From fe4d96ba28fb4c3eae1c488f2f1c14e100c43871 Mon Sep 17 00:00:00 2001
From: Dan Pasanen <dan.pasanen@gmail.com>
Date: Thu, 21 Sep 2017 09:55:42 -0500
Subject: [PATCH 0001/1835] arm: partially revert
 702b94bff3c50542a6e4ab9a4f4cef093262fe65

* Re-expose some dmi APIs for use in VCSM
---
 arch/arm/include/asm/cacheflush.h | 21 +++++++++++++++++++++
 arch/arm/include/asm/glue-cache.h |  2 ++
 arch/arm/mm/proc-macros.S         |  2 ++
 arch/arm/mm/proc-syms.c           |  3 +++
 4 files changed, 28 insertions(+)

diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index ec1a5fd0d2948..dc0a32fdde431 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -94,6 +94,21 @@
  *	DMA Cache Coherency
  *	===================
  *
+ *	dma_inv_range(start, end)
+ *
+ *		Invalidate (discard) the specified virtual address range.
+ *		May not write back any entries.  If 'start' or 'end'
+ *		are not cache line aligned, those lines must be written
+ *		back.
+ *		- start  - virtual start address
+ *		- end    - virtual end address
+ *
+ *	dma_clean_range(start, end)
+ *
+ *		Clean (write back) the specified virtual address range.
+ *		- start  - virtual start address
+ *		- end    - virtual end address
+ *
  *	dma_flush_range(start, end)
  *
  *		Clean and invalidate the specified virtual address range.
@@ -115,6 +130,8 @@ struct cpu_cache_fns {
 	void (*dma_map_area)(const void *, size_t, int);
 	void (*dma_unmap_area)(const void *, size_t, int);
 
+	void (*dma_inv_range)(const void *, const void *);
+	void (*dma_clean_range)(const void *, const void *);
 	void (*dma_flush_range)(const void *, const void *);
 } __no_randomize_layout;
 
@@ -140,6 +157,8 @@ extern struct cpu_cache_fns cpu_cache;
  * is visible to DMA, or data written by DMA to system memory is
  * visible to the CPU.
  */
+#define dmac_inv_range			cpu_cache.dma_inv_range
+#define dmac_clean_range		cpu_cache.dma_clean_range
 #define dmac_flush_range		cpu_cache.dma_flush_range
 
 #else
@@ -159,6 +178,8 @@ extern void __cpuc_flush_dcache_area(void *, size_t);
  * is visible to DMA, or data written by DMA to system memory is
  * visible to the CPU.
  */
+extern void dmac_inv_range(const void *, const void *);
+extern void dmac_clean_range(const void *, const void *);
 extern void dmac_flush_range(const void *, const void *);
 
 #endif
diff --git a/arch/arm/include/asm/glue-cache.h b/arch/arm/include/asm/glue-cache.h
index 8d1f498e5dd8e..0050d2246da86 100644
--- a/arch/arm/include/asm/glue-cache.h
+++ b/arch/arm/include/asm/glue-cache.h
@@ -158,6 +158,8 @@ static inline void nop_dma_unmap_area(const void *s, size_t l, int f) { }
 #define __cpuc_coherent_user_range	__glue(_CACHE,_coherent_user_range)
 #define __cpuc_flush_dcache_area	__glue(_CACHE,_flush_kern_dcache_area)
 
+#define dmac_inv_range			__glue(_CACHE,_dma_inv_range)
+#define dmac_clean_range		__glue(_CACHE,_dma_clean_range)
 #define dmac_flush_range		__glue(_CACHE,_dma_flush_range)
 #endif
 
diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index 5461d589a1e25..8d1d479a86fa9 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -335,6 +335,8 @@ ENTRY(\name\()_cache_fns)
 	.long	\name\()_flush_kern_dcache_area
 	.long	\name\()_dma_map_area
 	.long	\name\()_dma_unmap_area
+	.long	\name\()_dma_inv_range
+	.long	\name\()_dma_clean_range
 	.long	\name\()_dma_flush_range
 	.size	\name\()_cache_fns, . - \name\()_cache_fns
 .endm
diff --git a/arch/arm/mm/proc-syms.c b/arch/arm/mm/proc-syms.c
index 054b491ff7649..70e8b7d344346 100644
--- a/arch/arm/mm/proc-syms.c
+++ b/arch/arm/mm/proc-syms.c
@@ -30,6 +30,9 @@ EXPORT_SYMBOL(__cpuc_flush_user_all);
 EXPORT_SYMBOL(__cpuc_flush_user_range);
 EXPORT_SYMBOL(__cpuc_coherent_kern_range);
 EXPORT_SYMBOL(__cpuc_flush_dcache_area);
+EXPORT_SYMBOL(dmac_inv_range);
+EXPORT_SYMBOL(dmac_clean_range);
+EXPORT_SYMBOL(dmac_flush_range);
 #else
 EXPORT_SYMBOL(cpu_cache);
 #endif
-- 
GitLab


From 03b43f43f9234884a53777fe982e15073af00746 Mon Sep 17 00:00:00 2001
From: Steve Glendinning <steve.glendinning@smsc.com>
Date: Thu, 19 Feb 2015 18:47:12 +0000
Subject: [PATCH 0002/1835] smsx95xx: fix crimes against truesize

smsc95xx is adjusting truesize when it shouldn't, and following a recent patch from Eric this is now triggering warnings.

This patch stops smsc95xx from changing truesize.

Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
---
 drivers/net/usb/smsc95xx.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 6e971628bb50a..9f94e343e21c0 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -82,6 +82,10 @@ static bool turbo_mode = true;
 module_param(turbo_mode, bool, 0644);
 MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
 
+static bool truesize_mode = false;
+module_param(truesize_mode, bool, 0644);
+MODULE_PARM_DESC(truesize_mode, "Report larger truesize value");
+
 static int __must_check __smsc95xx_read_reg(struct usbnet *dev, u32 index,
 					    u32 *data, int in_pm)
 {
@@ -1972,7 +1976,8 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 				if (dev->net->features & NETIF_F_RXCSUM)
 					smsc95xx_rx_csum_offload(skb);
 				skb_trim(skb, skb->len - 4); /* remove fcs */
-				skb->truesize = size + sizeof(struct sk_buff);
+				if (truesize_mode)
+					skb->truesize = size + sizeof(struct sk_buff);
 
 				return 1;
 			}
@@ -1990,7 +1995,8 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 			if (dev->net->features & NETIF_F_RXCSUM)
 				smsc95xx_rx_csum_offload(ax_skb);
 			skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */
-			ax_skb->truesize = size + sizeof(struct sk_buff);
+			if (truesize_mode)
+				ax_skb->truesize = size + sizeof(struct sk_buff);
 
 			usbnet_skb_return(dev, ax_skb);
 		}
-- 
GitLab


From 684e7b822bbc440730a2f41cbeb847ee28c87d9d Mon Sep 17 00:00:00 2001
From: Sam Nazarko <email@samnazarko.co.uk>
Date: Fri, 1 Apr 2016 17:27:21 +0100
Subject: [PATCH 0003/1835] smsc95xx: Experimental: Enable turbo_mode and
 packetsize=2560 by default

See: http://forum.kodi.tv/showthread.php?tid=285288
---
 drivers/net/usb/smsc95xx.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 9f94e343e21c0..6429252d4f51e 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -86,6 +86,10 @@ static bool truesize_mode = false;
 module_param(truesize_mode, bool, 0644);
 MODULE_PARM_DESC(truesize_mode, "Report larger truesize value");
 
+static int packetsize = 2560;
+module_param(packetsize, int, 0644);
+MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
+
 static int __must_check __smsc95xx_read_reg(struct usbnet *dev, u32 index,
 					    u32 *data, int in_pm)
 {
@@ -1109,13 +1113,13 @@ static int smsc95xx_reset(struct usbnet *dev)
 
 	if (!turbo_mode) {
 		burst_cap = 0;
-		dev->rx_urb_size = MAX_SINGLE_PACKET_SIZE;
+		dev->rx_urb_size = packetsize ? packetsize : MAX_SINGLE_PACKET_SIZE;
 	} else if (dev->udev->speed == USB_SPEED_HIGH) {
-		burst_cap = DEFAULT_HS_BURST_CAP_SIZE / HS_USB_PKT_SIZE;
-		dev->rx_urb_size = DEFAULT_HS_BURST_CAP_SIZE;
+		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_HS_BURST_CAP_SIZE;
+		burst_cap = dev->rx_urb_size / HS_USB_PKT_SIZE;
 	} else {
-		burst_cap = DEFAULT_FS_BURST_CAP_SIZE / FS_USB_PKT_SIZE;
-		dev->rx_urb_size = DEFAULT_FS_BURST_CAP_SIZE;
+		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_FS_BURST_CAP_SIZE;
+		burst_cap = dev->rx_urb_size / FS_USB_PKT_SIZE;
 	}
 
 	netif_dbg(dev, ifup, dev->net, "rx_urb_size=%ld\n",
-- 
GitLab


From aac7b105788eabc21b825d67707d3941688df5b1 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 26 Mar 2013 17:26:38 +0000
Subject: [PATCH 0004/1835] Allow mac address to be set in smsc95xx

Signed-off-by: popcornmix <popcornmix@gmail.com>
---
 drivers/net/usb/smsc95xx.c | 56 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 6429252d4f51e..a5bbec75f22dc 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -60,6 +60,7 @@
 #define SUSPEND_SUSPEND3		(0x08)
 #define SUSPEND_ALLMODES		(SUSPEND_SUSPEND0 | SUSPEND_SUSPEND1 | \
 					 SUSPEND_SUSPEND2 | SUSPEND_SUSPEND3)
+#define MAC_ADDR_LEN                    (6)
 
 #define CARRIER_CHECK_DELAY (2 * HZ)
 
@@ -90,6 +91,10 @@ static int packetsize = 2560;
 module_param(packetsize, int, 0644);
 MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
 
+static char *macaddr = ":";
+module_param(macaddr, charp, 0);
+MODULE_PARM_DESC(macaddr, "MAC address");
+
 static int __must_check __smsc95xx_read_reg(struct usbnet *dev, u32 index,
 					    u32 *data, int in_pm)
 {
@@ -921,6 +926,53 @@ static int smsc95xx_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
 	return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
 }
 
+/* Check the macaddr module parameter for a MAC address */
+static int smsc95xx_is_macaddr_param(struct usbnet *dev, u8 *dev_mac)
+{
+       int i, j, got_num, num;
+       u8 mtbl[MAC_ADDR_LEN];
+
+       if (macaddr[0] == ':')
+               return 0;
+
+       i = 0;
+       j = 0;
+       num = 0;
+       got_num = 0;
+       while (j < MAC_ADDR_LEN) {
+               if (macaddr[i] && macaddr[i] != ':') {
+                       got_num++;
+                       if ('0' <= macaddr[i] && macaddr[i] <= '9')
+                               num = num * 16 + macaddr[i] - '0';
+                       else if ('A' <= macaddr[i] && macaddr[i] <= 'F')
+                               num = num * 16 + 10 + macaddr[i] - 'A';
+                       else if ('a' <= macaddr[i] && macaddr[i] <= 'f')
+                               num = num * 16 + 10 + macaddr[i] - 'a';
+                       else
+                               break;
+                       i++;
+               } else if (got_num == 2) {
+                       mtbl[j++] = (u8) num;
+                       num = 0;
+                       got_num = 0;
+                       i++;
+               } else {
+                       break;
+               }
+       }
+
+       if (j == MAC_ADDR_LEN) {
+               netif_dbg(dev, ifup, dev->net, "Overriding MAC address with: "
+               "%02x:%02x:%02x:%02x:%02x:%02x\n", mtbl[0], mtbl[1], mtbl[2],
+                                               mtbl[3], mtbl[4], mtbl[5]);
+               for (i = 0; i < MAC_ADDR_LEN; i++)
+                       dev_mac[i] = mtbl[i];
+               return 1;
+       } else {
+               return 0;
+       }
+}
+
 static void smsc95xx_init_mac_address(struct usbnet *dev)
 {
 	const u8 *mac_addr;
@@ -942,6 +994,10 @@ static void smsc95xx_init_mac_address(struct usbnet *dev)
 		}
 	}
 
+	/* Check module parameters */
+	if (smsc95xx_is_macaddr_param(dev, dev->net->dev_addr))
+		return;
+
 	/* no useful static MAC address found. generate a random one */
 	eth_hw_addr_random(dev->net);
 	netif_dbg(dev, ifup, dev->net, "MAC address set to eth_random_addr\n");
-- 
GitLab


From 2a63ec227a8445d38985600ed9deec72626b3a9d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 13 Mar 2015 12:43:36 +0000
Subject: [PATCH 0005/1835] Protect __release_resource against resources
 without parents

Without this patch, removing a device tree overlay can crash here.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 kernel/resource.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/kernel/resource.c b/kernel/resource.c
index 30e1bc68503b5..fd0f8be84ccc7 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -213,6 +213,12 @@ static int __release_resource(struct resource *old, bool release_child)
 {
 	struct resource *tmp, **p, *chd;
 
+	if (!old->parent) {
+		WARN(old->sibling, "sibling but no parent");
+		if (old->sibling)
+			return -EINVAL;
+		return 0;
+	}
 	p = &old->parent->child;
 	for (;;) {
 		tmp = *p;
-- 
GitLab


From 1b58c8cdb6d9ce5e9090f9894ee449503f5fc4d8 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 4 Dec 2015 17:41:50 +0000
Subject: [PATCH 0006/1835] irq-bcm2836: Prevent spurious interrupts, and trap
 them early

The old arch-specific IRQ macros included a dsb to ensure the
write to clear the mailbox interrupt completed before returning
from the interrupt. The BCM2836 irqchip driver needs the same
precaution to avoid spurious interrupts.

Spurious interrupts are still possible for other reasons,
though, so trap them early.
---
 drivers/irqchip/irq-bcm2836.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-bcm2836.c b/drivers/irqchip/irq-bcm2836.c
index dfe4a460340b9..5f881829615c1 100644
--- a/drivers/irqchip/irq-bcm2836.c
+++ b/drivers/irqchip/irq-bcm2836.c
@@ -144,6 +144,7 @@ __exception_irq_entry bcm2836_arm_irqchip_handle_irq(struct pt_regs *regs)
 		u32 ipi = ffs(mbox_val) - 1;
 
 		writel(1 << ipi, mailbox0);
+		dsb(sy);
 		handle_IPI(ipi, regs);
 #endif
 	} else if (stat) {
-- 
GitLab


From 027259c79e05164a86d3d33bba666784dda45fb4 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 9 Feb 2017 14:33:30 +0000
Subject: [PATCH 0007/1835] irq-bcm2836: Avoid "Invalid trigger warning"

Initialise the level for each IRQ to avoid a warning from the
arm arch timer code.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/irqchip/irq-bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-bcm2836.c b/drivers/irqchip/irq-bcm2836.c
index 5f881829615c1..9d0f221a1daa5 100644
--- a/drivers/irqchip/irq-bcm2836.c
+++ b/drivers/irqchip/irq-bcm2836.c
@@ -124,7 +124,7 @@ static int bcm2836_map(struct irq_domain *d, unsigned int irq,
 	irq_set_percpu_devid(irq);
 	irq_domain_set_info(d, irq, hw, chip, d->host_data,
 			    handle_percpu_devid_irq, NULL, NULL);
-	irq_set_status_flags(irq, IRQ_NOAUTOEN);
+	irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_TYPE_LEVEL_LOW);
 
 	return 0;
 }
-- 
GitLab


From df66d1565d89f528f26c860b927a0359354b1a1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Fri, 12 Jun 2015 19:01:05 +0200
Subject: [PATCH 0008/1835] irqchip: bcm2835: Add FIQ support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a duplicate irq range with an offset on the hwirq's so the
driver can detect that enable_fiq() is used.
Tested with downstream dwc_otg USB controller driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
---
 arch/arm/mach-bcm/Kconfig     |  1 +
 drivers/irqchip/irq-bcm2835.c | 51 +++++++++++++++++++++++++++++++----
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig
index 25aac6ee2ab18..4686dccb91d54 100644
--- a/arch/arm/mach-bcm/Kconfig
+++ b/arch/arm/mach-bcm/Kconfig
@@ -165,6 +165,7 @@ config ARCH_BCM2835
 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
 	select TIMER_OF
 	select BCM2835_TIMER
+	select FIQ
 	select PINCTRL
 	select PINCTRL_BCM2835
 	help
diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index d2da8a1e6b1b7..c4903360eabc2 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -54,7 +54,7 @@
 #include <asm/exception.h>
 
 /* Put the bank and irq (32 bits) into the hwirq */
-#define MAKE_HWIRQ(b, n)	((b << 5) | (n))
+#define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
 #define HWIRQ_BANK(i)		(i >> 5)
 #define HWIRQ_BIT(i)		BIT(i & 0x1f)
 
@@ -70,9 +70,13 @@
 					| SHORTCUT1_MASK | SHORTCUT2_MASK)
 
 #define REG_FIQ_CONTROL		0x0c
+#define REG_FIQ_ENABLE		0x80
+#define REG_FIQ_DISABLE		0
 
 #define NR_BANKS		3
 #define IRQS_PER_BANK		32
+#define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
+#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
 
 static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
 static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
@@ -97,14 +101,38 @@ static void __exception_irq_entry bcm2835_handle_irq(
 	struct pt_regs *regs);
 static void bcm2836_chained_handle_irq(struct irq_desc *desc);
 
+static inline unsigned int hwirq_to_fiq(unsigned long hwirq)
+{
+	hwirq -= NUMBER_IRQS;
+	/*
+	 * The hwirq numbering used in this driver is:
+	 *   BASE (0-7) GPU1 (32-63) GPU2 (64-95).
+	 * This differ from the one used in the FIQ register:
+	 *   GPU1 (0-31) GPU2 (32-63) BASE (64-71)
+	 */
+	if (hwirq >= 32)
+		return hwirq - 32;
+
+	return hwirq + 64;
+}
+
 static void armctrl_mask_irq(struct irq_data *d)
 {
-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.disable[HWIRQ_BANK(d->hwirq)]);
+	if (d->hwirq >= NUMBER_IRQS)
+		writel_relaxed(REG_FIQ_DISABLE, intc.base + REG_FIQ_CONTROL);
+	else
+		writel_relaxed(HWIRQ_BIT(d->hwirq),
+			       intc.disable[HWIRQ_BANK(d->hwirq)]);
 }
 
 static void armctrl_unmask_irq(struct irq_data *d)
 {
-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.enable[HWIRQ_BANK(d->hwirq)]);
+	if (d->hwirq >= NUMBER_IRQS)
+		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
+			       intc.base + REG_FIQ_CONTROL);
+	else
+		writel_relaxed(HWIRQ_BIT(d->hwirq),
+			       intc.enable[HWIRQ_BANK(d->hwirq)]);
 }
 
 static struct irq_chip armctrl_chip = {
@@ -149,8 +177,9 @@ static int __init armctrl_of_init(struct device_node *node,
 	if (!base)
 		panic("%pOF: unable to map IC registers\n", node);
 
-	intc.domain = irq_domain_add_linear(node, MAKE_HWIRQ(NR_BANKS, 0),
-			&armctrl_ops, NULL);
+	intc.base = base;
+	intc.domain = irq_domain_add_linear(node, NUMBER_IRQS * 2,
+					    &armctrl_ops, NULL);
 	if (!intc.domain)
 		panic("%pOF: unable to create IRQ domain\n", node);
 
@@ -180,6 +209,18 @@ static int __init armctrl_of_init(struct device_node *node,
 		set_handle_irq(bcm2835_handle_irq);
 	}
 
+	/* Make a duplicate irq range which is used to enable FIQ */
+	for (b = 0; b < NR_BANKS; b++) {
+		for (i = 0; i < bank_irqs[b]; i++) {
+			irq = irq_create_mapping(intc.domain,
+					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
+			BUG_ON(irq <= 0);
+			irq_set_chip(irq, &armctrl_chip);
+			set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+		}
+	}
+	init_FIQ(FIQ_START);
+
 	return 0;
 }
 
-- 
GitLab


From 44aca82afe466736130a697a97c5b072a8d14cfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Fri, 23 Oct 2015 16:26:55 +0200
Subject: [PATCH 0009/1835] irqchip: irq-bcm2835: Add 2836 FIQ support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/irqchip/irq-bcm2835.c | 43 +++++++++++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index c4903360eabc2..13356d3b7bcd5 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -50,8 +50,11 @@
 #include <linux/of_irq.h>
 #include <linux/irqchip.h>
 #include <linux/irqdomain.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
 
 #include <asm/exception.h>
+#include <asm/mach/irq.h>
 
 /* Put the bank and irq (32 bits) into the hwirq */
 #define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
@@ -69,6 +72,9 @@
 #define BANK0_VALID_MASK	(BANK0_HWIRQ_MASK | BANK1_HWIRQ | BANK2_HWIRQ \
 					| SHORTCUT1_MASK | SHORTCUT2_MASK)
 
+#undef ARM_LOCAL_GPU_INT_ROUTING
+#define ARM_LOCAL_GPU_INT_ROUTING 0x0c
+
 #define REG_FIQ_CONTROL		0x0c
 #define REG_FIQ_ENABLE		0x80
 #define REG_FIQ_DISABLE		0
@@ -94,6 +100,7 @@ struct armctrl_ic {
 	void __iomem *enable[NR_BANKS];
 	void __iomem *disable[NR_BANKS];
 	struct irq_domain *domain;
+	struct regmap *local_regmap;
 };
 
 static struct armctrl_ic intc __read_mostly;
@@ -127,12 +134,35 @@ static void armctrl_mask_irq(struct irq_data *d)
 
 static void armctrl_unmask_irq(struct irq_data *d)
 {
-	if (d->hwirq >= NUMBER_IRQS)
+	if (d->hwirq >= NUMBER_IRQS) {
+		if (num_online_cpus() > 1) {
+			unsigned int data;
+			int ret;
+
+			if (!intc.local_regmap) {
+				pr_err("FIQ is disabled due to missing regmap\n");
+				return;
+			}
+
+			ret = regmap_read(intc.local_regmap,
+					  ARM_LOCAL_GPU_INT_ROUTING, &data);
+			if (ret) {
+				pr_err("Failed to read int routing %d\n", ret);
+				return;
+			}
+
+			data &= ~0xc;
+			data |= (1 << 2);
+			regmap_write(intc.local_regmap,
+				     ARM_LOCAL_GPU_INT_ROUTING, data);
+		}
+
 		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
 			       intc.base + REG_FIQ_CONTROL);
-	else
+	} else {
 		writel_relaxed(HWIRQ_BIT(d->hwirq),
 			       intc.enable[HWIRQ_BANK(d->hwirq)]);
+	}
 }
 
 static struct irq_chip armctrl_chip = {
@@ -209,6 +239,15 @@ static int __init armctrl_of_init(struct device_node *node,
 		set_handle_irq(bcm2835_handle_irq);
 	}
 
+	if (is_2836) {
+		intc.local_regmap =
+			syscon_regmap_lookup_by_compatible("brcm,bcm2836-arm-local");
+		if (IS_ERR(intc.local_regmap)) {
+			pr_err("Failed to get local register map. FIQ is disabled for cpus > 1\n");
+			intc.local_regmap = NULL;
+		}
+	}
+
 	/* Make a duplicate irq range which is used to enable FIQ */
 	for (b = 0; b < NR_BANKS; b++) {
 		for (i = 0; i < bank_irqs[b]; i++) {
-- 
GitLab


From 08a5925fbb502947cec524995f8df1612b248d76 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 14 Jul 2015 10:26:09 +0100
Subject: [PATCH 0010/1835] spidev: Add "spidev" compatible string to silence
 warning

See: https://github.com/raspberrypi/linux/issues/1054
---
 drivers/spi/spidev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index cda10719d1d1b..4f3779d3aa096 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -669,6 +669,7 @@ static const struct of_device_id spidev_dt_ids[] = {
 	{ .compatible = "lineartechnology,ltc2488" },
 	{ .compatible = "ge,achc" },
 	{ .compatible = "semtech,sx1301" },
+	{ .compatible = "spidev" },
 	{},
 };
 MODULE_DEVICE_TABLE(of, spidev_dt_ids);
-- 
GitLab


From 0508d0d78fe8138ef653939cfb70cb1c8705f189 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 24 Jun 2015 14:10:44 +0100
Subject: [PATCH 0011/1835] spi-bcm2835: Support pin groups other than 7-11

The spi-bcm2835 driver automatically uses GPIO chip-selects due to
some unreliability of the native ones. In doing so it chooses the
same pins as the native chip-selects would use, but the existing
code always uses pins 7 and 8, wherever the SPI function is mapped.

Search the pinctrl group assigned to the driver for pins that
correspond to native chip-selects, and use those for GPIO chip-
selects.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/spi/spi-bcm2835.c | 45 ++++++++++++++++++++++++++++++++-------
 1 file changed, 37 insertions(+), 8 deletions(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 25abf2d1732a0..23ec074b1fb69 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -686,6 +686,8 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 {
 	int err;
 	struct gpio_chip *chip;
+	struct device_node *pins;
+	u32 pingroup_index;
 	/*
 	 * sanity checking the native-chipselects
 	 */
@@ -702,15 +704,42 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 			"setup: only two native chip-selects are supported\n");
 		return -EINVAL;
 	}
-	/* now translate native cs to GPIO */
-
-	/* get the gpio chip for the base */
-	chip = gpiochip_find("pinctrl-bcm2835", chip_match_name);
-	if (!chip)
-		return 0;
 
-	/* and calculate the real CS */
-	spi->cs_gpio = chip->base + 8 - spi->chip_select;
+	/* now translate native cs to GPIO */
+	/* first look for chip select pins in the devices pin groups */
+	for (pingroup_index = 0;
+	     (pins = of_parse_phandle(spi->master->dev.of_node,
+				     "pinctrl-0",
+				      pingroup_index)) != 0;
+	     pingroup_index++) {
+		u32 pin;
+		u32 pin_index;
+		for (pin_index = 0;
+		     of_property_read_u32_index(pins,
+						"brcm,pins",
+						pin_index,
+						&pin) == 0;
+		     pin_index++) {
+			if (((spi->chip_select == 0) &&
+			     ((pin == 8) || (pin == 36) || (pin == 46))) ||
+			    ((spi->chip_select == 1) &&
+			     ((pin == 7) || (pin == 35)))) {
+				spi->cs_gpio = pin;
+				break;
+			}
+		}
+		of_node_put(pins);
+	}
+	/* if that fails, assume GPIOs 7-11 are used */
+	if (!gpio_is_valid(spi->cs_gpio) ) {
+		/* get the gpio chip for the base */
+		chip = gpiochip_find("pinctrl-bcm2835", chip_match_name);
+		if (!chip)
+			return 0;
+
+		/* and calculate the real CS */
+		spi->cs_gpio = chip->base + 8 - spi->chip_select;
+	}
 
 	/* and set up the "mode" and level */
 	dev_info(&spi->dev, "setting up native-CS%i as GPIO %i\n",
-- 
GitLab


From f1d50c111bfb8a8be31b44f731b6be98f757abd0 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 1 Jul 2016 22:09:24 +0100
Subject: [PATCH 0012/1835] spi-bcm2835: Disable forced software CS

Select software CS in bcm2708_common.dtsi, and disable the automatic
conversion in the driver to allow hardware CS to be re-enabled with an
overlay.

See: https://github.com/raspberrypi/linux/issues/1547

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/spi/spi-bcm2835.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 23ec074b1fb69..f9f9bf7d0df8c 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -705,6 +705,7 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 		return -EINVAL;
 	}
 
+#if 0
 	/* now translate native cs to GPIO */
 	/* first look for chip select pins in the devices pin groups */
 	for (pingroup_index = 0;
@@ -754,6 +755,7 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 			spi->chip_select, spi->cs_gpio, err);
 		return err;
 	}
+#endif
 
 	return 0;
 }
-- 
GitLab


From eb321e0448eedf5692cc5a1dbaf089a9c74cad24 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 8 Nov 2016 21:35:38 +0000
Subject: [PATCH 0013/1835] spi-bcm2835: Remove unused code

---
 drivers/spi/spi-bcm2835.c | 61 ---------------------------------------
 1 file changed, 61 deletions(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index f9f9bf7d0df8c..5816bae19d584 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -677,17 +677,8 @@ static void bcm2835_spi_set_cs(struct spi_device *spi, bool gpio_level)
 	bcm2835_wr(bs, BCM2835_SPI_CS, cs);
 }
 
-static int chip_match_name(struct gpio_chip *chip, void *data)
-{
-	return !strcmp(chip->label, data);
-}
-
 static int bcm2835_spi_setup(struct spi_device *spi)
 {
-	int err;
-	struct gpio_chip *chip;
-	struct device_node *pins;
-	u32 pingroup_index;
 	/*
 	 * sanity checking the native-chipselects
 	 */
@@ -705,58 +696,6 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 		return -EINVAL;
 	}
 
-#if 0
-	/* now translate native cs to GPIO */
-	/* first look for chip select pins in the devices pin groups */
-	for (pingroup_index = 0;
-	     (pins = of_parse_phandle(spi->master->dev.of_node,
-				     "pinctrl-0",
-				      pingroup_index)) != 0;
-	     pingroup_index++) {
-		u32 pin;
-		u32 pin_index;
-		for (pin_index = 0;
-		     of_property_read_u32_index(pins,
-						"brcm,pins",
-						pin_index,
-						&pin) == 0;
-		     pin_index++) {
-			if (((spi->chip_select == 0) &&
-			     ((pin == 8) || (pin == 36) || (pin == 46))) ||
-			    ((spi->chip_select == 1) &&
-			     ((pin == 7) || (pin == 35)))) {
-				spi->cs_gpio = pin;
-				break;
-			}
-		}
-		of_node_put(pins);
-	}
-	/* if that fails, assume GPIOs 7-11 are used */
-	if (!gpio_is_valid(spi->cs_gpio) ) {
-		/* get the gpio chip for the base */
-		chip = gpiochip_find("pinctrl-bcm2835", chip_match_name);
-		if (!chip)
-			return 0;
-
-		/* and calculate the real CS */
-		spi->cs_gpio = chip->base + 8 - spi->chip_select;
-	}
-
-	/* and set up the "mode" and level */
-	dev_info(&spi->dev, "setting up native-CS%i as GPIO %i\n",
-		 spi->chip_select, spi->cs_gpio);
-
-	/* set up GPIO as output and pull to the correct level */
-	err = gpio_direction_output(spi->cs_gpio,
-				    (spi->mode & SPI_CS_HIGH) ? 0 : 1);
-	if (err) {
-		dev_err(&spi->dev,
-			"could not set CS%i gpio %i as output: %i",
-			spi->chip_select, spi->cs_gpio, err);
-		return err;
-	}
-#endif
-
 	return 0;
 }
 
-- 
GitLab


From a47f88e5a006170b202ec266b5afdf1742501bf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Sat, 3 Oct 2015 22:22:55 +0200
Subject: [PATCH 0014/1835] dmaengine: bcm2835: Load driver early and support
 legacy API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Load driver early since at least bcm2708_fb doesn't support deferred
probing and even if it did, we don't want the video driver deferred.
Support the legacy DMA API which is needed by bcm2708_fb.
Don't mask out channel 2.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/dma/Kconfig       |  2 +-
 drivers/dma/bcm2835-dma.c | 26 +++++++++++++++++++++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index dacf3f42426de..a4697f1d6ee5c 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -131,7 +131,7 @@ config COH901318
 
 config DMA_BCM2835
 	tristate "BCM2835 DMA engine support"
-	depends on ARCH_BCM2835
+	depends on ARCH_BCM2835 || ARCH_BCM2708 || ARCH_BCM2709
 	select DMA_ENGINE
 	select DMA_VIRTUAL_CHANNELS
 
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 2b11d967acd02..b676908ef5fa2 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -37,6 +37,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/platform_data/dma-bcm2708.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/io.h>
@@ -48,6 +49,7 @@
 
 #define BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED 14
 #define BCM2835_DMA_CHAN_NAME_SIZE 8
+#define BCM2835_DMA_BULK_MASK  BIT(0)
 
 struct bcm2835_dmadev {
 	struct dma_device ddev;
@@ -912,6 +914,9 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 	base = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(base))
 		return PTR_ERR(base);
+	rc = bcm_dmaman_probe(pdev, base, BCM2835_DMA_BULK_MASK);
+	if (rc)
+		dev_err(&pdev->dev, "Failed to initialize the legacy API\n");
 
 	od->base = base;
 
@@ -950,6 +955,9 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 		goto err_no_dma;
 	}
 
+	/* Channel 0 is used by the legacy API */
+	chans_available &= ~BCM2835_DMA_BULK_MASK;
+
 	/* get irqs for each channel that we support */
 	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
 		/* skip masked out channels */
@@ -1024,6 +1032,7 @@ static int bcm2835_dma_remove(struct platform_device *pdev)
 {
 	struct bcm2835_dmadev *od = platform_get_drvdata(pdev);
 
+	bcm_dmaman_remove(pdev);
 	dma_async_device_unregister(&od->ddev);
 	bcm2835_dma_free(od);
 
@@ -1039,7 +1048,22 @@ static struct platform_driver bcm2835_dma_driver = {
 	},
 };
 
-module_platform_driver(bcm2835_dma_driver);
+static int bcm2835_dma_init(void)
+{
+	return platform_driver_register(&bcm2835_dma_driver);
+}
+
+static void bcm2835_dma_exit(void)
+{
+	platform_driver_unregister(&bcm2835_dma_driver);
+}
+
+/*
+ * Load after serial driver (arch_initcall) so we see the messages if it fails,
+ * but before drivers (module_init) that need a DMA channel.
+ */
+subsys_initcall(bcm2835_dma_init);
+module_exit(bcm2835_dma_exit);
 
 MODULE_ALIAS("platform:bcm2835-dma");
 MODULE_DESCRIPTION("BCM2835 DMA engine driver");
-- 
GitLab


From 90ef1547592c8ba8d7cc77716df24f888dfa5928 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 25 Jan 2016 17:25:12 +0000
Subject: [PATCH 0015/1835] firmware: Updated mailbox header

---
 include/soc/bcm2835/raspberrypi-firmware.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index c4a5c9e9fb478..5a77cb921cf42 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -12,6 +12,8 @@
 #include <linux/types.h>
 #include <linux/of_device.h>
 
+#define RPI_FIRMWARE_CHAN_FB		1
+
 struct rpi_firmware;
 
 enum rpi_firmware_property_status {
@@ -76,6 +78,8 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
 	RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
 	RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
+	RPI_FIRMWARE_GET_CLOCK_MEASURED =                     0x00030047,
+	RPI_FIRMWARE_NOTIFY_REBOOT =                          0x00030048,
 	RPI_FIRMWARE_SET_CLOCK_STATE =                        0x00038001,
 	RPI_FIRMWARE_SET_CLOCK_RATE =                         0x00038002,
 	RPI_FIRMWARE_SET_VOLTAGE =                            0x00038003,
@@ -158,5 +162,6 @@ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware
 	return NULL;
 }
 #endif
+int rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data);
 
 #endif /* __SOC_RASPBERRY_FIRMWARE_H__ */
-- 
GitLab


From 4a3ab35a77b492b386913c1dc1899357c32ea185 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 15 Jun 2016 16:48:41 +0100
Subject: [PATCH 0016/1835] rtc: Add SPI alias for pcf2123 driver

Without this alias, Device Tree won't cause the driver
to be loaded.

See: https://github.com/raspberrypi/linux/pull/1510
---
 drivers/rtc/rtc-pcf2123.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
index e5222c5d82238..f97ee62f8e107 100644
--- a/drivers/rtc/rtc-pcf2123.c
+++ b/drivers/rtc/rtc-pcf2123.c
@@ -472,3 +472,4 @@ module_spi_driver(pcf2123_driver);
 MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>");
 MODULE_DESCRIPTION("NXP PCF2123 RTC driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("spi:rtc-pcf2123");
-- 
GitLab


From 413471603d965102425b146d305311324ddc780b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Fri, 7 Oct 2016 16:50:59 +0200
Subject: [PATCH 0017/1835] watchdog: bcm2835: Support setting reboot partition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Raspberry Pi firmware looks at the RSTS register to know which
partition to boot from. The reboot syscall command
LINUX_REBOOT_CMD_RESTART2 supports passing in a string argument.

Add support for passing in a partition number 0..63 to boot from.
Partition 63 is a special partiton indicating halt.
If the partition doesn't exist, the firmware falls back to partition 0.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/watchdog/bcm2835_wdt.c | 49 +++++++++++++++++++---------------
 1 file changed, 27 insertions(+), 22 deletions(-)

diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index ed05514cc2dce..9699e07119a72 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -31,13 +31,7 @@
 #define PM_RSTC_WRCFG_SET		0x00000030
 #define PM_RSTC_WRCFG_FULL_RESET	0x00000020
 #define PM_RSTC_RESET			0x00000102
-
-/*
- * The Raspberry Pi firmware uses the RSTS register to know which partition
- * to boot from. The partition value is spread into bits 0, 2, 4, 6, 8, 10.
- * Partition 63 is a special partition used by the firmware to indicate halt.
- */
-#define PM_RSTS_RASPBERRYPI_HALT	0x555
+#define PM_RSTS_PARTITION_CLR          0xfffffaaa
 
 #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
 #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
@@ -94,9 +88,24 @@ static unsigned int bcm2835_wdt_get_timeleft(struct watchdog_device *wdog)
 	return WDOG_TICKS_TO_SECS(ret & PM_WDOG_TIME_SET);
 }
 
-static void __bcm2835_restart(struct bcm2835_wdt *wdt)
+/*
+ * The Raspberry Pi firmware uses the RSTS register to know which partiton
+ * to boot from. The partiton value is spread into bits 0, 2, 4, 6, 8, 10.
+ * Partiton 63 is a special partition used by the firmware to indicate halt.
+ */
+
+static void __bcm2835_restart(struct bcm2835_wdt *wdt, u8 partition)
 {
-	u32 val;
+	u32 val, rsts;
+
+	rsts = (partition & BIT(0)) | ((partition & BIT(1)) << 1) |
+	       ((partition & BIT(2)) << 2) | ((partition & BIT(3)) << 3) |
+	       ((partition & BIT(4)) << 4) | ((partition & BIT(5)) << 5);
+
+	val = readl_relaxed(wdt->base + PM_RSTS);
+	val &= PM_RSTS_PARTITION_CLR;
+	val |= PM_PASSWORD | rsts;
+	writel_relaxed(val, wdt->base + PM_RSTS);
 
 	/* use a timeout of 10 ticks (~150us) */
 	writel_relaxed(10 | PM_PASSWORD, wdt->base + PM_WDOG);
@@ -114,7 +123,13 @@ static int bcm2835_restart(struct watchdog_device *wdog,
 {
 	struct bcm2835_wdt *wdt = watchdog_get_drvdata(wdog);
 
-	__bcm2835_restart(wdt);
+	unsigned long long val;
+	u8 partition = 0;
+
+	if (data && !kstrtoull(data, 0, &val) && val <= 63)
+		partition = val;
+
+	__bcm2835_restart(wdt, partition);
 
 	return 0;
 }
@@ -152,19 +167,9 @@ static void bcm2835_power_off(void)
 		of_find_compatible_node(NULL, NULL, "brcm,bcm2835-pm-wdt");
 	struct platform_device *pdev = of_find_device_by_node(np);
 	struct bcm2835_wdt *wdt = platform_get_drvdata(pdev);
-	u32 val;
-
-	/*
-	 * We set the watchdog hard reset bit here to distinguish this reset
-	 * from the normal (full) reset. bootcode.bin will not reboot after a
-	 * hard reset.
-	 */
-	val = readl_relaxed(wdt->base + PM_RSTS);
-	val |= PM_PASSWORD | PM_RSTS_RASPBERRYPI_HALT;
-	writel_relaxed(val, wdt->base + PM_RSTS);
 
-	/* Continue with normal reset mechanism */
-	__bcm2835_restart(wdt);
+	/* Partition 63 tells the firmware that this is a halt */
+	__bcm2835_restart(wdt, 63);
 }
 
 static int bcm2835_wdt_probe(struct platform_device *pdev)
-- 
GitLab


From 1f2a0e5309bfad5ffffe720829c687ec94f0eb79 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 5 Apr 2016 19:40:12 +0100
Subject: [PATCH 0018/1835] reboot: Use power off rather than busy spinning
 when halt is requested

---
 arch/arm/kernel/reboot.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c
index 3b2aa9a9fe268..0180d89a34af4 100644
--- a/arch/arm/kernel/reboot.c
+++ b/arch/arm/kernel/reboot.c
@@ -105,9 +105,7 @@ void machine_shutdown(void)
  */
 void machine_halt(void)
 {
-	local_irq_disable();
-	smp_send_stop();
-	while (1);
+	machine_power_off();
 }
 
 /*
-- 
GitLab


From 261c3c9f51dcd93c6ab088f31238dc541ee46f76 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 9 Nov 2016 13:02:52 +0000
Subject: [PATCH 0019/1835] bcm: Make RASPBERRYPI_POWER depend on PM

---
 drivers/soc/bcm/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/bcm/Kconfig b/drivers/soc/bcm/Kconfig
index 055a845ed979b..587c61998b722 100644
--- a/drivers/soc/bcm/Kconfig
+++ b/drivers/soc/bcm/Kconfig
@@ -4,6 +4,7 @@ config RASPBERRYPI_POWER
 	bool "Raspberry Pi power domain driver"
 	depends on ARCH_BCM2835 || (COMPILE_TEST && OF)
 	depends on RASPBERRYPI_FIRMWARE=y
+	depends on PM
 	select PM_GENERIC_DOMAINS if PM
 	help
 	  This enables support for the RPi power domains which can be enabled
-- 
GitLab


From b15c626fb2c5d44f3a9e78ad4dc0f9d01a59b14e Mon Sep 17 00:00:00 2001
From: Martin Sperl <kernel@martin.sperl.org>
Date: Fri, 2 Sep 2016 16:45:27 +0100
Subject: [PATCH 0020/1835] Register the clocks early during the boot process,
 so that special/critical clocks can get enabled early on in the boot process
 avoiding the risk of disabling a clock, pll_divider or pll when a claiming
 driver fails to install propperly - maybe it needs to defer.

Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
---
 drivers/clk/bcm/clk-bcm2835.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 7bef0666ae7e7..6c2eac8deafdb 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -2184,8 +2184,15 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	return of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
+	ret = of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
 				      &cprman->onecell);
+	if (ret)
+		return ret;
+
+	/* note that we have registered all the clocks */
+	dev_dbg(dev, "registered %d clocks\n", asize);
+
+	return 0;
 }
 
 static const struct of_device_id bcm2835_clk_of_match[] = {
@@ -2202,7 +2209,11 @@ static struct platform_driver bcm2835_clk_driver = {
 	.probe          = bcm2835_clk_probe,
 };
 
-builtin_platform_driver(bcm2835_clk_driver);
+static int __init __bcm2835_clk_driver_init(void)
+{
+	return platform_driver_register(&bcm2835_clk_driver);
+}
+core_initcall(__bcm2835_clk_driver_init);
 
 MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
 MODULE_DESCRIPTION("BCM2835 clock driver");
-- 
GitLab


From 95d028c42d306983552bd160ead7d06cf272b1fa Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 6 Dec 2016 17:05:39 +0000
Subject: [PATCH 0021/1835] bcm2835-rng: Avoid initialising if already enabled

Avoids the 0x40000 cycles of warmup again if firmware has already used it
---
 drivers/char/hw_random/bcm2835-rng.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
index 6767d965c36c5..186fe2fcfeacc 100644
--- a/drivers/char/hw_random/bcm2835-rng.c
+++ b/drivers/char/hw_random/bcm2835-rng.c
@@ -105,8 +105,10 @@ static int bcm2835_rng_init(struct hwrng *rng)
 	}
 
 	/* set warm-up count & enable */
-	rng_writel(priv, RNG_WARMUP_COUNT, RNG_STATUS);
-	rng_writel(priv, RNG_RBGEN, RNG_CTRL);
+	if (!(rng_readl(priv, RNG_CTRL) & RNG_RBGEN)) {
+		rng_writel(priv, RNG_WARMUP_COUNT, RNG_STATUS);
+		rng_writel(priv, RNG_RBGEN, RNG_CTRL);
+	}
 
 	return ret;
 }
-- 
GitLab


From 203418790be97a572750f25d7d8257a321ca2c08 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 24 Aug 2016 16:28:44 +0100
Subject: [PATCH 0022/1835] kbuild: Ignore dtco targets when filtering symbols

---
 scripts/Kbuild.include | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index ce53639a864a1..6d9e4233e66af 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -287,7 +287,7 @@ ksym_dep_filter =                                                            \
 	    $(CPP) $(call flags_nodeps,c_flags) -D__KSYM_DEPS__ $< ;;        \
 	  as_*_S|cpp_s_S)                                                    \
 	    $(CPP) $(call flags_nodeps,a_flags) -D__KSYM_DEPS__ $< ;;        \
-	  boot*|build*|cpp_its_S|*cpp_lds_S|dtc|host*|vdso*) : ;;            \
+	  boot*|build*|cpp_its_S|*cpp_lds_S|dtc*|host*|vdso*) : ;;            \
 	  *) echo "Don't know how to preprocess $(1)" >&2; false ;;          \
 	esac | tr ";" "\n" | sed -n 's/^.*=== __KSYM_\(.*\) ===.*$$/_\1/p'
 
-- 
GitLab


From 783b1d3fbfe95aea79cf9bdb8d82d65a3be770dd Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 13 Feb 2017 17:20:08 +0000
Subject: [PATCH 0023/1835] clk-bcm2835: Mark used PLLs and dividers CRITICAL

The VPU configures and relies on several PLLs and dividers. Mark all
enabled dividers and their PLLs as CRITICAL to prevent the kernel from
switching them off.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/clk/bcm/clk-bcm2835.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 6c2eac8deafdb..841e2525ed539 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1362,6 +1362,11 @@ bcm2835_register_pll_divider(struct bcm2835_cprman *cprman,
 	divider->div.hw.init = &init;
 	divider->div.table = NULL;
 
+	if (!(cprman_read(cprman, data->cm_reg) & data->hold_mask)) {
+		init.flags |= CLK_IS_CRITICAL;
+		divider->div.flags |= CLK_IS_CRITICAL;
+	}
+
 	divider->cprman = cprman;
 	divider->data = data;
 
-- 
GitLab


From 29509cf312531aee340cbf0aa9b0234aaddb8d09 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 13 Feb 2017 17:20:08 +0000
Subject: [PATCH 0024/1835] clk-bcm2835: Add claim-clocks property

The claim-clocks property can be used to prevent PLLs and dividers
from being marked as critical. It contains a vector of clock IDs,
as defined by dt-bindings/clock/bcm2835.h.

Use this mechanism to claim PLLD_DSI0, PLLD_DSI1, PLLH_AUX and
PLLH_PIX for the vc4_kms_v3d driver.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/clk/bcm/clk-bcm2835.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 841e2525ed539..985792400853f 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1294,6 +1294,8 @@ static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
 	.debug_init = bcm2835_clock_debug_init,
 };
 
+static bool bcm2835_clk_is_claimed(const char *name);
+
 static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
 					   const struct bcm2835_pll_data *data)
 {
@@ -1310,6 +1312,9 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
 	init.ops = &bcm2835_pll_clk_ops;
 	init.flags = CLK_IGNORE_UNUSED;
 
+	if (!bcm2835_clk_is_claimed(data->name))
+		init.flags |= CLK_IS_CRITICAL;
+
 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
 	if (!pll)
 		return NULL;
@@ -1363,8 +1368,10 @@ bcm2835_register_pll_divider(struct bcm2835_cprman *cprman,
 	divider->div.table = NULL;
 
 	if (!(cprman_read(cprman, data->cm_reg) & data->hold_mask)) {
-		init.flags |= CLK_IS_CRITICAL;
-		divider->div.flags |= CLK_IS_CRITICAL;
+		if (!bcm2835_clk_is_claimed(data->source_pll))
+			init.flags |= CLK_IS_CRITICAL;
+		if (!bcm2835_clk_is_claimed(data->name))
+			divider->div.flags |= CLK_IS_CRITICAL;
 	}
 
 	divider->cprman = cprman;
@@ -2116,6 +2123,8 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
 		.ctl_reg = CM_PERIICTL),
 };
 
+static bool bcm2835_clk_claimed[ARRAY_SIZE(clk_desc_array)];
+
 /*
  * Permanently take a reference on the parent of the SDRAM clock.
  *
@@ -2135,6 +2144,19 @@ static int bcm2835_mark_sdc_parent_critical(struct clk *sdc)
 	return clk_prepare_enable(parent);
 }
 
+static bool bcm2835_clk_is_claimed(const char *name)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
+		const char *clk_name = *(const char **)(clk_desc_array[i].data);
+		if (!strcmp(name, clk_name))
+		    return bcm2835_clk_claimed[i];
+	}
+
+	return false;
+}
+
 static int bcm2835_clk_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -2144,6 +2166,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	const struct bcm2835_clk_desc *desc;
 	const size_t asize = ARRAY_SIZE(clk_desc_array);
 	size_t i;
+	u32 clk_id;
 	int ret;
 
 	cprman = devm_kzalloc(dev,
@@ -2159,6 +2182,13 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	if (IS_ERR(cprman->regs))
 		return PTR_ERR(cprman->regs);
 
+	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
+	for (i = 0;
+	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
+					 i, &clk_id);
+	     i++)
+		bcm2835_clk_claimed[clk_id]= true;
+
 	memcpy(cprman->real_parent_names, cprman_parent_names,
 	       sizeof(cprman_parent_names));
 	of_clk_parent_fill(dev->of_node, cprman->real_parent_names,
-- 
GitLab


From 6239f614fa5ac3893465f71738e031ee175be14b Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 6 Mar 2017 09:06:18 +0000
Subject: [PATCH 0025/1835] clk-bcm2835: Read max core clock from firmware

The VPU is responsible for managing the core clock, usually under
direction from the bcm2835-cpufreq driver but not via the clk-bcm2835
driver. Since the core frequency can change without warning, it is
safer to report the maximum clock rate to users of the core clock -
I2C, SPI and the mini UART - to err on the safe side when calculating
clock divisors.

If the DT node for the clock driver includes a reference to the
firmware node, use the firmware API to query the maximum core clock
instead of reading the divider registers.

Prior to this patch, a "100KHz" I2C bus was sometimes clocked at about
160KHz. In particular, switching to the 4.9 kernel was likely to break
SenseHAT usage on a Pi3.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/clk/bcm/clk-bcm2835.c | 39 ++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 985792400853f..12dd417457ac1 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -44,6 +44,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <dt-bindings/clock/bcm2835.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define CM_PASSWORD		0x5a000000
 
@@ -298,6 +299,8 @@
 #define LOCK_TIMEOUT_NS		100000000
 #define BCM2835_MAX_FB_RATE	1750000000u
 
+#define VCMSG_ID_CORE_CLOCK     4
+
 /*
  * Names of clocks used within the driver that need to be replaced
  * with an external parent's name.  This array is in the order that
@@ -316,6 +319,7 @@ static const char *const cprman_parent_names[] = {
 struct bcm2835_cprman {
 	struct device *dev;
 	void __iomem *regs;
+	struct rpi_firmware *fw;
 	spinlock_t regs_lock; /* spinlock for all clocks */
 
 	/*
@@ -998,6 +1002,30 @@ static unsigned long bcm2835_clock_get_rate(struct clk_hw *hw,
 	return bcm2835_clock_rate_from_divisor(clock, parent_rate, div);
 }
 
+static unsigned long bcm2835_clock_get_rate_vpu(struct clk_hw *hw,
+						unsigned long parent_rate)
+{
+	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+	struct bcm2835_cprman *cprman = clock->cprman;
+
+	if (cprman->fw) {
+		struct {
+			u32 id;
+			u32 val;
+		} packet;
+
+		packet.id = VCMSG_ID_CORE_CLOCK;
+		packet.val = 0;
+
+		if (!rpi_firmware_property(cprman->fw,
+					   RPI_FIRMWARE_GET_MAX_CLOCK_RATE,
+					   &packet, sizeof(packet)))
+			return packet.val;
+	}
+
+	return bcm2835_clock_get_rate(hw, parent_rate);
+}
+
 static void bcm2835_clock_wait_busy(struct bcm2835_clock *clock)
 {
 	struct bcm2835_cprman *cprman = clock->cprman;
@@ -1286,7 +1314,7 @@ static int bcm2835_vpu_clock_is_on(struct clk_hw *hw)
  */
 static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
 	.is_prepared = bcm2835_vpu_clock_is_on,
-	.recalc_rate = bcm2835_clock_get_rate,
+	.recalc_rate = bcm2835_clock_get_rate_vpu,
 	.set_rate = bcm2835_clock_set_rate,
 	.determine_rate = bcm2835_clock_determine_rate,
 	.set_parent = bcm2835_clock_set_parent,
@@ -2165,6 +2193,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	struct resource *res;
 	const struct bcm2835_clk_desc *desc;
 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+	struct device_node *fw_node;
 	size_t i;
 	u32 clk_id;
 	int ret;
@@ -2182,6 +2211,14 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	if (IS_ERR(cprman->regs))
 		return PTR_ERR(cprman->regs);
 
+	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
+	if (fw_node) {
+		struct rpi_firmware *fw = rpi_firmware_get(NULL);
+		if (!fw)
+			return -EPROBE_DEFER;
+		cprman->fw = fw;
+	}
+
 	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
 	for (i = 0;
 	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
-- 
GitLab


From 64675bf7adbfe94d32b90f52104a9c51ef15f21a Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 9 May 2016 17:28:18 -0700
Subject: [PATCH 0026/1835] clk: bcm2835: Mark GPIO clocks enabled at boot as
 critical.

These divide off of PLLD_PER and are used for the ethernet and wifi
PHYs source PLLs.  Neither of them is currently represented by a phy
device that would grab the clock for us.

This keeps other drivers from killing the networking PHYs when they
disable their own clocks and trigger PLLD_PER's refcount going to 0.

v2: Skip marking as critical if they aren't on at boot.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/clk/bcm/clk-bcm2835.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 12dd417457ac1..a142253afdffe 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1453,6 +1453,15 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman,
 	init.name = data->name;
 	init.flags = data->flags | CLK_IGNORE_UNUSED;
 
+	/*
+	 * Some GPIO clocks for ethernet/wifi PLLs are marked as
+	 * critical (since some platforms use them), but if the
+	 * firmware didn't have them turned on then they clearly
+	 * aren't actually critical.
+	 */
+	if ((cprman_read(cprman, data->ctl_reg) & CM_ENABLE) == 0)
+		init.flags &= ~CLK_IS_CRITICAL;
+
 	/*
 	 * Pass the CLK_SET_RATE_PARENT flag if we are allowed to propagate
 	 * rate changes on at least of the parents.
-- 
GitLab


From 940f67346e19aab416387c168c061ad5edced158 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 9 Feb 2017 14:36:44 +0000
Subject: [PATCH 0027/1835] sound: Demote deferral errors to INFO level

At present there is no mechanism to specify driver load order,
which can lead to deferrals and repeated retries until successful.
Since this situation is expected, reduce the dmesg level to
INFO and mention that the operation will be retried.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 sound/soc/soc-core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 62aa320c20708..058e038df9eed 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -868,8 +868,8 @@ static int soc_bind_dai_link(struct snd_soc_card *card,
 	cpu_dai_component.dai_name = dai_link->cpu_dai_name;
 	rtd->cpu_dai = snd_soc_find_dai(&cpu_dai_component);
 	if (!rtd->cpu_dai) {
-		dev_info(card->dev, "ASoC: CPU DAI %s not registered\n",
-			 dai_link->cpu_dai_name);
+		dev_info(card->dev, "ASoC: CPU DAI %s not registered - will retry\n",
+			dai_link->cpu_dai_name);
 		goto _err_defer;
 	}
 	snd_soc_rtdcom_add(rtd, rtd->cpu_dai->component);
@@ -881,7 +881,7 @@ static int soc_bind_dai_link(struct snd_soc_card *card,
 	for (i = 0; i < rtd->num_codecs; i++) {
 		codec_dais[i] = snd_soc_find_dai(&codecs[i]);
 		if (!codec_dais[i]) {
-			dev_err(card->dev, "ASoC: CODEC DAI %s not registered\n",
+			dev_info(card->dev, "ASoC: CODEC DAI %s not registered - will retry\n",
 				codecs[i].dai_name);
 			goto _err_defer;
 		}
-- 
GitLab


From d5943d464a873503440f6fc9651dfeca8cfaac1b Mon Sep 17 00:00:00 2001
From: Claggy3 <stephen.maclagan@hotmail.com>
Date: Sat, 11 Feb 2017 14:00:30 +0000
Subject: [PATCH 0028/1835] Update vfpmodule.c

Christopher Alexander Tobias Schulze - May 2, 2015, 11:57 a.m.
This patch fixes a problem with VFP state save and restore related
to exception handling (panic with message "BUG: unsupported FP
instruction in kernel mode") present on VFP11 floating point units
(as used with ARM1176JZF-S CPUs, e.g. on first generation Raspberry
Pi boards). This patch was developed and discussed on

   https://github.com/raspberrypi/linux/issues/859

A precondition to see the crashes is that floating point exception
traps are enabled. In this case, the VFP11 might determine that a FPU
operation needs to trap at a point in time when it is not possible to
signal this to the ARM11 core any more. The VFP11 will then set the
FPEXC.EX bit and store the trapped opcode in FPINST. (In some cases,
a second opcode might have been accepted by the VFP11 before the
exception was detected and could be reported to the ARM11 - in this
case, the VFP11 also sets FPEXC.FP2V and stores the second opcode in
FPINST2.)

If FPEXC.EX is set, the VFP11 will "bounce" the next FPU opcode issued
by the ARM11 CPU, which will be seen by the ARM11 as an undefined opcode
trap. The VFP support code examines the FPEXC.EX and FPEXC.FP2V bits
to decide what actions to take, i.e., whether to emulate the opcodes
found in FPINST and FPINST2, and whether to retry the bounced instruction.

If a user space application has left the VFP11 in this "pending trap"
state, the next FPU opcode issued to the VFP11 might actually be the
VSTMIA operation vfp_save_state() uses to store the FPU registers
to memory (in our test cases, when building the signal stack frame).
In this case, the kernel crashes as described above.

This patch fixes the problem by making sure that vfp_save_state() is
always entered with FPEXC.EX cleared. (The current value of FPEXC has
already been saved, so this does not corrupt the context. Clearing
FPEXC.EX has no effects on FPINST or FPINST2. Also note that many
callers already modify FPEXC by setting FPEXC.EN before invoking
vfp_save_state().)

This patch also addresses a second problem related to FPEXC.EX: After
returning from signal handling, the kernel reloads the VFP context
from the user mode stack. However, the current code explicitly clears
both FPEXC.EX and FPEXC.FP2V during reload. As VFP11 requires these
bits to be preserved, this patch disables clearing them for VFP
implementations belonging to architecture 1. There should be no
negative side effects: the user can set both bits by executing FPU
opcodes anyway, and while user code may now place arbitrary values
into FPINST and FPINST2 (e.g., non-VFP ARM opcodes) the VFP support
code knows which instructions can be emulated, and rejects other
opcodes with "unhandled bounce" messages, so there should be no
security impact from allowing reloading FPEXC.EX and FPEXC.FP2V.

Signed-off-by: Christopher Alexander Tobias Schulze <cat.schulze@alice-dsl.net>
---
 arch/arm/vfp/vfpmodule.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 66c5e693428ab..e0ece0372d8db 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -179,8 +179,11 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 		 * case the thread migrates to a different CPU. The
 		 * restoring is done lazily.
 		 */
-		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu])
+		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu]) {
+			/* vfp_save_state oopses on VFP11 if EX bit set */
+			fmxr(FPEXC, fpexc & ~FPEXC_EX);
 			vfp_save_state(vfp_current_hw_state[cpu], fpexc);
+		}
 #endif
 
 		/*
@@ -462,13 +465,16 @@ static int vfp_pm_suspend(void)
 	/* if vfp is on, then save state for resumption */
 	if (fpexc & FPEXC_EN) {
 		pr_debug("%s: saving vfp state\n", __func__);
+		/* vfp_save_state oopses on VFP11 if EX bit set */
+		fmxr(FPEXC, fpexc & ~FPEXC_EX);
 		vfp_save_state(&ti->vfpstate, fpexc);
 
 		/* disable, just in case */
 		fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_EN);
 	} else if (vfp_current_hw_state[ti->cpu]) {
 #ifndef CONFIG_SMP
-		fmxr(FPEXC, fpexc | FPEXC_EN);
+		/* vfp_save_state oopses on VFP11 if EX bit set */
+		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
 		vfp_save_state(vfp_current_hw_state[ti->cpu], fpexc);
 		fmxr(FPEXC, fpexc);
 #endif
@@ -531,7 +537,8 @@ void vfp_sync_hwstate(struct thread_info *thread)
 		/*
 		 * Save the last VFP state on this CPU.
 		 */
-		fmxr(FPEXC, fpexc | FPEXC_EN);
+		/* vfp_save_state oopses on VFP11 if EX bit set */
+		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
 		vfp_save_state(&thread->vfpstate, fpexc | FPEXC_EN);
 		fmxr(FPEXC, fpexc);
 	}
@@ -597,6 +604,7 @@ int vfp_restore_user_hwstate(struct user_vfp *ufp, struct user_vfp_exc *ufp_exc)
 	struct thread_info *thread = current_thread_info();
 	struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
 	unsigned long fpexc;
+	u32 fpsid = fmrx(FPSID);
 
 	/* Disable VFP to avoid corrupting the new thread state. */
 	vfp_flush_hwstate(thread);
@@ -619,8 +627,12 @@ int vfp_restore_user_hwstate(struct user_vfp *ufp, struct user_vfp_exc *ufp_exc)
 	/* Ensure the VFP is enabled. */
 	fpexc |= FPEXC_EN;
 
-	/* Ensure FPINST2 is invalid and the exception flag is cleared. */
-	fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+	/* Mask FPXEC_EX and FPEXC_FP2V if not required by VFP arch */
+	if ((fpsid & FPSID_ARCH_MASK) != (1 << FPSID_ARCH_BIT)) {
+		/* Ensure FPINST2 is invalid and the exception flag is cleared. */
+		fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+	}
+
 	hwstate->fpexc = fpexc;
 
 	hwstate->fpinst = ufp_exc->fpinst;
@@ -690,7 +702,8 @@ void kernel_neon_begin(void)
 	cpu = get_cpu();
 
 	fpexc = fmrx(FPEXC) | FPEXC_EN;
-	fmxr(FPEXC, fpexc);
+	/* vfp_save_state oopses on VFP11 if EX bit set */
+	fmxr(FPEXC, fpexc & ~FPEXC_EX);
 
 	/*
 	 * Save the userland NEON/VFP state. Under UP,
-- 
GitLab


From b5d69852481291e77278c6102de279e948a1433c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Tue, 1 Nov 2016 15:15:41 +0100
Subject: [PATCH 0029/1835] i2c: bcm2835: Add debug support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds a debug module parameter to aid in debugging transfer issues
by printing info to the kernel log. When enabled, status values are
collected in the interrupt routine and msg info in
bcm2835_i2c_start_transfer(). This is done in a way that tries to avoid
affecting timing. Having printk in the isr can mask issues.

debug values (additive):
1: Print info on error
2: Print info on all transfers
3: Print messages before transfer is started

The value can be changed at runtime:
/sys/module/i2c_bcm2835/parameters/debug

Example output, debug=3:
[  747.114448] bcm2835_i2c_xfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
[  747.114463] bcm2835_i2c_xfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
[  747.117809] start_transfer: msg(1/2) write addr=0x54, len=2 flags= [i2c1]
[  747.117825] isr: remain=2, status=0x30000055 : TA TXW TXD TXE  [i2c1]
[  747.117839] start_transfer: msg(2/2) read addr=0x54, len=32 flags= [i2c1]
[  747.117849] isr: remain=32, status=0xd0000039 : TA RXR TXD RXD  [i2c1]
[  747.117861] isr: remain=20, status=0xd0000039 : TA RXR TXD RXD  [i2c1]
[  747.117870] isr: remain=8, status=0x32 : DONE TXD RXD  [i2c1]

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/i2c/busses/i2c-bcm2835.c | 99 +++++++++++++++++++++++++++++++-
 1 file changed, 98 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index 4d19254f78c8a..1426dab2670bf 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -56,6 +56,18 @@
 #define BCM2835_I2C_CDIV_MIN	0x0002
 #define BCM2835_I2C_CDIV_MAX	0xFFFE
 
+static unsigned int debug;
+module_param(debug, uint, 0644);
+MODULE_PARM_DESC(debug, "1=err, 2=isr, 3=xfer");
+
+#define BCM2835_DEBUG_MAX	512
+struct bcm2835_debug {
+	struct i2c_msg *msg;
+	int msg_idx;
+	size_t remain;
+	u32 status;
+};
+
 struct bcm2835_i2c_dev {
 	struct device *dev;
 	void __iomem *regs;
@@ -69,8 +81,78 @@ struct bcm2835_i2c_dev {
 	u32 msg_err;
 	u8 *msg_buf;
 	size_t msg_buf_remaining;
+	struct bcm2835_debug debug[BCM2835_DEBUG_MAX];
+	unsigned int debug_num;
+	unsigned int debug_num_msgs;
 };
 
+static inline void bcm2835_debug_add(struct bcm2835_i2c_dev *i2c_dev, u32 s)
+{
+	if (!i2c_dev->debug_num_msgs || i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
+		return;
+
+	i2c_dev->debug[i2c_dev->debug_num].msg = i2c_dev->curr_msg;
+	i2c_dev->debug[i2c_dev->debug_num].msg_idx =
+				i2c_dev->debug_num_msgs - i2c_dev->num_msgs;
+	i2c_dev->debug[i2c_dev->debug_num].remain = i2c_dev->msg_buf_remaining;
+	i2c_dev->debug[i2c_dev->debug_num].status = s;
+	i2c_dev->debug_num++;
+}
+
+static void bcm2835_debug_print_status(struct bcm2835_i2c_dev *i2c_dev,
+				       struct bcm2835_debug *d)
+{
+	u32 s = d->status;
+
+	pr_info("isr: remain=%zu, status=0x%x : %s%s%s%s%s%s%s%s%s%s [i2c%d]\n",
+		d->remain, s,
+		s & BCM2835_I2C_S_TA ? "TA " : "",
+		s & BCM2835_I2C_S_DONE ? "DONE " : "",
+		s & BCM2835_I2C_S_TXW ? "TXW " : "",
+		s & BCM2835_I2C_S_RXR ? "RXR " : "",
+		s & BCM2835_I2C_S_TXD ? "TXD " : "",
+		s & BCM2835_I2C_S_RXD ? "RXD " : "",
+		s & BCM2835_I2C_S_TXE ? "TXE " : "",
+		s & BCM2835_I2C_S_RXF ? "RXF " : "",
+		s & BCM2835_I2C_S_ERR ? "ERR " : "",
+		s & BCM2835_I2C_S_CLKT ? "CLKT " : "",
+		i2c_dev->adapter.nr);
+}
+
+static void bcm2835_debug_print_msg(struct bcm2835_i2c_dev *i2c_dev,
+				    struct i2c_msg *msg, int i, int total,
+				    const char *fname)
+{
+	pr_info("%s: msg(%d/%d) %s addr=0x%02x, len=%u flags=%s%s%s%s%s%s%s [i2c%d]\n",
+		fname, i, total,
+		msg->flags & I2C_M_RD ? "read" : "write", msg->addr, msg->len,
+		msg->flags & I2C_M_TEN ? "TEN" : "",
+		msg->flags & I2C_M_RECV_LEN ? "RECV_LEN" : "",
+		msg->flags & I2C_M_NO_RD_ACK ? "NO_RD_ACK" : "",
+		msg->flags & I2C_M_IGNORE_NAK ? "IGNORE_NAK" : "",
+		msg->flags & I2C_M_REV_DIR_ADDR ? "REV_DIR_ADDR" : "",
+		msg->flags & I2C_M_NOSTART ? "NOSTART" : "",
+		msg->flags & I2C_M_STOP ? "STOP" : "",
+		i2c_dev->adapter.nr);
+}
+
+static void bcm2835_debug_print(struct bcm2835_i2c_dev *i2c_dev)
+{
+	struct bcm2835_debug *d;
+	unsigned int i;
+
+	for (i = 0; i < i2c_dev->debug_num; i++) {
+		d = &i2c_dev->debug[i];
+		if (d->status == ~0)
+			bcm2835_debug_print_msg(i2c_dev, d->msg, d->msg_idx,
+				i2c_dev->debug_num_msgs, "start_transfer");
+		else
+			bcm2835_debug_print_status(i2c_dev, d);
+	}
+	if (i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
+		pr_info("BCM2835_DEBUG_MAX reached\n");
+}
+
 static inline void bcm2835_i2c_writel(struct bcm2835_i2c_dev *i2c_dev,
 				      u32 reg, u32 val)
 {
@@ -189,6 +271,7 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)
 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_A, msg->addr);
 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DLEN, msg->len);
 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
+	bcm2835_debug_add(i2c_dev, ~0);
 }
 
 static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
@@ -215,6 +298,7 @@ static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data)
 	u32 val, err;
 
 	val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
+	bcm2835_debug_add(i2c_dev, val);
 
 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
 	if (err) {
@@ -281,6 +365,13 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 	unsigned long time_left;
 	int i, ret;
 
+	if (debug)
+		i2c_dev->debug_num_msgs = num;
+
+	if (debug > 2)
+		for (i = 0; i < num; i++)
+			bcm2835_debug_print_msg(i2c_dev, &msgs[i], i + 1, num, __func__);
+
 	for (i = 0; i < (num - 1); i++)
 		if (msgs[i].flags & I2C_M_RD) {
 			dev_warn_once(i2c_dev->dev,
@@ -303,6 +394,10 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 
 	bcm2835_i2c_finish_transfer(i2c_dev);
 
+	if (debug > 1 || (debug && (!time_left || i2c_dev->msg_err)))
+		bcm2835_debug_print(i2c_dev);
+	i2c_dev->debug_num_msgs = 0;
+	i2c_dev->debug_num = 0;
 	if (!time_left) {
 		bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
 				   BCM2835_I2C_C_CLEAR);
@@ -313,7 +408,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 	if (!i2c_dev->msg_err)
 		return num;
 
-	dev_dbg(i2c_dev->dev, "i2c transfer failed: %x\n", i2c_dev->msg_err);
+	if (debug)
+		dev_err(i2c_dev->dev, "i2c transfer failed: %x\n",
+			i2c_dev->msg_err);
 
 	if (i2c_dev->msg_err & BCM2835_I2C_S_ERR)
 		return -EREMOTEIO;
-- 
GitLab


From cb9b549bce306a329fdaa977e778c5b975a7851e Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 18 Dec 2014 16:07:15 -0800
Subject: [PATCH 0030/1835] mm: Remove the PFN busy warning

See commit dae803e165a11bc88ca8dbc07a11077caf97bbcb -- the warning is
expected sometimes when using CMA.  However, that commit still spams
my kernel log with these warnings.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 mm/page_alloc.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 8e6932a140b82..aa38fdb8ca535 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -7970,8 +7970,6 @@ int alloc_contig_range(unsigned long start, unsigned long end,
 
 	/* Make sure the range is really isolated. */
 	if (test_pages_isolated(outer_start, end, false)) {
-		pr_info_ratelimited("%s: [%lx, %lx) PFNs busy\n",
-			__func__, outer_start, end);
 		ret = -EBUSY;
 		goto done;
 	}
-- 
GitLab


From ed7c42c39101625698405846fadd349a13396ed2 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 23 Mar 2017 10:06:56 +0000
Subject: [PATCH 0031/1835] ASoC: Add prompt for ICS43432 codec

Without a prompt string, a config setting can't be included in a
defconfig. Give CONFIG_SND_SOC_ICS43432 a prompt so that Pi soundcards
can use the driver.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 sound/soc/codecs/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index efb095dbcd714..7956d964fe5f0 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -616,7 +616,7 @@ config SND_SOC_HDAC_HDMI
 	select HDMI
 
 config SND_SOC_ICS43432
-	tristate
+	tristate "InvenSense ICS43432 I2S microphone codec"
 
 config SND_SOC_INNO_RK3036
 	tristate "Inno codec driver for RK3036 SoC"
-- 
GitLab


From 5a840d0d8f806b88fc6fe1e91ac35ee459e65c92 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 23 Jan 2018 16:52:45 +0000
Subject: [PATCH 0032/1835] irqchip: irq-bcm2836: Remove regmap and syscon use

The syscon node defines a register range that duplicates that used by
the local_intc node on bcm2836/7. Since irq-bcm2835 and irq-bcm2836 are
built in and always present together (both drivers are enabled by
CONFIG_ARCH_BCM2835), it is possible to replace the syscon usage with a
global variable that simplifies the code. Doing so does lose the
locking provided by regmap, but as only one side is using the regmap
interface (irq-bcm2835 uses readl and write) there is no loss of
atomicity.

See: https://github.com/raspberrypi/firmware/issues/926

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/irqchip/irq-bcm2835.c | 32 ++++++++++++--------------------
 drivers/irqchip/irq-bcm2836.c |  5 +++++
 2 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index 13356d3b7bcd5..7bdfc18dd9761 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -50,8 +50,6 @@
 #include <linux/of_irq.h>
 #include <linux/irqchip.h>
 #include <linux/irqdomain.h>
-#include <linux/mfd/syscon.h>
-#include <linux/regmap.h>
 
 #include <asm/exception.h>
 #include <asm/mach/irq.h>
@@ -100,7 +98,7 @@ struct armctrl_ic {
 	void __iomem *enable[NR_BANKS];
 	void __iomem *disable[NR_BANKS];
 	struct irq_domain *domain;
-	struct regmap *local_regmap;
+	void __iomem *local_base;
 };
 
 static struct armctrl_ic intc __read_mostly;
@@ -137,24 +135,20 @@ static void armctrl_unmask_irq(struct irq_data *d)
 	if (d->hwirq >= NUMBER_IRQS) {
 		if (num_online_cpus() > 1) {
 			unsigned int data;
-			int ret;
 
-			if (!intc.local_regmap) {
-				pr_err("FIQ is disabled due to missing regmap\n");
+			if (!intc.local_base) {
+				pr_err("FIQ is disabled due to missing arm_local_intc\n");
 				return;
 			}
 
-			ret = regmap_read(intc.local_regmap,
-					  ARM_LOCAL_GPU_INT_ROUTING, &data);
-			if (ret) {
-				pr_err("Failed to read int routing %d\n", ret);
-				return;
-			}
+			data = readl_relaxed(intc.local_base +
+					     ARM_LOCAL_GPU_INT_ROUTING);
 
 			data &= ~0xc;
 			data |= (1 << 2);
-			regmap_write(intc.local_regmap,
-				     ARM_LOCAL_GPU_INT_ROUTING, data);
+			writel_relaxed(data,
+				       intc.local_base +
+				       ARM_LOCAL_GPU_INT_ROUTING);
 		}
 
 		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
@@ -240,12 +234,10 @@ static int __init armctrl_of_init(struct device_node *node,
 	}
 
 	if (is_2836) {
-		intc.local_regmap =
-			syscon_regmap_lookup_by_compatible("brcm,bcm2836-arm-local");
-		if (IS_ERR(intc.local_regmap)) {
-			pr_err("Failed to get local register map. FIQ is disabled for cpus > 1\n");
-			intc.local_regmap = NULL;
-		}
+		extern void __iomem * __attribute__((weak)) arm_local_intc;
+		intc.local_base = arm_local_intc;
+		if (!intc.local_base)
+			pr_err("Failed to get local intc base. FIQ is disabled for cpus > 1\n");
 	}
 
 	/* Make a duplicate irq range which is used to enable FIQ */
diff --git a/drivers/irqchip/irq-bcm2836.c b/drivers/irqchip/irq-bcm2836.c
index 9d0f221a1daa5..39d05403835f2 100644
--- a/drivers/irqchip/irq-bcm2836.c
+++ b/drivers/irqchip/irq-bcm2836.c
@@ -30,6 +30,9 @@ struct bcm2836_arm_irqchip_intc {
 
 static struct bcm2836_arm_irqchip_intc intc  __read_mostly;
 
+void __iomem *arm_local_intc;
+EXPORT_SYMBOL_GPL(arm_local_intc);
+
 static void bcm2836_arm_irqchip_mask_per_cpu_irq(unsigned int reg_offset,
 						 unsigned int bit,
 						 int cpu)
@@ -234,6 +237,8 @@ static int __init bcm2836_arm_irqchip_l1_intc_of_init(struct device_node *node,
 		panic("%pOF: unable to map local interrupt registers\n", node);
 	}
 
+	arm_local_intc = intc.base;
+
 	bcm2835_init_local_timer_frequency();
 
 	intc.domain = irq_domain_add_linear(node, LAST_IRQ + 1,
-- 
GitLab


From 523e787d749fa082c1ee2c25a40b5bb39b214f3a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 17 Oct 2017 15:04:29 +0100
Subject: [PATCH 0033/1835] lan78xx: Enable LEDs and auto-negotiation

For applications of the LAN78xx that don't have valid programmed
EEPROMs or OTPs, enabling both LEDs and auto-negotiation by default
seems reasonable.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/usb/lan78xx.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 8d140495da79d..38f248b2b3b4f 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2472,6 +2472,11 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 	int ret = 0;
 	unsigned long timeout;
 	u8 sig;
+	bool has_eeprom;
+	bool has_otp;
+
+	has_eeprom = !lan78xx_read_eeprom(dev, 0, 0, NULL);
+	has_otp = !lan78xx_read_otp(dev, 0, 0, NULL);
 
 	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
 	buf |= HW_CFG_LRST_;
@@ -2525,6 +2530,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 
 	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
 	buf |= HW_CFG_MEF_;
+	/* If no valid EEPROM and no valid OTP, enable the LEDs by default */
+	if (!has_eeprom && !has_otp)
+	    buf |= HW_CFG_LED0_EN_ | HW_CFG_LED1_EN_;
 	ret = lan78xx_write_reg(dev, HW_CFG, buf);
 
 	ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
@@ -2580,6 +2588,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 			buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
 		}
 	}
+	/* If no valid EEPROM and no valid OTP, enable AUTO negotiation */
+	if (!has_eeprom && !has_otp)
+	    buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
 	ret = lan78xx_write_reg(dev, MAC_CR, buf);
 
 	ret = lan78xx_read_reg(dev, MAC_TX, &buf);
-- 
GitLab


From 56b6a0a32a2f440dad52fbbd44c0dd4c51542ea9 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 23 Feb 2016 17:26:48 +0000
Subject: [PATCH 0034/1835] amba_pl011: Don't use DT aliases for numbering

The pl011 driver looks for DT aliases of the form "serial<n>",
and if found uses <n> as the device ID. This can cause
/dev/ttyAMA0 to become /dev/ttyAMA1, which is confusing if the
other serial port is provided by the 8250 driver which doesn't
use the same logic.
---
 drivers/tty/serial/amba-pl011.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 89ade213a1a9a..18225dda654b4 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2578,7 +2578,12 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
 	if (IS_ERR(base))
 		return PTR_ERR(base);
 
+	/* Don't use DT serial<n> aliases - it causes the device to
+	   be renumbered to ttyAMA1 if it is the second serial port in the
+	   system, even though the other one is ttyS0. The 8250 driver
+	   doesn't use this logic, so always remains ttyS0.
 	index = pl011_probe_dt_alias(index, dev);
+	*/
 
 	uap->old_cr = 0;
 	uap->port.dev = dev;
-- 
GitLab


From e64484e1029761f9ac1f2992800d68c2e16c0257 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 1 Mar 2017 16:07:39 +0000
Subject: [PATCH 0035/1835] amba_pl011: Round input clock up

The UART clock is initialised to be as close to the requested
frequency as possible without exceeding it. Now that there is a
clock manager that returns the actual frequencies, an expected
48MHz clock is reported as 47999625. If the requested baudrate
== requested clock/16, there is no headroom and the slight
reduction in actual clock rate results in failure.

Detect cases where it looks like a "round" clock was chosen and
adjust the reported clock to match that "round" value. As the
code comment says:

/*
 * If increasing a clock by less than 0.1% changes it
 * from ..999.. to ..000.., round up.
 */

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/tty/serial/amba-pl011.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 18225dda654b4..02275f96dbca1 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1652,6 +1652,23 @@ static void pl011_put_poll_char(struct uart_port *port,
 
 #endif /* CONFIG_CONSOLE_POLL */
 
+unsigned long pl011_clk_round(unsigned long clk)
+{
+	unsigned long scaler;
+
+	/*
+	 * If increasing a clock by less than 0.1% changes it
+	 * from ..999.. to ..000.., round up.
+	 */
+	scaler = 1;
+	while (scaler * 100000 < clk)
+		scaler *= 10;
+	if ((clk + scaler - 1)/scaler % 1000 == 0)
+		clk = (clk/scaler + 1) * scaler;
+
+	return clk;
+}
+
 static int pl011_hwinit(struct uart_port *port)
 {
 	struct uart_amba_port *uap =
@@ -1668,7 +1685,7 @@ static int pl011_hwinit(struct uart_port *port)
 	if (retval)
 		return retval;
 
-	uap->port.uartclk = clk_get_rate(uap->clk);
+	uap->port.uartclk = pl011_clk_round(clk_get_rate(uap->clk));
 
 	/* Clear pending error and receive interrupts */
 	pl011_write(UART011_OEIS | UART011_BEIS | UART011_PEIS |
@@ -2324,7 +2341,7 @@ static int __init pl011_console_setup(struct console *co, char *options)
 			plat->init();
 	}
 
-	uap->port.uartclk = clk_get_rate(uap->clk);
+	uap->port.uartclk = pl011_clk_round(clk_get_rate(uap->clk));
 
 	if (uap->vendor->fixed_options) {
 		baud = uap->fixed_baud;
@@ -2509,6 +2526,7 @@ static struct uart_driver amba_reg = {
 	.cons			= AMBA_CONSOLE,
 };
 
+#if 0
 static int pl011_probe_dt_alias(int index, struct device *dev)
 {
 	struct device_node *np;
@@ -2540,6 +2558,7 @@ static int pl011_probe_dt_alias(int index, struct device *dev)
 
 	return ret;
 }
+#endif
 
 /* unregisters the driver also if no more ports are left */
 static void pl011_unregister_port(struct uart_amba_port *uap)
-- 
GitLab


From 428cd5ce5df9050b73ea7f69c75718dc512117ae Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 29 Sep 2017 10:32:19 +0100
Subject: [PATCH 0036/1835] amba_pl011: Insert mb() for correct FIFO handling

The pl011 register accessor functions use the _relaxed versions of the
standard readl() and writel() functions, meaning that there are no
automatic memory barriers. When polling a FIFO status register to check
for fullness, it is necessary to ensure that any outstanding writes have
completed; otherwise the flags are effectively stale, making it possible
that the next write is to a full FIFO.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/tty/serial/amba-pl011.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 02275f96dbca1..39d717e94af3b 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1385,6 +1385,7 @@ static bool pl011_tx_char(struct uart_amba_port *uap, unsigned char c,
 		return false; /* unable to transmit character */
 
 	pl011_write(c, uap, REG_DR);
+	mb();
 	uap->port.icount.tx++;
 
 	return true;
-- 
GitLab


From 504ae7093c392af206c5a66a3050942724ff28b3 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 29 Sep 2017 10:32:19 +0100
Subject: [PATCH 0037/1835] amba_pl011: Add cts-event-workaround DT property

The BCM2835 PL011 implementation seems to have a bug that can lead to a
transmission lockup if CTS changes frequently. A workaround was added to
the driver with a vendor-specific flag to enable it, but this flag is
currently not set for ARM implementations.

Add a "cts-event-workaround" property to Pi DTBs and use the presence
of that property to force the flag to be enabled in the driver.

See: https://github.com/raspberrypi/linux/issues/1280

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 Documentation/devicetree/bindings/serial/pl011.txt | 3 +++
 drivers/tty/serial/amba-pl011.c                    | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/Documentation/devicetree/bindings/serial/pl011.txt b/Documentation/devicetree/bindings/serial/pl011.txt
index 77863aefe9ef1..8d65b0ec2828b 100644
--- a/Documentation/devicetree/bindings/serial/pl011.txt
+++ b/Documentation/devicetree/bindings/serial/pl011.txt
@@ -35,6 +35,9 @@ Optional properties:
 - poll-timeout-ms:
 	   Poll timeout when auto-poll is set, default
 	   3000ms.
+- cts-event-workaround:
+	   Enables the (otherwise vendor-specific) workaround for the
+	   CTS-induced TX lockup.
 
 See also bindings/arm/primecell.txt
 
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 39d717e94af3b..6f15f32fa1942 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2661,6 +2661,11 @@ static int pl011_probe(struct amba_device *dev, const struct amba_id *id)
 	if (IS_ERR(uap->clk))
 		return PTR_ERR(uap->clk);
 
+	if (of_property_read_bool(dev->dev.of_node, "cts-event-workaround")) {
+	    vendor->cts_event_workaround = true;
+	    dev_info(&dev->dev, "cts_event_workaround enabled\n");
+	}
+
 	uap->reg_offset = vendor->reg_offset;
 	uap->vendor = vendor;
 	uap->fifosize = vendor->get_fifosize(dev);
-- 
GitLab


From eda90e58e6cefd1caf3f769849bdb49cbbde4756 Mon Sep 17 00:00:00 2001
From: notro <notro@tronnes.org>
Date: Thu, 10 Jul 2014 13:59:47 +0200
Subject: [PATCH 0038/1835] pinctrl-bcm2835: Set base to 0 give expected gpio
 numbering

Signed-off-by: Noralf Tronnes <notro@tronnes.org>
---
 drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 08925d24180b0..475e0fbd03c8d 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -352,7 +352,7 @@ static const struct gpio_chip bcm2835_gpio_chip = {
 	.get_direction = bcm2835_gpio_get_direction,
 	.get = bcm2835_gpio_get,
 	.set = bcm2835_gpio_set,
-	.base = -1,
+	.base = 0,
 	.ngpio = BCM2835_NUM_GPIOS,
 	.can_sleep = false,
 };
-- 
GitLab


From c6c8f6001dd7eef1756c6ee18fd775d92ce04853 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Sun, 12 May 2013 12:24:19 +0100
Subject: [PATCH 0039/1835] Main bcm2708/bcm2709 linux port
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: popcornmix <popcornmix@gmail.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2709: Drop platform smp and timer init code

irq-bcm2836 handles this through these functions:
bcm2835_init_local_timer_frequency()
bcm2836_arm_irqchip_smp_init()

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm270x: Use watchdog for reboot/poweroff

The watchdog driver already has support for reboot/poweroff.
Make use of this and remove the code from the platform files.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

board_bcm2835: Remove coherent dma pool increase - API has gone
---
 arch/arm/mach-bcm/Kconfig         |  1 +
 arch/arm/mm/proc-v6.S             | 15 ++++++++++++---
 drivers/irqchip/irq-bcm2835.c     |  7 ++++++-
 drivers/mailbox/bcm2835-mailbox.c | 18 ++++++++++++++++--
 4 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig
index 4686dccb91d54..abae0e72c3d65 100644
--- a/arch/arm/mach-bcm/Kconfig
+++ b/arch/arm/mach-bcm/Kconfig
@@ -168,6 +168,7 @@ config ARCH_BCM2835
 	select FIQ
 	select PINCTRL
 	select PINCTRL_BCM2835
+	select MFD_SYSCON if ARCH_MULTI_V7
 	help
 	  This enables support for the Broadcom BCM2835 and BCM2836 SoCs.
 	  This SoC is used in the Raspberry Pi and Roku 2 devices.
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 06d890a2342b1..30d96e81c0e05 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -73,10 +73,19 @@ ENDPROC(cpu_v6_reset)
  *
  *	IRQs are already disabled.
  */
+
+/* See jira SW-5991 for details of this workaround */
 ENTRY(cpu_v6_do_idle)
-	mov	r1, #0
-	mcr	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
-	mcr	p15, 0, r1, c7, c0, 4		@ wait for interrupt
+	.align 5
+	mov     r1, #2
+1:	subs	r1, #1
+	nop
+	mcreq	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
+	mcreq	p15, 0, r1, c7, c0, 4		@ wait for interrupt
+	nop
+	nop
+	nop
+	bne 1b
 	ret	lr
 
 ENTRY(cpu_v6_dcache_clean_area)
diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index 7bdfc18dd9761..44a1c357f6227 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -52,7 +52,9 @@
 #include <linux/irqdomain.h>
 
 #include <asm/exception.h>
+#ifndef CONFIG_ARM64
 #include <asm/mach/irq.h>
+#endif
 
 /* Put the bank and irq (32 bits) into the hwirq */
 #define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
@@ -80,6 +82,7 @@
 #define NR_BANKS		3
 #define IRQS_PER_BANK		32
 #define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
+#undef FIQ_START
 #define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
 
 static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
@@ -247,10 +250,12 @@ static int __init armctrl_of_init(struct device_node *node,
 					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
 			BUG_ON(irq <= 0);
 			irq_set_chip(irq, &armctrl_chip);
-			set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+			irq_set_probe(irq);
 		}
 	}
+#ifndef CONFIG_ARM64
 	init_FIQ(FIQ_START);
+#endif
 
 	return 0;
 }
diff --git a/drivers/mailbox/bcm2835-mailbox.c b/drivers/mailbox/bcm2835-mailbox.c
index e92bbc533821a..a03aeed2ed362 100644
--- a/drivers/mailbox/bcm2835-mailbox.c
+++ b/drivers/mailbox/bcm2835-mailbox.c
@@ -51,12 +51,15 @@
 #define MAIL1_WRT	(ARM_0_MAIL1 + 0x00)
 #define MAIL1_STA	(ARM_0_MAIL1 + 0x18)
 
+/* On ARCH_BCM270x these come through <linux/interrupt.h> (arm_control.h ) */
+#ifndef ARM_MS_FULL
 /* Status register: FIFO state. */
 #define ARM_MS_FULL		BIT(31)
 #define ARM_MS_EMPTY		BIT(30)
 
 /* Configuration register: Enable interrupts. */
 #define ARM_MC_IHAVEDATAIRQEN	BIT(0)
+#endif
 
 struct bcm2835_mbox {
 	void __iomem *regs;
@@ -151,7 +154,7 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	spin_lock_init(&mbox->lock);
 
-	ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0),
+	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
 			       bcm2835_mbox_irq, 0, dev_name(dev), mbox);
 	if (ret) {
 		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
@@ -209,7 +212,18 @@ static struct platform_driver bcm2835_mbox_driver = {
 	.probe		= bcm2835_mbox_probe,
 	.remove		= bcm2835_mbox_remove,
 };
-module_platform_driver(bcm2835_mbox_driver);
+
+static int __init bcm2835_mbox_init(void)
+{
+	return platform_driver_register(&bcm2835_mbox_driver);
+}
+arch_initcall(bcm2835_mbox_init);
+
+static void __init bcm2835_mbox_exit(void)
+{
+	platform_driver_unregister(&bcm2835_mbox_driver);
+}
+module_exit(bcm2835_mbox_exit);
 
 MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
 MODULE_DESCRIPTION("BCM2835 mailbox IPC driver");
-- 
GitLab


From 132ff67686761e7255eca2b63de844fb2fbebfe1 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 1 May 2013 19:46:17 +0100
Subject: [PATCH 0040/1835] Add dwc_otg driver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: popcornmix <popcornmix@gmail.com>

usb: dwc: fix lockdep false positive

Signed-off-by: Kari Suvanto <karis79@gmail.com>

usb: dwc: fix inconsistent lock state

Signed-off-by: Kari Suvanto <karis79@gmail.com>

Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
Thanks to Gordon and Costas

Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.

Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh

Make sure we wait for the reset to finish

dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
	 memory corruption, escalating to OOPS under high USB load.

dwc_otg: Fix unsafe access of QTD during URB enqueue

In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
transaction could complete almost immediately after the qtd was assigned
to a host channel during URB enqueue, which meant the qtd pointer was no
longer valid having been completed and removed. Usually, this resulted in
an OOPS during URB submission. By predetermining whether transactions
need to be queued or not, this unsafe pointer access is avoided.

This bug was only evident on the Pi model A where a device was attached
that had no periodic endpoints (e.g. USB pendrive or some wlan devices).

dwc_otg: Fix incorrect URB allocation error handling

If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
because for some reason a member of the *unallocated* struct was set to
zero. Error handling changed to fail correctly.

dwc_otg: fix potential use-after-free case in interrupt handler

If a transaction had previously aborted, certain interrupts are
enabled to track error counts and reset where necessary. On IN
endpoints the host generates an ACK interrupt near-simultaneously
with completion of transfer. In the case where this transfer had
previously had an error, this results in a use-after-free on
the QTD memory space with a 1-byte length being overwritten to
0x00.

dwc_otg: add handling of SPLIT transaction data toggle errors

Previously a data toggle error on packets from a USB1.1 device behind
a TT would result in the Pi locking up as the driver never handled
the associated interrupt. Patch adds basic retry mechanism and
interrupt acknowledgement to cater for either a chance toggle error or
for devices that have a broken initial toggle state (FT8U232/FT232BM).

dwc_otg: implement tasklet for returning URBs to usbcore hcd layer

The dwc_otg driver interrupt handler for transfer completion will spend
a very long time with interrupts disabled when a URB is completed -
this is because usb_hcd_giveback_urb is called from within the handler
which for a USB device driver with complicated processing (e.g. webcam)
will take an exorbitant amount of time to complete. This results in
missed completion interrupts for other USB packets which lead to them
being dropped due to microframe overruns.

This patch splits returning the URB to the usb hcd layer into a
high-priority tasklet. This will have most benefit for isochronous IN
transfers but will also have incidental benefit where multiple periodic
devices are active at once.

dwc_otg: fix NAK holdoff and allow on split transactions only

This corrects a bug where if a single active non-periodic endpoint
had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
would get skipped and never get queued again. This would result in
a silent device until error detection (automatic or otherwise) would
either reset the device or flush and requeue the URBs.

Additionally the NAK holdoff was enabled for all transactions - this
would potentially stall a HS endpoint for 1ms if a previous error state
enabled this interrupt and the next response was a NAK. Fix so that
only split transactions get held off.

dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler

usb_hcd_unlink_urb_from_ep must be called with the HCD lock held.  Calling it
asynchronously in the tasklet was not safe (regression in
c4564d4a1a0a9b10d4419e48239f5d99e88d2667).

This change unlinks it from the endpoint prior to queueing it for handling in
the tasklet, and also adds a check to ensure the urb is OK to be unlinked
before doing so.

NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
when a USB device was unplugged/replugged during data transfer.  This effect
was reproduced using automated USB port power control, hundreds of replug
events were performed during active transfers to confirm that the problem was
eliminated.

USB fix using a FIQ to implement split transactions

This commit adds a FIQ implementaion that schedules
the split transactions using a FIQ so we don't get
held off by the interrupt latency of Linux

dwc_otg: fix device attributes and avoid kernel warnings on boot

dcw_otg: avoid logging function that can cause panics

See: https://github.com/raspberrypi/firmware/issues/21
Thanks to cleverca22 for fix

dwc_otg: mask correct interrupts after transaction error recovery

The dwc_otg driver will unmask certain interrupts on a transaction
that previously halted in the error state in order to reset the
QTD error count. The various fine-grained interrupt handlers do not
consider that other interrupts besides themselves were unmasked.

By disabling the two other interrupts only ever enabled in DMA mode
for this purpose, we can avoid unnecessary function calls in the
IRQ handler. This will also prevent an unneccesary FIQ interrupt
from being generated if the FIQ is enabled.

dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ

In the case of a transaction to a device that had previously aborted
due to an error, several interrupts are enabled to reset the error
count when a device responds. This has the side-effect of making the
FIQ thrash because the hardware will generate multiple instances of
a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
associated interrupts.

Additionally, on non-split transactions make sure that only unmasked
interrupts are cleared. This caused a hard-to-trigger but serious
race condition when you had the combination of an endpoint awaiting
error recovery and a transaction completed on an endpoint - due to
the sequencing and timing of interrupts generated by the dwc_otg core,
it was possible to confuse the IRQ handler.

Fix function tracing

dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue

dwc_otg: prevent OOPSes during device disconnects

The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
friends does not occur within a critical section and so if a device
was unplugged during activity there was a high chance that the
usbcore hub_thread would try to disable the endpoint with partially-
formed entries in the URB queue. This would result in BUG() or null
pointer dereferences.

Fix so that access of urb->hcpriv, enqueuing to the hardware and
adding to usbcore endpoint URB lists is contained within a single
critical section.

dwc_otg: prevent BUG() in TT allocation if hub address is > 16

A fixed-size array is used to track TT allocation. This was
previously set to 16 which caused a crash because
dwc_otg_hcd_allocate_port would read past the end of the array.

This was hit if a hub was plugged in which enumerated as addr > 16,
due to previous device resets or unplugs.

Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
to a large size if 128 hub addresses are supported. This field is
for debug only for tracking which frame an allocate happened in.

dwc_otg: make channel halts with unknown state less damaging

If the IRQ received a channel halt interrupt through the FIQ
with no other bits set, the IRQ would not release the host
channel and never complete the URB.

Add catchall handling to treat as a transaction error and retry.

dwc_otg: fiq_split: use TTs with more granularity

This fixes certain issues with split transaction scheduling.

- Isochronous multi-packet OUT transactions now hog the TT until
  they are completed - this prevents hubs aborting transactions
  if they get a periodic start-split out-of-order
- Don't perform TT allocation on non-periodic endpoints - this
  allows simultaneous use of the TT's bulk/control and periodic
  transaction buffers

This commit will mainly affect USB audio playback.

dwc_otg: fix potential sleep while atomic during urb enqueue

Fixes a regression introduced with eb1b482a. Kmalloc called from
dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
the GPF_ATOMIC flag set. Force this flag when inside the larger
critical section.

dwc_otg: make fiq_split_enable imply fiq_fix_enable

Failing to set up the FIQ correctly would result in
"IRQ 32: nobody cared" errors in dmesg.

dwc_otg: prevent crashes on host port disconnects

Fix several issues resulting in crashes or inconsistent state
if a Model A root port was disconnected.

- Clean up queue heads properly in kill_urbs_in_qh_list by
  removing the empty QHs from the schedule lists
- Set the halt status properly to prevent IRQ handlers from
  using freed memory
- Add fiq_split related cleanup for saved registers
- Make microframe scheduling reclaim host channels if
  active during a disconnect
- Abort URBs with -ESHUTDOWN status response, informing
  device drivers so they respond in a more correct fashion
  and don't try to resubmit URBs
- Prevent IRQ handlers from attempting to handle channel
  interrupts if the associated URB was dequeued (and the
  driver state was cleared)

dwc_otg: prevent leaking URBs during enqueue

A dwc_otg_urb would get leaked if the HCD enqueue function
failed for any reason. Free the URB at the appropriate points.

dwc_otg: Enable NAK holdoff for control split transactions

Certain low-speed devices take a very long time to complete a
data or status stage of a control transaction, producing NAK
responses until they complete internal processing - the USB2.0
spec limit is up to 500mS. This causes the same type of interrupt
storm as seen with USB-serial dongles prior to c8edb238.

In certain circumstances, usually while booting, this interrupt
storm could cause SD card timeouts.

dwc_otg: Fix for occasional lockup on boot when doing a USB reset

dwc_otg: Don't issue traffic to LS devices in FS mode

Issuing low-speed packets when the root port is in full-speed mode
causes the root port to stop responding. Explicitly fail when
enqueuing URBs to a LS endpoint on a FS bus.

Fix ARM architecture issue with local_irq_restore()

If local_fiq_enable() is called before a local_irq_restore(flags) where
the flags variable has the F bit set, the FIQ will be erroneously disabled.

Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.

Also fix some of the hacks previously implemented for previous dwc_otg
incarnations.

dwc_otg: fiq_fsm: Base commit for driver rewrite

This commit removes the previous FIQ fixes entirely and adds fiq_fsm.

This rewrite features much more complete support for split transactions
and takes into account several OTG hardware bugs. High-speed
isochronous transactions are also capable of being performed by fiq_fsm.

All driver options have been removed and replaced with:
  - dwc_otg.fiq_enable (bool)
  - dwc_otg.fiq_fsm_enable (bool)
  - dwc_otg.fiq_fsm_mask (bitmask)
  - dwc_otg.nak_holdoff (unsigned int)

Defaults are specified such that fiq_fsm behaves similarly to the
previously implemented FIQ fixes.

fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used

If the transfer associated with a QTD failed due to a bus error, the HCD
would retry the transfer up to 3 times (implementing the USB2.0
three-strikes retry in software).

Due to the masking mechanism used by fiq_fsm, it is only possible to pass
a single interrupt through to the HCD per-transfer.

In this instance host channels would fall off the radar because the error
reset would function, but the subsequent channel halt would be lost.

Push the error count reset into the FIQ handler.

fiq_fsm: Implement timeout mechanism

For full-speed endpoints with a large packet size, interrupt latency
runs the risk of the FIQ starting a transaction too late in a full-speed
frame. If the device is still transmitting data when EOF2 for the
downstream frame occurs, the hub will disable the port. This change is
not reflected in the hub status endpoint and the device becomes
unresponsive.

Prevent high-bandwidth transactions from being started too late in a
frame. The mechanism is not guaranteed: a combination of bit stuffing
and hub latency may still result in a device overrunning.

fiq_fsm: fix bounce buffer utilisation for Isochronous OUT

Multi-packet isochronous OUT transactions were subject to a few bounday
bugs. Fix them.

Audio playback is now much more robust: however, an issue stands with
devices that have adaptive sinks - ALSA plays samples too fast.

dwc_otg: Return full-speed frame numbers in HS mode

The frame counter increments on every *microframe* in high-speed mode.
Most device drivers expect this number to be in full-speed frames - this
caused considerable confusion to e.g. snd_usb_audio which uses the
frame counter to estimate the number of samples played.

fiq_fsm: save PID on completion of interrupt OUT transfers

Also add edge case handling for interrupt transports.

Note that for periodic split IN, data toggles are unimplemented in the
OTG host hardware - it unconditionally accepts any PID.

fiq_fsm: add missing case for fiq_fsm_tt_in_use()

Certain combinations of bitrate and endpoint activity could
result in a periodic transaction erroneously getting started
while the previous Isochronous OUT was still active.

fiq_fsm: clear hcintmsk for aborted transactions

Prevents the FIQ from erroneously handling interrupts
on a timed out channel.

fiq_fsm: enable by default

fiq_fsm: fix dequeues for non-periodic split transactions

If a dequeue happened between the SSPLIT and CSPLIT phases of the
transaction, the HCD would never receive an interrupt.

fiq_fsm: Disable by default

fiq_fsm: Handle HC babble errors

The HCTSIZ transfer size field raises a babble interrupt if
the counter wraps. Handle the resulting interrupt in this case.

dwc_otg: fix interrupt registration for fiq_enable=0

Additionally make the module parameter conditional for wherever
hcd->fiq_state is touched.

fiq_fsm: Enable by default

dwc_otg: Fix various issues with root port and transaction errors

Process the host port interrupts correctly (and don't trample them).
Root port hotplug now functional again.

Fix a few thinkos with the transaction error passthrough for fiq_fsm.

fiq_fsm: Implement hack for Split Interrupt transactions

Hubs aren't too picky about which endpoint we send Control type split
transactions to. By treating Interrupt transfers as Control, it is
possible to use the non-periodic queue in the OTG core as well as the
non-periodic FIFOs in the hub itself. This massively reduces the
microframe exclusivity/contention that periodic split transactions
otherwise have to enforce.

It goes without saying that this is a fairly egregious USB specification
violation, but it works.

Original idea by Hans Petter Selasky @ FreeBSD.org.

dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.

dwc_otg: introduce fiq_fsm_spin(un|)lock()

SMP safety for the FIQ relies on register read-modify write cycles being
completed in the correct order. Several places in the DWC code modify
registers also touched by the FIQ. Protect these by a bare-bones lock
mechanism.

This also makes it possible to run the FIQ and IRQ handlers on different
cores.

fiq_fsm: fix build on bcm2708 and bcm2709 platforms

dwc_otg: put some barriers back where they should be for UP

bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active

dwc_otg: fixup read-modify-write in critical paths

Be more careful about read-modify-write on registers that the FIQ
also touches.

Guard fiq_fsm_spin_lock with fiq_enable check

fiq_fsm: Falling out of the state machine isn't fatal

This edge case can be hit if the port is disabled while the FIQ is
in the middle of a transaction. Make the effects less severe.

Also get rid of the useless return value.

squash: dwc_otg: Allow to build without SMP

usb: core: make overcurrent messages more prominent

Hub overcurrent messages are more serious than "debug". Increase loglevel.

usb: dwc_otg: Don't use dma_to_virt()

Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
Open code the old dma_to_virt() implementation to work around this.

Limit the use of __bus_to_virt() to cases where transfer_buffer_length
is set and transfer_buffer is not set. This is done to increase the
chance that this driver will also work on ARCH_BCM2835.

transfer_buffer should not be NULL if the length is set, but the
comment in the code indicates that there are situations where this
might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
comment pointing to a possible: 'usb storage / SCSI bug'.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dwc_otg: Fix crash when fiq_enable=0

dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly

Certain low-bandwidth high-speed USB devices (specialist audio devices,
compressed-frame webcams) have packet intervals > 1 microframe.

Stride these transfers in the FIQ by using the start-of-frame interrupt
to restart the channel at the right time.

dwc_otg: Force host mode to fix incorrect compute module boards

dwc_otg: Add ARCH_BCM2835 support

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dwc_otg: Simplify FIQ irq number code

Dropping ATAGS means we can simplify the FIQ irq number code.
Also add error checking on the returned irq number.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dwc_otg: Remove duplicate gadget probe/unregister function

dwc_otg: Properly set the HFIR

Douglas Anderson reported:

According to the most up to date version of the dwc2 databook, the FRINT
field of the HFIR register should be programmed to:
* 125 us * (PHY clock freq for HS) - 1
* 1000 us * (PHY clock freq for FS/LS) - 1

This is opposed to older versions of the doc that claimed it should be:
* 125 us * (PHY clock freq for HS)
* 1000 us * (PHY clock freq for FS/LS)

and reported lower timing jitter on a USB analyser

dcw_otg: trim xfer length when buffer larger than allocated size is received

dwc_otg: Don't free qh align buffers in atomic context

dwc_otg: Enable the hack for Split Interrupt transactions by default

dwc_otg.fiq_fsm_mask=0xF has long been a suggestion for users with audio stutters or other USB bandwidth issues.
So far we are aware of many success stories but no failure caused by this setting.
Make it a default to learn more.

See: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=70437

Signed-off-by: popcornmix <popcornmix@gmail.com>

dwc_otg: Use kzalloc when suitable

dwc_otg: Pass struct device to dma_alloc*()

This makes it possible to get the bus address from Device Tree.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dwc_otg: fix summarize urb->actual_length for isochronous transfers

Kernel does not copy input data of ISO transfers to userspace
if actual_length is set only in ISO transfers and not summarized
in urb->actual_length. Fixes raspberrypi/linux#903

fiq_fsm: Use correct states when starting isoc OUT transfers

In fiq_fsm_start_next_periodic() if an isochronous OUT transfer
was selected, no regard was given as to whether this was a single-packet
transfer or a multi-packet staged transfer.

For single-packet transfers, this had the effect of repeatedly sending
OUT packets with bogus data and lengths.

Eventually if the channel was repeatedly enabled enough times, this
would lock up the OTG core and no further bus transfers would happen.

Set the FSM state up properly if we select a single-packet transfer.

Fixes https://github.com/raspberrypi/linux/issues/1842

dwc_otg: make nak_holdoff work as intended with empty queues

If URBs reading from non-periodic split endpoints were dequeued and
the last transfer from the endpoint was a NAK handshake, the resulting
qh->nak_frame value was stale which would result in unnecessarily long
polling intervals for the first subsequent transfer with a fresh URB.

Fixup qh->nak_frame in dwc_otg_hcd_urb_dequeue and also guard against
a case where a single URB is submitted to the endpoint, a NAK was
received on the transfer immediately prior to receiving data and the
device subsequently resubmits another URB past the qh->nak_frame interval.

Fixes https://github.com/raspberrypi/linux/issues/1709

dwc_otg: fix split transaction data toggle handling around dequeues

See https://github.com/raspberrypi/linux/issues/1709

Fix several issues regarding endpoint state when URBs are dequeued
- If the HCD is disconnected, flush FIQ-enabled channels properly
- Save the data toggle state for bulk endpoints if the last transfer
  from an endpoint where URBs were dequeued returned a data packet
- Reset hc->start_pkt_count properly in assign_and_init_hc()

dwc_otg: fix several potential crash sources

On root port disconnect events, the host driver state is cleared and
in-progress host channels are forcibly stopped. This doesn't play
well with the FIQ running in the background, so:
- Guard the disconnect callback with both the host spinlock and FIQ
  spinlock
- Move qtd dereference in dwc_otg_handle_hc_fsm() after the early-out
  so we don't dereference a qtd that has gone away
- Turn catch-all BUG()s in dwc_otg_handle_hc_fsm() into warnings.

dwc_otg: delete hcd->channel_lock

The lock serves no purpose as it is only held while the HCD spinlock
is already being held.

dwc_otg: remove unnecessary dma-mode channel halts on disconnect interrupt

Host channels are already halted in kill_urbs_in_qh_list() with the
subsequent interrupt processing behaving as if the URB was dequeued
via HCD callback.

There's no need to clobber the host channel registers a second time
as this exposes races between the driver and host channel resulting
in hcd->free_hc_list becoming corrupted.

dwcotg: Allow to build without FIQ on ARM64

Signed-off-by: popcornmix <popcornmix@gmail.com>

dwc_otg: make periodic scheduling behave properly for FS buses

If the root port is in full-speed mode, transfer times at 12mbit/s
would be calculated but matched against high-speed quotas.

Reinitialise hcd->frame_usecs[i] on each port enable event so that
full-speed bandwidth can be tracked sensibly.

Also, don't bother using the FIQ for transfers when in full-speed
mode - at the slower bus speed, interrupt frequency is reduced by
an order of magnitude.

Related issue: https://github.com/raspberrypi/linux/issues/2020

dwc_otg: fiq_fsm: Make isochronous compatibility checks work properly

Get rid of the spammy printk and local pointer mangling.
Also, there is a nominal benefit for using fiq_fsm for isochronous
transfers in FS mode (~1.1k IRQs per second vs 2.1k IRQs per second)
so remove the root port speed check.

dwc_otg: add module parameter int_ep_interval_min

Add a module parameter (defaulting to ignored) that clamps the polling rate
of high-speed Interrupt endpoints to a minimum microframe interval.

The parameter is modifiable at runtime as it is used when activating new
endpoints (such as on device connect).

dwc_otg: fiq_fsm: Add non-periodic TT exclusivity constraints

Certain hub types do not discriminate between pipe direction (IN or OUT)
when considering non-periodic transfers. Therefore these hubs get confused
if multiple transfers are issued in different directions with the same
device address and endpoint number.

Constrain queuing non-periodic split transactions so they are performed
serially in such cases.

Related: https://github.com/raspberrypi/linux/issues/2024

dwc_otg: Fixup change to DRIVER_ATTR interface

dwc_otg: Fix compilation warnings

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

USB_DWCOTG: Disable building dwc_otg as a module (#2265)

When dwc_otg is built as a module, build will fail with the following
error:

ERROR: "DWC_TASK_HI_SCHEDULE" [drivers/usb/host/dwc_otg/dwc_otg.ko] undefined!
scripts/Makefile.modpost:91: recipe for target '__modpost' failed
make[1]: *** [__modpost] Error 1
Makefile:1199: recipe for target 'modules' failed
make: *** [modules] Error 2

Even if the error is solved by including the missing
DWC_TASK_HI_SCHEDULE function, the kernel will panic when loading
dwc_otg.

As a workaround, simply prevent user from building dwc_otg as a module
as the current kernel does not support it.

See: https://github.com/raspberrypi/linux/issues/2258

Signed-off-by: Malik Olivier Boussejra <malik@boussejra.com>

dwc_otg: New timer API

dwc_otg: Fix removed ACCESS_ONCE->READ_ONCE

dwc_otg: don't unconditionally force host mode in dwc_otg_cil_init()

Add the ability to disable force_host_mode for those that want to use
dwc_otg in both device and host modes.

dwc_otg: Fix a regression when dequeueing isochronous transfers

In 282bed95 (dwc_otg: make nak_holdoff work as intended with empty queues)
the dequeue mechanism was changed to leave FIQ-enabled transfers to run
to completion - to avoid leaving hub TT buffers with stale packets lying
around.

This broke FIQ-accelerated isochronous transfers, as this then meant that
dozens of transfers were performed after the dequeue function returned.

Restore the state machine fence for isochronous transfers.

fiq_fsm: rewind DMA pointer for OUT transactions that fail (#2288)

See: https://github.com/raspberrypi/linux/issues/2140

dwc_otg: add smp_mb() to prevent driver state corruption on boot

Occasional crashes have been seen where the FIQ code dereferences
invalid/random pointers immediately after being set up, leading to
panic on boot.

The crash occurs as the FIQ code races against hcd_init_fiq() and
the hcd_init_fiq() code races against the outstanding memory stores
from dwc_otg_hcd_init(). Use explicit barriers after touching
driver state.

usb: dwc_otg: fix memory corruption in dwc_otg driver

[Upstream commit 51b1b6491752ac066ee8d32cc66042fcc955fef6]

The move from the staging tree to the main tree exposed a
longstanding memory corruption bug in the dwc2 driver. The
reordering of the driver initialization caused the dwc2 driver
to corrupt the initialization data of the sdhci driver on the
Raspberry Pi platform, which made the bug show up.

The error is in calling to_usb_device(hsotg->dev), since ->dev
is not a member of struct usb_device. The easiest fix is to
just remove the offending code, since it is not really needed.

Thanks to Stephen Warren for tracking down the cause of this.

Reported-by: Andre Heider <a.heider@gmail.com>
Tested-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
Signed-off-by: Lukas Wunner <lukas@wunner.de>

usb: dwb_otg: Fix unreachable switch statement warning

This warning appears with GCC 7.3.0 from toolchains.bootlin.com:

../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c: In function ‘fiq_fsm_update_hs_isoc’:
../drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c:595:61: warning: statement will never be executed [-Wswitch-unreachable]
   st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
                                            ~~~~~~~~~~~~~~~~~^~~~

Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>

dwc_otg: fiq_fsm: fix incorrect DMA register offset calculation

Rationalise the offset and update all call sites.

Fixes https://github.com/raspberrypi/linux/issues/2408
---
 arch/arm/include/asm/irqflags.h               |   16 +-
 arch/arm/kernel/fiqasm.S                      |    4 +
 drivers/usb/Makefile                          |    1 +
 drivers/usb/core/generic.c                    |    1 +
 drivers/usb/core/hub.c                        |    2 +-
 drivers/usb/core/message.c                    |   79 +
 drivers/usb/core/otg_whitelist.h              |  114 +-
 drivers/usb/gadget/file_storage.c             | 3676 +++++++++
 drivers/usb/host/Kconfig                      |   10 +
 drivers/usb/host/Makefile                     |    2 +
 drivers/usb/host/dwc_common_port/Makefile     |   58 +
 .../usb/host/dwc_common_port/Makefile.fbsd    |   17 +
 .../usb/host/dwc_common_port/Makefile.linux   |   49 +
 drivers/usb/host/dwc_common_port/changes.txt  |  174 +
 .../usb/host/dwc_common_port/doc/doxygen.cfg  |  270 +
 drivers/usb/host/dwc_common_port/dwc_cc.c     |  532 ++
 drivers/usb/host/dwc_common_port/dwc_cc.h     |  224 +
 .../host/dwc_common_port/dwc_common_fbsd.c    | 1308 +++
 .../host/dwc_common_port/dwc_common_linux.c   | 1409 ++++
 .../host/dwc_common_port/dwc_common_nbsd.c    | 1275 +++
 drivers/usb/host/dwc_common_port/dwc_crypto.c |  308 +
 drivers/usb/host/dwc_common_port/dwc_crypto.h |  111 +
 drivers/usb/host/dwc_common_port/dwc_dh.c     |  291 +
 drivers/usb/host/dwc_common_port/dwc_dh.h     |  106 +
 drivers/usb/host/dwc_common_port/dwc_list.h   |  594 ++
 drivers/usb/host/dwc_common_port/dwc_mem.c    |  245 +
 drivers/usb/host/dwc_common_port/dwc_modpow.c |  636 ++
 drivers/usb/host/dwc_common_port/dwc_modpow.h |   34 +
 .../usb/host/dwc_common_port/dwc_notifier.c   |  319 +
 .../usb/host/dwc_common_port/dwc_notifier.h   |  122 +
 drivers/usb/host/dwc_common_port/dwc_os.h     | 1276 +++
 drivers/usb/host/dwc_common_port/usb.h        |  946 +++
 drivers/usb/host/dwc_otg/Makefile             |   82 +
 drivers/usb/host/dwc_otg/doc/doxygen.cfg      |  224 +
 drivers/usb/host/dwc_otg/dummy_audio.c        | 1574 ++++
 drivers/usb/host/dwc_otg/dwc_cfi_common.h     |  142 +
 drivers/usb/host/dwc_otg/dwc_otg_adp.c        |  854 ++
 drivers/usb/host/dwc_otg/dwc_otg_adp.h        |   80 +
 drivers/usb/host/dwc_otg/dwc_otg_attr.c       | 1212 +++
 drivers/usb/host/dwc_otg/dwc_otg_attr.h       |   89 +
 drivers/usb/host/dwc_otg/dwc_otg_cfi.c        | 1876 +++++
 drivers/usb/host/dwc_otg/dwc_otg_cfi.h        |  320 +
 drivers/usb/host/dwc_otg/dwc_otg_cil.c        | 7146 +++++++++++++++++
 drivers/usb/host/dwc_otg/dwc_otg_cil.h        | 1464 ++++
 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c   | 1596 ++++
 drivers/usb/host/dwc_otg/dwc_otg_core_if.h    |  705 ++
 drivers/usb/host/dwc_otg/dwc_otg_dbg.h        |  117 +
 drivers/usb/host/dwc_otg/dwc_otg_driver.c     | 1767 ++++
 drivers/usb/host/dwc_otg/dwc_otg_driver.h     |   86 +
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c    | 1401 ++++
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h    |  372 +
 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S   |   80 +
 drivers/usb/host/dwc_otg/dwc_otg_hcd.c        | 4297 ++++++++++
 drivers/usb/host/dwc_otg/dwc_otg_hcd.h        |  870 ++
 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c   | 1134 +++
 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h     |  417 +
 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c   | 2752 +++++++
 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c  | 1002 +++
 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c  |  971 +++
 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h     |  188 +
 drivers/usb/host/dwc_otg/dwc_otg_pcd.c        | 2725 +++++++
 drivers/usb/host/dwc_otg/dwc_otg_pcd.h        |  273 +
 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h     |  361 +
 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c   | 5148 ++++++++++++
 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c  | 1280 +++
 drivers/usb/host/dwc_otg/dwc_otg_regs.h       | 2550 ++++++
 drivers/usb/host/dwc_otg/test/Makefile        |   16 +
 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm |  337 +
 .../usb/host/dwc_otg/test/test_mod_param.pl   |  133 +
 drivers/usb/host/dwc_otg/test/test_sysfs.pl   |  193 +
 70 files changed, 60027 insertions(+), 16 deletions(-)
 create mode 100644 drivers/usb/gadget/file_storage.c
 create mode 100644 drivers/usb/host/dwc_common_port/Makefile
 create mode 100644 drivers/usb/host/dwc_common_port/Makefile.fbsd
 create mode 100644 drivers/usb/host/dwc_common_port/Makefile.linux
 create mode 100644 drivers/usb/host/dwc_common_port/changes.txt
 create mode 100644 drivers/usb/host/dwc_common_port/doc/doxygen.cfg
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_cc.h
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_linux.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_crypto.h
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_dh.h
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_list.h
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_mem.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_modpow.h
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.c
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_notifier.h
 create mode 100644 drivers/usb/host/dwc_common_port/dwc_os.h
 create mode 100644 drivers/usb/host/dwc_common_port/usb.h
 create mode 100644 drivers/usb/host/dwc_otg/Makefile
 create mode 100644 drivers/usb/host/dwc_otg/doc/doxygen.cfg
 create mode 100644 drivers/usb/host/dwc_otg/dummy_audio.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_cfi_common.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_adp.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_attr.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cfi.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_core_if.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_dbg.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_driver.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
 create mode 100644 drivers/usb/host/dwc_otg/dwc_otg_regs.h
 create mode 100644 drivers/usb/host/dwc_otg/test/Makefile
 create mode 100644 drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
 create mode 100644 drivers/usb/host/dwc_otg/test/test_mod_param.pl
 create mode 100644 drivers/usb/host/dwc_otg/test/test_sysfs.pl

diff --git a/arch/arm/include/asm/irqflags.h b/arch/arm/include/asm/irqflags.h
index aeec7f24eb75b..a3b186608c609 100644
--- a/arch/arm/include/asm/irqflags.h
+++ b/arch/arm/include/asm/irqflags.h
@@ -163,13 +163,23 @@ static inline unsigned long arch_local_save_flags(void)
 }
 
 /*
- * restore saved IRQ & FIQ state
+ * restore saved IRQ state
  */
 #define arch_local_irq_restore arch_local_irq_restore
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-	asm volatile(
-		"	msr	" IRQMASK_REG_NAME_W ", %0	@ local_irq_restore"
+	unsigned long temp = 0;
+	flags &= ~(1 << 6);
+	asm volatile (
+		" mrs %0, cpsr"
+		: "=r" (temp)
+		:
+		: "memory", "cc");
+		/* Preserve FIQ bit */
+		temp &= (1 << 6);
+		flags = flags | temp;
+	asm volatile (
+		"    msr    cpsr_c, %0    @ local_irq_restore"
 		:
 		: "r" (flags)
 		: "memory", "cc");
diff --git a/arch/arm/kernel/fiqasm.S b/arch/arm/kernel/fiqasm.S
index 8dd26e1a9bd69..eef484756af21 100644
--- a/arch/arm/kernel/fiqasm.S
+++ b/arch/arm/kernel/fiqasm.S
@@ -47,3 +47,7 @@ ENTRY(__get_fiq_regs)
 	mov	r0, r0		@ avoid hazard prior to ARMv4
 	ret	lr
 ENDPROC(__get_fiq_regs)
+
+ENTRY(__FIQ_Branch)
+	mov pc, r8
+ENDPROC(__FIQ_Branch)
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 7d1b8c82b2089..2810d7153f574 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -8,6 +8,7 @@
 obj-$(CONFIG_USB)		+= core/
 obj-$(CONFIG_USB_SUPPORT)	+= phy/
 
+obj-$(CONFIG_USB_DWCOTG)	+= host/
 obj-$(CONFIG_USB_DWC3)		+= dwc3/
 obj-$(CONFIG_USB_DWC2)		+= dwc2/
 obj-$(CONFIG_USB_ISP1760)	+= isp1760/
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index bc8242bc4564b..86dc8a0897444 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -154,6 +154,7 @@ int usb_choose_configuration(struct usb_device *udev)
 		dev_warn(&udev->dev,
 			"no configuration chosen from %d choice%s\n",
 			num_configs, plural(num_configs));
+		dev_warn(&udev->dev, "No support over %dmA\n", udev->bus_mA);
 	}
 	return i;
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bbcfa63d0233b..e7aa6a841f432 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5207,7 +5207,7 @@ static void port_event(struct usb_hub *hub, int port1)
 		u16 status = 0, unused;
 		port_dev->over_current_count++;
 
-		dev_dbg(&port_dev->dev, "over-current change #%u\n",
+		dev_notice(&port_dev->dev, "over-current change #%u\n",
 			port_dev->over_current_count);
 		usb_clear_port_feature(hdev, port1,
 				USB_PORT_FEAT_C_OVER_CURRENT);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 4020ce8db6ce5..9b5411635f96d 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1993,6 +1993,85 @@ free_interfaces:
 	if (cp->string == NULL &&
 			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
 		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
+/* Uncomment this define to enable the HS Electrical Test support */
+#define DWC_HS_ELECT_TST 1
+#ifdef DWC_HS_ELECT_TST
+		/* Here we implement the HS Electrical Test support. The
+		 * tester uses a vendor ID of 0x1A0A to indicate we should
+		 * run a special test sequence. The product ID tells us
+		 * which sequence to run. We invoke the test sequence by
+		 * sending a non-standard SetFeature command to our root
+		 * hub port. Our dwc_otg_hcd_hub_control() routine will
+		 * recognize the command and perform the desired test
+		 * sequence.
+		 */
+		if (dev->descriptor.idVendor == 0x1A0A) {
+			/* HSOTG Electrical Test */
+			dev_warn(&dev->dev, "VID from HSOTG Electrical Test Fixture\n");
+
+			if (dev->bus && dev->bus->root_hub) {
+				struct usb_device *hdev = dev->bus->root_hub;
+				dev_warn(&dev->dev, "Got PID 0x%x\n", dev->descriptor.idProduct);
+
+				switch (dev->descriptor.idProduct) {
+				case 0x0101:	/* TEST_SE0_NAK */
+					dev_warn(&dev->dev, "TEST_SE0_NAK\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x300, NULL, 0, HZ);
+					break;
+
+				case 0x0102:	/* TEST_J */
+					dev_warn(&dev->dev, "TEST_J\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x100, NULL, 0, HZ);
+					break;
+
+				case 0x0103:	/* TEST_K */
+					dev_warn(&dev->dev, "TEST_K\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x200, NULL, 0, HZ);
+					break;
+
+				case 0x0104:	/* TEST_PACKET */
+					dev_warn(&dev->dev, "TEST_PACKET\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x400, NULL, 0, HZ);
+					break;
+
+				case 0x0105:	/* TEST_FORCE_ENABLE */
+					dev_warn(&dev->dev, "TEST_FORCE_ENABLE\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x500, NULL, 0, HZ);
+					break;
+
+				case 0x0106:	/* HS_HOST_PORT_SUSPEND_RESUME */
+					dev_warn(&dev->dev, "HS_HOST_PORT_SUSPEND_RESUME\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x600, NULL, 0, 40 * HZ);
+					break;
+
+				case 0x0107:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
+					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x700, NULL, 0, 40 * HZ);
+					break;
+
+				case 0x0108:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
+					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x800, NULL, 0, 40 * HZ);
+				}
+			}
+		}
+#endif /* DWC_HS_ELECT_TST */
 
 	/* Now that the interfaces are installed, re-enable LPM. */
 	usb_unlocked_enable_lpm(dev);
diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
index 2ae90158ded72..150d4fa1e09bc 100644
--- a/drivers/usb/core/otg_whitelist.h
+++ b/drivers/usb/core/otg_whitelist.h
@@ -15,33 +15,82 @@
 static struct usb_device_id whitelist_table[] = {
 
 /* hubs are optional in OTG, but very handy ... */
+#define CERT_WITHOUT_HUBS
+#if defined(CERT_WITHOUT_HUBS)
+{ USB_DEVICE( 0x0000, 0x0000 ), }, /* Root HUB Only*/
+#else
 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 0), },
 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 1), },
+{ USB_DEVICE_INFO(USB_CLASS_HUB, 0, 2), },
+#endif
 
 #ifdef	CONFIG_USB_PRINTER		/* ignoring nonstatic linkage! */
 /* FIXME actually, printers are NOT supposed to use device classes;
  * they're supposed to use interface classes...
  */
-{ USB_DEVICE_INFO(7, 1, 1) },
-{ USB_DEVICE_INFO(7, 1, 2) },
-{ USB_DEVICE_INFO(7, 1, 3) },
+//{ USB_DEVICE_INFO(7, 1, 1) },
+//{ USB_DEVICE_INFO(7, 1, 2) },
+//{ USB_DEVICE_INFO(7, 1, 3) },
 #endif
 
 #ifdef	CONFIG_USB_NET_CDCETHER
 /* Linux-USB CDC Ethernet gadget */
-{ USB_DEVICE(0x0525, 0xa4a1), },
+//{ USB_DEVICE(0x0525, 0xa4a1), },
 /* Linux-USB CDC Ethernet + RNDIS gadget */
-{ USB_DEVICE(0x0525, 0xa4a2), },
+//{ USB_DEVICE(0x0525, 0xa4a2), },
 #endif
 
 #if	IS_ENABLED(CONFIG_USB_TEST)
 /* gadget zero, for testing */
-{ USB_DEVICE(0x0525, 0xa4a0), },
+//{ USB_DEVICE(0x0525, 0xa4a0), },
 #endif
 
+/* OPT Tester */
+{ USB_DEVICE( 0x1a0a, 0x0101 ), }, /* TEST_SE0_NAK */
+{ USB_DEVICE( 0x1a0a, 0x0102 ), }, /* Test_J */
+{ USB_DEVICE( 0x1a0a, 0x0103 ), }, /* Test_K */
+{ USB_DEVICE( 0x1a0a, 0x0104 ), }, /* Test_PACKET */
+{ USB_DEVICE( 0x1a0a, 0x0105 ), }, /* Test_FORCE_ENABLE */
+{ USB_DEVICE( 0x1a0a, 0x0106 ), }, /* HS_PORT_SUSPEND_RESUME  */
+{ USB_DEVICE( 0x1a0a, 0x0107 ), }, /* SINGLE_STEP_GET_DESCRIPTOR setup */
+{ USB_DEVICE( 0x1a0a, 0x0108 ), }, /* SINGLE_STEP_GET_DESCRIPTOR execute */
+
+/* Sony cameras */
+{ USB_DEVICE_VER(0x054c,0x0010,0x0410, 0x0500), },
+
+/* Memory Devices */
+//{ USB_DEVICE( 0x0781, 0x5150 ), }, /* SanDisk */
+//{ USB_DEVICE( 0x05DC, 0x0080 ), }, /* Lexar */
+//{ USB_DEVICE( 0x4146, 0x9281 ), }, /* IOMEGA */
+//{ USB_DEVICE( 0x067b, 0x2507 ), }, /* Hammer 20GB External HD  */
+{ USB_DEVICE( 0x0EA0, 0x2168 ), }, /* Ours Technology Inc. (BUFFALO ClipDrive)*/
+//{ USB_DEVICE( 0x0457, 0x0150 ), }, /* Silicon Integrated Systems Corp. */
+
+/* HP Printers */
+//{ USB_DEVICE( 0x03F0, 0x1102 ), }, /* HP Photosmart 245 */
+//{ USB_DEVICE( 0x03F0, 0x1302 ), }, /* HP Photosmart 370 Series */
+
+/* Speakers */
+//{ USB_DEVICE( 0x0499, 0x3002 ), }, /* YAMAHA YST-MS35D USB Speakers */
+//{ USB_DEVICE( 0x0672, 0x1041 ), }, /* Labtec USB Headset */
+
 { }	/* Terminating entry */
 };
 
+static inline void report_errors(struct usb_device *dev)
+{
+	/* OTG MESSAGE: report errors here, customize to match your product */
+	dev_info(&dev->dev, "device Vendor:%04x Product:%04x is not supported\n",
+		 le16_to_cpu(dev->descriptor.idVendor),
+		 le16_to_cpu(dev->descriptor.idProduct));
+        if (USB_CLASS_HUB == dev->descriptor.bDeviceClass){
+                dev_printk(KERN_CRIT, &dev->dev, "Unsupported Hub Topology\n");
+        } else {
+                dev_printk(KERN_CRIT, &dev->dev, "Attached Device is not Supported\n");
+        }
+}
+
+
 static int is_targeted(struct usb_device *dev)
 {
 	struct usb_device_id	*id = whitelist_table;
@@ -91,16 +140,57 @@ static int is_targeted(struct usb_device *dev)
 			continue;
 
 		return 1;
-	}
+		/* NOTE: can't use usb_match_id() since interface caches
+		 * aren't set up yet. this is cut/paste from that code.
+		 */
+		for (id = whitelist_table; id->match_flags; id++) {
+#ifdef DEBUG
+			dev_dbg(&dev->dev,
+				"ID: V:%04x P:%04x DC:%04x SC:%04x PR:%04x \n",
+				id->idVendor,
+				id->idProduct,
+				id->bDeviceClass,
+				id->bDeviceSubClass,
+				id->bDeviceProtocol);
+#endif
 
-	/* add other match criteria here ... */
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
+			    id->idVendor != le16_to_cpu(dev->descriptor.idVendor))
+				continue;
 
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
+			    id->idProduct != le16_to_cpu(dev->descriptor.idProduct))
+				continue;
 
-	/* OTG MESSAGE: report errors here, customize to match your product */
-	dev_err(&dev->dev, "device v%04x p%04x is not supported\n",
-		le16_to_cpu(dev->descriptor.idVendor),
-		le16_to_cpu(dev->descriptor.idProduct));
+			/* No need to test id->bcdDevice_lo != 0, since 0 is never
+			   greater than any unsigned number. */
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
+			    (id->bcdDevice_lo > le16_to_cpu(dev->descriptor.bcdDevice)))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
+			    (id->bcdDevice_hi < le16_to_cpu(dev->descriptor.bcdDevice)))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
+			    (id->bDeviceClass != dev->descriptor.bDeviceClass))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
+			    (id->bDeviceSubClass != dev->descriptor.bDeviceSubClass))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
+			    (id->bDeviceProtocol != dev->descriptor.bDeviceProtocol))
+				continue;
+
+			return 1;
+		}
+	}
+
+	/* add other match criteria here ... */
 
+	report_errors(dev);
 	return 0;
 }
 
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
new file mode 100644
index 0000000000000..a896d73f7a933
--- /dev/null
+++ b/drivers/usb/gadget/file_storage.c
@@ -0,0 +1,3676 @@
+/*
+ * file_storage.c -- File-backed USB Storage Gadget, for USB development
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * The File-backed Storage Gadget acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
+ * to providing an example of a genuinely useful gadget driver for a USB
+ * device, it also illustrates a technique of double-buffering for increased
+ * throughput.  Last but not least, it gives an easy way to probe the
+ * behavior of the Mass Storage drivers in a USB host.
+ *
+ * Backing storage is provided by a regular file or a block device, specified
+ * by the "file" module parameter.  Access can be limited to read-only by
+ * setting the optional "ro" module parameter.  (For CD-ROM emulation,
+ * access is always read-only.)  The gadget will indicate that it has
+ * removable media if the optional "removable" module parameter is set.
+ *
+ * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
+ * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
+ * by the optional "transport" module parameter.  It also supports the
+ * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
+ * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
+ * the optional "protocol" module parameter.  In addition, the default
+ * Vendor ID, Product ID, release number and serial number can be overridden.
+ *
+ * There is support for multiple logical units (LUNs), each of which has
+ * its own backing file.  The number of LUNs can be set using the optional
+ * "luns" module parameter (anywhere from 1 to 8), and the corresponding
+ * files are specified using comma-separated lists for "file" and "ro".
+ * The default number of LUNs is taken from the number of "file" elements;
+ * it is 1 if "file" is not given.  If "removable" is not set then a backing
+ * file must be specified for each LUN.  If it is set, then an unspecified
+ * or empty backing filename means the LUN's medium is not loaded.  Ideally
+ * each LUN would be settable independently as a disk drive or a CD-ROM
+ * drive, but currently all LUNs have to be the same type.  The CD-ROM
+ * emulation includes a single data track and no audio tracks; hence there
+ * need be only one backing file per LUN.
+ *
+ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
+ * needed (an interrupt-out endpoint is also needed for CBI).  The memory
+ * requirement amounts to two 16K buffers, size configurable by a parameter.
+ * Support is included for both full-speed and high-speed operation.
+ *
+ * Note that the driver is slightly non-portable in that it assumes a
+ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
+ * interrupt-in endpoints.  With most device controllers this isn't an
+ * issue, but there may be some with hardware restrictions that prevent
+ * a buffer from being used by more than one endpoint.
+ *
+ * Module options:
+ *
+ *	file=filename[,filename...]
+ *				Required if "removable" is not set, names of
+ *					the files or block devices used for
+ *					backing storage
+ *	serial=HHHH...		Required serial number (string of hex chars)
+ *	ro=b[,b...]		Default false, booleans for read-only access
+ *	removable		Default false, boolean for removable media
+ *	luns=N			Default N = number of filenames, number of
+ *					LUNs to support
+ *	nofua=b[,b...]		Default false, booleans for ignore FUA flag
+ *					in SCSI WRITE(10,12) commands
+ *	stall			Default determined according to the type of
+ *					USB device controller (usually true),
+ *					boolean to permit the driver to halt
+ *					bulk endpoints
+ *	cdrom			Default false, boolean for whether to emulate
+ *					a CD-ROM drive
+ *	transport=XXX		Default BBB, transport name (CB, CBI, or BBB)
+ *	protocol=YYY		Default SCSI, protocol name (RBC, 8020 or
+ *					ATAPI, QIC, UFI, 8070, or SCSI;
+ *					also 1 - 6)
+ *	vendor=0xVVVV		Default 0x0525 (NetChip), USB Vendor ID
+ *	product=0xPPPP		Default 0xa4a5 (FSG), USB Product ID
+ *	release=0xRRRR		Override the USB release number (bcdDevice)
+ *	buflen=N		Default N=16384, buffer size used (will be
+ *					rounded down to a multiple of
+ *					PAGE_CACHE_SIZE)
+ *
+ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
+ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
+ * default values are used for everything else.
+ *
+ * The pathnames of the backing files and the ro settings are available in
+ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
+ * the gadget's sysfs directory.  If the "removable" option is set, writing to
+ * these files will simulate ejecting/loading the medium (writing an empty
+ * line means eject) and adjusting a write-enable tab.  Changes to the ro
+ * setting are not allowed when the medium is loaded or if CD-ROM emulation
+ * is being used.
+ *
+ * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
+ * The driver's SCSI command interface was based on the "Information
+ * technology - Small Computer System Interface - 2" document from
+ * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
+ * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
+ * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
+ * "Universal Serial Bus Mass Storage Class UFI Command Specification"
+ * document, Revision 1.0, December 14, 1998, available at
+ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
+ */
+
+
+/*
+ *				Driver Design
+ *
+ * The FSG driver is fairly straightforward.  There is a main kernel
+ * thread that handles most of the work.  Interrupt routines field
+ * callbacks from the controller driver: bulk- and interrupt-request
+ * completion notifications, endpoint-0 events, and disconnect events.
+ * Completion events are passed to the main thread by wakeup calls.  Many
+ * ep0 requests are handled at interrupt time, but SetInterface,
+ * SetConfiguration, and device reset requests are forwarded to the
+ * thread in the form of "exceptions" using SIGUSR1 signals (since they
+ * should interrupt any ongoing file I/O operations).
+ *
+ * The thread's main routine implements the standard command/data/status
+ * parts of a SCSI interaction.  It and its subroutines are full of tests
+ * for pending signals/exceptions -- all this polling is necessary since
+ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
+ * indication that the driver really wants to be running in userspace.)
+ * An important point is that so long as the thread is alive it keeps an
+ * open reference to the backing file.  This will prevent unmounting
+ * the backing file's underlying filesystem and could cause problems
+ * during system shutdown, for example.  To prevent such problems, the
+ * thread catches INT, TERM, and KILL signals and converts them into
+ * an EXIT exception.
+ *
+ * In normal operation the main thread is started during the gadget's
+ * fsg_bind() callback and stopped during fsg_unbind().  But it can also
+ * exit when it receives a signal, and there's no point leaving the
+ * gadget running when the thread is dead.  So just before the thread
+ * exits, it deregisters the gadget driver.  This makes things a little
+ * tricky: The driver is deregistered at two places, and the exiting
+ * thread can indirectly call fsg_unbind() which in turn can tell the
+ * thread to exit.  The first problem is resolved through the use of the
+ * REGISTERED atomic bitflag; the driver will only be deregistered once.
+ * The second problem is resolved by having fsg_unbind() check
+ * fsg->state; it won't try to stop the thread if the state is already
+ * FSG_STATE_TERMINATED.
+ *
+ * To provide maximum throughput, the driver uses a circular pipeline of
+ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
+ * arbitrarily long; in practice the benefits don't justify having more
+ * than 2 stages (i.e., double buffering).  But it helps to think of the
+ * pipeline as being a long one.  Each buffer head contains a bulk-in and
+ * a bulk-out request pointer (since the buffer can be used for both
+ * output and input -- directions always are given from the host's
+ * point of view) as well as a pointer to the buffer and various state
+ * variables.
+ *
+ * Use of the pipeline follows a simple protocol.  There is a variable
+ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
+ * At any time that buffer head may still be in use from an earlier
+ * request, so each buffer head has a state variable indicating whether
+ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
+ * buffer head to be EMPTY, filling the buffer either by file I/O or by
+ * USB I/O (during which the buffer head is BUSY), and marking the buffer
+ * head FULL when the I/O is complete.  Then the buffer will be emptied
+ * (again possibly by USB I/O, during which it is marked BUSY) and
+ * finally marked EMPTY again (possibly by a completion routine).
+ *
+ * A module parameter tells the driver to avoid stalling the bulk
+ * endpoints wherever the transport specification allows.  This is
+ * necessary for some UDCs like the SuperH, which cannot reliably clear a
+ * halt on a bulk endpoint.  However, under certain circumstances the
+ * Bulk-only specification requires a stall.  In such cases the driver
+ * will halt the endpoint and set a flag indicating that it should clear
+ * the halt in software during the next device reset.  Hopefully this
+ * will permit everything to work correctly.  Furthermore, although the
+ * specification allows the bulk-out endpoint to halt when the host sends
+ * too much data, implementing this would cause an unavoidable race.
+ * The driver will always use the "no-stall" approach for OUT transfers.
+ *
+ * One subtle point concerns sending status-stage responses for ep0
+ * requests.  Some of these requests, such as device reset, can involve
+ * interrupting an ongoing file I/O operation, which might take an
+ * arbitrarily long time.  During that delay the host might give up on
+ * the original ep0 request and issue a new one.  When that happens the
+ * driver should not notify the host about completion of the original
+ * request, as the host will no longer be waiting for it.  So the driver
+ * assigns to each ep0 request a unique tag, and it keeps track of the
+ * tag value of the request associated with a long-running exception
+ * (device-reset, interface-change, or configuration-change).  When the
+ * exception handler is finished, the status-stage response is submitted
+ * only if the current ep0 request tag is equal to the exception request
+ * tag.  Thus only the most recently received ep0 request will get a
+ * status-stage response.
+ *
+ * Warning: This driver source file is too long.  It ought to be split up
+ * into a header file plus about 3 separate .c files, to handle the details
+ * of the Gadget, USB Mass Storage, and SCSI protocols.
+ */
+
+
+/* #define VERBOSE_DEBUG */
+/* #define DUMP_MSGS */
+
+
+#include <linux/blkdev.h>
+#include <linux/completion.h>
+#include <linux/dcache.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/fcntl.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/kref.h>
+#include <linux/kthread.h>
+#include <linux/limits.h>
+#include <linux/module.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/freezer.h>
+#include <linux/utsname.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_DESC		"File-backed Storage Gadget"
+#define DRIVER_NAME		"g_file_storage"
+#define DRIVER_VERSION		"1 September 2010"
+
+static       char fsg_string_manufacturer[64];
+static const char fsg_string_product[] = DRIVER_DESC;
+static const char fsg_string_config[] = "Self-powered";
+static const char fsg_string_interface[] = "Mass Storage";
+
+
+#include "storage_common.c"
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Alan Stern");
+MODULE_LICENSE("Dual BSD/GPL");
+
+/*
+ * This driver assumes self-powered hardware and has no way for users to
+ * trigger remote wakeup.  It uses autoconfiguration to select endpoints
+ * and endpoint addresses.
+ */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* Encapsulate the module parameter settings */
+
+static struct {
+	char		*file[FSG_MAX_LUNS];
+	char		*serial;
+	bool		ro[FSG_MAX_LUNS];
+	bool		nofua[FSG_MAX_LUNS];
+	unsigned int	num_filenames;
+	unsigned int	num_ros;
+	unsigned int	num_nofuas;
+	unsigned int	nluns;
+
+	bool		removable;
+	bool		can_stall;
+	bool		cdrom;
+
+	char		*transport_parm;
+	char		*protocol_parm;
+	unsigned short	vendor;
+	unsigned short	product;
+	unsigned short	release;
+	unsigned int	buflen;
+
+	int		transport_type;
+	char		*transport_name;
+	int		protocol_type;
+	char		*protocol_name;
+
+} mod_data = {					// Default values
+	.transport_parm		= "BBB",
+	.protocol_parm		= "SCSI",
+	.removable		= 0,
+	.can_stall		= 1,
+	.cdrom			= 0,
+	.vendor			= FSG_VENDOR_ID,
+	.product		= FSG_PRODUCT_ID,
+	.release		= 0xffff,	// Use controller chip type
+	.buflen			= 16384,
+	};
+
+
+module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
+		S_IRUGO);
+MODULE_PARM_DESC(file, "names of backing files or devices");
+
+module_param_named(serial, mod_data.serial, charp, S_IRUGO);
+MODULE_PARM_DESC(serial, "USB serial number");
+
+module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
+MODULE_PARM_DESC(ro, "true to force read-only");
+
+module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
+		S_IRUGO);
+MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
+
+module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
+MODULE_PARM_DESC(luns, "number of LUNs");
+
+module_param_named(removable, mod_data.removable, bool, S_IRUGO);
+MODULE_PARM_DESC(removable, "true to simulate removable media");
+
+module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
+MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
+
+module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
+MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
+
+/* In the non-TEST version, only the module parameters listed above
+ * are available. */
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
+
+module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
+		"8070, or SCSI)");
+
+module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
+MODULE_PARM_DESC(vendor, "USB Vendor ID");
+
+module_param_named(product, mod_data.product, ushort, S_IRUGO);
+MODULE_PARM_DESC(product, "USB Product ID");
+
+module_param_named(release, mod_data.release, ushort, S_IRUGO);
+MODULE_PARM_DESC(release, "USB release number");
+
+module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
+MODULE_PARM_DESC(buflen, "I/O buffer size");
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*
+ * These definitions will permit the compiler to avoid generating code for
+ * parts of the driver that aren't used in the non-TEST version.  Even gcc
+ * can recognize when a test of a constant expression yields a dead code
+ * path.
+ */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+#define transport_is_bbb()	(mod_data.transport_type == USB_PR_BULK)
+#define transport_is_cbi()	(mod_data.transport_type == USB_PR_CBI)
+#define protocol_is_scsi()	(mod_data.protocol_type == USB_SC_SCSI)
+
+#else
+
+#define transport_is_bbb()	1
+#define transport_is_cbi()	0
+#define protocol_is_scsi()	1
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+struct fsg_dev {
+	/* lock protects: state, all the req_busy's, and cbbuf_cmnd */
+	spinlock_t		lock;
+	struct usb_gadget	*gadget;
+
+	/* filesem protects: backing files in use */
+	struct rw_semaphore	filesem;
+
+	/* reference counting: wait until all LUNs are released */
+	struct kref		ref;
+
+	struct usb_ep		*ep0;		// Handy copy of gadget->ep0
+	struct usb_request	*ep0req;	// For control responses
+	unsigned int		ep0_req_tag;
+	const char		*ep0req_name;
+
+	struct usb_request	*intreq;	// For interrupt responses
+	int			intreq_busy;
+	struct fsg_buffhd	*intr_buffhd;
+
+	unsigned int		bulk_out_maxpacket;
+	enum fsg_state		state;		// For exception handling
+	unsigned int		exception_req_tag;
+
+	u8			config, new_config;
+
+	unsigned int		running : 1;
+	unsigned int		bulk_in_enabled : 1;
+	unsigned int		bulk_out_enabled : 1;
+	unsigned int		intr_in_enabled : 1;
+	unsigned int		phase_error : 1;
+	unsigned int		short_packet_received : 1;
+	unsigned int		bad_lun_okay : 1;
+
+	unsigned long		atomic_bitflags;
+#define REGISTERED		0
+#define IGNORE_BULK_OUT		1
+#define SUSPENDED		2
+
+	struct usb_ep		*bulk_in;
+	struct usb_ep		*bulk_out;
+	struct usb_ep		*intr_in;
+
+	struct fsg_buffhd	*next_buffhd_to_fill;
+	struct fsg_buffhd	*next_buffhd_to_drain;
+
+	int			thread_wakeup_needed;
+	struct completion	thread_notifier;
+	struct task_struct	*thread_task;
+
+	int			cmnd_size;
+	u8			cmnd[MAX_COMMAND_SIZE];
+	enum data_direction	data_dir;
+	u32			data_size;
+	u32			data_size_from_cmnd;
+	u32			tag;
+	unsigned int		lun;
+	u32			residue;
+	u32			usb_amount_left;
+
+	/* The CB protocol offers no way for a host to know when a command
+	 * has completed.  As a result the next command may arrive early,
+	 * and we will still have to handle it.  For that reason we need
+	 * a buffer to store new commands when using CB (or CBI, which
+	 * does not oblige a host to wait for command completion either). */
+	int			cbbuf_cmnd_size;
+	u8			cbbuf_cmnd[MAX_COMMAND_SIZE];
+
+	unsigned int		nluns;
+	struct fsg_lun		*luns;
+	struct fsg_lun		*curlun;
+	/* Must be the last entry */
+	struct fsg_buffhd	buffhds[];
+};
+
+typedef void (*fsg_routine_t)(struct fsg_dev *);
+
+static int exception_in_progress(struct fsg_dev *fsg)
+{
+	return (fsg->state > FSG_STATE_IDLE);
+}
+
+/* Make bulk-out requests be divisible by the maxpacket size */
+static void set_bulk_out_req_length(struct fsg_dev *fsg,
+		struct fsg_buffhd *bh, unsigned int length)
+{
+	unsigned int	rem;
+
+	bh->bulk_out_intended_length = length;
+	rem = length % fsg->bulk_out_maxpacket;
+	if (rem > 0)
+		length += fsg->bulk_out_maxpacket - rem;
+	bh->outreq->length = length;
+}
+
+static struct fsg_dev			*the_fsg;
+static struct usb_gadget_driver		fsg_driver;
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+{
+	const char	*name;
+
+	if (ep == fsg->bulk_in)
+		name = "bulk-in";
+	else if (ep == fsg->bulk_out)
+		name = "bulk-out";
+	else
+		name = ep->name;
+	DBG(fsg, "%s set halt\n", name);
+	return usb_ep_set_halt(ep);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * DESCRIPTORS ... most are static, but strings and (full) configuration
+ * descriptors are built on demand.  Also the (static) config and interface
+ * descriptors are adjusted during fsg_bind().
+ */
+
+/* There is only one configuration. */
+#define	CONFIG_VALUE		1
+
+static struct usb_device_descriptor
+device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+
+	.bcdUSB =		cpu_to_le16(0x0200),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+
+	/* The next three values can be overridden by module parameters */
+	.idVendor =		cpu_to_le16(FSG_VENDOR_ID),
+	.idProduct =		cpu_to_le16(FSG_PRODUCT_ID),
+	.bcdDevice =		cpu_to_le16(0xffff),
+
+	.iManufacturer =	FSG_STRING_MANUFACTURER,
+	.iProduct =		FSG_STRING_PRODUCT,
+	.iSerialNumber =	FSG_STRING_SERIAL,
+	.bNumConfigurations =	1,
+};
+
+static struct usb_config_descriptor
+config_desc = {
+	.bLength =		sizeof config_desc,
+	.bDescriptorType =	USB_DT_CONFIG,
+
+	/* wTotalLength computed by usb_gadget_config_buf() */
+	.bNumInterfaces =	1,
+	.bConfigurationValue =	CONFIG_VALUE,
+	.iConfiguration =	FSG_STRING_CONFIG,
+	.bmAttributes =		USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
+	.bMaxPower =		CONFIG_USB_GADGET_VBUS_DRAW / 2,
+};
+
+
+static struct usb_qualifier_descriptor
+dev_qualifier = {
+	.bLength =		sizeof dev_qualifier,
+	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
+
+	.bcdUSB =		cpu_to_le16(0x0200),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+
+	.bNumConfigurations =	1,
+};
+
+static int populate_bos(struct fsg_dev *fsg, u8 *buf)
+{
+	memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
+	buf += USB_DT_BOS_SIZE;
+
+	memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
+	buf += USB_DT_USB_EXT_CAP_SIZE;
+
+	memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
+
+	return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
+		+ USB_DT_USB_EXT_CAP_SIZE;
+}
+
+/*
+ * Config descriptors must agree with the code that sets configurations
+ * and with code managing interfaces and their altsettings.  They must
+ * also handle different speeds and other-speed requests.
+ */
+static int populate_config_buf(struct usb_gadget *gadget,
+		u8 *buf, u8 type, unsigned index)
+{
+	enum usb_device_speed			speed = gadget->speed;
+	int					len;
+	const struct usb_descriptor_header	**function;
+
+	if (index > 0)
+		return -EINVAL;
+
+	if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
+		speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
+	function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
+		? (const struct usb_descriptor_header **)fsg_hs_function
+		: (const struct usb_descriptor_header **)fsg_fs_function;
+
+	/* for now, don't advertise srp-only devices */
+	if (!gadget_is_otg(gadget))
+		function++;
+
+	len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
+	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
+	return len;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* These routines may be called in process context or in_irq */
+
+/* Caller must hold fsg->lock */
+static void wakeup_thread(struct fsg_dev *fsg)
+{
+	/* Tell the main thread that something has happened */
+	fsg->thread_wakeup_needed = 1;
+	if (fsg->thread_task)
+		wake_up_process(fsg->thread_task);
+}
+
+
+static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
+{
+	unsigned long		flags;
+
+	/* Do nothing if a higher-priority exception is already in progress.
+	 * If a lower-or-equal priority exception is in progress, preempt it
+	 * and notify the main thread by sending it a signal. */
+	spin_lock_irqsave(&fsg->lock, flags);
+	if (fsg->state <= new_state) {
+		fsg->exception_req_tag = fsg->ep0_req_tag;
+		fsg->state = new_state;
+		if (fsg->thread_task)
+			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+					fsg->thread_task);
+	}
+	spin_unlock_irqrestore(&fsg->lock, flags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* The disconnect callback and ep0 routines.  These always run in_irq,
+ * except that ep0_queue() is called in the main thread to acknowledge
+ * completion of various requests: set config, set interface, and
+ * Bulk-only device reset. */
+
+static void fsg_disconnect(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+
+	DBG(fsg, "disconnect or port reset\n");
+	raise_exception(fsg, FSG_STATE_DISCONNECT);
+}
+
+
+static int ep0_queue(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
+	if (rc != 0 && rc != -ESHUTDOWN) {
+
+		/* We can't do much more than wait for a reset */
+		WARNING(fsg, "error in submission: %s --> %d\n",
+				fsg->ep0->name, rc);
+	}
+	return rc;
+}
+
+static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+
+	if (req->actual > 0)
+		dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
+	if (req->status || req->actual != req->length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	if (req->status == 0 && req->context)
+		((fsg_routine_t) (req->context))(fsg);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Bulk and interrupt endpoint completion handlers.
+ * These always run in_irq. */
+
+static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	if (req->status || req->actual != req->length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&fsg->lock);
+	bh->inreq_busy = 0;
+	bh->state = BUF_STATE_EMPTY;
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	dump_msg(fsg, "bulk-out", req->buf, req->actual);
+	if (req->status || req->actual != bh->bulk_out_intended_length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual,
+				bh->bulk_out_intended_length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&fsg->lock);
+	bh->outreq_busy = 0;
+	bh->state = BUF_STATE_FULL;
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	if (req->status || req->actual != req->length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&fsg->lock);
+	fsg->intreq_busy = 0;
+	bh->state = BUF_STATE_EMPTY;
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+#else
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 class-specific handlers.  These always run in_irq. */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct usb_request	*req = fsg->ep0req;
+	static u8		cbi_reset_cmnd[6] = {
+			SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
+
+	/* Error in command transfer? */
+	if (req->status || req->length != req->actual ||
+			req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
+
+		/* Not all controllers allow a protocol stall after
+		 * receiving control-out data, but we'll try anyway. */
+		fsg_set_halt(fsg, fsg->ep0);
+		return;			// Wait for reset
+	}
+
+	/* Is it the special reset command? */
+	if (req->actual >= sizeof cbi_reset_cmnd &&
+			memcmp(req->buf, cbi_reset_cmnd,
+				sizeof cbi_reset_cmnd) == 0) {
+
+		/* Raise an exception to stop the current operation
+		 * and reinitialize our state. */
+		DBG(fsg, "cbi reset request\n");
+		raise_exception(fsg, FSG_STATE_RESET);
+		return;
+	}
+
+	VDBG(fsg, "CB[I] accept device-specific command\n");
+	spin_lock(&fsg->lock);
+
+	/* Save the command for later */
+	if (fsg->cbbuf_cmnd_size)
+		WARNING(fsg, "CB[I] overwriting previous command\n");
+	fsg->cbbuf_cmnd_size = req->actual;
+	memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
+
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+#else
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+static int class_setup_req(struct fsg_dev *fsg,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct usb_request	*req = fsg->ep0req;
+	int			value = -EOPNOTSUPP;
+	u16			w_index = le16_to_cpu(ctrl->wIndex);
+	u16                     w_value = le16_to_cpu(ctrl->wValue);
+	u16			w_length = le16_to_cpu(ctrl->wLength);
+
+	if (!fsg->config)
+		return value;
+
+	/* Handle Bulk-only class-specific requests */
+	if (transport_is_bbb()) {
+		switch (ctrl->bRequest) {
+
+		case US_BULK_RESET_REQUEST:
+			if (ctrl->bRequestType != (USB_DIR_OUT |
+					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+				break;
+			if (w_index != 0 || w_value != 0 || w_length != 0) {
+				value = -EDOM;
+				break;
+			}
+
+			/* Raise an exception to stop the current operation
+			 * and reinitialize our state. */
+			DBG(fsg, "bulk reset request\n");
+			raise_exception(fsg, FSG_STATE_RESET);
+			value = DELAYED_STATUS;
+			break;
+
+		case US_BULK_GET_MAX_LUN:
+			if (ctrl->bRequestType != (USB_DIR_IN |
+					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+				break;
+			if (w_index != 0 || w_value != 0 || w_length != 1) {
+				value = -EDOM;
+				break;
+			}
+			VDBG(fsg, "get max LUN\n");
+			*(u8 *) req->buf = fsg->nluns - 1;
+			value = 1;
+			break;
+		}
+	}
+
+	/* Handle CBI class-specific requests */
+	else {
+		switch (ctrl->bRequest) {
+
+		case USB_CBI_ADSC_REQUEST:
+			if (ctrl->bRequestType != (USB_DIR_OUT |
+					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+				break;
+			if (w_index != 0 || w_value != 0) {
+				value = -EDOM;
+				break;
+			}
+			if (w_length > MAX_COMMAND_SIZE) {
+				value = -EOVERFLOW;
+				break;
+			}
+			value = w_length;
+			fsg->ep0req->context = received_cbi_adsc;
+			break;
+		}
+	}
+
+	if (value == -EOPNOTSUPP)
+		VDBG(fsg,
+			"unknown class-specific control req "
+			"%02x.%02x v%04x i%04x l%u\n",
+			ctrl->bRequestType, ctrl->bRequest,
+			le16_to_cpu(ctrl->wValue), w_index, w_length);
+	return value;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 standard request handlers.  These always run in_irq. */
+
+static int standard_setup_req(struct fsg_dev *fsg,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct usb_request	*req = fsg->ep0req;
+	int			value = -EOPNOTSUPP;
+	u16			w_index = le16_to_cpu(ctrl->wIndex);
+	u16			w_value = le16_to_cpu(ctrl->wValue);
+
+	/* Usually this just stores reply data in the pre-allocated ep0 buffer,
+	 * but config change events will also reconfigure hardware. */
+	switch (ctrl->bRequest) {
+
+	case USB_REQ_GET_DESCRIPTOR:
+		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+				USB_RECIP_DEVICE))
+			break;
+		switch (w_value >> 8) {
+
+		case USB_DT_DEVICE:
+			VDBG(fsg, "get device descriptor\n");
+			device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
+			value = sizeof device_desc;
+			memcpy(req->buf, &device_desc, value);
+			break;
+		case USB_DT_DEVICE_QUALIFIER:
+			VDBG(fsg, "get device qualifier\n");
+			if (!gadget_is_dualspeed(fsg->gadget) ||
+					fsg->gadget->speed == USB_SPEED_SUPER)
+				break;
+			/*
+			 * Assume ep0 uses the same maxpacket value for both
+			 * speeds
+			 */
+			dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
+			value = sizeof dev_qualifier;
+			memcpy(req->buf, &dev_qualifier, value);
+			break;
+
+		case USB_DT_OTHER_SPEED_CONFIG:
+			VDBG(fsg, "get other-speed config descriptor\n");
+			if (!gadget_is_dualspeed(fsg->gadget) ||
+					fsg->gadget->speed == USB_SPEED_SUPER)
+				break;
+			goto get_config;
+		case USB_DT_CONFIG:
+			VDBG(fsg, "get configuration descriptor\n");
+get_config:
+			value = populate_config_buf(fsg->gadget,
+					req->buf,
+					w_value >> 8,
+					w_value & 0xff);
+			break;
+
+		case USB_DT_STRING:
+			VDBG(fsg, "get string descriptor\n");
+
+			/* wIndex == language code */
+			value = usb_gadget_get_string(&fsg_stringtab,
+					w_value & 0xff, req->buf);
+			break;
+
+		case USB_DT_BOS:
+			VDBG(fsg, "get bos descriptor\n");
+
+			if (gadget_is_superspeed(fsg->gadget))
+				value = populate_bos(fsg, req->buf);
+			break;
+		}
+
+		break;
+
+	/* One config, two speeds */
+	case USB_REQ_SET_CONFIGURATION:
+		if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
+				USB_RECIP_DEVICE))
+			break;
+		VDBG(fsg, "set configuration\n");
+		if (w_value == CONFIG_VALUE || w_value == 0) {
+			fsg->new_config = w_value;
+
+			/* Raise an exception to wipe out previous transaction
+			 * state (queued bufs, etc) and set the new config. */
+			raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
+			value = DELAYED_STATUS;
+		}
+		break;
+	case USB_REQ_GET_CONFIGURATION:
+		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+				USB_RECIP_DEVICE))
+			break;
+		VDBG(fsg, "get configuration\n");
+		*(u8 *) req->buf = fsg->config;
+		value = 1;
+		break;
+
+	case USB_REQ_SET_INTERFACE:
+		if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
+				USB_RECIP_INTERFACE))
+			break;
+		if (fsg->config && w_index == 0) {
+
+			/* Raise an exception to wipe out previous transaction
+			 * state (queued bufs, etc) and install the new
+			 * interface altsetting. */
+			raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
+			value = DELAYED_STATUS;
+		}
+		break;
+	case USB_REQ_GET_INTERFACE:
+		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+				USB_RECIP_INTERFACE))
+			break;
+		if (!fsg->config)
+			break;
+		if (w_index != 0) {
+			value = -EDOM;
+			break;
+		}
+		VDBG(fsg, "get interface\n");
+		*(u8 *) req->buf = 0;
+		value = 1;
+		break;
+
+	default:
+		VDBG(fsg,
+			"unknown control req %02x.%02x v%04x i%04x l%u\n",
+			ctrl->bRequestType, ctrl->bRequest,
+			w_value, w_index, le16_to_cpu(ctrl->wLength));
+	}
+
+	return value;
+}
+
+
+static int fsg_setup(struct usb_gadget *gadget,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+	int			rc;
+	int			w_length = le16_to_cpu(ctrl->wLength);
+
+	++fsg->ep0_req_tag;		// Record arrival of a new request
+	fsg->ep0req->context = NULL;
+	fsg->ep0req->length = 0;
+	dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
+
+	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
+		rc = class_setup_req(fsg, ctrl);
+	else
+		rc = standard_setup_req(fsg, ctrl);
+
+	/* Respond with data/status or defer until later? */
+	if (rc >= 0 && rc != DELAYED_STATUS) {
+		rc = min(rc, w_length);
+		fsg->ep0req->length = rc;
+		fsg->ep0req->zero = rc < w_length;
+		fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
+				"ep0-in" : "ep0-out");
+		rc = ep0_queue(fsg);
+	}
+
+	/* Device either stalls (rc < 0) or reports success */
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* All the following routines run in process context */
+
+
+/* Use this for bulk or interrupt transfers, not ep0 */
+static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
+		struct usb_request *req, int *pbusy,
+		enum fsg_buffer_state *state)
+{
+	int	rc;
+
+	if (ep == fsg->bulk_in)
+		dump_msg(fsg, "bulk-in", req->buf, req->length);
+	else if (ep == fsg->intr_in)
+		dump_msg(fsg, "intr-in", req->buf, req->length);
+
+	spin_lock_irq(&fsg->lock);
+	*pbusy = 1;
+	*state = BUF_STATE_BUSY;
+	spin_unlock_irq(&fsg->lock);
+	rc = usb_ep_queue(ep, req, GFP_KERNEL);
+	if (rc != 0) {
+		*pbusy = 0;
+		*state = BUF_STATE_EMPTY;
+
+		/* We can't do much more than wait for a reset */
+
+		/* Note: currently the net2280 driver fails zero-length
+		 * submissions if DMA is enabled. */
+		if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
+						req->length == 0))
+			WARNING(fsg, "error in submission: %s --> %d\n",
+					ep->name, rc);
+	}
+}
+
+
+static int sleep_thread(struct fsg_dev *fsg)
+{
+	int	rc = 0;
+
+	/* Wait until a signal arrives or we are woken up */
+	for (;;) {
+		try_to_freeze();
+		set_current_state(TASK_INTERRUPTIBLE);
+		if (signal_pending(current)) {
+			rc = -EINTR;
+			break;
+		}
+		if (fsg->thread_wakeup_needed)
+			break;
+		schedule();
+	}
+	__set_current_state(TASK_RUNNING);
+	fsg->thread_wakeup_needed = 0;
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_read(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	u32			lba;
+	struct fsg_buffhd	*bh;
+	int			rc;
+	u32			amount_left;
+	loff_t			file_offset, file_offset_tmp;
+	unsigned int		amount;
+	ssize_t			nread;
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	if (fsg->cmnd[0] == READ_6)
+		lba = get_unaligned_be24(&fsg->cmnd[1]);
+	else {
+		lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+		/* We allow DPO (Disable Page Out = don't save data in the
+		 * cache) and FUA (Force Unit Access = don't read from the
+		 * cache), but we don't implement them. */
+		if ((fsg->cmnd[1] & ~0x18) != 0) {
+			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+	file_offset = ((loff_t) lba) << curlun->blkbits;
+
+	/* Carry out the file reads */
+	amount_left = fsg->data_size_from_cmnd;
+	if (unlikely(amount_left == 0))
+		return -EIO;		// No default reply
+
+	for (;;) {
+
+		/* Figure out how much we need to read:
+		 * Try to read the remaining amount.
+		 * But don't read more than the buffer size.
+		 * And don't try to read past the end of the file.
+		 */
+		amount = min((unsigned int) amount_left, mod_data.buflen);
+		amount = min((loff_t) amount,
+				curlun->file_length - file_offset);
+
+		/* Wait for the next buffer to become available */
+		bh = fsg->next_buffhd_to_fill;
+		while (bh->state != BUF_STATE_EMPTY) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+
+		/* If we were asked to read past the end of file,
+		 * end with an empty buffer. */
+		if (amount == 0) {
+			curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			bh->inreq->length = 0;
+			bh->state = BUF_STATE_FULL;
+			break;
+		}
+
+		/* Perform the read */
+		file_offset_tmp = file_offset;
+		nread = vfs_read(curlun->filp,
+				(char __user *) bh->buf,
+				amount, &file_offset_tmp);
+		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+				(unsigned long long) file_offset,
+				(int) nread);
+		if (signal_pending(current))
+			return -EINTR;
+
+		if (nread < 0) {
+			LDBG(curlun, "error in file read: %d\n",
+					(int) nread);
+			nread = 0;
+		} else if (nread < amount) {
+			LDBG(curlun, "partial file read: %d/%u\n",
+					(int) nread, amount);
+			nread = round_down(nread, curlun->blksize);
+		}
+		file_offset  += nread;
+		amount_left  -= nread;
+		fsg->residue -= nread;
+
+		/* Except at the end of the transfer, nread will be
+		 * equal to the buffer size, which is divisible by the
+		 * bulk-in maxpacket size.
+		 */
+		bh->inreq->length = nread;
+		bh->state = BUF_STATE_FULL;
+
+		/* If an error occurred, report it and its position */
+		if (nread < amount) {
+			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			break;
+		}
+
+		if (amount_left == 0)
+			break;		// No more left to read
+
+		/* Send this buffer and go read some more */
+		bh->inreq->zero = 0;
+		start_transfer(fsg, fsg->bulk_in, bh->inreq,
+				&bh->inreq_busy, &bh->state);
+		fsg->next_buffhd_to_fill = bh->next;
+	}
+
+	return -EIO;		// No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_write(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	u32			lba;
+	struct fsg_buffhd	*bh;
+	int			get_some_more;
+	u32			amount_left_to_req, amount_left_to_write;
+	loff_t			usb_offset, file_offset, file_offset_tmp;
+	unsigned int		amount;
+	ssize_t			nwritten;
+	int			rc;
+
+	if (curlun->ro) {
+		curlun->sense_data = SS_WRITE_PROTECTED;
+		return -EINVAL;
+	}
+	spin_lock(&curlun->filp->f_lock);
+	curlun->filp->f_flags &= ~O_SYNC;	// Default is not to wait
+	spin_unlock(&curlun->filp->f_lock);
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	if (fsg->cmnd[0] == WRITE_6)
+		lba = get_unaligned_be24(&fsg->cmnd[1]);
+	else {
+		lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+		/* We allow DPO (Disable Page Out = don't save data in the
+		 * cache) and FUA (Force Unit Access = write directly to the
+		 * medium).  We don't implement DPO; we implement FUA by
+		 * performing synchronous output. */
+		if ((fsg->cmnd[1] & ~0x18) != 0) {
+			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+		/* FUA */
+		if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
+			spin_lock(&curlun->filp->f_lock);
+			curlun->filp->f_flags |= O_DSYNC;
+			spin_unlock(&curlun->filp->f_lock);
+		}
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	/* Carry out the file writes */
+	get_some_more = 1;
+	file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
+	amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
+
+	while (amount_left_to_write > 0) {
+
+		/* Queue a request for more data from the host */
+		bh = fsg->next_buffhd_to_fill;
+		if (bh->state == BUF_STATE_EMPTY && get_some_more) {
+
+			/* Figure out how much we want to get:
+			 * Try to get the remaining amount,
+			 * but not more than the buffer size.
+			 */
+			amount = min(amount_left_to_req, mod_data.buflen);
+
+			/* Beyond the end of the backing file? */
+			if (usb_offset >= curlun->file_length) {
+				get_some_more = 0;
+				curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+				curlun->sense_data_info = usb_offset >> curlun->blkbits;
+				curlun->info_valid = 1;
+				continue;
+			}
+
+			/* Get the next buffer */
+			usb_offset += amount;
+			fsg->usb_amount_left -= amount;
+			amount_left_to_req -= amount;
+			if (amount_left_to_req == 0)
+				get_some_more = 0;
+
+			/* Except at the end of the transfer, amount will be
+			 * equal to the buffer size, which is divisible by
+			 * the bulk-out maxpacket size.
+			 */
+			set_bulk_out_req_length(fsg, bh, amount);
+			start_transfer(fsg, fsg->bulk_out, bh->outreq,
+					&bh->outreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+			continue;
+		}
+
+		/* Write the received data to the backing file */
+		bh = fsg->next_buffhd_to_drain;
+		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
+			break;			// We stopped early
+		if (bh->state == BUF_STATE_FULL) {
+			smp_rmb();
+			fsg->next_buffhd_to_drain = bh->next;
+			bh->state = BUF_STATE_EMPTY;
+
+			/* Did something go wrong with the transfer? */
+			if (bh->outreq->status != 0) {
+				curlun->sense_data = SS_COMMUNICATION_FAILURE;
+				curlun->sense_data_info = file_offset >> curlun->blkbits;
+				curlun->info_valid = 1;
+				break;
+			}
+
+			amount = bh->outreq->actual;
+			if (curlun->file_length - file_offset < amount) {
+				LERROR(curlun,
+	"write %u @ %llu beyond end %llu\n",
+	amount, (unsigned long long) file_offset,
+	(unsigned long long) curlun->file_length);
+				amount = curlun->file_length - file_offset;
+			}
+
+			/* Don't accept excess data.  The spec doesn't say
+			 * what to do in this case.  We'll ignore the error.
+			 */
+			amount = min(amount, bh->bulk_out_intended_length);
+
+			/* Don't write a partial block */
+			amount = round_down(amount, curlun->blksize);
+			if (amount == 0)
+				goto empty_write;
+
+			/* Perform the write */
+			file_offset_tmp = file_offset;
+			nwritten = vfs_write(curlun->filp,
+					(char __user *) bh->buf,
+					amount, &file_offset_tmp);
+			VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
+					(unsigned long long) file_offset,
+					(int) nwritten);
+			if (signal_pending(current))
+				return -EINTR;		// Interrupted!
+
+			if (nwritten < 0) {
+				LDBG(curlun, "error in file write: %d\n",
+						(int) nwritten);
+				nwritten = 0;
+			} else if (nwritten < amount) {
+				LDBG(curlun, "partial file write: %d/%u\n",
+						(int) nwritten, amount);
+				nwritten = round_down(nwritten, curlun->blksize);
+			}
+			file_offset += nwritten;
+			amount_left_to_write -= nwritten;
+			fsg->residue -= nwritten;
+
+			/* If an error occurred, report it and its position */
+			if (nwritten < amount) {
+				curlun->sense_data = SS_WRITE_ERROR;
+				curlun->sense_data_info = file_offset >> curlun->blkbits;
+				curlun->info_valid = 1;
+				break;
+			}
+
+ empty_write:
+			/* Did the host decide to stop early? */
+			if (bh->outreq->actual < bh->bulk_out_intended_length) {
+				fsg->short_packet_received = 1;
+				break;
+			}
+			continue;
+		}
+
+		/* Wait for something to happen */
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+
+	return -EIO;		// No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_synchronize_cache(struct fsg_dev *fsg)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		rc;
+
+	/* We ignore the requested LBA and write out all file's
+	 * dirty data buffers. */
+	rc = fsg_lun_fsync_sub(curlun);
+	if (rc)
+		curlun->sense_data = SS_WRITE_ERROR;
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void invalidate_sub(struct fsg_lun *curlun)
+{
+	struct file	*filp = curlun->filp;
+	struct inode	*inode = filp->f_path.dentry->d_inode;
+	unsigned long	rc;
+
+	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+	VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
+}
+
+static int do_verify(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	u32			lba;
+	u32			verification_length;
+	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
+	loff_t			file_offset, file_offset_tmp;
+	u32			amount_left;
+	unsigned int		amount;
+	ssize_t			nread;
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	lba = get_unaligned_be32(&fsg->cmnd[2]);
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	/* We allow DPO (Disable Page Out = don't save data in the
+	 * cache) but we don't implement it. */
+	if ((fsg->cmnd[1] & ~0x10) != 0) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	verification_length = get_unaligned_be16(&fsg->cmnd[7]);
+	if (unlikely(verification_length == 0))
+		return -EIO;		// No default reply
+
+	/* Prepare to carry out the file verify */
+	amount_left = verification_length << curlun->blkbits;
+	file_offset = ((loff_t) lba) << curlun->blkbits;
+
+	/* Write out all the dirty buffers before invalidating them */
+	fsg_lun_fsync_sub(curlun);
+	if (signal_pending(current))
+		return -EINTR;
+
+	invalidate_sub(curlun);
+	if (signal_pending(current))
+		return -EINTR;
+
+	/* Just try to read the requested blocks */
+	while (amount_left > 0) {
+
+		/* Figure out how much we need to read:
+		 * Try to read the remaining amount, but not more than
+		 * the buffer size.
+		 * And don't try to read past the end of the file.
+		 */
+		amount = min((unsigned int) amount_left, mod_data.buflen);
+		amount = min((loff_t) amount,
+				curlun->file_length - file_offset);
+		if (amount == 0) {
+			curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			break;
+		}
+
+		/* Perform the read */
+		file_offset_tmp = file_offset;
+		nread = vfs_read(curlun->filp,
+				(char __user *) bh->buf,
+				amount, &file_offset_tmp);
+		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+				(unsigned long long) file_offset,
+				(int) nread);
+		if (signal_pending(current))
+			return -EINTR;
+
+		if (nread < 0) {
+			LDBG(curlun, "error in file verify: %d\n",
+					(int) nread);
+			nread = 0;
+		} else if (nread < amount) {
+			LDBG(curlun, "partial file verify: %d/%u\n",
+					(int) nread, amount);
+			nread = round_down(nread, curlun->blksize);
+		}
+		if (nread == 0) {
+			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			break;
+		}
+		file_offset += nread;
+		amount_left -= nread;
+	}
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	u8	*buf = (u8 *) bh->buf;
+
+	static char vendor_id[] = "Linux   ";
+	static char product_disk_id[] = "File-Stor Gadget";
+	static char product_cdrom_id[] = "File-CD Gadget  ";
+
+	if (!fsg->curlun) {		// Unsupported LUNs are okay
+		fsg->bad_lun_okay = 1;
+		memset(buf, 0, 36);
+		buf[0] = 0x7f;		// Unsupported, no device-type
+		buf[4] = 31;		// Additional length
+		return 36;
+	}
+
+	memset(buf, 0, 8);
+	buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
+	if (mod_data.removable)
+		buf[1] = 0x80;
+	buf[2] = 2;		// ANSI SCSI level 2
+	buf[3] = 2;		// SCSI-2 INQUIRY data format
+	buf[4] = 31;		// Additional length
+				// No special options
+	sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
+			(mod_data.cdrom ? product_cdrom_id :
+				product_disk_id),
+			mod_data.release);
+	return 36;
+}
+
+
+static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	u8		*buf = (u8 *) bh->buf;
+	u32		sd, sdinfo;
+	int		valid;
+
+	/*
+	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
+	 *
+	 * If a REQUEST SENSE command is received from an initiator
+	 * with a pending unit attention condition (before the target
+	 * generates the contingent allegiance condition), then the
+	 * target shall either:
+	 *   a) report any pending sense data and preserve the unit
+	 *	attention condition on the logical unit, or,
+	 *   b) report the unit attention condition, may discard any
+	 *	pending sense data, and clear the unit attention
+	 *	condition on the logical unit for that initiator.
+	 *
+	 * FSG normally uses option a); enable this code to use option b).
+	 */
+#if 0
+	if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
+		curlun->sense_data = curlun->unit_attention_data;
+		curlun->unit_attention_data = SS_NO_SENSE;
+	}
+#endif
+
+	if (!curlun) {		// Unsupported LUNs are okay
+		fsg->bad_lun_okay = 1;
+		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+		sdinfo = 0;
+		valid = 0;
+	} else {
+		sd = curlun->sense_data;
+		sdinfo = curlun->sense_data_info;
+		valid = curlun->info_valid << 7;
+		curlun->sense_data = SS_NO_SENSE;
+		curlun->sense_data_info = 0;
+		curlun->info_valid = 0;
+	}
+
+	memset(buf, 0, 18);
+	buf[0] = valid | 0x70;			// Valid, current error
+	buf[2] = SK(sd);
+	put_unaligned_be32(sdinfo, &buf[3]);	/* Sense information */
+	buf[7] = 18 - 8;			// Additional sense length
+	buf[12] = ASC(sd);
+	buf[13] = ASCQ(sd);
+	return 18;
+}
+
+
+static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
+	int		pmi = fsg->cmnd[8];
+	u8		*buf = (u8 *) bh->buf;
+
+	/* Check the PMI and LBA fields */
+	if (pmi > 1 || (pmi == 0 && lba != 0)) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
+						/* Max logical block */
+	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
+	return 8;
+}
+
+
+static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		msf = fsg->cmnd[1] & 0x02;
+	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
+	u8		*buf = (u8 *) bh->buf;
+
+	if ((fsg->cmnd[1] & ~0x02) != 0) {		/* Mask away MSF */
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	memset(buf, 0, 8);
+	buf[0] = 0x01;		/* 2048 bytes of user data, rest is EC */
+	store_cdrom_address(&buf[4], msf, lba);
+	return 8;
+}
+
+
+static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		msf = fsg->cmnd[1] & 0x02;
+	int		start_track = fsg->cmnd[6];
+	u8		*buf = (u8 *) bh->buf;
+
+	if ((fsg->cmnd[1] & ~0x02) != 0 ||		/* Mask away MSF */
+			start_track > 1) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	memset(buf, 0, 20);
+	buf[1] = (20-2);		/* TOC data length */
+	buf[2] = 1;			/* First track number */
+	buf[3] = 1;			/* Last track number */
+	buf[5] = 0x16;			/* Data track, copying allowed */
+	buf[6] = 0x01;			/* Only track is number 1 */
+	store_cdrom_address(&buf[8], msf, 0);
+
+	buf[13] = 0x16;			/* Lead-out track is data */
+	buf[14] = 0xAA;			/* Lead-out track number */
+	store_cdrom_address(&buf[16], msf, curlun->num_sectors);
+	return 20;
+}
+
+
+static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		mscmnd = fsg->cmnd[0];
+	u8		*buf = (u8 *) bh->buf;
+	u8		*buf0 = buf;
+	int		pc, page_code;
+	int		changeable_values, all_pages;
+	int		valid_page = 0;
+	int		len, limit;
+
+	if ((fsg->cmnd[1] & ~0x08) != 0) {		// Mask away DBD
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+	pc = fsg->cmnd[2] >> 6;
+	page_code = fsg->cmnd[2] & 0x3f;
+	if (pc == 3) {
+		curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
+		return -EINVAL;
+	}
+	changeable_values = (pc == 1);
+	all_pages = (page_code == 0x3f);
+
+	/* Write the mode parameter header.  Fixed values are: default
+	 * medium type, no cache control (DPOFUA), and no block descriptors.
+	 * The only variable value is the WriteProtect bit.  We will fill in
+	 * the mode data length later. */
+	memset(buf, 0, 8);
+	if (mscmnd == MODE_SENSE) {
+		buf[2] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
+		buf += 4;
+		limit = 255;
+	} else {			// MODE_SENSE_10
+		buf[3] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
+		buf += 8;
+		limit = 65535;		// Should really be mod_data.buflen
+	}
+
+	/* No block descriptors */
+
+	/* The mode pages, in numerical order.  The only page we support
+	 * is the Caching page. */
+	if (page_code == 0x08 || all_pages) {
+		valid_page = 1;
+		buf[0] = 0x08;		// Page code
+		buf[1] = 10;		// Page length
+		memset(buf+2, 0, 10);	// None of the fields are changeable
+
+		if (!changeable_values) {
+			buf[2] = 0x04;	// Write cache enable,
+					// Read cache not disabled
+					// No cache retention priorities
+			put_unaligned_be16(0xffff, &buf[4]);
+					/* Don't disable prefetch */
+					/* Minimum prefetch = 0 */
+			put_unaligned_be16(0xffff, &buf[8]);
+					/* Maximum prefetch */
+			put_unaligned_be16(0xffff, &buf[10]);
+					/* Maximum prefetch ceiling */
+		}
+		buf += 12;
+	}
+
+	/* Check that a valid page was requested and the mode data length
+	 * isn't too long. */
+	len = buf - buf0;
+	if (!valid_page || len > limit) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	/*  Store the mode data length */
+	if (mscmnd == MODE_SENSE)
+		buf0[0] = len - 1;
+	else
+		put_unaligned_be16(len - 2, buf0);
+	return len;
+}
+
+
+static int do_start_stop(struct fsg_dev *fsg)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		loej, start;
+
+	if (!mod_data.removable) {
+		curlun->sense_data = SS_INVALID_COMMAND;
+		return -EINVAL;
+	}
+
+	// int immed = fsg->cmnd[1] & 0x01;
+	loej = fsg->cmnd[4] & 0x02;
+	start = fsg->cmnd[4] & 0x01;
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+	if ((fsg->cmnd[1] & ~0x01) != 0 ||		// Mask away Immed
+			(fsg->cmnd[4] & ~0x03) != 0) {	// Mask LoEj, Start
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	if (!start) {
+
+		/* Are we allowed to unload the media? */
+		if (curlun->prevent_medium_removal) {
+			LDBG(curlun, "unload attempt prevented\n");
+			curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
+			return -EINVAL;
+		}
+		if (loej) {		// Simulate an unload/eject
+			up_read(&fsg->filesem);
+			down_write(&fsg->filesem);
+			fsg_lun_close(curlun);
+			up_write(&fsg->filesem);
+			down_read(&fsg->filesem);
+		}
+	} else {
+
+		/* Our emulation doesn't support mounting; the medium is
+		 * available for use as soon as it is loaded. */
+		if (!fsg_lun_is_open(curlun)) {
+			curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+			return -EINVAL;
+		}
+	}
+#endif
+	return 0;
+}
+
+
+static int do_prevent_allow(struct fsg_dev *fsg)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		prevent;
+
+	if (!mod_data.removable) {
+		curlun->sense_data = SS_INVALID_COMMAND;
+		return -EINVAL;
+	}
+
+	prevent = fsg->cmnd[4] & 0x01;
+	if ((fsg->cmnd[4] & ~0x01) != 0) {		// Mask away Prevent
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	if (curlun->prevent_medium_removal && !prevent)
+		fsg_lun_fsync_sub(curlun);
+	curlun->prevent_medium_removal = prevent;
+	return 0;
+}
+
+
+static int do_read_format_capacities(struct fsg_dev *fsg,
+			struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	u8		*buf = (u8 *) bh->buf;
+
+	buf[0] = buf[1] = buf[2] = 0;
+	buf[3] = 8;		// Only the Current/Maximum Capacity Descriptor
+	buf += 4;
+
+	put_unaligned_be32(curlun->num_sectors, &buf[0]);
+						/* Number of blocks */
+	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
+	buf[4] = 0x02;				/* Current capacity */
+	return 12;
+}
+
+
+static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+
+	/* We don't support MODE SELECT */
+	curlun->sense_data = SS_INVALID_COMMAND;
+	return -EINVAL;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	rc = fsg_set_halt(fsg, fsg->bulk_in);
+	if (rc == -EAGAIN)
+		VDBG(fsg, "delayed bulk-in endpoint halt\n");
+	while (rc != 0) {
+		if (rc != -EAGAIN) {
+			WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
+			rc = 0;
+			break;
+		}
+
+		/* Wait for a short time and then try again */
+		if (msleep_interruptible(100) != 0)
+			return -EINTR;
+		rc = usb_ep_set_halt(fsg->bulk_in);
+	}
+	return rc;
+}
+
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	DBG(fsg, "bulk-in set wedge\n");
+	rc = usb_ep_set_wedge(fsg->bulk_in);
+	if (rc == -EAGAIN)
+		VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+	while (rc != 0) {
+		if (rc != -EAGAIN) {
+			WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
+			rc = 0;
+			break;
+		}
+
+		/* Wait for a short time and then try again */
+		if (msleep_interruptible(100) != 0)
+			return -EINTR;
+		rc = usb_ep_set_wedge(fsg->bulk_in);
+	}
+	return rc;
+}
+
+static int throw_away_data(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh;
+	u32			amount;
+	int			rc;
+
+	while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
+			fsg->usb_amount_left > 0) {
+
+		/* Throw away the data in a filled buffer */
+		if (bh->state == BUF_STATE_FULL) {
+			smp_rmb();
+			bh->state = BUF_STATE_EMPTY;
+			fsg->next_buffhd_to_drain = bh->next;
+
+			/* A short packet or an error ends everything */
+			if (bh->outreq->actual < bh->bulk_out_intended_length ||
+					bh->outreq->status != 0) {
+				raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+				return -EINTR;
+			}
+			continue;
+		}
+
+		/* Try to submit another request if we need one */
+		bh = fsg->next_buffhd_to_fill;
+		if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
+			amount = min(fsg->usb_amount_left,
+					(u32) mod_data.buflen);
+
+			/* Except at the end of the transfer, amount will be
+			 * equal to the buffer size, which is divisible by
+			 * the bulk-out maxpacket size.
+			 */
+			set_bulk_out_req_length(fsg, bh, amount);
+			start_transfer(fsg, fsg->bulk_out, bh->outreq,
+					&bh->outreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+			fsg->usb_amount_left -= amount;
+			continue;
+		}
+
+		/* Otherwise wait for something to happen */
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+	return 0;
+}
+
+
+static int finish_reply(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
+	int			rc = 0;
+
+	switch (fsg->data_dir) {
+	case DATA_DIR_NONE:
+		break;			// Nothing to send
+
+	/* If we don't know whether the host wants to read or write,
+	 * this must be CB or CBI with an unknown command.  We mustn't
+	 * try to send or receive any data.  So stall both bulk pipes
+	 * if we can and wait for a reset. */
+	case DATA_DIR_UNKNOWN:
+		if (mod_data.can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			rc = halt_bulk_in_endpoint(fsg);
+		}
+		break;
+
+	/* All but the last buffer of data must have already been sent */
+	case DATA_DIR_TO_HOST:
+		if (fsg->data_size == 0)
+			;		// Nothing to send
+
+		/* If there's no residue, simply send the last buffer */
+		else if (fsg->residue == 0) {
+			bh->inreq->zero = 0;
+			start_transfer(fsg, fsg->bulk_in, bh->inreq,
+					&bh->inreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+		}
+
+		/* There is a residue.  For CB and CBI, simply mark the end
+		 * of the data with a short packet.  However, if we are
+		 * allowed to stall, there was no data at all (residue ==
+		 * data_size), and the command failed (invalid LUN or
+		 * sense data is set), then halt the bulk-in endpoint
+		 * instead. */
+		else if (!transport_is_bbb()) {
+			if (mod_data.can_stall &&
+					fsg->residue == fsg->data_size &&
+	(!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
+				bh->state = BUF_STATE_EMPTY;
+				rc = halt_bulk_in_endpoint(fsg);
+			} else {
+				bh->inreq->zero = 1;
+				start_transfer(fsg, fsg->bulk_in, bh->inreq,
+						&bh->inreq_busy, &bh->state);
+				fsg->next_buffhd_to_fill = bh->next;
+			}
+		}
+
+		/*
+		 * For Bulk-only, mark the end of the data with a short
+		 * packet.  If we are allowed to stall, halt the bulk-in
+		 * endpoint.  (Note: This violates the Bulk-Only Transport
+		 * specification, which requires us to pad the data if we
+		 * don't halt the endpoint.  Presumably nobody will mind.)
+		 */
+		else {
+			bh->inreq->zero = 1;
+			start_transfer(fsg, fsg->bulk_in, bh->inreq,
+					&bh->inreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+			if (mod_data.can_stall)
+				rc = halt_bulk_in_endpoint(fsg);
+		}
+		break;
+
+	/* We have processed all we want from the data the host has sent.
+	 * There may still be outstanding bulk-out requests. */
+	case DATA_DIR_FROM_HOST:
+		if (fsg->residue == 0)
+			;		// Nothing to receive
+
+		/* Did the host stop sending unexpectedly early? */
+		else if (fsg->short_packet_received) {
+			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+			rc = -EINTR;
+		}
+
+		/* We haven't processed all the incoming data.  Even though
+		 * we may be allowed to stall, doing so would cause a race.
+		 * The controller may already have ACK'ed all the remaining
+		 * bulk-out packets, in which case the host wouldn't see a
+		 * STALL.  Not realizing the endpoint was halted, it wouldn't
+		 * clear the halt -- leading to problems later on. */
+#if 0
+		else if (mod_data.can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+			rc = -EINTR;
+		}
+#endif
+
+		/* We can't stall.  Read in the excess data and throw it
+		 * all away. */
+		else
+			rc = throw_away_data(fsg);
+		break;
+	}
+	return rc;
+}
+
+
+static int send_status(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	struct fsg_buffhd	*bh;
+	int			rc;
+	u8			status = US_BULK_STAT_OK;
+	u32			sd, sdinfo = 0;
+
+	/* Wait for the next buffer to become available */
+	bh = fsg->next_buffhd_to_fill;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+
+	if (curlun) {
+		sd = curlun->sense_data;
+		sdinfo = curlun->sense_data_info;
+	} else if (fsg->bad_lun_okay)
+		sd = SS_NO_SENSE;
+	else
+		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+
+	if (fsg->phase_error) {
+		DBG(fsg, "sending phase-error status\n");
+		status = US_BULK_STAT_PHASE;
+		sd = SS_INVALID_COMMAND;
+	} else if (sd != SS_NO_SENSE) {
+		DBG(fsg, "sending command-failure status\n");
+		status = US_BULK_STAT_FAIL;
+		VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
+				"  info x%x\n",
+				SK(sd), ASC(sd), ASCQ(sd), sdinfo);
+	}
+
+	if (transport_is_bbb()) {
+		struct bulk_cs_wrap	*csw = bh->buf;
+
+		/* Store and send the Bulk-only CSW */
+		csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
+		csw->Tag = fsg->tag;
+		csw->Residue = cpu_to_le32(fsg->residue);
+		csw->Status = status;
+
+		bh->inreq->length = US_BULK_CS_WRAP_LEN;
+		bh->inreq->zero = 0;
+		start_transfer(fsg, fsg->bulk_in, bh->inreq,
+				&bh->inreq_busy, &bh->state);
+
+	} else if (mod_data.transport_type == USB_PR_CB) {
+
+		/* Control-Bulk transport has no status phase! */
+		return 0;
+
+	} else {			// USB_PR_CBI
+		struct interrupt_data	*buf = bh->buf;
+
+		/* Store and send the Interrupt data.  UFI sends the ASC
+		 * and ASCQ bytes.  Everything else sends a Type (which
+		 * is always 0) and the status Value. */
+		if (mod_data.protocol_type == USB_SC_UFI) {
+			buf->bType = ASC(sd);
+			buf->bValue = ASCQ(sd);
+		} else {
+			buf->bType = 0;
+			buf->bValue = status;
+		}
+		fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
+
+		fsg->intr_buffhd = bh;		// Point to the right buffhd
+		fsg->intreq->buf = bh->inreq->buf;
+		fsg->intreq->context = bh;
+		start_transfer(fsg, fsg->intr_in, fsg->intreq,
+				&fsg->intreq_busy, &bh->state);
+	}
+
+	fsg->next_buffhd_to_fill = bh->next;
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have. */
+static int check_command(struct fsg_dev *fsg, int cmnd_size,
+		enum data_direction data_dir, unsigned int mask,
+		int needs_medium, const char *name)
+{
+	int			i;
+	int			lun = fsg->cmnd[1] >> 5;
+	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
+	char			hdlen[20];
+	struct fsg_lun		*curlun;
+
+	/* Adjust the expected cmnd_size for protocol encapsulation padding.
+	 * Transparent SCSI doesn't pad. */
+	if (protocol_is_scsi())
+		;
+
+	/* There's some disagreement as to whether RBC pads commands or not.
+	 * We'll play it safe and accept either form. */
+	else if (mod_data.protocol_type == USB_SC_RBC) {
+		if (fsg->cmnd_size == 12)
+			cmnd_size = 12;
+
+	/* All the other protocols pad to 12 bytes */
+	} else
+		cmnd_size = 12;
+
+	hdlen[0] = 0;
+	if (fsg->data_dir != DATA_DIR_UNKNOWN)
+		sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
+				fsg->data_size);
+	VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
+			name, cmnd_size, dirletter[(int) data_dir],
+			fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
+
+	/* We can't reply at all until we know the correct data direction
+	 * and size. */
+	if (fsg->data_size_from_cmnd == 0)
+		data_dir = DATA_DIR_NONE;
+	if (fsg->data_dir == DATA_DIR_UNKNOWN) {	// CB or CBI
+		fsg->data_dir = data_dir;
+		fsg->data_size = fsg->data_size_from_cmnd;
+
+	} else {					// Bulk-only
+		if (fsg->data_size < fsg->data_size_from_cmnd) {
+
+			/* Host data size < Device data size is a phase error.
+			 * Carry out the command, but only transfer as much
+			 * as we are allowed. */
+			fsg->data_size_from_cmnd = fsg->data_size;
+			fsg->phase_error = 1;
+		}
+	}
+	fsg->residue = fsg->usb_amount_left = fsg->data_size;
+
+	/* Conflicting data directions is a phase error */
+	if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
+		fsg->phase_error = 1;
+		return -EINVAL;
+	}
+
+	/* Verify the length of the command itself */
+	if (cmnd_size != fsg->cmnd_size) {
+
+		/* Special case workaround: There are plenty of buggy SCSI
+		 * implementations. Many have issues with cbw->Length
+		 * field passing a wrong command size. For those cases we
+		 * always try to work around the problem by using the length
+		 * sent by the host side provided it is at least as large
+		 * as the correct command length.
+		 * Examples of such cases would be MS-Windows, which issues
+		 * REQUEST SENSE with cbw->Length == 12 where it should
+		 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
+		 * REQUEST SENSE with cbw->Length == 10 where it should
+		 * be 6 as well.
+		 */
+		if (cmnd_size <= fsg->cmnd_size) {
+			DBG(fsg, "%s is buggy! Expected length %d "
+					"but we got %d\n", name,
+					cmnd_size, fsg->cmnd_size);
+			cmnd_size = fsg->cmnd_size;
+		} else {
+			fsg->phase_error = 1;
+			return -EINVAL;
+		}
+	}
+
+	/* Check that the LUN values are consistent */
+	if (transport_is_bbb()) {
+		if (fsg->lun != lun)
+			DBG(fsg, "using LUN %d from CBW, "
+					"not LUN %d from CDB\n",
+					fsg->lun, lun);
+	}
+
+	/* Check the LUN */
+	curlun = fsg->curlun;
+	if (curlun) {
+		if (fsg->cmnd[0] != REQUEST_SENSE) {
+			curlun->sense_data = SS_NO_SENSE;
+			curlun->sense_data_info = 0;
+			curlun->info_valid = 0;
+		}
+	} else {
+		fsg->bad_lun_okay = 0;
+
+		/* INQUIRY and REQUEST SENSE commands are explicitly allowed
+		 * to use unsupported LUNs; all others may not. */
+		if (fsg->cmnd[0] != INQUIRY &&
+				fsg->cmnd[0] != REQUEST_SENSE) {
+			DBG(fsg, "unsupported LUN %d\n", fsg->lun);
+			return -EINVAL;
+		}
+	}
+
+	/* If a unit attention condition exists, only INQUIRY and
+	 * REQUEST SENSE commands are allowed; anything else must fail. */
+	if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
+			fsg->cmnd[0] != INQUIRY &&
+			fsg->cmnd[0] != REQUEST_SENSE) {
+		curlun->sense_data = curlun->unit_attention_data;
+		curlun->unit_attention_data = SS_NO_SENSE;
+		return -EINVAL;
+	}
+
+	/* Check that only command bytes listed in the mask are non-zero */
+	fsg->cmnd[1] &= 0x1f;			// Mask away the LUN
+	for (i = 1; i < cmnd_size; ++i) {
+		if (fsg->cmnd[i] && !(mask & (1 << i))) {
+			if (curlun)
+				curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+	}
+
+	/* If the medium isn't mounted and the command needs to access
+	 * it, return an error. */
+	if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
+		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* wrapper of check_command for data size in blocks handling */
+static int check_command_size_in_blocks(struct fsg_dev *fsg, int cmnd_size,
+		enum data_direction data_dir, unsigned int mask,
+		int needs_medium, const char *name)
+{
+	if (fsg->curlun)
+		fsg->data_size_from_cmnd <<= fsg->curlun->blkbits;
+	return check_command(fsg, cmnd_size, data_dir,
+			mask, needs_medium, name);
+}
+
+static int do_scsi_command(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh;
+	int			rc;
+	int			reply = -EINVAL;
+	int			i;
+	static char		unknown[16];
+
+	dump_cdb(fsg);
+
+	/* Wait for the next buffer to become available for data or status */
+	bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+	fsg->phase_error = 0;
+	fsg->short_packet_received = 0;
+
+	down_read(&fsg->filesem);	// We're using the backing file
+	switch (fsg->cmnd[0]) {
+
+	case INQUIRY:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+				(1<<4), 0,
+				"INQUIRY")) == 0)
+			reply = do_inquiry(fsg, bh);
+		break;
+
+	case MODE_SELECT:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
+				(1<<1) | (1<<4), 0,
+				"MODE SELECT(6)")) == 0)
+			reply = do_mode_select(fsg, bh);
+		break;
+
+	case MODE_SELECT_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
+				(1<<1) | (3<<7), 0,
+				"MODE SELECT(10)")) == 0)
+			reply = do_mode_select(fsg, bh);
+		break;
+
+	case MODE_SENSE:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+				(1<<1) | (1<<2) | (1<<4), 0,
+				"MODE SENSE(6)")) == 0)
+			reply = do_mode_sense(fsg, bh);
+		break;
+
+	case MODE_SENSE_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(1<<1) | (1<<2) | (3<<7), 0,
+				"MODE SENSE(10)")) == 0)
+			reply = do_mode_sense(fsg, bh);
+		break;
+
+	case ALLOW_MEDIUM_REMOVAL:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+				(1<<4), 0,
+				"PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
+			reply = do_prevent_allow(fsg);
+		break;
+
+	case READ_6:
+		i = fsg->cmnd[4];
+		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
+		if ((reply = check_command_size_in_blocks(fsg, 6,
+				DATA_DIR_TO_HOST,
+				(7<<1) | (1<<4), 1,
+				"READ(6)")) == 0)
+			reply = do_read(fsg);
+		break;
+
+	case READ_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command_size_in_blocks(fsg, 10,
+				DATA_DIR_TO_HOST,
+				(1<<1) | (0xf<<2) | (3<<7), 1,
+				"READ(10)")) == 0)
+			reply = do_read(fsg);
+		break;
+
+	case READ_12:
+		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
+		if ((reply = check_command_size_in_blocks(fsg, 12,
+				DATA_DIR_TO_HOST,
+				(1<<1) | (0xf<<2) | (0xf<<6), 1,
+				"READ(12)")) == 0)
+			reply = do_read(fsg);
+		break;
+
+	case READ_CAPACITY:
+		fsg->data_size_from_cmnd = 8;
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(0xf<<2) | (1<<8), 1,
+				"READ CAPACITY")) == 0)
+			reply = do_read_capacity(fsg, bh);
+		break;
+
+	case READ_HEADER:
+		if (!mod_data.cdrom)
+			goto unknown_cmnd;
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(3<<7) | (0x1f<<1), 1,
+				"READ HEADER")) == 0)
+			reply = do_read_header(fsg, bh);
+		break;
+
+	case READ_TOC:
+		if (!mod_data.cdrom)
+			goto unknown_cmnd;
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(7<<6) | (1<<1), 1,
+				"READ TOC")) == 0)
+			reply = do_read_toc(fsg, bh);
+		break;
+
+	case READ_FORMAT_CAPACITIES:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(3<<7), 1,
+				"READ FORMAT CAPACITIES")) == 0)
+			reply = do_read_format_capacities(fsg, bh);
+		break;
+
+	case REQUEST_SENSE:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+				(1<<4), 0,
+				"REQUEST SENSE")) == 0)
+			reply = do_request_sense(fsg, bh);
+		break;
+
+	case START_STOP:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+				(1<<1) | (1<<4), 0,
+				"START-STOP UNIT")) == 0)
+			reply = do_start_stop(fsg);
+		break;
+
+	case SYNCHRONIZE_CACHE:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+				(0xf<<2) | (3<<7), 1,
+				"SYNCHRONIZE CACHE")) == 0)
+			reply = do_synchronize_cache(fsg);
+		break;
+
+	case TEST_UNIT_READY:
+		fsg->data_size_from_cmnd = 0;
+		reply = check_command(fsg, 6, DATA_DIR_NONE,
+				0, 1,
+				"TEST UNIT READY");
+		break;
+
+	/* Although optional, this command is used by MS-Windows.  We
+	 * support a minimal version: BytChk must be 0. */
+	case VERIFY:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+				(1<<1) | (0xf<<2) | (3<<7), 1,
+				"VERIFY")) == 0)
+			reply = do_verify(fsg);
+		break;
+
+	case WRITE_6:
+		i = fsg->cmnd[4];
+		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
+		if ((reply = check_command_size_in_blocks(fsg, 6,
+				DATA_DIR_FROM_HOST,
+				(7<<1) | (1<<4), 1,
+				"WRITE(6)")) == 0)
+			reply = do_write(fsg);
+		break;
+
+	case WRITE_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command_size_in_blocks(fsg, 10,
+				DATA_DIR_FROM_HOST,
+				(1<<1) | (0xf<<2) | (3<<7), 1,
+				"WRITE(10)")) == 0)
+			reply = do_write(fsg);
+		break;
+
+	case WRITE_12:
+		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
+		if ((reply = check_command_size_in_blocks(fsg, 12,
+				DATA_DIR_FROM_HOST,
+				(1<<1) | (0xf<<2) | (0xf<<6), 1,
+				"WRITE(12)")) == 0)
+			reply = do_write(fsg);
+		break;
+
+	/* Some mandatory commands that we recognize but don't implement.
+	 * They don't mean much in this setting.  It's left as an exercise
+	 * for anyone interested to implement RESERVE and RELEASE in terms
+	 * of Posix locks. */
+	case FORMAT_UNIT:
+	case RELEASE:
+	case RESERVE:
+	case SEND_DIAGNOSTIC:
+		// Fall through
+
+	default:
+ unknown_cmnd:
+		fsg->data_size_from_cmnd = 0;
+		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
+		if ((reply = check_command(fsg, fsg->cmnd_size,
+				DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
+			fsg->curlun->sense_data = SS_INVALID_COMMAND;
+			reply = -EINVAL;
+		}
+		break;
+	}
+	up_read(&fsg->filesem);
+
+	if (reply == -EINTR || signal_pending(current))
+		return -EINTR;
+
+	/* Set up the single reply buffer for finish_reply() */
+	if (reply == -EINVAL)
+		reply = 0;		// Error reply length
+	if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
+		reply = min((u32) reply, fsg->data_size_from_cmnd);
+		bh->inreq->length = reply;
+		bh->state = BUF_STATE_FULL;
+		fsg->residue -= reply;
+	}				// Otherwise it's already set
+
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct usb_request		*req = bh->outreq;
+	struct bulk_cb_wrap	*cbw = req->buf;
+
+	/* Was this a real packet?  Should it be ignored? */
+	if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+		return -EINVAL;
+
+	/* Is the CBW valid? */
+	if (req->actual != US_BULK_CB_WRAP_LEN ||
+			cbw->Signature != cpu_to_le32(
+				US_BULK_CB_SIGN)) {
+		DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
+				req->actual,
+				le32_to_cpu(cbw->Signature));
+
+		/* The Bulk-only spec says we MUST stall the IN endpoint
+		 * (6.6.1), so it's unavoidable.  It also says we must
+		 * retain this state until the next reset, but there's
+		 * no way to tell the controller driver it should ignore
+		 * Clear-Feature(HALT) requests.
+		 *
+		 * We aren't required to halt the OUT endpoint; instead
+		 * we can simply accept and discard any data received
+		 * until the next reset. */
+		wedge_bulk_in_endpoint(fsg);
+		set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+		return -EINVAL;
+	}
+
+	/* Is the CBW meaningful? */
+	if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
+			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
+		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
+				"cmdlen %u\n",
+				cbw->Lun, cbw->Flags, cbw->Length);
+
+		/* We can do anything we want here, so let's stall the
+		 * bulk pipes if we are allowed to. */
+		if (mod_data.can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			halt_bulk_in_endpoint(fsg);
+		}
+		return -EINVAL;
+	}
+
+	/* Save the command for later */
+	fsg->cmnd_size = cbw->Length;
+	memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
+	if (cbw->Flags & US_BULK_FLAG_IN)
+		fsg->data_dir = DATA_DIR_TO_HOST;
+	else
+		fsg->data_dir = DATA_DIR_FROM_HOST;
+	fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
+	if (fsg->data_size == 0)
+		fsg->data_dir = DATA_DIR_NONE;
+	fsg->lun = cbw->Lun;
+	fsg->tag = cbw->Tag;
+	return 0;
+}
+
+
+static int get_next_command(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh;
+	int			rc = 0;
+
+	if (transport_is_bbb()) {
+
+		/* Wait for the next buffer to become available */
+		bh = fsg->next_buffhd_to_fill;
+		while (bh->state != BUF_STATE_EMPTY) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+
+		/* Queue a request to read a Bulk-only CBW */
+		set_bulk_out_req_length(fsg, bh, US_BULK_CB_WRAP_LEN);
+		start_transfer(fsg, fsg->bulk_out, bh->outreq,
+				&bh->outreq_busy, &bh->state);
+
+		/* We will drain the buffer in software, which means we
+		 * can reuse it for the next filling.  No need to advance
+		 * next_buffhd_to_fill. */
+
+		/* Wait for the CBW to arrive */
+		while (bh->state != BUF_STATE_FULL) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+		smp_rmb();
+		rc = received_cbw(fsg, bh);
+		bh->state = BUF_STATE_EMPTY;
+
+	} else {		// USB_PR_CB or USB_PR_CBI
+
+		/* Wait for the next command to arrive */
+		while (fsg->cbbuf_cmnd_size == 0) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+
+		/* Is the previous status interrupt request still busy?
+		 * The host is allowed to skip reading the status,
+		 * so we must cancel it. */
+		if (fsg->intreq_busy)
+			usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+
+		/* Copy the command and mark the buffer empty */
+		fsg->data_dir = DATA_DIR_UNKNOWN;
+		spin_lock_irq(&fsg->lock);
+		fsg->cmnd_size = fsg->cbbuf_cmnd_size;
+		memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
+		fsg->cbbuf_cmnd_size = 0;
+		spin_unlock_irq(&fsg->lock);
+
+		/* Use LUN from the command */
+		fsg->lun = fsg->cmnd[1] >> 5;
+	}
+
+	/* Update current lun */
+	if (fsg->lun >= 0 && fsg->lun < fsg->nluns)
+		fsg->curlun = &fsg->luns[fsg->lun];
+	else
+		fsg->curlun = NULL;
+
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
+		const struct usb_endpoint_descriptor *d)
+{
+	int	rc;
+
+	ep->driver_data = fsg;
+	ep->desc = d;
+	rc = usb_ep_enable(ep);
+	if (rc)
+		ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
+	return rc;
+}
+
+static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
+		struct usb_request **preq)
+{
+	*preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
+	if (*preq)
+		return 0;
+	ERROR(fsg, "can't allocate request for %s\n", ep->name);
+	return -ENOMEM;
+}
+
+/*
+ * Reset interface setting and re-init endpoint state (toggle etc).
+ * Call with altsetting < 0 to disable the interface.  The only other
+ * available altsetting is 0, which enables the interface.
+ */
+static int do_set_interface(struct fsg_dev *fsg, int altsetting)
+{
+	int	rc = 0;
+	int	i;
+	const struct usb_endpoint_descriptor	*d;
+
+	if (fsg->running)
+		DBG(fsg, "reset interface\n");
+
+reset:
+	/* Deallocate the requests */
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		struct fsg_buffhd *bh = &fsg->buffhds[i];
+
+		if (bh->inreq) {
+			usb_ep_free_request(fsg->bulk_in, bh->inreq);
+			bh->inreq = NULL;
+		}
+		if (bh->outreq) {
+			usb_ep_free_request(fsg->bulk_out, bh->outreq);
+			bh->outreq = NULL;
+		}
+	}
+	if (fsg->intreq) {
+		usb_ep_free_request(fsg->intr_in, fsg->intreq);
+		fsg->intreq = NULL;
+	}
+
+	/* Disable the endpoints */
+	if (fsg->bulk_in_enabled) {
+		usb_ep_disable(fsg->bulk_in);
+		fsg->bulk_in_enabled = 0;
+	}
+	if (fsg->bulk_out_enabled) {
+		usb_ep_disable(fsg->bulk_out);
+		fsg->bulk_out_enabled = 0;
+	}
+	if (fsg->intr_in_enabled) {
+		usb_ep_disable(fsg->intr_in);
+		fsg->intr_in_enabled = 0;
+	}
+
+	fsg->running = 0;
+	if (altsetting < 0 || rc != 0)
+		return rc;
+
+	DBG(fsg, "set interface %d\n", altsetting);
+
+	/* Enable the endpoints */
+	d = fsg_ep_desc(fsg->gadget,
+			&fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc,
+			&fsg_ss_bulk_in_desc);
+	if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
+		goto reset;
+	fsg->bulk_in_enabled = 1;
+
+	d = fsg_ep_desc(fsg->gadget,
+			&fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc,
+			&fsg_ss_bulk_out_desc);
+	if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
+		goto reset;
+	fsg->bulk_out_enabled = 1;
+	fsg->bulk_out_maxpacket = usb_endpoint_maxp(d);
+	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+
+	if (transport_is_cbi()) {
+		d = fsg_ep_desc(fsg->gadget,
+				&fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc,
+				&fsg_ss_intr_in_desc);
+		if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
+			goto reset;
+		fsg->intr_in_enabled = 1;
+	}
+
+	/* Allocate the requests */
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		struct fsg_buffhd	*bh = &fsg->buffhds[i];
+
+		if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
+			goto reset;
+		if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
+			goto reset;
+		bh->inreq->buf = bh->outreq->buf = bh->buf;
+		bh->inreq->context = bh->outreq->context = bh;
+		bh->inreq->complete = bulk_in_complete;
+		bh->outreq->complete = bulk_out_complete;
+	}
+	if (transport_is_cbi()) {
+		if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
+			goto reset;
+		fsg->intreq->complete = intr_in_complete;
+	}
+
+	fsg->running = 1;
+	for (i = 0; i < fsg->nluns; ++i)
+		fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+	return rc;
+}
+
+
+/*
+ * Change our operational configuration.  This code must agree with the code
+ * that returns config descriptors, and with interface altsetting code.
+ *
+ * It's also responsible for power management interactions.  Some
+ * configurations might not work with our current power sources.
+ * For now we just assume the gadget is always self-powered.
+ */
+static int do_set_config(struct fsg_dev *fsg, u8 new_config)
+{
+	int	rc = 0;
+
+	/* Disable the single interface */
+	if (fsg->config != 0) {
+		DBG(fsg, "reset config\n");
+		fsg->config = 0;
+		rc = do_set_interface(fsg, -1);
+	}
+
+	/* Enable the interface */
+	if (new_config != 0) {
+		fsg->config = new_config;
+		if ((rc = do_set_interface(fsg, 0)) != 0)
+			fsg->config = 0;	// Reset on errors
+		else
+			INFO(fsg, "%s config #%d\n",
+			     usb_speed_string(fsg->gadget->speed),
+			     fsg->config);
+	}
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void handle_exception(struct fsg_dev *fsg)
+{
+	siginfo_t		info;
+	int			sig;
+	int			i;
+	int			num_active;
+	struct fsg_buffhd	*bh;
+	enum fsg_state		old_state;
+	u8			new_config;
+	struct fsg_lun		*curlun;
+	unsigned int		exception_req_tag;
+	int			rc;
+
+	/* Clear the existing signals.  Anything but SIGUSR1 is converted
+	 * into a high-priority EXIT exception. */
+	for (;;) {
+		sig = dequeue_signal_lock(current, &current->blocked, &info);
+		if (!sig)
+			break;
+		if (sig != SIGUSR1) {
+			if (fsg->state < FSG_STATE_EXIT)
+				DBG(fsg, "Main thread exiting on signal\n");
+			raise_exception(fsg, FSG_STATE_EXIT);
+		}
+	}
+
+	/* Cancel all the pending transfers */
+	if (fsg->intreq_busy)
+		usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		bh = &fsg->buffhds[i];
+		if (bh->inreq_busy)
+			usb_ep_dequeue(fsg->bulk_in, bh->inreq);
+		if (bh->outreq_busy)
+			usb_ep_dequeue(fsg->bulk_out, bh->outreq);
+	}
+
+	/* Wait until everything is idle */
+	for (;;) {
+		num_active = fsg->intreq_busy;
+		for (i = 0; i < fsg_num_buffers; ++i) {
+			bh = &fsg->buffhds[i];
+			num_active += bh->inreq_busy + bh->outreq_busy;
+		}
+		if (num_active == 0)
+			break;
+		if (sleep_thread(fsg))
+			return;
+	}
+
+	/* Clear out the controller's fifos */
+	if (fsg->bulk_in_enabled)
+		usb_ep_fifo_flush(fsg->bulk_in);
+	if (fsg->bulk_out_enabled)
+		usb_ep_fifo_flush(fsg->bulk_out);
+	if (fsg->intr_in_enabled)
+		usb_ep_fifo_flush(fsg->intr_in);
+
+	/* Reset the I/O buffer states and pointers, the SCSI
+	 * state, and the exception.  Then invoke the handler. */
+	spin_lock_irq(&fsg->lock);
+
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		bh = &fsg->buffhds[i];
+		bh->state = BUF_STATE_EMPTY;
+	}
+	fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
+			&fsg->buffhds[0];
+
+	exception_req_tag = fsg->exception_req_tag;
+	new_config = fsg->new_config;
+	old_state = fsg->state;
+
+	if (old_state == FSG_STATE_ABORT_BULK_OUT)
+		fsg->state = FSG_STATE_STATUS_PHASE;
+	else {
+		for (i = 0; i < fsg->nluns; ++i) {
+			curlun = &fsg->luns[i];
+			curlun->prevent_medium_removal = 0;
+			curlun->sense_data = curlun->unit_attention_data =
+					SS_NO_SENSE;
+			curlun->sense_data_info = 0;
+			curlun->info_valid = 0;
+		}
+		fsg->state = FSG_STATE_IDLE;
+	}
+	spin_unlock_irq(&fsg->lock);
+
+	/* Carry out any extra actions required for the exception */
+	switch (old_state) {
+	default:
+		break;
+
+	case FSG_STATE_ABORT_BULK_OUT:
+		send_status(fsg);
+		spin_lock_irq(&fsg->lock);
+		if (fsg->state == FSG_STATE_STATUS_PHASE)
+			fsg->state = FSG_STATE_IDLE;
+		spin_unlock_irq(&fsg->lock);
+		break;
+
+	case FSG_STATE_RESET:
+		/* In case we were forced against our will to halt a
+		 * bulk endpoint, clear the halt now.  (The SuperH UDC
+		 * requires this.) */
+		if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+			usb_ep_clear_halt(fsg->bulk_in);
+
+		if (transport_is_bbb()) {
+			if (fsg->ep0_req_tag == exception_req_tag)
+				ep0_queue(fsg);	// Complete the status stage
+
+		} else if (transport_is_cbi())
+			send_status(fsg);	// Status by interrupt pipe
+
+		/* Technically this should go here, but it would only be
+		 * a waste of time.  Ditto for the INTERFACE_CHANGE and
+		 * CONFIG_CHANGE cases. */
+		// for (i = 0; i < fsg->nluns; ++i)
+		//	fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+		break;
+
+	case FSG_STATE_INTERFACE_CHANGE:
+		rc = do_set_interface(fsg, 0);
+		if (fsg->ep0_req_tag != exception_req_tag)
+			break;
+		if (rc != 0)			// STALL on errors
+			fsg_set_halt(fsg, fsg->ep0);
+		else				// Complete the status stage
+			ep0_queue(fsg);
+		break;
+
+	case FSG_STATE_CONFIG_CHANGE:
+		rc = do_set_config(fsg, new_config);
+		if (fsg->ep0_req_tag != exception_req_tag)
+			break;
+		if (rc != 0)			// STALL on errors
+			fsg_set_halt(fsg, fsg->ep0);
+		else				// Complete the status stage
+			ep0_queue(fsg);
+		break;
+
+	case FSG_STATE_DISCONNECT:
+		for (i = 0; i < fsg->nluns; ++i)
+			fsg_lun_fsync_sub(fsg->luns + i);
+		do_set_config(fsg, 0);		// Unconfigured state
+		break;
+
+	case FSG_STATE_EXIT:
+	case FSG_STATE_TERMINATED:
+		do_set_config(fsg, 0);			// Free resources
+		spin_lock_irq(&fsg->lock);
+		fsg->state = FSG_STATE_TERMINATED;	// Stop the thread
+		spin_unlock_irq(&fsg->lock);
+		break;
+	}
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_main_thread(void *fsg_)
+{
+	struct fsg_dev		*fsg = fsg_;
+
+	/* Allow the thread to be killed by a signal, but set the signal mask
+	 * to block everything but INT, TERM, KILL, and USR1. */
+	allow_signal(SIGINT);
+	allow_signal(SIGTERM);
+	allow_signal(SIGKILL);
+	allow_signal(SIGUSR1);
+
+	/* Allow the thread to be frozen */
+	set_freezable();
+
+	/* Arrange for userspace references to be interpreted as kernel
+	 * pointers.  That way we can pass a kernel pointer to a routine
+	 * that expects a __user pointer and it will work okay. */
+	set_fs(get_ds());
+
+	/* The main loop */
+	while (fsg->state != FSG_STATE_TERMINATED) {
+		if (exception_in_progress(fsg) || signal_pending(current)) {
+			handle_exception(fsg);
+			continue;
+		}
+
+		if (!fsg->running) {
+			sleep_thread(fsg);
+			continue;
+		}
+
+		if (get_next_command(fsg))
+			continue;
+
+		spin_lock_irq(&fsg->lock);
+		if (!exception_in_progress(fsg))
+			fsg->state = FSG_STATE_DATA_PHASE;
+		spin_unlock_irq(&fsg->lock);
+
+		if (do_scsi_command(fsg) || finish_reply(fsg))
+			continue;
+
+		spin_lock_irq(&fsg->lock);
+		if (!exception_in_progress(fsg))
+			fsg->state = FSG_STATE_STATUS_PHASE;
+		spin_unlock_irq(&fsg->lock);
+
+		if (send_status(fsg))
+			continue;
+
+		spin_lock_irq(&fsg->lock);
+		if (!exception_in_progress(fsg))
+			fsg->state = FSG_STATE_IDLE;
+		spin_unlock_irq(&fsg->lock);
+		}
+
+	spin_lock_irq(&fsg->lock);
+	fsg->thread_task = NULL;
+	spin_unlock_irq(&fsg->lock);
+
+	/* If we are exiting because of a signal, unregister the
+	 * gadget driver. */
+	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+		usb_gadget_unregister_driver(&fsg_driver);
+
+	/* Let the unbind and cleanup routines know the thread has exited */
+	complete_and_exit(&fsg->thread_notifier, 0);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* The write permissions and store_xxx pointers are set in fsg_bind() */
+static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
+static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
+static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_release(struct kref *ref)
+{
+	struct fsg_dev	*fsg = container_of(ref, struct fsg_dev, ref);
+
+	kfree(fsg->luns);
+	kfree(fsg);
+}
+
+static void lun_release(struct device *dev)
+{
+	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
+	struct fsg_dev		*fsg =
+		container_of(filesem, struct fsg_dev, filesem);
+
+	kref_put(&fsg->ref, fsg_release);
+}
+
+static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+	int			i;
+	struct fsg_lun		*curlun;
+	struct usb_request	*req = fsg->ep0req;
+
+	DBG(fsg, "unbind\n");
+	clear_bit(REGISTERED, &fsg->atomic_bitflags);
+
+	/* If the thread isn't already dead, tell it to exit now */
+	if (fsg->state != FSG_STATE_TERMINATED) {
+		raise_exception(fsg, FSG_STATE_EXIT);
+		wait_for_completion(&fsg->thread_notifier);
+
+		/* The cleanup routine waits for this completion also */
+		complete(&fsg->thread_notifier);
+	}
+
+	/* Unregister the sysfs attribute files and the LUNs */
+	for (i = 0; i < fsg->nluns; ++i) {
+		curlun = &fsg->luns[i];
+		if (curlun->registered) {
+			device_remove_file(&curlun->dev, &dev_attr_nofua);
+			device_remove_file(&curlun->dev, &dev_attr_ro);
+			device_remove_file(&curlun->dev, &dev_attr_file);
+			fsg_lun_close(curlun);
+			device_unregister(&curlun->dev);
+			curlun->registered = 0;
+		}
+	}
+
+	/* Free the data buffers */
+	for (i = 0; i < fsg_num_buffers; ++i)
+		kfree(fsg->buffhds[i].buf);
+
+	/* Free the request and buffer for endpoint 0 */
+	if (req) {
+		kfree(req->buf);
+		usb_ep_free_request(fsg->ep0, req);
+	}
+
+	set_gadget_data(gadget, NULL);
+}
+
+
+static int __init check_parameters(struct fsg_dev *fsg)
+{
+	int	prot;
+	int	gcnum;
+
+	/* Store the default values */
+	mod_data.transport_type = USB_PR_BULK;
+	mod_data.transport_name = "Bulk-only";
+	mod_data.protocol_type = USB_SC_SCSI;
+	mod_data.protocol_name = "Transparent SCSI";
+
+	/* Some peripheral controllers are known not to be able to
+	 * halt bulk endpoints correctly.  If one of them is present,
+	 * disable stalls.
+	 */
+	if (gadget_is_at91(fsg->gadget))
+		mod_data.can_stall = 0;
+
+	if (mod_data.release == 0xffff) {	// Parameter wasn't set
+		gcnum = usb_gadget_controller_number(fsg->gadget);
+		if (gcnum >= 0)
+			mod_data.release = 0x0300 + gcnum;
+		else {
+			WARNING(fsg, "controller '%s' not recognized\n",
+				fsg->gadget->name);
+			mod_data.release = 0x0399;
+		}
+	}
+
+	prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+	if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
+		;		// Use default setting
+	} else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
+		mod_data.transport_type = USB_PR_CB;
+		mod_data.transport_name = "Control-Bulk";
+	} else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
+		mod_data.transport_type = USB_PR_CBI;
+		mod_data.transport_name = "Control-Bulk-Interrupt";
+	} else {
+		ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
+		return -EINVAL;
+	}
+
+	if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
+			prot == USB_SC_SCSI) {
+		;		// Use default setting
+	} else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
+			prot == USB_SC_RBC) {
+		mod_data.protocol_type = USB_SC_RBC;
+		mod_data.protocol_name = "RBC";
+	} else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
+			strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
+			prot == USB_SC_8020) {
+		mod_data.protocol_type = USB_SC_8020;
+		mod_data.protocol_name = "8020i (ATAPI)";
+	} else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
+			prot == USB_SC_QIC) {
+		mod_data.protocol_type = USB_SC_QIC;
+		mod_data.protocol_name = "QIC-157";
+	} else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
+			prot == USB_SC_UFI) {
+		mod_data.protocol_type = USB_SC_UFI;
+		mod_data.protocol_name = "UFI";
+	} else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
+			prot == USB_SC_8070) {
+		mod_data.protocol_type = USB_SC_8070;
+		mod_data.protocol_name = "8070i";
+	} else {
+		ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
+		return -EINVAL;
+	}
+
+	mod_data.buflen &= PAGE_CACHE_MASK;
+	if (mod_data.buflen <= 0) {
+		ERROR(fsg, "invalid buflen\n");
+		return -ETOOSMALL;
+	}
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+	/* Serial string handling.
+	 * On a real device, the serial string would be loaded
+	 * from permanent storage. */
+	if (mod_data.serial) {
+		const char *ch;
+		unsigned len = 0;
+
+		/* Sanity check :
+		 * The CB[I] specification limits the serial string to
+		 * 12 uppercase hexadecimal characters.
+		 * BBB need at least 12 uppercase hexadecimal characters,
+		 * with a maximum of 126. */
+		for (ch = mod_data.serial; *ch; ++ch) {
+			++len;
+			if ((*ch < '0' || *ch > '9') &&
+			    (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
+				WARNING(fsg,
+					"Invalid serial string character: %c\n",
+					*ch);
+				goto no_serial;
+			}
+		}
+		if (len > 126 ||
+		    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
+		    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
+			WARNING(fsg, "Invalid serial string length!\n");
+			goto no_serial;
+		}
+		fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
+	} else {
+		WARNING(fsg, "No serial-number string provided!\n");
+ no_serial:
+		device_desc.iSerialNumber = 0;
+	}
+
+	return 0;
+}
+
+
+static int __init fsg_bind(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = the_fsg;
+	int			rc;
+	int			i;
+	struct fsg_lun		*curlun;
+	struct usb_ep		*ep;
+	struct usb_request	*req;
+	char			*pathbuf, *p;
+
+	fsg->gadget = gadget;
+	set_gadget_data(gadget, fsg);
+	fsg->ep0 = gadget->ep0;
+	fsg->ep0->driver_data = fsg;
+
+	if ((rc = check_parameters(fsg)) != 0)
+		goto out;
+
+	if (mod_data.removable) {	// Enable the store_xxx attributes
+		dev_attr_file.attr.mode = 0644;
+		dev_attr_file.store = fsg_store_file;
+		if (!mod_data.cdrom) {
+			dev_attr_ro.attr.mode = 0644;
+			dev_attr_ro.store = fsg_store_ro;
+		}
+	}
+
+	/* Only for removable media? */
+	dev_attr_nofua.attr.mode = 0644;
+	dev_attr_nofua.store = fsg_store_nofua;
+
+	/* Find out how many LUNs there should be */
+	i = mod_data.nluns;
+	if (i == 0)
+		i = max(mod_data.num_filenames, 1u);
+	if (i > FSG_MAX_LUNS) {
+		ERROR(fsg, "invalid number of LUNs: %d\n", i);
+		rc = -EINVAL;
+		goto out;
+	}
+
+	/* Create the LUNs, open their backing files, and register the
+	 * LUN devices in sysfs. */
+	fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
+	if (!fsg->luns) {
+		rc = -ENOMEM;
+		goto out;
+	}
+	fsg->nluns = i;
+
+	for (i = 0; i < fsg->nluns; ++i) {
+		curlun = &fsg->luns[i];
+		curlun->cdrom = !!mod_data.cdrom;
+		curlun->ro = mod_data.cdrom || mod_data.ro[i];
+		curlun->initially_ro = curlun->ro;
+		curlun->removable = mod_data.removable;
+		curlun->nofua = mod_data.nofua[i];
+		curlun->dev.release = lun_release;
+		curlun->dev.parent = &gadget->dev;
+		curlun->dev.driver = &fsg_driver.driver;
+		dev_set_drvdata(&curlun->dev, &fsg->filesem);
+		dev_set_name(&curlun->dev,"%s-lun%d",
+			     dev_name(&gadget->dev), i);
+
+		kref_get(&fsg->ref);
+		rc = device_register(&curlun->dev);
+		if (rc) {
+			INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
+			put_device(&curlun->dev);
+			goto out;
+		}
+		curlun->registered = 1;
+
+		rc = device_create_file(&curlun->dev, &dev_attr_ro);
+		if (rc)
+			goto out;
+		rc = device_create_file(&curlun->dev, &dev_attr_nofua);
+		if (rc)
+			goto out;
+		rc = device_create_file(&curlun->dev, &dev_attr_file);
+		if (rc)
+			goto out;
+
+		if (mod_data.file[i] && *mod_data.file[i]) {
+			rc = fsg_lun_open(curlun, mod_data.file[i]);
+			if (rc)
+				goto out;
+		} else if (!mod_data.removable) {
+			ERROR(fsg, "no file given for LUN%d\n", i);
+			rc = -EINVAL;
+			goto out;
+		}
+	}
+
+	/* Find all the endpoints we will use */
+	usb_ep_autoconfig_reset(gadget);
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
+	if (!ep)
+		goto autoconf_fail;
+	ep->driver_data = fsg;		// claim the endpoint
+	fsg->bulk_in = ep;
+
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
+	if (!ep)
+		goto autoconf_fail;
+	ep->driver_data = fsg;		// claim the endpoint
+	fsg->bulk_out = ep;
+
+	if (transport_is_cbi()) {
+		ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
+		if (!ep)
+			goto autoconf_fail;
+		ep->driver_data = fsg;		// claim the endpoint
+		fsg->intr_in = ep;
+	}
+
+	/* Fix up the descriptors */
+	device_desc.idVendor = cpu_to_le16(mod_data.vendor);
+	device_desc.idProduct = cpu_to_le16(mod_data.product);
+	device_desc.bcdDevice = cpu_to_le16(mod_data.release);
+
+	i = (transport_is_cbi() ? 3 : 2);	// Number of endpoints
+	fsg_intf_desc.bNumEndpoints = i;
+	fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
+	fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
+	fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+	if (gadget_is_dualspeed(gadget)) {
+		fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+		/* Assume endpoint addresses are the same for both speeds */
+		fsg_hs_bulk_in_desc.bEndpointAddress =
+			fsg_fs_bulk_in_desc.bEndpointAddress;
+		fsg_hs_bulk_out_desc.bEndpointAddress =
+			fsg_fs_bulk_out_desc.bEndpointAddress;
+		fsg_hs_intr_in_desc.bEndpointAddress =
+			fsg_fs_intr_in_desc.bEndpointAddress;
+	}
+
+	if (gadget_is_superspeed(gadget)) {
+		unsigned		max_burst;
+
+		fsg_ss_function[i + FSG_SS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+		/* Calculate bMaxBurst, we know packet size is 1024 */
+		max_burst = min_t(unsigned, mod_data.buflen / 1024, 15);
+
+		/* Assume endpoint addresses are the same for both speeds */
+		fsg_ss_bulk_in_desc.bEndpointAddress =
+			fsg_fs_bulk_in_desc.bEndpointAddress;
+		fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
+
+		fsg_ss_bulk_out_desc.bEndpointAddress =
+			fsg_fs_bulk_out_desc.bEndpointAddress;
+		fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
+	}
+
+	if (gadget_is_otg(gadget))
+		fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
+
+	rc = -ENOMEM;
+
+	/* Allocate the request and buffer for endpoint 0 */
+	fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
+	if (!req)
+		goto out;
+	req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
+	if (!req->buf)
+		goto out;
+	req->complete = ep0_complete;
+
+	/* Allocate the data buffers */
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		struct fsg_buffhd	*bh = &fsg->buffhds[i];
+
+		/* Allocate for the bulk-in endpoint.  We assume that
+		 * the buffer will also work with the bulk-out (and
+		 * interrupt-in) endpoint. */
+		bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
+		if (!bh->buf)
+			goto out;
+		bh->next = bh + 1;
+	}
+	fsg->buffhds[fsg_num_buffers - 1].next = &fsg->buffhds[0];
+
+	/* This should reflect the actual gadget power source */
+	usb_gadget_set_selfpowered(gadget);
+
+	snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
+			"%s %s with %s",
+			init_utsname()->sysname, init_utsname()->release,
+			gadget->name);
+
+	fsg->thread_task = kthread_create(fsg_main_thread, fsg,
+			"file-storage-gadget");
+	if (IS_ERR(fsg->thread_task)) {
+		rc = PTR_ERR(fsg->thread_task);
+		goto out;
+	}
+
+	INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+	INFO(fsg, "NOTE: This driver is deprecated.  "
+			"Consider using g_mass_storage instead.\n");
+	INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
+
+	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+	for (i = 0; i < fsg->nluns; ++i) {
+		curlun = &fsg->luns[i];
+		if (fsg_lun_is_open(curlun)) {
+			p = NULL;
+			if (pathbuf) {
+				p = d_path(&curlun->filp->f_path,
+					   pathbuf, PATH_MAX);
+				if (IS_ERR(p))
+					p = NULL;
+			}
+			LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
+			      curlun->ro, curlun->nofua, (p ? p : "(error)"));
+		}
+	}
+	kfree(pathbuf);
+
+	DBG(fsg, "transport=%s (x%02x)\n",
+			mod_data.transport_name, mod_data.transport_type);
+	DBG(fsg, "protocol=%s (x%02x)\n",
+			mod_data.protocol_name, mod_data.protocol_type);
+	DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
+			mod_data.vendor, mod_data.product, mod_data.release);
+	DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
+			mod_data.removable, mod_data.can_stall,
+			mod_data.cdrom, mod_data.buflen);
+	DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
+
+	set_bit(REGISTERED, &fsg->atomic_bitflags);
+
+	/* Tell the thread to start working */
+	wake_up_process(fsg->thread_task);
+	return 0;
+
+autoconf_fail:
+	ERROR(fsg, "unable to autoconfigure all endpoints\n");
+	rc = -ENOTSUPP;
+
+out:
+	fsg->state = FSG_STATE_TERMINATED;	// The thread is dead
+	fsg_unbind(gadget);
+	complete(&fsg->thread_notifier);
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_suspend(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+
+	DBG(fsg, "suspend\n");
+	set_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+static void fsg_resume(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+
+	DBG(fsg, "resume\n");
+	clear_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver		fsg_driver = {
+	.max_speed	= USB_SPEED_SUPER,
+	.function	= (char *) fsg_string_product,
+	.unbind		= fsg_unbind,
+	.disconnect	= fsg_disconnect,
+	.setup		= fsg_setup,
+	.suspend	= fsg_suspend,
+	.resume		= fsg_resume,
+
+	.driver		= {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+		// .release = ...
+		// .suspend = ...
+		// .resume = ...
+	},
+};
+
+
+static int __init fsg_alloc(void)
+{
+	struct fsg_dev		*fsg;
+
+	fsg = kzalloc(sizeof *fsg +
+		      fsg_num_buffers * sizeof *(fsg->buffhds), GFP_KERNEL);
+
+	if (!fsg)
+		return -ENOMEM;
+	spin_lock_init(&fsg->lock);
+	init_rwsem(&fsg->filesem);
+	kref_init(&fsg->ref);
+	init_completion(&fsg->thread_notifier);
+
+	the_fsg = fsg;
+	return 0;
+}
+
+
+static int __init fsg_init(void)
+{
+	int		rc;
+	struct fsg_dev	*fsg;
+
+	rc = fsg_num_buffers_validate();
+	if (rc != 0)
+		return rc;
+
+	if ((rc = fsg_alloc()) != 0)
+		return rc;
+	fsg = the_fsg;
+	if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
+		kref_put(&fsg->ref, fsg_release);
+	return rc;
+}
+module_init(fsg_init);
+
+
+static void __exit fsg_cleanup(void)
+{
+	struct fsg_dev	*fsg = the_fsg;
+
+	/* Unregister the driver iff the thread hasn't already done so */
+	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+		usb_gadget_unregister_driver(&fsg_driver);
+
+	/* Wait for the thread to finish up */
+	wait_for_completion(&fsg->thread_notifier);
+
+	kref_put(&fsg->ref, fsg_release);
+}
+module_exit(fsg_cleanup);
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 1a4ea98cac2a2..3f2b72af53e54 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -748,6 +748,16 @@ config USB_HWA_HCD
 	  To compile this driver a module, choose M here: the module
 	  will be called "hwa-hc".
 
+config USB_DWCOTG
+	bool "Synopsis DWC host support"
+	depends on USB && (FIQ || ARM64)
+	help
+	  The Synopsis DWC controller is a dual-role
+	  host/peripheral/OTG ("On The Go") USB controllers.
+
+	  Enable this option to support this IP in host controller mode.
+	  If unsure, say N.
+
 config USB_IMX21_HCD
        tristate "i.MX21 HCD support"
        depends on ARM && ARCH_MXC
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index e6235269c1519..61734870434ae 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -83,6 +83,8 @@ obj-$(CONFIG_USB_SL811_CS)	+= sl811_cs.o
 obj-$(CONFIG_USB_U132_HCD)	+= u132-hcd.o
 obj-$(CONFIG_USB_R8A66597_HCD)	+= r8a66597-hcd.o
 obj-$(CONFIG_USB_HWA_HCD)	+= hwa-hc.o
+
+obj-$(CONFIG_USB_DWCOTG)        += dwc_otg/ dwc_common_port/
 obj-$(CONFIG_USB_IMX21_HCD)	+= imx21-hcd.o
 obj-$(CONFIG_USB_FSL_USB2)	+= fsl-mph-dr-of.o
 obj-$(CONFIG_USB_EHCI_FSL)	+= fsl-mph-dr-of.o
diff --git a/drivers/usb/host/dwc_common_port/Makefile b/drivers/usb/host/dwc_common_port/Makefile
new file mode 100644
index 0000000000000..f10d466d1aea8
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/Makefile
@@ -0,0 +1,58 @@
+#
+# Makefile for DWC_common library
+#
+
+ifneq ($(KERNELRELEASE),)
+
+ccflags-y	+= -DDWC_LINUX
+#ccflags-y	+= -DDEBUG
+#ccflags-y	+= -DDWC_DEBUG_REGS
+#ccflags-y	+= -DDWC_DEBUG_MEMORY
+
+ccflags-y	+= -DDWC_LIBMODULE
+ccflags-y	+= -DDWC_CCLIB
+#ccflags-y	+= -DDWC_CRYPTOLIB
+ccflags-y	+= -DDWC_NOTIFYLIB
+ccflags-y	+= -DDWC_UTFLIB
+
+obj-$(CONFIG_USB_DWCOTG)	+= dwc_common_port_lib.o
+dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
+			    dwc_crypto.o dwc_notifier.o \
+			    dwc_common_linux.o dwc_mem.o
+
+kernrelwd := $(subst ., ,$(KERNELRELEASE))
+kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
+
+ifneq ($(kernrel3),2.6.20)
+# grayg - I only know that we use ccflags-y in 2.6.31 actually
+ccflags-y += $(CPPFLAGS)
+endif
+
+else
+
+#ifeq ($(KDIR),)
+#$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
+#endif
+
+ifeq ($(ARCH),)
+$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
+ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
+endif
+
+ifeq ($(DOXYGEN),)
+DOXYGEN		:= doxygen
+endif
+
+default:
+	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
+docs:	$(wildcard *.[hc]) doc/doxygen.cfg
+	$(DOXYGEN) doc/doxygen.cfg
+
+tags:	$(wildcard *.[hc])
+	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
+
+endif
+
+clean:
+	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
diff --git a/drivers/usb/host/dwc_common_port/Makefile.fbsd b/drivers/usb/host/dwc_common_port/Makefile.fbsd
new file mode 100644
index 0000000000000..45db9915b9d31
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/Makefile.fbsd
@@ -0,0 +1,17 @@
+CFLAGS	+= -I/sys/i386/compile/GENERIC -I/sys/i386/include -I/usr/include
+CFLAGS	+= -DDWC_FREEBSD
+CFLAGS	+= -DDEBUG
+#CFLAGS	+= -DDWC_DEBUG_REGS
+#CFLAGS	+= -DDWC_DEBUG_MEMORY
+
+#CFLAGS	+= -DDWC_LIBMODULE
+#CFLAGS	+= -DDWC_CCLIB
+#CFLAGS	+= -DDWC_CRYPTOLIB
+#CFLAGS	+= -DDWC_NOTIFYLIB
+#CFLAGS	+= -DDWC_UTFLIB
+
+KMOD = dwc_common_port_lib
+SRCS = dwc_cc.c dwc_modpow.c dwc_dh.c dwc_crypto.c dwc_notifier.c \
+       dwc_common_fbsd.c dwc_mem.c
+
+.include <bsd.kmod.mk>
diff --git a/drivers/usb/host/dwc_common_port/Makefile.linux b/drivers/usb/host/dwc_common_port/Makefile.linux
new file mode 100644
index 0000000000000..0cef7b461bd50
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/Makefile.linux
@@ -0,0 +1,49 @@
+#
+# Makefile for DWC_common library
+#
+ifneq ($(KERNELRELEASE),)
+
+ccflags-y	+= -DDWC_LINUX
+#ccflags-y	+= -DDEBUG
+#ccflags-y	+= -DDWC_DEBUG_REGS
+#ccflags-y	+= -DDWC_DEBUG_MEMORY
+
+ccflags-y	+= -DDWC_LIBMODULE
+ccflags-y	+= -DDWC_CCLIB
+ccflags-y	+= -DDWC_CRYPTOLIB
+ccflags-y	+= -DDWC_NOTIFYLIB
+ccflags-y	+= -DDWC_UTFLIB
+
+obj-m			 := dwc_common_port_lib.o
+dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
+			    dwc_crypto.o dwc_notifier.o \
+			    dwc_common_linux.o dwc_mem.o
+
+else
+
+ifeq ($(KDIR),)
+$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
+endif
+
+ifeq ($(ARCH),)
+$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
+ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
+endif
+
+ifeq ($(DOXYGEN),)
+DOXYGEN		:= doxygen
+endif
+
+default:
+	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
+docs:	$(wildcard *.[hc]) doc/doxygen.cfg
+	$(DOXYGEN) doc/doxygen.cfg
+
+tags:	$(wildcard *.[hc])
+	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
+
+endif
+
+clean:
+	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
diff --git a/drivers/usb/host/dwc_common_port/changes.txt b/drivers/usb/host/dwc_common_port/changes.txt
new file mode 100644
index 0000000000000..f6839f92c2760
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/changes.txt
@@ -0,0 +1,174 @@
+
+dwc_read_reg32() and friends now take an additional parameter, a pointer to an
+IO context struct. The IO context struct should live in an os-dependent struct
+in your driver. As an example, the dwc_usb3 driver has an os-dependent struct
+named 'os_dep' embedded in the main device struct. So there these calls look
+like this:
+
+	dwc_read_reg32(&usb3_dev->os_dep.ioctx, &pcd->dev_global_regs->dcfg);
+
+	dwc_write_reg32(&usb3_dev->os_dep.ioctx,
+			&pcd->dev_global_regs->dcfg, 0);
+
+Note that for the existing Linux driver ports, it is not necessary to actually
+define the 'ioctx' member in the os-dependent struct. Since Linux does not
+require an IO context, its macros for dwc_read_reg32() and friends do not
+use the context pointer, so it is optimized away by the compiler. But it is
+necessary to add the pointer parameter to all of the call sites, to be ready
+for any future ports (such as FreeBSD) which do require an IO context.
+
+
+Similarly, dwc_alloc(), dwc_alloc_atomic(), dwc_strdup(), and dwc_free() now
+take an additional parameter, a pointer to a memory context. Examples:
+
+	addr = dwc_alloc(&usb3_dev->os_dep.memctx, size);
+
+	dwc_free(&usb3_dev->os_dep.memctx, addr);
+
+Again, for the Linux ports, it is not necessary to actually define the memctx
+member, but it is necessary to add the pointer parameter to all of the call
+sites.
+
+
+Same for dwc_dma_alloc() and dwc_dma_free(). Examples:
+
+	virt_addr = dwc_dma_alloc(&usb3_dev->os_dep.dmactx, size, &phys_addr);
+
+	dwc_dma_free(&usb3_dev->os_dep.dmactx, size, virt_addr, phys_addr);
+
+
+Same for dwc_mutex_alloc() and dwc_mutex_free(). Examples:
+
+	mutex = dwc_mutex_alloc(&usb3_dev->os_dep.mtxctx);
+
+	dwc_mutex_free(&usb3_dev->os_dep.mtxctx, mutex);
+
+
+Same for dwc_spinlock_alloc() and dwc_spinlock_free(). Examples:
+
+	lock = dwc_spinlock_alloc(&usb3_dev->osdep.splctx);
+
+	dwc_spinlock_free(&usb3_dev->osdep.splctx, lock);
+
+
+Same for dwc_timer_alloc(). Example:
+
+	timer = dwc_timer_alloc(&usb3_dev->os_dep.tmrctx, "dwc_usb3_tmr1",
+				cb_func, cb_data);
+
+
+Same for dwc_waitq_alloc(). Example:
+
+	waitq = dwc_waitq_alloc(&usb3_dev->os_dep.wtqctx);
+
+
+Same for dwc_thread_run(). Example:
+
+	thread = dwc_thread_run(&usb3_dev->os_dep.thdctx, func,
+				"dwc_usb3_thd1", data);
+
+
+Same for dwc_workq_alloc(). Example:
+
+	workq = dwc_workq_alloc(&usb3_dev->osdep.wkqctx, "dwc_usb3_wkq1");
+
+
+Same for dwc_task_alloc(). Example:
+
+	task = dwc_task_alloc(&usb3_dev->os_dep.tskctx, "dwc_usb3_tsk1",
+			      cb_func, cb_data);
+
+
+In addition to the context pointer additions, a few core functions have had
+other changes made to their parameters:
+
+The 'flags' parameter to dwc_spinlock_irqsave() and dwc_spinunlock_irqrestore()
+has been changed from a uint64_t to a dwc_irqflags_t.
+
+dwc_thread_should_stop() now takes a 'dwc_thread_t *' parameter, because the
+FreeBSD equivalent of that function requires it.
+
+And, in addition to the context pointer, dwc_task_alloc() also adds a
+'char *name' parameter, to be consistent with dwc_thread_run() and
+dwc_workq_alloc(), and because the FreeBSD equivalent of that function
+requires a unique name.
+
+
+Here is a complete list of the core functions that now take a pointer to a
+context as their first parameter:
+
+	dwc_read_reg32
+	dwc_read_reg64
+	dwc_write_reg32
+	dwc_write_reg64
+	dwc_modify_reg32
+	dwc_modify_reg64
+	dwc_alloc
+	dwc_alloc_atomic
+	dwc_strdup
+	dwc_free
+	dwc_dma_alloc
+	dwc_dma_free
+	dwc_mutex_alloc
+	dwc_mutex_free
+	dwc_spinlock_alloc
+	dwc_spinlock_free
+	dwc_timer_alloc
+	dwc_waitq_alloc
+	dwc_thread_run
+	dwc_workq_alloc
+	dwc_task_alloc     Also adds a 'char *name' as its 2nd parameter
+
+And here are the core functions that have other changes to their parameters:
+
+	dwc_spinlock_irqsave      'flags' param is now a 'dwc_irqflags_t *'
+	dwc_spinunlock_irqrestore 'flags' param is now a 'dwc_irqflags_t'
+	dwc_thread_should_stop    Adds a 'dwc_thread_t *' parameter
+
+
+
+The changes to the core functions also require some of the other library
+functions to change:
+
+	dwc_cc_if_alloc() and dwc_cc_if_free() now take a 'void *memctx'
+	(for memory allocation) as the 1st param and a 'void *mtxctx'
+	(for mutex allocation) as the 2nd param.
+
+	dwc_cc_clear(), dwc_cc_add(), dwc_cc_change(), dwc_cc_remove(),
+	dwc_cc_data_for_save(), and dwc_cc_restore_from_data() now take a
+	'void *memctx' as the 1st param.
+
+	dwc_dh_modpow(), dwc_dh_pk(), and dwc_dh_derive_keys() now take a
+	'void *memctx' as the 1st param.
+
+	dwc_modpow() now takes a 'void *memctx' as the 1st param.
+
+	dwc_alloc_notification_manager() now takes a 'void *memctx' as the
+	1st param and a 'void *wkqctx' (for work queue allocation) as the 2nd
+	param, and also now returns an integer value that is non-zero if
+	allocation of its data structures or work queue fails.
+
+	dwc_register_notifier() now takes a 'void *memctx' as the 1st param.
+
+	dwc_memory_debug_start() now takes a 'void *mem_ctx' as the first
+	param, and also now returns an integer value that is non-zero if
+	allocation of its data structures fails.
+
+
+
+Other miscellaneous changes:
+
+The DEBUG_MEMORY and DEBUG_REGS #define's have been renamed to
+DWC_DEBUG_MEMORY and DWC_DEBUG_REGS.
+
+The following #define's have been added to allow selectively compiling library
+features:
+
+	DWC_CCLIB
+	DWC_CRYPTOLIB
+	DWC_NOTIFYLIB
+	DWC_UTFLIB
+
+A DWC_LIBMODULE #define has also been added. If this is not defined, then the
+module code in dwc_common_linux.c is not compiled in. This allows linking the
+library code directly into a driver module, instead of as a standalone module.
diff --git a/drivers/usb/host/dwc_common_port/doc/doxygen.cfg b/drivers/usb/host/dwc_common_port/doc/doxygen.cfg
new file mode 100644
index 0000000000000..89aa887af29df
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/doc/doxygen.cfg
@@ -0,0 +1,270 @@
+# Doxyfile 1.4.5
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+PROJECT_NAME           = "Synopsys DWC Portability and Common Library for UWB"
+PROJECT_NUMBER         =
+OUTPUT_DIRECTORY       = doc
+CREATE_SUBDIRS         = NO
+OUTPUT_LANGUAGE        = English
+BRIEF_MEMBER_DESC      = YES
+REPEAT_BRIEF           = YES
+ABBREVIATE_BRIEF       = "The $name class" \
+                         "The $name widget" \
+                         "The $name file" \
+                         is \
+                         provides \
+                         specifies \
+                         contains \
+                         represents \
+                         a \
+                         an \
+                         the
+ALWAYS_DETAILED_SEC    = YES
+INLINE_INHERITED_MEMB  = NO
+FULL_PATH_NAMES        = NO
+STRIP_FROM_PATH        = ..
+STRIP_FROM_INC_PATH    =
+SHORT_NAMES            = NO
+JAVADOC_AUTOBRIEF      = YES
+MULTILINE_CPP_IS_BRIEF = NO
+DETAILS_AT_TOP         = YES
+INHERIT_DOCS           = YES
+SEPARATE_MEMBER_PAGES  = NO
+TAB_SIZE               = 8
+ALIASES                =
+OPTIMIZE_OUTPUT_FOR_C  = YES
+OPTIMIZE_OUTPUT_JAVA   = NO
+BUILTIN_STL_SUPPORT    = NO
+DISTRIBUTE_GROUP_DOC   = NO
+SUBGROUPING            = NO
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+EXTRACT_ALL            = NO
+EXTRACT_PRIVATE        = NO
+EXTRACT_STATIC         = YES
+EXTRACT_LOCAL_CLASSES  = NO
+EXTRACT_LOCAL_METHODS  = NO
+HIDE_UNDOC_MEMBERS     = NO
+HIDE_UNDOC_CLASSES     = NO
+HIDE_FRIEND_COMPOUNDS  = NO
+HIDE_IN_BODY_DOCS      = NO
+INTERNAL_DOCS          = NO
+CASE_SENSE_NAMES       = YES
+HIDE_SCOPE_NAMES       = NO
+SHOW_INCLUDE_FILES     = NO
+INLINE_INFO            = YES
+SORT_MEMBER_DOCS       = NO
+SORT_BRIEF_DOCS        = NO
+SORT_BY_SCOPE_NAME     = NO
+GENERATE_TODOLIST      = YES
+GENERATE_TESTLIST      = YES
+GENERATE_BUGLIST       = YES
+GENERATE_DEPRECATEDLIST= YES
+ENABLED_SECTIONS       =
+MAX_INITIALIZER_LINES  = 30
+SHOW_USED_FILES        = YES
+SHOW_DIRECTORIES       = YES
+FILE_VERSION_FILTER    =
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+QUIET                  = YES
+WARNINGS               = YES
+WARN_IF_UNDOCUMENTED   = NO
+WARN_IF_DOC_ERROR      = YES
+WARN_NO_PARAMDOC       = YES
+WARN_FORMAT            = "$file:$line: $text"
+WARN_LOGFILE           =
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+INPUT                  = .
+FILE_PATTERNS          = *.c \
+                         *.cc \
+                         *.cxx \
+                         *.cpp \
+                         *.c++ \
+                         *.d \
+                         *.java \
+                         *.ii \
+                         *.ixx \
+                         *.ipp \
+                         *.i++ \
+                         *.inl \
+                         *.h \
+                         *.hh \
+                         *.hxx \
+                         *.hpp \
+                         *.h++ \
+                         *.idl \
+                         *.odl \
+                         *.cs \
+                         *.php \
+                         *.php3 \
+                         *.inc \
+                         *.m \
+                         *.mm \
+                         *.dox \
+                         *.py \
+                         *.C \
+                         *.CC \
+                         *.C++ \
+                         *.II \
+                         *.I++ \
+                         *.H \
+                         *.HH \
+                         *.H++ \
+                         *.CS \
+                         *.PHP \
+                         *.PHP3 \
+                         *.M \
+                         *.MM \
+                         *.PY
+RECURSIVE              = NO
+EXCLUDE                =
+EXCLUDE_SYMLINKS       = NO
+EXCLUDE_PATTERNS       =
+EXAMPLE_PATH           =
+EXAMPLE_PATTERNS       = *
+EXAMPLE_RECURSIVE      = NO
+IMAGE_PATH             =
+INPUT_FILTER           =
+FILTER_PATTERNS        =
+FILTER_SOURCE_FILES    = NO
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+SOURCE_BROWSER         = NO
+INLINE_SOURCES         = NO
+STRIP_CODE_COMMENTS    = YES
+REFERENCED_BY_RELATION = YES
+REFERENCES_RELATION    = YES
+USE_HTAGS              = NO
+VERBATIM_HEADERS       = NO
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+ALPHABETICAL_INDEX     = NO
+COLS_IN_ALPHA_INDEX    = 5
+IGNORE_PREFIX          =
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+GENERATE_HTML          = YES
+HTML_OUTPUT            = html
+HTML_FILE_EXTENSION    = .html
+HTML_HEADER            =
+HTML_FOOTER            =
+HTML_STYLESHEET        =
+HTML_ALIGN_MEMBERS     = YES
+GENERATE_HTMLHELP      = NO
+CHM_FILE               =
+HHC_LOCATION           =
+GENERATE_CHI           = NO
+BINARY_TOC             = NO
+TOC_EXPAND             = NO
+DISABLE_INDEX          = NO
+ENUM_VALUES_PER_LINE   = 4
+GENERATE_TREEVIEW      = YES
+TREEVIEW_WIDTH         = 250
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+GENERATE_LATEX         = NO
+LATEX_OUTPUT           = latex
+LATEX_CMD_NAME         = latex
+MAKEINDEX_CMD_NAME     = makeindex
+COMPACT_LATEX          = NO
+PAPER_TYPE             = a4wide
+EXTRA_PACKAGES         =
+LATEX_HEADER           =
+PDF_HYPERLINKS         = NO
+USE_PDFLATEX           = NO
+LATEX_BATCHMODE        = NO
+LATEX_HIDE_INDICES     = NO
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+GENERATE_RTF           = NO
+RTF_OUTPUT             = rtf
+COMPACT_RTF            = NO
+RTF_HYPERLINKS         = NO
+RTF_STYLESHEET_FILE    =
+RTF_EXTENSIONS_FILE    =
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+GENERATE_MAN           = NO
+MAN_OUTPUT             = man
+MAN_EXTENSION          = .3
+MAN_LINKS              = NO
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+GENERATE_XML           = NO
+XML_OUTPUT             = xml
+XML_SCHEMA             =
+XML_DTD                =
+XML_PROGRAMLISTING     = YES
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+GENERATE_AUTOGEN_DEF   = NO
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+GENERATE_PERLMOD       = NO
+PERLMOD_LATEX          = NO
+PERLMOD_PRETTY         = YES
+PERLMOD_MAKEVAR_PREFIX =
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+ENABLE_PREPROCESSING   = YES
+MACRO_EXPANSION        = NO
+EXPAND_ONLY_PREDEF     = NO
+SEARCH_INCLUDES        = YES
+INCLUDE_PATH           =
+INCLUDE_FILE_PATTERNS  =
+PREDEFINED             = DEBUG DEBUG_MEMORY
+EXPAND_AS_DEFINED      =
+SKIP_FUNCTION_MACROS   = YES
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+TAGFILES               =
+GENERATE_TAGFILE       =
+ALLEXTERNALS           = NO
+EXTERNAL_GROUPS        = YES
+PERL_PATH              = /usr/bin/perl
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+CLASS_DIAGRAMS         = YES
+HIDE_UNDOC_RELATIONS   = YES
+HAVE_DOT               = NO
+CLASS_GRAPH            = YES
+COLLABORATION_GRAPH    = YES
+GROUP_GRAPHS           = YES
+UML_LOOK               = NO
+TEMPLATE_RELATIONS     = NO
+INCLUDE_GRAPH          = NO
+INCLUDED_BY_GRAPH      = YES
+CALL_GRAPH             = NO
+GRAPHICAL_HIERARCHY    = YES
+DIRECTORY_GRAPH        = YES
+DOT_IMAGE_FORMAT       = png
+DOT_PATH               =
+DOTFILE_DIRS           =
+MAX_DOT_GRAPH_DEPTH    = 1000
+DOT_TRANSPARENT        = NO
+DOT_MULTI_TARGETS      = NO
+GENERATE_LEGEND        = YES
+DOT_CLEANUP            = YES
+#---------------------------------------------------------------------------
+# Configuration::additions related to the search engine
+#---------------------------------------------------------------------------
+SEARCHENGINE           = NO
diff --git a/drivers/usb/host/dwc_common_port/dwc_cc.c b/drivers/usb/host/dwc_common_port/dwc_cc.c
new file mode 100644
index 0000000000000..5ec2ae28698c1
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_cc.c
@@ -0,0 +1,532 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.c $
+ * $Revision: #4 $
+ * $Date: 2010/11/04 $
+ * $Change: 1621692 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifdef DWC_CCLIB
+
+#include "dwc_cc.h"
+
+typedef struct dwc_cc
+{
+	uint32_t uid;
+	uint8_t chid[16];
+	uint8_t cdid[16];
+	uint8_t ck[16];
+	uint8_t *name;
+	uint8_t length;
+        DWC_CIRCLEQ_ENTRY(dwc_cc) list_entry;
+} dwc_cc_t;
+
+DWC_CIRCLEQ_HEAD(context_list, dwc_cc);
+
+/** The main structure for CC management.  */
+struct dwc_cc_if
+{
+	dwc_mutex_t *mutex;
+	char *filename;
+
+	unsigned is_host:1;
+
+	dwc_notifier_t *notifier;
+
+	struct context_list list;
+};
+
+#ifdef DEBUG
+static inline void dump_bytes(char *name, uint8_t *bytes, int len)
+{
+	int i;
+	DWC_PRINTF("%s: ", name);
+	for (i=0; i<len; i++) {
+		DWC_PRINTF("%02x ", bytes[i]);
+	}
+	DWC_PRINTF("\n");
+}
+#else
+#define dump_bytes(x...)
+#endif
+
+static dwc_cc_t *alloc_cc(void *mem_ctx, uint8_t *name, uint32_t length)
+{
+	dwc_cc_t *cc = dwc_alloc(mem_ctx, sizeof(dwc_cc_t));
+	if (!cc) {
+		return NULL;
+	}
+	DWC_MEMSET(cc, 0, sizeof(dwc_cc_t));
+
+	if (name) {
+		cc->length = length;
+		cc->name = dwc_alloc(mem_ctx, length);
+		if (!cc->name) {
+			dwc_free(mem_ctx, cc);
+			return NULL;
+		}
+
+		DWC_MEMCPY(cc->name, name, length);
+	}
+
+	return cc;
+}
+
+static void free_cc(void *mem_ctx, dwc_cc_t *cc)
+{
+	if (cc->name) {
+		dwc_free(mem_ctx, cc->name);
+	}
+	dwc_free(mem_ctx, cc);
+}
+
+static uint32_t next_uid(dwc_cc_if_t *cc_if)
+{
+	uint32_t uid = 0;
+	dwc_cc_t *cc;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (cc->uid > uid) {
+			uid = cc->uid;
+		}
+	}
+
+	if (uid == 0) {
+		uid = 255;
+	}
+
+	return uid + 1;
+}
+
+static dwc_cc_t *cc_find(dwc_cc_if_t *cc_if, uint32_t uid)
+{
+	dwc_cc_t *cc;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (cc->uid == uid) {
+			return cc;
+		}
+	}
+	return NULL;
+}
+
+static unsigned int cc_data_size(dwc_cc_if_t *cc_if)
+{
+	unsigned int size = 0;
+	dwc_cc_t *cc;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		size += (48 + 1);
+		if (cc->name) {
+			size += cc->length;
+		}
+	}
+	return size;
+}
+
+static uint32_t cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
+{
+	uint32_t uid = 0;
+	dwc_cc_t *cc;
+
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (DWC_MEMCMP(cc->chid, chid, 16) == 0) {
+			uid = cc->uid;
+			break;
+		}
+	}
+	return uid;
+}
+static uint32_t cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
+{
+	uint32_t uid = 0;
+	dwc_cc_t *cc;
+
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (DWC_MEMCMP(cc->cdid, cdid, 16) == 0) {
+			uid = cc->uid;
+			break;
+		}
+	}
+	return uid;
+}
+
+/* Internal cc_add */
+static int32_t cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
+		      uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
+{
+	dwc_cc_t *cc;
+	uint32_t uid;
+
+	if (cc_if->is_host) {
+		uid = cc_match_cdid(cc_if, cdid);
+	}
+	else {
+		uid = cc_match_chid(cc_if, chid);
+	}
+
+	if (uid) {
+		DWC_DEBUGC("Replacing previous connection context id=%d name=%p name_len=%d", uid, name, length);
+		cc = cc_find(cc_if, uid);
+	}
+	else {
+		cc = alloc_cc(mem_ctx, name, length);
+		cc->uid = next_uid(cc_if);
+		DWC_CIRCLEQ_INSERT_TAIL(&cc_if->list, cc, list_entry);
+	}
+
+	DWC_MEMCPY(&(cc->chid[0]), chid, 16);
+	DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
+	DWC_MEMCPY(&(cc->ck[0]), ck, 16);
+
+	DWC_DEBUGC("Added connection context id=%d name=%p name_len=%d", cc->uid, name, length);
+	dump_bytes("CHID", cc->chid, 16);
+	dump_bytes("CDID", cc->cdid, 16);
+	dump_bytes("CK", cc->ck, 16);
+	return cc->uid;
+}
+
+/* Internal cc_clear */
+static void cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
+{
+	while (!DWC_CIRCLEQ_EMPTY(&cc_if->list)) {
+		dwc_cc_t *cc = DWC_CIRCLEQ_FIRST(&cc_if->list);
+		DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
+		free_cc(mem_ctx, cc);
+	}
+}
+
+dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
+			     dwc_notifier_t *notifier, unsigned is_host)
+{
+	dwc_cc_if_t *cc_if = NULL;
+
+	/* Allocate a common_cc_if structure */
+	cc_if = dwc_alloc(mem_ctx, sizeof(dwc_cc_if_t));
+
+	if (!cc_if)
+		return NULL;
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+	DWC_MUTEX_ALLOC_LINUX_DEBUG(cc_if->mutex);
+#else
+	cc_if->mutex = dwc_mutex_alloc(mtx_ctx);
+#endif
+	if (!cc_if->mutex) {
+		dwc_free(mem_ctx, cc_if);
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INIT(&cc_if->list);
+	cc_if->is_host = is_host;
+	cc_if->notifier = notifier;
+	return cc_if;
+}
+
+void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if)
+{
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+	DWC_MUTEX_FREE(cc_if->mutex);
+#else
+	dwc_mutex_free(mtx_ctx, cc_if->mutex);
+#endif
+	cc_clear(mem_ctx, cc_if);
+	dwc_free(mem_ctx, cc_if);
+}
+
+static void cc_changed(dwc_cc_if_t *cc_if)
+{
+	if (cc_if->notifier) {
+		dwc_notify(cc_if->notifier, DWC_CC_LIST_CHANGED_NOTIFICATION, cc_if);
+	}
+}
+
+void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
+{
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc_clear(mem_ctx, cc_if);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	cc_changed(cc_if);
+}
+
+int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
+		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
+{
+	uint32_t uid;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	uid = cc_add(mem_ctx, cc_if, chid, cdid, ck, name, length);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	cc_changed(cc_if);
+
+	return uid;
+}
+
+void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id, uint8_t *chid,
+		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
+{
+	dwc_cc_t* cc;
+
+	DWC_DEBUGC("Change connection context %d", id);
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (!cc) {
+		DWC_ERROR("Uid %d not found in cc list\n", id);
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return;
+	}
+
+	if (chid) {
+		DWC_MEMCPY(&(cc->chid[0]), chid, 16);
+	}
+	if (cdid) {
+		DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
+	}
+	if (ck) {
+		DWC_MEMCPY(&(cc->ck[0]), ck, 16);
+	}
+
+	if (name) {
+		if (cc->name) {
+			dwc_free(mem_ctx, cc->name);
+		}
+		cc->name = dwc_alloc(mem_ctx, length);
+		if (!cc->name) {
+			DWC_ERROR("Out of memory in dwc_cc_change()\n");
+			DWC_MUTEX_UNLOCK(cc_if->mutex);
+			return;
+		}
+		cc->length = length;
+		DWC_MEMCPY(cc->name, name, length);
+	}
+
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	cc_changed(cc_if);
+
+	DWC_DEBUGC("Changed connection context id=%d\n", id);
+	dump_bytes("New CHID", cc->chid, 16);
+	dump_bytes("New CDID", cc->cdid, 16);
+	dump_bytes("New CK", cc->ck, 16);
+}
+
+void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id)
+{
+	dwc_cc_t *cc;
+
+	DWC_DEBUGC("Removing connection context %d", id);
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (!cc) {
+		DWC_ERROR("Uid %d not found in cc list\n", id);
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return;
+	}
+
+	DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	free_cc(mem_ctx, cc);
+
+	cc_changed(cc_if);
+}
+
+uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if, unsigned int *length)
+{
+	uint8_t *buf, *x;
+	uint8_t zero = 0;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	*length = cc_data_size(cc_if);
+	if (!(*length)) {
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return NULL;
+	}
+
+	DWC_DEBUGC("Creating data for saving (length=%d)", *length);
+
+	buf = dwc_alloc(mem_ctx, *length);
+	if (!buf) {
+		*length = 0;
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return NULL;
+	}
+
+	x = buf;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		DWC_MEMCPY(x, cc->chid, 16);
+		x += 16;
+		DWC_MEMCPY(x, cc->cdid, 16);
+		x += 16;
+		DWC_MEMCPY(x, cc->ck, 16);
+		x += 16;
+		if (cc->name) {
+			DWC_MEMCPY(x, &cc->length, 1);
+			x += 1;
+			DWC_MEMCPY(x, cc->name, cc->length);
+			x += cc->length;
+		}
+		else {
+			DWC_MEMCPY(x, &zero, 1);
+			x += 1;
+		}
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return buf;
+}
+
+void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *data, uint32_t length)
+{
+	uint8_t name_length;
+	uint8_t *name;
+	uint8_t *chid;
+	uint8_t *cdid;
+	uint8_t *ck;
+	uint32_t i = 0;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc_clear(mem_ctx, cc_if);
+
+	while (i < length) {
+		chid = &data[i];
+		i += 16;
+		cdid = &data[i];
+		i += 16;
+		ck = &data[i];
+		i += 16;
+
+		name_length = data[i];
+		i ++;
+
+		if (name_length) {
+			name = &data[i];
+			i += name_length;
+		}
+		else {
+			name = NULL;
+		}
+
+		/* check to see if we haven't overflown the buffer */
+		if (i > length) {
+			DWC_ERROR("Data format error while attempting to load CCs "
+				  "(nlen=%d, iter=%d, buflen=%d).\n", name_length, i, length);
+			break;
+		}
+
+		cc_add(mem_ctx, cc_if, chid, cdid, ck, name, name_length);
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	cc_changed(cc_if);
+}
+
+uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
+{
+	uint32_t uid = 0;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	uid = cc_match_chid(cc_if, chid);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	return uid;
+}
+uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
+{
+	uint32_t uid = 0;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	uid = cc_match_cdid(cc_if, cdid);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	return uid;
+}
+
+uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id)
+{
+	uint8_t *ck = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		ck = cc->ck;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return ck;
+
+}
+
+uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id)
+{
+	uint8_t *retval = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		retval = cc->chid;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return retval;
+}
+
+uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id)
+{
+	uint8_t *retval = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		retval = cc->cdid;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return retval;
+}
+
+uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length)
+{
+	uint8_t *retval = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	*length = 0;
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		*length = cc->length;
+		retval = cc->name;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return retval;
+}
+
+#endif	/* DWC_CCLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_cc.h b/drivers/usb/host/dwc_common_port/dwc_cc.h
new file mode 100644
index 0000000000000..f86e6f21792b9
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_cc.h
@@ -0,0 +1,224 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.h $
+ * $Revision: #4 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifndef _DWC_CC_H_
+#define _DWC_CC_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * This file defines the Context Context library.
+ *
+ * The main data structure is dwc_cc_if_t which is returned by either the
+ * dwc_cc_if_alloc function or returned by the module to the user via a provided
+ * function. The data structure is opaque and should only be manipulated via the
+ * functions provied in this API.
+ *
+ * It manages a list of connection contexts and operations can be performed to
+ * add, remove, query, search, and change, those contexts.  Additionally,
+ * a dwc_notifier_t object can be requested from the manager so that
+ * the user can be notified whenever the context list has changed.
+ */
+
+#include "dwc_os.h"
+#include "dwc_list.h"
+#include "dwc_notifier.h"
+
+
+/* Notifications */
+#define DWC_CC_LIST_CHANGED_NOTIFICATION "DWC_CC_LIST_CHANGED_NOTIFICATION"
+
+struct dwc_cc_if;
+typedef struct dwc_cc_if dwc_cc_if_t;
+
+
+/** @name Connection Context Operations */
+/** @{ */
+
+/** This function allocates memory for a dwc_cc_if_t structure, initializes
+ * fields to default values, and returns a pointer to the structure or NULL on
+ * error. */
+extern dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
+				    dwc_notifier_t *notifier, unsigned is_host);
+
+/** Frees the memory for the specified CC structure allocated from
+ * dwc_cc_if_alloc(). */
+extern void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if);
+
+/** Removes all contexts from the connection context list */
+extern void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if);
+
+/** Adds a connection context (CHID, CK, CDID, Name) to the connection context list.
+ * If a CHID already exists, the CK and name are overwritten.  Statistics are
+ * not overwritten.
+ *
+ * @param cc_if The cc_if structure.
+ * @param chid A pointer to the 16-byte CHID.  This value will be copied.
+ * @param ck A pointer to the 16-byte CK.  This value will be copied.
+ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.
+ * @param name An optional host friendly name as defined in the association model
+ * spec.  Must be a UTF16-LE unicode string.  Can be NULL to indicated no name.
+ * @param length The length othe unicode string.
+ * @return A unique identifier used to refer to this context that is valid for
+ * as long as this context is still in the list. */
+extern int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
+			  uint8_t *cdid, uint8_t *ck, uint8_t *name,
+			  uint8_t length);
+
+/** Changes the CHID, CK, CDID, or Name values of a connection context in the
+ * list, preserving any accumulated statistics.  This would typically be called
+ * if the host decideds to change the context with a SET_CONNECTION request.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @param chid A pointer to the 16-byte CHID.  This value will be copied.  NULL
+ * indicates no change.
+ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.  NULL
+ * indicates no change.
+ * @param ck A pointer to the 16-byte CK.  This value will be copied.  NULL
+ * indicates no change.
+ * @param name Host friendly name UTF16-LE.  NULL indicates no change.
+ * @param length Length of name. */
+extern void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id,
+			  uint8_t *chid, uint8_t *cdid, uint8_t *ck,
+			  uint8_t *name, uint8_t length);
+
+/** Remove the specified connection context.
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context to remove. */
+extern void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id);
+
+/** Get a binary block of data for the connection context list and attributes.
+ * This data can be used by the OS specific driver to save the connection
+ * context list into non-volatile memory.
+ *
+ * @param cc_if The cc_if structure.
+ * @param length Return the length of the data buffer.
+ * @return A pointer to the data buffer.  The memory for this buffer should be
+ * freed with DWC_FREE() after use. */
+extern uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if,
+				     unsigned int *length);
+
+/** Restore the connection context list from the binary data that was previously
+ * returned from a call to dwc_cc_data_for_save.  This can be used by the OS specific
+ * driver to load a connection context list from non-volatile memory.
+ *
+ * @param cc_if The cc_if structure.
+ * @param data The data bytes as returned from dwc_cc_data_for_save.
+ * @param length The length of the data. */
+extern void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if,
+				     uint8_t *data, unsigned int length);
+
+/** Find the connection context from the specified CHID.
+ *
+ * @param cc_if The cc_if structure.
+ * @param chid A pointer to the CHID data.
+ * @return A non-zero identifier of the connection context if the CHID matches.
+ * Otherwise returns 0. */
+extern uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid);
+
+/** Find the connection context from the specified CDID.
+ *
+ * @param cc_if The cc_if structure.
+ * @param cdid A pointer to the CDID data.
+ * @return A non-zero identifier of the connection context if the CHID matches.
+ * Otherwise returns 0. */
+extern uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid);
+
+/** Retrieve the CK from the specified connection context.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @return A pointer to the CK data.  The memory does not need to be freed. */
+extern uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id);
+
+/** Retrieve the CHID from the specified connection context.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @return A pointer to the CHID data.  The memory does not need to be freed. */
+extern uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id);
+
+/** Retrieve the CDID from the specified connection context.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @return A pointer to the CDID data.  The memory does not need to be freed. */
+extern uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id);
+
+extern uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length);
+
+/** Checks a buffer for non-zero.
+ * @param id A pointer to a 16 byte buffer.
+ * @return true if the 16 byte value is non-zero. */
+static inline unsigned dwc_assoc_is_not_zero_id(uint8_t *id) {
+	int i;
+	for (i=0; i<16; i++) {
+		if (id[i]) return 1;
+	}
+	return 0;
+}
+
+/** Checks a buffer for zero.
+ * @param id A pointer to a 16 byte buffer.
+ * @return true if the 16 byte value is zero. */
+static inline unsigned dwc_assoc_is_zero_id(uint8_t *id) {
+	return !dwc_assoc_is_not_zero_id(id);
+}
+
+/** Prints an ASCII representation for the 16-byte chid, cdid, or ck, into
+ * buffer. */
+static inline int dwc_print_id_string(char *buffer, uint8_t *id) {
+	char *ptr = buffer;
+	int i;
+	for (i=0; i<16; i++) {
+		ptr += DWC_SPRINTF(ptr, "%02x", id[i]);
+		if (i < 15) {
+			ptr += DWC_SPRINTF(ptr, " ");
+		}
+	}
+	return ptr - buffer;
+}
+
+/** @} */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_CC_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c b/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
new file mode 100644
index 0000000000000..6dd04b58f8f6c
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
@@ -0,0 +1,1308 @@
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+#ifdef DWC_CCLIB
+# include "dwc_cc.h"
+#endif
+
+#ifdef DWC_CRYPTOLIB
+# include "dwc_modpow.h"
+# include "dwc_dh.h"
+# include "dwc_crypto.h"
+#endif
+
+#ifdef DWC_NOTIFYLIB
+# include "dwc_notifier.h"
+#endif
+
+/* OS-Level Implementations */
+
+/* This is the FreeBSD 7.0 kernel implementation of the DWC platform library. */
+
+
+/* MISC */
+
+void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
+{
+	return memset(dest, byte, size);
+}
+
+void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
+{
+	return memcpy(dest, src, size);
+}
+
+void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
+{
+	bcopy(src, dest, size);
+	return dest;
+}
+
+int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
+{
+	return memcmp(m1, m2, size);
+}
+
+int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
+{
+	return strncmp(s1, s2, size);
+}
+
+int DWC_STRCMP(void *s1, void *s2)
+{
+	return strcmp(s1, s2);
+}
+
+int DWC_STRLEN(char const *str)
+{
+	return strlen(str);
+}
+
+char *DWC_STRCPY(char *to, char const *from)
+{
+	return strcpy(to, from);
+}
+
+char *DWC_STRDUP(char const *str)
+{
+	int len = DWC_STRLEN(str) + 1;
+	char *new = DWC_ALLOC_ATOMIC(len);
+
+	if (!new) {
+		return NULL;
+	}
+
+	DWC_MEMCPY(new, str, len);
+	return new;
+}
+
+int DWC_ATOI(char *str, int32_t *value)
+{
+	char *end = NULL;
+
+	*value = strtol(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+int DWC_ATOUI(char *str, uint32_t *value)
+{
+	char *end = NULL;
+
+	*value = strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+
+#ifdef DWC_UTFLIB
+/* From usbstring.c */
+
+int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+
+#endif	/* DWC_UTFLIB */
+
+
+/* dwc_debug.h */
+
+dwc_bool_t DWC_IN_IRQ(void)
+{
+//	return in_irq();
+	return 0;
+}
+
+dwc_bool_t DWC_IN_BH(void)
+{
+//	return in_softirq();
+	return 0;
+}
+
+void DWC_VPRINTF(char *format, va_list args)
+{
+	vprintf(format, args);
+}
+
+int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
+{
+	return vsnprintf(str, size, format, args);
+}
+
+void DWC_PRINTF(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+int DWC_SPRINTF(char *buffer, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsprintf(buffer, format, args);
+	va_end(args);
+	return retval;
+}
+
+int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsnprintf(buffer, size, format, args);
+	va_end(args);
+	return retval;
+}
+
+void __DWC_WARN(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void __DWC_ERROR(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void DWC_EXCEPTION(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+//	BUG_ON(1);	???
+}
+
+#ifdef DEBUG
+void __DWC_DEBUG(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+#endif
+
+
+/* dwc_mem.h */
+
+#if 0
+dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
+				uint32_t align,
+				uint32_t alloc)
+{
+	struct dma_pool *pool = dma_pool_create("Pool", NULL,
+						size, align, alloc);
+	return (dwc_pool_t *)pool;
+}
+
+void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
+{
+	dma_pool_destroy((struct dma_pool *)pool);
+}
+
+void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
+	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
+}
+
+void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
+	memset(..);
+}
+
+void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
+{
+	dma_pool_free(pool, vaddr, daddr);
+}
+#endif
+
+static void dmamap_cb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
+{
+	if (error)
+		return;
+	*(bus_addr_t *)arg = segs[0].ds_addr;
+}
+
+void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+	int error;
+
+	error = bus_dma_tag_create(
+#if __FreeBSD_version >= 700000
+			bus_get_dma_tag(dma->dev),	/* parent */
+#else
+			NULL,				/* parent */
+#endif
+			4, 0,				/* alignment, bounds */
+			BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
+			BUS_SPACE_MAXADDR,		/* highaddr */
+			NULL, NULL,			/* filter, filterarg */
+			size,				/* maxsize */
+			1,				/* nsegments */
+			size,				/* maxsegsize */
+			0,				/* flags */
+			NULL,				/* lockfunc */
+			NULL,				/* lockarg */
+			&dma->dma_tag);
+	if (error) {
+		device_printf(dma->dev, "%s: bus_dma_tag_create failed: %d\n",
+			      __func__, error);
+		goto fail_0;
+	}
+
+	error = bus_dmamem_alloc(dma->dma_tag, &dma->dma_vaddr,
+				 BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dma->dma_map);
+	if (error) {
+		device_printf(dma->dev, "%s: bus_dmamem_alloc(%ju) failed: %d\n",
+			      __func__, (uintmax_t)size, error);
+		goto fail_1;
+	}
+
+	dma->dma_paddr = 0;
+	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr, size,
+				dmamap_cb, &dma->dma_paddr, BUS_DMA_NOWAIT);
+	if (error || dma->dma_paddr == 0) {
+		device_printf(dma->dev, "%s: bus_dmamap_load failed: %d\n",
+			      __func__, error);
+		goto fail_2;
+	}
+
+	*dma_addr = dma->dma_paddr;
+	return dma->dma_vaddr;
+
+fail_2:
+	bus_dmamap_unload(dma->dma_tag, dma->dma_map);
+fail_1:
+	bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
+	bus_dma_tag_destroy(dma->dma_tag);
+fail_0:
+	dma->dma_map = NULL;
+	dma->dma_tag = NULL;
+
+	return NULL;
+}
+
+void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+
+	if (dma->dma_tag == NULL)
+		return;
+	if (dma->dma_map != NULL) {
+		bus_dmamap_sync(dma->dma_tag, dma->dma_map,
+				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
+		bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
+		dma->dma_map = NULL;
+	}
+
+	bus_dma_tag_destroy(dma->dma_tag);
+	dma->dma_tag = NULL;
+}
+
+void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
+}
+
+void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
+}
+
+void __DWC_FREE(void *mem_ctx, void *addr)
+{
+	free(addr, M_DEVBUF);
+}
+
+
+#ifdef DWC_CRYPTOLIB
+/* dwc_crypto.h */
+
+void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
+{
+	get_random_bytes(buffer, length);
+}
+
+int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
+{
+	struct crypto_blkcipher *tfm;
+	struct blkcipher_desc desc;
+	struct scatterlist sgd;
+	struct scatterlist sgs;
+
+	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	if (tfm == NULL) {
+		printk("failed to load transform for aes CBC\n");
+		return -1;
+	}
+
+	crypto_blkcipher_setkey(tfm, key, keylen);
+	crypto_blkcipher_set_iv(tfm, iv, 16);
+
+	sg_init_one(&sgd, out, messagelen);
+	sg_init_one(&sgs, message, messagelen);
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
+		crypto_free_blkcipher(tfm);
+		DWC_ERROR("AES CBC encryption failed");
+		return -1;
+	}
+
+	crypto_free_blkcipher(tfm);
+	return 0;
+}
+
+int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, len);
+	crypto_hash_digest(&desc, &sg, len, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
+		    uint8_t *key, uint32_t keylen, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, messagelen);
+	crypto_hash_setkey(tfm, key, keylen);
+	crypto_hash_digest(&desc, &sg, messagelen, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+#endif	/* DWC_CRYPTOLIB */
+
+
+/* Byte Ordering Conversions */
+
+uint32_t DWC_CPU_TO_LE32(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_CPU_TO_BE32(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_LE32_TO_CPU(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_BE32_TO_CPU(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint16_t DWC_CPU_TO_LE16(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_CPU_TO_BE16(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_LE16_TO_CPU(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_BE16_TO_CPU(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+
+/* Registers */
+
+uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_4(io->iot, io->ioh, ior);
+}
+
+#if 0
+uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_8(io->iot, io->ioh, ior);
+}
+#endif
+
+void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior, value);
+}
+
+#if 0
+void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior, value);
+}
+#endif
+
+void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
+		      uint32_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior,
+			  (bus_space_read_4(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+
+#if 0
+void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
+		      uint64_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior,
+			  (bus_space_read_8(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+#endif
+
+
+/* Locking */
+
+dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
+{
+	struct mtx *sl = DWC_ALLOC(sizeof(*sl));
+
+	if (!sl) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		return NULL;
+	}
+
+	mtx_init(sl, "dw3spn", NULL, MTX_SPIN);
+	return (dwc_spinlock_t *)sl;
+}
+
+void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
+{
+	struct mtx *sl = (struct mtx *)lock;
+
+	mtx_destroy(sl);
+	DWC_FREE(sl);
+}
+
+void DWC_SPINLOCK(dwc_spinlock_t *lock)
+{
+	mtx_lock_spin((struct mtx *)lock);	// ???
+}
+
+void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
+{
+	mtx_unlock_spin((struct mtx *)lock);	// ???
+}
+
+void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
+{
+	mtx_lock_spin((struct mtx *)lock);
+}
+
+void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
+{
+	mtx_unlock_spin((struct mtx *)lock);
+}
+
+dwc_mutex_t *DWC_MUTEX_ALLOC(void)
+{
+	struct mtx *m;
+	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mtx));
+
+	if (!mutex) {
+		DWC_ERROR("Cannot allocate memory for mutex");
+		return NULL;
+	}
+
+	m = (struct mtx *)mutex;
+	mtx_init(m, "dw3mtx", NULL, MTX_DEF);
+	return mutex;
+}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+#else
+void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
+{
+	mtx_destroy((struct mtx *)mutex);
+	DWC_FREE(mutex);
+}
+#endif
+
+void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
+{
+	struct mtx *m = (struct mtx *)mutex;
+
+	mtx_lock(m);
+}
+
+int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
+{
+	struct mtx *m = (struct mtx *)mutex;
+
+	return mtx_trylock(m);
+}
+
+void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
+{
+	struct mtx *m = (struct mtx *)mutex;
+
+	mtx_unlock(m);
+}
+
+
+/* Timing */
+
+void DWC_UDELAY(uint32_t usecs)
+{
+	DELAY(usecs);
+}
+
+void DWC_MDELAY(uint32_t msecs)
+{
+	do {
+		DELAY(1000);
+	} while (--msecs);
+}
+
+void DWC_MSLEEP(uint32_t msecs)
+{
+	struct timeval tv;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+	pause("dw3slp", tvtohz(&tv));
+}
+
+uint32_t DWC_TIME(void)
+{
+	struct timeval tv;
+
+	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
+	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
+}
+
+
+/* Timers */
+
+struct dwc_timer {
+	struct callout t;
+	char *name;
+	dwc_spinlock_t *lock;
+	dwc_timer_callback_t cb;
+	void *data;
+};
+
+dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
+{
+	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (!t) {
+		DWC_ERROR("Cannot allocate memory for timer");
+		return NULL;
+	}
+
+	callout_init(&t->t, 1);
+
+	t->name = DWC_STRDUP(name);
+	if (!t->name) {
+		DWC_ERROR("Cannot allocate memory for timer->name");
+		goto no_name;
+	}
+
+	t->lock = DWC_SPINLOCK_ALLOC();
+	if (!t->lock) {
+		DWC_ERROR("Cannot allocate memory for lock");
+		goto no_lock;
+	}
+
+	t->cb = cb;
+	t->data = data;
+
+	return t;
+
+ no_lock:
+	DWC_FREE(t->name);
+ no_name:
+	DWC_FREE(t);
+
+	return NULL;
+}
+
+void DWC_TIMER_FREE(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+	DWC_SPINLOCK_FREE(timer->lock);
+	DWC_FREE(timer->name);
+	DWC_FREE(timer);
+}
+
+void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
+{
+	struct timeval tv;
+
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
+}
+
+void DWC_TIMER_CANCEL(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+}
+
+
+/* Wait Queues */
+
+struct dwc_waitq {
+	struct mtx lock;
+	int abort;
+};
+
+dwc_waitq_t *DWC_WAITQ_ALLOC(void)
+{
+	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		return NULL;
+	}
+
+	mtx_init(&wq->lock, "dw3wtq", NULL, MTX_DEF);
+	wq->abort = 0;
+
+	return wq;
+}
+
+void DWC_WAITQ_FREE(dwc_waitq_t *wq)
+{
+	mtx_destroy(&wq->lock);
+	DWC_FREE(wq);
+}
+
+int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
+{
+//	intrmask_t ipl;
+	int result = 0;
+
+	mtx_lock(&wq->lock);
+//	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+//		splx(ipl);
+		result = msleep(wq, &wq->lock, PCATCH, "dw3wat", 0); // infinite timeout
+//		ipl = splbio();
+	}
+
+	if (result == ERESTART) {	// signaled - restart
+		result = -DWC_E_RESTART;
+
+	} else if (result == EINTR) {	// signaled - interrupt
+		result = -DWC_E_ABORT;
+
+	} else if (wq->abort) {
+		result = -DWC_E_ABORT;
+
+	} else {
+		result = 0;
+	}
+
+	wq->abort = 0;
+//	splx(ipl);
+	mtx_unlock(&wq->lock);
+	return result;
+}
+
+int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+			       void *data, int32_t msecs)
+{
+	struct timeval tv, tv1, tv2;
+//	intrmask_t ipl;
+	int result = 0;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+
+	mtx_lock(&wq->lock);
+//	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+//		splx(ipl);
+		getmicrouptime(&tv1);
+		result = msleep(wq, &wq->lock, PCATCH, "dw3wto", tvtohz(&tv));
+		getmicrouptime(&tv2);
+//		ipl = splbio();
+	}
+
+	if (result == 0) {			// awoken
+		if (wq->abort) {
+			result = -DWC_E_ABORT;
+		} else {
+			tv2.tv_usec -= tv1.tv_usec;
+			if (tv2.tv_usec < 0) {
+				tv2.tv_usec += 1000000;
+				tv2.tv_sec--;
+			}
+
+			tv2.tv_sec -= tv1.tv_sec;
+			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
+			result = msecs - result;
+			if (result <= 0)
+				result = 1;
+		}
+	} else if (result == ERESTART) {	// signaled - restart
+		result = -DWC_E_RESTART;
+
+	} else if (result == EINTR) {		// signaled - interrupt
+		result = -DWC_E_ABORT;
+
+	} else {				// timed out
+		result = -DWC_E_TIMEOUT;
+	}
+
+	wq->abort = 0;
+//	splx(ipl);
+	mtx_unlock(&wq->lock);
+	return result;
+}
+
+void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
+{
+	wakeup(wq);
+}
+
+void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
+{
+//	intrmask_t ipl;
+
+	mtx_lock(&wq->lock);
+//	ipl = splbio();
+	wq->abort = 1;
+	wakeup(wq);
+//	splx(ipl);
+	mtx_unlock(&wq->lock);
+}
+
+
+/* Threading */
+
+struct dwc_thread {
+	struct proc *proc;
+	int abort;
+};
+
+dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
+{
+	int retval;
+	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
+
+	if (!thread) {
+		return NULL;
+	}
+
+	thread->abort = 0;
+	retval = kthread_create((void (*)(void *))func, data, &thread->proc,
+				RFPROC | RFNOWAIT, 0, "%s", name);
+	if (retval) {
+		DWC_FREE(thread);
+		return NULL;
+	}
+
+	return thread;
+}
+
+int DWC_THREAD_STOP(dwc_thread_t *thread)
+{
+	int retval;
+
+	thread->abort = 1;
+	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
+
+	if (retval == 0) {
+		/* DWC_THREAD_EXIT() will free the thread struct */
+		return 0;
+	}
+
+	/* NOTE: We leak the thread struct if thread doesn't die */
+
+	if (retval == EWOULDBLOCK) {
+		return -DWC_E_TIMEOUT;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
+{
+	return thread->abort;
+}
+
+void DWC_THREAD_EXIT(dwc_thread_t *thread)
+{
+	wakeup(&thread->abort);
+	DWC_FREE(thread);
+	kthread_exit(0);
+}
+
+
+/* tasklets
+ - Runs in interrupt context (cannot sleep)
+ - Each tasklet runs on a single CPU [ How can we ensure this on FreeBSD? Does it matter? ]
+ - Different tasklets can be running simultaneously on different CPUs [ shouldn't matter ]
+ */
+struct dwc_tasklet {
+	struct task t;
+	dwc_tasklet_callback_t cb;
+	void *data;
+};
+
+static void tasklet_callback(void *data, int pending)	// what to do with pending ???
+{
+	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
+
+	task->cb(task->data);
+}
+
+dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
+{
+	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
+
+	if (task) {
+		task->cb = cb;
+		task->data = data;
+		TASK_INIT(&task->t, 0, tasklet_callback, task);
+	} else {
+		DWC_ERROR("Cannot allocate memory for tasklet");
+	}
+
+	return task;
+}
+
+void DWC_TASK_FREE(dwc_tasklet_t *task)
+{
+	taskqueue_drain(taskqueue_fast, &task->t);	// ???
+	DWC_FREE(task);
+}
+
+void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
+{
+	/* Uses predefined system queue */
+	taskqueue_enqueue_fast(taskqueue_fast, &task->t);
+}
+
+
+/* workqueues
+ - Runs in process context (can sleep)
+ */
+typedef struct work_container {
+	dwc_work_callback_t cb;
+	void *data;
+	dwc_workq_t *wq;
+	char *name;
+	int hz;
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_ENTRY(work_container) entry;
+#endif
+	struct task task;
+} work_container_t;
+
+#ifdef DEBUG
+DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
+#endif
+
+struct dwc_workq {
+	struct taskqueue *taskq;
+	dwc_spinlock_t *lock;
+	dwc_waitq_t *waitq;
+	int pending;
+
+#ifdef DEBUG
+	struct work_container_queue entries;
+#endif
+};
+
+static void do_work(void *data, int pending)	// what to do with pending ???
+{
+	work_container_t *container = (work_container_t *)data;
+	dwc_workq_t *wq = container->wq;
+	dwc_irqflags_t flags;
+
+	if (container->hz) {
+		pause("dw3wrk", container->hz);
+	}
+
+	container->cb(container->data);
+	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
+#endif
+	if (container->name)
+		DWC_FREE(container->name);
+	DWC_FREE(container);
+	wq->pending--;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+}
+
+static int work_done(void *data)
+{
+	dwc_workq_t *workq = (dwc_workq_t *)data;
+
+	return workq->pending == 0;
+}
+
+int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
+{
+	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
+}
+
+dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
+{
+	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for workqueue");
+		return NULL;
+	}
+
+	wq->taskq = taskqueue_create(name, M_NOWAIT, taskqueue_thread_enqueue, &wq->taskq);
+	if (!wq->taskq) {
+		DWC_ERROR("Cannot allocate memory for taskqueue");
+		goto no_taskq;
+	}
+
+	wq->pending = 0;
+
+	wq->lock = DWC_SPINLOCK_ALLOC();
+	if (!wq->lock) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		goto no_lock;
+	}
+
+	wq->waitq = DWC_WAITQ_ALLOC();
+	if (!wq->waitq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		goto no_waitq;
+	}
+
+	taskqueue_start_threads(&wq->taskq, 1, PWAIT, "%s taskq", "dw3tsk");
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INIT(&wq->entries);
+#endif
+	return wq;
+
+ no_waitq:
+	DWC_SPINLOCK_FREE(wq->lock);
+ no_lock:
+	taskqueue_free(wq->taskq);
+ no_taskq:
+	DWC_FREE(wq);
+
+	return NULL;
+}
+
+void DWC_WORKQ_FREE(dwc_workq_t *wq)
+{
+#ifdef DEBUG
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+
+	if (wq->pending != 0) {
+		struct work_container *container;
+
+		DWC_ERROR("Destroying work queue with pending work");
+
+		DWC_CIRCLEQ_FOREACH(container, &wq->entries, entry) {
+			DWC_ERROR("Work %s still pending", container->name);
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+#endif
+	DWC_WAITQ_FREE(wq->waitq);
+	DWC_SPINLOCK_FREE(wq->lock);
+	taskqueue_free(wq->taskq);
+	DWC_FREE(wq);
+}
+
+void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
+			char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	container->hz = 0;
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+
+	TASK_INIT(&container->task, 0, do_work, container);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	taskqueue_enqueue_fast(wq->taskq, &container->task);
+}
+
+void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
+				void *data, uint32_t time, char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	struct timeval tv;
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	container->hz = tvtohz(&tv);
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+
+	TASK_INIT(&container->task, 0, do_work, container);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	taskqueue_enqueue_fast(wq->taskq, &container->task);
+}
+
+int DWC_WORKQ_PENDING(dwc_workq_t *wq)
+{
+	return wq->pending;
+}
diff --git a/drivers/usb/host/dwc_common_port/dwc_common_linux.c b/drivers/usb/host/dwc_common_port/dwc_common_linux.c
new file mode 100644
index 0000000000000..c2e83094d4b3b
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_common_linux.c
@@ -0,0 +1,1409 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kthread.h>
+
+#ifdef DWC_CCLIB
+# include "dwc_cc.h"
+#endif
+
+#ifdef DWC_CRYPTOLIB
+# include "dwc_modpow.h"
+# include "dwc_dh.h"
+# include "dwc_crypto.h"
+#endif
+
+#ifdef DWC_NOTIFYLIB
+# include "dwc_notifier.h"
+#endif
+
+/* OS-Level Implementations */
+
+/* This is the Linux kernel implementation of the DWC platform library. */
+#include <linux/moduleparam.h>
+#include <linux/ctype.h>
+#include <linux/crypto.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/cdev.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/jiffies.h>
+#include <linux/list.h>
+#include <linux/pci.h>
+#include <linux/random.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/stat.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+# include <linux/usb/gadget.h>
+#else
+# include <linux/usb_gadget.h>
+#endif
+
+#include <asm/io.h>
+#include <asm/page.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+
+/* MISC */
+
+void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
+{
+	return memset(dest, byte, size);
+}
+
+void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
+{
+	return memcpy(dest, src, size);
+}
+
+void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
+{
+	return memmove(dest, src, size);
+}
+
+int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
+{
+	return memcmp(m1, m2, size);
+}
+
+int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
+{
+	return strncmp(s1, s2, size);
+}
+
+int DWC_STRCMP(void *s1, void *s2)
+{
+	return strcmp(s1, s2);
+}
+
+int DWC_STRLEN(char const *str)
+{
+	return strlen(str);
+}
+
+char *DWC_STRCPY(char *to, char const *from)
+{
+	return strcpy(to, from);
+}
+
+char *DWC_STRDUP(char const *str)
+{
+	int len = DWC_STRLEN(str) + 1;
+	char *new = DWC_ALLOC_ATOMIC(len);
+
+	if (!new) {
+		return NULL;
+	}
+
+	DWC_MEMCPY(new, str, len);
+	return new;
+}
+
+int DWC_ATOI(const char *str, int32_t *value)
+{
+	char *end = NULL;
+
+	*value = simple_strtol(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+int DWC_ATOUI(const char *str, uint32_t *value)
+{
+	char *end = NULL;
+
+	*value = simple_strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+
+#ifdef DWC_UTFLIB
+/* From usbstring.c */
+
+int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+#endif	/* DWC_UTFLIB */
+
+
+/* dwc_debug.h */
+
+dwc_bool_t DWC_IN_IRQ(void)
+{
+	return in_irq();
+}
+
+dwc_bool_t DWC_IN_BH(void)
+{
+	return in_softirq();
+}
+
+void DWC_VPRINTF(char *format, va_list args)
+{
+	vprintk(format, args);
+}
+
+int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
+{
+	return vsnprintf(str, size, format, args);
+}
+
+void DWC_PRINTF(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+int DWC_SPRINTF(char *buffer, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsprintf(buffer, format, args);
+	va_end(args);
+	return retval;
+}
+
+int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsnprintf(buffer, size, format, args);
+	va_end(args);
+	return retval;
+}
+
+void __DWC_WARN(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_WARNING);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void __DWC_ERROR(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_ERR);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void DWC_EXCEPTION(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_ERR);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+	BUG_ON(1);
+}
+
+#ifdef DEBUG
+void __DWC_DEBUG(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_DEBUG);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+#endif
+
+
+/* dwc_mem.h */
+
+#if 0
+dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
+				uint32_t align,
+				uint32_t alloc)
+{
+	struct dma_pool *pool = dma_pool_create("Pool", NULL,
+						size, align, alloc);
+	return (dwc_pool_t *)pool;
+}
+
+void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
+{
+	dma_pool_destroy((struct dma_pool *)pool);
+}
+
+void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
+}
+
+void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
+	memset(..);
+}
+
+void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
+{
+	dma_pool_free(pool, vaddr, daddr);
+}
+#endif
+
+void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	return dma_zalloc_coherent(dma_ctx, size, dma_addr, GFP_KERNEL | GFP_DMA32);
+}
+
+void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	return dma_zalloc_coherent(dma_ctx, size, dma_addr, GFP_ATOMIC);
+}
+
+void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
+{
+	dma_free_coherent(dma_ctx, size, virt_addr, dma_addr);
+}
+
+void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
+{
+	return kzalloc(size, GFP_KERNEL);
+}
+
+void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
+{
+	return kzalloc(size, GFP_ATOMIC);
+}
+
+void __DWC_FREE(void *mem_ctx, void *addr)
+{
+	kfree(addr);
+}
+
+
+#ifdef DWC_CRYPTOLIB
+/* dwc_crypto.h */
+
+void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
+{
+	get_random_bytes(buffer, length);
+}
+
+int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
+{
+	struct crypto_blkcipher *tfm;
+	struct blkcipher_desc desc;
+	struct scatterlist sgd;
+	struct scatterlist sgs;
+
+	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	if (tfm == NULL) {
+		printk("failed to load transform for aes CBC\n");
+		return -1;
+	}
+
+	crypto_blkcipher_setkey(tfm, key, keylen);
+	crypto_blkcipher_set_iv(tfm, iv, 16);
+
+	sg_init_one(&sgd, out, messagelen);
+	sg_init_one(&sgs, message, messagelen);
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
+		crypto_free_blkcipher(tfm);
+		DWC_ERROR("AES CBC encryption failed");
+		return -1;
+	}
+
+	crypto_free_blkcipher(tfm);
+	return 0;
+}
+
+int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for sha256: %ld\n", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, len);
+	crypto_hash_digest(&desc, &sg, len, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
+		    uint8_t *key, uint32_t keylen, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for hmac(sha256): %ld\n", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, messagelen);
+	crypto_hash_setkey(tfm, key, keylen);
+	crypto_hash_digest(&desc, &sg, messagelen, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+#endif	/* DWC_CRYPTOLIB */
+
+
+/* Byte Ordering Conversions */
+
+uint32_t DWC_CPU_TO_LE32(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_CPU_TO_BE32(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_LE32_TO_CPU(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_BE32_TO_CPU(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint16_t DWC_CPU_TO_LE16(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_CPU_TO_BE16(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_LE16_TO_CPU(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_BE16_TO_CPU(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+
+/* Registers */
+
+uint32_t DWC_READ_REG32(uint32_t volatile *reg)
+{
+	return readl(reg);
+}
+
+#if 0
+uint64_t DWC_READ_REG64(uint64_t volatile *reg)
+{
+}
+#endif
+
+void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value)
+{
+	writel(value, reg);
+}
+
+#if 0
+void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value)
+{
+}
+#endif
+
+void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask)
+{
+	writel((readl(reg) & ~clear_mask) | set_mask, reg);
+}
+
+#if 0
+void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask)
+{
+}
+#endif
+
+
+/* Locking */
+
+dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
+{
+	spinlock_t *sl = (spinlock_t *)1;
+
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	sl = DWC_ALLOC(sizeof(*sl));
+	if (!sl) {
+		DWC_ERROR("Cannot allocate memory for spinlock\n");
+		return NULL;
+	}
+
+	spin_lock_init(sl);
+#endif
+	return (dwc_spinlock_t *)sl;
+}
+
+void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	DWC_FREE(lock);
+#endif
+}
+
+void DWC_SPINLOCK(dwc_spinlock_t *lock)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_lock((spinlock_t *)lock);
+#endif
+}
+
+void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_unlock((spinlock_t *)lock);
+#endif
+}
+
+void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
+{
+	dwc_irqflags_t f;
+
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_lock_irqsave((spinlock_t *)lock, f);
+#else
+	local_irq_save(f);
+#endif
+	*flags = f;
+}
+
+void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_unlock_irqrestore((spinlock_t *)lock, flags);
+#else
+	local_irq_restore(flags);
+#endif
+}
+
+dwc_mutex_t *DWC_MUTEX_ALLOC(void)
+{
+	struct mutex *m;
+	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex));
+
+	if (!mutex) {
+		DWC_ERROR("Cannot allocate memory for mutex\n");
+		return NULL;
+	}
+
+	m = (struct mutex *)mutex;
+	mutex_init(m);
+	return mutex;
+}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+#else
+void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
+{
+	mutex_destroy((struct mutex *)mutex);
+	DWC_FREE(mutex);
+}
+#endif
+
+void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
+{
+	struct mutex *m = (struct mutex *)mutex;
+	mutex_lock(m);
+}
+
+int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
+{
+	struct mutex *m = (struct mutex *)mutex;
+	return mutex_trylock(m);
+}
+
+void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
+{
+	struct mutex *m = (struct mutex *)mutex;
+	mutex_unlock(m);
+}
+
+
+/* Timing */
+
+void DWC_UDELAY(uint32_t usecs)
+{
+	udelay(usecs);
+}
+
+void DWC_MDELAY(uint32_t msecs)
+{
+	mdelay(msecs);
+}
+
+void DWC_MSLEEP(uint32_t msecs)
+{
+	msleep(msecs);
+}
+
+uint32_t DWC_TIME(void)
+{
+	return jiffies_to_msecs(jiffies);
+}
+
+
+/* Timers */
+
+struct dwc_timer {
+	struct timer_list t;
+	char *name;
+	dwc_timer_callback_t cb;
+	void *data;
+	uint8_t scheduled;
+	dwc_spinlock_t *lock;
+};
+
+static void timer_callback(struct timer_list *tt)
+{
+	dwc_timer_t *timer = from_timer(timer, tt, t);
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
+	timer->scheduled = 0;
+	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
+	DWC_DEBUGC("Timer %s callback", timer->name);
+	timer->cb(timer->data);
+}
+
+dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
+{
+	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (!t) {
+		DWC_ERROR("Cannot allocate memory for timer");
+		return NULL;
+	}
+
+	t->name = DWC_STRDUP(name);
+	if (!t->name) {
+		DWC_ERROR("Cannot allocate memory for timer->name");
+		goto no_name;
+	}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(t->lock);
+#else
+	t->lock = DWC_SPINLOCK_ALLOC();
+#endif
+	if (!t->lock) {
+		DWC_ERROR("Cannot allocate memory for lock");
+		goto no_lock;
+	}
+
+	t->scheduled = 0;
+	t->t.expires = jiffies;
+	timer_setup(&t->t, timer_callback, 0);
+
+	t->cb = cb;
+	t->data = data;
+
+	return t;
+
+ no_lock:
+	DWC_FREE(t->name);
+ no_name:
+	DWC_FREE(t);
+	return NULL;
+}
+
+void DWC_TIMER_FREE(dwc_timer_t *timer)
+{
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
+
+	if (timer->scheduled) {
+		del_timer(&timer->t);
+		timer->scheduled = 0;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
+	DWC_SPINLOCK_FREE(timer->lock);
+	DWC_FREE(timer->name);
+	DWC_FREE(timer);
+}
+
+void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
+{
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
+
+	if (!timer->scheduled) {
+		timer->scheduled = 1;
+		DWC_DEBUGC("Scheduling timer %s to expire in +%d msec", timer->name, time);
+		timer->t.expires = jiffies + msecs_to_jiffies(time);
+		add_timer(&timer->t);
+	} else {
+		DWC_DEBUGC("Modifying timer %s to expire in +%d msec", timer->name, time);
+		mod_timer(&timer->t, jiffies + msecs_to_jiffies(time));
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
+}
+
+void DWC_TIMER_CANCEL(dwc_timer_t *timer)
+{
+	del_timer(&timer->t);
+}
+
+
+/* Wait Queues */
+
+struct dwc_waitq {
+	wait_queue_head_t queue;
+	int abort;
+};
+
+dwc_waitq_t *DWC_WAITQ_ALLOC(void)
+{
+	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue\n");
+		return NULL;
+	}
+
+	init_waitqueue_head(&wq->queue);
+	wq->abort = 0;
+	return wq;
+}
+
+void DWC_WAITQ_FREE(dwc_waitq_t *wq)
+{
+	DWC_FREE(wq);
+}
+
+int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
+{
+	int result = wait_event_interruptible(wq->queue,
+					      cond(data) || wq->abort);
+	if (result == -ERESTARTSYS) {
+		wq->abort = 0;
+		return -DWC_E_RESTART;
+	}
+
+	if (wq->abort == 1) {
+		wq->abort = 0;
+		return -DWC_E_ABORT;
+	}
+
+	wq->abort = 0;
+
+	if (result == 0) {
+		return 0;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+			       void *data, int32_t msecs)
+{
+	int32_t tmsecs;
+	int result = wait_event_interruptible_timeout(wq->queue,
+						      cond(data) || wq->abort,
+						      msecs_to_jiffies(msecs));
+	if (result == -ERESTARTSYS) {
+		wq->abort = 0;
+		return -DWC_E_RESTART;
+	}
+
+	if (wq->abort == 1) {
+		wq->abort = 0;
+		return -DWC_E_ABORT;
+	}
+
+	wq->abort = 0;
+
+	if (result > 0) {
+		tmsecs = jiffies_to_msecs(result);
+		if (!tmsecs) {
+			return 1;
+		}
+
+		return tmsecs;
+	}
+
+	if (result == 0) {
+		return -DWC_E_TIMEOUT;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
+{
+	wq->abort = 0;
+	wake_up_interruptible(&wq->queue);
+}
+
+void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
+{
+	wq->abort = 1;
+	wake_up_interruptible(&wq->queue);
+}
+
+
+/* Threading */
+
+dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
+{
+	struct task_struct *thread = kthread_run(func, data, name);
+
+	if (thread == ERR_PTR(-ENOMEM)) {
+		return NULL;
+	}
+
+	return (dwc_thread_t *)thread;
+}
+
+int DWC_THREAD_STOP(dwc_thread_t *thread)
+{
+	return kthread_stop((struct task_struct *)thread);
+}
+
+dwc_bool_t DWC_THREAD_SHOULD_STOP(void)
+{
+	return kthread_should_stop();
+}
+
+
+/* tasklets
+ - run in interrupt context (cannot sleep)
+ - each tasklet runs on a single CPU
+ - different tasklets can be running simultaneously on different CPUs
+ */
+struct dwc_tasklet {
+	struct tasklet_struct t;
+	dwc_tasklet_callback_t cb;
+	void *data;
+};
+
+static void tasklet_callback(unsigned long data)
+{
+	dwc_tasklet_t *t = (dwc_tasklet_t *)data;
+	t->cb(t->data);
+}
+
+dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
+{
+	dwc_tasklet_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (t) {
+		t->cb = cb;
+		t->data = data;
+		tasklet_init(&t->t, tasklet_callback, (unsigned long)t);
+	} else {
+		DWC_ERROR("Cannot allocate memory for tasklet\n");
+	}
+
+	return t;
+}
+
+void DWC_TASK_FREE(dwc_tasklet_t *task)
+{
+	DWC_FREE(task);
+}
+
+void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
+{
+	tasklet_schedule(&task->t);
+}
+
+void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task)
+{
+	tasklet_hi_schedule(&task->t);
+}
+
+
+/* workqueues
+ - run in process context (can sleep)
+ */
+typedef struct work_container {
+	dwc_work_callback_t cb;
+	void *data;
+	dwc_workq_t *wq;
+	char *name;
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_ENTRY(work_container) entry;
+#endif
+	struct delayed_work work;
+} work_container_t;
+
+#ifdef DEBUG
+DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
+#endif
+
+struct dwc_workq {
+	struct workqueue_struct *wq;
+	dwc_spinlock_t *lock;
+	dwc_waitq_t *waitq;
+	int pending;
+
+#ifdef DEBUG
+	struct work_container_queue entries;
+#endif
+};
+
+static void do_work(struct work_struct *work)
+{
+	dwc_irqflags_t flags;
+	struct delayed_work *dw = container_of(work, struct delayed_work, work);
+	work_container_t *container = container_of(dw, struct work_container, work);
+	dwc_workq_t *wq = container->wq;
+
+	container->cb(container->data);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
+#endif
+	DWC_DEBUGC("Work done: %s, container=%p", container->name, container);
+	if (container->name) {
+		DWC_FREE(container->name);
+	}
+	DWC_FREE(container);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending--;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+}
+
+static int work_done(void *data)
+{
+	dwc_workq_t *workq = (dwc_workq_t *)data;
+	return workq->pending == 0;
+}
+
+int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
+{
+	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
+}
+
+dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
+{
+	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		return NULL;
+	}
+
+	wq->wq = create_singlethread_workqueue(name);
+	if (!wq->wq) {
+		goto no_wq;
+	}
+
+	wq->pending = 0;
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(wq->lock);
+#else
+	wq->lock = DWC_SPINLOCK_ALLOC();
+#endif
+	if (!wq->lock) {
+		goto no_lock;
+	}
+
+	wq->waitq = DWC_WAITQ_ALLOC();
+	if (!wq->waitq) {
+		goto no_waitq;
+	}
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INIT(&wq->entries);
+#endif
+	return wq;
+
+ no_waitq:
+	DWC_SPINLOCK_FREE(wq->lock);
+ no_lock:
+	destroy_workqueue(wq->wq);
+ no_wq:
+	DWC_FREE(wq);
+
+	return NULL;
+}
+
+void DWC_WORKQ_FREE(dwc_workq_t *wq)
+{
+#ifdef DEBUG
+	if (wq->pending != 0) {
+		struct work_container *wc;
+		DWC_ERROR("Destroying work queue with pending work");
+		DWC_CIRCLEQ_FOREACH(wc, &wq->entries, entry) {
+			DWC_ERROR("Work %s still pending", wc->name);
+		}
+	}
+#endif
+	destroy_workqueue(wq->wq);
+	DWC_SPINLOCK_FREE(wq->lock);
+	DWC_WAITQ_FREE(wq->waitq);
+	DWC_FREE(wq);
+}
+
+void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
+			char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container\n");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name\n");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
+	INIT_WORK(&container->work.work, do_work);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	queue_work(wq->wq, &container->work.work);
+}
+
+void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
+				void *data, uint32_t time, char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container\n");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name\n");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
+	INIT_DELAYED_WORK(&container->work, do_work);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	queue_delayed_work(wq->wq, &container->work, msecs_to_jiffies(time));
+}
+
+int DWC_WORKQ_PENDING(dwc_workq_t *wq)
+{
+	return wq->pending;
+}
+
+
+#ifdef DWC_LIBMODULE
+
+#ifdef DWC_CCLIB
+/* CC */
+EXPORT_SYMBOL(dwc_cc_if_alloc);
+EXPORT_SYMBOL(dwc_cc_if_free);
+EXPORT_SYMBOL(dwc_cc_clear);
+EXPORT_SYMBOL(dwc_cc_add);
+EXPORT_SYMBOL(dwc_cc_remove);
+EXPORT_SYMBOL(dwc_cc_change);
+EXPORT_SYMBOL(dwc_cc_data_for_save);
+EXPORT_SYMBOL(dwc_cc_restore_from_data);
+EXPORT_SYMBOL(dwc_cc_match_chid);
+EXPORT_SYMBOL(dwc_cc_match_cdid);
+EXPORT_SYMBOL(dwc_cc_ck);
+EXPORT_SYMBOL(dwc_cc_chid);
+EXPORT_SYMBOL(dwc_cc_cdid);
+EXPORT_SYMBOL(dwc_cc_name);
+#endif	/* DWC_CCLIB */
+
+#ifdef DWC_CRYPTOLIB
+# ifndef CONFIG_MACH_IPMATE
+/* Modpow */
+EXPORT_SYMBOL(dwc_modpow);
+
+/* DH */
+EXPORT_SYMBOL(dwc_dh_modpow);
+EXPORT_SYMBOL(dwc_dh_derive_keys);
+EXPORT_SYMBOL(dwc_dh_pk);
+# endif	/* CONFIG_MACH_IPMATE */
+
+/* Crypto */
+EXPORT_SYMBOL(dwc_wusb_aes_encrypt);
+EXPORT_SYMBOL(dwc_wusb_cmf);
+EXPORT_SYMBOL(dwc_wusb_prf);
+EXPORT_SYMBOL(dwc_wusb_fill_ccm_nonce);
+EXPORT_SYMBOL(dwc_wusb_gen_nonce);
+EXPORT_SYMBOL(dwc_wusb_gen_key);
+EXPORT_SYMBOL(dwc_wusb_gen_mic);
+#endif	/* DWC_CRYPTOLIB */
+
+/* Notification */
+#ifdef DWC_NOTIFYLIB
+EXPORT_SYMBOL(dwc_alloc_notification_manager);
+EXPORT_SYMBOL(dwc_free_notification_manager);
+EXPORT_SYMBOL(dwc_register_notifier);
+EXPORT_SYMBOL(dwc_unregister_notifier);
+EXPORT_SYMBOL(dwc_add_observer);
+EXPORT_SYMBOL(dwc_remove_observer);
+EXPORT_SYMBOL(dwc_notify);
+#endif
+
+/* Memory Debugging Routines */
+#ifdef DWC_DEBUG_MEMORY
+EXPORT_SYMBOL(dwc_alloc_debug);
+EXPORT_SYMBOL(dwc_alloc_atomic_debug);
+EXPORT_SYMBOL(dwc_free_debug);
+EXPORT_SYMBOL(dwc_dma_alloc_debug);
+EXPORT_SYMBOL(dwc_dma_free_debug);
+#endif
+
+EXPORT_SYMBOL(DWC_MEMSET);
+EXPORT_SYMBOL(DWC_MEMCPY);
+EXPORT_SYMBOL(DWC_MEMMOVE);
+EXPORT_SYMBOL(DWC_MEMCMP);
+EXPORT_SYMBOL(DWC_STRNCMP);
+EXPORT_SYMBOL(DWC_STRCMP);
+EXPORT_SYMBOL(DWC_STRLEN);
+EXPORT_SYMBOL(DWC_STRCPY);
+EXPORT_SYMBOL(DWC_STRDUP);
+EXPORT_SYMBOL(DWC_ATOI);
+EXPORT_SYMBOL(DWC_ATOUI);
+
+#ifdef DWC_UTFLIB
+EXPORT_SYMBOL(DWC_UTF8_TO_UTF16LE);
+#endif	/* DWC_UTFLIB */
+
+EXPORT_SYMBOL(DWC_IN_IRQ);
+EXPORT_SYMBOL(DWC_IN_BH);
+EXPORT_SYMBOL(DWC_VPRINTF);
+EXPORT_SYMBOL(DWC_VSNPRINTF);
+EXPORT_SYMBOL(DWC_PRINTF);
+EXPORT_SYMBOL(DWC_SPRINTF);
+EXPORT_SYMBOL(DWC_SNPRINTF);
+EXPORT_SYMBOL(__DWC_WARN);
+EXPORT_SYMBOL(__DWC_ERROR);
+EXPORT_SYMBOL(DWC_EXCEPTION);
+
+#ifdef DEBUG
+EXPORT_SYMBOL(__DWC_DEBUG);
+#endif
+
+EXPORT_SYMBOL(__DWC_DMA_ALLOC);
+EXPORT_SYMBOL(__DWC_DMA_ALLOC_ATOMIC);
+EXPORT_SYMBOL(__DWC_DMA_FREE);
+EXPORT_SYMBOL(__DWC_ALLOC);
+EXPORT_SYMBOL(__DWC_ALLOC_ATOMIC);
+EXPORT_SYMBOL(__DWC_FREE);
+
+#ifdef DWC_CRYPTOLIB
+EXPORT_SYMBOL(DWC_RANDOM_BYTES);
+EXPORT_SYMBOL(DWC_AES_CBC);
+EXPORT_SYMBOL(DWC_SHA256);
+EXPORT_SYMBOL(DWC_HMAC_SHA256);
+#endif
+
+EXPORT_SYMBOL(DWC_CPU_TO_LE32);
+EXPORT_SYMBOL(DWC_CPU_TO_BE32);
+EXPORT_SYMBOL(DWC_LE32_TO_CPU);
+EXPORT_SYMBOL(DWC_BE32_TO_CPU);
+EXPORT_SYMBOL(DWC_CPU_TO_LE16);
+EXPORT_SYMBOL(DWC_CPU_TO_BE16);
+EXPORT_SYMBOL(DWC_LE16_TO_CPU);
+EXPORT_SYMBOL(DWC_BE16_TO_CPU);
+EXPORT_SYMBOL(DWC_READ_REG32);
+EXPORT_SYMBOL(DWC_WRITE_REG32);
+EXPORT_SYMBOL(DWC_MODIFY_REG32);
+
+#if 0
+EXPORT_SYMBOL(DWC_READ_REG64);
+EXPORT_SYMBOL(DWC_WRITE_REG64);
+EXPORT_SYMBOL(DWC_MODIFY_REG64);
+#endif
+
+EXPORT_SYMBOL(DWC_SPINLOCK_ALLOC);
+EXPORT_SYMBOL(DWC_SPINLOCK_FREE);
+EXPORT_SYMBOL(DWC_SPINLOCK);
+EXPORT_SYMBOL(DWC_SPINUNLOCK);
+EXPORT_SYMBOL(DWC_SPINLOCK_IRQSAVE);
+EXPORT_SYMBOL(DWC_SPINUNLOCK_IRQRESTORE);
+EXPORT_SYMBOL(DWC_MUTEX_ALLOC);
+
+#if (!defined(DWC_LINUX) || !defined(CONFIG_DEBUG_MUTEXES))
+EXPORT_SYMBOL(DWC_MUTEX_FREE);
+#endif
+
+EXPORT_SYMBOL(DWC_MUTEX_LOCK);
+EXPORT_SYMBOL(DWC_MUTEX_TRYLOCK);
+EXPORT_SYMBOL(DWC_MUTEX_UNLOCK);
+EXPORT_SYMBOL(DWC_UDELAY);
+EXPORT_SYMBOL(DWC_MDELAY);
+EXPORT_SYMBOL(DWC_MSLEEP);
+EXPORT_SYMBOL(DWC_TIME);
+EXPORT_SYMBOL(DWC_TIMER_ALLOC);
+EXPORT_SYMBOL(DWC_TIMER_FREE);
+EXPORT_SYMBOL(DWC_TIMER_SCHEDULE);
+EXPORT_SYMBOL(DWC_TIMER_CANCEL);
+EXPORT_SYMBOL(DWC_WAITQ_ALLOC);
+EXPORT_SYMBOL(DWC_WAITQ_FREE);
+EXPORT_SYMBOL(DWC_WAITQ_WAIT);
+EXPORT_SYMBOL(DWC_WAITQ_WAIT_TIMEOUT);
+EXPORT_SYMBOL(DWC_WAITQ_TRIGGER);
+EXPORT_SYMBOL(DWC_WAITQ_ABORT);
+EXPORT_SYMBOL(DWC_THREAD_RUN);
+EXPORT_SYMBOL(DWC_THREAD_STOP);
+EXPORT_SYMBOL(DWC_THREAD_SHOULD_STOP);
+EXPORT_SYMBOL(DWC_TASK_ALLOC);
+EXPORT_SYMBOL(DWC_TASK_FREE);
+EXPORT_SYMBOL(DWC_TASK_SCHEDULE);
+EXPORT_SYMBOL(DWC_WORKQ_WAIT_WORK_DONE);
+EXPORT_SYMBOL(DWC_WORKQ_ALLOC);
+EXPORT_SYMBOL(DWC_WORKQ_FREE);
+EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE);
+EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE_DELAYED);
+EXPORT_SYMBOL(DWC_WORKQ_PENDING);
+
+static int dwc_common_port_init_module(void)
+{
+	int result = 0;
+
+	printk(KERN_DEBUG "Module dwc_common_port init\n" );
+
+#ifdef DWC_DEBUG_MEMORY
+	result = dwc_memory_debug_start(NULL);
+	if (result) {
+		printk(KERN_ERR
+		       "dwc_memory_debug_start() failed with error %d\n",
+		       result);
+		return result;
+	}
+#endif
+
+#ifdef DWC_NOTIFYLIB
+	result = dwc_alloc_notification_manager(NULL, NULL);
+	if (result) {
+		printk(KERN_ERR
+		       "dwc_alloc_notification_manager() failed with error %d\n",
+		       result);
+		return result;
+	}
+#endif
+	return result;
+}
+
+static void dwc_common_port_exit_module(void)
+{
+	printk(KERN_DEBUG "Module dwc_common_port exit\n" );
+
+#ifdef DWC_NOTIFYLIB
+	dwc_free_notification_manager();
+#endif
+
+#ifdef DWC_DEBUG_MEMORY
+	dwc_memory_debug_stop();
+#endif
+}
+
+module_init(dwc_common_port_init_module);
+module_exit(dwc_common_port_exit_module);
+
+MODULE_DESCRIPTION("DWC Common Library - Portable version");
+MODULE_AUTHOR("Synopsys Inc.");
+MODULE_LICENSE ("GPL");
+
+#endif	/* DWC_LIBMODULE */
diff --git a/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c b/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
new file mode 100644
index 0000000000000..49b07e1722645
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
@@ -0,0 +1,1275 @@
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+#ifdef DWC_CCLIB
+# include "dwc_cc.h"
+#endif
+
+#ifdef DWC_CRYPTOLIB
+# include "dwc_modpow.h"
+# include "dwc_dh.h"
+# include "dwc_crypto.h"
+#endif
+
+#ifdef DWC_NOTIFYLIB
+# include "dwc_notifier.h"
+#endif
+
+/* OS-Level Implementations */
+
+/* This is the NetBSD 4.0.1 kernel implementation of the DWC platform library. */
+
+
+/* MISC */
+
+void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
+{
+	return memset(dest, byte, size);
+}
+
+void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
+{
+	return memcpy(dest, src, size);
+}
+
+void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
+{
+	bcopy(src, dest, size);
+	return dest;
+}
+
+int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
+{
+	return memcmp(m1, m2, size);
+}
+
+int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
+{
+	return strncmp(s1, s2, size);
+}
+
+int DWC_STRCMP(void *s1, void *s2)
+{
+	return strcmp(s1, s2);
+}
+
+int DWC_STRLEN(char const *str)
+{
+	return strlen(str);
+}
+
+char *DWC_STRCPY(char *to, char const *from)
+{
+	return strcpy(to, from);
+}
+
+char *DWC_STRDUP(char const *str)
+{
+	int len = DWC_STRLEN(str) + 1;
+	char *new = DWC_ALLOC_ATOMIC(len);
+
+	if (!new) {
+		return NULL;
+	}
+
+	DWC_MEMCPY(new, str, len);
+	return new;
+}
+
+int DWC_ATOI(char *str, int32_t *value)
+{
+	char *end = NULL;
+
+	/* NetBSD doesn't have 'strtol' in the kernel, but 'strtoul'
+	 * should be equivalent on 2's complement machines
+	 */
+	*value = strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+int DWC_ATOUI(char *str, uint32_t *value)
+{
+	char *end = NULL;
+
+	*value = strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+
+#ifdef DWC_UTFLIB
+/* From usbstring.c */
+
+int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+
+#endif	/* DWC_UTFLIB */
+
+
+/* dwc_debug.h */
+
+dwc_bool_t DWC_IN_IRQ(void)
+{
+//	return in_irq();
+	return 0;
+}
+
+dwc_bool_t DWC_IN_BH(void)
+{
+//	return in_softirq();
+	return 0;
+}
+
+void DWC_VPRINTF(char *format, va_list args)
+{
+	vprintf(format, args);
+}
+
+int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
+{
+	return vsnprintf(str, size, format, args);
+}
+
+void DWC_PRINTF(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+int DWC_SPRINTF(char *buffer, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsprintf(buffer, format, args);
+	va_end(args);
+	return retval;
+}
+
+int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsnprintf(buffer, size, format, args);
+	va_end(args);
+	return retval;
+}
+
+void __DWC_WARN(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void __DWC_ERROR(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void DWC_EXCEPTION(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+//	BUG_ON(1);	???
+}
+
+#ifdef DEBUG
+void __DWC_DEBUG(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+#endif
+
+
+/* dwc_mem.h */
+
+#if 0
+dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
+				uint32_t align,
+				uint32_t alloc)
+{
+	struct dma_pool *pool = dma_pool_create("Pool", NULL,
+						size, align, alloc);
+	return (dwc_pool_t *)pool;
+}
+
+void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
+{
+	dma_pool_destroy((struct dma_pool *)pool);
+}
+
+void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
+	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
+}
+
+void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
+	memset(..);
+}
+
+void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
+{
+	dma_pool_free(pool, vaddr, daddr);
+}
+#endif
+
+void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+	int error;
+
+	error = bus_dmamem_alloc(dma->dma_tag, size, 1, size, dma->segs,
+				 sizeof(dma->segs) / sizeof(dma->segs[0]),
+				 &dma->nsegs, BUS_DMA_NOWAIT);
+	if (error) {
+		printf("%s: bus_dmamem_alloc(%ju) failed: %d\n", __func__,
+		       (uintmax_t)size, error);
+		goto fail_0;
+	}
+
+	error = bus_dmamem_map(dma->dma_tag, dma->segs, dma->nsegs, size,
+			       (caddr_t *)&dma->dma_vaddr,
+			       BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
+	if (error) {
+		printf("%s: bus_dmamem_map failed: %d\n", __func__, error);
+		goto fail_1;
+	}
+
+	error = bus_dmamap_create(dma->dma_tag, size, 1, size, 0,
+				  BUS_DMA_NOWAIT, &dma->dma_map);
+	if (error) {
+		printf("%s: bus_dmamap_create failed: %d\n", __func__, error);
+		goto fail_2;
+	}
+
+	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr,
+				size, NULL, BUS_DMA_NOWAIT);
+	if (error) {
+		printf("%s: bus_dmamap_load failed: %d\n", __func__, error);
+		goto fail_3;
+	}
+
+	dma->dma_paddr = (bus_addr_t)dma->segs[0].ds_addr;
+	*dma_addr = dma->dma_paddr;
+	return dma->dma_vaddr;
+
+fail_3:
+	bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
+fail_2:
+	bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
+fail_1:
+	bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
+fail_0:
+	dma->dma_map = NULL;
+	dma->dma_vaddr = NULL;
+	dma->nsegs = 0;
+
+	return NULL;
+}
+
+void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+
+	if (dma->dma_map != NULL) {
+		bus_dmamap_sync(dma->dma_tag, dma->dma_map, 0, size,
+				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
+		bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
+		bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
+		bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
+		dma->dma_paddr = 0;
+		dma->dma_map = NULL;
+		dma->dma_vaddr = NULL;
+		dma->nsegs = 0;
+	}
+}
+
+void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
+}
+
+void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
+}
+
+void __DWC_FREE(void *mem_ctx, void *addr)
+{
+	free(addr, M_DEVBUF);
+}
+
+
+#ifdef DWC_CRYPTOLIB
+/* dwc_crypto.h */
+
+void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
+{
+	get_random_bytes(buffer, length);
+}
+
+int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
+{
+	struct crypto_blkcipher *tfm;
+	struct blkcipher_desc desc;
+	struct scatterlist sgd;
+	struct scatterlist sgs;
+
+	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	if (tfm == NULL) {
+		printk("failed to load transform for aes CBC\n");
+		return -1;
+	}
+
+	crypto_blkcipher_setkey(tfm, key, keylen);
+	crypto_blkcipher_set_iv(tfm, iv, 16);
+
+	sg_init_one(&sgd, out, messagelen);
+	sg_init_one(&sgs, message, messagelen);
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
+		crypto_free_blkcipher(tfm);
+		DWC_ERROR("AES CBC encryption failed");
+		return -1;
+	}
+
+	crypto_free_blkcipher(tfm);
+	return 0;
+}
+
+int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, len);
+	crypto_hash_digest(&desc, &sg, len, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
+		    uint8_t *key, uint32_t keylen, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, messagelen);
+	crypto_hash_setkey(tfm, key, keylen);
+	crypto_hash_digest(&desc, &sg, messagelen, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+#endif	/* DWC_CRYPTOLIB */
+
+
+/* Byte Ordering Conversions */
+
+uint32_t DWC_CPU_TO_LE32(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_CPU_TO_BE32(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_LE32_TO_CPU(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_BE32_TO_CPU(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint16_t DWC_CPU_TO_LE16(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_CPU_TO_BE16(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_LE16_TO_CPU(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_BE16_TO_CPU(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+
+/* Registers */
+
+uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_4(io->iot, io->ioh, ior);
+}
+
+#if 0
+uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_8(io->iot, io->ioh, ior);
+}
+#endif
+
+void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior, value);
+}
+
+#if 0
+void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior, value);
+}
+#endif
+
+void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
+		      uint32_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior,
+			  (bus_space_read_4(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+
+#if 0
+void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
+		      uint64_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior,
+			  (bus_space_read_8(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+#endif
+
+
+/* Locking */
+
+dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
+{
+	struct simplelock *sl = DWC_ALLOC(sizeof(*sl));
+
+	if (!sl) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		return NULL;
+	}
+
+	simple_lock_init(sl);
+	return (dwc_spinlock_t *)sl;
+}
+
+void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
+{
+	struct simplelock *sl = (struct simplelock *)lock;
+
+	DWC_FREE(sl);
+}
+
+void DWC_SPINLOCK(dwc_spinlock_t *lock)
+{
+	simple_lock((struct simplelock *)lock);
+}
+
+void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
+{
+	simple_unlock((struct simplelock *)lock);
+}
+
+void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
+{
+	simple_lock((struct simplelock *)lock);
+	*flags = splbio();
+}
+
+void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
+{
+	splx(flags);
+	simple_unlock((struct simplelock *)lock);
+}
+
+dwc_mutex_t *DWC_MUTEX_ALLOC(void)
+{
+	dwc_mutex_t *mutex = DWC_ALLOC(sizeof(struct lock));
+
+	if (!mutex) {
+		DWC_ERROR("Cannot allocate memory for mutex");
+		return NULL;
+	}
+
+	lockinit((struct lock *)mutex, 0, "dw3mtx", 0, 0);
+	return mutex;
+}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+#else
+void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
+{
+	DWC_FREE(mutex);
+}
+#endif
+
+void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
+{
+	lockmgr((struct lock *)mutex, LK_EXCLUSIVE, NULL);
+}
+
+int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
+{
+	int status;
+
+	status = lockmgr((struct lock *)mutex, LK_EXCLUSIVE | LK_NOWAIT, NULL);
+	return status == 0;
+}
+
+void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
+{
+	lockmgr((struct lock *)mutex, LK_RELEASE, NULL);
+}
+
+
+/* Timing */
+
+void DWC_UDELAY(uint32_t usecs)
+{
+	DELAY(usecs);
+}
+
+void DWC_MDELAY(uint32_t msecs)
+{
+	do {
+		DELAY(1000);
+	} while (--msecs);
+}
+
+void DWC_MSLEEP(uint32_t msecs)
+{
+	struct timeval tv;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+	tsleep(&tv, 0, "dw3slp", tvtohz(&tv));
+}
+
+uint32_t DWC_TIME(void)
+{
+	struct timeval tv;
+
+	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
+	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
+}
+
+
+/* Timers */
+
+struct dwc_timer {
+	struct callout t;
+	char *name;
+	dwc_spinlock_t *lock;
+	dwc_timer_callback_t cb;
+	void *data;
+};
+
+dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
+{
+	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (!t) {
+		DWC_ERROR("Cannot allocate memory for timer");
+		return NULL;
+	}
+
+	callout_init(&t->t);
+
+	t->name = DWC_STRDUP(name);
+	if (!t->name) {
+		DWC_ERROR("Cannot allocate memory for timer->name");
+		goto no_name;
+	}
+
+	t->lock = DWC_SPINLOCK_ALLOC();
+	if (!t->lock) {
+		DWC_ERROR("Cannot allocate memory for timer->lock");
+		goto no_lock;
+	}
+
+	t->cb = cb;
+	t->data = data;
+
+	return t;
+
+ no_lock:
+	DWC_FREE(t->name);
+ no_name:
+	DWC_FREE(t);
+
+	return NULL;
+}
+
+void DWC_TIMER_FREE(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+	DWC_SPINLOCK_FREE(timer->lock);
+	DWC_FREE(timer->name);
+	DWC_FREE(timer);
+}
+
+void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
+{
+	struct timeval tv;
+
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
+}
+
+void DWC_TIMER_CANCEL(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+}
+
+
+/* Wait Queues */
+
+struct dwc_waitq {
+	struct simplelock lock;
+	int abort;
+};
+
+dwc_waitq_t *DWC_WAITQ_ALLOC(void)
+{
+	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		return NULL;
+	}
+
+	simple_lock_init(&wq->lock);
+	wq->abort = 0;
+
+	return wq;
+}
+
+void DWC_WAITQ_FREE(dwc_waitq_t *wq)
+{
+	DWC_FREE(wq);
+}
+
+int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
+{
+	int ipl;
+	int result = 0;
+
+	simple_lock(&wq->lock);
+	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+		splx(ipl);
+		result = ltsleep(wq, PCATCH, "dw3wat", 0, &wq->lock); // infinite timeout
+		ipl = splbio();
+	}
+
+	if (result == 0) {			// awoken
+		if (wq->abort) {
+			wq->abort = 0;
+			result = -DWC_E_ABORT;
+		} else {
+			result = 0;
+		}
+
+		splx(ipl);
+		simple_unlock(&wq->lock);
+	} else {
+		wq->abort = 0;
+		splx(ipl);
+		simple_unlock(&wq->lock);
+
+		if (result == ERESTART) {	// signaled - restart
+			result = -DWC_E_RESTART;
+		} else {			// signaled - must be EINTR
+			result = -DWC_E_ABORT;
+		}
+	}
+
+	return result;
+}
+
+int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+			       void *data, int32_t msecs)
+{
+	struct timeval tv, tv1, tv2;
+	int ipl;
+	int result = 0;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+
+	simple_lock(&wq->lock);
+	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+		splx(ipl);
+		getmicrouptime(&tv1);
+		result = ltsleep(wq, PCATCH, "dw3wto", tvtohz(&tv), &wq->lock);
+		getmicrouptime(&tv2);
+		ipl = splbio();
+	}
+
+	if (result == 0) {			// awoken
+		if (wq->abort) {
+			wq->abort = 0;
+			splx(ipl);
+			simple_unlock(&wq->lock);
+			result = -DWC_E_ABORT;
+		} else {
+			splx(ipl);
+			simple_unlock(&wq->lock);
+
+			tv2.tv_usec -= tv1.tv_usec;
+			if (tv2.tv_usec < 0) {
+				tv2.tv_usec += 1000000;
+				tv2.tv_sec--;
+			}
+
+			tv2.tv_sec -= tv1.tv_sec;
+			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
+			result = msecs - result;
+			if (result <= 0)
+				result = 1;
+		}
+	} else {
+		wq->abort = 0;
+		splx(ipl);
+		simple_unlock(&wq->lock);
+
+		if (result == ERESTART) {	// signaled - restart
+			result = -DWC_E_RESTART;
+
+		} else if (result == EINTR) {		// signaled - interrupt
+			result = -DWC_E_ABORT;
+
+		} else {				// timed out
+			result = -DWC_E_TIMEOUT;
+		}
+	}
+
+	return result;
+}
+
+void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
+{
+	wakeup(wq);
+}
+
+void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
+{
+	int ipl;
+
+	simple_lock(&wq->lock);
+	ipl = splbio();
+	wq->abort = 1;
+	wakeup(wq);
+	splx(ipl);
+	simple_unlock(&wq->lock);
+}
+
+
+/* Threading */
+
+struct dwc_thread {
+	struct proc *proc;
+	int abort;
+};
+
+dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
+{
+	int retval;
+	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
+
+	if (!thread) {
+		return NULL;
+	}
+
+	thread->abort = 0;
+	retval = kthread_create1((void (*)(void *))func, data, &thread->proc,
+				 "%s", name);
+	if (retval) {
+		DWC_FREE(thread);
+		return NULL;
+	}
+
+	return thread;
+}
+
+int DWC_THREAD_STOP(dwc_thread_t *thread)
+{
+	int retval;
+
+	thread->abort = 1;
+	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
+
+	if (retval == 0) {
+		/* DWC_THREAD_EXIT() will free the thread struct */
+		return 0;
+	}
+
+	/* NOTE: We leak the thread struct if thread doesn't die */
+
+	if (retval == EWOULDBLOCK) {
+		return -DWC_E_TIMEOUT;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
+{
+	return thread->abort;
+}
+
+void DWC_THREAD_EXIT(dwc_thread_t *thread)
+{
+	wakeup(&thread->abort);
+	DWC_FREE(thread);
+	kthread_exit(0);
+}
+
+/* tasklets
+ - Runs in interrupt context (cannot sleep)
+ - Each tasklet runs on a single CPU
+ - Different tasklets can be running simultaneously on different CPUs
+ [ On NetBSD there is no corresponding mechanism, drivers don't have bottom-
+   halves. So we just call the callback directly from DWC_TASK_SCHEDULE() ]
+ */
+struct dwc_tasklet {
+	dwc_tasklet_callback_t cb;
+	void *data;
+};
+
+static void tasklet_callback(void *data)
+{
+	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
+
+	task->cb(task->data);
+}
+
+dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
+{
+	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
+
+	if (task) {
+		task->cb = cb;
+		task->data = data;
+	} else {
+		DWC_ERROR("Cannot allocate memory for tasklet");
+	}
+
+	return task;
+}
+
+void DWC_TASK_FREE(dwc_tasklet_t *task)
+{
+	DWC_FREE(task);
+}
+
+void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
+{
+	tasklet_callback(task);
+}
+
+
+/* workqueues
+ - Runs in process context (can sleep)
+ */
+typedef struct work_container {
+	dwc_work_callback_t cb;
+	void *data;
+	dwc_workq_t *wq;
+	char *name;
+	int hz;
+	struct work task;
+} work_container_t;
+
+struct dwc_workq {
+	struct workqueue *taskq;
+	dwc_spinlock_t *lock;
+	dwc_waitq_t *waitq;
+	int pending;
+	struct work_container *container;
+};
+
+static void do_work(struct work *task, void *data)
+{
+	dwc_workq_t *wq = (dwc_workq_t *)data;
+	work_container_t *container = wq->container;
+	dwc_irqflags_t flags;
+
+	if (container->hz) {
+		tsleep(container, 0, "dw3wrk", container->hz);
+	}
+
+	container->cb(container->data);
+	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	if (container->name)
+		DWC_FREE(container->name);
+	DWC_FREE(container);
+	wq->pending--;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+}
+
+static int work_done(void *data)
+{
+	dwc_workq_t *workq = (dwc_workq_t *)data;
+
+	return workq->pending == 0;
+}
+
+int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
+{
+	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
+}
+
+dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
+{
+	int result;
+	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for workqueue");
+		return NULL;
+	}
+
+	result = workqueue_create(&wq->taskq, name, do_work, wq, 0 /*PWAIT*/,
+				  IPL_BIO, 0);
+	if (result) {
+		DWC_ERROR("Cannot create workqueue");
+		goto no_taskq;
+	}
+
+	wq->pending = 0;
+
+	wq->lock = DWC_SPINLOCK_ALLOC();
+	if (!wq->lock) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		goto no_lock;
+	}
+
+	wq->waitq = DWC_WAITQ_ALLOC();
+	if (!wq->waitq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		goto no_waitq;
+	}
+
+	return wq;
+
+ no_waitq:
+	DWC_SPINLOCK_FREE(wq->lock);
+ no_lock:
+	workqueue_destroy(wq->taskq);
+ no_taskq:
+	DWC_FREE(wq);
+
+	return NULL;
+}
+
+void DWC_WORKQ_FREE(dwc_workq_t *wq)
+{
+#ifdef DEBUG
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+
+	if (wq->pending != 0) {
+		struct work_container *container = wq->container;
+
+		DWC_ERROR("Destroying work queue with pending work");
+
+		if (container && container->name) {
+			DWC_ERROR("Work %s still pending", container->name);
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+#endif
+	DWC_WAITQ_FREE(wq->waitq);
+	DWC_SPINLOCK_FREE(wq->lock);
+	workqueue_destroy(wq->taskq);
+	DWC_FREE(wq);
+}
+
+void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
+			char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	container->hz = 0;
+	wq->container = container;
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+	workqueue_enqueue(wq->taskq, &container->task);
+}
+
+void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
+				void *data, uint32_t time, char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	struct timeval tv;
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	container->hz = tvtohz(&tv);
+	wq->container = container;
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+	workqueue_enqueue(wq->taskq, &container->task);
+}
+
+int DWC_WORKQ_PENDING(dwc_workq_t *wq)
+{
+	return wq->pending;
+}
diff --git a/drivers/usb/host/dwc_common_port/dwc_crypto.c b/drivers/usb/host/dwc_common_port/dwc_crypto.c
new file mode 100644
index 0000000000000..3b0353296148f
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_crypto.c
@@ -0,0 +1,308 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.c $
+ * $Revision: #5 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+
+/** @file
+ * This file contains the WUSB cryptographic routines.
+ */
+
+#ifdef DWC_CRYPTOLIB
+
+#include "dwc_crypto.h"
+#include "usb.h"
+
+#ifdef DEBUG
+static inline void dump_bytes(char *name, uint8_t *bytes, int len)
+{
+	int i;
+	DWC_PRINTF("%s: ", name);
+	for (i=0; i<len; i++) {
+		DWC_PRINTF("%02x ", bytes[i]);
+	}
+	DWC_PRINTF("\n");
+}
+#else
+#define dump_bytes(x...)
+#endif
+
+/* Display a block */
+void show_block(const u8 *blk, const char *prefix, const char *suffix, int a)
+{
+#ifdef DWC_DEBUG_CRYPTO
+	int i, blksize = 16;
+
+	DWC_DEBUG("%s", prefix);
+
+	if (suffix == NULL) {
+		suffix = "\n";
+		blksize = a;
+	}
+
+	for (i = 0; i < blksize; i++)
+		DWC_PRINT("%02x%s", *blk++, ((i & 3) == 3) ? "  " : " ");
+	DWC_PRINT(suffix);
+#endif
+}
+
+/**
+ * Encrypts an array of bytes using the AES encryption engine.
+ * If <code>dst</code> == <code>src</code>, then the bytes will be encrypted
+ * in-place.
+ *
+ * @return  0 on success, negative error code on error.
+ */
+int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst)
+{
+	u8 block_t[16];
+	DWC_MEMSET(block_t, 0, 16);
+
+	return DWC_AES_CBC(src, 16, key, 16, block_t, dst);
+}
+
+/**
+ * The CCM-MAC-FUNCTION described in section 6.5 of the WUSB spec.
+ * This function takes a data string and returns the encrypted CBC
+ * Counter-mode MIC.
+ *
+ * @param key     The 128-bit symmetric key.
+ * @param nonce   The CCM nonce.
+ * @param label   The unique 14-byte ASCII text label.
+ * @param bytes   The byte array to be encrypted.
+ * @param len     Length of the byte array.
+ * @param result  Byte array to receive the 8-byte encrypted MIC.
+ */
+void dwc_wusb_cmf(u8 *key, u8 *nonce,
+		  char *label, u8 *bytes, int len, u8 *result)
+{
+	u8 block_m[16];
+	u8 block_x[16];
+	u8 block_t[8];
+	int idx, blkNum;
+	u16 la = (u16)(len + 14);
+
+	/* Set the AES-128 key */
+	//dwc_aes_setkey(tfm, key, 16);
+
+	/* Fill block B0 from flags = 0x59, N, and l(m) = 0 */
+	block_m[0] = 0x59;
+	for (idx = 0; idx < 13; idx++)
+		block_m[idx + 1] = nonce[idx];
+	block_m[14] = 0;
+	block_m[15] = 0;
+
+	/* Produce the CBC IV */
+	dwc_wusb_aes_encrypt(block_m, key, block_x);
+	show_block(block_m, "CBC IV in: ", "\n", 0);
+	show_block(block_x, "CBC IV out:", "\n", 0);
+
+	/* Fill block B1 from l(a) = Blen + 14, and A */
+	block_x[0] ^= (u8)(la >> 8);
+	block_x[1] ^= (u8)la;
+	for (idx = 0; idx < 14; idx++)
+		block_x[idx + 2] ^= label[idx];
+	show_block(block_x, "After xor: ", "b1\n", 16);
+
+	dwc_wusb_aes_encrypt(block_x, key, block_x);
+	show_block(block_x, "After AES: ", "b1\n", 16);
+
+	idx = 0;
+	blkNum = 0;
+
+	/* Fill remaining blocks with B */
+	while (len-- > 0) {
+		block_x[idx] ^= *bytes++;
+		if (++idx >= 16) {
+			idx = 0;
+			show_block(block_x, "After xor: ", "\n", blkNum);
+			dwc_wusb_aes_encrypt(block_x, key, block_x);
+			show_block(block_x, "After AES: ", "\n", blkNum);
+			blkNum++;
+		}
+	}
+
+	/* Handle partial last block */
+	if (idx > 0) {
+		show_block(block_x, "After xor: ", "\n", blkNum);
+		dwc_wusb_aes_encrypt(block_x, key, block_x);
+		show_block(block_x, "After AES: ", "\n", blkNum);
+	}
+
+	/* Save the MIC tag */
+	DWC_MEMCPY(block_t, block_x, 8);
+	show_block(block_t, "MIC tag  : ", NULL, 8);
+
+	/* Fill block A0 from flags = 0x01, N, and counter = 0 */
+	block_m[0] = 0x01;
+	block_m[14] = 0;
+	block_m[15] = 0;
+
+	/* Encrypt the counter */
+	dwc_wusb_aes_encrypt(block_m, key, block_x);
+	show_block(block_x, "CTR[MIC] : ", NULL, 8);
+
+	/* XOR with MIC tag */
+	for (idx = 0; idx < 8; idx++) {
+		block_t[idx] ^= block_x[idx];
+	}
+
+	/* Return result to caller */
+	DWC_MEMCPY(result, block_t, 8);
+	show_block(result, "CCM-MIC  : ", NULL, 8);
+
+}
+
+/**
+ * The PRF function described in section 6.5 of the WUSB spec. This function
+ * concatenates MIC values returned from dwc_cmf() to create a value of
+ * the requested length.
+ *
+ * @param prf_len  Length of the PRF function in bits (64, 128, or 256).
+ * @param key, nonce, label, bytes, len  Same as for dwc_cmf().
+ * @param result   Byte array to receive the result.
+ */
+void dwc_wusb_prf(int prf_len, u8 *key,
+		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result)
+{
+	int i;
+
+	nonce[0] = 0;
+	for (i = 0; i < prf_len >> 6; i++, nonce[0]++) {
+		dwc_wusb_cmf(key, nonce, label, bytes, len, result);
+		result += 8;
+	}
+}
+
+/**
+ * Fills in CCM Nonce per the WUSB spec.
+ *
+ * @param[in] haddr Host address.
+ * @param[in] daddr Device address.
+ * @param[in] tkid Session Key(PTK) identifier.
+ * @param[out] nonce Pointer to where the CCM Nonce output is to be written.
+ */
+void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
+			     uint8_t *nonce)
+{
+
+	DWC_DEBUG("%s %x %x\n", __func__, daddr, haddr);
+
+	DWC_MEMSET(&nonce[0], 0, 16);
+
+	DWC_MEMCPY(&nonce[6], tkid, 3);
+	nonce[9] = daddr & 0xFF;
+	nonce[10] = (daddr >> 8) & 0xFF;
+	nonce[11] = haddr & 0xFF;
+	nonce[12] = (haddr >> 8) & 0xFF;
+
+	dump_bytes("CCM nonce", nonce, 16);
+}
+
+/**
+ * Generates a 16-byte cryptographic-grade random number for the Host/Device
+ * Nonce.
+ */
+void dwc_wusb_gen_nonce(uint16_t addr, uint8_t *nonce)
+{
+	uint8_t inonce[16];
+	uint32_t temp[4];
+
+	/* Fill in the Nonce */
+	DWC_MEMSET(&inonce[0], 0, sizeof(inonce));
+	inonce[9] = addr & 0xFF;
+	inonce[10] = (addr >> 8) & 0xFF;
+	inonce[11] = inonce[9];
+	inonce[12] = inonce[10];
+
+	/* Collect "randomness samples" */
+	DWC_RANDOM_BYTES((uint8_t *)temp, 16);
+
+	dwc_wusb_prf_128((uint8_t *)temp, nonce,
+			 "Random Numbers", (uint8_t *)temp, sizeof(temp),
+			 nonce);
+}
+
+/**
+ * Generates the Session Key (PTK) and Key Confirmation Key (KCK) per the
+ * WUSB spec.
+ *
+ * @param[in] ccm_nonce Pointer to CCM Nonce.
+ * @param[in] mk Master Key to derive the session from
+ * @param[in] hnonce Pointer to Host Nonce.
+ * @param[in] dnonce Pointer to Device Nonce.
+ * @param[out] kck Pointer to where the KCK output is to be written.
+ * @param[out] ptk Pointer to where the PTK output is to be written.
+ */
+void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk, uint8_t *hnonce,
+		      uint8_t *dnonce, uint8_t *kck, uint8_t *ptk)
+{
+	uint8_t idata[32];
+	uint8_t odata[32];
+
+	dump_bytes("ck", mk, 16);
+	dump_bytes("hnonce", hnonce, 16);
+	dump_bytes("dnonce", dnonce, 16);
+
+	/* The data is the HNonce and DNonce concatenated */
+	DWC_MEMCPY(&idata[0], hnonce, 16);
+	DWC_MEMCPY(&idata[16], dnonce, 16);
+
+	dwc_wusb_prf_256(mk, ccm_nonce, "Pair-wise keys", idata, 32, odata);
+
+	/* Low 16 bytes of the result is the KCK, high 16 is the PTK */
+	DWC_MEMCPY(kck, &odata[0], 16);
+	DWC_MEMCPY(ptk, &odata[16], 16);
+
+	dump_bytes("kck", kck, 16);
+	dump_bytes("ptk", ptk, 16);
+}
+
+/**
+ * Generates the Message Integrity Code over the Handshake data per the
+ * WUSB spec.
+ *
+ * @param ccm_nonce Pointer to CCM Nonce.
+ * @param kck   Pointer to Key Confirmation Key.
+ * @param data  Pointer to Handshake data to be checked.
+ * @param mic   Pointer to where the MIC output is to be written.
+ */
+void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t *kck,
+		      uint8_t *data, uint8_t *mic)
+{
+
+	dwc_wusb_prf_64(kck, ccm_nonce, "out-of-bandMIC",
+			data, WUSB_HANDSHAKE_LEN_FOR_MIC, mic);
+}
+
+#endif	/* DWC_CRYPTOLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_crypto.h b/drivers/usb/host/dwc_common_port/dwc_crypto.h
new file mode 100644
index 0000000000000..26fcddcfe9ba4
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_crypto.h
@@ -0,0 +1,111 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.h $
+ * $Revision: #3 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+
+#ifndef _DWC_CRYPTO_H_
+#define _DWC_CRYPTO_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * This file contains declarations for the WUSB Cryptographic routines as
+ * defined in the WUSB spec.  They are only to be used internally by the DWC UWB
+ * modules.
+ */
+
+#include "dwc_os.h"
+
+int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst);
+
+void dwc_wusb_cmf(u8 *key, u8 *nonce,
+		  char *label, u8 *bytes, int len, u8 *result);
+void dwc_wusb_prf(int prf_len, u8 *key,
+		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result);
+
+/**
+ * The PRF-64 function described in section 6.5 of the WUSB spec.
+ *
+ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
+ */
+static inline void dwc_wusb_prf_64(u8 *key, u8 *nonce,
+				   char *label, u8 *bytes, int len, u8 *result)
+{
+	dwc_wusb_prf(64, key, nonce, label, bytes, len, result);
+}
+
+/**
+ * The PRF-128 function described in section 6.5 of the WUSB spec.
+ *
+ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
+ */
+static inline void dwc_wusb_prf_128(u8 *key, u8 *nonce,
+				    char *label, u8 *bytes, int len, u8 *result)
+{
+	dwc_wusb_prf(128, key, nonce, label, bytes, len, result);
+}
+
+/**
+ * The PRF-256 function described in section 6.5 of the WUSB spec.
+ *
+ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
+ */
+static inline void dwc_wusb_prf_256(u8 *key, u8 *nonce,
+				    char *label, u8 *bytes, int len, u8 *result)
+{
+	dwc_wusb_prf(256, key, nonce, label, bytes, len, result);
+}
+
+
+void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
+			       uint8_t *nonce);
+void dwc_wusb_gen_nonce(uint16_t addr,
+			  uint8_t *nonce);
+
+void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk,
+			uint8_t *hnonce, uint8_t *dnonce,
+			uint8_t *kck, uint8_t *ptk);
+
+
+void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t
+			*kck, uint8_t *data, uint8_t *mic);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_CRYPTO_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_dh.c b/drivers/usb/host/dwc_common_port/dwc_dh.c
new file mode 100644
index 0000000000000..2b429a32aaf09
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_dh.c
@@ -0,0 +1,291 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.c $
+ * $Revision: #3 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifdef DWC_CRYPTOLIB
+
+#ifndef CONFIG_MACH_IPMATE
+
+#include "dwc_dh.h"
+#include "dwc_modpow.h"
+
+#ifdef DEBUG
+/* This function prints out a buffer in the format described in the Association
+ * Model specification. */
+static void dh_dump(char *str, void *_num, int len)
+{
+	uint8_t *num = _num;
+	int i;
+	DWC_PRINTF("%s\n", str);
+	for (i = 0; i < len; i ++) {
+		DWC_PRINTF("%02x", num[i]);
+		if (((i + 1) % 2) == 0) DWC_PRINTF(" ");
+		if (((i + 1) % 26) == 0) DWC_PRINTF("\n");
+	}
+
+	DWC_PRINTF("\n");
+}
+#else
+#define dh_dump(_x...) do {; } while(0)
+#endif
+
+/* Constant g value */
+static __u32 dh_g[] = {
+	0x02000000,
+};
+
+/* Constant p value */
+static __u32 dh_p[] = {
+	0xFFFFFFFF, 0xFFFFFFFF, 0xA2DA0FC9, 0x34C26821, 0x8B62C6C4, 0xD11CDC80, 0x084E0229, 0x74CC678A,
+	0xA6BE0B02, 0x229B133B, 0x79084A51, 0xDD04348E, 0xB31995EF, 0x1B433ACD, 0x6D0A2B30, 0x37145FF2,
+	0x6D35E14F, 0x45C2516D, 0x76B585E4, 0xC67E5E62, 0xE9424CF4, 0x6BED37A6, 0xB65CFF0B, 0xEDB706F4,
+	0xFB6B38EE, 0xA59F895A, 0x11249FAE, 0xE61F4B7C, 0x51662849, 0x3D5BE4EC, 0xB87C00C2, 0x05BF63A1,
+	0x3648DA98, 0x9AD3551C, 0xA83F1669, 0x5FCF24FD, 0x235D6583, 0x96ADA3DC, 0x56F3621C, 0xBB528520,
+	0x0729D59E, 0x6D969670, 0x4E350C67, 0x0498BC4A, 0x086C74F1, 0x7C2118CA, 0x465E9032, 0x3BCE362E,
+	0x2C779EE3, 0x03860E18, 0xA283279B, 0x8FA207EC, 0xF05DC5B5, 0xC9524C6F, 0xF6CB2BDE, 0x18175895,
+	0x7C499539, 0xE56A95EA, 0x1826D215, 0x1005FA98, 0x5A8E7215, 0x2DC4AA8A, 0x0D1733AD, 0x337A5004,
+	0xAB2155A8, 0x64BA1CDF, 0x0485FBEC, 0x0AEFDB58, 0x5771EA8A, 0x7D0C065D, 0x850F97B3, 0xC7E4E1A6,
+	0x8CAEF5AB, 0xD73309DB, 0xE0948C1E, 0x9D61254A, 0x26D2E3CE, 0x6BEED21A, 0x06FA2FF1, 0x64088AD9,
+	0x730276D8, 0x646AC83E, 0x182B1F52, 0x0C207B17, 0x5717E1BB, 0x6C5D617A, 0xC0880977, 0xE246D9BA,
+	0xA04FE208, 0x31ABE574, 0xFC5BDB43, 0x8E10FDE0, 0x20D1824B, 0xCAD23AA9, 0xFFFFFFFF, 0xFFFFFFFF,
+};
+
+static void dh_swap_bytes(void *_in, void *_out, uint32_t len)
+{
+	uint8_t *in = _in;
+	uint8_t *out = _out;
+	int i;
+	for (i=0; i<len; i++) {
+		out[i] = in[len-1-i];
+	}
+}
+
+/* Computes the modular exponentiation (num^exp % mod).  num, exp, and mod are
+ * big endian numbers of size len, in bytes.  Each len value must be a multiple
+ * of 4. */
+int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
+		  void *exp, uint32_t exp_len,
+		  void *mod, uint32_t mod_len,
+		  void *out)
+{
+	/* modpow() takes little endian numbers.  AM uses big-endian.  This
+	 * function swaps bytes of numbers before passing onto modpow. */
+
+	int retval = 0;
+	uint32_t *result;
+
+	uint32_t *bignum_num = dwc_alloc(mem_ctx, num_len + 4);
+	uint32_t *bignum_exp = dwc_alloc(mem_ctx, exp_len + 4);
+	uint32_t *bignum_mod = dwc_alloc(mem_ctx, mod_len + 4);
+
+	dh_swap_bytes(num, &bignum_num[1], num_len);
+	bignum_num[0] = num_len / 4;
+
+	dh_swap_bytes(exp, &bignum_exp[1], exp_len);
+	bignum_exp[0] = exp_len / 4;
+
+	dh_swap_bytes(mod, &bignum_mod[1], mod_len);
+	bignum_mod[0] = mod_len / 4;
+
+	result = dwc_modpow(mem_ctx, bignum_num, bignum_exp, bignum_mod);
+	if (!result) {
+		retval = -1;
+		goto dh_modpow_nomem;
+	}
+
+	dh_swap_bytes(&result[1], out, result[0] * 4);
+	dwc_free(mem_ctx, result);
+
+ dh_modpow_nomem:
+	dwc_free(mem_ctx, bignum_num);
+	dwc_free(mem_ctx, bignum_exp);
+	dwc_free(mem_ctx, bignum_mod);
+	return retval;
+}
+
+
+int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pk, uint8_t *hash)
+{
+	int retval;
+	uint8_t m3[385];
+
+#ifndef DH_TEST_VECTORS
+	DWC_RANDOM_BYTES(exp, 32);
+#endif
+
+	/* Compute the pkd */
+	if ((retval = dwc_dh_modpow(mem_ctx, dh_g, 4,
+				    exp, 32,
+				    dh_p, 384, pk))) {
+		return retval;
+	}
+
+	m3[384] = nd;
+	DWC_MEMCPY(&m3[0], pk, 384);
+	DWC_SHA256(m3, 385, hash);
+
+	dh_dump("PK", pk, 384);
+	dh_dump("SHA-256(M3)", hash, 32);
+	return 0;
+}
+
+int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
+		       uint8_t *exp, int is_host,
+		       char *dd, uint8_t *ck, uint8_t *kdk)
+{
+	int retval;
+	uint8_t mv[784];
+	uint8_t sha_result[32];
+	uint8_t dhkey[384];
+	uint8_t shared_secret[384];
+	char *message;
+	uint32_t vd;
+
+	uint8_t *pk;
+
+	if (is_host) {
+		pk = pkd;
+	}
+	else {
+		pk = pkh;
+	}
+
+	if ((retval = dwc_dh_modpow(mem_ctx, pk, 384,
+				    exp, 32,
+				    dh_p, 384, shared_secret))) {
+		return retval;
+	}
+	dh_dump("Shared Secret", shared_secret, 384);
+
+	DWC_SHA256(shared_secret, 384, dhkey);
+	dh_dump("DHKEY", dhkey, 384);
+
+	DWC_MEMCPY(&mv[0], pkd, 384);
+	DWC_MEMCPY(&mv[384], pkh, 384);
+	DWC_MEMCPY(&mv[768], "displayed digest", 16);
+	dh_dump("MV", mv, 784);
+
+	DWC_SHA256(mv, 784, sha_result);
+	dh_dump("SHA-256(MV)", sha_result, 32);
+	dh_dump("First 32-bits of SHA-256(MV)", sha_result, 4);
+
+	dh_swap_bytes(sha_result, &vd, 4);
+#ifdef DEBUG
+	DWC_PRINTF("Vd (decimal) = %d\n", vd);
+#endif
+
+	switch (nd) {
+	case 2:
+		vd = vd % 100;
+		DWC_SPRINTF(dd, "%02d", vd);
+		break;
+	case 3:
+		vd = vd % 1000;
+		DWC_SPRINTF(dd, "%03d", vd);
+		break;
+	case 4:
+		vd = vd % 10000;
+		DWC_SPRINTF(dd, "%04d", vd);
+		break;
+	}
+#ifdef DEBUG
+	DWC_PRINTF("Display Digits: %s\n", dd);
+#endif
+
+	message = "connection key";
+	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
+	dh_dump("HMAC(SHA-256, DHKey, connection key)", sha_result, 32);
+	DWC_MEMCPY(ck, sha_result, 16);
+
+	message = "key derivation key";
+	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
+	dh_dump("HMAC(SHA-256, DHKey, key derivation key)", sha_result, 32);
+	DWC_MEMCPY(kdk, sha_result, 32);
+
+	return 0;
+}
+
+
+#ifdef DH_TEST_VECTORS
+
+static __u8 dh_a[] = {
+	0x44, 0x00, 0x51, 0xd6,
+	0xf0, 0xb5, 0x5e, 0xa9,
+	0x67, 0xab, 0x31, 0xc6,
+	0x8a, 0x8b, 0x5e, 0x37,
+	0xd9, 0x10, 0xda, 0xe0,
+	0xe2, 0xd4, 0x59, 0xa4,
+	0x86, 0x45, 0x9c, 0xaa,
+	0xdf, 0x36, 0x75, 0x16,
+};
+
+static __u8 dh_b[] = {
+	0x5d, 0xae, 0xc7, 0x86,
+	0x79, 0x80, 0xa3, 0x24,
+	0x8c, 0xe3, 0x57, 0x8f,
+	0xc7, 0x5f, 0x1b, 0x0f,
+	0x2d, 0xf8, 0x9d, 0x30,
+	0x6f, 0xa4, 0x52, 0xcd,
+	0xe0, 0x7a, 0x04, 0x8a,
+	0xde, 0xd9, 0x26, 0x56,
+};
+
+void dwc_run_dh_test_vectors(void *mem_ctx)
+{
+	uint8_t pkd[384];
+	uint8_t pkh[384];
+	uint8_t hashd[32];
+	uint8_t hashh[32];
+	uint8_t ck[16];
+	uint8_t kdk[32];
+	char dd[5];
+
+	DWC_PRINTF("\n\n\nDH_TEST_VECTORS\n\n");
+
+	/* compute the PKd and SHA-256(PKd || Nd) */
+	DWC_PRINTF("Computing PKd\n");
+	dwc_dh_pk(mem_ctx, 2, dh_a, pkd, hashd);
+
+	/* compute the PKd and SHA-256(PKh || Nd) */
+	DWC_PRINTF("Computing PKh\n");
+	dwc_dh_pk(mem_ctx, 2, dh_b, pkh, hashh);
+
+	/* compute the dhkey */
+	dwc_dh_derive_keys(mem_ctx, 2, pkh, pkd, dh_a, 0, dd, ck, kdk);
+}
+#endif /* DH_TEST_VECTORS */
+
+#endif /* !CONFIG_MACH_IPMATE */
+
+#endif /* DWC_CRYPTOLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_dh.h b/drivers/usb/host/dwc_common_port/dwc_dh.h
new file mode 100644
index 0000000000000..25c1cc0d588a4
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_dh.h
@@ -0,0 +1,106 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.h $
+ * $Revision: #4 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifndef _DWC_DH_H_
+#define _DWC_DH_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dwc_os.h"
+
+/** @file
+ *
+ * This file defines the common functions on device and host for performing
+ * numeric association as defined in the WUSB spec.  They are only to be
+ * used internally by the DWC UWB modules. */
+
+extern int dwc_dh_sha256(uint8_t *message, uint32_t len, uint8_t *out);
+extern int dwc_dh_hmac_sha256(uint8_t *message, uint32_t messagelen,
+			      uint8_t *key, uint32_t keylen,
+			      uint8_t *out);
+extern int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
+			 void *exp, uint32_t exp_len,
+			 void *mod, uint32_t mod_len,
+			 void *out);
+
+/** Computes PKD or PKH, and SHA-256(PKd || Nd)
+ *
+ * PK = g^exp mod p.
+ *
+ * Input:
+ * Nd = Number of digits on the device.
+ *
+ * Output:
+ * exp = A 32-byte buffer to be filled with a randomly generated number.
+ *       used as either A or B.
+ * pk = A 384-byte buffer to be filled with the PKH or PKD.
+ * hash = A 32-byte buffer to be filled with SHA-256(PK || ND).
+ */
+extern int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pkd, uint8_t *hash);
+
+/** Computes the DHKEY, and VD.
+ *
+ * If called from host, then it will comput DHKEY=PKD^exp % p.
+ * If called from device, then it will comput DHKEY=PKH^exp % p.
+ *
+ * Input:
+ * pkd = The PKD value.
+ * pkh = The PKH value.
+ * exp = The A value (if device) or B value (if host) generated in dwc_wudev_dh_pk.
+ * is_host = Set to non zero if a WUSB host is calling this function.
+ *
+ * Output:
+
+ * dd = A pointer to an buffer to be set to the displayed digits string to be shown
+ *      to the user.  This buffer should be at 5 bytes long to hold 4 digits plus a
+ *      null termination character.  This buffer can be used directly for display.
+ * ck = A 16-byte buffer to be filled with the CK.
+ * kdk = A 32-byte buffer to be filled with the KDK.
+ */
+extern int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
+			      uint8_t *exp, int is_host,
+			      char *dd, uint8_t *ck, uint8_t *kdk);
+
+#ifdef DH_TEST_VECTORS
+extern void dwc_run_dh_test_vectors(void);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_DH_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_list.h b/drivers/usb/host/dwc_common_port/dwc_list.h
new file mode 100644
index 0000000000000..4ce560df0cae6
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_list.h
@@ -0,0 +1,594 @@
+/*	$OpenBSD: queue.h,v 1.26 2004/05/04 16:59:32 grange Exp $	*/
+/*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
+
+/*
+ * Copyright (c) 1991, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)queue.h	8.5 (Berkeley) 8/20/94
+ */
+
+#ifndef _DWC_LIST_H_
+#define _DWC_LIST_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * This file defines linked list operations.  It is derived from BSD with
+ * only the MACRO names being prefixed with DWC_.  This is because a few of
+ * these names conflict with those on Linux.  For documentation on use, see the
+ * inline comments in the source code.  The original license for this source
+ * code applies and is preserved in the dwc_list.h source file.
+ */
+
+/*
+ * This file defines five types of data structures: singly-linked lists,
+ * lists, simple queues, tail queues, and circular queues.
+ *
+ *
+ * A singly-linked list is headed by a single forward pointer. The elements
+ * are singly linked for minimum space and pointer manipulation overhead at
+ * the expense of O(n) removal for arbitrary elements. New elements can be
+ * added to the list after an existing element or at the head of the list.
+ * Elements being removed from the head of the list should use the explicit
+ * macro for this purpose for optimum efficiency. A singly-linked list may
+ * only be traversed in the forward direction.  Singly-linked lists are ideal
+ * for applications with large datasets and few or no removals or for
+ * implementing a LIFO queue.
+ *
+ * A list is headed by a single forward pointer (or an array of forward
+ * pointers for a hash table header). The elements are doubly linked
+ * so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before
+ * or after an existing element or at the head of the list. A list
+ * may only be traversed in the forward direction.
+ *
+ * A simple queue is headed by a pair of pointers, one the head of the
+ * list and the other to the tail of the list. The elements are singly
+ * linked to save space, so elements can only be removed from the
+ * head of the list. New elements can be added to the list before or after
+ * an existing element, at the head of the list, or at the end of the
+ * list. A simple queue may only be traversed in the forward direction.
+ *
+ * A tail queue is headed by a pair of pointers, one to the head of the
+ * list and the other to the tail of the list. The elements are doubly
+ * linked so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before or
+ * after an existing element, at the head of the list, or at the end of
+ * the list. A tail queue may be traversed in either direction.
+ *
+ * A circle queue is headed by a pair of pointers, one to the head of the
+ * list and the other to the tail of the list. The elements are doubly
+ * linked so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before or after
+ * an existing element, at the head of the list, or at the end of the list.
+ * A circle queue may be traversed in either direction, but has a more
+ * complex end of list detection.
+ *
+ * For details on the use of these macros, see the queue(3) manual page.
+ */
+
+/*
+ * Double-linked List.
+ */
+
+typedef struct dwc_list_link {
+	struct dwc_list_link *next;
+	struct dwc_list_link *prev;
+} dwc_list_link_t;
+
+#define DWC_LIST_INIT(link) do {	\
+	(link)->next = (link);		\
+	(link)->prev = (link);		\
+} while (0)
+
+#define DWC_LIST_FIRST(link)	((link)->next)
+#define DWC_LIST_LAST(link)	((link)->prev)
+#define DWC_LIST_END(link)	(link)
+#define DWC_LIST_NEXT(link)	((link)->next)
+#define DWC_LIST_PREV(link)	((link)->prev)
+#define DWC_LIST_EMPTY(link)	\
+	(DWC_LIST_FIRST(link) == DWC_LIST_END(link))
+#define DWC_LIST_ENTRY(link, type, field)			\
+	(type *)((uint8_t *)(link) - (size_t)(&((type *)0)->field))
+
+#if 0
+#define DWC_LIST_INSERT_HEAD(list, link) do {			\
+	(link)->next = (list)->next;				\
+	(link)->prev = (list);					\
+	(list)->next->prev = (link);				\
+	(list)->next = (link);					\
+} while (0)
+
+#define DWC_LIST_INSERT_TAIL(list, link) do {			\
+	(link)->next = (list);					\
+	(link)->prev = (list)->prev;				\
+	(list)->prev->next = (link);				\
+	(list)->prev = (link);					\
+} while (0)
+#else
+#define DWC_LIST_INSERT_HEAD(list, link) do {			\
+	dwc_list_link_t *__next__ = (list)->next;		\
+	__next__->prev = (link);				\
+	(link)->next = __next__;				\
+	(link)->prev = (list);					\
+	(list)->next = (link);					\
+} while (0)
+
+#define DWC_LIST_INSERT_TAIL(list, link) do {			\
+	dwc_list_link_t *__prev__ = (list)->prev;		\
+	(list)->prev = (link);					\
+	(link)->next = (list);					\
+	(link)->prev = __prev__;				\
+	__prev__->next = (link);				\
+} while (0)
+#endif
+
+#if 0
+static inline void __list_add(struct list_head *new,
+                              struct list_head *prev,
+                              struct list_head *next)
+{
+        next->prev = new;
+        new->next = next;
+        new->prev = prev;
+        prev->next = new;
+}
+
+static inline void list_add(struct list_head *new, struct list_head *head)
+{
+        __list_add(new, head, head->next);
+}
+
+static inline void list_add_tail(struct list_head *new, struct list_head *head)
+{
+        __list_add(new, head->prev, head);
+}
+
+static inline void __list_del(struct list_head * prev, struct list_head * next)
+{
+        next->prev = prev;
+        prev->next = next;
+}
+
+static inline void list_del(struct list_head *entry)
+{
+        __list_del(entry->prev, entry->next);
+        entry->next = LIST_POISON1;
+        entry->prev = LIST_POISON2;
+}
+#endif
+
+#define DWC_LIST_REMOVE(link) do {				\
+	(link)->next->prev = (link)->prev;			\
+	(link)->prev->next = (link)->next;			\
+} while (0)
+
+#define DWC_LIST_REMOVE_INIT(link) do {				\
+	DWC_LIST_REMOVE(link);					\
+	DWC_LIST_INIT(link);					\
+} while (0)
+
+#define DWC_LIST_MOVE_HEAD(list, link) do {			\
+	DWC_LIST_REMOVE(link);					\
+	DWC_LIST_INSERT_HEAD(list, link);			\
+} while (0)
+
+#define DWC_LIST_MOVE_TAIL(list, link) do {			\
+	DWC_LIST_REMOVE(link);					\
+	DWC_LIST_INSERT_TAIL(list, link);			\
+} while (0)
+
+#define DWC_LIST_FOREACH(var, list)				\
+	for((var) = DWC_LIST_FIRST(list);			\
+	    (var) != DWC_LIST_END(list);			\
+	    (var) = DWC_LIST_NEXT(var))
+
+#define DWC_LIST_FOREACH_SAFE(var, var2, list)			\
+	for((var) = DWC_LIST_FIRST(list), (var2) = DWC_LIST_NEXT(var);	\
+	    (var) != DWC_LIST_END(list);			\
+	    (var) = (var2), (var2) = DWC_LIST_NEXT(var2))
+
+#define DWC_LIST_FOREACH_REVERSE(var, list)			\
+	for((var) = DWC_LIST_LAST(list);			\
+	    (var) != DWC_LIST_END(list);			\
+	    (var) = DWC_LIST_PREV(var))
+
+/*
+ * Singly-linked List definitions.
+ */
+#define DWC_SLIST_HEAD(name, type)					\
+struct name {								\
+	struct type *slh_first;	/* first element */			\
+}
+
+#define DWC_SLIST_HEAD_INITIALIZER(head)				\
+	{ NULL }
+
+#define DWC_SLIST_ENTRY(type)						\
+struct {								\
+	struct type *sle_next;	/* next element */			\
+}
+
+/*
+ * Singly-linked List access methods.
+ */
+#define DWC_SLIST_FIRST(head)	((head)->slh_first)
+#define DWC_SLIST_END(head)		NULL
+#define DWC_SLIST_EMPTY(head)	(SLIST_FIRST(head) == SLIST_END(head))
+#define DWC_SLIST_NEXT(elm, field)	((elm)->field.sle_next)
+
+#define DWC_SLIST_FOREACH(var, head, field)				\
+	for((var) = SLIST_FIRST(head);					\
+	    (var) != SLIST_END(head);					\
+	    (var) = SLIST_NEXT(var, field))
+
+#define DWC_SLIST_FOREACH_PREVPTR(var, varp, head, field)		\
+	for((varp) = &SLIST_FIRST((head));				\
+	    ((var) = *(varp)) != SLIST_END(head);			\
+	    (varp) = &SLIST_NEXT((var), field))
+
+/*
+ * Singly-linked List functions.
+ */
+#define DWC_SLIST_INIT(head) {						\
+	SLIST_FIRST(head) = SLIST_END(head);				\
+}
+
+#define DWC_SLIST_INSERT_AFTER(slistelm, elm, field) do {		\
+	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
+	(slistelm)->field.sle_next = (elm);				\
+} while (0)
+
+#define DWC_SLIST_INSERT_HEAD(head, elm, field) do {			\
+	(elm)->field.sle_next = (head)->slh_first;			\
+	(head)->slh_first = (elm);					\
+} while (0)
+
+#define DWC_SLIST_REMOVE_NEXT(head, elm, field) do {			\
+	(elm)->field.sle_next = (elm)->field.sle_next->field.sle_next;	\
+} while (0)
+
+#define DWC_SLIST_REMOVE_HEAD(head, field) do {				\
+	(head)->slh_first = (head)->slh_first->field.sle_next;		\
+} while (0)
+
+#define DWC_SLIST_REMOVE(head, elm, type, field) do {			\
+	if ((head)->slh_first == (elm)) {				\
+		SLIST_REMOVE_HEAD((head), field);			\
+	}								\
+	else {								\
+		struct type *curelm = (head)->slh_first;		\
+		while( curelm->field.sle_next != (elm) )		\
+			curelm = curelm->field.sle_next;		\
+		curelm->field.sle_next =				\
+		    curelm->field.sle_next->field.sle_next;		\
+	}								\
+} while (0)
+
+/*
+ * Simple queue definitions.
+ */
+#define DWC_SIMPLEQ_HEAD(name, type)					\
+struct name {								\
+	struct type *sqh_first;	/* first element */			\
+	struct type **sqh_last;	/* addr of last next element */		\
+}
+
+#define DWC_SIMPLEQ_HEAD_INITIALIZER(head)				\
+	{ NULL, &(head).sqh_first }
+
+#define DWC_SIMPLEQ_ENTRY(type)						\
+struct {								\
+	struct type *sqe_next;	/* next element */			\
+}
+
+/*
+ * Simple queue access methods.
+ */
+#define DWC_SIMPLEQ_FIRST(head)	    ((head)->sqh_first)
+#define DWC_SIMPLEQ_END(head)	    NULL
+#define DWC_SIMPLEQ_EMPTY(head)	    (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head))
+#define DWC_SIMPLEQ_NEXT(elm, field)    ((elm)->field.sqe_next)
+
+#define DWC_SIMPLEQ_FOREACH(var, head, field)				\
+	for((var) = SIMPLEQ_FIRST(head);				\
+	    (var) != SIMPLEQ_END(head);					\
+	    (var) = SIMPLEQ_NEXT(var, field))
+
+/*
+ * Simple queue functions.
+ */
+#define DWC_SIMPLEQ_INIT(head) do {					\
+	(head)->sqh_first = NULL;					\
+	(head)->sqh_last = &(head)->sqh_first;				\
+} while (0)
+
+#define DWC_SIMPLEQ_INSERT_HEAD(head, elm, field) do {			\
+	if (((elm)->field.sqe_next = (head)->sqh_first) == NULL)	\
+		(head)->sqh_last = &(elm)->field.sqe_next;		\
+	(head)->sqh_first = (elm);					\
+} while (0)
+
+#define DWC_SIMPLEQ_INSERT_TAIL(head, elm, field) do {			\
+	(elm)->field.sqe_next = NULL;					\
+	*(head)->sqh_last = (elm);					\
+	(head)->sqh_last = &(elm)->field.sqe_next;			\
+} while (0)
+
+#define DWC_SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
+	if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\
+		(head)->sqh_last = &(elm)->field.sqe_next;		\
+	(listelm)->field.sqe_next = (elm);				\
+} while (0)
+
+#define DWC_SIMPLEQ_REMOVE_HEAD(head, field) do {			\
+	if (((head)->sqh_first = (head)->sqh_first->field.sqe_next) == NULL) \
+		(head)->sqh_last = &(head)->sqh_first;			\
+} while (0)
+
+/*
+ * Tail queue definitions.
+ */
+#define DWC_TAILQ_HEAD(name, type)					\
+struct name {								\
+	struct type *tqh_first;	/* first element */			\
+	struct type **tqh_last;	/* addr of last next element */		\
+}
+
+#define DWC_TAILQ_HEAD_INITIALIZER(head)				\
+	{ NULL, &(head).tqh_first }
+
+#define DWC_TAILQ_ENTRY(type)						\
+struct {								\
+	struct type *tqe_next;	/* next element */			\
+	struct type **tqe_prev;	/* address of previous next element */	\
+}
+
+/*
+ * tail queue access methods
+ */
+#define DWC_TAILQ_FIRST(head)		((head)->tqh_first)
+#define DWC_TAILQ_END(head)		NULL
+#define DWC_TAILQ_NEXT(elm, field)	((elm)->field.tqe_next)
+#define DWC_TAILQ_LAST(head, headname)					\
+	(*(((struct headname *)((head)->tqh_last))->tqh_last))
+/* XXX */
+#define DWC_TAILQ_PREV(elm, headname, field)				\
+	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
+#define DWC_TAILQ_EMPTY(head)						\
+	(DWC_TAILQ_FIRST(head) == DWC_TAILQ_END(head))
+
+#define DWC_TAILQ_FOREACH(var, head, field)				\
+	for ((var) = DWC_TAILQ_FIRST(head);				\
+	    (var) != DWC_TAILQ_END(head);				\
+	    (var) = DWC_TAILQ_NEXT(var, field))
+
+#define DWC_TAILQ_FOREACH_REVERSE(var, head, headname, field)		\
+	for ((var) = DWC_TAILQ_LAST(head, headname);			\
+	    (var) != DWC_TAILQ_END(head);				\
+	    (var) = DWC_TAILQ_PREV(var, headname, field))
+
+/*
+ * Tail queue functions.
+ */
+#define DWC_TAILQ_INIT(head) do {					\
+	(head)->tqh_first = NULL;					\
+	(head)->tqh_last = &(head)->tqh_first;				\
+} while (0)
+
+#define DWC_TAILQ_INSERT_HEAD(head, elm, field) do {			\
+	if (((elm)->field.tqe_next = (head)->tqh_first) != NULL)	\
+		(head)->tqh_first->field.tqe_prev =			\
+		    &(elm)->field.tqe_next;				\
+	else								\
+		(head)->tqh_last = &(elm)->field.tqe_next;		\
+	(head)->tqh_first = (elm);					\
+	(elm)->field.tqe_prev = &(head)->tqh_first;			\
+} while (0)
+
+#define DWC_TAILQ_INSERT_TAIL(head, elm, field) do {			\
+	(elm)->field.tqe_next = NULL;					\
+	(elm)->field.tqe_prev = (head)->tqh_last;			\
+	*(head)->tqh_last = (elm);					\
+	(head)->tqh_last = &(elm)->field.tqe_next;			\
+} while (0)
+
+#define DWC_TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
+	if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\
+		(elm)->field.tqe_next->field.tqe_prev =			\
+		    &(elm)->field.tqe_next;				\
+	else								\
+		(head)->tqh_last = &(elm)->field.tqe_next;		\
+	(listelm)->field.tqe_next = (elm);				\
+	(elm)->field.tqe_prev = &(listelm)->field.tqe_next;		\
+} while (0)
+
+#define DWC_TAILQ_INSERT_BEFORE(listelm, elm, field) do {		\
+	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
+	(elm)->field.tqe_next = (listelm);				\
+	*(listelm)->field.tqe_prev = (elm);				\
+	(listelm)->field.tqe_prev = &(elm)->field.tqe_next;		\
+} while (0)
+
+#define DWC_TAILQ_REMOVE(head, elm, field) do {				\
+	if (((elm)->field.tqe_next) != NULL)				\
+		(elm)->field.tqe_next->field.tqe_prev =			\
+		    (elm)->field.tqe_prev;				\
+	else								\
+		(head)->tqh_last = (elm)->field.tqe_prev;		\
+	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
+} while (0)
+
+#define DWC_TAILQ_REPLACE(head, elm, elm2, field) do {			\
+	if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL)	\
+		(elm2)->field.tqe_next->field.tqe_prev =		\
+		    &(elm2)->field.tqe_next;				\
+	else								\
+		(head)->tqh_last = &(elm2)->field.tqe_next;		\
+	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
+	*(elm2)->field.tqe_prev = (elm2);				\
+} while (0)
+
+/*
+ * Circular queue definitions.
+ */
+#define DWC_CIRCLEQ_HEAD(name, type)					\
+struct name {								\
+	struct type *cqh_first;		/* first element */		\
+	struct type *cqh_last;		/* last element */		\
+}
+
+#define DWC_CIRCLEQ_HEAD_INITIALIZER(head)				\
+	{ DWC_CIRCLEQ_END(&head), DWC_CIRCLEQ_END(&head) }
+
+#define DWC_CIRCLEQ_ENTRY(type)						\
+struct {								\
+	struct type *cqe_next;		/* next element */		\
+	struct type *cqe_prev;		/* previous element */		\
+}
+
+/*
+ * Circular queue access methods
+ */
+#define DWC_CIRCLEQ_FIRST(head)		((head)->cqh_first)
+#define DWC_CIRCLEQ_LAST(head)		((head)->cqh_last)
+#define DWC_CIRCLEQ_END(head)		((void *)(head))
+#define DWC_CIRCLEQ_NEXT(elm, field)	((elm)->field.cqe_next)
+#define DWC_CIRCLEQ_PREV(elm, field)	((elm)->field.cqe_prev)
+#define DWC_CIRCLEQ_EMPTY(head)						\
+	(DWC_CIRCLEQ_FIRST(head) == DWC_CIRCLEQ_END(head))
+
+#define DWC_CIRCLEQ_EMPTY_ENTRY(elm, field) (((elm)->field.cqe_next == NULL) && ((elm)->field.cqe_prev == NULL))
+
+#define DWC_CIRCLEQ_FOREACH(var, head, field)				\
+	for((var) = DWC_CIRCLEQ_FIRST(head);				\
+	    (var) != DWC_CIRCLEQ_END(head);				\
+	    (var) = DWC_CIRCLEQ_NEXT(var, field))
+
+#define DWC_CIRCLEQ_FOREACH_SAFE(var, var2, head, field)			\
+	for((var) = DWC_CIRCLEQ_FIRST(head), var2 = DWC_CIRCLEQ_NEXT(var, field); \
+	    (var) != DWC_CIRCLEQ_END(head);					\
+	    (var) = var2, var2 = DWC_CIRCLEQ_NEXT(var, field))
+
+#define DWC_CIRCLEQ_FOREACH_REVERSE(var, head, field)			\
+	for((var) = DWC_CIRCLEQ_LAST(head);				\
+	    (var) != DWC_CIRCLEQ_END(head);				\
+	    (var) = DWC_CIRCLEQ_PREV(var, field))
+
+/*
+ * Circular queue functions.
+ */
+#define DWC_CIRCLEQ_INIT(head) do {					\
+	(head)->cqh_first = DWC_CIRCLEQ_END(head);			\
+	(head)->cqh_last = DWC_CIRCLEQ_END(head);			\
+} while (0)
+
+#define DWC_CIRCLEQ_INIT_ENTRY(elm, field) do {				\
+	(elm)->field.cqe_next = NULL;					\
+	(elm)->field.cqe_prev = NULL;					\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
+	(elm)->field.cqe_next = (listelm)->field.cqe_next;		\
+	(elm)->field.cqe_prev = (listelm);				\
+	if ((listelm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_last = (elm);				\
+	else								\
+		(listelm)->field.cqe_next->field.cqe_prev = (elm);	\
+	(listelm)->field.cqe_next = (elm);				\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do {	\
+	(elm)->field.cqe_next = (listelm);				\
+	(elm)->field.cqe_prev = (listelm)->field.cqe_prev;		\
+	if ((listelm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_first = (elm);				\
+	else								\
+		(listelm)->field.cqe_prev->field.cqe_next = (elm);	\
+	(listelm)->field.cqe_prev = (elm);				\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_HEAD(head, elm, field) do {			\
+	(elm)->field.cqe_next = (head)->cqh_first;			\
+	(elm)->field.cqe_prev = DWC_CIRCLEQ_END(head);			\
+	if ((head)->cqh_last == DWC_CIRCLEQ_END(head))			\
+		(head)->cqh_last = (elm);				\
+	else								\
+		(head)->cqh_first->field.cqe_prev = (elm);		\
+	(head)->cqh_first = (elm);					\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_TAIL(head, elm, field) do {			\
+	(elm)->field.cqe_next = DWC_CIRCLEQ_END(head);			\
+	(elm)->field.cqe_prev = (head)->cqh_last;			\
+	if ((head)->cqh_first == DWC_CIRCLEQ_END(head))			\
+		(head)->cqh_first = (elm);				\
+	else								\
+		(head)->cqh_last->field.cqe_next = (elm);		\
+	(head)->cqh_last = (elm);					\
+} while (0)
+
+#define DWC_CIRCLEQ_REMOVE(head, elm, field) do {			\
+	if ((elm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_last = (elm)->field.cqe_prev;		\
+	else								\
+		(elm)->field.cqe_next->field.cqe_prev =			\
+		    (elm)->field.cqe_prev;				\
+	if ((elm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_first = (elm)->field.cqe_next;		\
+	else								\
+		(elm)->field.cqe_prev->field.cqe_next =			\
+		    (elm)->field.cqe_next;				\
+} while (0)
+
+#define DWC_CIRCLEQ_REMOVE_INIT(head, elm, field) do {			\
+	DWC_CIRCLEQ_REMOVE(head, elm, field);				\
+	DWC_CIRCLEQ_INIT_ENTRY(elm, field);				\
+} while (0)
+
+#define DWC_CIRCLEQ_REPLACE(head, elm, elm2, field) do {		\
+	if (((elm2)->field.cqe_next = (elm)->field.cqe_next) ==		\
+	    DWC_CIRCLEQ_END(head))					\
+		(head).cqh_last = (elm2);				\
+	else								\
+		(elm2)->field.cqe_next->field.cqe_prev = (elm2);	\
+	if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) ==		\
+	    DWC_CIRCLEQ_END(head))					\
+		(head).cqh_first = (elm2);				\
+	else								\
+		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
+} while (0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_LIST_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_mem.c b/drivers/usb/host/dwc_common_port/dwc_mem.c
new file mode 100644
index 0000000000000..ad645ff1ba7e0
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_mem.c
@@ -0,0 +1,245 @@
+/* Memory Debugging */
+#ifdef DWC_DEBUG_MEMORY
+
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+struct allocation {
+	void *addr;
+	void *ctx;
+	char *func;
+	int line;
+	uint32_t size;
+	int dma;
+	DWC_CIRCLEQ_ENTRY(allocation) entry;
+};
+
+DWC_CIRCLEQ_HEAD(allocation_queue, allocation);
+
+struct allocation_manager {
+	void *mem_ctx;
+	struct allocation_queue allocations;
+
+	/* statistics */
+	int num;
+	int num_freed;
+	int num_active;
+	uint32_t total;
+	uint32_t cur;
+	uint32_t max;
+};
+
+static struct allocation_manager *manager = NULL;
+
+static int add_allocation(void *ctx, uint32_t size, char const *func, int line, void *addr,
+			  int dma)
+{
+	struct allocation *a;
+
+	DWC_ASSERT(manager != NULL, "manager not allocated");
+
+	a = __DWC_ALLOC_ATOMIC(manager->mem_ctx, sizeof(*a));
+	if (!a) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	a->func = __DWC_ALLOC_ATOMIC(manager->mem_ctx, DWC_STRLEN(func) + 1);
+	if (!a->func) {
+		__DWC_FREE(manager->mem_ctx, a);
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_MEMCPY(a->func, func, DWC_STRLEN(func) + 1);
+	a->addr = addr;
+	a->ctx = ctx;
+	a->line = line;
+	a->size = size;
+	a->dma = dma;
+	DWC_CIRCLEQ_INSERT_TAIL(&manager->allocations, a, entry);
+
+	/* Update stats */
+	manager->num++;
+	manager->num_active++;
+	manager->total += size;
+	manager->cur += size;
+
+	if (manager->max < manager->cur) {
+		manager->max = manager->cur;
+	}
+
+	return 0;
+}
+
+static struct allocation *find_allocation(void *ctx, void *addr)
+{
+	struct allocation *a;
+
+	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
+		if (a->ctx == ctx && a->addr == addr) {
+			return a;
+		}
+	}
+
+	return NULL;
+}
+
+static void free_allocation(void *ctx, void *addr, char const *func, int line)
+{
+	struct allocation *a = find_allocation(ctx, addr);
+
+	if (!a) {
+		DWC_ASSERT(0,
+			   "Free of address %p that was never allocated or already freed %s:%d",
+			   addr, func, line);
+		return;
+	}
+
+	DWC_CIRCLEQ_REMOVE(&manager->allocations, a, entry);
+
+	manager->num_active--;
+	manager->num_freed++;
+	manager->cur -= a->size;
+	__DWC_FREE(manager->mem_ctx, a->func);
+	__DWC_FREE(manager->mem_ctx, a);
+}
+
+int dwc_memory_debug_start(void *mem_ctx)
+{
+	DWC_ASSERT(manager == NULL, "Memory debugging has already started\n");
+
+	if (manager) {
+		return -DWC_E_BUSY;
+	}
+
+	manager = __DWC_ALLOC(mem_ctx, sizeof(*manager));
+	if (!manager) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_CIRCLEQ_INIT(&manager->allocations);
+	manager->mem_ctx = mem_ctx;
+	manager->num = 0;
+	manager->num_freed = 0;
+	manager->num_active = 0;
+	manager->total = 0;
+	manager->cur = 0;
+	manager->max = 0;
+
+	return 0;
+}
+
+void dwc_memory_debug_stop(void)
+{
+	struct allocation *a;
+
+	dwc_memory_debug_report();
+
+	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
+		DWC_ERROR("Memory leaked from %s:%d\n", a->func, a->line);
+		free_allocation(a->ctx, a->addr, NULL, -1);
+	}
+
+	__DWC_FREE(manager->mem_ctx, manager);
+}
+
+void dwc_memory_debug_report(void)
+{
+	struct allocation *a;
+
+	DWC_PRINTF("\n\n\n----------------- Memory Debugging Report -----------------\n\n");
+	DWC_PRINTF("Num Allocations = %d\n", manager->num);
+	DWC_PRINTF("Freed = %d\n", manager->num_freed);
+	DWC_PRINTF("Active = %d\n", manager->num_active);
+	DWC_PRINTF("Current Memory Used = %d\n", manager->cur);
+	DWC_PRINTF("Total Memory Used = %d\n", manager->total);
+	DWC_PRINTF("Maximum Memory Used at Once = %d\n", manager->max);
+	DWC_PRINTF("Unfreed allocations:\n");
+
+	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
+		DWC_PRINTF("    addr=%p, size=%d from %s:%d, DMA=%d\n",
+			   a->addr, a->size, a->func, a->line, a->dma);
+	}
+}
+
+/* The replacement functions */
+void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line)
+{
+	void *addr = __DWC_ALLOC(mem_ctx, size);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
+		__DWC_FREE(mem_ctx, addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func,
+			     int line)
+{
+	void *addr = __DWC_ALLOC_ATOMIC(mem_ctx, size);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
+		__DWC_FREE(mem_ctx, addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line)
+{
+	free_allocation(mem_ctx, addr, func, line);
+	__DWC_FREE(mem_ctx, addr);
+}
+
+void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
+			  char const *func, int line)
+{
+	void *addr = __DWC_DMA_ALLOC(dma_ctx, size, dma_addr);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
+		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size,
+				 dwc_dma_t *dma_addr, char const *func, int line)
+{
+	void *addr = __DWC_DMA_ALLOC_ATOMIC(dma_ctx, size, dma_addr);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
+		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
+			dwc_dma_t dma_addr, char const *func, int line)
+{
+	free_allocation(dma_ctx, virt_addr, func, line);
+	__DWC_DMA_FREE(dma_ctx, size, virt_addr, dma_addr);
+}
+
+#endif /* DWC_DEBUG_MEMORY */
diff --git a/drivers/usb/host/dwc_common_port/dwc_modpow.c b/drivers/usb/host/dwc_common_port/dwc_modpow.c
new file mode 100644
index 0000000000000..20045381208a3
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_modpow.c
@@ -0,0 +1,636 @@
+/* Bignum routines adapted from PUTTY sources.  PuTTY copyright notice follows.
+ *
+ * PuTTY is copyright 1997-2007 Simon Tatham.
+ *
+ * Portions copyright Robert de Bath, Joris van Rantwijk, Delian
+ * Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry,
+ * Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus
+ * Kuhn, and CORE SDI S.A.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE
+ * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+#ifdef DWC_CRYPTOLIB
+
+#ifndef CONFIG_MACH_IPMATE
+
+#include "dwc_modpow.h"
+
+#define BIGNUM_INT_MASK  0xFFFFFFFFUL
+#define BIGNUM_TOP_BIT   0x80000000UL
+#define BIGNUM_INT_BITS  32
+
+
+static void *snmalloc(void *mem_ctx, size_t n, size_t size)
+{
+    void *p;
+    size *= n;
+    if (size == 0) size = 1;
+    p = dwc_alloc(mem_ctx, size);
+    return p;
+}
+
+#define snewn(ctx, n, type) ((type *)snmalloc((ctx), (n), sizeof(type)))
+#define sfree dwc_free
+
+/*
+ * Usage notes:
+ *  * Do not call the DIVMOD_WORD macro with expressions such as array
+ *    subscripts, as some implementations object to this (see below).
+ *  * Note that none of the division methods below will cope if the
+ *    quotient won't fit into BIGNUM_INT_BITS. Callers should be careful
+ *    to avoid this case.
+ *    If this condition occurs, in the case of the x86 DIV instruction,
+ *    an overflow exception will occur, which (according to a correspondent)
+ *    will manifest on Windows as something like
+ *      0xC0000095: Integer overflow
+ *    The C variant won't give the right answer, either.
+ */
+
+#define MUL_WORD(w1, w2) ((BignumDblInt)w1 * w2)
+
+#if defined __GNUC__ && defined __i386__
+#define DIVMOD_WORD(q, r, hi, lo, w) \
+    __asm__("div %2" : \
+	    "=d" (r), "=a" (q) : \
+	    "r" (w), "d" (hi), "a" (lo))
+#else
+#define DIVMOD_WORD(q, r, hi, lo, w) do { \
+    BignumDblInt n = (((BignumDblInt)hi) << BIGNUM_INT_BITS) | lo; \
+    q = n / w; \
+    r = n % w; \
+} while (0)
+#endif
+
+//    q = n / w;
+//    r = n % w;
+
+#define BIGNUM_INT_BYTES (BIGNUM_INT_BITS / 8)
+
+#define BIGNUM_INTERNAL
+
+static Bignum newbn(void *mem_ctx, int length)
+{
+    Bignum b = snewn(mem_ctx, length + 1, BignumInt);
+    //if (!b)
+    //abort();		       /* FIXME */
+    DWC_MEMSET(b, 0, (length + 1) * sizeof(*b));
+    b[0] = length;
+    return b;
+}
+
+void freebn(void *mem_ctx, Bignum b)
+{
+    /*
+     * Burn the evidence, just in case.
+     */
+    DWC_MEMSET(b, 0, sizeof(b[0]) * (b[0] + 1));
+    sfree(mem_ctx, b);
+}
+
+/*
+ * Compute c = a * b.
+ * Input is in the first len words of a and b.
+ * Result is returned in the first 2*len words of c.
+ */
+static void internal_mul(BignumInt *a, BignumInt *b,
+			 BignumInt *c, int len)
+{
+    int i, j;
+    BignumDblInt t;
+
+    for (j = 0; j < 2 * len; j++)
+	c[j] = 0;
+
+    for (i = len - 1; i >= 0; i--) {
+	t = 0;
+	for (j = len - 1; j >= 0; j--) {
+	    t += MUL_WORD(a[i], (BignumDblInt) b[j]);
+	    t += (BignumDblInt) c[i + j + 1];
+	    c[i + j + 1] = (BignumInt) t;
+	    t = t >> BIGNUM_INT_BITS;
+	}
+	c[i] = (BignumInt) t;
+    }
+}
+
+static void internal_add_shifted(BignumInt *number,
+				 unsigned n, int shift)
+{
+    int word = 1 + (shift / BIGNUM_INT_BITS);
+    int bshift = shift % BIGNUM_INT_BITS;
+    BignumDblInt addend;
+
+    addend = (BignumDblInt)n << bshift;
+
+    while (addend) {
+	addend += number[word];
+	number[word] = (BignumInt) addend & BIGNUM_INT_MASK;
+	addend >>= BIGNUM_INT_BITS;
+	word++;
+    }
+}
+
+/*
+ * Compute a = a % m.
+ * Input in first alen words of a and first mlen words of m.
+ * Output in first alen words of a
+ * (of which first alen-mlen words will be zero).
+ * The MSW of m MUST have its high bit set.
+ * Quotient is accumulated in the `quotient' array, which is a Bignum
+ * rather than the internal bigendian format. Quotient parts are shifted
+ * left by `qshift' before adding into quot.
+ */
+static void internal_mod(BignumInt *a, int alen,
+			 BignumInt *m, int mlen,
+			 BignumInt *quot, int qshift)
+{
+    BignumInt m0, m1;
+    unsigned int h;
+    int i, k;
+
+    m0 = m[0];
+    if (mlen > 1)
+	m1 = m[1];
+    else
+	m1 = 0;
+
+    for (i = 0; i <= alen - mlen; i++) {
+	BignumDblInt t;
+	unsigned int q, r, c, ai1;
+
+	if (i == 0) {
+	    h = 0;
+	} else {
+	    h = a[i - 1];
+	    a[i - 1] = 0;
+	}
+
+	if (i == alen - 1)
+	    ai1 = 0;
+	else
+	    ai1 = a[i + 1];
+
+	/* Find q = h:a[i] / m0 */
+	if (h >= m0) {
+	    /*
+	     * Special case.
+	     *
+	     * To illustrate it, suppose a BignumInt is 8 bits, and
+	     * we are dividing (say) A1:23:45:67 by A1:B2:C3. Then
+	     * our initial division will be 0xA123 / 0xA1, which
+	     * will give a quotient of 0x100 and a divide overflow.
+	     * However, the invariants in this division algorithm
+	     * are not violated, since the full number A1:23:... is
+	     * _less_ than the quotient prefix A1:B2:... and so the
+	     * following correction loop would have sorted it out.
+	     *
+	     * In this situation we set q to be the largest
+	     * quotient we _can_ stomach (0xFF, of course).
+	     */
+	    q = BIGNUM_INT_MASK;
+	} else {
+	    /* Macro doesn't want an array subscript expression passed
+	     * into it (see definition), so use a temporary. */
+	    BignumInt tmplo = a[i];
+	    DIVMOD_WORD(q, r, h, tmplo, m0);
+
+	    /* Refine our estimate of q by looking at
+	     h:a[i]:a[i+1] / m0:m1 */
+	    t = MUL_WORD(m1, q);
+	    if (t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) {
+		q--;
+		t -= m1;
+		r = (r + m0) & BIGNUM_INT_MASK;     /* overflow? */
+		if (r >= (BignumDblInt) m0 &&
+		    t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) q--;
+	    }
+	}
+
+	/* Subtract q * m from a[i...] */
+	c = 0;
+	for (k = mlen - 1; k >= 0; k--) {
+	    t = MUL_WORD(q, m[k]);
+	    t += c;
+	    c = (unsigned)(t >> BIGNUM_INT_BITS);
+	    if ((BignumInt) t > a[i + k])
+		c++;
+	    a[i + k] -= (BignumInt) t;
+	}
+
+	/* Add back m in case of borrow */
+	if (c != h) {
+	    t = 0;
+	    for (k = mlen - 1; k >= 0; k--) {
+		t += m[k];
+		t += a[i + k];
+		a[i + k] = (BignumInt) t;
+		t = t >> BIGNUM_INT_BITS;
+	    }
+	    q--;
+	}
+	if (quot)
+	    internal_add_shifted(quot, q, qshift + BIGNUM_INT_BITS * (alen - mlen - i));
+    }
+}
+
+/*
+ * Compute p % mod.
+ * The most significant word of mod MUST be non-zero.
+ * We assume that the result array is the same size as the mod array.
+ * We optionally write out a quotient if `quotient' is non-NULL.
+ * We can avoid writing out the result if `result' is NULL.
+ */
+void bigdivmod(void *mem_ctx, Bignum p, Bignum mod, Bignum result, Bignum quotient)
+{
+    BignumInt *n, *m;
+    int mshift;
+    int plen, mlen, i, j;
+
+    /* Allocate m of size mlen, copy mod to m */
+    /* We use big endian internally */
+    mlen = mod[0];
+    m = snewn(mem_ctx, mlen, BignumInt);
+    //if (!m)
+    //abort();		       /* FIXME */
+    for (j = 0; j < mlen; j++)
+	m[j] = mod[mod[0] - j];
+
+    /* Shift m left to make msb bit set */
+    for (mshift = 0; mshift < BIGNUM_INT_BITS-1; mshift++)
+	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
+	    break;
+    if (mshift) {
+	for (i = 0; i < mlen - 1; i++)
+	    m[i] = (m[i] << mshift) | (m[i + 1] >> (BIGNUM_INT_BITS - mshift));
+	m[mlen - 1] = m[mlen - 1] << mshift;
+    }
+
+    plen = p[0];
+    /* Ensure plen > mlen */
+    if (plen <= mlen)
+	plen = mlen + 1;
+
+    /* Allocate n of size plen, copy p to n */
+    n = snewn(mem_ctx, plen, BignumInt);
+    //if (!n)
+    //abort();		       /* FIXME */
+    for (j = 0; j < plen; j++)
+	n[j] = 0;
+    for (j = 1; j <= (int)p[0]; j++)
+	n[plen - j] = p[j];
+
+    /* Main computation */
+    internal_mod(n, plen, m, mlen, quotient, mshift);
+
+    /* Fixup result in case the modulus was shifted */
+    if (mshift) {
+	for (i = plen - mlen - 1; i < plen - 1; i++)
+	    n[i] = (n[i] << mshift) | (n[i + 1] >> (BIGNUM_INT_BITS - mshift));
+	n[plen - 1] = n[plen - 1] << mshift;
+	internal_mod(n, plen, m, mlen, quotient, 0);
+	for (i = plen - 1; i >= plen - mlen; i--)
+	    n[i] = (n[i] >> mshift) | (n[i - 1] << (BIGNUM_INT_BITS - mshift));
+    }
+
+    /* Copy result to buffer */
+    if (result) {
+	for (i = 1; i <= (int)result[0]; i++) {
+	    int j = plen - i;
+	    result[i] = j >= 0 ? n[j] : 0;
+	}
+    }
+
+    /* Free temporary arrays */
+    for (i = 0; i < mlen; i++)
+	m[i] = 0;
+    sfree(mem_ctx, m);
+    for (i = 0; i < plen; i++)
+	n[i] = 0;
+    sfree(mem_ctx, n);
+}
+
+/*
+ * Simple remainder.
+ */
+Bignum bigmod(void *mem_ctx, Bignum a, Bignum b)
+{
+    Bignum r = newbn(mem_ctx, b[0]);
+    bigdivmod(mem_ctx, a, b, r, NULL);
+    return r;
+}
+
+/*
+ * Compute (base ^ exp) % mod.
+ */
+Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod)
+{
+    BignumInt *a, *b, *n, *m;
+    int mshift;
+    int mlen, i, j;
+    Bignum base, result;
+
+    /*
+     * The most significant word of mod needs to be non-zero. It
+     * should already be, but let's make sure.
+     */
+    //assert(mod[mod[0]] != 0);
+
+    /*
+     * Make sure the base is smaller than the modulus, by reducing
+     * it modulo the modulus if not.
+     */
+    base = bigmod(mem_ctx, base_in, mod);
+
+    /* Allocate m of size mlen, copy mod to m */
+    /* We use big endian internally */
+    mlen = mod[0];
+    m = snewn(mem_ctx, mlen, BignumInt);
+    //if (!m)
+    //abort();		       /* FIXME */
+    for (j = 0; j < mlen; j++)
+	m[j] = mod[mod[0] - j];
+
+    /* Shift m left to make msb bit set */
+    for (mshift = 0; mshift < BIGNUM_INT_BITS - 1; mshift++)
+	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
+	    break;
+    if (mshift) {
+	for (i = 0; i < mlen - 1; i++)
+	    m[i] =
+		(m[i] << mshift) | (m[i + 1] >>
+				    (BIGNUM_INT_BITS - mshift));
+	m[mlen - 1] = m[mlen - 1] << mshift;
+    }
+
+    /* Allocate n of size mlen, copy base to n */
+    n = snewn(mem_ctx, mlen, BignumInt);
+    //if (!n)
+    //abort();		       /* FIXME */
+    i = mlen - base[0];
+    for (j = 0; j < i; j++)
+	n[j] = 0;
+    for (j = 0; j < base[0]; j++)
+	n[i + j] = base[base[0] - j];
+
+    /* Allocate a and b of size 2*mlen. Set a = 1 */
+    a = snewn(mem_ctx, 2 * mlen, BignumInt);
+    //if (!a)
+    //abort();		       /* FIXME */
+    b = snewn(mem_ctx, 2 * mlen, BignumInt);
+    //if (!b)
+    //abort();		       /* FIXME */
+    for (i = 0; i < 2 * mlen; i++)
+	a[i] = 0;
+    a[2 * mlen - 1] = 1;
+
+    /* Skip leading zero bits of exp. */
+    i = 0;
+    j = BIGNUM_INT_BITS - 1;
+    while (i < exp[0] && (exp[exp[0] - i] & (1 << j)) == 0) {
+	j--;
+	if (j < 0) {
+	    i++;
+	    j = BIGNUM_INT_BITS - 1;
+	}
+    }
+
+    /* Main computation */
+    while (i < exp[0]) {
+	while (j >= 0) {
+	    internal_mul(a + mlen, a + mlen, b, mlen);
+	    internal_mod(b, mlen * 2, m, mlen, NULL, 0);
+	    if ((exp[exp[0] - i] & (1 << j)) != 0) {
+		internal_mul(b + mlen, n, a, mlen);
+		internal_mod(a, mlen * 2, m, mlen, NULL, 0);
+	    } else {
+		BignumInt *t;
+		t = a;
+		a = b;
+		b = t;
+	    }
+	    j--;
+	}
+	i++;
+	j = BIGNUM_INT_BITS - 1;
+    }
+
+    /* Fixup result in case the modulus was shifted */
+    if (mshift) {
+	for (i = mlen - 1; i < 2 * mlen - 1; i++)
+	    a[i] =
+		(a[i] << mshift) | (a[i + 1] >>
+				    (BIGNUM_INT_BITS - mshift));
+	a[2 * mlen - 1] = a[2 * mlen - 1] << mshift;
+	internal_mod(a, mlen * 2, m, mlen, NULL, 0);
+	for (i = 2 * mlen - 1; i >= mlen; i--)
+	    a[i] =
+		(a[i] >> mshift) | (a[i - 1] <<
+				    (BIGNUM_INT_BITS - mshift));
+    }
+
+    /* Copy result to buffer */
+    result = newbn(mem_ctx, mod[0]);
+    for (i = 0; i < mlen; i++)
+	result[result[0] - i] = a[i + mlen];
+    while (result[0] > 1 && result[result[0]] == 0)
+	result[0]--;
+
+    /* Free temporary arrays */
+    for (i = 0; i < 2 * mlen; i++)
+	a[i] = 0;
+    sfree(mem_ctx, a);
+    for (i = 0; i < 2 * mlen; i++)
+	b[i] = 0;
+    sfree(mem_ctx, b);
+    for (i = 0; i < mlen; i++)
+	m[i] = 0;
+    sfree(mem_ctx, m);
+    for (i = 0; i < mlen; i++)
+	n[i] = 0;
+    sfree(mem_ctx, n);
+
+    freebn(mem_ctx, base);
+
+    return result;
+}
+
+
+#ifdef UNITTEST
+
+static __u32 dh_p[] = {
+	96,
+	0xFFFFFFFF,
+	0xFFFFFFFF,
+	0xA93AD2CA,
+	0x4B82D120,
+	0xE0FD108E,
+	0x43DB5BFC,
+	0x74E5AB31,
+	0x08E24FA0,
+	0xBAD946E2,
+	0x770988C0,
+	0x7A615D6C,
+	0xBBE11757,
+	0x177B200C,
+	0x521F2B18,
+	0x3EC86A64,
+	0xD8760273,
+	0xD98A0864,
+	0xF12FFA06,
+	0x1AD2EE6B,
+	0xCEE3D226,
+	0x4A25619D,
+	0x1E8C94E0,
+	0xDB0933D7,
+	0xABF5AE8C,
+	0xA6E1E4C7,
+	0xB3970F85,
+	0x5D060C7D,
+	0x8AEA7157,
+	0x58DBEF0A,
+	0xECFB8504,
+	0xDF1CBA64,
+	0xA85521AB,
+	0x04507A33,
+	0xAD33170D,
+	0x8AAAC42D,
+	0x15728E5A,
+	0x98FA0510,
+	0x15D22618,
+	0xEA956AE5,
+	0x3995497C,
+	0x95581718,
+	0xDE2BCBF6,
+	0x6F4C52C9,
+	0xB5C55DF0,
+	0xEC07A28F,
+	0x9B2783A2,
+	0x180E8603,
+	0xE39E772C,
+	0x2E36CE3B,
+	0x32905E46,
+	0xCA18217C,
+	0xF1746C08,
+	0x4ABC9804,
+	0x670C354E,
+	0x7096966D,
+	0x9ED52907,
+	0x208552BB,
+	0x1C62F356,
+	0xDCA3AD96,
+	0x83655D23,
+	0xFD24CF5F,
+	0x69163FA8,
+	0x1C55D39A,
+	0x98DA4836,
+	0xA163BF05,
+	0xC2007CB8,
+	0xECE45B3D,
+	0x49286651,
+	0x7C4B1FE6,
+	0xAE9F2411,
+	0x5A899FA5,
+	0xEE386BFB,
+	0xF406B7ED,
+	0x0BFF5CB6,
+	0xA637ED6B,
+	0xF44C42E9,
+	0x625E7EC6,
+	0xE485B576,
+	0x6D51C245,
+	0x4FE1356D,
+	0xF25F1437,
+	0x302B0A6D,
+	0xCD3A431B,
+	0xEF9519B3,
+	0x8E3404DD,
+	0x514A0879,
+	0x3B139B22,
+	0x020BBEA6,
+	0x8A67CC74,
+	0x29024E08,
+	0x80DC1CD1,
+	0xC4C6628B,
+	0x2168C234,
+	0xC90FDAA2,
+	0xFFFFFFFF,
+	0xFFFFFFFF,
+};
+
+static __u32 dh_a[] = {
+	8,
+	0xdf367516,
+	0x86459caa,
+	0xe2d459a4,
+	0xd910dae0,
+	0x8a8b5e37,
+	0x67ab31c6,
+	0xf0b55ea9,
+	0x440051d6,
+};
+
+static __u32 dh_b[] = {
+	8,
+	0xded92656,
+	0xe07a048a,
+	0x6fa452cd,
+	0x2df89d30,
+	0xc75f1b0f,
+	0x8ce3578f,
+	0x7980a324,
+	0x5daec786,
+};
+
+static __u32 dh_g[] = {
+	1,
+	2,
+};
+
+int main(void)
+{
+	int i;
+	__u32 *k;
+	k = dwc_modpow(NULL, dh_g, dh_a, dh_p);
+
+	printf("\n\n");
+	for (i=0; i<k[0]; i++) {
+		__u32 word32 = k[k[0] - i];
+		__u16 l = word32 & 0xffff;
+		__u16 m = (word32 & 0xffff0000) >> 16;
+		printf("%04x %04x ", m, l);
+		if (!((i + 1)%13)) printf("\n");
+	}
+	printf("\n\n");
+
+	if ((k[0] == 0x60) && (k[1] == 0x28e490e5) && (k[0x60] == 0x5a0d3d4e)) {
+		printf("PASS\n\n");
+	}
+	else {
+		printf("FAIL\n\n");
+	}
+
+}
+
+#endif /* UNITTEST */
+
+#endif /* CONFIG_MACH_IPMATE */
+
+#endif /*DWC_CRYPTOLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_modpow.h b/drivers/usb/host/dwc_common_port/dwc_modpow.h
new file mode 100644
index 0000000000000..64f00c276e71b
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_modpow.h
@@ -0,0 +1,34 @@
+/*
+ * dwc_modpow.h
+ * See dwc_modpow.c for license and changes
+ */
+#ifndef _DWC_MODPOW_H
+#define _DWC_MODPOW_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dwc_os.h"
+
+/** @file
+ *
+ * This file defines the module exponentiation function which is only used
+ * internally by the DWC UWB modules for calculation of PKs during numeric
+ * association.  The routine is taken from the PUTTY, an open source terminal
+ * emulator.  The PUTTY License is preserved in the dwc_modpow.c file.
+ *
+ */
+
+typedef uint32_t BignumInt;
+typedef uint64_t BignumDblInt;
+typedef BignumInt *Bignum;
+
+/* Compute modular exponentiaion */
+extern Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LINUX_BIGNUM_H */
diff --git a/drivers/usb/host/dwc_common_port/dwc_notifier.c b/drivers/usb/host/dwc_common_port/dwc_notifier.c
new file mode 100644
index 0000000000000..8b3772afe11d1
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_notifier.c
@@ -0,0 +1,319 @@
+#ifdef DWC_NOTIFYLIB
+
+#include "dwc_notifier.h"
+#include "dwc_list.h"
+
+typedef struct dwc_observer {
+	void *observer;
+	dwc_notifier_callback_t callback;
+	void *data;
+	char *notification;
+	DWC_CIRCLEQ_ENTRY(dwc_observer) list_entry;
+} observer_t;
+
+DWC_CIRCLEQ_HEAD(observer_queue, dwc_observer);
+
+typedef struct dwc_notifier {
+	void *mem_ctx;
+	void *object;
+	struct observer_queue observers;
+	DWC_CIRCLEQ_ENTRY(dwc_notifier) list_entry;
+} notifier_t;
+
+DWC_CIRCLEQ_HEAD(notifier_queue, dwc_notifier);
+
+typedef struct manager {
+	void *mem_ctx;
+	void *wkq_ctx;
+	dwc_workq_t *wq;
+//	dwc_mutex_t *mutex;
+	struct notifier_queue notifiers;
+} manager_t;
+
+static manager_t *manager = NULL;
+
+static int create_manager(void *mem_ctx, void *wkq_ctx)
+{
+	manager = dwc_alloc(mem_ctx, sizeof(manager_t));
+	if (!manager) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_CIRCLEQ_INIT(&manager->notifiers);
+
+	manager->wq = dwc_workq_alloc(wkq_ctx, "DWC Notification WorkQ");
+	if (!manager->wq) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	return 0;
+}
+
+static void free_manager(void)
+{
+	dwc_workq_free(manager->wq);
+
+	/* All notifiers must have unregistered themselves before this module
+	 * can be removed.  Hitting this assertion indicates a programmer
+	 * error. */
+	DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&manager->notifiers),
+		   "Notification manager being freed before all notifiers have been removed");
+	dwc_free(manager->mem_ctx, manager);
+}
+
+#ifdef DEBUG
+static void dump_manager(void)
+{
+	notifier_t *n;
+	observer_t *o;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	DWC_DEBUG("List of all notifiers and observers:\n");
+	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
+		DWC_DEBUG("Notifier %p has observers:\n", n->object);
+		DWC_CIRCLEQ_FOREACH(o, &n->observers, list_entry) {
+			DWC_DEBUG("    %p watching %s\n", o->observer, o->notification);
+		}
+	}
+}
+#else
+#define dump_manager(...)
+#endif
+
+static observer_t *alloc_observer(void *mem_ctx, void *observer, char *notification,
+				  dwc_notifier_callback_t callback, void *data)
+{
+	observer_t *new_observer = dwc_alloc(mem_ctx, sizeof(observer_t));
+
+	if (!new_observer) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INIT_ENTRY(new_observer, list_entry);
+	new_observer->observer = observer;
+	new_observer->notification = notification;
+	new_observer->callback = callback;
+	new_observer->data = data;
+	return new_observer;
+}
+
+static void free_observer(void *mem_ctx, observer_t *observer)
+{
+	dwc_free(mem_ctx, observer);
+}
+
+static notifier_t *alloc_notifier(void *mem_ctx, void *object)
+{
+	notifier_t *notifier;
+
+	if (!object) {
+		return NULL;
+	}
+
+	notifier = dwc_alloc(mem_ctx, sizeof(notifier_t));
+	if (!notifier) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INIT(&notifier->observers);
+	DWC_CIRCLEQ_INIT_ENTRY(notifier, list_entry);
+
+	notifier->mem_ctx = mem_ctx;
+	notifier->object = object;
+	return notifier;
+}
+
+static void free_notifier(notifier_t *notifier)
+{
+	observer_t *observer;
+
+	DWC_CIRCLEQ_FOREACH(observer, &notifier->observers, list_entry) {
+		free_observer(notifier->mem_ctx, observer);
+	}
+
+	dwc_free(notifier->mem_ctx, notifier);
+}
+
+static notifier_t *find_notifier(void *object)
+{
+	notifier_t *notifier;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	if (!object) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_FOREACH(notifier, &manager->notifiers, list_entry) {
+		if (notifier->object == object) {
+			return notifier;
+		}
+	}
+
+	return NULL;
+}
+
+int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx)
+{
+	return create_manager(mem_ctx, wkq_ctx);
+}
+
+void dwc_free_notification_manager(void)
+{
+	free_manager();
+}
+
+dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object)
+{
+	notifier_t *notifier;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	notifier = find_notifier(object);
+	if (notifier) {
+		DWC_ERROR("Notifier %p is already registered\n", object);
+		return NULL;
+	}
+
+	notifier = alloc_notifier(mem_ctx, object);
+	if (!notifier) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INSERT_TAIL(&manager->notifiers, notifier, list_entry);
+
+	DWC_INFO("Notifier %p registered", object);
+	dump_manager();
+
+	return notifier;
+}
+
+void dwc_unregister_notifier(dwc_notifier_t *notifier)
+{
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	if (!DWC_CIRCLEQ_EMPTY(&notifier->observers)) {
+		observer_t *o;
+
+		DWC_ERROR("Notifier %p has active observers when removing\n", notifier->object);
+		DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
+			DWC_DEBUGC("    %p watching %s\n", o->observer, o->notification);
+		}
+
+		DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&notifier->observers),
+			   "Notifier %p has active observers when removing", notifier);
+	}
+
+	DWC_CIRCLEQ_REMOVE_INIT(&manager->notifiers, notifier, list_entry);
+	free_notifier(notifier);
+
+	DWC_INFO("Notifier unregistered");
+	dump_manager();
+}
+
+/* Add an observer to observe the notifier for a particular state, event, or notification. */
+int dwc_add_observer(void *observer, void *object, char *notification,
+		     dwc_notifier_callback_t callback, void *data)
+{
+	notifier_t *notifier = find_notifier(object);
+	observer_t *new_observer;
+
+	if (!notifier) {
+		DWC_ERROR("Notifier %p is not found when adding observer\n", object);
+		return -DWC_E_INVALID;
+	}
+
+	new_observer = alloc_observer(notifier->mem_ctx, observer, notification, callback, data);
+	if (!new_observer) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_CIRCLEQ_INSERT_TAIL(&notifier->observers, new_observer, list_entry);
+
+	DWC_INFO("Added observer %p to notifier %p observing notification %s, callback=%p, data=%p",
+		 observer, object, notification, callback, data);
+
+	dump_manager();
+	return 0;
+}
+
+int dwc_remove_observer(void *observer)
+{
+	notifier_t *n;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
+		observer_t *o;
+		observer_t *o2;
+
+		DWC_CIRCLEQ_FOREACH_SAFE(o, o2, &n->observers, list_entry) {
+			if (o->observer == observer) {
+				DWC_CIRCLEQ_REMOVE_INIT(&n->observers, o, list_entry);
+				DWC_INFO("Removing observer %p from notifier %p watching notification %s:",
+					 o->observer, n->object, o->notification);
+				free_observer(n->mem_ctx, o);
+			}
+		}
+	}
+
+	dump_manager();
+	return 0;
+}
+
+typedef struct callback_data {
+	void *mem_ctx;
+	dwc_notifier_callback_t cb;
+	void *observer;
+	void *data;
+	void *object;
+	char *notification;
+	void *notification_data;
+} cb_data_t;
+
+static void cb_task(void *data)
+{
+	cb_data_t *cb = (cb_data_t *)data;
+
+	cb->cb(cb->object, cb->notification, cb->observer, cb->notification_data, cb->data);
+	dwc_free(cb->mem_ctx, cb);
+}
+
+void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data)
+{
+	observer_t *o;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
+		int len = DWC_STRLEN(notification);
+
+		if (DWC_STRLEN(o->notification) != len) {
+			continue;
+		}
+
+		if (DWC_STRNCMP(o->notification, notification, len) == 0) {
+			cb_data_t *cb_data = dwc_alloc(notifier->mem_ctx, sizeof(cb_data_t));
+
+			if (!cb_data) {
+				DWC_ERROR("Failed to allocate callback data\n");
+				return;
+			}
+
+			cb_data->mem_ctx = notifier->mem_ctx;
+			cb_data->cb = o->callback;
+			cb_data->observer = o->observer;
+			cb_data->data = o->data;
+			cb_data->object = notifier->object;
+			cb_data->notification = notification;
+			cb_data->notification_data = notification_data;
+			DWC_DEBUGC("Observer found %p for notification %s\n", o->observer, notification);
+			DWC_WORKQ_SCHEDULE(manager->wq, cb_task, cb_data,
+					   "Notify callback from %p for Notification %s, to observer %p",
+					   cb_data->object, notification, cb_data->observer);
+		}
+	}
+}
+
+#endif	/* DWC_NOTIFYLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_notifier.h b/drivers/usb/host/dwc_common_port/dwc_notifier.h
new file mode 100644
index 0000000000000..4a8cdfe565b1f
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_notifier.h
@@ -0,0 +1,122 @@
+
+#ifndef __DWC_NOTIFIER_H__
+#define __DWC_NOTIFIER_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dwc_os.h"
+
+/** @file
+ *
+ * A simple implementation of the Observer pattern.  Any "module" can
+ * register as an observer or notifier.  The notion of "module" is abstract and
+ * can mean anything used to identify either an observer or notifier.  Usually
+ * it will be a pointer to a data structure which contains some state, ie an
+ * object.
+ *
+ * Before any notifiers can be added, the global notification manager must be
+ * brought up with dwc_alloc_notification_manager().
+ * dwc_free_notification_manager() will bring it down and free all resources.
+ * These would typically be called upon module load and unload.  The
+ * notification manager is a single global instance that handles all registered
+ * observable modules and observers so this should be done only once.
+ *
+ * A module can be observable by using Notifications to publicize some general
+ * information about it's state or operation.  It does not care who listens, or
+ * even if anyone listens, or what they do with the information.  The observable
+ * modules do not need to know any information about it's observers or their
+ * interface, or their state or data.
+ *
+ * Any module can register to emit Notifications.  It should publish a list of
+ * notifications that it can emit and their behavior, such as when they will get
+ * triggered, and what information will be provided to the observer.  Then it
+ * should register itself as an observable module. See dwc_register_notifier().
+ *
+ * Any module can observe any observable, registered module, provided it has a
+ * handle to the other module and knows what notifications to observe.  See
+ * dwc_add_observer().
+ *
+ * A function of type dwc_notifier_callback_t is called whenever a notification
+ * is triggered with one or more observers observing it.  This function is
+ * called in it's own process so it may sleep or block if needed.  It is
+ * guaranteed to be called sometime after the notification has occurred and will
+ * be called once per each time the notification is triggered.  It will NOT be
+ * called in the same process context used to trigger the notification.
+ *
+ * @section Limitiations
+ *
+ * Keep in mind that Notifications that can be triggered in rapid sucession may
+ * schedule too many processes too handle.  Be aware of this limitation when
+ * designing to use notifications, and only add notifications for appropriate
+ * observable information.
+ *
+ * Also Notification callbacks are not synchronous.  If you need to synchronize
+ * the behavior between module/observer you must use other means.  And perhaps
+ * that will mean Notifications are not the proper solution.
+ */
+
+struct dwc_notifier;
+typedef struct dwc_notifier dwc_notifier_t;
+
+/** The callback function must be of this type.
+ *
+ * @param object This is the object that is being observed.
+ * @param notification This is the notification that was triggered.
+ * @param observer This is the observer
+ * @param notification_data This is notification-specific data that the notifier
+ * has included in this notification.  The value of this should be published in
+ * the documentation of the observable module with the notifications.
+ * @param user_data This is any custom data that the observer provided when
+ * adding itself as an observer to the notification. */
+typedef void (*dwc_notifier_callback_t)(void *object, char *notification, void *observer,
+					void *notification_data, void *user_data);
+
+/** Brings up the notification manager. */
+extern int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx);
+/** Brings down the notification manager. */
+extern void dwc_free_notification_manager(void);
+
+/** This function registers an observable module.  A dwc_notifier_t object is
+ * returned to the observable module.  This is an opaque object that is used by
+ * the observable module to trigger notifications.  This object should only be
+ * accessible to functions that are authorized to trigger notifications for this
+ * module.  Observers do not need this object. */
+extern dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object);
+
+/** This function unregisters an observable module.  All observers have to be
+ * removed prior to unregistration. */
+extern void dwc_unregister_notifier(dwc_notifier_t *notifier);
+
+/** Add a module as an observer to the observable module.  The observable module
+ * needs to have previously registered with the notification manager.
+ *
+ * @param observer The observer module
+ * @param object The module to observe
+ * @param notification The notification to observe
+ * @param callback The callback function to call
+ * @param user_data Any additional user data to pass into the callback function */
+extern int dwc_add_observer(void *observer, void *object, char *notification,
+			    dwc_notifier_callback_t callback, void *user_data);
+
+/** Removes the specified observer from all notifications that it is currently
+ * observing. */
+extern int dwc_remove_observer(void *observer);
+
+/** This function triggers a Notification.  It should be called by the
+ * observable module, or any module or library which the observable module
+ * allows to trigger notification on it's behalf.  Such as the dwc_cc_t.
+ *
+ * dwc_notify is a non-blocking function.  Callbacks are scheduled called in
+ * their own process context for each trigger.  Callbacks can be blocking.
+ * dwc_notify can be called from interrupt context if needed.
+ *
+ */
+void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __DWC_NOTIFIER_H__ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_os.h b/drivers/usb/host/dwc_common_port/dwc_os.h
new file mode 100644
index 0000000000000..9a86d299403bd
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_os.h
@@ -0,0 +1,1276 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_os.h $
+ * $Revision: #14 $
+ * $Date: 2010/11/04 $
+ * $Change: 1621695 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifndef _DWC_OS_H_
+#define _DWC_OS_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * DWC portability library, low level os-wrapper functions
+ *
+ */
+
+/* These basic types need to be defined by some OS header file or custom header
+ * file for your specific target architecture.
+ *
+ * uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t, uint64_t, int64_t
+ *
+ * Any custom or alternate header file must be added and enabled here.
+ */
+
+#ifdef DWC_LINUX
+# include <linux/types.h>
+# ifdef CONFIG_DEBUG_MUTEXES
+#  include <linux/mutex.h>
+# endif
+# include <linux/spinlock.h>
+# include <linux/errno.h>
+# include <stdarg.h>
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+# include <os_dep.h>
+#endif
+
+
+/** @name Primitive Types and Values */
+
+/** We define a boolean type for consistency.  Can be either YES or NO */
+typedef uint8_t dwc_bool_t;
+#define YES  1
+#define NO   0
+
+#ifdef DWC_LINUX
+
+/** @name Error Codes */
+#define DWC_E_INVALID		EINVAL
+#define DWC_E_NO_MEMORY		ENOMEM
+#define DWC_E_NO_DEVICE		ENODEV
+#define DWC_E_NOT_SUPPORTED	EOPNOTSUPP
+#define DWC_E_TIMEOUT		ETIMEDOUT
+#define DWC_E_BUSY		EBUSY
+#define DWC_E_AGAIN		EAGAIN
+#define DWC_E_RESTART		ERESTART
+#define DWC_E_ABORT		ECONNABORTED
+#define DWC_E_SHUTDOWN		ESHUTDOWN
+#define DWC_E_NO_DATA		ENODATA
+#define DWC_E_DISCONNECT	ECONNRESET
+#define DWC_E_UNKNOWN		EINVAL
+#define DWC_E_NO_STREAM_RES	ENOSR
+#define DWC_E_COMMUNICATION	ECOMM
+#define DWC_E_OVERFLOW		EOVERFLOW
+#define DWC_E_PROTOCOL		EPROTO
+#define DWC_E_IN_PROGRESS	EINPROGRESS
+#define DWC_E_PIPE		EPIPE
+#define DWC_E_IO		EIO
+#define DWC_E_NO_SPACE		ENOSPC
+
+#else
+
+/** @name Error Codes */
+#define DWC_E_INVALID		1001
+#define DWC_E_NO_MEMORY		1002
+#define DWC_E_NO_DEVICE		1003
+#define DWC_E_NOT_SUPPORTED	1004
+#define DWC_E_TIMEOUT		1005
+#define DWC_E_BUSY		1006
+#define DWC_E_AGAIN		1007
+#define DWC_E_RESTART		1008
+#define DWC_E_ABORT		1009
+#define DWC_E_SHUTDOWN		1010
+#define DWC_E_NO_DATA		1011
+#define DWC_E_DISCONNECT	2000
+#define DWC_E_UNKNOWN		3000
+#define DWC_E_NO_STREAM_RES	4001
+#define DWC_E_COMMUNICATION	4002
+#define DWC_E_OVERFLOW		4003
+#define DWC_E_PROTOCOL		4004
+#define DWC_E_IN_PROGRESS	4005
+#define DWC_E_PIPE		4006
+#define DWC_E_IO		4007
+#define DWC_E_NO_SPACE		4008
+
+#endif
+
+
+/** @name Tracing/Logging Functions
+ *
+ * These function provide the capability to add tracing, debugging, and error
+ * messages, as well exceptions as assertions.  The WUDEV uses these
+ * extensively.  These could be logged to the main console, the serial port, an
+ * internal buffer, etc.  These functions could also be no-op if they are too
+ * expensive on your system.  By default undefining the DEBUG macro already
+ * no-ops some of these functions. */
+
+/** Returns non-zero if in interrupt context. */
+extern dwc_bool_t DWC_IN_IRQ(void);
+#define dwc_in_irq DWC_IN_IRQ
+
+/** Returns "IRQ" if DWC_IN_IRQ is true. */
+static inline char *dwc_irq(void) {
+	return DWC_IN_IRQ() ? "IRQ" : "";
+}
+
+/** Returns non-zero if in bottom-half context. */
+extern dwc_bool_t DWC_IN_BH(void);
+#define dwc_in_bh DWC_IN_BH
+
+/** Returns "BH" if DWC_IN_BH is true. */
+static inline char *dwc_bh(void) {
+	return DWC_IN_BH() ? "BH" : "";
+}
+
+/**
+ * A vprintf() clone.  Just call vprintf if you've got it.
+ */
+extern void DWC_VPRINTF(char *format, va_list args);
+#define dwc_vprintf DWC_VPRINTF
+
+/**
+ * A vsnprintf() clone.  Just call vprintf if you've got it.
+ */
+extern int DWC_VSNPRINTF(char *str, int size, char *format, va_list args);
+#define dwc_vsnprintf DWC_VSNPRINTF
+
+/**
+ * printf() clone.  Just call printf if you've go it.
+ */
+extern void DWC_PRINTF(char *format, ...)
+/* This provides compiler level static checking of the parameters if you're
+ * using GCC. */
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+#define dwc_printf DWC_PRINTF
+
+/**
+ * sprintf() clone.  Just call sprintf if you've got it.
+ */
+extern int DWC_SPRINTF(char *string, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 2, 3)));
+#else
+	;
+#endif
+#define dwc_sprintf DWC_SPRINTF
+
+/**
+ * snprintf() clone.  Just call snprintf if you've got it.
+ */
+extern int DWC_SNPRINTF(char *string, int size, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 3, 4)));
+#else
+	;
+#endif
+#define dwc_snprintf DWC_SNPRINTF
+
+/**
+ * Prints a WARNING message.  On systems that don't differentiate between
+ * warnings and regular log messages, just print it.  Indicates that something
+ * may be wrong with the driver.  Works like printf().
+ *
+ * Use the DWC_WARN macro to call this function.
+ */
+extern void __DWC_WARN(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+
+/**
+ * Prints an error message.  On systems that don't differentiate between errors
+ * and regular log messages, just print it.  Indicates that something went wrong
+ * with the driver.  Works like printf().
+ *
+ * Use the DWC_ERROR macro to call this function.
+ */
+extern void __DWC_ERROR(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+
+/**
+ * Prints an exception error message and takes some user-defined action such as
+ * print out a backtrace or trigger a breakpoint.  Indicates that something went
+ * abnormally wrong with the driver such as programmer error, or other
+ * exceptional condition.  It should not be ignored so even on systems without
+ * printing capability, some action should be taken to notify the developer of
+ * it.  Works like printf().
+ */
+extern void DWC_EXCEPTION(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+#define dwc_exception DWC_EXCEPTION
+
+#ifndef DWC_OTG_DEBUG_LEV
+#define DWC_OTG_DEBUG_LEV 0
+#endif
+
+#ifdef DEBUG
+/**
+ * Prints out a debug message.  Used for logging/trace messages.
+ *
+ * Use the DWC_DEBUG macro to call this function
+ */
+extern void __DWC_DEBUG(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+#else
+#define __DWC_DEBUG printk
+#endif
+
+/**
+ * Prints out a Debug message.
+ */
+#define DWC_DEBUG(_format, _args...) __DWC_DEBUG("DEBUG:%s:%s: " _format "\n", \
+						 __func__, dwc_irq(), ## _args)
+#define dwc_debug DWC_DEBUG
+/**
+ * Prints out a Debug message if enabled at compile time.
+ */
+#if DWC_OTG_DEBUG_LEV > 0
+#define DWC_DEBUGC(_format, _args...) DWC_DEBUG(_format, ##_args )
+#else
+#define DWC_DEBUGC(_format, _args...)
+#endif
+#define dwc_debugc DWC_DEBUGC
+/**
+ * Prints out an informative message.
+ */
+#define DWC_INFO(_format, _args...) DWC_PRINTF("INFO:%s: " _format "\n", \
+					       dwc_irq(), ## _args)
+#define dwc_info DWC_INFO
+/**
+ * Prints out an informative message if enabled at compile time.
+ */
+#if DWC_OTG_DEBUG_LEV > 1
+#define DWC_INFOC(_format, _args...) DWC_INFO(_format, ##_args )
+#else
+#define DWC_INFOC(_format, _args...)
+#endif
+#define dwc_infoc DWC_INFOC
+/**
+ * Prints out a warning message.
+ */
+#define DWC_WARN(_format, _args...) __DWC_WARN("WARN:%s:%s:%d: " _format "\n", \
+					dwc_irq(), __func__, __LINE__, ## _args)
+#define dwc_warn DWC_WARN
+/**
+ * Prints out an error message.
+ */
+#define DWC_ERROR(_format, _args...) __DWC_ERROR("ERROR:%s:%s:%d: " _format "\n", \
+					dwc_irq(), __func__, __LINE__, ## _args)
+#define dwc_error DWC_ERROR
+
+#define DWC_PROTO_ERROR(_format, _args...) __DWC_WARN("ERROR:%s:%s:%d: " _format "\n", \
+						dwc_irq(), __func__, __LINE__, ## _args)
+#define dwc_proto_error DWC_PROTO_ERROR
+
+#ifdef DEBUG
+/** Prints out a exception error message if the _expr expression fails.  Disabled
+ * if DEBUG is not enabled. */
+#define DWC_ASSERT(_expr, _format, _args...) do { \
+	if (!(_expr)) { DWC_EXCEPTION("%s:%s:%d: " _format "\n", dwc_irq(), \
+				      __FILE__, __LINE__, ## _args); } \
+	} while (0)
+#else
+#define DWC_ASSERT(_x...)
+#endif
+#define dwc_assert DWC_ASSERT
+
+
+/** @name Byte Ordering
+ * The following functions are for conversions between processor's byte ordering
+ * and specific ordering you want.
+ */
+
+/** Converts 32 bit data in CPU byte ordering to little endian. */
+extern uint32_t DWC_CPU_TO_LE32(uint32_t *p);
+#define dwc_cpu_to_le32 DWC_CPU_TO_LE32
+
+/** Converts 32 bit data in CPU byte orderint to big endian. */
+extern uint32_t DWC_CPU_TO_BE32(uint32_t *p);
+#define dwc_cpu_to_be32 DWC_CPU_TO_BE32
+
+/** Converts 32 bit little endian data to CPU byte ordering. */
+extern uint32_t DWC_LE32_TO_CPU(uint32_t *p);
+#define dwc_le32_to_cpu DWC_LE32_TO_CPU
+
+/** Converts 32 bit big endian data to CPU byte ordering. */
+extern uint32_t DWC_BE32_TO_CPU(uint32_t *p);
+#define dwc_be32_to_cpu DWC_BE32_TO_CPU
+
+/** Converts 16 bit data in CPU byte ordering to little endian. */
+extern uint16_t DWC_CPU_TO_LE16(uint16_t *p);
+#define dwc_cpu_to_le16 DWC_CPU_TO_LE16
+
+/** Converts 16 bit data in CPU byte orderint to big endian. */
+extern uint16_t DWC_CPU_TO_BE16(uint16_t *p);
+#define dwc_cpu_to_be16 DWC_CPU_TO_BE16
+
+/** Converts 16 bit little endian data to CPU byte ordering. */
+extern uint16_t DWC_LE16_TO_CPU(uint16_t *p);
+#define dwc_le16_to_cpu DWC_LE16_TO_CPU
+
+/** Converts 16 bit bi endian data to CPU byte ordering. */
+extern uint16_t DWC_BE16_TO_CPU(uint16_t *p);
+#define dwc_be16_to_cpu DWC_BE16_TO_CPU
+
+
+/** @name Register Read/Write
+ *
+ * The following six functions should be implemented to read/write registers of
+ * 32-bit and 64-bit sizes.  All modules use this to read/write register values.
+ * The reg value is a pointer to the register calculated from the void *base
+ * variable passed into the driver when it is started.  */
+
+#ifdef DWC_LINUX
+/* Linux doesn't need any extra parameters for register read/write, so we
+ * just throw away the IO context parameter.
+ */
+/** Reads the content of a 32-bit register. */
+extern uint32_t DWC_READ_REG32(uint32_t volatile *reg);
+#define dwc_read_reg32(_ctx_,_reg_) DWC_READ_REG32(_reg_)
+
+/** Reads the content of a 64-bit register. */
+extern uint64_t DWC_READ_REG64(uint64_t volatile *reg);
+#define dwc_read_reg64(_ctx_,_reg_) DWC_READ_REG64(_reg_)
+
+/** Writes to a 32-bit register. */
+extern void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value);
+#define dwc_write_reg32(_ctx_,_reg_,_val_) DWC_WRITE_REG32(_reg_, _val_)
+
+/** Writes to a 64-bit register. */
+extern void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value);
+#define dwc_write_reg64(_ctx_,_reg_,_val_) DWC_WRITE_REG64(_reg_, _val_)
+
+/**
+ * Modify bit values in a register.  Using the
+ * algorithm: (reg_contents & ~clear_mask) | set_mask.
+ */
+extern void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
+#define dwc_modify_reg32(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG32(_reg_,_cmsk_,_smsk_)
+extern void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
+#define dwc_modify_reg64(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG64(_reg_,_cmsk_,_smsk_)
+
+#endif	/* DWC_LINUX */
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+typedef struct dwc_ioctx {
+	struct device *dev;
+	bus_space_tag_t iot;
+	bus_space_handle_t ioh;
+} dwc_ioctx_t;
+
+/** BSD needs two extra parameters for register read/write, so we pass
+ * them in using the IO context parameter.
+ */
+/** Reads the content of a 32-bit register. */
+extern uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg);
+#define dwc_read_reg32 DWC_READ_REG32
+
+/** Reads the content of a 64-bit register. */
+extern uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg);
+#define dwc_read_reg64 DWC_READ_REG64
+
+/** Writes to a 32-bit register. */
+extern void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value);
+#define dwc_write_reg32 DWC_WRITE_REG32
+
+/** Writes to a 64-bit register. */
+extern void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value);
+#define dwc_write_reg64 DWC_WRITE_REG64
+
+/**
+ * Modify bit values in a register.  Using the
+ * algorithm: (reg_contents & ~clear_mask) | set_mask.
+ */
+extern void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
+#define dwc_modify_reg32 DWC_MODIFY_REG32
+extern void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
+#define dwc_modify_reg64 DWC_MODIFY_REG64
+
+#endif	/* DWC_FREEBSD || DWC_NETBSD */
+
+/** @cond */
+
+/** @name Some convenience MACROS used internally.  Define DWC_DEBUG_REGS to log the
+ * register writes. */
+
+#ifdef DWC_LINUX
+
+# ifdef DWC_DEBUG_REGS
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
+	return DWC_READ_REG32(&container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
+	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
+		  &(((uint32_t*)container->regs->_reg)[num]), data); \
+	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(_container_type *container) { \
+	return DWC_READ_REG32(&container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
+	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
+	DWC_WRITE_REG32(&container->regs->_reg, data); \
+}
+
+# else	/* DWC_DEBUG_REGS */
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
+	return DWC_READ_REG32(&container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
+	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(_container_type *container) { \
+	return DWC_READ_REG32(&container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
+	DWC_WRITE_REG32(&container->regs->_reg, data); \
+}
+
+# endif	/* DWC_DEBUG_REGS */
+
+#endif	/* DWC_LINUX */
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+
+# ifdef DWC_DEBUG_REGS
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
+	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
+		  &(((uint32_t*)container->regs->_reg)[num]), data); \
+	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
+	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
+	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
+}
+
+# else	/* DWC_DEBUG_REGS */
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
+	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
+	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
+}
+
+# endif	/* DWC_DEBUG_REGS */
+
+#endif	/* DWC_FREEBSD || DWC_NETBSD */
+
+/** @endcond */
+
+
+#ifdef DWC_CRYPTOLIB
+/** @name Crypto Functions
+ *
+ * These are the low-level cryptographic functions used by the driver. */
+
+/** Perform AES CBC */
+extern int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out);
+#define dwc_aes_cbc DWC_AES_CBC
+
+/** Fill the provided buffer with random bytes.  These should be cryptographic grade random numbers. */
+extern void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length);
+#define dwc_random_bytes DWC_RANDOM_BYTES
+
+/** Perform the SHA-256 hash function */
+extern int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out);
+#define dwc_sha256 DWC_SHA256
+
+/** Calculated the HMAC-SHA256 */
+extern int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t *out);
+#define dwc_hmac_sha256 DWC_HMAC_SHA256
+
+#endif	/* DWC_CRYPTOLIB */
+
+
+/** @name Memory Allocation
+ *
+ * These function provide access to memory allocation.  There are only 2 DMA
+ * functions and 3 Regular memory functions that need to be implemented.  None
+ * of the memory debugging routines need to be implemented.  The allocation
+ * routines all ZERO the contents of the memory.
+ *
+ * Defining DWC_DEBUG_MEMORY turns on memory debugging and statistic gathering.
+ * This checks for memory leaks, keeping track of alloc/free pairs.  It also
+ * keeps track of how much memory the driver is using at any given time. */
+
+#define DWC_PAGE_SIZE 4096
+#define DWC_PAGE_OFFSET(addr) (((uint32_t)addr) & 0xfff)
+#define DWC_PAGE_ALIGNED(addr) ((((uint32_t)addr) & 0xfff) == 0)
+
+#define DWC_INVALID_DMA_ADDR 0x0
+
+#ifdef DWC_LINUX
+/** Type for a DMA address */
+typedef dma_addr_t dwc_dma_t;
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+typedef bus_addr_t dwc_dma_t;
+#endif
+
+#ifdef DWC_FREEBSD
+typedef struct dwc_dmactx {
+	struct device *dev;
+	bus_dma_tag_t dma_tag;
+	bus_dmamap_t dma_map;
+	bus_addr_t dma_paddr;
+	void *dma_vaddr;
+} dwc_dmactx_t;
+#endif
+
+#ifdef DWC_NETBSD
+typedef struct dwc_dmactx {
+	struct device *dev;
+	bus_dma_tag_t dma_tag;
+	bus_dmamap_t dma_map;
+	bus_dma_segment_t segs[1];
+	int nsegs;
+	bus_addr_t dma_paddr;
+	void *dma_vaddr;
+} dwc_dmactx_t;
+#endif
+
+/* @todo these functions will be added in the future */
+#if 0
+/**
+ * Creates a DMA pool from which you can allocate DMA buffers.  Buffers
+ * allocated from this pool will be guaranteed to meet the size, alignment, and
+ * boundary requirements specified.
+ *
+ * @param[in] size Specifies the size of the buffers that will be allocated from
+ * this pool.
+ * @param[in] align Specifies the byte alignment requirements of the buffers
+ * allocated from this pool.  Must be a power of 2.
+ * @param[in] boundary Specifies the N-byte boundary that buffers allocated from
+ * this pool must not cross.
+ *
+ * @returns A pointer to an internal opaque structure which is not to be
+ * accessed outside of these library functions.  Use this handle to specify
+ * which pools to allocate/free DMA buffers from and also to destroy the pool,
+ * when you are done with it.
+ */
+extern dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size, uint32_t align, uint32_t boundary);
+
+/**
+ * Destroy a DMA pool.  All buffers allocated from that pool must be freed first.
+ */
+extern void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool);
+
+/**
+ * Allocate a buffer from the specified DMA pool and zeros its contents.
+ */
+extern void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr);
+
+/**
+ * Free a previously allocated buffer from the DMA pool.
+ */
+extern void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr);
+#endif
+
+/** Allocates a DMA capable buffer and zeroes its contents. */
+extern void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
+
+/** Allocates a DMA capable buffer and zeroes its contents in atomic contest */
+extern void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
+
+/** Frees a previously allocated buffer. */
+extern void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr);
+
+/** Allocates a block of memory and zeroes its contents. */
+extern void *__DWC_ALLOC(void *mem_ctx, uint32_t size);
+
+/** Allocates a block of memory and zeroes its contents, in an atomic manner
+ * which can be used inside interrupt context.  The size should be sufficiently
+ * small, a few KB at most, such that failures are not likely to occur.  Can just call
+ * __DWC_ALLOC if it is atomic. */
+extern void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size);
+
+/** Frees a previously allocated buffer. */
+extern void __DWC_FREE(void *mem_ctx, void *addr);
+
+#ifndef DWC_DEBUG_MEMORY
+
+#define DWC_ALLOC(_size_) __DWC_ALLOC(NULL, _size_)
+#define DWC_ALLOC_ATOMIC(_size_) __DWC_ALLOC_ATOMIC(NULL, _size_)
+#define DWC_FREE(_addr_) __DWC_FREE(NULL, _addr_)
+
+# ifdef DWC_LINUX
+#define DWC_DMA_ALLOC(_dev, _size_, _dma_) __DWC_DMA_ALLOC(_dev, _size_, _dma_)
+#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) __DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_)
+#define DWC_DMA_FREE(_dev, _size_,_virt_, _dma_) __DWC_DMA_FREE(_dev, _size_, _virt_, _dma_)
+# endif
+
+# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+#define DWC_DMA_ALLOC __DWC_DMA_ALLOC
+#define DWC_DMA_FREE __DWC_DMA_FREE
+# endif
+extern void *dwc_dma_alloc_atomic_debug(uint32_t size, dwc_dma_t *dma_addr, char const *func, int line);
+
+#else	/* DWC_DEBUG_MEMORY */
+
+extern void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line);
+extern void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func, int line);
+extern void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line);
+extern void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
+				 char const *func, int line);
+extern void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
+				char const *func, int line);
+extern void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
+			       dwc_dma_t dma_addr, char const *func, int line);
+
+extern int dwc_memory_debug_start(void *mem_ctx);
+extern void dwc_memory_debug_stop(void);
+extern void dwc_memory_debug_report(void);
+
+#define DWC_ALLOC(_size_) dwc_alloc_debug(NULL, _size_, __func__, __LINE__)
+#define DWC_ALLOC_ATOMIC(_size_) dwc_alloc_atomic_debug(NULL, _size_, \
+							__func__, __LINE__)
+#define DWC_FREE(_addr_) dwc_free_debug(NULL, _addr_, __func__, __LINE__)
+
+# ifdef DWC_LINUX
+#define DWC_DMA_ALLOC(_dev, _size_, _dma_) \
+	dwc_dma_alloc_debug(_dev, _size_, _dma_, __func__, __LINE__)
+#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) \
+	dwc_dma_alloc_atomic_debug(_dev, _size_, _dma_, __func__, __LINE__)
+#define DWC_DMA_FREE(_dev, _size_, _virt_, _dma_) \
+	dwc_dma_free_debug(_dev, _size_, _virt_, _dma_, __func__, __LINE__)
+# endif
+
+# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+#define DWC_DMA_ALLOC(_ctx_,_size_,_dma_) dwc_dma_alloc_debug(_ctx_, _size_, \
+						_dma_, __func__, __LINE__)
+#define DWC_DMA_FREE(_ctx_,_size_,_virt_,_dma_) dwc_dma_free_debug(_ctx_, _size_, \
+						 _virt_, _dma_, __func__, __LINE__)
+# endif
+
+#endif /* DWC_DEBUG_MEMORY */
+
+#define dwc_alloc(_ctx_,_size_) DWC_ALLOC(_size_)
+#define dwc_alloc_atomic(_ctx_,_size_) DWC_ALLOC_ATOMIC(_size_)
+#define dwc_free(_ctx_,_addr_) DWC_FREE(_addr_)
+
+#ifdef DWC_LINUX
+/* Linux doesn't need any extra parameters for DMA buffer allocation, so we
+ * just throw away the DMA context parameter.
+ */
+#define dwc_dma_alloc(_ctx_,_size_,_dma_) DWC_DMA_ALLOC(_size_, _dma_)
+#define dwc_dma_alloc_atomic(_ctx_,_size_,_dma_) DWC_DMA_ALLOC_ATOMIC(_size_, _dma_)
+#define dwc_dma_free(_ctx_,_size_,_virt_,_dma_) DWC_DMA_FREE(_size_, _virt_, _dma_)
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+/** BSD needs several extra parameters for DMA buffer allocation, so we pass
+ * them in using the DMA context parameter.
+ */
+#define dwc_dma_alloc DWC_DMA_ALLOC
+#define dwc_dma_free DWC_DMA_FREE
+#endif
+
+
+/** @name Memory and String Processing */
+
+/** memset() clone */
+extern void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size);
+#define dwc_memset DWC_MEMSET
+
+/** memcpy() clone */
+extern void *DWC_MEMCPY(void *dest, void const *src, uint32_t size);
+#define dwc_memcpy DWC_MEMCPY
+
+/** memmove() clone */
+extern void *DWC_MEMMOVE(void *dest, void *src, uint32_t size);
+#define dwc_memmove DWC_MEMMOVE
+
+/** memcmp() clone */
+extern int DWC_MEMCMP(void *m1, void *m2, uint32_t size);
+#define dwc_memcmp DWC_MEMCMP
+
+/** strcmp() clone */
+extern int DWC_STRCMP(void *s1, void *s2);
+#define dwc_strcmp DWC_STRCMP
+
+/** strncmp() clone */
+extern int DWC_STRNCMP(void *s1, void *s2, uint32_t size);
+#define dwc_strncmp DWC_STRNCMP
+
+/** strlen() clone, for NULL terminated ASCII strings */
+extern int DWC_STRLEN(char const *str);
+#define dwc_strlen DWC_STRLEN
+
+/** strcpy() clone, for NULL terminated ASCII strings */
+extern char *DWC_STRCPY(char *to, const char *from);
+#define dwc_strcpy DWC_STRCPY
+
+/** strdup() clone.  If you wish to use memory allocation debugging, this
+ * implementation of strdup should use the DWC_* memory routines instead of
+ * calling a predefined strdup.  Otherwise the memory allocated by this routine
+ * will not be seen by the debugging routines. */
+extern char *DWC_STRDUP(char const *str);
+#define dwc_strdup(_ctx_,_str_) DWC_STRDUP(_str_)
+
+/** NOT an atoi() clone.  Read the description carefully.  Returns an integer
+ * converted from the string str in base 10 unless the string begins with a "0x"
+ * in which case it is base 16.  String must be a NULL terminated sequence of
+ * ASCII characters and may optionally begin with whitespace, a + or -, and a
+ * "0x" prefix if base 16.  The remaining characters must be valid digits for
+ * the number and end with a NULL character.  If any invalid characters are
+ * encountered or it returns with a negative error code and the results of the
+ * conversion are undefined.  On sucess it returns 0.  Overflow conditions are
+ * undefined.  An example implementation using atoi() can be referenced from the
+ * Linux implementation. */
+extern int DWC_ATOI(const char *str, int32_t *value);
+#define dwc_atoi DWC_ATOI
+
+/** Same as above but for unsigned. */
+extern int DWC_ATOUI(const char *str, uint32_t *value);
+#define dwc_atoui DWC_ATOUI
+
+#ifdef DWC_UTFLIB
+/** This routine returns a UTF16LE unicode encoded string from a UTF8 string. */
+extern int DWC_UTF8_TO_UTF16LE(uint8_t const *utf8string, uint16_t *utf16string, unsigned len);
+#define dwc_utf8_to_utf16le DWC_UTF8_TO_UTF16LE
+#endif
+
+
+/** @name Wait queues
+ *
+ * Wait queues provide a means of synchronizing between threads or processes.  A
+ * process can block on a waitq if some condition is not true, waiting for it to
+ * become true.  When the waitq is triggered all waiting process will get
+ * unblocked and the condition will be check again.  Waitqs should be triggered
+ * every time a condition can potentially change.*/
+struct dwc_waitq;
+
+/** Type for a waitq */
+typedef struct dwc_waitq dwc_waitq_t;
+
+/** The type of waitq condition callback function.  This is called every time
+ * condition is evaluated. */
+typedef int (*dwc_waitq_condition_t)(void *data);
+
+/** Allocate a waitq */
+extern dwc_waitq_t *DWC_WAITQ_ALLOC(void);
+#define dwc_waitq_alloc(_ctx_) DWC_WAITQ_ALLOC()
+
+/** Free a waitq */
+extern void DWC_WAITQ_FREE(dwc_waitq_t *wq);
+#define dwc_waitq_free DWC_WAITQ_FREE
+
+/** Check the condition and if it is false, block on the waitq.  When unblocked, check the
+ * condition again.  The function returns when the condition becomes true.  The return value
+ * is 0 on condition true, DWC_WAITQ_ABORTED on abort or killed, or DWC_WAITQ_UNKNOWN on error. */
+extern int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data);
+#define dwc_waitq_wait DWC_WAITQ_WAIT
+
+/** Check the condition and if it is false, block on the waitq.  When unblocked,
+ * check the condition again.  The function returns when the condition become
+ * true or the timeout has passed.  The return value is 0 on condition true or
+ * DWC_TIMED_OUT on timeout, or DWC_WAITQ_ABORTED, or DWC_WAITQ_UNKNOWN on
+ * error. */
+extern int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+				      void *data, int32_t msecs);
+#define dwc_waitq_wait_timeout DWC_WAITQ_WAIT_TIMEOUT
+
+/** Trigger a waitq, unblocking all processes.  This should be called whenever a condition
+ * has potentially changed. */
+extern void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq);
+#define dwc_waitq_trigger DWC_WAITQ_TRIGGER
+
+/** Unblock all processes waiting on the waitq with an ABORTED result. */
+extern void DWC_WAITQ_ABORT(dwc_waitq_t *wq);
+#define dwc_waitq_abort DWC_WAITQ_ABORT
+
+
+/** @name Threads
+ *
+ * A thread must be explicitly stopped.  It must check DWC_THREAD_SHOULD_STOP
+ * whenever it is woken up, and then return.  The DWC_THREAD_STOP function
+ * returns the value from the thread.
+ */
+
+struct dwc_thread;
+
+/** Type for a thread */
+typedef struct dwc_thread dwc_thread_t;
+
+/** The thread function */
+typedef int (*dwc_thread_function_t)(void *data);
+
+/** Create a thread and start it running the thread_function.  Returns a handle
+ * to the thread */
+extern dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data);
+#define dwc_thread_run(_ctx_,_func_,_name_,_data_) DWC_THREAD_RUN(_func_, _name_, _data_)
+
+/** Stops a thread.  Return the value returned by the thread.  Or will return
+ * DWC_ABORT if the thread never started. */
+extern int DWC_THREAD_STOP(dwc_thread_t *thread);
+#define dwc_thread_stop DWC_THREAD_STOP
+
+/** Signifies to the thread that it must stop. */
+#ifdef DWC_LINUX
+/* Linux doesn't need any parameters for kthread_should_stop() */
+extern dwc_bool_t DWC_THREAD_SHOULD_STOP(void);
+#define dwc_thread_should_stop(_thrd_) DWC_THREAD_SHOULD_STOP()
+
+/* No thread_exit function in Linux */
+#define dwc_thread_exit(_thrd_)
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+/** BSD needs the thread pointer for kthread_suspend_check() */
+extern dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread);
+#define dwc_thread_should_stop DWC_THREAD_SHOULD_STOP
+
+/** The thread must call this to exit. */
+extern void DWC_THREAD_EXIT(dwc_thread_t *thread);
+#define dwc_thread_exit DWC_THREAD_EXIT
+#endif
+
+
+/** @name Work queues
+ *
+ * Workqs are used to queue a callback function to be called at some later time,
+ * in another thread. */
+struct dwc_workq;
+
+/** Type for a workq */
+typedef struct dwc_workq dwc_workq_t;
+
+/** The type of the callback function to be called. */
+typedef void (*dwc_work_callback_t)(void *data);
+
+/** Allocate a workq */
+extern dwc_workq_t *DWC_WORKQ_ALLOC(char *name);
+#define dwc_workq_alloc(_ctx_,_name_) DWC_WORKQ_ALLOC(_name_)
+
+/** Free a workq.  All work must be completed before being freed. */
+extern void DWC_WORKQ_FREE(dwc_workq_t *workq);
+#define dwc_workq_free DWC_WORKQ_FREE
+
+/** Schedule a callback on the workq, passing in data.  The function will be
+ * scheduled at some later time. */
+extern void DWC_WORKQ_SCHEDULE(dwc_workq_t *workq, dwc_work_callback_t cb,
+			       void *data, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 4, 5)));
+#else
+	;
+#endif
+#define dwc_workq_schedule DWC_WORKQ_SCHEDULE
+
+/** Schedule a callback on the workq, that will be called until at least
+ * given number miliseconds have passed. */
+extern void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *workq, dwc_work_callback_t cb,
+				       void *data, uint32_t time, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 5, 6)));
+#else
+	;
+#endif
+#define dwc_workq_schedule_delayed DWC_WORKQ_SCHEDULE_DELAYED
+
+/** The number of processes in the workq */
+extern int DWC_WORKQ_PENDING(dwc_workq_t *workq);
+#define dwc_workq_pending DWC_WORKQ_PENDING
+
+/** Blocks until all the work in the workq is complete or timed out.  Returns <
+ * 0 on timeout. */
+extern int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout);
+#define dwc_workq_wait_work_done DWC_WORKQ_WAIT_WORK_DONE
+
+
+/** @name Tasklets
+ *
+ */
+struct dwc_tasklet;
+
+/** Type for a tasklet */
+typedef struct dwc_tasklet dwc_tasklet_t;
+
+/** The type of the callback function to be called */
+typedef void (*dwc_tasklet_callback_t)(void *data);
+
+/** Allocates a tasklet */
+extern dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data);
+#define dwc_task_alloc(_ctx_,_name_,_cb_,_data_) DWC_TASK_ALLOC(_name_, _cb_, _data_)
+
+/** Frees a tasklet */
+extern void DWC_TASK_FREE(dwc_tasklet_t *task);
+#define dwc_task_free DWC_TASK_FREE
+
+/** Schedules a tasklet to run */
+extern void DWC_TASK_SCHEDULE(dwc_tasklet_t *task);
+#define dwc_task_schedule DWC_TASK_SCHEDULE
+
+extern void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task);
+#define dwc_task_hi_schedule DWC_TASK_HI_SCHEDULE
+
+/** @name Timer
+ *
+ * Callbacks must be small and atomic.
+ */
+struct dwc_timer;
+
+/** Type for a timer */
+typedef struct dwc_timer dwc_timer_t;
+
+/** The type of the callback function to be called */
+typedef void (*dwc_timer_callback_t)(void *data);
+
+/** Allocates a timer */
+extern dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data);
+#define dwc_timer_alloc(_ctx_,_name_,_cb_,_data_) DWC_TIMER_ALLOC(_name_,_cb_,_data_)
+
+/** Frees a timer */
+extern void DWC_TIMER_FREE(dwc_timer_t *timer);
+#define dwc_timer_free DWC_TIMER_FREE
+
+/** Schedules the timer to run at time ms from now.  And will repeat at every
+ * repeat_interval msec therafter
+ *
+ * Modifies a timer that is still awaiting execution to a new expiration time.
+ * The mod_time is added to the old time.  */
+extern void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time);
+#define dwc_timer_schedule DWC_TIMER_SCHEDULE
+
+/** Disables the timer from execution. */
+extern void DWC_TIMER_CANCEL(dwc_timer_t *timer);
+#define dwc_timer_cancel DWC_TIMER_CANCEL
+
+
+/** @name Spinlocks
+ *
+ * These locks are used when the work between the lock/unlock is atomic and
+ * short.  Interrupts are also disabled during the lock/unlock and thus they are
+ * suitable to lock between interrupt/non-interrupt context.  They also lock
+ * between processes if you have multiple CPUs or Preemption.  If you don't have
+ * multiple CPUS or Preemption, then the you can simply implement the
+ * DWC_SPINLOCK and DWC_SPINUNLOCK to disable and enable interrupts.  Because
+ * the work between the lock/unlock is atomic, the process context will never
+ * change, and so you never have to lock between processes.  */
+
+struct dwc_spinlock;
+
+/** Type for a spinlock */
+typedef struct dwc_spinlock dwc_spinlock_t;
+
+/** Type for the 'flags' argument to spinlock funtions */
+typedef unsigned long dwc_irqflags_t;
+
+/** Returns an initialized lock variable.  This function should allocate and
+ * initialize the OS-specific data structure used for locking.  This data
+ * structure is to be used for the DWC_LOCK and DWC_UNLOCK functions and should
+ * be freed by the DWC_FREE_LOCK when it is no longer used.
+ *
+ * For Linux Spinlock Debugging make it macro because the debugging routines use
+ * the symbol name to determine recursive locking. Using a wrapper function
+ * makes it falsely think recursive locking occurs. */
+#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK)
+#define DWC_SPINLOCK_ALLOC_LINUX_DEBUG(lock) ({ \
+	lock = DWC_ALLOC(sizeof(spinlock_t)); \
+	if (lock) { \
+		spin_lock_init((spinlock_t *)lock); \
+	} \
+})
+#else
+extern dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void);
+#define dwc_spinlock_alloc(_ctx_) DWC_SPINLOCK_ALLOC()
+#endif
+
+/** Frees an initialized lock variable. */
+extern void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock);
+#define dwc_spinlock_free(_ctx_,_lock_) DWC_SPINLOCK_FREE(_lock_)
+
+/** Disables interrupts and blocks until it acquires the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ * @param flags Unsigned long for irq flags storage.
+ */
+extern void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags);
+#define dwc_spinlock_irqsave DWC_SPINLOCK_IRQSAVE
+
+/** Re-enables the interrupt and releases the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ * @param flags Unsigned long for irq flags storage.  Must be the same as was
+ * passed into DWC_LOCK.
+ */
+extern void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags);
+#define dwc_spinunlock_irqrestore DWC_SPINUNLOCK_IRQRESTORE
+
+/** Blocks until it acquires the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ */
+extern void DWC_SPINLOCK(dwc_spinlock_t *lock);
+#define dwc_spinlock DWC_SPINLOCK
+
+/** Releases the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ */
+extern void DWC_SPINUNLOCK(dwc_spinlock_t *lock);
+#define dwc_spinunlock DWC_SPINUNLOCK
+
+
+/** @name Mutexes
+ *
+ * Unlike spinlocks Mutexes lock only between processes and the work between the
+ * lock/unlock CAN block, therefore it CANNOT be called from interrupt context.
+ */
+
+struct dwc_mutex;
+
+/** Type for a mutex */
+typedef struct dwc_mutex dwc_mutex_t;
+
+/* For Linux Mutex Debugging make it inline because the debugging routines use
+ * the symbol to determine recursive locking.  This makes it falsely think
+ * recursive locking occurs. */
+#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
+#define DWC_MUTEX_ALLOC_LINUX_DEBUG(__mutexp) ({ \
+	__mutexp = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex)); \
+	mutex_init((struct mutex *)__mutexp); \
+})
+#endif
+
+/** Allocate a mutex */
+extern dwc_mutex_t *DWC_MUTEX_ALLOC(void);
+#define dwc_mutex_alloc(_ctx_) DWC_MUTEX_ALLOC()
+
+/* For memory leak debugging when using Linux Mutex Debugging */
+#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
+#define DWC_MUTEX_FREE(__mutexp) do { \
+	mutex_destroy((struct mutex *)__mutexp); \
+	DWC_FREE(__mutexp); \
+} while(0)
+#else
+/** Free a mutex */
+extern void DWC_MUTEX_FREE(dwc_mutex_t *mutex);
+#define dwc_mutex_free(_ctx_,_mutex_) DWC_MUTEX_FREE(_mutex_)
+#endif
+
+/** Lock a mutex */
+extern void DWC_MUTEX_LOCK(dwc_mutex_t *mutex);
+#define dwc_mutex_lock DWC_MUTEX_LOCK
+
+/** Non-blocking lock returns 1 on successful lock. */
+extern int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex);
+#define dwc_mutex_trylock DWC_MUTEX_TRYLOCK
+
+/** Unlock a mutex */
+extern void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex);
+#define dwc_mutex_unlock DWC_MUTEX_UNLOCK
+
+
+/** @name Time */
+
+/** Microsecond delay.
+ *
+ * @param usecs  Microseconds to delay.
+ */
+extern void DWC_UDELAY(uint32_t usecs);
+#define dwc_udelay DWC_UDELAY
+
+/** Millisecond delay.
+ *
+ * @param msecs  Milliseconds to delay.
+ */
+extern void DWC_MDELAY(uint32_t msecs);
+#define dwc_mdelay DWC_MDELAY
+
+/** Non-busy waiting.
+ * Sleeps for specified number of milliseconds.
+ *
+ * @param msecs Milliseconds to sleep.
+ */
+extern void DWC_MSLEEP(uint32_t msecs);
+#define dwc_msleep DWC_MSLEEP
+
+/**
+ * Returns number of milliseconds since boot.
+ */
+extern uint32_t DWC_TIME(void);
+#define dwc_time DWC_TIME
+
+
+
+
+/* @mainpage DWC Portability and Common Library
+ *
+ * This is the documentation for the DWC Portability and Common Library.
+ *
+ * @section intro Introduction
+ *
+ * The DWC Portability library consists of wrapper calls and data structures to
+ * all low-level functions which are typically provided by the OS.  The WUDEV
+ * driver uses only these functions.  In order to port the WUDEV driver, only
+ * the functions in this library need to be re-implemented, with the same
+ * behavior as documented here.
+ *
+ * The Common library consists of higher level functions, which rely only on
+ * calling the functions from the DWC Portability library.  These common
+ * routines are shared across modules.  Some of the common libraries need to be
+ * used directly by the driver programmer when porting WUDEV.  Such as the
+ * parameter and notification libraries.
+ *
+ * @section low Portability Library OS Wrapper Functions
+ *
+ * Any function starting with DWC and in all CAPS is a low-level OS-wrapper that
+ * needs to be implemented when porting, for example DWC_MUTEX_ALLOC().  All of
+ * these functions are included in the dwc_os.h file.
+ *
+ * There are many functions here covering a wide array of OS services.  Please
+ * see dwc_os.h for details, and implementation notes for each function.
+ *
+ * @section common Common Library Functions
+ *
+ * Any function starting with dwc and in all lowercase is a common library
+ * routine.  These functions have a portable implementation and do not need to
+ * be reimplemented when porting.  The common routines can be used by any
+ * driver, and some must be used by the end user to control the drivers.  For
+ * example, you must use the Parameter common library in order to set the
+ * parameters in the WUDEV module.
+ *
+ * The common libraries consist of the following:
+ *
+ * - Connection Contexts - Used internally and can be used by end-user.  See dwc_cc.h
+ * - Parameters - Used internally and can be used by end-user.  See dwc_params.h
+ * - Notifications - Used internally and can be used by end-user.  See dwc_notifier.h
+ * - Lists - Used internally and can be used by end-user.  See dwc_list.h
+ * - Memory Debugging - Used internally and can be used by end-user.  See dwc_os.h
+ * - Modpow - Used internally only.  See dwc_modpow.h
+ * - DH - Used internally only.  See dwc_dh.h
+ * - Crypto - Used internally only.  See dwc_crypto.h
+ *
+ *
+ * @section prereq Prerequistes For dwc_os.h
+ * @subsection types Data Types
+ *
+ * The dwc_os.h file assumes that several low-level data types are pre defined for the
+ * compilation environment.  These data types are:
+ *
+ * - uint8_t - unsigned 8-bit data type
+ * - int8_t - signed 8-bit data type
+ * - uint16_t - unsigned 16-bit data type
+ * - int16_t - signed 16-bit data type
+ * - uint32_t - unsigned 32-bit data type
+ * - int32_t - signed 32-bit data type
+ * - uint64_t - unsigned 64-bit data type
+ * - int64_t - signed 64-bit data type
+ *
+ * Ensure that these are defined before using dwc_os.h.  The easiest way to do
+ * that is to modify the top of the file to include the appropriate header.
+ * This is already done for the Linux environment.  If the DWC_LINUX macro is
+ * defined, the correct header will be added.  A standard header <stdint.h> is
+ * also used for environments where standard C headers are available.
+ *
+ * @subsection stdarg Variable Arguments
+ *
+ * Variable arguments are provided by a standard C header <stdarg.h>.  it is
+ * available in Both the Linux and ANSI C enviornment.  An equivalent must be
+ * provided in your enviornment in order to use dwc_os.h with the debug and
+ * tracing message functionality.
+ *
+ * @subsection thread Threading
+ *
+ * WUDEV Core must be run on an operating system that provides for multiple
+ * threads/processes.  Threading can be implemented in many ways, even in
+ * embedded systems without an operating system.  At the bare minimum, the
+ * system should be able to start any number of processes at any time to handle
+ * special work.  It need not be a pre-emptive system.  Process context can
+ * change upon a call to a blocking function.  The hardware interrupt context
+ * that calls the module's ISR() function must be differentiable from process
+ * context, even if your processes are impemented via a hardware interrupt.
+ * Further locking mechanism between process must exist (or be implemented), and
+ * process context must have a way to disable interrupts for a period of time to
+ * lock them out.  If all of this exists, the functions in dwc_os.h related to
+ * threading should be able to be implemented with the defined behavior.
+ *
+ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_OS_H_ */
diff --git a/drivers/usb/host/dwc_common_port/usb.h b/drivers/usb/host/dwc_common_port/usb.h
new file mode 100644
index 0000000000000..27bda82dac2eb
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/usb.h
@@ -0,0 +1,946 @@
+/*
+ * Copyright (c) 1998 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Lennart Augustsson (lennart@augustsson.net) at
+ * Carlstedt Research & Technology.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *        This product includes software developed by the NetBSD
+ *        Foundation, Inc. and its contributors.
+ * 4. Neither the name of The NetBSD Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Modified by Synopsys, Inc, 12/12/2007 */
+
+
+#ifndef _USB_H_
+#define _USB_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * The USB records contain some unaligned little-endian word
+ * components.  The U[SG]ETW macros take care of both the alignment
+ * and endian problem and should always be used to access non-byte
+ * values.
+ */
+typedef u_int8_t uByte;
+typedef u_int8_t uWord[2];
+typedef u_int8_t uDWord[4];
+
+#define USETW2(w,h,l) ((w)[0] = (u_int8_t)(l), (w)[1] = (u_int8_t)(h))
+#define UCONSTW(x)	{ (x) & 0xff, ((x) >> 8) & 0xff }
+#define UCONSTDW(x)	{ (x) & 0xff, ((x) >> 8) & 0xff, \
+			  ((x) >> 16) & 0xff, ((x) >> 24) & 0xff }
+
+#if 1
+#define UGETW(w) ((w)[0] | ((w)[1] << 8))
+#define USETW(w,v) ((w)[0] = (u_int8_t)(v), (w)[1] = (u_int8_t)((v) >> 8))
+#define UGETDW(w) ((w)[0] | ((w)[1] << 8) | ((w)[2] << 16) | ((w)[3] << 24))
+#define USETDW(w,v) ((w)[0] = (u_int8_t)(v), \
+		     (w)[1] = (u_int8_t)((v) >> 8), \
+		     (w)[2] = (u_int8_t)((v) >> 16), \
+		     (w)[3] = (u_int8_t)((v) >> 24))
+#else
+/*
+ * On little-endian machines that can handle unanliged accesses
+ * (e.g. i386) these macros can be replaced by the following.
+ */
+#define UGETW(w) (*(u_int16_t *)(w))
+#define USETW(w,v) (*(u_int16_t *)(w) = (v))
+#define UGETDW(w) (*(u_int32_t *)(w))
+#define USETDW(w,v) (*(u_int32_t *)(w) = (v))
+#endif
+
+/*
+ * Macros for accessing UAS IU fields, which are big-endian
+ */
+#define IUSETW2(w,h,l) ((w)[0] = (u_int8_t)(h), (w)[1] = (u_int8_t)(l))
+#define IUCONSTW(x)	{ ((x) >> 8) & 0xff, (x) & 0xff }
+#define IUCONSTDW(x)	{ ((x) >> 24) & 0xff, ((x) >> 16) & 0xff, \
+			((x) >> 8) & 0xff, (x) & 0xff }
+#define IUGETW(w) (((w)[0] << 8) | (w)[1])
+#define IUSETW(w,v) ((w)[0] = (u_int8_t)((v) >> 8), (w)[1] = (u_int8_t)(v))
+#define IUGETDW(w) (((w)[0] << 24) | ((w)[1] << 16) | ((w)[2] << 8) | (w)[3])
+#define IUSETDW(w,v) ((w)[0] = (u_int8_t)((v) >> 24), \
+		      (w)[1] = (u_int8_t)((v) >> 16), \
+		      (w)[2] = (u_int8_t)((v) >> 8), \
+		      (w)[3] = (u_int8_t)(v))
+
+#define UPACKED __attribute__((__packed__))
+
+typedef struct {
+	uByte		bmRequestType;
+	uByte		bRequest;
+	uWord		wValue;
+	uWord		wIndex;
+	uWord		wLength;
+} UPACKED usb_device_request_t;
+
+#define UT_GET_DIR(a) ((a) & 0x80)
+#define UT_WRITE		0x00
+#define UT_READ			0x80
+
+#define UT_GET_TYPE(a) ((a) & 0x60)
+#define UT_STANDARD		0x00
+#define UT_CLASS		0x20
+#define UT_VENDOR		0x40
+
+#define UT_GET_RECIPIENT(a) ((a) & 0x1f)
+#define UT_DEVICE		0x00
+#define UT_INTERFACE		0x01
+#define UT_ENDPOINT		0x02
+#define UT_OTHER		0x03
+
+#define UT_READ_DEVICE		(UT_READ  | UT_STANDARD | UT_DEVICE)
+#define UT_READ_INTERFACE	(UT_READ  | UT_STANDARD | UT_INTERFACE)
+#define UT_READ_ENDPOINT	(UT_READ  | UT_STANDARD | UT_ENDPOINT)
+#define UT_WRITE_DEVICE		(UT_WRITE | UT_STANDARD | UT_DEVICE)
+#define UT_WRITE_INTERFACE	(UT_WRITE | UT_STANDARD | UT_INTERFACE)
+#define UT_WRITE_ENDPOINT	(UT_WRITE | UT_STANDARD | UT_ENDPOINT)
+#define UT_READ_CLASS_DEVICE	(UT_READ  | UT_CLASS | UT_DEVICE)
+#define UT_READ_CLASS_INTERFACE	(UT_READ  | UT_CLASS | UT_INTERFACE)
+#define UT_READ_CLASS_OTHER	(UT_READ  | UT_CLASS | UT_OTHER)
+#define UT_READ_CLASS_ENDPOINT	(UT_READ  | UT_CLASS | UT_ENDPOINT)
+#define UT_WRITE_CLASS_DEVICE	(UT_WRITE | UT_CLASS | UT_DEVICE)
+#define UT_WRITE_CLASS_INTERFACE (UT_WRITE | UT_CLASS | UT_INTERFACE)
+#define UT_WRITE_CLASS_OTHER	(UT_WRITE | UT_CLASS | UT_OTHER)
+#define UT_WRITE_CLASS_ENDPOINT	(UT_WRITE | UT_CLASS | UT_ENDPOINT)
+#define UT_READ_VENDOR_DEVICE	(UT_READ  | UT_VENDOR | UT_DEVICE)
+#define UT_READ_VENDOR_INTERFACE (UT_READ  | UT_VENDOR | UT_INTERFACE)
+#define UT_READ_VENDOR_OTHER	(UT_READ  | UT_VENDOR | UT_OTHER)
+#define UT_READ_VENDOR_ENDPOINT	(UT_READ  | UT_VENDOR | UT_ENDPOINT)
+#define UT_WRITE_VENDOR_DEVICE	(UT_WRITE | UT_VENDOR | UT_DEVICE)
+#define UT_WRITE_VENDOR_INTERFACE (UT_WRITE | UT_VENDOR | UT_INTERFACE)
+#define UT_WRITE_VENDOR_OTHER	(UT_WRITE | UT_VENDOR | UT_OTHER)
+#define UT_WRITE_VENDOR_ENDPOINT (UT_WRITE | UT_VENDOR | UT_ENDPOINT)
+
+/* Requests */
+#define UR_GET_STATUS		0x00
+#define  USTAT_STANDARD_STATUS  0x00
+#define  WUSTAT_WUSB_FEATURE    0x01
+#define  WUSTAT_CHANNEL_INFO    0x02
+#define  WUSTAT_RECEIVED_DATA   0x03
+#define  WUSTAT_MAS_AVAILABILITY 0x04
+#define  WUSTAT_CURRENT_TRANSMIT_POWER 0x05
+#define UR_CLEAR_FEATURE	0x01
+#define UR_SET_FEATURE		0x03
+#define UR_SET_AND_TEST_FEATURE 0x0c
+#define UR_SET_ADDRESS		0x05
+#define UR_GET_DESCRIPTOR	0x06
+#define  UDESC_DEVICE		0x01
+#define  UDESC_CONFIG		0x02
+#define  UDESC_STRING		0x03
+#define  UDESC_INTERFACE	0x04
+#define  UDESC_ENDPOINT		0x05
+#define  UDESC_SS_USB_COMPANION	0x30
+#define  UDESC_DEVICE_QUALIFIER	0x06
+#define  UDESC_OTHER_SPEED_CONFIGURATION 0x07
+#define  UDESC_INTERFACE_POWER	0x08
+#define  UDESC_OTG		0x09
+#define  WUDESC_SECURITY	0x0c
+#define  WUDESC_KEY		0x0d
+#define   WUD_GET_KEY_INDEX(_wValue_) ((_wValue_) & 0xf)
+#define   WUD_GET_KEY_TYPE(_wValue_) (((_wValue_) & 0x30) >> 4)
+#define    WUD_KEY_TYPE_ASSOC    0x01
+#define    WUD_KEY_TYPE_GTK      0x02
+#define   WUD_GET_KEY_ORIGIN(_wValue_) (((_wValue_) & 0x40) >> 6)
+#define    WUD_KEY_ORIGIN_HOST   0x00
+#define    WUD_KEY_ORIGIN_DEVICE 0x01
+#define  WUDESC_ENCRYPTION_TYPE	0x0e
+#define  WUDESC_BOS		0x0f
+#define  WUDESC_DEVICE_CAPABILITY 0x10
+#define  WUDESC_WIRELESS_ENDPOINT_COMPANION 0x11
+#define  UDESC_BOS		0x0f
+#define  UDESC_DEVICE_CAPABILITY 0x10
+#define  UDESC_CS_DEVICE	0x21	/* class specific */
+#define  UDESC_CS_CONFIG	0x22
+#define  UDESC_CS_STRING	0x23
+#define  UDESC_CS_INTERFACE	0x24
+#define  UDESC_CS_ENDPOINT	0x25
+#define  UDESC_HUB		0x29
+#define UR_SET_DESCRIPTOR	0x07
+#define UR_GET_CONFIG		0x08
+#define UR_SET_CONFIG		0x09
+#define UR_GET_INTERFACE	0x0a
+#define UR_SET_INTERFACE	0x0b
+#define UR_SYNCH_FRAME		0x0c
+#define WUR_SET_ENCRYPTION      0x0d
+#define WUR_GET_ENCRYPTION	0x0e
+#define WUR_SET_HANDSHAKE	0x0f
+#define WUR_GET_HANDSHAKE	0x10
+#define WUR_SET_CONNECTION	0x11
+#define WUR_SET_SECURITY_DATA	0x12
+#define WUR_GET_SECURITY_DATA	0x13
+#define WUR_SET_WUSB_DATA	0x14
+#define  WUDATA_DRPIE_INFO	0x01
+#define  WUDATA_TRANSMIT_DATA	0x02
+#define  WUDATA_TRANSMIT_PARAMS	0x03
+#define  WUDATA_RECEIVE_PARAMS	0x04
+#define  WUDATA_TRANSMIT_POWER	0x05
+#define WUR_LOOPBACK_DATA_WRITE	0x15
+#define WUR_LOOPBACK_DATA_READ	0x16
+#define WUR_SET_INTERFACE_DS	0x17
+
+/* Feature numbers */
+#define UF_ENDPOINT_HALT	0
+#define UF_DEVICE_REMOTE_WAKEUP	1
+#define UF_TEST_MODE		2
+#define UF_DEVICE_B_HNP_ENABLE	3
+#define UF_DEVICE_A_HNP_SUPPORT	4
+#define UF_DEVICE_A_ALT_HNP_SUPPORT 5
+#define WUF_WUSB		3
+#define  WUF_TX_DRPIE		0x0
+#define  WUF_DEV_XMIT_PACKET	0x1
+#define  WUF_COUNT_PACKETS	0x2
+#define  WUF_CAPTURE_PACKETS	0x3
+#define UF_FUNCTION_SUSPEND	0
+#define UF_U1_ENABLE		48
+#define UF_U2_ENABLE		49
+#define UF_LTM_ENABLE		50
+
+/* Class requests from the USB 2.0 hub spec, table 11-15 */
+#define UCR_CLEAR_HUB_FEATURE		(0x2000 | UR_CLEAR_FEATURE)
+#define UCR_CLEAR_PORT_FEATURE		(0x2300 | UR_CLEAR_FEATURE)
+#define UCR_GET_HUB_DESCRIPTOR		(0xa000 | UR_GET_DESCRIPTOR)
+#define UCR_GET_HUB_STATUS		(0xa000 | UR_GET_STATUS)
+#define UCR_GET_PORT_STATUS		(0xa300 | UR_GET_STATUS)
+#define UCR_SET_HUB_FEATURE		(0x2000 | UR_SET_FEATURE)
+#define UCR_SET_PORT_FEATURE		(0x2300 | UR_SET_FEATURE)
+#define UCR_SET_AND_TEST_PORT_FEATURE	(0xa300 | UR_SET_AND_TEST_FEATURE)
+
+#ifdef _MSC_VER
+#include <pshpack1.h>
+#endif
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bDescriptorSubtype;
+} UPACKED usb_descriptor_t;
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+} UPACKED usb_descriptor_header_t;
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		bcdUSB;
+#define UD_USB_2_0		0x0200
+#define UD_IS_USB2(d) (UGETW((d)->bcdUSB) >= UD_USB_2_0)
+	uByte		bDeviceClass;
+	uByte		bDeviceSubClass;
+	uByte		bDeviceProtocol;
+	uByte		bMaxPacketSize;
+	/* The fields below are not part of the initial descriptor. */
+	uWord		idVendor;
+	uWord		idProduct;
+	uWord		bcdDevice;
+	uByte		iManufacturer;
+	uByte		iProduct;
+	uByte		iSerialNumber;
+	uByte		bNumConfigurations;
+} UPACKED usb_device_descriptor_t;
+#define USB_DEVICE_DESCRIPTOR_SIZE 18
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		wTotalLength;
+	uByte		bNumInterface;
+	uByte		bConfigurationValue;
+	uByte		iConfiguration;
+#define UC_ATT_ONE		(1 << 7)	/* must be set */
+#define UC_ATT_SELFPOWER	(1 << 6)	/* self powered */
+#define UC_ATT_WAKEUP		(1 << 5)	/* can wakeup */
+#define UC_ATT_BATTERY		(1 << 4)	/* battery powered */
+	uByte		bmAttributes;
+#define UC_BUS_POWERED		0x80
+#define UC_SELF_POWERED		0x40
+#define UC_REMOTE_WAKEUP	0x20
+	uByte		bMaxPower; /* max current in 2 mA units */
+#define UC_POWER_FACTOR 2
+} UPACKED usb_config_descriptor_t;
+#define USB_CONFIG_DESCRIPTOR_SIZE 9
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bInterfaceNumber;
+	uByte		bAlternateSetting;
+	uByte		bNumEndpoints;
+	uByte		bInterfaceClass;
+	uByte		bInterfaceSubClass;
+	uByte		bInterfaceProtocol;
+	uByte		iInterface;
+} UPACKED usb_interface_descriptor_t;
+#define USB_INTERFACE_DESCRIPTOR_SIZE 9
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bEndpointAddress;
+#define UE_GET_DIR(a)	((a) & 0x80)
+#define UE_SET_DIR(a,d)	((a) | (((d)&1) << 7))
+#define UE_DIR_IN	0x80
+#define UE_DIR_OUT	0x00
+#define UE_ADDR		0x0f
+#define UE_GET_ADDR(a)	((a) & UE_ADDR)
+	uByte		bmAttributes;
+#define UE_XFERTYPE	0x03
+#define  UE_CONTROL	0x00
+#define  UE_ISOCHRONOUS	0x01
+#define  UE_BULK	0x02
+#define  UE_INTERRUPT	0x03
+#define UE_GET_XFERTYPE(a)	((a) & UE_XFERTYPE)
+#define UE_ISO_TYPE	0x0c
+#define  UE_ISO_ASYNC	0x04
+#define  UE_ISO_ADAPT	0x08
+#define  UE_ISO_SYNC	0x0c
+#define UE_GET_ISO_TYPE(a)	((a) & UE_ISO_TYPE)
+	uWord		wMaxPacketSize;
+	uByte		bInterval;
+} UPACKED usb_endpoint_descriptor_t;
+#define USB_ENDPOINT_DESCRIPTOR_SIZE 7
+
+typedef struct ss_endpoint_companion_descriptor {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bMaxBurst;
+#define USSE_GET_MAX_STREAMS(a)		((a) & 0x1f)
+#define USSE_SET_MAX_STREAMS(a, b)	((a) | ((b) & 0x1f))
+#define USSE_GET_MAX_PACKET_NUM(a)	((a) & 0x03)
+#define USSE_SET_MAX_PACKET_NUM(a, b)	((a) | ((b) & 0x03))
+	uByte bmAttributes;
+	uWord wBytesPerInterval;
+} UPACKED ss_endpoint_companion_descriptor_t;
+#define USB_SS_ENDPOINT_COMPANION_DESCRIPTOR_SIZE 6
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		bString[127];
+} UPACKED usb_string_descriptor_t;
+#define USB_MAX_STRING_LEN 128
+#define USB_LANGUAGE_TABLE 0	/* # of the string language id table */
+
+/* Hub specific request */
+#define UR_GET_BUS_STATE	0x02
+#define UR_CLEAR_TT_BUFFER	0x08
+#define UR_RESET_TT		0x09
+#define UR_GET_TT_STATE		0x0a
+#define UR_STOP_TT		0x0b
+
+/* Hub features */
+#define UHF_C_HUB_LOCAL_POWER	0
+#define UHF_C_HUB_OVER_CURRENT	1
+#define UHF_PORT_CONNECTION	0
+#define UHF_PORT_ENABLE		1
+#define UHF_PORT_SUSPEND	2
+#define UHF_PORT_OVER_CURRENT	3
+#define UHF_PORT_RESET		4
+#define UHF_PORT_L1		5
+#define UHF_PORT_POWER		8
+#define UHF_PORT_LOW_SPEED	9
+#define UHF_PORT_HIGH_SPEED	10
+#define UHF_C_PORT_CONNECTION	16
+#define UHF_C_PORT_ENABLE	17
+#define UHF_C_PORT_SUSPEND	18
+#define UHF_C_PORT_OVER_CURRENT	19
+#define UHF_C_PORT_RESET	20
+#define UHF_C_PORT_L1		23
+#define UHF_PORT_TEST		21
+#define UHF_PORT_INDICATOR	22
+
+typedef struct {
+	uByte		bDescLength;
+	uByte		bDescriptorType;
+	uByte		bNbrPorts;
+	uWord		wHubCharacteristics;
+#define UHD_PWR			0x0003
+#define  UHD_PWR_GANGED		0x0000
+#define  UHD_PWR_INDIVIDUAL	0x0001
+#define  UHD_PWR_NO_SWITCH	0x0002
+#define UHD_COMPOUND		0x0004
+#define UHD_OC			0x0018
+#define  UHD_OC_GLOBAL		0x0000
+#define  UHD_OC_INDIVIDUAL	0x0008
+#define  UHD_OC_NONE		0x0010
+#define UHD_TT_THINK		0x0060
+#define  UHD_TT_THINK_8		0x0000
+#define  UHD_TT_THINK_16	0x0020
+#define  UHD_TT_THINK_24	0x0040
+#define  UHD_TT_THINK_32	0x0060
+#define UHD_PORT_IND		0x0080
+	uByte		bPwrOn2PwrGood;	/* delay in 2 ms units */
+#define UHD_PWRON_FACTOR 2
+	uByte		bHubContrCurrent;
+	uByte		DeviceRemovable[32]; /* max 255 ports */
+#define UHD_NOT_REMOV(desc, i) \
+    (((desc)->DeviceRemovable[(i)/8] >> ((i) % 8)) & 1)
+	/* deprecated */ uByte		PortPowerCtrlMask[1];
+} UPACKED usb_hub_descriptor_t;
+#define USB_HUB_DESCRIPTOR_SIZE 9 /* includes deprecated PortPowerCtrlMask */
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		bcdUSB;
+	uByte		bDeviceClass;
+	uByte		bDeviceSubClass;
+	uByte		bDeviceProtocol;
+	uByte		bMaxPacketSize0;
+	uByte		bNumConfigurations;
+	uByte		bReserved;
+} UPACKED usb_device_qualifier_t;
+#define USB_DEVICE_QUALIFIER_SIZE 10
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bmAttributes;
+#define UOTG_SRP	0x01
+#define UOTG_HNP	0x02
+} UPACKED usb_otg_descriptor_t;
+
+/* OTG feature selectors */
+#define UOTG_B_HNP_ENABLE	3
+#define UOTG_A_HNP_SUPPORT	4
+#define UOTG_A_ALT_HNP_SUPPORT	5
+
+typedef struct {
+	uWord		wStatus;
+/* Device status flags */
+#define UDS_SELF_POWERED		0x0001
+#define UDS_REMOTE_WAKEUP		0x0002
+/* Endpoint status flags */
+#define UES_HALT			0x0001
+} UPACKED usb_status_t;
+
+typedef struct {
+	uWord		wHubStatus;
+#define UHS_LOCAL_POWER			0x0001
+#define UHS_OVER_CURRENT		0x0002
+	uWord		wHubChange;
+} UPACKED usb_hub_status_t;
+
+typedef struct {
+	uWord		wPortStatus;
+#define UPS_CURRENT_CONNECT_STATUS	0x0001
+#define UPS_PORT_ENABLED		0x0002
+#define UPS_SUSPEND			0x0004
+#define UPS_OVERCURRENT_INDICATOR	0x0008
+#define UPS_RESET			0x0010
+#define UPS_PORT_POWER			0x0100
+#define UPS_LOW_SPEED			0x0200
+#define UPS_HIGH_SPEED			0x0400
+#define UPS_PORT_TEST			0x0800
+#define UPS_PORT_INDICATOR		0x1000
+	uWord		wPortChange;
+#define UPS_C_CONNECT_STATUS		0x0001
+#define UPS_C_PORT_ENABLED		0x0002
+#define UPS_C_SUSPEND			0x0004
+#define UPS_C_OVERCURRENT_INDICATOR	0x0008
+#define UPS_C_PORT_RESET		0x0010
+} UPACKED usb_port_status_t;
+
+#ifdef _MSC_VER
+#include <poppack.h>
+#endif
+
+/* Device class codes */
+#define UDCLASS_IN_INTERFACE	0x00
+#define UDCLASS_COMM		0x02
+#define UDCLASS_HUB		0x09
+#define  UDSUBCLASS_HUB		0x00
+#define  UDPROTO_FSHUB		0x00
+#define  UDPROTO_HSHUBSTT	0x01
+#define  UDPROTO_HSHUBMTT	0x02
+#define UDCLASS_DIAGNOSTIC	0xdc
+#define UDCLASS_WIRELESS	0xe0
+#define  UDSUBCLASS_RF		0x01
+#define   UDPROTO_BLUETOOTH	0x01
+#define UDCLASS_VENDOR		0xff
+
+/* Interface class codes */
+#define UICLASS_UNSPEC		0x00
+
+#define UICLASS_AUDIO		0x01
+#define  UISUBCLASS_AUDIOCONTROL	1
+#define  UISUBCLASS_AUDIOSTREAM		2
+#define  UISUBCLASS_MIDISTREAM		3
+
+#define UICLASS_CDC		0x02 /* communication */
+#define  UISUBCLASS_DIRECT_LINE_CONTROL_MODEL	1
+#define  UISUBCLASS_ABSTRACT_CONTROL_MODEL	2
+#define  UISUBCLASS_TELEPHONE_CONTROL_MODEL	3
+#define  UISUBCLASS_MULTICHANNEL_CONTROL_MODEL	4
+#define  UISUBCLASS_CAPI_CONTROLMODEL		5
+#define  UISUBCLASS_ETHERNET_NETWORKING_CONTROL_MODEL 6
+#define  UISUBCLASS_ATM_NETWORKING_CONTROL_MODEL 7
+#define   UIPROTO_CDC_AT			1
+
+#define UICLASS_HID		0x03
+#define  UISUBCLASS_BOOT	1
+#define  UIPROTO_BOOT_KEYBOARD	1
+
+#define UICLASS_PHYSICAL	0x05
+
+#define UICLASS_IMAGE		0x06
+
+#define UICLASS_PRINTER		0x07
+#define  UISUBCLASS_PRINTER	1
+#define  UIPROTO_PRINTER_UNI	1
+#define  UIPROTO_PRINTER_BI	2
+#define  UIPROTO_PRINTER_1284	3
+
+#define UICLASS_MASS		0x08
+#define  UISUBCLASS_RBC		1
+#define  UISUBCLASS_SFF8020I	2
+#define  UISUBCLASS_QIC157	3
+#define  UISUBCLASS_UFI		4
+#define  UISUBCLASS_SFF8070I	5
+#define  UISUBCLASS_SCSI	6
+#define  UIPROTO_MASS_CBI_I	0
+#define  UIPROTO_MASS_CBI	1
+#define  UIPROTO_MASS_BBB_OLD	2	/* Not in the spec anymore */
+#define  UIPROTO_MASS_BBB	80	/* 'P' for the Iomega Zip drive */
+
+#define UICLASS_HUB		0x09
+#define  UISUBCLASS_HUB		0
+#define  UIPROTO_FSHUB		0
+#define  UIPROTO_HSHUBSTT	0 /* Yes, same as previous */
+#define  UIPROTO_HSHUBMTT	1
+
+#define UICLASS_CDC_DATA	0x0a
+#define  UISUBCLASS_DATA		0
+#define   UIPROTO_DATA_ISDNBRI		0x30    /* Physical iface */
+#define   UIPROTO_DATA_HDLC		0x31    /* HDLC */
+#define   UIPROTO_DATA_TRANSPARENT	0x32    /* Transparent */
+#define   UIPROTO_DATA_Q921M		0x50    /* Management for Q921 */
+#define   UIPROTO_DATA_Q921		0x51    /* Data for Q921 */
+#define   UIPROTO_DATA_Q921TM		0x52    /* TEI multiplexer for Q921 */
+#define   UIPROTO_DATA_V42BIS		0x90    /* Data compression */
+#define   UIPROTO_DATA_Q931		0x91    /* Euro-ISDN */
+#define   UIPROTO_DATA_V120		0x92    /* V.24 rate adaption */
+#define   UIPROTO_DATA_CAPI		0x93    /* CAPI 2.0 commands */
+#define   UIPROTO_DATA_HOST_BASED	0xfd    /* Host based driver */
+#define   UIPROTO_DATA_PUF		0xfe    /* see Prot. Unit Func. Desc.*/
+#define   UIPROTO_DATA_VENDOR		0xff    /* Vendor specific */
+
+#define UICLASS_SMARTCARD	0x0b
+
+/*#define UICLASS_FIRM_UPD	0x0c*/
+
+#define UICLASS_SECURITY	0x0d
+
+#define UICLASS_DIAGNOSTIC	0xdc
+
+#define UICLASS_WIRELESS	0xe0
+#define  UISUBCLASS_RF			0x01
+#define   UIPROTO_BLUETOOTH		0x01
+
+#define UICLASS_APPL_SPEC	0xfe
+#define  UISUBCLASS_FIRMWARE_DOWNLOAD	1
+#define  UISUBCLASS_IRDA		2
+#define  UIPROTO_IRDA			0
+
+#define UICLASS_VENDOR		0xff
+
+#define USB_HUB_MAX_DEPTH 5
+
+/*
+ * Minimum time a device needs to be powered down to go through
+ * a power cycle.  XXX Are these time in the spec?
+ */
+#define USB_POWER_DOWN_TIME	200 /* ms */
+#define USB_PORT_POWER_DOWN_TIME	100 /* ms */
+
+#if 0
+/* These are the values from the spec. */
+#define USB_PORT_RESET_DELAY	10  /* ms */
+#define USB_PORT_ROOT_RESET_DELAY 50  /* ms */
+#define USB_PORT_RESET_RECOVERY	10  /* ms */
+#define USB_PORT_POWERUP_DELAY	100 /* ms */
+#define USB_SET_ADDRESS_SETTLE	2   /* ms */
+#define USB_RESUME_DELAY	(20*5)  /* ms */
+#define USB_RESUME_WAIT		10  /* ms */
+#define USB_RESUME_RECOVERY	10  /* ms */
+#define USB_EXTRA_POWER_UP_TIME	0   /* ms */
+#else
+/* Allow for marginal (i.e. non-conforming) devices. */
+#define USB_PORT_RESET_DELAY	50  /* ms */
+#define USB_PORT_ROOT_RESET_DELAY 250  /* ms */
+#define USB_PORT_RESET_RECOVERY	250  /* ms */
+#define USB_PORT_POWERUP_DELAY	300 /* ms */
+#define USB_SET_ADDRESS_SETTLE	10  /* ms */
+#define USB_RESUME_DELAY	(50*5)  /* ms */
+#define USB_RESUME_WAIT		50  /* ms */
+#define USB_RESUME_RECOVERY	50  /* ms */
+#define USB_EXTRA_POWER_UP_TIME	20  /* ms */
+#endif
+
+#define USB_MIN_POWER		100 /* mA */
+#define USB_MAX_POWER		500 /* mA */
+
+#define USB_BUS_RESET_DELAY	100 /* ms XXX?*/
+
+#define USB_UNCONFIG_NO 0
+#define USB_UNCONFIG_INDEX (-1)
+
+/*** ioctl() related stuff ***/
+
+struct usb_ctl_request {
+	int	ucr_addr;
+	usb_device_request_t ucr_request;
+	void	*ucr_data;
+	int	ucr_flags;
+#define USBD_SHORT_XFER_OK	0x04	/* allow short reads */
+	int	ucr_actlen;		/* actual length transferred */
+};
+
+struct usb_alt_interface {
+	int	uai_config_index;
+	int	uai_interface_index;
+	int	uai_alt_no;
+};
+
+#define USB_CURRENT_CONFIG_INDEX (-1)
+#define USB_CURRENT_ALT_INDEX (-1)
+
+struct usb_config_desc {
+	int	ucd_config_index;
+	usb_config_descriptor_t ucd_desc;
+};
+
+struct usb_interface_desc {
+	int	uid_config_index;
+	int	uid_interface_index;
+	int	uid_alt_index;
+	usb_interface_descriptor_t uid_desc;
+};
+
+struct usb_endpoint_desc {
+	int	ued_config_index;
+	int	ued_interface_index;
+	int	ued_alt_index;
+	int	ued_endpoint_index;
+	usb_endpoint_descriptor_t ued_desc;
+};
+
+struct usb_full_desc {
+	int	ufd_config_index;
+	u_int	ufd_size;
+	u_char	*ufd_data;
+};
+
+struct usb_string_desc {
+	int	usd_string_index;
+	int	usd_language_id;
+	usb_string_descriptor_t usd_desc;
+};
+
+struct usb_ctl_report_desc {
+	int	ucrd_size;
+	u_char	ucrd_data[1024];	/* filled data size will vary */
+};
+
+typedef struct { u_int32_t cookie; } usb_event_cookie_t;
+
+#define USB_MAX_DEVNAMES 4
+#define USB_MAX_DEVNAMELEN 16
+struct usb_device_info {
+	u_int8_t	udi_bus;
+	u_int8_t	udi_addr;	/* device address */
+	usb_event_cookie_t udi_cookie;
+	char		udi_product[USB_MAX_STRING_LEN];
+	char		udi_vendor[USB_MAX_STRING_LEN];
+	char		udi_release[8];
+	u_int16_t	udi_productNo;
+	u_int16_t	udi_vendorNo;
+	u_int16_t	udi_releaseNo;
+	u_int8_t	udi_class;
+	u_int8_t	udi_subclass;
+	u_int8_t	udi_protocol;
+	u_int8_t	udi_config;
+	u_int8_t	udi_speed;
+#define USB_SPEED_UNKNOWN	0
+#define USB_SPEED_LOW		1
+#define USB_SPEED_FULL		2
+#define USB_SPEED_HIGH		3
+#define USB_SPEED_VARIABLE	4
+#define USB_SPEED_SUPER		5
+	int		udi_power;	/* power consumption in mA, 0 if selfpowered */
+	int		udi_nports;
+	char		udi_devnames[USB_MAX_DEVNAMES][USB_MAX_DEVNAMELEN];
+	u_int8_t	udi_ports[16];/* hub only: addresses of devices on ports */
+#define USB_PORT_ENABLED 0xff
+#define USB_PORT_SUSPENDED 0xfe
+#define USB_PORT_POWERED 0xfd
+#define USB_PORT_DISABLED 0xfc
+};
+
+struct usb_ctl_report {
+	int	ucr_report;
+	u_char	ucr_data[1024];	/* filled data size will vary */
+};
+
+struct usb_device_stats {
+	u_long	uds_requests[4];	/* indexed by transfer type UE_* */
+};
+
+#define WUSB_MIN_IE			0x80
+#define WUSB_WCTA_IE			0x80
+#define WUSB_WCONNECTACK_IE		0x81
+#define WUSB_WHOSTINFO_IE		0x82
+#define  WUHI_GET_CA(_bmAttributes_) ((_bmAttributes_) & 0x3)
+#define   WUHI_CA_RECONN		0x00
+#define   WUHI_CA_LIMITED		0x01
+#define   WUHI_CA_ALL			0x03
+#define  WUHI_GET_MLSI(_bmAttributes_) (((_bmAttributes_) & 0x38) >> 3)
+#define WUSB_WCHCHANGEANNOUNCE_IE	0x83
+#define WUSB_WDEV_DISCONNECT_IE		0x84
+#define WUSB_WHOST_DISCONNECT_IE	0x85
+#define WUSB_WRELEASE_CHANNEL_IE	0x86
+#define WUSB_WWORK_IE			0x87
+#define WUSB_WCHANNEL_STOP_IE		0x88
+#define WUSB_WDEV_KEEPALIVE_IE		0x89
+#define WUSB_WISOCH_DISCARD_IE		0x8A
+#define WUSB_WRESETDEVICE_IE		0x8B
+#define WUSB_WXMIT_PACKET_ADJUST_IE	0x8C
+#define WUSB_MAX_IE			0x8C
+
+/* Device Notification Types */
+
+#define WUSB_DN_MIN			0x01
+#define WUSB_DN_CONNECT			0x01
+# define WUSB_DA_OLDCONN	0x00
+# define WUSB_DA_NEWCONN	0x01
+# define WUSB_DA_SELF_BEACON	0x02
+# define WUSB_DA_DIR_BEACON	0x04
+# define WUSB_DA_NO_BEACON	0x06
+#define WUSB_DN_DISCONNECT		0x02
+#define WUSB_DN_EPRDY			0x03
+#define WUSB_DN_MASAVAILCHANGED		0x04
+#define WUSB_DN_REMOTEWAKEUP		0x05
+#define WUSB_DN_SLEEP			0x06
+#define WUSB_DN_ALIVE			0x07
+#define WUSB_DN_MAX			0x07
+
+#ifdef _MSC_VER
+#include <pshpack1.h>
+#endif
+
+/* WUSB Handshake Data.  Used during the SET/GET HANDSHAKE requests */
+typedef struct wusb_hndshk_data {
+	uByte bMessageNumber;
+	uByte bStatus;
+	uByte tTKID[3];
+	uByte bReserved;
+	uByte CDID[16];
+	uByte Nonce[16];
+	uByte MIC[8];
+} UPACKED wusb_hndshk_data_t;
+#define WUSB_HANDSHAKE_LEN_FOR_MIC	38
+
+/* WUSB Connection Context */
+typedef struct wusb_conn_context {
+	uByte CHID [16];
+	uByte CDID [16];
+	uByte CK [16];
+} UPACKED wusb_conn_context_t;
+
+/* WUSB Security Descriptor */
+typedef struct wusb_security_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uWord wTotalLength;
+	uByte bNumEncryptionTypes;
+} UPACKED wusb_security_desc_t;
+
+/* WUSB Encryption Type Descriptor */
+typedef struct wusb_encrypt_type_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+
+	uByte bEncryptionType;
+#define WUETD_UNSECURE		0
+#define WUETD_WIRED		1
+#define WUETD_CCM_1		2
+#define WUETD_RSA_1		3
+
+	uByte bEncryptionValue;
+	uByte bAuthKeyIndex;
+} UPACKED wusb_encrypt_type_desc_t;
+
+/* WUSB Key Descriptor */
+typedef struct wusb_key_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte tTKID[3];
+	uByte bReserved;
+	uByte KeyData[1];	/* variable length */
+} UPACKED wusb_key_desc_t;
+
+/* WUSB BOS Descriptor (Binary device Object Store) */
+typedef struct wusb_bos_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uWord wTotalLength;
+	uByte bNumDeviceCaps;
+} UPACKED wusb_bos_desc_t;
+
+#define USB_DEVICE_CAPABILITY_20_EXTENSION	0x02
+typedef struct usb_dev_cap_20_ext_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+#define USB_20_EXT_LPM				0x02
+	uDWord bmAttributes;
+} UPACKED usb_dev_cap_20_ext_desc_t;
+
+#define USB_DEVICE_CAPABILITY_SS_USB		0x03
+typedef struct usb_dev_cap_ss_usb {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+#define USB_DC_SS_USB_LTM_CAPABLE		0x02
+	uByte bmAttributes;
+#define USB_DC_SS_USB_SPEED_SUPPORT_LOW		0x01
+#define USB_DC_SS_USB_SPEED_SUPPORT_FULL	0x02
+#define USB_DC_SS_USB_SPEED_SUPPORT_HIGH	0x04
+#define USB_DC_SS_USB_SPEED_SUPPORT_SS		0x08
+	uWord wSpeedsSupported;
+	uByte bFunctionalitySupport;
+	uByte bU1DevExitLat;
+	uWord wU2DevExitLat;
+} UPACKED usb_dev_cap_ss_usb_t;
+
+#define USB_DEVICE_CAPABILITY_CONTAINER_ID	0x04
+typedef struct usb_dev_cap_container_id {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+	uByte bReserved;
+	uByte containerID[16];
+} UPACKED usb_dev_cap_container_id_t;
+
+/* Device Capability Type Codes */
+#define WUSB_DEVICE_CAPABILITY_WIRELESS_USB 0x01
+
+/* Device Capability Descriptor */
+typedef struct wusb_dev_cap_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+	uByte caps[1];	/* Variable length */
+} UPACKED wusb_dev_cap_desc_t;
+
+/* Device Capability Descriptor */
+typedef struct wusb_dev_cap_uwb_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+	uByte bmAttributes;
+	uWord wPHYRates;	/* Bitmap */
+	uByte bmTFITXPowerInfo;
+	uByte bmFFITXPowerInfo;
+	uWord bmBandGroup;
+	uByte bReserved;
+} UPACKED wusb_dev_cap_uwb_desc_t;
+
+/* Wireless USB Endpoint Companion Descriptor */
+typedef struct wusb_endpoint_companion_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bMaxBurst;
+	uByte bMaxSequence;
+	uWord wMaxStreamDelay;
+	uWord wOverTheAirPacketSize;
+	uByte bOverTheAirInterval;
+	uByte bmCompAttributes;
+} UPACKED wusb_endpoint_companion_desc_t;
+
+/* Wireless USB Numeric Association M1 Data Structure */
+typedef struct wusb_m1_data {
+	uByte version;
+	uWord langId;
+	uByte deviceFriendlyNameLength;
+	uByte sha_256_m3[32];
+	uByte deviceFriendlyName[256];
+} UPACKED wusb_m1_data_t;
+
+typedef struct wusb_m2_data {
+	uByte version;
+	uWord langId;
+	uByte hostFriendlyNameLength;
+	uByte pkh[384];
+	uByte hostFriendlyName[256];
+} UPACKED wusb_m2_data_t;
+
+typedef struct wusb_m3_data {
+	uByte pkd[384];
+	uByte nd;
+} UPACKED wusb_m3_data_t;
+
+typedef struct wusb_m4_data {
+	uDWord _attributeTypeIdAndLength_1;
+	uWord  associationTypeId;
+
+	uDWord _attributeTypeIdAndLength_2;
+	uWord  associationSubTypeId;
+
+	uDWord _attributeTypeIdAndLength_3;
+	uDWord length;
+
+	uDWord _attributeTypeIdAndLength_4;
+	uDWord associationStatus;
+
+	uDWord _attributeTypeIdAndLength_5;
+	uByte  chid[16];
+
+	uDWord _attributeTypeIdAndLength_6;
+	uByte  cdid[16];
+
+	uDWord _attributeTypeIdAndLength_7;
+	uByte  bandGroups[2];
+} UPACKED wusb_m4_data_t;
+
+#ifdef _MSC_VER
+#include <poppack.h>
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _USB_H_ */
diff --git a/drivers/usb/host/dwc_otg/Makefile b/drivers/usb/host/dwc_otg/Makefile
new file mode 100644
index 0000000000000..e7bdd12015fee
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/Makefile
@@ -0,0 +1,82 @@
+#
+# Makefile for DWC_otg Highspeed USB controller driver
+#
+
+ifneq ($(KERNELRELEASE),)
+
+# Use the BUS_INTERFACE variable to compile the software for either
+# PCI(PCI_INTERFACE) or LM(LM_INTERFACE) bus.
+ifeq ($(BUS_INTERFACE),)
+#	BUS_INTERFACE = -DPCI_INTERFACE
+#	BUS_INTERFACE = -DLM_INTERFACE
+        BUS_INTERFACE = -DPLATFORM_INTERFACE
+endif
+
+#ccflags-y	+= -DDEBUG
+#ccflags-y	+= -DDWC_OTG_DEBUGLEV=1 # reduce common debug msgs
+
+# Use one of the following flags to compile the software in host-only or
+# device-only mode.
+#ccflags-y        += -DDWC_HOST_ONLY
+#ccflags-y        += -DDWC_DEVICE_ONLY
+
+ccflags-y	+= -Dlinux -DDWC_HS_ELECT_TST
+#ccflags-y	+= -DDWC_EN_ISOC
+ccflags-y   	+= -I$(obj)/../dwc_common_port
+#ccflags-y   	+= -I$(PORTLIB)
+ccflags-y   	+= -DDWC_LINUX
+ccflags-y   	+= $(CFI)
+ccflags-y	+= $(BUS_INTERFACE)
+#ccflags-y	+= -DDWC_DEV_SRPCAP
+
+obj-$(CONFIG_USB_DWCOTG) += dwc_otg.o
+
+dwc_otg-objs	:= dwc_otg_driver.o dwc_otg_attr.o
+dwc_otg-objs	+= dwc_otg_cil.o dwc_otg_cil_intr.o
+dwc_otg-objs	+= dwc_otg_pcd_linux.o dwc_otg_pcd.o dwc_otg_pcd_intr.o
+dwc_otg-objs	+= dwc_otg_hcd.o dwc_otg_hcd_linux.o dwc_otg_hcd_intr.o dwc_otg_hcd_queue.o dwc_otg_hcd_ddma.o
+dwc_otg-objs	+= dwc_otg_adp.o
+dwc_otg-objs	+= dwc_otg_fiq_fsm.o
+dwc_otg-objs	+= dwc_otg_fiq_stub.o
+ifneq ($(CFI),)
+dwc_otg-objs	+= dwc_otg_cfi.o
+endif
+
+kernrelwd := $(subst ., ,$(KERNELRELEASE))
+kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
+
+ifneq ($(kernrel3),2.6.20)
+ccflags-y += $(CPPFLAGS)
+endif
+
+else
+
+PWD		:= $(shell pwd)
+PORTLIB		:= $(PWD)/../dwc_common_port
+
+# Command paths
+CTAGS		:= $(CTAGS)
+DOXYGEN		:= $(DOXYGEN)
+
+default: portlib
+	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
+install: default
+	$(MAKE) -C$(KDIR) M=$(PORTLIB) modules_install
+	$(MAKE) -C$(KDIR) M=$(PWD) modules_install
+
+portlib:
+	$(MAKE) -C$(KDIR) M=$(PORTLIB) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+	cp $(PORTLIB)/Module.symvers $(PWD)/
+
+docs:	$(wildcard *.[hc]) doc/doxygen.cfg
+	$(DOXYGEN) doc/doxygen.cfg
+
+tags:	$(wildcard *.[hc])
+	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
+
+
+clean:
+	rm -rf   *.o *.ko .*cmd *.mod.c .tmp_versions Module.symvers
+
+endif
diff --git a/drivers/usb/host/dwc_otg/doc/doxygen.cfg b/drivers/usb/host/dwc_otg/doc/doxygen.cfg
new file mode 100644
index 0000000000000..712b057ef7c29
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/doc/doxygen.cfg
@@ -0,0 +1,224 @@
+# Doxyfile 1.3.9.1
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+PROJECT_NAME           = "DesignWare USB 2.0 OTG Controller (DWC_otg) Device Driver"
+PROJECT_NUMBER         = v3.00a
+OUTPUT_DIRECTORY       = ./doc/
+CREATE_SUBDIRS         = NO
+OUTPUT_LANGUAGE        = English
+BRIEF_MEMBER_DESC      = YES
+REPEAT_BRIEF           = YES
+ABBREVIATE_BRIEF       = "The $name class" \
+                         "The $name widget" \
+                         "The $name file" \
+                         is \
+                         provides \
+                         specifies \
+                         contains \
+                         represents \
+                         a \
+                         an \
+                         the
+ALWAYS_DETAILED_SEC    = NO
+INLINE_INHERITED_MEMB  = NO
+FULL_PATH_NAMES        = NO
+STRIP_FROM_PATH        =
+STRIP_FROM_INC_PATH    =
+SHORT_NAMES            = NO
+JAVADOC_AUTOBRIEF      = YES
+MULTILINE_CPP_IS_BRIEF = NO
+INHERIT_DOCS           = YES
+DISTRIBUTE_GROUP_DOC   = NO
+TAB_SIZE               = 8
+ALIASES                =
+OPTIMIZE_OUTPUT_FOR_C  = YES
+OPTIMIZE_OUTPUT_JAVA   = NO
+SUBGROUPING            = YES
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+EXTRACT_ALL            = NO
+EXTRACT_PRIVATE        = YES
+EXTRACT_STATIC         = YES
+EXTRACT_LOCAL_CLASSES  = YES
+EXTRACT_LOCAL_METHODS  = NO
+HIDE_UNDOC_MEMBERS     = NO
+HIDE_UNDOC_CLASSES     = NO
+HIDE_FRIEND_COMPOUNDS  = NO
+HIDE_IN_BODY_DOCS      = NO
+INTERNAL_DOCS          = NO
+CASE_SENSE_NAMES       = NO
+HIDE_SCOPE_NAMES       = NO
+SHOW_INCLUDE_FILES     = YES
+INLINE_INFO            = YES
+SORT_MEMBER_DOCS       = NO
+SORT_BRIEF_DOCS        = NO
+SORT_BY_SCOPE_NAME     = NO
+GENERATE_TODOLIST      = YES
+GENERATE_TESTLIST      = YES
+GENERATE_BUGLIST       = YES
+GENERATE_DEPRECATEDLIST= YES
+ENABLED_SECTIONS       =
+MAX_INITIALIZER_LINES  = 30
+SHOW_USED_FILES        = YES
+SHOW_DIRECTORIES       = YES
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+QUIET                  = YES
+WARNINGS               = YES
+WARN_IF_UNDOCUMENTED   = NO
+WARN_IF_DOC_ERROR      = YES
+WARN_FORMAT            = "$file:$line: $text"
+WARN_LOGFILE           =
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+INPUT                  = .
+FILE_PATTERNS          = *.c \
+                         *.h \
+                         ./linux/*.c \
+                         ./linux/*.h
+RECURSIVE              = NO
+EXCLUDE                = ./test/ \
+                         ./dwc_otg/.AppleDouble/
+EXCLUDE_SYMLINKS       = YES
+EXCLUDE_PATTERNS       = *.mod.*
+EXAMPLE_PATH           =
+EXAMPLE_PATTERNS       = *
+EXAMPLE_RECURSIVE      = NO
+IMAGE_PATH             =
+INPUT_FILTER           =
+FILTER_PATTERNS        =
+FILTER_SOURCE_FILES    = NO
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+SOURCE_BROWSER         = YES
+INLINE_SOURCES         = NO
+STRIP_CODE_COMMENTS    = YES
+REFERENCED_BY_RELATION = NO
+REFERENCES_RELATION    = NO
+VERBATIM_HEADERS       = NO
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+ALPHABETICAL_INDEX     = NO
+COLS_IN_ALPHA_INDEX    = 5
+IGNORE_PREFIX          =
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+GENERATE_HTML          = YES
+HTML_OUTPUT            = html
+HTML_FILE_EXTENSION    = .html
+HTML_HEADER            =
+HTML_FOOTER            =
+HTML_STYLESHEET        =
+HTML_ALIGN_MEMBERS     = YES
+GENERATE_HTMLHELP      = NO
+CHM_FILE               =
+HHC_LOCATION           =
+GENERATE_CHI           = NO
+BINARY_TOC             = NO
+TOC_EXPAND             = NO
+DISABLE_INDEX          = NO
+ENUM_VALUES_PER_LINE   = 4
+GENERATE_TREEVIEW      = YES
+TREEVIEW_WIDTH         = 250
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+GENERATE_LATEX         = NO
+LATEX_OUTPUT           = latex
+LATEX_CMD_NAME         = latex
+MAKEINDEX_CMD_NAME     = makeindex
+COMPACT_LATEX          = NO
+PAPER_TYPE             = a4wide
+EXTRA_PACKAGES         =
+LATEX_HEADER           =
+PDF_HYPERLINKS         = NO
+USE_PDFLATEX           = NO
+LATEX_BATCHMODE        = NO
+LATEX_HIDE_INDICES     = NO
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+GENERATE_RTF           = NO
+RTF_OUTPUT             = rtf
+COMPACT_RTF            = NO
+RTF_HYPERLINKS         = NO
+RTF_STYLESHEET_FILE    =
+RTF_EXTENSIONS_FILE    =
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+GENERATE_MAN           = NO
+MAN_OUTPUT             = man
+MAN_EXTENSION          = .3
+MAN_LINKS              = NO
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+GENERATE_XML           = NO
+XML_OUTPUT             = xml
+XML_SCHEMA             =
+XML_DTD                =
+XML_PROGRAMLISTING     = YES
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+GENERATE_AUTOGEN_DEF   = NO
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+GENERATE_PERLMOD       = NO
+PERLMOD_LATEX          = NO
+PERLMOD_PRETTY         = YES
+PERLMOD_MAKEVAR_PREFIX =
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+ENABLE_PREPROCESSING   = YES
+MACRO_EXPANSION        = YES
+EXPAND_ONLY_PREDEF     = YES
+SEARCH_INCLUDES        = YES
+INCLUDE_PATH           =
+INCLUDE_FILE_PATTERNS  =
+PREDEFINED             = DEVICE_ATTR DWC_EN_ISOC
+EXPAND_AS_DEFINED      = DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW DWC_OTG_DEVICE_ATTR_BITFIELD_STORE DWC_OTG_DEVICE_ATTR_BITFIELD_RW DWC_OTG_DEVICE_ATTR_BITFIELD_RO DWC_OTG_DEVICE_ATTR_REG_SHOW DWC_OTG_DEVICE_ATTR_REG_STORE DWC_OTG_DEVICE_ATTR_REG32_RW DWC_OTG_DEVICE_ATTR_REG32_RO DWC_EN_ISOC
+SKIP_FUNCTION_MACROS   = NO
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+TAGFILES               =
+GENERATE_TAGFILE       =
+ALLEXTERNALS           = NO
+EXTERNAL_GROUPS        = YES
+PERL_PATH              = /usr/bin/perl
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+CLASS_DIAGRAMS         = YES
+HIDE_UNDOC_RELATIONS   = YES
+HAVE_DOT               = NO
+CLASS_GRAPH            = YES
+COLLABORATION_GRAPH    = YES
+UML_LOOK               = NO
+TEMPLATE_RELATIONS     = NO
+INCLUDE_GRAPH          = YES
+INCLUDED_BY_GRAPH      = YES
+CALL_GRAPH             = NO
+GRAPHICAL_HIERARCHY    = YES
+DOT_IMAGE_FORMAT       = png
+DOT_PATH               =
+DOTFILE_DIRS           =
+MAX_DOT_GRAPH_DEPTH    = 1000
+GENERATE_LEGEND        = YES
+DOT_CLEANUP            = YES
+#---------------------------------------------------------------------------
+# Configuration::additions related to the search engine
+#---------------------------------------------------------------------------
+SEARCHENGINE           = NO
diff --git a/drivers/usb/host/dwc_otg/dummy_audio.c b/drivers/usb/host/dwc_otg/dummy_audio.c
new file mode 100644
index 0000000000000..f827102fa6441
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dummy_audio.c
@@ -0,0 +1,1574 @@
+/*
+ * zero.c -- Gadget Zero, for USB development
+ *
+ * Copyright (C) 2003-2004 David Brownell
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * Gadget Zero only needs two bulk endpoints, and is an example of how you
+ * can write a hardware-agnostic gadget driver running inside a USB device.
+ *
+ * Hardware details are visible (see CONFIG_USB_ZERO_* below) but don't
+ * affect most of the driver.
+ *
+ * Use it with the Linux host/master side "usbtest" driver to get a basic
+ * functional test of your device-side usb stack, or with "usb-skeleton".
+ *
+ * It supports two similar configurations.  One sinks whatever the usb host
+ * writes, and in return sources zeroes.  The other loops whatever the host
+ * writes back, so the host can read it.  Module options include:
+ *
+ *   buflen=N		default N=4096, buffer size used
+ *   qlen=N		default N=32, how many buffers in the loopback queue
+ *   loopdefault	default false, list loopback config first
+ *
+ * Many drivers will only have one configuration, letting them be much
+ * simpler if they also don't support high speed operation (like this
+ * driver does).
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/smp_lock.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/uts.h>
+#include <linux/version.h>
+#include <linux/device.h>
+#include <linux/moduleparam.h>
+#include <linux/proc_fs.h>
+
+#include <asm/byteorder.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/system.h>
+#include <asm/unaligned.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+# include <linux/usb/ch9.h>
+#else
+# include <linux/usb_ch9.h>
+#endif
+
+#include <linux/usb_gadget.h>
+
+
+/*-------------------------------------------------------------------------*/
+/*-------------------------------------------------------------------------*/
+
+
+static int utf8_to_utf16le(const char *s, u16 *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+
+
+/**
+ * usb_gadget_get_string - fill out a string descriptor
+ * @table: of c strings encoded using UTF-8
+ * @id: string id, from low byte of wValue in get string descriptor
+ * @buf: at least 256 bytes
+ *
+ * Finds the UTF-8 string matching the ID, and converts it into a
+ * string descriptor in utf16-le.
+ * Returns length of descriptor (always even) or negative errno
+ *
+ * If your driver needs stings in multiple languages, you'll probably
+ * "switch (wIndex) { ... }"  in your ep0 string descriptor logic,
+ * using this routine after choosing which set of UTF-8 strings to use.
+ * Note that US-ASCII is a strict subset of UTF-8; any string bytes with
+ * the eighth bit set will be multibyte UTF-8 characters, not ISO-8859/1
+ * characters (which are also widely used in C strings).
+ */
+int
+usb_gadget_get_string (struct usb_gadget_strings *table, int id, u8 *buf)
+{
+	struct usb_string	*s;
+	int			len;
+
+	/* descriptor 0 has the language id */
+	if (id == 0) {
+		buf [0] = 4;
+		buf [1] = USB_DT_STRING;
+		buf [2] = (u8) table->language;
+		buf [3] = (u8) (table->language >> 8);
+		return 4;
+	}
+	for (s = table->strings; s && s->s; s++)
+		if (s->id == id)
+			break;
+
+	/* unrecognized: stall. */
+	if (!s || !s->s)
+		return -EINVAL;
+
+	/* string descriptors have length, tag, then UTF16-LE text */
+	len = min ((size_t) 126, strlen (s->s));
+	memset (buf + 2, 0, 2 * len);	/* zero all the bytes */
+	len = utf8_to_utf16le(s->s, (u16 *)&buf[2], len);
+	if (len < 0)
+		return -EINVAL;
+	buf [0] = (len + 1) * 2;
+	buf [1] = USB_DT_STRING;
+	return buf [0];
+}
+
+
+/*-------------------------------------------------------------------------*/
+/*-------------------------------------------------------------------------*/
+
+
+/**
+ * usb_descriptor_fillbuf - fill buffer with descriptors
+ * @buf: Buffer to be filled
+ * @buflen: Size of buf
+ * @src: Array of descriptor pointers, terminated by null pointer.
+ *
+ * Copies descriptors into the buffer, returning the length or a
+ * negative error code if they can't all be copied.  Useful when
+ * assembling descriptors for an associated set of interfaces used
+ * as part of configuring a composite device; or in other cases where
+ * sets of descriptors need to be marshaled.
+ */
+int
+usb_descriptor_fillbuf(void *buf, unsigned buflen,
+		const struct usb_descriptor_header **src)
+{
+	u8	*dest = buf;
+
+	if (!src)
+		return -EINVAL;
+
+	/* fill buffer from src[] until null descriptor ptr */
+	for (; 0 != *src; src++) {
+		unsigned		len = (*src)->bLength;
+
+		if (len > buflen)
+			return -EINVAL;
+		memcpy(dest, *src, len);
+		buflen -= len;
+		dest += len;
+	}
+	return dest - (u8 *)buf;
+}
+
+
+/**
+ * usb_gadget_config_buf - builts a complete configuration descriptor
+ * @config: Header for the descriptor, including characteristics such
+ *	as power requirements and number of interfaces.
+ * @desc: Null-terminated vector of pointers to the descriptors (interface,
+ *	endpoint, etc) defining all functions in this device configuration.
+ * @buf: Buffer for the resulting configuration descriptor.
+ * @length: Length of buffer.  If this is not big enough to hold the
+ *	entire configuration descriptor, an error code will be returned.
+ *
+ * This copies descriptors into the response buffer, building a descriptor
+ * for that configuration.  It returns the buffer length or a negative
+ * status code.  The config.wTotalLength field is set to match the length
+ * of the result, but other descriptor fields (including power usage and
+ * interface count) must be set by the caller.
+ *
+ * Gadget drivers could use this when constructing a config descriptor
+ * in response to USB_REQ_GET_DESCRIPTOR.  They will need to patch the
+ * resulting bDescriptorType value if USB_DT_OTHER_SPEED_CONFIG is needed.
+ */
+int usb_gadget_config_buf(
+	const struct usb_config_descriptor	*config,
+	void					*buf,
+	unsigned				length,
+	const struct usb_descriptor_header	**desc
+)
+{
+	struct usb_config_descriptor		*cp = buf;
+	int					len;
+
+	/* config descriptor first */
+	if (length < USB_DT_CONFIG_SIZE || !desc)
+		return -EINVAL;
+	*cp = *config;
+
+	/* then interface/endpoint/class/vendor/... */
+	len = usb_descriptor_fillbuf(USB_DT_CONFIG_SIZE + (u8*)buf,
+			length - USB_DT_CONFIG_SIZE, desc);
+	if (len < 0)
+		return len;
+	len += USB_DT_CONFIG_SIZE;
+	if (len > 0xffff)
+		return -EINVAL;
+
+	/* patch up the config descriptor */
+	cp->bLength = USB_DT_CONFIG_SIZE;
+	cp->bDescriptorType = USB_DT_CONFIG;
+	cp->wTotalLength = cpu_to_le16(len);
+	cp->bmAttributes |= USB_CONFIG_ATT_ONE;
+	return len;
+}
+
+/*-------------------------------------------------------------------------*/
+/*-------------------------------------------------------------------------*/
+
+
+#define RBUF_LEN (1024*1024)
+static int rbuf_start;
+static int rbuf_len;
+static __u8 rbuf[RBUF_LEN];
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_VERSION		"St Patrick's Day 2004"
+
+static const char shortname [] = "zero";
+static const char longname [] = "YAMAHA YST-MS35D USB Speaker  ";
+
+static const char source_sink [] = "source and sink data";
+static const char loopback [] = "loop input to output";
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * driver assumes self-powered hardware, and
+ * has no way for users to trigger remote wakeup.
+ *
+ * this version autoconfigures as much as possible,
+ * which is reasonable for most "bulk-only" drivers.
+ */
+static const char *EP_IN_NAME;		/* source */
+static const char *EP_OUT_NAME;		/* sink */
+
+/*-------------------------------------------------------------------------*/
+
+/* big enough to hold our biggest descriptor */
+#define USB_BUFSIZ	512
+
+struct zero_dev {
+	spinlock_t		lock;
+	struct usb_gadget	*gadget;
+	struct usb_request	*req;		/* for control responses */
+
+	/* when configured, we have one of two configs:
+	 * - source data (in to host) and sink it (out from host)
+	 * - or loop it back (out from host back in to host)
+	 */
+	u8			config;
+	struct usb_ep		*in_ep, *out_ep;
+
+	/* autoresume timer */
+	struct timer_list	resume;
+};
+
+#define xprintk(d,level,fmt,args...) \
+	dev_printk(level , &(d)->gadget->dev , fmt , ## args)
+
+#ifdef DEBUG
+#define DBG(dev,fmt,args...) \
+	xprintk(dev , KERN_DEBUG , fmt , ## args)
+#else
+#define DBG(dev,fmt,args...) \
+	do { } while (0)
+#endif /* DEBUG */
+
+#ifdef VERBOSE
+#define VDBG	DBG
+#else
+#define VDBG(dev,fmt,args...) \
+	do { } while (0)
+#endif /* VERBOSE */
+
+#define ERROR(dev,fmt,args...) \
+	xprintk(dev , KERN_ERR , fmt , ## args)
+#define WARN(dev,fmt,args...) \
+	xprintk(dev , KERN_WARNING , fmt , ## args)
+#define INFO(dev,fmt,args...) \
+	xprintk(dev , KERN_INFO , fmt , ## args)
+
+/*-------------------------------------------------------------------------*/
+
+static unsigned buflen = 4096;
+static unsigned qlen = 32;
+static unsigned pattern = 0;
+
+module_param (buflen, uint, S_IRUGO|S_IWUSR);
+module_param (qlen, uint, S_IRUGO|S_IWUSR);
+module_param (pattern, uint, S_IRUGO|S_IWUSR);
+
+/*
+ * if it's nonzero, autoresume says how many seconds to wait
+ * before trying to wake up the host after suspend.
+ */
+static unsigned autoresume = 0;
+module_param (autoresume, uint, 0);
+
+/*
+ * Normally the "loopback" configuration is second (index 1) so
+ * it's not the default.  Here's where to change that order, to
+ * work better with hosts where config changes are problematic.
+ * Or controllers (like superh) that only support one config.
+ */
+static int loopdefault = 0;
+
+module_param (loopdefault, bool, S_IRUGO|S_IWUSR);
+
+/*-------------------------------------------------------------------------*/
+
+/* Thanks to NetChip Technologies for donating this product ID.
+ *
+ * DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
+ * Instead:  allocate your own, using normal USB-IF procedures.
+ */
+#ifndef	CONFIG_USB_ZERO_HNPTEST
+#define DRIVER_VENDOR_NUM	0x0525		/* NetChip */
+#define DRIVER_PRODUCT_NUM	0xa4a0		/* Linux-USB "Gadget Zero" */
+#else
+#define DRIVER_VENDOR_NUM	0x1a0a		/* OTG test device IDs */
+#define DRIVER_PRODUCT_NUM	0xbadd
+#endif
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * DESCRIPTORS ... most are static, but strings and (full)
+ * configuration descriptors are built on demand.
+ */
+
+/*
+#define STRING_MANUFACTURER		25
+#define STRING_PRODUCT			42
+#define STRING_SERIAL			101
+*/
+#define STRING_MANUFACTURER		1
+#define STRING_PRODUCT			2
+#define STRING_SERIAL			3
+
+#define STRING_SOURCE_SINK		250
+#define STRING_LOOPBACK			251
+
+/*
+ * This device advertises two configurations; these numbers work
+ * on a pxa250 as well as more flexible hardware.
+ */
+#define	CONFIG_SOURCE_SINK	3
+#define	CONFIG_LOOPBACK		2
+
+/*
+static struct usb_device_descriptor
+device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+
+	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
+	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
+
+	.idVendor =		__constant_cpu_to_le16 (DRIVER_VENDOR_NUM),
+	.idProduct =		__constant_cpu_to_le16 (DRIVER_PRODUCT_NUM),
+	.iManufacturer =	STRING_MANUFACTURER,
+	.iProduct =		STRING_PRODUCT,
+	.iSerialNumber =	STRING_SERIAL,
+	.bNumConfigurations =	2,
+};
+*/
+static struct usb_device_descriptor
+device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+	.bcdUSB =		__constant_cpu_to_le16 (0x0100),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+	.bDeviceSubClass =      0,
+	.bDeviceProtocol =      0,
+	.bMaxPacketSize0 =      64,
+	.bcdDevice =            __constant_cpu_to_le16 (0x0100),
+	.idVendor =		__constant_cpu_to_le16 (0x0499),
+	.idProduct =		__constant_cpu_to_le16 (0x3002),
+	.iManufacturer =	STRING_MANUFACTURER,
+	.iProduct =		STRING_PRODUCT,
+	.iSerialNumber =	STRING_SERIAL,
+	.bNumConfigurations =	1,
+};
+
+static struct usb_config_descriptor
+z_config = {
+	.bLength =		sizeof z_config,
+	.bDescriptorType =	USB_DT_CONFIG,
+
+	/* compute wTotalLength on the fly */
+	.bNumInterfaces =	2,
+	.bConfigurationValue =	1,
+	.iConfiguration =	0,
+	.bmAttributes =		0x40,
+	.bMaxPower =		0,	/* self-powered */
+};
+
+
+static struct usb_otg_descriptor
+otg_descriptor = {
+	.bLength =		sizeof otg_descriptor,
+	.bDescriptorType =	USB_DT_OTG,
+
+	.bmAttributes =		USB_OTG_SRP,
+};
+
+/* one interface in each configuration */
+#ifdef	CONFIG_USB_GADGET_DUALSPEED
+
+/*
+ * usb 2.0 devices need to expose both high speed and full speed
+ * descriptors, unless they only run at full speed.
+ *
+ * that means alternate endpoint descriptors (bigger packets)
+ * and a "device qualifier" ... plus more construction options
+ * for the config descriptor.
+ */
+
+static struct usb_qualifier_descriptor
+dev_qualifier = {
+	.bLength =		sizeof dev_qualifier,
+	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
+
+	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
+	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
+
+	.bNumConfigurations =	2,
+};
+
+
+struct usb_cs_as_general_descriptor {
+	__u8  bLength;
+	__u8  bDescriptorType;
+
+	__u8  bDescriptorSubType;
+	__u8  bTerminalLink;
+	__u8  bDelay;
+	__u16  wFormatTag;
+} __attribute__ ((packed));
+
+struct usb_cs_as_format_descriptor {
+	__u8  bLength;
+	__u8  bDescriptorType;
+
+	__u8  bDescriptorSubType;
+	__u8  bFormatType;
+	__u8  bNrChannels;
+	__u8  bSubframeSize;
+	__u8  bBitResolution;
+	__u8  bSamfreqType;
+	__u8  tLowerSamFreq[3];
+	__u8  tUpperSamFreq[3];
+} __attribute__ ((packed));
+
+static const struct usb_interface_descriptor
+z_audio_control_if_desc = {
+	.bLength =		sizeof z_audio_control_if_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+	.bInterfaceNumber = 0,
+	.bAlternateSetting = 0,
+	.bNumEndpoints = 0,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = 0x1,
+	.bInterfaceProtocol = 0,
+	.iInterface = 0,
+};
+
+static const struct usb_interface_descriptor
+z_audio_if_desc = {
+	.bLength =		sizeof z_audio_if_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+	.bInterfaceNumber = 1,
+	.bAlternateSetting = 0,
+	.bNumEndpoints = 0,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = 0x2,
+	.bInterfaceProtocol = 0,
+	.iInterface = 0,
+};
+
+static const struct usb_interface_descriptor
+z_audio_if_desc2 = {
+	.bLength =		sizeof z_audio_if_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+	.bInterfaceNumber = 1,
+	.bAlternateSetting = 1,
+	.bNumEndpoints = 1,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = 0x2,
+	.bInterfaceProtocol = 0,
+	.iInterface = 0,
+};
+
+static const struct usb_cs_as_general_descriptor
+z_audio_cs_as_if_desc = {
+	.bLength = 7,
+	.bDescriptorType = 0x24,
+
+	.bDescriptorSubType = 0x01,
+	.bTerminalLink = 0x01,
+	.bDelay = 0x0,
+	.wFormatTag = __constant_cpu_to_le16 (0x0001)
+};
+
+
+static const struct usb_cs_as_format_descriptor
+z_audio_cs_as_format_desc = {
+	.bLength = 0xe,
+	.bDescriptorType = 0x24,
+
+	.bDescriptorSubType = 2,
+	.bFormatType = 1,
+	.bNrChannels = 1,
+	.bSubframeSize = 1,
+	.bBitResolution = 8,
+	.bSamfreqType = 0,
+	.tLowerSamFreq = {0x7e, 0x13, 0x00},
+	.tUpperSamFreq = {0xe2, 0xd6, 0x00},
+};
+
+static const struct usb_endpoint_descriptor
+z_iso_ep = {
+	.bLength = 0x09,
+	.bDescriptorType = 0x05,
+	.bEndpointAddress = 0x04,
+	.bmAttributes = 0x09,
+	.wMaxPacketSize = 0x0038,
+	.bInterval = 0x01,
+	.bRefresh = 0x00,
+	.bSynchAddress = 0x00,
+};
+
+static char z_iso_ep2[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+// 9 bytes
+static char z_ac_interface_header_desc[] =
+{ 0x09, 0x24, 0x01, 0x00, 0x01, 0x2b, 0x00, 0x01, 0x01 };
+
+// 12 bytes
+static char z_0[] = {0x0c, 0x24, 0x02, 0x01, 0x01, 0x01, 0x00, 0x02,
+		     0x03, 0x00, 0x00, 0x00};
+// 13 bytes
+static char z_1[] = {0x0d, 0x24, 0x06, 0x02, 0x01, 0x02, 0x15, 0x00,
+		     0x02, 0x00, 0x02, 0x00, 0x00};
+// 9 bytes
+static char z_2[] = {0x09, 0x24, 0x03, 0x03, 0x01, 0x03, 0x00, 0x02,
+		     0x00};
+
+static char za_0[] = {0x09, 0x04, 0x01, 0x02, 0x01, 0x01, 0x02, 0x00,
+		      0x00};
+
+static char za_1[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_2[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x01, 0x08, 0x00,
+		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_3[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
+		      0x00};
+
+static char za_4[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_5[] = {0x09, 0x04, 0x01, 0x03, 0x01, 0x01, 0x02, 0x00,
+		      0x00};
+
+static char za_6[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_7[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x02, 0x10, 0x00,
+		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_8[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
+		      0x00};
+
+static char za_9[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_10[] = {0x09, 0x04, 0x01, 0x04, 0x01, 0x01, 0x02, 0x00,
+		       0x00};
+
+static char za_11[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_12[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x02, 0x10, 0x00,
+		       0x73, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_13[] = {0x09, 0x05, 0x04, 0x09, 0xe0, 0x00, 0x01, 0x00,
+		       0x00};
+
+static char za_14[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_15[] = {0x09, 0x04, 0x01, 0x05, 0x01, 0x01, 0x02, 0x00,
+		       0x00};
+
+static char za_16[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_17[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x03, 0x14, 0x00,
+		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_18[] = {0x09, 0x05, 0x04, 0x09, 0xa8, 0x00, 0x01, 0x00,
+		       0x00};
+
+static char za_19[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_20[] = {0x09, 0x04, 0x01, 0x06, 0x01, 0x01, 0x02, 0x00,
+		       0x00};
+
+static char za_21[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_22[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x03, 0x14, 0x00,
+		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_23[] = {0x09, 0x05, 0x04, 0x09, 0x50, 0x01, 0x01, 0x00,
+		       0x00};
+
+static char za_24[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+
+
+static const struct usb_descriptor_header *z_function [] = {
+	(struct usb_descriptor_header *) &z_audio_control_if_desc,
+	(struct usb_descriptor_header *) &z_ac_interface_header_desc,
+	(struct usb_descriptor_header *) &z_0,
+	(struct usb_descriptor_header *) &z_1,
+	(struct usb_descriptor_header *) &z_2,
+	(struct usb_descriptor_header *) &z_audio_if_desc,
+	(struct usb_descriptor_header *) &z_audio_if_desc2,
+	(struct usb_descriptor_header *) &z_audio_cs_as_if_desc,
+	(struct usb_descriptor_header *) &z_audio_cs_as_format_desc,
+	(struct usb_descriptor_header *) &z_iso_ep,
+	(struct usb_descriptor_header *) &z_iso_ep2,
+	(struct usb_descriptor_header *) &za_0,
+	(struct usb_descriptor_header *) &za_1,
+	(struct usb_descriptor_header *) &za_2,
+	(struct usb_descriptor_header *) &za_3,
+	(struct usb_descriptor_header *) &za_4,
+	(struct usb_descriptor_header *) &za_5,
+	(struct usb_descriptor_header *) &za_6,
+	(struct usb_descriptor_header *) &za_7,
+	(struct usb_descriptor_header *) &za_8,
+	(struct usb_descriptor_header *) &za_9,
+	(struct usb_descriptor_header *) &za_10,
+	(struct usb_descriptor_header *) &za_11,
+	(struct usb_descriptor_header *) &za_12,
+	(struct usb_descriptor_header *) &za_13,
+	(struct usb_descriptor_header *) &za_14,
+	(struct usb_descriptor_header *) &za_15,
+	(struct usb_descriptor_header *) &za_16,
+	(struct usb_descriptor_header *) &za_17,
+	(struct usb_descriptor_header *) &za_18,
+	(struct usb_descriptor_header *) &za_19,
+	(struct usb_descriptor_header *) &za_20,
+	(struct usb_descriptor_header *) &za_21,
+	(struct usb_descriptor_header *) &za_22,
+	(struct usb_descriptor_header *) &za_23,
+	(struct usb_descriptor_header *) &za_24,
+	NULL,
+};
+
+/* maxpacket and other transfer characteristics vary by speed. */
+#define ep_desc(g,hs,fs) (((g)->speed==USB_SPEED_HIGH)?(hs):(fs))
+
+#else
+
+/* if there's no high speed support, maxpacket doesn't change. */
+#define ep_desc(g,hs,fs) fs
+
+#endif	/* !CONFIG_USB_GADGET_DUALSPEED */
+
+static char				manufacturer [40];
+//static char				serial [40];
+static char				serial [] = "Ser 00 em";
+
+/* static strings, in UTF-8 */
+static struct usb_string		strings [] = {
+	{ STRING_MANUFACTURER, manufacturer, },
+	{ STRING_PRODUCT, longname, },
+	{ STRING_SERIAL, serial, },
+	{ STRING_LOOPBACK, loopback, },
+	{ STRING_SOURCE_SINK, source_sink, },
+	{  }			/* end of list */
+};
+
+static struct usb_gadget_strings	stringtab = {
+	.language	= 0x0409,	/* en-us */
+	.strings	= strings,
+};
+
+/*
+ * config descriptors are also handcrafted.  these must agree with code
+ * that sets configurations, and with code managing interfaces and their
+ * altsettings.  other complexity may come from:
+ *
+ *  - high speed support, including "other speed config" rules
+ *  - multiple configurations
+ *  - interfaces with alternate settings
+ *  - embedded class or vendor-specific descriptors
+ *
+ * this handles high speed, and has a second config that could as easily
+ * have been an alternate interface setting (on most hardware).
+ *
+ * NOTE:  to demonstrate (and test) more USB capabilities, this driver
+ * should include an altsetting to test interrupt transfers, including
+ * high bandwidth modes at high speed.  (Maybe work like Intel's test
+ * device?)
+ */
+static int
+config_buf (struct usb_gadget *gadget, u8 *buf, u8 type, unsigned index)
+{
+	int len;
+	const struct usb_descriptor_header **function;
+
+	function = z_function;
+	len = usb_gadget_config_buf (&z_config, buf, USB_BUFSIZ, function);
+	if (len < 0)
+		return len;
+	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
+	return len;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_request *
+alloc_ep_req (struct usb_ep *ep, unsigned length)
+{
+	struct usb_request	*req;
+
+	req = usb_ep_alloc_request (ep, GFP_ATOMIC);
+	if (req) {
+		req->length = length;
+		req->buf = usb_ep_alloc_buffer (ep, length,
+				&req->dma, GFP_ATOMIC);
+		if (!req->buf) {
+			usb_ep_free_request (ep, req);
+			req = NULL;
+		}
+	}
+	return req;
+}
+
+static void free_ep_req (struct usb_ep *ep, struct usb_request *req)
+{
+	if (req->buf)
+		usb_ep_free_buffer (ep, req->buf, req->dma, req->length);
+	usb_ep_free_request (ep, req);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* optionally require specific source/sink data patterns  */
+
+static int
+check_read_data (
+	struct zero_dev		*dev,
+	struct usb_ep		*ep,
+	struct usb_request	*req
+)
+{
+	unsigned	i;
+	u8		*buf = req->buf;
+
+	for (i = 0; i < req->actual; i++, buf++) {
+		switch (pattern) {
+		/* all-zeroes has no synchronization issues */
+		case 0:
+			if (*buf == 0)
+				continue;
+			break;
+		/* mod63 stays in sync with short-terminated transfers,
+		 * or otherwise when host and gadget agree on how large
+		 * each usb transfer request should be.  resync is done
+		 * with set_interface or set_config.
+		 */
+		case 1:
+			if (*buf == (u8)(i % 63))
+				continue;
+			break;
+		}
+		ERROR (dev, "bad OUT byte, buf [%d] = %d\n", i, *buf);
+		usb_ep_set_halt (ep);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void zero_reset_config (struct zero_dev *dev)
+{
+	if (dev->config == 0)
+		return;
+
+	DBG (dev, "reset config\n");
+
+	/* just disable endpoints, forcing completion of pending i/o.
+	 * all our completion handlers free their requests in this case.
+	 */
+	if (dev->in_ep) {
+		usb_ep_disable (dev->in_ep);
+		dev->in_ep = NULL;
+	}
+	if (dev->out_ep) {
+		usb_ep_disable (dev->out_ep);
+		dev->out_ep = NULL;
+	}
+	dev->config = 0;
+	del_timer (&dev->resume);
+}
+
+#define _write(f, buf, sz) (f->f_op->write(f, buf, sz, &f->f_pos))
+
+static void
+zero_isoc_complete (struct usb_ep *ep, struct usb_request *req)
+{
+	struct zero_dev	*dev = ep->driver_data;
+	int		status = req->status;
+	int i, j;
+
+	switch (status) {
+
+	case 0: 			/* normal completion? */
+		//printk ("\nzero ---------------> isoc normal completion %d bytes\n", req->actual);
+		for (i=0, j=rbuf_start; i<req->actual; i++) {
+			//printk ("%02x ", ((__u8*)req->buf)[i]);
+			rbuf[j] = ((__u8*)req->buf)[i];
+			j++;
+			if (j >= RBUF_LEN) j=0;
+		}
+		rbuf_start = j;
+		//printk ("\n\n");
+
+		if (rbuf_len < RBUF_LEN) {
+			rbuf_len += req->actual;
+			if (rbuf_len > RBUF_LEN) {
+				rbuf_len = RBUF_LEN;
+			}
+		}
+
+		break;
+
+	/* this endpoint is normally active while we're configured */
+	case -ECONNABORTED: 		/* hardware forced ep reset */
+	case -ECONNRESET:		/* request dequeued */
+	case -ESHUTDOWN:		/* disconnect from host */
+		VDBG (dev, "%s gone (%d), %d/%d\n", ep->name, status,
+				req->actual, req->length);
+		if (ep == dev->out_ep)
+			check_read_data (dev, ep, req);
+		free_ep_req (ep, req);
+		return;
+
+	case -EOVERFLOW:		/* buffer overrun on read means that
+					 * we didn't provide a big enough
+					 * buffer.
+					 */
+	default:
+#if 1
+		DBG (dev, "%s complete --> %d, %d/%d\n", ep->name,
+				status, req->actual, req->length);
+#endif
+	case -EREMOTEIO:		/* short read */
+		break;
+	}
+
+	status = usb_ep_queue (ep, req, GFP_ATOMIC);
+	if (status) {
+		ERROR (dev, "kill %s:  resubmit %d bytes --> %d\n",
+				ep->name, req->length, status);
+		usb_ep_set_halt (ep);
+		/* FIXME recover later ... somehow */
+	}
+}
+
+static struct usb_request *
+zero_start_isoc_ep (struct usb_ep *ep, int gfp_flags)
+{
+	struct usb_request	*req;
+	int			status;
+
+	req = alloc_ep_req (ep, 512);
+	if (!req)
+		return NULL;
+
+	req->complete = zero_isoc_complete;
+
+	status = usb_ep_queue (ep, req, gfp_flags);
+	if (status) {
+		struct zero_dev	*dev = ep->driver_data;
+
+		ERROR (dev, "start %s --> %d\n", ep->name, status);
+		free_ep_req (ep, req);
+		req = NULL;
+	}
+
+	return req;
+}
+
+/* change our operational config.  this code must agree with the code
+ * that returns config descriptors, and altsetting code.
+ *
+ * it's also responsible for power management interactions. some
+ * configurations might not work with our current power sources.
+ *
+ * note that some device controller hardware will constrain what this
+ * code can do, perhaps by disallowing more than one configuration or
+ * by limiting configuration choices (like the pxa2xx).
+ */
+static int
+zero_set_config (struct zero_dev *dev, unsigned number, int gfp_flags)
+{
+	int			result = 0;
+	struct usb_gadget	*gadget = dev->gadget;
+	const struct usb_endpoint_descriptor	*d;
+	struct usb_ep		*ep;
+
+	if (number == dev->config)
+		return 0;
+
+	zero_reset_config (dev);
+
+	gadget_for_each_ep (ep, gadget) {
+
+		if (strcmp (ep->name, "ep4") == 0) {
+
+			d = (struct usb_endpoint_descripter *)&za_23; // isoc ep desc for audio i/f alt setting 6
+			result = usb_ep_enable (ep, d);
+
+			if (result == 0) {
+				ep->driver_data = dev;
+				dev->in_ep = ep;
+
+				if (zero_start_isoc_ep (ep, gfp_flags) != 0) {
+
+					dev->in_ep = ep;
+					continue;
+				}
+
+				usb_ep_disable (ep);
+				result = -EIO;
+			}
+		}
+
+	}
+
+	dev->config = number;
+	return result;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void zero_setup_complete (struct usb_ep *ep, struct usb_request *req)
+{
+	if (req->status || req->actual != req->length)
+		DBG ((struct zero_dev *) ep->driver_data,
+				"setup complete --> %d, %d/%d\n",
+				req->status, req->actual, req->length);
+}
+
+/*
+ * The setup() callback implements all the ep0 functionality that's
+ * not handled lower down, in hardware or the hardware driver (like
+ * device and endpoint feature flags, and their status).  It's all
+ * housekeeping for the gadget function we're implementing.  Most of
+ * the work is in config-specific setup.
+ */
+static int
+zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+	struct usb_request	*req = dev->req;
+	int			value = -EOPNOTSUPP;
+
+	/* usually this stores reply data in the pre-allocated ep0 buffer,
+	 * but config change events will reconfigure hardware.
+	 */
+	req->zero = 0;
+	switch (ctrl->bRequest) {
+
+	case USB_REQ_GET_DESCRIPTOR:
+
+		switch (ctrl->wValue >> 8) {
+
+		case USB_DT_DEVICE:
+			value = min (ctrl->wLength, (u16) sizeof device_desc);
+			memcpy (req->buf, &device_desc, value);
+			break;
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+		case USB_DT_DEVICE_QUALIFIER:
+			if (!gadget->is_dualspeed)
+				break;
+			value = min (ctrl->wLength, (u16) sizeof dev_qualifier);
+			memcpy (req->buf, &dev_qualifier, value);
+			break;
+
+		case USB_DT_OTHER_SPEED_CONFIG:
+			if (!gadget->is_dualspeed)
+				break;
+			// FALLTHROUGH
+#endif /* CONFIG_USB_GADGET_DUALSPEED */
+		case USB_DT_CONFIG:
+			value = config_buf (gadget, req->buf,
+					ctrl->wValue >> 8,
+					ctrl->wValue & 0xff);
+			if (value >= 0)
+				value = min (ctrl->wLength, (u16) value);
+			break;
+
+		case USB_DT_STRING:
+			/* wIndex == language code.
+			 * this driver only handles one language, you can
+			 * add string tables for other languages, using
+			 * any UTF-8 characters
+			 */
+			value = usb_gadget_get_string (&stringtab,
+					ctrl->wValue & 0xff, req->buf);
+			if (value >= 0) {
+				value = min (ctrl->wLength, (u16) value);
+			}
+			break;
+		}
+		break;
+
+	/* currently two configs, two speeds */
+	case USB_REQ_SET_CONFIGURATION:
+		if (ctrl->bRequestType != 0)
+			goto unknown;
+
+		spin_lock (&dev->lock);
+		value = zero_set_config (dev, ctrl->wValue, GFP_ATOMIC);
+		spin_unlock (&dev->lock);
+		break;
+	case USB_REQ_GET_CONFIGURATION:
+		if (ctrl->bRequestType != USB_DIR_IN)
+			goto unknown;
+		*(u8 *)req->buf = dev->config;
+		value = min (ctrl->wLength, (u16) 1);
+		break;
+
+	/* until we add altsetting support, or other interfaces,
+	 * only 0/0 are possible.  pxa2xx only supports 0/0 (poorly)
+	 * and already killed pending endpoint I/O.
+	 */
+	case USB_REQ_SET_INTERFACE:
+
+		if (ctrl->bRequestType != USB_RECIP_INTERFACE)
+			goto unknown;
+		spin_lock (&dev->lock);
+		if (dev->config) {
+			u8		config = dev->config;
+
+			/* resets interface configuration, forgets about
+			 * previous transaction state (queued bufs, etc)
+			 * and re-inits endpoint state (toggle etc)
+			 * no response queued, just zero status == success.
+			 * if we had more than one interface we couldn't
+			 * use this "reset the config" shortcut.
+			 */
+			zero_reset_config (dev);
+			zero_set_config (dev, config, GFP_ATOMIC);
+			value = 0;
+		}
+		spin_unlock (&dev->lock);
+		break;
+	case USB_REQ_GET_INTERFACE:
+		if ((ctrl->bRequestType == 0x21) && (ctrl->wIndex == 0x02)) {
+			value = ctrl->wLength;
+			break;
+		}
+		else {
+			if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
+				goto unknown;
+			if (!dev->config)
+				break;
+			if (ctrl->wIndex != 0) {
+				value = -EDOM;
+				break;
+			}
+			*(u8 *)req->buf = 0;
+			value = min (ctrl->wLength, (u16) 1);
+		}
+		break;
+
+	/*
+	 * These are the same vendor-specific requests supported by
+	 * Intel's USB 2.0 compliance test devices.  We exceed that
+	 * device spec by allowing multiple-packet requests.
+	 */
+	case 0x5b:	/* control WRITE test -- fill the buffer */
+		if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
+			goto unknown;
+		if (ctrl->wValue || ctrl->wIndex)
+			break;
+		/* just read that many bytes into the buffer */
+		if (ctrl->wLength > USB_BUFSIZ)
+			break;
+		value = ctrl->wLength;
+		break;
+	case 0x5c:	/* control READ test -- return the buffer */
+		if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
+			goto unknown;
+		if (ctrl->wValue || ctrl->wIndex)
+			break;
+		/* expect those bytes are still in the buffer; send back */
+		if (ctrl->wLength > USB_BUFSIZ
+				|| ctrl->wLength != req->length)
+			break;
+		value = ctrl->wLength;
+		break;
+
+	case 0x01: // SET_CUR
+	case 0x02:
+	case 0x03:
+	case 0x04:
+	case 0x05:
+		value = ctrl->wLength;
+		break;
+	case 0x81:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0xe3;
+			break;
+		case 0x0300:
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x00;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x81;
+		//((u8*)req->buf)[1] = 0x81;
+		value = ctrl->wLength;
+		break;
+	case 0x82:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0xc3;
+			break;
+		case 0x0300:
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x00;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x82;
+		//((u8*)req->buf)[1] = 0x82;
+		value = ctrl->wLength;
+		break;
+	case 0x83:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0x00;
+			break;
+		case 0x0300:
+			((u8*)req->buf)[0] = 0x60;
+			break;
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x18;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x83;
+		//((u8*)req->buf)[1] = 0x83;
+		value = ctrl->wLength;
+		break;
+	case 0x84:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0x01;
+			break;
+		case 0x0300:
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x08;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x84;
+		//((u8*)req->buf)[1] = 0x84;
+		value = ctrl->wLength;
+		break;
+	case 0x85:
+		((u8*)req->buf)[0] = 0x85;
+		((u8*)req->buf)[1] = 0x85;
+		value = ctrl->wLength;
+		break;
+
+
+	default:
+unknown:
+		printk("unknown control req%02x.%02x v%04x i%04x l%d\n",
+			ctrl->bRequestType, ctrl->bRequest,
+			ctrl->wValue, ctrl->wIndex, ctrl->wLength);
+	}
+
+	/* respond with data transfer before status phase? */
+	if (value >= 0) {
+		req->length = value;
+		req->zero = value < ctrl->wLength
+				&& (value % gadget->ep0->maxpacket) == 0;
+		value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
+		if (value < 0) {
+			DBG (dev, "ep_queue < 0 --> %d\n", value);
+			req->status = 0;
+			zero_setup_complete (gadget->ep0, req);
+		}
+	}
+
+	/* device either stalls (value < 0) or reports success */
+	return value;
+}
+
+static void
+zero_disconnect (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+	unsigned long		flags;
+
+	spin_lock_irqsave (&dev->lock, flags);
+	zero_reset_config (dev);
+
+	/* a more significant application might have some non-usb
+	 * activities to quiesce here, saving resources like power
+	 * or pushing the notification up a network stack.
+	 */
+	spin_unlock_irqrestore (&dev->lock, flags);
+
+	/* next we may get setup() calls to enumerate new connections;
+	 * or an unbind() during shutdown (including removing module).
+	 */
+}
+
+static void
+zero_autoresume (unsigned long _dev)
+{
+	struct zero_dev	*dev = (struct zero_dev *) _dev;
+	int		status;
+
+	/* normally the host would be woken up for something
+	 * more significant than just a timer firing...
+	 */
+	if (dev->gadget->speed != USB_SPEED_UNKNOWN) {
+		status = usb_gadget_wakeup (dev->gadget);
+		DBG (dev, "wakeup --> %d\n", status);
+	}
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void
+zero_unbind (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+
+	DBG (dev, "unbind\n");
+
+	/* we've already been disconnected ... no i/o is active */
+	if (dev->req)
+		free_ep_req (gadget->ep0, dev->req);
+	del_timer_sync (&dev->resume);
+	kfree (dev);
+	set_gadget_data (gadget, NULL);
+}
+
+static int
+zero_bind (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev;
+	//struct usb_ep		*ep;
+
+	printk("binding\n");
+	/*
+	 * DRIVER POLICY CHOICE:  you may want to do this differently.
+	 * One thing to avoid is reusing a bcdDevice revision code
+	 * with different host-visible configurations or behavior
+	 * restrictions -- using ep1in/ep2out vs ep1out/ep3in, etc
+	 */
+	//device_desc.bcdDevice = __constant_cpu_to_le16 (0x0201);
+
+
+	/* ok, we made sense of the hardware ... */
+	dev = kzalloc (sizeof *dev, SLAB_KERNEL);
+	if (!dev)
+		return -ENOMEM;
+	spin_lock_init (&dev->lock);
+	dev->gadget = gadget;
+	set_gadget_data (gadget, dev);
+
+	/* preallocate control response and buffer */
+	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
+	if (!dev->req)
+		goto enomem;
+	dev->req->buf = usb_ep_alloc_buffer (gadget->ep0, USB_BUFSIZ,
+				&dev->req->dma, GFP_KERNEL);
+	if (!dev->req->buf)
+		goto enomem;
+
+	dev->req->complete = zero_setup_complete;
+
+	device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
+
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+	/* assume ep0 uses the same value for both speeds ... */
+	dev_qualifier.bMaxPacketSize0 = device_desc.bMaxPacketSize0;
+
+	/* and that all endpoints are dual-speed */
+	//hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
+	//hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
+#endif
+
+	usb_gadget_set_selfpowered (gadget);
+
+	init_timer (&dev->resume);
+	dev->resume.function = zero_autoresume;
+	dev->resume.data = (unsigned long) dev;
+
+	gadget->ep0->driver_data = dev;
+
+	INFO (dev, "%s, version: " DRIVER_VERSION "\n", longname);
+	INFO (dev, "using %s, OUT %s IN %s\n", gadget->name,
+		EP_OUT_NAME, EP_IN_NAME);
+
+	snprintf (manufacturer, sizeof manufacturer,
+		UTS_SYSNAME " " UTS_RELEASE " with %s",
+		gadget->name);
+
+	return 0;
+
+enomem:
+	zero_unbind (gadget);
+	return -ENOMEM;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void
+zero_suspend (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+
+	if (gadget->speed == USB_SPEED_UNKNOWN)
+		return;
+
+	if (autoresume) {
+		mod_timer (&dev->resume, jiffies + (HZ * autoresume));
+		DBG (dev, "suspend, wakeup in %d seconds\n", autoresume);
+	} else
+		DBG (dev, "suspend\n");
+}
+
+static void
+zero_resume (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+
+	DBG (dev, "resume\n");
+	del_timer (&dev->resume);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver zero_driver = {
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+	.speed		= USB_SPEED_HIGH,
+#else
+	.speed		= USB_SPEED_FULL,
+#endif
+	.function	= (char *) longname,
+	.bind		= zero_bind,
+	.unbind		= zero_unbind,
+
+	.setup		= zero_setup,
+	.disconnect	= zero_disconnect,
+
+	.suspend	= zero_suspend,
+	.resume		= zero_resume,
+
+	.driver 	= {
+		.name		= (char *) shortname,
+		// .shutdown = ...
+		// .suspend = ...
+		// .resume = ...
+	},
+};
+
+MODULE_AUTHOR ("David Brownell");
+MODULE_LICENSE ("Dual BSD/GPL");
+
+static struct proc_dir_entry *pdir, *pfile;
+
+static int isoc_read_data (char *page, char **start,
+			   off_t off, int count,
+			   int *eof, void *data)
+{
+	int i;
+	static int c = 0;
+	static int done = 0;
+	static int s = 0;
+
+/*
+	printk ("\ncount: %d\n", count);
+	printk ("rbuf_start: %d\n", rbuf_start);
+	printk ("rbuf_len: %d\n", rbuf_len);
+	printk ("off: %d\n", off);
+	printk ("start: %p\n\n", *start);
+*/
+	if (done) {
+		c = 0;
+		done = 0;
+		*eof = 1;
+		return 0;
+	}
+
+	if (c == 0) {
+		if (rbuf_len == RBUF_LEN)
+			s = rbuf_start;
+		else s = 0;
+	}
+
+	for (i=0; i<count && c<rbuf_len; i++, c++) {
+		page[i] = rbuf[(c+s) % RBUF_LEN];
+	}
+	*start = page;
+
+	if (c >= rbuf_len) {
+		*eof = 1;
+		done = 1;
+	}
+
+
+	return i;
+}
+
+static int __init init (void)
+{
+
+	int retval = 0;
+
+	pdir = proc_mkdir("isoc_test", NULL);
+	if(pdir == NULL) {
+		retval = -ENOMEM;
+		printk("Error creating dir\n");
+		goto done;
+	}
+	pdir->owner = THIS_MODULE;
+
+	pfile = create_proc_read_entry("isoc_data",
+				       0444, pdir,
+				       isoc_read_data,
+				       NULL);
+	if (pfile == NULL) {
+		retval = -ENOMEM;
+		printk("Error creating file\n");
+		goto no_file;
+	}
+	pfile->owner = THIS_MODULE;
+
+	return usb_gadget_register_driver (&zero_driver);
+
+ no_file:
+	remove_proc_entry("isoc_data", NULL);
+ done:
+	return retval;
+}
+module_init (init);
+
+static void __exit cleanup (void)
+{
+
+	usb_gadget_unregister_driver (&zero_driver);
+
+	remove_proc_entry("isoc_data", pdir);
+	remove_proc_entry("isoc_test", NULL);
+}
+module_exit (cleanup);
diff --git a/drivers/usb/host/dwc_otg/dwc_cfi_common.h b/drivers/usb/host/dwc_otg/dwc_cfi_common.h
new file mode 100644
index 0000000000000..7770e201ad3bd
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_cfi_common.h
@@ -0,0 +1,142 @@
+/* ==========================================================================
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_CFI_COMMON_H__)
+#define __DWC_CFI_COMMON_H__
+
+//#include <linux/types.h>
+
+/**
+ * @file
+ *
+ * This file contains the CFI specific common constants, interfaces
+ * (functions and macros) and structures for Linux. No PCD specific
+ * data structure or definition is to be included in this file.
+ *
+ */
+
+/** This is a request for all Core Features */
+#define VEN_CORE_GET_FEATURES		0xB1
+
+/** This is a request to get the value of a specific Core Feature */
+#define VEN_CORE_GET_FEATURE		0xB2
+
+/** This command allows the host to set the value of a specific Core Feature */
+#define VEN_CORE_SET_FEATURE		0xB3
+
+/** This command allows the host to set the default values of
+ * either all or any specific Core Feature
+ */
+#define VEN_CORE_RESET_FEATURES		0xB4
+
+/** This command forces the PCD to write the deferred values of a Core Features */
+#define VEN_CORE_ACTIVATE_FEATURES	0xB5
+
+/** This request reads a DWORD value from a register at the specified offset */
+#define VEN_CORE_READ_REGISTER		0xB6
+
+/** This request writes a DWORD value into a register at the specified offset */
+#define VEN_CORE_WRITE_REGISTER		0xB7
+
+/** This structure is the header of the Core Features dataset returned to
+ *  the Host
+ */
+struct cfi_all_features_header {
+/** The features header structure length is */
+#define CFI_ALL_FEATURES_HDR_LEN		8
+	/**
+	 * The total length of the features dataset returned to the Host
+	 */
+	uint16_t wTotalLen;
+
+	/**
+	 * CFI version number inBinary-Coded Decimal (i.e., 1.00 is 100H).
+	 * This field identifies the version of the CFI Specification with which
+	 * the device is compliant.
+	 */
+	uint16_t wVersion;
+
+	/** The ID of the Core */
+	uint16_t wCoreID;
+#define CFI_CORE_ID_UDC		1
+#define CFI_CORE_ID_OTG		2
+#define CFI_CORE_ID_WUDEV	3
+
+	/** Number of features returned by VEN_CORE_GET_FEATURES request */
+	uint16_t wNumFeatures;
+} UPACKED;
+
+typedef struct cfi_all_features_header cfi_all_features_header_t;
+
+/** This structure is a header of the Core Feature descriptor dataset returned to
+ *  the Host after the VEN_CORE_GET_FEATURES request
+ */
+struct cfi_feature_desc_header {
+#define CFI_FEATURE_DESC_HDR_LEN	8
+
+	/** The feature ID */
+	uint16_t wFeatureID;
+
+	/** Length of this feature descriptor in bytes - including the
+	 * length of the feature name string
+	 */
+	uint16_t wLength;
+
+	/** The data length of this feature in bytes */
+	uint16_t wDataLength;
+
+	/**
+	 * Attributes of this features
+	 * D0: Access rights
+	 * 0 - Read/Write
+	 * 1 - Read only
+	 */
+	uint8_t bmAttributes;
+#define CFI_FEATURE_ATTR_RO		1
+#define CFI_FEATURE_ATTR_RW		0
+
+	/** Length of the feature name in bytes */
+	uint8_t bNameLen;
+
+	/** The feature name buffer */
+	//uint8_t *name;
+} UPACKED;
+
+typedef struct cfi_feature_desc_header cfi_feature_desc_header_t;
+
+/**
+ * This structure describes a NULL terminated string referenced by its id field.
+ * It is very similar to usb_string structure but has the id field type set to 16-bit.
+ */
+struct cfi_string {
+	uint16_t id;
+	const uint8_t *s;
+};
+typedef struct cfi_string cfi_string_t;
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_adp.c b/drivers/usb/host/dwc_otg/dwc_otg_adp.c
new file mode 100644
index 0000000000000..ce0618dd3f4a6
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.c
@@ -0,0 +1,854 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.c $
+ * $Revision: #12 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#include "dwc_os.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_adp.h"
+
+/** @file
+ *
+ * This file contains the most of the Attach Detect Protocol implementation for
+ * the driver to support OTG Rev2.0.
+ *
+ */
+
+void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value)
+{
+	adpctl_data_t adpctl;
+
+	adpctl.d32 = value;
+	adpctl.b.ar = 0x2;
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
+
+	while (adpctl.b.ar) {
+		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
+	}
+
+}
+
+/**
+ * Function is called to read ADP registers
+ */
+uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	adpctl.d32 = 0;
+	adpctl.b.ar = 0x1;
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
+
+	while (adpctl.b.ar) {
+		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
+	}
+
+	return adpctl.d32;
+}
+
+/**
+ * Function is called to read ADPCTL register and filter Write-clear bits
+ */
+uint32_t dwc_otg_adp_read_reg_filter(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_tmout_int = 0;
+	adpctl.b.adp_prb_int = 0;
+	adpctl.b.adp_tmout_int = 0;
+
+	return adpctl.d32;
+}
+
+/**
+ * Function is called to write ADP registers
+ */
+void dwc_otg_adp_modify_reg(dwc_otg_core_if_t * core_if, uint32_t clr,
+			    uint32_t set)
+{
+	dwc_otg_adp_write_reg(core_if,
+			      (dwc_otg_adp_read_reg(core_if) & (~clr)) | set);
+}
+
+static void adp_sense_timeout(void *ptr)
+{
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+	core_if->adp.sense_timer_started = 0;
+	DWC_PRINTF("ADP SENSE TIMEOUT\n");
+	if (core_if->adp_enable) {
+		dwc_otg_adp_sense_stop(core_if);
+		dwc_otg_adp_probe_start(core_if);
+	}
+}
+
+/**
+ * This function is called when the ADP vbus timer expires. Timeout is 1.1s.
+ */
+static void adp_vbuson_timeout(void *ptr)
+{
+	gpwrdn_data_t gpwrdn;
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+	hprt0_data_t hprt0 = {.d32 = 0 };
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	DWC_PRINTF("%s: 1.1 seconds expire after turning on VBUS\n",__FUNCTION__);
+	if (core_if) {
+		core_if->adp.vbuson_timer_started = 0;
+		/* Turn off vbus */
+		hprt0.b.prtpwr = 1;
+		DWC_MODIFY_REG32(core_if->host_if->hprt0, hprt0.d32, 0);
+		gpwrdn.d32 = 0;
+
+		/* Power off the core */
+		if (core_if->power_down == 2) {
+			/* Enable Wakeup Logic */
+//                      gpwrdn.b.wkupactiv = 1;
+			gpwrdn.b.pmuactv = 0;
+			gpwrdn.b.pwrdnrstn = 1;
+			gpwrdn.b.pwrdnclmp = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+
+			/* Suspend the Phy Clock */
+			pcgcctl.b.stoppclk = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+			/* Switch on VDD */
+//                      gpwrdn.b.wkupactiv = 1;
+			gpwrdn.b.pmuactv = 1;
+			gpwrdn.b.pwrdnrstn = 1;
+			gpwrdn.b.pwrdnclmp = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+		} else {
+			/* Enable Power Down Logic */
+			gpwrdn.b.pmuintsel = 1;
+			gpwrdn.b.pmuactv = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		}
+
+		/* Power off the core */
+		if (core_if->power_down == 2) {
+			gpwrdn.d32 = 0;
+			gpwrdn.b.pwrdnswtch = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn,
+					 gpwrdn.d32, 0);
+		}
+
+		/* Unmask SRP detected interrupt from Power Down Logic */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.srp_det_msk = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+
+		dwc_otg_adp_probe_start(core_if);
+		dwc_otg_dump_global_registers(core_if);
+		dwc_otg_dump_host_registers(core_if);
+	}
+
+}
+
+/**
+ * Start the ADP Initial Probe timer to detect if Port Connected interrupt is
+ * not asserted within 1.1 seconds.
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+void dwc_otg_adp_vbuson_timer_start(dwc_otg_core_if_t * core_if)
+{
+	core_if->adp.vbuson_timer_started = 1;
+	if (core_if->adp.vbuson_timer)
+	{
+		DWC_PRINTF("SCHEDULING VBUSON TIMER\n");
+		/* 1.1 secs + 60ms necessary for cil_hcd_start*/
+		DWC_TIMER_SCHEDULE(core_if->adp.vbuson_timer, 1160);
+	} else {
+		DWC_WARN("VBUSON_TIMER = %p\n",core_if->adp.vbuson_timer);
+	}
+}
+
+#if 0
+/**
+ * Masks all DWC OTG core interrupts
+ *
+ */
+static void mask_all_interrupts(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+
+	/* Mask Host Interrupts */
+
+	/* Clear and disable HCINTs */
+	for (i = 0; i < core_if->core_params->host_channels; i++) {
+		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk, 0);
+		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcint, 0xFFFFFFFF);
+
+	}
+
+	/* Clear and disable HAINT */
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk, 0x0000);
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haint, 0xFFFFFFFF);
+
+	/* Mask Device Interrupts */
+	if (!core_if->multiproc_int_enable) {
+		/* Clear and disable IN Endpoint interrupts */
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, 0);
+		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
+					diepint, 0xFFFFFFFF);
+		}
+
+		/* Clear and disable OUT Endpoint interrupts */
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, 0);
+		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
+					doepint, 0xFFFFFFFF);
+		}
+
+		/* Clear and disable DAINT */
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daint,
+				0xFFFFFFFF);
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, 0);
+	} else {
+		for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					diepeachintmsk[i], 0);
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
+					diepint, 0xFFFFFFFF);
+		}
+
+		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					doepeachintmsk[i], 0);
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
+					doepint, 0xFFFFFFFF);
+		}
+
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
+				0);
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachint,
+				0xFFFFFFFF);
+
+	}
+
+	/* Disable interrupts */
+	ahbcfg.b.glblintrmsk = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
+
+	/* Disable all interrupts. */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
+
+	/* Clear any pending interrupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Clear any pending OTG Interrupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, 0xFFFFFFFF);
+}
+
+/**
+ * Unmask Port Connection Detected interrupt
+ *
+ */
+static void unmask_conn_det_intr(dwc_otg_core_if_t * core_if)
+{
+	gintmsk_data_t gintmsk = {.d32 = 0,.b.portintr = 1 };
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
+}
+#endif
+
+/**
+ * Starts the ADP Probing
+ *
+ * @param core_if the pointer to core_if structure.
+ */
+uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if)
+{
+
+	adpctl_data_t adpctl = {.d32 = 0};
+	gpwrdn_data_t gpwrdn;
+#if 0
+	adpctl_data_t adpctl_int = {.d32 = 0, .b.adp_prb_int = 1,
+								.b.adp_sns_int = 1, b.adp_tmout_int};
+#endif
+	dwc_otg_disable_global_interrupts(core_if);
+	DWC_PRINTF("ADP Probe Start\n");
+	core_if->adp.probe_enabled = 1;
+
+	adpctl.b.adpres = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	while (adpctl.b.adpres) {
+		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	}
+
+	adpctl.d32 = 0;
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+	/* In Host mode unmask SRP detected interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.sts_chngint_msk = 1;
+	if (!gpwrdn.b.idsts) {
+		gpwrdn.b.srp_det_msk = 1;
+	}
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+
+	adpctl.b.adp_tmout_int_msk = 1;
+	adpctl.b.adp_prb_int_msk = 1;
+	adpctl.b.prb_dschg = 1;
+	adpctl.b.prb_delta = 1;
+	adpctl.b.prb_per = 1;
+	adpctl.b.adpen = 1;
+	adpctl.b.enaprb = 1;
+
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+	DWC_PRINTF("ADP Probe Finish\n");
+	return 0;
+}
+
+/**
+ * Starts the ADP Sense timer to detect if ADP Sense interrupt is not asserted
+ * within 3 seconds.
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+void dwc_otg_adp_sense_timer_start(dwc_otg_core_if_t * core_if)
+{
+	core_if->adp.sense_timer_started = 1;
+	DWC_TIMER_SCHEDULE(core_if->adp.sense_timer, 3000 /* 3 secs */ );
+}
+
+/**
+ * Starts the ADP Sense
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	DWC_PRINTF("ADP Sense Start\n");
+
+	/* Unmask ADP sense interrupt and mask all other from the core */
+	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
+	adpctl.b.adp_sns_int_msk = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+	dwc_otg_disable_global_interrupts(core_if); // vahrama
+
+	/* Set ADP reset bit*/
+	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
+	adpctl.b.adpres = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	while (adpctl.b.adpres) {
+		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	}
+
+	adpctl.b.adpres = 0;
+	adpctl.b.adpen = 1;
+	adpctl.b.enasns = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	dwc_otg_adp_sense_timer_start(core_if);
+
+	return 0;
+}
+
+/**
+ * Stops the ADP Probing
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if)
+{
+
+	adpctl_data_t adpctl;
+	DWC_PRINTF("Stop ADP probe\n");
+	core_if->adp.probe_enabled = 0;
+	core_if->adp.probe_counter = 0;
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+
+	adpctl.b.adpen = 0;
+	adpctl.b.adp_prb_int = 1;
+	adpctl.b.adp_tmout_int = 1;
+	adpctl.b.adp_sns_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * Stops the ADP Sensing
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	core_if->adp.sense_enabled = 0;
+
+	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
+	adpctl.b.enasns = 0;
+	adpctl.b.adp_sns_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * Called to turn on the VBUS after initial ADP probe in host mode.
+ * If port power was already enabled in cil_hcd_start function then
+ * only schedule a timer.
+ *
+ * @param core_if the pointer to core_if structure.
+ */
+void dwc_otg_adp_turnon_vbus(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0 = {.d32 = 0 };
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	DWC_PRINTF("Turn on VBUS for 1.1s, port power is %d\n", hprt0.b.prtpwr);
+
+	if (hprt0.b.prtpwr == 0) {
+		hprt0.b.prtpwr = 1;
+		//DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	}
+
+	dwc_otg_adp_vbuson_timer_start(core_if);
+}
+
+/**
+ * Called right after driver is loaded
+ * to perform initial actions for ADP
+ *
+ * @param core_if the pointer to core_if structure.
+ * @param is_host - flag for current mode of operation either from GINTSTS or GPWRDN
+ */
+void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host)
+{
+	gpwrdn_data_t gpwrdn;
+
+	DWC_PRINTF("ADP Initial Start\n");
+	core_if->adp.adp_started = 1;
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+	dwc_otg_disable_global_interrupts(core_if);
+	if (is_host) {
+		DWC_PRINTF("HOST MODE\n");
+		/* Enable Power Down Logic Interrupt*/
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuintsel = 1;
+		gpwrdn.b.pmuactv = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		/* Initialize first ADP probe to obtain Ramp Time value */
+		core_if->adp.initial_probe = 1;
+		dwc_otg_adp_probe_start(core_if);
+	} else {
+		gotgctl_data_t gotgctl;
+		gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+		DWC_PRINTF("DEVICE MODE\n");
+		if (gotgctl.b.bsesvld == 0) {
+			/* Enable Power Down Logic Interrupt*/
+			gpwrdn.d32 = 0;
+			DWC_PRINTF("VBUS is not valid - start ADP probe\n");
+			gpwrdn.b.pmuintsel = 1;
+			gpwrdn.b.pmuactv = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+			core_if->adp.initial_probe = 1;
+			dwc_otg_adp_probe_start(core_if);
+		} else {
+			DWC_PRINTF("VBUS is valid - initialize core as a Device\n");
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+			dwc_otg_dump_global_registers(core_if);
+			dwc_otg_dump_dev_registers(core_if);
+		}
+	}
+}
+
+void dwc_otg_adp_init(dwc_otg_core_if_t * core_if)
+{
+	core_if->adp.adp_started = 0;
+	core_if->adp.initial_probe = 0;
+	core_if->adp.probe_timer_values[0] = -1;
+	core_if->adp.probe_timer_values[1] = -1;
+	core_if->adp.probe_enabled = 0;
+	core_if->adp.sense_enabled = 0;
+	core_if->adp.sense_timer_started = 0;
+	core_if->adp.vbuson_timer_started = 0;
+	core_if->adp.probe_counter = 0;
+	core_if->adp.gpwrdn = 0;
+	core_if->adp.attached = DWC_OTG_ADP_UNKOWN;
+	/* Initialize timers */
+	core_if->adp.sense_timer =
+	    DWC_TIMER_ALLOC("ADP SENSE TIMER", adp_sense_timeout, core_if);
+	core_if->adp.vbuson_timer =
+	    DWC_TIMER_ALLOC("ADP VBUS ON TIMER", adp_vbuson_timeout, core_if);
+	if (!core_if->adp.sense_timer || !core_if->adp.vbuson_timer)
+	{
+		DWC_ERROR("Could not allocate memory for ADP timers\n");
+	}
+}
+
+void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = { .d32 = 0 };
+	gpwrdn.b.pmuintsel = 1;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	if (core_if->adp.probe_enabled)
+		dwc_otg_adp_probe_stop(core_if);
+	if (core_if->adp.sense_enabled)
+		dwc_otg_adp_sense_stop(core_if);
+	if (core_if->adp.sense_timer_started)
+		DWC_TIMER_CANCEL(core_if->adp.sense_timer);
+	if (core_if->adp.vbuson_timer_started)
+		DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
+	DWC_TIMER_FREE(core_if->adp.sense_timer);
+	DWC_TIMER_FREE(core_if->adp.vbuson_timer);
+}
+
+/////////////////////////////////////////////////////////////////////
+////////////// ADP Interrupt Handlers ///////////////////////////////
+/////////////////////////////////////////////////////////////////////
+/**
+ * This function sets Ramp Timer values
+ */
+static uint32_t set_timer_value(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	if (core_if->adp.probe_timer_values[0] == -1) {
+		core_if->adp.probe_timer_values[0] = val;
+		core_if->adp.probe_timer_values[1] = -1;
+		return 1;
+	} else {
+		core_if->adp.probe_timer_values[1] =
+		    core_if->adp.probe_timer_values[0];
+		core_if->adp.probe_timer_values[0] = val;
+		return 0;
+	}
+}
+
+/**
+ * This function compares Ramp Timer values
+ */
+static uint32_t compare_timer_values(dwc_otg_core_if_t * core_if)
+{
+	uint32_t diff;
+	if (core_if->adp.probe_timer_values[0]>=core_if->adp.probe_timer_values[1])
+			diff = core_if->adp.probe_timer_values[0]-core_if->adp.probe_timer_values[1];
+	else
+			diff = core_if->adp.probe_timer_values[1]-core_if->adp.probe_timer_values[0];
+	if(diff < 2) {
+		return 0;
+	} else {
+		return 1;
+	}
+}
+
+/**
+ * This function handles ADP Probe Interrupts
+ */
+static int32_t dwc_otg_adp_handle_prb_intr(dwc_otg_core_if_t * core_if,
+						 uint32_t val)
+{
+	adpctl_data_t adpctl = {.d32 = 0 };
+	gpwrdn_data_t gpwrdn, temp;
+	adpctl.d32 = val;
+
+	temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	core_if->adp.probe_counter++;
+	core_if->adp.gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (adpctl.b.rtim == 0 && !temp.b.idsts){
+		DWC_PRINTF("RTIM value is 0\n");
+		goto exit;
+	}
+	if (set_timer_value(core_if, adpctl.b.rtim) &&
+	    core_if->adp.initial_probe) {
+		core_if->adp.initial_probe = 0;
+		dwc_otg_adp_probe_stop(core_if);
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuactv = 1;
+		gpwrdn.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+		/* check which value is for device mode and which for Host mode */
+		if (!temp.b.idsts) {	/* considered host mode value is 0 */
+			/*
+			 * Turn on VBUS after initial ADP probe.
+			 */
+			core_if->op_state = A_HOST;
+			dwc_otg_enable_global_interrupts(core_if);
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_start(core_if);
+			dwc_otg_adp_turnon_vbus(core_if);
+			DWC_SPINLOCK(core_if->lock);
+		} else {
+			/*
+			 * Initiate SRP after initial ADP probe.
+			 */
+			dwc_otg_enable_global_interrupts(core_if);
+			dwc_otg_initiate_srp(core_if);
+		}
+	} else if (core_if->adp.probe_counter > 2){
+		gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+		if (compare_timer_values(core_if)) {
+			DWC_PRINTF("Difference in timer values !!! \n");
+//                      core_if->adp.attached = DWC_OTG_ADP_ATTACHED;
+			dwc_otg_adp_probe_stop(core_if);
+
+			/* Power on the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+			}
+
+			/* check which value is for device mode and which for Host mode */
+			if (!temp.b.idsts) {	/* considered host mode value is 0 */
+				/* Disable Interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Host mode.
+				 */
+				core_if->op_state = A_HOST;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_hcd_start(core_if);
+			} else {
+				gotgctl_data_t gotgctl;
+				/* Mask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, gpwrdn.d32, 0);
+
+				/* Disable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Device mode.
+				 */
+				core_if->op_state = B_PERIPHERAL;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_pcd_start(core_if);
+
+				gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+				if (!gotgctl.b.bsesvld) {
+					dwc_otg_initiate_srp(core_if);
+				}
+			}
+		}
+		if (core_if->power_down == 2) {
+			if (gpwrdn.b.bsessvld) {
+				/* Mask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+				/* Disable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Device mode.
+				 */
+				core_if->op_state = B_PERIPHERAL;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_pcd_start(core_if);
+			}
+		}
+	}
+exit:
+	/* Clear interrupt */
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_prb_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * This function hadles ADP Sense Interrupt
+ */
+static int32_t dwc_otg_adp_handle_sns_intr(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+	/* Stop ADP Sense timer */
+	DWC_TIMER_CANCEL(core_if->adp.sense_timer);
+
+	/* Restart ADP Sense timer */
+	dwc_otg_adp_sense_timer_start(core_if);
+
+	/* Clear interrupt */
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_sns_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * This function handles ADP Probe Interrupts
+ */
+static int32_t dwc_otg_adp_handle_prb_tmout_intr(dwc_otg_core_if_t * core_if,
+						 uint32_t val)
+{
+	adpctl_data_t adpctl = {.d32 = 0 };
+	adpctl.d32 = val;
+	set_timer_value(core_if, adpctl.b.rtim);
+
+	/* Clear interrupt */
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_tmout_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * ADP Interrupt handler.
+ *
+ */
+int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if)
+{
+	int retval = 0;
+	adpctl_data_t adpctl = {.d32 = 0};
+
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	DWC_PRINTF("ADPCTL = %08x\n",adpctl.d32);
+
+	if (adpctl.b.adp_sns_int & adpctl.b.adp_sns_int_msk) {
+		DWC_PRINTF("ADP Sense interrupt\n");
+		retval |= dwc_otg_adp_handle_sns_intr(core_if);
+	}
+	if (adpctl.b.adp_tmout_int & adpctl.b.adp_tmout_int_msk) {
+		DWC_PRINTF("ADP timeout interrupt\n");
+		retval |= dwc_otg_adp_handle_prb_tmout_intr(core_if, adpctl.d32);
+	}
+	if (adpctl.b.adp_prb_int & adpctl.b.adp_prb_int_msk) {
+		DWC_PRINTF("ADP Probe interrupt\n");
+		adpctl.b.adp_prb_int = 1;
+		retval |= dwc_otg_adp_handle_prb_intr(core_if, adpctl.d32);
+	}
+
+//	dwc_otg_adp_modify_reg(core_if, adpctl.d32, 0);
+	//dwc_otg_adp_write_reg(core_if, adpctl.d32);
+	DWC_PRINTF("RETURN FROM ADP ISR\n");
+
+	return retval;
+}
+
+/**
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if)
+{
+
+#ifndef DWC_HOST_ONLY
+	hprt0_data_t hprt0;
+	gpwrdn_data_t gpwrdn;
+	DWC_DEBUGPL(DBG_ANY, "++ Power Down Logic Session Request Interrupt++\n");
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	/* check which value is for device mode and which for Host mode */
+	if (!gpwrdn.b.idsts) {	/* considered host mode value is 0 */
+		DWC_PRINTF("SRP: Host mode\n");
+
+		if (core_if->adp_enable) {
+			dwc_otg_adp_probe_stop(core_if);
+
+			/* Power on the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+			}
+
+			core_if->op_state = A_HOST;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_hcd_start(core_if);
+		}
+
+		/* Turn on the port power bit. */
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		hprt0.b.prtpwr = 1;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+		/* Start the Connection timer. So a message can be displayed
+		 * if connect does not occur within 10 seconds. */
+		cil_hcd_session_start(core_if);
+	} else {
+		DWC_PRINTF("SRP: Device mode %s\n", __FUNCTION__);
+		if (core_if->adp_enable) {
+			dwc_otg_adp_probe_stop(core_if);
+
+			/* Power on the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+			}
+
+			gpwrdn.d32 = 0;
+			gpwrdn.b.pmuactv = 0;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+		}
+	}
+#endif
+	return 1;
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_adp.h b/drivers/usb/host/dwc_otg/dwc_otg_adp.h
new file mode 100644
index 0000000000000..4110b25d2002e
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.h
@@ -0,0 +1,80 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.h $
+ * $Revision: #7 $
+ * $Date: 2011/10/24 $
+ * $Change: 1871159 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_ADP_H__
+#define __DWC_OTG_ADP_H__
+
+/**
+ * @file
+ *
+ * This file contains the Attach Detect Protocol interfaces and defines
+ * (functions) and structures for Linux.
+ *
+ */
+
+#define DWC_OTG_ADP_UNATTACHED	0
+#define DWC_OTG_ADP_ATTACHED	1
+#define DWC_OTG_ADP_UNKOWN	2
+
+typedef struct dwc_otg_adp {
+	uint32_t adp_started;
+	uint32_t initial_probe;
+	int32_t probe_timer_values[2];
+	uint32_t probe_enabled;
+	uint32_t sense_enabled;
+	dwc_timer_t *sense_timer;
+	uint32_t sense_timer_started;
+	dwc_timer_t *vbuson_timer;
+	uint32_t vbuson_timer_started;
+	uint32_t attached;
+	uint32_t probe_counter;
+	uint32_t gpwrdn;
+} dwc_otg_adp_t;
+
+/**
+ * Attach Detect Protocol functions
+ */
+
+extern void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value);
+extern uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
+extern void dwc_otg_adp_init(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if);
+extern int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if);
+extern int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if);
+
+#endif //__DWC_OTG_ADP_H__
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_attr.c b/drivers/usb/host/dwc_otg/dwc_otg_attr.c
new file mode 100644
index 0000000000000..2f8ea77c3892b
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.c
@@ -0,0 +1,1212 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.c $
+ * $Revision: #44 $
+ * $Date: 2010/11/29 $
+ * $Change: 1636033 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * The diagnostic interface will provide access to the controller for
+ * bringing up the hardware and testing.  The Linux driver attributes
+ * feature will be used to provide the Linux Diagnostic
+ * Interface. These attributes are accessed through sysfs.
+ */
+
+/** @page "Linux Module Attributes"
+ *
+ * The Linux module attributes feature is used to provide the Linux
+ * Diagnostic Interface.  These attributes are accessed through sysfs.
+ * The diagnostic interface will provide access to the controller for
+ * bringing up the hardware and testing.
+
+ The following table shows the attributes.
+ <table>
+ <tr>
+ <td><b> Name</b></td>
+ <td><b> Description</b></td>
+ <td><b> Access</b></td>
+ </tr>
+
+ <tr>
+ <td> mode </td>
+ <td> Returns the current mode: 0 for device mode, 1 for host mode</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hnpcapable </td>
+ <td> Gets or sets the "HNP-capable" bit in the Core USB Configuraton Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> srpcapable </td>
+ <td> Gets or sets the "SRP-capable" bit in the Core USB Configuraton Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> hsic_connect </td>
+ <td> Gets or sets the "HSIC-Connect" bit in the GLPMCFG Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> inv_sel_hsic </td>
+ <td> Gets or sets the "Invert Select HSIC" bit in the GLPMFG Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> hnp </td>
+ <td> Initiates the Host Negotiation Protocol.  Read returns the status.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> srp </td>
+ <td> Initiates the Session Request Protocol.  Read returns the status.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> buspower </td>
+ <td> Gets or sets the Power State of the bus (0 - Off or 1 - On)</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> bussuspend </td>
+ <td> Suspends the USB bus.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> busconnected </td>
+ <td> Gets the connection status of the bus</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> gotgctl </td>
+ <td> Gets or sets the Core Control Status Register.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gusbcfg </td>
+ <td> Gets or sets the Core USB Configuration Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> grxfsiz </td>
+ <td> Gets or sets the Receive FIFO Size Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gnptxfsiz </td>
+ <td> Gets or sets the non-periodic Transmit Size Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gpvndctl </td>
+ <td> Gets or sets the PHY Vendor Control Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> ggpio </td>
+ <td> Gets the value in the lower 16-bits of the General Purpose IO Register
+ or sets the upper 16 bits.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> guid </td>
+ <td> Gets or sets the value of the User ID Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gsnpsid </td>
+ <td> Gets the value of the Synopsys ID Regester</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> devspeed </td>
+ <td> Gets or sets the device speed setting in the DCFG register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> enumspeed </td>
+ <td> Gets the device enumeration Speed.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hptxfsiz </td>
+ <td> Gets the value of the Host Periodic Transmit FIFO</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hprt0 </td>
+ <td> Gets or sets the value in the Host Port Control and Status Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> regoffset </td>
+ <td> Sets the register offset for the next Register Access</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> regvalue </td>
+ <td> Gets or sets the value of the register at the offset in the regoffset attribute.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> remote_wakeup </td>
+ <td> On read, shows the status of Remote Wakeup. On write, initiates a remote
+ wakeup of the host. When bit 0 is 1 and Remote Wakeup is enabled, the Remote
+ Wakeup signalling bit in the Device Control Register is set for 1
+ milli-second.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> rem_wakeup_pwrdn </td>
+ <td> On read, shows the status core - hibernated or not. On write, initiates
+ a remote wakeup of the device from Hibernation. </td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> mode_ch_tim_en </td>
+ <td> This bit is used to enable or disable the host core to wait for 200 PHY
+ clock cycles at the end of Resume to change the opmode signal to the PHY to 00
+ after Suspend or LPM. </td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> fr_interval </td>
+ <td> On read, shows the value of HFIR Frame Interval. On write, dynamically
+ reload HFIR register during runtime. The application can write a value to this
+ register only after the Port Enable bit of the Host Port Control and Status
+ register (HPRT.PrtEnaPort) has been set </td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> disconnect_us </td>
+ <td> On read, shows the status of disconnect_device_us. On write, sets disconnect_us
+ which causes soft disconnect for 100us. Applicable only for device mode of operation.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> regdump </td>
+ <td> Dumps the contents of core registers.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> spramdump </td>
+ <td> Dumps the contents of core registers.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hcddump </td>
+ <td> Dumps the current HCD state.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hcd_frrem </td>
+ <td> Shows the average value of the Frame Remaining
+ field in the Host Frame Number/Frame Remaining register when an SOF interrupt
+ occurs. This can be used to determine the average interrupt latency. Also
+ shows the average Frame Remaining value for start_transfer and the "a" and
+ "b" sample points. The "a" and "b" sample points may be used during debugging
+ bto determine how long it takes to execute a section of the HCD code.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> rd_reg_test </td>
+ <td> Displays the time required to read the GNPTXFSIZ register many times
+ (the output shows the number of times the register is read).
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> wr_reg_test </td>
+ <td> Displays the time required to write the GNPTXFSIZ register many times
+ (the output shows the number of times the register is written).
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> lpm_response </td>
+ <td> Gets or sets lpm_response mode. Applicable only in device mode.
+ <td> Write</td>
+ </tr>
+
+ <tr>
+ <td> sleep_status </td>
+ <td> Shows sleep status of device.
+ <td> Read</td>
+ </tr>
+
+ </table>
+
+ Example usage:
+ To get the current mode:
+ cat /sys/devices/lm0/mode
+
+ To power down the USB:
+ echo 0 > /sys/devices/lm0/buspower
+ */
+
+#include "dwc_otg_os_dep.h"
+#include "dwc_os.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_attr.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_hcd_if.h"
+
+/*
+ * MACROs for defining sysfs attribute
+ */
+#ifdef LM_INTERFACE
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev);		\
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
+	uint32_t set = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
+	return count; \
+}
+
+#elif defined(PCI_INTERFACE)
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);	\
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
+	uint32_t set = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
+	return count; \
+}
+
+#elif defined(PLATFORM_INTERFACE)
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+        struct platform_device *platform_dev = \
+                container_of(_dev, struct platform_device, dev); \
+        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev);  \
+	uint32_t val; \
+	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
+                    __func__, _dev, platform_dev, otg_dev); \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+        struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
+        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
+	uint32_t set = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
+	return count; \
+}
+#endif
+
+/*
+ * MACROs for defining sysfs attribute for 32-bit registers
+ */
+#ifdef LM_INTERFACE
+#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
+	uint32_t val = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
+	return count; \
+}
+#elif defined(PCI_INTERFACE)
+#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
+	uint32_t val = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
+	return count; \
+}
+
+#elif defined(PLATFORM_INTERFACE)
+#include "dwc_otg_dbg.h"
+#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
+	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
+	uint32_t val; \
+	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
+                    __func__, _dev, platform_dev, otg_dev); \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
+	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
+	uint32_t val = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
+	return count; \
+}
+
+#endif
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_RW(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_RO(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
+
+#define DWC_OTG_DEVICE_ATTR_REG32_RW(_otg_attr_name_,_addr_,_string_) \
+DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
+
+#define DWC_OTG_DEVICE_ATTR_REG32_RO(_otg_attr_name_,_addr_,_string_) \
+DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
+
+/** @name Functions for Show/Store of Attributes */
+/**@{*/
+
+/**
+ * Helper function returning the otg_device structure of the given device
+ */
+static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
+{
+        dwc_otg_device_t *otg_dev;
+        DWC_OTG_GETDRVDEV(otg_dev, _dev);
+        return otg_dev;
+}
+
+/**
+ * Show the register offset of the Register Access.
+ */
+static ssize_t regoffset_show(struct device *_dev,
+			      struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return snprintf(buf, sizeof("0xFFFFFFFF\n") + 1, "0x%08x\n",
+			otg_dev->os_dep.reg_offset);
+}
+
+/**
+ * Set the register offset for the next Register Access 	Read/Write
+ */
+static ssize_t regoffset_store(struct device *_dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t offset = simple_strtoul(buf, NULL, 16);
+#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
+	if (offset < SZ_256K) {
+#elif  defined(PCI_INTERFACE)
+	if (offset < 0x00040000) {
+#endif
+		otg_dev->os_dep.reg_offset = offset;
+	} else {
+		dev_err(_dev, "invalid offset\n");
+	}
+
+	return count;
+}
+
+DEVICE_ATTR(regoffset, S_IRUGO | S_IWUSR, regoffset_show, regoffset_store);
+
+/**
+ * Show the value of the register at the offset in the reg_offset
+ * attribute.
+ */
+static ssize_t regvalue_show(struct device *_dev,
+			     struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val;
+	volatile uint32_t *addr;
+
+	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
+		/* Calculate the address */
+		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
+				     (uint8_t *) otg_dev->os_dep.base);
+		val = DWC_READ_REG32(addr);
+		return snprintf(buf,
+				sizeof("Reg@0xFFFFFFFF = 0xFFFFFFFF\n") + 1,
+				"Reg@0x%06x = 0x%08x\n", otg_dev->os_dep.reg_offset,
+				val);
+	} else {
+		dev_err(_dev, "Invalid offset (0x%0x)\n", otg_dev->os_dep.reg_offset);
+		return sprintf(buf, "invalid offset\n");
+	}
+}
+
+/**
+ * Store the value in the register at the offset in the reg_offset
+ * attribute.
+ *
+ */
+static ssize_t regvalue_store(struct device *_dev,
+			      struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	volatile uint32_t *addr;
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+	//dev_dbg(_dev, "Offset=0x%08x Val=0x%08x\n", otg_dev->reg_offset, val);
+	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
+		/* Calculate the address */
+		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
+				     (uint8_t *) otg_dev->os_dep.base);
+		DWC_WRITE_REG32(addr, val);
+	} else {
+		dev_err(_dev, "Invalid Register Offset (0x%08x)\n",
+			otg_dev->os_dep.reg_offset);
+	}
+	return count;
+}
+
+DEVICE_ATTR(regvalue, S_IRUGO | S_IWUSR, regvalue_show, regvalue_store);
+
+/*
+ * Attributes
+ */
+DWC_OTG_DEVICE_ATTR_BITFIELD_RO(mode, "Mode");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hnpcapable, "HNPCapable");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(srpcapable, "SRPCapable");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hsic_connect, "HSIC Connect");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(inv_sel_hsic, "Invert Select HSIC");
+
+//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(buspower,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
+//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(bussuspend,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RO(busconnected, "Bus Connected");
+
+DWC_OTG_DEVICE_ATTR_REG32_RW(gotgctl, 0, "GOTGCTL");
+DWC_OTG_DEVICE_ATTR_REG32_RW(gusbcfg,
+			     &(otg_dev->core_if->core_global_regs->gusbcfg),
+			     "GUSBCFG");
+DWC_OTG_DEVICE_ATTR_REG32_RW(grxfsiz,
+			     &(otg_dev->core_if->core_global_regs->grxfsiz),
+			     "GRXFSIZ");
+DWC_OTG_DEVICE_ATTR_REG32_RW(gnptxfsiz,
+			     &(otg_dev->core_if->core_global_regs->gnptxfsiz),
+			     "GNPTXFSIZ");
+DWC_OTG_DEVICE_ATTR_REG32_RW(gpvndctl,
+			     &(otg_dev->core_if->core_global_regs->gpvndctl),
+			     "GPVNDCTL");
+DWC_OTG_DEVICE_ATTR_REG32_RW(ggpio,
+			     &(otg_dev->core_if->core_global_regs->ggpio),
+			     "GGPIO");
+DWC_OTG_DEVICE_ATTR_REG32_RW(guid, &(otg_dev->core_if->core_global_regs->guid),
+			     "GUID");
+DWC_OTG_DEVICE_ATTR_REG32_RO(gsnpsid,
+			     &(otg_dev->core_if->core_global_regs->gsnpsid),
+			     "GSNPSID");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(devspeed, "Device Speed");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RO(enumspeed, "Device Enumeration Speed");
+
+DWC_OTG_DEVICE_ATTR_REG32_RO(hptxfsiz,
+			     &(otg_dev->core_if->core_global_regs->hptxfsiz),
+			     "HPTXFSIZ");
+DWC_OTG_DEVICE_ATTR_REG32_RW(hprt0, otg_dev->core_if->host_if->hprt0, "HPRT0");
+
+/**
+ * @todo Add code to initiate the HNP.
+ */
+/**
+ * Show the HNP status bit
+ */
+static ssize_t hnp_show(struct device *_dev,
+			struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "HstNegScs = 0x%x\n",
+		       dwc_otg_get_hnpstatus(otg_dev->core_if));
+}
+
+/**
+ * Set the HNP Request bit
+ */
+static ssize_t hnp_store(struct device *_dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_hnpreq(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(hnp, 0644, hnp_show, hnp_store);
+
+/**
+ * @todo Add code to initiate the SRP.
+ */
+/**
+ * Show the SRP status bit
+ */
+static ssize_t srp_show(struct device *_dev,
+			struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "SesReqScs = 0x%x\n",
+		       dwc_otg_get_srpstatus(otg_dev->core_if));
+#else
+	return sprintf(buf, "Host Only Mode!\n");
+#endif
+}
+
+/**
+ * Set the SRP Request bit
+ */
+static ssize_t srp_store(struct device *_dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_pcd_initiate_srp(otg_dev->pcd);
+#endif
+	return count;
+}
+
+DEVICE_ATTR(srp, 0644, srp_show, srp_store);
+
+/**
+ * @todo Need to do more for power on/off?
+ */
+/**
+ * Show the Bus Power status
+ */
+static ssize_t buspower_show(struct device *_dev,
+			     struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Bus Power = 0x%x\n",
+		       dwc_otg_get_prtpower(otg_dev->core_if));
+}
+
+/**
+ * Set the Bus Power status
+ */
+static ssize_t buspower_store(struct device *_dev,
+			      struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t on = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_prtpower(otg_dev->core_if, on);
+	return count;
+}
+
+DEVICE_ATTR(buspower, 0644, buspower_show, buspower_store);
+
+/**
+ * @todo Need to do more for suspend?
+ */
+/**
+ * Show the Bus Suspend status
+ */
+static ssize_t bussuspend_show(struct device *_dev,
+			       struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Bus Suspend = 0x%x\n",
+		       dwc_otg_get_prtsuspend(otg_dev->core_if));
+}
+
+/**
+ * Set the Bus Suspend status
+ */
+static ssize_t bussuspend_store(struct device *_dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_prtsuspend(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(bussuspend, 0644, bussuspend_show, bussuspend_store);
+
+/**
+ * Show the Mode Change Ready Timer status
+ */
+static ssize_t mode_ch_tim_en_show(struct device *_dev,
+				   struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Mode Change Ready Timer Enable = 0x%x\n",
+		       dwc_otg_get_mode_ch_tim(otg_dev->core_if));
+}
+
+/**
+ * Set the Mode Change Ready Timer status
+ */
+static ssize_t mode_ch_tim_en_store(struct device *_dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_mode_ch_tim(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(mode_ch_tim_en, 0644, mode_ch_tim_en_show, mode_ch_tim_en_store);
+
+/**
+ * Show the value of HFIR Frame Interval bitfield
+ */
+static ssize_t fr_interval_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Frame Interval = 0x%x\n",
+		       dwc_otg_get_fr_interval(otg_dev->core_if));
+}
+
+/**
+ * Set the HFIR Frame Interval value
+ */
+static ssize_t fr_interval_store(struct device *_dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 10);
+	dwc_otg_set_fr_interval(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(fr_interval, 0644, fr_interval_show, fr_interval_store);
+
+/**
+ * Show the status of Remote Wakeup.
+ */
+static ssize_t remote_wakeup_show(struct device *_dev,
+				  struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	return sprintf(buf,
+		       "Remote Wakeup Sig = %d Enabled = %d LPM Remote Wakeup = %d\n",
+		       dwc_otg_get_remotewakesig(otg_dev->core_if),
+		       dwc_otg_pcd_get_rmwkup_enable(otg_dev->pcd),
+		       dwc_otg_get_lpm_remotewakeenabled(otg_dev->core_if));
+#else
+	return sprintf(buf, "Host Only Mode!\n");
+#endif /* DWC_HOST_ONLY */
+}
+
+/**
+ * Initiate a remote wakeup of the host.  The Device control register
+ * Remote Wakeup Signal bit is written if the PCD Remote wakeup enable
+ * flag is set.
+ *
+ */
+static ssize_t remote_wakeup_store(struct device *_dev,
+				   struct device_attribute *attr,
+				   const char *buf, size_t count)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+
+	if (val & 1) {
+		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 1);
+	} else {
+		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 0);
+	}
+#endif /* DWC_HOST_ONLY */
+	return count;
+}
+
+DEVICE_ATTR(remote_wakeup, S_IRUGO | S_IWUSR, remote_wakeup_show,
+	    remote_wakeup_store);
+
+/**
+ * Show the whether core is hibernated or not.
+ */
+static ssize_t rem_wakeup_pwrdn_show(struct device *_dev,
+				     struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	if (dwc_otg_get_core_state(otg_dev->core_if)) {
+		DWC_PRINTF("Core is in hibernation\n");
+	} else {
+		DWC_PRINTF("Core is not in hibernation\n");
+	}
+#endif /* DWC_HOST_ONLY */
+	return 0;
+}
+
+extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
+					      int rem_wakeup, int reset);
+
+/**
+ * Initiate a remote wakeup of the device to exit from hibernation.
+ */
+static ssize_t rem_wakeup_pwrdn_store(struct device *_dev,
+				      struct device_attribute *attr,
+				      const char *buf, size_t count)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_device_hibernation_restore(otg_dev->core_if, 1, 0);
+#endif
+	return count;
+}
+
+DEVICE_ATTR(rem_wakeup_pwrdn, S_IRUGO | S_IWUSR, rem_wakeup_pwrdn_show,
+	    rem_wakeup_pwrdn_store);
+
+static ssize_t disconnect_us(struct device *_dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count)
+{
+
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+	DWC_PRINTF("The Passed value is %04x\n", val);
+
+	dwc_otg_pcd_disconnect_us(otg_dev->pcd, 50);
+
+#endif /* DWC_HOST_ONLY */
+	return count;
+}
+
+DEVICE_ATTR(disconnect_us, S_IWUSR, 0, disconnect_us);
+
+/**
+ * Dump global registers and either host or device registers (depending on the
+ * current mode of the core).
+ */
+static ssize_t regdump_show(struct device *_dev,
+			    struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	dwc_otg_dump_global_registers(otg_dev->core_if);
+	if (dwc_otg_is_host_mode(otg_dev->core_if)) {
+		dwc_otg_dump_host_registers(otg_dev->core_if);
+	} else {
+		dwc_otg_dump_dev_registers(otg_dev->core_if);
+
+	}
+	return sprintf(buf, "Register Dump\n");
+}
+
+DEVICE_ATTR(regdump, S_IRUGO, regdump_show, 0);
+
+/**
+ * Dump global registers and either host or device registers (depending on the
+ * current mode of the core).
+ */
+static ssize_t spramdump_show(struct device *_dev,
+			      struct device_attribute *attr, char *buf)
+{
+#if 0
+	dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	dwc_otg_dump_spram(otg_dev->core_if);
+#endif
+
+	return sprintf(buf, "SPRAM Dump\n");
+}
+
+DEVICE_ATTR(spramdump, S_IRUGO, spramdump_show, 0);
+
+/**
+ * Dump the current hcd state.
+ */
+static ssize_t hcddump_show(struct device *_dev,
+			    struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_DEVICE_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_hcd_dump_state(otg_dev->hcd);
+#endif /* DWC_DEVICE_ONLY */
+	return sprintf(buf, "HCD Dump\n");
+}
+
+DEVICE_ATTR(hcddump, S_IRUGO, hcddump_show, 0);
+
+/**
+ * Dump the average frame remaining at SOF. This can be used to
+ * determine average interrupt latency. Frame remaining is also shown for
+ * start transfer and two additional sample points.
+ */
+static ssize_t hcd_frrem_show(struct device *_dev,
+			      struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_DEVICE_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	dwc_otg_hcd_dump_frrem(otg_dev->hcd);
+#endif /* DWC_DEVICE_ONLY */
+	return sprintf(buf, "HCD Dump Frame Remaining\n");
+}
+
+DEVICE_ATTR(hcd_frrem, S_IRUGO, hcd_frrem_show, 0);
+
+/**
+ * Displays the time required to read the GNPTXFSIZ register many times (the
+ * output shows the number of times the register is read).
+ */
+#define RW_REG_COUNT 10000000
+#define MSEC_PER_JIFFIE 1000/HZ
+static ssize_t rd_reg_test_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	int i;
+	int time;
+	int start_jiffies;
+
+	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
+	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
+	start_jiffies = jiffies;
+	for (i = 0; i < RW_REG_COUNT; i++) {
+		dwc_otg_get_gnptxfsiz(otg_dev->core_if);
+	}
+	time = jiffies - start_jiffies;
+	return sprintf(buf,
+		       "Time to read GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
+		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
+}
+
+DEVICE_ATTR(rd_reg_test, S_IRUGO, rd_reg_test_show, 0);
+
+/**
+ * Displays the time required to write the GNPTXFSIZ register many times (the
+ * output shows the number of times the register is written).
+ */
+static ssize_t wr_reg_test_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t reg_val;
+	int i;
+	int time;
+	int start_jiffies;
+
+	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
+	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
+	reg_val = dwc_otg_get_gnptxfsiz(otg_dev->core_if);
+	start_jiffies = jiffies;
+	for (i = 0; i < RW_REG_COUNT; i++) {
+		dwc_otg_set_gnptxfsiz(otg_dev->core_if, reg_val);
+	}
+	time = jiffies - start_jiffies;
+	return sprintf(buf,
+		       "Time to write GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
+		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
+}
+
+DEVICE_ATTR(wr_reg_test, S_IRUGO, wr_reg_test_show, 0);
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+
+/**
+* Show the lpm_response attribute.
+*/
+static ssize_t lpmresp_show(struct device *_dev,
+			    struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if))
+		return sprintf(buf, "** LPM is DISABLED **\n");
+
+	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
+		return sprintf(buf, "** Current mode is not device mode\n");
+	}
+	return sprintf(buf, "lpm_response = %d\n",
+		       dwc_otg_get_lpmresponse(otg_dev->core_if));
+}
+
+/**
+* Store the lpm_response attribute.
+*/
+static ssize_t lpmresp_store(struct device *_dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+
+	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if)) {
+		return 0;
+	}
+
+	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
+		return 0;
+	}
+
+	dwc_otg_set_lpmresponse(otg_dev->core_if, val);
+	return count;
+}
+
+DEVICE_ATTR(lpm_response, S_IRUGO | S_IWUSR, lpmresp_show, lpmresp_store);
+
+/**
+* Show the sleep_status attribute.
+*/
+static ssize_t sleepstatus_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Sleep Status = %d\n",
+		       dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if));
+}
+
+/**
+ * Store the sleep_status attribure.
+ */
+static ssize_t sleepstatus_store(struct device *_dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+
+	if (dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if)) {
+		if (dwc_otg_is_host_mode(core_if)) {
+
+			DWC_PRINTF("Host initiated resume\n");
+			dwc_otg_set_prtresume(otg_dev->core_if, 1);
+		}
+	}
+
+	return count;
+}
+
+DEVICE_ATTR(sleep_status, S_IRUGO | S_IWUSR, sleepstatus_show,
+	    sleepstatus_store);
+
+#endif /* CONFIG_USB_DWC_OTG_LPM_ENABLE */
+
+/**@}*/
+
+/**
+ * Create the device files
+ */
+void dwc_otg_attr_create(
+#ifdef LM_INTERFACE
+	struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+	struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+        struct platform_device *dev
+#endif
+    )
+{
+	int error;
+
+	error = device_create_file(&dev->dev, &dev_attr_regoffset);
+	error = device_create_file(&dev->dev, &dev_attr_regvalue);
+	error = device_create_file(&dev->dev, &dev_attr_mode);
+	error = device_create_file(&dev->dev, &dev_attr_hnpcapable);
+	error = device_create_file(&dev->dev, &dev_attr_srpcapable);
+	error = device_create_file(&dev->dev, &dev_attr_hsic_connect);
+	error = device_create_file(&dev->dev, &dev_attr_inv_sel_hsic);
+	error = device_create_file(&dev->dev, &dev_attr_hnp);
+	error = device_create_file(&dev->dev, &dev_attr_srp);
+	error = device_create_file(&dev->dev, &dev_attr_buspower);
+	error = device_create_file(&dev->dev, &dev_attr_bussuspend);
+	error = device_create_file(&dev->dev, &dev_attr_mode_ch_tim_en);
+	error = device_create_file(&dev->dev, &dev_attr_fr_interval);
+	error = device_create_file(&dev->dev, &dev_attr_busconnected);
+	error = device_create_file(&dev->dev, &dev_attr_gotgctl);
+	error = device_create_file(&dev->dev, &dev_attr_gusbcfg);
+	error = device_create_file(&dev->dev, &dev_attr_grxfsiz);
+	error = device_create_file(&dev->dev, &dev_attr_gnptxfsiz);
+	error = device_create_file(&dev->dev, &dev_attr_gpvndctl);
+	error = device_create_file(&dev->dev, &dev_attr_ggpio);
+	error = device_create_file(&dev->dev, &dev_attr_guid);
+	error = device_create_file(&dev->dev, &dev_attr_gsnpsid);
+	error = device_create_file(&dev->dev, &dev_attr_devspeed);
+	error = device_create_file(&dev->dev, &dev_attr_enumspeed);
+	error = device_create_file(&dev->dev, &dev_attr_hptxfsiz);
+	error = device_create_file(&dev->dev, &dev_attr_hprt0);
+	error = device_create_file(&dev->dev, &dev_attr_remote_wakeup);
+	error = device_create_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
+	error = device_create_file(&dev->dev, &dev_attr_disconnect_us);
+	error = device_create_file(&dev->dev, &dev_attr_regdump);
+	error = device_create_file(&dev->dev, &dev_attr_spramdump);
+	error = device_create_file(&dev->dev, &dev_attr_hcddump);
+	error = device_create_file(&dev->dev, &dev_attr_hcd_frrem);
+	error = device_create_file(&dev->dev, &dev_attr_rd_reg_test);
+	error = device_create_file(&dev->dev, &dev_attr_wr_reg_test);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	error = device_create_file(&dev->dev, &dev_attr_lpm_response);
+	error = device_create_file(&dev->dev, &dev_attr_sleep_status);
+#endif
+}
+
+/**
+ * Remove the device files
+ */
+void dwc_otg_attr_remove(
+#ifdef LM_INTERFACE
+	struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+	struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    )
+{
+	device_remove_file(&dev->dev, &dev_attr_regoffset);
+	device_remove_file(&dev->dev, &dev_attr_regvalue);
+	device_remove_file(&dev->dev, &dev_attr_mode);
+	device_remove_file(&dev->dev, &dev_attr_hnpcapable);
+	device_remove_file(&dev->dev, &dev_attr_srpcapable);
+	device_remove_file(&dev->dev, &dev_attr_hsic_connect);
+	device_remove_file(&dev->dev, &dev_attr_inv_sel_hsic);
+	device_remove_file(&dev->dev, &dev_attr_hnp);
+	device_remove_file(&dev->dev, &dev_attr_srp);
+	device_remove_file(&dev->dev, &dev_attr_buspower);
+	device_remove_file(&dev->dev, &dev_attr_bussuspend);
+	device_remove_file(&dev->dev, &dev_attr_mode_ch_tim_en);
+	device_remove_file(&dev->dev, &dev_attr_fr_interval);
+	device_remove_file(&dev->dev, &dev_attr_busconnected);
+	device_remove_file(&dev->dev, &dev_attr_gotgctl);
+	device_remove_file(&dev->dev, &dev_attr_gusbcfg);
+	device_remove_file(&dev->dev, &dev_attr_grxfsiz);
+	device_remove_file(&dev->dev, &dev_attr_gnptxfsiz);
+	device_remove_file(&dev->dev, &dev_attr_gpvndctl);
+	device_remove_file(&dev->dev, &dev_attr_ggpio);
+	device_remove_file(&dev->dev, &dev_attr_guid);
+	device_remove_file(&dev->dev, &dev_attr_gsnpsid);
+	device_remove_file(&dev->dev, &dev_attr_devspeed);
+	device_remove_file(&dev->dev, &dev_attr_enumspeed);
+	device_remove_file(&dev->dev, &dev_attr_hptxfsiz);
+	device_remove_file(&dev->dev, &dev_attr_hprt0);
+	device_remove_file(&dev->dev, &dev_attr_remote_wakeup);
+	device_remove_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
+	device_remove_file(&dev->dev, &dev_attr_disconnect_us);
+	device_remove_file(&dev->dev, &dev_attr_regdump);
+	device_remove_file(&dev->dev, &dev_attr_spramdump);
+	device_remove_file(&dev->dev, &dev_attr_hcddump);
+	device_remove_file(&dev->dev, &dev_attr_hcd_frrem);
+	device_remove_file(&dev->dev, &dev_attr_rd_reg_test);
+	device_remove_file(&dev->dev, &dev_attr_wr_reg_test);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	device_remove_file(&dev->dev, &dev_attr_lpm_response);
+	device_remove_file(&dev->dev, &dev_attr_sleep_status);
+#endif
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_attr.h b/drivers/usb/host/dwc_otg/dwc_otg_attr.h
new file mode 100644
index 0000000000000..e10b67f97c522
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.h
@@ -0,0 +1,89 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.h $
+ * $Revision: #13 $
+ * $Date: 2010/06/21 $
+ * $Change: 1532021 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_OTG_ATTR_H__)
+#define __DWC_OTG_ATTR_H__
+
+/** @file
+ * This file contains the interface to the Linux device attributes.
+ */
+extern struct device_attribute dev_attr_regoffset;
+extern struct device_attribute dev_attr_regvalue;
+
+extern struct device_attribute dev_attr_mode;
+extern struct device_attribute dev_attr_hnpcapable;
+extern struct device_attribute dev_attr_srpcapable;
+extern struct device_attribute dev_attr_hnp;
+extern struct device_attribute dev_attr_srp;
+extern struct device_attribute dev_attr_buspower;
+extern struct device_attribute dev_attr_bussuspend;
+extern struct device_attribute dev_attr_mode_ch_tim_en;
+extern struct device_attribute dev_attr_fr_interval;
+extern struct device_attribute dev_attr_busconnected;
+extern struct device_attribute dev_attr_gotgctl;
+extern struct device_attribute dev_attr_gusbcfg;
+extern struct device_attribute dev_attr_grxfsiz;
+extern struct device_attribute dev_attr_gnptxfsiz;
+extern struct device_attribute dev_attr_gpvndctl;
+extern struct device_attribute dev_attr_ggpio;
+extern struct device_attribute dev_attr_guid;
+extern struct device_attribute dev_attr_gsnpsid;
+extern struct device_attribute dev_attr_devspeed;
+extern struct device_attribute dev_attr_enumspeed;
+extern struct device_attribute dev_attr_hptxfsiz;
+extern struct device_attribute dev_attr_hprt0;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+extern struct device_attribute dev_attr_lpm_response;
+extern struct device_attribute devi_attr_sleep_status;
+#endif
+
+void dwc_otg_attr_create(
+#ifdef LM_INTERFACE
+				struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+				struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+
+void dwc_otg_attr_remove(
+#ifdef LM_INTERFACE
+				struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+				struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cfi.c b/drivers/usb/host/dwc_otg/dwc_otg_cfi.c
new file mode 100644
index 0000000000000..bbb3d32093d02
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.c
@@ -0,0 +1,1876 @@
+/* ==========================================================================
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * This file contains the most of the CFI(Core Feature Interface)
+ * implementation for the OTG.
+ */
+
+#ifdef DWC_UTE_CFI
+
+#include "dwc_otg_pcd.h"
+#include "dwc_otg_cfi.h"
+
+/** This definition should actually migrate to the Portability Library */
+#define DWC_CONSTANT_CPU_TO_LE16(x) (x)
+
+extern dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex);
+
+static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen);
+static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
+				 struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *ctrl_req);
+static int cfi_set_feature_value(struct dwc_otg_pcd *pcd);
+static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req);
+static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *req);
+static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				struct cfi_usb_ctrlrequest *req);
+static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req);
+static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep);
+
+static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if);
+static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue);
+static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue);
+
+static uint8_t resize_fifos(dwc_otg_core_if_t * core_if);
+
+/** This is the header of the all features descriptor */
+static cfi_all_features_header_t all_props_desc_header = {
+	.wVersion = DWC_CONSTANT_CPU_TO_LE16(0x100),
+	.wCoreID = DWC_CONSTANT_CPU_TO_LE16(CFI_CORE_ID_OTG),
+	.wNumFeatures = DWC_CONSTANT_CPU_TO_LE16(9),
+};
+
+/** This is an array of statically allocated feature descriptors */
+static cfi_feature_desc_header_t prop_descs[] = {
+
+	/* FT_ID_DMA_MODE */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_MODE),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(1),
+	 },
+
+	/* FT_ID_DMA_BUFFER_SETUP */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFFER_SETUP),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_DMA_BUFF_ALIGN */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFF_ALIGN),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 },
+
+	/* FT_ID_DMA_CONCAT_SETUP */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CONCAT_SETUP),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 //.wDataLength  = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_DMA_CIRCULAR */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CIRCULAR),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_THRESHOLD_SETUP */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_THRESHOLD_SETUP),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_DFIFO_DEPTH */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DFIFO_DEPTH),
+	 .bmAttributes = CFI_FEATURE_ATTR_RO,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 },
+
+	/* FT_ID_TX_FIFO_DEPTH */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_TX_FIFO_DEPTH),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 },
+
+	/* FT_ID_RX_FIFO_DEPTH */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_RX_FIFO_DEPTH),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 }
+};
+
+/** The table of feature names */
+cfi_string_t prop_name_table[] = {
+	{FT_ID_DMA_MODE, "dma_mode"},
+	{FT_ID_DMA_BUFFER_SETUP, "buffer_setup"},
+	{FT_ID_DMA_BUFF_ALIGN, "buffer_align"},
+	{FT_ID_DMA_CONCAT_SETUP, "concat_setup"},
+	{FT_ID_DMA_CIRCULAR, "buffer_circular"},
+	{FT_ID_THRESHOLD_SETUP, "threshold_setup"},
+	{FT_ID_DFIFO_DEPTH, "dfifo_depth"},
+	{FT_ID_TX_FIFO_DEPTH, "txfifo_depth"},
+	{FT_ID_RX_FIFO_DEPTH, "rxfifo_depth"},
+	{}
+};
+
+/************************************************************************/
+
+/**
+ * Returns the name of the feature by its ID
+ * or NULL if no featute ID matches.
+ *
+ */
+const uint8_t *get_prop_name(uint16_t prop_id, int *len)
+{
+	cfi_string_t *pstr;
+	*len = 0;
+
+	for (pstr = prop_name_table; pstr && pstr->s; pstr++) {
+		if (pstr->id == prop_id) {
+			*len = DWC_STRLEN(pstr->s);
+			return pstr->s;
+		}
+	}
+	return NULL;
+}
+
+/**
+ * This function handles all CFI specific control requests.
+ *
+ * Return a negative value to stall the DCE.
+ */
+int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl)
+{
+	int retval = 0;
+	dwc_otg_pcd_ep_t *ep = NULL;
+	cfiobject_t *cfi = pcd->cfi;
+	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
+	uint16_t wLen = DWC_LE16_TO_CPU(&ctrl->wLength);
+	uint16_t wValue = DWC_LE16_TO_CPU(&ctrl->wValue);
+	uint16_t wIndex = DWC_LE16_TO_CPU(&ctrl->wIndex);
+	uint32_t regaddr = 0;
+	uint32_t regval = 0;
+
+	/* Save this Control Request in the CFI object.
+	 * The data field will be assigned in the data stage completion CB function.
+	 */
+	cfi->ctrl_req = *ctrl;
+	cfi->ctrl_req.data = NULL;
+
+	cfi->need_gadget_att = 0;
+	cfi->need_status_in_complete = 0;
+
+	switch (ctrl->bRequest) {
+	case VEN_CORE_GET_FEATURES:
+		retval = cfi_core_features_buf(cfi->buf_in.buf, CFI_IN_BUF_LEN);
+		if (retval >= 0) {
+			//dump_msg(cfi->buf_in.buf, retval);
+			ep = &pcd->ep0;
+
+			retval = min((uint16_t) retval, wLen);
+			/* Transfer this buffer to the host through the EP0-IN EP */
+			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
+			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_len = retval;
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+			pcd->ep0_pending = 1;
+			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		}
+		retval = 0;
+		break;
+
+	case VEN_CORE_GET_FEATURE:
+		CFI_INFO("VEN_CORE_GET_FEATURE\n");
+		retval = cfi_get_feature_value(cfi->buf_in.buf, CFI_IN_BUF_LEN,
+					       pcd, ctrl);
+		if (retval >= 0) {
+			ep = &pcd->ep0;
+
+			retval = min((uint16_t) retval, wLen);
+			/* Transfer this buffer to the host through the EP0-IN EP */
+			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
+			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_len = retval;
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+			pcd->ep0_pending = 1;
+			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		}
+		CFI_INFO("VEN_CORE_GET_FEATURE=%d\n", retval);
+		dump_msg(cfi->buf_in.buf, retval);
+		break;
+
+	case VEN_CORE_SET_FEATURE:
+		CFI_INFO("VEN_CORE_SET_FEATURE\n");
+		/* Set up an XFER to get the data stage of the control request,
+		 * which is the new value of the feature to be modified.
+		 */
+		ep = &pcd->ep0;
+		ep->dwc_ep.is_in = 0;
+		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
+		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_len = wLen;
+		ep->dwc_ep.xfer_count = 0;
+		ep->dwc_ep.sent_zlp = 0;
+		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+		pcd->ep0_pending = 1;
+		/* Read the control write's data stage */
+		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		retval = 0;
+		break;
+
+	case VEN_CORE_RESET_FEATURES:
+		CFI_INFO("VEN_CORE_RESET_FEATURES\n");
+		cfi->need_gadget_att = 1;
+		cfi->need_status_in_complete = 1;
+		retval = cfi_preproc_reset(pcd, ctrl);
+		CFI_INFO("VEN_CORE_RESET_FEATURES = (%d)\n", retval);
+		break;
+
+	case VEN_CORE_ACTIVATE_FEATURES:
+		CFI_INFO("VEN_CORE_ACTIVATE_FEATURES\n");
+		break;
+
+	case VEN_CORE_READ_REGISTER:
+		CFI_INFO("VEN_CORE_READ_REGISTER\n");
+		/* wValue optionally contains the HI WORD of the register offset and
+		 * wIndex contains the LOW WORD of the register offset
+		 */
+		if (wValue == 0) {
+			/* @TODO - MAS - fix the access to the base field */
+			regaddr = 0;
+			//regaddr = (uint32_t) pcd->otg_dev->os_dep.base;
+			//GET_CORE_IF(pcd)->co
+			regaddr |= wIndex;
+		} else {
+			regaddr = (wValue << 16) | wIndex;
+		}
+
+		/* Read a 32-bit value of the memory at the regaddr */
+		regval = DWC_READ_REG32((uint32_t *) regaddr);
+
+		ep = &pcd->ep0;
+		dwc_memcpy(cfi->buf_in.buf, &regval, sizeof(uint32_t));
+		ep->dwc_ep.is_in = 1;
+		ep->dwc_ep.dma_addr = cfi->buf_in.addr;
+		ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
+		ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
+		ep->dwc_ep.xfer_len = wLen;
+		ep->dwc_ep.xfer_count = 0;
+		ep->dwc_ep.sent_zlp = 0;
+		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+		pcd->ep0_pending = 1;
+		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		cfi->need_gadget_att = 0;
+		retval = 0;
+		break;
+
+	case VEN_CORE_WRITE_REGISTER:
+		CFI_INFO("VEN_CORE_WRITE_REGISTER\n");
+		/* Set up an XFER to get the data stage of the control request,
+		 * which is the new value of the register to be modified.
+		 */
+		ep = &pcd->ep0;
+		ep->dwc_ep.is_in = 0;
+		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
+		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_len = wLen;
+		ep->dwc_ep.xfer_count = 0;
+		ep->dwc_ep.sent_zlp = 0;
+		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+		pcd->ep0_pending = 1;
+		/* Read the control write's data stage */
+		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		retval = 0;
+		break;
+
+	default:
+		retval = -DWC_E_NOT_SUPPORTED;
+		break;
+	}
+
+	return retval;
+}
+
+/**
+ * This function prepares the core features descriptors and copies its
+ * raw representation into the buffer <buf>.
+ *
+ * The buffer structure is as follows:
+ *	all_features_header (8 bytes)
+ *	features_#1 (8 bytes + feature name string length)
+ *	features_#2 (8 bytes + feature name string length)
+ *	.....
+ *	features_#n - where n=the total count of feature descriptors
+ */
+static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen)
+{
+	cfi_feature_desc_header_t *prop_hdr = prop_descs;
+	cfi_feature_desc_header_t *prop;
+	cfi_all_features_header_t *all_props_hdr = &all_props_desc_header;
+	cfi_all_features_header_t *tmp;
+	uint8_t *tmpbuf = buf;
+	const uint8_t *pname = NULL;
+	int i, j, namelen = 0, totlen;
+
+	/* Prepare and copy the core features into the buffer */
+	CFI_INFO("%s:\n", __func__);
+
+	tmp = (cfi_all_features_header_t *) tmpbuf;
+	*tmp = *all_props_hdr;
+	tmpbuf += CFI_ALL_FEATURES_HDR_LEN;
+
+	j = sizeof(prop_descs) / sizeof(cfi_all_features_header_t);
+	for (i = 0; i < j; i++, prop_hdr++) {
+		pname = get_prop_name(prop_hdr->wFeatureID, &namelen);
+		prop = (cfi_feature_desc_header_t *) tmpbuf;
+		*prop = *prop_hdr;
+
+		prop->bNameLen = namelen;
+		prop->wLength =
+		    DWC_CONSTANT_CPU_TO_LE16(CFI_FEATURE_DESC_HDR_LEN +
+					     namelen);
+
+		tmpbuf += CFI_FEATURE_DESC_HDR_LEN;
+		dwc_memcpy(tmpbuf, pname, namelen);
+		tmpbuf += namelen;
+	}
+
+	totlen = tmpbuf - buf;
+
+	if (totlen > 0) {
+		tmp = (cfi_all_features_header_t *) buf;
+		tmp->wTotalLen = DWC_CONSTANT_CPU_TO_LE16(totlen);
+	}
+
+	return totlen;
+}
+
+/**
+ * This function releases all the dynamic memory in the CFI object.
+ */
+static void cfi_release(cfiobject_t * cfiobj)
+{
+	cfi_ep_t *cfiep;
+	dwc_list_link_t *tmp;
+
+	CFI_INFO("%s\n", __func__);
+
+	if (cfiobj->buf_in.buf) {
+		DWC_DMA_FREE(CFI_IN_BUF_LEN, cfiobj->buf_in.buf,
+			     cfiobj->buf_in.addr);
+		cfiobj->buf_in.buf = NULL;
+	}
+
+	if (cfiobj->buf_out.buf) {
+		DWC_DMA_FREE(CFI_OUT_BUF_LEN, cfiobj->buf_out.buf,
+			     cfiobj->buf_out.addr);
+		cfiobj->buf_out.buf = NULL;
+	}
+
+	/* Free the Buffer Setup values for each EP */
+	//list_for_each_entry(cfiep, &cfiobj->active_eps, lh) {
+	DWC_LIST_FOREACH(tmp, &cfiobj->active_eps) {
+		cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+		cfi_free_ep_bs_dyn_data(cfiep);
+	}
+}
+
+/**
+ * This function frees the dynamically allocated EP buffer setup data.
+ */
+static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep)
+{
+	if (cfiep->bm_sg) {
+		DWC_FREE(cfiep->bm_sg);
+		cfiep->bm_sg = NULL;
+	}
+
+	if (cfiep->bm_align) {
+		DWC_FREE(cfiep->bm_align);
+		cfiep->bm_align = NULL;
+	}
+
+	if (cfiep->bm_concat) {
+		if (NULL != cfiep->bm_concat->wTxBytes) {
+			DWC_FREE(cfiep->bm_concat->wTxBytes);
+			cfiep->bm_concat->wTxBytes = NULL;
+		}
+		DWC_FREE(cfiep->bm_concat);
+		cfiep->bm_concat = NULL;
+	}
+}
+
+/**
+ * This function initializes the default values of the features
+ * for a specific endpoint and should be called only once when
+ * the EP is enabled first time.
+ */
+static int cfi_ep_init_defaults(struct dwc_otg_pcd *pcd, cfi_ep_t * cfiep)
+{
+	int retval = 0;
+
+	cfiep->bm_sg = DWC_ALLOC(sizeof(ddma_sg_buffer_setup_t));
+	if (NULL == cfiep->bm_sg) {
+		CFI_INFO("Failed to allocate memory for SG feature value\n");
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
+
+	/* For the Concatenation feature's default value we do not allocate
+	 * memory for the wTxBytes field - it will be done in the set_feature_value
+	 * request handler.
+	 */
+	cfiep->bm_concat = DWC_ALLOC(sizeof(ddma_concat_buffer_setup_t));
+	if (NULL == cfiep->bm_concat) {
+		CFI_INFO
+		    ("Failed to allocate memory for CONCATENATION feature value\n");
+		DWC_FREE(cfiep->bm_sg);
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
+
+	cfiep->bm_align = DWC_ALLOC(sizeof(ddma_align_buffer_setup_t));
+	if (NULL == cfiep->bm_align) {
+		CFI_INFO
+		    ("Failed to allocate memory for Alignment feature value\n");
+		DWC_FREE(cfiep->bm_sg);
+		DWC_FREE(cfiep->bm_concat);
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_memset(cfiep->bm_align, 0, sizeof(ddma_align_buffer_setup_t));
+
+	return retval;
+}
+
+/**
+ * The callback function that notifies the CFI on the activation of
+ * an endpoint in the PCD. The following steps are done in this function:
+ *
+ *	Create a dynamically allocated cfi_ep_t object (a CFI wrapper to the PCD's
+ *		active endpoint)
+ *	Create MAX_DMA_DESCS_PER_EP count DMA Descriptors for the EP
+ *	Set the Buffer Mode to standard
+ *	Initialize the default values for all EP modes (SG, Circular, Concat, Align)
+ *	Add the cfi_ep_t object to the list of active endpoints in the CFI object
+ */
+static int cfi_ep_enable(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
+			 struct dwc_otg_pcd_ep *ep)
+{
+	cfi_ep_t *cfiep;
+	int retval = -DWC_E_NOT_SUPPORTED;
+
+	CFI_INFO("%s: epname=%s; epnum=0x%02x\n", __func__,
+		 "EP_" /*ep->ep.name */ , ep->desc->bEndpointAddress);
+	/* MAS - Check whether this endpoint already is in the list */
+	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
+
+	if (NULL == cfiep) {
+		/* Allocate a cfi_ep_t object */
+		cfiep = DWC_ALLOC(sizeof(cfi_ep_t));
+		if (NULL == cfiep) {
+			CFI_INFO
+			    ("Unable to allocate memory for <cfiep> in function %s\n",
+			     __func__);
+			return -DWC_E_NO_MEMORY;
+		}
+		dwc_memset(cfiep, 0, sizeof(cfi_ep_t));
+
+		/* Save the dwc_otg_pcd_ep pointer in the cfiep object */
+		cfiep->ep = ep;
+
+		/* Allocate the DMA Descriptors chain of MAX_DMA_DESCS_PER_EP count */
+		ep->dwc_ep.descs =
+		    DWC_DMA_ALLOC(MAX_DMA_DESCS_PER_EP *
+				  sizeof(dwc_otg_dma_desc_t),
+				  &ep->dwc_ep.descs_dma_addr);
+
+		if (NULL == ep->dwc_ep.descs) {
+			DWC_FREE(cfiep);
+			return -DWC_E_NO_MEMORY;
+		}
+
+		DWC_LIST_INIT(&cfiep->lh);
+
+		/* Set the buffer mode to BM_STANDARD. It will be modified
+		 * when building descriptors for a specific buffer mode */
+		ep->dwc_ep.buff_mode = BM_STANDARD;
+
+		/* Create and initialize the default values for this EP's Buffer modes */
+		if ((retval = cfi_ep_init_defaults(pcd, cfiep)) < 0)
+			return retval;
+
+		/* Add the cfi_ep_t object to the CFI object's list of active endpoints */
+		DWC_LIST_INSERT_TAIL(&cfi->active_eps, &cfiep->lh);
+		retval = 0;
+	} else {		/* The sought EP already is in the list */
+		CFI_INFO("%s: The sought EP already is in the list\n",
+			 __func__);
+	}
+
+	return retval;
+}
+
+/**
+ * This function is called when the data stage of a 3-stage Control Write request
+ * is complete.
+ *
+ */
+static int cfi_ctrl_write_complete(struct cfiobject *cfi,
+				   struct dwc_otg_pcd *pcd)
+{
+	uint32_t addr, reg_value;
+	uint16_t wIndex, wValue;
+	uint8_t bRequest;
+	uint8_t *buf = cfi->buf_out.buf;
+	//struct usb_ctrlrequest *ctrl_req = &cfi->ctrl_req_saved;
+	struct cfi_usb_ctrlrequest *ctrl_req = &cfi->ctrl_req;
+	int retval = -DWC_E_NOT_SUPPORTED;
+
+	CFI_INFO("%s\n", __func__);
+
+	bRequest = ctrl_req->bRequest;
+	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
+	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
+
+	/*
+	 * Save the pointer to the data stage in the ctrl_req's <data> field.
+	 * The request should be already saved in the command stage by now.
+	 */
+	ctrl_req->data = cfi->buf_out.buf;
+	cfi->need_status_in_complete = 0;
+	cfi->need_gadget_att = 0;
+
+	switch (bRequest) {
+	case VEN_CORE_WRITE_REGISTER:
+		/* The buffer contains raw data of the new value for the register */
+		reg_value = *((uint32_t *) buf);
+		if (wValue == 0) {
+			addr = 0;
+			//addr = (uint32_t) pcd->otg_dev->os_dep.base;
+			addr += wIndex;
+		} else {
+			addr = (wValue << 16) | wIndex;
+		}
+
+		//writel(reg_value, addr);
+
+		retval = 0;
+		cfi->need_status_in_complete = 1;
+		break;
+
+	case VEN_CORE_SET_FEATURE:
+		/* The buffer contains raw data of the new value of the feature */
+		retval = cfi_set_feature_value(pcd);
+		if (retval < 0)
+			return retval;
+
+		cfi->need_status_in_complete = 1;
+		break;
+
+	default:
+		break;
+	}
+
+	return retval;
+}
+
+/**
+ * This function builds the DMA descriptors for the SG buffer mode.
+ */
+static void cfi_build_sg_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+			       dwc_otg_pcd_request_t * req)
+{
+	struct dwc_otg_pcd_ep *ep = cfiep->ep;
+	ddma_sg_buffer_setup_t *sgval = cfiep->bm_sg;
+	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
+	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
+	dma_addr_t buff_addr = req->dma;
+	int i;
+	uint32_t txsize, off;
+
+	txsize = sgval->wSize;
+	off = sgval->bOffset;
+
+//      CFI_INFO("%s: %s TXSIZE=0x%08x; OFFSET=0x%08x\n",
+//              __func__, cfiep->ep->ep.name, txsize, off);
+
+	for (i = 0; i < sgval->bCount; i++) {
+		desc->status.b.bs = BS_HOST_BUSY;
+		desc->buf = buff_addr;
+		desc->status.b.l = 0;
+		desc->status.b.ioc = 0;
+		desc->status.b.sp = 0;
+		desc->status.b.bytes = txsize;
+		desc->status.b.bs = BS_HOST_READY;
+
+		/* Set the next address of the buffer */
+		buff_addr += txsize + off;
+		desc_last = desc;
+		desc++;
+	}
+
+	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
+	desc_last->status.b.l = 1;
+	desc_last->status.b.ioc = 1;
+	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
+	/* Save the last DMA descriptor pointer */
+	cfiep->dma_desc_last = desc_last;
+	cfiep->desc_count = sgval->bCount;
+}
+
+/**
+ * This function builds the DMA descriptors for the Concatenation buffer mode.
+ */
+static void cfi_build_concat_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+				   dwc_otg_pcd_request_t * req)
+{
+	struct dwc_otg_pcd_ep *ep = cfiep->ep;
+	ddma_concat_buffer_setup_t *concatval = cfiep->bm_concat;
+	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
+	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
+	dma_addr_t buff_addr = req->dma;
+	int i;
+	uint16_t *txsize;
+
+	txsize = concatval->wTxBytes;
+
+	for (i = 0; i < concatval->hdr.bDescCount; i++) {
+		desc->buf = buff_addr;
+		desc->status.b.bs = BS_HOST_BUSY;
+		desc->status.b.l = 0;
+		desc->status.b.ioc = 0;
+		desc->status.b.sp = 0;
+		desc->status.b.bytes = *txsize;
+		desc->status.b.bs = BS_HOST_READY;
+
+		txsize++;
+		/* Set the next address of the buffer */
+		buff_addr += UGETW(ep->desc->wMaxPacketSize);
+		desc_last = desc;
+		desc++;
+	}
+
+	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
+	desc_last->status.b.l = 1;
+	desc_last->status.b.ioc = 1;
+	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
+	cfiep->dma_desc_last = desc_last;
+	cfiep->desc_count = concatval->hdr.bDescCount;
+}
+
+/**
+ * This function builds the DMA descriptors for the Circular buffer mode
+ */
+static void cfi_build_circ_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+				 dwc_otg_pcd_request_t * req)
+{
+	/* @todo: MAS - add implementation when this feature needs to be tested */
+}
+
+/**
+ * This function builds the DMA descriptors for the Alignment buffer mode
+ */
+static void cfi_build_align_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+				  dwc_otg_pcd_request_t * req)
+{
+	struct dwc_otg_pcd_ep *ep = cfiep->ep;
+	ddma_align_buffer_setup_t *alignval = cfiep->bm_align;
+	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
+	dma_addr_t buff_addr = req->dma;
+
+	desc->status.b.bs = BS_HOST_BUSY;
+	desc->status.b.l = 1;
+	desc->status.b.ioc = 1;
+	desc->status.b.sp = ep->dwc_ep.sent_zlp;
+	desc->status.b.bytes = req->length;
+	/* Adjust the buffer alignment */
+	desc->buf = (buff_addr + alignval->bAlign);
+	desc->status.b.bs = BS_HOST_READY;
+	cfiep->dma_desc_last = desc;
+	cfiep->desc_count = 1;
+}
+
+/**
+ * This function builds the DMA descriptors chain for different modes of the
+ * buffer setup of an endpoint.
+ */
+static void cfi_build_descriptors(struct cfiobject *cfi,
+				  struct dwc_otg_pcd *pcd,
+				  struct dwc_otg_pcd_ep *ep,
+				  dwc_otg_pcd_request_t * req)
+{
+	cfi_ep_t *cfiep;
+
+	/* Get the cfiep by the dwc_otg_pcd_ep */
+	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
+	if (NULL == cfiep) {
+		CFI_INFO("%s: Unable to find a matching active endpoint\n",
+			 __func__);
+		return;
+	}
+
+	cfiep->xfer_len = req->length;
+
+	/* Iterate through all the DMA descriptors */
+	switch (cfiep->ep->dwc_ep.buff_mode) {
+	case BM_SG:
+		cfi_build_sg_descs(cfi, cfiep, req);
+		break;
+
+	case BM_CONCAT:
+		cfi_build_concat_descs(cfi, cfiep, req);
+		break;
+
+	case BM_CIRCULAR:
+		cfi_build_circ_descs(cfi, cfiep, req);
+		break;
+
+	case BM_ALIGN:
+		cfi_build_align_descs(cfi, cfiep, req);
+		break;
+
+	default:
+		break;
+	}
+}
+
+/**
+ * Allocate DMA buffer for different Buffer modes.
+ */
+static void *cfi_ep_alloc_buf(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
+			      struct dwc_otg_pcd_ep *ep, dma_addr_t * dma,
+			      unsigned size, gfp_t flags)
+{
+	return DWC_DMA_ALLOC(size, dma);
+}
+
+/**
+ * This function initializes the CFI object.
+ */
+int init_cfi(cfiobject_t * cfiobj)
+{
+	CFI_INFO("%s\n", __func__);
+
+	/* Allocate a buffer for IN XFERs */
+	cfiobj->buf_in.buf =
+	    DWC_DMA_ALLOC(CFI_IN_BUF_LEN, &cfiobj->buf_in.addr);
+	if (NULL == cfiobj->buf_in.buf) {
+		CFI_INFO("Unable to allocate buffer for INs\n");
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Allocate a buffer for OUT XFERs */
+	cfiobj->buf_out.buf =
+	    DWC_DMA_ALLOC(CFI_OUT_BUF_LEN, &cfiobj->buf_out.addr);
+	if (NULL == cfiobj->buf_out.buf) {
+		CFI_INFO("Unable to allocate buffer for OUT\n");
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Initialize the callback function pointers */
+	cfiobj->ops.release = cfi_release;
+	cfiobj->ops.ep_enable = cfi_ep_enable;
+	cfiobj->ops.ctrl_write_complete = cfi_ctrl_write_complete;
+	cfiobj->ops.build_descriptors = cfi_build_descriptors;
+	cfiobj->ops.ep_alloc_buf = cfi_ep_alloc_buf;
+
+	/* Initialize the list of active endpoints in the CFI object */
+	DWC_LIST_INIT(&cfiobj->active_eps);
+
+	return 0;
+}
+
+/**
+ * This function reads the required feature's current value into the buffer
+ *
+ * @retval: Returns negative as error, or the data length of the feature
+ */
+static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
+				 struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *ctrl_req)
+{
+	int retval = -DWC_E_NOT_SUPPORTED;
+	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
+	uint16_t dfifo, rxfifo, txfifo;
+
+	switch (ctrl_req->wIndex) {
+		/* Whether the DDMA is enabled or not */
+	case FT_ID_DMA_MODE:
+		*buf = (coreif->dma_enable && coreif->dma_desc_enable) ? 1 : 0;
+		retval = 1;
+		break;
+
+	case FT_ID_DMA_BUFFER_SETUP:
+		retval = cfi_ep_get_sg_val(buf, pcd, ctrl_req);
+		break;
+
+	case FT_ID_DMA_BUFF_ALIGN:
+		retval = cfi_ep_get_align_val(buf, pcd, ctrl_req);
+		break;
+
+	case FT_ID_DMA_CONCAT_SETUP:
+		retval = cfi_ep_get_concat_val(buf, pcd, ctrl_req);
+		break;
+
+	case FT_ID_DMA_CIRCULAR:
+		CFI_INFO("GetFeature value (FT_ID_DMA_CIRCULAR)\n");
+		break;
+
+	case FT_ID_THRESHOLD_SETUP:
+		CFI_INFO("GetFeature value (FT_ID_THRESHOLD_SETUP)\n");
+		break;
+
+	case FT_ID_DFIFO_DEPTH:
+		dfifo = get_dfifo_size(coreif);
+		*((uint16_t *) buf) = dfifo;
+		retval = sizeof(uint16_t);
+		break;
+
+	case FT_ID_TX_FIFO_DEPTH:
+		retval = get_txfifo_size(pcd, ctrl_req->wValue);
+		if (retval >= 0) {
+			txfifo = retval;
+			*((uint16_t *) buf) = txfifo;
+			retval = sizeof(uint16_t);
+		}
+		break;
+
+	case FT_ID_RX_FIFO_DEPTH:
+		retval = get_rxfifo_size(coreif, ctrl_req->wValue);
+		if (retval >= 0) {
+			rxfifo = retval;
+			*((uint16_t *) buf) = rxfifo;
+			retval = sizeof(uint16_t);
+		}
+		break;
+	}
+
+	return retval;
+}
+
+/**
+ * This function resets the SG for the specified EP to its default value
+ */
+static int cfi_reset_sg_val(cfi_ep_t * cfiep)
+{
+	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
+	return 0;
+}
+
+/**
+ * This function resets the Alignment for the specified EP to its default value
+ */
+static int cfi_reset_align_val(cfi_ep_t * cfiep)
+{
+	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
+	return 0;
+}
+
+/**
+ * This function resets the Concatenation for the specified EP to its default value
+ * This function will also set the value of the wTxBytes field to NULL after
+ * freeing the memory previously allocated for this field.
+ */
+static int cfi_reset_concat_val(cfi_ep_t * cfiep)
+{
+	/* First we need to free the wTxBytes field */
+	if (cfiep->bm_concat->wTxBytes) {
+		DWC_FREE(cfiep->bm_concat->wTxBytes);
+		cfiep->bm_concat->wTxBytes = NULL;
+	}
+
+	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
+	return 0;
+}
+
+/**
+ * This function resets all the buffer setups of the specified endpoint
+ */
+static int cfi_ep_reset_all_setup_vals(cfi_ep_t * cfiep)
+{
+	cfi_reset_sg_val(cfiep);
+	cfi_reset_align_val(cfiep);
+	cfi_reset_concat_val(cfiep);
+	return 0;
+}
+
+static int cfi_handle_reset_fifo_val(struct dwc_otg_pcd *pcd, uint8_t ep_addr,
+				     uint8_t rx_rst, uint8_t tx_rst)
+{
+	int retval = -DWC_E_INVALID;
+	uint16_t tx_siz[15];
+	uint16_t rx_siz = 0;
+	dwc_otg_pcd_ep_t *ep = NULL;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
+
+	if (rx_rst) {
+		rx_siz = params->dev_rx_fifo_size;
+		params->dev_rx_fifo_size = GET_CORE_IF(pcd)->init_rxfsiz;
+	}
+
+	if (tx_rst) {
+		if (ep_addr == 0) {
+			int i;
+
+			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+				tx_siz[i] =
+				    core_if->core_params->dev_tx_fifo_size[i];
+				core_if->core_params->dev_tx_fifo_size[i] =
+				    core_if->init_txfsiz[i];
+			}
+		} else {
+
+			ep = get_ep_by_addr(pcd, ep_addr);
+
+			if (NULL == ep) {
+				CFI_INFO
+				    ("%s: Unable to get the endpoint addr=0x%02x\n",
+				     __func__, ep_addr);
+				return -DWC_E_INVALID;
+			}
+
+			tx_siz[0] =
+			    params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num -
+						     1];
+			params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] =
+			    GET_CORE_IF(pcd)->init_txfsiz[ep->
+							  dwc_ep.tx_fifo_num -
+							  1];
+		}
+	}
+
+	if (resize_fifos(GET_CORE_IF(pcd))) {
+		retval = 0;
+	} else {
+		CFI_INFO
+		    ("%s: Error resetting the feature Reset All(FIFO size)\n",
+		     __func__);
+		if (rx_rst) {
+			params->dev_rx_fifo_size = rx_siz;
+		}
+
+		if (tx_rst) {
+			if (ep_addr == 0) {
+				int i;
+				for (i = 0; i < core_if->hwcfg4.b.num_in_eps;
+				     i++) {
+					core_if->
+					    core_params->dev_tx_fifo_size[i] =
+					    tx_siz[i];
+				}
+			} else {
+				params->dev_tx_fifo_size[ep->
+							 dwc_ep.tx_fifo_num -
+							 1] = tx_siz[0];
+			}
+		}
+		retval = -DWC_E_INVALID;
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_all(struct dwc_otg_pcd *pcd, uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	retval = cfi_handle_reset_fifo_val(pcd, addr, 1, 1);
+	if (retval < 0) {
+		return retval;
+	}
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_ep_reset_all_setup_vals(cfiep);
+		cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_ep_reset_all_setup_vals(cfiep);
+			cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Reset All\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_dma_buff_setup(struct dwc_otg_pcd *pcd,
+					   uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_reset_sg_val(cfiep);
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_reset_sg_val(cfiep);
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Buffer Setup\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_concat_val(struct dwc_otg_pcd *pcd, uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_reset_concat_val(cfiep);
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_reset_concat_val(cfiep);
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Concatenation Value\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_align_val(struct dwc_otg_pcd *pcd, uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_reset_align_val(cfiep);
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_reset_align_val(cfiep);
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Aliignment Value\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+
+}
+
+static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req)
+{
+	int retval = 0;
+
+	switch (req->wIndex) {
+	case 0:
+		/* Reset all features */
+		retval = cfi_handle_reset_all(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_DMA_BUFFER_SETUP:
+		/* Reset the SG buffer setup */
+		retval =
+		    cfi_handle_reset_dma_buff_setup(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_DMA_CONCAT_SETUP:
+		/* Reset the Concatenation buffer setup */
+		retval = cfi_handle_reset_concat_val(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_DMA_BUFF_ALIGN:
+		/* Reset the Alignment buffer setup */
+		retval = cfi_handle_reset_align_val(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_TX_FIFO_DEPTH:
+		retval =
+		    cfi_handle_reset_fifo_val(pcd, req->wValue & 0xff, 0, 1);
+		pcd->cfi->need_gadget_att = 0;
+		break;
+
+	case FT_ID_RX_FIFO_DEPTH:
+		retval = cfi_handle_reset_fifo_val(pcd, 0, 1, 0);
+		pcd->cfi->need_gadget_att = 0;
+		break;
+	default:
+		break;
+	}
+	return retval;
+}
+
+/**
+ * This function sets a new value for the SG buffer setup.
+ */
+static int cfi_ep_set_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
+{
+	uint8_t inaddr, outaddr;
+	cfi_ep_t *epin, *epout;
+	ddma_sg_buffer_setup_t *psgval;
+	uint32_t desccount, size;
+
+	CFI_INFO("%s\n", __func__);
+
+	psgval = (ddma_sg_buffer_setup_t *) buf;
+	desccount = (uint32_t) psgval->bCount;
+	size = (uint32_t) psgval->wSize;
+
+	/* Check the DMA descriptor count */
+	if ((desccount > MAX_DMA_DESCS_PER_EP) || (desccount == 0)) {
+		CFI_INFO
+		    ("%s: The count of DMA Descriptors should be between 1 and %d\n",
+		     __func__, MAX_DMA_DESCS_PER_EP);
+		return -DWC_E_INVALID;
+	}
+
+	/* Check the DMA descriptor count */
+
+	if (size == 0) {
+
+		CFI_INFO("%s: The transfer size should be at least 1 byte\n",
+			 __func__);
+
+		return -DWC_E_INVALID;
+
+	}
+
+	inaddr = psgval->bInEndpointAddress;
+	outaddr = psgval->bOutEndpointAddress;
+
+	epin = get_cfi_ep_by_addr(pcd->cfi, inaddr);
+	epout = get_cfi_ep_by_addr(pcd->cfi, outaddr);
+
+	if (NULL == epin || NULL == epout) {
+		CFI_INFO
+		    ("%s: Unable to get the endpoints inaddr=0x%02x outaddr=0x%02x\n",
+		     __func__, inaddr, outaddr);
+		return -DWC_E_INVALID;
+	}
+
+	epin->ep->dwc_ep.buff_mode = BM_SG;
+	dwc_memcpy(epin->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
+
+	epout->ep->dwc_ep.buff_mode = BM_SG;
+	dwc_memcpy(epout->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
+
+	return 0;
+}
+
+/**
+ * This function sets a new value for the buffer Alignment setup.
+ */
+static int cfi_ep_set_alignment_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
+{
+	cfi_ep_t *ep;
+	uint8_t addr;
+	ddma_align_buffer_setup_t *palignval;
+
+	palignval = (ddma_align_buffer_setup_t *) buf;
+	addr = palignval->bEndpointAddress;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, addr);
+		return -DWC_E_INVALID;
+	}
+
+	ep->ep->dwc_ep.buff_mode = BM_ALIGN;
+	dwc_memcpy(ep->bm_align, palignval, sizeof(ddma_align_buffer_setup_t));
+
+	return 0;
+}
+
+/**
+ * This function sets a new value for the Concatenation buffer setup.
+ */
+static int cfi_ep_set_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
+{
+	uint8_t addr;
+	cfi_ep_t *ep;
+	struct _ddma_concat_buffer_setup_hdr *pConcatValHdr;
+	uint16_t *pVals;
+	uint32_t desccount;
+	int i;
+	uint16_t mps;
+
+	pConcatValHdr = (struct _ddma_concat_buffer_setup_hdr *)buf;
+	desccount = (uint32_t) pConcatValHdr->bDescCount;
+	pVals = (uint16_t *) (buf + BS_CONCAT_VAL_HDR_LEN);
+
+	/* Check the DMA descriptor count */
+	if (desccount > MAX_DMA_DESCS_PER_EP) {
+		CFI_INFO("%s: Maximum DMA Descriptor count should be %d\n",
+			 __func__, MAX_DMA_DESCS_PER_EP);
+		return -DWC_E_INVALID;
+	}
+
+	addr = pConcatValHdr->bEndpointAddress;
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, addr);
+		return -DWC_E_INVALID;
+	}
+
+	mps = UGETW(ep->ep->desc->wMaxPacketSize);
+
+#if 0
+	for (i = 0; i < desccount; i++) {
+		CFI_INFO("%s: wTxSize[%d]=0x%04x\n", __func__, i, pVals[i]);
+	}
+	CFI_INFO("%s: epname=%s; mps=%d\n", __func__, ep->ep->ep.name, mps);
+#endif
+
+	/* Check the wTxSizes to be less than or equal to the mps */
+	for (i = 0; i < desccount; i++) {
+		if (pVals[i] > mps) {
+			CFI_INFO
+			    ("%s: ERROR - the wTxSize[%d] should be <= MPS (wTxSize=%d)\n",
+			     __func__, i, pVals[i]);
+			return -DWC_E_INVALID;
+		}
+	}
+
+	ep->ep->dwc_ep.buff_mode = BM_CONCAT;
+	dwc_memcpy(ep->bm_concat, pConcatValHdr, BS_CONCAT_VAL_HDR_LEN);
+
+	/* Free the previously allocated storage for the wTxBytes */
+	if (ep->bm_concat->wTxBytes) {
+		DWC_FREE(ep->bm_concat->wTxBytes);
+	}
+
+	/* Allocate a new storage for the wTxBytes field */
+	ep->bm_concat->wTxBytes =
+	    DWC_ALLOC(sizeof(uint16_t) * pConcatValHdr->bDescCount);
+	if (NULL == ep->bm_concat->wTxBytes) {
+		CFI_INFO("%s: Unable to allocate memory\n", __func__);
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Copy the new values into the wTxBytes filed */
+	dwc_memcpy(ep->bm_concat->wTxBytes, buf + BS_CONCAT_VAL_HDR_LEN,
+		   sizeof(uint16_t) * pConcatValHdr->bDescCount);
+
+	return 0;
+}
+
+/**
+ * This function calculates the total of all FIFO sizes
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return The total of data FIFO sizes.
+ *
+ */
+static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_params_t *params = core_if->core_params;
+	uint16_t dfifo_total = 0;
+	int i;
+
+	/* The shared RxFIFO size */
+	dfifo_total =
+	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
+
+	/* Add up each TxFIFO size to the total */
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+		dfifo_total += params->dev_tx_fifo_size[i];
+	}
+
+	return dfifo_total;
+}
+
+/**
+ * This function returns Rx FIFO size
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return The total of data FIFO sizes.
+ *
+ */
+static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue)
+{
+	switch (wValue >> 8) {
+	case 0:
+		return (core_if->pwron_rxfsiz <
+			32768) ? core_if->pwron_rxfsiz : 32768;
+		break;
+	case 1:
+		return core_if->core_params->dev_rx_fifo_size;
+		break;
+	default:
+		return -DWC_E_INVALID;
+		break;
+	}
+}
+
+/**
+ * This function returns Tx FIFO size for IN EP
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return The total of data FIFO sizes.
+ *
+ */
+static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue)
+{
+	dwc_otg_pcd_ep_t *ep;
+
+	ep = get_ep_by_addr(pcd, wValue & 0xff);
+
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, wValue & 0xff);
+		return -DWC_E_INVALID;
+	}
+
+	if (!ep->dwc_ep.is_in) {
+		CFI_INFO
+		    ("%s: No Tx FIFO assingned to the Out endpoint addr=0x%02x\n",
+		     __func__, wValue & 0xff);
+		return -DWC_E_INVALID;
+	}
+
+	switch (wValue >> 8) {
+	case 0:
+		return (GET_CORE_IF(pcd)->pwron_txfsiz
+			[ep->dwc_ep.tx_fifo_num - 1] <
+			768) ? GET_CORE_IF(pcd)->pwron_txfsiz[ep->
+							      dwc_ep.tx_fifo_num
+							      - 1] : 32768;
+		break;
+	case 1:
+		return GET_CORE_IF(pcd)->core_params->
+		    dev_tx_fifo_size[ep->dwc_ep.num - 1];
+		break;
+	default:
+		return -DWC_E_INVALID;
+		break;
+	}
+}
+
+/**
+ * This function checks if the submitted combination of
+ * device mode FIFO sizes is possible or not.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return 1 if possible, 0 otherwise.
+ *
+ */
+static uint8_t check_fifo_sizes(dwc_otg_core_if_t * core_if)
+{
+	uint16_t dfifo_actual = 0;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	uint16_t start_addr = 0;
+	int i;
+
+	dfifo_actual =
+	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+		dfifo_actual += params->dev_tx_fifo_size[i];
+	}
+
+	if (dfifo_actual > core_if->total_fifo_size) {
+		return 0;
+	}
+
+	if (params->dev_rx_fifo_size > 32768 || params->dev_rx_fifo_size < 16)
+		return 0;
+
+	if (params->dev_nperio_tx_fifo_size > 32768
+	    || params->dev_nperio_tx_fifo_size < 16)
+		return 0;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+
+		if (params->dev_tx_fifo_size[i] > 768
+		    || params->dev_tx_fifo_size[i] < 4)
+			return 0;
+	}
+
+	if (params->dev_rx_fifo_size > core_if->pwron_rxfsiz)
+		return 0;
+	start_addr = params->dev_rx_fifo_size;
+
+	if (params->dev_nperio_tx_fifo_size > core_if->pwron_gnptxfsiz)
+		return 0;
+	start_addr += params->dev_nperio_tx_fifo_size;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+
+		if (params->dev_tx_fifo_size[i] > core_if->pwron_txfsiz[i])
+			return 0;
+		start_addr += params->dev_tx_fifo_size[i];
+	}
+
+	return 1;
+}
+
+/**
+ * This function resizes Device mode FIFOs
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return 1 if successful, 0 otherwise
+ *
+ */
+static uint8_t resize_fifos(dwc_otg_core_if_t * core_if)
+{
+	int i = 0;
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	uint32_t rx_fifo_size;
+	fifosize_data_t nptxfifosize;
+	fifosize_data_t txfifosize[15];
+
+	uint32_t rx_fsz_bak;
+	uint32_t nptxfsz_bak;
+	uint32_t txfsz_bak[15];
+
+	uint16_t start_address;
+	uint8_t retval = 1;
+
+	if (!check_fifo_sizes(core_if)) {
+		return 0;
+	}
+
+	/* Configure data FIFO sizes */
+	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
+		rx_fsz_bak = DWC_READ_REG32(&global_regs->grxfsiz);
+		rx_fifo_size = params->dev_rx_fifo_size;
+		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
+
+		/*
+		 * Tx FIFOs These FIFOs are numbered from 1 to 15.
+		 * Indexes of the FIFO size module parameters in the
+		 * dev_tx_fifo_size array and the FIFO size registers in
+		 * the dtxfsiz array run from 0 to 14.
+		 */
+
+		/* Non-periodic Tx FIFO */
+		nptxfsz_bak = DWC_READ_REG32(&global_regs->gnptxfsiz);
+		nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
+		start_address = params->dev_rx_fifo_size;
+		nptxfifosize.b.startaddr = start_address;
+
+		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
+
+		start_address += nptxfifosize.b.depth;
+
+		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+			txfsz_bak[i] = DWC_READ_REG32(&global_regs->dtxfsiz[i]);
+
+			txfifosize[i].b.depth = params->dev_tx_fifo_size[i];
+			txfifosize[i].b.startaddr = start_address;
+			DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+					txfifosize[i].d32);
+
+			start_address += txfifosize[i].b.depth;
+		}
+
+		/** Check if register values are set correctly */
+		if (rx_fifo_size != DWC_READ_REG32(&global_regs->grxfsiz)) {
+			retval = 0;
+		}
+
+		if (nptxfifosize.d32 != DWC_READ_REG32(&global_regs->gnptxfsiz)) {
+			retval = 0;
+		}
+
+		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+			if (txfifosize[i].d32 !=
+			    DWC_READ_REG32(&global_regs->dtxfsiz[i])) {
+				retval = 0;
+			}
+		}
+
+		/** If register values are not set correctly, reset old values */
+		if (retval == 0) {
+			DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fsz_bak);
+
+			/* Non-periodic Tx FIFO */
+			DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfsz_bak);
+
+			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+						txfsz_bak[i]);
+			}
+		}
+	} else {
+		return 0;
+	}
+
+	/* Flush the FIFOs */
+	dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
+	dwc_otg_flush_rx_fifo(core_if);
+
+	return retval;
+}
+
+/**
+ * This function sets a new value for the buffer Alignment setup.
+ */
+static int cfi_ep_set_tx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
+{
+	int retval;
+	uint32_t fsiz;
+	uint16_t size;
+	uint16_t ep_addr;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
+	tx_fifo_size_setup_t *ptxfifoval;
+
+	ptxfifoval = (tx_fifo_size_setup_t *) buf;
+	ep_addr = ptxfifoval->bEndpointAddress;
+	size = ptxfifoval->wDepth;
+
+	ep = get_ep_by_addr(pcd, ep_addr);
+
+	CFI_INFO
+	    ("%s: Set Tx FIFO size: endpoint addr=0x%02x, depth=%d, FIFO Num=%d\n",
+	     __func__, ep_addr, size, ep->dwc_ep.tx_fifo_num);
+
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, ep_addr);
+		return -DWC_E_INVALID;
+	}
+
+	fsiz = params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1];
+	params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = size;
+
+	if (resize_fifos(GET_CORE_IF(pcd))) {
+		retval = 0;
+	} else {
+		CFI_INFO
+		    ("%s: Error setting the feature Tx FIFO Size for EP%d\n",
+		     __func__, ep_addr);
+		params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = fsiz;
+		retval = -DWC_E_INVALID;
+	}
+
+	return retval;
+}
+
+/**
+ * This function sets a new value for the buffer Alignment setup.
+ */
+static int cfi_set_rx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
+{
+	int retval;
+	uint32_t fsiz;
+	uint16_t size;
+	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
+	rx_fifo_size_setup_t *prxfifoval;
+
+	prxfifoval = (rx_fifo_size_setup_t *) buf;
+	size = prxfifoval->wDepth;
+
+	fsiz = params->dev_rx_fifo_size;
+	params->dev_rx_fifo_size = size;
+
+	if (resize_fifos(GET_CORE_IF(pcd))) {
+		retval = 0;
+	} else {
+		CFI_INFO("%s: Error setting the feature Rx FIFO Size\n",
+			 __func__);
+		params->dev_rx_fifo_size = fsiz;
+		retval = -DWC_E_INVALID;
+	}
+
+	return retval;
+}
+
+/**
+ * This function reads the SG of an EP's buffer setup into the buffer buf
+ */
+static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req)
+{
+	int retval = -DWC_E_INVALID;
+	uint8_t addr;
+	cfi_ep_t *ep;
+
+	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
+	addr = req->wValue & 0xFF;
+	if (addr == 0)		/* The address should be non-zero */
+		return retval;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
+			 __func__, addr);
+		return retval;
+	}
+
+	dwc_memcpy(buf, ep->bm_sg, BS_SG_VAL_DESC_LEN);
+	retval = BS_SG_VAL_DESC_LEN;
+	return retval;
+}
+
+/**
+ * This function reads the Concatenation value of an EP's buffer mode into
+ * the buffer buf
+ */
+static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *req)
+{
+	int retval = -DWC_E_INVALID;
+	uint8_t addr;
+	cfi_ep_t *ep;
+	uint8_t desc_count;
+
+	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
+	addr = req->wValue & 0xFF;
+	if (addr == 0)		/* The address should be non-zero */
+		return retval;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
+			 __func__, addr);
+		return retval;
+	}
+
+	/* Copy the header to the buffer */
+	dwc_memcpy(buf, ep->bm_concat, BS_CONCAT_VAL_HDR_LEN);
+	/* Advance the buffer pointer by the header size */
+	buf += BS_CONCAT_VAL_HDR_LEN;
+
+	desc_count = ep->bm_concat->hdr.bDescCount;
+	/* Copy alll the wTxBytes to the buffer */
+	dwc_memcpy(buf, ep->bm_concat->wTxBytes, sizeof(uid16_t) * desc_count);
+
+	retval = BS_CONCAT_VAL_HDR_LEN + sizeof(uid16_t) * desc_count;
+	return retval;
+}
+
+/**
+ * This function reads the buffer Alignment value of an EP's buffer mode into
+ * the buffer buf
+ *
+ * @return The total number of bytes copied to the buffer or negative error code.
+ */
+static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				struct cfi_usb_ctrlrequest *req)
+{
+	int retval = -DWC_E_INVALID;
+	uint8_t addr;
+	cfi_ep_t *ep;
+
+	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
+	addr = req->wValue & 0xFF;
+	if (addr == 0)		/* The address should be non-zero */
+		return retval;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
+			 __func__, addr);
+		return retval;
+	}
+
+	dwc_memcpy(buf, ep->bm_align, BS_ALIGN_VAL_HDR_LEN);
+	retval = BS_ALIGN_VAL_HDR_LEN;
+
+	return retval;
+}
+
+/**
+ * This function sets a new value for the specified feature
+ *
+ * @param	pcd	A pointer to the PCD object
+ *
+ * @return 0 if successful, negative error code otherwise to stall the DCE.
+ */
+static int cfi_set_feature_value(struct dwc_otg_pcd *pcd)
+{
+	int retval = -DWC_E_NOT_SUPPORTED;
+	uint16_t wIndex, wValue;
+	uint8_t bRequest;
+	struct dwc_otg_core_if *coreif;
+	cfiobject_t *cfi = pcd->cfi;
+	struct cfi_usb_ctrlrequest *ctrl_req;
+	uint8_t *buf;
+	ctrl_req = &cfi->ctrl_req;
+
+	buf = pcd->cfi->ctrl_req.data;
+
+	coreif = GET_CORE_IF(pcd);
+	bRequest = ctrl_req->bRequest;
+	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
+	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
+
+	/* See which feature is to be modified */
+	switch (wIndex) {
+	case FT_ID_DMA_BUFFER_SETUP:
+		/* Modify the feature */
+		if ((retval = cfi_ep_set_sg_val(buf, pcd)) < 0)
+			return retval;
+
+		/* And send this request to the gadget */
+		cfi->need_gadget_att = 1;
+		break;
+
+	case FT_ID_DMA_BUFF_ALIGN:
+		if ((retval = cfi_ep_set_alignment_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 1;
+		break;
+
+	case FT_ID_DMA_CONCAT_SETUP:
+		/* Modify the feature */
+		if ((retval = cfi_ep_set_concat_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 1;
+		break;
+
+	case FT_ID_DMA_CIRCULAR:
+		CFI_INFO("FT_ID_DMA_CIRCULAR\n");
+		break;
+
+	case FT_ID_THRESHOLD_SETUP:
+		CFI_INFO("FT_ID_THRESHOLD_SETUP\n");
+		break;
+
+	case FT_ID_DFIFO_DEPTH:
+		CFI_INFO("FT_ID_DFIFO_DEPTH\n");
+		break;
+
+	case FT_ID_TX_FIFO_DEPTH:
+		CFI_INFO("FT_ID_TX_FIFO_DEPTH\n");
+		if ((retval = cfi_ep_set_tx_fifo_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 0;
+		break;
+
+	case FT_ID_RX_FIFO_DEPTH:
+		CFI_INFO("FT_ID_RX_FIFO_DEPTH\n");
+		if ((retval = cfi_set_rx_fifo_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 0;
+		break;
+	}
+
+	return retval;
+}
+
+#endif //DWC_UTE_CFI
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cfi.h b/drivers/usb/host/dwc_otg/dwc_otg_cfi.h
new file mode 100644
index 0000000000000..55fd337a283c3
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.h
@@ -0,0 +1,320 @@
+/* ==========================================================================
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_OTG_CFI_H__)
+#define __DWC_OTG_CFI_H__
+
+#include "dwc_otg_pcd.h"
+#include "dwc_cfi_common.h"
+
+/**
+ * @file
+ * This file contains the CFI related OTG PCD specific common constants,
+ * interfaces(functions and macros) and data structures.The CFI Protocol is an
+ * optional interface for internal testing purposes that a DUT may implement to
+ * support testing of configurable features.
+ *
+ */
+
+struct dwc_otg_pcd;
+struct dwc_otg_pcd_ep;
+
+/** OTG CFI Features (properties) ID constants */
+/** This is a request for all Core Features */
+#define FT_ID_DMA_MODE					0x0001
+#define FT_ID_DMA_BUFFER_SETUP			0x0002
+#define FT_ID_DMA_BUFF_ALIGN			0x0003
+#define FT_ID_DMA_CONCAT_SETUP			0x0004
+#define FT_ID_DMA_CIRCULAR				0x0005
+#define FT_ID_THRESHOLD_SETUP			0x0006
+#define FT_ID_DFIFO_DEPTH				0x0007
+#define FT_ID_TX_FIFO_DEPTH				0x0008
+#define FT_ID_RX_FIFO_DEPTH				0x0009
+
+/**********************************************************/
+#define CFI_INFO_DEF
+
+#ifdef CFI_INFO_DEF
+#define CFI_INFO(fmt...)	DWC_PRINTF("CFI: " fmt);
+#else
+#define CFI_INFO(fmt...)
+#endif
+
+#define min(x,y) ({ \
+	x < y ? x : y; })
+
+#define max(x,y) ({ \
+	x > y ? x : y; })
+
+/**
+ * Descriptor DMA SG Buffer setup structure (SG buffer). This structure is
+ * also used for setting up a buffer for Circular DDMA.
+ */
+struct _ddma_sg_buffer_setup {
+#define BS_SG_VAL_DESC_LEN	6
+	/* The OUT EP address */
+	uint8_t bOutEndpointAddress;
+	/* The IN EP address */
+	uint8_t bInEndpointAddress;
+	/* Number of bytes to put between transfer segments (must be DWORD boundaries) */
+	uint8_t bOffset;
+	/* The number of transfer segments (a DMA descriptors per each segment) */
+	uint8_t bCount;
+	/* Size (in byte) of each transfer segment */
+	uint16_t wSize;
+} __attribute__ ((packed));
+typedef struct _ddma_sg_buffer_setup ddma_sg_buffer_setup_t;
+
+/** Descriptor DMA Concatenation Buffer setup structure */
+struct _ddma_concat_buffer_setup_hdr {
+#define BS_CONCAT_VAL_HDR_LEN	4
+	/* The endpoint for which the buffer is to be set up */
+	uint8_t bEndpointAddress;
+	/* The count of descriptors to be used */
+	uint8_t bDescCount;
+	/* The total size of the transfer */
+	uint16_t wSize;
+} __attribute__ ((packed));
+typedef struct _ddma_concat_buffer_setup_hdr ddma_concat_buffer_setup_hdr_t;
+
+/** Descriptor DMA Concatenation Buffer setup structure */
+struct _ddma_concat_buffer_setup {
+	/* The SG header */
+	ddma_concat_buffer_setup_hdr_t hdr;
+
+	/* The XFER sizes pointer (allocated dynamically) */
+	uint16_t *wTxBytes;
+} __attribute__ ((packed));
+typedef struct _ddma_concat_buffer_setup ddma_concat_buffer_setup_t;
+
+/** Descriptor DMA Alignment Buffer setup structure */
+struct _ddma_align_buffer_setup {
+#define BS_ALIGN_VAL_HDR_LEN	2
+	uint8_t bEndpointAddress;
+	uint8_t bAlign;
+} __attribute__ ((packed));
+typedef struct _ddma_align_buffer_setup ddma_align_buffer_setup_t;
+
+/** Transmit FIFO Size setup structure */
+struct _tx_fifo_size_setup {
+	uint8_t bEndpointAddress;
+	uint16_t wDepth;
+} __attribute__ ((packed));
+typedef struct _tx_fifo_size_setup tx_fifo_size_setup_t;
+
+/** Transmit FIFO Size setup structure */
+struct _rx_fifo_size_setup {
+	uint16_t wDepth;
+} __attribute__ ((packed));
+typedef struct _rx_fifo_size_setup rx_fifo_size_setup_t;
+
+/**
+ * struct cfi_usb_ctrlrequest - the CFI implementation of the struct usb_ctrlrequest
+ * This structure encapsulates the standard usb_ctrlrequest and adds a pointer
+ * to the data returned in the data stage of a 3-stage Control Write requests.
+ */
+struct cfi_usb_ctrlrequest {
+	uint8_t bRequestType;
+	uint8_t bRequest;
+	uint16_t wValue;
+	uint16_t wIndex;
+	uint16_t wLength;
+	uint8_t *data;
+} UPACKED;
+
+/*---------------------------------------------------------------------------*/
+
+/**
+ * The CFI wrapper of the enabled and activated dwc_otg_pcd_ep structures.
+ * This structure is used to store the buffer setup data for any
+ * enabled endpoint in the PCD.
+ */
+struct cfi_ep {
+	/* Entry for the list container */
+	dwc_list_link_t lh;
+	/* Pointer to the active PCD endpoint structure */
+	struct dwc_otg_pcd_ep *ep;
+	/* The last descriptor in the chain of DMA descriptors of the endpoint */
+	struct dwc_otg_dma_desc *dma_desc_last;
+	/* The SG feature value */
+	ddma_sg_buffer_setup_t *bm_sg;
+	/* The Circular feature value */
+	ddma_sg_buffer_setup_t *bm_circ;
+	/* The Concatenation feature value */
+	ddma_concat_buffer_setup_t *bm_concat;
+	/* The Alignment feature value */
+	ddma_align_buffer_setup_t *bm_align;
+	/* XFER length */
+	uint32_t xfer_len;
+	/*
+	 * Count of DMA descriptors currently used.
+	 * The total should not exceed the MAX_DMA_DESCS_PER_EP value
+	 * defined in the dwc_otg_cil.h
+	 */
+	uint32_t desc_count;
+};
+typedef struct cfi_ep cfi_ep_t;
+
+typedef struct cfi_dma_buff {
+#define CFI_IN_BUF_LEN	1024
+#define CFI_OUT_BUF_LEN	1024
+	dma_addr_t addr;
+	uint8_t *buf;
+} cfi_dma_buff_t;
+
+struct cfiobject;
+
+/**
+ * This is the interface for the CFI operations.
+ *
+ * @param	ep_enable			Called when any endpoint is enabled and activated.
+ * @param	release				Called when the CFI object is released and it needs to correctly
+ *								deallocate the dynamic memory
+ * @param	ctrl_write_complete	Called when the data stage of the request is complete
+ */
+typedef struct cfi_ops {
+	int (*ep_enable) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
+			  struct dwc_otg_pcd_ep * ep);
+	void *(*ep_alloc_buf) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
+			       struct dwc_otg_pcd_ep * ep, dma_addr_t * dma,
+			       unsigned size, gfp_t flags);
+	void (*release) (struct cfiobject * cfi);
+	int (*ctrl_write_complete) (struct cfiobject * cfi,
+				    struct dwc_otg_pcd * pcd);
+	void (*build_descriptors) (struct cfiobject * cfi,
+				   struct dwc_otg_pcd * pcd,
+				   struct dwc_otg_pcd_ep * ep,
+				   dwc_otg_pcd_request_t * req);
+} cfi_ops_t;
+
+struct cfiobject {
+	cfi_ops_t ops;
+	struct dwc_otg_pcd *pcd;
+	struct usb_gadget *gadget;
+
+	/* Buffers used to send/receive CFI-related request data */
+	cfi_dma_buff_t buf_in;
+	cfi_dma_buff_t buf_out;
+
+	/* CFI specific Control request wrapper */
+	struct cfi_usb_ctrlrequest ctrl_req;
+
+	/* The list of active EP's in the PCD of type cfi_ep_t */
+	dwc_list_link_t active_eps;
+
+	/* This flag shall control the propagation of a specific request
+	 * to the gadget's processing routines.
+	 * 0 - no gadget handling
+	 * 1 - the gadget needs to know about this request (w/o completing a status
+	 * phase - just return a 0 to the _setup callback)
+	 */
+	uint8_t need_gadget_att;
+
+	/* Flag indicating whether the status IN phase needs to be
+	 * completed by the PCD
+	 */
+	uint8_t need_status_in_complete;
+};
+typedef struct cfiobject cfiobject_t;
+
+#define DUMP_MSG
+
+#if defined(DUMP_MSG)
+static inline void dump_msg(const u8 * buf, unsigned int length)
+{
+	unsigned int start, num, i;
+	char line[52], *p;
+
+	if (length >= 512)
+		return;
+
+	start = 0;
+	while (length > 0) {
+		num = min(length, 16u);
+		p = line;
+		for (i = 0; i < num; ++i) {
+			if (i == 8)
+				*p++ = ' ';
+			DWC_SPRINTF(p, " %02x", buf[i]);
+			p += 3;
+		}
+		*p = 0;
+		DWC_DEBUG("%6x: %s\n", start, line);
+		buf += num;
+		start += num;
+		length -= num;
+	}
+}
+#else
+static inline void dump_msg(const u8 * buf, unsigned int length)
+{
+}
+#endif
+
+/**
+ * This function returns a pointer to cfi_ep_t object with the addr address.
+ */
+static inline struct cfi_ep *get_cfi_ep_by_addr(struct cfiobject *cfi,
+						uint8_t addr)
+{
+	struct cfi_ep *pcfiep;
+	dwc_list_link_t *tmp;
+
+	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+
+		if (pcfiep->ep->desc->bEndpointAddress == addr) {
+			return pcfiep;
+		}
+	}
+
+	return NULL;
+}
+
+/**
+ * This function returns a pointer to cfi_ep_t object that matches
+ * the dwc_otg_pcd_ep object.
+ */
+static inline struct cfi_ep *get_cfi_ep_by_pcd_ep(struct cfiobject *cfi,
+						  struct dwc_otg_pcd_ep *ep)
+{
+	struct cfi_ep *pcfiep = NULL;
+	dwc_list_link_t *tmp;
+
+	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+		if (pcfiep->ep == ep) {
+			return pcfiep;
+		}
+	}
+	return NULL;
+}
+
+int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl);
+
+#endif /* (__DWC_OTG_CFI_H__) */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil.c b/drivers/usb/host/dwc_otg/dwc_otg_cil.c
new file mode 100644
index 0000000000000..14300ad0f2af7
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.c
@@ -0,0 +1,7146 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.c $
+ * $Revision: #191 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * The Core Interface Layer provides basic services for accessing and
+ * managing the DWC_otg hardware. These services are used by both the
+ * Host Controller Driver and the Peripheral Controller Driver.
+ *
+ * The CIL manages the memory map for the core so that the HCD and PCD
+ * don't have to do this separately. It also handles basic tasks like
+ * reading/writing the registers and data FIFOs in the controller.
+ * Some of the data access functions provide encapsulation of several
+ * operations required to perform a task, such as writing multiple
+ * registers to start a transfer. Finally, the CIL performs basic
+ * services that are not specific to either the host or device modes
+ * of operation. These services include management of the OTG Host
+ * Negotiation Protocol (HNP) and Session Request Protocol (SRP). A
+ * Diagnostic API is also provided to allow testing of the controller
+ * hardware.
+ *
+ * The Core Interface Layer has the following requirements:
+ * - Provides basic controller operations.
+ * - Minimal use of OS services.
+ * - The OS services used will be abstracted by using inline functions
+ *	 or macros.
+ *
+ */
+
+#include "dwc_os.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+
+extern bool cil_force_host;
+
+static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if);
+
+/**
+ * This function is called to initialize the DWC_otg CSR data
+ * structures. The register addresses in the device and host
+ * structures are initialized from the base address supplied by the
+ * caller. The calling function must make the OS calls to get the
+ * base address of the DWC_otg controller registers. The core_params
+ * argument holds the parameters that specify how the core should be
+ * configured.
+ *
+ * @param reg_base_addr Base address of DWC_otg core registers
+ *
+ */
+dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * reg_base_addr)
+{
+	dwc_otg_core_if_t *core_if = 0;
+	dwc_otg_dev_if_t *dev_if = 0;
+	dwc_otg_host_if_t *host_if = 0;
+	uint8_t *reg_base = (uint8_t *) reg_base_addr;
+	int i = 0;
+
+	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, reg_base_addr);
+
+	core_if = DWC_ALLOC(sizeof(dwc_otg_core_if_t));
+
+	if (core_if == NULL) {
+		DWC_DEBUGPL(DBG_CIL,
+			    "Allocation of dwc_otg_core_if_t failed\n");
+		return 0;
+	}
+	core_if->core_global_regs = (dwc_otg_core_global_regs_t *) reg_base;
+
+	/*
+	 * Allocate the Device Mode structures.
+	 */
+	dev_if = DWC_ALLOC(sizeof(dwc_otg_dev_if_t));
+
+	if (dev_if == NULL) {
+		DWC_DEBUGPL(DBG_CIL, "Allocation of dwc_otg_dev_if_t failed\n");
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	dev_if->dev_global_regs =
+	    (dwc_otg_device_global_regs_t *) (reg_base +
+					      DWC_DEV_GLOBAL_REG_OFFSET);
+
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		dev_if->in_ep_regs[i] = (dwc_otg_dev_in_ep_regs_t *)
+		    (reg_base + DWC_DEV_IN_EP_REG_OFFSET +
+		     (i * DWC_EP_REG_OFFSET));
+
+		dev_if->out_ep_regs[i] = (dwc_otg_dev_out_ep_regs_t *)
+		    (reg_base + DWC_DEV_OUT_EP_REG_OFFSET +
+		     (i * DWC_EP_REG_OFFSET));
+		DWC_DEBUGPL(DBG_CILV, "in_ep_regs[%d]->diepctl=%p\n",
+			    i, &dev_if->in_ep_regs[i]->diepctl);
+		DWC_DEBUGPL(DBG_CILV, "out_ep_regs[%d]->doepctl=%p\n",
+			    i, &dev_if->out_ep_regs[i]->doepctl);
+	}
+
+	dev_if->speed = 0;	// unknown
+
+	core_if->dev_if = dev_if;
+
+	/*
+	 * Allocate the Host Mode structures.
+	 */
+	host_if = DWC_ALLOC(sizeof(dwc_otg_host_if_t));
+
+	if (host_if == NULL) {
+		DWC_DEBUGPL(DBG_CIL,
+			    "Allocation of dwc_otg_host_if_t failed\n");
+		DWC_FREE(dev_if);
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	host_if->host_global_regs = (dwc_otg_host_global_regs_t *)
+	    (reg_base + DWC_OTG_HOST_GLOBAL_REG_OFFSET);
+
+	host_if->hprt0 =
+	    (uint32_t *) (reg_base + DWC_OTG_HOST_PORT_REGS_OFFSET);
+
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		host_if->hc_regs[i] = (dwc_otg_hc_regs_t *)
+		    (reg_base + DWC_OTG_HOST_CHAN_REGS_OFFSET +
+		     (i * DWC_OTG_CHAN_REGS_OFFSET));
+		DWC_DEBUGPL(DBG_CILV, "hc_reg[%d]->hcchar=%p\n",
+			    i, &host_if->hc_regs[i]->hcchar);
+	}
+
+	host_if->num_host_channels = MAX_EPS_CHANNELS;
+	core_if->host_if = host_if;
+
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		core_if->data_fifo[i] =
+		    (uint32_t *) (reg_base + DWC_OTG_DATA_FIFO_OFFSET +
+				  (i * DWC_OTG_DATA_FIFO_SIZE));
+		DWC_DEBUGPL(DBG_CILV, "data_fifo[%d]=0x%08lx\n",
+			    i, (unsigned long)core_if->data_fifo[i]);
+	}
+
+	core_if->pcgcctl = (uint32_t *) (reg_base + DWC_OTG_PCGCCTL_OFFSET);
+
+	/* Initiate lx_state to L3 disconnected state */
+	core_if->lx_state = DWC_OTG_L3;
+	/*
+	 * Store the contents of the hardware configuration registers here for
+	 * easy access later.
+	 */
+	core_if->hwcfg1.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg1);
+	core_if->hwcfg2.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
+	core_if->hwcfg3.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg3);
+	core_if->hwcfg4.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
+
+	/* Force host mode to get HPTXFSIZ exact power on value */
+	{
+		gusbcfg_data_t gusbcfg = {.d32 = 0 };
+		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+		gusbcfg.b.force_host_mode = 1;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
+		dwc_mdelay(100);
+		core_if->hptxfsiz.d32 =
+		DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
+		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+		if (cil_force_host)
+			gusbcfg.b.force_host_mode = 1;
+		else
+			gusbcfg.b.force_host_mode = 0;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
+		dwc_mdelay(100);
+	}
+
+	DWC_DEBUGPL(DBG_CILV, "hwcfg1=%08x\n", core_if->hwcfg1.d32);
+	DWC_DEBUGPL(DBG_CILV, "hwcfg2=%08x\n", core_if->hwcfg2.d32);
+	DWC_DEBUGPL(DBG_CILV, "hwcfg3=%08x\n", core_if->hwcfg3.d32);
+	DWC_DEBUGPL(DBG_CILV, "hwcfg4=%08x\n", core_if->hwcfg4.d32);
+
+	core_if->hcfg.d32 =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	core_if->dcfg.d32 =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+
+	DWC_DEBUGPL(DBG_CILV, "hcfg=%08x\n", core_if->hcfg.d32);
+	DWC_DEBUGPL(DBG_CILV, "dcfg=%08x\n", core_if->dcfg.d32);
+
+	DWC_DEBUGPL(DBG_CILV, "op_mode=%0x\n", core_if->hwcfg2.b.op_mode);
+	DWC_DEBUGPL(DBG_CILV, "arch=%0x\n", core_if->hwcfg2.b.architecture);
+	DWC_DEBUGPL(DBG_CILV, "num_dev_ep=%d\n", core_if->hwcfg2.b.num_dev_ep);
+	DWC_DEBUGPL(DBG_CILV, "num_host_chan=%d\n",
+		    core_if->hwcfg2.b.num_host_chan);
+	DWC_DEBUGPL(DBG_CILV, "nonperio_tx_q_depth=0x%0x\n",
+		    core_if->hwcfg2.b.nonperio_tx_q_depth);
+	DWC_DEBUGPL(DBG_CILV, "host_perio_tx_q_depth=0x%0x\n",
+		    core_if->hwcfg2.b.host_perio_tx_q_depth);
+	DWC_DEBUGPL(DBG_CILV, "dev_token_q_depth=0x%0x\n",
+		    core_if->hwcfg2.b.dev_token_q_depth);
+
+	DWC_DEBUGPL(DBG_CILV, "Total FIFO SZ=%d\n",
+		    core_if->hwcfg3.b.dfifo_depth);
+	DWC_DEBUGPL(DBG_CILV, "xfer_size_cntr_width=%0x\n",
+		    core_if->hwcfg3.b.xfer_size_cntr_width);
+
+	/*
+	 * Set the SRP sucess bit for FS-I2c
+	 */
+	core_if->srp_success = 0;
+	core_if->srp_timer_started = 0;
+
+	/*
+	 * Create new workqueue and init works
+	 */
+	core_if->wq_otg = DWC_WORKQ_ALLOC("dwc_otg");
+	if (core_if->wq_otg == 0) {
+		DWC_WARN("DWC_WORKQ_ALLOC failed\n");
+		DWC_FREE(host_if);
+		DWC_FREE(dev_if);
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	core_if->snpsid = DWC_READ_REG32(&core_if->core_global_regs->gsnpsid);
+
+	DWC_PRINTF("Core Release: %x.%x%x%x\n",
+		   (core_if->snpsid >> 12 & 0xF),
+		   (core_if->snpsid >> 8 & 0xF),
+		   (core_if->snpsid >> 4 & 0xF), (core_if->snpsid & 0xF));
+
+	core_if->wkp_timer = DWC_TIMER_ALLOC("Wake Up Timer",
+					     w_wakeup_detected, core_if);
+	if (core_if->wkp_timer == 0) {
+		DWC_WARN("DWC_TIMER_ALLOC failed\n");
+		DWC_FREE(host_if);
+		DWC_FREE(dev_if);
+		DWC_WORKQ_FREE(core_if->wq_otg);
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	if (dwc_otg_setup_params(core_if)) {
+		DWC_WARN("Error while setting core params\n");
+	}
+
+	core_if->hibernation_suspend = 0;
+
+	/** ADP initialization */
+	dwc_otg_adp_init(core_if);
+
+	return core_if;
+}
+
+/**
+ * This function frees the structures allocated by dwc_otg_cil_init().
+ *
+ * @param core_if The core interface pointer returned from
+ * 		  dwc_otg_cil_init().
+ *
+ */
+void dwc_otg_cil_remove(dwc_otg_core_if_t * core_if)
+{
+	dctl_data_t dctl = {.d32 = 0 };
+	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
+
+	/* Disable all interrupts */
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 1, 0);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
+
+	dctl.b.sftdiscon = 1;
+	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0,
+				 dctl.d32);
+	}
+
+	if (core_if->wq_otg) {
+		DWC_WORKQ_WAIT_WORK_DONE(core_if->wq_otg, 500);
+		DWC_WORKQ_FREE(core_if->wq_otg);
+	}
+	if (core_if->dev_if) {
+		DWC_FREE(core_if->dev_if);
+	}
+	if (core_if->host_if) {
+		DWC_FREE(core_if->host_if);
+	}
+
+	/** Remove ADP Stuff  */
+	dwc_otg_adp_remove(core_if);
+	if (core_if->core_params) {
+		DWC_FREE(core_if->core_params);
+	}
+	if (core_if->wkp_timer) {
+		DWC_TIMER_FREE(core_if->wkp_timer);
+	}
+	if (core_if->srp_timer) {
+		DWC_TIMER_FREE(core_if->srp_timer);
+	}
+	DWC_FREE(core_if);
+}
+
+/**
+ * This function enables the controller's Global Interrupt in the AHB Config
+ * register.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * core_if)
+{
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+	ahbcfg.b.glblintrmsk = 1;	/* Enable interrupts */
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 0, ahbcfg.d32);
+}
+
+/**
+ * This function disables the controller's Global Interrupt in the AHB Config
+ * register.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * core_if)
+{
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+	ahbcfg.b.glblintrmsk = 1;	/* Disable interrupts */
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
+}
+
+/**
+ * This function initializes the commmon interrupts, used in both
+ * device and host modes.
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ *
+ */
+static void dwc_otg_enable_common_interrupts(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	/* Clear any pending OTG Interrupts */
+	DWC_WRITE_REG32(&global_regs->gotgint, 0xFFFFFFFF);
+
+	/* Clear any pending interrupts */
+	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
+
+	/*
+	 * Enable the interrupts in the GINTMSK.
+	 */
+	intr_mask.b.modemismatch = 1;
+	intr_mask.b.otgintr = 1;
+
+	if (!core_if->dma_enable) {
+		intr_mask.b.rxstsqlvl = 1;
+	}
+
+	intr_mask.b.conidstschng = 1;
+	intr_mask.b.wkupintr = 1;
+	intr_mask.b.disconnect = 0;
+	intr_mask.b.usbsuspend = 1;
+	intr_mask.b.sessreqintr = 1;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	if (core_if->core_params->lpm_enable) {
+		intr_mask.b.lpmtranrcvd = 1;
+	}
+#endif
+	DWC_WRITE_REG32(&global_regs->gintmsk, intr_mask.d32);
+}
+
+/*
+ * The restore operation is modified to support Synopsys Emulated Powerdown and
+ * Hibernation. This function is for exiting from Device mode hibernation by
+ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
+ * @param core_if Programming view of DWC_otg controller.
+ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
+ * @param reset - indicates whether resume is initiated by Reset.
+ */
+int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
+				       int rem_wakeup, int reset)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+
+	int timeout = 2000;
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "%s called\n", __FUNCTION__);
+	/* Switch-on voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Assert Restore signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	if (rem_wakeup) {
+		dwc_udelay(70);
+	}
+
+	/* Deassert Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Mask interrupts from gpwrdn */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.connect_det_msk = 1;
+	gpwrdn.b.srp_det_msk = 1;
+	gpwrdn.b.disconn_det_msk = 1;
+	gpwrdn.b.rst_det_msk = 1;
+	gpwrdn.b.lnstchng_msk = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Indicates that we are going out from hibernation */
+	core_if->hibernation_suspend = 0;
+
+	/*
+	 * Set Restore Essential Regs bit in PCGCCTL register, restore_mode = 1
+	 * indicates restore from remote_wakeup
+	 */
+	restore_essential_regs(core_if, rem_wakeup, 0);
+
+	/*
+	 * Wait a little for seeing new value of variable hibernation_suspend if
+	 * Restore done interrupt received before polling
+	 */
+	dwc_udelay(10);
+
+	if (core_if->hibernation_suspend == 0) {
+		/*
+		 * Wait For Restore_done Interrupt. This mechanism of polling the
+		 * interrupt is introduced to avoid any possible race conditions
+		 */
+		do {
+			gintsts_data_t gintsts;
+			gintsts.d32 =
+			    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			if (gintsts.b.restoredone) {
+				gintsts.d32 = 0;
+				gintsts.b.restoredone = 1;
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+						gintsts, gintsts.d32);
+				DWC_PRINTF("Restore Done Interrupt seen\n");
+				break;
+			}
+			dwc_udelay(10);
+		} while (--timeout);
+		if (!timeout) {
+			DWC_PRINTF("Restore Done interrupt wasn't generated here\n");
+		}
+	}
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* De-assert Restore */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	if (!rem_wakeup) {
+		pcgcctl.d32 = 0;
+		pcgcctl.b.rstpdwnmodule = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+	}
+
+	/* Restore GUSBCFG and DCFG */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
+			core_if->gr_backup->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
+			core_if->dr_backup->dcfg);
+
+	/* De-assert Wakeup Logic */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	if (!rem_wakeup) {
+		/* Set Device programming done bit */
+		dctl.b.pwronprgdone = 1;
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+	} else {
+		/* Start Remote Wakeup Signaling */
+		dctl.d32 = core_if->dr_backup->dctl;
+		dctl.b.rmtwkupsig = 1;
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+	}
+
+	dwc_mdelay(2);
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Restore global registers */
+	dwc_otg_restore_global_regs(core_if);
+	/* Restore device global registers */
+	dwc_otg_restore_dev_regs(core_if, rem_wakeup);
+
+	if (rem_wakeup) {
+		dwc_mdelay(7);
+		dctl.d32 = 0;
+		dctl.b.rmtwkupsig = 1;
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
+	}
+
+	core_if->hibernation_suspend = 0;
+	/* The core will be in ON STATE */
+	core_if->lx_state = DWC_OTG_L0;
+	DWC_PRINTF("Hibernation recovery completes here\n");
+
+	return 1;
+}
+
+/*
+ * The restore operation is modified to support Synopsys Emulated Powerdown and
+ * Hibernation. This function is for exiting from Host mode hibernation by
+ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
+ * @param core_if Programming view of DWC_otg controller.
+ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
+ * @param reset - indicates whether resume is initiated by Reset.
+ */
+int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
+				     int rem_wakeup, int reset)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	hprt0_data_t hprt0 = {.d32 = 0 };
+
+	int timeout = 2000;
+
+	DWC_DEBUGPL(DBG_HCD, "%s called\n", __FUNCTION__);
+	/* Switch-on voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Assert Restore signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	if (!rem_wakeup) {
+		dwc_udelay(50);
+	}
+
+	/* Deassert Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	gpwrdn.d32 = 0;
+	gpwrdn.b.connect_det_msk = 1;
+	gpwrdn.b.srp_det_msk = 1;
+	gpwrdn.b.disconn_det_msk = 1;
+	gpwrdn.b.rst_det_msk = 1;
+	gpwrdn.b.lnstchng_msk = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Indicates that we are going out from hibernation */
+	core_if->hibernation_suspend = 0;
+
+	/* Set Restore Essential Regs bit in PCGCCTL register */
+	restore_essential_regs(core_if, rem_wakeup, 1);
+
+	/* Wait a little for seeing new value of variable hibernation_suspend if
+	 * Restore done interrupt received before polling */
+	dwc_udelay(10);
+
+	if (core_if->hibernation_suspend == 0) {
+		/* Wait For Restore_done Interrupt. This mechanism of polling the
+		 * interrupt is introduced to avoid any possible race conditions
+		 */
+		do {
+			gintsts_data_t gintsts;
+			gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			if (gintsts.b.restoredone) {
+				gintsts.d32 = 0;
+				gintsts.b.restoredone = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+				DWC_DEBUGPL(DBG_HCD,"Restore Done Interrupt seen\n");
+				break;
+			}
+			dwc_udelay(10);
+		} while (--timeout);
+		if (!timeout) {
+			DWC_WARN("Restore Done interrupt wasn't generated\n");
+		}
+	}
+
+	/* Set the flag's value to 0 again after receiving restore done interrupt */
+	core_if->hibernation_suspend = 0;
+
+	/* This step is not described in functional spec but if not wait for this
+	 * delay, mismatch interrupts occurred because just after restore core is
+	 * in Device mode(gintsts.curmode == 0) */
+	dwc_mdelay(100);
+
+	/* Clear all pending interrupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* De-assert Restore */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Restore GUSBCFG and HCFG */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
+			core_if->gr_backup->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
+			core_if->hr_backup->hcfg_local);
+
+	/* De-assert Wakeup Logic */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Start the Resume operation by programming HPRT0 */
+	hprt0.d32 = core_if->hr_backup->hprt0_local;
+	hprt0.b.prtpwr = 1;
+	hprt0.b.prtena = 0;
+	hprt0.b.prtsusp = 0;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+	DWC_PRINTF("Resume Starts Now\n");
+	if (!reset) {		// Indicates it is Resume Operation
+		hprt0.d32 = core_if->hr_backup->hprt0_local;
+		hprt0.b.prtres = 1;
+		hprt0.b.prtpwr = 1;
+		hprt0.b.prtena = 0;
+		hprt0.b.prtsusp = 0;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+		if (!rem_wakeup)
+			hprt0.b.prtres = 0;
+		/* Wait for Resume time and then program HPRT again */
+		dwc_mdelay(100);
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+	} else {		// Indicates it is Reset Operation
+		hprt0.d32 = core_if->hr_backup->hprt0_local;
+		hprt0.b.prtrst = 1;
+		hprt0.b.prtpwr = 1;
+		hprt0.b.prtena = 0;
+		hprt0.b.prtsusp = 0;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+		/* Wait for Reset time and then program HPRT again */
+		dwc_mdelay(60);
+		hprt0.b.prtrst = 0;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	}
+	/* Clear all interrupt status */
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtconndet = 1;
+	hprt0.b.prtenchng = 1;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Restore global registers */
+	dwc_otg_restore_global_regs(core_if);
+	/* Restore host global registers */
+	dwc_otg_restore_host_regs(core_if, reset);
+
+	/* The core will be in ON STATE */
+	core_if->lx_state = DWC_OTG_L0;
+	DWC_PRINTF("Hibernation recovery is complete here\n");
+	return 0;
+}
+
+/** Saves some register values into system memory. */
+int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+	int i;
+
+	gr = core_if->gr_backup;
+	if (!gr) {
+		gr = DWC_ALLOC(sizeof(*gr));
+		if (!gr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->gr_backup = gr;
+	}
+
+	gr->gotgctl_local = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+	gr->gahbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
+	gr->gusbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	gr->grxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+	gr->gnptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
+	gr->hptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	gr->glpmcfg_local = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+#endif
+	gr->gi2cctl_local = DWC_READ_REG32(&core_if->core_global_regs->gi2cctl);
+	gr->pcgcctl_local = DWC_READ_REG32(core_if->pcgcctl);
+	gr->gdfifocfg_local =
+	    DWC_READ_REG32(&core_if->core_global_regs->gdfifocfg);
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		gr->dtxfsiz_local[i] =
+		    DWC_READ_REG32(&(core_if->core_global_regs->dtxfsiz[i]));
+	}
+
+	DWC_DEBUGPL(DBG_ANY, "===========Backing Global registers==========\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up gotgctl   = %08x\n", gr->gotgctl_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gahbcfg   = %08x\n", gr->gahbcfg_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gusbcfg   = %08x\n", gr->gusbcfg_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up grxfsiz   = %08x\n", gr->grxfsiz_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gnptxfsiz = %08x\n",
+		    gr->gnptxfsiz_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up hptxfsiz  = %08x\n",
+		    gr->hptxfsiz_local);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	DWC_DEBUGPL(DBG_ANY, "Backed up glpmcfg   = %08x\n", gr->glpmcfg_local);
+#endif
+	DWC_DEBUGPL(DBG_ANY, "Backed up gi2cctl   = %08x\n", gr->gi2cctl_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up pcgcctl   = %08x\n", gr->pcgcctl_local);
+	DWC_DEBUGPL(DBG_ANY,"Backed up gdfifocfg   = %08x\n",gr->gdfifocfg_local);
+
+	return 0;
+}
+
+/** Saves GINTMSK register before setting the msk bits. */
+int dwc_otg_save_gintmsk_reg(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+
+	gr = core_if->gr_backup;
+	if (!gr) {
+		gr = DWC_ALLOC(sizeof(*gr));
+		if (!gr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->gr_backup = gr;
+	}
+
+	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+
+	DWC_DEBUGPL(DBG_ANY,"=============Backing GINTMSK registers============\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
+
+	return 0;
+}
+
+int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_dev_regs_backup *dr;
+	int i;
+
+	dr = core_if->dr_backup;
+	if (!dr) {
+		dr = DWC_ALLOC(sizeof(*dr));
+		if (!dr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->dr_backup = dr;
+	}
+
+	dr->dcfg = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+	dr->dctl = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	dr->daintmsk =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
+	dr->diepmsk =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->diepmsk);
+	dr->doepmsk =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->doepmsk);
+
+	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+		dr->diepctl[i] =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
+		dr->dieptsiz[i] =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz);
+		dr->diepdma[i] =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma);
+	}
+
+	DWC_DEBUGPL(DBG_ANY,
+		    "=============Backing Host registers==============\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up dcfg            = %08x\n", dr->dcfg);
+	DWC_DEBUGPL(DBG_ANY, "Backed up dctl        = %08x\n", dr->dctl);
+	DWC_DEBUGPL(DBG_ANY, "Backed up daintmsk            = %08x\n",
+		    dr->daintmsk);
+	DWC_DEBUGPL(DBG_ANY, "Backed up diepmsk        = %08x\n", dr->diepmsk);
+	DWC_DEBUGPL(DBG_ANY, "Backed up doepmsk        = %08x\n", dr->doepmsk);
+	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+		DWC_DEBUGPL(DBG_ANY, "Backed up diepctl[%d]        = %08x\n", i,
+			    dr->diepctl[i]);
+		DWC_DEBUGPL(DBG_ANY, "Backed up dieptsiz[%d]        = %08x\n",
+			    i, dr->dieptsiz[i]);
+		DWC_DEBUGPL(DBG_ANY, "Backed up diepdma[%d]        = %08x\n", i,
+			    dr->diepdma[i]);
+	}
+
+	return 0;
+}
+
+int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_host_regs_backup *hr;
+	int i;
+
+	hr = core_if->hr_backup;
+	if (!hr) {
+		hr = DWC_ALLOC(sizeof(*hr));
+		if (!hr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->hr_backup = hr;
+	}
+
+	hr->hcfg_local =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	hr->haintmsk_local =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
+	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
+		hr->hcintmsk_local[i] =
+		    DWC_READ_REG32(&core_if->host_if->hc_regs[i]->hcintmsk);
+	}
+	hr->hprt0_local = DWC_READ_REG32(core_if->host_if->hprt0);
+	hr->hfir_local =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
+
+	DWC_DEBUGPL(DBG_ANY,
+		    "=============Backing Host registers===============\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up hcfg		= %08x\n",
+		    hr->hcfg_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up haintmsk = %08x\n", hr->haintmsk_local);
+	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
+		DWC_DEBUGPL(DBG_ANY, "Backed up hcintmsk[%02d]=%08x\n", i,
+			    hr->hcintmsk_local[i]);
+	}
+	DWC_DEBUGPL(DBG_ANY, "Backed up hprt0           = %08x\n",
+		    hr->hprt0_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up hfir           = %08x\n",
+		    hr->hfir_local);
+
+	return 0;
+}
+
+int dwc_otg_restore_global_regs(dwc_otg_core_if_t *core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+	int i;
+
+	gr = core_if->gr_backup;
+	if (!gr) {
+		return -DWC_E_INVALID;
+	}
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, gr->gotgctl_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gr->gintmsk_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gr->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gr->gahbcfg_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, gr->grxfsiz_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz,
+			gr->gnptxfsiz_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->hptxfsiz,
+			gr->hptxfsiz_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gdfifocfg,
+			gr->gdfifocfg_local);
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		DWC_WRITE_REG32(&core_if->core_global_regs->dtxfsiz[i],
+				gr->dtxfsiz_local[i]);
+	}
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+	DWC_WRITE_REG32(core_if->host_if->hprt0, 0x0000100A);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg,
+			(gr->gahbcfg_local));
+	return 0;
+}
+
+int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if, int rem_wakeup)
+{
+	struct dwc_otg_dev_regs_backup *dr;
+	int i;
+
+	dr = core_if->dr_backup;
+
+	if (!dr) {
+		return -DWC_E_INVALID;
+	}
+
+	if (!rem_wakeup) {
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
+				dr->dctl);
+	}
+
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, dr->daintmsk);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, dr->diepmsk);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, dr->doepmsk);
+
+	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz, dr->dieptsiz[i]);
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma, dr->diepdma[i]);
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl, dr->diepctl[i]);
+	}
+
+	return 0;
+}
+
+int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset)
+{
+	struct dwc_otg_host_regs_backup *hr;
+	int i;
+	hr = core_if->hr_backup;
+
+	if (!hr) {
+		return -DWC_E_INVALID;
+	}
+
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hr->hcfg_local);
+	//if (!reset)
+	//{
+	//      DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hr->hfir_local);
+	//}
+
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk,
+			hr->haintmsk_local);
+	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
+		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk,
+				hr->hcintmsk_local[i]);
+	}
+
+	return 0;
+}
+
+int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+
+	gr = core_if->gr_backup;
+
+	/* Restore values for LPM and I2C */
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, gr->glpmcfg_local);
+#endif
+	DWC_WRITE_REG32(&core_if->core_global_regs->gi2cctl, gr->gi2cctl_local);
+
+	return 0;
+}
+
+int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode, int is_host)
+{
+	struct dwc_otg_global_regs_backup *gr;
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	gahbcfg_data_t gahbcfg = {.d32 = 0 };
+	gusbcfg_data_t gusbcfg = {.d32 = 0 };
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+	/* Restore LPM and I2C registers */
+	restore_lpm_i2c_regs(core_if);
+
+	/* Set PCGCCTL to 0 */
+	DWC_WRITE_REG32(core_if->pcgcctl, 0x00000000);
+
+	gr = core_if->gr_backup;
+	/* Load restore values for [31:14] bits */
+	DWC_WRITE_REG32(core_if->pcgcctl,
+			((gr->pcgcctl_local & 0xffffc000) | 0x00020000));
+
+	/* Umnask global Interrupt in GAHBCFG and restore it */
+	gahbcfg.d32 = gr->gahbcfg_local;
+	gahbcfg.b.glblintrmsk = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
+
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Unmask restore done interrupt */
+	gintmsk.b.restoredone = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
+
+	/* Restore GUSBCFG and HCFG/DCFG */
+	gusbcfg.d32 = core_if->gr_backup->gusbcfg_local;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
+
+	if (is_host) {
+		hcfg_data_t hcfg = {.d32 = 0 };
+		hcfg.d32 = core_if->hr_backup->hcfg_local;
+		DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
+				hcfg.d32);
+
+		/* Load restore values for [31:14] bits */
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
+
+		if (rmode)
+			pcgcctl.b.restoremode = 1;
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+		dwc_udelay(10);
+
+		/* Load restore values for [31:14] bits and set EssRegRestored bit */
+		pcgcctl.d32 = gr->pcgcctl_local | 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.b.ess_reg_restored = 1;
+		if (rmode)
+			pcgcctl.b.restoremode = 1;
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	} else {
+		dcfg_data_t dcfg = {.d32 = 0 };
+		dcfg.d32 = core_if->dr_backup->dcfg;
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+		/* Load restore values for [31:14] bits */
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
+		if (!rmode) {
+			pcgcctl.d32 |= 0x208;
+		}
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+		dwc_udelay(10);
+
+		/* Load restore values for [31:14] bits */
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
+		pcgcctl.b.ess_reg_restored = 1;
+		if (!rmode)
+			pcgcctl.d32 |= 0x208;
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	}
+
+	return 0;
+}
+
+/**
+ * Initializes the FSLSPClkSel field of the HCFG register depending on the PHY
+ * type.
+ */
+static void init_fslspclksel(dwc_otg_core_if_t * core_if)
+{
+	uint32_t val;
+	hcfg_data_t hcfg;
+
+	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	     (core_if->core_params->ulpi_fs_ls)) ||
+	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
+		/* Full speed PHY */
+		val = DWC_HCFG_48_MHZ;
+	} else {
+		/* High speed PHY running at full speed or high speed */
+		val = DWC_HCFG_30_60_MHZ;
+	}
+
+	DWC_DEBUGPL(DBG_CIL, "Initializing HCFG.FSLSPClkSel to 0x%1x\n", val);
+	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	hcfg.b.fslspclksel = val;
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+}
+
+/**
+ * Initializes the DevSpd field of the DCFG register depending on the PHY type
+ * and the enumeration speed of the device.
+ */
+static void init_devspd(dwc_otg_core_if_t * core_if)
+{
+	uint32_t val;
+	dcfg_data_t dcfg;
+
+	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	     (core_if->core_params->ulpi_fs_ls)) ||
+	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
+		/* Full speed PHY */
+		val = 0x3;
+	} else if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
+		/* High speed PHY running at full speed */
+		val = 0x1;
+	} else {
+		/* High speed PHY running at high speed */
+		val = 0x0;
+	}
+
+	DWC_DEBUGPL(DBG_CIL, "Initializing DCFG.DevSpd to 0x%1x\n", val);
+
+	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+	dcfg.b.devspd = val;
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
+}
+
+/**
+ * This function calculates the number of IN EPS
+ * using GHWCFG1 and GHWCFG2 registers values
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ */
+static uint32_t calc_num_in_eps(dwc_otg_core_if_t * core_if)
+{
+	uint32_t num_in_eps = 0;
+	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
+	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 3;
+	uint32_t num_tx_fifos = core_if->hwcfg4.b.num_in_eps;
+	int i;
+
+	for (i = 0; i < num_eps; ++i) {
+		if (!(hwcfg1 & 0x1))
+			num_in_eps++;
+
+		hwcfg1 >>= 2;
+	}
+
+	if (core_if->hwcfg4.b.ded_fifo_en) {
+		num_in_eps =
+		    (num_in_eps > num_tx_fifos) ? num_tx_fifos : num_in_eps;
+	}
+
+	return num_in_eps;
+}
+
+/**
+ * This function calculates the number of OUT EPS
+ * using GHWCFG1 and GHWCFG2 registers values
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ */
+static uint32_t calc_num_out_eps(dwc_otg_core_if_t * core_if)
+{
+	uint32_t num_out_eps = 0;
+	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
+	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 2;
+	int i;
+
+	for (i = 0; i < num_eps; ++i) {
+		if (!(hwcfg1 & 0x1))
+			num_out_eps++;
+
+		hwcfg1 >>= 2;
+	}
+	return num_out_eps;
+}
+
+/**
+ * This function initializes the DWC_otg controller registers and
+ * prepares the core for device mode or host mode operation.
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ *
+ */
+void dwc_otg_core_init(dwc_otg_core_if_t * core_if)
+{
+	int i = 0;
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+	gusbcfg_data_t usbcfg = {.d32 = 0 };
+	gi2cctl_data_t i2cctl = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CILV, "dwc_otg_core_init(%p) regs at %p\n",
+                    core_if, global_regs);
+
+	/* Common Initialization */
+	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+
+	/* Program the ULPI External VBUS bit if needed */
+	usbcfg.b.ulpi_ext_vbus_drv =
+	    (core_if->core_params->phy_ulpi_ext_vbus ==
+	     DWC_PHY_ULPI_EXTERNAL_VBUS) ? 1 : 0;
+
+	/* Set external TS Dline pulsing */
+	usbcfg.b.term_sel_dl_pulse =
+	    (core_if->core_params->ts_dline == 1) ? 1 : 0;
+	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+	/* Reset the Controller */
+	dwc_otg_core_reset(core_if);
+
+	core_if->adp_enable = core_if->core_params->adp_supp_enable;
+	core_if->power_down = core_if->core_params->power_down;
+	core_if->otg_sts = 0;
+
+	/* Initialize parameters from Hardware configuration registers. */
+	dev_if->num_in_eps = calc_num_in_eps(core_if);
+	dev_if->num_out_eps = calc_num_out_eps(core_if);
+
+	DWC_DEBUGPL(DBG_CIL, "num_dev_perio_in_ep=%d\n",
+		    core_if->hwcfg4.b.num_dev_perio_in_ep);
+
+	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
+		dev_if->perio_tx_fifo_size[i] =
+		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
+		DWC_DEBUGPL(DBG_CIL, "Periodic Tx FIFO SZ #%d=0x%0x\n",
+			    i, dev_if->perio_tx_fifo_size[i]);
+	}
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+		dev_if->tx_fifo_size[i] =
+		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
+		DWC_DEBUGPL(DBG_CIL, "Tx FIFO SZ #%d=0x%0x\n",
+			    i, dev_if->tx_fifo_size[i]);
+	}
+
+	core_if->total_fifo_size = core_if->hwcfg3.b.dfifo_depth;
+	core_if->rx_fifo_size = DWC_READ_REG32(&global_regs->grxfsiz);
+	core_if->nperio_tx_fifo_size =
+	    DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16;
+
+	DWC_DEBUGPL(DBG_CIL, "Total FIFO SZ=%d\n", core_if->total_fifo_size);
+	DWC_DEBUGPL(DBG_CIL, "Rx FIFO SZ=%d\n", core_if->rx_fifo_size);
+	DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO SZ=%d\n",
+		    core_if->nperio_tx_fifo_size);
+
+	/* This programming sequence needs to happen in FS mode before any other
+	 * programming occurs */
+	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) &&
+	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
+		/* If FS mode with FS PHY */
+
+		/* core_init() is now called on every switch so only call the
+		 * following for the first time through. */
+		if (!core_if->phy_init_done) {
+			core_if->phy_init_done = 1;
+			DWC_DEBUGPL(DBG_CIL, "FS_PHY detected\n");
+			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+			usbcfg.b.physel = 1;
+			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+			/* Reset after a PHY select */
+			dwc_otg_core_reset(core_if);
+		}
+
+		/* Program DCFG.DevSpd or HCFG.FSLSPclkSel to 48Mhz in FS.      Also
+		 * do this on HNP Dev/Host mode switches (done in dev_init and
+		 * host_init). */
+		if (dwc_otg_is_host_mode(core_if)) {
+			init_fslspclksel(core_if);
+		} else {
+			init_devspd(core_if);
+		}
+
+		if (core_if->core_params->i2c_enable) {
+			DWC_DEBUGPL(DBG_CIL, "FS_PHY Enabling I2c\n");
+			/* Program GUSBCFG.OtgUtmifsSel to I2C */
+			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+			usbcfg.b.otgutmifssel = 1;
+			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+			/* Program GI2CCTL.I2CEn */
+			i2cctl.d32 = DWC_READ_REG32(&global_regs->gi2cctl);
+			i2cctl.b.i2cdevaddr = 1;
+			i2cctl.b.i2cen = 0;
+			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
+			i2cctl.b.i2cen = 1;
+			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
+		}
+
+	} /* endif speed == DWC_SPEED_PARAM_FULL */
+	else {
+		/* High speed PHY. */
+		if (!core_if->phy_init_done) {
+			core_if->phy_init_done = 1;
+			/* HS PHY parameters.  These parameters are preserved
+			 * during soft reset so only program the first time.  Do
+			 * a soft reset immediately after setting phyif.  */
+
+			if (core_if->core_params->phy_type == 2) {
+				/* ULPI interface */
+				usbcfg.b.ulpi_utmi_sel = 1;
+				usbcfg.b.phyif = 0;
+				usbcfg.b.ddrsel =
+				    core_if->core_params->phy_ulpi_ddr;
+			} else if (core_if->core_params->phy_type == 1) {
+				/* UTMI+ interface */
+				usbcfg.b.ulpi_utmi_sel = 0;
+				if (core_if->core_params->phy_utmi_width == 16) {
+					usbcfg.b.phyif = 1;
+
+				} else {
+					usbcfg.b.phyif = 0;
+				}
+			} else {
+				DWC_ERROR("FS PHY TYPE\n");
+			}
+			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+			/* Reset after setting the PHY parameters */
+			dwc_otg_core_reset(core_if);
+		}
+	}
+
+	if ((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	    (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	    (core_if->core_params->ulpi_fs_ls)) {
+		DWC_DEBUGPL(DBG_CIL, "Setting ULPI FSLS\n");
+		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+		usbcfg.b.ulpi_fsls = 1;
+		usbcfg.b.ulpi_clk_sus_m = 1;
+		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+	} else {
+		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+		usbcfg.b.ulpi_fsls = 0;
+		usbcfg.b.ulpi_clk_sus_m = 0;
+		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+	}
+
+	/* Program the GAHBCFG Register. */
+	switch (core_if->hwcfg2.b.architecture) {
+
+	case DWC_SLAVE_ONLY_ARCH:
+		DWC_DEBUGPL(DBG_CIL, "Slave Only Mode\n");
+		ahbcfg.b.nptxfemplvl_txfemplvl =
+		    DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
+		ahbcfg.b.ptxfemplvl = DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
+		core_if->dma_enable = 0;
+		core_if->dma_desc_enable = 0;
+		break;
+
+	case DWC_EXT_DMA_ARCH:
+		DWC_DEBUGPL(DBG_CIL, "External DMA Mode\n");
+		{
+			uint8_t brst_sz = core_if->core_params->dma_burst_size;
+			ahbcfg.b.hburstlen = 0;
+			while (brst_sz > 1) {
+				ahbcfg.b.hburstlen++;
+				brst_sz >>= 1;
+			}
+		}
+		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
+		core_if->dma_desc_enable =
+		    (core_if->core_params->dma_desc_enable != 0);
+		break;
+
+	case DWC_INT_DMA_ARCH:
+		DWC_DEBUGPL(DBG_CIL, "Internal DMA Mode\n");
+		/* Old value was DWC_GAHBCFG_INT_DMA_BURST_INCR - done for
+		  Host mode ISOC in issue fix - vahrama */
+		/* Broadcom had altered to (1<<3)|(0<<0) - WRESP=1, max 4 beats */
+		ahbcfg.b.hburstlen = (1<<3)|(0<<0);//DWC_GAHBCFG_INT_DMA_BURST_INCR4;
+		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
+		core_if->dma_desc_enable =
+		    (core_if->core_params->dma_desc_enable != 0);
+		break;
+
+	}
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			DWC_PRINTF("Using Descriptor DMA mode\n");
+		} else {
+			DWC_PRINTF("Using Buffer DMA mode\n");
+
+		}
+	} else {
+		DWC_PRINTF("Using Slave mode\n");
+		core_if->dma_desc_enable = 0;
+	}
+
+	if (core_if->core_params->ahb_single) {
+		ahbcfg.b.ahbsingle = 1;
+	}
+
+	ahbcfg.b.dmaenable = core_if->dma_enable;
+	DWC_WRITE_REG32(&global_regs->gahbcfg, ahbcfg.d32);
+
+	core_if->en_multiple_tx_fifo = core_if->hwcfg4.b.ded_fifo_en;
+
+	core_if->pti_enh_enable = core_if->core_params->pti_enable != 0;
+	core_if->multiproc_int_enable = core_if->core_params->mpi_enable;
+	DWC_PRINTF("Periodic Transfer Interrupt Enhancement - %s\n",
+		   ((core_if->pti_enh_enable) ? "enabled" : "disabled"));
+	DWC_PRINTF("Multiprocessor Interrupt Enhancement - %s\n",
+		   ((core_if->multiproc_int_enable) ? "enabled" : "disabled"));
+
+	/*
+	 * Program the GUSBCFG register.
+	 */
+	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+
+	switch (core_if->hwcfg2.b.op_mode) {
+	case DWC_MODE_HNP_SRP_CAPABLE:
+		usbcfg.b.hnpcap = (core_if->core_params->otg_cap ==
+				   DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_SRP_ONLY_CAPABLE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_NO_HNP_SRP_CAPABLE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = 0;
+		break;
+
+	case DWC_MODE_SRP_CAPABLE_DEVICE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_NO_SRP_CAPABLE_DEVICE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = 0;
+		break;
+
+	case DWC_MODE_SRP_CAPABLE_HOST:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_NO_SRP_CAPABLE_HOST:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = 0;
+		break;
+	}
+
+	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	if (core_if->core_params->lpm_enable) {
+		glpmcfg_data_t lpmcfg = {.d32 = 0 };
+
+		/* To enable LPM support set lpm_cap_en bit */
+		lpmcfg.b.lpm_cap_en = 1;
+
+		/* Make AppL1Res ACK */
+		lpmcfg.b.appl_resp = 1;
+
+		/* Retry 3 times */
+		lpmcfg.b.retry_count = 3;
+
+		DWC_MODIFY_REG32(&core_if->core_global_regs->glpmcfg,
+				 0, lpmcfg.d32);
+
+	}
+#endif
+	if (core_if->core_params->ic_usb_cap) {
+		gusbcfg_data_t gusbcfg = {.d32 = 0 };
+		gusbcfg.b.ic_usb_cap = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gusbcfg,
+				 0, gusbcfg.d32);
+	}
+	{
+		gotgctl_data_t gotgctl = {.d32 = 0 };
+		gotgctl.b.otgver = core_if->core_params->otg_ver;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl, 0,
+				 gotgctl.d32);
+		/* Set OTG version supported */
+		core_if->otg_ver = core_if->core_params->otg_ver;
+		DWC_PRINTF("OTG VER PARAM: %d, OTG VER FLAG: %d\n",
+			   core_if->core_params->otg_ver, core_if->otg_ver);
+	}
+
+
+	/* Enable common interrupts */
+	dwc_otg_enable_common_interrupts(core_if);
+
+	/* Do device or host intialization based on mode during PCD
+	 * and HCD initialization  */
+	if (dwc_otg_is_host_mode(core_if)) {
+		DWC_DEBUGPL(DBG_ANY, "Host Mode\n");
+		core_if->op_state = A_HOST;
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "Device Mode\n");
+		core_if->op_state = B_PERIPHERAL;
+#ifdef DWC_DEVICE_ONLY
+		dwc_otg_core_dev_init(core_if);
+#endif
+	}
+}
+
+/**
+ * This function enables the Device mode interrupts.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * core_if)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+
+	DWC_DEBUGPL(DBG_CIL, "%s()\n", __func__);
+
+	/* Disable all interrupts. */
+	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+	/* Clear any pending interrupts */
+	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Enable the common interrupts */
+	dwc_otg_enable_common_interrupts(core_if);
+
+	/* Enable interrupts */
+	intr_mask.b.usbreset = 1;
+	intr_mask.b.enumdone = 1;
+	/* Disable Disconnect interrupt in Device mode */
+	intr_mask.b.disconnect = 0;
+
+	if (!core_if->multiproc_int_enable) {
+		intr_mask.b.inepintr = 1;
+		intr_mask.b.outepintr = 1;
+	}
+
+	intr_mask.b.erlysuspend = 1;
+
+	if (core_if->en_multiple_tx_fifo == 0) {
+		intr_mask.b.epmismatch = 1;
+	}
+
+	//intr_mask.b.incomplisoout = 1;
+	intr_mask.b.incomplisoin = 1;
+
+/* Enable the ignore frame number for ISOC xfers - MAS */
+/* Disable to support high bandwith ISOC transfers - manukz */
+#if 0
+#ifdef DWC_UTE_PER_IO
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			dctl_data_t dctl1 = {.d32 = 0 };
+			dctl1.b.ifrmnum = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, 0, dctl1.d32);
+			DWC_DEBUG("----Enabled Ignore frame number (0x%08x)",
+				  DWC_READ_REG32(&core_if->dev_if->
+						 dev_global_regs->dctl));
+		}
+	}
+#endif
+#endif
+#ifdef DWC_EN_ISOC
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable == 0) {
+			if (core_if->pti_enh_enable) {
+				dctl_data_t dctl = {.d32 = 0 };
+				dctl.b.ifrmnum = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 dev_if->dev_global_regs->dctl,
+						 0, dctl.d32);
+			} else {
+				intr_mask.b.incomplisoin = 1;
+				intr_mask.b.incomplisoout = 1;
+			}
+		}
+	} else {
+		intr_mask.b.incomplisoin = 1;
+		intr_mask.b.incomplisoout = 1;
+	}
+#endif /* DWC_EN_ISOC */
+
+	/** @todo NGS: Should this be a module parameter? */
+#ifdef USE_PERIODIC_EP
+	intr_mask.b.isooutdrop = 1;
+	intr_mask.b.eopframe = 1;
+	intr_mask.b.incomplisoin = 1;
+	intr_mask.b.incomplisoout = 1;
+#endif
+
+	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+
+	DWC_DEBUGPL(DBG_CIL, "%s() gintmsk=%0x\n", __func__,
+		    DWC_READ_REG32(&global_regs->gintmsk));
+}
+
+/**
+ * This function initializes the DWC_otg controller registers for
+ * device mode.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ */
+void dwc_otg_core_dev_init(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	dcfg_data_t dcfg = {.d32 = 0 };
+	depctl_data_t diepctl = {.d32 = 0 };
+	grstctl_t resetctl = {.d32 = 0 };
+	uint32_t rx_fifo_size;
+	fifosize_data_t nptxfifosize;
+	fifosize_data_t txfifosize;
+	dthrctl_data_t dthrctl;
+	fifosize_data_t ptxfifosize;
+	uint16_t rxfsiz, nptxfsiz;
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	hwcfg3_data_t hwcfg3 = {.d32 = 0 };
+
+	/* Restart the Phy Clock */
+	DWC_WRITE_REG32(core_if->pcgcctl, 0);
+
+	/* Device configuration register */
+	init_devspd(core_if);
+	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+	dcfg.b.descdma = (core_if->dma_desc_enable) ? 1 : 0;
+	dcfg.b.perfrint = DWC_DCFG_FRAME_INTERVAL_80;
+	/* Enable Device OUT NAK in case of DDMA mode*/
+	if (core_if->core_params->dev_out_nak) {
+		dcfg.b.endevoutnak = 1;
+	}
+
+	if (core_if->core_params->cont_on_bna) {
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.b.encontonbna = 1;
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
+	}
+
+
+	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+	/* Configure data FIFO sizes */
+	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
+		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
+			    core_if->total_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
+			    params->dev_rx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
+			    params->dev_nperio_tx_fifo_size);
+
+		/* Rx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+
+#ifdef DWC_UTE_CFI
+		core_if->pwron_rxfsiz = DWC_READ_REG32(&global_regs->grxfsiz);
+		core_if->init_rxfsiz = params->dev_rx_fifo_size;
+#endif
+		rx_fifo_size = params->dev_rx_fifo_size;
+		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
+
+		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+
+		/** Set Periodic Tx FIFO Mask all bits 0 */
+		core_if->p_tx_msk = 0;
+
+		/** Set Tx FIFO Mask all bits 0 */
+		core_if->tx_msk = 0;
+
+		if (core_if->en_multiple_tx_fifo == 0) {
+			/* Non-periodic Tx FIFO */
+			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
+			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
+
+			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
+					nptxfifosize.d32);
+
+			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+			/**@todo NGS: Fix Periodic FIFO Sizing! */
+			/*
+			 * Periodic Tx FIFOs These FIFOs are numbered from 1 to 15.
+			 * Indexes of the FIFO size module parameters in the
+			 * dev_perio_tx_fifo_size array and the FIFO size registers in
+			 * the dptxfsiz array run from 0 to 14.
+			 */
+			/** @todo Finish debug of this */
+			ptxfifosize.b.startaddr =
+			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
+			for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
+				ptxfifosize.b.depth =
+				    params->dev_perio_tx_fifo_size[i];
+				DWC_DEBUGPL(DBG_CIL,
+					    "initial dtxfsiz[%d]=%08x\n", i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+						ptxfifosize.d32);
+				DWC_DEBUGPL(DBG_CIL, "new dtxfsiz[%d]=%08x\n",
+					    i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+				ptxfifosize.b.startaddr += ptxfifosize.b.depth;
+			}
+		} else {
+			/*
+			 * Tx FIFOs These FIFOs are numbered from 1 to 15.
+			 * Indexes of the FIFO size module parameters in the
+			 * dev_tx_fifo_size array and the FIFO size registers in
+			 * the dtxfsiz array run from 0 to 14.
+			 */
+
+			/* Non-periodic Tx FIFO */
+			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+#ifdef DWC_UTE_CFI
+			core_if->pwron_gnptxfsiz =
+			    (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
+			core_if->init_gnptxfsiz =
+			    params->dev_nperio_tx_fifo_size;
+#endif
+			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
+			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
+
+			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
+					nptxfifosize.d32);
+
+			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+			txfifosize.b.startaddr =
+			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
+
+			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+
+				txfifosize.b.depth =
+				    params->dev_tx_fifo_size[i];
+
+				DWC_DEBUGPL(DBG_CIL,
+					    "initial dtxfsiz[%d]=%08x\n",
+					    i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+
+#ifdef DWC_UTE_CFI
+				core_if->pwron_txfsiz[i] =
+				    (DWC_READ_REG32
+				     (&global_regs->dtxfsiz[i]) >> 16);
+				core_if->init_txfsiz[i] =
+				    params->dev_tx_fifo_size[i];
+#endif
+				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+						txfifosize.d32);
+
+				DWC_DEBUGPL(DBG_CIL,
+					    "new dtxfsiz[%d]=%08x\n",
+					    i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+
+				txfifosize.b.startaddr += txfifosize.b.depth;
+			}
+			if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
+				/* Calculating DFIFOCFG for Device mode to include RxFIFO and NPTXFIFO */
+				gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
+				hwcfg3.d32 = DWC_READ_REG32(&global_regs->ghwcfg3);
+				gdfifocfg.b.gdfifocfg = (DWC_READ_REG32(&global_regs->ghwcfg3) >> 16);
+				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
+				rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
+				nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
+				gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz;
+				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
+			}
+		}
+
+		/* Flush the FIFOs */
+		dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
+		dwc_otg_flush_rx_fifo(core_if);
+
+		/* Flush the Learning Queue. */
+		resetctl.b.intknqflsh = 1;
+		DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
+
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
+			core_if->start_predict = 0;
+			for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
+				core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
+			}
+			core_if->nextep_seq[0] = 0;
+			core_if->first_in_nextep_seq = 0;
+			diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
+			diepctl.b.nextep = 0;
+			DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
+
+			/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
+			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+			dcfg.b.epmscnt = 2;
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+			DWC_DEBUGPL(DBG_CILV,"%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+				__func__, core_if->first_in_nextep_seq);
+			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+				DWC_DEBUGPL(DBG_CILV, "%2d ", core_if->nextep_seq[i]);
+			}
+			DWC_DEBUGPL(DBG_CILV,"\n");
+		}
+
+		/* Clear all pending Device Interrupts */
+		/** @todo - if the condition needed to be checked
+		 *  or in any case all pending interrutps should be cleared?
+	     */
+		if (core_if->multiproc_int_enable) {
+			for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+				DWC_WRITE_REG32(&dev_if->
+						dev_global_regs->diepeachintmsk[i], 0);
+			}
+		}
+
+		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
+			DWC_WRITE_REG32(&dev_if->
+					dev_global_regs->doepeachintmsk[i], 0);
+		}
+
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachint, 0xFFFFFFFF);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk, 0);
+	} else {
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, 0);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, 0);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->daint, 0xFFFFFFFF);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk, 0);
+	}
+
+	for (i = 0; i <= dev_if->num_in_eps; i++) {
+		depctl_data_t depctl;
+		depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+		if (depctl.b.epena) {
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			depctl.b.snak = 1;
+		} else {
+			depctl.d32 = 0;
+		}
+
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
+
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, 0);
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, 0);
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepint, 0xFF);
+	}
+
+	for (i = 0; i <= dev_if->num_out_eps; i++) {
+		depctl_data_t depctl;
+		depctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
+		if (depctl.b.epena) {
+			dctl_data_t dctl = {.d32 = 0 };
+			gintmsk_data_t gintsts = {.d32 = 0 };
+			doepint_data_t doepint = {.d32 = 0 };
+			dctl.b.sgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+			do {
+				dwc_udelay(10);
+				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			} while (!gintsts.b.goutnakeff);
+			gintsts.d32 = 0;
+			gintsts.b.goutnakeff = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			depctl.b.snak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepctl, depctl.d32);
+			do {
+				dwc_udelay(10);
+				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+					out_ep_regs[i]->doepint);
+			} while (!doepint.b.epdisabled);
+
+			doepint.b.epdisabled = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepint, doepint.d32);
+
+			dctl.d32 = 0;
+			dctl.b.cgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+		} else {
+			depctl.d32 = 0;
+		}
+
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, depctl.d32);
+
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doeptsiz, 0);
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepdma, 0);
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepint, 0xFF);
+	}
+
+	if (core_if->en_multiple_tx_fifo && core_if->dma_enable) {
+		dev_if->non_iso_tx_thr_en = params->thr_ctl & 0x1;
+		dev_if->iso_tx_thr_en = (params->thr_ctl >> 1) & 0x1;
+		dev_if->rx_thr_en = (params->thr_ctl >> 2) & 0x1;
+
+		dev_if->rx_thr_length = params->rx_thr_length;
+		dev_if->tx_thr_length = params->tx_thr_length;
+
+		dev_if->setup_desc_index = 0;
+
+		dthrctl.d32 = 0;
+		dthrctl.b.non_iso_thr_en = dev_if->non_iso_tx_thr_en;
+		dthrctl.b.iso_thr_en = dev_if->iso_tx_thr_en;
+		dthrctl.b.tx_thr_len = dev_if->tx_thr_length;
+		dthrctl.b.rx_thr_en = dev_if->rx_thr_en;
+		dthrctl.b.rx_thr_len = dev_if->rx_thr_length;
+		dthrctl.b.ahb_thr_ratio = params->ahb_thr_ratio;
+
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->dtknqr3_dthrctl,
+				dthrctl.d32);
+
+		DWC_DEBUGPL(DBG_CIL,
+			    "Non ISO Tx Thr - %d\nISO Tx Thr - %d\nRx Thr - %d\nTx Thr Len - %d\nRx Thr Len - %d\n",
+			    dthrctl.b.non_iso_thr_en, dthrctl.b.iso_thr_en,
+			    dthrctl.b.rx_thr_en, dthrctl.b.tx_thr_len,
+			    dthrctl.b.rx_thr_len);
+
+	}
+
+	dwc_otg_enable_device_interrupts(core_if);
+
+	{
+		diepmsk_data_t msk = {.d32 = 0 };
+		msk.b.txfifoundrn = 1;
+		if (core_if->multiproc_int_enable) {
+			DWC_MODIFY_REG32(&dev_if->dev_global_regs->
+					 diepeachintmsk[0], msk.d32, msk.d32);
+		} else {
+			DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk,
+					 msk.d32, msk.d32);
+		}
+	}
+
+	if (core_if->multiproc_int_enable) {
+		/* Set NAK on Babble */
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.b.nakonbble = 1;
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
+	}
+
+	if (core_if->snpsid >= OTG_CORE_REV_2_94a) {
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
+		dctl.b.sftdiscon = 0;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl, dctl.d32);
+	}
+}
+
+/**
+ * This function enables the Host mode interrupts.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CIL, "%s(%p)\n", __func__, core_if);
+
+	/* Disable all interrupts. */
+	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+	/* Clear any pending interrupts. */
+	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Enable the common interrupts */
+	dwc_otg_enable_common_interrupts(core_if);
+
+	/*
+	 * Enable host mode interrupts without disturbing common
+	 * interrupts.
+	 */
+
+	intr_mask.b.disconnect = 1;
+	intr_mask.b.portintr = 1;
+	intr_mask.b.hcintr = 1;
+
+	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+}
+
+/**
+ * This function disables the Host Mode interrupts.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CILV, "%s()\n", __func__);
+
+	/*
+	 * Disable host mode interrupts without disturbing common
+	 * interrupts.
+	 */
+	intr_mask.b.sofintr = 1;
+	intr_mask.b.portintr = 1;
+	intr_mask.b.hcintr = 1;
+	intr_mask.b.ptxfempty = 1;
+	intr_mask.b.nptxfempty = 1;
+
+	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, 0);
+}
+
+/**
+ * This function initializes the DWC_otg controller registers for
+ * host mode.
+ *
+ * This function flushes the Tx and Rx FIFOs and it flushes any entries in the
+ * request queues. Host channels are reset to ensure that they are ready for
+ * performing transfers.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ */
+void dwc_otg_core_host_init(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_host_if_t *host_if = core_if->host_if;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	hprt0_data_t hprt0 = {.d32 = 0 };
+	fifosize_data_t nptxfifosize;
+	fifosize_data_t ptxfifosize;
+	uint16_t rxfsiz, nptxfsiz, hptxfsiz;
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	int i;
+	hcchar_data_t hcchar;
+	hcfg_data_t hcfg;
+	hfir_data_t hfir;
+	dwc_otg_hc_regs_t *hc_regs;
+	int num_channels;
+	gotgctl_data_t gotgctl = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
+
+	/* Restart the Phy Clock */
+	DWC_WRITE_REG32(core_if->pcgcctl, 0);
+
+	/* Initialize Host Configuration Register */
+	init_fslspclksel(core_if);
+	if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
+		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
+		hcfg.b.fslssupp = 1;
+		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
+
+	}
+
+	/* This bit allows dynamic reloading of the HFIR register
+	 * during runtime. This bit needs to be programmed during
+	 * initial configuration and its value must not be changed
+	 * during runtime.*/
+	if (core_if->core_params->reload_ctl == 1) {
+		hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
+		hfir.b.hfirrldctrl = 1;
+		DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
+	}
+
+	if (core_if->core_params->dma_desc_enable) {
+		uint8_t op_mode = core_if->hwcfg2.b.op_mode;
+		if (!
+		    (core_if->hwcfg4.b.desc_dma
+		     && (core_if->snpsid >= OTG_CORE_REV_2_90a)
+		     && ((op_mode == DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
+			 || (op_mode ==
+			     DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG)
+			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)
+			 || (op_mode ==
+			     DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST)))) {
+
+			DWC_ERROR("Host can't operate in Descriptor DMA mode.\n"
+				  "Either core version is below 2.90a or "
+				  "GHWCFG2, GHWCFG4 registers' values do not allow Descriptor DMA in host mode.\n"
+				  "To run the driver in Buffer DMA host mode set dma_desc_enable "
+				  "module parameter to 0.\n");
+			return;
+		}
+		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
+		hcfg.b.descdma = 1;
+		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
+	}
+
+	/* Configure data FIFO sizes */
+	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
+		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
+			    core_if->total_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
+			    params->host_rx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
+			    params->host_nperio_tx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "P Tx FIFO Size=%d\n",
+			    params->host_perio_tx_fifo_size);
+
+		/* Rx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+		DWC_WRITE_REG32(&global_regs->grxfsiz,
+				params->host_rx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+
+		/* Non-periodic Tx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->gnptxfsiz));
+		nptxfifosize.b.depth = params->host_nperio_tx_fifo_size;
+		nptxfifosize.b.startaddr = params->host_rx_fifo_size;
+		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
+		DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+		/* Periodic Tx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial hptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->hptxfsiz));
+		ptxfifosize.b.depth = params->host_perio_tx_fifo_size;
+		ptxfifosize.b.startaddr =
+		    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
+		DWC_WRITE_REG32(&global_regs->hptxfsiz, ptxfifosize.d32);
+		DWC_DEBUGPL(DBG_CIL, "new hptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->hptxfsiz));
+
+		if (core_if->en_multiple_tx_fifo
+		    && core_if->snpsid <= OTG_CORE_REV_2_94a) {
+			/* Global DFIFOCFG calculation for Host mode - include RxFIFO, NPTXFIFO and HPTXFIFO */
+			gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
+			rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
+			nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
+			hptxfsiz = (DWC_READ_REG32(&global_regs->hptxfsiz) >> 16);
+			gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz + hptxfsiz;
+			DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
+		}
+	}
+
+	/* TODO - check this */
+	/* Clear Host Set HNP Enable in the OTG Control Register */
+	gotgctl.b.hstsethnpen = 1;
+	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+	/* Make sure the FIFOs are flushed. */
+	dwc_otg_flush_tx_fifo(core_if, 0x10 /* all TX FIFOs */ );
+	dwc_otg_flush_rx_fifo(core_if);
+
+	/* Clear Host Set HNP Enable in the OTG Control Register */
+	gotgctl.b.hstsethnpen = 1;
+	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+
+	if (!core_if->core_params->dma_desc_enable) {
+		/* Flush out any leftover queued requests. */
+		num_channels = core_if->core_params->host_channels;
+
+		for (i = 0; i < num_channels; i++) {
+			hc_regs = core_if->host_if->hc_regs[i];
+			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+			hcchar.b.chen = 0;
+			hcchar.b.chdis = 1;
+			hcchar.b.epdir = 0;
+			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		}
+
+		/* Halt all channels to put them into a known state. */
+		for (i = 0; i < num_channels; i++) {
+			int count = 0;
+			hc_regs = core_if->host_if->hc_regs[i];
+			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+			hcchar.b.chen = 1;
+			hcchar.b.chdis = 1;
+			hcchar.b.epdir = 0;
+			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+			DWC_DEBUGPL(DBG_HCDV, "%s: Halt channel %d regs %p\n", __func__, i, hc_regs);
+			do {
+				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+				if (++count > 1000) {
+					DWC_ERROR
+					    ("%s: Unable to clear halt on channel %d (timeout HCCHAR 0x%X @%p)\n",
+					     __func__, i, hcchar.d32, &hc_regs->hcchar);
+					break;
+				}
+				dwc_udelay(1);
+			} while (hcchar.b.chen);
+		}
+	}
+
+	/* Turn on the vbus power. */
+	DWC_PRINTF("Init: Port Power? op_state=%d\n", core_if->op_state);
+	if (core_if->op_state == A_HOST) {
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		DWC_PRINTF("Init: Power Port (%d)\n", hprt0.b.prtpwr);
+		if (hprt0.b.prtpwr == 0) {
+			hprt0.b.prtpwr = 1;
+			DWC_WRITE_REG32(host_if->hprt0, hprt0.d32);
+		}
+	}
+
+	dwc_otg_enable_host_interrupts(core_if);
+}
+
+/**
+ * Prepares a host channel for transferring packets to/from a specific
+ * endpoint. The HCCHARn register is set up with the characteristics specified
+ * in _hc. Host channel interrupts that may need to be serviced while this
+ * transfer is in progress are enabled.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ * @param hc Information needed to initialize the host channel
+ */
+void dwc_otg_hc_init(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	hcintmsk_data_t hc_intr_mask;
+	hcchar_data_t hcchar;
+	hcsplt_data_t hcsplt;
+
+	uint8_t hc_num = hc->hc_num;
+	dwc_otg_host_if_t *host_if = core_if->host_if;
+	dwc_otg_hc_regs_t *hc_regs = host_if->hc_regs[hc_num];
+
+	/* Clear old interrupt conditions for this host channel. */
+	hc_intr_mask.d32 = 0xFFFFFFFF;
+	hc_intr_mask.b.reserved14_31 = 0;
+	DWC_WRITE_REG32(&hc_regs->hcint, hc_intr_mask.d32);
+
+	/* Enable channel interrupts required for this transfer. */
+	hc_intr_mask.d32 = 0;
+	hc_intr_mask.b.chhltd = 1;
+	if (core_if->dma_enable) {
+		/* For Descriptor DMA mode core halts the channel on AHB error. Interrupt is not required */
+		if (!core_if->dma_desc_enable)
+			hc_intr_mask.b.ahberr = 1;
+		else {
+			if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+				hc_intr_mask.b.xfercompl = 1;
+		}
+
+		if (hc->error_state && !hc->do_split &&
+		    hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
+			hc_intr_mask.b.ack = 1;
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.datatglerr = 1;
+				if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
+					hc_intr_mask.b.nak = 1;
+				}
+			}
+		}
+	} else {
+		switch (hc->ep_type) {
+		case DWC_OTG_EP_TYPE_CONTROL:
+		case DWC_OTG_EP_TYPE_BULK:
+			hc_intr_mask.b.xfercompl = 1;
+			hc_intr_mask.b.stall = 1;
+			hc_intr_mask.b.xacterr = 1;
+			hc_intr_mask.b.datatglerr = 1;
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.bblerr = 1;
+			} else {
+				hc_intr_mask.b.nak = 1;
+				hc_intr_mask.b.nyet = 1;
+				if (hc->do_ping) {
+					hc_intr_mask.b.ack = 1;
+				}
+			}
+
+			if (hc->do_split) {
+				hc_intr_mask.b.nak = 1;
+				if (hc->complete_split) {
+					hc_intr_mask.b.nyet = 1;
+				} else {
+					hc_intr_mask.b.ack = 1;
+				}
+			}
+
+			if (hc->error_state) {
+				hc_intr_mask.b.ack = 1;
+			}
+			break;
+		case DWC_OTG_EP_TYPE_INTR:
+			hc_intr_mask.b.xfercompl = 1;
+			hc_intr_mask.b.nak = 1;
+			hc_intr_mask.b.stall = 1;
+			hc_intr_mask.b.xacterr = 1;
+			hc_intr_mask.b.datatglerr = 1;
+			hc_intr_mask.b.frmovrun = 1;
+
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.bblerr = 1;
+			}
+			if (hc->error_state) {
+				hc_intr_mask.b.ack = 1;
+			}
+			if (hc->do_split) {
+				if (hc->complete_split) {
+					hc_intr_mask.b.nyet = 1;
+				} else {
+					hc_intr_mask.b.ack = 1;
+				}
+			}
+			break;
+		case DWC_OTG_EP_TYPE_ISOC:
+			hc_intr_mask.b.xfercompl = 1;
+			hc_intr_mask.b.frmovrun = 1;
+			hc_intr_mask.b.ack = 1;
+
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.xacterr = 1;
+				hc_intr_mask.b.bblerr = 1;
+			}
+			break;
+		}
+	}
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, hc_intr_mask.d32);
+
+	/*
+	 * Program the HCCHARn register with the endpoint characteristics for
+	 * the current transfer.
+	 */
+	hcchar.d32 = 0;
+	hcchar.b.devaddr = hc->dev_addr;
+	hcchar.b.epnum = hc->ep_num;
+	hcchar.b.epdir = hc->ep_is_in;
+	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
+	hcchar.b.eptype = hc->ep_type;
+	hcchar.b.mps = hc->max_packet;
+
+	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcchar, hcchar.d32);
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d, Dev Addr %d, EP #%d\n",
+                    __func__, hc->hc_num, hcchar.b.devaddr, hcchar.b.epnum);
+	DWC_DEBUGPL(DBG_HCDV, "	 Is In %d, Is Low Speed %d, EP Type %d, "
+                                "Max Pkt %d, Multi Cnt %d\n",
+                    hcchar.b.epdir, hcchar.b.lspddev, hcchar.b.eptype,
+                    hcchar.b.mps, hcchar.b.multicnt);
+
+	/*
+	 * Program the HCSPLIT register for SPLITs
+	 */
+	hcsplt.d32 = 0;
+	if (hc->do_split) {
+		DWC_DEBUGPL(DBG_HCDV, "Programming HC %d with split --> %s\n",
+			    hc->hc_num,
+			    hc->complete_split ? "CSPLIT" : "SSPLIT");
+		hcsplt.b.compsplt = hc->complete_split;
+		hcsplt.b.xactpos = hc->xact_pos;
+		hcsplt.b.hubaddr = hc->hub_addr;
+		hcsplt.b.prtaddr = hc->port_addr;
+		DWC_DEBUGPL(DBG_HCDV, "\t  comp split %d\n", hc->complete_split);
+		DWC_DEBUGPL(DBG_HCDV, "\t  xact pos %d\n", hc->xact_pos);
+		DWC_DEBUGPL(DBG_HCDV, "\t  hub addr %d\n", hc->hub_addr);
+		DWC_DEBUGPL(DBG_HCDV, "\t  port addr %d\n", hc->port_addr);
+		DWC_DEBUGPL(DBG_HCDV, "\t  is_in %d\n", hc->ep_is_in);
+		DWC_DEBUGPL(DBG_HCDV, "\t  Max Pkt: %d\n", hcchar.b.mps);
+		DWC_DEBUGPL(DBG_HCDV, "\t  xferlen: %d\n", hc->xfer_len);
+	}
+	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcsplt, hcsplt.d32);
+
+}
+
+/**
+ * Attempts to halt a host channel. This function should only be called in
+ * Slave mode or to abort a transfer in either Slave mode or DMA mode. Under
+ * normal circumstances in DMA mode, the controller halts the channel when the
+ * transfer is complete or a condition occurs that requires application
+ * intervention.
+ *
+ * In slave mode, checks for a free request queue entry, then sets the Channel
+ * Enable and Channel Disable bits of the Host Channel Characteristics
+ * register of the specified channel to intiate the halt. If there is no free
+ * request queue entry, sets only the Channel Disable bit of the HCCHARn
+ * register to flush requests for this channel. In the latter case, sets a
+ * flag to indicate that the host channel needs to be halted when a request
+ * queue slot is open.
+ *
+ * In DMA mode, always sets the Channel Enable and Channel Disable bits of the
+ * HCCHARn register. The controller ensures there is space in the request
+ * queue before submitting the halt request.
+ *
+ * Some time may elapse before the core flushes any posted requests for this
+ * host channel and halts. The Channel Halted interrupt handler completes the
+ * deactivation of the host channel.
+ *
+ * @param core_if Controller register interface.
+ * @param hc Host channel to halt.
+ * @param halt_status Reason for halting the channel.
+ */
+void dwc_otg_hc_halt(dwc_otg_core_if_t * core_if,
+		     dwc_hc_t * hc, dwc_otg_halt_status_e halt_status)
+{
+	gnptxsts_data_t nptxsts;
+	hptxsts_data_t hptxsts;
+	hcchar_data_t hcchar;
+	dwc_otg_hc_regs_t *hc_regs;
+	dwc_otg_core_global_regs_t *global_regs;
+	dwc_otg_host_global_regs_t *host_global_regs;
+
+	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+	global_regs = core_if->core_global_regs;
+	host_global_regs = core_if->host_if->host_global_regs;
+
+	DWC_ASSERT(!(halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS),
+		   "halt_status = %d\n", halt_status);
+
+	if (halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
+	    halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
+		/*
+		 * Disable all channel interrupts except Ch Halted. The QTD
+		 * and QH state associated with this transfer has been cleared
+		 * (in the case of URB_DEQUEUE), so the channel needs to be
+		 * shut down carefully to prevent crashes.
+		 */
+		hcintmsk_data_t hcintmsk;
+		hcintmsk.d32 = 0;
+		hcintmsk.b.chhltd = 1;
+		DWC_WRITE_REG32(&hc_regs->hcintmsk, hcintmsk.d32);
+
+		/*
+		 * Make sure no other interrupts besides halt are currently
+		 * pending. Handling another interrupt could cause a crash due
+		 * to the QTD and QH state.
+		 */
+		DWC_WRITE_REG32(&hc_regs->hcint, ~hcintmsk.d32);
+
+		/*
+		 * Make sure the halt status is set to URB_DEQUEUE or AHB_ERR
+		 * even if the channel was already halted for some other
+		 * reason.
+		 */
+		hc->halt_status = halt_status;
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		if (hcchar.b.chen == 0) {
+			/*
+			 * The channel is either already halted or it hasn't
+			 * started yet. In DMA mode, the transfer may halt if
+			 * it finishes normally or a condition occurs that
+			 * requires driver intervention. Don't want to halt
+			 * the channel again. In either Slave or DMA mode,
+			 * it's possible that the transfer has been assigned
+			 * to a channel, but not started yet when an URB is
+			 * dequeued. Don't want to halt a channel that hasn't
+			 * started yet.
+			 */
+			return;
+		}
+	}
+	if (hc->halt_pending) {
+		/*
+		 * A halt has already been issued for this channel. This might
+		 * happen when a transfer is aborted by a higher level in
+		 * the stack.
+		 */
+#ifdef DEBUG
+		DWC_PRINTF
+		    ("*** %s: Channel %d, _hc->halt_pending already set ***\n",
+		     __func__, hc->hc_num);
+
+#endif
+		return;
+	}
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* No need to set the bit in DDMA for disabling the channel */
+	//TODO check it everywhere channel is disabled
+	if (!core_if->core_params->dma_desc_enable)
+		hcchar.b.chen = 1;
+	hcchar.b.chdis = 1;
+
+	if (!core_if->dma_enable) {
+		/* Check for space in the request queue to issue the halt. */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
+			nptxsts.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+			if (nptxsts.b.nptxqspcavail == 0) {
+				hcchar.b.chen = 0;
+			}
+		} else {
+			hptxsts.d32 =
+			    DWC_READ_REG32(&host_global_regs->hptxsts);
+			if ((hptxsts.b.ptxqspcavail == 0)
+			    || (core_if->queuing_high_bandwidth)) {
+				hcchar.b.chen = 0;
+			}
+		}
+	}
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	hc->halt_status = halt_status;
+
+	if (hcchar.b.chen) {
+		hc->halt_pending = 1;
+		hc->halt_on_queue = 0;
+	} else {
+		hc->halt_on_queue = 1;
+	}
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+	DWC_DEBUGPL(DBG_HCDV, "	 hcchar: 0x%08x\n", hcchar.d32);
+	DWC_DEBUGPL(DBG_HCDV, "	 halt_pending: %d\n", hc->halt_pending);
+	DWC_DEBUGPL(DBG_HCDV, "	 halt_on_queue: %d\n", hc->halt_on_queue);
+	DWC_DEBUGPL(DBG_HCDV, "	 halt_status: %d\n", hc->halt_status);
+
+	return;
+}
+
+/**
+ * Clears the transfer state for a host channel. This function is normally
+ * called after a transfer is done and the host channel is being released.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Identifies the host channel to clean up.
+ */
+void dwc_otg_hc_cleanup(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	dwc_otg_hc_regs_t *hc_regs;
+
+	hc->xfer_started = 0;
+
+	/*
+	 * Clear channel interrupt enables and any unhandled channel interrupt
+	 * conditions.
+	 */
+	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0);
+	DWC_WRITE_REG32(&hc_regs->hcint, 0xFFFFFFFF);
+#ifdef DEBUG
+	DWC_TIMER_CANCEL(core_if->hc_xfer_timer[hc->hc_num]);
+#endif
+}
+
+/**
+ * Sets the channel property that indicates in which frame a periodic transfer
+ * should occur. This is always set to the _next_ frame. This function has no
+ * effect on non-periodic transfers.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Identifies the host channel to set up and its properties.
+ * @param hcchar Current value of the HCCHAR register for the specified host
+ * channel.
+ */
+static inline void hc_set_even_odd_frame(dwc_otg_core_if_t * core_if,
+					 dwc_hc_t * hc, hcchar_data_t * hcchar)
+{
+	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+		hfnum_data_t hfnum;
+		hfnum.d32 =
+		    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfnum);
+
+		/* 1 if _next_ frame is odd, 0 if it's even */
+		hcchar->b.oddfrm = (hfnum.b.frnum & 0x1) ? 0 : 1;
+#ifdef DEBUG
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR && hc->do_split
+		    && !hc->complete_split) {
+			switch (hfnum.b.frnum & 0x7) {
+			case 7:
+				core_if->hfnum_7_samples++;
+				core_if->hfnum_7_frrem_accum += hfnum.b.frrem;
+				break;
+			case 0:
+				core_if->hfnum_0_samples++;
+				core_if->hfnum_0_frrem_accum += hfnum.b.frrem;
+				break;
+			default:
+				core_if->hfnum_other_samples++;
+				core_if->hfnum_other_frrem_accum +=
+				    hfnum.b.frrem;
+				break;
+			}
+		}
+#endif
+	}
+}
+
+#ifdef DEBUG
+void hc_xfer_timeout(void *ptr)
+{
+	hc_xfer_info_t *xfer_info = NULL;
+	int hc_num = 0;
+
+	if (ptr)
+		xfer_info = (hc_xfer_info_t *) ptr;
+
+	if (!xfer_info->hc) {
+		DWC_ERROR("xfer_info->hc = %p\n", xfer_info->hc);
+		return;
+	}
+
+	hc_num = xfer_info->hc->hc_num;
+	DWC_WARN("%s: timeout on channel %d\n", __func__, hc_num);
+	DWC_WARN("	start_hcchar_val 0x%08x\n",
+		 xfer_info->core_if->start_hcchar_val[hc_num]);
+}
+#endif
+
+void ep_xfer_timeout(void *ptr)
+{
+	ep_xfer_info_t *xfer_info = NULL;
+	int ep_num = 0;
+	dctl_data_t dctl = {.d32 = 0 };
+	gintsts_data_t gintsts = {.d32 = 0 };
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+	if (ptr)
+		xfer_info = (ep_xfer_info_t *) ptr;
+
+	if (!xfer_info->ep) {
+		DWC_ERROR("xfer_info->ep = %p\n", xfer_info->ep);
+		return;
+	}
+
+	ep_num = xfer_info->ep->num;
+	DWC_WARN("%s: timeout on endpoit %d\n", __func__, ep_num);
+	/* Put the sate to 2 as it was time outed */
+	xfer_info->state = 2;
+
+	dctl.d32 =
+	    DWC_READ_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl);
+	gintsts.d32 =
+	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintsts);
+	gintmsk.d32 =
+	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintmsk);
+
+	if (!gintmsk.b.goutnakeff) {
+		/* Unmask it */
+		gintmsk.b.goutnakeff = 1;
+		DWC_WRITE_REG32(&xfer_info->core_if->core_global_regs->gintmsk,
+				gintmsk.d32);
+
+	}
+
+	if (!gintsts.b.goutnakeff) {
+		dctl.b.sgoutnak = 1;
+	}
+	DWC_WRITE_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl,
+			dctl.d32);
+
+}
+
+void set_pid_isoc(dwc_hc_t * hc)
+{
+	/* Set up the initial PID for the transfer. */
+	if (hc->speed == DWC_OTG_EP_SPEED_HIGH) {
+		if (hc->ep_is_in) {
+			if (hc->multi_count == 1) {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
+			} else if (hc->multi_count == 2) {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
+			} else {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA2;
+			}
+		} else {
+			if (hc->multi_count == 1) {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
+			} else {
+				hc->data_pid_start = DWC_OTG_HC_PID_MDATA;
+			}
+		}
+	} else {
+		hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
+	}
+}
+
+/**
+ * This function does the setup for a data transfer for a host channel and
+ * starts the transfer. May be called in either Slave mode or DMA mode. In
+ * Slave mode, the caller must ensure that there is sufficient space in the
+ * request queue and Tx Data FIFO.
+ *
+ * For an OUT transfer in Slave mode, it loads a data packet into the
+ * appropriate FIFO. If necessary, additional data packets will be loaded in
+ * the Host ISR.
+ *
+ * For an IN transfer in Slave mode, a data packet is requested. The data
+ * packets are unloaded from the Rx FIFO in the Host ISR. If necessary,
+ * additional data packets are requested in the Host ISR.
+ *
+ * For a PING transfer in Slave mode, the Do Ping bit is set in the HCTSIZ
+ * register along with a packet count of 1 and the channel is enabled. This
+ * causes a single PING transaction to occur. Other fields in HCTSIZ are
+ * simply set to 0 since no data transfer occurs in this case.
+ *
+ * For a PING transfer in DMA mode, the HCTSIZ register is initialized with
+ * all the information required to perform the subsequent data transfer. In
+ * addition, the Do Ping bit is set in the HCTSIZ register. In this case, the
+ * controller performs the entire PING protocol, then starts the data
+ * transfer.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Information needed to initialize the host channel. The xfer_len
+ * value may be reduced to accommodate the max widths of the XferSize and
+ * PktCnt fields in the HCTSIZn register. The multi_count value may be changed
+ * to reflect the final xfer_len value.
+ */
+void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	uint16_t num_packets;
+	uint32_t max_hc_xfer_size = core_if->core_params->max_transfer_size;
+	uint16_t max_hc_pkt_count = core_if->core_params->max_packet_count;
+	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+
+	hctsiz.d32 = 0;
+
+	if (hc->do_ping) {
+		if (!core_if->dma_enable) {
+			dwc_otg_hc_do_ping(core_if, hc);
+			hc->xfer_started = 1;
+			return;
+		} else {
+			hctsiz.b.dopng = 1;
+		}
+	}
+
+	if (hc->do_split) {
+		num_packets = 1;
+
+		if (hc->complete_split && !hc->ep_is_in) {
+			/* For CSPLIT OUT Transfer, set the size to 0 so the
+			 * core doesn't expect any data written to the FIFO */
+			hc->xfer_len = 0;
+		} else if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
+			hc->xfer_len = hc->max_packet;
+		} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
+			hc->xfer_len = 188;
+		}
+
+		hctsiz.b.xfersize = hc->xfer_len;
+	} else {
+		/*
+		 * Ensure that the transfer length and packet count will fit
+		 * in the widths allocated for them in the HCTSIZn register.
+		 */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+			/*
+			 * Make sure the transfer size is no larger than one
+			 * (micro)frame's worth of data. (A check was done
+			 * when the periodic transfer was accepted to ensure
+			 * that a (micro)frame's worth of data can be
+			 * programmed into a channel.)
+			 */
+			uint32_t max_periodic_len =
+			    hc->multi_count * hc->max_packet;
+			if (hc->xfer_len > max_periodic_len) {
+				hc->xfer_len = max_periodic_len;
+			} else {
+			}
+		} else if (hc->xfer_len > max_hc_xfer_size) {
+			/* Make sure that xfer_len is a multiple of max packet size. */
+			hc->xfer_len = max_hc_xfer_size - hc->max_packet + 1;
+		}
+
+		if (hc->xfer_len > 0) {
+			num_packets =
+			    (hc->xfer_len + hc->max_packet -
+			     1) / hc->max_packet;
+			if (num_packets > max_hc_pkt_count) {
+				num_packets = max_hc_pkt_count;
+				hc->xfer_len = num_packets * hc->max_packet;
+			}
+		} else {
+			/* Need 1 packet for transfer length of 0. */
+			num_packets = 1;
+		}
+
+		if (hc->ep_is_in) {
+			/* Always program an integral # of max packets for IN transfers. */
+			hc->xfer_len = num_packets * hc->max_packet;
+		}
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+			/*
+			 * Make sure that the multi_count field matches the
+			 * actual transfer length.
+			 */
+			hc->multi_count = num_packets;
+		}
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+			set_pid_isoc(hc);
+
+		hctsiz.b.xfersize = hc->xfer_len;
+	}
+
+	hc->start_pkt_count = num_packets;
+	hctsiz.b.pktcnt = num_packets;
+	hctsiz.b.pid = hc->data_pid_start;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+	DWC_DEBUGPL(DBG_HCDV, "	 Xfer Size: %d\n", hctsiz.b.xfersize);
+	DWC_DEBUGPL(DBG_HCDV, "	 Num Pkts: %d\n", hctsiz.b.pktcnt);
+	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
+
+	if (core_if->dma_enable) {
+		dwc_dma_t dma_addr;
+		if (hc->align_buff) {
+			dma_addr = hc->align_buff;
+		} else {
+			dma_addr = ((unsigned long)hc->xfer_buff & 0xffffffff);
+		}
+		DWC_WRITE_REG32(&hc_regs->hcdma, dma_addr);
+	}
+
+	/* Start the split */
+	if (hc->do_split) {
+		hcsplt_data_t hcsplt;
+		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+		hcsplt.b.spltena = 1;
+		DWC_WRITE_REG32(&hc_regs->hcsplt, hcsplt.d32);
+	}
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.multicnt = hc->multi_count;
+	hc_set_even_odd_frame(core_if, hc, &hcchar);
+#ifdef DEBUG
+	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
+	if (hcchar.b.chdis) {
+		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
+			 __func__, hc->hc_num, hcchar.d32);
+	}
+#endif
+
+	/* Set host channel enable after all other setup is complete. */
+	hcchar.b.chen = 1;
+	hcchar.b.chdis = 0;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	hc->xfer_started = 1;
+	hc->requests++;
+
+	if (!core_if->dma_enable && !hc->ep_is_in && hc->xfer_len > 0) {
+		/* Load OUT packet into the appropriate Tx FIFO. */
+		dwc_otg_hc_write_packet(core_if, hc);
+	}
+#ifdef DEBUG
+	if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
+                DWC_DEBUGPL(DBG_HCDV, "transfer %d from core_if %p\n",
+                            hc->hc_num, core_if);//GRAYG
+		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
+		core_if->hc_xfer_info[hc->hc_num].hc = hc;
+
+		/* Start a timer for this transfer. */
+		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
+	}
+#endif
+}
+
+/**
+ * This function does the setup for a data transfer for a host channel
+ * and starts the transfer in Descriptor DMA mode.
+ *
+ * Initializes HCTSIZ register. For a PING transfer the Do Ping bit is set.
+ * Sets PID and NTD values. For periodic transfers
+ * initializes SCHED_INFO field with micro-frame bitmap.
+ *
+ * Initializes HCDMA register with descriptor list address and CTD value
+ * then starts the transfer via enabling the channel.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Information needed to initialize the host channel.
+ */
+void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	hcdma_data_t hcdma;
+
+	hctsiz.d32 = 0;
+
+	if (hc->do_ping)
+		hctsiz.b_ddma.dopng = 1;
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+		set_pid_isoc(hc);
+
+	/* Packet Count and Xfer Size are not used in Descriptor DMA mode */
+	hctsiz.b_ddma.pid = hc->data_pid_start;
+	hctsiz.b_ddma.ntd = hc->ntd - 1;	/* 0 - 1 descriptor, 1 - 2 descriptors, etc. */
+	hctsiz.b_ddma.schinfo = hc->schinfo;	/* Non-zero only for high-speed interrupt endpoints */
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
+	DWC_DEBUGPL(DBG_HCDV, "	 NTD: %d\n", hctsiz.b_ddma.ntd);
+
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	hcdma.d32 = 0;
+	hcdma.b.dma_addr = ((uint32_t) hc->desc_list_addr) >> 11;
+
+	/* Always start from first descriptor. */
+	hcdma.b.ctd = 0;
+	DWC_WRITE_REG32(&hc_regs->hcdma, hcdma.d32);
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.multicnt = hc->multi_count;
+
+#ifdef DEBUG
+	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
+	if (hcchar.b.chdis) {
+		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
+			 __func__, hc->hc_num, hcchar.d32);
+	}
+#endif
+
+	/* Set host channel enable after all other setup is complete. */
+	hcchar.b.chen = 1;
+	hcchar.b.chdis = 0;
+
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	hc->xfer_started = 1;
+	hc->requests++;
+
+#ifdef DEBUG
+	if ((hc->ep_type != DWC_OTG_EP_TYPE_INTR)
+	    && (hc->ep_type != DWC_OTG_EP_TYPE_ISOC)) {
+                DWC_DEBUGPL(DBG_HCDV, "DMA transfer %d from core_if %p\n",
+                            hc->hc_num, core_if);//GRAYG
+		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
+		core_if->hc_xfer_info[hc->hc_num].hc = hc;
+		/* Start a timer for this transfer. */
+		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
+	}
+#endif
+
+}
+
+/**
+ * This function continues a data transfer that was started by previous call
+ * to <code>dwc_otg_hc_start_transfer</code>. The caller must ensure there is
+ * sufficient space in the request queue and Tx Data FIFO. This function
+ * should only be called in Slave mode. In DMA mode, the controller acts
+ * autonomously to complete transfers programmed to a host channel.
+ *
+ * For an OUT transfer, a new data packet is loaded into the appropriate FIFO
+ * if there is any data remaining to be queued. For an IN transfer, another
+ * data packet is always requested. For the SETUP phase of a control transfer,
+ * this function does nothing.
+ *
+ * @return 1 if a new request is queued, 0 if no more requests are required
+ * for this transfer.
+ */
+int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+
+	if (hc->do_split) {
+		/* SPLITs always queue just once per channel */
+		return 0;
+	} else if (hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
+		/* SETUPs are queued only once since they can't be NAKed. */
+		return 0;
+	} else if (hc->ep_is_in) {
+		/*
+		 * Always queue another request for other IN transfers. If
+		 * back-to-back INs are issued and NAKs are received for both,
+		 * the driver may still be processing the first NAK when the
+		 * second NAK is received. When the interrupt handler clears
+		 * the NAK interrupt for the first NAK, the second NAK will
+		 * not be seen. So we can't depend on the NAK interrupt
+		 * handler to requeue a NAKed request. Instead, IN requests
+		 * are issued each time this function is called. When the
+		 * transfer completes, the extra requests for the channel will
+		 * be flushed.
+		 */
+		hcchar_data_t hcchar;
+		dwc_otg_hc_regs_t *hc_regs =
+		    core_if->host_if->hc_regs[hc->hc_num];
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		hc_set_even_odd_frame(core_if, hc, &hcchar);
+		hcchar.b.chen = 1;
+		hcchar.b.chdis = 0;
+		DWC_DEBUGPL(DBG_HCDV, "	 IN xfer: hcchar = 0x%08x\n",
+			    hcchar.d32);
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		hc->requests++;
+		return 1;
+	} else {
+		/* OUT transfers. */
+		if (hc->xfer_count < hc->xfer_len) {
+			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+				hcchar_data_t hcchar;
+				dwc_otg_hc_regs_t *hc_regs;
+				hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+				hc_set_even_odd_frame(core_if, hc, &hcchar);
+			}
+
+			/* Load OUT packet into the appropriate Tx FIFO. */
+			dwc_otg_hc_write_packet(core_if, hc);
+			hc->requests++;
+			return 1;
+		} else {
+			return 0;
+		}
+	}
+}
+
+/**
+ * Starts a PING transfer. This function should only be called in Slave mode.
+ * The Do Ping bit is set in the HCTSIZ register, then the channel is enabled.
+ */
+void dwc_otg_hc_do_ping(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+
+	hctsiz.d32 = 0;
+	hctsiz.b.dopng = 1;
+	hctsiz.b.pktcnt = 1;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.chen = 1;
+	hcchar.b.chdis = 0;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+}
+
+/*
+ * This function writes a packet into the Tx FIFO associated with the Host
+ * Channel. For a channel associated with a non-periodic EP, the non-periodic
+ * Tx FIFO is written. For a channel associated with a periodic EP, the
+ * periodic Tx FIFO is written. This function should only be called in Slave
+ * mode.
+ *
+ * Upon return the xfer_buff and xfer_count fields in _hc are incremented by
+ * then number of bytes written to the Tx FIFO.
+ */
+void dwc_otg_hc_write_packet(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	uint32_t i;
+	uint32_t remaining_count;
+	uint32_t byte_count;
+	uint32_t dword_count;
+
+	uint32_t *data_buff = (uint32_t *) (hc->xfer_buff);
+	uint32_t *data_fifo = core_if->data_fifo[hc->hc_num];
+
+	remaining_count = hc->xfer_len - hc->xfer_count;
+	if (remaining_count > hc->max_packet) {
+		byte_count = hc->max_packet;
+	} else {
+		byte_count = remaining_count;
+	}
+
+	dword_count = (byte_count + 3) / 4;
+
+	if ((((unsigned long)data_buff) & 0x3) == 0) {
+		/* xfer_buff is DWORD aligned. */
+		for (i = 0; i < dword_count; i++, data_buff++) {
+			DWC_WRITE_REG32(data_fifo, *data_buff);
+		}
+	} else {
+		/* xfer_buff is not DWORD aligned. */
+		for (i = 0; i < dword_count; i++, data_buff++) {
+			uint32_t data;
+			data =
+			    (data_buff[0] | data_buff[1] << 8 | data_buff[2] <<
+			     16 | data_buff[3] << 24);
+			DWC_WRITE_REG32(data_fifo, data);
+		}
+	}
+
+	hc->xfer_count += byte_count;
+	hc->xfer_buff += byte_count;
+}
+
+/**
+ * Gets the current USB frame number. This is the frame number from the last
+ * SOF packet.
+ */
+uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	/* read current frame/microframe number from DSTS register */
+	return dsts.b.soffn;
+}
+
+/**
+ * Calculates and gets the frame Interval value of HFIR register according PHY
+ * type and speed.The application can modify a value of HFIR register only after
+ * the Port Enable bit of the Host Port Control and Status register
+ * (HPRT.PrtEnaPort) has been set.
+*/
+
+uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if)
+{
+	gusbcfg_data_t usbcfg;
+	hwcfg2_data_t hwcfg2;
+	hprt0_data_t hprt0;
+	int clock = 60;		// default value
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	hwcfg2.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	if (!usbcfg.b.physel && usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
+		clock = 60;
+	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 3)
+		clock = 48;
+	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
+	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
+		clock = 30;
+	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
+	    !usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
+		clock = 60;
+	if (usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
+	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
+		clock = 48;
+	if (usbcfg.b.physel && !usbcfg.b.phyif && hwcfg2.b.fs_phy_type == 2)
+		clock = 48;
+	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 1)
+		clock = 48;
+	if (hprt0.b.prtspd == 0)
+		/* High speed case */
+		return 125 * clock - 1;
+	else
+		/* FS/LS case */
+		return 1000 * clock - 1;
+}
+
+/**
+ * This function reads a setup packet from the Rx FIFO into the destination
+ * buffer. This function is called from the Rx Status Queue Level (RxStsQLvl)
+ * Interrupt routine when a SETUP packet has been received in Slave mode.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dest Destination buffer for packet data.
+ */
+void dwc_otg_read_setup_packet(dwc_otg_core_if_t * core_if, uint32_t * dest)
+{
+	device_grxsts_data_t status;
+	/* Get the 8 bytes of a setup transaction data */
+
+	/* Pop 2 DWORDS off the receive data FIFO into memory */
+	dest[0] = DWC_READ_REG32(core_if->data_fifo[0]);
+	dest[1] = DWC_READ_REG32(core_if->data_fifo[0]);
+	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+		status.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->grxstsp);
+		DWC_DEBUGPL(DBG_ANY,
+			    "EP:%d BCnt:%d " "pktsts:%x Frame:%d(0x%0x)\n",
+			    status.b.epnum, status.b.bcnt, status.b.pktsts,
+			    status.b.fn, status.b.fn);
+	}
+}
+
+/**
+ * This function enables EP0 OUT to receive SETUP packets and configures EP0
+ * IN for transmitting packets. It is normally called when the
+ * "Enumeration Done" interrupt occurs.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP0 data.
+ */
+void dwc_otg_ep0_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dsts_data_t dsts;
+	depctl_data_t diepctl;
+	depctl_data_t doepctl;
+	dctl_data_t dctl = {.d32 = 0 };
+
+	ep->stp_rollover = 0;
+	/* Read the Device Status and Endpoint 0 Control registers */
+	dsts.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dsts);
+	diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
+	doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
+
+	/* Set the MPS of the IN EP based on the enumeration speed */
+	switch (dsts.b.enumspd) {
+	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
+	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
+	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
+		diepctl.b.mps = DWC_DEP0CTL_MPS_64;
+		break;
+	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
+		diepctl.b.mps = DWC_DEP0CTL_MPS_8;
+		break;
+	}
+
+	DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
+
+	/* Enable OUT EP for receive */
+	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
+	doepctl.b.epena = 1;
+	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
+	}
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
+	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
+#endif
+	dctl.b.cgnpinnak = 1;
+
+	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+	DWC_DEBUGPL(DBG_PCDV, "dctl=%0x\n",
+		    DWC_READ_REG32(&dev_if->dev_global_regs->dctl));
+
+}
+
+/**
+ * This function activates an EP.  The Device EP control register for
+ * the EP is configured as defined in the ep structure. Note: This
+ * function is not used for EP0.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to activate.
+ */
+void dwc_otg_ep_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	depctl_data_t depctl;
+	volatile uint32_t *addr;
+	daint_data_t daintmsk = {.d32 = 0 };
+	dcfg_data_t dcfg;
+	uint8_t i;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s() EP%d-%s\n", __func__, ep->num,
+		    (ep->is_in ? "IN" : "OUT"));
+
+#ifdef DWC_UTE_PER_IO
+	ep->xiso_frame_num = 0xFFFFFFFF;
+	ep->xiso_active_xfers = 0;
+	ep->xiso_queued_xfers = 0;
+#endif
+	/* Read DEPCTLn register */
+	if (ep->is_in == 1) {
+		addr = &dev_if->in_ep_regs[ep->num]->diepctl;
+		daintmsk.ep.in = 1 << ep->num;
+	} else {
+		addr = &dev_if->out_ep_regs[ep->num]->doepctl;
+		daintmsk.ep.out = 1 << ep->num;
+	}
+
+	/* If the EP is already active don't change the EP Control
+	 * register. */
+	depctl.d32 = DWC_READ_REG32(addr);
+	if (!depctl.b.usbactep) {
+		depctl.b.mps = ep->maxpacket;
+		depctl.b.eptype = ep->type;
+		depctl.b.txfnum = ep->tx_fifo_num;
+
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			depctl.b.setd0pid = 1;	// ???
+		} else {
+			depctl.b.setd0pid = 1;
+		}
+		depctl.b.usbactep = 1;
+
+		/* Update nextep_seq array and EPMSCNT in DCFG*/
+		if (!(depctl.b.eptype & 1) && (ep->is_in == 1)) {	// NP IN EP
+			for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+				if (core_if->nextep_seq[i] == core_if->first_in_nextep_seq)
+				break;
+			}
+			core_if->nextep_seq[i] = ep->num;
+			core_if->nextep_seq[ep->num] = core_if->first_in_nextep_seq;
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+			dcfg.b.epmscnt++;
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+			DWC_DEBUGPL(DBG_PCDV,
+				    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+				__func__, core_if->first_in_nextep_seq);
+			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+				DWC_DEBUGPL(DBG_PCDV, "%2d\n",
+					    core_if->nextep_seq[i]);
+			}
+
+		}
+
+
+		DWC_WRITE_REG32(addr, depctl.d32);
+		DWC_DEBUGPL(DBG_PCDV, "DEPCTL=%08x\n", DWC_READ_REG32(addr));
+	}
+
+	/* Enable the Interrupt for this EP */
+	if (core_if->multiproc_int_enable) {
+		if (ep->is_in == 1) {
+			diepmsk_data_t diepmsk = {.d32 = 0 };
+			diepmsk.b.xfercompl = 1;
+			diepmsk.b.timeout = 1;
+			diepmsk.b.epdisabled = 1;
+			diepmsk.b.ahberr = 1;
+			diepmsk.b.intknepmis = 1;
+			if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
+				diepmsk.b.intknepmis = 0;
+			diepmsk.b.txfifoundrn = 1;	//?????
+			if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+				diepmsk.b.nak = 1;
+			}
+
+
+
+/*
+			if (core_if->dma_desc_enable) {
+				diepmsk.b.bna = 1;
+			}
+*/
+/*
+			if (core_if->dma_enable) {
+				doepmsk.b.nak = 1;
+			}
+*/
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->
+					diepeachintmsk[ep->num], diepmsk.d32);
+
+		} else {
+			doepmsk_data_t doepmsk = {.d32 = 0 };
+			doepmsk.b.xfercompl = 1;
+			doepmsk.b.ahberr = 1;
+			doepmsk.b.epdisabled = 1;
+			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
+				doepmsk.b.outtknepdis = 1;
+
+/*
+
+			if (core_if->dma_desc_enable) {
+				doepmsk.b.bna = 1;
+			}
+*/
+/*
+			doepmsk.b.babble = 1;
+			doepmsk.b.nyet = 1;
+			doepmsk.b.nak = 1;
+*/
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->
+					doepeachintmsk[ep->num], doepmsk.d32);
+		}
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->deachintmsk,
+				 0, daintmsk.d32);
+	} else {
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			if (ep->is_in) {
+				diepmsk_data_t diepmsk = {.d32 = 0 };
+				diepmsk.b.nak = 1;
+				DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk, 0, diepmsk.d32);
+			} else {
+				doepmsk_data_t doepmsk = {.d32 = 0 };
+				doepmsk.b.outtknepdis = 1;
+				DWC_MODIFY_REG32(&dev_if->dev_global_regs->doepmsk, 0, doepmsk.d32);
+			}
+		}
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->daintmsk,
+				 0, daintmsk.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "DAINTMSK=%0x\n",
+		    DWC_READ_REG32(&dev_if->dev_global_regs->daintmsk));
+
+	ep->stall_clear_flag = 0;
+
+	return;
+}
+
+/**
+ * This function deactivates an EP. This is done by clearing the USB Active
+ * EP bit in the Device EP control register. Note: This function is not used
+ * for EP0. EP0 cannot be deactivated.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to deactivate.
+ */
+void dwc_otg_ep_deactivate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+	daint_data_t daintmsk = {.d32 = 0 };
+	dcfg_data_t dcfg;
+	uint8_t i = 0;
+
+#ifdef DWC_UTE_PER_IO
+	ep->xiso_frame_num = 0xFFFFFFFF;
+	ep->xiso_active_xfers = 0;
+	ep->xiso_queued_xfers = 0;
+#endif
+
+	/* Read DEPCTLn register */
+	if (ep->is_in == 1) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+		daintmsk.ep.in = 1 << ep->num;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+		daintmsk.ep.out = 1 << ep->num;
+	}
+
+	depctl.d32 = DWC_READ_REG32(addr);
+
+	depctl.b.usbactep = 0;
+
+	/* Update nextep_seq array and EPMSCNT in DCFG*/
+	if (!(depctl.b.eptype & 1) && ep->is_in == 1) {	// NP EP IN
+		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			if (core_if->nextep_seq[i] == ep->num)
+			break;
+		}
+		core_if->nextep_seq[i] = core_if->nextep_seq[ep->num];
+		if (core_if->first_in_nextep_seq == ep->num)
+			core_if->first_in_nextep_seq = i;
+		core_if->nextep_seq[ep->num] = 0xff;
+		depctl.b.nextep = 0;
+		dcfg.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+		dcfg.b.epmscnt--;
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
+				dcfg.d32);
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+				__func__, core_if->first_in_nextep_seq);
+			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+				DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
+			}
+	}
+
+	if (ep->is_in == 1)
+		depctl.b.txfnum = 0;
+
+	if (core_if->dma_desc_enable)
+		depctl.b.epdis = 1;
+
+	DWC_WRITE_REG32(addr, depctl.d32);
+	depctl.d32 = DWC_READ_REG32(addr);
+	if (core_if->dma_enable && ep->type == DWC_OTG_EP_TYPE_ISOC
+	    && depctl.b.epena) {
+		depctl_data_t depctl = {.d32 = 0};
+		if (ep->is_in) {
+			diepint_data_t diepint = {.d32 = 0};
+
+			depctl.b.snak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepctl, depctl.d32);
+			do {
+				dwc_udelay(10);
+				diepint.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->in_ep_regs[ep->num]->
+						   diepint);
+			} while (!diepint.b.inepnakeff);
+			diepint.b.inepnakeff = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepint, diepint.d32);
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepctl, depctl.d32);
+			do {
+				dwc_udelay(10);
+				diepint.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->in_ep_regs[ep->num]->
+						   diepint);
+			} while (!diepint.b.epdisabled);
+			diepint.b.epdisabled = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepint, diepint.d32);
+		} else {
+			dctl_data_t dctl = {.d32 = 0};
+			gintmsk_data_t gintsts = {.d32 = 0};
+			doepint_data_t doepint = {.d32 = 0};
+			dctl.b.sgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, 0, dctl.d32);
+			do {
+				dwc_udelay(10);
+				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			} while (!gintsts.b.goutnakeff);
+			gintsts.d32 = 0;
+			gintsts.b.goutnakeff = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			depctl.b.snak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepctl, depctl.d32);
+			do
+			{
+				dwc_udelay(10);
+				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+											out_ep_regs[ep->num]->doepint);
+			} while (!doepint.b.epdisabled);
+
+			doepint.b.epdisabled = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepint, doepint.d32);
+
+			dctl.d32 = 0;
+			dctl.b.cgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+		}
+	}
+
+	/* Disable the Interrupt for this EP */
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
+				 daintmsk.d32, 0);
+
+		if (ep->is_in == 1) {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					diepeachintmsk[ep->num], 0);
+		} else {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					doepeachintmsk[ep->num], 0);
+		}
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->daintmsk,
+				 daintmsk.d32, 0);
+	}
+
+}
+
+/**
+ * This function initializes dma descriptor chain.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+static void init_dma_desc_chain(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	uint32_t offset;
+	uint32_t xfer_est;
+	int i;
+	unsigned maxxfer_local, total_len;
+
+	if (!ep->is_in && ep->type == DWC_OTG_EP_TYPE_INTR &&
+					(ep->maxpacket%4)) {
+		maxxfer_local = ep->maxpacket;
+		total_len = ep->xfer_len;
+	} else {
+		maxxfer_local = ep->maxxfer;
+		total_len = ep->total_len;
+	}
+
+	ep->desc_cnt = (total_len / maxxfer_local) +
+            ((total_len % maxxfer_local) ? 1 : 0);
+
+	if (!ep->desc_cnt)
+		ep->desc_cnt = 1;
+
+	if (ep->desc_cnt > MAX_DMA_DESC_CNT)
+		ep->desc_cnt = MAX_DMA_DESC_CNT;
+
+	dma_desc = ep->desc_addr;
+	if (maxxfer_local == ep->maxpacket) {
+		if ((total_len % maxxfer_local) &&
+				(total_len/maxxfer_local < MAX_DMA_DESC_CNT)) {
+			xfer_est = (ep->desc_cnt - 1) * maxxfer_local +
+					(total_len % maxxfer_local);
+		} else
+			xfer_est = ep->desc_cnt * maxxfer_local;
+	} else
+		xfer_est = total_len;
+	offset = 0;
+	for (i = 0; i < ep->desc_cnt; ++i) {
+		/** DMA Descriptor Setup */
+		if (xfer_est > maxxfer_local) {
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 0;
+			dma_desc->status.b.ioc = 0;
+			dma_desc->status.b.sp = 0;
+			dma_desc->status.b.bytes = maxxfer_local;
+			dma_desc->buf = ep->dma_addr + offset;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			xfer_est -= maxxfer_local;
+			offset += maxxfer_local;
+		} else {
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			if (ep->is_in) {
+				dma_desc->status.b.sp =
+				    (xfer_est %
+				     ep->maxpacket) ? 1 : ((ep->
+							    sent_zlp) ? 1 : 0);
+				dma_desc->status.b.bytes = xfer_est;
+			} else {
+				if (maxxfer_local == ep->maxpacket)
+					dma_desc->status.b.bytes = xfer_est;
+				else
+					dma_desc->status.b.bytes =
+						xfer_est + ((4 - (xfer_est & 0x3)) & 0x3);
+			}
+
+			dma_desc->buf = ep->dma_addr + offset;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+		}
+		dma_desc++;
+	}
+}
+/**
+ * This function is called when to write ISOC data into appropriate dedicated
+ * periodic FIFO.
+ */
+static int32_t write_isoc_tx_fifo(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	dtxfsts_data_t txstatus = {.d32 = 0 };
+	uint32_t len = 0;
+	int epnum = dwc_ep->num;
+	int dwords;
+
+	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
+
+	ep_regs = core_if->dev_if->in_ep_regs[epnum];
+
+	len = dwc_ep->xfer_len - dwc_ep->xfer_count;
+
+	if (len > dwc_ep->maxpacket) {
+		len = dwc_ep->maxpacket;
+	}
+
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
+
+	while (txstatus.b.txfspcavail > dwords &&
+	       dwc_ep->xfer_count < dwc_ep->xfer_len && dwc_ep->xfer_len != 0) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, dwc_ep, 0);
+
+		len = dwc_ep->xfer_len - dwc_ep->xfer_count;
+		if (len > dwc_ep->maxpacket) {
+			len = dwc_ep->maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 =
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
+			    txstatus.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
+
+	return 1;
+}
+/**
+ * This function does the setup for a data transfer for an EP and
+ * starts the transfer. For an IN transfer, the packets will be
+ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
+ * the packets are unloaded from the Rx FIFO in the ISR.  the ISR.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+
+void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	deptsiz_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
+	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
+		    "xfer_buff=%p start_xfer_buff=%p, total_len = %d\n",
+		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
+		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff,
+		    ep->total_len);
+	/* IN endpoint */
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[ep->num];
+
+		gnptxsts_data_t gtxstatus;
+
+		gtxstatus.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
+
+		if (core_if->en_multiple_tx_fifo == 0
+		    && gtxstatus.b.nptxqspcavail == 0 && !core_if->dma_enable) {
+#ifdef DEBUG
+			DWC_PRINTF("TX Queue Full (0x%0x)\n", gtxstatus.d32);
+#endif
+			return;
+		}
+
+		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
+
+		if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
+			ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
+				ep->maxxfer : (ep->total_len - ep->xfer_len);
+		else
+			ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len - ep->xfer_len)) ?
+				 MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
+
+
+		/* Zero Length Packet? */
+		if ((ep->xfer_len - ep->xfer_count) == 0) {
+			deptsiz.b.xfersize = 0;
+			deptsiz.b.pktcnt = 1;
+		} else {
+			/* Program the transfer size and packet count
+			 *      as follows: xfersize = N * maxpacket +
+			 *      short_packet pktcnt = N + (short_packet
+			 *      exist ? 1 : 0)
+			 */
+			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len - ep->xfer_count - 1 +
+			     ep->maxpacket) / ep->maxpacket;
+			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
+				deptsiz.b.pktcnt = MAX_PKT_CNT;
+				deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
+			}
+			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
+				deptsiz.b.mc = deptsiz.b.pktcnt;
+		}
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				if (ep->type != DWC_OTG_EP_TYPE_ISOC)
+					deptsiz.b.mc = 1;
+				DWC_WRITE_REG32(&in_regs->dieptsiz,
+						deptsiz.d32);
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+#ifdef DWC_UTE_CFI
+				/* The descriptor chain should be already initialized by now */
+				if (ep->buff_mode != BM_STANDARD) {
+					DWC_WRITE_REG32(&in_regs->diepdma,
+							ep->descs_dma_addr);
+				} else {
+#endif
+					init_dma_desc_chain(core_if, ep);
+				/** DIEPDMAn Register write */
+					DWC_WRITE_REG32(&in_regs->diepdma,
+							ep->dma_desc_addr);
+#ifdef DWC_UTE_CFI
+				}
+#endif
+			}
+		} else {
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+			if (ep->type != DWC_OTG_EP_TYPE_ISOC) {
+				/**
+				 * Enable the Non-Periodic Tx FIFO empty interrupt,
+				 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
+				 * the data will be written into the fifo by the ISR.
+				 */
+				if (core_if->en_multiple_tx_fifo == 0) {
+					intr_mask.b.nptxfempty = 1;
+					DWC_MODIFY_REG32
+					    (&core_if->core_global_regs->gintmsk,
+					     intr_mask.d32, intr_mask.d32);
+				} else {
+					/* Enable the Tx FIFO Empty Interrupt for this EP */
+					if (ep->xfer_len > 0) {
+						uint32_t fifoemptymsk = 0;
+						fifoemptymsk = 1 << ep->num;
+						DWC_MODIFY_REG32
+						    (&core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+						     0, fifoemptymsk);
+
+					}
+				}
+			}  else {
+					 write_isoc_tx_fifo(core_if, ep);
+			}
+		}
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			dsts_data_t dsts = {.d32 = 0};
+			if (ep->bInterval == 1) {
+				dsts.d32 =
+				    DWC_READ_REG32(&core_if->dev_if->
+						   dev_global_regs->dsts);
+				ep->frame_num = dsts.b.soffn + ep->bInterval;
+				if (ep->frame_num > 0x3FFF) {
+					ep->frm_overrun = 1;
+					ep->frame_num &= 0x3FFF;
+				} else
+					ep->frm_overrun = 0;
+				if (ep->frame_num & 0x1) {
+					depctl.b.setd1pid = 1;
+				} else {
+					depctl.b.setd0pid = 1;
+				}
+			}
+		}
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+	} else {
+		/* OUT endpoint */
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[ep->num];
+
+		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
+
+		if (!core_if->dma_desc_enable) {
+			if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
+				ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
+				ep->maxxfer : (ep->total_len - ep->xfer_len);
+                else
+					ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len
+					- ep->xfer_len)) ? MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
+		}
+
+		/* Program the transfer size and packet count as follows:
+		 *
+		 *      pktcnt = N
+		 *      xfersize = N * maxpacket
+		 */
+		if ((ep->xfer_len - ep->xfer_count) == 0) {
+			/* Zero Length Packet */
+			deptsiz.b.xfersize = ep->maxpacket;
+			deptsiz.b.pktcnt = 1;
+		} else {
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len - ep->xfer_count +
+			     (ep->maxpacket - 1)) / ep->maxpacket;
+			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
+				deptsiz.b.pktcnt = MAX_PKT_CNT;
+			}
+			if (!core_if->dma_desc_enable) {
+				ep->xfer_len =
+					deptsiz.b.pktcnt * ep->maxpacket + ep->xfer_count;
+			}
+			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
+		}
+
+		DWC_DEBUGPL(DBG_PCDV, "ep%d xfersize=%d pktcnt=%d\n",
+			    ep->num, deptsiz.b.xfersize, deptsiz.b.pktcnt);
+
+		if (core_if->dma_enable) {
+			if (!core_if->dma_desc_enable) {
+				DWC_WRITE_REG32(&out_regs->doeptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+#ifdef DWC_UTE_CFI
+				/* The descriptor chain should be already initialized by now */
+				if (ep->buff_mode != BM_STANDARD) {
+					DWC_WRITE_REG32(&out_regs->doepdma,
+							ep->descs_dma_addr);
+				} else {
+#endif
+					/** This is used for interrupt out transfers*/
+					if (!ep->xfer_len)
+						ep->xfer_len = ep->total_len;
+					init_dma_desc_chain(core_if, ep);
+
+					if (core_if->core_params->dev_out_nak) {
+						if (ep->type == DWC_OTG_EP_TYPE_BULK) {
+							deptsiz.b.pktcnt = (ep->total_len +
+								(ep->maxpacket - 1)) / ep->maxpacket;
+							deptsiz.b.xfersize = ep->total_len;
+							/* Remember initial value of doeptsiz */
+							core_if->start_doeptsiz_val[ep->num] = deptsiz.d32;
+							DWC_WRITE_REG32(&out_regs->doeptsiz,
+								deptsiz.d32);
+						}
+					}
+				/** DOEPDMAn Register write */
+					DWC_WRITE_REG32(&out_regs->doepdma,
+							ep->dma_desc_addr);
+#ifdef DWC_UTE_CFI
+				}
+#endif
+			}
+		} else {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		}
+
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			dsts_data_t dsts = {.d32 = 0};
+			if (ep->bInterval == 1) {
+				dsts.d32 =
+				    DWC_READ_REG32(&core_if->dev_if->
+						   dev_global_regs->dsts);
+				ep->frame_num = dsts.b.soffn + ep->bInterval;
+				if (ep->frame_num > 0x3FFF) {
+					ep->frm_overrun = 1;
+					ep->frame_num &= 0x3FFF;
+				} else
+					ep->frm_overrun = 0;
+
+				if (ep->frame_num & 0x1) {
+					depctl.b.setd1pid = 1;
+				} else {
+					depctl.b.setd0pid = 1;
+				}
+			}
+		}
+
+		/* EP enable */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+
+		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
+
+		DWC_DEBUGPL(DBG_PCD, "DOEPCTL=%08x DOEPTSIZ=%08x\n",
+			    DWC_READ_REG32(&out_regs->doepctl),
+			    DWC_READ_REG32(&out_regs->doeptsiz));
+		DWC_DEBUGPL(DBG_PCD, "DAINTMSK=%08x GINTMSK=%08x\n",
+			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
+					   daintmsk),
+			    DWC_READ_REG32(&core_if->core_global_regs->
+					   gintmsk));
+
+		/* Timer is scheduling only for out bulk transfers for
+		 * "Device DDMA OUT NAK Enhancement" feature to inform user
+		 * about received data payload in case of timeout
+		 */
+		if (core_if->core_params->dev_out_nak) {
+			if (ep->type == DWC_OTG_EP_TYPE_BULK) {
+				core_if->ep_xfer_info[ep->num].core_if = core_if;
+				core_if->ep_xfer_info[ep->num].ep = ep;
+				core_if->ep_xfer_info[ep->num].state = 1;
+
+				/* Start a timer for this transfer. */
+				DWC_TIMER_SCHEDULE(core_if->ep_xfer_timer[ep->num], 10000);
+			}
+		}
+	}
+}
+
+/**
+ * This function setup a zero length transfer in Buffer DMA and
+ * Slave modes for usb requests with zero field set
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+
+	depctl_data_t depctl;
+	deptsiz_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
+	DWC_PRINTF("zero length transfer is called\n");
+
+	/* IN endpoint */
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[ep->num];
+
+		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
+
+		deptsiz.b.xfersize = 0;
+		deptsiz.b.pktcnt = 1;
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				deptsiz.b.mc = 1;
+				DWC_WRITE_REG32(&in_regs->dieptsiz,
+						deptsiz.d32);
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+			/**
+			 * Enable the Non-Periodic Tx FIFO empty interrupt,
+			 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
+			 * the data will be written into the fifo by the ISR.
+			 */
+			if (core_if->en_multiple_tx_fifo == 0) {
+				intr_mask.b.nptxfempty = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gintmsk,
+						 intr_mask.d32, intr_mask.d32);
+			} else {
+				/* Enable the Tx FIFO Empty Interrupt for this EP */
+				if (ep->xfer_len > 0) {
+					uint32_t fifoemptymsk = 0;
+					fifoemptymsk = 1 << ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 0, fifoemptymsk);
+				}
+			}
+		}
+
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+	} else {
+		/* OUT endpoint */
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[ep->num];
+
+		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
+
+		/* Zero Length Packet */
+		deptsiz.b.xfersize = ep->maxpacket;
+		deptsiz.b.pktcnt = 1;
+
+		if (core_if->dma_enable) {
+			if (!core_if->dma_desc_enable) {
+				DWC_WRITE_REG32(&out_regs->doeptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		}
+
+		/* EP enable */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+
+		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
+
+	}
+}
+
+/**
+ * This function does the setup for a data transfer for EP0 and starts
+ * the transfer.  For an IN transfer, the packets will be loaded into
+ * the appropriate Tx FIFO in the ISR. For OUT transfers, the packets are
+ * unloaded from the Rx FIFO in the ISR.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP0 data.
+ */
+void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	deptsiz0_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_dev_dma_desc_t *dma_desc;
+
+	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
+		    "xfer_buff=%p start_xfer_buff=%p \n",
+		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
+		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff);
+
+	ep->total_len = ep->xfer_len;
+
+	/* IN endpoint */
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[0];
+
+		gnptxsts_data_t gtxstatus;
+
+		if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+			depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
+			if (depctl.b.epena)
+				return;
+		}
+
+		gtxstatus.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
+
+		/* If dedicated FIFO every time flush fifo before enable ep*/
+		if (core_if->en_multiple_tx_fifo && core_if->snpsid >= OTG_CORE_REV_3_00a)
+			dwc_otg_flush_tx_fifo(core_if, ep->tx_fifo_num);
+
+		if (core_if->en_multiple_tx_fifo == 0
+		    && gtxstatus.b.nptxqspcavail == 0
+		    && !core_if->dma_enable) {
+#ifdef DEBUG
+			deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
+			DWC_DEBUGPL(DBG_PCD, "DIEPCTL0=%0x\n",
+				    DWC_READ_REG32(&in_regs->diepctl));
+			DWC_DEBUGPL(DBG_PCD, "DIEPTSIZ0=%0x (sz=%d, pcnt=%d)\n",
+				    deptsiz.d32,
+				    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+			DWC_PRINTF("TX Queue or FIFO Full (0x%0x)\n",
+				   gtxstatus.d32);
+#endif
+			return;
+		}
+
+		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
+		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
+
+		/* Zero Length Packet? */
+		if (ep->xfer_len == 0) {
+			deptsiz.b.xfersize = 0;
+			deptsiz.b.pktcnt = 1;
+		} else {
+			/* Program the transfer size and packet count
+			 *      as follows: xfersize = N * maxpacket +
+			 *      short_packet pktcnt = N + (short_packet
+			 *      exist ? 1 : 0)
+			 */
+			if (ep->xfer_len > ep->maxpacket) {
+				ep->xfer_len = ep->maxpacket;
+				deptsiz.b.xfersize = ep->maxpacket;
+			} else {
+				deptsiz.b.xfersize = ep->xfer_len;
+			}
+			deptsiz.b.pktcnt = 1;
+
+		}
+		DWC_DEBUGPL(DBG_PCDV,
+			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
+			    deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				DWC_WRITE_REG32(&in_regs->dieptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+				dma_desc = core_if->dev_if->in_desc_addr;
+
+				/** DMA Descriptor Setup */
+				dma_desc->status.b.bs = BS_HOST_BUSY;
+				dma_desc->status.b.l = 1;
+				dma_desc->status.b.ioc = 1;
+				dma_desc->status.b.sp =
+				    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
+				dma_desc->status.b.bytes = ep->xfer_len;
+				dma_desc->buf = ep->dma_addr;
+				dma_desc->status.b.sts = 0;
+				dma_desc->status.b.bs = BS_HOST_READY;
+
+				/** DIEPDMA0 Register write */
+				DWC_WRITE_REG32(&in_regs->diepdma,
+						core_if->
+						dev_if->dma_in_desc_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+		}
+
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+		/**
+		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
+		 * data will be written into the fifo by the ISR.
+		 */
+		if (!core_if->dma_enable) {
+			if (core_if->en_multiple_tx_fifo == 0) {
+				intr_mask.b.nptxfempty = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gintmsk,
+						 intr_mask.d32, intr_mask.d32);
+			} else {
+				/* Enable the Tx FIFO Empty Interrupt for this EP */
+				if (ep->xfer_len > 0) {
+					uint32_t fifoemptymsk = 0;
+					fifoemptymsk |= 1 << ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 0, fifoemptymsk);
+				}
+			}
+		}
+	} else {
+		/* OUT endpoint */
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[0];
+
+		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
+		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
+
+		/* Program the transfer size and packet count as follows:
+		 *      xfersize = N * (maxpacket + 4 - (maxpacket % 4))
+		 *      pktcnt = N                                                                                      */
+		/* Zero Length Packet */
+		deptsiz.b.xfersize = ep->maxpacket;
+		deptsiz.b.pktcnt = 1;
+		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
+			deptsiz.b.supcnt = 3;
+
+		DWC_DEBUGPL(DBG_PCDV, "len=%d  xfersize=%d pktcnt=%d\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt);
+
+		if (core_if->dma_enable) {
+			if (!core_if->dma_desc_enable) {
+				DWC_WRITE_REG32(&out_regs->doeptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+				dma_desc = core_if->dev_if->out_desc_addr;
+
+				/** DMA Descriptor Setup */
+				dma_desc->status.b.bs = BS_HOST_BUSY;
+				if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+					dma_desc->status.b.mtrf = 0;
+					dma_desc->status.b.sr = 0;
+				}
+				dma_desc->status.b.l = 1;
+				dma_desc->status.b.ioc = 1;
+				dma_desc->status.b.bytes = ep->maxpacket;
+				dma_desc->buf = ep->dma_addr;
+				dma_desc->status.b.sts = 0;
+				dma_desc->status.b.bs = BS_HOST_READY;
+
+				/** DOEPDMA0 Register write */
+				DWC_WRITE_REG32(&out_regs->doepdma,
+						core_if->dev_if->
+						dma_out_desc_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		}
+
+		/* EP enable */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&(out_regs->doepctl), depctl.d32);
+	}
+}
+
+/**
+ * This function continues control IN transfers started by
+ * dwc_otg_ep0_start_transfer, when the transfer does not fit in a
+ * single packet.  NOTE: The DIEPCTL0/DOEPCTL0 registers only have one
+ * bit for the packet count.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP0 data.
+ */
+void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	deptsiz0_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_dev_dma_desc_t *dma_desc;
+
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[0];
+		gnptxsts_data_t tx_status = {.d32 = 0 };
+
+		tx_status.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
+		/** @todo Should there be check for room in the Tx
+		 * Status Queue.  If not remove the code above this comment. */
+
+		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
+		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
+
+		/* Program the transfer size and packet count
+		 *      as follows: xfersize = N * maxpacket +
+		 *      short_packet pktcnt = N + (short_packet
+		 *      exist ? 1 : 0)
+		 */
+
+		if (core_if->dma_desc_enable == 0) {
+			deptsiz.b.xfersize =
+			    (ep->total_len - ep->xfer_count) >
+			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
+							     ep->xfer_count);
+			deptsiz.b.pktcnt = 1;
+			if (core_if->dma_enable == 0) {
+				ep->xfer_len += deptsiz.b.xfersize;
+			} else {
+				ep->xfer_len = deptsiz.b.xfersize;
+			}
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+		} else {
+			ep->xfer_len =
+			    (ep->total_len - ep->xfer_count) >
+			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
+							     ep->xfer_count);
+
+			dma_desc = core_if->dev_if->in_desc_addr;
+
+			/** DMA Descriptor Setup */
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			dma_desc->status.b.sp =
+			    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
+			dma_desc->status.b.bytes = ep->xfer_len;
+			dma_desc->buf = ep->dma_addr;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			/** DIEPDMA0 Register write */
+			DWC_WRITE_REG32(&in_regs->diepdma,
+					core_if->dev_if->dma_in_desc_addr);
+		}
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
+			    deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
+			if (core_if->dma_desc_enable == 0)
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+		}
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+		/**
+		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
+		 * data will be written into the fifo by the ISR.
+		 */
+		if (!core_if->dma_enable) {
+			if (core_if->en_multiple_tx_fifo == 0) {
+				/* First clear it from GINTSTS */
+				intr_mask.b.nptxfempty = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gintmsk,
+						 intr_mask.d32, intr_mask.d32);
+
+			} else {
+				/* Enable the Tx FIFO Empty Interrupt for this EP */
+				if (ep->xfer_len > 0) {
+					uint32_t fifoemptymsk = 0;
+					fifoemptymsk |= 1 << ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 0, fifoemptymsk);
+				}
+			}
+		}
+	} else {
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[0];
+
+		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
+		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
+
+		/* Program the transfer size and packet count
+		 *      as follows: xfersize = N * maxpacket +
+		 *      short_packet pktcnt = N + (short_packet
+		 *      exist ? 1 : 0)
+		 */
+		deptsiz.b.xfersize = ep->maxpacket;
+		deptsiz.b.pktcnt = 1;
+
+		if (core_if->dma_desc_enable == 0) {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		} else {
+			dma_desc = core_if->dev_if->out_desc_addr;
+
+			/** DMA Descriptor Setup */
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			dma_desc->status.b.bytes = ep->maxpacket;
+			dma_desc->buf = ep->dma_addr;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			/** DOEPDMA0 Register write */
+			DWC_WRITE_REG32(&out_regs->doepdma,
+					core_if->dev_if->dma_out_desc_addr);
+		}
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
+			    deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
+			if (core_if->dma_desc_enable == 0)
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+
+		}
+
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
+
+	}
+}
+
+#ifdef DEBUG
+void dump_msg(const u8 * buf, unsigned int length)
+{
+	unsigned int start, num, i;
+	char line[52], *p;
+
+	if (length >= 512)
+		return;
+	start = 0;
+	while (length > 0) {
+		num = length < 16u ? length : 16u;
+		p = line;
+		for (i = 0; i < num; ++i) {
+			if (i == 8)
+				*p++ = ' ';
+			DWC_SPRINTF(p, " %02x", buf[i]);
+			p += 3;
+		}
+		*p = 0;
+		DWC_PRINTF("%6x: %s\n", start, line);
+		buf += num;
+		start += num;
+		length -= num;
+	}
+}
+#else
+static inline void dump_msg(const u8 * buf, unsigned int length)
+{
+}
+#endif
+
+/**
+ * This function writes a packet into the Tx FIFO associated with the
+ * EP. For non-periodic EPs the non-periodic Tx FIFO is written.  For
+ * periodic EPs the periodic Tx FIFO associated with the EP is written
+ * with all packets for the next micro-frame.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to write packet for.
+ * @param dma Indicates if DMA is being used.
+ */
+void dwc_otg_ep_write_packet(dwc_otg_core_if_t * core_if, dwc_ep_t * ep,
+			     int dma)
+{
+	/**
+	 * The buffer is padded to DWORD on a per packet basis in
+	 * slave/dma mode if the MPS is not DWORD aligned. The last
+	 * packet, if short, is also padded to a multiple of DWORD.
+	 *
+	 * ep->xfer_buff always starts DWORD aligned in memory and is a
+	 * multiple of DWORD in length
+	 *
+	 * ep->xfer_len can be any number of bytes
+	 *
+	 * ep->xfer_count is a multiple of ep->maxpacket until the last
+	 *	packet
+	 *
+	 * FIFO access is DWORD */
+
+	uint32_t i;
+	uint32_t byte_count;
+	uint32_t dword_count;
+	uint32_t *fifo;
+	uint32_t *data_buff = (uint32_t *) ep->xfer_buff;
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p)\n", __func__, core_if,
+		    ep);
+	if (ep->xfer_count >= ep->xfer_len) {
+		DWC_WARN("%s() No data for EP%d!!!\n", __func__, ep->num);
+		return;
+	}
+
+	/* Find the byte length of the packet either short packet or MPS */
+	if ((ep->xfer_len - ep->xfer_count) < ep->maxpacket) {
+		byte_count = ep->xfer_len - ep->xfer_count;
+	} else {
+		byte_count = ep->maxpacket;
+	}
+
+	/* Find the DWORD length, padded by extra bytes as neccessary if MPS
+	 * is not a multiple of DWORD */
+	dword_count = (byte_count + 3) / 4;
+
+#ifdef VERBOSE
+	dump_msg(ep->xfer_buff, byte_count);
+#endif
+
+	/**@todo NGS Where are the Periodic Tx FIFO addresses
+	 * intialized?	What should this be? */
+
+	fifo = core_if->data_fifo[ep->num];
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "fifo=%p buff=%p *p=%08x bc=%d\n",
+		    fifo, data_buff, *data_buff, byte_count);
+
+	if (!dma) {
+		for (i = 0; i < dword_count; i++, data_buff++) {
+			DWC_WRITE_REG32(fifo, *data_buff);
+		}
+	}
+
+	ep->xfer_count += byte_count;
+	ep->xfer_buff += byte_count;
+	ep->dma_addr += byte_count;
+}
+
+/**
+ * Set the EP STALL.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to set the stall on.
+ */
+void dwc_otg_ep_set_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	volatile uint32_t *depctl_addr;
+
+	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
+		    (ep->is_in ? "IN" : "OUT"));
+
+	if (ep->is_in == 1) {
+		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
+		depctl.d32 = DWC_READ_REG32(depctl_addr);
+
+		/* set the disable and stall bits */
+		if (depctl.b.epena) {
+			depctl.b.epdis = 1;
+		}
+		depctl.b.stall = 1;
+		DWC_WRITE_REG32(depctl_addr, depctl.d32);
+	} else {
+		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
+		depctl.d32 = DWC_READ_REG32(depctl_addr);
+
+		/* set the stall bit */
+		depctl.b.stall = 1;
+		DWC_WRITE_REG32(depctl_addr, depctl.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
+
+	return;
+}
+
+/**
+ * Clear the EP STALL.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to clear stall from.
+ */
+void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	volatile uint32_t *depctl_addr;
+
+	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
+		    (ep->is_in ? "IN" : "OUT"));
+
+	if (ep->is_in == 1) {
+		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
+	} else {
+		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
+	}
+
+	depctl.d32 = DWC_READ_REG32(depctl_addr);
+
+	/* clear the stall bits */
+	depctl.b.stall = 0;
+
+	/*
+	 * USB Spec 9.4.5: For endpoints using data toggle, regardless
+	 * of whether an endpoint has the Halt feature set, a
+	 * ClearFeature(ENDPOINT_HALT) request always results in the
+	 * data toggle being reinitialized to DATA0.
+	 */
+	if (ep->type == DWC_OTG_EP_TYPE_INTR ||
+	    ep->type == DWC_OTG_EP_TYPE_BULK) {
+		depctl.b.setd0pid = 1;	/* DATA0 */
+	}
+
+	DWC_WRITE_REG32(depctl_addr, depctl.d32);
+	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
+	return;
+}
+
+/**
+ * This function reads a packet from the Rx FIFO into the destination
+ * buffer. To read SETUP data use dwc_otg_read_setup_packet.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dest	  Destination buffer for the packet.
+ * @param bytes  Number of bytes to copy to the destination.
+ */
+void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
+			 uint8_t * dest, uint16_t bytes)
+{
+	int i;
+	int word_count = (bytes + 3) / 4;
+
+	volatile uint32_t *fifo = core_if->data_fifo[0];
+	uint32_t *data_buff = (uint32_t *) dest;
+
+	/**
+	 * @todo Account for the case where _dest is not dword aligned. This
+	 * requires reading data from the FIFO into a uint32_t temp buffer,
+	 * then moving it into the data buffer.
+	 */
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p,%d)\n", __func__,
+		    core_if, dest, bytes);
+
+	for (i = 0; i < word_count; i++, data_buff++) {
+		*data_buff = DWC_READ_REG32(fifo);
+	}
+
+	return;
+}
+
+/**
+ * This functions reads the device registers and prints them
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	volatile uint32_t *addr;
+
+	DWC_PRINTF("Device Global Registers\n");
+	addr = &core_if->dev_if->dev_global_regs->dcfg;
+	DWC_PRINTF("DCFG		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->dctl;
+	DWC_PRINTF("DCTL		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->dsts;
+	DWC_PRINTF("DSTS		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->diepmsk;
+	DWC_PRINTF("DIEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->doepmsk;
+	DWC_PRINTF("DOEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->daint;
+	DWC_PRINTF("DAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->daintmsk;
+	DWC_PRINTF("DAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->dtknqr1;
+	DWC_PRINTF("DTKNQR1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	if (core_if->hwcfg2.b.dev_token_q_depth > 6) {
+		addr = &core_if->dev_if->dev_global_regs->dtknqr2;
+		DWC_PRINTF("DTKNQR2	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+
+	addr = &core_if->dev_if->dev_global_regs->dvbusdis;
+	DWC_PRINTF("DVBUSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	addr = &core_if->dev_if->dev_global_regs->dvbuspulse;
+	DWC_PRINTF("DVBUSPULSE	@0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+
+	addr = &core_if->dev_if->dev_global_regs->dtknqr3_dthrctl;
+	DWC_PRINTF("DTKNQR3_DTHRCTL	 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+
+	if (core_if->hwcfg2.b.dev_token_q_depth > 22) {
+		addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
+		DWC_PRINTF("DTKNQR4	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+
+	addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
+	DWC_PRINTF("FIFOEMPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	if (core_if->hwcfg2.b.multi_proc_int) {
+
+		addr = &core_if->dev_if->dev_global_regs->deachint;
+		DWC_PRINTF("DEACHINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->dev_global_regs->deachintmsk;
+		DWC_PRINTF("DEACHINTMSK	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+
+		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			addr =
+			    &core_if->dev_if->
+			    dev_global_regs->diepeachintmsk[i];
+			DWC_PRINTF("DIEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
+				   i, (unsigned long)addr,
+				   DWC_READ_REG32(addr));
+		}
+
+		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
+			addr =
+			    &core_if->dev_if->
+			    dev_global_regs->doepeachintmsk[i];
+			DWC_PRINTF("DOEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
+				   i, (unsigned long)addr,
+				   DWC_READ_REG32(addr));
+		}
+	}
+
+	for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+		DWC_PRINTF("Device IN EP %d Registers\n", i);
+		addr = &core_if->dev_if->in_ep_regs[i]->diepctl;
+		DWC_PRINTF("DIEPCTL	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->diepint;
+		DWC_PRINTF("DIEPINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->dieptsiz;
+		DWC_PRINTF("DIETSIZ	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->diepdma;
+		DWC_PRINTF("DIEPDMA	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->dtxfsts;
+		DWC_PRINTF("DTXFSTS	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->diepdmab;
+		DWC_PRINTF("DIEPDMAB	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, 0 /*DWC_READ_REG32(addr) */ );
+	}
+
+	for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
+		DWC_PRINTF("Device OUT EP %d Registers\n", i);
+		addr = &core_if->dev_if->out_ep_regs[i]->doepctl;
+		DWC_PRINTF("DOEPCTL	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->out_ep_regs[i]->doepint;
+		DWC_PRINTF("DOEPINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->out_ep_regs[i]->doeptsiz;
+		DWC_PRINTF("DOETSIZ	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->out_ep_regs[i]->doepdma;
+		DWC_PRINTF("DOEPDMA	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		if (core_if->dma_enable) {	/* Don't access this register in SLAVE mode */
+			addr = &core_if->dev_if->out_ep_regs[i]->doepdmab;
+			DWC_PRINTF("DOEPDMAB	 @0x%08lX : 0x%08X\n",
+				   (unsigned long)addr, DWC_READ_REG32(addr));
+		}
+
+	}
+}
+
+/**
+ * This functions reads the SPRAM and prints its content
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_spram(dwc_otg_core_if_t * core_if)
+{
+	volatile uint8_t *addr, *start_addr, *end_addr;
+
+	DWC_PRINTF("SPRAM Data:\n");
+	start_addr = (void *)core_if->core_global_regs;
+	DWC_PRINTF("Base Address: 0x%8lX\n", (unsigned long)start_addr);
+	start_addr += 0x00028000;
+	end_addr = (void *)core_if->core_global_regs;
+	end_addr += 0x000280e0;
+
+	for (addr = start_addr; addr < end_addr; addr += 16) {
+		DWC_PRINTF
+		    ("0x%8lX:\t%2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X\n",
+		     (unsigned long)addr, addr[0], addr[1], addr[2], addr[3],
+		     addr[4], addr[5], addr[6], addr[7], addr[8], addr[9],
+		     addr[10], addr[11], addr[12], addr[13], addr[14], addr[15]
+		    );
+	}
+
+	return;
+}
+
+/**
+ * This function reads the host registers and prints them
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_host_registers(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	volatile uint32_t *addr;
+
+	DWC_PRINTF("Host Global Registers\n");
+	addr = &core_if->host_if->host_global_regs->hcfg;
+	DWC_PRINTF("HCFG		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->hfir;
+	DWC_PRINTF("HFIR		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->hfnum;
+	DWC_PRINTF("HFNUM	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->hptxsts;
+	DWC_PRINTF("HPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->haint;
+	DWC_PRINTF("HAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->haintmsk;
+	DWC_PRINTF("HAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	if (core_if->dma_desc_enable) {
+		addr = &core_if->host_if->host_global_regs->hflbaddr;
+		DWC_PRINTF("HFLBADDR	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+
+	addr = core_if->host_if->hprt0;
+	DWC_PRINTF("HPRT0	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	for (i = 0; i < core_if->core_params->host_channels; i++) {
+		DWC_PRINTF("Host Channel %d Specific Registers\n", i);
+		addr = &core_if->host_if->hc_regs[i]->hcchar;
+		DWC_PRINTF("HCCHAR	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcsplt;
+		DWC_PRINTF("HCSPLT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcint;
+		DWC_PRINTF("HCINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcintmsk;
+		DWC_PRINTF("HCINTMSK	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hctsiz;
+		DWC_PRINTF("HCTSIZ	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcdma;
+		DWC_PRINTF("HCDMA	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		if (core_if->dma_desc_enable) {
+			addr = &core_if->host_if->hc_regs[i]->hcdmab;
+			DWC_PRINTF("HCDMAB	 @0x%08lX : 0x%08X\n",
+				   (unsigned long)addr, DWC_READ_REG32(addr));
+		}
+
+	}
+	return;
+}
+
+/**
+ * This function reads the core global registers and prints them
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_global_registers(dwc_otg_core_if_t * core_if)
+{
+	int i, ep_num;
+	volatile uint32_t *addr;
+	char *txfsiz;
+
+	DWC_PRINTF("Core Global Registers\n");
+	addr = &core_if->core_global_regs->gotgctl;
+	DWC_PRINTF("GOTGCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gotgint;
+	DWC_PRINTF("GOTGINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gahbcfg;
+	DWC_PRINTF("GAHBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gusbcfg;
+	DWC_PRINTF("GUSBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->grstctl;
+	DWC_PRINTF("GRSTCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gintsts;
+	DWC_PRINTF("GINTSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gintmsk;
+	DWC_PRINTF("GINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->grxstsr;
+	DWC_PRINTF("GRXSTSR	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->grxfsiz;
+	DWC_PRINTF("GRXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gnptxfsiz;
+	DWC_PRINTF("GNPTXFSIZ @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gnptxsts;
+	DWC_PRINTF("GNPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gi2cctl;
+	DWC_PRINTF("GI2CCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gpvndctl;
+	DWC_PRINTF("GPVNDCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ggpio;
+	DWC_PRINTF("GGPIO	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->guid;
+	DWC_PRINTF("GUID		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gsnpsid;
+	DWC_PRINTF("GSNPSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg1;
+	DWC_PRINTF("GHWCFG1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg2;
+	DWC_PRINTF("GHWCFG2	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg3;
+	DWC_PRINTF("GHWCFG3	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg4;
+	DWC_PRINTF("GHWCFG4	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->glpmcfg;
+	DWC_PRINTF("GLPMCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gpwrdn;
+	DWC_PRINTF("GPWRDN	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gdfifocfg;
+	DWC_PRINTF("GDFIFOCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->adpctl;
+	DWC_PRINTF("ADPCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   dwc_otg_adp_read_reg(core_if));
+	addr = &core_if->core_global_regs->hptxfsiz;
+	DWC_PRINTF("HPTXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	if (core_if->en_multiple_tx_fifo == 0) {
+		ep_num = core_if->hwcfg4.b.num_dev_perio_in_ep;
+		txfsiz = "DPTXFSIZ";
+	} else {
+		ep_num = core_if->hwcfg4.b.num_in_eps;
+		txfsiz = "DIENPTXF";
+	}
+	for (i = 0; i < ep_num; i++) {
+		addr = &core_if->core_global_regs->dtxfsiz[i];
+		DWC_PRINTF("%s[%d] @0x%08lX : 0x%08X\n", txfsiz, i + 1,
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+	addr = core_if->pcgcctl;
+	DWC_PRINTF("PCGCCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+}
+
+/**
+ * Flush a Tx FIFO.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param num Tx FIFO to flush.
+ */
+void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * core_if, const int num)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	volatile grstctl_t greset = {.d32 = 0 };
+	int count = 0;
+
+	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "Flush Tx FIFO %d\n", num);
+
+	greset.b.txfflsh = 1;
+	greset.b.txfnum = num;
+	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
+
+	do {
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 10000) {
+			DWC_WARN("%s() HANG! GRSTCTL=%0x GNPTXSTS=0x%08x\n",
+				 __func__, greset.d32,
+				 DWC_READ_REG32(&global_regs->gnptxsts));
+			break;
+		}
+		dwc_udelay(1);
+	} while (greset.b.txfflsh == 1);
+
+	/* Wait for 3 PHY Clocks */
+	dwc_udelay(1);
+}
+
+/**
+ * Flush Rx FIFO.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	volatile grstctl_t greset = {.d32 = 0 };
+	int count = 0;
+
+	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "%s\n", __func__);
+	/*
+	 *
+	 */
+	greset.b.rxfflsh = 1;
+	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
+
+	do {
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 10000) {
+			DWC_WARN("%s() HANG! GRSTCTL=%0x\n", __func__,
+				 greset.d32);
+			break;
+		}
+		dwc_udelay(1);
+	} while (greset.b.rxfflsh == 1);
+
+	/* Wait for 3 PHY Clocks */
+	dwc_udelay(1);
+}
+
+/**
+ * Do core a soft reset of the core.  Be careful with this because it
+ * resets all the internal state machines of the core.
+ */
+void dwc_otg_core_reset(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	volatile grstctl_t greset = {.d32 = 0 };
+	int count = 0;
+
+	DWC_DEBUGPL(DBG_CILV, "%s\n", __func__);
+	/* Wait for AHB master IDLE state. */
+	do {
+		dwc_udelay(10);
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 100000) {
+			DWC_WARN("%s() HANG! AHB Idle GRSTCTL=%0x\n", __func__,
+				 greset.d32);
+			return;
+		}
+	}
+	while (greset.b.ahbidle == 0);
+
+	/* Core Soft Reset */
+	count = 0;
+	greset.b.csftrst = 1;
+	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
+	do {
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 10000) {
+			DWC_WARN("%s() HANG! Soft Reset GRSTCTL=%0x\n",
+				 __func__, greset.d32);
+			break;
+		}
+		dwc_udelay(1);
+	}
+	while (greset.b.csftrst == 1);
+
+	/* Wait for 3 PHY Clocks */
+	dwc_mdelay(100);
+}
+
+uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if)
+{
+	return (dwc_otg_mode(_core_if) != DWC_HOST_MODE);
+}
+
+uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if)
+{
+	return (dwc_otg_mode(_core_if) == DWC_HOST_MODE);
+}
+
+/**
+ * Register HCD callbacks. The callbacks are used to start and stop
+ * the HCD for interrupt processing.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param cb the HCD callback structure.
+ * @param p pointer to be passed to callback function (usb_hcd*).
+ */
+void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * core_if,
+					dwc_otg_cil_callbacks_t * cb, void *p)
+{
+	core_if->hcd_cb = cb;
+	cb->p = p;
+}
+
+/**
+ * Register PCD callbacks. The callbacks are used to start and stop
+ * the PCD for interrupt processing.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param cb the PCD callback structure.
+ * @param p pointer to be passed to callback function (pcd*).
+ */
+void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * core_if,
+					dwc_otg_cil_callbacks_t * cb, void *p)
+{
+	core_if->pcd_cb = cb;
+	cb->p = p;
+}
+
+#ifdef DWC_EN_ISOC
+
+/**
+ * This function writes isoc data per 1 (micro)frame into tx fifo
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void write_isoc_frame_data(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	dtxfsts_data_t txstatus = {.d32 = 0 };
+	uint32_t len = 0;
+	uint32_t dwords;
+
+	ep->xfer_len = ep->data_per_frame;
+	ep->xfer_count = 0;
+
+	ep_regs = core_if->dev_if->in_ep_regs[ep->num];
+
+	len = ep->xfer_len - ep->xfer_count;
+
+	if (len > ep->maxpacket) {
+		len = ep->maxpacket;
+	}
+
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 =
+	    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dtxfsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", ep->num, txstatus.d32);
+
+	while (txstatus.b.txfspcavail > dwords &&
+	       ep->xfer_count < ep->xfer_len && ep->xfer_len != 0) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, ep, 0);
+
+		len = ep->xfer_len - ep->xfer_count;
+		if (len > ep->maxpacket) {
+			len = ep->maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+				   dtxfsts);
+		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", ep->num,
+			    txstatus.d32);
+	}
+}
+
+/**
+ * This function initializes a descriptor chain for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
+				       dwc_ep_t * ep)
+{
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dsts_data_t dsts = {.d32 = 0 };
+	volatile uint32_t *addr;
+
+	if (ep->is_in) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+	}
+
+	ep->xfer_len = ep->data_per_frame;
+	ep->xfer_count = 0;
+	ep->xfer_buff = ep->cur_pkt_addr;
+	ep->dma_addr = ep->cur_pkt_dma_addr;
+
+	if (ep->is_in) {
+		/* Program the transfer size and packet count
+		 *      as follows: xfersize = N * maxpacket +
+		 *      short_packet pktcnt = N + (short_packet
+		 *      exist ? 1 : 0)
+		 */
+		deptsiz.b.xfersize = ep->xfer_len;
+		deptsiz.b.pktcnt =
+		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
+		deptsiz.b.mc = deptsiz.b.pktcnt;
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dieptsiz,
+				deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->in_ep_regs[ep->num]->
+					 diepdma), (uint32_t) ep->dma_addr);
+		}
+	} else {
+		deptsiz.b.pktcnt =
+		    (ep->xfer_len + (ep->maxpacket - 1)) / ep->maxpacket;
+		deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
+
+		DWC_WRITE_REG32(&core_if->dev_if->
+				out_ep_regs[ep->num]->doeptsiz, deptsiz.d32);
+
+		if (core_if->dma_enable) {
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->
+					 out_ep_regs[ep->num]->doepdma),
+					(uint32_t) ep->dma_addr);
+		}
+	}
+
+	/** Enable endpoint, clear nak  */
+
+	depctl.d32 = 0;
+	if (ep->bInterval == 1) {
+		dsts.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+		ep->next_frame = dsts.b.soffn + ep->bInterval;
+
+		if (ep->next_frame & 0x1) {
+			depctl.b.setd1pid = 1;
+		} else {
+			depctl.b.setd0pid = 1;
+		}
+	} else {
+		ep->next_frame += ep->bInterval;
+
+		if (ep->next_frame & 0x1) {
+			depctl.b.setd1pid = 1;
+		} else {
+			depctl.b.setd0pid = 1;
+		}
+	}
+	depctl.b.epena = 1;
+	depctl.b.cnak = 1;
+
+	DWC_MODIFY_REG32(addr, 0, depctl.d32);
+	depctl.d32 = DWC_READ_REG32(addr);
+
+	if (ep->is_in && core_if->dma_enable == 0) {
+		write_isoc_frame_data(core_if, ep);
+	}
+
+}
+#endif /* DWC_EN_ISOC */
+
+static void dwc_otg_set_uninitialized(int32_t * p, int size)
+{
+	int i;
+	for (i = 0; i < size; i++) {
+		p[i] = -1;
+	}
+}
+
+static int dwc_otg_param_initialized(int32_t val)
+{
+	return val != -1;
+}
+
+static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	core_if->core_params = DWC_ALLOC(sizeof(*core_if->core_params));
+	if (!core_if->core_params) {
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_otg_set_uninitialized((int32_t *) core_if->core_params,
+				  sizeof(*core_if->core_params) /
+				  sizeof(int32_t));
+	DWC_PRINTF("Setting default values for core params\n");
+	dwc_otg_set_param_otg_cap(core_if, dwc_param_otg_cap_default);
+	dwc_otg_set_param_dma_enable(core_if, dwc_param_dma_enable_default);
+	dwc_otg_set_param_dma_desc_enable(core_if,
+					  dwc_param_dma_desc_enable_default);
+	dwc_otg_set_param_opt(core_if, dwc_param_opt_default);
+	dwc_otg_set_param_dma_burst_size(core_if,
+					 dwc_param_dma_burst_size_default);
+	dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
+						       dwc_param_host_support_fs_ls_low_power_default);
+	dwc_otg_set_param_enable_dynamic_fifo(core_if,
+					      dwc_param_enable_dynamic_fifo_default);
+	dwc_otg_set_param_data_fifo_size(core_if,
+					 dwc_param_data_fifo_size_default);
+	dwc_otg_set_param_dev_rx_fifo_size(core_if,
+					   dwc_param_dev_rx_fifo_size_default);
+	dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
+						  dwc_param_dev_nperio_tx_fifo_size_default);
+	dwc_otg_set_param_host_rx_fifo_size(core_if,
+					    dwc_param_host_rx_fifo_size_default);
+	dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
+						   dwc_param_host_nperio_tx_fifo_size_default);
+	dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
+						  dwc_param_host_perio_tx_fifo_size_default);
+	dwc_otg_set_param_max_transfer_size(core_if,
+					    dwc_param_max_transfer_size_default);
+	dwc_otg_set_param_max_packet_count(core_if,
+					   dwc_param_max_packet_count_default);
+	dwc_otg_set_param_host_channels(core_if,
+					dwc_param_host_channels_default);
+	dwc_otg_set_param_dev_endpoints(core_if,
+					dwc_param_dev_endpoints_default);
+	dwc_otg_set_param_phy_type(core_if, dwc_param_phy_type_default);
+	dwc_otg_set_param_speed(core_if, dwc_param_speed_default);
+	dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
+						    dwc_param_host_ls_low_power_phy_clk_default);
+	dwc_otg_set_param_phy_ulpi_ddr(core_if, dwc_param_phy_ulpi_ddr_default);
+	dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
+					    dwc_param_phy_ulpi_ext_vbus_default);
+	dwc_otg_set_param_phy_utmi_width(core_if,
+					 dwc_param_phy_utmi_width_default);
+	dwc_otg_set_param_ts_dline(core_if, dwc_param_ts_dline_default);
+	dwc_otg_set_param_i2c_enable(core_if, dwc_param_i2c_enable_default);
+	dwc_otg_set_param_ulpi_fs_ls(core_if, dwc_param_ulpi_fs_ls_default);
+	dwc_otg_set_param_en_multiple_tx_fifo(core_if,
+					      dwc_param_en_multiple_tx_fifo_default);
+	for (i = 0; i < 15; i++) {
+		dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
+							 dwc_param_dev_perio_tx_fifo_size_default,
+							 i);
+	}
+
+	for (i = 0; i < 15; i++) {
+		dwc_otg_set_param_dev_tx_fifo_size(core_if,
+						   dwc_param_dev_tx_fifo_size_default,
+						   i);
+	}
+	dwc_otg_set_param_thr_ctl(core_if, dwc_param_thr_ctl_default);
+	dwc_otg_set_param_mpi_enable(core_if, dwc_param_mpi_enable_default);
+	dwc_otg_set_param_pti_enable(core_if, dwc_param_pti_enable_default);
+	dwc_otg_set_param_lpm_enable(core_if, dwc_param_lpm_enable_default);
+	dwc_otg_set_param_ic_usb_cap(core_if, dwc_param_ic_usb_cap_default);
+	dwc_otg_set_param_tx_thr_length(core_if,
+					dwc_param_tx_thr_length_default);
+	dwc_otg_set_param_rx_thr_length(core_if,
+					dwc_param_rx_thr_length_default);
+	dwc_otg_set_param_ahb_thr_ratio(core_if,
+					dwc_param_ahb_thr_ratio_default);
+	dwc_otg_set_param_power_down(core_if, dwc_param_power_down_default);
+	dwc_otg_set_param_reload_ctl(core_if, dwc_param_reload_ctl_default);
+	dwc_otg_set_param_dev_out_nak(core_if, dwc_param_dev_out_nak_default);
+	dwc_otg_set_param_cont_on_bna(core_if, dwc_param_cont_on_bna_default);
+	dwc_otg_set_param_ahb_single(core_if, dwc_param_ahb_single_default);
+	dwc_otg_set_param_otg_ver(core_if, dwc_param_otg_ver_default);
+	dwc_otg_set_param_adp_enable(core_if, dwc_param_adp_enable_default);
+	DWC_PRINTF("Finished setting default values for core params\n");
+
+	return 0;
+}
+
+uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->dma_enable;
+}
+
+/* Checks if the parameter is outside of its valid range of values */
+#define DWC_OTG_PARAM_TEST(_param_, _low_, _high_) \
+		(((_param_) < (_low_)) || \
+		((_param_) > (_high_)))
+
+/* Parameter access functions */
+int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int valid;
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
+		DWC_WARN("Wrong value for otg_cap parameter\n");
+		DWC_WARN("otg_cap parameter must be 0,1 or 2\n");
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	valid = 1;
+	switch (val) {
+	case DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE:
+		if (core_if->hwcfg2.b.op_mode !=
+		    DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+			valid = 0;
+		break;
+	case DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE:
+		if ((core_if->hwcfg2.b.op_mode !=
+		     DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+		    && (core_if->hwcfg2.b.op_mode !=
+			DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
+		    && (core_if->hwcfg2.b.op_mode !=
+			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
+		    && (core_if->hwcfg2.b.op_mode !=
+			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) {
+			valid = 0;
+		}
+		break;
+	case DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE:
+		/* always valid */
+		break;
+	}
+	if (!valid) {
+		if (dwc_otg_param_initialized(core_if->core_params->otg_cap)) {
+			DWC_ERROR
+			    ("%d invalid for otg_cap paremter. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (((core_if->hwcfg2.b.op_mode ==
+		       DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+		      || (core_if->hwcfg2.b.op_mode ==
+			  DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
+		      || (core_if->hwcfg2.b.op_mode ==
+			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
+		      || (core_if->hwcfg2.b.op_mode ==
+			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) ?
+		     DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE :
+		     DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->otg_cap = val;
+out:
+	return retval;
+}
+
+int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->otg_cap;
+}
+
+int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for opt parameter\n");
+		return -DWC_E_INVALID;
+	}
+	core_if->core_params->opt = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->opt;
+}
+
+int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for dma enable\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->hwcfg2.b.architecture == 0)) {
+		if (dwc_otg_param_initialized(core_if->core_params->dma_enable)) {
+			DWC_ERROR
+			    ("%d invalid for dma_enable paremter. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dma_enable = val;
+	if (val == 0) {
+		dwc_otg_set_param_dma_desc_enable(core_if, 0);
+	}
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dma_enable;
+}
+
+int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for dma_enable\n");
+		DWC_WARN("dma_desc_enable must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1)
+	    && ((dwc_otg_get_param_dma_enable(core_if) == 0)
+		|| (core_if->hwcfg4.b.desc_dma == 0))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dma_desc_enable)) {
+			DWC_ERROR
+			    ("%d invalid for dma_desc_enable paremter. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+	core_if->core_params->dma_desc_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dma_desc_enable;
+}
+
+int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t * core_if,
+						   int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for host_support_fs_low_power\n");
+		DWC_WARN("host_support_fs_low_power must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+	core_if->core_params->host_support_fs_ls_low_power = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
+						       core_if)
+{
+	return core_if->core_params->host_support_fs_ls_low_power;
+}
+
+int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
+					  int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for enable_dynamic_fifo\n");
+		DWC_WARN("enable_dynamic_fifo must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->hwcfg2.b.dynamic_fifo == 0)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->enable_dynamic_fifo)) {
+			DWC_ERROR
+			    ("%d invalid for enable_dynamic_fifo paremter. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+	core_if->core_params->enable_dynamic_fifo = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->enable_dynamic_fifo;
+}
+
+int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 32, 32768)) {
+		DWC_WARN("Wrong value for data_fifo_size\n");
+		DWC_WARN("data_fifo_size must be 32-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > core_if->hwcfg3.b.dfifo_depth) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->data_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for data_fifo_size parameter. Check HW configuration.\n",
+			     val);
+		}
+		val = core_if->hwcfg3.b.dfifo_depth;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->data_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->data_fifo_size;
+}
+
+int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for dev_rx_fifo_size\n");
+		DWC_WARN("dev_rx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
+		if (dwc_otg_param_initialized(core_if->core_params->dev_rx_fifo_size)) {
+		DWC_WARN("%d invalid for dev_rx_fifo_size parameter\n", val);
+		}
+		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_rx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_rx_fifo_size;
+}
+
+int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for dev_nperio_tx_fifo\n");
+		DWC_WARN("dev_nperio_tx_fifo must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_nperio_tx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for dev_nperio_tx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
+		     16);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_nperio_tx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_nperio_tx_fifo_size;
+}
+
+int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
+					int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for host_rx_fifo_size\n");
+		DWC_WARN("host_rx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_rx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for host_rx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_rx_fifo_size = val;
+	return retval;
+
+}
+
+int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_rx_fifo_size;
+}
+
+int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					       int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for host_nperio_tx_fifo_size\n");
+		DWC_WARN("host_nperio_tx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_nperio_tx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for host_nperio_tx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
+		     16);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_nperio_tx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_nperio_tx_fifo_size;
+}
+
+int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for host_perio_tx_fifo_size\n");
+		DWC_WARN("host_perio_tx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > ((core_if->hptxfsiz.d32) >> 16)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_perio_tx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for host_perio_tx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val = (core_if->hptxfsiz.d32) >> 16;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_perio_tx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_perio_tx_fifo_size;
+}
+
+int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
+					int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 2047, 524288)) {
+		DWC_WARN("Wrong value for max_transfer_size\n");
+		DWC_WARN("max_transfer_size must be 2047-524288\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val >= (1 << (core_if->hwcfg3.b.xfer_size_cntr_width + 11))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->max_transfer_size)) {
+			DWC_ERROR
+			    ("%d invalid for max_transfer_size. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 11)) -
+		     1);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->max_transfer_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->max_transfer_size;
+}
+
+int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 15, 511)) {
+		DWC_WARN("Wrong value for max_packet_count\n");
+		DWC_WARN("max_packet_count must be 15-511\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->max_packet_count)) {
+			DWC_ERROR
+			    ("%d invalid for max_packet_count. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4)) - 1);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->max_packet_count = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->max_packet_count;
+}
+
+int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 1, 16)) {
+		DWC_WARN("Wrong value for host_channels\n");
+		DWC_WARN("host_channels must be 1-16\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (core_if->hwcfg2.b.num_host_chan + 1)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_channels)) {
+			DWC_ERROR
+			    ("%d invalid for host_channels. Check HW configurations.\n",
+			     val);
+		}
+		val = (core_if->hwcfg2.b.num_host_chan + 1);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_channels = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_channels;
+}
+
+int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 1, 15)) {
+		DWC_WARN("Wrong value for dev_endpoints\n");
+		DWC_WARN("dev_endpoints must be 1-15\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (core_if->hwcfg2.b.num_dev_ep)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_endpoints)) {
+			DWC_ERROR
+			    ("%d invalid for dev_endpoints. Check HW configurations.\n",
+			     val);
+		}
+		val = core_if->hwcfg2.b.num_dev_ep;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_endpoints = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_endpoints;
+}
+
+int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
+		DWC_WARN("Wrong value for phy_type\n");
+		DWC_WARN("phy_type must be 0,1 or 2\n");
+		return -DWC_E_INVALID;
+	}
+#ifndef NO_FS_PHY_HW_CHECKS
+	if ((val == DWC_PHY_TYPE_PARAM_UTMI) &&
+	    ((core_if->hwcfg2.b.hs_phy_type == 1) ||
+	     (core_if->hwcfg2.b.hs_phy_type == 3))) {
+		valid = 1;
+	} else if ((val == DWC_PHY_TYPE_PARAM_ULPI) &&
+		   ((core_if->hwcfg2.b.hs_phy_type == 2) ||
+		    (core_if->hwcfg2.b.hs_phy_type == 3))) {
+		valid = 1;
+	} else if ((val == DWC_PHY_TYPE_PARAM_FS) &&
+		   (core_if->hwcfg2.b.fs_phy_type == 1)) {
+		valid = 1;
+	}
+	if (!valid) {
+		if (dwc_otg_param_initialized(core_if->core_params->phy_type)) {
+			DWC_ERROR
+			    ("%d invalid for phy_type. Check HW configurations.\n",
+			     val);
+		}
+		if (core_if->hwcfg2.b.hs_phy_type) {
+			if ((core_if->hwcfg2.b.hs_phy_type == 3) ||
+			    (core_if->hwcfg2.b.hs_phy_type == 1)) {
+				val = DWC_PHY_TYPE_PARAM_UTMI;
+			} else {
+				val = DWC_PHY_TYPE_PARAM_ULPI;
+			}
+		}
+		retval = -DWC_E_INVALID;
+	}
+#endif
+	core_if->core_params->phy_type = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_type;
+}
+
+int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for speed parameter\n");
+		DWC_WARN("max_speed parameter must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+	if ((val == 0)
+	    && dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS) {
+		if (dwc_otg_param_initialized(core_if->core_params->speed)) {
+			DWC_ERROR
+			    ("%d invalid for speed paremter. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (dwc_otg_get_param_phy_type(core_if) ==
+		     DWC_PHY_TYPE_PARAM_FS ? 1 : 0);
+		retval = -DWC_E_INVALID;
+	}
+	core_if->core_params->speed = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->speed;
+}
+
+int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if,
+						int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN
+		    ("Wrong value for host_ls_low_power_phy_clk parameter\n");
+		DWC_WARN("host_ls_low_power_phy_clk must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ)
+	    && (dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_ls_low_power_phy_clk)) {
+			DWC_ERROR
+			    ("%d invalid for host_ls_low_power_phy_clk. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (dwc_otg_get_param_phy_type(core_if) ==
+		     DWC_PHY_TYPE_PARAM_FS) ?
+		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ :
+		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_ls_low_power_phy_clk = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_ls_low_power_phy_clk;
+}
+
+int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for phy_ulpi_ddr\n");
+		DWC_WARN("phy_upli_ddr must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->phy_ulpi_ddr = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_ulpi_ddr;
+}
+
+int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
+					int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for phy_ulpi_ext_vbus\n");
+		DWC_WARN("phy_ulpi_ext_vbus must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->phy_ulpi_ext_vbus = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_ulpi_ext_vbus;
+}
+
+int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 8, 8) && DWC_OTG_PARAM_TEST(val, 16, 16)) {
+		DWC_WARN("Wrong valaue for phy_utmi_width\n");
+		DWC_WARN("phy_utmi_width must be 8 or 16\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->phy_utmi_width = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_utmi_width;
+}
+
+int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for ulpi_fs_ls\n");
+		DWC_WARN("ulpi_fs_ls must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->ulpi_fs_ls = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ulpi_fs_ls;
+}
+
+int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for ts_dline\n");
+		DWC_WARN("ts_dline must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->ts_dline = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ts_dline;
+}
+
+int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for i2c_enable\n");
+		DWC_WARN("i2c_enable must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+#ifndef NO_FS_PHY_HW_CHECK
+	if (val == 1 && core_if->hwcfg3.b.i2c == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->i2c_enable)) {
+			DWC_ERROR
+			    ("%d invalid for i2c_enable. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+#endif
+
+	core_if->core_params->i2c_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->i2c_enable;
+}
+
+int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					     int32_t val, int fifo_num)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
+		DWC_WARN("Wrong value for dev_perio_tx_fifo_size\n");
+		DWC_WARN("dev_perio_tx_fifo_size must be 4-768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val >
+	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_perio_tx_fifo_size[fifo_num])) {
+			DWC_ERROR
+			    ("`%d' invalid for parameter `dev_perio_fifo_size_%d'. Check HW configuration.\n",
+			     val, fifo_num);
+		}
+		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_perio_tx_fifo_size[fifo_num] = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+						 int fifo_num)
+{
+	return core_if->core_params->dev_perio_tx_fifo_size[fifo_num];
+}
+
+int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
+					  int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for en_multiple_tx_fifo,\n");
+		DWC_WARN("en_multiple_tx_fifo must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val == 1 && core_if->hwcfg4.b.ded_fifo_en == 0) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->en_multiple_tx_fifo)) {
+			DWC_ERROR
+			    ("%d invalid for parameter en_multiple_tx_fifo. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->en_multiple_tx_fifo = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->en_multiple_tx_fifo;
+}
+
+int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val,
+				       int fifo_num)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
+		DWC_WARN("Wrong value for dev_tx_fifo_size\n");
+		DWC_WARN("dev_tx_fifo_size must be 4-768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val >
+	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_tx_fifo_size[fifo_num])) {
+			DWC_ERROR
+			    ("`%d' invalid for parameter `dev_tx_fifo_size_%d'. Check HW configuration.\n",
+			     val, fifo_num);
+		}
+		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_tx_fifo_size[fifo_num] = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					   int fifo_num)
+{
+	return core_if->core_params->dev_tx_fifo_size[fifo_num];
+}
+
+int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 7)) {
+		DWC_WARN("Wrong value for thr_ctl\n");
+		DWC_WARN("thr_ctl must be 0-7\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val != 0) &&
+	    (!dwc_otg_get_param_dma_enable(core_if) ||
+	     !core_if->hwcfg4.b.ded_fifo_en)) {
+		if (dwc_otg_param_initialized(core_if->core_params->thr_ctl)) {
+			DWC_ERROR
+			    ("%d invalid for parameter thr_ctl. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->thr_ctl = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_thr_ctl(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->thr_ctl;
+}
+
+int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for lpm_enable\n");
+		DWC_WARN("lpm_enable must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val && !core_if->hwcfg3.b.otg_lpm_en) {
+		if (dwc_otg_param_initialized(core_if->core_params->lpm_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter lpm_enable. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->lpm_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->lpm_enable;
+}
+
+int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
+		DWC_WARN("Wrong valaue for tx_thr_length\n");
+		DWC_WARN("tx_thr_length must be 8 - 128\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->tx_thr_length = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_tx_thr_length(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->tx_thr_length;
+}
+
+int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
+		DWC_WARN("Wrong valaue for rx_thr_length\n");
+		DWC_WARN("rx_thr_length must be 8 - 128\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->rx_thr_length = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_rx_thr_length(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->rx_thr_length;
+}
+
+int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 1, 1) &&
+	    DWC_OTG_PARAM_TEST(val, 4, 4) &&
+	    DWC_OTG_PARAM_TEST(val, 8, 8) &&
+	    DWC_OTG_PARAM_TEST(val, 16, 16) &&
+	    DWC_OTG_PARAM_TEST(val, 32, 32) &&
+	    DWC_OTG_PARAM_TEST(val, 64, 64) &&
+	    DWC_OTG_PARAM_TEST(val, 128, 128) &&
+	    DWC_OTG_PARAM_TEST(val, 256, 256)) {
+		DWC_WARN("`%d' invalid for parameter `dma_burst_size'\n", val);
+		return -DWC_E_INVALID;
+	}
+	core_if->core_params->dma_burst_size = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dma_burst_size;
+}
+
+int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `pti_enable'\n", val);
+		return -DWC_E_INVALID;
+	}
+	if (val && (core_if->snpsid < OTG_CORE_REV_2_72a)) {
+		if (dwc_otg_param_initialized(core_if->core_params->pti_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter pti_enable. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->pti_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->pti_enable;
+}
+
+int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `mpi_enable'\n", val);
+		return -DWC_E_INVALID;
+	}
+	if (val && (core_if->hwcfg2.b.multi_proc_int == 0)) {
+		if (dwc_otg_param_initialized(core_if->core_params->mpi_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter mpi_enable. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->mpi_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->mpi_enable;
+}
+
+int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `adp_enable'\n", val);
+		return -DWC_E_INVALID;
+	}
+	if (val && (core_if->hwcfg3.b.adp_supp == 0)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->adp_supp_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter adp_enable. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->adp_supp_enable = val;
+	/*Set OTG version 2.0 in case of enabling ADP*/
+	if (val)
+		dwc_otg_set_param_otg_ver(core_if, 1);
+
+	return retval;
+}
+
+int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->adp_supp_enable;
+}
+
+int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `ic_usb_cap'\n", val);
+		DWC_WARN("ic_usb_cap must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val && (core_if->hwcfg2.b.otg_enable_ic_usb == 0)) {
+		if (dwc_otg_param_initialized(core_if->core_params->ic_usb_cap)) {
+			DWC_ERROR
+			    ("%d invalid for parameter ic_usb_cap. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->ic_usb_cap = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ic_usb_cap;
+}
+
+int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
+		DWC_WARN("`%d' invalid for parameter `ahb_thr_ratio'\n", val);
+		DWC_WARN("ahb_thr_ratio must be 0 - 3\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val
+	    && (core_if->snpsid < OTG_CORE_REV_2_81a
+		|| !dwc_otg_get_param_thr_ctl(core_if))) {
+		valid = 0;
+	} else if (val
+		   && ((dwc_otg_get_param_tx_thr_length(core_if) / (1 << val)) <
+		       4)) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->ahb_thr_ratio)) {
+			DWC_ERROR
+			    ("%d invalid for parameter ahb_thr_ratio. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+
+	core_if->core_params->ahb_thr_ratio = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ahb_thr_ratio;
+}
+
+int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+	hwcfg4_data_t hwcfg4 = {.d32 = 0 };
+	hwcfg4.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
+		DWC_WARN("`%d' invalid for parameter `power_down'\n", val);
+		DWC_WARN("power_down must be 0 - 2\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 2) && (core_if->snpsid < OTG_CORE_REV_2_91a)) {
+		valid = 0;
+	}
+	if ((val == 3)
+	    && ((core_if->snpsid < OTG_CORE_REV_3_00a)
+		|| (hwcfg4.b.xhiber == 0))) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->power_down)) {
+			DWC_ERROR
+			    ("%d invalid for parameter power_down. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->power_down = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->power_down;
+}
+
+int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `reload_ctl'\n", val);
+		DWC_WARN("reload_ctl must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_92a)) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->reload_ctl)) {
+			DWC_ERROR("%d invalid for parameter reload_ctl."
+				  "Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->reload_ctl = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->reload_ctl;
+}
+
+int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `dev_out_nak'\n", val);
+		DWC_WARN("dev_out_nak must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_93a) ||
+		!(core_if->core_params->dma_desc_enable))) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->dev_out_nak)) {
+			DWC_ERROR("%d invalid for parameter dev_out_nak."
+				"Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->dev_out_nak = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_out_nak;
+}
+
+int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `cont_on_bna'\n", val);
+		DWC_WARN("cont_on_bna must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_94a) ||
+		!(core_if->core_params->dma_desc_enable))) {
+			valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->cont_on_bna)) {
+			DWC_ERROR("%d invalid for parameter cont_on_bna."
+				"Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->cont_on_bna = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->cont_on_bna;
+}
+
+int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `ahb_single'\n", val);
+		DWC_WARN("ahb_single must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
+			valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->ahb_single)) {
+			DWC_ERROR("%d invalid for parameter ahb_single."
+				"Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->ahb_single = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ahb_single;
+}
+
+int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `otg_ver'\n", val);
+		DWC_WARN
+		    ("otg_ver must be 0(for OTG 1.3 support) or 1(for OTG 2.0 support)\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->otg_ver = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->otg_ver;
+}
+
+uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if)
+{
+	gotgctl_data_t otgctl;
+	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	return otgctl.b.hstnegscs;
+}
+
+uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if)
+{
+	gotgctl_data_t otgctl;
+	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	return otgctl.b.sesreqscs;
+}
+
+void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	if(core_if->otg_ver == 0) {
+		gotgctl_data_t otgctl;
+		otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+		otgctl.b.hnpreq = val;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, otgctl.d32);
+	} else {
+		core_if->otg_sts = val;
+	}
+}
+
+uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if)
+{
+	return core_if->snpsid;
+}
+
+uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	return gintsts.b.curmode;
+}
+
+uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	return usbcfg.b.hnpcap;
+}
+
+void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	usbcfg.b.hnpcap = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
+}
+
+uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	return usbcfg.b.srpcap;
+}
+
+void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	usbcfg.b.srpcap = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
+}
+
+uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if)
+{
+	dcfg_data_t dcfg;
+	/* originally: dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg); */
+
+        dcfg.d32 = -1; //GRAYG
+        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)\n", __func__, core_if);
+        if (NULL == core_if)
+                DWC_ERROR("reg request with NULL core_if\n");
+        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)\n", __func__,
+                    core_if, core_if->dev_if);
+        if (NULL == core_if->dev_if)
+                DWC_ERROR("reg request with NULL dev_if\n");
+        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)->"
+                    "dev_global_regs(%p)\n", __func__,
+                    core_if, core_if->dev_if,
+                    core_if->dev_if->dev_global_regs);
+        if (NULL == core_if->dev_if->dev_global_regs)
+                DWC_ERROR("reg request with NULL dev_global_regs\n");
+        else {
+                DWC_DEBUGPL(DBG_CILV, "%s - &core_if(%p)->dev_if(%p)->"
+                            "dev_global_regs(%p)->dcfg = %p\n", __func__,
+                            core_if, core_if->dev_if,
+                            core_if->dev_if->dev_global_regs,
+                            &core_if->dev_if->dev_global_regs->dcfg);
+		dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+        }
+	return dcfg.b.devspd;
+}
+
+void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	dcfg_data_t dcfg;
+	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+	dcfg.b.devspd = val;
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
+}
+
+uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	return hprt0.b.prtconnsts;
+}
+
+uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+	return dsts.b.enumspd;
+}
+
+uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	return hprt0.b.prtpwr;
+
+}
+
+uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if)
+{
+	return core_if->hibernation_suspend;
+}
+
+void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtpwr = val;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+}
+
+uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	return hprt0.b.prtsusp;
+
+}
+
+void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtsusp = val;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+}
+
+uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if)
+{
+	hfir_data_t hfir;
+	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
+	return hfir.b.frint;
+
+}
+
+void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hfir_data_t hfir;
+	uint32_t fram_int;
+	fram_int = calc_frame_interval(core_if);
+	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
+	if (!core_if->core_params->reload_ctl) {
+		DWC_WARN("\nCannot reload HFIR register.HFIR.HFIRRldCtrl bit is"
+			 "not set to 1.\nShould load driver with reload_ctl=1"
+			 " module parameter\n");
+		return;
+	}
+	switch (fram_int) {
+	case 3750:
+		if ((val < 3350) || (val > 4150)) {
+			DWC_WARN("HFIR interval for HS core and 30 MHz"
+				 "clock freq should be from 3350 to 4150\n");
+			return;
+		}
+		break;
+	case 30000:
+		if ((val < 26820) || (val > 33180)) {
+			DWC_WARN("HFIR interval for FS/LS core and 30 MHz"
+				 "clock freq should be from 26820 to 33180\n");
+			return;
+		}
+		break;
+	case 6000:
+		if ((val < 5360) || (val > 6640)) {
+			DWC_WARN("HFIR interval for HS core and 48 MHz"
+				 "clock freq should be from 5360 to 6640\n");
+			return;
+		}
+		break;
+	case 48000:
+		if ((val < 42912) || (val > 53088)) {
+			DWC_WARN("HFIR interval for FS/LS core and 48 MHz"
+				 "clock freq should be from 42912 to 53088\n");
+			return;
+		}
+		break;
+	case 7500:
+		if ((val < 6700) || (val > 8300)) {
+			DWC_WARN("HFIR interval for HS core and 60 MHz"
+				 "clock freq should be from 6700 to 8300\n");
+			return;
+		}
+		break;
+	case 60000:
+		if ((val < 53640) || (val > 65536)) {
+			DWC_WARN("HFIR interval for FS/LS core and 60 MHz"
+				 "clock freq should be from 53640 to 65536\n");
+			return;
+		}
+		break;
+	default:
+		DWC_WARN("Unknown frame interval\n");
+		return;
+		break;
+
+	}
+	hfir.b.frint = val;
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hfir.d32);
+}
+
+uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if)
+{
+	hcfg_data_t hcfg;
+	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	return hcfg.b.modechtimen;
+
+}
+
+void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hcfg_data_t hcfg;
+	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	hcfg.b.modechtimen = val;
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+}
+
+void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtres = val;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+}
+
+uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if)
+{
+	dctl_data_t dctl;
+	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	return dctl.b.rmtwkupsig;
+}
+
+uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+
+	DWC_ASSERT(!
+		   ((core_if->lx_state == DWC_OTG_L1) ^ lpmcfg.b.prt_sleep_sts),
+		   "lx_state = %d, lmpcfg.prt_sleep_sts = %d\n",
+		   core_if->lx_state, lpmcfg.b.prt_sleep_sts);
+
+	return lpmcfg.b.prt_sleep_sts;
+}
+
+uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.rem_wkup_en;
+}
+
+uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.appl_resp;
+}
+
+void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.appl_resp = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+}
+
+uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.hsic_connect;
+}
+
+void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.hsic_connect = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+}
+
+uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.inv_sel_hsic;
+
+}
+
+void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.inv_sel_hsic = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+}
+
+uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+}
+
+void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, val);
+}
+
+uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+}
+
+void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, val);
+}
+
+uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+}
+
+void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, val);
+}
+
+uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
+}
+
+void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz, val);
+}
+
+uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gpvndctl);
+}
+
+void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gpvndctl, val);
+}
+
+uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->ggpio);
+}
+
+void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, val);
+}
+
+uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(core_if->host_if->hprt0);
+
+}
+
+void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(core_if->host_if->hprt0, val);
+}
+
+uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->guid);
+}
+
+void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->guid, val);
+}
+
+uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
+}
+
+uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if)
+{
+	return ((core_if->otg_ver == 1) ? (uint16_t)0x0200 : (uint16_t)0x0103);
+}
+
+/**
+ * Start the SRP timer to detect when the SRP does not complete within
+ * 6 seconds.
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+void dwc_otg_pcd_start_srp_timer(dwc_otg_core_if_t * core_if)
+{
+	core_if->srp_timer_started = 1;
+	DWC_TIMER_SCHEDULE(core_if->srp_timer, 6000 /* 6 secs */ );
+}
+
+void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if)
+{
+	uint32_t *addr = (uint32_t *) & (core_if->core_global_regs->gotgctl);
+	gotgctl_data_t mem;
+	gotgctl_data_t val;
+
+	val.d32 = DWC_READ_REG32(addr);
+	if (val.b.sesreq) {
+		DWC_ERROR("Session Request Already active!\n");
+		return;
+	}
+
+	DWC_INFO("Session Request Initated\n");	//NOTICE
+	mem.d32 = DWC_READ_REG32(addr);
+	mem.b.sesreq = 1;
+	DWC_WRITE_REG32(addr, mem.d32);
+
+	/* Start the SRP timer */
+	dwc_otg_pcd_start_srp_timer(core_if);
+	return;
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil.h b/drivers/usb/host/dwc_otg/dwc_otg_cil.h
new file mode 100644
index 0000000000000..79dbf8374f023
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.h
@@ -0,0 +1,1464 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.h $
+ * $Revision: #123 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_CIL_H__)
+#define __DWC_CIL_H__
+
+#include "dwc_list.h"
+#include "dwc_otg_dbg.h"
+#include "dwc_otg_regs.h"
+
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_adp.h"
+
+/**
+ * @file
+ * This file contains the interface to the Core Interface Layer.
+ */
+
+#ifdef DWC_UTE_CFI
+
+#define MAX_DMA_DESCS_PER_EP	256
+
+/**
+ * Enumeration for the data buffer mode
+ */
+typedef enum _data_buffer_mode {
+	BM_STANDARD = 0,	/* data buffer is in normal mode */
+	BM_SG = 1,		/* data buffer uses the scatter/gather mode */
+	BM_CONCAT = 2,		/* data buffer uses the concatenation mode */
+	BM_CIRCULAR = 3,	/* data buffer uses the circular DMA mode */
+	BM_ALIGN = 4		/* data buffer is in buffer alignment mode */
+} data_buffer_mode_e;
+#endif //DWC_UTE_CFI
+
+/** Macros defined for DWC OTG HW Release version */
+
+#define OTG_CORE_REV_2_60a	0x4F54260A
+#define OTG_CORE_REV_2_71a	0x4F54271A
+#define OTG_CORE_REV_2_72a	0x4F54272A
+#define OTG_CORE_REV_2_80a	0x4F54280A
+#define OTG_CORE_REV_2_81a	0x4F54281A
+#define OTG_CORE_REV_2_90a	0x4F54290A
+#define OTG_CORE_REV_2_91a	0x4F54291A
+#define OTG_CORE_REV_2_92a	0x4F54292A
+#define OTG_CORE_REV_2_93a	0x4F54293A
+#define OTG_CORE_REV_2_94a	0x4F54294A
+#define OTG_CORE_REV_3_00a	0x4F54300A
+
+/**
+ * Information for each ISOC packet.
+ */
+typedef struct iso_pkt_info {
+	uint32_t offset;
+	uint32_t length;
+	int32_t status;
+} iso_pkt_info_t;
+
+/**
+ * The <code>dwc_ep</code> structure represents the state of a single
+ * endpoint when acting in device mode. It contains the data items
+ * needed for an endpoint to be activated and transfer packets.
+ */
+typedef struct dwc_ep {
+	/** EP number used for register address lookup */
+	uint8_t num;
+	/** EP direction 0 = OUT */
+	unsigned is_in:1;
+	/** EP active. */
+	unsigned active:1;
+
+	/**
+	 * Periodic Tx FIFO # for IN EPs For INTR EP set to 0 to use non-periodic
+	 * Tx FIFO. If dedicated Tx FIFOs are enabled Tx FIFO # FOR IN EPs*/
+	unsigned tx_fifo_num:4;
+	/** EP type: 0 - Control, 1 - ISOC,	 2 - BULK,	3 - INTR */
+	unsigned type:2;
+#define DWC_OTG_EP_TYPE_CONTROL	   0
+#define DWC_OTG_EP_TYPE_ISOC	   1
+#define DWC_OTG_EP_TYPE_BULK	   2
+#define DWC_OTG_EP_TYPE_INTR	   3
+
+	/** DATA start PID for INTR and BULK EP */
+	unsigned data_pid_start:1;
+	/** Frame (even/odd) for ISOC EP */
+	unsigned even_odd_frame:1;
+	/** Max Packet bytes */
+	unsigned maxpacket:11;
+
+	/** Max Transfer size */
+	uint32_t maxxfer;
+
+	/** @name Transfer state */
+	/** @{ */
+
+	/**
+	 * Pointer to the beginning of the transfer buffer -- do not modify
+	 * during transfer.
+	 */
+
+	dwc_dma_t dma_addr;
+
+	dwc_dma_t dma_desc_addr;
+	dwc_otg_dev_dma_desc_t *desc_addr;
+
+	uint8_t *start_xfer_buff;
+	/** pointer to the transfer buffer */
+	uint8_t *xfer_buff;
+	/** Number of bytes to transfer */
+	unsigned xfer_len:19;
+	/** Number of bytes transferred. */
+	unsigned xfer_count:19;
+	/** Sent ZLP */
+	unsigned sent_zlp:1;
+	/** Total len for control transfer */
+	unsigned total_len:19;
+
+	/** stall clear flag */
+	unsigned stall_clear_flag:1;
+
+	/** SETUP pkt cnt rollover flag for EP0 out*/
+	unsigned stp_rollover;
+
+#ifdef DWC_UTE_CFI
+	/* The buffer mode */
+	data_buffer_mode_e buff_mode;
+
+	/* The chain of DMA descriptors.
+	 * MAX_DMA_DESCS_PER_EP will be allocated for each active EP.
+	 */
+	dwc_otg_dma_desc_t *descs;
+
+	/* The DMA address of the descriptors chain start */
+	dma_addr_t descs_dma_addr;
+	/** This variable stores the length of the last enqueued request */
+	uint32_t cfi_req_len;
+#endif				//DWC_UTE_CFI
+
+/** Max DMA Descriptor count for any EP */
+#define MAX_DMA_DESC_CNT 256
+	/** Allocated DMA Desc count */
+	uint32_t desc_cnt;
+
+	/** bInterval */
+	uint32_t bInterval;
+	/** Next frame num to setup next ISOC transfer */
+	uint32_t frame_num;
+	/** Indicates SOF number overrun in DSTS */
+	uint8_t frm_overrun;
+
+#ifdef DWC_UTE_PER_IO
+	/** Next frame num for which will be setup DMA Desc */
+	uint32_t xiso_frame_num;
+	/** bInterval */
+	uint32_t xiso_bInterval;
+	/** Count of currently active transfers - shall be either 0 or 1 */
+	int xiso_active_xfers;
+	int xiso_queued_xfers;
+#endif
+#ifdef DWC_EN_ISOC
+	/**
+	 * Variables specific for ISOC EPs
+	 *
+	 */
+	/** DMA addresses of ISOC buffers */
+	dwc_dma_t dma_addr0;
+	dwc_dma_t dma_addr1;
+
+	dwc_dma_t iso_dma_desc_addr;
+	dwc_otg_dev_dma_desc_t *iso_desc_addr;
+
+	/** pointer to the transfer buffers */
+	uint8_t *xfer_buff0;
+	uint8_t *xfer_buff1;
+
+	/** number of ISOC Buffer is processing */
+	uint32_t proc_buf_num;
+	/** Interval of ISOC Buffer processing */
+	uint32_t buf_proc_intrvl;
+	/** Data size for regular frame */
+	uint32_t data_per_frame;
+
+	/* todo - pattern data support is to be implemented in the future */
+	/** Data size for pattern frame */
+	uint32_t data_pattern_frame;
+	/** Frame number of pattern data */
+	uint32_t sync_frame;
+
+	/** bInterval */
+	uint32_t bInterval;
+	/** ISO Packet number per frame */
+	uint32_t pkt_per_frm;
+	/** Next frame num for which will be setup DMA Desc */
+	uint32_t next_frame;
+	/** Number of packets per buffer processing */
+	uint32_t pkt_cnt;
+	/** Info for all isoc packets */
+	iso_pkt_info_t *pkt_info;
+	/** current pkt number */
+	uint32_t cur_pkt;
+	/** current pkt number */
+	uint8_t *cur_pkt_addr;
+	/** current pkt number */
+	uint32_t cur_pkt_dma_addr;
+#endif				/* DWC_EN_ISOC */
+
+/** @} */
+} dwc_ep_t;
+
+/*
+ * Reasons for halting a host channel.
+ */
+typedef enum dwc_otg_halt_status {
+	DWC_OTG_HC_XFER_NO_HALT_STATUS,
+	DWC_OTG_HC_XFER_COMPLETE,
+	DWC_OTG_HC_XFER_URB_COMPLETE,
+	DWC_OTG_HC_XFER_ACK,
+	DWC_OTG_HC_XFER_NAK,
+	DWC_OTG_HC_XFER_NYET,
+	DWC_OTG_HC_XFER_STALL,
+	DWC_OTG_HC_XFER_XACT_ERR,
+	DWC_OTG_HC_XFER_FRAME_OVERRUN,
+	DWC_OTG_HC_XFER_BABBLE_ERR,
+	DWC_OTG_HC_XFER_DATA_TOGGLE_ERR,
+	DWC_OTG_HC_XFER_AHB_ERR,
+	DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE,
+	DWC_OTG_HC_XFER_URB_DEQUEUE
+} dwc_otg_halt_status_e;
+
+/**
+ * Host channel descriptor. This structure represents the state of a single
+ * host channel when acting in host mode. It contains the data items needed to
+ * transfer packets to an endpoint via a host channel.
+ */
+typedef struct dwc_hc {
+	/** Host channel number used for register address lookup */
+	uint8_t hc_num;
+
+	/** Device to access */
+	unsigned dev_addr:7;
+
+	/** EP to access */
+	unsigned ep_num:4;
+
+	/** EP direction. 0: OUT, 1: IN */
+	unsigned ep_is_in:1;
+
+	/**
+	 * EP speed.
+	 * One of the following values:
+	 *	- DWC_OTG_EP_SPEED_LOW
+	 *	- DWC_OTG_EP_SPEED_FULL
+	 *	- DWC_OTG_EP_SPEED_HIGH
+	 */
+	unsigned speed:2;
+#define DWC_OTG_EP_SPEED_LOW	0
+#define DWC_OTG_EP_SPEED_FULL	1
+#define DWC_OTG_EP_SPEED_HIGH	2
+
+	/**
+	 * Endpoint type.
+	 * One of the following values:
+	 *	- DWC_OTG_EP_TYPE_CONTROL: 0
+	 *	- DWC_OTG_EP_TYPE_ISOC: 1
+	 *	- DWC_OTG_EP_TYPE_BULK: 2
+	 *	- DWC_OTG_EP_TYPE_INTR: 3
+	 */
+	unsigned ep_type:2;
+
+	/** Max packet size in bytes */
+	unsigned max_packet:11;
+
+	/**
+	 * PID for initial transaction.
+	 * 0: DATA0,<br>
+	 * 1: DATA2,<br>
+	 * 2: DATA1,<br>
+	 * 3: MDATA (non-Control EP),
+	 *	  SETUP (Control EP)
+	 */
+	unsigned data_pid_start:2;
+#define DWC_OTG_HC_PID_DATA0 0
+#define DWC_OTG_HC_PID_DATA2 1
+#define DWC_OTG_HC_PID_DATA1 2
+#define DWC_OTG_HC_PID_MDATA 3
+#define DWC_OTG_HC_PID_SETUP 3
+
+	/** Number of periodic transactions per (micro)frame */
+	unsigned multi_count:2;
+
+	/** @name Transfer State */
+	/** @{ */
+
+	/** Pointer to the current transfer buffer position. */
+	uint8_t *xfer_buff;
+	/**
+	 * In Buffer DMA mode this buffer will be used
+	 * if xfer_buff is not DWORD aligned.
+	 */
+	dwc_dma_t align_buff;
+	/** Total number of bytes to transfer. */
+	uint32_t xfer_len;
+	/** Number of bytes transferred so far. */
+	uint32_t xfer_count;
+	/** Packet count at start of transfer.*/
+	uint16_t start_pkt_count;
+
+	/**
+	 * Flag to indicate whether the transfer has been started. Set to 1 if
+	 * it has been started, 0 otherwise.
+	 */
+	uint8_t xfer_started;
+
+	/**
+	 * Set to 1 to indicate that a PING request should be issued on this
+	 * channel. If 0, process normally.
+	 */
+	uint8_t do_ping;
+
+	/**
+	 * Set to 1 to indicate that the error count for this transaction is
+	 * non-zero. Set to 0 if the error count is 0.
+	 */
+	uint8_t error_state;
+
+	/**
+	 * Set to 1 to indicate that this channel should be halted the next
+	 * time a request is queued for the channel. This is necessary in
+	 * slave mode if no request queue space is available when an attempt
+	 * is made to halt the channel.
+	 */
+	uint8_t halt_on_queue;
+
+	/**
+	 * Set to 1 if the host channel has been halted, but the core is not
+	 * finished flushing queued requests. Otherwise 0.
+	 */
+	uint8_t halt_pending;
+
+	/**
+	 * Reason for halting the host channel.
+	 */
+	dwc_otg_halt_status_e halt_status;
+
+	/*
+	 * Split settings for the host channel
+	 */
+	uint8_t do_split;		   /**< Enable split for the channel */
+	uint8_t complete_split;	   /**< Enable complete split */
+	uint8_t hub_addr;		   /**< Address of high speed hub */
+
+	uint8_t port_addr;		   /**< Port of the low/full speed device */
+	/** Split transaction position
+	 * One of the following values:
+	 *	  - DWC_HCSPLIT_XACTPOS_MID
+	 *	  - DWC_HCSPLIT_XACTPOS_BEGIN
+	 *	  - DWC_HCSPLIT_XACTPOS_END
+	 *	  - DWC_HCSPLIT_XACTPOS_ALL */
+	uint8_t xact_pos;
+
+	/** Set when the host channel does a short read. */
+	uint8_t short_read;
+
+	/**
+	 * Number of requests issued for this channel since it was assigned to
+	 * the current transfer (not counting PINGs).
+	 */
+	uint8_t requests;
+
+	/**
+	 * Queue Head for the transfer being processed by this channel.
+	 */
+	struct dwc_otg_qh *qh;
+
+	/** @} */
+
+	/** Entry in list of host channels. */
+	 DWC_CIRCLEQ_ENTRY(dwc_hc) hc_list_entry;
+
+	/** @name Descriptor DMA support */
+	/** @{ */
+
+	/** Number of Transfer Descriptors */
+	uint16_t ntd;
+
+	/** Descriptor List DMA address */
+	dwc_dma_t desc_list_addr;
+
+	/** Scheduling micro-frame bitmap. */
+	uint8_t schinfo;
+
+	/** @} */
+} dwc_hc_t;
+
+/**
+ * The following parameters may be specified when starting the module. These
+ * parameters define how the DWC_otg controller should be configured.
+ */
+typedef struct dwc_otg_core_params {
+	int32_t opt;
+
+	/**
+	 * Specifies the OTG capabilities. The driver will automatically
+	 * detect the value for this parameter if none is specified.
+	 * 0 - HNP and SRP capable (default)
+	 * 1 - SRP Only capable
+	 * 2 - No HNP/SRP capable
+	 */
+	int32_t otg_cap;
+
+	/**
+	 * Specifies whether to use slave or DMA mode for accessing the data
+	 * FIFOs. The driver will automatically detect the value for this
+	 * parameter if none is specified.
+	 * 0 - Slave
+	 * 1 - DMA (default, if available)
+	 */
+	int32_t dma_enable;
+
+	/**
+	 * When DMA mode is enabled specifies whether to use address DMA or DMA
+	 * Descriptor mode for accessing the data FIFOs in device mode. The driver
+	 * will automatically detect the value for this if none is specified.
+	 * 0 - address DMA
+	 * 1 - DMA Descriptor(default, if available)
+	 */
+	int32_t dma_desc_enable;
+	/** The DMA Burst size (applicable only for External DMA
+	 * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
+	 */
+	int32_t dma_burst_size;	/* Translate this to GAHBCFG values */
+
+	/**
+	 * Specifies the maximum speed of operation in host and device mode.
+	 * The actual speed depends on the speed of the attached device and
+	 * the value of phy_type. The actual speed depends on the speed of the
+	 * attached device.
+	 * 0 - High Speed (default)
+	 * 1 - Full Speed
+	 */
+	int32_t speed;
+	/** Specifies whether low power mode is supported when attached
+	 *	to a Full Speed or Low Speed device in host mode.
+	 * 0 - Don't support low power mode (default)
+	 * 1 - Support low power mode
+	 */
+	int32_t host_support_fs_ls_low_power;
+
+	/** Specifies the PHY clock rate in low power mode when connected to a
+	 * Low Speed device in host mode. This parameter is applicable only if
+	 * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
+	 * then defaults to 6 MHZ otherwise 48 MHZ.
+	 *
+	 * 0 - 48 MHz
+	 * 1 - 6 MHz
+	 */
+	int32_t host_ls_low_power_phy_clk;
+
+	/**
+	 * 0 - Use cC FIFO size parameters
+	 * 1 - Allow dynamic FIFO sizing (default)
+	 */
+	int32_t enable_dynamic_fifo;
+
+	/** Total number of 4-byte words in the data FIFO memory. This
+	 * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
+	 * Tx FIFOs.
+	 * 32 to 32768 (default 8192)
+	 * Note: The total FIFO memory depth in the FPGA configuration is 8192.
+	 */
+	int32_t data_fifo_size;
+
+	/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
+	 * FIFO sizing is enabled.
+	 * 16 to 32768 (default 1064)
+	 */
+	int32_t dev_rx_fifo_size;
+
+	/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
+	 * when dynamic FIFO sizing is enabled.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t dev_nperio_tx_fifo_size;
+
+	/** Number of 4-byte words in each of the periodic Tx FIFOs in device
+	 * mode when dynamic FIFO sizing is enabled.
+	 * 4 to 768 (default 256)
+	 */
+	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
+
+	/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
+	 * FIFO sizing is enabled.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t host_rx_fifo_size;
+
+	/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
+	 * when Dynamic FIFO sizing is enabled in the core.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t host_nperio_tx_fifo_size;
+
+	/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
+	 * FIFO sizing is enabled.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t host_perio_tx_fifo_size;
+
+	/** The maximum transfer size supported in bytes.
+	 * 2047 to 65,535  (default 65,535)
+	 */
+	int32_t max_transfer_size;
+
+	/** The maximum number of packets in a transfer.
+	 * 15 to 511  (default 511)
+	 */
+	int32_t max_packet_count;
+
+	/** The number of host channel registers to use.
+	 * 1 to 16 (default 12)
+	 * Note: The FPGA configuration supports a maximum of 12 host channels.
+	 */
+	int32_t host_channels;
+
+	/** The number of endpoints in addition to EP0 available for device
+	 * mode operations.
+	 * 1 to 15 (default 6 IN and OUT)
+	 * Note: The FPGA configuration supports a maximum of 6 IN and OUT
+	 * endpoints in addition to EP0.
+	 */
+	int32_t dev_endpoints;
+
+		/**
+		 * Specifies the type of PHY interface to use. By default, the driver
+		 * will automatically detect the phy_type.
+		 *
+		 * 0 - Full Speed PHY
+		 * 1 - UTMI+ (default)
+		 * 2 - ULPI
+		 */
+	int32_t phy_type;
+
+	/**
+	 * Specifies the UTMI+ Data Width. This parameter is
+	 * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
+	 * PHY_TYPE, this parameter indicates the data width between
+	 * the MAC and the ULPI Wrapper.) Also, this parameter is
+	 * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
+	 * to "8 and 16 bits", meaning that the core has been
+	 * configured to work at either data path width.
+	 *
+	 * 8 or 16 bits (default 16)
+	 */
+	int32_t phy_utmi_width;
+
+	/**
+	 * Specifies whether the ULPI operates at double or single
+	 * data rate. This parameter is only applicable if PHY_TYPE is
+	 * ULPI.
+	 *
+	 * 0 - single data rate ULPI interface with 8 bit wide data
+	 * bus (default)
+	 * 1 - double data rate ULPI interface with 4 bit wide data
+	 * bus
+	 */
+	int32_t phy_ulpi_ddr;
+
+	/**
+	 * Specifies whether to use the internal or external supply to
+	 * drive the vbus with a ULPI phy.
+	 */
+	int32_t phy_ulpi_ext_vbus;
+
+	/**
+	 * Specifies whether to use the I2Cinterface for full speed PHY. This
+	 * parameter is only applicable if PHY_TYPE is FS.
+	 * 0 - No (default)
+	 * 1 - Yes
+	 */
+	int32_t i2c_enable;
+
+	int32_t ulpi_fs_ls;
+
+	int32_t ts_dline;
+
+	/**
+	 * Specifies whether dedicated transmit FIFOs are
+	 * enabled for non periodic IN endpoints in device mode
+	 * 0 - No
+	 * 1 - Yes
+	 */
+	int32_t en_multiple_tx_fifo;
+
+	/** Number of 4-byte words in each of the Tx FIFOs in device
+	 * mode when dynamic FIFO sizing is enabled.
+	 * 4 to 768 (default 256)
+	 */
+	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
+
+	/** Thresholding enable flag-
+	 * bit 0 - enable non-ISO Tx thresholding
+	 * bit 1 - enable ISO Tx thresholding
+	 * bit 2 - enable Rx thresholding
+	 */
+	uint32_t thr_ctl;
+
+	/** Thresholding length for Tx
+	 *	FIFOs in 32 bit DWORDs
+	 */
+	uint32_t tx_thr_length;
+
+	/** Thresholding length for Rx
+	 *	FIFOs in 32 bit DWORDs
+	 */
+	uint32_t rx_thr_length;
+
+	/**
+	 * Specifies whether LPM (Link Power Management) support is enabled
+	 */
+	int32_t lpm_enable;
+
+	/** Per Transfer Interrupt
+	 *	mode enable flag
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t pti_enable;
+
+	/** Multi Processor Interrupt
+	 *	mode enable flag
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t mpi_enable;
+
+	/** IS_USB Capability
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t ic_usb_cap;
+
+	/** AHB Threshold Ratio
+	 * 2'b00 AHB Threshold = 	MAC Threshold
+	 * 2'b01 AHB Threshold = 1/2 	MAC Threshold
+	 * 2'b10 AHB Threshold = 1/4	MAC Threshold
+	 * 2'b11 AHB Threshold = 1/8	MAC Threshold
+	 */
+	int32_t ahb_thr_ratio;
+
+	/** ADP Support
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t adp_supp_enable;
+
+	/** HFIR Reload Control
+	 * 0 - The HFIR cannot be reloaded dynamically.
+	 * 1 - Allow dynamic reloading of the HFIR register during runtime.
+	 */
+	int32_t reload_ctl;
+
+	/** DCFG: Enable device Out NAK
+	 * 0 - The core does not set NAK after Bulk Out transfer complete.
+	 * 1 - The core sets NAK after Bulk OUT transfer complete.
+	 */
+	int32_t dev_out_nak;
+
+	/** DCFG: Enable Continue on BNA
+	 * After receiving BNA interrupt the core disables the endpoint,when the
+	 * endpoint is re-enabled by the application the core starts processing
+	 * 0 - from the DOEPDMA descriptor
+	 * 1 - from the descriptor which received the BNA.
+	 */
+	int32_t cont_on_bna;
+
+	/** GAHBCFG: AHB Single Support
+	 * This bit when programmed supports SINGLE transfers for remainder
+	 * data in a transfer for DMA mode of operation.
+	 * 0 - in this case the remainder data will be sent using INCR burst size.
+	 * 1 - in this case the remainder data will be sent using SINGLE burst size.
+	 */
+	int32_t ahb_single;
+
+	/** Core Power down mode
+	 * 0 - No Power Down is enabled
+	 * 1 - Reserved
+	 * 2 - Complete Power Down (Hibernation)
+	 */
+	int32_t power_down;
+
+	/** OTG revision supported
+	 * 0 - OTG 1.3 revision
+	 * 1 - OTG 2.0 revision
+	 */
+	int32_t otg_ver;
+
+} dwc_otg_core_params_t;
+
+#ifdef DEBUG
+struct dwc_otg_core_if;
+typedef struct hc_xfer_info {
+	struct dwc_otg_core_if *core_if;
+	dwc_hc_t *hc;
+} hc_xfer_info_t;
+#endif
+
+typedef struct ep_xfer_info {
+	struct dwc_otg_core_if *core_if;
+	dwc_ep_t *ep;
+	uint8_t state;
+} ep_xfer_info_t;
+/*
+ * Device States
+ */
+typedef enum dwc_otg_lx_state {
+	/** On state */
+	DWC_OTG_L0,
+	/** LPM sleep state*/
+	DWC_OTG_L1,
+	/** USB suspend state*/
+	DWC_OTG_L2,
+	/** Off state*/
+	DWC_OTG_L3
+} dwc_otg_lx_state_e;
+
+struct dwc_otg_global_regs_backup {
+	uint32_t gotgctl_local;
+	uint32_t gintmsk_local;
+	uint32_t gahbcfg_local;
+	uint32_t gusbcfg_local;
+	uint32_t grxfsiz_local;
+	uint32_t gnptxfsiz_local;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	uint32_t glpmcfg_local;
+#endif
+	uint32_t gi2cctl_local;
+	uint32_t hptxfsiz_local;
+	uint32_t pcgcctl_local;
+	uint32_t gdfifocfg_local;
+	uint32_t dtxfsiz_local[MAX_EPS_CHANNELS];
+	uint32_t gpwrdn_local;
+	uint32_t xhib_pcgcctl;
+	uint32_t xhib_gpwrdn;
+};
+
+struct dwc_otg_host_regs_backup {
+	uint32_t hcfg_local;
+	uint32_t haintmsk_local;
+	uint32_t hcintmsk_local[MAX_EPS_CHANNELS];
+	uint32_t hprt0_local;
+	uint32_t hfir_local;
+};
+
+struct dwc_otg_dev_regs_backup {
+	uint32_t dcfg;
+	uint32_t dctl;
+	uint32_t daintmsk;
+	uint32_t diepmsk;
+	uint32_t doepmsk;
+	uint32_t diepctl[MAX_EPS_CHANNELS];
+	uint32_t dieptsiz[MAX_EPS_CHANNELS];
+	uint32_t diepdma[MAX_EPS_CHANNELS];
+};
+/**
+ * The <code>dwc_otg_core_if</code> structure contains information needed to manage
+ * the DWC_otg controller acting in either host or device mode. It
+ * represents the programming view of the controller as a whole.
+ */
+struct dwc_otg_core_if {
+	/** Parameters that define how the core should be configured.*/
+	dwc_otg_core_params_t *core_params;
+
+	/** Core Global registers starting at offset 000h. */
+	dwc_otg_core_global_regs_t *core_global_regs;
+
+	/** Device-specific information */
+	dwc_otg_dev_if_t *dev_if;
+	/** Host-specific information */
+	dwc_otg_host_if_t *host_if;
+
+	/** Value from SNPSID register */
+	uint32_t snpsid;
+
+	/*
+	 * Set to 1 if the core PHY interface bits in USBCFG have been
+	 * initialized.
+	 */
+	uint8_t phy_init_done;
+
+	/*
+	 * SRP Success flag, set by srp success interrupt in FS I2C mode
+	 */
+	uint8_t srp_success;
+	uint8_t srp_timer_started;
+	/** Timer for SRP. If it expires before SRP is successful
+	 * clear the SRP. */
+	dwc_timer_t *srp_timer;
+
+#ifdef DWC_DEV_SRPCAP
+	/* This timer is needed to power on the hibernated host core if SRP is not
+	 * initiated on connected SRP capable device for limited period of time
+	 */
+	uint8_t pwron_timer_started;
+	dwc_timer_t *pwron_timer;
+#endif
+	/* Common configuration information */
+	/** Power and Clock Gating Control Register */
+	volatile uint32_t *pcgcctl;
+#define DWC_OTG_PCGCCTL_OFFSET 0xE00
+
+	/** Push/pop addresses for endpoints or host channels.*/
+	uint32_t *data_fifo[MAX_EPS_CHANNELS];
+#define DWC_OTG_DATA_FIFO_OFFSET 0x1000
+#define DWC_OTG_DATA_FIFO_SIZE 0x1000
+
+	/** Total RAM for FIFOs (Bytes) */
+	uint16_t total_fifo_size;
+	/** Size of Rx FIFO (Bytes) */
+	uint16_t rx_fifo_size;
+	/** Size of Non-periodic Tx FIFO (Bytes) */
+	uint16_t nperio_tx_fifo_size;
+
+	/** 1 if DMA is enabled, 0 otherwise. */
+	uint8_t dma_enable;
+
+	/** 1 if DMA descriptor is enabled, 0 otherwise. */
+	uint8_t dma_desc_enable;
+
+	/** 1 if PTI Enhancement mode is enabled, 0 otherwise. */
+	uint8_t pti_enh_enable;
+
+	/** 1 if MPI Enhancement mode is enabled, 0 otherwise. */
+	uint8_t multiproc_int_enable;
+
+	/** 1 if dedicated Tx FIFOs are enabled, 0 otherwise. */
+	uint8_t en_multiple_tx_fifo;
+
+	/** Set to 1 if multiple packets of a high-bandwidth transfer is in
+	 * process of being queued */
+	uint8_t queuing_high_bandwidth;
+
+	/** Hardware Configuration -- stored here for convenience.*/
+	hwcfg1_data_t hwcfg1;
+	hwcfg2_data_t hwcfg2;
+	hwcfg3_data_t hwcfg3;
+	hwcfg4_data_t hwcfg4;
+	fifosize_data_t hptxfsiz;
+
+	/** Host and Device Configuration -- stored here for convenience.*/
+	hcfg_data_t hcfg;
+	dcfg_data_t dcfg;
+
+	/** The operational State, during transations
+	 * (a_host>>a_peripherial and b_device=>b_host) this may not
+	 * match the core but allows the software to determine
+	 * transitions.
+	 */
+	uint8_t op_state;
+
+	/**
+	 * Set to 1 if the HCD needs to be restarted on a session request
+	 * interrupt. This is required if no connector ID status change has
+	 * occurred since the HCD was last disconnected.
+	 */
+	uint8_t restart_hcd_on_session_req;
+
+	/** HCD callbacks */
+	/** A-Device is a_host */
+#define A_HOST		(1)
+	/** A-Device is a_suspend */
+#define A_SUSPEND	(2)
+	/** A-Device is a_peripherial */
+#define A_PERIPHERAL	(3)
+	/** B-Device is operating as a Peripheral. */
+#define B_PERIPHERAL	(4)
+	/** B-Device is operating as a Host. */
+#define B_HOST		(5)
+
+	/** HCD callbacks */
+	struct dwc_otg_cil_callbacks *hcd_cb;
+	/** PCD callbacks */
+	struct dwc_otg_cil_callbacks *pcd_cb;
+
+	/** Device mode Periodic Tx FIFO Mask */
+	uint32_t p_tx_msk;
+	/** Device mode Periodic Tx FIFO Mask */
+	uint32_t tx_msk;
+
+	/** Workqueue object used for handling several interrupts */
+	dwc_workq_t *wq_otg;
+
+	/** Timer object used for handling "Wakeup Detected" Interrupt */
+	dwc_timer_t *wkp_timer;
+	/** This arrays used for debug purposes for DEV OUT NAK enhancement */
+	uint32_t start_doeptsiz_val[MAX_EPS_CHANNELS];
+	ep_xfer_info_t ep_xfer_info[MAX_EPS_CHANNELS];
+	dwc_timer_t *ep_xfer_timer[MAX_EPS_CHANNELS];
+#ifdef DEBUG
+	uint32_t start_hcchar_val[MAX_EPS_CHANNELS];
+
+	hc_xfer_info_t hc_xfer_info[MAX_EPS_CHANNELS];
+	dwc_timer_t *hc_xfer_timer[MAX_EPS_CHANNELS];
+
+	uint32_t hfnum_7_samples;
+	uint64_t hfnum_7_frrem_accum;
+	uint32_t hfnum_0_samples;
+	uint64_t hfnum_0_frrem_accum;
+	uint32_t hfnum_other_samples;
+	uint64_t hfnum_other_frrem_accum;
+#endif
+
+#ifdef DWC_UTE_CFI
+	uint16_t pwron_rxfsiz;
+	uint16_t pwron_gnptxfsiz;
+	uint16_t pwron_txfsiz[15];
+
+	uint16_t init_rxfsiz;
+	uint16_t init_gnptxfsiz;
+	uint16_t init_txfsiz[15];
+#endif
+
+	/** Lx state of device */
+	dwc_otg_lx_state_e lx_state;
+
+	/** Saved Core Global registers */
+	struct dwc_otg_global_regs_backup *gr_backup;
+	/** Saved Host registers */
+	struct dwc_otg_host_regs_backup *hr_backup;
+	/** Saved Device registers */
+	struct dwc_otg_dev_regs_backup *dr_backup;
+
+	/** Power Down Enable */
+	uint32_t power_down;
+
+	/** ADP support Enable */
+	uint32_t adp_enable;
+
+	/** ADP structure object */
+	dwc_otg_adp_t adp;
+
+	/** hibernation/suspend flag */
+	int hibernation_suspend;
+
+	/** Device mode extended hibernation flag */
+	int xhib;
+
+	/** OTG revision supported */
+	uint32_t otg_ver;
+
+	/** OTG status flag used for HNP polling */
+	uint8_t otg_sts;
+
+	/** Pointer to either hcd->lock or pcd->lock */
+	dwc_spinlock_t *lock;
+
+	/** Start predict NextEP based on Learning Queue if equal 1,
+	 * also used as counter of disabled NP IN EP's */
+	uint8_t start_predict;
+
+	/** NextEp sequence, including EP0: nextep_seq[] = EP if non-periodic and
+	 * active, 0xff otherwise */
+	uint8_t nextep_seq[MAX_EPS_CHANNELS];
+
+	/** Index of fisrt EP in nextep_seq array which should be re-enabled **/
+	uint8_t first_in_nextep_seq;
+
+	/** Frame number while entering to ISR - needed for ISOCs **/
+	uint32_t frame_num;
+
+};
+
+#ifdef DEBUG
+/*
+ * This function is called when transfer is timed out.
+ */
+extern void hc_xfer_timeout(void *ptr);
+#endif
+
+/*
+ * This function is called when transfer is timed out on endpoint.
+ */
+extern void ep_xfer_timeout(void *ptr);
+
+/*
+ * The following functions are functions for works
+ * using during handling some interrupts
+ */
+extern void w_conn_id_status_change(void *p);
+
+extern void w_wakeup_detected(void *p);
+
+/** Saves global register values into system memory. */
+extern int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if);
+/** Saves device register values into system memory. */
+extern int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if);
+/** Saves host register values into system memory. */
+extern int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if);
+/** Restore global register values. */
+extern int dwc_otg_restore_global_regs(dwc_otg_core_if_t * core_if);
+/** Restore host register values. */
+extern int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset);
+/** Restore device register values. */
+extern int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if,
+				    int rem_wakeup);
+extern int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if);
+extern int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode,
+				  int is_host);
+
+extern int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
+					    int restore_mode, int reset);
+extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
+					      int rem_wakeup, int reset);
+
+/*
+ * The following functions support initialization of the CIL driver component
+ * and the DWC_otg controller.
+ */
+extern void dwc_otg_core_host_init(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_core_dev_init(dwc_otg_core_if_t * _core_if);
+
+/** @name Device CIL Functions
+ * The following functions support managing the DWC_otg controller in device
+ * mode.
+ */
+/**@{*/
+extern void dwc_otg_wakeup(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_read_setup_packet(dwc_otg_core_if_t * _core_if,
+				      uint32_t * _dest);
+extern uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_ep0_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_deactivate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * _core_if,
+				      dwc_ep_t * _ep);
+extern void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * _core_if,
+					 dwc_ep_t * _ep);
+extern void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * _core_if,
+				       dwc_ep_t * _ep);
+extern void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * _core_if,
+					  dwc_ep_t * _ep);
+extern void dwc_otg_ep_write_packet(dwc_otg_core_if_t * _core_if,
+				    dwc_ep_t * _ep, int _dma);
+extern void dwc_otg_ep_set_stall(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * _core_if,
+				   dwc_ep_t * _ep);
+extern void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * _core_if);
+
+#ifdef DWC_EN_ISOC
+extern void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
+					      dwc_ep_t * ep);
+extern void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
+					      dwc_ep_t * ep);
+#endif /* DWC_EN_ISOC */
+/**@}*/
+
+/** @name Host CIL Functions
+ * The following functions support managing the DWC_otg controller in host
+ * mode.
+ */
+/**@{*/
+extern void dwc_otg_hc_init(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
+extern void dwc_otg_hc_halt(dwc_otg_core_if_t * _core_if,
+			    dwc_hc_t * _hc, dwc_otg_halt_status_e _halt_status);
+extern void dwc_otg_hc_cleanup(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
+extern void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * _core_if,
+				      dwc_hc_t * _hc);
+extern int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * _core_if,
+					dwc_hc_t * _hc);
+extern void dwc_otg_hc_do_ping(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
+extern void dwc_otg_hc_write_packet(dwc_otg_core_if_t * _core_if,
+				    dwc_hc_t * _hc);
+extern void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * _core_if);
+
+extern void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if,
+					   dwc_hc_t * hc);
+
+extern uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if);
+
+/* Macro used to clear one channel interrupt */
+#define clear_hc_int(_hc_regs_, _intr_) \
+do { \
+	hcint_data_t hcint_clear = {.d32 = 0}; \
+	hcint_clear.b._intr_ = 1; \
+	DWC_WRITE_REG32(&(_hc_regs_)->hcint, hcint_clear.d32); \
+} while (0)
+
+/*
+ * Macro used to disable one channel interrupt. Channel interrupts are
+ * disabled when the channel is halted or released by the interrupt handler.
+ * There is no need to handle further interrupts of that type until the
+ * channel is re-assigned. In fact, subsequent handling may cause crashes
+ * because the channel structures are cleaned up when the channel is released.
+ */
+#define disable_hc_int(_hc_regs_, _intr_) \
+do { \
+	hcintmsk_data_t hcintmsk = {.d32 = 0}; \
+	hcintmsk.b._intr_ = 1; \
+	DWC_MODIFY_REG32(&(_hc_regs_)->hcintmsk, hcintmsk.d32, 0); \
+} while (0)
+
+/**
+ * This function Reads HPRT0 in preparation to modify. It keeps the
+ * WC bits 0 so that if they are read as 1, they won't clear when you
+ * write it back
+ */
+static inline uint32_t dwc_otg_read_hprt0(dwc_otg_core_if_t * _core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(_core_if->host_if->hprt0);
+	hprt0.b.prtena = 0;
+	hprt0.b.prtconndet = 0;
+	hprt0.b.prtenchng = 0;
+	hprt0.b.prtovrcurrchng = 0;
+	return hprt0.d32;
+}
+
+/**@}*/
+
+/** @name Common CIL Functions
+ * The following functions support managing the DWC_otg controller in either
+ * device or host mode.
+ */
+/**@{*/
+
+extern void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
+				uint8_t * dest, uint16_t bytes);
+
+extern void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * _core_if, const int _num);
+extern void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_core_reset(dwc_otg_core_if_t * _core_if);
+
+/**
+ * This function returns the Core Interrupt register.
+ */
+static inline uint32_t dwc_otg_read_core_intr(dwc_otg_core_if_t * core_if)
+{
+	return (DWC_READ_REG32(&core_if->core_global_regs->gintsts) &
+		DWC_READ_REG32(&core_if->core_global_regs->gintmsk));
+}
+
+/**
+ * This function returns the OTG Interrupt register.
+ */
+static inline uint32_t dwc_otg_read_otg_intr(dwc_otg_core_if_t * core_if)
+{
+	return (DWC_READ_REG32(&core_if->core_global_regs->gotgint));
+}
+
+/**
+ * This function reads the Device All Endpoints Interrupt register and
+ * returns the IN endpoint interrupt bits.
+ */
+static inline uint32_t dwc_otg_read_dev_all_in_ep_intr(dwc_otg_core_if_t *
+						       core_if)
+{
+
+	uint32_t v;
+
+	if (core_if->multiproc_int_enable) {
+		v = DWC_READ_REG32(&core_if->dev_if->
+				   dev_global_regs->deachint) &
+		    DWC_READ_REG32(&core_if->
+				   dev_if->dev_global_regs->deachintmsk);
+	} else {
+		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
+	}
+	return (v & 0xffff);
+}
+
+/**
+ * This function reads the Device All Endpoints Interrupt register and
+ * returns the OUT endpoint interrupt bits.
+ */
+static inline uint32_t dwc_otg_read_dev_all_out_ep_intr(dwc_otg_core_if_t *
+							core_if)
+{
+	uint32_t v;
+
+	if (core_if->multiproc_int_enable) {
+		v = DWC_READ_REG32(&core_if->dev_if->
+				   dev_global_regs->deachint) &
+		    DWC_READ_REG32(&core_if->
+				   dev_if->dev_global_regs->deachintmsk);
+	} else {
+		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
+	}
+
+	return ((v & 0xffff0000) >> 16);
+}
+
+/**
+ * This function returns the Device IN EP Interrupt register
+ */
+static inline uint32_t dwc_otg_read_dev_in_ep_intr(dwc_otg_core_if_t * core_if,
+						   dwc_ep_t * ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	uint32_t v, msk, emp;
+
+	if (core_if->multiproc_int_enable) {
+		msk =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->diepeachintmsk[ep->num]);
+		emp =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->dtknqr4_fifoemptymsk);
+		msk |= ((emp >> ep->num) & 0x1) << 7;
+		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
+	} else {
+		msk = DWC_READ_REG32(&dev_if->dev_global_regs->diepmsk);
+		emp =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->dtknqr4_fifoemptymsk);
+		msk |= ((emp >> ep->num) & 0x1) << 7;
+		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
+	}
+
+	return v;
+}
+
+/**
+ * This function returns the Device OUT EP Interrupt register
+ */
+static inline uint32_t dwc_otg_read_dev_out_ep_intr(dwc_otg_core_if_t *
+						    _core_if, dwc_ep_t * _ep)
+{
+	dwc_otg_dev_if_t *dev_if = _core_if->dev_if;
+	uint32_t v;
+	doepmsk_data_t msk = {.d32 = 0 };
+
+	if (_core_if->multiproc_int_enable) {
+		msk.d32 =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->doepeachintmsk[_ep->num]);
+		if (_core_if->pti_enh_enable) {
+			msk.b.pktdrpsts = 1;
+		}
+		v = DWC_READ_REG32(&dev_if->
+				   out_ep_regs[_ep->num]->doepint) & msk.d32;
+	} else {
+		msk.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->doepmsk);
+		if (_core_if->pti_enh_enable) {
+			msk.b.pktdrpsts = 1;
+		}
+		v = DWC_READ_REG32(&dev_if->
+				   out_ep_regs[_ep->num]->doepint) & msk.d32;
+	}
+	return v;
+}
+
+/**
+ * This function returns the Host All Channel Interrupt register
+ */
+static inline uint32_t dwc_otg_read_host_all_channels_intr(dwc_otg_core_if_t *
+							   _core_if)
+{
+	return (DWC_READ_REG32(&_core_if->host_if->host_global_regs->haint));
+}
+
+static inline uint32_t dwc_otg_read_host_channel_intr(dwc_otg_core_if_t *
+						      _core_if, dwc_hc_t * _hc)
+{
+	return (DWC_READ_REG32
+		(&_core_if->host_if->hc_regs[_hc->hc_num]->hcint));
+}
+
+/**
+ * This function returns the mode of the operation, host or device.
+ *
+ * @return 0 - Device Mode, 1 - Host Mode
+ */
+static inline uint32_t dwc_otg_mode(dwc_otg_core_if_t * _core_if)
+{
+	return (DWC_READ_REG32(&_core_if->core_global_regs->gintsts) & 0x1);
+}
+
+/**@}*/
+
+/**
+ * DWC_otg CIL callback structure. This structure allows the HCD and
+ * PCD to register functions used for starting and stopping the PCD
+ * and HCD for role change on for a DRD.
+ */
+typedef struct dwc_otg_cil_callbacks {
+	/** Start function for role change */
+	int (*start) (void *_p);
+	/** Stop Function for role change */
+	int (*stop) (void *_p);
+	/** Disconnect Function for role change */
+	int (*disconnect) (void *_p);
+	/** Resume/Remote wakeup Function */
+	int (*resume_wakeup) (void *_p);
+	/** Suspend function */
+	int (*suspend) (void *_p);
+	/** Session Start (SRP) */
+	int (*session_start) (void *_p);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	/** Sleep (switch to L0 state) */
+	int (*sleep) (void *_p);
+#endif
+	/** Pointer passed to start() and stop() */
+	void *p;
+} dwc_otg_cil_callbacks_t;
+
+extern void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * _core_if,
+					       dwc_otg_cil_callbacks_t * _cb,
+					       void *_p);
+extern void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * _core_if,
+					       dwc_otg_cil_callbacks_t * _cb,
+					       void *_p);
+
+void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if);
+
+//////////////////////////////////////////////////////////////////////
+/** Start the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_start(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->start) {
+		core_if->hcd_cb->start(core_if->hcd_cb->p);
+	}
+}
+
+/** Stop the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_stop(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->stop) {
+		core_if->hcd_cb->stop(core_if->hcd_cb->p);
+	}
+}
+
+/** Disconnect the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_disconnect(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->disconnect) {
+		core_if->hcd_cb->disconnect(core_if->hcd_cb->p);
+	}
+}
+
+/** Inform the HCD the a New Session has begun.  Helper function for
+ * using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_session_start(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->session_start) {
+		core_if->hcd_cb->session_start(core_if->hcd_cb->p);
+	}
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * Inform the HCD about LPM sleep.
+ * Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_sleep(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->sleep) {
+		core_if->hcd_cb->sleep(core_if->hcd_cb->p);
+	}
+}
+#endif
+
+/** Resume the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_resume(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->resume_wakeup) {
+		core_if->hcd_cb->resume_wakeup(core_if->hcd_cb->p);
+	}
+}
+
+/** Start the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_start(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->start) {
+		core_if->pcd_cb->start(core_if->pcd_cb->p);
+	}
+}
+
+/** Stop the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_stop(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->stop) {
+		core_if->pcd_cb->stop(core_if->pcd_cb->p);
+	}
+}
+
+/** Suspend the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_suspend(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->suspend) {
+		core_if->pcd_cb->suspend(core_if->pcd_cb->p);
+	}
+}
+
+/** Resume the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_resume(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+		core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+	}
+}
+
+//////////////////////////////////////////////////////////////////////
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
new file mode 100644
index 0000000000000..9fb7229f43ae4
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
@@ -0,0 +1,1596 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil_intr.c $
+ * $Revision: #32 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * The Core Interface Layer provides basic services for accessing and
+ * managing the DWC_otg hardware. These services are used by both the
+ * Host Controller Driver and the Peripheral Controller Driver.
+ *
+ * This file contains the Common Interrupt handlers.
+ */
+#include "dwc_os.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_pcd.h"
+#include "dwc_otg_hcd.h"
+
+#ifdef DEBUG
+inline const char *op_state_str(dwc_otg_core_if_t * core_if)
+{
+	return (core_if->op_state == A_HOST ? "a_host" :
+		(core_if->op_state == A_SUSPEND ? "a_suspend" :
+		 (core_if->op_state == A_PERIPHERAL ? "a_peripheral" :
+		  (core_if->op_state == B_PERIPHERAL ? "b_peripheral" :
+		   (core_if->op_state == B_HOST ? "b_host" : "unknown")))));
+}
+#endif
+
+/** This function will log a debug message
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_mode_mismatch_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+	DWC_WARN("Mode Mismatch Interrupt: currently in %s mode\n",
+		 dwc_otg_mode(core_if) ? "Host" : "Device");
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.modemismatch = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+	return 1;
+}
+
+/**
+ * This function handles the OTG Interrupts. It reads the OTG
+ * Interrupt Register (GOTGINT) to determine what interrupt has
+ * occurred.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_otg_intr(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gotgint_data_t gotgint;
+	gotgctl_data_t gotgctl;
+	gintmsk_data_t gintmsk;
+	gpwrdn_data_t gpwrdn;
+
+	gotgint.d32 = DWC_READ_REG32(&global_regs->gotgint);
+	gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+	DWC_DEBUGPL(DBG_CIL, "++OTG Interrupt gotgint=%0x [%s]\n", gotgint.d32,
+		    op_state_str(core_if));
+
+	if (gotgint.b.sesenddet) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "Session End Detected++ (%s)\n",
+			    op_state_str(core_if));
+		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+
+		if (core_if->op_state == B_HOST) {
+			cil_pcd_start(core_if);
+			core_if->op_state = B_PERIPHERAL;
+		} else {
+			/* If not B_HOST and Device HNP still set. HNP
+			 * Did not succeed!*/
+			if (gotgctl.b.devhnpen) {
+				DWC_DEBUGPL(DBG_ANY, "Session End Detected\n");
+				__DWC_ERROR("Device Not Connected/Responding!\n");
+			}
+
+			/* If Session End Detected the B-Cable has
+			 * been disconnected. */
+			/* Reset PCD and Gadget driver to a
+			 * clean state. */
+			core_if->lx_state = DWC_OTG_L0;
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_pcd_stop(core_if);
+			DWC_SPINLOCK(core_if->lock);
+
+			if (core_if->adp_enable) {
+				if (core_if->power_down == 2) {
+					gpwrdn.d32 = 0;
+					gpwrdn.b.pwrdnswtch = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, gpwrdn.d32, 0);
+				}
+
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				dwc_otg_adp_sense_start(core_if);
+			}
+		}
+
+		gotgctl.d32 = 0;
+		gotgctl.b.devhnpen = 1;
+		DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+	}
+	if (gotgint.b.sesreqsucstschng) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "Session Reqeust Success Status Change++\n");
+		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+		if (gotgctl.b.sesreqscs) {
+
+			if ((core_if->core_params->phy_type ==
+			     DWC_PHY_TYPE_PARAM_FS) && (core_if->core_params->i2c_enable)) {
+				core_if->srp_success = 1;
+			} else {
+				DWC_SPINUNLOCK(core_if->lock);
+				cil_pcd_resume(core_if);
+				DWC_SPINLOCK(core_if->lock);
+				/* Clear Session Request */
+				gotgctl.d32 = 0;
+				gotgctl.b.sesreq = 1;
+				DWC_MODIFY_REG32(&global_regs->gotgctl,
+						 gotgctl.d32, 0);
+			}
+		}
+	}
+	if (gotgint.b.hstnegsucstschng) {
+		/* Print statements during the HNP interrupt handling
+		 * can cause it to fail.*/
+		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+		/* WA for 3.00a- HW is not setting cur_mode, even sometimes
+		 * this does not help*/
+		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
+			dwc_udelay(100);
+		if (gotgctl.b.hstnegscs) {
+			if (dwc_otg_is_host_mode(core_if)) {
+				core_if->op_state = B_HOST;
+				/*
+				 * Need to disable SOF interrupt immediately.
+				 * When switching from device to host, the PCD
+				 * interrupt handler won't handle the
+				 * interrupt if host mode is already set. The
+				 * HCD interrupt handler won't get called if
+				 * the HCD state is HALT. This means that the
+				 * interrupt does not get handled and Linux
+				 * complains loudly.
+				 */
+				gintmsk.d32 = 0;
+				gintmsk.b.sofintr = 1;
+				DWC_MODIFY_REG32(&global_regs->gintmsk,
+						 gintmsk.d32, 0);
+				/* Call callback function with spin lock released */
+				DWC_SPINUNLOCK(core_if->lock);
+				cil_pcd_stop(core_if);
+				/*
+				 * Initialize the Core for Host mode.
+				 */
+				cil_hcd_start(core_if);
+				DWC_SPINLOCK(core_if->lock);
+				core_if->op_state = B_HOST;
+			}
+		} else {
+			gotgctl.d32 = 0;
+			gotgctl.b.hnpreq = 1;
+			gotgctl.b.devhnpen = 1;
+			DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+			DWC_DEBUGPL(DBG_ANY, "HNP Failed\n");
+			__DWC_ERROR("Device Not Connected/Responding\n");
+		}
+	}
+	if (gotgint.b.hstnegdet) {
+		/* The disconnect interrupt is set at the same time as
+		 * Host Negotiation Detected.  During the mode
+		 * switch all interrupts are cleared so the disconnect
+		 * interrupt handler will not get executed.
+		 */
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "Host Negotiation Detected++ (%s)\n",
+			    (dwc_otg_is_host_mode(core_if) ? "Host" :
+			     "Device"));
+		if (dwc_otg_is_device_mode(core_if)) {
+			DWC_DEBUGPL(DBG_ANY, "a_suspend->a_peripheral (%d)\n",
+				    core_if->op_state);
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_disconnect(core_if);
+			cil_pcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = A_PERIPHERAL;
+		} else {
+			/*
+			 * Need to disable SOF interrupt immediately. When
+			 * switching from device to host, the PCD interrupt
+			 * handler won't handle the interrupt if host mode is
+			 * already set. The HCD interrupt handler won't get
+			 * called if the HCD state is HALT. This means that
+			 * the interrupt does not get handled and Linux
+			 * complains loudly.
+			 */
+			gintmsk.d32 = 0;
+			gintmsk.b.sofintr = 1;
+			DWC_MODIFY_REG32(&global_regs->gintmsk, gintmsk.d32, 0);
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_pcd_stop(core_if);
+			cil_hcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = A_HOST;
+		}
+	}
+	if (gotgint.b.adevtoutchng) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "A-Device Timeout Change++\n");
+	}
+	if (gotgint.b.debdone) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: " "Debounce Done++\n");
+	}
+
+	/* Clear GOTGINT */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, gotgint.d32);
+
+	return 1;
+}
+
+void w_conn_id_status_change(void *p)
+{
+	dwc_otg_core_if_t *core_if = p;
+	uint32_t count = 0;
+	gotgctl_data_t gotgctl = {.d32 = 0 };
+
+	gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	DWC_DEBUGPL(DBG_CIL, "gotgctl=%0x\n", gotgctl.d32);
+	DWC_DEBUGPL(DBG_CIL, "gotgctl.b.conidsts=%d\n", gotgctl.b.conidsts);
+
+	/* B-Device connector (Device Mode) */
+	if (gotgctl.b.conidsts) {
+		/* Wait for switch to device mode. */
+		while (!dwc_otg_is_device_mode(core_if)) {
+			DWC_PRINTF("Waiting for Peripheral Mode, Mode=%s\n",
+				   (dwc_otg_is_host_mode(core_if) ? "Host" :
+				    "Peripheral"));
+			dwc_mdelay(100);
+			if (++count > 10000)
+				break;
+		}
+		DWC_ASSERT(++count < 10000,
+			   "Connection id status change timed out");
+		core_if->op_state = B_PERIPHERAL;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_pcd_start(core_if);
+	} else {
+		/* A-Device connector (Host Mode) */
+		while (!dwc_otg_is_host_mode(core_if)) {
+			DWC_PRINTF("Waiting for Host Mode, Mode=%s\n",
+				   (dwc_otg_is_host_mode(core_if) ? "Host" :
+				    "Peripheral"));
+			dwc_mdelay(100);
+			if (++count > 10000)
+				break;
+		}
+		DWC_ASSERT(++count < 10000,
+			   "Connection id status change timed out");
+		core_if->op_state = A_HOST;
+		/*
+		 * Initialize the Core for Host mode.
+		 */
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_hcd_start(core_if);
+	}
+}
+
+/**
+ * This function handles the Connector ID Status Change Interrupt.  It
+ * reads the OTG Interrupt Register (GOTCTL) to determine whether this
+ * is a Device to Host Mode transition or a Host Mode to Device
+ * Transition.
+ *
+ * This only occurs when the cable is connected/removed from the PHY
+ * connector.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_conn_id_status_change_intr(dwc_otg_core_if_t * core_if)
+{
+
+	/*
+	 * Need to disable SOF interrupt immediately. If switching from device
+	 * to host, the PCD interrupt handler won't handle the interrupt if
+	 * host mode is already set. The HCD interrupt handler won't get
+	 * called if the HCD state is HALT. This means that the interrupt does
+	 * not get handled and Linux complains loudly.
+	 */
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+	gintsts_data_t gintsts = {.d32 = 0 };
+
+	gintmsk.b.sofintr = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+
+	DWC_DEBUGPL(DBG_CIL,
+		    " ++Connector ID Status Change Interrupt++  (%s)\n",
+		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"));
+
+	DWC_SPINUNLOCK(core_if->lock);
+
+	/*
+	 * Need to schedule a work, as there are possible DELAY function calls
+	 * Release lock before scheduling workq as it holds spinlock during scheduling
+	 */
+
+	DWC_WORKQ_SCHEDULE(core_if->wq_otg, w_conn_id_status_change,
+			   core_if, "connection id status change");
+	DWC_SPINLOCK(core_if->lock);
+
+	/* Set flag and clear interrupt */
+	gintsts.b.conidstschng = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that a device is initiating the Session
+ * Request Protocol to request the host to turn on bus power so a new
+ * session can begin. The handler responds by turning on bus power. If
+ * the DWC_otg controller is in low power mode, the handler brings the
+ * controller out of low power mode before turning on bus power.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_session_req_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+
+#ifndef DWC_HOST_ONLY
+	DWC_DEBUGPL(DBG_ANY, "++Session Request Interrupt++\n");
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		DWC_PRINTF("SRP: Device mode\n");
+	} else {
+		hprt0_data_t hprt0;
+		DWC_PRINTF("SRP: Host mode\n");
+
+		/* Turn on the port power bit. */
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		hprt0.b.prtpwr = 1;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+		/* Start the Connection timer. So a message can be displayed
+		 * if connect does not occur within 10 seconds. */
+		cil_hcd_session_start(core_if);
+	}
+#endif
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.sessreqintr = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+void w_wakeup_detected(void *p)
+{
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) p;
+	/*
+	 * Clear the Resume after 70ms. (Need 20 ms minimum. Use 70 ms
+	 * so that OPT tests pass with all PHYs).
+	 */
+	hprt0_data_t hprt0 = {.d32 = 0 };
+#if 0
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	/* Restart the Phy Clock */
+	pcgcctl.b.stoppclk = 1;
+	DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+	dwc_udelay(10);
+#endif //0
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	DWC_DEBUGPL(DBG_ANY, "Resume: HPRT0=%0x\n", hprt0.d32);
+//      dwc_mdelay(70);
+	hprt0.b.prtres = 0;	/* Resume */
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	DWC_DEBUGPL(DBG_ANY, "Clear Resume: HPRT0=%0x\n",
+		    DWC_READ_REG32(core_if->host_if->hprt0));
+
+	cil_hcd_resume(core_if);
+
+	/** Change to L0 state*/
+	core_if->lx_state = DWC_OTG_L0;
+}
+
+/**
+ * This interrupt indicates that the DWC_otg controller has detected a
+ * resume or remote wakeup sequence. If the DWC_otg controller is in
+ * low power mode, the handler must brings the controller out of low
+ * power mode. The controller automatically begins resume
+ * signaling. The handler schedules a time to stop resume signaling.
+ */
+int32_t dwc_otg_handle_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+
+	DWC_DEBUGPL(DBG_ANY,
+		    "++Resume and Remote Wakeup Detected Interrupt++\n");
+
+	DWC_PRINTF("%s lxstate = %d\n", __func__, core_if->lx_state);
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		dctl_data_t dctl = {.d32 = 0 };
+		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n",
+			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
+					   dsts));
+		if (core_if->lx_state == DWC_OTG_L2) {
+#ifdef PARTIAL_POWER_DOWN
+			if (core_if->hwcfg4.b.power_optimiz) {
+				pcgcctl_data_t power = {.d32 = 0 };
+
+				power.d32 = DWC_READ_REG32(core_if->pcgcctl);
+				DWC_DEBUGPL(DBG_CIL, "PCGCCTL=%0x\n",
+					    power.d32);
+
+				power.b.stoppclk = 0;
+				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+
+				power.b.pwrclmp = 0;
+				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+
+				power.b.rstpdwnmodule = 0;
+				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+			}
+#endif
+			/* Clear the Remote Wakeup Signaling */
+			dctl.b.rmtwkupsig = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, dctl.d32, 0);
+
+			DWC_SPINUNLOCK(core_if->lock);
+			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+			}
+			DWC_SPINLOCK(core_if->lock);
+		} else {
+			glpmcfg_data_t lpmcfg;
+			lpmcfg.d32 =
+			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+			lpmcfg.b.hird_thres &= (~(1 << 4));
+			DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
+					lpmcfg.d32);
+		}
+		/** Change to L0 state*/
+		core_if->lx_state = DWC_OTG_L0;
+	} else {
+		if (core_if->lx_state != DWC_OTG_L1) {
+			pcgcctl_data_t pcgcctl = {.d32 = 0 };
+
+			/* Restart the Phy Clock */
+			pcgcctl.b.stoppclk = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+			DWC_TIMER_SCHEDULE(core_if->wkp_timer, 71);
+		} else {
+			/** Change to L0 state*/
+			core_if->lx_state = DWC_OTG_L0;
+		}
+	}
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.wkupintr = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * Device disconnect.
+ */
+static int32_t dwc_otg_handle_pwrdn_disconnect_intr(dwc_otg_core_if_t *core_if)
+{
+	gpwrdn_data_t gpwrdn = { .d32 = 0 };
+	gpwrdn_data_t gpwrdn_temp = { .d32 = 0 };
+	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+
+	/* Switch on the voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset the core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Disable power clamps*/
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Remove reset the core signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	core_if->hibernation_suspend = 0;
+
+	/* Disable PMU */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	if (gpwrdn_temp.b.idsts) {
+		core_if->op_state = B_PERIPHERAL;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_pcd_start(core_if);
+	} else {
+		core_if->op_state = A_HOST;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_hcd_start(core_if);
+	}
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * remote wakeup sequence.
+ */
+static int32_t dwc_otg_handle_pwrdn_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	DWC_DEBUGPL(DBG_ANY,
+		    "++Powerdown Remote Wakeup Detected Interrupt++\n");
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (gpwrdn.b.idsts) {	// Device Mode
+		if ((core_if->power_down == 2)
+		    && (core_if->hibernation_suspend == 1)) {
+			dwc_otg_device_hibernation_restore(core_if, 0, 0);
+		}
+	} else {
+		if ((core_if->power_down == 2)
+		    && (core_if->hibernation_suspend == 1)) {
+			dwc_otg_host_hibernation_restore(core_if, 1, 0);
+		}
+	}
+	return 1;
+}
+
+static int32_t dwc_otg_handle_pwrdn_idsts_change(dwc_otg_device_t *otg_dev)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+
+	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
+	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (core_if->power_down == 2) {
+		if (!core_if->hibernation_suspend) {
+			DWC_PRINTF("Already exited from Hibernation\n");
+			return 1;
+		}
+		DWC_DEBUGPL(DBG_ANY, "Exit from hibernation on ID sts change\n");
+		/* Switch on the voltage to the core */
+		gpwrdn.b.pwrdnswtch = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Reset the core */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Disable power clamps */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnclmp = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+		/* Remove reset the core signal */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		dwc_udelay(10);
+
+		/* Disable PMU interrupt */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+		/*Indicates that we are exiting from hibernation */
+		core_if->hibernation_suspend = 0;
+
+		/* Disable PMU */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuactv = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		gpwrdn.d32 = core_if->gr_backup->gpwrdn_local;
+		if (gpwrdn.b.dis_vbus == 1) {
+			gpwrdn.d32 = 0;
+			gpwrdn.b.dis_vbus = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		}
+
+		if (gpwrdn_temp.b.idsts) {
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+		} else {
+			core_if->op_state = A_HOST;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_hcd_start(core_if);
+		}
+	}
+
+	if (core_if->adp_enable) {
+		uint8_t is_host = 0;
+		DWC_SPINUNLOCK(core_if->lock);
+		/* Change the core_if's lock to hcd/pcd lock depend on mode? */
+#ifndef DWC_HOST_ONLY
+		if (gpwrdn_temp.b.idsts)
+			core_if->lock = otg_dev->pcd->lock;
+#endif
+#ifndef DWC_DEVICE_ONLY
+		if (!gpwrdn_temp.b.idsts) {
+				core_if->lock = otg_dev->hcd->lock;
+				is_host = 1;
+		}
+#endif
+		DWC_PRINTF("RESTART ADP\n");
+		if (core_if->adp.probe_enabled)
+			dwc_otg_adp_probe_stop(core_if);
+		if (core_if->adp.sense_enabled)
+			dwc_otg_adp_sense_stop(core_if);
+		if (core_if->adp.sense_timer_started)
+			DWC_TIMER_CANCEL(core_if->adp.sense_timer);
+		if (core_if->adp.vbuson_timer_started)
+			DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
+		core_if->adp.probe_timer_values[0] = -1;
+		core_if->adp.probe_timer_values[1] = -1;
+		core_if->adp.sense_timer_started = 0;
+		core_if->adp.vbuson_timer_started = 0;
+		core_if->adp.probe_counter = 0;
+		core_if->adp.gpwrdn = 0;
+
+		/* Disable PMU and restart ADP */
+		gpwrdn_temp.d32 = 0;
+		gpwrdn_temp.b.pmuactv = 1;
+		gpwrdn_temp.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		DWC_PRINTF("Check point 1\n");
+		dwc_mdelay(110);
+		dwc_otg_adp_start(core_if, is_host);
+		DWC_SPINLOCK(core_if->lock);
+	}
+
+
+	return 1;
+}
+
+static int32_t dwc_otg_handle_pwrdn_session_change(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	int32_t otg_cap_param = core_if->core_params->otg_cap;
+	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (core_if->power_down == 2) {
+		if (!core_if->hibernation_suspend) {
+			DWC_PRINTF("Already exited from Hibernation\n");
+			return 1;
+		}
+
+		if ((otg_cap_param != DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
+			 otg_cap_param != DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) &&
+			gpwrdn.b.bsessvld == 0) {
+			/* Save gpwrdn register for further usage if stschng interrupt */
+			core_if->gr_backup->gpwrdn_local =
+				DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+			/*Exit from ISR and wait for stschng interrupt with bsessvld = 1 */
+			return 1;
+		}
+
+		/* Switch on the voltage to the core */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnswtch = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Reset the core */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Disable power clamps */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnclmp = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+		/* Remove reset the core signal */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		dwc_udelay(10);
+
+		/* Disable PMU interrupt */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/*Indicates that we are exiting from hibernation */
+		core_if->hibernation_suspend = 0;
+
+		/* Disable PMU */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuactv = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		core_if->op_state = B_PERIPHERAL;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_pcd_start(core_if);
+
+		if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
+			otg_cap_param == DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) {
+			/*
+			 * Initiate SRP after initial ADP probe.
+			 */
+			dwc_otg_initiate_srp(core_if);
+		}
+	}
+
+	return 1;
+}
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * status change either on IDDIG or BSessVld.
+ */
+static uint32_t dwc_otg_handle_pwrdn_stschng_intr(dwc_otg_device_t *otg_dev)
+{
+	int retval;
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (core_if->power_down == 2) {
+		if (core_if->hibernation_suspend <= 0) {
+			DWC_PRINTF("Already exited from Hibernation\n");
+			return 1;
+		} else
+			gpwrdn_temp.d32 = core_if->gr_backup->gpwrdn_local;
+
+	} else {
+		gpwrdn_temp.d32 = core_if->adp.gpwrdn;
+	}
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+	if (gpwrdn.b.idsts ^ gpwrdn_temp.b.idsts) {
+		retval = dwc_otg_handle_pwrdn_idsts_change(otg_dev);
+	} else if (gpwrdn.b.bsessvld ^ gpwrdn_temp.b.bsessvld) {
+		retval = dwc_otg_handle_pwrdn_session_change(core_if);
+	}
+
+	return retval;
+}
+
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * SRP.
+ */
+static int32_t dwc_otg_handle_pwrdn_srp_intr(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+#ifdef DWC_DEV_SRPCAP
+	if (core_if->pwron_timer_started) {
+		core_if->pwron_timer_started = 0;
+		DWC_TIMER_CANCEL(core_if->pwron_timer);
+	}
+#endif
+
+	/* Switch on the voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset the core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Remove reset the core signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Indicates that we are exiting from hibernation */
+	core_if->hibernation_suspend = 0;
+
+	/* Disable PMU */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Programm Disable VBUS to 0 */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.dis_vbus = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/*Initialize the core as Host */
+	core_if->op_state = A_HOST;
+	dwc_otg_core_init(core_if);
+	dwc_otg_enable_global_interrupts(core_if);
+	cil_hcd_start(core_if);
+
+	return 1;
+}
+
+/** This interrupt indicates that restore command after Hibernation
+ * was completed by the core. */
+int32_t dwc_otg_handle_restore_done_intr(dwc_otg_core_if_t * core_if)
+{
+	pcgcctl_data_t pcgcctl;
+	DWC_DEBUGPL(DBG_ANY, "++Restore Done Interrupt++\n");
+
+	//TODO De-assert restore signal. 8.a
+	pcgcctl.d32 = DWC_READ_REG32(core_if->pcgcctl);
+	if (pcgcctl.b.restoremode == 1) {
+		gintmsk_data_t gintmsk = {.d32 = 0 };
+		/*
+		 * If restore mode is Remote Wakeup,
+		 * unmask Remote Wakeup interrupt.
+		 */
+		gintmsk.b.wkupintr = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+				 0, gintmsk.d32);
+	}
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that a device has been disconnected from
+ * the root port.
+ */
+int32_t dwc_otg_handle_disconnect_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+
+	DWC_DEBUGPL(DBG_ANY, "++Disconnect Detected Interrupt++ (%s) %s\n",
+		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"),
+		    op_state_str(core_if));
+
+/** @todo Consolidate this if statement. */
+#ifndef DWC_HOST_ONLY
+	if (core_if->op_state == B_HOST) {
+		/* If in device mode Disconnect and stop the HCD, then
+		 * start the PCD. */
+		DWC_SPINUNLOCK(core_if->lock);
+		cil_hcd_disconnect(core_if);
+		cil_pcd_start(core_if);
+		DWC_SPINLOCK(core_if->lock);
+		core_if->op_state = B_PERIPHERAL;
+	} else if (dwc_otg_is_device_mode(core_if)) {
+		gotgctl_data_t gotgctl = {.d32 = 0 };
+		gotgctl.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+		if (gotgctl.b.hstsethnpen == 1) {
+			/* Do nothing, if HNP in process the OTG
+			 * interrupt "Host Negotiation Detected"
+			 * interrupt will do the mode switch.
+			 */
+		} else if (gotgctl.b.devhnpen == 0) {
+			/* If in device mode Disconnect and stop the HCD, then
+			 * start the PCD. */
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_disconnect(core_if);
+			cil_pcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = B_PERIPHERAL;
+		} else {
+			DWC_DEBUGPL(DBG_ANY, "!a_peripheral && !devhnpen\n");
+		}
+	} else {
+		if (core_if->op_state == A_HOST) {
+			/* A-Cable still connected but device disconnected. */
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_disconnect(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			if (core_if->adp_enable) {
+				gpwrdn_data_t gpwrdn = { .d32 = 0 };
+				cil_hcd_stop(core_if);
+				/* Enable Power Down Logic */
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_otg_adp_probe_start(core_if);
+
+				/* Power off the core */
+				if (core_if->power_down == 2) {
+					gpwrdn.d32 = 0;
+					gpwrdn.b.pwrdnswtch = 1;
+					DWC_MODIFY_REG32
+					    (&core_if->core_global_regs->gpwrdn,
+					     gpwrdn.d32, 0);
+				}
+			}
+		}
+	}
+#endif
+	/* Change to L3(OFF) state */
+	core_if->lx_state = DWC_OTG_L3;
+
+	gintsts.d32 = 0;
+	gintsts.b.disconnect = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+	return 1;
+}
+
+/**
+ * This interrupt indicates that SUSPEND state has been detected on
+ * the USB.
+ *
+ * For HNP the USB Suspend interrupt signals the change from
+ * "a_peripheral" to "a_host".
+ *
+ * When power management is enabled the core will be put in low power
+ * mode.
+ */
+int32_t dwc_otg_handle_usb_suspend_intr(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	gintsts_data_t gintsts;
+	dcfg_data_t dcfg;
+
+	DWC_DEBUGPL(DBG_ANY, "USB SUSPEND\n");
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		/* Check the Device status register to determine if the Suspend
+		 * state is active. */
+		dsts.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n", dsts.d32);
+		DWC_DEBUGPL(DBG_PCD, "DSTS.Suspend Status=%d "
+			    "HWCFG4.power Optimize=%d\n",
+			    dsts.b.suspsts, core_if->hwcfg4.b.power_optimiz);
+
+#ifdef PARTIAL_POWER_DOWN
+/** @todo Add a module parameter for power management. */
+
+		if (dsts.b.suspsts && core_if->hwcfg4.b.power_optimiz) {
+			pcgcctl_data_t power = {.d32 = 0 };
+			DWC_DEBUGPL(DBG_CIL, "suspend\n");
+
+			power.b.pwrclmp = 1;
+			DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+
+			power.b.rstpdwnmodule = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
+
+			power.b.stoppclk = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
+
+		} else {
+			DWC_DEBUGPL(DBG_ANY, "disconnect?\n");
+		}
+#endif
+		/* PCD callback for suspend. Release the lock inside of callback function */
+		cil_pcd_suspend(core_if);
+		if (core_if->power_down == 2)
+		{
+			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+			DWC_DEBUGPL(DBG_ANY,"lx_state = %08x\n",core_if->lx_state);
+			DWC_DEBUGPL(DBG_ANY," device address = %08d\n",dcfg.b.devaddr);
+
+			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				gpwrdn_data_t gpwrdn = {.d32 = 0 };
+				gusbcfg_data_t gusbcfg = {.d32 = 0 };
+
+				/* Change to L2(suspend) state */
+				core_if->lx_state = DWC_OTG_L2;
+
+				/* Clear interrupt in gintsts */
+				gintsts.d32 = 0;
+				gintsts.b.usbsuspend = 1;
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+						gintsts, gintsts.d32);
+				DWC_PRINTF("Start of hibernation completed\n");
+				dwc_otg_save_global_regs(core_if);
+				dwc_otg_save_dev_regs(core_if);
+
+				gusbcfg.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->
+						   gusbcfg);
+				if (gusbcfg.b.ulpi_utmi_sel == 1) {
+					/* ULPI interface */
+					/* Suspend the Phy Clock */
+					pcgcctl.d32 = 0;
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+							 pcgcctl.d32);
+					dwc_udelay(10);
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+				} else {
+					/* UTMI+ Interface */
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+					dwc_udelay(10);
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+							 pcgcctl.d32);
+					dwc_udelay(10);
+				}
+
+				/* Set flag to indicate that we are in hibernation */
+				core_if->hibernation_suspend = 1;
+				/* Enable interrupts from wake up logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Unmask device mode interrupts in GPWRDN */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.rst_det_msk = 1;
+				gpwrdn.b.lnstchng_msk = 1;
+				gpwrdn.b.sts_chngint_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Enable Power Down Clamp */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnclmp = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Switch off VDD */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				/* Save gpwrdn register for further usage if stschng interrupt */
+				core_if->gr_backup->gpwrdn_local =
+							DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+				DWC_PRINTF("Hibernation completed\n");
+
+				return 1;
+			}
+		} else if (core_if->power_down == 3) {
+			pcgcctl_data_t pcgcctl = {.d32 = 0 };
+			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+			DWC_DEBUGPL(DBG_ANY, "lx_state = %08x\n",core_if->lx_state);
+			DWC_DEBUGPL(DBG_ANY, " device address = %08d\n",dcfg.b.devaddr);
+
+			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
+				DWC_DEBUGPL(DBG_ANY, "Start entering to extended hibernation\n");
+				core_if->xhib = 1;
+
+				/* Clear interrupt in gintsts */
+				gintsts.d32 = 0;
+				gintsts.b.usbsuspend = 1;
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+					gintsts, gintsts.d32);
+
+				dwc_otg_save_global_regs(core_if);
+				dwc_otg_save_dev_regs(core_if);
+
+				/* Wait for 10 PHY clocks */
+				dwc_udelay(10);
+
+				/* Program GPIO register while entering to xHib */
+				DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x1);
+
+				pcgcctl.b.enbl_extnd_hiber = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+				pcgcctl.d32 = 0;
+				pcgcctl.b.extnd_hiber_pwrclmp = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+				pcgcctl.d32 = 0;
+				pcgcctl.b.extnd_hiber_switch = 1;
+				core_if->gr_backup->xhib_gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+				core_if->gr_backup->xhib_pcgcctl = DWC_READ_REG32(core_if->pcgcctl) | pcgcctl.d32;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+				DWC_DEBUGPL(DBG_ANY, "Finished entering to extended hibernation\n");
+
+				return 1;
+			}
+		}
+	} else {
+		if (core_if->op_state == A_PERIPHERAL) {
+			DWC_DEBUGPL(DBG_ANY, "a_peripheral->a_host\n");
+			/* Clear the a_peripheral flag, back to a_host. */
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_pcd_stop(core_if);
+			cil_hcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = A_HOST;
+		}
+	}
+
+	/* Change to L2(suspend) state */
+	core_if->lx_state = DWC_OTG_L2;
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.usbsuspend = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+static int32_t dwc_otg_handle_xhib_exit_intr(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	gahbcfg_data_t gahbcfg = {.d32 = 0 };
+
+	dwc_udelay(10);
+
+	/* Program GPIO register while entering to xHib */
+	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x0);
+
+	pcgcctl.d32 = core_if->gr_backup->xhib_pcgcctl;
+	pcgcctl.b.extnd_hiber_pwrclmp = 0;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	dwc_udelay(10);
+
+	gpwrdn.d32 = core_if->gr_backup->xhib_gpwrdn;
+	gpwrdn.b.restore = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32);
+	dwc_udelay(10);
+
+	restore_lpm_i2c_regs(core_if);
+
+	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
+	pcgcctl.b.max_xcvrselect = 1;
+	pcgcctl.b.ess_reg_restored = 0;
+	pcgcctl.b.extnd_hiber_switch = 0;
+	pcgcctl.b.extnd_hiber_pwrclmp = 0;
+	pcgcctl.b.enbl_extnd_hiber = 1;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+
+	gahbcfg.d32 = core_if->gr_backup->gahbcfg_local;
+	gahbcfg.b.glblintrmsk = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0x1 << 16);
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
+			core_if->gr_backup->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
+			core_if->dr_backup->dcfg);
+
+	pcgcctl.d32 = 0;
+	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
+	pcgcctl.b.max_xcvrselect = 1;
+	pcgcctl.d32 |= 0x608;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	dwc_udelay(10);
+
+	pcgcctl.d32 = 0;
+	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
+	pcgcctl.b.max_xcvrselect = 1;
+	pcgcctl.b.ess_reg_restored = 1;
+	pcgcctl.b.enbl_extnd_hiber = 1;
+	pcgcctl.b.rstpdwnmodule = 1;
+	pcgcctl.b.restoremode = 1;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+
+	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
+
+	return 1;
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * This function hadles LPM transaction received interrupt.
+ */
+static int32_t dwc_otg_handle_lpm_intr(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	gintsts_data_t gintsts;
+
+	if (!core_if->core_params->lpm_enable) {
+		DWC_PRINTF("Unexpected LPM interrupt\n");
+	}
+
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	DWC_PRINTF("LPM config register = 0x%08x\n", lpmcfg.d32);
+
+	if (dwc_otg_is_host_mode(core_if)) {
+		cil_hcd_sleep(core_if);
+	} else {
+		lpmcfg.b.hird_thres |= (1 << 4);
+		DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
+				lpmcfg.d32);
+	}
+
+	/* Examine prt_sleep_sts after TL1TokenTetry period max (10 us) */
+	dwc_udelay(10);
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	if (lpmcfg.b.prt_sleep_sts) {
+		/* Save the current state */
+		core_if->lx_state = DWC_OTG_L1;
+	}
+
+	/* Clear interrupt  */
+	gintsts.d32 = 0;
+	gintsts.b.lpmtranrcvd = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+	return 1;
+}
+#endif /* CONFIG_USB_DWC_OTG_LPM */
+
+/**
+ * This function returns the Core Interrupt register.
+ */
+static inline uint32_t dwc_otg_read_common_intr(dwc_otg_core_if_t * core_if, gintmsk_data_t *reenable_gintmsk, dwc_otg_hcd_t *hcd)
+{
+	gahbcfg_data_t gahbcfg = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk;
+	gintmsk_data_t gintmsk_common = {.d32 = 0 };
+	gintmsk_common.b.wkupintr = 1;
+	gintmsk_common.b.sessreqintr = 1;
+	gintmsk_common.b.conidstschng = 1;
+	gintmsk_common.b.otgintr = 1;
+	gintmsk_common.b.modemismatch = 1;
+	gintmsk_common.b.disconnect = 1;
+	gintmsk_common.b.usbsuspend = 1;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	gintmsk_common.b.lpmtranrcvd = 1;
+#endif
+	gintmsk_common.b.restoredone = 1;
+	if(dwc_otg_is_device_mode(core_if))
+	{
+		/** @todo: The port interrupt occurs while in device
+		 * mode. Added code to CIL to clear the interrupt for now!
+		 */
+		gintmsk_common.b.portintr = 1;
+	}
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+	if(fiq_enable) {
+		local_fiq_disable();
+		/* Pull in the interrupts that the FIQ has masked */
+		gintmsk.d32 |= ~(hcd->fiq_state->gintmsk_saved.d32);
+		gintmsk.d32 |= gintmsk_common.d32;
+		/* for the upstairs function to reenable - have to read it here in case FIQ triggers again */
+		reenable_gintmsk->d32 = gintmsk.d32;
+		local_fiq_enable();
+	}
+
+	gahbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
+
+#ifdef DEBUG
+	/* if any common interrupts set */
+	if (gintsts.d32 & gintmsk_common.d32) {
+		DWC_DEBUGPL(DBG_ANY, "common_intr: gintsts=%08x  gintmsk=%08x\n",
+			    gintsts.d32, gintmsk.d32);
+	}
+#endif
+	if (!fiq_enable){
+		if (gahbcfg.b.glblintrmsk)
+			return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
+		else
+			return 0;
+	} else {
+		/* Our IRQ kicker is no longer the USB hardware, it's the MPHI interface.
+		 * Can't trust the global interrupt mask bit in this case.
+		 */
+		return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
+	}
+
+}
+
+/* MACRO for clearing interupt bits in GPWRDN register */
+#define CLEAR_GPWRDN_INTR(__core_if,__intr) \
+do { \
+		gpwrdn_data_t gpwrdn = {.d32=0}; \
+		gpwrdn.b.__intr = 1; \
+		DWC_MODIFY_REG32(&__core_if->core_global_regs->gpwrdn, \
+		0, gpwrdn.d32); \
+} while (0)
+
+/**
+ * Common interrupt handler.
+ *
+ * The common interrupts are those that occur in both Host and Device mode.
+ * This handler handles the following interrupts:
+ * - Mode Mismatch Interrupt
+ * - Disconnect Interrupt
+ * - OTG Interrupt
+ * - Connector ID Status Change Interrupt
+ * - Session Request Interrupt.
+ * - Resume / Remote Wakeup Detected Interrupt.
+ * - LPM Transaction Received Interrupt
+ * - ADP Transaction Received Interrupt
+ *
+ */
+int32_t dwc_otg_handle_common_intr(void *dev)
+{
+	int retval = 0;
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk_reenable = { .d32 = 0 };
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	dwc_otg_device_t *otg_dev = dev;
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (dwc_otg_is_device_mode(core_if))
+		core_if->frame_num = dwc_otg_get_frame_number(core_if);
+
+	if (core_if->lock)
+		DWC_SPINLOCK(core_if->lock);
+
+	if (core_if->power_down == 3 && core_if->xhib == 1) {
+		DWC_DEBUGPL(DBG_ANY, "Exiting from xHIB state\n");
+		retval |= dwc_otg_handle_xhib_exit_intr(core_if);
+		core_if->xhib = 2;
+		if (core_if->lock)
+			DWC_SPINUNLOCK(core_if->lock);
+
+		return retval;
+	}
+
+	if (core_if->hibernation_suspend <= 0) {
+		/* read_common will have to poke the FIQ's saved mask. We must then clear this mask at the end
+		 * of this handler - god only knows why it's done like this
+		 */
+		gintsts.d32 = dwc_otg_read_common_intr(core_if, &gintmsk_reenable, otg_dev->hcd);
+
+		if (gintsts.b.modemismatch) {
+			retval |= dwc_otg_handle_mode_mismatch_intr(core_if);
+		}
+		if (gintsts.b.otgintr) {
+			retval |= dwc_otg_handle_otg_intr(core_if);
+		}
+		if (gintsts.b.conidstschng) {
+			retval |=
+			    dwc_otg_handle_conn_id_status_change_intr(core_if);
+		}
+		if (gintsts.b.disconnect) {
+			retval |= dwc_otg_handle_disconnect_intr(core_if);
+		}
+		if (gintsts.b.sessreqintr) {
+			retval |= dwc_otg_handle_session_req_intr(core_if);
+		}
+		if (gintsts.b.wkupintr) {
+			retval |= dwc_otg_handle_wakeup_detected_intr(core_if);
+		}
+		if (gintsts.b.usbsuspend) {
+			retval |= dwc_otg_handle_usb_suspend_intr(core_if);
+		}
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		if (gintsts.b.lpmtranrcvd) {
+			retval |= dwc_otg_handle_lpm_intr(core_if);
+		}
+#endif
+		if (gintsts.b.restoredone) {
+			gintsts.d32 = 0;
+	                if (core_if->power_down == 2)
+				core_if->hibernation_suspend = -1;
+			else if (core_if->power_down == 3 && core_if->xhib == 2) {
+				gpwrdn_data_t gpwrdn = {.d32 = 0 };
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				dctl_data_t dctl = {.d32 = 0 };
+
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+						gintsts, 0xFFFFFFFF);
+
+				DWC_DEBUGPL(DBG_ANY,
+					    "RESTORE DONE generated\n");
+
+				gpwrdn.b.restore = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+				dwc_udelay(10);
+
+				pcgcctl.b.rstpdwnmodule = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+
+				DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, core_if->gr_backup->gusbcfg_local);
+				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, core_if->dr_backup->dcfg);
+				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, core_if->dr_backup->dctl);
+				dwc_udelay(50);
+
+				dctl.b.pwronprgdone = 1;
+				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+				dwc_udelay(10);
+
+				dwc_otg_restore_global_regs(core_if);
+				dwc_otg_restore_dev_regs(core_if, 0);
+
+				dctl.d32 = 0;
+				dctl.b.pwronprgdone = 1;
+				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
+				dwc_udelay(10);
+
+				pcgcctl.d32 = 0;
+				pcgcctl.b.enbl_extnd_hiber = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+
+				/* The core will be in ON STATE */
+				core_if->lx_state = DWC_OTG_L0;
+				core_if->xhib = 0;
+
+				DWC_SPINUNLOCK(core_if->lock);
+				if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+					core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+				}
+				DWC_SPINLOCK(core_if->lock);
+
+			}
+
+			gintsts.b.restoredone = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
+			DWC_PRINTF(" --Restore done interrupt received-- \n");
+			retval |= 1;
+		}
+		if (gintsts.b.portintr && dwc_otg_is_device_mode(core_if)) {
+			/* The port interrupt occurs while in device mode with HPRT0
+			 * Port Enable/Disable.
+			 */
+			gintsts.d32 = 0;
+			gintsts.b.portintr = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
+			retval |= 1;
+			gintmsk_reenable.b.portintr = 1;
+
+		}
+		/* Did we actually handle anything? if so, unmask the interrupt */
+//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "CILOUT %1d", retval);
+//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintsts.d32);
+//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintmsk_reenable.d32);
+		if (retval && fiq_enable) {
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_reenable.d32);
+		}
+
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "gpwrdn=%08x\n", gpwrdn.d32);
+
+		if (gpwrdn.b.disconn_det && gpwrdn.b.disconn_det_msk) {
+			CLEAR_GPWRDN_INTR(core_if, disconn_det);
+			if (gpwrdn.b.linestate == 0) {
+				dwc_otg_handle_pwrdn_disconnect_intr(core_if);
+			} else {
+				DWC_PRINTF("Disconnect detected while linestate is not 0\n");
+			}
+
+			retval |= 1;
+		}
+		if (gpwrdn.b.lnstschng && gpwrdn.b.lnstchng_msk) {
+			CLEAR_GPWRDN_INTR(core_if, lnstschng);
+			/* remote wakeup from hibernation */
+			if (gpwrdn.b.linestate == 2 || gpwrdn.b.linestate == 1) {
+				dwc_otg_handle_pwrdn_wakeup_detected_intr(core_if);
+			} else {
+				DWC_PRINTF("gpwrdn.linestate = %d\n", gpwrdn.b.linestate);
+			}
+			retval |= 1;
+		}
+		if (gpwrdn.b.rst_det && gpwrdn.b.rst_det_msk) {
+			CLEAR_GPWRDN_INTR(core_if, rst_det);
+			if (gpwrdn.b.linestate == 0) {
+				DWC_PRINTF("Reset detected\n");
+				retval |= dwc_otg_device_hibernation_restore(core_if, 0, 1);
+			}
+		}
+		if (gpwrdn.b.srp_det && gpwrdn.b.srp_det_msk) {
+			CLEAR_GPWRDN_INTR(core_if, srp_det);
+			dwc_otg_handle_pwrdn_srp_intr(core_if);
+			retval |= 1;
+		}
+	}
+	/* Handle ADP interrupt here */
+	if (gpwrdn.b.adp_int) {
+		DWC_PRINTF("ADP interrupt\n");
+		CLEAR_GPWRDN_INTR(core_if, adp_int);
+		dwc_otg_adp_handle_intr(core_if);
+		retval |= 1;
+	}
+	if (gpwrdn.b.sts_chngint && gpwrdn.b.sts_chngint_msk) {
+		DWC_PRINTF("STS CHNG interrupt asserted\n");
+		CLEAR_GPWRDN_INTR(core_if, sts_chngint);
+		dwc_otg_handle_pwrdn_stschng_intr(otg_dev);
+
+		retval |= 1;
+	}
+	if (core_if->lock)
+		DWC_SPINUNLOCK(core_if->lock);
+	return retval;
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_core_if.h b/drivers/usb/host/dwc_otg/dwc_otg_core_if.h
new file mode 100644
index 0000000000000..4138fd173337d
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_core_if.h
@@ -0,0 +1,705 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_core_if.h $
+ * $Revision: #13 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#if !defined(__DWC_CORE_IF_H__)
+#define __DWC_CORE_IF_H__
+
+#include "dwc_os.h"
+
+/** @file
+ * This file defines DWC_OTG Core API
+ */
+
+struct dwc_otg_core_if;
+typedef struct dwc_otg_core_if dwc_otg_core_if_t;
+
+/** Maximum number of Periodic FIFOs */
+#define MAX_PERIO_FIFOS 15
+/** Maximum number of Periodic FIFOs */
+#define MAX_TX_FIFOS 15
+
+/** Maximum number of Endpoints/HostChannels */
+#define MAX_EPS_CHANNELS 16
+
+extern dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * _reg_base_addr);
+extern void dwc_otg_core_init(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_cil_remove(dwc_otg_core_if_t * _core_if);
+
+extern void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * _core_if);
+
+extern uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if);
+extern uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if);
+
+extern uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if);
+
+/** This function should be called on every hardware interrupt. */
+extern int32_t dwc_otg_handle_common_intr(void *otg_dev);
+
+/** @name OTG Core Parameters */
+/** @{ */
+
+/**
+ * Specifies the OTG capabilities. The driver will automatically
+ * detect the value for this parameter if none is specified.
+ * 0 - HNP and SRP capable (default)
+ * 1 - SRP Only capable
+ * 2 - No HNP/SRP capable
+ */
+extern int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if);
+#define DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE 0
+#define DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE 1
+#define DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE 2
+#define dwc_param_otg_cap_default DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE
+
+extern int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if);
+#define dwc_param_opt_default 1
+
+/**
+ * Specifies whether to use slave or DMA mode for accessing the data
+ * FIFOs. The driver will automatically detect the value for this
+ * parameter if none is specified.
+ * 0 - Slave
+ * 1 - DMA (default, if available)
+ */
+extern int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_dma_enable_default 1
+
+/**
+ * When DMA mode is enabled specifies whether to use
+ * address DMA or DMA Descritor mode for accessing the data
+ * FIFOs in device mode. The driver will automatically detect
+ * the value for this parameter if none is specified.
+ * 0 - address DMA
+ * 1 - DMA Descriptor(default, if available)
+ */
+extern int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if,
+					     int32_t val);
+extern int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if);
+//#define dwc_param_dma_desc_enable_default 1
+#define dwc_param_dma_desc_enable_default 0 // Broadcom BCM2708
+
+/** The DMA Burst size (applicable only for External DMA
+ * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
+ */
+extern int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if,
+					    int32_t val);
+extern int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if);
+#define dwc_param_dma_burst_size_default 32
+
+/**
+ * Specifies the maximum speed of operation in host and device mode.
+ * The actual speed depends on the speed of the attached device and
+ * the value of phy_type. The actual speed depends on the speed of the
+ * attached device.
+ * 0 - High Speed (default)
+ * 1 - Full Speed
+ */
+extern int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if);
+#define dwc_param_speed_default 0
+#define DWC_SPEED_PARAM_HIGH 0
+#define DWC_SPEED_PARAM_FULL 1
+
+/** Specifies whether low power mode is supported when attached
+ *	to a Full Speed or Low Speed device in host mode.
+ * 0 - Don't support low power mode (default)
+ * 1 - Support low power mode
+ */
+extern int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
+							  core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t
+							      * core_if);
+#define dwc_param_host_support_fs_ls_low_power_default 0
+
+/** Specifies the PHY clock rate in low power mode when connected to a
+ * Low Speed device in host mode. This parameter is applicable only if
+ * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
+ * then defaults to 6 MHZ otherwise 48 MHZ.
+ *
+ * 0 - 48 MHz
+ * 1 - 6 MHz
+ */
+extern int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
+						       core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
+							   core_if);
+#define dwc_param_host_ls_low_power_phy_clk_default 0
+#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ 0
+#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ 1
+
+/**
+ * 0 - Use cC FIFO size parameters
+ * 1 - Allow dynamic FIFO sizing (default)
+ */
+extern int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
+						 int32_t val);
+extern int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t *
+						     core_if);
+#define dwc_param_enable_dynamic_fifo_default 1
+
+/** Total number of 4-byte words in the data FIFO memory. This
+ * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
+ * Tx FIFOs.
+ * 32 to 32768 (default 8192)
+ * Note: The total FIFO memory depth in the FPGA configuration is 8192.
+ */
+extern int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if,
+					    int32_t val);
+extern int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if);
+//#define dwc_param_data_fifo_size_default 8192
+#define dwc_param_data_fifo_size_default 0xFF0 // Broadcom BCM2708
+
+/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
+ * FIFO sizing is enabled.
+ * 16 to 32768 (default 1064)
+ */
+extern int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int32_t val);
+extern int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if);
+#define dwc_param_dev_rx_fifo_size_default 1064
+
+/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
+ * when dynamic FIFO sizing is enabled.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
+						     core_if, int32_t val);
+extern int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
+							 core_if);
+#define dwc_param_dev_nperio_tx_fifo_size_default 1024
+
+/** Number of 4-byte words in each of the periodic Tx FIFOs in device
+ * mode when dynamic FIFO sizing is enabled.
+ * 4 to 768 (default 256)
+ */
+extern int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+						    int32_t val, int fifo_num);
+extern int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t *
+							core_if, int fifo_num);
+#define dwc_param_dev_perio_tx_fifo_size_default 256
+
+/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
+ * FIFO sizing is enabled.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
+					       int32_t val);
+extern int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if);
+//#define dwc_param_host_rx_fifo_size_default 1024
+#define dwc_param_host_rx_fifo_size_default 774 // Broadcom BCM2708
+
+/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
+ * when Dynamic FIFO sizing is enabled in the core.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
+						      core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
+							  core_if);
+//#define dwc_param_host_nperio_tx_fifo_size_default 1024
+#define dwc_param_host_nperio_tx_fifo_size_default 0x100 // Broadcom BCM2708
+
+/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
+ * FIFO sizing is enabled.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
+						     core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
+							 core_if);
+//#define dwc_param_host_perio_tx_fifo_size_default 1024
+#define dwc_param_host_perio_tx_fifo_size_default 0x200 // Broadcom BCM2708
+
+/** The maximum transfer size supported in bytes.
+ * 2047 to 65,535  (default 65,535)
+ */
+extern int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
+					       int32_t val);
+extern int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if);
+#define dwc_param_max_transfer_size_default 65535
+
+/** The maximum number of packets in a transfer.
+ * 15 to 511  (default 511)
+ */
+extern int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if,
+					      int32_t val);
+extern int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if);
+#define dwc_param_max_packet_count_default 511
+
+/** The number of host channel registers to use.
+ * 1 to 16 (default 12)
+ * Note: The FPGA configuration supports a maximum of 12 host channels.
+ */
+extern int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if);
+//#define dwc_param_host_channels_default 12
+#define dwc_param_host_channels_default 8 // Broadcom BCM2708
+
+/** The number of endpoints in addition to EP0 available for device
+ * mode operations.
+ * 1 to 15 (default 6 IN and OUT)
+ * Note: The FPGA configuration supports a maximum of 6 IN and OUT
+ * endpoints in addition to EP0.
+ */
+extern int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if);
+#define dwc_param_dev_endpoints_default 6
+
+/**
+ * Specifies the type of PHY interface to use. By default, the driver
+ * will automatically detect the phy_type.
+ *
+ * 0 - Full Speed PHY
+ * 1 - UTMI+ (default)
+ * 2 - ULPI
+ */
+extern int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if);
+#define DWC_PHY_TYPE_PARAM_FS 0
+#define DWC_PHY_TYPE_PARAM_UTMI 1
+#define DWC_PHY_TYPE_PARAM_ULPI 2
+#define dwc_param_phy_type_default DWC_PHY_TYPE_PARAM_UTMI
+
+/**
+ * Specifies the UTMI+ Data Width. This parameter is
+ * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
+ * PHY_TYPE, this parameter indicates the data width between
+ * the MAC and the ULPI Wrapper.) Also, this parameter is
+ * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
+ * to "8 and 16 bits", meaning that the core has been
+ * configured to work at either data path width.
+ *
+ * 8 or 16 bits (default 16)
+ */
+extern int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if,
+					    int32_t val);
+extern int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if);
+//#define dwc_param_phy_utmi_width_default 16
+#define dwc_param_phy_utmi_width_default 8 // Broadcom BCM2708
+
+/**
+ * Specifies whether the ULPI operates at double or single
+ * data rate. This parameter is only applicable if PHY_TYPE is
+ * ULPI.
+ *
+ * 0 - single data rate ULPI interface with 8 bit wide data
+ * bus (default)
+ * 1 - double data rate ULPI interface with 4 bit wide data
+ * bus
+ */
+extern int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if,
+					  int32_t val);
+extern int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if);
+#define dwc_param_phy_ulpi_ddr_default 0
+
+/**
+ * Specifies whether to use the internal or external supply to
+ * drive the vbus with a ULPI phy.
+ */
+extern int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
+					       int32_t val);
+extern int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if);
+#define DWC_PHY_ULPI_INTERNAL_VBUS 0
+#define DWC_PHY_ULPI_EXTERNAL_VBUS 1
+#define dwc_param_phy_ulpi_ext_vbus_default DWC_PHY_ULPI_INTERNAL_VBUS
+
+/**
+ * Specifies whether to use the I2Cinterface for full speed PHY. This
+ * parameter is only applicable if PHY_TYPE is FS.
+ * 0 - No (default)
+ * 1 - Yes
+ */
+extern int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_i2c_enable_default 0
+
+extern int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if);
+#define dwc_param_ulpi_fs_ls_default 0
+
+extern int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if);
+#define dwc_param_ts_dline_default 0
+
+/**
+ * Specifies whether dedicated transmit FIFOs are
+ * enabled for non periodic IN endpoints in device mode
+ * 0 - No
+ * 1 - Yes
+ */
+extern int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
+						 int32_t val);
+extern int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t *
+						     core_if);
+#define dwc_param_en_multiple_tx_fifo_default 1
+
+/** Number of 4-byte words in each of the Tx FIFOs in device
+ * mode when dynamic FIFO sizing is enabled.
+ * 4 to 768 (default 256)
+ */
+extern int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int fifo_num, int32_t val);
+extern int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
+						  int fifo_num);
+#define dwc_param_dev_tx_fifo_size_default 768
+
+/** Thresholding enable flag-
+ * bit 0 - enable non-ISO Tx thresholding
+ * bit 1 - enable ISO Tx thresholding
+ * bit 2 - enable Rx thresholding
+ */
+extern int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_thr_ctl(dwc_otg_core_if_t * core_if, int fifo_num);
+#define dwc_param_thr_ctl_default 0
+
+/** Thresholding length for Tx
+ * FIFOs in 32 bit DWORDs
+ */
+extern int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_tx_thr_length(dwc_otg_core_if_t * core_if);
+#define dwc_param_tx_thr_length_default 64
+
+/** Thresholding length for Rx
+ *	FIFOs in 32 bit DWORDs
+ */
+extern int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_rx_thr_length(dwc_otg_core_if_t * core_if);
+#define dwc_param_rx_thr_length_default 64
+
+/**
+ * Specifies whether LPM (Link Power Management) support is enabled
+ */
+extern int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_lpm_enable_default 1
+
+/**
+ * Specifies whether PTI enhancement is enabled
+ */
+extern int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_pti_enable_default 0
+
+/**
+ * Specifies whether MPI enhancement is enabled
+ */
+extern int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_mpi_enable_default 0
+
+/**
+ * Specifies whether ADP capability is enabled
+ */
+extern int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_adp_enable_default 0
+
+/**
+ * Specifies whether IC_USB capability is enabled
+ */
+
+extern int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if);
+#define dwc_param_ic_usb_cap_default 0
+
+extern int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if);
+#define dwc_param_ahb_thr_ratio_default 0
+
+extern int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if);
+#define dwc_param_power_down_default 0
+
+extern int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if);
+#define dwc_param_reload_ctl_default 0
+
+extern int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if,
+										int32_t val);
+extern int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if);
+#define dwc_param_dev_out_nak_default 0
+
+extern int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if,
+										 int32_t val);
+extern int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if);
+#define dwc_param_cont_on_bna_default 0
+
+extern int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if,
+										 int32_t val);
+extern int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if);
+#define dwc_param_ahb_single_default 0
+
+extern int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if);
+#define dwc_param_otg_ver_default 0
+
+/** @} */
+
+/** @name Access to registers and bit-fields */
+
+/**
+ * Dump core registers and SPRAM
+ */
+extern void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_dump_spram(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_dump_host_registers(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_dump_global_registers(dwc_otg_core_if_t * _core_if);
+
+/**
+ * Get host negotiation status.
+ */
+extern uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get srp status
+ */
+extern uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if);
+
+/**
+ * Set hnpreq bit in the GOTGCTL register.
+ */
+extern void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get Content of SNPSID register.
+ */
+extern uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get current mode.
+ * Returns 0 if in device mode, and 1 if in host mode.
+ */
+extern uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of hnpcapable field in the GUSBCFG register
+ */
+extern uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of hnpcapable field in the GUSBCFG register
+ */
+extern void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of srpcapable field in the GUSBCFG register
+ */
+extern uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of srpcapable field in the GUSBCFG register
+ */
+extern void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of devspeed field in the DCFG register
+ */
+extern uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of devspeed field in the DCFG register
+ */
+extern void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get the value of busconnected field from the HPRT0 register
+ */
+extern uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if);
+
+/**
+ * Gets the device enumeration Speed.
+ */
+extern uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of prtpwr field from the HPRT0 register
+ */
+extern uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of flag indicating core state - hibernated or not
+ */
+extern uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if);
+
+/**
+ * Set value of prtpwr field from the HPRT0 register
+ */
+extern void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of prtsusp field from the HPRT0 regsiter
+ */
+extern uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of prtpwr field from the HPRT0 register
+ */
+extern void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of ModeChTimEn field from the HCFG regsiter
+ */
+extern uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of ModeChTimEn field from the HCFG regsiter
+ */
+extern void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of Fram Interval field from the HFIR regsiter
+ */
+extern uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of Frame Interval field from the HFIR regsiter
+ */
+extern void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Set value of prtres field from the HPRT0 register
+ *FIXME Remove?
+ */
+extern void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of rmtwkupsig bit in DCTL register
+ */
+extern uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of prt_sleep_sts field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of rem_wkup_en field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of appl_resp field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of appl_resp field from the GLPMCFG register
+ */
+extern void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of hsic_connect field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of hsic_connect field from the GLPMCFG register
+ */
+extern void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of inv_sel_hsic field from the GLPMCFG register.
+ */
+extern uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of inv_sel_hsic field from the GLPMFG register.
+ */
+extern void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/*
+ * Some functions for accessing registers
+ */
+
+/**
+ *  GOTGCTL register
+ */
+extern uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GUSBCFG register
+ */
+extern uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GRXFSIZ register
+ */
+extern uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GNPTXFSIZ register
+ */
+extern uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
+
+extern uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GGPIO register
+ */
+extern uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GUID register
+ */
+extern uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * HPRT0 register
+ */
+extern uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GHPTXFSIZE
+ */
+extern uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if);
+
+/** @} */
+
+#endif				/* __DWC_CORE_IF_H__ */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_dbg.h b/drivers/usb/host/dwc_otg/dwc_otg_dbg.h
new file mode 100644
index 0000000000000..ccc24e010e449
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_dbg.h
@@ -0,0 +1,117 @@
+/* ==========================================================================
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_DBG_H__
+#define __DWC_OTG_DBG_H__
+
+/** @file
+ * This file defines debug levels.
+ * Debugging support vanishes in non-debug builds.
+ */
+
+/**
+ * The Debug Level bit-mask variable.
+ */
+extern uint32_t g_dbg_lvl;
+/**
+ * Set the Debug Level variable.
+ */
+static inline uint32_t SET_DEBUG_LEVEL(const uint32_t new)
+{
+	uint32_t old = g_dbg_lvl;
+	g_dbg_lvl = new;
+	return old;
+}
+
+#define DBG_USER	(0x1)
+/** When debug level has the DBG_CIL bit set, display CIL Debug messages. */
+#define DBG_CIL		(0x2)
+/** When debug level has the DBG_CILV bit set, display CIL Verbose debug
+ * messages */
+#define DBG_CILV	(0x20)
+/**  When debug level has the DBG_PCD bit set, display PCD (Device) debug
+ *  messages */
+#define DBG_PCD		(0x4)
+/** When debug level has the DBG_PCDV set, display PCD (Device) Verbose debug
+ * messages */
+#define DBG_PCDV	(0x40)
+/** When debug level has the DBG_HCD bit set, display Host debug messages */
+#define DBG_HCD		(0x8)
+/** When debug level has the DBG_HCDV bit set, display Verbose Host debug
+ * messages */
+#define DBG_HCDV	(0x80)
+/** When debug level has the DBG_HCD_URB bit set, display enqueued URBs in host
+ *  mode. */
+#define DBG_HCD_URB	(0x800)
+/** When debug level has the DBG_HCDI bit set, display host interrupt
+ *  messages. */
+#define DBG_HCDI	(0x1000)
+
+/** When debug level has any bit set, display debug messages */
+#define DBG_ANY		(0xFF)
+
+/** All debug messages off */
+#define DBG_OFF		0
+
+/** Prefix string for DWC_DEBUG print macros. */
+#define USB_DWC "DWC_otg: "
+
+/**
+ * Print a debug message when the Global debug level variable contains
+ * the bit defined in <code>lvl</code>.
+ *
+ * @param[in] lvl - Debug level, use one of the DBG_ constants above.
+ * @param[in] x - like printf
+ *
+ *    Example:<p>
+ * <code>
+ *      DWC_DEBUGPL( DBG_ANY, "%s(%p)\n", __func__, _reg_base_addr);
+ * </code>
+ * <br>
+ * results in:<br>
+ * <code>
+ * usb-DWC_otg: dwc_otg_cil_init(ca867000)
+ * </code>
+ */
+#ifdef DEBUG
+
+# define DWC_DEBUGPL(lvl, x...) do{ if ((lvl)&g_dbg_lvl)__DWC_DEBUG(USB_DWC x ); }while(0)
+# define DWC_DEBUGP(x...)	DWC_DEBUGPL(DBG_ANY, x )
+
+# define CHK_DEBUG_LEVEL(level) ((level) & g_dbg_lvl)
+
+#else
+
+# define DWC_DEBUGPL(lvl, x...) do{}while(0)
+# define DWC_DEBUGP(x...)
+
+# define CHK_DEBUG_LEVEL(level) (0)
+
+#endif /*DEBUG*/
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.c b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
new file mode 100644
index 0000000000000..e945900c503cb
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
@@ -0,0 +1,1767 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.c $
+ * $Revision: #92 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ * The dwc_otg_driver module provides the initialization and cleanup entry
+ * points for the DWC_otg driver. This module will be dynamically installed
+ * after Linux is booted using the insmod command. When the module is
+ * installed, the dwc_otg_driver_init function is called. When the module is
+ * removed (using rmmod), the dwc_otg_driver_cleanup function is called.
+ *
+ * This module also defines a data structure for the dwc_otg_driver, which is
+ * used in conjunction with the standard ARM lm_device structure. These
+ * structures allow the OTG driver to comply with the standard Linux driver
+ * model in which devices and drivers are registered with a bus driver. This
+ * has the benefit that Linux can expose attributes of the driver and device
+ * in its special sysfs file system. Users can then read or write files in
+ * this file system to perform diagnostics on the driver components or the
+ * device.
+ */
+
+#include "dwc_otg_os_dep.h"
+#include "dwc_os.h"
+#include "dwc_otg_dbg.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_attr.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_hcd_if.h"
+#include "dwc_otg_fiq_fsm.h"
+
+#define DWC_DRIVER_VERSION	"3.00a 10-AUG-2012"
+#define DWC_DRIVER_DESC		"HS OTG USB Controller driver"
+
+bool microframe_schedule=true;
+
+static const char dwc_driver_name[] = "dwc_otg";
+
+
+extern int pcd_init(
+#ifdef LM_INTERFACE
+			   struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			   struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+extern int hcd_init(
+#ifdef LM_INTERFACE
+			   struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			   struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+
+extern int pcd_remove(
+#ifdef LM_INTERFACE
+			     struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			     struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *_dev
+#endif
+    );
+
+extern void hcd_remove(
+#ifdef LM_INTERFACE
+			      struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			      struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *_dev
+#endif
+    );
+
+extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
+
+/*-------------------------------------------------------------------------*/
+/* Encapsulate the module parameter settings */
+
+struct dwc_otg_driver_module_params {
+	int32_t opt;
+	int32_t otg_cap;
+	int32_t dma_enable;
+	int32_t dma_desc_enable;
+	int32_t dma_burst_size;
+	int32_t speed;
+	int32_t host_support_fs_ls_low_power;
+	int32_t host_ls_low_power_phy_clk;
+	int32_t enable_dynamic_fifo;
+	int32_t data_fifo_size;
+	int32_t dev_rx_fifo_size;
+	int32_t dev_nperio_tx_fifo_size;
+	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
+	int32_t host_rx_fifo_size;
+	int32_t host_nperio_tx_fifo_size;
+	int32_t host_perio_tx_fifo_size;
+	int32_t max_transfer_size;
+	int32_t max_packet_count;
+	int32_t host_channels;
+	int32_t dev_endpoints;
+	int32_t phy_type;
+	int32_t phy_utmi_width;
+	int32_t phy_ulpi_ddr;
+	int32_t phy_ulpi_ext_vbus;
+	int32_t i2c_enable;
+	int32_t ulpi_fs_ls;
+	int32_t ts_dline;
+	int32_t en_multiple_tx_fifo;
+	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
+	uint32_t thr_ctl;
+	uint32_t tx_thr_length;
+	uint32_t rx_thr_length;
+	int32_t pti_enable;
+	int32_t mpi_enable;
+	int32_t lpm_enable;
+	int32_t ic_usb_cap;
+	int32_t ahb_thr_ratio;
+	int32_t power_down;
+	int32_t reload_ctl;
+	int32_t dev_out_nak;
+	int32_t cont_on_bna;
+	int32_t ahb_single;
+	int32_t otg_ver;
+	int32_t adp_enable;
+};
+
+static struct dwc_otg_driver_module_params dwc_otg_module_params = {
+	.opt = -1,
+	.otg_cap = -1,
+	.dma_enable = -1,
+	.dma_desc_enable = -1,
+	.dma_burst_size = -1,
+	.speed = -1,
+	.host_support_fs_ls_low_power = -1,
+	.host_ls_low_power_phy_clk = -1,
+	.enable_dynamic_fifo = -1,
+	.data_fifo_size = -1,
+	.dev_rx_fifo_size = -1,
+	.dev_nperio_tx_fifo_size = -1,
+	.dev_perio_tx_fifo_size = {
+				   /* dev_perio_tx_fifo_size_1 */
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1
+				   /* 15 */
+				   },
+	.host_rx_fifo_size = -1,
+	.host_nperio_tx_fifo_size = -1,
+	.host_perio_tx_fifo_size = -1,
+	.max_transfer_size = -1,
+	.max_packet_count = -1,
+	.host_channels = -1,
+	.dev_endpoints = -1,
+	.phy_type = -1,
+	.phy_utmi_width = -1,
+	.phy_ulpi_ddr = -1,
+	.phy_ulpi_ext_vbus = -1,
+	.i2c_enable = -1,
+	.ulpi_fs_ls = -1,
+	.ts_dline = -1,
+	.en_multiple_tx_fifo = -1,
+	.dev_tx_fifo_size = {
+			     /* dev_tx_fifo_size */
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1
+			     /* 15 */
+			     },
+	.thr_ctl = -1,
+	.tx_thr_length = -1,
+	.rx_thr_length = -1,
+	.pti_enable = -1,
+	.mpi_enable = -1,
+	.lpm_enable = 0,
+	.ic_usb_cap = -1,
+	.ahb_thr_ratio = -1,
+	.power_down = -1,
+	.reload_ctl = -1,
+	.dev_out_nak = -1,
+	.cont_on_bna = -1,
+	.ahb_single = -1,
+	.otg_ver = -1,
+	.adp_enable = -1,
+};
+
+//Global variable to switch the fiq fix on or off
+bool fiq_enable = 1;
+// Global variable to enable the split transaction fix
+bool fiq_fsm_enable = true;
+//Bulk split-transaction NAK holdoff in microframes
+uint16_t nak_holdoff = 8;
+
+//Force host mode during CIL re-init
+bool cil_force_host = true;
+
+unsigned short fiq_fsm_mask = 0x0F;
+
+unsigned short int_ep_interval_min = 0;
+/**
+ * This function shows the Driver Version.
+ */
+static ssize_t version_show(struct device_driver *dev, char *buf)
+{
+	return snprintf(buf, sizeof(DWC_DRIVER_VERSION) + 2, "%s\n",
+			DWC_DRIVER_VERSION);
+}
+
+static DRIVER_ATTR_RO(version);
+
+/**
+ * Global Debug Level Mask.
+ */
+uint32_t g_dbg_lvl = 0;		/* OFF */
+
+/**
+ * This function shows the driver Debug Level.
+ */
+static ssize_t debuglevel_show(struct device_driver *drv, char *buf)
+{
+	return sprintf(buf, "0x%0x\n", g_dbg_lvl);
+}
+
+/**
+ * This function stores the driver Debug Level.
+ */
+static ssize_t debuglevel_store(struct device_driver *drv, const char *buf,
+			       size_t count)
+{
+	g_dbg_lvl = simple_strtoul(buf, NULL, 16);
+	return count;
+}
+
+static DRIVER_ATTR_RW(debuglevel);
+
+/**
+ * This function is called during module intialization
+ * to pass module parameters to the DWC_OTG CORE.
+ */
+static int set_parameters(dwc_otg_core_if_t * core_if)
+{
+	int retval = 0;
+	int i;
+
+	if (dwc_otg_module_params.otg_cap != -1) {
+		retval +=
+		    dwc_otg_set_param_otg_cap(core_if,
+					      dwc_otg_module_params.otg_cap);
+	}
+	if (dwc_otg_module_params.dma_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_dma_enable(core_if,
+						 dwc_otg_module_params.
+						 dma_enable);
+	}
+	if (dwc_otg_module_params.dma_desc_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_dma_desc_enable(core_if,
+						      dwc_otg_module_params.
+						      dma_desc_enable);
+	}
+	if (dwc_otg_module_params.opt != -1) {
+		retval +=
+		    dwc_otg_set_param_opt(core_if, dwc_otg_module_params.opt);
+	}
+	if (dwc_otg_module_params.dma_burst_size != -1) {
+		retval +=
+		    dwc_otg_set_param_dma_burst_size(core_if,
+						     dwc_otg_module_params.
+						     dma_burst_size);
+	}
+	if (dwc_otg_module_params.host_support_fs_ls_low_power != -1) {
+		retval +=
+		    dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
+								   dwc_otg_module_params.
+								   host_support_fs_ls_low_power);
+	}
+	if (dwc_otg_module_params.enable_dynamic_fifo != -1) {
+		retval +=
+		    dwc_otg_set_param_enable_dynamic_fifo(core_if,
+							  dwc_otg_module_params.
+							  enable_dynamic_fifo);
+	}
+	if (dwc_otg_module_params.data_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_data_fifo_size(core_if,
+						     dwc_otg_module_params.
+						     data_fifo_size);
+	}
+	if (dwc_otg_module_params.dev_rx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_dev_rx_fifo_size(core_if,
+						       dwc_otg_module_params.
+						       dev_rx_fifo_size);
+	}
+	if (dwc_otg_module_params.dev_nperio_tx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
+							      dwc_otg_module_params.
+							      dev_nperio_tx_fifo_size);
+	}
+	if (dwc_otg_module_params.host_rx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_host_rx_fifo_size(core_if,
+							dwc_otg_module_params.host_rx_fifo_size);
+	}
+	if (dwc_otg_module_params.host_nperio_tx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
+							       dwc_otg_module_params.
+							       host_nperio_tx_fifo_size);
+	}
+	if (dwc_otg_module_params.host_perio_tx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
+							      dwc_otg_module_params.
+							      host_perio_tx_fifo_size);
+	}
+	if (dwc_otg_module_params.max_transfer_size != -1) {
+		retval +=
+		    dwc_otg_set_param_max_transfer_size(core_if,
+							dwc_otg_module_params.
+							max_transfer_size);
+	}
+	if (dwc_otg_module_params.max_packet_count != -1) {
+		retval +=
+		    dwc_otg_set_param_max_packet_count(core_if,
+						       dwc_otg_module_params.
+						       max_packet_count);
+	}
+	if (dwc_otg_module_params.host_channels != -1) {
+		retval +=
+		    dwc_otg_set_param_host_channels(core_if,
+						    dwc_otg_module_params.
+						    host_channels);
+	}
+	if (dwc_otg_module_params.dev_endpoints != -1) {
+		retval +=
+		    dwc_otg_set_param_dev_endpoints(core_if,
+						    dwc_otg_module_params.
+						    dev_endpoints);
+	}
+	if (dwc_otg_module_params.phy_type != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_type(core_if,
+					       dwc_otg_module_params.phy_type);
+	}
+	if (dwc_otg_module_params.speed != -1) {
+		retval +=
+		    dwc_otg_set_param_speed(core_if,
+					    dwc_otg_module_params.speed);
+	}
+	if (dwc_otg_module_params.host_ls_low_power_phy_clk != -1) {
+		retval +=
+		    dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
+								dwc_otg_module_params.
+								host_ls_low_power_phy_clk);
+	}
+	if (dwc_otg_module_params.phy_ulpi_ddr != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_ulpi_ddr(core_if,
+						   dwc_otg_module_params.
+						   phy_ulpi_ddr);
+	}
+	if (dwc_otg_module_params.phy_ulpi_ext_vbus != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
+							dwc_otg_module_params.
+							phy_ulpi_ext_vbus);
+	}
+	if (dwc_otg_module_params.phy_utmi_width != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_utmi_width(core_if,
+						     dwc_otg_module_params.
+						     phy_utmi_width);
+	}
+	if (dwc_otg_module_params.ulpi_fs_ls != -1) {
+		retval +=
+		    dwc_otg_set_param_ulpi_fs_ls(core_if,
+						 dwc_otg_module_params.ulpi_fs_ls);
+	}
+	if (dwc_otg_module_params.ts_dline != -1) {
+		retval +=
+		    dwc_otg_set_param_ts_dline(core_if,
+					       dwc_otg_module_params.ts_dline);
+	}
+	if (dwc_otg_module_params.i2c_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_i2c_enable(core_if,
+						 dwc_otg_module_params.
+						 i2c_enable);
+	}
+	if (dwc_otg_module_params.en_multiple_tx_fifo != -1) {
+		retval +=
+		    dwc_otg_set_param_en_multiple_tx_fifo(core_if,
+							  dwc_otg_module_params.
+							  en_multiple_tx_fifo);
+	}
+	for (i = 0; i < 15; i++) {
+		if (dwc_otg_module_params.dev_perio_tx_fifo_size[i] != -1) {
+			retval +=
+			    dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
+								     dwc_otg_module_params.
+								     dev_perio_tx_fifo_size
+								     [i], i);
+		}
+	}
+
+	for (i = 0; i < 15; i++) {
+		if (dwc_otg_module_params.dev_tx_fifo_size[i] != -1) {
+			retval += dwc_otg_set_param_dev_tx_fifo_size(core_if,
+								     dwc_otg_module_params.
+								     dev_tx_fifo_size
+								     [i], i);
+		}
+	}
+	if (dwc_otg_module_params.thr_ctl != -1) {
+		retval +=
+		    dwc_otg_set_param_thr_ctl(core_if,
+					      dwc_otg_module_params.thr_ctl);
+	}
+	if (dwc_otg_module_params.mpi_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_mpi_enable(core_if,
+						 dwc_otg_module_params.
+						 mpi_enable);
+	}
+	if (dwc_otg_module_params.pti_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_pti_enable(core_if,
+						 dwc_otg_module_params.
+						 pti_enable);
+	}
+	if (dwc_otg_module_params.lpm_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_lpm_enable(core_if,
+						 dwc_otg_module_params.
+						 lpm_enable);
+	}
+	if (dwc_otg_module_params.ic_usb_cap != -1) {
+		retval +=
+		    dwc_otg_set_param_ic_usb_cap(core_if,
+						 dwc_otg_module_params.
+						 ic_usb_cap);
+	}
+	if (dwc_otg_module_params.tx_thr_length != -1) {
+		retval +=
+		    dwc_otg_set_param_tx_thr_length(core_if,
+						    dwc_otg_module_params.tx_thr_length);
+	}
+	if (dwc_otg_module_params.rx_thr_length != -1) {
+		retval +=
+		    dwc_otg_set_param_rx_thr_length(core_if,
+						    dwc_otg_module_params.
+						    rx_thr_length);
+	}
+	if (dwc_otg_module_params.ahb_thr_ratio != -1) {
+		retval +=
+		    dwc_otg_set_param_ahb_thr_ratio(core_if,
+						    dwc_otg_module_params.ahb_thr_ratio);
+	}
+	if (dwc_otg_module_params.power_down != -1) {
+		retval +=
+		    dwc_otg_set_param_power_down(core_if,
+						 dwc_otg_module_params.power_down);
+	}
+	if (dwc_otg_module_params.reload_ctl != -1) {
+		retval +=
+		    dwc_otg_set_param_reload_ctl(core_if,
+						 dwc_otg_module_params.reload_ctl);
+	}
+
+	if (dwc_otg_module_params.dev_out_nak != -1) {
+		retval +=
+			dwc_otg_set_param_dev_out_nak(core_if,
+			dwc_otg_module_params.dev_out_nak);
+	}
+
+	if (dwc_otg_module_params.cont_on_bna != -1) {
+		retval +=
+			dwc_otg_set_param_cont_on_bna(core_if,
+			dwc_otg_module_params.cont_on_bna);
+	}
+
+	if (dwc_otg_module_params.ahb_single != -1) {
+		retval +=
+			dwc_otg_set_param_ahb_single(core_if,
+			dwc_otg_module_params.ahb_single);
+	}
+
+	if (dwc_otg_module_params.otg_ver != -1) {
+		retval +=
+		    dwc_otg_set_param_otg_ver(core_if,
+					      dwc_otg_module_params.otg_ver);
+	}
+	if (dwc_otg_module_params.adp_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_adp_enable(core_if,
+						 dwc_otg_module_params.
+						 adp_enable);
+	}
+	return retval;
+}
+
+/**
+ * This function is the top level interrupt handler for the Common
+ * (Device and host modes) interrupts.
+ */
+static irqreturn_t dwc_otg_common_irq(int irq, void *dev)
+{
+	int32_t retval = IRQ_NONE;
+
+	retval = dwc_otg_handle_common_intr(dev);
+	if (retval != 0) {
+		S3C2410X_CLEAR_EINTPEND();
+	}
+	return IRQ_RETVAL(retval);
+}
+
+/**
+ * This function is called when a lm_device is unregistered with the
+ * dwc_otg_driver. This happens, for example, when the rmmod command is
+ * executed. The device may or may not be electrically present. If it is
+ * present, the driver stops device processing. Any resources used on behalf
+ * of this device are freed.
+ *
+ * @param _dev
+ */
+#ifdef LM_INTERFACE
+#define REM_RETVAL(n)
+static void dwc_otg_driver_remove(	 struct lm_device *_dev )
+{       dwc_otg_device_t *otg_dev = lm_get_drvdata(_dev);
+#elif  defined(PCI_INTERFACE)
+#define REM_RETVAL(n)
+static void dwc_otg_driver_remove(	 struct pci_dev *_dev )
+{	dwc_otg_device_t *otg_dev = pci_get_drvdata(_dev);
+#elif  defined(PLATFORM_INTERFACE)
+#define REM_RETVAL(n) n
+static int dwc_otg_driver_remove(        struct platform_device *_dev )
+{       dwc_otg_device_t *otg_dev = platform_get_drvdata(_dev);
+#endif
+
+	DWC_DEBUGPL(DBG_ANY, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
+
+	if (!otg_dev) {
+		/* Memory allocation for the dwc_otg_device failed. */
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
+                return REM_RETVAL(-ENOMEM);
+	}
+#ifndef DWC_DEVICE_ONLY
+	if (otg_dev->hcd) {
+		hcd_remove(_dev);
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
+                return REM_RETVAL(-EINVAL);
+	}
+#endif
+
+#ifndef DWC_HOST_ONLY
+	if (otg_dev->pcd) {
+		pcd_remove(_dev);
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->pcd NULL!\n", __func__);
+                return REM_RETVAL(-EINVAL);
+	}
+#endif
+	/*
+	 * Free the IRQ
+	 */
+	if (otg_dev->common_irq_installed) {
+#ifdef PLATFORM_INTERFACE
+		free_irq(platform_get_irq(_dev, 0), otg_dev);
+#else
+		free_irq(_dev->irq, otg_dev);
+#endif
+        } else {
+		DWC_DEBUGPL(DBG_ANY, "%s: There is no installed irq!\n", __func__);
+		return REM_RETVAL(-ENXIO);
+	}
+
+	if (otg_dev->core_if) {
+		dwc_otg_cil_remove(otg_dev->core_if);
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->core_if NULL!\n", __func__);
+		return REM_RETVAL(-ENXIO);
+	}
+
+	/*
+	 * Remove the device attributes
+	 */
+	dwc_otg_attr_remove(_dev);
+
+	/*
+	 * Return the memory.
+	 */
+	if (otg_dev->os_dep.base) {
+		iounmap(otg_dev->os_dep.base);
+	}
+	DWC_FREE(otg_dev);
+
+	/*
+	 * Clear the drvdata pointer.
+	 */
+#ifdef LM_INTERFACE
+	lm_set_drvdata(_dev, 0);
+#elif defined(PCI_INTERFACE)
+        release_mem_region(otg_dev->os_dep.rsrc_start,
+                           otg_dev->os_dep.rsrc_len);
+	pci_set_drvdata(_dev, 0);
+#elif  defined(PLATFORM_INTERFACE)
+        platform_set_drvdata(_dev, 0);
+#endif
+        return REM_RETVAL(0);
+}
+
+/**
+ * This function is called when an lm_device is bound to a
+ * dwc_otg_driver. It creates the driver components required to
+ * control the device (CIL, HCD, and PCD) and it initializes the
+ * device. The driver components are stored in a dwc_otg_device
+ * structure. A reference to the dwc_otg_device is saved in the
+ * lm_device. This allows the driver to access the dwc_otg_device
+ * structure on subsequent calls to driver methods for this device.
+ *
+ * @param _dev Bus device
+ */
+static int dwc_otg_driver_probe(
+#ifdef LM_INTERFACE
+				       struct lm_device *_dev
+#elif defined(PCI_INTERFACE)
+				       struct pci_dev *_dev,
+				       const struct pci_device_id *id
+#elif  defined(PLATFORM_INTERFACE)
+                                       struct platform_device *_dev
+#endif
+    )
+{
+	int retval = 0;
+	dwc_otg_device_t *dwc_otg_device;
+        int devirq;
+
+	dev_dbg(&_dev->dev, "dwc_otg_driver_probe(%p)\n", _dev);
+#ifdef LM_INTERFACE
+	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)_dev->resource.start);
+#elif defined(PCI_INTERFACE)
+	if (!id) {
+		DWC_ERROR("Invalid pci_device_id %p", id);
+		return -EINVAL;
+	}
+
+	if (!_dev || (pci_enable_device(_dev) < 0)) {
+		DWC_ERROR("Invalid pci_device %p", _dev);
+		return -ENODEV;
+	}
+	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)pci_resource_start(_dev,0));
+	/* other stuff needed as well? */
+
+#elif  defined(PLATFORM_INTERFACE)
+	dev_dbg(&_dev->dev, "start=0x%08x (len 0x%x)\n",
+                (unsigned)_dev->resource->start,
+                (unsigned)(_dev->resource->end - _dev->resource->start));
+#endif
+
+	dwc_otg_device = DWC_ALLOC(sizeof(dwc_otg_device_t));
+
+	if (!dwc_otg_device) {
+		dev_err(&_dev->dev, "kmalloc of dwc_otg_device failed\n");
+		return -ENOMEM;
+	}
+
+	memset(dwc_otg_device, 0, sizeof(*dwc_otg_device));
+	dwc_otg_device->os_dep.reg_offset = 0xFFFFFFFF;
+	dwc_otg_device->os_dep.platformdev = _dev;
+
+	/*
+	 * Map the DWC_otg Core memory into virtual address space.
+	 */
+#ifdef LM_INTERFACE
+	dwc_otg_device->os_dep.base = ioremap(_dev->resource.start, SZ_256K);
+
+	if (!dwc_otg_device->os_dep.base) {
+		dev_err(&_dev->dev, "ioremap() failed\n");
+		DWC_FREE(dwc_otg_device);
+		return -ENOMEM;
+	}
+	dev_dbg(&_dev->dev, "base=0x%08x\n",
+		(unsigned)dwc_otg_device->os_dep.base);
+#elif defined(PCI_INTERFACE)
+	_dev->current_state = PCI_D0;
+	_dev->dev.power.power_state = PMSG_ON;
+
+	if (!_dev->irq) {
+		DWC_ERROR("Found HC with no IRQ. Check BIOS/PCI %s setup!",
+			  pci_name(_dev));
+		iounmap(dwc_otg_device->os_dep.base);
+		DWC_FREE(dwc_otg_device);
+		return -ENODEV;
+	}
+
+	dwc_otg_device->os_dep.rsrc_start = pci_resource_start(_dev, 0);
+	dwc_otg_device->os_dep.rsrc_len = pci_resource_len(_dev, 0);
+	DWC_DEBUGPL(DBG_ANY, "PCI resource: start=%08x, len=%08x\n",
+		    (unsigned)dwc_otg_device->os_dep.rsrc_start,
+		    (unsigned)dwc_otg_device->os_dep.rsrc_len);
+	if (!request_mem_region
+	    (dwc_otg_device->os_dep.rsrc_start, dwc_otg_device->os_dep.rsrc_len,
+	     "dwc_otg")) {
+		dev_dbg(&_dev->dev, "error requesting memory\n");
+		iounmap(dwc_otg_device->os_dep.base);
+		DWC_FREE(dwc_otg_device);
+		return -EFAULT;
+	}
+
+	dwc_otg_device->os_dep.base =
+	    ioremap_nocache(dwc_otg_device->os_dep.rsrc_start,
+			    dwc_otg_device->os_dep.rsrc_len);
+	if (dwc_otg_device->os_dep.base == NULL) {
+		dev_dbg(&_dev->dev, "error mapping memory\n");
+		release_mem_region(dwc_otg_device->os_dep.rsrc_start,
+				   dwc_otg_device->os_dep.rsrc_len);
+		iounmap(dwc_otg_device->os_dep.base);
+		DWC_FREE(dwc_otg_device);
+		return -EFAULT;
+	}
+	dev_dbg(&_dev->dev, "base=0x%p (before adjust) \n",
+		dwc_otg_device->os_dep.base);
+	dwc_otg_device->os_dep.base = (char *)dwc_otg_device->os_dep.base;
+	dev_dbg(&_dev->dev, "base=0x%p (after adjust) \n",
+		dwc_otg_device->os_dep.base);
+	dev_dbg(&_dev->dev, "%s: mapped PA 0x%x to VA 0x%p\n", __func__,
+		(unsigned)dwc_otg_device->os_dep.rsrc_start,
+		dwc_otg_device->os_dep.base);
+
+	pci_set_master(_dev);
+	pci_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PLATFORM_INTERFACE)
+        DWC_DEBUGPL(DBG_ANY,"Platform resource: start=%08x, len=%08x\n",
+                    _dev->resource->start,
+                    _dev->resource->end - _dev->resource->start + 1);
+#if 1
+        if (!request_mem_region(_dev->resource[0].start,
+                                _dev->resource[0].end - _dev->resource[0].start + 1,
+                                "dwc_otg")) {
+          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
+          retval = -EFAULT;
+          goto fail;
+        }
+
+	dwc_otg_device->os_dep.base = ioremap_nocache(_dev->resource[0].start,
+                                                      _dev->resource[0].end -
+                                                      _dev->resource[0].start+1);
+	if (fiq_enable)
+	{
+		if (!request_mem_region(_dev->resource[1].start,
+	                                _dev->resource[1].end - _dev->resource[1].start + 1,
+	                                "dwc_otg")) {
+	          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
+	          retval = -EFAULT;
+	          goto fail;
+	}
+
+		dwc_otg_device->os_dep.mphi_base = ioremap_nocache(_dev->resource[1].start,
+							    _dev->resource[1].end -
+							    _dev->resource[1].start + 1);
+	}
+
+#else
+        {
+                struct map_desc desc = {
+                    .virtual = IO_ADDRESS((unsigned)_dev->resource->start),
+                    .pfn     = __phys_to_pfn((unsigned)_dev->resource->start),
+                    .length  = SZ_128K,
+                    .type    = MT_DEVICE
+                };
+                iotable_init(&desc, 1);
+                dwc_otg_device->os_dep.base = (void *)desc.virtual;
+        }
+#endif
+	if (!dwc_otg_device->os_dep.base) {
+		dev_err(&_dev->dev, "ioremap() failed\n");
+		retval = -ENOMEM;
+		goto fail;
+	}
+	dev_dbg(&_dev->dev, "base=0x%08x\n",
+                (unsigned)dwc_otg_device->os_dep.base);
+#endif
+
+	/*
+	 * Initialize driver data to point to the global DWC_otg
+	 * Device structure.
+	 */
+#ifdef LM_INTERFACE
+	lm_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PLATFORM_INTERFACE)
+	platform_set_drvdata(_dev, dwc_otg_device);
+#endif
+	dev_dbg(&_dev->dev, "dwc_otg_device=0x%p\n", dwc_otg_device);
+
+	dwc_otg_device->core_if = dwc_otg_cil_init(dwc_otg_device->os_dep.base);
+        DWC_DEBUGPL(DBG_HCDV, "probe of device %p given core_if %p\n",
+                    dwc_otg_device, dwc_otg_device->core_if);//GRAYG
+
+	if (!dwc_otg_device->core_if) {
+		dev_err(&_dev->dev, "CIL initialization failed!\n");
+		retval = -ENOMEM;
+		goto fail;
+	}
+
+	dev_dbg(&_dev->dev, "Calling get_gsnpsid\n");
+	/*
+	 * Attempt to ensure this device is really a DWC_otg Controller.
+	 * Read and verify the SNPSID register contents. The value should be
+	 * 0x45F42XXX or 0x45F42XXX, which corresponds to either "OT2" or "OTG3",
+	 * as in "OTG version 2.XX" or "OTG version 3.XX".
+	 */
+
+	if (((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) !=	0x4F542000) &&
+		((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) != 0x4F543000)) {
+		dev_err(&_dev->dev, "Bad value for SNPSID: 0x%08x\n",
+			dwc_otg_get_gsnpsid(dwc_otg_device->core_if));
+		retval = -EINVAL;
+		goto fail;
+	}
+
+	/*
+	 * Validate parameter values.
+	 */
+	dev_dbg(&_dev->dev, "Calling set_parameters\n");
+	if (set_parameters(dwc_otg_device->core_if)) {
+		retval = -EINVAL;
+		goto fail;
+	}
+
+	/*
+	 * Create Device Attributes in sysfs
+	 */
+	dev_dbg(&_dev->dev, "Calling attr_create\n");
+	dwc_otg_attr_create(_dev);
+
+	/*
+	 * Disable the global interrupt until all the interrupt
+	 * handlers are installed.
+	 */
+	dev_dbg(&_dev->dev, "Calling disable_global_interrupts\n");
+	dwc_otg_disable_global_interrupts(dwc_otg_device->core_if);
+
+	/*
+	 * Install the interrupt handler for the common interrupts before
+	 * enabling common interrupts in core_init below.
+	 */
+
+#if defined(PLATFORM_INTERFACE)
+	devirq = platform_get_irq(_dev, fiq_enable ? 0 : 1);
+#else
+	devirq = _dev->irq;
+#endif
+	DWC_DEBUGPL(DBG_CIL, "registering (common) handler for irq%d\n",
+		    devirq);
+	dev_dbg(&_dev->dev, "Calling request_irq(%d)\n", devirq);
+	retval = request_irq(devirq, dwc_otg_common_irq,
+                             IRQF_SHARED,
+                             "dwc_otg", dwc_otg_device);
+	if (retval) {
+		DWC_ERROR("request of irq%d failed\n", devirq);
+		retval = -EBUSY;
+		goto fail;
+	} else {
+		dwc_otg_device->common_irq_installed = 1;
+	}
+
+#ifndef IRQF_TRIGGER_LOW
+#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
+	dev_dbg(&_dev->dev, "Calling set_irq_type\n");
+	set_irq_type(devirq,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
+                     IRQT_LOW
+#else
+                     IRQ_TYPE_LEVEL_LOW
+#endif
+                    );
+#endif
+#endif /*IRQF_TRIGGER_LOW*/
+
+	/*
+	 * Initialize the DWC_otg core.
+	 */
+	dev_dbg(&_dev->dev, "Calling dwc_otg_core_init\n");
+	dwc_otg_core_init(dwc_otg_device->core_if);
+
+#ifndef DWC_HOST_ONLY
+	/*
+	 * Initialize the PCD
+	 */
+	dev_dbg(&_dev->dev, "Calling pcd_init\n");
+	retval = pcd_init(_dev);
+	if (retval != 0) {
+		DWC_ERROR("pcd_init failed\n");
+		dwc_otg_device->pcd = NULL;
+		goto fail;
+	}
+#endif
+#ifndef DWC_DEVICE_ONLY
+	/*
+	 * Initialize the HCD
+	 */
+	dev_dbg(&_dev->dev, "Calling hcd_init\n");
+	retval = hcd_init(_dev);
+	if (retval != 0) {
+		DWC_ERROR("hcd_init failed\n");
+		dwc_otg_device->hcd = NULL;
+		goto fail;
+	}
+#endif
+        /* Recover from drvdata having been overwritten by hcd_init() */
+#ifdef LM_INTERFACE
+	lm_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PLATFORM_INTERFACE)
+	platform_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PCI_INTERFACE)
+	pci_set_drvdata(_dev, dwc_otg_device);
+	dwc_otg_device->os_dep.pcidev = _dev;
+#endif
+
+	/*
+	 * Enable the global interrupt after all the interrupt
+	 * handlers are installed if there is no ADP support else
+	 * perform initial actions required for Internal ADP logic.
+	 */
+	if (!dwc_otg_get_param_adp_enable(dwc_otg_device->core_if)) {
+	        dev_dbg(&_dev->dev, "Calling enable_global_interrupts\n");
+		dwc_otg_enable_global_interrupts(dwc_otg_device->core_if);
+	        dev_dbg(&_dev->dev, "Done\n");
+	} else
+		dwc_otg_adp_start(dwc_otg_device->core_if,
+							dwc_otg_is_host_mode(dwc_otg_device->core_if));
+
+	return 0;
+
+fail:
+	dwc_otg_driver_remove(_dev);
+	return retval;
+}
+
+/**
+ * This structure defines the methods to be called by a bus driver
+ * during the lifecycle of a device on that bus. Both drivers and
+ * devices are registered with a bus driver. The bus driver matches
+ * devices to drivers based on information in the device and driver
+ * structures.
+ *
+ * The probe function is called when the bus driver matches a device
+ * to this driver. The remove function is called when a device is
+ * unregistered with the bus driver.
+ */
+#ifdef LM_INTERFACE
+static struct lm_driver dwc_otg_driver = {
+	.drv = {.name = (char *)dwc_driver_name,},
+	.probe = dwc_otg_driver_probe,
+	.remove = dwc_otg_driver_remove,
+        // 'suspend' and 'resume' absent
+};
+#elif defined(PCI_INTERFACE)
+static const struct pci_device_id pci_ids[] = { {
+						 PCI_DEVICE(0x16c3, 0xabcd),
+						 .driver_data =
+						 (unsigned long)0xdeadbeef,
+						 }, { /* end: all zeroes */ }
+};
+
+MODULE_DEVICE_TABLE(pci, pci_ids);
+
+/* pci driver glue; this is a "new style" PCI driver module */
+static struct pci_driver dwc_otg_driver = {
+	.name = "dwc_otg",
+	.id_table = pci_ids,
+
+	.probe = dwc_otg_driver_probe,
+	.remove = dwc_otg_driver_remove,
+
+	.driver = {
+		   .name = (char *)dwc_driver_name,
+		   },
+};
+#elif defined(PLATFORM_INTERFACE)
+static struct platform_device_id platform_ids[] = {
+        {
+              .name = "bcm2708_usb",
+              .driver_data = (kernel_ulong_t) 0xdeadbeef,
+        },
+        { /* end: all zeroes */ }
+};
+MODULE_DEVICE_TABLE(platform, platform_ids);
+
+static const struct of_device_id dwc_otg_of_match_table[] = {
+	{ .compatible = "brcm,bcm2708-usb", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, dwc_otg_of_match_table);
+
+static struct platform_driver dwc_otg_driver = {
+	.driver = {
+		.name = (char *)dwc_driver_name,
+		.of_match_table = dwc_otg_of_match_table,
+		},
+        .id_table = platform_ids,
+
+	.probe = dwc_otg_driver_probe,
+	.remove = dwc_otg_driver_remove,
+        // no 'shutdown', 'suspend', 'resume', 'suspend_late' or 'resume_early'
+};
+#endif
+
+/**
+ * This function is called when the dwc_otg_driver is installed with the
+ * insmod command. It registers the dwc_otg_driver structure with the
+ * appropriate bus driver. This will cause the dwc_otg_driver_probe function
+ * to be called. In addition, the bus driver will automatically expose
+ * attributes defined for the device and driver in the special sysfs file
+ * system.
+ *
+ * @return
+ */
+static int __init dwc_otg_driver_init(void)
+{
+	int retval = 0;
+	int error;
+        struct device_driver *drv;
+
+	if(fiq_fsm_enable && !fiq_enable) {
+		printk(KERN_WARNING "dwc_otg: fiq_fsm_enable was set without fiq_enable! Correcting.\n");
+		fiq_enable = 1;
+	}
+
+	printk(KERN_INFO "%s: version %s (%s bus)\n", dwc_driver_name,
+	       DWC_DRIVER_VERSION,
+#ifdef LM_INTERFACE
+               "logicmodule");
+	retval = lm_driver_register(&dwc_otg_driver);
+        drv = &dwc_otg_driver.drv;
+#elif defined(PCI_INTERFACE)
+               "pci");
+	retval = pci_register_driver(&dwc_otg_driver);
+        drv = &dwc_otg_driver.driver;
+#elif defined(PLATFORM_INTERFACE)
+               "platform");
+	retval = platform_driver_register(&dwc_otg_driver);
+        drv = &dwc_otg_driver.driver;
+#endif
+	if (retval < 0) {
+		printk(KERN_ERR "%s retval=%d\n", __func__, retval);
+		return retval;
+	}
+	printk(KERN_DEBUG "dwc_otg: FIQ %s\n", fiq_enable ? "enabled":"disabled");
+	printk(KERN_DEBUG "dwc_otg: NAK holdoff %s\n", nak_holdoff ? "enabled":"disabled");
+	printk(KERN_DEBUG "dwc_otg: FIQ split-transaction FSM %s\n", fiq_fsm_enable ? "enabled":"disabled");
+
+	error = driver_create_file(drv, &driver_attr_version);
+#ifdef DEBUG
+	error = driver_create_file(drv, &driver_attr_debuglevel);
+#endif
+	return retval;
+}
+
+module_init(dwc_otg_driver_init);
+
+/**
+ * This function is called when the driver is removed from the kernel
+ * with the rmmod command. The driver unregisters itself with its bus
+ * driver.
+ *
+ */
+static void __exit dwc_otg_driver_cleanup(void)
+{
+	printk(KERN_DEBUG "dwc_otg_driver_cleanup()\n");
+
+#ifdef LM_INTERFACE
+	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_debuglevel);
+	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_version);
+	lm_driver_unregister(&dwc_otg_driver);
+#elif defined(PCI_INTERFACE)
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
+	pci_unregister_driver(&dwc_otg_driver);
+#elif defined(PLATFORM_INTERFACE)
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
+	platform_driver_unregister(&dwc_otg_driver);
+#endif
+
+	printk(KERN_INFO "%s module removed\n", dwc_driver_name);
+}
+
+module_exit(dwc_otg_driver_cleanup);
+
+MODULE_DESCRIPTION(DWC_DRIVER_DESC);
+MODULE_AUTHOR("Synopsys Inc.");
+MODULE_LICENSE("GPL");
+
+module_param_named(otg_cap, dwc_otg_module_params.otg_cap, int, 0444);
+MODULE_PARM_DESC(otg_cap, "OTG Capabilities 0=HNP&SRP 1=SRP Only 2=None");
+module_param_named(opt, dwc_otg_module_params.opt, int, 0444);
+MODULE_PARM_DESC(opt, "OPT Mode");
+module_param_named(dma_enable, dwc_otg_module_params.dma_enable, int, 0444);
+MODULE_PARM_DESC(dma_enable, "DMA Mode 0=Slave 1=DMA enabled");
+
+module_param_named(dma_desc_enable, dwc_otg_module_params.dma_desc_enable, int,
+		   0444);
+MODULE_PARM_DESC(dma_desc_enable,
+		 "DMA Desc Mode 0=Address DMA 1=DMA Descriptor enabled");
+
+module_param_named(dma_burst_size, dwc_otg_module_params.dma_burst_size, int,
+		   0444);
+MODULE_PARM_DESC(dma_burst_size,
+		 "DMA Burst Size 1, 4, 8, 16, 32, 64, 128, 256");
+module_param_named(speed, dwc_otg_module_params.speed, int, 0444);
+MODULE_PARM_DESC(speed, "Speed 0=High Speed 1=Full Speed");
+module_param_named(host_support_fs_ls_low_power,
+		   dwc_otg_module_params.host_support_fs_ls_low_power, int,
+		   0444);
+MODULE_PARM_DESC(host_support_fs_ls_low_power,
+		 "Support Low Power w/FS or LS 0=Support 1=Don't Support");
+module_param_named(host_ls_low_power_phy_clk,
+		   dwc_otg_module_params.host_ls_low_power_phy_clk, int, 0444);
+MODULE_PARM_DESC(host_ls_low_power_phy_clk,
+		 "Low Speed Low Power Clock 0=48Mhz 1=6Mhz");
+module_param_named(enable_dynamic_fifo,
+		   dwc_otg_module_params.enable_dynamic_fifo, int, 0444);
+MODULE_PARM_DESC(enable_dynamic_fifo, "0=cC Setting 1=Allow Dynamic Sizing");
+module_param_named(data_fifo_size, dwc_otg_module_params.data_fifo_size, int,
+		   0444);
+MODULE_PARM_DESC(data_fifo_size,
+		 "Total number of words in the data FIFO memory 32-32768");
+module_param_named(dev_rx_fifo_size, dwc_otg_module_params.dev_rx_fifo_size,
+		   int, 0444);
+MODULE_PARM_DESC(dev_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
+module_param_named(dev_nperio_tx_fifo_size,
+		   dwc_otg_module_params.dev_nperio_tx_fifo_size, int, 0444);
+MODULE_PARM_DESC(dev_nperio_tx_fifo_size,
+		 "Number of words in the non-periodic Tx FIFO 16-32768");
+module_param_named(dev_perio_tx_fifo_size_1,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[0], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_1,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_2,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[1], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_2,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_3,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[2], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_3,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_4,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[3], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_4,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_5,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[4], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_5,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_6,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[5], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_6,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_7,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[6], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_7,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_8,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[7], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_8,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_9,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[8], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_9,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_10,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[9], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_10,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_11,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[10], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_11,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_12,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[11], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_12,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_13,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[12], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_13,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_14,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[13], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_14,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_15,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[14], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_15,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(host_rx_fifo_size, dwc_otg_module_params.host_rx_fifo_size,
+		   int, 0444);
+MODULE_PARM_DESC(host_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
+module_param_named(host_nperio_tx_fifo_size,
+		   dwc_otg_module_params.host_nperio_tx_fifo_size, int, 0444);
+MODULE_PARM_DESC(host_nperio_tx_fifo_size,
+		 "Number of words in the non-periodic Tx FIFO 16-32768");
+module_param_named(host_perio_tx_fifo_size,
+		   dwc_otg_module_params.host_perio_tx_fifo_size, int, 0444);
+MODULE_PARM_DESC(host_perio_tx_fifo_size,
+		 "Number of words in the host periodic Tx FIFO 16-32768");
+module_param_named(max_transfer_size, dwc_otg_module_params.max_transfer_size,
+		   int, 0444);
+/** @todo Set the max to 512K, modify checks */
+MODULE_PARM_DESC(max_transfer_size,
+		 "The maximum transfer size supported in bytes 2047-65535");
+module_param_named(max_packet_count, dwc_otg_module_params.max_packet_count,
+		   int, 0444);
+MODULE_PARM_DESC(max_packet_count,
+		 "The maximum number of packets in a transfer 15-511");
+module_param_named(host_channels, dwc_otg_module_params.host_channels, int,
+		   0444);
+MODULE_PARM_DESC(host_channels,
+		 "The number of host channel registers to use 1-16");
+module_param_named(dev_endpoints, dwc_otg_module_params.dev_endpoints, int,
+		   0444);
+MODULE_PARM_DESC(dev_endpoints,
+		 "The number of endpoints in addition to EP0 available for device mode 1-15");
+module_param_named(phy_type, dwc_otg_module_params.phy_type, int, 0444);
+MODULE_PARM_DESC(phy_type, "0=Reserved 1=UTMI+ 2=ULPI");
+module_param_named(phy_utmi_width, dwc_otg_module_params.phy_utmi_width, int,
+		   0444);
+MODULE_PARM_DESC(phy_utmi_width, "Specifies the UTMI+ Data Width 8 or 16 bits");
+module_param_named(phy_ulpi_ddr, dwc_otg_module_params.phy_ulpi_ddr, int, 0444);
+MODULE_PARM_DESC(phy_ulpi_ddr,
+		 "ULPI at double or single data rate 0=Single 1=Double");
+module_param_named(phy_ulpi_ext_vbus, dwc_otg_module_params.phy_ulpi_ext_vbus,
+		   int, 0444);
+MODULE_PARM_DESC(phy_ulpi_ext_vbus,
+		 "ULPI PHY using internal or external vbus 0=Internal");
+module_param_named(i2c_enable, dwc_otg_module_params.i2c_enable, int, 0444);
+MODULE_PARM_DESC(i2c_enable, "FS PHY Interface");
+module_param_named(ulpi_fs_ls, dwc_otg_module_params.ulpi_fs_ls, int, 0444);
+MODULE_PARM_DESC(ulpi_fs_ls, "ULPI PHY FS/LS mode only");
+module_param_named(ts_dline, dwc_otg_module_params.ts_dline, int, 0444);
+MODULE_PARM_DESC(ts_dline, "Term select Dline pulsing for all PHYs");
+module_param_named(debug, g_dbg_lvl, int, 0444);
+MODULE_PARM_DESC(debug, "");
+
+module_param_named(en_multiple_tx_fifo,
+		   dwc_otg_module_params.en_multiple_tx_fifo, int, 0444);
+MODULE_PARM_DESC(en_multiple_tx_fifo,
+		 "Dedicated Non Periodic Tx FIFOs 0=disabled 1=enabled");
+module_param_named(dev_tx_fifo_size_1,
+		   dwc_otg_module_params.dev_tx_fifo_size[0], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_1, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_2,
+		   dwc_otg_module_params.dev_tx_fifo_size[1], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_2, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_3,
+		   dwc_otg_module_params.dev_tx_fifo_size[2], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_3, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_4,
+		   dwc_otg_module_params.dev_tx_fifo_size[3], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_4, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_5,
+		   dwc_otg_module_params.dev_tx_fifo_size[4], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_5, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_6,
+		   dwc_otg_module_params.dev_tx_fifo_size[5], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_6, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_7,
+		   dwc_otg_module_params.dev_tx_fifo_size[6], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_7, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_8,
+		   dwc_otg_module_params.dev_tx_fifo_size[7], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_8, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_9,
+		   dwc_otg_module_params.dev_tx_fifo_size[8], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_9, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_10,
+		   dwc_otg_module_params.dev_tx_fifo_size[9], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_10, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_11,
+		   dwc_otg_module_params.dev_tx_fifo_size[10], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_11, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_12,
+		   dwc_otg_module_params.dev_tx_fifo_size[11], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_12, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_13,
+		   dwc_otg_module_params.dev_tx_fifo_size[12], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_13, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_14,
+		   dwc_otg_module_params.dev_tx_fifo_size[13], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_14, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_15,
+		   dwc_otg_module_params.dev_tx_fifo_size[14], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_15, "Number of words in the Tx FIFO 4-768");
+
+module_param_named(thr_ctl, dwc_otg_module_params.thr_ctl, int, 0444);
+MODULE_PARM_DESC(thr_ctl,
+		 "Thresholding enable flag bit 0 - non ISO Tx thr., 1 - ISO Tx thr., 2 - Rx thr.- bit 0=disabled 1=enabled");
+module_param_named(tx_thr_length, dwc_otg_module_params.tx_thr_length, int,
+		   0444);
+MODULE_PARM_DESC(tx_thr_length, "Tx Threshold length in 32 bit DWORDs");
+module_param_named(rx_thr_length, dwc_otg_module_params.rx_thr_length, int,
+		   0444);
+MODULE_PARM_DESC(rx_thr_length, "Rx Threshold length in 32 bit DWORDs");
+
+module_param_named(pti_enable, dwc_otg_module_params.pti_enable, int, 0444);
+module_param_named(mpi_enable, dwc_otg_module_params.mpi_enable, int, 0444);
+module_param_named(lpm_enable, dwc_otg_module_params.lpm_enable, int, 0444);
+MODULE_PARM_DESC(lpm_enable, "LPM Enable 0=LPM Disabled 1=LPM Enabled");
+module_param_named(ic_usb_cap, dwc_otg_module_params.ic_usb_cap, int, 0444);
+MODULE_PARM_DESC(ic_usb_cap,
+		 "IC_USB Capability 0=IC_USB Disabled 1=IC_USB Enabled");
+module_param_named(ahb_thr_ratio, dwc_otg_module_params.ahb_thr_ratio, int,
+		   0444);
+MODULE_PARM_DESC(ahb_thr_ratio, "AHB Threshold Ratio");
+module_param_named(power_down, dwc_otg_module_params.power_down, int, 0444);
+MODULE_PARM_DESC(power_down, "Power Down Mode");
+module_param_named(reload_ctl, dwc_otg_module_params.reload_ctl, int, 0444);
+MODULE_PARM_DESC(reload_ctl, "HFIR Reload Control");
+module_param_named(dev_out_nak, dwc_otg_module_params.dev_out_nak, int, 0444);
+MODULE_PARM_DESC(dev_out_nak, "Enable Device OUT NAK");
+module_param_named(cont_on_bna, dwc_otg_module_params.cont_on_bna, int, 0444);
+MODULE_PARM_DESC(cont_on_bna, "Enable Enable Continue on BNA");
+module_param_named(ahb_single, dwc_otg_module_params.ahb_single, int, 0444);
+MODULE_PARM_DESC(ahb_single, "Enable AHB Single Support");
+module_param_named(adp_enable, dwc_otg_module_params.adp_enable, int, 0444);
+MODULE_PARM_DESC(adp_enable, "ADP Enable 0=ADP Disabled 1=ADP Enabled");
+module_param_named(otg_ver, dwc_otg_module_params.otg_ver, int, 0444);
+MODULE_PARM_DESC(otg_ver, "OTG revision supported 0=OTG 1.3 1=OTG 2.0");
+module_param(microframe_schedule, bool, 0444);
+MODULE_PARM_DESC(microframe_schedule, "Enable the microframe scheduler");
+
+module_param(fiq_enable, bool, 0444);
+MODULE_PARM_DESC(fiq_enable, "Enable the FIQ");
+module_param(nak_holdoff, ushort, 0644);
+MODULE_PARM_DESC(nak_holdoff, "Throttle duration for bulk split-transaction endpoints on a NAK. Default 8");
+module_param(fiq_fsm_enable, bool, 0444);
+MODULE_PARM_DESC(fiq_fsm_enable, "Enable the FIQ to perform split transactions as defined by fiq_fsm_mask");
+module_param(fiq_fsm_mask, ushort, 0444);
+MODULE_PARM_DESC(fiq_fsm_mask, "Bitmask of transactions to perform in the FIQ.\n"
+					"Bit 0 : Non-periodic split transactions\n"
+					"Bit 1 : Periodic split transactions\n"
+					"Bit 2 : High-speed multi-transfer isochronous\n"
+					"All other bits should be set 0.");
+module_param(int_ep_interval_min, ushort, 0644);
+MODULE_PARM_DESC(int_ep_interval_min, "Clamp high-speed Interrupt endpoints to a minimum polling interval.\n"
+					"0..1 = Use endpoint default\n"
+					"2..n = Minimum interval n microframes. Use powers of 2.\n");
+
+module_param(cil_force_host, bool, 0644);
+MODULE_PARM_DESC(cil_force_host, "On a connector-ID status change, "
+					"force Host Mode regardless of OTG state.");
+
+/** @page "Module Parameters"
+ *
+ * The following parameters may be specified when starting the module.
+ * These parameters define how the DWC_otg controller should be
+ * configured. Parameter values are passed to the CIL initialization
+ * function dwc_otg_cil_init
+ *
+ * Example: <code>modprobe dwc_otg speed=1 otg_cap=1</code>
+ *
+
+ <table>
+ <tr><td>Parameter Name</td><td>Meaning</td></tr>
+
+ <tr>
+ <td>otg_cap</td>
+ <td>Specifies the OTG capabilities. The driver will automatically detect the
+ value for this parameter if none is specified.
+ - 0: HNP and SRP capable (default, if available)
+ - 1: SRP Only capable
+ - 2: No HNP/SRP capable
+ </td></tr>
+
+ <tr>
+ <td>dma_enable</td>
+ <td>Specifies whether to use slave or DMA mode for accessing the data FIFOs.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Slave
+ - 1: DMA (default, if available)
+ </td></tr>
+
+ <tr>
+ <td>dma_burst_size</td>
+ <td>The DMA Burst size (applicable only for External DMA Mode).
+ - Values: 1, 4, 8 16, 32, 64, 128, 256 (default 32)
+ </td></tr>
+
+ <tr>
+ <td>speed</td>
+ <td>Specifies the maximum speed of operation in host and device mode. The
+ actual speed depends on the speed of the attached device and the value of
+ phy_type.
+ - 0: High Speed (default)
+ - 1: Full Speed
+ </td></tr>
+
+ <tr>
+ <td>host_support_fs_ls_low_power</td>
+ <td>Specifies whether low power mode is supported when attached to a Full
+ Speed or Low Speed device in host mode.
+ - 0: Don't support low power mode (default)
+ - 1: Support low power mode
+ </td></tr>
+
+ <tr>
+ <td>host_ls_low_power_phy_clk</td>
+ <td>Specifies the PHY clock rate in low power mode when connected to a Low
+ Speed device in host mode. This parameter is applicable only if
+ HOST_SUPPORT_FS_LS_LOW_POWER is enabled.
+ - 0: 48 MHz (default)
+ - 1: 6 MHz
+ </td></tr>
+
+ <tr>
+ <td>enable_dynamic_fifo</td>
+ <td> Specifies whether FIFOs may be resized by the driver software.
+ - 0: Use cC FIFO size parameters
+ - 1: Allow dynamic FIFO sizing (default)
+ </td></tr>
+
+ <tr>
+ <td>data_fifo_size</td>
+ <td>Total number of 4-byte words in the data FIFO memory. This memory
+ includes the Rx FIFO, non-periodic Tx FIFO, and periodic Tx FIFOs.
+ - Values: 32 to 32768 (default 8192)
+
+ Note: The total FIFO memory depth in the FPGA configuration is 8192.
+ </td></tr>
+
+ <tr>
+ <td>dev_rx_fifo_size</td>
+ <td>Number of 4-byte words in the Rx FIFO in device mode when dynamic
+ FIFO sizing is enabled.
+ - Values: 16 to 32768 (default 1064)
+ </td></tr>
+
+ <tr>
+ <td>dev_nperio_tx_fifo_size</td>
+ <td>Number of 4-byte words in the non-periodic Tx FIFO in device mode when
+ dynamic FIFO sizing is enabled.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>dev_perio_tx_fifo_size_n (n = 1 to 15)</td>
+ <td>Number of 4-byte words in each of the periodic Tx FIFOs in device mode
+ when dynamic FIFO sizing is enabled.
+ - Values: 4 to 768 (default 256)
+ </td></tr>
+
+ <tr>
+ <td>host_rx_fifo_size</td>
+ <td>Number of 4-byte words in the Rx FIFO in host mode when dynamic FIFO
+ sizing is enabled.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>host_nperio_tx_fifo_size</td>
+ <td>Number of 4-byte words in the non-periodic Tx FIFO in host mode when
+ dynamic FIFO sizing is enabled in the core.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>host_perio_tx_fifo_size</td>
+ <td>Number of 4-byte words in the host periodic Tx FIFO when dynamic FIFO
+ sizing is enabled.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>max_transfer_size</td>
+ <td>The maximum transfer size supported in bytes.
+ - Values: 2047 to 65,535 (default 65,535)
+ </td></tr>
+
+ <tr>
+ <td>max_packet_count</td>
+ <td>The maximum number of packets in a transfer.
+ - Values: 15 to 511 (default 511)
+ </td></tr>
+
+ <tr>
+ <td>host_channels</td>
+ <td>The number of host channel registers to use.
+ - Values: 1 to 16 (default 12)
+
+ Note: The FPGA configuration supports a maximum of 12 host channels.
+ </td></tr>
+
+ <tr>
+ <td>dev_endpoints</td>
+ <td>The number of endpoints in addition to EP0 available for device mode
+ operations.
+ - Values: 1 to 15 (default 6 IN and OUT)
+
+ Note: The FPGA configuration supports a maximum of 6 IN and OUT endpoints in
+ addition to EP0.
+ </td></tr>
+
+ <tr>
+ <td>phy_type</td>
+ <td>Specifies the type of PHY interface to use. By default, the driver will
+ automatically detect the phy_type.
+ - 0: Full Speed
+ - 1: UTMI+ (default, if available)
+ - 2: ULPI
+ </td></tr>
+
+ <tr>
+ <td>phy_utmi_width</td>
+ <td>Specifies the UTMI+ Data Width. This parameter is applicable for a
+ phy_type of UTMI+. Also, this parameter is applicable only if the
+ OTG_HSPHY_WIDTH cC parameter was set to "8 and 16 bits", meaning that the
+ core has been configured to work at either data path width.
+ - Values: 8 or 16 bits (default 16)
+ </td></tr>
+
+ <tr>
+ <td>phy_ulpi_ddr</td>
+ <td>Specifies whether the ULPI operates at double or single data rate. This
+ parameter is only applicable if phy_type is ULPI.
+ - 0: single data rate ULPI interface with 8 bit wide data bus (default)
+ - 1: double data rate ULPI interface with 4 bit wide data bus
+ </td></tr>
+
+ <tr>
+ <td>i2c_enable</td>
+ <td>Specifies whether to use the I2C interface for full speed PHY. This
+ parameter is only applicable if PHY_TYPE is FS.
+ - 0: Disabled (default)
+ - 1: Enabled
+ </td></tr>
+
+ <tr>
+ <td>ulpi_fs_ls</td>
+ <td>Specifies whether to use ULPI FS/LS mode only.
+ - 0: Disabled (default)
+ - 1: Enabled
+ </td></tr>
+
+ <tr>
+ <td>ts_dline</td>
+ <td>Specifies whether term select D-Line pulsing for all PHYs is enabled.
+ - 0: Disabled (default)
+ - 1: Enabled
+ </td></tr>
+
+ <tr>
+ <td>en_multiple_tx_fifo</td>
+ <td>Specifies whether dedicatedto tx fifos are enabled for non periodic IN EPs.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Disabled
+ - 1: Enabled (default, if available)
+ </td></tr>
+
+ <tr>
+ <td>dev_tx_fifo_size_n (n = 1 to 15)</td>
+ <td>Number of 4-byte words in each of the Tx FIFOs in device mode
+ when dynamic FIFO sizing is enabled.
+ - Values: 4 to 768 (default 256)
+ </td></tr>
+
+ <tr>
+ <td>tx_thr_length</td>
+ <td>Transmit Threshold length in 32 bit double words
+ - Values: 8 to 128 (default 64)
+ </td></tr>
+
+ <tr>
+ <td>rx_thr_length</td>
+ <td>Receive Threshold length in 32 bit double words
+ - Values: 8 to 128 (default 64)
+ </td></tr>
+
+<tr>
+ <td>thr_ctl</td>
+ <td>Specifies whether to enable Thresholding for Device mode. Bits 0, 1, 2 of
+ this parmater specifies if thresholding is enabled for non-Iso Tx, Iso Tx and
+ Rx transfers accordingly.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - Values: 0 to 7 (default 0)
+ Bit values indicate:
+ - 0: Thresholding disabled
+ - 1: Thresholding enabled
+ </td></tr>
+
+<tr>
+ <td>dma_desc_enable</td>
+ <td>Specifies whether to enable Descriptor DMA mode.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Descriptor DMA disabled
+ - 1: Descriptor DMA (default, if available)
+ </td></tr>
+
+<tr>
+ <td>mpi_enable</td>
+ <td>Specifies whether to enable MPI enhancement mode.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: MPI disabled (default)
+ - 1: MPI enable
+ </td></tr>
+
+<tr>
+ <td>pti_enable</td>
+ <td>Specifies whether to enable PTI enhancement support.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: PTI disabled (default)
+ - 1: PTI enable
+ </td></tr>
+
+<tr>
+ <td>lpm_enable</td>
+ <td>Specifies whether to enable LPM support.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: LPM disabled
+ - 1: LPM enable (default, if available)
+ </td></tr>
+
+<tr>
+ <td>ic_usb_cap</td>
+ <td>Specifies whether to enable IC_USB capability.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: IC_USB disabled (default, if available)
+ - 1: IC_USB enable
+ </td></tr>
+
+<tr>
+ <td>ahb_thr_ratio</td>
+ <td>Specifies AHB Threshold ratio.
+ - Values: 0 to 3 (default 0)
+ </td></tr>
+
+<tr>
+ <td>power_down</td>
+ <td>Specifies Power Down(Hibernation) Mode.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Power Down disabled (default)
+ - 2: Power Down enabled
+ </td></tr>
+
+ <tr>
+ <td>reload_ctl</td>
+ <td>Specifies whether dynamic reloading of the HFIR register is allowed during
+ run time. The driver will automatically detect the value for this parameter if
+ none is specified. In case the HFIR value is reloaded when HFIR.RldCtrl == 1'b0
+ the core might misbehave.
+ - 0: Reload Control disabled (default)
+ - 1: Reload Control enabled
+ </td></tr>
+
+ <tr>
+ <td>dev_out_nak</td>
+ <td>Specifies whether  Device OUT NAK enhancement enabled or no.
+ The driver will automatically detect the value for this parameter if
+ none is specified. This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
+ - 0: The core does not set NAK after Bulk OUT transfer complete (default)
+ - 1: The core sets NAK after Bulk OUT transfer complete
+ </td></tr>
+
+ <tr>
+ <td>cont_on_bna</td>
+ <td>Specifies whether Enable Continue on BNA enabled or no.
+ After receiving BNA interrupt the core disables the endpoint,when the
+ endpoint is re-enabled by the application the
+ - 0: Core starts processing from the DOEPDMA descriptor (default)
+ - 1: Core starts processing from the descriptor which received the BNA.
+ This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
+ </td></tr>
+
+ <tr>
+ <td>ahb_single</td>
+ <td>This bit when programmed supports SINGLE transfers for remainder data
+ in a transfer for DMA mode of operation.
+ - 0: The remainder data will be sent using INCR burst size (default)
+ - 1: The remainder data will be sent using SINGLE burst size.
+ </td></tr>
+
+<tr>
+ <td>adp_enable</td>
+ <td>Specifies whether ADP feature is enabled.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: ADP feature disabled (default)
+ - 1: ADP feature enabled
+ </td></tr>
+
+  <tr>
+ <td>otg_ver</td>
+ <td>Specifies whether OTG is performing as USB OTG Revision 2.0 or Revision 1.3
+ USB OTG device.
+ - 0: OTG 2.0 support disabled (default)
+ - 1: OTG 2.0 support enabled
+ </td></tr>
+
+*/
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.h b/drivers/usb/host/dwc_otg/dwc_otg_driver.h
new file mode 100644
index 0000000000000..6a8be63a0ab20
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.h
@@ -0,0 +1,86 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.h $
+ * $Revision: #19 $
+ * $Date: 2010/11/15 $
+ * $Change: 1627671 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_DRIVER_H__
+#define __DWC_OTG_DRIVER_H__
+
+/** @file
+ * This file contains the interface to the Linux driver.
+ */
+#include "dwc_otg_os_dep.h"
+#include "dwc_otg_core_if.h"
+
+/* Type declarations */
+struct dwc_otg_pcd;
+struct dwc_otg_hcd;
+
+/**
+ * This structure is a wrapper that encapsulates the driver components used to
+ * manage a single DWC_otg controller.
+ */
+typedef struct dwc_otg_device {
+	/** Structure containing OS-dependent stuff. KEEP THIS STRUCT AT THE
+	 * VERY BEGINNING OF THE DEVICE STRUCT. OSes such as FreeBSD and NetBSD
+	 * require this. */
+	struct os_dependent os_dep;
+
+	/** Pointer to the core interface structure. */
+	dwc_otg_core_if_t *core_if;
+
+	/** Pointer to the PCD structure. */
+	struct dwc_otg_pcd *pcd;
+
+	/** Pointer to the HCD structure. */
+	struct dwc_otg_hcd *hcd;
+
+	/** Flag to indicate whether the common IRQ handler is installed. */
+	uint8_t common_irq_installed;
+
+} dwc_otg_device_t;
+
+/*We must clear S3C24XX_EINTPEND external interrupt register
+ * because after clearing in this register trigerred IRQ from
+ * H/W core in kernel interrupt can be occured again before OTG
+ * handlers clear all IRQ sources of Core registers because of
+ * timing latencies and Low Level IRQ Type.
+ */
+#ifdef CONFIG_MACH_IPMATE
+#define  S3C2410X_CLEAR_EINTPEND()   \
+do { \
+	__raw_writel(1UL << 11,S3C24XX_EINTPEND); \
+} while (0)
+#else
+#define  S3C2410X_CLEAR_EINTPEND()   do { } while (0)
+#endif
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
new file mode 100644
index 0000000000000..e4923d7619813
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
@@ -0,0 +1,1401 @@
+/*
+ * dwc_otg_fiq_fsm.c - The finite state machine FIQ
+ *
+ * Copyright (c) 2013 Raspberry Pi Foundation
+ *
+ * Author: Jonathan Bell <jonathan@raspberrypi.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *	* Redistributions of source code must retain the above copyright
+ *	  notice, this list of conditions and the following disclaimer.
+ *	* Redistributions in binary form must reproduce the above copyright
+ *	  notice, this list of conditions and the following disclaimer in the
+ *	  documentation and/or other materials provided with the distribution.
+ *	* Neither the name of Raspberry Pi nor the
+ *	  names of its contributors may be used to endorse or promote products
+ *	  derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * This FIQ implements functionality that performs split transactions on
+ * the dwc_otg hardware without any outside intervention. A split transaction
+ * is "queued" by nominating a specific host channel to perform the entirety
+ * of a split transaction. This FIQ will then perform the microframe-precise
+ * scheduling required in each phase of the transaction until completion.
+ *
+ * The FIQ functionality is glued into the Synopsys driver via the entry point
+ * in the FSM enqueue function, and at the exit point in handling a HC interrupt
+ * for a FSM-enabled channel.
+ *
+ * NB: Large parts of this implementation have architecture-specific code.
+ * For porting this functionality to other ARM machines, the minimum is required:
+ * - An interrupt controller allowing the top-level dwc USB interrupt to be routed
+ *   to the FIQ
+ * - A method of forcing a software generated interrupt from FIQ mode that then
+ *   triggers an IRQ entry (with the dwc USB handler called by this IRQ number)
+ * - Guaranteed interrupt routing such that both the FIQ and SGI occur on the same
+ *   processor core - there is no locking between the FIQ and IRQ (aside from
+ *   local_fiq_disable)
+ *
+ */
+
+#include "dwc_otg_fiq_fsm.h"
+
+
+char buffer[1000*16];
+int wptr;
+void notrace _fiq_print(enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...)
+{
+	enum fiq_debug_level dbg_lvl_req = FIQDBG_ERR;
+	va_list args;
+	char text[17];
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + 0x408) };
+
+	if((dbg_lvl & dbg_lvl_req) || dbg_lvl == FIQDBG_ERR)
+	{
+		snprintf(text, 9, " %4d:%1u  ", hfnum.b.frnum/8, hfnum.b.frnum & 7);
+		va_start(args, fmt);
+		vsnprintf(text+8, 9, fmt, args);
+		va_end(args);
+
+		memcpy(buffer + wptr, text, 16);
+		wptr = (wptr + 16) % sizeof(buffer);
+	}
+}
+
+/**
+ * fiq_fsm_spin_lock() - ARMv6+ bare bones spinlock
+ * Must be called with local interrupts and FIQ disabled.
+ */
+#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
+inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
+{
+	unsigned long tmp;
+	uint32_t newval;
+	fiq_lock_t lockval;
+	/* Nested locking, yay. If we are on the same CPU as the fiq, then the disable
+	 * will be sufficient. If we are on a different CPU, then the lock protects us. */
+	prefetchw(&lock->slock);
+	asm volatile (
+	"1:     ldrex   %0, [%3]\n"
+	"       add     %1, %0, %4\n"
+	"       strex   %2, %1, [%3]\n"
+	"       teq     %2, #0\n"
+	"       bne     1b"
+	: "=&r" (lockval), "=&r" (newval), "=&r" (tmp)
+	: "r" (&lock->slock), "I" (1 << 16)
+	: "cc");
+
+	while (lockval.tickets.next != lockval.tickets.owner) {
+		wfe();
+		lockval.tickets.owner = READ_ONCE(lock->tickets.owner);
+	}
+	smp_mb();
+}
+#else
+inline void fiq_fsm_spin_lock(fiq_lock_t *lock) { }
+#endif
+
+/**
+ * fiq_fsm_spin_unlock() - ARMv6+ bare bones spinunlock
+ */
+#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
+inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
+{
+	smp_mb();
+	lock->tickets.owner++;
+	dsb_sev();
+}
+#else
+inline void fiq_fsm_spin_unlock(fiq_lock_t *lock) { }
+#endif
+
+/**
+ * fiq_fsm_restart_channel() - Poke channel enable bit for a split transaction
+ * @channel: channel to re-enable
+ */
+static void fiq_fsm_restart_channel(struct fiq_state *st, int n, int force)
+{
+	hcchar_data_t hcchar = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR) };
+
+	hcchar.b.chen = 0;
+	if (st->channel[n].hcchar_copy.b.eptype & 0x1) {
+		hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
+		/* Hardware bug workaround: update the ssplit index */
+		if (st->channel[n].hcsplt_copy.b.spltena)
+			st->channel[n].expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
+
+		hcchar.b.oddfrm = (hfnum.b.frnum & 0x1) ? 0	: 1;
+	}
+
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
+	hcchar.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+	hcchar.b.chen = 1;
+
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
+	fiq_print(FIQDBG_INT, st, "HCGO %01d %01d", n, force);
+}
+
+/**
+ * fiq_fsm_setup_csplit() - Prepare a host channel for a CSplit transaction stage
+ * @st: Pointer to the channel's state
+ * @n : channel number
+ *
+ * Change host channel registers to perform a complete-split transaction. Being mindful of the
+ * endpoint direction, set control regs up correctly.
+ */
+static void notrace fiq_fsm_setup_csplit(struct fiq_state *st, int n)
+{
+	hcsplt_data_t hcsplt = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT) };
+	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
+
+	hcsplt.b.compsplt = 1;
+	if (st->channel[n].hcchar_copy.b.epdir == 1) {
+		// If IN, the CSPLIT result contains the data or a hub handshake. hctsiz = maxpacket.
+		hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
+	} else {
+		// If OUT, the CSPLIT result contains handshake only.
+		hctsiz.b.xfersize = 0;
+	}
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
+	mb();
+}
+
+/**
+ * fiq_fsm_restart_np_pending() - Restart a single non-periodic contended transfer
+ * @st: Pointer to the channel's state
+ * @num_channels: Total number of host channels
+ * @orig_channel: Channel index of completed transfer
+ *
+ * In the case where an IN and OUT transfer are simultaneously scheduled to the
+ * same device/EP, inadequate hub implementations will misbehave. Once the first
+ * transfer is complete, a pending non-periodic split can then be issued.
+ */
+static void notrace fiq_fsm_restart_np_pending(struct fiq_state *st, int num_channels, int orig_channel)
+{
+	int i;
+	int dev_addr = st->channel[orig_channel].hcchar_copy.b.devaddr;
+	int ep_num = st->channel[orig_channel].hcchar_copy.b.epnum;
+	for (i = 0; i < num_channels; i++) {
+		if (st->channel[i].fsm == FIQ_NP_SSPLIT_PENDING &&
+			st->channel[i].hcchar_copy.b.devaddr == dev_addr &&
+			st->channel[i].hcchar_copy.b.epnum == ep_num) {
+			st->channel[i].fsm = FIQ_NP_SSPLIT_STARTED;
+			fiq_fsm_restart_channel(st, i, 0);
+			break;
+		}
+	}
+}
+
+static inline int notrace fiq_get_xfer_len(struct fiq_state *st, int n)
+{
+	/* The xfersize register is a bit wonky. For IN transfers, it decrements by the packet size. */
+	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
+
+	if (st->channel[n].hcchar_copy.b.epdir == 0) {
+		return st->channel[n].hctsiz_copy.b.xfersize;
+	} else {
+		return st->channel[n].hctsiz_copy.b.xfersize - hctsiz.b.xfersize;
+	}
+
+}
+
+
+/**
+ * fiq_increment_dma_buf() - update DMA address for bounce buffers after a CSPLIT
+ *
+ * Of use only for IN periodic transfers.
+ */
+static int notrace fiq_increment_dma_buf(struct fiq_state *st, int num_channels, int n)
+{
+	hcdma_data_t hcdma;
+	int i = st->channel[n].dma_info.index;
+	int len;
+	struct fiq_dma_blob *blob = (struct fiq_dma_blob *) st->dma_base;
+
+	len = fiq_get_xfer_len(st, n);
+	fiq_print(FIQDBG_INT, st, "LEN: %03d", len);
+	st->channel[n].dma_info.slot_len[i] = len;
+	i++;
+	if (i > 6)
+		BUG();
+
+	hcdma.d32 = (dma_addr_t) &blob->channel[n].index[i].buf[0];
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
+	st->channel[n].dma_info.index = i;
+	return 0;
+}
+
+/**
+ * fiq_reload_hctsiz() - for IN transactions, reset HCTSIZ
+ */
+static void notrace fiq_fsm_reload_hctsiz(struct fiq_state *st, int n)
+{
+	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
+	hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
+	hctsiz.b.pktcnt = 1;
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
+}
+
+/**
+ * fiq_fsm_reload_hcdma() - for OUT transactions, rewind DMA pointer
+ */
+static void notrace fiq_fsm_reload_hcdma(struct fiq_state *st, int n)
+{
+	hcdma_data_t hcdma = st->channel[n].hcdma_copy;
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
+}
+
+/**
+ * fiq_iso_out_advance() - update DMA address and split position bits
+ * for isochronous OUT transactions.
+ *
+ * Returns 1 if this is the last packet queued, 0 otherwise. Split-ALL and
+ * Split-BEGIN states are not handled - this is done when the transaction was queued.
+ *
+ * This function must only be called from the FIQ_ISO_OUT_ACTIVE state.
+ */
+static int notrace fiq_iso_out_advance(struct fiq_state *st, int num_channels, int n)
+{
+	hcsplt_data_t hcsplt;
+	hctsiz_data_t hctsiz;
+	hcdma_data_t hcdma;
+	struct fiq_dma_blob *blob = (struct fiq_dma_blob *) st->dma_base;
+	int last = 0;
+	int i = st->channel[n].dma_info.index;
+
+	fiq_print(FIQDBG_INT, st, "ADV %01d %01d ", n, i);
+	i++;
+	if (i == 4)
+		last = 1;
+	if (st->channel[n].dma_info.slot_len[i+1] == 255)
+		last = 1;
+
+	/* New DMA address - address of bounce buffer referred to in index */
+	hcdma.d32 = (uint32_t) &blob->channel[n].index[i].buf[0];
+	//hcdma.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA);
+	//hcdma.d32 += st->channel[n].dma_info.slot_len[i];
+	fiq_print(FIQDBG_INT, st, "LAST: %01d ", last);
+	fiq_print(FIQDBG_INT, st, "LEN: %03d", st->channel[n].dma_info.slot_len[i]);
+	hcsplt.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT);
+	hctsiz.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ);
+	hcsplt.b.xactpos = (last) ? ISOC_XACTPOS_END : ISOC_XACTPOS_MID;
+	/* Set up new packet length */
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.xfersize = st->channel[n].dma_info.slot_len[i];
+	fiq_print(FIQDBG_INT, st, "%08x", hctsiz.d32);
+
+	st->channel[n].dma_info.index++;
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
+	return last;
+}
+
+/**
+ * fiq_fsm_tt_next_isoc() - queue next pending isochronous out start-split on a TT
+ *
+ * Despite the limitations of the DWC core, we can force a microframe pipeline of
+ * isochronous OUT start-split transactions while waiting for a corresponding other-type
+ * of endpoint to finish its CSPLITs. TTs have big periodic buffers therefore it
+ * is very unlikely that filling the start-split FIFO will cause data loss.
+ * This allows much better interleaving of transactions in an order-independent way-
+ * there is no requirement to prioritise isochronous, just a state-space search has
+ * to be performed on each periodic start-split complete interrupt.
+ */
+static int notrace fiq_fsm_tt_next_isoc(struct fiq_state *st, int num_channels, int n)
+{
+	int hub_addr = st->channel[n].hub_addr;
+	int port_addr = st->channel[n].port_addr;
+	int i, poked = 0;
+	for (i = 0; i < num_channels; i++) {
+		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
+			continue;
+		if (st->channel[i].hub_addr == hub_addr &&
+			st->channel[i].port_addr == port_addr) {
+			switch (st->channel[i].fsm) {
+			case FIQ_PER_ISO_OUT_PENDING:
+				if (st->channel[i].nrpackets == 1) {
+					st->channel[i].fsm = FIQ_PER_ISO_OUT_LAST;
+				} else {
+					st->channel[i].fsm = FIQ_PER_ISO_OUT_ACTIVE;
+				}
+				fiq_fsm_restart_channel(st, i, 0);
+				poked = 1;
+				break;
+
+			default:
+				break;
+			}
+		}
+		if (poked)
+			break;
+	}
+	return poked;
+}
+
+/**
+ * fiq_fsm_tt_in_use() - search for host channels using this TT
+ * @n: Channel to use as reference
+ *
+ */
+int notrace noinline fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n)
+{
+	int hub_addr = st->channel[n].hub_addr;
+	int port_addr = st->channel[n].port_addr;
+	int i, in_use = 0;
+	for (i = 0; i < num_channels; i++) {
+		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
+			continue;
+		switch (st->channel[i].fsm) {
+		/* TT is reserved for channels that are in the middle of a periodic
+		 * split transaction.
+		 */
+		case FIQ_PER_SSPLIT_STARTED:
+		case FIQ_PER_CSPLIT_WAIT:
+		case FIQ_PER_CSPLIT_NYET1:
+		//case FIQ_PER_CSPLIT_POLL:
+		case FIQ_PER_ISO_OUT_ACTIVE:
+		case FIQ_PER_ISO_OUT_LAST:
+			if (st->channel[i].hub_addr == hub_addr &&
+				st->channel[i].port_addr == port_addr) {
+				in_use = 1;
+			}
+			break;
+		default:
+			break;
+		}
+		if (in_use)
+			break;
+	}
+	return in_use;
+}
+
+/**
+ * fiq_fsm_more_csplits() - determine whether additional CSPLITs need
+ * 			to be issued for this IN transaction.
+ *
+ * We cannot tell the inbound PID of a data packet due to hardware limitations.
+ * we need to make an educated guess as to whether we need to queue another CSPLIT
+ * or not. A no-brainer is when we have received enough data to fill the endpoint
+ * size, but for endpoints that give variable-length data then we have to resort
+ * to heuristics.
+ *
+ * We also return whether this is the last CSPLIT to be queued, again based on
+ * heuristics. This is to allow a 1-uframe overlap of periodic split transactions.
+ * Note: requires at least 1 CSPLIT to have been performed prior to being called.
+ */
+
+/*
+ * We need some way of guaranteeing if a returned periodic packet of size X
+ * has a DATA0 PID.
+ * The heuristic value of 144 bytes assumes that the received data has maximal
+ * bit-stuffing and the clock frequency of the transmitting device is at the lowest
+ * permissible limit. If the transfer length results in a final packet size
+ * 144 < p <= 188, then an erroneous CSPLIT will be issued.
+ * Also used to ensure that an endpoint will nominally only return a single
+ * complete-split worth of data.
+ */
+#define DATA0_PID_HEURISTIC 144
+
+static int notrace noinline fiq_fsm_more_csplits(struct fiq_state *state, int n, int *probably_last)
+{
+
+	int i;
+	int total_len = 0;
+	int more_needed = 1;
+	struct fiq_channel_state *st = &state->channel[n];
+
+	for (i = 0; i < st->dma_info.index; i++) {
+			total_len += st->dma_info.slot_len[i];
+	}
+
+	*probably_last = 0;
+
+	if (st->hcchar_copy.b.eptype == 0x3) {
+		/*
+		 * An interrupt endpoint will take max 2 CSPLITs. if we are receiving data
+		 * then this is definitely the last CSPLIT.
+		 */
+		*probably_last = 1;
+	} else {
+		/* Isoc IN. This is a bit risky if we are the first transaction:
+		 * we may have been held off slightly. */
+		if (i > 1 && st->dma_info.slot_len[st->dma_info.index-1] <= DATA0_PID_HEURISTIC) {
+			more_needed = 0;
+		}
+		/* If in the next uframe we will receive enough data to fill the endpoint,
+		 * then only issue 1 more csplit.
+		 */
+		if (st->hctsiz_copy.b.xfersize - total_len <= DATA0_PID_HEURISTIC)
+			*probably_last = 1;
+	}
+
+	if (total_len >= st->hctsiz_copy.b.xfersize ||
+		i == 6 || total_len == 0)
+		/* Note: due to bit stuffing it is possible to have > 6 CSPLITs for
+		 * a single endpoint. Accepting more would completely break our scheduling mechanism though
+		 * - in these extreme cases we will pass through a truncated packet.
+		 */
+		more_needed = 0;
+
+	return more_needed;
+}
+
+/**
+ * fiq_fsm_too_late() - Test transaction for lateness
+ *
+ * If a SSPLIT for a large IN transaction is issued too late in a frame,
+ * the hub will disable the port to the device and respond with ERR handshakes.
+ * The hub status endpoint will not reflect this change.
+ * Returns 1 if we will issue a SSPLIT that will result in a device babble.
+ */
+int notrace fiq_fsm_too_late(struct fiq_state *st, int n)
+{
+	int uframe;
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
+	uframe = hfnum.b.frnum & 0x7;
+	if ((uframe < 6) && (st->channel[n].nrpackets + 1 + uframe > 7)) {
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+
+/**
+ * fiq_fsm_start_next_periodic() - A half-arsed attempt at a microframe pipeline
+ *
+ * Search pending transactions in the start-split pending state and queue them.
+ * Don't queue packets in uframe .5 (comes out in .6) (USB2.0 11.18.4).
+ * Note: we specifically don't do isochronous OUT transactions first because better
+ * use of the TT's start-split fifo can be achieved by pipelining an IN before an OUT.
+ */
+static void notrace noinline fiq_fsm_start_next_periodic(struct fiq_state *st, int num_channels)
+{
+	int n;
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
+	if ((hfnum.b.frnum & 0x7) == 5)
+		return;
+	for (n = 0; n < num_channels; n++) {
+		if (st->channel[n].fsm == FIQ_PER_SSPLIT_QUEUED) {
+			/* Check to see if any other transactions are using this TT */
+			if(!fiq_fsm_tt_in_use(st, num_channels, n)) {
+				if (!fiq_fsm_too_late(st, n)) {
+					st->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
+					fiq_print(FIQDBG_INT, st, "NEXTPER ");
+					fiq_fsm_restart_channel(st, n, 0);
+				} else {
+					st->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
+				}
+				break;
+			}
+		}
+	}
+	for (n = 0; n < num_channels; n++) {
+		if (st->channel[n].fsm == FIQ_PER_ISO_OUT_PENDING) {
+			if (!fiq_fsm_tt_in_use(st, num_channels, n)) {
+				fiq_print(FIQDBG_INT, st, "NEXTISO ");
+				if (st->channel[n].nrpackets == 1)
+					st->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
+				else
+					st->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
+				fiq_fsm_restart_channel(st, n, 0);
+				break;
+			}
+		}
+	}
+}
+
+/**
+ * fiq_fsm_update_hs_isoc() - update isochronous frame and transfer data
+ * @state:	Pointer to fiq_state
+ * @n:		Channel transaction is active on
+ * @hcint:	Copy of host channel interrupt register
+ *
+ * Returns 0 if there are no more transactions for this HC to do, 1
+ * otherwise.
+ */
+static int notrace noinline fiq_fsm_update_hs_isoc(struct fiq_state *state, int n, hcint_data_t hcint)
+{
+	struct fiq_channel_state *st = &state->channel[n];
+	int xfer_len = 0, nrpackets = 0;
+	hcdma_data_t hcdma;
+	fiq_print(FIQDBG_INT, state, "HSISO %02d", n);
+
+	xfer_len = fiq_get_xfer_len(state, n);
+	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].actual_length = xfer_len;
+
+	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].status = hcint.d32;
+
+	st->hs_isoc_info.index++;
+	if (st->hs_isoc_info.index == st->hs_isoc_info.nrframes) {
+		return 0;
+	}
+
+	/* grab the next DMA address offset from the array */
+	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].offset;
+	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
+
+	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
+	 * the core needs to be told to send the correct number. Caution: for IN transfers,
+	 * this is always set to the maximum size of the endpoint. */
+	xfer_len = st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].length;
+	/* Integer divide in a FIQ: fun. FIXME: make this not suck */
+	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
+	if (nrpackets == 0)
+		nrpackets = 1;
+	st->hcchar_copy.b.multicnt = nrpackets;
+	st->hctsiz_copy.b.pktcnt = nrpackets;
+
+	/* Initial PID also needs to be set */
+	if (st->hcchar_copy.b.epdir == 0) {
+		st->hctsiz_copy.b.xfersize = xfer_len;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
+			break;
+		}
+
+	} else {
+		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
+			break;
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
+			break;
+		}
+	}
+	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, st->hctsiz_copy.d32);
+	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, st->hcchar_copy.d32);
+	/* Channel is enabled on hcint handler exit */
+	fiq_print(FIQDBG_INT, state, "HSISOOUT");
+	return 1;
+}
+
+
+/**
+ * fiq_fsm_do_sof() - FSM start-of-frame interrupt handler
+ * @state:	Pointer to the state struct passed from banked FIQ mode registers.
+ * @num_channels:	set according to the DWC hardware configuration
+ *
+ * The SOF handler in FSM mode has two functions
+ * 1. Hold off SOF from causing schedule advancement in IRQ context if there's
+ *    nothing to do
+ * 2. Advance certain FSM states that require either a microframe delay, or a microframe
+ *    of holdoff.
+ *
+ * The second part is architecture-specific to mach-bcm2835 -
+ * a sane interrupt controller would have a mask register for ARM interrupt sources
+ * to be promoted to the nFIQ line, but it doesn't. Instead a single interrupt
+ * number (USB) can be enabled. This means that certain parts of the USB specification
+ * that require "wait a little while, then issue another packet" cannot be fulfilled with
+ * the timing granularity required to achieve optimal throughout. The workaround is to use
+ * the SOF "timer" (125uS) to perform this task.
+ */
+static int notrace noinline fiq_fsm_do_sof(struct fiq_state *state, int num_channels)
+{
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + HFNUM) };
+	int n;
+	int kick_irq = 0;
+
+	if ((hfnum.b.frnum & 0x7) == 1) {
+		/* We cannot issue csplits for transactions in the last frame past (n+1).1
+		 * Check to see if there are any transactions that are stale.
+		 * Boot them out.
+		 */
+		for (n = 0; n < num_channels; n++) {
+			switch (state->channel[n].fsm) {
+			case FIQ_PER_CSPLIT_WAIT:
+			case FIQ_PER_CSPLIT_NYET1:
+			case FIQ_PER_CSPLIT_POLL:
+			case FIQ_PER_CSPLIT_LAST:
+				/* Check if we are no longer in the same full-speed frame. */
+				if (((state->channel[n].expected_uframe & 0x3FFF) & ~0x7) <
+						(hfnum.b.frnum & ~0x7))
+					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
+				break;
+			default:
+				break;
+			}
+		}
+	}
+
+	for (n = 0; n < num_channels; n++) {
+		switch (state->channel[n].fsm) {
+
+		case FIQ_NP_SSPLIT_RETRY:
+		case FIQ_NP_IN_CSPLIT_RETRY:
+		case FIQ_NP_OUT_CSPLIT_RETRY:
+			fiq_fsm_restart_channel(state, n, 0);
+			break;
+
+		case FIQ_HS_ISOC_SLEEPING:
+			/* Is it time to wake this channel yet? */
+			if (--state->channel[n].uframe_sleeps == 0) {
+				state->channel[n].fsm = FIQ_HS_ISOC_TURBO;
+				fiq_fsm_restart_channel(state, n, 0);
+			}
+			break;
+
+		case FIQ_PER_SSPLIT_QUEUED:
+			if ((hfnum.b.frnum & 0x7) == 5)
+				break;
+			if(!fiq_fsm_tt_in_use(state, num_channels, n)) {
+				if (!fiq_fsm_too_late(state, n)) {
+					fiq_print(FIQDBG_INT, state, "SOF GO %01d", n);
+					fiq_fsm_restart_channel(state, n, 0);
+					state->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
+				} else {
+					/* Transaction cannot be started without risking a device babble error */
+					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
+					state->haintmsk_saved.b2.chint &= ~(1 << n);
+					FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
+					kick_irq |= 1;
+				}
+			}
+			break;
+
+		case FIQ_PER_ISO_OUT_PENDING:
+			/* Ordinarily, this should be poked after the SSPLIT
+			 * complete interrupt for a competing transfer on the same
+			 * TT. Doesn't happen for aborted transactions though.
+			 */
+			if ((hfnum.b.frnum & 0x7) >= 5)
+				break;
+			if (!fiq_fsm_tt_in_use(state, num_channels, n)) {
+				/* Hardware bug. SOF can sometimes occur after the channel halt interrupt
+				 * that caused this.
+				 */
+					fiq_fsm_restart_channel(state, n, 0);
+					fiq_print(FIQDBG_INT, state, "SOF ISOC");
+					if (state->channel[n].nrpackets == 1) {
+						state->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
+					} else {
+						state->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
+					}
+			}
+			break;
+
+		case FIQ_PER_CSPLIT_WAIT:
+			/* we are guaranteed to be in this state if and only if the SSPLIT interrupt
+			 * occurred when the bus transaction occurred. The SOF interrupt reversal bug
+			 * will utterly bugger this up though.
+			 */
+			if (hfnum.b.frnum != state->channel[n].expected_uframe) {
+				fiq_print(FIQDBG_INT, state, "SOFCS %d ", n);
+				state->channel[n].fsm = FIQ_PER_CSPLIT_POLL;
+				fiq_fsm_restart_channel(state, n, 0);
+				fiq_fsm_start_next_periodic(state, num_channels);
+
+			}
+			break;
+
+		case FIQ_PER_SPLIT_TIMEOUT:
+		case FIQ_DEQUEUE_ISSUED:
+			/* Ugly: we have to force a HCD interrupt.
+			 * Poke the mask for the channel in question.
+			 * We will take a fake SOF because of this, but
+			 * that's OK.
+			 */
+			state->haintmsk_saved.b2.chint &= ~(1 << n);
+			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
+			kick_irq |= 1;
+			break;
+
+		default:
+			break;
+		}
+	}
+
+	if (state->kick_np_queues ||
+			dwc_frame_num_le(state->next_sched_frame, hfnum.b.frnum))
+		kick_irq |= 1;
+
+	return !kick_irq;
+}
+
+
+/**
+ * fiq_fsm_do_hcintr() - FSM host channel interrupt handler
+ * @state: Pointer to the FIQ state struct
+ * @num_channels: Number of channels as per hardware config
+ * @n: channel for which HAINT(i) was raised
+ *
+ * An important property is that only the CHHLT interrupt is unmasked. Unfortunately, AHBerr is as well.
+ */
+static int notrace noinline fiq_fsm_do_hcintr(struct fiq_state *state, int num_channels, int n)
+{
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	hcint_data_t hcint_probe;
+	hcchar_data_t hcchar;
+	int handled = 0;
+	int restart = 0;
+	int last_csplit = 0;
+	int start_next_periodic = 0;
+	struct fiq_channel_state *st = &state->channel[n];
+	hfnum_data_t hfnum;
+
+	hcint.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT);
+	hcintmsk.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK);
+	hcint_probe.d32 = hcint.d32 & hcintmsk.d32;
+
+	if (st->fsm != FIQ_PASSTHROUGH) {
+		fiq_print(FIQDBG_INT, state, "HC%01d ST%02d", n, st->fsm);
+		fiq_print(FIQDBG_INT, state, "%08x", hcint.d32);
+	}
+
+	switch (st->fsm) {
+
+	case FIQ_PASSTHROUGH:
+	case FIQ_DEQUEUE_ISSUED:
+		/* doesn't belong to us, kick it upstairs */
+		break;
+
+	case FIQ_PASSTHROUGH_ERRORSTATE:
+		/* We are here to emulate the error recovery mechanism of the dwc HCD.
+		 * Several interrupts are unmasked if a previous transaction failed - it's
+		 * death for the FIQ to attempt to handle them as the channel isn't halted.
+		 * Emulate what the HCD does in this situation: mask and continue.
+		 * The FSM has no other state setup so this has to be handled out-of-band.
+		 */
+		fiq_print(FIQDBG_ERR, state, "ERRST %02d", n);
+		if (hcint_probe.b.nak || hcint_probe.b.ack || hcint_probe.b.datatglerr) {
+			fiq_print(FIQDBG_ERR, state, "RESET %02d", n);
+			/* In some random cases we can get a NAK interrupt coincident with a Xacterr
+			 * interrupt, after the device has disappeared.
+			 */
+			if (!hcint.b.xacterr)
+				st->nr_errors = 0;
+			hcintmsk.b.nak = 0;
+			hcintmsk.b.ack = 0;
+			hcintmsk.b.datatglerr = 0;
+			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, hcintmsk.d32);
+			return 1;
+		}
+		if (hcint_probe.b.chhltd) {
+			fiq_print(FIQDBG_ERR, state, "CHHLT %02d", n);
+			fiq_print(FIQDBG_ERR, state, "%08x", hcint.d32);
+			return 0;
+		}
+		break;
+
+	/* Non-periodic state groups */
+	case FIQ_NP_SSPLIT_STARTED:
+	case FIQ_NP_SSPLIT_RETRY:
+		/* Got a HCINT for a NP SSPLIT. Expected ACK / NAK / fail */
+		if (hcint.b.ack) {
+			/* SSPLIT complete. For OUT, the data has been sent. For IN, the LS transaction
+			 * will start shortly. SOF needs to kick the transaction to prevent a NYET flood.
+			 */
+			if(st->hcchar_copy.b.epdir == 1)
+				st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
+			else
+				st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
+			st->nr_errors = 0;
+			handled = 1;
+			fiq_fsm_setup_csplit(state, n);
+		} else if (hcint.b.nak) {
+			// No buffer space in TT. Retry on a uframe boundary.
+			fiq_fsm_reload_hcdma(state, n);
+			st->fsm = FIQ_NP_SSPLIT_RETRY;
+			handled = 1;
+		} else if (hcint.b.xacterr) {
+			// The only other one we care about is xacterr. This implies HS bus error - retry.
+			st->nr_errors++;
+			if(st->hcchar_copy.b.epdir == 0)
+				fiq_fsm_reload_hcdma(state, n);
+			st->fsm = FIQ_NP_SSPLIT_RETRY;
+			if (st->nr_errors >= 3) {
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			} else {
+				handled = 1;
+				restart = 1;
+			}
+		} else {
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+			handled = 0;
+			restart = 0;
+		}
+		break;
+
+	case FIQ_NP_IN_CSPLIT_RETRY:
+		/* Received a CSPLIT done interrupt.
+		 * Expected Data/NAK/STALL/NYET for IN.
+		 */
+		if (hcint.b.xfercomp) {
+			/* For IN, data is present. */
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nak) {
+			/* no endpoint data. Punt it upstairs */
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nyet) {
+			/* CSPLIT NYET - retry on a uframe boundary. */
+			handled = 1;
+			st->nr_errors = 0;
+		} else if (hcint.b.datatglerr) {
+			/* data toggle errors do not set the xfercomp bit. */
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+		} else if (hcint.b.xacterr) {
+			/* HS error. Retry immediate */
+			st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
+			st->nr_errors++;
+			if (st->nr_errors >= 3) {
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			} else {
+				handled = 1;
+				restart = 1;
+			}
+		} else if (hcint.b.stall || hcint.b.bblerr) {
+			/* A STALL implies either a LS bus error or a genuine STALL. */
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+		} else {
+			/*  Hardware bug. It's possible in some cases to
+			 *  get a channel halt with nothing else set when
+			 *  the response was a NYET. Treat as local 3-strikes retry.
+			 */
+			hcint_data_t hcint_test = hcint;
+			hcint_test.b.chhltd = 0;
+			if (!hcint_test.d32) {
+				st->nr_errors++;
+				if (st->nr_errors >= 3) {
+					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+				} else {
+					handled = 1;
+				}
+			} else {
+				/* Bail out if something unexpected happened */
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			}
+		}
+		if (st->fsm != FIQ_NP_IN_CSPLIT_RETRY) {
+			fiq_fsm_restart_np_pending(state, num_channels, n);
+		}
+		break;
+
+	case FIQ_NP_OUT_CSPLIT_RETRY:
+		/* Received a CSPLIT done interrupt.
+		 * Expected ACK/NAK/STALL/NYET/XFERCOMP for OUT.*/
+		if (hcint.b.xfercomp) {
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nak) {
+			// The HCD will implement the holdoff on frame boundaries.
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nyet) {
+			// Hub still processing.
+			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
+			handled = 1;
+			st->nr_errors = 0;
+			//restart = 1;
+		} else if (hcint.b.xacterr) {
+			/* HS error. retry immediate */
+			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
+			st->nr_errors++;
+			if (st->nr_errors >= 3) {
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			} else {
+				handled = 1;
+				restart = 1;
+			}
+		} else if (hcint.b.stall) {
+			/* LS bus error or genuine stall */
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+		} else {
+			/*
+			 * Hardware bug. It's possible in some cases to get a
+			 * channel halt with nothing else set when the response was a NYET.
+			 * Treat as local 3-strikes retry.
+			 */
+			hcint_data_t hcint_test = hcint;
+			hcint_test.b.chhltd = 0;
+			if (!hcint_test.d32) {
+				st->nr_errors++;
+				if (st->nr_errors >= 3) {
+					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+				} else {
+					handled = 1;
+				}
+			} else {
+				// Something unexpected happened. AHBerror or babble perhaps. Let the IRQ deal with it.
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			}
+		}
+		if (st->fsm != FIQ_NP_OUT_CSPLIT_RETRY) {
+			fiq_fsm_restart_np_pending(state, num_channels, n);
+		}
+		break;
+
+	/* Periodic split states (except isoc out) */
+	case FIQ_PER_SSPLIT_STARTED:
+		/* Expect an ACK or failure for SSPLIT */
+		if (hcint.b.ack) {
+			/*
+			 * SSPLIT transfer complete interrupt - the generation of this interrupt is fraught with bugs.
+			 * For a packet queued in microframe n-3 to appear in n-2, if the channel is enabled near the EOF1
+			 * point for microframe n-3, the packet will not appear on the bus until microframe n.
+			 * Additionally, the generation of the actual interrupt is dodgy. For a packet appearing on the bus
+			 * in microframe n, sometimes the interrupt is generated immediately. Sometimes, it appears in n+1
+			 * coincident with SOF for n+1.
+			 * SOF is also buggy. It can sometimes be raised AFTER the first bus transaction has taken place.
+			 * These appear to be caused by timing/clock crossing bugs within the core itself.
+			 * State machine workaround.
+			 */
+			hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+			hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+			fiq_fsm_setup_csplit(state, n);
+			/* Poke the oddfrm bit. If we are equivalent, we received the interrupt at the correct
+			 * time. If not, then we're in the next SOF.
+			 */
+			if ((hfnum.b.frnum & 0x1) == hcchar.b.oddfrm) {
+				fiq_print(FIQDBG_INT, state, "CSWAIT %01d", n);
+				st->expected_uframe = hfnum.b.frnum;
+				st->fsm = FIQ_PER_CSPLIT_WAIT;
+			} else {
+				fiq_print(FIQDBG_INT, state, "CSPOL  %01d", n);
+				/* For isochronous IN endpoints,
+				 * we need to hold off if we are expecting a lot of data */
+				if (st->hcchar_copy.b.mps < DATA0_PID_HEURISTIC) {
+					start_next_periodic = 1;
+				}
+				/* Danger will robinson: we are in a broken state. If our first interrupt after
+				 * this is a NYET, it will be delayed by 1 uframe and result in an unrecoverable
+				 * lag. Unmask the NYET interrupt.
+				 */
+				st->expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
+				st->fsm = FIQ_PER_CSPLIT_BROKEN_NYET1;
+				restart = 1;
+			}
+			handled = 1;
+		} else if (hcint.b.xacterr) {
+			/* 3-strikes retry is enabled, we have hit our max nr_errors */
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+			start_next_periodic = 1;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+			start_next_periodic = 1;
+		}
+		/* We can now queue the next isochronous OUT transaction, if one is pending. */
+		if(fiq_fsm_tt_next_isoc(state, num_channels, n)) {
+			fiq_print(FIQDBG_INT, state, "NEXTISO ");
+		}
+		break;
+
+	case FIQ_PER_CSPLIT_NYET1:
+		/* First CSPLIT attempt was a NYET. If we get a subsequent NYET,
+		 * we are too late and the TT has dropped its CSPLIT fifo.
+		 */
+		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+		start_next_periodic = 1;
+		if (hcint.b.nak) {
+			st->fsm = FIQ_PER_SPLIT_DONE;
+		} else if (hcint.b.xfercomp) {
+			fiq_increment_dma_buf(state, num_channels, n);
+			st->fsm = FIQ_PER_CSPLIT_POLL;
+			st->nr_errors = 0;
+			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
+				handled = 1;
+				restart = 1;
+				if (!last_csplit)
+					start_next_periodic = 0;
+			} else {
+				st->fsm = FIQ_PER_SPLIT_DONE;
+			}
+		} else if (hcint.b.nyet) {
+			/* Doh. Data lost. */
+			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
+		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
+			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+		}
+		break;
+
+	case FIQ_PER_CSPLIT_BROKEN_NYET1:
+		/*
+		 * we got here because our host channel is in the delayed-interrupt
+		 * state and we cannot take a NYET interrupt any later than when it
+		 * occurred. Disable then re-enable the channel if this happens to force
+		 * CSPLITs to occur at the right time.
+		 */
+		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+		fiq_print(FIQDBG_INT, state, "BROK: %01d ", n);
+		if (hcint.b.nak) {
+			st->fsm = FIQ_PER_SPLIT_DONE;
+			start_next_periodic = 1;
+		} else if (hcint.b.xfercomp) {
+			fiq_increment_dma_buf(state, num_channels, n);
+			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
+				st->fsm = FIQ_PER_CSPLIT_POLL;
+				handled = 1;
+				restart = 1;
+				start_next_periodic = 1;
+				/* Reload HCTSIZ for the next transfer */
+				fiq_fsm_reload_hctsiz(state, n);
+				if (!last_csplit)
+					start_next_periodic = 0;
+			} else {
+				st->fsm = FIQ_PER_SPLIT_DONE;
+			}
+		} else if (hcint.b.nyet) {
+			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
+			start_next_periodic = 1;
+		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
+			/* Local 3-strikes retry is handled by the core. This is a ERR response.*/
+			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+		}
+		break;
+
+	case FIQ_PER_CSPLIT_POLL:
+		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+		start_next_periodic = 1;
+		if (hcint.b.nak) {
+			st->fsm = FIQ_PER_SPLIT_DONE;
+		} else if (hcint.b.xfercomp) {
+			fiq_increment_dma_buf(state, num_channels, n);
+			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
+				handled = 1;
+				restart = 1;
+				/* Reload HCTSIZ for the next transfer */
+				fiq_fsm_reload_hctsiz(state, n);
+				if (!last_csplit)
+					start_next_periodic = 0;
+			} else {
+				st->fsm = FIQ_PER_SPLIT_DONE;
+			}
+		} else if (hcint.b.nyet) {
+			/* Are we a NYET after the first data packet? */
+			if (st->nrpackets == 0) {
+				st->fsm = FIQ_PER_CSPLIT_NYET1;
+				handled = 1;
+				restart = 1;
+			} else {
+				/* We got a NYET when polling CSPLITs. Can happen
+				 * if our heuristic fails, or if someone disables us
+				 * for any significant length of time.
+				 */
+				if (st->nr_errors >= 3) {
+					st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
+				} else {
+					st->fsm = FIQ_PER_SPLIT_DONE;
+				}
+			}
+		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
+			/* For xacterr, Local 3-strikes retry is handled by the core. This is a ERR response.*/
+			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+		}
+		break;
+
+	case FIQ_HS_ISOC_TURBO:
+		if (fiq_fsm_update_hs_isoc(state, n, hcint)) {
+			/* more transactions to come */
+			handled = 1;
+			fiq_print(FIQDBG_INT, state, "HSISO M ");
+			/* For strided transfers, put ourselves to sleep */
+			if (st->hs_isoc_info.stride > 1) {
+				st->uframe_sleeps = st->hs_isoc_info.stride - 1;
+				st->fsm = FIQ_HS_ISOC_SLEEPING;
+			} else {
+				restart = 1;
+			}
+		} else {
+			st->fsm = FIQ_HS_ISOC_DONE;
+			fiq_print(FIQDBG_INT, state, "HSISO F ");
+		}
+		break;
+
+	case FIQ_HS_ISOC_ABORTED:
+		/* This abort is called by the driver rewriting the state mid-transaction
+		 * which allows the dequeue mechanism to work more effectively.
+		 */
+		break;
+
+	case FIQ_PER_ISO_OUT_ACTIVE:
+		if (hcint.b.ack) {
+			if(fiq_iso_out_advance(state, num_channels, n)) {
+				/* last OUT transfer */
+				st->fsm = FIQ_PER_ISO_OUT_LAST;
+				/*
+				 * Assuming the periodic FIFO in the dwc core
+				 * actually does its job properly, we can queue
+				 * the next ssplit now and in theory, the wire
+				 * transactions will be in-order.
+				 */
+				// No it doesn't. It appears to process requests in host channel order.
+				//start_next_periodic = 1;
+			}
+			handled = 1;
+			restart = 1;
+		} else {
+			/*
+			 * Isochronous transactions carry on regardless. Log the error
+			 * and continue.
+			 */
+			//explode += 1;
+			st->nr_errors++;
+			if(fiq_iso_out_advance(state, num_channels, n)) {
+				st->fsm = FIQ_PER_ISO_OUT_LAST;
+				//start_next_periodic = 1;
+			}
+			handled = 1;
+			restart = 1;
+		}
+		break;
+
+	case FIQ_PER_ISO_OUT_LAST:
+		if (hcint.b.ack) {
+			/* All done here */
+			st->fsm = FIQ_PER_ISO_OUT_DONE;
+		} else {
+			st->fsm = FIQ_PER_ISO_OUT_DONE;
+			st->nr_errors++;
+		}
+		start_next_periodic = 1;
+		break;
+
+	case FIQ_PER_SPLIT_TIMEOUT:
+		/* SOF kicked us because we overran. */
+		start_next_periodic = 1;
+		break;
+
+	default:
+		break;
+	}
+
+	if (handled) {
+		FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT, hcint.d32);
+	} else {
+		/* Copy the regs into the state so the IRQ knows what to do */
+		st->hcint_copy.d32 = hcint.d32;
+	}
+
+	if (restart) {
+		/* Restart always implies handled. */
+		if (restart == 2) {
+			/* For complete-split INs, the show must go on.
+			 * Force a channel restart */
+			fiq_fsm_restart_channel(state, n, 1);
+		} else {
+			fiq_fsm_restart_channel(state, n, 0);
+		}
+	}
+	if (start_next_periodic) {
+		fiq_fsm_start_next_periodic(state, num_channels);
+	}
+	if (st->fsm != FIQ_PASSTHROUGH)
+		fiq_print(FIQDBG_INT, state, "FSMOUT%02d", st->fsm);
+
+	return handled;
+}
+
+
+/**
+ * dwc_otg_fiq_fsm() - Flying State Machine (monster) FIQ
+ * @state:		pointer to state struct passed from the banked FIQ mode registers.
+ * @num_channels:	set according to the DWC hardware configuration
+ * @dma:		pointer to DMA bounce buffers for split transaction slots
+ *
+ * The FSM FIQ performs the low-level tasks that normally would be performed by the microcode
+ * inside an EHCI or similar host controller regarding split transactions. The DWC core
+ * interrupts each and every time a split transaction packet is received or sent successfully.
+ * This results in either an interrupt storm when everything is working "properly", or
+ * the interrupt latency of the system in general breaks time-sensitive periodic split
+ * transactions. Pushing the low-level, but relatively easy state machine work into the FIQ
+ * solves these problems.
+ *
+ * Return: void
+ */
+void notrace dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels)
+{
+	gintsts_data_t gintsts, gintsts_handled;
+	gintmsk_data_t gintmsk;
+	//hfnum_data_t hfnum;
+	haint_data_t haint, haint_handled;
+	haintmsk_data_t haintmsk;
+	int kick_irq = 0;
+
+	gintsts_handled.d32 = 0;
+	haint_handled.d32 = 0;
+
+	fiq_fsm_spin_lock(&state->lock);
+	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
+	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
+	gintsts.d32 &= gintmsk.d32;
+
+	if (gintsts.b.sofintr) {
+		/* For FSM mode, SOF is required to keep the state machine advance for
+		 * certain stages of the periodic pipeline. It's death to mask this
+		 * interrupt in that case.
+		 */
+
+		if (!fiq_fsm_do_sof(state, num_channels)) {
+			/* Kick IRQ once. Queue advancement means that all pending transactions
+			 * will get serviced when the IRQ finally executes.
+			 */
+			if (state->gintmsk_saved.b.sofintr == 1)
+				kick_irq |= 1;
+			state->gintmsk_saved.b.sofintr = 0;
+		}
+		gintsts_handled.b.sofintr = 1;
+	}
+
+	if (gintsts.b.hcintr) {
+		int i;
+		haint.d32 = FIQ_READ(state->dwc_regs_base + HAINT);
+		haintmsk.d32 = FIQ_READ(state->dwc_regs_base + HAINTMSK);
+		haint.d32 &= haintmsk.d32;
+		haint_handled.d32 = 0;
+		for (i=0; i<num_channels; i++) {
+			if (haint.b2.chint & (1 << i)) {
+				if(!fiq_fsm_do_hcintr(state, num_channels, i)) {
+					/* HCINT was not handled in FIQ
+					 * HAINT is level-sensitive, leading to level-sensitive ginststs.b.hcint bit.
+					 * Mask HAINT(i) but keep top-level hcint unmasked.
+					 */
+					state->haintmsk_saved.b2.chint &= ~(1 << i);
+				} else {
+					/* do_hcintr cleaned up after itself, but clear haint */
+					haint_handled.b2.chint |= (1 << i);
+				}
+			}
+		}
+
+		if (haint_handled.b2.chint) {
+			FIQ_WRITE(state->dwc_regs_base + HAINT, haint_handled.d32);
+		}
+
+		if (haintmsk.d32 != (haintmsk.d32 & state->haintmsk_saved.d32)) {
+			/*
+			 * This is necessary to avoid multiple retriggers of the MPHI in the case
+			 * where interrupts are held off and HCINTs start to pile up.
+			 * Only wake up the IRQ if a new interrupt came in, was not handled and was
+			 * masked.
+			 */
+			haintmsk.d32 &= state->haintmsk_saved.d32;
+			FIQ_WRITE(state->dwc_regs_base + HAINTMSK, haintmsk.d32);
+			kick_irq |= 1;
+		}
+		/* Top-Level interrupt - always handled because it's level-sensitive */
+		gintsts_handled.b.hcintr = 1;
+	}
+
+
+	/* Clear the bits in the saved register that were not handled but were triggered. */
+	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
+
+	/* FIQ didn't handle something - mask has changed - write new mask */
+	if (gintmsk.d32 != (gintmsk.d32 & state->gintmsk_saved.d32)) {
+		gintmsk.d32 &= state->gintmsk_saved.d32;
+		gintmsk.b.sofintr = 1;
+		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
+//		fiq_print(FIQDBG_INT, state, "KICKGINT");
+//		fiq_print(FIQDBG_INT, state, "%08x", gintmsk.d32);
+//		fiq_print(FIQDBG_INT, state, "%08x", state->gintmsk_saved.d32);
+		kick_irq |= 1;
+	}
+
+	if (gintsts_handled.d32) {
+		/* Only applies to edge-sensitive bits in GINTSTS */
+		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
+	}
+
+	/* We got an interrupt, didn't handle it. */
+	if (kick_irq) {
+		state->mphi_int_count++;
+		FIQ_WRITE(state->mphi_regs.outdda, (int) state->dummy_send);
+		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+
+	}
+	state->fiq_done++;
+	mb();
+	fiq_fsm_spin_unlock(&state->lock);
+}
+
+
+/**
+ * dwc_otg_fiq_nop() - FIQ "lite"
+ * @state:	pointer to state struct passed from the banked FIQ mode registers.
+ *
+ * The "nop" handler does not intervene on any interrupts other than SOF.
+ * It is limited in scope to deciding at each SOF if the IRQ SOF handler (which deals
+ * with non-periodic/periodic queues) needs to be kicked.
+ *
+ * This is done to hold off the SOF interrupt, which occurs at a rate of 8000 per second.
+ *
+ * Return: void
+ */
+void notrace dwc_otg_fiq_nop(struct fiq_state *state)
+{
+	gintsts_data_t gintsts, gintsts_handled;
+	gintmsk_data_t gintmsk;
+	hfnum_data_t hfnum;
+
+	fiq_fsm_spin_lock(&state->lock);
+	hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
+	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
+	gintsts.d32 &= gintmsk.d32;
+	gintsts_handled.d32 = 0;
+
+	if (gintsts.b.sofintr) {
+		if (!state->kick_np_queues &&
+				dwc_frame_num_gt(state->next_sched_frame, hfnum.b.frnum)) {
+			/* SOF handled, no work to do, just ACK interrupt */
+			gintsts_handled.b.sofintr = 1;
+		} else {
+			/* Kick IRQ */
+			state->gintmsk_saved.b.sofintr = 0;
+		}
+	}
+
+	/* Reset handled interrupts */
+	if(gintsts_handled.d32) {
+		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
+	}
+
+	/* Clear the bits in the saved register that were not handled but were triggered. */
+	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
+
+	/* We got an interrupt, didn't handle it and want to mask it */
+	if (~(state->gintmsk_saved.d32)) {
+		state->mphi_int_count++;
+		gintmsk.d32 &= state->gintmsk_saved.d32;
+		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
+		/* Force a clear before another dummy send */
+		FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
+		FIQ_WRITE(state->mphi_regs.outdda, (int) state->dummy_send);
+		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+
+	}
+	state->fiq_done++;
+	mb();
+	fiq_fsm_spin_unlock(&state->lock);
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
new file mode 100644
index 0000000000000..e9cd3ea562baa
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
@@ -0,0 +1,372 @@
+/*
+ * dwc_otg_fiq_fsm.h - Finite state machine FIQ header definitions
+ *
+ * Copyright (c) 2013 Raspberry Pi Foundation
+ *
+ * Author: Jonathan Bell <jonathan@raspberrypi.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *	* Redistributions of source code must retain the above copyright
+ *	  notice, this list of conditions and the following disclaimer.
+ *	* Redistributions in binary form must reproduce the above copyright
+ *	  notice, this list of conditions and the following disclaimer in the
+ *	  documentation and/or other materials provided with the distribution.
+ *	* Neither the name of Raspberry Pi nor the
+ *	  names of its contributors may be used to endorse or promote products
+ *	  derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * This FIQ implements functionality that performs split transactions on
+ * the dwc_otg hardware without any outside intervention. A split transaction
+ * is "queued" by nominating a specific host channel to perform the entirety
+ * of a split transaction. This FIQ will then perform the microframe-precise
+ * scheduling required in each phase of the transaction until completion.
+ *
+ * The FIQ functionality has been surgically implanted into the Synopsys
+ * vendor-provided driver.
+ *
+ */
+
+#ifndef DWC_OTG_FIQ_FSM_H_
+#define DWC_OTG_FIQ_FSM_H_
+
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_hcd.h"
+#include <linux/kernel.h>
+#include <linux/irqflags.h>
+#include <linux/string.h>
+#include <asm/barrier.h>
+
+#if 0
+#define FLAME_ON(x)					\
+do {							\
+	int gpioreg;                                    \
+							\
+	gpioreg = readl(__io_address(0x20200000+0x8));	\
+	gpioreg &= ~(7 << (x-20)*3);			\
+	gpioreg |= 0x1 << (x-20)*3;			\
+	writel(gpioreg, __io_address(0x20200000+0x8));	\
+							\
+	writel(1<<x, __io_address(0x20200000+(0x1C)));	\
+} while (0)
+
+#define FLAME_OFF(x)					\
+do {							\
+	writel(1<<x, __io_address(0x20200000+(0x28)));	\
+} while (0)
+#else
+#define FLAME_ON(x) do { } while (0)
+#define FLAME_OFF(X) do { } while (0)
+#endif
+
+/* This is a quick-and-dirty arch-specific register read/write. We know that
+ * writes to a peripheral on BCM2835 will always arrive in-order, also that
+ * reads and writes are executed in-order therefore the need for memory barriers
+ * is obviated if we're only talking to USB.
+ */
+#define FIQ_WRITE(_addr_,_data_) (*(volatile unsigned int *) (_addr_) = (_data_))
+#define FIQ_READ(_addr_) (*(volatile unsigned int *) (_addr_))
+
+/* FIQ-ified register definitions. Offsets are from dwc_regs_base. */
+#define GINTSTS		0x014
+#define GINTMSK		0x018
+/* Debug register. Poll the top of the received packets FIFO. */
+#define GRXSTSR		0x01C
+#define HFNUM		0x408
+#define HAINT		0x414
+#define HAINTMSK	0x418
+#define HPRT0		0x440
+
+/* HC_regs start from an offset of 0x500 */
+#define HC_START	0x500
+#define HC_OFFSET	0x020
+
+#define HC_DMA		0x14
+
+#define HCCHAR		0x00
+#define HCSPLT		0x04
+#define HCINT		0x08
+#define HCINTMSK	0x0C
+#define HCTSIZ		0x10
+
+#define ISOC_XACTPOS_ALL 	0b11
+#define ISOC_XACTPOS_BEGIN	0b10
+#define ISOC_XACTPOS_MID	0b00
+#define ISOC_XACTPOS_END	0b01
+
+#define DWC_PID_DATA2	0b01
+#define DWC_PID_MDATA	0b11
+#define DWC_PID_DATA1	0b10
+#define DWC_PID_DATA0	0b00
+
+typedef struct {
+	volatile void* base;
+	volatile void* ctrl;
+	volatile void* outdda;
+	volatile void* outddb;
+	volatile void* intstat;
+} mphi_regs_t;
+
+enum fiq_debug_level {
+	FIQDBG_SCHED = (1 << 0),
+	FIQDBG_INT   = (1 << 1),
+	FIQDBG_ERR   = (1 << 2),
+	FIQDBG_PORTHUB = (1 << 3),
+};
+
+typedef struct {
+	union {
+		uint32_t slock;
+		struct _tickets {
+			uint16_t owner;
+			uint16_t next;
+		} tickets;
+	};
+} fiq_lock_t;
+
+struct fiq_state;
+
+extern void _fiq_print (enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...);
+#if 0
+#define fiq_print _fiq_print
+#else
+#define fiq_print(x, y, ...)
+#endif
+
+extern bool fiq_enable, fiq_fsm_enable;
+extern ushort nak_holdoff;
+
+/**
+ * enum fiq_fsm_state - The FIQ FSM states.
+ *
+ * This is the "core" of the FIQ FSM. Broadly, the FSM states follow the
+ * USB2.0 specification for host responses to various transaction states.
+ * There are modifications to this host state machine because of a variety of
+ * quirks and limitations in the dwc_otg hardware.
+ *
+ * The fsm state is also used to communicate back to the driver on completion of
+ * a split transaction. The end states are used in conjunction with the interrupts
+ * raised by the final transaction.
+ */
+enum fiq_fsm_state {
+	/* FIQ isn't enabled for this host channel */
+	FIQ_PASSTHROUGH = 0,
+	/* For the first interrupt received for this channel,
+	 * the FIQ has to ack any interrupts indicating success. */
+	FIQ_PASSTHROUGH_ERRORSTATE = 31,
+	/* Nonperiodic state groups */
+	FIQ_NP_SSPLIT_STARTED = 1,
+	FIQ_NP_SSPLIT_RETRY = 2,
+	/* TT contention - working around hub bugs */
+	FIQ_NP_SSPLIT_PENDING = 33,
+	FIQ_NP_OUT_CSPLIT_RETRY = 3,
+	FIQ_NP_IN_CSPLIT_RETRY = 4,
+	FIQ_NP_SPLIT_DONE = 5,
+	FIQ_NP_SPLIT_LS_ABORTED = 6,
+	/* This differentiates a HS transaction error from a LS one
+	 * (handling the hub state is different) */
+	FIQ_NP_SPLIT_HS_ABORTED = 7,
+
+	/* Periodic state groups */
+	/* Periodic transactions are either started directly by the IRQ handler
+	 * or deferred if the TT is already in use.
+	 */
+	FIQ_PER_SSPLIT_QUEUED = 8,
+	FIQ_PER_SSPLIT_STARTED = 9,
+	FIQ_PER_SSPLIT_LAST = 10,
+
+
+	FIQ_PER_ISO_OUT_PENDING = 11,
+	FIQ_PER_ISO_OUT_ACTIVE = 12,
+	FIQ_PER_ISO_OUT_LAST = 13,
+	FIQ_PER_ISO_OUT_DONE = 27,
+
+	FIQ_PER_CSPLIT_WAIT = 14,
+	FIQ_PER_CSPLIT_NYET1 = 15,
+	FIQ_PER_CSPLIT_BROKEN_NYET1 = 28,
+	FIQ_PER_CSPLIT_NYET_FAFF = 29,
+	/* For multiple CSPLITs (large isoc IN, or delayed interrupt) */
+	FIQ_PER_CSPLIT_POLL = 16,
+	/* The last CSPLIT for a transaction has been issued, differentiates
+	 * for the state machine to queue the next packet.
+	 */
+	FIQ_PER_CSPLIT_LAST = 17,
+
+	FIQ_PER_SPLIT_DONE = 18,
+	FIQ_PER_SPLIT_LS_ABORTED = 19,
+	FIQ_PER_SPLIT_HS_ABORTED = 20,
+	FIQ_PER_SPLIT_NYET_ABORTED = 21,
+	/* Frame rollover has occurred without the transaction finishing. */
+	FIQ_PER_SPLIT_TIMEOUT = 22,
+
+	/* FIQ-accelerated HS Isochronous state groups */
+	FIQ_HS_ISOC_TURBO = 23,
+	/* For interval > 1, SOF wakes up the isochronous FSM */
+	FIQ_HS_ISOC_SLEEPING = 24,
+	FIQ_HS_ISOC_DONE = 25,
+	FIQ_HS_ISOC_ABORTED = 26,
+	FIQ_DEQUEUE_ISSUED = 30,
+	FIQ_TEST = 32,
+};
+
+struct fiq_stack {
+	int magic1;
+	uint8_t stack[2048];
+	int magic2;
+};
+
+
+/**
+ * struct fiq_dma_info - DMA bounce buffer utilisation information (per-channel)
+ * @index:	Number of slots reported used for IN transactions / number of slots
+ *			transmitted for an OUT transaction
+ * @slot_len[6]: Number of actual transfer bytes in each slot (255 if unused)
+ *
+ * Split transaction transfers can have variable length depending on other bus
+ * traffic. The OTG core DMA engine requires 4-byte aligned addresses therefore
+ * each transaction needs a guaranteed aligned address. A maximum of 6 split transfers
+ * can happen per-frame.
+ */
+struct fiq_dma_info {
+	u8 index;
+	u8 slot_len[6];
+};
+
+struct __attribute__((packed)) fiq_split_dma_slot {
+	u8 buf[188];
+};
+
+struct fiq_dma_channel {
+	struct __attribute__((packed)) fiq_split_dma_slot index[6];
+};
+
+struct fiq_dma_blob {
+	struct __attribute__((packed)) fiq_dma_channel channel[0];
+};
+
+/**
+ * struct fiq_hs_isoc_info - USB2.0 isochronous data
+ * @iso_frame:	Pointer to the array of OTG URB iso_frame_descs.
+ * @nrframes:	Total length of iso_frame_desc array
+ * @index:	Current index (FIQ-maintained)
+ * @stride:	Interval in uframes between HS isoc transactions
+ */
+struct fiq_hs_isoc_info {
+	struct dwc_otg_hcd_iso_packet_desc *iso_desc;
+	unsigned int nrframes;
+	unsigned int index;
+	unsigned int stride;
+};
+
+/**
+ * struct fiq_channel_state - FIQ state machine storage
+ * @fsm:	Current state of the channel as understood by the FIQ
+ * @nr_errors:	Number of transaction errors on this split-transaction
+ * @hub_addr:   SSPLIT/CSPLIT destination hub
+ * @port_addr:  SSPLIT/CSPLIT destination port - always 1 if single TT hub
+ * @nrpackets:  For isoc OUT, the number of split-OUT packets to transmit. For
+ * 		split-IN, number of CSPLIT data packets that were received.
+ * @hcchar_copy:
+ * @hcsplt_copy:
+ * @hcintmsk_copy:
+ * @hctsiz_copy:	Copies of the host channel registers.
+ * 			For use as scratch, or for returning state.
+ *
+ * The fiq_channel_state is state storage between interrupts for a host channel. The
+ * FSM state is stored here. Members of this structure must only be set up by the
+ * driver prior to enabling the FIQ for this host channel, and not touched until the FIQ
+ * has updated the state to either a COMPLETE state group or ABORT state group.
+ */
+
+struct fiq_channel_state {
+	enum fiq_fsm_state fsm;
+	unsigned int nr_errors;
+	unsigned int hub_addr;
+	unsigned int port_addr;
+	/* Hardware bug workaround: sometimes channel halt interrupts are
+	 * delayed until the next SOF. Keep track of when we expected to get interrupted. */
+	unsigned int expected_uframe;
+	/* number of uframes remaining (for interval > 1 HS isoc transfers) before next transfer */
+	unsigned int uframe_sleeps;
+	/* in/out for communicating number of dma buffers used, or number of ISOC to do */
+	unsigned int nrpackets;
+	struct fiq_dma_info dma_info;
+	struct fiq_hs_isoc_info hs_isoc_info;
+	/* Copies of HC registers - in/out communication from/to IRQ handler
+	 * and for ease of channel setup. A bit of mungeing is performed - for
+	 * example the hctsiz.b.maxp is _always_ the max packet size of the endpoint.
+	 */
+	hcchar_data_t hcchar_copy;
+	hcsplt_data_t hcsplt_copy;
+	hcint_data_t hcint_copy;
+	hcintmsk_data_t hcintmsk_copy;
+	hctsiz_data_t hctsiz_copy;
+	hcdma_data_t hcdma_copy;
+};
+
+/**
+ * struct fiq_state - top-level FIQ state machine storage
+ * @mphi_regs:		virtual address of the MPHI peripheral register file
+ * @dwc_regs_base:	virtual address of the base of the DWC core register file
+ * @dma_base:		physical address for the base of the DMA bounce buffers
+ * @dummy_send:		Scratch area for sending a fake message to the MPHI peripheral
+ * @gintmsk_saved:	Top-level mask of interrupts that the FIQ has not handled.
+ * 			Used for determining which interrupts fired to set off the IRQ handler.
+ * @haintmsk_saved:	Mask of interrupts from host channels that the FIQ did not handle internally.
+ * @np_count:		Non-periodic transactions in the active queue
+ * @np_sent:		Count of non-periodic transactions that have completed
+ * @next_sched_frame:	For periodic transactions handled by the driver's SOF-driven queuing mechanism,
+ * 			this is the next frame on which a SOF interrupt is required. Used to hold off
+ * 			passing SOF through to the driver until necessary.
+ * @channel[n]:		Per-channel FIQ state. Allocated during init depending on the number of host
+ * 			channels configured into the core logic.
+ *
+ * This is passed as the first argument to the dwc_otg_fiq_fsm top-level FIQ handler from the asm stub.
+ * It contains top-level state information.
+ */
+struct fiq_state {
+	fiq_lock_t lock;
+	mphi_regs_t mphi_regs;
+	void *dwc_regs_base;
+	dma_addr_t dma_base;
+	struct fiq_dma_blob *fiq_dmab;
+	void *dummy_send;
+	gintmsk_data_t gintmsk_saved;
+	haintmsk_data_t haintmsk_saved;
+	int mphi_int_count;
+	unsigned int fiq_done;
+	unsigned int kick_np_queues;
+	unsigned int next_sched_frame;
+#ifdef FIQ_DEBUG
+	char * buffer;
+	unsigned int bufsiz;
+#endif
+	struct fiq_channel_state channel[0];
+};
+
+extern void fiq_fsm_spin_lock(fiq_lock_t *lock);
+
+extern void fiq_fsm_spin_unlock(fiq_lock_t *lock);
+
+extern int fiq_fsm_too_late(struct fiq_state *st, int n);
+
+extern int fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n);
+
+extern void dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels);
+
+extern void dwc_otg_fiq_nop(struct fiq_state *state);
+
+#endif /* DWC_OTG_FIQ_FSM_H_ */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S b/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
new file mode 100644
index 0000000000000..ffa8d21bc61e8
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
@@ -0,0 +1,80 @@
+/*
+ * dwc_otg_fiq_fsm.S - assembly stub for the FSM FIQ
+ *
+ * Copyright (c) 2013 Raspberry Pi Foundation
+ *
+ * Author: Jonathan Bell <jonathan@raspberrypi.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *	* Redistributions of source code must retain the above copyright
+ *	  notice, this list of conditions and the following disclaimer.
+ *	* Redistributions in binary form must reproduce the above copyright
+ *	  notice, this list of conditions and the following disclaimer in the
+ *	  documentation and/or other materials provided with the distribution.
+ *	* Neither the name of Raspberry Pi nor the
+ *	  names of its contributors may be used to endorse or promote products
+ *	  derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include <asm/assembler.h>
+#include <linux/linkage.h>
+
+
+.text
+
+.global _dwc_otg_fiq_stub_end;
+
+/**
+  * _dwc_otg_fiq_stub() - entry copied to the FIQ vector page to allow
+  * a C-style function call with arguments from the FIQ banked registers.
+  * r0 = &hcd->fiq_state
+  * r1 = &hcd->num_channels
+  * r2 = &hcd->dma_buffers
+  * Tramples: r0, r1, r2, r4, fp, ip
+  */
+
+ENTRY(_dwc_otg_fiq_stub)
+	/* Stash unbanked regs - SP will have been set up for us */
+	mov ip, sp;
+	stmdb sp!, {r0-r12, lr};
+#ifdef FIQ_DEBUG
+	// Cycle profiling - read cycle counter at start
+	mrc p15, 0, r5, c15, c12, 1;
+#endif
+	/* r11 = fp, don't trample it */
+	mov r4, fp;
+	/* set EABI frame size */
+	sub fp, ip, #512;
+
+	/* for fiq NOP mode - just need state */
+	mov r0, r8;
+	/* r9 = num_channels */
+	mov r1, r9;
+	/* r10 = struct *dma_bufs */
+//	mov r2, r10;
+
+	/* r4 = &fiq_c_function */
+	blx r4;
+#ifdef FIQ_DEBUG
+	mrc p15, 0, r4, c15, c12, 1;
+	subs r5, r5, r4;
+	// r5 is now the cycle count time for executing the FIQ. Store it somewhere?
+#endif
+	ldmia sp!, {r0-r12, lr};
+	subs pc, lr, #4;
+_dwc_otg_fiq_stub_end:
+END(_dwc_otg_fiq_stub)
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
new file mode 100644
index 0000000000000..4ceefdded6068
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -0,0 +1,4297 @@
+
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.c $
+ * $Revision: #104 $
+ * $Date: 2011/10/24 $
+ * $Change: 1871159 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/** @file
+ * This file implements HCD Core. All code in this file is portable and doesn't
+ * use any OS specific functions.
+ * Interface provided by HCD Core is defined in <code><hcd_if.h></code>
+ * header file.
+ */
+
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_fiq_fsm.h"
+
+extern bool microframe_schedule;
+extern uint16_t fiq_fsm_mask, nak_holdoff;
+
+//#define DEBUG_HOST_CHANNELS
+#ifdef DEBUG_HOST_CHANNELS
+static int last_sel_trans_num_per_scheduled = 0;
+static int last_sel_trans_num_nonper_scheduled = 0;
+static int last_sel_trans_num_avail_hc_at_start = 0;
+static int last_sel_trans_num_avail_hc_at_end = 0;
+#endif /* DEBUG_HOST_CHANNELS */
+
+
+dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void)
+{
+	return DWC_ALLOC(sizeof(dwc_otg_hcd_t));
+}
+
+/**
+ * Connection timeout function.  An OTG host is required to display a
+ * message if the device does not connect within 10 seconds.
+ */
+void dwc_otg_hcd_connect_timeout(void *ptr)
+{
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, ptr);
+	DWC_PRINTF("Connect Timeout\n");
+	__DWC_ERROR("Device Not Connected/Responding\n");
+}
+
+#if defined(DEBUG)
+static void dump_channel_info(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	if (qh->channel != NULL) {
+		dwc_hc_t *hc = qh->channel;
+		dwc_list_link_t *item;
+		dwc_otg_qh_t *qh_item;
+		int num_channels = hcd->core_if->core_params->host_channels;
+		int i;
+
+		dwc_otg_hc_regs_t *hc_regs;
+		hcchar_data_t hcchar;
+		hcsplt_data_t hcsplt;
+		hctsiz_data_t hctsiz;
+		uint32_t hcdma;
+
+		hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		hcdma = DWC_READ_REG32(&hc_regs->hcdma);
+
+		DWC_PRINTF("  Assigned to channel %p:\n", hc);
+		DWC_PRINTF("    hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32,
+			   hcsplt.d32);
+		DWC_PRINTF("    hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32,
+			   hcdma);
+		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
+			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
+		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
+		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
+		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
+		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
+		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
+		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
+		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
+		DWC_PRINTF("    qh: %p\n", hc->qh);
+		DWC_PRINTF("  NP inactive sched:\n");
+		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_inactive) {
+			qh_item =
+			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
+			DWC_PRINTF("    %p\n", qh_item);
+		}
+		DWC_PRINTF("  NP active sched:\n");
+		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_active) {
+			qh_item =
+			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
+			DWC_PRINTF("    %p\n", qh_item);
+		}
+		DWC_PRINTF("  Channels: \n");
+		for (i = 0; i < num_channels; i++) {
+			dwc_hc_t *hc = hcd->hc_ptr_array[i];
+			DWC_PRINTF("    %2d: %p\n", i, hc);
+		}
+	}
+}
+#else
+#define dump_channel_info(hcd, qh)
+#endif /* DEBUG */
+
+/**
+ * Work queue function for starting the HCD when A-Cable is connected.
+ * The hcd_start() must be called in a process context.
+ */
+static void hcd_start_func(void *_vp)
+{
+	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) _vp;
+
+	DWC_DEBUGPL(DBG_HCDV, "%s() %p\n", __func__, hcd);
+	if (hcd) {
+		hcd->fops->start(hcd);
+	}
+}
+
+static void del_xfer_timers(dwc_otg_hcd_t * hcd)
+{
+#ifdef DEBUG
+	int i;
+	int num_channels = hcd->core_if->core_params->host_channels;
+	for (i = 0; i < num_channels; i++) {
+		DWC_TIMER_CANCEL(hcd->core_if->hc_xfer_timer[i]);
+	}
+#endif
+}
+
+static void del_timers(dwc_otg_hcd_t * hcd)
+{
+	del_xfer_timers(hcd);
+	DWC_TIMER_CANCEL(hcd->conn_timer);
+}
+
+/**
+ * Processes all the URBs in a single list of QHs. Completes them with
+ * -ESHUTDOWN and frees the QTD.
+ */
+static void kill_urbs_in_qh_list(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
+{
+	dwc_list_link_t *qh_item, *qh_tmp;
+	dwc_otg_qh_t *qh;
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+
+	DWC_LIST_FOREACH_SAFE(qh_item, qh_tmp, qh_list) {
+		qh = DWC_LIST_ENTRY(qh_item, dwc_otg_qh_t, qh_list_entry);
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp,
+					 &qh->qtd_list, qtd_list_entry) {
+			qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+			if (qtd->urb != NULL) {
+				hcd->fops->complete(hcd, qtd->urb->priv,
+						    qtd->urb, -DWC_E_SHUTDOWN);
+				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+			}
+
+		}
+		if(qh->channel) {
+			int n = qh->channel->hc_num;
+			/* Using hcchar.chen == 1 is not a reliable test.
+			 * It is possible that the channel has already halted
+			 * but not yet been through the IRQ handler.
+			 */
+			if (fiq_fsm_enable && (hcd->fiq_state->channel[qh->channel->hc_num].fsm != FIQ_PASSTHROUGH)) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
+				qh->channel->halt_pending = 1;
+				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
+					hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
+					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				dwc_otg_hc_halt(hcd->core_if, qh->channel,
+						DWC_OTG_HC_XFER_URB_DEQUEUE);
+			}
+			qh->channel = NULL;
+		}
+		dwc_otg_hcd_qh_remove(hcd, qh);
+	}
+}
+
+/**
+ * Responds with an error status of ESHUTDOWN to all URBs in the non-periodic
+ * and periodic schedules. The QTD associated with each URB is removed from
+ * the schedule and freed. This function may be called when a disconnect is
+ * detected or when the HCD is being stopped.
+ */
+static void kill_all_urbs(dwc_otg_hcd_t * hcd)
+{
+	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_inactive);
+	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_active);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_inactive);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_ready);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_assigned);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_queued);
+}
+
+/**
+ * Start the connection timer.  An OTG host is required to display a
+ * message if the device does not connect within 10 seconds.  The
+ * timer is deleted if a port connect interrupt occurs before the
+ * timer expires.
+ */
+static void dwc_otg_hcd_start_connect_timer(dwc_otg_hcd_t * hcd)
+{
+	DWC_TIMER_SCHEDULE(hcd->conn_timer, 10000 /* 10 secs */ );
+}
+
+/**
+ * HCD Callback function for disconnect of the HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_session_start_cb(void *p)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd;
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
+	dwc_otg_hcd = p;
+	dwc_otg_hcd_start_connect_timer(dwc_otg_hcd);
+	return 1;
+}
+
+/**
+ * HCD Callback function for starting the HCD when A-Cable is
+ * connected.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_start_cb(void *p)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = p;
+	dwc_otg_core_if_t *core_if;
+	hprt0_data_t hprt0;
+
+	core_if = dwc_otg_hcd->core_if;
+
+	if (core_if->op_state == B_HOST) {
+		/*
+		 * Reset the port.  During a HNP mode switch the reset
+		 * needs to occur within 1ms and have a duration of at
+		 * least 50ms.
+		 */
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		hprt0.b.prtrst = 1;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	}
+	DWC_WORKQ_SCHEDULE_DELAYED(core_if->wq_otg,
+				   hcd_start_func, dwc_otg_hcd, 50,
+				   "start hcd");
+
+	return 1;
+}
+
+/**
+ * HCD Callback function for disconnect of the HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_disconnect_cb(void *p)
+{
+	gintsts_data_t intr;
+	dwc_otg_hcd_t *dwc_otg_hcd = p;
+
+	DWC_SPINLOCK(dwc_otg_hcd->lock);
+	/*
+	 * Set status flags for the hub driver.
+	 */
+	dwc_otg_hcd->flags.b.port_connect_status_change = 1;
+	dwc_otg_hcd->flags.b.port_connect_status = 0;
+	if(fiq_enable) {
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+	}
+	/*
+	 * Shutdown any transfers in process by clearing the Tx FIFO Empty
+	 * interrupt mask and status bits and disabling subsequent host
+	 * channel interrupts.
+	 */
+	intr.d32 = 0;
+	intr.b.nptxfempty = 1;
+	intr.b.ptxfempty = 1;
+	intr.b.hcintr = 1;
+	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk,
+			 intr.d32, 0);
+	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintsts,
+			 intr.d32, 0);
+
+	del_timers(dwc_otg_hcd);
+
+	/*
+	 * Turn off the vbus power only if the core has transitioned to device
+	 * mode. If still in host mode, need to keep power on to detect a
+	 * reconnection.
+	 */
+	if (dwc_otg_is_device_mode(dwc_otg_hcd->core_if)) {
+		if (dwc_otg_hcd->core_if->op_state != A_SUSPEND) {
+			hprt0_data_t hprt0 = {.d32 = 0 };
+			DWC_PRINTF("Disconnect: PortPower off\n");
+			hprt0.b.prtpwr = 0;
+			DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0,
+					hprt0.d32);
+		}
+
+		dwc_otg_disable_host_interrupts(dwc_otg_hcd->core_if);
+	}
+
+	/* Respond with an error status to all URBs in the schedule. */
+	kill_all_urbs(dwc_otg_hcd);
+
+	if (dwc_otg_is_host_mode(dwc_otg_hcd->core_if)) {
+		/* Clean up any host channels that were in use. */
+		int num_channels;
+		int i;
+		dwc_hc_t *channel;
+		dwc_otg_hc_regs_t *hc_regs;
+		hcchar_data_t hcchar;
+
+		num_channels = dwc_otg_hcd->core_if->core_params->host_channels;
+
+		if (!dwc_otg_hcd->core_if->dma_enable) {
+			/* Flush out any channel requests in slave mode. */
+			for (i = 0; i < num_channels; i++) {
+				channel = dwc_otg_hcd->hc_ptr_array[i];
+				if (DWC_CIRCLEQ_EMPTY_ENTRY
+				    (channel, hc_list_entry)) {
+					hc_regs =
+					    dwc_otg_hcd->core_if->
+					    host_if->hc_regs[i];
+					hcchar.d32 =
+					    DWC_READ_REG32(&hc_regs->hcchar);
+					if (hcchar.b.chen) {
+						hcchar.b.chen = 0;
+						hcchar.b.chdis = 1;
+						hcchar.b.epdir = 0;
+						DWC_WRITE_REG32
+						    (&hc_regs->hcchar,
+						     hcchar.d32);
+					}
+				}
+			}
+		}
+
+		if(fiq_fsm_enable) {
+			for(i=0; i < 128; i++) {
+				dwc_otg_hcd->hub_port[i] = 0;
+			}
+		}
+	}
+
+	if(fiq_enable) {
+		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+		local_fiq_enable();
+	}
+
+	if (dwc_otg_hcd->fops->disconnect) {
+		dwc_otg_hcd->fops->disconnect(dwc_otg_hcd);
+	}
+
+	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
+	return 1;
+}
+
+/**
+ * HCD Callback function for stopping the HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_stop_cb(void *p)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = p;
+
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
+	dwc_otg_hcd_stop(dwc_otg_hcd);
+	return 1;
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * HCD Callback function for sleep of HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int dwc_otg_hcd_sleep_cb(void *p)
+{
+	dwc_otg_hcd_t *hcd = p;
+
+	dwc_otg_hcd_free_hc_from_lpm(hcd);
+
+	return 0;
+}
+#endif
+
+
+/**
+ * HCD Callback function for Remote Wakeup.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int dwc_otg_hcd_rem_wakeup_cb(void *p)
+{
+	dwc_otg_hcd_t *hcd = p;
+
+	if (hcd->core_if->lx_state == DWC_OTG_L2) {
+		hcd->flags.b.port_suspend_change = 1;
+	}
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	else {
+		hcd->flags.b.port_l1_change = 1;
+	}
+#endif
+	return 0;
+}
+
+/**
+ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
+ * stopped.
+ */
+void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd)
+{
+	hprt0_data_t hprt0 = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD STOP\n");
+
+	/*
+	 * The root hub should be disconnected before this function is called.
+	 * The disconnect will clear the QTD lists (via ..._hcd_urb_dequeue)
+	 * and the QH lists (via ..._hcd_endpoint_disable).
+	 */
+
+	/* Turn off all host-specific interrupts. */
+	dwc_otg_disable_host_interrupts(hcd->core_if);
+
+	/* Turn off the vbus power */
+	DWC_PRINTF("PortPower off\n");
+	hprt0.b.prtpwr = 0;
+	DWC_WRITE_REG32(hcd->core_if->host_if->hprt0, hprt0.d32);
+	dwc_mdelay(1);
+}
+
+int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * hcd,
+			    dwc_otg_hcd_urb_t * dwc_otg_urb, void **ep_handle,
+			    int atomic_alloc)
+{
+	int retval = 0;
+	uint8_t needs_scheduling = 0;
+	dwc_otg_transaction_type_e tr_type;
+	dwc_otg_qtd_t *qtd;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	hprt0_data_t hprt0 = { .d32 = 0 };
+
+#ifdef DEBUG /* integrity checks (Broadcom) */
+	if (NULL == hcd->core_if) {
+		DWC_ERROR("**** DWC OTG HCD URB Enqueue - HCD has NULL core_if\n");
+		/* No longer connected. */
+		return -DWC_E_INVALID;
+	}
+#endif
+	if (!hcd->flags.b.port_connect_status) {
+		/* No longer connected. */
+		DWC_ERROR("Not connected\n");
+		return -DWC_E_NO_DEVICE;
+	}
+
+	/* Some core configurations cannot support LS traffic on a FS root port */
+	if ((hcd->fops->speed(hcd, dwc_otg_urb->priv) == USB_SPEED_LOW) &&
+		(hcd->core_if->hwcfg2.b.fs_phy_type == 1) &&
+		(hcd->core_if->hwcfg2.b.hs_phy_type == 1)) {
+			hprt0.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
+			if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_FULL_SPEED) {
+				return -DWC_E_NO_DEVICE;
+			}
+	}
+
+	qtd = dwc_otg_hcd_qtd_create(dwc_otg_urb, atomic_alloc);
+	if (qtd == NULL) {
+		DWC_ERROR("DWC OTG HCD URB Enqueue failed creating QTD\n");
+		return -DWC_E_NO_MEMORY;
+	}
+#ifdef DEBUG /* integrity checks (Broadcom) */
+	if (qtd->urb == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD with no URBs\n");
+		return -DWC_E_NO_MEMORY;
+	}
+	if (qtd->urb->priv == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD URB with no URB handle\n");
+		return -DWC_E_NO_MEMORY;
+	}
+#endif
+	intr_mask.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->gintmsk);
+	if(!intr_mask.b.sofintr || fiq_enable) needs_scheduling = 1;
+	if((((dwc_otg_qh_t *)ep_handle)->ep_type == UE_BULK) && !(qtd->urb->flags & URB_GIVEBACK_ASAP))
+		/* Do not schedule SG transactions until qtd has URB_GIVEBACK_ASAP set */
+		needs_scheduling = 0;
+
+	retval = dwc_otg_hcd_qtd_add(qtd, hcd, (dwc_otg_qh_t **) ep_handle, atomic_alloc);
+            // creates a new queue in ep_handle if it doesn't exist already
+	if (retval < 0) {
+		DWC_ERROR("DWC OTG HCD URB Enqueue failed adding QTD. "
+			  "Error status %d\n", retval);
+		dwc_otg_hcd_qtd_free(qtd);
+		return retval;
+	}
+
+	if(needs_scheduling) {
+		tr_type = dwc_otg_hcd_select_transactions(hcd);
+		if (tr_type != DWC_OTG_TRANSACTION_NONE) {
+			dwc_otg_hcd_queue_transactions(hcd, tr_type);
+		}
+	}
+	return retval;
+}
+
+int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * hcd,
+			    dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	dwc_otg_qh_t *qh;
+	dwc_otg_qtd_t *urb_qtd;
+	BUG_ON(!hcd);
+	BUG_ON(!dwc_otg_urb);
+
+#ifdef DEBUG /* integrity checks (Broadcom) */
+
+	if (hcd == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL HCD\n");
+		return -DWC_E_INVALID;
+	}
+	if (dwc_otg_urb == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL URB\n");
+		return -DWC_E_INVALID;
+	}
+	if (dwc_otg_urb->qtd == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue with NULL QTD\n");
+		return -DWC_E_INVALID;
+	}
+	urb_qtd = dwc_otg_urb->qtd;
+	BUG_ON(!urb_qtd);
+	if (urb_qtd->qh == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue with QTD with NULL Q handler\n");
+		return -DWC_E_INVALID;
+	}
+#else
+	urb_qtd = dwc_otg_urb->qtd;
+	BUG_ON(!urb_qtd);
+#endif
+	qh = urb_qtd->qh;
+	BUG_ON(!qh);
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		if (urb_qtd->in_process) {
+			dump_channel_info(hcd, qh);
+		}
+	}
+#ifdef DEBUG /* integrity checks (Broadcom) */
+	if (hcd->core_if == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue HCD has NULL core_if\n");
+		return -DWC_E_INVALID;
+	}
+#endif
+	if (urb_qtd->in_process && qh->channel) {
+		/* The QTD is in process (it has been assigned to a channel). */
+		if (hcd->flags.b.port_connect_status) {
+			int n = qh->channel->hc_num;
+			/*
+			 * If still connected (i.e. in host mode), halt the
+			 * channel so it can be used for other transfers. If
+			 * no longer connected, the host registers can't be
+			 * written to halt the channel since the core is in
+			 * device mode.
+			 */
+			/* In FIQ FSM mode, we need to shut down carefully.
+			 * The FIQ may attempt to restart a disabled channel */
+			if (fiq_fsm_enable && (hcd->fiq_state->channel[n].fsm != FIQ_PASSTHROUGH)) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
+				qh->channel->halt_pending = 1;
+				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
+					hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
+					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				dwc_otg_hc_halt(hcd->core_if, qh->channel,
+						DWC_OTG_HC_XFER_URB_DEQUEUE);
+			}
+		}
+	}
+
+	/*
+	 * Free the QTD and clean up the associated QH. Leave the QH in the
+	 * schedule if it has any remaining QTDs.
+	 */
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue - "
+                    "delete %sQueue handler\n",
+                    hcd->core_if->dma_desc_enable?"DMA ":"");
+	if (!hcd->core_if->dma_desc_enable) {
+		uint8_t b = urb_qtd->in_process;
+		if (nak_holdoff && qh->do_split && dwc_qh_is_non_per(qh))
+			qh->nak_frame = 0xFFFF;
+		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
+		if (b) {
+			dwc_otg_hcd_qh_deactivate(hcd, qh, 0);
+			qh->channel = NULL;
+		} else if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			dwc_otg_hcd_qh_remove(hcd, qh);
+		}
+	} else {
+		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
+	}
+	return 0;
+}
+
+int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
+				 int retry)
+{
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	int retval = 0;
+	dwc_irqflags_t flags;
+
+	if (retry < 0) {
+		retval = -DWC_E_INVALID;
+		goto done;
+	}
+
+	if (!qh) {
+		retval = -DWC_E_INVALID;
+		goto done;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+
+	while (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list) && retry) {
+		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+		retry--;
+		dwc_msleep(5);
+		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	}
+
+	dwc_otg_hcd_qh_remove(hcd, qh);
+
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	/*
+	 * Split dwc_otg_hcd_qh_remove_and_free() into qh_remove
+	 * and qh_free to prevent stack dump on DWC_DMA_FREE() with
+	 * irq_disabled (spinlock_irqsave) in dwc_otg_hcd_desc_list_free()
+	 * and dwc_otg_hcd_frame_list_alloc().
+	 */
+	dwc_otg_hcd_qh_free(hcd, qh);
+
+done:
+	return retval;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	int retval = 0;
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	if (!qh)
+		return -DWC_E_INVALID;
+
+	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+	return retval;
+}
+#endif
+
+/**
+ * HCD Callback structure for handling mode switching.
+ */
+static dwc_otg_cil_callbacks_t hcd_cil_callbacks = {
+	.start = dwc_otg_hcd_start_cb,
+	.stop = dwc_otg_hcd_stop_cb,
+	.disconnect = dwc_otg_hcd_disconnect_cb,
+	.session_start = dwc_otg_hcd_session_start_cb,
+	.resume_wakeup = dwc_otg_hcd_rem_wakeup_cb,
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	.sleep = dwc_otg_hcd_sleep_cb,
+#endif
+	.p = 0,
+};
+
+/**
+ * Reset tasklet function
+ */
+static void reset_tasklet_func(void *data)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *) data;
+	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
+	hprt0_data_t hprt0;
+
+	DWC_DEBUGPL(DBG_HCDV, "USB RESET tasklet called\n");
+
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtrst = 1;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	dwc_mdelay(60);
+
+	hprt0.b.prtrst = 0;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	dwc_otg_hcd->flags.b.port_reset_change = 1;
+}
+
+static void completion_tasklet_func(void *ptr)
+{
+	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) ptr;
+	struct urb *urb;
+	urb_tq_entry_t *item;
+	dwc_irqflags_t flags;
+
+	/* This could just be spin_lock_irq */
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	while (!DWC_TAILQ_EMPTY(&hcd->completed_urb_list)) {
+		item = DWC_TAILQ_FIRST(&hcd->completed_urb_list);
+		urb = item->urb;
+		DWC_TAILQ_REMOVE(&hcd->completed_urb_list, item,
+				urb_tq_entries);
+		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+		DWC_FREE(item);
+
+		usb_hcd_giveback_urb(hcd->priv, urb, urb->status);
+
+
+		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	return;
+}
+
+static void qh_list_free(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
+{
+	dwc_list_link_t *item;
+	dwc_otg_qh_t *qh;
+	dwc_irqflags_t flags;
+
+	if (!qh_list->next) {
+		/* The list hasn't been initialized yet. */
+		return;
+	}
+	/*
+	 * Hold spinlock here. Not needed in that case if bellow
+	 * function is being called from ISR
+	 */
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	/* Ensure there are no QTDs or URBs left. */
+	kill_urbs_in_qh_list(hcd, qh_list);
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+
+	DWC_LIST_FOREACH(item, qh_list) {
+		qh = DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
+		dwc_otg_hcd_qh_remove_and_free(hcd, qh);
+	}
+}
+
+/**
+ * Exit from Hibernation if Host did not detect SRP from connected SRP capable
+ * Device during SRP time by host power up.
+ */
+void dwc_otg_hcd_power_up(void *ptr)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return;
+	}
+
+	/* Switch on the voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset the core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Remove reset the core signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	core_if->hibernation_suspend = 0;
+
+	/* Disable PMU */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Enable VBUS */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.dis_vbus = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	core_if->op_state = A_HOST;
+	dwc_otg_core_init(core_if);
+	dwc_otg_enable_global_interrupts(core_if);
+	cil_hcd_start(core_if);
+}
+
+void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num)
+{
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
+	struct fiq_dma_blob *blob = hcd->fiq_dmab;
+	int i;
+
+	st->fsm = FIQ_PASSTHROUGH;
+	st->hcchar_copy.d32 = 0;
+	st->hcsplt_copy.d32 = 0;
+	st->hcint_copy.d32 = 0;
+	st->hcintmsk_copy.d32 = 0;
+	st->hctsiz_copy.d32 = 0;
+	st->hcdma_copy.d32 = 0;
+	st->nr_errors = 0;
+	st->hub_addr = 0;
+	st->port_addr = 0;
+	st->expected_uframe = 0;
+	st->nrpackets = 0;
+	st->dma_info.index = 0;
+	for (i = 0; i < 6; i++)
+		st->dma_info.slot_len[i] = 255;
+	st->hs_isoc_info.index = 0;
+	st->hs_isoc_info.iso_desc = NULL;
+	st->hs_isoc_info.nrframes = 0;
+
+	DWC_MEMSET(&blob->channel[num].index[0], 0x6b, 1128);
+}
+
+/**
+ * Frees secondary storage associated with the dwc_otg_hcd structure contained
+ * in the struct usb_hcd field.
+ */
+static void dwc_otg_hcd_free(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(dwc_otg_hcd);
+	int i;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD FREE\n");
+
+	del_timers(dwc_otg_hcd);
+
+	/* Free memory for QH/QTD lists */
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_inactive);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_active);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_inactive);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_ready);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_assigned);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_queued);
+
+	/* Free memory for the host channels. */
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		dwc_hc_t *hc = dwc_otg_hcd->hc_ptr_array[i];
+
+#ifdef DEBUG
+		if (dwc_otg_hcd->core_if->hc_xfer_timer[i]) {
+			DWC_TIMER_FREE(dwc_otg_hcd->core_if->hc_xfer_timer[i]);
+		}
+#endif
+		if (hc != NULL) {
+			DWC_DEBUGPL(DBG_HCDV, "HCD Free channel #%i, hc=%p\n",
+				    i, hc);
+			DWC_FREE(hc);
+		}
+	}
+
+	if (dwc_otg_hcd->core_if->dma_enable) {
+		if (dwc_otg_hcd->status_buf_dma) {
+			DWC_DMA_FREE(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
+				     dwc_otg_hcd->status_buf,
+				     dwc_otg_hcd->status_buf_dma);
+		}
+	} else if (dwc_otg_hcd->status_buf != NULL) {
+		DWC_FREE(dwc_otg_hcd->status_buf);
+	}
+	DWC_SPINLOCK_FREE(dwc_otg_hcd->lock);
+	/* Set core_if's lock pointer to NULL */
+	dwc_otg_hcd->core_if->lock = NULL;
+
+	DWC_TIMER_FREE(dwc_otg_hcd->conn_timer);
+	DWC_TASK_FREE(dwc_otg_hcd->reset_tasklet);
+	DWC_TASK_FREE(dwc_otg_hcd->completion_tasklet);
+	DWC_FREE(dwc_otg_hcd->fiq_state);
+
+#ifdef DWC_DEV_SRPCAP
+	if (dwc_otg_hcd->core_if->power_down == 2 &&
+	    dwc_otg_hcd->core_if->pwron_timer) {
+		DWC_TIMER_FREE(dwc_otg_hcd->core_if->pwron_timer);
+	}
+#endif
+	DWC_FREE(dwc_otg_hcd);
+}
+
+int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+	int retval = 0;
+	int num_channels;
+	int i;
+	dwc_hc_t *channel;
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(hcd->lock);
+#else
+	hcd->lock = DWC_SPINLOCK_ALLOC();
+#endif
+        DWC_DEBUGPL(DBG_HCDV, "init of HCD %p given core_if %p\n",
+                    hcd, core_if);
+	if (!hcd->lock) {
+		DWC_ERROR("Could not allocate lock for pcd");
+		DWC_FREE(hcd);
+		retval = -DWC_E_NO_MEMORY;
+		goto out;
+	}
+	hcd->core_if = core_if;
+
+	/* Register the HCD CIL Callbacks */
+	dwc_otg_cil_register_hcd_callbacks(hcd->core_if,
+					   &hcd_cil_callbacks, hcd);
+
+	/* Initialize the non-periodic schedule. */
+	DWC_LIST_INIT(&hcd->non_periodic_sched_inactive);
+	DWC_LIST_INIT(&hcd->non_periodic_sched_active);
+
+	/* Initialize the periodic schedule. */
+	DWC_LIST_INIT(&hcd->periodic_sched_inactive);
+	DWC_LIST_INIT(&hcd->periodic_sched_ready);
+	DWC_LIST_INIT(&hcd->periodic_sched_assigned);
+	DWC_LIST_INIT(&hcd->periodic_sched_queued);
+	DWC_TAILQ_INIT(&hcd->completed_urb_list);
+	/*
+	 * Create a host channel descriptor for each host channel implemented
+	 * in the controller. Initialize the channel descriptor array.
+	 */
+	DWC_CIRCLEQ_INIT(&hcd->free_hc_list);
+	num_channels = hcd->core_if->core_params->host_channels;
+	DWC_MEMSET(hcd->hc_ptr_array, 0, sizeof(hcd->hc_ptr_array));
+	for (i = 0; i < num_channels; i++) {
+		channel = DWC_ALLOC(sizeof(dwc_hc_t));
+		if (channel == NULL) {
+			retval = -DWC_E_NO_MEMORY;
+			DWC_ERROR("%s: host channel allocation failed\n",
+				  __func__);
+			dwc_otg_hcd_free(hcd);
+			goto out;
+		}
+		channel->hc_num = i;
+		hcd->hc_ptr_array[i] = channel;
+#ifdef DEBUG
+		hcd->core_if->hc_xfer_timer[i] =
+		    DWC_TIMER_ALLOC("hc timer", hc_xfer_timeout,
+				    &hcd->core_if->hc_xfer_info[i]);
+#endif
+		DWC_DEBUGPL(DBG_HCDV, "HCD Added channel #%d, hc=%p\n", i,
+			    channel);
+	}
+
+	if (fiq_enable) {
+		hcd->fiq_state = DWC_ALLOC(sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels));
+		if (!hcd->fiq_state) {
+			retval = -DWC_E_NO_MEMORY;
+			DWC_ERROR("%s: cannot allocate fiq_state structure\n", __func__);
+			dwc_otg_hcd_free(hcd);
+			goto out;
+		}
+		DWC_MEMSET(hcd->fiq_state, 0, (sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels)));
+
+		for (i = 0; i < num_channels; i++) {
+			hcd->fiq_state->channel[i].fsm = FIQ_PASSTHROUGH;
+		}
+		hcd->fiq_state->dummy_send = DWC_ALLOC_ATOMIC(16);
+
+		hcd->fiq_stack = DWC_ALLOC(sizeof(struct fiq_stack));
+		if (!hcd->fiq_stack) {
+			retval = -DWC_E_NO_MEMORY;
+			DWC_ERROR("%s: cannot allocate fiq_stack structure\n", __func__);
+			dwc_otg_hcd_free(hcd);
+			goto out;
+		}
+		hcd->fiq_stack->magic1 = 0xDEADBEEF;
+		hcd->fiq_stack->magic2 = 0xD00DFEED;
+		hcd->fiq_state->gintmsk_saved.d32 = ~0;
+		hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
+
+		/* This bit is terrible and uses no API, but necessary. The FIQ has no concept of DMA pools
+		 * (and if it did, would be a lot slower). This allocates a chunk of memory (~9kiB for 8 host channels)
+		 * for use as transaction bounce buffers in a 2-D array. Our access into this chunk is done by some
+		 * moderately readable array casts.
+		 */
+		hcd->fiq_dmab = DWC_DMA_ALLOC(dev, (sizeof(struct fiq_dma_channel) * num_channels), &hcd->fiq_state->dma_base);
+		DWC_WARN("FIQ DMA bounce buffers: virt = 0x%08x dma = 0x%08x len=%d",
+				(unsigned int)hcd->fiq_dmab, (unsigned int)hcd->fiq_state->dma_base,
+				sizeof(struct fiq_dma_channel) * num_channels);
+
+		DWC_MEMSET(hcd->fiq_dmab, 0x6b, 9024);
+
+		/* pointer for debug in fiq_print */
+		hcd->fiq_state->fiq_dmab = hcd->fiq_dmab;
+		if (fiq_fsm_enable) {
+			int i;
+			for (i=0; i < hcd->core_if->core_params->host_channels; i++) {
+				dwc_otg_cleanup_fiq_channel(hcd, i);
+			}
+			DWC_PRINTF("FIQ FSM acceleration enabled for :\n%s%s%s%s",
+				(fiq_fsm_mask & 0x1) ? "Non-periodic Split Transactions\n" : "",
+				(fiq_fsm_mask & 0x2) ? "Periodic Split Transactions\n" : "",
+				(fiq_fsm_mask & 0x4) ? "High-Speed Isochronous Endpoints\n" : "",
+				(fiq_fsm_mask & 0x8) ? "Interrupt/Control Split Transaction hack enabled\n" : "");
+		}
+	}
+
+	/* Initialize the Connection timeout timer. */
+	hcd->conn_timer = DWC_TIMER_ALLOC("Connection timer",
+					  dwc_otg_hcd_connect_timeout, 0);
+
+	printk(KERN_DEBUG "dwc_otg: Microframe scheduler %s\n", microframe_schedule ? "enabled":"disabled");
+	if (microframe_schedule)
+		init_hcd_usecs(hcd);
+
+	/* Initialize reset tasklet. */
+	hcd->reset_tasklet = DWC_TASK_ALLOC("reset_tasklet", reset_tasklet_func, hcd);
+
+	hcd->completion_tasklet = DWC_TASK_ALLOC("completion_tasklet",
+						completion_tasklet_func, hcd);
+#ifdef DWC_DEV_SRPCAP
+	if (hcd->core_if->power_down == 2) {
+		/* Initialize Power on timer for Host power up in case hibernation */
+		hcd->core_if->pwron_timer = DWC_TIMER_ALLOC("PWRON TIMER",
+									dwc_otg_hcd_power_up, core_if);
+	}
+#endif
+
+	/*
+	 * Allocate space for storing data on status transactions. Normally no
+	 * data is sent, but this space acts as a bit bucket. This must be
+	 * done after usb_add_hcd since that function allocates the DMA buffer
+	 * pool.
+	 */
+	if (hcd->core_if->dma_enable) {
+		hcd->status_buf =
+		    DWC_DMA_ALLOC(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
+				  &hcd->status_buf_dma);
+	} else {
+		hcd->status_buf = DWC_ALLOC(DWC_OTG_HCD_STATUS_BUF_SIZE);
+	}
+	if (!hcd->status_buf) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR("%s: status_buf allocation failed\n", __func__);
+		dwc_otg_hcd_free(hcd);
+		goto out;
+	}
+
+	hcd->otg_port = 1;
+	hcd->frame_list = NULL;
+	hcd->frame_list_dma = 0;
+	hcd->periodic_qh_count = 0;
+
+	DWC_MEMSET(hcd->hub_port, 0, sizeof(hcd->hub_port));
+#ifdef FIQ_DEBUG
+	DWC_MEMSET(hcd->hub_port_alloc, -1, sizeof(hcd->hub_port_alloc));
+#endif
+
+out:
+	return retval;
+}
+
+void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd)
+{
+	/* Turn off all host-specific interrupts. */
+	dwc_otg_disable_host_interrupts(hcd->core_if);
+
+	dwc_otg_hcd_free(hcd);
+}
+
+/**
+ * Initializes dynamic portions of the DWC_otg HCD state.
+ */
+static void dwc_otg_hcd_reinit(dwc_otg_hcd_t * hcd)
+{
+	int num_channels;
+	int i;
+	dwc_hc_t *channel;
+	dwc_hc_t *channel_tmp;
+
+	hcd->flags.d32 = 0;
+
+	hcd->non_periodic_qh_ptr = &hcd->non_periodic_sched_active;
+	if (!microframe_schedule) {
+		hcd->non_periodic_channels = 0;
+		hcd->periodic_channels = 0;
+	} else {
+		hcd->available_host_channels = hcd->core_if->core_params->host_channels;
+	}
+	/*
+	 * Put all channels in the free channel list and clean up channel
+	 * states.
+	 */
+	DWC_CIRCLEQ_FOREACH_SAFE(channel, channel_tmp,
+				 &hcd->free_hc_list, hc_list_entry) {
+		DWC_CIRCLEQ_REMOVE(&hcd->free_hc_list, channel, hc_list_entry);
+	}
+
+	num_channels = hcd->core_if->core_params->host_channels;
+	for (i = 0; i < num_channels; i++) {
+		channel = hcd->hc_ptr_array[i];
+		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, channel,
+					hc_list_entry);
+		dwc_otg_hc_cleanup(hcd->core_if, channel);
+	}
+
+	/* Initialize the DWC core for host mode operation. */
+	dwc_otg_core_host_init(hcd->core_if);
+
+	/* Set core_if's lock pointer to the hcd->lock */
+	hcd->core_if->lock = hcd->lock;
+}
+
+/**
+ * Assigns transactions from a QTD to a free host channel and initializes the
+ * host channel to perform the transactions. The host channel is removed from
+ * the free list.
+ *
+ * @param hcd The HCD state structure.
+ * @param qh Transactions from the first QTD for this QH are selected and
+ * assigned to a free host channel.
+ */
+static void assign_and_init_hc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	dwc_hc_t *hc;
+	dwc_otg_qtd_t *qtd;
+	dwc_otg_hcd_urb_t *urb;
+	void* ptr = NULL;
+	uint32_t intr_enable;
+	unsigned long flags;
+	gintmsk_data_t gintmsk = { .d32 = 0, };
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+
+	urb = qtd->urb;
+
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p,%p) - urb %x, actual_length %d\n", __func__, hcd, qh, (unsigned int)urb, urb->actual_length);
+
+	if (((urb->actual_length < 0) || (urb->actual_length > urb->length)) && !dwc_otg_hcd_is_pipe_in(&urb->pipe_info))
+		urb->actual_length = urb->length;
+
+
+	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
+
+	/* Remove the host channel from the free list. */
+	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
+
+	qh->channel = hc;
+
+	qtd->in_process = 1;
+
+	/*
+	 * Use usb_pipedevice to determine device address. This address is
+	 * 0 before the SET_ADDRESS command and the correct address afterward.
+	 */
+	hc->dev_addr = dwc_otg_hcd_get_dev_addr(&urb->pipe_info);
+	hc->ep_num = dwc_otg_hcd_get_ep_num(&urb->pipe_info);
+	hc->speed = qh->dev_speed;
+	hc->max_packet = dwc_max_packet(qh->maxp);
+
+	hc->xfer_started = 0;
+	hc->halt_status = DWC_OTG_HC_XFER_NO_HALT_STATUS;
+	hc->error_state = (qtd->error_count > 0);
+	hc->halt_on_queue = 0;
+	hc->halt_pending = 0;
+	hc->requests = 0;
+
+	/*
+	 * The following values may be modified in the transfer type section
+	 * below. The xfer_len value may be reduced when the transfer is
+	 * started to accommodate the max widths of the XferSize and PktCnt
+	 * fields in the HCTSIZn register.
+	 */
+
+	hc->ep_is_in = (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) != 0);
+	if (hc->ep_is_in) {
+		hc->do_ping = 0;
+	} else {
+		hc->do_ping = qh->ping_state;
+	}
+
+	hc->data_pid_start = qh->data_toggle;
+	hc->multi_count = 1;
+
+	if (hcd->core_if->dma_enable) {
+		hc->xfer_buff = (uint8_t *) urb->dma + urb->actual_length;
+
+		/* For non-dword aligned case */
+		if (((unsigned long)hc->xfer_buff & 0x3)
+		    && !hcd->core_if->dma_desc_enable) {
+			ptr = (uint8_t *) urb->buf + urb->actual_length;
+		}
+	} else {
+		hc->xfer_buff = (uint8_t *) urb->buf + urb->actual_length;
+	}
+	hc->xfer_len = urb->length - urb->actual_length;
+	hc->xfer_count = 0;
+
+	/*
+	 * Set the split attributes
+	 */
+	hc->do_split = 0;
+	if (qh->do_split) {
+		uint32_t hub_addr, port_addr;
+		hc->do_split = 1;
+		hc->start_pkt_count = 1;
+		hc->xact_pos = qtd->isoc_split_pos;
+		/* We don't need to do complete splits anymore */
+//		if(fiq_fsm_enable)
+		if (0)
+			hc->complete_split = qtd->complete_split = 0;
+		else
+			hc->complete_split = qtd->complete_split;
+
+		hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &port_addr);
+		hc->hub_addr = (uint8_t) hub_addr;
+		hc->port_addr = (uint8_t) port_addr;
+	}
+
+	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
+	case UE_CONTROL:
+		hc->ep_type = DWC_OTG_EP_TYPE_CONTROL;
+		switch (qtd->control_phase) {
+		case DWC_OTG_CONTROL_SETUP:
+			DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction\n");
+			hc->do_ping = 0;
+			hc->ep_is_in = 0;
+			hc->data_pid_start = DWC_OTG_HC_PID_SETUP;
+			if (hcd->core_if->dma_enable) {
+				hc->xfer_buff = (uint8_t *) urb->setup_dma;
+			} else {
+				hc->xfer_buff = (uint8_t *) urb->setup_packet;
+			}
+			hc->xfer_len = 8;
+			ptr = NULL;
+			break;
+		case DWC_OTG_CONTROL_DATA:
+			DWC_DEBUGPL(DBG_HCDV, "  Control data transaction\n");
+			hc->data_pid_start = qtd->data_toggle;
+			break;
+		case DWC_OTG_CONTROL_STATUS:
+			/*
+			 * Direction is opposite of data direction or IN if no
+			 * data.
+			 */
+			DWC_DEBUGPL(DBG_HCDV, "  Control status transaction\n");
+			if (urb->length == 0) {
+				hc->ep_is_in = 1;
+			} else {
+				hc->ep_is_in =
+				    dwc_otg_hcd_is_pipe_out(&urb->pipe_info);
+			}
+			if (hc->ep_is_in) {
+				hc->do_ping = 0;
+			}
+
+			hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
+
+			hc->xfer_len = 0;
+			if (hcd->core_if->dma_enable) {
+				hc->xfer_buff = (uint8_t *) hcd->status_buf_dma;
+			} else {
+				hc->xfer_buff = (uint8_t *) hcd->status_buf;
+			}
+			ptr = NULL;
+			break;
+		}
+		break;
+	case UE_BULK:
+		hc->ep_type = DWC_OTG_EP_TYPE_BULK;
+		break;
+	case UE_INTERRUPT:
+		hc->ep_type = DWC_OTG_EP_TYPE_INTR;
+		break;
+	case UE_ISOCHRONOUS:
+		{
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+
+			hc->ep_type = DWC_OTG_EP_TYPE_ISOC;
+
+			if (hcd->core_if->dma_desc_enable)
+				break;
+
+			frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
+
+			frame_desc->status = 0;
+
+			if (hcd->core_if->dma_enable) {
+				hc->xfer_buff = (uint8_t *) urb->dma;
+			} else {
+				hc->xfer_buff = (uint8_t *) urb->buf;
+			}
+			hc->xfer_buff +=
+			    frame_desc->offset + qtd->isoc_split_offset;
+			hc->xfer_len =
+			    frame_desc->length - qtd->isoc_split_offset;
+
+			/* For non-dword aligned buffers */
+			if (((unsigned long)hc->xfer_buff & 0x3)
+			    && hcd->core_if->dma_enable) {
+				ptr =
+				    (uint8_t *) urb->buf + frame_desc->offset +
+				    qtd->isoc_split_offset;
+			} else
+				ptr = NULL;
+
+			if (hc->xact_pos == DWC_HCSPLIT_XACTPOS_ALL) {
+				if (hc->xfer_len <= 188) {
+					hc->xact_pos = DWC_HCSPLIT_XACTPOS_ALL;
+				} else {
+					hc->xact_pos =
+					    DWC_HCSPLIT_XACTPOS_BEGIN;
+				}
+			}
+		}
+		break;
+	}
+	/* non DWORD-aligned buffer case */
+	if (ptr) {
+		uint32_t buf_size;
+		if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
+			buf_size = hcd->core_if->core_params->max_transfer_size;
+		} else {
+			buf_size = 4096;
+		}
+		if (!qh->dw_align_buf) {
+			qh->dw_align_buf = DWC_DMA_ALLOC_ATOMIC(dev, buf_size,
+							 &qh->dw_align_buf_dma);
+			if (!qh->dw_align_buf) {
+				DWC_ERROR
+				    ("%s: Failed to allocate memory to handle "
+				     "non-dword aligned buffer case\n",
+				     __func__);
+				return;
+			}
+		}
+		if (!hc->ep_is_in) {
+			dwc_memcpy(qh->dw_align_buf, ptr, hc->xfer_len);
+		}
+		hc->align_buff = qh->dw_align_buf_dma;
+	} else {
+		hc->align_buff = 0;
+	}
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+		/*
+		 * This value may be modified when the transfer is started to
+		 * reflect the actual transfer length.
+		 */
+		hc->multi_count = dwc_hb_mult(qh->maxp);
+	}
+
+	if (hcd->core_if->dma_desc_enable)
+		hc->desc_list_addr = qh->desc_list_dma;
+
+	dwc_otg_hc_init(hcd->core_if, hc);
+
+	local_irq_save(flags);
+
+	if (fiq_enable) {
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+	}
+
+	/* Enable the top level host channel interrupt. */
+	intr_enable = (1 << hc->hc_num);
+	DWC_MODIFY_REG32(&hcd->core_if->host_if->host_global_regs->haintmsk, 0, intr_enable);
+
+	/* Make sure host channel interrupts are enabled. */
+	gintmsk.b.hcintr = 1;
+	DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
+
+	if (fiq_enable) {
+		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+		local_fiq_enable();
+	}
+
+	local_irq_restore(flags);
+	hc->qh = qh;
+}
+
+
+/**
+ * fiq_fsm_transaction_suitable() - Test a QH for compatibility with the FIQ
+ * @hcd:	Pointer to the dwc_otg_hcd struct
+ * @qh:	pointer to the endpoint's queue head
+ *
+ * Transaction start/end control flow is grafted onto the existing dwc_otg
+ * mechanisms, to avoid spaghettifying the functions more than they already are.
+ * This function's eligibility check is altered by debug parameter.
+ *
+ * Returns: 0 for unsuitable, 1 implies the FIQ can be enabled for this transaction.
+ */
+
+int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	if (qh->do_split) {
+		switch (qh->ep_type) {
+		case UE_CONTROL:
+		case UE_BULK:
+			if (fiq_fsm_mask & (1 << 0))
+				return 1;
+			break;
+		case UE_INTERRUPT:
+		case UE_ISOCHRONOUS:
+			if (fiq_fsm_mask & (1 << 1))
+				return 1;
+			break;
+		default:
+			break;
+		}
+	} else if (qh->ep_type == UE_ISOCHRONOUS) {
+		if (fiq_fsm_mask & (1 << 2)) {
+			/* ISOCH support. We test for compatibility:
+			 * - DWORD aligned buffers
+			 * - Must be at least 2 transfers (otherwise pointless to use the FIQ)
+			 * If yes, then the fsm enqueue function will handle the state machine setup.
+			 */
+			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+			dwc_otg_hcd_urb_t *urb = qtd->urb;
+			dwc_dma_t ptr;
+			int i;
+
+			if (urb->packet_count < 2)
+				return 0;
+			for (i = 0; i < urb->packet_count; i++) {
+				ptr = urb->dma + urb->iso_descs[i].offset;
+				if (ptr & 0x3)
+					return 0;
+			}
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/**
+ * fiq_fsm_setup_periodic_dma() - Set up DMA bounce buffers
+ * @hcd: Pointer to the dwc_otg_hcd struct
+ * @qh: Pointer to the endpoint's queue head
+ *
+ * Periodic split transactions are transmitted modulo 188 bytes.
+ * This necessitates slicing data up into buckets for isochronous out
+ * and fixing up the DMA address for all IN transfers.
+ *
+ * Returns 1 if the DMA bounce buffers have been used, 0 if the default
+ * HC buffer has been used.
+ */
+int fiq_fsm_setup_periodic_dma(dwc_otg_hcd_t *hcd, struct fiq_channel_state *st, dwc_otg_qh_t *qh)
+ {
+	int frame_length, i = 0;
+	uint8_t *ptr = NULL;
+	dwc_hc_t *hc = qh->channel;
+	struct fiq_dma_blob *blob;
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+
+	for (i = 0; i < 6; i++) {
+		st->dma_info.slot_len[i] = 255;
+	}
+	st->dma_info.index = 0;
+	i = 0;
+	if (hc->ep_is_in) {
+		/*
+		 * Set dma_regs to bounce buffer. FIQ will update the
+		 * state depending on transaction progress.
+		 */
+		blob = (struct fiq_dma_blob *) hcd->fiq_state->dma_base;
+		st->hcdma_copy.d32 = (uint32_t) &blob->channel[hc->hc_num].index[0].buf[0];
+		/* Calculate the max number of CSPLITS such that the FIQ can time out
+		 * a transaction if it fails.
+		 */
+		frame_length = st->hcchar_copy.b.mps;
+		do {
+			i++;
+			frame_length -= 188;
+		} while (frame_length >= 0);
+		st->nrpackets = i;
+		return 1;
+	} else {
+		if (qh->ep_type == UE_ISOCHRONOUS) {
+
+			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+
+			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			frame_length = frame_desc->length;
+
+			/* Virtual address for bounce buffers */
+			blob = hcd->fiq_dmab;
+
+			ptr = qtd->urb->buf + frame_desc->offset;
+			if (frame_length == 0) {
+				/*
+				 * for isochronous transactions, we must still transmit a packet
+				 * even if the length is zero.
+				 */
+				st->dma_info.slot_len[0] = 0;
+				st->nrpackets = 1;
+			} else {
+				do {
+					if (frame_length <= 188) {
+						dwc_memcpy(&blob->channel[hc->hc_num].index[i].buf[0], ptr, frame_length);
+						st->dma_info.slot_len[i] = frame_length;
+						ptr += frame_length;
+					} else {
+						dwc_memcpy(&blob->channel[hc->hc_num].index[i].buf[0], ptr, 188);
+						st->dma_info.slot_len[i] = 188;
+						ptr += 188;
+					}
+					i++;
+					frame_length -= 188;
+				} while (frame_length > 0);
+				st->nrpackets = i;
+			}
+			ptr = qtd->urb->buf + frame_desc->offset;
+			/* Point the HC at the DMA address of the bounce buffers */
+			blob = (struct fiq_dma_blob *) hcd->fiq_state->dma_base;
+			st->hcdma_copy.d32 = (uint32_t) &blob->channel[hc->hc_num].index[0].buf[0];
+
+			/* fixup xfersize to the actual packet size */
+			st->hctsiz_copy.b.pid = 0;
+			st->hctsiz_copy.b.xfersize = st->dma_info.slot_len[0];
+			return 1;
+		} else {
+			/* For interrupt, single OUT packet required, goes in the SSPLIT from hc_buff. */
+			return 0;
+		}
+	}
+}
+
+/**
+ * fiq_fsm_np_tt_contended() - Avoid performing contended non-periodic transfers
+ * @hcd: Pointer to the dwc_otg_hcd struct
+ * @qh: Pointer to the endpoint's queue head
+ *
+ * Certain hub chips don't differentiate between IN and OUT non-periodic pipes
+ * with the same endpoint number. If transfers get completed out of order
+ * (disregarding the direction token) then the hub can lock up
+ * or return erroneous responses.
+ *
+ * Returns 1 if initiating the transfer would cause contention, 0 otherwise.
+ */
+int fiq_fsm_np_tt_contended(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	int i;
+	struct fiq_channel_state *st;
+	int dev_addr = qh->channel->dev_addr;
+	int ep_num = qh->channel->ep_num;
+	for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
+		if (i == qh->channel->hc_num)
+			continue;
+		st = &hcd->fiq_state->channel[i];
+		switch (st->fsm) {
+		case FIQ_NP_SSPLIT_STARTED:
+		case FIQ_NP_SSPLIT_RETRY:
+		case FIQ_NP_SSPLIT_PENDING:
+		case FIQ_NP_OUT_CSPLIT_RETRY:
+		case FIQ_NP_IN_CSPLIT_RETRY:
+			if (st->hcchar_copy.b.devaddr == dev_addr &&
+				st->hcchar_copy.b.epnum == ep_num)
+				return 1;
+			break;
+		default:
+			break;
+		}
+	}
+	return 0;
+}
+
+/*
+ * Pushing a periodic request into the queue near the EOF1 point
+ * in a microframe causes erroneous behaviour (frmovrun) interrupt.
+ * Usually, the request goes out on the bus causing a transfer but
+ * the core does not transfer the data to memory.
+ * This guard interval (in number of 60MHz clocks) is required which
+ * must cater for CPU latency between reading the value and enabling
+ * the channel.
+ */
+#define PERIODIC_FRREM_BACKOFF 1000
+
+int fiq_fsm_queue_isoc_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	dwc_hc_t *hc = qh->channel;
+	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
+	dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+	int frame;
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
+	int xfer_len, nrpackets;
+	hcdma_data_t hcdma;
+	hfnum_data_t hfnum;
+
+	if (st->fsm != FIQ_PASSTHROUGH)
+		return 0;
+
+	st->nr_errors = 0;
+
+	st->hcchar_copy.d32 = 0;
+	st->hcchar_copy.b.mps = hc->max_packet;
+	st->hcchar_copy.b.epdir = hc->ep_is_in;
+	st->hcchar_copy.b.devaddr = hc->dev_addr;
+	st->hcchar_copy.b.epnum = hc->ep_num;
+	st->hcchar_copy.b.eptype = hc->ep_type;
+
+	st->hcintmsk_copy.b.chhltd = 1;
+
+	frame = dwc_otg_hcd_get_frame_number(hcd);
+	st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
+
+	st->hcchar_copy.b.lspddev = 0;
+	/* Enable the channel later as a final register write. */
+
+	st->hcsplt_copy.d32 = 0;
+
+	st->hs_isoc_info.iso_desc = (struct dwc_otg_hcd_iso_packet_desc *) &qtd->urb->iso_descs;
+	st->hs_isoc_info.nrframes = qtd->urb->packet_count;
+	/* grab the next DMA address offset from the array */
+	st->hcdma_copy.d32 = qtd->urb->dma;
+	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[0].offset;
+
+	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
+	 * the core needs to be told to send the correct number. Caution: for IN transfers,
+	 * this is always set to the maximum size of the endpoint. */
+	xfer_len = st->hs_isoc_info.iso_desc[0].length;
+	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
+	if (nrpackets == 0)
+		nrpackets = 1;
+	st->hcchar_copy.b.multicnt = nrpackets;
+	st->hctsiz_copy.b.pktcnt = nrpackets;
+
+	/* Initial PID also needs to be set */
+	if (st->hcchar_copy.b.epdir == 0) {
+		st->hctsiz_copy.b.xfersize = xfer_len;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
+			break;
+		}
+
+	} else {
+		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
+			break;
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
+			break;
+		}
+	}
+
+	st->hs_isoc_info.stride = qh->interval;
+	st->uframe_sleeps = 0;
+
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ  %01d ", hc->hc_num);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcchar_copy.d32);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
+	hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
+	local_fiq_disable();
+	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
+	if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
+		/* Prevent queueing near EOF1. Bad things happen if a periodic
+		 * split transaction is queued very close to EOF. SOF interrupt handler
+		 * will wake this channel at the next interrupt.
+		 */
+		st->fsm = FIQ_HS_ISOC_SLEEPING;
+		st->uframe_sleeps = 1;
+	} else {
+		st->fsm = FIQ_HS_ISOC_TURBO;
+		st->hcchar_copy.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	}
+	mb();
+	st->hcchar_copy.b.chen = 0;
+	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+	local_fiq_enable();
+	return 0;
+}
+
+
+/**
+ * fiq_fsm_queue_split_transaction() - Set up a host channel and FIQ state
+ * @hcd: Pointer to the dwc_otg_hcd struct
+ * @qh: Pointer to the endpoint's queue head
+ *
+ * This overrides the dwc_otg driver's normal method of queueing a transaction.
+ * Called from dwc_otg_hcd_queue_transactions(), this performs specific setup
+ * for the nominated host channel.
+ *
+ * For periodic transfers, it also peeks at the FIQ state to see if an immediate
+ * start is possible. If not, then the FIQ is left to start the transfer.
+ */
+int fiq_fsm_queue_split_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	int start_immediate = 1, i;
+	hfnum_data_t hfnum;
+	dwc_hc_t *hc = qh->channel;
+	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
+	/* Program HC registers, setup FIQ_state, examine FIQ if periodic, start transfer (not if uframe 5) */
+	int hub_addr, port_addr, frame, uframe;
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
+
+	/*
+	 * Non-periodic channel assignments stay in the non_periodic_active queue.
+	 * Therefore we get repeatedly called until the FIQ's done processing this channel.
+	 */
+	if (qh->channel->xfer_started == 1)
+		return 0;
+
+	if (st->fsm != FIQ_PASSTHROUGH) {
+		pr_warn_ratelimited("%s:%d: Queue called for an active channel\n", __func__, __LINE__);
+		return 0;
+	}
+
+	qh->channel->xfer_started = 1;
+
+	st->nr_errors = 0;
+
+	st->hcchar_copy.d32 = 0;
+	st->hcchar_copy.b.mps = hc->max_packet;
+	st->hcchar_copy.b.epdir = hc->ep_is_in;
+	st->hcchar_copy.b.devaddr = hc->dev_addr;
+	st->hcchar_copy.b.epnum = hc->ep_num;
+	st->hcchar_copy.b.eptype = hc->ep_type;
+	if (hc->ep_type & 0x1) {
+		if (hc->ep_is_in)
+			st->hcchar_copy.b.multicnt = 3;
+		else
+			/* Docs say set this to 1, but driver sets to 0! */
+			st->hcchar_copy.b.multicnt = 0;
+	} else {
+		st->hcchar_copy.b.multicnt = 1;
+		st->hcchar_copy.b.oddfrm = 0;
+	}
+	st->hcchar_copy.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW) ? 1 : 0;
+	/* Enable the channel later as a final register write. */
+
+	st->hcsplt_copy.d32 = 0;
+	if(qh->do_split) {
+		hcd->fops->hub_info(hcd, DWC_CIRCLEQ_FIRST(&qh->qtd_list)->urb->priv, &hub_addr, &port_addr);
+		st->hcsplt_copy.b.compsplt = 0;
+		st->hcsplt_copy.b.spltena = 1;
+		// XACTPOS is for isoc-out only but needs initialising anyway.
+		st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_ALL;
+		if((qh->ep_type == DWC_OTG_EP_TYPE_ISOC) && (!qh->ep_is_in)) {
+			/* For packetsize 0 < L < 188, ISOC_XACTPOS_ALL.
+			 * for longer than this, ISOC_XACTPOS_BEGIN and the FIQ
+			 * will update as necessary.
+			 */
+			if (hc->xfer_len > 188) {
+				st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_BEGIN;
+			}
+		}
+		st->hcsplt_copy.b.hubaddr = (uint8_t) hub_addr;
+		st->hcsplt_copy.b.prtaddr = (uint8_t) port_addr;
+		st->hub_addr = hub_addr;
+		st->port_addr = port_addr;
+	}
+
+	st->hctsiz_copy.d32 = 0;
+	st->hctsiz_copy.b.dopng = 0;
+	st->hctsiz_copy.b.pid = hc->data_pid_start;
+
+	if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
+		hc->xfer_len = hc->max_packet;
+	} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
+		hc->xfer_len = 188;
+	}
+	st->hctsiz_copy.b.xfersize = hc->xfer_len;
+
+	st->hctsiz_copy.b.pktcnt = 1;
+
+	if (hc->ep_type & 0x1) {
+		/*
+		 * For potentially multi-packet transfers, must use the DMA bounce buffers. For IN transfers,
+		 * the DMA address is the address of the first 188byte slot buffer in the bounce buffer array.
+		 * For multi-packet OUT transfers, we need to copy the data into the bounce buffer array so the FIQ can punt
+		 * the right address out as necessary. hc->xfer_buff and hc->xfer_len have already been set
+		 * in assign_and_init_hc(), but this is for the eventual transaction completion only. The FIQ
+		 * must not touch internal driver state.
+		 */
+		if(!fiq_fsm_setup_periodic_dma(hcd, st, qh)) {
+			if (hc->align_buff) {
+				st->hcdma_copy.d32 = hc->align_buff;
+			} else {
+				st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
+			}
+		}
+	} else {
+		if (hc->align_buff) {
+			st->hcdma_copy.d32 = hc->align_buff;
+		} else {
+			st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
+		}
+	}
+	/* The FIQ depends upon no other interrupts being enabled except channel halt.
+	 * Fixup channel interrupt mask. */
+	st->hcintmsk_copy.d32 = 0;
+	st->hcintmsk_copy.b.chhltd = 1;
+	st->hcintmsk_copy.b.ahberr = 1;
+
+	/* Hack courtesy of FreeBSD: apparently forcing Interrupt Split transactions
+	 * as Control puts the transfer into the non-periodic request queue and the
+	 * non-periodic handler in the hub. Makes things lots easier.
+	 */
+	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT) {
+		st->hcchar_copy.b.multicnt = 0;
+		st->hcchar_copy.b.oddfrm = 0;
+		st->hcchar_copy.b.eptype = UE_CONTROL;
+		if (hc->align_buff) {
+			st->hcdma_copy.d32 = hc->align_buff;
+		} else {
+			st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
+		}
+	}
+	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
+
+	local_fiq_disable();
+	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+
+	if (hc->ep_type & 0x1) {
+		hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
+		frame = (hfnum.b.frnum & ~0x7) >> 3;
+		uframe = hfnum.b.frnum & 0x7;
+		if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
+			/* Prevent queueing near EOF1. Bad things happen if a periodic
+			 * split transaction is queued very close to EOF.
+			 */
+			start_immediate = 0;
+		} else if (uframe == 5) {
+			start_immediate = 0;
+		} else if (hc->ep_type == UE_ISOCHRONOUS && !hc->ep_is_in) {
+			start_immediate = 0;
+		} else if (hc->ep_is_in && fiq_fsm_too_late(hcd->fiq_state, hc->hc_num)) {
+			start_immediate = 0;
+		} else {
+			/* Search through all host channels to determine if a transaction
+			 * is currently in progress */
+			for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
+				if (i == hc->hc_num || hcd->fiq_state->channel[i].fsm == FIQ_PASSTHROUGH)
+					continue;
+				switch (hcd->fiq_state->channel[i].fsm) {
+				/* TT is reserved for channels that are in the middle of a periodic
+				 * split transaction.
+				 */
+				case FIQ_PER_SSPLIT_STARTED:
+				case FIQ_PER_CSPLIT_WAIT:
+				case FIQ_PER_CSPLIT_NYET1:
+				case FIQ_PER_CSPLIT_POLL:
+				case FIQ_PER_ISO_OUT_ACTIVE:
+				case FIQ_PER_ISO_OUT_LAST:
+					if (hcd->fiq_state->channel[i].hub_addr == hub_addr &&
+							hcd->fiq_state->channel[i].port_addr == port_addr) {
+						start_immediate = 0;
+					}
+					break;
+				default:
+					break;
+				}
+				if (!start_immediate)
+					break;
+			}
+		}
+	}
+	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT)
+		start_immediate = 1;
+
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ %01d %01d", hc->hc_num, start_immediate);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08d", hfnum.b.frrem);
+	//fiq_print(FIQDBG_INT, hcd->fiq_state, "H:%02dP:%02d", hub_addr, port_addr);
+	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
+	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
+	switch (hc->ep_type) {
+		case UE_CONTROL:
+		case UE_BULK:
+			if (fiq_fsm_np_tt_contended(hcd, qh)) {
+				st->fsm = FIQ_NP_SSPLIT_PENDING;
+				start_immediate = 0;
+			} else {
+				st->fsm = FIQ_NP_SSPLIT_STARTED;
+			}
+			break;
+		case UE_ISOCHRONOUS:
+			if (hc->ep_is_in) {
+				if (start_immediate) {
+					st->fsm = FIQ_PER_SSPLIT_STARTED;
+				} else {
+					st->fsm = FIQ_PER_SSPLIT_QUEUED;
+				}
+			} else {
+				if (start_immediate) {
+					/* Single-isoc OUT packets don't require FIQ involvement */
+					if (st->nrpackets == 1) {
+						st->fsm = FIQ_PER_ISO_OUT_LAST;
+					} else {
+						st->fsm = FIQ_PER_ISO_OUT_ACTIVE;
+					}
+				} else {
+					st->fsm = FIQ_PER_ISO_OUT_PENDING;
+				}
+			}
+			break;
+		case UE_INTERRUPT:
+			if (fiq_fsm_mask & 0x8) {
+				if (fiq_fsm_np_tt_contended(hcd, qh)) {
+					st->fsm = FIQ_NP_SSPLIT_PENDING;
+					start_immediate = 0;
+				} else {
+					st->fsm = FIQ_NP_SSPLIT_STARTED;
+				}
+			} else if (start_immediate) {
+					st->fsm = FIQ_PER_SSPLIT_STARTED;
+			} else {
+				st->fsm = FIQ_PER_SSPLIT_QUEUED;
+			}
+		default:
+			break;
+	}
+	if (start_immediate) {
+		/* Set the oddfrm bit as close as possible to actual queueing */
+		frame = dwc_otg_hcd_get_frame_number(hcd);
+		st->expected_uframe = (frame + 1) & 0x3FFF;
+		st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
+		st->hcchar_copy.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	}
+	mb();
+	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+	local_fiq_enable();
+	return 0;
+}
+
+
+/**
+ * This function selects transactions from the HCD transfer schedule and
+ * assigns them to available host channels. It is called from HCD interrupt
+ * handler functions.
+ *
+ * @param hcd The HCD state structure.
+ *
+ * @return The types of new transactions that were assigned to host channels.
+ */
+dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t * hcd)
+{
+	dwc_list_link_t *qh_ptr;
+	dwc_otg_qh_t *qh;
+	int num_channels;
+	dwc_otg_transaction_type_e ret_val = DWC_OTG_TRANSACTION_NONE;
+
+#ifdef DEBUG_HOST_CHANNELS
+	last_sel_trans_num_per_scheduled = 0;
+	last_sel_trans_num_nonper_scheduled = 0;
+	last_sel_trans_num_avail_hc_at_start = hcd->available_host_channels;
+#endif /* DEBUG_HOST_CHANNELS */
+
+	/* Process entries in the periodic ready list. */
+	qh_ptr = DWC_LIST_FIRST(&hcd->periodic_sched_ready);
+
+	while (qh_ptr != &hcd->periodic_sched_ready &&
+	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
+
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+
+		if (microframe_schedule) {
+			// Make sure we leave one channel for non periodic transactions.
+			if (hcd->available_host_channels <= 1) {
+				break;
+			}
+			hcd->available_host_channels--;
+#ifdef DEBUG_HOST_CHANNELS
+			last_sel_trans_num_per_scheduled++;
+#endif /* DEBUG_HOST_CHANNELS */
+		}
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+		assign_and_init_hc(hcd, qh);
+
+		/*
+		 * Move the QH from the periodic ready schedule to the
+		 * periodic assigned schedule.
+		 */
+		qh_ptr = DWC_LIST_NEXT(qh_ptr);
+		DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
+				   &qh->qh_list_entry);
+	}
+
+	/*
+	 * Process entries in the inactive portion of the non-periodic
+	 * schedule. Some free host channels may not be used if they are
+	 * reserved for periodic transfers.
+	 */
+	qh_ptr = hcd->non_periodic_sched_inactive.next;
+	num_channels = hcd->core_if->core_params->host_channels;
+	while (qh_ptr != &hcd->non_periodic_sched_inactive &&
+	       (microframe_schedule || hcd->non_periodic_channels <
+		num_channels - hcd->periodic_channels) &&
+	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
+
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+		/*
+		 * Check to see if this is a NAK'd retransmit, in which case ignore for retransmission
+		 * we hold off on bulk retransmissions to reduce NAK interrupt overhead for full-speed
+		 * cheeky devices that just hold off using NAKs
+		 */
+		if (fiq_enable && nak_holdoff && qh->do_split) {
+			if (qh->nak_frame != 0xffff) {
+				uint16_t next_frame = dwc_frame_num_inc(qh->nak_frame, (qh->ep_type == UE_BULK) ? nak_holdoff : 8);
+				uint16_t frame = dwc_otg_hcd_get_frame_number(hcd);
+				if (dwc_frame_num_le(frame, next_frame)) {
+					if(dwc_frame_num_le(next_frame, hcd->fiq_state->next_sched_frame)) {
+						hcd->fiq_state->next_sched_frame = next_frame;
+					}
+					qh_ptr = DWC_LIST_NEXT(qh_ptr);
+					continue;
+				} else {
+					qh->nak_frame = 0xFFFF;
+				}
+			}
+		}
+
+		if (microframe_schedule) {
+				if (hcd->available_host_channels < 1) {
+					break;
+				}
+				hcd->available_host_channels--;
+#ifdef DEBUG_HOST_CHANNELS
+				last_sel_trans_num_nonper_scheduled++;
+#endif /* DEBUG_HOST_CHANNELS */
+		}
+
+		assign_and_init_hc(hcd, qh);
+
+		/*
+		 * Move the QH from the non-periodic inactive schedule to the
+		 * non-periodic active schedule.
+		 */
+		qh_ptr = DWC_LIST_NEXT(qh_ptr);
+		DWC_LIST_MOVE_HEAD(&hcd->non_periodic_sched_active,
+				   &qh->qh_list_entry);
+
+		if (!microframe_schedule)
+			hcd->non_periodic_channels++;
+	}
+	/* we moved a non-periodic QH to the active schedule. If the inactive queue is empty,
+	 * stop the FIQ from kicking us. We could potentially still have elements here if we
+	 * ran out of host channels.
+	 */
+	if (fiq_enable) {
+		if (DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive)) {
+			hcd->fiq_state->kick_np_queues = 0;
+		} else {
+			/* For each entry remaining in the NP inactive queue,
+			* if this a NAK'd retransmit then don't set the kick flag.
+			*/
+			if(nak_holdoff) {
+				DWC_LIST_FOREACH(qh_ptr, &hcd->non_periodic_sched_inactive) {
+					qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+					if (qh->nak_frame == 0xFFFF) {
+						hcd->fiq_state->kick_np_queues = 1;
+					}
+				}
+			}
+		}
+	}
+	if(!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned))
+		ret_val |= DWC_OTG_TRANSACTION_PERIODIC;
+
+	if(!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active))
+		ret_val |= DWC_OTG_TRANSACTION_NON_PERIODIC;
+
+
+#ifdef DEBUG_HOST_CHANNELS
+	last_sel_trans_num_avail_hc_at_end = hcd->available_host_channels;
+#endif /* DEBUG_HOST_CHANNELS */
+	return ret_val;
+}
+
+/**
+ * Attempts to queue a single transaction request for a host channel
+ * associated with either a periodic or non-periodic transfer. This function
+ * assumes that there is space available in the appropriate request queue. For
+ * an OUT transfer or SETUP transaction in Slave mode, it checks whether space
+ * is available in the appropriate Tx FIFO.
+ *
+ * @param hcd The HCD state structure.
+ * @param hc Host channel descriptor associated with either a periodic or
+ * non-periodic transfer.
+ * @param fifo_dwords_avail Number of DWORDs available in the periodic Tx
+ * FIFO for periodic transfers or the non-periodic Tx FIFO for non-periodic
+ * transfers.
+ *
+ * @return 1 if a request is queued and more requests may be needed to
+ * complete the transfer, 0 if no more requests are required for this
+ * transfer, -1 if there is insufficient space in the Tx FIFO.
+ */
+static int queue_transaction(dwc_otg_hcd_t * hcd,
+			     dwc_hc_t * hc, uint16_t fifo_dwords_avail)
+{
+	int retval;
+
+	if (hcd->core_if->dma_enable) {
+		if (hcd->core_if->dma_desc_enable) {
+			if (!hc->xfer_started
+			    || (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)) {
+				dwc_otg_hcd_start_xfer_ddma(hcd, hc->qh);
+				hc->qh->ping_state = 0;
+			}
+		} else if (!hc->xfer_started) {
+			if (fiq_fsm_enable && hc->error_state) {
+				hcd->fiq_state->channel[hc->hc_num].nr_errors =
+					DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list)->error_count;
+				hcd->fiq_state->channel[hc->hc_num].fsm =
+					FIQ_PASSTHROUGH_ERRORSTATE;
+			}
+			dwc_otg_hc_start_transfer(hcd->core_if, hc);
+			hc->qh->ping_state = 0;
+		}
+		retval = 0;
+	} else if (hc->halt_pending) {
+		/* Don't queue a request if the channel has been halted. */
+		retval = 0;
+	} else if (hc->halt_on_queue) {
+		dwc_otg_hc_halt(hcd->core_if, hc, hc->halt_status);
+		retval = 0;
+	} else if (hc->do_ping) {
+		if (!hc->xfer_started) {
+			dwc_otg_hc_start_transfer(hcd->core_if, hc);
+		}
+		retval = 0;
+	} else if (!hc->ep_is_in || hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
+		if ((fifo_dwords_avail * 4) >= hc->max_packet) {
+			if (!hc->xfer_started) {
+				dwc_otg_hc_start_transfer(hcd->core_if, hc);
+				retval = 1;
+			} else {
+				retval =
+				    dwc_otg_hc_continue_transfer(hcd->core_if,
+								 hc);
+			}
+		} else {
+			retval = -1;
+		}
+	} else {
+		if (!hc->xfer_started) {
+			dwc_otg_hc_start_transfer(hcd->core_if, hc);
+			retval = 1;
+		} else {
+			retval = dwc_otg_hc_continue_transfer(hcd->core_if, hc);
+		}
+	}
+
+	return retval;
+}
+
+/**
+ * Processes periodic channels for the next frame and queues transactions for
+ * these channels to the DWC_otg controller. After queueing transactions, the
+ * Periodic Tx FIFO Empty interrupt is enabled if there are more transactions
+ * to queue as Periodic Tx FIFO or request queue space becomes available.
+ * Otherwise, the Periodic Tx FIFO Empty interrupt is disabled.
+ */
+static void process_periodic_channels(dwc_otg_hcd_t * hcd)
+{
+	hptxsts_data_t tx_status;
+	dwc_list_link_t *qh_ptr;
+	dwc_otg_qh_t *qh;
+	int status = 0;
+	int no_queue_space = 0;
+	int no_fifo_space = 0;
+
+	dwc_otg_host_global_regs_t *host_regs;
+	host_regs = hcd->core_if->host_if->host_global_regs;
+
+	DWC_DEBUGPL(DBG_HCDV, "Queue periodic transactions\n");
+#ifdef DEBUG
+	tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
+	DWC_DEBUGPL(DBG_HCDV,
+		    "  P Tx Req Queue Space Avail (before queue): %d\n",
+		    tx_status.b.ptxqspcavail);
+	DWC_DEBUGPL(DBG_HCDV, "  P Tx FIFO Space Avail (before queue): %d\n",
+		    tx_status.b.ptxfspcavail);
+#endif
+
+	qh_ptr = hcd->periodic_sched_assigned.next;
+	while (qh_ptr != &hcd->periodic_sched_assigned) {
+		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
+		if (tx_status.b.ptxqspcavail == 0) {
+			no_queue_space = 1;
+			break;
+		}
+
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+
+		// Do not send a split start transaction any later than frame .6
+		// Note, we have to schedule a periodic in .5 to make it go in .6
+		if(fiq_fsm_enable && qh->do_split && ((dwc_otg_hcd_get_frame_number(hcd) + 1) & 7) > 6)
+		{
+			qh_ptr = qh_ptr->next;
+			hcd->fiq_state->next_sched_frame = dwc_otg_hcd_get_frame_number(hcd) | 7;
+			continue;
+		}
+
+		if (fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
+			if (qh->do_split)
+				fiq_fsm_queue_split_transaction(hcd, qh);
+			else
+				fiq_fsm_queue_isoc_transaction(hcd, qh);
+		} else {
+
+			/*
+			 * Set a flag if we're queueing high-bandwidth in slave mode.
+			 * The flag prevents any halts to get into the request queue in
+			 * the middle of multiple high-bandwidth packets getting queued.
+			 */
+			if (!hcd->core_if->dma_enable && qh->channel->multi_count > 1) {
+				hcd->core_if->queuing_high_bandwidth = 1;
+			}
+			status = queue_transaction(hcd, qh->channel,
+							tx_status.b.ptxfspcavail);
+			if (status < 0) {
+				no_fifo_space = 1;
+				break;
+			}
+		}
+
+		/*
+		 * In Slave mode, stay on the current transfer until there is
+		 * nothing more to do or the high-bandwidth request count is
+		 * reached. In DMA mode, only need to queue one request. The
+		 * controller automatically handles multiple packets for
+		 * high-bandwidth transfers.
+		 */
+		if (hcd->core_if->dma_enable || status == 0 ||
+		    qh->channel->requests == qh->channel->multi_count) {
+			qh_ptr = qh_ptr->next;
+			/*
+			 * Move the QH from the periodic assigned schedule to
+			 * the periodic queued schedule.
+			 */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_queued,
+					   &qh->qh_list_entry);
+
+			/* done queuing high bandwidth */
+			hcd->core_if->queuing_high_bandwidth = 0;
+		}
+	}
+
+	if (!hcd->core_if->dma_enable) {
+		dwc_otg_core_global_regs_t *global_regs;
+		gintmsk_data_t intr_mask = {.d32 = 0 };
+
+		global_regs = hcd->core_if->core_global_regs;
+		intr_mask.b.ptxfempty = 1;
+#ifdef DEBUG
+		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  P Tx Req Queue Space Avail (after queue): %d\n",
+			    tx_status.b.ptxqspcavail);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  P Tx FIFO Space Avail (after queue): %d\n",
+			    tx_status.b.ptxfspcavail);
+#endif
+		if (!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned) ||
+		    no_queue_space || no_fifo_space) {
+			/*
+			 * May need to queue more transactions as the request
+			 * queue or Tx FIFO empties. Enable the periodic Tx
+			 * FIFO empty interrupt. (Always use the half-empty
+			 * level to ensure that new requests are loaded as
+			 * soon as possible.)
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
+					 intr_mask.d32);
+		} else {
+			/*
+			 * Disable the Tx FIFO empty interrupt since there are
+			 * no more transactions that need to be queued right
+			 * now. This function is called from interrupt
+			 * handlers to queue more transactions as transfer
+			 * states change.
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
+					 0);
+		}
+	}
+}
+
+/**
+ * Processes active non-periodic channels and queues transactions for these
+ * channels to the DWC_otg controller. After queueing transactions, the NP Tx
+ * FIFO Empty interrupt is enabled if there are more transactions to queue as
+ * NP Tx FIFO or request queue space becomes available. Otherwise, the NP Tx
+ * FIFO Empty interrupt is disabled.
+ */
+static void process_non_periodic_channels(dwc_otg_hcd_t * hcd)
+{
+	gnptxsts_data_t tx_status;
+	dwc_list_link_t *orig_qh_ptr;
+	dwc_otg_qh_t *qh;
+	int status;
+	int no_queue_space = 0;
+	int no_fifo_space = 0;
+	int more_to_do = 0;
+
+	dwc_otg_core_global_regs_t *global_regs =
+	    hcd->core_if->core_global_regs;
+
+	DWC_DEBUGPL(DBG_HCDV, "Queue non-periodic transactions\n");
+#ifdef DEBUG
+	tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+	DWC_DEBUGPL(DBG_HCDV,
+		    "  NP Tx Req Queue Space Avail (before queue): %d\n",
+		    tx_status.b.nptxqspcavail);
+	DWC_DEBUGPL(DBG_HCDV, "  NP Tx FIFO Space Avail (before queue): %d\n",
+		    tx_status.b.nptxfspcavail);
+#endif
+	/*
+	 * Keep track of the starting point. Skip over the start-of-list
+	 * entry.
+	 */
+	if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
+		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
+	}
+	orig_qh_ptr = hcd->non_periodic_qh_ptr;
+
+	/*
+	 * Process once through the active list or until no more space is
+	 * available in the request queue or the Tx FIFO.
+	 */
+	do {
+		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+		if (!hcd->core_if->dma_enable && tx_status.b.nptxqspcavail == 0) {
+			no_queue_space = 1;
+			break;
+		}
+
+		qh = DWC_LIST_ENTRY(hcd->non_periodic_qh_ptr, dwc_otg_qh_t,
+				    qh_list_entry);
+
+		if(fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
+			fiq_fsm_queue_split_transaction(hcd, qh);
+		} else {
+			status = queue_transaction(hcd, qh->channel,
+						tx_status.b.nptxfspcavail);
+
+			if (status > 0) {
+				more_to_do = 1;
+			} else if (status < 0) {
+				no_fifo_space = 1;
+				break;
+			}
+		}
+		/* Advance to next QH, skipping start-of-list entry. */
+		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
+		if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
+			hcd->non_periodic_qh_ptr =
+			    hcd->non_periodic_qh_ptr->next;
+		}
+
+	} while (hcd->non_periodic_qh_ptr != orig_qh_ptr);
+
+	if (!hcd->core_if->dma_enable) {
+		gintmsk_data_t intr_mask = {.d32 = 0 };
+		intr_mask.b.nptxfempty = 1;
+
+#ifdef DEBUG
+		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  NP Tx Req Queue Space Avail (after queue): %d\n",
+			    tx_status.b.nptxqspcavail);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  NP Tx FIFO Space Avail (after queue): %d\n",
+			    tx_status.b.nptxfspcavail);
+#endif
+		if (more_to_do || no_queue_space || no_fifo_space) {
+			/*
+			 * May need to queue more transactions as the request
+			 * queue or Tx FIFO empties. Enable the non-periodic
+			 * Tx FIFO empty interrupt. (Always use the half-empty
+			 * level to ensure that new requests are loaded as
+			 * soon as possible.)
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
+					 intr_mask.d32);
+		} else {
+			/*
+			 * Disable the Tx FIFO empty interrupt since there are
+			 * no more transactions that need to be queued right
+			 * now. This function is called from interrupt
+			 * handlers to queue more transactions as transfer
+			 * states change.
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
+					 0);
+		}
+	}
+}
+
+/**
+ * This function processes the currently active host channels and queues
+ * transactions for these channels to the DWC_otg controller. It is called
+ * from HCD interrupt handler functions.
+ *
+ * @param hcd The HCD state structure.
+ * @param tr_type The type(s) of transactions to queue (non-periodic,
+ * periodic, or both).
+ */
+void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
+				    dwc_otg_transaction_type_e tr_type)
+{
+#ifdef DEBUG_SOF
+	DWC_DEBUGPL(DBG_HCD, "Queue Transactions\n");
+#endif
+	/* Process host channels associated with periodic transfers. */
+	if ((tr_type == DWC_OTG_TRANSACTION_PERIODIC ||
+	     tr_type == DWC_OTG_TRANSACTION_ALL) &&
+	    !DWC_LIST_EMPTY(&hcd->periodic_sched_assigned)) {
+
+		process_periodic_channels(hcd);
+	}
+
+	/* Process host channels associated with non-periodic transfers. */
+	if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC ||
+	    tr_type == DWC_OTG_TRANSACTION_ALL) {
+		if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active)) {
+			process_non_periodic_channels(hcd);
+		} else {
+			/*
+			 * Ensure NP Tx FIFO empty interrupt is disabled when
+			 * there are no non-periodic transfers to process.
+			 */
+			gintmsk_data_t gintmsk = {.d32 = 0 };
+			gintmsk.b.nptxfempty = 1;
+
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+			}
+		}
+	}
+}
+
+#ifdef DWC_HS_ELECT_TST
+/*
+ * Quick and dirty hack to implement the HS Electrical Test
+ * SINGLE_STEP_GET_DEVICE_DESCRIPTOR feature.
+ *
+ * This code was copied from our userspace app "hset". It sends a
+ * Get Device Descriptor control sequence in two parts, first the
+ * Setup packet by itself, followed some time later by the In and
+ * Ack packets. Rather than trying to figure out how to add this
+ * functionality to the normal driver code, we just hijack the
+ * hardware, using these two function to drive the hardware
+ * directly.
+ */
+
+static dwc_otg_core_global_regs_t *global_regs;
+static dwc_otg_host_global_regs_t *hc_global_regs;
+static dwc_otg_hc_regs_t *hc_regs;
+static uint32_t *data_fifo;
+
+static void do_setup(void)
+{
+	gintsts_data_t gintsts;
+	hctsiz_data_t hctsiz;
+	hcchar_data_t hcchar;
+	haint_data_t haint;
+	hcint_data_t hcint;
+
+	/* Enable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
+
+	/* Enable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/*
+	 * Send Setup packet (Get Device Descriptor)
+	 */
+
+	/* Make sure channel is disabled */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chen) {
+		hcchar.b.chdis = 1;
+//              hcchar.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		//sleep(1);
+		dwc_mdelay(1000);
+
+		/* Read GINTSTS */
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+		/* Read HAINT */
+		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+		/* Read HCINT */
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+		/* Read HCCHAR */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+		/* Clear HCINT */
+		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+		/* Clear HAINT */
+		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+		/* Clear GINTSTS */
+		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	}
+
+	/* Set HCTSIZ */
+	hctsiz.d32 = 0;
+	hctsiz.b.xfersize = 8;
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.pid = DWC_OTG_HC_PID_SETUP;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	/* Set HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.epdir = 0;
+	hcchar.b.epnum = 0;
+	hcchar.b.mps = 8;
+	hcchar.b.chen = 1;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	/* Fill FIFO with Setup data for Get Device Descriptor */
+	data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
+	DWC_WRITE_REG32(data_fifo++, 0x01000680);
+	DWC_WRITE_REG32(data_fifo++, 0x00080000);
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for host channel interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.hcintr == 0);
+
+	/* Disable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
+
+	/* Disable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+}
+
+static void do_in_ack(void)
+{
+	gintsts_data_t gintsts;
+	hctsiz_data_t hctsiz;
+	hcchar_data_t hcchar;
+	haint_data_t haint;
+	hcint_data_t hcint;
+	host_grxsts_data_t grxsts;
+
+	/* Enable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
+
+	/* Enable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/*
+	 * Receive Control In packet
+	 */
+
+	/* Make sure channel is disabled */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chen) {
+		hcchar.b.chdis = 1;
+		hcchar.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		//sleep(1);
+		dwc_mdelay(1000);
+
+		/* Read GINTSTS */
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+		/* Read HAINT */
+		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+		/* Read HCINT */
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+		/* Read HCCHAR */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+		/* Clear HCINT */
+		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+		/* Clear HAINT */
+		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+		/* Clear GINTSTS */
+		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	}
+
+	/* Set HCTSIZ */
+	hctsiz.d32 = 0;
+	hctsiz.b.xfersize = 8;
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	/* Set HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.epdir = 1;
+	hcchar.b.epnum = 0;
+	hcchar.b.mps = 8;
+	hcchar.b.chen = 1;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for receive status queue interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.rxstsqlvl == 0);
+
+	/* Read RXSTS */
+	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
+
+	/* Clear RXSTSQLVL in GINTSTS */
+	gintsts.d32 = 0;
+	gintsts.b.rxstsqlvl = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	switch (grxsts.b.pktsts) {
+	case DWC_GRXSTS_PKTSTS_IN:
+		/* Read the data into the host buffer */
+		if (grxsts.b.bcnt > 0) {
+			int i;
+			int word_count = (grxsts.b.bcnt + 3) / 4;
+
+			data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
+
+			for (i = 0; i < word_count; i++) {
+				(void)DWC_READ_REG32(data_fifo++);
+			}
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for receive status queue interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.rxstsqlvl == 0);
+
+	/* Read RXSTS */
+	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
+
+	/* Clear RXSTSQLVL in GINTSTS */
+	gintsts.d32 = 0;
+	gintsts.b.rxstsqlvl = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	switch (grxsts.b.pktsts) {
+	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
+		break;
+
+	default:
+		break;
+	}
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for host channel interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.hcintr == 0);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+//      usleep(100000);
+//      mdelay(100);
+	dwc_mdelay(1);
+
+	/*
+	 * Send handshake packet
+	 */
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Make sure channel is disabled */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chen) {
+		hcchar.b.chdis = 1;
+		hcchar.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		//sleep(1);
+		dwc_mdelay(1000);
+
+		/* Read GINTSTS */
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+		/* Read HAINT */
+		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+		/* Read HCINT */
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+		/* Read HCCHAR */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+		/* Clear HCINT */
+		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+		/* Clear HAINT */
+		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+		/* Clear GINTSTS */
+		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	}
+
+	/* Set HCTSIZ */
+	hctsiz.d32 = 0;
+	hctsiz.b.xfersize = 0;
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	/* Set HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.epdir = 0;
+	hcchar.b.epnum = 0;
+	hcchar.b.mps = 8;
+	hcchar.b.chen = 1;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for host channel interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.hcintr == 0);
+
+	/* Disable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
+
+	/* Disable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+}
+#endif
+
+/** Handles hub class-specific requests. */
+int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
+			    uint16_t typeReq,
+			    uint16_t wValue,
+			    uint16_t wIndex, uint8_t * buf, uint16_t wLength)
+{
+	int retval = 0;
+
+	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
+	usb_hub_descriptor_t *hub_desc;
+	hprt0_data_t hprt0 = {.d32 = 0 };
+
+	uint32_t port_status;
+
+	switch (typeReq) {
+	case UCR_CLEAR_HUB_FEATURE:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "ClearHubFeature 0x%x\n", wValue);
+		switch (wValue) {
+		case UHF_C_HUB_LOCAL_POWER:
+		case UHF_C_HUB_OVER_CURRENT:
+			/* Nothing required here */
+			break;
+		default:
+			retval = -DWC_E_INVALID;
+			DWC_ERROR("DWC OTG HCD - "
+				  "ClearHubFeature request %xh unknown\n",
+				  wValue);
+		}
+		break;
+	case UCR_CLEAR_PORT_FEATURE:
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		if (wValue != UHF_PORT_L1)
+#endif
+			if (!wIndex || wIndex > 1)
+				goto error;
+
+		switch (wValue) {
+		case UHF_PORT_ENABLE:
+			DWC_DEBUGPL(DBG_ANY, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_ENABLE\n");
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtena = 1;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			break;
+		case UHF_PORT_SUSPEND:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_SUSPEND\n");
+
+			if (core_if->power_down == 2) {
+				dwc_otg_host_hibernation_restore(core_if, 0, 0);
+			} else {
+				DWC_WRITE_REG32(core_if->pcgcctl, 0);
+				dwc_mdelay(5);
+
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtres = 1;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+				hprt0.b.prtsusp = 0;
+				/* Clear Resume bit */
+				dwc_mdelay(100);
+				hprt0.b.prtres = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			}
+			break;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		case UHF_PORT_L1:
+			{
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				glpmcfg_data_t lpmcfg = {.d32 = 0 };
+
+				lpmcfg.d32 =
+				    DWC_READ_REG32(&core_if->
+						   core_global_regs->glpmcfg);
+				lpmcfg.b.en_utmi_sleep = 0;
+				lpmcfg.b.hird_thres &= (~(1 << 4));
+				lpmcfg.b.prt_sleep_sts = 1;
+				DWC_WRITE_REG32(&core_if->
+						core_global_regs->glpmcfg,
+						lpmcfg.d32);
+
+				/* Clear Enbl_L1Gating bit. */
+				pcgcctl.b.enbl_sleep_gating = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32,
+						 0);
+
+				dwc_mdelay(5);
+
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtres = 1;
+				DWC_WRITE_REG32(core_if->host_if->hprt0,
+						hprt0.d32);
+				/* This bit will be cleared in wakeup interrupt handle */
+				break;
+			}
+#endif
+		case UHF_PORT_POWER:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_POWER\n");
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtpwr = 0;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			break;
+		case UHF_PORT_INDICATOR:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_INDICATOR\n");
+			/* Port inidicator not supported */
+			break;
+		case UHF_C_PORT_CONNECTION:
+			/* Clears drivers internal connect status change
+			 * flag */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_CONNECTION\n");
+			dwc_otg_hcd->flags.b.port_connect_status_change = 0;
+			break;
+		case UHF_C_PORT_RESET:
+			/* Clears the driver's internal Port Reset Change
+			 * flag */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_RESET\n");
+			dwc_otg_hcd->flags.b.port_reset_change = 0;
+			break;
+		case UHF_C_PORT_ENABLE:
+			/* Clears the driver's internal Port
+			 * Enable/Disable Change flag */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_ENABLE\n");
+			dwc_otg_hcd->flags.b.port_enable_change = 0;
+			break;
+		case UHF_C_PORT_SUSPEND:
+			/* Clears the driver's internal Port Suspend
+			 * Change flag, which is set when resume signaling on
+			 * the host port is complete */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_SUSPEND\n");
+			dwc_otg_hcd->flags.b.port_suspend_change = 0;
+			break;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		case UHF_C_PORT_L1:
+			dwc_otg_hcd->flags.b.port_l1_change = 0;
+			break;
+#endif
+		case UHF_C_PORT_OVER_CURRENT:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_OVER_CURRENT\n");
+			dwc_otg_hcd->flags.b.port_over_current_change = 0;
+			break;
+		default:
+			retval = -DWC_E_INVALID;
+			DWC_ERROR("DWC OTG HCD - "
+				  "ClearPortFeature request %xh "
+				  "unknown or unsupported\n", wValue);
+		}
+		break;
+	case UCR_GET_HUB_DESCRIPTOR:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "GetHubDescriptor\n");
+		hub_desc = (usb_hub_descriptor_t *) buf;
+		hub_desc->bDescLength = 9;
+		hub_desc->bDescriptorType = 0x29;
+		hub_desc->bNbrPorts = 1;
+		USETW(hub_desc->wHubCharacteristics, 0x08);
+		hub_desc->bPwrOn2PwrGood = 1;
+		hub_desc->bHubContrCurrent = 0;
+		hub_desc->DeviceRemovable[0] = 0;
+		hub_desc->DeviceRemovable[1] = 0xff;
+		break;
+	case UCR_GET_HUB_STATUS:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "GetHubStatus\n");
+		DWC_MEMSET(buf, 0, 4);
+		break;
+	case UCR_GET_PORT_STATUS:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "GetPortStatus wIndex = 0x%04x FLAGS=0x%08x\n",
+			    wIndex, dwc_otg_hcd->flags.d32);
+		if (!wIndex || wIndex > 1)
+			goto error;
+
+		port_status = 0;
+
+		if (dwc_otg_hcd->flags.b.port_connect_status_change)
+			port_status |= (1 << UHF_C_PORT_CONNECTION);
+
+		if (dwc_otg_hcd->flags.b.port_enable_change)
+			port_status |= (1 << UHF_C_PORT_ENABLE);
+
+		if (dwc_otg_hcd->flags.b.port_suspend_change)
+			port_status |= (1 << UHF_C_PORT_SUSPEND);
+
+		if (dwc_otg_hcd->flags.b.port_l1_change)
+			port_status |= (1 << UHF_C_PORT_L1);
+
+		if (dwc_otg_hcd->flags.b.port_reset_change) {
+			port_status |= (1 << UHF_C_PORT_RESET);
+		}
+
+		if (dwc_otg_hcd->flags.b.port_over_current_change) {
+			DWC_WARN("Overcurrent change detected\n");
+			port_status |= (1 << UHF_C_PORT_OVER_CURRENT);
+		}
+
+		if (!dwc_otg_hcd->flags.b.port_connect_status) {
+			/*
+			 * The port is disconnected, which means the core is
+			 * either in device mode or it soon will be. Just
+			 * return 0's for the remainder of the port status
+			 * since the port register can't be read if the core
+			 * is in device mode.
+			 */
+			*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
+			break;
+		}
+
+		hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+		DWC_DEBUGPL(DBG_HCDV, "  HPRT0: 0x%08x\n", hprt0.d32);
+
+		if (hprt0.b.prtconnsts)
+			port_status |= (1 << UHF_PORT_CONNECTION);
+
+		if (hprt0.b.prtena)
+			port_status |= (1 << UHF_PORT_ENABLE);
+
+		if (hprt0.b.prtsusp)
+			port_status |= (1 << UHF_PORT_SUSPEND);
+
+		if (hprt0.b.prtovrcurract)
+			port_status |= (1 << UHF_PORT_OVER_CURRENT);
+
+		if (hprt0.b.prtrst)
+			port_status |= (1 << UHF_PORT_RESET);
+
+		if (hprt0.b.prtpwr)
+			port_status |= (1 << UHF_PORT_POWER);
+
+		if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
+			port_status |= (1 << UHF_PORT_HIGH_SPEED);
+		else if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED)
+			port_status |= (1 << UHF_PORT_LOW_SPEED);
+
+		if (hprt0.b.prttstctl)
+			port_status |= (1 << UHF_PORT_TEST);
+		if (dwc_otg_get_lpm_portsleepstatus(dwc_otg_hcd->core_if)) {
+			port_status |= (1 << UHF_PORT_L1);
+		}
+		/*
+		   For Synopsys HW emulation of Power down wkup_control asserts the
+		   hreset_n and prst_n on suspned. This causes the HPRT0 to be zero.
+		   We intentionally tell the software that port is in L2Suspend state.
+		   Only for STE.
+		*/
+		if ((core_if->power_down == 2)
+		    && (core_if->hibernation_suspend == 1)) {
+			port_status |= (1 << UHF_PORT_SUSPEND);
+		}
+		/* USB_PORT_FEAT_INDICATOR unsupported always 0 */
+
+		*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
+
+		break;
+	case UCR_SET_HUB_FEATURE:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "SetHubFeature\n");
+		/* No HUB features supported */
+		break;
+	case UCR_SET_PORT_FEATURE:
+		if (wValue != UHF_PORT_TEST && (!wIndex || wIndex > 1))
+			goto error;
+
+		if (!dwc_otg_hcd->flags.b.port_connect_status) {
+			/*
+			 * The port is disconnected, which means the core is
+			 * either in device mode or it soon will be. Just
+			 * return without doing anything since the port
+			 * register can't be written if the core is in device
+			 * mode.
+			 */
+			break;
+		}
+
+		switch (wValue) {
+		case UHF_PORT_SUSPEND:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "SetPortFeature - USB_PORT_FEAT_SUSPEND\n");
+			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) != wIndex) {
+				goto error;
+			}
+			if (core_if->power_down == 2) {
+				int timeout = 300;
+				dwc_irqflags_t flags;
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				gpwrdn_data_t gpwrdn = {.d32 = 0 };
+				gusbcfg_data_t gusbcfg = {.d32 = 0 };
+#ifdef DWC_DEV_SRPCAP
+				int32_t otg_cap_param = core_if->core_params->otg_cap;
+#endif
+				DWC_PRINTF("Preparing for complete power-off\n");
+
+				/* Save registers before hibernation */
+				dwc_otg_save_global_regs(core_if);
+				dwc_otg_save_host_regs(core_if);
+
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtsusp = 1;
+				hprt0.b.prtena = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+				/* Spin hprt0.b.prtsusp to became 1 */
+				do {
+					hprt0.d32 = dwc_otg_read_hprt0(core_if);
+					if (hprt0.b.prtsusp) {
+						break;
+					}
+					dwc_mdelay(1);
+				} while (--timeout);
+				if (!timeout) {
+					DWC_WARN("Suspend wasn't genereted\n");
+				}
+				dwc_udelay(10);
+
+				/*
+				 * We need to disable interrupts to prevent servicing of any IRQ
+				 * during going to hibernation
+				 */
+				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+				core_if->lx_state = DWC_OTG_L2;
+#ifdef DWC_DEV_SRPCAP
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtpwr = 0;
+				hprt0.b.prtena = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0,
+						hprt0.d32);
+#endif
+				gusbcfg.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->
+						   gusbcfg);
+				if (gusbcfg.b.ulpi_utmi_sel == 1) {
+					/* ULPI interface */
+					/* Suspend the Phy Clock */
+					pcgcctl.d32 = 0;
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+							 pcgcctl.d32);
+					dwc_udelay(10);
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+				} else {
+					/* UTMI+ Interface */
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+					dwc_udelay(10);
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+					dwc_udelay(10);
+				}
+#ifdef DWC_DEV_SRPCAP
+				gpwrdn.d32 = 0;
+				gpwrdn.b.dis_vbus = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+#endif
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				gpwrdn.d32 = 0;
+#ifdef DWC_DEV_SRPCAP
+				gpwrdn.b.srp_det_msk = 1;
+#endif
+				gpwrdn.b.disconn_det_msk = 1;
+				gpwrdn.b.lnstchng_msk = 1;
+				gpwrdn.b.sts_chngint_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Enable Power Down Clamp and all interrupts in GPWRDN */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnclmp = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Switch off VDD */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+#ifdef DWC_DEV_SRPCAP
+				if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE)
+				{
+					core_if->pwron_timer_started = 1;
+					DWC_TIMER_SCHEDULE(core_if->pwron_timer, 6000 /* 6 secs */ );
+				}
+#endif
+				/* Save gpwrdn register for further usage if stschng interrupt */
+				core_if->gr_backup->gpwrdn_local =
+						DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+				/* Set flag to indicate that we are in hibernation */
+				core_if->hibernation_suspend = 1;
+				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock,flags);
+
+				DWC_PRINTF("Host hibernation completed\n");
+				// Exit from case statement
+				break;
+
+			}
+			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) == wIndex &&
+			    dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
+				gotgctl_data_t gotgctl = {.d32 = 0 };
+				gotgctl.b.hstsethnpen = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gotgctl, 0, gotgctl.d32);
+				core_if->op_state = A_SUSPEND;
+			}
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtsusp = 1;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			{
+				dwc_irqflags_t flags;
+				/* Update lx_state */
+				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+				core_if->lx_state = DWC_OTG_L2;
+				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+			}
+			/* Suspend the Phy Clock */
+			{
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				pcgcctl.b.stoppclk = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+						 pcgcctl.d32);
+				dwc_udelay(10);
+			}
+
+			/* For HNP the bus must be suspended for at least 200ms. */
+			if (dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				pcgcctl.b.stoppclk = 1;
+                DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+				dwc_mdelay(200);
+			}
+
+			/** @todo - check how sw can wait for 1 sec to check asesvld??? */
+#if 0 //vahrama !!!!!!!!!!!!!!!!!!
+			if (core_if->adp_enable) {
+				gotgctl_data_t gotgctl = {.d32 = 0 };
+				gpwrdn_data_t gpwrdn;
+
+				while (gotgctl.b.asesvld == 1) {
+					gotgctl.d32 =
+					    DWC_READ_REG32(&core_if->
+							   core_global_regs->
+							   gotgctl);
+					dwc_mdelay(100);
+				}
+
+				/* Enable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				/* Unmask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				dwc_otg_adp_probe_start(core_if);
+			}
+#endif
+			break;
+		case UHF_PORT_POWER:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "SetPortFeature - USB_PORT_FEAT_POWER\n");
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtpwr = 1;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			break;
+		case UHF_PORT_RESET:
+			if ((core_if->power_down == 2)
+			    && (core_if->hibernation_suspend == 1)) {
+				/* If we are going to exit from Hibernated
+				 * state via USB RESET.
+				 */
+				dwc_otg_host_hibernation_restore(core_if, 0, 1);
+			} else {
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+
+				DWC_DEBUGPL(DBG_HCD,
+					    "DWC OTG HCD HUB CONTROL - "
+					    "SetPortFeature - USB_PORT_FEAT_RESET\n");
+				{
+					pcgcctl_data_t pcgcctl = {.d32 = 0 };
+					pcgcctl.b.enbl_sleep_gating = 1;
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+					DWC_WRITE_REG32(core_if->pcgcctl, 0);
+				}
+#ifdef CONFIG_USB_DWC_OTG_LPM
+				{
+					glpmcfg_data_t lpmcfg;
+					lpmcfg.d32 =
+						DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+					if (lpmcfg.b.prt_sleep_sts) {
+						lpmcfg.b.en_utmi_sleep = 0;
+						lpmcfg.b.hird_thres &= (~(1 << 4));
+						DWC_WRITE_REG32
+						    (&core_if->core_global_regs->glpmcfg,
+						     lpmcfg.d32);
+						dwc_mdelay(1);
+					}
+				}
+#endif
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				/* Clear suspend bit if resetting from suspended state. */
+				hprt0.b.prtsusp = 0;
+				/* When B-Host the Port reset bit is set in
+				 * the Start HCD Callback function, so that
+				 * the reset is started within 1ms of the HNP
+				 * success interrupt. */
+				if (!dwc_otg_hcd_is_b_host(dwc_otg_hcd)) {
+					hprt0.b.prtpwr = 1;
+					hprt0.b.prtrst = 1;
+					DWC_PRINTF("Indeed it is in host mode hprt0 = %08x\n",hprt0.d32);
+					DWC_WRITE_REG32(core_if->host_if->hprt0,
+							hprt0.d32);
+				}
+				/* Clear reset bit in 10ms (FS/LS) or 50ms (HS) */
+				dwc_mdelay(60);
+				hprt0.b.prtrst = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+				core_if->lx_state = DWC_OTG_L0;	/* Now back to the on state */
+			}
+			break;
+#ifdef DWC_HS_ELECT_TST
+		case UHF_PORT_TEST:
+			{
+				uint32_t t;
+				gintmsk_data_t gintmsk;
+
+				t = (wIndex >> 8);	/* MSB wIndex USB */
+				DWC_DEBUGPL(DBG_HCD,
+					    "DWC OTG HCD HUB CONTROL - "
+					    "SetPortFeature - USB_PORT_FEAT_TEST %d\n",
+					    t);
+				DWC_WARN("USB_PORT_FEAT_TEST %d\n", t);
+				if (t < 6) {
+					hprt0.d32 = dwc_otg_read_hprt0(core_if);
+					hprt0.b.prttstctl = t;
+					DWC_WRITE_REG32(core_if->host_if->hprt0,
+							hprt0.d32);
+				} else {
+					/* Setup global vars with reg addresses (quick and
+					 * dirty hack, should be cleaned up)
+					 */
+					global_regs = core_if->core_global_regs;
+					hc_global_regs =
+					    core_if->host_if->host_global_regs;
+					hc_regs =
+					    (dwc_otg_hc_regs_t *) ((char *)
+								   global_regs +
+								   0x500);
+					data_fifo =
+					    (uint32_t *) ((char *)global_regs +
+							  0x1000);
+
+					if (t == 6) {	/* HS_HOST_PORT_SUSPEND_RESUME */
+						/* Save current interrupt mask */
+						gintmsk.d32 =
+						    DWC_READ_REG32
+						    (&global_regs->gintmsk);
+
+						/* Disable all interrupts while we muck with
+						 * the hardware directly
+						 */
+						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+						/* 15 second delay per the test spec */
+						dwc_mdelay(15000);
+
+						/* Drive suspend on the root port */
+						hprt0.d32 =
+						    dwc_otg_read_hprt0(core_if);
+						hprt0.b.prtsusp = 1;
+						hprt0.b.prtres = 0;
+						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+						/* 15 second delay per the test spec */
+						dwc_mdelay(15000);
+
+						/* Drive resume on the root port */
+						hprt0.d32 =
+						    dwc_otg_read_hprt0(core_if);
+						hprt0.b.prtsusp = 0;
+						hprt0.b.prtres = 1;
+						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+						dwc_mdelay(100);
+
+						/* Clear the resume bit */
+						hprt0.b.prtres = 0;
+						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+						/* Restore interrupts */
+						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
+					} else if (t == 7) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
+						/* Save current interrupt mask */
+						gintmsk.d32 =
+						    DWC_READ_REG32
+						    (&global_regs->gintmsk);
+
+						/* Disable all interrupts while we muck with
+						 * the hardware directly
+						 */
+						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+						/* 15 second delay per the test spec */
+						dwc_mdelay(15000);
+
+						/* Send the Setup packet */
+						do_setup();
+
+						/* 15 second delay so nothing else happens for awhile */
+						dwc_mdelay(15000);
+
+						/* Restore interrupts */
+						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
+					} else if (t == 8) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
+						/* Save current interrupt mask */
+						gintmsk.d32 =
+						    DWC_READ_REG32
+						    (&global_regs->gintmsk);
+
+						/* Disable all interrupts while we muck with
+						 * the hardware directly
+						 */
+						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+						/* Send the Setup packet */
+						do_setup();
+
+						/* 15 second delay so nothing else happens for awhile */
+						dwc_mdelay(15000);
+
+						/* Send the In and Ack packets */
+						do_in_ack();
+
+						/* 15 second delay so nothing else happens for awhile */
+						dwc_mdelay(15000);
+
+						/* Restore interrupts */
+						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
+					}
+				}
+				break;
+			}
+#endif /* DWC_HS_ELECT_TST */
+
+		case UHF_PORT_INDICATOR:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "SetPortFeature - USB_PORT_FEAT_INDICATOR\n");
+			/* Not supported */
+			break;
+		default:
+			retval = -DWC_E_INVALID;
+			DWC_ERROR("DWC OTG HCD - "
+				  "SetPortFeature request %xh "
+				  "unknown or unsupported\n", wValue);
+			break;
+		}
+		break;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	case UCR_SET_AND_TEST_PORT_FEATURE:
+		if (wValue != UHF_PORT_L1) {
+			goto error;
+		}
+		{
+			int portnum, hird, devaddr, remwake;
+			glpmcfg_data_t lpmcfg;
+			uint32_t time_usecs;
+			gintsts_data_t gintsts;
+			gintmsk_data_t gintmsk;
+
+			if (!dwc_otg_get_param_lpm_enable(core_if)) {
+				goto error;
+			}
+			if (wValue != UHF_PORT_L1 || wLength != 1) {
+				goto error;
+			}
+			/* Check if the port currently is in SLEEP state */
+			lpmcfg.d32 =
+			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+			if (lpmcfg.b.prt_sleep_sts) {
+				DWC_INFO("Port is already in sleep mode\n");
+				buf[0] = 0;	/* Return success */
+				break;
+			}
+
+			portnum = wIndex & 0xf;
+			hird = (wIndex >> 4) & 0xf;
+			devaddr = (wIndex >> 8) & 0x7f;
+			remwake = (wIndex >> 15);
+
+			if (portnum != 1) {
+				retval = -DWC_E_INVALID;
+				DWC_WARN
+				    ("Wrong port number(%d) in SetandTestPortFeature request\n",
+				     portnum);
+				break;
+			}
+
+			DWC_PRINTF
+			    ("SetandTestPortFeature request: portnum = %d, hird = %d, devaddr = %d, rewake = %d\n",
+			     portnum, hird, devaddr, remwake);
+			/* Disable LPM interrupt */
+			gintmsk.d32 = 0;
+			gintmsk.b.lpmtranrcvd = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+					 gintmsk.d32, 0);
+
+			if (dwc_otg_hcd_send_lpm
+			    (dwc_otg_hcd, devaddr, hird, remwake)) {
+				retval = -DWC_E_INVALID;
+				break;
+			}
+
+			time_usecs = 10 * (lpmcfg.b.retry_count + 1);
+			/* We will consider timeout if time_usecs microseconds pass,
+			 * and we don't receive LPM transaction status.
+			 * After receiving non-error responce(ACK/NYET/STALL) from device,
+			 *  core will set lpmtranrcvd bit.
+			 */
+			do {
+				gintsts.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+				if (gintsts.b.lpmtranrcvd) {
+					break;
+				}
+				dwc_udelay(1);
+			} while (--time_usecs);
+			/* lpm_int bit will be cleared in LPM interrupt handler */
+
+			/* Now fill status
+			 * 0x00 - Success
+			 * 0x10 - NYET
+			 * 0x11 - Timeout
+			 */
+			if (!gintsts.b.lpmtranrcvd) {
+				buf[0] = 0x3;	/* Completion code is Timeout */
+				dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd);
+			} else {
+				lpmcfg.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+				if (lpmcfg.b.lpm_resp == 0x3) {
+					/* ACK responce from the device */
+					buf[0] = 0x00;	/* Success */
+				} else if (lpmcfg.b.lpm_resp == 0x2) {
+					/* NYET responce from the device */
+					buf[0] = 0x2;
+				} else {
+					/* Otherwise responce with Timeout */
+					buf[0] = 0x3;
+				}
+			}
+			DWC_PRINTF("Device responce to LPM trans is %x\n",
+				   lpmcfg.b.lpm_resp);
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0,
+					 gintmsk.d32);
+
+			break;
+		}
+#endif /* CONFIG_USB_DWC_OTG_LPM */
+	default:
+error:
+		retval = -DWC_E_INVALID;
+		DWC_WARN("DWC OTG HCD - "
+			 "Unknown hub control request type or invalid typeReq: %xh wIndex: %xh wValue: %xh\n",
+			 typeReq, wIndex, wValue);
+		break;
+	}
+
+	return retval;
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/** Returns index of host channel to perform LPM transaction. */
+int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd, uint8_t devaddr)
+{
+	dwc_otg_core_if_t *core_if = hcd->core_if;
+	dwc_hc_t *hc;
+	hcchar_data_t hcchar;
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+	if (DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
+		DWC_PRINTF("No free channel to select for LPM transaction\n");
+		return -1;
+	}
+
+	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
+
+	/* Mask host channel interrupts. */
+	gintmsk.b.hcintr = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+
+	/* Fill fields that core needs for LPM transaction */
+	hcchar.b.devaddr = devaddr;
+	hcchar.b.epnum = 0;
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.mps = 64;
+	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
+	hcchar.b.epdir = 0;	/* OUT */
+	DWC_WRITE_REG32(&core_if->host_if->hc_regs[hc->hc_num]->hcchar,
+			hcchar.d32);
+
+	/* Remove the host channel from the free list. */
+	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
+
+	DWC_PRINTF("hcnum = %d devaddr = %d\n", hc->hc_num, devaddr);
+
+	return hc->hc_num;
+}
+
+/** Release hc after performing LPM transaction */
+void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd)
+{
+	dwc_hc_t *hc;
+	glpmcfg_data_t lpmcfg;
+	uint8_t hc_num;
+
+	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
+	hc_num = lpmcfg.b.lpm_chan_index;
+
+	hc = hcd->hc_ptr_array[hc_num];
+
+	DWC_PRINTF("Freeing channel %d after LPM\n", hc_num);
+	/* Return host channel to free list */
+	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
+}
+
+int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr, uint8_t hird,
+			 uint8_t bRemoteWake)
+{
+	glpmcfg_data_t lpmcfg;
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	int channel;
+
+	channel = dwc_otg_hcd_get_hc_for_lpm_tran(hcd, devaddr);
+	if (channel < 0) {
+		return channel;
+	}
+
+	pcgcctl.b.enbl_sleep_gating = 1;
+	DWC_MODIFY_REG32(hcd->core_if->pcgcctl, 0, pcgcctl.d32);
+
+	/* Read LPM config register */
+	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
+
+	/* Program LPM transaction fields */
+	lpmcfg.b.rem_wkup_en = bRemoteWake;
+	lpmcfg.b.hird = hird;
+	lpmcfg.b.hird_thres = 0x1c;
+	lpmcfg.b.lpm_chan_index = channel;
+	lpmcfg.b.en_utmi_sleep = 1;
+	/* Program LPM config register */
+	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+
+	/* Send LPM transaction */
+	lpmcfg.b.send_lpm = 1;
+	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+
+	return 0;
+}
+
+#endif /* CONFIG_USB_DWC_OTG_LPM */
+
+int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port)
+{
+	int retval;
+
+	if (port != 1) {
+		return -DWC_E_INVALID;
+	}
+
+	retval = (hcd->flags.b.port_connect_status_change ||
+		  hcd->flags.b.port_reset_change ||
+		  hcd->flags.b.port_enable_change ||
+		  hcd->flags.b.port_suspend_change ||
+		  hcd->flags.b.port_over_current_change);
+#ifdef DEBUG
+	if (retval) {
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB STATUS DATA:"
+			    " Root port status changed\n");
+		DWC_DEBUGPL(DBG_HCDV, "  port_connect_status_change: %d\n",
+			    hcd->flags.b.port_connect_status_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_reset_change: %d\n",
+			    hcd->flags.b.port_reset_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_enable_change: %d\n",
+			    hcd->flags.b.port_enable_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_suspend_change: %d\n",
+			    hcd->flags.b.port_suspend_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_over_current_change: %d\n",
+			    hcd->flags.b.port_over_current_change);
+	}
+#endif
+	return retval;
+}
+
+int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	hfnum_data_t hfnum;
+	hfnum.d32 =
+	    DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->
+			   hfnum);
+
+#ifdef DEBUG_SOF
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD GET FRAME NUMBER %d\n",
+		    hfnum.b.frnum);
+#endif
+	return hfnum.b.frnum;
+}
+
+int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
+		      struct dwc_otg_hcd_function_ops *fops)
+{
+	int retval = 0;
+
+	hcd->fops = fops;
+	if (!dwc_otg_is_device_mode(hcd->core_if) &&
+		(!hcd->core_if->adp_enable || hcd->core_if->adp.adp_started)) {
+		dwc_otg_hcd_reinit(hcd);
+	} else {
+		retval = -DWC_E_NO_DEVICE;
+	}
+
+	return retval;
+}
+
+void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd)
+{
+	return hcd->priv;
+}
+
+void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data)
+{
+	hcd->priv = priv_data;
+}
+
+uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd)
+{
+	return hcd->otg_port;
+}
+
+uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd)
+{
+	uint32_t is_b_host;
+	if (hcd->core_if->op_state == B_HOST) {
+		is_b_host = 1;
+	} else {
+		is_b_host = 0;
+	}
+
+	return is_b_host;
+}
+
+dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
+					 int iso_desc_count, int atomic_alloc)
+{
+	dwc_otg_hcd_urb_t *dwc_otg_urb;
+	uint32_t size;
+
+	size =
+	    sizeof(*dwc_otg_urb) +
+	    iso_desc_count * sizeof(struct dwc_otg_hcd_iso_packet_desc);
+	if (atomic_alloc)
+		dwc_otg_urb = DWC_ALLOC_ATOMIC(size);
+	else
+		dwc_otg_urb = DWC_ALLOC(size);
+
+        if (dwc_otg_urb)
+		dwc_otg_urb->packet_count = iso_desc_count;
+        else {
+		DWC_ERROR("**** DWC OTG HCD URB alloc - "
+			"%salloc of %db failed\n",
+			atomic_alloc?"atomic ":"", size);
+	}
+	return dwc_otg_urb;
+}
+
+void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * dwc_otg_urb,
+				  uint8_t dev_addr, uint8_t ep_num,
+				  uint8_t ep_type, uint8_t ep_dir, uint16_t mps)
+{
+	dwc_otg_hcd_fill_pipe(&dwc_otg_urb->pipe_info, dev_addr, ep_num,
+			      ep_type, ep_dir, mps);
+#if 0
+	DWC_PRINTF
+	    ("addr = %d, ep_num = %d, ep_dir = 0x%x, ep_type = 0x%x, mps = %d\n",
+	     dev_addr, ep_num, ep_dir, ep_type, mps);
+#endif
+}
+
+void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
+				void *urb_handle, void *buf, dwc_dma_t dma,
+				uint32_t buflen, void *setup_packet,
+				dwc_dma_t setup_dma, uint32_t flags,
+				uint16_t interval)
+{
+	dwc_otg_urb->priv = urb_handle;
+	dwc_otg_urb->buf = buf;
+	dwc_otg_urb->dma = dma;
+	dwc_otg_urb->length = buflen;
+	dwc_otg_urb->setup_packet = setup_packet;
+	dwc_otg_urb->setup_dma = setup_dma;
+	dwc_otg_urb->flags = flags;
+	dwc_otg_urb->interval = interval;
+	dwc_otg_urb->status = -DWC_E_IN_PROGRESS;
+}
+
+uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	return dwc_otg_urb->status;
+}
+
+uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	return dwc_otg_urb->actual_length;
+}
+
+uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	return dwc_otg_urb->error_count;
+}
+
+void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
+					 int desc_num, uint32_t offset,
+					 uint32_t length)
+{
+	dwc_otg_urb->iso_descs[desc_num].offset = offset;
+	dwc_otg_urb->iso_descs[desc_num].length = length;
+}
+
+uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t * dwc_otg_urb,
+					     int desc_num)
+{
+	return dwc_otg_urb->iso_descs[desc_num].status;
+}
+
+uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
+						    dwc_otg_urb, int desc_num)
+{
+	return dwc_otg_urb->iso_descs[desc_num].actual_length;
+}
+
+int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	int allocated = 0;
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+
+	if (qh) {
+		if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+			allocated = 1;
+		}
+	}
+	return allocated;
+}
+
+int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	int freed = 0;
+	DWC_ASSERT(qh, "qh is not allocated\n");
+
+	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+		freed = 1;
+	}
+
+	return freed;
+}
+
+uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	DWC_ASSERT(qh, "qh is not allocated\n");
+	return qh->usecs;
+}
+
+void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd)
+{
+#ifdef DEBUG
+	int num_channels;
+	int i;
+	gnptxsts_data_t np_tx_status;
+	hptxsts_data_t p_tx_status;
+
+	num_channels = hcd->core_if->core_params->host_channels;
+	DWC_PRINTF("\n");
+	DWC_PRINTF
+	    ("************************************************************\n");
+	DWC_PRINTF("HCD State:\n");
+	DWC_PRINTF("  Num channels: %d\n", num_channels);
+	for (i = 0; i < num_channels; i++) {
+		dwc_hc_t *hc = hcd->hc_ptr_array[i];
+		DWC_PRINTF("  Channel %d:\n", i);
+		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
+			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
+		DWC_PRINTF("    speed: %d\n", hc->speed);
+		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
+		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
+		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
+		DWC_PRINTF("    multi_count: %d\n", hc->multi_count);
+		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
+		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
+		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
+		DWC_PRINTF("    xfer_count: %d\n", hc->xfer_count);
+		DWC_PRINTF("    halt_on_queue: %d\n", hc->halt_on_queue);
+		DWC_PRINTF("    halt_pending: %d\n", hc->halt_pending);
+		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
+		DWC_PRINTF("    do_split: %d\n", hc->do_split);
+		DWC_PRINTF("    complete_split: %d\n", hc->complete_split);
+		DWC_PRINTF("    hub_addr: %d\n", hc->hub_addr);
+		DWC_PRINTF("    port_addr: %d\n", hc->port_addr);
+		DWC_PRINTF("    xact_pos: %d\n", hc->xact_pos);
+		DWC_PRINTF("    requests: %d\n", hc->requests);
+		DWC_PRINTF("    qh: %p\n", hc->qh);
+		if (hc->xfer_started) {
+			hfnum_data_t hfnum;
+			hcchar_data_t hcchar;
+			hctsiz_data_t hctsiz;
+			hcint_data_t hcint;
+			hcintmsk_data_t hcintmsk;
+			hfnum.d32 =
+			    DWC_READ_REG32(&hcd->core_if->
+					   host_if->host_global_regs->hfnum);
+			hcchar.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hcchar);
+			hctsiz.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hctsiz);
+			hcint.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hcint);
+			hcintmsk.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hcintmsk);
+			DWC_PRINTF("    hfnum: 0x%08x\n", hfnum.d32);
+			DWC_PRINTF("    hcchar: 0x%08x\n", hcchar.d32);
+			DWC_PRINTF("    hctsiz: 0x%08x\n", hctsiz.d32);
+			DWC_PRINTF("    hcint: 0x%08x\n", hcint.d32);
+			DWC_PRINTF("    hcintmsk: 0x%08x\n", hcintmsk.d32);
+		}
+		if (hc->xfer_started && hc->qh) {
+			dwc_otg_qtd_t *qtd;
+			dwc_otg_hcd_urb_t *urb;
+
+			DWC_CIRCLEQ_FOREACH(qtd, &hc->qh->qtd_list, qtd_list_entry) {
+				if (!qtd->in_process)
+					break;
+
+				urb = qtd->urb;
+			DWC_PRINTF("    URB Info:\n");
+			DWC_PRINTF("      qtd: %p, urb: %p\n", qtd, urb);
+			if (urb) {
+				DWC_PRINTF("      Dev: %d, EP: %d %s\n",
+					   dwc_otg_hcd_get_dev_addr(&urb->
+								    pipe_info),
+					   dwc_otg_hcd_get_ep_num(&urb->
+								  pipe_info),
+					   dwc_otg_hcd_is_pipe_in(&urb->
+								  pipe_info) ?
+					   "IN" : "OUT");
+				DWC_PRINTF("      Max packet size: %d\n",
+					   dwc_otg_hcd_get_mps(&urb->
+							       pipe_info));
+				DWC_PRINTF("      transfer_buffer: %p\n",
+					   urb->buf);
+				DWC_PRINTF("      transfer_dma: %p\n",
+					   (void *)urb->dma);
+				DWC_PRINTF("      transfer_buffer_length: %d\n",
+					   urb->length);
+					DWC_PRINTF("      actual_length: %d\n",
+						   urb->actual_length);
+				}
+			}
+		}
+	}
+	DWC_PRINTF("  non_periodic_channels: %d\n", hcd->non_periodic_channels);
+	DWC_PRINTF("  periodic_channels: %d\n", hcd->periodic_channels);
+	DWC_PRINTF("  periodic_usecs: %d\n", hcd->periodic_usecs);
+	np_tx_status.d32 =
+	    DWC_READ_REG32(&hcd->core_if->core_global_regs->gnptxsts);
+	DWC_PRINTF("  NP Tx Req Queue Space Avail: %d\n",
+		   np_tx_status.b.nptxqspcavail);
+	DWC_PRINTF("  NP Tx FIFO Space Avail: %d\n",
+		   np_tx_status.b.nptxfspcavail);
+	p_tx_status.d32 =
+	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hptxsts);
+	DWC_PRINTF("  P Tx Req Queue Space Avail: %d\n",
+		   p_tx_status.b.ptxqspcavail);
+	DWC_PRINTF("  P Tx FIFO Space Avail: %d\n", p_tx_status.b.ptxfspcavail);
+	dwc_otg_hcd_dump_frrem(hcd);
+	dwc_otg_dump_global_registers(hcd->core_if);
+	dwc_otg_dump_host_registers(hcd->core_if);
+	DWC_PRINTF
+	    ("************************************************************\n");
+	DWC_PRINTF("\n");
+#endif
+}
+
+#ifdef DEBUG
+void dwc_print_setup_data(uint8_t * setup)
+{
+	int i;
+	if (CHK_DEBUG_LEVEL(DBG_HCD)) {
+		DWC_PRINTF("Setup Data = MSB ");
+		for (i = 7; i >= 0; i--)
+			DWC_PRINTF("%02x ", setup[i]);
+		DWC_PRINTF("\n");
+		DWC_PRINTF("  bmRequestType Tranfer = %s\n",
+			   (setup[0] & 0x80) ? "Device-to-Host" :
+			   "Host-to-Device");
+		DWC_PRINTF("  bmRequestType Type = ");
+		switch ((setup[0] & 0x60) >> 5) {
+		case 0:
+			DWC_PRINTF("Standard\n");
+			break;
+		case 1:
+			DWC_PRINTF("Class\n");
+			break;
+		case 2:
+			DWC_PRINTF("Vendor\n");
+			break;
+		case 3:
+			DWC_PRINTF("Reserved\n");
+			break;
+		}
+		DWC_PRINTF("  bmRequestType Recipient = ");
+		switch (setup[0] & 0x1f) {
+		case 0:
+			DWC_PRINTF("Device\n");
+			break;
+		case 1:
+			DWC_PRINTF("Interface\n");
+			break;
+		case 2:
+			DWC_PRINTF("Endpoint\n");
+			break;
+		case 3:
+			DWC_PRINTF("Other\n");
+			break;
+		default:
+			DWC_PRINTF("Reserved\n");
+			break;
+		}
+		DWC_PRINTF("  bRequest = 0x%0x\n", setup[1]);
+		DWC_PRINTF("  wValue = 0x%0x\n", *((uint16_t *) & setup[2]));
+		DWC_PRINTF("  wIndex = 0x%0x\n", *((uint16_t *) & setup[4]));
+		DWC_PRINTF("  wLength = 0x%0x\n\n", *((uint16_t *) & setup[6]));
+	}
+}
+#endif
+
+void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd)
+{
+#if 0
+	DWC_PRINTF("Frame remaining at SOF:\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->frrem_samples, hcd->frrem_accum,
+		   (hcd->frrem_samples > 0) ?
+		   hcd->frrem_accum / hcd->frrem_samples : 0);
+
+	DWC_PRINTF("\n");
+	DWC_PRINTF("Frame remaining at start_transfer (uframe 7):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->core_if->hfnum_7_samples,
+		   hcd->core_if->hfnum_7_frrem_accum,
+		   (hcd->core_if->hfnum_7_samples >
+		    0) ? hcd->core_if->hfnum_7_frrem_accum /
+		   hcd->core_if->hfnum_7_samples : 0);
+	DWC_PRINTF("Frame remaining at start_transfer (uframe 0):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->core_if->hfnum_0_samples,
+		   hcd->core_if->hfnum_0_frrem_accum,
+		   (hcd->core_if->hfnum_0_samples >
+		    0) ? hcd->core_if->hfnum_0_frrem_accum /
+		   hcd->core_if->hfnum_0_samples : 0);
+	DWC_PRINTF("Frame remaining at start_transfer (uframe 1-6):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->core_if->hfnum_other_samples,
+		   hcd->core_if->hfnum_other_frrem_accum,
+		   (hcd->core_if->hfnum_other_samples >
+		    0) ? hcd->core_if->hfnum_other_frrem_accum /
+		   hcd->core_if->hfnum_other_samples : 0);
+
+	DWC_PRINTF("\n");
+	DWC_PRINTF("Frame remaining at sample point A (uframe 7):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_7_samples_a, hcd->hfnum_7_frrem_accum_a,
+		   (hcd->hfnum_7_samples_a > 0) ?
+		   hcd->hfnum_7_frrem_accum_a / hcd->hfnum_7_samples_a : 0);
+	DWC_PRINTF("Frame remaining at sample point A (uframe 0):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_0_samples_a, hcd->hfnum_0_frrem_accum_a,
+		   (hcd->hfnum_0_samples_a > 0) ?
+		   hcd->hfnum_0_frrem_accum_a / hcd->hfnum_0_samples_a : 0);
+	DWC_PRINTF("Frame remaining at sample point A (uframe 1-6):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_other_samples_a, hcd->hfnum_other_frrem_accum_a,
+		   (hcd->hfnum_other_samples_a > 0) ?
+		   hcd->hfnum_other_frrem_accum_a /
+		   hcd->hfnum_other_samples_a : 0);
+
+	DWC_PRINTF("\n");
+	DWC_PRINTF("Frame remaining at sample point B (uframe 7):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_7_samples_b, hcd->hfnum_7_frrem_accum_b,
+		   (hcd->hfnum_7_samples_b > 0) ?
+		   hcd->hfnum_7_frrem_accum_b / hcd->hfnum_7_samples_b : 0);
+	DWC_PRINTF("Frame remaining at sample point B (uframe 0):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_0_samples_b, hcd->hfnum_0_frrem_accum_b,
+		   (hcd->hfnum_0_samples_b > 0) ?
+		   hcd->hfnum_0_frrem_accum_b / hcd->hfnum_0_samples_b : 0);
+	DWC_PRINTF("Frame remaining at sample point B (uframe 1-6):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_other_samples_b, hcd->hfnum_other_frrem_accum_b,
+		   (hcd->hfnum_other_samples_b > 0) ?
+		   hcd->hfnum_other_frrem_accum_b /
+		   hcd->hfnum_other_samples_b : 0);
+#endif
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.h b/drivers/usb/host/dwc_otg/dwc_otg_hcd.h
new file mode 100644
index 0000000000000..5ed8dccf03959
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.h
@@ -0,0 +1,870 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.h $
+ * $Revision: #58 $
+ * $Date: 2011/09/15 $
+ * $Change: 1846647 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+#ifndef __DWC_HCD_H__
+#define __DWC_HCD_H__
+
+#include "dwc_otg_os_dep.h"
+#include "usb.h"
+#include "dwc_otg_hcd_if.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_list.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_fiq_fsm.h"
+#include "dwc_otg_driver.h"
+
+
+/**
+ * @file
+ *
+ * This file contains the structures, constants, and interfaces for
+ * the Host Contoller Driver (HCD).
+ *
+ * The Host Controller Driver (HCD) is responsible for translating requests
+ * from the USB Driver into the appropriate actions on the DWC_otg controller.
+ * It isolates the USBD from the specifics of the controller by providing an
+ * API to the USBD.
+ */
+
+struct dwc_otg_hcd_pipe_info {
+	uint8_t dev_addr;
+	uint8_t ep_num;
+	uint8_t pipe_type;
+	uint8_t pipe_dir;
+	uint16_t mps;
+};
+
+struct dwc_otg_hcd_iso_packet_desc {
+	uint32_t offset;
+	uint32_t length;
+	uint32_t actual_length;
+	uint32_t status;
+};
+
+struct dwc_otg_qtd;
+
+struct dwc_otg_hcd_urb {
+	void *priv;
+	struct dwc_otg_qtd *qtd;
+	void *buf;
+	dwc_dma_t dma;
+	void *setup_packet;
+	dwc_dma_t setup_dma;
+	uint32_t length;
+	uint32_t actual_length;
+	uint32_t status;
+	uint32_t error_count;
+	uint32_t packet_count;
+	uint32_t flags;
+	uint16_t interval;
+	struct dwc_otg_hcd_pipe_info pipe_info;
+	struct dwc_otg_hcd_iso_packet_desc iso_descs[0];
+};
+
+static inline uint8_t dwc_otg_hcd_get_ep_num(struct dwc_otg_hcd_pipe_info *pipe)
+{
+	return pipe->ep_num;
+}
+
+static inline uint8_t dwc_otg_hcd_get_pipe_type(struct dwc_otg_hcd_pipe_info
+						*pipe)
+{
+	return pipe->pipe_type;
+}
+
+static inline uint16_t dwc_otg_hcd_get_mps(struct dwc_otg_hcd_pipe_info *pipe)
+{
+	return pipe->mps;
+}
+
+static inline uint8_t dwc_otg_hcd_get_dev_addr(struct dwc_otg_hcd_pipe_info
+					       *pipe)
+{
+	return pipe->dev_addr;
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_isoc(struct dwc_otg_hcd_pipe_info
+					       *pipe)
+{
+	return (pipe->pipe_type == UE_ISOCHRONOUS);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_int(struct dwc_otg_hcd_pipe_info
+					      *pipe)
+{
+	return (pipe->pipe_type == UE_INTERRUPT);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_bulk(struct dwc_otg_hcd_pipe_info
+					       *pipe)
+{
+	return (pipe->pipe_type == UE_BULK);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_control(struct dwc_otg_hcd_pipe_info
+						  *pipe)
+{
+	return (pipe->pipe_type == UE_CONTROL);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_in(struct dwc_otg_hcd_pipe_info *pipe)
+{
+	return (pipe->pipe_dir == UE_DIR_IN);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_out(struct dwc_otg_hcd_pipe_info
+					      *pipe)
+{
+	return (!dwc_otg_hcd_is_pipe_in(pipe));
+}
+
+static inline void dwc_otg_hcd_fill_pipe(struct dwc_otg_hcd_pipe_info *pipe,
+					 uint8_t devaddr, uint8_t ep_num,
+					 uint8_t pipe_type, uint8_t pipe_dir,
+					 uint16_t mps)
+{
+	pipe->dev_addr = devaddr;
+	pipe->ep_num = ep_num;
+	pipe->pipe_type = pipe_type;
+	pipe->pipe_dir = pipe_dir;
+	pipe->mps = mps;
+}
+
+/**
+ * Phases for control transfers.
+ */
+typedef enum dwc_otg_control_phase {
+	DWC_OTG_CONTROL_SETUP,
+	DWC_OTG_CONTROL_DATA,
+	DWC_OTG_CONTROL_STATUS
+} dwc_otg_control_phase_e;
+
+/** Transaction types. */
+typedef enum dwc_otg_transaction_type {
+	DWC_OTG_TRANSACTION_NONE          = 0,
+	DWC_OTG_TRANSACTION_PERIODIC      = 1,
+	DWC_OTG_TRANSACTION_NON_PERIODIC  = 2,
+	DWC_OTG_TRANSACTION_ALL           = DWC_OTG_TRANSACTION_PERIODIC + DWC_OTG_TRANSACTION_NON_PERIODIC
+} dwc_otg_transaction_type_e;
+
+struct dwc_otg_qh;
+
+/**
+ * A Queue Transfer Descriptor (QTD) holds the state of a bulk, control,
+ * interrupt, or isochronous transfer. A single QTD is created for each URB
+ * (of one of these types) submitted to the HCD. The transfer associated with
+ * a QTD may require one or multiple transactions.
+ *
+ * A QTD is linked to a Queue Head, which is entered in either the
+ * non-periodic or periodic schedule for execution. When a QTD is chosen for
+ * execution, some or all of its transactions may be executed. After
+ * execution, the state of the QTD is updated. The QTD may be retired if all
+ * its transactions are complete or if an error occurred. Otherwise, it
+ * remains in the schedule so more transactions can be executed later.
+ */
+typedef struct dwc_otg_qtd {
+	/**
+	 * Determines the PID of the next data packet for the data phase of
+	 * control transfers. Ignored for other transfer types.<br>
+	 * One of the following values:
+	 *	- DWC_OTG_HC_PID_DATA0
+	 *	- DWC_OTG_HC_PID_DATA1
+	 */
+	uint8_t data_toggle;
+
+	/** Current phase for control transfers (Setup, Data, or Status). */
+	dwc_otg_control_phase_e control_phase;
+
+	/** Keep track of the current split type
+	 * for FS/LS endpoints on a HS Hub */
+	uint8_t complete_split;
+
+	/** How many bytes transferred during SSPLIT OUT */
+	uint32_t ssplit_out_xfer_count;
+
+	/**
+	 * Holds the number of bus errors that have occurred for a transaction
+	 * within this transfer.
+	 */
+	uint8_t error_count;
+
+	/**
+	 * Index of the next frame descriptor for an isochronous transfer. A
+	 * frame descriptor describes the buffer position and length of the
+	 * data to be transferred in the next scheduled (micro)frame of an
+	 * isochronous transfer. It also holds status for that transaction.
+	 * The frame index starts at 0.
+	 */
+	uint16_t isoc_frame_index;
+
+	/** Position of the ISOC split on full/low speed */
+	uint8_t isoc_split_pos;
+
+	/** Position of the ISOC split in the buffer for the current frame */
+	uint16_t isoc_split_offset;
+
+	/** URB for this transfer */
+	struct dwc_otg_hcd_urb *urb;
+
+	struct dwc_otg_qh *qh;
+
+	/** This list of QTDs */
+	 DWC_CIRCLEQ_ENTRY(dwc_otg_qtd) qtd_list_entry;
+
+	/** Indicates if this QTD is currently processed by HW. */
+	uint8_t in_process;
+
+	/** Number of DMA descriptors for this QTD */
+	uint8_t n_desc;
+
+	/**
+	 * Last activated frame(packet) index.
+	 * Used in Descriptor DMA mode only.
+	 */
+	uint16_t isoc_frame_index_last;
+
+} dwc_otg_qtd_t;
+
+DWC_CIRCLEQ_HEAD(dwc_otg_qtd_list, dwc_otg_qtd);
+
+/**
+ * A Queue Head (QH) holds the static characteristics of an endpoint and
+ * maintains a list of transfers (QTDs) for that endpoint. A QH structure may
+ * be entered in either the non-periodic or periodic schedule.
+ */
+typedef struct dwc_otg_qh {
+	/**
+	 * Endpoint type.
+	 * One of the following values:
+	 *	- UE_CONTROL
+	 *	- UE_BULK
+	 *	- UE_INTERRUPT
+	 *	- UE_ISOCHRONOUS
+	 */
+	uint8_t ep_type;
+	uint8_t ep_is_in;
+
+	/** wMaxPacketSize Field of Endpoint Descriptor. */
+	uint16_t maxp;
+
+	/**
+	 * Device speed.
+	 * One of the following values:
+	 *	- DWC_OTG_EP_SPEED_LOW
+	 *	- DWC_OTG_EP_SPEED_FULL
+	 *	- DWC_OTG_EP_SPEED_HIGH
+	 */
+	uint8_t dev_speed;
+
+	/**
+	 * Determines the PID of the next data packet for non-control
+	 * transfers. Ignored for control transfers.<br>
+	 * One of the following values:
+	 *	- DWC_OTG_HC_PID_DATA0
+	 *	- DWC_OTG_HC_PID_DATA1
+	 */
+	uint8_t data_toggle;
+
+	/** Ping state if 1. */
+	uint8_t ping_state;
+
+	/**
+	 * List of QTDs for this QH.
+	 */
+	struct dwc_otg_qtd_list qtd_list;
+
+	/** Host channel currently processing transfers for this QH. */
+	struct dwc_hc *channel;
+
+	/** Full/low speed endpoint on high-speed hub requires split. */
+	uint8_t do_split;
+
+	/** @name Periodic schedule information */
+	/** @{ */
+
+	/** Bandwidth in microseconds per (micro)frame. */
+	uint16_t usecs;
+
+	/** Interval between transfers in (micro)frames. */
+	uint16_t interval;
+
+	/**
+	 * (micro)frame to initialize a periodic transfer. The transfer
+	 * executes in the following (micro)frame.
+	 */
+	uint16_t sched_frame;
+
+	/*
+	** Frame a NAK was received on this queue head, used to minimise NAK retransmission
+	*/
+	uint16_t nak_frame;
+
+	/** (micro)frame at which last start split was initialized. */
+	uint16_t start_split_frame;
+
+	/** @} */
+
+	/**
+	 * Used instead of original buffer if
+	 * it(physical address) is not dword-aligned.
+	 */
+	uint8_t *dw_align_buf;
+	dwc_dma_t dw_align_buf_dma;
+
+	/** Entry for QH in either the periodic or non-periodic schedule. */
+	dwc_list_link_t qh_list_entry;
+
+	/** @name Descriptor DMA support */
+	/** @{ */
+
+	/** Descriptor List. */
+	dwc_otg_host_dma_desc_t *desc_list;
+
+	/** Descriptor List physical address. */
+	dwc_dma_t desc_list_dma;
+
+	/**
+	 * Xfer Bytes array.
+	 * Each element corresponds to a descriptor and indicates
+	 * original XferSize size value for the descriptor.
+	 */
+	uint32_t *n_bytes;
+
+	/** Actual number of transfer descriptors in a list. */
+	uint16_t ntd;
+
+	/** First activated isochronous transfer descriptor index. */
+	uint8_t td_first;
+	/** Last activated isochronous transfer descriptor index. */
+	uint8_t td_last;
+
+	/** @} */
+
+
+	uint16_t speed;
+	uint16_t frame_usecs[8];
+
+	uint32_t skip_count;
+} dwc_otg_qh_t;
+
+DWC_CIRCLEQ_HEAD(hc_list, dwc_hc);
+
+typedef struct urb_tq_entry {
+	struct urb *urb;
+	DWC_TAILQ_ENTRY(urb_tq_entry) urb_tq_entries;
+} urb_tq_entry_t;
+
+DWC_TAILQ_HEAD(urb_list, urb_tq_entry);
+
+/**
+ * This structure holds the state of the HCD, including the non-periodic and
+ * periodic schedules.
+ */
+struct dwc_otg_hcd {
+	/** The DWC otg device pointer */
+	struct dwc_otg_device *otg_dev;
+	/** DWC OTG Core Interface Layer */
+	dwc_otg_core_if_t *core_if;
+
+	/** Function HCD driver callbacks */
+	struct dwc_otg_hcd_function_ops *fops;
+
+	/** Internal DWC HCD Flags */
+	volatile union dwc_otg_hcd_internal_flags {
+		uint32_t d32;
+		struct {
+			unsigned port_connect_status_change:1;
+			unsigned port_connect_status:1;
+			unsigned port_reset_change:1;
+			unsigned port_enable_change:1;
+			unsigned port_suspend_change:1;
+			unsigned port_over_current_change:1;
+			unsigned port_l1_change:1;
+			unsigned port_speed:2;
+			unsigned reserved:24;
+		} b;
+	} flags;
+
+	/**
+	 * Inactive items in the non-periodic schedule. This is a list of
+	 * Queue Heads. Transfers associated with these Queue Heads are not
+	 * currently assigned to a host channel.
+	 */
+	dwc_list_link_t non_periodic_sched_inactive;
+
+	/**
+	 * Active items in the non-periodic schedule. This is a list of
+	 * Queue Heads. Transfers associated with these Queue Heads are
+	 * currently assigned to a host channel.
+	 */
+	dwc_list_link_t non_periodic_sched_active;
+
+	/**
+	 * Pointer to the next Queue Head to process in the active
+	 * non-periodic schedule.
+	 */
+	dwc_list_link_t *non_periodic_qh_ptr;
+
+	/**
+	 * Inactive items in the periodic schedule. This is a list of QHs for
+	 * periodic transfers that are _not_ scheduled for the next frame.
+	 * Each QH in the list has an interval counter that determines when it
+	 * needs to be scheduled for execution. This scheduling mechanism
+	 * allows only a simple calculation for periodic bandwidth used (i.e.
+	 * must assume that all periodic transfers may need to execute in the
+	 * same frame). However, it greatly simplifies scheduling and should
+	 * be sufficient for the vast majority of OTG hosts, which need to
+	 * connect to a small number of peripherals at one time.
+	 *
+	 * Items move from this list to periodic_sched_ready when the QH
+	 * interval counter is 0 at SOF.
+	 */
+	dwc_list_link_t periodic_sched_inactive;
+
+	/**
+	 * List of periodic QHs that are ready for execution in the next
+	 * frame, but have not yet been assigned to host channels.
+	 *
+	 * Items move from this list to periodic_sched_assigned as host
+	 * channels become available during the current frame.
+	 */
+	dwc_list_link_t periodic_sched_ready;
+
+	/**
+	 * List of periodic QHs to be executed in the next frame that are
+	 * assigned to host channels.
+	 *
+	 * Items move from this list to periodic_sched_queued as the
+	 * transactions for the QH are queued to the DWC_otg controller.
+	 */
+	dwc_list_link_t periodic_sched_assigned;
+
+	/**
+	 * List of periodic QHs that have been queued for execution.
+	 *
+	 * Items move from this list to either periodic_sched_inactive or
+	 * periodic_sched_ready when the channel associated with the transfer
+	 * is released. If the interval for the QH is 1, the item moves to
+	 * periodic_sched_ready because it must be rescheduled for the next
+	 * frame. Otherwise, the item moves to periodic_sched_inactive.
+	 */
+	dwc_list_link_t periodic_sched_queued;
+
+	/**
+	 * Total bandwidth claimed so far for periodic transfers. This value
+	 * is in microseconds per (micro)frame. The assumption is that all
+	 * periodic transfers may occur in the same (micro)frame.
+	 */
+	uint16_t periodic_usecs;
+
+	/**
+	 * Total bandwidth claimed so far for all periodic transfers
+	 * in a frame.
+	 * This will include a mixture of HS and FS transfers.
+	 * Units are microseconds per (micro)frame.
+	 * We have a budget per frame and have to schedule
+	 * transactions accordingly.
+	 * Watch out for the fact that things are actually scheduled for the
+	 * "next frame".
+	 */
+	uint16_t                frame_usecs[8];
+
+
+	/**
+	 * Frame number read from the core at SOF. The value ranges from 0 to
+	 * DWC_HFNUM_MAX_FRNUM.
+	 */
+	uint16_t frame_number;
+
+	/**
+	 * Count of periodic QHs, if using several eps. For SOF enable/disable.
+	 */
+	uint16_t periodic_qh_count;
+
+	/**
+	 * Free host channels in the controller. This is a list of
+	 * dwc_hc_t items.
+	 */
+	struct hc_list free_hc_list;
+	/**
+	 * Number of host channels assigned to periodic transfers. Currently
+	 * assuming that there is a dedicated host channel for each periodic
+	 * transaction and at least one host channel available for
+	 * non-periodic transactions.
+	 */
+	int periodic_channels; /* microframe_schedule==0 */
+
+	/**
+	 * Number of host channels assigned to non-periodic transfers.
+	 */
+	int non_periodic_channels; /* microframe_schedule==0 */
+
+	/**
+	 * Number of host channels assigned to non-periodic transfers.
+	 */
+	int available_host_channels;
+
+	/**
+	 * Array of pointers to the host channel descriptors. Allows accessing
+	 * a host channel descriptor given the host channel number. This is
+	 * useful in interrupt handlers.
+	 */
+	struct dwc_hc *hc_ptr_array[MAX_EPS_CHANNELS];
+
+	/**
+	 * Buffer to use for any data received during the status phase of a
+	 * control transfer. Normally no data is transferred during the status
+	 * phase. This buffer is used as a bit bucket.
+	 */
+	uint8_t *status_buf;
+
+	/**
+	 * DMA address for status_buf.
+	 */
+	dma_addr_t status_buf_dma;
+#define DWC_OTG_HCD_STATUS_BUF_SIZE 64
+
+	/**
+	 * Connection timer. An OTG host must display a message if the device
+	 * does not connect. Started when the VBus power is turned on via
+	 * sysfs attribute "buspower".
+	 */
+	dwc_timer_t *conn_timer;
+
+	/* Tasket to do a reset */
+	dwc_tasklet_t *reset_tasklet;
+
+	dwc_tasklet_t *completion_tasklet;
+	struct urb_list completed_urb_list;
+
+	/*  */
+	dwc_spinlock_t *lock;
+	/**
+	 * Private data that could be used by OS wrapper.
+	 */
+	void *priv;
+
+	uint8_t otg_port;
+
+	/** Frame List */
+	uint32_t *frame_list;
+
+	/** Hub - Port assignment */
+	int hub_port[128];
+#ifdef FIQ_DEBUG
+	int hub_port_alloc[2048];
+#endif
+
+	/** Frame List DMA address */
+	dma_addr_t frame_list_dma;
+
+	struct fiq_stack *fiq_stack;
+	struct fiq_state *fiq_state;
+
+	/** Virtual address for split transaction DMA bounce buffers */
+	struct fiq_dma_blob *fiq_dmab;
+
+#ifdef DEBUG
+	uint32_t frrem_samples;
+	uint64_t frrem_accum;
+
+	uint32_t hfnum_7_samples_a;
+	uint64_t hfnum_7_frrem_accum_a;
+	uint32_t hfnum_0_samples_a;
+	uint64_t hfnum_0_frrem_accum_a;
+	uint32_t hfnum_other_samples_a;
+	uint64_t hfnum_other_frrem_accum_a;
+
+	uint32_t hfnum_7_samples_b;
+	uint64_t hfnum_7_frrem_accum_b;
+	uint32_t hfnum_0_samples_b;
+	uint64_t hfnum_0_frrem_accum_b;
+	uint32_t hfnum_other_samples_b;
+	uint64_t hfnum_other_frrem_accum_b;
+#endif
+};
+
+static inline struct device *dwc_otg_hcd_to_dev(struct dwc_otg_hcd *hcd)
+{
+	return &hcd->otg_dev->os_dep.platformdev->dev;
+}
+
+/** @name Transaction Execution Functions */
+/** @{ */
+extern dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t
+								  * hcd);
+extern void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
+					   dwc_otg_transaction_type_e tr_type);
+
+int dwc_otg_hcd_allocate_port(dwc_otg_hcd_t * hcd, dwc_otg_qh_t *qh);
+void dwc_otg_hcd_release_port(dwc_otg_hcd_t * dwc_otg_hcd, dwc_otg_qh_t *qh);
+
+extern int fiq_fsm_queue_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
+extern int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
+extern void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num);
+
+/** @} */
+
+/** @name Interrupt Handler Functions */
+/** @{ */
+extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t *
+							 dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t *
+							dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t *
+							   dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_incomplete_periodic_intr(dwc_otg_hcd_t *
+							   dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_conn_id_status_change_intr(dwc_otg_hcd_t *
+							     dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_disconnect_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd,
+					    uint32_t num);
+extern int32_t dwc_otg_hcd_handle_session_req_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_wakeup_detected_intr(dwc_otg_hcd_t *
+						       dwc_otg_hcd);
+/** @} */
+
+/** @name Schedule Queue Functions */
+/** @{ */
+
+/* Implemented in dwc_otg_hcd_queue.c */
+extern dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
+					   dwc_otg_hcd_urb_t * urb, int atomic_alloc);
+extern void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+				      int sched_csplit);
+
+/** Remove and free a QH */
+static inline void dwc_otg_hcd_qh_remove_and_free(dwc_otg_hcd_t * hcd,
+						  dwc_otg_qh_t * qh)
+{
+	dwc_irqflags_t flags;
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	dwc_otg_hcd_qh_remove(hcd, qh);
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	dwc_otg_hcd_qh_free(hcd, qh);
+}
+
+/** Allocates memory for a QH structure.
+ * @return Returns the memory allocate or NULL on error. */
+static inline dwc_otg_qh_t *dwc_otg_hcd_qh_alloc(int atomic_alloc)
+{
+	if (atomic_alloc)
+		return (dwc_otg_qh_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qh_t));
+	else
+		return (dwc_otg_qh_t *) DWC_ALLOC(sizeof(dwc_otg_qh_t));
+}
+
+extern dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb,
+					     int atomic_alloc);
+extern void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb);
+extern int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd, dwc_otg_hcd_t * dwc_otg_hcd,
+			       dwc_otg_qh_t ** qh, int atomic_alloc);
+
+/** Allocates memory for a QTD structure.
+ * @return Returns the memory allocate or NULL on error. */
+static inline dwc_otg_qtd_t *dwc_otg_hcd_qtd_alloc(int atomic_alloc)
+{
+	if (atomic_alloc)
+		return (dwc_otg_qtd_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qtd_t));
+	else
+		return (dwc_otg_qtd_t *) DWC_ALLOC(sizeof(dwc_otg_qtd_t));
+}
+
+/** Frees the memory for a QTD structure.  QTD should already be removed from
+ * list.
+ * @param qtd QTD to free.*/
+static inline void dwc_otg_hcd_qtd_free(dwc_otg_qtd_t * qtd)
+{
+	DWC_FREE(qtd);
+}
+
+/** Removes a QTD from list.
+ * @param hcd HCD instance.
+ * @param qtd QTD to remove from list.
+ * @param qh QTD belongs to.
+ */
+static inline void dwc_otg_hcd_qtd_remove(dwc_otg_hcd_t * hcd,
+					  dwc_otg_qtd_t * qtd,
+					  dwc_otg_qh_t * qh)
+{
+	DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
+}
+
+/** Remove and free a QTD
+  * Need to disable IRQ and hold hcd lock while calling this function out of
+  * interrupt servicing chain */
+static inline void dwc_otg_hcd_qtd_remove_and_free(dwc_otg_hcd_t * hcd,
+						   dwc_otg_qtd_t * qtd,
+						   dwc_otg_qh_t * qh)
+{
+	dwc_otg_hcd_qtd_remove(hcd, qtd, qh);
+	dwc_otg_hcd_qtd_free(qtd);
+}
+
+/** @} */
+
+/** @name Descriptor DMA Supporting Functions */
+/** @{ */
+
+extern void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
+					   dwc_hc_t * hc,
+					   dwc_otg_hc_regs_t * hc_regs,
+					   dwc_otg_halt_status_e halt_status);
+
+extern int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+
+/** @} */
+
+/** @name Internal Functions */
+/** @{ */
+dwc_otg_qh_t *dwc_urb_to_qh(dwc_otg_hcd_urb_t * urb);
+/** @} */
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+extern int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd,
+					   uint8_t devaddr);
+extern void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd);
+#endif
+
+/** Gets the QH that contains the list_head */
+#define dwc_list_to_qh(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qh_t, qh_list_entry)
+
+/** Gets the QTD that contains the list_head */
+#define dwc_list_to_qtd(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qtd_t, qtd_list_entry)
+
+/** Check if QH is non-periodic  */
+#define dwc_qh_is_non_per(_qh_ptr_) ((_qh_ptr_->ep_type == UE_BULK) || \
+				     (_qh_ptr_->ep_type == UE_CONTROL))
+
+/** High bandwidth multiplier as encoded in highspeed endpoint descriptors */
+#define dwc_hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
+
+/** Packet size for any kind of endpoint descriptor */
+#define dwc_max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
+
+/**
+ * Returns true if _frame1 is less than or equal to _frame2. The comparison is
+ * done modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the
+ * frame number when the max frame number is reached.
+ */
+static inline int dwc_frame_num_le(uint16_t frame1, uint16_t frame2)
+{
+	return ((frame2 - frame1) & DWC_HFNUM_MAX_FRNUM) <=
+	    (DWC_HFNUM_MAX_FRNUM >> 1);
+}
+
+/**
+ * Returns true if _frame1 is greater than _frame2. The comparison is done
+ * modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the frame
+ * number when the max frame number is reached.
+ */
+static inline int dwc_frame_num_gt(uint16_t frame1, uint16_t frame2)
+{
+	return (frame1 != frame2) &&
+	    (((frame1 - frame2) & DWC_HFNUM_MAX_FRNUM) <
+	     (DWC_HFNUM_MAX_FRNUM >> 1));
+}
+
+/**
+ * Increments _frame by the amount specified by _inc. The addition is done
+ * modulo DWC_HFNUM_MAX_FRNUM. Returns the incremented value.
+ */
+static inline uint16_t dwc_frame_num_inc(uint16_t frame, uint16_t inc)
+{
+	return (frame + inc) & DWC_HFNUM_MAX_FRNUM;
+}
+
+static inline uint16_t dwc_full_frame_num(uint16_t frame)
+{
+	return (frame & DWC_HFNUM_MAX_FRNUM) >> 3;
+}
+
+static inline uint16_t dwc_micro_frame_num(uint16_t frame)
+{
+	return frame & 0x7;
+}
+
+extern void init_hcd_usecs(dwc_otg_hcd_t *_hcd);
+
+void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
+				  dwc_otg_hc_regs_t * hc_regs,
+				  dwc_otg_qtd_t * qtd);
+
+#ifdef DEBUG
+/**
+ * Macro to sample the remaining PHY clocks left in the current frame. This
+ * may be used during debugging to determine the average time it takes to
+ * execute sections of code. There are two possible sample points, "a" and
+ * "b", so the _letter argument must be one of these values.
+ *
+ * To dump the average sample times, read the "hcd_frrem" sysfs attribute. For
+ * example, "cat /sys/devices/lm0/hcd_frrem".
+ */
+#define dwc_sample_frrem(_hcd, _qh, _letter) \
+{ \
+	hfnum_data_t hfnum; \
+	dwc_otg_qtd_t *qtd; \
+	qtd = list_entry(_qh->qtd_list.next, dwc_otg_qtd_t, qtd_list_entry); \
+	if (usb_pipeint(qtd->urb->pipe) && _qh->start_split_frame != 0 && !qtd->complete_split) { \
+		hfnum.d32 = DWC_READ_REG32(&_hcd->core_if->host_if->host_global_regs->hfnum); \
+		switch (hfnum.b.frnum & 0x7) { \
+		case 7: \
+			_hcd->hfnum_7_samples_##_letter++; \
+			_hcd->hfnum_7_frrem_accum_##_letter += hfnum.b.frrem; \
+			break; \
+		case 0: \
+			_hcd->hfnum_0_samples_##_letter++; \
+			_hcd->hfnum_0_frrem_accum_##_letter += hfnum.b.frrem; \
+			break; \
+		default: \
+			_hcd->hfnum_other_samples_##_letter++; \
+			_hcd->hfnum_other_frrem_accum_##_letter += hfnum.b.frrem; \
+			break; \
+		} \
+	} \
+}
+#else
+#define dwc_sample_frrem(_hcd, _qh, _letter)
+#endif
+#endif
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
new file mode 100644
index 0000000000000..bd8a204037134
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
@@ -0,0 +1,1134 @@
+/*==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_ddma.c $
+ * $Revision: #10 $
+ * $Date: 2011/10/20 $
+ * $Change: 1869464 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/** @file
+ * This file contains Descriptor DMA support implementation for host mode.
+ */
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+
+extern bool microframe_schedule;
+
+static inline uint8_t frame_list_idx(uint16_t frame)
+{
+	return (frame & (MAX_FRLIST_EN_NUM - 1));
+}
+
+static inline uint16_t desclist_idx_inc(uint16_t idx, uint16_t inc, uint8_t speed)
+{
+	return (idx + inc) &
+	    (((speed ==
+	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
+	      MAX_DMA_DESC_NUM_GENERIC) - 1);
+}
+
+static inline uint16_t desclist_idx_dec(uint16_t idx, uint16_t inc, uint8_t speed)
+{
+	return (idx - inc) &
+	    (((speed ==
+	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
+	      MAX_DMA_DESC_NUM_GENERIC) - 1);
+}
+
+static inline uint16_t max_desc_num(dwc_otg_qh_t * qh)
+{
+	return (((qh->ep_type == UE_ISOCHRONOUS)
+		 && (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH))
+		? MAX_DMA_DESC_NUM_HS_ISOC : MAX_DMA_DESC_NUM_GENERIC);
+}
+static inline uint16_t frame_incr_val(dwc_otg_qh_t * qh)
+{
+	return ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH)
+		? ((qh->interval + 8 - 1) / 8)
+		: qh->interval);
+}
+
+static int desc_list_alloc(struct device *dev, dwc_otg_qh_t * qh)
+{
+	int retval = 0;
+
+	qh->desc_list = (dwc_otg_host_dma_desc_t *)
+	    DWC_DMA_ALLOC(dev, sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh),
+			  &qh->desc_list_dma);
+
+	if (!qh->desc_list) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR("%s: DMA descriptor list allocation failed\n", __func__);
+
+	}
+
+	dwc_memset(qh->desc_list, 0x00,
+		   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
+
+	qh->n_bytes =
+	    (uint32_t *) DWC_ALLOC(sizeof(uint32_t) * max_desc_num(qh));
+
+	if (!qh->n_bytes) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR
+		    ("%s: Failed to allocate array for descriptors' size actual values\n",
+		     __func__);
+
+	}
+	return retval;
+
+}
+
+static void desc_list_free(struct device *dev, dwc_otg_qh_t * qh)
+{
+	if (qh->desc_list) {
+		DWC_DMA_FREE(dev, max_desc_num(qh), qh->desc_list,
+			     qh->desc_list_dma);
+		qh->desc_list = NULL;
+	}
+
+	if (qh->n_bytes) {
+		DWC_FREE(qh->n_bytes);
+		qh->n_bytes = NULL;
+	}
+}
+
+static int frame_list_alloc(dwc_otg_hcd_t * hcd)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+	int retval = 0;
+
+	if (hcd->frame_list)
+		return 0;
+
+	hcd->frame_list = DWC_DMA_ALLOC(dev, 4 * MAX_FRLIST_EN_NUM,
+					&hcd->frame_list_dma);
+	if (!hcd->frame_list) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR("%s: Frame List allocation failed\n", __func__);
+	}
+
+	dwc_memset(hcd->frame_list, 0x00, 4 * MAX_FRLIST_EN_NUM);
+
+	return retval;
+}
+
+static void frame_list_free(dwc_otg_hcd_t * hcd)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	if (!hcd->frame_list)
+		return;
+
+	DWC_DMA_FREE(dev, 4 * MAX_FRLIST_EN_NUM, hcd->frame_list, hcd->frame_list_dma);
+	hcd->frame_list = NULL;
+}
+
+static void per_sched_enable(dwc_otg_hcd_t * hcd, uint16_t fr_list_en)
+{
+
+	hcfg_data_t hcfg;
+
+	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
+
+	if (hcfg.b.perschedena) {
+		/* already enabled */
+		return;
+	}
+
+	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hflbaddr,
+			hcd->frame_list_dma);
+
+	switch (fr_list_en) {
+	case 64:
+		hcfg.b.frlisten = 3;
+		break;
+	case 32:
+		hcfg.b.frlisten = 2;
+		break;
+	case 16:
+		hcfg.b.frlisten = 1;
+		break;
+	case 8:
+		hcfg.b.frlisten = 0;
+		break;
+	default:
+		break;
+	}
+
+	hcfg.b.perschedena = 1;
+
+	DWC_DEBUGPL(DBG_HCD, "Enabling Periodic schedule\n");
+	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+
+}
+
+static void per_sched_disable(dwc_otg_hcd_t * hcd)
+{
+	hcfg_data_t hcfg;
+
+	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
+
+	if (!hcfg.b.perschedena) {
+		/* already disabled */
+		return;
+	}
+	hcfg.b.perschedena = 0;
+
+	DWC_DEBUGPL(DBG_HCD, "Disabling Periodic schedule\n");
+	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+}
+
+/*
+ * Activates/Deactivates FrameList entries for the channel
+ * based on endpoint servicing period.
+ */
+void update_frame_list(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, uint8_t enable)
+{
+	uint16_t i, j, inc;
+	dwc_hc_t *hc = NULL;
+
+	if (!qh->channel) {
+		DWC_ERROR("qh->channel = %p", qh->channel);
+		return;
+	}
+
+	if (!hcd) {
+		DWC_ERROR("------hcd = %p", hcd);
+		return;
+	}
+
+	if (!hcd->frame_list) {
+		DWC_ERROR("-------hcd->frame_list = %p", hcd->frame_list);
+		return;
+	}
+
+	hc = qh->channel;
+	inc = frame_incr_val(qh);
+	if (qh->ep_type == UE_ISOCHRONOUS)
+		i = frame_list_idx(qh->sched_frame);
+	else
+		i = 0;
+
+	j = i;
+	do {
+		if (enable)
+			hcd->frame_list[j] |= (1 << hc->hc_num);
+		else
+			hcd->frame_list[j] &= ~(1 << hc->hc_num);
+		j = (j + inc) & (MAX_FRLIST_EN_NUM - 1);
+	}
+	while (j != i);
+	if (!enable)
+		return;
+	hc->schinfo = 0;
+	if (qh->channel->speed == DWC_OTG_EP_SPEED_HIGH) {
+		j = 1;
+		/* TODO - check this */
+		inc = (8 + qh->interval - 1) / qh->interval;
+		for (i = 0; i < inc; i++) {
+			hc->schinfo |= j;
+			j = j << qh->interval;
+		}
+	} else {
+		hc->schinfo = 0xff;
+	}
+}
+
+#if 1
+void dump_frame_list(dwc_otg_hcd_t * hcd)
+{
+	int i = 0;
+	DWC_PRINTF("--FRAME LIST (hex) --\n");
+	for (i = 0; i < MAX_FRLIST_EN_NUM; i++) {
+		DWC_PRINTF("%x\t", hcd->frame_list[i]);
+		if (!(i % 8) && i)
+			DWC_PRINTF("\n");
+	}
+	DWC_PRINTF("\n----\n");
+
+}
+#endif
+
+static void release_channel_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	dwc_hc_t *hc = qh->channel;
+	if (dwc_qh_is_non_per(qh)) {
+		if (!microframe_schedule)
+			hcd->non_periodic_channels--;
+		else
+			hcd->available_host_channels++;
+	} else
+		update_frame_list(hcd, qh, 0);
+
+	/*
+	 * The condition is added to prevent double cleanup try in case of device
+	 * disconnect. See channel cleanup in dwc_otg_hcd_disconnect_cb().
+	 */
+	if (hc->qh) {
+		dwc_otg_hc_cleanup(hcd->core_if, hc);
+		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
+		hc->qh = NULL;
+	}
+
+	qh->channel = NULL;
+	qh->ntd = 0;
+
+	if (qh->desc_list) {
+		dwc_memset(qh->desc_list, 0x00,
+			   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
+	}
+}
+
+/**
+ * Initializes a QH structure's Descriptor DMA related members.
+ * Allocates memory for descriptor list.
+ * On first periodic QH, allocates memory for FrameList
+ * and enables periodic scheduling.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh The QH to init.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+	int retval = 0;
+
+	if (qh->do_split) {
+		DWC_ERROR("SPLIT Transfers are not supported in Descriptor DMA.\n");
+		return -1;
+	}
+
+	retval = desc_list_alloc(dev, qh);
+
+	if ((retval == 0)
+	    && (qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)) {
+		if (!hcd->frame_list) {
+			retval = frame_list_alloc(hcd);
+			/* Enable periodic schedule on first periodic QH */
+			if (retval == 0)
+				per_sched_enable(hcd, MAX_FRLIST_EN_NUM);
+		}
+	}
+
+	qh->ntd = 0;
+
+	return retval;
+}
+
+/**
+ * Frees descriptor list memory associated with the QH.
+ * If QH is periodic and the last, frees FrameList memory
+ * and disables periodic scheduling.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh The QH to init.
+ */
+void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	desc_list_free(dev, qh);
+
+	/*
+	 * Channel still assigned due to some reasons.
+	 * Seen on Isoc URB dequeue. Channel halted but no subsequent
+	 * ChHalted interrupt to release the channel. Afterwards
+	 * when it comes here from endpoint disable routine
+	 * channel remains assigned.
+	 */
+	if (qh->channel)
+		release_channel_ddma(hcd, qh);
+
+	if ((qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)
+	    && (microframe_schedule || !hcd->periodic_channels) && hcd->frame_list) {
+
+		per_sched_disable(hcd);
+		frame_list_free(hcd);
+	}
+}
+
+static uint8_t frame_to_desc_idx(dwc_otg_qh_t * qh, uint16_t frame_idx)
+{
+	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
+		/*
+		 * Descriptor set(8 descriptors) index
+		 * which is 8-aligned.
+		 */
+		return (frame_idx & ((MAX_DMA_DESC_NUM_HS_ISOC / 8) - 1)) * 8;
+	} else {
+		return (frame_idx & (MAX_DMA_DESC_NUM_GENERIC - 1));
+	}
+}
+
+/*
+ * Determine starting frame for Isochronous transfer.
+ * Few frames skipped to prevent race condition with HC.
+ */
+static uint8_t calc_starting_frame(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+				   uint8_t * skip_frames)
+{
+	uint16_t frame = 0;
+	hcd->frame_number = dwc_otg_hcd_get_frame_number(hcd);
+
+	/* sched_frame is always frame number(not uFrame) both in FS and HS !! */
+
+	/*
+	 * skip_frames is used to limit activated descriptors number
+	 * to avoid the situation when HC services the last activated
+	 * descriptor firstly.
+	 * Example for FS:
+	 * Current frame is 1, scheduled frame is 3. Since HC always fetches the descriptor
+	 * corresponding to curr_frame+1, the descriptor corresponding to frame 2
+	 * will be fetched. If the number of descriptors is max=64 (or greather) the
+	 * list will be fully programmed with Active descriptors and it is possible
+	 * case(rare) that the latest descriptor(considering rollback) corresponding
+	 * to frame 2 will be serviced first. HS case is more probable because, in fact,
+	 * up to 11 uframes(16 in the code) may be skipped.
+	 */
+	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
+		/*
+		 * Consider uframe counter also, to start xfer asap.
+		 * If half of the frame elapsed skip 2 frames otherwise
+		 * just 1 frame.
+		 * Starting descriptor index must be 8-aligned, so
+		 * if the current frame is near to complete the next one
+		 * is skipped as well.
+		 */
+
+		if (dwc_micro_frame_num(hcd->frame_number) >= 5) {
+			*skip_frames = 2 * 8;
+			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
+		} else {
+			*skip_frames = 1 * 8;
+			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
+		}
+
+		frame = dwc_full_frame_num(frame);
+	} else {
+		/*
+		 * Two frames are skipped for FS - the current and the next.
+		 * But for descriptor programming, 1 frame(descriptor) is enough,
+		 * see example above.
+		 */
+		*skip_frames = 1;
+		frame = dwc_frame_num_inc(hcd->frame_number, 2);
+	}
+
+	return frame;
+}
+
+/*
+ * Calculate initial descriptor index for isochronous transfer
+ * based on scheduled frame.
+ */
+static uint8_t recalc_initial_desc_idx(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	uint16_t frame = 0, fr_idx, fr_idx_tmp;
+	uint8_t skip_frames = 0;
+	/*
+	 * With current ISOC processing algorithm the channel is being
+	 * released when no more QTDs in the list(qh->ntd == 0).
+	 * Thus this function is called only when qh->ntd == 0 and qh->channel == 0.
+	 *
+	 * So qh->channel != NULL branch is not used and just not removed from the
+	 * source file. It is required for another possible approach which is,
+	 * do not disable and release the channel when ISOC session completed,
+	 * just move QH to inactive schedule until new QTD arrives.
+	 * On new QTD, the QH moved back to 'ready' schedule,
+	 * starting frame and therefore starting desc_index are recalculated.
+	 * In this case channel is released only on ep_disable.
+	 */
+
+	/* Calculate starting descriptor index. For INTERRUPT endpoint it is always 0. */
+	if (qh->channel) {
+		frame = calc_starting_frame(hcd, qh, &skip_frames);
+		/*
+		 * Calculate initial descriptor index based on FrameList current bitmap
+		 * and servicing period.
+		 */
+		fr_idx_tmp = frame_list_idx(frame);
+		fr_idx =
+		    (MAX_FRLIST_EN_NUM + frame_list_idx(qh->sched_frame) -
+		     fr_idx_tmp)
+		    % frame_incr_val(qh);
+		fr_idx = (fr_idx + fr_idx_tmp) % MAX_FRLIST_EN_NUM;
+	} else {
+		qh->sched_frame = calc_starting_frame(hcd, qh, &skip_frames);
+		fr_idx = frame_list_idx(qh->sched_frame);
+	}
+
+	qh->td_first = qh->td_last = frame_to_desc_idx(qh, fr_idx);
+
+	return skip_frames;
+}
+
+#define	ISOC_URB_GIVEBACK_ASAP
+
+#define MAX_ISOC_XFER_SIZE_FS 1023
+#define MAX_ISOC_XFER_SIZE_HS 3072
+#define DESCNUM_THRESHOLD 4
+
+static void init_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+			       uint8_t skip_frames)
+{
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+	dwc_otg_qtd_t *qtd;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	uint16_t idx, inc, n_desc, ntd_max, max_xfer_size;
+
+	idx = qh->td_last;
+	inc = qh->interval;
+	n_desc = 0;
+
+	ntd_max = (max_desc_num(qh) + qh->interval - 1) / qh->interval;
+	if (skip_frames && !qh->channel)
+		ntd_max = ntd_max - skip_frames / qh->interval;
+
+	max_xfer_size =
+	    (qh->dev_speed ==
+	     DWC_OTG_EP_SPEED_HIGH) ? MAX_ISOC_XFER_SIZE_HS :
+	    MAX_ISOC_XFER_SIZE_FS;
+
+	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
+		while ((qh->ntd < ntd_max)
+		       && (qtd->isoc_frame_index_last <
+			   qtd->urb->packet_count)) {
+
+			dma_desc = &qh->desc_list[idx];
+			dwc_memset(dma_desc, 0x00, sizeof(dwc_otg_host_dma_desc_t));
+
+			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
+
+			if (frame_desc->length > max_xfer_size)
+				qh->n_bytes[idx] = max_xfer_size;
+			else
+				qh->n_bytes[idx] = frame_desc->length;
+			dma_desc->status.b_isoc.n_bytes = qh->n_bytes[idx];
+			dma_desc->status.b_isoc.a = 1;
+			dma_desc->status.b_isoc.sts = 0;
+
+			dma_desc->buf = qtd->urb->dma + frame_desc->offset;
+
+			qh->ntd++;
+
+			qtd->isoc_frame_index_last++;
+
+#ifdef	ISOC_URB_GIVEBACK_ASAP
+			/*
+			 * Set IOC for each descriptor corresponding to the
+			 * last frame of the URB.
+			 */
+			if (qtd->isoc_frame_index_last ==
+			    qtd->urb->packet_count)
+				dma_desc->status.b_isoc.ioc = 1;
+
+#endif
+			idx = desclist_idx_inc(idx, inc, qh->dev_speed);
+			n_desc++;
+
+		}
+		qtd->in_process = 1;
+	}
+
+	qh->td_last = idx;
+
+#ifdef	ISOC_URB_GIVEBACK_ASAP
+	/* Set IOC for the last descriptor if descriptor list is full */
+	if (qh->ntd == ntd_max) {
+		idx = desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
+		qh->desc_list[idx].status.b_isoc.ioc = 1;
+	}
+#else
+	/*
+	 * Set IOC bit only for one descriptor.
+	 * Always try to be ahead of HW processing,
+	 * i.e. on IOC generation driver activates next descriptors but
+	 * core continues to process descriptors followed the one with IOC set.
+	 */
+
+	if (n_desc > DESCNUM_THRESHOLD) {
+		/*
+		 * Move IOC "up". Required even if there is only one QTD
+		 * in the list, cause QTDs migth continue to be queued,
+		 * but during the activation it was only one queued.
+		 * Actually more than one QTD might be in the list if this function called
+		 * from XferCompletion - QTDs was queued during HW processing of the previous
+		 * descriptor chunk.
+		 */
+		idx = dwc_desclist_idx_dec(idx, inc * ((qh->ntd + 1) / 2), qh->dev_speed);
+	} else {
+		/*
+		 * Set the IOC for the latest descriptor
+		 * if either number of descriptor is not greather than threshold
+		 * or no more new descriptors activated.
+		 */
+		idx = dwc_desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
+	}
+
+	qh->desc_list[idx].status.b_isoc.ioc = 1;
+#endif
+}
+
+static void init_non_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+
+	dwc_hc_t *hc;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	dwc_otg_qtd_t *qtd;
+	int num_packets, len, n_desc = 0;
+
+	hc = qh->channel;
+
+	/*
+	 * Start with hc->xfer_buff initialized in
+	 * assign_and_init_hc(), then if SG transfer consists of multiple URBs,
+	 * this pointer re-assigned to the buffer of the currently processed QTD.
+	 * For non-SG request there is always one QTD active.
+	 */
+
+	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
+
+		if (n_desc) {
+			/* SG request - more than 1 QTDs */
+			hc->xfer_buff = (uint8_t *)qtd->urb->dma + qtd->urb->actual_length;
+			hc->xfer_len = qtd->urb->length - qtd->urb->actual_length;
+		}
+
+		qtd->n_desc = 0;
+
+		do {
+			dma_desc = &qh->desc_list[n_desc];
+			len = hc->xfer_len;
+
+			if (len > MAX_DMA_DESC_SIZE)
+				len = MAX_DMA_DESC_SIZE - hc->max_packet + 1;
+
+			if (hc->ep_is_in) {
+				if (len > 0) {
+					num_packets = (len + hc->max_packet - 1) / hc->max_packet;
+				} else {
+					/* Need 1 packet for transfer length of 0. */
+					num_packets = 1;
+				}
+				/* Always program an integral # of max packets for IN transfers. */
+				len = num_packets * hc->max_packet;
+			}
+
+			dma_desc->status.b.n_bytes = len;
+
+			qh->n_bytes[n_desc] = len;
+
+			if ((qh->ep_type == UE_CONTROL)
+			    && (qtd->control_phase == DWC_OTG_CONTROL_SETUP))
+				dma_desc->status.b.sup = 1;	/* Setup Packet */
+
+			dma_desc->status.b.a = 1;	/* Active descriptor */
+			dma_desc->status.b.sts = 0;
+
+			dma_desc->buf =
+			    ((unsigned long)hc->xfer_buff & 0xffffffff);
+
+			/*
+			 * Last descriptor(or single) of IN transfer
+			 * with actual size less than MaxPacket.
+			 */
+			if (len > hc->xfer_len) {
+				hc->xfer_len = 0;
+			} else {
+				hc->xfer_buff += len;
+				hc->xfer_len -= len;
+			}
+
+			qtd->n_desc++;
+			n_desc++;
+		}
+		while ((hc->xfer_len > 0) && (n_desc != MAX_DMA_DESC_NUM_GENERIC));
+
+
+		qtd->in_process = 1;
+
+		if (qh->ep_type == UE_CONTROL)
+			break;
+
+		if (n_desc == MAX_DMA_DESC_NUM_GENERIC)
+			break;
+	}
+
+	if (n_desc) {
+		/* Request Transfer Complete interrupt for the last descriptor */
+		qh->desc_list[n_desc - 1].status.b.ioc = 1;
+		/* End of List indicator */
+		qh->desc_list[n_desc - 1].status.b.eol = 1;
+
+		hc->ntd = n_desc;
+	}
+}
+
+/**
+ * For Control and Bulk endpoints initializes descriptor list
+ * and starts the transfer.
+ *
+ * For Interrupt and Isochronous endpoints initializes descriptor list
+ * then updates FrameList, marking appropriate entries as active.
+ * In case of Isochronous, the starting descriptor index is calculated based
+ * on the scheduled frame, but only on the first transfer descriptor within a session.
+ * Then starts the transfer via enabling the channel.
+ * For Isochronous endpoint the channel is not halted on XferComplete
+ * interrupt so remains assigned to the endpoint(QH) until session is done.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh The QH to init.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	/* Channel is already assigned */
+	dwc_hc_t *hc = qh->channel;
+	uint8_t skip_frames = 0;
+
+	switch (hc->ep_type) {
+	case DWC_OTG_EP_TYPE_CONTROL:
+	case DWC_OTG_EP_TYPE_BULK:
+		init_non_isoc_dma_desc(hcd, qh);
+
+		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
+		break;
+	case DWC_OTG_EP_TYPE_INTR:
+		init_non_isoc_dma_desc(hcd, qh);
+
+		update_frame_list(hcd, qh, 1);
+
+		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
+		break;
+	case DWC_OTG_EP_TYPE_ISOC:
+
+		if (!qh->ntd)
+			skip_frames = recalc_initial_desc_idx(hcd, qh);
+
+		init_isoc_dma_desc(hcd, qh, skip_frames);
+
+		if (!hc->xfer_started) {
+
+			update_frame_list(hcd, qh, 1);
+
+			/*
+			 * Always set to max, instead of actual size.
+			 * Otherwise ntd will be changed with
+			 * channel being enabled. Not recommended.
+			 *
+			 */
+			hc->ntd = max_desc_num(qh);
+			/* Enable channel only once for ISOC */
+			dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
+		}
+
+		break;
+	default:
+
+		break;
+	}
+}
+
+static void complete_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
+				    dwc_hc_t * hc,
+				    dwc_otg_hc_regs_t * hc_regs,
+				    dwc_otg_halt_status_e halt_status)
+{
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+	dwc_otg_qh_t *qh;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	uint16_t idx, remain;
+	uint8_t urb_compl;
+
+	qh = hc->qh;
+	idx = qh->td_first;
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry)
+		    qtd->in_process = 0;
+		return;
+	} else if ((halt_status == DWC_OTG_HC_XFER_AHB_ERR) ||
+		   (halt_status == DWC_OTG_HC_XFER_BABBLE_ERR)) {
+		/*
+		 * Channel is halted in these error cases.
+		 * Considered as serious issues.
+		 * Complete all URBs marking all frames as failed,
+		 * irrespective whether some of the descriptors(frames) succeeded or no.
+		 * Pass error code to completion routine as well, to
+		 * update urb->status, some of class drivers might use it to stop
+		 * queing transfer requests.
+		 */
+		int err = (halt_status == DWC_OTG_HC_XFER_AHB_ERR)
+		    ? (-DWC_E_IO)
+		    : (-DWC_E_OVERFLOW);
+
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
+			for (idx = 0; idx < qtd->urb->packet_count; idx++) {
+				frame_desc = &qtd->urb->iso_descs[idx];
+				frame_desc->status = err;
+			}
+			hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, err);
+			dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+		}
+		return;
+	}
+
+	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
+
+		if (!qtd->in_process)
+			break;
+
+		urb_compl = 0;
+
+		do {
+
+			dma_desc = &qh->desc_list[idx];
+
+			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			remain = hc->ep_is_in ? dma_desc->status.b_isoc.n_bytes : 0;
+
+			if (dma_desc->status.b_isoc.sts == DMA_DESC_STS_PKTERR) {
+				/*
+				 * XactError or, unable to complete all the transactions
+				 * in the scheduled micro-frame/frame,
+				 * both indicated by DMA_DESC_STS_PKTERR.
+				 */
+				qtd->urb->error_count++;
+				frame_desc->actual_length = qh->n_bytes[idx] - remain;
+				frame_desc->status = -DWC_E_PROTOCOL;
+			} else {
+				/* Success */
+
+				frame_desc->actual_length = qh->n_bytes[idx] - remain;
+				frame_desc->status = 0;
+			}
+
+			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+				/*
+				 * urb->status is not used for isoc transfers here.
+				 * The individual frame_desc status are used instead.
+				 */
+
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+
+				/*
+				 * This check is necessary because urb_dequeue can be called
+				 * from urb complete callback(sound driver example).
+				 * All pending URBs are dequeued there, so no need for
+				 * further processing.
+				 */
+				if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+					return;
+				}
+
+				urb_compl = 1;
+
+			}
+
+			qh->ntd--;
+
+			/* Stop if IOC requested descriptor reached */
+			if (dma_desc->status.b_isoc.ioc) {
+				idx = desclist_idx_inc(idx, qh->interval, hc->speed);
+				goto stop_scan;
+			}
+
+			idx = desclist_idx_inc(idx, qh->interval, hc->speed);
+
+			if (urb_compl)
+				break;
+		}
+		while (idx != qh->td_first);
+	}
+stop_scan:
+	qh->td_first = idx;
+}
+
+uint8_t update_non_isoc_urb_state_ddma(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_host_dma_desc_t * dma_desc,
+				       dwc_otg_halt_status_e halt_status,
+				       uint32_t n_bytes, uint8_t * xfer_done)
+{
+
+	uint16_t remain = hc->ep_is_in ? dma_desc->status.b.n_bytes : 0;
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+
+	if (halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
+		urb->status = -DWC_E_IO;
+		return 1;
+	}
+	if (dma_desc->status.b.sts == DMA_DESC_STS_PKTERR) {
+		switch (halt_status) {
+		case DWC_OTG_HC_XFER_STALL:
+			urb->status = -DWC_E_PIPE;
+			break;
+		case DWC_OTG_HC_XFER_BABBLE_ERR:
+			urb->status = -DWC_E_OVERFLOW;
+			break;
+		case DWC_OTG_HC_XFER_XACT_ERR:
+			urb->status = -DWC_E_PROTOCOL;
+			break;
+		default:
+			DWC_ERROR("%s: Unhandled descriptor error status (%d)\n", __func__,
+				  halt_status);
+			break;
+		}
+		return 1;
+	}
+
+	if (dma_desc->status.b.a == 1) {
+		DWC_DEBUGPL(DBG_HCDV,
+			    "Active descriptor encountered on channel %d\n",
+			    hc->hc_num);
+		return 0;
+	}
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL) {
+		if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
+			urb->actual_length += n_bytes - remain;
+			if (remain || urb->actual_length == urb->length) {
+				/*
+				 * For Control Data stage do not set urb->status=0 to prevent
+				 * URB callback. Set it when Status phase done. See below.
+				 */
+				*xfer_done = 1;
+			}
+
+		} else if (qtd->control_phase == DWC_OTG_CONTROL_STATUS) {
+			urb->status = 0;
+			*xfer_done = 1;
+		}
+		/* No handling for SETUP stage */
+	} else {
+		/* BULK and INTR */
+		urb->actual_length += n_bytes - remain;
+		if (remain || urb->actual_length == urb->length) {
+			urb->status = 0;
+			*xfer_done = 1;
+		}
+	}
+
+	return 0;
+}
+
+static void complete_non_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
+					dwc_hc_t * hc,
+					dwc_otg_hc_regs_t * hc_regs,
+					dwc_otg_halt_status_e halt_status)
+{
+	dwc_otg_hcd_urb_t *urb = NULL;
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+	dwc_otg_qh_t *qh;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	uint32_t n_bytes, n_desc, i;
+	uint8_t failed = 0, xfer_done;
+
+	n_desc = 0;
+
+	qh = hc->qh;
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
+			qtd->in_process = 0;
+		}
+		return;
+	}
+
+	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
+
+		urb = qtd->urb;
+
+		n_bytes = 0;
+		xfer_done = 0;
+
+		for (i = 0; i < qtd->n_desc; i++) {
+			dma_desc = &qh->desc_list[n_desc];
+
+			n_bytes = qh->n_bytes[n_desc];
+
+			failed =
+			    update_non_isoc_urb_state_ddma(hcd, hc, qtd,
+							   dma_desc,
+							   halt_status, n_bytes,
+							   &xfer_done);
+
+			if (failed
+			    || (xfer_done
+				&& (urb->status != -DWC_E_IN_PROGRESS))) {
+
+				hcd->fops->complete(hcd, urb->priv, urb,
+						    urb->status);
+				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+
+				if (failed)
+					goto stop_scan;
+			} else if (qh->ep_type == UE_CONTROL) {
+				if (qtd->control_phase == DWC_OTG_CONTROL_SETUP) {
+					if (urb->length > 0) {
+						qtd->control_phase = DWC_OTG_CONTROL_DATA;
+					} else {
+						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
+					}
+					DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction done\n");
+				} else if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
+					if (xfer_done) {
+						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
+						DWC_DEBUGPL(DBG_HCDV, "  Control data transfer done\n");
+					} else if (i + 1 == qtd->n_desc) {
+						/*
+						 * Last descriptor for Control data stage which is
+						 * not completed yet.
+						 */
+						dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+					}
+				}
+			}
+
+			n_desc++;
+		}
+
+	}
+
+stop_scan:
+
+	if (qh->ep_type != UE_CONTROL) {
+		/*
+		 * Resetting the data toggle for bulk
+		 * and interrupt endpoints in case of stall. See handle_hc_stall_intr()
+		 */
+		if (halt_status == DWC_OTG_HC_XFER_STALL)
+			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+		else
+			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+	}
+
+	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
+		hcint_data_t hcint;
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+		if (hcint.b.nyet) {
+			/*
+			 * Got a NYET on the last transaction of the transfer. It
+			 * means that the endpoint should be in the PING state at the
+			 * beginning of the next transfer.
+			 */
+			qh->ping_state = 1;
+			clear_hc_int(hc_regs, nyet);
+		}
+
+	}
+
+}
+
+/**
+ * This function is called from interrupt handlers.
+ * Scans the descriptor list, updates URB's status and
+ * calls completion routine for the URB if it's done.
+ * Releases the channel to be used by other transfers.
+ * In case of Isochronous endpoint the channel is not halted until
+ * the end of the session, i.e. QTD list is empty.
+ * If periodic channel released the FrameList is updated accordingly.
+ *
+ * Calls transaction selection routines to activate pending transfers.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param hc Host channel, the transfer is completed on.
+ * @param hc_regs Host channel registers.
+ * @param halt_status Reason the channel is being halted,
+ *		      or just XferComplete for isochronous transfer
+ */
+void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
+				    dwc_hc_t * hc,
+				    dwc_otg_hc_regs_t * hc_regs,
+				    dwc_otg_halt_status_e halt_status)
+{
+	uint8_t continue_isoc_xfer = 0;
+	dwc_otg_transaction_type_e tr_type;
+	dwc_otg_qh_t *qh = hc->qh;
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+
+		complete_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
+
+		/* Release the channel if halted or session completed */
+		if (halt_status != DWC_OTG_HC_XFER_COMPLETE ||
+		    DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+
+			/* Halt the channel if session completed */
+			if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
+				dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
+			}
+
+			release_channel_ddma(hcd, qh);
+			dwc_otg_hcd_qh_remove(hcd, qh);
+		} else {
+			/* Keep in assigned schedule to continue transfer */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
+					   &qh->qh_list_entry);
+			continue_isoc_xfer = 1;
+
+		}
+		/** @todo Consider the case when period exceeds FrameList size.
+		 *  Frame Rollover interrupt should be used.
+		 */
+	} else {
+		/* Scan descriptor list to complete the URB(s), then release the channel */
+		complete_non_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
+
+		release_channel_ddma(hcd, qh);
+		dwc_otg_hcd_qh_remove(hcd, qh);
+
+		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			/* Add back to inactive non-periodic schedule on normal completion */
+			dwc_otg_hcd_qh_add(hcd, qh);
+		}
+
+	}
+	tr_type = dwc_otg_hcd_select_transactions(hcd);
+	if (tr_type != DWC_OTG_TRANSACTION_NONE || continue_isoc_xfer) {
+		if (continue_isoc_xfer) {
+			if (tr_type == DWC_OTG_TRANSACTION_NONE) {
+				tr_type = DWC_OTG_TRANSACTION_PERIODIC;
+			} else if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC) {
+				tr_type = DWC_OTG_TRANSACTION_ALL;
+			}
+		}
+		dwc_otg_hcd_queue_transactions(hcd, tr_type);
+	}
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
new file mode 100644
index 0000000000000..fb57db09378f4
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
@@ -0,0 +1,417 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_if.h $
+ * $Revision: #12 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+#ifndef __DWC_HCD_IF_H__
+#define __DWC_HCD_IF_H__
+
+#include "dwc_otg_core_if.h"
+
+/** @file
+ * This file defines DWC_OTG HCD Core API.
+ */
+
+struct dwc_otg_hcd;
+typedef struct dwc_otg_hcd dwc_otg_hcd_t;
+
+struct dwc_otg_hcd_urb;
+typedef struct dwc_otg_hcd_urb dwc_otg_hcd_urb_t;
+
+/** @name HCD Function Driver Callbacks */
+/** @{ */
+
+/** This function is called whenever core switches to host mode. */
+typedef int (*dwc_otg_hcd_start_cb_t) (dwc_otg_hcd_t * hcd);
+
+/** This function is called when device has been disconnected */
+typedef int (*dwc_otg_hcd_disconnect_cb_t) (dwc_otg_hcd_t * hcd);
+
+/** Wrapper provides this function to HCD to core, so it can get hub information to which device is connected */
+typedef int (*dwc_otg_hcd_hub_info_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
+						   void *urb_handle,
+						   uint32_t * hub_addr,
+						   uint32_t * port_addr);
+/** Via this function HCD core gets device speed */
+typedef int (*dwc_otg_hcd_speed_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
+						void *urb_handle);
+
+/** This function is called when urb is completed */
+typedef int (*dwc_otg_hcd_complete_urb_cb_t) (dwc_otg_hcd_t * hcd,
+					      void *urb_handle,
+					      dwc_otg_hcd_urb_t * dwc_otg_urb,
+					      int32_t status);
+
+/** Via this function HCD core gets b_hnp_enable parameter */
+typedef int (*dwc_otg_hcd_get_b_hnp_enable) (dwc_otg_hcd_t * hcd);
+
+struct dwc_otg_hcd_function_ops {
+	dwc_otg_hcd_start_cb_t start;
+	dwc_otg_hcd_disconnect_cb_t disconnect;
+	dwc_otg_hcd_hub_info_from_urb_cb_t hub_info;
+	dwc_otg_hcd_speed_from_urb_cb_t speed;
+	dwc_otg_hcd_complete_urb_cb_t complete;
+	dwc_otg_hcd_get_b_hnp_enable get_b_hnp_enable;
+};
+/** @} */
+
+/** @name HCD Core API */
+/** @{ */
+/** This function allocates dwc_otg_hcd structure and returns pointer on it. */
+extern dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void);
+
+/** This function should be called to initiate HCD Core.
+ *
+ * @param hcd The HCD
+ * @param core_if The DWC_OTG Core
+ *
+ * Returns -DWC_E_NO_MEMORY if no enough memory.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if);
+
+/** Frees HCD
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd);
+
+/** This function should be called on every hardware interrupt.
+ *
+ * @param dwc_otg_hcd The HCD
+ *
+ * Returns non zero if interrupt is handled
+ * Return 0 if interrupt is not handled
+ */
+extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+
+/** This function is used to handle the fast interrupt
+ *
+ */
+extern void __attribute__ ((naked)) dwc_otg_hcd_handle_fiq(void);
+
+/**
+ * Returns private data set by
+ * dwc_otg_hcd_set_priv_data function.
+ *
+ * @param hcd The HCD
+ */
+extern void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd);
+
+/**
+ * Set private data.
+ *
+ * @param hcd The HCD
+ * @param priv_data pointer to be stored in private data
+ */
+extern void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data);
+
+/**
+ * This function initializes the HCD Core.
+ *
+ * @param hcd The HCD
+ * @param fops The Function Driver Operations data structure containing pointers to all callbacks.
+ *
+ * Returns -DWC_E_NO_DEVICE if Core is currently is in device mode.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
+			     struct dwc_otg_hcd_function_ops *fops);
+
+/**
+ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
+ * stopped.
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd);
+
+/**
+ * Handles hub class-specific requests.
+ *
+ * @param dwc_otg_hcd The HCD
+ * @param typeReq Request Type
+ * @param wValue wValue from control request
+ * @param wIndex wIndex from control request
+ * @param buf data buffer
+ * @param wLength data buffer length
+ *
+ * Returns -DWC_E_INVALID if invalid argument is passed
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
+				   uint16_t typeReq, uint16_t wValue,
+				   uint16_t wIndex, uint8_t * buf,
+				   uint16_t wLength);
+
+/**
+ * Returns otg port number.
+ *
+ * @param hcd The HCD
+ */
+extern uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd);
+
+/**
+ * Returns OTG version - either 1.3 or 2.0.
+ *
+ * @param core_if The core_if structure pointer
+ */
+extern uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if);
+
+/**
+ * Returns 1 if currently core is acting as B host, and 0 otherwise.
+ *
+ * @param hcd The HCD
+ */
+extern uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd);
+
+/**
+ * Returns current frame number.
+ *
+ * @param hcd The HCD
+ */
+extern int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * hcd);
+
+/**
+ * Dumps hcd state.
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd);
+
+/**
+ * Dump the average frame remaining at SOF. This can be used to
+ * determine average interrupt latency. Frame remaining is also shown for
+ * start transfer and two additional sample points.
+ * Currently this function is not implemented.
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd);
+
+/**
+ * Sends LPM transaction to the local device.
+ *
+ * @param hcd The HCD
+ * @param devaddr Device Address
+ * @param hird Host initiated resume duration
+ * @param bRemoteWake Value of bRemoteWake field in LPM transaction
+ *
+ * Returns negative value if sending LPM transaction was not succeeded.
+ * Returns 0 on success.
+ */
+extern int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr,
+				uint8_t hird, uint8_t bRemoteWake);
+
+/* URB interface */
+
+/**
+ * Allocates memory for dwc_otg_hcd_urb structure.
+ * Allocated memory should be freed by call of DWC_FREE.
+ *
+ * @param hcd The HCD
+ * @param iso_desc_count Count of ISOC descriptors
+ * @param atomic_alloc Specefies whether to perform atomic allocation.
+ */
+extern dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
+						int iso_desc_count,
+						int atomic_alloc);
+
+/**
+ * Set pipe information in URB.
+ *
+ * @param hcd_urb DWC_OTG URB
+ * @param devaddr Device Address
+ * @param ep_num Endpoint Number
+ * @param ep_type Endpoint Type
+ * @param ep_dir Endpoint Direction
+ * @param mps Max Packet Size
+ */
+extern void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * hcd_urb,
+					 uint8_t devaddr, uint8_t ep_num,
+					 uint8_t ep_type, uint8_t ep_dir,
+					 uint16_t mps);
+
+/* Transfer flags */
+#define URB_GIVEBACK_ASAP 0x1
+#define URB_SEND_ZERO_PACKET 0x2
+
+/**
+ * Sets dwc_otg_hcd_urb parameters.
+ *
+ * @param urb DWC_OTG URB allocated by dwc_otg_hcd_urb_alloc function.
+ * @param urb_handle Unique handle for request, this will be passed back
+ * to function driver in completion callback.
+ * @param buf The buffer for the data
+ * @param dma The DMA buffer for the data
+ * @param buflen Transfer length
+ * @param sp Buffer for setup data
+ * @param sp_dma DMA address of setup data buffer
+ * @param flags Transfer flags
+ * @param interval Polling interval for interrupt or isochronous transfers.
+ */
+extern void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * urb,
+				       void *urb_handle, void *buf,
+				       dwc_dma_t dma, uint32_t buflen, void *sp,
+				       dwc_dma_t sp_dma, uint32_t flags,
+				       uint16_t interval);
+
+/** Gets status from dwc_otg_hcd_urb
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb);
+
+/** Gets actual length from dwc_otg_hcd_urb
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t *
+						  dwc_otg_urb);
+
+/** Gets error count from dwc_otg_hcd_urb. Only for ISOC URBs
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t *
+						dwc_otg_urb);
+
+/** Set ISOC descriptor offset and length
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param desc_num ISOC descriptor number
+ * @param offset Offset from beginig of buffer.
+ * @param length Transaction length
+ */
+extern void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
+						int desc_num, uint32_t offset,
+						uint32_t length);
+
+/** Get status of ISOC descriptor, specified by desc_num
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param desc_num ISOC descriptor number
+ */
+extern uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t *
+						    dwc_otg_urb, int desc_num);
+
+/** Get actual length of ISOC descriptor, specified by desc_num
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param desc_num ISOC descriptor number
+ */
+extern uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
+							   dwc_otg_urb,
+							   int desc_num);
+
+/** Queue URB. After transfer is completes, the complete callback will be called with the URB status
+ *
+ * @param dwc_otg_hcd The HCD
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param ep_handle Out parameter for returning endpoint handle
+ * @param atomic_alloc Flag to do atomic allocation if needed
+ *
+ * Returns -DWC_E_NO_DEVICE if no device is connected.
+ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
+ * Returns 0 on success.
+ */
+extern int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * dwc_otg_hcd,
+				   dwc_otg_hcd_urb_t * dwc_otg_urb,
+				   void **ep_handle, int atomic_alloc);
+
+/** De-queue the specified URB
+ *
+ * @param dwc_otg_hcd The HCD
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * dwc_otg_hcd,
+				   dwc_otg_hcd_urb_t * dwc_otg_urb);
+
+/** Frees resources in the DWC_otg controller related to a given endpoint.
+ * Any URBs for the endpoint must already be dequeued.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
+ * @param retry Number of retries if there are queued transfers.
+ *
+ * Returns -DWC_E_INVALID if invalid arguments are passed.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
+					int retry);
+
+/* Resets the data toggle in qh structure. This function can be called from
+ * usb_clear_halt routine.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
+ *
+ * Returns -DWC_E_INVALID if invalid arguments are passed.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle);
+
+/** Returns 1 if status of specified port is changed and 0 otherwise.
+ *
+ * @param hcd The HCD
+ * @param port Port number
+ */
+extern int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port);
+
+/** Call this function to check if bandwidth was allocated for specified endpoint.
+ * Only for ISOC and INTERRUPT endpoints.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle
+ */
+extern int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd,
+					      void *ep_handle);
+
+/** Call this function to check if bandwidth was freed for specified endpoint.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle
+ */
+extern int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle);
+
+/** Returns bandwidth allocated for specified endpoint in microseconds.
+ * Only for ISOC and INTERRUPT endpoints.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle
+ */
+extern uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd,
+					    void *ep_handle);
+
+/** @} */
+
+#endif /* __DWC_HCD_IF_H__ */
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
new file mode 100644
index 0000000000000..082159b64b343
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
@@ -0,0 +1,2752 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_intr.c $
+ * $Revision: #89 $
+ * $Date: 2011/10/20 $
+ * $Change: 1869487 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+
+#include <linux/jiffies.h>
+#include <asm/fiq.h>
+
+
+extern bool microframe_schedule;
+
+/** @file
+ * This file contains the implementation of the HCD Interrupt handlers.
+ */
+
+int fiq_done, int_done;
+
+#ifdef FIQ_DEBUG
+char buffer[1000*16];
+int wptr;
+void notrace _fiq_print(FIQDBG_T dbg_lvl, char *fmt, ...)
+{
+	FIQDBG_T dbg_lvl_req = FIQDBG_PORTHUB;
+	va_list args;
+	char text[17];
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(dwc_regs_base + 0x408) };
+
+	if(dbg_lvl & dbg_lvl_req || dbg_lvl == FIQDBG_ERR)
+	{
+		local_fiq_disable();
+		snprintf(text, 9, "%4d%d:%d ", hfnum.b.frnum/8, hfnum.b.frnum%8, 8 - hfnum.b.frrem/937);
+		va_start(args, fmt);
+		vsnprintf(text+8, 9, fmt, args);
+		va_end(args);
+
+		memcpy(buffer + wptr, text, 16);
+		wptr = (wptr + 16) % sizeof(buffer);
+		local_fiq_enable();
+	}
+}
+#endif
+
+/** This function handles interrupts for the HCD. */
+int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	int retval = 0;
+	static int last_time;
+	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk;
+	hfnum_data_t hfnum;
+	haintmsk_data_t haintmsk;
+
+#ifdef DEBUG
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+
+#endif
+
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+
+	/* Exit from ISR if core is hibernated */
+	if (core_if->hibernation_suspend == 1) {
+		goto exit_handler_routine;
+	}
+	DWC_SPINLOCK(dwc_otg_hcd->lock);
+	/* Check if HOST Mode */
+	if (dwc_otg_is_host_mode(core_if)) {
+		if (fiq_enable) {
+			local_fiq_disable();
+			fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+			/* Pull in from the FIQ's disabled mask */
+			gintmsk.d32 = gintmsk.d32 | ~(dwc_otg_hcd->fiq_state->gintmsk_saved.d32);
+			dwc_otg_hcd->fiq_state->gintmsk_saved.d32 = ~0;
+		}
+
+		if (fiq_fsm_enable && ( 0x0000FFFF & ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint))) {
+			gintsts.b.hcintr = 1;
+		}
+
+		/* Danger will robinson: fake a SOF if necessary */
+		if (fiq_fsm_enable && (dwc_otg_hcd->fiq_state->gintmsk_saved.b.sofintr == 1)) {
+			gintsts.b.sofintr = 1;
+		}
+		gintsts.d32 &= gintmsk.d32;
+
+		if (fiq_enable) {
+			fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+			local_fiq_enable();
+		}
+
+		if (!gintsts.d32) {
+			goto exit_handler_routine;
+		}
+
+#ifdef DEBUG
+		// We should be OK doing this because the common interrupts should already have been serviced
+		/* Don't print debug message in the interrupt handler on SOF */
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+			DWC_DEBUGPL(DBG_HCDI, "\n");
+#endif
+
+#ifdef DEBUG
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+			DWC_DEBUGPL(DBG_HCDI,
+				    "DWC OTG HCD Interrupt Detected gintsts&gintmsk=0x%08x core_if=%p\n",
+				    gintsts.d32, core_if);
+#endif
+		hfnum.d32 = DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->hfnum);
+		if (gintsts.b.sofintr) {
+			retval |= dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd);
+		}
+
+		if (gintsts.b.rxstsqlvl) {
+			retval |=
+			    dwc_otg_hcd_handle_rx_status_q_level_intr
+			    (dwc_otg_hcd);
+		}
+		if (gintsts.b.nptxfempty) {
+			retval |=
+			    dwc_otg_hcd_handle_np_tx_fifo_empty_intr
+			    (dwc_otg_hcd);
+		}
+		if (gintsts.b.i2cintr) {
+			/** @todo Implement i2cintr handler. */
+		}
+		if (gintsts.b.portintr) {
+
+			gintmsk_data_t gintmsk = { .b.portintr = 1};
+			retval |= dwc_otg_hcd_handle_port_intr(dwc_otg_hcd);
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
+				fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
+			}
+		}
+		if (gintsts.b.hcintr) {
+			retval |= dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd);
+		}
+		if (gintsts.b.ptxfempty) {
+			retval |=
+			    dwc_otg_hcd_handle_perio_tx_fifo_empty_intr
+			    (dwc_otg_hcd);
+		}
+#ifdef DEBUG
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+		{
+			DWC_DEBUGPL(DBG_HCDI,
+				    "DWC OTG HCD Finished Servicing Interrupts\n");
+			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintsts=0x%08x\n",
+				    DWC_READ_REG32(&global_regs->gintsts));
+			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintmsk=0x%08x\n",
+				    DWC_READ_REG32(&global_regs->gintmsk));
+		}
+#endif
+
+#ifdef DEBUG
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+			DWC_DEBUGPL(DBG_HCDI, "\n");
+#endif
+
+	}
+
+exit_handler_routine:
+	if (fiq_enable)	{
+		gintmsk_data_t gintmsk_new;
+		haintmsk_data_t haintmsk_new;
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+		gintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->gintmsk_saved.d32;
+		if(fiq_fsm_enable)
+			haintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->haintmsk_saved.d32;
+		else
+			haintmsk_new.d32 = 0x0000FFFF;
+
+		/* The FIQ could have sneaked another interrupt in. If so, don't clear MPHI */
+		if ((gintmsk_new.d32 == ~0) && (haintmsk_new.d32 == 0x0000FFFF)) {
+				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.intstat, (1<<16));
+				if (dwc_otg_hcd->fiq_state->mphi_int_count >= 50) {
+					fiq_print(FIQDBG_INT, dwc_otg_hcd->fiq_state, "MPHI CLR");
+					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, ((1<<31) + (1<<16)));
+					while (!(DWC_READ_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & (1 << 17)))
+						;
+					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, (1<<31));
+					dwc_otg_hcd->fiq_state->mphi_int_count = 0;
+				}
+				int_done++;
+		}
+		haintmsk.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
+		/* Re-enable interrupts that the FIQ masked (first time round) */
+		FIQ_WRITE(dwc_otg_hcd->fiq_state->dwc_regs_base + GINTMSK, gintmsk.d32);
+		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+		local_fiq_enable();
+
+		if ((jiffies / HZ) > last_time) {
+			//dwc_otg_qh_t *qh;
+			//dwc_list_link_t *cur;
+			/* Once a second output the fiq and irq numbers, useful for debug */
+			last_time = jiffies / HZ;
+		//	 DWC_WARN("np_kick=%d AHC=%d sched_frame=%d cur_frame=%d int_done=%d fiq_done=%d",
+		//	dwc_otg_hcd->fiq_state->kick_np_queues, dwc_otg_hcd->available_host_channels,
+		//	dwc_otg_hcd->fiq_state->next_sched_frame, hfnum.b.frnum, int_done, dwc_otg_hcd->fiq_state->fiq_done);
+			 //printk(KERN_WARNING "Periodic queues:\n");
+		}
+	}
+
+	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
+	return retval;
+}
+
+#ifdef DWC_TRACK_MISSED_SOFS
+
+#warning Compiling code to track missed SOFs
+#define FRAME_NUM_ARRAY_SIZE 1000
+/**
+ * This function is for debug only.
+ */
+static inline void track_missed_sofs(uint16_t curr_frame_number)
+{
+	static uint16_t frame_num_array[FRAME_NUM_ARRAY_SIZE];
+	static uint16_t last_frame_num_array[FRAME_NUM_ARRAY_SIZE];
+	static int frame_num_idx = 0;
+	static uint16_t last_frame_num = DWC_HFNUM_MAX_FRNUM;
+	static int dumped_frame_num_array = 0;
+
+	if (frame_num_idx < FRAME_NUM_ARRAY_SIZE) {
+		if (((last_frame_num + 1) & DWC_HFNUM_MAX_FRNUM) !=
+		    curr_frame_number) {
+			frame_num_array[frame_num_idx] = curr_frame_number;
+			last_frame_num_array[frame_num_idx++] = last_frame_num;
+		}
+	} else if (!dumped_frame_num_array) {
+		int i;
+		DWC_PRINTF("Frame     Last Frame\n");
+		DWC_PRINTF("-----     ----------\n");
+		for (i = 0; i < FRAME_NUM_ARRAY_SIZE; i++) {
+			DWC_PRINTF("0x%04x    0x%04x\n",
+				   frame_num_array[i], last_frame_num_array[i]);
+		}
+		dumped_frame_num_array = 1;
+	}
+	last_frame_num = curr_frame_number;
+}
+#endif
+
+/**
+ * Handles the start-of-frame interrupt in host mode. Non-periodic
+ * transactions may be queued to the DWC_otg controller for the current
+ * (micro)frame. Periodic transactions may be queued to the controller for the
+ * next (micro)frame.
+ */
+int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * hcd)
+{
+	hfnum_data_t hfnum;
+	gintsts_data_t gintsts = { .d32 = 0 };
+	dwc_list_link_t *qh_entry;
+	dwc_otg_qh_t *qh;
+	dwc_otg_transaction_type_e tr_type;
+	int did_something = 0;
+	int32_t next_sched_frame = -1;
+
+	hfnum.d32 =
+	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
+
+#ifdef DEBUG_SOF
+	DWC_DEBUGPL(DBG_HCD, "--Start of Frame Interrupt--\n");
+#endif
+	hcd->frame_number = hfnum.b.frnum;
+
+#ifdef DEBUG
+	hcd->frrem_accum += hfnum.b.frrem;
+	hcd->frrem_samples++;
+#endif
+
+#ifdef DWC_TRACK_MISSED_SOFS
+	track_missed_sofs(hcd->frame_number);
+#endif
+	/* Determine whether any periodic QHs should be executed. */
+	qh_entry = DWC_LIST_FIRST(&hcd->periodic_sched_inactive);
+	while (qh_entry != &hcd->periodic_sched_inactive) {
+		qh = DWC_LIST_ENTRY(qh_entry, dwc_otg_qh_t, qh_list_entry);
+		qh_entry = qh_entry->next;
+		if (dwc_frame_num_le(qh->sched_frame, hcd->frame_number)) {
+
+			/*
+			 * Move QH to the ready list to be executed next
+			 * (micro)frame.
+			 */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
+					   &qh->qh_list_entry);
+
+			did_something = 1;
+		}
+		else
+		{
+			if(next_sched_frame < 0 || dwc_frame_num_le(qh->sched_frame, next_sched_frame))
+			{
+				next_sched_frame = qh->sched_frame;
+			}
+		}
+	}
+	if (fiq_enable)
+		hcd->fiq_state->next_sched_frame = next_sched_frame;
+
+	tr_type = dwc_otg_hcd_select_transactions(hcd);
+	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
+		dwc_otg_hcd_queue_transactions(hcd, tr_type);
+		did_something = 1;
+	}
+
+	/* Clear interrupt - but do not trample on the FIQ sof */
+	if (!fiq_fsm_enable) {
+		gintsts.b.sofintr = 1;
+		DWC_WRITE_REG32(&hcd->core_if->core_global_regs->gintsts, gintsts.d32);
+	}
+	return 1;
+}
+
+/** Handles the Rx Status Queue Level Interrupt, which indicates that there is at
+ * least one packet in the Rx FIFO.  The packets are moved from the FIFO to
+ * memory if the DWC_otg controller is operating in Slave mode. */
+int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	host_grxsts_data_t grxsts;
+	dwc_hc_t *hc = NULL;
+
+	DWC_DEBUGPL(DBG_HCD, "--RxStsQ Level Interrupt--\n");
+
+	grxsts.d32 =
+	    DWC_READ_REG32(&dwc_otg_hcd->core_if->core_global_regs->grxstsp);
+
+	hc = dwc_otg_hcd->hc_ptr_array[grxsts.b.chnum];
+	if (!hc) {
+		DWC_ERROR("Unable to get corresponding channel\n");
+		return 0;
+	}
+
+	/* Packet Status */
+	DWC_DEBUGPL(DBG_HCDV, "    Ch num = %d\n", grxsts.b.chnum);
+	DWC_DEBUGPL(DBG_HCDV, "    Count = %d\n", grxsts.b.bcnt);
+	DWC_DEBUGPL(DBG_HCDV, "    DPID = %d, hc.dpid = %d\n", grxsts.b.dpid,
+		    hc->data_pid_start);
+	DWC_DEBUGPL(DBG_HCDV, "    PStatus = %d\n", grxsts.b.pktsts);
+
+	switch (grxsts.b.pktsts) {
+	case DWC_GRXSTS_PKTSTS_IN:
+		/* Read the data into the host buffer. */
+		if (grxsts.b.bcnt > 0) {
+			dwc_otg_read_packet(dwc_otg_hcd->core_if,
+					    hc->xfer_buff, grxsts.b.bcnt);
+
+			/* Update the HC fields for the next packet received. */
+			hc->xfer_count += grxsts.b.bcnt;
+			hc->xfer_buff += grxsts.b.bcnt;
+		}
+
+	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
+	case DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR:
+	case DWC_GRXSTS_PKTSTS_CH_HALTED:
+		/* Handled in interrupt, just ignore data */
+		break;
+	default:
+		DWC_ERROR("RX_STS_Q Interrupt: Unknown status %d\n",
+			  grxsts.b.pktsts);
+		break;
+	}
+
+	return 1;
+}
+
+/** This interrupt occurs when the non-periodic Tx FIFO is half-empty. More
+ * data packets may be written to the FIFO for OUT transfers. More requests
+ * may be written to the non-periodic request queue for IN transfers. This
+ * interrupt is enabled only in Slave mode. */
+int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	DWC_DEBUGPL(DBG_HCD, "--Non-Periodic TxFIFO Empty Interrupt--\n");
+	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
+				       DWC_OTG_TRANSACTION_NON_PERIODIC);
+	return 1;
+}
+
+/** This interrupt occurs when the periodic Tx FIFO is half-empty. More data
+ * packets may be written to the FIFO for OUT transfers. More requests may be
+ * written to the periodic request queue for IN transfers. This interrupt is
+ * enabled only in Slave mode. */
+int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	DWC_DEBUGPL(DBG_HCD, "--Periodic TxFIFO Empty Interrupt--\n");
+	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
+				       DWC_OTG_TRANSACTION_PERIODIC);
+	return 1;
+}
+
+/** There are multiple conditions that can cause a port interrupt. This function
+ * determines which interrupt conditions have occurred and handles them
+ * appropriately. */
+int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	int retval = 0;
+	hprt0_data_t hprt0;
+	hprt0_data_t hprt0_modify;
+
+	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+	hprt0_modify.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+
+	/* Clear appropriate bits in HPRT0 to clear the interrupt bit in
+	 * GINTSTS */
+
+	hprt0_modify.b.prtena = 0;
+	hprt0_modify.b.prtconndet = 0;
+	hprt0_modify.b.prtenchng = 0;
+	hprt0_modify.b.prtovrcurrchng = 0;
+
+	/* Port Connect Detected
+	 * Set flag and clear if detected */
+	if (dwc_otg_hcd->core_if->hibernation_suspend == 1) {
+		// Dont modify port status if we are in hibernation state
+		hprt0_modify.b.prtconndet = 1;
+		hprt0_modify.b.prtenchng = 1;
+		DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
+		hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+		return retval;
+	}
+
+	if (hprt0.b.prtconndet) {
+		/** @todo - check if steps performed in 'else' block should be perfromed regardles adp */
+		if (dwc_otg_hcd->core_if->adp_enable &&
+				dwc_otg_hcd->core_if->adp.vbuson_timer_started == 1) {
+			DWC_PRINTF("PORT CONNECT DETECTED ----------------\n");
+			DWC_TIMER_CANCEL(dwc_otg_hcd->core_if->adp.vbuson_timer);
+			dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
+			/* TODO - check if this is required, as
+			 * host initialization was already performed
+			 * after initial ADP probing
+			 */
+			/*dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
+			dwc_otg_core_init(dwc_otg_hcd->core_if);
+			dwc_otg_enable_global_interrupts(dwc_otg_hcd->core_if);
+			cil_hcd_start(dwc_otg_hcd->core_if);*/
+		} else {
+
+			DWC_DEBUGPL(DBG_HCD, "--Port Interrupt HPRT0=0x%08x "
+				    "Port Connect Detected--\n", hprt0.d32);
+			dwc_otg_hcd->flags.b.port_connect_status_change = 1;
+			dwc_otg_hcd->flags.b.port_connect_status = 1;
+			hprt0_modify.b.prtconndet = 1;
+
+			/* B-Device has connected, Delete the connection timer. */
+			DWC_TIMER_CANCEL(dwc_otg_hcd->conn_timer);
+		}
+		/* The Hub driver asserts a reset when it sees port connect
+		 * status change flag */
+		retval |= 1;
+	}
+
+	/* Port Enable Changed
+	 * Clear if detected - Set internal flag if disabled */
+	if (hprt0.b.prtenchng) {
+		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
+			    "Port Enable Changed--\n", hprt0.d32);
+		hprt0_modify.b.prtenchng = 1;
+		if (hprt0.b.prtena == 1) {
+			hfir_data_t hfir;
+			int do_reset = 0;
+			dwc_otg_core_params_t *params =
+			    dwc_otg_hcd->core_if->core_params;
+			dwc_otg_core_global_regs_t *global_regs =
+			    dwc_otg_hcd->core_if->core_global_regs;
+			dwc_otg_host_if_t *host_if =
+			    dwc_otg_hcd->core_if->host_if;
+
+			dwc_otg_hcd->flags.b.port_speed = hprt0.b.prtspd;
+			if (microframe_schedule)
+				init_hcd_usecs(dwc_otg_hcd);
+
+			/* Every time when port enables calculate
+			 * HFIR.FrInterval
+			 */
+			hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
+			hfir.b.frint = calc_frame_interval(dwc_otg_hcd->core_if);
+			DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
+
+			/* Check if we need to adjust the PHY clock speed for
+			 * low power and adjust it */
+			if (params->host_support_fs_ls_low_power) {
+				gusbcfg_data_t usbcfg;
+
+				usbcfg.d32 =
+				    DWC_READ_REG32(&global_regs->gusbcfg);
+
+				if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED
+				    || hprt0.b.prtspd ==
+				    DWC_HPRT0_PRTSPD_FULL_SPEED) {
+					/*
+					 * Low power
+					 */
+					hcfg_data_t hcfg;
+					if (usbcfg.b.phylpwrclksel == 0) {
+						/* Set PHY low power clock select for FS/LS devices */
+						usbcfg.b.phylpwrclksel = 1;
+						DWC_WRITE_REG32
+						    (&global_regs->gusbcfg,
+						     usbcfg.d32);
+						do_reset = 1;
+					}
+
+					hcfg.d32 =
+					    DWC_READ_REG32
+					    (&host_if->host_global_regs->hcfg);
+
+					if (hprt0.b.prtspd ==
+					    DWC_HPRT0_PRTSPD_LOW_SPEED
+					    && params->host_ls_low_power_phy_clk
+					    ==
+					    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ)
+					{
+						/* 6 MHZ */
+						DWC_DEBUGPL(DBG_CIL,
+							    "FS_PHY programming HCFG to 6 MHz (Low Power)\n");
+						if (hcfg.b.fslspclksel !=
+						    DWC_HCFG_6_MHZ) {
+							hcfg.b.fslspclksel =
+							    DWC_HCFG_6_MHZ;
+							DWC_WRITE_REG32
+							    (&host_if->host_global_regs->hcfg,
+							     hcfg.d32);
+							do_reset = 1;
+						}
+					} else {
+						/* 48 MHZ */
+						DWC_DEBUGPL(DBG_CIL,
+							    "FS_PHY programming HCFG to 48 MHz ()\n");
+						if (hcfg.b.fslspclksel !=
+						    DWC_HCFG_48_MHZ) {
+							hcfg.b.fslspclksel =
+							    DWC_HCFG_48_MHZ;
+							DWC_WRITE_REG32
+							    (&host_if->host_global_regs->hcfg,
+							     hcfg.d32);
+							do_reset = 1;
+						}
+					}
+				} else {
+					/*
+					 * Not low power
+					 */
+					if (usbcfg.b.phylpwrclksel == 1) {
+						usbcfg.b.phylpwrclksel = 0;
+						DWC_WRITE_REG32
+						    (&global_regs->gusbcfg,
+						     usbcfg.d32);
+						do_reset = 1;
+					}
+				}
+
+				if (do_reset) {
+					DWC_TASK_SCHEDULE(dwc_otg_hcd->reset_tasklet);
+				}
+			}
+
+			if (!do_reset) {
+				/* Port has been enabled set the reset change flag */
+				dwc_otg_hcd->flags.b.port_reset_change = 1;
+			}
+		} else {
+			dwc_otg_hcd->flags.b.port_enable_change = 1;
+		}
+		retval |= 1;
+	}
+
+	/** Overcurrent Change Interrupt */
+	if (hprt0.b.prtovrcurrchng) {
+		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
+			    "Port Overcurrent Changed--\n", hprt0.d32);
+		dwc_otg_hcd->flags.b.port_over_current_change = 1;
+		hprt0_modify.b.prtovrcurrchng = 1;
+		retval |= 1;
+	}
+
+	/* Clear Port Interrupts */
+	DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
+
+	return retval;
+}
+
+/** This interrupt indicates that one or more host channels has a pending
+ * interrupt. There are multiple conditions that can cause each host channel
+ * interrupt. This function determines which conditions have occurred for each
+ * host channel interrupt and handles them appropriately. */
+int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	int i;
+	int retval = 0;
+	haint_data_t haint = { .d32 = 0 } ;
+
+	/* Clear appropriate bits in HCINTn to clear the interrupt bit in
+	 * GINTSTS */
+
+	if (!fiq_fsm_enable)
+		haint.d32 = dwc_otg_read_host_all_channels_intr(dwc_otg_hcd->core_if);
+
+	// Overwrite with saved interrupts from fiq handler
+	if(fiq_fsm_enable)
+	{
+		/* check the mask? */
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+		haint.b2.chint |= ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint);
+		dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
+		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+		local_fiq_enable();
+	}
+
+	for (i = 0; i < dwc_otg_hcd->core_if->core_params->host_channels; i++) {
+		if (haint.b2.chint & (1 << i)) {
+			retval |= dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd, i);
+		}
+	}
+
+	return retval;
+}
+
+/**
+ * Gets the actual length of a transfer after the transfer halts. _halt_status
+ * holds the reason for the halt.
+ *
+ * For IN transfers where halt_status is DWC_OTG_HC_XFER_COMPLETE,
+ * *short_read is set to 1 upon return if less than the requested
+ * number of bytes were transferred. Otherwise, *short_read is set to 0 upon
+ * return. short_read may also be NULL on entry, in which case it remains
+ * unchanged.
+ */
+static uint32_t get_actual_xfer_length(dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_halt_status_e halt_status,
+				       int *short_read)
+{
+	hctsiz_data_t hctsiz;
+	uint32_t length;
+
+	if (short_read != NULL) {
+		*short_read = 0;
+	}
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+
+	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
+		if (hc->ep_is_in) {
+			length = hc->xfer_len - hctsiz.b.xfersize;
+			if (short_read != NULL) {
+				*short_read = (hctsiz.b.xfersize != 0);
+			}
+		} else if (hc->qh->do_split) {
+				//length = split_out_xfersize[hc->hc_num];
+				length = qtd->ssplit_out_xfer_count;
+		} else {
+			length = hc->xfer_len;
+		}
+	} else {
+		/*
+		 * Must use the hctsiz.pktcnt field to determine how much data
+		 * has been transferred. This field reflects the number of
+		 * packets that have been transferred via the USB. This is
+		 * always an integral number of packets if the transfer was
+		 * halted before its normal completion. (Can't use the
+		 * hctsiz.xfersize field because that reflects the number of
+		 * bytes transferred via the AHB, not the USB).
+		 */
+		length =
+		    (hc->start_pkt_count - hctsiz.b.pktcnt) * hc->max_packet;
+	}
+
+	return length;
+}
+
+/**
+ * Updates the state of the URB after a Transfer Complete interrupt on the
+ * host channel. Updates the actual_length field of the URB based on the
+ * number of bytes transferred via the host channel. Sets the URB status
+ * if the data transfer is finished.
+ *
+ * @return 1 if the data transfer specified by the URB is completely finished,
+ * 0 otherwise.
+ */
+static int update_urb_state_xfer_comp(dwc_hc_t * hc,
+				      dwc_otg_hc_regs_t * hc_regs,
+				      dwc_otg_hcd_urb_t * urb,
+				      dwc_otg_qtd_t * qtd)
+{
+	int xfer_done = 0;
+	int short_read = 0;
+
+	int xfer_length;
+
+	xfer_length = get_actual_xfer_length(hc, hc_regs, qtd,
+					     DWC_OTG_HC_XFER_COMPLETE,
+					     &short_read);
+
+	if (urb->actual_length + xfer_length > urb->length) {
+		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
+			hc->dev_addr, __func__, __LINE__);
+		xfer_length = urb->length - urb->actual_length;
+	}
+
+	/* non DWORD-aligned buffer case handling. */
+	if (hc->align_buff && xfer_length && hc->ep_is_in) {
+		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
+			   xfer_length);
+	}
+
+	urb->actual_length += xfer_length;
+
+	if (xfer_length && (hc->ep_type == DWC_OTG_EP_TYPE_BULK) &&
+	    (urb->flags & URB_SEND_ZERO_PACKET)
+	    && (urb->actual_length == urb->length)
+	    && !(urb->length % hc->max_packet)) {
+		xfer_done = 0;
+	} else if (short_read || urb->actual_length >= urb->length) {
+		xfer_done = 1;
+		urb->status = 0;
+	}
+
+#ifdef DEBUG
+	{
+		hctsiz_data_t hctsiz;
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
+			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
+			    hc->hc_num);
+		DWC_DEBUGPL(DBG_HCDV, "  hc->xfer_len %d\n", hc->xfer_len);
+		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.xfersize %d\n",
+			    hctsiz.b.xfersize);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
+			    urb->length);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
+			    urb->actual_length);
+		DWC_DEBUGPL(DBG_HCDV, "  short_read %d, xfer_done %d\n",
+			    short_read, xfer_done);
+	}
+#endif
+
+	return xfer_done;
+}
+
+/*
+ * Save the starting data toggle for the next transfer. The data toggle is
+ * saved in the QH for non-control transfers and it's saved in the QTD for
+ * control transfers.
+ */
+void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
+			     dwc_otg_hc_regs_t * hc_regs, dwc_otg_qtd_t * qtd)
+{
+	hctsiz_data_t hctsiz;
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+
+	if (hc->ep_type != DWC_OTG_EP_TYPE_CONTROL) {
+		dwc_otg_qh_t *qh = hc->qh;
+		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
+			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+		} else {
+			qh->data_toggle = DWC_OTG_HC_PID_DATA1;
+		}
+	} else {
+		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
+			qtd->data_toggle = DWC_OTG_HC_PID_DATA0;
+		} else {
+			qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
+		}
+	}
+}
+
+/**
+ * Updates the state of an Isochronous URB when the transfer is stopped for
+ * any reason. The fields of the current entry in the frame descriptor array
+ * are set based on the transfer state and the input _halt_status. Completes
+ * the Isochronous URB if all the URB frames have been completed.
+ *
+ * @return DWC_OTG_HC_XFER_COMPLETE if there are more frames remaining to be
+ * transferred in the URB. Otherwise return DWC_OTG_HC_XFER_URB_COMPLETE.
+ */
+static dwc_otg_halt_status_e
+update_isoc_urb_state(dwc_otg_hcd_t * hcd,
+		      dwc_hc_t * hc,
+		      dwc_otg_hc_regs_t * hc_regs,
+		      dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
+{
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+	dwc_otg_halt_status_e ret_val = halt_status;
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+
+	frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
+	switch (halt_status) {
+	case DWC_OTG_HC_XFER_COMPLETE:
+		frame_desc->status = 0;
+		frame_desc->actual_length =
+		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
+
+		/* non DWORD-aligned buffer case handling. */
+		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
+			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
+				   hc->qh->dw_align_buf, frame_desc->actual_length);
+		}
+
+		break;
+	case DWC_OTG_HC_XFER_FRAME_OVERRUN:
+		urb->error_count++;
+		if (hc->ep_is_in) {
+			frame_desc->status = -DWC_E_NO_STREAM_RES;
+		} else {
+			frame_desc->status = -DWC_E_COMMUNICATION;
+		}
+		frame_desc->actual_length = 0;
+		break;
+	case DWC_OTG_HC_XFER_BABBLE_ERR:
+		urb->error_count++;
+		frame_desc->status = -DWC_E_OVERFLOW;
+		/* Don't need to update actual_length in this case. */
+		break;
+	case DWC_OTG_HC_XFER_XACT_ERR:
+		urb->error_count++;
+		frame_desc->status = -DWC_E_PROTOCOL;
+		frame_desc->actual_length =
+		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
+
+		/* non DWORD-aligned buffer case handling. */
+		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
+			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
+				   hc->qh->dw_align_buf, frame_desc->actual_length);
+		}
+		/* Skip whole frame */
+		if (hc->qh->do_split && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) &&
+		    hc->ep_is_in && hcd->core_if->dma_enable) {
+			qtd->complete_split = 0;
+			qtd->isoc_split_offset = 0;
+		}
+
+		break;
+	default:
+		DWC_ASSERT(1, "Unhandled _halt_status (%d)\n", halt_status);
+		break;
+	}
+	if (++qtd->isoc_frame_index == urb->packet_count) {
+		/*
+		 * urb->status is not used for isoc transfers.
+		 * The individual frame_desc statuses are used instead.
+		 */
+		hcd->fops->complete(hcd, urb->priv, urb, 0);
+		ret_val = DWC_OTG_HC_XFER_URB_COMPLETE;
+	} else {
+		ret_val = DWC_OTG_HC_XFER_COMPLETE;
+	}
+	return ret_val;
+}
+
+/**
+ * Frees the first QTD in the QH's list if free_qtd is 1. For non-periodic
+ * QHs, removes the QH from the active non-periodic schedule. If any QTDs are
+ * still linked to the QH, the QH is added to the end of the inactive
+ * non-periodic schedule. For periodic QHs, removes the QH from the periodic
+ * schedule if no more QTDs are linked to the QH.
+ */
+static void deactivate_qh(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, int free_qtd)
+{
+	int continue_split = 0;
+	dwc_otg_qtd_t *qtd;
+
+	DWC_DEBUGPL(DBG_HCDV, "  %s(%p,%p,%d)\n", __func__, hcd, qh, free_qtd);
+
+	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+
+	if (qtd->complete_split) {
+		continue_split = 1;
+	} else if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_MID ||
+		   qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_END) {
+		continue_split = 1;
+	}
+
+	if (free_qtd) {
+		dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+		continue_split = 0;
+	}
+
+	qh->channel = NULL;
+	dwc_otg_hcd_qh_deactivate(hcd, qh, continue_split);
+}
+
+/**
+ * Releases a host channel for use by other transfers. Attempts to select and
+ * queue more transactions since at least one host channel is available.
+ *
+ * @param hcd The HCD state structure.
+ * @param hc The host channel to release.
+ * @param qtd The QTD associated with the host channel. This QTD may be freed
+ * if the transfer is complete or an error has occurred.
+ * @param halt_status Reason the channel is being released. This status
+ * determines the actions taken by this function.
+ */
+static void release_channel(dwc_otg_hcd_t * hcd,
+			    dwc_hc_t * hc,
+			    dwc_otg_qtd_t * qtd,
+			    dwc_otg_halt_status_e halt_status)
+{
+	dwc_otg_transaction_type_e tr_type;
+	int free_qtd;
+
+	int hog_port = 0;
+
+	DWC_DEBUGPL(DBG_HCDV, "  %s: channel %d, halt_status %d, xfer_len %d\n",
+		    __func__, hc->hc_num, halt_status, hc->xfer_len);
+
+	if(fiq_fsm_enable && hc->do_split) {
+		if(!hc->ep_is_in && hc->ep_type == UE_ISOCHRONOUS) {
+			if(hc->xact_pos == DWC_HCSPLIT_XACTPOS_MID ||
+					hc->xact_pos == DWC_HCSPLIT_XACTPOS_BEGIN) {
+				hog_port = 0;
+			}
+		}
+	}
+
+	switch (halt_status) {
+	case DWC_OTG_HC_XFER_URB_COMPLETE:
+		free_qtd = 1;
+		break;
+	case DWC_OTG_HC_XFER_AHB_ERR:
+	case DWC_OTG_HC_XFER_STALL:
+	case DWC_OTG_HC_XFER_BABBLE_ERR:
+		free_qtd = 1;
+		break;
+	case DWC_OTG_HC_XFER_XACT_ERR:
+		if (qtd->error_count >= 3) {
+			DWC_DEBUGPL(DBG_HCDV,
+				    "  Complete URB with transaction error\n");
+			free_qtd = 1;
+			qtd->urb->status = -DWC_E_PROTOCOL;
+			hcd->fops->complete(hcd, qtd->urb->priv,
+					    qtd->urb, -DWC_E_PROTOCOL);
+		} else {
+			free_qtd = 0;
+		}
+		break;
+	case DWC_OTG_HC_XFER_URB_DEQUEUE:
+		/*
+		 * The QTD has already been removed and the QH has been
+		 * deactivated. Don't want to do anything except release the
+		 * host channel and try to queue more transfers.
+		 */
+		goto cleanup;
+	case DWC_OTG_HC_XFER_NO_HALT_STATUS:
+		free_qtd = 0;
+		break;
+	case DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE:
+		DWC_DEBUGPL(DBG_HCDV,
+			"  Complete URB with I/O error\n");
+		free_qtd = 1;
+		qtd->urb->status = -DWC_E_IO;
+		hcd->fops->complete(hcd, qtd->urb->priv,
+			qtd->urb, -DWC_E_IO);
+		break;
+	default:
+		free_qtd = 0;
+		break;
+	}
+
+	deactivate_qh(hcd, hc->qh, free_qtd);
+
+cleanup:
+	/*
+	 * Release the host channel for use by other transfers. The cleanup
+	 * function clears the channel interrupt enables and conditions, so
+	 * there's no need to clear the Channel Halted interrupt separately.
+	 */
+	if (fiq_fsm_enable && hcd->fiq_state->channel[hc->hc_num].fsm != FIQ_PASSTHROUGH)
+		dwc_otg_cleanup_fiq_channel(hcd, hc->hc_num);
+	dwc_otg_hc_cleanup(hcd->core_if, hc);
+	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
+
+	if (!microframe_schedule) {
+		switch (hc->ep_type) {
+		case DWC_OTG_EP_TYPE_CONTROL:
+		case DWC_OTG_EP_TYPE_BULK:
+			hcd->non_periodic_channels--;
+			break;
+
+		default:
+			/*
+			 * Don't release reservations for periodic channels here.
+			 * That's done when a periodic transfer is descheduled (i.e.
+			 * when the QH is removed from the periodic schedule).
+			 */
+			break;
+		}
+	} else {
+		hcd->available_host_channels++;
+		fiq_print(FIQDBG_INT, hcd->fiq_state, "AHC = %d ", hcd->available_host_channels);
+	}
+
+	/* Try to queue more transfers now that there's a free channel. */
+	tr_type = dwc_otg_hcd_select_transactions(hcd);
+	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
+		dwc_otg_hcd_queue_transactions(hcd, tr_type);
+	}
+}
+
+/**
+ * Halts a host channel. If the channel cannot be halted immediately because
+ * the request queue is full, this function ensures that the FIFO empty
+ * interrupt for the appropriate queue is enabled so that the halt request can
+ * be queued when there is space in the request queue.
+ *
+ * This function may also be called in DMA mode. In that case, the channel is
+ * simply released since the core always halts the channel automatically in
+ * DMA mode.
+ */
+static void halt_channel(dwc_otg_hcd_t * hcd,
+			 dwc_hc_t * hc,
+			 dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
+{
+	if (hcd->core_if->dma_enable) {
+		release_channel(hcd, hc, qtd, halt_status);
+		return;
+	}
+
+	/* Slave mode processing... */
+	dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
+
+	if (hc->halt_on_queue) {
+		gintmsk_data_t gintmsk = {.d32 = 0 };
+		dwc_otg_core_global_regs_t *global_regs;
+		global_regs = hcd->core_if->core_global_regs;
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
+			/*
+			 * Make sure the Non-periodic Tx FIFO empty interrupt
+			 * is enabled so that the non-periodic schedule will
+			 * be processed.
+			 */
+			gintmsk.b.nptxfempty = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+			}
+		} else {
+			/*
+			 * Move the QH from the periodic queued schedule to
+			 * the periodic assigned schedule. This allows the
+			 * halt to be queued when the periodic schedule is
+			 * processed.
+			 */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
+					   &hc->qh->qh_list_entry);
+
+			/*
+			 * Make sure the Periodic Tx FIFO Empty interrupt is
+			 * enabled so that the periodic schedule will be
+			 * processed.
+			 */
+			gintmsk.b.ptxfempty = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+			}
+		}
+	}
+}
+
+/**
+ * Performs common cleanup for non-periodic transfers after a Transfer
+ * Complete interrupt. This function should be called after any endpoint type
+ * specific handling is finished to release the host channel.
+ */
+static void complete_non_periodic_xfer(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_halt_status_e halt_status)
+{
+	hcint_data_t hcint;
+
+	qtd->error_count = 0;
+
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+	if (hcint.b.nyet) {
+		/*
+		 * Got a NYET on the last transaction of the transfer. This
+		 * means that the endpoint should be in the PING state at the
+		 * beginning of the next transfer.
+		 */
+		hc->qh->ping_state = 1;
+		clear_hc_int(hc_regs, nyet);
+	}
+
+	/*
+	 * Always halt and release the host channel to make it available for
+	 * more transfers. There may still be more phases for a control
+	 * transfer or more data packets for a bulk transfer at this point,
+	 * but the host channel is still halted. A channel will be reassigned
+	 * to the transfer when the non-periodic schedule is processed after
+	 * the channel is released. This allows transactions to be queued
+	 * properly via dwc_otg_hcd_queue_transactions, which also enables the
+	 * Tx FIFO Empty interrupt if necessary.
+	 */
+	if (hc->ep_is_in) {
+		/*
+		 * IN transfers in Slave mode require an explicit disable to
+		 * halt the channel. (In DMA mode, this call simply releases
+		 * the channel.)
+		 */
+		halt_channel(hcd, hc, qtd, halt_status);
+	} else {
+		/*
+		 * The channel is automatically disabled by the core for OUT
+		 * transfers in Slave mode.
+		 */
+		release_channel(hcd, hc, qtd, halt_status);
+	}
+}
+
+/**
+ * Performs common cleanup for periodic transfers after a Transfer Complete
+ * interrupt. This function should be called after any endpoint type specific
+ * handling is finished to release the host channel.
+ */
+static void complete_periodic_xfer(dwc_otg_hcd_t * hcd,
+				   dwc_hc_t * hc,
+				   dwc_otg_hc_regs_t * hc_regs,
+				   dwc_otg_qtd_t * qtd,
+				   dwc_otg_halt_status_e halt_status)
+{
+	hctsiz_data_t hctsiz;
+	qtd->error_count = 0;
+
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+	if (!hc->ep_is_in || hctsiz.b.pktcnt == 0) {
+		/* Core halts channel in these cases. */
+		release_channel(hcd, hc, qtd, halt_status);
+	} else {
+		/* Flush any outstanding requests from the Tx queue. */
+		halt_channel(hcd, hc, qtd, halt_status);
+	}
+}
+
+static int32_t handle_xfercomp_isoc_split_in(dwc_otg_hcd_t * hcd,
+					     dwc_hc_t * hc,
+					     dwc_otg_hc_regs_t * hc_regs,
+					     dwc_otg_qtd_t * qtd)
+{
+	uint32_t len;
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+
+	len = get_actual_xfer_length(hc, hc_regs, qtd,
+				     DWC_OTG_HC_XFER_COMPLETE, NULL);
+
+	if (!len) {
+		qtd->complete_split = 0;
+		qtd->isoc_split_offset = 0;
+		return 0;
+	}
+	frame_desc->actual_length += len;
+
+	if (hc->align_buff && len)
+		dwc_memcpy(qtd->urb->buf + frame_desc->offset +
+			   qtd->isoc_split_offset, hc->qh->dw_align_buf, len);
+	qtd->isoc_split_offset += len;
+
+	if (frame_desc->length == frame_desc->actual_length) {
+		frame_desc->status = 0;
+		qtd->isoc_frame_index++;
+		qtd->complete_split = 0;
+		qtd->isoc_split_offset = 0;
+	}
+
+	if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+	} else {
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+	}
+
+	return 1;		/* Indicates that channel released */
+}
+
+/**
+ * Handles a host channel Transfer Complete interrupt. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_xfercomp_intr(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd)
+{
+	int urb_xfer_done;
+	dwc_otg_halt_status_e halt_status = DWC_OTG_HC_XFER_COMPLETE;
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
+
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Transfer Complete--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, halt_status);
+		if (pipe_type == UE_ISOCHRONOUS) {
+			/* Do not disable the interrupt, just clear it */
+			clear_hc_int(hc_regs, xfercomp);
+			return 1;
+		}
+		goto handle_xfercomp_done;
+	}
+
+	/*
+	 * Handle xfer complete on CSPLIT.
+	 */
+
+	if (hc->qh->do_split) {
+		if ((hc->ep_type == DWC_OTG_EP_TYPE_ISOC) && hc->ep_is_in
+		    && hcd->core_if->dma_enable) {
+			if (qtd->complete_split
+			    && handle_xfercomp_isoc_split_in(hcd, hc, hc_regs,
+							     qtd))
+				goto handle_xfercomp_done;
+		} else {
+			qtd->complete_split = 0;
+		}
+	}
+
+	/* Update the QTD and URB states. */
+	switch (pipe_type) {
+	case UE_CONTROL:
+		switch (qtd->control_phase) {
+		case DWC_OTG_CONTROL_SETUP:
+			if (urb->length > 0) {
+				qtd->control_phase = DWC_OTG_CONTROL_DATA;
+			} else {
+				qtd->control_phase = DWC_OTG_CONTROL_STATUS;
+			}
+			DWC_DEBUGPL(DBG_HCDV,
+				    "  Control setup transaction done\n");
+			halt_status = DWC_OTG_HC_XFER_COMPLETE;
+			break;
+		case DWC_OTG_CONTROL_DATA:{
+				urb_xfer_done =
+				    update_urb_state_xfer_comp(hc, hc_regs, urb,
+							       qtd);
+				if (urb_xfer_done) {
+					qtd->control_phase =
+					    DWC_OTG_CONTROL_STATUS;
+					DWC_DEBUGPL(DBG_HCDV,
+						    "  Control data transfer done\n");
+				} else {
+					dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+				}
+				halt_status = DWC_OTG_HC_XFER_COMPLETE;
+				break;
+			}
+		case DWC_OTG_CONTROL_STATUS:
+			DWC_DEBUGPL(DBG_HCDV, "  Control transfer complete\n");
+			if (urb->status == -DWC_E_IN_PROGRESS) {
+				urb->status = 0;
+			}
+			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
+			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
+			break;
+		}
+
+		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	case UE_BULK:
+		DWC_DEBUGPL(DBG_HCDV, "  Bulk transfer complete\n");
+		urb_xfer_done =
+		    update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
+		if (urb_xfer_done) {
+			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
+			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
+		} else {
+			halt_status = DWC_OTG_HC_XFER_COMPLETE;
+		}
+
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	case UE_INTERRUPT:
+		DWC_DEBUGPL(DBG_HCDV, "  Interrupt transfer complete\n");
+		urb_xfer_done =
+			update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
+
+		/*
+		 * Interrupt URB is done on the first transfer complete
+		 * interrupt.
+		 */
+		if (urb_xfer_done) {
+				hcd->fops->complete(hcd, urb->priv, urb, urb->status);
+				halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
+		} else {
+				halt_status = DWC_OTG_HC_XFER_COMPLETE;
+		}
+
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	case UE_ISOCHRONOUS:
+		DWC_DEBUGPL(DBG_HCDV, "  Isochronous transfer complete\n");
+		if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_ALL) {
+			halt_status =
+			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						  DWC_OTG_HC_XFER_COMPLETE);
+		}
+		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	}
+
+handle_xfercomp_done:
+	disable_hc_int(hc_regs, xfercompl);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel STALL interrupt. This handler may be called in
+ * either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_stall_intr(dwc_otg_hcd_t * hcd,
+				    dwc_hc_t * hc,
+				    dwc_otg_hc_regs_t * hc_regs,
+				    dwc_otg_qtd_t * qtd)
+{
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
+
+	DWC_DEBUGPL(DBG_HCD, "--Host Channel %d Interrupt: "
+		    "STALL Received--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, DWC_OTG_HC_XFER_STALL);
+		goto handle_stall_done;
+	}
+
+	if (pipe_type == UE_CONTROL) {
+		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
+	}
+
+	if (pipe_type == UE_BULK || pipe_type == UE_INTERRUPT) {
+		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
+		/*
+		 * USB protocol requires resetting the data toggle for bulk
+		 * and interrupt endpoints when a CLEAR_FEATURE(ENDPOINT_HALT)
+		 * setup command is issued to the endpoint. Anticipate the
+		 * CLEAR_FEATURE command since a STALL has occurred and reset
+		 * the data toggle now.
+		 */
+		hc->qh->data_toggle = 0;
+	}
+
+	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_STALL);
+
+handle_stall_done:
+	disable_hc_int(hc_regs, stall);
+
+	return 1;
+}
+
+/*
+ * Updates the state of the URB when a transfer has been stopped due to an
+ * abnormal condition before the transfer completes. Modifies the
+ * actual_length field of the URB to reflect the number of bytes that have
+ * actually been transferred via the host channel.
+ */
+static void update_urb_state_xfer_intr(dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_hcd_urb_t * urb,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_halt_status_e halt_status)
+{
+	uint32_t bytes_transferred = get_actual_xfer_length(hc, hc_regs, qtd,
+							    halt_status, NULL);
+
+	if (urb->actual_length + bytes_transferred > urb->length) {
+		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
+			hc->dev_addr, __func__, __LINE__);
+		bytes_transferred = urb->length - urb->actual_length;
+	}
+
+	/* non DWORD-aligned buffer case handling. */
+	if (hc->align_buff && bytes_transferred && hc->ep_is_in) {
+		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
+			   bytes_transferred);
+	}
+
+	urb->actual_length += bytes_transferred;
+
+#ifdef DEBUG
+	{
+		hctsiz_data_t hctsiz;
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
+			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
+			    hc->hc_num);
+		DWC_DEBUGPL(DBG_HCDV, "  hc->start_pkt_count %d\n",
+			    hc->start_pkt_count);
+		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.pktcnt %d\n", hctsiz.b.pktcnt);
+		DWC_DEBUGPL(DBG_HCDV, "  hc->max_packet %d\n", hc->max_packet);
+		DWC_DEBUGPL(DBG_HCDV, "  bytes_transferred %d\n",
+			    bytes_transferred);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
+			    urb->actual_length);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
+			    urb->length);
+	}
+#endif
+}
+
+/**
+ * Handles a host channel NAK interrupt. This handler may be called in either
+ * DMA mode or Slave mode.
+ */
+static int32_t handle_hc_nak_intr(dwc_otg_hcd_t * hcd,
+				  dwc_hc_t * hc,
+				  dwc_otg_hc_regs_t * hc_regs,
+				  dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "NAK Received--\n", hc->hc_num);
+
+	/*
+	 * When we get bulk NAKs then remember this so we holdoff on this qh until
+	 * the beginning of the next frame
+	 */
+	switch(dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+		case UE_BULK:
+		case UE_CONTROL:
+		if (nak_holdoff && qtd->qh->do_split)
+			hc->qh->nak_frame = dwc_otg_hcd_get_frame_number(hcd);
+	}
+
+	/*
+	 * Handle NAK for IN/OUT SSPLIT/CSPLIT transfers, bulk, control, and
+	 * interrupt.  Re-start the SSPLIT transfer.
+	 */
+	if (hc->do_split) {
+		if (hc->complete_split) {
+			qtd->error_count = 0;
+		}
+		qtd->complete_split = 0;
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
+		goto handle_nak_done;
+	}
+
+	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+	case UE_CONTROL:
+	case UE_BULK:
+		if (hcd->core_if->dma_enable && hc->ep_is_in) {
+			/*
+			 * NAK interrupts are enabled on bulk/control IN
+			 * transfers in DMA mode for the sole purpose of
+			 * resetting the error count after a transaction error
+			 * occurs. The core will continue transferring data.
+			 * Disable other interrupts unmasked for the same
+			 * reason.
+			 */
+			disable_hc_int(hc_regs, datatglerr);
+			disable_hc_int(hc_regs, ack);
+			qtd->error_count = 0;
+			goto handle_nak_done;
+		}
+
+		/*
+		 * NAK interrupts normally occur during OUT transfers in DMA
+		 * or Slave mode. For IN transfers, more requests will be
+		 * queued as request queue space is available.
+		 */
+		qtd->error_count = 0;
+
+		if (!hc->qh->ping_state) {
+			update_urb_state_xfer_intr(hc, hc_regs,
+						   qtd->urb, qtd,
+						   DWC_OTG_HC_XFER_NAK);
+			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+
+			if (hc->speed == DWC_OTG_EP_SPEED_HIGH)
+				hc->qh->ping_state = 1;
+		}
+
+		/*
+		 * Halt the channel so the transfer can be re-started from
+		 * the appropriate point or the PING protocol will
+		 * start/continue.
+		 */
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
+		break;
+	case UE_INTERRUPT:
+		qtd->error_count = 0;
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
+		break;
+	case UE_ISOCHRONOUS:
+		/* Should never get called for isochronous transfers. */
+		DWC_ASSERT(1, "NACK interrupt for ISOC transfer\n");
+		break;
+	}
+
+handle_nak_done:
+	disable_hc_int(hc_regs, nak);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel ACK interrupt. This interrupt is enabled when
+ * performing the PING protocol in Slave mode, when errors occur during
+ * either Slave mode or DMA mode, and during Start Split transactions.
+ */
+static int32_t handle_hc_ack_intr(dwc_otg_hcd_t * hcd,
+				  dwc_hc_t * hc,
+				  dwc_otg_hc_regs_t * hc_regs,
+				  dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "ACK Received--\n", hc->hc_num);
+
+	if (hc->do_split) {
+		/*
+		 * Handle ACK on SSPLIT.
+		 * ACK should not occur in CSPLIT.
+		 */
+		if (!hc->ep_is_in && hc->data_pid_start != DWC_OTG_HC_PID_SETUP) {
+			qtd->ssplit_out_xfer_count = hc->xfer_len;
+		}
+		if (!(hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in)) {
+			/* Don't need complete for isochronous out transfers. */
+			qtd->complete_split = 1;
+		}
+
+		/* ISOC OUT */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
+			switch (hc->xact_pos) {
+			case DWC_HCSPLIT_XACTPOS_ALL:
+				break;
+			case DWC_HCSPLIT_XACTPOS_END:
+				qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
+				qtd->isoc_split_offset = 0;
+				break;
+			case DWC_HCSPLIT_XACTPOS_BEGIN:
+			case DWC_HCSPLIT_XACTPOS_MID:
+				/*
+				 * For BEGIN or MID, calculate the length for
+				 * the next microframe to determine the correct
+				 * SSPLIT token, either MID or END.
+				 */
+				{
+					struct dwc_otg_hcd_iso_packet_desc
+					*frame_desc;
+
+					frame_desc =
+					    &qtd->urb->
+					    iso_descs[qtd->isoc_frame_index];
+					qtd->isoc_split_offset += 188;
+
+					if ((frame_desc->length -
+					     qtd->isoc_split_offset) <= 188) {
+						qtd->isoc_split_pos =
+						    DWC_HCSPLIT_XACTPOS_END;
+					} else {
+						qtd->isoc_split_pos =
+						    DWC_HCSPLIT_XACTPOS_MID;
+					}
+
+				}
+				break;
+			}
+		} else {
+			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
+		}
+	} else {
+		/*
+		 * An unmasked ACK on a non-split DMA transaction is
+		 * for the sole purpose of resetting error counts. Disable other
+		 * interrupts unmasked for the same reason.
+		 */
+		if(hcd->core_if->dma_enable) {
+			disable_hc_int(hc_regs, datatglerr);
+			disable_hc_int(hc_regs, nak);
+		}
+		qtd->error_count = 0;
+
+		if (hc->qh->ping_state) {
+			hc->qh->ping_state = 0;
+			/*
+			 * Halt the channel so the transfer can be re-started
+			 * from the appropriate point. This only happens in
+			 * Slave mode. In DMA mode, the ping_state is cleared
+			 * when the transfer is started because the core
+			 * automatically executes the PING, then the transfer.
+			 */
+			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
+		}
+	}
+
+	/*
+	 * If the ACK occurred when _not_ in the PING state, let the channel
+	 * continue transferring data after clearing the error count.
+	 */
+
+	disable_hc_int(hc_regs, ack);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel NYET interrupt. This interrupt should only occur on
+ * Bulk and Control OUT endpoints and for complete split transactions. If a
+ * NYET occurs at the same time as a Transfer Complete interrupt, it is
+ * handled in the xfercomp interrupt handler, not here. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_nyet_intr(dwc_otg_hcd_t * hcd,
+				   dwc_hc_t * hc,
+				   dwc_otg_hc_regs_t * hc_regs,
+				   dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "NYET Received--\n", hc->hc_num);
+
+	/*
+	 * NYET on CSPLIT
+	 * re-do the CSPLIT immediately on non-periodic
+	 */
+	if (hc->do_split && hc->complete_split) {
+		if (hc->ep_is_in && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+		    && hcd->core_if->dma_enable) {
+			qtd->complete_split = 0;
+			qtd->isoc_split_offset = 0;
+			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			}
+			else
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+			goto handle_nyet_done;
+		}
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+			int frnum = dwc_otg_hcd_get_frame_number(hcd);
+
+			// With the FIQ running we only ever see the failed NYET
+			if (dwc_full_frame_num(frnum) !=
+			    dwc_full_frame_num(hc->qh->sched_frame) ||
+			    fiq_fsm_enable) {
+				/*
+				 * No longer in the same full speed frame.
+				 * Treat this as a transaction error.
+				 */
+#if 0
+				/** @todo Fix system performance so this can
+				 * be treated as an error. Right now complete
+				 * splits cannot be scheduled precisely enough
+				 * due to other system activity, so this error
+				 * occurs regularly in Slave mode.
+				 */
+				qtd->error_count++;
+#endif
+				qtd->complete_split = 0;
+				halt_channel(hcd, hc, qtd,
+					     DWC_OTG_HC_XFER_XACT_ERR);
+				/** @todo add support for isoc release */
+				goto handle_nyet_done;
+			}
+		}
+
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
+		goto handle_nyet_done;
+	}
+
+	hc->qh->ping_state = 1;
+	qtd->error_count = 0;
+
+	update_urb_state_xfer_intr(hc, hc_regs, qtd->urb, qtd,
+				   DWC_OTG_HC_XFER_NYET);
+	dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+
+	/*
+	 * Halt the channel and re-start the transfer so the PING
+	 * protocol will start.
+	 */
+	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
+
+handle_nyet_done:
+	disable_hc_int(hc_regs, nyet);
+	return 1;
+}
+
+/**
+ * Handles a host channel babble interrupt. This handler may be called in
+ * either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_babble_intr(dwc_otg_hcd_t * hcd,
+				     dwc_hc_t * hc,
+				     dwc_otg_hc_regs_t * hc_regs,
+				     dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Babble Error--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+					       DWC_OTG_HC_XFER_BABBLE_ERR);
+		goto handle_babble_done;
+	}
+
+	if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
+		hcd->fops->complete(hcd, qtd->urb->priv,
+				    qtd->urb, -DWC_E_OVERFLOW);
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_BABBLE_ERR);
+	} else {
+		dwc_otg_halt_status_e halt_status;
+		halt_status = update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						    DWC_OTG_HC_XFER_BABBLE_ERR);
+		halt_channel(hcd, hc, qtd, halt_status);
+	}
+
+handle_babble_done:
+	disable_hc_int(hc_regs, bblerr);
+	return 1;
+}
+
+/**
+ * Handles a host channel AHB error interrupt. This handler is only called in
+ * DMA mode.
+ */
+static int32_t handle_hc_ahberr_intr(dwc_otg_hcd_t * hcd,
+				     dwc_hc_t * hc,
+				     dwc_otg_hc_regs_t * hc_regs,
+				     dwc_otg_qtd_t * qtd)
+{
+	hcchar_data_t hcchar;
+	hcsplt_data_t hcsplt;
+	hctsiz_data_t hctsiz;
+	uint32_t hcdma;
+	char *pipetype, *speed;
+
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "AHB Error--\n", hc->hc_num);
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+	hcdma = DWC_READ_REG32(&hc_regs->hcdma);
+
+	DWC_ERROR("AHB ERROR, Channel %d\n", hc->hc_num);
+	DWC_ERROR("  hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32, hcsplt.d32);
+	DWC_ERROR("  hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32, hcdma);
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Enqueue\n");
+	DWC_ERROR("  Device address: %d\n",
+		  dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
+	DWC_ERROR("  Endpoint: %d, %s\n",
+		  dwc_otg_hcd_get_ep_num(&urb->pipe_info),
+		  (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT"));
+
+	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
+	case UE_CONTROL:
+		pipetype = "CONTROL";
+		break;
+	case UE_BULK:
+		pipetype = "BULK";
+		break;
+	case UE_INTERRUPT:
+		pipetype = "INTERRUPT";
+		break;
+	case UE_ISOCHRONOUS:
+		pipetype = "ISOCHRONOUS";
+		break;
+	default:
+		pipetype = "UNKNOWN";
+		break;
+	}
+
+	DWC_ERROR("  Endpoint type: %s\n", pipetype);
+
+	switch (hc->speed) {
+	case DWC_OTG_EP_SPEED_HIGH:
+		speed = "HIGH";
+		break;
+	case DWC_OTG_EP_SPEED_FULL:
+		speed = "FULL";
+		break;
+	case DWC_OTG_EP_SPEED_LOW:
+		speed = "LOW";
+		break;
+	default:
+		speed = "UNKNOWN";
+		break;
+	};
+
+	DWC_ERROR("  Speed: %s\n", speed);
+
+	DWC_ERROR("  Max packet size: %d\n",
+		  dwc_otg_hcd_get_mps(&urb->pipe_info));
+	DWC_ERROR("  Data buffer length: %d\n", urb->length);
+	DWC_ERROR("  Transfer buffer: %p, Transfer DMA: %p\n",
+		  urb->buf, (void *)urb->dma);
+	DWC_ERROR("  Setup buffer: %p, Setup DMA: %p\n",
+		  urb->setup_packet, (void *)urb->setup_dma);
+	DWC_ERROR("  Interval: %d\n", urb->interval);
+
+	/* Core haltes the channel for Descriptor DMA mode */
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+					       DWC_OTG_HC_XFER_AHB_ERR);
+		goto handle_ahberr_done;
+	}
+
+	hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_IO);
+
+	/*
+	 * Force a channel halt. Don't call halt_channel because that won't
+	 * write to the HCCHARn register in DMA mode to force the halt.
+	 */
+	dwc_otg_hc_halt(hcd->core_if, hc, DWC_OTG_HC_XFER_AHB_ERR);
+handle_ahberr_done:
+	disable_hc_int(hc_regs, ahberr);
+	return 1;
+}
+
+/**
+ * Handles a host channel transaction error interrupt. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_xacterr_intr(dwc_otg_hcd_t * hcd,
+				      dwc_hc_t * hc,
+				      dwc_otg_hc_regs_t * hc_regs,
+				      dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Transaction Error--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+					       DWC_OTG_HC_XFER_XACT_ERR);
+		goto handle_xacterr_done;
+	}
+
+	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+	case UE_CONTROL:
+	case UE_BULK:
+		qtd->error_count++;
+		if (!hc->qh->ping_state) {
+
+			update_urb_state_xfer_intr(hc, hc_regs,
+						   qtd->urb, qtd,
+						   DWC_OTG_HC_XFER_XACT_ERR);
+			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+			if (!hc->ep_is_in && hc->speed == DWC_OTG_EP_SPEED_HIGH) {
+				hc->qh->ping_state = 1;
+			}
+		}
+
+		/*
+		 * Halt the channel so the transfer can be re-started from
+		 * the appropriate point or the PING protocol will start.
+		 */
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		break;
+	case UE_INTERRUPT:
+		qtd->error_count++;
+		if (hc->do_split && hc->complete_split) {
+			qtd->complete_split = 0;
+		}
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		break;
+	case UE_ISOCHRONOUS:
+		{
+			dwc_otg_halt_status_e halt_status;
+			halt_status =
+			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						  DWC_OTG_HC_XFER_XACT_ERR);
+
+			halt_channel(hcd, hc, qtd, halt_status);
+		}
+		break;
+	}
+handle_xacterr_done:
+	disable_hc_int(hc_regs, xacterr);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel frame overrun interrupt. This handler may be called
+ * in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_frmovrun_intr(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Frame Overrun--\n", hc->hc_num);
+
+	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+	case UE_CONTROL:
+	case UE_BULK:
+		break;
+	case UE_INTERRUPT:
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_FRAME_OVERRUN);
+		break;
+	case UE_ISOCHRONOUS:
+		{
+			dwc_otg_halt_status_e halt_status;
+			halt_status =
+			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						  DWC_OTG_HC_XFER_FRAME_OVERRUN);
+
+			halt_channel(hcd, hc, qtd, halt_status);
+		}
+		break;
+	}
+
+	disable_hc_int(hc_regs, frmovrun);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel data toggle error interrupt. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_datatglerr_intr(dwc_otg_hcd_t * hcd,
+					 dwc_hc_t * hc,
+					 dwc_otg_hc_regs_t * hc_regs,
+					 dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		"Data Toggle Error on %s transfer--\n",
+		hc->hc_num, (hc->ep_is_in ? "IN" : "OUT"));
+
+	/* Data toggles on split transactions cause the hc to halt.
+	 * restart transfer */
+	if(hc->qh->do_split)
+	{
+		qtd->error_count++;
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		update_urb_state_xfer_intr(hc, hc_regs,
+			qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+	} else if (hc->ep_is_in) {
+		/* An unmasked data toggle error on a non-split DMA transaction is
+		 * for the sole purpose of resetting error counts. Disable other
+		 * interrupts unmasked for the same reason.
+		 */
+		if(hcd->core_if->dma_enable) {
+			disable_hc_int(hc_regs, ack);
+			disable_hc_int(hc_regs, nak);
+		}
+		qtd->error_count = 0;
+	}
+
+	disable_hc_int(hc_regs, datatglerr);
+
+	return 1;
+}
+
+#ifdef DEBUG
+/**
+ * This function is for debug only. It checks that a valid halt status is set
+ * and that HCCHARn.chdis is clear. If there's a problem, corrective action is
+ * taken and a warning is issued.
+ * @return 1 if halt status is ok, 0 otherwise.
+ */
+static inline int halt_status_ok(dwc_otg_hcd_t * hcd,
+				 dwc_hc_t * hc,
+				 dwc_otg_hc_regs_t * hc_regs,
+				 dwc_otg_qtd_t * qtd)
+{
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	hcsplt_data_t hcsplt;
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS) {
+		/*
+		 * This code is here only as a check. This condition should
+		 * never happen. Ignore the halt if it does occur.
+		 */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+		hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
+		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+		DWC_WARN
+		    ("%s: hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS, "
+		     "channel %d, hcchar 0x%08x, hctsiz 0x%08x, "
+		     "hcint 0x%08x, hcintmsk 0x%08x, "
+		     "hcsplt 0x%08x, qtd->complete_split %d\n", __func__,
+		     hc->hc_num, hcchar.d32, hctsiz.d32, hcint.d32,
+		     hcintmsk.d32, hcsplt.d32, qtd->complete_split);
+
+		DWC_WARN("%s: no halt status, channel %d, ignoring interrupt\n",
+			 __func__, hc->hc_num);
+		DWC_WARN("\n");
+		clear_hc_int(hc_regs, chhltd);
+		return 0;
+	}
+
+	/*
+	 * This code is here only as a check. hcchar.chdis should
+	 * never be set when the halt interrupt occurs. Halt the
+	 * channel again if it does occur.
+	 */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chdis) {
+		DWC_WARN("%s: hcchar.chdis set unexpectedly, "
+			 "hcchar 0x%08x, trying to halt again\n",
+			 __func__, hcchar.d32);
+		clear_hc_int(hc_regs, chhltd);
+		hc->halt_pending = 0;
+		halt_channel(hcd, hc, qtd, hc->halt_status);
+		return 0;
+	}
+
+	return 1;
+}
+#endif
+
+/**
+ * Handles a host Channel Halted interrupt in DMA mode. This handler
+ * determines the reason the channel halted and proceeds accordingly.
+ */
+static void handle_hc_chhltd_intr_dma(dwc_otg_hcd_t * hcd,
+				      dwc_hc_t * hc,
+				      dwc_otg_hc_regs_t * hc_regs,
+				      dwc_otg_qtd_t * qtd)
+{
+	int out_nak_enh = 0;
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	/* For core with OUT NAK enhancement, the flow for high-
+	 * speed CONTROL/BULK OUT is handled a little differently.
+	 */
+	if (hcd->core_if->snpsid >= OTG_CORE_REV_2_71a) {
+		if (hc->speed == DWC_OTG_EP_SPEED_HIGH && !hc->ep_is_in &&
+		    (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
+		     hc->ep_type == DWC_OTG_EP_TYPE_BULK)) {
+			out_nak_enh = 1;
+		}
+	}
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
+	    (hc->halt_status == DWC_OTG_HC_XFER_AHB_ERR
+	     && !hcd->core_if->dma_desc_enable)) {
+		/*
+		 * Just release the channel. A dequeue can happen on a
+		 * transfer timeout. In the case of an AHB Error, the channel
+		 * was forced to halt because there's no way to gracefully
+		 * recover.
+		 */
+		if (hcd->core_if->dma_desc_enable)
+			dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+						       hc->halt_status);
+		else
+			release_channel(hcd, hc, qtd, hc->halt_status);
+		return;
+	}
+
+	/* Read the HCINTn register to determine the cause for the halt. */
+
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
+
+	if (hcint.b.xfercomp) {
+		/** @todo This is here because of a possible hardware bug.  Spec
+		 * says that on SPLIT-ISOC OUT transfers in DMA mode that a HALT
+		 * interrupt w/ACK bit set should occur, but I only see the
+		 * XFERCOMP bit, even with it masked out.  This is a workaround
+		 * for that behavior.  Should fix this when hardware is fixed.
+		 */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
+			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
+		}
+		handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.stall) {
+		handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.xacterr && !hcd->core_if->dma_desc_enable) {
+		if (out_nak_enh) {
+			if (hcint.b.nyet || hcint.b.nak || hcint.b.ack) {
+				DWC_DEBUGPL(DBG_HCD, "XactErr with NYET/NAK/ACK\n");
+				qtd->error_count = 0;
+			} else {
+				DWC_DEBUGPL(DBG_HCD, "XactErr without NYET/NAK/ACK\n");
+			}
+		}
+
+		/*
+		 * Must handle xacterr before nak or ack. Could get a xacterr
+		 * at the same time as either of these on a BULK/CONTROL OUT
+		 * that started with a PING. The xacterr takes precedence.
+		 */
+		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.xcs_xact && hcd->core_if->dma_desc_enable) {
+		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.ahberr && hcd->core_if->dma_desc_enable) {
+		handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.bblerr) {
+		handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.frmovrun) {
+		handle_hc_frmovrun_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.datatglerr) {
+		handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
+	} else if (!out_nak_enh) {
+		if (hcint.b.nyet) {
+			/*
+			 * Must handle nyet before nak or ack. Could get a nyet at the
+			 * same time as either of those on a BULK/CONTROL OUT that
+			 * started with a PING. The nyet takes precedence.
+			 */
+			handle_hc_nyet_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.nak && !hcintmsk.b.nak) {
+			/*
+			 * If nak is not masked, it's because a non-split IN transfer
+			 * is in an error state. In that case, the nak is handled by
+			 * the nak interrupt handler, not here. Handle nak here for
+			 * BULK/CONTROL OUT transfers, which halt on a NAK to allow
+			 * rewinding the buffer pointer.
+			 */
+			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.ack && !hcintmsk.b.ack) {
+			/*
+			 * If ack is not masked, it's because a non-split IN transfer
+			 * is in an error state. In that case, the ack is handled by
+			 * the ack interrupt handler, not here. Handle ack here for
+			 * split transfers. Start splits halt on ACK.
+			 */
+			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+				/*
+				 * A periodic transfer halted with no other channel
+				 * interrupts set. Assume it was halted by the core
+				 * because it could not be completed in its scheduled
+				 * (micro)frame.
+				 */
+#ifdef DEBUG
+				DWC_PRINTF
+				    ("%s: Halt channel %d (assume incomplete periodic transfer)\n",
+				     __func__, hc->hc_num);
+#endif
+				halt_channel(hcd, hc, qtd,
+					     DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE);
+			} else {
+				DWC_ERROR
+				    ("%s: Channel %d, DMA Mode -- ChHltd set, but reason "
+				     "for halting is unknown, hcint 0x%08x, intsts 0x%08x\n",
+				     __func__, hc->hc_num, hcint.d32,
+				     DWC_READ_REG32(&hcd->
+						    core_if->core_global_regs->
+						    gintsts));
+				/* Failthrough: use 3-strikes rule */
+				qtd->error_count++;
+				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+				update_urb_state_xfer_intr(hc, hc_regs,
+					   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+				halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+			}
+
+		}
+	} else {
+		DWC_PRINTF("NYET/NAK/ACK/other in non-error case, 0x%08x\n",
+			   hcint.d32);
+		/* Failthrough: use 3-strikes rule */
+		qtd->error_count++;
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		update_urb_state_xfer_intr(hc, hc_regs,
+			   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+	}
+}
+
+/**
+ * Handles a host channel Channel Halted interrupt.
+ *
+ * In slave mode, this handler is called only when the driver specifically
+ * requests a halt. This occurs during handling other host channel interrupts
+ * (e.g. nak, xacterr, stall, nyet, etc.).
+ *
+ * In DMA mode, this is the interrupt that occurs when the core has finished
+ * processing a transfer on a channel. Other host channel interrupts (except
+ * ahberr) are disabled in DMA mode.
+ */
+static int32_t handle_hc_chhltd_intr(dwc_otg_hcd_t * hcd,
+				     dwc_hc_t * hc,
+				     dwc_otg_hc_regs_t * hc_regs,
+				     dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Channel Halted--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_enable) {
+		handle_hc_chhltd_intr_dma(hcd, hc, hc_regs, qtd);
+	} else {
+#ifdef DEBUG
+		if (!halt_status_ok(hcd, hc, hc_regs, qtd)) {
+			return 1;
+		}
+#endif
+		release_channel(hcd, hc, qtd, hc->halt_status);
+	}
+
+	return 1;
+}
+
+
+/**
+ * dwc_otg_fiq_unmangle_isoc() - Update the iso_frame_desc structure on
+ * FIQ transfer completion
+ * @hcd:	Pointer to dwc_otg_hcd struct
+ * @num:	Host channel number
+ *
+ * 1. Un-mangle the status as recorded in each iso_frame_desc status
+ * 2. Copy it from the dwc_otg_urb into the real URB
+ */
+void dwc_otg_fiq_unmangle_isoc(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
+{
+	struct dwc_otg_hcd_urb *dwc_urb = qtd->urb;
+	int nr_frames = dwc_urb->packet_count;
+	int i;
+	hcint_data_t frame_hcint;
+
+	for (i = 0; i < nr_frames; i++) {
+		frame_hcint.d32 = dwc_urb->iso_descs[i].status;
+		if (frame_hcint.b.xfercomp) {
+			dwc_urb->iso_descs[i].status = 0;
+			dwc_urb->actual_length += dwc_urb->iso_descs[i].actual_length;
+		} else if (frame_hcint.b.frmovrun) {
+			if (qh->ep_is_in)
+				dwc_urb->iso_descs[i].status = -DWC_E_NO_STREAM_RES;
+			else
+				dwc_urb->iso_descs[i].status = -DWC_E_COMMUNICATION;
+			dwc_urb->error_count++;
+			dwc_urb->iso_descs[i].actual_length = 0;
+		} else if (frame_hcint.b.xacterr) {
+			dwc_urb->iso_descs[i].status = -DWC_E_PROTOCOL;
+			dwc_urb->error_count++;
+			dwc_urb->iso_descs[i].actual_length = 0;
+		} else if (frame_hcint.b.bblerr) {
+			dwc_urb->iso_descs[i].status = -DWC_E_OVERFLOW;
+			dwc_urb->error_count++;
+			dwc_urb->iso_descs[i].actual_length = 0;
+		} else {
+			/* Something went wrong */
+			dwc_urb->iso_descs[i].status = -1;
+			dwc_urb->iso_descs[i].actual_length = 0;
+			dwc_urb->error_count++;
+		}
+	}
+	qh->sched_frame = dwc_frame_num_inc(qh->sched_frame, qh->interval * (nr_frames - 1));
+
+	//printk_ratelimited(KERN_INFO "%s: HS isochronous of %d/%d frames with %d errors complete\n",
+	//			__FUNCTION__, i, dwc_urb->packet_count, dwc_urb->error_count);
+}
+
+/**
+ * dwc_otg_fiq_unsetup_per_dma() - Remove data from bounce buffers for split transactions
+ * @hcd:	Pointer to dwc_otg_hcd struct
+ * @num:	Host channel number
+ *
+ * Copies data from the FIQ bounce buffers into the URB's transfer buffer. Does not modify URB state.
+ * Returns total length of data or -1 if the buffers were not used.
+ *
+ */
+int dwc_otg_fiq_unsetup_per_dma(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
+{
+	dwc_hc_t *hc = qh->channel;
+	struct fiq_dma_blob *blob = hcd->fiq_dmab;
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
+	uint8_t *ptr = NULL;
+	int index = 0, len = 0;
+	int i = 0;
+	if (hc->ep_is_in) {
+		/* Copy data out of the DMA bounce buffers to the URB's buffer.
+		 * The align_buf is ignored as this is ignored on FSM enqueue. */
+		ptr = qtd->urb->buf;
+		if (qh->ep_type == UE_ISOCHRONOUS) {
+			/* Isoc IN transactions - grab the offset of the iso_frame_desc into the URB transfer buffer */
+			index = qtd->isoc_frame_index;
+			ptr += qtd->urb->iso_descs[index].offset;
+		} else {
+			/* Need to increment by actual_length for interrupt IN */
+			ptr += qtd->urb->actual_length;
+		}
+
+		for (i = 0; i < st->dma_info.index; i++) {
+			len += st->dma_info.slot_len[i];
+			dwc_memcpy(ptr, &blob->channel[num].index[i].buf[0], st->dma_info.slot_len[i]);
+			ptr += st->dma_info.slot_len[i];
+		}
+		return len;
+	} else {
+		/* OUT endpoints - nothing to do. */
+		return -1;
+	}
+
+}
+/**
+ * dwc_otg_hcd_handle_hc_fsm() - handle an unmasked channel interrupt
+ * 				 from a channel handled in the FIQ
+ * @hcd:	Pointer to dwc_otg_hcd struct
+ * @num:	Host channel number
+ *
+ * If a host channel interrupt was received by the IRQ and this was a channel
+ * used by the FIQ, the execution flow for transfer completion is substantially
+ * different from the normal (messy) path. This function and its friends handles
+ * channel cleanup and transaction completion from a FIQ transaction.
+ */
+void dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd_t *hcd, uint32_t num)
+{
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
+	dwc_hc_t *hc = hcd->hc_ptr_array[num];
+	dwc_otg_qtd_t *qtd;
+	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[num];
+	hcint_data_t hcint = hcd->fiq_state->channel[num].hcint_copy;
+	hctsiz_data_t hctsiz = hcd->fiq_state->channel[num].hctsiz_copy;
+	int hostchannels  = 0;
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "OUT %01d %01d ", num , st->fsm);
+
+	hostchannels = hcd->available_host_channels;
+	if (hc->halt_pending) {
+		/* Dequeue: The FIQ was allowed to complete the transfer but state has been cleared. */
+		if (hc->qh && st->fsm == FIQ_NP_SPLIT_DONE &&
+				hcint.b.xfercomp && hc->qh->ep_type == UE_BULK) {
+			if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
+				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA1;
+			} else {
+				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+			}
+		}
+		release_channel(hcd, hc, NULL, hc->halt_status);
+		return;
+	}
+
+	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
+	switch (st->fsm) {
+	case FIQ_TEST:
+		break;
+
+	case FIQ_DEQUEUE_ISSUED:
+		/* Handled above, but keep for posterity */
+		release_channel(hcd, hc, NULL, hc->halt_status);
+		break;
+
+	case FIQ_NP_SPLIT_DONE:
+		/* Nonperiodic transaction complete. */
+		if (!hc->ep_is_in) {
+			qtd->ssplit_out_xfer_count = hc->xfer_len;
+		}
+		if (hcint.b.xfercomp) {
+			handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.nak) {
+			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			DWC_WARN("Unexpected IRQ state on FSM transaction:"
+					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
+				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_NP_SPLIT_HS_ABORTED:
+		/* A HS abort is a 3-strikes on the HS bus at any point in the transaction.
+		 * Normally a CLEAR_TT_BUFFER hub command would be required: we can't do that
+		 * because there's no guarantee which order a non-periodic split happened in.
+		 * We could end up clearing a perfectly good transaction out of the buffer.
+		 */
+		if (hcint.b.xacterr) {
+			qtd->error_count += st->nr_errors;
+			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.ahberr) {
+			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			DWC_WARN("Unexpected IRQ state on FSM transaction:"
+					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
+				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_NP_SPLIT_LS_ABORTED:
+		/* A few cases can cause this - either an unknown state on a SSPLIT or
+		 * STALL/data toggle error response on a CSPLIT */
+		if (hcint.b.stall) {
+			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.datatglerr) {
+			handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.bblerr) {
+			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.ahberr) {
+			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			DWC_WARN("Unexpected IRQ state on FSM transaction:"
+					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
+				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_PER_SPLIT_DONE:
+		/* Isoc IN or Interrupt IN/OUT */
+
+		/* Flow control here is different from the normal execution by the driver.
+		* We need to completely ignore most of the driver's method of handling
+		* split transactions and do it ourselves.
+		*/
+		if (hc->ep_type == UE_INTERRUPT) {
+			if (hcint.b.nak) {
+					handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
+			} else if (hc->ep_is_in) {
+				int len;
+				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
+				//printk(KERN_NOTICE "FIQ Transaction: hc=%d len=%d urb_len = %d\n", num, len, qtd->urb->length);
+				qtd->urb->actual_length += len;
+				if (qtd->urb->actual_length >= qtd->urb->length) {
+					qtd->urb->status = 0;
+					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
+					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+				} else {
+					/* Interrupt transfer not complete yet - is it a short read? */
+					if (len < hc->max_packet) {
+						/* Interrupt transaction complete */
+						qtd->urb->status = 0;
+						hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
+						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+					} else {
+						/* Further transactions required */
+						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+					}
+				}
+			} else {
+				/* Interrupt OUT complete. */
+				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+				qtd->urb->actual_length += hc->xfer_len;
+				if (qtd->urb->actual_length >= qtd->urb->length) {
+					qtd->urb->status = 0;
+					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
+					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+				} else {
+					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+				}
+			}
+		} else {
+			/* ISOC IN complete. */
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			int len = 0;
+			/* Record errors, update qtd. */
+			if (st->nr_errors) {
+				frame_desc->actual_length = 0;
+				frame_desc->status = -DWC_E_PROTOCOL;
+			} else {
+				frame_desc->status = 0;
+				/* Unswizzle dma */
+				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
+				frame_desc->actual_length = len;
+			}
+			qtd->isoc_frame_index++;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		}
+		break;
+
+	case FIQ_PER_ISO_OUT_DONE: {
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			/* Record errors, update qtd. */
+			if (st->nr_errors) {
+				frame_desc->actual_length = 0;
+				frame_desc->status = -DWC_E_PROTOCOL;
+			} else {
+				frame_desc->status = 0;
+				frame_desc->actual_length = frame_desc->length;
+			}
+			qtd->isoc_frame_index++;
+			qtd->isoc_split_offset = 0;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		}
+		break;
+
+	case FIQ_PER_SPLIT_NYET_ABORTED:
+		/* Doh. lost the data. */
+		printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
+				"- FIQ reported NYET. Data may have been lost.\n",
+				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
+		if (hc->ep_type == UE_ISOCHRONOUS) {
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			/* Record errors, update qtd. */
+			frame_desc->actual_length = 0;
+			frame_desc->status = -DWC_E_PROTOCOL;
+			qtd->isoc_frame_index++;
+			qtd->isoc_split_offset = 0;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		} else {
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_HS_ISOC_DONE:
+		/* The FIQ has performed a whole pile of isochronous transactions.
+		 * The status is recorded as the interrupt state should the transaction
+		 * fail.
+		 */
+		dwc_otg_fiq_unmangle_isoc(hcd, hc->qh, qtd, num);
+		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+		break;
+
+	case FIQ_PER_SPLIT_LS_ABORTED:
+		if (hcint.b.xacterr) {
+			/* Hub has responded with an ERR packet. Device
+			 * has been unplugged or the port has been disabled.
+			 * TODO: need to issue a reset to the hub port. */
+			qtd->error_count += 3;
+			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.stall) {
+			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.bblerr) {
+			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x failed "
+				"- FIQ reported FSM=%d. Data may have been lost.\n",
+				st->fsm, hc->dev_addr, hc->ep_num);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_PER_SPLIT_HS_ABORTED:
+		/* Either the SSPLIT phase suffered transaction errors or something
+		 * unexpected happened.
+		 */
+		qtd->error_count += 3;
+		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		break;
+
+	case FIQ_PER_SPLIT_TIMEOUT:
+		/* Couldn't complete in the nominated frame */
+		printk(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
+				"- FIQ timed out. Data may have been lost.\n",
+				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
+		if (hc->ep_type == UE_ISOCHRONOUS) {
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			/* Record errors, update qtd. */
+			frame_desc->actual_length = 0;
+			if (hc->ep_is_in) {
+				frame_desc->status = -DWC_E_NO_STREAM_RES;
+			} else {
+				frame_desc->status = -DWC_E_COMMUNICATION;
+			}
+			qtd->isoc_frame_index++;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		} else {
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	default:
+		DWC_WARN("Unexpected state received on hc=%d fsm=%d on transfer to device %d ep 0x%x", 
+					hc->hc_num, st->fsm, hc->dev_addr, hc->ep_num);
+		qtd->error_count++;
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+	}
+	return;
+}
+
+/** Handles interrupt for a specific Host Channel */
+int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd, uint32_t num)
+{
+	int retval = 0;
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	dwc_hc_t *hc;
+	dwc_otg_hc_regs_t *hc_regs;
+	dwc_otg_qtd_t *qtd;
+
+	DWC_DEBUGPL(DBG_HCDV, "--Host Channel Interrupt--, Channel %d\n", num);
+
+	hc = dwc_otg_hcd->hc_ptr_array[num];
+	hc_regs = dwc_otg_hcd->core_if->host_if->hc_regs[num];
+	if(hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+		/* A dequeue was issued for this transfer. Our QTD has gone away
+		 * but in the case of a FIQ transfer, the transfer would have run
+		 * to completion.
+		 */
+		if (fiq_fsm_enable && dwc_otg_hcd->fiq_state->channel[num].fsm != FIQ_PASSTHROUGH) {
+			dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
+		} else {
+			release_channel(dwc_otg_hcd, hc, NULL, hc->halt_status);
+		}
+		return 1;
+	}
+	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
+
+	/*
+	 * FSM mode: Check to see if this is a HC interrupt from a channel handled by the FIQ.
+	 * Execution path is fundamentally different for the channels after a FIQ has completed
+	 * a split transaction.
+	 */
+	if (fiq_fsm_enable) {
+		switch (dwc_otg_hcd->fiq_state->channel[num].fsm) {
+			case FIQ_PASSTHROUGH:
+				break;
+			case FIQ_PASSTHROUGH_ERRORSTATE:
+				/* Hook into the error count */
+				fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "HCDERR%02d", num);
+				if (!dwc_otg_hcd->fiq_state->channel[num].nr_errors) {
+					qtd->error_count = 0;
+					fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "RESET   ");
+				}
+				break;
+			default:
+				dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
+				return 1;
+		}
+	}
+
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
+	hcint.d32 = hcint.d32 & hcintmsk.d32;
+	if (!dwc_otg_hcd->core_if->dma_enable) {
+		if (hcint.b.chhltd && hcint.d32 != 0x2) {
+			hcint.b.chhltd = 0;
+		}
+	}
+
+	if (hcint.b.xfercomp) {
+		retval |=
+		    handle_hc_xfercomp_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+		/*
+		 * If NYET occurred at same time as Xfer Complete, the NYET is
+		 * handled by the Xfer Complete interrupt handler. Don't want
+		 * to call the NYET interrupt handler in this case.
+		 */
+		hcint.b.nyet = 0;
+	}
+	if (hcint.b.chhltd) {
+		retval |= handle_hc_chhltd_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.ahberr) {
+		retval |= handle_hc_ahberr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.stall) {
+		retval |= handle_hc_stall_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.nak) {
+		retval |= handle_hc_nak_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.ack) {
+		if(!hcint.b.chhltd)
+			retval |= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.nyet) {
+		retval |= handle_hc_nyet_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.xacterr) {
+		retval |= handle_hc_xacterr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.bblerr) {
+		retval |= handle_hc_babble_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.frmovrun) {
+		retval |=
+		    handle_hc_frmovrun_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.datatglerr) {
+		retval |=
+		    handle_hc_datatglerr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+
+	return retval;
+}
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
new file mode 100644
index 0000000000000..660d069dda1d3
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -0,0 +1,1002 @@
+
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_linux.c $
+ * $Revision: #20 $
+ * $Date: 2011/10/26 $
+ * $Change: 1872981 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/**
+ * @file
+ *
+ * This file contains the implementation of the HCD. In Linux, the HCD
+ * implements the hc_driver API.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/string.h>
+#include <linux/dma-mapping.h>
+#include <linux/version.h>
+#include <asm/io.h>
+#include <asm/fiq.h>
+#include <linux/usb.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+#include <../drivers/usb/core/hcd.h>
+#else
+#include <linux/usb/hcd.h>
+#endif
+#include <asm/bug.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
+#define USB_URB_EP_LINKING 1
+#else
+#define USB_URB_EP_LINKING 0
+#endif
+
+#include "dwc_otg_hcd_if.h"
+#include "dwc_otg_dbg.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_hcd.h"
+
+extern unsigned char  _dwc_otg_fiq_stub, _dwc_otg_fiq_stub_end;
+
+/**
+ * Gets the endpoint number from a _bEndpointAddress argument. The endpoint is
+ * qualified with its direction (possible 32 endpoints per device).
+ */
+#define dwc_ep_addr_to_endpoint(_bEndpointAddress_) ((_bEndpointAddress_ & USB_ENDPOINT_NUMBER_MASK) | \
+						     ((_bEndpointAddress_ & USB_DIR_IN) != 0) << 4)
+
+static const char dwc_otg_hcd_name[] = "dwc_otg_hcd";
+
+extern bool fiq_enable;
+
+/** @name Linux HC Driver API Functions */
+/** @{ */
+/* manage i/o requests, device state */
+static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		       struct usb_host_endpoint *ep,
+#endif
+		       struct urb *urb, gfp_t mem_flags);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb);
+#endif
+#else /* kernels at or post 2.6.30 */
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd,
+                               struct urb *urb, int status);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30) */
+
+static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
+#endif
+static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd);
+extern int hcd_start(struct usb_hcd *hcd);
+extern void hcd_stop(struct usb_hcd *hcd);
+static int get_frame_number(struct usb_hcd *hcd);
+extern int hub_status_data(struct usb_hcd *hcd, char *buf);
+extern int hub_control(struct usb_hcd *hcd,
+		       u16 typeReq,
+		       u16 wValue, u16 wIndex, char *buf, u16 wLength);
+
+struct wrapper_priv_data {
+	dwc_otg_hcd_t *dwc_otg_hcd;
+};
+
+/** @} */
+
+static struct hc_driver dwc_otg_hc_driver = {
+
+	.description = dwc_otg_hcd_name,
+	.product_desc = "DWC OTG Controller",
+	.hcd_priv_size = sizeof(struct wrapper_priv_data),
+
+	.irq = dwc_otg_hcd_irq,
+
+	.flags = HCD_MEMORY | HCD_USB2,
+
+	//.reset =
+	.start = hcd_start,
+	//.suspend =
+	//.resume =
+	.stop = hcd_stop,
+
+	.urb_enqueue = dwc_otg_urb_enqueue,
+	.urb_dequeue = dwc_otg_urb_dequeue,
+	.endpoint_disable = endpoint_disable,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+	.endpoint_reset = endpoint_reset,
+#endif
+	.get_frame_number = get_frame_number,
+
+	.hub_status_data = hub_status_data,
+	.hub_control = hub_control,
+	//.bus_suspend =
+	//.bus_resume =
+};
+
+/** Gets the dwc_otg_hcd from a struct usb_hcd */
+static inline dwc_otg_hcd_t *hcd_to_dwc_otg_hcd(struct usb_hcd *hcd)
+{
+	struct wrapper_priv_data *p;
+	p = (struct wrapper_priv_data *)(hcd->hcd_priv);
+	return p->dwc_otg_hcd;
+}
+
+/** Gets the struct usb_hcd that contains a dwc_otg_hcd_t. */
+static inline struct usb_hcd *dwc_otg_hcd_to_hcd(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	return dwc_otg_hcd_get_priv_data(dwc_otg_hcd);
+}
+
+/** Gets the usb_host_endpoint associated with an URB. */
+inline struct usb_host_endpoint *dwc_urb_to_endpoint(struct urb *urb)
+{
+	struct usb_device *dev = urb->dev;
+	int ep_num = usb_pipeendpoint(urb->pipe);
+
+	if (usb_pipein(urb->pipe))
+		return dev->ep_in[ep_num];
+	else
+		return dev->ep_out[ep_num];
+}
+
+static int _disconnect(dwc_otg_hcd_t * hcd)
+{
+	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
+
+	usb_hcd->self.is_b_host = 0;
+	return 0;
+}
+
+static int _start(dwc_otg_hcd_t * hcd)
+{
+	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
+
+	usb_hcd->self.is_b_host = dwc_otg_hcd_is_b_host(hcd);
+	hcd_start(usb_hcd);
+
+	return 0;
+}
+
+static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
+		     uint32_t * port_addr)
+{
+   struct urb *urb = (struct urb *)urb_handle;
+   struct usb_bus *bus;
+#if 1 //GRAYG - temporary
+   if (NULL == urb_handle)
+      DWC_ERROR("**** %s - NULL URB handle\n", __func__);//GRAYG
+   if (NULL == urb->dev)
+      DWC_ERROR("**** %s - URB has no device\n", __func__);//GRAYG
+   if (NULL == port_addr)
+      DWC_ERROR("**** %s - NULL port_address\n", __func__);//GRAYG
+#endif
+   if (urb->dev->tt) {
+        if (NULL == urb->dev->tt->hub) {
+                DWC_ERROR("**** %s - (URB's transactor has no TT - giving no hub)\n",
+                           __func__); //GRAYG
+                //*hub_addr = (u8)usb_pipedevice(urb->pipe); //GRAYG
+                *hub_addr = 0; //GRAYG
+                // we probably shouldn't have a transaction translator if
+                // there's no associated hub?
+        } else {
+		bus = hcd_to_bus(dwc_otg_hcd_to_hcd(hcd));
+		if (urb->dev->tt->hub == bus->root_hub)
+			*hub_addr = 0;
+		else
+			*hub_addr = urb->dev->tt->hub->devnum;
+	}
+	*port_addr = urb->dev->tt->multi ? urb->dev->ttport : 1;
+   } else {
+        *hub_addr = 0;
+	*port_addr = urb->dev->ttport;
+   }
+   return 0;
+}
+
+static int _speed(dwc_otg_hcd_t * hcd, void *urb_handle)
+{
+	struct urb *urb = (struct urb *)urb_handle;
+	return urb->dev->speed;
+}
+
+static int _get_b_hnp_enable(dwc_otg_hcd_t * hcd)
+{
+	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
+	return usb_hcd->self.b_hnp_enable;
+}
+
+static void allocate_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
+				   struct urb *urb)
+{
+	hcd_to_bus(hcd)->bandwidth_allocated += bw / urb->interval;
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		hcd_to_bus(hcd)->bandwidth_isoc_reqs++;
+	} else {
+		hcd_to_bus(hcd)->bandwidth_int_reqs++;
+	}
+}
+
+static void free_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
+			       struct urb *urb)
+{
+	hcd_to_bus(hcd)->bandwidth_allocated -= bw / urb->interval;
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		hcd_to_bus(hcd)->bandwidth_isoc_reqs--;
+	} else {
+		hcd_to_bus(hcd)->bandwidth_int_reqs--;
+	}
+}
+
+/**
+ * Sets the final status of an URB and returns it to the device driver. Any
+ * required cleanup of the URB is performed.  The HCD lock should be held on
+ * entry.
+ */
+static int _complete(dwc_otg_hcd_t * hcd, void *urb_handle,
+		     dwc_otg_hcd_urb_t * dwc_otg_urb, int32_t status)
+{
+	struct urb *urb = (struct urb *)urb_handle;
+	urb_tq_entry_t *new_entry;
+	int rc = 0;
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		DWC_PRINTF("%s: urb %p, device %d, ep %d %s, status=%d\n",
+			   __func__, urb, usb_pipedevice(urb->pipe),
+			   usb_pipeendpoint(urb->pipe),
+			   usb_pipein(urb->pipe) ? "IN" : "OUT", status);
+		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+			int i;
+			for (i = 0; i < urb->number_of_packets; i++) {
+				DWC_PRINTF("  ISO Desc %d status: %d\n",
+					   i, urb->iso_frame_desc[i].status);
+			}
+		}
+	}
+	new_entry = DWC_ALLOC_ATOMIC(sizeof(urb_tq_entry_t));
+	urb->actual_length = dwc_otg_hcd_urb_get_actual_length(dwc_otg_urb);
+	/* Convert status value. */
+	switch (status) {
+	case -DWC_E_PROTOCOL:
+		status = -EPROTO;
+		break;
+	case -DWC_E_IN_PROGRESS:
+		status = -EINPROGRESS;
+		break;
+	case -DWC_E_PIPE:
+		status = -EPIPE;
+		break;
+	case -DWC_E_IO:
+		status = -EIO;
+		break;
+	case -DWC_E_TIMEOUT:
+		status = -ETIMEDOUT;
+		break;
+	case -DWC_E_OVERFLOW:
+		status = -EOVERFLOW;
+		break;
+	case -DWC_E_SHUTDOWN:
+		status = -ESHUTDOWN;
+		break;
+	default:
+		if (status) {
+			DWC_PRINTF("Uknown urb status %d\n", status);
+
+		}
+	}
+
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		int i;
+
+		urb->error_count = dwc_otg_hcd_urb_get_error_count(dwc_otg_urb);
+		urb->actual_length = 0;
+		for (i = 0; i < urb->number_of_packets; ++i) {
+			urb->iso_frame_desc[i].actual_length =
+			    dwc_otg_hcd_urb_get_iso_desc_actual_length
+			    (dwc_otg_urb, i);
+			urb->actual_length += urb->iso_frame_desc[i].actual_length;
+			urb->iso_frame_desc[i].status =
+			    dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_urb, i);
+		}
+	}
+
+	urb->status = status;
+	urb->hcpriv = NULL;
+	if (!status) {
+		if ((urb->transfer_flags & URB_SHORT_NOT_OK) &&
+		    (urb->actual_length < urb->transfer_buffer_length)) {
+			urb->status = -EREMOTEIO;
+		}
+	}
+
+	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) ||
+	    (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
+		struct usb_host_endpoint *ep = dwc_urb_to_endpoint(urb);
+		if (ep) {
+			free_bus_bandwidth(dwc_otg_hcd_to_hcd(hcd),
+					   dwc_otg_hcd_get_ep_bandwidth(hcd,
+									ep->hcpriv),
+					   urb);
+		}
+	}
+	DWC_FREE(dwc_otg_urb);
+	if (!new_entry) {
+		DWC_ERROR("dwc_otg_hcd: complete: cannot allocate URB TQ entry\n");
+		urb->status = -EPROTO;
+		/* don't schedule the tasklet -
+		 * directly return the packet here with error. */
+#if USB_URB_EP_LINKING
+		usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb);
+#else
+		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
+#endif
+	} else {
+		new_entry->urb = urb;
+#if USB_URB_EP_LINKING
+		rc = usb_hcd_check_unlink_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
+		if(0 == rc) {
+			usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
+		}
+#endif
+		if(0 == rc) {
+			DWC_TAILQ_INSERT_TAIL(&hcd->completed_urb_list, new_entry,
+						urb_tq_entries);
+			DWC_TASK_HI_SCHEDULE(hcd->completion_tasklet);
+		}
+	}
+	return 0;
+}
+
+static struct dwc_otg_hcd_function_ops hcd_fops = {
+	.start = _start,
+	.disconnect = _disconnect,
+	.hub_info = _hub_info,
+	.speed = _speed,
+	.complete = _complete,
+	.get_b_hnp_enable = _get_b_hnp_enable,
+};
+
+static struct fiq_handler fh = {
+  .name = "usb_fiq",
+};
+
+static void hcd_init_fiq(void *cookie)
+{
+	dwc_otg_device_t *otg_dev = cookie;
+	dwc_otg_hcd_t *dwc_otg_hcd = otg_dev->hcd;
+	struct pt_regs regs;
+	int irq;
+
+	if (claim_fiq(&fh)) {
+		DWC_ERROR("Can't claim FIQ");
+		BUG();
+	}
+	DWC_WARN("FIQ on core %d at 0x%08x",
+				smp_processor_id(),
+				(fiq_fsm_enable ? (int)&dwc_otg_fiq_fsm : (int)&dwc_otg_fiq_nop));
+	DWC_WARN("FIQ ASM at 0x%08x length %d", (int)&_dwc_otg_fiq_stub, (int)(&_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub));
+		set_fiq_handler((void *) &_dwc_otg_fiq_stub, &_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub);
+	memset(&regs,0,sizeof(regs));
+
+	regs.ARM_r8 = (long) dwc_otg_hcd->fiq_state;
+	if (fiq_fsm_enable) {
+		regs.ARM_r9 = dwc_otg_hcd->core_if->core_params->host_channels;
+		//regs.ARM_r10 = dwc_otg_hcd->dma;
+		regs.ARM_fp = (long) dwc_otg_fiq_fsm;
+	} else {
+		regs.ARM_fp = (long) dwc_otg_fiq_nop;
+	}
+
+	regs.ARM_sp = (long) dwc_otg_hcd->fiq_stack + (sizeof(struct fiq_stack) - 4);
+
+//		__show_regs(&regs);
+	set_fiq_regs(&regs);
+
+	//Set the mphi periph to  the required registers
+	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
+	dwc_otg_hcd->fiq_state->mphi_regs.ctrl    = otg_dev->os_dep.mphi_base + 0x4c;
+	dwc_otg_hcd->fiq_state->mphi_regs.outdda  = otg_dev->os_dep.mphi_base + 0x28;
+	dwc_otg_hcd->fiq_state->mphi_regs.outddb  = otg_dev->os_dep.mphi_base + 0x2c;
+	dwc_otg_hcd->fiq_state->mphi_regs.intstat = otg_dev->os_dep.mphi_base + 0x50;
+	dwc_otg_hcd->fiq_state->dwc_regs_base = otg_dev->os_dep.base;
+	DWC_WARN("MPHI regs_base at 0x%08x", (int)dwc_otg_hcd->fiq_state->mphi_regs.base);
+	//Enable mphi peripheral
+	writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
+#ifdef DEBUG
+	if (readl(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & 0x80000000)
+		DWC_WARN("MPHI periph has been enabled");
+	else
+		DWC_WARN("MPHI periph has NOT been enabled");
+#endif
+	// Enable FIQ interrupt from USB peripheral
+#ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
+	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
+#else
+	irq = INTERRUPT_VC_USB;
+#endif
+	if (irq < 0) {
+		DWC_ERROR("Can't get FIQ irq");
+		return;
+	}
+	/*
+	 * We could take an interrupt immediately after enabling the FIQ.
+	 * Ensure coherency of hcd->fiq_state.
+	 */
+	smp_mb();
+	enable_fiq(irq);
+	local_fiq_enable();
+}
+
+/**
+ * Initializes the HCD. This function allocates memory for and initializes the
+ * static parts of the usb_hcd and dwc_otg_hcd structures. It also registers the
+ * USB bus with the core and calls the hc_driver->start() function. It returns
+ * a negative error on failure.
+ */
+int hcd_init(dwc_bus_dev_t *_dev)
+{
+	struct usb_hcd *hcd = NULL;
+	dwc_otg_hcd_t *dwc_otg_hcd = NULL;
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	int retval = 0;
+        u64 dmamask;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD INIT otg_dev=%p\n", otg_dev);
+
+	/* Set device flags indicating whether the HCD supports DMA. */
+	if (dwc_otg_is_dma_enable(otg_dev->core_if))
+                dmamask = DMA_BIT_MASK(32);
+        else
+                dmamask = 0;
+
+#if    defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
+        dma_set_mask(&_dev->dev, dmamask);
+        dma_set_coherent_mask(&_dev->dev, dmamask);
+#elif  defined(PCI_INTERFACE)
+        pci_set_dma_mask(_dev, dmamask);
+        pci_set_consistent_dma_mask(_dev, dmamask);
+#endif
+
+	/*
+	 * Allocate memory for the base HCD plus the DWC OTG HCD.
+	 * Initialize the base HCD.
+	 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
+	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, _dev->dev.bus_id);
+#else
+	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, dev_name(&_dev->dev));
+	hcd->has_tt = 1;
+//      hcd->uses_new_polling = 1;
+//      hcd->poll_rh = 0;
+#endif
+	if (!hcd) {
+		retval = -ENOMEM;
+		goto error1;
+	}
+
+	hcd->regs = otg_dev->os_dep.base;
+
+
+	/* Initialize the DWC OTG HCD. */
+	dwc_otg_hcd = dwc_otg_hcd_alloc_hcd();
+	if (!dwc_otg_hcd) {
+		goto error2;
+	}
+	((struct wrapper_priv_data *)(hcd->hcd_priv))->dwc_otg_hcd =
+	    dwc_otg_hcd;
+	otg_dev->hcd = dwc_otg_hcd;
+	otg_dev->hcd->otg_dev = otg_dev;
+
+	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if)) {
+		goto error2;
+	}
+
+	if (fiq_enable) {
+		if (num_online_cpus() > 1) {
+			/*
+			 * bcm2709: can run the FIQ on a separate core to IRQs.
+			 * Ensure driver state is visible to other cores before setting up the FIQ.
+			 */
+			smp_mb();
+			smp_call_function_single(1, hcd_init_fiq, otg_dev, 1);
+		} else {
+			smp_call_function_single(0, hcd_init_fiq, otg_dev, 1);
+		}
+	}
+
+	hcd->self.otg_port = dwc_otg_hcd_otg_port(dwc_otg_hcd);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,33) //don't support for LM(with 2.6.20.1 kernel)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) //version field absent later
+	hcd->self.otg_version = dwc_otg_get_otg_version(otg_dev->core_if);
+#endif
+	/* Don't support SG list at this point */
+	hcd->self.sg_tablesize = 0;
+#endif
+	/*
+	 * Finish generic HCD initialization and start the HCD. This function
+	 * allocates the DMA buffer pool, registers the USB bus, requests the
+	 * IRQ line, and calls hcd_start method.
+	 */
+#ifdef PLATFORM_INTERFACE
+	retval = usb_add_hcd(hcd, platform_get_irq(_dev, fiq_enable ? 0 : 1), IRQF_SHARED);
+#else
+	retval = usb_add_hcd(hcd, _dev->irq, IRQF_SHARED);
+#endif
+	if (retval < 0) {
+		goto error2;
+	}
+
+	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, hcd);
+	return 0;
+
+error2:
+	usb_put_hcd(hcd);
+error1:
+	return retval;
+}
+
+/**
+ * Removes the HCD.
+ * Frees memory and resources associated with the HCD and deregisters the bus.
+ */
+void hcd_remove(dwc_bus_dev_t *_dev)
+{
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	dwc_otg_hcd_t *dwc_otg_hcd;
+	struct usb_hcd *hcd;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD REMOVE otg_dev=%p\n", otg_dev);
+
+	if (!otg_dev) {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
+		return;
+	}
+
+	dwc_otg_hcd = otg_dev->hcd;
+
+	if (!dwc_otg_hcd) {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
+		return;
+	}
+
+	hcd = dwc_otg_hcd_to_hcd(dwc_otg_hcd);
+
+	if (!hcd) {
+		DWC_DEBUGPL(DBG_ANY,
+			    "%s: dwc_otg_hcd_to_hcd(dwc_otg_hcd) NULL!\n",
+			    __func__);
+		return;
+	}
+	usb_remove_hcd(hcd);
+	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, NULL);
+	dwc_otg_hcd_remove(dwc_otg_hcd);
+	usb_put_hcd(hcd);
+}
+
+/* =========================================================================
+ *  Linux HC Driver Functions
+ * ========================================================================= */
+
+/** Initializes the DWC_otg controller and its root hub and prepares it for host
+ * mode operation. Activates the root port. Returns 0 on success and a negative
+ * error code on failure. */
+int hcd_start(struct usb_hcd *hcd)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	struct usb_bus *bus;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD START\n");
+	bus = hcd_to_bus(hcd);
+
+	hcd->state = HC_STATE_RUNNING;
+	if (dwc_otg_hcd_start(dwc_otg_hcd, &hcd_fops)) {
+		return 0;
+	}
+
+	/* Initialize and connect root hub if one is not already attached */
+	if (bus->root_hub) {
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD Has Root Hub\n");
+		/* Inform the HUB driver to resume. */
+		usb_hcd_resume_root_hub(hcd);
+	}
+
+	return 0;
+}
+
+/**
+ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
+ * stopped.
+ */
+void hcd_stop(struct usb_hcd *hcd)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	dwc_otg_hcd_stop(dwc_otg_hcd);
+}
+
+/** Returns the current frame number. */
+static int get_frame_number(struct usb_hcd *hcd)
+{
+	hprt0_data_t hprt0;
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+	if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
+		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd) >> 3;
+	else
+		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd);
+}
+
+#ifdef DEBUG
+static void dump_urb_info(struct urb *urb, char *fn_name)
+{
+	DWC_PRINTF("%s, urb %p\n", fn_name, urb);
+	DWC_PRINTF("  Device address: %d\n", usb_pipedevice(urb->pipe));
+	DWC_PRINTF("  Endpoint: %d, %s\n", usb_pipeendpoint(urb->pipe),
+		   (usb_pipein(urb->pipe) ? "IN" : "OUT"));
+	DWC_PRINTF("  Endpoint type: %s\n", ( {
+					     char *pipetype;
+					     switch (usb_pipetype(urb->pipe)) {
+case PIPE_CONTROL:
+pipetype = "CONTROL"; break; case PIPE_BULK:
+pipetype = "BULK"; break; case PIPE_INTERRUPT:
+pipetype = "INTERRUPT"; break; case PIPE_ISOCHRONOUS:
+pipetype = "ISOCHRONOUS"; break; default:
+					     pipetype = "UNKNOWN"; break;};
+					     pipetype;}
+		   )) ;
+	DWC_PRINTF("  Speed: %s\n", ( {
+				     char *speed; switch (urb->dev->speed) {
+case USB_SPEED_HIGH:
+speed = "HIGH"; break; case USB_SPEED_FULL:
+speed = "FULL"; break; case USB_SPEED_LOW:
+speed = "LOW"; break; default:
+				     speed = "UNKNOWN"; break;};
+				     speed;}
+		   )) ;
+	DWC_PRINTF("  Max packet size: %d\n",
+		   usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe)));
+	DWC_PRINTF("  Data buffer length: %d\n", urb->transfer_buffer_length);
+	DWC_PRINTF("  Transfer buffer: %p, Transfer DMA: %p\n",
+		   urb->transfer_buffer, (void *)urb->transfer_dma);
+	DWC_PRINTF("  Setup buffer: %p, Setup DMA: %p\n",
+		   urb->setup_packet, (void *)urb->setup_dma);
+	DWC_PRINTF("  Interval: %d\n", urb->interval);
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		int i;
+		for (i = 0; i < urb->number_of_packets; i++) {
+			DWC_PRINTF("  ISO Desc %d:\n", i);
+			DWC_PRINTF("    offset: %d, length %d\n",
+				   urb->iso_frame_desc[i].offset,
+				   urb->iso_frame_desc[i].length);
+		}
+	}
+}
+#endif
+
+/** Starts processing a USB transfer request specified by a USB Request Block
+ * (URB). mem_flags indicates the type of memory allocation to use while
+ * processing this URB. */
+static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		       struct usb_host_endpoint *ep,
+#endif
+		       struct urb *urb, gfp_t mem_flags)
+{
+	int retval = 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
+	struct usb_host_endpoint *ep = urb->ep;
+#endif
+	dwc_irqflags_t irqflags;
+        void **ref_ep_hcpriv = &ep->hcpriv;
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	dwc_otg_hcd_urb_t *dwc_otg_urb;
+	int i;
+	int alloc_bandwidth = 0;
+	uint8_t ep_type = 0;
+	uint32_t flags = 0;
+	void *buf;
+
+#ifdef DEBUG
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		dump_urb_info(urb, "dwc_otg_urb_enqueue");
+	}
+#endif
+
+	if (!urb->transfer_buffer && urb->transfer_buffer_length)
+		return -EINVAL;
+
+	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+	    || (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
+		if (!dwc_otg_hcd_is_bandwidth_allocated
+		    (dwc_otg_hcd, ref_ep_hcpriv)) {
+			alloc_bandwidth = 1;
+		}
+	}
+
+	switch (usb_pipetype(urb->pipe)) {
+	case PIPE_CONTROL:
+		ep_type = USB_ENDPOINT_XFER_CONTROL;
+		break;
+	case PIPE_ISOCHRONOUS:
+		ep_type = USB_ENDPOINT_XFER_ISOC;
+		break;
+	case PIPE_BULK:
+		ep_type = USB_ENDPOINT_XFER_BULK;
+		break;
+	case PIPE_INTERRUPT:
+		ep_type = USB_ENDPOINT_XFER_INT;
+		break;
+	default:
+                DWC_WARN("Wrong EP type - %d\n", usb_pipetype(urb->pipe));
+	}
+
+        /* # of packets is often 0 - do we really need to call this then? */
+	dwc_otg_urb = dwc_otg_hcd_urb_alloc(dwc_otg_hcd,
+					    urb->number_of_packets,
+					    mem_flags == GFP_ATOMIC ? 1 : 0);
+
+	if(dwc_otg_urb == NULL)
+		return -ENOMEM;
+
+	if (!dwc_otg_urb && urb->number_of_packets)
+		return -ENOMEM;
+
+	dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_urb, usb_pipedevice(urb->pipe),
+				     usb_pipeendpoint(urb->pipe), ep_type,
+				     usb_pipein(urb->pipe),
+				     usb_maxpacket(urb->dev, urb->pipe,
+						   !(usb_pipein(urb->pipe))));
+
+	buf = urb->transfer_buffer;
+	if (hcd->self.uses_dma && !buf && urb->transfer_buffer_length) {
+		/*
+		 * Calculate virtual address from physical address,
+		 * because some class driver may not fill transfer_buffer.
+		 * In Buffer DMA mode virual address is used,
+		 * when handling non DWORD aligned buffers.
+		 */
+		buf = (void *)__bus_to_virt((unsigned long)urb->transfer_dma);
+		dev_warn_once(&urb->dev->dev,
+			      "USB transfer_buffer was NULL, will use __bus_to_virt(%pad)=%p\n",
+			      &urb->transfer_dma, buf);
+	}
+
+	if (!(urb->transfer_flags & URB_NO_INTERRUPT))
+		flags |= URB_GIVEBACK_ASAP;
+	if (urb->transfer_flags & URB_ZERO_PACKET)
+		flags |= URB_SEND_ZERO_PACKET;
+
+	dwc_otg_hcd_urb_set_params(dwc_otg_urb, urb, buf,
+				   urb->transfer_dma,
+				   urb->transfer_buffer_length,
+				   urb->setup_packet,
+				   urb->setup_dma, flags, urb->interval);
+
+	for (i = 0; i < urb->number_of_packets; ++i) {
+		dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_urb, i,
+						    urb->
+						    iso_frame_desc[i].offset,
+						    urb->
+						    iso_frame_desc[i].length);
+	}
+
+	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &irqflags);
+	urb->hcpriv = dwc_otg_urb;
+#if USB_URB_EP_LINKING
+	retval = usb_hcd_link_urb_to_ep(hcd, urb);
+	if (0 == retval)
+#endif
+	{
+		retval = dwc_otg_hcd_urb_enqueue(dwc_otg_hcd, dwc_otg_urb,
+						/*(dwc_otg_qh_t **)*/
+						ref_ep_hcpriv, 1);
+		if (0 == retval) {
+			if (alloc_bandwidth) {
+				allocate_bus_bandwidth(hcd,
+						dwc_otg_hcd_get_ep_bandwidth(
+							dwc_otg_hcd, *ref_ep_hcpriv),
+						urb);
+			}
+		} else {
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG dwc_otg_hcd_urb_enqueue failed rc %d\n", retval);
+#if USB_URB_EP_LINKING
+			usb_hcd_unlink_urb_from_ep(hcd, urb);
+#endif
+			DWC_FREE(dwc_otg_urb);
+			urb->hcpriv = NULL;
+			if (retval == -DWC_E_NO_DEVICE)
+				retval = -ENODEV;
+		}
+	}
+#if USB_URB_EP_LINKING
+	else
+	{
+		DWC_FREE(dwc_otg_urb);
+		urb->hcpriv = NULL;
+	}
+#endif
+	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, irqflags);
+	return retval;
+}
+
+/** Aborts/cancels a USB transfer request. Always returns 0 to indicate
+ * success.  */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+#else
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+#endif
+{
+	dwc_irqflags_t flags;
+	dwc_otg_hcd_t *dwc_otg_hcd;
+        int rc;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue\n");
+
+	dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+#ifdef DEBUG
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		dump_urb_info(urb, "dwc_otg_urb_dequeue");
+	}
+#endif
+
+	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+	if (0 == rc) {
+		if(urb->hcpriv != NULL) {
+	                dwc_otg_hcd_urb_dequeue(dwc_otg_hcd,
+	                                    (dwc_otg_hcd_urb_t *)urb->hcpriv);
+
+		        DWC_FREE(urb->hcpriv);
+			urb->hcpriv = NULL;
+		}
+        }
+
+        if (0 == rc) {
+		/* Higher layer software sets URB status. */
+#if USB_URB_EP_LINKING
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+#endif
+		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+                usb_hcd_giveback_urb(hcd, urb);
+#else
+                usb_hcd_giveback_urb(hcd, urb, status);
+#endif
+                if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+                        DWC_PRINTF("Called usb_hcd_giveback_urb() \n");
+                        DWC_PRINTF("  1urb->status = %d\n", urb->status);
+                }
+                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue OK\n");
+        } else {
+		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue failed - rc %d\n",
+                            rc);
+        }
+
+	return rc;
+}
+
+/* Frees resources in the DWC_otg controller related to a given endpoint. Also
+ * clears state in the HCD related to the endpoint. Any URBs for the endpoint
+ * must already be dequeued. */
+static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	DWC_DEBUGPL(DBG_HCD,
+		    "DWC OTG HCD EP DISABLE: _bEndpointAddress=0x%02x, "
+		    "endpoint=%d\n", ep->desc.bEndpointAddress,
+		    dwc_ep_addr_to_endpoint(ep->desc.bEndpointAddress));
+	dwc_otg_hcd_endpoint_disable(dwc_otg_hcd, ep->hcpriv, 250);
+	ep->hcpriv = NULL;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+/* Resets endpoint specific parameter values, in current version used to reset
+ * the data toggle(as a WA). This function can be called from usb_clear_halt routine */
+static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
+{
+	dwc_irqflags_t flags;
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n", epnum);
+
+	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+	if (ep->hcpriv) {
+		dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+}
+#endif
+
+/** Handles host mode interrupts for the DWC_otg controller. Returns IRQ_NONE if
+ * there was no interrupt to handle. Returns IRQ_HANDLED if there was a valid
+ * interrupt.
+ *
+ * This function is called by the USB core when an interrupt occurs */
+static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	int32_t retval = dwc_otg_hcd_handle_intr(dwc_otg_hcd);
+	if (retval != 0) {
+		S3C2410X_CLEAR_EINTPEND();
+	}
+	return IRQ_RETVAL(retval);
+}
+
+/** Creates Status Change bitmap for the root hub and root port. The bitmap is
+ * returned in buf. Bit 0 is the status change indicator for the root hub. Bit 1
+ * is the status change indicator for the single root port. Returns 1 if either
+ * change indicator is 1, otherwise returns 0. */
+int hub_status_data(struct usb_hcd *hcd, char *buf)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	buf[0] = 0;
+	buf[0] |= (dwc_otg_hcd_is_status_changed(dwc_otg_hcd, 1)) << 1;
+
+	return (buf[0] != 0);
+}
+
+/** Handles hub class-specific requests. */
+int hub_control(struct usb_hcd *hcd,
+		u16 typeReq, u16 wValue, u16 wIndex, char *buf, u16 wLength)
+{
+	int retval;
+
+	retval = dwc_otg_hcd_hub_control(hcd_to_dwc_otg_hcd(hcd),
+					 typeReq, wValue, wIndex, buf, wLength);
+
+	switch (retval) {
+	case -DWC_E_INVALID:
+		retval = -EINVAL;
+		break;
+	}
+
+	return retval;
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
new file mode 100644
index 0000000000000..fe8e8f841f036
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
@@ -0,0 +1,971 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_queue.c $
+ * $Revision: #44 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/**
+ * @file
+ *
+ * This file contains the functions to manage Queue Heads and Queue
+ * Transfer Descriptors.
+ */
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+
+extern bool microframe_schedule;
+extern unsigned short int_ep_interval_min;
+
+/**
+ * Free each QTD in the QH's QTD-list then free the QH.  QH should already be
+ * removed from a list.  QTD list should already be empty if called from URB
+ * Dequeue.
+ *
+ * @param hcd HCD instance.
+ * @param qh The QH to free.
+ */
+void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+	dwc_irqflags_t flags;
+	uint32_t buf_size = 0;
+	uint8_t *align_buf_virt = NULL;
+	dwc_dma_t align_buf_dma;
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	/* Free each QTD in the QTD list */
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
+		DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
+		dwc_otg_hcd_qtd_free(qtd);
+	}
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_qh_free_ddma(hcd, qh);
+	} else if (qh->dw_align_buf) {
+		if (qh->ep_type == UE_ISOCHRONOUS) {
+			buf_size = 4096;
+		} else {
+			buf_size = hcd->core_if->core_params->max_transfer_size;
+		}
+		align_buf_virt = qh->dw_align_buf;
+		align_buf_dma = qh->dw_align_buf_dma;
+	}
+
+	DWC_FREE(qh);
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	if (align_buf_virt)
+		DWC_DMA_FREE(dev, buf_size, align_buf_virt, align_buf_dma);
+	return;
+}
+
+#define BitStuffTime(bytecount)  ((8 * 7* bytecount) / 6)
+#define HS_HOST_DELAY		5	/* nanoseconds */
+#define FS_LS_HOST_DELAY	1000	/* nanoseconds */
+#define HUB_LS_SETUP		333	/* nanoseconds */
+#define NS_TO_US(ns)		((ns + 500) / 1000)
+				/* convert & round nanoseconds to microseconds */
+
+static uint32_t calc_bus_time(int speed, int is_in, int is_isoc, int bytecount)
+{
+	unsigned long retval;
+
+	switch (speed) {
+	case USB_SPEED_HIGH:
+		if (is_isoc) {
+			retval =
+			    ((38 * 8 * 2083) +
+			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
+			    HS_HOST_DELAY;
+		} else {
+			retval =
+			    ((55 * 8 * 2083) +
+			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
+			    HS_HOST_DELAY;
+		}
+		break;
+	case USB_SPEED_FULL:
+		if (is_isoc) {
+			retval =
+			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
+			if (is_in) {
+				retval = 7268 + FS_LS_HOST_DELAY + retval;
+			} else {
+				retval = 6265 + FS_LS_HOST_DELAY + retval;
+			}
+		} else {
+			retval =
+			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
+			retval = 9107 + FS_LS_HOST_DELAY + retval;
+		}
+		break;
+	case USB_SPEED_LOW:
+		if (is_in) {
+			retval =
+			    (67667 * (31 + 10 * BitStuffTime(bytecount))) /
+			    1000;
+			retval =
+			    64060 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
+			    retval;
+		} else {
+			retval =
+			    (66700 * (31 + 10 * BitStuffTime(bytecount))) /
+			    1000;
+			retval =
+			    64107 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
+			    retval;
+		}
+		break;
+	default:
+		DWC_WARN("Unknown device speed\n");
+		retval = -1;
+	}
+
+	return NS_TO_US(retval);
+}
+
+/**
+ * Initializes a QH structure.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh  The QH to init.
+ * @param urb Holds the information about the device/endpoint that we need
+ * 	      to initialize the QH.
+ */
+#define SCHEDULE_SLOP 10
+void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
+{
+	char *speed, *type;
+	int dev_speed;
+	uint32_t hub_addr, hub_port;
+
+	dwc_memset(qh, 0, sizeof(dwc_otg_qh_t));
+
+	/* Initialize QH */
+	qh->ep_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
+	qh->ep_is_in = dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? 1 : 0;
+
+	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+	qh->maxp = dwc_otg_hcd_get_mps(&urb->pipe_info);
+	DWC_CIRCLEQ_INIT(&qh->qtd_list);
+	DWC_LIST_INIT(&qh->qh_list_entry);
+	qh->channel = NULL;
+
+	/* FS/LS Enpoint on HS Hub
+	 * NOT virtual root hub */
+	dev_speed = hcd->fops->speed(hcd, urb->priv);
+
+	hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &hub_port);
+	qh->do_split = 0;
+	if (microframe_schedule)
+		qh->speed = dev_speed;
+
+	qh->nak_frame = 0xffff;
+
+	if (((dev_speed == USB_SPEED_LOW) ||
+	     (dev_speed == USB_SPEED_FULL)) &&
+	    (hub_addr != 0 && hub_addr != 1)) {
+		DWC_DEBUGPL(DBG_HCD,
+			    "QH init: EP %d: TT found at hub addr %d, for port %d\n",
+			    dwc_otg_hcd_get_ep_num(&urb->pipe_info), hub_addr,
+			    hub_port);
+		qh->do_split = 1;
+		qh->skip_count = 0;
+	}
+
+	if (qh->ep_type == UE_INTERRUPT || qh->ep_type == UE_ISOCHRONOUS) {
+		/* Compute scheduling parameters once and save them. */
+		hprt0_data_t hprt;
+
+		/** @todo Account for split transfers in the bus time. */
+		int bytecount =
+		    dwc_hb_mult(qh->maxp) * dwc_max_packet(qh->maxp);
+
+		qh->usecs =
+		    calc_bus_time((qh->do_split ? USB_SPEED_HIGH : dev_speed),
+				  qh->ep_is_in, (qh->ep_type == UE_ISOCHRONOUS),
+				  bytecount);
+		/* Start in a slightly future (micro)frame. */
+		qh->sched_frame = dwc_frame_num_inc(hcd->frame_number,
+						    SCHEDULE_SLOP);
+		qh->interval = urb->interval;
+
+		hprt.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
+		if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED) {
+			if (dev_speed == USB_SPEED_LOW ||
+					dev_speed == USB_SPEED_FULL) {
+				qh->interval *= 8;
+				qh->sched_frame |= 0x7;
+				qh->start_split_frame = qh->sched_frame;
+			} else if (int_ep_interval_min >= 2 &&
+					qh->interval < int_ep_interval_min &&
+					qh->ep_type == UE_INTERRUPT) {
+				qh->interval = int_ep_interval_min;
+			}
+		}
+	}
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD QH Initialized\n");
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - qh = %p\n", qh);
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Device Address = %d\n",
+		    dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Endpoint %d, %s\n",
+		    dwc_otg_hcd_get_ep_num(&urb->pipe_info),
+		    dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT");
+	switch (dev_speed) {
+	case USB_SPEED_LOW:
+		qh->dev_speed = DWC_OTG_EP_SPEED_LOW;
+		speed = "low";
+		break;
+	case USB_SPEED_FULL:
+		qh->dev_speed = DWC_OTG_EP_SPEED_FULL;
+		speed = "full";
+		break;
+	case USB_SPEED_HIGH:
+		qh->dev_speed = DWC_OTG_EP_SPEED_HIGH;
+		speed = "high";
+		break;
+	default:
+		speed = "?";
+		break;
+	}
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Speed = %s\n", speed);
+
+	switch (qh->ep_type) {
+	case UE_ISOCHRONOUS:
+		type = "isochronous";
+		break;
+	case UE_INTERRUPT:
+		type = "interrupt";
+		break;
+	case UE_CONTROL:
+		type = "control";
+		break;
+	case UE_BULK:
+		type = "bulk";
+		break;
+	default:
+		type = "?";
+		break;
+	}
+
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Type = %s\n", type);
+
+#ifdef DEBUG
+	if (qh->ep_type == UE_INTERRUPT) {
+		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - usecs = %d\n",
+			    qh->usecs);
+		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - interval = %d\n",
+			    qh->interval);
+	}
+#endif
+
+}
+
+/**
+ * This function allocates and initializes a QH.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param urb Holds the information about the device/endpoint that we need
+ * 	      to initialize the QH.
+ * @param atomic_alloc Flag to do atomic allocation if needed
+ *
+ * @return Returns pointer to the newly allocated QH, or NULL on error. */
+dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
+				    dwc_otg_hcd_urb_t * urb, int atomic_alloc)
+{
+	dwc_otg_qh_t *qh;
+
+	/* Allocate memory */
+	/** @todo add memflags argument */
+	qh = dwc_otg_hcd_qh_alloc(atomic_alloc);
+	if (qh == NULL) {
+		DWC_ERROR("qh allocation failed");
+		return NULL;
+	}
+
+	qh_init(hcd, qh, urb);
+
+	if (hcd->core_if->dma_desc_enable
+	    && (dwc_otg_hcd_qh_init_ddma(hcd, qh) < 0)) {
+		dwc_otg_hcd_qh_free(hcd, qh);
+		return NULL;
+	}
+
+	return qh;
+}
+
+/* microframe_schedule=0 start */
+
+/**
+ * Checks that a channel is available for a periodic transfer.
+ *
+ * @return 0 if successful, negative error code otherise.
+ */
+static int periodic_channel_available(dwc_otg_hcd_t * hcd)
+{
+	/*
+	 * Currently assuming that there is a dedicated host channnel for each
+	 * periodic transaction plus at least one host channel for
+	 * non-periodic transactions.
+	 */
+	int status;
+	int num_channels;
+
+	num_channels = hcd->core_if->core_params->host_channels;
+	if ((hcd->periodic_channels + hcd->non_periodic_channels < num_channels)
+	    && (hcd->periodic_channels < num_channels - 1)) {
+		status = 0;
+	} else {
+		DWC_INFO("%s: Total channels: %d, Periodic: %d, Non-periodic: %d\n",
+			__func__, num_channels, hcd->periodic_channels, hcd->non_periodic_channels);	//NOTICE
+		status = -DWC_E_NO_SPACE;
+	}
+
+	return status;
+}
+
+/**
+ * Checks that there is sufficient bandwidth for the specified QH in the
+ * periodic schedule. For simplicity, this calculation assumes that all the
+ * transfers in the periodic schedule may occur in the same (micro)frame.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH containing periodic bandwidth required.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+static int check_periodic_bandwidth(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status;
+	int16_t max_claimed_usecs;
+
+	status = 0;
+
+	if ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) || qh->do_split) {
+		/*
+		 * High speed mode.
+		 * Max periodic usecs is 80% x 125 usec = 100 usec.
+		 */
+
+		max_claimed_usecs = 100 - qh->usecs;
+	} else {
+		/*
+		 * Full speed mode.
+		 * Max periodic usecs is 90% x 1000 usec = 900 usec.
+		 */
+		max_claimed_usecs = 900 - qh->usecs;
+	}
+
+	if (hcd->periodic_usecs > max_claimed_usecs) {
+		DWC_INFO("%s: already claimed usecs %d, required usecs %d\n", __func__, hcd->periodic_usecs, qh->usecs);	//NOTICE
+		status = -DWC_E_NO_SPACE;
+	}
+
+	return status;
+}
+
+/* microframe_schedule=0 end */
+
+/**
+ * Microframe scheduler
+ * track the total use in hcd->frame_usecs
+ * keep each qh use in qh->frame_usecs
+ * when surrendering the qh then donate the time back
+ */
+const unsigned short max_uframe_usecs[]={ 100, 100, 100, 100, 100, 100, 30, 0 };
+
+/*
+ * called from dwc_otg_hcd.c:dwc_otg_hcd_init
+ */
+void init_hcd_usecs(dwc_otg_hcd_t *_hcd)
+{
+	int i;
+	if (_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
+		_hcd->frame_usecs[0] = 900;
+		for (i = 1; i < 8; i++)
+			_hcd->frame_usecs[i] = 0;
+	} else {
+		for (i = 0; i < 8; i++)
+			_hcd->frame_usecs[i] = max_uframe_usecs[i];
+	}
+}
+
+static int find_single_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
+{
+	int i;
+	unsigned short utime;
+	int t_left;
+	int ret;
+	int done;
+
+	ret = -1;
+	utime = _qh->usecs;
+	t_left = utime;
+	i = 0;
+	done = 0;
+	while (done == 0) {
+		/* At the start _hcd->frame_usecs[i] = max_uframe_usecs[i]; */
+		if (utime <= _hcd->frame_usecs[i]) {
+			_hcd->frame_usecs[i] -= utime;
+			_qh->frame_usecs[i] += utime;
+			t_left -= utime;
+			ret = i;
+			done = 1;
+			return ret;
+		} else {
+			i++;
+			if (i == 8) {
+				done = 1;
+				ret = -1;
+			}
+		}
+	}
+	return ret;
+ }
+
+/*
+ * use this for FS apps that can span multiple uframes
+  */
+static int find_multi_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
+{
+	int i;
+	int j;
+	unsigned short utime;
+	int t_left;
+	int ret;
+	int done;
+	unsigned short xtime;
+
+	ret = -1;
+	utime = _qh->usecs;
+	t_left = utime;
+	i = 0;
+	done = 0;
+loop:
+	while (done == 0) {
+		if(_hcd->frame_usecs[i] <= 0) {
+			i++;
+			if (i == 8) {
+				done = 1;
+				ret = -1;
+			}
+			goto loop;
+		}
+
+		/*
+		 * we need n consecutive slots
+		 * so use j as a start slot j plus j+1 must be enough time (for now)
+		 */
+		xtime= _hcd->frame_usecs[i];
+		for (j = i+1 ; j < 8 ; j++ ) {
+                       /*
+                        * if we add this frame remaining time to xtime we may
+                        * be OK, if not we need to test j for a complete frame
+                        */
+                       if ((xtime+_hcd->frame_usecs[j]) < utime) {
+                               if (_hcd->frame_usecs[j] < max_uframe_usecs[j]) {
+                                       j = 8;
+                                       ret = -1;
+                                       continue;
+                               }
+                       }
+                       if (xtime >= utime) {
+                               ret = i;
+                               j = 8;  /* stop loop with a good value ret */
+                               continue;
+                       }
+                       /* add the frame time to x time */
+                       xtime += _hcd->frame_usecs[j];
+		       /* we must have a fully available next frame or break */
+		       if ((xtime < utime)
+				       && (_hcd->frame_usecs[j] == max_uframe_usecs[j])) {
+			       ret = -1;
+			       j = 8;  /* stop loop with a bad value ret */
+			       continue;
+		       }
+		}
+		if (ret >= 0) {
+			t_left = utime;
+			for (j = i; (t_left>0) && (j < 8); j++ ) {
+				t_left -= _hcd->frame_usecs[j];
+				if ( t_left <= 0 ) {
+					_qh->frame_usecs[j] += _hcd->frame_usecs[j] + t_left;
+					_hcd->frame_usecs[j]= -t_left;
+					ret = i;
+					done = 1;
+				} else {
+					_qh->frame_usecs[j] += _hcd->frame_usecs[j];
+					_hcd->frame_usecs[j] = 0;
+				}
+			}
+		} else {
+			i++;
+			if (i == 8) {
+				done = 1;
+				ret = -1;
+			}
+		}
+	}
+	return ret;
+}
+
+static int find_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
+{
+	int ret;
+	ret = -1;
+
+	if (_qh->speed == USB_SPEED_HIGH ||
+		_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
+		/* if this is a hs transaction we need a full frame - or account for FS usecs */
+		ret = find_single_uframe(_hcd, _qh);
+	} else {
+		/* if this is a fs transaction we may need a sequence of frames */
+		ret = find_multi_uframe(_hcd, _qh);
+	}
+	return ret;
+}
+
+/**
+ * Checks that the max transfer size allowed in a host channel is large enough
+ * to handle the maximum data transfer in a single (micro)frame for a periodic
+ * transfer.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH for a periodic endpoint.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+static int check_max_xfer_size(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status;
+	uint32_t max_xfer_size;
+	uint32_t max_channel_xfer_size;
+
+	status = 0;
+
+	max_xfer_size = dwc_max_packet(qh->maxp) * dwc_hb_mult(qh->maxp);
+	max_channel_xfer_size = hcd->core_if->core_params->max_transfer_size;
+
+	if (max_xfer_size > max_channel_xfer_size) {
+		DWC_INFO("%s: Periodic xfer length %d > " "max xfer length for channel %d\n",
+				__func__, max_xfer_size, max_channel_xfer_size);	//NOTICE
+		status = -DWC_E_NO_SPACE;
+	}
+
+	return status;
+}
+
+
+
+/**
+ * Schedules an interrupt or isochronous transfer in the periodic schedule.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH for the periodic transfer. The QH should already contain the
+ * scheduling information.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+static int schedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status = 0;
+
+	if (microframe_schedule) {
+		int frame;
+		status = find_uframe(hcd, qh);
+		frame = -1;
+		if (status == 0) {
+			frame = 7;
+		} else {
+			if (status > 0 )
+				frame = status-1;
+		}
+
+		/* Set the new frame up */
+		if (frame > -1) {
+			qh->sched_frame &= ~0x7;
+			qh->sched_frame |= (frame & 7);
+		}
+
+		if (status != -1)
+			status = 0;
+	} else {
+		status = periodic_channel_available(hcd);
+		if (status) {
+			DWC_INFO("%s: No host channel available for periodic " "transfer.\n", __func__);	//NOTICE
+			return status;
+		}
+
+		status = check_periodic_bandwidth(hcd, qh);
+	}
+	if (status) {
+		DWC_INFO("%s: Insufficient periodic bandwidth for "
+			    "periodic transfer.\n", __func__);
+		return -DWC_E_NO_SPACE;
+	}
+	status = check_max_xfer_size(hcd, qh);
+	if (status) {
+		DWC_INFO("%s: Channel max transfer size too small "
+			    "for periodic transfer.\n", __func__);
+		return status;
+	}
+
+	if (hcd->core_if->dma_desc_enable) {
+		/* Don't rely on SOF and start in ready schedule */
+		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_ready, &qh->qh_list_entry);
+	}
+	else {
+		if(fiq_enable && (DWC_LIST_EMPTY(&hcd->periodic_sched_inactive) || dwc_frame_num_le(qh->sched_frame, hcd->fiq_state->next_sched_frame)))
+		{
+			hcd->fiq_state->next_sched_frame = qh->sched_frame;
+
+		}
+		/* Always start in the inactive schedule. */
+		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_inactive, &qh->qh_list_entry);
+	}
+
+	if (!microframe_schedule) {
+		/* Reserve the periodic channel. */
+		hcd->periodic_channels++;
+	}
+
+	/* Update claimed usecs per (micro)frame. */
+	hcd->periodic_usecs += qh->usecs;
+
+	return status;
+}
+
+
+/**
+ * This function adds a QH to either the non periodic or periodic schedule if
+ * it is not already in the schedule. If the QH is already in the schedule, no
+ * action is taken.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status = 0;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+		/* QH already in a schedule. */
+		return status;
+	}
+
+	/* Add the new QH to the appropriate schedule */
+	if (dwc_qh_is_non_per(qh)) {
+		/* Always start in the inactive schedule. */
+		DWC_LIST_INSERT_TAIL(&hcd->non_periodic_sched_inactive,
+				     &qh->qh_list_entry);
+		//hcd->fiq_state->kick_np_queues = 1;
+	} else {
+		status = schedule_periodic(hcd, qh);
+		if ( !hcd->periodic_qh_count ) {
+			intr_mask.b.sofintr = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+			}
+		}
+		hcd->periodic_qh_count++;
+	}
+
+	return status;
+}
+
+/**
+ * Removes an interrupt or isochronous transfer from the periodic schedule.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH for the periodic transfer.
+ */
+static void deschedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int i;
+	DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
+
+	/* Update claimed usecs per (micro)frame. */
+	hcd->periodic_usecs -= qh->usecs;
+
+	if (!microframe_schedule) {
+		/* Release the periodic channel reservation. */
+		hcd->periodic_channels--;
+	} else {
+		for (i = 0; i < 8; i++) {
+			hcd->frame_usecs[i] += qh->frame_usecs[i];
+			qh->frame_usecs[i] = 0;
+		}
+	}
+}
+
+/**
+ * Removes a QH from either the non-periodic or periodic schedule.  Memory is
+ * not freed.
+ *
+ * @param hcd The HCD state structure.
+ * @param qh QH to remove from schedule. */
+void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+		/* QH is not in a schedule. */
+		return;
+	}
+
+	if (dwc_qh_is_non_per(qh)) {
+		if (hcd->non_periodic_qh_ptr == &qh->qh_list_entry) {
+			hcd->non_periodic_qh_ptr =
+			    hcd->non_periodic_qh_ptr->next;
+		}
+		DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
+		//if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive))
+		//	hcd->fiq_state->kick_np_queues = 1;
+	} else {
+		deschedule_periodic(hcd, qh);
+		hcd->periodic_qh_count--;
+		if( !hcd->periodic_qh_count && !fiq_fsm_enable ) {
+			intr_mask.b.sofintr = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
+			}
+		}
+	}
+}
+
+/**
+ * Deactivates a QH. For non-periodic QHs, removes the QH from the active
+ * non-periodic schedule. The QH is added to the inactive non-periodic
+ * schedule if any QTDs are still attached to the QH.
+ *
+ * For periodic QHs, the QH is removed from the periodic queued schedule. If
+ * there are any QTDs still attached to the QH, the QH is added to either the
+ * periodic inactive schedule or the periodic ready schedule and its next
+ * scheduled frame is calculated. The QH is placed in the ready schedule if
+ * the scheduled frame has been reached already. Otherwise it's placed in the
+ * inactive schedule. If there are no QTDs attached to the QH, the QH is
+ * completely removed from the periodic schedule.
+ */
+void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+			       int sched_next_periodic_split)
+{
+	if (dwc_qh_is_non_per(qh)) {
+		dwc_otg_hcd_qh_remove(hcd, qh);
+		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			/* Add back to inactive non-periodic schedule. */
+			dwc_otg_hcd_qh_add(hcd, qh);
+			//hcd->fiq_state->kick_np_queues = 1;
+		} else {
+			if(nak_holdoff && qh->do_split) {
+				qh->nak_frame = 0xFFFF;
+			}
+		}
+	} else {
+		uint16_t frame_number = dwc_otg_hcd_get_frame_number(hcd);
+
+		if (qh->do_split) {
+			/* Schedule the next continuing periodic split transfer */
+			if (sched_next_periodic_split) {
+
+				qh->sched_frame = frame_number;
+
+				if (dwc_frame_num_le(frame_number,
+						     dwc_frame_num_inc
+						     (qh->start_split_frame,
+						      1))) {
+					/*
+					 * Allow one frame to elapse after start
+					 * split microframe before scheduling
+					 * complete split, but DONT if we are
+					 * doing the next start split in the
+					 * same frame for an ISOC out.
+					 */
+					if ((qh->ep_type != UE_ISOCHRONOUS) ||
+					    (qh->ep_is_in != 0)) {
+						qh->sched_frame =
+						    dwc_frame_num_inc(qh->sched_frame, 1);
+					}
+				}
+			} else {
+				qh->sched_frame =
+				    dwc_frame_num_inc(qh->start_split_frame,
+						      qh->interval);
+				if (dwc_frame_num_le
+				    (qh->sched_frame, frame_number)) {
+					qh->sched_frame = frame_number;
+				}
+				qh->sched_frame |= 0x7;
+				qh->start_split_frame = qh->sched_frame;
+			}
+		} else {
+			qh->sched_frame =
+			    dwc_frame_num_inc(qh->sched_frame, qh->interval);
+			if (dwc_frame_num_le(qh->sched_frame, frame_number)) {
+				qh->sched_frame = frame_number;
+			}
+		}
+
+		if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			dwc_otg_hcd_qh_remove(hcd, qh);
+		} else {
+			/*
+			 * Remove from periodic_sched_queued and move to
+			 * appropriate queue.
+			 */
+			if ((microframe_schedule && dwc_frame_num_le(qh->sched_frame, frame_number)) ||
+			(!microframe_schedule && qh->sched_frame == frame_number)) {
+				DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
+						   &qh->qh_list_entry);
+			} else {
+				if(fiq_enable && !dwc_frame_num_le(hcd->fiq_state->next_sched_frame, qh->sched_frame))
+				{
+					hcd->fiq_state->next_sched_frame = qh->sched_frame;
+				}
+
+				DWC_LIST_MOVE_HEAD
+				    (&hcd->periodic_sched_inactive,
+				     &qh->qh_list_entry);
+			}
+		}
+	}
+}
+
+/**
+ * This function allocates and initializes a QTD.
+ *
+ * @param urb The URB to create a QTD from.  Each URB-QTD pair will end up
+ * 	      pointing to each other so each pair should have a unique correlation.
+ * @param atomic_alloc Flag to do atomic alloc if needed
+ *
+ * @return Returns pointer to the newly allocated QTD, or NULL on error. */
+dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb, int atomic_alloc)
+{
+	dwc_otg_qtd_t *qtd;
+
+	qtd = dwc_otg_hcd_qtd_alloc(atomic_alloc);
+	if (qtd == NULL) {
+		return NULL;
+	}
+
+	dwc_otg_hcd_qtd_init(qtd, urb);
+	return qtd;
+}
+
+/**
+ * Initializes a QTD structure.
+ *
+ * @param qtd The QTD to initialize.
+ * @param urb The URB to use for initialization.  */
+void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb)
+{
+	dwc_memset(qtd, 0, sizeof(dwc_otg_qtd_t));
+	qtd->urb = urb;
+	if (dwc_otg_hcd_get_pipe_type(&urb->pipe_info) == UE_CONTROL) {
+		/*
+		 * The only time the QTD data toggle is used is on the data
+		 * phase of control transfers. This phase always starts with
+		 * DATA1.
+		 */
+		qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
+		qtd->control_phase = DWC_OTG_CONTROL_SETUP;
+	}
+
+	/* start split */
+	qtd->complete_split = 0;
+	qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
+	qtd->isoc_split_offset = 0;
+	qtd->in_process = 0;
+
+	/* Store the qtd ptr in the urb to reference what QTD. */
+	urb->qtd = qtd;
+	return;
+}
+
+/**
+ * This function adds a QTD to the QTD-list of a QH.  It will find the correct
+ * QH to place the QTD into.  If it does not find a QH, then it will create a
+ * new QH. If the QH to which the QTD is added is not currently scheduled, it
+ * is placed into the proper schedule based on its EP type.
+ * HCD lock must be held and interrupts must be disabled on entry
+ *
+ * @param[in] qtd The QTD to add
+ * @param[in] hcd The DWC HCD structure
+ * @param[out] qh out parameter to return queue head
+ * @param atomic_alloc Flag to do atomic alloc if needed
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd,
+			dwc_otg_hcd_t * hcd, dwc_otg_qh_t ** qh, int atomic_alloc)
+{
+	int retval = 0;
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+
+	/*
+	 * Get the QH which holds the QTD-list to insert to. Create QH if it
+	 * doesn't exist.
+	 */
+	if (*qh == NULL) {
+		*qh = dwc_otg_hcd_qh_create(hcd, urb, atomic_alloc);
+		if (*qh == NULL) {
+			retval = -DWC_E_NO_MEMORY;
+			goto done;
+		} else {
+			if (fiq_enable)
+				hcd->fiq_state->kick_np_queues = 1;
+		}
+	}
+	retval = dwc_otg_hcd_qh_add(hcd, *qh);
+	if (retval == 0) {
+		DWC_CIRCLEQ_INSERT_TAIL(&((*qh)->qtd_list), qtd,
+					qtd_list_entry);
+		qtd->qh = *qh;
+	}
+done:
+
+	return retval;
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
new file mode 100644
index 0000000000000..6b2c7d0c93f36
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
@@ -0,0 +1,188 @@
+#ifndef _DWC_OS_DEP_H_
+#define _DWC_OS_DEP_H_
+
+/**
+ * @file
+ *
+ * This file contains OS dependent structures.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/ctype.h>
+#include <linux/string.h>
+#include <linux/dma-mapping.h>
+#include <linux/jiffies.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/workqueue.h>
+#include <linux/stat.h>
+#include <linux/pci.h>
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+# include <linux/irq.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+# include <linux/usb/ch9.h>
+#else
+# include <linux/usb_ch9.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+# include <linux/usb/gadget.h>
+#else
+# include <linux/usb_gadget.h>
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
+# include <asm/irq.h>
+#endif
+
+#ifdef PCI_INTERFACE
+# include <asm/io.h>
+#endif
+
+#ifdef LM_INTERFACE
+# include <asm/unaligned.h>
+# include <asm/sizes.h>
+# include <asm/param.h>
+# include <asm/io.h>
+# if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
+#  include <asm/arch/hardware.h>
+#  include <asm/arch/lm.h>
+#  include <asm/arch/irqs.h>
+#  include <asm/arch/regs-irq.h>
+# else
+/* in 2.6.31, at least, we seem to have lost the generic LM infrastructure -
+   here we assume that the machine architecture provides definitions
+   in its own header
+*/
+#  include <mach/lm.h>
+#  include <mach/hardware.h>
+# endif
+#endif
+
+#ifdef PLATFORM_INTERFACE
+#include <linux/platform_device.h>
+#include <asm/mach/map.h>
+#endif
+
+/** The OS page size */
+#define DWC_OS_PAGE_SIZE	PAGE_SIZE
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
+typedef int gfp_t;
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
+# define IRQF_SHARED SA_SHIRQ
+#endif
+
+typedef struct os_dependent {
+	/** Base address returned from ioremap() */
+	void *base;
+
+	/** Register offset for Diagnostic API */
+	uint32_t reg_offset;
+
+	/** Base address for MPHI peripheral */
+	void *mphi_base;
+
+#ifdef LM_INTERFACE
+	struct lm_device *lmdev;
+#elif  defined(PCI_INTERFACE)
+	struct pci_dev *pcidev;
+
+	/** Start address of a PCI region */
+	resource_size_t rsrc_start;
+
+	/** Length address of a PCI region */
+	resource_size_t rsrc_len;
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *platformdev;
+#endif
+
+} os_dependent_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+
+
+/* Type for the our device on the chosen bus */
+#if   defined(LM_INTERFACE)
+typedef struct lm_device       dwc_bus_dev_t;
+#elif defined(PCI_INTERFACE)
+typedef struct pci_dev         dwc_bus_dev_t;
+#elif defined(PLATFORM_INTERFACE)
+typedef struct platform_device dwc_bus_dev_t;
+#endif
+
+/* Helper macro to retrieve drvdata from the device on the chosen bus */
+#if    defined(LM_INTERFACE)
+#define DWC_OTG_BUSDRVDATA(_dev) lm_get_drvdata(_dev)
+#elif  defined(PCI_INTERFACE)
+#define DWC_OTG_BUSDRVDATA(_dev) pci_get_drvdata(_dev)
+#elif  defined(PLATFORM_INTERFACE)
+#define DWC_OTG_BUSDRVDATA(_dev) platform_get_drvdata(_dev)
+#endif
+
+/**
+ * Helper macro returning the otg_device structure of a given struct device
+ *
+ * c.f. static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
+ */
+#ifdef LM_INTERFACE
+#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
+                struct lm_device *lm_dev = \
+                        container_of(_dev, struct lm_device, dev); \
+                _var = lm_get_drvdata(lm_dev); \
+        } while (0)
+
+#elif defined(PCI_INTERFACE)
+#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
+                _var = dev_get_drvdata(_dev); \
+        } while (0)
+
+#elif defined(PLATFORM_INTERFACE)
+#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
+                struct platform_device *platform_dev = \
+                        container_of(_dev, struct platform_device, dev); \
+                _var = platform_get_drvdata(platform_dev); \
+        } while (0)
+#endif
+
+
+/**
+ * Helper macro returning the struct dev of the given struct os_dependent
+ *
+ * c.f. static struct device *dwc_otg_getdev(struct os_dependent *osdep)
+ */
+#ifdef LM_INTERFACE
+#define DWC_OTG_OS_GETDEV(_osdep) \
+        ((_osdep).lmdev == NULL? NULL: &(_osdep).lmdev->dev)
+#elif defined(PCI_INTERFACE)
+#define DWC_OTG_OS_GETDEV(_osdep) \
+        ((_osdep).pci_dev == NULL? NULL: &(_osdep).pci_dev->dev)
+#elif defined(PLATFORM_INTERFACE)
+#define DWC_OTG_OS_GETDEV(_osdep) \
+        ((_osdep).platformdev == NULL? NULL: &(_osdep).platformdev->dev)
+#endif
+
+
+
+
+#endif /* _DWC_OS_DEP_H_ */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd.c
new file mode 100644
index 0000000000000..9dabbe5c9791c
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.c
@@ -0,0 +1,2725 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.c $
+ * $Revision: #101 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+/** @file
+ * This file implements PCD Core. All code in this file is portable and doesn't
+ * use any OS specific functions.
+ * PCD Core provides Interface, defined in <code><dwc_otg_pcd_if.h></code>
+ * header file, which can be used to implement OS specific PCD interface.
+ *
+ * An important function of the PCD is managing interrupts generated
+ * by the DWC_otg controller. The implementation of the DWC_otg device
+ * mode interrupt service routines is in dwc_otg_pcd_intr.c.
+ *
+ * @todo Add Device Mode test modes (Test J mode, Test K mode, etc).
+ * @todo Does it work when the request size is greater than DEPTSIZ
+ * transfer size
+ *
+ */
+
+#include "dwc_otg_pcd.h"
+
+#ifdef DWC_UTE_CFI
+#include "dwc_otg_cfi.h"
+
+extern int init_cfi(cfiobject_t * cfiobj);
+#endif
+
+/**
+ * Choose endpoint from ep arrays using usb_ep structure.
+ */
+static dwc_otg_pcd_ep_t *get_ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
+{
+	int i;
+	if (pcd->ep0.priv == handle) {
+		return &pcd->ep0;
+	}
+	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
+		if (pcd->in_ep[i].priv == handle)
+			return &pcd->in_ep[i];
+		if (pcd->out_ep[i].priv == handle)
+			return &pcd->out_ep[i];
+	}
+
+	return NULL;
+}
+
+/**
+ * This function completes a request.  It call's the request call back.
+ */
+void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req,
+			  int32_t status)
+{
+	unsigned stopped = ep->stopped;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(ep %p req %p)\n", __func__, ep, req);
+	DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
+
+	/* don't modify queue heads during completion callback */
+	ep->stopped = 1;
+	/* spin_unlock/spin_lock now done in fops->complete() */
+	ep->pcd->fops->complete(ep->pcd, ep->priv, req->priv, status,
+				req->actual);
+
+	if (ep->pcd->request_pending > 0) {
+		--ep->pcd->request_pending;
+	}
+
+	ep->stopped = stopped;
+	DWC_FREE(req);
+}
+
+/**
+ * This function terminates all the requsts in the EP request queue.
+ */
+void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_pcd_request_t *req;
+
+	ep->stopped = 1;
+
+	/* called with irqs blocked?? */
+	while (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		dwc_otg_request_done(ep, req, -DWC_E_SHUTDOWN);
+	}
+}
+
+void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
+		       const struct dwc_otg_pcd_function_ops *fops)
+{
+	pcd->fops = fops;
+}
+
+/**
+ * PCD Callback function for initializing the PCD when switching to
+ * device mode.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_start_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	/*
+	 * Initialized the Core for Device mode.
+	 */
+	if (dwc_otg_is_device_mode(core_if)) {
+		dwc_otg_core_dev_init(core_if);
+		/* Set core_if's lock pointer to the pcd->lock */
+		core_if->lock = pcd->lock;
+	}
+	return 1;
+}
+
+/** CFI-specific buffer allocation function for EP */
+#ifdef DWC_UTE_CFI
+uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
+			      size_t buflen, int flags)
+{
+	dwc_otg_pcd_ep_t *ep;
+	ep = get_ep_from_handle(pcd, pep);
+	if (!ep) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	return pcd->cfi->ops.ep_alloc_buf(pcd->cfi, pcd, ep, addr, buflen,
+					  flags);
+}
+#else
+uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
+			      size_t buflen, int flags);
+#endif
+
+/**
+ * PCD Callback function for notifying the PCD when resuming from
+ * suspend.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_resume_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+
+	if (pcd->fops->resume) {
+		pcd->fops->resume(pcd);
+	}
+
+	/* Stop the SRP timeout timer. */
+	if ((GET_CORE_IF(pcd)->core_params->phy_type != DWC_PHY_TYPE_PARAM_FS)
+	    || (!GET_CORE_IF(pcd)->core_params->i2c_enable)) {
+		if (GET_CORE_IF(pcd)->srp_timer_started) {
+			GET_CORE_IF(pcd)->srp_timer_started = 0;
+			DWC_TIMER_CANCEL(GET_CORE_IF(pcd)->srp_timer);
+		}
+	}
+	return 1;
+}
+
+/**
+ * PCD Callback function for notifying the PCD device is suspended.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_suspend_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+
+	if (pcd->fops->suspend) {
+		DWC_SPINUNLOCK(pcd->lock);
+		pcd->fops->suspend(pcd);
+		DWC_SPINLOCK(pcd->lock);
+	}
+
+	return 1;
+}
+
+/**
+ * PCD Callback function for stopping the PCD when switching to Host
+ * mode.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_stop_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+	extern void dwc_otg_pcd_stop(dwc_otg_pcd_t * _pcd);
+
+	dwc_otg_pcd_stop(pcd);
+	return 1;
+}
+
+/**
+ * PCD Callback structure for handling mode switching.
+ */
+static dwc_otg_cil_callbacks_t pcd_callbacks = {
+	.start = dwc_otg_pcd_start_cb,
+	.stop = dwc_otg_pcd_stop_cb,
+	.suspend = dwc_otg_pcd_suspend_cb,
+	.resume_wakeup = dwc_otg_pcd_resume_cb,
+	.p = 0,			/* Set at registration */
+};
+
+/**
+ * This function allocates a DMA Descriptor chain for the Endpoint
+ * buffer to be used for a transfer to/from the specified endpoint.
+ */
+dwc_otg_dev_dma_desc_t *dwc_otg_ep_alloc_desc_chain(struct device *dev,
+						    dwc_dma_t * dma_desc_addr,
+						    uint32_t count)
+{
+	return DWC_DMA_ALLOC_ATOMIC(dev, count * sizeof(dwc_otg_dev_dma_desc_t),
+							dma_desc_addr);
+}
+
+/**
+ * This function frees a DMA Descriptor chain that was allocated by ep_alloc_desc.
+ */
+void dwc_otg_ep_free_desc_chain(struct device *dev,
+				dwc_otg_dev_dma_desc_t * desc_addr,
+				uint32_t dma_desc_addr, uint32_t count)
+{
+	DWC_DMA_FREE(dev, count * sizeof(dwc_otg_dev_dma_desc_t), desc_addr,
+		     dma_desc_addr);
+}
+
+#ifdef DWC_EN_ISOC
+
+/**
+ * This function initializes a descriptor chain for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_iso_ep_start_ddma_transfer(dwc_otg_core_if_t * core_if,
+					dwc_ep_t * dwc_ep)
+{
+
+	dsts_data_t dsts = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+	int i, j;
+	uint32_t len;
+
+	if (dwc_ep->is_in)
+		dwc_ep->desc_cnt = dwc_ep->buf_proc_intrvl / dwc_ep->bInterval;
+	else
+		dwc_ep->desc_cnt =
+		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
+		    dwc_ep->bInterval;
+
+	/** Allocate descriptors for double buffering */
+	dwc_ep->iso_desc_addr =
+	    dwc_otg_ep_alloc_desc_chain(&dwc_ep->iso_dma_desc_addr,
+					dwc_ep->desc_cnt * 2);
+	if (dwc_ep->desc_addr) {
+		DWC_WARN("%s, can't allocate DMA descriptor chain\n", __func__);
+		return;
+	}
+
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	/** ISO OUT EP */
+	if (dwc_ep->is_in == 0) {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
+		dma_addr_t dma_ad;
+		uint32_t data_per_desc;
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[dwc_ep->num];
+		int offset;
+
+		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
+		dma_ad = (dma_addr_t) DWC_READ_REG32(&(out_regs->doepdma));
+
+		/** Buffer 0 descriptors setup */
+		dma_ad = dwc_ep->dma_addr0;
+
+		sts.b_iso_out.bs = BS_HOST_READY;
+		sts.b_iso_out.rxsts = 0;
+		sts.b_iso_out.l = 0;
+		sts.b_iso_out.sp = 0;
+		sts.b_iso_out.ioc = 0;
+		sts.b_iso_out.pid = 0;
+		sts.b_iso_out.framenum = 0;
+
+		offset = 0;
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				uint32_t len = (j + 1) * dwc_ep->maxpacket;
+				if (len > dwc_ep->data_per_frame)
+					data_per_desc =
+					    dwc_ep->data_per_frame -
+					    j * dwc_ep->maxpacket;
+				else
+					data_per_desc = dwc_ep->maxpacket;
+				len = data_per_desc % 4;
+				if (len)
+					data_per_desc += 4 - len;
+
+				sts.b_iso_out.rxbytes = data_per_desc;
+				dma_desc->buf = dma_ad;
+				dma_desc->status.d32 = sts.d32;
+
+				offset += data_per_desc;
+				dma_desc++;
+				dma_ad += data_per_desc;
+			}
+		}
+
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+			uint32_t len = (j + 1) * dwc_ep->maxpacket;
+			if (len > dwc_ep->data_per_frame)
+				data_per_desc =
+				    dwc_ep->data_per_frame -
+				    j * dwc_ep->maxpacket;
+			else
+				data_per_desc = dwc_ep->maxpacket;
+			len = data_per_desc % 4;
+			if (len)
+				data_per_desc += 4 - len;
+			sts.b_iso_out.rxbytes = data_per_desc;
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			offset += data_per_desc;
+			dma_desc++;
+			dma_ad += data_per_desc;
+		}
+
+		sts.b_iso_out.ioc = 1;
+		len = (j + 1) * dwc_ep->maxpacket;
+		if (len > dwc_ep->data_per_frame)
+			data_per_desc =
+			    dwc_ep->data_per_frame - j * dwc_ep->maxpacket;
+		else
+			data_per_desc = dwc_ep->maxpacket;
+		len = data_per_desc % 4;
+		if (len)
+			data_per_desc += 4 - len;
+		sts.b_iso_out.rxbytes = data_per_desc;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+		dma_desc++;
+
+		/** Buffer 1 descriptors setup */
+		sts.b_iso_out.ioc = 0;
+		dma_ad = dwc_ep->dma_addr1;
+
+		offset = 0;
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				uint32_t len = (j + 1) * dwc_ep->maxpacket;
+				if (len > dwc_ep->data_per_frame)
+					data_per_desc =
+					    dwc_ep->data_per_frame -
+					    j * dwc_ep->maxpacket;
+				else
+					data_per_desc = dwc_ep->maxpacket;
+				len = data_per_desc % 4;
+				if (len)
+					data_per_desc += 4 - len;
+
+				data_per_desc =
+				    sts.b_iso_out.rxbytes = data_per_desc;
+				dma_desc->buf = dma_ad;
+				dma_desc->status.d32 = sts.d32;
+
+				offset += data_per_desc;
+				dma_desc++;
+				dma_ad += data_per_desc;
+			}
+		}
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+			data_per_desc =
+			    ((j + 1) * dwc_ep->maxpacket >
+			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+			data_per_desc +=
+			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+			sts.b_iso_out.rxbytes = data_per_desc;
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			offset += data_per_desc;
+			dma_desc++;
+			dma_ad += data_per_desc;
+		}
+
+		sts.b_iso_out.ioc = 1;
+		sts.b_iso_out.l = 1;
+		data_per_desc =
+		    ((j + 1) * dwc_ep->maxpacket >
+		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+		data_per_desc +=
+		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+		sts.b_iso_out.rxbytes = data_per_desc;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+
+		dwc_ep->next_frame = 0;
+
+		/** Write dma_ad into DOEPDMA register */
+		DWC_WRITE_REG32(&(out_regs->doepdma),
+				(uint32_t) dwc_ep->iso_dma_desc_addr);
+
+	}
+	/** ISO IN EP */
+	else {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
+		dma_addr_t dma_ad;
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[dwc_ep->num];
+		unsigned int frmnumber;
+		fifosize_data_t txfifosize, rxfifosize;
+
+		txfifosize.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[dwc_ep->num]->
+				   dtxfsts);
+		rxfifosize.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+
+		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+
+		dma_ad = dwc_ep->dma_addr0;
+
+		dsts.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+		sts.b_iso_in.bs = BS_HOST_READY;
+		sts.b_iso_in.txsts = 0;
+		sts.b_iso_in.sp =
+		    (dwc_ep->data_per_frame % dwc_ep->maxpacket) ? 1 : 0;
+		sts.b_iso_in.ioc = 0;
+		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
+
+		frmnumber = dwc_ep->next_frame;
+
+		sts.b_iso_in.framenum = frmnumber;
+		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
+		sts.b_iso_in.l = 0;
+
+		/** Buffer 0 descriptors setup */
+		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+			dma_desc++;
+
+			dma_ad += dwc_ep->data_per_frame;
+			sts.b_iso_in.framenum += dwc_ep->bInterval;
+		}
+
+		sts.b_iso_in.ioc = 1;
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+		++dma_desc;
+
+		/** Buffer 1 descriptors setup */
+		sts.b_iso_in.ioc = 0;
+		dma_ad = dwc_ep->dma_addr1;
+
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+			dma_desc++;
+
+			dma_ad += dwc_ep->data_per_frame;
+			sts.b_iso_in.framenum += dwc_ep->bInterval;
+
+			sts.b_iso_in.ioc = 0;
+		}
+		sts.b_iso_in.ioc = 1;
+		sts.b_iso_in.l = 1;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+
+		dwc_ep->next_frame = sts.b_iso_in.framenum + dwc_ep->bInterval;
+
+		/** Write dma_ad into diepdma register */
+		DWC_WRITE_REG32(&(in_regs->diepdma),
+				(uint32_t) dwc_ep->iso_dma_desc_addr);
+	}
+	/** Enable endpoint, clear nak  */
+	depctl.d32 = 0;
+	depctl.b.epena = 1;
+	depctl.b.usbactep = 1;
+	depctl.b.cnak = 1;
+
+	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
+	depctl.d32 = DWC_READ_REG32(addr);
+}
+
+/**
+ * This function initializes a descriptor chain for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
+				       dwc_ep_t * ep)
+{
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+
+	if (ep->is_in) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+	}
+
+	if (core_if->dma_enable == 0 || core_if->dma_desc_enable != 0) {
+		return;
+	} else {
+		deptsiz_data_t deptsiz = {.d32 = 0 };
+
+		ep->xfer_len =
+		    ep->data_per_frame * ep->buf_proc_intrvl / ep->bInterval;
+		ep->pkt_cnt =
+		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
+		ep->xfer_count = 0;
+		ep->xfer_buff =
+		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
+		ep->dma_addr =
+		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
+
+		if (ep->is_in) {
+			/* Program the transfer size and packet count
+			 *      as follows: xfersize = N * maxpacket +
+			 *      short_packet pktcnt = N + (short_packet
+			 *      exist ? 1 : 0)
+			 */
+			deptsiz.b.mc = ep->pkt_per_frm;
+			deptsiz.b.xfersize = ep->xfer_len;
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					dieptsiz, deptsiz.d32);
+
+			/* Write the DMA register */
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->in_ep_regs[ep->num]->
+					 diepdma), (uint32_t) ep->dma_addr);
+
+		} else {
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len + (ep->maxpacket - 1)) /
+			    ep->maxpacket;
+			deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
+
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
+					doeptsiz, deptsiz.d32);
+
+			/* Write the DMA register */
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->out_ep_regs[ep->num]->
+					 doepdma), (uint32_t) ep->dma_addr);
+
+		}
+		/** Enable endpoint, clear nak  */
+		depctl.d32 = 0;
+		depctl.b.epena = 1;
+		depctl.b.cnak = 1;
+
+		DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
+	}
+}
+
+/**
+ * This function does the setup for a data transfer for an EP and
+ * starts the transfer. For an IN transfer, the packets will be
+ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
+ * the packets are unloaded from the Rx FIFO in the ISR.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+
+static void dwc_otg_iso_ep_start_transfer(dwc_otg_core_if_t * core_if,
+					  dwc_ep_t * ep)
+{
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			if (ep->is_in) {
+				ep->desc_cnt = ep->pkt_cnt / ep->pkt_per_frm;
+			} else {
+				ep->desc_cnt = ep->pkt_cnt;
+			}
+			dwc_otg_iso_ep_start_ddma_transfer(core_if, ep);
+		} else {
+			if (core_if->pti_enh_enable) {
+				dwc_otg_iso_ep_start_buf_transfer(core_if, ep);
+			} else {
+				ep->cur_pkt_addr =
+				    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->
+				    xfer_buff0;
+				ep->cur_pkt_dma_addr =
+				    (ep->proc_buf_num) ? ep->dma_addr1 : ep->
+				    dma_addr0;
+				dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
+			}
+		}
+	} else {
+		ep->cur_pkt_addr =
+		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
+		ep->cur_pkt_dma_addr =
+		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
+		dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
+	}
+}
+
+/**
+ * This function stops transfer for an EP and
+ * resets the ep's variables.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+
+void dwc_otg_iso_ep_stop_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+
+	if (ep->is_in == 1) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+	}
+
+	/* disable the ep */
+	depctl.d32 = DWC_READ_REG32(addr);
+
+	depctl.b.epdis = 1;
+	depctl.b.snak = 1;
+
+	DWC_WRITE_REG32(addr, depctl.d32);
+
+	if (core_if->dma_desc_enable &&
+	    ep->iso_desc_addr && ep->iso_dma_desc_addr) {
+		dwc_otg_ep_free_desc_chain(ep->iso_desc_addr,
+					   ep->iso_dma_desc_addr,
+					   ep->desc_cnt * 2);
+	}
+
+	/* reset varibales */
+	ep->dma_addr0 = 0;
+	ep->dma_addr1 = 0;
+	ep->xfer_buff0 = 0;
+	ep->xfer_buff1 = 0;
+	ep->data_per_frame = 0;
+	ep->data_pattern_frame = 0;
+	ep->sync_frame = 0;
+	ep->buf_proc_intrvl = 0;
+	ep->bInterval = 0;
+	ep->proc_buf_num = 0;
+	ep->pkt_per_frm = 0;
+	ep->pkt_per_frm = 0;
+	ep->desc_cnt = 0;
+	ep->iso_desc_addr = 0;
+	ep->iso_dma_desc_addr = 0;
+}
+
+int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
+			     uint8_t * buf0, uint8_t * buf1, dwc_dma_t dma0,
+			     dwc_dma_t dma1, int sync_frame, int dp_frame,
+			     int data_per_frame, int start_frame,
+			     int buf_proc_intrvl, void *req_handle,
+			     int atomic_alloc)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags = 0;
+	dwc_ep_t *dwc_ep;
+	int32_t frm_data;
+	dsts_data_t dsts;
+	dwc_otg_core_if_t *core_if;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	core_if = GET_CORE_IF(pcd);
+	dwc_ep = &ep->dwc_ep;
+
+	if (ep->iso_req_handle) {
+		DWC_WARN("ISO request in progress\n");
+	}
+
+	dwc_ep->dma_addr0 = dma0;
+	dwc_ep->dma_addr1 = dma1;
+
+	dwc_ep->xfer_buff0 = buf0;
+	dwc_ep->xfer_buff1 = buf1;
+
+	dwc_ep->data_per_frame = data_per_frame;
+
+	/** @todo - pattern data support is to be implemented in the future */
+	dwc_ep->data_pattern_frame = dp_frame;
+	dwc_ep->sync_frame = sync_frame;
+
+	dwc_ep->buf_proc_intrvl = buf_proc_intrvl;
+
+	dwc_ep->bInterval = 1 << (ep->desc->bInterval - 1);
+
+	dwc_ep->proc_buf_num = 0;
+
+	dwc_ep->pkt_per_frm = 0;
+	frm_data = ep->dwc_ep.data_per_frame;
+	while (frm_data > 0) {
+		dwc_ep->pkt_per_frm++;
+		frm_data -= ep->dwc_ep.maxpacket;
+	}
+
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	if (start_frame == -1) {
+		dwc_ep->next_frame = dsts.b.soffn + 1;
+		if (dwc_ep->bInterval != 1) {
+			dwc_ep->next_frame =
+			    dwc_ep->next_frame + (dwc_ep->bInterval - 1 -
+						  dwc_ep->next_frame %
+						  dwc_ep->bInterval);
+		}
+	} else {
+		dwc_ep->next_frame = start_frame;
+	}
+
+	if (!core_if->pti_enh_enable) {
+		dwc_ep->pkt_cnt =
+		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
+		    dwc_ep->bInterval;
+	} else {
+		dwc_ep->pkt_cnt =
+		    (dwc_ep->data_per_frame *
+		     (dwc_ep->buf_proc_intrvl / dwc_ep->bInterval)
+		     - 1 + dwc_ep->maxpacket) / dwc_ep->maxpacket;
+	}
+
+	if (core_if->dma_desc_enable) {
+		dwc_ep->desc_cnt =
+		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
+		    dwc_ep->bInterval;
+	}
+
+	if (atomic_alloc) {
+		dwc_ep->pkt_info =
+		    DWC_ALLOC_ATOMIC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
+	} else {
+		dwc_ep->pkt_info =
+		    DWC_ALLOC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
+	}
+	if (!dwc_ep->pkt_info) {
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		return -DWC_E_NO_MEMORY;
+	}
+	if (core_if->pti_enh_enable) {
+		dwc_memset(dwc_ep->pkt_info, 0,
+			   sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
+	}
+
+	dwc_ep->cur_pkt = 0;
+	ep->iso_req_handle = req_handle;
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+	dwc_otg_iso_ep_start_transfer(core_if, dwc_ep);
+	return 0;
+}
+
+int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
+			    void *req_handle)
+{
+	dwc_irqflags_t flags = 0;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+	dwc_ep = &ep->dwc_ep;
+
+	dwc_otg_iso_ep_stop_transfer(GET_CORE_IF(pcd), dwc_ep);
+
+	DWC_FREE(dwc_ep->pkt_info);
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	if (ep->iso_req_handle != req_handle) {
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	ep->iso_req_handle = 0;
+	return 0;
+}
+
+/**
+ * This function is used for perodical data exchnage between PCD and gadget drivers.
+ * for Isochronous EPs
+ *
+ *	- Every time a sync period completes this function is called to
+ *	  perform data exchange between PCD and gadget
+ */
+void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
+			     void *req_handle)
+{
+	int i;
+	dwc_ep_t *dwc_ep;
+
+	dwc_ep = &ep->dwc_ep;
+
+	DWC_SPINUNLOCK(ep->pcd->lock);
+	pcd->fops->isoc_complete(pcd, ep->priv, ep->iso_req_handle,
+				 dwc_ep->proc_buf_num ^ 0x1);
+	DWC_SPINLOCK(ep->pcd->lock);
+
+	for (i = 0; i < dwc_ep->pkt_cnt; ++i) {
+		dwc_ep->pkt_info[i].status = 0;
+		dwc_ep->pkt_info[i].offset = 0;
+		dwc_ep->pkt_info[i].length = 0;
+	}
+}
+
+int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd, void *ep_handle,
+				     void *iso_req_handle)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep->desc || ep->dwc_ep.num == 0) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+	dwc_ep = &ep->dwc_ep;
+
+	return dwc_ep->pkt_cnt;
+}
+
+void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd, void *ep_handle,
+				       void *iso_req_handle, int packet,
+				       int *status, int *actual, int *offset)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep)
+		DWC_WARN("bad ep\n");
+
+	dwc_ep = &ep->dwc_ep;
+
+	*status = dwc_ep->pkt_info[packet].status;
+	*actual = dwc_ep->pkt_info[packet].length;
+	*offset = dwc_ep->pkt_info[packet].offset;
+}
+
+#endif /* DWC_EN_ISOC */
+
+static void dwc_otg_pcd_init_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * pcd_ep,
+				uint32_t is_in, uint32_t ep_num)
+{
+	/* Init EP structure */
+	pcd_ep->desc = 0;
+	pcd_ep->pcd = pcd;
+	pcd_ep->stopped = 1;
+	pcd_ep->queue_sof = 0;
+
+	/* Init DWC ep structure */
+	pcd_ep->dwc_ep.is_in = is_in;
+	pcd_ep->dwc_ep.num = ep_num;
+	pcd_ep->dwc_ep.active = 0;
+	pcd_ep->dwc_ep.tx_fifo_num = 0;
+	/* Control until ep is actvated */
+	pcd_ep->dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
+	pcd_ep->dwc_ep.maxpacket = MAX_PACKET_SIZE;
+	pcd_ep->dwc_ep.dma_addr = 0;
+	pcd_ep->dwc_ep.start_xfer_buff = 0;
+	pcd_ep->dwc_ep.xfer_buff = 0;
+	pcd_ep->dwc_ep.xfer_len = 0;
+	pcd_ep->dwc_ep.xfer_count = 0;
+	pcd_ep->dwc_ep.sent_zlp = 0;
+	pcd_ep->dwc_ep.total_len = 0;
+	pcd_ep->dwc_ep.desc_addr = 0;
+	pcd_ep->dwc_ep.dma_desc_addr = 0;
+	DWC_CIRCLEQ_INIT(&pcd_ep->queue);
+}
+
+/**
+ * Initialize ep's
+ */
+static void dwc_otg_pcd_reinit(dwc_otg_pcd_t * pcd)
+{
+	int i;
+	uint32_t hwcfg1;
+	dwc_otg_pcd_ep_t *ep;
+	int in_ep_cntr, out_ep_cntr;
+	uint32_t num_in_eps = (GET_CORE_IF(pcd))->dev_if->num_in_eps;
+	uint32_t num_out_eps = (GET_CORE_IF(pcd))->dev_if->num_out_eps;
+
+	/**
+	 * Initialize the EP0 structure.
+	 */
+	ep = &pcd->ep0;
+	dwc_otg_pcd_init_ep(pcd, ep, 0, 0);
+
+	in_ep_cntr = 0;
+	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 3;
+	for (i = 1; in_ep_cntr < num_in_eps; i++) {
+		if ((hwcfg1 & 0x1) == 0) {
+			dwc_otg_pcd_ep_t *ep = &pcd->in_ep[in_ep_cntr];
+			in_ep_cntr++;
+			/**
+			 * @todo NGS: Add direction to EP, based on contents
+			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
+			 * sprintf(";r
+			 */
+			dwc_otg_pcd_init_ep(pcd, ep, 1 /* IN */ , i);
+
+			DWC_CIRCLEQ_INIT(&ep->queue);
+		}
+		hwcfg1 >>= 2;
+	}
+
+	out_ep_cntr = 0;
+	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 2;
+	for (i = 1; out_ep_cntr < num_out_eps; i++) {
+		if ((hwcfg1 & 0x1) == 0) {
+			dwc_otg_pcd_ep_t *ep = &pcd->out_ep[out_ep_cntr];
+			out_ep_cntr++;
+			/**
+			 * @todo NGS: Add direction to EP, based on contents
+			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
+			 * sprintf(";r
+			 */
+			dwc_otg_pcd_init_ep(pcd, ep, 0 /* OUT */ , i);
+			DWC_CIRCLEQ_INIT(&ep->queue);
+		}
+		hwcfg1 >>= 2;
+	}
+
+	pcd->ep0state = EP0_DISCONNECT;
+	pcd->ep0.dwc_ep.maxpacket = MAX_EP0_SIZE;
+	pcd->ep0.dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
+}
+
+/**
+ * This function is called when the SRP timer expires. The SRP should
+ * complete within 6 seconds.
+ */
+static void srp_timeout(void *ptr)
+{
+	gotgctl_data_t gotgctl;
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+	volatile uint32_t *addr = &core_if->core_global_regs->gotgctl;
+
+	gotgctl.d32 = DWC_READ_REG32(addr);
+
+	core_if->srp_timer_started = 0;
+
+	if (core_if->adp_enable) {
+		if (gotgctl.b.bsesvld == 0) {
+			gpwrdn_data_t gpwrdn = {.d32 = 0 };
+			DWC_PRINTF("SRP Timeout BSESSVLD = 0\n");
+			/* Power off the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gpwrdn,
+						 gpwrdn.d32, 0);
+			}
+
+			gpwrdn.d32 = 0;
+			gpwrdn.b.pmuintsel = 1;
+			gpwrdn.b.pmuactv = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+			dwc_otg_adp_probe_start(core_if);
+		} else {
+			DWC_PRINTF("SRP Timeout BSESSVLD = 1\n");
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+		}
+	}
+
+	if ((core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS) &&
+	    (core_if->core_params->i2c_enable)) {
+		DWC_PRINTF("SRP Timeout\n");
+
+		if ((core_if->srp_success) && (gotgctl.b.bsesvld)) {
+			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+			}
+
+			/* Clear Session Request */
+			gotgctl.d32 = 0;
+			gotgctl.b.sesreq = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl,
+					 gotgctl.d32, 0);
+
+			core_if->srp_success = 0;
+		} else {
+			__DWC_ERROR("Device not connected/responding\n");
+			gotgctl.b.sesreq = 0;
+			DWC_WRITE_REG32(addr, gotgctl.d32);
+		}
+	} else if (gotgctl.b.sesreq) {
+		DWC_PRINTF("SRP Timeout\n");
+
+		__DWC_ERROR("Device not connected/responding\n");
+		gotgctl.b.sesreq = 0;
+		DWC_WRITE_REG32(addr, gotgctl.d32);
+	} else {
+		DWC_PRINTF(" SRP GOTGCTL=%0x\n", gotgctl.d32);
+	}
+}
+
+/**
+ * Tasklet
+ *
+ */
+extern void start_next_request(dwc_otg_pcd_ep_t * ep);
+
+static void start_xfer_tasklet_func(void *data)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	int i;
+	depctl_data_t diepctl;
+
+	DWC_DEBUGPL(DBG_PCDV, "Start xfer tasklet\n");
+
+	diepctl.d32 = DWC_READ_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl);
+
+	if (pcd->ep0.queue_sof) {
+		pcd->ep0.queue_sof = 0;
+		start_next_request(&pcd->ep0);
+		// break;
+	}
+
+	for (i = 0; i < core_if->dev_if->num_in_eps; i++) {
+		depctl_data_t diepctl;
+		diepctl.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
+
+		if (pcd->in_ep[i].queue_sof) {
+			pcd->in_ep[i].queue_sof = 0;
+			start_next_request(&pcd->in_ep[i]);
+			// break;
+		}
+	}
+
+	return;
+}
+
+/**
+ * This function initialized the PCD portion of the driver.
+ *
+ */
+dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev)
+{
+	struct device *dev = &otg_dev->os_dep.platformdev->dev;
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+	dwc_otg_pcd_t *pcd = NULL;
+	dwc_otg_dev_if_t *dev_if;
+	int i;
+
+	/*
+	 * Allocate PCD structure
+	 */
+	pcd = DWC_ALLOC(sizeof(dwc_otg_pcd_t));
+
+	if (pcd == NULL) {
+		return NULL;
+	}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(pcd->lock);
+#else
+	pcd->lock = DWC_SPINLOCK_ALLOC();
+#endif
+        DWC_DEBUGPL(DBG_HCDV, "Init of PCD %p given core_if %p\n",
+                    pcd, core_if);//GRAYG
+	if (!pcd->lock) {
+		DWC_ERROR("Could not allocate lock for pcd");
+		DWC_FREE(pcd);
+		return NULL;
+	}
+	/* Set core_if's lock pointer to hcd->lock */
+	core_if->lock = pcd->lock;
+	pcd->core_if = core_if;
+
+	dev_if = core_if->dev_if;
+	dev_if->isoc_ep = NULL;
+
+	if (core_if->hwcfg4.b.ded_fifo_en) {
+		DWC_PRINTF("Dedicated Tx FIFOs mode\n");
+	} else {
+		DWC_PRINTF("Shared Tx FIFO mode\n");
+	}
+
+	/*
+	 * Initialized the Core for Device mode here if there is nod ADP support.
+	 * Otherwise it will be done later in dwc_otg_adp_start routine.
+	 */
+	if (dwc_otg_is_device_mode(core_if) /*&& !core_if->adp_enable*/) {
+		dwc_otg_core_dev_init(core_if);
+	}
+
+	/*
+	 * Register the PCD Callbacks.
+	 */
+	dwc_otg_cil_register_pcd_callbacks(core_if, &pcd_callbacks, pcd);
+
+	/*
+	 * Initialize the DMA buffer for SETUP packets
+	 */
+	if (GET_CORE_IF(pcd)->dma_enable) {
+		pcd->setup_pkt =
+		    DWC_DMA_ALLOC(dev, sizeof(*pcd->setup_pkt) * 5,
+				  &pcd->setup_pkt_dma_handle);
+		if (pcd->setup_pkt == NULL) {
+			DWC_FREE(pcd);
+			return NULL;
+		}
+
+		pcd->status_buf =
+		    DWC_DMA_ALLOC(dev, sizeof(uint16_t),
+				  &pcd->status_buf_dma_handle);
+		if (pcd->status_buf == NULL) {
+			DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
+				     pcd->setup_pkt, pcd->setup_pkt_dma_handle);
+			DWC_FREE(pcd);
+			return NULL;
+		}
+
+		if (GET_CORE_IF(pcd)->dma_desc_enable) {
+			dev_if->setup_desc_addr[0] =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_setup_desc_addr[0], 1);
+			dev_if->setup_desc_addr[1] =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_setup_desc_addr[1], 1);
+			dev_if->in_desc_addr =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_in_desc_addr, 1);
+			dev_if->out_desc_addr =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_out_desc_addr, 1);
+			pcd->data_terminated = 0;
+
+			if (dev_if->setup_desc_addr[0] == 0
+			    || dev_if->setup_desc_addr[1] == 0
+			    || dev_if->in_desc_addr == 0
+			    || dev_if->out_desc_addr == 0) {
+
+				if (dev_if->out_desc_addr)
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->out_desc_addr,
+					     dev_if->dma_out_desc_addr, 1);
+				if (dev_if->in_desc_addr)
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->in_desc_addr,
+					     dev_if->dma_in_desc_addr, 1);
+				if (dev_if->setup_desc_addr[1])
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->setup_desc_addr[1],
+					     dev_if->dma_setup_desc_addr[1], 1);
+				if (dev_if->setup_desc_addr[0])
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->setup_desc_addr[0],
+					     dev_if->dma_setup_desc_addr[0], 1);
+
+				DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
+					     pcd->setup_pkt,
+					     pcd->setup_pkt_dma_handle);
+				DWC_DMA_FREE(dev, sizeof(*pcd->status_buf),
+					     pcd->status_buf,
+					     pcd->status_buf_dma_handle);
+
+				DWC_FREE(pcd);
+
+				return NULL;
+			}
+		}
+	} else {
+		pcd->setup_pkt = DWC_ALLOC(sizeof(*pcd->setup_pkt) * 5);
+		if (pcd->setup_pkt == NULL) {
+			DWC_FREE(pcd);
+			return NULL;
+		}
+
+		pcd->status_buf = DWC_ALLOC(sizeof(uint16_t));
+		if (pcd->status_buf == NULL) {
+			DWC_FREE(pcd->setup_pkt);
+			DWC_FREE(pcd);
+			return NULL;
+		}
+	}
+
+	dwc_otg_pcd_reinit(pcd);
+
+	/* Allocate the cfi object for the PCD */
+#ifdef DWC_UTE_CFI
+	pcd->cfi = DWC_ALLOC(sizeof(cfiobject_t));
+	if (NULL == pcd->cfi)
+		goto fail;
+	if (init_cfi(pcd->cfi)) {
+		CFI_INFO("%s: Failed to init the CFI object\n", __func__);
+		goto fail;
+	}
+#endif
+
+	/* Initialize tasklets */
+	pcd->start_xfer_tasklet = DWC_TASK_ALLOC("xfer_tasklet",
+						 start_xfer_tasklet_func, pcd);
+	pcd->test_mode_tasklet = DWC_TASK_ALLOC("test_mode_tasklet",
+						do_test_mode, pcd);
+
+	/* Initialize SRP timer */
+	core_if->srp_timer = DWC_TIMER_ALLOC("SRP TIMER", srp_timeout, core_if);
+
+	if (core_if->core_params->dev_out_nak) {
+		/**
+		* Initialize xfer timeout timer. Implemented for
+		* 2.93a feature "Device DDMA OUT NAK Enhancement"
+		*/
+		for(i = 0; i < MAX_EPS_CHANNELS; i++) {
+			pcd->core_if->ep_xfer_timer[i] =
+				DWC_TIMER_ALLOC("ep timer", ep_xfer_timeout,
+				&pcd->core_if->ep_xfer_info[i]);
+		}
+	}
+
+	return pcd;
+#ifdef DWC_UTE_CFI
+fail:
+#endif
+	if (pcd->setup_pkt)
+		DWC_FREE(pcd->setup_pkt);
+	if (pcd->status_buf)
+		DWC_FREE(pcd->status_buf);
+#ifdef DWC_UTE_CFI
+	if (pcd->cfi)
+		DWC_FREE(pcd->cfi);
+#endif
+	if (pcd)
+		DWC_FREE(pcd);
+	return NULL;
+
+}
+
+/**
+ * Remove PCD specific data
+ */
+void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+	int i;
+
+	if (pcd->core_if->core_params->dev_out_nak) {
+		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+			DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[i]);
+			pcd->core_if->ep_xfer_info[i].state = 0;
+		}
+	}
+
+	if (GET_CORE_IF(pcd)->dma_enable) {
+		DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5, pcd->setup_pkt,
+			     pcd->setup_pkt_dma_handle);
+		DWC_DMA_FREE(dev, sizeof(uint16_t), pcd->status_buf,
+			     pcd->status_buf_dma_handle);
+		if (GET_CORE_IF(pcd)->dma_desc_enable) {
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->setup_desc_addr[0],
+						   dev_if->dma_setup_desc_addr
+						   [0], 1);
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->setup_desc_addr[1],
+						   dev_if->dma_setup_desc_addr
+						   [1], 1);
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->in_desc_addr,
+						   dev_if->dma_in_desc_addr, 1);
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->out_desc_addr,
+						   dev_if->dma_out_desc_addr,
+						   1);
+		}
+	} else {
+		DWC_FREE(pcd->setup_pkt);
+		DWC_FREE(pcd->status_buf);
+	}
+	DWC_SPINLOCK_FREE(pcd->lock);
+	/* Set core_if's lock pointer to NULL */
+	pcd->core_if->lock = NULL;
+
+	DWC_TASK_FREE(pcd->start_xfer_tasklet);
+	DWC_TASK_FREE(pcd->test_mode_tasklet);
+	if (pcd->core_if->core_params->dev_out_nak) {
+		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+			if (pcd->core_if->ep_xfer_timer[i]) {
+					DWC_TIMER_FREE(pcd->core_if->ep_xfer_timer[i]);
+			}
+		}
+	}
+
+/* Release the CFI object's dynamic memory */
+#ifdef DWC_UTE_CFI
+	if (pcd->cfi->ops.release) {
+		pcd->cfi->ops.release(pcd->cfi);
+	}
+#endif
+
+	DWC_FREE(pcd);
+}
+
+/**
+ * Returns whether registered pcd is dual speed or not
+ */
+uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) ||
+	    ((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	     (core_if->core_params->ulpi_fs_ls))) {
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * Returns whether registered pcd is OTG capable or not
+ */
+uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	gusbcfg_data_t usbcfg = {.d32 = 0 };
+
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	if (!usbcfg.b.srpcap || !usbcfg.b.hnpcap) {
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * This function assigns periodic Tx FIFO to an periodic EP
+ * in shared Tx FIFO mode
+ */
+static uint32_t assign_tx_fifo(dwc_otg_core_if_t * core_if)
+{
+	uint32_t TxMsk = 1;
+	int i;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; ++i) {
+		if ((TxMsk & core_if->tx_msk) == 0) {
+			core_if->tx_msk |= TxMsk;
+			return i + 1;
+		}
+		TxMsk <<= 1;
+	}
+	return 0;
+}
+
+/**
+ * This function assigns periodic Tx FIFO to an periodic EP
+ * in shared Tx FIFO mode
+ */
+static uint32_t assign_perio_tx_fifo(dwc_otg_core_if_t * core_if)
+{
+	uint32_t PerTxMsk = 1;
+	int i;
+	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; ++i) {
+		if ((PerTxMsk & core_if->p_tx_msk) == 0) {
+			core_if->p_tx_msk |= PerTxMsk;
+			return i + 1;
+		}
+		PerTxMsk <<= 1;
+	}
+	return 0;
+}
+
+/**
+ * This function releases periodic Tx FIFO
+ * in shared Tx FIFO mode
+ */
+static void release_perio_tx_fifo(dwc_otg_core_if_t * core_if,
+				  uint32_t fifo_num)
+{
+	core_if->p_tx_msk =
+	    (core_if->p_tx_msk & (1 << (fifo_num - 1))) ^ core_if->p_tx_msk;
+}
+
+/**
+ * This function releases periodic Tx FIFO
+ * in shared Tx FIFO mode
+ */
+static void release_tx_fifo(dwc_otg_core_if_t * core_if, uint32_t fifo_num)
+{
+	core_if->tx_msk =
+	    (core_if->tx_msk & (1 << (fifo_num - 1))) ^ core_if->tx_msk;
+}
+
+/**
+ * This function is being called from gadget
+ * to enable PCD endpoint.
+ */
+int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
+			  const uint8_t * ep_desc, void *usb_ep)
+{
+	int num, dir;
+	dwc_otg_pcd_ep_t *ep = NULL;
+	const usb_endpoint_descriptor_t *desc;
+	dwc_irqflags_t flags;
+	fifosize_data_t dptxfsiz = {.d32 = 0 };
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
+	int retval = 0;
+	int i, epcount;
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+
+	desc = (const usb_endpoint_descriptor_t *)ep_desc;
+
+	if (!desc) {
+		pcd->ep0.priv = usb_ep;
+		ep = &pcd->ep0;
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	num = UE_GET_ADDR(desc->bEndpointAddress);
+	dir = UE_GET_DIR(desc->bEndpointAddress);
+
+	if (!desc->wMaxPacketSize) {
+		DWC_WARN("bad maxpacketsize\n");
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	if (dir == UE_DIR_IN) {
+		epcount = pcd->core_if->dev_if->num_in_eps;
+		for (i = 0; i < epcount; i++) {
+			if (num == pcd->in_ep[i].dwc_ep.num) {
+				ep = &pcd->in_ep[i];
+				break;
+			}
+		}
+	} else {
+		epcount = pcd->core_if->dev_if->num_out_eps;
+		for (i = 0; i < epcount; i++) {
+			if (num == pcd->out_ep[i].dwc_ep.num) {
+				ep = &pcd->out_ep[i];
+				break;
+			}
+		}
+	}
+
+	if (!ep) {
+		DWC_WARN("bad address\n");
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	ep->desc = desc;
+	ep->priv = usb_ep;
+
+	/*
+	 * Activate the EP
+	 */
+	ep->stopped = 0;
+
+	ep->dwc_ep.is_in = (dir == UE_DIR_IN);
+	ep->dwc_ep.maxpacket = UGETW(desc->wMaxPacketSize);
+
+	ep->dwc_ep.type = desc->bmAttributes & UE_XFERTYPE;
+
+	if (ep->dwc_ep.is_in) {
+		if (!GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			ep->dwc_ep.tx_fifo_num = 0;
+
+			if (ep->dwc_ep.type == UE_ISOCHRONOUS) {
+				/*
+				 * if ISOC EP then assign a Periodic Tx FIFO.
+				 */
+				ep->dwc_ep.tx_fifo_num =
+				    assign_perio_tx_fifo(GET_CORE_IF(pcd));
+			}
+		} else {
+			/*
+			 * if Dedicated FIFOs mode is on then assign a Tx FIFO.
+			 */
+			ep->dwc_ep.tx_fifo_num =
+			    assign_tx_fifo(GET_CORE_IF(pcd));
+		}
+
+		/* Calculating EP info controller base address */
+		if (ep->dwc_ep.tx_fifo_num
+		    && GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			gdfifocfg.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
+					   core_global_regs->gdfifocfg);
+			gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
+			dptxfsiz.d32 =
+			    (DWC_READ_REG32
+			     (&GET_CORE_IF(pcd)->core_global_regs->
+			      dtxfsiz[ep->dwc_ep.tx_fifo_num - 1]) >> 16);
+			gdfifocfg.b.epinfobase =
+			    gdfifocfgbase.d32 + dptxfsiz.d32;
+			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
+				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
+						core_global_regs->gdfifocfg,
+						gdfifocfg.d32);
+			}
+		}
+	}
+	/* Set initial data PID. */
+	if (ep->dwc_ep.type == UE_BULK) {
+		ep->dwc_ep.data_pid_start = 0;
+	}
+
+	/* Alloc DMA Descriptors */
+	if (GET_CORE_IF(pcd)->dma_desc_enable) {
+#ifndef DWC_UTE_PER_IO
+		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
+#endif
+			ep->dwc_ep.desc_addr =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+						&ep->dwc_ep.dma_desc_addr,
+						MAX_DMA_DESC_CNT);
+			if (!ep->dwc_ep.desc_addr) {
+				DWC_WARN("%s, can't allocate DMA descriptor\n",
+					 __func__);
+				retval = -DWC_E_SHUTDOWN;
+				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+				goto out;
+			}
+#ifndef DWC_UTE_PER_IO
+		}
+#endif
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "Activate %s: type=%d, mps=%d desc=%p\n",
+		    (ep->dwc_ep.is_in ? "IN" : "OUT"),
+		    ep->dwc_ep.type, ep->dwc_ep.maxpacket, ep->desc);
+#ifdef DWC_UTE_PER_IO
+	ep->dwc_ep.xiso_bInterval = 1 << (ep->desc->bInterval - 1);
+#endif
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		ep->dwc_ep.bInterval = 1 << (ep->desc->bInterval - 1);
+		ep->dwc_ep.frame_num = 0xFFFFFFFF;
+	}
+
+	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
+
+#ifdef DWC_UTE_CFI
+	if (pcd->cfi->ops.ep_enable) {
+		pcd->cfi->ops.ep_enable(pcd->cfi, pcd, ep);
+	}
+#endif
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+out:
+	return retval;
+}
+
+/**
+ * This function is being called from gadget
+ * to disable PCD endpoint.
+ */
+int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	dwc_otg_dev_dma_desc_t *desc_addr;
+	dwc_dma_t dma_desc_addr;
+	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	fifosize_data_t dptxfsiz = {.d32 = 0 };
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if (!ep || !ep->desc) {
+		DWC_DEBUGPL(DBG_PCD, "bad ep address\n");
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	dwc_otg_request_nuke(ep);
+
+	dwc_otg_ep_deactivate(GET_CORE_IF(pcd), &ep->dwc_ep);
+	if (pcd->core_if->core_params->dev_out_nak) {
+		DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[ep->dwc_ep.num]);
+		pcd->core_if->ep_xfer_info[ep->dwc_ep.num].state = 0;
+	}
+	ep->desc = NULL;
+	ep->stopped = 1;
+
+	gdfifocfg.d32 =
+	    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg);
+	gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
+
+	if (ep->dwc_ep.is_in) {
+		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			/* Flush the Tx FIFO */
+			dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd),
+					      ep->dwc_ep.tx_fifo_num);
+		}
+		release_perio_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
+		release_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
+		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			/* Decreasing EPinfo Base Addr */
+			dptxfsiz.d32 =
+			    (DWC_READ_REG32
+			     (&GET_CORE_IF(pcd)->
+				core_global_regs->dtxfsiz[ep->dwc_ep.tx_fifo_num-1]) >> 16);
+			gdfifocfg.b.epinfobase = gdfifocfgbase.d32 - dptxfsiz.d32;
+			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
+				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg,
+					gdfifocfg.d32);
+			}
+		}
+	}
+
+	/* Free DMA Descriptors */
+	if (GET_CORE_IF(pcd)->dma_desc_enable) {
+		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
+			desc_addr = ep->dwc_ep.desc_addr;
+			dma_desc_addr = ep->dwc_ep.dma_desc_addr;
+
+			/* Cannot call dma_free_coherent() with IRQs disabled */
+			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+			dwc_otg_ep_free_desc_chain(dev, desc_addr, dma_desc_addr,
+						   MAX_DMA_DESC_CNT);
+
+			goto out_unlocked;
+		}
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+out_unlocked:
+	DWC_DEBUGPL(DBG_PCD, "%d %s disabled\n", ep->dwc_ep.num,
+		    ep->dwc_ep.is_in ? "IN" : "OUT");
+	return 0;
+
+}
+
+/******************************************************************************/
+#ifdef DWC_UTE_PER_IO
+
+/**
+ * Free the request and its extended parts
+ *
+ */
+void dwc_pcd_xiso_ereq_free(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req)
+{
+	DWC_FREE(req->ext_req.per_io_frame_descs);
+	DWC_FREE(req);
+}
+
+/**
+ * Start the next request in the endpoint's queue.
+ *
+ */
+int dwc_otg_pcd_xiso_start_next_request(dwc_otg_pcd_t * pcd,
+					dwc_otg_pcd_ep_t * ep)
+{
+	int i;
+	dwc_otg_pcd_request_t *req = NULL;
+	dwc_ep_t *dwcep = NULL;
+	struct dwc_iso_xreq_port *ereq = NULL;
+	struct dwc_iso_pkt_desc_port *ddesc_iso;
+	uint16_t nat;
+	depctl_data_t diepctl;
+
+	dwcep = &ep->dwc_ep;
+
+	if (dwcep->xiso_active_xfers > 0) {
+#if 0	//Disable this to decrease s/w overhead that is crucial for Isoc transfers
+		DWC_WARN("There are currently active transfers for EP%d \
+				(active=%d; queued=%d)", dwcep->num, dwcep->xiso_active_xfers,
+				dwcep->xiso_queued_xfers);
+#endif
+		return 0;
+	}
+
+	nat = UGETW(ep->desc->wMaxPacketSize);
+	nat = (nat >> 11) & 0x03;
+
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		ereq = &req->ext_req;
+		ep->stopped = 0;
+
+		/* Get the frame number */
+		dwcep->xiso_frame_num =
+		    dwc_otg_get_frame_number(GET_CORE_IF(pcd));
+		DWC_DEBUG("FRM_NUM=%d", dwcep->xiso_frame_num);
+
+		ddesc_iso = ereq->per_io_frame_descs;
+
+		if (dwcep->is_in) {
+			/* Setup DMA Descriptor chain for IN Isoc request */
+			for (i = 0; i < ereq->pio_pkt_count; i++) {
+				//if ((i % (nat + 1)) == 0)
+				if ( i > 0 )
+					dwcep->xiso_frame_num =
+					    (dwcep->xiso_bInterval +
+										dwcep->xiso_frame_num) & 0x3FFF;
+				dwcep->desc_addr[i].buf =
+				    req->dma + ddesc_iso[i].offset;
+				dwcep->desc_addr[i].status.b_iso_in.txbytes =
+				    ddesc_iso[i].length;
+				dwcep->desc_addr[i].status.b_iso_in.framenum =
+				    dwcep->xiso_frame_num;
+				dwcep->desc_addr[i].status.b_iso_in.bs =
+				    BS_HOST_READY;
+				dwcep->desc_addr[i].status.b_iso_in.txsts = 0;
+				dwcep->desc_addr[i].status.b_iso_in.sp =
+				    (ddesc_iso[i].length %
+				     dwcep->maxpacket) ? 1 : 0;
+				dwcep->desc_addr[i].status.b_iso_in.ioc = 0;
+				dwcep->desc_addr[i].status.b_iso_in.pid = nat + 1;
+				dwcep->desc_addr[i].status.b_iso_in.l = 0;
+
+				/* Process the last descriptor */
+				if (i == ereq->pio_pkt_count - 1) {
+					dwcep->desc_addr[i].status.b_iso_in.ioc = 1;
+					dwcep->desc_addr[i].status.b_iso_in.l = 1;
+				}
+			}
+
+			/* Setup and start the transfer for this endpoint */
+			dwcep->xiso_active_xfers++;
+			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->dev_if->
+					in_ep_regs[dwcep->num]->diepdma,
+					dwcep->dma_desc_addr);
+			diepctl.d32 = 0;
+			diepctl.b.epena = 1;
+			diepctl.b.cnak = 1;
+			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->dev_if->
+					 in_ep_regs[dwcep->num]->diepctl, 0,
+					 diepctl.d32);
+		} else {
+			/* Setup DMA Descriptor chain for OUT Isoc request */
+			for (i = 0; i < ereq->pio_pkt_count; i++) {
+				//if ((i % (nat + 1)) == 0)
+				dwcep->xiso_frame_num = (dwcep->xiso_bInterval +
+										dwcep->xiso_frame_num) & 0x3FFF;
+				dwcep->desc_addr[i].buf =
+				    req->dma + ddesc_iso[i].offset;
+				dwcep->desc_addr[i].status.b_iso_out.rxbytes =
+				    ddesc_iso[i].length;
+				dwcep->desc_addr[i].status.b_iso_out.framenum =
+				    dwcep->xiso_frame_num;
+				dwcep->desc_addr[i].status.b_iso_out.bs =
+				    BS_HOST_READY;
+				dwcep->desc_addr[i].status.b_iso_out.rxsts = 0;
+				dwcep->desc_addr[i].status.b_iso_out.sp =
+				    (ddesc_iso[i].length %
+				     dwcep->maxpacket) ? 1 : 0;
+				dwcep->desc_addr[i].status.b_iso_out.ioc = 0;
+				dwcep->desc_addr[i].status.b_iso_out.pid = nat + 1;
+				dwcep->desc_addr[i].status.b_iso_out.l = 0;
+
+				/* Process the last descriptor */
+				if (i == ereq->pio_pkt_count - 1) {
+					dwcep->desc_addr[i].status.b_iso_out.ioc = 1;
+					dwcep->desc_addr[i].status.b_iso_out.l = 1;
+				}
+			}
+
+			/* Setup and start the transfer for this endpoint */
+			dwcep->xiso_active_xfers++;
+			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
+					dev_if->out_ep_regs[dwcep->num]->
+					doepdma, dwcep->dma_desc_addr);
+			diepctl.d32 = 0;
+			diepctl.b.epena = 1;
+			diepctl.b.cnak = 1;
+			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
+					 dev_if->out_ep_regs[dwcep->num]->
+					 doepctl, 0, diepctl.d32);
+		}
+
+	} else {
+		ep->stopped = 1;
+	}
+
+	return 0;
+}
+
+/**
+ *	- Remove the request from the queue
+ */
+void complete_xiso_ep(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_pcd_request_t *req = NULL;
+	struct dwc_iso_xreq_port *ereq = NULL;
+	struct dwc_iso_pkt_desc_port *ddesc_iso = NULL;
+	dwc_ep_t *dwcep = NULL;
+	int i;
+
+	//DWC_DEBUG();
+	dwcep = &ep->dwc_ep;
+
+	/* Get the first pending request from the queue */
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		if (!req) {
+			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
+			return;
+		}
+		dwcep->xiso_active_xfers--;
+		dwcep->xiso_queued_xfers--;
+		/* Remove this request from the queue */
+		DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
+	} else {
+		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
+		return;
+	}
+
+	ep->stopped = 1;
+	ereq = &req->ext_req;
+	ddesc_iso = ereq->per_io_frame_descs;
+
+	if (dwcep->xiso_active_xfers < 0) {
+		DWC_WARN("EP#%d (xiso_active_xfers=%d)", dwcep->num,
+			 dwcep->xiso_active_xfers);
+	}
+
+	/* Fill the Isoc descs of portable extended req from dma descriptors */
+	for (i = 0; i < ereq->pio_pkt_count; i++) {
+		if (dwcep->is_in) {	/* IN endpoints */
+			ddesc_iso[i].actual_length = ddesc_iso[i].length -
+			    dwcep->desc_addr[i].status.b_iso_in.txbytes;
+			ddesc_iso[i].status =
+			    dwcep->desc_addr[i].status.b_iso_in.txsts;
+		} else {	/* OUT endpoints */
+			ddesc_iso[i].actual_length = ddesc_iso[i].length -
+			    dwcep->desc_addr[i].status.b_iso_out.rxbytes;
+			ddesc_iso[i].status =
+			    dwcep->desc_addr[i].status.b_iso_out.rxsts;
+		}
+	}
+
+	DWC_SPINUNLOCK(ep->pcd->lock);
+
+	/* Call the completion function in the non-portable logic */
+	ep->pcd->fops->xisoc_complete(ep->pcd, ep->priv, req->priv, 0,
+				      &req->ext_req);
+
+	DWC_SPINLOCK(ep->pcd->lock);
+
+	/* Free the request - specific freeing needed for extended request object */
+	dwc_pcd_xiso_ereq_free(ep, req);
+
+	/* Start the next request */
+	dwc_otg_pcd_xiso_start_next_request(ep->pcd, ep);
+
+	return;
+}
+
+/**
+ * Create and initialize the Isoc pkt descriptors of the extended request.
+ *
+ */
+static int dwc_otg_pcd_xiso_create_pkt_descs(dwc_otg_pcd_request_t * req,
+					     void *ereq_nonport,
+					     int atomic_alloc)
+{
+	struct dwc_iso_xreq_port *ereq = NULL;
+	struct dwc_iso_xreq_port *req_mapped = NULL;
+	struct dwc_iso_pkt_desc_port *ipds = NULL;	/* To be created in this function */
+	uint32_t pkt_count;
+	int i;
+
+	ereq = &req->ext_req;
+	req_mapped = (struct dwc_iso_xreq_port *)ereq_nonport;
+	pkt_count = req_mapped->pio_pkt_count;
+
+	/* Create the isoc descs */
+	if (atomic_alloc) {
+		ipds = DWC_ALLOC_ATOMIC(sizeof(*ipds) * pkt_count);
+	} else {
+		ipds = DWC_ALLOC(sizeof(*ipds) * pkt_count);
+	}
+
+	if (!ipds) {
+		DWC_ERROR("Failed to allocate isoc descriptors");
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Initialize the extended request fields */
+	ereq->per_io_frame_descs = ipds;
+	ereq->error_count = 0;
+	ereq->pio_alloc_pkt_count = pkt_count;
+	ereq->pio_pkt_count = pkt_count;
+	ereq->tr_sub_flags = req_mapped->tr_sub_flags;
+
+	/* Init the Isoc descriptors */
+	for (i = 0; i < pkt_count; i++) {
+		ipds[i].length = req_mapped->per_io_frame_descs[i].length;
+		ipds[i].offset = req_mapped->per_io_frame_descs[i].offset;
+		ipds[i].status = req_mapped->per_io_frame_descs[i].status;	/* 0 */
+		ipds[i].actual_length =
+		    req_mapped->per_io_frame_descs[i].actual_length;
+	}
+
+	return 0;
+}
+
+static void prn_ext_request(struct dwc_iso_xreq_port *ereq)
+{
+	struct dwc_iso_pkt_desc_port *xfd = NULL;
+	int i;
+
+	DWC_DEBUG("per_io_frame_descs=%p", ereq->per_io_frame_descs);
+	DWC_DEBUG("tr_sub_flags=%d", ereq->tr_sub_flags);
+	DWC_DEBUG("error_count=%d", ereq->error_count);
+	DWC_DEBUG("pio_alloc_pkt_count=%d", ereq->pio_alloc_pkt_count);
+	DWC_DEBUG("pio_pkt_count=%d", ereq->pio_pkt_count);
+	DWC_DEBUG("res=%d", ereq->res);
+
+	for (i = 0; i < ereq->pio_pkt_count; i++) {
+		xfd = &ereq->per_io_frame_descs[0];
+		DWC_DEBUG("FD #%d", i);
+
+		DWC_DEBUG("xfd->actual_length=%d", xfd->actual_length);
+		DWC_DEBUG("xfd->length=%d", xfd->length);
+		DWC_DEBUG("xfd->offset=%d", xfd->offset);
+		DWC_DEBUG("xfd->status=%d", xfd->status);
+	}
+}
+
+/**
+ *
+ */
+int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+			      uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
+			      int zero, void *req_handle, int atomic_alloc,
+			      void *ereq_nonport)
+{
+	dwc_otg_pcd_request_t *req = NULL;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	int res;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	/* We support this extension only for DDMA mode */
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
+		if (!GET_CORE_IF(pcd)->dma_desc_enable)
+			return -DWC_E_INVALID;
+
+	/* Create a dwc_otg_pcd_request_t object */
+	if (atomic_alloc) {
+		req = DWC_ALLOC_ATOMIC(sizeof(*req));
+	} else {
+		req = DWC_ALLOC(sizeof(*req));
+	}
+
+	if (!req) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Create the Isoc descs for this request which shall be the exact match
+	 * of the structure sent to us from the non-portable logic */
+	res =
+	    dwc_otg_pcd_xiso_create_pkt_descs(req, ereq_nonport, atomic_alloc);
+	if (res) {
+		DWC_WARN("Failed to init the Isoc descriptors");
+		DWC_FREE(req);
+		return res;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
+	req->buf = buf;
+	req->dma = dma_buf;
+	req->length = buflen;
+	req->sent_zlp = zero;
+	req->priv = req_handle;
+
+	//DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	ep->dwc_ep.dma_addr = dma_buf;
+	ep->dwc_ep.start_xfer_buff = buf;
+	ep->dwc_ep.xfer_buff = buf;
+	ep->dwc_ep.xfer_len = 0;
+	ep->dwc_ep.xfer_count = 0;
+	ep->dwc_ep.sent_zlp = 0;
+	ep->dwc_ep.total_len = buflen;
+
+	/* Add this request to the tail */
+	DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
+	ep->dwc_ep.xiso_queued_xfers++;
+
+//DWC_DEBUG("CP_0");
+//DWC_DEBUG("req->ext_req.tr_sub_flags=%d", req->ext_req.tr_sub_flags);
+//prn_ext_request((struct dwc_iso_xreq_port *) ereq_nonport);
+//prn_ext_request(&req->ext_req);
+
+	//DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	/* If the req->status == ASAP  then check if there is any active transfer
+	 * for this endpoint. If no active transfers, then get the first entry
+	 * from the queue and start that transfer
+	 */
+	if (req->ext_req.tr_sub_flags == DWC_EREQ_TF_ASAP) {
+		res = dwc_otg_pcd_xiso_start_next_request(pcd, ep);
+		if (res) {
+			DWC_WARN("Failed to start the next Isoc transfer");
+			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+			DWC_FREE(req);
+			return res;
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+	return 0;
+}
+
+#endif
+/* END ifdef DWC_UTE_PER_IO ***************************************************/
+int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+			 uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
+			 int zero, void *req_handle, int atomic_alloc)
+{
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+	dwc_irqflags_t flags;
+	dwc_otg_pcd_request_t *req;
+	dwc_otg_pcd_ep_t *ep;
+	uint32_t max_transfer;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (atomic_alloc) {
+		req = DWC_ALLOC_ATOMIC(sizeof(*req));
+	} else {
+		req = DWC_ALLOC(sizeof(*req));
+	}
+
+	if (!req) {
+		return -DWC_E_NO_MEMORY;
+	}
+	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
+	if (!GET_CORE_IF(pcd)->core_params->opt) {
+		if (ep->dwc_ep.num != 0) {
+			DWC_ERROR("queue req %p, len %d buf %p\n",
+				  req_handle, buflen, buf);
+		}
+	}
+
+	req->buf = buf;
+	req->dma = dma_buf;
+	req->length = buflen;
+	req->sent_zlp = zero;
+	req->priv = req_handle;
+	req->dw_align_buf = NULL;
+	if ((dma_buf & 0x3) && GET_CORE_IF(pcd)->dma_enable
+			&& !GET_CORE_IF(pcd)->dma_desc_enable)
+		req->dw_align_buf = DWC_DMA_ALLOC(dev, buflen,
+				 &req->dw_align_buf_dma);
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	/*
+	 * After adding request to the queue for IN ISOC wait for In Token Received
+	 * when TX FIFO is empty interrupt and for OUT ISOC wait for OUT Token
+	 * Received when EP is disabled interrupt to obtain starting microframe
+	 * (odd/even) start transfer
+	 */
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		if (req != 0) {
+			depctl_data_t depctl = {.d32 =
+				    DWC_READ_REG32(&pcd->core_if->dev_if->
+						   in_ep_regs[ep->dwc_ep.num]->
+						   diepctl) };
+			++pcd->request_pending;
+
+			DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
+			if (ep->dwc_ep.is_in) {
+				depctl.b.cnak = 1;
+				DWC_WRITE_REG32(&pcd->core_if->dev_if->
+						in_ep_regs[ep->dwc_ep.num]->
+						diepctl, depctl.d32);
+			}
+
+			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		}
+		return 0;
+	}
+
+	/*
+	 * For EP0 IN without premature status, zlp is required?
+	 */
+	if (ep->dwc_ep.num == 0 && ep->dwc_ep.is_in) {
+		DWC_DEBUGPL(DBG_PCDV, "%d-OUT ZLP\n", ep->dwc_ep.num);
+		//_req->zero = 1;
+	}
+
+	/* Start the transfer */
+	if (DWC_CIRCLEQ_EMPTY(&ep->queue) && !ep->stopped) {
+		/* EP0 Transfer? */
+		if (ep->dwc_ep.num == 0) {
+			switch (pcd->ep0state) {
+			case EP0_IN_DATA_PHASE:
+				DWC_DEBUGPL(DBG_PCD,
+					    "%s ep0: EP0_IN_DATA_PHASE\n",
+					    __func__);
+				break;
+
+			case EP0_OUT_DATA_PHASE:
+				DWC_DEBUGPL(DBG_PCD,
+					    "%s ep0: EP0_OUT_DATA_PHASE\n",
+					    __func__);
+				if (pcd->request_config) {
+					/* Complete STATUS PHASE */
+					ep->dwc_ep.is_in = 1;
+					pcd->ep0state = EP0_IN_STATUS_PHASE;
+				}
+				break;
+
+			case EP0_IN_STATUS_PHASE:
+				DWC_DEBUGPL(DBG_PCD,
+					    "%s ep0: EP0_IN_STATUS_PHASE\n",
+					    __func__);
+				break;
+
+			default:
+				DWC_DEBUGPL(DBG_ANY, "ep0: odd state %d\n",
+					    pcd->ep0state);
+				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+				return -DWC_E_SHUTDOWN;
+			}
+
+			ep->dwc_ep.dma_addr = dma_buf;
+			ep->dwc_ep.start_xfer_buff = buf;
+			ep->dwc_ep.xfer_buff = buf;
+			ep->dwc_ep.xfer_len = buflen;
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+			if (zero) {
+				if ((ep->dwc_ep.xfer_len %
+				     ep->dwc_ep.maxpacket == 0)
+				    && (ep->dwc_ep.xfer_len != 0)) {
+					ep->dwc_ep.sent_zlp = 1;
+				}
+
+			}
+
+			dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
+						   &ep->dwc_ep);
+		}		// non-ep0 endpoints
+		else {
+#ifdef DWC_UTE_CFI
+			if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+				/* store the request length */
+				ep->dwc_ep.cfi_req_len = buflen;
+				pcd->cfi->ops.build_descriptors(pcd->cfi, pcd,
+								ep, req);
+			} else {
+#endif
+				max_transfer =
+				    GET_CORE_IF(ep->pcd)->core_params->
+				    max_transfer_size;
+
+				/* Setup and start the Transfer */
+				if (req->dw_align_buf){
+					if (ep->dwc_ep.is_in)
+						dwc_memcpy(req->dw_align_buf,
+							   buf, buflen);
+					ep->dwc_ep.dma_addr =
+					    req->dw_align_buf_dma;
+					ep->dwc_ep.start_xfer_buff =
+					    req->dw_align_buf;
+					ep->dwc_ep.xfer_buff =
+					    req->dw_align_buf;
+				} else {
+					ep->dwc_ep.dma_addr = dma_buf;
+					ep->dwc_ep.start_xfer_buff = buf;
+                                        ep->dwc_ep.xfer_buff = buf;
+				}
+				ep->dwc_ep.xfer_len = 0;
+				ep->dwc_ep.xfer_count = 0;
+				ep->dwc_ep.sent_zlp = 0;
+				ep->dwc_ep.total_len = buflen;
+
+				ep->dwc_ep.maxxfer = max_transfer;
+				if (GET_CORE_IF(pcd)->dma_desc_enable) {
+					uint32_t out_max_xfer =
+					    DDMA_MAX_TRANSFER_SIZE -
+					    (DDMA_MAX_TRANSFER_SIZE % 4);
+					if (ep->dwc_ep.is_in) {
+						if (ep->dwc_ep.maxxfer >
+						    DDMA_MAX_TRANSFER_SIZE) {
+							ep->dwc_ep.maxxfer =
+							    DDMA_MAX_TRANSFER_SIZE;
+						}
+					} else {
+						if (ep->dwc_ep.maxxfer >
+						    out_max_xfer) {
+							ep->dwc_ep.maxxfer =
+							    out_max_xfer;
+						}
+					}
+				}
+				if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
+					ep->dwc_ep.maxxfer -=
+					    (ep->dwc_ep.maxxfer %
+					     ep->dwc_ep.maxpacket);
+				}
+
+				if (zero) {
+					if ((ep->dwc_ep.total_len %
+					     ep->dwc_ep.maxpacket == 0)
+					    && (ep->dwc_ep.total_len != 0)) {
+						ep->dwc_ep.sent_zlp = 1;
+					}
+				}
+#ifdef DWC_UTE_CFI
+			}
+#endif
+			dwc_otg_ep_start_transfer(GET_CORE_IF(pcd),
+						  &ep->dwc_ep);
+		}
+	}
+
+	if (req != 0) {
+		++pcd->request_pending;
+		DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
+		if (ep->dwc_ep.is_in && ep->stopped
+		    && !(GET_CORE_IF(pcd)->dma_enable)) {
+			/** @todo NGS Create a function for this. */
+			diepmsk_data_t diepmsk = {.d32 = 0 };
+			diepmsk.b.intktxfemp = 1;
+			if (GET_CORE_IF(pcd)->multiproc_int_enable) {
+				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
+						 dev_if->dev_global_regs->diepeachintmsk
+						 [ep->dwc_ep.num], 0,
+						 diepmsk.d32);
+			} else {
+				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
+						 dev_if->dev_global_regs->
+						 diepmsk, 0, diepmsk.d32);
+			}
+
+		}
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return 0;
+}
+
+int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
+			   void *req_handle)
+{
+	dwc_irqflags_t flags;
+	dwc_otg_pcd_request_t *req;
+	dwc_otg_pcd_ep_t *ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
+		DWC_WARN("bad argument\n");
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	/* make sure it's actually queued on this endpoint */
+	DWC_CIRCLEQ_FOREACH(req, &ep->queue, queue_entry) {
+		if (req->priv == (void *)req_handle) {
+			break;
+		}
+	}
+
+	if (req->priv != (void *)req_handle) {
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		return -DWC_E_INVALID;
+	}
+
+	if (!DWC_CIRCLEQ_EMPTY_ENTRY(req, queue_entry)) {
+		dwc_otg_request_done(ep, req, -DWC_E_RESTART);
+	} else {
+		req = NULL;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return req ? 0 : -DWC_E_SHUTDOWN;
+
+}
+
+/**
+ * dwc_otg_pcd_ep_wedge - sets the halt feature and ignores clear requests
+ *
+ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
+ * requests. If the gadget driver clears the halt status, it will
+ * automatically unwedge the endpoint.
+ *
+ * Returns zero on success, else negative DWC error code.
+ */
+int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	int retval = 0;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if ((!ep->desc && ep != &pcd->ep0) ||
+	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
+		DWC_WARN("%s, bad ep\n", __func__);
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
+			 ep->dwc_ep.is_in ? "IN" : "OUT");
+		retval = -DWC_E_AGAIN;
+	} else {
+                /* This code needs to be reviewed */
+		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
+			dtxfsts_data_t txstatus;
+			fifosize_data_t txfifosize;
+
+			txfifosize.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
+					   core_global_regs->dtxfsiz[ep->dwc_ep.
+								     tx_fifo_num]);
+			txstatus.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
+					   dev_if->in_ep_regs[ep->dwc_ep.num]->
+					   dtxfsts);
+
+			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
+				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
+				retval = -DWC_E_AGAIN;
+			} else {
+				if (ep->dwc_ep.num == 0) {
+					pcd->ep0state = EP0_STALL;
+				}
+
+				ep->stopped = 1;
+				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
+						     &ep->dwc_ep);
+			}
+		} else {
+			if (ep->dwc_ep.num == 0) {
+				pcd->ep0state = EP0_STALL;
+			}
+
+			ep->stopped = 1;
+			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return retval;
+}
+
+int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	int retval = 0;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if (!ep || (!ep->desc && ep != &pcd->ep0) ||
+	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
+		DWC_WARN("%s, bad ep\n", __func__);
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
+			 ep->dwc_ep.is_in ? "IN" : "OUT");
+		retval = -DWC_E_AGAIN;
+	} else if (value == 0) {
+		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+	} else if (value == 1) {
+		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
+			dtxfsts_data_t txstatus;
+			fifosize_data_t txfifosize;
+
+			txfifosize.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->
+					   dtxfsiz[ep->dwc_ep.tx_fifo_num]);
+			txstatus.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
+					   in_ep_regs[ep->dwc_ep.num]->dtxfsts);
+
+			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
+				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
+				retval = -DWC_E_AGAIN;
+			} else {
+				if (ep->dwc_ep.num == 0) {
+					pcd->ep0state = EP0_STALL;
+				}
+
+				ep->stopped = 1;
+				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
+						     &ep->dwc_ep);
+			}
+		} else {
+			if (ep->dwc_ep.num == 0) {
+				pcd->ep0state = EP0_STALL;
+			}
+
+			ep->stopped = 1;
+			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+		}
+	} else if (value == 2) {
+		ep->dwc_ep.stall_clear_flag = 0;
+	} else if (value == 3) {
+		ep->dwc_ep.stall_clear_flag = 1;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return retval;
+}
+
+/**
+ * This function initiates remote wakeup of the host from suspend state.
+ */
+void dwc_otg_pcd_rem_wkup_from_suspend(dwc_otg_pcd_t * pcd, int set)
+{
+	dctl_data_t dctl = { 0 };
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dsts_data_t dsts;
+
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+	if (!dsts.b.suspsts) {
+		DWC_WARN("Remote wakeup while is not in suspend state\n");
+	}
+	/* Check if DEVICE_REMOTE_WAKEUP feature enabled */
+	if (pcd->remote_wakeup_enable) {
+		if (set) {
+
+			if (core_if->adp_enable) {
+				gpwrdn_data_t gpwrdn;
+
+				dwc_otg_adp_probe_stop(core_if);
+
+				/* Mask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gpwrdn,
+						 gpwrdn.d32, 0);
+
+				/* Disable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gpwrdn,
+						 gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Device mode.
+				 */
+				core_if->op_state = B_PERIPHERAL;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_pcd_start(core_if);
+
+				dwc_otg_initiate_srp(core_if);
+			}
+
+			dctl.b.rmtwkupsig = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, 0, dctl.d32);
+			DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
+
+			dwc_mdelay(2);
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, dctl.d32, 0);
+			DWC_DEBUGPL(DBG_PCD, "Clear Remote Wakeup\n");
+		}
+	} else {
+		DWC_DEBUGPL(DBG_PCD, "Remote Wakeup is disabled\n");
+	}
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * This function initiates remote wakeup of the host from L1 sleep state.
+ */
+void dwc_otg_pcd_rem_wkup_from_sleep(dwc_otg_pcd_t * pcd, int set)
+{
+	glpmcfg_data_t lpmcfg;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+
+	/* Check if we are in L1 state */
+	if (!lpmcfg.b.prt_sleep_sts) {
+		DWC_DEBUGPL(DBG_PCD, "Device is not in sleep state\n");
+		return;
+	}
+
+	/* Check if host allows remote wakeup */
+	if (!lpmcfg.b.rem_wkup_en) {
+		DWC_DEBUGPL(DBG_PCD, "Host does not allow remote wakeup\n");
+		return;
+	}
+
+	/* Check if Resume OK */
+	if (!lpmcfg.b.sleep_state_resumeok) {
+		DWC_DEBUGPL(DBG_PCD, "Sleep state resume is not OK\n");
+		return;
+	}
+
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.en_utmi_sleep = 0;
+	lpmcfg.b.hird_thres &= (~(1 << 4));
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+
+	if (set) {
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.b.rmtwkupsig = 1;
+		/* Set RmtWkUpSig bit to start remote wakup signaling.
+		 * Hardware will automatically clear this bit.
+		 */
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl,
+				 0, dctl.d32);
+		DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
+	}
+
+}
+#endif
+
+/**
+ * Performs remote wakeup.
+ */
+void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_irqflags_t flags;
+	if (dwc_otg_is_device_mode(core_if)) {
+		DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		if (core_if->lx_state == DWC_OTG_L1) {
+			dwc_otg_pcd_rem_wkup_from_sleep(pcd, set);
+		} else {
+#endif
+			dwc_otg_pcd_rem_wkup_from_suspend(pcd, set);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		}
+#endif
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+	}
+	return;
+}
+
+void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dctl_data_t dctl = { 0 };
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		dctl.b.sftdiscon = 1;
+		DWC_PRINTF("Soft disconnect for %d useconds\n",no_of_usecs);
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+		dwc_udelay(no_of_usecs);
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32,0);
+
+	} else{
+		DWC_PRINTF("NOT SUPPORTED IN HOST MODE\n");
+	}
+	return;
+
+}
+
+int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd)
+{
+	dsts_data_t dsts;
+	gotgctl_data_t gotgctl;
+
+	/*
+	 * This function starts the Protocol if no session is in progress. If
+	 * a session is already in progress, but the device is suspended,
+	 * remote wakeup signaling is started.
+	 */
+
+	/* Check if valid session */
+	gotgctl.d32 =
+	    DWC_READ_REG32(&(GET_CORE_IF(pcd)->core_global_regs->gotgctl));
+	if (gotgctl.b.bsesvld) {
+		/* Check if suspend state */
+		dsts.d32 =
+		    DWC_READ_REG32(&
+				   (GET_CORE_IF(pcd)->dev_if->
+				    dev_global_regs->dsts));
+		if (dsts.b.suspsts) {
+			dwc_otg_pcd_remote_wakeup(pcd, 1);
+		}
+	} else {
+		dwc_otg_pcd_initiate_srp(pcd);
+	}
+
+	return 0;
+
+}
+
+/**
+ * Start the SRP timer to detect when the SRP does not complete within
+ * 6 seconds.
+ *
+ * @param pcd the pcd structure.
+ */
+void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd)
+{
+	dwc_irqflags_t flags;
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	dwc_otg_initiate_srp(GET_CORE_IF(pcd));
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+}
+
+int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd)
+{
+	return dwc_otg_get_frame_number(GET_CORE_IF(pcd));
+}
+
+int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd)
+{
+	return GET_CORE_IF(pcd)->core_params->lpm_enable;
+}
+
+uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd)
+{
+	return pcd->b_hnp_enable;
+}
+
+uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd)
+{
+	return pcd->a_hnp_support;
+}
+
+uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd)
+{
+	return pcd->a_alt_hnp_support;
+}
+
+int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd)
+{
+	return pcd->remote_wakeup_enable;
+}
+
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd.h b/drivers/usb/host/dwc_otg/dwc_otg_pcd.h
new file mode 100644
index 0000000000000..a70ebd049d2cc
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.h
@@ -0,0 +1,273 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.h $
+ * $Revision: #48 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+#if !defined(__DWC_PCD_H__)
+#define __DWC_PCD_H__
+
+#include "dwc_otg_os_dep.h"
+#include "usb.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_driver.h"
+
+struct cfiobject;
+
+/**
+ * @file
+ *
+ * This file contains the structures, constants, and interfaces for
+ * the Perpherial Contoller Driver (PCD).
+ *
+ * The Peripheral Controller Driver (PCD) for Linux will implement the
+ * Gadget API, so that the existing Gadget drivers can be used. For
+ * the Mass Storage Function driver the File-backed USB Storage Gadget
+ * (FBS) driver will be used.  The FBS driver supports the
+ * Control-Bulk (CB), Control-Bulk-Interrupt (CBI), and Bulk-Only
+ * transports.
+ *
+ */
+
+/** Invalid DMA Address */
+#define DWC_DMA_ADDR_INVALID	(~(dwc_dma_t)0)
+
+/** Max Transfer size for any EP */
+#define DDMA_MAX_TRANSFER_SIZE 65535
+
+/**
+ * Get the pointer to the core_if from the pcd pointer.
+ */
+#define GET_CORE_IF( _pcd ) (_pcd->core_if)
+
+/**
+ * States of EP0.
+ */
+typedef enum ep0_state {
+	EP0_DISCONNECT,		/* no host */
+	EP0_IDLE,
+	EP0_IN_DATA_PHASE,
+	EP0_OUT_DATA_PHASE,
+	EP0_IN_STATUS_PHASE,
+	EP0_OUT_STATUS_PHASE,
+	EP0_STALL,
+} ep0state_e;
+
+/** Fordward declaration.*/
+struct dwc_otg_pcd;
+
+/** DWC_otg iso request structure.
+ *
+ */
+typedef struct usb_iso_request dwc_otg_pcd_iso_request_t;
+
+#ifdef DWC_UTE_PER_IO
+
+/**
+ * This shall be the exact analogy of the same type structure defined in the
+ * usb_gadget.h. Each descriptor contains
+ */
+struct dwc_iso_pkt_desc_port {
+	uint32_t offset;
+	uint32_t length;	/* expected length */
+	uint32_t actual_length;
+	uint32_t status;
+};
+
+struct dwc_iso_xreq_port {
+	/** transfer/submission flag */
+	uint32_t tr_sub_flags;
+	/** Start the request ASAP */
+#define DWC_EREQ_TF_ASAP		0x00000002
+	/** Just enqueue the request w/o initiating a transfer */
+#define DWC_EREQ_TF_ENQUEUE		0x00000004
+
+	/**
+	* count of ISO packets attached to this request - shall
+	* not exceed the pio_alloc_pkt_count
+	*/
+	uint32_t pio_pkt_count;
+	/** count of ISO packets allocated for this request */
+	uint32_t pio_alloc_pkt_count;
+	/** number of ISO packet errors */
+	uint32_t error_count;
+	/** reserved for future extension */
+	uint32_t res;
+	/** Will be allocated and freed in the UTE gadget and based on the CFC value */
+	struct dwc_iso_pkt_desc_port *per_io_frame_descs;
+};
+#endif
+/** DWC_otg request structure.
+ * This structure is a list of requests.
+ */
+typedef struct dwc_otg_pcd_request {
+	void *priv;
+	void *buf;
+	dwc_dma_t dma;
+	uint32_t length;
+	uint32_t actual;
+	unsigned sent_zlp:1;
+    /**
+     * Used instead of original buffer if
+     * it(physical address) is not dword-aligned.
+     **/
+     uint8_t *dw_align_buf;
+     dwc_dma_t dw_align_buf_dma;
+
+	 DWC_CIRCLEQ_ENTRY(dwc_otg_pcd_request) queue_entry;
+#ifdef DWC_UTE_PER_IO
+	struct dwc_iso_xreq_port ext_req;
+	//void *priv_ereq_nport; /*  */
+#endif
+} dwc_otg_pcd_request_t;
+
+DWC_CIRCLEQ_HEAD(req_list, dwc_otg_pcd_request);
+
+/**	  PCD EP structure.
+ * This structure describes an EP, there is an array of EPs in the PCD
+ * structure.
+ */
+typedef struct dwc_otg_pcd_ep {
+	/** USB EP Descriptor */
+	const usb_endpoint_descriptor_t *desc;
+
+	/** queue of dwc_otg_pcd_requests. */
+	struct req_list queue;
+	unsigned stopped:1;
+	unsigned disabling:1;
+	unsigned dma:1;
+	unsigned queue_sof:1;
+
+#ifdef DWC_EN_ISOC
+	/** ISOC req handle passed */
+	void *iso_req_handle;
+#endif				//_EN_ISOC_
+
+	/** DWC_otg ep data. */
+	dwc_ep_t dwc_ep;
+
+	/** Pointer to PCD */
+	struct dwc_otg_pcd *pcd;
+
+	void *priv;
+} dwc_otg_pcd_ep_t;
+
+/** DWC_otg PCD Structure.
+ * This structure encapsulates the data for the dwc_otg PCD.
+ */
+struct dwc_otg_pcd {
+	const struct dwc_otg_pcd_function_ops *fops;
+	/** The DWC otg device pointer */
+	struct dwc_otg_device *otg_dev;
+	/** Core Interface */
+	dwc_otg_core_if_t *core_if;
+	/** State of EP0 */
+	ep0state_e ep0state;
+	/** EP0 Request is pending */
+	unsigned ep0_pending:1;
+	/** Indicates when SET CONFIGURATION Request is in process */
+	unsigned request_config:1;
+	/** The state of the Remote Wakeup Enable. */
+	unsigned remote_wakeup_enable:1;
+	/** The state of the B-Device HNP Enable. */
+	unsigned b_hnp_enable:1;
+	/** The state of A-Device HNP Support. */
+	unsigned a_hnp_support:1;
+	/** The state of the A-Device Alt HNP support. */
+	unsigned a_alt_hnp_support:1;
+	/** Count of pending Requests */
+	unsigned request_pending;
+
+	/** SETUP packet for EP0
+	 * This structure is allocated as a DMA buffer on PCD initialization
+	 * with enough space for up to 3 setup packets.
+	 */
+	union {
+		usb_device_request_t req;
+		uint32_t d32[2];
+	} *setup_pkt;
+
+	dwc_dma_t setup_pkt_dma_handle;
+
+	/* Additional buffer and flag for CTRL_WR premature case */
+	uint8_t *backup_buf;
+	unsigned data_terminated;
+
+	/** 2-byte dma buffer used to return status from GET_STATUS */
+	uint16_t *status_buf;
+	dwc_dma_t status_buf_dma_handle;
+
+	/** EP0 */
+	dwc_otg_pcd_ep_t ep0;
+
+	/** Array of IN EPs. */
+	dwc_otg_pcd_ep_t in_ep[MAX_EPS_CHANNELS - 1];
+	/** Array of OUT EPs. */
+	dwc_otg_pcd_ep_t out_ep[MAX_EPS_CHANNELS - 1];
+	/** number of valid EPs in the above array. */
+//        unsigned      num_eps : 4;
+	dwc_spinlock_t *lock;
+
+	/** Tasklet to defer starting of TEST mode transmissions until
+	 *	Status Phase has been completed.
+	 */
+	dwc_tasklet_t *test_mode_tasklet;
+
+	/** Tasklet to delay starting of xfer in DMA mode */
+	dwc_tasklet_t *start_xfer_tasklet;
+
+	/** The test mode to enter when the tasklet is executed. */
+	unsigned test_mode;
+	/** The cfi_api structure that implements most of the CFI API
+	 * and OTG specific core configuration functionality
+	 */
+#ifdef DWC_UTE_CFI
+	struct cfiobject *cfi;
+#endif
+
+};
+
+static inline struct device *dwc_otg_pcd_to_dev(struct dwc_otg_pcd *pcd)
+{
+	return &pcd->otg_dev->os_dep.platformdev->dev;
+}
+
+//FIXME this functions should be static, and this prototypes should be removed
+extern void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep);
+extern void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep,
+				 dwc_otg_pcd_request_t * req, int32_t status);
+
+void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
+			     void *req_handle);
+
+extern void do_test_mode(void *data);
+#endif
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h b/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
new file mode 100644
index 0000000000000..4c1d591fbc098
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
@@ -0,0 +1,361 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_if.h $
+ * $Revision: #11 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+#if !defined(__DWC_PCD_IF_H__)
+#define __DWC_PCD_IF_H__
+
+//#include "dwc_os.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_driver.h"
+
+/** @file
+ * This file defines DWC_OTG PCD Core API.
+ */
+
+struct dwc_otg_pcd;
+typedef struct dwc_otg_pcd dwc_otg_pcd_t;
+
+/** Maxpacket size for EP0 */
+#define MAX_EP0_SIZE	64
+/** Maxpacket size for any EP */
+#define MAX_PACKET_SIZE 1024
+
+/** @name Function Driver Callbacks */
+/** @{ */
+
+/** This function will be called whenever a previously queued request has
+ * completed.  The status value will be set to -DWC_E_SHUTDOWN to indicated a
+ * failed or aborted transfer, or -DWC_E_RESTART to indicate the device was reset,
+ * or -DWC_E_TIMEOUT to indicate it timed out, or -DWC_E_INVALID to indicate invalid
+ * parameters. */
+typedef int (*dwc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
+				    void *req_handle, int32_t status,
+				    uint32_t actual);
+/**
+ * This function will be called whenever a previousle queued ISOC request has
+ * completed. Count of ISOC packets could be read using dwc_otg_pcd_get_iso_packet_count
+ * function.
+ * The status of each ISOC packet could be read using dwc_otg_pcd_get_iso_packet_*
+ * functions.
+ */
+typedef int (*dwc_isoc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
+					 void *req_handle, int proc_buf_num);
+/** This function should handle any SETUP request that cannot be handled by the
+ * PCD Core.  This includes most GET_DESCRIPTORs, SET_CONFIGS, Any
+ * class-specific requests, etc.  The function must non-blocking.
+ *
+ * Returns 0 on success.
+ * Returns -DWC_E_NOT_SUPPORTED if the request is not supported.
+ * Returns -DWC_E_INVALID if the setup request had invalid parameters or bytes.
+ * Returns -DWC_E_SHUTDOWN on any other error. */
+typedef int (*dwc_setup_cb_t) (dwc_otg_pcd_t * pcd, uint8_t * bytes);
+/** This is called whenever the device has been disconnected.  The function
+ * driver should take appropriate action to clean up all pending requests in the
+ * PCD Core, remove all endpoints (except ep0), and initialize back to reset
+ * state. */
+typedef int (*dwc_disconnect_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called when device has been connected. */
+typedef int (*dwc_connect_cb_t) (dwc_otg_pcd_t * pcd, int speed);
+/** This function is called when device has been suspended */
+typedef int (*dwc_suspend_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called when device has received LPM tokens, i.e.
+ * device has been sent to sleep state. */
+typedef int (*dwc_sleep_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called when device has been resumed
+ * from suspend(L2) or L1 sleep state. */
+typedef int (*dwc_resume_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called whenever hnp params has been changed.
+ * User can call get_b_hnp_enable, get_a_hnp_support, get_a_alt_hnp_support functions
+ * to get hnp parameters. */
+typedef int (*dwc_hnp_params_changed_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called whenever USB RESET is detected. */
+typedef int (*dwc_reset_cb_t) (dwc_otg_pcd_t * pcd);
+
+typedef int (*cfi_setup_cb_t) (dwc_otg_pcd_t * pcd, void *ctrl_req_bytes);
+
+/**
+ *
+ * @param ep_handle	Void pointer to the usb_ep structure
+ * @param ereq_port Pointer to the extended request structure created in the
+ *					portable part.
+ */
+typedef int (*xiso_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
+				     void *req_handle, int32_t status,
+				     void *ereq_port);
+/** Function Driver Ops Data Structure */
+struct dwc_otg_pcd_function_ops {
+	dwc_connect_cb_t connect;
+	dwc_disconnect_cb_t disconnect;
+	dwc_setup_cb_t setup;
+	dwc_completion_cb_t complete;
+	dwc_isoc_completion_cb_t isoc_complete;
+	dwc_suspend_cb_t suspend;
+	dwc_sleep_cb_t sleep;
+	dwc_resume_cb_t resume;
+	dwc_reset_cb_t reset;
+	dwc_hnp_params_changed_cb_t hnp_changed;
+	cfi_setup_cb_t cfi_setup;
+#ifdef DWC_UTE_PER_IO
+	xiso_completion_cb_t xisoc_complete;
+#endif
+};
+/** @} */
+
+/** @name Function Driver Functions */
+/** @{ */
+
+/** Call this function to get pointer on dwc_otg_pcd_t,
+ * this pointer will be used for all PCD API functions.
+ *
+ * @param core_if The DWC_OTG Core
+ */
+extern dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev);
+
+/** Frees PCD allocated by dwc_otg_pcd_init
+ *
+ * @param pcd The PCD
+ */
+extern void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd);
+
+/** Call this to bind the function driver to the PCD Core.
+ *
+ * @param pcd Pointer on dwc_otg_pcd_t returned by dwc_otg_pcd_init function.
+ * @param fops The Function Driver Ops data structure containing pointers to all callbacks.
+ */
+extern void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
+			      const struct dwc_otg_pcd_function_ops *fops);
+
+/** Enables an endpoint for use.  This function enables an endpoint in
+ * the PCD.  The endpoint is described by the ep_desc which has the
+ * same format as a USB ep descriptor.  The ep_handle parameter is used to refer
+ * to the endpoint from other API functions and in callbacks.  Normally this
+ * should be called after a SET_CONFIGURATION/SET_INTERFACE to configure the
+ * core for that interface.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns 0 on success.
+ *
+ * @param pcd The PCD
+ * @param ep_desc Endpoint descriptor
+ * @param usb_ep Handle on endpoint, that will be used to identify endpoint.
+ */
+extern int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
+				 const uint8_t * ep_desc, void *usb_ep);
+
+/** Disable the endpoint referenced by ep_handle.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error occurred.
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle);
+
+/** Queue a data transfer request on the endpoint referenced by ep_handle.
+ * After the transfer is completes, the complete callback will be called with
+ * the request status.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param buf The buffer for the data
+ * @param dma_buf The DMA buffer for the data
+ * @param buflen The length of the data transfer
+ * @param zero Specifies whether to send zero length last packet.
+ * @param req_handle Set this handle to any value to use to reference this
+ * request in the ep_dequeue function or from the complete callback
+ * @param atomic_alloc If driver need to perform atomic allocations
+ * for internal data structures.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+				uint8_t * buf, dwc_dma_t dma_buf,
+				uint32_t buflen, int zero, void *req_handle,
+				int atomic_alloc);
+#ifdef DWC_UTE_PER_IO
+/**
+ *
+ * @param ereq_nonport	Pointer to the extended request part of the
+ *						usb_request structure defined in usb_gadget.h file.
+ */
+extern int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+				     uint8_t * buf, dwc_dma_t dma_buf,
+				     uint32_t buflen, int zero,
+				     void *req_handle, int atomic_alloc,
+				     void *ereq_nonport);
+
+#endif
+
+/** De-queue the specified data transfer that has not yet completed.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
+				  void *req_handle);
+
+/** Halt (STALL) an endpoint or clear it.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns -DWC_E_AGAIN if the STALL cannot be sent and must be tried again later
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value);
+
+/** This function */
+extern int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle);
+
+/** This function should be called on every hardware interrupt */
+extern int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd);
+
+/** This function returns current frame number */
+extern int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd);
+
+/**
+ * Start isochronous transfers on the endpoint referenced by ep_handle.
+ * For isochronous transfers duble buffering is used.
+ * After processing each of buffers comlete callback will be called with
+ * status for each transaction.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param buf0 The virtual address of first data buffer
+ * @param buf1 The virtual address of second data buffer
+ * @param dma0 The DMA address of first data buffer
+ * @param dma1 The DMA address of second data buffer
+ * @param sync_frame Data pattern frame number
+ * @param dp_frame Data size for pattern frame
+ * @param data_per_frame Data size for regular frame
+ * @param start_frame Frame number to start transfers, if -1 then start transfers ASAP.
+ * @param buf_proc_intrvl Interval of ISOC Buffer processing
+ * @param req_handle Handle of ISOC request
+ * @param atomic_alloc Specefies whether to perform atomic allocation for
+ * 			internal data structures.
+ *
+ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
+ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function.
+ * Returns -DW_E_SHUTDOWN for any other error.
+ * Returns 0 on success
+ */
+extern int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
+				    uint8_t * buf0, uint8_t * buf1,
+				    dwc_dma_t dma0, dwc_dma_t dma1,
+				    int sync_frame, int dp_frame,
+				    int data_per_frame, int start_frame,
+				    int buf_proc_intrvl, void *req_handle,
+				    int atomic_alloc);
+
+/** Stop ISOC transfers on endpoint referenced by ep_handle.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param req_handle Handle of ISOC request
+ *
+ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function
+ * Returns 0 on success
+ */
+int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
+			    void *req_handle);
+
+/** Get ISOC packet status.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param iso_req_handle Isochronoush request handle
+ * @param packet Number of packet
+ * @param status Out parameter for returning status
+ * @param actual Out parameter for returning actual length
+ * @param offset Out parameter for returning offset
+ *
+ */
+extern void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd,
+					      void *ep_handle,
+					      void *iso_req_handle, int packet,
+					      int *status, int *actual,
+					      int *offset);
+
+/** Get ISOC packet count.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param iso_req_handle
+ */
+extern int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd,
+					    void *ep_handle,
+					    void *iso_req_handle);
+
+/** This function starts the SRP Protocol if no session is in progress. If
+ * a session is already in progress, but the device is suspended,
+ * remote wakeup signaling is started.
+ */
+extern int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd);
+
+/** This function returns 1 if LPM support is enabled, and 0 otherwise. */
+extern int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd);
+
+/** This function returns 1 if remote wakeup is allowed and 0, otherwise. */
+extern int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd);
+
+/** Initiate SRP */
+extern void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd);
+
+/** Starts remote wakeup signaling. */
+extern void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set);
+
+/** Starts micorsecond soft disconnect. */
+extern void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs);
+/** This function returns whether device is dualspeed.*/
+extern uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd);
+
+/** This function returns whether device is otg. */
+extern uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd);
+
+/** These functions allow to get hnp parameters */
+extern uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd);
+extern uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd);
+extern uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd);
+
+/** CFI specific Interface functions */
+/** Allocate a cfi buffer */
+extern uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep,
+				     dwc_dma_t * addr, size_t buflen,
+				     int flags);
+
+/******************************************************************************/
+
+/** @} */
+
+#endif				/* __DWC_PCD_IF_H__ */
+
+#endif				/* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
new file mode 100644
index 0000000000000..e55ea9c74be46
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
@@ -0,0 +1,5148 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_intr.c $
+ * $Revision: #116 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+#include "dwc_otg_pcd.h"
+
+#ifdef DWC_UTE_CFI
+#include "dwc_otg_cfi.h"
+#endif
+
+#ifdef DWC_UTE_PER_IO
+extern void complete_xiso_ep(dwc_otg_pcd_ep_t * ep);
+#endif
+//#define PRINT_CFI_DMA_DESCS
+
+#define DEBUG_EP0
+
+/**
+ * This function updates OTG.
+ */
+static void dwc_otg_pcd_update_otg(dwc_otg_pcd_t * pcd, const unsigned reset)
+{
+
+	if (reset) {
+		pcd->b_hnp_enable = 0;
+		pcd->a_hnp_support = 0;
+		pcd->a_alt_hnp_support = 0;
+	}
+
+	if (pcd->fops->hnp_changed) {
+		pcd->fops->hnp_changed(pcd);
+	}
+}
+
+/** @file
+ * This file contains the implementation of the PCD Interrupt handlers.
+ *
+ * The PCD handles the device interrupts.  Many conditions can cause a
+ * device interrupt. When an interrupt occurs, the device interrupt
+ * service routine determines the cause of the interrupt and
+ * dispatches handling to the appropriate function. These interrupt
+ * handling functions are described below.
+ * All interrupt registers are processed from LSB to MSB.
+ */
+
+/**
+ * This function prints the ep0 state for debug purposes.
+ */
+static inline void print_ep0_state(dwc_otg_pcd_t * pcd)
+{
+#ifdef DEBUG
+	char str[40];
+
+	switch (pcd->ep0state) {
+	case EP0_DISCONNECT:
+		dwc_strcpy(str, "EP0_DISCONNECT");
+		break;
+	case EP0_IDLE:
+		dwc_strcpy(str, "EP0_IDLE");
+		break;
+	case EP0_IN_DATA_PHASE:
+		dwc_strcpy(str, "EP0_IN_DATA_PHASE");
+		break;
+	case EP0_OUT_DATA_PHASE:
+		dwc_strcpy(str, "EP0_OUT_DATA_PHASE");
+		break;
+	case EP0_IN_STATUS_PHASE:
+		dwc_strcpy(str, "EP0_IN_STATUS_PHASE");
+		break;
+	case EP0_OUT_STATUS_PHASE:
+		dwc_strcpy(str, "EP0_OUT_STATUS_PHASE");
+		break;
+	case EP0_STALL:
+		dwc_strcpy(str, "EP0_STALL");
+		break;
+	default:
+		dwc_strcpy(str, "EP0_INVALID");
+	}
+
+	DWC_DEBUGPL(DBG_ANY, "%s(%d)\n", str, pcd->ep0state);
+#endif
+}
+
+/**
+ * This function calculate the size of the payload in the memory
+ * for out endpoints and prints size for debug purposes(used in
+ * 2.93a DevOutNak feature).
+ */
+static inline void print_memory_payload(dwc_otg_pcd_t * pcd,  dwc_ep_t * ep)
+{
+#ifdef DEBUG
+	deptsiz_data_t deptsiz_init = {.d32 = 0 };
+	deptsiz_data_t deptsiz_updt = {.d32 = 0 };
+	int pack_num;
+	unsigned payload;
+
+	deptsiz_init.d32 = pcd->core_if->start_doeptsiz_val[ep->num];
+	deptsiz_updt.d32 =
+		DWC_READ_REG32(&pcd->core_if->dev_if->
+						out_ep_regs[ep->num]->doeptsiz);
+	/* Payload will be */
+	payload = deptsiz_init.b.xfersize - deptsiz_updt.b.xfersize;
+	/* Packet count is decremented every time a packet
+	 * is written to the RxFIFO not in to the external memory
+	 * So, if payload == 0, then it means no packet was sent to ext memory*/
+	pack_num = (!payload) ? 0 : (deptsiz_init.b.pktcnt - deptsiz_updt.b.pktcnt);
+	DWC_DEBUGPL(DBG_PCDV,
+		"Payload for EP%d-%s\n",
+		ep->num, (ep->is_in ? "IN" : "OUT"));
+	DWC_DEBUGPL(DBG_PCDV,
+		"Number of transfered bytes = 0x%08x\n", payload);
+	DWC_DEBUGPL(DBG_PCDV,
+		"Number of transfered packets = %d\n", pack_num);
+#endif
+}
+
+
+#ifdef DWC_UTE_CFI
+static inline void print_desc(struct dwc_otg_dma_desc *ddesc,
+			      const uint8_t * epname, int descnum)
+{
+	CFI_INFO
+	    ("%s DMA_DESC(%d) buf=0x%08x bytes=0x%04x; sp=0x%x; l=0x%x; sts=0x%02x; bs=0x%02x\n",
+	     epname, descnum, ddesc->buf, ddesc->status.b.bytes,
+	     ddesc->status.b.sp, ddesc->status.b.l, ddesc->status.b.sts,
+	     ddesc->status.b.bs);
+}
+#endif
+
+/**
+ * This function returns pointer to in ep struct with number ep_num
+ */
+static inline dwc_otg_pcd_ep_t *get_in_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
+{
+	int i;
+	int num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
+	if (ep_num == 0) {
+		return &pcd->ep0;
+	} else {
+		for (i = 0; i < num_in_eps; ++i) {
+			if (pcd->in_ep[i].dwc_ep.num == ep_num)
+				return &pcd->in_ep[i];
+		}
+		return 0;
+	}
+}
+
+/**
+ * This function returns pointer to out ep struct with number ep_num
+ */
+static inline dwc_otg_pcd_ep_t *get_out_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
+{
+	int i;
+	int num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
+	if (ep_num == 0) {
+		return &pcd->ep0;
+	} else {
+		for (i = 0; i < num_out_eps; ++i) {
+			if (pcd->out_ep[i].dwc_ep.num == ep_num)
+				return &pcd->out_ep[i];
+		}
+		return 0;
+	}
+}
+
+/**
+ * This functions gets a pointer to an EP from the wIndex address
+ * value of the control request.
+ */
+dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex)
+{
+	dwc_otg_pcd_ep_t *ep;
+	uint32_t ep_num = UE_GET_ADDR(wIndex);
+
+	if (ep_num == 0) {
+		ep = &pcd->ep0;
+	} else if (UE_GET_DIR(wIndex) == UE_DIR_IN) {	/* in ep */
+		ep = &pcd->in_ep[ep_num - 1];
+	} else {
+		ep = &pcd->out_ep[ep_num - 1];
+	}
+
+	return ep;
+}
+
+/**
+ * This function checks the EP request queue, if the queue is not
+ * empty the next request is started.
+ */
+void start_next_request(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_pcd_request_t *req = 0;
+	uint32_t max_transfer =
+	    GET_CORE_IF(ep->pcd)->core_params->max_transfer_size;
+
+#ifdef DWC_UTE_CFI
+	struct dwc_otg_pcd *pcd;
+	pcd = ep->pcd;
+#endif
+
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+
+#ifdef DWC_UTE_CFI
+		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+			ep->dwc_ep.cfi_req_len = req->length;
+			pcd->cfi->ops.build_descriptors(pcd->cfi, pcd, ep, req);
+		} else {
+#endif
+			/* Setup and start the Transfer */
+			if (req->dw_align_buf) {
+				ep->dwc_ep.dma_addr = req->dw_align_buf_dma;
+				ep->dwc_ep.start_xfer_buff = req->dw_align_buf;
+				ep->dwc_ep.xfer_buff = req->dw_align_buf;
+			} else {
+				ep->dwc_ep.dma_addr = req->dma;
+				ep->dwc_ep.start_xfer_buff = req->buf;
+				ep->dwc_ep.xfer_buff = req->buf;
+			}
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = req->length;
+			ep->dwc_ep.xfer_len = 0;
+			ep->dwc_ep.xfer_count = 0;
+
+			ep->dwc_ep.maxxfer = max_transfer;
+			if (GET_CORE_IF(ep->pcd)->dma_desc_enable) {
+				uint32_t out_max_xfer = DDMA_MAX_TRANSFER_SIZE
+				    - (DDMA_MAX_TRANSFER_SIZE % 4);
+				if (ep->dwc_ep.is_in) {
+					if (ep->dwc_ep.maxxfer >
+					    DDMA_MAX_TRANSFER_SIZE) {
+						ep->dwc_ep.maxxfer =
+						    DDMA_MAX_TRANSFER_SIZE;
+					}
+				} else {
+					if (ep->dwc_ep.maxxfer > out_max_xfer) {
+						ep->dwc_ep.maxxfer =
+						    out_max_xfer;
+					}
+				}
+			}
+			if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
+				ep->dwc_ep.maxxfer -=
+				    (ep->dwc_ep.maxxfer % ep->dwc_ep.maxpacket);
+			}
+			if (req->sent_zlp) {
+				if ((ep->dwc_ep.total_len %
+				     ep->dwc_ep.maxpacket == 0)
+				    && (ep->dwc_ep.total_len != 0)) {
+					ep->dwc_ep.sent_zlp = 1;
+				}
+
+			}
+#ifdef DWC_UTE_CFI
+		}
+#endif
+		dwc_otg_ep_start_transfer(GET_CORE_IF(ep->pcd), &ep->dwc_ep);
+	} else if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		DWC_PRINTF("There are no more ISOC requests \n");
+		ep->dwc_ep.frame_num = 0xFFFFFFFF;
+	}
+}
+
+/**
+ * This function handles the SOF Interrupts. At this time the SOF
+ * Interrupt is disabled.
+ */
+int32_t dwc_otg_pcd_handle_sof_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	gintsts_data_t gintsts;
+
+	DWC_DEBUGPL(DBG_PCD, "SOF\n");
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.sofintr = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This function handles the Rx Status Queue Level Interrupt, which
+ * indicates that there is a least one packet in the Rx FIFO.  The
+ * packets are moved from the FIFO to memory, where they will be
+ * processed when the Endpoint Interrupt Register indicates Transfer
+ * Complete or SETUP Phase Done.
+ *
+ * Repeat the following until the Rx Status Queue is empty:
+ *	 -# Read the Receive Status Pop Register (GRXSTSP) to get Packet
+ *		info
+ *	 -# If Receive FIFO is empty then skip to step Clear the interrupt
+ *		and exit
+ *	 -# If SETUP Packet call dwc_otg_read_setup_packet to copy the
+ *		SETUP data to the buffer
+ *	 -# If OUT Data Packet call dwc_otg_read_packet to copy the data
+ *		to the destination buffer
+ */
+int32_t dwc_otg_pcd_handle_rx_status_q_level_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t gintmask = {.d32 = 0 };
+	device_grxsts_data_t status;
+	dwc_otg_pcd_ep_t *ep;
+	gintsts_data_t gintsts;
+#ifdef DEBUG
+	static char *dpid_str[] = { "D0", "D2", "D1", "MDATA" };
+#endif
+
+	//DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, _pcd);
+	/* Disable the Rx Status Queue Level interrupt */
+	gintmask.b.rxstsqlvl = 1;
+	DWC_MODIFY_REG32(&global_regs->gintmsk, gintmask.d32, 0);
+
+	/* Get the Status from the top of the FIFO */
+	status.d32 = DWC_READ_REG32(&global_regs->grxstsp);
+
+	DWC_DEBUGPL(DBG_PCD, "EP:%d BCnt:%d DPID:%s "
+		    "pktsts:%x Frame:%d(0x%0x)\n",
+		    status.b.epnum, status.b.bcnt,
+		    dpid_str[status.b.dpid],
+		    status.b.pktsts, status.b.fn, status.b.fn);
+	/* Get pointer to EP structure */
+	ep = get_out_ep(pcd, status.b.epnum);
+
+	switch (status.b.pktsts) {
+	case DWC_DSTS_GOUT_NAK:
+		DWC_DEBUGPL(DBG_PCDV, "Global OUT NAK\n");
+		break;
+	case DWC_STS_DATA_UPDT:
+		DWC_DEBUGPL(DBG_PCDV, "OUT Data Packet\n");
+		if (status.b.bcnt && ep->dwc_ep.xfer_buff) {
+			/** @todo NGS Check for buffer overflow? */
+			dwc_otg_read_packet(core_if,
+					    ep->dwc_ep.xfer_buff,
+					    status.b.bcnt);
+			ep->dwc_ep.xfer_count += status.b.bcnt;
+			ep->dwc_ep.xfer_buff += status.b.bcnt;
+		}
+		break;
+	case DWC_STS_XFER_COMP:
+		DWC_DEBUGPL(DBG_PCDV, "OUT Complete\n");
+		break;
+	case DWC_DSTS_SETUP_COMP:
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCDV, "Setup Complete\n");
+#endif
+		break;
+	case DWC_DSTS_SETUP_UPDT:
+		dwc_otg_read_setup_packet(core_if, pcd->setup_pkt->d32);
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCD,
+			    "SETUP PKT: %02x.%02x v%04x i%04x l%04x\n",
+			    pcd->setup_pkt->req.bmRequestType,
+			    pcd->setup_pkt->req.bRequest,
+			    UGETW(pcd->setup_pkt->req.wValue),
+			    UGETW(pcd->setup_pkt->req.wIndex),
+			    UGETW(pcd->setup_pkt->req.wLength));
+#endif
+		ep->dwc_ep.xfer_count += status.b.bcnt;
+		break;
+	default:
+		DWC_DEBUGPL(DBG_PCDV, "Invalid Packet Status (0x%0x)\n",
+			    status.b.pktsts);
+		break;
+	}
+
+	/* Enable the Rx Status Queue Level interrupt */
+	DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmask.d32);
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.rxstsqlvl = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	//DWC_DEBUGPL(DBG_PCDV, "EXIT: %s\n", __func__);
+	return 1;
+}
+
+/**
+ * This function examines the Device IN Token Learning Queue to
+ * determine the EP number of the last IN token received.  This
+ * implementation is for the Mass Storage device where there are only
+ * 2 IN EPs (Control-IN and BULK-IN).
+ *
+ * The EP numbers for the first six IN Tokens are in DTKNQR1 and there
+ * are 8 EP Numbers in each of the other possible DTKNQ Registers.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ *
+ */
+static inline int get_ep_of_last_in_token(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_device_global_regs_t *dev_global_regs =
+	    core_if->dev_if->dev_global_regs;
+	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
+	/* Number of Token Queue Registers */
+	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
+	dtknq1_data_t dtknqr1;
+	uint32_t in_tkn_epnums[4];
+	int ndx = 0;
+	int i = 0;
+	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
+	int epnum = 0;
+
+	//DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
+
+	/* Read the DTKNQ Registers */
+	for (i = 0; i < DTKNQ_REG_CNT; i++) {
+		in_tkn_epnums[i] = DWC_READ_REG32(addr);
+		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
+			    in_tkn_epnums[i]);
+		if (addr == &dev_global_regs->dvbusdis) {
+			addr = &dev_global_regs->dtknqr3_dthrctl;
+		} else {
+			++addr;
+		}
+
+	}
+
+	/* Copy the DTKNQR1 data to the bit field. */
+	dtknqr1.d32 = in_tkn_epnums[0];
+	/* Get the EP numbers */
+	in_tkn_epnums[0] = dtknqr1.b.epnums0_5;
+	ndx = dtknqr1.b.intknwptr - 1;
+
+	//DWC_DEBUGPL(DBG_PCDV,"ndx=%d\n",ndx);
+	if (ndx == -1) {
+		/** @todo Find a simpler way to calculate the max
+		 * queue position.*/
+		int cnt = TOKEN_Q_DEPTH;
+		if (TOKEN_Q_DEPTH <= 6) {
+			cnt = TOKEN_Q_DEPTH - 1;
+		} else if (TOKEN_Q_DEPTH <= 14) {
+			cnt = TOKEN_Q_DEPTH - 7;
+		} else if (TOKEN_Q_DEPTH <= 22) {
+			cnt = TOKEN_Q_DEPTH - 15;
+		} else {
+			cnt = TOKEN_Q_DEPTH - 23;
+		}
+		epnum = (in_tkn_epnums[DTKNQ_REG_CNT - 1] >> (cnt * 4)) & 0xF;
+	} else {
+		if (ndx <= 5) {
+			epnum = (in_tkn_epnums[0] >> (ndx * 4)) & 0xF;
+		} else if (ndx <= 13) {
+			ndx -= 6;
+			epnum = (in_tkn_epnums[1] >> (ndx * 4)) & 0xF;
+		} else if (ndx <= 21) {
+			ndx -= 14;
+			epnum = (in_tkn_epnums[2] >> (ndx * 4)) & 0xF;
+		} else if (ndx <= 29) {
+			ndx -= 22;
+			epnum = (in_tkn_epnums[3] >> (ndx * 4)) & 0xF;
+		}
+	}
+	//DWC_DEBUGPL(DBG_PCD,"epnum=%d\n",epnum);
+	return epnum;
+}
+
+/**
+ * This interrupt occurs when the non-periodic Tx FIFO is half-empty.
+ * The active request is checked for the next packet to be loaded into
+ * the non-periodic Tx FIFO.
+ */
+int32_t dwc_otg_pcd_handle_np_tx_fifo_empty_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	gnptxsts_data_t txstatus = {.d32 = 0 };
+	gintsts_data_t gintsts;
+
+	int epnum = 0;
+	dwc_otg_pcd_ep_t *ep = 0;
+	uint32_t len = 0;
+	int dwords;
+
+	/* Get the epnum from the IN Token Learning Queue. */
+	epnum = get_ep_of_last_in_token(core_if);
+	ep = get_in_ep(pcd, epnum);
+
+	DWC_DEBUGPL(DBG_PCD, "NP TxFifo Empty: %d \n", epnum);
+
+	ep_regs = core_if->dev_if->in_ep_regs[epnum];
+
+	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+	if (len > ep->dwc_ep.maxpacket) {
+		len = ep->dwc_ep.maxpacket;
+	}
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 GNPTXSTS=0x%08x\n", txstatus.d32);
+
+	while (txstatus.b.nptxqspcavail > 0 &&
+	       txstatus.b.nptxfspcavail > dwords &&
+	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
+		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+
+		if (len > ep->dwc_ep.maxpacket) {
+			len = ep->dwc_ep.maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+		DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n", txstatus.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n",
+		    DWC_READ_REG32(&global_regs->gnptxsts));
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.nptxfempty = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This function is called when dedicated Tx FIFO Empty interrupt occurs.
+ * The active request is checked for the next packet to be loaded into
+ * apropriate Tx FIFO.
+ */
+static int32_t write_empty_tx_fifo(dwc_otg_pcd_t * pcd, uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	dtxfsts_data_t txstatus = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep = 0;
+	uint32_t len = 0;
+	int dwords;
+
+	ep = get_in_ep(pcd, epnum);
+
+	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
+
+	ep_regs = core_if->dev_if->in_ep_regs[epnum];
+
+	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+
+	if (len > ep->dwc_ep.maxpacket) {
+		len = ep->dwc_ep.maxpacket;
+	}
+
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
+
+	while (txstatus.b.txfspcavail > dwords &&
+	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len &&
+	       ep->dwc_ep.xfer_len != 0) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
+
+		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+		if (len > ep->dwc_ep.maxpacket) {
+			len = ep->dwc_ep.maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 =
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
+			    txstatus.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
+
+	return 1;
+}
+
+/**
+ * This function is called when the Device is disconnected. It stops
+ * any active requests and informs the Gadget driver of the
+ * disconnect.
+ */
+void dwc_otg_pcd_stop(dwc_otg_pcd_t * pcd)
+{
+	int i, num_in_eps, num_out_eps;
+	dwc_otg_pcd_ep_t *ep;
+
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_SPINLOCK(pcd->lock);
+
+	num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
+	num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s() \n", __func__);
+	/* don't disconnect drivers more than once */
+	if (pcd->ep0state == EP0_DISCONNECT) {
+		DWC_DEBUGPL(DBG_ANY, "%s() Already Disconnected\n", __func__);
+		DWC_SPINUNLOCK(pcd->lock);
+		return;
+	}
+	pcd->ep0state = EP0_DISCONNECT;
+
+	/* Reset the OTG state. */
+	dwc_otg_pcd_update_otg(pcd, 1);
+
+	/* Disable the NP Tx Fifo Empty Interrupt. */
+	intr_mask.b.nptxfempty = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Flush the FIFOs */
+	/**@todo NGS Flush Periodic FIFOs */
+	dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd), 0x10);
+	dwc_otg_flush_rx_fifo(GET_CORE_IF(pcd));
+
+	/* prevent new request submissions, kill any outstanding requests  */
+	ep = &pcd->ep0;
+	dwc_otg_request_nuke(ep);
+	/* prevent new request submissions, kill any outstanding requests  */
+	for (i = 0; i < num_in_eps; i++) {
+		dwc_otg_pcd_ep_t *ep = &pcd->in_ep[i];
+		dwc_otg_request_nuke(ep);
+	}
+	/* prevent new request submissions, kill any outstanding requests  */
+	for (i = 0; i < num_out_eps; i++) {
+		dwc_otg_pcd_ep_t *ep = &pcd->out_ep[i];
+		dwc_otg_request_nuke(ep);
+	}
+
+	/* report disconnect; the driver is already quiesced */
+	if (pcd->fops->disconnect) {
+		DWC_SPINUNLOCK(pcd->lock);
+		pcd->fops->disconnect(pcd);
+		DWC_SPINLOCK(pcd->lock);
+	}
+	DWC_SPINUNLOCK(pcd->lock);
+}
+
+/**
+ * This interrupt indicates that ...
+ */
+int32_t dwc_otg_pcd_handle_i2c_intr(dwc_otg_pcd_t * pcd)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "i2cintr");
+	intr_mask.b.i2cintr = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.i2cintr = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+	return 1;
+}
+
+/**
+ * This interrupt indicates that ...
+ */
+int32_t dwc_otg_pcd_handle_early_suspend_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+#if defined(VERBOSE)
+	DWC_PRINTF("Early Suspend Detected\n");
+#endif
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.erlysuspend = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+	return 1;
+}
+
+/**
+ * This function configures EPO to receive SETUP packets.
+ *
+ * @todo NGS: Update the comments from the HW FS.
+ *
+ *	-# Program the following fields in the endpoint specific registers
+ *	for Control OUT EP 0, in order to receive a setup packet
+ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
+ *	  setup packets)
+ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
+ *	  to back setup packets)
+ *		- In DMA mode, DOEPDMA0 Register with a memory address to
+ *		  store any setup packets received
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param pcd	  Programming view of the PCD.
+ */
+static inline void ep0_out_start(dwc_otg_core_if_t * core_if,
+				 dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	depctl_data_t doepctl = {.d32 = 0 };
+
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_PCDV, "%s() doepctl0=%0x\n", __func__,
+		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
+#endif
+	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
+		if (doepctl.b.epena) {
+			return;
+		}
+	}
+
+	doeptsize0.b.supcnt = 3;
+	doeptsize0.b.pktcnt = 1;
+	doeptsize0.b.xfersize = 8 * 3;
+
+	if (core_if->dma_enable) {
+		if (!core_if->dma_desc_enable) {
+			/** put here as for Hermes mode deptisz register should not be written */
+			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
+					doeptsize0.d32);
+
+			/** @todo dma needs to handle multiple setup packets (up to 3) */
+			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
+					pcd->setup_pkt_dma_handle);
+		} else {
+			dev_if->setup_desc_index =
+			    (dev_if->setup_desc_index + 1) & 1;
+			dma_desc =
+			    dev_if->setup_desc_addr[dev_if->setup_desc_index];
+
+			/** DMA Descriptor Setup */
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+				dma_desc->status.b.sr = 0;
+				dma_desc->status.b.mtrf = 0;
+			}
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			dma_desc->status.b.bytes = pcd->ep0.dwc_ep.maxpacket;
+			dma_desc->buf = pcd->setup_pkt_dma_handle;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			/** DOEPDMA0 Register write */
+			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
+					dev_if->dma_setup_desc_addr
+					[dev_if->setup_desc_index]);
+		}
+
+	} else {
+		/** put here as for Hermes mode deptisz register should not be written */
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
+				doeptsize0.d32);
+	}
+
+	/** DOEPCTL0 Register write cnak will be set after setup interrupt */
+	doepctl.d32 = 0;
+	doepctl.b.epena = 1;
+	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
+	doepctl.b.cnak = 1;
+	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
+	} else {
+		DWC_MODIFY_REG32(&dev_if->out_ep_regs[0]->doepctl, 0, doepctl.d32);
+	}
+
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
+	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
+#endif
+}
+
+/**
+ * This interrupt occurs when a USB Reset is detected. When the USB
+ * Reset Interrupt occurs the device state is set to DEFAULT and the
+ * EP0 state is set to IDLE.
+ *	-#	Set the NAK bit for all OUT endpoints (DOEPCTLn.SNAK = 1)
+ *	-#	Unmask the following interrupt bits
+ *		- DAINTMSK.INEP0 = 1 (Control 0 IN endpoint)
+ *	- DAINTMSK.OUTEP0 = 1 (Control 0 OUT endpoint)
+ *	- DOEPMSK.SETUP = 1
+ *	- DOEPMSK.XferCompl = 1
+ *	- DIEPMSK.XferCompl = 1
+ *	- DIEPMSK.TimeOut = 1
+ *	-# Program the following fields in the endpoint specific registers
+ *	for Control OUT EP 0, in order to receive a setup packet
+ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
+ *	  setup packets)
+ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
+ *	  to back setup packets)
+ *		- In DMA mode, DOEPDMA0 Register with a memory address to
+ *		  store any setup packets received
+ * At this point, all the required initialization, except for enabling
+ * the control 0 OUT endpoint is done, for receiving SETUP packets.
+ */
+int32_t dwc_otg_pcd_handle_usb_reset_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	depctl_data_t doepctl = {.d32 = 0 };
+	depctl_data_t diepctl = {.d32 = 0 };
+	daint_data_t daintmsk = {.d32 = 0 };
+	doepmsk_data_t doepmsk = {.d32 = 0 };
+	diepmsk_data_t diepmsk = {.d32 = 0 };
+	dcfg_data_t dcfg = {.d32 = 0 };
+	grstctl_t resetctl = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+	int i = 0;
+	gintsts_data_t gintsts;
+	pcgcctl_data_t power = {.d32 = 0 };
+
+	power.d32 = DWC_READ_REG32(core_if->pcgcctl);
+	if (power.b.stoppclk) {
+		power.d32 = 0;
+		power.b.stoppclk = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
+
+		power.b.pwrclmp = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
+
+		power.b.rstpdwnmodule = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
+	}
+
+	core_if->lx_state = DWC_OTG_L0;
+
+	DWC_PRINTF("USB RESET\n");
+#ifdef DWC_EN_ISOC
+	for (i = 1; i < 16; ++i) {
+		dwc_otg_pcd_ep_t *ep;
+		dwc_ep_t *dwc_ep;
+		ep = get_in_ep(pcd, i);
+		if (ep != 0) {
+			dwc_ep = &ep->dwc_ep;
+			dwc_ep->next_frame = 0xffffffff;
+		}
+	}
+#endif /* DWC_EN_ISOC */
+
+	/* reset the HNP settings */
+	dwc_otg_pcd_update_otg(pcd, 1);
+
+	/* Clear the Remote Wakeup Signalling */
+	dctl.b.rmtwkupsig = 1;
+	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
+
+	/* Set NAK for all OUT EPs */
+	doepctl.b.snak = 1;
+	for (i = 0; i <= dev_if->num_out_eps; i++) {
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
+	}
+
+	/* Flush the NP Tx FIFO */
+	dwc_otg_flush_tx_fifo(core_if, 0x10);
+	/* Flush the Learning Queue */
+	resetctl.b.intknqflsh = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
+
+	if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
+		core_if->start_predict = 0;
+		for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
+			core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
+		}
+		core_if->nextep_seq[0] = 0;
+		core_if->first_in_nextep_seq = 0;
+		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
+		diepctl.b.nextep = 0;
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
+
+		/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
+		dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+		dcfg.b.epmscnt = 2;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+			__func__, core_if->first_in_nextep_seq);
+		for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+			DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
+		}
+	}
+
+	if (core_if->multiproc_int_enable) {
+		daintmsk.b.inep0 = 1;
+		daintmsk.b.outep0 = 1;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk,
+				daintmsk.d32);
+
+		doepmsk.b.setup = 1;
+		doepmsk.b.xfercompl = 1;
+		doepmsk.b.ahberr = 1;
+		doepmsk.b.epdisabled = 1;
+
+		if ((core_if->dma_desc_enable) ||
+		    (core_if->dma_enable
+		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
+			doepmsk.b.stsphsercvd = 1;
+		}
+		if (core_if->dma_desc_enable)
+			doepmsk.b.bna = 1;
+/*
+		doepmsk.b.babble = 1;
+		doepmsk.b.nyet = 1;
+
+		if (core_if->dma_enable) {
+			doepmsk.b.nak = 1;
+		}
+*/
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepeachintmsk[0],
+				doepmsk.d32);
+
+		diepmsk.b.xfercompl = 1;
+		diepmsk.b.timeout = 1;
+		diepmsk.b.epdisabled = 1;
+		diepmsk.b.ahberr = 1;
+		diepmsk.b.intknepmis = 1;
+		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
+			diepmsk.b.intknepmis = 0;
+
+/*		if (core_if->dma_desc_enable) {
+			diepmsk.b.bna = 1;
+		}
+*/
+/*
+		if (core_if->dma_enable) {
+			diepmsk.b.nak = 1;
+		}
+*/
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepeachintmsk[0],
+				diepmsk.d32);
+	} else {
+		daintmsk.b.inep0 = 1;
+		daintmsk.b.outep0 = 1;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk,
+				daintmsk.d32);
+
+		doepmsk.b.setup = 1;
+		doepmsk.b.xfercompl = 1;
+		doepmsk.b.ahberr = 1;
+		doepmsk.b.epdisabled = 1;
+
+		if ((core_if->dma_desc_enable) ||
+		    (core_if->dma_enable
+		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
+			doepmsk.b.stsphsercvd = 1;
+		}
+		if (core_if->dma_desc_enable)
+			doepmsk.b.bna = 1;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, doepmsk.d32);
+
+		diepmsk.b.xfercompl = 1;
+		diepmsk.b.timeout = 1;
+		diepmsk.b.epdisabled = 1;
+		diepmsk.b.ahberr = 1;
+		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
+			diepmsk.b.intknepmis = 0;
+/*
+		if (core_if->dma_desc_enable) {
+			diepmsk.b.bna = 1;
+		}
+*/
+
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, diepmsk.d32);
+	}
+
+	/* Reset Device Address */
+	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+	dcfg.b.devaddr = 0;
+	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+	/* setup EP0 to receive SETUP packets */
+	if (core_if->snpsid <= OTG_CORE_REV_2_94a)
+		ep0_out_start(core_if, pcd);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.usbreset = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * Get the device speed from the device status register and convert it
+ * to USB speed constant.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static int get_device_speed(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	int speed = 0;
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	switch (dsts.b.enumspd) {
+	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
+		speed = USB_SPEED_HIGH;
+		break;
+	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
+	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
+		speed = USB_SPEED_FULL;
+		break;
+
+	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
+		speed = USB_SPEED_LOW;
+		break;
+	}
+
+	return speed;
+}
+
+/**
+ * Read the device status register and set the device speed in the
+ * data structure.
+ * Set up EP0 to receive SETUP packets by calling dwc_ep0_activate.
+ */
+int32_t dwc_otg_pcd_handle_enum_done_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	gintsts_data_t gintsts;
+	gusbcfg_data_t gusbcfg;
+	dwc_otg_core_global_regs_t *global_regs =
+	    GET_CORE_IF(pcd)->core_global_regs;
+	uint8_t utmi16b, utmi8b;
+	int speed;
+	DWC_DEBUGPL(DBG_PCD, "SPEED ENUM\n");
+
+	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_2_60a) {
+		utmi16b = 6;	//vahrama old value was 6;
+		utmi8b = 9;
+	} else {
+		utmi16b = 4;
+		utmi8b = 8;
+	}
+	dwc_otg_ep0_activate(GET_CORE_IF(pcd), &ep0->dwc_ep);
+	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a) {
+		ep0_out_start(GET_CORE_IF(pcd), pcd);
+	}
+
+#ifdef DEBUG_EP0
+	print_ep0_state(pcd);
+#endif
+
+	if (pcd->ep0state == EP0_DISCONNECT) {
+		pcd->ep0state = EP0_IDLE;
+	} else if (pcd->ep0state == EP0_STALL) {
+		pcd->ep0state = EP0_IDLE;
+	}
+
+	pcd->ep0state = EP0_IDLE;
+
+	ep0->stopped = 0;
+
+	speed = get_device_speed(GET_CORE_IF(pcd));
+	pcd->fops->connect(pcd, speed);
+
+	/* Set USB turnaround time based on device speed and PHY interface. */
+	gusbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+	if (speed == USB_SPEED_HIGH) {
+		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
+		    DWC_HWCFG2_HS_PHY_TYPE_ULPI) {
+			/* ULPI interface */
+			gusbcfg.b.usbtrdtim = 9;
+		}
+		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
+		    DWC_HWCFG2_HS_PHY_TYPE_UTMI) {
+			/* UTMI+ interface */
+			if (GET_CORE_IF(pcd)->hwcfg4.b.utmi_phy_data_width == 0) {
+				gusbcfg.b.usbtrdtim = utmi8b;
+			} else if (GET_CORE_IF(pcd)->hwcfg4.
+				   b.utmi_phy_data_width == 1) {
+				gusbcfg.b.usbtrdtim = utmi16b;
+			} else if (GET_CORE_IF(pcd)->
+				   core_params->phy_utmi_width == 8) {
+				gusbcfg.b.usbtrdtim = utmi8b;
+			} else {
+				gusbcfg.b.usbtrdtim = utmi16b;
+			}
+		}
+		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
+		    DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI) {
+			/* UTMI+  OR  ULPI interface */
+			if (gusbcfg.b.ulpi_utmi_sel == 1) {
+				/* ULPI interface */
+				gusbcfg.b.usbtrdtim = 9;
+			} else {
+				/* UTMI+ interface */
+				if (GET_CORE_IF(pcd)->
+				    core_params->phy_utmi_width == 16) {
+					gusbcfg.b.usbtrdtim = utmi16b;
+				} else {
+					gusbcfg.b.usbtrdtim = utmi8b;
+				}
+			}
+		}
+	} else {
+		/* Full or low speed */
+		gusbcfg.b.usbtrdtim = 9;
+	}
+	DWC_WRITE_REG32(&global_regs->gusbcfg, gusbcfg.d32);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.enumdone = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+	return 1;
+}
+
+/**
+ * This interrupt indicates that the ISO OUT Packet was dropped due to
+ * Rx FIFO full or Rx Status Queue Full.  If this interrupt occurs
+ * read all the data from the Rx FIFO.
+ */
+int32_t dwc_otg_pcd_handle_isoc_out_packet_dropped_intr(dwc_otg_pcd_t * pcd)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+
+	DWC_WARN("INTERRUPT Handler not implemented for %s\n",
+		 "ISOC Out Dropped");
+
+	intr_mask.b.isooutdrop = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.isooutdrop = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates the end of the portion of the micro-frame
+ * for periodic transactions.  If there is a periodic transaction for
+ * the next frame, load the packets into the EP periodic Tx FIFO.
+ */
+int32_t dwc_otg_pcd_handle_end_periodic_frame_intr(dwc_otg_pcd_t * pcd)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "EOP");
+
+	intr_mask.b.eopframe = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.eopframe = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that EP of the packet on the top of the
+ * non-periodic Tx FIFO does not match EP of the IN Token received.
+ *
+ * The "Device IN Token Queue" Registers are read to determine the
+ * order the IN Tokens have been received. The non-periodic Tx FIFO
+ * is flushed, so it can be reloaded in the order seen in the IN Token
+ * Queue.
+ */
+int32_t dwc_otg_pcd_handle_ep_mismatch_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dctl_data_t dctl;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	if (!core_if->en_multiple_tx_fifo && core_if->dma_enable) {
+		core_if->start_predict = 1;
+
+		DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
+
+		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+		if (!gintsts.b.ginnakeff) {
+			/* Disable EP Mismatch interrupt */
+			intr_mask.d32 = 0;
+			intr_mask.b.epmismatch = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
+			/* Enable the Global IN NAK Effective Interrupt */
+			intr_mask.d32 = 0;
+			intr_mask.b.ginnakeff = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
+			/* Set the global non-periodic IN NAK handshake */
+			dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+			dctl.b.sgnpinnak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+		} else {
+			DWC_PRINTF("gintsts.b.ginnakeff = 1! dctl.b.sgnpinnak not set\n");
+		}
+		/* Disabling of all EP's will be done in dwc_otg_pcd_handle_in_nak_effective()
+		 * handler after Global IN NAK Effective interrupt will be asserted */
+	}
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.epmismatch = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt is valid only in DMA mode. This interrupt indicates that the
+ * core has stopped fetching data for IN endpoints due to the unavailability of
+ * TxFIFO space or Request Queue space. This interrupt is used by the
+ * application for an endpoint mismatch algorithm.
+ *
+ * @param pcd The PCD
+ */
+int32_t dwc_otg_pcd_handle_ep_fetsusp_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk_data;
+	dctl_data_t dctl;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
+
+	/* Clear the global non-periodic IN NAK handshake */
+	dctl.d32 = 0;
+	dctl.b.cgnpinnak = 1;
+	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+
+	/* Mask GINTSTS.FETSUSP interrupt */
+	gintmsk_data.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+	gintmsk_data.b.fetsusp = 0;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_data.d32);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.fetsusp = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+/**
+ * This funcion stalls EP0.
+ */
+static inline void ep0_do_stall(dwc_otg_pcd_t * pcd, const int err_val)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	usb_device_request_t *ctrl = &pcd->setup_pkt->req;
+	DWC_WARN("req %02x.%02x protocol STALL; err %d\n",
+		 ctrl->bmRequestType, ctrl->bRequest, err_val);
+
+	ep0->dwc_ep.is_in = 1;
+	dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep0->dwc_ep);
+	pcd->ep0.stopped = 1;
+	pcd->ep0state = EP0_IDLE;
+	ep0_out_start(GET_CORE_IF(pcd), pcd);
+}
+
+/**
+ * This functions delegates the setup command to the gadget driver.
+ */
+static inline void do_gadget_setup(dwc_otg_pcd_t * pcd,
+				   usb_device_request_t * ctrl)
+{
+	int ret = 0;
+	DWC_SPINUNLOCK(pcd->lock);
+	ret = pcd->fops->setup(pcd, (uint8_t *) ctrl);
+	DWC_SPINLOCK(pcd->lock);
+	if (ret < 0) {
+		ep0_do_stall(pcd, ret);
+	}
+
+	/** @todo This is a g_file_storage gadget driver specific
+	 * workaround: a DELAYED_STATUS result from the fsg_setup
+	 * routine will result in the gadget queueing a EP0 IN status
+	 * phase for a two-stage control transfer. Exactly the same as
+	 * a SET_CONFIGURATION/SET_INTERFACE except that this is a class
+	 * specific request.  Need a generic way to know when the gadget
+	 * driver will queue the status phase. Can we assume when we
+	 * call the gadget driver setup() function that it will always
+	 * queue and require the following flag? Need to look into
+	 * this.
+	 */
+
+	if (ret == 256 + 999) {
+		pcd->request_config = 1;
+	}
+}
+
+#ifdef DWC_UTE_CFI
+/**
+ * This functions delegates the CFI setup commands to the gadget driver.
+ * This function will return a negative value to indicate a failure.
+ */
+static inline int cfi_gadget_setup(dwc_otg_pcd_t * pcd,
+				   struct cfi_usb_ctrlrequest *ctrl_req)
+{
+	int ret = 0;
+
+	if (pcd->fops && pcd->fops->cfi_setup) {
+		DWC_SPINUNLOCK(pcd->lock);
+		ret = pcd->fops->cfi_setup(pcd, ctrl_req);
+		DWC_SPINLOCK(pcd->lock);
+		if (ret < 0) {
+			ep0_do_stall(pcd, ret);
+			return ret;
+		}
+	}
+
+	return ret;
+}
+#endif
+
+/**
+ * This function starts the Zero-Length Packet for the IN status phase
+ * of a 2 stage control transfer.
+ */
+static inline void do_setup_in_status_phase(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	if (pcd->ep0state == EP0_STALL) {
+		return;
+	}
+
+	pcd->ep0state = EP0_IN_STATUS_PHASE;
+
+	/* Prepare for more SETUP Packets */
+	DWC_DEBUGPL(DBG_PCD, "EP0 IN ZLP\n");
+	if ((GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a)
+	    && (pcd->core_if->dma_desc_enable)
+	    && (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len)) {
+		DWC_DEBUGPL(DBG_PCDV,
+			    "Data terminated wait next packet in out_desc_addr\n");
+		pcd->backup_buf = phys_to_virt(ep0->dwc_ep.dma_addr);
+		pcd->data_terminated = 1;
+	}
+	ep0->dwc_ep.xfer_len = 0;
+	ep0->dwc_ep.xfer_count = 0;
+	ep0->dwc_ep.is_in = 1;
+	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
+	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
+
+	/* Prepare for more SETUP Packets */
+	//ep0_out_start(GET_CORE_IF(pcd), pcd);
+}
+
+/**
+ * This function starts the Zero-Length Packet for the OUT status phase
+ * of a 2 stage control transfer.
+ */
+static inline void do_setup_out_status_phase(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	if (pcd->ep0state == EP0_STALL) {
+		DWC_DEBUGPL(DBG_PCD, "EP0 STALLED\n");
+		return;
+	}
+	pcd->ep0state = EP0_OUT_STATUS_PHASE;
+
+	DWC_DEBUGPL(DBG_PCD, "EP0 OUT ZLP\n");
+	ep0->dwc_ep.xfer_len = 0;
+	ep0->dwc_ep.xfer_count = 0;
+	ep0->dwc_ep.is_in = 0;
+	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
+	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
+
+	/* Prepare for more SETUP Packets */
+	if (GET_CORE_IF(pcd)->dma_enable == 0) {
+		ep0_out_start(GET_CORE_IF(pcd), pcd);
+	}
+}
+
+/**
+ * Clear the EP halt (STALL) and if pending requests start the
+ * transfer.
+ */
+static inline void pcd_clear_halt(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
+{
+	if (ep->dwc_ep.stall_clear_flag == 0)
+		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+
+	/* Reactive the EP */
+	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
+	if (ep->stopped) {
+		ep->stopped = 0;
+		/* If there is a request in the EP queue start it */
+
+		/** @todo FIXME: this causes an EP mismatch in DMA mode.
+		 * epmismatch not yet implemented. */
+
+		/*
+		 * Above fixme is solved by implmenting a tasklet to call the
+		 * start_next_request(), outside of interrupt context at some
+		 * time after the current time, after a clear-halt setup packet.
+		 * Still need to implement ep mismatch in the future if a gadget
+		 * ever uses more than one endpoint at once
+		 */
+		ep->queue_sof = 1;
+		DWC_TASK_SCHEDULE(pcd->start_xfer_tasklet);
+	}
+	/* Start Control Status Phase */
+	do_setup_in_status_phase(pcd);
+}
+
+/**
+ * This function is called when the SET_FEATURE TEST_MODE Setup packet
+ * is sent from the host.  The Device Control register is written with
+ * the Test Mode bits set to the specified Test Mode.  This is done as
+ * a tasklet so that the "Status" phase of the control transfer
+ * completes before transmitting the TEST packets.
+ *
+ * @todo This has not been tested since the tasklet struct was put
+ * into the PCD struct!
+ *
+ */
+void do_test_mode(void *data)
+{
+	dctl_data_t dctl;
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	int test_mode = pcd->test_mode;
+
+//        DWC_WARN("%s() has not been tested since being rewritten!\n", __func__);
+
+	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	switch (test_mode) {
+	case 1:		// TEST_J
+		dctl.b.tstctl = 1;
+		break;
+
+	case 2:		// TEST_K
+		dctl.b.tstctl = 2;
+		break;
+
+	case 3:		// TEST_SE0_NAK
+		dctl.b.tstctl = 3;
+		break;
+
+	case 4:		// TEST_PACKET
+		dctl.b.tstctl = 4;
+		break;
+
+	case 5:		// TEST_FORCE_ENABLE
+		dctl.b.tstctl = 5;
+		break;
+	}
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+}
+
+/**
+ * This function process the GET_STATUS Setup Commands.
+ */
+static inline void do_get_status(dwc_otg_pcd_t * pcd)
+{
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	uint16_t *status = pcd->status_buf;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+#ifdef DEBUG_EP0
+	DWC_DEBUGPL(DBG_PCD,
+		    "GET_STATUS %02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+#endif
+
+	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
+	case UT_DEVICE:
+		if(UGETW(ctrl.wIndex) == 0xF000) { /* OTG Status selector */
+			DWC_PRINTF("wIndex - %d\n", UGETW(ctrl.wIndex));
+			DWC_PRINTF("OTG VERSION - %d\n", core_if->otg_ver);
+			DWC_PRINTF("OTG CAP - %d, %d\n",
+				   core_if->core_params->otg_cap,
+						DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
+			if (core_if->otg_ver == 1
+			    && core_if->core_params->otg_cap ==
+			    DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				uint8_t *otgsts = (uint8_t*)pcd->status_buf;
+				*otgsts = (core_if->otg_sts & 0x1);
+				pcd->ep0_pending = 1;
+				ep0->dwc_ep.start_xfer_buff =
+				    (uint8_t *) otgsts;
+				ep0->dwc_ep.xfer_buff = (uint8_t *) otgsts;
+				ep0->dwc_ep.dma_addr =
+				    pcd->status_buf_dma_handle;
+				ep0->dwc_ep.xfer_len = 1;
+				ep0->dwc_ep.xfer_count = 0;
+				ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
+				dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
+							   &ep0->dwc_ep);
+				return;
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+		} else {
+			*status = 0x1;	/* Self powered */
+			*status |= pcd->remote_wakeup_enable << 1;
+			break;
+		}
+	case UT_INTERFACE:
+		*status = 0;
+		break;
+
+	case UT_ENDPOINT:
+		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
+		if (ep == 0 || UGETW(ctrl.wLength) > 2) {
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+		}
+		/** @todo check for EP stall */
+		*status = ep->stopped;
+		break;
+	}
+	pcd->ep0_pending = 1;
+	ep0->dwc_ep.start_xfer_buff = (uint8_t *) status;
+	ep0->dwc_ep.xfer_buff = (uint8_t *) status;
+	ep0->dwc_ep.dma_addr = pcd->status_buf_dma_handle;
+	ep0->dwc_ep.xfer_len = 2;
+	ep0->dwc_ep.xfer_count = 0;
+	ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
+	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
+}
+
+/**
+ * This function process the SET_FEATURE Setup Commands.
+ */
+static inline void do_set_feature(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep = 0;
+	int32_t otg_cap_param = core_if->core_params->otg_cap;
+	gotgctl_data_t gotgctl = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_PCD, "SET_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+	DWC_DEBUGPL(DBG_PCD, "otg_cap=%d\n", otg_cap_param);
+
+	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
+	case UT_DEVICE:
+		switch (UGETW(ctrl.wValue)) {
+		case UF_DEVICE_REMOTE_WAKEUP:
+			pcd->remote_wakeup_enable = 1;
+			break;
+
+		case UF_TEST_MODE:
+			/* Setup the Test Mode tasklet to do the Test
+			 * Packet generation after the SETUP Status
+			 * phase has completed. */
+
+			/** @todo This has not been tested since the
+			 * tasklet struct was put into the PCD
+			 * struct! */
+			pcd->test_mode = UGETW(ctrl.wIndex) >> 8;
+			DWC_TASK_SCHEDULE(pcd->test_mode_tasklet);
+			break;
+
+		case UF_DEVICE_B_HNP_ENABLE:
+			DWC_DEBUGPL(DBG_PCDV,
+				    "SET_FEATURE: USB_DEVICE_B_HNP_ENABLE\n");
+
+			/* dev may initiate HNP */
+			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				pcd->b_hnp_enable = 1;
+				dwc_otg_pcd_update_otg(pcd, 0);
+				DWC_DEBUGPL(DBG_PCD, "Request B HNP\n");
+				/**@todo Is the gotgctl.devhnpen cleared
+				 * by a USB Reset? */
+				gotgctl.b.devhnpen = 1;
+				gotgctl.b.hnpreq = 1;
+				DWC_WRITE_REG32(&global_regs->gotgctl,
+						gotgctl.d32);
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+
+		case UF_DEVICE_A_HNP_SUPPORT:
+			/* RH port supports HNP */
+			DWC_DEBUGPL(DBG_PCDV,
+				    "SET_FEATURE: USB_DEVICE_A_HNP_SUPPORT\n");
+			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				pcd->a_hnp_support = 1;
+				dwc_otg_pcd_update_otg(pcd, 0);
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+
+		case UF_DEVICE_A_ALT_HNP_SUPPORT:
+			/* other RH port does */
+			DWC_DEBUGPL(DBG_PCDV,
+				    "SET_FEATURE: USB_DEVICE_A_ALT_HNP_SUPPORT\n");
+			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				pcd->a_alt_hnp_support = 1;
+				dwc_otg_pcd_update_otg(pcd, 0);
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+
+		default:
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+
+		}
+		do_setup_in_status_phase(pcd);
+		break;
+
+	case UT_INTERFACE:
+		do_gadget_setup(pcd, &ctrl);
+		break;
+
+	case UT_ENDPOINT:
+		if (UGETW(ctrl.wValue) == UF_ENDPOINT_HALT) {
+			ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
+			if (ep == 0) {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			ep->stopped = 1;
+			dwc_otg_ep_set_stall(core_if, &ep->dwc_ep);
+		}
+		do_setup_in_status_phase(pcd);
+		break;
+	}
+}
+
+/**
+ * This function process the CLEAR_FEATURE Setup Commands.
+ */
+static inline void do_clear_feature(dwc_otg_pcd_t * pcd)
+{
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep = 0;
+
+	DWC_DEBUGPL(DBG_PCD,
+		    "CLEAR_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+
+	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
+	case UT_DEVICE:
+		switch (UGETW(ctrl.wValue)) {
+		case UF_DEVICE_REMOTE_WAKEUP:
+			pcd->remote_wakeup_enable = 0;
+			break;
+
+		case UF_TEST_MODE:
+			/** @todo Add CLEAR_FEATURE for TEST modes. */
+			break;
+
+		default:
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+		}
+		do_setup_in_status_phase(pcd);
+		break;
+
+	case UT_ENDPOINT:
+		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
+		if (ep == 0) {
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+		}
+
+		pcd_clear_halt(pcd, ep);
+
+		break;
+	}
+}
+
+/**
+ * This function process the SET_ADDRESS Setup Commands.
+ */
+static inline void do_set_address(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+
+	if (ctrl.bmRequestType == UT_DEVICE) {
+		dcfg_data_t dcfg = {.d32 = 0 };
+
+#ifdef DEBUG_EP0
+//                      DWC_DEBUGPL(DBG_PCDV, "SET_ADDRESS:%d\n", ctrl.wValue);
+#endif
+		dcfg.b.devaddr = UGETW(ctrl.wValue);
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dcfg, 0, dcfg.d32);
+		do_setup_in_status_phase(pcd);
+	}
+}
+
+/**
+ *	This function processes SETUP commands. In Linux, the USB Command
+ *	processing is done in two places - the first being the PCD and the
+ *	second in the Gadget Driver (for example, the File-Backed Storage
+ *	Gadget Driver).
+ *
+ * <table>
+ * <tr><td>Command	</td><td>Driver </td><td>Description</td></tr>
+ *
+ * <tr><td>GET_STATUS </td><td>PCD </td><td>Command is processed as
+ * defined in chapter 9 of the USB 2.0 Specification chapter 9
+ * </td></tr>
+ *
+ * <tr><td>CLEAR_FEATURE </td><td>PCD </td><td>The Device and Endpoint
+ * requests are the ENDPOINT_HALT feature is procesed, all others the
+ * interface requests are ignored.</td></tr>
+ *
+ * <tr><td>SET_FEATURE </td><td>PCD </td><td>The Device and Endpoint
+ * requests are processed by the PCD.  Interface requests are passed
+ * to the Gadget Driver.</td></tr>
+ *
+ * <tr><td>SET_ADDRESS </td><td>PCD </td><td>Program the DCFG reg,
+ * with device address received </td></tr>
+ *
+ * <tr><td>GET_DESCRIPTOR </td><td>Gadget Driver </td><td>Return the
+ * requested descriptor</td></tr>
+ *
+ * <tr><td>SET_DESCRIPTOR </td><td>Gadget Driver </td><td>Optional -
+ * not implemented by any of the existing Gadget Drivers.</td></tr>
+ *
+ * <tr><td>SET_CONFIGURATION </td><td>Gadget Driver </td><td>Disable
+ * all EPs and enable EPs for new configuration.</td></tr>
+ *
+ * <tr><td>GET_CONFIGURATION </td><td>Gadget Driver </td><td>Return
+ * the current configuration</td></tr>
+ *
+ * <tr><td>SET_INTERFACE </td><td>Gadget Driver </td><td>Disable all
+ * EPs and enable EPs for new configuration.</td></tr>
+ *
+ * <tr><td>GET_INTERFACE </td><td>Gadget Driver </td><td>Return the
+ * current interface.</td></tr>
+ *
+ * <tr><td>SYNC_FRAME </td><td>PCD </td><td>Display debug
+ * message.</td></tr>
+ * </table>
+ *
+ * When the SETUP Phase Done interrupt occurs, the PCD SETUP commands are
+ * processed by pcd_setup. Calling the Function Driver's setup function from
+ * pcd_setup processes the gadget SETUP commands.
+ */
+static inline void pcd_setup(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+
+	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
+
+#ifdef DWC_UTE_CFI
+	int retval = 0;
+	struct cfi_usb_ctrlrequest cfi_req;
+#endif
+
+	doeptsize0.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doeptsiz);
+
+	/** In BDMA more then 1 setup packet is not supported till 3.00a */
+	if (core_if->dma_enable && core_if->dma_desc_enable == 0
+	    && (doeptsize0.b.supcnt < 2)
+	    && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
+		DWC_ERROR
+		    ("\n\n-----------	 CANNOT handle > 1 setup packet in DMA mode\n\n");
+	}
+	if ((core_if->snpsid >= OTG_CORE_REV_3_00a)
+	    && (core_if->dma_enable == 1) && (core_if->dma_desc_enable == 0)) {
+		ctrl =
+		    (pcd->setup_pkt +
+		     (3 - doeptsize0.b.supcnt - 1 +
+		      ep0->dwc_ep.stp_rollover))->req;
+	}
+#ifdef DEBUG_EP0
+	DWC_DEBUGPL(DBG_PCD, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+#endif
+
+	/* Clean up the request queue */
+	dwc_otg_request_nuke(ep0);
+	ep0->stopped = 0;
+
+	if (ctrl.bmRequestType & UE_DIR_IN) {
+		ep0->dwc_ep.is_in = 1;
+		pcd->ep0state = EP0_IN_DATA_PHASE;
+	} else {
+		ep0->dwc_ep.is_in = 0;
+		pcd->ep0state = EP0_OUT_DATA_PHASE;
+	}
+
+	if (UGETW(ctrl.wLength) == 0) {
+		ep0->dwc_ep.is_in = 1;
+		pcd->ep0state = EP0_IN_STATUS_PHASE;
+	}
+
+	if (UT_GET_TYPE(ctrl.bmRequestType) != UT_STANDARD) {
+
+#ifdef DWC_UTE_CFI
+		DWC_MEMCPY(&cfi_req, &ctrl, sizeof(usb_device_request_t));
+
+		//printk(KERN_ALERT "CFI: req_type=0x%02x; req=0x%02x\n",
+				ctrl.bRequestType, ctrl.bRequest);
+		if (UT_GET_TYPE(cfi_req.bRequestType) == UT_VENDOR) {
+			if (cfi_req.bRequest > 0xB0 && cfi_req.bRequest < 0xBF) {
+				retval = cfi_setup(pcd, &cfi_req);
+				if (retval < 0) {
+					ep0_do_stall(pcd, retval);
+					pcd->ep0_pending = 0;
+					return;
+				}
+
+				/* if need gadget setup then call it and check the retval */
+				if (pcd->cfi->need_gadget_att) {
+					retval =
+					    cfi_gadget_setup(pcd,
+							     &pcd->
+							     cfi->ctrl_req);
+					if (retval < 0) {
+						pcd->ep0_pending = 0;
+						return;
+					}
+				}
+
+				if (pcd->cfi->need_status_in_complete) {
+					do_setup_in_status_phase(pcd);
+				}
+				return;
+			}
+		}
+#endif
+
+		/* handle non-standard (class/vendor) requests in the gadget driver */
+		do_gadget_setup(pcd, &ctrl);
+		return;
+	}
+
+	/** @todo NGS: Handle bad setup packet? */
+
+///////////////////////////////////////////
+//// --- Standard Request handling --- ////
+
+	switch (ctrl.bRequest) {
+	case UR_GET_STATUS:
+		do_get_status(pcd);
+		break;
+
+	case UR_CLEAR_FEATURE:
+		do_clear_feature(pcd);
+		break;
+
+	case UR_SET_FEATURE:
+		do_set_feature(pcd);
+		break;
+
+	case UR_SET_ADDRESS:
+		do_set_address(pcd);
+		break;
+
+	case UR_SET_INTERFACE:
+	case UR_SET_CONFIG:
+//              _pcd->request_config = 1;       /* Configuration changed */
+		do_gadget_setup(pcd, &ctrl);
+		break;
+
+	case UR_SYNCH_FRAME:
+		do_gadget_setup(pcd, &ctrl);
+		break;
+
+	default:
+		/* Call the Gadget Driver's setup functions */
+		do_gadget_setup(pcd, &ctrl);
+		break;
+	}
+}
+
+/**
+ * This function completes the ep0 control transfer.
+ */
+static int32_t ep0_complete_request(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
+	    dev_if->in_ep_regs[ep->dwc_ep.num];
+#ifdef DEBUG_EP0
+	dwc_otg_dev_out_ep_regs_t *out_ep_regs =
+	    dev_if->out_ep_regs[ep->dwc_ep.num];
+#endif
+	deptsiz0_data_t deptsiz;
+	dev_dma_desc_sts_t desc_sts;
+	dwc_otg_pcd_request_t *req;
+	int is_last = 0;
+	dwc_otg_pcd_t *pcd = ep->pcd;
+
+#ifdef DWC_UTE_CFI
+	struct cfi_usb_ctrlrequest *ctrlreq;
+	int retval = -DWC_E_NOT_SUPPORTED;
+#endif
+
+        desc_sts.b.bytes = 0;
+
+	if (pcd->ep0_pending && DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		if (ep->dwc_ep.is_in) {
+#ifdef DEBUG_EP0
+			DWC_DEBUGPL(DBG_PCDV, "Do setup OUT status phase\n");
+#endif
+			do_setup_out_status_phase(pcd);
+		} else {
+#ifdef DEBUG_EP0
+			DWC_DEBUGPL(DBG_PCDV, "Do setup IN status phase\n");
+#endif
+
+#ifdef DWC_UTE_CFI
+			ctrlreq = &pcd->cfi->ctrl_req;
+
+			if (UT_GET_TYPE(ctrlreq->bRequestType) == UT_VENDOR) {
+				if (ctrlreq->bRequest > 0xB0
+				    && ctrlreq->bRequest < 0xBF) {
+
+					/* Return if the PCD failed to handle the request */
+					if ((retval =
+					     pcd->cfi->ops.
+					     ctrl_write_complete(pcd->cfi,
+								 pcd)) < 0) {
+						CFI_INFO
+						    ("ERROR setting a new value in the PCD(%d)\n",
+						     retval);
+						ep0_do_stall(pcd, retval);
+						pcd->ep0_pending = 0;
+						return 0;
+					}
+
+					/* If the gadget needs to be notified on the request */
+					if (pcd->cfi->need_gadget_att == 1) {
+						//retval = do_gadget_setup(pcd, &pcd->cfi->ctrl_req);
+						retval =
+						    cfi_gadget_setup(pcd,
+								     &pcd->cfi->
+								     ctrl_req);
+
+						/* Return from the function if the gadget failed to process
+						 * the request properly - this should never happen !!!
+						 */
+						if (retval < 0) {
+							CFI_INFO
+							    ("ERROR setting a new value in the gadget(%d)\n",
+							     retval);
+							pcd->ep0_pending = 0;
+							return 0;
+						}
+					}
+
+					CFI_INFO("%s: RETVAL=%d\n", __func__,
+						 retval);
+					/* If we hit here then the PCD and the gadget has properly
+					 * handled the request - so send the ZLP IN to the host.
+					 */
+					/* @todo: MAS - decide whether we need to start the setup
+					 * stage based on the need_setup value of the cfi object
+					 */
+					do_setup_in_status_phase(pcd);
+					pcd->ep0_pending = 0;
+					return 1;
+				}
+			}
+#endif
+
+			do_setup_in_status_phase(pcd);
+		}
+		pcd->ep0_pending = 0;
+		return 1;
+	}
+
+	if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		return 0;
+	}
+	req = DWC_CIRCLEQ_FIRST(&ep->queue);
+
+	if (pcd->ep0state == EP0_OUT_STATUS_PHASE
+	    || pcd->ep0state == EP0_IN_STATUS_PHASE) {
+		is_last = 1;
+	} else if (ep->dwc_ep.is_in) {
+		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
+		if (core_if->dma_desc_enable != 0)
+			desc_sts = dev_if->in_desc_addr->status;
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCDV, "%d len=%d  xfersize=%d pktcnt=%d\n",
+			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
+			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+#endif
+
+		if (((core_if->dma_desc_enable == 0)
+		     && (deptsiz.b.xfersize == 0))
+		    || ((core_if->dma_desc_enable != 0)
+			&& (desc_sts.b.bytes == 0))) {
+			req->actual = ep->dwc_ep.xfer_count;
+			/* Is a Zero Len Packet needed? */
+			if (req->sent_zlp) {
+#ifdef DEBUG_EP0
+				DWC_DEBUGPL(DBG_PCD, "Setup Rx ZLP\n");
+#endif
+				req->sent_zlp = 0;
+			}
+			do_setup_out_status_phase(pcd);
+		}
+	} else {
+		/* ep0-OUT */
+#ifdef DEBUG_EP0
+		deptsiz.d32 = DWC_READ_REG32(&out_ep_regs->doeptsiz);
+		DWC_DEBUGPL(DBG_PCDV, "%d len=%d xsize=%d pktcnt=%d\n",
+			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
+			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+#endif
+		req->actual = ep->dwc_ep.xfer_count;
+
+		/* Is a Zero Len Packet needed? */
+		if (req->sent_zlp) {
+#ifdef DEBUG_EP0
+			DWC_DEBUGPL(DBG_PCDV, "Setup Tx ZLP\n");
+#endif
+			req->sent_zlp = 0;
+		}
+		/* For older cores do setup in status phase in Slave/BDMA modes,
+		 * starting from 3.00 do that only in slave, and for DMA modes
+		 * just re-enable ep 0 OUT here*/
+		if (core_if->dma_enable == 0
+		    || (core_if->dma_desc_enable == 0
+			&& core_if->snpsid <= OTG_CORE_REV_2_94a)) {
+			do_setup_in_status_phase(pcd);
+		} else if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+			DWC_DEBUGPL(DBG_PCDV,
+				    "Enable out ep before in status phase\n");
+			ep0_out_start(core_if, pcd);
+		}
+	}
+
+	/* Complete the request */
+	if (is_last) {
+		dwc_otg_request_done(ep, req, 0);
+		ep->dwc_ep.start_xfer_buff = 0;
+		ep->dwc_ep.xfer_buff = 0;
+		ep->dwc_ep.xfer_len = 0;
+		return 1;
+	}
+	return 0;
+}
+
+#ifdef DWC_UTE_CFI
+/**
+ * This function calculates traverses all the CFI DMA descriptors and
+ * and accumulates the bytes that are left to be transfered.
+ *
+ * @return The total bytes left to transfered, or a negative value as failure
+ */
+static inline int cfi_calc_desc_residue(dwc_otg_pcd_ep_t * ep)
+{
+	int32_t ret = 0;
+	int i;
+	struct dwc_otg_dma_desc *ddesc = NULL;
+	struct cfi_ep *cfiep;
+
+	/* See if the pcd_ep has its respective cfi_ep mapped */
+	cfiep = get_cfi_ep_by_pcd_ep(ep->pcd->cfi, ep);
+	if (!cfiep) {
+		CFI_INFO("%s: Failed to find ep\n", __func__);
+		return -1;
+	}
+
+	ddesc = ep->dwc_ep.descs;
+
+	for (i = 0; (i < cfiep->desc_count) && (i < MAX_DMA_DESCS_PER_EP); i++) {
+
+#if defined(PRINT_CFI_DMA_DESCS)
+		print_desc(ddesc, ep->ep.name, i);
+#endif
+		ret += ddesc->status.b.bytes;
+		ddesc++;
+	}
+
+	if (ret)
+		CFI_INFO("!!!!!!!!!! WARNING (%s) - residue=%d\n", __func__,
+			 ret);
+
+	return ret;
+}
+#endif
+
+/**
+ * This function completes the request for the EP. If there are
+ * additional requests for the EP in the queue they will be started.
+ */
+static void complete_ep(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
+	struct device *dev = dwc_otg_pcd_to_dev(ep->pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
+	    dev_if->in_ep_regs[ep->dwc_ep.num];
+	deptsiz_data_t deptsiz;
+	dev_dma_desc_sts_t desc_sts;
+	dwc_otg_pcd_request_t *req = 0;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	uint32_t byte_count = 0;
+	int is_last = 0;
+	int i;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s() %d-%s\n", __func__, ep->dwc_ep.num,
+		    (ep->dwc_ep.is_in ? "IN" : "OUT"));
+
+	/* Get any pending requests */
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		if (!req) {
+			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
+			return;
+		}
+	} else {
+		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
+		return;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "Requests %d\n", ep->pcd->request_pending);
+
+	if (ep->dwc_ep.is_in) {
+		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
+
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				if (deptsiz.b.xfersize == 0
+				    && deptsiz.b.pktcnt == 0) {
+					byte_count =
+					    ep->dwc_ep.xfer_len -
+					    ep->dwc_ep.xfer_count;
+
+					ep->dwc_ep.xfer_buff += byte_count;
+					ep->dwc_ep.dma_addr += byte_count;
+					ep->dwc_ep.xfer_count += byte_count;
+
+					DWC_DEBUGPL(DBG_PCDV,
+						    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
+						    ep->dwc_ep.num,
+						    (ep->dwc_ep.
+						     is_in ? "IN" : "OUT"),
+						    ep->dwc_ep.xfer_len,
+						    deptsiz.b.xfersize,
+						    deptsiz.b.pktcnt);
+
+					if (ep->dwc_ep.xfer_len <
+					    ep->dwc_ep.total_len) {
+						dwc_otg_ep_start_transfer
+						    (core_if, &ep->dwc_ep);
+					} else if (ep->dwc_ep.sent_zlp) {
+						/*
+						 * This fragment of code should initiate 0
+						 * length transfer in case if it is queued
+						 * a transfer with size divisible to EPs max
+						 * packet size and with usb_request zero field
+						 * is set, which means that after data is transfered,
+						 * it is also should be transfered
+						 * a 0 length packet at the end. For Slave and
+						 * Buffer DMA modes in this case SW has
+						 * to initiate 2 transfers one with transfer size,
+						 * and the second with 0 size. For Descriptor
+						 * DMA mode SW is able to initiate a transfer,
+						 * which will handle all the packets including
+						 * the last  0 length.
+						 */
+						ep->dwc_ep.sent_zlp = 0;
+						dwc_otg_ep_start_zl_transfer
+						    (core_if, &ep->dwc_ep);
+					} else {
+						is_last = 1;
+					}
+				} else {
+					if (ep->dwc_ep.type ==
+					    DWC_OTG_EP_TYPE_ISOC) {
+						req->actual = 0;
+						dwc_otg_request_done(ep, req, 0);
+
+						ep->dwc_ep.start_xfer_buff = 0;
+						ep->dwc_ep.xfer_buff = 0;
+						ep->dwc_ep.xfer_len = 0;
+
+						/* If there is a request in the queue start it. */
+						start_next_request(ep);
+					} else
+						DWC_WARN
+						("Incomplete transfer (%d - %s [siz=%d pkt=%d])\n",
+						ep->dwc_ep.num,
+						(ep->dwc_ep.is_in ? "IN" : "OUT"),
+						deptsiz.b.xfersize,
+						deptsiz.b.pktcnt);
+				}
+			} else {
+				dma_desc = ep->dwc_ep.desc_addr;
+				byte_count = 0;
+				ep->dwc_ep.sent_zlp = 0;
+
+#ifdef DWC_UTE_CFI
+				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
+					 ep->dwc_ep.buff_mode);
+				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+					int residue;
+
+					residue = cfi_calc_desc_residue(ep);
+					if (residue < 0)
+						return;
+
+					byte_count = residue;
+				} else {
+#endif
+					for (i = 0; i < ep->dwc_ep.desc_cnt;
+					     ++i) {
+					desc_sts = dma_desc->status;
+					byte_count += desc_sts.b.bytes;
+					dma_desc++;
+				}
+#ifdef DWC_UTE_CFI
+				}
+#endif
+				if (byte_count == 0) {
+					ep->dwc_ep.xfer_count =
+					    ep->dwc_ep.total_len;
+					is_last = 1;
+				} else {
+					DWC_WARN("Incomplete transfer\n");
+				}
+			}
+		} else {
+			if (deptsiz.b.xfersize == 0 && deptsiz.b.pktcnt == 0) {
+				DWC_DEBUGPL(DBG_PCDV,
+					    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
+					    ep->dwc_ep.num,
+					    ep->dwc_ep.is_in ? "IN" : "OUT",
+					    ep->dwc_ep.xfer_len,
+					    deptsiz.b.xfersize,
+					    deptsiz.b.pktcnt);
+
+				/*      Check if the whole transfer was completed,
+				 *      if no, setup transfer for next portion of data
+				 */
+				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
+					dwc_otg_ep_start_transfer(core_if,
+								  &ep->dwc_ep);
+				} else if (ep->dwc_ep.sent_zlp) {
+					/*
+					 * This fragment of code should initiate 0
+					 * length trasfer in case if it is queued
+					 * a trasfer with size divisible to EPs max
+					 * packet size and with usb_request zero field
+					 * is set, which means that after data is transfered,
+					 * it is also should be transfered
+					 * a 0 length packet at the end. For Slave and
+					 * Buffer DMA modes in this case SW has
+					 * to initiate 2 transfers one with transfer size,
+					 * and the second with 0 size. For Desriptor
+					 * DMA mode SW is able to initiate a transfer,
+					 * which will handle all the packets including
+					 * the last  0 legth.
+					 */
+					ep->dwc_ep.sent_zlp = 0;
+					dwc_otg_ep_start_zl_transfer(core_if,
+								     &ep->dwc_ep);
+				} else {
+					is_last = 1;
+				}
+			} else {
+				DWC_WARN
+				    ("Incomplete transfer (%d-%s [siz=%d pkt=%d])\n",
+				     ep->dwc_ep.num,
+				     (ep->dwc_ep.is_in ? "IN" : "OUT"),
+				     deptsiz.b.xfersize, deptsiz.b.pktcnt);
+			}
+		}
+	} else {
+		dwc_otg_dev_out_ep_regs_t *out_ep_regs =
+		    dev_if->out_ep_regs[ep->dwc_ep.num];
+		desc_sts.d32 = 0;
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable) {
+				dma_desc = ep->dwc_ep.desc_addr;
+				byte_count = 0;
+				ep->dwc_ep.sent_zlp = 0;
+
+#ifdef DWC_UTE_CFI
+				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
+					 ep->dwc_ep.buff_mode);
+				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+					int residue;
+					residue = cfi_calc_desc_residue(ep);
+					if (residue < 0)
+						return;
+					byte_count = residue;
+				} else {
+#endif
+
+					for (i = 0; i < ep->dwc_ep.desc_cnt;
+					     ++i) {
+						desc_sts = dma_desc->status;
+						byte_count += desc_sts.b.bytes;
+						dma_desc++;
+					}
+
+#ifdef DWC_UTE_CFI
+				}
+#endif
+				/* Checking for interrupt Out transfers with not
+				 * dword aligned mps sizes
+				 */
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_INTR &&
+							(ep->dwc_ep.maxpacket%4)) {
+					ep->dwc_ep.xfer_count =
+					    ep->dwc_ep.total_len - byte_count;
+					if ((ep->dwc_ep.xfer_len %
+					     ep->dwc_ep.maxpacket)
+					    && (ep->dwc_ep.xfer_len /
+						ep->dwc_ep.maxpacket <
+						MAX_DMA_DESC_CNT))
+						ep->dwc_ep.xfer_len -=
+						    (ep->dwc_ep.desc_cnt -
+						     1) * ep->dwc_ep.maxpacket +
+						    ep->dwc_ep.xfer_len %
+						    ep->dwc_ep.maxpacket;
+					else
+						ep->dwc_ep.xfer_len -=
+						    ep->dwc_ep.desc_cnt *
+						    ep->dwc_ep.maxpacket;
+					if (ep->dwc_ep.xfer_len > 0) {
+						dwc_otg_ep_start_transfer
+						    (core_if, &ep->dwc_ep);
+					} else {
+						is_last = 1;
+					}
+				} else {
+					ep->dwc_ep.xfer_count =
+					    ep->dwc_ep.total_len - byte_count +
+					    ((4 -
+					      (ep->dwc_ep.
+					       total_len & 0x3)) & 0x3);
+					is_last = 1;
+				}
+			} else {
+				deptsiz.d32 = 0;
+				deptsiz.d32 =
+				    DWC_READ_REG32(&out_ep_regs->doeptsiz);
+
+				byte_count = (ep->dwc_ep.xfer_len -
+					      ep->dwc_ep.xfer_count -
+					      deptsiz.b.xfersize);
+				ep->dwc_ep.xfer_buff += byte_count;
+				ep->dwc_ep.dma_addr += byte_count;
+				ep->dwc_ep.xfer_count += byte_count;
+
+				/*      Check if the whole transfer was completed,
+				 *      if no, setup transfer for next portion of data
+				 */
+				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
+					dwc_otg_ep_start_transfer(core_if,
+								  &ep->dwc_ep);
+				} else if (ep->dwc_ep.sent_zlp) {
+					/*
+					 * This fragment of code should initiate 0
+					 * length trasfer in case if it is queued
+					 * a trasfer with size divisible to EPs max
+					 * packet size and with usb_request zero field
+					 * is set, which means that after data is transfered,
+					 * it is also should be transfered
+					 * a 0 length packet at the end. For Slave and
+					 * Buffer DMA modes in this case SW has
+					 * to initiate 2 transfers one with transfer size,
+					 * and the second with 0 size. For Desriptor
+					 * DMA mode SW is able to initiate a transfer,
+					 * which will handle all the packets including
+					 * the last  0 legth.
+					 */
+					ep->dwc_ep.sent_zlp = 0;
+					dwc_otg_ep_start_zl_transfer(core_if,
+								     &ep->dwc_ep);
+				} else {
+					is_last = 1;
+				}
+			}
+		} else {
+			/*      Check if the whole transfer was completed,
+			 *      if no, setup transfer for next portion of data
+			 */
+			if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
+				dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
+			} else if (ep->dwc_ep.sent_zlp) {
+				/*
+				 * This fragment of code should initiate 0
+				 * length transfer in case if it is queued
+				 * a transfer with size divisible to EPs max
+				 * packet size and with usb_request zero field
+				 * is set, which means that after data is transfered,
+				 * it is also should be transfered
+				 * a 0 length packet at the end. For Slave and
+				 * Buffer DMA modes in this case SW has
+				 * to initiate 2 transfers one with transfer size,
+				 * and the second with 0 size. For Descriptor
+				 * DMA mode SW is able to initiate a transfer,
+				 * which will handle all the packets including
+				 * the last  0 length.
+				 */
+				ep->dwc_ep.sent_zlp = 0;
+				dwc_otg_ep_start_zl_transfer(core_if,
+							     &ep->dwc_ep);
+			} else {
+				is_last = 1;
+			}
+		}
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "addr %p,	 %d-%s len=%d cnt=%d xsize=%d pktcnt=%d\n",
+			    &out_ep_regs->doeptsiz, ep->dwc_ep.num,
+			    ep->dwc_ep.is_in ? "IN" : "OUT",
+			    ep->dwc_ep.xfer_len, ep->dwc_ep.xfer_count,
+			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+	}
+
+	/* Complete the request */
+	if (is_last) {
+#ifdef DWC_UTE_CFI
+		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+			req->actual = ep->dwc_ep.cfi_req_len - byte_count;
+		} else {
+#endif
+			req->actual = ep->dwc_ep.xfer_count;
+#ifdef DWC_UTE_CFI
+		}
+#endif
+		if (req->dw_align_buf) {
+			if (!ep->dwc_ep.is_in) {
+				dwc_memcpy(req->buf, req->dw_align_buf, req->length);
+			}
+			DWC_DMA_FREE(dev, req->length, req->dw_align_buf,
+				     req->dw_align_buf_dma);
+		}
+
+		dwc_otg_request_done(ep, req, 0);
+
+		ep->dwc_ep.start_xfer_buff = 0;
+		ep->dwc_ep.xfer_buff = 0;
+		ep->dwc_ep.xfer_len = 0;
+
+		/* If there is a request in the queue start it. */
+		start_next_request(ep);
+	}
+}
+
+#ifdef DWC_EN_ISOC
+
+/**
+ * This function BNA interrupt for Isochronous EPs
+ *
+ */
+static void dwc_otg_pcd_handle_iso_bna(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_ep_t *dwc_ep = &ep->dwc_ep;
+	volatile uint32_t *addr;
+	depctl_data_t depctl = {.d32 = 0 };
+	dwc_otg_pcd_t *pcd = ep->pcd;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	int i;
+
+	dma_desc =
+	    dwc_ep->iso_desc_addr + dwc_ep->desc_cnt * (dwc_ep->proc_buf_num);
+
+	if (dwc_ep->is_in) {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
+			sts.d32 = dma_desc->status.d32;
+			sts.b_iso_in.bs = BS_HOST_READY;
+			dma_desc->status.d32 = sts.d32;
+		}
+	} else {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
+			sts.d32 = dma_desc->status.d32;
+			sts.b_iso_out.bs = BS_HOST_READY;
+			dma_desc->status.d32 = sts.d32;
+		}
+	}
+
+	if (dwc_ep->is_in == 0) {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->
+							   num]->doepctl;
+	} else {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+	}
+	depctl.b.epena = 1;
+	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
+}
+
+/**
+ * This function sets latest iso packet information(non-PTI mode)
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void set_current_pkt_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	dma_addr_t dma_addr;
+	uint32_t offset;
+
+	if (ep->proc_buf_num)
+		dma_addr = ep->dma_addr1;
+	else
+		dma_addr = ep->dma_addr0;
+
+	if (ep->is_in) {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->
+				   in_ep_regs[ep->num]->dieptsiz);
+		offset = ep->data_per_frame;
+	} else {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->
+				   out_ep_regs[ep->num]->doeptsiz);
+		offset =
+		    ep->data_per_frame +
+		    (0x4 & (0x4 - (ep->data_per_frame & 0x3)));
+	}
+
+	if (!deptsiz.b.xfersize) {
+		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
+		ep->pkt_info[ep->cur_pkt].offset =
+		    ep->cur_pkt_dma_addr - dma_addr;
+		ep->pkt_info[ep->cur_pkt].status = 0;
+	} else {
+		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
+		ep->pkt_info[ep->cur_pkt].offset =
+		    ep->cur_pkt_dma_addr - dma_addr;
+		ep->pkt_info[ep->cur_pkt].status = -DWC_E_NO_DATA;
+	}
+	ep->cur_pkt_addr += offset;
+	ep->cur_pkt_dma_addr += offset;
+	ep->cur_pkt++;
+}
+
+/**
+ * This function sets latest iso packet information(DDMA mode)
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP to start the transfer on.
+ *
+ */
+static void set_ddma_iso_pkts_info(dwc_otg_core_if_t * core_if,
+				   dwc_ep_t * dwc_ep)
+{
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	dev_dma_desc_sts_t sts = {.d32 = 0 };
+	iso_pkt_info_t *iso_packet;
+	uint32_t data_per_desc;
+	uint32_t offset;
+	int i, j;
+
+	iso_packet = dwc_ep->pkt_info;
+
+	/** Reinit closed DMA Descriptors*/
+	/** ISO OUT EP */
+	if (dwc_ep->is_in == 0) {
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+		offset = 0;
+
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				data_per_desc =
+				    ((j + 1) * dwc_ep->maxpacket >
+				     dwc_ep->
+				     data_per_frame) ? dwc_ep->data_per_frame -
+				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+				data_per_desc +=
+				    (data_per_desc % 4) ? (4 -
+							   data_per_desc %
+							   4) : 0;
+
+				sts.d32 = dma_desc->status.d32;
+
+				/* Write status in iso_packet_decsriptor  */
+				iso_packet->status =
+				    sts.b_iso_out.rxsts +
+				    (sts.b_iso_out.bs ^ BS_DMA_DONE);
+				if (iso_packet->status) {
+					iso_packet->status = -DWC_E_NO_DATA;
+				}
+
+				/* Received data length */
+				if (!sts.b_iso_out.rxbytes) {
+					iso_packet->length =
+					    data_per_desc -
+					    sts.b_iso_out.rxbytes;
+				} else {
+					iso_packet->length =
+					    data_per_desc -
+					    sts.b_iso_out.rxbytes + (4 -
+								     dwc_ep->data_per_frame
+								     % 4);
+				}
+
+				iso_packet->offset = offset;
+
+				offset += data_per_desc;
+				dma_desc++;
+				iso_packet++;
+			}
+		}
+
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+			data_per_desc =
+			    ((j + 1) * dwc_ep->maxpacket >
+			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+			data_per_desc +=
+			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+
+			sts.d32 = dma_desc->status.d32;
+
+			/* Write status in iso_packet_decsriptor  */
+			iso_packet->status =
+			    sts.b_iso_out.rxsts +
+			    (sts.b_iso_out.bs ^ BS_DMA_DONE);
+			if (iso_packet->status) {
+				iso_packet->status = -DWC_E_NO_DATA;
+			}
+
+			/* Received data length */
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
+
+			iso_packet->offset = offset;
+
+			offset += data_per_desc;
+			iso_packet++;
+			dma_desc++;
+		}
+
+		sts.d32 = dma_desc->status.d32;
+
+		/* Write status in iso_packet_decsriptor  */
+		iso_packet->status =
+		    sts.b_iso_out.rxsts + (sts.b_iso_out.bs ^ BS_DMA_DONE);
+		if (iso_packet->status) {
+			iso_packet->status = -DWC_E_NO_DATA;
+		}
+		/* Received data length */
+		if (!sts.b_iso_out.rxbytes) {
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
+		} else {
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes +
+			    (4 - dwc_ep->data_per_frame % 4);
+		}
+
+		iso_packet->offset = offset;
+	} else {
+/** ISO IN EP */
+
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+
+		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
+			sts.d32 = dma_desc->status.d32;
+
+			/* Write status in iso packet descriptor */
+			iso_packet->status =
+			    sts.b_iso_in.txsts +
+			    (sts.b_iso_in.bs ^ BS_DMA_DONE);
+			if (iso_packet->status != 0) {
+				iso_packet->status = -DWC_E_NO_DATA;
+
+			}
+			/* Bytes has been transfered */
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
+
+			dma_desc++;
+			iso_packet++;
+		}
+
+		sts.d32 = dma_desc->status.d32;
+		while (sts.b_iso_in.bs == BS_DMA_BUSY) {
+			sts.d32 = dma_desc->status.d32;
+		}
+
+		/* Write status in iso packet descriptor ??? do be done with ERROR codes */
+		iso_packet->status =
+		    sts.b_iso_in.txsts + (sts.b_iso_in.bs ^ BS_DMA_DONE);
+		if (iso_packet->status != 0) {
+			iso_packet->status = -DWC_E_NO_DATA;
+		}
+
+		/* Bytes has been transfered */
+		iso_packet->length =
+		    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
+	}
+}
+
+/**
+ * This function reinitialize DMA Descriptors for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP to start the transfer on.
+ *
+ */
+static void reinit_ddma_iso_xfer(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
+{
+	int i, j;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	dma_addr_t dma_ad;
+	volatile uint32_t *addr;
+	dev_dma_desc_sts_t sts = {.d32 = 0 };
+	uint32_t data_per_desc;
+
+	if (dwc_ep->is_in == 0) {
+		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
+	} else {
+		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+	}
+
+	if (dwc_ep->proc_buf_num == 0) {
+		/** Buffer 0 descriptors setup */
+		dma_ad = dwc_ep->dma_addr0;
+	} else {
+		/** Buffer 1 descriptors setup */
+		dma_ad = dwc_ep->dma_addr1;
+	}
+
+	/** Reinit closed DMA Descriptors*/
+	/** ISO OUT EP */
+	if (dwc_ep->is_in == 0) {
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+
+		sts.b_iso_out.bs = BS_HOST_READY;
+		sts.b_iso_out.rxsts = 0;
+		sts.b_iso_out.l = 0;
+		sts.b_iso_out.sp = 0;
+		sts.b_iso_out.ioc = 0;
+		sts.b_iso_out.pid = 0;
+		sts.b_iso_out.framenum = 0;
+
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				data_per_desc =
+				    ((j + 1) * dwc_ep->maxpacket >
+				     dwc_ep->
+				     data_per_frame) ? dwc_ep->data_per_frame -
+				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+				data_per_desc +=
+				    (data_per_desc % 4) ? (4 -
+							   data_per_desc %
+							   4) : 0;
+				sts.b_iso_out.rxbytes = data_per_desc;
+				dma_desc->buf = dma_ad;
+				dma_desc->status.d32 = sts.d32;
+
+				dma_ad += data_per_desc;
+				dma_desc++;
+			}
+		}
+
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+
+			data_per_desc =
+			    ((j + 1) * dwc_ep->maxpacket >
+			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+			data_per_desc +=
+			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+			sts.b_iso_out.rxbytes = data_per_desc;
+
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			dma_desc++;
+			dma_ad += data_per_desc;
+		}
+
+		sts.b_iso_out.ioc = 1;
+		sts.b_iso_out.l = dwc_ep->proc_buf_num;
+
+		data_per_desc =
+		    ((j + 1) * dwc_ep->maxpacket >
+		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+		data_per_desc +=
+		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+		sts.b_iso_out.rxbytes = data_per_desc;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+	} else {
+/** ISO IN EP */
+
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+
+		sts.b_iso_in.bs = BS_HOST_READY;
+		sts.b_iso_in.txsts = 0;
+		sts.b_iso_in.sp = 0;
+		sts.b_iso_in.ioc = 0;
+		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
+		sts.b_iso_in.framenum = dwc_ep->next_frame;
+		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
+		sts.b_iso_in.l = 0;
+
+		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			sts.b_iso_in.framenum += dwc_ep->bInterval;
+			dma_ad += dwc_ep->data_per_frame;
+			dma_desc++;
+		}
+
+		sts.b_iso_in.ioc = 1;
+		sts.b_iso_in.l = dwc_ep->proc_buf_num;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+
+		dwc_ep->next_frame =
+		    sts.b_iso_in.framenum + dwc_ep->bInterval * 1;
+	}
+	dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
+}
+
+/**
+ * This function is to handle Iso EP transfer complete interrupt
+ * in case Iso out packet was dropped
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP for wihich transfer complete was asserted
+ *
+ */
+static uint32_t handle_iso_out_pkt_dropped(dwc_otg_core_if_t * core_if,
+					   dwc_ep_t * dwc_ep)
+{
+	uint32_t dma_addr;
+	uint32_t drp_pkt;
+	uint32_t drp_pkt_cnt;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	int i;
+
+	deptsiz.d32 =
+	    DWC_READ_REG32(&core_if->dev_if->
+			   out_ep_regs[dwc_ep->num]->doeptsiz);
+
+	drp_pkt = dwc_ep->pkt_cnt - deptsiz.b.pktcnt;
+	drp_pkt_cnt = dwc_ep->pkt_per_frm - (drp_pkt % dwc_ep->pkt_per_frm);
+
+	/* Setting dropped packets status */
+	for (i = 0; i < drp_pkt_cnt; ++i) {
+		dwc_ep->pkt_info[drp_pkt].status = -DWC_E_NO_DATA;
+		drp_pkt++;
+		deptsiz.b.pktcnt--;
+	}
+
+	if (deptsiz.b.pktcnt > 0) {
+		deptsiz.b.xfersize =
+		    dwc_ep->xfer_len - (dwc_ep->pkt_cnt -
+					deptsiz.b.pktcnt) * dwc_ep->maxpacket;
+	} else {
+		deptsiz.b.xfersize = 0;
+		deptsiz.b.pktcnt = 0;
+	}
+
+	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz,
+			deptsiz.d32);
+
+	if (deptsiz.b.pktcnt > 0) {
+		if (dwc_ep->proc_buf_num) {
+			dma_addr =
+			    dwc_ep->dma_addr1 + dwc_ep->xfer_len -
+			    deptsiz.b.xfersize;
+		} else {
+			dma_addr =
+			    dwc_ep->dma_addr0 + dwc_ep->xfer_len -
+			    deptsiz.b.xfersize;;
+		}
+
+		DWC_WRITE_REG32(&core_if->dev_if->
+				out_ep_regs[dwc_ep->num]->doepdma, dma_addr);
+
+		/** Re-enable endpoint, clear nak  */
+		depctl.d32 = 0;
+		depctl.b.epena = 1;
+		depctl.b.cnak = 1;
+
+		DWC_MODIFY_REG32(&core_if->dev_if->
+				 out_ep_regs[dwc_ep->num]->doepctl, depctl.d32,
+				 depctl.d32);
+		return 0;
+	} else {
+		return 1;
+	}
+}
+
+/**
+ * This function sets iso packets information(PTI mode)
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+static uint32_t set_iso_pkts_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	int i, j;
+	dma_addr_t dma_ad;
+	iso_pkt_info_t *packet_info = ep->pkt_info;
+	uint32_t offset;
+	uint32_t frame_data;
+	deptsiz_data_t deptsiz;
+
+	if (ep->proc_buf_num == 0) {
+		/** Buffer 0 descriptors setup */
+		dma_ad = ep->dma_addr0;
+	} else {
+		/** Buffer 1 descriptors setup */
+		dma_ad = ep->dma_addr1;
+	}
+
+	if (ep->is_in) {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+				   dieptsiz);
+	} else {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
+				   doeptsiz);
+	}
+
+	if (!deptsiz.b.xfersize) {
+		offset = 0;
+		for (i = 0; i < ep->pkt_cnt; i += ep->pkt_per_frm) {
+			frame_data = ep->data_per_frame;
+			for (j = 0; j < ep->pkt_per_frm; ++j) {
+
+				/* Packet status - is not set as initially
+				 * it is set to 0 and if packet was sent
+				 successfully, status field will remain 0*/
+
+				/* Bytes has been transfered */
+				packet_info->length =
+				    (ep->maxpacket <
+				     frame_data) ? ep->maxpacket : frame_data;
+
+				/* Received packet offset */
+				packet_info->offset = offset;
+				offset += packet_info->length;
+				frame_data -= packet_info->length;
+
+				packet_info++;
+			}
+		}
+		return 1;
+	} else {
+		/* This is a workaround for in case of Transfer Complete with
+		 * PktDrpSts interrupts merging - in this case Transfer complete
+		 * interrupt for Isoc Out Endpoint is asserted without PktDrpSts
+		 * set and with DOEPTSIZ register non zero. Investigations showed,
+		 * that this happens when Out packet is dropped, but because of
+		 * interrupts merging during first interrupt handling PktDrpSts
+		 * bit is cleared and for next merged interrupts it is not reset.
+		 * In this case SW hadles the interrupt as if PktDrpSts bit is set.
+		 */
+		if (ep->is_in) {
+			return 1;
+		} else {
+			return handle_iso_out_pkt_dropped(core_if, ep);
+		}
+	}
+}
+
+/**
+ * This function is to handle Iso EP transfer complete interrupt
+ *
+ * @param pcd The PCD
+ * @param ep The EP for which transfer complete was asserted
+ *
+ */
+static void complete_iso_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
+	dwc_ep_t *dwc_ep = &ep->dwc_ep;
+	uint8_t is_last = 0;
+
+	if (ep->dwc_ep.next_frame == 0xffffffff) {
+		DWC_WARN("Next frame is not set!\n");
+		return;
+	}
+
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			set_ddma_iso_pkts_info(core_if, dwc_ep);
+			reinit_ddma_iso_xfer(core_if, dwc_ep);
+			is_last = 1;
+		} else {
+			if (core_if->pti_enh_enable) {
+				if (set_iso_pkts_info(core_if, dwc_ep)) {
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+					dwc_otg_iso_ep_start_buf_transfer
+					    (core_if, dwc_ep);
+					is_last = 1;
+				}
+			} else {
+				set_current_pkt_info(core_if, dwc_ep);
+				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+					is_last = 1;
+					dwc_ep->cur_pkt = 0;
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+					if (dwc_ep->proc_buf_num) {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff1;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr1;
+					} else {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff0;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr0;
+					}
+
+				}
+				dwc_otg_iso_ep_start_frm_transfer(core_if,
+								  dwc_ep);
+			}
+		}
+	} else {
+		set_current_pkt_info(core_if, dwc_ep);
+		if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+			is_last = 1;
+			dwc_ep->cur_pkt = 0;
+			dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
+			if (dwc_ep->proc_buf_num) {
+				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff1;
+				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr1;
+			} else {
+				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff0;
+				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr0;
+			}
+
+		}
+		dwc_otg_iso_ep_start_frm_transfer(core_if, dwc_ep);
+	}
+	if (is_last)
+		dwc_otg_iso_buffer_done(pcd, ep, ep->iso_req_handle);
+}
+#endif /* DWC_EN_ISOC */
+
+/**
+ * This function handle BNA interrupt for Non Isochronous EPs
+ *
+ */
+static void dwc_otg_pcd_handle_noniso_bna(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_ep_t *dwc_ep = &ep->dwc_ep;
+	volatile uint32_t *addr;
+	depctl_data_t depctl = {.d32 = 0 };
+	dwc_otg_pcd_t *pcd = ep->pcd;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	dev_dma_desc_sts_t sts = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = ep->pcd->core_if;
+	int i, start;
+
+	if (!dwc_ep->desc_cnt)
+		DWC_WARN("Ep%d %s Descriptor count = %d \n", dwc_ep->num,
+			 (dwc_ep->is_in ? "IN" : "OUT"), dwc_ep->desc_cnt);
+
+	if (core_if->core_params->cont_on_bna && !dwc_ep->is_in
+							&& dwc_ep->type != DWC_OTG_EP_TYPE_CONTROL) {
+		uint32_t doepdma;
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+			core_if->dev_if->out_ep_regs[dwc_ep->num];
+		doepdma = DWC_READ_REG32(&(out_regs->doepdma));
+		start = (doepdma - dwc_ep->dma_desc_addr)/sizeof(dwc_otg_dev_dma_desc_t);
+		dma_desc = &(dwc_ep->desc_addr[start]);
+	} else {
+		start = 0;
+		dma_desc = dwc_ep->desc_addr;
+	}
+
+
+	for (i = start; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
+		sts.d32 = dma_desc->status.d32;
+		sts.b.bs = BS_HOST_READY;
+		dma_desc->status.d32 = sts.d32;
+	}
+
+	if (dwc_ep->is_in == 0) {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->num]->
+		    doepctl;
+	} else {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+	}
+	depctl.b.epena = 1;
+	depctl.b.cnak = 1;
+	DWC_MODIFY_REG32(addr, 0, depctl.d32);
+}
+
+/**
+ * This function handles EP0 Control transfers.
+ *
+ * The state of the control transfers are tracked in
+ * <code>ep0state</code>.
+ */
+static void handle_ep0(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	dev_dma_desc_sts_t desc_sts;
+	deptsiz0_data_t deptsiz;
+	uint32_t byte_count;
+
+#ifdef DEBUG_EP0
+	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
+	print_ep0_state(pcd);
+#endif
+
+//      DWC_PRINTF("HANDLE EP0\n");
+
+	switch (pcd->ep0state) {
+	case EP0_DISCONNECT:
+		break;
+
+	case EP0_IDLE:
+		pcd->request_config = 0;
+
+		pcd_setup(pcd);
+		break;
+
+	case EP0_IN_DATA_PHASE:
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCD, "DATA_IN EP%d-%s: type=%d, mps=%d\n",
+			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
+			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
+#endif
+
+		if (core_if->dma_enable != 0) {
+			/*
+			 * For EP0 we can only program 1 packet at a time so we
+			 * need to do the make calculations after each complete.
+			 * Call write_packet to make the calculations, as in
+			 * slave mode, and use those values to determine if we
+			 * can complete.
+			 */
+			if (core_if->dma_desc_enable == 0) {
+				deptsiz.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->in_ep_regs[0]->
+						   dieptsiz);
+				byte_count =
+				    ep0->dwc_ep.xfer_len - deptsiz.b.xfersize;
+			} else {
+				desc_sts =
+				    core_if->dev_if->in_desc_addr->status;
+				byte_count =
+				    ep0->dwc_ep.xfer_len - desc_sts.b.bytes;
+			}
+			ep0->dwc_ep.xfer_count += byte_count;
+			ep0->dwc_ep.xfer_buff += byte_count;
+			ep0->dwc_ep.dma_addr += byte_count;
+		}
+		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
+		} else if (ep0->dwc_ep.sent_zlp) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			ep0->dwc_ep.sent_zlp = 0;
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
+		} else {
+			ep0_complete_request(ep0);
+			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
+		}
+		break;
+	case EP0_OUT_DATA_PHASE:
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCD, "DATA_OUT EP%d-%s: type=%d, mps=%d\n",
+			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
+			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
+#endif
+		if (core_if->dma_enable != 0) {
+			if (core_if->dma_desc_enable == 0) {
+				deptsiz.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->out_ep_regs[0]->
+						   doeptsiz);
+				byte_count =
+				    ep0->dwc_ep.maxpacket - deptsiz.b.xfersize;
+			} else {
+				desc_sts =
+				    core_if->dev_if->out_desc_addr->status;
+				byte_count =
+				    ep0->dwc_ep.maxpacket - desc_sts.b.bytes;
+			}
+			ep0->dwc_ep.xfer_count += byte_count;
+			ep0->dwc_ep.xfer_buff += byte_count;
+			ep0->dwc_ep.dma_addr += byte_count;
+		}
+		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
+		} else if (ep0->dwc_ep.sent_zlp) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			ep0->dwc_ep.sent_zlp = 0;
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
+		} else {
+			ep0_complete_request(ep0);
+			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
+		}
+		break;
+
+	case EP0_IN_STATUS_PHASE:
+	case EP0_OUT_STATUS_PHASE:
+		DWC_DEBUGPL(DBG_PCD, "CASE: EP0_STATUS\n");
+		ep0_complete_request(ep0);
+		pcd->ep0state = EP0_IDLE;
+		ep0->stopped = 1;
+		ep0->dwc_ep.is_in = 0;	/* OUT for next SETUP */
+
+		/* Prepare for more SETUP Packets */
+		if (core_if->dma_enable) {
+			ep0_out_start(core_if, pcd);
+		}
+		break;
+
+	case EP0_STALL:
+		DWC_ERROR("EP0 STALLed, should not get here pcd_setup()\n");
+		break;
+	}
+#ifdef DEBUG_EP0
+	print_ep0_state(pcd);
+#endif
+}
+
+/**
+ * Restart transfer
+ */
+static void restart_transfer(dwc_otg_pcd_t * pcd, const uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if;
+	dwc_otg_dev_if_t *dev_if;
+	deptsiz_data_t dieptsiz = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep;
+
+	ep = get_in_ep(pcd, epnum);
+
+#ifdef DWC_EN_ISOC
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		return;
+	}
+#endif /* DWC_EN_ISOC  */
+
+	core_if = GET_CORE_IF(pcd);
+	dev_if = core_if->dev_if;
+
+	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
+
+	DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x xfer_len=%0x"
+		    " stopped=%d\n", ep->dwc_ep.xfer_buff,
+		    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len, ep->stopped);
+	/*
+	 * If xfersize is 0 and pktcnt in not 0, resend the last packet.
+	 */
+	if (dieptsiz.b.pktcnt && dieptsiz.b.xfersize == 0 &&
+	    ep->dwc_ep.start_xfer_buff != 0) {
+		if (ep->dwc_ep.total_len <= ep->dwc_ep.maxpacket) {
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.xfer_buff = ep->dwc_ep.start_xfer_buff;
+			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
+		} else {
+			ep->dwc_ep.xfer_count -= ep->dwc_ep.maxpacket;
+			/* convert packet size to dwords. */
+			ep->dwc_ep.xfer_buff -= ep->dwc_ep.maxpacket;
+			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
+		}
+		ep->stopped = 0;
+		DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x "
+			    "xfer_len=%0x stopped=%d\n",
+			    ep->dwc_ep.xfer_buff,
+			    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len,
+			    ep->stopped);
+		if (epnum == 0) {
+			dwc_otg_ep0_start_transfer(core_if, &ep->dwc_ep);
+		} else {
+			dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
+		}
+	}
+}
+
+/*
+ * This function create new nextep sequnce based on Learn Queue.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void predict_nextep_seq( dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_device_global_regs_t *dev_global_regs =
+	    core_if->dev_if->dev_global_regs;
+	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
+	/* Number of Token Queue Registers */
+	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
+	dtknq1_data_t dtknqr1;
+	uint32_t in_tkn_epnums[4];
+	uint8_t seqnum[MAX_EPS_CHANNELS];
+	uint8_t intkn_seq[TOKEN_Q_DEPTH];
+	grstctl_t resetctl = {.d32 = 0 };
+	uint8_t temp;
+	int ndx = 0;
+	int start = 0;
+	int end = 0;
+	int sort_done = 0;
+	int i = 0;
+	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
+
+
+	DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
+
+	/* Read the DTKNQ Registers */
+	for (i = 0; i < DTKNQ_REG_CNT; i++) {
+		in_tkn_epnums[i] = DWC_READ_REG32(addr);
+		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
+			    in_tkn_epnums[i]);
+		if (addr == &dev_global_regs->dvbusdis) {
+			addr = &dev_global_regs->dtknqr3_dthrctl;
+		} else {
+			++addr;
+		}
+
+	}
+
+	/* Copy the DTKNQR1 data to the bit field. */
+	dtknqr1.d32 = in_tkn_epnums[0];
+	if (dtknqr1.b.wrap_bit) {
+		ndx = dtknqr1.b.intknwptr;
+		end = ndx -1;
+		if (end < 0)
+			end = TOKEN_Q_DEPTH -1;
+	} else {
+		ndx = 0;
+		end = dtknqr1.b.intknwptr -1;
+		if (end < 0)
+			end = 0;
+	}
+	start = ndx;
+
+	/* Fill seqnum[] by initial values: EP number + 31 */
+	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+		seqnum[i] = i +31;
+	}
+
+	/* Fill intkn_seq[] from in_tkn_epnums[0] */
+	for (i=0; i < 6; i++)
+		intkn_seq[i] = (in_tkn_epnums[0] >> ((7-i) * 4)) & 0xf;
+
+	if (TOKEN_Q_DEPTH > 6) {
+		/* Fill intkn_seq[] from in_tkn_epnums[1] */
+		for (i=6; i < 14; i++)
+			intkn_seq[i] =
+			    (in_tkn_epnums[1] >> ((7 - (i - 6)) * 4)) & 0xf;
+	}
+
+	if (TOKEN_Q_DEPTH > 14) {
+		/* Fill intkn_seq[] from in_tkn_epnums[1] */
+		for (i=14; i < 22; i++)
+			intkn_seq[i] =
+			    (in_tkn_epnums[2] >> ((7 - (i - 14)) * 4)) & 0xf;
+	}
+
+	if (TOKEN_Q_DEPTH > 22) {
+		/* Fill intkn_seq[] from in_tkn_epnums[1] */
+		for (i=22; i < 30; i++)
+			intkn_seq[i] =
+			    (in_tkn_epnums[3] >> ((7 - (i - 22)) * 4)) & 0xf;
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "%s start=%d end=%d intkn_seq[]:\n", __func__,
+		    start, end);
+	for (i=0; i<TOKEN_Q_DEPTH; i++)
+		DWC_DEBUGPL(DBG_PCDV,"%d\n", intkn_seq[i]);
+
+	/* Update seqnum based on intkn_seq[] */
+	i = 0;
+	do {
+		seqnum[intkn_seq[ndx]] = i;
+		ndx++;
+		i++;
+		if (ndx == TOKEN_Q_DEPTH)
+			ndx = 0;
+	} while ( i < TOKEN_Q_DEPTH );
+
+	/* Mark non active EP's in seqnum[] by 0xff */
+	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
+		if (core_if->nextep_seq[i] == 0xff )
+			seqnum[i] = 0xff;
+	}
+
+	/* Sort seqnum[] */
+	sort_done = 0;
+	while (!sort_done) {
+		sort_done = 1;
+		for (i=0; i<core_if->dev_if->num_in_eps; i++) {
+			if (seqnum[i] > seqnum[i+1]) {
+				temp = seqnum[i];
+				seqnum[i] = seqnum[i+1];
+				seqnum[i+1] = temp;
+				sort_done = 0;
+			}
+		}
+	}
+
+	ndx = start + seqnum[0];
+	if (ndx >= TOKEN_Q_DEPTH)
+		ndx = ndx % TOKEN_Q_DEPTH;
+	core_if->first_in_nextep_seq = intkn_seq[ndx];
+
+	/* Update seqnum[] by EP numbers  */
+	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
+		ndx = start + i;
+		if (seqnum[i] < 31) {
+			ndx = start + seqnum[i];
+			if (ndx >= TOKEN_Q_DEPTH)
+				ndx = ndx % TOKEN_Q_DEPTH;
+			seqnum[i] = intkn_seq[ndx];
+		} else {
+			if (seqnum[i] < 0xff) {
+				seqnum[i] = seqnum[i] - 31;
+			} else {
+				break;
+			}
+		}
+	}
+
+	/* Update nextep_seq[] based on seqnum[] */
+	for (i=0; i<core_if->dev_if->num_in_eps; i++) {
+		if (seqnum[i] != 0xff) {
+			if (seqnum[i+1] != 0xff) {
+				core_if->nextep_seq[seqnum[i]] = seqnum[i+1];
+			} else {
+				core_if->nextep_seq[seqnum[i]] = core_if->first_in_nextep_seq;
+				break;
+			}
+		} else {
+			break;
+		}
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+		__func__, core_if->first_in_nextep_seq);
+	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+		DWC_DEBUGPL(DBG_PCDV,"%2d\n", core_if->nextep_seq[i]);
+	}
+
+	/* Flush the Learning Queue */
+	resetctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->grstctl);
+	resetctl.b.intknqflsh = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
+
+
+}
+
+/**
+ * handle the IN EP disable interrupt.
+ */
+static inline void handle_in_ep_disable_intr(dwc_otg_pcd_t * pcd,
+					     const uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	deptsiz_data_t dieptsiz = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+	gintmsk_data_t gintmsk_data;
+	depctl_data_t depctl;
+	uint32_t diepdma;
+	uint32_t remain_to_transfer = 0;
+	uint8_t i;
+	uint32_t xfer_size;
+
+	ep = get_in_ep(pcd, epnum);
+	dwc_ep = &ep->dwc_ep;
+
+	if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+		dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
+		complete_ep(ep);
+		return;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "diepctl%d=%0x\n", epnum,
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl));
+	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
+	depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
+
+	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
+		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
+
+	if ((core_if->start_predict == 0) || (depctl.b.eptype & 1)) {
+		if (ep->stopped) {
+			if (core_if->en_multiple_tx_fifo)
+				/* Flush the Tx FIFO */
+				dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
+			/* Clear the Global IN NP NAK */
+			dctl.d32 = 0;
+			dctl.b.cgnpinnak = 1;
+			DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+			/* Restart the transaction */
+			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
+				restart_transfer(pcd, epnum);
+			}
+		} else {
+			/* Restart the transaction */
+			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
+				restart_transfer(pcd, epnum);
+			}
+			DWC_DEBUGPL(DBG_ANY, "STOPPED!!!\n");
+		}
+		return;
+	}
+
+	if (core_if->start_predict > 2) {	// NP IN EP
+		core_if->start_predict--;
+		return;
+	}
+
+	core_if->start_predict--;
+
+	if (core_if->start_predict == 1) {	// All NP IN Ep's disabled now
+
+		predict_nextep_seq(core_if);
+
+		/* Update all active IN EP's NextEP field based of nextep_seq[] */
+		for ( i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+			if (core_if->nextep_seq[i] != 0xff) {	// Active NP IN EP
+				depctl.b.nextep = core_if->nextep_seq[i];
+				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
+			}
+		}
+		/* Flush Shared NP TxFIFO */
+		dwc_otg_flush_tx_fifo(core_if, 0);
+		/* Rewind buffers */
+		if (!core_if->dma_desc_enable) {
+			i = core_if->first_in_nextep_seq;
+			do {
+				ep = get_in_ep(pcd, i);
+				dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
+				xfer_size = ep->dwc_ep.total_len - ep->dwc_ep.xfer_count;
+				if (xfer_size > ep->dwc_ep.maxxfer)
+					xfer_size = ep->dwc_ep.maxxfer;
+				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+				if (dieptsiz.b.pktcnt != 0) {
+					if (xfer_size == 0) {
+						remain_to_transfer = 0;
+					} else {
+						if ((xfer_size % ep->dwc_ep.maxpacket) == 0) {
+							remain_to_transfer =
+								dieptsiz.b.pktcnt * ep->dwc_ep.maxpacket;
+						} else {
+							remain_to_transfer = ((dieptsiz.b.pktcnt -1) * ep->dwc_ep.maxpacket)
+								+ (xfer_size % ep->dwc_ep.maxpacket);
+						}
+					}
+					diepdma = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepdma);
+					dieptsiz.b.xfersize = remain_to_transfer;
+					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, dieptsiz.d32);
+					diepdma = ep->dwc_ep.dma_addr + (xfer_size - remain_to_transfer);
+					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, diepdma);
+				}
+				i = core_if->nextep_seq[i];
+			} while (i != core_if->first_in_nextep_seq);
+		} else { // dma_desc_enable
+				DWC_PRINTF("%s Learning Queue not supported in DDMA\n", __func__);
+		}
+
+		/* Restart transfers in predicted sequences */
+		i = core_if->first_in_nextep_seq;
+		do {
+			dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
+			depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+			if (dieptsiz.b.pktcnt != 0) {
+				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+				depctl.b.epena = 1;
+				depctl.b.cnak = 1;
+				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
+			}
+			i = core_if->nextep_seq[i];
+		} while (i != core_if->first_in_nextep_seq);
+
+		/* Clear the global non-periodic IN NAK handshake */
+		dctl.d32 = 0;
+		dctl.b.cgnpinnak = 1;
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+
+		/* Unmask EP Mismatch interrupt */
+		gintmsk_data.d32 = 0;
+		gintmsk_data.b.epmismatch = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, gintmsk_data.d32);
+
+		core_if->start_predict = 0;
+
+	}
+}
+
+/**
+ * Handler for the IN EP timeout handshake interrupt.
+ */
+static inline void handle_in_ep_timeout_intr(dwc_otg_pcd_t * pcd,
+					     const uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+
+#ifdef DEBUG
+	deptsiz_data_t dieptsiz = {.d32 = 0 };
+	uint32_t num = 0;
+#endif
+	dctl_data_t dctl = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep;
+
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	ep = get_in_ep(pcd, epnum);
+
+	/* Disable the NP Tx Fifo Empty Interrrupt */
+	if (!core_if->dma_enable) {
+		intr_mask.b.nptxfempty = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+				 intr_mask.d32, 0);
+	}
+	/** @todo NGS Check EP type.
+	 * Implement for Periodic EPs */
+	/*
+	 * Non-periodic EP
+	 */
+	/* Enable the Global IN NAK Effective Interrupt */
+	intr_mask.b.ginnakeff = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
+
+	/* Set Global IN NAK */
+	dctl.b.sgnpinnak = 1;
+	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+
+	ep->stopped = 1;
+
+#ifdef DEBUG
+	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[num]->dieptsiz);
+	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
+		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
+#endif
+
+#ifdef DISABLE_PERIODIC_EP
+	/*
+	 * Set the NAK bit for this EP to
+	 * start the disable process.
+	 */
+	diepctl.d32 = 0;
+	diepctl.b.snak = 1;
+	DWC_MODIFY_REG32(&dev_if->in_ep_regs[num]->diepctl, diepctl.d32,
+			 diepctl.d32);
+	ep->disabling = 1;
+	ep->stopped = 1;
+#endif
+}
+
+/**
+ * Handler for the IN EP NAK interrupt.
+ */
+static inline int32_t handle_in_ep_nak_intr(dwc_otg_pcd_t * pcd,
+					    const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	diepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "IN EP NAK");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.nak = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 diepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->diepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * Handler for the OUT EP Babble interrupt.
+ */
+static inline int32_t handle_out_ep_babble_intr(dwc_otg_pcd_t * pcd,
+						const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	doepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
+		   "OUT EP Babble");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.babble = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 doepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * Handler for the OUT EP NAK interrupt.
+ */
+static inline int32_t handle_out_ep_nak_intr(dwc_otg_pcd_t * pcd,
+					     const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	doepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_ANY, "INTERRUPT Handler not implemented for %s\n", "OUT EP NAK");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.nak = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 doepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * Handler for the OUT EP NYET interrupt.
+ */
+static inline int32_t handle_out_ep_nyet_intr(dwc_otg_pcd_t * pcd,
+					      const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	doepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "OUT EP NYET");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.nyet = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 doepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that an IN EP has a pending Interrupt.
+ * The sequence for handling the IN EP interrupt is shown below:
+ * -#	Read the Device All Endpoint Interrupt register
+ * -#	Repeat the following for each IN EP interrupt bit set (from
+ *		LSB to MSB).
+ * -#	Read the Device Endpoint Interrupt (DIEPINTn) register
+ * -#	If "Transfer Complete" call the request complete function
+ * -#	If "Endpoint Disabled" complete the EP disable procedure.
+ * -#	If "AHB Error Interrupt" log error
+ * -#	If "Time-out Handshake" log error
+ * -#	If "IN Token Received when TxFIFO Empty" write packet to Tx
+ *		FIFO.
+ * -#	If "IN Token EP Mismatch" (disable, this is handled by EP
+ *		Mismatch Interrupt)
+ */
+static int32_t dwc_otg_pcd_handle_in_ep_intr(dwc_otg_pcd_t * pcd)
+{
+#define CLEAR_IN_EP_INTR(__core_if,__epnum,__intr) \
+do { \
+		diepint_data_t diepint = {.d32=0}; \
+		diepint.b.__intr = 1; \
+		DWC_WRITE_REG32(&__core_if->dev_if->in_ep_regs[__epnum]->diepint, \
+		diepint.d32); \
+} while (0)
+
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	diepint_data_t diepint = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	uint32_t ep_intr;
+	uint32_t epnum = 0;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, pcd);
+
+	/* Read in the device interrupt bits */
+	ep_intr = dwc_otg_read_dev_all_in_ep_intr(core_if);
+
+	/* Service the Device IN interrupts for each endpoint */
+	while (ep_intr) {
+		if (ep_intr & 0x1) {
+			uint32_t empty_msk;
+			/* Get EP pointer */
+			ep = get_in_ep(pcd, epnum);
+			dwc_ep = &ep->dwc_ep;
+
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
+			empty_msk =
+			    DWC_READ_REG32(&dev_if->
+					   dev_global_regs->dtknqr4_fifoemptymsk);
+
+			DWC_DEBUGPL(DBG_PCDV,
+				    "IN EP INTERRUPT - %d\nepmty_msk - %8x  diepctl - %8x\n",
+				    epnum, empty_msk, depctl.d32);
+
+			DWC_DEBUGPL(DBG_PCD,
+				    "EP%d-%s: type=%d, mps=%d\n",
+				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
+				    dwc_ep->type, dwc_ep->maxpacket);
+
+			diepint.d32 =
+			    dwc_otg_read_dev_in_ep_intr(core_if, dwc_ep);
+
+			DWC_DEBUGPL(DBG_PCDV,
+				    "EP %d Interrupt Register - 0x%x\n", epnum,
+				    diepint.d32);
+			/* Transfer complete */
+			if (diepint.b.xfercompl) {
+				/* Disable the NP Tx FIFO Empty
+				 * Interrupt */
+				if (core_if->en_multiple_tx_fifo == 0) {
+					intr_mask.b.nptxfempty = 1;
+					DWC_MODIFY_REG32
+					    (&core_if->core_global_regs->gintmsk,
+					     intr_mask.d32, 0);
+				} else {
+					/* Disable the Tx FIFO Empty Interrupt for this EP */
+					uint32_t fifoemptymsk =
+					    0x1 << dwc_ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 fifoemptymsk, 0);
+				}
+				/* Clear the bit in DIEPINTn for this interrupt */
+				CLEAR_IN_EP_INTR(core_if, epnum, xfercompl);
+
+				/* Complete the transfer */
+				if (epnum == 0) {
+					handle_ep0(pcd);
+				}
+#ifdef DWC_EN_ISOC
+				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					if (!ep->stopped)
+						complete_iso_ep(pcd, ep);
+				}
+#endif /* DWC_EN_ISOC */
+#ifdef DWC_UTE_PER_IO
+				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					if (!ep->stopped)
+						complete_xiso_ep(ep);
+				}
+#endif /* DWC_UTE_PER_IO */
+				else {
+					if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC &&
+							dwc_ep->bInterval > 1) {
+						dwc_ep->frame_num += dwc_ep->bInterval;
+						if (dwc_ep->frame_num > 0x3FFF)
+						{
+							dwc_ep->frm_overrun = 1;
+							dwc_ep->frame_num &= 0x3FFF;
+						} else
+							dwc_ep->frm_overrun = 0;
+					}
+					complete_ep(ep);
+					if(diepint.b.nak)
+						CLEAR_IN_EP_INTR(core_if, epnum, nak);
+				}
+			}
+			/* Endpoint disable      */
+			if (diepint.b.epdisabled) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d IN disabled\n",
+					    epnum);
+				handle_in_ep_disable_intr(pcd, epnum);
+
+				/* Clear the bit in DIEPINTn for this interrupt */
+				CLEAR_IN_EP_INTR(core_if, epnum, epdisabled);
+			}
+			/* AHB Error */
+			if (diepint.b.ahberr) {
+				DWC_ERROR("EP%d IN AHB Error\n", epnum);
+				/* Clear the bit in DIEPINTn for this interrupt */
+				CLEAR_IN_EP_INTR(core_if, epnum, ahberr);
+			}
+			/* TimeOUT Handshake (non-ISOC IN EPs) */
+			if (diepint.b.timeout) {
+				DWC_ERROR("EP%d IN Time-out\n", epnum);
+				handle_in_ep_timeout_intr(pcd, epnum);
+
+				CLEAR_IN_EP_INTR(core_if, epnum, timeout);
+			}
+			/** IN Token received with TxF Empty */
+			if (diepint.b.intktxfemp) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d IN TKN TxFifo Empty\n",
+					    epnum);
+				if (!ep->stopped && epnum != 0) {
+
+					diepmsk_data_t diepmsk = {.d32 = 0 };
+					diepmsk.b.intktxfemp = 1;
+
+					if (core_if->multiproc_int_enable) {
+						DWC_MODIFY_REG32
+						    (&dev_if->dev_global_regs->diepeachintmsk
+						     [epnum], diepmsk.d32, 0);
+					} else {
+						DWC_MODIFY_REG32
+						    (&dev_if->dev_global_regs->diepmsk,
+						     diepmsk.d32, 0);
+					}
+				} else if (core_if->dma_desc_enable
+					   && epnum == 0
+					   && pcd->ep0state ==
+					   EP0_OUT_STATUS_PHASE) {
+					// EP0 IN set STALL
+					depctl.d32 =
+					    DWC_READ_REG32(&dev_if->in_ep_regs
+							   [epnum]->diepctl);
+
+					/* set the disable and stall bits */
+					if (depctl.b.epena) {
+						depctl.b.epdis = 1;
+					}
+					depctl.b.stall = 1;
+					DWC_WRITE_REG32(&dev_if->in_ep_regs
+							[epnum]->diepctl,
+							depctl.d32);
+				}
+				CLEAR_IN_EP_INTR(core_if, epnum, intktxfemp);
+			}
+			/** IN Token Received with EP mismatch */
+			if (diepint.b.intknepmis) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d IN TKN EP Mismatch\n", epnum);
+				CLEAR_IN_EP_INTR(core_if, epnum, intknepmis);
+			}
+			/** IN Endpoint NAK Effective */
+			if (diepint.b.inepnakeff) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d IN EP NAK Effective\n",
+					    epnum);
+				/* Periodic EP */
+				if (ep->disabling) {
+					depctl.d32 = 0;
+					depctl.b.snak = 1;
+					depctl.b.epdis = 1;
+					DWC_MODIFY_REG32(&dev_if->in_ep_regs
+							 [epnum]->diepctl,
+							 depctl.d32,
+							 depctl.d32);
+				}
+				CLEAR_IN_EP_INTR(core_if, epnum, inepnakeff);
+
+			}
+
+			/** IN EP Tx FIFO Empty Intr */
+			if (diepint.b.emptyintr) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d Tx FIFO Empty Intr \n",
+					    epnum);
+				write_empty_tx_fifo(pcd, epnum);
+
+				CLEAR_IN_EP_INTR(core_if, epnum, emptyintr);
+
+			}
+
+			/** IN EP BNA Intr */
+			if (diepint.b.bna) {
+				CLEAR_IN_EP_INTR(core_if, epnum, bna);
+				if (core_if->dma_desc_enable) {
+#ifdef DWC_EN_ISOC
+					if (dwc_ep->type ==
+					    DWC_OTG_EP_TYPE_ISOC) {
+						/*
+						 * This checking is performed to prevent first "false" BNA
+						 * handling occuring right after reconnect
+						 */
+						if (dwc_ep->next_frame !=
+						    0xffffffff)
+							dwc_otg_pcd_handle_iso_bna(ep);
+					} else
+#endif				/* DWC_EN_ISOC */
+					{
+						dwc_otg_pcd_handle_noniso_bna(ep);
+					}
+				}
+			}
+			/* NAK Interrutp */
+			if (diepint.b.nak) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d IN NAK Interrupt\n",
+					    epnum);
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+					depctl_data_t depctl;
+					if (ep->dwc_ep.frame_num == 0xFFFFFFFF) {
+						ep->dwc_ep.frame_num = core_if->frame_num;
+						if (ep->dwc_ep.bInterval > 1) {
+							depctl.d32 = 0;
+							depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
+							if (ep->dwc_ep.frame_num & 0x1) {
+								depctl.b.setd1pid = 1;
+								depctl.b.setd0pid = 0;
+							} else {
+								depctl.b.setd0pid = 1;
+								depctl.b.setd1pid = 0;
+							}
+							DWC_WRITE_REG32(&dev_if->in_ep_regs[epnum]->diepctl, depctl.d32);
+						}
+						start_next_request(ep);
+					}
+					ep->dwc_ep.frame_num += ep->dwc_ep.bInterval;
+					if (dwc_ep->frame_num > 0x3FFF)	{
+						dwc_ep->frm_overrun = 1;
+						dwc_ep->frame_num &= 0x3FFF;
+					} else
+						dwc_ep->frm_overrun = 0;
+				}
+
+				CLEAR_IN_EP_INTR(core_if, epnum, nak);
+			}
+		}
+		epnum++;
+		ep_intr >>= 1;
+	}
+
+	return 1;
+#undef CLEAR_IN_EP_INTR
+}
+
+/**
+ * This interrupt indicates that an OUT EP has a pending Interrupt.
+ * The sequence for handling the OUT EP interrupt is shown below:
+ * -#	Read the Device All Endpoint Interrupt register
+ * -#	Repeat the following for each OUT EP interrupt bit set (from
+ *		LSB to MSB).
+ * -#	Read the Device Endpoint Interrupt (DOEPINTn) register
+ * -#	If "Transfer Complete" call the request complete function
+ * -#	If "Endpoint Disabled" complete the EP disable procedure.
+ * -#	If "AHB Error Interrupt" log error
+ * -#	If "Setup Phase Done" process Setup Packet (See Standard USB
+ *		Command Processing)
+ */
+static int32_t dwc_otg_pcd_handle_out_ep_intr(dwc_otg_pcd_t * pcd)
+{
+#define CLEAR_OUT_EP_INTR(__core_if,__epnum,__intr) \
+do { \
+		doepint_data_t doepint = {.d32=0}; \
+		doepint.b.__intr = 1; \
+		DWC_WRITE_REG32(&__core_if->dev_if->out_ep_regs[__epnum]->doepint, \
+		doepint.d32); \
+} while (0)
+
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	uint32_t ep_intr;
+	doepint_data_t doepint = {.d32 = 0 };
+	uint32_t epnum = 0;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+	dctl_data_t dctl = {.d32 = 0 };
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+
+	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
+
+	/* Read in the device interrupt bits */
+	ep_intr = dwc_otg_read_dev_all_out_ep_intr(core_if);
+
+	while (ep_intr) {
+		if (ep_intr & 0x1) {
+			/* Get EP pointer */
+			ep = get_out_ep(pcd, epnum);
+			dwc_ep = &ep->dwc_ep;
+
+#ifdef VERBOSE
+			DWC_DEBUGPL(DBG_PCDV,
+				    "EP%d-%s: type=%d, mps=%d\n",
+				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
+				    dwc_ep->type, dwc_ep->maxpacket);
+#endif
+			doepint.d32 =
+			    dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep);
+			/* Moved this interrupt upper due to core deffect of asserting
+			 * OUT EP 0 xfercompl along with stsphsrcvd in BDMA */
+			if (doepint.b.stsphsercvd) {
+				deptsiz0_data_t deptsiz;
+				CLEAR_OUT_EP_INTR(core_if, epnum, stsphsercvd);
+				deptsiz.d32 =
+				    DWC_READ_REG32(&core_if->dev_if->
+						   out_ep_regs[0]->doeptsiz);
+				if (core_if->snpsid >= OTG_CORE_REV_3_00a
+				    && core_if->dma_enable
+				    && core_if->dma_desc_enable == 0
+				    && doepint.b.xfercompl
+				    && deptsiz.b.xfersize == 24) {
+					CLEAR_OUT_EP_INTR(core_if, epnum,
+							  xfercompl);
+					doepint.b.xfercompl = 0;
+					ep0_out_start(core_if, pcd);
+				}
+				if ((core_if->dma_desc_enable) ||
+				    (core_if->dma_enable
+				     && core_if->snpsid >=
+				     OTG_CORE_REV_3_00a)) {
+					do_setup_in_status_phase(pcd);
+				}
+			}
+			/* Transfer complete */
+			if (doepint.b.xfercompl) {
+
+				if (epnum == 0) {
+					/* Clear the bit in DOEPINTn for this interrupt */
+					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
+					if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
+							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepint),
+							doepint.d32);
+						DWC_DEBUGPL(DBG_PCDV, "DOEPCTL=%x \n",
+							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepctl));
+
+						if (core_if->snpsid >= OTG_CORE_REV_3_00a
+							&& core_if->dma_enable == 0) {
+							doepint_data_t doepint;
+							doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+														out_ep_regs[0]->doepint);
+							if (pcd->ep0state == EP0_IDLE && doepint.b.sr) {
+								CLEAR_OUT_EP_INTR(core_if, epnum, sr);
+								goto exit_xfercompl;
+							}
+						}
+						/* In case of DDMA  look at SR bit to go to the Data Stage */
+						if (core_if->dma_desc_enable) {
+							dev_dma_desc_sts_t status = {.d32 = 0};
+							if (pcd->ep0state == EP0_IDLE) {
+								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
+											dev_if->setup_desc_index]->status.d32;
+								if(pcd->data_terminated) {
+									 pcd->data_terminated = 0;
+									 status.d32 = core_if->dev_if->out_desc_addr->status.d32;
+									 dwc_memcpy(&pcd->setup_pkt->req, pcd->backup_buf, 8);
+								}
+								if (status.b.sr) {
+									if (doepint.b.setup) {
+										DWC_DEBUGPL(DBG_PCDV, "DMA DESC EP0_IDLE SR=1 setup=1\n");
+										/* Already started data stage, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										/* Prepare for more setup packets */
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
+											pcd->ep0state == EP0_IN_DATA_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_PCDV,
+											"EP0_IDLE SR=1 setup=0 new setup comes\n");
+										ep0_out_start(core_if, pcd);
+									}
+								}
+							} else {
+								dwc_otg_pcd_request_t *req;
+								dev_dma_desc_sts_t status = {.d32 = 0};
+								diepint_data_t diepint0;
+								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
+															in_ep_regs[0]->diepint);
+
+								if (pcd->ep0state == EP0_STALL || pcd->ep0state == EP0_DISCONNECT) {
+									DWC_ERROR("EP0 is stalled/disconnected\n");
+								}
+
+								/* Clear IN xfercompl if set */
+								if (diepint0.b.xfercompl && (pcd->ep0state == EP0_IN_STATUS_PHASE
+									|| pcd->ep0state == EP0_IN_DATA_PHASE)) {
+									DWC_WRITE_REG32(&core_if->dev_if->
+										in_ep_regs[0]->diepint, diepint0.d32);
+								}
+
+								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
+									dev_if->setup_desc_index]->status.d32;
+
+								if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len
+									&& (pcd->ep0state == EP0_OUT_DATA_PHASE))
+									status.d32 = core_if->dev_if->out_desc_addr->status.d32;
+								if (pcd->ep0state == EP0_OUT_STATUS_PHASE)
+									status.d32 = core_if->dev_if->
+									out_desc_addr->status.d32;
+
+								if (status.b.sr) {
+									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
+									} else {
+										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
+										req = DWC_CIRCLEQ_FIRST(&ep->queue);
+										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
+											pcd->ep0state == EP0_OUT_DATA_PHASE) {
+												/* Read arrived setup packet from req->buf */
+												dwc_memcpy(&pcd->setup_pkt->req,
+													req->buf + ep->dwc_ep.xfer_count, 8);
+										}
+										req->actual = ep->dwc_ep.xfer_count;
+										dwc_otg_request_done(ep, req, -ECONNRESET);
+										ep->dwc_ep.start_xfer_buff = 0;
+										ep->dwc_ep.xfer_buff = 0;
+										ep->dwc_ep.xfer_len = 0;
+									}
+									pcd->ep0state = EP0_IDLE;
+									if (doepint.b.setup) {
+										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
+										/* Data stage started, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										/* Prepare for setup packets if ep0in was enabled*/
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_PCDV,
+											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
+										ep0_out_start(core_if, pcd);
+									}
+								}
+							}
+						}
+						if (core_if->snpsid >= OTG_CORE_REV_2_94a && core_if->dma_enable
+							&& core_if->dma_desc_enable == 0) {
+							doepint_data_t doepint_temp = {.d32 = 0};
+							deptsiz0_data_t doeptsize0 = {.d32 = 0 };
+							doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
+															out_ep_regs[ep->dwc_ep.num]->doepint);
+							doeptsize0.d32 = DWC_READ_REG32(&core_if->dev_if->
+															out_ep_regs[ep->dwc_ep.num]->doeptsiz);
+							if (pcd->ep0state == EP0_IDLE) {
+								if (doepint_temp.b.sr) {
+									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
+								}
+									doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+																	out_ep_regs[0]->doepint);
+									if (doeptsize0.b.supcnt == 3) {
+										DWC_DEBUGPL(DBG_ANY, "Rolling over!!!!!!!\n");
+										ep->dwc_ep.stp_rollover = 1;
+									}
+									if (doepint.b.setup) {
+retry:
+										/* Already started data stage, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										ep->dwc_ep.stp_rollover = 0;
+										/* Prepare for more setup packets */
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
+											pcd->ep0state == EP0_IN_DATA_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_ANY,
+											"EP0_IDLE SR=1 setup=0 new setup comes\n");
+										doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+																	out_ep_regs[0]->doepint);
+										if(doepint.b.setup)
+											goto retry;
+										ep0_out_start(core_if, pcd);
+									}
+							} else {
+								dwc_otg_pcd_request_t *req;
+								diepint_data_t diepint0 = {.d32 = 0};
+								doepint_data_t doepint_temp = {.d32 = 0};
+								depctl_data_t diepctl0;
+								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
+																in_ep_regs[0]->diepint);
+								diepctl0.d32 = DWC_READ_REG32(&core_if->dev_if->
+																in_ep_regs[0]->diepctl);
+
+								if (pcd->ep0state == EP0_IN_DATA_PHASE
+									|| pcd->ep0state == EP0_IN_STATUS_PHASE) {
+									if (diepint0.b.xfercompl) {
+										DWC_WRITE_REG32(&core_if->dev_if->
+											in_ep_regs[0]->diepint, diepint0.d32);
+									}
+									if (diepctl0.b.epena) {
+										diepint_data_t diepint = {.d32 = 0};
+										diepctl0.b.snak = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->
+														in_ep_regs[0]->diepctl, diepctl0.d32);
+										do {
+											dwc_udelay(10);
+											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+												in_ep_regs[0]->diepint);
+										} while (!diepint.b.inepnakeff);
+										diepint.b.inepnakeff = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->
+											in_ep_regs[0]->diepint, diepint.d32);
+										diepctl0.d32 = 0;
+										diepctl0.b.epdis = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl,
+														diepctl0.d32);
+										do {
+											dwc_udelay(10);
+											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+												in_ep_regs[0]->diepint);
+										} while (!diepint.b.epdisabled);
+										diepint.b.epdisabled = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepint,
+															diepint.d32);
+									}
+								}
+								doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
+																out_ep_regs[ep->dwc_ep.num]->doepint);
+								if (doepint_temp.b.sr) {
+									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
+									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
+									} else {
+										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
+										req = DWC_CIRCLEQ_FIRST(&ep->queue);
+										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
+											pcd->ep0state == EP0_OUT_DATA_PHASE) {
+												/* Read arrived setup packet from req->buf */
+												dwc_memcpy(&pcd->setup_pkt->req,
+													req->buf + ep->dwc_ep.xfer_count, 8);
+										}
+										req->actual = ep->dwc_ep.xfer_count;
+										dwc_otg_request_done(ep, req, -ECONNRESET);
+										ep->dwc_ep.start_xfer_buff = 0;
+										ep->dwc_ep.xfer_buff = 0;
+										ep->dwc_ep.xfer_len = 0;
+									}
+									pcd->ep0state = EP0_IDLE;
+									if (doepint.b.setup) {
+										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
+										/* Data stage started, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										/* Prepare for setup packets if ep0in was enabled*/
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_PCDV,
+											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
+										ep0_out_start(core_if, pcd);
+									}
+								}
+							}
+						}
+						if (core_if->dma_enable == 0 || pcd->ep0state != EP0_IDLE)
+							handle_ep0(pcd);
+exit_xfercompl:
+						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
+							dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep), doepint.d32);
+					} else {
+					if (core_if->dma_desc_enable == 0
+					    || pcd->ep0state != EP0_IDLE)
+						handle_ep0(pcd);
+					}
+#ifdef DWC_EN_ISOC
+				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					if (doepint.b.pktdrpsts == 0) {
+						/* Clear the bit in DOEPINTn for this interrupt */
+						CLEAR_OUT_EP_INTR(core_if,
+								  epnum,
+								  xfercompl);
+						complete_iso_ep(pcd, ep);
+					} else {
+
+						doepint_data_t doepint = {.d32 = 0 };
+						doepint.b.xfercompl = 1;
+						doepint.b.pktdrpsts = 1;
+						DWC_WRITE_REG32
+						    (&core_if->dev_if->out_ep_regs
+						     [epnum]->doepint,
+						     doepint.d32);
+						if (handle_iso_out_pkt_dropped
+						    (core_if, dwc_ep)) {
+							complete_iso_ep(pcd,
+									ep);
+						}
+					}
+#endif /* DWC_EN_ISOC */
+#ifdef DWC_UTE_PER_IO
+				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
+					if (!ep->stopped)
+						complete_xiso_ep(ep);
+#endif /* DWC_UTE_PER_IO */
+				} else {
+					/* Clear the bit in DOEPINTn for this interrupt */
+					CLEAR_OUT_EP_INTR(core_if, epnum,
+							  xfercompl);
+
+					if (core_if->core_params->dev_out_nak) {
+						DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[epnum]);
+						pcd->core_if->ep_xfer_info[epnum].state = 0;
+#ifdef DEBUG
+						print_memory_payload(pcd, dwc_ep);
+#endif
+					}
+					complete_ep(ep);
+				}
+
+			}
+
+			/* Endpoint disable      */
+			if (doepint.b.epdisabled) {
+
+				/* Clear the bit in DOEPINTn for this interrupt */
+				CLEAR_OUT_EP_INTR(core_if, epnum, epdisabled);
+				if (core_if->core_params->dev_out_nak) {
+#ifdef DEBUG
+					print_memory_payload(pcd, dwc_ep);
+#endif
+					/* In case of timeout condition */
+					if (core_if->ep_xfer_info[epnum].state == 2) {
+						dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
+										dev_global_regs->dctl);
+						dctl.b.cgoutnak = 1;
+						DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
+																dctl.d32);
+						/* Unmask goutnakeff interrupt which was masked
+						 * during handle nak out interrupt */
+						gintmsk.b.goutnakeff = 1;
+						DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+																0, gintmsk.d32);
+
+						complete_ep(ep);
+					}
+				}
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
+				{
+					dctl_data_t dctl;
+					gintmsk_data_t intr_mask = {.d32 = 0};
+					dwc_otg_pcd_request_t *req = 0;
+
+					dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
+						dev_global_regs->dctl);
+					dctl.b.cgoutnak = 1;
+					DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
+						dctl.d32);
+
+					intr_mask.d32 = 0;
+					intr_mask.b.incomplisoout = 1;
+
+					/* Get any pending requests */
+					if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+						req = DWC_CIRCLEQ_FIRST(&ep->queue);
+						if (!req) {
+							DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
+						} else {
+							dwc_otg_request_done(ep, req, 0);
+							start_next_request(ep);
+						}
+					} else {
+						DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
+					}
+				}
+			}
+			/* AHB Error */
+			if (doepint.b.ahberr) {
+				DWC_ERROR("EP%d OUT AHB Error\n", epnum);
+				DWC_ERROR("EP%d DEPDMA=0x%08x \n",
+					  epnum, core_if->dev_if->out_ep_regs[epnum]->doepdma);
+				CLEAR_OUT_EP_INTR(core_if, epnum, ahberr);
+			}
+			/* Setup Phase Done (contorl EPs) */
+			if (doepint.b.setup) {
+#ifdef DEBUG_EP0
+				DWC_DEBUGPL(DBG_PCD, "EP%d SETUP Done\n", epnum);
+#endif
+				CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+
+				handle_ep0(pcd);
+			}
+
+			/** OUT EP BNA Intr */
+			if (doepint.b.bna) {
+				CLEAR_OUT_EP_INTR(core_if, epnum, bna);
+				if (core_if->dma_desc_enable) {
+#ifdef DWC_EN_ISOC
+					if (dwc_ep->type ==
+					    DWC_OTG_EP_TYPE_ISOC) {
+						/*
+						 * This checking is performed to prevent first "false" BNA
+						 * handling occuring right after reconnect
+						 */
+						if (dwc_ep->next_frame !=
+						    0xffffffff)
+							dwc_otg_pcd_handle_iso_bna(ep);
+					} else
+#endif				/* DWC_EN_ISOC */
+					{
+						dwc_otg_pcd_handle_noniso_bna(ep);
+					}
+				}
+			}
+			/* Babble Interrupt */
+			if (doepint.b.babble) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Babble\n",
+					    epnum);
+				handle_out_ep_babble_intr(pcd, epnum);
+
+				CLEAR_OUT_EP_INTR(core_if, epnum, babble);
+			}
+			if (doepint.b.outtknepdis) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Token received when EP is \
+					disabled\n",epnum);
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+					doepmsk_data_t doepmsk = {.d32 = 0};
+					ep->dwc_ep.frame_num = core_if->frame_num;
+					if (ep->dwc_ep.bInterval > 1) {
+						depctl_data_t depctl;
+						depctl.d32 = DWC_READ_REG32(&core_if->dev_if->
+													out_ep_regs[epnum]->doepctl);
+						if (ep->dwc_ep.frame_num & 0x1) {
+							depctl.b.setd1pid = 1;
+							depctl.b.setd0pid = 0;
+						} else {
+							depctl.b.setd0pid = 1;
+							depctl.b.setd1pid = 0;
+						}
+						DWC_WRITE_REG32(&core_if->dev_if->
+										out_ep_regs[epnum]->doepctl, depctl.d32);
+					}
+					start_next_request(ep);
+					doepmsk.b.outtknepdis = 1;
+					DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+								 doepmsk.d32, 0);
+				}
+				CLEAR_OUT_EP_INTR(core_if, epnum, outtknepdis);
+			}
+
+			/* NAK Interrutp */
+			if (doepint.b.nak) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NAK\n", epnum);
+				handle_out_ep_nak_intr(pcd, epnum);
+
+				CLEAR_OUT_EP_INTR(core_if, epnum, nak);
+			}
+			/* NYET Interrutp */
+			if (doepint.b.nyet) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NYET\n", epnum);
+				handle_out_ep_nyet_intr(pcd, epnum);
+
+				CLEAR_OUT_EP_INTR(core_if, epnum, nyet);
+			}
+		}
+
+		epnum++;
+		ep_intr >>= 1;
+	}
+
+	return 1;
+
+#undef CLEAR_OUT_EP_INTR
+}
+static int drop_transfer(uint32_t trgt_fr, uint32_t curr_fr, uint8_t frm_overrun)
+{
+	int retval = 0;
+	if(!frm_overrun && curr_fr >= trgt_fr)
+		retval = 1;
+	else if (frm_overrun
+		 && (curr_fr >= trgt_fr && ((curr_fr - trgt_fr) < 0x3FFF / 2)))
+		retval = 1;
+	return retval;
+}
+/**
+ * Incomplete ISO IN Transfer Interrupt.
+ * This interrupt indicates one of the following conditions occurred
+ * while transmitting an ISOC transaction.
+ * - Corrupted IN Token for ISOC EP.
+ * - Packet not complete in FIFO.
+ * The follow actions will be taken:
+ *	-#	Determine the EP
+ *	-#	Set incomplete flag in dwc_ep structure
+ *	-#	Disable EP; when "Endpoint Disabled" interrupt is received
+ *		Flush FIFO
+ */
+int32_t dwc_otg_pcd_handle_incomplete_isoc_in_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+
+#ifdef DWC_EN_ISOC
+	dwc_otg_dev_if_t *dev_if;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dsts_data_t dsts = {.d32 = 0 };
+	dwc_ep_t *dwc_ep;
+	int i;
+
+	dev_if = GET_CORE_IF(pcd)->dev_if;
+
+	for (i = 1; i <= dev_if->num_in_eps; ++i) {
+		dwc_ep = &pcd->in_ep[i].dwc_ep;
+		if (dwc_ep->active && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			deptsiz.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+
+			if (depctl.b.epdis && deptsiz.d32) {
+				set_current_pkt_info(GET_CORE_IF(pcd), dwc_ep);
+				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+					dwc_ep->cur_pkt = 0;
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+
+					if (dwc_ep->proc_buf_num) {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff1;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr1;
+					} else {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff0;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr0;
+					}
+
+				}
+
+				dsts.d32 =
+				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
+						   dev_global_regs->dsts);
+				dwc_ep->next_frame = dsts.b.soffn;
+
+				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
+								  (pcd),
+								  dwc_ep);
+			}
+		}
+	}
+
+#else
+	depctl_data_t depctl = {.d32 = 0 };
+	dwc_ep_t *dwc_ep;
+	dwc_otg_dev_if_t *dev_if;
+	int i;
+	dev_if = GET_CORE_IF(pcd)->dev_if;
+
+	DWC_DEBUGPL(DBG_PCD,"Incomplete ISO IN \n");
+
+	for (i = 1; i <= dev_if->num_in_eps; ++i) {
+		dwc_ep = &pcd->in_ep[i-1].dwc_ep;
+		depctl.d32 =
+			DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+		if (depctl.b.epena && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			if (drop_transfer(dwc_ep->frame_num, GET_CORE_IF(pcd)->frame_num,
+							dwc_ep->frm_overrun))
+			{
+				depctl.d32 =
+					DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+				depctl.b.snak = 1;
+				depctl.b.epdis = 1;
+				DWC_MODIFY_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32, depctl.d32);
+			}
+		}
+	}
+
+	/*intr_mask.b.incomplisoin = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);	 */
+#endif				//DWC_EN_ISOC
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.incomplisoin = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * Incomplete ISO OUT Transfer Interrupt.
+ *
+ * This interrupt indicates that the core has dropped an ISO OUT
+ * packet. The following conditions can be the cause:
+ * - FIFO Full, the entire packet would not fit in the FIFO.
+ * - CRC Error
+ * - Corrupted Token
+ * The follow actions will be taken:
+ *	-#	Determine the EP
+ *	-#	Set incomplete flag in dwc_ep structure
+ *	-#	Read any data from the FIFO
+ *	-#	Disable EP. When "Endpoint Disabled" interrupt is received
+ *		re-enable EP.
+ */
+int32_t dwc_otg_pcd_handle_incomplete_isoc_out_intr(dwc_otg_pcd_t * pcd)
+{
+
+	gintsts_data_t gintsts;
+
+#ifdef DWC_EN_ISOC
+	dwc_otg_dev_if_t *dev_if;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dsts_data_t dsts = {.d32 = 0 };
+	dwc_ep_t *dwc_ep;
+	int i;
+
+	dev_if = GET_CORE_IF(pcd)->dev_if;
+
+	for (i = 1; i <= dev_if->num_out_eps; ++i) {
+		dwc_ep = &pcd->in_ep[i].dwc_ep;
+		if (pcd->out_ep[i].dwc_ep.active &&
+		    pcd->out_ep[i].dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+			deptsiz.d32 =
+			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doeptsiz);
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
+
+			if (depctl.b.epdis && deptsiz.d32) {
+				set_current_pkt_info(GET_CORE_IF(pcd),
+						     &pcd->out_ep[i].dwc_ep);
+				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+					dwc_ep->cur_pkt = 0;
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+
+					if (dwc_ep->proc_buf_num) {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff1;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr1;
+					} else {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff0;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr0;
+					}
+
+				}
+
+				dsts.d32 =
+				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
+						   dev_global_regs->dsts);
+				dwc_ep->next_frame = dsts.b.soffn;
+
+				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
+								  (pcd),
+								  dwc_ep);
+			}
+		}
+	}
+#else
+	/** @todo implement ISR */
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+	dwc_ep_t *dwc_ep = NULL;
+	int i;
+	core_if = GET_CORE_IF(pcd);
+
+	for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
+		dwc_ep = &pcd->out_ep[i].dwc_ep;
+		depctl.d32 =
+			DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
+		if (depctl.b.epena && depctl.b.dpid == (core_if->frame_num & 0x1)) {
+			core_if->dev_if->isoc_ep = dwc_ep;
+			deptsiz.d32 =
+					DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz);
+				break;
+		}
+	}
+	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	intr_mask.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+
+	if (!intr_mask.b.goutnakeff) {
+		/* Unmask it */
+		intr_mask.b.goutnakeff = 1;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32);
+	}
+	if (!gintsts.b.goutnakeff) {
+		dctl.b.sgoutnak = 1;
+	}
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+
+	depctl.d32 = DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
+	if (depctl.b.epena) {
+		depctl.b.epdis = 1;
+		depctl.b.snak = 1;
+	}
+	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl, depctl.d32);
+
+	intr_mask.d32 = 0;
+	intr_mask.b.incomplisoout = 1;
+
+#endif /* DWC_EN_ISOC */
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.incomplisoout = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This function handles the Global IN NAK Effective interrupt.
+ *
+ */
+int32_t dwc_otg_pcd_handle_in_nak_effective(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	depctl_data_t diepctl = {.d32 = 0 };
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	int i;
+
+	DWC_DEBUGPL(DBG_PCD, "Global IN NAK Effective\n");
+
+	/* Disable all active IN EPs */
+	for (i = 0; i <= dev_if->num_in_eps; i++) {
+		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+		if (!(diepctl.b.eptype & 1) && diepctl.b.epena) {
+			if (core_if->start_predict > 0)
+				core_if->start_predict++;
+			diepctl.b.epdis = 1;
+			diepctl.b.snak = 1;
+			DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, diepctl.d32);
+		}
+	}
+
+
+	/* Disable the Global IN NAK Effective Interrupt */
+	intr_mask.b.ginnakeff = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.ginnakeff = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * OUT NAK Effective.
+ *
+ */
+int32_t dwc_otg_pcd_handle_out_nak_effective(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	depctl_data_t doepctl;
+	int i;
+
+	/* Disable the Global OUT NAK Effective Interrupt */
+	intr_mask.b.goutnakeff = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+		intr_mask.d32, 0);
+
+	/* If DEV OUT NAK enabled*/
+	if (pcd->core_if->core_params->dev_out_nak) {
+		/* Run over all out endpoints to determine the ep number on
+		 * which the timeout has happened
+		 */
+		for (i = 0; i <= dev_if->num_out_eps; i++) {
+			if ( pcd->core_if->ep_xfer_info[i].state == 2 )
+				break;
+		}
+		if (i > dev_if->num_out_eps) {
+			dctl_data_t dctl;
+			dctl.d32 =
+			    DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
+			dctl.b.cgoutnak = 1;
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl,
+				dctl.d32);
+			goto out;
+		}
+
+		/* Disable the endpoint */
+		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
+		if (doepctl.b.epena) {
+			doepctl.b.epdis = 1;
+			doepctl.b.snak = 1;
+		}
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
+		return 1;
+	}
+	/* We come here from Incomplete ISO OUT handler */
+	if (dev_if->isoc_ep) {
+		dwc_ep_t *dwc_ep = (dwc_ep_t *)dev_if->isoc_ep;
+		uint32_t epnum = dwc_ep->num;
+		doepint_data_t doepint;
+		doepint.d32 =
+		    DWC_READ_REG32(&dev_if->out_ep_regs[dwc_ep->num]->doepint);
+		dev_if->isoc_ep = NULL;
+		doepctl.d32 =
+		    DWC_READ_REG32(&dev_if->out_ep_regs[epnum]->doepctl);
+		DWC_PRINTF("Before disable DOEPCTL = %08x\n", doepctl.d32);
+		if (doepctl.b.epena) {
+			doepctl.b.epdis = 1;
+			doepctl.b.snak = 1;
+		}
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[epnum]->doepctl,
+				doepctl.d32);
+		return 1;
+	} else
+		DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
+			   "Global OUT NAK Effective\n");
+
+out:
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.goutnakeff = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * PCD interrupt handler.
+ *
+ * The PCD handles the device interrupts.  Many conditions can cause a
+ * device interrupt. When an interrupt occurs, the device interrupt
+ * service routine determines the cause of the interrupt and
+ * dispatches handling to the appropriate function. These interrupt
+ * handling functions are described below.
+ *
+ * All interrupt registers are processed from LSB to MSB.
+ *
+ */
+int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+#ifdef VERBOSE
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+#endif
+	gintsts_data_t gintr_status;
+	int32_t retval = 0;
+
+	/* Exit from ISR if core is hibernated */
+	if (core_if->hibernation_suspend == 1) {
+		return retval;
+	}
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_ANY, "%s() gintsts=%08x	 gintmsk=%08x\n",
+		    __func__,
+		    DWC_READ_REG32(&global_regs->gintsts),
+		    DWC_READ_REG32(&global_regs->gintmsk));
+#endif
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		DWC_SPINLOCK(pcd->lock);
+#ifdef VERBOSE
+		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%08x  gintmsk=%08x\n",
+			    __func__,
+			    DWC_READ_REG32(&global_regs->gintsts),
+			    DWC_READ_REG32(&global_regs->gintmsk));
+#endif
+
+		gintr_status.d32 = dwc_otg_read_core_intr(core_if);
+
+		DWC_DEBUGPL(DBG_PCDV, "%s: gintsts&gintmsk=%08x\n",
+			    __func__, gintr_status.d32);
+
+		if (gintr_status.b.sofintr) {
+			retval |= dwc_otg_pcd_handle_sof_intr(pcd);
+		}
+		if (gintr_status.b.rxstsqlvl) {
+			retval |=
+			    dwc_otg_pcd_handle_rx_status_q_level_intr(pcd);
+		}
+		if (gintr_status.b.nptxfempty) {
+			retval |= dwc_otg_pcd_handle_np_tx_fifo_empty_intr(pcd);
+		}
+		if (gintr_status.b.goutnakeff) {
+			retval |= dwc_otg_pcd_handle_out_nak_effective(pcd);
+		}
+		if (gintr_status.b.i2cintr) {
+			retval |= dwc_otg_pcd_handle_i2c_intr(pcd);
+		}
+		if (gintr_status.b.erlysuspend) {
+			retval |= dwc_otg_pcd_handle_early_suspend_intr(pcd);
+		}
+		if (gintr_status.b.usbreset) {
+			retval |= dwc_otg_pcd_handle_usb_reset_intr(pcd);
+		}
+		if (gintr_status.b.enumdone) {
+			retval |= dwc_otg_pcd_handle_enum_done_intr(pcd);
+		}
+		if (gintr_status.b.isooutdrop) {
+			retval |=
+			    dwc_otg_pcd_handle_isoc_out_packet_dropped_intr
+			    (pcd);
+		}
+		if (gintr_status.b.eopframe) {
+			retval |=
+			    dwc_otg_pcd_handle_end_periodic_frame_intr(pcd);
+		}
+		if (gintr_status.b.inepint) {
+			if (!core_if->multiproc_int_enable) {
+				retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
+			}
+		}
+		if (gintr_status.b.outepintr) {
+			if (!core_if->multiproc_int_enable) {
+				retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
+			}
+		}
+		if (gintr_status.b.epmismatch) {
+			retval |= dwc_otg_pcd_handle_ep_mismatch_intr(pcd);
+		}
+		if (gintr_status.b.fetsusp) {
+			retval |= dwc_otg_pcd_handle_ep_fetsusp_intr(pcd);
+		}
+		if (gintr_status.b.ginnakeff) {
+			retval |= dwc_otg_pcd_handle_in_nak_effective(pcd);
+		}
+		if (gintr_status.b.incomplisoin) {
+			retval |=
+			    dwc_otg_pcd_handle_incomplete_isoc_in_intr(pcd);
+		}
+		if (gintr_status.b.incomplisoout) {
+			retval |=
+			    dwc_otg_pcd_handle_incomplete_isoc_out_intr(pcd);
+		}
+
+		/* In MPI mode Device Endpoints interrupts are asserted
+		 * without setting outepintr and inepint bits set, so these
+		 * Interrupt handlers are called without checking these bit-fields
+		 */
+		if (core_if->multiproc_int_enable) {
+			retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
+			retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
+		}
+#ifdef VERBOSE
+		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%0x\n", __func__,
+			    DWC_READ_REG32(&global_regs->gintsts));
+#endif
+		DWC_SPINUNLOCK(pcd->lock);
+	}
+	return retval;
+}
+
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
new file mode 100644
index 0000000000000..e799f15f29470
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
@@ -0,0 +1,1280 @@
+ /* ==========================================================================
+  * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_linux.c $
+  * $Revision: #21 $
+  * $Date: 2012/08/10 $
+  * $Change: 2047372 $
+  *
+  * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+  * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+  * otherwise expressly agreed to in writing between Synopsys and you.
+  *
+  * The Software IS NOT an item of Licensed Software or Licensed Product under
+  * any End User Software License Agreement or Agreement for Licensed Product
+  * with Synopsys or any supplement thereto. You are permitted to use and
+  * redistribute this Software in source and binary forms, with or without
+  * modification, provided that redistributions of source code must retain this
+  * notice. You may not view, use, disclose, copy or distribute this file or
+  * any information contained herein except pursuant to this license grant from
+  * Synopsys. If you do not agree with this notice, including the disclaimer
+  * below, then you are not authorized to use the Software.
+  *
+  * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+  * DAMAGE.
+  * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+/** @file
+ * This file implements the Peripheral Controller Driver.
+ *
+ * The Peripheral Controller Driver (PCD) is responsible for
+ * translating requests from the Function Driver into the appropriate
+ * actions on the DWC_otg controller. It isolates the Function Driver
+ * from the specifics of the controller by providing an API to the
+ * Function Driver.
+ *
+ * The Peripheral Controller Driver for Linux will implement the
+ * Gadget API, so that the existing Gadget drivers can be used.
+ * (Gadget Driver is the Linux terminology for a Function Driver.)
+ *
+ * The Linux Gadget API is defined in the header file
+ * <code><linux/usb_gadget.h></code>.  The USB EP operations API is
+ * defined in the structure <code>usb_ep_ops</code> and the USB
+ * Controller API is defined in the structure
+ * <code>usb_gadget_ops</code>.
+ *
+ */
+
+#include "dwc_otg_os_dep.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_pcd.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_dbg.h"
+
+extern bool fiq_enable;
+
+static struct gadget_wrapper {
+	dwc_otg_pcd_t *pcd;
+
+	struct usb_gadget gadget;
+	struct usb_gadget_driver *driver;
+
+	struct usb_ep ep0;
+	struct usb_ep in_ep[16];
+	struct usb_ep out_ep[16];
+
+} *gadget_wrapper;
+
+/* Display the contents of the buffer */
+extern void dump_msg(const u8 * buf, unsigned int length);
+/**
+ * Get the dwc_otg_pcd_ep_t* from usb_ep* pointer - NULL in case
+ * if the endpoint is not found
+ */
+static struct dwc_otg_pcd_ep *ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
+{
+	int i;
+	if (pcd->ep0.priv == handle) {
+		return &pcd->ep0;
+	}
+
+	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
+		if (pcd->in_ep[i].priv == handle)
+			return &pcd->in_ep[i];
+		if (pcd->out_ep[i].priv == handle)
+			return &pcd->out_ep[i];
+	}
+
+	return NULL;
+}
+
+/* USB Endpoint Operations */
+/*
+ * The following sections briefly describe the behavior of the Gadget
+ * API endpoint operations implemented in the DWC_otg driver
+ * software. Detailed descriptions of the generic behavior of each of
+ * these functions can be found in the Linux header file
+ * include/linux/usb_gadget.h.
+ *
+ * The Gadget API provides wrapper functions for each of the function
+ * pointers defined in usb_ep_ops. The Gadget Driver calls the wrapper
+ * function, which then calls the underlying PCD function. The
+ * following sections are named according to the wrapper
+ * functions. Within each section, the corresponding DWC_otg PCD
+ * function name is specified.
+ *
+ */
+
+/**
+ * This function is called by the Gadget Driver for each EP to be
+ * configured for the current configuration (SET_CONFIGURATION).
+ *
+ * This function initializes the dwc_otg_ep_t data structure, and then
+ * calls dwc_otg_ep_activate.
+ */
+static int ep_enable(struct usb_ep *usb_ep,
+		     const struct usb_endpoint_descriptor *ep_desc)
+{
+	int retval;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, ep_desc);
+
+	if (!usb_ep || !ep_desc || ep_desc->bDescriptorType != USB_DT_ENDPOINT) {
+		DWC_WARN("%s, bad ep or descriptor\n", __func__);
+		return -EINVAL;
+	}
+	if (usb_ep == &gadget_wrapper->ep0) {
+		DWC_WARN("%s, bad ep(0)\n", __func__);
+		return -EINVAL;
+	}
+
+	/* Check FIFO size? */
+	if (!ep_desc->wMaxPacketSize) {
+		DWC_WARN("%s, bad %s maxpacket\n", __func__, usb_ep->name);
+		return -ERANGE;
+	}
+
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_WARN("%s, bogus device state\n", __func__);
+		return -ESHUTDOWN;
+	}
+
+	/* Delete after check - MAS */
+#if 0
+	nat = (uint32_t) ep_desc->wMaxPacketSize;
+	printk(KERN_ALERT "%s: nat (before) =%d\n", __func__, nat);
+	nat = (nat >> 11) & 0x03;
+	printk(KERN_ALERT "%s: nat (after) =%d\n", __func__, nat);
+#endif
+	retval = dwc_otg_pcd_ep_enable(gadget_wrapper->pcd,
+				       (const uint8_t *)ep_desc,
+				       (void *)usb_ep);
+	if (retval) {
+		DWC_WARN("dwc_otg_pcd_ep_enable failed\n");
+		return -EINVAL;
+	}
+
+	usb_ep->maxpacket = le16_to_cpu(ep_desc->wMaxPacketSize);
+
+	return 0;
+}
+
+/**
+ * This function is called when an EP is disabled due to disconnect or
+ * change in configuration. Any pending requests will terminate with a
+ * status of -ESHUTDOWN.
+ *
+ * This function modifies the dwc_otg_ep_t data structure for this EP,
+ * and then calls dwc_otg_ep_deactivate.
+ */
+static int ep_disable(struct usb_ep *usb_ep)
+{
+	int retval;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, usb_ep);
+	if (!usb_ep) {
+		DWC_DEBUGPL(DBG_PCD, "%s, %s not enabled\n", __func__,
+			    usb_ep ? usb_ep->name : NULL);
+		return -EINVAL;
+	}
+
+	retval = dwc_otg_pcd_ep_disable(gadget_wrapper->pcd, usb_ep);
+	if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+/**
+ * This function allocates a request object to use with the specified
+ * endpoint.
+ *
+ * @param ep The endpoint to be used with with the request
+ * @param gfp_flags the GFP_* flags to use.
+ */
+static struct usb_request *dwc_otg_pcd_alloc_request(struct usb_ep *ep,
+						     gfp_t gfp_flags)
+{
+	struct usb_request *usb_req;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d)\n", __func__, ep, gfp_flags);
+	if (0 == ep) {
+		DWC_WARN("%s() %s\n", __func__, "Invalid EP!\n");
+		return 0;
+	}
+	usb_req = kzalloc(sizeof(*usb_req), gfp_flags);
+	if (0 == usb_req) {
+		DWC_WARN("%s() %s\n", __func__, "request allocation failed!\n");
+		return 0;
+	}
+	usb_req->dma = DWC_DMA_ADDR_INVALID;
+
+	return usb_req;
+}
+
+/**
+ * This function frees a request object.
+ *
+ * @param ep The endpoint associated with the request
+ * @param req The request being freed
+ */
+static void dwc_otg_pcd_free_request(struct usb_ep *ep, struct usb_request *req)
+{
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, ep, req);
+
+	if (0 == ep || 0 == req) {
+		DWC_WARN("%s() %s\n", __func__,
+			 "Invalid ep or req argument!\n");
+		return;
+	}
+
+	kfree(req);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+/**
+ * This function allocates an I/O buffer to be used for a transfer
+ * to/from the specified endpoint.
+ *
+ * @param usb_ep The endpoint to be used with with the request
+ * @param bytes The desired number of bytes for the buffer
+ * @param dma Pointer to the buffer's DMA address; must be valid
+ * @param gfp_flags the GFP_* flags to use.
+ * @return address of a new buffer or null is buffer could not be allocated.
+ */
+static void *dwc_otg_pcd_alloc_buffer(struct usb_ep *usb_ep, unsigned bytes,
+				      dma_addr_t * dma, gfp_t gfp_flags)
+{
+	void *buf;
+	dwc_otg_pcd_t *pcd = 0;
+
+	pcd = gadget_wrapper->pcd;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d,%p,%0x)\n", __func__, usb_ep, bytes,
+		    dma, gfp_flags);
+
+	/* Check dword alignment */
+	if ((bytes & 0x3UL) != 0) {
+		DWC_WARN("%s() Buffer size is not a multiple of"
+			 "DWORD size (%d)", __func__, bytes);
+	}
+
+	buf = dma_alloc_coherent(NULL, bytes, dma, gfp_flags);
+	WARN_ON(!buf);
+
+	/* Check dword alignment */
+	if (((int)buf & 0x3UL) != 0) {
+		DWC_WARN("%s() Buffer is not DWORD aligned (%p)",
+			 __func__, buf);
+	}
+
+	return buf;
+}
+
+/**
+ * This function frees an I/O buffer that was allocated by alloc_buffer.
+ *
+ * @param usb_ep the endpoint associated with the buffer
+ * @param buf address of the buffer
+ * @param dma The buffer's DMA address
+ * @param bytes The number of bytes of the buffer
+ */
+static void dwc_otg_pcd_free_buffer(struct usb_ep *usb_ep, void *buf,
+				    dma_addr_t dma, unsigned bytes)
+{
+	dwc_otg_pcd_t *pcd = 0;
+
+	pcd = gadget_wrapper->pcd;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%0x,%d)\n", __func__, buf, dma, bytes);
+
+	dma_free_coherent(NULL, bytes, buf, dma);
+}
+#endif
+
+/**
+ * This function is used to submit an I/O Request to an EP.
+ *
+ *	- When the request completes the request's completion callback
+ *	  is called to return the request to the driver.
+ *	- An EP, except control EPs, may have multiple requests
+ *	  pending.
+ *	- Once submitted the request cannot be examined or modified.
+ *	- Each request is turned into one or more packets.
+ *	- A BULK EP can queue any amount of data; the transfer is
+ *	  packetized.
+ *	- Zero length Packets are specified with the request 'zero'
+ *	  flag.
+ */
+static int ep_queue(struct usb_ep *usb_ep, struct usb_request *usb_req,
+		    gfp_t gfp_flags)
+{
+	dwc_otg_pcd_t *pcd;
+	struct dwc_otg_pcd_ep *ep = NULL;
+	int retval = 0, is_isoc_ep = 0;
+	dma_addr_t dma_addr = DWC_DMA_ADDR_INVALID;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p,%d)\n",
+		    __func__, usb_ep, usb_req, gfp_flags);
+
+	if (!usb_req || !usb_req->complete || !usb_req->buf) {
+		DWC_WARN("bad params\n");
+		return -EINVAL;
+	}
+
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+		return -EINVAL;
+	}
+
+	pcd = gadget_wrapper->pcd;
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
+			    gadget_wrapper->gadget.speed);
+		DWC_WARN("bogus device state\n");
+		return -ESHUTDOWN;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "%s queue req %p, len %d buf %p\n",
+		    usb_ep->name, usb_req, usb_req->length, usb_req->buf);
+
+	usb_req->status = -EINPROGRESS;
+	usb_req->actual = 0;
+
+	ep = ep_from_handle(pcd, usb_ep);
+	if (ep == NULL)
+		is_isoc_ep = 0;
+	else
+		is_isoc_ep = (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) ? 1 : 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+	dma_addr = usb_req->dma;
+#else
+	if (GET_CORE_IF(pcd)->dma_enable) {
+                dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
+                struct device *dev = NULL;
+
+                if (otg_dev != NULL)
+                        dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
+
+		if (usb_req->length != 0 &&
+                    usb_req->dma == DWC_DMA_ADDR_INVALID) {
+                        dma_addr = dma_map_single(dev, usb_req->buf,
+                                                  usb_req->length,
+                                                  ep->dwc_ep.is_in ?
+                                                        DMA_TO_DEVICE:
+                                                        DMA_FROM_DEVICE);
+		}
+	}
+#endif
+
+#ifdef DWC_UTE_PER_IO
+	if (is_isoc_ep == 1) {
+		retval = dwc_otg_pcd_xiso_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
+			usb_req->length, usb_req->zero, usb_req,
+			gfp_flags == GFP_ATOMIC ? 1 : 0, &usb_req->ext_req);
+		if (retval)
+			return -EINVAL;
+
+		return 0;
+	}
+#endif
+	retval = dwc_otg_pcd_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
+				      usb_req->length, usb_req->zero, usb_req,
+				      gfp_flags == GFP_ATOMIC ? 1 : 0);
+	if (retval) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * This function cancels an I/O request from an EP.
+ */
+static int ep_dequeue(struct usb_ep *usb_ep, struct usb_request *usb_req)
+{
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, usb_req);
+
+	if (!usb_ep || !usb_req) {
+		DWC_WARN("bad argument\n");
+		return -EINVAL;
+	}
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_WARN("bogus device state\n");
+		return -ESHUTDOWN;
+	}
+	if (dwc_otg_pcd_ep_dequeue(gadget_wrapper->pcd, usb_ep, usb_req)) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * usb_ep_set_halt stalls an endpoint.
+ *
+ * usb_ep_clear_halt clears an endpoint halt and resets its data
+ * toggle.
+ *
+ * Both of these functions are implemented with the same underlying
+ * function. The behavior depends on the value argument.
+ *
+ * @param[in] usb_ep the Endpoint to halt or clear halt.
+ * @param[in] value
+ *	- 0 means clear_halt.
+ *	- 1 means set_halt,
+ *	- 2 means clear stall lock flag.
+ *	- 3 means set  stall lock flag.
+ */
+static int ep_halt(struct usb_ep *usb_ep, int value)
+{
+	int retval = 0;
+
+	DWC_DEBUGPL(DBG_PCD, "HALT %s %d\n", usb_ep->name, value);
+
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+		return -EINVAL;
+	}
+
+	retval = dwc_otg_pcd_ep_halt(gadget_wrapper->pcd, usb_ep, value);
+	if (retval == -DWC_E_AGAIN) {
+		return -EAGAIN;
+	} else if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+//#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
+#if 0
+/**
+ * ep_wedge: sets the halt feature and ignores clear requests
+ *
+ * @usb_ep: the endpoint being wedged
+ *
+ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
+ * requests. If the gadget driver clears the halt status, it will
+ * automatically unwedge the endpoint.
+ *
+ * Returns zero on success, else negative errno. *
+ * Check usb_ep_set_wedge() at "usb_gadget.h" for details
+ */
+static int ep_wedge(struct usb_ep *usb_ep)
+{
+	int retval = 0;
+
+	DWC_DEBUGPL(DBG_PCD, "WEDGE %s\n", usb_ep->name);
+
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+		return -EINVAL;
+	}
+
+	retval = dwc_otg_pcd_ep_wedge(gadget_wrapper->pcd, usb_ep);
+	if (retval == -DWC_E_AGAIN) {
+		retval = -EAGAIN;
+	} else if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+#endif
+
+#ifdef DWC_EN_ISOC
+/**
+ * This function is used to submit an ISOC Transfer Request to an EP.
+ *
+ *	- Every time a sync period completes the request's completion callback
+ *	  is called to provide data to the gadget driver.
+ *	- Once submitted the request cannot be modified.
+ *	- Each request is turned into periodic data packets untill ISO
+ *	  Transfer is stopped..
+ */
+static int iso_ep_start(struct usb_ep *usb_ep, struct usb_iso_request *req,
+			gfp_t gfp_flags)
+{
+	int retval = 0;
+
+	if (!req || !req->process_buffer || !req->buf0 || !req->buf1) {
+		DWC_WARN("bad params\n");
+		return -EINVAL;
+	}
+
+	if (!usb_ep) {
+		DWC_PRINTF("bad params\n");
+		return -EINVAL;
+	}
+
+	req->status = -EINPROGRESS;
+
+	retval =
+	    dwc_otg_pcd_iso_ep_start(gadget_wrapper->pcd, usb_ep, req->buf0,
+				     req->buf1, req->dma0, req->dma1,
+				     req->sync_frame, req->data_pattern_frame,
+				     req->data_per_frame,
+				     req->
+				     flags & USB_REQ_ISO_ASAP ? -1 :
+				     req->start_frame, req->buf_proc_intrvl,
+				     req, gfp_flags == GFP_ATOMIC ? 1 : 0);
+
+	if (retval) {
+		return -EINVAL;
+	}
+
+	return retval;
+}
+
+/**
+ * This function stops ISO EP Periodic Data Transfer.
+ */
+static int iso_ep_stop(struct usb_ep *usb_ep, struct usb_iso_request *req)
+{
+	int retval = 0;
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+	}
+
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
+			    gadget_wrapper->gadget.speed);
+		DWC_WARN("bogus device state\n");
+	}
+
+	dwc_otg_pcd_iso_ep_stop(gadget_wrapper->pcd, usb_ep, req);
+	if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+static struct usb_iso_request *alloc_iso_request(struct usb_ep *ep,
+						 int packets, gfp_t gfp_flags)
+{
+	struct usb_iso_request *pReq = NULL;
+	uint32_t req_size;
+
+	req_size = sizeof(struct usb_iso_request);
+	req_size +=
+	    (2 * packets * (sizeof(struct usb_gadget_iso_packet_descriptor)));
+
+	pReq = kmalloc(req_size, gfp_flags);
+	if (!pReq) {
+		DWC_WARN("Can't allocate Iso Request\n");
+		return 0;
+	}
+	pReq->iso_packet_desc0 = (void *)(pReq + 1);
+
+	pReq->iso_packet_desc1 = pReq->iso_packet_desc0 + packets;
+
+	return pReq;
+}
+
+static void free_iso_request(struct usb_ep *ep, struct usb_iso_request *req)
+{
+	kfree(req);
+}
+
+static struct usb_isoc_ep_ops dwc_otg_pcd_ep_ops = {
+	.ep_ops = {
+		   .enable = ep_enable,
+		   .disable = ep_disable,
+
+		   .alloc_request = dwc_otg_pcd_alloc_request,
+		   .free_request = dwc_otg_pcd_free_request,
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		   .alloc_buffer = dwc_otg_pcd_alloc_buffer,
+		   .free_buffer = dwc_otg_pcd_free_buffer,
+#endif
+
+		   .queue = ep_queue,
+		   .dequeue = ep_dequeue,
+
+		   .set_halt = ep_halt,
+		   .fifo_status = 0,
+		   .fifo_flush = 0,
+		   },
+	.iso_ep_start = iso_ep_start,
+	.iso_ep_stop = iso_ep_stop,
+	.alloc_iso_request = alloc_iso_request,
+	.free_iso_request = free_iso_request,
+};
+
+#else
+
+	int (*enable) (struct usb_ep *ep,
+		const struct usb_endpoint_descriptor *desc);
+	int (*disable) (struct usb_ep *ep);
+
+	struct usb_request *(*alloc_request) (struct usb_ep *ep,
+		gfp_t gfp_flags);
+	void (*free_request) (struct usb_ep *ep, struct usb_request *req);
+
+	int (*queue) (struct usb_ep *ep, struct usb_request *req,
+		gfp_t gfp_flags);
+	int (*dequeue) (struct usb_ep *ep, struct usb_request *req);
+
+	int (*set_halt) (struct usb_ep *ep, int value);
+	int (*set_wedge) (struct usb_ep *ep);
+
+	int (*fifo_status) (struct usb_ep *ep);
+	void (*fifo_flush) (struct usb_ep *ep);
+static struct usb_ep_ops dwc_otg_pcd_ep_ops = {
+	.enable = ep_enable,
+	.disable = ep_disable,
+
+	.alloc_request = dwc_otg_pcd_alloc_request,
+	.free_request = dwc_otg_pcd_free_request,
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+	.alloc_buffer = dwc_otg_pcd_alloc_buffer,
+	.free_buffer = dwc_otg_pcd_free_buffer,
+#else
+	/* .set_wedge = ep_wedge, */
+        .set_wedge = NULL, /* uses set_halt instead */
+#endif
+
+	.queue = ep_queue,
+	.dequeue = ep_dequeue,
+
+	.set_halt = ep_halt,
+	.fifo_status = 0,
+	.fifo_flush = 0,
+
+};
+
+#endif /* _EN_ISOC_ */
+/*	Gadget Operations */
+/**
+ * The following gadget operations will be implemented in the DWC_otg
+ * PCD. Functions in the API that are not described below are not
+ * implemented.
+ *
+ * The Gadget API provides wrapper functions for each of the function
+ * pointers defined in usb_gadget_ops. The Gadget Driver calls the
+ * wrapper function, which then calls the underlying PCD function. The
+ * following sections are named according to the wrapper functions
+ * (except for ioctl, which doesn't have a wrapper function). Within
+ * each section, the corresponding DWC_otg PCD function name is
+ * specified.
+ *
+ */
+
+/**
+ *Gets the USB Frame number of the last SOF.
+ */
+static int get_frame_number(struct usb_gadget *gadget)
+{
+	struct gadget_wrapper *d;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
+
+	if (gadget == 0) {
+		return -ENODEV;
+	}
+
+	d = container_of(gadget, struct gadget_wrapper, gadget);
+	return dwc_otg_pcd_get_frame_number(d->pcd);
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+static int test_lpm_enabled(struct usb_gadget *gadget)
+{
+	struct gadget_wrapper *d;
+
+	d = container_of(gadget, struct gadget_wrapper, gadget);
+
+	return dwc_otg_pcd_is_lpm_enabled(d->pcd);
+}
+#endif
+
+/**
+ * Initiates Session Request Protocol (SRP) to wakeup the host if no
+ * session is in progress. If a session is already in progress, but
+ * the device is suspended, remote wakeup signaling is started.
+ *
+ */
+static int wakeup(struct usb_gadget *gadget)
+{
+	struct gadget_wrapper *d;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
+
+	if (gadget == 0) {
+		return -ENODEV;
+	} else {
+		d = container_of(gadget, struct gadget_wrapper, gadget);
+	}
+	dwc_otg_pcd_wakeup(d->pcd);
+	return 0;
+}
+
+static const struct usb_gadget_ops dwc_otg_pcd_ops = {
+	.get_frame = get_frame_number,
+	.wakeup = wakeup,
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	.lpm_support = test_lpm_enabled,
+#endif
+	// current versions must always be self-powered
+};
+
+static int _setup(dwc_otg_pcd_t * pcd, uint8_t * bytes)
+{
+	int retval = -DWC_E_NOT_SUPPORTED;
+	if (gadget_wrapper->driver && gadget_wrapper->driver->setup) {
+		retval = gadget_wrapper->driver->setup(&gadget_wrapper->gadget,
+						       (struct usb_ctrlrequest
+							*)bytes);
+	}
+
+	if (retval == -ENOTSUPP) {
+		retval = -DWC_E_NOT_SUPPORTED;
+	} else if (retval < 0) {
+		retval = -DWC_E_INVALID;
+	}
+
+	return retval;
+}
+
+#ifdef DWC_EN_ISOC
+static int _isoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
+			  void *req_handle, int proc_buf_num)
+{
+	int i, packet_count;
+	struct usb_gadget_iso_packet_descriptor *iso_packet = 0;
+	struct usb_iso_request *iso_req = req_handle;
+
+	if (proc_buf_num) {
+		iso_packet = iso_req->iso_packet_desc1;
+	} else {
+		iso_packet = iso_req->iso_packet_desc0;
+	}
+	packet_count =
+	    dwc_otg_pcd_get_iso_packet_count(pcd, ep_handle, req_handle);
+	for (i = 0; i < packet_count; ++i) {
+		int status;
+		int actual;
+		int offset;
+		dwc_otg_pcd_get_iso_packet_params(pcd, ep_handle, req_handle,
+						  i, &status, &actual, &offset);
+		switch (status) {
+		case -DWC_E_NO_DATA:
+			status = -ENODATA;
+			break;
+		default:
+			if (status) {
+				DWC_PRINTF("unknown status in isoc packet\n");
+			}
+
+		}
+		iso_packet[i].status = status;
+		iso_packet[i].offset = offset;
+		iso_packet[i].actual_length = actual;
+	}
+
+	iso_req->status = 0;
+	iso_req->process_buffer(ep_handle, iso_req);
+
+	return 0;
+}
+#endif /* DWC_EN_ISOC */
+
+#ifdef DWC_UTE_PER_IO
+/**
+ * Copy the contents of the extended request to the Linux usb_request's
+ * extended part and call the gadget's completion.
+ *
+ * @param pcd			Pointer to the pcd structure
+ * @param ep_handle		Void pointer to the usb_ep structure
+ * @param req_handle	Void pointer to the usb_request structure
+ * @param status		Request status returned from the portable logic
+ * @param ereq_port		Void pointer to the extended request structure
+ *						created in the the portable part that contains the
+ *						results of the processed iso packets.
+ */
+static int _xisoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
+			   void *req_handle, int32_t status, void *ereq_port)
+{
+	struct dwc_ute_iso_req_ext *ereqorg = NULL;
+	struct dwc_iso_xreq_port *ereqport = NULL;
+	struct dwc_ute_iso_packet_descriptor *desc_org = NULL;
+	int i;
+	struct usb_request *req;
+	//struct dwc_ute_iso_packet_descriptor *
+	//int status = 0;
+
+	req = (struct usb_request *)req_handle;
+	ereqorg = &req->ext_req;
+	ereqport = (struct dwc_iso_xreq_port *)ereq_port;
+	desc_org = ereqorg->per_io_frame_descs;
+
+	if (req && req->complete) {
+		/* Copy the request data from the portable logic to our request */
+		for (i = 0; i < ereqport->pio_pkt_count; i++) {
+			desc_org[i].actual_length =
+			    ereqport->per_io_frame_descs[i].actual_length;
+			desc_org[i].status =
+			    ereqport->per_io_frame_descs[i].status;
+		}
+
+		switch (status) {
+		case -DWC_E_SHUTDOWN:
+			req->status = -ESHUTDOWN;
+			break;
+		case -DWC_E_RESTART:
+			req->status = -ECONNRESET;
+			break;
+		case -DWC_E_INVALID:
+			req->status = -EINVAL;
+			break;
+		case -DWC_E_TIMEOUT:
+			req->status = -ETIMEDOUT;
+			break;
+		default:
+			req->status = status;
+		}
+
+		/* And call the gadget's completion */
+		req->complete(ep_handle, req);
+	}
+
+	return 0;
+}
+#endif /* DWC_UTE_PER_IO */
+
+static int _complete(dwc_otg_pcd_t * pcd, void *ep_handle,
+		     void *req_handle, int32_t status, uint32_t actual)
+{
+	struct usb_request *req = (struct usb_request *)req_handle;
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
+	struct dwc_otg_pcd_ep *ep = NULL;
+#endif
+
+	if (req && req->complete) {
+		switch (status) {
+		case -DWC_E_SHUTDOWN:
+			req->status = -ESHUTDOWN;
+			break;
+		case -DWC_E_RESTART:
+			req->status = -ECONNRESET;
+			break;
+		case -DWC_E_INVALID:
+			req->status = -EINVAL;
+			break;
+		case -DWC_E_TIMEOUT:
+			req->status = -ETIMEDOUT;
+			break;
+		default:
+			req->status = status;
+
+		}
+
+		req->actual = actual;
+		DWC_SPINUNLOCK(pcd->lock);
+		req->complete(ep_handle, req);
+		DWC_SPINLOCK(pcd->lock);
+	}
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
+	ep = ep_from_handle(pcd, ep_handle);
+	if (GET_CORE_IF(pcd)->dma_enable) {
+                if (req->length != 0) {
+                        dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
+                        struct device *dev = NULL;
+
+                        if (otg_dev != NULL)
+                                  dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
+
+			dma_unmap_single(dev, req->dma, req->length,
+                                         ep->dwc_ep.is_in ?
+                                                DMA_TO_DEVICE: DMA_FROM_DEVICE);
+                }
+	}
+#endif
+
+	return 0;
+}
+
+static int _connect(dwc_otg_pcd_t * pcd, int speed)
+{
+	gadget_wrapper->gadget.speed = speed;
+	return 0;
+}
+
+static int _disconnect(dwc_otg_pcd_t * pcd)
+{
+	if (gadget_wrapper->driver && gadget_wrapper->driver->disconnect) {
+		gadget_wrapper->driver->disconnect(&gadget_wrapper->gadget);
+	}
+	return 0;
+}
+
+static int _resume(dwc_otg_pcd_t * pcd)
+{
+	if (gadget_wrapper->driver && gadget_wrapper->driver->resume) {
+		gadget_wrapper->driver->resume(&gadget_wrapper->gadget);
+	}
+
+	return 0;
+}
+
+static int _suspend(dwc_otg_pcd_t * pcd)
+{
+	if (gadget_wrapper->driver && gadget_wrapper->driver->suspend) {
+		gadget_wrapper->driver->suspend(&gadget_wrapper->gadget);
+	}
+	return 0;
+}
+
+/**
+ * This function updates the otg values in the gadget structure.
+ */
+static int _hnp_changed(dwc_otg_pcd_t * pcd)
+{
+
+	if (!gadget_wrapper->gadget.is_otg)
+		return 0;
+
+	gadget_wrapper->gadget.b_hnp_enable = get_b_hnp_enable(pcd);
+	gadget_wrapper->gadget.a_hnp_support = get_a_hnp_support(pcd);
+	gadget_wrapper->gadget.a_alt_hnp_support = get_a_alt_hnp_support(pcd);
+	return 0;
+}
+
+static int _reset(dwc_otg_pcd_t * pcd)
+{
+	return 0;
+}
+
+#ifdef DWC_UTE_CFI
+static int _cfi_setup(dwc_otg_pcd_t * pcd, void *cfi_req)
+{
+	int retval = -DWC_E_INVALID;
+	if (gadget_wrapper->driver->cfi_feature_setup) {
+		retval =
+		    gadget_wrapper->driver->
+		    cfi_feature_setup(&gadget_wrapper->gadget,
+				      (struct cfi_usb_ctrlrequest *)cfi_req);
+	}
+
+	return retval;
+}
+#endif
+
+static const struct dwc_otg_pcd_function_ops fops = {
+	.complete = _complete,
+#ifdef DWC_EN_ISOC
+	.isoc_complete = _isoc_complete,
+#endif
+	.setup = _setup,
+	.disconnect = _disconnect,
+	.connect = _connect,
+	.resume = _resume,
+	.suspend = _suspend,
+	.hnp_changed = _hnp_changed,
+	.reset = _reset,
+#ifdef DWC_UTE_CFI
+	.cfi_setup = _cfi_setup,
+#endif
+#ifdef DWC_UTE_PER_IO
+	.xisoc_complete = _xisoc_complete,
+#endif
+};
+
+/**
+ * This function is the top level PCD interrupt handler.
+ */
+static irqreturn_t dwc_otg_pcd_irq(int irq, void *dev)
+{
+	dwc_otg_pcd_t *pcd = dev;
+	int32_t retval = IRQ_NONE;
+
+	retval = dwc_otg_pcd_handle_intr(pcd);
+	if (retval != 0) {
+		S3C2410X_CLEAR_EINTPEND();
+	}
+	return IRQ_RETVAL(retval);
+}
+
+/**
+ * This function initialized the usb_ep structures to there default
+ * state.
+ *
+ * @param d Pointer on gadget_wrapper.
+ */
+void gadget_add_eps(struct gadget_wrapper *d)
+{
+	static const char *names[] = {
+
+		"ep0",
+		"ep1in",
+		"ep2in",
+		"ep3in",
+		"ep4in",
+		"ep5in",
+		"ep6in",
+		"ep7in",
+		"ep8in",
+		"ep9in",
+		"ep10in",
+		"ep11in",
+		"ep12in",
+		"ep13in",
+		"ep14in",
+		"ep15in",
+		"ep1out",
+		"ep2out",
+		"ep3out",
+		"ep4out",
+		"ep5out",
+		"ep6out",
+		"ep7out",
+		"ep8out",
+		"ep9out",
+		"ep10out",
+		"ep11out",
+		"ep12out",
+		"ep13out",
+		"ep14out",
+		"ep15out"
+	};
+
+	int i;
+	struct usb_ep *ep;
+	int8_t dev_endpoints;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s\n", __func__);
+
+	INIT_LIST_HEAD(&d->gadget.ep_list);
+	d->gadget.ep0 = &d->ep0;
+	d->gadget.speed = USB_SPEED_UNKNOWN;
+
+	INIT_LIST_HEAD(&d->gadget.ep0->ep_list);
+
+	/**
+	 * Initialize the EP0 structure.
+	 */
+	ep = &d->ep0;
+
+	/* Init the usb_ep structure. */
+	ep->name = names[0];
+	ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
+
+	/**
+	 * @todo NGS: What should the max packet size be set to
+	 * here?  Before EP type is set?
+	 */
+	ep->maxpacket = MAX_PACKET_SIZE;
+	dwc_otg_pcd_ep_enable(d->pcd, NULL, ep);
+
+	list_add_tail(&ep->ep_list, &d->gadget.ep_list);
+
+	/**
+	 * Initialize the EP structures.
+	 */
+	dev_endpoints = d->pcd->core_if->dev_if->num_in_eps;
+
+	for (i = 0; i < dev_endpoints; i++) {
+		ep = &d->in_ep[i];
+
+		/* Init the usb_ep structure. */
+		ep->name = names[d->pcd->in_ep[i].dwc_ep.num];
+		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
+
+		/**
+		 * @todo NGS: What should the max packet size be set to
+		 * here?  Before EP type is set?
+		 */
+		ep->maxpacket = MAX_PACKET_SIZE;
+		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
+	}
+
+	dev_endpoints = d->pcd->core_if->dev_if->num_out_eps;
+
+	for (i = 0; i < dev_endpoints; i++) {
+		ep = &d->out_ep[i];
+
+		/* Init the usb_ep structure. */
+		ep->name = names[15 + d->pcd->out_ep[i].dwc_ep.num];
+		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
+
+		/**
+		 * @todo NGS: What should the max packet size be set to
+		 * here?  Before EP type is set?
+		 */
+		ep->maxpacket = MAX_PACKET_SIZE;
+
+		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
+	}
+
+	/* remove ep0 from the list.  There is a ep0 pointer. */
+	list_del_init(&d->ep0.ep_list);
+
+	d->ep0.maxpacket = MAX_EP0_SIZE;
+}
+
+/**
+ * This function releases the Gadget device.
+ * required by device_unregister().
+ *
+ * @todo Should this do something?	Should it free the PCD?
+ */
+static void dwc_otg_pcd_gadget_release(struct device *dev)
+{
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, dev);
+}
+
+static struct gadget_wrapper *alloc_wrapper(dwc_bus_dev_t *_dev)
+{
+	static char pcd_name[] = "dwc_otg_pcd";
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	struct gadget_wrapper *d;
+	int retval;
+
+	d = DWC_ALLOC(sizeof(*d));
+	if (d == NULL) {
+		return NULL;
+	}
+
+	memset(d, 0, sizeof(*d));
+
+	d->gadget.name = pcd_name;
+	d->pcd = otg_dev->pcd;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
+	strcpy(d->gadget.dev.bus_id, "gadget");
+#else
+	dev_set_name(&d->gadget.dev, "%s", "gadget");
+#endif
+
+	d->gadget.dev.parent = &_dev->dev;
+	d->gadget.dev.release = dwc_otg_pcd_gadget_release;
+	d->gadget.ops = &dwc_otg_pcd_ops;
+	d->gadget.max_speed = dwc_otg_pcd_is_dualspeed(otg_dev->pcd) ? USB_SPEED_HIGH:USB_SPEED_FULL;
+	d->gadget.is_otg = dwc_otg_pcd_is_otg(otg_dev->pcd);
+
+	d->driver = 0;
+	/* Register the gadget device */
+	retval = device_register(&d->gadget.dev);
+	if (retval != 0) {
+		DWC_ERROR("device_register failed\n");
+		DWC_FREE(d);
+		return NULL;
+	}
+
+	return d;
+}
+
+static void free_wrapper(struct gadget_wrapper *d)
+{
+	if (d->driver) {
+		/* should have been done already by driver model core */
+		DWC_WARN("driver '%s' is still registered\n",
+			 d->driver->driver.name);
+#ifdef CONFIG_USB_GADGET
+		usb_gadget_unregister_driver(d->driver);
+#endif
+	}
+
+	device_unregister(&d->gadget.dev);
+	DWC_FREE(d);
+}
+
+/**
+ * This function initialized the PCD portion of the driver.
+ *
+ */
+int pcd_init(dwc_bus_dev_t *_dev)
+{
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	int retval = 0;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev=%p\n", __func__, _dev, otg_dev);
+
+	otg_dev->pcd = dwc_otg_pcd_init(otg_dev);
+
+	if (!otg_dev->pcd) {
+		DWC_ERROR("dwc_otg_pcd_init failed\n");
+		return -ENOMEM;
+	}
+
+	otg_dev->pcd->otg_dev = otg_dev;
+	gadget_wrapper = alloc_wrapper(_dev);
+
+	/*
+	 * Initialize EP structures
+	 */
+	gadget_add_eps(gadget_wrapper);
+	/*
+	 * Setup interupt handler
+	 */
+#ifdef PLATFORM_INTERFACE
+	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
+                    platform_get_irq(_dev, fiq_enable ? 0 : 1));
+	retval = request_irq(platform_get_irq(_dev, fiq_enable ? 0 : 1), dwc_otg_pcd_irq,
+			     IRQF_SHARED, gadget_wrapper->gadget.name,
+			     otg_dev->pcd);
+	if (retval != 0) {
+		DWC_ERROR("request of irq%d failed\n",
+                          platform_get_irq(_dev, fiq_enable ? 0 : 1));
+		free_wrapper(gadget_wrapper);
+		return -EBUSY;
+	}
+#else
+	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
+                    _dev->irq);
+	retval = request_irq(_dev->irq, dwc_otg_pcd_irq,
+			     IRQF_SHARED | IRQF_DISABLED,
+			     gadget_wrapper->gadget.name, otg_dev->pcd);
+	if (retval != 0) {
+		DWC_ERROR("request of irq%d failed\n", _dev->irq);
+		free_wrapper(gadget_wrapper);
+		return -EBUSY;
+	}
+#endif
+
+	dwc_otg_pcd_start(gadget_wrapper->pcd, &fops);
+
+	return retval;
+}
+
+/**
+ * Cleanup the PCD.
+ */
+void pcd_remove(dwc_bus_dev_t *_dev)
+{
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	dwc_otg_pcd_t *pcd = otg_dev->pcd;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
+
+	/*
+	 * Free the IRQ
+	 */
+#ifdef PLATFORM_INTERFACE
+	free_irq(platform_get_irq(_dev, 0), pcd);
+#else
+	free_irq(_dev->irq, pcd);
+#endif
+	dwc_otg_pcd_remove(otg_dev->pcd);
+	free_wrapper(gadget_wrapper);
+	otg_dev->pcd = 0;
+}
+
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_regs.h b/drivers/usb/host/dwc_otg/dwc_otg_regs.h
new file mode 100644
index 0000000000000..8e0e7b569f1ac
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_regs.h
@@ -0,0 +1,2550 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_regs.h $
+ * $Revision: #98 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_REGS_H__
+#define __DWC_OTG_REGS_H__
+
+#include "dwc_otg_core_if.h"
+
+/**
+ * @file
+ *
+ * This file contains the data structures for accessing the DWC_otg core registers.
+ *
+ * The application interfaces with the HS OTG core by reading from and
+ * writing to the Control and Status Register (CSR) space through the
+ * AHB Slave interface. These registers are 32 bits wide, and the
+ * addresses are 32-bit-block aligned.
+ * CSRs are classified as follows:
+ * - Core Global Registers
+ * - Device Mode Registers
+ * - Device Global Registers
+ * - Device Endpoint Specific Registers
+ * - Host Mode Registers
+ * - Host Global Registers
+ * - Host Port CSRs
+ * - Host Channel Specific Registers
+ *
+ * Only the Core Global registers can be accessed in both Device and
+ * Host modes. When the HS OTG core is operating in one mode, either
+ * Device or Host, the application must not access registers from the
+ * other mode. When the core switches from one mode to another, the
+ * registers in the new mode of operation must be reprogrammed as they
+ * would be after a power-on reset.
+ */
+
+/****************************************************************************/
+/** DWC_otg Core registers .
+ * The dwc_otg_core_global_regs structure defines the size
+ * and relative field offsets for the Core Global registers.
+ */
+typedef struct dwc_otg_core_global_regs {
+	/** OTG Control and Status Register.  <i>Offset: 000h</i> */
+	volatile uint32_t gotgctl;
+	/** OTG Interrupt Register.	 <i>Offset: 004h</i> */
+	volatile uint32_t gotgint;
+	/**Core AHB Configuration Register.	 <i>Offset: 008h</i> */
+	volatile uint32_t gahbcfg;
+
+#define DWC_GLBINTRMASK		0x0001
+#define DWC_DMAENABLE		0x0020
+#define DWC_NPTXEMPTYLVL_EMPTY	0x0080
+#define DWC_NPTXEMPTYLVL_HALFEMPTY	0x0000
+#define DWC_PTXEMPTYLVL_EMPTY	0x0100
+#define DWC_PTXEMPTYLVL_HALFEMPTY	0x0000
+
+	/**Core USB Configuration Register.	 <i>Offset: 00Ch</i> */
+	volatile uint32_t gusbcfg;
+	/**Core Reset Register.	 <i>Offset: 010h</i> */
+	volatile uint32_t grstctl;
+	/**Core Interrupt Register.	 <i>Offset: 014h</i> */
+	volatile uint32_t gintsts;
+	/**Core Interrupt Mask Register.  <i>Offset: 018h</i> */
+	volatile uint32_t gintmsk;
+	/**Receive Status Queue Read Register (Read Only).	<i>Offset: 01Ch</i> */
+	volatile uint32_t grxstsr;
+	/**Receive Status Queue Read & POP Register (Read Only).  <i>Offset: 020h</i>*/
+	volatile uint32_t grxstsp;
+	/**Receive FIFO Size Register.	<i>Offset: 024h</i> */
+	volatile uint32_t grxfsiz;
+	/**Non Periodic Transmit FIFO Size Register.  <i>Offset: 028h</i> */
+	volatile uint32_t gnptxfsiz;
+	/**Non Periodic Transmit FIFO/Queue Status Register (Read
+	 * Only). <i>Offset: 02Ch</i> */
+	volatile uint32_t gnptxsts;
+	/**I2C Access Register.	 <i>Offset: 030h</i> */
+	volatile uint32_t gi2cctl;
+	/**PHY Vendor Control Register.	 <i>Offset: 034h</i> */
+	volatile uint32_t gpvndctl;
+	/**General Purpose Input/Output Register.  <i>Offset: 038h</i> */
+	volatile uint32_t ggpio;
+	/**User ID Register.  <i>Offset: 03Ch</i> */
+	volatile uint32_t guid;
+	/**Synopsys ID Register (Read Only).  <i>Offset: 040h</i> */
+	volatile uint32_t gsnpsid;
+	/**User HW Config1 Register (Read Only).  <i>Offset: 044h</i> */
+	volatile uint32_t ghwcfg1;
+	/**User HW Config2 Register (Read Only).  <i>Offset: 048h</i> */
+	volatile uint32_t ghwcfg2;
+#define DWC_SLAVE_ONLY_ARCH 0
+#define DWC_EXT_DMA_ARCH 1
+#define DWC_INT_DMA_ARCH 2
+
+#define DWC_MODE_HNP_SRP_CAPABLE	0
+#define DWC_MODE_SRP_ONLY_CAPABLE	1
+#define DWC_MODE_NO_HNP_SRP_CAPABLE		2
+#define DWC_MODE_SRP_CAPABLE_DEVICE		3
+#define DWC_MODE_NO_SRP_CAPABLE_DEVICE	4
+#define DWC_MODE_SRP_CAPABLE_HOST	5
+#define DWC_MODE_NO_SRP_CAPABLE_HOST	6
+
+	/**User HW Config3 Register (Read Only).  <i>Offset: 04Ch</i> */
+	volatile uint32_t ghwcfg3;
+	/**User HW Config4 Register (Read Only).  <i>Offset: 050h</i>*/
+	volatile uint32_t ghwcfg4;
+	/** Core LPM Configuration register <i>Offset: 054h</i>*/
+	volatile uint32_t glpmcfg;
+	/** Global PowerDn Register <i>Offset: 058h</i> */
+	volatile uint32_t gpwrdn;
+	/** Global DFIFO SW Config Register  <i>Offset: 05Ch</i> */
+	volatile uint32_t gdfifocfg;
+	/** ADP Control Register  <i>Offset: 060h</i> */
+	volatile uint32_t adpctl;
+	/** Reserved  <i>Offset: 064h-0FFh</i> */
+	volatile uint32_t reserved39[39];
+	/** Host Periodic Transmit FIFO Size Register. <i>Offset: 100h</i> */
+	volatile uint32_t hptxfsiz;
+	/** Device Periodic Transmit FIFO#n Register if dedicated fifos are disabled,
+		otherwise Device Transmit FIFO#n Register.
+	 * <i>Offset: 104h + (FIFO_Number-1)*04h, 1 <= FIFO Number <= 15 (1<=n<=15).</i> */
+	volatile uint32_t dtxfsiz[15];
+} dwc_otg_core_global_regs_t;
+
+/**
+ * This union represents the bit fields of the Core OTG Control
+ * and Status Register (GOTGCTL).  Set the bits using the bit
+ * fields then write the <i>d32</i> value to the register.
+ */
+typedef union gotgctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned sesreqscs:1;
+		unsigned sesreq:1;
+		unsigned vbvalidoven:1;
+		unsigned vbvalidovval:1;
+		unsigned avalidoven:1;
+		unsigned avalidovval:1;
+		unsigned bvalidoven:1;
+		unsigned bvalidovval:1;
+		unsigned hstnegscs:1;
+		unsigned hnpreq:1;
+		unsigned hstsethnpen:1;
+		unsigned devhnpen:1;
+		unsigned reserved12_15:4;
+		unsigned conidsts:1;
+		unsigned dbnctime:1;
+		unsigned asesvld:1;
+		unsigned bsesvld:1;
+		unsigned otgver:1;
+		unsigned reserved1:1;
+		unsigned multvalidbc:5;
+		unsigned chirpen:1;
+		unsigned reserved28_31:4;
+	} b;
+} gotgctl_data_t;
+
+/**
+ * This union represents the bit fields of the Core OTG Interrupt Register
+ * (GOTGINT).  Set/clear the bits using the bit fields then write the <i>d32</i>
+ * value to the register.
+ */
+typedef union gotgint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Current Mode */
+		unsigned reserved0_1:2;
+
+		/** Session End Detected */
+		unsigned sesenddet:1;
+
+		unsigned reserved3_7:5;
+
+		/** Session Request Success Status Change */
+		unsigned sesreqsucstschng:1;
+		/** Host Negotiation Success Status Change */
+		unsigned hstnegsucstschng:1;
+
+		unsigned reserved10_16:7;
+
+		/** Host Negotiation Detected */
+		unsigned hstnegdet:1;
+		/** A-Device Timeout Change */
+		unsigned adevtoutchng:1;
+		/** Debounce Done */
+		unsigned debdone:1;
+		/** Multi-Valued input changed */
+		unsigned mvic:1;
+
+		unsigned reserved31_21:11;
+
+	} b;
+} gotgint_data_t;
+
+/**
+ * This union represents the bit fields of the Core AHB Configuration
+ * Register (GAHBCFG). Set/clear the bits using the bit fields then
+ * write the <i>d32</i> value to the register.
+ */
+typedef union gahbcfg_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned glblintrmsk:1;
+#define DWC_GAHBCFG_GLBINT_ENABLE		1
+
+		unsigned hburstlen:4;
+#define DWC_GAHBCFG_INT_DMA_BURST_SINGLE	0
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR		1
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR4		3
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR8		5
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR16	7
+
+		unsigned dmaenable:1;
+#define DWC_GAHBCFG_DMAENABLE			1
+		unsigned reserved:1;
+		unsigned nptxfemplvl_txfemplvl:1;
+		unsigned ptxfemplvl:1;
+#define DWC_GAHBCFG_TXFEMPTYLVL_EMPTY		1
+#define DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY	0
+		unsigned reserved9_20:12;
+		unsigned remmemsupp:1;
+		unsigned notialldmawrit:1;
+		unsigned ahbsingle:1;
+		unsigned reserved24_31:8;
+	} b;
+} gahbcfg_data_t;
+
+/**
+ * This union represents the bit fields of the Core USB Configuration
+ * Register (GUSBCFG). Set the bits using the bit fields then write
+ * the <i>d32</i> value to the register.
+ */
+typedef union gusbcfg_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned toutcal:3;
+		unsigned phyif:1;
+		unsigned ulpi_utmi_sel:1;
+		unsigned fsintf:1;
+		unsigned physel:1;
+		unsigned ddrsel:1;
+		unsigned srpcap:1;
+		unsigned hnpcap:1;
+		unsigned usbtrdtim:4;
+		unsigned reserved1:1;
+		unsigned phylpwrclksel:1;
+		unsigned otgutmifssel:1;
+		unsigned ulpi_fsls:1;
+		unsigned ulpi_auto_res:1;
+		unsigned ulpi_clk_sus_m:1;
+		unsigned ulpi_ext_vbus_drv:1;
+		unsigned ulpi_int_vbus_indicator:1;
+		unsigned term_sel_dl_pulse:1;
+		unsigned indicator_complement:1;
+		unsigned indicator_pass_through:1;
+		unsigned ulpi_int_prot_dis:1;
+		unsigned ic_usb_cap:1;
+		unsigned ic_traffic_pull_remove:1;
+		unsigned tx_end_delay:1;
+		unsigned force_host_mode:1;
+		unsigned force_dev_mode:1;
+		unsigned reserved31:1;
+	} b;
+} gusbcfg_data_t;
+
+/**
+ * This union represents the bit fields of the Core Reset Register
+ * (GRSTCTL).  Set/clear the bits using the bit fields then write the
+ * <i>d32</i> value to the register.
+ */
+typedef union grstctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Core Soft Reset (CSftRst) (Device and Host)
+		 *
+		 * The application can flush the control logic in the
+		 * entire core using this bit. This bit resets the
+		 * pipelines in the AHB Clock domain as well as the
+		 * PHY Clock domain.
+		 *
+		 * The state machines are reset to an IDLE state, the
+		 * control bits in the CSRs are cleared, all the
+		 * transmit FIFOs and the receive FIFO are flushed.
+		 *
+		 * The status mask bits that control the generation of
+		 * the interrupt, are cleared, to clear the
+		 * interrupt. The interrupt status bits are not
+		 * cleared, so the application can get the status of
+		 * any events that occurred in the core after it has
+		 * set this bit.
+		 *
+		 * Any transactions on the AHB are terminated as soon
+		 * as possible following the protocol. Any
+		 * transactions on the USB are terminated immediately.
+		 *
+		 * The configuration settings in the CSRs are
+		 * unchanged, so the software doesn't have to
+		 * reprogram these registers (Device
+		 * Configuration/Host Configuration/Core System
+		 * Configuration/Core PHY Configuration).
+		 *
+		 * The application can write to this bit, any time it
+		 * wants to reset the core. This is a self clearing
+		 * bit and the core clears this bit after all the
+		 * necessary logic is reset in the core, which may
+		 * take several clocks, depending on the current state
+		 * of the core.
+		 */
+		unsigned csftrst:1;
+		/** Hclk Soft Reset
+		 *
+		 * The application uses this bit to reset the control logic in
+		 * the AHB clock domain. Only AHB clock domain pipelines are
+		 * reset.
+		 */
+		unsigned hsftrst:1;
+		/** Host Frame Counter Reset (Host Only)<br>
+		 *
+		 * The application can reset the (micro)frame number
+		 * counter inside the core, using this bit. When the
+		 * (micro)frame counter is reset, the subsequent SOF
+		 * sent out by the core, will have a (micro)frame
+		 * number of 0.
+		 */
+		unsigned hstfrm:1;
+		/** In Token Sequence Learning Queue Flush
+		 * (INTknQFlsh) (Device Only)
+		 */
+		unsigned intknqflsh:1;
+		/** RxFIFO Flush (RxFFlsh) (Device and Host)
+		 *
+		 * The application can flush the entire Receive FIFO
+		 * using this bit. The application must first
+		 * ensure that the core is not in the middle of a
+		 * transaction. The application should write into
+		 * this bit, only after making sure that neither the
+		 * DMA engine is reading from the RxFIFO nor the MAC
+		 * is writing the data in to the FIFO. The
+		 * application should wait until the bit is cleared
+		 * before performing any other operations. This bit
+		 * will takes 8 clocks (slowest of PHY or AHB clock)
+		 * to clear.
+		 */
+		unsigned rxfflsh:1;
+		/** TxFIFO Flush (TxFFlsh) (Device and Host).
+		 *
+		 * This bit is used to selectively flush a single or
+		 * all transmit FIFOs. The application must first
+		 * ensure that the core is not in the middle of a
+		 * transaction. The application should write into
+		 * this bit, only after making sure that neither the
+		 * DMA engine is writing into the TxFIFO nor the MAC
+		 * is reading the data out of the FIFO. The
+		 * application should wait until the core clears this
+		 * bit, before performing any operations. This bit
+		 * will takes 8 clocks (slowest of PHY or AHB clock)
+		 * to clear.
+		 */
+		unsigned txfflsh:1;
+
+		/** TxFIFO Number (TxFNum) (Device and Host).
+		 *
+		 * This is the FIFO number which needs to be flushed,
+		 * using the TxFIFO Flush bit. This field should not
+		 * be changed until the TxFIFO Flush bit is cleared by
+		 * the core.
+		 *	 - 0x0 : Non Periodic TxFIFO Flush
+		 *	 - 0x1 : Periodic TxFIFO #1 Flush in device mode
+		 *	   or Periodic TxFIFO in host mode
+		 *	 - 0x2 : Periodic TxFIFO #2 Flush in device mode.
+		 *	 - ...
+		 *	 - 0xF : Periodic TxFIFO #15 Flush in device mode
+		 *	 - 0x10: Flush all the Transmit NonPeriodic and
+		 *	   Transmit Periodic FIFOs in the core
+		 */
+		unsigned txfnum:5;
+		/** Reserved */
+		unsigned reserved11_29:19;
+		/** DMA Request Signal.	 Indicated DMA request is in
+		 * probress. Used for debug purpose. */
+		unsigned dmareq:1;
+		/** AHB Master Idle.  Indicates the AHB Master State
+		 * Machine is in IDLE condition. */
+		unsigned ahbidle:1;
+	} b;
+} grstctl_t;
+
+/**
+ * This union represents the bit fields of the Core Interrupt Mask
+ * Register (GINTMSK). Set/clear the bits using the bit fields then
+ * write the <i>d32</i> value to the register.
+ */
+typedef union gintmsk_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned reserved0:1;
+		unsigned modemismatch:1;
+		unsigned otgintr:1;
+		unsigned sofintr:1;
+		unsigned rxstsqlvl:1;
+		unsigned nptxfempty:1;
+		unsigned ginnakeff:1;
+		unsigned goutnakeff:1;
+		unsigned ulpickint:1;
+		unsigned i2cintr:1;
+		unsigned erlysuspend:1;
+		unsigned usbsuspend:1;
+		unsigned usbreset:1;
+		unsigned enumdone:1;
+		unsigned isooutdrop:1;
+		unsigned eopframe:1;
+		unsigned restoredone:1;
+		unsigned epmismatch:1;
+		unsigned inepintr:1;
+		unsigned outepintr:1;
+		unsigned incomplisoin:1;
+		unsigned incomplisoout:1;
+		unsigned fetsusp:1;
+		unsigned resetdet:1;
+		unsigned portintr:1;
+		unsigned hcintr:1;
+		unsigned ptxfempty:1;
+		unsigned lpmtranrcvd:1;
+		unsigned conidstschng:1;
+		unsigned disconnect:1;
+		unsigned sessreqintr:1;
+		unsigned wkupintr:1;
+	} b;
+} gintmsk_data_t;
+/**
+ * This union represents the bit fields of the Core Interrupt Register
+ * (GINTSTS).  Set/clear the bits using the bit fields then write the
+ * <i>d32</i> value to the register.
+ */
+typedef union gintsts_data {
+	/** raw register data */
+	uint32_t d32;
+#define DWC_SOF_INTR_MASK 0x0008
+	/** register bits */
+	struct {
+#define DWC_HOST_MODE 1
+		unsigned curmode:1;
+		unsigned modemismatch:1;
+		unsigned otgintr:1;
+		unsigned sofintr:1;
+		unsigned rxstsqlvl:1;
+		unsigned nptxfempty:1;
+		unsigned ginnakeff:1;
+		unsigned goutnakeff:1;
+		unsigned ulpickint:1;
+		unsigned i2cintr:1;
+		unsigned erlysuspend:1;
+		unsigned usbsuspend:1;
+		unsigned usbreset:1;
+		unsigned enumdone:1;
+		unsigned isooutdrop:1;
+		unsigned eopframe:1;
+		unsigned restoredone:1;
+		unsigned epmismatch:1;
+		unsigned inepint:1;
+		unsigned outepintr:1;
+		unsigned incomplisoin:1;
+		unsigned incomplisoout:1;
+		unsigned fetsusp:1;
+		unsigned resetdet:1;
+		unsigned portintr:1;
+		unsigned hcintr:1;
+		unsigned ptxfempty:1;
+		unsigned lpmtranrcvd:1;
+		unsigned conidstschng:1;
+		unsigned disconnect:1;
+		unsigned sessreqintr:1;
+		unsigned wkupintr:1;
+	} b;
+} gintsts_data_t;
+
+/**
+ * This union represents the bit fields in the Device Receive Status Read and
+ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
+ * element then read out the bits using the <i>b</i>it elements.
+ */
+typedef union device_grxsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned epnum:4;
+		unsigned bcnt:11;
+		unsigned dpid:2;
+
+#define DWC_STS_DATA_UPDT		0x2	// OUT Data Packet
+#define DWC_STS_XFER_COMP		0x3	// OUT Data Transfer Complete
+
+#define DWC_DSTS_GOUT_NAK		0x1	// Global OUT NAK
+#define DWC_DSTS_SETUP_COMP		0x4	// Setup Phase Complete
+#define DWC_DSTS_SETUP_UPDT 0x6	// SETUP Packet
+		unsigned pktsts:4;
+		unsigned fn:4;
+		unsigned reserved25_31:7;
+	} b;
+} device_grxsts_data_t;
+
+/**
+ * This union represents the bit fields in the Host Receive Status Read and
+ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
+ * element then read out the bits using the <i>b</i>it elements.
+ */
+typedef union host_grxsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned chnum:4;
+		unsigned bcnt:11;
+		unsigned dpid:2;
+
+		unsigned pktsts:4;
+#define DWC_GRXSTS_PKTSTS_IN			  0x2
+#define DWC_GRXSTS_PKTSTS_IN_XFER_COMP	  0x3
+#define DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR 0x5
+#define DWC_GRXSTS_PKTSTS_CH_HALTED		  0x7
+
+		unsigned reserved21_31:11;
+	} b;
+} host_grxsts_data_t;
+
+/**
+ * This union represents the bit fields in the FIFO Size Registers (HPTXFSIZ,
+ * GNPTXFSIZ, DPTXFSIZn, DIEPTXFn). Read the register into the <i>d32</i> element
+ * then read out the bits using the <i>b</i>it elements.
+ */
+typedef union fifosize_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned startaddr:16;
+		unsigned depth:16;
+	} b;
+} fifosize_data_t;
+
+/**
+ * This union represents the bit fields in the Non-Periodic Transmit
+ * FIFO/Queue Status Register (GNPTXSTS). Read the register into the
+ * <i>d32</i> element then read out the bits using the <i>b</i>it
+ * elements.
+ */
+typedef union gnptxsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned nptxfspcavail:16;
+		unsigned nptxqspcavail:8;
+		/** Top of the Non-Periodic Transmit Request Queue
+		 *	- bit 24 - Terminate (Last entry for the selected
+		 *	  channel/EP)
+		 *	- bits 26:25 - Token Type
+		 *	  - 2'b00 - IN/OUT
+		 *	  - 2'b01 - Zero Length OUT
+		 *	  - 2'b10 - PING/Complete Split
+		 *	  - 2'b11 - Channel Halt
+		 *	- bits 30:27 - Channel/EP Number
+		 */
+		unsigned nptxqtop_terminate:1;
+		unsigned nptxqtop_token:2;
+		unsigned nptxqtop_chnep:4;
+		unsigned reserved:1;
+	} b;
+} gnptxsts_data_t;
+
+/**
+ * This union represents the bit fields in the Transmit
+ * FIFO Status Register (DTXFSTS). Read the register into the
+ * <i>d32</i> element then read out the bits using the <i>b</i>it
+ * elements.
+ */
+typedef union dtxfsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned txfspcavail:16;
+		unsigned reserved:16;
+	} b;
+} dtxfsts_data_t;
+
+/**
+ * This union represents the bit fields in the I2C Control Register
+ * (I2CCTL). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gi2cctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned rwdata:8;
+		unsigned regaddr:8;
+		unsigned addr:7;
+		unsigned i2cen:1;
+		unsigned ack:1;
+		unsigned i2csuspctl:1;
+		unsigned i2cdevaddr:2;
+		unsigned i2cdatse0:1;
+		unsigned reserved:1;
+		unsigned rw:1;
+		unsigned bsydne:1;
+	} b;
+} gi2cctl_data_t;
+
+/**
+ * This union represents the bit fields in the PHY Vendor Control Register
+ * (GPVNDCTL). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gpvndctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned regdata:8;
+		unsigned vctrl:8;
+		unsigned regaddr16_21:6;
+		unsigned regwr:1;
+		unsigned reserved23_24:2;
+		unsigned newregreq:1;
+		unsigned vstsbsy:1;
+		unsigned vstsdone:1;
+		unsigned reserved28_30:3;
+		unsigned disulpidrvr:1;
+	} b;
+} gpvndctl_data_t;
+
+/**
+ * This union represents the bit fields in the General Purpose
+ * Input/Output Register (GGPIO).
+ * Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union ggpio_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned gpi:16;
+		unsigned gpo:16;
+	} b;
+} ggpio_data_t;
+
+/**
+ * This union represents the bit fields in the User ID Register
+ * (GUID). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union guid_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned rwdata:32;
+	} b;
+} guid_data_t;
+
+/**
+ * This union represents the bit fields in the Synopsys ID Register
+ * (GSNPSID). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gsnpsid_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned rwdata:32;
+	} b;
+} gsnpsid_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config1
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg1_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned ep_dir0:2;
+		unsigned ep_dir1:2;
+		unsigned ep_dir2:2;
+		unsigned ep_dir3:2;
+		unsigned ep_dir4:2;
+		unsigned ep_dir5:2;
+		unsigned ep_dir6:2;
+		unsigned ep_dir7:2;
+		unsigned ep_dir8:2;
+		unsigned ep_dir9:2;
+		unsigned ep_dir10:2;
+		unsigned ep_dir11:2;
+		unsigned ep_dir12:2;
+		unsigned ep_dir13:2;
+		unsigned ep_dir14:2;
+		unsigned ep_dir15:2;
+	} b;
+} hwcfg1_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config2
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg2_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/* GHWCFG2 */
+		unsigned op_mode:3;
+#define DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG 0
+#define DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG 1
+#define DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG 2
+#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE 3
+#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_DEVICE 4
+#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST 5
+#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST 6
+
+		unsigned architecture:2;
+		unsigned point2point:1;
+		unsigned hs_phy_type:2;
+#define DWC_HWCFG2_HS_PHY_TYPE_NOT_SUPPORTED 0
+#define DWC_HWCFG2_HS_PHY_TYPE_UTMI 1
+#define DWC_HWCFG2_HS_PHY_TYPE_ULPI 2
+#define DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI 3
+
+		unsigned fs_phy_type:2;
+		unsigned num_dev_ep:4;
+		unsigned num_host_chan:4;
+		unsigned perio_ep_supported:1;
+		unsigned dynamic_fifo:1;
+		unsigned multi_proc_int:1;
+		unsigned reserved21:1;
+		unsigned nonperio_tx_q_depth:2;
+		unsigned host_perio_tx_q_depth:2;
+		unsigned dev_token_q_depth:5;
+		unsigned otg_enable_ic_usb:1;
+	} b;
+} hwcfg2_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config3
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg3_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/* GHWCFG3 */
+		unsigned xfer_size_cntr_width:4;
+		unsigned packet_size_cntr_width:3;
+		unsigned otg_func:1;
+		unsigned i2c:1;
+		unsigned vendor_ctrl_if:1;
+		unsigned optional_features:1;
+		unsigned synch_reset_type:1;
+		unsigned adp_supp:1;
+		unsigned otg_enable_hsic:1;
+		unsigned bc_support:1;
+		unsigned otg_lpm_en:1;
+		unsigned dfifo_depth:16;
+	} b;
+} hwcfg3_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config4
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg4_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned num_dev_perio_in_ep:4;
+		unsigned power_optimiz:1;
+		unsigned min_ahb_freq:1;
+		unsigned hiber:1;
+		unsigned xhiber:1;
+		unsigned reserved:6;
+		unsigned utmi_phy_data_width:2;
+		unsigned num_dev_mode_ctrl_ep:4;
+		unsigned iddig_filt_en:1;
+		unsigned vbus_valid_filt_en:1;
+		unsigned a_valid_filt_en:1;
+		unsigned b_valid_filt_en:1;
+		unsigned session_end_filt_en:1;
+		unsigned ded_fifo_en:1;
+		unsigned num_in_eps:4;
+		unsigned desc_dma:1;
+		unsigned desc_dma_dyn:1;
+	} b;
+} hwcfg4_data_t;
+
+/**
+ * This union represents the bit fields of the Core LPM Configuration
+ * Register (GLPMCFG). Set the bits using bit fields then write
+ * the <i>d32</i> value to the register.
+ */
+typedef union glpmctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** LPM-Capable (LPMCap) (Device and Host)
+		 * The application uses this bit to control
+		 * the DWC_otg core LPM capabilities.
+		 */
+		unsigned lpm_cap_en:1;
+		/** LPM response programmed by application (AppL1Res) (Device)
+		 * Handshake response to LPM token pre-programmed
+		 * by device application software.
+		 */
+		unsigned appl_resp:1;
+		/** Host Initiated Resume Duration (HIRD) (Device and Host)
+		 * In Host mode this field indicates the value of HIRD
+		 * to be sent in an LPM transaction.
+		 * In Device mode this field is updated with the
+		 * Received LPM Token HIRD bmAttribute
+		 * when an ACK/NYET/STALL response is sent
+		 * to an LPM transaction.
+		 */
+		unsigned hird:4;
+		/** RemoteWakeEnable (bRemoteWake) (Device and Host)
+		 * In Host mode this bit indicates the value of remote
+		 * wake up to be sent in wIndex field of LPM transaction.
+		 * In Device mode this field is updated with the
+		 * Received LPM Token bRemoteWake bmAttribute
+		 * when an ACK/NYET/STALL response is sent
+		 * to an LPM transaction.
+		 */
+		unsigned rem_wkup_en:1;
+		/** Enable utmi_sleep_n (EnblSlpM) (Device and Host)
+		 * The application uses this bit to control
+		 * the utmi_sleep_n assertion to the PHY when in L1 state.
+		 */
+		unsigned en_utmi_sleep:1;
+		/** HIRD Threshold (HIRD_Thres) (Device and Host)
+		 */
+		unsigned hird_thres:5;
+		/** LPM Response (CoreL1Res) (Device and Host)
+		 * In Host mode this bit contains handsake response to
+		 * LPM transaction.
+		 * In Device mode the response of the core to
+		 * LPM transaction received is reflected in these two bits.
+			- 0x0 : ERROR (No handshake response)
+			- 0x1 : STALL
+			- 0x2 : NYET
+			- 0x3 : ACK
+		 */
+		unsigned lpm_resp:2;
+		/** Port Sleep Status (SlpSts) (Device and Host)
+		 * This bit is set as long as a Sleep condition
+		 * is present on the USB bus.
+		 */
+		unsigned prt_sleep_sts:1;
+		/** Sleep State Resume OK (L1ResumeOK) (Device and Host)
+		 * Indicates that the application or host
+		 * can start resume from Sleep state.
+		 */
+		unsigned sleep_state_resumeok:1;
+		/** LPM channel Index (LPM_Chnl_Indx) (Host)
+		 * The channel number on which the LPM transaction
+		 * has to be applied while sending
+		 * an LPM transaction to the local device.
+		 */
+		unsigned lpm_chan_index:4;
+		/** LPM Retry Count (LPM_Retry_Cnt) (Host)
+		 * Number host retries that would be performed
+		 * if the device response was not valid response.
+		 */
+		unsigned retry_count:3;
+		/** Send LPM Transaction (SndLPM) (Host)
+		 * When set by application software,
+		 * an LPM transaction containing two tokens
+		 * is sent.
+		 */
+		unsigned send_lpm:1;
+		/** LPM Retry status (LPM_RetryCnt_Sts) (Host)
+		 * Number of LPM Host Retries still remaining
+		 * to be transmitted for the current LPM sequence
+		 */
+		unsigned retry_count_sts:3;
+		unsigned reserved28_29:2;
+		/** In host mode once this bit is set, the host
+		 * configures to drive the HSIC Idle state on the bus.
+		 * It then waits for the  device to initiate the Connect sequence.
+		 * In device mode once this bit is set, the device waits for
+		 * the HSIC Idle line state on the bus. Upon receving the Idle
+		 * line state, it initiates the HSIC Connect sequence.
+		 */
+		unsigned hsic_connect:1;
+		/** This bit overrides and functionally inverts
+		 * the if_select_hsic input port signal.
+		 */
+		unsigned inv_sel_hsic:1;
+	} b;
+} glpmcfg_data_t;
+
+/**
+ * This union represents the bit fields of the Core ADP Timer, Control and
+ * Status Register (ADPTIMCTLSTS). Set the bits using bit fields then write
+ * the <i>d32</i> value to the register.
+ */
+typedef union adpctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Probe Discharge (PRB_DSCHG)
+		 *  These bits set the times for TADP_DSCHG.
+		 *  These bits are defined as follows:
+		 *  2'b00 - 4 msec
+		 *  2'b01 - 8 msec
+		 *  2'b10 - 16 msec
+		 *  2'b11 - 32 msec
+		 */
+		unsigned prb_dschg:2;
+		/** Probe Delta (PRB_DELTA)
+		 *  These bits set the resolution for RTIM   value.
+		 *  The bits are defined in units of 32 kHz clock cycles as follows:
+		 *  2'b00  -  1 cycles
+		 *  2'b01  -  2 cycles
+		 *  2'b10 -  3 cycles
+		 *  2'b11 - 4 cycles
+		 *  For example if this value is chosen to 2'b01, it means that RTIM
+		 *  increments for every 3(three) 32Khz clock cycles.
+		 */
+		unsigned prb_delta:2;
+		/** Probe Period (PRB_PER)
+		 *  These bits sets the TADP_PRD as shown in Figure 4 as follows:
+		 *  2'b00  -  0.625 to 0.925 sec (typical 0.775 sec)
+		 *  2'b01  -  1.25 to 1.85 sec (typical 1.55 sec)
+		 *  2'b10  -  1.9 to 2.6 sec (typical 2.275 sec)
+		 *  2'b11  -  Reserved
+		 */
+		unsigned prb_per:2;
+		/** These bits capture the latest time it took for VBUS to ramp from
+		 *  VADP_SINK to VADP_PRB.
+		 *  0x000  -  1 cycles
+		 *  0x001  -  2 cycles
+		 *  0x002  -  3 cycles
+		 *  etc
+		 *  0x7FF  -  2048 cycles
+		 *  A time of 1024 cycles at 32 kHz corresponds to a time of 32 msec.
+		*/
+		unsigned rtim:11;
+		/** Enable Probe (EnaPrb)
+		 *  When programmed to 1'b1, the core performs a probe operation.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned enaprb:1;
+		/** Enable Sense (EnaSns)
+		 *  When programmed to 1'b1, the core performs a Sense operation.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned enasns:1;
+		/** ADP Reset (ADPRes)
+		 *  When set, ADP controller is reset.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adpres:1;
+		/** ADP Enable (ADPEn)
+		 *  When set, the core performs either ADP probing or sensing
+		 *  based on EnaPrb or EnaSns.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adpen:1;
+		/** ADP Probe Interrupt (ADP_PRB_INT)
+		 *  When this bit is set, it means that the VBUS
+		 *  voltage is greater than VADP_PRB or VADP_PRB is reached.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_prb_int:1;
+		/**
+		 *  ADP Sense Interrupt (ADP_SNS_INT)
+		 *  When this bit is set, it means that the VBUS voltage is greater than
+		 *  VADP_SNS value or VADP_SNS is reached.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_sns_int:1;
+		/** ADP Tomeout Interrupt (ADP_TMOUT_INT)
+		 *  This bit is relevant only for an ADP probe.
+		 *  When this bit is set, it means that the ramp time has
+		 *  completed ie ADPCTL.RTIM has reached its terminal value
+		 *  of 0x7FF.  This is a debug feature that allows software
+		 *  to read the ramp time after each cycle.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_tmout_int:1;
+		/** ADP Probe Interrupt Mask (ADP_PRB_INT_MSK)
+		 *  When this bit is set, it unmasks the interrupt due to ADP_PRB_INT.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_prb_int_msk:1;
+		/** ADP Sense Interrupt Mask (ADP_SNS_INT_MSK)
+		 *  When this bit is set, it unmasks the interrupt due to ADP_SNS_INT.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_sns_int_msk:1;
+		/** ADP Timoeout Interrupt Mask (ADP_TMOUT_MSK)
+		 *  When this bit is set, it unmasks the interrupt due to ADP_TMOUT_INT.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_tmout_int_msk:1;
+		/** Access Request
+		 * 2'b00 - Read/Write Valid (updated by the core)
+		 * 2'b01 - Read
+		 * 2'b00 - Write
+		 * 2'b00 - Reserved
+		 */
+		unsigned ar:2;
+		 /** Reserved */
+		unsigned reserved29_31:3;
+	} b;
+} adpctl_data_t;
+
+////////////////////////////////////////////
+// Device Registers
+/**
+ * Device Global Registers. <i>Offsets 800h-BFFh</i>
+ *
+ * The following structures define the size and relative field offsets
+ * for the Device Mode Registers.
+ *
+ * <i>These registers are visible only in Device mode and must not be
+ * accessed in Host mode, as the results are unknown.</i>
+ */
+typedef struct dwc_otg_dev_global_regs {
+	/** Device Configuration Register. <i>Offset 800h</i> */
+	volatile uint32_t dcfg;
+	/** Device Control Register. <i>Offset: 804h</i> */
+	volatile uint32_t dctl;
+	/** Device Status Register (Read Only). <i>Offset: 808h</i> */
+	volatile uint32_t dsts;
+	/** Reserved. <i>Offset: 80Ch</i> */
+	uint32_t unused;
+	/** Device IN Endpoint Common Interrupt Mask
+	 * Register. <i>Offset: 810h</i> */
+	volatile uint32_t diepmsk;
+	/** Device OUT Endpoint Common Interrupt Mask
+	 * Register. <i>Offset: 814h</i> */
+	volatile uint32_t doepmsk;
+	/** Device All Endpoints Interrupt Register.  <i>Offset: 818h</i> */
+	volatile uint32_t daint;
+	/** Device All Endpoints Interrupt Mask Register.  <i>Offset:
+	 * 81Ch</i> */
+	volatile uint32_t daintmsk;
+	/** Device IN Token Queue Read Register-1 (Read Only).
+	 * <i>Offset: 820h</i> */
+	volatile uint32_t dtknqr1;
+	/** Device IN Token Queue Read Register-2 (Read Only).
+	 * <i>Offset: 824h</i> */
+	volatile uint32_t dtknqr2;
+	/** Device VBUS	 discharge Register.  <i>Offset: 828h</i> */
+	volatile uint32_t dvbusdis;
+	/** Device VBUS Pulse Register.	 <i>Offset: 82Ch</i> */
+	volatile uint32_t dvbuspulse;
+	/** Device IN Token Queue Read Register-3 (Read Only). /
+	 *	Device Thresholding control register (Read/Write)
+	 * <i>Offset: 830h</i> */
+	volatile uint32_t dtknqr3_dthrctl;
+	/** Device IN Token Queue Read Register-4 (Read Only). /
+	 *	Device IN EPs empty Inr. Mask Register (Read/Write)
+	 * <i>Offset: 834h</i> */
+	volatile uint32_t dtknqr4_fifoemptymsk;
+	/** Device Each Endpoint Interrupt Register (Read Only). /
+	 * <i>Offset: 838h</i> */
+	volatile uint32_t deachint;
+	/** Device Each Endpoint Interrupt mask Register (Read/Write). /
+	 * <i>Offset: 83Ch</i> */
+	volatile uint32_t deachintmsk;
+	/** Device Each In Endpoint Interrupt mask Register (Read/Write). /
+	 * <i>Offset: 840h</i> */
+	volatile uint32_t diepeachintmsk[MAX_EPS_CHANNELS];
+	/** Device Each Out Endpoint Interrupt mask Register (Read/Write). /
+	 * <i>Offset: 880h</i> */
+	volatile uint32_t doepeachintmsk[MAX_EPS_CHANNELS];
+} dwc_otg_device_global_regs_t;
+
+/**
+ * This union represents the bit fields in the Device Configuration
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.  Write the
+ * <i>d32</i> member to the dcfg register.
+ */
+typedef union dcfg_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Device Speed */
+		unsigned devspd:2;
+		/** Non Zero Length Status OUT Handshake */
+		unsigned nzstsouthshk:1;
+#define DWC_DCFG_SEND_STALL 1
+
+		unsigned ena32khzs:1;
+		/** Device Addresses */
+		unsigned devaddr:7;
+		/** Periodic Frame Interval */
+		unsigned perfrint:2;
+#define DWC_DCFG_FRAME_INTERVAL_80 0
+#define DWC_DCFG_FRAME_INTERVAL_85 1
+#define DWC_DCFG_FRAME_INTERVAL_90 2
+#define DWC_DCFG_FRAME_INTERVAL_95 3
+
+		/** Enable Device OUT NAK for bulk in DDMA mode */
+		unsigned endevoutnak:1;
+
+		unsigned reserved14_17:4;
+		/** In Endpoint Mis-match count */
+		unsigned epmscnt:5;
+		/** Enable Descriptor DMA in Device mode */
+		unsigned descdma:1;
+		unsigned perschintvl:2;
+		unsigned resvalid:6;
+	} b;
+} dcfg_data_t;
+
+/**
+ * This union represents the bit fields in the Device Control
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union dctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Remote Wakeup */
+		unsigned rmtwkupsig:1;
+		/** Soft Disconnect */
+		unsigned sftdiscon:1;
+		/** Global Non-Periodic IN NAK Status */
+		unsigned gnpinnaksts:1;
+		/** Global OUT NAK Status */
+		unsigned goutnaksts:1;
+		/** Test Control */
+		unsigned tstctl:3;
+		/** Set Global Non-Periodic IN NAK */
+		unsigned sgnpinnak:1;
+		/** Clear Global Non-Periodic IN NAK */
+		unsigned cgnpinnak:1;
+		/** Set Global OUT NAK */
+		unsigned sgoutnak:1;
+		/** Clear Global OUT NAK */
+		unsigned cgoutnak:1;
+		/** Power-On Programming Done */
+		unsigned pwronprgdone:1;
+		/** Reserved */
+		unsigned reserved:1;
+		/** Global Multi Count */
+		unsigned gmc:2;
+		/** Ignore Frame Number for ISOC EPs */
+		unsigned ifrmnum:1;
+		/** NAK on Babble */
+		unsigned nakonbble:1;
+		/** Enable Continue on BNA */
+		unsigned encontonbna:1;
+
+		unsigned reserved18_31:14;
+	} b;
+} dctl_data_t;
+
+/**
+ * This union represents the bit fields in the Device Status
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union dsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Suspend Status */
+		unsigned suspsts:1;
+		/** Enumerated Speed */
+		unsigned enumspd:2;
+#define DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ 0
+#define DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ 1
+#define DWC_DSTS_ENUMSPD_LS_PHY_6MHZ		   2
+#define DWC_DSTS_ENUMSPD_FS_PHY_48MHZ		   3
+		/** Erratic Error */
+		unsigned errticerr:1;
+		unsigned reserved4_7:4;
+		/** Frame or Microframe Number of the received SOF */
+		unsigned soffn:14;
+		unsigned reserved22_31:10;
+	} b;
+} dsts_data_t;
+
+/**
+ * This union represents the bit fields in the Device IN EP Interrupt
+ * Register and the Device IN EP Common Mask Register.
+ *
+ * - Read the register into the <i>d32</i> member then set/clear the
+ *	 bits using the <i>b</i>it elements.
+ */
+typedef union diepint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Transfer complete mask */
+		unsigned xfercompl:1;
+		/** Endpoint disable mask */
+		unsigned epdisabled:1;
+		/** AHB Error mask */
+		unsigned ahberr:1;
+		/** TimeOUT Handshake mask (non-ISOC EPs) */
+		unsigned timeout:1;
+		/** IN Token received with TxF Empty mask */
+		unsigned intktxfemp:1;
+		/** IN Token Received with EP mismatch mask */
+		unsigned intknepmis:1;
+		/** IN Endpoint NAK Effective mask */
+		unsigned inepnakeff:1;
+		/** Reserved */
+		unsigned emptyintr:1;
+
+		unsigned txfifoundrn:1;
+
+		/** BNA Interrupt mask */
+		unsigned bna:1;
+
+		unsigned reserved10_12:3;
+		/** BNA Interrupt mask */
+		unsigned nak:1;
+
+		unsigned reserved14_31:18;
+	} b;
+} diepint_data_t;
+
+/**
+ * This union represents the bit fields in the Device IN EP
+ * Common/Dedicated Interrupt Mask Register.
+ */
+typedef union diepint_data diepmsk_data_t;
+
+/**
+ * This union represents the bit fields in the Device OUT EP Interrupt
+ * Registerand Device OUT EP Common Interrupt Mask Register.
+ *
+ * - Read the register into the <i>d32</i> member then set/clear the
+ *	 bits using the <i>b</i>it elements.
+ */
+typedef union doepint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Transfer complete */
+		unsigned xfercompl:1;
+		/** Endpoint disable  */
+		unsigned epdisabled:1;
+		/** AHB Error */
+		unsigned ahberr:1;
+		/** Setup Phase Done (contorl EPs) */
+		unsigned setup:1;
+		/** OUT Token Received when Endpoint Disabled */
+		unsigned outtknepdis:1;
+
+		unsigned stsphsercvd:1;
+		/** Back-to-Back SETUP Packets Received */
+		unsigned back2backsetup:1;
+
+		unsigned reserved7:1;
+		/** OUT packet Error */
+		unsigned outpkterr:1;
+		/** BNA Interrupt */
+		unsigned bna:1;
+
+		unsigned reserved10:1;
+		/** Packet Drop Status */
+		unsigned pktdrpsts:1;
+		/** Babble Interrupt */
+		unsigned babble:1;
+		/** NAK Interrupt */
+		unsigned nak:1;
+		/** NYET Interrupt */
+		unsigned nyet:1;
+		/** Bit indicating setup packet received */
+		unsigned sr:1;
+
+		unsigned reserved16_31:16;
+	} b;
+} doepint_data_t;
+
+/**
+ * This union represents the bit fields in the Device OUT EP
+ * Common/Dedicated Interrupt Mask Register.
+ */
+typedef union doepint_data doepmsk_data_t;
+
+/**
+ * This union represents the bit fields in the Device All EP Interrupt
+ * and Mask Registers.
+ * - Read the register into the <i>d32</i> member then set/clear the
+ *	 bits using the <i>b</i>it elements.
+ */
+typedef union daint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** IN Endpoint bits */
+		unsigned in:16;
+		/** OUT Endpoint bits */
+		unsigned out:16;
+	} ep;
+	struct {
+		/** IN Endpoint bits */
+		unsigned inep0:1;
+		unsigned inep1:1;
+		unsigned inep2:1;
+		unsigned inep3:1;
+		unsigned inep4:1;
+		unsigned inep5:1;
+		unsigned inep6:1;
+		unsigned inep7:1;
+		unsigned inep8:1;
+		unsigned inep9:1;
+		unsigned inep10:1;
+		unsigned inep11:1;
+		unsigned inep12:1;
+		unsigned inep13:1;
+		unsigned inep14:1;
+		unsigned inep15:1;
+		/** OUT Endpoint bits */
+		unsigned outep0:1;
+		unsigned outep1:1;
+		unsigned outep2:1;
+		unsigned outep3:1;
+		unsigned outep4:1;
+		unsigned outep5:1;
+		unsigned outep6:1;
+		unsigned outep7:1;
+		unsigned outep8:1;
+		unsigned outep9:1;
+		unsigned outep10:1;
+		unsigned outep11:1;
+		unsigned outep12:1;
+		unsigned outep13:1;
+		unsigned outep14:1;
+		unsigned outep15:1;
+	} b;
+} daint_data_t;
+
+/**
+ * This union represents the bit fields in the Device IN Token Queue
+ * Read Registers.
+ * - Read the register into the <i>d32</i> member.
+ * - READ-ONLY Register
+ */
+typedef union dtknq1_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** In Token Queue Write Pointer */
+		unsigned intknwptr:5;
+		/** Reserved */
+		unsigned reserved05_06:2;
+		/** write pointer has wrapped. */
+		unsigned wrap_bit:1;
+		/** EP Numbers of IN Tokens 0 ... 4 */
+		unsigned epnums0_5:24;
+	} b;
+} dtknq1_data_t;
+
+/**
+ * This union represents Threshold control Register
+ * - Read and write the register into the <i>d32</i> member.
+ * - READ-WRITABLE Register
+ */
+typedef union dthrctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** non ISO Tx Thr. Enable */
+		unsigned non_iso_thr_en:1;
+		/** ISO Tx Thr. Enable */
+		unsigned iso_thr_en:1;
+		/** Tx Thr. Length */
+		unsigned tx_thr_len:9;
+		/** AHB Threshold ratio */
+		unsigned ahb_thr_ratio:2;
+		/** Reserved */
+		unsigned reserved13_15:3;
+		/** Rx Thr. Enable */
+		unsigned rx_thr_en:1;
+		/** Rx Thr. Length */
+		unsigned rx_thr_len:9;
+		unsigned reserved26:1;
+		/** Arbiter Parking Enable*/
+		unsigned arbprken:1;
+		/** Reserved */
+		unsigned reserved28_31:4;
+	} b;
+} dthrctl_data_t;
+
+/**
+ * Device Logical IN Endpoint-Specific Registers. <i>Offsets
+ * 900h-AFCh</i>
+ *
+ * There will be one set of endpoint registers per logical endpoint
+ * implemented.
+ *
+ * <i>These registers are visible only in Device mode and must not be
+ * accessed in Host mode, as the results are unknown.</i>
+ */
+typedef struct dwc_otg_dev_in_ep_regs {
+	/** Device IN Endpoint Control Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 00h</i> */
+	volatile uint32_t diepctl;
+	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 04h</i> */
+	uint32_t reserved04;
+	/** Device IN Endpoint Interrupt Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 08h</i> */
+	volatile uint32_t diepint;
+	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 0Ch</i> */
+	uint32_t reserved0C;
+	/** Device IN Endpoint Transfer Size
+	 * Register. <i>Offset:900h + (ep_num * 20h) + 10h</i> */
+	volatile uint32_t dieptsiz;
+	/** Device IN Endpoint DMA Address Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 14h</i> */
+	volatile uint32_t diepdma;
+	/** Device IN Endpoint Transmit FIFO Status Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 18h</i> */
+	volatile uint32_t dtxfsts;
+	/** Device IN Endpoint DMA Buffer Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 1Ch</i> */
+	volatile uint32_t diepdmab;
+} dwc_otg_dev_in_ep_regs_t;
+
+/**
+ * Device Logical OUT Endpoint-Specific Registers. <i>Offsets:
+ * B00h-CFCh</i>
+ *
+ * There will be one set of endpoint registers per logical endpoint
+ * implemented.
+ *
+ * <i>These registers are visible only in Device mode and must not be
+ * accessed in Host mode, as the results are unknown.</i>
+ */
+typedef struct dwc_otg_dev_out_ep_regs {
+	/** Device OUT Endpoint Control Register. <i>Offset:B00h +
+	 * (ep_num * 20h) + 00h</i> */
+	volatile uint32_t doepctl;
+	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 04h</i> */
+	uint32_t reserved04;
+	/** Device OUT Endpoint Interrupt Register. <i>Offset:B00h +
+	 * (ep_num * 20h) + 08h</i> */
+	volatile uint32_t doepint;
+	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 0Ch</i> */
+	uint32_t reserved0C;
+	/** Device OUT Endpoint Transfer Size Register. <i>Offset:
+	 * B00h + (ep_num * 20h) + 10h</i> */
+	volatile uint32_t doeptsiz;
+	/** Device OUT Endpoint DMA Address Register. <i>Offset:B00h
+	 * + (ep_num * 20h) + 14h</i> */
+	volatile uint32_t doepdma;
+	/** Reserved. <i>Offset:B00h + 	 * (ep_num * 20h) + 18h</i> */
+	uint32_t unused;
+	/** Device OUT Endpoint DMA Buffer Register. <i>Offset:B00h
+	 * + (ep_num * 20h) + 1Ch</i> */
+	uint32_t doepdmab;
+} dwc_otg_dev_out_ep_regs_t;
+
+/**
+ * This union represents the bit fields in the Device EP Control
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union depctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Maximum Packet Size
+		 * IN/OUT EPn
+		 * IN/OUT EP0 - 2 bits
+		 *	 2'b00: 64 Bytes
+		 *	 2'b01: 32
+		 *	 2'b10: 16
+		 *	 2'b11: 8 */
+		unsigned mps:11;
+#define DWC_DEP0CTL_MPS_64	 0
+#define DWC_DEP0CTL_MPS_32	 1
+#define DWC_DEP0CTL_MPS_16	 2
+#define DWC_DEP0CTL_MPS_8	 3
+
+		/** Next Endpoint
+		 * IN EPn/IN EP0
+		 * OUT EPn/OUT EP0 - reserved */
+		unsigned nextep:4;
+
+		/** USB Active Endpoint */
+		unsigned usbactep:1;
+
+		/** Endpoint DPID (INTR/Bulk IN and OUT endpoints)
+		 * This field contains the PID of the packet going to
+		 * be received or transmitted on this endpoint. The
+		 * application should program the PID of the first
+		 * packet going to be received or transmitted on this
+		 * endpoint , after the endpoint is
+		 * activated. Application use the SetD1PID and
+		 * SetD0PID fields of this register to program either
+		 * D0 or D1 PID.
+		 *
+		 * The encoding for this field is
+		 *	 - 0: D0
+		 *	 - 1: D1
+		 */
+		unsigned dpid:1;
+
+		/** NAK Status */
+		unsigned naksts:1;
+
+		/** Endpoint Type
+		 *	2'b00: Control
+		 *	2'b01: Isochronous
+		 *	2'b10: Bulk
+		 *	2'b11: Interrupt */
+		unsigned eptype:2;
+
+		/** Snoop Mode
+		 * OUT EPn/OUT EP0
+		 * IN EPn/IN EP0 - reserved */
+		unsigned snp:1;
+
+		/** Stall Handshake */
+		unsigned stall:1;
+
+		/** Tx Fifo Number
+		 * IN EPn/IN EP0
+		 * OUT EPn/OUT EP0 - reserved */
+		unsigned txfnum:4;
+
+		/** Clear NAK */
+		unsigned cnak:1;
+		/** Set NAK */
+		unsigned snak:1;
+		/** Set DATA0 PID (INTR/Bulk IN and OUT endpoints)
+		 * Writing to this field sets the Endpoint DPID (DPID)
+		 * field in this register to DATA0. Set Even
+		 * (micro)frame (SetEvenFr) (ISO IN and OUT Endpoints)
+		 * Writing to this field sets the Even/Odd
+		 * (micro)frame (EO_FrNum) field to even (micro)
+		 * frame.
+		 */
+		unsigned setd0pid:1;
+		/** Set DATA1 PID (INTR/Bulk IN and OUT endpoints)
+		 * Writing to this field sets the Endpoint DPID (DPID)
+		 * field in this register to DATA1 Set Odd
+		 * (micro)frame (SetOddFr) (ISO IN and OUT Endpoints)
+		 * Writing to this field sets the Even/Odd
+		 * (micro)frame (EO_FrNum) field to odd (micro) frame.
+		 */
+		unsigned setd1pid:1;
+
+		/** Endpoint Disable */
+		unsigned epdis:1;
+		/** Endpoint Enable */
+		unsigned epena:1;
+	} b;
+} depctl_data_t;
+
+/**
+ * This union represents the bit fields in the Device EP Transfer
+ * Size Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union deptsiz_data {
+		/** raw register data */
+	uint32_t d32;
+		/** register bits */
+	struct {
+		/** Transfer size */
+		unsigned xfersize:19;
+/** Max packet count for EP (pow(2,10)-1) */
+#define MAX_PKT_CNT 1023
+		/** Packet Count */
+		unsigned pktcnt:10;
+		/** Multi Count - Periodic IN endpoints */
+		unsigned mc:2;
+		unsigned reserved:1;
+	} b;
+} deptsiz_data_t;
+
+/**
+ * This union represents the bit fields in the Device EP 0 Transfer
+ * Size Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union deptsiz0_data {
+		/** raw register data */
+	uint32_t d32;
+		/** register bits */
+	struct {
+		/** Transfer size */
+		unsigned xfersize:7;
+				/** Reserved */
+		unsigned reserved7_18:12;
+		/** Packet Count */
+		unsigned pktcnt:2;
+				/** Reserved */
+		unsigned reserved21_28:8;
+				/**Setup Packet Count (DOEPTSIZ0 Only) */
+		unsigned supcnt:2;
+		unsigned reserved31;
+	} b;
+} deptsiz0_data_t;
+
+/////////////////////////////////////////////////
+// DMA Descriptor Specific Structures
+//
+
+/** Buffer status definitions */
+
+#define BS_HOST_READY	0x0
+#define BS_DMA_BUSY		0x1
+#define BS_DMA_DONE		0x2
+#define BS_HOST_BUSY	0x3
+
+/** Receive/Transmit status definitions */
+
+#define RTS_SUCCESS		0x0
+#define RTS_BUFFLUSH	0x1
+#define RTS_RESERVED	0x2
+#define RTS_BUFERR		0x3
+
+/**
+ * This union represents the bit fields in the DMA Descriptor
+ * status quadlet. Read the quadlet into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it, <i>b_iso_out</i> and
+ * <i>b_iso_in</i> elements.
+ */
+typedef union dev_dma_desc_sts {
+		/** raw register data */
+	uint32_t d32;
+		/** quadlet bits */
+	struct {
+		/** Received number of bytes */
+		unsigned bytes:16;
+		/** NAK bit - only for OUT EPs */
+		unsigned nak:1;
+		unsigned reserved17_22:6;
+		/** Multiple Transfer - only for OUT EPs */
+		unsigned mtrf:1;
+		/** Setup Packet received - only for OUT EPs */
+		unsigned sr:1;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** Short Packet */
+		unsigned sp:1;
+		/** Last */
+		unsigned l:1;
+		/** Receive Status */
+		unsigned sts:2;
+		/** Buffer Status */
+		unsigned bs:2;
+	} b;
+
+//#ifdef DWC_EN_ISOC
+		/** iso out quadlet bits */
+	struct {
+		/** Received number of bytes */
+		unsigned rxbytes:11;
+
+		unsigned reserved11:1;
+		/** Frame Number */
+		unsigned framenum:11;
+		/** Received ISO Data PID */
+		unsigned pid:2;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** Short Packet */
+		unsigned sp:1;
+		/** Last */
+		unsigned l:1;
+		/** Receive Status */
+		unsigned rxsts:2;
+		/** Buffer Status */
+		unsigned bs:2;
+	} b_iso_out;
+
+		/** iso in quadlet bits */
+	struct {
+		/** Transmited number of bytes */
+		unsigned txbytes:12;
+		/** Frame Number */
+		unsigned framenum:11;
+		/** Transmited ISO Data PID */
+		unsigned pid:2;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** Short Packet */
+		unsigned sp:1;
+		/** Last */
+		unsigned l:1;
+		/** Transmit Status */
+		unsigned txsts:2;
+		/** Buffer Status */
+		unsigned bs:2;
+	} b_iso_in;
+//#endif                                /* DWC_EN_ISOC */
+} dev_dma_desc_sts_t;
+
+/**
+ * DMA Descriptor structure
+ *
+ * DMA Descriptor structure contains two quadlets:
+ * Status quadlet and Data buffer pointer.
+ */
+typedef struct dwc_otg_dev_dma_desc {
+	/** DMA Descriptor status quadlet */
+	dev_dma_desc_sts_t status;
+	/** DMA Descriptor data buffer pointer */
+	uint32_t buf;
+} dwc_otg_dev_dma_desc_t;
+
+/**
+ * The dwc_otg_dev_if structure contains information needed to manage
+ * the DWC_otg controller acting in device mode. It represents the
+ * programming view of the device-specific aspects of the controller.
+ */
+typedef struct dwc_otg_dev_if {
+	/** Pointer to device Global registers.
+	 * Device Global Registers starting at offset 800h
+	 */
+	dwc_otg_device_global_regs_t *dev_global_regs;
+#define DWC_DEV_GLOBAL_REG_OFFSET 0x800
+
+	/**
+	 * Device Logical IN Endpoint-Specific Registers 900h-AFCh
+	 */
+	dwc_otg_dev_in_ep_regs_t *in_ep_regs[MAX_EPS_CHANNELS];
+#define DWC_DEV_IN_EP_REG_OFFSET 0x900
+#define DWC_EP_REG_OFFSET 0x20
+
+	/** Device Logical OUT Endpoint-Specific Registers B00h-CFCh */
+	dwc_otg_dev_out_ep_regs_t *out_ep_regs[MAX_EPS_CHANNELS];
+#define DWC_DEV_OUT_EP_REG_OFFSET 0xB00
+
+	/* Device configuration information */
+	uint8_t speed;				 /**< Device Speed	0: Unknown, 1: LS, 2:FS, 3: HS */
+	uint8_t num_in_eps;		 /**< Number # of Tx EP range: 0-15 exept ep0 */
+	uint8_t num_out_eps;		 /**< Number # of Rx EP range: 0-15 exept ep 0*/
+
+	/** Size of periodic FIFOs (Bytes) */
+	uint16_t perio_tx_fifo_size[MAX_PERIO_FIFOS];
+
+	/** Size of Tx FIFOs (Bytes) */
+	uint16_t tx_fifo_size[MAX_TX_FIFOS];
+
+	/** Thresholding enable flags and length varaiables **/
+	uint16_t rx_thr_en;
+	uint16_t iso_tx_thr_en;
+	uint16_t non_iso_tx_thr_en;
+
+	uint16_t rx_thr_length;
+	uint16_t tx_thr_length;
+
+	/**
+	 * Pointers to the DMA Descriptors for EP0 Control
+	 * transfers (virtual and physical)
+	 */
+
+	/** 2 descriptors for SETUP packets */
+	dwc_dma_t dma_setup_desc_addr[2];
+	dwc_otg_dev_dma_desc_t *setup_desc_addr[2];
+
+	/** Pointer to Descriptor with latest SETUP packet */
+	dwc_otg_dev_dma_desc_t *psetup;
+
+	/** Index of current SETUP handler descriptor */
+	uint32_t setup_desc_index;
+
+	/** Descriptor for Data In or Status In phases */
+	dwc_dma_t dma_in_desc_addr;
+	dwc_otg_dev_dma_desc_t *in_desc_addr;
+
+	/** Descriptor for Data Out or Status Out phases */
+	dwc_dma_t dma_out_desc_addr;
+	dwc_otg_dev_dma_desc_t *out_desc_addr;
+
+	/** Setup Packet Detected - if set clear NAK when queueing */
+	uint32_t spd;
+	/** Isoc ep pointer on which incomplete happens */
+	void *isoc_ep;
+
+} dwc_otg_dev_if_t;
+
+/////////////////////////////////////////////////
+// Host Mode Register Structures
+//
+/**
+ * The Host Global Registers structure defines the size and relative
+ * field offsets for the Host Mode Global Registers.  Host Global
+ * Registers offsets 400h-7FFh.
+*/
+typedef struct dwc_otg_host_global_regs {
+	/** Host Configuration Register.   <i>Offset: 400h</i> */
+	volatile uint32_t hcfg;
+	/** Host Frame Interval Register.	<i>Offset: 404h</i> */
+	volatile uint32_t hfir;
+	/** Host Frame Number / Frame Remaining Register. <i>Offset: 408h</i> */
+	volatile uint32_t hfnum;
+	/** Reserved.	<i>Offset: 40Ch</i> */
+	uint32_t reserved40C;
+	/** Host Periodic Transmit FIFO/ Queue Status Register. <i>Offset: 410h</i> */
+	volatile uint32_t hptxsts;
+	/** Host All Channels Interrupt Register. <i>Offset: 414h</i> */
+	volatile uint32_t haint;
+	/** Host All Channels Interrupt Mask Register. <i>Offset: 418h</i> */
+	volatile uint32_t haintmsk;
+	/** Host Frame List Base Address Register . <i>Offset: 41Ch</i> */
+	volatile uint32_t hflbaddr;
+} dwc_otg_host_global_regs_t;
+
+/**
+ * This union represents the bit fields in the Host Configuration Register.
+ * Read the register into the <i>d32</i> member then set/clear the bits using
+ * the <i>b</i>it elements. Write the <i>d32</i> member to the hcfg register.
+ */
+typedef union hcfg_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** FS/LS Phy Clock Select */
+		unsigned fslspclksel:2;
+#define DWC_HCFG_30_60_MHZ 0
+#define DWC_HCFG_48_MHZ	   1
+#define DWC_HCFG_6_MHZ	   2
+
+		/** FS/LS Only Support */
+		unsigned fslssupp:1;
+		unsigned reserved3_6:4;
+		/** Enable 32-KHz Suspend Mode */
+		unsigned ena32khzs:1;
+		/** Resume Validation Periiod */
+		unsigned resvalid:8;
+		unsigned reserved16_22:7;
+		/** Enable Scatter/gather DMA in Host mode */
+		unsigned descdma:1;
+		/** Frame List Entries */
+		unsigned frlisten:2;
+		/** Enable Periodic Scheduling */
+		unsigned perschedena:1;
+		unsigned reserved27_30:4;
+		unsigned modechtimen:1;
+	} b;
+} hcfg_data_t;
+
+/**
+ * This union represents the bit fields in the Host Frame Remaing/Number
+ * Register.
+ */
+typedef union hfir_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned frint:16;
+		unsigned hfirrldctrl:1;
+		unsigned reserved:15;
+	} b;
+} hfir_data_t;
+
+/**
+ * This union represents the bit fields in the Host Frame Remaing/Number
+ * Register.
+ */
+typedef union hfnum_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned frnum:16;
+#define DWC_HFNUM_MAX_FRNUM 0x3FFF
+		unsigned frrem:16;
+	} b;
+} hfnum_data_t;
+
+typedef union hptxsts_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned ptxfspcavail:16;
+		unsigned ptxqspcavail:8;
+		/** Top of the Periodic Transmit Request Queue
+		 *	- bit 24 - Terminate (last entry for the selected channel)
+		 *	- bits 26:25 - Token Type
+		 *	  - 2'b00 - Zero length
+		 *	  - 2'b01 - Ping
+		 *	  - 2'b10 - Disable
+		 *	- bits 30:27 - Channel Number
+		 *	- bit 31 - Odd/even microframe
+		 */
+		unsigned ptxqtop_terminate:1;
+		unsigned ptxqtop_token:2;
+		unsigned ptxqtop_chnum:4;
+		unsigned ptxqtop_odd:1;
+	} b;
+} hptxsts_data_t;
+
+/**
+ * This union represents the bit fields in the Host Port Control and Status
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hprt0 register.
+ */
+typedef union hprt0_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned prtconnsts:1;
+		unsigned prtconndet:1;
+		unsigned prtena:1;
+		unsigned prtenchng:1;
+		unsigned prtovrcurract:1;
+		unsigned prtovrcurrchng:1;
+		unsigned prtres:1;
+		unsigned prtsusp:1;
+		unsigned prtrst:1;
+		unsigned reserved9:1;
+		unsigned prtlnsts:2;
+		unsigned prtpwr:1;
+		unsigned prttstctl:4;
+		unsigned prtspd:2;
+#define DWC_HPRT0_PRTSPD_HIGH_SPEED 0
+#define DWC_HPRT0_PRTSPD_FULL_SPEED 1
+#define DWC_HPRT0_PRTSPD_LOW_SPEED	2
+		unsigned reserved19_31:13;
+	} b;
+} hprt0_data_t;
+
+/**
+ * This union represents the bit fields in the Host All Interrupt
+ * Register.
+ */
+typedef union haint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned ch0:1;
+		unsigned ch1:1;
+		unsigned ch2:1;
+		unsigned ch3:1;
+		unsigned ch4:1;
+		unsigned ch5:1;
+		unsigned ch6:1;
+		unsigned ch7:1;
+		unsigned ch8:1;
+		unsigned ch9:1;
+		unsigned ch10:1;
+		unsigned ch11:1;
+		unsigned ch12:1;
+		unsigned ch13:1;
+		unsigned ch14:1;
+		unsigned ch15:1;
+		unsigned reserved:16;
+	} b;
+
+	struct {
+		unsigned chint:16;
+		unsigned reserved:16;
+	} b2;
+} haint_data_t;
+
+/**
+ * This union represents the bit fields in the Host All Interrupt
+ * Register.
+ */
+typedef union haintmsk_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned ch0:1;
+		unsigned ch1:1;
+		unsigned ch2:1;
+		unsigned ch3:1;
+		unsigned ch4:1;
+		unsigned ch5:1;
+		unsigned ch6:1;
+		unsigned ch7:1;
+		unsigned ch8:1;
+		unsigned ch9:1;
+		unsigned ch10:1;
+		unsigned ch11:1;
+		unsigned ch12:1;
+		unsigned ch13:1;
+		unsigned ch14:1;
+		unsigned ch15:1;
+		unsigned reserved:16;
+	} b;
+
+	struct {
+		unsigned chint:16;
+		unsigned reserved:16;
+	} b2;
+} haintmsk_data_t;
+
+/**
+ * Host Channel Specific Registers. <i>500h-5FCh</i>
+ */
+typedef struct dwc_otg_hc_regs {
+	/** Host Channel 0 Characteristic Register. <i>Offset: 500h + (chan_num * 20h) + 00h</i> */
+	volatile uint32_t hcchar;
+	/** Host Channel 0 Split Control Register. <i>Offset: 500h + (chan_num * 20h) + 04h</i> */
+	volatile uint32_t hcsplt;
+	/** Host Channel 0 Interrupt Register. <i>Offset: 500h + (chan_num * 20h) + 08h</i> */
+	volatile uint32_t hcint;
+	/** Host Channel 0 Interrupt Mask Register. <i>Offset: 500h + (chan_num * 20h) + 0Ch</i> */
+	volatile uint32_t hcintmsk;
+	/** Host Channel 0 Transfer Size Register. <i>Offset: 500h + (chan_num * 20h) + 10h</i> */
+	volatile uint32_t hctsiz;
+	/** Host Channel 0 DMA Address Register. <i>Offset: 500h + (chan_num * 20h) + 14h</i> */
+	volatile uint32_t hcdma;
+	volatile uint32_t reserved;
+	/** Host Channel 0 DMA Buffer Address Register. <i>Offset: 500h + (chan_num * 20h) + 1Ch</i> */
+	volatile uint32_t hcdmab;
+} dwc_otg_hc_regs_t;
+
+/**
+ * This union represents the bit fields in the Host Channel Characteristics
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hcchar register.
+ */
+typedef union hcchar_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Maximum packet size in bytes */
+		unsigned mps:11;
+
+		/** Endpoint number */
+		unsigned epnum:4;
+
+		/** 0: OUT, 1: IN */
+		unsigned epdir:1;
+
+		unsigned reserved:1;
+
+		/** 0: Full/high speed device, 1: Low speed device */
+		unsigned lspddev:1;
+
+		/** 0: Control, 1: Isoc, 2: Bulk, 3: Intr */
+		unsigned eptype:2;
+
+		/** Packets per frame for periodic transfers. 0 is reserved. */
+		unsigned multicnt:2;
+
+		/** Device address */
+		unsigned devaddr:7;
+
+		/**
+		 * Frame to transmit periodic transaction.
+		 * 0: even, 1: odd
+		 */
+		unsigned oddfrm:1;
+
+		/** Channel disable */
+		unsigned chdis:1;
+
+		/** Channel enable */
+		unsigned chen:1;
+	} b;
+} hcchar_data_t;
+
+typedef union hcsplt_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Port Address */
+		unsigned prtaddr:7;
+
+		/** Hub Address */
+		unsigned hubaddr:7;
+
+		/** Transaction Position */
+		unsigned xactpos:2;
+#define DWC_HCSPLIT_XACTPOS_MID 0
+#define DWC_HCSPLIT_XACTPOS_END 1
+#define DWC_HCSPLIT_XACTPOS_BEGIN 2
+#define DWC_HCSPLIT_XACTPOS_ALL 3
+
+		/** Do Complete Split */
+		unsigned compsplt:1;
+
+		/** Reserved */
+		unsigned reserved:14;
+
+		/** Split Enble */
+		unsigned spltena:1;
+	} b;
+} hcsplt_data_t;
+
+/**
+ * This union represents the bit fields in the Host All Interrupt
+ * Register.
+ */
+typedef union hcint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Transfer Complete */
+		unsigned xfercomp:1;
+		/** Channel Halted */
+		unsigned chhltd:1;
+		/** AHB Error */
+		unsigned ahberr:1;
+		/** STALL Response Received */
+		unsigned stall:1;
+		/** NAK Response Received */
+		unsigned nak:1;
+		/** ACK Response Received */
+		unsigned ack:1;
+		/** NYET Response Received */
+		unsigned nyet:1;
+		/** Transaction Err */
+		unsigned xacterr:1;
+		/** Babble Error */
+		unsigned bblerr:1;
+		/** Frame Overrun */
+		unsigned frmovrun:1;
+		/** Data Toggle Error */
+		unsigned datatglerr:1;
+		/** Buffer Not Available (only for DDMA mode) */
+		unsigned bna:1;
+		/** Exessive transaction error (only for DDMA mode) */
+		unsigned xcs_xact:1;
+		/** Frame List Rollover interrupt */
+		unsigned frm_list_roll:1;
+		/** Reserved */
+		unsigned reserved14_31:18;
+	} b;
+} hcint_data_t;
+
+/**
+ * This union represents the bit fields in the Host Channel Interrupt Mask
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hcintmsk register.
+ */
+typedef union hcintmsk_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned xfercompl:1;
+		unsigned chhltd:1;
+		unsigned ahberr:1;
+		unsigned stall:1;
+		unsigned nak:1;
+		unsigned ack:1;
+		unsigned nyet:1;
+		unsigned xacterr:1;
+		unsigned bblerr:1;
+		unsigned frmovrun:1;
+		unsigned datatglerr:1;
+		unsigned bna:1;
+		unsigned xcs_xact:1;
+		unsigned frm_list_roll:1;
+		unsigned reserved14_31:18;
+	} b;
+} hcintmsk_data_t;
+
+/**
+ * This union represents the bit fields in the Host Channel Transfer Size
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hcchar register.
+ */
+
+typedef union hctsiz_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Total transfer size in bytes */
+		unsigned xfersize:19;
+
+		/** Data packets to transfer */
+		unsigned pktcnt:10;
+
+		/**
+		 * Packet ID for next data packet
+		 * 0: DATA0
+		 * 1: DATA2
+		 * 2: DATA1
+		 * 3: MDATA (non-Control), SETUP (Control)
+		 */
+		unsigned pid:2;
+#define DWC_HCTSIZ_DATA0 0
+#define DWC_HCTSIZ_DATA1 2
+#define DWC_HCTSIZ_DATA2 1
+#define DWC_HCTSIZ_MDATA 3
+#define DWC_HCTSIZ_SETUP 3
+
+		/** Do PING protocol when 1 */
+		unsigned dopng:1;
+	} b;
+
+	/** register bits */
+	struct {
+		/** Scheduling information */
+		unsigned schinfo:8;
+
+		/** Number of transfer descriptors.
+		 * Max value:
+		 * 64 in general,
+		 * 256 only for HS isochronous endpoint.
+		 */
+		unsigned ntd:8;
+
+		/** Data packets to transfer */
+		unsigned reserved16_28:13;
+
+		/**
+		 * Packet ID for next data packet
+		 * 0: DATA0
+		 * 1: DATA2
+		 * 2: DATA1
+		 * 3: MDATA (non-Control)
+		 */
+		unsigned pid:2;
+
+		/** Do PING protocol when 1 */
+		unsigned dopng:1;
+	} b_ddma;
+} hctsiz_data_t;
+
+/**
+ * This union represents the bit fields in the Host DMA Address
+ * Register used in Descriptor DMA mode.
+ */
+typedef union hcdma_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned reserved0_2:3;
+		/** Current Transfer Descriptor. Not used for ISOC */
+		unsigned ctd:8;
+		/** Start Address of Descriptor List */
+		unsigned dma_addr:21;
+	} b;
+} hcdma_data_t;
+
+/**
+ * This union represents the bit fields in the DMA Descriptor
+ * status quadlet for host mode. Read the quadlet into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union host_dma_desc_sts {
+	/** raw register data */
+	uint32_t d32;
+	/** quadlet bits */
+
+	/* for non-isochronous  */
+	struct {
+		/** Number of bytes */
+		unsigned n_bytes:17;
+		/** QTD offset to jump when Short Packet received - only for IN EPs */
+		unsigned qtd_offset:6;
+		/**
+		 * Set to request the core to jump to alternate QTD if
+		 * Short Packet received - only for IN EPs
+		 */
+		unsigned a_qtd:1;
+		 /**
+		  * Setup Packet bit. When set indicates that buffer contains
+		  * setup packet.
+		  */
+		unsigned sup:1;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** End of List */
+		unsigned eol:1;
+		unsigned reserved27:1;
+		/** Rx/Tx Status */
+		unsigned sts:2;
+#define DMA_DESC_STS_PKTERR	1
+		unsigned reserved30:1;
+		/** Active Bit */
+		unsigned a:1;
+	} b;
+	/* for isochronous */
+	struct {
+		/** Number of bytes */
+		unsigned n_bytes:12;
+		unsigned reserved12_24:13;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		unsigned reserved26_27:2;
+		/** Rx/Tx Status */
+		unsigned sts:2;
+		unsigned reserved30:1;
+		/** Active Bit */
+		unsigned a:1;
+	} b_isoc;
+} host_dma_desc_sts_t;
+
+#define	MAX_DMA_DESC_SIZE		131071
+#define MAX_DMA_DESC_NUM_GENERIC	64
+#define MAX_DMA_DESC_NUM_HS_ISOC	256
+#define MAX_FRLIST_EN_NUM		64
+/**
+ * Host-mode DMA Descriptor structure
+ *
+ * DMA Descriptor structure contains two quadlets:
+ * Status quadlet and Data buffer pointer.
+ */
+typedef struct dwc_otg_host_dma_desc {
+	/** DMA Descriptor status quadlet */
+	host_dma_desc_sts_t status;
+	/** DMA Descriptor data buffer pointer */
+	uint32_t buf;
+} dwc_otg_host_dma_desc_t;
+
+/** OTG Host Interface Structure.
+ *
+ * The OTG Host Interface Structure structure contains information
+ * needed to manage the DWC_otg controller acting in host mode. It
+ * represents the programming view of the host-specific aspects of the
+ * controller.
+ */
+typedef struct dwc_otg_host_if {
+	/** Host Global Registers starting at offset 400h.*/
+	dwc_otg_host_global_regs_t *host_global_regs;
+#define DWC_OTG_HOST_GLOBAL_REG_OFFSET 0x400
+
+	/** Host Port 0 Control and Status Register */
+	volatile uint32_t *hprt0;
+#define DWC_OTG_HOST_PORT_REGS_OFFSET 0x440
+
+	/** Host Channel Specific Registers at offsets 500h-5FCh. */
+	dwc_otg_hc_regs_t *hc_regs[MAX_EPS_CHANNELS];
+#define DWC_OTG_HOST_CHAN_REGS_OFFSET 0x500
+#define DWC_OTG_CHAN_REGS_OFFSET 0x20
+
+	/* Host configuration information */
+	/** Number of Host Channels (range: 1-16) */
+	uint8_t num_host_channels;
+	/** Periodic EPs supported (0: no, 1: yes) */
+	uint8_t perio_eps_supported;
+	/** Periodic Tx FIFO Size (Only 1 host periodic Tx FIFO) */
+	uint16_t perio_tx_fifo_size;
+
+} dwc_otg_host_if_t;
+
+/**
+ * This union represents the bit fields in the Power and Clock Gating Control
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union pcgcctl_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Stop Pclk */
+		unsigned stoppclk:1;
+		/** Gate Hclk */
+		unsigned gatehclk:1;
+		/** Power Clamp */
+		unsigned pwrclmp:1;
+		/** Reset Power Down Modules */
+		unsigned rstpdwnmodule:1;
+		/** Reserved */
+		unsigned reserved:1;
+		/** Enable Sleep Clock Gating (Enbl_L1Gating) */
+		unsigned enbl_sleep_gating:1;
+		/** PHY In Sleep (PhySleep) */
+		unsigned phy_in_sleep:1;
+		/** Deep Sleep*/
+		unsigned deep_sleep:1;
+		unsigned resetaftsusp:1;
+		unsigned restoremode:1;
+		unsigned enbl_extnd_hiber:1;
+		unsigned extnd_hiber_pwrclmp:1;
+		unsigned extnd_hiber_switch:1;
+		unsigned ess_reg_restored:1;
+		unsigned prt_clk_sel:2;
+		unsigned port_power:1;
+		unsigned max_xcvrselect:2;
+		unsigned max_termsel:1;
+		unsigned mac_dev_addr:7;
+		unsigned p2hd_dev_enum_spd:2;
+		unsigned p2hd_prt_spd:2;
+		unsigned if_dev_mode:1;
+	} b;
+} pcgcctl_data_t;
+
+/**
+ * This union represents the bit fields in the Global Data FIFO Software
+ * Configuration Register. Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union gdfifocfg_data {
+	/* raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** OTG Data FIFO depth */
+		unsigned gdfifocfg:16;
+		/** Start address of EP info controller */
+		unsigned epinfobase:16;
+	} b;
+} gdfifocfg_data_t;
+
+/**
+ * This union represents the bit fields in the Global Power Down Register
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gpwrdn_data {
+	/* raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** PMU Interrupt Select */
+		unsigned pmuintsel:1;
+		/** PMU Active */
+		unsigned pmuactv:1;
+		/** Restore */
+		unsigned restore:1;
+		/** Power Down Clamp */
+		unsigned pwrdnclmp:1;
+		/** Power Down Reset */
+		unsigned pwrdnrstn:1;
+		/** Power Down Switch */
+		unsigned pwrdnswtch:1;
+		/** Disable VBUS */
+		unsigned dis_vbus:1;
+		/** Line State Change */
+		unsigned lnstschng:1;
+		/** Line state change mask */
+		unsigned lnstchng_msk:1;
+		/** Reset Detected */
+		unsigned rst_det:1;
+		/** Reset Detect mask */
+		unsigned rst_det_msk:1;
+		/** Disconnect Detected */
+		unsigned disconn_det:1;
+		/** Disconnect Detect mask */
+		unsigned disconn_det_msk:1;
+		/** Connect Detected*/
+		unsigned connect_det:1;
+		/** Connect Detected Mask*/
+		unsigned connect_det_msk:1;
+		/** SRP Detected */
+		unsigned srp_det:1;
+		/** SRP Detect mask */
+		unsigned srp_det_msk:1;
+		/** Status Change Interrupt */
+		unsigned sts_chngint:1;
+		/** Status Change Interrupt Mask */
+		unsigned sts_chngint_msk:1;
+		/** Line State */
+		unsigned linestate:2;
+		/** Indicates current mode(status of IDDIG signal) */
+		unsigned idsts:1;
+		/** B Session Valid signal status*/
+		unsigned bsessvld:1;
+		/** ADP Event Detected */
+		unsigned adp_int:1;
+		/** Multi Valued ID pin */
+		unsigned mult_val_id_bc:5;
+		/** Reserved 24_31 */
+		unsigned reserved29_31:3;
+	} b;
+} gpwrdn_data_t;
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/test/Makefile b/drivers/usb/host/dwc_otg/test/Makefile
new file mode 100644
index 0000000000000..fc453759dea3e
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/Makefile
@@ -0,0 +1,16 @@
+
+PERL=/usr/bin/perl
+PL_TESTS=test_sysfs.pl test_mod_param.pl
+
+.PHONY : test
+test : perl_tests
+
+perl_tests :
+	@echo
+	@echo Running perl tests
+	@for test in $(PL_TESTS); do \
+	  if $(PERL) ./$$test ; then \
+	    echo "=======> $$test, PASSED" ; \
+	  else echo "=======> $$test, FAILED" ; \
+	  fi \
+	done
diff --git a/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm b/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
new file mode 100644
index 0000000000000..85e55fd6ddbc7
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
@@ -0,0 +1,337 @@
+package dwc_otg_test;
+
+use strict;
+use Exporter ();
+
+use vars qw(@ISA @EXPORT
+$sysfsdir $paramdir $errors $params
+);
+
+@ISA = qw(Exporter);
+
+#
+# Globals
+#
+$sysfsdir = "/sys/devices/lm0";
+$paramdir = "/sys/module/dwc_otg";
+$errors = 0;
+
+$params = [
+	   {
+	    NAME => "otg_cap",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 2
+	   },
+	   {
+	    NAME => "dma_enable",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "dma_burst_size",
+	    DEFAULT => 32,
+	    ENUM => [1, 4, 8, 16, 32, 64, 128, 256],
+	    LOW => 1,
+	    HIGH => 256
+	   },
+	   {
+	    NAME => "host_speed",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "host_support_fs_ls_low_power",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "host_ls_low_power_phy_clk",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "dev_speed",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "enable_dynamic_fifo",
+	    DEFAULT => 1,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "data_fifo_size",
+	    DEFAULT => 8192,
+	    ENUM => [],
+	    LOW => 32,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "dev_rx_fifo_size",
+	    DEFAULT => 1064,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "dev_nperio_tx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_1",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_2",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_3",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_4",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_5",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_6",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_7",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_8",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_9",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_10",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_11",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_12",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_13",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_14",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_15",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "host_rx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "host_nperio_tx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "host_perio_tx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "max_transfer_size",
+	    DEFAULT => 65535,
+	    ENUM => [],
+	    LOW => 2047,
+	    HIGH => 65535
+	   },
+	   {
+	    NAME => "max_packet_count",
+	    DEFAULT => 511,
+	    ENUM => [],
+	    LOW => 15,
+	    HIGH => 511
+	   },
+	   {
+	    NAME => "host_channels",
+	    DEFAULT => 12,
+	    ENUM => [],
+	    LOW => 1,
+	    HIGH => 16
+	   },
+	   {
+	    NAME => "dev_endpoints",
+	    DEFAULT => 6,
+	    ENUM => [],
+	    LOW => 1,
+	    HIGH => 15
+	   },
+	   {
+	    NAME => "phy_type",
+	    DEFAULT => 1,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 2
+	   },
+	   {
+	    NAME => "phy_utmi_width",
+	    DEFAULT => 16,
+	    ENUM => [8, 16],
+	    LOW => 8,
+	    HIGH => 16
+	   },
+	   {
+	    NAME => "phy_ulpi_ddr",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	  ];
+
+
+#
+#
+sub check_arch {
+  $_ = `uname -m`;
+  chomp;
+  unless (m/armv4tl/) {
+    warn "# \n# Can't execute on $_.  Run on integrator platform.\n# \n";
+    return 0;
+  }
+  return 1;
+}
+
+#
+#
+sub load_module {
+  my $params = shift;
+  print "\nRemoving Module\n";
+  system "rmmod dwc_otg";
+  print "Loading Module\n";
+  if ($params ne "") {
+    print "Module Parameters: $params\n";
+  }
+  if (system("modprobe dwc_otg $params")) {
+    warn "Unable to load module\n";
+    return 0;
+  }
+  return 1;
+}
+
+#
+#
+sub test_status {
+  my $arg = shift;
+
+  print "\n";
+
+  if (defined $arg) {
+    warn "WARNING: $arg\n";
+  }
+
+  if ($errors > 0) {
+    warn "TEST FAILED with $errors errors\n";
+    return 0;
+  } else {
+    print "TEST PASSED\n";
+    return 0 if (defined $arg);
+  }
+  return 1;
+}
+
+#
+#
+@EXPORT = qw(
+$sysfsdir
+$paramdir
+$params
+$errors
+check_arch
+load_module
+test_status
+);
+
+1;
diff --git a/drivers/usb/host/dwc_otg/test/test_mod_param.pl b/drivers/usb/host/dwc_otg/test/test_mod_param.pl
new file mode 100644
index 0000000000000..dc3820df577ba
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/test_mod_param.pl
@@ -0,0 +1,133 @@
+#!/usr/bin/perl -w
+#
+# Run this program on the integrator.
+#
+# - Tests module parameter default values.
+# - Tests setting of valid module parameter values via modprobe.
+# - Tests invalid module parameter values.
+# -----------------------------------------------------------------------------
+use strict;
+use dwc_otg_test;
+
+check_arch() or die;
+
+#
+#
+sub test {
+  my ($param,$expected) = @_;
+  my $value = get($param);
+
+  if ($value == $expected) {
+    print "$param = $value, okay\n";
+  }
+
+  else {
+    warn "ERROR: value of $param != $expected, $value\n";
+    $errors ++;
+  }
+}
+
+#
+#
+sub get {
+  my $param = shift;
+  my $tmp = `cat $paramdir/$param`;
+  chomp $tmp;
+  return $tmp;
+}
+
+#
+#
+sub test_main {
+
+  print "\nTesting Module Parameters\n";
+
+  load_module("") or die;
+
+  # Test initial values
+  print "\nTesting Default Values\n";
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{DEFAULT});
+  }
+
+  # Test low value
+  print "\nTesting Low Value\n";
+  my $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . "$_->{NAME}=$_->{LOW} ";
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{LOW});
+  }
+
+  # Test high value
+  print "\nTesting High Value\n";
+  $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . "$_->{NAME}=$_->{HIGH} ";
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{HIGH});
+  }
+
+  # Test Enum
+  print "\nTesting Enumerated\n";
+  foreach (@{$params}) {
+    if (defined $_->{ENUM}) {
+      my $value;
+      foreach $value (@{$_->{ENUM}}) {
+	$cmd_params = "$_->{NAME}=$value";
+	load_module($cmd_params) or die;
+	test ($_->{NAME}, $value);
+      }
+    }
+  }
+
+  # Test Invalid Values
+  print "\nTesting Invalid Values\n";
+  $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{LOW}-1;
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{DEFAULT});
+  }
+
+  $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{HIGH}+1;
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{DEFAULT});
+  }
+
+  print "\nTesting Enumerated\n";
+  foreach (@{$params}) {
+    if (defined $_->{ENUM}) {
+      my $value;
+      foreach $value (@{$_->{ENUM}}) {
+	$value = $value + 1;
+	$cmd_params = "$_->{NAME}=$value";
+	load_module($cmd_params) or die;
+	test ($_->{NAME}, $_->{DEFAULT});
+	$value = $value - 2;
+	$cmd_params = "$_->{NAME}=$value";
+	load_module($cmd_params) or die;
+	test ($_->{NAME}, $_->{DEFAULT});
+      }
+    }
+  }
+
+  test_status() or die;
+}
+
+test_main();
+0;
diff --git a/drivers/usb/host/dwc_otg/test/test_sysfs.pl b/drivers/usb/host/dwc_otg/test/test_sysfs.pl
new file mode 100644
index 0000000000000..cdc9963176e5a
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/test_sysfs.pl
@@ -0,0 +1,193 @@
+#!/usr/bin/perl -w
+#
+# Run this program on the integrator
+# - Tests select sysfs attributes.
+# - Todo ... test more attributes, hnp/srp, buspower/bussuspend, etc.
+# -----------------------------------------------------------------------------
+use strict;
+use dwc_otg_test;
+
+check_arch() or die;
+
+#
+#
+sub test {
+  my ($attr,$expected) = @_;
+  my $string = get($attr);
+
+  if ($string eq $expected) {
+    printf("$attr = $string, okay\n");
+  }
+  else {
+    warn "ERROR: value of $attr != $expected, $string\n";
+    $errors ++;
+  }
+}
+
+#
+#
+sub set {
+  my ($reg, $value) = @_;
+  system "echo $value > $sysfsdir/$reg";
+}
+
+#
+#
+sub get {
+  my $attr = shift;
+  my $string = `cat $sysfsdir/$attr`;
+  chomp $string;
+  if ($string =~ m/\s\=\s/) {
+    my $tmp;
+    ($tmp, $string) = split /\s=\s/, $string;
+  }
+  return $string;
+}
+
+#
+#
+sub test_main {
+  print("\nTesting Sysfs Attributes\n");
+
+  load_module("") or die;
+
+  # Test initial values of regoffset/regvalue/guid/gsnpsid
+  print("\nTesting Default Values\n");
+
+  test("regoffset", "0xffffffff");
+  test("regvalue", "invalid offset");
+  test("guid", "0x12345678");	# this will fail if it has been changed
+  test("gsnpsid", "0x4f54200a");
+
+  # Test operation of regoffset/regvalue
+  print("\nTesting regoffset\n");
+  set('regoffset', '5a5a5a5a');
+  test("regoffset", "0xffffffff");
+
+  set('regoffset', '0');
+  test("regoffset", "0x00000000");
+
+  set('regoffset', '40000');
+  test("regoffset", "0x00000000");
+
+  set('regoffset', '3ffff');
+  test("regoffset", "0x0003ffff");
+
+  set('regoffset', '1');
+  test("regoffset", "0x00000001");
+
+  print("\nTesting regvalue\n");
+  set('regoffset', '3c');
+  test("regvalue", "0x12345678");
+  set('regvalue', '5a5a5a5a');
+  test("regvalue", "0x5a5a5a5a");
+  set('regvalue','a5a5a5a5');
+  test("regvalue", "0xa5a5a5a5");
+  set('guid','12345678');
+
+  # Test HNP Capable
+  print("\nTesting HNP Capable bit\n");
+  set('hnpcapable', '1');
+  test("hnpcapable", "0x1");
+  set('hnpcapable','0');
+  test("hnpcapable", "0x0");
+
+  set('regoffset','0c');
+
+  my $old = get('gusbcfg');
+  print("setting hnpcapable\n");
+  set('hnpcapable', '1');
+  test("hnpcapable", "0x1");
+  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<9)));
+  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<9)));
+
+  $old = get('gusbcfg');
+  print("clearing hnpcapable\n");
+  set('hnpcapable', '0');
+  test("hnpcapable", "0x0");
+  test ('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<9)));
+  test ('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<9)));
+
+  # Test SRP Capable
+  print("\nTesting SRP Capable bit\n");
+  set('srpcapable', '1');
+  test("srpcapable", "0x1");
+  set('srpcapable','0');
+  test("srpcapable", "0x0");
+
+  set('regoffset','0c');
+
+  $old = get('gusbcfg');
+  print("setting srpcapable\n");
+  set('srpcapable', '1');
+  test("srpcapable", "0x1");
+  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<8)));
+  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<8)));
+
+  $old = get('gusbcfg');
+  print("clearing srpcapable\n");
+  set('srpcapable', '0');
+  test("srpcapable", "0x0");
+  test('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<8)));
+  test('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<8)));
+
+  # Test GGPIO
+  print("\nTesting GGPIO\n");
+  set('ggpio','5a5a5a5a');
+  test('ggpio','0x5a5a0000');
+  set('ggpio','a5a5a5a5');
+  test('ggpio','0xa5a50000');
+  set('ggpio','11110000');
+  test('ggpio','0x11110000');
+  set('ggpio','00001111');
+  test('ggpio','0x00000000');
+
+  # Test DEVSPEED
+  print("\nTesting DEVSPEED\n");
+  set('regoffset','800');
+  $old = get('regvalue');
+  set('devspeed','0');
+  test('devspeed','0x0');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
+  set('devspeed','1');
+  test('devspeed','0x1');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
+  set('devspeed','2');
+  test('devspeed','0x2');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 2));
+  set('devspeed','3');
+  test('devspeed','0x3');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 3));
+  set('devspeed','4');
+  test('devspeed','0x0');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
+  set('devspeed','5');
+  test('devspeed','0x1');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
+
+
+  #  mode	Returns the current mode:0 for device mode1 for host mode	Read
+  #  hnp	Initiate the Host Negotiation Protocol.  Read returns the status.	Read/Write
+  #  srp	Initiate the Session Request Protocol.  Read returns the status.	Read/Write
+  #  buspower	Get or Set the Power State of the bus (0 - Off or 1 - On) 	Read/Write
+  #  bussuspend	Suspend the USB bus.	Read/Write
+  #  busconnected	Get the connection status of the bus 	Read
+
+  #  gotgctl	Get or set the Core Control Status Register.	Read/Write
+  ##  gusbcfg	Get or set the Core USB Configuration Register	Read/Write
+  #  grxfsiz	Get or set the Receive FIFO Size Register	Read/Write
+  #  gnptxfsiz	Get or set the non-periodic Transmit Size Register	Read/Write
+  #  gpvndctl	Get or set the PHY Vendor Control Register	Read/Write
+  ##  ggpio	Get the value in the lower 16-bits of the General Purpose IO Register or Set the upper 16 bits.	Read/Write
+  ##  guid	Get or set the value of the User ID Register	Read/Write
+  ##  gsnpsid	Get the value of the Synopsys ID Regester	Read
+  ##  devspeed	Get or set the device speed setting in the DCFG register	Read/Write
+  #  enumspeed	Gets the device enumeration Speed.	Read
+  #  hptxfsiz	Get the value of the Host Periodic Transmit FIFO	Read
+  #  hprt0	Get or Set the value in the Host Port Control and Status Register	Read/Write
+
+  test_status("TEST NYI") or die;
+}
+
+test_main();
+0;
-- 
GitLab


From 6228f30645c84bfbd9ab4a0d4f5e6155769d2c59 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 17 Jun 2015 17:06:34 +0100
Subject: [PATCH 0041/1835] bcm2708 framebuffer driver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: popcornmix <popcornmix@gmail.com>

bcm2708_fb : Implement blanking support using the mailbox property interface

bcm2708_fb: Add pan and vsync controls

bcm2708_fb: DMA acceleration for fb_copyarea

Based on http://www.raspberrypi.org/phpBB3/viewtopic.php?p=62425#p62425
Also used Simon's dmaer_master module as a reference for tweaking DMA
settings for better performance.

For now busylooping only. IRQ support might be added later.
With non-overclocked Raspberry Pi, the performance is ~360 MB/s
for simple copy or ~260 MB/s for two-pass copy (used when dragging
windows to the right).

In the case of using DMA channel 0, the performance improves
to ~440 MB/s.

For comparison, VFP optimized CPU copy can only do ~114 MB/s in
the same conditions (hindered by reading uncached source buffer).

Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>

bcm2708_fb: report number of dma copies

Add a counter (exported via debugfs) reporting the
number of dma copies that the framebuffer driver
has done, in order to help evaluate different
optimization strategies.

Signed-off-by: Luke Diamand <luked@broadcom.com>

bcm2708_fb: use IRQ for DMA copies

The copyarea ioctl() uses DMA to speed things along. This
was busy-waiting for completion. This change supports using
an interrupt instead for larger transfers. For small
transfers, busy-waiting is still likely to be faster.

Signed-off-by: Luke Diamand <luke@diamand.org>

bcm2708: Make ioctl logging quieter

video: fbdev: bcm2708_fb: Don't panic on error

No need to panic the kernel if the video driver fails.
Just print a message and return an error.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

fbdev: bcm2708_fb: Add ARCH_BCM2835 support

Add Device Tree support.
Pass the device to dma_alloc_coherent() in order to get the
correct bus address on ARCH_BCM2835.
Use the new DMA legacy API header file.
Including <mach/platform.h> is not necessary.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270x_DT: Add bcm2708-fb device

Add bcm2708-fb to Device Tree and don't add the
platform device when booting in DT mode.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

Cleanup of bcm2708_fb file to kernel coding standards

Some minor change to function - remove a use of
in_atomic, plus replacing various debug messages
that manually specify the function name with
("%s",.__func__)

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 drivers/video/fbdev/Kconfig               |   14 +
 drivers/video/fbdev/Makefile              |    1 +
 drivers/video/fbdev/bcm2708_fb.c          |  864 +++++++
 drivers/video/logo/logo_linux_clut224.ppm | 2483 ++++++++-------------
 4 files changed, 1760 insertions(+), 1602 deletions(-)
 create mode 100644 drivers/video/fbdev/bcm2708_fb.c

diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 591a13a597874..dc7d04b1d5542 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -236,6 +236,20 @@ config FB_TILEBLITTING
 comment "Frame buffer hardware drivers"
 	depends on FB
 
+config FB_BCM2708
+	tristate "BCM2708 framebuffer support"
+	depends on FB && RASPBERRYPI_FIRMWARE
+	select FB_CFB_FILLRECT
+	select FB_CFB_COPYAREA
+	select FB_CFB_IMAGEBLIT
+	help
+	  This framebuffer device driver is for the BCM2708 framebuffer.
+
+	  If you want to compile this as a module (=code which can be
+	  inserted into and removed from the running kernel), say M
+	  here and read <file:Documentation/kbuild/modules.txt>.  The module
+	  will be called bcm2708_fb.
+
 config FB_GRVGA
 	tristate "Aeroflex Gaisler framebuffer support"
 	depends on FB && SPARC
diff --git a/drivers/video/fbdev/Makefile b/drivers/video/fbdev/Makefile
index 13c900320c2cc..784c57ffd660c 100644
--- a/drivers/video/fbdev/Makefile
+++ b/drivers/video/fbdev/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_FB_MACMODES)      += macmodes.o
 obj-$(CONFIG_FB_WMT_GE_ROPS)   += wmt_ge_rops.o
 
 # Hardware specific drivers go first
+obj-$(CONFIG_FB_BCM2708)	  += bcm2708_fb.o
 obj-$(CONFIG_FB_AMIGA)            += amifb.o c2p_planar.o
 obj-$(CONFIG_FB_ARC)              += arcfb.o
 obj-$(CONFIG_FB_CLPS711X)	  += clps711x-fb.o
diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
new file mode 100644
index 0000000000000..205cb26cac0ee
--- /dev/null
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -0,0 +1,864 @@
+/*
+ *  linux/drivers/video/bcm2708_fb.c
+ *
+ * Copyright (C) 2010 Broadcom
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ *
+ * Broadcom simple framebuffer driver
+ *
+ * This file is derived from cirrusfb.c
+ * Copyright 1999-2001 Jeff Garzik <jgarzik@pobox.com>
+ *
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/list.h>
+#include <linux/platform_data/dma-bcm2708.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/printk.h>
+#include <linux/console.h>
+#include <linux/debugfs.h>
+#include <asm/sizes.h>
+#include <linux/io.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+//#define BCM2708_FB_DEBUG
+#define MODULE_NAME "bcm2708_fb"
+
+#ifdef BCM2708_FB_DEBUG
+#define print_debug(fmt, ...) pr_debug("%s:%s:%d: "fmt, \
+			MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
+#else
+#define print_debug(fmt, ...)
+#endif
+
+/* This is limited to 16 characters when displayed by X startup */
+static const char *bcm2708_name = "BCM2708 FB";
+
+#define DRIVER_NAME "bcm2708_fb"
+
+static int fbwidth = 800;	/* module parameter */
+static int fbheight = 480;	/* module parameter */
+static int fbdepth = 32;	/* module parameter */
+static int fbswap;		/* module parameter */
+
+static u32 dma_busy_wait_threshold = 1<<15;
+module_param(dma_busy_wait_threshold, int, 0644);
+MODULE_PARM_DESC(dma_busy_wait_threshold, "Busy-wait for DMA completion below this area");
+
+struct fb_alloc_tags {
+	struct rpi_firmware_property_tag_header tag1;
+	u32 xres, yres;
+	struct rpi_firmware_property_tag_header tag2;
+	u32 xres_virtual, yres_virtual;
+	struct rpi_firmware_property_tag_header tag3;
+	u32 bpp;
+	struct rpi_firmware_property_tag_header tag4;
+	u32 xoffset, yoffset;
+	struct rpi_firmware_property_tag_header tag5;
+	u32 base, screen_size;
+	struct rpi_firmware_property_tag_header tag6;
+	u32 pitch;
+};
+
+struct bcm2708_fb_stats {
+	struct debugfs_regset32 regset;
+	u32 dma_copies;
+	u32 dma_irqs;
+};
+
+struct bcm2708_fb {
+	struct fb_info fb;
+	struct platform_device *dev;
+	struct rpi_firmware *fw;
+	u32 cmap[16];
+	u32 gpu_cmap[256];
+	int dma_chan;
+	int dma_irq;
+	void __iomem *dma_chan_base;
+	void *cb_base;		/* DMA control blocks */
+	dma_addr_t cb_handle;
+	struct dentry *debugfs_dir;
+	wait_queue_head_t dma_waitq;
+	struct bcm2708_fb_stats stats;
+	unsigned long fb_bus_address;
+};
+
+#define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
+
+static void bcm2708_fb_debugfs_deinit(struct bcm2708_fb *fb)
+{
+	debugfs_remove_recursive(fb->debugfs_dir);
+	fb->debugfs_dir = NULL;
+}
+
+static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
+{
+	static struct debugfs_reg32 stats_registers[] = {
+		{
+			"dma_copies",
+			offsetof(struct bcm2708_fb_stats, dma_copies)
+		},
+		{
+			"dma_irqs",
+			offsetof(struct bcm2708_fb_stats, dma_irqs)
+		},
+	};
+
+	fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
+	if (!fb->debugfs_dir) {
+		pr_warn("%s: could not create debugfs entry\n",
+			__func__);
+		return -EFAULT;
+	}
+
+	fb->stats.regset.regs = stats_registers;
+	fb->stats.regset.nregs = ARRAY_SIZE(stats_registers);
+	fb->stats.regset.base = &fb->stats;
+
+	if (!debugfs_create_regset32(
+		"stats", 0444, fb->debugfs_dir, &fb->stats.regset)) {
+		pr_warn("%s: could not create statistics registers\n",
+			__func__);
+		goto fail;
+	}
+	return 0;
+
+fail:
+	bcm2708_fb_debugfs_deinit(fb);
+	return -EFAULT;
+}
+
+static int bcm2708_fb_set_bitfields(struct fb_var_screeninfo *var)
+{
+	int ret = 0;
+
+	memset(&var->transp, 0, sizeof(var->transp));
+
+	var->red.msb_right = 0;
+	var->green.msb_right = 0;
+	var->blue.msb_right = 0;
+
+	switch (var->bits_per_pixel) {
+	case 1:
+	case 2:
+	case 4:
+	case 8:
+		var->red.length = var->bits_per_pixel;
+		var->red.offset = 0;
+		var->green.length = var->bits_per_pixel;
+		var->green.offset = 0;
+		var->blue.length = var->bits_per_pixel;
+		var->blue.offset = 0;
+		break;
+	case 16:
+		var->red.length = 5;
+		var->blue.length = 5;
+		/*
+		 * Green length can be 5 or 6 depending whether
+		 * we're operating in RGB555 or RGB565 mode.
+		 */
+		if (var->green.length != 5 && var->green.length != 6)
+			var->green.length = 6;
+		break;
+	case 24:
+		var->red.length = 8;
+		var->blue.length = 8;
+		var->green.length = 8;
+		break;
+	case 32:
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 8;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	/*
+	 * >= 16bpp displays have separate colour component bitfields
+	 * encoded in the pixel data.  Calculate their position from
+	 * the bitfield length defined above.
+	 */
+	if (ret == 0 && var->bits_per_pixel >= 24 && fbswap) {
+		var->blue.offset = 0;
+		var->green.offset = var->blue.offset + var->blue.length;
+		var->red.offset = var->green.offset + var->green.length;
+		var->transp.offset = var->red.offset + var->red.length;
+	} else if (ret == 0 && var->bits_per_pixel >= 24) {
+		var->red.offset = 0;
+		var->green.offset = var->red.offset + var->red.length;
+		var->blue.offset = var->green.offset + var->green.length;
+		var->transp.offset = var->blue.offset + var->blue.length;
+	} else if (ret == 0 && var->bits_per_pixel >= 16) {
+		var->blue.offset = 0;
+		var->green.offset = var->blue.offset + var->blue.length;
+		var->red.offset = var->green.offset + var->green.length;
+		var->transp.offset = var->red.offset + var->red.length;
+	}
+
+	return ret;
+}
+
+static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
+				struct fb_info *info)
+{
+	/* info input, var output */
+	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n",
+		__func__,
+		info,
+		info->var.xres, info->var.yres, info->var.xres_virtual,
+		info->var.yres_virtual, (int)info->screen_size,
+		info->var.bits_per_pixel);
+	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var,
+		var->xres, var->yres, var->xres_virtual, var->yres_virtual,
+		var->bits_per_pixel);
+
+	if (!var->bits_per_pixel)
+		var->bits_per_pixel = 16;
+
+	if (bcm2708_fb_set_bitfields(var) != 0) {
+		pr_err("%s: invalid bits_per_pixel %d\n", __func__,
+		     var->bits_per_pixel);
+		return -EINVAL;
+	}
+
+
+	if (var->xres_virtual < var->xres)
+		var->xres_virtual = var->xres;
+	/* use highest possible virtual resolution */
+	if (var->yres_virtual == -1) {
+		var->yres_virtual = 480;
+
+		pr_err("%s: virtual resolution set to maximum of %dx%d\n",
+		     __func__, var->xres_virtual, var->yres_virtual);
+	}
+	if (var->yres_virtual < var->yres)
+		var->yres_virtual = var->yres;
+
+	if (var->xoffset < 0)
+		var->xoffset = 0;
+	if (var->yoffset < 0)
+		var->yoffset = 0;
+
+	/* truncate xoffset and yoffset to maximum if too high */
+	if (var->xoffset > var->xres_virtual - var->xres)
+		var->xoffset = var->xres_virtual - var->xres - 1;
+	if (var->yoffset > var->yres_virtual - var->yres)
+		var->yoffset = var->yres_virtual - var->yres - 1;
+
+	return 0;
+}
+
+static int bcm2708_fb_set_par(struct fb_info *info)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	struct fb_alloc_tags fbinfo = {
+		.tag1 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT,
+			  8, 0, },
+			.xres = info->var.xres,
+			.yres = info->var.yres,
+		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT,
+			  8, 0, },
+			.xres_virtual = info->var.xres_virtual,
+			.yres_virtual = info->var.yres_virtual,
+		.tag3 = { RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH, 4, 0 },
+			.bpp = info->var.bits_per_pixel,
+		.tag4 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET, 8, 0 },
+			.xoffset = info->var.xoffset,
+			.yoffset = info->var.yoffset,
+		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
+			.base = 0,
+			.screen_size = 0,
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH, 4, 0 },
+			.pitch = 0,
+	};
+	int ret;
+
+	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
+		info->var.xres, info->var.yres, info->var.xres_virtual,
+		info->var.yres_virtual, (int)info->screen_size,
+		info->var.bits_per_pixel);
+
+	ret = rpi_firmware_property_list(fb->fw, &fbinfo, sizeof(fbinfo));
+	if (ret) {
+		dev_err(info->device,
+			"Failed to allocate GPU framebuffer (%d)\n", ret);
+		return ret;
+	}
+
+	if (info->var.bits_per_pixel <= 8)
+		fb->fb.fix.visual = FB_VISUAL_PSEUDOCOLOR;
+	else
+		fb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
+
+	fb->fb.fix.line_length = fbinfo.pitch;
+	fbinfo.base |= 0x40000000;
+	fb->fb_bus_address = fbinfo.base;
+	fbinfo.base &= ~0xc0000000;
+	fb->fb.fix.smem_start = fbinfo.base;
+	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
+	fb->fb.screen_size = fbinfo.screen_size;
+	if (fb->fb.screen_base)
+		iounmap(fb->fb.screen_base);
+	fb->fb.screen_base = ioremap_wc(fbinfo.base, fb->fb.screen_size);
+	if (!fb->fb.screen_base) {
+		/* the console may currently be locked */
+		console_trylock();
+		console_unlock();
+		dev_err(info->device, "Failed to set screen_base\n");
+		return -ENOMEM;
+	}
+
+	print_debug(
+	  "%s: start = %p,%p width=%d, height=%d, bpp=%d, pitch=%d size=%d\n",
+	  __func__,
+	  (void *)fb->fb.screen_base, (void *)fb->fb_bus_address,
+	  fbinfo.xres, fbinfo.yres, fbinfo.bpp,
+	  fbinfo.pitch, (int)fb->fb.screen_size);
+
+	return 0;
+}
+
+static inline u32 convert_bitfield(int val, struct fb_bitfield *bf)
+{
+	unsigned int mask = (1 << bf->length) - 1;
+
+	return (val >> (16 - bf->length) & mask) << bf->offset;
+}
+
+
+static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
+				unsigned int green, unsigned int blue,
+				unsigned int transp, struct fb_info *info)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+
+	if (fb->fb.var.bits_per_pixel <= 8) {
+		if (regno < 256) {
+			/* blue [23:16], green [15:8], red [7:0] */
+			fb->gpu_cmap[regno] = ((red   >> 8) & 0xff) << 0 |
+					      ((green >> 8) & 0xff) << 8 |
+					      ((blue  >> 8) & 0xff) << 16;
+		}
+		/* Hack: we need to tell GPU the palette has changed, but
+		 * currently bcm2708_fb_set_par takes noticeable time when
+		 * called for every (256) colour
+		 * So just call it for what looks like the last colour in a
+		 * list for now.
+		 */
+		if (regno == 15 || regno == 255) {
+			struct packet {
+				u32 offset;
+				u32 length;
+				u32 cmap[256];
+			} *packet;
+			int ret;
+
+			packet = kmalloc(sizeof(*packet), GFP_KERNEL);
+			if (!packet)
+				return -ENOMEM;
+			packet->offset = 0;
+			packet->length = regno + 1;
+			memcpy(packet->cmap, fb->gpu_cmap,
+				sizeof(packet->cmap));
+			ret = rpi_firmware_property(fb->fw,
+					RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
+					packet,
+					(2 + packet->length) * sizeof(u32));
+			if (ret || packet->offset)
+				dev_err(info->device,
+					"Failed to set palette (%d,%u)\n",
+					ret, packet->offset);
+			kfree(packet);
+		}
+	} else if (regno < 16) {
+		fb->cmap[regno] = convert_bitfield(transp, &fb->fb.var.transp) |
+		convert_bitfield(blue, &fb->fb.var.blue) |
+		convert_bitfield(green, &fb->fb.var.green) |
+		convert_bitfield(red, &fb->fb.var.red);
+	}
+	return regno > 255;
+}
+
+static int bcm2708_fb_blank(int blank_mode, struct fb_info *info)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	u32 value;
+	int ret;
+
+	switch (blank_mode) {
+	case FB_BLANK_UNBLANK:
+		value = 0;
+		break;
+	case FB_BLANK_NORMAL:
+	case FB_BLANK_VSYNC_SUSPEND:
+	case FB_BLANK_HSYNC_SUSPEND:
+	case FB_BLANK_POWERDOWN:
+		value = 1;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	ret = rpi_firmware_property(fb->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+				    &value, sizeof(value));
+	if (ret)
+		dev_err(info->device, "%s(%d) failed: %d\n", __func__,
+			blank_mode, ret);
+
+	return ret;
+}
+
+static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
+				  struct fb_info *info)
+{
+	s32 result;
+
+	info->var.xoffset = var->xoffset;
+	info->var.yoffset = var->yoffset;
+	result = bcm2708_fb_set_par(info);
+	if (result != 0)
+		pr_err("%s(%d,%d) returns=%d\n", __func__,
+			var->xoffset, var->yoffset, result);
+	return result;
+}
+
+static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	u32 dummy = 0;
+	int ret;
+
+	switch (cmd) {
+	case FBIO_WAITFORVSYNC:
+		ret = rpi_firmware_property(fb->fw,
+					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
+					    &dummy, sizeof(dummy));
+		break;
+	default:
+		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
+		return -ENOTTY;
+	}
+
+	if (ret)
+		dev_err(info->device, "ioctl 0x%x failed (%d)\n", cmd, ret);
+
+	return ret;
+}
+static void bcm2708_fb_fillrect(struct fb_info *info,
+				const struct fb_fillrect *rect)
+{
+	/* (is called) print_debug("bcm2708_fb_fillrect\n"); */
+	cfb_fillrect(info, rect);
+}
+
+/* A helper function for configuring dma control block */
+static void set_dma_cb(struct bcm2708_dma_cb *cb,
+		       int        burst_size,
+		       dma_addr_t dst,
+		       int        dst_stride,
+		       dma_addr_t src,
+		       int        src_stride,
+		       int        w,
+		       int        h)
+{
+	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
+		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
+		   BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
+	cb->dst = dst;
+	cb->src = src;
+	/*
+	 * This is not really obvious from the DMA documentation,
+	 * but the top 16 bits must be programmmed to "height -1"
+	 * and not "height" in 2D mode.
+	 */
+	cb->length = ((h - 1) << 16) | w;
+	cb->stride = ((dst_stride - w) << 16) | (u16)(src_stride - w);
+	cb->pad[0] = 0;
+	cb->pad[1] = 0;
+}
+
+static void bcm2708_fb_copyarea(struct fb_info *info,
+				const struct fb_copyarea *region)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	struct bcm2708_dma_cb *cb = fb->cb_base;
+	int bytes_per_pixel = (info->var.bits_per_pixel + 7) >> 3;
+
+	/* Channel 0 supports larger bursts and is a bit faster */
+	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
+	int pixels = region->width * region->height;
+
+	/* Fallback to cfb_copyarea() if we don't like something */
+	if (bytes_per_pixel > 4 ||
+	    info->var.xres * info->var.yres > 1920 * 1200 ||
+	    region->width <= 0 || region->width > info->var.xres ||
+	    region->height <= 0 || region->height > info->var.yres ||
+	    region->sx < 0 || region->sx >= info->var.xres ||
+	    region->sy < 0 || region->sy >= info->var.yres ||
+	    region->dx < 0 || region->dx >= info->var.xres ||
+	    region->dy < 0 || region->dy >= info->var.yres ||
+	    region->sx + region->width > info->var.xres ||
+	    region->dx + region->width > info->var.xres ||
+	    region->sy + region->height > info->var.yres ||
+	    region->dy + region->height > info->var.yres) {
+		cfb_copyarea(info, region);
+		return;
+	}
+
+	if (region->dy == region->sy && region->dx > region->sx) {
+		/*
+		 * A difficult case of overlapped copy. Because DMA can't
+		 * copy individual scanlines in backwards direction, we need
+		 * two-pass processing. We do it by programming a chain of dma
+		 * control blocks in the first 16K part of the buffer and use
+		 * the remaining 48K as the intermediate temporary scratch
+		 * buffer. The buffer size is sufficient to handle up to
+		 * 1920x1200 resolution at 32bpp pixel depth.
+		 */
+		int y;
+		dma_addr_t control_block_pa = fb->cb_handle;
+		dma_addr_t scratchbuf = fb->cb_handle + 16 * 1024;
+		int scanline_size = bytes_per_pixel * region->width;
+		int scanlines_per_cb = (64 * 1024 - 16 * 1024) / scanline_size;
+
+		for (y = 0; y < region->height; y += scanlines_per_cb) {
+			dma_addr_t src =
+				fb->fb_bus_address +
+				bytes_per_pixel * region->sx +
+				(region->sy + y) * fb->fb.fix.line_length;
+			dma_addr_t dst =
+				fb->fb_bus_address +
+				bytes_per_pixel * region->dx +
+				(region->dy + y) * fb->fb.fix.line_length;
+
+			if (region->height - y < scanlines_per_cb)
+				scanlines_per_cb = region->height - y;
+
+			set_dma_cb(cb, burst_size, scratchbuf, scanline_size,
+				   src, fb->fb.fix.line_length,
+				   scanline_size, scanlines_per_cb);
+			control_block_pa += sizeof(struct bcm2708_dma_cb);
+			cb->next = control_block_pa;
+			cb++;
+
+			set_dma_cb(cb, burst_size, dst, fb->fb.fix.line_length,
+				   scratchbuf, scanline_size,
+				   scanline_size, scanlines_per_cb);
+			control_block_pa += sizeof(struct bcm2708_dma_cb);
+			cb->next = control_block_pa;
+			cb++;
+		}
+		/* move the pointer back to the last dma control block */
+		cb--;
+	} else {
+		/* A single dma control block is enough. */
+		int sy, dy, stride;
+
+		if (region->dy <= region->sy) {
+			/* processing from top to bottom */
+			dy = region->dy;
+			sy = region->sy;
+			stride = fb->fb.fix.line_length;
+		} else {
+			/* processing from bottom to top */
+			dy = region->dy + region->height - 1;
+			sy = region->sy + region->height - 1;
+			stride = -fb->fb.fix.line_length;
+		}
+		set_dma_cb(cb, burst_size,
+			   fb->fb_bus_address + dy * fb->fb.fix.line_length +
+						   bytes_per_pixel * region->dx,
+			   stride,
+			   fb->fb_bus_address + sy * fb->fb.fix.line_length +
+						   bytes_per_pixel * region->sx,
+			   stride,
+			   region->width * bytes_per_pixel,
+			   region->height);
+	}
+
+	/* end of dma control blocks chain */
+	cb->next = 0;
+
+
+	if (pixels < dma_busy_wait_threshold) {
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		bcm_dma_wait_idle(fb->dma_chan_base);
+	} else {
+		void __iomem *dma_chan = fb->dma_chan_base;
+
+		cb->info |= BCM2708_DMA_INT_EN;
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		while (bcm_dma_is_busy(dma_chan)) {
+			wait_event_interruptible(
+				fb->dma_waitq,
+				!bcm_dma_is_busy(dma_chan));
+		}
+		fb->stats.dma_irqs++;
+	}
+	fb->stats.dma_copies++;
+}
+
+static void bcm2708_fb_imageblit(struct fb_info *info,
+				 const struct fb_image *image)
+{
+	/* (is called) print_debug("bcm2708_fb_imageblit\n"); */
+	cfb_imageblit(info, image);
+}
+
+static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
+{
+	struct bcm2708_fb *fb = cxt;
+
+	/* FIXME: should read status register to check if this is
+	 * actually interrupting us or not, in case this interrupt
+	 * ever becomes shared amongst several DMA channels
+	 *
+	 * readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_IRQ;
+	 */
+
+	/* acknowledge the interrupt */
+	writel(BCM2708_DMA_INT, fb->dma_chan_base + BCM2708_DMA_CS);
+
+	wake_up(&fb->dma_waitq);
+	return IRQ_HANDLED;
+}
+
+static struct fb_ops bcm2708_fb_ops = {
+	.owner = THIS_MODULE,
+	.fb_check_var = bcm2708_fb_check_var,
+	.fb_set_par = bcm2708_fb_set_par,
+	.fb_setcolreg = bcm2708_fb_setcolreg,
+	.fb_blank = bcm2708_fb_blank,
+	.fb_fillrect = bcm2708_fb_fillrect,
+	.fb_copyarea = bcm2708_fb_copyarea,
+	.fb_imageblit = bcm2708_fb_imageblit,
+	.fb_pan_display = bcm2708_fb_pan_display,
+	.fb_ioctl = bcm2708_ioctl,
+};
+
+static int bcm2708_fb_register(struct bcm2708_fb *fb)
+{
+	int ret;
+
+	fb->fb.fbops = &bcm2708_fb_ops;
+	fb->fb.flags = FBINFO_FLAG_DEFAULT | FBINFO_HWACCEL_COPYAREA;
+	fb->fb.pseudo_palette = fb->cmap;
+
+	strncpy(fb->fb.fix.id, bcm2708_name, sizeof(fb->fb.fix.id));
+	fb->fb.fix.type = FB_TYPE_PACKED_PIXELS;
+	fb->fb.fix.type_aux = 0;
+	fb->fb.fix.xpanstep = 1;
+	fb->fb.fix.ypanstep = 1;
+	fb->fb.fix.ywrapstep = 0;
+	fb->fb.fix.accel = FB_ACCEL_NONE;
+
+	fb->fb.var.xres = fbwidth;
+	fb->fb.var.yres = fbheight;
+	fb->fb.var.xres_virtual = fbwidth;
+	fb->fb.var.yres_virtual = fbheight;
+	fb->fb.var.bits_per_pixel = fbdepth;
+	fb->fb.var.vmode = FB_VMODE_NONINTERLACED;
+	fb->fb.var.activate = FB_ACTIVATE_NOW;
+	fb->fb.var.nonstd = 0;
+	fb->fb.var.height = -1;		/* height of picture in mm    */
+	fb->fb.var.width = -1;		/* width of picture in mm    */
+	fb->fb.var.accel_flags = 0;
+
+	fb->fb.monspecs.hfmin = 0;
+	fb->fb.monspecs.hfmax = 100000;
+	fb->fb.monspecs.vfmin = 0;
+	fb->fb.monspecs.vfmax = 400;
+	fb->fb.monspecs.dclkmin = 1000000;
+	fb->fb.monspecs.dclkmax = 100000000;
+
+	bcm2708_fb_set_bitfields(&fb->fb.var);
+	init_waitqueue_head(&fb->dma_waitq);
+
+	/*
+	 * Allocate colourmap.
+	 */
+
+	fb_set_var(&fb->fb, &fb->fb.var);
+	ret = bcm2708_fb_set_par(&fb->fb);
+	if (ret)
+		return ret;
+
+	print_debug("BCM2708FB: registering framebuffer (%dx%d@%d) (%d)\n",
+		fbwidth, fbheight, fbdepth, fbswap);
+
+	ret = register_framebuffer(&fb->fb);
+	print_debug("BCM2708FB: register framebuffer (%d)\n", ret);
+	if (ret == 0)
+		goto out;
+
+	print_debug("BCM2708FB: cannot register framebuffer (%d)\n", ret);
+out:
+	return ret;
+}
+
+static int bcm2708_fb_probe(struct platform_device *dev)
+{
+	struct device_node *fw_np;
+	struct rpi_firmware *fw;
+	struct bcm2708_fb *fb;
+	int ret;
+
+	fw_np = of_parse_phandle(dev->dev.of_node, "firmware", 0);
+/* Remove comment when booting without Device Tree is no longer supported
+ *	if (!fw_np) {
+ *		dev_err(&dev->dev, "Missing firmware node\n");
+ *		return -ENOENT;
+ *	}
+ */
+	fw = rpi_firmware_get(fw_np);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	fb = kzalloc(sizeof(struct bcm2708_fb), GFP_KERNEL);
+	if (!fb) {
+		ret = -ENOMEM;
+		goto free_region;
+	}
+
+	fb->fw = fw;
+	bcm2708_fb_debugfs_init(fb);
+
+	fb->cb_base = dma_alloc_writecombine(&dev->dev, SZ_64K,
+					     &fb->cb_handle, GFP_KERNEL);
+	if (!fb->cb_base) {
+		dev_err(&dev->dev, "cannot allocate DMA CBs\n");
+		ret = -ENOMEM;
+		goto free_fb;
+	}
+
+	pr_info("BCM2708FB: allocated DMA memory %08x\n",
+	       fb->cb_handle);
+
+	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
+				 &fb->dma_chan_base, &fb->dma_irq);
+	if (ret < 0) {
+		dev_err(&dev->dev, "couldn't allocate a DMA channel\n");
+		goto free_cb;
+	}
+	fb->dma_chan = ret;
+
+	ret = request_irq(fb->dma_irq, bcm2708_fb_dma_irq,
+			  0, "bcm2708_fb dma", fb);
+	if (ret) {
+		pr_err("%s: failed to request DMA irq\n", __func__);
+		goto free_dma_chan;
+	}
+
+
+	pr_info("BCM2708FB: allocated DMA channel %d @ %p\n",
+	       fb->dma_chan, fb->dma_chan_base);
+
+	fb->dev = dev;
+	fb->fb.device = &dev->dev;
+
+	/* failure here isn't fatal, but we'll fail in vc_mem_copy if
+	 * fb->gpu is not valid
+	 */
+	rpi_firmware_property(fb->fw,
+				    RPI_FIRMWARE_GET_VC_MEMORY,
+				    &fb->gpu, sizeof(fb->gpu));
+
+	ret = bcm2708_fb_register(fb);
+	if (ret == 0) {
+		platform_set_drvdata(dev, fb);
+		goto out;
+	}
+
+free_dma_chan:
+	bcm_dma_chan_free(fb->dma_chan);
+free_cb:
+	dma_free_writecombine(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
+free_fb:
+	kfree(fb);
+free_region:
+	dev_err(&dev->dev, "probe failed, err %d\n", ret);
+out:
+	return ret;
+}
+
+static int bcm2708_fb_remove(struct platform_device *dev)
+{
+	struct bcm2708_fb *fb = platform_get_drvdata(dev);
+
+	platform_set_drvdata(dev, NULL);
+
+	if (fb->fb.screen_base)
+		iounmap(fb->fb.screen_base);
+	unregister_framebuffer(&fb->fb);
+
+	dma_free_writecombine(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
+	bcm_dma_chan_free(fb->dma_chan);
+
+	bcm2708_fb_debugfs_deinit(fb);
+
+	free_irq(fb->dma_irq, fb);
+
+	kfree(fb);
+
+	return 0;
+}
+
+static const struct of_device_id bcm2708_fb_of_match_table[] = {
+	{ .compatible = "brcm,bcm2708-fb", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, bcm2708_fb_of_match_table);
+
+static struct platform_driver bcm2708_fb_driver = {
+	.probe = bcm2708_fb_probe,
+	.remove = bcm2708_fb_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2708_fb_of_match_table,
+		   },
+};
+
+static int __init bcm2708_fb_init(void)
+{
+	return platform_driver_register(&bcm2708_fb_driver);
+}
+
+module_init(bcm2708_fb_init);
+
+static void __exit bcm2708_fb_exit(void)
+{
+	platform_driver_unregister(&bcm2708_fb_driver);
+}
+
+module_exit(bcm2708_fb_exit);
+
+module_param(fbwidth, int, 0644);
+module_param(fbheight, int, 0644);
+module_param(fbdepth, int, 0644);
+module_param(fbswap, int, 0644);
+
+MODULE_DESCRIPTION("BCM2708 framebuffer driver");
+MODULE_LICENSE("GPL");
+
+MODULE_PARM_DESC(fbwidth, "Width of ARM Framebuffer");
+MODULE_PARM_DESC(fbheight, "Height of ARM Framebuffer");
+MODULE_PARM_DESC(fbdepth, "Bit depth of ARM Framebuffer");
+MODULE_PARM_DESC(fbswap, "Swap order of red and blue in 24 and 32 bit modes");
diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
index 3c14e43b82fef..7626beb6a5bb8 100644
--- a/drivers/video/logo/logo_linux_clut224.ppm
+++ b/drivers/video/logo/logo_linux_clut224.ppm
@@ -1,1604 +1,883 @@
 P3
-# Standard 224-color Linux logo
-80 80
+63 80
 255
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6   6   6   6  10  10  10  10  10  10
- 10  10  10   6   6   6   6   6   6   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  10  10  10  14  14  14
- 22  22  22  26  26  26  30  30  30  34  34  34
- 30  30  30  30  30  30  26  26  26  18  18  18
- 14  14  14  10  10  10   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  26  26  26  42  42  42
- 54  54  54  66  66  66  78  78  78  78  78  78
- 78  78  78  74  74  74  66  66  66  54  54  54
- 42  42  42  26  26  26  18  18  18  10  10  10
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 22  22  22  42  42  42  66  66  66  86  86  86
- 66  66  66  38  38  38  38  38  38  22  22  22
- 26  26  26  34  34  34  54  54  54  66  66  66
- 86  86  86  70  70  70  46  46  46  26  26  26
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  26  26  26
- 50  50  50  82  82  82  58  58  58   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  6   6   6  54  54  54  86  86  86  66  66  66
- 38  38  38  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  22  22  22  50  50  50
- 78  78  78  34  34  34   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   6   6   6  70  70  70
- 78  78  78  46  46  46  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  42  42  42  82  82  82
- 26  26  26   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  14  14  14
- 46  46  46  34  34  34   6   6   6   2   2   6
- 42  42  42  78  78  78  42  42  42  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 10  10  10  30  30  30  66  66  66  58  58  58
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  26  26  26
- 86  86  86 101 101 101  46  46  46  10  10  10
-  2   2   6  58  58  58  70  70  70  34  34  34
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 14  14  14  42  42  42  86  86  86  10  10  10
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  30  30  30
- 94  94  94  94  94  94  58  58  58  26  26  26
-  2   2   6   6   6   6  78  78  78  54  54  54
- 22  22  22   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 22  22  22  62  62  62  62  62  62   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  26  26  26
- 54  54  54  38  38  38  18  18  18  10  10  10
-  2   2   6   2   2   6  34  34  34  82  82  82
- 38  38  38  14  14  14   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 30  30  30  78  78  78  30  30  30   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  10  10  10
- 10  10  10   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  78  78  78
- 50  50  50  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  86  86  86  14  14  14   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  54  54  54
- 66  66  66  26  26  26   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  82  82  82   2   2   6   2   2   6
-  2   2   6   6   6   6  10  10  10   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   6   6   6
- 14  14  14  10  10  10   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  18  18  18
- 82  82  82  34  34  34  10  10  10   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6   2   2   6
-  6   6   6   6   6   6  22  22  22  34  34  34
-  6   6   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  18  18  18  34  34  34
- 10  10  10  50  50  50  22  22  22   2   2   6
-  2   2   6   2   2   6   2   2   6  10  10  10
- 86  86  86  42  42  42  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6   2   2   6
- 38  38  38 116 116 116  94  94  94  22  22  22
- 22  22  22   2   2   6   2   2   6   2   2   6
- 14  14  14  86  86  86 138 138 138 162 162 162
-154 154 154  38  38  38  26  26  26   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 86  86  86  46  46  46  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6  14  14  14
-134 134 134 198 198 198 195 195 195 116 116 116
- 10  10  10   2   2   6   2   2   6   6   6   6
-101  98  89 187 187 187 210 210 210 218 218 218
-214 214 214 134 134 134  14  14  14   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 86  86  86  50  50  50  18  18  18   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6  54  54  54
-218 218 218 195 195 195 226 226 226 246 246 246
- 58  58  58   2   2   6   2   2   6  30  30  30
-210 210 210 253 253 253 174 174 174 123 123 123
-221 221 221 234 234 234  74  74  74   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 70  70  70  58  58  58  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  82  82  82   2   2   6 106 106 106
-170 170 170  26  26  26  86  86  86 226 226 226
-123 123 123  10  10  10  14  14  14  46  46  46
-231 231 231 190 190 190   6   6   6  70  70  70
- 90  90  90 238 238 238 158 158 158   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 70  70  70  58  58  58  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  86  86  86   6   6   6 116 116 116
-106 106 106   6   6   6  70  70  70 149 149 149
-128 128 128  18  18  18  38  38  38  54  54  54
-221 221 221 106 106 106   2   2   6  14  14  14
- 46  46  46 190 190 190 198 198 198   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 74  74  74  62  62  62  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   0
-  0   0   1   0   0   0   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  94  94  94  14  14  14 101 101 101
-128 128 128   2   2   6  18  18  18 116 116 116
-118  98  46 121  92   8 121  92   8  98  78  10
-162 162 162 106 106 106   2   2   6   2   2   6
-  2   2   6 195 195 195 195 195 195   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 74  74  74  62  62  62  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   1
-  0   0   1   0   0   0   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  90  90  90  14  14  14  58  58  58
-210 210 210  26  26  26  54  38   6 154 114  10
-226 170  11 236 186  11 225 175  15 184 144  12
-215 174  15 175 146  61  37  26   9   2   2   6
- 70  70  70 246 246 246 138 138 138   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 70  70  70  66  66  66  26  26  26   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  86  86  86  14  14  14  10  10  10
-195 195 195 188 164 115 192 133   9 225 175  15
-239 182  13 234 190  10 232 195  16 232 200  30
-245 207  45 241 208  19 232 195  16 184 144  12
-218 194 134 211 206 186  42  42  42   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 50  50  50  74  74  74  30  30  30   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 34  34  34  86  86  86  14  14  14   2   2   6
-121  87  25 192 133   9 219 162  10 239 182  13
-236 186  11 232 195  16 241 208  19 244 214  54
-246 218  60 246 218  38 246 215  20 241 208  19
-241 208  19 226 184  13 121  87  25   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 50  50  50  82  82  82  34  34  34  10  10  10
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 34  34  34  82  82  82  30  30  30  61  42   6
-180 123   7 206 145  10 230 174  11 239 182  13
-234 190  10 238 202  15 241 208  19 246 218  74
-246 218  38 246 215  20 246 215  20 246 215  20
-226 184  13 215 174  15 184 144  12   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 26  26  26  94  94  94  42  42  42  14  14  14
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78  50  50  50 104  69   6
-192 133   9 216 158  10 236 178  12 236 186  11
-232 195  16 241 208  19 244 214  54 245 215  43
-246 215  20 246 215  20 241 208  19 198 155  10
-200 144  11 216 158  10 156 118  10   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  6   6   6  90  90  90  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78  46  46  46  22  22  22
-137  92   6 210 162  10 239 182  13 238 190  10
-238 202  15 241 208  19 246 215  20 246 215  20
-241 208  19 203 166  17 185 133  11 210 150  10
-216 158  10 210 150  10 102  78  10   2   2   6
-  6   6   6  54  54  54  14  14  14   2   2   6
-  2   2   6  62  62  62  74  74  74  30  30  30
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 34  34  34  78  78  78  50  50  50   6   6   6
- 94  70  30 139 102  15 190 146  13 226 184  13
-232 200  30 232 195  16 215 174  15 190 146  13
-168 122  10 192 133   9 210 150  10 213 154  11
-202 150  34 182 157 106 101  98  89   2   2   6
-  2   2   6  78  78  78 116 116 116  58  58  58
-  2   2   6  22  22  22  90  90  90  46  46  46
- 18  18  18   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  86  86  86  50  50  50   6   6   6
-128 128 128 174 154 114 156 107  11 168 122  10
-198 155  10 184 144  12 197 138  11 200 144  11
-206 145  10 206 145  10 197 138  11 188 164 115
-195 195 195 198 198 198 174 174 174  14  14  14
-  2   2   6  22  22  22 116 116 116 116 116 116
- 22  22  22   2   2   6  74  74  74  70  70  70
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50 101 101 101  26  26  26  10  10  10
-138 138 138 190 190 190 174 154 114 156 107  11
-197 138  11 200 144  11 197 138  11 192 133   9
-180 123   7 190 142  34 190 178 144 187 187 187
-202 202 202 221 221 221 214 214 214  66  66  66
-  2   2   6   2   2   6  50  50  50  62  62  62
-  6   6   6   2   2   6  10  10  10  90  90  90
- 50  50  50  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  34  34  34
- 74  74  74  74  74  74   2   2   6   6   6   6
-144 144 144 198 198 198 190 190 190 178 166 146
-154 121  60 156 107  11 156 107  11 168 124  44
-174 154 114 187 187 187 190 190 190 210 210 210
-246 246 246 253 253 253 253 253 253 182 182 182
-  6   6   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  62  62  62
- 74  74  74  34  34  34  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0  10  10  10  22  22  22  54  54  54
- 94  94  94  18  18  18   2   2   6  46  46  46
-234 234 234 221 221 221 190 190 190 190 190 190
-190 190 190 187 187 187 187 187 187 190 190 190
-190 190 190 195 195 195 214 214 214 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
- 82  82  82   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  14  14  14
- 86  86  86  54  54  54  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  46  46  46  90  90  90
- 46  46  46  18  18  18   6   6   6 182 182 182
-253 253 253 246 246 246 206 206 206 190 190 190
-190 190 190 190 190 190 190 190 190 190 190 190
-206 206 206 231 231 231 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-202 202 202  14  14  14   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 42  42  42  86  86  86  42  42  42  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 14  14  14  38  38  38  74  74  74  66  66  66
-  2   2   6   6   6   6  90  90  90 250 250 250
-253 253 253 253 253 253 238 238 238 198 198 198
-190 190 190 190 190 190 195 195 195 221 221 221
-246 246 246 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253  82  82  82   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  78  78  78  70  70  70  34  34  34
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 34  34  34  66  66  66  78  78  78   6   6   6
-  2   2   6  18  18  18 218 218 218 253 253 253
-253 253 253 253 253 253 253 253 253 246 246 246
-226 226 226 231 231 231 246 246 246 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 178 178 178   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  18  18  18  90  90  90  62  62  62
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  26  26  26
- 58  58  58  90  90  90  18  18  18   2   2   6
-  2   2   6 110 110 110 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 231 231 231  18  18  18   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  18  18  18  94  94  94
- 54  54  54  26  26  26  10  10  10   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  22  22  22  50  50  50
- 90  90  90  26  26  26   2   2   6   2   2   6
- 14  14  14 195 195 195 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 242 242 242  54  54  54   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  38  38  38
- 86  86  86  50  50  50  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  38  38  38  82  82  82
- 34  34  34   2   2   6   2   2   6   2   2   6
- 42  42  42 195 195 195 246 246 246 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-242 242 242 242 242 242 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 250 250 250 246 246 246 238 238 238
-226 226 226 231 231 231 101 101 101   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 38  38  38  82  82  82  42  42  42  14  14  14
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 10  10  10  26  26  26  62  62  62  66  66  66
-  2   2   6   2   2   6   2   2   6   6   6   6
- 70  70  70 170 170 170 206 206 206 234 234 234
-246 246 246 250 250 250 250 250 250 238 238 238
-226 226 226 231 231 231 238 238 238 250 250 250
-250 250 250 250 250 250 246 246 246 231 231 231
-214 214 214 206 206 206 202 202 202 202 202 202
-198 198 198 202 202 202 182 182 182  18  18  18
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  62  62  62  66  66  66  30  30  30
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 14  14  14  42  42  42  82  82  82  18  18  18
-  2   2   6   2   2   6   2   2   6  10  10  10
- 94  94  94 182 182 182 218 218 218 242 242 242
-250 250 250 253 253 253 253 253 253 250 250 250
-234 234 234 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 246 246 246
-238 238 238 226 226 226 210 210 210 202 202 202
-195 195 195 195 195 195 210 210 210 158 158 158
-  6   6   6  14  14  14  50  50  50  14  14  14
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  86  86  86  46  46  46
- 18  18  18   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 22  22  22  54  54  54  70  70  70   2   2   6
-  2   2   6  10  10  10   2   2   6  22  22  22
-166 166 166 231 231 231 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-242 242 242 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 246 246 246
-231 231 231 206 206 206 198 198 198 226 226 226
- 94  94  94   2   2   6   6   6   6  38  38  38
- 30  30  30   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  62  62  62  66  66  66
- 26  26  26  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  74  74  74  50  50  50   2   2   6
- 26  26  26  26  26  26   2   2   6 106 106 106
-238 238 238 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 246 246 246 218 218 218 202 202 202
-210 210 210  14  14  14   2   2   6   2   2   6
- 30  30  30  22  22  22   2   2   6   2   2   6
-  2   2   6   2   2   6  18  18  18  86  86  86
- 42  42  42  14  14  14   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  90  90  90  22  22  22   2   2   6
- 42  42  42   2   2   6  18  18  18 218 218 218
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 250 250 250 221 221 221
-218 218 218 101 101 101   2   2   6  14  14  14
- 18  18  18  38  38  38  10  10  10   2   2   6
-  2   2   6   2   2   6   2   2   6  78  78  78
- 58  58  58  22  22  22   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 54  54  54  82  82  82   2   2   6  26  26  26
- 22  22  22   2   2   6 123 123 123 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-238 238 238 198 198 198   6   6   6  38  38  38
- 58  58  58  26  26  26  38  38  38   2   2   6
-  2   2   6   2   2   6   2   2   6  46  46  46
- 78  78  78  30  30  30  10  10  10   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  30  30  30
- 74  74  74  58  58  58   2   2   6  42  42  42
-  2   2   6  22  22  22 231 231 231 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 246 246 246  46  46  46  38  38  38
- 42  42  42  14  14  14  38  38  38  14  14  14
-  2   2   6   2   2   6   2   2   6   6   6   6
- 86  86  86  46  46  46  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  14  14  14  42  42  42
- 90  90  90  18  18  18  18  18  18  26  26  26
-  2   2   6 116 116 116 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 250 250 250 238 238 238
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253  94  94  94   6   6   6
-  2   2   6   2   2   6  10  10  10  34  34  34
-  2   2   6   2   2   6   2   2   6   2   2   6
- 74  74  74  58  58  58  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0  10  10  10  26  26  26  66  66  66
- 82  82  82   2   2   6  38  38  38   6   6   6
- 14  14  14 210 210 210 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 246 246 246 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 144 144 144   2   2   6
-  2   2   6   2   2   6   2   2   6  46  46  46
-  2   2   6   2   2   6   2   2   6   2   2   6
- 42  42  42  74  74  74  30  30  30  10  10  10
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  42  42  42  90  90  90
- 26  26  26   6   6   6  42  42  42   2   2   6
- 74  74  74 250 250 250 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 242 242 242 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 182 182 182   2   2   6
-  2   2   6   2   2   6   2   2   6  46  46  46
-  2   2   6   2   2   6   2   2   6   2   2   6
- 10  10  10  86  86  86  38  38  38  10  10  10
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 10  10  10  26  26  26  66  66  66  82  82  82
-  2   2   6  22  22  22  18  18  18   2   2   6
-149 149 149 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 206 206 206   2   2   6
-  2   2   6   2   2   6   2   2   6  38  38  38
-  2   2   6   2   2   6   2   2   6   2   2   6
-  6   6   6  86  86  86  46  46  46  14  14  14
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 18  18  18  46  46  46  86  86  86  18  18  18
-  2   2   6  34  34  34  10  10  10   6   6   6
-210 210 210 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 221 221 221   6   6   6
-  2   2   6   2   2   6   6   6   6  30  30  30
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  82  82  82  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 26  26  26  66  66  66  62  62  62   2   2   6
-  2   2   6  38  38  38  10  10  10  26  26  26
-238 238 238 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 238 238 238
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231   6   6   6
-  2   2   6   2   2   6  10  10  10  30  30  30
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  58  58  58  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  78  78  78   6   6   6   2   2   6
-  2   2   6  46  46  46  14  14  14  42  42  42
-246 246 246 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234  10  10  10
-  2   2   6   2   2   6  22  22  22  14  14  14
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  62  62  62  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50  74  74  74   2   2   6   2   2   6
- 14  14  14  70  70  70  34  34  34  62  62  62
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234  14  14  14
-  2   2   6   2   2   6  30  30  30   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  62  62  62  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 54  54  54  62  62  62   2   2   6   2   2   6
-  2   2   6  30  30  30  46  46  46  70  70  70
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 226 226 226  10  10  10
-  2   2   6   6   6   6  30  30  30   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  58  58  58  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  22  22  22
- 58  58  58  62  62  62   2   2   6   2   2   6
-  2   2   6   2   2   6  30  30  30  78  78  78
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 206 206 206   2   2   6
- 22  22  22  34  34  34  18  14   6  22  22  22
- 26  26  26  18  18  18   6   6   6   2   2   6
-  2   2   6  82  82  82  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  26  26  26
- 62  62  62 106 106 106  74  54  14 185 133  11
-210 162  10 121  92   8   6   6   6  62  62  62
-238 238 238 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 158 158 158  18  18  18
- 14  14  14   2   2   6   2   2   6   2   2   6
-  6   6   6  18  18  18  66  66  66  38  38  38
-  6   6   6  94  94  94  50  50  50  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 10  10  10  10  10  10  18  18  18  38  38  38
- 78  78  78 142 134 106 216 158  10 242 186  14
-246 190  14 246 190  14 156 118  10  10  10  10
- 90  90  90 238 238 238 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 250 250 250
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 246 230 190
-238 204  91 238 204  91 181 142  44  37  26   9
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  38  38  38  46  46  46
- 26  26  26 106 106 106  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  14  14  14  22  22  22
- 30  30  30  38  38  38  50  50  50  70  70  70
-106 106 106 190 142  34 226 170  11 242 186  14
-246 190  14 246 190  14 246 190  14 154 114  10
-  6   6   6  74  74  74 226 226 226 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 250 250 250
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 228 184  62
-241 196  14 241 208  19 232 195  16  38  30  10
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  30  30  30  26  26  26
-203 166  17 154 142  90  66  66  66  26  26  26
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  38  38  38  58  58  58
- 78  78  78  86  86  86 101 101 101 123 123 123
-175 146  61 210 150  10 234 174  13 246 186  14
-246 190  14 246 190  14 246 190  14 238 190  10
-102  78  10   2   2   6  46  46  46 198 198 198
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 224 178  62
-242 186  14 241 196  14 210 166  10  22  18   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   6   6   6 121  92   8
-238 202  15 232 195  16  82  82  82  34  34  34
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 14  14  14  38  38  38  70  70  70 154 122  46
-190 142  34 200 144  11 197 138  11 197 138  11
-213 154  11 226 170  11 242 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-225 175  15  46  32   6   2   2   6  22  22  22
-158 158 158 250 250 250 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 250 250 250 242 242 242 224 178  62
-239 182  13 236 186  11 213 154  11  46  32   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  61  42   6 225 175  15
-238 190  10 236 186  11 112 100  78  42  42  42
- 14  14  14   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 22  22  22  54  54  54 154 122  46 213 154  11
-226 170  11 230 174  11 226 170  11 226 170  11
-236 178  12 242 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-241 196  14 184 144  12  10  10  10   2   2   6
-  6   6   6 116 116 116 242 242 242 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 231 231 231 198 198 198 214 170  54
-236 178  12 236 178  12 210 150  10 137  92   6
- 18  14   6   2   2   6   2   2   6   2   2   6
-  6   6   6  70  47   6 200 144  11 236 178  12
-239 182  13 239 182  13 124 112  88  58  58  58
- 22  22  22   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  70  70  70 180 133  36 226 170  11
-239 182  13 242 186  14 242 186  14 246 186  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 232 195  16  98  70   6   2   2   6
-  2   2   6   2   2   6  66  66  66 221 221 221
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 206 206 206 198 198 198 214 166  58
-230 174  11 230 174  11 216 158  10 192 133   9
-163 110   8 116  81   8 102  78  10 116  81   8
-167 114   7 197 138  11 226 170  11 239 182  13
-242 186  14 242 186  14 162 146  94  78  78  78
- 34  34  34  14  14  14   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 30  30  30  78  78  78 190 142  34 226 170  11
-239 182  13 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 241 196  14 203 166  17  22  18   6
-  2   2   6   2   2   6   2   2   6  38  38  38
-218 218 218 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 206 206 206 198 198 198 202 162  69
-226 170  11 236 178  12 224 166  10 210 150  10
-200 144  11 197 138  11 192 133   9 197 138  11
-210 150  10 226 170  11 242 186  14 246 190  14
-246 190  14 246 186  14 225 175  15 124 112  88
- 62  62  62  30  30  30  14  14  14   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78 174 135  50 224 166  10
-239 182  13 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 241 196  14 139 102  15
-  2   2   6   2   2   6   2   2   6   2   2   6
- 78  78  78 250 250 250 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 214 214 214 198 198 198 190 150  46
-219 162  10 236 178  12 234 174  13 224 166  10
-216 158  10 213 154  11 213 154  11 216 158  10
-226 170  11 239 182  13 246 190  14 246 190  14
-246 190  14 246 190  14 242 186  14 206 162  42
-101 101 101  58  58  58  30  30  30  14  14  14
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  74  74  74 174 135  50 216 158  10
-236 178  12 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 241 196  14 226 184  13
- 61  42   6   2   2   6   2   2   6   2   2   6
- 22  22  22 238 238 238 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 226 226 226 187 187 187 180 133  36
-216 158  10 236 178  12 239 182  13 236 178  12
-230 174  11 226 170  11 226 170  11 230 174  11
-236 178  12 242 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 186  14 239 182  13
-206 162  42 106 106 106  66  66  66  34  34  34
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 26  26  26  70  70  70 163 133  67 213 154  11
-236 178  12 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 241 196  14
-190 146  13  18  14   6   2   2   6   2   2   6
- 46  46  46 246 246 246 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 221 221 221  86  86  86 156 107  11
-216 158  10 236 178  12 242 186  14 246 186  14
-242 186  14 239 182  13 239 182  13 242 186  14
-242 186  14 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-242 186  14 225 175  15 142 122  72  66  66  66
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 26  26  26  70  70  70 163 133  67 210 150  10
-236 178  12 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-232 195  16 121  92   8  34  34  34 106 106 106
-221 221 221 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-242 242 242  82  82  82  18  14   6 163 110   8
-216 158  10 236 178  12 242 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 242 186  14 163 133  67
- 46  46  46  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78 163 133  67 210 150  10
-236 178  12 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-241 196  14 215 174  15 190 178 144 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 218 218 218
- 58  58  58   2   2   6  22  18   6 167 114   7
-216 158  10 236 178  12 246 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 186  14 242 186  14 190 150  46
- 54  54  54  22  22  22   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 38  38  38  86  86  86 180 133  36 213 154  11
-236 178  12 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 232 195  16 190 146  13 214 214 214
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 250 250 250 170 170 170  26  26  26
-  2   2   6   2   2   6  37  26   9 163 110   8
-219 162  10 239 182  13 246 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 186  14 236 178  12 224 166  10 142 122  72
- 46  46  46  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50 109 106  95 192 133   9 224 166  10
-242 186  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-242 186  14 226 184  13 210 162  10 142 110  46
-226 226 226 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-198 198 198  66  66  66   2   2   6   2   2   6
-  2   2   6   2   2   6  50  34   6 156 107  11
-219 162  10 239 182  13 246 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 242 186  14
-234 174  13 213 154  11 154 122  46  66  66  66
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  22  22  22
- 58  58  58 154 121  60 206 145  10 234 174  13
-242 186  14 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 186  14 236 178  12 210 162  10 163 110   8
- 61  42   6 138 138 138 218 218 218 250 250 250
-253 253 253 253 253 253 253 253 253 250 250 250
-242 242 242 210 210 210 144 144 144  66  66  66
-  6   6   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  61  42   6 163 110   8
-216 158  10 236 178  12 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 239 182  13 230 174  11 216 158  10
-190 142  34 124 112  88  70  70  70  38  38  38
- 18  18  18   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  22  22  22
- 62  62  62 168 124  44 206 145  10 224 166  10
-236 178  12 239 182  13 242 186  14 242 186  14
-246 186  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 236 178  12 216 158  10 175 118   6
- 80  54   7   2   2   6   6   6   6  30  30  30
- 54  54  54  62  62  62  50  50  50  38  38  38
- 14  14  14   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  80  54   7 167 114   7
-213 154  11 236 178  12 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 242 186  14 239 182  13 239 182  13
-230 174  11 210 150  10 174 135  50 124 112  88
- 82  82  82  54  54  54  34  34  34  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50 158 118  36 192 133   9 200 144  11
-216 158  10 219 162  10 224 166  10 226 170  11
-230 174  11 236 178  12 239 182  13 239 182  13
-242 186  14 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 186  14 230 174  11 210 150  10 163 110   8
-104  69   6  10  10  10   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  91  60   6 167 114   7
-206 145  10 230 174  11 242 186  14 246 190  14
-246 190  14 246 190  14 246 186  14 242 186  14
-239 182  13 230 174  11 224 166  10 213 154  11
-180 133  36 124 112  88  86  86  86  58  58  58
- 38  38  38  22  22  22  10  10  10   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 34  34  34  70  70  70 138 110  50 158 118  36
-167 114   7 180 123   7 192 133   9 197 138  11
-200 144  11 206 145  10 213 154  11 219 162  10
-224 166  10 230 174  11 239 182  13 242 186  14
-246 186  14 246 186  14 246 186  14 246 186  14
-239 182  13 216 158  10 185 133  11 152  99   6
-104  69   6  18  14   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  80  54   7 152  99   6
-192 133   9 219 162  10 236 178  12 239 182  13
-246 186  14 242 186  14 239 182  13 236 178  12
-224 166  10 206 145  10 192 133   9 154 121  60
- 94  94  94  62  62  62  42  42  42  22  22  22
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 18  18  18  34  34  34  58  58  58  78  78  78
-101  98  89 124 112  88 142 110  46 156 107  11
-163 110   8 167 114   7 175 118   6 180 123   7
-185 133  11 197 138  11 210 150  10 219 162  10
-226 170  11 236 178  12 236 178  12 234 174  13
-219 162  10 197 138  11 163 110   8 130  83   6
- 91  60   6  10  10  10   2   2   6   2   2   6
- 18  18  18  38  38  38  38  38  38  38  38  38
- 38  38  38  38  38  38  38  38  38  38  38  38
- 38  38  38  38  38  38  26  26  26   2   2   6
-  2   2   6   6   6   6  70  47   6 137  92   6
-175 118   6 200 144  11 219 162  10 230 174  11
-234 174  13 230 174  11 219 162  10 210 150  10
-192 133   9 163 110   8 124 112  88  82  82  82
- 50  50  50  30  30  30  14  14  14   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  22  22  22  34  34  34
- 42  42  42  58  58  58  74  74  74  86  86  86
-101  98  89 122 102  70 130  98  46 121  87  25
-137  92   6 152  99   6 163 110   8 180 123   7
-185 133  11 197 138  11 206 145  10 200 144  11
-180 123   7 156 107  11 130  83   6 104  69   6
- 50  34   6  54  54  54 110 110 110 101  98  89
- 86  86  86  82  82  82  78  78  78  78  78  78
- 78  78  78  78  78  78  78  78  78  78  78  78
- 78  78  78  82  82  82  86  86  86  94  94  94
-106 106 106 101 101 101  86  66  34 124  80   6
-156 107  11 180 123   7 192 133   9 200 144  11
-206 145  10 200 144  11 192 133   9 175 118   6
-139 102  15 109 106  95  70  70  70  42  42  42
- 22  22  22  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  10  10  10
- 14  14  14  22  22  22  30  30  30  38  38  38
- 50  50  50  62  62  62  74  74  74  90  90  90
-101  98  89 112 100  78 121  87  25 124  80   6
-137  92   6 152  99   6 152  99   6 152  99   6
-138  86   6 124  80   6  98  70   6  86  66  30
-101  98  89  82  82  82  58  58  58  46  46  46
- 38  38  38  34  34  34  34  34  34  34  34  34
- 34  34  34  34  34  34  34  34  34  34  34  34
- 34  34  34  34  34  34  38  38  38  42  42  42
- 54  54  54  82  82  82  94  86  76  91  60   6
-134  86   6 156 107  11 167 114   7 175 118   6
-175 118   6 167 114   7 152  99   6 121  87  25
-101  98  89  62  62  62  34  34  34  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6   6   6   6  10  10  10
- 18  18  18  22  22  22  30  30  30  42  42  42
- 50  50  50  66  66  66  86  86  86 101  98  89
-106  86  58  98  70   6 104  69   6 104  69   6
-104  69   6  91  60   6  82  62  34  90  90  90
- 62  62  62  38  38  38  22  22  22  14  14  14
- 10  10  10  10  10  10  10  10  10  10  10  10
- 10  10  10  10  10  10   6   6   6  10  10  10
- 10  10  10  10  10  10  10  10  10  14  14  14
- 22  22  22  42  42  42  70  70  70  89  81  66
- 80  54   7 104  69   6 124  80   6 137  92   6
-134  86   6 116  81   8 100  82  52  86  86  86
- 58  58  58  30  30  30  14  14  14   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  10  10  10  14  14  14
- 18  18  18  26  26  26  38  38  38  54  54  54
- 70  70  70  86  86  86  94  86  76  89  81  66
- 89  81  66  86  86  86  74  74  74  50  50  50
- 30  30  30  14  14  14   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  34  34  34  58  58  58
- 82  82  82  89  81  66  89  81  66  89  81  66
- 94  86  66  94  86  76  74  74  74  50  50  50
- 26  26  26  14  14  14   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6   6   6   6  14  14  14  18  18  18
- 30  30  30  38  38  38  46  46  46  54  54  54
- 50  50  50  42  42  42  30  30  30  18  18  18
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  14  14  14  26  26  26
- 38  38  38  50  50  50  58  58  58  58  58  58
- 54  54  54  42  42  42  30  30  30  18  18  18
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
-  6   6   6  10  10  10  14  14  14  18  18  18
- 18  18  18  14  14  14  10  10  10   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 14  14  14  18  18  18  22  22  22  22  22  22
- 18  18  18  14  14  14  10  10  10   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 1 0  0 0 0  0 0 0  1 1 0
+0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  1 1 0  0 0 0  0 0 0
+0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
+10 15 3  2 3 1  12 18 4  42 61 14  19 27 6  11 16 4
+38 55 13  10 15 3  3 4 1  10 15 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 3 1
+12 18 4  1 1 0  23 34 8  31 45 11  10 15 3  32 47 11
+34 49 12  3 4 1  3 4 1  3 4 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  10 15 3  29 42 10  26 37 9  12 18 4
+55 80 19  81 118 28  55 80 19  92 132 31  106 153 36  69 100 23
+100 144 34  80 116 27  42 61 14  81 118 28  23 34 8  27 40 9
+15 21 5  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  1 1 0  29 42 10  15 21 5  50 72 17
+74 107 25  45 64 15  102 148 35  80 116 27  84 121 28  111 160 38
+69 100 23  65 94 22  81 118 28  29 42 10  17 25 6  29 42 10
+23 34 8  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
+15 21 5  15 21 5  34 49 12  101 146 34  111 161 38  97 141 33
+97 141 33  119 172 41  117 170 40  116 167 40  118 170 40  118 171 40
+117 169 40  118 170 40  111 160 38  118 170 40  96 138 32  89 128 30
+81 118 28  11 16 4  10 15 3  1 1 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+3 4 1  3 4 1  34 49 12  101 146 34  79 115 27  111 160 38
+114 165 39  113 163 39  118 170 40  117 169 40  118 171 40  117 169 40
+116 167 40  119 172 41  113 163 39  92 132 31  105 151 36  113 163 39
+75 109 26  19 27 6  16 23 5  11 16 4  0 1 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
+80 116 27  106 153 36  105 151 36  114 165 39  118 170 40  118 171 40
+118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 170 40  117 169 40  118 170 40  118 170 40
+117 170 40  75 109 26  75 109 26  34 49 12  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
+64 92 22  65 94 22  100 144 34  118 171 40  118 170 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 171 41  118 170 40  117 169 40
+109 158 37  105 151 36  104 150 35  47 69 16  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+42 61 14  115 167 39  118 170 40  117 169 40  117 169 40  117 169 40
+117 170 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  118 170 40  96 138 32  17 25 6  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  47 69 16
+114 165 39  117 168 40  117 170 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  118 170 40  117 169 40  117 169 40  117 169 40
+117 170 40  119 172 41  96 138 32  12 18 4  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
+32 47 11  105 151 36  118 170 40  117 169 40  117 169 40  116 168 40
+109 157 37  111 160 38  117 169 40  118 171 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 171 40  69 100 23  2 3 1
+0 0 0  0 0 0  0 0 0  0 0 0  19 27 6  101 146 34
+118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 170 40
+118 171 40  115 166 39  107 154 36  111 161 38  117 169 40  117 169 40
+117 169 40  118 171 40  75 109 26  19 27 6  2 3 1  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  16 23 5
+89 128 30  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+111 160 38  92 132 31  79 115 27  96 138 32  115 166 39  119 171 41
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 170 40  109 157 37  26 37 9
+0 0 0  0 0 0  0 0 0  0 0 0  64 92 22  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 170 40  118 171 40  109 157 37
+89 128 30  81 118 28  100 144 34  115 166 39  117 169 40  117 169 40
+117 169 40  117 170 40  113 163 39  60 86 20  1 1 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+27 40 9  96 138 32  118 170 40  117 169 40  117 169 40  117 169 40
+117 170 40  117 169 40  101 146 34  67 96 23  55 80 19  84 121 28
+113 163 39  119 171 41  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  65 94 22
+0 0 0  0 0 0  0 0 0  15 21 5  101 146 34  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  118 170 40  118 171 40  104 150 35  69 100 23  53 76 18
+81 118 28  111 160 38  118 170 40  117 169 40  117 169 40  117 169 40
+117 169 40  114 165 39  69 100 23  10 15 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
+31 45 11  77 111 26  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  118 170 40  116 168 40  92 132 31  47 69 16
+38 55 13  81 118 28  113 163 39  119 171 41  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 171 41  92 132 31
+10 15 3  0 0 0  0 0 0  36 52 12  115 166 39  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
+118 171 40  102 148 35  64 92 22  34 49 12  65 94 22  106 153 36
+118 171 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
+118 170 40  107 154 36  55 80 19  15 21 5  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+29 42 10  101 146 34  118 171 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  113 163 39
+75 109 26  27 40 9  36 52 12  89 128 30  116 167 40  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  104 150 35
+16 23 5  0 0 0  0 0 0  53 76 18  118 171 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  109 157 37
+67 96 23  23 34 8  42 61 14  96 138 32  118 170 40  118 170 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  74 107 25  10 15 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  31 45 11  101 146 34  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+119 171 41  102 148 35  47 69 16  14 20 5  50 72 17  102 148 35
+118 171 40  117 169 40  117 169 40  117 169 40  118 170 40  102 148 35
+15 21 5  0 0 0  0 0 0  50 72 17  118 170 40  117 169 40
+117 169 40  117 169 40  118 170 40  116 167 40  84 121 28  27 40 9
+19 27 6  74 107 25  114 165 39  118 171 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  75 109 26  10 15 4  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  38 55 13  102 148 35  118 171 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  118 170 40  115 167 39  77 111 26  17 25 6  19 27 6
+77 111 26  115 166 39  118 170 40  117 169 40  119 172 41  81 118 28
+3 4 1  0 0 0  0 0 0  27 40 9  111 160 38  118 170 40
+117 169 40  118 171 40  105 151 36  50 72 17  10 15 3  38 55 13
+100 144 34  118 171 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  79 115 27  15 21 5  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  10 15 3  64 92 22  111 160 38  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 171 40  96 138 32  32 47 11
+3 4 1  50 72 17  107 154 36  120 173 41  105 151 36  31 45 11
+0 0 0  0 0 0  0 0 0  3 4 1  65 94 22  117 169 40
+118 170 40  89 128 30  26 37 9  3 4 1  60 86 20  111 161 38
+118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+97 141 33  36 52 12  1 1 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  14 20 5  75 109 26  117 168 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  107 154 36
+45 64 15  2 3 1  31 45 11  75 109 26  32 47 11  0 1 0
+0 0 0  0 0 0  0 0 0  0 0 0  10 15 3  55 80 19
+65 94 22  11 16 4  11 16 4  75 109 26  116 168 40  118 170 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  107 154 36
+47 69 16  3 4 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  12 18 4  69 100 23  111 161 38  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
+111 160 38  50 72 17  2 3 1  2 3 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
+1 1 0  12 18 4  81 118 28  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 170 40  118 171 40  101 146 34
+42 61 14  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  3 4 1  36 52 12  89 128 30
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+118 171 41  101 146 34  14 20 5  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  47 69 16  118 170 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 170 40  111 160 38  69 100 23  19 27 6
+0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  11 16 4  69 100 23
+115 167 39  119 172 41  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+119 172 41  75 109 26  3 4 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  23 34 8  106 153 36  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  118 170 40  119 172 41  105 151 36  42 61 14  2 3 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 1 0  15 21 5
+45 64 15  80 116 27  114 165 39  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  119 172 41
+97 141 33  20 30 7  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  1 1 0  53 76 18  114 165 39  118 171 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+118 171 40  104 150 35  64 92 22  31 45 11  10 15 3  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  36 52 12  97 141 33  109 158 37  113 163 39  116 168 40
+117 169 40  117 170 40  118 170 40  119 172 41  115 167 39  84 121 28
+23 34 8  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  3 4 1  50 72 17  102 148 35  118 171 40
+119 171 41  118 170 40  117 169 40  117 169 40  115 166 39  111 161 38
+109 157 37  79 115 27  12 18 4  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  3 4 1  15 21 5  23 34 8  45 64 15  106 153 36
+116 167 40  111 160 38  101 146 34  79 115 27  42 61 14  10 15 3
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  1 1 0  20 30 7  60 86 20
+89 128 30  106 153 36  113 163 39  117 169 40  84 121 28  29 42 10
+19 27 6  10 15 3  2 3 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  16 23 5  38 55 13
+36 52 12  26 37 9  12 18 4  2 3 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  1 0 0  19 2 7  52 5 18
+78 7 27  88 8 31  81 7 29  56 5 19  25 2 9  3 0 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+3 4 1  19 27 6  31 45 11  38 55 13  32 47 11  3 4 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
+9 0 3  12 1 4  9 0 3  4 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  28 3 10  99 9 35  156 14 55  182 16 64
+189 17 66  190 17 67  189 17 66  184 17 65  166 15 58  118 13 41
+45 4 16  3 0 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  11 1 4  52 5 18  101 9 35  134 12 47
+151 14 53  154 14 54  151 14 53  113 10 40  11 1 4  0 0 0
+3 0 1  67 6 24  159 14 56  190 17 67  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  191 17 67
+174 16 61  101 9 35  14 1 5  0 0 0  35 3 12  108 10 38
+122 11 43  122 11 43  112 10 39  87 8 30  50 5 17  13 1 5
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+3 0 1  56 5 19  141 13 49  182 16 64  191 17 67  191 17 67
+190 17 67  190 17 67  191 17 67  113 10 40  3 0 1  1 0 0
+79 7 28  180 16 63  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+189 17 66  188 17 66  122 11 43  11 1 4  41 4 14  176 16 62
+191 17 67  191 17 67  191 17 67  190 17 67  181 16 63  146 13 51
+75 7 26  10 1 4  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  7 1 2
+90 8 32  178 16 62  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  41 4 14
+173 16 61  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  88 8 31  1 0 0  89 8 31
+185 17 65  189 17 66  188 17 66  188 17 66  189 17 66  191 17 67
+186 17 65  124 11 43  25 2 9  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  89 8 31
+184 17 65  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  151 14 53  34 3 12  0 0 0  0 0 0  79 7 28
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  191 17 67  146 13 51  9 1 3  7 1 2
+108 10 38  187 17 66  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  176 16 62
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+151 14 53  38 3 13  0 0 0  0 0 0  0 0 0  50 5 17
+180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  191 17 67  141 13 49  7 1 3  0 0 0
+11 1 4  112 10 39  187 17 66  189 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  113 10 40  5 0 2  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  7 1 3  132 12 46  191 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  146 13 51
+35 3 12  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
+101 9 35  185 17 65  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  190 17 67  180 16 63  67 6 24  0 0 0  0 0 0
+0 0 0  11 1 4  108 10 38  186 17 65  189 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  44 4 15  177 16 62  189 17 66
+188 17 66  188 17 66  189 17 66  189 17 66  134 12 47  28 3 10
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+8 1 3  79 7 28  159 14 56  188 17 66  191 17 67  190 17 67
+189 17 66  189 17 66  189 17 66  189 17 66  190 17 67  191 17 67
+188 17 66  158 14 55  72 7 25  4 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  8 1 3  95 9 33  182 16 64  189 17 67
+188 17 66  188 17 66  188 17 66  191 17 67  122 11 43  3 0 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  88 8 31  190 17 67  188 17 66
+188 17 66  189 17 66  185 17 65  113 10 40  18 2 6  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  1 0 0  24 2 8  77 7 27  124 11 43  154 14 54
+168 15 59  173 16 61  173 16 61  168 15 59  154 14 54  124 11 43
+77 7 27  22 2 8  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  5 0 2  77 7 27  173 16 61
+190 17 67  188 17 66  188 17 66  190 17 67  164 15 57  23 2 8
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  1 0 0  118 13 41  191 17 67  188 17 66
+190 17 67  174 16 61  87 8 30  8 1 3  0 0 0  0 0 0
+0 0 0  0 0 0  10 1 4  29 3 10  40 4 14  36 3 13
+18 2 6  2 0 1  0 0 0  0 0 0  3 0 1  14 1 5
+26 2 9  33 3 11  32 3 11  25 2 9  13 1 5  3 0 1
+0 0 0  14 1 5  56 5 19  95 9 33  109 10 38  101 9 35
+77 7 27  35 3 12  5 0 2  0 0 0  1 0 0  56 5 19
+156 14 55  190 17 67  188 17 66  188 17 66  182 16 64  50 5 17
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  189 17 66
+151 14 53  52 5 18  2 0 1  0 0 0  0 0 0  1 0 0
+28 3 10  90 8 32  146 13 51  170 15 60  178 16 62  174 16 61
+158 14 55  112 10 39  40 4 14  1 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
+56 5 19  146 13 51  183 17 64  191 17 67  191 17 67  191 17 67
+188 17 66  173 16 61  122 11 43  41 4 14  1 0 0  0 0 0
+30 3 10  124 11 43  185 17 65  190 17 67  187 17 66  67 6 24
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  6 1 2  134 12 47  168 15 59  99 9 35
+21 2 7  0 0 0  0 0 0  0 0 0  6 1 2  77 7 27
+162 15 57  190 17 67  191 17 67  189 17 66  189 17 66  189 17 66
+190 17 67  191 17 67  169 15 59  75 7 26  3 0 1  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  79 7 28
+178 16 62  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  191 17 67  170 15 60  79 7 28  5 0 2
+0 0 0  10 1 3  78 7 27  159 14 56  188 17 66  75 7 26
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  1 0 0  35 3 12  29 3 10  2 0 1
+0 0 0  0 0 0  0 0 0  9 1 3  101 9 35  183 17 64
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  178 16 63  67 6 23  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  174 16 61
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  182 16 64  89 8 31
+4 0 1  0 0 0  0 0 0  25 2 9  73 7 26  31 3 11
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  4 0 1  98 9 34  187 17 66  189 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  158 14 55  25 2 9
+0 0 0  0 0 0  0 0 0  8 1 3  134 12 47  191 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  180 16 63
+68 6 24  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  6 1 2  19 2 7  3 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  65 6 23  180 16 63  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  83 8 29
+0 0 0  0 0 0  0 0 0  41 4 14  177 16 62  189 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+159 14 56  28 3 10  0 0 0  0 0 0  0 0 0  23 2 8
+41 4 14  5 0 2  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+23 2 8  113 10 40  159 14 56  65 6 23  0 0 0  0 0 0
+0 0 0  16 1 6  146 13 51  191 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  132 12 46
+5 0 2  0 0 0  0 0 0  77 7 27  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  98 9 34  0 0 0  0 0 0  12 1 4  134 12 47
+178 16 63  108 10 38  16 1 6  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  30 3 10
+141 13 49  190 17 67  191 17 67  134 12 47  6 1 2  0 0 0
+0 0 0  68 6 24  186 17 65  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  156 14 55
+14 1 5  0 0 0  0 0 0  98 9 34  191 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  156 14 55  19 2 7  0 0 0  47 4 16  181 16 63
+190 17 67  189 17 66  126 14 44  17 2 6  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  16 1 6  134 12 47
+191 17 67  188 17 66  190 17 67  162 15 57  19 2 7  0 0 0
+3 0 1  123 11 43  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  163 15 57
+20 2 7  0 0 0  0 0 0  101 9 35  191 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  182 16 64  52 5 18  0 0 0  73 7 26  188 17 66
+188 17 66  188 17 66  189 17 66  109 10 38  5 0 2  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  95 9 33  189 17 66
+188 17 66  188 17 66  189 17 66  171 15 60  29 3 10  0 0 0
+16 1 6  156 14 55  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  158 14 55
+17 2 6  0 0 0  0 0 0  85 8 30  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  81 7 29  0 0 0  85 8 30  190 17 67
+188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  25 2 9  162 15 57  190 17 67
+188 17 66  188 17 66  189 17 66  173 16 61  31 3 11  0 0 0
+30 3 10  171 15 60  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  141 13 49
+7 1 2  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  191 17 67  98 9 34  0 0 0  88 8 31  190 17 67
+188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  5 0 2
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  68 6 24  187 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  170 15 60  28 3 10  0 0 0
+34 3 12  174 16 61  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  101 9 35
+0 0 0  0 0 0  0 0 0  21 2 7  159 14 56  190 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  191 17 67  98 9 34  0 0 0  81 7 29  189 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  168 15 59  28 3 10
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  109 10 38  191 17 67  188 17 66
+188 17 66  188 17 66  190 17 67  163 15 57  21 2 7  0 0 0
+26 2 9  168 15 59  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  180 16 63  47 4 16
+0 0 0  0 0 0  0 0 0  0 0 0  108 10 38  190 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  78 7 27  0 0 0  68 6 24  187 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  183 17 64  56 5 19
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  3 0 1  131 12 46  191 17 67  188 17 66
+188 17 66  188 17 66  190 17 67  151 14 53  12 1 4  0 0 0
+11 1 4  146 13 51  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  191 17 67  126 14 44  7 1 2
+0 0 0  0 0 0  0 0 0  0 0 0  32 3 11  164 15 58
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+189 17 66  178 16 62  44 4 15  0 0 0  50 5 17  182 16 64
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  188 17 66
+188 17 66  188 17 66  191 17 67  131 12 46  3 0 1  0 0 0
+0 0 0  101 9 35  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  170 15 60  44 4 15  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  77 7 27
+183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+191 17 67  134 12 47  9 1 3  0 0 0  31 3 11  171 15 60
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  2 0 1  124 11 43  191 17 67  188 17 66
+188 17 66  188 17 66  191 17 67  101 9 35  0 0 0  0 0 0
+0 0 0  35 3 12  168 15 59  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  182 16 64  77 7 27  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  6 1 2
+99 9 35  185 17 65  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
+177 16 62  56 5 19  0 0 0  0 0 0  13 1 5  151 14 53
+190 17 67  188 17 66  188 17 66  188 17 66  185 17 65  56 5 19
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  99 9 35  191 17 67  188 17 66
+188 17 66  188 17 66  186 17 65  65 6 23  0 0 0  0 0 0
+0 0 0  0 0 0  79 7 28  182 16 64  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+191 17 67  177 16 62  83 8 29  4 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+8 1 3  89 8 31  175 16 62  191 17 67  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  181 16 63
+85 8 30  3 0 1  0 0 0  0 0 0  1 0 0  118 13 41
+191 17 67  188 17 66  188 17 66  189 17 66  173 16 61  34 3 12
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
+188 17 66  189 17 66  169 15 59  30 3 10  0 0 0  0 0 0
+0 0 0  0 0 0  5 0 2  83 8 29  173 16 61  191 17 67
+190 17 67  189 17 66  189 17 66  190 17 67  191 17 67  187 17 66
+151 14 53  56 5 19  3 0 1  0 0 0  16 1 6  50 5 17
+79 7 28  95 9 33  95 9 33  75 7 26  41 4 14  10 1 4
+0 0 0  2 0 1  50 5 17  132 12 46  178 16 62  190 17 67
+191 17 67  191 17 67  191 17 67  186 17 65  154 14 54  68 6 24
+4 0 1  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
+187 17 66  188 17 66  188 17 66  191 17 67  141 13 49  9 1 3
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  14 1 5  151 14 53  190 17 67
+188 17 66  191 17 67  131 12 46  5 0 2  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  2 0 1  44 4 15  113 10 40
+156 14 55  173 16 61  174 16 61  164 15 58  134 12 47  77 7 27
+18 2 6  0 0 0  16 1 6  85 8 30  151 14 53  182 16 64
+189 17 66  191 17 67  190 17 67  188 17 66  177 16 62  141 13 49
+68 6 24  8 1 3  0 0 0  8 1 3  44 4 15  88 8 31
+113 10 40  122 11 43  108 10 38  67 6 24  20 2 7  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  28 3 10
+166 15 58  190 17 67  188 17 66  187 17 66  79 7 28  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  73 7 26  185 17 65
+189 17 66  184 17 65  65 6 23  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 0 1
+17 2 6  32 3 11  34 3 12  22 2 8  6 1 2  0 0 0
+0 0 0  38 3 13  141 13 49  188 17 66  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  191 17 67
+184 17 65  122 11 43  21 2 7  0 0 0  0 0 0  0 0 0
+0 0 0  1 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
+108 10 38  191 17 67  191 17 67  141 13 49  16 1 6  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  8 1 3  112 10 39
+186 17 65  124 11 43  10 1 4  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+36 3 13  156 14 55  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+189 17 66  190 17 67  134 12 47  18 2 6  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  7 1 2  41 4 14  75 7 26  66 5 23  19 2 7
+26 2 9  144 13 50  154 14 54  40 4 14  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
+56 5 19  19 2 7  0 0 0  7 1 2  29 3 10  35 3 12
+19 2 7  2 0 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
+134 12 47  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 67  108 10 38  3 0 1  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
+40 4 14  124 11 43  177 16 62  188 17 66  187 17 66  144 13 50
+24 2 8  17 2 6  22 2 8  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  19 2 7  122 11 43  171 15 60  175 16 62
+159 14 56  112 10 39  40 4 14  2 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
+186 17 65  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  174 16 61  41 4 14  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  3 0 1  72 7 25
+168 15 59  191 17 67  189 17 66  188 17 66  188 17 66  190 17 67
+95 9 33  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  95 9 33  191 17 67  189 17 66  189 17 66
+190 17 67  191 17 67  171 15 60  90 8 32  12 1 4  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  132 12 46
+191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  98 9 34  0 0 0
+0 0 0  0 0 0  0 0 0  5 0 2  88 8 31  180 16 63
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  191 17 67
+146 13 51  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  9 1 3  144 13 50  191 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  187 17 66  123 11 43  20 2 7
+0 0 0  0 0 0  0 0 0  0 0 0  21 2 7  163 15 57
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  191 17 67  134 12 47  5 0 2
+0 0 0  0 0 0  3 0 1  88 8 31  182 16 64  189 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
+171 15 60  31 3 11  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  20 2 7  162 15 57  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  132 12 46
+20 2 7  0 0 0  0 0 0  0 0 0  32 3 11  173 16 61
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  151 14 53  12 1 4
+0 0 0  0 0 0  72 7 25  180 16 63  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+181 16 63  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  21 2 7  163 15 57  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+122 11 43  9 1 3  0 0 0  0 0 0  30 3 10  171 15 60
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  146 13 51  10 1 4
+0 0 0  38 3 13  166 15 58  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+183 17 64  52 5 18  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  13 1 5  154 14 54  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+186 17 65  79 7 28  0 0 0  0 0 0  14 1 5  156 14 54
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  2 0 1
+5 0 2  122 11 43  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+182 16 64  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  3 0 1  126 14 44  191 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  158 14 55  23 2 8  0 0 0  1 0 0  113 10 40
+191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  78 7 27  0 0 0
+47 4 16  177 16 62  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
+173 16 61  34 3 12  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  85 8 30  189 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  79 7 28  0 0 0  0 0 0  47 4 16
+175 16 62  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  156 14 55  22 2 8  0 0 0
+109 10 38  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+151 14 53  13 1 5  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  35 3 12  173 16 61  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  191 17 67  134 12 47  7 1 2  0 0 0  3 0 1
+99 9 35  188 17 66  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  181 16 63  68 6 24  0 0 0  18 2 6
+156 14 55  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+101 9 35  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  3 0 1  118 13 41  191 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  168 15 59  28 3 10  0 0 0  0 0 0
+12 1 4  113 10 40  187 17 66  189 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  180 16 63  88 8 31  4 0 1  0 0 0  47 4 16
+180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  168 15 59
+36 3 13  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  38 3 13  164 15 58  190 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
+0 0 0  11 1 4  90 8 32  169 15 59  190 17 67  190 17 67
+189 17 66  189 17 66  189 17 66  189 17 66  191 17 67  189 17 66
+158 14 55  68 6 24  4 0 1  0 0 0  0 0 0  73 7 26
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  185 17 65  83 8 29
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  65 6 23  174 16 61
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  185 17 65  56 5 19  0 0 0  0 0 0
+0 0 0  0 0 0  2 0 1  35 3 12  99 9 35  146 13 51
+170 15 60  177 16 62  177 16 62  166 15 58  141 13 49  85 8 30
+24 2 8  0 0 0  0 0 0  0 0 0  0 0 0  85 8 30
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  112 10 39  8 1 3
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  68 6 24
+170 15 60  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  11 1 4
+28 3 10  40 4 14  38 3 13  25 2 9  8 1 3  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  78 7 27
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  187 17 66  113 10 40  14 1 5  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
+47 4 16  141 13 49  186 17 65  191 17 67  190 17 67  189 17 66
+189 17 66  191 17 67  156 14 55  20 2 7  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  44 4 15
+178 16 62  190 17 67  188 17 66  188 17 66  188 17 66  190 17 67
+191 17 67  173 16 61  90 8 32  10 1 4  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  14 1 5  68 6 24  131 12 46  162 15 57  174 16 61
+171 15 60  146 13 51  56 5 19  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  3 0 1  14 1 5  29 3 10
+41 4 14  47 4 16  50 5 17  45 4 16  34 3 12  18 2 6
+5 0 2  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
+90 8 32  169 15 59  185 17 65  187 17 66  182 16 64  163 15 57
+113 10 40  41 4 14  2 0 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  5 0 2  21 2 7  34 3 12
+29 3 10  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
+3 0 1  32 3 11  79 7 28  124 11 43  154 14 54  171 15 60
+180 16 63  182 16 64  182 16 64  180 16 63  174 16 61  159 14 56
+132 12 46  88 8 31  34 3 12  3 0 1  0 0 0  0 0 0
+3 0 1  29 3 10  56 5 19  65 6 23  50 5 17  23 2 8
+3 0 1  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  25 2 9
+109 10 38  169 15 59  189 17 66  191 17 67  190 17 67  189 17 66
+189 17 66  188 17 66  188 17 66  188 17 66  189 17 66  190 17 67
+191 17 67  190 17 67  171 15 60  98 9 34  10 1 3  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  14 1 5  141 13 49
+191 17 67  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 67  186 17 65  65 6 23  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  23 2 8  166 15 58
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  176 16 62  45 4 16  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  83 8 29
+183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  185 17 65  95 9 33  3 0 1  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
+85 8 30  176 16 62  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+191 17 67  180 16 63  95 9 33  7 1 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+2 0 1  52 5 18  141 13 49  185 17 65  191 17 67  189 17 67
+189 17 66  188 17 66  188 17 66  189 17 66  191 17 67  187 17 66
+146 13 51  56 5 19  4 0 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  14 1 5  68 6 24  131 12 46  166 15 58
+180 16 63  183 17 64  180 16 63  168 15 59  134 12 47  75 7 26
+17 2 6  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  24 2 8
+44 4 15  52 5 18  45 4 16  26 2 9  6 1 2  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
-- 
GitLab


From 7e500c0d0d20d2ec3b455fc1b97569d3063a48ce Mon Sep 17 00:00:00 2001
From: Harm Hanemaaijer <fgenfb@yahoo.com>
Date: Thu, 20 Jun 2013 20:21:39 +0200
Subject: [PATCH 0042/1835] Speed up console framebuffer imageblit function

Especially on platforms with a slower CPU but a relatively high
framebuffer fill bandwidth, like current ARM devices, the existing
console monochrome imageblit function used to draw console text is
suboptimal for common pixel depths such as 16bpp and 32bpp. The existing
code is quite general and can deal with several pixel depths. By creating
special case functions for 16bpp and 32bpp, by far the most common pixel
formats used on modern systems, a significant speed-up is attained
which can be readily felt on ARM-based devices like the Raspberry Pi
and the Allwinner platform, but should help any platform using the
fb layer.

The special case functions allow constant folding, eliminating a number
of instructions including divide operations, and allow the use of an
unrolled loop, eliminating instructions with a variable shift size,
reducing source memory access instructions, and eliminating excessive
branching. These unrolled loops also allow much better code optimization
by the C compiler. The code that selects which optimized variant is used
is also simplified, eliminating integer divide instructions.

The speed-up, measured by timing 'cat file.txt' in the console, varies
between 40% and 70%, when testing on the Raspberry Pi and Allwinner
ARM-based platforms, depending on font size and the pixel depth, with
the greater benefit for 32bpp.

Signed-off-by: Harm Hanemaaijer <fgenfb@yahoo.com>
---
 drivers/video/fbdev/core/cfbimgblt.c | 152 ++++++++++++++++++++++++++-
 1 file changed, 147 insertions(+), 5 deletions(-)

diff --git a/drivers/video/fbdev/core/cfbimgblt.c b/drivers/video/fbdev/core/cfbimgblt.c
index a2bb276a8b246..436494fba15ab 100644
--- a/drivers/video/fbdev/core/cfbimgblt.c
+++ b/drivers/video/fbdev/core/cfbimgblt.c
@@ -28,6 +28,11 @@
  *
  *  Also need to add code to deal with cards endians that are different than
  *  the native cpu endians. I also need to deal with MSB position in the word.
+ *  Modified by Harm Hanemaaijer (fgenfb@yahoo.com) 2013:
+ *  - Provide optimized versions of fast_imageblit for 16 and 32bpp that are
+ *    significantly faster than the previous implementation.
+ *  - Simplify the fast/slow_imageblit selection code, avoiding integer
+ *    divides.
  */
 #include <linux/module.h>
 #include <linux/string.h>
@@ -262,6 +267,133 @@ static inline void fast_imageblit(const struct fb_image *image, struct fb_info *
 	}
 }	
 	
+/*
+ * Optimized fast_imageblit for bpp == 16. ppw = 2, bit_mask = 3 folded
+ * into the code, main loop unrolled.
+ */
+
+static inline void fast_imageblit16(const struct fb_image *image,
+				    struct fb_info *p, u8 __iomem * dst1,
+				    u32 fgcolor, u32 bgcolor)
+{
+	u32 fgx = fgcolor, bgx = bgcolor;
+	u32 spitch = (image->width + 7) / 8;
+	u32 end_mask, eorx;
+	const char *s = image->data, *src;
+	u32 __iomem *dst;
+	const u32 *tab = NULL;
+	int i, j, k;
+
+	tab = fb_be_math(p) ? cfb_tab16_be : cfb_tab16_le;
+
+	fgx <<= 16;
+	bgx <<= 16;
+	fgx |= fgcolor;
+	bgx |= bgcolor;
+
+	eorx = fgx ^ bgx;
+	k = image->width / 2;
+
+	for (i = image->height; i--;) {
+		dst = (u32 __iomem *) dst1;
+		src = s;
+
+		j = k;
+		while (j >= 4) {
+			u8 bits = *src;
+			end_mask = tab[(bits >> 6) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 4) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 2) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[bits & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			src++;
+			j -= 4;
+		}
+		if (j != 0) {
+			u8 bits = *src;
+			end_mask = tab[(bits >> 6) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			if (j >= 2) {
+				end_mask = tab[(bits >> 4) & 3];
+				FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+				if (j == 3) {
+					end_mask = tab[(bits >> 2) & 3];
+					FB_WRITEL((end_mask & eorx) ^ bgx, dst);
+				}
+			}
+		}
+		dst1 += p->fix.line_length;
+		s += spitch;
+	}
+}
+
+/*
+ * Optimized fast_imageblit for bpp == 32. ppw = 1, bit_mask = 1 folded
+ * into the code, main loop unrolled.
+ */
+
+static inline void fast_imageblit32(const struct fb_image *image,
+				    struct fb_info *p, u8 __iomem * dst1,
+				    u32 fgcolor, u32 bgcolor)
+{
+	u32 fgx = fgcolor, bgx = bgcolor;
+	u32 spitch = (image->width + 7) / 8;
+	u32 end_mask, eorx;
+	const char *s = image->data, *src;
+	u32 __iomem *dst;
+	const u32 *tab = NULL;
+	int i, j, k;
+
+	tab = cfb_tab32;
+
+	eorx = fgx ^ bgx;
+	k = image->width;
+
+	for (i = image->height; i--;) {
+		dst = (u32 __iomem *) dst1;
+		src = s;
+
+		j = k;
+		while (j >= 8) {
+			u8 bits = *src;
+			end_mask = tab[(bits >> 7) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 6) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 5) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 4) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 3) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 2) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 1) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[bits & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			src++;
+			j -= 8;
+		}
+		if (j != 0) {
+			u32 bits = (u32) * src;
+			while (j > 1) {
+				end_mask = tab[(bits >> 7) & 1];
+				FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+				bits <<= 1;
+				j--;
+			}
+			end_mask = tab[(bits >> 7) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst);
+		}
+		dst1 += p->fix.line_length;
+		s += spitch;
+	}
+}
+
 void cfb_imageblit(struct fb_info *p, const struct fb_image *image)
 {
 	u32 fgcolor, bgcolor, start_index, bitstart, pitch_index = 0;
@@ -294,11 +426,21 @@ void cfb_imageblit(struct fb_info *p, const struct fb_image *image)
 			bgcolor = image->bg_color;
 		}	
 		
-		if (32 % bpp == 0 && !start_index && !pitch_index && 
-		    ((width & (32/bpp-1)) == 0) &&
-		    bpp >= 8 && bpp <= 32) 			
-			fast_imageblit(image, p, dst1, fgcolor, bgcolor);
-		else 
+		if (!start_index && !pitch_index) {
+			if (bpp == 32)
+				fast_imageblit32(image, p, dst1, fgcolor,
+						 bgcolor);
+			else if (bpp == 16 && (width & 1) == 0)
+				fast_imageblit16(image, p, dst1, fgcolor,
+						 bgcolor);
+			else if (bpp == 8 && (width & 3) == 0)
+				fast_imageblit(image, p, dst1, fgcolor,
+					       bgcolor);
+			else
+				slow_imageblit(image, p, dst1, fgcolor,
+					       bgcolor,
+					       start_index, pitch_index);
+		} else
 			slow_imageblit(image, p, dst1, fgcolor, bgcolor,
 					start_index, pitch_index);
 	} else
-- 
GitLab


From ce1d401c2856cbbaaf21c92709f49e2faee347c6 Mon Sep 17 00:00:00 2001
From: Florian Meier <florian.meier@koalo.de>
Date: Fri, 22 Nov 2013 14:22:53 +0100
Subject: [PATCH 0043/1835] dmaengine: Add support for BCM2708
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for DMA controller of BCM2708 as used in the Raspberry Pi.
Currently it only supports cyclic DMA.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

dmaengine: expand functionality by supporting scatter/gather transfers sdhci-bcm2708 and dma.c: fix for LITE channels

DMA: fix cyclic LITE length overflow bug

dmaengine: bcm2708: Remove chancnt affectations

Mirror bcm2835-dma.c commit 9eba5536a7434c69d8c185d4bd1c70734d92287d:
chancnt is already filled by dma_async_device_register, which uses the channel
list to know how much channels there is.

Since it's already filled, we can safely remove it from the drivers' probe
function.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: overwrite dreq only if it is not set

dreq is set when the DMA channel is fetched from Device Tree.
slave_id is set using dmaengine_slave_config().
Only overwrite dreq with slave_id if it is not set.

dreq/slave_id in the cyclic DMA case is not touched, because I don't
have hardware to test with.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: do device registration in the board file

Don't register the device in the driver. Do it in the board file.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: don't restrict DT support to ARCH_BCM2835

Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
Add Device Tree support to the non ARCH_BCM2835 case.
Use the same driver name regardless of architecture.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270x_DT: add bcm2835-dma entry

Add Device Tree entry for bcm2835-dma.
The entry doesn't contain any resources since they are handled
by the arch/arm/mach-bcm270x/dma.c driver.
In non-DT mode, don't add the device in the board file.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2708-dmaengine: Add debug options

BCM270x: Add memory and irq resources to dmaengine device and DT

Prepare for merging of the legacy DMA API arch driver dma.c
with bcm2708-dmaengine by adding memory and irq resources both
to platform file device and Device Tree node.
Don't use BCM_DMAMAN_DRIVER_NAME so we don't have to include mach/dma.h

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: Merge with arch dma.c driver and disable dma.c

Merge the legacy DMA API driver with bcm2708-dmaengine.
This is done so we can use bcm2708_fb on ARCH_BCM2835 (mailbox
driver is also needed).

Changes to the dma.c code:
- Use BIT() macro.
- Cutdown some comments to one line.
- Add mutex to vc_dmaman and use this, since the dev lock is locked
  during probing of the engine part.
- Add global g_dmaman variable since drvdata is used by the engine part.
- Restructure for readability:
  vc_dmaman_chan_alloc()
  vc_dmaman_chan_free()
  bcm_dma_chan_free()
- Restructure bcm_dma_chan_alloc() to simplify error handling.
- Use device irq resources instead of hardcoded bcm_dma_irqs table.
- Remove dev_dmaman_register() and code it directly.
- Remove dev_dmaman_deregister() and code it directly.
- Simplify bcm_dmaman_probe() using devm_* functions.
- Get dmachans from DT if available.
- Keep 'dma.dmachans' module argument name for backwards compatibility.

Make it available on ARCH_BCM2835 as well.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: set residue_granularity field

bcm2708-dmaengine supports residue reporting at burst level
but didn't report this via the residue_granularity field.

Without this field set properly we get playback issues with I2S cards.

dmaengine: bcm2708-dmaengine: Fix memory leak when stopping a running transfer

bcm2708-dmaengine: Use more DMA channels (but not 12)

1) Only the bcm2708_fb drivers uses the legacy DMA API, and
it requires a BULK-capable channel, so all other types
(FAST, NORMAL and LITE) can be made available to the regular
DMA API.

2) DMA channels 11-14 share an interrupt. The driver can't
handle this, so don't use channels 12-14 (12 was used, probably
because it appears to have an interrupt, but in reality that
interrupt is for activity on ANY channel). This may explain
a lockup encountered when running out of DMA channels.

The combined effect of this patch is to leave 7 DMA channels
available + channel 0 for bcm2708_fb via the legacy API.

See: https://github.com/raspberrypi/linux/issues/1110
     https://github.com/raspberrypi/linux/issues/1108

dmaengine: bcm2708: Make legacy API available for bcm2835-dma

bcm2708_fb uses the legacy DMA API, so in order to start using
bcm2835-dma, bcm2835-dma has to support the legacy API. Make this
possible by exporting bcm_dmaman_probe() and bcm_dmaman_remove().

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: Change DT compatible string

Both bcm2835-dma and bcm2708-dmaengine have the same compatible string.
So change compatible to "brcm,bcm2708-dma".

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: Remove driver but keep legacy API

Dropping non-DT support means we don't need this driver,
but we still need the legacy DMA API.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2708-dmaengine - Fix arm64 portability/build issues

dma-bcm2708: Fix module compilation of CONFIG_DMA_BCM2708

bcm2708-dmaengine.c defines functions like bcm_dma_start which are
defined as well in dma-bcm2708.h as inline versions when
CONFIG_DMA_BCM2708 is not defined. This works fine when
CONFIG_DMA_BCM2708 is built in, but when it is selected as module build
fails with redefinition errors because in the build system when
CONFIG_DMA_BCM2708 is selected as module, the macro becomes
CONFIG_DMA_BCM2708_MODULE.

This patch makes the header use CONFIG_DMA_BCM2708_MODULE too when
available.

Fixes https://github.com/raspberrypi/linux/issues/2056

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
---
 drivers/dma/Kconfig                       |   6 +-
 drivers/dma/Makefile                      |   1 +
 drivers/dma/bcm2708-dmaengine.c           | 281 ++++++++++++++++++++++
 include/linux/platform_data/dma-bcm2708.h | 143 +++++++++++
 4 files changed, 430 insertions(+), 1 deletion(-)
 create mode 100644 drivers/dma/bcm2708-dmaengine.c
 create mode 100644 include/linux/platform_data/dma-bcm2708.h

diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index a4697f1d6ee5c..288aca490da03 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -131,7 +131,7 @@ config COH901318
 
 config DMA_BCM2835
 	tristate "BCM2835 DMA engine support"
-	depends on ARCH_BCM2835 || ARCH_BCM2708 || ARCH_BCM2709
+	depends on ARCH_BCM2835
 	select DMA_ENGINE
 	select DMA_VIRTUAL_CHANNELS
 
@@ -576,6 +576,10 @@ config TIMB_DMA
 	help
 	  Enable support for the Timberdale FPGA DMA engine.
 
+config DMA_BCM2708
+	tristate "BCM2708 DMA legacy API support"
+	depends on DMA_BCM2835
+
 config XGENE_DMA
 	tristate "APM X-Gene DMA support"
 	depends on ARCH_XGENE || COMPILE_TEST
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index c91702d88b953..4825021aea883 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_AT_XDMAC) += at_xdmac.o
 obj-$(CONFIG_AXI_DMAC) += dma-axi-dmac.o
 obj-$(CONFIG_BCM_SBA_RAID) += bcm-sba-raid.o
 obj-$(CONFIG_COH901318) += coh901318.o coh901318_lli.o
+obj-$(CONFIG_DMA_BCM2708) += bcm2708-dmaengine.o
 obj-$(CONFIG_DMA_BCM2835) += bcm2835-dma.o
 obj-$(CONFIG_DMA_JZ4740) += dma-jz4740.o
 obj-$(CONFIG_DMA_JZ4780) += dma-jz4780.o
diff --git a/drivers/dma/bcm2708-dmaengine.c b/drivers/dma/bcm2708-dmaengine.c
new file mode 100644
index 0000000000000..0f4a26983e401
--- /dev/null
+++ b/drivers/dma/bcm2708-dmaengine.c
@@ -0,0 +1,281 @@
+/*
+ * BCM2708 legacy DMA API
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/platform_data/dma-bcm2708.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/spinlock.h>
+
+#include "virt-dma.h"
+
+#define CACHE_LINE_MASK 31
+#define DEFAULT_DMACHAN_BITMAP 0x10  /* channel 4 only */
+
+/* valid only for channels 0 - 14, 15 has its own base address */
+#define BCM2708_DMA_CHAN(n)	((n) << 8) /* base address */
+#define BCM2708_DMA_CHANIO(dma_base, n) \
+	((void __iomem *)((char *)(dma_base) + BCM2708_DMA_CHAN(n)))
+
+struct vc_dmaman {
+	void __iomem *dma_base;
+	u32 chan_available; /* bitmap of available channels */
+	u32 has_feature[BCM_DMA_FEATURE_COUNT]; /* bitmap of feature presence */
+	struct mutex lock;
+};
+
+static struct device *dmaman_dev;	/* we assume there's only one! */
+static struct vc_dmaman *g_dmaman;	/* DMA manager */
+
+/* DMA Auxiliary Functions */
+
+/* A DMA buffer on an arbitrary boundary may separate a cache line into a
+   section inside the DMA buffer and another section outside it.
+   Even if we flush DMA buffers from the cache there is always the chance that
+   during a DMA someone will access the part of a cache line that is outside
+   the DMA buffer - which will then bring in unwelcome data.
+   Without being able to dictate our own buffer pools we must insist that
+   DMA buffers consist of a whole number of cache lines.
+*/
+extern int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len)
+{
+	int i;
+
+	for (i = 0; i < sg_len; i++) {
+		if (sg_ptr[i].offset & CACHE_LINE_MASK ||
+		    sg_ptr[i].length & CACHE_LINE_MASK)
+			return 0;
+	}
+
+	return 1;
+}
+EXPORT_SYMBOL_GPL(bcm_sg_suitable_for_dma);
+
+extern void bcm_dma_start(void __iomem *dma_chan_base,
+			  dma_addr_t control_block)
+{
+	dsb(sy);	/* ARM data synchronization (push) operation */
+
+	writel(control_block, dma_chan_base + BCM2708_DMA_ADDR);
+	writel(BCM2708_DMA_ACTIVE, dma_chan_base + BCM2708_DMA_CS);
+}
+EXPORT_SYMBOL_GPL(bcm_dma_start);
+
+extern void bcm_dma_wait_idle(void __iomem *dma_chan_base)
+{
+	dsb(sy);
+
+	/* ugly busy wait only option for now */
+	while (readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE)
+		cpu_relax();
+}
+EXPORT_SYMBOL_GPL(bcm_dma_wait_idle);
+
+extern bool bcm_dma_is_busy(void __iomem *dma_chan_base)
+{
+	dsb(sy);
+
+	return readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_is_busy);
+
+/* Complete an ongoing DMA (assuming its results are to be ignored)
+   Does nothing if there is no DMA in progress.
+   This routine waits for the current AXI transfer to complete before
+   terminating the current DMA. If the current transfer is hung on a DREQ used
+   by an uncooperative peripheral the AXI transfer may never complete.	In this
+   case the routine times out and return a non-zero error code.
+   Use of this routine doesn't guarantee that the ongoing or aborted DMA
+   does not produce an interrupt.
+*/
+extern int bcm_dma_abort(void __iomem *dma_chan_base)
+{
+	unsigned long int cs;
+	int rc = 0;
+
+	cs = readl(dma_chan_base + BCM2708_DMA_CS);
+
+	if (BCM2708_DMA_ACTIVE & cs) {
+		long int timeout = 10000;
+
+		/* write 0 to the active bit - pause the DMA */
+		writel(0, dma_chan_base + BCM2708_DMA_CS);
+
+		/* wait for any current AXI transfer to complete */
+		while (0 != (cs & BCM2708_DMA_ISPAUSED) && --timeout >= 0)
+			cs = readl(dma_chan_base + BCM2708_DMA_CS);
+
+		if (0 != (cs & BCM2708_DMA_ISPAUSED)) {
+			/* we'll un-pause when we set of our next DMA */
+			rc = -ETIMEDOUT;
+
+		} else if (BCM2708_DMA_ACTIVE & cs) {
+			/* terminate the control block chain */
+			writel(0, dma_chan_base + BCM2708_DMA_NEXTCB);
+
+			/* abort the whole DMA */
+			writel(BCM2708_DMA_ABORT | BCM2708_DMA_ACTIVE,
+			       dma_chan_base + BCM2708_DMA_CS);
+		}
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_abort);
+
+ /* DMA Manager Device Methods */
+
+static void vc_dmaman_init(struct vc_dmaman *dmaman, void __iomem *dma_base,
+			   u32 chans_available)
+{
+	dmaman->dma_base = dma_base;
+	dmaman->chan_available = chans_available;
+	dmaman->has_feature[BCM_DMA_FEATURE_FAST_ORD] = 0x0c;  /* 2 & 3 */
+	dmaman->has_feature[BCM_DMA_FEATURE_BULK_ORD] = 0x01;  /* 0 */
+	dmaman->has_feature[BCM_DMA_FEATURE_NORMAL_ORD] = 0xfe;  /* 1 to 7 */
+	dmaman->has_feature[BCM_DMA_FEATURE_LITE_ORD] = 0x7f00;  /* 8 to 14 */
+}
+
+static int vc_dmaman_chan_alloc(struct vc_dmaman *dmaman,
+				unsigned required_feature_set)
+{
+	u32 chans;
+	int chan = 0;
+	int feature;
+
+	chans = dmaman->chan_available;
+	for (feature = 0; feature < BCM_DMA_FEATURE_COUNT; feature++)
+		/* select the subset of available channels with the desired
+		   features */
+		if (required_feature_set & (1 << feature))
+			chans &= dmaman->has_feature[feature];
+
+	if (!chans)
+		return -ENOENT;
+
+	/* return the ordinal of the first channel in the bitmap */
+	while (chans != 0 && (chans & 1) == 0) {
+		chans >>= 1;
+		chan++;
+	}
+	/* claim the channel */
+	dmaman->chan_available &= ~(1 << chan);
+
+	return chan;
+}
+
+static int vc_dmaman_chan_free(struct vc_dmaman *dmaman, int chan)
+{
+	if (chan < 0)
+		return -EINVAL;
+
+	if ((1 << chan) & dmaman->chan_available)
+		return -EIDRM;
+
+	dmaman->chan_available |= (1 << chan);
+
+	return 0;
+}
+
+/* DMA Manager Monitor */
+
+extern int bcm_dma_chan_alloc(unsigned required_feature_set,
+			      void __iomem **out_dma_base, int *out_dma_irq)
+{
+	struct vc_dmaman *dmaman = g_dmaman;
+	struct platform_device *pdev = to_platform_device(dmaman_dev);
+	struct resource *r;
+	int chan;
+
+	if (!dmaman_dev)
+		return -ENODEV;
+
+	mutex_lock(&dmaman->lock);
+	chan = vc_dmaman_chan_alloc(dmaman, required_feature_set);
+	if (chan < 0)
+		goto out;
+
+	r = platform_get_resource(pdev, IORESOURCE_IRQ, (unsigned int)chan);
+	if (!r) {
+		dev_err(dmaman_dev, "failed to get irq for DMA channel %d\n",
+			chan);
+		vc_dmaman_chan_free(dmaman, chan);
+		chan = -ENOENT;
+		goto out;
+	}
+
+	*out_dma_base = BCM2708_DMA_CHANIO(dmaman->dma_base, chan);
+	*out_dma_irq = r->start;
+	dev_dbg(dmaman_dev,
+		"Legacy API allocated channel=%d, base=%p, irq=%i\n",
+		chan, *out_dma_base, *out_dma_irq);
+
+out:
+	mutex_unlock(&dmaman->lock);
+
+	return chan;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_chan_alloc);
+
+extern int bcm_dma_chan_free(int channel)
+{
+	struct vc_dmaman *dmaman = g_dmaman;
+	int rc;
+
+	if (!dmaman_dev)
+		return -ENODEV;
+
+	mutex_lock(&dmaman->lock);
+	rc = vc_dmaman_chan_free(dmaman, channel);
+	mutex_unlock(&dmaman->lock);
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_chan_free);
+
+int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
+		     u32 chans_available)
+{
+	struct device *dev = &pdev->dev;
+	struct vc_dmaman *dmaman;
+
+	dmaman = devm_kzalloc(dev, sizeof(*dmaman), GFP_KERNEL);
+	if (!dmaman)
+		return -ENOMEM;
+
+	mutex_init(&dmaman->lock);
+	vc_dmaman_init(dmaman, base, chans_available);
+	g_dmaman = dmaman;
+	dmaman_dev = dev;
+
+	dev_info(dev, "DMA legacy API manager at %p, dmachans=0x%x\n",
+		 base, chans_available);
+
+	return 0;
+}
+EXPORT_SYMBOL(bcm_dmaman_probe);
+
+int bcm_dmaman_remove(struct platform_device *pdev)
+{
+	dmaman_dev = NULL;
+
+	return 0;
+}
+EXPORT_SYMBOL(bcm_dmaman_remove);
+
+MODULE_LICENSE("GPL");
diff --git a/include/linux/platform_data/dma-bcm2708.h b/include/linux/platform_data/dma-bcm2708.h
new file mode 100644
index 0000000000000..6ca874d332a8b
--- /dev/null
+++ b/include/linux/platform_data/dma-bcm2708.h
@@ -0,0 +1,143 @@
+/*
+ *  Copyright (C) 2010 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _PLAT_BCM2708_DMA_H
+#define _PLAT_BCM2708_DMA_H
+
+/* DMA CS Control and Status bits */
+#define BCM2708_DMA_ACTIVE	BIT(0)
+#define BCM2708_DMA_INT		BIT(2)
+#define BCM2708_DMA_ISPAUSED	BIT(4)  /* Pause requested or not active */
+#define BCM2708_DMA_ISHELD	BIT(5)  /* Is held by DREQ flow control */
+#define BCM2708_DMA_ERR		BIT(8)
+#define BCM2708_DMA_ABORT	BIT(30) /* stop current CB, go to next, WO */
+#define BCM2708_DMA_RESET	BIT(31) /* WO, self clearing */
+
+/* DMA control block "info" field bits */
+#define BCM2708_DMA_INT_EN	BIT(0)
+#define BCM2708_DMA_TDMODE	BIT(1)
+#define BCM2708_DMA_WAIT_RESP	BIT(3)
+#define BCM2708_DMA_D_INC	BIT(4)
+#define BCM2708_DMA_D_WIDTH	BIT(5)
+#define BCM2708_DMA_D_DREQ	BIT(6)
+#define BCM2708_DMA_S_INC	BIT(8)
+#define BCM2708_DMA_S_WIDTH	BIT(9)
+#define BCM2708_DMA_S_DREQ	BIT(10)
+
+#define	BCM2708_DMA_BURST(x)	(((x) & 0xf) << 12)
+#define	BCM2708_DMA_PER_MAP(x)	((x) << 16)
+#define	BCM2708_DMA_WAITS(x)	(((x) & 0x1f) << 21)
+
+#define BCM2708_DMA_DREQ_EMMC	11
+#define BCM2708_DMA_DREQ_SDHOST	13
+
+#define BCM2708_DMA_CS		0x00 /* Control and Status */
+#define BCM2708_DMA_ADDR	0x04
+/* the current control block appears in the following registers - read only */
+#define BCM2708_DMA_INFO	0x08
+#define BCM2708_DMA_SOURCE_AD	0x0c
+#define BCM2708_DMA_DEST_AD	0x10
+#define BCM2708_DMA_NEXTCB	0x1C
+#define BCM2708_DMA_DEBUG	0x20
+
+#define BCM2708_DMA4_CS		(BCM2708_DMA_CHAN(4) + BCM2708_DMA_CS)
+#define BCM2708_DMA4_ADDR	(BCM2708_DMA_CHAN(4) + BCM2708_DMA_ADDR)
+
+#define BCM2708_DMA_TDMODE_LEN(w, h) ((h) << 16 | (w))
+
+/* When listing features we can ask for when allocating DMA channels give
+   those with higher priority smaller ordinal numbers */
+#define BCM_DMA_FEATURE_FAST_ORD	0
+#define BCM_DMA_FEATURE_BULK_ORD	1
+#define BCM_DMA_FEATURE_NORMAL_ORD	2
+#define BCM_DMA_FEATURE_LITE_ORD	3
+#define BCM_DMA_FEATURE_FAST		BIT(BCM_DMA_FEATURE_FAST_ORD)
+#define BCM_DMA_FEATURE_BULK		BIT(BCM_DMA_FEATURE_BULK_ORD)
+#define BCM_DMA_FEATURE_NORMAL		BIT(BCM_DMA_FEATURE_NORMAL_ORD)
+#define BCM_DMA_FEATURE_LITE		BIT(BCM_DMA_FEATURE_LITE_ORD)
+#define BCM_DMA_FEATURE_COUNT		4
+
+struct bcm2708_dma_cb {
+	u32 info;
+	u32 src;
+	u32 dst;
+	u32 length;
+	u32 stride;
+	u32 next;
+	u32 pad[2];
+};
+
+struct scatterlist;
+struct platform_device;
+
+#if defined(CONFIG_DMA_BCM2708) || defined(CONFIG_DMA_BCM2708_MODULE)
+
+int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len);
+void bcm_dma_start(void __iomem *dma_chan_base, dma_addr_t control_block);
+void bcm_dma_wait_idle(void __iomem *dma_chan_base);
+bool bcm_dma_is_busy(void __iomem *dma_chan_base);
+int bcm_dma_abort(void __iomem *dma_chan_base);
+
+/* return channel no or -ve error */
+int bcm_dma_chan_alloc(unsigned preferred_feature_set,
+		       void __iomem **out_dma_base, int *out_dma_irq);
+int bcm_dma_chan_free(int channel);
+
+int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
+		     u32 chans_available);
+int bcm_dmaman_remove(struct platform_device *pdev);
+
+#else /* CONFIG_DMA_BCM2708 */
+
+static inline int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr,
+					  int sg_len)
+{
+	return 0;
+}
+
+static inline void bcm_dma_start(void __iomem *dma_chan_base,
+				 dma_addr_t control_block) { }
+
+static inline void bcm_dma_wait_idle(void __iomem *dma_chan_base) { }
+
+static inline bool bcm_dma_is_busy(void __iomem *dma_chan_base)
+{
+	return false;
+}
+
+static inline int bcm_dma_abort(void __iomem *dma_chan_base)
+{
+	return -EINVAL;
+}
+
+static inline int bcm_dma_chan_alloc(unsigned preferred_feature_set,
+				     void __iomem **out_dma_base,
+				     int *out_dma_irq)
+{
+	return -EINVAL;
+}
+
+static inline int bcm_dma_chan_free(int channel)
+{
+	return -EINVAL;
+}
+
+static inline int bcm_dmaman_probe(struct platform_device *pdev,
+				   void __iomem *base, u32 chans_available)
+{
+	return 0;
+}
+
+static inline int bcm_dmaman_remove(struct platform_device *pdev)
+{
+	return 0;
+}
+
+#endif /* CONFIG_DMA_BCM2708 || CONFIG_DMA_BCM2708_MODULE */
+
+#endif /* _PLAT_BCM2708_DMA_H */
-- 
GitLab


From f4e77830825a268e4f3b2265126449fcd8786704 Mon Sep 17 00:00:00 2001
From: gellert <gellert@raspberrypi.org>
Date: Fri, 15 Aug 2014 16:35:06 +0100
Subject: [PATCH 0044/1835] MMC: added alternative MMC driver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mmc: Disable CMD23 transfers on all cards

Pending wire-level investigation of these types of transfers
and associated errors on bcm2835-mmc, disable for now. Fallback of
CMD18/CMD25 transfers will be used automatically by the MMC layer.

Reported/Tested-by: Gellert Weisz <gellert@raspberrypi.org>

mmc: bcm2835-mmc: enable DT support for all architectures

Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
Enable Device Tree support for all architectures.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

mmc: bcm2835-mmc: fix probe error handling

Probe error handling is broken in several places.
Simplify error handling by using device managed functions.
Replace pr_{err,info} with dev_{err,info}.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835-mmc: Add locks when accessing sdhost registers

bcm2835-mmc: Add range of debug options for slowing things down

bcm2835-mmc: Add option to disable some delays

bcm2835-mmc: Add option to disable MMC_QUIRK_BLK_NO_CMD23

bcm2835-mmc: Default to disabling MMC_QUIRK_BLK_NO_CMD23

bcm2835-mmc: Adding overclocking option

Allow a different clock speed to be substitued for a requested 50MHz.
This option is exposed using the "overclock_50" DT parameter.
Note that the mmc interface is restricted to EVEN integer divisions of
250MHz, and the highest sensible option is 63 (250/4 = 62.5), the
next being 125 (250/2) which is much too high.

Use at your own risk.

bcm2835-mmc: Round up the overclock, so 62 works for 62.5Mhz

Also only warn once for each overclock setting.

mmc: bcm2835-mmc: Make available on ARCH_BCM2835

Make the bcm2835-mmc driver available for use on ARCH_BCM2835.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270x_DT: add bcm2835-mmc entry

Add Device Tree entry for bcm2835-mmc.
In non-DT mode, don't add the device in the board file.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835-mmc: Don't overwrite MMC capabilities from DT

bcm2835-mmc: Don't override bus width capabilities from devicetree

Take out the force setting of the MMC_CAP_4_BIT_DATA host capability
so that the result read from devicetree via mmc_of_parse() is
preserved.

bcm2835-mmc: Only claim one DMA channel

With both MMC controllers enabled there are few DMA channels left. The
bcm2835-mmc driver only uses DMA in one direction at a time, so it
doesn't need to claim two channels.

See: https://github.com/raspberrypi/linux/issues/1327

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-mmc: New timer API

mmc: bcm2835-mmc: Support underclocking

Support underclocking of the SD bus using the max-frequency DT property
(which currently has no DT parameter). The sd_overclock parameter
already provides another way to achieve the same thing which should be
equivalent in end result, but it is a bug not to support max-frequency
as well.

See: https://github.com/raspberrypi/linux/issues/2350

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/core/block.c       |   28 +-
 drivers/mmc/core/core.c        |    3 +-
 drivers/mmc/core/host.c        |   17 +-
 drivers/mmc/core/quirks.h      |    8 +
 drivers/mmc/host/Kconfig       |   29 +
 drivers/mmc/host/Makefile      |    1 +
 drivers/mmc/host/bcm2835-mmc.c | 1582 ++++++++++++++++++++++++++++++++
 include/linux/mmc/card.h       |    2 +
 8 files changed, 1665 insertions(+), 5 deletions(-)
 create mode 100644 drivers/mmc/host/bcm2835-mmc.c

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index eee004fb3c3e3..df9320cb09158 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -167,6 +167,13 @@ static DEFINE_MUTEX(open_lock);
 module_param(perdev_minors, int, 0444);
 MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
 
+/*
+ * Allow quirks to be overridden for the current card
+ */
+static char *card_quirks;
+module_param(card_quirks, charp, 0644);
+MODULE_PARM_DESC(card_quirks, "Force the use of the indicated quirks (a bitfield)");
+
 static inline int mmc_blk_part_switch(struct mmc_card *card,
 				      unsigned int part_type);
 
@@ -2919,6 +2926,7 @@ static int mmc_blk_probe(struct mmc_card *card)
 {
 	struct mmc_blk_data *md, *part_md;
 	char cap_str[10];
+	char quirk_str[24];
 
 	/*
 	 * Check that the card supports the command class(es) we need.
@@ -2926,7 +2934,16 @@ static int mmc_blk_probe(struct mmc_card *card)
 	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
 		return -ENODEV;
 
-	mmc_fixup_device(card, mmc_blk_fixups);
+	if (card_quirks) {
+		unsigned long quirks;
+		if (kstrtoul(card_quirks, 0, &quirks) == 0)
+			card->quirks = (unsigned int)quirks;
+		else
+			pr_err("mmc_block: Invalid card_quirks parameter '%s'\n",
+			       card_quirks);
+	}
+	else
+		mmc_fixup_device(card, mmc_blk_fixups);
 
 	card->complete_wq = alloc_workqueue("mmc_complete",
 					WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
@@ -2941,9 +2958,14 @@ static int mmc_blk_probe(struct mmc_card *card)
 
 	string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2,
 			cap_str, sizeof(cap_str));
-	pr_info("%s: %s %s %s %s\n",
+	if (card->quirks)
+		snprintf(quirk_str, sizeof(quirk_str),
+			 " (quirks 0x%08x)", card->quirks);
+	else
+		quirk_str[0] = '\0';
+	pr_info("%s: %s %s %s%s%s\n",
 		md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
-		cap_str, md->read_only ? "(ro)" : "");
+		cap_str, md->read_only ? " (ro)" : "", quirk_str);
 
 	if (mmc_blk_alloc_parts(card, md))
 		goto out;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 6600b3466dfbc..7fec8f1787034 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2229,7 +2229,8 @@ EXPORT_SYMBOL(mmc_erase);
 int mmc_can_erase(struct mmc_card *card)
 {
 	if ((card->host->caps & MMC_CAP_ERASE) &&
-	    (card->csd.cmdclass & CCC_ERASE) && card->erase_size)
+	    (card->csd.cmdclass & CCC_ERASE) && card->erase_size &&
+	    !(card->quirks & MMC_QUIRK_ERASE_BROKEN))
 		return 1;
 	return 0;
 }
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index f57f5de542064..f333d817f98d8 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -359,15 +359,30 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 {
 	int err;
 	struct mmc_host *host;
+	int id;
 
 	host = kzalloc(sizeof(struct mmc_host) + extra, GFP_KERNEL);
 	if (!host)
 		return NULL;
 
+	/* If OF aliases exist, start dynamic assignment after highest */
+	id = of_alias_get_highest_id("mmc");
+	id = (id < 0) ? 0 : id + 1;
+
+	/* If this devices has OF node, maybe it has an alias */
+	if (dev->of_node) {
+		int of_id = of_alias_get_id(dev->of_node, "mmc");
+
+		if (of_id < 0)
+			dev_warn(dev, "/aliases ID not available\n");
+		else
+			id = of_id;
+	}
+
 	/* scanning will be enabled when we're ready */
 	host->rescan_disable = 1;
 
-	err = ida_simple_get(&mmc_host_ida, 0, 0, GFP_KERNEL);
+	err = ida_simple_get(&mmc_host_ida, id, 0, GFP_KERNEL);
 	if (err < 0) {
 		kfree(host);
 		return NULL;
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index dd2f73af8f2c0..b11a56e76a4fd 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -99,6 +99,14 @@ static const struct mmc_fixup mmc_blk_fixups[] = {
 	MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc,
 		  MMC_QUIRK_TRIM_BROKEN),
 
+	/*
+	 *  On some Kingston SD cards, multiple erases of less than 64
+	 *  sectors can cause corruption.
+	 */
+	MMC_FIXUP("SD16G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+
 	END_FIXUP
 };
 
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 694d0828215d2..0f0c4b160b156 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -4,6 +4,35 @@
 
 comment "MMC/SD/SDIO Host Controller Drivers"
 
+config MMC_BCM2835_MMC
+	tristate "MMC support on BCM2835"
+	depends on MACH_BCM2708 || MACH_BCM2709 || ARCH_BCM2835
+	help
+	  This selects the MMC Interface on BCM2835.
+
+	  If you have a controller with this interface, say Y or M here.
+
+	  If unsure, say N.
+
+config MMC_BCM2835_DMA
+	bool "DMA support on BCM2835 Arasan controller"
+	depends on MMC_BCM2835_MMC
+	help
+	  Enable DMA support on the Arasan SDHCI controller in Broadcom 2708
+	  based chips.
+
+	  If unsure, say N.
+
+config MMC_BCM2835_PIO_DMA_BARRIER
+	int "Block count limit for PIO transfers"
+	depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA
+	range 0 256
+	default 2
+	help
+	  The inclusive limit in bytes under which PIO will be used instead of DMA
+
+	  If unsure, say 2 here.
+
 config MMC_DEBUG
 	bool "MMC host drivers debugging"
 	depends on MMC != n
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index ce8398e6f2c0e..b402128375b6a 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_MMC_SDHCI_S3C)	+= sdhci-s3c.o
 obj-$(CONFIG_MMC_SDHCI_SIRF)   	+= sdhci-sirf.o
 obj-$(CONFIG_MMC_SDHCI_F_SDH30)	+= sdhci_f_sdh30.o
 obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
+obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
 obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
 obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
 obj-$(CONFIG_MMC_MTK)		+= mtk-sd.o
diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
new file mode 100644
index 0000000000000..905075c94232c
--- /dev/null
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -0,0 +1,1582 @@
+/*
+ * BCM2835 MMC host driver.
+ *
+ * Author:      Gellert Weisz <gellert@raspberrypi.org>
+ *              Copyright 2014
+ *
+ * Based on
+ *  sdhci-bcm2708.c by Broadcom
+ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
+ *  sdhci.c and sdhci-pci.c by Pierre Ossman
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/io.h>
+#include <linux/mmc/mmc.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sd.h>
+#include <linux/scatterlist.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/blkdev.h>
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_dma.h>
+
+#include "sdhci.h"
+
+
+#define DRIVER_NAME "mmc-bcm2835"
+
+#define DBG(f, x...) \
+pr_debug(DRIVER_NAME " [%s()]: " f, __func__, ## x)
+
+#ifndef CONFIG_MMC_BCM2835_DMA
+ #define FORCE_PIO
+#endif
+
+
+/* the inclusive limit in bytes under which PIO will be used instead of DMA */
+#ifdef CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
+#define PIO_DMA_BARRIER CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
+#else
+#define PIO_DMA_BARRIER 00
+#endif
+
+#define MIN_FREQ 400000
+#define TIMEOUT_VAL 0xE
+#define BCM2835_SDHCI_WRITE_DELAY(f)	(((2 * 1000000) / f) + 1)
+
+
+unsigned mmc_debug;
+unsigned mmc_debug2;
+
+struct bcm2835_host {
+	spinlock_t				lock;
+
+	void __iomem			*ioaddr;
+	u32						bus_addr;
+
+	struct mmc_host			*mmc;
+
+	u32						timeout;
+
+	int						clock;	/* Current clock speed */
+	u8						pwr;	/* Current voltage */
+
+	unsigned int			max_clk;		/* Max possible freq */
+	unsigned int			timeout_clk;	/* Timeout freq (KHz) */
+	unsigned int			clk_mul;		/* Clock Muliplier value */
+
+	struct tasklet_struct	finish_tasklet;		/* Tasklet structures */
+
+	struct timer_list		timer;			/* Timer for timeouts */
+
+	struct sg_mapping_iter	sg_miter;		/* SG state for PIO */
+	unsigned int			blocks;			/* remaining PIO blocks */
+
+	int						irq;			/* Device IRQ */
+
+
+	u32						ier;			/* cached registers */
+
+	struct mmc_request		*mrq;			/* Current request */
+	struct mmc_command		*cmd;			/* Current command */
+	struct mmc_data			*data;			/* Current data request */
+	unsigned int			data_early:1;		/* Data finished before cmd */
+
+	wait_queue_head_t		buf_ready_int;		/* Waitqueue for Buffer Read Ready interrupt */
+
+	u32						thread_isr;
+
+	u32						shadow;
+
+	/*DMA part*/
+	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
+	struct dma_slave_config		dma_cfg_rx;
+	struct dma_slave_config		dma_cfg_tx;
+	struct dma_async_tx_descriptor	*tx_desc;	/* descriptor */
+
+	bool					have_dma;
+	bool					use_dma;
+	bool					wait_for_dma;
+	/*end of DMA part*/
+
+	int						max_delay;	/* maximum length of time spent waiting */
+
+	int						flags;				/* Host attributes */
+#define SDHCI_REQ_USE_DMA	(1<<2)	/* Use DMA for this req. */
+#define SDHCI_DEVICE_DEAD	(1<<3)	/* Device unresponsive */
+#define SDHCI_AUTO_CMD12	(1<<6)	/* Auto CMD12 support */
+#define SDHCI_AUTO_CMD23	(1<<7)	/* Auto CMD23 support */
+#define SDHCI_SDIO_IRQ_ENABLED	(1<<9)	/* SDIO irq enabled */
+
+	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
+	u32				max_overclock;	/* Highest reported */
+};
+
+
+static inline void bcm2835_mmc_writel(struct bcm2835_host *host, u32 val, int reg, int from)
+{
+	unsigned delay;
+	lockdep_assert_held_once(&host->lock);
+	writel(val, host->ioaddr + reg);
+	udelay(BCM2835_SDHCI_WRITE_DELAY(max(host->clock, MIN_FREQ)));
+
+	delay = ((mmc_debug >> 16) & 0xf) << ((mmc_debug >> 20) & 0xf);
+	if (delay && !((1<<from) & mmc_debug2))
+		udelay(delay);
+}
+
+static inline void mmc_raw_writel(struct bcm2835_host *host, u32 val, int reg)
+{
+	unsigned delay;
+	lockdep_assert_held_once(&host->lock);
+	writel(val, host->ioaddr + reg);
+
+	delay = ((mmc_debug >> 24) & 0xf) << ((mmc_debug >> 28) & 0xf);
+	if (delay)
+		udelay(delay);
+}
+
+static inline u32 bcm2835_mmc_readl(struct bcm2835_host *host, int reg)
+{
+	lockdep_assert_held_once(&host->lock);
+	return readl(host->ioaddr + reg);
+}
+
+static inline void bcm2835_mmc_writew(struct bcm2835_host *host, u16 val, int reg)
+{
+	u32 oldval = (reg == SDHCI_COMMAND) ? host->shadow :
+		bcm2835_mmc_readl(host, reg & ~3);
+	u32 word_num = (reg >> 1) & 1;
+	u32 word_shift = word_num * 16;
+	u32 mask = 0xffff << word_shift;
+	u32 newval = (oldval & ~mask) | (val << word_shift);
+
+	if (reg == SDHCI_TRANSFER_MODE)
+		host->shadow = newval;
+	else
+		bcm2835_mmc_writel(host, newval, reg & ~3, 0);
+
+}
+
+static inline void bcm2835_mmc_writeb(struct bcm2835_host *host, u8 val, int reg)
+{
+	u32 oldval = bcm2835_mmc_readl(host, reg & ~3);
+	u32 byte_num = reg & 3;
+	u32 byte_shift = byte_num * 8;
+	u32 mask = 0xff << byte_shift;
+	u32 newval = (oldval & ~mask) | (val << byte_shift);
+
+	bcm2835_mmc_writel(host, newval, reg & ~3, 1);
+}
+
+
+static inline u16 bcm2835_mmc_readw(struct bcm2835_host *host, int reg)
+{
+	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
+	u32 word_num = (reg >> 1) & 1;
+	u32 word_shift = word_num * 16;
+	u32 word = (val >> word_shift) & 0xffff;
+
+	return word;
+}
+
+static inline u8 bcm2835_mmc_readb(struct bcm2835_host *host, int reg)
+{
+	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
+	u32 byte_num = reg & 3;
+	u32 byte_shift = byte_num * 8;
+	u32 byte = (val >> byte_shift) & 0xff;
+
+	return byte;
+}
+
+static void bcm2835_mmc_unsignal_irqs(struct bcm2835_host *host, u32 clear)
+{
+	u32 ier;
+
+	ier = bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE);
+	ier &= ~clear;
+	/* change which requests generate IRQs - makes no difference to
+	   the content of SDHCI_INT_STATUS, or the need to acknowledge IRQs */
+	bcm2835_mmc_writel(host, ier, SDHCI_SIGNAL_ENABLE, 2);
+}
+
+
+static void bcm2835_mmc_dumpregs(struct bcm2835_host *host)
+{
+	pr_debug(DRIVER_NAME ": =========== REGISTER DUMP (%s)===========\n",
+		mmc_hostname(host->mmc));
+
+	pr_debug(DRIVER_NAME ": Sys addr: 0x%08x | Version:  0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_DMA_ADDRESS),
+		bcm2835_mmc_readw(host, SDHCI_HOST_VERSION));
+	pr_debug(DRIVER_NAME ": Blk size: 0x%08x | Blk cnt:  0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_BLOCK_SIZE),
+		bcm2835_mmc_readw(host, SDHCI_BLOCK_COUNT));
+	pr_debug(DRIVER_NAME ": Argument: 0x%08x | Trn mode: 0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_ARGUMENT),
+		bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE));
+	pr_debug(DRIVER_NAME ": Present:  0x%08x | Host ctl: 0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE),
+		bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL));
+	pr_debug(DRIVER_NAME ": Power:    0x%08x | Blk gap:  0x%08x\n",
+		bcm2835_mmc_readb(host, SDHCI_POWER_CONTROL),
+		bcm2835_mmc_readb(host, SDHCI_BLOCK_GAP_CONTROL));
+	pr_debug(DRIVER_NAME ": Wake-up:  0x%08x | Clock:    0x%08x\n",
+		bcm2835_mmc_readb(host, SDHCI_WAKE_UP_CONTROL),
+		bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL));
+	pr_debug(DRIVER_NAME ": Timeout:  0x%08x | Int stat: 0x%08x\n",
+		bcm2835_mmc_readb(host, SDHCI_TIMEOUT_CONTROL),
+		bcm2835_mmc_readl(host, SDHCI_INT_STATUS));
+	pr_debug(DRIVER_NAME ": Int enab: 0x%08x | Sig enab: 0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_INT_ENABLE),
+		bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE));
+	pr_debug(DRIVER_NAME ": AC12 err: 0x%08x | Slot int: 0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_AUTO_CMD_STATUS),
+		bcm2835_mmc_readw(host, SDHCI_SLOT_INT_STATUS));
+	pr_debug(DRIVER_NAME ": Caps:     0x%08x | Caps_1:   0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES),
+		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES_1));
+	pr_debug(DRIVER_NAME ": Cmd:      0x%08x | Max curr: 0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_COMMAND),
+		bcm2835_mmc_readl(host, SDHCI_MAX_CURRENT));
+	pr_debug(DRIVER_NAME ": Host ctl2: 0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2));
+
+	pr_debug(DRIVER_NAME ": ===========================================\n");
+}
+
+
+static void bcm2835_mmc_reset(struct bcm2835_host *host, u8 mask)
+{
+	unsigned long timeout;
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	bcm2835_mmc_writeb(host, mask, SDHCI_SOFTWARE_RESET);
+
+	if (mask & SDHCI_RESET_ALL)
+		host->clock = 0;
+
+	/* Wait max 100 ms */
+	timeout = 100;
+
+	/* hw clears the bit when it's done */
+	while (bcm2835_mmc_readb(host, SDHCI_SOFTWARE_RESET) & mask) {
+		if (timeout == 0) {
+			pr_err("%s: Reset 0x%x never completed.\n",
+				mmc_hostname(host->mmc), (int)mask);
+			bcm2835_mmc_dumpregs(host);
+			return;
+		}
+		timeout--;
+		spin_unlock_irqrestore(&host->lock, flags);
+		mdelay(1);
+		spin_lock_irqsave(&host->lock, flags);
+	}
+
+	if (100-timeout > 10 && 100-timeout > host->max_delay) {
+		host->max_delay = 100-timeout;
+		pr_warning("Warning: MMC controller hung for %d ms\n", host->max_delay);
+	}
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
+
+static void bcm2835_mmc_init(struct bcm2835_host *host, int soft)
+{
+	unsigned long flags;
+	if (soft)
+		bcm2835_mmc_reset(host, SDHCI_RESET_CMD|SDHCI_RESET_DATA);
+	else
+		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
+
+	host->ier = SDHCI_INT_BUS_POWER | SDHCI_INT_DATA_END_BIT |
+		    SDHCI_INT_DATA_CRC | SDHCI_INT_DATA_TIMEOUT |
+		    SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC |
+		    SDHCI_INT_TIMEOUT | SDHCI_INT_DATA_END |
+		    SDHCI_INT_RESPONSE;
+
+	spin_lock_irqsave(&host->lock, flags);
+	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 3);
+	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 3);
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (soft) {
+		/* force clock reconfiguration */
+		host->clock = 0;
+		bcm2835_mmc_set_ios(host->mmc, &host->mmc->ios);
+	}
+}
+
+
+
+static void bcm2835_mmc_finish_data(struct bcm2835_host *host);
+
+static void bcm2835_mmc_dma_complete(void *param)
+{
+	struct bcm2835_host *host = param;
+	struct dma_chan *dma_chan;
+	unsigned long flags;
+	u32 dir_data;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	host->use_dma = false;
+
+	if (host->data && !(host->data->flags & MMC_DATA_WRITE)) {
+		/* otherwise handled in SDHCI IRQ */
+		dma_chan = host->dma_chan_rxtx;
+		dir_data = DMA_FROM_DEVICE;
+
+		dma_unmap_sg(dma_chan->device->dev,
+		     host->data->sg, host->data->sg_len,
+		     dir_data);
+
+		bcm2835_mmc_finish_data(host);
+	} else if (host->wait_for_dma) {
+		host->wait_for_dma = false;
+		tasklet_schedule(&host->finish_tasklet);
+	}
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_bcm2835_mmc_read_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len, chunk;
+
+	u32 uninitialized_var(scratch);
+	u8 *buf;
+
+	blksize = host->data->blksz;
+	chunk = 0;
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		if (!sg_miter_next(&host->sg_miter))
+			BUG();
+
+		len = min(host->sg_miter.length, blksize);
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = host->sg_miter.addr;
+
+		while (len) {
+			if (chunk == 0) {
+				scratch = bcm2835_mmc_readl(host, SDHCI_BUFFER);
+				chunk = 4;
+			}
+
+			*buf = scratch & 0xFF;
+
+			buf++;
+			scratch >>= 8;
+			chunk--;
+			len--;
+		}
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+static void bcm2835_bcm2835_mmc_write_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len, chunk;
+	u32 scratch;
+	u8 *buf;
+
+	blksize = host->data->blksz;
+	chunk = 0;
+	chunk = 0;
+	scratch = 0;
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		if (!sg_miter_next(&host->sg_miter))
+			BUG();
+
+		len = min(host->sg_miter.length, blksize);
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = host->sg_miter.addr;
+
+		while (len) {
+			scratch |= (u32)*buf << (chunk * 8);
+
+			buf++;
+			chunk++;
+			len--;
+
+			if ((chunk == 4) || ((len == 0) && (blksize == 0))) {
+				mmc_raw_writel(host, scratch, SDHCI_BUFFER);
+				chunk = 0;
+				scratch = 0;
+			}
+		}
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+
+static void bcm2835_mmc_transfer_pio(struct bcm2835_host *host)
+{
+	u32 mask;
+
+	BUG_ON(!host->data);
+
+	if (host->blocks == 0)
+		return;
+
+	if (host->data->flags & MMC_DATA_READ)
+		mask = SDHCI_DATA_AVAILABLE;
+	else
+		mask = SDHCI_SPACE_AVAILABLE;
+
+	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
+
+		if (host->data->flags & MMC_DATA_READ)
+			bcm2835_bcm2835_mmc_read_block_pio(host);
+		else
+			bcm2835_bcm2835_mmc_write_block_pio(host);
+
+		host->blocks--;
+
+		/* QUIRK used in sdhci.c removes the 'if' */
+		/* but it seems this is unnecessary */
+		if (host->blocks == 0)
+			break;
+
+
+	}
+}
+
+
+static void bcm2835_mmc_transfer_dma(struct bcm2835_host *host)
+{
+	u32 len, dir_data, dir_slave;
+	struct dma_async_tx_descriptor *desc = NULL;
+	struct dma_chan *dma_chan;
+
+
+	WARN_ON(!host->data);
+
+	if (!host->data)
+		return;
+
+	if (host->blocks == 0)
+		return;
+
+	dma_chan = host->dma_chan_rxtx;
+	if (host->data->flags & MMC_DATA_READ) {
+		dir_data = DMA_FROM_DEVICE;
+		dir_slave = DMA_DEV_TO_MEM;
+	} else {
+		dir_data = DMA_TO_DEVICE;
+		dir_slave = DMA_MEM_TO_DEV;
+	}
+
+	/* The parameters have already been validated, so this will not fail */
+	(void)dmaengine_slave_config(dma_chan,
+				     (dir_data == DMA_FROM_DEVICE) ?
+				     &host->dma_cfg_rx :
+				     &host->dma_cfg_tx);
+
+	BUG_ON(!dma_chan->device);
+	BUG_ON(!dma_chan->device->dev);
+	BUG_ON(!host->data->sg);
+
+	len = dma_map_sg(dma_chan->device->dev, host->data->sg,
+			 host->data->sg_len, dir_data);
+	if (len > 0) {
+		desc = dmaengine_prep_slave_sg(dma_chan, host->data->sg,
+					       len, dir_slave,
+					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	} else {
+		dev_err(mmc_dev(host->mmc), "dma_map_sg returned zero length\n");
+	}
+	if (desc) {
+		unsigned long flags;
+		spin_lock_irqsave(&host->lock, flags);
+		bcm2835_mmc_unsignal_irqs(host, SDHCI_INT_DATA_AVAIL |
+						    SDHCI_INT_SPACE_AVAIL);
+		host->tx_desc = desc;
+		desc->callback = bcm2835_mmc_dma_complete;
+		desc->callback_param = host;
+		spin_unlock_irqrestore(&host->lock, flags);
+		dmaengine_submit(desc);
+		dma_async_issue_pending(dma_chan);
+	}
+
+}
+
+
+
+static void bcm2835_mmc_set_transfer_irqs(struct bcm2835_host *host)
+{
+	u32 pio_irqs = SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL;
+	u32 dma_irqs = SDHCI_INT_DMA_END | SDHCI_INT_ADMA_ERROR;
+
+	if (host->use_dma)
+		host->ier = (host->ier & ~pio_irqs) | dma_irqs;
+	else
+		host->ier = (host->ier & ~dma_irqs) | pio_irqs;
+
+	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 4);
+	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 4);
+}
+
+
+static void bcm2835_mmc_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
+{
+	u8 count;
+	struct mmc_data *data = cmd->data;
+
+	WARN_ON(host->data);
+
+	if (data || (cmd->flags & MMC_RSP_BUSY)) {
+		count = TIMEOUT_VAL;
+		bcm2835_mmc_writeb(host, count, SDHCI_TIMEOUT_CONTROL);
+	}
+
+	if (!data)
+		return;
+
+	/* Sanity checks */
+	BUG_ON(data->blksz * data->blocks > 524288);
+	BUG_ON(data->blksz > host->mmc->max_blk_size);
+	BUG_ON(data->blocks > 65535);
+
+	host->data = data;
+	host->data_early = 0;
+	host->data->bytes_xfered = 0;
+
+
+	if (!(host->flags & SDHCI_REQ_USE_DMA)) {
+		int flags;
+
+		flags = SG_MITER_ATOMIC;
+		if (host->data->flags & MMC_DATA_READ)
+			flags |= SG_MITER_TO_SG;
+		else
+			flags |= SG_MITER_FROM_SG;
+		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
+		host->blocks = data->blocks;
+	}
+
+	host->use_dma = host->have_dma && data->blocks > PIO_DMA_BARRIER;
+
+	bcm2835_mmc_set_transfer_irqs(host);
+
+	/* Set the DMA boundary value and block size */
+	bcm2835_mmc_writew(host, SDHCI_MAKE_BLKSZ(SDHCI_DEFAULT_BOUNDARY_ARG,
+		data->blksz), SDHCI_BLOCK_SIZE);
+	bcm2835_mmc_writew(host, data->blocks, SDHCI_BLOCK_COUNT);
+
+	BUG_ON(!host->data);
+}
+
+static void bcm2835_mmc_set_transfer_mode(struct bcm2835_host *host,
+	struct mmc_command *cmd)
+{
+	u16 mode;
+	struct mmc_data *data = cmd->data;
+
+	if (data == NULL) {
+		/* clear Auto CMD settings for no data CMDs */
+		mode = bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE);
+		bcm2835_mmc_writew(host, mode & ~(SDHCI_TRNS_AUTO_CMD12 |
+				SDHCI_TRNS_AUTO_CMD23), SDHCI_TRANSFER_MODE);
+		return;
+	}
+
+	WARN_ON(!host->data);
+
+	mode = SDHCI_TRNS_BLK_CNT_EN;
+
+	if ((mmc_op_multi(cmd->opcode) || data->blocks > 1)) {
+		mode |= SDHCI_TRNS_MULTI;
+
+		/*
+		 * If we are sending CMD23, CMD12 never gets sent
+		 * on successful completion (so no Auto-CMD12).
+		 */
+		if (!host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD12))
+			mode |= SDHCI_TRNS_AUTO_CMD12;
+		else if (host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
+			mode |= SDHCI_TRNS_AUTO_CMD23;
+			bcm2835_mmc_writel(host, host->mrq->sbc->arg, SDHCI_ARGUMENT2, 5);
+		}
+	}
+
+	if (data->flags & MMC_DATA_READ)
+		mode |= SDHCI_TRNS_READ;
+	if (host->flags & SDHCI_REQ_USE_DMA)
+		mode |= SDHCI_TRNS_DMA;
+
+	bcm2835_mmc_writew(host, mode, SDHCI_TRANSFER_MODE);
+}
+
+void bcm2835_mmc_send_command(struct bcm2835_host *host, struct mmc_command *cmd)
+{
+	int flags;
+	u32 mask;
+	unsigned long timeout;
+
+	WARN_ON(host->cmd);
+
+	/* Wait max 10 ms */
+	timeout = 1000;
+
+	mask = SDHCI_CMD_INHIBIT;
+	if ((cmd->data != NULL) || (cmd->flags & MMC_RSP_BUSY))
+		mask |= SDHCI_DATA_INHIBIT;
+
+	/* We shouldn't wait for data inihibit for stop commands, even
+	   though they might use busy signaling */
+	if (host->mrq->data && (cmd == host->mrq->data->stop))
+		mask &= ~SDHCI_DATA_INHIBIT;
+
+	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
+		if (timeout == 0) {
+			pr_err("%s: Controller never released inhibit bit(s).\n",
+				mmc_hostname(host->mmc));
+			bcm2835_mmc_dumpregs(host);
+			cmd->error = -EIO;
+			tasklet_schedule(&host->finish_tasklet);
+			return;
+		}
+		timeout--;
+		udelay(10);
+	}
+
+	if ((1000-timeout)/100 > 1 && (1000-timeout)/100 > host->max_delay) {
+		host->max_delay = (1000-timeout)/100;
+		pr_warning("Warning: MMC controller hung for %d ms\n", host->max_delay);
+	}
+
+	timeout = jiffies;
+	if (!cmd->data && cmd->busy_timeout > 9000)
+		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
+	else
+		timeout += 10 * HZ;
+	mod_timer(&host->timer, timeout);
+
+	host->cmd = cmd;
+	host->use_dma = false;
+
+	bcm2835_mmc_prepare_data(host, cmd);
+
+	bcm2835_mmc_writel(host, cmd->arg, SDHCI_ARGUMENT, 6);
+
+	bcm2835_mmc_set_transfer_mode(host, cmd);
+
+	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
+		pr_err("%s: Unsupported response type!\n",
+			mmc_hostname(host->mmc));
+		cmd->error = -EINVAL;
+		tasklet_schedule(&host->finish_tasklet);
+		return;
+	}
+
+	if (!(cmd->flags & MMC_RSP_PRESENT))
+		flags = SDHCI_CMD_RESP_NONE;
+	else if (cmd->flags & MMC_RSP_136)
+		flags = SDHCI_CMD_RESP_LONG;
+	else if (cmd->flags & MMC_RSP_BUSY)
+		flags = SDHCI_CMD_RESP_SHORT_BUSY;
+	else
+		flags = SDHCI_CMD_RESP_SHORT;
+
+	if (cmd->flags & MMC_RSP_CRC)
+		flags |= SDHCI_CMD_CRC;
+	if (cmd->flags & MMC_RSP_OPCODE)
+		flags |= SDHCI_CMD_INDEX;
+
+	if (cmd->data)
+		flags |= SDHCI_CMD_DATA;
+
+	bcm2835_mmc_writew(host, SDHCI_MAKE_CMD(cmd->opcode, flags), SDHCI_COMMAND);
+}
+
+
+static void bcm2835_mmc_finish_data(struct bcm2835_host *host)
+{
+	struct mmc_data *data;
+
+	BUG_ON(!host->data);
+
+	data = host->data;
+	host->data = NULL;
+
+	if (data->error)
+		data->bytes_xfered = 0;
+	else
+		data->bytes_xfered = data->blksz * data->blocks;
+
+	/*
+	 * Need to send CMD12 if -
+	 * a) open-ended multiblock transfer (no CMD23)
+	 * b) error in multiblock transfer
+	 */
+	if (data->stop &&
+	    (data->error ||
+	     !host->mrq->sbc)) {
+
+		/*
+		 * The controller needs a reset of internal state machines
+		 * upon error conditions.
+		 */
+		if (data->error) {
+			bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
+			bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
+		}
+
+		bcm2835_mmc_send_command(host, data->stop);
+	} else if (host->use_dma) {
+		host->wait_for_dma = true;
+	} else {
+		tasklet_schedule(&host->finish_tasklet);
+	}
+}
+
+static void bcm2835_mmc_finish_command(struct bcm2835_host *host)
+{
+	int i;
+
+	BUG_ON(host->cmd == NULL);
+
+	if (host->cmd->flags & MMC_RSP_PRESENT) {
+		if (host->cmd->flags & MMC_RSP_136) {
+			/* CRC is stripped so we need to do some shifting. */
+			for (i = 0; i < 4; i++) {
+				host->cmd->resp[i] = bcm2835_mmc_readl(host,
+					SDHCI_RESPONSE + (3-i)*4) << 8;
+				if (i != 3)
+					host->cmd->resp[i] |=
+						bcm2835_mmc_readb(host,
+						SDHCI_RESPONSE + (3-i)*4-1);
+			}
+		} else {
+			host->cmd->resp[0] = bcm2835_mmc_readl(host, SDHCI_RESPONSE);
+		}
+	}
+
+	host->cmd->error = 0;
+
+	/* Finished CMD23, now send actual command. */
+	if (host->cmd == host->mrq->sbc) {
+		host->cmd = NULL;
+		bcm2835_mmc_send_command(host, host->mrq->cmd);
+
+		if (host->mrq->cmd->data && host->use_dma) {
+			/* DMA transfer starts now, PIO starts after interrupt */
+			bcm2835_mmc_transfer_dma(host);
+		}
+	} else {
+
+		/* Processed actual command. */
+		if (host->data && host->data_early)
+			bcm2835_mmc_finish_data(host);
+
+		if (!host->cmd->data)
+			tasklet_schedule(&host->finish_tasklet);
+
+		host->cmd = NULL;
+	}
+}
+
+
+static void bcm2835_mmc_timeout_timer(struct timer_list *t)
+{
+	struct bcm2835_host *host = from_timer(host, t, timer);
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	if (host->mrq) {
+		pr_err("%s: Timeout waiting for hardware interrupt.\n",
+			mmc_hostname(host->mmc));
+		bcm2835_mmc_dumpregs(host);
+
+		if (host->data) {
+			host->data->error = -ETIMEDOUT;
+			bcm2835_mmc_finish_data(host);
+		} else {
+			if (host->cmd)
+				host->cmd->error = -ETIMEDOUT;
+			else
+				host->mrq->cmd->error = -ETIMEDOUT;
+
+			tasklet_schedule(&host->finish_tasklet);
+		}
+	}
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+
+static void bcm2835_mmc_enable_sdio_irq_nolock(struct bcm2835_host *host, int enable)
+{
+	if (!(host->flags & SDHCI_DEVICE_DEAD)) {
+		if (enable)
+			host->ier |= SDHCI_INT_CARD_INT;
+		else
+			host->ier &= ~SDHCI_INT_CARD_INT;
+
+		bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 7);
+		bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 7);
+		mmiowb();
+	}
+}
+
+static void bcm2835_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
+{
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	if (enable)
+		host->flags |= SDHCI_SDIO_IRQ_ENABLED;
+	else
+		host->flags &= ~SDHCI_SDIO_IRQ_ENABLED;
+
+	bcm2835_mmc_enable_sdio_irq_nolock(host, enable);
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_mmc_cmd_irq(struct bcm2835_host *host, u32 intmask)
+{
+
+	BUG_ON(intmask == 0);
+
+	if (!host->cmd) {
+		pr_err("%s: Got command interrupt 0x%08x even "
+			"though no command operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_mmc_dumpregs(host);
+		return;
+	}
+
+	if (intmask & SDHCI_INT_TIMEOUT)
+		host->cmd->error = -ETIMEDOUT;
+	else if (intmask & (SDHCI_INT_CRC | SDHCI_INT_END_BIT |
+			SDHCI_INT_INDEX)) {
+			host->cmd->error = -EILSEQ;
+	}
+
+	if (host->cmd->error) {
+		tasklet_schedule(&host->finish_tasklet);
+		return;
+	}
+
+	if (intmask & SDHCI_INT_RESPONSE)
+		bcm2835_mmc_finish_command(host);
+
+}
+
+static void bcm2835_mmc_data_irq(struct bcm2835_host *host, u32 intmask)
+{
+	struct dma_chan *dma_chan;
+	u32 dir_data;
+
+	BUG_ON(intmask == 0);
+
+	if (!host->data) {
+		/*
+		 * The "data complete" interrupt is also used to
+		 * indicate that a busy state has ended. See comment
+		 * above in sdhci_cmd_irq().
+		 */
+		if (host->cmd && (host->cmd->flags & MMC_RSP_BUSY)) {
+			if (intmask & SDHCI_INT_DATA_END) {
+				bcm2835_mmc_finish_command(host);
+				return;
+			}
+		}
+
+		pr_debug("%s: Got data interrupt 0x%08x even "
+			"though no data operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_mmc_dumpregs(host);
+
+		return;
+	}
+
+	if (intmask & SDHCI_INT_DATA_TIMEOUT)
+		host->data->error = -ETIMEDOUT;
+	else if (intmask & SDHCI_INT_DATA_END_BIT)
+		host->data->error = -EILSEQ;
+	else if ((intmask & SDHCI_INT_DATA_CRC) &&
+		SDHCI_GET_CMD(bcm2835_mmc_readw(host, SDHCI_COMMAND))
+			!= MMC_BUS_TEST_R)
+		host->data->error = -EILSEQ;
+
+	if (host->use_dma) {
+		if  (host->data->flags & MMC_DATA_WRITE) {
+			/* IRQ handled here */
+
+			dma_chan = host->dma_chan_rxtx;
+			dir_data = DMA_TO_DEVICE;
+			dma_unmap_sg(dma_chan->device->dev,
+				 host->data->sg, host->data->sg_len,
+				 dir_data);
+
+			bcm2835_mmc_finish_data(host);
+		}
+
+	} else {
+		if (host->data->error)
+			bcm2835_mmc_finish_data(host);
+		else {
+			if (intmask & (SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL))
+				bcm2835_mmc_transfer_pio(host);
+
+			if (intmask & SDHCI_INT_DATA_END) {
+				if (host->cmd) {
+					/*
+					 * Data managed to finish before the
+					 * command completed. Make sure we do
+					 * things in the proper order.
+					 */
+					host->data_early = 1;
+				} else {
+					bcm2835_mmc_finish_data(host);
+				}
+			}
+		}
+	}
+}
+
+
+static irqreturn_t bcm2835_mmc_irq(int irq, void *dev_id)
+{
+	irqreturn_t result = IRQ_NONE;
+	struct bcm2835_host *host = dev_id;
+	u32 intmask, mask, unexpected = 0;
+	int max_loops = 16;
+
+	spin_lock(&host->lock);
+
+	intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
+
+	if (!intmask || intmask == 0xffffffff) {
+		result = IRQ_NONE;
+		goto out;
+	}
+
+	do {
+		/* Clear selected interrupts. */
+		mask = intmask & (SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
+				  SDHCI_INT_BUS_POWER);
+		bcm2835_mmc_writel(host, mask, SDHCI_INT_STATUS, 8);
+
+
+		if (intmask & SDHCI_INT_CMD_MASK)
+			bcm2835_mmc_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
+
+		if (intmask & SDHCI_INT_DATA_MASK)
+			bcm2835_mmc_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
+
+		if (intmask & SDHCI_INT_BUS_POWER)
+			pr_err("%s: Card is consuming too much power!\n",
+				mmc_hostname(host->mmc));
+
+		if (intmask & SDHCI_INT_CARD_INT) {
+			bcm2835_mmc_enable_sdio_irq_nolock(host, false);
+			host->thread_isr |= SDHCI_INT_CARD_INT;
+			result = IRQ_WAKE_THREAD;
+		}
+
+		intmask &= ~(SDHCI_INT_CARD_INSERT | SDHCI_INT_CARD_REMOVE |
+			     SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
+			     SDHCI_INT_ERROR | SDHCI_INT_BUS_POWER |
+			     SDHCI_INT_CARD_INT);
+
+		if (intmask) {
+			unexpected |= intmask;
+			bcm2835_mmc_writel(host, intmask, SDHCI_INT_STATUS, 9);
+		}
+
+		if (result == IRQ_NONE)
+			result = IRQ_HANDLED;
+
+		intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
+	} while (intmask && --max_loops);
+out:
+	spin_unlock(&host->lock);
+
+	if (unexpected) {
+		pr_err("%s: Unexpected interrupt 0x%08x.\n",
+			   mmc_hostname(host->mmc), unexpected);
+		bcm2835_mmc_dumpregs(host);
+	}
+
+	return result;
+}
+
+static irqreturn_t bcm2835_mmc_thread_irq(int irq, void *dev_id)
+{
+	struct bcm2835_host *host = dev_id;
+	unsigned long flags;
+	u32 isr;
+
+	spin_lock_irqsave(&host->lock, flags);
+	isr = host->thread_isr;
+	host->thread_isr = 0;
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (isr & SDHCI_INT_CARD_INT) {
+		sdio_run_irqs(host->mmc);
+
+		spin_lock_irqsave(&host->lock, flags);
+		if (host->flags & SDHCI_SDIO_IRQ_ENABLED)
+			bcm2835_mmc_enable_sdio_irq_nolock(host, true);
+		spin_unlock_irqrestore(&host->lock, flags);
+	}
+
+	return isr ? IRQ_HANDLED : IRQ_NONE;
+}
+
+
+
+void bcm2835_mmc_set_clock(struct bcm2835_host *host, unsigned int clock)
+{
+	int div = 0; /* Initialized for compiler warning */
+	int real_div = div, clk_mul = 1;
+	u16 clk = 0;
+	unsigned long timeout;
+	unsigned int input_clock = clock;
+
+	if (host->overclock_50 && (clock == 50000000))
+		clock = host->overclock_50 * 1000000 + 999999;
+
+	host->mmc->actual_clock = 0;
+
+	bcm2835_mmc_writew(host, 0, SDHCI_CLOCK_CONTROL);
+
+	if (clock == 0)
+		return;
+
+	/* Version 3.00 divisors must be a multiple of 2. */
+	if (host->max_clk <= clock)
+		div = 1;
+	else {
+		for (div = 2; div < SDHCI_MAX_DIV_SPEC_300;
+			 div += 2) {
+			if ((host->max_clk / div) <= clock)
+				break;
+		}
+	}
+
+	real_div = div;
+	div >>= 1;
+
+	if (real_div)
+		clock = (host->max_clk * clk_mul) / real_div;
+	host->mmc->actual_clock = clock;
+
+	if ((clock > input_clock) && (clock > host->max_overclock)) {
+		pr_warn("%s: Overclocking to %dHz\n",
+			mmc_hostname(host->mmc), clock);
+		host->max_overclock = clock;
+	}
+
+	clk |= (div & SDHCI_DIV_MASK) << SDHCI_DIVIDER_SHIFT;
+	clk |= ((div & SDHCI_DIV_HI_MASK) >> SDHCI_DIV_MASK_LEN)
+		<< SDHCI_DIVIDER_HI_SHIFT;
+	clk |= SDHCI_CLOCK_INT_EN;
+	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
+
+	/* Wait max 20 ms */
+	timeout = 20;
+	while (!((clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL))
+		& SDHCI_CLOCK_INT_STABLE)) {
+		if (timeout == 0) {
+			pr_err("%s: Internal clock never "
+				"stabilised.\n", mmc_hostname(host->mmc));
+			bcm2835_mmc_dumpregs(host);
+			return;
+		}
+		timeout--;
+		mdelay(1);
+	}
+
+	if (20-timeout > 10 && 20-timeout > host->max_delay) {
+		host->max_delay = 20-timeout;
+		pr_warning("Warning: MMC controller hung for %d ms\n", host->max_delay);
+	}
+
+	clk |= SDHCI_CLOCK_CARD_EN;
+	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
+}
+
+static void bcm2835_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+
+	host = mmc_priv(mmc);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	WARN_ON(host->mrq != NULL);
+
+	host->mrq = mrq;
+
+	if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
+		bcm2835_mmc_send_command(host, mrq->sbc);
+	else
+		bcm2835_mmc_send_command(host, mrq->cmd);
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (!(mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23)) && mrq->cmd->data && host->use_dma) {
+		/* DMA transfer starts now, PIO starts after interrupt */
+		bcm2835_mmc_transfer_dma(host);
+	}
+}
+
+
+static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+	u8 ctrl;
+	u16 clk, ctrl_2;
+
+	pr_debug("bcm2835_mmc_set_ios: clock %d, pwr %d, bus_width %d, timing %d, vdd %d, drv_type %d\n",
+		 ios->clock, ios->power_mode, ios->bus_width,
+		 ios->timing, ios->signal_voltage, ios->drv_type);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	if (!ios->clock || ios->clock != host->clock) {
+		bcm2835_mmc_set_clock(host, ios->clock);
+		host->clock = ios->clock;
+	}
+
+	if (host->pwr != SDHCI_POWER_330) {
+		host->pwr = SDHCI_POWER_330;
+		bcm2835_mmc_writeb(host, SDHCI_POWER_330 | SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
+	}
+
+	ctrl = bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL);
+
+	/* set bus width */
+	ctrl &= ~SDHCI_CTRL_8BITBUS;
+	if (ios->bus_width == MMC_BUS_WIDTH_4)
+		ctrl |= SDHCI_CTRL_4BITBUS;
+	else
+		ctrl &= ~SDHCI_CTRL_4BITBUS;
+
+	ctrl &= ~SDHCI_CTRL_HISPD; /* NO_HISPD_BIT */
+
+
+	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+	/*
+	 * We only need to set Driver Strength if the
+	 * preset value enable is not set.
+	 */
+	ctrl_2 = bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2);
+	ctrl_2 &= ~SDHCI_CTRL_DRV_TYPE_MASK;
+	if (ios->drv_type == MMC_SET_DRIVER_TYPE_A)
+		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_A;
+	else if (ios->drv_type == MMC_SET_DRIVER_TYPE_C)
+		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_C;
+
+	bcm2835_mmc_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
+
+	/* Reset SD Clock Enable */
+	clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL);
+	clk &= ~SDHCI_CLOCK_CARD_EN;
+	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
+
+	/* Re-enable SD Clock */
+	bcm2835_mmc_set_clock(host, host->clock);
+	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+
+	mmiowb();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+
+static struct mmc_host_ops bcm2835_ops = {
+	.request = bcm2835_mmc_request,
+	.set_ios = bcm2835_mmc_set_ios,
+	.enable_sdio_irq = bcm2835_mmc_enable_sdio_irq,
+};
+
+
+static void bcm2835_mmc_tasklet_finish(unsigned long param)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+	struct mmc_request *mrq;
+
+	host = (struct bcm2835_host *)param;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	/*
+	 * If this tasklet gets rescheduled while running, it will
+	 * be run again afterwards but without any active request.
+	 */
+	if (!host->mrq) {
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	del_timer(&host->timer);
+
+	mrq = host->mrq;
+
+	/*
+	 * The controller needs a reset of internal state machines
+	 * upon error conditions.
+	 */
+	if (!(host->flags & SDHCI_DEVICE_DEAD) &&
+	    ((mrq->cmd && mrq->cmd->error) ||
+		 (mrq->data && (mrq->data->error ||
+		  (mrq->data->stop && mrq->data->stop->error))))) {
+
+		spin_unlock_irqrestore(&host->lock, flags);
+		bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
+		bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
+		spin_lock_irqsave(&host->lock, flags);
+	}
+
+	host->mrq = NULL;
+	host->cmd = NULL;
+	host->data = NULL;
+
+	mmiowb();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+	mmc_request_done(host->mmc, mrq);
+}
+
+
+
+static int bcm2835_mmc_add_host(struct bcm2835_host *host)
+{
+	struct mmc_host *mmc = host->mmc;
+	struct device *dev = mmc->parent;
+#ifndef FORCE_PIO
+	struct dma_slave_config cfg;
+#endif
+	int ret;
+
+	bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
+
+	host->clk_mul = 0;
+
+	if (!mmc->f_max || mmc->f_max > host->max_clk)
+		mmc->f_max = host->max_clk;
+	mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
+
+	/* SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK */
+	host->timeout_clk = mmc->f_max / 1000;
+	mmc->max_busy_timeout = (1 << 27) / host->timeout_clk;
+
+	/* host controller capabilities */
+	mmc->caps |= MMC_CAP_CMD23 | MMC_CAP_ERASE | MMC_CAP_NEEDS_POLL |
+		MMC_CAP_SDIO_IRQ | MMC_CAP_SD_HIGHSPEED |
+		MMC_CAP_MMC_HIGHSPEED;
+
+	mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
+
+	host->flags = SDHCI_AUTO_CMD23;
+
+	dev_info(dev, "mmc_debug:%x mmc_debug2:%x\n", mmc_debug, mmc_debug2);
+#ifdef FORCE_PIO
+	dev_info(dev, "Forcing PIO mode\n");
+	host->have_dma = false;
+#else
+	if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
+		dev_err(dev, "%s: Unable to initialise DMA channel. Falling back to PIO\n",
+			DRIVER_NAME);
+		host->have_dma = false;
+	} else {
+		dev_info(dev, "DMA channel allocated");
+
+		cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		cfg.slave_id = 11;		/* DREQ channel */
+
+		/* Validate the slave configurations */
+
+		cfg.direction = DMA_MEM_TO_DEV;
+		cfg.src_addr = 0;
+		cfg.dst_addr = host->bus_addr + SDHCI_BUFFER;
+
+		ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+
+		if (ret == 0) {
+			host->dma_cfg_tx = cfg;
+
+			cfg.direction = DMA_DEV_TO_MEM;
+			cfg.src_addr = host->bus_addr + SDHCI_BUFFER;
+			cfg.dst_addr = 0;
+
+			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+		}
+
+		if (ret == 0) {
+			host->dma_cfg_rx = cfg;
+
+			host->have_dma = true;
+		} else {
+			pr_err("%s: unable to configure DMA channel. "
+			       "Falling back to PIO\n",
+			       mmc_hostname(mmc));
+			dma_release_channel(host->dma_chan_rxtx);
+			host->dma_chan_rxtx = NULL;
+			host->have_dma = false;
+		}
+	}
+#endif
+	mmc->max_segs = 128;
+	mmc->max_req_size = 524288;
+	mmc->max_seg_size = mmc->max_req_size;
+	mmc->max_blk_size = 512;
+	mmc->max_blk_count =  65535;
+
+	/* report supported voltage ranges */
+	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+	tasklet_init(&host->finish_tasklet,
+		bcm2835_mmc_tasklet_finish, (unsigned long)host);
+
+	timer_setup(&host->timer, bcm2835_mmc_timeout_timer, 0);
+	init_waitqueue_head(&host->buf_ready_int);
+
+	bcm2835_mmc_init(host, 0);
+	ret = devm_request_threaded_irq(dev, host->irq, bcm2835_mmc_irq,
+					bcm2835_mmc_thread_irq, IRQF_SHARED,
+					mmc_hostname(mmc), host);
+	if (ret) {
+		dev_err(dev, "Failed to request IRQ %d: %d\n", host->irq, ret);
+		goto untasklet;
+	}
+
+	mmiowb();
+	mmc_add_host(mmc);
+
+	return 0;
+
+untasklet:
+	tasklet_kill(&host->finish_tasklet);
+
+	return ret;
+}
+
+static int bcm2835_mmc_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct clk *clk;
+	struct resource *iomem;
+	struct bcm2835_host *host;
+	struct mmc_host *mmc;
+	const __be32 *addr;
+	int ret;
+
+	mmc = mmc_alloc_host(sizeof(*host), dev);
+	if (!mmc)
+		return -ENOMEM;
+
+	mmc->ops = &bcm2835_ops;
+	host = mmc_priv(mmc);
+	host->mmc = mmc;
+	host->timeout = msecs_to_jiffies(1000);
+	spin_lock_init(&host->lock);
+
+	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	host->ioaddr = devm_ioremap_resource(dev, iomem);
+	if (IS_ERR(host->ioaddr)) {
+		ret = PTR_ERR(host->ioaddr);
+		goto err;
+	}
+
+	addr = of_get_address(node, 0, NULL, NULL);
+	if (!addr) {
+		dev_err(dev, "could not get DMA-register address\n");
+		return -ENODEV;
+	}
+	host->bus_addr = be32_to_cpup(addr);
+	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
+		 (unsigned long)host->ioaddr,
+		 (unsigned long)iomem->start,
+		 (unsigned long)host->bus_addr);
+
+#ifndef FORCE_PIO
+	if (node) {
+		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
+		if (!host->dma_chan_rxtx)
+			host->dma_chan_rxtx =
+				dma_request_slave_channel(dev, "tx");
+		if (!host->dma_chan_rxtx)
+			host->dma_chan_rxtx =
+				dma_request_slave_channel(dev, "rx");
+	} else {
+		dma_cap_mask_t mask;
+
+		dma_cap_zero(mask);
+		/* we don't care about the channel, any would work */
+		dma_cap_set(DMA_SLAVE, mask);
+		host->dma_chan_rxtx = dma_request_channel(mask, NULL, NULL);
+	}
+#endif
+	clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(clk)) {
+		ret = PTR_ERR(clk);
+		if (ret == -EPROBE_DEFER)
+			dev_info(dev, "could not get clk, deferring probe\n");
+		else
+			dev_err(dev, "could not get clk\n");
+		goto err;
+	}
+
+	host->max_clk = clk_get_rate(clk);
+
+	host->irq = platform_get_irq(pdev, 0);
+	if (host->irq <= 0) {
+		dev_err(dev, "get IRQ failed\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (node) {
+		mmc_of_parse(mmc);
+
+		/* Read any custom properties */
+		of_property_read_u32(node,
+				     "brcm,overclock-50",
+				     &host->overclock_50);
+	} else {
+		mmc->caps |= MMC_CAP_4_BIT_DATA;
+	}
+
+	ret = bcm2835_mmc_add_host(host);
+	if (ret)
+		goto err;
+
+	platform_set_drvdata(pdev, host);
+
+	return 0;
+err:
+	mmc_free_host(mmc);
+
+	return ret;
+}
+
+static int bcm2835_mmc_remove(struct platform_device *pdev)
+{
+	struct bcm2835_host *host = platform_get_drvdata(pdev);
+	unsigned long flags;
+	int dead;
+	u32 scratch;
+
+	dead = 0;
+	scratch = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
+	if (scratch == (u32)-1)
+		dead = 1;
+
+
+	if (dead) {
+		spin_lock_irqsave(&host->lock, flags);
+
+		host->flags |= SDHCI_DEVICE_DEAD;
+
+		if (host->mrq) {
+			pr_err("%s: Controller removed during "
+				" transfer!\n", mmc_hostname(host->mmc));
+
+			host->mrq->cmd->error = -ENOMEDIUM;
+			tasklet_schedule(&host->finish_tasklet);
+		}
+
+		spin_unlock_irqrestore(&host->lock, flags);
+	}
+
+	mmc_remove_host(host->mmc);
+
+	if (!dead)
+		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
+
+	free_irq(host->irq, host);
+
+	del_timer_sync(&host->timer);
+
+	tasklet_kill(&host->finish_tasklet);
+
+	mmc_free_host(host->mmc);
+	platform_set_drvdata(pdev, NULL);
+
+	return 0;
+}
+
+
+static const struct of_device_id bcm2835_mmc_match[] = {
+	{ .compatible = "brcm,bcm2835-mmc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, bcm2835_mmc_match);
+
+
+
+static struct platform_driver bcm2835_mmc_driver = {
+	.probe      = bcm2835_mmc_probe,
+	.remove     = bcm2835_mmc_remove,
+	.driver     = {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= bcm2835_mmc_match,
+	},
+};
+module_platform_driver(bcm2835_mmc_driver);
+
+module_param(mmc_debug, uint, 0644);
+module_param(mmc_debug2, uint, 0644);
+MODULE_ALIAS("platform:mmc-bcm2835");
+MODULE_DESCRIPTION("BCM2835 SDHCI driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Gellert Weisz");
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index 8ef330027b134..1bd1810da68e1 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -271,6 +271,8 @@ struct mmc_card {
 #define MMC_QUIRK_TRIM_BROKEN	(1<<12)		/* Skip trim */
 #define MMC_QUIRK_BROKEN_HPI	(1<<13)		/* Disable broken HPI support */
 
+#define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
+
 	bool			reenable_cmdq;	/* Re-enable Command Queue */
 
 	unsigned int		erase_size;	/* erase size in sectors */
-- 
GitLab


From 1f97f903dfe5b002a70d7b6428403eba52a39f76 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 25 Mar 2015 17:49:47 +0000
Subject: [PATCH 0045/1835] Adding bcm2835-sdhost driver, and an overlay to
 enable it

BCM2835 has two SD card interfaces. This driver uses the other one.

bcm2835-sdhost: Error handling fix, and code clarification

bcm2835-sdhost: Adding overclocking option

Allow a different clock speed to be substitued for a requested 50MHz.
This option is exposed using the "overclock_50" DT parameter.
Note that the sdhost interface is restricted to integer divisions of
core_freq, and the highest sensible option for a core_freq of 250MHz
is 84 (250/3 = 83.3MHz), the next being 125 (250/2) which is much too
high.

Use at your own risk.

bcm2835-sdhost: Round up the overclock, so 62 works for 62.5Mhz

Also only warn once for each overclock setting.

bcm2835-sdhost: Improve error handling and recovery

1) Expose the hw_reset method to the MMC framework, removing many
   internal calls by the driver.

2) Reduce overclock setting on error.

3) Increase timeout to cope with high capacity cards.

4) Add properties and parameters to control pio_limit and debug.

5) Reduce messages at probe time.

bcm2835-sdhost: Further improve overclock back-off

bcm2835-sdhost: Clear HBLC for PIO mode

Also update pio_limit default in overlay README.

bcm2835-sdhost: Add the ERASE capability

See: https://github.com/raspberrypi/linux/issues/1076

bcm2835-sdhost: Ignore CRC7 for MMC CMD1

It seems that the sdhost interface returns CRC7 errors for CMD1,
which is the MMC-specific SEND_OP_COND. Returning these errors to
the MMC layer causes a downward spiral, but ignoring them seems
to be harmless.

bcm2835-mmc/sdhost: Remove ARCH_BCM2835 differences

The bcm2835-mmc driver (and -sdhost driver that copied from it)
contains code to handle SDIO interrupts in a threaded interrupt
handler rather than waking the MMC framework thread. The change
follows a patch from Russell King that adds the facility as the
preferred way of working.

However, the new code path is only present in ARCH_BCM2835
builds, which I have taken to be a way of testing the waters
rather than making the change across the board; I can't see
any technical reason why it wouldn't be enabled for MACH_BCM270X
builds. So this patch standardises on the ARCH_BCM2835 code,
removing the old code paths.

bcm2835-sdhost: Don't log timeout errors unless debug=1

The MMC card-discovery process generates timeouts. This is
expected behaviour, so reporting it to the user serves no purpose.
Suppress the reporting of timeout errors unless the debug flag
is on.

bcm2835-sdhost: Add workaround for odd behaviour on some cards

For reasons not understood, the sdhost driver fails when reading
sectors very near the end of some SD cards. The problem could
be related to the similar issue that reading the final sector
of any card as part of a multiple read never completes, and the
workaround is an extension of the mechanism introduced to solve
that problem which ensures those sectors are always read singly.

bcm2835-sdhost: Major revision

This is a significant revision of the bcm2835-sdhost driver. It
improves on the original in a number of ways:

1) Through the use of CMD23 for reads it appears to avoid problems
   reading some sectors on certain high speed cards.
2) Better atomicity to prevent crashes.
3) Higher performance.
4) Activity logging included, for easier diagnosis in the event
   of a problem.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: Restore ATOMIC flag to PIO sg mapping

Allocation problems have been seen in a wireless driver, and
this is the only change which might have been responsible.

SQUASH: bcm2835-sdhost: Only claim one DMA channel

With both MMC controllers enabled there are few DMA channels left. The
bcm2835-sdhost driver only uses DMA in one direction at a time, so it
doesn't need to claim two channels.

See: https://github.com/raspberrypi/linux/issues/1327

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: Workaround for "slow" sectors

Some cards have been seen to cause timeouts after certain sectors are
read. This workaround enforces a minimum delay between the stop after
reading one of those sectors and a subsequent data command.

Using CMD23 (SET_BLOCK_COUNT) avoids this problem, so good cards will
not be penalised by this workaround.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: Firmware manages the clock divisor

The bcm2835-sdhost driver hands control of the CDIV clock divisor
register to matching firmware, allowing it to adjust to a changing
core clock. This removes the need to use the performance governor or
to enable io_is_busy on the on-demand governor in order to get the
best SD performance.

N.B. As SD clocks must be an integer divisor of the core clock, it is
possible that the SD clock for "turbo" mode can be different (even
lower) than "normal" mode.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: Reset the clock in task context

Since reprogramming the clock can now involve a round-trip to the
firmware it must not be done at atomic context, and a tasklet
is not a task.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: Don't exit cmd wait loop on error

The FAIL flag can be set in the CMD register before command processing
is complete, leading to spurious "failed to complete" errors. This has
the effect of promoting harmless CRC7 errors during CMD1 processing
into errors that can delay and even prevent booting.

Also:
1) Convert the last KERN_ERROR message in the register dumping to
   KERN_INFO.
2) Remove an unnecessary reset call from  bcm2835_sdhost_add_host.

See: https://github.com/raspberrypi/linux/pull/1492

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: mmc_card_blockaddr fix

Get the definition of mmc_card_blockaddr from drivers/mmc/core/card.h.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

bcm2835-sdhost: New timer API

mmc: bcm2835-sdhost: Support underclocking

Support underclocking of the SD bus in two ways:
1. using the max-frequency DT property (which currently has no DT
   parameter), and
2. using the exiting sd_overclock parameter.

The two methods differ slightly - in the former the MMC subsystem is
aware of the underclocking, while in the latter it isn't - but the
end results should be the same.

See: https://github.com/raspberrypi/linux/issues/2350

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

mmc: bcm2835-sdhost: Add include

highmem.h (needed for kmap_atomic) is pulled in by one of the other
include files, but only with some CONFIG settings. Make the inclusion
explicit to cater for cases where the CONFIG setting is absent.

See: https://github.com/raspberrypi/linux/issues/2366

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/Kconfig          |   10 +
 drivers/mmc/host/Makefile         |    1 +
 drivers/mmc/host/bcm2835-sdhost.c | 2191 +++++++++++++++++++++++++++++
 3 files changed, 2202 insertions(+)
 create mode 100644 drivers/mmc/host/bcm2835-sdhost.c

diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 0f0c4b160b156..b6265f7e5b0be 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -33,6 +33,16 @@ config MMC_BCM2835_PIO_DMA_BARRIER
 
 	  If unsure, say 2 here.
 
+config MMC_BCM2835_SDHOST
+	tristate "Support for the SDHost controller on BCM2708/9"
+	depends on ARCH_BCM2835
+	help
+	  This selects the SDHost controller on BCM2835/6.
+
+	  If you have a controller with this interface, say Y or M here.
+
+	  If unsure, say N.
+
 config MMC_DEBUG
 	bool "MMC host drivers debugging"
 	depends on MMC != n
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index b402128375b6a..cc9e472bdd325 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -22,6 +22,7 @@ obj-$(CONFIG_MMC_SDHCI_SIRF)   	+= sdhci-sirf.o
 obj-$(CONFIG_MMC_SDHCI_F_SDH30)	+= sdhci_f_sdh30.o
 obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
 obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
+obj-$(CONFIG_MMC_BCM2835_SDHOST)	+= bcm2835-sdhost.o
 obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
 obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
 obj-$(CONFIG_MMC_MTK)		+= mtk-sd.o
diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
new file mode 100644
index 0000000000000..34ae2be3647f7
--- /dev/null
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -0,0 +1,2191 @@
+/*
+ * BCM2835 SD host driver.
+ *
+ * Author:      Phil Elwell <phil@raspberrypi.org>
+ *              Copyright (C) 2015-2016 Raspberry Pi (Trading) Ltd.
+ *
+ * Based on
+ *  mmc-bcm2835.c by Gellert Weisz
+ * which is, in turn, based on
+ *  sdhci-bcm2708.c by Broadcom
+ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
+ *  sdhci.c and sdhci-pci.c by Pierre Ossman
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define FIFO_READ_THRESHOLD     4
+#define FIFO_WRITE_THRESHOLD    4
+#define ALLOW_CMD23_READ        1
+#define ALLOW_CMD23_WRITE       0
+#define ENABLE_LOG              1
+#define SDDATA_FIFO_PIO_BURST   8
+#define CMD_DALLY_US            1
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/io.h>
+#include <linux/mmc/mmc.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sd.h>
+#include <linux/mmc/sdio.h>
+#include <linux/scatterlist.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/blkdev.h>
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_dma.h>
+#include <linux/time.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/highmem.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+/* For mmc_card_blockaddr */
+#include "../core/card.h"
+
+#define DRIVER_NAME "sdhost-bcm2835"
+
+#define SDCMD  0x00 /* Command to SD card              - 16 R/W */
+#define SDARG  0x04 /* Argument to SD card             - 32 R/W */
+#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
+#define SDCDIV 0x0c /* Start value for clock divider   - 11 R/W */
+#define SDRSP0 0x10 /* SD card response (31:0)         - 32 R   */
+#define SDRSP1 0x14 /* SD card response (63:32)        - 32 R   */
+#define SDRSP2 0x18 /* SD card response (95:64)        - 32 R   */
+#define SDRSP3 0x1c /* SD card response (127:96)       - 32 R   */
+#define SDHSTS 0x20 /* SD host status                  - 11 R   */
+#define SDVDD  0x30 /* SD card power control           -  1 R/W */
+#define SDEDM  0x34 /* Emergency Debug Mode            - 13 R/W */
+#define SDHCFG 0x38 /* Host configuration              -  2 R/W */
+#define SDHBCT 0x3c /* Host byte count (debug)         - 32 R/W */
+#define SDDATA 0x40 /* Data to/from SD card            - 32 R/W */
+#define SDHBLC 0x50 /* Host block count (SDIO/SDHC)    -  9 R/W */
+
+#define SDCMD_NEW_FLAG                  0x8000
+#define SDCMD_FAIL_FLAG                 0x4000
+#define SDCMD_BUSYWAIT                  0x800
+#define SDCMD_NO_RESPONSE               0x400
+#define SDCMD_LONG_RESPONSE             0x200
+#define SDCMD_WRITE_CMD                 0x80
+#define SDCMD_READ_CMD                  0x40
+#define SDCMD_CMD_MASK                  0x3f
+
+#define SDCDIV_MAX_CDIV                 0x7ff
+
+#define SDHSTS_BUSY_IRPT                0x400
+#define SDHSTS_BLOCK_IRPT               0x200
+#define SDHSTS_SDIO_IRPT                0x100
+#define SDHSTS_REW_TIME_OUT             0x80
+#define SDHSTS_CMD_TIME_OUT             0x40
+#define SDHSTS_CRC16_ERROR              0x20
+#define SDHSTS_CRC7_ERROR               0x10
+#define SDHSTS_FIFO_ERROR               0x08
+/* Reserved */
+/* Reserved */
+#define SDHSTS_DATA_FLAG                0x01
+
+#define SDHSTS_TRANSFER_ERROR_MASK      (SDHSTS_CRC7_ERROR|SDHSTS_CRC16_ERROR|SDHSTS_REW_TIME_OUT|SDHSTS_FIFO_ERROR)
+#define SDHSTS_ERROR_MASK               (SDHSTS_CMD_TIME_OUT|SDHSTS_TRANSFER_ERROR_MASK)
+
+#define SDHCFG_BUSY_IRPT_EN     (1<<10)
+#define SDHCFG_BLOCK_IRPT_EN    (1<<8)
+#define SDHCFG_SDIO_IRPT_EN     (1<<5)
+#define SDHCFG_DATA_IRPT_EN     (1<<4)
+#define SDHCFG_SLOW_CARD        (1<<3)
+#define SDHCFG_WIDE_EXT_BUS     (1<<2)
+#define SDHCFG_WIDE_INT_BUS     (1<<1)
+#define SDHCFG_REL_CMD_LINE     (1<<0)
+
+#define SDEDM_FORCE_DATA_MODE   (1<<19)
+#define SDEDM_CLOCK_PULSE       (1<<20)
+#define SDEDM_BYPASS            (1<<21)
+
+#define SDEDM_WRITE_THRESHOLD_SHIFT 9
+#define SDEDM_READ_THRESHOLD_SHIFT 14
+#define SDEDM_THRESHOLD_MASK     0x1f
+
+#define SDEDM_FSM_MASK           0xf
+#define SDEDM_FSM_IDENTMODE      0x0
+#define SDEDM_FSM_DATAMODE       0x1
+#define SDEDM_FSM_READDATA       0x2
+#define SDEDM_FSM_WRITEDATA      0x3
+#define SDEDM_FSM_READWAIT       0x4
+#define SDEDM_FSM_READCRC        0x5
+#define SDEDM_FSM_WRITECRC       0x6
+#define SDEDM_FSM_WRITEWAIT1     0x7
+#define SDEDM_FSM_POWERDOWN      0x8
+#define SDEDM_FSM_POWERUP        0x9
+#define SDEDM_FSM_WRITESTART1    0xa
+#define SDEDM_FSM_WRITESTART2    0xb
+#define SDEDM_FSM_GENPULSES      0xc
+#define SDEDM_FSM_WRITEWAIT2     0xd
+#define SDEDM_FSM_STARTPOWDOWN   0xf
+
+#define SDDATA_FIFO_WORDS        16
+
+#define USE_CMD23_FLAGS          ((ALLOW_CMD23_READ * MMC_DATA_READ) | \
+				  (ALLOW_CMD23_WRITE * MMC_DATA_WRITE))
+
+#define MHZ 1000000
+
+
+struct bcm2835_host {
+	spinlock_t		lock;
+
+	void __iomem		*ioaddr;
+	u32			bus_addr;
+
+	struct mmc_host		*mmc;
+
+	u32			pio_timeout;	/* In jiffies */
+
+	int			clock;		/* Current clock speed */
+
+	bool			slow_card;	/* Force 11-bit divisor */
+
+	unsigned int		max_clk;	/* Max possible freq */
+
+	struct tasklet_struct	finish_tasklet;	/* Tasklet structures */
+
+	struct work_struct	cmd_wait_wq;	/* Workqueue function */
+
+	struct timer_list	timer;		/* Timer for timeouts */
+
+	struct sg_mapping_iter	sg_miter;	/* SG state for PIO */
+	unsigned int		blocks;		/* remaining PIO blocks */
+
+	int			irq;		/* Device IRQ */
+
+	u32			cmd_quick_poll_retries;
+	u32			ns_per_fifo_word;
+
+	/* cached registers */
+	u32			hcfg;
+	u32			cdiv;
+
+	struct mmc_request		*mrq;			/* Current request */
+	struct mmc_command		*cmd;			/* Current command */
+	struct mmc_data			*data;			/* Current data request */
+	unsigned int			data_complete:1;	/* Data finished before cmd */
+
+	unsigned int			flush_fifo:1;		/* Drain the fifo when finishing */
+
+	unsigned int			use_busy:1;		/* Wait for busy interrupt */
+
+	unsigned int			use_sbc:1;		/* Send CMD23 */
+
+	unsigned int			debug:1;		/* Enable debug output */
+	unsigned int			firmware_sets_cdiv:1;	/* Let the firmware manage the clock */
+	unsigned int			reset_clock:1;		/* Reset the clock fore the next request */
+
+	/*DMA part*/
+	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
+	struct dma_chan			*dma_chan;		/* Channel in use */
+	struct dma_slave_config		dma_cfg_rx;
+	struct dma_slave_config		dma_cfg_tx;
+	struct dma_async_tx_descriptor	*dma_desc;
+	u32				dma_dir;
+	u32				drain_words;
+	struct page 			*drain_page;
+	u32				drain_offset;
+
+	bool				allow_dma;
+	bool				use_dma;
+	/*end of DMA part*/
+
+	int				max_delay;	/* maximum length of time spent waiting */
+	struct timeval			stop_time;	/* when the last stop was issued */
+	u32				delay_after_stop; /* minimum time between stop and subsequent data transfer */
+	u32				delay_after_this_stop; /* minimum time between this stop and subsequent data transfer */
+	u32				user_overclock_50; /* User's preferred frequency to use when 50MHz is requested (in MHz) */
+	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
+	u32				overclock;	/* Current frequency if overclocked, else zero */
+	u32				pio_limit;	/* Maximum block count for PIO (0 = always DMA) */
+
+	u32				sectors;	/* Cached card size in sectors */
+};
+
+#if ENABLE_LOG
+
+struct log_entry_struct {
+	char event[4];
+	u32 timestamp;
+	u32 param1;
+	u32 param2;
+};
+
+typedef struct log_entry_struct LOG_ENTRY_T;
+
+LOG_ENTRY_T *sdhost_log_buf;
+dma_addr_t sdhost_log_addr;
+static u32 sdhost_log_idx;
+static spinlock_t log_lock;
+static void __iomem *timer_base;
+
+#define LOG_ENTRIES (256*1)
+#define LOG_SIZE (sizeof(LOG_ENTRY_T)*LOG_ENTRIES)
+
+static void log_init(struct device *dev, u32 bus_to_phys)
+{
+	spin_lock_init(&log_lock);
+	sdhost_log_buf = dma_zalloc_coherent(dev, LOG_SIZE, &sdhost_log_addr,
+					     GFP_KERNEL);
+	if (sdhost_log_buf) {
+		pr_info("sdhost: log_buf @ %p (%x)\n",
+			sdhost_log_buf, sdhost_log_addr);
+		timer_base = ioremap_nocache(bus_to_phys + 0x7e003000, SZ_4K);
+		if (!timer_base)
+			pr_err("sdhost: failed to remap timer\n");
+	}
+	else
+		pr_err("sdhost: failed to allocate log buf\n");
+}
+
+static void log_event_impl(const char *event, u32 param1, u32 param2)
+{
+	if (sdhost_log_buf) {
+		LOG_ENTRY_T *entry;
+		unsigned long flags;
+
+		spin_lock_irqsave(&log_lock, flags);
+
+		entry = sdhost_log_buf + sdhost_log_idx;
+		memcpy(entry->event, event, 4);
+		entry->timestamp = (readl(timer_base + 4) & 0x3fffffff) +
+			(smp_processor_id()<<30);
+		entry->param1 = param1;
+		entry->param2 = param2;
+		sdhost_log_idx = (sdhost_log_idx + 1) % LOG_ENTRIES;
+
+		spin_unlock_irqrestore(&log_lock, flags);
+	}
+}
+
+static void log_dump(void)
+{
+	if (sdhost_log_buf) {
+		LOG_ENTRY_T *entry;
+		unsigned long flags;
+		int idx;
+
+		spin_lock_irqsave(&log_lock, flags);
+
+		idx = sdhost_log_idx;
+		do {
+			entry = sdhost_log_buf + idx;
+			if (entry->event[0] != '\0')
+				pr_info("[%08x] %.4s %x %x\n",
+				       entry->timestamp,
+				       entry->event,
+				       entry->param1,
+				       entry->param2);
+			idx = (idx + 1) % LOG_ENTRIES;
+		} while (idx != sdhost_log_idx);
+
+		spin_unlock_irqrestore(&log_lock, flags);
+	}
+}
+
+#define log_event(event, param1, param2) log_event_impl(event, param1, param2)
+
+#else
+
+#define log_init(x) (void)0
+#define log_event(event, param1, param2) (void)0
+#define log_dump() (void)0
+
+#endif
+
+static inline void bcm2835_sdhost_write(struct bcm2835_host *host, u32 val, int reg)
+{
+	writel(val, host->ioaddr + reg);
+}
+
+static inline u32 bcm2835_sdhost_read(struct bcm2835_host *host, int reg)
+{
+	return readl(host->ioaddr + reg);
+}
+
+static inline u32 bcm2835_sdhost_read_relaxed(struct bcm2835_host *host, int reg)
+{
+	return readl_relaxed(host->ioaddr + reg);
+}
+
+static void bcm2835_sdhost_dumpcmd(struct bcm2835_host *host,
+				   struct mmc_command *cmd,
+				   const char *label)
+{
+	if (cmd)
+		pr_info("%s:%c%s op %d arg 0x%x flags 0x%x - resp %08x %08x %08x %08x, err %d\n",
+			mmc_hostname(host->mmc),
+			(cmd == host->cmd) ? '>' : ' ',
+			label, cmd->opcode, cmd->arg, cmd->flags,
+			cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3],
+			cmd->error);
+}
+
+static void bcm2835_sdhost_dumpregs(struct bcm2835_host *host)
+{
+	if (host->mrq)
+	{
+		bcm2835_sdhost_dumpcmd(host, host->mrq->sbc, "sbc");
+		bcm2835_sdhost_dumpcmd(host, host->mrq->cmd, "cmd");
+		if (host->mrq->data)
+			pr_info("%s: data blocks %x blksz %x - err %d\n",
+			       mmc_hostname(host->mmc),
+			       host->mrq->data->blocks,
+			       host->mrq->data->blksz,
+			       host->mrq->data->error);
+		bcm2835_sdhost_dumpcmd(host, host->mrq->stop, "stop");
+	}
+
+	pr_info("%s: =========== REGISTER DUMP ===========\n",
+		mmc_hostname(host->mmc));
+
+	pr_info("%s: SDCMD  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDCMD));
+	pr_info("%s: SDARG  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDARG));
+	pr_info("%s: SDTOUT 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDTOUT));
+	pr_info("%s: SDCDIV 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDCDIV));
+	pr_info("%s: SDRSP0 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP0));
+	pr_info("%s: SDRSP1 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP1));
+	pr_info("%s: SDRSP2 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP2));
+	pr_info("%s: SDRSP3 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP3));
+	pr_info("%s: SDHSTS 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHSTS));
+	pr_info("%s: SDVDD  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDVDD));
+	pr_info("%s: SDEDM  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDEDM));
+	pr_info("%s: SDHCFG 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHCFG));
+	pr_info("%s: SDHBCT 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHBCT));
+	pr_info("%s: SDHBLC 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHBLC));
+
+	pr_info("%s: ===========================================\n",
+		mmc_hostname(host->mmc));
+}
+
+static void bcm2835_sdhost_set_power(struct bcm2835_host *host, bool on)
+{
+	bcm2835_sdhost_write(host, on ? 1 : 0, SDVDD);
+}
+
+static void bcm2835_sdhost_reset_internal(struct bcm2835_host *host)
+{
+	u32 temp;
+
+	if (host->debug)
+		pr_info("%s: reset\n", mmc_hostname(host->mmc));
+
+	bcm2835_sdhost_set_power(host, false);
+
+	bcm2835_sdhost_write(host, 0, SDCMD);
+	bcm2835_sdhost_write(host, 0, SDARG);
+	bcm2835_sdhost_write(host, 0xf00000, SDTOUT);
+	bcm2835_sdhost_write(host, 0, SDCDIV);
+	bcm2835_sdhost_write(host, 0x7f8, SDHSTS); /* Write 1s to clear */
+	bcm2835_sdhost_write(host, 0, SDHCFG);
+	bcm2835_sdhost_write(host, 0, SDHBCT);
+	bcm2835_sdhost_write(host, 0, SDHBLC);
+
+	/* Limit fifo usage due to silicon bug */
+	temp = bcm2835_sdhost_read(host, SDEDM);
+	temp &= ~((SDEDM_THRESHOLD_MASK<<SDEDM_READ_THRESHOLD_SHIFT) |
+		  (SDEDM_THRESHOLD_MASK<<SDEDM_WRITE_THRESHOLD_SHIFT));
+	temp |= (FIFO_READ_THRESHOLD << SDEDM_READ_THRESHOLD_SHIFT) |
+		(FIFO_WRITE_THRESHOLD << SDEDM_WRITE_THRESHOLD_SHIFT);
+	bcm2835_sdhost_write(host, temp, SDEDM);
+	mdelay(10);
+	bcm2835_sdhost_set_power(host, true);
+	mdelay(10);
+	host->clock = 0;
+	host->sectors = 0;
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+	bcm2835_sdhost_write(host, SDCDIV_MAX_CDIV, SDCDIV);
+	mmiowb();
+}
+
+static void bcm2835_sdhost_reset(struct mmc_host *mmc)
+{
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+	spin_lock_irqsave(&host->lock, flags);
+	log_event("RST<", 0, 0);
+
+	bcm2835_sdhost_reset_internal(host);
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
+
+static void bcm2835_sdhost_init(struct bcm2835_host *host, int soft)
+{
+	pr_debug("bcm2835_sdhost_init(%d)\n", soft);
+
+	/* Set interrupt enables */
+	host->hcfg = SDHCFG_BUSY_IRPT_EN;
+
+	bcm2835_sdhost_reset_internal(host);
+
+	if (soft) {
+		/* force clock reconfiguration */
+		host->clock = 0;
+		bcm2835_sdhost_set_ios(host->mmc, &host->mmc->ios);
+	}
+}
+
+static void bcm2835_sdhost_wait_transfer_complete(struct bcm2835_host *host)
+{
+	int timediff;
+	u32 alternate_idle;
+	u32 edm;
+
+	alternate_idle = (host->mrq->data->flags & MMC_DATA_READ) ?
+		SDEDM_FSM_READWAIT : SDEDM_FSM_WRITESTART1;
+
+	edm = bcm2835_sdhost_read(host, SDEDM);
+
+	log_event("WTC<", edm, 0);
+
+	timediff = 0;
+
+	while (1) {
+		u32 fsm = edm & SDEDM_FSM_MASK;
+		if ((fsm == SDEDM_FSM_IDENTMODE) ||
+		    (fsm == SDEDM_FSM_DATAMODE))
+			break;
+		if (fsm == alternate_idle) {
+			bcm2835_sdhost_write(host,
+					     edm | SDEDM_FORCE_DATA_MODE,
+					     SDEDM);
+			break;
+		}
+
+		timediff++;
+		if (timediff == 100000) {
+			pr_err("%s: wait_transfer_complete - still waiting after %d retries\n",
+			       mmc_hostname(host->mmc),
+			       timediff);
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+			host->mrq->data->error = -ETIMEDOUT;
+			log_event("WTC!", edm, 0);
+			return;
+		}
+		cpu_relax();
+		edm = bcm2835_sdhost_read(host, SDEDM);
+	}
+	log_event("WTC>", edm, 0);
+}
+
+static void bcm2835_sdhost_finish_data(struct bcm2835_host *host);
+
+static void bcm2835_sdhost_dma_complete(void *param)
+{
+	struct bcm2835_host *host = param;
+	struct mmc_data *data = host->data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	log_event("DMA<", (u32)host->data, bcm2835_sdhost_read(host, SDHSTS));
+	log_event("DMA ", bcm2835_sdhost_read(host, SDCMD),
+		  bcm2835_sdhost_read(host, SDEDM));
+
+	if (host->dma_chan) {
+		dma_unmap_sg(host->dma_chan->device->dev,
+			     data->sg, data->sg_len,
+			     host->dma_dir);
+
+		host->dma_chan = NULL;
+	}
+
+	if (host->drain_words) {
+		void *page;
+		u32 *buf;
+
+		page = kmap_atomic(host->drain_page);
+		buf = page + host->drain_offset;
+
+		while (host->drain_words) {
+			u32 edm = bcm2835_sdhost_read(host, SDEDM);
+			if ((edm >> 4) & 0x1f)
+				*(buf++) = bcm2835_sdhost_read(host,
+							       SDDATA);
+			host->drain_words--;
+		}
+
+		kunmap_atomic(page);
+	}
+
+	bcm2835_sdhost_finish_data(host);
+
+	log_event("DMA>", (u32)host->data, 0);
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_read_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len;
+	u32 *buf;
+	unsigned long wait_max;
+
+	blksize = host->data->blksz;
+
+	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		int copy_words;
+		u32 hsts = 0;
+
+		if (!sg_miter_next(&host->sg_miter)) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		len = min(host->sg_miter.length, blksize);
+		if (len % 4) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = (u32 *)host->sg_miter.addr;
+
+		copy_words = len/4;
+
+		while (copy_words) {
+			int burst_words, words;
+			u32 edm;
+
+			burst_words = SDDATA_FIFO_PIO_BURST;
+			if (burst_words > copy_words)
+				burst_words = copy_words;
+			edm = bcm2835_sdhost_read(host, SDEDM);
+			words = ((edm >> 4) & 0x1f);
+
+			if (words < burst_words) {
+				int fsm_state = (edm & SDEDM_FSM_MASK);
+				if ((fsm_state != SDEDM_FSM_READDATA) &&
+				    (fsm_state != SDEDM_FSM_READWAIT) &&
+				    (fsm_state != SDEDM_FSM_READCRC)) {
+					hsts = bcm2835_sdhost_read(host,
+								   SDHSTS);
+					pr_info("%s: fsm %x, hsts %x\n",
+					       mmc_hostname(host->mmc),
+					       fsm_state, hsts);
+					if (hsts & SDHSTS_ERROR_MASK)
+						break;
+				}
+
+				if (time_after(jiffies, wait_max)) {
+					pr_err("%s: PIO read timeout - EDM %x\n",
+					       mmc_hostname(host->mmc),
+					       edm);
+					hsts = SDHSTS_REW_TIME_OUT;
+					break;
+				}
+				ndelay((burst_words - words) *
+				       host->ns_per_fifo_word);
+				continue;
+			} else if (words > copy_words) {
+				words = copy_words;
+			}
+
+			copy_words -= words;
+
+			while (words) {
+				*(buf++) = bcm2835_sdhost_read(host, SDDATA);
+				words--;
+			}
+		}
+
+		if (hsts & SDHSTS_ERROR_MASK)
+			break;
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+static void bcm2835_sdhost_write_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len;
+	u32 *buf;
+	unsigned long wait_max;
+
+	blksize = host->data->blksz;
+
+	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		int copy_words;
+		u32 hsts = 0;
+
+		if (!sg_miter_next(&host->sg_miter)) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		len = min(host->sg_miter.length, blksize);
+		if (len % 4) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = (u32 *)host->sg_miter.addr;
+
+		copy_words = len/4;
+
+		while (copy_words) {
+			int burst_words, words;
+			u32 edm;
+
+			burst_words = SDDATA_FIFO_PIO_BURST;
+			if (burst_words > copy_words)
+				burst_words = copy_words;
+			edm = bcm2835_sdhost_read(host, SDEDM);
+			words = SDDATA_FIFO_WORDS - ((edm >> 4) & 0x1f);
+
+			if (words < burst_words) {
+				int fsm_state = (edm & SDEDM_FSM_MASK);
+				if ((fsm_state != SDEDM_FSM_WRITEDATA) &&
+				    (fsm_state != SDEDM_FSM_WRITESTART1) &&
+				    (fsm_state != SDEDM_FSM_WRITESTART2)) {
+					hsts = bcm2835_sdhost_read(host,
+								   SDHSTS);
+					pr_info("%s: fsm %x, hsts %x\n",
+					       mmc_hostname(host->mmc),
+					       fsm_state, hsts);
+					if (hsts & SDHSTS_ERROR_MASK)
+						break;
+				}
+
+				if (time_after(jiffies, wait_max)) {
+					pr_err("%s: PIO write timeout - EDM %x\n",
+					       mmc_hostname(host->mmc),
+					       edm);
+					hsts = SDHSTS_REW_TIME_OUT;
+					break;
+				}
+				ndelay((burst_words - words) *
+				       host->ns_per_fifo_word);
+				continue;
+			} else if (words > copy_words) {
+				words = copy_words;
+			}
+
+			copy_words -= words;
+
+			while (words) {
+				bcm2835_sdhost_write(host, *(buf++), SDDATA);
+				words--;
+			}
+		}
+
+		if (hsts & SDHSTS_ERROR_MASK)
+			break;
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+static void bcm2835_sdhost_transfer_pio(struct bcm2835_host *host)
+{
+	u32 sdhsts;
+	bool is_read;
+	BUG_ON(!host->data);
+	log_event("XFP<", (u32)host->data, host->blocks);
+
+	is_read = (host->data->flags & MMC_DATA_READ) != 0;
+	if (is_read)
+		bcm2835_sdhost_read_block_pio(host);
+	else
+		bcm2835_sdhost_write_block_pio(host);
+
+	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
+	if (sdhsts & (SDHSTS_CRC16_ERROR |
+		      SDHSTS_CRC7_ERROR |
+		      SDHSTS_FIFO_ERROR)) {
+		pr_err("%s: %s transfer error - HSTS %x\n",
+		       mmc_hostname(host->mmc),
+		       is_read ? "read" : "write",
+		       sdhsts);
+		host->data->error = -EILSEQ;
+	} else if ((sdhsts & (SDHSTS_CMD_TIME_OUT |
+			      SDHSTS_REW_TIME_OUT))) {
+		pr_err("%s: %s timeout error - HSTS %x\n",
+		       mmc_hostname(host->mmc),
+		       is_read ? "read" : "write",
+		       sdhsts);
+		host->data->error = -ETIMEDOUT;
+	}
+	log_event("XFP>", (u32)host->data, host->blocks);
+}
+
+static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
+	struct mmc_data *data)
+{
+	int len, dir_data, dir_slave;
+	struct dma_async_tx_descriptor *desc = NULL;
+	struct dma_chan *dma_chan;
+
+	log_event("PRD<", (u32)data, 0);
+	pr_debug("bcm2835_sdhost_prepare_dma()\n");
+
+	dma_chan = host->dma_chan_rxtx;
+	if (data->flags & MMC_DATA_READ) {
+		dir_data = DMA_FROM_DEVICE;
+		dir_slave = DMA_DEV_TO_MEM;
+	} else {
+		dir_data = DMA_TO_DEVICE;
+		dir_slave = DMA_MEM_TO_DEV;
+	}
+	log_event("PRD1", (u32)dma_chan, 0);
+
+	BUG_ON(!dma_chan->device);
+	BUG_ON(!dma_chan->device->dev);
+	BUG_ON(!data->sg);
+
+	/* The block doesn't manage the FIFO DREQs properly for multi-block
+	   transfers, so don't attempt to DMA the final few words.
+	   Unfortunately this requires the final sg entry to be trimmed.
+	   N.B. This code demands that the overspill is contained in
+	   a single sg entry.
+	*/
+
+	host->drain_words = 0;
+	if ((data->blocks > 1) && (dir_data == DMA_FROM_DEVICE)) {
+		struct scatterlist *sg;
+		u32 len;
+		int i;
+
+		len = min((u32)(FIFO_READ_THRESHOLD - 1) * 4,
+			  (u32)data->blocks * data->blksz);
+
+		for_each_sg(data->sg, sg, data->sg_len, i) {
+			if (sg_is_last(sg)) {
+				BUG_ON(sg->length < len);
+				sg->length -= len;
+				host->drain_page = sg_page(sg);
+				host->drain_offset = sg->offset + sg->length;
+			}
+		}
+		host->drain_words = len/4;
+	}
+
+	/* The parameters have already been validated, so this will not fail */
+	(void)dmaengine_slave_config(dma_chan,
+				     (dir_data == DMA_FROM_DEVICE) ?
+				     &host->dma_cfg_rx :
+				     &host->dma_cfg_tx);
+
+	len = dma_map_sg(dma_chan->device->dev, data->sg, data->sg_len,
+			 dir_data);
+
+	log_event("PRD2", len, 0);
+	if (len > 0)
+		desc = dmaengine_prep_slave_sg(dma_chan, data->sg,
+					       len, dir_slave,
+					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	log_event("PRD3", (u32)desc, 0);
+
+	if (desc) {
+		desc->callback = bcm2835_sdhost_dma_complete;
+		desc->callback_param = host;
+		host->dma_desc = desc;
+		host->dma_chan = dma_chan;
+		host->dma_dir = dir_data;
+	}
+	log_event("PDM>", (u32)data, 0);
+}
+
+static void bcm2835_sdhost_start_dma(struct bcm2835_host *host)
+{
+	log_event("SDMA", (u32)host->data, (u32)host->dma_chan);
+	dmaengine_submit(host->dma_desc);
+	dma_async_issue_pending(host->dma_chan);
+}
+
+static void bcm2835_sdhost_set_transfer_irqs(struct bcm2835_host *host)
+{
+	u32 all_irqs = SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN |
+		SDHCFG_BUSY_IRPT_EN;
+	if (host->dma_desc)
+		host->hcfg = (host->hcfg & ~all_irqs) |
+			SDHCFG_BUSY_IRPT_EN;
+	else
+		host->hcfg = (host->hcfg & ~all_irqs) |
+			SDHCFG_DATA_IRPT_EN |
+			SDHCFG_BUSY_IRPT_EN;
+
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+}
+
+static void bcm2835_sdhost_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
+{
+	struct mmc_data *data = cmd->data;
+
+	WARN_ON(host->data);
+
+	host->data = data;
+	if (!data)
+		return;
+
+	/* Sanity checks */
+	BUG_ON(data->blksz * data->blocks > 524288);
+	BUG_ON(data->blksz > host->mmc->max_blk_size);
+	BUG_ON(data->blocks > 65535);
+
+	host->data_complete = 0;
+	host->flush_fifo = 0;
+	host->data->bytes_xfered = 0;
+
+	if (!host->sectors && host->mmc->card) {
+		struct mmc_card *card = host->mmc->card;
+		if (!mmc_card_sd(card) && mmc_card_blockaddr(card)) {
+			/*
+			 * The EXT_CSD sector count is in number of 512 byte
+			 * sectors.
+			 */
+			host->sectors = card->ext_csd.sectors;
+		} else {
+			/*
+			 * The CSD capacity field is in units of read_blkbits.
+			 * set_capacity takes units of 512 bytes.
+			 */
+			host->sectors = card->csd.capacity <<
+				(card->csd.read_blkbits - 9);
+		}
+	}
+
+	if (!host->dma_desc) {
+		/* Use PIO */
+		int flags = SG_MITER_ATOMIC;
+
+		if (data->flags & MMC_DATA_READ)
+			flags |= SG_MITER_TO_SG;
+		else
+			flags |= SG_MITER_FROM_SG;
+		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
+		host->blocks = data->blocks;
+	}
+
+	bcm2835_sdhost_set_transfer_irqs(host);
+
+	bcm2835_sdhost_write(host, data->blksz, SDHBCT);
+	bcm2835_sdhost_write(host, data->blocks, SDHBLC);
+
+	BUG_ON(!host->data);
+}
+
+bool bcm2835_sdhost_send_command(struct bcm2835_host *host,
+				 struct mmc_command *cmd)
+{
+	u32 sdcmd, sdhsts;
+	unsigned long timeout;
+	int delay;
+
+	WARN_ON(host->cmd);
+	log_event("CMD<", cmd->opcode, cmd->arg);
+
+	if (cmd->data)
+		pr_debug("%s: send_command %d 0x%x "
+			 "(flags 0x%x) - %s %d*%d\n",
+			 mmc_hostname(host->mmc),
+			 cmd->opcode, cmd->arg, cmd->flags,
+			 (cmd->data->flags & MMC_DATA_READ) ?
+			 "read" : "write", cmd->data->blocks,
+			 cmd->data->blksz);
+	else
+		pr_debug("%s: send_command %d 0x%x (flags 0x%x)\n",
+			 mmc_hostname(host->mmc),
+			 cmd->opcode, cmd->arg, cmd->flags);
+
+	/* Wait max 100 ms */
+	timeout = 10000;
+
+	while (bcm2835_sdhost_read(host, SDCMD) & SDCMD_NEW_FLAG) {
+		if (timeout == 0) {
+			pr_warn("%s: previous command never completed.\n",
+				mmc_hostname(host->mmc));
+			if (host->debug)
+				bcm2835_sdhost_dumpregs(host);
+			cmd->error = -EILSEQ;
+			tasklet_schedule(&host->finish_tasklet);
+			return false;
+		}
+		timeout--;
+		udelay(10);
+	}
+
+	delay = (10000 - timeout)/100;
+	if (delay > host->max_delay) {
+		host->max_delay = delay;
+		pr_warning("%s: controller hung for %d ms\n",
+			   mmc_hostname(host->mmc),
+			   host->max_delay);
+	}
+
+	timeout = jiffies;
+	if (!cmd->data && cmd->busy_timeout > 9000)
+		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
+	else
+		timeout += 10 * HZ;
+	mod_timer(&host->timer, timeout);
+
+	host->cmd = cmd;
+
+	/* Clear any error flags */
+	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
+	if (sdhsts & SDHSTS_ERROR_MASK)
+		bcm2835_sdhost_write(host, sdhsts, SDHSTS);
+
+	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
+		pr_err("%s: unsupported response type!\n",
+			mmc_hostname(host->mmc));
+		cmd->error = -EINVAL;
+		tasklet_schedule(&host->finish_tasklet);
+		return false;
+	}
+
+	bcm2835_sdhost_prepare_data(host, cmd);
+
+	bcm2835_sdhost_write(host, cmd->arg, SDARG);
+
+	sdcmd = cmd->opcode & SDCMD_CMD_MASK;
+
+	host->use_busy = 0;
+	if (!(cmd->flags & MMC_RSP_PRESENT)) {
+		sdcmd |= SDCMD_NO_RESPONSE;
+	} else {
+		if (cmd->flags & MMC_RSP_136)
+			sdcmd |= SDCMD_LONG_RESPONSE;
+		if (cmd->flags & MMC_RSP_BUSY) {
+			sdcmd |= SDCMD_BUSYWAIT;
+			host->use_busy = 1;
+		}
+	}
+
+	if (cmd->data) {
+		log_event("CMDD", cmd->data->blocks, cmd->data->blksz);
+		if (host->delay_after_this_stop) {
+			struct timeval now;
+			int time_since_stop;
+			do_gettimeofday(&now);
+			time_since_stop = (now.tv_sec - host->stop_time.tv_sec);
+			if (time_since_stop < 2) {
+				/* Possibly less than one second */
+				time_since_stop = time_since_stop * 1000000 +
+					(now.tv_usec - host->stop_time.tv_usec);
+				if (time_since_stop <
+				    host->delay_after_this_stop)
+					udelay(host->delay_after_this_stop -
+					       time_since_stop);
+			}
+		}
+
+		host->delay_after_this_stop = host->delay_after_stop;
+		if ((cmd->data->flags & MMC_DATA_READ) && !host->use_sbc) {
+			/* See if read crosses one of the hazardous sectors */
+			u32 first_blk, last_blk;
+
+			/* Intentionally include the following sector because
+			   without CMD23/SBC the read may run on. */
+			first_blk = host->mrq->cmd->arg;
+			last_blk = first_blk + cmd->data->blocks;
+
+			if (((last_blk >= (host->sectors - 64)) &&
+			     (first_blk <= (host->sectors - 64))) ||
+			    ((last_blk >= (host->sectors - 32)) &&
+			     (first_blk <= (host->sectors - 32)))) {
+				host->delay_after_this_stop =
+					max(250u, host->delay_after_stop);
+			}
+		}
+
+		if (cmd->data->flags & MMC_DATA_WRITE)
+			sdcmd |= SDCMD_WRITE_CMD;
+		if (cmd->data->flags & MMC_DATA_READ)
+			sdcmd |= SDCMD_READ_CMD;
+	}
+
+	bcm2835_sdhost_write(host, sdcmd | SDCMD_NEW_FLAG, SDCMD);
+
+	return true;
+}
+
+static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
+					  unsigned long *irq_flags);
+static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host);
+
+static void bcm2835_sdhost_finish_data(struct bcm2835_host *host)
+{
+	struct mmc_data *data;
+
+	data = host->data;
+	BUG_ON(!data);
+
+	log_event("FDA<", (u32)host->mrq, (u32)host->cmd);
+	pr_debug("finish_data(error %d, stop %d, sbc %d)\n",
+	       data->error, data->stop ? 1 : 0,
+	       host->mrq->sbc ? 1 : 0);
+
+	host->hcfg &= ~(SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN);
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+
+	data->bytes_xfered = data->error ? 0 : (data->blksz * data->blocks);
+
+	host->data_complete = 1;
+
+	if (host->cmd) {
+		/*
+		 * Data managed to finish before the
+		 * command completed. Make sure we do
+		 * things in the proper order.
+		 */
+		pr_debug("Finished early - HSTS %x\n",
+			 bcm2835_sdhost_read(host, SDHSTS));
+	}
+	else
+		bcm2835_sdhost_transfer_complete(host);
+	log_event("FDA>", (u32)host->mrq, (u32)host->cmd);
+}
+
+static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
+{
+	struct mmc_data *data;
+
+	BUG_ON(host->cmd);
+	BUG_ON(!host->data);
+	BUG_ON(!host->data_complete);
+
+	data = host->data;
+	host->data = NULL;
+
+	log_event("TCM<", (u32)data, data->error);
+	pr_debug("transfer_complete(error %d, stop %d)\n",
+	       data->error, data->stop ? 1 : 0);
+
+	/*
+	 * Need to send CMD12 if -
+	 * a) open-ended multiblock transfer (no CMD23)
+	 * b) error in multiblock transfer
+	 */
+	if (host->mrq->stop && (data->error || !host->use_sbc)) {
+		if (bcm2835_sdhost_send_command(host, host->mrq->stop)) {
+			/* No busy, so poll for completion */
+			if (!host->use_busy)
+				bcm2835_sdhost_finish_command(host, NULL);
+
+			if (host->delay_after_this_stop)
+				do_gettimeofday(&host->stop_time);
+		}
+	} else {
+		bcm2835_sdhost_wait_transfer_complete(host);
+		tasklet_schedule(&host->finish_tasklet);
+	}
+	log_event("TCM>", (u32)data, 0);
+}
+
+/* If irq_flags is valid, the caller is in a thread context and is allowed
+   to sleep */
+static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
+					  unsigned long *irq_flags)
+{
+	u32 sdcmd;
+	u32 retries;
+#ifdef DEBUG
+	struct timeval before, after;
+	int timediff = 0;
+#endif
+
+	log_event("FCM<", (u32)host->mrq, (u32)host->cmd);
+	pr_debug("finish_command(%x)\n", bcm2835_sdhost_read(host, SDCMD));
+
+	BUG_ON(!host->cmd || !host->mrq);
+
+	/* Poll quickly at first */
+
+	retries = host->cmd_quick_poll_retries;
+	if (!retries) {
+		/* Work out how many polls take 1us by timing 10us */
+		struct timeval start, now;
+		int us_diff;
+
+		retries = 1;
+		do {
+			int i;
+
+			retries *= 2;
+
+			do_gettimeofday(&start);
+
+			for (i = 0; i < retries; i++) {
+				cpu_relax();
+				sdcmd = bcm2835_sdhost_read(host, SDCMD);
+			}
+
+			do_gettimeofday(&now);
+			us_diff = (now.tv_sec - start.tv_sec) * 1000000 +
+				(now.tv_usec - start.tv_usec);
+		} while (us_diff < 10);
+
+		host->cmd_quick_poll_retries = ((retries * us_diff + 9)*CMD_DALLY_US)/10 + 1;
+		retries = 1; // We've already waited long enough this time
+	}
+
+	for (sdcmd = bcm2835_sdhost_read(host, SDCMD);
+	     (sdcmd & SDCMD_NEW_FLAG) && retries;
+	     retries--) {
+		cpu_relax();
+		sdcmd = bcm2835_sdhost_read(host, SDCMD);
+	}
+
+	if (!retries) {
+		unsigned long wait_max;
+
+		if (!irq_flags) {
+			/* Schedule the work */
+			log_event("CWWQ", 0, 0);
+			schedule_work(&host->cmd_wait_wq);
+			return;
+		}
+
+		/* Wait max 100 ms */
+		wait_max = jiffies + msecs_to_jiffies(100);
+		while (time_before(jiffies, wait_max)) {
+			spin_unlock_irqrestore(&host->lock, *irq_flags);
+			usleep_range(1, 10);
+			spin_lock_irqsave(&host->lock, *irq_flags);
+			sdcmd = bcm2835_sdhost_read(host, SDCMD);
+			if (!(sdcmd & SDCMD_NEW_FLAG))
+				break;
+		}
+	}
+
+	/* Check for errors */
+	if (sdcmd & SDCMD_NEW_FLAG) {
+		if (host->debug) {
+			pr_err("%s: command %d never completed.\n",
+			       mmc_hostname(host->mmc), host->cmd->opcode);
+			bcm2835_sdhost_dumpregs(host);
+		}
+		host->cmd->error = -EILSEQ;
+		tasklet_schedule(&host->finish_tasklet);
+		return;
+	} else if (sdcmd & SDCMD_FAIL_FLAG) {
+		u32 sdhsts = bcm2835_sdhost_read(host, SDHSTS);
+
+		/* Clear the errors */
+		bcm2835_sdhost_write(host, SDHSTS_ERROR_MASK, SDHSTS);
+
+		if (host->debug)
+			pr_info("%s: error detected - CMD %x, HSTS %03x, EDM %x\n",
+				mmc_hostname(host->mmc), sdcmd, sdhsts,
+				bcm2835_sdhost_read(host, SDEDM));
+
+		if ((sdhsts & SDHSTS_CRC7_ERROR) &&
+		    (host->cmd->opcode == 1)) {
+			if (host->debug)
+				pr_info("%s: ignoring CRC7 error for CMD1\n",
+					mmc_hostname(host->mmc));
+		} else {
+			if (sdhsts & SDHSTS_CMD_TIME_OUT) {
+				if (host->debug)
+					pr_warn("%s: command %d timeout\n",
+					       mmc_hostname(host->mmc),
+					       host->cmd->opcode);
+				host->cmd->error = -ETIMEDOUT;
+			} else {
+				pr_warn("%s: unexpected command %d error\n",
+				       mmc_hostname(host->mmc),
+				       host->cmd->opcode);
+				host->cmd->error = -EILSEQ;
+			}
+			tasklet_schedule(&host->finish_tasklet);
+			return;
+		}
+	}
+
+	if (host->cmd->flags & MMC_RSP_PRESENT) {
+		if (host->cmd->flags & MMC_RSP_136) {
+			int i;
+			for (i = 0; i < 4; i++)
+				host->cmd->resp[3 - i] = bcm2835_sdhost_read(host, SDRSP0 + i*4);
+			pr_debug("%s: finish_command %08x %08x %08x %08x\n",
+				 mmc_hostname(host->mmc),
+				 host->cmd->resp[0], host->cmd->resp[1], host->cmd->resp[2], host->cmd->resp[3]);
+			log_event("RSP ", host->cmd->resp[0], host->cmd->resp[1]);
+		} else {
+			host->cmd->resp[0] = bcm2835_sdhost_read(host, SDRSP0);
+			pr_debug("%s: finish_command %08x\n",
+				 mmc_hostname(host->mmc),
+				 host->cmd->resp[0]);
+			log_event("RSP ", host->cmd->resp[0], 0);
+		}
+	}
+
+	if (host->cmd == host->mrq->sbc) {
+		/* Finished CMD23, now send actual command. */
+		host->cmd = NULL;
+		if (bcm2835_sdhost_send_command(host, host->mrq->cmd)) {
+			if (host->data && host->dma_desc)
+				/* DMA transfer starts now, PIO starts after irq */
+				bcm2835_sdhost_start_dma(host);
+
+			if (!host->use_busy)
+				bcm2835_sdhost_finish_command(host, NULL);
+		}
+	} else if (host->cmd == host->mrq->stop) {
+		/* Finished CMD12 */
+		tasklet_schedule(&host->finish_tasklet);
+	} else {
+		/* Processed actual command. */
+		host->cmd = NULL;
+		if (!host->data)
+			tasklet_schedule(&host->finish_tasklet);
+		else if (host->data_complete)
+			bcm2835_sdhost_transfer_complete(host);
+	}
+	log_event("FCM>", (u32)host->mrq, (u32)host->cmd);
+}
+
+static void bcm2835_sdhost_timeout(struct timer_list *t)
+{
+	struct bcm2835_host *host = from_timer(host, t, timer);
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	log_event("TIM<", 0, 0);
+
+	if (host->mrq) {
+		pr_err("%s: timeout waiting for hardware interrupt.\n",
+			mmc_hostname(host->mmc));
+		log_dump();
+		bcm2835_sdhost_dumpregs(host);
+
+		if (host->data) {
+			host->data->error = -ETIMEDOUT;
+			bcm2835_sdhost_finish_data(host);
+		} else {
+			if (host->cmd)
+				host->cmd->error = -ETIMEDOUT;
+			else
+				host->mrq->cmd->error = -ETIMEDOUT;
+
+			pr_debug("timeout_timer tasklet_schedule\n");
+			tasklet_schedule(&host->finish_tasklet);
+		}
+	}
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_busy_irq(struct bcm2835_host *host, u32 intmask)
+{
+	log_event("IRQB", (u32)host->cmd, intmask);
+	if (!host->cmd) {
+		pr_err("%s: got command busy interrupt 0x%08x even "
+			"though no command operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_sdhost_dumpregs(host);
+		return;
+	}
+
+	if (!host->use_busy) {
+		pr_err("%s: got command busy interrupt 0x%08x even "
+			"though not expecting one.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_sdhost_dumpregs(host);
+		return;
+	}
+	host->use_busy = 0;
+
+	if (intmask & SDHSTS_ERROR_MASK)
+	{
+		pr_err("sdhost_busy_irq: intmask %x, data %p\n", intmask, host->mrq->data);
+		if (intmask & SDHSTS_CRC7_ERROR)
+			host->cmd->error = -EILSEQ;
+		else if (intmask & (SDHSTS_CRC16_ERROR |
+				    SDHSTS_FIFO_ERROR)) {
+			if (host->mrq->data)
+				host->mrq->data->error = -EILSEQ;
+			else
+				host->cmd->error = -EILSEQ;
+		} else if (intmask & SDHSTS_REW_TIME_OUT) {
+			if (host->mrq->data)
+				host->mrq->data->error = -ETIMEDOUT;
+			else
+				host->cmd->error = -ETIMEDOUT;
+		} else if (intmask & SDHSTS_CMD_TIME_OUT)
+			host->cmd->error = -ETIMEDOUT;
+
+		if (host->debug) {
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+	}
+	else
+		bcm2835_sdhost_finish_command(host, NULL);
+}
+
+static void bcm2835_sdhost_data_irq(struct bcm2835_host *host, u32 intmask)
+{
+	/* There are no dedicated data/space available interrupt
+	   status bits, so it is necessary to use the single shared
+	   data/space available FIFO status bits. It is therefore not
+	   an error to get here when there is no data transfer in
+	   progress. */
+	log_event("IRQD", (u32)host->data, intmask);
+	if (!host->data)
+		return;
+
+	if (intmask & (SDHSTS_CRC16_ERROR |
+		       SDHSTS_FIFO_ERROR |
+		       SDHSTS_REW_TIME_OUT)) {
+		if (intmask & (SDHSTS_CRC16_ERROR |
+			       SDHSTS_FIFO_ERROR))
+			host->data->error = -EILSEQ;
+		else
+			host->data->error = -ETIMEDOUT;
+
+		if (host->debug) {
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+	}
+
+	if (host->data->error) {
+		bcm2835_sdhost_finish_data(host);
+	} else if (host->data->flags & MMC_DATA_WRITE) {
+		/* Use the block interrupt for writes after the first block */
+		host->hcfg &= ~(SDHCFG_DATA_IRPT_EN);
+		host->hcfg |= SDHCFG_BLOCK_IRPT_EN;
+		bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+		bcm2835_sdhost_transfer_pio(host);
+	} else {
+		bcm2835_sdhost_transfer_pio(host);
+		host->blocks--;
+		if ((host->blocks == 0) || host->data->error)
+			bcm2835_sdhost_finish_data(host);
+	}
+}
+
+static void bcm2835_sdhost_block_irq(struct bcm2835_host *host, u32 intmask)
+{
+	log_event("IRQK", (u32)host->data, intmask);
+	if (!host->data) {
+		pr_err("%s: got block interrupt 0x%08x even "
+			"though no data operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_sdhost_dumpregs(host);
+		return;
+	}
+
+	if (intmask & (SDHSTS_CRC16_ERROR |
+		       SDHSTS_FIFO_ERROR |
+		       SDHSTS_REW_TIME_OUT)) {
+		if (intmask & (SDHSTS_CRC16_ERROR |
+			       SDHSTS_FIFO_ERROR))
+			host->data->error = -EILSEQ;
+		else
+			host->data->error = -ETIMEDOUT;
+
+		if (host->debug) {
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+	}
+
+	if (!host->dma_desc) {
+		BUG_ON(!host->blocks);
+		if (host->data->error || (--host->blocks == 0)) {
+			bcm2835_sdhost_finish_data(host);
+		} else {
+			bcm2835_sdhost_transfer_pio(host);
+		}
+	} else if (host->data->flags & MMC_DATA_WRITE) {
+		bcm2835_sdhost_finish_data(host);
+	}
+}
+
+static irqreturn_t bcm2835_sdhost_irq(int irq, void *dev_id)
+{
+	irqreturn_t result = IRQ_NONE;
+	struct bcm2835_host *host = dev_id;
+	u32 intmask;
+
+	spin_lock(&host->lock);
+
+	intmask = bcm2835_sdhost_read(host, SDHSTS);
+	log_event("IRQ<", intmask, 0);
+
+	bcm2835_sdhost_write(host,
+			     SDHSTS_BUSY_IRPT |
+			     SDHSTS_BLOCK_IRPT |
+			     SDHSTS_SDIO_IRPT |
+			     SDHSTS_DATA_FLAG,
+			     SDHSTS);
+
+	if (intmask & SDHSTS_BLOCK_IRPT) {
+		bcm2835_sdhost_block_irq(host, intmask);
+		result = IRQ_HANDLED;
+	}
+
+	if (intmask & SDHSTS_BUSY_IRPT) {
+		bcm2835_sdhost_busy_irq(host, intmask);
+		result = IRQ_HANDLED;
+	}
+
+	/* There is no true data interrupt status bit, so it is
+	   necessary to qualify the data flag with the interrupt
+	   enable bit */
+	if ((intmask & SDHSTS_DATA_FLAG) &&
+	    (host->hcfg & SDHCFG_DATA_IRPT_EN)) {
+		bcm2835_sdhost_data_irq(host, intmask);
+		result = IRQ_HANDLED;
+	}
+
+	mmiowb();
+
+	log_event("IRQ>", bcm2835_sdhost_read(host, SDHSTS), 0);
+	spin_unlock(&host->lock);
+
+	return result;
+}
+
+void bcm2835_sdhost_set_clock(struct bcm2835_host *host, unsigned int clock)
+{
+	int div = 0; /* Initialized for compiler warning */
+	unsigned int input_clock = clock;
+	unsigned long flags;
+
+	if (host->debug)
+		pr_info("%s: set_clock(%d)\n", mmc_hostname(host->mmc), clock);
+
+	if (host->overclock_50 && (clock == 50*MHZ))
+		clock = host->overclock_50 * MHZ + (MHZ - 1);
+
+	/* The SDCDIV register has 11 bits, and holds (div - 2).
+	   But in data mode the max is 50MHz wihout a minimum, and only the
+	   bottom 3 bits are used. Since the switch over is automatic (unless
+	   we have marked the card as slow...), chosen values have to make
+	   sense in both modes.
+	   Ident mode must be 100-400KHz, so can range check the requested
+	   clock. CMD15 must be used to return to data mode, so this can be
+	   monitored.
+
+	   clock 250MHz -> 0->125MHz, 1->83.3MHz, 2->62.5MHz, 3->50.0MHz
+                           4->41.7MHz, 5->35.7MHz, 6->31.3MHz, 7->27.8MHz
+
+			 623->400KHz/27.8MHz
+			 reset value (507)->491159/50MHz
+
+	   BUT, the 3-bit clock divisor in data mode is too small if the
+	   core clock is higher than 250MHz, so instead use the SLOW_CARD
+	   configuration bit to force the use of the ident clock divisor
+	   at all times.
+	*/
+
+	host->mmc->actual_clock = 0;
+
+	if (host->firmware_sets_cdiv) {
+		u32 msg[3] = { clock, 0, 0 };
+
+		rpi_firmware_property(rpi_firmware_get(NULL),
+				      RPI_FIRMWARE_SET_SDHOST_CLOCK,
+				      &msg, sizeof(msg));
+
+		clock = max(msg[1], msg[2]);
+		spin_lock_irqsave(&host->lock, flags);
+	} else {
+		spin_lock_irqsave(&host->lock, flags);
+		if (clock < 100000) {
+			/* Can't stop the clock, but make it as slow as
+			 * possible to show willing
+			 */
+			host->cdiv = SDCDIV_MAX_CDIV;
+			bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
+			mmiowb();
+			spin_unlock_irqrestore(&host->lock, flags);
+			return;
+		}
+
+		div = host->max_clk / clock;
+		if (div < 2)
+			div = 2;
+		if ((host->max_clk / div) > clock)
+			div++;
+		div -= 2;
+
+		if (div > SDCDIV_MAX_CDIV)
+			div = SDCDIV_MAX_CDIV;
+
+		clock = host->max_clk / (div + 2);
+
+		host->cdiv = div;
+		bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
+
+		if (host->debug)
+			pr_info("%s: clock=%d -> max_clk=%d, cdiv=%x "
+				"(actual clock %d)\n",
+				mmc_hostname(host->mmc), input_clock,
+				host->max_clk, host->cdiv,
+				clock);
+	}
+
+	/* Calibrate some delays */
+
+	host->ns_per_fifo_word = (1000000000/clock) *
+		((host->mmc->caps & MMC_CAP_4_BIT_DATA) ? 8 : 32);
+
+	if (input_clock == 50 * MHZ) {
+		if (clock > input_clock) {
+			/* Save the closest value, to make it easier
+			   to reduce in the event of error */
+			host->overclock_50 = (clock/MHZ);
+
+			if (clock != host->overclock) {
+				pr_info("%s: overclocking to %dHz\n",
+					mmc_hostname(host->mmc), clock);
+				host->overclock = clock;
+			}
+		} else if (host->overclock) {
+			host->overclock = 0;
+			if (clock == 50 * MHZ)
+				pr_warn("%s: cancelling overclock\n",
+					mmc_hostname(host->mmc));
+		}
+	} else if (input_clock == 0) {
+		/* Reset the preferred overclock when the clock is stopped.
+		 * This always happens during initialisation. */
+		host->overclock_50 = host->user_overclock_50;
+		host->overclock = 0;
+	}
+
+	/* Set the timeout to 500ms */
+	bcm2835_sdhost_write(host, clock/2, SDTOUT);
+
+	host->mmc->actual_clock = clock;
+	host->clock = input_clock;
+	host->reset_clock = 0;
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_request(struct mmc_host *mmc, struct mmc_request *mrq)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+	u32 edm, fsm;
+
+	host = mmc_priv(mmc);
+
+	if (host->debug) {
+		struct mmc_command *cmd = mrq->cmd;
+		BUG_ON(!cmd);
+		if (cmd->data)
+			pr_info("%s: cmd %d 0x%x (flags 0x%x) - %s %d*%d\n",
+				mmc_hostname(mmc),
+				cmd->opcode, cmd->arg, cmd->flags,
+				(cmd->data->flags & MMC_DATA_READ) ?
+				"read" : "write", cmd->data->blocks,
+				cmd->data->blksz);
+		else
+			pr_info("%s: cmd %d 0x%x (flags 0x%x)\n",
+				mmc_hostname(mmc),
+				cmd->opcode, cmd->arg, cmd->flags);
+	}
+
+	/* Reset the error statuses in case this is a retry */
+	if (mrq->sbc)
+		mrq->sbc->error = 0;
+	if (mrq->cmd)
+		mrq->cmd->error = 0;
+	if (mrq->data)
+		mrq->data->error = 0;
+	if (mrq->stop)
+		mrq->stop->error = 0;
+
+	if (mrq->data && !is_power_of_2(mrq->data->blksz)) {
+		pr_err("%s: unsupported block size (%d bytes)\n",
+		       mmc_hostname(mmc), mrq->data->blksz);
+		mrq->cmd->error = -EINVAL;
+		mmc_request_done(mmc, mrq);
+		return;
+	}
+
+	if (host->use_dma && mrq->data &&
+	    (mrq->data->blocks > host->pio_limit))
+		bcm2835_sdhost_prepare_dma(host, mrq->data);
+
+	if (host->reset_clock)
+	    bcm2835_sdhost_set_clock(host, host->clock);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	WARN_ON(host->mrq != NULL);
+	host->mrq = mrq;
+
+	edm = bcm2835_sdhost_read(host, SDEDM);
+	fsm = edm & SDEDM_FSM_MASK;
+
+	log_event("REQ<", (u32)mrq, edm);
+	if ((fsm != SDEDM_FSM_IDENTMODE) &&
+	    (fsm != SDEDM_FSM_DATAMODE)) {
+		log_event("REQ!", (u32)mrq, edm);
+		if (host->debug) {
+			pr_warn("%s: previous command (%d) not complete (EDM %x)\n",
+			       mmc_hostname(host->mmc),
+			       bcm2835_sdhost_read(host, SDCMD) & SDCMD_CMD_MASK,
+			       edm);
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+		mrq->cmd->error = -EILSEQ;
+		tasklet_schedule(&host->finish_tasklet);
+		mmiowb();
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	host->use_sbc = !!mrq->sbc &&
+		(host->mrq->data->flags & USE_CMD23_FLAGS);
+	if (host->use_sbc) {
+		if (bcm2835_sdhost_send_command(host, mrq->sbc)) {
+			if (!host->use_busy)
+				bcm2835_sdhost_finish_command(host, &flags);
+		}
+	} else if (bcm2835_sdhost_send_command(host, mrq->cmd)) {
+		if (host->data && host->dma_desc)
+			/* DMA transfer starts now, PIO starts after irq */
+			bcm2835_sdhost_start_dma(host);
+
+		if (!host->use_busy)
+			bcm2835_sdhost_finish_command(host, &flags);
+	}
+
+	log_event("CMD ", (u32)mrq->cmd->opcode,
+		   mrq->data ? (u32)mrq->data->blksz : 0);
+	mmiowb();
+
+	log_event("REQ>", (u32)mrq, 0);
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+
+	if (host->debug)
+		pr_info("%s: ios clock %d, pwr %d, bus_width %d, "
+			"timing %d, vdd %d, drv_type %d\n",
+			mmc_hostname(mmc),
+			ios->clock, ios->power_mode, ios->bus_width,
+			ios->timing, ios->signal_voltage, ios->drv_type);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	log_event("IOS<", ios->clock, 0);
+
+	/* set bus width */
+	host->hcfg &= ~SDHCFG_WIDE_EXT_BUS;
+	if (ios->bus_width == MMC_BUS_WIDTH_4)
+		host->hcfg |= SDHCFG_WIDE_EXT_BUS;
+
+	host->hcfg |= SDHCFG_WIDE_INT_BUS;
+
+	/* Disable clever clock switching, to cope with fast core clocks */
+	host->hcfg |= SDHCFG_SLOW_CARD;
+
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+
+	mmiowb();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (!ios->clock || ios->clock != host->clock)
+		bcm2835_sdhost_set_clock(host, ios->clock);
+}
+
+static struct mmc_host_ops bcm2835_sdhost_ops = {
+	.request = bcm2835_sdhost_request,
+	.set_ios = bcm2835_sdhost_set_ios,
+	.hw_reset = bcm2835_sdhost_reset,
+};
+
+static void bcm2835_sdhost_cmd_wait_work(struct work_struct *work)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+
+	host = container_of(work, struct bcm2835_host, cmd_wait_wq);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	log_event("CWK<", (u32)host->cmd, (u32)host->mrq);
+
+	/*
+	 * If this tasklet gets rescheduled while running, it will
+	 * be run again afterwards but without any active request.
+	 */
+	if (!host->mrq) {
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	bcm2835_sdhost_finish_command(host, &flags);
+
+	mmiowb();
+
+	log_event("CWK>", (u32)host->cmd, 0);
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_tasklet_finish(unsigned long param)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+	struct mmc_request *mrq;
+	struct dma_chan *terminate_chan = NULL;
+
+	host = (struct bcm2835_host *)param;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	log_event("TSK<", (u32)host->mrq, 0);
+	/*
+	 * If this tasklet gets rescheduled while running, it will
+	 * be run again afterwards but without any active request.
+	 */
+	if (!host->mrq) {
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	del_timer(&host->timer);
+
+	mrq = host->mrq;
+
+	/* Drop the overclock after any data corruption, or after any
+	 * error while overclocked. Ignore errors for status commands,
+	 * as they are likely when a card is ejected. */
+	if (host->overclock) {
+		if ((mrq->cmd && mrq->cmd->error &&
+		     (mrq->cmd->opcode != MMC_SEND_STATUS)) ||
+		    (mrq->data && mrq->data->error) ||
+		    (mrq->stop && mrq->stop->error) ||
+		    (mrq->sbc && mrq->sbc->error)) {
+			host->overclock_50--;
+			pr_warn("%s: reducing overclock due to errors\n",
+				mmc_hostname(host->mmc));
+			host->reset_clock = 1;
+			mrq->cmd->error = -ETIMEDOUT;
+			mrq->cmd->retries = 1;
+		}
+	}
+
+	host->mrq = NULL;
+	host->cmd = NULL;
+	host->data = NULL;
+
+	mmiowb();
+
+	host->dma_desc = NULL;
+	terminate_chan = host->dma_chan;
+	host->dma_chan = NULL;
+
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (terminate_chan)
+	{
+		int err = dmaengine_terminate_all(terminate_chan);
+		if (err)
+			pr_err("%s: failed to terminate DMA (%d)\n",
+			       mmc_hostname(host->mmc), err);
+	}
+
+	/* The SDHOST block doesn't report any errors for a disconnected
+	   interface. All cards and SDIO devices should report some supported
+	   voltage range, so a zero response to SEND_OP_COND, IO_SEND_OP_COND
+	   or APP_SEND_OP_COND can be treated as an error. */
+	if (((mrq->cmd->opcode == MMC_SEND_OP_COND) ||
+	     (mrq->cmd->opcode == SD_IO_SEND_OP_COND) ||
+	     (mrq->cmd->opcode == SD_APP_OP_COND)) &&
+	    (mrq->cmd->error == 0) &&
+	    (mrq->cmd->resp[0] == 0)) {
+		mrq->cmd->error = -ETIMEDOUT;
+		if (host->debug)
+			pr_info("%s: faking timeout due to zero OCR\n",
+				mmc_hostname(host->mmc));
+	}
+
+	mmc_request_done(host->mmc, mrq);
+	log_event("TSK>", (u32)mrq, 0);
+}
+
+int bcm2835_sdhost_add_host(struct bcm2835_host *host)
+{
+	struct mmc_host *mmc;
+	struct dma_slave_config cfg;
+	char pio_limit_string[20];
+	int ret;
+
+	mmc = host->mmc;
+
+	if (!mmc->f_max || mmc->f_max > host->max_clk)
+		mmc->f_max = host->max_clk;
+	mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
+
+	mmc->max_busy_timeout =  (~(unsigned int)0)/(mmc->f_max/1000);
+
+	pr_debug("f_max %d, f_min %d, max_busy_timeout %d\n",
+		 mmc->f_max, mmc->f_min, mmc->max_busy_timeout);
+
+	/* host controller capabilities */
+	mmc->caps |=
+		MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED |
+		MMC_CAP_NEEDS_POLL | MMC_CAP_HW_RESET | MMC_CAP_ERASE |
+		((ALLOW_CMD23_READ|ALLOW_CMD23_WRITE) * MMC_CAP_CMD23);
+
+	spin_lock_init(&host->lock);
+
+	if (host->allow_dma) {
+		if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
+			pr_err("%s: unable to initialise DMA channel. "
+			       "Falling back to PIO\n",
+			       mmc_hostname(mmc));
+			host->use_dma = false;
+		} else {
+			cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+			cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+			cfg.slave_id = 13;		/* DREQ channel */
+
+			/* Validate the slave configurations */
+
+			cfg.direction = DMA_MEM_TO_DEV;
+			cfg.src_addr = 0;
+			cfg.dst_addr = host->bus_addr + SDDATA;
+
+			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+
+			if (ret == 0) {
+				host->dma_cfg_tx = cfg;
+
+				cfg.direction = DMA_DEV_TO_MEM;
+				cfg.src_addr = host->bus_addr + SDDATA;
+				cfg.dst_addr = 0;
+
+				ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+			}
+
+			if (ret == 0) {
+				host->dma_cfg_rx = cfg;
+
+				host->use_dma = true;
+			} else {
+				pr_err("%s: unable to configure DMA channel. "
+				       "Falling back to PIO\n",
+				       mmc_hostname(mmc));
+				dma_release_channel(host->dma_chan_rxtx);
+				host->dma_chan_rxtx = NULL;
+				host->use_dma = false;
+			}
+		}
+	} else {
+		host->use_dma = false;
+	}
+
+	mmc->max_segs = 128;
+	mmc->max_req_size = 524288;
+	mmc->max_seg_size = mmc->max_req_size;
+	mmc->max_blk_size = 512;
+	mmc->max_blk_count =  65535;
+
+	/* report supported voltage ranges */
+	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+	tasklet_init(&host->finish_tasklet,
+		bcm2835_sdhost_tasklet_finish, (unsigned long)host);
+
+	INIT_WORK(&host->cmd_wait_wq, bcm2835_sdhost_cmd_wait_work);
+
+	timer_setup(&host->timer, bcm2835_sdhost_timeout, 0);
+
+	bcm2835_sdhost_init(host, 0);
+
+	ret = request_irq(host->irq, bcm2835_sdhost_irq, 0 /*IRQF_SHARED*/,
+				  mmc_hostname(mmc), host);
+	if (ret) {
+		pr_err("%s: failed to request IRQ %d: %d\n",
+		       mmc_hostname(mmc), host->irq, ret);
+		goto untasklet;
+	}
+
+	mmiowb();
+	mmc_add_host(mmc);
+
+	pio_limit_string[0] = '\0';
+	if (host->use_dma && (host->pio_limit > 0))
+		sprintf(pio_limit_string, " (>%d)", host->pio_limit);
+	pr_info("%s: %s loaded - DMA %s%s\n",
+		mmc_hostname(mmc), DRIVER_NAME,
+		host->use_dma ? "enabled" : "disabled",
+		pio_limit_string);
+
+	return 0;
+
+untasklet:
+	tasklet_kill(&host->finish_tasklet);
+
+	return ret;
+}
+
+static int bcm2835_sdhost_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct clk *clk;
+	struct resource *iomem;
+	struct bcm2835_host *host;
+	struct mmc_host *mmc;
+	const __be32 *addr;
+	u32 msg[3];
+	int ret;
+
+	pr_debug("bcm2835_sdhost_probe\n");
+	mmc = mmc_alloc_host(sizeof(*host), dev);
+	if (!mmc)
+		return -ENOMEM;
+
+	mmc->ops = &bcm2835_sdhost_ops;
+	host = mmc_priv(mmc);
+	host->mmc = mmc;
+	host->pio_timeout = msecs_to_jiffies(500);
+	host->pio_limit = 1;
+	host->max_delay = 1; /* Warn if over 1ms */
+	host->allow_dma = 1;
+	spin_lock_init(&host->lock);
+
+	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	host->ioaddr = devm_ioremap_resource(dev, iomem);
+	if (IS_ERR(host->ioaddr)) {
+		ret = PTR_ERR(host->ioaddr);
+		goto err;
+	}
+
+	addr = of_get_address(node, 0, NULL, NULL);
+	if (!addr) {
+		dev_err(dev, "could not get DMA-register address\n");
+		return -ENODEV;
+	}
+	host->bus_addr = be32_to_cpup(addr);
+	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
+		 (unsigned long)host->ioaddr,
+		 (unsigned long)iomem->start,
+		 (unsigned long)host->bus_addr);
+
+	if (node) {
+		/* Read any custom properties */
+		of_property_read_u32(node,
+				     "brcm,delay-after-stop",
+				     &host->delay_after_stop);
+		of_property_read_u32(node,
+				     "brcm,overclock-50",
+				     &host->user_overclock_50);
+		of_property_read_u32(node,
+				     "brcm,pio-limit",
+				     &host->pio_limit);
+		host->allow_dma =
+			!of_property_read_bool(node, "brcm,force-pio");
+		host->debug = of_property_read_bool(node, "brcm,debug");
+	}
+
+	host->dma_chan = NULL;
+	host->dma_desc = NULL;
+
+	/* Formally recognise the other way of disabling DMA */
+	if (host->pio_limit == 0x7fffffff)
+		host->allow_dma = false;
+
+	if (host->allow_dma) {
+		if (node) {
+			host->dma_chan_rxtx =
+				dma_request_slave_channel(dev, "rx-tx");
+			if (!host->dma_chan_rxtx)
+				host->dma_chan_rxtx =
+					dma_request_slave_channel(dev, "tx");
+			if (!host->dma_chan_rxtx)
+				host->dma_chan_rxtx =
+					dma_request_slave_channel(dev, "rx");
+		} else {
+			dma_cap_mask_t mask;
+
+			dma_cap_zero(mask);
+			/* we don't care about the channel, any would work */
+			dma_cap_set(DMA_SLAVE, mask);
+			host->dma_chan_rxtx =
+				dma_request_channel(mask, NULL, NULL);
+		}
+	}
+
+	clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(clk)) {
+		ret = PTR_ERR(clk);
+		if (ret == -EPROBE_DEFER)
+			dev_info(dev, "could not get clk, deferring probe\n");
+		else
+			dev_err(dev, "could not get clk\n");
+		goto err;
+	}
+
+	host->max_clk = clk_get_rate(clk);
+
+	host->irq = platform_get_irq(pdev, 0);
+	if (host->irq <= 0) {
+		dev_err(dev, "get IRQ failed\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	pr_debug(" - max_clk %lx, irq %d\n",
+		 (unsigned long)host->max_clk,
+		 (int)host->irq);
+
+	log_init(dev, iomem->start - host->bus_addr);
+
+	if (node)
+		mmc_of_parse(mmc);
+	else
+		mmc->caps |= MMC_CAP_4_BIT_DATA;
+
+	msg[0] = 0;
+	msg[1] = ~0;
+	msg[2] = ~0;
+
+	rpi_firmware_property(rpi_firmware_get(NULL),
+			      RPI_FIRMWARE_SET_SDHOST_CLOCK,
+			      &msg, sizeof(msg));
+
+	host->firmware_sets_cdiv = (msg[1] != ~0);
+
+	ret = bcm2835_sdhost_add_host(host);
+	if (ret)
+		goto err;
+
+	platform_set_drvdata(pdev, host);
+
+	pr_debug("bcm2835_sdhost_probe -> OK\n");
+
+	return 0;
+
+err:
+	pr_debug("bcm2835_sdhost_probe -> err %d\n", ret);
+	mmc_free_host(mmc);
+
+	return ret;
+}
+
+static int bcm2835_sdhost_remove(struct platform_device *pdev)
+{
+	struct bcm2835_host *host = platform_get_drvdata(pdev);
+
+	pr_debug("bcm2835_sdhost_remove\n");
+
+	mmc_remove_host(host->mmc);
+
+	bcm2835_sdhost_set_power(host, false);
+
+	free_irq(host->irq, host);
+
+	del_timer_sync(&host->timer);
+
+	tasklet_kill(&host->finish_tasklet);
+
+	mmc_free_host(host->mmc);
+	platform_set_drvdata(pdev, NULL);
+
+	pr_debug("bcm2835_sdhost_remove - OK\n");
+	return 0;
+}
+
+static const struct of_device_id bcm2835_sdhost_match[] = {
+	{ .compatible = "brcm,bcm2835-sdhost" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, bcm2835_sdhost_match);
+
+static struct platform_driver bcm2835_sdhost_driver = {
+	.probe      = bcm2835_sdhost_probe,
+	.remove     = bcm2835_sdhost_remove,
+	.driver     = {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= bcm2835_sdhost_match,
+	},
+};
+module_platform_driver(bcm2835_sdhost_driver);
+
+MODULE_ALIAS("platform:sdhost-bcm2835");
+MODULE_DESCRIPTION("BCM2835 SDHost driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Phil Elwell");
-- 
GitLab


From 270ce1368cf61c4db24e08d6db448397f9d8ce25 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Fri, 28 Oct 2016 15:36:43 +0100
Subject: [PATCH 0046/1835] vc_mem: Add vc_mem driver for querying firmware
 memory addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: popcornmix <popcornmix@gmail.com>

BCM270x: Move vc_mem

Make the vc_mem module available for ARCH_BCM2835 by moving it.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/char/broadcom/Kconfig   |  18 ++
 drivers/char/broadcom/Makefile  |   1 +
 drivers/char/broadcom/vc_mem.c  | 422 ++++++++++++++++++++++++++++++++
 include/linux/broadcom/vc_mem.h |  35 +++
 4 files changed, 476 insertions(+)
 create mode 100644 drivers/char/broadcom/Kconfig
 create mode 100644 drivers/char/broadcom/Makefile
 create mode 100644 drivers/char/broadcom/vc_mem.c
 create mode 100644 include/linux/broadcom/vc_mem.h

diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
new file mode 100644
index 0000000000000..fc1315209dab9
--- /dev/null
+++ b/drivers/char/broadcom/Kconfig
@@ -0,0 +1,18 @@
+#
+# Broadcom char driver config
+#
+
+menuconfig BRCM_CHAR_DRIVERS
+	bool "Broadcom Char Drivers"
+	help
+	  Broadcom's char drivers
+
+if BRCM_CHAR_DRIVERS
+
+config BCM2708_VCMEM
+	bool "Videocore Memory"
+        default y
+        help
+          Helper for videocore memory access and total size allocation.
+
+endif
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
new file mode 100644
index 0000000000000..06c5c8ad00e75
--- /dev/null
+++ b/drivers/char/broadcom/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
diff --git a/drivers/char/broadcom/vc_mem.c b/drivers/char/broadcom/vc_mem.c
new file mode 100644
index 0000000000000..d063c106de2f9
--- /dev/null
+++ b/drivers/char/broadcom/vc_mem.c
@@ -0,0 +1,422 @@
+/*****************************************************************************
+* Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+#include <linux/cdev.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include <linux/dma-mapping.h>
+#include <linux/broadcom/vc_mem.h>
+
+#define DRIVER_NAME  "vc-mem"
+
+// Device (/dev) related variables
+static dev_t vc_mem_devnum = 0;
+static struct class *vc_mem_class = NULL;
+static struct cdev vc_mem_cdev;
+static int vc_mem_inited = 0;
+
+#ifdef CONFIG_DEBUG_FS
+static struct dentry *vc_mem_debugfs_entry;
+#endif
+
+/*
+ * Videocore memory addresses and size
+ *
+ * Drivers that wish to know the videocore memory addresses and sizes should
+ * use these variables instead of the MM_IO_BASE and MM_ADDR_IO defines in
+ * headers. This allows the other drivers to not be tied down to a a certain
+ * address/size at compile time.
+ *
+ * In the future, the goal is to have the videocore memory virtual address and
+ * size be calculated at boot time rather than at compile time. The decision of
+ * where the videocore memory resides and its size would be in the hands of the
+ * bootloader (and/or kernel). When that happens, the values of these variables
+ * would be calculated and assigned in the init function.
+ */
+// in the 2835 VC in mapped above ARM, but ARM has full access to VC space
+unsigned long mm_vc_mem_phys_addr = 0x00000000;
+unsigned int mm_vc_mem_size = 0;
+unsigned int mm_vc_mem_base = 0;
+
+EXPORT_SYMBOL(mm_vc_mem_phys_addr);
+EXPORT_SYMBOL(mm_vc_mem_size);
+EXPORT_SYMBOL(mm_vc_mem_base);
+
+static uint phys_addr = 0;
+static uint mem_size = 0;
+static uint mem_base = 0;
+
+
+/****************************************************************************
+*
+*   vc_mem_open
+*
+***************************************************************************/
+
+static int
+vc_mem_open(struct inode *inode, struct file *file)
+{
+	(void) inode;
+	(void) file;
+
+	pr_debug("%s: called file = 0x%p\n", __func__, file);
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   vc_mem_release
+*
+***************************************************************************/
+
+static int
+vc_mem_release(struct inode *inode, struct file *file)
+{
+	(void) inode;
+	(void) file;
+
+	pr_debug("%s: called file = 0x%p\n", __func__, file);
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   vc_mem_get_size
+*
+***************************************************************************/
+
+static void
+vc_mem_get_size(void)
+{
+}
+
+/****************************************************************************
+*
+*   vc_mem_get_base
+*
+***************************************************************************/
+
+static void
+vc_mem_get_base(void)
+{
+}
+
+/****************************************************************************
+*
+*   vc_mem_get_current_size
+*
+***************************************************************************/
+
+int
+vc_mem_get_current_size(void)
+{
+	return mm_vc_mem_size;
+}
+
+EXPORT_SYMBOL_GPL(vc_mem_get_current_size);
+
+/****************************************************************************
+*
+*   vc_mem_ioctl
+*
+***************************************************************************/
+
+static long
+vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	int rc = 0;
+
+	(void) cmd;
+	(void) arg;
+
+	pr_debug("%s: called file = 0x%p\n", __func__, file);
+
+	switch (cmd) {
+	case VC_MEM_IOC_MEM_PHYS_ADDR:
+		{
+			pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR=0x%p\n",
+				__func__, (void *) mm_vc_mem_phys_addr);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_phys_addr,
+					 sizeof (mm_vc_mem_phys_addr)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	case VC_MEM_IOC_MEM_SIZE:
+		{
+			// Get the videocore memory size first
+			vc_mem_get_size();
+
+			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%u\n", __func__,
+				mm_vc_mem_size);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_size,
+					 sizeof (mm_vc_mem_size)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	case VC_MEM_IOC_MEM_BASE:
+		{
+			// Get the videocore memory base
+			vc_mem_get_base();
+
+			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%u\n", __func__,
+				mm_vc_mem_base);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_base,
+					 sizeof (mm_vc_mem_base)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	case VC_MEM_IOC_MEM_LOAD:
+		{
+			// Get the videocore memory base
+			vc_mem_get_base();
+
+			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%u\n", __func__,
+				mm_vc_mem_base);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_base,
+					 sizeof (mm_vc_mem_base)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	default:
+		{
+			return -ENOTTY;
+		}
+	}
+	pr_debug("%s: file = 0x%p returning %d\n", __func__, file, rc);
+
+	return rc;
+}
+
+/****************************************************************************
+*
+*   vc_mem_mmap
+*
+***************************************************************************/
+
+static int
+vc_mem_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	int rc = 0;
+	unsigned long length = vma->vm_end - vma->vm_start;
+	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+
+	pr_debug("%s: vm_start = 0x%08lx vm_end = 0x%08lx vm_pgoff = 0x%08lx\n",
+		__func__, (long) vma->vm_start, (long) vma->vm_end,
+		(long) vma->vm_pgoff);
+
+	if (offset + length > mm_vc_mem_size) {
+		pr_err("%s: length %ld is too big\n", __func__, length);
+		return -EINVAL;
+	}
+	// Do not cache the memory map
+	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+	rc = remap_pfn_range(vma, vma->vm_start,
+			     (mm_vc_mem_phys_addr >> PAGE_SHIFT) +
+			     vma->vm_pgoff, length, vma->vm_page_prot);
+	if (rc != 0) {
+		pr_err("%s: remap_pfn_range failed (rc=%d)\n", __func__, rc);
+	}
+
+	return rc;
+}
+
+/****************************************************************************
+*
+*   File Operations for the driver.
+*
+***************************************************************************/
+
+static const struct file_operations vc_mem_fops = {
+	.owner = THIS_MODULE,
+	.open = vc_mem_open,
+	.release = vc_mem_release,
+	.unlocked_ioctl = vc_mem_ioctl,
+	.mmap = vc_mem_mmap,
+};
+
+#ifdef CONFIG_DEBUG_FS
+static void vc_mem_debugfs_deinit(void)
+{
+	debugfs_remove_recursive(vc_mem_debugfs_entry);
+	vc_mem_debugfs_entry = NULL;
+}
+
+
+static int vc_mem_debugfs_init(
+	struct device *dev)
+{
+	vc_mem_debugfs_entry = debugfs_create_dir(DRIVER_NAME, NULL);
+	if (!vc_mem_debugfs_entry) {
+		dev_warn(dev, "could not create debugfs entry\n");
+		return -EFAULT;
+	}
+
+	if (!debugfs_create_x32("vc_mem_phys_addr",
+				0444,
+				vc_mem_debugfs_entry,
+				(u32 *)&mm_vc_mem_phys_addr)) {
+		dev_warn(dev, "%s:could not create vc_mem_phys entry\n",
+			__func__);
+		goto fail;
+	}
+
+	if (!debugfs_create_x32("vc_mem_size",
+				0444,
+				vc_mem_debugfs_entry,
+				(u32 *)&mm_vc_mem_size)) {
+		dev_warn(dev, "%s:could not create vc_mem_size entry\n",
+			__func__);
+		goto fail;
+	}
+
+	if (!debugfs_create_x32("vc_mem_base",
+				0444,
+				vc_mem_debugfs_entry,
+				(u32 *)&mm_vc_mem_base)) {
+		dev_warn(dev, "%s:could not create vc_mem_base entry\n",
+			 __func__);
+		goto fail;
+	}
+
+	return 0;
+
+fail:
+	vc_mem_debugfs_deinit();
+	return -EFAULT;
+}
+
+#endif /* CONFIG_DEBUG_FS */
+
+
+/****************************************************************************
+*
+*   vc_mem_init
+*
+***************************************************************************/
+
+static int __init
+vc_mem_init(void)
+{
+	int rc = -EFAULT;
+	struct device *dev;
+
+	pr_debug("%s: called\n", __func__);
+
+	mm_vc_mem_phys_addr = phys_addr;
+	mm_vc_mem_size = mem_size;
+	mm_vc_mem_base = mem_base;
+
+	vc_mem_get_size();
+
+	pr_info("vc-mem: phys_addr:0x%08lx mem_base=0x%08x mem_size:0x%08x(%u MiB)\n",
+		mm_vc_mem_phys_addr, mm_vc_mem_base, mm_vc_mem_size, mm_vc_mem_size / (1024 * 1024));
+
+	if ((rc = alloc_chrdev_region(&vc_mem_devnum, 0, 1, DRIVER_NAME)) < 0) {
+		pr_err("%s: alloc_chrdev_region failed (rc=%d)\n",
+		       __func__, rc);
+		goto out_err;
+	}
+
+	cdev_init(&vc_mem_cdev, &vc_mem_fops);
+	if ((rc = cdev_add(&vc_mem_cdev, vc_mem_devnum, 1)) != 0) {
+		pr_err("%s: cdev_add failed (rc=%d)\n", __func__, rc);
+		goto out_unregister;
+	}
+
+	vc_mem_class = class_create(THIS_MODULE, DRIVER_NAME);
+	if (IS_ERR(vc_mem_class)) {
+		rc = PTR_ERR(vc_mem_class);
+		pr_err("%s: class_create failed (rc=%d)\n", __func__, rc);
+		goto out_cdev_del;
+	}
+
+	dev = device_create(vc_mem_class, NULL, vc_mem_devnum, NULL,
+			    DRIVER_NAME);
+	if (IS_ERR(dev)) {
+		rc = PTR_ERR(dev);
+		pr_err("%s: device_create failed (rc=%d)\n", __func__, rc);
+		goto out_class_destroy;
+	}
+
+#ifdef CONFIG_DEBUG_FS
+	/* don't fail if the debug entries cannot be created */
+	vc_mem_debugfs_init(dev);
+#endif
+
+	vc_mem_inited = 1;
+	return 0;
+
+	device_destroy(vc_mem_class, vc_mem_devnum);
+
+      out_class_destroy:
+	class_destroy(vc_mem_class);
+	vc_mem_class = NULL;
+
+      out_cdev_del:
+	cdev_del(&vc_mem_cdev);
+
+      out_unregister:
+	unregister_chrdev_region(vc_mem_devnum, 1);
+
+      out_err:
+	return -1;
+}
+
+/****************************************************************************
+*
+*   vc_mem_exit
+*
+***************************************************************************/
+
+static void __exit
+vc_mem_exit(void)
+{
+	pr_debug("%s: called\n", __func__);
+
+	if (vc_mem_inited) {
+#if CONFIG_DEBUG_FS
+		vc_mem_debugfs_deinit();
+#endif
+		device_destroy(vc_mem_class, vc_mem_devnum);
+		class_destroy(vc_mem_class);
+		cdev_del(&vc_mem_cdev);
+		unregister_chrdev_region(vc_mem_devnum, 1);
+	}
+}
+
+module_init(vc_mem_init);
+module_exit(vc_mem_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Broadcom Corporation");
+
+module_param(phys_addr, uint, 0644);
+module_param(mem_size, uint, 0644);
+module_param(mem_base, uint, 0644);
diff --git a/include/linux/broadcom/vc_mem.h b/include/linux/broadcom/vc_mem.h
new file mode 100644
index 0000000000000..20a475377eb30
--- /dev/null
+++ b/include/linux/broadcom/vc_mem.h
@@ -0,0 +1,35 @@
+/*****************************************************************************
+* Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+#ifndef _VC_MEM_H
+#define _VC_MEM_H
+
+#include <linux/ioctl.h>
+
+#define VC_MEM_IOC_MAGIC  'v'
+
+#define VC_MEM_IOC_MEM_PHYS_ADDR    _IOR( VC_MEM_IOC_MAGIC, 0, unsigned long )
+#define VC_MEM_IOC_MEM_SIZE         _IOR( VC_MEM_IOC_MAGIC, 1, unsigned int )
+#define VC_MEM_IOC_MEM_BASE         _IOR( VC_MEM_IOC_MAGIC, 2, unsigned int )
+#define VC_MEM_IOC_MEM_LOAD         _IOR( VC_MEM_IOC_MAGIC, 3, unsigned int )
+
+#if defined( __KERNEL__ )
+#define VC_MEM_TO_ARM_ADDR_MASK 0x3FFFFFFF
+
+extern unsigned long mm_vc_mem_phys_addr;
+extern unsigned int  mm_vc_mem_size;
+extern int vc_mem_get_current_size( void );
+#endif
+
+#endif  /* _VC_MEM_H */
-- 
GitLab


From 26e7fd6d20349dd82bddeb759fbc86bfccaeaa38 Mon Sep 17 00:00:00 2001
From: Tim Gover <tgover@broadcom.com>
Date: Tue, 22 Jul 2014 15:41:04 +0100
Subject: [PATCH 0047/1835] vcsm: VideoCore shared memory service for BCM2835
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add experimental support for the VideoCore shared memory service.
This allows user processes to allocate memory from VideoCore's
GPU relocatable heap and mmap the buffers. Additionally, the memory
handles can passed to other VideoCore services such as MMAL, OpenMax
and DispmanX

TODO
* This driver was originally released for BCM28155 which has a different
  cache architecture to BCM2835. Consequently, in this release only
  uncached mappings are supported. However, there's no fundamental
  reason which cached mappings cannot be support or BCM2835
* More refactoring is required to remove the typedefs.
* Re-enable the some of the commented out debug-fs statistics which were
  disabled when migrating code from proc-fs.
* There's a lot of code to support sharing of VCSM in order to support
  Android. This could probably done more cleanly or perhaps just
  removed.

Signed-off-by: Tim Gover <timgover@gmail.com>

config: Disable VC_SM for now to fix hang with cutdown kernel

vcsm: Use boolean as it cannot be built as module

On building the bcm_vc_sm as a module we get the following error:

v7_dma_flush_range and do_munmap are undefined in vc-sm.ko.

Fix by making it not an option to build as module

vcsm: Add ioctl for custom cache flushing

vc-sm: Move headers out of arch directory

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

vcsm: Treat EBUSY as success rather than SIGBUS

Currently if two cores access the same page concurrently one will return VM_FAULT_NOPAGE
and the other VM_FAULT_SIGBUS crashing the user code.

Also report when mapping fails.

Signed-off-by: popcornmix <popcornmix@gmail.com>

vcsm: Provide new ioctl to clean/invalidate a 2D block

vcsm: Convert to loading via device tree.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>

VCSM: New option to import a DMABUF for VPU use

Takes a dmabuf, and then calls over to the VPU to wrap
it into a suitable handle.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>

vcsm: fix multi-platform build

vcsm: add macros for cache functions

vcsm: use dma APIs for cache functions

* Will handle multi-platform builds

vcsm: Fix up macros to avoid breaking numbers used by existing apps

vcsm: Define cache operation constants in user header

Without this change, users have to use raw values (1, 2, 3) to specify
cache operation.

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Support for finding user/vc handle in memory pool

vmcs_sm_{usr,vc}_handle_from_pid_and_address() were failing to find
handle if specified user pointer is not exactly the one that the memory
locking call returned even if the pointer is in range of map/resource.
So fixed the functions to match the range.

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Unify cache manipulating functions

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Fix obscure conditions

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Fix memory leaking on clean_invalid2 ioctl handler

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Describe the use of cache operation constants

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Fix obscure conditions again

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Add no-op cache operation constant

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Revert to do page-table-walk-based cache manipulating on some ioctl calls

On FLUSH, INVALID, CLEAN_INVALID ioctl calls, cache operations based on
page table walk were used in case that the buffer of the cache is not
pinned.  So reverted to do page-table-based cache manipulating.

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>

vcsm: Define cache operation constants in user header

Without this change, users have to use raw values (1, 2, 3) to specify
cache operation.

Signed-off-by: Sugizaki Yukimasa <i.can.speak.c.and.basic@gmail.com>
---
 drivers/char/Kconfig                     |    2 +
 drivers/char/Makefile                    |    1 +
 drivers/char/broadcom/Kconfig            |   10 +
 drivers/char/broadcom/Makefile           |    1 +
 drivers/char/broadcom/vc_sm/Makefile     |    9 +
 drivers/char/broadcom/vc_sm/vc_sm_defs.h |  237 ++
 drivers/char/broadcom/vc_sm/vc_sm_knl.h  |   53 +
 drivers/char/broadcom/vc_sm/vc_vchi_sm.c |  516 ++++
 drivers/char/broadcom/vc_sm/vc_vchi_sm.h |  102 +
 drivers/char/broadcom/vc_sm/vmcs_sm.c    | 3543 ++++++++++++++++++++++
 include/linux/broadcom/vmcs_sm_ioctl.h   |  294 ++
 11 files changed, 4768 insertions(+)
 create mode 100644 drivers/char/broadcom/vc_sm/Makefile
 create mode 100644 drivers/char/broadcom/vc_sm/vc_sm_defs.h
 create mode 100644 drivers/char/broadcom/vc_sm/vc_sm_knl.h
 create mode 100644 drivers/char/broadcom/vc_sm/vc_vchi_sm.c
 create mode 100644 drivers/char/broadcom/vc_sm/vc_vchi_sm.h
 create mode 100644 drivers/char/broadcom/vc_sm/vmcs_sm.c
 create mode 100644 include/linux/broadcom/vmcs_sm_ioctl.h

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 1df9cb8e659e2..66b424143ea7c 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -5,6 +5,8 @@
 
 menu "Character devices"
 
+source "drivers/char/broadcom/Kconfig"
+
 source "drivers/tty/Kconfig"
 
 config DEVMEM
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index b8d42b4e979bb..86a3d7846b092 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -58,3 +58,4 @@ js-rtc-y = rtc.o
 obj-$(CONFIG_XILLYBUS)		+= xillybus/
 obj-$(CONFIG_POWERNV_OP_PANEL)	+= powernv-op-panel.o
 obj-$(CONFIG_ADI)		+= adi.o
+obj-$(CONFIG_BRCM_CHAR_DRIVERS) += broadcom/
diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
index fc1315209dab9..2b6132d12b13d 100644
--- a/drivers/char/broadcom/Kconfig
+++ b/drivers/char/broadcom/Kconfig
@@ -16,3 +16,13 @@ config BCM2708_VCMEM
           Helper for videocore memory access and total size allocation.
 
 endif
+
+config BCM_VC_SM
+	bool "VMCS Shared Memory"
+	depends on BCM2835_VCHIQ
+	select BCM2708_VCMEM
+	select DMA_SHARED_BUFFER
+	default n
+	help
+	Support for the VC shared memory on the Broadcom reference
+	design. Uses the VCHIQ stack.
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
index 06c5c8ad00e75..419af4180deb0 100644
--- a/drivers/char/broadcom/Makefile
+++ b/drivers/char/broadcom/Makefile
@@ -1 +1,2 @@
 obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
diff --git a/drivers/char/broadcom/vc_sm/Makefile b/drivers/char/broadcom/vc_sm/Makefile
new file mode 100644
index 0000000000000..19ce263bc273d
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/Makefile
@@ -0,0 +1,9 @@
+ccflags-$(CONFIG_BCM_VC_SM) += -Werror -Wall -Wstrict-prototypes -Wno-trigraphs -O2
+ccflags-$(CONFIG_BCM_VC_SM) += -I"drivers/staging/vc04_services" -I"drivers/staging/vc04_services/interface/vchi" -I"drivers/staging/vc04_services/interface/vchiq_arm" -I"$(srctree)/fs/"
+ccflags-$(CONFIG_BCM_VC_SM) += -DOS_ASSERT_FAILURE -D__STDC_VERSION=199901L -D__STDC_VERSION__=199901L -D__VCCOREVER__=0 -D__KERNEL__ -D__linux__
+
+obj-$(CONFIG_BCM_VC_SM) := vc-sm.o
+
+vc-sm-objs := \
+    vmcs_sm.o \
+    vc_vchi_sm.o
diff --git a/drivers/char/broadcom/vc_sm/vc_sm_defs.h b/drivers/char/broadcom/vc_sm/vc_sm_defs.h
new file mode 100644
index 0000000000000..de6afe9f65af4
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_sm_defs.h
@@ -0,0 +1,237 @@
+/*
+ ****************************************************************************
+ * Copyright 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+#ifndef __VC_SM_DEFS_H__INCLUDED__
+#define __VC_SM_DEFS_H__INCLUDED__
+
+/* FourCC code used for VCHI connection */
+#define VC_SM_SERVER_NAME MAKE_FOURCC("SMEM")
+
+/* Maximum message length */
+#define VC_SM_MAX_MSG_LEN (sizeof(union vc_sm_msg_union_t) + \
+	sizeof(struct vc_sm_msg_hdr_t))
+#define VC_SM_MAX_RSP_LEN (sizeof(union vc_sm_msg_union_t))
+
+/* Resource name maximum size */
+#define VC_SM_RESOURCE_NAME 32
+
+enum vc_sm_msg_type {
+	/* Message types supported for HOST->VC direction */
+
+	/* Allocate shared memory block */
+	VC_SM_MSG_TYPE_ALLOC,
+	/* Lock allocated shared memory block */
+	VC_SM_MSG_TYPE_LOCK,
+	/* Unlock allocated shared memory block */
+	VC_SM_MSG_TYPE_UNLOCK,
+	/* Unlock allocated shared memory block, do not answer command */
+	VC_SM_MSG_TYPE_UNLOCK_NOANS,
+	/* Free shared memory block */
+	VC_SM_MSG_TYPE_FREE,
+	/* Resize a shared memory block */
+	VC_SM_MSG_TYPE_RESIZE,
+	/* Walk the allocated shared memory block(s) */
+	VC_SM_MSG_TYPE_WALK_ALLOC,
+
+	/* A previously applied action will need to be reverted */
+	VC_SM_MSG_TYPE_ACTION_CLEAN,
+
+	/*
+	 * Import a physical address and wrap into a MEM_HANDLE_T.
+	 * Release with VC_SM_MSG_TYPE_FREE.
+	 */
+	VC_SM_MSG_TYPE_IMPORT,
+
+	/* Message types supported for VC->HOST direction */
+
+	/*
+	 * VC has finished with an imported memory allocation.
+	 * Release any Linux reference counts on the underlying block.
+	 */
+	VC_SM_MSG_TYPE_RELEASED,
+
+	VC_SM_MSG_TYPE_MAX
+};
+
+/* Type of memory to be allocated */
+enum vc_sm_alloc_type_t {
+	VC_SM_ALLOC_CACHED,
+	VC_SM_ALLOC_NON_CACHED,
+};
+
+/* Message header for all messages in HOST->VC direction */
+struct vc_sm_msg_hdr_t {
+	int32_t type;
+	uint32_t trans_id;
+	uint8_t body[0];
+
+};
+
+/* Request to allocate memory (HOST->VC) */
+struct vc_sm_alloc_t {
+	/* type of memory to allocate */
+	enum vc_sm_alloc_type_t type;
+	/* byte amount of data to allocate per unit */
+	uint32_t base_unit;
+	/* number of unit to allocate */
+	uint32_t num_unit;
+	/* alignement to be applied on allocation */
+	uint32_t alignement;
+	/* identity of who allocated this block */
+	uint32_t allocator;
+	/* resource name (for easier tracking on vc side) */
+	char name[VC_SM_RESOURCE_NAME];
+
+};
+
+/* Result of a requested memory allocation (VC->HOST) */
+struct vc_sm_alloc_result_t {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	/* Resource handle */
+	uint32_t res_handle;
+	/* Pointer to resource buffer */
+	uint32_t res_mem;
+	/* Resource base size (bytes) */
+	uint32_t res_base_size;
+	/* Resource number */
+	uint32_t res_num;
+
+};
+
+/* Request to free a previously allocated memory (HOST->VC) */
+struct vc_sm_free_t {
+	/* Resource handle (returned from alloc) */
+	uint32_t res_handle;
+	/* Resource buffer (returned from alloc) */
+	uint32_t res_mem;
+
+};
+
+/* Request to lock a previously allocated memory (HOST->VC) */
+struct vc_sm_lock_unlock_t {
+	/* Resource handle (returned from alloc) */
+	uint32_t res_handle;
+	/* Resource buffer (returned from alloc) */
+	uint32_t res_mem;
+
+};
+
+/* Request to resize a previously allocated memory (HOST->VC) */
+struct vc_sm_resize_t {
+	/* Resource handle (returned from alloc) */
+	uint32_t res_handle;
+	/* Resource buffer (returned from alloc) */
+	uint32_t res_mem;
+	/* Resource *new* size requested (bytes) */
+	uint32_t res_new_size;
+
+};
+
+/* Result of a requested memory lock (VC->HOST) */
+struct vc_sm_lock_result_t {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	/* Resource handle */
+	uint32_t res_handle;
+	/* Pointer to resource buffer */
+	uint32_t res_mem;
+	/*
+	 * Pointer to former resource buffer if the memory
+	 * was reallocated
+	 */
+	uint32_t res_old_mem;
+
+};
+
+/* Generic result for a request (VC->HOST) */
+struct vc_sm_result_t {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	int32_t success;
+
+};
+
+/* Request to revert a previously applied action (HOST->VC) */
+struct vc_sm_action_clean_t {
+	/* Action of interest */
+	enum vc_sm_msg_type res_action;
+	/* Transaction identifier for the action of interest */
+	uint32_t action_trans_id;
+
+};
+
+/* Request to remove all data associated with a given allocator (HOST->VC) */
+struct vc_sm_free_all_t {
+	/* Allocator identifier */
+	uint32_t allocator;
+};
+
+/* Request to import memory (HOST->VC) */
+struct vc_sm_import {
+	/* type of memory to allocate */
+	enum vc_sm_alloc_type_t type;
+	/* pointer to the VC (ie physical) address of the allocated memory */
+	uint32_t addr;
+	/* size of buffer */
+	uint32_t size;
+	/* opaque handle returned in RELEASED messages */
+	int32_t  kernel_id;
+	/* Allocator identifier */
+	uint32_t allocator;
+	/* resource name (for easier tracking on vc side) */
+	char     name[VC_SM_RESOURCE_NAME];
+};
+
+/* Result of a requested memory import (VC->HOST) */
+struct vc_sm_import_result {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	/* Resource handle */
+	uint32_t res_handle;
+};
+
+/* Notification that VC has finished with an allocation (VC->HOST) */
+struct vc_sm_released {
+	/* pointer to the VC (ie physical) address of the allocated memory */
+	uint32_t addr;
+	/* size of buffer */
+	uint32_t size;
+	/* opaque handle returned in RELEASED messages */
+	int32_t  kernel_id;
+};
+
+/* Union of ALL messages */
+union vc_sm_msg_union_t {
+	struct vc_sm_alloc_t alloc;
+	struct vc_sm_alloc_result_t alloc_result;
+	struct vc_sm_free_t free;
+	struct vc_sm_lock_unlock_t lock_unlock;
+	struct vc_sm_action_clean_t action_clean;
+	struct vc_sm_resize_t resize;
+	struct vc_sm_lock_result_t lock_result;
+	struct vc_sm_result_t result;
+	struct vc_sm_free_all_t free_all;
+	struct vc_sm_import import;
+	struct vc_sm_import_result import_result;
+	struct vc_sm_released released;
+};
+
+#endif /* __VC_SM_DEFS_H__INCLUDED__ */
diff --git a/drivers/char/broadcom/vc_sm/vc_sm_knl.h b/drivers/char/broadcom/vc_sm/vc_sm_knl.h
new file mode 100644
index 0000000000000..f7f74750d8358
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_sm_knl.h
@@ -0,0 +1,53 @@
+/*
+ ****************************************************************************
+ * Copyright 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+#ifndef __VC_SM_KNL_H__INCLUDED__
+#define __VC_SM_KNL_H__INCLUDED__
+
+#if !defined(__KERNEL__)
+#error "This interface is for kernel use only..."
+#endif
+
+/* Type of memory to be locked (ie mapped) */
+enum vc_sm_lock_cache_mode {
+	VC_SM_LOCK_CACHED,
+	VC_SM_LOCK_NON_CACHED,
+};
+
+/* Allocate a shared memory handle and block. */
+int vc_sm_alloc(struct vc_sm_alloc_t *alloc, int *handle);
+
+/* Free a previously allocated shared memory handle and block. */
+int vc_sm_free(int handle);
+
+/* Lock a memory handle for use by kernel. */
+int vc_sm_lock(int handle, enum vc_sm_lock_cache_mode mode,
+	       unsigned long *data);
+
+/* Unlock a memory handle in use by kernel. */
+int vc_sm_unlock(int handle, int flush, int no_vc_unlock);
+
+/* Get an internal resource handle mapped from the external one. */
+int vc_sm_int_handle(int handle);
+
+/* Map a shared memory region for use by kernel. */
+int vc_sm_map(int handle, unsigned int sm_addr,
+	      enum vc_sm_lock_cache_mode mode, unsigned long *data);
+
+/* Import a block of memory into the GPU space. */
+int vc_sm_import_dmabuf(struct dma_buf *dmabuf, int *handle);
+
+#endif /* __VC_SM_KNL_H__INCLUDED__ */
diff --git a/drivers/char/broadcom/vc_sm/vc_vchi_sm.c b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
new file mode 100644
index 0000000000000..f8b909a09adb0
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
@@ -0,0 +1,516 @@
+/*
+ ****************************************************************************
+ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+/* ---- Include Files ----------------------------------------------------- */
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/semaphore.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/kthread.h>
+
+#include "vc_vchi_sm.h"
+
+#define VC_SM_VER  1
+#define VC_SM_MIN_VER 0
+
+/* ---- Private Constants and Types -------------------------------------- */
+
+/* Command blocks come from a pool */
+#define SM_MAX_NUM_CMD_RSP_BLKS 32
+
+struct sm_cmd_rsp_blk {
+	struct list_head head;	/* To create lists */
+	struct semaphore sema;	/* To be signaled when the response is there */
+
+	uint16_t id;
+	uint16_t length;
+
+	uint8_t msg[VC_SM_MAX_MSG_LEN];
+
+	uint32_t wait:1;
+	uint32_t sent:1;
+	uint32_t alloc:1;
+
+};
+
+struct sm_instance {
+	uint32_t num_connections;
+	VCHI_SERVICE_HANDLE_T vchi_handle[VCHI_MAX_NUM_CONNECTIONS];
+	struct task_struct *io_thread;
+	struct semaphore io_sema;
+
+	uint32_t trans_id;
+
+	struct mutex lock;
+	struct list_head cmd_list;
+	struct list_head rsp_list;
+	struct list_head dead_list;
+
+	struct sm_cmd_rsp_blk free_blk[SM_MAX_NUM_CMD_RSP_BLKS];
+	struct list_head free_list;
+	struct mutex free_lock;
+	struct semaphore free_sema;
+
+};
+
+/* ---- Private Variables ------------------------------------------------ */
+
+/* ---- Private Function Prototypes -------------------------------------- */
+
+/* ---- Private Functions ------------------------------------------------ */
+static int
+bcm2835_vchi_msg_queue(VCHI_SERVICE_HANDLE_T handle,
+		       void *data,
+		       unsigned int size)
+{
+	return vchi_queue_kernel_message(handle,
+					 data,
+					 size);
+}
+
+static struct
+sm_cmd_rsp_blk *vc_vchi_cmd_create(struct sm_instance *instance,
+		enum vc_sm_msg_type id, void *msg,
+		uint32_t size, int wait)
+{
+	struct sm_cmd_rsp_blk *blk;
+	struct vc_sm_msg_hdr_t *hdr;
+
+	if (down_interruptible(&instance->free_sema)) {
+		blk = kmalloc(sizeof(*blk), GFP_KERNEL);
+		if (!blk)
+			return NULL;
+
+		blk->alloc = 1;
+		sema_init(&blk->sema, 0);
+	} else {
+		mutex_lock(&instance->free_lock);
+		blk =
+		    list_first_entry(&instance->free_list,
+				    struct sm_cmd_rsp_blk, head);
+		list_del(&blk->head);
+		mutex_unlock(&instance->free_lock);
+	}
+
+	blk->sent = 0;
+	blk->wait = wait;
+	blk->length = sizeof(*hdr) + size;
+
+	hdr = (struct vc_sm_msg_hdr_t *) blk->msg;
+	hdr->type = id;
+	mutex_lock(&instance->lock);
+	hdr->trans_id = blk->id = ++instance->trans_id;
+	mutex_unlock(&instance->lock);
+
+	if (size)
+		memcpy(hdr->body, msg, size);
+
+	return blk;
+}
+
+static void
+vc_vchi_cmd_delete(struct sm_instance *instance, struct sm_cmd_rsp_blk *blk)
+{
+	if (blk->alloc) {
+		kfree(blk);
+		return;
+	}
+
+	mutex_lock(&instance->free_lock);
+	list_add(&blk->head, &instance->free_list);
+	mutex_unlock(&instance->free_lock);
+	up(&instance->free_sema);
+}
+
+static int vc_vchi_sm_videocore_io(void *arg)
+{
+	struct sm_instance *instance = arg;
+	struct sm_cmd_rsp_blk *cmd = NULL, *cmd_tmp;
+	struct vc_sm_result_t *reply;
+	uint32_t reply_len;
+	int32_t status;
+	int svc_use = 1;
+
+	while (1) {
+		if (svc_use)
+			vchi_service_release(instance->vchi_handle[0]);
+		svc_use = 0;
+		if (!down_interruptible(&instance->io_sema)) {
+			vchi_service_use(instance->vchi_handle[0]);
+			svc_use = 1;
+
+			do {
+				/*
+				 * Get new command and move it to response list
+				 */
+				mutex_lock(&instance->lock);
+				if (list_empty(&instance->cmd_list)) {
+					/* no more commands to process */
+					mutex_unlock(&instance->lock);
+					break;
+				}
+				cmd =
+				    list_first_entry(&instance->cmd_list,
+						     struct sm_cmd_rsp_blk,
+						     head);
+				list_move(&cmd->head, &instance->rsp_list);
+				cmd->sent = 1;
+				mutex_unlock(&instance->lock);
+
+				/* Send the command */
+				status = bcm2835_vchi_msg_queue(
+						instance->vchi_handle[0],
+						cmd->msg, cmd->length);
+				if (status) {
+					pr_err("%s: failed to queue message (%d)",
+					     __func__, status);
+				}
+
+				/* If no reply is needed then we're done */
+				if (!cmd->wait) {
+					mutex_lock(&instance->lock);
+					list_del(&cmd->head);
+					mutex_unlock(&instance->lock);
+					vc_vchi_cmd_delete(instance, cmd);
+					continue;
+				}
+
+				if (status) {
+					up(&cmd->sema);
+					continue;
+				}
+
+			} while (1);
+
+			while (!vchi_msg_peek
+			       (instance->vchi_handle[0], (void **)&reply,
+				&reply_len, VCHI_FLAGS_NONE)) {
+				mutex_lock(&instance->lock);
+				list_for_each_entry(cmd, &instance->rsp_list,
+						    head) {
+					if (cmd->id == reply->trans_id)
+						break;
+				}
+				mutex_unlock(&instance->lock);
+
+				if (&cmd->head == &instance->rsp_list) {
+					pr_debug("%s: received response %u, throw away...",
+					     __func__, reply->trans_id);
+				} else if (reply_len > sizeof(cmd->msg)) {
+					pr_err("%s: reply too big (%u) %u, throw away...",
+					     __func__, reply_len,
+					     reply->trans_id);
+				} else {
+					memcpy(cmd->msg, reply, reply_len);
+					up(&cmd->sema);
+				}
+
+				vchi_msg_remove(instance->vchi_handle[0]);
+			}
+
+			/* Go through the dead list and free them */
+			mutex_lock(&instance->lock);
+			list_for_each_entry_safe(cmd, cmd_tmp,
+						 &instance->dead_list, head) {
+				list_del(&cmd->head);
+				vc_vchi_cmd_delete(instance, cmd);
+			}
+			mutex_unlock(&instance->lock);
+		}
+	}
+
+	return 0;
+}
+
+static void vc_sm_vchi_callback(void *param,
+				const VCHI_CALLBACK_REASON_T reason,
+				void *msg_handle)
+{
+	struct sm_instance *instance = param;
+
+	(void)msg_handle;
+
+	switch (reason) {
+	case VCHI_CALLBACK_MSG_AVAILABLE:
+		up(&instance->io_sema);
+		break;
+
+	case VCHI_CALLBACK_SERVICE_CLOSED:
+		pr_info("%s: service CLOSED!!", __func__);
+	default:
+		break;
+	}
+}
+
+struct sm_instance *vc_vchi_sm_init(VCHI_INSTANCE_T vchi_instance,
+				    VCHI_CONNECTION_T **vchi_connections,
+				    uint32_t num_connections)
+{
+	uint32_t i;
+	struct sm_instance *instance;
+	int status;
+
+	pr_debug("%s: start", __func__);
+
+	if (num_connections > VCHI_MAX_NUM_CONNECTIONS) {
+		pr_err("%s: unsupported number of connections %u (max=%u)",
+			__func__, num_connections, VCHI_MAX_NUM_CONNECTIONS);
+
+		goto err_null;
+	}
+	/* Allocate memory for this instance */
+	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
+
+	/* Misc initialisations */
+	mutex_init(&instance->lock);
+	sema_init(&instance->io_sema, 0);
+	INIT_LIST_HEAD(&instance->cmd_list);
+	INIT_LIST_HEAD(&instance->rsp_list);
+	INIT_LIST_HEAD(&instance->dead_list);
+	INIT_LIST_HEAD(&instance->free_list);
+	sema_init(&instance->free_sema, SM_MAX_NUM_CMD_RSP_BLKS);
+	mutex_init(&instance->free_lock);
+	for (i = 0; i < SM_MAX_NUM_CMD_RSP_BLKS; i++) {
+		sema_init(&instance->free_blk[i].sema, 0);
+		list_add(&instance->free_blk[i].head, &instance->free_list);
+	}
+
+	/* Open the VCHI service connections */
+	instance->num_connections = num_connections;
+	for (i = 0; i < num_connections; i++) {
+		SERVICE_CREATION_T params = {
+			VCHI_VERSION_EX(VC_SM_VER, VC_SM_MIN_VER),
+			VC_SM_SERVER_NAME,
+			vchi_connections[i],
+			0,
+			0,
+			vc_sm_vchi_callback,
+			instance,
+			0,
+			0,
+			0,
+		};
+
+		status = vchi_service_open(vchi_instance,
+					   &params, &instance->vchi_handle[i]);
+		if (status) {
+			pr_err("%s: failed to open VCHI service (%d)",
+					__func__, status);
+
+			goto err_close_services;
+		}
+	}
+
+	/* Create the thread which takes care of all io to/from videoocore. */
+	instance->io_thread = kthread_create(&vc_vchi_sm_videocore_io,
+					     (void *)instance, "SMIO");
+	if (instance->io_thread == NULL) {
+		pr_err("%s: failed to create SMIO thread", __func__);
+
+		goto err_close_services;
+	}
+	set_user_nice(instance->io_thread, -10);
+	wake_up_process(instance->io_thread);
+
+	pr_debug("%s: success - instance 0x%x", __func__,
+		 (unsigned int)instance);
+	return instance;
+
+err_close_services:
+	for (i = 0; i < instance->num_connections; i++) {
+		if (instance->vchi_handle[i] != NULL)
+			vchi_service_close(instance->vchi_handle[i]);
+	}
+	kfree(instance);
+err_null:
+	pr_debug("%s: FAILED", __func__);
+	return NULL;
+}
+
+int vc_vchi_sm_stop(struct sm_instance **handle)
+{
+	struct sm_instance *instance;
+	uint32_t i;
+
+	if (handle == NULL) {
+		pr_err("%s: invalid pointer to handle %p", __func__, handle);
+		goto lock;
+	}
+
+	if (*handle == NULL) {
+		pr_err("%s: invalid handle %p", __func__, *handle);
+		goto lock;
+	}
+
+	instance = *handle;
+
+	/* Close all VCHI service connections */
+	for (i = 0; i < instance->num_connections; i++) {
+		int32_t success;
+
+		vchi_service_use(instance->vchi_handle[i]);
+
+		success = vchi_service_close(instance->vchi_handle[i]);
+	}
+
+	kfree(instance);
+
+	*handle = NULL;
+	return 0;
+
+lock:
+	return -EINVAL;
+}
+
+int vc_vchi_sm_send_msg(struct sm_instance *handle,
+			enum vc_sm_msg_type msg_id,
+			void *msg, uint32_t msg_size,
+			void *result, uint32_t result_size,
+			uint32_t *cur_trans_id, uint8_t wait_reply)
+{
+	int status = 0;
+	struct sm_instance *instance = handle;
+	struct sm_cmd_rsp_blk *cmd_blk;
+
+	if (handle == NULL) {
+		pr_err("%s: invalid handle", __func__);
+		return -EINVAL;
+	}
+	if (msg == NULL) {
+		pr_err("%s: invalid msg pointer", __func__);
+		return -EINVAL;
+	}
+
+	cmd_blk =
+	    vc_vchi_cmd_create(instance, msg_id, msg, msg_size, wait_reply);
+	if (cmd_blk == NULL) {
+		pr_err("[%s]: failed to allocate global tracking resource",
+			__func__);
+		return -ENOMEM;
+	}
+
+	if (cur_trans_id != NULL)
+		*cur_trans_id = cmd_blk->id;
+
+	mutex_lock(&instance->lock);
+	list_add_tail(&cmd_blk->head, &instance->cmd_list);
+	mutex_unlock(&instance->lock);
+	up(&instance->io_sema);
+
+	if (!wait_reply)
+		/* We're done */
+		return 0;
+
+	/* Wait for the response */
+	if (down_interruptible(&cmd_blk->sema)) {
+		mutex_lock(&instance->lock);
+		if (!cmd_blk->sent) {
+			list_del(&cmd_blk->head);
+			mutex_unlock(&instance->lock);
+			vc_vchi_cmd_delete(instance, cmd_blk);
+			return -ENXIO;
+		}
+		mutex_unlock(&instance->lock);
+
+		mutex_lock(&instance->lock);
+		list_move(&cmd_blk->head, &instance->dead_list);
+		mutex_unlock(&instance->lock);
+		up(&instance->io_sema);
+		return -EINTR;	/* We're done */
+	}
+
+	if (result && result_size) {
+		memcpy(result, cmd_blk->msg, result_size);
+	} else {
+		struct vc_sm_result_t *res =
+			(struct vc_sm_result_t *) cmd_blk->msg;
+		status = (res->success == 0) ? 0 : -ENXIO;
+	}
+
+	mutex_lock(&instance->lock);
+	list_del(&cmd_blk->head);
+	mutex_unlock(&instance->lock);
+	vc_vchi_cmd_delete(instance, cmd_blk);
+	return status;
+}
+
+int vc_vchi_sm_alloc(struct sm_instance *handle, struct vc_sm_alloc_t *msg,
+		     struct vc_sm_alloc_result_t *result,
+		     uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_ALLOC,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
+
+int vc_vchi_sm_free(struct sm_instance *handle,
+		    struct vc_sm_free_t *msg, uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_FREE,
+				   msg, sizeof(*msg), 0, 0, cur_trans_id, 0);
+}
+
+int vc_vchi_sm_lock(struct sm_instance *handle,
+		    struct vc_sm_lock_unlock_t *msg,
+		    struct vc_sm_lock_result_t *result,
+		    uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_LOCK,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
+
+int vc_vchi_sm_unlock(struct sm_instance *handle,
+		      struct vc_sm_lock_unlock_t *msg,
+		      uint32_t *cur_trans_id, uint8_t wait_reply)
+{
+	return vc_vchi_sm_send_msg(handle, wait_reply ?
+				   VC_SM_MSG_TYPE_UNLOCK :
+				   VC_SM_MSG_TYPE_UNLOCK_NOANS, msg,
+				   sizeof(*msg), 0, 0, cur_trans_id,
+				   wait_reply);
+}
+
+int vc_vchi_sm_resize(struct sm_instance *handle, struct vc_sm_resize_t *msg,
+		      uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_RESIZE,
+				   msg, sizeof(*msg), 0, 0, cur_trans_id, 1);
+}
+
+int vc_vchi_sm_walk_alloc(struct sm_instance *handle)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_WALK_ALLOC,
+				   0, 0, 0, 0, 0, 0);
+}
+
+int vc_vchi_sm_clean_up(struct sm_instance *handle,
+			struct vc_sm_action_clean_t *msg)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_ACTION_CLEAN,
+				   msg, sizeof(*msg), 0, 0, 0, 0);
+}
+
+int vc_vchi_sm_import(struct sm_instance *handle, struct vc_sm_import *msg,
+		      struct vc_sm_import_result *result,
+		      uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_IMPORT,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
diff --git a/drivers/char/broadcom/vc_sm/vc_vchi_sm.h b/drivers/char/broadcom/vc_sm/vc_vchi_sm.h
new file mode 100644
index 0000000000000..abe4ed15836f2
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_vchi_sm.h
@@ -0,0 +1,102 @@
+/*
+ ****************************************************************************
+ * Copyright 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+#ifndef __VC_VCHI_SM_H__INCLUDED__
+#define __VC_VCHI_SM_H__INCLUDED__
+
+#include "interface/vchi/vchi.h"
+
+#include "vc_sm_defs.h"
+
+/*
+ * Forward declare.
+ */
+struct sm_instance;
+
+/*
+ * Initialize the shared memory service, opens up vchi connection to talk to it.
+ */
+struct sm_instance *vc_vchi_sm_init(VCHI_INSTANCE_T vchi_instance,
+				    VCHI_CONNECTION_T **vchi_connections,
+				    uint32_t num_connections);
+
+/*
+ * Terminates the shared memory service.
+ */
+int vc_vchi_sm_stop(struct sm_instance **handle);
+
+/*
+ * Ask the shared memory service to allocate some memory on videocre and
+ * return the result of this allocation (which upon success will be a pointer
+ * to some memory in videocore space).
+ */
+int vc_vchi_sm_alloc(struct sm_instance *handle, struct vc_sm_alloc_t *alloc,
+		     struct vc_sm_alloc_result_t *alloc_result,
+		     uint32_t *trans_id);
+
+/*
+ * Ask the shared memory service to free up some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_free(struct sm_instance *handle,
+		    struct vc_sm_free_t *free, uint32_t *trans_id);
+
+/*
+ * Ask the shared memory service to lock up some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_lock(struct sm_instance *handle,
+		    struct vc_sm_lock_unlock_t *lock_unlock,
+		    struct vc_sm_lock_result_t *lock_result,
+		    uint32_t *trans_id);
+
+/*
+ * Ask the shared memory service to unlock some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_unlock(struct sm_instance *handle,
+		      struct vc_sm_lock_unlock_t *lock_unlock,
+		      uint32_t *trans_id, uint8_t wait_reply);
+
+/*
+ * Ask the shared memory service to resize some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_resize(struct sm_instance *handle,
+		      struct vc_sm_resize_t *resize, uint32_t *trans_id);
+
+/*
+ * Walk the allocated resources on the videocore side, the allocation will
+ * show up in the log.  This is purely for debug/information and takes no
+ * specific actions.
+ */
+int vc_vchi_sm_walk_alloc(struct sm_instance *handle);
+
+/*
+ * Clean up following a previously interrupted action which left the system
+ * in a bad state of some sort.
+ */
+int vc_vchi_sm_clean_up(struct sm_instance *handle,
+			struct vc_sm_action_clean_t *action_clean);
+
+/*
+ * Import a contiguous block of memory and wrap it in a GPU MEM_HANDLE_T.
+ */
+int vc_vchi_sm_import(struct sm_instance *handle, struct vc_sm_import *msg,
+		      struct vc_sm_import_result *result,
+		      uint32_t *cur_trans_id);
+
+#endif /* __VC_VCHI_SM_H__INCLUDED__ */
diff --git a/drivers/char/broadcom/vc_sm/vmcs_sm.c b/drivers/char/broadcom/vc_sm/vmcs_sm.c
new file mode 100644
index 0000000000000..1bc37ee882255
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vmcs_sm.c
@@ -0,0 +1,3543 @@
+/*
+ ****************************************************************************
+ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+/* ---- Include Files ----------------------------------------------------- */
+
+#include <linux/cdev.h>
+#include <linux/broadcom/vc_mem.h>
+#include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/hugetlb.h>
+#include <linux/ioctl.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pfn.h>
+#include <linux/proc_fs.h>
+#include <linux/pagemap.h>
+#include <linux/semaphore.h>
+#include <linux/slab.h>
+#include <linux/seq_file.h>
+#include <linux/types.h>
+#include <asm/cacheflush.h>
+
+#include "vchiq_connected.h"
+#include "vc_vchi_sm.h"
+
+#include <linux/broadcom/vmcs_sm_ioctl.h>
+#include "vc_sm_knl.h"
+
+/* ---- Private Constants and Types --------------------------------------- */
+
+#define DEVICE_NAME              "vcsm"
+#define DRIVER_NAME		 "bcm2835-vcsm"
+#define DEVICE_MINOR             0
+
+#define VC_SM_DIR_ROOT_NAME       "vc-smem"
+#define VC_SM_DIR_ALLOC_NAME      "alloc"
+#define VC_SM_STATE               "state"
+#define VC_SM_STATS               "statistics"
+#define VC_SM_RESOURCES           "resources"
+#define VC_SM_DEBUG               "debug"
+#define VC_SM_WRITE_BUF_SIZE      128
+
+/* Statistics tracked per resource and globally. */
+enum sm_stats_t {
+	/* Attempt. */
+	ALLOC,
+	FREE,
+	LOCK,
+	UNLOCK,
+	MAP,
+	FLUSH,
+	INVALID,
+	IMPORT,
+
+	END_ATTEMPT,
+
+	/* Failure. */
+	ALLOC_FAIL,
+	FREE_FAIL,
+	LOCK_FAIL,
+	UNLOCK_FAIL,
+	MAP_FAIL,
+	FLUSH_FAIL,
+	INVALID_FAIL,
+	IMPORT_FAIL,
+
+	END_ALL,
+
+};
+
+static const char *const sm_stats_human_read[] = {
+	"Alloc",
+	"Free",
+	"Lock",
+	"Unlock",
+	"Map",
+	"Cache Flush",
+	"Cache Invalidate",
+	"Import",
+};
+
+typedef int (*VC_SM_SHOW) (struct seq_file *s, void *v);
+struct sm_pde_t {
+	VC_SM_SHOW show;          /* Debug fs function hookup. */
+	struct dentry *dir_entry; /* Debug fs directory entry. */
+	void *priv_data;          /* Private data */
+
+};
+
+/* Single resource allocation tracked for all devices. */
+struct sm_mmap {
+	struct list_head map_list;	/* Linked list of maps. */
+
+	struct sm_resource_t *resource;	/* Pointer to the resource. */
+
+	pid_t res_pid;			/* PID owning that resource. */
+	unsigned int res_vc_hdl;	/* Resource handle (videocore). */
+	unsigned int res_usr_hdl;	/* Resource handle (user). */
+
+	unsigned long res_addr;	/* Mapped virtual address. */
+	struct vm_area_struct *vma;	/* VM area for this mapping. */
+	unsigned int ref_count;		/* Reference count to this vma. */
+
+	/* Used to link maps associated with a resource. */
+	struct list_head resource_map_list;
+};
+
+/* Single resource allocation tracked for each opened device. */
+struct sm_resource_t {
+	struct list_head resource_list;	/* List of resources. */
+	struct list_head global_resource_list;	/* Global list of resources. */
+
+	pid_t pid;		/* PID owning that resource. */
+	uint32_t res_guid;	/* Unique identifier. */
+	uint32_t lock_count;	/* Lock count for this resource. */
+	uint32_t ref_count;	/* Ref count for this resource. */
+
+	uint32_t res_handle;	/* Resource allocation handle. */
+	void *res_base_mem;	/* Resource base memory address. */
+	uint32_t res_size;	/* Resource size allocated. */
+	enum vmcs_sm_cache_e res_cached;	/* Resource cache type. */
+	struct sm_resource_t *res_shared;	/* Shared resource */
+
+	enum sm_stats_t res_stats[END_ALL];	/* Resource statistics. */
+
+	uint8_t map_count;	/* Counter of mappings for this resource. */
+	struct list_head map_list;	/* Maps associated with a resource. */
+
+	/* DMABUF related fields */
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *sgt;
+	dma_addr_t dma_addr;
+
+	struct sm_priv_data_t *private;
+	bool map;		/* whether to map pages up front */
+};
+
+/* Private file data associated with each opened device. */
+struct sm_priv_data_t {
+	struct list_head resource_list; /* List of resources. */
+
+	pid_t pid;                      /* PID of creator. */
+
+	struct dentry *dir_pid;	   /* Debug fs entries root. */
+	struct sm_pde_t dir_stats; /* Debug fs entries statistics sub-tree. */
+	struct sm_pde_t dir_res;   /* Debug fs resource sub-tree. */
+
+	int restart_sys;           /* Tracks restart on interrupt. */
+	enum vc_sm_msg_type int_action; /* Interrupted action. */
+	uint32_t int_trans_id;     /* Interrupted transaction. */
+
+};
+
+/* Global state information. */
+struct sm_state_t {
+	struct platform_device *pdev;
+	struct sm_instance *sm_handle;	/* Handle for videocore service. */
+	struct dentry *dir_root;   /* Debug fs entries root. */
+	struct dentry *dir_alloc;  /* Debug fs entries allocations. */
+	struct sm_pde_t dir_stats; /* Debug fs entries statistics sub-tree. */
+	struct sm_pde_t dir_state; /* Debug fs entries state sub-tree. */
+	struct dentry *debug;      /* Debug fs entries debug. */
+
+	struct mutex map_lock;          /* Global map lock. */
+	struct list_head map_list;      /* List of maps. */
+	struct list_head resource_list;	/* List of resources. */
+
+	enum sm_stats_t deceased[END_ALL];    /* Natural termination stats. */
+	enum sm_stats_t terminated[END_ALL];  /* Forced termination stats. */
+	uint32_t res_deceased_cnt;	      /* Natural termination counter. */
+	uint32_t res_terminated_cnt;	      /* Forced termination counter. */
+
+	struct cdev sm_cdev;	/* Device. */
+	dev_t sm_devid;		/* Device identifier. */
+	struct class *sm_class;	/* Class. */
+	struct device *sm_dev;	/* Device. */
+
+	struct sm_priv_data_t *data_knl;    /* Kernel internal data tracking. */
+
+	struct mutex lock;	/* Global lock. */
+	uint32_t guid;		/* GUID (next) tracker. */
+
+};
+
+/* ---- Private Variables ----------------------------------------------- */
+
+static struct sm_state_t *sm_state;
+static int sm_inited;
+
+#if 0
+static const char *const sm_cache_map_vector[] = {
+	"(null)",
+	"host",
+	"videocore",
+	"host+videocore",
+};
+#endif
+
+/* ---- Private Function Prototypes -------------------------------------- */
+
+/* ---- Private Functions ------------------------------------------------ */
+
+static inline unsigned int vcaddr_to_pfn(unsigned long vc_addr)
+{
+	unsigned long pfn = vc_addr & 0x3FFFFFFF;
+
+	pfn += mm_vc_mem_phys_addr;
+	pfn >>= PAGE_SHIFT;
+	return pfn;
+}
+
+/*
+ * Carries over to the state statistics the statistics once owned by a deceased
+ * resource.
+ */
+static void vc_sm_resource_deceased(struct sm_resource_t *p_res, int terminated)
+{
+	if (sm_state != NULL) {
+		if (p_res != NULL) {
+			int ix;
+
+			if (terminated)
+				sm_state->res_terminated_cnt++;
+			else
+				sm_state->res_deceased_cnt++;
+
+			for (ix = 0; ix < END_ALL; ix++) {
+				if (terminated)
+					sm_state->terminated[ix] +=
+					    p_res->res_stats[ix];
+				else
+					sm_state->deceased[ix] +=
+					    p_res->res_stats[ix];
+			}
+		}
+	}
+}
+
+/*
+ * Fetch a videocore handle corresponding to a mapping of the pid+address
+ * returns 0 (ie NULL) if no such handle exists in the global map.
+ */
+static unsigned int vmcs_sm_vc_handle_from_pid_and_address(unsigned int pid,
+							   unsigned int addr)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int handle = 0;
+
+	if (!sm_state || addr == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid)
+				continue;
+			if (addr < map->res_addr ||
+						addr >= (map->res_addr + map->resource->res_size))
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, addr %lx) -> vc-hdl %x (usr-hdl %x)\n",
+				__func__, map, map->res_pid, map->res_addr,
+				map->res_vc_hdl, map->res_usr_hdl);
+
+			handle = map->res_vc_hdl;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped, we do not want a kernel log each
+	 * time around.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (handle == 0) {
+		pr_debug("[%s]: not a valid map (pid %u, addr %x)\n",
+			__func__, pid, addr);
+	}
+
+	return handle;
+}
+
+/*
+ * Fetch a user handle corresponding to a mapping of the pid+address
+ * returns 0 (ie NULL) if no such handle exists in the global map.
+ */
+static unsigned int vmcs_sm_usr_handle_from_pid_and_address(unsigned int pid,
+							    unsigned int addr)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int handle = 0;
+
+	if (!sm_state || addr == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid)
+				continue;
+			if (addr < map->res_addr ||
+						addr >= (map->res_addr + map->resource->res_size))
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, addr %lx) -> usr-hdl %x (vc-hdl %x)\n",
+				__func__, map, map->res_pid, map->res_addr,
+				map->res_usr_hdl, map->res_vc_hdl);
+
+			handle = map->res_usr_hdl;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped yet.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (handle == 0)
+		pr_debug("[%s]: not a valid map (pid %u, addr %x)\n",
+			__func__, pid, addr);
+
+	return handle;
+}
+
+#if defined(DO_NOT_USE)
+/*
+ * Fetch an address corresponding to a mapping of the pid+handle
+ * returns 0 (ie NULL) if no such address exists in the global map.
+ */
+static unsigned int vmcs_sm_usr_address_from_pid_and_vc_handle(unsigned int pid,
+							       unsigned int hdl)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int addr = 0;
+
+	if (sm_state == NULL || hdl == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid || map->res_vc_hdl != hdl)
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, vc-hdl %x, usr-hdl %x) -> addr %lx\n",
+				__func__, map, map->res_pid, map->res_vc_hdl,
+				map->res_usr_hdl, map->res_addr);
+
+			addr = map->res_addr;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped, we do not want a kernel log each
+	 * time around.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (addr == 0)
+		pr_debug("[%s]: not a valid map (pid %u, hdl %x)\n",
+			__func__, pid, hdl);
+
+	return addr;
+}
+#endif
+
+/*
+ * Fetch an address corresponding to a mapping of the pid+handle
+ * returns 0 (ie NULL) if no such address exists in the global map.
+ */
+static unsigned int vmcs_sm_usr_address_from_pid_and_usr_handle(unsigned int
+								pid,
+								unsigned int
+								hdl)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int addr = 0;
+
+	if (sm_state == NULL || hdl == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid || map->res_usr_hdl != hdl)
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, vc-hdl %x, usr-hdl %x) -> addr %lx\n",
+				__func__, map, map->res_pid, map->res_vc_hdl,
+				map->res_usr_hdl, map->res_addr);
+
+			addr = map->res_addr;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped, we do not want a kernel log each
+	 * time around.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (addr == 0)
+		pr_debug("[%s]: not a valid map (pid %u, hdl %x)\n", __func__,
+				pid, hdl);
+
+	return addr;
+}
+
+/* Adds a resource mapping to the global data list. */
+static void vmcs_sm_add_map(struct sm_state_t *state,
+			    struct sm_resource_t *resource, struct sm_mmap *map)
+{
+	mutex_lock(&(state->map_lock));
+
+	/* Add to the global list of mappings */
+	list_add(&map->map_list, &state->map_list);
+
+	/* Add to the list of mappings for this resource */
+	list_add(&map->resource_map_list, &resource->map_list);
+	resource->map_count++;
+
+	mutex_unlock(&(state->map_lock));
+
+	pr_debug("[%s]: added map %p (pid %u, vc-hdl %x, usr-hdl %x, addr %lx)\n",
+		__func__, map, map->res_pid, map->res_vc_hdl,
+		map->res_usr_hdl, map->res_addr);
+}
+
+/* Removes a resource mapping from the global data list. */
+static void vmcs_sm_remove_map(struct sm_state_t *state,
+			       struct sm_resource_t *resource,
+			       struct sm_mmap *map)
+{
+	mutex_lock(&(state->map_lock));
+
+	/* Remove from the global list of mappings */
+	list_del(&map->map_list);
+
+	/* Remove from the list of mapping for this resource */
+	list_del(&map->resource_map_list);
+	if (resource->map_count > 0)
+		resource->map_count--;
+
+	mutex_unlock(&(state->map_lock));
+
+	pr_debug("[%s]: removed map %p (pid %d, vc-hdl %x, usr-hdl %x, addr %lx)\n",
+		__func__, map, map->res_pid, map->res_vc_hdl, map->res_usr_hdl,
+		map->res_addr);
+
+	kfree(map);
+}
+
+/* Read callback for the global state proc entry. */
+static int vc_sm_global_state_show(struct seq_file *s, void *v)
+{
+	struct sm_mmap *map = NULL;
+	struct sm_resource_t *resource = NULL;
+	int map_count = 0;
+	int resource_count = 0;
+
+	if (sm_state == NULL)
+		return 0;
+
+	seq_printf(s, "\nVC-ServiceHandle     0x%x\n",
+		   (unsigned int)sm_state->sm_handle);
+
+	/* Log all applicable mapping(s). */
+
+	mutex_lock(&(sm_state->map_lock));
+	seq_puts(s, "\nResources\n");
+	if (!list_empty(&sm_state->resource_list)) {
+		list_for_each_entry(resource, &sm_state->resource_list,
+				    global_resource_list) {
+			resource_count++;
+
+			seq_printf(s, "\nResource                %p\n",
+				   resource);
+			seq_printf(s, "           PID          %u\n",
+				   resource->pid);
+			seq_printf(s, "           RES_GUID     0x%x\n",
+				   resource->res_guid);
+			seq_printf(s, "           LOCK_COUNT   %u\n",
+				   resource->lock_count);
+			seq_printf(s, "           REF_COUNT    %u\n",
+				   resource->ref_count);
+			seq_printf(s, "           res_handle   0x%X\n",
+				   resource->res_handle);
+			seq_printf(s, "           res_base_mem %p\n",
+				   resource->res_base_mem);
+			seq_printf(s, "           SIZE         %d\n",
+				   resource->res_size);
+			seq_printf(s, "           DMABUF       %p\n",
+				   resource->dma_buf);
+			seq_printf(s, "           ATTACH       %p\n",
+				   resource->attach);
+			seq_printf(s, "           SGT          %p\n",
+				   resource->sgt);
+			seq_printf(s, "           DMA_ADDR     %pad\n",
+				   &resource->dma_addr);
+		}
+	}
+	seq_printf(s, "\n\nTotal resource count:   %d\n\n", resource_count);
+
+	seq_puts(s, "\nMappings\n");
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			map_count++;
+
+			seq_printf(s, "\nMapping                0x%x\n",
+				   (unsigned int)map);
+			seq_printf(s, "           TGID        %u\n",
+				   map->res_pid);
+			seq_printf(s, "           VC-HDL      0x%x\n",
+				   map->res_vc_hdl);
+			seq_printf(s, "           USR-HDL     0x%x\n",
+				   map->res_usr_hdl);
+			seq_printf(s, "           USR-ADDR    0x%lx\n",
+				   map->res_addr);
+			seq_printf(s, "           SIZE        %d\n",
+				   map->resource->res_size);
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+	seq_printf(s, "\n\nTotal map count:   %d\n\n", map_count);
+
+	return 0;
+}
+
+static int vc_sm_global_statistics_show(struct seq_file *s, void *v)
+{
+	int ix;
+
+	/* Global state tracked statistics. */
+	if (sm_state != NULL) {
+		seq_puts(s, "\nDeceased Resources Statistics\n");
+
+		seq_printf(s, "\nNatural Cause (%u occurences)\n",
+			   sm_state->res_deceased_cnt);
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->deceased[ix] > 0) {
+				seq_printf(s, "                %u\t%s\n",
+					   sm_state->deceased[ix],
+					   sm_stats_human_read[ix]);
+			}
+		}
+		seq_puts(s, "\n");
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->deceased[ix + END_ATTEMPT] > 0) {
+				seq_printf(s, "                %u\tFAILED %s\n",
+					   sm_state->deceased[ix + END_ATTEMPT],
+					   sm_stats_human_read[ix]);
+			}
+		}
+
+		seq_printf(s, "\nForcefull (%u occurences)\n",
+			   sm_state->res_terminated_cnt);
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->terminated[ix] > 0) {
+				seq_printf(s, "                %u\t%s\n",
+					   sm_state->terminated[ix],
+					   sm_stats_human_read[ix]);
+			}
+		}
+		seq_puts(s, "\n");
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->terminated[ix + END_ATTEMPT] > 0) {
+				seq_printf(s, "                %u\tFAILED %s\n",
+					   sm_state->terminated[ix +
+								END_ATTEMPT],
+					   sm_stats_human_read[ix]);
+			}
+		}
+	}
+
+	return 0;
+}
+
+#if 0
+/* Read callback for the statistics proc entry. */
+static int vc_sm_statistics_show(struct seq_file *s, void *v)
+{
+	int ix;
+	struct sm_priv_data_t *file_data;
+	struct sm_resource_t *resource;
+	int res_count = 0;
+	struct sm_pde_t *p_pde;
+
+	p_pde = (struct sm_pde_t *)(s->private);
+	file_data = (struct sm_priv_data_t *)(p_pde->priv_data);
+
+	if (file_data == NULL)
+		return 0;
+
+	/* Per process statistics. */
+
+	seq_printf(s, "\nStatistics for TGID %d\n", file_data->pid);
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (!list_empty(&file_data->resource_list)) {
+		list_for_each_entry(resource, &file_data->resource_list,
+				    resource_list) {
+			res_count++;
+
+			seq_printf(s, "\nGUID:         0x%x\n\n",
+				   resource->res_guid);
+			for (ix = 0; ix < END_ATTEMPT; ix++) {
+				if (resource->res_stats[ix] > 0) {
+					seq_printf(s,
+						   "                %u\t%s\n",
+						   resource->res_stats[ix],
+						   sm_stats_human_read[ix]);
+				}
+			}
+			seq_puts(s, "\n");
+			for (ix = 0; ix < END_ATTEMPT; ix++) {
+				if (resource->res_stats[ix + END_ATTEMPT] > 0) {
+					seq_printf(s,
+						   "                %u\tFAILED %s\n",
+						   resource->res_stats[
+						   ix + END_ATTEMPT],
+						   sm_stats_human_read[ix]);
+				}
+			}
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	seq_printf(s, "\nResources Count %d\n", res_count);
+
+	return 0;
+}
+#endif
+
+#if 0
+/* Read callback for the allocation proc entry.  */
+static int vc_sm_alloc_show(struct seq_file *s, void *v)
+{
+	struct sm_priv_data_t *file_data;
+	struct sm_resource_t *resource;
+	int alloc_count = 0;
+	struct sm_pde_t *p_pde;
+
+	p_pde = (struct sm_pde_t *)(s->private);
+	file_data = (struct sm_priv_data_t *)(p_pde->priv_data);
+
+	if (!file_data)
+		return 0;
+
+	/* Per process statistics.  */
+	seq_printf(s, "\nAllocation for TGID %d\n", file_data->pid);
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (!list_empty(&file_data->resource_list)) {
+		list_for_each_entry(resource, &file_data->resource_list,
+				    resource_list) {
+			alloc_count++;
+
+			seq_printf(s, "\nGUID:              0x%x\n",
+				   resource->res_guid);
+			seq_printf(s, "Lock Count:        %u\n",
+				   resource->lock_count);
+			seq_printf(s, "Mapped:            %s\n",
+				   (resource->map_count ? "yes" : "no"));
+			seq_printf(s, "VC-handle:         0x%x\n",
+				   resource->res_handle);
+			seq_printf(s, "VC-address:        0x%p\n",
+				   resource->res_base_mem);
+			seq_printf(s, "VC-size (bytes):   %u\n",
+				   resource->res_size);
+			seq_printf(s, "Cache:             %s\n",
+				   sm_cache_map_vector[resource->res_cached]);
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	seq_printf(s, "\n\nTotal allocation count: %d\n\n", alloc_count);
+
+	return 0;
+}
+#endif
+
+static int vc_sm_seq_file_show(struct seq_file *s, void *v)
+{
+	struct sm_pde_t *sm_pde;
+
+	sm_pde = (struct sm_pde_t *)(s->private);
+
+	if (sm_pde && sm_pde->show)
+		sm_pde->show(s, v);
+
+	return 0;
+}
+
+static int vc_sm_single_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, vc_sm_seq_file_show, inode->i_private);
+}
+
+static const struct file_operations vc_sm_debug_fs_fops = {
+	.open = vc_sm_single_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+
+/*
+ * Adds a resource to the private data list which tracks all the allocated
+ * data.
+ */
+static void vmcs_sm_add_resource(struct sm_priv_data_t *privdata,
+				 struct sm_resource_t *resource)
+{
+	mutex_lock(&(sm_state->map_lock));
+	list_add(&resource->resource_list, &privdata->resource_list);
+	list_add(&resource->global_resource_list, &sm_state->resource_list);
+	mutex_unlock(&(sm_state->map_lock));
+
+	pr_debug("[%s]: added resource %p (base addr %p, hdl %x, size %u, cache %u)\n",
+		__func__, resource, resource->res_base_mem,
+		resource->res_handle, resource->res_size, resource->res_cached);
+}
+
+/*
+ * Locates a resource and acquire a reference on it.
+ * The resource won't be deleted while there is a reference on it.
+ */
+static struct sm_resource_t *vmcs_sm_acquire_resource(struct sm_priv_data_t
+						      *private,
+						      unsigned int res_guid)
+{
+	struct sm_resource_t *resource, *ret = NULL;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	list_for_each_entry(resource, &private->resource_list, resource_list) {
+		if (resource->res_guid != res_guid)
+			continue;
+
+		pr_debug("[%s]: located resource %p (guid: %x, base addr %p, hdl %x, size %u, cache %u)\n",
+			__func__, resource, resource->res_guid,
+			resource->res_base_mem, resource->res_handle,
+			resource->res_size, resource->res_cached);
+		resource->ref_count++;
+		ret = resource;
+		break;
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	return ret;
+}
+
+/*
+ * Locates a resource and acquire a reference on it.
+ * The resource won't be deleted while there is a reference on it.
+ */
+static struct sm_resource_t *vmcs_sm_acquire_first_resource(
+		struct sm_priv_data_t *private)
+{
+	struct sm_resource_t *resource, *ret = NULL;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	list_for_each_entry(resource, &private->resource_list, resource_list) {
+		pr_debug("[%s]: located resource %p (guid: %x, base addr %p, hdl %x, size %u, cache %u)\n",
+			__func__, resource, resource->res_guid,
+			resource->res_base_mem, resource->res_handle,
+			resource->res_size, resource->res_cached);
+		resource->ref_count++;
+		ret = resource;
+		break;
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	return ret;
+}
+
+/*
+ * Locates a resource and acquire a reference on it.
+ * The resource won't be deleted while there is a reference on it.
+ */
+static struct sm_resource_t *vmcs_sm_acquire_global_resource(unsigned int
+							     res_guid)
+{
+	struct sm_resource_t *resource, *ret = NULL;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	list_for_each_entry(resource, &sm_state->resource_list,
+			    global_resource_list) {
+		if (resource->res_guid != res_guid)
+			continue;
+
+		pr_debug("[%s]: located resource %p (guid: %x, base addr %p, hdl %x, size %u, cache %u)\n",
+			__func__, resource, resource->res_guid,
+			resource->res_base_mem, resource->res_handle,
+			resource->res_size, resource->res_cached);
+		resource->ref_count++;
+		ret = resource;
+		break;
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	return ret;
+}
+
+/*
+ * Release a previously acquired resource.
+ * The resource will be deleted when its refcount reaches 0.
+ */
+static void vmcs_sm_release_resource(struct sm_resource_t *resource, int force)
+{
+	struct sm_priv_data_t *private = resource->private;
+	struct sm_mmap *map, *map_tmp;
+	struct sm_resource_t *res_tmp;
+	int ret;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (--resource->ref_count) {
+		if (force)
+			pr_err("[%s]: resource %p in use\n", __func__, resource);
+
+		mutex_unlock(&(sm_state->map_lock));
+		return;
+	}
+
+	/* Time to free the resource. Start by removing it from the list */
+	list_del(&resource->resource_list);
+	list_del(&resource->global_resource_list);
+
+	/*
+	 * Walk the global resource list, find out if the resource is used
+	 * somewhere else. In which case we don't want to delete it.
+	 */
+	list_for_each_entry(res_tmp, &sm_state->resource_list,
+			    global_resource_list) {
+		if (res_tmp->res_handle == resource->res_handle) {
+			resource->res_handle = 0;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	pr_debug("[%s]: freeing data - guid %x, hdl %x, base address %p\n",
+		__func__, resource->res_guid, resource->res_handle,
+		resource->res_base_mem);
+	resource->res_stats[FREE]++;
+
+	/* Make sure the resource we're removing is unmapped first */
+	if (resource->map_count && !list_empty(&resource->map_list)) {
+		down_write(&current->mm->mmap_sem);
+		list_for_each_entry_safe(map, map_tmp, &resource->map_list,
+					 resource_map_list) {
+			ret =
+			    do_munmap(current->mm, map->res_addr,
+				      resource->res_size, NULL);
+			if (ret) {
+				pr_err("[%s]: could not unmap resource %p\n",
+					__func__, resource);
+			}
+		}
+		up_write(&current->mm->mmap_sem);
+	}
+
+	/* Free up the videocore allocated resource. */
+	if (resource->res_handle) {
+		struct vc_sm_free_t free = {
+			resource->res_handle, (uint32_t)resource->res_base_mem
+		};
+		int status = vc_vchi_sm_free(sm_state->sm_handle, &free,
+					     &private->int_trans_id);
+		if (status != 0 && status != -EINTR) {
+			pr_err("[%s]: failed to free memory on videocore (status: %u, trans_id: %u)\n",
+			     __func__, status, private->int_trans_id);
+			resource->res_stats[FREE_FAIL]++;
+			ret = -EPERM;
+		}
+	}
+
+	if (resource->sgt)
+		dma_buf_unmap_attachment(resource->attach, resource->sgt,
+					 DMA_BIDIRECTIONAL);
+	if (resource->attach)
+		dma_buf_detach(resource->dma_buf, resource->attach);
+	if (resource->dma_buf)
+		dma_buf_put(resource->dma_buf);
+
+	/* Free up the shared resource. */
+	if (resource->res_shared)
+		vmcs_sm_release_resource(resource->res_shared, 0);
+
+	/* Free up the local resource tracking this allocation. */
+	vc_sm_resource_deceased(resource, force);
+	kfree(resource);
+}
+
+/*
+ * Dump the map table for the driver.  If process is -1, dumps the whole table,
+ * if process is a valid pid (non -1) dump only the entries associated with the
+ * pid of interest.
+ */
+static void vmcs_sm_host_walk_map_per_pid(int pid)
+{
+	struct sm_mmap *map = NULL;
+
+	/* Make sure the device was started properly. */
+	if (sm_state == NULL) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return;
+	}
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Log all applicable mapping(s). */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (pid == -1 || map->res_pid == pid) {
+				pr_info("[%s]: tgid: %u - vc-hdl: %x, usr-hdl: %x, usr-addr: %lx\n",
+				     __func__, map->res_pid, map->res_vc_hdl,
+				     map->res_usr_hdl, map->res_addr);
+			}
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+}
+
+/*
+ * Dump the allocation table from host side point of view.  This only dumps the
+ * data allocated for this process/device referenced by the file_data.
+ */
+static void vmcs_sm_host_walk_alloc(struct sm_priv_data_t *file_data)
+{
+	struct sm_resource_t *resource = NULL;
+
+	/* Make sure the device was started properly. */
+	if ((sm_state == NULL) || (file_data == NULL)) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return;
+	}
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (!list_empty(&file_data->resource_list)) {
+		list_for_each_entry(resource, &file_data->resource_list,
+				    resource_list) {
+			pr_info("[%s]: guid: %x - hdl: %x, vc-mem: %p, size: %u, cache: %u\n",
+			     __func__, resource->res_guid, resource->res_handle,
+			     resource->res_base_mem, resource->res_size,
+			     resource->res_cached);
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+}
+
+/* Create support for private data tracking. */
+static struct sm_priv_data_t *vc_sm_create_priv_data(pid_t id)
+{
+	char alloc_name[32];
+	struct sm_priv_data_t *file_data = NULL;
+
+	/* Allocate private structure. */
+	file_data = kzalloc(sizeof(*file_data), GFP_KERNEL);
+
+	if (!file_data) {
+		pr_err("[%s]: cannot allocate file data\n", __func__);
+		goto out;
+	}
+
+	snprintf(alloc_name, sizeof(alloc_name), "%d", id);
+
+	INIT_LIST_HEAD(&file_data->resource_list);
+	file_data->pid = id;
+	file_data->dir_pid = debugfs_create_dir(alloc_name,
+			sm_state->dir_alloc);
+#if 0
+  /* TODO: fix this to support querying statistics per pid */
+
+	if (IS_ERR_OR_NULL(file_data->dir_pid)) {
+		file_data->dir_pid = NULL;
+	} else {
+		struct dentry *dir_entry;
+
+		dir_entry = debugfs_create_file(VC_SM_RESOURCES, 0444,
+				file_data->dir_pid, file_data,
+				vc_sm_debug_fs_fops);
+
+		file_data->dir_res.dir_entry = dir_entry;
+		file_data->dir_res.priv_data = file_data;
+		file_data->dir_res.show = &vc_sm_alloc_show;
+
+		dir_entry = debugfs_create_file(VC_SM_STATS, 0444,
+				file_data->dir_pid, file_data,
+				vc_sm_debug_fs_fops);
+
+		file_data->dir_res.dir_entry = dir_entry;
+		file_data->dir_res.priv_data = file_data;
+		file_data->dir_res.show = &vc_sm_statistics_show;
+	}
+	pr_debug("[%s]: private data allocated %p\n", __func__, file_data);
+
+#endif
+out:
+	return file_data;
+}
+
+/*
+ * Open the device.  Creates a private state to help track all allocation
+ * associated with this device.
+ */
+static int vc_sm_open(struct inode *inode, struct file *file)
+{
+	int ret = 0;
+
+	/* Make sure the device was started properly. */
+	if (!sm_state) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	file->private_data = vc_sm_create_priv_data(current->tgid);
+	if (file->private_data == NULL) {
+		pr_err("[%s]: failed to create data tracker\n", __func__);
+
+		ret = -ENOMEM;
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+/*
+ * Close the device.  Free up all resources still associated with this device
+ * at the time.
+ */
+static int vc_sm_release(struct inode *inode, struct file *file)
+{
+	struct sm_priv_data_t *file_data =
+	    (struct sm_priv_data_t *)file->private_data;
+	struct sm_resource_t *resource;
+	int ret = 0;
+
+	/* Make sure the device was started properly. */
+	if (sm_state == NULL || file_data == NULL) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	pr_debug("[%s]: using private data %p\n", __func__, file_data);
+
+	if (file_data->restart_sys == -EINTR) {
+		struct vc_sm_action_clean_t action_clean;
+
+		pr_debug("[%s]: releasing following EINTR on %u (trans_id: %u) (likely due to signal)...\n",
+			__func__, file_data->int_action,
+			file_data->int_trans_id);
+
+		action_clean.res_action = file_data->int_action;
+		action_clean.action_trans_id = file_data->int_trans_id;
+
+		vc_vchi_sm_clean_up(sm_state->sm_handle, &action_clean);
+	}
+
+	while ((resource = vmcs_sm_acquire_first_resource(file_data)) != NULL) {
+		vmcs_sm_release_resource(resource, 0);
+		vmcs_sm_release_resource(resource, 1);
+	}
+
+	/* Remove the corresponding proc entry. */
+	debugfs_remove_recursive(file_data->dir_pid);
+
+	/* Terminate the private data. */
+	kfree(file_data);
+
+out:
+	return ret;
+}
+
+static void vcsm_vma_open(struct vm_area_struct *vma)
+{
+	struct sm_mmap *map = (struct sm_mmap *)vma->vm_private_data;
+
+	pr_debug("[%s]: virt %lx-%lx, pid %i, pfn %i\n",
+		__func__, vma->vm_start, vma->vm_end, (int)current->tgid,
+		(int)vma->vm_pgoff);
+
+	map->ref_count++;
+}
+
+static void vcsm_vma_close(struct vm_area_struct *vma)
+{
+	struct sm_mmap *map = (struct sm_mmap *)vma->vm_private_data;
+
+	pr_debug("[%s]: virt %lx-%lx, pid %i, pfn %i\n",
+		__func__, vma->vm_start, vma->vm_end, (int)current->tgid,
+		(int)vma->vm_pgoff);
+
+	map->ref_count--;
+
+	/* Remove from the map table. */
+	if (map->ref_count == 0)
+		vmcs_sm_remove_map(sm_state, map->resource, map);
+}
+
+static int vcsm_vma_fault(struct vm_fault *vmf)
+{
+	struct sm_mmap *map = (struct sm_mmap *)vmf->vma->vm_private_data;
+	struct sm_resource_t *resource = map->resource;
+	pgoff_t page_offset;
+	unsigned long pfn;
+	int ret = 0;
+
+	/* Lock the resource if necessary. */
+	if (!resource->lock_count) {
+		struct vc_sm_lock_unlock_t lock_unlock;
+		struct vc_sm_lock_result_t lock_result;
+		int status;
+
+		lock_unlock.res_handle = resource->res_handle;
+		lock_unlock.res_mem = (uint32_t)resource->res_base_mem;
+
+		pr_debug("[%s]: attempt to lock data - hdl %x, base address %p\n",
+			__func__, lock_unlock.res_handle,
+			(void *)lock_unlock.res_mem);
+
+		/* Lock the videocore allocated resource. */
+		status = vc_vchi_sm_lock(sm_state->sm_handle,
+					 &lock_unlock, &lock_result, 0);
+		if (status || !lock_result.res_mem) {
+			pr_err("[%s]: failed to lock memory on videocore (status: %u)\n",
+					__func__, status);
+			resource->res_stats[LOCK_FAIL]++;
+			return VM_FAULT_SIGBUS;
+		}
+
+		pfn = vcaddr_to_pfn((unsigned long)resource->res_base_mem);
+		outer_inv_range(__pfn_to_phys(pfn),
+				__pfn_to_phys(pfn) + resource->res_size);
+
+		resource->res_stats[LOCK]++;
+		resource->lock_count++;
+
+		/* Keep track of the new base memory. */
+		if (lock_result.res_mem &&
+		    lock_result.res_old_mem &&
+		    (lock_result.res_mem != lock_result.res_old_mem)) {
+			resource->res_base_mem = (void *)lock_result.res_mem;
+		}
+	}
+
+	/* We don't use vmf->pgoff since that has the fake offset */
+	page_offset = ((unsigned long)vmf->address - vmf->vma->vm_start);
+	pfn = (uint32_t)resource->res_base_mem & 0x3FFFFFFF;
+	pfn += mm_vc_mem_phys_addr;
+	pfn += page_offset;
+	pfn >>= PAGE_SHIFT;
+
+	/* Finally, remap it */
+	ret = vm_insert_pfn(vmf->vma, (unsigned long)vmf->address, pfn);
+
+	switch (ret) {
+	case 0:
+	case -ERESTARTSYS:
+	/*
+	 * EBUSY is ok: this just means that another thread
+	 * already did the job.
+	 */
+	case -EBUSY:
+		return VM_FAULT_NOPAGE;
+	case -ENOMEM:
+	case -EAGAIN:
+		pr_err("[%s]: failed to map page pfn:%lx virt:%lx ret:%d\n", __func__,
+			pfn, (unsigned long)vmf->address, ret);
+		return VM_FAULT_OOM;
+	default:
+		pr_err("[%s]: failed to map page pfn:%lx virt:%lx ret:%d\n", __func__,
+			pfn, (unsigned long)vmf->address, ret);
+		return VM_FAULT_SIGBUS;
+	}
+}
+
+static const struct vm_operations_struct vcsm_vm_ops = {
+	.open = vcsm_vma_open,
+	.close = vcsm_vma_close,
+	.fault = vcsm_vma_fault,
+};
+
+/* Converts VCSM_CACHE_OP_* to an operating function. */
+static void (*cache_op_to_func(const unsigned cache_op))
+		(const void*, const void*)
+{
+	switch (cache_op) {
+	case VCSM_CACHE_OP_NOP:
+		return NULL;
+
+	case VCSM_CACHE_OP_INV:
+		return dmac_inv_range;
+
+	case VCSM_CACHE_OP_CLEAN:
+		return dmac_clean_range;
+
+	case VCSM_CACHE_OP_FLUSH:
+		return dmac_flush_range;
+
+	default:
+		pr_err("[%s]: Invalid cache_op: 0x%08x\n", __func__, cache_op);
+		return NULL;
+	}
+}
+
+/*
+ * Clean/invalid/flush cache of which buffer is already pinned (i.e. accessed).
+ */
+static int clean_invalid_contiguous_mem_2d(const void __user *addr,
+		const size_t block_count, const size_t block_size, const size_t stride,
+		const unsigned cache_op)
+{
+	size_t i;
+	void (*op_fn)(const void*, const void*);
+
+	if (!block_size) {
+		pr_err("[%s]: size cannot be 0\n", __func__);
+		return -EINVAL;
+	}
+
+	op_fn = cache_op_to_func(cache_op);
+	if (op_fn == NULL)
+		return -EINVAL;
+
+	for (i = 0; i < block_count; i ++, addr += stride)
+		op_fn(addr, addr + block_size);
+
+	return 0;
+}
+
+/* Clean/invalid/flush cache of which buffer may be non-pinned. */
+/* The caller must lock current->mm->mmap_sem for read. */
+static int clean_invalid_mem_walk(unsigned long addr, const size_t size,
+		const unsigned cache_op)
+{
+	pgd_t *pgd;
+	pud_t *pud;
+	pmd_t *pmd;
+	pte_t *pte;
+	unsigned long pgd_next, pud_next, pmd_next;
+	const unsigned long end = ALIGN(addr + size, PAGE_SIZE);
+	void (*op_fn)(const void*, const void*);
+
+	addr &= PAGE_MASK;
+
+	if (addr >= end)
+		return 0;
+
+	op_fn = cache_op_to_func(cache_op);
+	if (op_fn == NULL)
+		return -EINVAL;
+
+	/* Walk PGD */
+	pgd = pgd_offset(current->mm, addr);
+	do {
+		pgd_next = pgd_addr_end(addr, end);
+
+		if (pgd_none(*pgd) || pgd_bad(*pgd))
+			continue;
+
+		/* Walk PUD */
+		pud = pud_offset(pgd, addr);
+		do {
+			pud_next = pud_addr_end(addr, pgd_next);
+			if (pud_none(*pud) || pud_bad(*pud))
+				continue;
+
+			/* Walk PMD */
+			pmd = pmd_offset(pud, addr);
+			do {
+				pmd_next = pmd_addr_end(addr, pud_next);
+				if (pmd_none(*pmd) || pmd_bad(*pmd))
+					continue;
+
+				/* Walk PTE */
+				pte = pte_offset_map(pmd, addr);
+				do {
+					if (pte_none(*pte) || !pte_present(*pte))
+						continue;
+
+					op_fn((const void __user*) addr,
+							(const void __user*) (addr + PAGE_SIZE));
+				} while (pte++, addr += PAGE_SIZE, addr != pmd_next);
+				pte_unmap(pte);
+
+			} while (pmd++, addr = pmd_next, addr != pud_next);
+
+		} while (pud++, addr = pud_next, addr != pgd_next);
+
+	} while (pgd++, addr = pgd_next, addr != end);
+
+	return 0;
+}
+
+/* Clean/invalid/flush cache of buffer in resource */
+static int clean_invalid_resource_walk(const void __user *addr,
+		const size_t size, const unsigned cache_op, const int usr_hdl,
+		struct sm_resource_t *resource)
+{
+	int err;
+	enum sm_stats_t stat_attempt, stat_failure;
+	void __user *res_addr;
+
+	if (resource == NULL) {
+		pr_err("[%s]: resource is NULL\n", __func__);
+		return -EINVAL;
+	}
+	if (resource->res_cached != VMCS_SM_CACHE_HOST &&
+				resource->res_cached != VMCS_SM_CACHE_BOTH)
+		return 0;
+
+	switch (cache_op) {
+	case VCSM_CACHE_OP_NOP:
+		return 0;
+	case VCSM_CACHE_OP_INV:
+		stat_attempt = INVALID;
+		stat_failure = INVALID_FAIL;
+		break;
+	case VCSM_CACHE_OP_CLEAN:
+		/* Like the original VMCS_SM_CMD_CLEAN_INVALID ioctl handler does. */
+		stat_attempt = FLUSH;
+		stat_failure = FLUSH_FAIL;
+		break;
+	case VCSM_CACHE_OP_FLUSH:
+		stat_attempt = FLUSH;
+		stat_failure = FLUSH_FAIL;
+		break;
+	default:
+		pr_err("[%s]: Invalid cache_op: 0x%08x\n", __func__, cache_op);
+		return -EINVAL;
+	}
+	resource->res_stats[stat_attempt]++;
+
+	if (size > resource->res_size) {
+		pr_err("[%s]: size (0x%08zu) is larger than res_size (0x%08zu)\n",
+				__func__, size, resource->res_size);
+		return -EFAULT;
+	}
+	res_addr = (void __user*) vmcs_sm_usr_address_from_pid_and_usr_handle(
+			current->tgid, usr_hdl);
+	if (res_addr == NULL) {
+		pr_err("[%s]: Failed to get user address "
+				"from pid (%d) and user handle (%d)\n", __func__, current->tgid,
+				resource->res_handle);
+		return -EINVAL;
+	}
+	if (!(res_addr <= addr && addr + size <= res_addr + resource->res_size)) {
+		pr_err("[%s]: Addr (0x%p-0x%p) out of range (0x%p-0x%p)\n",
+				__func__, addr, addr + size, res_addr,
+				res_addr + resource->res_size);
+		return -EFAULT;
+	}
+
+	down_read(&current->mm->mmap_sem);
+	err = clean_invalid_mem_walk((unsigned long) addr, size, cache_op);
+	up_read(&current->mm->mmap_sem);
+
+	if (err)
+		resource->res_stats[stat_failure]++;
+
+	return err;
+}
+
+/* Map an allocated data into something that the user space. */
+static int vc_sm_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	int ret = 0;
+	struct sm_priv_data_t *file_data =
+	    (struct sm_priv_data_t *)file->private_data;
+	struct sm_resource_t *resource = NULL;
+	struct sm_mmap *map = NULL;
+
+	/* Make sure the device was started properly. */
+	if ((sm_state == NULL) || (file_data == NULL)) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return -EPERM;
+	}
+
+	pr_debug("[%s]: private data %p, guid %x\n", __func__, file_data,
+		((unsigned int)vma->vm_pgoff << PAGE_SHIFT));
+
+	/*
+	 * We lookup to make sure that the data we are being asked to mmap is
+	 * something that we allocated.
+	 *
+	 * We use the offset information as the key to tell us which resource
+	 * we are mapping.
+	 */
+	resource = vmcs_sm_acquire_resource(file_data,
+					    ((unsigned int)vma->vm_pgoff <<
+					     PAGE_SHIFT));
+	if (resource == NULL) {
+		pr_err("[%s]: failed to locate resource for guid %x\n", __func__,
+			((unsigned int)vma->vm_pgoff << PAGE_SHIFT));
+		return -ENOMEM;
+	}
+
+	pr_debug("[%s]: guid %x, tgid %u, %u, %u\n",
+		__func__, resource->res_guid, current->tgid, resource->pid,
+		file_data->pid);
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n",
+			__func__, current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	/* Verify that what we are asked to mmap is proper. */
+	if (resource->res_size != (unsigned int)(vma->vm_end - vma->vm_start)) {
+		pr_err("[%s]: size inconsistency (resource: %u - mmap: %u)\n",
+			__func__,
+			resource->res_size,
+			(unsigned int)(vma->vm_end - vma->vm_start));
+
+		ret = -EINVAL;
+		goto error;
+	}
+
+	/*
+	 * Keep track of the tuple in the global resource list such that one
+	 * can do a mapping lookup for address/memory handle.
+	 */
+	map = kzalloc(sizeof(*map), GFP_KERNEL);
+	if (map == NULL) {
+		pr_err("[%s]: failed to allocate global tracking resource\n",
+			__func__);
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	map->res_pid = current->tgid;
+	map->res_vc_hdl = resource->res_handle;
+	map->res_usr_hdl = resource->res_guid;
+	map->res_addr = (unsigned long)vma->vm_start;
+	map->resource = resource;
+	map->vma = vma;
+	vmcs_sm_add_map(sm_state, resource, map);
+
+	/*
+	 * We are not actually mapping the pages, we just provide a fault
+	 * handler to allow pages to be mapped when accessed
+	 */
+	vma->vm_flags |=
+	    VM_IO | VM_PFNMAP | VM_DONTCOPY | VM_DONTEXPAND;
+	vma->vm_ops = &vcsm_vm_ops;
+	vma->vm_private_data = map;
+
+	/* vm_pgoff is the first PFN of the mapped memory */
+	vma->vm_pgoff = (unsigned long)resource->res_base_mem & 0x3FFFFFFF;
+	vma->vm_pgoff += mm_vc_mem_phys_addr;
+	vma->vm_pgoff >>= PAGE_SHIFT;
+
+	if ((resource->res_cached == VMCS_SM_CACHE_NONE) ||
+	    (resource->res_cached == VMCS_SM_CACHE_VC)) {
+		/* Allocated non host cached memory, honour it. */
+		vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+	}
+
+	pr_debug("[%s]: resource %p (guid %x) - cnt %u, base address %p, handle %x, size %u (%u), cache %u\n",
+		__func__,
+		resource, resource->res_guid, resource->lock_count,
+		resource->res_base_mem, resource->res_handle,
+		resource->res_size, (unsigned int)(vma->vm_end - vma->vm_start),
+		resource->res_cached);
+
+	pr_debug("[%s]: resource %p (base address %p, handle %x) - map-count %d, usr-addr %x\n",
+		__func__, resource, resource->res_base_mem,
+		resource->res_handle, resource->map_count,
+		(unsigned int)vma->vm_start);
+
+	vcsm_vma_open(vma);
+	resource->res_stats[MAP]++;
+	vmcs_sm_release_resource(resource, 0);
+
+	if (resource->map) {
+		/* We don't use vmf->pgoff since that has the fake offset */
+		unsigned long addr;
+
+		for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
+			/* Finally, remap it */
+			unsigned long pfn = (unsigned long)resource->res_base_mem & 0x3FFFFFFF;
+
+			pfn += mm_vc_mem_phys_addr;
+			pfn += addr - vma->vm_start;
+			pfn >>= PAGE_SHIFT;
+			ret = vm_insert_pfn(vma, addr, pfn);
+		}
+	}
+
+	return 0;
+
+error:
+	resource->res_stats[MAP_FAIL]++;
+	vmcs_sm_release_resource(resource, 0);
+	return ret;
+}
+
+/* Allocate a shared memory handle and block. */
+int vc_sm_ioctl_alloc(struct sm_priv_data_t *private,
+		      struct vmcs_sm_ioctl_alloc *ioparam)
+{
+	int ret = 0;
+	int status;
+	struct sm_resource_t *resource;
+	struct vc_sm_alloc_t alloc = { 0 };
+	struct vc_sm_alloc_result_t result = { 0 };
+	enum vmcs_sm_cache_e cached = ioparam->cached;
+	bool map = false;
+
+	/* flag to requst buffer is mapped up front, rather than lazily */
+	if (cached & 0x80) {
+		map = true;
+		cached &= ~0x80;
+	}
+
+	/* Setup our allocation parameters */
+	alloc.type = ((cached == VMCS_SM_CACHE_VC)
+		      || (cached ==
+			  VMCS_SM_CACHE_BOTH)) ? VC_SM_ALLOC_CACHED :
+	    VC_SM_ALLOC_NON_CACHED;
+	alloc.base_unit = ioparam->size;
+	alloc.num_unit = ioparam->num;
+	alloc.allocator = current->tgid;
+	/* Align to kernel page size */
+	alloc.alignement = 4096;
+	/* Align the size to the kernel page size */
+	alloc.base_unit =
+	    (alloc.base_unit + alloc.alignement - 1) & ~(alloc.alignement - 1);
+	if (*ioparam->name) {
+		memcpy(alloc.name, ioparam->name, sizeof(alloc.name) - 1);
+	} else {
+		memcpy(alloc.name, VMCS_SM_RESOURCE_NAME_DEFAULT,
+		       sizeof(VMCS_SM_RESOURCE_NAME_DEFAULT));
+	}
+
+	pr_debug("[%s]: attempt to allocate \"%s\" data - type %u, base %u (%u), num %u, alignement %u\n",
+		__func__, alloc.name, alloc.type, ioparam->size,
+		alloc.base_unit, alloc.num_unit, alloc.alignement);
+
+	/* Allocate local resource to track this allocation. */
+	resource = kzalloc(sizeof(*resource), GFP_KERNEL);
+	if (!resource) {
+		ret = -ENOMEM;
+		goto error;
+	}
+	INIT_LIST_HEAD(&resource->map_list);
+	resource->ref_count++;
+	resource->pid = current->tgid;
+
+	/* Allocate the videocore resource. */
+	status = vc_vchi_sm_alloc(sm_state->sm_handle, &alloc, &result,
+				  &private->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting allocate memory action restart (trans_id: %u)\n",
+			__func__, private->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_ALLOC;
+		goto error;
+	} else if (status != 0 || !result.res_mem) {
+		pr_err("[%s]: failed to allocate memory on videocore (status: %u, trans_id: %u)\n",
+		     __func__, status, private->int_trans_id);
+		ret = -ENOMEM;
+		resource->res_stats[ALLOC_FAIL]++;
+		goto error;
+	}
+
+	/* Keep track of the resource we created. */
+	resource->private = private;
+	resource->res_handle = result.res_handle;
+	resource->res_base_mem = (void *)result.res_mem;
+	resource->res_size = alloc.base_unit * alloc.num_unit;
+	resource->res_cached = cached;
+	resource->map = map;
+
+	/*
+	 * Kernel/user GUID.  This global identifier is used for mmap'ing the
+	 * allocated region from user space, it is passed as the mmap'ing
+	 * offset, we use it to 'hide' the videocore handle/address.
+	 */
+	mutex_lock(&sm_state->lock);
+	resource->res_guid = ++sm_state->guid;
+	mutex_unlock(&sm_state->lock);
+	resource->res_guid <<= PAGE_SHIFT;
+
+	vmcs_sm_add_resource(private, resource);
+
+	pr_debug("[%s]: allocated data - guid %x, hdl %x, base address %p, size %d, cache %d\n",
+		__func__, resource->res_guid, resource->res_handle,
+		resource->res_base_mem, resource->res_size,
+		resource->res_cached);
+
+	/* We're done */
+	resource->res_stats[ALLOC]++;
+	ioparam->handle = resource->res_guid;
+	return 0;
+
+error:
+	pr_err("[%s]: failed to allocate \"%s\" data (%i) - type %u, base %u (%u), num %u, alignment %u\n",
+	     __func__, alloc.name, ret, alloc.type, ioparam->size,
+	     alloc.base_unit, alloc.num_unit, alloc.alignement);
+	if (resource != NULL) {
+		vc_sm_resource_deceased(resource, 1);
+		kfree(resource);
+	}
+	return ret;
+}
+
+/* Share an allocate memory handle and block.*/
+int vc_sm_ioctl_alloc_share(struct sm_priv_data_t *private,
+			    struct vmcs_sm_ioctl_alloc_share *ioparam)
+{
+	struct sm_resource_t *resource, *shared_resource;
+	int ret = 0;
+
+	pr_debug("[%s]: attempt to share resource %u\n", __func__,
+			ioparam->handle);
+
+	shared_resource = vmcs_sm_acquire_global_resource(ioparam->handle);
+	if (shared_resource == NULL) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	/* Allocate local resource to track this allocation. */
+	resource = kzalloc(sizeof(*resource), GFP_KERNEL);
+	if (resource == NULL) {
+		pr_err("[%s]: failed to allocate local tracking resource\n",
+			__func__);
+		ret = -ENOMEM;
+		goto error;
+	}
+	INIT_LIST_HEAD(&resource->map_list);
+	resource->ref_count++;
+	resource->pid = current->tgid;
+
+	/* Keep track of the resource we created. */
+	resource->private = private;
+	resource->res_handle = shared_resource->res_handle;
+	resource->res_base_mem = shared_resource->res_base_mem;
+	resource->res_size = shared_resource->res_size;
+	resource->res_cached = shared_resource->res_cached;
+	resource->res_shared = shared_resource;
+
+	mutex_lock(&sm_state->lock);
+	resource->res_guid = ++sm_state->guid;
+	mutex_unlock(&sm_state->lock);
+	resource->res_guid <<= PAGE_SHIFT;
+
+	vmcs_sm_add_resource(private, resource);
+
+	pr_debug("[%s]: allocated data - guid %x, hdl %x, base address %p, size %d, cache %d\n",
+		__func__, resource->res_guid, resource->res_handle,
+		resource->res_base_mem, resource->res_size,
+		resource->res_cached);
+
+	/* We're done */
+	resource->res_stats[ALLOC]++;
+	ioparam->handle = resource->res_guid;
+	ioparam->size = resource->res_size;
+	return 0;
+
+error:
+	pr_err("[%s]: failed to share %u\n", __func__, ioparam->handle);
+	if (shared_resource != NULL)
+		vmcs_sm_release_resource(shared_resource, 0);
+
+	return ret;
+}
+
+/* Free a previously allocated shared memory handle and block.*/
+static int vc_sm_ioctl_free(struct sm_priv_data_t *private,
+			    struct vmcs_sm_ioctl_free *ioparam)
+{
+	struct sm_resource_t *resource =
+	    vmcs_sm_acquire_resource(private, ioparam->handle);
+
+	if (resource == NULL) {
+		pr_err("[%s]: resource for guid %u does not exist\n", __func__,
+			ioparam->handle);
+		return -EINVAL;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n",
+			__func__, current->tgid, resource->pid);
+		vmcs_sm_release_resource(resource, 0);
+		return -EPERM;
+	}
+
+	vmcs_sm_release_resource(resource, 0);
+	vmcs_sm_release_resource(resource, 0);
+	return 0;
+}
+
+/* Resize a previously allocated shared memory handle and block. */
+static int vc_sm_ioctl_resize(struct sm_priv_data_t *private,
+			      struct vmcs_sm_ioctl_resize *ioparam)
+{
+	int ret = 0;
+	int status;
+	struct vc_sm_resize_t resize;
+	struct sm_resource_t *resource;
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(private, ioparam->handle);
+	if (!resource) {
+		pr_err("[%s]: failed resource - guid %x\n",
+				__func__, ioparam->handle);
+		ret = -EFAULT;
+		goto error;
+	}
+
+	/*
+	 * If the resource is locked, its reference count will be not NULL,
+	 * in which case we will not be allowed to resize it anyways, so
+	 * reject the attempt here.
+	 */
+	if (resource->lock_count != 0) {
+		pr_err("[%s]: cannot resize - guid %x, ref-cnt %d\n",
+		     __func__, ioparam->handle, resource->lock_count);
+		ret = -EFAULT;
+		goto error;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n", __func__,
+				current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	if (resource->map_count != 0) {
+		pr_err("[%s]: cannot resize - guid %x, ref-cnt %d\n",
+		     __func__, ioparam->handle, resource->map_count);
+		ret = -EFAULT;
+		goto error;
+	}
+
+	resize.res_handle = resource->res_handle;
+	resize.res_mem = (uint32_t)resource->res_base_mem;
+	resize.res_new_size = ioparam->new_size;
+
+	pr_debug("[%s]: attempt to resize data - guid %x, hdl %x, base address %p\n",
+		__func__, ioparam->handle, resize.res_handle,
+		(void *)resize.res_mem);
+
+	/* Resize the videocore allocated resource. */
+	status = vc_vchi_sm_resize(sm_state->sm_handle, &resize,
+				   &private->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting resize memory action restart (trans_id: %u)\n",
+			__func__, private->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_RESIZE;
+		goto error;
+	} else if (status) {
+		pr_err("[%s]: failed to resize memory on videocore (status: %u, trans_id: %u)\n",
+		     __func__, status, private->int_trans_id);
+		ret = -EPERM;
+		goto error;
+	}
+
+	pr_debug("[%s]: success to resize data - hdl %x, size %d -> %d\n",
+		__func__, resize.res_handle, resource->res_size,
+		resize.res_new_size);
+
+	/* Successfully resized, save the information and inform the user. */
+	ioparam->old_size = resource->res_size;
+	resource->res_size = resize.res_new_size;
+
+error:
+	if (resource)
+		vmcs_sm_release_resource(resource, 0);
+
+	return ret;
+}
+
+/* Lock a previously allocated shared memory handle and block. */
+static int vc_sm_ioctl_lock(struct sm_priv_data_t *private,
+			    struct vmcs_sm_ioctl_lock_unlock *ioparam,
+			    int change_cache, enum vmcs_sm_cache_e cache_type,
+			    unsigned int vc_addr)
+{
+	int status;
+	struct vc_sm_lock_unlock_t lock;
+	struct vc_sm_lock_result_t result;
+	struct sm_resource_t *resource;
+	int ret = 0;
+	struct sm_mmap *map, *map_tmp;
+	unsigned long phys_addr;
+
+	map = NULL;
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(private, ioparam->handle);
+	if (resource == NULL) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n", __func__,
+				current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	lock.res_handle = resource->res_handle;
+	lock.res_mem = (uint32_t)resource->res_base_mem;
+
+	/* Take the lock and get the address to be mapped. */
+	if (vc_addr == 0) {
+		pr_debug("[%s]: attempt to lock data - guid %x, hdl %x, base address %p\n",
+			__func__, ioparam->handle, lock.res_handle,
+			(void *)lock.res_mem);
+
+		/* Lock the videocore allocated resource. */
+		status = vc_vchi_sm_lock(sm_state->sm_handle, &lock, &result,
+					 &private->int_trans_id);
+		if (status == -EINTR) {
+			pr_debug("[%s]: requesting lock memory action restart (trans_id: %u)\n",
+				__func__, private->int_trans_id);
+			ret = -ERESTARTSYS;
+			private->restart_sys = -EINTR;
+			private->int_action = VC_SM_MSG_TYPE_LOCK;
+			goto error;
+		} else if (status ||
+			   (!status && !(void *)result.res_mem)) {
+			pr_err("[%s]: failed to lock memory on videocore (status: %u, trans_id: %u)\n",
+			     __func__, status, private->int_trans_id);
+			ret = -EPERM;
+			resource->res_stats[LOCK_FAIL]++;
+			goto error;
+		}
+
+		pr_debug("[%s]: succeed to lock data - hdl %x, base address %p (%p), ref-cnt %d\n",
+			__func__, lock.res_handle, (void *)result.res_mem,
+			(void *)lock.res_mem, resource->lock_count);
+	}
+	/* Lock assumed taken already, address to be mapped is known. */
+	else
+		resource->res_base_mem = (void *)vc_addr;
+
+	resource->res_stats[LOCK]++;
+	resource->lock_count++;
+
+	/* Keep track of the new base memory allocation if it has changed. */
+	if ((vc_addr == 0) &&
+	    ((void *)result.res_mem) &&
+	    ((void *)result.res_old_mem) &&
+	    (result.res_mem != result.res_old_mem)) {
+		resource->res_base_mem = (void *)result.res_mem;
+
+		/* Kernel allocated resources. */
+		if (resource->pid == 0) {
+			if (!list_empty(&resource->map_list)) {
+				list_for_each_entry_safe(map, map_tmp,
+							 &resource->map_list,
+							 resource_map_list) {
+					if (map->res_addr) {
+						iounmap((void *)map->res_addr);
+						map->res_addr = 0;
+
+						vmcs_sm_remove_map(sm_state,
+								map->resource,
+								map);
+						break;
+					}
+				}
+			}
+		}
+	}
+
+	if (change_cache)
+		resource->res_cached = cache_type;
+
+	if (resource->map_count) {
+		ioparam->addr =
+		    vmcs_sm_usr_address_from_pid_and_usr_handle(
+				    current->tgid, ioparam->handle);
+
+		pr_debug("[%s] map_count %d private->pid %d current->tgid %d hnd %x addr %u\n",
+			__func__, resource->map_count, private->pid,
+			current->tgid, ioparam->handle, ioparam->addr);
+	} else {
+		/* Kernel allocated resources. */
+		if (resource->pid == 0) {
+			pr_debug("[%s]: attempt mapping kernel resource - guid %x, hdl %x\n",
+				__func__, ioparam->handle, lock.res_handle);
+
+			ioparam->addr = 0;
+
+			map = kzalloc(sizeof(*map), GFP_KERNEL);
+			if (map == NULL) {
+				pr_err("[%s]: failed allocating tracker\n",
+						__func__);
+				ret = -ENOMEM;
+				goto error;
+			} else {
+				phys_addr = (uint32_t)resource->res_base_mem &
+				    0x3FFFFFFF;
+				phys_addr += mm_vc_mem_phys_addr;
+				if (resource->res_cached
+						== VMCS_SM_CACHE_HOST) {
+					ioparam->addr = (unsigned long)
+					/* TODO - make cached work */
+					    ioremap_nocache(phys_addr,
+							   resource->res_size);
+
+					pr_debug("[%s]: mapping kernel - guid %x, hdl %x - cached mapping %u\n",
+						__func__, ioparam->handle,
+						lock.res_handle, ioparam->addr);
+				} else {
+					ioparam->addr = (unsigned long)
+					    ioremap_nocache(phys_addr,
+							    resource->res_size);
+
+					pr_debug("[%s]: mapping kernel- guid %x, hdl %x - non cached mapping %u\n",
+						__func__, ioparam->handle,
+						lock.res_handle, ioparam->addr);
+				}
+
+				map->res_pid = 0;
+				map->res_vc_hdl = resource->res_handle;
+				map->res_usr_hdl = resource->res_guid;
+				map->res_addr = ioparam->addr;
+				map->resource = resource;
+				map->vma = NULL;
+
+				vmcs_sm_add_map(sm_state, resource, map);
+			}
+		} else
+			ioparam->addr = 0;
+	}
+
+error:
+	if (resource)
+		vmcs_sm_release_resource(resource, 0);
+
+	return ret;
+}
+
+/* Unlock a previously allocated shared memory handle and block.*/
+static int vc_sm_ioctl_unlock(struct sm_priv_data_t *private,
+			      struct vmcs_sm_ioctl_lock_unlock *ioparam,
+			      int flush, int wait_reply, int no_vc_unlock)
+{
+	int status;
+	struct vc_sm_lock_unlock_t unlock;
+	struct sm_mmap *map, *map_tmp;
+	struct sm_resource_t *resource;
+	int ret = 0;
+
+	map = NULL;
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(private, ioparam->handle);
+	if (resource == NULL) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n",
+			__func__, current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	unlock.res_handle = resource->res_handle;
+	unlock.res_mem = (uint32_t)resource->res_base_mem;
+
+	pr_debug("[%s]: attempt to unlock data - guid %x, hdl %x, base address %p\n",
+		__func__, ioparam->handle, unlock.res_handle,
+		(void *)unlock.res_mem);
+
+	/* User space allocated resources. */
+	if (resource->pid) {
+		/* Flush if requested */
+		if (resource->res_cached && flush) {
+			dma_addr_t phys_addr = 0;
+
+			resource->res_stats[FLUSH]++;
+
+			phys_addr =
+			    (dma_addr_t)((uint32_t)resource->res_base_mem &
+					 0x3FFFFFFF);
+			phys_addr += (dma_addr_t)mm_vc_mem_phys_addr;
+
+			/* L1 cache flush */
+			down_read(&current->mm->mmap_sem);
+			list_for_each_entry(map, &resource->map_list,
+					    resource_map_list) {
+				if (map->vma) {
+					const unsigned long start = map->vma->vm_start;
+					const unsigned long end = map->vma->vm_end;
+
+					ret = clean_invalid_mem_walk(start, end - start,
+							VCSM_CACHE_OP_FLUSH);
+					if (ret)
+						goto error;
+				}
+			}
+			up_read(&current->mm->mmap_sem);
+
+			/* L2 cache flush */
+			outer_clean_range(phys_addr,
+					  phys_addr +
+					  (size_t) resource->res_size);
+		}
+
+		/* We need to zap all the vmas associated with this resource */
+		if (resource->lock_count == 1) {
+			down_read(&current->mm->mmap_sem);
+			list_for_each_entry(map, &resource->map_list,
+					    resource_map_list) {
+				if (map->vma) {
+					zap_vma_ptes(map->vma,
+						     map->vma->vm_start,
+						     map->vma->vm_end -
+						     map->vma->vm_start);
+				}
+			}
+			up_read(&current->mm->mmap_sem);
+		}
+	}
+	/* Kernel allocated resources. */
+	else {
+		/* Global + Taken in this context */
+		if (resource->ref_count == 2) {
+			if (!list_empty(&resource->map_list)) {
+				list_for_each_entry_safe(map, map_tmp,
+						&resource->map_list,
+						resource_map_list) {
+					if (map->res_addr) {
+						if (flush &&
+								(resource->res_cached ==
+									VMCS_SM_CACHE_HOST)) {
+							unsigned long
+								phys_addr;
+							phys_addr = (uint32_t)
+								resource->res_base_mem & 0x3FFFFFFF;
+							phys_addr +=
+								mm_vc_mem_phys_addr;
+
+							/* L1 cache flush */
+							dmac_flush_range((const
+										void
+										*)
+									map->res_addr, (const void *)
+									(map->res_addr + resource->res_size));
+
+							/* L2 cache flush */
+							outer_clean_range
+								(phys_addr,
+								 phys_addr +
+								 (size_t)
+								 resource->res_size);
+						}
+
+						iounmap((void *)map->res_addr);
+						map->res_addr = 0;
+
+						vmcs_sm_remove_map(sm_state,
+								map->resource,
+								map);
+						break;
+					}
+				}
+			}
+		}
+	}
+
+	if (resource->lock_count) {
+		/* Bypass the videocore unlock. */
+		if (no_vc_unlock)
+			status = 0;
+		/* Unlock the videocore allocated resource. */
+		else {
+			status =
+			    vc_vchi_sm_unlock(sm_state->sm_handle, &unlock,
+					      &private->int_trans_id,
+					      wait_reply);
+			if (status == -EINTR) {
+				pr_debug("[%s]: requesting unlock memory action restart (trans_id: %u)\n",
+					__func__, private->int_trans_id);
+
+				ret = -ERESTARTSYS;
+				resource->res_stats[UNLOCK]--;
+				private->restart_sys = -EINTR;
+				private->int_action = VC_SM_MSG_TYPE_UNLOCK;
+				goto error;
+			} else if (status != 0) {
+				pr_err("[%s]: failed to unlock vc mem (status: %u, trans_id: %u)\n",
+				     __func__, status, private->int_trans_id);
+
+				ret = -EPERM;
+				resource->res_stats[UNLOCK_FAIL]++;
+				goto error;
+			}
+		}
+
+		resource->res_stats[UNLOCK]++;
+		resource->lock_count--;
+	}
+
+	pr_debug("[%s]: success to unlock data - hdl %x, base address %p, ref-cnt %d\n",
+		__func__, unlock.res_handle, (void *)unlock.res_mem,
+		resource->lock_count);
+
+error:
+	if (resource)
+		vmcs_sm_release_resource(resource, 0);
+
+	return ret;
+}
+
+/* Import a contiguous block of memory to be shared with VC. */
+int vc_sm_ioctl_import_dmabuf(struct sm_priv_data_t *private,
+			      struct vmcs_sm_ioctl_import_dmabuf *ioparam,
+			      struct dma_buf *src_dma_buf)
+{
+	int ret = 0;
+	int status;
+	struct sm_resource_t *resource = NULL;
+	struct vc_sm_import import = { 0 };
+	struct vc_sm_import_result result = { 0 };
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *sgt = NULL;
+
+	/* Setup our allocation parameters */
+	if (src_dma_buf) {
+		get_dma_buf(src_dma_buf);
+		dma_buf = src_dma_buf;
+	} else {
+		dma_buf = dma_buf_get(ioparam->dmabuf_fd);
+	}
+	if (IS_ERR(dma_buf))
+		return PTR_ERR(dma_buf);
+
+	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
+	if (IS_ERR(attach)) {
+		ret = PTR_ERR(attach);
+		goto error;
+	}
+
+	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+	if (IS_ERR(sgt)) {
+		ret = PTR_ERR(sgt);
+		goto error;
+	}
+
+	/* Verify that the address block is contiguous */
+	if (sgt->nents != 1) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	import.type = ((ioparam->cached == VMCS_SM_CACHE_VC) ||
+		       (ioparam->cached == VMCS_SM_CACHE_BOTH)) ?
+				VC_SM_ALLOC_CACHED : VC_SM_ALLOC_NON_CACHED;
+	import.addr = (uint32_t)sg_dma_address(sgt->sgl);
+	import.size = sg_dma_len(sgt->sgl);
+	import.allocator = current->tgid;
+
+	if (*ioparam->name)
+		memcpy(import.name, ioparam->name, sizeof(import.name) - 1);
+	else
+		memcpy(import.name, VMCS_SM_RESOURCE_NAME_DEFAULT,
+		       sizeof(VMCS_SM_RESOURCE_NAME_DEFAULT));
+
+	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %p, size %u\n",
+		 __func__, import.name, import.type,
+		 (void *)import.addr, import.size);
+
+	/* Allocate local resource to track this allocation. */
+	resource = kzalloc(sizeof(*resource), GFP_KERNEL);
+	if (!resource) {
+		ret = -ENOMEM;
+		goto error;
+	}
+	INIT_LIST_HEAD(&resource->map_list);
+	resource->ref_count++;
+	resource->pid = current->tgid;
+
+	/* Allocate the videocore resource. */
+	status = vc_vchi_sm_import(sm_state->sm_handle, &import, &result,
+				   &private->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
+			 __func__, private->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_IMPORT;
+		goto error;
+	} else if (status || !result.res_handle) {
+		pr_debug("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
+			 __func__, status, private->int_trans_id);
+		ret = -ENOMEM;
+		resource->res_stats[ALLOC_FAIL]++;
+		goto error;
+	}
+
+	/* Keep track of the resource we created. */
+	resource->private = private;
+	resource->res_handle = result.res_handle;
+	resource->res_size = import.size;
+	resource->res_cached = ioparam->cached;
+
+	resource->dma_buf = dma_buf;
+	resource->attach = attach;
+	resource->sgt = sgt;
+	resource->dma_addr = sg_dma_address(sgt->sgl);
+
+	/*
+	 * Kernel/user GUID.  This global identifier is used for mmap'ing the
+	 * allocated region from user space, it is passed as the mmap'ing
+	 * offset, we use it to 'hide' the videocore handle/address.
+	 */
+	mutex_lock(&sm_state->lock);
+	resource->res_guid = ++sm_state->guid;
+	mutex_unlock(&sm_state->lock);
+	resource->res_guid <<= PAGE_SHIFT;
+
+	vmcs_sm_add_resource(private, resource);
+
+	/* We're done */
+	resource->res_stats[IMPORT]++;
+	ioparam->handle = resource->res_guid;
+	return 0;
+
+error:
+	resource->res_stats[IMPORT_FAIL]++;
+	if (resource) {
+		vc_sm_resource_deceased(resource, 1);
+		kfree(resource);
+	}
+	if (sgt)
+		dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
+	if (attach)
+		dma_buf_detach(dma_buf, attach);
+	dma_buf_put(dma_buf);
+	return ret;
+}
+
+/* Handle control from host. */
+static long vc_sm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	int ret = 0;
+	unsigned int cmdnr = _IOC_NR(cmd);
+	struct sm_priv_data_t *file_data =
+	    (struct sm_priv_data_t *)file->private_data;
+	struct sm_resource_t *resource = NULL;
+
+	/* Validate we can work with this device. */
+	if ((sm_state == NULL) || (file_data == NULL)) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
+			current->tgid, file_data->pid);
+
+	/* Action is a re-post of a previously interrupted action? */
+	if (file_data->restart_sys == -EINTR) {
+		struct vc_sm_action_clean_t action_clean;
+
+		pr_debug("[%s]: clean up of action %u (trans_id: %u) following EINTR\n",
+			__func__, file_data->int_action,
+			file_data->int_trans_id);
+
+		action_clean.res_action = file_data->int_action;
+		action_clean.action_trans_id = file_data->int_trans_id;
+
+		vc_vchi_sm_clean_up(sm_state->sm_handle, &action_clean);
+
+		file_data->restart_sys = 0;
+	}
+
+	/* Now process the command. */
+	switch (cmdnr) {
+		/* New memory allocation.
+		 */
+	case VMCS_SM_CMD_ALLOC:
+		{
+			struct vmcs_sm_ioctl_alloc ioparam;
+
+			/* Get the parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_alloc(file_data, &ioparam);
+			if (!ret &&
+			    (copy_to_user((void *)arg,
+					  &ioparam, sizeof(ioparam)) != 0)) {
+				struct vmcs_sm_ioctl_free freeparam = {
+					ioparam.handle
+				};
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+						__func__, cmdnr);
+				vc_sm_ioctl_free(file_data, &freeparam);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Share existing memory allocation. */
+	case VMCS_SM_CMD_ALLOC_SHARE:
+		{
+			struct vmcs_sm_ioctl_alloc_share ioparam;
+
+			/* Get the parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_alloc_share(file_data, &ioparam);
+
+			/* Copy result back to user. */
+			if (!ret
+			    && copy_to_user((void *)arg, &ioparam,
+					    sizeof(ioparam)) != 0) {
+				struct vmcs_sm_ioctl_free freeparam = {
+					ioparam.handle
+				};
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+						__func__, cmdnr);
+				vc_sm_ioctl_free(file_data, &freeparam);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+	case VMCS_SM_CMD_IMPORT_DMABUF:
+		{
+			struct vmcs_sm_ioctl_import_dmabuf ioparam;
+
+			/* Get the parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+				       __func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_import_dmabuf(file_data, &ioparam,
+							NULL);
+			if (!ret &&
+			    (copy_to_user((void *)arg,
+					  &ioparam, sizeof(ioparam)) != 0)) {
+				struct vmcs_sm_ioctl_free freeparam = {
+					ioparam.handle
+				};
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				       __func__, cmdnr);
+				vc_sm_ioctl_free(file_data, &freeparam);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Lock (attempt to) *and* register a cache behavior change. */
+	case VMCS_SM_CMD_LOCK_CACHE:
+		{
+			struct vmcs_sm_ioctl_lock_cache ioparam;
+			struct vmcs_sm_ioctl_lock_unlock lock;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			lock.handle = ioparam.handle;
+			ret =
+			    vc_sm_ioctl_lock(file_data, &lock, 1,
+					     ioparam.cached, 0);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Lock (attempt to) existing memory allocation. */
+	case VMCS_SM_CMD_LOCK:
+		{
+			struct vmcs_sm_ioctl_lock_unlock ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_lock(file_data, &ioparam, 0, 0, 0);
+
+			/* Copy result back to user. */
+			if (copy_to_user((void *)arg, &ioparam, sizeof(ioparam))
+			    != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Unlock (attempt to) existing memory allocation. */
+	case VMCS_SM_CMD_UNLOCK:
+		{
+			struct vmcs_sm_ioctl_lock_unlock ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_unlock(file_data, &ioparam, 0, 1, 0);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Resize (attempt to) existing memory allocation. */
+	case VMCS_SM_CMD_RESIZE:
+		{
+			struct vmcs_sm_ioctl_resize ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_resize(file_data, &ioparam);
+
+			/* Copy result back to user. */
+			if (copy_to_user((void *)arg, &ioparam, sizeof(ioparam))
+			    != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+			goto out;
+		}
+		break;
+
+		/* Terminate existing memory allocation.
+		 */
+	case VMCS_SM_CMD_FREE:
+		{
+			struct vmcs_sm_ioctl_free ioparam;
+
+			/* Get parameter data.
+			 */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_free(file_data, &ioparam);
+
+			/* Done.
+			 */
+			goto out;
+		}
+		break;
+
+		/* Walk allocation on videocore, information shows up in the
+		 ** videocore log.
+		 */
+	case VMCS_SM_CMD_VC_WALK_ALLOC:
+		{
+			pr_debug("[%s]: invoking walk alloc\n", __func__);
+
+			if (vc_vchi_sm_walk_alloc(sm_state->sm_handle) != 0)
+				pr_err("[%s]: failed to walk-alloc on videocore\n",
+				     __func__);
+
+			/* Done.
+			 */
+			goto out;
+		}
+		break;
+		/* Walk mapping table on host, information shows up in the
+		 ** kernel log.
+		 */
+	case VMCS_SM_CMD_HOST_WALK_MAP:
+		{
+			/* Use pid of -1 to tell to walk the whole map. */
+			vmcs_sm_host_walk_map_per_pid(-1);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Walk mapping table per process on host.  */
+	case VMCS_SM_CMD_HOST_WALK_PID_ALLOC:
+		{
+			struct vmcs_sm_ioctl_walk ioparam;
+
+			/* Get parameter data.  */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			vmcs_sm_host_walk_alloc(file_data);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Walk allocation per process on host.  */
+	case VMCS_SM_CMD_HOST_WALK_PID_MAP:
+		{
+			struct vmcs_sm_ioctl_walk ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			vmcs_sm_host_walk_map_per_pid(ioparam.pid);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Gets the size of the memory associated with a user handle. */
+	case VMCS_SM_CMD_SIZE_USR_HANDLE:
+		{
+			struct vmcs_sm_ioctl_size ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource != NULL) {
+				ioparam.size = resource->res_size;
+				vmcs_sm_release_resource(resource, 0);
+			} else {
+				ioparam.size = 0;
+			}
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Verify we are dealing with a valid resource. */
+	case VMCS_SM_CMD_CHK_USR_HANDLE:
+		{
+			struct vmcs_sm_ioctl_chk ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource == NULL)
+				ret = -EINVAL;
+			/*
+			 * If the resource is cacheable, return additional
+			 * information that may be needed to flush the cache.
+			 */
+			else if ((resource->res_cached == VMCS_SM_CACHE_HOST) ||
+				 (resource->res_cached == VMCS_SM_CACHE_BOTH)) {
+				ioparam.addr =
+				    vmcs_sm_usr_address_from_pid_and_usr_handle
+				    (current->tgid, ioparam.handle);
+				ioparam.size = resource->res_size;
+				ioparam.cache = resource->res_cached;
+			} else {
+				ioparam.addr = 0;
+				ioparam.size = 0;
+				ioparam.cache = resource->res_cached;
+			}
+
+			if (resource)
+				vmcs_sm_release_resource(resource, 0);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/*
+		 * Maps a user handle given the process and the virtual address.
+		 */
+	case VMCS_SM_CMD_MAPPED_USR_HANDLE:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ioparam.handle =
+			    vmcs_sm_usr_handle_from_pid_and_address(
+					    ioparam.pid, ioparam.addr);
+
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if ((resource != NULL)
+			    && ((resource->res_cached == VMCS_SM_CACHE_HOST)
+				|| (resource->res_cached ==
+				    VMCS_SM_CACHE_BOTH))) {
+				ioparam.size = resource->res_size;
+			} else {
+				ioparam.size = 0;
+			}
+
+			if (resource)
+				vmcs_sm_release_resource(resource, 0);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/*
+		 * Maps a videocore handle given process and virtual address.
+		 */
+	case VMCS_SM_CMD_MAPPED_VC_HDL_FROM_ADDR:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ioparam.handle = vmcs_sm_vc_handle_from_pid_and_address(
+					    ioparam.pid, ioparam.addr);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Maps a videocore handle given process and user handle. */
+	case VMCS_SM_CMD_MAPPED_VC_HDL_FROM_HDL:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource != NULL) {
+				ioparam.handle = resource->res_handle;
+				vmcs_sm_release_resource(resource, 0);
+			} else {
+				ioparam.handle = 0;
+			}
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/*
+		 * Maps a videocore address given process and videocore handle.
+		 */
+	case VMCS_SM_CMD_MAPPED_VC_ADDR_FROM_HDL:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource != NULL) {
+				ioparam.addr =
+					(unsigned int)resource->res_base_mem;
+				vmcs_sm_release_resource(resource, 0);
+			} else {
+				ioparam.addr = 0;
+			}
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Maps a user address given process and vc handle. */
+	case VMCS_SM_CMD_MAPPED_USR_ADDRESS:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/*
+			 * Return the address information from the mapping,
+			 * 0 (ie NULL) if it cannot locate the actual mapping.
+			 */
+			ioparam.addr =
+			    vmcs_sm_usr_address_from_pid_and_usr_handle
+			    (ioparam.pid, ioparam.handle);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Flush the cache for a given mapping. */
+	case VMCS_SM_CMD_FLUSH:
+		{
+			struct vmcs_sm_ioctl_cache ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource == NULL) {
+				ret = -EINVAL;
+				goto out;
+			}
+
+			ret = clean_invalid_resource_walk((void __user*) ioparam.addr,
+					ioparam.size, VCSM_CACHE_OP_FLUSH, ioparam.handle,
+					resource);
+			vmcs_sm_release_resource(resource, 0);
+			if (ret)
+				goto out;
+		}
+		break;
+
+		/* Invalidate the cache for a given mapping. */
+	case VMCS_SM_CMD_INVALID:
+		{
+			struct vmcs_sm_ioctl_cache ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource == NULL) {
+				ret = -EINVAL;
+				goto out;
+			}
+
+			ret = clean_invalid_resource_walk((void __user*) ioparam.addr,
+					ioparam.size, VCSM_CACHE_OP_INV, ioparam.handle, resource);
+			vmcs_sm_release_resource(resource, 0);
+			if (ret)
+				goto out;
+		}
+		break;
+
+	/* Flush/Invalidate the cache for a given mapping. */
+	case VMCS_SM_CMD_CLEAN_INVALID:
+		{
+			int i;
+			struct vmcs_sm_ioctl_clean_invalid ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+			for (i = 0; i < sizeof(ioparam.s) / sizeof(*ioparam.s); i++) {
+				if (ioparam.s[i].cmd == VCSM_CACHE_OP_NOP)
+					break;
+
+				/* Locate resource from GUID. */
+				resource =
+					vmcs_sm_acquire_resource(file_data, ioparam.s[i].handle);
+				if (resource == NULL) {
+					ret = -EINVAL;
+					goto out;
+				}
+
+				ret = clean_invalid_resource_walk(
+						(void __user*) ioparam.s[i].addr, ioparam.s[i].size,
+						ioparam.s[i].cmd, ioparam.s[i].handle, resource);
+				vmcs_sm_release_resource(resource, 0);
+				if (ret)
+					goto out;
+			}
+		}
+		break;
+	/*
+	 * Flush/Invalidate the cache for a given mapping.
+	 * Blocks must be pinned (i.e. accessed) before this call.
+	 */
+	case VMCS_SM_CMD_CLEAN_INVALID2:
+		{
+				int i;
+				struct vmcs_sm_ioctl_clean_invalid2 ioparam;
+				struct vmcs_sm_ioctl_clean_invalid_block *block = NULL;
+
+				/* Get parameter data. */
+				if (copy_from_user(&ioparam,
+						   (void *)arg, sizeof(ioparam)) != 0) {
+					pr_err("[%s]: failed to copy-from-user header for cmd %x\n",
+							__func__, cmdnr);
+					ret = -EFAULT;
+					goto out;
+				}
+				block = kmalloc(ioparam.op_count *
+						sizeof(struct vmcs_sm_ioctl_clean_invalid_block),
+						GFP_KERNEL);
+				if (!block) {
+					ret = -EFAULT;
+					goto out;
+				}
+				if (copy_from_user(block,
+						   (void *)(arg + sizeof(ioparam)), ioparam.op_count * sizeof(struct vmcs_sm_ioctl_clean_invalid_block)) != 0) {
+					pr_err("[%s]: failed to copy-from-user payload for cmd %x\n",
+							__func__, cmdnr);
+					ret = -EFAULT;
+					goto out;
+				}
+
+				for (i = 0; i < ioparam.op_count; i++) {
+					const struct vmcs_sm_ioctl_clean_invalid_block * const op = block + i;
+
+					if (op->invalidate_mode == VCSM_CACHE_OP_NOP)
+						continue;
+
+					ret = clean_invalid_contiguous_mem_2d(
+							(void __user*) op->start_address, op->block_count,
+							op->block_size, op->inter_block_stride,
+							op->invalidate_mode);
+					if (ret)
+						break;
+				}
+				kfree(block);
+			}
+		break;
+
+	default:
+		{
+			ret = -EINVAL;
+			goto out;
+		}
+		break;
+	}
+
+out:
+	return ret;
+}
+
+/* Device operations that we managed in this driver. */
+static const struct file_operations vmcs_sm_ops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = vc_sm_ioctl,
+	.open = vc_sm_open,
+	.release = vc_sm_release,
+	.mmap = vc_sm_mmap,
+};
+
+/* Creation of device. */
+static int vc_sm_create_sharedmemory(void)
+{
+	int ret;
+
+	if (sm_state == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	/* Create a device class for creating dev nodes. */
+	sm_state->sm_class = class_create(THIS_MODULE, "vc-sm");
+	if (IS_ERR(sm_state->sm_class)) {
+		pr_err("[%s]: unable to create device class\n", __func__);
+		ret = PTR_ERR(sm_state->sm_class);
+		goto out;
+	}
+
+	/* Create a character driver. */
+	ret = alloc_chrdev_region(&sm_state->sm_devid,
+				  DEVICE_MINOR, 1, DEVICE_NAME);
+	if (ret != 0) {
+		pr_err("[%s]: unable to allocate device number\n", __func__);
+		goto out_dev_class_destroy;
+	}
+
+	cdev_init(&sm_state->sm_cdev, &vmcs_sm_ops);
+	ret = cdev_add(&sm_state->sm_cdev, sm_state->sm_devid, 1);
+	if (ret != 0) {
+		pr_err("[%s]: unable to register device\n", __func__);
+		goto out_chrdev_unreg;
+	}
+
+	/* Create a device node. */
+	sm_state->sm_dev = device_create(sm_state->sm_class,
+					 NULL,
+					 MKDEV(MAJOR(sm_state->sm_devid),
+					       DEVICE_MINOR), NULL,
+					 DEVICE_NAME);
+	if (IS_ERR(sm_state->sm_dev)) {
+		pr_err("[%s]: unable to create device node\n", __func__);
+		ret = PTR_ERR(sm_state->sm_dev);
+		goto out_chrdev_del;
+	}
+
+	goto out;
+
+out_chrdev_del:
+	cdev_del(&sm_state->sm_cdev);
+out_chrdev_unreg:
+	unregister_chrdev_region(sm_state->sm_devid, 1);
+out_dev_class_destroy:
+	class_destroy(sm_state->sm_class);
+	sm_state->sm_class = NULL;
+out:
+	return ret;
+}
+
+/* Termination of the device. */
+static int vc_sm_remove_sharedmemory(void)
+{
+	int ret;
+
+	if (sm_state == NULL) {
+		/* Nothing to do. */
+		ret = 0;
+		goto out;
+	}
+
+	/* Remove the sharedmemory character driver. */
+	cdev_del(&sm_state->sm_cdev);
+
+	/* Unregister region. */
+	unregister_chrdev_region(sm_state->sm_devid, 1);
+
+	ret = 0;
+	goto out;
+
+out:
+	return ret;
+}
+
+/* Videocore connected.  */
+static void vc_sm_connected_init(void)
+{
+	int ret;
+	VCHI_INSTANCE_T vchi_instance;
+	VCHI_CONNECTION_T *vchi_connection = NULL;
+
+	pr_info("[%s]: start\n", __func__);
+
+	/*
+	 * Initialize and create a VCHI connection for the shared memory service
+	 * running on videocore.
+	 */
+	ret = vchi_initialise(&vchi_instance);
+	if (ret != 0) {
+		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
+			__func__, ret);
+
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
+	ret = vchi_connect(NULL, 0, vchi_instance);
+	if (ret != 0) {
+		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
+			__func__, ret);
+
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
+	/* Initialize an instance of the shared memory service. */
+	sm_state->sm_handle =
+	    vc_vchi_sm_init(vchi_instance, &vchi_connection, 1);
+	if (sm_state->sm_handle == NULL) {
+		pr_err("[%s]: failed to initialize shared memory service\n",
+			__func__);
+
+		ret = -EPERM;
+		goto err_free_mem;
+	}
+
+	/* Create a debug fs directory entry (root). */
+	sm_state->dir_root = debugfs_create_dir(VC_SM_DIR_ROOT_NAME, NULL);
+	if (!sm_state->dir_root) {
+		pr_err("[%s]: failed to create \'%s\' directory entry\n",
+			__func__, VC_SM_DIR_ROOT_NAME);
+
+		ret = -EPERM;
+		goto err_stop_sm_service;
+	}
+
+	sm_state->dir_state.show = &vc_sm_global_state_show;
+	sm_state->dir_state.dir_entry = debugfs_create_file(VC_SM_STATE,
+			0444, sm_state->dir_root, &sm_state->dir_state,
+			&vc_sm_debug_fs_fops);
+
+	sm_state->dir_stats.show = &vc_sm_global_statistics_show;
+	sm_state->dir_stats.dir_entry = debugfs_create_file(VC_SM_STATS,
+			0444, sm_state->dir_root, &sm_state->dir_stats,
+			&vc_sm_debug_fs_fops);
+
+	/* Create the proc entry children. */
+	sm_state->dir_alloc = debugfs_create_dir(VC_SM_DIR_ALLOC_NAME,
+			sm_state->dir_root);
+
+	/* Create a shared memory device. */
+	ret = vc_sm_create_sharedmemory();
+	if (ret != 0) {
+		pr_err("[%s]: failed to create shared memory device\n",
+			__func__);
+		goto err_remove_debugfs;
+	}
+
+	INIT_LIST_HEAD(&sm_state->map_list);
+	INIT_LIST_HEAD(&sm_state->resource_list);
+
+	sm_state->data_knl = vc_sm_create_priv_data(0);
+	if (sm_state->data_knl == NULL) {
+		pr_err("[%s]: failed to create kernel private data tracker\n",
+			__func__);
+		goto err_remove_shared_memory;
+	}
+
+	/* Done! */
+	sm_inited = 1;
+	goto out;
+
+err_remove_shared_memory:
+	vc_sm_remove_sharedmemory();
+err_remove_debugfs:
+	debugfs_remove_recursive(sm_state->dir_root);
+err_stop_sm_service:
+	vc_vchi_sm_stop(&sm_state->sm_handle);
+err_free_mem:
+	kfree(sm_state);
+out:
+	pr_info("[%s]: end - returning %d\n", __func__, ret);
+}
+
+/* Driver loading. */
+static int bcm2835_vcsm_probe(struct platform_device *pdev)
+{
+	pr_info("vc-sm: Videocore shared memory driver\n");
+
+	sm_state = kzalloc(sizeof(*sm_state), GFP_KERNEL);
+	if (!sm_state)
+		return -ENOMEM;
+	sm_state->pdev = pdev;
+	mutex_init(&sm_state->lock);
+	mutex_init(&sm_state->map_lock);
+
+	vchiq_add_connected_callback(vc_sm_connected_init);
+	return 0;
+}
+
+/* Driver unloading. */
+static int bcm2835_vcsm_remove(struct platform_device *pdev)
+{
+	pr_debug("[%s]: start\n", __func__);
+	if (sm_inited) {
+		/* Remove shared memory device. */
+		vc_sm_remove_sharedmemory();
+
+		/* Remove all proc entries. */
+		debugfs_remove_recursive(sm_state->dir_root);
+
+		/* Stop the videocore shared memory service. */
+		vc_vchi_sm_stop(&sm_state->sm_handle);
+
+		/* Free the memory for the state structure. */
+		mutex_destroy(&(sm_state->map_lock));
+		kfree(sm_state);
+	}
+
+	pr_debug("[%s]: end\n", __func__);
+	return 0;
+}
+
+#if defined(__KERNEL__)
+/* Allocate a shared memory handle and block. */
+int vc_sm_alloc(struct vc_sm_alloc_t *alloc, int *handle)
+{
+	struct vmcs_sm_ioctl_alloc ioparam = { 0 };
+	int ret;
+	struct sm_resource_t *resource;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || alloc == NULL || handle == NULL) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ioparam.size = alloc->base_unit;
+	ioparam.num = alloc->num_unit;
+	ioparam.cached =
+	    alloc->type == VC_SM_ALLOC_CACHED ? VMCS_SM_CACHE_VC : 0;
+
+	ret = vc_sm_ioctl_alloc(sm_state->data_knl, &ioparam);
+
+	if (ret == 0) {
+		resource =
+		    vmcs_sm_acquire_resource(sm_state->data_knl,
+					     ioparam.handle);
+		if (resource) {
+			resource->pid = 0;
+			vmcs_sm_release_resource(resource, 0);
+
+			/* Assign valid handle at this time. */
+			*handle = ioparam.handle;
+		} else {
+			ret = -ENOMEM;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_alloc);
+
+/* Get an internal resource handle mapped from the external one. */
+int vc_sm_int_handle(int handle)
+{
+	struct sm_resource_t *resource;
+	int ret = 0;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return 0;
+	}
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(sm_state->data_knl, handle);
+	if (resource) {
+		ret = resource->res_handle;
+		vmcs_sm_release_resource(resource, 0);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_int_handle);
+
+/* Free a previously allocated shared memory handle and block. */
+int vc_sm_free(int handle)
+{
+	struct vmcs_sm_ioctl_free ioparam = { handle };
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	return vc_sm_ioctl_free(sm_state->data_knl, &ioparam);
+}
+EXPORT_SYMBOL_GPL(vc_sm_free);
+
+/* Lock a memory handle for use by kernel. */
+int vc_sm_lock(int handle, enum vc_sm_lock_cache_mode mode,
+	       unsigned long *data)
+{
+	struct vmcs_sm_ioctl_lock_unlock ioparam;
+	int ret;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0 || data == NULL) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	*data = 0;
+
+	ioparam.handle = handle;
+	ret = vc_sm_ioctl_lock(sm_state->data_knl,
+			       &ioparam,
+			       1,
+			       ((mode ==
+				 VC_SM_LOCK_CACHED) ? VMCS_SM_CACHE_HOST :
+				VMCS_SM_CACHE_NONE), 0);
+
+	*data = ioparam.addr;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_lock);
+
+/* Unlock a memory handle in use by kernel. */
+int vc_sm_unlock(int handle, int flush, int no_vc_unlock)
+{
+	struct vmcs_sm_ioctl_lock_unlock ioparam;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ioparam.handle = handle;
+	return vc_sm_ioctl_unlock(sm_state->data_knl,
+				  &ioparam, flush, 0, no_vc_unlock);
+}
+EXPORT_SYMBOL_GPL(vc_sm_unlock);
+
+/* Map a shared memory region for use by kernel. */
+int vc_sm_map(int handle, unsigned int sm_addr,
+	      enum vc_sm_lock_cache_mode mode, unsigned long *data)
+{
+	struct vmcs_sm_ioctl_lock_unlock ioparam;
+	int ret;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0 || data == NULL || sm_addr == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	*data = 0;
+
+	ioparam.handle = handle;
+	ret = vc_sm_ioctl_lock(sm_state->data_knl,
+			       &ioparam,
+			       1,
+			       ((mode ==
+				 VC_SM_LOCK_CACHED) ? VMCS_SM_CACHE_HOST :
+				VMCS_SM_CACHE_NONE), sm_addr);
+
+	*data = ioparam.addr;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_map);
+
+/* Import a dmabuf to be shared with VC. */
+int vc_sm_import_dmabuf(struct dma_buf *dmabuf, int *handle)
+{
+	struct vmcs_sm_ioctl_import_dmabuf ioparam = { 0 };
+	int ret;
+	struct sm_resource_t *resource;
+
+	/* Validate we can work with this device. */
+	if (!sm_state || !dmabuf || !handle) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ioparam.cached = 0;
+	strcpy(ioparam.name, "KRNL DMABUF");
+
+	ret = vc_sm_ioctl_import_dmabuf(sm_state->data_knl, &ioparam, dmabuf);
+
+	if (!ret) {
+		resource = vmcs_sm_acquire_resource(sm_state->data_knl,
+						    ioparam.handle);
+		if (resource) {
+			resource->pid = 0;
+			vmcs_sm_release_resource(resource, 0);
+
+			/* Assign valid handle at this time.*/
+			*handle = ioparam.handle;
+		} else {
+			ret = -ENOMEM;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_import_dmabuf);
+#endif
+
+/*
+ *   Register the driver with device tree
+ */
+
+static const struct of_device_id bcm2835_vcsm_of_match[] = {
+	{.compatible = "raspberrypi,bcm2835-vcsm",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_vcsm_of_match);
+
+static struct platform_driver bcm2835_vcsm_driver = {
+	.probe = bcm2835_vcsm_probe,
+	.remove = bcm2835_vcsm_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_vcsm_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_vcsm_driver);
+
+MODULE_AUTHOR("Broadcom");
+MODULE_DESCRIPTION("VideoCore SharedMemory Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/include/linux/broadcom/vmcs_sm_ioctl.h b/include/linux/broadcom/vmcs_sm_ioctl.h
new file mode 100644
index 0000000000000..2395ff08c5cee
--- /dev/null
+++ b/include/linux/broadcom/vmcs_sm_ioctl.h
@@ -0,0 +1,294 @@
+/*****************************************************************************
+*  Copyright 2011 Broadcom Corporation.  All rights reserved.
+*
+*  Unless you and Broadcom execute a separate written software license
+*  agreement governing use of this software, this software is licensed to you
+*  under the terms of the GNU General Public License version 2, available at
+*  http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+*  Notwithstanding the above, under no circumstances may you combine this
+*  software in any way with any other Broadcom software provided under a
+*  license other than the GPL, without Broadcom's express prior written
+*  consent.
+*
+*****************************************************************************/
+
+#if !defined(__VMCS_SM_IOCTL_H__INCLUDED__)
+#define __VMCS_SM_IOCTL_H__INCLUDED__
+
+/* ---- Include Files ---------------------------------------------------- */
+
+#if defined(__KERNEL__)
+#include <linux/types.h>	/* Needed for standard types */
+#else
+#include <stdint.h>
+#endif
+
+#include <linux/ioctl.h>
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+#define VMCS_SM_RESOURCE_NAME               32
+#define VMCS_SM_RESOURCE_NAME_DEFAULT       "sm-host-resource"
+
+/* Type define used to create unique IOCTL number */
+#define VMCS_SM_MAGIC_TYPE                  'I'
+
+/* IOCTL commands */
+enum vmcs_sm_cmd_e {
+	VMCS_SM_CMD_ALLOC = 0x5A,	/* Start at 0x5A arbitrarily */
+	VMCS_SM_CMD_ALLOC_SHARE,
+	VMCS_SM_CMD_LOCK,
+	VMCS_SM_CMD_LOCK_CACHE,
+	VMCS_SM_CMD_UNLOCK,
+	VMCS_SM_CMD_RESIZE,
+	VMCS_SM_CMD_UNMAP,
+	VMCS_SM_CMD_FREE,
+	VMCS_SM_CMD_FLUSH,
+	VMCS_SM_CMD_INVALID,
+
+	VMCS_SM_CMD_SIZE_USR_HANDLE,
+	VMCS_SM_CMD_CHK_USR_HANDLE,
+
+	VMCS_SM_CMD_MAPPED_USR_HANDLE,
+	VMCS_SM_CMD_MAPPED_USR_ADDRESS,
+	VMCS_SM_CMD_MAPPED_VC_HDL_FROM_ADDR,
+	VMCS_SM_CMD_MAPPED_VC_HDL_FROM_HDL,
+	VMCS_SM_CMD_MAPPED_VC_ADDR_FROM_HDL,
+
+	VMCS_SM_CMD_VC_WALK_ALLOC,
+	VMCS_SM_CMD_HOST_WALK_MAP,
+	VMCS_SM_CMD_HOST_WALK_PID_ALLOC,
+	VMCS_SM_CMD_HOST_WALK_PID_MAP,
+
+	VMCS_SM_CMD_CLEAN_INVALID,
+	VMCS_SM_CMD_CLEAN_INVALID2,
+
+	VMCS_SM_CMD_IMPORT_DMABUF,
+
+	VMCS_SM_CMD_LAST	/* Do not delete */
+};
+
+/* Cache type supported, conveniently matches the user space definition in
+** user-vcsm.h.
+*/
+enum vmcs_sm_cache_e {
+	VMCS_SM_CACHE_NONE,
+	VMCS_SM_CACHE_HOST,
+	VMCS_SM_CACHE_VC,
+	VMCS_SM_CACHE_BOTH,
+};
+
+/* Cache functions */
+#define VCSM_CACHE_OP_INV       0x01
+#define VCSM_CACHE_OP_CLEAN     0x02
+#define VCSM_CACHE_OP_FLUSH     0x03
+
+/* IOCTL Data structures */
+struct vmcs_sm_ioctl_alloc {
+	/* user -> kernel */
+	unsigned int size;
+	unsigned int num;
+	enum vmcs_sm_cache_e cached;
+	char name[VMCS_SM_RESOURCE_NAME];
+
+	/* kernel -> user */
+	unsigned int handle;
+	/* unsigned int base_addr; */
+};
+
+struct vmcs_sm_ioctl_alloc_share {
+	/* user -> kernel */
+	unsigned int handle;
+	unsigned int size;
+};
+
+struct vmcs_sm_ioctl_free {
+	/* user -> kernel */
+	unsigned int handle;
+	/* unsigned int base_addr; */
+};
+
+struct vmcs_sm_ioctl_lock_unlock {
+	/* user -> kernel */
+	unsigned int handle;
+
+	/* kernel -> user */
+	unsigned int addr;
+};
+
+struct vmcs_sm_ioctl_lock_cache {
+	/* user -> kernel */
+	unsigned int handle;
+	enum vmcs_sm_cache_e cached;
+};
+
+struct vmcs_sm_ioctl_resize {
+	/* user -> kernel */
+	unsigned int handle;
+	unsigned int new_size;
+
+	/* kernel -> user */
+	unsigned int old_size;
+};
+
+struct vmcs_sm_ioctl_map {
+	/* user -> kernel */
+	/* and kernel -> user */
+	unsigned int pid;
+	unsigned int handle;
+	unsigned int addr;
+
+	/* kernel -> user */
+	unsigned int size;
+};
+
+struct vmcs_sm_ioctl_walk {
+	/* user -> kernel */
+	unsigned int pid;
+};
+
+struct vmcs_sm_ioctl_chk {
+	/* user -> kernel */
+	unsigned int handle;
+
+	/* kernel -> user */
+	unsigned int addr;
+	unsigned int size;
+	enum vmcs_sm_cache_e cache;
+};
+
+struct vmcs_sm_ioctl_size {
+	/* user -> kernel */
+	unsigned int handle;
+
+	/* kernel -> user */
+	unsigned int size;
+};
+
+struct vmcs_sm_ioctl_cache {
+	/* user -> kernel */
+	unsigned int handle;
+	unsigned int addr;
+	unsigned int size;
+};
+
+/*
+ * Cache functions to be set to struct vmcs_sm_ioctl_clean_invalid cmd and
+ * vmcs_sm_ioctl_clean_invalid2 invalidate_mode.
+ */
+#define VCSM_CACHE_OP_NOP       0x00
+#define VCSM_CACHE_OP_INV       0x01
+#define VCSM_CACHE_OP_CLEAN     0x02
+#define VCSM_CACHE_OP_FLUSH     0x03
+
+struct vmcs_sm_ioctl_clean_invalid {
+	/* user -> kernel */
+	struct {
+		unsigned int cmd;
+		unsigned int handle;
+		unsigned int addr;
+		unsigned int size;
+	} s[8];
+};
+
+struct vmcs_sm_ioctl_clean_invalid2 {
+	uint8_t op_count;
+	uint8_t zero[3];
+	struct vmcs_sm_ioctl_clean_invalid_block {
+		uint16_t invalidate_mode;
+		uint16_t block_count;
+		void *   start_address;
+		uint32_t block_size;
+		uint32_t inter_block_stride;
+	} s[0];
+};
+
+struct vmcs_sm_ioctl_import_dmabuf {
+	/* user -> kernel */
+	int dmabuf_fd;
+	enum vmcs_sm_cache_e cached;
+	char name[VMCS_SM_RESOURCE_NAME];
+
+	/* kernel -> user */
+	unsigned int handle;
+};
+
+/* IOCTL numbers */
+#define VMCS_SM_IOCTL_MEM_ALLOC\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_ALLOC,\
+	 struct vmcs_sm_ioctl_alloc)
+#define VMCS_SM_IOCTL_MEM_ALLOC_SHARE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_ALLOC_SHARE,\
+	 struct vmcs_sm_ioctl_alloc_share)
+#define VMCS_SM_IOCTL_MEM_LOCK\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_LOCK,\
+	 struct vmcs_sm_ioctl_lock_unlock)
+#define VMCS_SM_IOCTL_MEM_LOCK_CACHE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_LOCK_CACHE,\
+	 struct vmcs_sm_ioctl_lock_cache)
+#define VMCS_SM_IOCTL_MEM_UNLOCK\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_UNLOCK,\
+	 struct vmcs_sm_ioctl_lock_unlock)
+#define VMCS_SM_IOCTL_MEM_RESIZE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_RESIZE,\
+	 struct vmcs_sm_ioctl_resize)
+#define VMCS_SM_IOCTL_MEM_FREE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_FREE,\
+	 struct vmcs_sm_ioctl_free)
+#define VMCS_SM_IOCTL_MEM_FLUSH\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_FLUSH,\
+	 struct vmcs_sm_ioctl_cache)
+#define VMCS_SM_IOCTL_MEM_INVALID\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_INVALID,\
+	 struct vmcs_sm_ioctl_cache)
+#define VMCS_SM_IOCTL_MEM_CLEAN_INVALID\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_CLEAN_INVALID,\
+	 struct vmcs_sm_ioctl_clean_invalid)
+#define VMCS_SM_IOCTL_MEM_CLEAN_INVALID2\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_CLEAN_INVALID2,\
+	 struct vmcs_sm_ioctl_clean_invalid2)
+
+#define VMCS_SM_IOCTL_SIZE_USR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_SIZE_USR_HANDLE,\
+	 struct vmcs_sm_ioctl_size)
+#define VMCS_SM_IOCTL_CHK_USR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_CHK_USR_HANDLE,\
+	 struct vmcs_sm_ioctl_chk)
+
+#define VMCS_SM_IOCTL_MAP_USR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_USR_HANDLE,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_USR_ADDRESS\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_USR_ADDRESS,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_VC_HDL_FR_ADDR\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_VC_HDL_FROM_ADDR,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_VC_HDL_FR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_VC_HDL_FROM_HDL,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_VC_ADDR_FR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_VC_ADDR_FROM_HDL,\
+	 struct vmcs_sm_ioctl_map)
+
+#define VMCS_SM_IOCTL_VC_WALK_ALLOC\
+	_IO(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_VC_WALK_ALLOC)
+#define VMCS_SM_IOCTL_HOST_WALK_MAP\
+	_IO(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_HOST_WALK_MAP)
+#define VMCS_SM_IOCTL_HOST_WALK_PID_ALLOC\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_HOST_WALK_PID_ALLOC,\
+	 struct vmcs_sm_ioctl_walk)
+#define VMCS_SM_IOCTL_HOST_WALK_PID_MAP\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_HOST_WALK_PID_MAP,\
+	 struct vmcs_sm_ioctl_walk)
+
+#define VMCS_SM_IOCTL_MEM_IMPORT_DMABUF\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_IMPORT_DMABUF,\
+	 struct vmcs_sm_ioctl_import_dmabuf)
+
+/* ---- Variable Externs ------------------------------------------------- */
+
+/* ---- Function Prototypes ---------------------------------------------- */
+
+#endif /* __VMCS_SM_IOCTL_H__INCLUDED__ */
-- 
GitLab


From 06c3f6fcc502d18b66831c68d6aae6eec4d3ad0b Mon Sep 17 00:00:00 2001
From: Luke Wren <luke@raspberrypi.org>
Date: Fri, 21 Aug 2015 23:14:48 +0100
Subject: [PATCH 0048/1835] Add /dev/gpiomem device for rootless user GPIO
 access

Signed-off-by: Luke Wren <luke@raspberrypi.org>

bcm2835-gpiomem: Fix for ARCH_BCM2835 builds

Build on ARCH_BCM2835, and fail to probe if no IO resource.

See: https://github.com/raspberrypi/linux/issues/1154
---
 drivers/char/broadcom/Kconfig           |   9 +
 drivers/char/broadcom/Makefile          |   3 +
 drivers/char/broadcom/bcm2835-gpiomem.c | 258 ++++++++++++++++++++++++
 3 files changed, 270 insertions(+)
 create mode 100644 drivers/char/broadcom/bcm2835-gpiomem.c

diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
index 2b6132d12b13d..235704f2d916b 100644
--- a/drivers/char/broadcom/Kconfig
+++ b/drivers/char/broadcom/Kconfig
@@ -26,3 +26,12 @@ config BCM_VC_SM
 	help
 	Support for the VC shared memory on the Broadcom reference
 	design. Uses the VCHIQ stack.
+
+config BCM2835_DEVGPIOMEM
+	tristate "/dev/gpiomem rootless GPIO access via mmap() on the BCM2835"
+	default m
+	help
+		Provides users with root-free access to the GPIO registers
+		on the 2835. Calling mmap(/dev/gpiomem) will map the GPIO
+		register page to the user's pointer.
+
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
index 419af4180deb0..187a0b02f1896 100644
--- a/drivers/char/broadcom/Makefile
+++ b/drivers/char/broadcom/Makefile
@@ -1,2 +1,5 @@
 obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
 obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
+
+obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
+
diff --git a/drivers/char/broadcom/bcm2835-gpiomem.c b/drivers/char/broadcom/bcm2835-gpiomem.c
new file mode 100644
index 0000000000000..f5e7f1ba8fb6f
--- /dev/null
+++ b/drivers/char/broadcom/bcm2835-gpiomem.c
@@ -0,0 +1,258 @@
+/**
+ * GPIO memory device driver
+ *
+ * Creates a chardev /dev/gpiomem which will provide user access to
+ * the BCM2835's GPIO registers when it is mmap()'d.
+ * No longer need root for user GPIO access, but without relaxing permissions
+ * on /dev/mem.
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <linux/pagemap.h>
+#include <linux/io.h>
+
+#define DEVICE_NAME "bcm2835-gpiomem"
+#define DRIVER_NAME "gpiomem-bcm2835"
+#define DEVICE_MINOR 0
+
+struct bcm2835_gpiomem_instance {
+	unsigned long gpio_regs_phys;
+	struct device *dev;
+};
+
+static struct cdev bcm2835_gpiomem_cdev;
+static dev_t bcm2835_gpiomem_devid;
+static struct class *bcm2835_gpiomem_class;
+static struct device *bcm2835_gpiomem_dev;
+static struct bcm2835_gpiomem_instance *inst;
+
+
+/****************************************************************************
+*
+*   GPIO mem chardev file ops
+*
+***************************************************************************/
+
+static int bcm2835_gpiomem_open(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+	int ret = 0;
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev, "Unknown minor device: %d", dev);
+		ret = -ENXIO;
+	}
+	return ret;
+}
+
+static int bcm2835_gpiomem_release(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+	int ret = 0;
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev, "Unknown minor device %d", dev);
+		ret = -ENXIO;
+	}
+	return ret;
+}
+
+static const struct vm_operations_struct bcm2835_gpiomem_vm_ops = {
+#ifdef CONFIG_HAVE_IOREMAP_PROT
+	.access = generic_access_phys
+#endif
+};
+
+static int bcm2835_gpiomem_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	/* Ignore what the user says - they're getting the GPIO regs
+	   whether they like it or not! */
+	unsigned long gpio_page = inst->gpio_regs_phys >> PAGE_SHIFT;
+
+	vma->vm_page_prot = phys_mem_access_prot(file, gpio_page,
+						 PAGE_SIZE,
+						 vma->vm_page_prot);
+	vma->vm_ops = &bcm2835_gpiomem_vm_ops;
+	if (remap_pfn_range(vma, vma->vm_start,
+			gpio_page,
+			PAGE_SIZE,
+			vma->vm_page_prot)) {
+		return -EAGAIN;
+	}
+	return 0;
+}
+
+static const struct file_operations
+bcm2835_gpiomem_fops = {
+	.owner = THIS_MODULE,
+	.open = bcm2835_gpiomem_open,
+	.release = bcm2835_gpiomem_release,
+	.mmap = bcm2835_gpiomem_mmap,
+};
+
+
+ /****************************************************************************
+*
+*   Probe and remove functions
+*
+***************************************************************************/
+
+
+static int bcm2835_gpiomem_probe(struct platform_device *pdev)
+{
+	int err;
+	void *ptr_err;
+	struct device *dev = &pdev->dev;
+	struct resource *ioresource;
+
+	/* Allocate buffers and instance data */
+
+	inst = kzalloc(sizeof(struct bcm2835_gpiomem_instance), GFP_KERNEL);
+
+	if (!inst) {
+		err = -ENOMEM;
+		goto failed_inst_alloc;
+	}
+
+	inst->dev = dev;
+
+	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (ioresource) {
+		inst->gpio_regs_phys = ioresource->start;
+	} else {
+		dev_err(inst->dev, "failed to get IO resource");
+		err = -ENOENT;
+		goto failed_get_resource;
+	}
+
+	/* Create character device entries */
+
+	err = alloc_chrdev_region(&bcm2835_gpiomem_devid,
+				  DEVICE_MINOR, 1, DEVICE_NAME);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to allocate device number");
+		goto failed_alloc_chrdev;
+	}
+	cdev_init(&bcm2835_gpiomem_cdev, &bcm2835_gpiomem_fops);
+	bcm2835_gpiomem_cdev.owner = THIS_MODULE;
+	err = cdev_add(&bcm2835_gpiomem_cdev, bcm2835_gpiomem_devid, 1);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to register device");
+		goto failed_cdev_add;
+	}
+
+	/* Create sysfs entries */
+
+	bcm2835_gpiomem_class = class_create(THIS_MODULE, DEVICE_NAME);
+	ptr_err = bcm2835_gpiomem_class;
+	if (IS_ERR(ptr_err))
+		goto failed_class_create;
+
+	bcm2835_gpiomem_dev = device_create(bcm2835_gpiomem_class, NULL,
+					bcm2835_gpiomem_devid, NULL,
+					"gpiomem");
+	ptr_err = bcm2835_gpiomem_dev;
+	if (IS_ERR(ptr_err))
+		goto failed_device_create;
+
+	dev_info(inst->dev, "Initialised: Registers at 0x%08lx",
+		inst->gpio_regs_phys);
+
+	return 0;
+
+failed_device_create:
+	class_destroy(bcm2835_gpiomem_class);
+failed_class_create:
+	cdev_del(&bcm2835_gpiomem_cdev);
+	err = PTR_ERR(ptr_err);
+failed_cdev_add:
+	unregister_chrdev_region(bcm2835_gpiomem_devid, 1);
+failed_alloc_chrdev:
+failed_get_resource:
+	kfree(inst);
+failed_inst_alloc:
+	dev_err(inst->dev, "could not load bcm2835_gpiomem");
+	return err;
+}
+
+static int bcm2835_gpiomem_remove(struct platform_device *pdev)
+{
+	struct device *dev = inst->dev;
+
+	kfree(inst);
+	device_destroy(bcm2835_gpiomem_class, bcm2835_gpiomem_devid);
+	class_destroy(bcm2835_gpiomem_class);
+	cdev_del(&bcm2835_gpiomem_cdev);
+	unregister_chrdev_region(bcm2835_gpiomem_devid, 1);
+
+	dev_info(dev, "GPIO mem driver removed - OK");
+	return 0;
+}
+
+ /****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_gpiomem_of_match[] = {
+	{.compatible = "brcm,bcm2835-gpiomem",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_gpiomem_of_match);
+
+static struct platform_driver bcm2835_gpiomem_driver = {
+	.probe = bcm2835_gpiomem_probe,
+	.remove = bcm2835_gpiomem_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_gpiomem_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_gpiomem_driver);
+
+MODULE_ALIAS("platform:gpiomem-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("gpiomem driver for accessing GPIO from userspace");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
-- 
GitLab


From e76d8f42ed2f9d6a9d2e7ee23bdba4ee4f4b3ef2 Mon Sep 17 00:00:00 2001
From: Luke Wren <wren6991@gmail.com>
Date: Sat, 5 Sep 2015 01:14:45 +0100
Subject: [PATCH 0049/1835] Add SMI driver

Signed-off-by: Luke Wren <wren6991@gmail.com>
---
 .../bindings/misc/brcm,bcm2835-smi-dev.txt    |  17 +
 .../bindings/misc/brcm,bcm2835-smi.txt        |  48 +
 drivers/char/broadcom/Kconfig                 |   8 +
 drivers/char/broadcom/Makefile                |   2 +-
 drivers/char/broadcom/bcm2835_smi_dev.c       | 402 +++++++
 drivers/misc/Kconfig                          |   8 +
 drivers/misc/Makefile                         |   1 +
 drivers/misc/bcm2835_smi.c                    | 985 ++++++++++++++++++
 include/linux/broadcom/bcm2835_smi.h          | 391 +++++++
 9 files changed, 1861 insertions(+), 1 deletion(-)
 create mode 100644 Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
 create mode 100644 Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
 create mode 100644 drivers/char/broadcom/bcm2835_smi_dev.c
 create mode 100644 drivers/misc/bcm2835_smi.c
 create mode 100644 include/linux/broadcom/bcm2835_smi.h

diff --git a/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
new file mode 100644
index 0000000000000..68cc8ebc3392d
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
@@ -0,0 +1,17 @@
+* Broadcom BCM2835 SMI character device driver.
+
+SMI or secondary memory interface is a peripheral specific to certain Broadcom
+SOCs, and is helpful for talking to things like parallel-interface displays
+and NAND flashes (in fact, most things with a parallel register interface).
+
+This driver adds a character device which provides a user-space interface to
+an instance of the SMI driver.
+
+Required properties:
+- compatible: "brcm,bcm2835-smi-dev"
+- smi_handle: a phandle to the smi node.
+
+Optional properties:
+- None.
+
+
diff --git a/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
new file mode 100644
index 0000000000000..b76dc694f1ac0
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
@@ -0,0 +1,48 @@
+* Broadcom BCM2835 SMI driver.
+
+SMI or secondary memory interface is a peripheral specific to certain Broadcom
+SOCs, and is helpful for talking to things like parallel-interface displays
+and NAND flashes (in fact, most things with a parallel register interface).
+
+Required properties:
+- compatible: "brcm,bcm2835-smi"
+- reg: Should contain location and length of SMI registers and SMI clkman regs
+- interrupts: *the* SMI interrupt.
+- pinctrl-names: should be "default".
+- pinctrl-0: the phandle of the gpio pin node.
+- brcm,smi-clock-source: the clock source for clkman
+- brcm,smi-clock-divisor: the integer clock divisor for clkman
+- dmas: the dma controller phandle and the DREQ number (4 on a 2835)
+- dma-names: the name used by the driver to request its channel.
+  Should be "rx-tx".
+
+Optional properties:
+- None.
+
+Examples:
+
+8 data pin configuration:
+
+smi: smi@7e600000 {
+	compatible = "brcm,bcm2835-smi";
+	reg = <0x7e600000 0x44>, <0x7e1010b0 0x8>;
+	interrupts = <2 16>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&smi_pins>;
+	brcm,smi-clock-source = <6>;
+	brcm,smi-clock-divisor = <4>;
+	dmas = <&dma 4>;
+	dma-names = "rx-tx";
+
+	status = "okay";
+};
+
+smi_pins: smi_pins {
+	brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15>;
+	/* Alt 1: SMI */
+	brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5>;
+	/* /CS, /WE and /OE are pulled high, as they are
+	   generally active low signals */
+	brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
+};
+
diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
index 235704f2d916b..4ef0d7af2bc72 100644
--- a/drivers/char/broadcom/Kconfig
+++ b/drivers/char/broadcom/Kconfig
@@ -35,3 +35,11 @@ config BCM2835_DEVGPIOMEM
 		on the 2835. Calling mmap(/dev/gpiomem) will map the GPIO
 		register page to the user's pointer.
 
+config BCM2835_SMI_DEV
+	tristate "Character device driver for BCM2835 Secondary Memory Interface"
+	depends on BCM2835_SMI
+	default m
+	help
+		This driver provides a character device interface (ioctl + read/write) to
+		Broadcom's Secondary Memory interface. The low-level functionality is provided
+		by the SMI driver itself.
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
index 187a0b02f1896..d0ad04f8e4981 100644
--- a/drivers/char/broadcom/Makefile
+++ b/drivers/char/broadcom/Makefile
@@ -2,4 +2,4 @@ obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
 obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
 
 obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
-
+obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
diff --git a/drivers/char/broadcom/bcm2835_smi_dev.c b/drivers/char/broadcom/bcm2835_smi_dev.c
new file mode 100644
index 0000000000000..d6efd92fdfe46
--- /dev/null
+++ b/drivers/char/broadcom/bcm2835_smi_dev.c
@@ -0,0 +1,402 @@
+/**
+ * Character device driver for Broadcom Secondary Memory Interface
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <linux/fs.h>
+
+#include <linux/broadcom/bcm2835_smi.h>
+
+#define DEVICE_NAME "bcm2835-smi-dev"
+#define DRIVER_NAME "smi-dev-bcm2835"
+#define DEVICE_MINOR 0
+
+static struct cdev bcm2835_smi_cdev;
+static dev_t bcm2835_smi_devid;
+static struct class *bcm2835_smi_class;
+static struct device *bcm2835_smi_dev;
+
+struct bcm2835_smi_dev_instance {
+	struct device *dev;
+};
+
+static struct bcm2835_smi_instance *smi_inst;
+static struct bcm2835_smi_dev_instance *inst;
+
+static const char *const ioctl_names[] = {
+	"READ_SETTINGS",
+	"WRITE_SETTINGS",
+	"ADDRESS"
+};
+
+/****************************************************************************
+*
+*   SMI chardev file ops
+*
+***************************************************************************/
+static long
+bcm2835_smi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	long ret = 0;
+
+	dev_info(inst->dev, "serving ioctl...");
+
+	switch (cmd) {
+	case BCM2835_SMI_IOC_GET_SETTINGS:{
+		struct smi_settings *settings;
+
+		dev_info(inst->dev, "Reading SMI settings to user.");
+		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
+		if (copy_to_user((void *)arg, settings,
+				 sizeof(struct smi_settings)))
+			dev_err(inst->dev, "settings copy failed.");
+		break;
+	}
+	case BCM2835_SMI_IOC_WRITE_SETTINGS:{
+		struct smi_settings *settings;
+
+		dev_info(inst->dev, "Setting user's SMI settings.");
+		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
+		if (copy_from_user(settings, (void *)arg,
+				   sizeof(struct smi_settings)))
+			dev_err(inst->dev, "settings copy failed.");
+		else
+			bcm2835_smi_set_regs_from_settings(smi_inst);
+		break;
+	}
+	case BCM2835_SMI_IOC_ADDRESS:
+		dev_info(inst->dev, "SMI address set: 0x%02x", (int)arg);
+		bcm2835_smi_set_address(smi_inst, arg);
+		break;
+	default:
+		dev_err(inst->dev, "invalid ioctl cmd: %d", cmd);
+		ret = -ENOTTY;
+		break;
+	}
+
+	return ret;
+}
+
+static int bcm2835_smi_open(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+
+	dev_dbg(inst->dev, "SMI device opened.");
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev,
+			"bcm2835_smi_release: Unknown minor device: %d",
+			dev);
+		return -ENXIO;
+	}
+
+	return 0;
+}
+
+static int bcm2835_smi_release(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev,
+			"bcm2835_smi_release: Unknown minor device %d", dev);
+		return -ENXIO;
+	}
+
+	return 0;
+}
+
+static ssize_t dma_bounce_user(
+	enum dma_transfer_direction dma_dir,
+	char __user *user_ptr,
+	size_t count,
+	struct bcm2835_smi_bounce_info *bounce)
+{
+	int chunk_size;
+	int chunk_no = 0;
+	int count_left = count;
+
+	while (count_left) {
+		int rv;
+		void *buf;
+
+		/* Wait for current chunk to complete: */
+		if (down_timeout(&bounce->callback_sem,
+			msecs_to_jiffies(1000))) {
+			dev_err(inst->dev, "DMA bounce timed out");
+			count -= (count_left);
+			break;
+		}
+
+		if (bounce->callback_sem.count >= DMA_BOUNCE_BUFFER_COUNT - 1)
+			dev_err(inst->dev, "WARNING: Ring buffer overflow");
+		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
+			DMA_BOUNCE_BUFFER_SIZE : count_left;
+		buf = bounce->buffer[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
+		if (dma_dir == DMA_DEV_TO_MEM)
+			rv = copy_to_user(user_ptr, buf, chunk_size);
+		else
+			rv = copy_from_user(buf, user_ptr, chunk_size);
+		if (rv)
+			dev_err(inst->dev, "copy_*_user() failed!: %d", rv);
+		user_ptr += chunk_size;
+		count_left -= chunk_size;
+		chunk_no++;
+	}
+	return count;
+}
+
+static ssize_t
+bcm2835_read_file(struct file *f, char __user *user_ptr,
+		  size_t count, loff_t *offs)
+{
+	int odd_bytes;
+
+	dev_dbg(inst->dev, "User reading %d bytes from SMI.", count);
+	/* We don't want to DMA a number of bytes % 4 != 0 (32 bit FIFO) */
+	if (count > DMA_THRESHOLD_BYTES)
+		odd_bytes = count & 0x3;
+	else
+		odd_bytes = count;
+	count -= odd_bytes;
+	if (count) {
+		struct bcm2835_smi_bounce_info *bounce;
+
+		count = bcm2835_smi_user_dma(smi_inst,
+			DMA_DEV_TO_MEM, user_ptr, count,
+			&bounce);
+		if (count)
+			count = dma_bounce_user(DMA_DEV_TO_MEM, user_ptr,
+				count, bounce);
+	}
+	if (odd_bytes) {
+		/* Read from FIFO directly if not using DMA */
+		uint8_t buf[DMA_THRESHOLD_BYTES];
+
+		bcm2835_smi_read_buf(smi_inst, buf, odd_bytes);
+		if (copy_to_user(user_ptr, buf, odd_bytes))
+			dev_err(inst->dev, "copy_to_user() failed.");
+		count += odd_bytes;
+
+	}
+	return count;
+}
+
+static ssize_t
+bcm2835_write_file(struct file *f, const char __user *user_ptr,
+		   size_t count, loff_t *offs)
+{
+	int odd_bytes;
+
+	dev_dbg(inst->dev, "User writing %d bytes to SMI.", count);
+	if (count > DMA_THRESHOLD_BYTES)
+		odd_bytes = count & 0x3;
+	else
+		odd_bytes = count;
+	count -= odd_bytes;
+	if (count) {
+		struct bcm2835_smi_bounce_info *bounce;
+
+		count = bcm2835_smi_user_dma(smi_inst,
+			DMA_MEM_TO_DEV, (char __user *)user_ptr, count,
+			&bounce);
+		if (count)
+			count = dma_bounce_user(DMA_MEM_TO_DEV,
+				(char __user *)user_ptr,
+				count, bounce);
+	}
+	if (odd_bytes) {
+		uint8_t buf[DMA_THRESHOLD_BYTES];
+
+		if (copy_from_user(buf, user_ptr, odd_bytes))
+			dev_err(inst->dev, "copy_from_user() failed.");
+		else
+			bcm2835_smi_write_buf(smi_inst, buf, odd_bytes);
+		count += odd_bytes;
+	}
+	return count;
+}
+
+static const struct file_operations
+bcm2835_smi_fops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = bcm2835_smi_ioctl,
+	.open = bcm2835_smi_open,
+	.release = bcm2835_smi_release,
+	.read = bcm2835_read_file,
+	.write = bcm2835_write_file,
+};
+
+
+/****************************************************************************
+*
+*   bcm2835_smi_probe - called when the driver is loaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_dev_probe(struct platform_device *pdev)
+{
+	int err;
+	void *ptr_err;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node, *smi_node;
+
+	if (!node) {
+		dev_err(dev, "No device tree node supplied!");
+		return -EINVAL;
+	}
+
+	smi_node = of_parse_phandle(node, "smi_handle", 0);
+
+	if (!smi_node) {
+		dev_err(dev, "No such property: smi_handle");
+		return -ENXIO;
+	}
+
+	smi_inst = bcm2835_smi_get(smi_node);
+
+	if (!smi_inst)
+		return -EPROBE_DEFER;
+
+	/* Allocate buffers and instance data */
+
+	inst = devm_kzalloc(dev, sizeof(*inst), GFP_KERNEL);
+
+	if (!inst)
+		return -ENOMEM;
+
+	inst->dev = dev;
+
+	/* Create character device entries */
+
+	err = alloc_chrdev_region(&bcm2835_smi_devid,
+				  DEVICE_MINOR, 1, DEVICE_NAME);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to allocate device number");
+		return -ENOMEM;
+	}
+	cdev_init(&bcm2835_smi_cdev, &bcm2835_smi_fops);
+	bcm2835_smi_cdev.owner = THIS_MODULE;
+	err = cdev_add(&bcm2835_smi_cdev, bcm2835_smi_devid, 1);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to register device");
+		err = -ENOMEM;
+		goto failed_cdev_add;
+	}
+
+	/* Create sysfs entries */
+
+	bcm2835_smi_class = class_create(THIS_MODULE, DEVICE_NAME);
+	ptr_err = bcm2835_smi_class;
+	if (IS_ERR(ptr_err))
+		goto failed_class_create;
+
+	bcm2835_smi_dev = device_create(bcm2835_smi_class, NULL,
+					bcm2835_smi_devid, NULL,
+					"smi");
+	ptr_err = bcm2835_smi_dev;
+	if (IS_ERR(ptr_err))
+		goto failed_device_create;
+
+	dev_info(inst->dev, "initialised");
+
+	return 0;
+
+failed_device_create:
+	class_destroy(bcm2835_smi_class);
+failed_class_create:
+	cdev_del(&bcm2835_smi_cdev);
+	err = PTR_ERR(ptr_err);
+failed_cdev_add:
+	unregister_chrdev_region(bcm2835_smi_devid, 1);
+	dev_err(dev, "could not load bcm2835_smi_dev");
+	return err;
+}
+
+/****************************************************************************
+*
+*   bcm2835_smi_remove - called when the driver is unloaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_dev_remove(struct platform_device *pdev)
+{
+	device_destroy(bcm2835_smi_class, bcm2835_smi_devid);
+	class_destroy(bcm2835_smi_class);
+	cdev_del(&bcm2835_smi_cdev);
+	unregister_chrdev_region(bcm2835_smi_devid, 1);
+
+	dev_info(inst->dev, "SMI character dev removed - OK");
+	return 0;
+}
+
+/****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_smi_dev_of_match[] = {
+	{.compatible = "brcm,bcm2835-smi-dev",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_smi_dev_of_match);
+
+static struct platform_driver bcm2835_smi_dev_driver = {
+	.probe = bcm2835_smi_dev_probe,
+	.remove = bcm2835_smi_dev_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_smi_dev_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_smi_dev_driver);
+
+MODULE_ALIAS("platform:smi-dev-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(
+	"Character device driver for BCM2835's secondary memory interface");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3726eacdf65de..1f3d3f2171c64 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -10,6 +10,14 @@ config SENSORS_LIS3LV02D
 	select INPUT_POLLDEV
 	default n
 
+config BCM2835_SMI
+	tristate "Broadcom 283x Secondary Memory Interface driver"
+	depends on ARCH_BCM2835
+	default m
+	help
+		Driver for enabling and using Broadcom's Secondary/Slow Memory Interface.
+		Appears as /dev/bcm2835_smi. For ioctl interface see drivers/misc/bcm2835_smi.h
+
 config AD525X_DPOT
 	tristate "Analog Devices Digital Potentiometers"
 	depends on (I2C || SPI) && SYSFS
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index af22bbc3d00cb..16d1c85cfced7 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_AD525X_DPOT_SPI)	+= ad525x_dpot-spi.o
 obj-$(CONFIG_INTEL_MID_PTI)	+= pti.o
 obj-$(CONFIG_ATMEL_SSC)		+= atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)	+= atmel_tclib.o
+obj-$(CONFIG_BCM2835_SMI)	+= bcm2835_smi.o
 obj-$(CONFIG_DUMMY_IRQ)		+= dummy-irq.o
 obj-$(CONFIG_ICS932S401)	+= ics932s401.o
 obj-$(CONFIG_LKDTM)		+= lkdtm/
diff --git a/drivers/misc/bcm2835_smi.c b/drivers/misc/bcm2835_smi.c
new file mode 100644
index 0000000000000..63a4ea08b9930
--- /dev/null
+++ b/drivers/misc/bcm2835_smi.c
@@ -0,0 +1,985 @@
+/**
+ * Broadcom Secondary Memory Interface driver
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/of_address.h>
+#include <linux/of_platform.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/pagemap.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmaengine.h>
+#include <linux/semaphore.h>
+#include <linux/spinlock.h>
+#include <linux/io.h>
+
+#define BCM2835_SMI_IMPLEMENTATION
+#include <linux/broadcom/bcm2835_smi.h>
+
+#define DRIVER_NAME "smi-bcm2835"
+
+#define N_PAGES_FROM_BYTES(n) ((n + PAGE_SIZE-1) / PAGE_SIZE)
+
+#define DMA_WRITE_TO_MEM true
+#define DMA_READ_FROM_MEM false
+
+struct bcm2835_smi_instance {
+	struct device *dev;
+	struct smi_settings settings;
+	__iomem void *smi_regs_ptr, *cm_smi_regs_ptr;
+	dma_addr_t smi_regs_busaddr;
+
+	struct dma_chan *dma_chan;
+	struct dma_slave_config dma_config;
+
+	struct bcm2835_smi_bounce_info bounce;
+
+	struct scatterlist buffer_sgl;
+
+	int clock_source;
+	int clock_divisor;
+
+	/* Sometimes we are called into in an atomic context (e.g. by
+	   JFFS2 + MTD) so we can't use a mutex */
+	spinlock_t transaction_lock;
+};
+
+/****************************************************************************
+*
+*   SMI clock manager setup
+*
+***************************************************************************/
+
+static inline void write_smi_cm_reg(struct bcm2835_smi_instance *inst,
+	u32 val, unsigned reg)
+{
+	writel(CM_PWD | val, inst->cm_smi_regs_ptr + reg);
+}
+
+static inline u32 read_smi_cm_reg(struct bcm2835_smi_instance *inst,
+	unsigned reg)
+{
+	return readl(inst->cm_smi_regs_ptr + reg);
+}
+
+static void smi_setup_clock(struct bcm2835_smi_instance *inst)
+{
+	dev_dbg(inst->dev, "Setting up clock...");
+	/* Disable SMI clock and wait for it to stop. */
+	write_smi_cm_reg(inst, 0, CM_SMI_CTL);
+	while (read_smi_cm_reg(inst, CM_SMI_CTL) & CM_SMI_CTL_BUSY)
+		;
+
+	write_smi_cm_reg(inst, (inst->clock_divisor << CM_SMI_DIV_DIVI_OFFS),
+	       CM_SMI_DIV);
+	write_smi_cm_reg(inst, (inst->clock_source << CM_SMI_CTL_SRC_OFFS),
+	       CM_SMI_CTL);
+
+	/* Enable the clock */
+	write_smi_cm_reg(inst, (inst->clock_source << CM_SMI_CTL_SRC_OFFS) |
+	       CM_SMI_CTL_ENAB, CM_SMI_CTL);
+}
+
+/****************************************************************************
+*
+*   SMI peripheral setup
+*
+***************************************************************************/
+
+static inline void write_smi_reg(struct bcm2835_smi_instance *inst,
+	u32 val, unsigned reg)
+{
+	writel(val, inst->smi_regs_ptr + reg);
+}
+
+static inline u32 read_smi_reg(struct bcm2835_smi_instance *inst, unsigned reg)
+{
+	return readl(inst->smi_regs_ptr + reg);
+}
+
+/* Token-paste macro for e.g SMIDSR_RSTROBE ->  value of SMIDSR_RSTROBE_MASK */
+#define _CONCAT(x, y) x##y
+#define CONCAT(x, y) _CONCAT(x, y)
+
+#define SET_BIT_FIELD(dest, field, bits) ((dest) = \
+	((dest) & ~CONCAT(field, _MASK)) | (((bits) << CONCAT(field, _OFFS))& \
+	 CONCAT(field, _MASK)))
+#define GET_BIT_FIELD(src, field) (((src) & \
+	CONCAT(field, _MASK)) >> CONCAT(field, _OFFS))
+
+static void smi_dump_context_labelled(struct bcm2835_smi_instance *inst,
+	const char *label)
+{
+	dev_err(inst->dev, "SMI context dump: %s", label);
+	dev_err(inst->dev, "SMICS:  0x%08x", read_smi_reg(inst, SMICS));
+	dev_err(inst->dev, "SMIL:   0x%08x", read_smi_reg(inst, SMIL));
+	dev_err(inst->dev, "SMIDSR: 0x%08x", read_smi_reg(inst, SMIDSR0));
+	dev_err(inst->dev, "SMIDSW: 0x%08x", read_smi_reg(inst, SMIDSW0));
+	dev_err(inst->dev, "SMIDC:  0x%08x", read_smi_reg(inst, SMIDC));
+	dev_err(inst->dev, "SMIFD:  0x%08x", read_smi_reg(inst, SMIFD));
+	dev_err(inst->dev, " ");
+}
+
+static inline void smi_dump_context(struct bcm2835_smi_instance *inst)
+{
+	smi_dump_context_labelled(inst, "");
+}
+
+static void smi_get_default_settings(struct bcm2835_smi_instance *inst)
+{
+	struct smi_settings *settings = &inst->settings;
+
+	settings->data_width = SMI_WIDTH_16BIT;
+	settings->pack_data = true;
+
+	settings->read_setup_time = 1;
+	settings->read_hold_time = 1;
+	settings->read_pace_time = 1;
+	settings->read_strobe_time = 3;
+
+	settings->write_setup_time = settings->read_setup_time;
+	settings->write_hold_time = settings->read_hold_time;
+	settings->write_pace_time = settings->read_pace_time;
+	settings->write_strobe_time = settings->read_strobe_time;
+
+	settings->dma_enable = true;
+	settings->dma_passthrough_enable = false;
+	settings->dma_read_thresh = 0x01;
+	settings->dma_write_thresh = 0x3f;
+	settings->dma_panic_read_thresh = 0x20;
+	settings->dma_panic_write_thresh = 0x20;
+}
+
+void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *inst)
+{
+	struct smi_settings *settings = &inst->settings;
+	int smidsr_temp = 0, smidsw_temp = 0, smics_temp,
+	    smidcs_temp, smidc_temp = 0;
+
+	spin_lock(&inst->transaction_lock);
+
+	/* temporarily disable the peripheral: */
+	smics_temp = read_smi_reg(inst, SMICS);
+	write_smi_reg(inst, 0, SMICS);
+	smidcs_temp = read_smi_reg(inst, SMIDCS);
+	write_smi_reg(inst, 0, SMIDCS);
+
+	if (settings->pack_data)
+		smics_temp |= SMICS_PXLDAT;
+	else
+		smics_temp &= ~SMICS_PXLDAT;
+
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RWIDTH, settings->data_width);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSETUP, settings->read_setup_time);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RHOLD, settings->read_hold_time);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RPACE, settings->read_pace_time);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSTROBE, settings->read_strobe_time);
+	write_smi_reg(inst, smidsr_temp, SMIDSR0);
+
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WWIDTH, settings->data_width);
+	if (settings->data_width == SMI_WIDTH_8BIT)
+		smidsw_temp |= SMIDSW_WSWAP;
+	else
+		smidsw_temp &= ~SMIDSW_WSWAP;
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSETUP, settings->write_setup_time);
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WHOLD, settings->write_hold_time);
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WPACE, settings->write_pace_time);
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSTROBE,
+			settings->write_strobe_time);
+	write_smi_reg(inst, smidsw_temp, SMIDSW0);
+
+	SET_BIT_FIELD(smidc_temp, SMIDC_REQR, settings->dma_read_thresh);
+	SET_BIT_FIELD(smidc_temp, SMIDC_REQW, settings->dma_write_thresh);
+	SET_BIT_FIELD(smidc_temp, SMIDC_PANICR,
+		      settings->dma_panic_read_thresh);
+	SET_BIT_FIELD(smidc_temp, SMIDC_PANICW,
+		      settings->dma_panic_write_thresh);
+	if (settings->dma_passthrough_enable) {
+		smidc_temp |= SMIDC_DMAP;
+		smidsr_temp |= SMIDSR_RDREQ;
+		write_smi_reg(inst, smidsr_temp, SMIDSR0);
+		smidsw_temp |= SMIDSW_WDREQ;
+		write_smi_reg(inst, smidsw_temp, SMIDSW0);
+	} else
+		smidc_temp &= ~SMIDC_DMAP;
+	if (settings->dma_enable)
+		smidc_temp |= SMIDC_DMAEN;
+	else
+		smidc_temp &= ~SMIDC_DMAEN;
+
+	write_smi_reg(inst, smidc_temp, SMIDC);
+
+	/* re-enable (if was previously enabled) */
+	write_smi_reg(inst, smics_temp, SMICS);
+	write_smi_reg(inst, smidcs_temp, SMIDCS);
+
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_set_regs_from_settings);
+
+struct smi_settings *bcm2835_smi_get_settings_from_regs
+	(struct bcm2835_smi_instance *inst)
+{
+	struct smi_settings *settings = &inst->settings;
+	int smidsr, smidsw, smidc;
+
+	spin_lock(&inst->transaction_lock);
+
+	smidsr = read_smi_reg(inst, SMIDSR0);
+	smidsw = read_smi_reg(inst, SMIDSW0);
+	smidc = read_smi_reg(inst, SMIDC);
+
+	settings->pack_data = (read_smi_reg(inst, SMICS) & SMICS_PXLDAT) ?
+	    true : false;
+
+	settings->data_width = GET_BIT_FIELD(smidsr, SMIDSR_RWIDTH);
+	settings->read_setup_time = GET_BIT_FIELD(smidsr, SMIDSR_RSETUP);
+	settings->read_hold_time = GET_BIT_FIELD(smidsr, SMIDSR_RHOLD);
+	settings->read_pace_time = GET_BIT_FIELD(smidsr, SMIDSR_RPACE);
+	settings->read_strobe_time = GET_BIT_FIELD(smidsr, SMIDSR_RSTROBE);
+
+	settings->write_setup_time = GET_BIT_FIELD(smidsw, SMIDSW_WSETUP);
+	settings->write_hold_time = GET_BIT_FIELD(smidsw, SMIDSW_WHOLD);
+	settings->write_pace_time = GET_BIT_FIELD(smidsw, SMIDSW_WPACE);
+	settings->write_strobe_time = GET_BIT_FIELD(smidsw, SMIDSW_WSTROBE);
+
+	settings->dma_read_thresh = GET_BIT_FIELD(smidc, SMIDC_REQR);
+	settings->dma_write_thresh = GET_BIT_FIELD(smidc, SMIDC_REQW);
+	settings->dma_panic_read_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICR);
+	settings->dma_panic_write_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICW);
+	settings->dma_passthrough_enable = (smidc & SMIDC_DMAP) ? true : false;
+	settings->dma_enable = (smidc & SMIDC_DMAEN) ? true : false;
+
+	spin_unlock(&inst->transaction_lock);
+
+	return settings;
+}
+EXPORT_SYMBOL(bcm2835_smi_get_settings_from_regs);
+
+static inline void smi_set_address(struct bcm2835_smi_instance *inst,
+	unsigned int address)
+{
+	int smia_temp = 0, smida_temp = 0;
+
+	SET_BIT_FIELD(smia_temp, SMIA_ADDR, address);
+	SET_BIT_FIELD(smida_temp, SMIDA_ADDR, address);
+
+	/* Write to both address registers - user doesn't care whether we're
+	   doing programmed or direct transfers. */
+	write_smi_reg(inst, smia_temp, SMIA);
+	write_smi_reg(inst, smida_temp, SMIDA);
+}
+
+static void smi_setup_regs(struct bcm2835_smi_instance *inst)
+{
+
+	dev_dbg(inst->dev, "Initialising SMI registers...");
+	/* Disable the peripheral if already enabled */
+	write_smi_reg(inst, 0, SMICS);
+	write_smi_reg(inst, 0, SMIDCS);
+
+	smi_get_default_settings(inst);
+	bcm2835_smi_set_regs_from_settings(inst);
+	smi_set_address(inst, 0);
+
+	write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ENABLE, SMICS);
+	write_smi_reg(inst, read_smi_reg(inst, SMIDCS) | SMIDCS_ENABLE,
+		SMIDCS);
+}
+
+/****************************************************************************
+*
+*   Low-level SMI access functions
+*   Other modules should use the exported higher-level functions e.g.
+*   bcm2835_smi_write_buf() unless they have a good reason to use these
+*
+***************************************************************************/
+
+static inline uint32_t smi_read_single_word(struct bcm2835_smi_instance *inst)
+{
+	int timeout = 0;
+
+	write_smi_reg(inst, SMIDCS_ENABLE, SMIDCS);
+	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_START, SMIDCS);
+	/* Make sure things happen in the right order...*/
+	mb();
+	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
+		++timeout < 10000)
+		;
+	if (timeout < 10000)
+		return read_smi_reg(inst, SMIDD);
+
+	dev_err(inst->dev,
+		"SMI direct read timed out (is the clock set up correctly?)");
+	return 0;
+}
+
+static inline void smi_write_single_word(struct bcm2835_smi_instance *inst,
+	uint32_t data)
+{
+	int timeout = 0;
+
+	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE, SMIDCS);
+	write_smi_reg(inst, data, SMIDD);
+	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE | SMIDCS_START,
+		SMIDCS);
+
+	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
+		++timeout < 10000)
+		;
+	if (timeout >= 10000)
+		dev_err(inst->dev,
+		"SMI direct write timed out (is the clock set up correctly?)");
+}
+
+/* Initiates a programmed read into the read FIFO. It is up to the caller to
+ * read data from the FIFO -  either via paced DMA transfer,
+ * or polling SMICS_RXD to check whether data is available.
+ * SMICS_ACTIVE will go low upon completion. */
+static void smi_init_programmed_read(struct bcm2835_smi_instance *inst,
+	int num_transfers)
+{
+	int smics_temp;
+
+	/* Disable the peripheral: */
+	smics_temp = read_smi_reg(inst, SMICS) & ~(SMICS_ENABLE | SMICS_WRITE);
+	write_smi_reg(inst, smics_temp, SMICS);
+	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
+		;
+
+	/* Program the transfer count: */
+	write_smi_reg(inst, num_transfers, SMIL);
+
+	/* re-enable and start: */
+	smics_temp |= SMICS_ENABLE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	smics_temp |= SMICS_CLEAR;
+	/* Just to be certain: */
+	mb();
+	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
+		;
+	write_smi_reg(inst, smics_temp, SMICS);
+	smics_temp |= SMICS_START;
+	write_smi_reg(inst, smics_temp, SMICS);
+}
+
+/* Initiates a programmed write sequence, using data from the write FIFO.
+ * It is up to the caller to initiate a DMA transfer before calling,
+ * or use another method to keep the write FIFO topped up.
+ * SMICS_ACTIVE will go low upon completion.
+ */
+static void smi_init_programmed_write(struct bcm2835_smi_instance *inst,
+	int num_transfers)
+{
+	int smics_temp;
+
+	/* Disable the peripheral: */
+	smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
+		;
+
+	/* Program the transfer count: */
+	write_smi_reg(inst, num_transfers, SMIL);
+
+	/* setup, re-enable and start: */
+	smics_temp |= SMICS_WRITE | SMICS_ENABLE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	smics_temp |= SMICS_START;
+	write_smi_reg(inst, smics_temp, SMICS);
+}
+
+/* Initiate a read and then poll FIFO for data, reading out as it appears. */
+static void smi_read_fifo(struct bcm2835_smi_instance *inst,
+	uint32_t *dest, int n_bytes)
+{
+	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
+		smi_dump_context_labelled(inst,
+			"WARNING: read FIFO not empty at start of read call.");
+		while (read_smi_reg(inst, SMICS))
+			;
+	}
+
+	/* Dispatch the read: */
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_read(inst, n_bytes);
+	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
+		smi_init_programmed_read(inst, n_bytes / 2);
+	else {
+		dev_err(inst->dev, "Unsupported data width for read.");
+		return;
+	}
+
+	/* Poll FIFO to keep it empty */
+	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
+		if (read_smi_reg(inst, SMICS) & SMICS_RXD)
+			*dest++ = read_smi_reg(inst, SMID);
+
+	/* Ensure that the FIFO is emptied */
+	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
+		int fifo_count;
+
+		fifo_count = GET_BIT_FIELD(read_smi_reg(inst, SMIFD),
+			SMIFD_FCNT);
+		while (fifo_count--)
+			*dest++ = read_smi_reg(inst, SMID);
+	}
+
+	if (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
+		smi_dump_context_labelled(inst,
+			"WARNING: transaction finished but done bit not set.");
+
+	if (read_smi_reg(inst, SMICS) & SMICS_RXD)
+		smi_dump_context_labelled(inst,
+			"WARNING: read FIFO not empty at end of read call.");
+
+}
+
+/* Initiate a write, and then keep the FIFO topped up. */
+static void smi_write_fifo(struct bcm2835_smi_instance *inst,
+	uint32_t *src, int n_bytes)
+{
+	int i, timeout = 0;
+
+	/* Empty FIFOs if not already so */
+	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE)) {
+		smi_dump_context_labelled(inst,
+		    "WARNING: write fifo not empty at start of write call.");
+		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_CLEAR,
+			SMICS);
+	}
+
+	/* Initiate the transfer */
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_write(inst, n_bytes);
+	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
+		smi_init_programmed_write(inst, n_bytes / 2);
+	else {
+		dev_err(inst->dev, "Unsupported data width for write.");
+		return;
+	}
+	/* Fill the FIFO: */
+	for (i = 0; i < (n_bytes - 1) / 4 + 1; ++i) {
+		while (!(read_smi_reg(inst, SMICS) & SMICS_TXD))
+			;
+		write_smi_reg(inst, *src++, SMID);
+	}
+	/* Busy wait... */
+	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE) && ++timeout <
+		1000000)
+		;
+	if (timeout >= 1000000)
+		smi_dump_context_labelled(inst,
+			"Timed out on write operation!");
+	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE))
+		smi_dump_context_labelled(inst,
+			"WARNING: FIFO not empty at end of write operation.");
+}
+
+/****************************************************************************
+*
+*   SMI DMA operations
+*
+***************************************************************************/
+
+/* Disable SMI and put it into the correct direction before doing DMA setup.
+   Stops spurious DREQs during setup. Peripheral is re-enabled by init_*() */
+static void smi_disable(struct bcm2835_smi_instance *inst,
+	enum dma_transfer_direction direction)
+{
+	int smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
+
+	if (direction == DMA_DEV_TO_MEM)
+		smics_temp &= ~SMICS_WRITE;
+	else
+		smics_temp |= SMICS_WRITE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
+		;
+}
+
+static struct scatterlist *smi_scatterlist_from_buffer(
+	struct bcm2835_smi_instance *inst,
+	dma_addr_t buf,
+	size_t len,
+	struct scatterlist *sg)
+{
+	sg_init_table(sg, 1);
+	sg_dma_address(sg) = buf;
+	sg_dma_len(sg) = len;
+	return sg;
+}
+
+static void smi_dma_callback_user_copy(void *param)
+{
+	/* Notify the bottom half that a chunk is ready for user copy */
+	struct bcm2835_smi_instance *inst =
+		(struct bcm2835_smi_instance *)param;
+
+	up(&inst->bounce.callback_sem);
+}
+
+/* Creates a descriptor, assigns the given callback, and submits the
+   descriptor to dmaengine. Does not block - can queue up multiple
+   descriptors and then wait for them all to complete.
+   sg_len is the number of control blocks, NOT the number of bytes.
+   dir can be DMA_MEM_TO_DEV or DMA_DEV_TO_MEM.
+   callback can be NULL - in this case it is not called. */
+static inline struct dma_async_tx_descriptor *smi_dma_submit_sgl(
+	struct bcm2835_smi_instance *inst,
+	struct scatterlist *sgl,
+	size_t sg_len,
+	enum dma_transfer_direction dir,
+	dma_async_tx_callback callback)
+{
+	struct dma_async_tx_descriptor *desc;
+
+	desc = dmaengine_prep_slave_sg(inst->dma_chan,
+				       sgl,
+				       sg_len,
+				       dir,
+				       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
+				       DMA_PREP_FENCE);
+	if (!desc) {
+		dev_err(inst->dev, "read_sgl: dma slave preparation failed!");
+		write_smi_reg(inst, read_smi_reg(inst, SMICS) & ~SMICS_ACTIVE,
+			SMICS);
+		while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
+			cpu_relax();
+		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ACTIVE,
+			SMICS);
+		return NULL;
+	}
+	desc->callback = callback;
+	desc->callback_param = inst;
+	if (dmaengine_submit(desc) < 0)
+		return NULL;
+	return desc;
+}
+
+/* NB this function blocks until the transfer is complete */
+static void
+smi_dma_read_sgl(struct bcm2835_smi_instance *inst,
+	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
+{
+	struct dma_async_tx_descriptor *desc;
+
+	/* Disable SMI and set to read before dispatching DMA - if SMI is in
+	 * write mode and TX fifo is empty, it will generate a DREQ which may
+	 * cause the read DMA to complete before the SMI read command is even
+	 * dispatched! We want to dispatch DMA before SMI read so that reading
+	 * is gapless, for logic analyser.
+	 */
+
+	smi_disable(inst, DMA_DEV_TO_MEM);
+
+	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_DEV_TO_MEM, NULL);
+	dma_async_issue_pending(inst->dma_chan);
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_read(inst, n_bytes);
+	else
+		smi_init_programmed_read(inst, n_bytes / 2);
+
+	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
+		smi_dump_context_labelled(inst, "DMA timeout!");
+}
+
+static void
+smi_dma_write_sgl(struct bcm2835_smi_instance *inst,
+	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
+{
+	struct dma_async_tx_descriptor *desc;
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_write(inst, n_bytes);
+	else
+		smi_init_programmed_write(inst, n_bytes / 2);
+
+	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_MEM_TO_DEV, NULL);
+	dma_async_issue_pending(inst->dma_chan);
+
+	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
+		smi_dump_context_labelled(inst, "DMA timeout!");
+	else
+		/* Wait for SMI to finish our writes */
+		while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
+			cpu_relax();
+}
+
+ssize_t bcm2835_smi_user_dma(
+	struct bcm2835_smi_instance *inst,
+	enum dma_transfer_direction dma_dir,
+	char __user *user_ptr, size_t count,
+	struct bcm2835_smi_bounce_info **bounce)
+{
+	int chunk_no = 0, chunk_size, count_left = count;
+	struct scatterlist *sgl;
+	void (*init_trans_func)(struct bcm2835_smi_instance *, int);
+
+	spin_lock(&inst->transaction_lock);
+
+	if (dma_dir == DMA_DEV_TO_MEM)
+		init_trans_func = smi_init_programmed_read;
+	else
+		init_trans_func = smi_init_programmed_write;
+
+	smi_disable(inst, dma_dir);
+
+	sema_init(&inst->bounce.callback_sem, 0);
+	if (bounce)
+		*bounce = &inst->bounce;
+	while (count_left) {
+		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
+			DMA_BOUNCE_BUFFER_SIZE : count_left;
+		if (chunk_size == DMA_BOUNCE_BUFFER_SIZE) {
+			sgl =
+			&inst->bounce.sgl[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
+		} else {
+			sgl = smi_scatterlist_from_buffer(
+				inst,
+				inst->bounce.phys[
+					chunk_no % DMA_BOUNCE_BUFFER_COUNT],
+				chunk_size,
+				&inst->buffer_sgl);
+		}
+
+		if (!smi_dma_submit_sgl(inst, sgl, 1, dma_dir,
+			smi_dma_callback_user_copy
+		)) {
+			dev_err(inst->dev, "sgl submit failed");
+			count = 0;
+			goto out;
+		}
+		count_left -= chunk_size;
+		chunk_no++;
+	}
+	dma_async_issue_pending(inst->dma_chan);
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		init_trans_func(inst, count);
+	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
+		init_trans_func(inst, count / 2);
+out:
+	spin_unlock(&inst->transaction_lock);
+	return count;
+}
+EXPORT_SYMBOL(bcm2835_smi_user_dma);
+
+
+/****************************************************************************
+*
+*   High level buffer transfer functions - for use by other drivers
+*
+***************************************************************************/
+
+/* Buffer must be physically contiguous - i.e. kmalloc, not vmalloc! */
+void bcm2835_smi_write_buf(
+	struct bcm2835_smi_instance *inst,
+	const void *buf, size_t n_bytes)
+{
+	int odd_bytes = n_bytes & 0x3;
+
+	n_bytes -= odd_bytes;
+
+	spin_lock(&inst->transaction_lock);
+
+	if (n_bytes > DMA_THRESHOLD_BYTES) {
+		dma_addr_t phy_addr = dma_map_single(
+			inst->dev,
+			(void *)buf,
+			n_bytes,
+			DMA_MEM_TO_DEV);
+		struct scatterlist *sgl =
+			smi_scatterlist_from_buffer(inst, phy_addr, n_bytes,
+				&inst->buffer_sgl);
+
+		if (!sgl) {
+			smi_dump_context_labelled(inst,
+			"Error: could not create scatterlist for write!");
+			goto out;
+		}
+		smi_dma_write_sgl(inst, sgl, 1, n_bytes);
+
+		dma_unmap_single
+			(inst->dev, phy_addr, n_bytes, DMA_MEM_TO_DEV);
+	} else if (n_bytes) {
+		smi_write_fifo(inst, (uint32_t *) buf, n_bytes);
+	}
+	buf += n_bytes;
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
+		while (odd_bytes--)
+			smi_write_single_word(inst, *(uint8_t *) (buf++));
+	} else {
+		while (odd_bytes >= 2) {
+			smi_write_single_word(inst, *(uint16_t *)buf);
+			buf += 2;
+			odd_bytes -= 2;
+		}
+		if (odd_bytes) {
+			/* Reading an odd number of bytes on a 16 bit bus is
+			   a user bug. It's kinder to fail early and tell them
+			   than to e.g. transparently give them the bottom byte
+			   of a 16 bit transfer. */
+			dev_err(inst->dev,
+		"WARNING: odd number of bytes specified for wide transfer.");
+			dev_err(inst->dev,
+		"At least one byte dropped as a result.");
+			dump_stack();
+		}
+	}
+out:
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_write_buf);
+
+void bcm2835_smi_read_buf(struct bcm2835_smi_instance *inst,
+	void *buf, size_t n_bytes)
+{
+
+	/* SMI is inherently 32-bit, which causes surprising amounts of mess
+	   for bytes % 4 != 0. Easiest to avoid this mess altogether
+	   by handling remainder separately. */
+	int odd_bytes = n_bytes & 0x3;
+
+	spin_lock(&inst->transaction_lock);
+	n_bytes -= odd_bytes;
+	if (n_bytes > DMA_THRESHOLD_BYTES) {
+		dma_addr_t phy_addr = dma_map_single(inst->dev,
+						     buf, n_bytes,
+						     DMA_DEV_TO_MEM);
+		struct scatterlist *sgl = smi_scatterlist_from_buffer(
+			inst, phy_addr, n_bytes,
+			&inst->buffer_sgl);
+		if (!sgl) {
+			smi_dump_context_labelled(inst,
+			"Error: could not create scatterlist for read!");
+			goto out;
+		}
+		smi_dma_read_sgl(inst, sgl, 1, n_bytes);
+		dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_DEV_TO_MEM);
+	} else if (n_bytes) {
+		smi_read_fifo(inst, (uint32_t *)buf, n_bytes);
+	}
+	buf += n_bytes;
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
+		while (odd_bytes--)
+			*((uint8_t *) (buf++)) = smi_read_single_word(inst);
+	} else {
+		while (odd_bytes >= 2) {
+			*(uint16_t *) buf = smi_read_single_word(inst);
+			buf += 2;
+			odd_bytes -= 2;
+		}
+		if (odd_bytes) {
+			dev_err(inst->dev,
+		"WARNING: odd number of bytes specified for wide transfer.");
+			dev_err(inst->dev,
+		"At least one byte dropped as a result.");
+			dump_stack();
+		}
+	}
+out:
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_read_buf);
+
+void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
+	unsigned int address)
+{
+	spin_lock(&inst->transaction_lock);
+	smi_set_address(inst, address);
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_set_address);
+
+struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node)
+{
+	struct platform_device *pdev;
+
+	if (!node)
+		return NULL;
+
+	pdev = of_find_device_by_node(node);
+	if (!pdev)
+		return NULL;
+
+	return platform_get_drvdata(pdev);
+}
+EXPORT_SYMBOL(bcm2835_smi_get);
+
+/****************************************************************************
+*
+*   bcm2835_smi_probe - called when the driver is loaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_dma_setup(struct bcm2835_smi_instance *inst)
+{
+	int i, rv = 0;
+
+	inst->dma_chan = dma_request_slave_channel(inst->dev, "rx-tx");
+
+	inst->dma_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+	inst->dma_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+	inst->dma_config.src_addr = inst->smi_regs_busaddr + SMID;
+	inst->dma_config.dst_addr = inst->dma_config.src_addr;
+	/* Direction unimportant - always overridden by prep_slave_sg */
+	inst->dma_config.direction = DMA_DEV_TO_MEM;
+	dmaengine_slave_config(inst->dma_chan, &inst->dma_config);
+	/* Alloc and map bounce buffers */
+	for (i = 0; i < DMA_BOUNCE_BUFFER_COUNT; ++i) {
+		inst->bounce.buffer[i] =
+		dmam_alloc_coherent(inst->dev, DMA_BOUNCE_BUFFER_SIZE,
+				&inst->bounce.phys[i],
+				GFP_KERNEL);
+		if (!inst->bounce.buffer[i]) {
+			dev_err(inst->dev, "Could not allocate buffer!");
+			rv = -ENOMEM;
+			break;
+		}
+		smi_scatterlist_from_buffer(
+			inst,
+			inst->bounce.phys[i],
+			DMA_BOUNCE_BUFFER_SIZE,
+			&inst->bounce.sgl[i]
+		);
+	}
+
+	return rv;
+}
+
+static int bcm2835_smi_probe(struct platform_device *pdev)
+{
+	int err;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct resource *ioresource;
+	struct bcm2835_smi_instance *inst;
+
+	/* Allocate buffers and instance data */
+
+	inst = devm_kzalloc(dev, sizeof(struct bcm2835_smi_instance),
+		GFP_KERNEL);
+
+	if (!inst)
+		return -ENOMEM;
+
+	inst->dev = dev;
+	spin_lock_init(&inst->transaction_lock);
+
+	/* We require device tree support */
+	if (!node)
+		return -EINVAL;
+
+	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	inst->smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
+	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	inst->cm_smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
+	inst->smi_regs_busaddr = be32_to_cpu(
+		*of_get_address(node, 0, NULL, NULL));
+	of_property_read_u32(node,
+			     "brcm,smi-clock-source",
+			     &inst->clock_source);
+	of_property_read_u32(node,
+			     "brcm,smi-clock-divisor",
+			     &inst->clock_divisor);
+
+	err = bcm2835_smi_dma_setup(inst);
+	if (err)
+		return err;
+
+	/* Finally, do peripheral setup */
+
+	smi_setup_clock(inst);
+	smi_setup_regs(inst);
+
+	platform_set_drvdata(pdev, inst);
+
+	dev_info(inst->dev, "initialised");
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   bcm2835_smi_remove - called when the driver is unloaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_remove(struct platform_device *pdev)
+{
+	struct bcm2835_smi_instance *inst = platform_get_drvdata(pdev);
+	struct device *dev = inst->dev;
+
+	dev_info(dev, "SMI device removed - OK");
+	return 0;
+}
+
+/****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_smi_of_match[] = {
+	{.compatible = "brcm,bcm2835-smi",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_smi_of_match);
+
+static struct platform_driver bcm2835_smi_driver = {
+	.probe = bcm2835_smi_probe,
+	.remove = bcm2835_smi_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_smi_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_smi_driver);
+
+MODULE_ALIAS("platform:smi-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Device driver for BCM2835's secondary memory interface");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/include/linux/broadcom/bcm2835_smi.h b/include/linux/broadcom/bcm2835_smi.h
new file mode 100644
index 0000000000000..ee3a75edfc033
--- /dev/null
+++ b/include/linux/broadcom/bcm2835_smi.h
@@ -0,0 +1,391 @@
+/**
+ * Declarations and definitions for Broadcom's Secondary Memory Interface
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ * Copyright (c) 2010-2012 Broadcom. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BCM2835_SMI_H
+#define BCM2835_SMI_H
+
+#include <linux/ioctl.h>
+
+#ifndef __KERNEL__
+#include <stdint.h>
+#include <stdbool.h>
+#endif
+
+#define BCM2835_SMI_IOC_MAGIC 0x1
+#define BCM2835_SMI_INVALID_HANDLE (~0)
+
+/* IOCTLs 0x100...0x1ff are not device-specific - we can use them */
+#define BCM2835_SMI_IOC_GET_SETTINGS    _IO(BCM2835_SMI_IOC_MAGIC, 0)
+#define BCM2835_SMI_IOC_WRITE_SETTINGS  _IO(BCM2835_SMI_IOC_MAGIC, 1)
+#define BCM2835_SMI_IOC_ADDRESS	 _IO(BCM2835_SMI_IOC_MAGIC, 2)
+#define BCM2835_SMI_IOC_MAX	     2
+
+#define SMI_WIDTH_8BIT 0
+#define SMI_WIDTH_16BIT 1
+#define SMI_WIDTH_9BIT 2
+#define SMI_WIDTH_18BIT 3
+
+/* max number of bytes where DMA will not be used */
+#define DMA_THRESHOLD_BYTES 128
+#define DMA_BOUNCE_BUFFER_SIZE (1024 * 1024 / 2)
+#define DMA_BOUNCE_BUFFER_COUNT 3
+
+
+struct smi_settings {
+	int data_width;
+	/* Whether or not to pack multiple SMI transfers into a
+	   single 32 bit FIFO word */
+	bool pack_data;
+
+	/* Timing for reads (writes the same but for WE)
+	 *
+	 * OE ----------+	   +--------------------
+	 *		|	   |
+	 *		+----------+
+	 * SD -<==============================>-----------
+	 * SA -<=========================================>-
+	 *    <-setup->  <-strobe ->  <-hold ->  <- pace ->
+	 */
+
+	int read_setup_time;
+	int read_hold_time;
+	int read_pace_time;
+	int read_strobe_time;
+
+	int write_setup_time;
+	int write_hold_time;
+	int write_pace_time;
+	int write_strobe_time;
+
+	bool dma_enable;		/* DREQs */
+	bool dma_passthrough_enable;	/* External DREQs */
+	int dma_read_thresh;
+	int dma_write_thresh;
+	int dma_panic_read_thresh;
+	int dma_panic_write_thresh;
+};
+
+/****************************************************************************
+*
+*   Declare exported SMI functions
+*
+***************************************************************************/
+
+#ifdef __KERNEL__
+
+#include <linux/dmaengine.h> /* for enum dma_transfer_direction */
+#include <linux/of.h>
+#include <linux/semaphore.h>
+
+struct bcm2835_smi_instance;
+
+struct bcm2835_smi_bounce_info {
+	struct semaphore callback_sem;
+	void *buffer[DMA_BOUNCE_BUFFER_COUNT];
+	dma_addr_t phys[DMA_BOUNCE_BUFFER_COUNT];
+	struct scatterlist sgl[DMA_BOUNCE_BUFFER_COUNT];
+};
+
+
+void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *);
+
+struct smi_settings *bcm2835_smi_get_settings_from_regs(
+	struct bcm2835_smi_instance *inst);
+
+void bcm2835_smi_write_buf(
+	struct bcm2835_smi_instance *inst,
+	const void *buf,
+	size_t n_bytes);
+
+void bcm2835_smi_read_buf(
+	struct bcm2835_smi_instance *inst,
+	void *buf,
+	size_t n_bytes);
+
+void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
+	unsigned int address);
+
+ssize_t bcm2835_smi_user_dma(
+	struct bcm2835_smi_instance *inst,
+	enum dma_transfer_direction dma_dir,
+	char __user *user_ptr,
+	size_t count,
+	struct bcm2835_smi_bounce_info **bounce);
+
+struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node);
+
+#endif /* __KERNEL__ */
+
+/****************************************************************
+*
+*	Implementation-only declarations
+*
+****************************************************************/
+
+#ifdef BCM2835_SMI_IMPLEMENTATION
+
+/* Clock manager registers for SMI clock: */
+#define CM_SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x1010b0)
+/* Clock manager "password" to protect registers from spurious writes */
+#define CM_PWD (0x5a << 24)
+
+#define CM_SMI_CTL	0x00
+#define CM_SMI_DIV	0x04
+
+#define CM_SMI_CTL_FLIP (1 << 8)
+#define CM_SMI_CTL_BUSY (1 << 7)
+#define CM_SMI_CTL_KILL (1 << 5)
+#define CM_SMI_CTL_ENAB (1 << 4)
+#define CM_SMI_CTL_SRC_MASK (0xf)
+#define CM_SMI_CTL_SRC_OFFS (0)
+
+#define CM_SMI_DIV_DIVI_MASK (0xf <<  12)
+#define CM_SMI_DIV_DIVI_OFFS (12)
+#define CM_SMI_DIV_DIVF_MASK (0xff << 4)
+#define CM_SMI_DIV_DIVF_OFFS (4)
+
+/* SMI register mapping:*/
+#define SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x600000)
+
+#define SMICS	0x00	/* control + status register		*/
+#define SMIL	0x04	/* length/count (n external txfers)	*/
+#define SMIA	0x08	/* address register			*/
+#define SMID	0x0c	/* data register			*/
+#define SMIDSR0	0x10	/* device 0 read settings		*/
+#define SMIDSW0	0x14	/* device 0 write settings		*/
+#define SMIDSR1	0x18	/* device 1 read settings		*/
+#define SMIDSW1	0x1c	/* device 1 write settings		*/
+#define SMIDSR2	0x20	/* device 2 read settings		*/
+#define SMIDSW2	0x24	/* device 2 write settings		*/
+#define SMIDSR3	0x28	/* device 3 read settings		*/
+#define SMIDSW3	0x2c	/* device 3 write settings		*/
+#define SMIDC	0x30	/* DMA control registers		*/
+#define SMIDCS	0x34	/* direct control/status register	*/
+#define SMIDA	0x38	/* direct address register		*/
+#define SMIDD	0x3c	/* direct data registers		*/
+#define SMIFD	0x40	/* FIFO debug register			*/
+
+
+
+/* Control and Status register bits:
+ * SMICS_RXF	: RX fifo full: 1 when RX fifo is full
+ * SMICS_TXE	: TX fifo empty: 1 when empty.
+ * SMICS_RXD	: RX fifo contains data: 1 when there is data.
+ * SMICS_TXD	: TX fifo can accept data: 1 when true.
+ * SMICS_RXR	: RX fifo needs reading: 1 when fifo more than 3/4 full, or
+ *		  when "DONE" and fifo not emptied.
+ * SMICS_TXW	: TX fifo needs writing: 1 when less than 1/4 full.
+ * SMICS_AFERR	: AXI FIFO error: 1 when fifo read when empty or written
+ *		  when full. Write 1 to clear.
+ * SMICS_EDREQ	: 1 when external DREQ received.
+ * SMICS_PXLDAT	:  Pixel data:	write 1 to enable pixel transfer modes.
+ * SMICS_SETERR	: 1 if there was an error writing to setup regs (e.g.
+ *		  tx was in progress). Write 1 to clear.
+ * SMICS_PVMODE	: Set to 1 to enable pixel valve mode.
+ * SMICS_INTR	: Set to 1 to enable interrupt on RX.
+ * SMICS_INTT	: Set to 1 to enable interrupt on TX.
+ * SMICS_INTD	: Set to 1 to enable interrupt on DONE condition.
+ * SMICS_TEEN	: Tear effect mode enabled: Programmed transfers will wait
+ *		  for a TE trigger before writing.
+ * SMICS_PAD1	: Padding settings for external transfers. For writes: the
+ *		  number of bytes initially written to  the TX fifo that
+ * SMICS_PAD0	: should be ignored. For reads: the number of bytes that will
+ *		  be read before the data, and should be dropped.
+ * SMICS_WRITE	: Transfer direction: 1 = write to external device, 0 = read
+ * SMICS_CLEAR	: Write 1 to clear the FIFOs.
+ * SMICS_START	: Write 1 to start the programmed transfer.
+ * SMICS_ACTIVE	: Reads as 1 when a programmed transfer is underway.
+ * SMICS_DONE	: Reads as 1 when transfer finished. For RX, not set until
+ *		  FIFO emptied.
+ * SMICS_ENABLE	: Set to 1 to enable the SMI peripheral, 0 to disable.
+ */
+
+#define SMICS_RXF	(1 << 31)
+#define SMICS_TXE	(1 << 30)
+#define SMICS_RXD	(1 << 29)
+#define SMICS_TXD	(1 << 28)
+#define SMICS_RXR	(1 << 27)
+#define SMICS_TXW	(1 << 26)
+#define SMICS_AFERR	(1 << 25)
+#define SMICS_EDREQ	(1 << 15)
+#define SMICS_PXLDAT	(1 << 14)
+#define SMICS_SETERR	(1 << 13)
+#define SMICS_PVMODE	(1 << 12)
+#define SMICS_INTR	(1 << 11)
+#define SMICS_INTT	(1 << 10)
+#define SMICS_INTD	(1 << 9)
+#define SMICS_TEEN	(1 << 8)
+#define SMICS_PAD1	(1 << 7)
+#define SMICS_PAD0	(1 << 6)
+#define SMICS_WRITE	(1 << 5)
+#define SMICS_CLEAR	(1 << 4)
+#define SMICS_START	(1 << 3)
+#define SMICS_ACTIVE	(1 << 2)
+#define SMICS_DONE	(1 << 1)
+#define SMICS_ENABLE	(1 << 0)
+
+/* Address register bits: */
+
+#define SMIA_DEVICE_MASK ((1 << 9) | (1 << 8))
+#define SMIA_DEVICE_OFFS (8)
+#define SMIA_ADDR_MASK (0x3f)	/* bits 5 -> 0 */
+#define SMIA_ADDR_OFFS (0)
+
+/* DMA control register bits:
+ * SMIDC_DMAEN	: DMA enable: set 1: DMA requests will be issued.
+ * SMIDC_DMAP	: DMA passthrough: when set to 0, top two data pins are used by
+ *		  SMI as usual. When set to 1, the top two pins are used for
+ *		  external DREQs: pin 16 read request, 17 write.
+ * SMIDC_PANIC*	: Threshold at which DMA will panic during read/write.
+ * SMIDC_REQ*	: Threshold at which DMA will generate a DREQ.
+ */
+
+#define SMIDC_DMAEN		(1 << 28)
+#define SMIDC_DMAP		(1 << 24)
+#define SMIDC_PANICR_MASK	(0x3f << 18)
+#define SMIDC_PANICR_OFFS	(18)
+#define SMIDC_PANICW_MASK	(0x3f << 12)
+#define SMIDC_PANICW_OFFS	(12)
+#define SMIDC_REQR_MASK		(0x3f << 6)
+#define SMIDC_REQR_OFFS		(6)
+#define SMIDC_REQW_MASK		(0x3f)
+#define SMIDC_REQW_OFFS		(0)
+
+/* Device settings register bits: same for all 4 (or 3?) device register sets.
+ * Device read settings:
+ * SMIDSR_RWIDTH	: Read transfer width. 00 = 8bit, 01 = 16bit,
+ *			  10 = 18bit, 11 = 9bit.
+ * SMIDSR_RSETUP	: Read setup time: number of core cycles between chip
+ *			  select/address and read strobe. Min 1, max 64.
+ * SMIDSR_MODE68	: 1 for System 68 mode (i.e. enable + direction pins,
+ *			  rather than OE + WE pin)
+ * SMIDSR_FSETUP	: If set to 1, setup time only applies to first
+ *			  transfer after address change.
+ * SMIDSR_RHOLD		: Number of core cycles between read strobe going
+ *			  inactive and CS/address going inactive. Min 1, max 64
+ * SMIDSR_RPACEALL	: When set to 1, this device's RPACE value will always
+ *			  be used for the next transaction, even if it is not
+ *			  to this device.
+ * SMIDSR_RPACE		: Number of core cycles spent waiting between CS
+ *			  deassert and start of next transfer. Min 1, max 128
+ * SMIDSR_RDREQ		: 1 = use external DMA request on SD16 to pace reads
+ *			  from device. Must also set DMAP in SMICS.
+ * SMIDSR_RSTROBE	: Number of cycles to assert the read strobe.
+ *			  min 1, max 128.
+ */
+#define SMIDSR_RWIDTH_MASK	((1<<31)|(1<<30))
+#define SMIDSR_RWIDTH_OFFS	(30)
+#define SMIDSR_RSETUP_MASK	(0x3f << 24)
+#define SMIDSR_RSETUP_OFFS	(24)
+#define SMIDSR_MODE68		(1 << 23)
+#define SMIDSR_FSETUP		(1 << 22)
+#define SMIDSR_RHOLD_MASK	(0x3f << 16)
+#define SMIDSR_RHOLD_OFFS	(16)
+#define SMIDSR_RPACEALL		(1 << 15)
+#define SMIDSR_RPACE_MASK	(0x7f << 8)
+#define SMIDSR_RPACE_OFFS	(8)
+#define SMIDSR_RDREQ		(1 << 7)
+#define SMIDSR_RSTROBE_MASK	(0x7f)
+#define SMIDSR_RSTROBE_OFFS	(0)
+
+/* Device write settings:
+ * SMIDSW_WWIDTH	: Write transfer width. 00 = 8bit, 01 = 16bit,
+ *			  10= 18bit, 11 = 9bit.
+ * SMIDSW_WSETUP	: Number of cycles between CS assert and write strobe.
+ *			  Min 1, max 64.
+ * SMIDSW_WFORMAT	: Pixel format of input. 0 = 16bit RGB 565,
+ *			  1 = 32bit RGBA 8888
+ * SMIDSW_WSWAP		: 1 = swap pixel data bits. (Use with SMICS_PXLDAT)
+ * SMIDSW_WHOLD		: Time between WE deassert and CS deassert. 1 to 64
+ * SMIDSW_WPACEALL	: 1: this device's WPACE will be used for the next
+ *			  transfer, regardless of that transfer's device.
+ * SMIDSW_WPACE		: Cycles between CS deassert and next CS assert.
+ *			  Min 1, max 128
+ * SMIDSW_WDREQ		: Use external DREQ on pin 17 to pace writes. DMAP must
+ *			  be set in SMICS.
+ * SMIDSW_WSTROBE	: Number of cycles to assert the write strobe.
+ *			  Min 1, max 128
+ */
+#define SMIDSW_WWIDTH_MASK	 ((1<<31)|(1<<30))
+#define SMIDSW_WWIDTH_OFFS	(30)
+#define SMIDSW_WSETUP_MASK	(0x3f << 24)
+#define SMIDSW_WSETUP_OFFS	(24)
+#define SMIDSW_WFORMAT		(1 << 23)
+#define SMIDSW_WSWAP		(1 << 22)
+#define SMIDSW_WHOLD_MASK	(0x3f << 16)
+#define SMIDSW_WHOLD_OFFS	(16)
+#define SMIDSW_WPACEALL		(1 << 15)
+#define SMIDSW_WPACE_MASK	(0x7f << 8)
+#define SMIDSW_WPACE_OFFS	(8)
+#define SMIDSW_WDREQ		(1 << 7)
+#define SMIDSW_WSTROBE_MASK	 (0x7f)
+#define SMIDSW_WSTROBE_OFFS	 (0)
+
+/* Direct transfer control + status register
+ * SMIDCS_WRITE	: Direction of transfer: 1 -> write, 0 -> read
+ * SMIDCS_DONE	: 1 when a transfer has finished. Write 1 to clear.
+ * SMIDCS_START	: Write 1 to start a transfer, if one is not already underway.
+ * SMIDCE_ENABLE: Write 1 to enable SMI in direct mode.
+ */
+
+#define SMIDCS_WRITE		(1 << 3)
+#define SMIDCS_DONE		(1 << 2)
+#define SMIDCS_START		(1 << 1)
+#define SMIDCS_ENABLE		(1 << 0)
+
+/* Direct transfer address register
+ * SMIDA_DEVICE	: Indicates which of the device settings banks should be used.
+ * SMIDA_ADDR	: The value to be asserted on the address pins.
+ */
+
+#define SMIDA_DEVICE_MASK	((1<<9)|(1<<8))
+#define SMIDA_DEVICE_OFFS	(8)
+#define SMIDA_ADDR_MASK		(0x3f)
+#define SMIDA_ADDR_OFFS		(0)
+
+/* FIFO debug register
+ * SMIFD_FLVL	: The high-tide mark of FIFO count during the most recent txfer
+ * SMIFD_FCNT	: The current FIFO count.
+ */
+#define SMIFD_FLVL_MASK		(0x3f << 8)
+#define SMIFD_FLVL_OFFS		(8)
+#define SMIFD_FCNT_MASK		(0x3f)
+#define SMIFD_FCNT_OFFS		(0)
+
+#endif /* BCM2835_SMI_IMPLEMENTATION */
+
+#endif /* BCM2835_SMI_H */
-- 
GitLab


From 4f87ab3f81e420f6f3a44ce2a22a5cf8e334423f Mon Sep 17 00:00:00 2001
From: Martin Sperl <kernel@martin.sperl.org>
Date: Tue, 26 Apr 2016 14:59:21 +0000
Subject: [PATCH 0050/1835] MISC: bcm2835: smi: use clock manager and fix
 reload issues

Use clock manager instead of self-made clockmanager.

Also fix some error paths that showd up during development
(especially missing release of dma resources on rmmod)

Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
---
 drivers/misc/bcm2835_smi.c | 86 +++++++++++++-------------------------
 1 file changed, 28 insertions(+), 58 deletions(-)

diff --git a/drivers/misc/bcm2835_smi.c b/drivers/misc/bcm2835_smi.c
index 63a4ea08b9930..1261540703127 100644
--- a/drivers/misc/bcm2835_smi.c
+++ b/drivers/misc/bcm2835_smi.c
@@ -34,6 +34,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <linux/clk.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/of.h>
@@ -62,7 +63,7 @@
 struct bcm2835_smi_instance {
 	struct device *dev;
 	struct smi_settings settings;
-	__iomem void *smi_regs_ptr, *cm_smi_regs_ptr;
+	__iomem void *smi_regs_ptr;
 	dma_addr_t smi_regs_busaddr;
 
 	struct dma_chan *dma_chan;
@@ -72,50 +73,13 @@ struct bcm2835_smi_instance {
 
 	struct scatterlist buffer_sgl;
 
-	int clock_source;
-	int clock_divisor;
+	struct clk *clk;
 
 	/* Sometimes we are called into in an atomic context (e.g. by
 	   JFFS2 + MTD) so we can't use a mutex */
 	spinlock_t transaction_lock;
 };
 
-/****************************************************************************
-*
-*   SMI clock manager setup
-*
-***************************************************************************/
-
-static inline void write_smi_cm_reg(struct bcm2835_smi_instance *inst,
-	u32 val, unsigned reg)
-{
-	writel(CM_PWD | val, inst->cm_smi_regs_ptr + reg);
-}
-
-static inline u32 read_smi_cm_reg(struct bcm2835_smi_instance *inst,
-	unsigned reg)
-{
-	return readl(inst->cm_smi_regs_ptr + reg);
-}
-
-static void smi_setup_clock(struct bcm2835_smi_instance *inst)
-{
-	dev_dbg(inst->dev, "Setting up clock...");
-	/* Disable SMI clock and wait for it to stop. */
-	write_smi_cm_reg(inst, 0, CM_SMI_CTL);
-	while (read_smi_cm_reg(inst, CM_SMI_CTL) & CM_SMI_CTL_BUSY)
-		;
-
-	write_smi_cm_reg(inst, (inst->clock_divisor << CM_SMI_DIV_DIVI_OFFS),
-	       CM_SMI_DIV);
-	write_smi_cm_reg(inst, (inst->clock_source << CM_SMI_CTL_SRC_OFFS),
-	       CM_SMI_CTL);
-
-	/* Enable the clock */
-	write_smi_cm_reg(inst, (inst->clock_source << CM_SMI_CTL_SRC_OFFS) |
-	       CM_SMI_CTL_ENAB, CM_SMI_CTL);
-}
-
 /****************************************************************************
 *
 *   SMI peripheral setup
@@ -894,42 +858,40 @@ static int bcm2835_smi_probe(struct platform_device *pdev)
 	struct device_node *node = dev->of_node;
 	struct resource *ioresource;
 	struct bcm2835_smi_instance *inst;
+	const __be32 *addr;
 
+	/* We require device tree support */
+	if (!node)
+		return -EINVAL;
 	/* Allocate buffers and instance data */
-
 	inst = devm_kzalloc(dev, sizeof(struct bcm2835_smi_instance),
 		GFP_KERNEL);
-
 	if (!inst)
 		return -ENOMEM;
 
 	inst->dev = dev;
 	spin_lock_init(&inst->transaction_lock);
 
-	/* We require device tree support */
-	if (!node)
-		return -EINVAL;
-
 	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	inst->smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
-	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-	inst->cm_smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
-	inst->smi_regs_busaddr = be32_to_cpu(
-		*of_get_address(node, 0, NULL, NULL));
-	of_property_read_u32(node,
-			     "brcm,smi-clock-source",
-			     &inst->clock_source);
-	of_property_read_u32(node,
-			     "brcm,smi-clock-divisor",
-			     &inst->clock_divisor);
+	if (IS_ERR(inst->smi_regs_ptr)) {
+		err = PTR_ERR(inst->smi_regs_ptr);
+		goto err;
+	}
+	addr = of_get_address(node, 0, NULL, NULL);
+	inst->smi_regs_busaddr = be32_to_cpu(addr);
 
 	err = bcm2835_smi_dma_setup(inst);
 	if (err)
-		return err;
+		goto err;
 
-	/* Finally, do peripheral setup */
+	/* request clock */
+	inst->clk = devm_clk_get(dev, NULL);
+	if (!inst->clk)
+		goto err;
+	clk_prepare_enable(inst->clk);
 
-	smi_setup_clock(inst);
+	/* Finally, do peripheral setup */
 	smi_setup_regs(inst);
 
 	platform_set_drvdata(pdev, inst);
@@ -937,6 +899,9 @@ static int bcm2835_smi_probe(struct platform_device *pdev)
 	dev_info(inst->dev, "initialised");
 
 	return 0;
+err:
+	kfree(inst);
+	return err;
 }
 
 /****************************************************************************
@@ -950,6 +915,11 @@ static int bcm2835_smi_remove(struct platform_device *pdev)
 	struct bcm2835_smi_instance *inst = platform_get_drvdata(pdev);
 	struct device *dev = inst->dev;
 
+	dmaengine_terminate_all(inst->dma_chan);
+	dma_release_channel(inst->dma_chan);
+
+	clk_disable_unprepare(inst->clk);
+
 	dev_info(dev, "SMI device removed - OK");
 	return 0;
 }
-- 
GitLab


From 9e5e1dc0bab97229f7a674ec35a7c2fcd2a9e2a4 Mon Sep 17 00:00:00 2001
From: Luke Wren <wren6991@gmail.com>
Date: Sat, 5 Sep 2015 01:16:10 +0100
Subject: [PATCH 0051/1835] Add SMI NAND driver

Signed-off-by: Luke Wren <wren6991@gmail.com>
---
 .../bindings/mtd/brcm,bcm2835-smi-nand.txt    |  42 +++
 drivers/mtd/nand/raw/Kconfig                  |   7 +
 drivers/mtd/nand/raw/Makefile                 |   1 +
 drivers/mtd/nand/raw/bcm2835_smi_nand.c       | 258 ++++++++++++++++++
 4 files changed, 308 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt
 create mode 100644 drivers/mtd/nand/raw/bcm2835_smi_nand.c

diff --git a/Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt b/Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt
new file mode 100644
index 0000000000000..159544d657907
--- /dev/null
+++ b/Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt
@@ -0,0 +1,42 @@
+* BCM2835 SMI NAND flash
+
+This driver is a shim between the BCM2835 SMI driver (SMI is a peripheral for
+talking to parallel register interfaces) and Linux's MTD layer.
+
+Required properties:
+- compatible: "brcm,bcm2835-smi-nand"
+- status: "okay"
+
+Optional properties:
+- partition@n, where n is an integer from a consecutive sequence starting at 0
+	- Difficult to store partition table on NAND device - normally put it
+	in the source code, kernel bootparams, or device tree (the best way!)
+	- Sub-properties:
+		- label: the partition name, as shown by mtdinfo /dev/mtd*
+		- reg: the size and offset of this partition.
+		- (optional) read-only: an empty property flagging as read only
+
+Example:
+
+nand: flash@0 {
+	compatible = "brcm,bcm2835-smi-nand";
+	status = "okay";
+
+	partition@0 {
+		label = "stage2";
+		// 128k
+		reg = <0 0x20000>;
+		read-only;
+	};
+	partition@1 {
+		label = "firmware";
+		// 16M
+		reg = <0x20000 0x1000000>;
+		read-only;
+	};
+	partition@2 {
+		label = "root";
+		// 2G
+		reg = <0x1020000 0x80000000>;
+	};
+};
\ No newline at end of file
diff --git a/drivers/mtd/nand/raw/Kconfig b/drivers/mtd/nand/raw/Kconfig
index 5fc9a1bde4ac2..21f7c3bc4e253 100644
--- a/drivers/mtd/nand/raw/Kconfig
+++ b/drivers/mtd/nand/raw/Kconfig
@@ -40,6 +40,13 @@ config MTD_SM_COMMON
 	tristate
 	default n
 
+config MTD_NAND_BCM2835_SMI
+        tristate "Use Broadcom's Secondary Memory Interface as a NAND controller (BCM283x)"
+        depends on BCM2835_SMI
+        default m
+        help
+	  Uses the BCM2835's SMI peripheral as a NAND controller.
+
 config MTD_NAND_DENALI
 	tristate
 
diff --git a/drivers/mtd/nand/raw/Makefile b/drivers/mtd/nand/raw/Makefile
index d5a5f9832b887..f5ac0e84df2aa 100644
--- a/drivers/mtd/nand/raw/Makefile
+++ b/drivers/mtd/nand/raw/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_MTD_NAND_DENALI)		+= denali.o
 obj-$(CONFIG_MTD_NAND_DENALI_PCI)	+= denali_pci.o
 obj-$(CONFIG_MTD_NAND_DENALI_DT)	+= denali_dt.o
 obj-$(CONFIG_MTD_NAND_AU1550)		+= au1550nd.o
+obj-$(CONFIG_MTD_NAND_BCM2835_SMI)	+= bcm2835_smi_nand.o
 obj-$(CONFIG_MTD_NAND_S3C2410)		+= s3c2410.o
 obj-$(CONFIG_MTD_NAND_TANGO)		+= tango_nand.o
 obj-$(CONFIG_MTD_NAND_DAVINCI)		+= davinci_nand.o
diff --git a/drivers/mtd/nand/raw/bcm2835_smi_nand.c b/drivers/mtd/nand/raw/bcm2835_smi_nand.c
new file mode 100644
index 0000000000000..78dc4fcc7495b
--- /dev/null
+++ b/drivers/mtd/nand/raw/bcm2835_smi_nand.c
@@ -0,0 +1,258 @@
+/**
+ * NAND flash driver for Broadcom Secondary Memory Interface
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/mtd/rawnand.h>
+#include <linux/mtd/partitions.h>
+
+#include <linux/broadcom/bcm2835_smi.h>
+
+#define DEVICE_NAME "bcm2835-smi-nand"
+#define DRIVER_NAME "smi-nand-bcm2835"
+
+struct bcm2835_smi_nand_host {
+	struct bcm2835_smi_instance *smi_inst;
+	struct nand_chip nand_chip;
+	struct mtd_info mtd;
+	struct device *dev;
+};
+
+/****************************************************************************
+*
+*   NAND functionality implementation
+*
+****************************************************************************/
+
+#define SMI_NAND_CLE_PIN 0x01
+#define SMI_NAND_ALE_PIN 0x02
+
+static inline void bcm2835_smi_nand_cmd_ctrl(struct mtd_info *mtd, int cmd,
+					     unsigned int ctrl)
+{
+	uint32_t cmd32 = cmd;
+	uint32_t addr = ~(SMI_NAND_CLE_PIN | SMI_NAND_ALE_PIN);
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	if (ctrl & NAND_CLE)
+		addr |= SMI_NAND_CLE_PIN;
+	if (ctrl & NAND_ALE)
+		addr |= SMI_NAND_ALE_PIN;
+	/* Lower ALL the CS pins! */
+	if (ctrl & NAND_NCE)
+		addr &= (SMI_NAND_CLE_PIN | SMI_NAND_ALE_PIN);
+
+	bcm2835_smi_set_address(inst, addr);
+
+	if (cmd != NAND_CMD_NONE)
+		bcm2835_smi_write_buf(inst, &cmd32, 1);
+}
+
+static inline uint8_t bcm2835_smi_nand_read_byte(struct mtd_info *mtd)
+{
+	uint8_t byte;
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_read_buf(inst, &byte, 1);
+	return byte;
+}
+
+static inline void bcm2835_smi_nand_write_byte(struct mtd_info *mtd,
+					       uint8_t byte)
+{
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_write_buf(inst, &byte, 1);
+}
+
+static inline void bcm2835_smi_nand_write_buf(struct mtd_info *mtd,
+					      const uint8_t *buf, int len)
+{
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_write_buf(inst, buf, len);
+}
+
+static inline void bcm2835_smi_nand_read_buf(struct mtd_info *mtd,
+					     uint8_t *buf, int len)
+{
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_read_buf(inst, buf, len);
+}
+
+/****************************************************************************
+*
+*   Probe and remove functions
+*
+***************************************************************************/
+
+static int bcm2835_smi_nand_probe(struct platform_device *pdev)
+{
+	struct bcm2835_smi_nand_host *host;
+	struct nand_chip *this;
+	struct mtd_info *mtd;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node, *smi_node;
+	struct mtd_part_parser_data ppdata;
+	struct smi_settings *smi_settings;
+	struct bcm2835_smi_instance *smi_inst;
+	int ret = -ENXIO;
+
+	if (!node) {
+		dev_err(dev, "No device tree node supplied!");
+		return -EINVAL;
+	}
+
+	smi_node = of_parse_phandle(node, "smi_handle", 0);
+
+	/* Request use of SMI peripheral: */
+	smi_inst = bcm2835_smi_get(smi_node);
+
+	if (!smi_inst) {
+		dev_err(dev, "Could not register with SMI.");
+		return -EPROBE_DEFER;
+	}
+
+	/* Set SMI timing and bus width */
+
+	smi_settings = bcm2835_smi_get_settings_from_regs(smi_inst);
+
+	smi_settings->data_width = SMI_WIDTH_8BIT;
+	smi_settings->read_setup_time = 2;
+	smi_settings->read_hold_time = 1;
+	smi_settings->read_pace_time = 1;
+	smi_settings->read_strobe_time = 3;
+
+	smi_settings->write_setup_time = 2;
+	smi_settings->write_hold_time = 1;
+	smi_settings->write_pace_time = 1;
+	smi_settings->write_strobe_time = 3;
+
+	bcm2835_smi_set_regs_from_settings(smi_inst);
+
+	host = devm_kzalloc(dev, sizeof(struct bcm2835_smi_nand_host),
+		GFP_KERNEL);
+	if (!host)
+		return -ENOMEM;
+
+	host->dev = dev;
+	host->smi_inst = smi_inst;
+
+	platform_set_drvdata(pdev, host);
+
+	/* Link the structures together */
+
+	this = &host->nand_chip;
+	mtd = &host->mtd;
+	mtd->priv = this;
+	mtd->owner = THIS_MODULE;
+	mtd->dev.parent = dev;
+	mtd->name = DRIVER_NAME;
+
+	/* 20 us command delay time... */
+	this->chip_delay = 20;
+
+	this->priv = host;
+	this->cmd_ctrl = bcm2835_smi_nand_cmd_ctrl;
+	this->read_byte = bcm2835_smi_nand_read_byte;
+	this->write_byte = bcm2835_smi_nand_write_byte;
+	this->write_buf = bcm2835_smi_nand_write_buf;
+	this->read_buf = bcm2835_smi_nand_read_buf;
+
+	this->ecc.mode = NAND_ECC_SOFT;
+
+	/* Should never be accessed directly: */
+
+	this->IO_ADDR_R = (void *)0xdeadbeef;
+	this->IO_ADDR_W = (void *)0xdeadbeef;
+
+	/* Scan to find the device and get the page size */
+
+	if (nand_scan(mtd, 1))
+		return -ENXIO;
+
+	nand_release(mtd);
+	return -EINVAL;
+}
+
+static int bcm2835_smi_nand_remove(struct platform_device *pdev)
+{
+	struct bcm2835_smi_nand_host *host = platform_get_drvdata(pdev);
+
+	nand_release(&host->mtd);
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_smi_nand_of_match[] = {
+	{.compatible = "brcm,bcm2835-smi-nand",},
+	{ /* sentinel */ }
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_smi_nand_of_match);
+
+static struct platform_driver bcm2835_smi_nand_driver = {
+	.probe = bcm2835_smi_nand_probe,
+	.remove = bcm2835_smi_nand_remove,
+	.driver = {
+		.name = DRIVER_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = bcm2835_smi_nand_of_match,
+	},
+};
+
+module_platform_driver(bcm2835_smi_nand_driver);
+
+MODULE_ALIAS("platform:smi-nand-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION
+	("Driver for NAND chips using Broadcom Secondary Memory Interface");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
-- 
GitLab


From 49f3f68bfbfe568ad6dcdd66b9e981c81f5b10fa Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 3 Jul 2013 00:49:20 +0100
Subject: [PATCH 0052/1835] Add cpufreq driver

Signed-off-by: popcornmix <popcornmix@gmail.com>

bcm2835-cpufreq: Change licence to GPLv2

Signed-off-by: Eben Upton <eben.upton@broadcom.com>
Signed-off-by: Dom Cobley <dom@raspberrypi.com>
---
 drivers/cpufreq/Kconfig.arm       |   9 ++
 drivers/cpufreq/Makefile          |   1 +
 drivers/cpufreq/bcm2835-cpufreq.c | 210 ++++++++++++++++++++++++++++++
 3 files changed, 220 insertions(+)
 create mode 100644 drivers/cpufreq/bcm2835-cpufreq.c

diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 0cd8eb76ad592..22a4107c3f7cf 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -260,6 +260,15 @@ config ARM_TANGO_CPUFREQ
 	depends on CPUFREQ_DT && ARCH_TANGO
 	default y
 
+config ARM_BCM2835_CPUFREQ
+	depends on RASPBERRYPI_FIRMWARE
+	bool "BCM2835 Driver"
+	default y
+	help
+	  This adds the CPUFreq driver for BCM2835
+
+	  If in doubt, say N.
+
 config ARM_TEGRA20_CPUFREQ
 	tristate "Tegra20 CPUFreq support"
 	depends on ARCH_TEGRA
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index c1ffeabe4ecfa..e8dcb1695337d 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -80,6 +80,7 @@ obj-$(CONFIG_ARM_SCPI_CPUFREQ)		+= scpi-cpufreq.o
 obj-$(CONFIG_ARM_SPEAR_CPUFREQ)		+= spear-cpufreq.o
 obj-$(CONFIG_ARM_STI_CPUFREQ)		+= sti-cpufreq.o
 obj-$(CONFIG_ARM_TANGO_CPUFREQ)		+= tango-cpufreq.o
+obj-$(CONFIG_ARM_BCM2835_CPUFREQ)	+= bcm2835-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA20_CPUFREQ)	+= tegra20-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA124_CPUFREQ)	+= tegra124-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA186_CPUFREQ)	+= tegra186-cpufreq.o
diff --git a/drivers/cpufreq/bcm2835-cpufreq.c b/drivers/cpufreq/bcm2835-cpufreq.c
new file mode 100644
index 0000000000000..99345969b0e4d
--- /dev/null
+++ b/drivers/cpufreq/bcm2835-cpufreq.c
@@ -0,0 +1,210 @@
+/*
+ * Copyright 2011 Broadcom Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ *
+ * This driver dynamically manages the CPU Frequency of the ARM
+ * processor. Messages are sent to Videocore either setting or requesting the
+ * frequency of the ARM in order to match an appropiate frequency to the current
+ * usage of the processor. The policy which selects the frequency to use is
+ * defined in the kernel .config file, but can be changed during runtime.
+ */
+
+/* ---------- INCLUDES ---------- */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/cpufreq.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+/* ---------- DEFINES ---------- */
+/*#define CPUFREQ_DEBUG_ENABLE*/		/* enable debugging */
+#define MODULE_NAME "bcm2835-cpufreq"
+
+#define VCMSG_ID_ARM_CLOCK 0x000000003		/* Clock/Voltage ID's */
+
+/* debug printk macros */
+#ifdef CPUFREQ_DEBUG_ENABLE
+#define print_debug(fmt,...) pr_debug("%s:%s:%d: "fmt, MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
+#else
+#define print_debug(fmt,...)
+#endif
+#define print_err(fmt,...) pr_err("%s:%s:%d: "fmt, MODULE_NAME, __func__,__LINE__, ##__VA_ARGS__)
+#define print_info(fmt,...) pr_info("%s: "fmt, MODULE_NAME, ##__VA_ARGS__)
+
+/* ---------- GLOBALS ---------- */
+static struct cpufreq_driver bcm2835_cpufreq_driver;	/* the cpufreq driver global */
+static unsigned int min_frequency, max_frequency;
+static struct cpufreq_frequency_table bcm2835_freq_table[3];
+
+/*
+ ===============================================
+  clk_rate either gets or sets the clock rates.
+ ===============================================
+*/
+
+static int bcm2835_cpufreq_clock_property(u32 tag, u32 id, u32 *val)
+{
+	struct rpi_firmware *fw = rpi_firmware_get(NULL);
+	struct {
+		u32 id;
+		u32 val;
+	} packet;
+	int ret;
+
+	packet.id = id;
+	packet.val = *val;
+	ret = rpi_firmware_property(fw, tag, &packet, sizeof(packet));
+	if (ret)
+		return ret;
+
+	*val = packet.val;
+
+	return 0;
+}
+
+static uint32_t bcm2835_cpufreq_set_clock(int cur_rate, int arm_rate)
+{
+	u32 rate = arm_rate * 1000;
+	int ret;
+
+	ret = bcm2835_cpufreq_clock_property(RPI_FIRMWARE_SET_CLOCK_RATE, VCMSG_ID_ARM_CLOCK, &rate);
+	if (ret) {
+		print_err("Failed to set clock: %d (%d)\n", arm_rate, ret);
+		return 0;
+	}
+
+	rate /= 1000;
+	print_debug("Setting new frequency = %d -> %d (actual %d)\n", cur_rate, arm_rate, rate);
+
+	return rate;
+}
+
+static uint32_t bcm2835_cpufreq_get_clock(int tag)
+{
+	u32 rate;
+	int ret;
+
+	ret = bcm2835_cpufreq_clock_property(tag, VCMSG_ID_ARM_CLOCK, &rate);
+	if (ret) {
+		print_err("Failed to get clock (%d)\n", ret);
+		return 0;
+	}
+
+	rate /= 1000;
+	print_debug("%s frequency = %u\n",
+		tag == RPI_FIRMWARE_GET_CLOCK_RATE ? "Current":
+		tag == RPI_FIRMWARE_GET_MIN_CLOCK_RATE ? "Min":
+		tag == RPI_FIRMWARE_GET_MAX_CLOCK_RATE ? "Max":
+		"Unexpected", rate);
+
+	return rate;
+}
+
+/*
+ ====================================================
+  Module Initialisation registers the cpufreq driver
+ ====================================================
+*/
+static int __init bcm2835_cpufreq_module_init(void)
+{
+	print_debug("IN\n");
+	return cpufreq_register_driver(&bcm2835_cpufreq_driver);
+}
+
+/*
+ =============
+  Module exit
+ =============
+*/
+static void __exit bcm2835_cpufreq_module_exit(void)
+{
+	print_debug("IN\n");
+	cpufreq_unregister_driver(&bcm2835_cpufreq_driver);
+	return;
+}
+
+/*
+ ==============================================================
+  Initialisation function sets up the CPU policy for first use
+ ==============================================================
+*/
+static int bcm2835_cpufreq_driver_init(struct cpufreq_policy *policy)
+{
+	/* measured value of how long it takes to change frequency */
+	const unsigned int transition_latency = 355000; /* ns */
+
+	if (!rpi_firmware_get(NULL)) {
+		print_err("Firmware is not available\n");
+		return -ENODEV;
+	}
+
+	/* now find out what the maximum and minimum frequencies are */
+	min_frequency = bcm2835_cpufreq_get_clock(RPI_FIRMWARE_GET_MIN_CLOCK_RATE);
+	max_frequency = bcm2835_cpufreq_get_clock(RPI_FIRMWARE_GET_MAX_CLOCK_RATE);
+
+	if (min_frequency == max_frequency) {
+		bcm2835_freq_table[0].frequency = min_frequency;
+		bcm2835_freq_table[1].frequency = CPUFREQ_TABLE_END;
+	} else {
+		bcm2835_freq_table[0].frequency = min_frequency;
+		bcm2835_freq_table[1].frequency = max_frequency;
+		bcm2835_freq_table[2].frequency = CPUFREQ_TABLE_END;
+	}
+
+	print_info("min=%d max=%d\n", min_frequency, max_frequency);
+	return cpufreq_generic_init(policy, bcm2835_freq_table, transition_latency);
+}
+
+/*
+ =====================================================================
+  Target index function chooses the requested frequency from the table
+ =====================================================================
+*/
+
+static int bcm2835_cpufreq_driver_target_index(struct cpufreq_policy *policy, unsigned int state)
+{
+	unsigned int target_freq = state == 0 ? min_frequency : max_frequency;
+	unsigned int cur = bcm2835_cpufreq_set_clock(policy->cur, target_freq);
+
+	if (!cur)
+	{
+		print_err("Error occurred setting a new frequency (%d)\n", target_freq);
+		return -EINVAL;
+	}
+	print_debug("%s: %i: freq %d->%d\n", policy->governor->name, state, policy->cur, cur);
+	return 0;
+}
+
+/*
+ ======================================================
+  Get function returns the current frequency from table
+ ======================================================
+*/
+
+static unsigned int bcm2835_cpufreq_driver_get(unsigned int cpu)
+{
+	unsigned int actual_rate = bcm2835_cpufreq_get_clock(RPI_FIRMWARE_GET_CLOCK_RATE);
+	print_debug("cpu%d: freq=%d\n", cpu, actual_rate);
+	return actual_rate <= min_frequency ? min_frequency : max_frequency;
+}
+
+/* the CPUFreq driver */
+static struct cpufreq_driver bcm2835_cpufreq_driver = {
+	.name         = "BCM2835 CPUFreq",
+	.init         = bcm2835_cpufreq_driver_init,
+	.verify       = cpufreq_generic_frequency_table_verify,
+	.target_index = bcm2835_cpufreq_driver_target_index,
+	.get          = bcm2835_cpufreq_driver_get,
+	.attr         = cpufreq_generic_attr,
+};
+
+MODULE_AUTHOR("Dorian Peake and Dom Cobley");
+MODULE_DESCRIPTION("CPU frequency driver for BCM2835 chip");
+MODULE_LICENSE("GPL");
+
+module_init(bcm2835_cpufreq_module_init);
+module_exit(bcm2835_cpufreq_module_exit);
-- 
GitLab


From 1b638586072ee13e3ed35ace0f56302c111b0e56 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 17 Jun 2015 15:44:08 +0100
Subject: [PATCH 0053/1835] Add Chris Boot's i2c driver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

i2c-bcm2708: fixed baudrate

Fixed issue where the wrong CDIV value was set for baudrates below 3815 Hz (for 250MHz bus clock).
In that case the computed CDIV value was more than 0xffff. However the CDIV register width is only 16 bits.
This resulted in incorrect setting of CDIV and higher baudrate than intended.
Example: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0x1704 -> 42430Hz
After correction: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0xffff -> 3815Hz
The correct baudrate is shown in the log after the cdiv > 0xffff correction.

Perform I2C combined transactions when possible

Perform I2C combined transactions whenever possible, within the
restrictions of the Broadcomm Serial Controller.

Disable DONE interrupt during TA poll

Prevent interrupt from being triggered if poll is missed and transfer
starts and finishes.

i2c: Make combined transactions optional and disabled by default

i2c: bcm2708: add device tree support

Add DT support to driver and add to .dtsi file.
Setup pins in .dts file.
i2c is disabled by default.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

bcm2708: don't register i2c controllers when using DT

The devices for the i2c controllers are in the Device Tree.
Only register devices when not using DT.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

I2C: Only register the I2C device for the current board revision

i2c_bcm2708: Fix clock reference counting

Fix grabbing lock from atomic context in i2c driver

2 main changes:
- check for timeouts in the bcm2708_bsc_setup function as indicated by this comment:
      /* poll for transfer start bit (should only take 1-20 polls) */
  This implies that the setup function can now fail so account for this everywhere it's called
- Removed the clk_get_rate call from inside the setup function as it locks a mutex and that's not ok since we call it from under a spin lock.

i2c-bcm2708: When using DT, leave the GPIO setup to pinctrl

i2c-bcm2708: Increase timeouts to allow larger transfers

Use the timeout value provided by the I2C_TIMEOUT ioctl when waiting
for completion. The default timeout is 1 second.

See: https://github.com/raspberrypi/linux/issues/260

i2c-bcm2708/BCM270X_DT: Add support for I2C2

The third I2C bus (I2C2) is normally reserved for HDMI use. Careless
use of this bus can break an attached display - use with caution.

It is recommended to disable accesses by VideoCore by setting
hdmi_ignore_edid=1 or hdmi_edid_file=1 in config.txt.

The interface is disabled by default - enable using the
i2c2_iknowwhatimdoing DT parameter.

bcm2708-spi: Don't use static pin configuration with DT

Also remove superfluous error checking - the SPI framework ensures the
validity of the chip_select value.

i2c-bcm2708: Remove non-DT support

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

Set the BSC_CLKT clock streching timeout to 35ms as per SMBus specs.

Fixes i2c_bcm2708: Write to FIFO correctly - v2 (#1574)

* i2c: fix i2c_bcm2708: Clear FIFO before sending data

Make sure FIFO gets cleared before trying to send
data in case of a repeated start (COMBINED=Y).

* i2c: fix i2c_bcm2708: Only write to FIFO when not full

Check if FIFO can accept data before writing.
To avoid a peripheral read on the last iteration of a loop,
both bcm2708_bsc_fifo_fill and ~drain are changed as well.
---
 drivers/i2c/busses/Kconfig       |  19 ++
 drivers/i2c/busses/Makefile      |   2 +
 drivers/i2c/busses/i2c-bcm2708.c | 512 +++++++++++++++++++++++++++++++
 3 files changed, 533 insertions(+)
 create mode 100644 drivers/i2c/busses/i2c-bcm2708.c

diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 8f803812ea244..75148af4da6fa 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -8,6 +8,25 @@ menu "I2C Hardware Bus support"
 comment "PC SMBus host controller drivers"
 	depends on PCI
 
+config I2C_BCM2708
+	tristate "BCM2708 BSC"
+	depends on ARCH_BCM2835
+	help
+	  Enabling this option will add BSC (Broadcom Serial Controller)
+	  support for the BCM2708. BSC is a Broadcom proprietary bus compatible
+	  with I2C/TWI/SMBus.
+
+config I2C_BCM2708_BAUDRATE
+	prompt "BCM2708 I2C baudrate"
+	depends on I2C_BCM2708
+	int
+	default 100000
+	help
+	  Set the I2C baudrate. This will alter the default value. A
+	  different baudrate can be set by using a module parameter as well. If
+	  no parameter is provided when loading, this is the value that will be
+	  used.
+
 config I2C_ALI1535
 	tristate "ALI 1535"
 	depends on PCI
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 18b26af82b1c5..6d28972ae56a2 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -3,6 +3,8 @@
 # Makefile for the i2c bus drivers.
 #
 
+obj-$(CONFIG_I2C_BCM2708)	+= i2c-bcm2708.o
+
 # ACPI drivers
 obj-$(CONFIG_I2C_SCMI)		+= i2c-scmi.o
 
diff --git a/drivers/i2c/busses/i2c-bcm2708.c b/drivers/i2c/busses/i2c-bcm2708.c
new file mode 100644
index 0000000000000..962f2e5c7455d
--- /dev/null
+++ b/drivers/i2c/busses/i2c-bcm2708.c
@@ -0,0 +1,512 @@
+/*
+ * Driver for Broadcom BCM2708 BSC Controllers
+ *
+ * Copyright (C) 2012 Chris Boot & Frank Buss
+ *
+ * This driver is inspired by:
+ * i2c-ocores.c, by Peter Korsgaard <jacmet@sunsite.dk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+
+/* BSC register offsets */
+#define BSC_C			0x00
+#define BSC_S			0x04
+#define BSC_DLEN		0x08
+#define BSC_A			0x0c
+#define BSC_FIFO		0x10
+#define BSC_DIV			0x14
+#define BSC_DEL			0x18
+#define BSC_CLKT		0x1c
+
+/* Bitfields in BSC_C */
+#define BSC_C_I2CEN		0x00008000
+#define BSC_C_INTR		0x00000400
+#define BSC_C_INTT		0x00000200
+#define BSC_C_INTD		0x00000100
+#define BSC_C_ST		0x00000080
+#define BSC_C_CLEAR_1		0x00000020
+#define BSC_C_CLEAR_2		0x00000010
+#define BSC_C_READ		0x00000001
+
+/* Bitfields in BSC_S */
+#define BSC_S_CLKT		0x00000200
+#define BSC_S_ERR		0x00000100
+#define BSC_S_RXF		0x00000080
+#define BSC_S_TXE		0x00000040
+#define BSC_S_RXD		0x00000020
+#define BSC_S_TXD		0x00000010
+#define BSC_S_RXR		0x00000008
+#define BSC_S_TXW		0x00000004
+#define BSC_S_DONE		0x00000002
+#define BSC_S_TA		0x00000001
+
+#define I2C_WAIT_LOOP_COUNT	200
+
+#define DRV_NAME		"bcm2708_i2c"
+
+static unsigned int baudrate;
+module_param(baudrate, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+MODULE_PARM_DESC(baudrate, "The I2C baudrate");
+
+static bool combined = false;
+module_param(combined, bool, 0644);
+MODULE_PARM_DESC(combined, "Use combined transactions");
+
+struct bcm2708_i2c {
+	struct i2c_adapter adapter;
+
+	spinlock_t lock;
+	void __iomem *base;
+	int irq;
+	struct clk *clk;
+	u32 cdiv;
+	u32 clk_tout;
+
+	struct completion done;
+
+	struct i2c_msg *msg;
+	int pos;
+	int nmsgs;
+	bool error;
+};
+
+static inline u32 bcm2708_rd(struct bcm2708_i2c *bi, unsigned reg)
+{
+	return readl(bi->base + reg);
+}
+
+static inline void bcm2708_wr(struct bcm2708_i2c *bi, unsigned reg, u32 val)
+{
+	writel(val, bi->base + reg);
+}
+
+static inline void bcm2708_bsc_reset(struct bcm2708_i2c *bi)
+{
+	bcm2708_wr(bi, BSC_C, 0);
+	bcm2708_wr(bi, BSC_S, BSC_S_CLKT | BSC_S_ERR | BSC_S_DONE);
+}
+
+static inline void bcm2708_bsc_fifo_drain(struct bcm2708_i2c *bi)
+{
+	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_RXD))
+		bi->msg->buf[bi->pos++] = bcm2708_rd(bi, BSC_FIFO);
+}
+
+static inline void bcm2708_bsc_fifo_fill(struct bcm2708_i2c *bi)
+{
+	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_TXD))
+		bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
+}
+
+static inline int bcm2708_bsc_setup(struct bcm2708_i2c *bi)
+{
+	u32 cdiv, s, clk_tout;
+	u32 c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_ST | BSC_C_CLEAR_1;
+	int wait_loops = I2C_WAIT_LOOP_COUNT;
+
+	/* Can't call clk_get_rate as it locks a mutex and here we are spinlocked.
+	 * Use the value that we cached in the probe.
+	 */
+	cdiv = bi->cdiv;
+	clk_tout = bi->clk_tout;
+
+	if (bi->msg->flags & I2C_M_RD)
+		c |= BSC_C_INTR | BSC_C_READ;
+	else
+		c |= BSC_C_INTT;
+
+	bcm2708_wr(bi, BSC_CLKT, clk_tout);
+	bcm2708_wr(bi, BSC_DIV, cdiv);
+	bcm2708_wr(bi, BSC_A, bi->msg->addr);
+	bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
+	if (combined)
+	{
+		/* Do the next two messages meet combined transaction criteria?
+		   - Current message is a write, next message is a read
+		   - Both messages to same slave address
+		   - Write message can fit inside FIFO (16 bytes or less) */
+		if ( (bi->nmsgs > 1) &&
+			!(bi->msg[0].flags & I2C_M_RD) && (bi->msg[1].flags & I2C_M_RD) &&
+			 (bi->msg[0].addr == bi->msg[1].addr) && (bi->msg[0].len <= 16)) {
+
+			/* Clear FIFO */
+			bcm2708_wr(bi, BSC_C, BSC_C_CLEAR_1);
+
+			/* Fill FIFO with entire write message (16 byte FIFO) */
+			while (bi->pos < bi->msg->len) {
+				bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
+			}
+			/* Start write transfer (no interrupts, don't clear FIFO) */
+			bcm2708_wr(bi, BSC_C, BSC_C_I2CEN | BSC_C_ST);
+
+			/* poll for transfer start bit (should only take 1-20 polls) */
+			do {
+				s = bcm2708_rd(bi, BSC_S);
+			} while (!(s & (BSC_S_TA | BSC_S_ERR | BSC_S_CLKT | BSC_S_DONE)) && --wait_loops >= 0);
+
+			/* did we time out or some error occured? */
+			if (wait_loops < 0 || (s & (BSC_S_ERR | BSC_S_CLKT))) {
+				return -1;
+			}
+
+			/* Send next read message before the write transfer finishes. */
+			bi->nmsgs--;
+			bi->msg++;
+			bi->pos = 0;
+			bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
+			c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_INTR | BSC_C_ST | BSC_C_READ;
+		}
+	}
+	bcm2708_wr(bi, BSC_C, c);
+
+	return 0;
+}
+
+static irqreturn_t bcm2708_i2c_interrupt(int irq, void *dev_id)
+{
+	struct bcm2708_i2c *bi = dev_id;
+	bool handled = true;
+	u32 s;
+	int ret;
+
+	spin_lock(&bi->lock);
+
+	/* we may see camera interrupts on the "other" I2C channel
+		   Just return if we've not sent anything */
+	if (!bi->nmsgs || !bi->msg) {
+		goto early_exit;
+	}
+
+	s = bcm2708_rd(bi, BSC_S);
+
+	if (s & (BSC_S_CLKT | BSC_S_ERR)) {
+		bcm2708_bsc_reset(bi);
+		bi->error = true;
+
+		bi->msg = 0; /* to inform the that all work is done */
+		bi->nmsgs = 0;
+		/* wake up our bh */
+		complete(&bi->done);
+	} else if (s & BSC_S_DONE) {
+		bi->nmsgs--;
+
+		if (bi->msg->flags & I2C_M_RD) {
+			bcm2708_bsc_fifo_drain(bi);
+		}
+
+		bcm2708_bsc_reset(bi);
+
+		if (bi->nmsgs) {
+			/* advance to next message */
+			bi->msg++;
+			bi->pos = 0;
+			ret = bcm2708_bsc_setup(bi);
+			if (ret < 0) {
+				bcm2708_bsc_reset(bi);
+				bi->error = true;
+				bi->msg = 0; /* to inform the that all work is done */
+				bi->nmsgs = 0;
+				/* wake up our bh */
+				complete(&bi->done);
+				goto early_exit;
+			}
+		} else {
+			bi->msg = 0; /* to inform the that all work is done */
+			bi->nmsgs = 0;
+			/* wake up our bh */
+			complete(&bi->done);
+		}
+	} else if (s & BSC_S_TXW) {
+		bcm2708_bsc_fifo_fill(bi);
+	} else if (s & BSC_S_RXR) {
+		bcm2708_bsc_fifo_drain(bi);
+	} else {
+		handled = false;
+	}
+
+early_exit:
+	spin_unlock(&bi->lock);
+
+	return handled ? IRQ_HANDLED : IRQ_NONE;
+}
+
+static int bcm2708_i2c_master_xfer(struct i2c_adapter *adap,
+	struct i2c_msg *msgs, int num)
+{
+	struct bcm2708_i2c *bi = adap->algo_data;
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&bi->lock, flags);
+
+	reinit_completion(&bi->done);
+	bi->msg = msgs;
+	bi->pos = 0;
+	bi->nmsgs = num;
+	bi->error = false;
+
+	ret = bcm2708_bsc_setup(bi);
+
+	spin_unlock_irqrestore(&bi->lock, flags);
+
+	/* check the result of the setup */
+	if (ret < 0)
+	{
+		dev_err(&adap->dev, "transfer setup timed out\n");
+		goto error_timeout;
+	}
+
+	ret = wait_for_completion_timeout(&bi->done, adap->timeout);
+	if (ret == 0) {
+		dev_err(&adap->dev, "transfer timed out\n");
+		goto error_timeout;
+	}
+
+	ret = bi->error ? -EIO : num;
+	return ret;
+
+error_timeout:
+	spin_lock_irqsave(&bi->lock, flags);
+	bcm2708_bsc_reset(bi);
+	bi->msg = 0; /* to inform the interrupt handler that there's nothing else to be done */
+	bi->nmsgs = 0;
+	spin_unlock_irqrestore(&bi->lock, flags);
+	return -ETIMEDOUT;
+}
+
+static u32 bcm2708_i2c_functionality(struct i2c_adapter *adap)
+{
+	return I2C_FUNC_I2C | /*I2C_FUNC_10BIT_ADDR |*/ I2C_FUNC_SMBUS_EMUL;
+}
+
+static struct i2c_algorithm bcm2708_i2c_algorithm = {
+	.master_xfer = bcm2708_i2c_master_xfer,
+	.functionality = bcm2708_i2c_functionality,
+};
+
+static int bcm2708_i2c_probe(struct platform_device *pdev)
+{
+	struct resource *regs;
+	int irq, err = -ENOMEM;
+	struct clk *clk;
+	struct bcm2708_i2c *bi;
+	struct i2c_adapter *adap;
+	unsigned long bus_hz;
+	u32 cdiv, clk_tout;
+	u32 baud;
+
+	baud = CONFIG_I2C_BCM2708_BAUDRATE;
+
+	if (pdev->dev.of_node) {
+		u32 bus_clk_rate;
+		pdev->id = of_alias_get_id(pdev->dev.of_node, "i2c");
+		if (pdev->id < 0) {
+			dev_err(&pdev->dev, "alias is missing\n");
+			return -EINVAL;
+		}
+		if (!of_property_read_u32(pdev->dev.of_node,
+					"clock-frequency", &bus_clk_rate))
+			baud = bus_clk_rate;
+		else
+			dev_warn(&pdev->dev,
+				"Could not read clock-frequency property\n");
+	}
+
+	if (baudrate)
+		baud = baudrate;
+
+	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!regs) {
+		dev_err(&pdev->dev, "could not get IO memory\n");
+		return -ENXIO;
+	}
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0) {
+		dev_err(&pdev->dev, "could not get IRQ\n");
+		return irq;
+	}
+
+	clk = clk_get(&pdev->dev, NULL);
+	if (IS_ERR(clk)) {
+		dev_err(&pdev->dev, "could not find clk: %ld\n", PTR_ERR(clk));
+		return PTR_ERR(clk);
+	}
+
+	err = clk_prepare_enable(clk);
+	if (err) {
+		dev_err(&pdev->dev, "could not enable clk: %d\n", err);
+		goto out_clk_put;
+	}
+
+	bi = kzalloc(sizeof(*bi), GFP_KERNEL);
+	if (!bi)
+		goto out_clk_disable;
+
+	platform_set_drvdata(pdev, bi);
+
+	adap = &bi->adapter;
+	adap->class = I2C_CLASS_HWMON | I2C_CLASS_DDC;
+	adap->algo = &bcm2708_i2c_algorithm;
+	adap->algo_data = bi;
+	adap->dev.parent = &pdev->dev;
+	adap->nr = pdev->id;
+	strlcpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
+	adap->dev.of_node = pdev->dev.of_node;
+
+	switch (pdev->id) {
+	case 0:
+		adap->class = I2C_CLASS_HWMON;
+		break;
+	case 1:
+		adap->class = I2C_CLASS_DDC;
+		break;
+	case 2:
+		adap->class = I2C_CLASS_DDC;
+		break;
+	default:
+		dev_err(&pdev->dev, "can only bind to BSC 0, 1 or 2\n");
+		err = -ENXIO;
+		goto out_free_bi;
+	}
+
+	spin_lock_init(&bi->lock);
+	init_completion(&bi->done);
+
+	bi->base = ioremap(regs->start, resource_size(regs));
+	if (!bi->base) {
+		dev_err(&pdev->dev, "could not remap memory\n");
+		goto out_free_bi;
+	}
+
+	bi->irq = irq;
+	bi->clk = clk;
+
+	err = request_irq(irq, bcm2708_i2c_interrupt, IRQF_SHARED,
+			dev_name(&pdev->dev), bi);
+	if (err) {
+		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+		goto out_iounmap;
+	}
+
+	bcm2708_bsc_reset(bi);
+
+	err = i2c_add_numbered_adapter(adap);
+	if (err < 0) {
+		dev_err(&pdev->dev, "could not add I2C adapter: %d\n", err);
+		goto out_free_irq;
+	}
+
+	bus_hz = clk_get_rate(bi->clk);
+	cdiv = bus_hz / baud;
+	if (cdiv > 0xffff) {
+		cdiv = 0xffff;
+		baud = bus_hz / cdiv;
+	}
+
+	clk_tout = 35/1000*baud; //35ms timeout as per SMBus specs.
+	if (clk_tout > 0xffff)
+		clk_tout = 0xffff;
+	
+	bi->cdiv = cdiv;
+	bi->clk_tout = clk_tout;
+
+	dev_info(&pdev->dev, "BSC%d Controller at 0x%08lx (irq %d) (baudrate %d)\n",
+		pdev->id, (unsigned long)regs->start, irq, baud);
+
+	return 0;
+
+out_free_irq:
+	free_irq(bi->irq, bi);
+out_iounmap:
+	iounmap(bi->base);
+out_free_bi:
+	kfree(bi);
+out_clk_disable:
+	clk_disable_unprepare(clk);
+out_clk_put:
+	clk_put(clk);
+	return err;
+}
+
+static int bcm2708_i2c_remove(struct platform_device *pdev)
+{
+	struct bcm2708_i2c *bi = platform_get_drvdata(pdev);
+
+	platform_set_drvdata(pdev, NULL);
+
+	i2c_del_adapter(&bi->adapter);
+	free_irq(bi->irq, bi);
+	iounmap(bi->base);
+	clk_disable_unprepare(bi->clk);
+	clk_put(bi->clk);
+	kfree(bi);
+
+	return 0;
+}
+
+static const struct of_device_id bcm2708_i2c_of_match[] = {
+        { .compatible = "brcm,bcm2708-i2c" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, bcm2708_i2c_of_match);
+
+static struct platform_driver bcm2708_i2c_driver = {
+	.driver		= {
+		.name	= DRV_NAME,
+		.owner	= THIS_MODULE,
+		.of_match_table = bcm2708_i2c_of_match,
+	},
+	.probe		= bcm2708_i2c_probe,
+	.remove		= bcm2708_i2c_remove,
+};
+
+// module_platform_driver(bcm2708_i2c_driver);
+
+
+static int __init bcm2708_i2c_init(void)
+{
+	return platform_driver_register(&bcm2708_i2c_driver);
+}
+
+static void __exit bcm2708_i2c_exit(void)
+{
+	platform_driver_unregister(&bcm2708_i2c_driver);
+}
+
+module_init(bcm2708_i2c_init);
+module_exit(bcm2708_i2c_exit);
+
+
+
+MODULE_DESCRIPTION("BSC controller driver for Broadcom BCM2708");
+MODULE_AUTHOR("Chris Boot <bootc@bootc.net>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" DRV_NAME);
-- 
GitLab


From 8bdea6e84e35af03d6c2a1aad70fe64e06ba14fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Fri, 26 Jun 2015 14:27:06 +0200
Subject: [PATCH 0054/1835] char: broadcom: Add vcio module
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add module for accessing the mailbox property channel through
/dev/vcio. Was previously in bcm2708-vcio.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/char/broadcom/Kconfig  |   6 ++
 drivers/char/broadcom/Makefile |   1 +
 drivers/char/broadcom/vcio.c   | 175 +++++++++++++++++++++++++++++++++
 3 files changed, 182 insertions(+)
 create mode 100644 drivers/char/broadcom/vcio.c

diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
index 4ef0d7af2bc72..cffd17df6a1b6 100644
--- a/drivers/char/broadcom/Kconfig
+++ b/drivers/char/broadcom/Kconfig
@@ -15,6 +15,12 @@ config BCM2708_VCMEM
         help
           Helper for videocore memory access and total size allocation.
 
+config BCM_VCIO
+	tristate "Mailbox userspace access"
+	depends on BCM2835_MBOX
+	help
+	  Gives access to the mailbox property channel from userspace.
+
 endif
 
 config BCM_VC_SM
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
index d0ad04f8e4981..7d9cb3e0b1c3c 100644
--- a/drivers/char/broadcom/Makefile
+++ b/drivers/char/broadcom/Makefile
@@ -1,4 +1,5 @@
 obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+obj-$(CONFIG_BCM_VCIO)		+= vcio.o
 obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
 
 obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
diff --git a/drivers/char/broadcom/vcio.c b/drivers/char/broadcom/vcio.c
new file mode 100644
index 0000000000000..c19bc2075c778
--- /dev/null
+++ b/drivers/char/broadcom/vcio.c
@@ -0,0 +1,175 @@
+/*
+ *  Copyright (C) 2010 Broadcom
+ *  Copyright (C) 2015 Noralf Trønnes
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/ioctl.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MBOX_CHAN_PROPERTY 8
+
+#define VCIO_IOC_MAGIC 100
+#define IOCTL_MBOX_PROPERTY _IOWR(VCIO_IOC_MAGIC, 0, char *)
+
+static struct {
+	dev_t devt;
+	struct cdev cdev;
+	struct class *class;
+	struct rpi_firmware *fw;
+} vcio;
+
+static int vcio_user_property_list(void *user)
+{
+	u32 *buf, size;
+	int ret;
+
+	/* The first 32-bit is the size of the buffer */
+	if (copy_from_user(&size, user, sizeof(size)))
+		return -EFAULT;
+
+	buf = kmalloc(size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (copy_from_user(buf, user, size)) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	/* Strip off protocol encapsulation */
+	ret = rpi_firmware_property_list(vcio.fw, &buf[2], size - 12);
+	if (ret) {
+		kfree(buf);
+		return ret;
+	}
+
+	buf[1] = RPI_FIRMWARE_STATUS_SUCCESS;
+	if (copy_to_user(user, buf, size))
+		ret = -EFAULT;
+
+	kfree(buf);
+
+	return ret;
+}
+
+static int vcio_device_open(struct inode *inode, struct file *file)
+{
+	try_module_get(THIS_MODULE);
+
+	return 0;
+}
+
+static int vcio_device_release(struct inode *inode, struct file *file)
+{
+	module_put(THIS_MODULE);
+
+	return 0;
+}
+
+static long vcio_device_ioctl(struct file *file, unsigned int ioctl_num,
+			      unsigned long ioctl_param)
+{
+	switch (ioctl_num) {
+	case IOCTL_MBOX_PROPERTY:
+		return vcio_user_property_list((void *)ioctl_param);
+	default:
+		pr_err("unknown ioctl: %d\n", ioctl_num);
+		return -EINVAL;
+	}
+}
+
+const struct file_operations vcio_fops = {
+	.unlocked_ioctl = vcio_device_ioctl,
+	.open = vcio_device_open,
+	.release = vcio_device_release,
+};
+
+static int __init vcio_init(void)
+{
+	struct device_node *np;
+	static struct device *dev;
+	int ret;
+
+	np = of_find_compatible_node(NULL, NULL,
+				     "raspberrypi,bcm2835-firmware");
+/* Uncomment this when we only boot with Device Tree
+	if (!of_device_is_available(np))
+		return -ENODEV;
+*/
+	vcio.fw = rpi_firmware_get(np);
+	if (!vcio.fw)
+		return -ENODEV;
+
+	ret = alloc_chrdev_region(&vcio.devt, 0, 1, "vcio");
+	if (ret) {
+		pr_err("failed to allocate device number\n");
+		return ret;
+	}
+
+	cdev_init(&vcio.cdev, &vcio_fops);
+	vcio.cdev.owner = THIS_MODULE;
+	ret = cdev_add(&vcio.cdev, vcio.devt, 1);
+	if (ret) {
+		pr_err("failed to register device\n");
+		goto err_unregister_chardev;
+	}
+
+	/*
+	 * Create sysfs entries
+	 * 'bcm2708_vcio' is used for backwards compatibility so we don't break
+	 * userspace. Raspian has a udev rule that changes the permissions.
+	 */
+	vcio.class = class_create(THIS_MODULE, "bcm2708_vcio");
+	if (IS_ERR(vcio.class)) {
+		ret = PTR_ERR(vcio.class);
+		pr_err("failed to create class\n");
+		goto err_cdev_del;
+	}
+
+	dev = device_create(vcio.class, NULL, vcio.devt, NULL, "vcio");
+	if (IS_ERR(dev)) {
+		ret = PTR_ERR(dev);
+		pr_err("failed to create device\n");
+		goto err_class_destroy;
+	}
+
+	return 0;
+
+err_class_destroy:
+	class_destroy(vcio.class);
+err_cdev_del:
+	cdev_del(&vcio.cdev);
+err_unregister_chardev:
+	unregister_chrdev_region(vcio.devt, 1);
+
+	return ret;
+}
+module_init(vcio_init);
+
+static void __exit vcio_exit(void)
+{
+	device_destroy(vcio.class, vcio.devt);
+	class_destroy(vcio.class);
+	cdev_del(&vcio.cdev);
+	unregister_chrdev_region(vcio.devt, 1);
+}
+module_exit(vcio_exit);
+
+MODULE_AUTHOR("Gray Girling");
+MODULE_AUTHOR("Noralf Trønnes");
+MODULE_DESCRIPTION("Mailbox userspace access");
+MODULE_LICENSE("GPL");
-- 
GitLab


From 31193865ab60d2bdd240210f20aab0904e2d0ef5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Fri, 26 Jun 2015 14:25:01 +0200
Subject: [PATCH 0055/1835] firmware: bcm2835: Support ARCH_BCM270x
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Support booting without Device Tree.
Turn on USB power.
Load driver early because of lacking support for deferred probing
in many drivers.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

firmware: bcm2835: Don't turn on USB power

The raspberrypi-power driver is now used to turn on USB power.

This partly reverts commit:
firmware: bcm2835: Support ARCH_BCM270x

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/firmware/raspberrypi.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index a200a21746119..12da5a6facdee 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -32,6 +32,8 @@ struct rpi_firmware {
 	u32 enabled;
 };
 
+static struct platform_device *g_pdev;
+
 static DEFINE_MUTEX(transaction_lock);
 
 static void response_callback(struct mbox_client *cl, void *msg)
@@ -229,6 +231,7 @@ static int rpi_firmware_probe(struct platform_device *pdev)
 	init_completion(&fw->c);
 
 	platform_set_drvdata(pdev, fw);
+	g_pdev = pdev;
 
 	rpi_firmware_print_firmware_revision(fw);
 	rpi_register_hwmon_driver(dev, fw);
@@ -243,6 +246,7 @@ static int rpi_firmware_remove(struct platform_device *pdev)
 	platform_device_unregister(rpi_hwmon);
 	rpi_hwmon = NULL;
 	mbox_free_channel(fw->chan);
+	g_pdev = NULL;
 
 	return 0;
 }
@@ -255,7 +259,7 @@ static int rpi_firmware_remove(struct platform_device *pdev)
  */
 struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
 {
-	struct platform_device *pdev = of_find_device_by_node(firmware_node);
+	struct platform_device *pdev = g_pdev;
 
 	if (!pdev)
 		return NULL;
@@ -278,7 +282,18 @@ static struct platform_driver rpi_firmware_driver = {
 	.probe		= rpi_firmware_probe,
 	.remove		= rpi_firmware_remove,
 };
-module_platform_driver(rpi_firmware_driver);
+
+static int __init rpi_firmware_init(void)
+{
+	return platform_driver_register(&rpi_firmware_driver);
+}
+subsys_initcall(rpi_firmware_init);
+
+static void __init rpi_firmware_exit(void)
+{
+	platform_driver_unregister(&rpi_firmware_driver);
+}
+module_exit(rpi_firmware_exit);
 
 MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
 MODULE_DESCRIPTION("Raspberry Pi firmware driver");
-- 
GitLab


From 2367d8a42e2717d8d15a39a9085cc2909fae033a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 11 May 2015 09:00:42 +0100
Subject: [PATCH 0056/1835] scripts: Add mkknlimg and knlinfo scripts from
 tools repo

The Raspberry Pi firmware looks for a trailer on the kernel image to
determine whether it was compiled with Device Tree support enabled.
If the firmware finds a kernel without this trailer, or which has a
trailer indicating that it isn't DT-capable, it disables DT support
and reverts to using ATAGs.

The mkknlimg utility adds that trailer, having first analysed the
image to look for signs of DT support and the kernel version string.

knlinfo displays the contents of the trailer in the given kernel image.

scripts/mkknlimg: Add support for ARCH_BCM2835

Add a new trailer field indicating whether this is an ARCH_BCM2835
build, as opposed to MACH_BCM2708/9. If the loader finds this flag
is set it changes the default base dtb file name from bcm270x...
to bcm283y...

Also update knlinfo to show the status of the field.

scripts/mkknlimg: Improve ARCH_BCM2835 detection

The board support code contains sufficient strings to be able to
distinguish 2708 vs. 2835 builds, so remove the check for
bcm2835-pm-wdt which could exist in either.

Also, since the canned configuration is no longer built in (it's
a module), remove the config string checking.

See: https://github.com/raspberrypi/linux/issues/1157

scripts: Multi-platform support for mkknlimg and knlinfo

The firmware uses tags in the kernel trailer to choose which dtb file
to load. Current firmware loads bcm2835-*.dtb if the '283x' tag is true,
otherwise it loads bcm270*.dtb. This scheme breaks if an image supports
multiple platforms.

This patch adds '270X' and '283X' tags to indicate support for RPi and
upstream platforms, respectively. '283x' (note lower case 'x') is left
for old firmware, and is only set if the image only supports upstream
builds.

scripts/mkknlimg: Append a trailer for all input

Now that the firmware assumes an unsigned kernel is DT-capable, it is
helpful to be able to mark a kernel as being non-DT-capable.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

scripts/knlinfo: Decode DDTK atom

Show the DDTK atom as being a boolean.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

mkknlimg: Retain downstream-kernel detection

With the death of ARCH_BCM2708 and ARCH_BCM2709, a new way is needed to
determine if this is a "downstream" build that wants the firmware to
load a bcm27xx .dtb. The vc_cma driver is used downstream but not
upstream, making vc_cma_init a suitable predicate symbol.

mkknlimg: Find some more downstream-only strings

See: https://github.com/raspberrypi/linux/issues/1920

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

scripts: Update mkknlimg, just in case

With the removal of the vc_cma driver, mkknlimg lost an indication that
the user had built a downstream kernel. Update the script, adding a few
more key strings, in case it is still being used.

Note that mkknlimg is now deprecated, except to tag kernels as upstream
(283x), and thus requiring upstream DTBs.

See: https://github.com/raspberrypi/linux/issues/2239

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 scripts/knlinfo  | 171 +++++++++++++++++++++++++++++++
 scripts/mkknlimg | 262 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 433 insertions(+)
 create mode 100755 scripts/knlinfo
 create mode 100755 scripts/mkknlimg

diff --git a/scripts/knlinfo b/scripts/knlinfo
new file mode 100755
index 0000000000000..263ec937eaa70
--- /dev/null
+++ b/scripts/knlinfo
@@ -0,0 +1,171 @@
+#!/usr/bin/env perl
+# ----------------------------------------------------------------------
+# knlinfo by Phil Elwell for Raspberry Pi
+#
+# (c) 2014,2015 Raspberry Pi (Trading) Limited <info@raspberrypi.org>
+#
+# Licensed under the terms of the GNU General Public License.
+# ----------------------------------------------------------------------
+
+use strict;
+use integer;
+
+use Fcntl ":seek";
+
+my $trailer_magic = 'RPTL';
+
+my %atom_formats =
+(
+    'DDTK' => \&format_bool,
+    'DTOK' => \&format_bool,
+    'KVer' => \&format_string,
+    '270X' => \&format_bool,
+    '283X' => \&format_bool,
+    '283x' => \&format_bool,
+);
+
+if (@ARGV != 1)
+{
+	print ("Usage: knlinfo <kernel image>\n");
+	exit(1);
+}
+
+my $kernel_file = $ARGV[0];
+
+
+my ($atoms, $pos) = read_trailer($kernel_file);
+
+exit(1) if (!$atoms);
+
+printf("Kernel trailer found at %d/0x%x:\n", $pos, $pos);
+
+foreach my $atom (@$atoms)
+{
+    printf("  %s: %s\n", $atom->[0], format_atom($atom));
+}
+
+exit(0);
+
+sub read_trailer
+{
+	my ($kernel_file) = @_;
+	my $fh;
+
+	if (!open($fh, '<', $kernel_file))
+	{
+		print ("* Failed to open '$kernel_file'\n");
+		return undef;
+	}
+
+	if (!seek($fh, -12, SEEK_END))
+	{
+		print ("* seek error in '$kernel_file'\n");
+		return undef;
+	}
+
+	my $last_bytes;
+	sysread($fh, $last_bytes, 12);
+
+	my ($trailer_len, $data_len, $magic) = unpack('VVa4', $last_bytes);
+
+	if (($magic ne $trailer_magic) || ($data_len != 4))
+	{
+		print ("* no trailer\n");
+		return undef;
+	}
+	if (!seek($fh, -12, SEEK_END))
+	{
+		print ("* seek error in '$kernel_file'\n");
+		return undef;
+	}
+
+	$trailer_len -= 12;
+
+	while ($trailer_len > 0)
+	{
+		if ($trailer_len < 8)
+		{
+			print ("* truncated atom header in trailer\n");
+			return undef;
+		}
+		if (!seek($fh, -8, SEEK_CUR))
+		{
+			print ("* seek error in '$kernel_file'\n");
+			return undef;
+		}
+		$trailer_len -= 8;
+
+		my $atom_hdr;
+		sysread($fh, $atom_hdr, 8);
+		my ($atom_len, $atom_type) = unpack('Va4', $atom_hdr);
+
+		if ($trailer_len < $atom_len)
+		{
+			print ("* truncated atom data in trailer\n");
+			return undef;
+		}
+
+		my $rounded_len = (($atom_len + 3) & ~3);
+		if (!seek($fh, -(8 + $rounded_len), SEEK_CUR))
+		{
+			print ("* seek error in '$kernel_file'\n");
+			return undef;
+		}
+		$trailer_len -= $rounded_len;
+
+		my $atom_data;
+		sysread($fh, $atom_data, $atom_len);
+
+		if (!seek($fh, -$atom_len, SEEK_CUR))
+		{
+			print ("* seek error in '$kernel_file'\n");
+			return undef;
+		}
+
+		push @$atoms, [ $atom_type, $atom_data ];
+	}
+
+ 	if (($$atoms[-1][0] eq "\x00\x00\x00\x00") &&
+	    ($$atoms[-1][1] eq ""))
+	{
+		pop @$atoms;
+	}
+	else
+	{
+		print ("* end marker missing from trailer\n");
+	}
+
+	return ($atoms, tell($fh));
+}
+
+sub format_atom
+{
+    my ($atom) = @_;
+
+    my $format_func = $atom_formats{$atom->[0]} || \&format_hex;
+    return $format_func->($atom->[1]);
+}
+
+sub format_bool
+{
+    my ($data) = @_;
+    return unpack('V', $data) ? 'y' : 'n';
+}
+
+sub format_int
+{
+    my ($data) = @_;
+    return unpack('V', $data);
+}
+
+sub format_string
+{
+    my ($data) = @_;
+    return '"'.$data.'"';
+}
+
+sub format_hex
+{
+    my ($data) = @_;
+    return unpack('H*', $data);
+}
diff --git a/scripts/mkknlimg b/scripts/mkknlimg
new file mode 100755
index 0000000000000..d72e15224232d
--- /dev/null
+++ b/scripts/mkknlimg
@@ -0,0 +1,262 @@
+#!/usr/bin/env perl
+# ----------------------------------------------------------------------
+# mkknlimg by Phil Elwell for Raspberry Pi
+# based on extract-ikconfig by Dick Streefland
+#
+# (c) 2009,2010 Dick Streefland <dick@streefland.net>
+# (c) 2014,2015 Raspberry Pi (Trading) Limited <info@raspberrypi.org>
+#
+# Licensed under the terms of the GNU General Public License.
+# ----------------------------------------------------------------------
+
+use strict;
+use warnings;
+use integer;
+
+use constant FLAG_PI   => 0x01;
+use constant FLAG_DTOK => 0x02;
+use constant FLAG_DDTK => 0x04;
+use constant FLAG_270X => 0x08;
+use constant FLAG_283X => 0x10;
+
+my $trailer_magic = 'RPTL';
+
+my $tmpfile1 = "/tmp/mkknlimg_$$.1";
+my $tmpfile2 = "/tmp/mkknlimg_$$.2";
+
+my $dtok = 0;
+my $ddtk = 0;
+my $is_270x = 0;
+my $is_283x = 0;
+
+while (@ARGV && ($ARGV[0] =~ /^-/))
+{
+    my $arg = shift(@ARGV);
+    if ($arg eq '--dtok')
+    {
+	$dtok = 1;
+    }
+    elsif ($arg eq '--ddtk')
+    {
+	$ddtk = 1;
+    }
+    elsif ($arg eq '--270x')
+    {
+	$is_270x = 1;
+    }
+    elsif ($arg eq '--283x')
+    {
+	$is_283x = 1;
+    }
+    else
+    {
+	print ("* Unknown option '$arg'\n");
+	usage();
+    }
+}
+
+usage() if (@ARGV != 2);
+
+my $kernel_file = $ARGV[0];
+my $out_file = $ARGV[1];
+
+if (! -r $kernel_file)
+{
+    print ("* File '$kernel_file' not found\n");
+    usage();
+}
+
+my $wanted_strings =
+{
+	'brcm,bcm2835-mmc' => FLAG_PI,
+	'brcm,bcm2835-sdhost' => FLAG_PI,
+	'brcm,bcm2835-gpio' => FLAG_PI | FLAG_DTOK,
+	'brcm,bcm2708-fb'   => FLAG_PI | FLAG_DTOK | FLAG_270X,
+	'brcm,bcm2708-usb'  => FLAG_PI | FLAG_DTOK | FLAG_270X,
+	'brcm,bcm2835' => FLAG_PI | FLAG_DTOK | FLAG_283X,
+	'brcm,bcm2836' => FLAG_PI | FLAG_DTOK | FLAG_283X,
+	'brcm,bcm2837' => FLAG_PI | FLAG_DTOK | FLAG_283X,
+	'of_cfs_init' => FLAG_DTOK | FLAG_DDTK,
+};
+
+my $res = try_extract($kernel_file, $tmpfile1);
+$res ||= try_decompress('\037\213\010', 'xy',    'gunzip', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\3757zXZ\000', 'abcde', 'unxz --single-stream', -1,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('BZh',          'xy',    'bunzip2', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\135\0\0\0',   'xxx',   'unlzma', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\211\114\132', 'xy',    'lzop -d', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\002\041\114\030', 'xy',    'lz4 -d', 1,
+			$kernel_file, $tmpfile1, $tmpfile2);
+
+my $append_trailer;
+my $trailer;
+my $kver = '?';
+
+$append_trailer = 1;
+
+if ($res)
+{
+    $kver = $res->{'kver'} || '?';
+    my $flags = $res->{'flags'};
+    print("Version: $kver\n");
+
+    if ($flags & FLAG_PI)
+    {
+	$dtok ||= ($flags & FLAG_DTOK) != 0;
+	$is_270x ||= ($flags & FLAG_270X) != 0;
+	$is_283x ||= ($flags & FLAG_283X) != 0;
+	$ddtk ||= ($flags & FLAG_DDTK) != 0;
+    }
+    else
+    {
+	print ("* This doesn't look like a Raspberry Pi kernel.\n");
+    }
+}
+elsif (!$dtok)
+{
+    print ("* Is this a valid kernel?\n");
+}
+
+if ($append_trailer)
+{
+    printf("DT: %s\n", $dtok ? "y" : "n");
+    printf("DDT: %s\n", $ddtk ? "y" : "n");
+    printf("270x: %s\n", $is_270x ? "y" : "n");
+    printf("283x: %s\n", $is_283x ? "y" : "n");
+
+    my @atoms;
+
+    push @atoms, [ $trailer_magic, pack('V', 0) ];
+    push @atoms, [ 'KVer', $kver ];
+    push @atoms, [ 'DTOK', pack('V', $dtok) ];
+    push @atoms, [ 'DDTK', pack('V', $ddtk) ];
+    push @atoms, [ '270X', pack('V', $is_270x) ];
+    push @atoms, [ '283X', pack('V', $is_283x) ];
+    push @atoms, [ '283x', pack('V', $is_283x && !$is_270x) ];
+
+    $trailer = pack_trailer(\@atoms);
+    $atoms[0]->[1] = pack('V', length($trailer));
+
+    $trailer = pack_trailer(\@atoms);
+}
+
+my $ofh;
+my $total_len = 0;
+
+if ($out_file eq $kernel_file)
+{
+    die "* Failed to open '$out_file' for append\n"
+	if (!open($ofh, '>>', $out_file));
+    $total_len = tell($ofh);
+}
+else
+{
+    die "* Failed to open '$kernel_file'\n"
+	if (!open(my $ifh, '<', $kernel_file));
+    die "* Failed to create '$out_file'\n"
+	if (!open($ofh, '>', $out_file));
+
+    my $copybuf;
+    while (1)
+    {
+	my $bytes = sysread($ifh, $copybuf, 64*1024);
+	last if (!$bytes);
+	syswrite($ofh, $copybuf, $bytes);
+	$total_len += $bytes;
+    }
+    close($ifh);
+}
+
+if ($trailer)
+{
+    # Pad to word-alignment
+    syswrite($ofh, "\x000\x000\x000", (-$total_len & 0x3));
+    syswrite($ofh, $trailer);
+}
+
+close($ofh);
+
+exit($trailer ? 0 : 1);
+
+END {
+	unlink($tmpfile1) if ($tmpfile1);
+	unlink($tmpfile2) if ($tmpfile2);
+}
+
+
+sub usage
+{
+	print ("Usage: mkknlimg [--dtok] [--270x] [--283x] <vmlinux|zImage|bzImage> <outfile>\n");
+	exit(1);
+}
+
+sub try_extract
+{
+	my ($knl, $tmp) = @_;
+
+	my $ver = `strings "$knl" | grep -a -E "^Linux version [1-9]"`;
+
+	return undef if (!$ver);
+
+	chomp($ver);
+
+	my $res = { 'kver'=>$ver };
+	$res->{'flags'} = strings_to_flags($knl, $wanted_strings);
+
+	return $res;
+}
+
+
+sub try_decompress
+{
+	my ($magic, $subst, $zcat, $idx, $knl, $tmp1, $tmp2) = @_;
+
+	my $pos = `tr "$magic\n$subst" "\n$subst=" < "$knl" | grep -abo "^$subst"`;
+	if ($pos)
+	{
+		chomp($pos);
+		$pos = (split(/[\r\n]+/, $pos))[$idx];
+		return undef if (!defined($pos));
+		$pos =~ s/:.*[\r\n]*$//s;
+		my $cmd = "tail -c+$pos \"$knl\" | $zcat > $tmp2 2> /dev/null";
+		my $err = (system($cmd) >> 8);
+		return undef if (($err != 0) && ($err != 2));
+
+		return try_extract($tmp2, $tmp1);
+	}
+
+	return undef;
+}
+
+sub strings_to_flags
+{
+	my ($knl, $strings) = @_;
+	my $string_pattern = '^('.join('|', keys(%$strings)).')$';
+	my $flags = 0;
+
+	my @matches = `strings \"$knl\" | grep -E \"$string_pattern\"`;
+	foreach my $match (@matches)
+	{
+	    chomp($match);
+	    $flags |= $strings->{$match};
+	}
+
+	return $flags;
+}
+
+sub pack_trailer
+{
+	my ($atoms) = @_;
+	my $trailer = pack('VV', 0, 0);
+	for (my $i = $#$atoms; $i>=0; $i--)
+	{
+		my $atom = $atoms->[$i];
+		$trailer .= pack('a*x!4Va4', $atom->[1], length($atom->[1]), $atom->[0]);
+	}
+	return $trailer;
+}
-- 
GitLab


From 5115fa211b7b6207fe77d828ccaf085b115d68f9 Mon Sep 17 00:00:00 2001
From: notro <notro@tronnes.org>
Date: Wed, 9 Jul 2014 14:46:08 +0200
Subject: [PATCH 0057/1835] BCM2708: Add core Device Tree support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the bare minimum needed to boot BCM2708 from a Device Tree.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

BCM2708: DT: change 'axi' nodename to 'soc'

Change DT node named 'axi' to 'soc' so it matches ARCH_BCM2835.
The VC4 bootloader fills in certain properties in the 'axi' subtree,
but since this is part of an upstreaming effort, the name is changed.

Signed-off-by: Noralf Tronnes notro@tronnes.org

BCM2708_DT: Correct length of the peripheral space

Use dts-dirs feature for overlays.

The kernel makefiles have a dts-dirs target that is for vendor subdirectories.

Using this fixes the install_dtbs target, which previously did not install the overlays.

BCM270X_DT: configure I2S DMA channels

Signed-off-by: Matthias Reichl <hias@horus.com>

BCM270X_DT: switch to bcm2835-i2s

I2S soundcard drivers with proper devicetree support (i.e. not linking
to the cpu_dai/platform via name but to cpu/platform via of_node)
will work out of the box without any modifications.

When the kernel is compiled without devicetree support the platform
code will instantiate the bcm2708-i2s driver and I2S soundcard drivers
will link to it via name, as before.

Signed-off-by: Matthias Reichl <hias@horus.com>

SDIO-overlay: add poll_once-boolean parameter

Add paramter to toggle sdio-device-polling
done every second or once at boot-time.

Signed-off-by: Patrick Boettcher <patrick.boettcher@posteo.de>

BCM270X_DT: Make mmc overlay compatible with current firmware

The original DT overlay logic followed a merge-then-patch procedure,
i.e. parameters are applied to the loaded overlay before the overlay
is merged into the base DTB. This sequence has been changed to
patch-then-merge, in order to support parameterised node names, and
to protect against bad overlays. As a result, overrides (parameters)
must only target labels in the overlay, but the overlay can obviously target nodes in the base DTB.

mmc-overlay.dts (that switches back to the original mmc sdcard
driver) is the only overlay violating that rule, and this patch
fixes it.

bcm270x_dt: Use the sdhost MMC controller by default

The "mmc" overlay reverts to using the other controller.

squash: Add cprman to dt

BCM270X_DT: Use clk_core for I2C interfaces

BCM270X_DT: Use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi

The mainline Device Tree files are quite close to downstream now.
Let's use bcm283x.dtsi, bcm2835.dtsi and bcm2836.dtsi as base files
for our dts files.

Mainline dts files are based on these files:

          bcm2835-rpi.dtsi
  bcm2835.dtsi    bcm2836.dtsi
          bcm283x.dtsi

Current downstream are based on these:

  bcm2708.dtsi    bcm2709.dtsi    bcm2710.dtsi
             bcm2708_common.dtsi

This patch introduces this dependency:

  bcm2708.dtsi    bcm2709.dtsi
          bcm2708-rpi.dtsi
          bcm270x.dtsi
  bcm2835.dtsi    bcm2836.dtsi
          bcm283x.dtsi

And:
          bcm2710.dtsi
          bcm2708-rpi.dtsi
          bcm270x.dtsi
          bcm283x.dtsi

bcm270x.dtsi contains the downstream bcm283x.dtsi diff.
bcm2708-rpi.dtsi is the downstream version of bcm2835-rpi.dtsi.

Other changes:
- The led node has moved from /soc/leds to /leds. This is not a problem
  since the label is used to reference it.
- The clk_osc reg property changes from 6 to 3.
- The gpu nodes has their interrupt property set in the base file.
- the clocks label does not point to the /clocks node anymore, but
  points to the cprman node. This is not a problem since the overlays
  that use the clock node refer to it directly: target-path = "/clocks";
- some nodes now have 2 labels since mainline and downstream differs in
  this respect: cprman/clocks, spi0/spi, gpu/vc4.
- some nodes doesn't have an explicit status = "okay" since they're not
  disabled in the base file: watchdog and random.
- gpiomem doesn't need an explicit status = "okay".
- bcm2708-rpi-cm.dts got the hpd-gpios property from bcm2708_common.dtsi,
  it's now set directly in that file.
- bcm2709-rpi-2-b.dts has the timer node moved from /soc/timer to /timer.
- Removed clock-frequency property on the bcm{2709,2710}.dtsi timer nodes.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270X_DT: Use raspberrypi-power to turn on USB power

Use the raspberrypi-power driver to turn on USB power.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270X_DT: Add a .dtbo target, use for overlays

Change the filenames and extensions to keep the pre-DDT style of
overlay (<name>-overlay.dtb) distinct from new ones that use a
different style of local fixups (<name>.dtbo), and to match other
platforms.

The RPi firmware uses the DDTK trailer atom to choose which type of
overlay to use for each kernel.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

BCM270X_DT: Don't generate "linux,phandle" props

The EPAPR standard says to use "phandle" properties to store phandles,
rather than the deprecated "linux,phandle" version. By default, dtc
generates both, but adding "-H epapr" causes it to only generate
"phandle"s, saving some space and clutter.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

BCM270X_DT: Add overlay for enc28j60 on SPI2

Works on SPI2 for compute module

BCM270X_DT: Add midi-uart0 overlay

MIDI requires 31.25kbaud, a baudrate unsupported by Linux. The
midi-uart0 overlay configures uart0 (ttyAMA0) to use a fake clock
so that requesting 38.4kbaud actually gets 31.25kbaud.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

BCM270X_DT: Add i2c-sensor overlay

The i2c-sensor overlay is a container for various pressure and
temperature sensors, currently bmp085 and bmp280. The standalone
bmp085_i2c-sensor overlay is now deprecated.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

BCM270X_DT: overlays/*-overlay.dtb -> overlays/*.dtbo (#1752)

We now create overlays as .dtbo files.

build: support for .dtbo files for dtb overlays

Kernel 4.4.6+ on RaspberryPi support .dtbo files for overlays, instead of .dtb.
Patch the kernel, which has faulty rules to generate .dtbo the way yocto does

Signed-off-by: Herve Jourdain <herve.jourdain@neuf.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>

BCM270X: Drop position requirement for CMA in VC4 overlay.

No longer necessary since 2aefcd576195a739a7a256099571c9c4a401005f,
and will probably let peeople that want to choose a larger CMA
allocation (particularly on pi0/1).

Signed-off-by: Eric Anholt <eric@anholt.net>

BCM270X_DT: RPi Device Tree tidy

Use the upstream sdhost node, add thermal-zones, and factor out some
common elements.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

kbuild: Silence unhelpful DTC warnings

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .gitignore                                    |    2 +-
 arch/arm/Makefile                             |    2 +
 arch/arm/boot/dts/Makefile                    |   21 +
 arch/arm/boot/dts/bcm2708-rpi-0-w.dts         |  166 ++
 arch/arm/boot/dts/bcm2708-rpi-b-plus.dts      |  122 ++
 arch/arm/boot/dts/bcm2708-rpi-b.dts           |  112 +
 arch/arm/boot/dts/bcm2708-rpi-cm.dts          |   95 +
 arch/arm/boot/dts/bcm2708-rpi-cm.dtsi         |   17 +
 arch/arm/boot/dts/bcm2708-rpi.dtsi            |  159 ++
 arch/arm/boot/dts/bcm2708.dtsi                |   11 +
 arch/arm/boot/dts/bcm2709-rpi-2-b.dts         |  123 ++
 arch/arm/boot/dts/bcm2709.dtsi                |   19 +
 arch/arm/boot/dts/bcm270x.dtsi                |  152 ++
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts    |  183 ++
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts         |  191 ++
 arch/arm/boot/dts/bcm2710-rpi-cm3.dts         |  129 ++
 arch/arm/boot/dts/bcm2710.dtsi                |   29 +
 arch/arm/boot/dts/bcm2835-rpi.dtsi            |    2 +-
 arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi    |   17 +
 arch/arm/boot/dts/overlays/Makefile           |  145 ++
 arch/arm/boot/dts/overlays/README             | 1952 +++++++++++++++++
 .../dts/overlays/adau1977-adc-overlay.dts     |   40 +
 .../dts/overlays/adau7002-simple-overlay.dts  |   52 +
 .../arm/boot/dts/overlays/ads1015-overlay.dts |   98 +
 .../arm/boot/dts/overlays/ads1115-overlay.dts |  103 +
 .../arm/boot/dts/overlays/ads7846-overlay.dts |   89 +
 .../overlays/akkordion-iqdacplus-overlay.dts  |   49 +
 .../allo-boss-dac-pcm512x-audio-overlay.dts   |   59 +
 .../dts/overlays/allo-digione-overlay.dts     |   44 +
 .../allo-katana-dac-audio-overlay.dts         |   57 +
 .../allo-piano-dac-pcm512x-audio-overlay.dts  |   54 +
 ...o-piano-dac-plus-pcm512x-audio-overlay.dts |   55 +
 .../boot/dts/overlays/applepi-dac-overlay.dts |   57 +
 .../boot/dts/overlays/at86rf233-overlay.dts   |   57 +
 .../overlays/audioinjector-addons-overlay.dts |   59 +
 .../audioinjector-wm8731-audio-overlay.dts    |   39 +
 .../boot/dts/overlays/audremap-overlay.dts    |   19 +
 .../boot/dts/overlays/balena-fin-overlay.dts  |   79 +
 .../overlays/bmp085_i2c-sensor-overlay.dts    |   23 +
 arch/arm/boot/dts/overlays/dht11-overlay.dts  |   39 +
 .../dts/overlays/dionaudio-loco-overlay.dts   |   39 +
 .../overlays/dionaudio-loco-v2-overlay.dts    |   49 +
 arch/arm/boot/dts/overlays/dpi18-overlay.dts  |   31 +
 arch/arm/boot/dts/overlays/dpi24-overlay.dts  |   31 +
 .../arm/boot/dts/overlays/dwc-otg-overlay.dts |   20 +
 arch/arm/boot/dts/overlays/dwc2-overlay.dts   |   28 +
 .../boot/dts/overlays/enc28j60-overlay.dts    |   53 +
 .../dts/overlays/enc28j60-spi2-overlay.dts    |   47 +
 .../arm/boot/dts/overlays/exc3000-overlay.dts |   48 +
 .../boot/dts/overlays/fe-pi-audio-overlay.dts |   70 +
 arch/arm/boot/dts/overlays/goodix-overlay.dts |   46 +
 .../googlevoicehat-soundcard-overlay.dts      |   49 +
 .../arm/boot/dts/overlays/gpio-ir-overlay.dts |   48 +
 .../boot/dts/overlays/gpio-ir-tx-overlay.dts  |   36 +
 .../boot/dts/overlays/gpio-key-overlay.dts    |   48 +
 .../boot/dts/overlays/gpio-no-irq-overlay.dts |   14 +
 .../dts/overlays/gpio-poweroff-overlay.dts    |   36 +
 .../dts/overlays/gpio-shutdown-overlay.dts    |   80 +
 .../dts/overlays/hifiberry-amp-overlay.dts    |   39 +
 .../dts/overlays/hifiberry-dac-overlay.dts    |   34 +
 .../overlays/hifiberry-dacplus-overlay.dts    |   59 +
 .../dts/overlays/hifiberry-digi-overlay.dts   |   41 +
 .../overlays/hifiberry-digi-pro-overlay.dts   |   43 +
 arch/arm/boot/dts/overlays/hy28a-overlay.dts  |   93 +
 arch/arm/boot/dts/overlays/hy28b-overlay.dts  |  148 ++
 .../boot/dts/overlays/i2c-bcm2708-overlay.dts |   13 +
 .../boot/dts/overlays/i2c-gpio-overlay.dts    |   43 +
 .../arm/boot/dts/overlays/i2c-mux-overlay.dts |  139 ++
 .../dts/overlays/i2c-pwm-pca9685a-overlay.dts |   26 +
 .../dts/overlays/i2c-rtc-gpio-overlay.dts     |  183 ++
 .../arm/boot/dts/overlays/i2c-rtc-overlay.dts |  181 ++
 .../boot/dts/overlays/i2c-sensor-overlay.dts  |  223 ++
 .../dts/overlays/i2c0-bcm2708-overlay.dts     |   69 +
 .../dts/overlays/i2c1-bcm2708-overlay.dts     |   43 +
 .../dts/overlays/i2s-gpio28-31-overlay.dts    |   18 +
 .../boot/dts/overlays/iqaudio-dac-overlay.dts |   46 +
 .../dts/overlays/iqaudio-dacplus-overlay.dts  |   49 +
 .../iqaudio-digi-wm8804-audio-overlay.dts     |   47 +
 .../dts/overlays/jedec-spi-nor-overlay.dts    |  309 +++
 .../dts/overlays/justboom-dac-overlay.dts     |   46 +
 .../dts/overlays/justboom-digi-overlay.dts    |   41 +
 .../boot/dts/overlays/lirc-rpi-overlay.dts    |   57 +
 .../arm/boot/dts/overlays/ltc294x-overlay.dts |   86 +
 .../boot/dts/overlays/mbed-dac-overlay.dts    |   64 +
 .../boot/dts/overlays/mcp23017-overlay.dts    |   54 +
 .../boot/dts/overlays/mcp23s17-overlay.dts    |  732 +++++++
 .../dts/overlays/mcp2515-can0-overlay.dts     |   73 +
 .../dts/overlays/mcp2515-can1-overlay.dts     |   73 +
 .../arm/boot/dts/overlays/mcp3008-overlay.dts |  205 ++
 .../arm/boot/dts/overlays/mcp3202-overlay.dts |  205 ++
 .../dts/overlays/media-center-overlay.dts     |  134 ++
 .../boot/dts/overlays/midi-uart0-overlay.dts  |   36 +
 .../boot/dts/overlays/midi-uart1-overlay.dts  |   43 +
 arch/arm/boot/dts/overlays/mmc-overlay.dts    |   39 +
 .../arm/boot/dts/overlays/mpu6050-overlay.dts |   28 +
 .../arm/boot/dts/overlays/mz61581-overlay.dts |  117 +
 .../arm/boot/dts/overlays/papirus-overlay.dts |   89 +
 .../boot/dts/overlays/pi3-act-led-overlay.dts |   27 +
 .../dts/overlays/pi3-disable-bt-overlay.dts   |   46 +
 .../dts/overlays/pi3-disable-wifi-overlay.dts |   13 +
 .../dts/overlays/pi3-miniuart-bt-overlay.dts  |   74 +
 arch/arm/boot/dts/overlays/pibell-overlay.dts |   81 +
 .../boot/dts/overlays/piscreen-overlay.dts    |  102 +
 .../boot/dts/overlays/piscreen2r-overlay.dts  |  106 +
 .../arm/boot/dts/overlays/pisound-overlay.dts |  120 +
 .../arm/boot/dts/overlays/pitft22-overlay.dts |   69 +
 .../overlays/pitft28-capacitive-overlay.dts   |   91 +
 .../overlays/pitft28-resistive-overlay.dts    |  121 +
 .../overlays/pitft35-resistive-overlay.dts    |  121 +
 .../boot/dts/overlays/pps-gpio-overlay.dts    |   38 +
 .../boot/dts/overlays/pwm-2chan-overlay.dts   |   47 +
 .../boot/dts/overlays/pwm-ir-tx-overlay.dts   |   40 +
 arch/arm/boot/dts/overlays/pwm-overlay.dts    |   43 +
 .../arm/boot/dts/overlays/qca7000-overlay.dts |   52 +
 .../dts/overlays/rotary-encoder-overlay.dts   |   59 +
 .../dts/overlays/rpi-backlight-overlay.dts    |   21 +
 .../overlays/rpi-cirrus-wm5102-overlay.dts    |  146 ++
 .../arm/boot/dts/overlays/rpi-dac-overlay.dts |   34 +
 .../boot/dts/overlays/rpi-display-overlay.dts |   91 +
 .../boot/dts/overlays/rpi-ft5406-overlay.dts  |   30 +
 .../boot/dts/overlays/rpi-proto-overlay.dts   |   39 +
 .../boot/dts/overlays/rpi-sense-overlay.dts   |   47 +
 arch/arm/boot/dts/overlays/rpi-tv-overlay.dts |   31 +
 .../rra-digidac1-wm8741-audio-overlay.dts     |   49 +
 .../dts/overlays/sc16is750-i2c-overlay.dts    |   37 +
 .../dts/overlays/sc16is752-i2c-overlay.dts    |   40 +
 .../dts/overlays/sc16is752-spi1-overlay.dts   |   61 +
 arch/arm/boot/dts/overlays/sdhost-overlay.dts |   31 +
 .../boot/dts/overlays/sdio-1bit-overlay.dts   |   63 +
 arch/arm/boot/dts/overlays/sdio-overlay.dts   |   63 +
 .../arm/boot/dts/overlays/sdtweak-overlay.dts |   25 +
 .../arm/boot/dts/overlays/smi-dev-overlay.dts |   18 +
 .../boot/dts/overlays/smi-nand-overlay.dts    |   69 +
 arch/arm/boot/dts/overlays/smi-overlay.dts    |   37 +
 .../dts/overlays/spi-gpio35-39-overlay.dts    |   31 +
 .../arm/boot/dts/overlays/spi-rtc-overlay.dts |   33 +
 .../arm/boot/dts/overlays/spi0-cs-overlay.dts |   29 +
 .../boot/dts/overlays/spi0-hw-cs-overlay.dts  |   26 +
 .../boot/dts/overlays/spi1-1cs-overlay.dts    |   57 +
 .../boot/dts/overlays/spi1-2cs-overlay.dts    |   69 +
 .../boot/dts/overlays/spi1-3cs-overlay.dts    |   81 +
 .../boot/dts/overlays/spi2-1cs-overlay.dts    |   57 +
 .../boot/dts/overlays/spi2-2cs-overlay.dts    |   69 +
 .../boot/dts/overlays/spi2-3cs-overlay.dts    |   81 +
 .../dts/overlays/superaudioboard-overlay.dts  |   73 +
 arch/arm/boot/dts/overlays/sx150x-overlay.dts | 1706 ++++++++++++++
 .../boot/dts/overlays/tinylcd35-overlay.dts   |  224 ++
 arch/arm/boot/dts/overlays/uart0-overlay.dts  |   32 +
 arch/arm/boot/dts/overlays/uart1-overlay.dts  |   38 +
 .../upstream-aux-interrupt-overlay.dts        |   33 +
 .../boot/dts/overlays/upstream-overlay.dts    |  154 ++
 .../dts/overlays/vc4-fkms-v3d-overlay.dts     |   89 +
 .../boot/dts/overlays/vc4-kms-v3d-overlay.dts |  151 ++
 arch/arm/boot/dts/overlays/vga666-overlay.dts |   30 +
 .../arm/boot/dts/overlays/w1-gpio-overlay.dts |   41 +
 .../dts/overlays/w1-gpio-pullup-overlay.dts   |   43 +
 .../arm/boot/dts/overlays/wittypi-overlay.dts |   44 +
 scripts/Makefile.dtbinst                      |    8 +-
 scripts/Makefile.lib                          |   13 +
 159 files changed, 14852 insertions(+), 4 deletions(-)
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi-0-w.dts
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi-b.dts
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi-cm.dts
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi.dtsi
 create mode 100644 arch/arm/boot/dts/bcm2708.dtsi
 create mode 100644 arch/arm/boot/dts/bcm2709-rpi-2-b.dts
 create mode 100644 arch/arm/boot/dts/bcm2709.dtsi
 create mode 100644 arch/arm/boot/dts/bcm270x.dtsi
 create mode 100644 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
 create mode 100644 arch/arm/boot/dts/bcm2710-rpi-3-b.dts
 create mode 100644 arch/arm/boot/dts/bcm2710-rpi-cm3.dts
 create mode 100644 arch/arm/boot/dts/bcm2710.dtsi
 create mode 100644 arch/arm/boot/dts/overlays/Makefile
 create mode 100644 arch/arm/boot/dts/overlays/README
 create mode 100644 arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/ads1015-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/ads1115-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/ads7846-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/allo-digione-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/at86rf233-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/audremap-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/balena-fin-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dht11-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dpi18-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dpi24-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/dwc2-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/enc28j60-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/exc3000-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/goodix-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/gpio-key-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hy28a-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/hy28b-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/ltc294x-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mcp23017-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
 create mode 100755 arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
 create mode 100755 arch/arm/boot/dts/overlays/mcp3008-overlay.dts
 create mode 100755 arch/arm/boot/dts/overlays/mcp3202-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/media-center-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mmc-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mpu6050-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/mz61581-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/papirus-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pibell-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/piscreen-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pisound-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pitft22-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/pwm-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/qca7000-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-display-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sdhost-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sdio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sdtweak-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/smi-dev-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/smi-nand-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/smi-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
 create mode 100755 arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/sx150x-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
 create mode 100755 arch/arm/boot/dts/overlays/uart0-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/uart1-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/upstream-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/vga666-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/wittypi-overlay.dts

diff --git a/.gitignore b/.gitignore
index 97ba6b79834c6..d99301c57cffd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,7 +15,7 @@
 *.bin
 *.bz2
 *.c.[012]*.*
-*.dtb
+*.dtb*
 *.dtb.S
 *.dwo
 *.elf
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index d1516f85f25d3..fbe40c9647e15 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -341,6 +341,8 @@ $(INSTALL_TARGETS):
 
 %.dtb: | scripts
 	$(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@
+%.dtbo: | scripts
+	$(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@
 
 PHONY += dtbs dtbs_install
 
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index b5bd3de87c331..ffd515b94cb8c 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -1,4 +1,15 @@
 # SPDX-License-Identifier: GPL-2.0
+
+dtb-$(CONFIG_ARCH_BCM2835) += \
+	bcm2708-rpi-b.dtb \
+	bcm2708-rpi-b-plus.dtb \
+	bcm2708-rpi-cm.dtb \
+	bcm2708-rpi-0-w.dtb \
+	bcm2709-rpi-2-b.dtb \
+	bcm2710-rpi-3-b.dtb \
+	bcm2710-rpi-3-b-plus.dtb \
+	bcm2710-rpi-cm3.dtb
+
 dtb-$(CONFIG_ARCH_ALPINE) += \
 	alpine-db.dtb
 dtb-$(CONFIG_MACH_ARTPEC6) += \
@@ -1207,3 +1218,13 @@ dtb-$(CONFIG_ARCH_ASPEED) += \
 	aspeed-bmc-opp-zaius.dtb \
 	aspeed-bmc-portwell-neptune.dtb \
 	aspeed-bmc-quanta-q71l.dtb
+
+targets += dtbs dtbs_install
+targets += $(dtb-y)
+
+subdir-y	:= overlays
+
+# Enable fixups to support overlays on BCM2835 platforms
+ifeq ($(CONFIG_ARCH_BCM2835),y)
+	DTC_FLAGS ?= -@
+endif
diff --git a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
new file mode 100644
index 0000000000000..ef0b0f040ca5c
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
@@ -0,0 +1,166 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+
+/ {
+	compatible = "raspberrypi,model-zero-w", "brcm,bcm2835";
+	model = "Raspberry Pi Zero W";
+
+	chosen {
+		bootargs = "8250.nr_uarts=1";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins = <34 35 36 37 38 39>;
+		brcm,function = <7>; /* ALT3 = SD1 */
+		brcm,pull = <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = <43>;
+		brcm,function = <4>; /* alt0:GPCLK2 */
+		brcm,pull = <0>; /* none */
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <30 31 32 33>;
+		brcm,function = <7>; /* alt3=UART0 */
+		brcm,pull = <2 0 0 2>; /* up none none up */
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <>;
+		brcm,function = <>;
+	};
+};
+
+&mmc {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	non-removable;
+	bus-width = <4>;
+	status = "okay";
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	#sound-dai-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&random {
+	status = "okay";
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
new file mode 100644
index 0000000000000..31db4fd917a40
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
@@ -0,0 +1,122 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
+
+/ {
+	model = "Raspberry Pi Model B+";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 45>;
+		brcm,function = <4>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&gpio 35 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b.dts b/arch/arm/boot/dts/bcm2708-rpi-b.dts
new file mode 100644
index 0000000000000..ffe5d14feb9f6
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
@@ -0,0 +1,112 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+#include "bcm283x-rpi-smsc9512.dtsi"
+
+/ {
+	model = "Raspberry Pi Model B";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <28 29 30 31>;
+		brcm,function = <6>; /* alt2 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 45>;
+		brcm,function = <4>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 16 1>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dts b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
new file mode 100644
index 0000000000000..0b0d23256edd7
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
@@ -0,0 +1,95 @@
+/dts-v1/;
+
+#include "bcm2708-rpi-cm.dtsi"
+
+/ {
+	model = "Raspberry Pi Compute Module";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins;
+		brcm,function;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
new file mode 100644
index 0000000000000..d0299e3d9a09d
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
@@ -0,0 +1,17 @@
+#include "bcm2708.dtsi"
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
new file mode 100644
index 0000000000000..00160e0b8ab71
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -0,0 +1,159 @@
+/* Downstream version of bcm2835-rpi.dtsi */
+
+#include <dt-bindings/power/raspberrypi-power.h>
+
+/ {
+	memory {
+		device_type = "memory";
+		reg = <0x0 0x0>;
+	};
+
+	aliases {
+		audio = &audio;
+		aux = &aux;
+		sound = &sound;
+		soc = &soc;
+		dma = &dma;
+		intc = &intc;
+		watchdog = &watchdog;
+		random = &random;
+		mailbox = &mailbox;
+		gpio = &gpio;
+		uart0 = &uart0;
+		sdhost = &sdhost;
+		mmc0 = &sdhost;
+		i2s = &i2s;
+		spi0 = &spi0;
+		i2c0 = &i2c0;
+		uart1 = &uart1;
+		spi1 = &spi1;
+		spi2 = &spi2;
+		mmc = &mmc;
+		mmc1 = &mmc;
+		i2c1 = &i2c1;
+		i2c2 = &i2c2;
+		usb = &usb;
+		leds = &leds;
+		fb = &fb;
+		thermal = &thermal;
+		axiperf = &axiperf;
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+	};
+
+	soc {
+		gpiomem {
+			compatible = "brcm,bcm2835-gpiomem";
+			reg = <0x7e200000 0x1000>;
+		};
+
+		firmware: firmware {
+			compatible = "raspberrypi,bcm2835-firmware";
+			mboxes = <&mailbox>;
+		};
+
+		power: power {
+			compatible = "raspberrypi,bcm2835-power";
+			firmware = <&firmware>;
+			#power-domain-cells = <1>;
+		};
+
+		fb: fb {
+			compatible = "brcm,bcm2708-fb";
+			firmware = <&firmware>;
+			status = "disabled";
+		};
+
+		mailbox@7e00b840 {
+			compatible = "brcm,bcm2835-vchiq";
+			reg = <0x7e00b840 0x3c>;
+			interrupts = <0 2>;
+		};
+
+		vcsm: vcsm {
+			compatible = "raspberrypi,bcm2835-vcsm";
+			firmware = <&firmware>;
+			status = "okay";
+		};
+
+		/* Onboard audio */
+		audio: audio {
+			compatible = "brcm,bcm2835-audio";
+			brcm,pwm-channels = <8>;
+			status = "disabled";
+		};
+
+		/* External sound card */
+		sound: sound {
+			status = "disabled";
+		};
+	};
+
+	__overrides__ {
+		cache_line_size;
+
+		uart0 = <&uart0>,"status";
+		uart1 = <&uart1>,"status";
+		i2s = <&i2s>,"status";
+		spi = <&spi0>,"status";
+		i2c0 = <&i2c0>,"status";
+		i2c1 = <&i2c1>,"status";
+		i2c2_iknowwhatimdoing = <&i2c2>,"status";
+		i2c0_baudrate = <&i2c0>,"clock-frequency:0";
+		i2c1_baudrate = <&i2c1>,"clock-frequency:0";
+		i2c2_baudrate = <&i2c2>,"clock-frequency:0";
+
+		audio = <&audio>,"status";
+		watchdog = <&watchdog>,"status";
+		random = <&random>,"status";
+		sd_overclock = <&sdhost>,"brcm,overclock-50:0";
+		sd_force_pio = <&sdhost>,"brcm,force-pio?";
+		sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
+		sd_debug     = <&sdhost>,"brcm,debug";
+		sdio_overclock = <&mmc>,"brcm,overclock-50:0";
+		axiperf      = <&axiperf>,"status";
+	};
+};
+
+&dma {
+	brcm,dma-channel-mask = <0x7f34>;
+};
+
+&hdmi {
+	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
+};
+
+&usb {
+	power-domains = <&power RPI_POWER_DOMAIN_USB>;
+};
+
+&clocks {
+	firmware = <&firmware>;
+};
+
+sdhost_pins: &sdhost_gpio48 {
+	/* Add alias */
+};
+
+&sdhost {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdhost_gpio48>;
+	bus-width = <4>;
+	brcm,overclock-50 = <0>;
+	brcm,pio-limit = <1>;
+	status = "okay";
+};
+
+&fb {
+	status = "okay";
+};
+
+&cpu_thermal {
+	/delete-node/ trips;
+};
+
+&vec {
+	status = "disabled";
+};
diff --git a/arch/arm/boot/dts/bcm2708.dtsi b/arch/arm/boot/dts/bcm2708.dtsi
new file mode 100644
index 0000000000000..768c7da10f0eb
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708.dtsi
@@ -0,0 +1,11 @@
+#include "bcm2835.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	/delete-node/ cpus;
+
+	__overrides__ {
+		arm_freq;
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
new file mode 100644
index 0000000000000..442d2ebbdd366
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
@@ -0,0 +1,123 @@
+/dts-v1/;
+
+#include "bcm2709.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
+
+/ {
+	compatible = "raspberrypi,2-model-b", "brcm,bcm2836";
+	model = "Raspberry Pi 2 Model B";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 45>;
+		brcm,function = <4>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&gpio 35 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2709.dtsi b/arch/arm/boot/dts/bcm2709.dtsi
new file mode 100644
index 0000000000000..715f5aca753e5
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2709.dtsi
@@ -0,0 +1,19 @@
+#include "bcm2836.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	soc {
+		ranges = <0x7e000000 0x3f000000 0x01000000>,
+		         <0x40000000 0x40000000 0x00040000>;
+
+		/delete-node/ timer@7e003000;
+	};
+
+	__overrides__ {
+		arm_freq = <&v7_cpu0>, "clock-frequency:0",
+			   <&v7_cpu1>, "clock-frequency:0",
+			   <&v7_cpu2>, "clock-frequency:0",
+			   <&v7_cpu3>, "clock-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
new file mode 100644
index 0000000000000..145e455a2a146
--- /dev/null
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -0,0 +1,152 @@
+/* Downstream bcm283x.dtsi diff */
+#include <dt-bindings/power/raspberrypi-power.h>
+
+/ {
+	chosen {
+		bootargs = "";
+		/delete-property/ stdout-path;
+	};
+
+	soc: soc {
+
+		watchdog: watchdog@7e100000 {
+			/* Add alias */
+		};
+
+		random: rng@7e104000 {
+			/* Add alias */
+		};
+
+		gpio@7e200000 { /* gpio */
+			interrupts = <2 17>, <2 18>;
+		};
+
+		serial@7e201000 { /* uart0 */
+			/* Enable CTS bug workaround */
+			cts-event-workaround;
+		};
+
+		i2s@7e203000 { /* i2s */
+			#sound-dai-cells = <0>;
+			reg = <0x7e203000 0x24>;
+			clocks = <&clocks BCM2835_CLOCK_PCM>;
+		};
+
+		spi0: spi@7e204000 {
+			/* Add alias */
+			dmas = <&dma 6>, <&dma 7>;
+			dma-names = "tx", "rx";
+		};
+
+		pixelvalve0: pixelvalve@7e206000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		pixelvalve1: pixelvalve@7e207000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		dpi: dpi@7e208000 {
+			compatible = "brcm,bcm2835-dpi";
+			reg = <0x7e208000 0x8c>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>,
+				 <&clocks BCM2835_CLOCK_DPI>;
+			clock-names = "core", "pixel";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		/delete-node/ sdhci@7e300000;
+
+		mmc: mmc@7e300000 {
+			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
+			reg = <0x7e300000 0x100>;
+			interrupts = <2 30>;
+			clocks = <&clocks BCM2835_CLOCK_EMMC>;
+			dmas = <&dma 11>;
+			dma-names = "rx-tx";
+			brcm,overclock-50 = <0>;
+			status = "disabled";
+		};
+
+		hvs: hvs@7e400000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		firmwarekms: firmwarekms@7e600000 {
+			compatible = "raspberrypi,rpi-firmware-kms";
+			/* SMI interrupt reg */
+			reg = <0x7e600000 0x100>;
+			interrupts = <2 16>;
+			brcm,firmware = <&firmware>;
+			status = "disabled";
+		};
+
+		smi: smi@7e600000 {
+			compatible = "brcm,bcm2835-smi";
+			reg = <0x7e600000 0x100>;
+			interrupts = <2 16>;
+			clocks = <&clocks BCM2835_CLOCK_SMI>;
+			assigned-clocks = <&clocks BCM2835_CLOCK_SMI>;
+			assigned-clock-rates = <125000000>;
+			dmas = <&dma 4>;
+			dma-names = "rx-tx";
+			status = "disabled";
+		};
+
+		pixelvalve2: pixelvalve@7e807000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		hdmi@7e902000 { /* hdmi */
+			status = "disabled";
+		};
+
+		usb@7e980000 { /* usb */
+			compatible = "brcm,bcm2708-usb";
+			reg = <0x7e980000 0x10000>,
+			      <0x7e006000 0x1000>;
+			interrupts = <2 0>,
+				     <1 9>;
+		};
+
+		v3d@7ec00000 { /* vd3 */
+			compatible = "brcm,vc4-v3d";
+			power-domains = <&power RPI_POWER_DOMAIN_V3D>;
+			status = "disabled";
+		};
+
+		axiperf: axiperf {
+			compatible = "brcm,bcm2835-axiperf";
+			reg = <0x7e009800 0x100>,
+			      <0x7ee08000 0x100>;
+			firmware = <&firmware>;
+			status = "disabled";
+		};
+	};
+
+	vdd_5v0_reg: fixedregulator_5v0 {
+		compatible = "regulator-fixed";
+		regulator-name = "5v0";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-always-on;
+	};
+
+	vdd_3v3_reg: fixedregulator_3v3 {
+		compatible = "regulator-fixed";
+		regulator-name = "3v3";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-always-on;
+	};
+};
+
+&vc4 {
+	status = "disabled";
+};
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
new file mode 100644
index 0000000000000..7821483f7d505
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -0,0 +1,183 @@
+/dts-v1/;
+
+#include "bcm2710.dtsi"
+#include "bcm283x-rpi-lan7515.dtsi"
+
+/ {
+	compatible = "raspberrypi,3-model-b-plus", "brcm,bcm2837";
+	model = "Raspberry Pi 3 Model B+";
+
+	chosen {
+		bootargs = "8250.nr_uarts=1";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins =     <34 35 36 37 38 39>;
+		brcm,function = <7>; // alt3 = SD1
+		brcm,pull =     <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = <43>;
+		brcm,function = <4>; /* alt0:GPCLK2 */
+		brcm,pull = <0>;
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <32 33>;
+		brcm,function = <7>; /* alt3=UART0 */
+		brcm,pull = <0 2>;
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 41>;
+		brcm,function = <4>;
+	};
+};
+
+&mmc {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	non-removable;
+	bus-width = <4>;
+	status = "okay";
+	brcm,overclock-50 = <0>;
+};
+
+&soc {
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 29 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "default-on";
+		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
new file mode 100644
index 0000000000000..3f84e2af8c25a
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -0,0 +1,191 @@
+/dts-v1/;
+
+#include "bcm2710.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
+
+/ {
+	compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
+	model = "Raspberry Pi 3 Model B";
+
+	chosen {
+		bootargs = "8250.nr_uarts=1";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins =     <34 35 36 37 38 39>;
+		brcm,function = <7>; // alt3 = SD1
+		brcm,pull =     <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = <43>;
+		brcm,function = <4>; /* alt0:GPCLK2 */
+		brcm,pull = <0>;
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <32 33>;
+		brcm,function = <7>; /* alt3=UART0 */
+		brcm,pull = <0 2>;
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 41>;
+		brcm,function = <4>;
+	};
+};
+
+&mmc {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	non-removable;
+	bus-width = <4>;
+	status = "okay";
+	brcm,overclock-50 = <0>;
+};
+
+&soc {
+	virtgpio: virtgpio {
+		compatible = "brcm,bcm2835-virtgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&virtgpio 0 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&expgpio 7 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&expgpio 4 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
new file mode 100644
index 0000000000000..2500641c14dc3
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -0,0 +1,129 @@
+/dts-v1/;
+
+#include "bcm2710.dtsi"
+
+/ {
+	model = "Raspberry Pi Compute Module 3";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins;
+		brcm,function;
+	};
+};
+
+&soc {
+	virtgpio: virtgpio {
+		compatible = "brcm,bcm2835-virtgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&virtgpio 0 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2710.dtsi b/arch/arm/boot/dts/bcm2710.dtsi
new file mode 100644
index 0000000000000..56d58f588203c
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710.dtsi
@@ -0,0 +1,29 @@
+#include "bcm2837.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	compatible = "brcm,bcm2837", "brcm,bcm2836";
+
+	soc {
+
+		arm-pmu {
+#ifdef RPI364
+			compatible = "arm,armv8-pmuv3", "arm,cortex-a7-pmu";
+#else
+			compatible = "arm,cortex-a7-pmu";
+#endif
+			interrupt-parent = <&local_intc>;
+			interrupts = <9 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		/delete-node/ timer@7e003000;
+	};
+
+	__overrides__ {
+		arm_freq = <&cpu0>, "clock-frequency:0",
+		       <&cpu1>, "clock-frequency:0",
+		       <&cpu2>, "clock-frequency:0",
+		       <&cpu3>, "clock-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index cb2d6d78a7fbf..c481eab1bd7c0 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -32,7 +32,7 @@
 
 		mailbox@7e00b840 {
 			compatible = "brcm,bcm2835-vchiq";
-			reg = <0x7e00b840 0xf>;
+			reg = <0x7e00b840 0x3c>;
 			interrupts = <0 2>;
 		};
 	};
diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
index 9403da0990d07..76039f81f17f3 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
@@ -21,7 +21,24 @@
 			ethernet: ethernet@1 {
 				compatible = "usb424,7800";
 				reg = <1>;
+				microchip,eee-enabled;
+				microchip,tx-lpi-timer = <600>; /* non-aggressive*/
+				/*
+				 * led0 = 1:link1000/activity
+				 * led1 = 6:link10/100/activity
+				 */
+				microchip,led-modes = <1 6>;
 			};
 		};
 	};
 };
+
+
+/ {
+	__overrides__ {
+		eee = <&ethernet>,"microchip,eee-enabled?";
+		tx_lpi_timer = <&ethernet>,"microchip,tx-lpi-timer:0";
+		eth_led0 = <&ethernet>,"microchip,led-modes:0";
+		eth_led1 = <&ethernet>,"microchip,led-modes:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
new file mode 100644
index 0000000000000..d9439370d7eda
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -0,0 +1,145 @@
+# Overlays for the Raspberry Pi platform
+
+dtbo-$(CONFIG_ARCH_BCM2835) += \
+	adau1977-adc.dtbo \
+	adau7002-simple.dtbo \
+	ads1015.dtbo \
+	ads1115.dtbo \
+	ads7846.dtbo \
+	akkordion-iqdacplus.dtbo \
+	allo-boss-dac-pcm512x-audio.dtbo \
+	allo-digione.dtbo \
+	allo-katana-dac-audio.dtbo \
+	allo-piano-dac-pcm512x-audio.dtbo \
+	allo-piano-dac-plus-pcm512x-audio.dtbo \
+	applepi-dac.dtbo \
+	at86rf233.dtbo \
+	audioinjector-addons.dtbo \
+	audioinjector-wm8731-audio.dtbo \
+	audremap.dtbo \
+	balena-fin.dtbo \
+	bmp085_i2c-sensor.dtbo \
+	dht11.dtbo \
+	dionaudio-loco.dtbo \
+	dionaudio-loco-v2.dtbo \
+	dpi18.dtbo \
+	dpi24.dtbo \
+	dwc-otg.dtbo \
+	dwc2.dtbo \
+	enc28j60.dtbo \
+	enc28j60-spi2.dtbo \
+	exc3000.dtbo \
+	fe-pi-audio.dtbo \
+	goodix.dtbo \
+	googlevoicehat-soundcard.dtbo \
+	gpio-ir.dtbo \
+	gpio-ir-tx.dtbo \
+	gpio-key.dtbo \
+	gpio-no-irq.dtbo \
+	gpio-poweroff.dtbo \
+	gpio-shutdown.dtbo \
+	hifiberry-amp.dtbo \
+	hifiberry-dac.dtbo \
+	hifiberry-dacplus.dtbo \
+	hifiberry-digi.dtbo \
+	hifiberry-digi-pro.dtbo \
+	hy28a.dtbo \
+	hy28b.dtbo \
+	i2c-bcm2708.dtbo \
+	i2c-gpio.dtbo \
+	i2c-mux.dtbo \
+	i2c-pwm-pca9685a.dtbo \
+	i2c-rtc.dtbo \
+	i2c-rtc-gpio.dtbo \
+	i2c-sensor.dtbo \
+	i2c0-bcm2708.dtbo \
+	i2c1-bcm2708.dtbo \
+	i2s-gpio28-31.dtbo \
+	iqaudio-dac.dtbo \
+	iqaudio-dacplus.dtbo \
+	iqaudio-digi-wm8804-audio.dtbo \
+	jedec-spi-nor.dtbo \
+	justboom-dac.dtbo \
+	justboom-digi.dtbo \
+	lirc-rpi.dtbo \
+	ltc294x.dtbo \
+	mbed-dac.dtbo \
+	mcp23017.dtbo \
+	mcp23s17.dtbo \
+	mcp2515-can0.dtbo \
+	mcp2515-can1.dtbo \
+	mcp3008.dtbo \
+	mcp3202.dtbo \
+	media-center.dtbo \
+	midi-uart0.dtbo \
+	midi-uart1.dtbo \
+	mmc.dtbo \
+	mpu6050.dtbo \
+	mz61581.dtbo \
+	papirus.dtbo \
+	pi3-act-led.dtbo \
+	pi3-disable-bt.dtbo \
+	pi3-disable-wifi.dtbo \
+	pi3-miniuart-bt.dtbo \
+	pibell.dtbo \
+	piscreen.dtbo \
+	piscreen2r.dtbo \
+	pisound.dtbo \
+	pitft22.dtbo \
+	pitft28-capacitive.dtbo \
+	pitft28-resistive.dtbo \
+	pitft35-resistive.dtbo \
+	pps-gpio.dtbo \
+	pwm.dtbo \
+	pwm-2chan.dtbo \
+	pwm-ir-tx.dtbo \
+	qca7000.dtbo \
+	rotary-encoder.dtbo \
+	rpi-backlight.dtbo \
+	rpi-cirrus-wm5102.dtbo \
+	rpi-dac.dtbo \
+	rpi-display.dtbo \
+	rpi-ft5406.dtbo \
+	rpi-proto.dtbo \
+	rpi-sense.dtbo \
+	rpi-tv.dtbo \
+	rra-digidac1-wm8741-audio.dtbo \
+	sc16is750-i2c.dtbo \
+	sc16is752-i2c.dtbo \
+	sc16is752-spi1.dtbo \
+	sdhost.dtbo \
+	sdio.dtbo \
+	sdio-1bit.dtbo \
+	sdtweak.dtbo \
+	smi.dtbo \
+	smi-dev.dtbo \
+	smi-nand.dtbo \
+	spi-gpio35-39.dtbo \
+	spi-rtc.dtbo \
+	spi0-cs.dtbo \
+	spi0-hw-cs.dtbo \
+	spi1-1cs.dtbo \
+	spi1-2cs.dtbo \
+	spi1-3cs.dtbo \
+	spi2-1cs.dtbo \
+	spi2-2cs.dtbo \
+	spi2-3cs.dtbo \
+	superaudioboard.dtbo \
+	sx150x.dtbo \
+	tinylcd35.dtbo \
+	uart0.dtbo \
+	uart1.dtbo \
+	upstream.dtbo \
+	upstream-aux-interrupt.dtbo \
+	vc4-fkms-v3d.dtbo \
+	vc4-kms-v3d.dtbo \
+	vga666.dtbo \
+	w1-gpio.dtbo \
+	w1-gpio-pullup.dtbo \
+	wittypi.dtbo
+
+targets += dtbs dtbs_install
+targets += $(dtbo-y)
+
+always		:= $(dtbo-y)
+clean-files	:= *.dtbo
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
new file mode 100644
index 0000000000000..61bfe29cfb8f4
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/README
@@ -0,0 +1,1952 @@
+Introduction
+============
+
+This directory contains Device Tree overlays. Device Tree makes it possible
+to support many hardware configurations with a single kernel and without the
+need to explicitly load or blacklist kernel modules. Note that this isn't a
+"pure" Device Tree configuration (c.f. MACH_BCM2835) - some on-board devices
+are still configured by the board support code, but the intention is to
+eventually reach that goal.
+
+On Raspberry Pi, Device Tree usage is controlled from /boot/config.txt. By
+default, the Raspberry Pi kernel boots with device tree enabled. You can
+completely disable DT usage (for now) by adding:
+
+    device_tree=
+
+to your config.txt, which should cause your Pi to revert to the old way of
+doing things after a reboot.
+
+In /boot you will find a .dtb for each base platform. This describes the
+hardware that is part of the Raspberry Pi board. The loader (start.elf and its
+siblings) selects the .dtb file appropriate for the platform by name, and reads
+it into memory. At this point, all of the optional interfaces (i2c, i2s, spi)
+are disabled, but they can be enabled using Device Tree parameters:
+
+    dtparam=i2c=on,i2s=on,spi=on
+
+However, this shouldn't be necessary in many use cases because loading an
+overlay that requires one of those interfaces will cause it to be enabled
+automatically, and it is advisable to only enable interfaces if they are
+needed.
+
+Configuring additional, optional hardware is done using Device Tree overlays
+(see below).
+
+GPIO numbering uses the hardware pin numbering scheme (aka BCM scheme) and
+not the physical pin numbers.
+
+raspi-config
+============
+
+The Advanced Options section of the raspi-config utility can enable and disable
+Device Tree use, as well as toggling the I2C and SPI interfaces. Note that it
+is possible to both enable an interface and blacklist the driver, if for some
+reason you should want to defer the loading.
+
+Modules
+=======
+
+As well as describing the hardware, Device Tree also gives enough information
+to allow suitable driver modules to be located and loaded, with the corollary
+that unneeded modules are not loaded. As a result it should be possible to
+remove lines from /etc/modules, and /etc/modprobe.d/raspi-blacklist.conf can
+have its contents deleted (or commented out).
+
+Using Overlays
+==============
+
+Overlays are loaded using the "dtoverlay" directive. As an example, consider
+the popular lirc-rpi module, the Linux Infrared Remote Control driver. In the
+pre-DT world this would be loaded from /etc/modules, with an explicit
+"modprobe lirc-rpi" command, or programmatically by lircd. With DT enabled,
+this becomes a line in config.txt:
+
+    dtoverlay=lirc-rpi
+
+This causes the file /boot/overlays/lirc-rpi.dtbo to be loaded. By
+default it will use GPIOs 17 (out) and 18 (in), but this can be modified using
+DT parameters:
+
+    dtoverlay=lirc-rpi,gpio_out_pin=17,gpio_in_pin=13
+
+Parameters always have default values, although in some cases (e.g. "w1-gpio")
+it is necessary to provided multiple overlays in order to get the desired
+behaviour. See the list of overlays below for a description of the parameters
+and their defaults.
+
+The Overlay and Parameter Reference
+===================================
+
+N.B. When editing this file, please preserve the indentation levels to make it
+simple to parse programmatically. NO HARD TABS.
+
+
+Name:   <The base DTB>
+Info:   Configures the base Raspberry Pi hardware
+Load:   <loaded automatically>
+Params:
+        audio                   Set to "on" to enable the onboard ALSA audio
+                                interface (default "off")
+
+        eee                     Enable Energy Efficient Ethernet support for
+                                compatible devices (default "on"). See also
+                                "tx_lpi_timer".
+
+        eth_led0                Set mode of LED0 (usually orange) (default
+                                "1"). The legal values are:
+                                0=link/activity          1=link1000/activity
+                                2=link100/activity       3=link10/activity
+                                4=link100/1000/activity  5=link10/1000/activity
+                                6=link10/100/activity    14=off    15=on
+
+        eth_led1                Set mode of LED1 (usually green) (default
+                                "6"). See eth_led0 for legal values.
+
+        i2c_arm                 Set to "on" to enable the ARM's i2c interface
+                                (default "off")
+
+        i2c_vc                  Set to "on" to enable the i2c interface
+                                usually reserved for the VideoCore processor
+                                (default "off")
+
+        i2c                     An alias for i2c_arm
+
+        i2c_arm_baudrate        Set the baudrate of the ARM's i2c interface
+                                (default "100000")
+
+        i2c_vc_baudrate         Set the baudrate of the VideoCore i2c interface
+                                (default "100000")
+
+        i2c_baudrate            An alias for i2c_arm_baudrate
+
+        i2s                     Set to "on" to enable the i2s interface
+                                (default "off")
+
+        spi                     Set to "on" to enable the spi interfaces
+                                (default "off")
+
+        random                  Set to "on" to enable the hardware random
+                                number generator (default "on")
+
+        sd_overclock            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+        sd_force_pio            Disable DMA support for SD driver (default off)
+
+        sd_pio_limit            Number of blocks above which to use DMA for
+                                SD card (default 1)
+
+        sd_debug                Enable debug output from SD driver (default off)
+
+        sdio_overclock          Clock (in MHz) to use when the MMC framework
+                                requests 50MHz for the SDIO/WiFi interface.
+
+        tx_lpi_timer            Set the delay in microseconds between going idle
+                                and entering the low power state (default 600).
+                                Requires EEE to be enabled - see "eee".
+
+        uart0                   Set to "off" to disable uart0 (default "on")
+
+        uart1                   Set to "on" or "off" to enable or disable uart1
+                                (default varies)
+
+        watchdog                Set to "on" to enable the hardware watchdog
+                                (default "off")
+
+        act_led_trigger         Choose which activity the LED tracks.
+                                Use "heartbeat" for a nice load indicator.
+                                (default "mmc")
+
+        act_led_activelow       Set to "on" to invert the sense of the LED
+                                (default "off")
+                                N.B. For Pi3 see pi3-act-led overlay.
+
+        act_led_gpio            Set which GPIO to use for the activity LED
+                                (in case you want to connect it to an external
+                                device)
+                                (default "16" on a non-Plus board, "47" on a
+                                Plus or Pi 2)
+                                N.B. For Pi3 see pi3-act-led overlay.
+
+        pwr_led_trigger
+        pwr_led_activelow
+        pwr_led_gpio
+                                As for act_led_*, but using the PWR LED.
+                                Not available on Model A/B boards.
+
+        N.B. It is recommended to only enable those interfaces that are needed.
+        Leaving all interfaces enabled can lead to unwanted behaviour (i2c_vc
+        interfering with Pi Camera, I2S and SPI hogging GPIO pins, etc.)
+        Note also that i2c, i2c_arm and i2c_vc are aliases for the physical
+        interfaces i2c0 and i2c1. Use of the numeric variants is still possible
+        but deprecated because the ARM/VC assignments differ between board
+        revisions. The same board-specific mapping applies to i2c_baudrate,
+        and the other i2c baudrate parameters.
+
+
+Name:   adau1977-adc
+Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
+        and I2S for data.
+Load:   dtoverlay=adau1977-adc
+Params: <None>
+
+
+Name:   adau7002-simple
+Info:   Overlay for the activation of ADAU7002 stereo PDM to I2S converter.
+Load:   dtoverlay=adau7002-simple,<param>=<val>
+Params: card-name               Override the default, "adau7002", card name.
+
+
+Name:   ads1015
+Info:   Overlay for activation of Texas Instruments ADS1015 ADC over I2C
+Load:   dtoverlay=ads1015,<param>=<val>
+Params: addr                    I2C bus address of device. Set based on how the
+                                addr pin is wired. (default=0x48 assumes addr
+                                is pulled to GND)
+        cha_enable              Enable virtual channel a. (default=true)
+        cha_cfg                 Set the configuration for virtual channel a.
+                                (default=4 configures this channel for the
+                                voltage at A0 with respect to GND)
+        cha_datarate            Set the datarate (samples/sec) for this channel.
+                                (default=4 sets 1600 sps)
+        cha_gain                Set the gain of the Programmable Gain
+                                Amplifier for this channel. (default=2 sets the
+                                full scale of the channel to 2.048 Volts)
+
+        Channel (ch) parameters can be set for each enabled channel.
+        A maximum of 4 channels can be enabled (letters a thru d).
+        For more information refer to the device datasheet at:
+        http://www.ti.com/lit/ds/symlink/ads1015.pdf
+
+
+Name:   ads1115
+Info:   Texas Instruments ADS1115 ADC
+Load:   dtoverlay=ads1115,<param>[=<val>]
+Params: addr                    I2C bus address of device. Set based on how the
+                                addr pin is wired. (default=0x48 assumes addr
+                                is pulled to GND)
+        cha_enable              Enable virtual channel a.
+        cha_cfg                 Set the configuration for virtual channel a.
+                                (default=4 configures this channel for the
+                                voltage at A0 with respect to GND)
+        cha_datarate            Set the datarate (samples/sec) for this channel.
+                                (default=7 sets 860 sps)
+        cha_gain                Set the gain of the Programmable Gain
+                                Amplifier for this channel. (Default 1 sets the
+                                full scale of the channel to 4.096 Volts)
+
+        Channel parameters can be set for each enabled channel.
+        A maximum of 4 channels can be enabled (letters a thru d).
+        For more information refer to the device datasheet at:
+        http://www.ti.com/lit/ds/symlink/ads1115.pdf
+
+
+Name:   ads7846
+Info:   ADS7846 Touch controller
+Load:   dtoverlay=ads7846,<param>=<val>
+Params: cs                      SPI bus Chip Select (default 1)
+        speed                   SPI bus speed (default 2MHz, max 3.25MHz)
+        penirq                  GPIO used for PENIRQ. REQUIRED
+        penirq_pull             Set GPIO pull (default 0=none, 2=pullup)
+        swapxy                  Swap x and y axis
+        xmin                    Minimum value on the X axis (default 0)
+        ymin                    Minimum value on the Y axis (default 0)
+        xmax                    Maximum value on the X axis (default 4095)
+        ymax                    Maximum value on the Y axis (default 4095)
+        pmin                    Minimum reported pressure value (default 0)
+        pmax                    Maximum reported pressure value (default 65535)
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+                                (default 400)
+
+        penirq is required and usually xohms (60-100) has to be set as well.
+        Apart from that, pmax (255) and swapxy are also common.
+        The rest of the calibration can be done with xinput-calibrator.
+        See: github.com/notro/fbtft/wiki/FBTFT-on-Raspian
+        Device Tree binding document:
+        www.kernel.org/doc/Documentation/devicetree/bindings/input/ads7846.txt
+
+
+Name:   akkordion-iqdacplus
+Info:   Configures the Digital Dreamtime Akkordion Music Player (based on the
+        OEM IQAudIO DAC+ or DAC Zero module).
+Load:   dtoverlay=akkordion-iqdacplus,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                dtoverlay=akkordion-iqdacplus,24db_digital_gain
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   allo-boss-dac-pcm512x-audio
+Info:   Configures the Allo Boss DAC audio cards.
+Load:   dtoverlay=allo-boss-dac-pcm512x-audio,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=allo-boss-dac-pcm512x-audio,
+                                24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        slave                   Force Boss DAC into slave mode, using Pi a
+                                master for bit clock and frame clock. Enable
+                                with "dtoverlay=allo-boss-dac-pcm512x-audio,
+                                slave"
+
+
+Name:   allo-digione
+Info:   Configures the Allo Digione audio card
+Load:   dtoverlay=allo-digione
+Params: <None>
+
+
+Name:   allo-katana-dac-audio
+Info:   Configures the Allo Katana DAC audio card
+Load:   dtoverlay=allo-katana-dac-audio
+Params: <None>
+
+
+Name:   allo-piano-dac-pcm512x-audio
+Info:   Configures the Allo Piano DAC (2.0/2.1) audio cards.
+        (NB. This initial support is for 2.0 channel audio ONLY! ie. stereo.
+        The subwoofer outputs on the Piano 2.1 are not currently supported!)
+Load:   dtoverlay=allo-piano-dac-pcm512x-audio,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control.
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   allo-piano-dac-plus-pcm512x-audio
+Info:   Configures the Allo Piano DAC (2.1) audio cards.
+Load:   dtoverlay=allo-piano-dac-plus-pcm512x-audio,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control.
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        glb_mclk                This option is only with Kali board. If enabled,
+                                MCLK for Kali is used and PLL is disabled for
+                                better voice quality. (default Off)
+
+
+Name:   applepi-dac
+Info:   Configures the Orchard Audio ApplePi-DAC audio card
+Load:   dtoverlay=applepi-dac
+Params: <None>
+
+
+Name:   at86rf233
+Info:   Configures the Atmel AT86RF233 802.15.4 low-power WPAN transceiver,
+        connected to spi0.0
+Load:   dtoverlay=at86rf233,<param>=<val>
+Params: interrupt               GPIO used for INT (default 23)
+        reset                   GPIO used for Reset (default 24)
+        sleep                   GPIO used for Sleep (default 25)
+        speed                   SPI bus speed in Hz (default 3000000)
+        trim                    Fine tuning of the internal capacitance
+                                arrays (0=+0pF, 15=+4.5pF, default 15)
+
+
+Name:   audioinjector-addons
+Info:   Configures the audioinjector.net audio add on soundcards
+Load:   dtoverlay=audioinjector-addons,<param>=<val>
+Params: non-stop-clocks         Keeps the clocks running even when the stream
+                                is paused or stopped (default off)
+
+
+Name:   audioinjector-wm8731-audio
+Info:   Configures the audioinjector.net audio add on soundcard
+Load:   dtoverlay=audioinjector-wm8731-audio
+Params: <None>
+
+
+Name:   audremap
+Info:   Switches PWM sound output to pins 12 (Right) & 13 (Left)
+Load:   dtoverlay=audremap,<param>=<val>
+Params: swap_lr                 Reverse the channel allocation, which will also
+                                swap the audio jack outputs (default off)
+        enable_jack             Don't switch off the audio jack output
+                                (default off)
+
+
+Name:   balena-fin
+Info:   Overlay that enables WiFi, Bluetooth and the GPIO expander on the
+        Balena Fin board.
+Load:   dtoverlay=balena-fin
+Params: <None>
+
+
+Name:   bmp085_i2c-sensor
+Info:   This overlay is now deprecated - see i2c-sensor
+Load:   dtoverlay=bmp085_i2c-sensor
+Params: <None>
+
+
+Name:   dht11
+Info:   Overlay for the DHT11/DHT21/DHT22 humidity/temperature sensors
+        Also sometimes found with the part number(s) AM230x.
+Load:   dtoverlay=dht11,<param>=<val>
+Params: gpiopin                 GPIO connected to the sensor's DATA output.
+                                (default 4)
+
+
+Name:   dionaudio-loco
+Info:   Configures the Dion Audio LOCO DAC-AMP
+Load:   dtoverlay=dionaudio-loco
+Params: <None>
+
+
+Name:   dionaudio-loco-v2
+Info:   Configures the Dion Audio LOCO-V2 DAC-AMP
+Load:   dtoverlay=dionaudio-loco-v2,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   dpi18
+Info:   Overlay for a generic 18-bit DPI display
+        This uses GPIOs 0-21 (so no I2C, uart etc.), and activates the output
+        2-3 seconds after the kernel has started.
+Load:   dtoverlay=dpi18
+Params: <None>
+
+
+Name:   dpi24
+Info:   Overlay for a generic 24-bit DPI display
+        This uses GPIOs 0-27 (so no I2C, uart etc.), and activates the output
+        2-3 seconds after the kernel has started.
+Load:   dtoverlay=dpi24
+Params: <None>
+
+
+Name:   dwc-otg
+Info:   Selects the dwc_otg USB controller driver which has fiq support. This
+        is the default on all except the Pi Zero which defaults to dwc2.
+Load:   dtoverlay=dwc-otg
+Params: <None>
+
+
+Name:   dwc2
+Info:   Selects the dwc2 USB controller driver
+Load:   dtoverlay=dwc2,<param>=<val>
+Params: dr_mode                 Dual role mode: "host", "peripheral" or "otg"
+
+        g-rx-fifo-size          Size of rx fifo size in gadget mode
+
+        g-np-tx-fifo-size       Size of non-periodic tx fifo size in gadget
+                                mode
+
+
+[ The ds1307-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+Name:   enc28j60
+Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI0
+Load:   dtoverlay=enc28j60,<param>=<val>
+Params: int_pin                 GPIO used for INT (default 25)
+
+        speed                   SPI bus speed (default 12000000)
+
+
+Name:   enc28j60-spi2
+Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI2
+Load:   dtoverlay=enc28j60-spi2,<param>=<val>
+Params: int_pin                 GPIO used for INT (default 39)
+
+        speed                   SPI bus speed (default 12000000)
+
+
+Name:   exc3000
+Info:   Enables I2C connected EETI EXC3000 multiple touch controller using
+        GPIO 4 (pin 7 on GPIO header) for interrupt.
+Load:   dtoverlay=exc3000,<param>=<val>
+Params: interrupt               GPIO used for interrupt (default 4)
+        sizex                   Touchscreen size x (default 4096)
+        sizey                   Touchscreen size y (default 4096)
+        invx                    Touchscreen inverted x axis
+        invy                    Touchscreen inverted y axis
+        swapxy                  Touchscreen swapped x y axis
+
+
+Name:   fe-pi-audio
+Info:   Configures the Fe-Pi Audio Sound Card
+Load:   dtoverlay=fe-pi-audio
+Params: <None>
+
+
+Name:   goodix
+Info:   Enables I2C connected Goodix gt9271 multiple touch controller using
+        GPIOs 4 and 17 (pins 7 and 11 on GPIO header) for interrupt and reset.
+Load:   dtoverlay=goodix,<param>=<val>
+Params: interrupt               GPIO used for interrupt (default 4)
+        reset                   GPIO used for reset (default 17)
+
+
+Name:   googlevoicehat-soundcard
+Info:   Configures the Google voiceHAT soundcard
+Load:   dtoverlay=googlevoicehat-soundcard
+Params: <None>
+
+
+Name:   gpio-ir
+Info:   Use GPIO pin as rc-core style infrared receiver input. The rc-core-
+        based gpio_ir_recv driver maps received keys directly to a
+        /dev/input/event* device, all decoding is done by the kernel - LIRC is
+        not required! The key mapping and other decoding parameters can be
+        configured by "ir-keytable" tool.
+Load:   dtoverlay=gpio-ir,<param>=<val>
+Params: gpio_pin                Input pin number. Default is 18.
+
+        gpio_pull               Desired pull-up/down state (off, down, up)
+                                Default is "down".
+
+        rc-map-name             Default rc keymap (can also be changed by
+                                ir-keytable), defaults to "rc-rc6-mce"
+
+
+Name:   gpio-ir-tx
+Info:   Use GPIO pin as bit-banged infrared transmitter output.
+        This is an alternative to "pwm-ir-tx". gpio-ir-tx doesn't require
+        a PWM so it can be used together with onboard analog audio.
+Load:   dtoverlay=gpio-ir-tx,<param>=<val>
+Params: gpio_pin                Output GPIO (default 18)
+
+        invert                  "1" = invert the output (make it active-low).
+                                Default is "0" (active-high).
+
+
+Name:   gpio-key
+Info:   This is a generic overlay for activating GPIO keypresses using
+        the gpio-keys library and this dtoverlay. Multiple keys can be
+        set up using multiple calls to the overlay for configuring
+        additional buttons or joysticks. You can see available keycodes
+        at https://github.com/torvalds/linux/blob/v4.12/include/uapi/
+        linux/input-event-codes.h#L64
+Load:   dtoverlay=gpio-key,<param>=<val>
+Params: gpio                    GPIO pin to trigger on (default 3)
+        active_low              When this is 1 (active low), a falling
+                                edge generates a key down event and a
+                                rising edge generates a key up event.
+                                When this is 0 (active high), this is
+                                reversed. The default is 1 (active low)
+        gpio_pull               Desired pull-up/down state (off, down, up)
+                                Default is "up". Note that the default pin
+                                (GPIO3) has an external pullup
+        label                   Set a label for the key
+        keycode                 Set the key code for the button
+
+
+Name:   gpio-no-irq
+Info:   Use this overlay to disable all GPIO interrupts, which can be useful
+        for user-space GPIO edge detection systems.
+Load:   dtoverlay=gpio-no-irq
+Params: <None>
+
+
+Name:   gpio-poweroff
+Info:   Drives a GPIO high or low on poweroff (including halt). Enabling this
+        overlay will prevent the ability to boot by driving GPIO3 low.
+Load:   dtoverlay=gpio-poweroff,<param>=<val>
+Params: gpiopin                 GPIO for signalling (default 26)
+
+        active_low              Set if the power control device requires a
+                                high->low transition to trigger a power-down.
+                                Note that this will require the support of a
+                                custom dt-blob.bin to prevent a power-down
+                                during the boot process, and that a reboot
+                                will also cause the pin to go low.
+        input                   Set if the gpio pin should be configured as
+                                an input.
+        export                  Set to export the configured pin to sysfs
+
+
+Name:   gpio-shutdown
+Info:   Initiates a shutdown when GPIO pin changes. The given GPIO pin
+        is configured as an input key that generates KEY_POWER events.
+        This event is handled by systemd-logind by initiating a
+        shutdown. Systemd versions older than 225 need an udev rule
+        enable listening to the input device:
+
+                ACTION!="REMOVE", SUBSYSTEM=="input", KERNEL=="event*", \
+                        SUBSYSTEMS=="platform", DRIVERS=="gpio-keys", \
+                        ATTRS{keys}=="116", TAG+="power-switch"
+
+        This overlay only handles shutdown. After shutdown, the system
+        can be powered up again by driving GPIO3 low. The default
+        configuration uses GPIO3 with a pullup, so if you connect a
+        button between GPIO3 and GND (pin 5 and 6 on the 40-pin header),
+        you get a shutdown and power-up button.
+Load:   dtoverlay=gpio-shutdown,<param>=<val>
+Params: gpio_pin                GPIO pin to trigger on (default 3)
+
+        active_low              When this is 1 (active low), a falling
+                                edge generates a key down event and a
+                                rising edge generates a key up event.
+                                When this is 0 (active high), this is
+                                reversed. The default is 1 (active low).
+
+        gpio_pull               Desired pull-up/down state (off, down, up)
+                                Default is "up".
+
+                                Note that the default pin (GPIO3) has an
+                                external pullup.
+
+
+Name:   hifiberry-amp
+Info:   Configures the HifiBerry Amp and Amp+ audio cards
+Load:   dtoverlay=hifiberry-amp
+Params: <None>
+
+
+Name:   hifiberry-dac
+Info:   Configures the HifiBerry DAC audio card
+Load:   dtoverlay=hifiberry-dac
+Params: <None>
+
+
+Name:   hifiberry-dacplus
+Info:   Configures the HifiBerry DAC+ audio card
+Load:   dtoverlay=hifiberry-dacplus,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        slave                   Force DAC+ Pro into slave mode, using Pi as
+                                master for bit clock and frame clock.
+
+
+Name:   hifiberry-digi
+Info:   Configures the HifiBerry Digi and Digi+ audio card
+Load:   dtoverlay=hifiberry-digi
+Params: <None>
+
+
+Name:   hifiberry-digi-pro
+Info:   Configures the HifiBerry Digi+ Pro audio card
+Load:   dtoverlay=hifiberry-digi-pro
+Params: <None>
+
+
+Name:   hy28a
+Info:   HY28A - 2.8" TFT LCD Display Module by HAOYU Electronics
+        Default values match Texy's display shield
+Load:   dtoverlay=hy28a,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+        resetgpio               GPIO used to reset controller
+
+        ledgpio                 GPIO used to control backlight
+
+
+Name:   hy28b
+Info:   HY28B - 2.8" TFT LCD Display Module by HAOYU Electronics
+        Default values match Texy's display shield
+Load:   dtoverlay=hy28b,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+        resetgpio               GPIO used to reset controller
+
+        ledgpio                 GPIO used to control backlight
+
+
+Name:   i2c-bcm2708
+Info:   Fall back to the i2c_bcm2708 driver for the i2c_arm bus.
+Load:   dtoverlay=i2c-bcm2708
+Params: <None>
+
+
+Name:   i2c-gpio
+Info:   Adds support for software i2c controller on gpio pins
+Load:   dtoverlay=i2c-gpio,<param>=<val>
+Params: i2c_gpio_sda            GPIO used for I2C data (default "23")
+
+        i2c_gpio_scl            GPIO used for I2C clock (default "24")
+
+        i2c_gpio_delay_us       Clock delay in microseconds
+                                (default "2" = ~100kHz)
+
+        bus                     Set to a unique, non-zero value if wanting
+                                multiple i2c-gpio busses. If set, will be used
+                                as the preferred bus number (/dev/i2c-<n>). If
+                                not set, the default value is 0, but the bus
+                                number will be dynamically assigned - probably
+                                3.
+
+
+Name:   i2c-mux
+Info:   Adds support for a number of I2C bus multiplexers on i2c_arm
+Load:   dtoverlay=i2c-mux,<param>=<val>
+Params: pca9542                 Select the NXP PCA9542 device
+
+        pca9545                 Select the NXP PCA9545 device
+
+        pca9548                 Select the NXP PCA9548 device
+
+        addr                    Change I2C address of the device (default 0x70)
+
+
+[ The i2c-mux-pca9548a overlay has been deleted. See i2c-mux. ]
+
+
+Name:   i2c-pwm-pca9685a
+Info:   Adds support for an NXP PCA9685A I2C PWM controller on i2c_arm
+Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
+Params: addr                    I2C address of PCA9685A (default 0x40)
+
+
+Name:   i2c-rtc
+Info:   Adds support for a number of I2C Real Time Clock devices
+Load:   dtoverlay=i2c-rtc,<param>=<val>
+Params: abx80x                  Select one of the ABx80x family:
+                                  AB0801, AB0803, AB0804, AB0805,
+                                  AB1801, AB1803, AB1804, AB1805
+
+        ds1307                  Select the DS1307 device
+
+        ds1339                  Select the DS1339 device
+
+        ds3231                  Select the DS3231 device
+
+        m41t62                  Select the M41T62 device
+
+        mcp7940x                Select the MCP7940x device
+
+        mcp7941x                Select the MCP7941x device
+
+        pcf2127                 Select the PCF2127 device
+
+        pcf8523                 Select the PCF8523 device
+
+        pcf8563                 Select the PCF8563 device
+
+        trickle-diode-type      Diode type for trickle charge - "standard" or
+                                "schottky" (ABx80x only)
+
+        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
+                                ABx80x)
+
+        wakeup-source           Specify that the RTC can be used as a wakeup
+                                source
+
+
+Name:   i2c-rtc-gpio
+Info:   Adds support for a number of I2C Real Time Clock devices
+        using the software i2c controller
+Load:   dtoverlay=i2c-rtc-gpio,<param>=<val>
+Params: abx80x                  Select one of the ABx80x family:
+                                  AB0801, AB0803, AB0804, AB0805,
+                                  AB1801, AB1803, AB1804, AB1805
+
+        ds1307                  Select the DS1307 device
+
+        ds1339                  Select the DS1339 device
+
+        ds3231                  Select the DS3231 device
+
+        mcp7940x                Select the MCP7940x device
+
+        mcp7941x                Select the MCP7941x device
+
+        pcf2127                 Select the PCF2127 device
+
+        pcf8523                 Select the PCF8523 device
+
+        pcf8563                 Select the PCF8563 device
+
+        trickle-diode-type      Diode type for trickle charge - "standard" or
+                                "schottky" (ABx80x only)
+
+        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
+                                ABx80x)
+
+        wakeup-source           Specify that the RTC can be used as a wakeup
+                                source
+
+        i2c_gpio_sda            GPIO used for I2C data (default "23")
+
+        i2c_gpio_scl            GPIO used for I2C clock (default "24")
+
+        i2c_gpio_delay_us       Clock delay in microseconds
+                                (default "2" = ~100kHz)
+
+
+Name:   i2c-sensor
+Info:   Adds support for a number of I2C barometric pressure and temperature
+        sensors on i2c_arm
+Load:   dtoverlay=i2c-sensor,<param>=<val>
+Params: addr                    Set the address for the BME280, BMP280, DS1621,
+                                HDC100X, LM75, SHT3x or TMP102
+
+        bme280                  Select the Bosch Sensortronic BME280
+                                Valid addresses 0x76-0x77, default 0x76
+
+        bmp085                  Select the Bosch Sensortronic BMP085
+
+        bmp180                  Select the Bosch Sensortronic BMP180
+
+        bmp280                  Select the Bosch Sensortronic BMP280
+                                Valid addresses 0x76-0x77, default 0x76
+
+        ds1621                  Select the Dallas Semiconductors DS1621 temp
+                                sensor. Valid addresses 0x48-0x4f, default 0x48
+
+        hdc100x                 Select the Texas Instruments HDC100x temp sensor
+                                Valid addresses 0x40-0x43, default 0x40
+
+        htu21                   Select the HTU21 temperature and humidity sensor
+
+        lm75                    Select the Maxim LM75 temperature sensor
+                                Valid addresses 0x48-0x4f, default 0x4f
+
+        lm75addr                Deprecated - use addr parameter instead
+
+        sht3x                   Select the Sensiron SHT3x temperature and
+                                humidity sensor. Valid addresses 0x44-0x45,
+                                default 0x44
+
+        si7020                  Select the Silicon Labs Si7013/20/21 humidity/
+                                temperature sensor
+
+        tmp102                  Select the Texas Instruments TMP102 temp sensor
+                                Valid addresses 0x48-0x4b, default 0x48
+
+        tsl4531                 Select the AMS TSL4531 digital ambient light
+                                sensor
+
+        veml6070                Select the Vishay VEML6070 ultraviolet light
+                                sensor
+
+
+Name:   i2c0-bcm2708
+Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
+        platforms - platforms other then Compute Modules can only use this
+        to disable transaction combining.
+Load:   dtoverlay=i2c0-bcm2708,<param>=<val>
+Params: sda0_pin                GPIO pin for SDA0 (deprecated - use pins_*)
+        scl0_pin                GPIO pin for SCL0 (deprecated - use pins_*)
+        pins_0_1                Use pins 0 and 1 (default)
+        pins_28_29              Use pins 28 and 29
+        pins_44_45              Use pins 44 and 45
+        pins_46_47              Use pins 46 and 47
+        combine                 Allow transactions to be combined (default
+                                "yes")
+
+
+Name:   i2c1-bcm2708
+Info:   Change i2c1 pin usage. Not all pin combinations are usable on all
+        platforms - platforms other then Compute Modules can only use this
+        to disable transaction combining.
+Info:   Enable the i2c_bcm2708 driver for the i2c1 bus
+Load:   dtoverlay=i2c1-bcm2708,<param>=<val>
+Params: sda1_pin                GPIO pin for SDA1 (2 or 44 - default 2)
+        scl1_pin                GPIO pin for SCL1 (3 or 45 - default 3)
+        pin_func                Alternative pin function (4 (alt0), 6 (alt2) -
+                                default 4)
+        combine                 Allow transactions to be combined (default
+                                "yes")
+
+
+Name:   i2s-gpio28-31
+Info:   move I2S function block to GPIO 28 to 31
+Load:   dtoverlay=i2s-gpio28-31
+Params: <None>
+
+
+Name:   iqaudio-dac
+Info:   Configures the IQaudio DAC audio card
+Load:   dtoverlay=iqaudio-dac,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=iqaudio-dac,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   iqaudio-dacplus
+Info:   Configures the IQaudio DAC+ audio card
+Load:   dtoverlay=iqaudio-dacplus,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=iqaudio-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        auto_mute_amp           If specified, unmute/mute the IQaudIO amp when
+                                starting/stopping audio playback.
+        unmute_amp              If specified, unmute the IQaudIO amp once when
+                                the DAC driver module loads.
+
+
+Name:   iqaudio-digi-wm8804-audio
+Info:   Configures the IQAudIO Digi WM8804 audio card
+Load:   dtoverlay=iqaudio-digi-wm8804-audio,<param>=<val>
+Params: card_name               Override the default, "IQAudIODigi", card name.
+        dai_name                Override the default, "IQAudIO Digi", dai name.
+        dai_stream_name         Override the default, "IQAudIO Digi HiFi",
+                                dai stream name.
+
+
+Name:   jedec-spi-nor
+Info:   Adds support for JEDEC-compliant SPI NOR flash devices.  (Note: The
+        "jedec,spi-nor" kernel driver was formerly known as "m25p80".)
+Load:   dtoverlay=jedec-spi-nor,<param>=<val>
+Params: flash-spi<n>-<m>        Enables flash device on SPI<n>, CS#<m>.
+        flash-fastr-spi<n>-<m>  Enables flash device with fast read capability
+                                on SPI<n>, CS#<m>.
+
+
+Name:   justboom-dac
+Info:   Configures the JustBoom DAC HAT, Amp HAT, DAC Zero and Amp Zero audio
+        cards
+Load:   dtoverlay=justboom-dac,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=justboom-dac,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   justboom-digi
+Info:   Configures the JustBoom Digi HAT and Digi Zero audio cards
+Load:   dtoverlay=justboom-digi
+Params: <None>
+
+
+Name:   lirc-rpi
+Info:   Configures lirc-rpi (Linux Infrared Remote Control for Raspberry Pi)
+        Consult the module documentation for more details.
+Load:   dtoverlay=lirc-rpi,<param>=<val>
+Params: gpio_out_pin            GPIO for output (default "17")
+
+        gpio_in_pin             GPIO for input (default "18")
+
+        gpio_in_pull            Pull up/down/off on the input pin
+                                (default "down")
+
+        sense                   Override the IR receive auto-detection logic:
+                                 "0" = force active-high
+                                 "1" = force active-low
+                                 "-1" = use auto-detection
+                                (default "-1")
+
+        softcarrier             Turn the software carrier "on" or "off"
+                                (default "on")
+
+        invert                  "on" = invert the output pin (default "off")
+
+        debug                   "on" = enable additional debug messages
+                                (default "off")
+
+
+Name:   ltc294x
+Info:   Adds support for the ltc294x family of battery gauges
+Load:   dtoverlay=ltc294x,<param>=<val>
+Params: ltc2941                 Select the ltc2941 device
+
+        ltc2942                 Select the ltc2942 device
+
+        ltc2943                 Select the ltc2943 device
+
+        ltc2944                 Select the ltc2944 device
+
+        resistor-sense          The sense resistor value in milli-ohms.
+                                Can be a 32-bit negative value when the battery
+                                has been connected to the wrong end of the
+                                resistor.
+
+        prescaler-exponent      Range and accuracy of the gauge. The value is
+                                programmed into the chip only if it differs
+                                from the current setting.
+                                For LTC2941 only:
+                                - Default value is 128
+                                - the exponent is in the range 0-7 (default 7)
+                                See the datasheet for more information.
+
+
+Name:   mbed-dac
+Info:   Configures the mbed AudioCODEC (TLV320AIC23B)
+Load:   dtoverlay=mbed-dac
+Params: <None>
+
+
+Name:   mcp23017
+Info:   Configures the MCP23017 I2C GPIO expander
+Load:   dtoverlay=mcp23017,<param>=<val>
+Params: gpiopin                 Gpio pin connected to the INTA output of the
+                                MCP23017 (default: 4)
+
+        addr                    I2C address of the MCP23017 (default: 0x20)
+
+
+Name:   mcp23s17
+Info:   Configures the MCP23S08/17 SPI GPIO expanders.
+        If devices are present on SPI1 or SPI2, those interfaces must be enabled
+        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+        If interrupts are enabled for a device on a given CS# on a SPI bus, that
+        device must be the only one present on that SPI bus/CS#.
+Load:   dtoverlay=mcp23s17,<param>=<val>
+Params: s08-spi<n>-<m>-present  4-bit integer, bitmap indicating MCP23S08
+                                devices present on SPI<n>, CS#<m>
+
+        s17-spi<n>-<m>-present  8-bit integer, bitmap indicating MCP23S17
+                                devices present on SPI<n>, CS#<m>
+
+        s08-spi<n>-<m>-int-gpio integer, enables interrupts on a single
+                                MCP23S08 device on SPI<n>, CS#<m>, specifies
+                                the GPIO pin to which INT output of MCP23S08
+                                is connected.
+
+        s17-spi<n>-<m>-int-gpio integer, enables mirrored interrupts on a
+                                single MCP23S17 device on SPI<n>, CS#<m>,
+                                specifies the GPIO pin to which either INTA
+                                or INTB output of MCP23S17 is connected.
+
+
+Name:   mcp2515-can0
+Info:   Configures the MCP2515 CAN controller on spi0.0
+Load:   dtoverlay=mcp2515-can0,<param>=<val>
+Params: oscillator              Clock frequency for the CAN controller (Hz)
+
+        spimaxfrequency         Maximum SPI frequence (Hz)
+
+        interrupt               GPIO for interrupt signal
+
+
+Name:   mcp2515-can1
+Info:   Configures the MCP2515 CAN controller on spi0.1
+Load:   dtoverlay=mcp2515-can1,<param>=<val>
+Params: oscillator              Clock frequency for the CAN controller (Hz)
+
+        spimaxfrequency         Maximum SPI frequence (Hz)
+
+        interrupt               GPIO for interrupt signal
+
+
+Name:   mcp3008
+Info:   Configures MCP3008 A/D converters
+        For devices on spi1 or spi2, the interfaces should be enabled
+        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+Load:   dtoverlay=mcp3008,<param>[=<val>]
+Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
+        spi<n>-<m>-speed        integer, set the spi bus speed for this device
+
+
+Name:   mcp3202
+Info:   Configures MCP3202 A/D converters
+        For devices on spi1 or spi2, the interfaces should be enabled
+        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+Load:   dtoverlay=mcp3202,<param>[=<val>]
+Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
+        spi<n>-<m>-speed        integer, set the spi bus speed for this device
+
+
+Name:   media-center
+Info:   Media Center HAT - 2.83" Touch Display + extras by Pi Supply
+Load:   dtoverlay=media-center,<param>=<val>
+Params: speed                   Display SPI bus speed
+        rotate                  Display rotation {0,90,180,270}
+        fps                     Delay between frame updates
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+        swapxy                  Swap x and y axis
+        backlight               Change backlight GPIO pin {e.g. 12, 18}
+        gpio_out_pin            GPIO for output (default "17")
+        gpio_in_pin             GPIO for input (default "18")
+        gpio_in_pull            Pull up/down/off on the input pin
+                                (default "down")
+        sense                   Override the IR receive auto-detection logic:
+                                 "0" = force active-high
+                                 "1" = force active-low
+                                 "-1" = use auto-detection
+                                (default "-1")
+        softcarrier             Turn the software carrier "on" or "off"
+                                (default "on")
+        invert                  "on" = invert the output pin (default "off")
+        debug                   "on" = enable additional debug messages
+                                (default "off")
+
+
+Name:   midi-uart0
+Info:   Configures UART0 (ttyAMA0) so that a requested 38.4kbaud actually gets
+        31.25kbaud, the frequency required for MIDI
+Load:   dtoverlay=midi-uart0
+Params: <None>
+
+
+Name:   midi-uart1
+Info:   Configures UART1 (ttyS0) so that a requested 38.4kbaud actually gets
+        31.25kbaud, the frequency required for MIDI
+Load:   dtoverlay=midi-uart1
+Params: <None>
+
+
+Name:   mmc
+Info:   Selects the bcm2835-mmc SD/MMC driver, optionally with overclock
+Load:   dtoverlay=mmc,<param>=<val>
+Params: overclock_50            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+
+Name:   mpu6050
+Info:   Overlay for i2c connected mpu6050 imu
+Load:   dtoverlay=mpu6050,<param>=<val>
+Params: interrupt               GPIO pin for interrupt (default 4)
+
+
+Name:   mz61581
+Info:   MZ61581 display by Tontec
+Load:   dtoverlay=mz61581,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        txbuflen                Transmit buffer length (default 32768)
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+
+Name:   papirus
+Info:   PaPiRus ePaper Screen by Pi Supply (both HAT and pHAT)
+Load:   dtoverlay=papirus,<param>=<val>
+Params: panel                   Display panel (required):
+                                1.44": e1144cs021
+                                2.0":  e2200cs021
+                                2.7":  e2271cs021
+
+        speed                   Display SPI bus speed
+
+
+[ The pcf2127-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+[ The pcf8523-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+[ The pcf8563-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+Name:   pi3-act-led
+Info:   Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
+        from the VPU. There is a special driver for this with a separate DT
+        node, which has the unfortunate consequence of breaking the
+        act_led_gpio and act_led_activelow dtparams.
+        This overlay changes the GPIO controller back to the standard one and
+        restores the dtparams.
+Load:   dtoverlay=pi3-act-led,<param>=<val>
+Params: activelow               Set to "on" to invert the sense of the LED
+                                (default "off")
+
+        gpio                    Set which GPIO to use for the activity LED
+                                (in case you want to connect it to an external
+                                device)
+                                REQUIRED
+
+
+Name:   pi3-disable-bt
+Info:   Disable Pi3 Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15
+        N.B. To disable the systemd service that initialises the modem so it
+        doesn't use the UART, use 'sudo systemctl disable hciuart'.
+Load:   dtoverlay=pi3-disable-bt
+Params: <None>
+
+
+Name:   pi3-disable-wifi
+Info:   Disable Pi3 onboard WiFi
+Load:   dtoverlay=pi3-disable-wifi
+Params: <None>
+
+
+Name:   pi3-miniuart-bt
+Info:   Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
+        UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
+        usable baudrate.
+        N.B. It is also necessary to edit /lib/systemd/system/hciuart.service
+        and replace ttyAMA0 with ttyS0, unless you have a system with udev rules
+        that create /dev/serial0 and /dev/serial1, in which case use
+        /dev/serial1 instead because it will always be correct. Furthermore,
+        you must also set core_freq=250 in config.txt or the miniuart will not
+        work.
+Load:   dtoverlay=pi3-miniuart-bt
+Params: <None>
+
+
+Name:   pibell
+Info:   Configures the pibell audio card.
+Load:   dtoverlay=pibell,<param>=<val>
+Params: alsaname                Set the name as it appears in ALSA (default
+                                "PiBell")
+
+
+Name:   piscreen
+Info:   PiScreen display by OzzMaker.com
+Load:   dtoverlay=piscreen,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+
+Name:   piscreen2r
+Info:   PiScreen 2 with resistive TP display by OzzMaker.com
+Load:   dtoverlay=piscreen2r,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+
+Name:   pisound
+Info:   Configures the Blokas Labs pisound card
+Load:   dtoverlay=pisound
+Params: <None>
+
+
+Name:   pitft22
+Info:   Adafruit PiTFT 2.2" screen
+Load:   dtoverlay=pitft22,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+
+Name:   pitft28-capacitive
+Info:   Adafruit PiTFT 2.8" capacitive touch screen
+Load:   dtoverlay=pitft28-capacitive,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        touch-sizex             Touchscreen size x (default 240)
+
+        touch-sizey             Touchscreen size y (default 320)
+
+        touch-invx              Touchscreen inverted x axis
+
+        touch-invy              Touchscreen inverted y axis
+
+        touch-swapxy            Touchscreen swapped x y axis
+
+
+Name:   pitft28-resistive
+Info:   Adafruit PiTFT 2.8" resistive touch screen
+Load:   dtoverlay=pitft28-resistive,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+
+Name:   pitft35-resistive
+Info:   Adafruit PiTFT 3.5" resistive touch screen
+Load:   dtoverlay=pitft35-resistive,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+
+Name:   pps-gpio
+Info:   Configures the pps-gpio (pulse-per-second time signal via GPIO).
+Load:   dtoverlay=pps-gpio,<param>=<val>
+Params: gpiopin                 Input GPIO (default "18")
+        assert_falling_edge     When present, assert is indicated by a falling
+                                edge, rather than by a rising edge (default
+                                off)
+        capture_clear           Generate clear events on the trailing edge
+                                (default off)
+
+
+Name:   pwm
+Info:   Configures a single PWM channel
+        Legal pin,function combinations for each channel:
+          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+        N.B.:
+          1) Pin 18 is the only one available on all platforms, and
+             it is the one used by the I2S audio interface.
+             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+          2) The onboard analogue audio output uses both PWM channels.
+          3) So be careful mixing audio and PWM.
+          4) Currently the clock must have been enabled and configured
+             by other means.
+Load:   dtoverlay=pwm,<param>=<val>
+Params: pin                     Output pin (default 18) - see table
+        func                    Pin function (default 2 = Alt5) - see above
+        clock                   PWM clock frequency (informational)
+
+
+Name:   pwm-2chan
+Info:   Configures both PWM channels
+        Legal pin,function combinations for each channel:
+          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+        N.B.:
+          1) Pin 18 is the only one available on all platforms, and
+             it is the one used by the I2S audio interface.
+             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+          2) The onboard analogue audio output uses both PWM channels.
+          3) So be careful mixing audio and PWM.
+          4) Currently the clock must have been enabled and configured
+             by other means.
+Load:   dtoverlay=pwm-2chan,<param>=<val>
+Params: pin                     Output pin (default 18) - see table
+        pin2                    Output pin for other channel (default 19)
+        func                    Pin function (default 2 = Alt5) - see above
+        func2                   Function for pin2 (default 2 = Alt5)
+        clock                   PWM clock frequency (informational)
+
+
+Name:   pwm-ir-tx
+Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
+        This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
+        of PWM0 to reduce the CPU load during transmission compared to
+        gpio-ir-tx which uses bit-banging.
+        Legal pin,function combinations are:
+          12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
+Load:   dtoverlay=pwm-ir-tx,<param>=<val>
+Params: gpio_pin                Output GPIO (default 18)
+
+        func                    Pin function (default 2 = Alt5)
+
+
+Name:   qca7000
+Info:   I2SE's Evaluation Board for PLC Stamp micro
+Load:   dtoverlay=qca7000,<param>=<val>
+Params: int_pin                 GPIO pin for interrupt signal (default 23)
+
+        speed                   SPI bus speed (default 12 MHz)
+
+
+Name:   rotary-encoder
+Info:   Overlay for GPIO connected rotary encoder.
+Load:   dtoverlay=rotary-encoder,<param>=<val>
+Params: pin_a                   GPIO connected to rotary encoder channel A
+                                (default 4).
+        pin_b                   GPIO connected to rotary encoder channel B
+                                (default 17).
+        relative_axis           register a relative axis rather than an
+                                absolute one. Relative axis will only
+                                generate +1/-1 events on the input device,
+                                hence no steps need to be passed.
+        linux_axis              the input subsystem axis to map to this
+                                rotary encoder. Defaults to 0 (ABS_X / REL_X)
+        rollover                Automatic rollover when the rotary value
+                                becomes greater than the specified steps or
+                                smaller than 0. For absolute axis only.
+        steps-per-period        Number of steps (stable states) per period.
+                                The values have the following meaning:
+                                1: Full-period mode (default)
+                                2: Half-period mode
+                                4: Quarter-period mode
+        steps                   Number of steps in a full turnaround of the
+                                encoder. Only relevant for absolute axis.
+                                Defaults to 24 which is a typical value for
+                                such devices.
+        wakeup                  Boolean, rotary encoder can wake up the
+                                system.
+        encoding                String, the method used to encode steps.
+                                Supported are "gray" (the default and more
+                                common) and "binary".
+
+
+Name:   rpi-backlight
+Info:   Raspberry Pi official display backlight driver
+Load:   dtoverlay=rpi-backlight
+Params: <None>
+
+
+Name:   rpi-cirrus-wm5102
+Info:   Configures the Cirrus Logic Audio Card
+Load:   dtoverlay=rpi-cirrus-wm5102
+Params: <None>
+
+
+Name:   rpi-dac
+Info:   Configures the RPi DAC audio card
+Load:   dtoverlay=rpi-dac
+Params: <None>
+
+
+Name:   rpi-display
+Info:   RPi-Display - 2.8" Touch Display by Watterott
+Load:   dtoverlay=rpi-display,<param>=<val>
+Params: speed                   Display SPI bus speed
+        rotate                  Display rotation {0,90,180,270}
+        fps                     Delay between frame updates
+        debug                   Debug output level {0-7}
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+        swapxy                  Swap x and y axis
+        backlight               Change backlight GPIO pin {e.g. 12, 18}
+
+
+Name:   rpi-ft5406
+Info:   Official Raspberry Pi display touchscreen
+Load:   dtoverlay=rpi-ft5406,<param>=<val>
+Params: touchscreen-size-x      Touchscreen X resolution (default 800)
+        touchscreen-size-y      Touchscreen Y resolution (default 600);
+        touchscreen-inverted-x  Invert touchscreen X coordinates (default 0);
+        touchscreen-inverted-y  Invert touchscreen Y coordinates (default 0);
+        touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
+
+
+Name:   rpi-proto
+Info:   Configures the RPi Proto audio card
+Load:   dtoverlay=rpi-proto
+Params: <None>
+
+
+Name:   rpi-sense
+Info:   Raspberry Pi Sense HAT
+Load:   dtoverlay=rpi-sense
+Params: <None>
+
+
+Name:   rpi-tv
+Info:   Raspberry Pi TV HAT
+Load:   dtoverlay=rpi-tv
+Params: <None>
+
+
+Name:   rra-digidac1-wm8741-audio
+Info:   Configures the Red Rocks Audio DigiDAC1 soundcard
+Load:   dtoverlay=rra-digidac1-wm8741-audio
+Params: <None>
+
+
+Name:   sc16is750-i2c
+Info:   Overlay for the NXP SC16IS750 UART with I2C Interface
+        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
+        select another address, please refer to table 10 in reference manual.
+Load:   dtoverlay=sc16is750-i2c,<param>=<val>
+Params: int_pin                 GPIO used for IRQ (default 24)
+        addr                    Address (default 0x48)
+
+
+Name:   sc16is752-i2c
+Info:   Overlay for the NXP SC16IS752 dual UART with I2C Interface
+        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
+        select another address, please refer to table 10 in reference manual.
+Load:   dtoverlay=sc16is752-i2c,<param>=<val>
+Params: int_pin                 GPIO used for IRQ (default 24)
+        addr                    Address (default 0x48)
+        xtal                    On-board crystal frequency (default 14745600)
+
+
+Name:   sc16is752-spi1
+Info:   Overlay for the NXP SC16IS752 Dual UART with SPI Interface
+        Enables the chip on SPI1.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+
+Load:   dtoverlay=sc16is752-spi1,<param>=<val>
+Params: int_pin                 GPIO used for IRQ (default 24)
+
+
+Name:   sdhost
+Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock.
+        N.B. This overlay is designed for situations where the mmc driver is
+        the default, so it disables the other (mmc) interface - this will kill
+        WiFi on a Pi3. If this isn't what you want, either use the sdtweak
+        overlay or the new sd_* dtparams of the base DTBs.
+Load:   dtoverlay=sdhost,<param>=<val>
+Params: overclock_50            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+        force_pio               Disable DMA support (default off)
+
+        pio_limit               Number of blocks above which to use DMA
+                                (default 1)
+
+        debug                   Enable debug output (default off)
+
+
+Name:   sdio
+Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
+        and enables SDIO via GPIOs 22-27.
+Load:   dtoverlay=sdio,<param>=<val>
+Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
+                                framework requests 50MHz
+
+        poll_once               Disable SDIO-device polling every second
+                                (default on: polling once at boot-time)
+
+        bus_width               Set the SDIO host bus width (default 4 bits)
+
+
+Name:   sdio-1bit
+Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
+        and enables 1-bit SDIO via GPIOs 22-25.
+Load:   dtoverlay=sdio-1bit,<param>=<val>
+Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
+                                framework requests 50MHz
+
+        poll_once               Disable SDIO-device polling every second
+                                (default on: polling once at boot-time)
+
+
+Name:   sdtweak
+Info:   Tunes the bcm2835-sdhost SD/MMC driver
+        N.B. This functionality is now available via the sd_* dtparams in the
+        base DTB.
+Load:   dtoverlay=sdtweak,<param>=<val>
+Params: overclock_50            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+        force_pio               Disable DMA support (default off)
+
+        pio_limit               Number of blocks above which to use DMA
+                                (default 1)
+
+        debug                   Enable debug output (default off)
+
+        poll_once               Looks for a card once after booting. Useful
+                                for network booting scenarios to avoid the
+                                overhead of continuous polling. N.B. Using
+                                this option restricts the system to using a
+                                single card per boot (or none at all).
+                                (default off)
+
+        enable                  Set to off to completely disable the interface
+                                (default on)
+
+
+Name:   smi
+Info:   Enables the Secondary Memory Interface peripheral. Uses GPIOs 2-25!
+Load:   dtoverlay=smi
+Params: <None>
+
+
+Name:   smi-dev
+Info:   Enables the userspace interface for the SMI driver
+Load:   dtoverlay=smi-dev
+Params: <None>
+
+
+Name:   smi-nand
+Info:   Enables access to NAND flash via the SMI interface
+Load:   dtoverlay=smi-nand
+Params: <None>
+
+
+Name:   spi-gpio35-39
+Info:   Move SPI function block to GPIO 35 to 39
+Load:   dtoverlay=spi-gpio35-39
+Params: <None>
+
+
+Name:   spi-rtc
+Info:   Adds support for a number of SPI Real Time Clock devices
+Load:   dtoverlay=spi-rtc,<param>=<val>
+Params: pcf2123                 Select the PCF2123 device
+
+
+Name:   spi0-cs
+Info:   Allows the (software) CS pins for SPI0 to be changed
+Load:   dtoverlay=spi0-cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 8)
+        cs1_pin                 GPIO pin for CS1 (default 7)
+
+
+Name:   spi0-hw-cs
+Info:   Re-enables hardware CS/CE (chip selects) for SPI0
+Load:   dtoverlay=spi0-hw-cs
+Params: <None>
+
+
+Name:   spi1-1cs
+Info:   Enables spi1 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+Load:   dtoverlay=spi1-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.0 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi1-2cs
+Info:   Enables spi1 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+Load:   dtoverlay=spi1-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.1 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi1-3cs
+Info:   Enables spi1 with three chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+Load:   dtoverlay=spi1-3cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
+        cs2_pin                 GPIO pin for CS2 (default 16 - BCM SPI1_CE2).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.1 (default
+                                is 'okay' or enabled).
+        cs2_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.2 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi2-1cs
+Info:   Enables spi2 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+        N.B.: spi2 is only accessible with the Compute Module.
+Load:   dtoverlay=spi2-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.0 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi2-2cs
+Info:   Enables spi2 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi2 is only accessible with the Compute Module.
+Load:   dtoverlay=spi2-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.1 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi2-3cs
+Info:   Enables spi2 with three chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi2 is only accessible with the Compute Module.
+Load:   dtoverlay=spi2-3cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
+        cs2_pin                 GPIO pin for CS2 (default 45 - BCM SPI2_CE2).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.1 (default
+                                is 'okay' or enabled).
+        cs2_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.2 (default
+                                is 'okay' or enabled).
+
+
+Name:   superaudioboard
+Info:   Configures the SuperAudioBoard sound card
+Load:   dtoverlay=superaudioboard,<param>=<val>
+Params: gpiopin                 GPIO pin for codec reset
+
+
+Name:   sx150x
+Info:   Configures the Semtech SX150X I2C GPIO expanders.
+Load:   dtoverlay=sx150x,<param>=<val>
+Params: sx150<x>-<n>-<m>        Enables SX150X device on I2C#<n> with slave
+                                address <m>. <x> may be 1-9. <n> may be 0 or 1.
+                                Permissible values of <m> (which is denoted in
+                                hex) depend on the device variant. For SX1501,
+                                SX1502, SX1504 and SX1505, <m> may be 20 or 21.
+                                For SX1503 and SX1506, <m> may be 20. For
+                                SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
+                                For SX1508, <m> may be 20, 21, 22 or 23.
+
+        sx150<x>-<n>-<m>-int-gpio
+                                Integer, enables interrupts on SX150X device on
+                                I2C#<n> with slave address <m>, specifies
+                                the GPIO pin to which NINT output of SX150X is
+                                connected.
+
+
+Name:   tinylcd35
+Info:   3.5" Color TFT Display by www.tinylcd.com
+        Options: Touch, RTC, keypad
+Load:   dtoverlay=tinylcd35,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        touch                   Enable touch panel
+
+        touchgpio               Touch controller IRQ GPIO
+
+        xohms                   Touchpanel: Resistance of X-plate in ohms
+
+        rtc-pcf                 PCF8563 Real Time Clock
+
+        rtc-ds                  DS1307 Real Time Clock
+
+        keypad                  Enable keypad
+
+        Examples:
+            Display with touchpanel, PCF8563 RTC and keypad:
+                dtoverlay=tinylcd35,touch,rtc-pcf,keypad
+            Old touch display:
+                dtoverlay=tinylcd35,touch,touchgpio=3
+
+
+Name:   uart0
+Info:   Change the pin usage of uart0
+Load:   dtoverlay=uart0,<param>=<val>
+Params: txd0_pin                GPIO pin for TXD0 (14, 32 or 36 - default 14)
+
+        rxd0_pin                GPIO pin for RXD0 (15, 33 or 37 - default 15)
+
+        pin_func                Alternative pin function - 4(Alt0) for 14&15,
+                                7(Alt3) for 32&33, 6(Alt2) for 36&37
+
+
+Name:   uart1
+Info:   Change the pin usage of uart1
+Load:   dtoverlay=uart1,<param>=<val>
+Params: txd1_pin                GPIO pin for TXD1 (14, 32 or 40 - default 14)
+
+        rxd1_pin                GPIO pin for RXD1 (15, 33 or 41 - default 15)
+
+
+Name:   upstream
+Info:   Allow usage of downstream .dtb with upstream kernel. Comprises
+        vc4-kms-v3d, dwc2 and upstream-aux-interrupt overlays.
+Load:   dtoverlay=upstream
+Params: <None>
+
+
+Name:   upstream-aux-interrupt
+Info:   Allow usage of downstream .dtb with upstream kernel by binding AUX
+        devices directly to the shared AUX interrupt line. One of the parts
+        of the 'upstream' overlay
+Load:   dtoverlay=upstream-aux-interrupt
+Params: <None>
+
+
+Name:   vc4-fkms-v3d
+Info:   Enable Eric Anholt's DRM VC4 V3D driver on top of the dispmanx
+        display stack.
+Load:   dtoverlay=vc4-fkms-v3d,<param>
+Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
+        cma-192                 CMA is 192MB, 256MB-aligned (needs 1GB)
+        cma-128                 CMA is 128MB, 128MB-aligned
+        cma-96                  CMA is 96MB, 128MB-aligned
+        cma-64                  CMA is 64MB, 64MB-aligned
+
+
+Name:   vc4-kms-v3d
+Info:   Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver. Running startx or
+        booting to GUI while this overlay is in use will cause interesting
+        lockups.
+Load:   dtoverlay=vc4-kms-v3d,<param>
+Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
+        cma-192                 CMA is 192MB, 256MB-aligned (needs 1GB)
+        cma-128                 CMA is 128MB, 128MB-aligned
+        cma-96                  CMA is 96MB, 128MB-aligned
+        cma-64                  CMA is 64MB, 64MB-aligned
+
+
+Name:   vga666
+Info:   Overlay for the Fen Logic VGA666 board
+        This uses GPIOs 2-21 (so no I2C), and activates the output 2-3 seconds
+        after the kernel has started.
+Load:   dtoverlay=vga666
+Params: <None>
+
+
+Name:   w1-gpio
+Info:   Configures the w1-gpio Onewire interface module.
+        Use this overlay if you *don't* need a GPIO to drive an external pullup.
+Load:   dtoverlay=w1-gpio,<param>=<val>
+Params: gpiopin                 GPIO for I/O (default "4")
+
+        pullup                  Non-zero, "on", or "y" to enable the parasitic
+                                power (2-wire, power-on-data) feature
+
+
+Name:   w1-gpio-pullup
+Info:   Configures the w1-gpio Onewire interface module.
+        Use this overlay if you *do* need a GPIO to drive an external pullup.
+Load:   dtoverlay=w1-gpio-pullup,<param>=<val>
+Params: gpiopin                 GPIO for I/O (default "4")
+
+        pullup                  Non-zero, "on", or "y" to enable the parasitic
+                                power (2-wire, power-on-data) feature
+
+        extpullup               GPIO for external pullup (default "5")
+
+
+Name:   wittypi
+Info:   Configures the wittypi RTC module.
+Load:   dtoverlay=wittypi,<param>=<val>
+Params: led_gpio                GPIO for LED (default "17")
+        led_trigger             Choose which activity the LED tracks (default
+                                "default-on")
+
+
+Troubleshooting
+===============
+
+If you are experiencing problems that you think are DT-related, enable DT
+diagnostic output by adding this to /boot/config.txt:
+
+    dtdebug=on
+
+and rebooting. Then run:
+
+    sudo vcdbg log msg
+
+and look for relevant messages.
+
+Further reading
+===============
+
+This is only meant to be a quick introduction to the subject of Device Tree on
+Raspberry Pi. There is a more complete explanation here:
+
+http://www.raspberrypi.org/documentation/configuration/device-tree.md
diff --git a/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
new file mode 100644
index 0000000000000..1aaca71c1b677
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
@@ -0,0 +1,40 @@
+// Definitions for ADAU1977 ADC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+    
+	fragment@0 {
+        	target = <&i2c>;
+        	
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+			
+			adau1977: codec@11 {
+                        	compatible = "adi,adau1977";
+                        	reg = <0x11>;
+                        	reset-gpios = <&gpio 5 0>;
+				AVDD-supply = <&vdd_3v3_reg>;
+                	};
+        	};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "adi,adau1977-adc";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
new file mode 100644
index 0000000000000..e67e6625d7967
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
@@ -0,0 +1,52 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target = <&i2s>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+        target-path = "/";
+        __overlay__ {
+                adau7002_codec: adau7002-codec {
+                #sound-dai-cells = <0>;
+                compatible = "adi,adau7002";
+/*                IOVDD-supply = <&supply>;*/
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@2 {
+        target = <&sound>;
+            sound_overlay: __overlay__ {
+            compatible = "simple-audio-card";
+            simple-audio-card,format = "i2s";
+            simple-audio-card,name = "adau7002";
+            simple-audio-card,bitclock-slave = <&dailink0_slave>;
+            simple-audio-card,frame-slave = <&dailink0_slave>;
+            simple-audio-card,widgets =
+                    "Microphone", "Microphone Jack";
+            simple-audio-card,routing =
+                    "PDM_DAT", "Microphone Jack";
+            status = "okay";
+            simple-audio-card,cpu {
+                sound-dai = <&i2s>;
+            };
+            dailink0_slave: simple-audio-card,codec {
+                sound-dai = <&adau7002_codec>;
+            };
+        };
+    };
+
+
+    __overrides__ {
+        card-name = <&sound_overlay>,"simple-audio-card,name";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/ads1015-overlay.dts b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
new file mode 100644
index 0000000000000..02b9de46299ba
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
@@ -0,0 +1,98 @@
+/*
+ * 2016 - Erik Sejr
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+    /* ----------- ADS1015 ------------ */
+    fragment@0 {
+        target = <&i2c_arm>;
+        __overlay__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            status = "okay";
+            ads1015: ads1015 {
+                compatible = "ti,ads1015";
+                status = "okay";
+                #address-cells = <1>;
+                #size-cells = <0>;
+                reg = <0x48>;
+            };
+        };
+    };
+
+    fragment@1 {
+        target-path = "i2c_arm/ads1015";
+        __overlay__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_a: channel_a {
+                reg = <4>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    fragment@2 {
+        target-path = "i2c_arm/ads1015";
+        __dormant__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_b: channel_b {
+                reg = <5>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    fragment@3 {
+        target-path = "i2c_arm/ads1015";
+        __dormant__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_c: channel_c {
+                reg = <6>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    fragment@4 {
+        target-path = "i2c_arm/ads1015";
+        __dormant__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_d: channel_d {
+                reg = <7>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    __overrides__ {
+        addr =            <&ads1015>,"reg:0";
+        cha_enable =      <0>,"=1";
+        cha_cfg =         <&channel_a>,"reg:0";
+        cha_gain =        <&channel_a>,"ti,gain:0";
+        cha_datarate =    <&channel_a>,"ti,datarate:0";
+        chb_enable =      <0>,"=2";
+        chb_cfg =         <&channel_b>,"reg:0";
+        chb_gain =        <&channel_b>,"ti,gain:0";
+        chb_datarate =    <&channel_b>,"ti,datarate:0";
+        chc_enable =      <0>,"=3";
+        chc_cfg =         <&channel_c>,"reg:0";
+        chc_gain =        <&channel_c>,"ti,gain:0";
+        chc_datarate =    <&channel_c>,"ti,datarate:0";
+        chd_enable =      <0>,"=4";
+        chd_cfg =         <&channel_d>,"reg:0";
+        chd_gain =        <&channel_d>,"ti,gain:0";
+        chd_datarate =    <&channel_d>,"ti,datarate:0";
+   };
+
+};
diff --git a/arch/arm/boot/dts/overlays/ads1115-overlay.dts b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
new file mode 100644
index 0000000000000..7c16a1af3172d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
@@ -0,0 +1,103 @@
+/*
+ * TI ADS1115 multi-channel ADC overlay
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ads1115: ads1115 {
+				compatible = "ti,ads1115";
+				status = "okay";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				reg = <0x48>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_a: channel_a {
+				reg = <4>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_b: channel_b {
+				reg = <5>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_c: channel_c {
+				reg = <6>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	fragment@4 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_d: channel_d {
+				reg = <7>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	__overrides__ {
+		addr =            <&ads1115>,"reg:0";
+		cha_enable =      <0>,"=1";
+		cha_cfg =         <&channel_a>,"reg:0";
+		cha_gain =        <&channel_a>,"ti,gain:0";
+		cha_datarate =    <&channel_a>,"ti,datarate:0";
+		chb_enable =      <0>,"=2";
+		chb_cfg =         <&channel_b>,"reg:0";
+		chb_gain =        <&channel_b>,"ti,gain:0";
+		chb_datarate =    <&channel_b>,"ti,datarate:0";
+		chc_enable =      <0>,"=3";
+		chc_cfg =         <&channel_c>,"reg:0";
+		chc_gain =        <&channel_c>,"ti,gain:0";
+		chc_datarate =    <&channel_c>,"ti,datarate:0";
+		chd_enable =      <0>,"=4";
+		chd_cfg =         <&channel_d>,"reg:0";
+		chd_gain =        <&channel_d>,"ti,gain:0";
+		chd_datarate =    <&channel_d>,"ti,datarate:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/ads7846-overlay.dts b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
new file mode 100644
index 0000000000000..edf2dc9d5d5f6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
@@ -0,0 +1,89 @@
+/*
+ * Generic Device Tree overlay for the ADS7846 touch controller
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			ads7846_pins: ads7846_pins {
+				brcm,pins = <255>; /* illegal default value */
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			ads7846: ads7846@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&ads7846_pins>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <255 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 255 0>;
+
+				/* driver defaults */
+				ti,x-min = /bits/ 16 <0>;
+				ti,y-min = /bits/ 16 <0>;
+				ti,x-max = /bits/ 16 <0x0FFF>;
+				ti,y-max = /bits/ 16 <0x0FFF>;
+				ti,pressure-min = /bits/ 16 <0>;
+				ti,pressure-max = /bits/ 16 <0xFFFF>;
+				ti,x-plate-ohms = /bits/ 16 <400>;
+			};
+		};
+	};
+	__overrides__ {
+		cs =     <&ads7846>,"reg:0";
+		speed =  <&ads7846>,"spi-max-frequency:0";
+		penirq = <&ads7846_pins>,"brcm,pins:0", /* REQUIRED */
+			 <&ads7846>,"interrupts:0",
+			 <&ads7846>,"pendown-gpio:4";
+		penirq_pull = <&ads7846_pins>,"brcm,pull:0";
+		swapxy = <&ads7846>,"ti,swap-xy?";
+		xmin =   <&ads7846>,"ti,x-min;0";
+		ymin =   <&ads7846>,"ti,y-min;0";
+		xmax =   <&ads7846>,"ti,x-max;0";
+		ymax =   <&ads7846>,"ti,y-max;0";
+		pmin =   <&ads7846>,"ti,pressure-min;0";
+		pmax =   <&ads7846>,"ti,pressure-max;0";
+		xohms =  <&ads7846>,"ti,x-plate-ohms;0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
new file mode 100644
index 0000000000000..241d03b9b79ef
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for Digital Dreamtime Akkordion using IQaudIO DAC+ or DACZero
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		frag2: __overlay__ {
+			compatible = "iqaudio,iqaudio-dac";
+			card_name = "Akkordion";
+			dai_name = "IQaudIO DAC";
+			dai_stream_name = "IQaudIO DAC HiFi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
new file mode 100644
index 0000000000000..ac1cfe093d9aa
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
@@ -0,0 +1,59 @@
+/*
+ * Definitions for Allo Boss DAC board
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			boss_osc: boss_osc {
+				compatible = "allo,dac-clk";
+				#clock-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				clocks = <&boss_osc>;
+				reg = <0x4d>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		boss_dac: __overlay__ {
+			compatible = "allo,boss-dac";
+			i2s-controller = <&i2s>;
+			mute-gpios = <&gpio 6 1>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&boss_dac>,"allo,24db_digital_gain?";
+		slave = <&boss_dac>,"allo,slave?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-digione-overlay.dts b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
new file mode 100644
index 0000000000000..101277a11a24e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
@@ -0,0 +1,44 @@
+// Definitions for Allo DigiOne
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+				wlf,reset-gpio = <&gpio 17 0>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "allo,allo-digione";
+			i2s-controller = <&i2s>;
+			status = "okay";
+			clock44-gpio = <&gpio 5 0>;
+			clock48-gpio = <&gpio 6 0>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
new file mode 100644
index 0000000000000..6dc4acf1f80c1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
@@ -0,0 +1,57 @@
+/*
+ * Definitions for Allo Katana DAC boards
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			#sound-dai-cells = <0>;
+			status = "okay";
+			cpu_port: port {
+				cpu_endpoint: endpoint {
+					remote-endpoint = <&codec_endpoint>;
+					bitclock-master = <&codec_endpoint>;
+					frame-master = <&codec_endpoint>;
+					dai-format = "i2s";
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			allo-katana-codec@30 {
+				#sound-dai-cells = <0>;
+				compatible = "allo,allo-katana-codec";
+				reg = <0x30>;
+				port {
+					codec_endpoint: endpoint {
+					remote-endpoint = <&cpu_endpoint>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		katana_dac: __overlay__ {
+			compatible = "audio-graph-card";
+			label = "Allo Katana";
+			dais = <&cpu_port>;
+			status = "okay";
+		};
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
new file mode 100644
index 0000000000000..a5468d850a911
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
@@ -0,0 +1,54 @@
+/*
+ * Definitions for Allo Piano DAC (2.0/2.1) boards
+ *
+ * NB. The Piano DAC 2.1 board contains 2x TI PCM5142 DAC's. One DAC is stereo
+ * (left/right) and the other provides a subwoofer output, using DSP on the
+ * chip for digital high/low pass crossover.
+ * The initial support for this hardware, that doesn't require any codec driver
+ * modifications, uses only one DAC chip for stereo (left/right) output, the
+ * chip with 0x4c slave address. The other chip at 0x4d is currently ignored!
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5142@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5142";
+				reg = <0x4c>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		piano_dac: __overlay__ {
+			compatible = "allo,piano-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&piano_dac>,"allo,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
new file mode 100644
index 0000000000000..5c1c81c427a8b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
@@ -0,0 +1,55 @@
+// Definitions for Piano DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			allo_pcm5122_4c: pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				status = "okay";
+			};
+			allo_pcm5122_4d: pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		piano_dac: __overlay__ {
+			compatible = "allo,piano-dac-plus";
+			audio-codec = <&allo_pcm5122_4c &allo_pcm5122_4d>;
+			i2s-controller = <&i2s>;
+			mute1-gpios = <&gpio 6 1>;
+			mute2-gpios = <&gpio 25 1>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&piano_dac>,"allo,24db_digital_gain?";
+		glb_mclk =
+			<&piano_dac>,"allo,glb_mclk?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
new file mode 100644
index 0000000000000..fc02b295470ef
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target = <&sound>;
+        __overlay__ {
+            compatible = "simple-audio-card";
+            simple-audio-card,name = "ApplePi-DAC";
+
+            status = "okay";
+
+            playback_link: simple-audio-card,dai-link@1 {
+                format = "i2s";
+
+                p_cpu_dai: cpu {
+                    sound-dai = <&i2s>;
+                    dai-tdm-slot-num = <2>;
+                    dai-tdm-slot-width = <32>;
+                };
+
+                p_codec_dai: codec {
+                    sound-dai = <&codec_out>;
+                };
+            };
+        };
+    };
+
+    fragment@1 {
+        target-path = "/";
+        __overlay__ {
+            codec_out: pcm1794a-codec {
+                #sound-dai-cells = <0>;
+                compatible = "ti,pcm1794a";
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@2 {
+        target = <&i2s>;
+        __overlay__ {
+            #sound-dai-cells = <0>;
+            status = "okay";
+        };
+    };
+};
+
+/*
+   Written by: Leonid Ayzenshtat
+   Company: Orchard Audio (www.orchardaudio.com)
+
+   compile with:
+   dtc -@ -H epapr -O dtb -o ApplePi-DAC.dtbo -W no-unit_address_vs_reg ApplePi-DAC.dts
+*/
diff --git a/arch/arm/boot/dts/overlays/at86rf233-overlay.dts b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
new file mode 100644
index 0000000000000..880c7539d496f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+/* Overlay for Atmel AT86RF233 IEEE 802.15.4 WPAN transceiver on spi0.0 */
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			lowpan0: at86rf233@0 {
+				compatible = "atmel,at86rf233";
+				reg = <0>;
+				interrupt-parent = <&gpio>;
+				interrupts = <23 4>; /* active high */
+				reset-gpio = <&gpio 24 1>;
+				sleep-gpio = <&gpio 25 1>;
+				spi-max-frequency = <3000000>;
+				xtal-trim = /bits/ 8 <0xf>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			lowpan0_pins: lowpan0_pins {
+				brcm,pins = <23 24 25>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	__overrides__ {
+		interrupt = <&lowpan0>, "interrupts:0",
+			<&lowpan0_pins>, "brcm,pins:0";
+		reset     = <&lowpan0>, "reset-gpio:4",
+			<&lowpan0_pins>, "brcm,pins:4";
+		sleep     = <&lowpan0>, "sleep-gpio:4",
+			<&lowpan0_pins>, "brcm,pins:8";
+		speed     = <&lowpan0>, "spi-max-frequency:0";
+		trim      = <&lowpan0>, "xtal-trim.0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
new file mode 100644
index 0000000000000..60b2e94f2c9a6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
@@ -0,0 +1,59 @@
+// Definitions for audioinjector.net audio add on soundcard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			cs42448: cs42448@48 {
+				#sound-dai-cells = <0>;
+				compatible = "cirrus,cs42448";
+				reg = <0x48>;
+				clocks = <&cs42448_mclk>;
+				clock-names = "mclk";
+				VA-supply = <&vdd_5v0_reg>;
+				VD-supply = <&vdd_3v3_reg>;
+				VLS-supply = <&vdd_3v3_reg>;
+				VLC-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+
+			cs42448_mclk: codec-mclk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <49152000>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		snd: __overlay__ {
+			compatible = "ai,audioinjector-octo-soundcard";
+			mult-gpios = <&gpio 27 0>, <&gpio 22 0>, <&gpio 23 0>,
+				     <&gpio 24 0>;
+			reset-gpios = <&gpio 5 0>;
+			i2s-controller = <&i2s>;
+			codec = <&cs42448>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		non-stop-clocks = <&snd>, "non-stop-clocks?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
new file mode 100644
index 0000000000000..4ed66577fa1d5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for audioinjector.net audio add on soundcard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8731@1a {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8731";
+				reg = <0x1a>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "ai,audioinjector-pi-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/audremap-overlay.dts b/arch/arm/boot/dts/overlays/audremap-overlay.dts
new file mode 100644
index 0000000000000..9582d6ab31218
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
@@ -0,0 +1,19 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target = <&audio_pins>;
+                frag0: __overlay__ {
+                        brcm,pins = < 12 13 >;
+                        brcm,function = < 4 >; /* alt0 alt0 */
+                };
+        };
+
+	__overrides__ {
+		swap_lr = <&frag0>, "swap_lr?";
+		enable_jack = <&frag0>, "enable_jack?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
new file mode 100644
index 0000000000000..269ab7d729382
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
@@ -0,0 +1,79 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		sdio_wifi: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdio_pins>;
+			bus-width = <4>;
+			brcm,overclock-50 = <35>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			sdio_pins: sdio_pins {
+				brcm,pins = <34 35 36 37 38 39>;
+				brcm,function = <7>; /* ALT3 = SD1 */
+				brcm,pull = <0 2 2 2 2 2>;
+			};
+
+			power_ctrl_pins: power_ctrl_pins {
+				brcm,pins = <40>;
+				brcm,function = <1>; // out
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			// We should investigate how to switch to mmc-pwrseq-sd8787
+			// Currently that module requires two GPIOs to function since it
+			// targets a slightly different chip
+			power_ctrl: power_ctrl {
+				compatible = "gpio-poweroff";
+				gpios = <&gpio 40 1>;
+				force;
+			};
+
+			i2c_soft: i2c@0 {
+				compatible = "i2c-gpio";
+				gpios = <&gpio 43 0 /* sda */ &gpio 42 0 /* scl */>;
+				i2c-gpio,delay-us = <2>; /* ~100 kHz */
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_soft>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			gpio_expander: gpio_expander@20 {
+				compatible = "nxp,pca9554";
+				gpio-controller;
+				#gpio-cells = <2>;
+				reg = <0x20>;
+				status = "okay";
+			};
+
+			// rtc clock
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
new file mode 100644
index 0000000000000..782b1715467e9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
@@ -0,0 +1,23 @@
+// Definitions for BMP085/BMP180 digital barometric pressure and temperature sensors from Bosch Sensortec
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target = <&i2c_arm>;
+                __overlay__ {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        status = "okay";
+
+                        bmp085@77 {
+                                compatible = "bosch,bmp085";
+                                reg = <0x77>;
+                                default-oversampling = <3>;
+                                status = "okay";
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/dht11-overlay.dts b/arch/arm/boot/dts/overlays/dht11-overlay.dts
new file mode 100644
index 0000000000000..9bf67fd57bada
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dht11-overlay.dts
@@ -0,0 +1,39 @@
+/*
+ * Overlay for the DHT11/21/22 humidity/temperature sensor modules.
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+
+			dht11: dht11@0 {
+				compatible = "dht11";
+				pinctrl-names = "default";
+				pinctrl-0 = <&dht11_pins>;
+				gpios = <&gpio 4 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			dht11_pins: dht11_pins {
+				brcm,pins = <4>;
+				brcm,function = <0>; // in
+				brcm,pull = <0>; // off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin = <&dht11_pins>,"brcm,pins:0",
+			<&dht11>,"gpios:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
new file mode 100644
index 0000000000000..3930f412bca44
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for Dion Audio LOCO DAC-AMP
+
+/*
+ * PCM5242 DAC (in hardware mode) and TPA3118 AMP.
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			pcm5102a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5102a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "dionaudio,loco-pcm5242-tpa3118";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
new file mode 100644
index 0000000000000..a1af93de30119
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
@@ -0,0 +1,49 @@
+/*
+ * Definitions for Dion Audio LOCO-V2 DAC-AMP
+ *  eg. dtoverlay=dionaudio-loco-v2
+ *
+ * PCM5242 DAC (in software mode) and TPA3255 AMP.
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sound>;
+		frag0: __overlay__ {
+			compatible = "dionaudio,dionaudio-loco-v2";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag0>,"dionaudio,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
new file mode 100644
index 0000000000000..8098d5e28a71f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
@@ -0,0 +1,31 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// There is no DPI driver module, but we need a platform device
+	// node (that doesn't already use pinctrl) to hang the pinctrl
+	// reference on - leds will do
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi18_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			dpi18_pins: dpi18_pins {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					     12 13 14 15 16 17 18 19 20
+					     21>;
+				brcm,function = <6>; /* alt2 */
+				brcm,pull = <0>; /* no pull */
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
new file mode 100644
index 0000000000000..e4dbe40218a00
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
@@ -0,0 +1,31 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// There is no DPI driver module, but we need a platform device
+	// node (that doesn't already use pinctrl) to hang the pinctrl
+	// reference on - leds will do
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi24_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			dpi24_pins: dpi24_pins {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					     12 13 14 15 16 17 18 19 20
+					     21 22 23 24 25 26 27>;
+				brcm,function = <6>; /* alt2 */
+				brcm,pull = <0>; /* no pull */
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
new file mode 100644
index 0000000000000..fc48bd1eac605
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
@@ -0,0 +1,20 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&usb>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		__overlay__ {
+			compatible = "brcm,bcm2708-usb";
+			reg = <0x7e980000 0x10000>,
+			      <0x7e006000 0x1000>;
+			interrupts = <2 0>,
+				     <1 9>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dwc2-overlay.dts b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
new file mode 100644
index 0000000000000..d6c223bc559ab
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
@@ -0,0 +1,28 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&usb>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		dwc2_usb: __overlay__ {
+			compatible = "brcm,bcm2835-usb";
+			reg = <0x7e980000 0x10000>;
+			interrupts = <1 9>;
+			dr_mode = "otg";
+			g-np-tx-fifo-size = <32>;
+			g-rx-fifo-size = <256>;
+			g-tx-fifo-size = <512 512 512 512 512 256 256>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		dr_mode = <&dwc2_usb>, "dr_mode";
+		g-np-tx-fifo-size = <&dwc2_usb>,"g-np-tx-fifo-size:0";
+		g-rx-fifo-size = <&dwc2_usb>,"g-rx-fifo-size:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/enc28j60-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
new file mode 100644
index 0000000000000..db8a8feed94c0
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
@@ -0,0 +1,53 @@
+// Overlay for the Microchip ENC28J60 Ethernet Controller
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			eth1: enc28j60@0{
+				compatible = "microchip,enc28j60";
+				reg = <0>; /* CE0 */
+				pinctrl-names = "default";
+				pinctrl-0 = <&eth1_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <25 0x2>; /* falling edge */
+				spi-max-frequency = <12000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			eth1_pins: eth1_pins {
+				brcm,pins = <25>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&eth1>, "interrupts:0",
+		          <&eth1_pins>, "brcm,pins:0";
+		speed   = <&eth1>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
new file mode 100644
index 0000000000000..946c9d2107a83
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
@@ -0,0 +1,47 @@
+// Overlay for the Microchip ENC28J60 Ethernet Controller - SPI2 Compute Module
+// Interrupt pin: 39
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi2>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			eth1: enc28j60@0{
+				compatible = "microchip,enc28j60";
+				reg = <0>; /* CE0 */
+				pinctrl-names = "default";
+				pinctrl-0 = <&eth1_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <39 0x2>; /* falling edge */
+				spi-max-frequency = <12000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			eth1_pins: eth1_pins {
+				brcm,pins = <39>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&eth1>, "interrupts:0",
+		          <&eth1_pins>, "brcm,pins:0";
+		speed   = <&eth1>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/exc3000-overlay.dts b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
new file mode 100644
index 0000000000000..c5694033d03f3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
@@ -0,0 +1,48 @@
+// Device tree overlay for I2C connected EETI EXC3000 multiple touch controller
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			exc3000_pins: exc3000_pins {
+				brcm,pins = <4>; // interrupt
+				brcm,function = <0>; // in
+				brcm,pull = <2>; // pull-up
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			exc3000: exc3000@2a {
+				compatible = "eeti,exc3000";
+				reg = <0x2a>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&exc3000_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 8>; // active low level-sensitive
+				touchscreen-size-x = <4096>;
+				touchscreen-size-y = <4096>;
+			};
+		};
+	};
+
+	__overrides__ {
+		interrupt = <&exc3000_pins>,"brcm,pins:0",
+			<&exc3000>,"interrupts:0";
+		sizex = <&exc3000>,"touchscreen-size-x:0";
+		sizey = <&exc3000>,"touchscreen-size-y:0";
+		invx = <&exc3000>,"touchscreen-inverted-x?";
+		invy = <&exc3000>,"touchscreen-inverted-y?";
+		swapxy = <&exc3000>,"touchscreen-swapped-x-y?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
new file mode 100644
index 0000000000000..81a07ed5a8c75
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
@@ -0,0 +1,70 @@
+// Definitions for Fe-Pi Audio
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&clocks>;
+		__overlay__ {
+			sgtl5000_mclk: sgtl5000_mclk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <12288000>;
+				clock-output-names = "sgtl5000-mclk";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			reg_1v8: reg_1v8@0 {
+				compatible = "regulator-fixed";
+				regulator-name = "1V8";
+				regulator-min-microvolt = <1800000>;
+				regulator-max-microvolt = <1800000>;
+				regulator-always-on;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sgtl5000@0a {
+				#sound-dai-cells = <0>;
+				compatible = "fepi,sgtl5000";
+				reg = <0x0a>;
+				clocks = <&sgtl5000_mclk>;
+				micbias-resistor-k-ohms = <2>;
+				micbias-voltage-m-volts = <3000>;
+				VDDA-supply = <&vdd_3v3_reg>;
+				VDDIO-supply = <&vdd_3v3_reg>;
+				VDDD-supply = <&reg_1v8>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@4 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "fe-pi,fe-pi-audio";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/goodix-overlay.dts b/arch/arm/boot/dts/overlays/goodix-overlay.dts
new file mode 100644
index 0000000000000..084f74042ed63
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
@@ -0,0 +1,46 @@
+// Device tree overlay for I2C connected Goodix gt9271 multiple touch controller
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			goodix_pins: goodix_pins {
+				brcm,pins = <4 17>; // interrupt and reset
+				brcm,function = <0 0>; // in
+				brcm,pull = <2 2>; // pull-up
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			gt9271: gt9271@14 {
+				compatible = "goodix,gt9271";
+				reg = <0x14>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&goodix_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 2>; // high-to-low edge triggered
+				irq-gpios = <&gpio 4 0>; // Pin7 on GPIO header
+				reset-gpios = <&gpio 17 0>; // Pin11 on GPIO header
+			};
+		};
+	};
+
+	__overrides__ {
+		interrupt = <&goodix_pins>,"brcm,pins:0",
+			<&gt9271>,"interrupts:0",
+			<&gt9271>,"irq-gpios:4";
+		reset = <&goodix_pins>,"brcm,pins:4",
+			<&gt9271>,"reset-gpios:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
new file mode 100644
index 0000000000000..9a9e9a0ca28cf
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for Google voiceHAT v1 soundcard overlay
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			googlevoicehat_pins: googlevoicehat_pins {
+				brcm,pins = <16>;
+				brcm,function = <1>; /* out */
+				brcm,pull = <0>; /* up */
+			};
+		};
+	};
+
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			voicehat-codec {
+				#sound-dai-cells = <0>;
+				compatible = "google,voicehat";
+				pinctrl-names = "default";
+				pinctrl-0 = <&googlevoicehat_pins>;
+				sdmode-gpios= <&gpio 16 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "googlevoicehat,googlevoicehat-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
new file mode 100644
index 0000000000000..1bd9bb950efae
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
@@ -0,0 +1,48 @@
+// Definitions for ir-gpio module
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target-path = "/";
+                __overlay__ {
+                        gpio_ir: ir-receiver@12 {
+                                compatible = "gpio-ir-receiver";
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&gpio_ir_pins>;
+
+                                // pin number, high or low
+                                gpios = <&gpio 18 1>;
+
+                                // parameter for keymap name
+                                linux,rc-map-name = "rc-rc6-mce";
+
+                                status = "okay";
+                        };
+                };
+        };
+
+        fragment@1 {
+                target = <&gpio>;
+                __overlay__ {
+                        gpio_ir_pins: gpio_ir_pins@12 {
+                                brcm,pins = <18>;                       // pin 18
+                                brcm,function = <0>;                    // in
+                                brcm,pull = <1>;                        // down
+                        };
+                };
+        };
+
+        __overrides__ {
+                // parameters
+                gpio_pin =      <&gpio_ir>,"gpios:4",           // pin number
+                                <&gpio_ir>,"reg:0",
+                                <&gpio_ir_pins>,"brcm,pins:0",
+                                <&gpio_ir_pins>,"reg:0";
+                gpio_pull = <&gpio_ir_pins>,"brcm,pull:0";              // pull-up/down state
+
+                rc-map-name = <&gpio_ir>,"linux,rc-map-name";           // default rc map
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
new file mode 100644
index 0000000000000..e054ba319398e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
@@ -0,0 +1,36 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			gpio_ir_tx_pins: gpio_ir_tx_pins@12 {
+				brcm,pins = <18>;
+				brcm,function = <1>;	// out
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			gpio_ir_tx: gpio-ir-transmitter@12 {
+				compatible = "gpio-ir-tx";
+				pinctrl-names = "default";
+				pinctrl-0 = <&gpio_ir_tx_pins>;
+				gpios = <&gpio 18 0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio_pin = <&gpio_ir_tx>, "gpios:4",           	// pin number
+			   <&gpio_ir_tx>, "reg:0",
+			   <&gpio_ir_tx_pins>, "brcm,pins:0",
+			   <&gpio_ir_tx_pins>, "reg:0";
+		invert = <&gpio_ir_tx>, "gpios:8";		// 1 = active low
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-key-overlay.dts b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
new file mode 100644
index 0000000000000..333d016d6f029
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
@@ -0,0 +1,48 @@
+// Definitions for gpio-key module
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		// Configure the gpio pin controller
+		target = <&gpio>;
+		__overlay__ {
+			pin_state: button_pins@0 {
+				brcm,pins = <3>; // gpio number
+				brcm,function = <0>; // 0 = input, 1 = output
+				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
+			};
+		};
+	};
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			button: button@0 {
+				compatible = "gpio-keys";
+				pinctrl-names = "default";
+				pinctrl-0 = <&pin_state>;
+				status = "okay";
+
+				key: key {
+					linux,code = <116>;
+					gpios = <&gpio 3 1>;
+					label = "KEY_POWER";
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio =       <&key>,"gpios:4",
+		             <&button>,"reg:0",
+		             <&pin_state>,"brcm,pins:0",
+		             <&pin_state>,"reg:0";
+		label =      <&key>,"label";
+		keycode =    <&key>,"linux,code:0";
+		gpio_pull =  <&pin_state>,"brcm,pull:0";
+		active_low = <&key>,"gpios:8";
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts b/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
new file mode 100644
index 0000000000000..55f9bff3a8f62
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-no-irq-overlay.dts
@@ -0,0 +1,14 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		// Configure the gpio pin controller
+		target = <&gpio>;
+		__overlay__ {
+			    interrupts;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
new file mode 100644
index 0000000000000..b9c8349605567
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
@@ -0,0 +1,36 @@
+// Definitions for gpio-poweroff module
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			power_ctrl: power_ctrl {
+				compatible = "gpio-poweroff";
+				gpios = <&gpio 26 0>;
+				force;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			power_ctrl_pins: power_ctrl_pins {
+				brcm,pins = <26>;
+				brcm,function = <1>; // out
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin =       <&power_ctrl>,"gpios:4",
+				<&power_ctrl_pins>,"brcm,pins:0";
+		active_low =    <&power_ctrl>,"gpios:8";
+		input =         <&power_ctrl>,"input?";
+		export =        <&power_ctrl>,"export?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
new file mode 100644
index 0000000000000..863fb395c8539
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
@@ -0,0 +1,80 @@
+// Definitions for gpio-poweroff module
+/dts-v1/;
+/plugin/;
+
+// This overlay sets up an input device that generates KEY_POWER events
+// when a given GPIO pin changes. It defaults to using GPIO3, which can
+// also be used to wake up (start) the Rpi again after shutdown. Since
+// wakeup is active-low, this defaults to active-low with a pullup
+// enabled, but all of this can be changed using overlay parameters (but
+// note that GPIO3 has an external pullup on at least some boards).
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		// Configure the gpio pin controller
+		target = <&gpio>;
+		__overlay__ {
+			// Define a pinctrl state, that sets up the gpio
+			// as an input with a pullup enabled. This does
+			// not take effect by itself, only when referenced
+			// by a "pinctrl client", as is done below. See:
+			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
+			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/brcm,bcm2835-gpio.txt
+			pin_state: shutdown_button_pins {
+				brcm,pins = <3>; // gpio number
+				brcm,function = <0>; // 0 = input, 1 = output
+				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
+			};
+		};
+	};
+	fragment@1 {
+		// Add a new device to the /soc devicetree node
+		target-path = "/soc";
+		__overlay__ {
+			shutdown_button {
+				// Let the gpio-keys driver handle this device. See:
+				// https://www.kernel.org/doc/Documentation/devicetree/bindings/input/gpio-keys.txt
+				compatible = "gpio-keys";
+
+				// Declare a single pinctrl state (referencing the one declared above) and name it
+				// default, so it is activated automatically.
+				pinctrl-names = "default";
+				pinctrl-0 = <&pin_state>;
+
+				// Enable this device
+				status = "okay";
+
+				// Define a single key, called "shutdown" that monitors the gpio and sends KEY_POWER
+				// (keycode 116, see
+				// https://github.com/torvalds/linux/blob/v4.12/include/uapi/linux/input-event-codes.h#L190)
+				button: shutdown {
+					label = "shutdown";
+					linux,code = <116>; // KEY_POWER
+					gpios = <&gpio 3 1>;
+				};
+			};
+		};
+	};
+
+	// This defines parameters that can be specified when loading
+	// the overlay. Each foo = line specifies one parameter, named
+	// foo. The rest of the specification gives properties where the
+	// parameter value is inserted into (changing the values above
+	// or adding new ones).
+	__overrides__ {
+		// Allow overriding the GPIO number.
+		gpio_pin = <&button>,"gpios:4",
+		           <&pin_state>,"brcm,pins:0";
+
+		// Allow changing the internal pullup/down state. 0 = none, 1 = pulldown, 2 = pullup
+		// Note that GPIO3 and GPIO2 are the I2c pins and have an external pullup (at least
+                // on some boards).
+		gpio_pull = <&pin_state>,"brcm,pull:0";
+
+		// Allow setting the active_low flag. 0 = active high, 1 = active low
+		active_low = <&button>,"gpios:8";
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
new file mode 100644
index 0000000000000..5f5785534fd3d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for HiFiBerry Amp/Amp+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tas5713@1b {
+				#sound-dai-cells = <0>;
+				compatible = "ti,tas5713";
+				reg = <0x1b>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-amp";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
new file mode 100644
index 0000000000000..0b74fdc6e0f64
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
@@ -0,0 +1,34 @@
+// Definitions for HiFiBerry DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			pcm5102a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5102a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
new file mode 100644
index 0000000000000..b4dc99633b9d4
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
@@ -0,0 +1,59 @@
+// Definitions for HiFiBerry DAC+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			dacpro_osc: dacpro_osc {
+				compatible = "hifiberry,dacpro-clk";
+				#clock-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				clocks = <&dacpro_osc>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		hifiberry_dacplus: __overlay__ {
+			compatible = "hifiberry,hifiberry-dacplus";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
+		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
new file mode 100644
index 0000000000000..64cb1e00343b5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
@@ -0,0 +1,41 @@
+// Definitions for HiFiBerry Digi
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
new file mode 100644
index 0000000000000..d02479ca4a25c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
@@ -0,0 +1,43 @@
+// Definitions for HiFiBerry Digi Pro
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+			clock44-gpio = <&gpio 5 0>;
+			clock48-gpio = <&gpio 6 0>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hy28a-overlay.dts b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
new file mode 100644
index 0000000000000..d7625a6372f51
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
@@ -0,0 +1,93 @@
+/*
+ * Device Tree overlay for HY28A display
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			hy28a_pins: hy28a_pins {
+				brcm,pins = <17 25 18>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hy28a: hy28a@0{
+				compatible = "ilitek,ili9320";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&hy28a_pins>;
+
+				spi-max-frequency = <32000000>;
+				spi-cpol;
+				spi-cpha;
+				rotate = <270>;
+				bgr;
+				fps = <50>;
+				buswidth = <8>;
+				startbyte = <0x70>;
+				reset-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 1>;
+				debug = <0>;
+			};
+
+			hy28a_ts: hy28a-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =		<&hy28a>,"spi-max-frequency:0";
+		rotate =	<&hy28a>,"rotate:0";
+		fps =		<&hy28a>,"fps:0";
+		debug =		<&hy28a>,"debug:0";
+		xohms =		<&hy28a_ts>,"ti,x-plate-ohms;0";
+		resetgpio =	<&hy28a>,"reset-gpios:4",
+				<&hy28a_pins>, "brcm,pins:4";
+		ledgpio =	<&hy28a>,"led-gpios:4",
+				<&hy28a_pins>, "brcm,pins:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hy28b-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
new file mode 100644
index 0000000000000..70c1118064b64
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
@@ -0,0 +1,148 @@
+/*
+ * Device Tree overlay for HY28b display shield by Texy
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			hy28b_pins: hy28b_pins {
+				brcm,pins = <17 25 18>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hy28b: hy28b@0{
+				compatible = "ilitek,ili9325";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&hy28b_pins>;
+
+				spi-max-frequency = <48000000>;
+				spi-cpol;
+				spi-cpha;
+				rotate = <270>;
+				bgr;
+				fps = <50>;
+				buswidth = <8>;
+				startbyte = <0x70>;
+				reset-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 1>;
+
+				gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
+
+				init = <0x10000e7 0x0010
+					0x1000000 0x0001
+					0x1000001 0x0100
+					0x1000002 0x0700
+				        0x1000003 0x1030
+					0x1000004 0x0000
+					0x1000008 0x0207
+					0x1000009 0x0000
+				        0x100000a 0x0000
+					0x100000c 0x0001
+					0x100000d 0x0000
+					0x100000f 0x0000
+				        0x1000010 0x0000
+					0x1000011 0x0007
+					0x1000012 0x0000
+					0x1000013 0x0000
+				        0x2000032
+					0x1000010 0x1590
+					0x1000011 0x0227
+				        0x2000032
+					0x1000012 0x009c
+				        0x2000032
+				        0x1000013 0x1900
+					0x1000029 0x0023
+					0x100002b 0x000e
+				        0x2000032
+				        0x1000020 0x0000
+					0x1000021 0x0000
+				        0x2000032
+					0x1000050 0x0000
+				        0x1000051 0x00ef
+					0x1000052 0x0000
+					0x1000053 0x013f
+					0x1000060 0xa700
+				        0x1000061 0x0001
+					0x100006a 0x0000
+					0x1000080 0x0000
+					0x1000081 0x0000
+				        0x1000082 0x0000
+					0x1000083 0x0000
+					0x1000084 0x0000
+					0x1000085 0x0000
+				        0x1000090 0x0010
+					0x1000092 0x0000
+					0x1000093 0x0003
+					0x1000095 0x0110
+				        0x1000097 0x0000
+					0x1000098 0x0000
+					0x1000007 0x0133
+					0x1000020 0x0000
+				        0x1000021 0x0000
+				        0x2000064>;
+				debug = <0>;
+			};
+
+			hy28b_ts: hy28b-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed = 	<&hy28b>,"spi-max-frequency:0";
+		rotate = 	<&hy28b>,"rotate:0";
+		fps = 		<&hy28b>,"fps:0";
+		debug = 	<&hy28b>,"debug:0";
+		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
+		resetgpio =	<&hy28b>,"reset-gpios:4",
+				<&hy28b_pins>, "brcm,pins:4";
+		ledgpio =	<&hy28b>,"led-gpios:4",
+				<&hy28b_pins>, "brcm,pins:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
new file mode 100644
index 0000000000000..0afc6b405414c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
@@ -0,0 +1,13 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			compatible = "brcm,bcm2708-i2c";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
new file mode 100644
index 0000000000000..3f692c1a8958c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
@@ -0,0 +1,43 @@
+// Overlay for i2c_gpio bitbanging host bus.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			i2c_gpio: i2c@0 {
+				compatible = "i2c-gpio";
+				gpios = <&gpio 23 0 /* sda */
+					 &gpio 24 0 /* scl */
+					>;
+				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/aliases";
+		__overlay__ {
+			i2c_gpio = "/i2c@0";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/__symbols__";
+		__overlay__ {
+			i2c_gpio = "/i2c@0";
+		};
+	};
+
+	__overrides__ {
+		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
+		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
+		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
+		bus = <&i2c_gpio>, "reg:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
new file mode 100644
index 0000000000000..976d38e781539
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
@@ -0,0 +1,139 @@
+// Umbrella I2C Mux overlay
+
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca9542: mux@70 {
+				compatible = "nxp,pca9542";
+				reg = <0x70>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				i2c@0 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <0>;
+				};
+				i2c@1 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <1>;
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca9545: mux@70 {
+				compatible = "nxp,pca9545";
+				reg = <0x70>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				i2c@0 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <0>;
+				};
+				i2c@1 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <1>;
+				};
+				i2c@2 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <2>;
+				};
+				i2c@3 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <3>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca9548: mux@70 {
+				compatible = "nxp,pca9548";
+				reg = <0x70>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				i2c@0 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <0>;
+				};
+				i2c@1 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <1>;
+				};
+				i2c@2 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <2>;
+				};
+				i2c@3 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <3>;
+				};
+				i2c@4 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <4>;
+				};
+				i2c@5 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <5>;
+				};
+				i2c@6 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <6>;
+				};
+				i2c@7 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <7>;
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		pca9542 = <0>, "+0";
+		pca9545 = <0>, "+1";
+		pca9548 = <0>, "+2";
+
+		addr =  <&pca9542>,"reg:0",
+			<&pca9545>,"reg:0",
+			<&pca9548>,"reg:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
new file mode 100644
index 0000000000000..d1ffd2326669e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
@@ -0,0 +1,26 @@
+// Definitions for NXP PCA9685A I2C PWM controller on ARM I2C bus.
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca: pca@40 {
+				compatible = "nxp,pca9685";
+				#pwm-cells = <2>;
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+	__overrides__ {
+		addr = <&pca>,"reg:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
new file mode 100644
index 0000000000000..8415e6081428f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
@@ -0,0 +1,183 @@
+// Definitions for several I2C based Real Time Clocks
+// Available through i2c-gpio
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			i2c_gpio: i2c-gpio-rtc@0 {
+				compatible = "i2c-gpio";
+				gpios = <&gpio 23 0 /* sda */
+					 &gpio 24 0 /* scl */
+					>;
+				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			abx80x: abx80x@69 {
+				compatible = "abracon,abx80x";
+				reg = <0x69>;
+				abracon,tc-diode = "standard";
+				abracon,tc-resistor = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1339: ds1339@68 {
+				compatible = "dallas,ds1339";
+				trickle-resistor-ohms = <0>;
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds3231: ds3231@68 {
+				compatible = "maxim,ds3231";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7940x: mcp7940x@6f {
+				compatible = "microchip,mcp7940x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7941x: mcp7941x@6f {
+				compatible = "microchip,mcp7941x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf2127: pcf2127@51 {
+				compatible = "nxp,pcf2127";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@8 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8523: pcf8523@68 {
+				compatible = "nxp,pcf8523";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8563: pcf8563@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		abx80x = <0>,"+1";
+		ds1307 = <0>,"+2";
+		ds1339 = <0>,"+3";
+		ds3231 = <0>,"+4";
+		mcp7940x = <0>,"+5";
+		mcp7941x = <0>,"+6";
+		pcf2127 = <0>,"+7";
+		pcf8523 = <0>,"+8";
+		pcf8563 = <0>,"+9";
+		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
+		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
+					<&abx80x>,"abracon,tc-resistor";
+		wakeup-source = <&ds1339>,"wakeup-source?",
+				<&ds3231>,"wakeup-source?",
+				<&mcp7940x>,"wakeup-source?",
+					<&mcp7941x>,"wakeup-source?";
+		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
+		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
+		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
new file mode 100644
index 0000000000000..fcb846a50d19c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -0,0 +1,181 @@
+// Definitions for several I2C based Real Time Clocks
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			abx80x: abx80x@69 {
+				compatible = "abracon,abx80x";
+				reg = <0x69>;
+				abracon,tc-diode = "standard";
+				abracon,tc-resistor = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1339: ds1339@68 {
+				compatible = "dallas,ds1339";
+				trickle-resistor-ohms = <0>;
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds3231: ds3231@68 {
+				compatible = "maxim,ds3231";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7940x: mcp7940x@6f {
+				compatible = "microchip,mcp7940x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7941x: mcp7941x@6f {
+				compatible = "microchip,mcp7941x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf2127: pcf2127@51 {
+				compatible = "nxp,pcf2127";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8523: pcf8523@68 {
+				compatible = "nxp,pcf8523";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@8 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8563: pcf8563@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			m41t62: m41t62@68 {
+				compatible = "st,m41t62";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		abx80x = <0>,"+0";
+		ds1307 = <0>,"+1";
+		ds1339 = <0>,"+2";
+		ds3231 = <0>,"+3";
+		mcp7940x = <0>,"+4";
+		mcp7941x = <0>,"+5";
+		pcf2127 = <0>,"+6";
+		pcf8523 = <0>,"+7";
+		pcf8563 = <0>,"+8";
+		m41t62 = <0>,"+9";
+		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
+		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
+					<&abx80x>,"abracon,tc-resistor";
+		wakeup-source = <&ds1339>,"wakeup-source?",
+				<&ds3231>,"wakeup-source?",
+				<&mcp7940x>,"wakeup-source?",
+				<&mcp7941x>,"wakeup-source?",
+				<&m41t62>,"wakeup-source?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
new file mode 100644
index 0000000000000..4b5be8676d112
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
@@ -0,0 +1,223 @@
+// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bme280: bme280@76 {
+				compatible = "bosch,bme280";
+				reg = <0x76>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bmp085: bmp085@77 {
+				compatible = "bosch,bmp085";
+				reg = <0x77>;
+				default-oversampling = <3>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bmp180: bmp180@77 {
+				compatible = "bosch,bmp180";
+				reg = <0x77>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bmp280: bmp280@76 {
+				compatible = "bosch,bmp280";
+				reg = <0x76>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			htu21: htu21@40 {
+				compatible = "htu21";
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			lm75: lm75@4f {
+				compatible = "lm75";
+				reg = <0x4f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			si7020: si7020@40 {
+				compatible = "si7020";
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tmp102: tmp102@48 {
+				compatible = "ti,tmp102";
+				reg = <0x48>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@8 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			hdc100x: hdc100x@40 {
+				compatible = "hdc100x";
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tsl4531: tsl4531@29 {
+				compatible = "tsl4531";
+				reg = <0x29>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@10 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			veml6070: veml6070@38 {
+				compatible = "veml6070";
+				reg = <0x38>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@11 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sht3x: sht3x@44 {
+				compatible = "sht3x";
+				reg = <0x44>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1621: ds1621@48 {
+				compatible = "ds1621";
+				reg = <0x48>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+			<&ds1621>,"reg:0";
+		bme280 = <0>,"+0";
+		bmp085 = <0>,"+1";
+		bmp180 = <0>,"+2";
+		bmp280 = <0>,"+3";
+		htu21 = <0>,"+4";
+		lm75 = <0>,"+5";
+		lm75addr = <&lm75>,"reg:0";
+		si7020 = <0>,"+6";
+		tmp102 = <0>,"+7";
+		hdc100x = <0>,"+8";
+		tsl4531 = <0>,"+9";
+		veml6070 = <0>,"+10";
+		sht3x = <0>,"+11";
+		ds1621 = <0>,"+12";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
new file mode 100644
index 0000000000000..9b5776f1bf6a9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
@@ -0,0 +1,69 @@
+/*
+ * Device tree overlay for i2c_bcm2708, i2c0 bus
+ *
+ * Compile:
+ * dtc -@ -I dts -O dtb -o i2c0-bcm2708-overlay.dtb i2c0-bcm2708-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+/{
+   compatible = "brcm,bcm2708";
+
+   fragment@0 {
+      target = <&i2c0>;
+      __overlay__ {
+         status = "okay";
+      };
+   };
+
+   fragment@1 {
+      target = <&i2c0_pins>;
+      frag1: __overlay__ {
+         brcm,pins = <0 1>;
+         brcm,function = <4>; /* alt0 */
+      };
+   };
+
+   fragment@2 {
+      target = <&i2c0_pins>;
+      __dormant__ {
+         brcm,pins = <28 29>;
+         brcm,function = <4>; /* alt0 */
+      };
+   };
+
+   fragment@3 {
+      target = <&i2c0_pins>;
+      __dormant__ {
+         brcm,pins = <44 45>;
+         brcm,function = <5>; /* alt1 */
+      };
+   };
+
+   fragment@4 {
+      target = <&i2c0_pins>;
+      __dormant__ {
+         brcm,pins = <46 47>;
+         brcm,function = <4>; /* alt0 */
+      };
+   };
+
+   fragment@5 {
+      target = <&i2c0>;
+      __dormant__ {
+         compatible = "brcm,bcm2708-i2c";
+      };
+   };
+
+   __overrides__ {
+      sda0_pin = <&frag1>,"brcm,pins:0";
+      scl0_pin = <&frag1>,"brcm,pins:4";
+      pins_0_1   = <0>,"+1-2-3-4";
+      pins_28_29 = <0>,"-1+2-3-4";
+      pins_44_45 = <0>,"-1-2+3-4";
+      pins_46_47 = <0>,"-1-2-3+4";
+      combine = <0>, "!5";
+   };
+};
diff --git a/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
new file mode 100644
index 0000000000000..c9da3eea00122
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
@@ -0,0 +1,43 @@
+/*
+ * Device tree overlay for i2c_bcm2708, i2c1 bus
+ *
+ * Compile:
+ * dtc -@ -I dts -O dtb -o i2c1-bcm2708-overlay.dtb i2c1-bcm2708-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+/{
+   compatible = "brcm,bcm2708";
+
+   fragment@0 {
+      target = <&i2c1>;
+      __overlay__ {
+         pinctrl-0 = <&i2c1_pins>;
+         status = "okay";
+      };
+   };
+
+   fragment@1 {
+      target = <&i2c1_pins>;
+         pins: __overlay__ {
+         brcm,pins = <2 3>;
+         brcm,function = <4>; /* alt 0 */
+      };
+   };
+
+   fragment@2 {
+      target = <&i2c1>;
+      __dormant__ {
+         compatible = "brcm,bcm2708-i2c";
+      };
+   };
+
+   __overrides__ {
+      sda1_pin = <&pins>,"brcm,pins:0";
+      scl1_pin = <&pins>,"brcm,pins:4";
+      pin_func = <&pins>,"brcm,function:0";
+      combine = <0>, "!2";
+   };
+};
diff --git a/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
new file mode 100644
index 0000000000000..30c356d6070cc
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
@@ -0,0 +1,18 @@
+/*
+ * Device tree overlay to move i2s to gpio 28 to 31 on CM
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2s_pins>;
+		__overlay__ {
+			brcm,pins = <28 29 30 31>;
+			brcm,function = <6>; /* alt2 */
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
new file mode 100644
index 0000000000000..f16586f05971f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
@@ -0,0 +1,46 @@
+// Definitions for IQaudIO DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		frag2: __overlay__ {
+			compatible = "iqaudio,iqaudio-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
new file mode 100644
index 0000000000000..4dcf17515f955
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for IQaudIO DAC+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		iqaudio_dac: __overlay__ {
+			compatible = "iqaudio,iqaudio-dac";
+			i2s-controller = <&i2s>;
+			mute-gpios = <&gpio 22 0>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&iqaudio_dac>,"iqaudio,24db_digital_gain?";
+		auto_mute_amp = <&iqaudio_dac>,"iqaudio-dac,auto-mute-amp?";
+		unmute_amp = <&iqaudio_dac>,"iqaudio-dac,unmute-amp?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
new file mode 100644
index 0000000000000..b86e1e5edc89f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
@@ -0,0 +1,47 @@
+// Definitions for IQAudIO Digi WM8804 audio board
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				status = "okay";
+				DVDD-supply = <&vdd_3v3_reg>;
+				PVDD-supply = <&vdd_3v3_reg>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		wm8804_digi: __overlay__ {
+			compatible = "iqaudio,wm8804-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		card_name = <&wm8804_digi>,"wm8804-digi,card-name";
+		dai_name = <&wm8804_digi>,"wm8804-digi,dai-name";
+		dai_stream_name = <&wm8804_digi>,"wm8804-digi,dai-stream-name";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
new file mode 100644
index 0000000000000..279e22efc0137
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
@@ -0,0 +1,309 @@
+// Overlay for JEDEC SPI-NOR Flash Devices (aka m25p80)
+
+// dtparams:
+//     flash-spi<n>-<m>        - Enables flash device on SPI<n>, CS#<m>.
+//     flash-fastr-spi<n>-<m>  - Enables flash device with fast read capability on SPI<n>, CS#<m>.
+//
+// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+//
+// Example: A single flash device with fast read capability on SPI0, CS#0:
+// dtoverlay=jedec-spi-nor:flash-fastr-spi0-0
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	// disable spi-dev on spi0.0
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi0.1
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.0
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.1
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.2
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.0
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.1
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.2
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// enable flash on spi0.0
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_00: spi_nor@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi0.1
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_01: spi_nor@1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <1>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi1.0
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_10: spi_nor@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi1.1
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_11: spi_nor@1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <1>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi1.2
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_12: spi_nor@2 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <2>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi2.0
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_20: spi_nor@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi2.1
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_21: spi_nor@1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <1>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi2.2
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_22: spi_nor@2 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <2>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// Enable fast read for device on spi0.0.
+	// Use default active low interrupt signalling.
+	fragment@16 {
+		target = <&spi_nor_00>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi0.1.
+	// Use default active low interrupt signalling.
+	fragment@17 {
+		target = <&spi_nor_01>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi1.0.
+	// Use default active low interrupt signalling.
+	fragment@18 {
+		target = <&spi_nor_10>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi1.1.
+	// Use default active low interrupt signalling.
+	fragment@19 {
+		target = <&spi_nor_11>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi1.2.
+	// Use default active low interrupt signalling.
+	fragment@20 {
+		target = <&spi_nor_12>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi2.0.
+	// Use default active low interrupt signalling.
+	fragment@21 {
+		target = <&spi_nor_20>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi2.1.
+	// Use default active low interrupt signalling.
+	fragment@22 {
+		target = <&spi_nor_21>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi2.2.
+	// Use default active low interrupt signalling.
+	fragment@23 {
+		target = <&spi_nor_22>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	__overrides__ {
+		flash-spi0-0       = <0>,"+0+8";
+		flash-spi0-1       = <0>,"+1+9";
+		flash-spi1-0       = <0>,"+2+10";
+		flash-spi1-1       = <0>,"+3+11";
+		flash-spi1-2       = <0>,"+4+12";
+		flash-spi2-0       = <0>,"+5+13";
+		flash-spi2-1       = <0>,"+6+14";
+		flash-spi2-2       = <0>,"+7+15";
+		flash-fastr-spi0-0 = <0>,"+0+8+16";
+		flash-fastr-spi0-1 = <0>,"+1+9+17";
+		flash-fastr-spi1-0 = <0>,"+2+10+18";
+		flash-fastr-spi1-1 = <0>,"+3+11+19";
+		flash-fastr-spi1-2 = <0>,"+4+12+20";
+		flash-fastr-spi2-0 = <0>,"+5+13+21";
+		flash-fastr-spi2-1 = <0>,"+6+14+22";
+		flash-fastr-spi2-2 = <0>,"+7+15+23";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
new file mode 100644
index 0000000000000..2b8dba0c231b2
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
@@ -0,0 +1,46 @@
+// Definitions for JustBoom DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		frag2: __overlay__ {
+			compatible = "justboom,justboom-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag2>,"justboom,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
new file mode 100644
index 0000000000000..1212e3ff591b6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
@@ -0,0 +1,41 @@
+// Definitions for JustBoom Digi
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "justboom,justboom-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts b/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
new file mode 100644
index 0000000000000..7d5d82bdf4c41
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
@@ -0,0 +1,57 @@
+// Definitions for lirc-rpi module
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			lirc_rpi: lirc_rpi {
+				compatible = "rpi,lirc-rpi";
+				pinctrl-names = "default";
+				pinctrl-0 = <&lirc_pins>;
+				status = "okay";
+
+				// Override autodetection of IR receiver circuit
+				// (0 = active high, 1 = active low, -1 = no override )
+				rpi,sense = <0xffffffff>;
+
+				// Software carrier
+				// (0 = off, 1 = on)
+				rpi,softcarrier = <1>;
+
+				// Invert output
+				// (0 = off, 1 = on)
+				rpi,invert = <0>;
+
+				// Enable debugging messages
+				// (0 = off, 1 = on)
+				rpi,debug = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			lirc_pins: lirc_pins {
+				brcm,pins = <17 18>;
+				brcm,function = <1 0>; // out in
+				brcm,pull = <0 1>; // off down
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
+		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
+		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
+
+		sense =         <&lirc_rpi>,"rpi,sense:0";
+		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
+		invert =        <&lirc_rpi>,"rpi,invert:0";
+		debug =         <&lirc_rpi>,"rpi,debug:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/ltc294x-overlay.dts b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
new file mode 100644
index 0000000000000..6d971f3649ca5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
@@ -0,0 +1,86 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2941: ltc2941@64 {
+				compatible = "lltc,ltc2941";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2942: ltc2942@64 {
+				compatible = "lltc,ltc2942";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2943: ltc2943@64 {
+				compatible = "lltc,ltc2943";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2944: ltc2944@64 {
+				compatible = "lltc,ltc2944";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	__overrides__ {
+		ltc2941 = <0>,"+0";
+		ltc2942 = <0>,"+1";
+		ltc2943 = <0>,"+2";
+		ltc2944 = <0>,"+3";
+		resistor-sense = <&ltc2941>, "lltc,resistor-sense:0",
+			         <&ltc2942>, "lltc,resistor-sense:0",
+				 <&ltc2943>, "lltc,resistor-sense:0",
+				 <&ltc2944>, "lltc,resistor-sense:0";
+		prescaler-exponent = <&ltc2941>, "lltc,prescaler-exponent:0",
+			         <&ltc2942>, "lltc,prescaler-exponent:0",
+				 <&ltc2943>, "lltc,prescaler-exponent:0",
+				 <&ltc2944>, "lltc,prescaler-exponent:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
new file mode 100644
index 0000000000000..313563d6ed47f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
@@ -0,0 +1,64 @@
+// Definitions for mbed DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+                        #size-cells = <0>;
+			status = "okay";
+
+			tlv320aic23: codec@1a {
+				#sound-dai-cells = <0>;
+				reg = <0x1a>;
+				compatible = "ti,tlv320aic23";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "simple-audio-card";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			simple-audio-card,name = "mbed-DAC";
+
+			simple-audio-card,widgets =
+				"Microphone", "Mic Jack",
+				"Line", "Line In",
+				"Headphone", "Headphone Jack";
+
+			simple-audio-card,routing =
+				"Headphone Jack", "LHPOUT",
+				"Headphone Jack", "RHPOUT",
+				"LLINEIN", "Line In",
+				"RLINEIN", "Line In",
+				"MICIN", "Mic Jack";
+
+			simple-audio-card,format = "i2s";
+
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+			};
+
+			sound_master: simple-audio-card,codec {
+				sound-dai = <&tlv320aic23>;
+				system-clock-frequency = <12288000>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
new file mode 100644
index 0000000000000..412f966a3cc0a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
@@ -0,0 +1,54 @@
+// Definitions for MCP23017 Gpio Extender from Microchip Semiconductor
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			mcp23017_pins: mcp23017_pins {
+				brcm,pins = <4>;
+				brcm,function = <0>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp23017: mcp@20 {
+				compatible = "microchip,mcp23017";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells=<2>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 2>;
+				interrupt-controller;
+				microchip,irq-mirror;
+
+				status = "okay";
+			};
+		};
+	};
+	
+	__overrides__ {
+		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
+				<&mcp23017>,"interrupts:0";
+		addr = <&mcp23017>,"reg:0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
new file mode 100644
index 0000000000000..7dcbacb3cd007
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
@@ -0,0 +1,732 @@
+// Overlay for MCP23S08/17 GPIO Extenders from Microchip Semiconductor
+
+// dtparams:
+//     s08-spi<n>-<m>-present  - 4-bit integer, bitmap indicating MCP23S08 devices present on SPI<n>, CS#<m>.
+//     s17-spi<n>-<m>-present  - 8-bit integer, bitmap indicating MCP23S17 devices present on SPI<n>, CS#<m>.
+//     s08-spi<n>-<m>-int-gpio - integer, enables interrupts on a single MCP23S08 device on SPI<n>, CS#<m>, specifies the GPIO pin to which INT output is connected.
+//     s17-spi<n>-<m>-int-gpio - integer, enables mirrored interrupts on a single MCP23S17 device on SPI<n>, CS#<m>, specifies the GPIO pin to which either INTA or INTB output is connected.
+//
+// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+// If interrupts are enabled for a device on a given CS# on a SPI bus, that device must be the only one present on that SPI bus/CS#.
+//
+// Example 1: A single MCP23S17 device on SPI0, CS#0 with its SPI addr set to 0 and INTA output connected to GPIO25:
+// dtoverlay=mcp23s17:s17-spi0-0-present=1,s17-spi0-0-int-gpio=25
+//
+// Example 2: Two MCP23S08 devices on SPI1, CS#0 with their addrs set to 2 and 3. Three MCP23S17 devices on SPI1, CS#1 with their addrs set to 0, 1 and 7:
+// dtoverlay=spi1-2cs
+// dtoverlay=mcp23s17:s08-spi1-0-present=12,s17-spi1-1-present=131
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	// disable spi-dev on spi0.0
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi0.1
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.0
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.1
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.2
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.0
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.1
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.2
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// enable one or more mcp23s08s on spi0.0
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_00: mcp23s08@0 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi0.1
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_01: mcp23s08@1 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi1.0
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_10: mcp23s08@0 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi1.1
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_11: mcp23s08@1 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi1.2
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_12: mcp23s08@2 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi2.0
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_20: mcp23s08@0 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi2.1
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_21: mcp23s08@1 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi2.2
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_22: mcp23s08@2 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi0.0
+	fragment@16 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_00: mcp23s17@0 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi0.1
+	fragment@17 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_01: mcp23s17@1 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi1.0
+	fragment@18 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_10: mcp23s17@0 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi1.1
+	fragment@19 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_11: mcp23s17@1 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi1.2
+	fragment@20 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_12: mcp23s17@2 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi2.0
+	fragment@21 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_20: mcp23s17@0 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi2.1
+	fragment@22 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_21: mcp23s17@1 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi2.2
+	fragment@23 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_22: mcp23s17@2 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.0 as a input with no pull-up/down
+	fragment@24 {
+		target = <&gpio>;
+		__dormant__ {
+			spi0_0_int_pins: spi0_0_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-0-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.1 as a input with no pull-up/down
+	fragment@25 {
+		target = <&gpio>;
+		__dormant__ {
+			spi0_1_int_pins: spi0_1_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-1-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.0 as a input with no pull-up/down
+	fragment@26 {
+		target = <&gpio>;
+		__dormant__ {
+			spi1_0_int_pins: spi1_0_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-0-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.1 as a input with no pull-up/down
+	fragment@27 {
+		target = <&gpio>;
+		__dormant__ {
+			spi1_1_int_pins: spi1_1_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-1-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.2 as a input with no pull-up/down
+	fragment@28 {
+		target = <&gpio>;
+		__dormant__ {
+			spi1_2_int_pins: spi1_2_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-2-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.0 as a input with no pull-up/down
+	fragment@29 {
+		target = <&gpio>;
+		__dormant__ {
+			spi2_0_int_pins: spi2_0_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-0-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.1 as a input with no pull-up/down
+	fragment@30 {
+		target = <&gpio>;
+		__dormant__ {
+			spi2_1_int_pins: spi2_1_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-1-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.2 as a input with no pull-up/down
+	fragment@31 {
+		target = <&gpio>;
+		__dormant__ {
+			spi2_2_int_pins: spi2_2_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-2-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi0.0.
+	// Use default active low interrupt signalling.
+	fragment@32 {
+		target = <&mcp23s08_00>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi0.1.
+	// Use default active low interrupt signalling.
+	fragment@33 {
+		target = <&mcp23s08_01>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi1.0.
+	// Use default active low interrupt signalling.
+	fragment@34 {
+		target = <&mcp23s08_10>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi1.1.
+	// Use default active low interrupt signalling.
+	fragment@35 {
+		target = <&mcp23s08_11>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi1.2.
+	// Use default active low interrupt signalling.
+	fragment@36 {
+		target = <&mcp23s08_12>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi2.0.
+	// Use default active low interrupt signalling.
+	fragment@37 {
+		target = <&mcp23s08_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi2.1.
+	// Use default active low interrupt signalling.
+	fragment@38 {
+		target = <&mcp23s08_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi2.2.
+	// Use default active low interrupt signalling.
+	fragment@39 {
+		target = <&mcp23s08_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi0.0.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Use default active low interrupt signalling.
+	fragment@40 {
+		target = <&mcp23s17_00>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi0.1.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@41 {
+		target = <&mcp23s17_01>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi1.0.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@42 {
+		target = <&mcp23s17_10>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi1.1.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@43 {
+		target = <&mcp23s17_11>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi1.2.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@44 {
+		target = <&mcp23s17_12>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi2.0.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@45 {
+		target = <&mcp23s17_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi2.1.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@46 {
+		target = <&mcp23s17_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi2.2.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@47 {
+		target = <&mcp23s17_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	__overrides__ {
+		s08-spi0-0-present = <0>,"+0+8",  <&mcp23s08_00>,"microchip,spi-present-mask:0";
+		s08-spi0-1-present = <0>,"+1+9",  <&mcp23s08_01>,"microchip,spi-present-mask:0";
+		s08-spi1-0-present = <0>,"+2+10", <&mcp23s08_10>,"microchip,spi-present-mask:0";
+		s08-spi1-1-present = <0>,"+3+11", <&mcp23s08_11>,"microchip,spi-present-mask:0";
+		s08-spi1-2-present = <0>,"+4+12", <&mcp23s08_12>,"microchip,spi-present-mask:0";
+		s08-spi2-0-present = <0>,"+5+13", <&mcp23s08_20>,"microchip,spi-present-mask:0";
+		s08-spi2-1-present = <0>,"+6+14", <&mcp23s08_21>,"microchip,spi-present-mask:0";
+		s08-spi2-2-present = <0>,"+7+15", <&mcp23s08_22>,"microchip,spi-present-mask:0";
+		s17-spi0-0-present = <0>,"+0+16", <&mcp23s17_00>,"microchip,spi-present-mask:0";
+		s17-spi0-1-present = <0>,"+1+17", <&mcp23s17_01>,"microchip,spi-present-mask:0";
+		s17-spi1-0-present = <0>,"+2+18", <&mcp23s17_10>,"microchip,spi-present-mask:0";
+		s17-spi1-1-present = <0>,"+3+19", <&mcp23s17_11>,"microchip,spi-present-mask:0";
+		s17-spi1-2-present = <0>,"+4+20", <&mcp23s17_12>,"microchip,spi-present-mask:0";
+		s17-spi2-0-present = <0>,"+5+21", <&mcp23s17_20>,"microchip,spi-present-mask:0";
+		s17-spi2-1-present = <0>,"+6+22", <&mcp23s17_21>,"microchip,spi-present-mask:0";
+		s17-spi2-2-present = <0>,"+7+23", <&mcp23s17_22>,"microchip,spi-present-mask:0";
+		s08-spi0-0-int-gpio = <0>,"+24+32", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s08_00>,"interrupts:0";
+		s08-spi0-1-int-gpio = <0>,"+25+33", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s08_01>,"interrupts:0";
+		s08-spi1-0-int-gpio = <0>,"+26+34", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s08_10>,"interrupts:0";
+		s08-spi1-1-int-gpio = <0>,"+27+35", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s08_11>,"interrupts:0";
+		s08-spi1-2-int-gpio = <0>,"+28+36", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s08_12>,"interrupts:0";
+		s08-spi2-0-int-gpio = <0>,"+29+37", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s08_20>,"interrupts:0";
+		s08-spi2-1-int-gpio = <0>,"+30+38", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s08_21>,"interrupts:0";
+		s08-spi2-2-int-gpio = <0>,"+31+39", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s08_22>,"interrupts:0";
+		s17-spi0-0-int-gpio = <0>,"+24+40", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s17_00>,"interrupts:0";
+		s17-spi0-1-int-gpio = <0>,"+25+41", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s17_01>,"interrupts:0";
+		s17-spi1-0-int-gpio = <0>,"+26+42", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s17_10>,"interrupts:0";
+		s17-spi1-1-int-gpio = <0>,"+27+43", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s17_11>,"interrupts:0";
+		s17-spi1-2-int-gpio = <0>,"+28+44", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s17_12>,"interrupts:0";
+		s17-spi2-0-int-gpio = <0>,"+29+45", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s17_20>,"interrupts:0";
+		s17-spi2-1-int-gpio = <0>,"+30+46", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s17_21>,"interrupts:0";
+		s17-spi2-2-int-gpio = <0>,"+31+47", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s17_22>,"interrupts:0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
new file mode 100755
index 0000000000000..03eb5486fa9c4
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
@@ -0,0 +1,73 @@
+/*
+ * Device tree overlay for mcp251x/can0 on spi0.0
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    /* disable spi-dev for spi0.0 */
+    fragment@0 {
+        target = <&spi0>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+	target = <&spidev0>;
+	__overlay__ {
+	    status = "disabled";
+	};
+    };
+
+    /* the interrupt pin of the can-controller */
+    fragment@2 {
+        target = <&gpio>;
+        __overlay__ {
+            can0_pins: can0_pins {
+                brcm,pins = <25>;
+                brcm,function = <0>; /* input */
+            };
+        };
+    };
+
+    /* the clock/oscillator of the can-controller */
+    fragment@3 {
+        target-path = "/clocks";
+        __overlay__ {
+            /* external oscillator of mcp2515 on SPI0.0 */
+            can0_osc: can0_osc {
+                compatible = "fixed-clock";
+                #clock-cells = <0>;
+                clock-frequency  = <16000000>;
+            };
+        };
+    };
+
+    /* the spi config of the can-controller itself binding everything together */
+    fragment@4 {
+        target = <&spi0>;
+        __overlay__ {
+            /* needed to avoid dtc warning */
+            #address-cells = <1>;
+            #size-cells = <0>;
+            can0: mcp2515@0 {
+                reg = <0>;
+                compatible = "microchip,mcp2515";
+                pinctrl-names = "default";
+                pinctrl-0 = <&can0_pins>;
+                spi-max-frequency = <10000000>;
+                interrupt-parent = <&gpio>;
+                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
+                clocks = <&can0_osc>;
+            };
+        };
+    };
+    __overrides__ {
+        oscillator = <&can0_osc>,"clock-frequency:0";
+        spimaxfrequency = <&can0>,"spi-max-frequency:0";
+        interrupt = <&can0_pins>,"brcm,pins:0",<&can0>,"interrupts:0";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
new file mode 100644
index 0000000000000..dc773fa3b50ce
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
@@ -0,0 +1,73 @@
+/*
+ * Device tree overlay for mcp251x/can1 on spi0.1 edited by petit_miner
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    /* disable spi-dev for spi0.1 */
+    fragment@0 {
+        target = <&spi0>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+	target = <&spidev1>;
+	__overlay__ {
+	    status = "disabled";
+	};
+    };
+
+    /* the interrupt pin of the can-controller */
+    fragment@2 {
+        target = <&gpio>;
+        __overlay__ {
+            can1_pins: can1_pins {
+                brcm,pins = <25>;
+                brcm,function = <0>; /* input */
+            };
+        };
+    };
+
+    /* the clock/oscillator of the can-controller */
+    fragment@3 {
+        target-path = "/clocks";
+        __overlay__ {
+            /* external oscillator of mcp2515 on spi0.1 */
+            can1_osc: can1_osc {
+                compatible = "fixed-clock";
+                #clock-cells = <0>;
+                clock-frequency  = <16000000>;
+            };
+        };
+    };
+
+    /* the spi config of the can-controller itself binding everything together */
+    fragment@4 {
+        target = <&spi0>;
+        __overlay__ {
+            /* needed to avoid dtc warning */
+            #address-cells = <1>;
+            #size-cells = <0>;
+            can1: mcp2515@1 {
+                reg = <1>;
+                compatible = "microchip,mcp2515";
+                pinctrl-names = "default";
+                pinctrl-0 = <&can1_pins>;
+                spi-max-frequency = <10000000>;
+                interrupt-parent = <&gpio>;
+                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
+                clocks = <&can1_osc>;
+            };
+        };
+    };
+    __overrides__ {
+        oscillator = <&can1_osc>,"clock-frequency:0";
+        spimaxfrequency = <&can1>,"spi-max-frequency:0";
+        interrupt = <&can1_pins>,"brcm,pins:0",<&can1>,"interrupts:0";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/mcp3008-overlay.dts b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
new file mode 100755
index 0000000000000..06bf4264959c3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
@@ -0,0 +1,205 @@
+/*
+ * Device tree overlay for Microchip mcp3008 10-Bit A/D Converters
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_00: mcp3008@0 {
+				compatible = "mcp3008";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_01: mcp3008@1 {
+				compatible = "mcp3008";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_10: mcp3008@0 {
+				compatible = "mcp3008";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_11: mcp3008@1 {
+				compatible = "mcp3008";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_12: mcp3008@2 {
+				compatible = "mcp3008";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_20: mcp3008@0 {
+				compatible = "mcp3008";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_21: mcp3008@1 {
+				compatible = "mcp3008";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_22: mcp3008@2 {
+				compatible = "mcp3008";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	__overrides__ {
+		spi0-0-present = <0>, "+0+8";
+		spi0-1-present = <0>, "+1+9";
+		spi1-0-present = <0>, "+2+10";
+		spi1-1-present = <0>, "+3+11";
+		spi1-2-present = <0>, "+4+12";
+		spi2-0-present = <0>, "+5+13";
+		spi2-1-present = <0>, "+6+14";
+		spi2-2-present = <0>, "+7+15";
+		spi0-0-speed = <&mcp3008_00>, "spi-max-frequency:0";
+		spi0-1-speed = <&mcp3008_01>, "spi-max-frequency:0";
+		spi1-0-speed = <&mcp3008_10>, "spi-max-frequency:0";
+		spi1-1-speed = <&mcp3008_11>, "spi-max-frequency:0";
+		spi1-2-speed = <&mcp3008_12>, "spi-max-frequency:0";
+		spi2-0-speed = <&mcp3008_20>, "spi-max-frequency:0";
+		spi2-1-speed = <&mcp3008_21>, "spi-max-frequency:0";
+		spi2-2-speed = <&mcp3008_22>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mcp3202-overlay.dts b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
new file mode 100755
index 0000000000000..9902c4614ea1f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
@@ -0,0 +1,205 @@
+/*
+ * Device tree overlay for Microchip mcp3202 12-Bit A/D Converters
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_00: mcp3202@0 {
+				compatible = "mcp3202";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_01: mcp3202@1 {
+				compatible = "mcp3202";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_10: mcp3202@0 {
+				compatible = "mcp3202";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_11: mcp3202@1 {
+				compatible = "mcp3202";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_12: mcp3202@2 {
+				compatible = "mcp3202";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_20: mcp3202@0 {
+				compatible = "mcp3202";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_21: mcp3202@1 {
+				compatible = "mcp3202";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_22: mcp3202@2 {
+				compatible = "mcp3202";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	__overrides__ {
+		spi0-0-present = <0>, "+0+8";
+		spi0-1-present = <0>, "+1+9";
+		spi1-0-present = <0>, "+2+10";
+		spi1-1-present = <0>, "+3+11";
+		spi1-2-present = <0>, "+4+12";
+		spi2-0-present = <0>, "+5+13";
+		spi2-1-present = <0>, "+6+14";
+		spi2-2-present = <0>, "+7+15";
+		spi0-0-speed = <&mcp3202_00>, "spi-max-frequency:0";
+		spi0-1-speed = <&mcp3202_01>, "spi-max-frequency:0";
+		spi1-0-speed = <&mcp3202_10>, "spi-max-frequency:0";
+		spi1-1-speed = <&mcp3202_11>, "spi-max-frequency:0";
+		spi1-2-speed = <&mcp3202_12>, "spi-max-frequency:0";
+		spi2-0-speed = <&mcp3202_20>, "spi-max-frequency:0";
+		spi2-1-speed = <&mcp3202_21>, "spi-max-frequency:0";
+		spi2-2-speed = <&mcp3202_22>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/media-center-overlay.dts b/arch/arm/boot/dts/overlays/media-center-overlay.dts
new file mode 100644
index 0000000000000..ce4db35228e9f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/media-center-overlay.dts
@@ -0,0 +1,134 @@
+/*
+ * Device Tree overlay for Media Center HAT by Pi Supply
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+
+			spidev@0{
+				status = "disabled";
+			};
+
+			spidev@1{
+				status = "disabled";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			rpi_display_pins: rpi_display_pins {
+				brcm,pins = <12 23 24 25>;
+				brcm,function = <1 1 1 0>; /* out out out in */
+				brcm,pull = <0 0 0 2>; /* - - - up */
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			rpidisplay: rpi-display@0{
+				compatible = "ilitek,ili9341";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&rpi_display_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <90>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				reset-gpios = <&gpio 23 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 12 1>;
+				debug = <0>;
+			};
+
+			rpidisplay_ts: rpi-display-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <25 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 25 0>;
+				ti,x-plate-ohms = /bits/ 16 <60>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/";
+		__overlay__ {
+			lirc_rpi: lirc_rpi {
+				compatible = "rpi,lirc-rpi";
+				pinctrl-names = "default";
+				pinctrl-0 = <&lirc_pins>;
+				status = "okay";
+
+				// Override autodetection of IR receiver circuit
+				// (0 = active high, 1 = active low, -1 = no override )
+				rpi,sense = <0xffffffff>;
+
+				// Software carrier
+				// (0 = off, 1 = on)
+				rpi,softcarrier = <1>;
+
+				// Invert output
+				// (0 = off, 1 = on)
+				rpi,invert = <0>;
+
+				// Enable debugging messages
+				// (0 = off, 1 = on)
+				rpi,debug = <0>;
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&gpio>;
+		__overlay__ {
+			lirc_pins: lirc_pins {
+				brcm,pins = <6 5>;
+				brcm,function = <1 0>; // out in
+				brcm,pull = <0 1>; // off down
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =     <&rpidisplay>,"spi-max-frequency:0";
+		rotate =    <&rpidisplay>,"rotate:0";
+		fps =       <&rpidisplay>,"fps:0";
+		debug =     <&rpidisplay>,"debug:0", 
+		            <&lirc_rpi>,"rpi,debug:0";
+		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
+		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
+		backlight = <&rpidisplay>,"led-gpios:4",
+		            <&rpi_display_pins>,"brcm,pins:0";
+
+		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
+		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
+		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
+
+		sense =         <&lirc_rpi>,"rpi,sense:0";
+		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
+		invert =        <&lirc_rpi>,"rpi,invert:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
new file mode 100644
index 0000000000000..565af7cf79d76
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
@@ -0,0 +1,36 @@
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835.h>
+
+/*
+ * Fake a higher clock rate to get a larger divisor, and thereby a lower
+ * baudrate. The real clock is 48MHz, which we scale so that requesting
+ * 38.4kHz results in an actual 31.25kHz.
+ *
+ *   48000000*38400/31250 = 58982400
+ */
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			midi_clk: midi_clk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-output-names = "uart0_pclk";
+				clock-frequency = <58982400>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&uart0>;
+		__overlay__ {
+			clocks = <&midi_clk>,
+			         <&clocks BCM2835_CLOCK_VPU>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
new file mode 100644
index 0000000000000..e0bc410acbff3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
@@ -0,0 +1,43 @@
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835-aux.h>
+
+/*
+ * Fake a higher clock rate to get a larger divisor, and thereby a lower
+ * baudrate. The real clock is 48MHz, which we scale so that requesting
+ * 38.4kHz results in an actual 31.25kHz.
+ *
+ *   48000000*38400/31250 = 58982400
+ */
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			midi_clk: clock@5 {
+				compatible = "fixed-factor-clock";
+				#clock-cells = <0>;
+				clocks = <&aux BCM2835_AUX_CLOCK_UART>;
+				clock-mult = <38400>;
+				clock-div  = <31250>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&uart1>;
+		__overlay__ {
+			clocks = <&midi_clk>;
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			clock-output-names = "aux_uart", "aux_spi1", "aux_spi2";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mmc-overlay.dts b/arch/arm/boot/dts/overlays/mmc-overlay.dts
new file mode 100644
index 0000000000000..88251ad653917
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mmc-overlay.dts
@@ -0,0 +1,39 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		frag0: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&mmc_pins>;
+			bus-width = <4>;
+			brcm,overclock-50 = <0>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			mmc_pins: mmc_pins {
+				brcm,pins = <48 49 50 51 52 53>;
+				brcm,function = <7>; /* alt3 */
+				brcm,pull = <0 2 2 2 2 2>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sdhost>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	__overrides__ {
+		overclock_50     = <&frag0>,"brcm,overclock-50:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mpu6050-overlay.dts b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
new file mode 100644
index 0000000000000..06037969c3abb
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
@@ -0,0 +1,28 @@
+// Definitions for MPU6050
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target = <&i2c1>;
+                __overlay__ {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        status = "okay";
+                        clock-frequency = <400000>;
+
+                        mpu6050: mpu6050@68 {
+                                compatible = "invensense,mpu6050";
+                                reg = <0x68>;
+                                interrupt-parent = <&gpio>;
+                                interrupts = <4 1>;
+                        };
+                };
+        };
+
+        __overrides__ {
+                interrupt = <&mpu6050>,"interrupts:0";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/mz61581-overlay.dts b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
new file mode 100644
index 0000000000000..2c29aaed44c59
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
@@ -0,0 +1,117 @@
+/*
+ * Device Tree overlay for MZ61581-PI-EXT 2014.12.28 by Tontec
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			mz61581_pins: mz61581_pins {
+				brcm,pins = <4 15 18 25>;
+				brcm,function = <0 1 1 1>; /* in out out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mz61581: mz61581@0{
+				compatible = "samsung,s6d02a1";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&mz61581_pins>;
+
+				spi-max-frequency = <128000000>;
+				spi-cpol;
+				spi-cpha;
+
+				width = <320>;
+				height = <480>;
+				rotate = <270>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				txbuflen = <32768>;
+
+				reset-gpios = <&gpio 15 0>;
+				dc-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 0>;
+
+				init = <0x10000b0 00
+					0x1000011
+					0x20000ff
+					0x10000b3 0x02 0x00 0x00 0x00
+					0x10000c0 0x13 0x3b 0x00 0x02 0x00 0x01 0x00 0x43
+					0x10000c1 0x08 0x16 0x08 0x08
+					0x10000c4 0x11 0x07 0x03 0x03
+					0x10000c6 0x00
+					0x10000c8 0x03 0x03 0x13 0x5c 0x03 0x07 0x14 0x08 0x00 0x21 0x08 0x14 0x07 0x53 0x0c 0x13 0x03 0x03 0x21 0x00
+					0x1000035 0x00
+					0x1000036 0xa0
+					0x100003a 0x55
+					0x1000044 0x00 0x01
+					0x10000d0 0x07 0x07 0x1d 0x03
+					0x10000d1 0x03 0x30 0x10
+					0x10000d2 0x03 0x14 0x04
+					0x1000029
+					0x100002c>;
+
+				/* This is a workaround to make sure the init sequence slows down and doesn't fail */
+				debug = <3>;
+			};
+
+			mz61581_ts: mz61581_ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <4 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 4 0>;
+
+				ti,x-plate-ohms = /bits/ 16 <60>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =   <&mz61581>, "spi-max-frequency:0";
+		rotate =  <&mz61581>, "rotate:0";
+		fps =     <&mz61581>, "fps:0";
+		txbuflen = <&mz61581>, "txbuflen:0";
+		debug =   <&mz61581>, "debug:0";
+		xohms =   <&mz61581_ts>,"ti,x-plate-ohms;0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/papirus-overlay.dts b/arch/arm/boot/dts/overlays/papirus-overlay.dts
new file mode 100644
index 0000000000000..58eb8847f9ed8
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/papirus-overlay.dts
@@ -0,0 +1,89 @@
+/* PaPiRus ePaper Screen by Pi Supply */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			display_temp: lm75@48 {
+				compatible = "lm75b";
+				reg = <0x48>;
+				status = "okay";
+				#thermal-sensor-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			thermal-zones {
+				display {
+					polling-delay-passive = <0>;
+					polling-delay = <0>;
+					thermal-sensors = <&display_temp>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+
+			spidev@0{
+				status = "disabled";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			repaper_pins: repaper_pins {
+				brcm,pins = <14 15 23 24 25>;
+				brcm,function = <1 1 1 1 0>; /* out out out out in */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			repaper: repaper@0{
+				compatible = "not_set";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&repaper_pins>;
+
+				spi-max-frequency = <8000000>;
+
+				panel-on-gpios = <&gpio 23 0>;
+				border-gpios = <&gpio 14 0>;
+				discharge-gpios = <&gpio 15 0>;
+				reset-gpios = <&gpio 24 0>;
+				busy-gpios = <&gpio 25 0>;
+
+				repaper-thermal-zone = "display";
+			};
+		};
+	};
+
+	__overrides__ {
+		panel = <&repaper>, "compatible";
+		speed = <&repaper>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
new file mode 100644
index 0000000000000..14a59dcf13ca6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/* Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
+   from the VPU. There is a special driver for this with a separate DT node,
+   which has the unfortunate consequence of breaking the act_led_gpio and
+   act_led_activelow dtparams.
+
+   This overlay changes the GPIO controller back to the standard one and
+   restores the dtparams.
+*/
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&act_led>;
+		frag0: __overlay__ {
+			gpios = <&gpio 0 0>;
+		};
+	};
+
+	__overrides__ {
+		gpio = <&frag0>,"gpios:4";
+		activelow = <&frag0>,"gpios:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
new file mode 100644
index 0000000000000..87cf345f9641e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
@@ -0,0 +1,46 @@
+/dts-v1/;
+/plugin/;
+
+/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
+   To disable the systemd service that initialises the modem so it doesn't use
+   the UART:
+
+       sudo systemctl disable hciuart
+*/
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&uart0_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@3 {
+		target-path = "/aliases";
+		__overlay__ {
+			serial0 = "/soc/serial@7e201000";
+			serial1 = "/soc/serial@7e215040";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
new file mode 100644
index 0000000000000..017199554bf2f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
@@ -0,0 +1,13 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
new file mode 100644
index 0000000000000..98381656945f5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
@@ -0,0 +1,74 @@
+/dts-v1/;
+/plugin/;
+
+/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
+   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
+   usable baudrate.
+
+   It is also necessary to edit /lib/systemd/system/hciuart.service and
+   replace ttyAMA0 with ttyS0, unless you have a system with udev rules
+   that create /dev/serial0 and /dev/serial1, in which case use /dev/serial1
+   instead because it will always be correct.
+
+   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
+   then the firmware will replace with the appropriate port whether or not
+   this overlay is used.
+*/
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart1>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart1_pins &bt_pins &fake_bt_cts>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&uart0_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@3 {
+		target = <&uart1_pins>;
+		__overlay__ {
+			brcm,pins = <32 33>;
+			brcm,function = <2>; /* alt5=UART1 */
+			brcm,pull = <0 2>;
+		};
+	};
+
+	fragment@4 {
+		target = <&gpio>;
+		__overlay__ {
+			fake_bt_cts: fake_bt_cts {
+				brcm,pins = <31>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/aliases";
+		__overlay__ {
+			serial0 = "/soc/serial@7e201000";
+			serial1 = "/soc/serial@7e215040";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pibell-overlay.dts b/arch/arm/boot/dts/overlays/pibell-overlay.dts
new file mode 100644
index 0000000000000..6e71c159357ad
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pibell-overlay.dts
@@ -0,0 +1,81 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target-path = "/";
+        __overlay__ {
+            codec_out: spdif-transmitter {
+                #address-cells = <0>;
+                #size-cells = <0>;
+                #sound-dai-cells = <0>;
+                compatible = "linux,spdif-dit";
+                status = "okay";
+            };
+
+            codec_in: card-codec {
+                #sound-dai-cells = <0>;
+                compatible = "invensense,ics43432";
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@1 {
+        target = <&i2s>;
+        __overlay__ {
+            #sound-dai-cells = <0>;
+            status = "okay";
+        };
+    };
+
+    fragment@2 {
+        target = <&sound>;
+        snd: __overlay__ {
+            compatible = "simple-audio-card";
+            simple-audio-card,name = "PiBell";
+
+            status="okay";
+
+            capture_link: simple-audio-card,dai-link@0 {
+                format = "i2s";
+
+                r_cpu_dai: cpu {
+                    sound-dai = <&i2s>;
+
+/* example TDM slot configuration
+                    dai-tdm-slot-num = <2>;
+                    dai-tdm-slot-width = <32>;
+*/
+                };
+
+                r_codec_dai: codec {
+                    sound-dai = <&codec_in>;
+                };
+            };
+
+            playback_link: simple-audio-card,dai-link@1 {
+                format = "i2s";
+
+                p_cpu_dai: cpu {
+                    sound-dai = <&i2s>;
+
+/* example TDM slot configuration
+                    dai-tdm-slot-num = <2>;
+                    dai-tdm-slot-width = <32>;
+*/
+                };
+
+                p_codec_dai: codec {
+                    sound-dai = <&codec_out>;
+                };
+            };
+        };
+    };
+
+    __overrides__ {
+        alsaname = <&snd>, "simple-audio-card,name";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/piscreen-overlay.dts b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
new file mode 100644
index 0000000000000..40a1f295346e3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
@@ -0,0 +1,102 @@
+/*
+ * Device Tree overlay for PiScreen 3.5" display shield by Ozzmaker
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			piscreen_pins: piscreen_pins {
+				brcm,pins = <17 25 24 22>;
+				brcm,function = <0 1 1 1>; /* in out out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			piscreen: piscreen@0{
+				compatible = "ilitek,ili9486";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&piscreen_pins>;
+
+				spi-max-frequency = <24000000>;
+				rotate = <270>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				regwidth = <16>;
+				reset-gpios = <&gpio 25 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 22 1>;
+				debug = <0>;
+
+				init = <0x10000b0 0x00
+				        0x1000011
+					0x20000ff
+					0x100003a 0x55
+					0x1000036 0x28
+					0x10000c2 0x44
+					0x10000c5 0x00 0x00 0x00 0x00
+					0x10000e0 0x0f 0x1f 0x1c 0x0c 0x0f 0x08 0x48 0x98 0x37 0x0a 0x13 0x04 0x11 0x0d 0x00
+					0x10000e1 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
+					0x10000e2 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
+					0x1000011
+					0x1000029>;
+			};
+
+			piscreen_ts: piscreen-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,swap-xy;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =		<&piscreen>,"spi-max-frequency:0";
+		rotate =	<&piscreen>,"rotate:0";
+		fps =		<&piscreen>,"fps:0";
+		debug =		<&piscreen>,"debug:0";
+		xohms =		<&piscreen_ts>,"ti,x-plate-ohms;0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
new file mode 100644
index 0000000000000..9c0bed893057b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
@@ -0,0 +1,106 @@
+ /*
+ * Device Tree overlay for PiScreen2 3.5" TFT with resistive touch  by Ozzmaker.com
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			piscreen2_pins: piscreen2_pins {
+				brcm,pins = <17 25 24 22>;
+				brcm,function = <0 1 1 1>; /* in out out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			piscreen2: piscreen2@0{
+				compatible = "ilitek,ili9486";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&piscreen2_pins>;
+				bgr;
+				spi-max-frequency = <64000000>;
+				rotate = <90>;
+				fps = <30>;
+				buswidth = <8>;
+				regwidth = <16>;
+				txbuflen = <32768>;
+				reset-gpios = <&gpio 25 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 22 1>;
+				debug = <0>;
+
+                                init = <0x10000b0 0x00
+                                        0x1000011
+                                        0x20000ff
+                                        0x100003a 0x55
+                                        0x1000036 0x28
+                                        0x10000c0 0x11 0x09
+                                        0x10000c1 0x41
+                                        0x10000c5 0x00 0x00 0x00 0x00
+                                        0x10000b6 0x00 0x02
+                                        0x10000f7 0xa9 0x51 0x2c 0x2
+                                        0x10000be 0x00 0x04
+                                        0x10000e9 0x00
+                                        0x1000011
+                                        0x1000029>;
+
+			};
+
+			piscreen2_ts: piscreen2-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,swap-xy;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =		<&piscreen2>,"spi-max-frequency:0";
+		rotate =	<&piscreen2>,"rotate:0";
+		fps =		<&piscreen2>,"fps:0";
+		debug =		<&piscreen2>,"debug:0";
+		xohms =		<&piscreen2_ts>,"ti,x-plate-ohms;0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/pisound-overlay.dts b/arch/arm/boot/dts/overlays/pisound-overlay.dts
new file mode 100644
index 0000000000000..0893717af4e01
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pisound-overlay.dts
@@ -0,0 +1,120 @@
+/*
+ * Pisound Linux kernel module.
+ * Copyright (C) 2016-2017  Vilniaus Blokas UAB, https://blokas.io/pisound
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@3 {
+		target = <&spi0>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pisound_spi: pisound_spi@0{
+				compatible = "blokaslabs,pisound-spi";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&spi0_pins>;
+				spi-max-frequency = <1000000>;
+			};
+		};
+	};
+
+	fragment@4 {
+		target-path = "/";
+		__overlay__ {
+			pcm5102a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5102a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "blokaslabs,pisound";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			pinctrl-0 = <&pisound_button_pins>;
+
+			osr-gpios =
+				<&gpio 13 GPIO_ACTIVE_HIGH>,
+				<&gpio 26 GPIO_ACTIVE_HIGH>,
+				<&gpio 16 GPIO_ACTIVE_HIGH>;
+
+			reset-gpios =
+				<&gpio 12 GPIO_ACTIVE_HIGH>,
+				<&gpio 24 GPIO_ACTIVE_HIGH>;
+
+			data_available-gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
+
+			button-gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	fragment@6 {
+		target = <&gpio>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pisound_button_pins>;
+
+			pisound_button_pins: pisound_button_pins {
+				brcm,pins = <17>;
+				brcm,function = <0>; // Input
+				brcm,pull = <2>; // Pull-Up
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pitft22-overlay.dts b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
new file mode 100644
index 0000000000000..894ba2292f6be
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
@@ -0,0 +1,69 @@
+/*
+ * Device Tree overlay for pitft by Adafruit
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+        fragment@0 {
+                target = <&spi0>;
+                __overlay__ {
+                        status = "okay";
+
+                        spidev@0{
+                                status = "disabled";
+                        };
+
+                        spidev@1{
+                                status = "disabled";
+                        };
+                };
+        };
+
+        fragment@1 {
+                target = <&gpio>;
+                __overlay__ {
+                        pitft_pins: pitft_pins {
+                                brcm,pins = <25>;
+                                brcm,function = <1>; /* out */
+                                brcm,pull = <0>; /* none */
+                        };
+                };
+        };
+
+        fragment@2 {
+                target = <&spi0>;
+                __overlay__ {
+                        /* needed to avoid dtc warning */
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        pitft: pitft@0{
+                                compatible = "ilitek,ili9340";
+                                reg = <0>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pitft_pins>;
+
+                                spi-max-frequency = <32000000>;
+                                rotate = <90>;
+                                fps = <25>;
+                                bgr;
+                                buswidth = <8>;
+                                dc-gpios = <&gpio 25 0>;
+                                debug = <0>;
+                        };
+
+                };
+        };
+
+        __overrides__ {
+                speed =   <&pitft>,"spi-max-frequency:0";
+                rotate =  <&pitft>,"rotate:0";
+                fps =     <&pitft>,"fps:0";
+                debug =   <&pitft>,"debug:0";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
new file mode 100644
index 0000000000000..5c0752655c706
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
@@ -0,0 +1,91 @@
+/*
+ * Device Tree overlay for Adafruit PiTFT 2.8" capacitive touch screen
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+        fragment@0 {
+                target = <&spi0>;
+                __overlay__ {
+                        status = "okay";
+                };
+        };
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+        fragment@2 {
+                target = <&gpio>;
+                __overlay__ {
+                        pitft_pins: pitft_pins {
+                                brcm,pins = <24 25>;
+                                brcm,function = <0 1>; /* in out */
+                                brcm,pull = <2 0>; /* pullup none */
+                        };
+                };
+        };
+
+        fragment@3 {
+                target = <&spi0>;
+                __overlay__ {
+                        /* needed to avoid dtc warning */
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        pitft: pitft@0{
+                                compatible = "ilitek,ili9340";
+                                reg = <0>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pitft_pins>;
+
+                                spi-max-frequency = <32000000>;
+                                rotate = <90>;
+                                fps = <25>;
+                                bgr;
+                                buswidth = <8>;
+                                dc-gpios = <&gpio 25 0>;
+                                debug = <0>;
+                        };
+                };
+        };
+
+        fragment@4 {
+                target = <&i2c1>;
+                __overlay__ {
+                        /* needed to avoid dtc warning */
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        ft6236: ft6236@38 {
+                                compatible = "focaltech,ft6236";
+                                reg = <0x38>;
+
+                                interrupt-parent = <&gpio>;
+                                interrupts = <24 2>;
+                                touchscreen-size-x = <240>;
+                                touchscreen-size-y = <320>;
+                        };
+                };
+        };
+
+        __overrides__ {
+                speed =   <&pitft>,"spi-max-frequency:0";
+                rotate =  <&pitft>,"rotate:0";
+                fps =     <&pitft>,"fps:0";
+                debug =   <&pitft>,"debug:0";
+                touch-sizex = <&ft6236>,"touchscreen-size-x?";
+                touch-sizey = <&ft6236>,"touchscreen-size-y?";
+                touch-invx  = <&ft6236>,"touchscreen-inverted-x?";
+                touch-invy  = <&ft6236>,"touchscreen-inverted-y?";
+                touch-swapxy = <&ft6236>,"touchscreen-swapped-x-y?";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
new file mode 100644
index 0000000000000..ed2afc2f7fd65
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
@@ -0,0 +1,121 @@
+/*
+ * Device Tree overlay for Adafruit PiTFT 2.8" resistive touch screen
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			pitft_pins: pitft_pins {
+				brcm,pins = <24 25>;
+				brcm,function = <0 1>; /* in out */
+				brcm,pull = <2 0>; /* pullup none */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pitft: pitft@0{
+				compatible = "ilitek,ili9340";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&pitft_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <90>;
+				fps = <25>;
+				bgr;
+				buswidth = <8>;
+				dc-gpios = <&gpio 25 0>;
+				debug = <0>;
+			};
+
+			pitft_ts@1 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				compatible = "st,stmpe610";
+				reg = <1>;
+
+				spi-max-frequency = <500000>;
+				irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
+				interrupts = <24 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				interrupt-controller;
+
+				stmpe_touchscreen {
+					compatible = "st,stmpe-ts";
+					st,sample-time = <4>;
+					st,mod-12b = <1>;
+					st,ref-sel = <0>;
+					st,adc-freq = <2>;
+					st,ave-ctrl = <3>;
+					st,touch-det-delay = <4>;
+					st,settling = <2>;
+					st,fraction-z = <7>;
+					st,i-drive = <0>;
+				};
+
+				stmpe_gpio: stmpe_gpio {
+					#gpio-cells = <2>;
+					compatible = "st,stmpe-gpio";
+					/*
+					 * only GPIO2 is wired/available
+					 * and it is wired to the backlight
+					 */
+					st,norequest-mask = <0x7b>;
+				};
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/soc";
+		__overlay__ {
+			backlight {
+				compatible = "gpio-backlight";
+				gpios = <&stmpe_gpio 2 0>;
+				default-on;
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =   <&pitft>,"spi-max-frequency:0";
+		rotate =  <&pitft>,"rotate:0";
+		fps =     <&pitft>,"fps:0";
+		debug =   <&pitft>,"debug:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
new file mode 100644
index 0000000000000..25cb5cc9576da
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
@@ -0,0 +1,121 @@
+/*
+ * Device Tree overlay for Adafruit PiTFT 3.5" resistive touch screen
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			pitft_pins: pitft_pins {
+				brcm,pins = <24 25>;
+				brcm,function = <0 1>; /* in out */
+				brcm,pull = <2 0>; /* pullup none */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pitft: pitft@0{
+				compatible = "himax,hx8357d";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&pitft_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <90>;
+				fps = <25>;
+				bgr;
+				buswidth = <8>;
+				dc-gpios = <&gpio 25 0>;
+				debug = <0>;
+			};
+
+			pitft_ts@1 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				compatible = "st,stmpe610";
+				reg = <1>;
+
+				spi-max-frequency = <500000>;
+				irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
+				interrupts = <24 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				interrupt-controller;
+
+				stmpe_touchscreen {
+					compatible = "st,stmpe-ts";
+					st,sample-time = <4>;
+					st,mod-12b = <1>;
+					st,ref-sel = <0>;
+					st,adc-freq = <2>;
+					st,ave-ctrl = <3>;
+					st,touch-det-delay = <4>;
+					st,settling = <2>;
+					st,fraction-z = <7>;
+					st,i-drive = <0>;
+				};
+
+				stmpe_gpio: stmpe_gpio {
+					#gpio-cells = <2>;
+					compatible = "st,stmpe-gpio";
+					/*
+					 * only GPIO2 is wired/available
+					 * and it is wired to the backlight
+					 */
+					st,norequest-mask = <0x7b>;
+				};
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/soc";
+		__overlay__ {
+			backlight {
+				compatible = "gpio-backlight";
+				gpios = <&stmpe_gpio 2 0>;
+				default-on;
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =   <&pitft>,"spi-max-frequency:0";
+		rotate =  <&pitft>,"rotate:0";
+		fps =     <&pitft>,"fps:0";
+		debug =   <&pitft>,"debug:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
new file mode 100644
index 0000000000000..af29b870f1a18
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
@@ -0,0 +1,38 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			pps: pps@12 {
+				compatible = "pps-gpio";
+				pinctrl-names = "default";
+				pinctrl-0 = <&pps_pins>;
+				gpios = <&gpio 18 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			pps_pins: pps_pins@12 {
+				brcm,pins =     <18>;
+				brcm,function = <0>;    // in
+				brcm,pull =     <0>;    // off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin = <&pps>,"gpios:4",
+			  <&pps>,"reg:0",
+			  <&pps_pins>,"brcm,pins:0",
+			  <&pps_pins>,"reg:0";
+		assert_falling_edge = <&pps>,"assert-falling-edge?";
+		capture_clear = <&pps>,"capture-clear?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
new file mode 100644
index 0000000000000..abdeddd0f2c87
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
@@ -0,0 +1,47 @@
+/dts-v1/;
+/plugin/;
+
+/*
+This is the 2-channel overlay - only use it if you need both channels.
+
+Legal pin,function combinations for each channel:
+  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+
+N.B.:
+  1) Pin 18 is the only one available on all platforms, and
+     it is the one used by the I2S audio interface.
+     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+  2) The onboard analogue audio output uses both PWM channels.
+  3) So be careful mixing audio and PWM.
+*/
+
+/ {
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			pwm_pins: pwm_pins {
+				brcm,pins = <18 19>;
+				brcm,function = <2 2>; /* Alt5 */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pwm>;
+		frag1: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm_pins>;
+			assigned-clock-rates = <100000000>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		pin   = <&pwm_pins>,"brcm,pins:0";
+		pin2  = <&pwm_pins>,"brcm,pins:4";
+		func  = <&pwm_pins>,"brcm,function:0";
+		func2 = <&pwm_pins>,"brcm,function:4";
+		clock = <&frag1>,"assigned-clock-rates:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
new file mode 100644
index 0000000000000..141c126fe33b9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
@@ -0,0 +1,40 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			pwm0_pins: pwm0_pins {
+				brcm,pins = <18>;
+				brcm,function = <2>; /* Alt5 */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pwm>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			pwm-ir-transmitter {
+				compatible = "pwm-ir-tx";
+				pwms = <&pwm 0 100>;
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio_pin = <&pwm0_pins>, "brcm,pins:0";
+		func = <&pwm0_pins>,"brcm,function:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pwm-overlay.dts b/arch/arm/boot/dts/overlays/pwm-overlay.dts
new file mode 100644
index 0000000000000..27809e8dc7466
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pwm-overlay.dts
@@ -0,0 +1,43 @@
+/dts-v1/;
+/plugin/;
+
+/*
+Legal pin,function combinations for each channel:
+  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+
+N.B.:
+  1) Pin 18 is the only one available on all platforms, and
+     it is the one used by the I2S audio interface.
+     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+  2) The onboard analogue audio output uses both PWM channels.
+  3) So be careful mixing audio and PWM.
+*/
+
+/ {
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			pwm_pins: pwm_pins {
+				brcm,pins = <18>;
+				brcm,function = <2>; /* Alt5 */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pwm>;
+		frag1: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm_pins>;
+			assigned-clock-rates = <100000000>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		pin   = <&pwm_pins>,"brcm,pins:0";
+		func  = <&pwm_pins>,"brcm,function:0";
+		clock = <&frag1>,"assigned-clock-rates:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/qca7000-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
new file mode 100644
index 0000000000000..b4e601396c495
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
@@ -0,0 +1,52 @@
+// Overlay for the Qualcomm Atheros QCA7000 on I2SE's PLC Stamp micro EVK
+// Visit: https://www.i2se.com/product/plc-stamp-micro-evk for details
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			spidev@0 {
+				status = "disabled";
+			};
+
+			eth1: qca7000@0 {
+				compatible = "qca,qca7000";
+				reg = <0>; /* CE0 */
+				pinctrl-names = "default";
+				pinctrl-0 = <&eth1_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <23 0x1>; /* rising edge */
+				spi-max-frequency = <12000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			eth1_pins: eth1_pins {
+				brcm,pins = <23>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&eth1>, "interrupts:0",
+		          <&eth1_pins>, "brcm,pins:0";
+		speed   = <&eth1>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
new file mode 100644
index 0000000000000..819f400a90546
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
@@ -0,0 +1,59 @@
+// Device tree overlay for GPIO connected rotary encoder.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			rotary_pins: rotary_pins@4 {
+				brcm,pins = <4 17>; /* gpio 4 17 */
+				brcm,function = <0 0>; /* input */
+				brcm,pull = <2 2>; /* pull-up */
+			};
+
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			rotary: rotary@4 {
+				compatible = "rotary-encoder";
+				status = "okay";
+				pinctrl-names = "default";
+				pinctrl-0 = <&rotary_pins>;
+				gpios = <&gpio 4 0>, <&gpio 17 0>;
+				linux,axis = <0>; /* REL_X */
+				rotary-encoder,encoding = "gray";
+				rotary-encoder,steps = <24>; /* 24 default */
+				rotary-encoder,steps-per-period = <1>; /* corresponds to full period mode. See README */
+			};
+		};
+
+	};  
+
+	__overrides__ {
+		pin_a =		    <&rotary>,"gpios:4",
+				    <&rotary_pins>,"brcm,pins:0",
+				    /* modify reg values to allow multiple instantiation */
+				    <&rotary>,"reg:0",
+				    <&rotary_pins>,"reg:0";
+		pin_b =		    <&rotary>,"gpios:16",
+				    <&rotary_pins>,"brcm,pins:4";
+		relative_axis =     <&rotary>,"rotary-encoder,relative-axis?";
+		linux_axis =        <&rotary>,"linux,axis:0";
+		rollover =          <&rotary>,"rotary-encoder,rollover?";
+		steps-per-period =  <&rotary>,"rotary-encoder,steps-per-period:0";
+		steps =             <&rotary>,"rotary-encoder,steps:0";
+		wakeup =            <&rotary>,"wakeup-source?";
+		encoding =          <&rotary>,"rotary-encoder,encoding";
+                /* legacy parameters*/
+		rotary0_pin_a =     <&rotary>,"gpios:4",
+		                    <&rotary_pins>,"brcm,pins:0";
+		rotary0_pin_b =     <&rotary>,"gpios:16",
+		                    <&rotary_pins>,"brcm,pins:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
new file mode 100644
index 0000000000000..c021d02bb75ff
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
@@ -0,0 +1,21 @@
+/*
+ * Devicetree overlay for mailbox-driven Raspberry Pi DSI Display
+ * backlight controller
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			rpi_backlight: rpi_backlight {
+				compatible = "raspberrypi,rpi-backlight";
+				firmware = <&firmware>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
new file mode 100644
index 0000000000000..cf85f0af22406
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
@@ -0,0 +1,146 @@
+// Definitions for the Cirrus Logic Audio Card
+/dts-v1/;
+/plugin/;
+#include <dt-bindings/pinctrl/bcm2835.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/mfd/arizona.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			wlf_pins: wlf_pins {
+				brcm,pins = <17 22 27 8>;
+				brcm,function = <
+					BCM2835_FSEL_GPIO_OUT
+					BCM2835_FSEL_GPIO_OUT
+					BCM2835_FSEL_GPIO_IN
+					BCM2835_FSEL_GPIO_OUT
+				>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			rpi_cirrus_reg_1v8: rpi_cirrus_reg_1v8 {
+				compatible = "regulator-fixed";
+				regulator-name = "RPi-Cirrus 1v8";
+				regulator-min-microvolt = <1800000>;
+				regulator-max-microvolt = <1800000>;
+				regulator-always-on;
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&spi0>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			spidev@0{
+				status = "disabled";
+			};
+
+			spidev@1{
+				status = "disabled";
+			};
+
+			wm5102@1{
+				compatible = "wlf,wm5102";
+				reg = <1>;
+
+				spi-max-frequency = <500000>;
+
+				interrupt-parent = <&gpio>;
+				interrupts = <27 8>;
+				interrupt-controller;
+				#interrupt-cells = <2>;
+
+				gpio-controller;
+				#gpio-cells = <2>;
+
+				LDOVDD-supply = <&rpi_cirrus_reg_1v8>;
+				AVDD-supply = <&rpi_cirrus_reg_1v8>;
+				DBVDD1-supply = <&rpi_cirrus_reg_1v8>;
+				DBVDD2-supply = <&vdd_3v3_reg>;
+				DBVDD3-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&rpi_cirrus_reg_1v8>;
+				SPKVDDL-supply = <&vdd_5v0_reg>;
+				SPKVDDR-supply = <&vdd_5v0_reg>;
+				DCVDD-supply = <&arizona_ldo1>;
+
+				wlf,reset = <&gpio 17 GPIO_ACTIVE_HIGH>;
+				wlf,ldoena = <&gpio 22 GPIO_ACTIVE_HIGH>;
+				wlf,gpio-defaults = <
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+				>;
+				wlf,micd-configs = <0 1 0>;
+				wlf,dmic-ref = <
+					ARIZONA_DMIC_MICVDD
+					ARIZONA_DMIC_MICBIAS2
+					ARIZONA_DMIC_MICVDD
+					ARIZONA_DMIC_MICVDD
+				>;
+				wlf,inmode = <
+					ARIZONA_INMODE_DIFF
+					ARIZONA_INMODE_DMIC
+					ARIZONA_INMODE_SE
+					ARIZONA_INMODE_DIFF
+				>;
+				status = "okay";
+
+				arizona_ldo1: ldo1 {
+					regulator-name = "LDO1";
+					// default constraints as in
+					// arizona-ldo1.c
+					regulator-min-microvolt = <1200000>;
+					regulator-max-microvolt = <1800000>;
+				};
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c1>;
+		__overlay__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			wm8804@3b {
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				status = "okay";
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				wlf,reset-gpio = <&gpio 8 GPIO_ACTIVE_HIGH>;
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "wlf,rpi-cirrus";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
new file mode 100644
index 0000000000000..a442c8f0ec01b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
@@ -0,0 +1,34 @@
+// Definitions for RPi DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			pcm1794a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm1794a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "rpi,rpi-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-display-overlay.dts b/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
new file mode 100644
index 0000000000000..533b5c140b544
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
@@ -0,0 +1,91 @@
+/*
+ * Device Tree overlay for rpi-display by Watterott
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			rpi_display_pins: rpi_display_pins {
+				brcm,pins = <18 23 24 25>;
+				brcm,function = <1 1 1 0>; /* out out out in */
+				brcm,pull = <0 0 0 2>; /* - - - up */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			rpidisplay: rpi-display@0{
+				compatible = "ilitek,ili9341";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&rpi_display_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <270>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				reset-gpios = <&gpio 23 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 18 1>;
+				debug = <0>;
+			};
+
+			rpidisplay_ts: rpi-display-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <25 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 25 0>;
+				ti,x-plate-ohms = /bits/ 16 <60>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =     <&rpidisplay>,"spi-max-frequency:0";
+		rotate =    <&rpidisplay>,"rotate:0";
+		fps =       <&rpidisplay>,"fps:0";
+		debug =     <&rpidisplay>,"debug:0";
+		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
+		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
+		backlight = <&rpidisplay>,"led-gpios:4",
+		            <&rpi_display_pins>,"brcm,pins:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
new file mode 100644
index 0000000000000..1915ce188bf30
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
@@ -0,0 +1,30 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			rpi_ft5406: rpi_ft5406 {
+				compatible = "rpi,rpi-ft5406";
+				firmware = <&firmware>;
+				status = "okay";
+				touchscreen-size-x = <800>;
+				touchscreen-size-y = <480>;
+				touchscreen-inverted-x = <0>;
+				touchscreen-inverted-y = <0>;
+				touchscreen-swapped-x-y = <0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		touchscreen-size-x = <&rpi_ft5406>,"touchscreen-size-x:0";
+		touchscreen-size-y = <&rpi_ft5406>,"touchscreen-size-y:0";
+		touchscreen-inverted-x = <&rpi_ft5406>,"touchscreen-inverted-x:0";
+		touchscreen-inverted-y = <&rpi_ft5406>,"touchscreen-inverted-y:0";
+		touchscreen-swapped-x-y = <&rpi_ft5406>,"touchscreen-swapped-x-y:0";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts b/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
new file mode 100644
index 0000000000000..8332d0159a45b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for Rpi-Proto
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8731@1a {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8731";
+				reg = <0x1a>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "rpi,rpi-proto";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
new file mode 100644
index 0000000000000..27153240e1be5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
@@ -0,0 +1,47 @@
+// rpi-sense HAT
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			rpi-sense@46 {
+				compatible = "rpi,rpi-sense";
+				reg = <0x46>;
+				keys-int-gpios = <&gpio 23 1>;
+				status = "okay";
+			};
+
+			lsm9ds1-magn@1c {
+				compatible = "st,lsm9ds1-magn";
+				reg = <0x1c>;
+				status = "okay";
+			};
+
+			lsm9ds1-accel6a {
+				compatible = "st,lsm9ds1-accel";
+				reg = <0x6a>;
+				status = "okay";
+			};
+
+			lps25h-press@5c {
+				compatible = "st,lps25h-press";
+				reg = <0x5c>;
+				status = "okay";
+			};
+
+			hts221-humid@5f {
+				compatible = "st,hts221-humid";
+				reg = <0x5f>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
new file mode 100644
index 0000000000000..a68f6f793d8ef
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
@@ -0,0 +1,31 @@
+// rpi-tv HAT
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			spidev@0 {
+				status = "disabled";
+			};
+
+			cxd2880@0 {
+				compatible = "sony,cxd2880";
+				reg = <0>; /* CE0 */
+				spi-max-frequency = <50000000>;
+				status = "okay";
+			};
+		};
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
new file mode 100644
index 0000000000000..f8d48233e28c7
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for RRA DigiDAC1 Audio card
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				status = "okay";
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+			};
+
+			wm8742: wm8741@1a {
+				compatible = "wlf,wm8741";
+				reg = <0x1a>;
+				status = "okay";
+				AVDD-supply = <&vdd_5v0_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "rra,digidac1-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
new file mode 100644
index 0000000000000..339d0d17c01ff
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
@@ -0,0 +1,37 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sc16is750: sc16is750@48 {
+				compatible = "nxp,sc16is750";
+				reg = <0x48>; /* address */
+				clocks = <&sc16is750_clk>;
+				interrupt-parent = <&gpio>;
+				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
+				#gpio-cells = <2>;
+
+				sc16is750_clk: sc16is750_clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <14745600>;
+				};
+			};
+		};
+	};
+
+
+	__overrides__ {
+		int_pin = <&sc16is750>,"interrupts:0";
+		addr = <&sc16is750>,"reg:0";
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
new file mode 100644
index 0000000000000..e43e81d5a28f9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
@@ -0,0 +1,40 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c1>;
+
+		frag1: __overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sc16is752: sc16is752@48 {
+				compatible = "nxp,sc16is752";
+				reg = <0x48>; // i2c address
+				clocks = <&sc16is752_clk>;
+				interrupt-parent = <&gpio>;
+				interrupts = <24 0x2>; /* IRQ_TYPE_EDGE_FALLING */
+				gpio-controller;
+				#gpio-cells = <0>;
+				i2c-max-frequency = <400000>;
+				status = "okay";
+
+				sc16is752_clk: sc16is752_clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <14745600>;
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&sc16is752>,"interrupts:0";
+		addr = <&sc16is752>,"reg:0";
+		xtal = <&sc16is752>,"clock-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
new file mode 100644
index 0000000000000..d0a9e82dbea14
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
@@ -0,0 +1,61 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>;
+			status = "okay";
+
+			sc16is752: sc16is752@0 {
+				compatible = "nxp,sc16is752";
+				reg = <0>; /* CE0 */
+				clocks = <&sc16is752_clk>;
+				interrupt-parent = <&gpio>;
+				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
+				#gpio-controller;
+				#gpio-cells = <2>;
+				spi-max-frequency = <4000000>;
+
+				sc16is752_clk: sc16is752_clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <14745600>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+    __overrides__ {
+      int_pin = <&sc16is752>,"interrupts:0";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/sdhost-overlay.dts b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
new file mode 100644
index 0000000000000..de3d1b0a5e403
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
@@ -0,0 +1,31 @@
+/dts-v1/;
+/plugin/;
+
+/* Provide backwards compatible aliases for the old sdhost dtparams. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sdhost>;
+		frag0: __overlay__ {
+			brcm,overclock-50 = <0>;
+			brcm,pio-limit = <1>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	__overrides__ {
+		overclock_50     = <&frag0>,"brcm,overclock-50:0";
+		force_pio        = <&frag0>,"brcm,force-pio?";
+		pio_limit        = <&frag0>,"brcm,pio-limit:0";
+		debug            = <&frag0>,"brcm,debug?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts b/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
new file mode 100644
index 0000000000000..297daae8faf9f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
@@ -0,0 +1,63 @@
+/dts-v1/;
+/plugin/;
+
+/* Enable 1-bit SDIO from MMC interface via GPIOs 22-25. Includes sdhost overlay. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			sdio_1bit: sdio@7e300000 {
+				compatible = "brcm,bcm2835-mmc",
+					     "brcm,bcm2835-sdhci";
+				reg = <0x7e300000 0x100>;
+				interrupts = <2 30>;
+				clocks = <&clocks 28/*BCM2835_CLOCK_EMMC*/>;
+				dmas = <&dma 11>;
+				dma-names = "rx-tx";
+				brcm,overclock-50 = <0>;
+				status = "okay";
+				pinctrl-names = "default";
+				pinctrl-0 = <&sdio_1bit_pins>;
+				non-removable;
+				bus-width = <1>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			sdio_1bit_pins: sdio_1bit_pins {
+				brcm,pins = <22 23 24 25>;
+				brcm,function = <7>; /* ALT3 = SD1 */
+				brcm,pull = <0 2 2 2>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/aliases";
+		__overlay__ {
+			mmc1 = "/soc/sdio@7e300000";
+		};
+	};
+
+
+	__overrides__ {
+		poll_once = <&sdio_1bit>,"non-removable?";
+		sdio_overclock = <&sdio_1bit>,"brcm,overclock-50:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
new file mode 100644
index 0000000000000..685b65a858e89
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
@@ -0,0 +1,63 @@
+/dts-v1/;
+/plugin/;
+
+/* Enable SDIO from MMC interface via GPIOs 22-27. Includes sdhost overlay. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			sdio_ovl: sdio@7e300000 {
+				compatible = "brcm,bcm2835-mmc",
+					     "brcm,bcm2835-sdhci";
+				reg = <0x7e300000 0x100>;
+				interrupts = <2 30>;
+				clocks = <&clocks 28/*BCM2835_CLOCK_EMMC*/>;
+				dmas = <&dma 11>;
+				dma-names = "rx-tx";
+				brcm,overclock-50 = <0>;
+				status = "okay";
+				pinctrl-names = "default";
+				pinctrl-0 = <&sdio_ovl_pins>;
+				non-removable;
+				bus-width = <1>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			sdio_ovl_pins: sdio_ovl_pins {
+				brcm,pins = <22 23 24 25 26 27>;
+				brcm,function = <7>; /* ALT3 = SD1 */
+				brcm,pull = <0 2 2 2 2 2>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/aliases";
+		__overlay__ {
+			mmc1 = "/soc/sdio@7e300000";
+		};
+	};
+
+	__overrides__ {
+		poll_once = <&sdio_ovl>,"non-removable?";
+		bus_width = <&sdio_ovl>,"bus-width:0";
+		sdio_overclock = <&sdio_ovl>,"brcm,overclock-50:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sdtweak-overlay.dts b/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
new file mode 100644
index 0000000000000..5880e7cd5d1c3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
@@ -0,0 +1,25 @@
+/dts-v1/;
+/plugin/;
+
+/* Provide backwards compatible aliases for the old sdhost dtparams. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sdhost>;
+		frag0: __overlay__ {
+			brcm,overclock-50 = <0>;
+			brcm,pio-limit = <1>;
+		};
+	};
+
+	__overrides__ {
+		overclock_50     = <&frag0>,"brcm,overclock-50:0";
+		force_pio        = <&frag0>,"brcm,force-pio?";
+		pio_limit        = <&frag0>,"brcm,pio-limit:0";
+		debug            = <&frag0>,"brcm,debug?";
+		enable           = <&frag0>,"status";
+		poll_once        = <&frag0>,"non-removable?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/smi-dev-overlay.dts b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
new file mode 100644
index 0000000000000..b610d82836081
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
@@ -0,0 +1,18 @@
+// Description: Overlay to enable character device interface for SMI.
+// Author:	Luke Wren <luke@raspberrypi.org>
+
+/dts-v1/;
+/plugin/;
+
+/{
+	fragment@0 {
+		target = <&soc>;
+		__overlay__ {
+			smi_dev {
+				compatible = "brcm,bcm2835-smi-dev";
+				smi_handle = <&smi>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
new file mode 100644
index 0000000000000..13ce0b7cfb242
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
@@ -0,0 +1,69 @@
+// Description: Overlay to enable NAND flash through
+// the secondary memory interface
+// Author:	Luke Wren
+
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&smi>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&smi_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			nand: flash@0 {
+				compatible = "brcm,bcm2835-smi-nand";
+				smi_handle = <&smi>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				status = "okay";
+
+				partition@0 {
+					label = "stage2";
+					// 128k
+					reg = <0 0x20000>;
+					read-only;
+				};
+				partition@1 {
+					label = "firmware";
+					// 16M
+					reg = <0x20000 0x1000000>;
+					read-only;
+				};
+				partition@2 {
+					label = "root";
+					// 2G (will need to use 64 bit for >=4G)
+					reg = <0x1020000 0x80000000>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			smi_pins: smi_pins {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					12 13 14 15>;
+				/* Alt 1: SMI */
+				brcm,function = <5 5 5 5 5 5 5 5 5 5 5
+					5 5 5 5 5>;
+				/* /CS, /WE and /OE are pulled high, as they are
+				   generally active low signals */
+				brcm,pull = <2 2 2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/smi-overlay.dts b/arch/arm/boot/dts/overlays/smi-overlay.dts
new file mode 100644
index 0000000000000..095f52c355fd6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/smi-overlay.dts
@@ -0,0 +1,37 @@
+// Description:	Overlay to enable the secondary memory interface peripheral
+// Author:	Luke Wren
+
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&smi>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&smi_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			smi_pins: smi_pins {
+				/* Don't configure the top two address bits, as
+				   these are already used as ID_SD and ID_SC */
+				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15
+					     16 17 18 19 20 21 22 23 24 25>;
+				/* Alt 0: SMI */
+				brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5 5
+						 5 5 5 5 5 5 5 5 5>;
+				/* /CS, /WE and /OE are pulled high, as they are
+				   generally active low signals */
+				brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0 0 0 0
+					     0 0 0 0 0 0 0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
new file mode 100644
index 0000000000000..49803b309f864
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
@@ -0,0 +1,31 @@
+/*
+ * Device tree overlay to move spi0 to gpio 35 to 39 on CM
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			cs-gpios = <&gpio 36 1>, <&gpio 35 1>;
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0_cs_pins>;
+		__overlay__ {
+			brcm,pins = <36 35>;
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0_pins>;
+		__overlay__ {
+			brcm,pins = <37 38 39>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
new file mode 100644
index 0000000000000..88d1800d63c9f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
@@ -0,0 +1,33 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			rtc-pcf2123@0 {
+				compatible = "nxp,rtc-pcf2123";
+				spi-max-frequency = <5000000>;
+				spi-cs-high = <1>;
+				reg = <0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		pcf2123 = <0>, "=0=1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
new file mode 100644
index 0000000000000..7f79029d043c0
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
@@ -0,0 +1,29 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <8 7>;
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0>;
+		frag1: __overlay__ {
+			cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&frag0>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
new file mode 100644
index 0000000000000..ef9845f7184ee
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
@@ -0,0 +1,26 @@
+/*
+ * Device tree overlay to re-enable hardware CS for SPI0
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			cs-gpios = <0>, <0>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0_cs_pins>;
+		__overlay__ {
+			brcm,pins = <8 7>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
new file mode 100644
index 0000000000000..c3d4f96b7aa92
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>;
+			status = "okay";
+
+			spidev1_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev1_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
new file mode 100644
index 0000000000000..2ad62497dc895
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
@@ -0,0 +1,69 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18 17>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>, <&gpio 17 1>;
+			status = "okay";
+
+			spidev1_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev1_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev1_0>,"status";
+		cs1_spidev = <&spidev1_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
new file mode 100644
index 0000000000000..ef82890453bfe
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
@@ -0,0 +1,81 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18 17 16>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>, <&gpio 17 1>, <&gpio 16 1>;
+			status = "okay";
+
+			spidev1_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev1_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev1_2: spidev@2 {
+				compatible = "spidev";
+				reg = <2>;      /* CE2 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs2_pin  = <&spi1_cs_pins>,"brcm,pins:8",
+			   <&frag1>,"cs-gpios:28";
+		cs0_spidev = <&spidev1_0>,"status";
+		cs1_spidev = <&spidev1_1>,"status";
+		cs2_spidev = <&spidev1_2>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
new file mode 100644
index 0000000000000..761b6be4ff9b5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi2_pins: spi2_pins {
+				brcm,pins = <40 41 42>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi2_cs_pins: spi2_cs_pins {
+				brcm,pins = <43>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi2>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
+			cs-gpios = <&gpio 43 1>;
+			status = "okay";
+
+			spidev2_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev2_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
new file mode 100644
index 0000000000000..e533aba113ded
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
@@ -0,0 +1,69 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi2_pins: spi2_pins {
+				brcm,pins = <40 41 42>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi2_cs_pins: spi2_cs_pins {
+				brcm,pins = <43 44>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi2>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
+			cs-gpios = <&gpio 43 1>, <&gpio 44 1>;
+			status = "okay";
+
+			spidev2_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev2_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev2_0>,"status";
+		cs1_spidev = <&spidev2_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
new file mode 100644
index 0000000000000..a62e107dc98fa
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
@@ -0,0 +1,81 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi2_pins: spi2_pins {
+				brcm,pins = <40 41 42>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi2_cs_pins: spi2_cs_pins {
+				brcm,pins = <43 44 45>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi2>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
+			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
+			status = "okay";
+
+			spidev2_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev2_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev2_2: spidev@2 {
+				compatible = "spidev";
+				reg = <2>;      /* CE2 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs2_pin  = <&spi2_cs_pins>,"brcm,pins:8",
+			   <&frag1>,"cs-gpios:28";
+		cs0_spidev = <&spidev2_0>,"status";
+		cs1_spidev = <&spidev2_1>,"status";
+		cs2_spidev = <&spidev2_2>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
new file mode 100755
index 0000000000000..e625faeed7fbc
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
@@ -0,0 +1,73 @@
+// Definitions for SuperAudioBoard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "simple-audio-card";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			simple-audio-card,name = "SuperAudioBoard";
+
+			simple-audio-card,widgets =
+				"Line", "Line In",
+				"Line", "Line Out";
+
+			simple-audio-card,routing =
+				"Line Out","AOUTA+",
+				"Line Out","AOUTA-",
+				"Line Out","AOUTB+",
+				"Line Out","AOUTB-",
+				"AINA","Line In",
+				"AINB","Line In";
+
+			simple-audio-card,format = "i2s";
+
+			simple-audio-card,bitclock-master = <&sound_master>;
+			simple-audio-card,frame-master = <&sound_master>;
+
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+				dai-tdm-slot-num = <2>;
+				dai-tdm-slot-width = <32>;
+			};
+
+			sound_master: simple-audio-card,codec {
+				sound-dai = <&cs4271>;
+				system-clock-frequency = <24576000>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+    
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			cs4271: cs4271@10 {
+				#sound-dai-cells = <0>;
+				compatible = "cirrus,cs4271";
+				reg = <0x10>;
+				status = "okay";
+				reset-gpio = <&gpio 26 0>; /* Pin 26, active high */
+			};
+		};
+	};
+	__overrides__ {
+		gpiopin = <&cs4271>,"reset-gpio:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sx150x-overlay.dts b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
new file mode 100644
index 0000000000000..0321b292c133b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
@@ -0,0 +1,1706 @@
+// Definitions for SX150x I2C GPIO Expanders from Semtech
+
+// dtparams:
+//     sx150<x>-<n>-<m>          - Enables SX150X device on I2C#<n> with slave address <m>. <x> may be 1-9.
+//                                 <n> may be 0 or 1.  Permissible values of <m> (which is denoted in hex)
+//                                 depend on the device variant.
+//                                 For SX1501, SX1502, SX1504 and SX1505, <m> may be 20 or 21.
+//                                 For SX1503 and SX1506, <m> may be 20.
+//                                 For SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
+//                                 For SX1508, <m> may be 20, 21, 22 or 23.
+//     sx150<x>-<n>-<m>-int-gpio - Integer, enables interrupts on SX150X device on I2C#<n> with slave address <m>,
+//                                 specifies the GPIO pin to which NINT output of SX150X is connected.
+//
+//
+// Example 1: A single SX1505 device on I2C#1 with its slave address set to 0x20 and NINT output connected to GPIO25:
+// dtoverlay=sx150x:sx1505-1-20,sx1505-1-20-int-gpio=25
+//
+// Example 2: Two SX1507 devices on I2C#0 with their slave addresses set to 0x3E and 0x70 (interrupts not used):
+// dtoverlay=sx150x:sx1507-0-3E,sx1507-0-70
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	// Enable I2C#0 interface
+	fragment@0 {
+		target = <&i2c0>;
+		__dormant__ {
+			status = "okay";
+		};
+	};
+
+	// Enable I2C#1 interface
+	fragment@1 {
+		target = <&i2c1>;
+		__dormant__ {
+			status = "okay";
+		};
+	};
+
+	// Enable a SX1501 on I2C#0 at slave addr 0x20
+	fragment@2 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_0_20: sx150x@20 {
+				compatible = "semtech,sx1501q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1501 on I2C#1 at slave addr 0x20
+	fragment@3 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_1_20: sx150x@20 {
+				compatible = "semtech,sx1501q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1501 on I2C#0 at slave addr 0x21
+	fragment@4 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_0_21: sx150x@21 {
+				compatible = "semtech,sx1501q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1501 on I2C#1 at slave addr 0x21
+	fragment@5 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_1_21: sx150x@21 {
+				compatible = "semtech,sx1501q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#0 at slave addr 0x20
+	fragment@6 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_0_20: sx150x@20 {
+				compatible = "semtech,sx1502q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#1 at slave addr 0x20
+	fragment@7 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_1_20: sx150x@20 {
+				compatible = "semtech,sx1502q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1502-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#0 at slave addr 0x21
+	fragment@8 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_0_21: sx150x@21 {
+				compatible = "semtech,sx1502q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#1 at slave addr 0x21
+	fragment@9 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_1_21: sx150x@21 {
+				compatible = "semtech,sx1502q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1503 on I2C#0 at slave addr 0x20
+	fragment@10 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1503_0_20: sx150x@20 {
+				compatible = "semtech,sx1503q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1503-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1503 on I2C#1 at slave addr 0x20
+	fragment@11 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1503_1_20: sx150x@20 {
+				compatible = "semtech,sx1503q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1503-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#0 at slave addr 0x20
+	fragment@12 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_0_20: sx150x@20 {
+				compatible = "semtech,sx1504q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#1 at slave addr 0x20
+	fragment@13 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_1_20: sx150x@20 {
+				compatible = "semtech,sx1504q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#0 at slave addr 0x21
+	fragment@14 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_0_21: sx150x@21 {
+				compatible = "semtech,sx1504q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#1 at slave addr 0x21
+	fragment@15 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_1_21: sx150x@21 {
+				compatible = "semtech,sx1504q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#0 at slave addr 0x20
+	fragment@16 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_0_20: sx150x@20 {
+				compatible = "semtech,sx1505q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#1 at slave addr 0x20
+	fragment@17 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_1_20: sx150x@20 {
+				compatible = "semtech,sx1505q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#0 at slave addr 0x21
+	fragment@18 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_0_21: sx150x@21 {
+				compatible = "semtech,sx1505q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#1 at slave addr 0x21
+	fragment@19 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_1_21: sx150x@21 {
+				compatible = "semtech,sx1505q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1506 on I2C#0 at slave addr 0x20
+	fragment@20 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1506_0_20: sx150x@20 {
+				compatible = "semtech,sx1506q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1506-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1506 on I2C#1 at slave addr 0x20
+	fragment@21 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1506_1_20: sx150x@20 {
+				compatible = "semtech,sx1506q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1506-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x3E
+	fragment@22 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_3E: sx150x@3E {
+				compatible = "semtech,sx1507q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x3E
+	fragment@23 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_3E: sx150x@3E {
+				compatible = "semtech,sx1507q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x3F
+	fragment@24 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_3F: sx150x@3F {
+				compatible = "semtech,sx1507q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x3F
+	fragment@25 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_3F: sx150x@3F {
+				compatible = "semtech,sx1507q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x70
+	fragment@26 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_70: sx150x@70 {
+				compatible = "semtech,sx1507q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x70
+	fragment@27 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_70: sx150x@70 {
+				compatible = "semtech,sx1507q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x71
+	fragment@28 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_71: sx150x@71 {
+				compatible = "semtech,sx1507q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x71
+	fragment@29 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_71: sx150x@71 {
+				compatible = "semtech,sx1507q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x20
+	fragment@30 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_20: sx150x@20 {
+				compatible = "semtech,sx1508q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x20
+	fragment@31 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_20: sx150x@20 {
+				compatible = "semtech,sx1508q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x21
+	fragment@32 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_21: sx150x@21 {
+				compatible = "semtech,sx1508q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x21
+	fragment@33 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_21: sx150x@21 {
+				compatible = "semtech,sx1508q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x22
+	fragment@34 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_22: sx150x@22 {
+				compatible = "semtech,sx1508q";
+				reg = <0x22>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-22-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x22
+	fragment@35 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_22: sx150x@22 {
+				compatible = "semtech,sx1508q";
+				reg = <0x22>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-22-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x23
+	fragment@36 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_23: sx150x@23 {
+				compatible = "semtech,sx1508q";
+				reg = <0x23>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-23-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x23
+	fragment@37 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_23: sx150x@23 {
+				compatible = "semtech,sx1508q";
+				reg = <0x23>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-23-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x3E
+	fragment@38 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_3E: sx150x@3E {
+				compatible = "semtech,sx1509q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x3E
+	fragment@39 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_3E: sx150x@3E {
+				compatible = "semtech,sx1509q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x3F
+	fragment@40 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_3F: sx150x@3F {
+				compatible = "semtech,sx1509q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x3F
+	fragment@41 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_3F: sx150x@3F {
+				compatible = "semtech,sx1509q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x70
+	fragment@42 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_70: sx150x@70 {
+				compatible = "semtech,sx1509q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x70
+	fragment@43 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_70: sx150x@70 {
+				compatible = "semtech,sx1509q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x71
+	fragment@44 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_71: sx150x@71 {
+				compatible = "semtech,sx1509q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x71
+	fragment@45 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_71: sx150x@71 {
+				compatible = "semtech,sx1509q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x20
+	fragment@46 {
+		target = <&sx1501_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x20
+	fragment@47 {
+		target = <&sx1501_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x21
+	fragment@48 {
+		target = <&sx1501_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x21
+	fragment@49 {
+		target = <&sx1501_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x20
+	fragment@50 {
+		target = <&sx1502_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x20
+	fragment@51 {
+		target = <&sx1502_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x21
+	fragment@52 {
+		target = <&sx1502_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x21
+	fragment@53 {
+		target = <&sx1502_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1503 on I2C#0 at slave addr 0x20
+	fragment@54 {
+		target = <&sx1503_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1503 on I2C#1 at slave addr 0x20
+	fragment@55 {
+		target = <&sx1503_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x20
+	fragment@56 {
+		target = <&sx1504_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x20
+	fragment@57 {
+		target = <&sx1504_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x21
+	fragment@58 {
+		target = <&sx1504_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x21
+	fragment@59 {
+		target = <&sx1504_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x20
+	fragment@60 {
+		target = <&sx1505_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x20
+	fragment@61 {
+		target = <&sx1505_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x21
+	fragment@62 {
+		target = <&sx1505_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x21
+	fragment@63 {
+		target = <&sx1505_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1506 on I2C#0 at slave addr 0x20
+	fragment@64 {
+		target = <&sx1506_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1506 on I2C#1 at slave addr 0x20
+	fragment@65 {
+		target = <&sx1506_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3E
+	fragment@66 {
+		target = <&sx1507_0_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3E
+	fragment@67 {
+		target = <&sx1507_1_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3F
+	fragment@68 {
+		target = <&sx1507_0_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3F
+	fragment@69 {
+		target = <&sx1507_1_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x70
+	fragment@70 {
+		target = <&sx1507_0_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x70
+	fragment@71 {
+		target = <&sx1507_1_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x71
+	fragment@72 {
+		target = <&sx1507_0_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_71_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x71
+	fragment@73 {
+		target = <&sx1507_1_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_71_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x20
+	fragment@74 {
+		target = <&sx1508_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x20
+	fragment@75 {
+		target = <&sx1508_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x21
+	fragment@76 {
+		target = <&sx1508_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x21
+	fragment@77 {
+		target = <&sx1508_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x22
+	fragment@78 {
+		target = <&sx1508_0_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_22_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x22
+	fragment@79 {
+		target = <&sx1508_1_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_22_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x23
+	fragment@80 {
+		target = <&sx1508_0_23>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_23_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x23
+	fragment@81 {
+		target = <&sx1508_1_23>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_23_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3E
+	fragment@82 {
+		target = <&sx1509_0_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3E
+	fragment@83 {
+		target = <&sx1509_1_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3F
+	fragment@84 {
+		target = <&sx1509_0_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3F
+	fragment@85 {
+		target = <&sx1509_1_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x70
+	fragment@86 {
+		target = <&sx1509_0_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x70
+	fragment@87 {
+		target = <&sx1509_1_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x71
+	fragment@88 {
+		target = <&sx1509_0_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_71_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x71
+	fragment@89 {
+		target = <&sx1509_1_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_71_pins>;
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x20
+        // Configure as a input with no pull-up/down
+	fragment@90 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_20_pins: sx150x_0_20_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-20-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x20
+        // Configure as a input with no pull-up/down
+	fragment@91 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_20_pins: sx150x_1_20_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-20-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x21
+        // Configure as a input with no pull-up/down
+	fragment@92 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_21_pins: sx150x_0_21_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-21-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x21
+        // Configure as a input with no pull-up/down
+	fragment@93 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_21_pins: sx150x_1_21_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-21-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x22
+        // Configure as a input with no pull-up/down
+	fragment@94 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_22_pins: sx150x_0_22_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-22-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x22
+        // Configure as a input with no pull-up/down
+	fragment@95 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_22_pins: sx150x_1_22_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-22-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x23
+        // Configure as a input with no pull-up/down
+	fragment@96 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_23_pins: sx150x_0_23_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-23-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x23
+        // Configure as a input with no pull-up/down
+	fragment@97 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_23_pins: sx150x_1_23_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-23-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3E
+        // Configure as a input with no pull-up/down
+	fragment@98 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_3E_pins: sx150x_0_3E_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-3E-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3E
+        // Configure as a input with no pull-up/down
+	fragment@99 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_3E_pins: sx150x_1_3E_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-3E-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3F
+        // Configure as a input with no pull-up/down
+	fragment@100 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_3F_pins: sx150x_0_3F_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-3F-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3F
+        // Configure as a input with no pull-up/down
+	fragment@101 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_3F_pins: sx150x_1_3F_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-3F-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x70
+        // Configure as a input with no pull-up/down
+	fragment@102 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_70_pins: sx150x_0_70_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-70-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x70
+        // Configure as a input with no pull-up/down
+	fragment@103 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_70_pins: sx150x_1_70_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-70-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x71
+        // Configure as a input with no pull-up/down
+	fragment@104 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_71_pins: sx150x_0_71_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-71-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x71
+        // Configure as a input with no pull-up/down
+	fragment@105 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_71_pins: sx150x_1_71_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-71-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		sx1501-0-20          = <0>,"+0+2";
+		sx1501-1-20          = <0>,"+1+3";
+		sx1501-0-21          = <0>,"+0+4";
+		sx1501-1-21          = <0>,"+1+5";
+		sx1502-0-20          = <0>,"+0+6";
+		sx1502-1-20          = <0>,"+1+7";
+		sx1502-0-21          = <0>,"+0+8";
+		sx1502-1-21          = <0>,"+1+9";
+		sx1503-0-20          = <0>,"+0+10";
+		sx1503-1-20          = <0>,"+1+11";
+		sx1504-0-20          = <0>,"+0+12";
+		sx1504-1-20          = <0>,"+1+13";
+		sx1504-0-21          = <0>,"+0+14";
+		sx1504-1-21          = <0>,"+1+15";
+		sx1505-0-20          = <0>,"+0+16";
+		sx1505-1-20          = <0>,"+1+17";
+		sx1505-0-21          = <0>,"+0+18";
+		sx1505-1-21          = <0>,"+1+19";
+		sx1506-0-20          = <0>,"+0+20";
+		sx1506-1-20          = <0>,"+1+21";
+		sx1507-0-3E          = <0>,"+0+22";
+		sx1507-1-3E          = <0>,"+1+23";
+		sx1507-0-3F          = <0>,"+0+24";
+		sx1507-1-3F          = <0>,"+1+25";
+		sx1507-0-70          = <0>,"+0+26";
+		sx1507-1-70          = <0>,"+1+27";
+		sx1507-0-71          = <0>,"+0+28";
+		sx1507-1-71          = <0>,"+1+29";
+		sx1508-0-20          = <0>,"+0+30";
+		sx1508-1-20          = <0>,"+1+31";
+		sx1508-0-21          = <0>,"+0+32";
+		sx1508-1-21          = <0>,"+1+33";
+		sx1508-0-22          = <0>,"+0+34";
+		sx1508-1-22          = <0>,"+1+35";
+		sx1508-0-23          = <0>,"+0+36";
+		sx1508-1-23          = <0>,"+1+37";
+		sx1509-0-3E          = <0>,"+0+38";
+		sx1509-1-3E          = <0>,"+1+39";
+		sx1509-0-3F          = <0>,"+0+40";
+		sx1509-1-3F          = <0>,"+1+41";
+		sx1509-0-70          = <0>,"+0+42";
+		sx1509-1-70          = <0>,"+1+43";
+		sx1509-0-71          = <0>,"+0+44";
+		sx1509-1-71          = <0>,"+1+45";
+		sx1501-0-20-int-gpio = <0>,"+46+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1501_0_20>,"interrupts:0";
+		sx1501-1-20-int-gpio = <0>,"+47+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1501_1_20>,"interrupts:0";
+		sx1501-0-21-int-gpio = <0>,"+48+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1501_0_21>,"interrupts:0";
+		sx1501-1-21-int-gpio = <0>,"+49+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1501_1_21>,"interrupts:0";
+		sx1502-0-20-int-gpio = <0>,"+50+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1502_0_20>,"interrupts:0";
+		sx1502-1-20-int-gpio = <0>,"+51+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1502_1_20>,"interrupts:0";
+		sx1502-0-21-int-gpio = <0>,"+52+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1502_0_21>,"interrupts:0";
+		sx1502-1-21-int-gpio = <0>,"+53+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1502_1_21>,"interrupts:0";
+		sx1503-0-20-int-gpio = <0>,"+54+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1503_0_20>,"interrupts:0";
+		sx1503-1-20-int-gpio = <0>,"+55+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1503_1_20>,"interrupts:0";
+		sx1504-0-20-int-gpio = <0>,"+56+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1504_0_20>,"interrupts:0";
+		sx1504-1-20-int-gpio = <0>,"+57+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1504_1_20>,"interrupts:0";
+		sx1504-0-21-int-gpio = <0>,"+58+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1504_0_21>,"interrupts:0";
+		sx1504-1-21-int-gpio = <0>,"+59+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1504_1_21>,"interrupts:0";
+		sx1505-0-20-int-gpio = <0>,"+60+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1505_0_20>,"interrupts:0";
+		sx1505-1-20-int-gpio = <0>,"+61+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1505_1_20>,"interrupts:0";
+		sx1505-0-21-int-gpio = <0>,"+62+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1505_0_21>,"interrupts:0";
+		sx1505-1-21-int-gpio = <0>,"+63+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1505_1_21>,"interrupts:0";
+		sx1506-0-20-int-gpio = <0>,"+64+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1506_0_20>,"interrupts:0";
+		sx1506-1-20-int-gpio = <0>,"+65+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1506_1_20>,"interrupts:0";
+		sx1507-0-3E-int-gpio = <0>,"+66+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1507_0_3E>,"interrupts:0";
+		sx1507-1-3E-int-gpio = <0>,"+67+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1507_1_3E>,"interrupts:0";
+		sx1507-0-3F-int-gpio = <0>,"+68+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1507_0_3F>,"interrupts:0";
+		sx1507-1-3F-int-gpio = <0>,"+69+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1507_1_3F>,"interrupts:0";
+		sx1507-0-70-int-gpio = <0>,"+60+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1507_0_70>,"interrupts:0";
+		sx1507-1-70-int-gpio = <0>,"+71+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1507_1_70>,"interrupts:0";
+		sx1507-0-71-int-gpio = <0>,"+72+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1507_0_71>,"interrupts:0";
+		sx1507-1-71-int-gpio = <0>,"+73+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1507_1_71>,"interrupts:0";
+		sx1508-0-20-int-gpio = <0>,"+74+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1508_0_20>,"interrupts:0";
+		sx1508-1-20-int-gpio = <0>,"+75+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1508_1_20>,"interrupts:0";
+		sx1508-0-21-int-gpio = <0>,"+76+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1508_0_21>,"interrupts:0";
+		sx1508-1-21-int-gpio = <0>,"+77+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1508_1_21>,"interrupts:0";
+		sx1508-0-22-int-gpio = <0>,"+78+94",  <&sx150x_0_22_pins>,"brcm,pins:0", <&sx1508_0_22>,"interrupts:0";
+		sx1508-1-22-int-gpio = <0>,"+79+95",  <&sx150x_1_22_pins>,"brcm,pins:0", <&sx1508_1_22>,"interrupts:0";
+		sx1508-0-23-int-gpio = <0>,"+80+96",  <&sx150x_0_23_pins>,"brcm,pins:0", <&sx1508_0_23>,"interrupts:0";
+		sx1508-1-23-int-gpio = <0>,"+81+97",  <&sx150x_1_23_pins>,"brcm,pins:0", <&sx1508_1_23>,"interrupts:0";
+		sx1509-0-3E-int-gpio = <0>,"+82+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1509_0_3E>,"interrupts:0";
+		sx1509-1-3E-int-gpio = <0>,"+83+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1509_1_3E>,"interrupts:0";
+		sx1509-0-3F-int-gpio = <0>,"+84+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1509_0_3F>,"interrupts:0";
+		sx1509-1-3F-int-gpio = <0>,"+85+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1509_1_3F>,"interrupts:0";
+		sx1509-0-70-int-gpio = <0>,"+86+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1509_0_70>,"interrupts:0";
+		sx1509-1-70-int-gpio = <0>,"+87+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1509_1_70>,"interrupts:0";
+		sx1509-0-71-int-gpio = <0>,"+88+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1509_0_71>,"interrupts:0";
+		sx1509-1-71-int-gpio = <0>,"+89+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1509_1_71>,"interrupts:0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
new file mode 100644
index 0000000000000..ed2b053aef23e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
@@ -0,0 +1,224 @@
+/*
+ * tinylcd35-overlay.dts
+ *
+ * -------------------------------------------------
+ * www.tinlylcd.com
+ * -------------------------------------------------
+ * Device---Driver-----BUS       GPIO's
+ * display  tinylcd35  spi0.0    25 24 18
+ * touch    ads7846    spi0.1    5
+ * rtc      ds1307     i2c1-0068
+ * rtc      pcf8563    i2c1-0051
+ * keypad   gpio-keys  --------- 17 22 27 23 28
+ *
+ *
+ * TinyLCD.com 3.5 inch TFT
+ *
+ *  Version 001
+ *  5/3/2015  -- Noralf Trønnes     Initial Device tree framework
+ *  10/3/2015 -- tinylcd@gmail.com  added ds1307 support.
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			tinylcd35_pins: tinylcd35_pins {
+				brcm,pins = <25 24 18>;
+				brcm,function = <1>; /* out */
+			};
+			tinylcd35_ts_pins: tinylcd35_ts_pins {
+				brcm,pins = <5>;
+				brcm,function = <0>; /* in */
+			};
+			keypad_pins: keypad_pins {
+				brcm,pins = <4 17 22 23 27>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <1>; /* down */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			tinylcd35: tinylcd35@0{
+				compatible = "neosec,tinylcd";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&tinylcd35_pins>,
+					    <&tinylcd35_ts_pins>;
+
+				spi-max-frequency = <48000000>;
+				rotate = <270>;
+				fps = <20>;
+				bgr;
+				buswidth = <8>;
+				reset-gpios = <&gpio 25 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 18 1>;
+				debug = <0>;
+
+				init = <0x10000B0 0x80
+					0x10000C0 0x0A 0x0A
+					0x10000C1 0x01 0x01
+					0x10000C2 0x33
+					0x10000C5 0x00 0x42 0x80
+					0x10000B1 0xD0 0x11
+					0x10000B4 0x02
+					0x10000B6 0x00 0x22 0x3B
+					0x10000B7 0x07
+					0x1000036 0x58
+					0x10000F0 0x36 0xA5 0xD3
+					0x10000E5 0x80
+					0x10000E5 0x01
+					0x10000B3 0x00
+					0x10000E5 0x00
+					0x10000F0 0x36 0xA5 0x53
+					0x10000E0 0x00 0x35 0x33 0x00 0x00 0x00 0x00 0x35 0x33 0x00 0x00 0x00
+					0x100003A 0x55
+					0x1000011
+					0x2000001
+					0x1000029>;
+			};
+
+			tinylcd35_ts: tinylcd35_ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+				status = "disabled";
+
+				spi-max-frequency = <2000000>;
+				interrupts = <5 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 5 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+
+	/*  RTC    */
+
+	fragment@5 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			pcf8563: pcf8563@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	/*
+	 * Values for input event code is found under the
+	 * 'Keys and buttons' heading in include/uapi/linux/input.h
+	 */
+	fragment@7 {
+		target-path = "/soc";
+		__overlay__ {
+			keypad: keypad {
+				compatible = "gpio-keys";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&keypad_pins>;
+				status = "disabled";
+				autorepeat;
+
+				button@17 {
+					label = "GPIO KEY_UP";
+					linux,code = <103>;
+					gpios = <&gpio 17 0>;
+				};
+				button@22 {
+					label = "GPIO KEY_DOWN";
+					linux,code = <108>;
+					gpios = <&gpio 22 0>;
+				};
+				button@27 {
+					label = "GPIO KEY_LEFT";
+					linux,code = <105>;
+					gpios = <&gpio 27 0>;
+				};
+				button@23 {
+					label = "GPIO KEY_RIGHT";
+					linux,code = <106>;
+					gpios = <&gpio 23 0>;
+				};
+				button@4 {
+					label = "GPIO KEY_ENTER";
+					linux,code = <28>;
+					gpios = <&gpio 4 0>;
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =      <&tinylcd35>,"spi-max-frequency:0";
+		rotate =     <&tinylcd35>,"rotate:0";
+		fps =        <&tinylcd35>,"fps:0";
+		debug =      <&tinylcd35>,"debug:0";
+		touch =      <&tinylcd35_ts>,"status";
+		touchgpio =  <&tinylcd35_ts_pins>,"brcm,pins:0",
+			     <&tinylcd35_ts>,"interrupts:0",
+			     <&tinylcd35_ts>,"pendown-gpio:4";
+		xohms =      <&tinylcd35_ts>,"ti,x-plate-ohms;0";
+		rtc-pcf =    <0>,"=5";
+		rtc-ds =     <0>,"=6";
+		keypad =     <&keypad>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart0-overlay.dts b/arch/arm/boot/dts/overlays/uart0-overlay.dts
new file mode 100755
index 0000000000000..20b2a609c511b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart0-overlay.dts
@@ -0,0 +1,32 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			uart0_pins: uart0_pins {
+				brcm,pins = <14 15>;
+				brcm,function = <4>; /* alt0 */
+				brcm,pull = <0 2>;
+			};
+		};
+	};
+
+	__overrides__ {
+		txd0_pin = <&uart0_pins>,"brcm,pins:0";
+		rxd0_pin = <&uart0_pins>,"brcm,pins:4";
+		pin_func = <&uart0_pins>,"brcm,function:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart1-overlay.dts b/arch/arm/boot/dts/overlays/uart1-overlay.dts
new file mode 100644
index 0000000000000..fa73e1feaeb1b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart1-overlay.dts
@@ -0,0 +1,38 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart1>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart1_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			uart1_pins: uart1_pins {
+				brcm,pins = <14 15>;
+				brcm,function = <2>; /* alt5 */
+				brcm,pull = <0 2>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "8250.nr_uarts=1";
+		};
+	};
+
+	__overrides__ {
+		txd1_pin = <&uart1_pins>,"brcm,pins:0";
+		rxd1_pin = <&uart1_pins>,"brcm,pins:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts b/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
new file mode 100644
index 0000000000000..04e271b72a3aa
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
@@ -0,0 +1,33 @@
+// Overlay for missing AUX interrupt controller
+// Instead we bind all AUX devices to the generic AUX interrupt line
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target = <&uart1>;
+        __overlay__ {
+            interrupt-parent = <&intc>;
+            interrupts = <0x1 0x1d>;
+        };
+    };
+
+    fragment@1 {
+        target = <&spi1>;
+        __overlay__ {
+            interrupt-parent = <&intc>;
+            interrupts = <0x1 0x1d>;
+        };
+    };
+
+    fragment@2 {
+        target = <&spi2>;
+        __overlay__ {
+            interrupt-parent = <&intc>;
+            interrupts = <0x1 0x1d>;
+        };
+    };
+};
+
diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
new file mode 100644
index 0000000000000..ff37a5013de47
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -0,0 +1,154 @@
+// redo: ovmerge -c vc4-kms-v3d-overlay.dts,cma-96 dwc2-overlay.dts,dr_mode=otg upstream-aux-interrupt-overlay.dts,
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	fragment@0 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=256M";
+		};
+	};
+	fragment@1 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=192M";
+		};
+	};
+	fragment@2 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=128M";
+		};
+	};
+	fragment@3 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "cma=96M";
+		};
+	};
+	fragment@4 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=64M";
+		};
+	};
+	fragment@5 {
+		target = <&i2c2>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@6 {
+		target = <&fb>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+	fragment@7 {
+		target = <&pixelvalve0>;
+		__overlay__ {
+			interrupts = <2 13>;
+			status = "okay";
+		};
+	};
+	fragment@8 {
+		target = <&pixelvalve1>;
+		__overlay__ {
+			interrupts = <2 14>;
+			status = "okay";
+		};
+	};
+	fragment@9 {
+		target = <&pixelvalve2>;
+		__overlay__ {
+			interrupts = <2 10>;
+			status = "okay";
+		};
+	};
+	fragment@10 {
+		target = <&hvs>;
+		__overlay__ {
+			interrupts = <2 1>;
+			status = "okay";
+		};
+	};
+	fragment@11 {
+		target = <&hdmi>;
+		__overlay__ {
+			interrupts = <2 8>, <2 9>;
+			status = "okay";
+		};
+	};
+	fragment@12 {
+		target = <&v3d>;
+		__overlay__ {
+			interrupts = <1 10>;
+			status = "okay";
+		};
+	};
+	fragment@13 {
+		target = <&vc4>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@14 {
+		target-path = "/soc/dma";
+		__overlay__ {
+			brcm,dma-channel-mask = <0x7f35>;
+		};
+	};
+	fragment@15 {
+		target = <&clocks>;
+		__overlay__ {
+			claim-clocks = <BCM2835_PLLD_DSI0 BCM2835_PLLD_DSI1 BCM2835_PLLH_AUX BCM2835_PLLH_PIX>;
+		};
+	};
+	fragment@16 {
+		target = <&vec>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@17 {
+		target = <&usb>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		dwc2_usb: __overlay__ {
+			compatible = "brcm,bcm2835-usb";
+			reg = <0x7e980000 0x10000>;
+			interrupts = <1 9>;
+			dr_mode = "otg";
+			g-np-tx-fifo-size = <32>;
+			g-rx-fifo-size = <256>;
+			g-tx-fifo-size = <512 512 512 512 512 256 256>;
+			status = "okay";
+		};
+	};
+	fragment@18 {
+		target = <&uart1>;
+		__overlay__ {
+			interrupt-parent = <&intc>;
+			interrupts = <0x1 0x1d>;
+		};
+	};
+	fragment@19 {
+		target = <&spi1>;
+		__overlay__ {
+			interrupt-parent = <&intc>;
+			interrupts = <0x1 0x1d>;
+		};
+	};
+	fragment@20 {
+		target = <&spi2>;
+		__overlay__ {
+			interrupt-parent = <&intc>;
+			interrupts = <0x1 0x1d>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
new file mode 100644
index 0000000000000..14f7687172c3a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
@@ -0,0 +1,89 @@
+/*
+ * vc4-fkms-v3d-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "cma=256M";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=192M";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=128M";
+		};
+	};
+
+	fragment@3 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=96M";
+		};
+	};
+
+	fragment@4 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=64M";
+		};
+	};
+
+	fragment@5 {
+		target = <&fb>;
+		__overlay__  {
+			status = "disabled";
+		};
+	};
+
+	fragment@6 {
+		target = <&firmwarekms>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@7 {
+		target = <&v3d>;
+		__overlay__  {
+			interrupts = <1 10>;
+			status = "okay";
+		};
+	};
+
+	fragment@8 {
+		target = <&vc4>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@9 {
+		target-path = "/soc/dma";
+		__overlay__ {
+			brcm,dma-channel-mask = <0x7f35>;
+		};
+	};
+
+	__overrides__ {
+		cma-256 = <0>,"+0-1-2-3-4";
+		cma-192 = <0>,"-0+1-2-3-4";
+		cma-128 = <0>,"-0-1+2-3-4";
+		cma-96  = <0>,"-0-1-2+3-4";
+		cma-64  = <0>,"-0-1-2-3+4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
new file mode 100644
index 0000000000000..4896796373062
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
@@ -0,0 +1,151 @@
+/*
+ * vc4-kms-v3d-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "cma=256M";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=192M";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=128M";
+		};
+	};
+
+	fragment@3 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=96M";
+		};
+	};
+
+	fragment@4 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=64M";
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c2>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@6 {
+		target = <&fb>;
+		__overlay__  {
+			status = "disabled";
+		};
+	};
+
+	fragment@7 {
+		target = <&pixelvalve0>;
+		__overlay__  {
+			interrupts = <2 13>; /* pwa0 */
+			status = "okay";
+		};
+	};
+
+	fragment@8 {
+		target = <&pixelvalve1>;
+		__overlay__  {
+			interrupts = <2 14>; /* pwa1 */
+			status = "okay";
+		};
+	};
+
+	fragment@9 {
+		target = <&pixelvalve2>;
+		__overlay__  {
+			interrupts = <2 10>; /* pixelvalve */
+			status = "okay";
+		};
+	};
+
+	fragment@10 {
+		target = <&hvs>;
+		__overlay__  {
+			interrupts = <2 1>;
+			status = "okay";
+		};
+	};
+
+	fragment@11 {
+		target = <&hdmi>;
+		__overlay__  {
+			interrupts = <2 8>, <2 9>;
+			status = "okay";
+		};
+	};
+
+	fragment@12 {
+		target = <&v3d>;
+		__overlay__  {
+			interrupts = <1 10>;
+			status = "okay";
+		};
+	};
+
+	fragment@13 {
+		target = <&vc4>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@14 {
+		target-path = "/soc/dma";
+		__overlay__ {
+			brcm,dma-channel-mask = <0x7f35>;
+		};
+	};
+
+
+	fragment@15 {
+		target = <&clocks>;
+		__overlay__  {
+			claim-clocks = <
+				BCM2835_PLLD_DSI0
+				BCM2835_PLLD_DSI1
+				BCM2835_PLLH_AUX
+				BCM2835_PLLH_PIX
+			>;
+		};
+	};
+
+	fragment@16 {
+		target = <&vec>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cma-256 = <0>,"+0-1-2-3-4";
+		cma-192 = <0>,"-0+1-2-3-4";
+		cma-128 = <0>,"-0-1+2-3-4";
+		cma-96  = <0>,"-0-1-2+3-4";
+		cma-64  = <0>,"-0-1-2-3+4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/vga666-overlay.dts b/arch/arm/boot/dts/overlays/vga666-overlay.dts
new file mode 100644
index 0000000000000..7fcab963eb4ae
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vga666-overlay.dts
@@ -0,0 +1,30 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// There is no VGA driver module, but we need a platform device
+	// node (that doesn't already use pinctrl) to hang the pinctrl
+	// reference on - leds will do
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&vga666_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			vga666_pins: vga666_pins {
+				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12
+					     13 14 15 16 17 18 19 20 21>;
+				brcm,function = <6>; /* alt2 */
+				brcm,pull = <0>; /* no pull */
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
new file mode 100644
index 0000000000000..f7f8747512653
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
@@ -0,0 +1,41 @@
+// Definitions for w1-gpio module (without external pullup)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+
+			w1: onewire@0 {
+				compatible = "w1-gpio";
+				pinctrl-names = "default";
+				pinctrl-0 = <&w1_pins>;
+				gpios = <&gpio 4 0>;
+				rpi,parasitic-power = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			w1_pins: w1_pins@0 {
+				brcm,pins = <4>;
+				brcm,function = <0>; // in (initially)
+				brcm,pull = <0>; // off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin =       <&w1>,"gpios:4",
+				<&w1>,"reg:0",
+				<&w1_pins>,"brcm,pins:0",
+				<&w1_pins>,"reg:0";
+		pullup =        <&w1>,"rpi,parasitic-power:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
new file mode 100644
index 0000000000000..ef8bfbcabdb31
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
@@ -0,0 +1,43 @@
+// Definitions for w1-gpio module (with external pullup)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+
+			w1: onewire@0 {
+				compatible = "w1-gpio";
+				pinctrl-names = "default";
+				pinctrl-0 = <&w1_pins>;
+				gpios = <&gpio 4 0>, <&gpio 5 1>;
+				rpi,parasitic-power = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			w1_pins: w1_pins@0 {
+				brcm,pins = <4 5>;
+				brcm,function = <0 1>; // in out
+				brcm,pull = <0 0>; // off off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin =       <&w1>,"gpios:4",
+				<&w1>,"reg:0",
+				<&w1_pins>,"brcm,pins:0",
+				<&w1_pins>,"reg:0";
+		extpullup =     <&w1>,"gpios:16",
+				<&w1_pins>,"brcm,pins:4";
+		pullup =        <&w1>,"rpi,parasitic-power:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/wittypi-overlay.dts b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
new file mode 100644
index 0000000000000..8498134fdbb39
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
@@ -0,0 +1,44 @@
+/*
+ * Device Tree overlay for Witty Pi extension board by UUGear
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			compatible = "gpio-leds";
+			wittypi_led: wittypi_led {
+				label = "wittypi_led";
+				linux,default-trigger = "default-on";
+				gpios = <&gpio 17 0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			rtc: ds1337@68 {
+				compatible = "dallas,ds1337";
+				reg = <0x68>;
+				wakeup-source;
+			};
+		};
+	};
+
+	__overrides__ {
+		led_gpio =	<&wittypi_led>,"gpios:4";
+		led_trigger =	<&wittypi_led>,"linux,default-trigger";
+	};
+
+};
diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst
index 7301ab5e2e066..da2af04a6d7da 100644
--- a/scripts/Makefile.dtbinst
+++ b/scripts/Makefile.dtbinst
@@ -20,6 +20,7 @@ include scripts/Kbuild.include
 include $(src)/Makefile
 
 dtbinst-files	:= $(sort $(dtb-y) $(if $(CONFIG_OF_ALL_DTBS), $(dtb-)))
+dtboinst-files	:= $(sort $(dtbo-y) $(if $(CONFIG_OF_ALL_DTBS), $(dtb-)))
 dtbinst-dirs	:= $(subdir-y) $(subdir-m)
 
 # Helper targets for Installing DTBs into the boot directory
@@ -31,10 +32,13 @@ install-dir = $(patsubst $(dtbinst_root)%,$(INSTALL_DTBS_PATH)%,$(obj))
 $(dtbinst-files): %.dtb: $(obj)/%.dtb
 	$(call cmd,dtb_install,$(install-dir))
 
+$(dtboinst-files): %.dtbo: $(obj)/%.dtbo
+	$(call cmd,dtb_install,$(install-dir))
+
 $(dtbinst-dirs):
 	$(Q)$(MAKE) $(dtbinst)=$(obj)/$@
 
-PHONY += $(dtbinst-files) $(dtbinst-dirs)
-__dtbs_install: $(dtbinst-files) $(dtbinst-dirs)
+PHONY += $(dtbinst-files) $(dtboinst-files) $(dtbinst-dirs)
+__dtbs_install: $(dtbinst-files) $(dtboinst-files) $(dtbinst-dirs)
 
 .PHONY: $(PHONY)
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 61e596650ed31..1b737403afbbb 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -248,6 +248,7 @@ DTC ?= $(objtree)/scripts/dtc/dtc
 ifeq ($(findstring 1,$(KBUILD_ENABLE_EXTRA_GCC_CHECKS)),)
 DTC_FLAGS += -Wno-unit_address_vs_reg \
 	-Wno-unit_address_format \
+	-Wno-gpios_property \
 	-Wno-avoid_unnecessary_addr_size \
 	-Wno-alias_paths \
 	-Wno-graph_child_address \
@@ -292,6 +293,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
 $(obj)/%.dtb: $(src)/%.dts $(DTC) FORCE
 	$(call if_changed_dep,dtc)
 
+quiet_cmd_dtco = DTCO    $@
+cmd_dtco = mkdir -p $(dir ${dtc-tmp}) ; \
+	$(CPP) $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
+	$(DTC) -@ -H epapr -O dtb -o $@ -b 0 \
+		-i $(dir $<) $(DTC_FLAGS) \
+		-Wno-interrupts_property \
+		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
+	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
+
+$(obj)/%.dtbo: $(src)/%-overlay.dts FORCE
+	$(call if_changed_dep,dtco)
+
 dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp)
 
 # Bzip2
-- 
GitLab


From f7e1b7042dacab4aefb7283ea9a4d2aef2a4f54a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 6 Feb 2015 13:50:57 +0000
Subject: [PATCH 0058/1835] BCM270x_DT: Add pwr_led, and the required "input"
 trigger

The "input" trigger makes the associated GPIO an input.  This is to support
the Raspberry Pi PWR LED, which is driven by external hardware in normal use.

N.B. pwr_led is not available on Model A or B boards.

leds-gpio: Implement the brightness_get method

The power LED uses some clever logic that means it is driven
by a voltage measuring circuit when configured as input, otherwise
it is driven by the GPIO output value. This patch wires up the
brightness_get method for leds-gpio so that user-space can monitor
the LED value via /sys/class/gpio/led1/brightness. Using the input
trigger this returns an indication of the system power health,
otherwise it is just whatever value the trigger has written most
recently.

See: https://github.com/raspberrypi/linux/issues/1064
---
 drivers/leds/leds-gpio.c             | 17 ++++++++-
 drivers/leds/trigger/Kconfig         |  7 ++++
 drivers/leds/trigger/Makefile        |  1 +
 drivers/leds/trigger/ledtrig-input.c | 55 ++++++++++++++++++++++++++++
 include/linux/leds.h                 |  3 ++
 5 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 drivers/leds/trigger/ledtrig-input.c

diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
index 764c31301f903..9544067cafa55 100644
--- a/drivers/leds/leds-gpio.c
+++ b/drivers/leds/leds-gpio.c
@@ -50,8 +50,15 @@ static void gpio_led_set(struct led_classdev *led_cdev,
 		led_dat->platform_gpio_blink_set(led_dat->gpiod, level,
 						 NULL, NULL);
 		led_dat->blinking = 0;
+	} else if (led_dat->cdev.flags & SET_GPIO_INPUT) {
+		gpiod_direction_input(led_dat->gpiod);
+		led_dat->cdev.flags &= ~SET_GPIO_INPUT;
+	} else if (led_dat->cdev.flags & SET_GPIO_OUTPUT) {
+		gpiod_direction_output(led_dat->gpiod, level);
+		led_dat->cdev.flags &= ~SET_GPIO_OUTPUT;
 	} else {
-		if (led_dat->can_sleep)
+		if (led_dat->can_sleep ||
+			(led_dat->cdev.flags & (SET_GPIO_INPUT | SET_GPIO_OUTPUT) ))
 			gpiod_set_value_cansleep(led_dat->gpiod, level);
 		else
 			gpiod_set_value(led_dat->gpiod, level);
@@ -65,6 +72,13 @@ static int gpio_led_set_blocking(struct led_classdev *led_cdev,
 	return 0;
 }
 
+static enum led_brightness gpio_led_get(struct led_classdev *led_cdev)
+{
+	struct gpio_led_data *led_dat =
+		container_of(led_cdev, struct gpio_led_data, cdev);
+	return gpiod_get_value_cansleep(led_dat->gpiod) ? LED_FULL : LED_OFF;
+}
+
 static int gpio_blink_set(struct led_classdev *led_cdev,
 	unsigned long *delay_on, unsigned long *delay_off)
 {
@@ -122,6 +136,7 @@ static int create_gpio_led(const struct gpio_led *template,
 		led_dat->platform_gpio_blink_set = blink_set;
 		led_dat->cdev.blink_set = gpio_blink_set;
 	}
+	led_dat->cdev.brightness_get = gpio_led_get;
 	if (template->default_state == LEDS_GPIO_DEFSTATE_KEEP) {
 		state = gpiod_get_value_cansleep(led_dat->gpiod);
 		if (state < 0)
diff --git a/drivers/leds/trigger/Kconfig b/drivers/leds/trigger/Kconfig
index 4018af7699693..6d84002b0bf35 100644
--- a/drivers/leds/trigger/Kconfig
+++ b/drivers/leds/trigger/Kconfig
@@ -113,6 +113,13 @@ config LEDS_TRIGGER_CAMERA
 	  This enables direct flash/torch on/off by the driver, kernel space.
 	  If unsure, say Y.
 
+config LEDS_TRIGGER_INPUT
+	tristate "LED Input Trigger"
+	depends on LEDS_TRIGGERS
+	help
+	  This allows the GPIOs assigned to be LEDs to be initialised to inputs.
+	  If unsure, say Y.
+
 config LEDS_TRIGGER_PANIC
 	bool "LED Panic Trigger"
 	help
diff --git a/drivers/leds/trigger/Makefile b/drivers/leds/trigger/Makefile
index f3cfe19505385..05f817d8949f4 100644
--- a/drivers/leds/trigger/Makefile
+++ b/drivers/leds/trigger/Makefile
@@ -11,5 +11,6 @@ obj-$(CONFIG_LEDS_TRIGGER_ACTIVITY)	+= ledtrig-activity.o
 obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
 obj-$(CONFIG_LEDS_TRIGGER_TRANSIENT)	+= ledtrig-transient.o
 obj-$(CONFIG_LEDS_TRIGGER_CAMERA)	+= ledtrig-camera.o
+obj-$(CONFIG_LEDS_TRIGGER_INPUT)	+= ledtrig-input.o
 obj-$(CONFIG_LEDS_TRIGGER_PANIC)	+= ledtrig-panic.o
 obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
diff --git a/drivers/leds/trigger/ledtrig-input.c b/drivers/leds/trigger/ledtrig-input.c
new file mode 100644
index 0000000000000..8a974a3556564
--- /dev/null
+++ b/drivers/leds/trigger/ledtrig-input.c
@@ -0,0 +1,55 @@
+/*
+ * Set LED GPIO to Input "Trigger"
+ *
+ * Copyright 2015 Phil Elwell <phil@raspberrypi.org>
+ *
+ * Based on Nick Forbes's ledtrig-default-on.c.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/leds.h>
+#include <linux/gpio.h>
+#include "../leds.h"
+
+static int input_trig_activate(struct led_classdev *led_cdev)
+{
+	led_cdev->flags |= SET_GPIO_INPUT;
+	led_set_brightness(led_cdev, 0);
+	return 0;
+}
+
+static void input_trig_deactivate(struct led_classdev *led_cdev)
+{
+	led_cdev->flags |= SET_GPIO_OUTPUT;
+	led_set_brightness(led_cdev, 0);
+}
+
+static struct led_trigger input_led_trigger = {
+	.name     = "input",
+	.activate = input_trig_activate,
+	.deactivate = input_trig_deactivate,
+};
+
+static int __init input_trig_init(void)
+{
+	return led_trigger_register(&input_led_trigger);
+}
+
+static void __exit input_trig_exit(void)
+{
+	led_trigger_unregister(&input_led_trigger);
+}
+
+module_init(input_trig_init);
+module_exit(input_trig_exit);
+
+MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
+MODULE_DESCRIPTION("Set LED GPIO to Input \"trigger\"");
+MODULE_LICENSE("GPL");
diff --git a/include/linux/leds.h b/include/linux/leds.h
index 834683d603f91..ac55bc925f7da 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -50,6 +50,9 @@ struct led_classdev {
 #define LED_PANIC_INDICATOR	BIT(20)
 #define LED_BRIGHT_HW_CHANGED	BIT(21)
 #define LED_RETAIN_AT_SHUTDOWN	BIT(22)
+	/* Additions for Raspberry Pi PWR LED */
+#define SET_GPIO_INPUT		BIT(30)
+#define SET_GPIO_OUTPUT		BIT(31)
 
 	/* set_brightness_work / blink_timer flags, atomic, private. */
 	unsigned long		work_flags;
-- 
GitLab


From 85957532ef6c5f3b2c8f2b8bbea753cabd92ece6 Mon Sep 17 00:00:00 2001
From: Siarhei Siamashka <siarhei.siamashka@gmail.com>
Date: Mon, 17 Jun 2013 13:32:11 +0300
Subject: [PATCH 0059/1835] fbdev: add FBIOCOPYAREA ioctl

Based on the patch authored by Ali Gholami Rudi at
    https://lkml.org/lkml/2009/7/13/153

Provide an ioctl for userspace applications, but only if this operation
is hardware accelerated (otherwide it does not make any sense).

Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>

bcm2708_fb: Add ioctl for reading gpu memory through dma
---
 drivers/video/fbdev/bcm2708_fb.c | 119 ++++++++++++++++++++++++++++++-
 drivers/video/fbdev/core/fbmem.c |  36 ++++++++++
 include/uapi/linux/fb.h          |  12 ++++
 3 files changed, 166 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 205cb26cac0ee..6c9ee9ca8ee2d 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -31,8 +31,10 @@
 #include <linux/console.h>
 #include <linux/debugfs.h>
 #include <asm/sizes.h>
+#include <linux/uaccess.h>
 #include <linux/io.h>
 #include <linux/dma-mapping.h>
+#include <linux/cred.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 //#define BCM2708_FB_DEBUG
@@ -95,6 +97,7 @@ struct bcm2708_fb {
 	wait_queue_head_t dma_waitq;
 	struct bcm2708_fb_stats stats;
 	unsigned long fb_bus_address;
+	struct { u32 base, length; } gpu;
 };
 
 #define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
@@ -439,7 +442,118 @@ static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
 	return result;
 }
 
-static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
+static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
+		       int size)
+{
+	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
+	struct bcm2708_dma_cb *cb = fb->cb_base;
+
+	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
+		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
+		   BCM2708_DMA_D_INC;
+	cb->dst = dst;
+	cb->src = src;
+	cb->length = size;
+	cb->stride = 0;
+	cb->pad[0] = 0;
+	cb->pad[1] = 0;
+	cb->next = 0;
+
+	if (size < dma_busy_wait_threshold) {
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		bcm_dma_wait_idle(fb->dma_chan_base);
+	} else {
+		void __iomem *dma_chan = fb->dma_chan_base;
+
+		cb->info |= BCM2708_DMA_INT_EN;
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		while (bcm_dma_is_busy(dma_chan)) {
+			wait_event_interruptible(
+				fb->dma_waitq,
+				!bcm_dma_is_busy(dma_chan));
+		}
+		fb->stats.dma_irqs++;
+	}
+	fb->stats.dma_copies++;
+}
+
+/* address with no aliases */
+#define INTALIAS_NORMAL(x) ((x)&~0xc0000000)
+/* cache coherent but non-allocating in L1 and L2 */
+#define INTALIAS_L1L2_NONALLOCATING(x) (((x)&~0xc0000000)|0x80000000)
+
+static long vc_mem_copy(struct bcm2708_fb *fb, unsigned long arg)
+{
+	struct fb_dmacopy ioparam;
+	size_t size = PAGE_SIZE;
+	u32 *buf = NULL;
+	dma_addr_t bus_addr;
+	long rc = 0;
+	size_t offset;
+
+	/* restrict this to root user */
+	if (!uid_eq(current_euid(), GLOBAL_ROOT_UID)) {
+		rc = -EFAULT;
+		goto out;
+	}
+
+	/* Get the parameter data.
+	 */
+	if (copy_from_user
+	    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+		pr_err("[%s]: failed to copy-from-user\n",
+				__func__);
+		rc = -EFAULT;
+		goto out;
+	}
+
+	if (fb->gpu.base == 0 || fb->gpu.length == 0) {
+		pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
+			__func__, fb->gpu.base, fb->gpu.length);
+		return -EFAULT;
+	}
+
+	if (INTALIAS_NORMAL(ioparam.src) < fb->gpu.base ||
+		INTALIAS_NORMAL(ioparam.src) >= fb->gpu.base + fb->gpu.length) {
+		pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
+			INTALIAS_NORMAL(ioparam.src), fb->gpu.base,
+			fb->gpu.base + fb->gpu.length);
+		return -EFAULT;
+	}
+
+	buf = dma_alloc_coherent(fb->fb.device, PAGE_ALIGN(size), &bus_addr,
+				 GFP_ATOMIC);
+	if (!buf) {
+		pr_err("[%s]: failed to dma_alloc_coherent(%d)\n",
+				__func__, size);
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	for (offset = 0; offset < ioparam.length; offset += size) {
+		size_t remaining = ioparam.length - offset;
+		size_t s = min(size, remaining);
+		unsigned char *p = (unsigned char *)ioparam.src + offset;
+		unsigned char *q = (unsigned char *)ioparam.dst + offset;
+
+		dma_memcpy(fb, bus_addr,
+			   INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
+		if (copy_to_user(q, buf, s) != 0) {
+			pr_err("[%s]: failed to copy-to-user\n",
+					__func__);
+			rc = -EFAULT;
+			goto out;
+		}
+	}
+out:
+	if (buf)
+		dma_free_coherent(fb->fb.device, PAGE_ALIGN(size), buf,
+				  bus_addr);
+	return rc;
+}
+
+static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
+			 unsigned long arg)
 {
 	struct bcm2708_fb *fb = to_bcm2708(info);
 	u32 dummy = 0;
@@ -451,6 +565,9 @@ static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd, unsigned long a
 					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
 					    &dummy, sizeof(dummy));
 		break;
+	case FBIODMACOPY:
+		ret = vc_mem_copy(fb, arg);
+		break;
 	default:
 		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
 		return -ENOTTY;
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index c48f083d522a2..9998a69041b87 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1081,6 +1081,31 @@ fb_blank(struct fb_info *info, int blank)
 }
 EXPORT_SYMBOL(fb_blank);
 
+static int fb_copyarea_user(struct fb_info *info,
+			    struct fb_copyarea *copy)
+{
+	int ret = 0;
+	if (!lock_fb_info(info))
+		return -ENODEV;
+	if (copy->dx >= info->var.xres ||
+	    copy->sx >= info->var.xres ||
+	    copy->width > info->var.xres ||
+	    copy->dy >= info->var.yres ||
+	    copy->sy >= info->var.yres ||
+	    copy->height > info->var.yres ||
+	    copy->dx + copy->width > info->var.xres ||
+	    copy->sx + copy->width > info->var.xres ||
+	    copy->dy + copy->height > info->var.yres ||
+	    copy->sy + copy->height > info->var.yres) {
+		ret = -EINVAL;
+		goto out;
+	}
+	info->fbops->fb_copyarea(info, copy);
+out:
+	unlock_fb_info(info);
+	return ret;
+}
+
 static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 			unsigned long arg)
 {
@@ -1091,6 +1116,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 	struct fb_cmap cmap_from;
 	struct fb_cmap_user cmap;
 	struct fb_event event;
+	struct fb_copyarea copy;
 	void __user *argp = (void __user *)arg;
 	long ret = 0;
 
@@ -1208,6 +1234,15 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 		unlock_fb_info(info);
 		console_unlock();
 		break;
+	case FBIOCOPYAREA:
+		if (info->flags & FBINFO_HWACCEL_COPYAREA) {
+			/* only provide this ioctl if it is accelerated */
+			if (copy_from_user(&copy, argp, sizeof(copy)))
+				return -EFAULT;
+			ret = fb_copyarea_user(info, &copy);
+			break;
+		}
+		/* fall through */
 	default:
 		if (!lock_fb_info(info))
 			return -ENODEV;
@@ -1353,6 +1388,7 @@ static long fb_compat_ioctl(struct file *file, unsigned int cmd,
 	case FBIOPAN_DISPLAY:
 	case FBIOGET_CON2FBMAP:
 	case FBIOPUT_CON2FBMAP:
+	case FBIOCOPYAREA:
 		arg = (unsigned long) compat_ptr(arg);
 		/* fall through */
 	case FBIOBLANK:
diff --git a/include/uapi/linux/fb.h b/include/uapi/linux/fb.h
index 6cd9b198b7c64..f36c92c2da748 100644
--- a/include/uapi/linux/fb.h
+++ b/include/uapi/linux/fb.h
@@ -35,6 +35,12 @@
 #define FBIOPUT_MODEINFO        0x4617
 #define FBIOGET_DISPINFO        0x4618
 #define FBIO_WAITFORVSYNC	_IOW('F', 0x20, __u32)
+/*
+ * HACK: use 'z' in order not to clash with any other ioctl numbers which might
+ * be concurrently added to the mainline kernel
+ */
+#define FBIOCOPYAREA		_IOW('z', 0x21, struct fb_copyarea)
+#define FBIODMACOPY 		_IOW('z', 0x22, struct fb_dmacopy)
 
 #define FB_TYPE_PACKED_PIXELS		0	/* Packed Pixels	*/
 #define FB_TYPE_PLANES			1	/* Non interleaved planes */
@@ -347,6 +353,12 @@ struct fb_copyarea {
 	__u32 sy;
 };
 
+struct fb_dmacopy {
+	void *dst;
+	__u32 src;
+	__u32 length;
+};
+
 struct fb_fillrect {
 	__u32 dx;	/* screen-relative */
 	__u32 dy;
-- 
GitLab


From 119c9d1c4aa24545e4d810dab1e6be52cbf0025d Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 3 Jul 2013 00:54:08 +0100
Subject: [PATCH 0060/1835] Added Device IDs for August DVB-T 205

---
 drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index a970224a94bdd..af361660be384 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -1917,6 +1917,10 @@ static const struct usb_device_id rtl28xxu_id_table[] = {
 		&rtl28xxu_props, "Compro VideoMate U650F", NULL) },
 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, 0xd394,
 		&rtl28xxu_props, "MaxMedia HU394-T", NULL) },
+	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xb803 /*USB_PID_AUGUST_DVBT205*/,
+		&rtl28xxu_props, "August DVB-T 205", NULL) },
+	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xa803 /*USB_PID_AUGUST_DVBT205*/,
+		&rtl28xxu_props, "August DVB-T 205", NULL) },
 	{ DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a03,
 		&rtl28xxu_props, "Leadtek WinFast DTV Dongle mini", NULL) },
 	{ DVB_USB_DEVICE(USB_VID_GTEK, USB_PID_CPYTO_REDI_PC50A,
-- 
GitLab


From 8569b230d73fdac7787b0ad97a08d432108ed5b9 Mon Sep 17 00:00:00 2001
From: Gordon Hollingworth <gordon@raspberrypi.org>
Date: Tue, 12 May 2015 14:47:56 +0100
Subject: [PATCH 0061/1835] rpi-ft5406: Add touchscreen driver for pi LCD
 display

Fix driver detection failure Check that the buffer response is non-zero meaning the touchscreen was detected

rpi-ft5406: Use firmware API

RPI-FT5406: Enable aarch64 support through explicit iomem interface

Signed-off-by: Gerhard de Clercq <gerharddeclercq@outlook.com>
---
 drivers/input/touchscreen/Kconfig      |   7 +
 drivers/input/touchscreen/Makefile     |   1 +
 drivers/input/touchscreen/rpi-ft5406.c | 292 +++++++++++++++++++++++++
 3 files changed, 300 insertions(+)
 create mode 100644 drivers/input/touchscreen/rpi-ft5406.c

diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 2a80675cfd947..8e6cb4042e7b8 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -696,6 +696,13 @@ config TOUCHSCREEN_EDT_FT5X06
 	  To compile this driver as a module, choose M here: the
 	  module will be called edt-ft5x06.
 
+config TOUCHSCREEN_RPI_FT5406
+	tristate "Raspberry Pi FT5406 driver"
+	depends on RASPBERRYPI_FIRMWARE
+	help
+	  Say Y here to enable the Raspberry Pi memory based FT5406 device
+
+
 config TOUCHSCREEN_MIGOR
 	tristate "Renesas MIGO-R touchscreen"
 	depends on (SH_MIGOR || COMPILE_TEST) && I2C
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 5911a4190cd2c..cbc2159c16a52 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -33,6 +33,7 @@ obj-$(CONFIG_TOUCHSCREEN_DA9034)	+= da9034-ts.o
 obj-$(CONFIG_TOUCHSCREEN_DA9052)	+= da9052_tsi.o
 obj-$(CONFIG_TOUCHSCREEN_DYNAPRO)	+= dynapro.o
 obj-$(CONFIG_TOUCHSCREEN_EDT_FT5X06)	+= edt-ft5x06.o
+obj-$(CONFIG_TOUCHSCREEN_RPI_FT5406)	+= rpi-ft5406.o
 obj-$(CONFIG_TOUCHSCREEN_HAMPSHIRE)	+= hampshire.o
 obj-$(CONFIG_TOUCHSCREEN_GUNZE)		+= gunze.o
 obj-$(CONFIG_TOUCHSCREEN_EETI)		+= eeti_ts.o
diff --git a/drivers/input/touchscreen/rpi-ft5406.c b/drivers/input/touchscreen/rpi-ft5406.c
new file mode 100644
index 0000000000000..9d7d05482355d
--- /dev/null
+++ b/drivers/input/touchscreen/rpi-ft5406.c
@@ -0,0 +1,292 @@
+/*
+ * Driver for memory based ft5406 touchscreen
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/input.h>
+#include <linux/irq.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/bitops.h>
+#include <linux/input/mt.h>
+#include <linux/kthread.h>
+#include <linux/platform_device.h>
+#include <linux/stddef.h>
+#include <asm/io.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MAXIMUM_SUPPORTED_POINTS 10
+struct ft5406_regs {
+	uint8_t device_mode;
+	uint8_t gesture_id;
+	uint8_t num_points;
+	struct ft5406_touch {
+		uint8_t xh;
+		uint8_t xl;
+		uint8_t yh;
+		uint8_t yl;
+		uint8_t res1;
+		uint8_t res2;
+	} point[MAXIMUM_SUPPORTED_POINTS];
+};
+
+#define SCREEN_WIDTH  800
+#define SCREEN_HEIGHT 480
+
+struct ft5406 {
+	struct platform_device * pdev;
+	struct input_dev       * input_dev;
+	void __iomem           * ts_base;
+	dma_addr_t		 bus_addr;
+	struct task_struct     * thread;
+};
+
+/* Thread to poll for touchscreen events
+ * 
+ * This thread polls the memory based register copy of the ft5406 registers
+ * using the number of points register to know whether the copy has been
+ * updated (we write 99 to the memory copy, the GPU will write between 
+ * 0 - 10 points)
+ */
+static int ft5406_thread(void *arg)
+{
+	struct ft5406 *ts = (struct ft5406 *) arg;
+	struct ft5406_regs regs;
+	int known_ids = 0;
+	
+	while(!kthread_should_stop())
+	{
+		// 60fps polling
+		msleep_interruptible(17);
+		memcpy_fromio(&regs, ts->ts_base, sizeof(struct ft5406_regs));
+		iowrite8(99, ts->ts_base + offsetof(struct ft5406_regs, num_points));
+		// Do not output if theres no new information (num_points is 99)
+		// or we have no touch points and don't need to release any
+		if(!(regs.num_points == 99 || (regs.num_points == 0 && known_ids == 0)))
+		{
+			int i;
+			int modified_ids = 0, released_ids;
+			for(i = 0; i < regs.num_points; i++)
+			{
+				int x = (((int) regs.point[i].xh & 0xf) << 8) + regs.point[i].xl;
+				int y = (((int) regs.point[i].yh & 0xf) << 8) + regs.point[i].yl;
+				int touchid = (regs.point[i].yh >> 4) & 0xf;
+				
+				modified_ids |= 1 << touchid;
+
+				if(!((1 << touchid) & known_ids))
+					dev_dbg(&ts->pdev->dev, "x = %d, y = %d, touchid = %d\n", x, y, touchid);
+				
+				input_mt_slot(ts->input_dev, touchid);
+				input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, 1);
+
+				input_report_abs(ts->input_dev, ABS_MT_POSITION_X, x);
+				input_report_abs(ts->input_dev, ABS_MT_POSITION_Y, y);
+
+			}
+
+			released_ids = known_ids & ~modified_ids;
+			for(i = 0; released_ids && i < MAXIMUM_SUPPORTED_POINTS; i++)
+			{
+				if(released_ids & (1<<i))
+				{
+					dev_dbg(&ts->pdev->dev, "Released %d, known = %x modified = %x\n", i, known_ids, modified_ids);
+					input_mt_slot(ts->input_dev, i);
+					input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, 0);
+					modified_ids &= ~(1 << i);
+				}
+			}
+			known_ids = modified_ids;
+			
+			input_mt_report_pointer_emulation(ts->input_dev, true);
+			input_sync(ts->input_dev);
+		}
+			
+	}
+	
+	return 0;
+}
+
+static int ft5406_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct ft5406 * ts;
+	struct device_node *fw_node;
+	struct rpi_firmware *fw;
+	u32 touchbuf;
+	
+	dev_info(dev, "Probing device\n");
+	
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	fw = rpi_firmware_get(fw_node);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	ts = devm_kzalloc(dev, sizeof(struct ft5406), GFP_KERNEL);
+	if (!ts) {
+		dev_err(dev, "Failed to allocate memory\n");
+		return -ENOMEM;
+	}
+
+	ts->input_dev = input_allocate_device();
+	if (!ts->input_dev) {
+		dev_err(dev, "Failed to allocate input device\n");
+		return -ENOMEM;
+	}
+
+	ts->ts_base = dma_zalloc_coherent(dev, PAGE_SIZE, &ts->bus_addr, GFP_KERNEL);
+	if (!ts->ts_base) {
+		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
+				__func__, PAGE_SIZE);
+		err = -ENOMEM;
+		goto out;
+	}
+
+	touchbuf = (u32)ts->bus_addr;
+	err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+				    &touchbuf, sizeof(touchbuf));
+
+	if (err || touchbuf != 0) {
+		dev_warn(dev, "Failed to set touchbuf, trying to get err:%x\n", err);
+		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
+		ts->ts_base = 0;
+		ts->bus_addr = 0;
+	}
+
+	if (!ts->ts_base) {
+		dev_warn(dev, "set failed, trying get (err:%d touchbuf:%x virt:%p bus:%x)\n", err, touchbuf, ts->ts_base, ts->bus_addr);
+
+		err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF,
+				    &touchbuf, sizeof(touchbuf));
+		if (err) {
+			dev_err(dev, "Failed to get touch buffer\n");
+			goto out;
+		}
+
+		if (!touchbuf) {
+			dev_err(dev, "Touchscreen not detected\n");
+			err = -ENODEV;
+			goto out;
+		}
+
+		dev_dbg(dev, "Got TS buffer 0x%x\n", touchbuf);
+
+		// mmap the physical memory
+		touchbuf &= ~0xc0000000;
+		ts->ts_base = ioremap(touchbuf, sizeof(struct ft5406_regs));
+		if (ts->ts_base == NULL)
+		{
+			dev_err(dev, "Failed to map physical address\n");
+			err = -ENOMEM;
+			goto out;
+		}
+	}
+	platform_set_drvdata(pdev, ts);
+	ts->pdev = pdev;
+	
+	ts->input_dev->name = "FT5406 memory based driver";
+	
+	__set_bit(EV_KEY, ts->input_dev->evbit);
+	__set_bit(EV_SYN, ts->input_dev->evbit);
+	__set_bit(EV_ABS, ts->input_dev->evbit);
+
+	input_set_abs_params(ts->input_dev, ABS_MT_POSITION_X, 0,
+			     SCREEN_WIDTH, 0, 0);
+	input_set_abs_params(ts->input_dev, ABS_MT_POSITION_Y, 0,
+			     SCREEN_HEIGHT, 0, 0);
+
+	input_mt_init_slots(ts->input_dev, MAXIMUM_SUPPORTED_POINTS, INPUT_MT_DIRECT);
+
+	input_set_drvdata(ts->input_dev, ts);
+	
+	err = input_register_device(ts->input_dev);
+	if (err) {
+		dev_err(dev, "could not register input device, %d\n",
+			err);
+		goto out;
+	}
+
+	// create thread to poll the touch events
+	ts->thread = kthread_run(ft5406_thread, ts, "ft5406");
+	if(ts->thread == NULL)
+	{
+		dev_err(dev, "Failed to create kernel thread");
+		err = -ENOMEM;
+		goto out;
+	}
+
+	return 0;
+
+out:
+	if (ts->bus_addr) {
+		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
+		ts->bus_addr = 0;
+		ts->ts_base = NULL;
+	} else if (ts->ts_base) {
+		iounmap(ts->ts_base);
+		ts->ts_base = NULL;
+	}
+	if (ts->input_dev) {
+		input_unregister_device(ts->input_dev);
+		ts->input_dev = NULL;
+	}
+	return err;
+}
+
+static int ft5406_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct ft5406 *ts = (struct ft5406 *) platform_get_drvdata(pdev);
+	
+	dev_info(dev, "Removing rpi-ft5406\n");
+	
+	kthread_stop(ts->thread);
+
+	if (ts->bus_addr)
+		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
+	else if (ts->ts_base)
+		iounmap(ts->ts_base);
+	if (ts->input_dev)
+		input_unregister_device(ts->input_dev);
+	
+	return 0;
+}
+
+static const struct of_device_id ft5406_match[] = {
+	{ .compatible = "rpi,rpi-ft5406", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, ft5406_match);
+
+static struct platform_driver ft5406_driver = {
+	.driver = {
+		.name   = "rpi-ft5406",
+		.owner  = THIS_MODULE,
+		.of_match_table = ft5406_match,
+	},
+	.probe          = ft5406_probe,
+	.remove         = ft5406_remove,
+};
+
+module_platform_driver(ft5406_driver);
+
+MODULE_AUTHOR("Gordon Hollingworth");
+MODULE_DESCRIPTION("Touchscreen driver for memory based FT5406");
+MODULE_LICENSE("GPL");
-- 
GitLab


From 385b89c3588d764035d188057da2a9cef830affb Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 28 Nov 2016 16:50:04 +0000
Subject: [PATCH 0062/1835] Improve __copy_to_user and __copy_from_user
 performance

Provide a __copy_from_user that uses memcpy. On BCM2708, use
optimised memcpy/memmove/memcmp/memset implementations.

arch/arm: Add mmiocpy/set aliases for memcpy/set

See: https://github.com/raspberrypi/linux/issues/1082

copy_from_user: CPU_SW_DOMAIN_PAN compatibility

The downstream copy_from_user acceleration must also play nice with
CONFIG_CPU_SW_DOMAIN_PAN.

See: https://github.com/raspberrypi/linux/issues/1381

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/include/asm/string.h      |   5 +
 arch/arm/include/asm/uaccess.h     |   3 +
 arch/arm/lib/Makefile              |  14 +-
 arch/arm/lib/arm-mem.h             | 159 +++++++++
 arch/arm/lib/copy_from_user.S      |   4 +-
 arch/arm/lib/exports_rpi.c         |  37 +++
 arch/arm/lib/memcmp_rpi.S          | 285 ++++++++++++++++
 arch/arm/lib/memcpy_rpi.S          |  61 ++++
 arch/arm/lib/memcpymove.h          | 506 +++++++++++++++++++++++++++++
 arch/arm/lib/memmove_rpi.S         |  61 ++++
 arch/arm/lib/memset_rpi.S          | 128 ++++++++
 arch/arm/lib/uaccess_with_memcpy.c | 120 ++++++-
 arch/arm/mach-bcm/Kconfig          |   7 +
 13 files changed, 1385 insertions(+), 5 deletions(-)
 create mode 100644 arch/arm/lib/arm-mem.h
 create mode 100644 arch/arm/lib/exports_rpi.c
 create mode 100644 arch/arm/lib/memcmp_rpi.S
 create mode 100644 arch/arm/lib/memcpy_rpi.S
 create mode 100644 arch/arm/lib/memcpymove.h
 create mode 100644 arch/arm/lib/memmove_rpi.S
 create mode 100644 arch/arm/lib/memset_rpi.S

diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h
index 111a1d8a41ddf..867a4465cebf9 100644
--- a/arch/arm/include/asm/string.h
+++ b/arch/arm/include/asm/string.h
@@ -39,4 +39,9 @@ static inline void *memset64(uint64_t *p, uint64_t v, __kernel_size_t n)
 	return __memset64(p, v, n * 8, v >> 32);
 }
 
+#ifdef CONFIG_BCM2835_FAST_MEMCPY
+#define __HAVE_ARCH_MEMCMP
+extern int memcmp(const void *, const void *, size_t);
+#endif
+
 #endif
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index c136eef8f690b..f770393d2d62a 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -496,6 +496,9 @@ do {									\
 extern unsigned long __must_check
 arm_copy_from_user(void *to, const void __user *from, unsigned long n);
 
+extern unsigned long __must_check
+__copy_from_user_std(void *to, const void __user *from, unsigned long n);
+
 static inline unsigned long __must_check
 raw_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index 0bff0176db2c4..284a86832db34 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -7,8 +7,8 @@
 
 lib-y		:= backtrace.o changebit.o csumipv6.o csumpartial.o   \
 		   csumpartialcopy.o csumpartialcopyuser.o clearbit.o \
-		   delay.o delay-loop.o findbit.o memchr.o memcpy.o   \
-		   memmove.o memset.o setbit.o                        \
+		   delay.o delay-loop.o findbit.o memchr.o            \
+		   setbit.o                                           \
 		   strchr.o strrchr.o                                 \
 		   testchangebit.o testclearbit.o testsetbit.o        \
 		   ashldi3.o ashrdi3.o lshrdi3.o muldi3.o             \
@@ -19,6 +19,16 @@ lib-y		:= backtrace.o changebit.o csumipv6.o csumpartial.o   \
 mmu-y		:= clear_user.o copy_page.o getuser.o putuser.o       \
 		   copy_from_user.o copy_to_user.o
 
+# Choose optimised implementations for Raspberry Pi
+ifeq ($(CONFIG_BCM2835_FAST_MEMCPY),y)
+  CFLAGS_uaccess_with_memcpy.o += -DCOPY_FROM_USER_THRESHOLD=1600
+  CFLAGS_uaccess_with_memcpy.o += -DCOPY_TO_USER_THRESHOLD=672
+  obj-$(CONFIG_MODULES) += exports_rpi.o
+  lib-y        += memcpy_rpi.o memmove_rpi.o memset_rpi.o memcmp_rpi.o
+else
+  lib-y        += memcpy.o memmove.o memset.o
+endif
+
 # using lib_ here won't override already available weak symbols
 obj-$(CONFIG_UACCESS_WITH_MEMCPY) += uaccess_with_memcpy.o
 
diff --git a/arch/arm/lib/arm-mem.h b/arch/arm/lib/arm-mem.h
new file mode 100644
index 0000000000000..5d4bda19ad207
--- /dev/null
+++ b/arch/arm/lib/arm-mem.h
@@ -0,0 +1,159 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+.macro myfunc fname
+ .func fname
+ .global fname
+fname:
+.endm
+
+.macro preload_leading_step1  backwards, ptr, base
+/* If the destination is already 16-byte aligned, then we need to preload
+ * between 0 and prefetch_distance (inclusive) cache lines ahead so there
+ * are no gaps when the inner loop starts.
+ */
+ .if backwards
+        sub     ptr, base, #1
+        bic     ptr, ptr, #31
+ .else
+        bic     ptr, base, #31
+ .endif
+ .set OFFSET, 0
+ .rept prefetch_distance+1
+        pld     [ptr, #OFFSET]
+  .if backwards
+   .set OFFSET, OFFSET-32
+  .else
+   .set OFFSET, OFFSET+32
+  .endif
+ .endr
+.endm
+
+.macro preload_leading_step2  backwards, ptr, base, leading_bytes, tmp
+/* However, if the destination is not 16-byte aligned, we may need to
+ * preload one more cache line than that. The question we need to ask is:
+ * are the leading bytes more than the amount by which the source
+ * pointer will be rounded down for preloading, and if so, by how many
+ * cache lines?
+ */
+ .if backwards
+/* Here we compare against how many bytes we are into the
+ * cache line, counting down from the highest such address.
+ * Effectively, we want to calculate
+ *     leading_bytes = dst&15
+ *     cacheline_offset = 31-((src-leading_bytes-1)&31)
+ *     extra_needed = leading_bytes - cacheline_offset
+ * and test if extra_needed is <= 0, or rearranging:
+ *     leading_bytes + (src-leading_bytes-1)&31 <= 31
+ */
+        mov     tmp, base, lsl #32-5
+        sbc     tmp, tmp, leading_bytes, lsl #32-5
+        adds    tmp, tmp, leading_bytes, lsl #32-5
+        bcc     61f
+        pld     [ptr, #-32*(prefetch_distance+1)]
+ .else
+/* Effectively, we want to calculate
+ *     leading_bytes = (-dst)&15
+ *     cacheline_offset = (src+leading_bytes)&31
+ *     extra_needed = leading_bytes - cacheline_offset
+ * and test if extra_needed is <= 0.
+ */
+        mov     tmp, base, lsl #32-5
+        add     tmp, tmp, leading_bytes, lsl #32-5
+        rsbs    tmp, tmp, leading_bytes, lsl #32-5
+        bls     61f
+        pld     [ptr, #32*(prefetch_distance+1)]
+ .endif
+61:
+.endm
+
+.macro preload_trailing  backwards, base, remain, tmp
+        /* We need either 0, 1 or 2 extra preloads */
+ .if backwards
+        rsb     tmp, base, #0
+        mov     tmp, tmp, lsl #32-5
+ .else
+        mov     tmp, base, lsl #32-5
+ .endif
+        adds    tmp, tmp, remain, lsl #32-5
+        adceqs  tmp, tmp, #0
+        /* The instruction above has two effects: ensures Z is only
+         * set if C was clear (so Z indicates that both shifted quantities
+         * were 0), and clears C if Z was set (so C indicates that the sum
+         * of the shifted quantities was greater and not equal to 32) */
+        beq     82f
+ .if backwards
+        sub     tmp, base, #1
+        bic     tmp, tmp, #31
+ .else
+        bic     tmp, base, #31
+ .endif
+        bcc     81f
+ .if backwards
+        pld     [tmp, #-32*(prefetch_distance+1)]
+81:
+        pld     [tmp, #-32*prefetch_distance]
+ .else
+        pld     [tmp, #32*(prefetch_distance+2)]
+81:
+        pld     [tmp, #32*(prefetch_distance+1)]
+ .endif
+82:
+.endm
+
+.macro preload_all    backwards, narrow_case, shift, base, remain, tmp0, tmp1
+ .if backwards
+        sub     tmp0, base, #1
+        bic     tmp0, tmp0, #31
+        pld     [tmp0]
+        sub     tmp1, base, remain, lsl #shift
+ .else
+        bic     tmp0, base, #31
+        pld     [tmp0]
+        add     tmp1, base, remain, lsl #shift
+        sub     tmp1, tmp1, #1
+ .endif
+        bic     tmp1, tmp1, #31
+        cmp     tmp1, tmp0
+        beq     92f
+ .if narrow_case
+        /* In this case, all the data fits in either 1 or 2 cache lines */
+        pld     [tmp1]
+ .else
+91:
+  .if backwards
+        sub     tmp0, tmp0, #32
+  .else
+        add     tmp0, tmp0, #32
+  .endif
+        cmp     tmp0, tmp1
+        pld     [tmp0]
+        bne     91b
+ .endif
+92:
+.endm
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 6709a8d33963b..1258914174513 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -89,7 +89,8 @@
 
 	.text
 
-ENTRY(arm_copy_from_user)
+ENTRY(__copy_from_user_std)
+WEAK(arm_copy_from_user)
 #ifdef CONFIG_CPU_SPECTRE
 	get_thread_info r3
 	ldr	r3, [r3, #TI_ADDR_LIMIT]
@@ -99,6 +100,7 @@ ENTRY(arm_copy_from_user)
 #include "copy_template.S"
 
 ENDPROC(arm_copy_from_user)
+ENDPROC(__copy_from_user_std)
 
 	.pushsection .fixup,"ax"
 	.align 0
diff --git a/arch/arm/lib/exports_rpi.c b/arch/arm/lib/exports_rpi.c
new file mode 100644
index 0000000000000..1f826047db754
--- /dev/null
+++ b/arch/arm/lib/exports_rpi.c
@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) 2014, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+EXPORT_SYMBOL(memcmp);
diff --git a/arch/arm/lib/memcmp_rpi.S b/arch/arm/lib/memcmp_rpi.S
new file mode 100644
index 0000000000000..bf6e4edfc9d3b
--- /dev/null
+++ b/arch/arm/lib/memcmp_rpi.S
@@ -0,0 +1,285 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+.macro memcmp_process_head  unaligned
+ .if unaligned
+        ldr     DAT0, [S_1], #4
+        ldr     DAT1, [S_1], #4
+        ldr     DAT2, [S_1], #4
+        ldr     DAT3, [S_1], #4
+ .else
+        ldmia   S_1!, {DAT0, DAT1, DAT2, DAT3}
+ .endif
+        ldmia   S_2!, {DAT4, DAT5, DAT6, DAT7}
+.endm
+
+.macro memcmp_process_tail
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        cmpeq   DAT2, DAT6
+        cmpeq   DAT3, DAT7
+        bne     200f
+.endm
+
+.macro memcmp_leading_31bytes
+        movs    DAT0, OFF, lsl #31
+        ldrmib  DAT0, [S_1], #1
+        ldrcsh  DAT1, [S_1], #2
+        ldrmib  DAT4, [S_2], #1
+        ldrcsh  DAT5, [S_2], #2
+        movpl   DAT0, #0
+        movcc   DAT1, #0
+        movpl   DAT4, #0
+        movcc   DAT5, #0
+        submi   N, N, #1
+        subcs   N, N, #2
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        bne     200f
+        movs    DAT0, OFF, lsl #29
+        ldrmi   DAT0, [S_1], #4
+        ldrcs   DAT1, [S_1], #4
+        ldrcs   DAT2, [S_1], #4
+        ldrmi   DAT4, [S_2], #4
+        ldmcsia S_2!, {DAT5, DAT6}
+        movpl   DAT0, #0
+        movcc   DAT1, #0
+        movcc   DAT2, #0
+        movpl   DAT4, #0
+        movcc   DAT5, #0
+        movcc   DAT6, #0
+        submi   N, N, #4
+        subcs   N, N, #8
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        cmpeq   DAT2, DAT6
+        bne     200f
+        tst     OFF, #16
+        beq     105f
+        memcmp_process_head  1
+        sub     N, N, #16
+        memcmp_process_tail
+105:
+.endm
+
+.macro memcmp_trailing_15bytes  unaligned
+        movs    N, N, lsl #29
+ .if unaligned
+        ldrcs   DAT0, [S_1], #4
+        ldrcs   DAT1, [S_1], #4
+ .else
+        ldmcsia S_1!, {DAT0, DAT1}
+ .endif
+        ldrmi   DAT2, [S_1], #4
+        ldmcsia S_2!, {DAT4, DAT5}
+        ldrmi   DAT6, [S_2], #4
+        movcc   DAT0, #0
+        movcc   DAT1, #0
+        movpl   DAT2, #0
+        movcc   DAT4, #0
+        movcc   DAT5, #0
+        movpl   DAT6, #0
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        cmpeq   DAT2, DAT6
+        bne     200f
+        movs    N, N, lsl #2
+        ldrcsh  DAT0, [S_1], #2
+        ldrmib  DAT1, [S_1]
+        ldrcsh  DAT4, [S_2], #2
+        ldrmib  DAT5, [S_2]
+        movcc   DAT0, #0
+        movpl   DAT1, #0
+        movcc   DAT4, #0
+        movpl   DAT5, #0
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        bne     200f
+.endm
+
+.macro memcmp_long_inner_loop  unaligned
+110:
+        memcmp_process_head  unaligned
+        pld     [S_2, #prefetch_distance*32 + 16]
+        memcmp_process_tail
+        memcmp_process_head  unaligned
+        pld     [S_1, OFF]
+        memcmp_process_tail
+        subs    N, N, #32
+        bhs     110b
+        /* Just before the final (prefetch_distance+1) 32-byte blocks,
+         * deal with final preloads */
+        preload_trailing  0, S_1, N, DAT0
+        preload_trailing  0, S_2, N, DAT0
+        add     N, N, #(prefetch_distance+2)*32 - 16
+120:
+        memcmp_process_head  unaligned
+        memcmp_process_tail
+        subs    N, N, #16
+        bhs     120b
+        /* Trailing words and bytes */
+        tst     N, #15
+        beq     199f
+        memcmp_trailing_15bytes  unaligned
+199:    /* Reached end without detecting a difference */
+        mov     a1, #0
+        setend  le
+        pop     {DAT1-DAT6, pc}
+.endm
+
+.macro memcmp_short_inner_loop  unaligned
+        subs    N, N, #16     /* simplifies inner loop termination */
+        blo     122f
+120:
+        memcmp_process_head  unaligned
+        memcmp_process_tail
+        subs    N, N, #16
+        bhs     120b
+122:    /* Trailing words and bytes */
+        tst     N, #15
+        beq     199f
+        memcmp_trailing_15bytes  unaligned
+199:    /* Reached end without detecting a difference */
+        mov     a1, #0
+        setend  le
+        pop     {DAT1-DAT6, pc}
+.endm
+
+/*
+ * int memcmp(const void *s1, const void *s2, size_t n);
+ * On entry:
+ * a1 = pointer to buffer 1
+ * a2 = pointer to buffer 2
+ * a3 = number of bytes to compare (as unsigned chars)
+ * On exit:
+ * a1 = >0/=0/<0 if s1 >/=/< s2
+ */
+
+.set prefetch_distance, 2
+
+ENTRY(memcmp)
+        S_1     .req    a1
+        S_2     .req    a2
+        N       .req    a3
+        DAT0    .req    a4
+        DAT1    .req    v1
+        DAT2    .req    v2
+        DAT3    .req    v3
+        DAT4    .req    v4
+        DAT5    .req    v5
+        DAT6    .req    v6
+        DAT7    .req    ip
+        OFF     .req    lr
+
+        push    {DAT1-DAT6, lr}
+        setend  be /* lowest-addressed bytes are most significant */
+
+        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
+        cmp     N, #(prefetch_distance+3)*32 - 1
+        blo     170f
+
+        /* Long case */
+        /* Adjust N so that the decrement instruction can also test for
+         * inner loop termination. We want it to stop when there are
+         * (prefetch_distance+1) complete blocks to go. */
+        sub     N, N, #(prefetch_distance+2)*32
+        preload_leading_step1  0, DAT0, S_1
+        preload_leading_step1  0, DAT1, S_2
+        tst     S_2, #31
+        beq     154f
+        rsb     OFF, S_2, #0 /* no need to AND with 15 here */
+        preload_leading_step2  0, DAT0, S_1, OFF, DAT2
+        preload_leading_step2  0, DAT1, S_2, OFF, DAT2
+        memcmp_leading_31bytes
+154:    /* Second source now cacheline (32-byte) aligned; we have at
+         * least one prefetch to go. */
+        /* Prefetch offset is best selected such that it lies in the
+         * first 8 of each 32 bytes - but it's just as easy to aim for
+         * the first one */
+        and     OFF, S_1, #31
+        rsb     OFF, OFF, #32*prefetch_distance
+        tst     S_1, #3
+        bne     140f
+        memcmp_long_inner_loop  0
+140:    memcmp_long_inner_loop  1
+
+170:    /* Short case */
+        teq     N, #0
+        beq     199f
+        preload_all 0, 0, 0, S_1, N, DAT0, DAT1
+        preload_all 0, 0, 0, S_2, N, DAT0, DAT1
+        tst     S_2, #3
+        beq     174f
+172:    subs    N, N, #1
+        blo     199f
+        ldrb    DAT0, [S_1], #1
+        ldrb    DAT4, [S_2], #1
+        cmp     DAT0, DAT4
+        bne     200f
+        tst     S_2, #3
+        bne     172b
+174:    /* Second source now 4-byte aligned; we have 0 or more bytes to go */
+        tst     S_1, #3
+        bne     140f
+        memcmp_short_inner_loop  0
+140:    memcmp_short_inner_loop  1
+
+200:    /* Difference found: determine sign. */
+        movhi   a1, #1
+        movlo   a1, #-1
+        setend  le
+        pop     {DAT1-DAT6, pc}
+
+        .unreq  S_1
+        .unreq  S_2
+        .unreq  N
+        .unreq  DAT0
+        .unreq  DAT1
+        .unreq  DAT2
+        .unreq  DAT3
+        .unreq  DAT4
+        .unreq  DAT5
+        .unreq  DAT6
+        .unreq  DAT7
+        .unreq  OFF
+ENDPROC(memcmp)
diff --git a/arch/arm/lib/memcpy_rpi.S b/arch/arm/lib/memcpy_rpi.S
new file mode 100644
index 0000000000000..30f8a9089a835
--- /dev/null
+++ b/arch/arm/lib/memcpy_rpi.S
@@ -0,0 +1,61 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+#include "memcpymove.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+/*
+ * void *memcpy(void * restrict s1, const void * restrict s2, size_t n);
+ * On entry:
+ * a1 = pointer to destination
+ * a2 = pointer to source
+ * a3 = number of bytes to copy
+ * On exit:
+ * a1 preserved
+ */
+
+.set prefetch_distance, 3
+
+ENTRY(mmiocpy)
+ENTRY(memcpy)
+        memcpy  0
+ENDPROC(memcpy)
+ENDPROC(mmiocpy)
diff --git a/arch/arm/lib/memcpymove.h b/arch/arm/lib/memcpymove.h
new file mode 100644
index 0000000000000..d8be5849c8609
--- /dev/null
+++ b/arch/arm/lib/memcpymove.h
@@ -0,0 +1,506 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+.macro unaligned_words  backwards, align, use_pld, words, r0, r1, r2, r3, r4, r5, r6, r7, r8
+ .if words == 1
+  .if backwards
+        mov     r1, r0, lsl #32-align*8
+        ldr     r0, [S, #-4]!
+        orr     r1, r1, r0, lsr #align*8
+        str     r1, [D, #-4]!
+  .else
+        mov     r0, r1, lsr #align*8
+        ldr     r1, [S, #4]!
+        orr     r0, r0, r1, lsl #32-align*8
+        str     r0, [D], #4
+  .endif
+ .elseif words == 2
+  .if backwards
+        ldr     r1, [S, #-4]!
+        mov     r2, r0, lsl #32-align*8
+        ldr     r0, [S, #-4]!
+        orr     r2, r2, r1, lsr #align*8
+        mov     r1, r1, lsl #32-align*8
+        orr     r1, r1, r0, lsr #align*8
+        stmdb   D!, {r1, r2}
+  .else
+        ldr     r1, [S, #4]!
+        mov     r0, r2, lsr #align*8
+        ldr     r2, [S, #4]!
+        orr     r0, r0, r1, lsl #32-align*8
+        mov     r1, r1, lsr #align*8
+        orr     r1, r1, r2, lsl #32-align*8
+        stmia   D!, {r0, r1}
+  .endif
+ .elseif words == 4
+  .if backwards
+        ldmdb   S!, {r2, r3}
+        mov     r4, r0, lsl #32-align*8
+        ldmdb   S!, {r0, r1}
+        orr     r4, r4, r3, lsr #align*8
+        mov     r3, r3, lsl #32-align*8
+        orr     r3, r3, r2, lsr #align*8
+        mov     r2, r2, lsl #32-align*8
+        orr     r2, r2, r1, lsr #align*8
+        mov     r1, r1, lsl #32-align*8
+        orr     r1, r1, r0, lsr #align*8
+        stmdb   D!, {r1, r2, r3, r4}
+  .else
+        ldmib   S!, {r1, r2}
+        mov     r0, r4, lsr #align*8
+        ldmib   S!, {r3, r4}
+        orr     r0, r0, r1, lsl #32-align*8
+        mov     r1, r1, lsr #align*8
+        orr     r1, r1, r2, lsl #32-align*8
+        mov     r2, r2, lsr #align*8
+        orr     r2, r2, r3, lsl #32-align*8
+        mov     r3, r3, lsr #align*8
+        orr     r3, r3, r4, lsl #32-align*8
+        stmia   D!, {r0, r1, r2, r3}
+  .endif
+ .elseif words == 8
+  .if backwards
+        ldmdb   S!, {r4, r5, r6, r7}
+        mov     r8, r0, lsl #32-align*8
+        ldmdb   S!, {r0, r1, r2, r3}
+   .if use_pld
+        pld     [S, OFF]
+   .endif
+        orr     r8, r8, r7, lsr #align*8
+        mov     r7, r7, lsl #32-align*8
+        orr     r7, r7, r6, lsr #align*8
+        mov     r6, r6, lsl #32-align*8
+        orr     r6, r6, r5, lsr #align*8
+        mov     r5, r5, lsl #32-align*8
+        orr     r5, r5, r4, lsr #align*8
+        mov     r4, r4, lsl #32-align*8
+        orr     r4, r4, r3, lsr #align*8
+        mov     r3, r3, lsl #32-align*8
+        orr     r3, r3, r2, lsr #align*8
+        mov     r2, r2, lsl #32-align*8
+        orr     r2, r2, r1, lsr #align*8
+        mov     r1, r1, lsl #32-align*8
+        orr     r1, r1, r0, lsr #align*8
+        stmdb   D!, {r5, r6, r7, r8}
+        stmdb   D!, {r1, r2, r3, r4}
+  .else
+        ldmib   S!, {r1, r2, r3, r4}
+        mov     r0, r8, lsr #align*8
+        ldmib   S!, {r5, r6, r7, r8}
+   .if use_pld
+        pld     [S, OFF]
+   .endif
+        orr     r0, r0, r1, lsl #32-align*8
+        mov     r1, r1, lsr #align*8
+        orr     r1, r1, r2, lsl #32-align*8
+        mov     r2, r2, lsr #align*8
+        orr     r2, r2, r3, lsl #32-align*8
+        mov     r3, r3, lsr #align*8
+        orr     r3, r3, r4, lsl #32-align*8
+        mov     r4, r4, lsr #align*8
+        orr     r4, r4, r5, lsl #32-align*8
+        mov     r5, r5, lsr #align*8
+        orr     r5, r5, r6, lsl #32-align*8
+        mov     r6, r6, lsr #align*8
+        orr     r6, r6, r7, lsl #32-align*8
+        mov     r7, r7, lsr #align*8
+        orr     r7, r7, r8, lsl #32-align*8
+        stmia   D!, {r0, r1, r2, r3}
+        stmia   D!, {r4, r5, r6, r7}
+  .endif
+ .endif
+.endm
+
+.macro memcpy_leading_15bytes  backwards, align
+        movs    DAT1, DAT2, lsl #31
+        sub     N, N, DAT2
+ .if backwards
+        ldrmib  DAT0, [S, #-1]!
+        ldrcsh  DAT1, [S, #-2]!
+        strmib  DAT0, [D, #-1]!
+        strcsh  DAT1, [D, #-2]!
+ .else
+        ldrmib  DAT0, [S], #1
+        ldrcsh  DAT1, [S], #2
+        strmib  DAT0, [D], #1
+        strcsh  DAT1, [D], #2
+ .endif
+        movs    DAT1, DAT2, lsl #29
+ .if backwards
+        ldrmi   DAT0, [S, #-4]!
+  .if align == 0
+        ldmcsdb S!, {DAT1, DAT2}
+  .else
+        ldrcs   DAT2, [S, #-4]!
+        ldrcs   DAT1, [S, #-4]!
+  .endif
+        strmi   DAT0, [D, #-4]!
+        stmcsdb D!, {DAT1, DAT2}
+ .else
+        ldrmi   DAT0, [S], #4
+  .if align == 0
+        ldmcsia S!, {DAT1, DAT2}
+  .else
+        ldrcs   DAT1, [S], #4
+        ldrcs   DAT2, [S], #4
+  .endif
+        strmi   DAT0, [D], #4
+        stmcsia D!, {DAT1, DAT2}
+ .endif
+.endm
+
+.macro memcpy_trailing_15bytes  backwards, align
+        movs    N, N, lsl #29
+ .if backwards
+  .if align == 0
+        ldmcsdb S!, {DAT0, DAT1}
+  .else
+        ldrcs   DAT1, [S, #-4]!
+        ldrcs   DAT0, [S, #-4]!
+  .endif
+        ldrmi   DAT2, [S, #-4]!
+        stmcsdb D!, {DAT0, DAT1}
+        strmi   DAT2, [D, #-4]!
+ .else
+  .if align == 0
+        ldmcsia S!, {DAT0, DAT1}
+  .else
+        ldrcs   DAT0, [S], #4
+        ldrcs   DAT1, [S], #4
+  .endif
+        ldrmi   DAT2, [S], #4
+        stmcsia D!, {DAT0, DAT1}
+        strmi   DAT2, [D], #4
+ .endif
+        movs    N, N, lsl #2
+ .if backwards
+        ldrcsh  DAT0, [S, #-2]!
+        ldrmib  DAT1, [S, #-1]
+        strcsh  DAT0, [D, #-2]!
+        strmib  DAT1, [D, #-1]
+ .else
+        ldrcsh  DAT0, [S], #2
+        ldrmib  DAT1, [S]
+        strcsh  DAT0, [D], #2
+        strmib  DAT1, [D]
+ .endif
+.endm
+
+.macro memcpy_long_inner_loop  backwards, align
+ .if align != 0
+  .if backwards
+        ldr     DAT0, [S, #-align]!
+  .else
+        ldr     LAST, [S, #-align]!
+  .endif
+ .endif
+110:
+ .if align == 0
+  .if backwards
+        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        pld     [S, OFF]
+        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
+        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
+  .else
+        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        pld     [S, OFF]
+        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
+        stmia   D!, {DAT4, DAT5, DAT6, LAST}
+  .endif
+ .else
+        unaligned_words  backwards, align, 1, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
+ .endif
+        subs    N, N, #32
+        bhs     110b
+        /* Just before the final (prefetch_distance+1) 32-byte blocks, deal with final preloads */
+        preload_trailing  backwards, S, N, OFF
+        add     N, N, #(prefetch_distance+2)*32 - 32
+120:
+ .if align == 0
+  .if backwards
+        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
+        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
+  .else
+        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
+        stmia   D!, {DAT4, DAT5, DAT6, LAST}
+  .endif
+ .else
+        unaligned_words  backwards, align, 0, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
+ .endif
+        subs    N, N, #32
+        bhs     120b
+        tst     N, #16
+ .if align == 0
+  .if backwards
+        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
+        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
+        stmneia D!, {DAT0, DAT1, DAT2, LAST}
+  .endif
+ .else
+        beq     130f
+        unaligned_words  backwards, align, 0, 4, DAT0, DAT1, DAT2, DAT3, LAST
+130:
+ .endif
+        /* Trailing words and bytes */
+        tst      N, #15
+        beq      199f
+ .if align != 0
+        add     S, S, #align
+ .endif
+        memcpy_trailing_15bytes  backwards, align
+199:
+        pop     {DAT3, DAT4, DAT5, DAT6, DAT7}
+        pop     {D, DAT1, DAT2, pc}
+.endm
+
+.macro memcpy_medium_inner_loop  backwards, align
+120:
+ .if backwards
+  .if align == 0
+        ldmdb   S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldr     LAST, [S, #-4]!
+        ldr     DAT2, [S, #-4]!
+        ldr     DAT1, [S, #-4]!
+        ldr     DAT0, [S, #-4]!
+  .endif
+        stmdb   D!, {DAT0, DAT1, DAT2, LAST}
+ .else
+  .if align == 0
+        ldmia   S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldr     DAT0, [S], #4
+        ldr     DAT1, [S], #4
+        ldr     DAT2, [S], #4
+        ldr     LAST, [S], #4
+  .endif
+        stmia   D!, {DAT0, DAT1, DAT2, LAST}
+ .endif
+        subs     N, N, #16
+        bhs      120b
+        /* Trailing words and bytes */
+        tst      N, #15
+        beq      199f
+        memcpy_trailing_15bytes  backwards, align
+199:
+        pop     {D, DAT1, DAT2, pc}
+.endm
+
+.macro memcpy_short_inner_loop  backwards, align
+        tst     N, #16
+ .if backwards
+  .if align == 0
+        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldrne   LAST, [S, #-4]!
+        ldrne   DAT2, [S, #-4]!
+        ldrne   DAT1, [S, #-4]!
+        ldrne   DAT0, [S, #-4]!
+  .endif
+        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
+ .else
+  .if align == 0
+        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldrne   DAT0, [S], #4
+        ldrne   DAT1, [S], #4
+        ldrne   DAT2, [S], #4
+        ldrne   LAST, [S], #4
+  .endif
+        stmneia D!, {DAT0, DAT1, DAT2, LAST}
+ .endif
+        memcpy_trailing_15bytes  backwards, align
+199:
+        pop     {D, DAT1, DAT2, pc}
+.endm
+
+.macro memcpy backwards
+        D       .req    a1
+        S       .req    a2
+        N       .req    a3
+        DAT0    .req    a4
+        DAT1    .req    v1
+        DAT2    .req    v2
+        DAT3    .req    v3
+        DAT4    .req    v4
+        DAT5    .req    v5
+        DAT6    .req    v6
+        DAT7    .req    sl
+        LAST    .req    ip
+        OFF     .req    lr
+
+        .cfi_startproc
+
+        push    {D, DAT1, DAT2, lr}
+
+        .cfi_def_cfa_offset 16
+        .cfi_rel_offset D, 0
+        .cfi_undefined  S
+        .cfi_undefined  N
+        .cfi_undefined  DAT0
+        .cfi_rel_offset DAT1, 4
+        .cfi_rel_offset DAT2, 8
+        .cfi_undefined  LAST
+        .cfi_rel_offset lr, 12
+
+ .if backwards
+        add     D, D, N
+        add     S, S, N
+ .endif
+
+        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
+        cmp     N, #31
+        blo     170f
+        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
+        cmp     N, #(prefetch_distance+3)*32 - 1
+        blo     160f
+
+        /* Long case */
+        push    {DAT3, DAT4, DAT5, DAT6, DAT7}
+
+        .cfi_def_cfa_offset 36
+        .cfi_rel_offset D, 20
+        .cfi_rel_offset DAT1, 24
+        .cfi_rel_offset DAT2, 28
+        .cfi_rel_offset DAT3, 0
+        .cfi_rel_offset DAT4, 4
+        .cfi_rel_offset DAT5, 8
+        .cfi_rel_offset DAT6, 12
+        .cfi_rel_offset DAT7, 16
+        .cfi_rel_offset lr, 32
+
+        /* Adjust N so that the decrement instruction can also test for
+         * inner loop termination. We want it to stop when there are
+         * (prefetch_distance+1) complete blocks to go. */
+        sub     N, N, #(prefetch_distance+2)*32
+        preload_leading_step1  backwards, DAT0, S
+ .if backwards
+        /* Bug in GAS: it accepts, but mis-assembles the instruction
+         * ands    DAT2, D, #60, 2
+         * which sets DAT2 to the number of leading bytes until destination is aligned and also clears C (sets borrow)
+         */
+        .word   0xE210513C
+        beq     154f
+ .else
+        ands    DAT2, D, #15
+        beq     154f
+        rsb     DAT2, DAT2, #16 /* number of leading bytes until destination aligned */
+ .endif
+        preload_leading_step2  backwards, DAT0, S, DAT2, OFF
+        memcpy_leading_15bytes backwards, 1
+154:    /* Destination now 16-byte aligned; we have at least one prefetch as well as at least one 16-byte output block */
+        /* Prefetch offset is best selected such that it lies in the first 8 of each 32 bytes - but it's just as easy to aim for the first one */
+ .if backwards
+        rsb     OFF, S, #3
+        and     OFF, OFF, #28
+        sub     OFF, OFF, #32*(prefetch_distance+1)
+ .else
+        and     OFF, S, #28
+        rsb     OFF, OFF, #32*prefetch_distance
+ .endif
+        movs    DAT0, S, lsl #31
+        bhi     157f
+        bcs     156f
+        bmi     155f
+        memcpy_long_inner_loop  backwards, 0
+155:    memcpy_long_inner_loop  backwards, 1
+156:    memcpy_long_inner_loop  backwards, 2
+157:    memcpy_long_inner_loop  backwards, 3
+
+        .cfi_def_cfa_offset 16
+        .cfi_rel_offset D, 0
+        .cfi_rel_offset DAT1, 4
+        .cfi_rel_offset DAT2, 8
+        .cfi_same_value DAT3
+        .cfi_same_value DAT4
+        .cfi_same_value DAT5
+        .cfi_same_value DAT6
+        .cfi_same_value DAT7
+        .cfi_rel_offset lr, 12
+
+160:    /* Medium case */
+        preload_all  backwards, 0, 0, S, N, DAT2, OFF
+        sub     N, N, #16     /* simplifies inner loop termination */
+ .if backwards
+        ands    DAT2, D, #15
+        beq     164f
+ .else
+        ands    DAT2, D, #15
+        beq     164f
+        rsb     DAT2, DAT2, #16
+ .endif
+        memcpy_leading_15bytes backwards, align
+164:    /* Destination now 16-byte aligned; we have at least one 16-byte output block */
+        tst     S, #3
+        bne     140f
+        memcpy_medium_inner_loop  backwards, 0
+140:    memcpy_medium_inner_loop  backwards, 1
+
+170:    /* Short case, less than 31 bytes, so no guarantee of at least one 16-byte block */
+        teq     N, #0
+        beq     199f
+        preload_all  backwards, 1, 0, S, N, DAT2, LAST
+        tst     D, #3
+        beq     174f
+172:    subs    N, N, #1
+        blo     199f
+ .if backwards
+        ldrb    DAT0, [S, #-1]!
+        strb    DAT0, [D, #-1]!
+ .else
+        ldrb    DAT0, [S], #1
+        strb    DAT0, [D], #1
+ .endif
+        tst     D, #3
+        bne     172b
+174:    /* Destination now 4-byte aligned; we have 0 or more output bytes to go */
+        tst     S, #3
+        bne     140f
+        memcpy_short_inner_loop  backwards, 0
+140:    memcpy_short_inner_loop  backwards, 1
+
+        .cfi_endproc
+
+        .unreq  D
+        .unreq  S
+        .unreq  N
+        .unreq  DAT0
+        .unreq  DAT1
+        .unreq  DAT2
+        .unreq  DAT3
+        .unreq  DAT4
+        .unreq  DAT5
+        .unreq  DAT6
+        .unreq  DAT7
+        .unreq  LAST
+        .unreq  OFF
+.endm
diff --git a/arch/arm/lib/memmove_rpi.S b/arch/arm/lib/memmove_rpi.S
new file mode 100644
index 0000000000000..8b0760c0904c5
--- /dev/null
+++ b/arch/arm/lib/memmove_rpi.S
@@ -0,0 +1,61 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+#include "memcpymove.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+/*
+ * void *memmove(void *s1, const void *s2, size_t n);
+ * On entry:
+ * a1 = pointer to destination
+ * a2 = pointer to source
+ * a3 = number of bytes to copy
+ * On exit:
+ * a1 preserved
+ */
+
+.set prefetch_distance, 3
+
+ENTRY(memmove)
+        cmp     a2, a1
+        bpl     memcpy  /* pl works even over -1 - 0 and 0x7fffffff - 0x80000000 boundaries */
+        memcpy  1
+ENDPROC(memmove)
diff --git a/arch/arm/lib/memset_rpi.S b/arch/arm/lib/memset_rpi.S
new file mode 100644
index 0000000000000..e8469cecabc15
--- /dev/null
+++ b/arch/arm/lib/memset_rpi.S
@@ -0,0 +1,128 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+/*
+ *  void *memset(void *s, int c, size_t n);
+ *  On entry:
+ *  a1 = pointer to buffer to fill
+ *  a2 = byte pattern to fill with (caller-narrowed)
+ *  a3 = number of bytes to fill
+ *  On exit:
+ *  a1 preserved
+ */
+ENTRY(mmioset)
+ENTRY(memset)
+ENTRY(__memset32)
+ENTRY(__memset64)
+
+        S       .req    a1
+        DAT0    .req    a2
+        N       .req    a3
+        DAT1    .req    a4
+        DAT2    .req    ip
+        DAT3    .req    lr
+
+        orr     DAT0, DAT0, DAT0, lsl #8
+        push    {S, lr}
+        orr     DAT0, DAT0, DAT0, lsl #16
+        mov     DAT1, DAT0
+
+        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
+        cmp     N, #31
+        blo     170f
+
+161:    sub     N, N, #16     /* simplifies inner loop termination */
+        /* Leading words and bytes */
+        tst     S, #15
+        beq     164f
+        rsb     DAT3, S, #0   /* bits 0-3 = number of leading bytes until aligned */
+        movs    DAT2, DAT3, lsl #31
+        submi   N, N, #1
+        strmib  DAT0, [S], #1
+        subcs   N, N, #2
+        strcsh  DAT0, [S], #2
+        movs    DAT2, DAT3, lsl #29
+        submi   N, N, #4
+        strmi   DAT0, [S], #4
+        subcs   N, N, #8
+        stmcsia S!, {DAT0, DAT1}
+164:    /* Delayed set up of DAT2 and DAT3 so we could use them as scratch registers above */
+        mov     DAT2, DAT0
+        mov     DAT3, DAT0
+        /* Now the inner loop of 16-byte stores */
+165:    stmia   S!, {DAT0, DAT1, DAT2, DAT3}
+        subs    N, N, #16
+        bhs     165b
+166:    /* Trailing words and bytes */
+        movs    N, N, lsl #29
+        stmcsia S!, {DAT0, DAT1}
+        strmi   DAT0, [S], #4
+        movs    N, N, lsl #2
+        strcsh  DAT0, [S], #2
+        strmib  DAT0, [S]
+199:    pop     {S, pc}
+
+170:    /* Short case */
+        mov     DAT2, DAT0
+        mov     DAT3, DAT0
+        tst     S, #3
+        beq     174f
+172:    subs    N, N, #1
+        blo     199b
+        strb    DAT0, [S], #1
+        tst     S, #3
+        bne     172b
+174:    tst     N, #16
+        stmneia S!, {DAT0, DAT1, DAT2, DAT3}
+        b       166b
+
+        .unreq  S
+        .unreq  DAT0
+        .unreq  N
+        .unreq  DAT1
+        .unreq  DAT2
+        .unreq  DAT3
+ENDPROC(__memset64)
+ENDPROC(__memset32)
+ENDPROC(memset)
+ENDPROC(mmioset)
diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
index 73dc7360cbdd5..1ea66521768dd 100644
--- a/arch/arm/lib/uaccess_with_memcpy.c
+++ b/arch/arm/lib/uaccess_with_memcpy.c
@@ -22,6 +22,14 @@
 #include <asm/current.h>
 #include <asm/page.h>
 
+#ifndef COPY_FROM_USER_THRESHOLD
+#define COPY_FROM_USER_THRESHOLD 64
+#endif
+
+#ifndef COPY_TO_USER_THRESHOLD
+#define COPY_TO_USER_THRESHOLD 64
+#endif
+
 static int
 pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
 {
@@ -84,7 +92,44 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
 	return 1;
 }
 
-static unsigned long noinline
+static int
+pin_page_for_read(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
+{
+	unsigned long addr = (unsigned long)_addr;
+	pgd_t *pgd;
+	pmd_t *pmd;
+	pte_t *pte;
+	pud_t *pud;
+	spinlock_t *ptl;
+
+	pgd = pgd_offset(current->mm, addr);
+	if (unlikely(pgd_none(*pgd) || pgd_bad(*pgd)))
+	{
+		return 0;
+	}
+	pud = pud_offset(pgd, addr);
+	if (unlikely(pud_none(*pud) || pud_bad(*pud)))
+	{
+		return 0;
+	}
+
+	pmd = pmd_offset(pud, addr);
+	if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd)))
+		return 0;
+
+	pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl);
+	if (unlikely(!pte_present(*pte) || !pte_young(*pte))) {
+		pte_unmap_unlock(pte, ptl);
+		return 0;
+	}
+
+	*ptep = pte;
+	*ptlp = ptl;
+
+	return 1;
+}
+
+unsigned long noinline
 __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
 {
 	unsigned long ua_flags;
@@ -137,6 +182,57 @@ out:
 	return n;
 }
 
+unsigned long noinline
+__copy_from_user_memcpy(void *to, const void __user *from, unsigned long n)
+{
+	unsigned long ua_flags;
+	int atomic;
+
+	if (unlikely(segment_eq(get_fs(), KERNEL_DS))) {
+		memcpy(to, (const void *)from, n);
+		return 0;
+	}
+
+	/* the mmap semaphore is taken only if not in an atomic context */
+	atomic = in_atomic();
+
+	if (!atomic)
+		down_read(&current->mm->mmap_sem);
+	while (n) {
+		pte_t *pte;
+		spinlock_t *ptl;
+		int tocopy;
+
+		while (!pin_page_for_read(from, &pte, &ptl)) {
+			char temp;
+			if (!atomic)
+				up_read(&current->mm->mmap_sem);
+			if (__get_user(temp, (char __user *)from))
+				goto out;
+			if (!atomic)
+				down_read(&current->mm->mmap_sem);
+		}
+
+		tocopy = (~(unsigned long)from & ~PAGE_MASK) + 1;
+		if (tocopy > n)
+			tocopy = n;
+
+		ua_flags = uaccess_save_and_enable();
+		memcpy(to, (const void *)from, tocopy);
+		uaccess_restore(ua_flags);
+		to += tocopy;
+		from += tocopy;
+		n -= tocopy;
+
+		pte_unmap_unlock(pte, ptl);
+	}
+	if (!atomic)
+		up_read(&current->mm->mmap_sem);
+
+out:
+	return n;
+}
+
 unsigned long
 arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
@@ -147,7 +243,7 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 	 * With frame pointer disabled, tail call optimization kicks in
 	 * as well making this test almost invisible.
 	 */
-	if (n < 64) {
+	if (n < COPY_TO_USER_THRESHOLD) {
 		unsigned long ua_flags = uaccess_save_and_enable();
 		n = __copy_to_user_std(to, from, n);
 		uaccess_restore(ua_flags);
@@ -157,6 +253,26 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 	}
 	return n;
 }
+
+unsigned long __must_check
+arm_copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+	/*
+	 * This test is stubbed out of the main function above to keep
+	 * the overhead for small copies low by avoiding a large
+	 * register dump on the stack just to reload them right away.
+	 * With frame pointer disabled, tail call optimization kicks in
+	 * as well making this test almost invisible.
+	 */
+	if (n < COPY_TO_USER_THRESHOLD) {
+		unsigned long ua_flags = uaccess_save_and_enable();
+		n = __copy_from_user_std(to, from, n);
+		uaccess_restore(ua_flags);
+	} else {
+		n = __copy_from_user_memcpy(to, from, n);
+	}
+	return n;
+}
 	
 static unsigned long noinline
 __clear_user_memset(void __user *addr, unsigned long n)
diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig
index abae0e72c3d65..e85de844f98ee 100644
--- a/arch/arm/mach-bcm/Kconfig
+++ b/arch/arm/mach-bcm/Kconfig
@@ -187,6 +187,13 @@ config ARCH_BCM_53573
 	  The base chip is BCM53573 and there are some packaging modifications
 	  like BCM47189 and BCM47452.
 
+config BCM2835_FAST_MEMCPY
+	bool "Enable optimized __copy_to_user and __copy_from_user"
+	depends on ARCH_BCM2835 && ARCH_MULTI_V6
+	default y
+	help
+	  Optimized versions of __copy_to_user and __copy_from_user for Pi1.
+
 config ARCH_BCM_63XX
 	bool "Broadcom BCM63xx DSL SoC"
 	depends on ARCH_MULTI_V7
-- 
GitLab


From 841422a6515f04db88f375309036efe1bcbff8fe Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 25 Jun 2015 12:16:11 +0100
Subject: [PATCH 0063/1835] gpio-poweroff: Allow it to work on Raspberry Pi

The Raspberry Pi firmware manages the power-down and reboot
process. To do this it installs a pm_power_off handler, causing
the gpio-poweroff module to abort the probe function.

This patch introduces a "force" DT property that overrides that
behaviour, and also adds a DT overlay to enable and control it.

Note that running in an active-low configuration (DT parameter
"active_low") requires a custom dt-blob.bin and probably won't
allow a reboot without switching off, so an external inversion
of the trigger signal may be preferable.
---
 drivers/power/reset/gpio-poweroff.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c
index 38206c39b3bff..cf8cfc83e4a1f 100644
--- a/drivers/power/reset/gpio-poweroff.c
+++ b/drivers/power/reset/gpio-poweroff.c
@@ -51,9 +51,11 @@ static int gpio_poweroff_probe(struct platform_device *pdev)
 {
 	bool input = false;
 	enum gpiod_flags flags;
+	bool force = false;
 
 	/* If a pm_power_off function has already been added, leave it alone */
-	if (pm_power_off != NULL) {
+	force = of_property_read_bool(pdev->dev.of_node, "force");
+	if (!force && (pm_power_off != NULL)) {
 		dev_err(&pdev->dev,
 			"%s: pm_power_off function already registered",
 		       __func__);
-- 
GitLab


From eb435bf43ebf73ef81c725f6c001a7d0dec728b7 Mon Sep 17 00:00:00 2001
From: Phil Elwell <pelwell@users.noreply.github.com>
Date: Tue, 14 Jul 2015 14:32:47 +0100
Subject: [PATCH 0064/1835] mfd: Add Raspberry Pi Sense HAT core driver

---
 drivers/input/joystick/Kconfig           |   8 +
 drivers/input/joystick/Makefile          |   1 +
 drivers/input/joystick/rpisense-js.c     | 153 ++++++++++++
 drivers/mfd/Kconfig                      |   8 +
 drivers/mfd/Makefile                     |   2 +-
 drivers/mfd/rpisense-core.c              | 157 ++++++++++++
 drivers/video/fbdev/Kconfig              |  13 +
 drivers/video/fbdev/Makefile             |   1 +
 drivers/video/fbdev/rpisense-fb.c        | 293 +++++++++++++++++++++++
 include/linux/mfd/rpisense/core.h        |  47 ++++
 include/linux/mfd/rpisense/framebuffer.h |  32 +++
 include/linux/mfd/rpisense/joystick.h    |  35 +++
 12 files changed, 749 insertions(+), 1 deletion(-)
 create mode 100644 drivers/input/joystick/rpisense-js.c
 create mode 100644 drivers/mfd/rpisense-core.c
 create mode 100644 drivers/video/fbdev/rpisense-fb.c
 create mode 100644 include/linux/mfd/rpisense/core.h
 create mode 100644 include/linux/mfd/rpisense/framebuffer.h
 create mode 100644 include/linux/mfd/rpisense/joystick.h

diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig
index d8f9c6e1fc08b..212d8a69467d4 100644
--- a/drivers/input/joystick/Kconfig
+++ b/drivers/input/joystick/Kconfig
@@ -361,4 +361,12 @@ config JOYSTICK_PXRC
 	  To compile this driver as a module, choose M here: the
 	  module will be called pxrc.
 
+config JOYSTICK_RPISENSE
+	tristate "Raspberry Pi Sense HAT joystick"
+	depends on GPIOLIB && INPUT
+	select MFD_RPISENSE_CORE
+
+	help
+	  This is the joystick driver for the Raspberry Pi Sense HAT
+
 endif
diff --git a/drivers/input/joystick/Makefile b/drivers/input/joystick/Makefile
index dd0492ebbed79..914d138d29b1a 100644
--- a/drivers/input/joystick/Makefile
+++ b/drivers/input/joystick/Makefile
@@ -35,4 +35,5 @@ obj-$(CONFIG_JOYSTICK_WARRIOR)		+= warrior.o
 obj-$(CONFIG_JOYSTICK_XPAD)		+= xpad.o
 obj-$(CONFIG_JOYSTICK_ZHENHUA)		+= zhenhua.o
 obj-$(CONFIG_JOYSTICK_WALKERA0701)	+= walkera0701.o
+obj-$(CONFIG_JOYSTICK_RPISENSE)		+= rpisense-js.o
 
diff --git a/drivers/input/joystick/rpisense-js.c b/drivers/input/joystick/rpisense-js.c
new file mode 100644
index 0000000000000..6a416769065d2
--- /dev/null
+++ b/drivers/input/joystick/rpisense-js.c
@@ -0,0 +1,153 @@
+/*
+ * Raspberry Pi Sense HAT joystick driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+
+#include <linux/mfd/rpisense/joystick.h>
+#include <linux/mfd/rpisense/core.h>
+
+static struct rpisense *rpisense;
+static unsigned char keymap[5] = {KEY_DOWN, KEY_RIGHT, KEY_UP, KEY_ENTER, KEY_LEFT,};
+
+static void keys_work_fn(struct work_struct *work)
+{
+	int i;
+	static s32 prev_keys;
+	struct rpisense_js *rpisense_js = &rpisense->joystick;
+	s32 keys = rpisense_reg_read(rpisense, RPISENSE_KEYS);
+	s32 changes = keys ^ prev_keys;
+
+	prev_keys = keys;
+	for (i = 0; i < 5; i++) {
+		if (changes & 1) {
+			input_report_key(rpisense_js->keys_dev,
+					 keymap[i], keys & 1);
+		}
+		changes >>= 1;
+		keys >>= 1;
+	}
+	input_sync(rpisense_js->keys_dev);
+}
+
+static irqreturn_t keys_irq_handler(int irq, void *pdev)
+{
+	struct rpisense_js *rpisense_js = &rpisense->joystick;
+
+	schedule_work(&rpisense_js->keys_work_s);
+	return IRQ_HANDLED;
+}
+
+static int rpisense_js_probe(struct platform_device *pdev)
+{
+	int ret;
+	int i;
+	struct rpisense_js *rpisense_js;
+
+	rpisense = rpisense_get_dev();
+	rpisense_js = &rpisense->joystick;
+
+	INIT_WORK(&rpisense_js->keys_work_s, keys_work_fn);
+
+	rpisense_js->keys_dev = input_allocate_device();
+	if (!rpisense_js->keys_dev) {
+		dev_err(&pdev->dev, "Could not allocate input device.\n");
+		return -ENOMEM;
+	}
+
+	rpisense_js->keys_dev->evbit[0] = BIT_MASK(EV_KEY);
+	for (i = 0; i < ARRAY_SIZE(keymap); i++) {
+		set_bit(keymap[i],
+			rpisense_js->keys_dev->keybit);
+	}
+
+	rpisense_js->keys_dev->name = "Raspberry Pi Sense HAT Joystick";
+	rpisense_js->keys_dev->phys = "rpi-sense-joy/input0";
+	rpisense_js->keys_dev->id.bustype = BUS_I2C;
+	rpisense_js->keys_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+	rpisense_js->keys_dev->keycode = keymap;
+	rpisense_js->keys_dev->keycodesize = sizeof(unsigned char);
+	rpisense_js->keys_dev->keycodemax = ARRAY_SIZE(keymap);
+
+	ret = input_register_device(rpisense_js->keys_dev);
+	if (ret) {
+		dev_err(&pdev->dev, "Could not register input device.\n");
+		goto err_keys_alloc;
+	}
+
+	ret = gpiod_direction_input(rpisense_js->keys_desc);
+	if (ret) {
+		dev_err(&pdev->dev, "Could not set keys-int direction.\n");
+		goto err_keys_reg;
+	}
+
+	rpisense_js->keys_irq = gpiod_to_irq(rpisense_js->keys_desc);
+	if (rpisense_js->keys_irq < 0) {
+		dev_err(&pdev->dev, "Could not determine keys-int IRQ.\n");
+		ret = rpisense_js->keys_irq;
+		goto err_keys_reg;
+	}
+
+	ret = devm_request_irq(&pdev->dev, rpisense_js->keys_irq,
+			       keys_irq_handler, IRQF_TRIGGER_RISING,
+			       "keys", &pdev->dev);
+	if (ret) {
+		dev_err(&pdev->dev, "IRQ request failed.\n");
+		goto err_keys_reg;
+	}
+	return 0;
+err_keys_reg:
+	input_unregister_device(rpisense_js->keys_dev);
+err_keys_alloc:
+	input_free_device(rpisense_js->keys_dev);
+	return ret;
+}
+
+static int rpisense_js_remove(struct platform_device *pdev)
+{
+	struct rpisense_js *rpisense_js = &rpisense->joystick;
+
+	input_unregister_device(rpisense_js->keys_dev);
+	input_free_device(rpisense_js->keys_dev);
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rpisense_js_id[] = {
+	{ .compatible = "rpi,rpi-sense-js" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, rpisense_js_id);
+#endif
+
+static struct platform_device_id rpisense_js_device_id[] = {
+	{ .name = "rpi-sense-js" },
+	{ },
+};
+MODULE_DEVICE_TABLE(platform, rpisense_js_device_id);
+
+static struct platform_driver rpisense_js_driver = {
+	.probe = rpisense_js_probe,
+	.remove = rpisense_js_remove,
+	.driver = {
+		.name = "rpi-sense-js",
+		.owner = THIS_MODULE,
+	},
+};
+
+module_platform_driver(rpisense_js_driver);
+
+MODULE_DESCRIPTION("Raspberry Pi Sense HAT joystick driver");
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 11841f4b7b2ba..fea3501ca98b8 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -10,6 +10,14 @@ config MFD_CORE
 	select IRQ_DOMAIN
 	default n
 
+config MFD_RPISENSE_CORE
+	tristate "Raspberry Pi Sense HAT core functions"
+	depends on I2C
+	select MFD_CORE
+	help
+	  This is the core driver for the Raspberry Pi Sense HAT. This provides
+	  the necessary functions to communicate with the hardware.
+
 config MFD_CS5535
 	tristate "AMD CS5535 and CS5536 southbridge core functions"
 	select MFD_CORE
diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
index 5856a9489cbd8..aa72f59f94c84 100644
--- a/drivers/mfd/Makefile
+++ b/drivers/mfd/Makefile
@@ -240,4 +240,4 @@ obj-$(CONFIG_MFD_MXS_LRADC)     += mxs-lradc.o
 obj-$(CONFIG_MFD_SC27XX_PMIC)	+= sprd-sc27xx-spi.o
 obj-$(CONFIG_RAVE_SP_CORE)	+= rave-sp.o
 obj-$(CONFIG_MFD_ROHM_BD718XX)	+= rohm-bd718x7.o
-
+obj-$(CONFIG_MFD_RPISENSE_CORE)	+= rpisense-core.o
diff --git a/drivers/mfd/rpisense-core.c b/drivers/mfd/rpisense-core.c
new file mode 100644
index 0000000000000..eea9312dc96a4
--- /dev/null
+++ b/drivers/mfd/rpisense-core.c
@@ -0,0 +1,157 @@
+/*
+ * Raspberry Pi Sense HAT core driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  This driver is based on wm8350 implementation.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/platform_device.h>
+#include <linux/mfd/rpisense/core.h>
+#include <linux/slab.h>
+
+static struct rpisense *rpisense;
+
+static void rpisense_client_dev_register(struct rpisense *rpisense,
+					 const char *name,
+					 struct platform_device **pdev)
+{
+	int ret;
+
+	*pdev = platform_device_alloc(name, -1);
+	if (*pdev == NULL) {
+		dev_err(rpisense->dev, "Failed to allocate %s\n", name);
+		return;
+	}
+
+	(*pdev)->dev.parent = rpisense->dev;
+	platform_set_drvdata(*pdev, rpisense);
+	ret = platform_device_add(*pdev);
+	if (ret != 0) {
+		dev_err(rpisense->dev, "Failed to register %s: %d\n",
+			name, ret);
+		platform_device_put(*pdev);
+		*pdev = NULL;
+	}
+}
+
+static int rpisense_probe(struct i2c_client *i2c,
+			       const struct i2c_device_id *id)
+{
+	int ret;
+	struct rpisense_js *rpisense_js;
+
+	rpisense = devm_kzalloc(&i2c->dev, sizeof(struct rpisense), GFP_KERNEL);
+	if (rpisense == NULL)
+		return -ENOMEM;
+
+	i2c_set_clientdata(i2c, rpisense);
+	rpisense->dev = &i2c->dev;
+	rpisense->i2c_client = i2c;
+
+	ret = rpisense_reg_read(rpisense, RPISENSE_WAI);
+	if (ret > 0) {
+		if (ret != 's')
+			return -EINVAL;
+	} else {
+		return ret;
+	}
+	ret = rpisense_reg_read(rpisense, RPISENSE_VER);
+	if (ret < 0)
+		return ret;
+
+	dev_info(rpisense->dev,
+		 "Raspberry Pi Sense HAT firmware version %i\n", ret);
+
+	rpisense_js = &rpisense->joystick;
+	rpisense_js->keys_desc = devm_gpiod_get(&i2c->dev,
+						"keys-int", GPIOD_IN);
+	if (IS_ERR(rpisense_js->keys_desc)) {
+		dev_warn(&i2c->dev, "Failed to get keys-int descriptor.\n");
+		rpisense_js->keys_desc = gpio_to_desc(23);
+		if (rpisense_js->keys_desc == NULL) {
+			dev_err(&i2c->dev, "GPIO23 fallback failed.\n");
+			return PTR_ERR(rpisense_js->keys_desc);
+		}
+	}
+	rpisense_client_dev_register(rpisense, "rpi-sense-js",
+				     &(rpisense->joystick.pdev));
+	rpisense_client_dev_register(rpisense, "rpi-sense-fb",
+				     &(rpisense->framebuffer.pdev));
+
+	return 0;
+}
+
+static int rpisense_remove(struct i2c_client *i2c)
+{
+	struct rpisense *rpisense = i2c_get_clientdata(i2c);
+
+	platform_device_unregister(rpisense->joystick.pdev);
+	return 0;
+}
+
+struct rpisense *rpisense_get_dev(void)
+{
+	return rpisense;
+}
+EXPORT_SYMBOL_GPL(rpisense_get_dev);
+
+s32 rpisense_reg_read(struct rpisense *rpisense, int reg)
+{
+	int ret = i2c_smbus_read_byte_data(rpisense->i2c_client, reg);
+
+	if (ret < 0)
+		dev_err(rpisense->dev, "Read from reg %d failed\n", reg);
+	/* Due to the BCM270x I2C clock stretching bug, some values
+	 * may have MSB set. Clear it to avoid incorrect values.
+	 * */
+	return ret & 0x7F;
+}
+EXPORT_SYMBOL_GPL(rpisense_reg_read);
+
+int rpisense_block_write(struct rpisense *rpisense, const char *buf, int count)
+{
+	int ret = i2c_master_send(rpisense->i2c_client, buf, count);
+
+	if (ret < 0)
+		dev_err(rpisense->dev, "Block write failed\n");
+	return ret;
+}
+EXPORT_SYMBOL_GPL(rpisense_block_write);
+
+static const struct i2c_device_id rpisense_i2c_id[] = {
+	{ "rpi-sense", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, rpisense_i2c_id);
+
+
+static struct i2c_driver rpisense_driver = {
+	.driver = {
+		   .name = "rpi-sense",
+		   .owner = THIS_MODULE,
+	},
+	.probe = rpisense_probe,
+	.remove = rpisense_remove,
+	.id_table = rpisense_i2c_id,
+};
+
+module_i2c_driver(rpisense_driver);
+
+MODULE_DESCRIPTION("Raspberry Pi Sense HAT core driver");
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index dc7d04b1d5542..65478a7f71126 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -2355,3 +2355,16 @@ config FB_SM712
 	  This driver is also available as a module. The module will be
 	  called sm712fb. If you want to compile it as a module, say M
 	  here and read <file:Documentation/kbuild/modules.txt>.
+
+config FB_RPISENSE
+	tristate "Raspberry Pi Sense HAT framebuffer"
+	depends on FB
+	select MFD_RPISENSE_CORE
+	select FB_SYS_FOPS
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select FB_DEFERRED_IO
+
+	help
+	  This is the framebuffer driver for the Raspberry Pi Sense HAT
diff --git a/drivers/video/fbdev/Makefile b/drivers/video/fbdev/Makefile
index 784c57ffd660c..aac19b4ffb7b0 100644
--- a/drivers/video/fbdev/Makefile
+++ b/drivers/video/fbdev/Makefile
@@ -138,6 +138,7 @@ obj-$(CONFIG_FB_DA8XX)		  += da8xx-fb.o
 obj-$(CONFIG_FB_MXS)		  += mxsfb.o
 obj-$(CONFIG_FB_SSD1307)	  += ssd1307fb.o
 obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
+obj-$(CONFIG_FB_RPISENSE)	  += rpisense-fb.o
 
 # the test framebuffer is last
 obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
diff --git a/drivers/video/fbdev/rpisense-fb.c b/drivers/video/fbdev/rpisense-fb.c
new file mode 100644
index 0000000000000..26432a5a0b4b4
--- /dev/null
+++ b/drivers/video/fbdev/rpisense-fb.c
@@ -0,0 +1,293 @@
+/*
+ * Raspberry Pi Sense HAT framebuffer driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+
+#include <linux/mfd/rpisense/framebuffer.h>
+#include <linux/mfd/rpisense/core.h>
+
+static bool lowlight;
+module_param(lowlight, bool, 0);
+MODULE_PARM_DESC(lowlight, "Reduce LED matrix brightness to one third");
+
+static struct rpisense *rpisense;
+
+struct rpisense_fb_param {
+	char __iomem *vmem;
+	u8 *vmem_work;
+	u32 vmemsize;
+	u8 *gamma;
+};
+
+static u8 gamma_default[32] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01,
+			       0x02, 0x02, 0x03, 0x03, 0x04, 0x05, 0x06, 0x07,
+			       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0E, 0x0F, 0x11,
+			       0x12, 0x14, 0x15, 0x17, 0x19, 0x1B, 0x1D, 0x1F,};
+
+static u8 gamma_low[32] = {0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+			   0x01, 0x01, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02,
+			   0x03, 0x03, 0x03, 0x04, 0x04, 0x05, 0x05, 0x06,
+			   0x06, 0x07, 0x07, 0x08, 0x08, 0x09, 0x0A, 0x0A,};
+
+static u8 gamma_user[32];
+
+static struct rpisense_fb_param rpisense_fb_param = {
+	.vmem = NULL,
+	.vmemsize = 128,
+	.gamma = gamma_default,
+};
+
+static struct fb_deferred_io rpisense_fb_defio;
+
+static struct fb_fix_screeninfo rpisense_fb_fix = {
+	.id =		"RPi-Sense FB",
+	.type =		FB_TYPE_PACKED_PIXELS,
+	.visual =	FB_VISUAL_TRUECOLOR,
+	.xpanstep =	0,
+	.ypanstep =	0,
+	.ywrapstep =	0,
+	.accel =	FB_ACCEL_NONE,
+	.line_length =	16,
+};
+
+static struct fb_var_screeninfo rpisense_fb_var = {
+	.xres		= 8,
+	.yres		= 8,
+	.xres_virtual	= 8,
+	.yres_virtual	= 8,
+	.bits_per_pixel = 16,
+	.red		= {11, 5, 0},
+	.green		= {5, 6, 0},
+	.blue		= {0, 5, 0},
+};
+
+static ssize_t rpisense_fb_write(struct fb_info *info,
+				 const char __user *buf, size_t count,
+				 loff_t *ppos)
+{
+	ssize_t res = fb_sys_write(info, buf, count, ppos);
+
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+	return res;
+}
+
+static void rpisense_fb_fillrect(struct fb_info *info,
+				 const struct fb_fillrect *rect)
+{
+	sys_fillrect(info, rect);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+}
+
+static void rpisense_fb_copyarea(struct fb_info *info,
+				 const struct fb_copyarea *area)
+{
+	sys_copyarea(info, area);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+}
+
+static void rpisense_fb_imageblit(struct fb_info *info,
+				  const struct fb_image *image)
+{
+	sys_imageblit(info, image);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+}
+
+static void rpisense_fb_deferred_io(struct fb_info *info,
+				struct list_head *pagelist)
+{
+	int i;
+	int j;
+	u8 *vmem_work = rpisense_fb_param.vmem_work;
+	u16 *mem = (u16 *)rpisense_fb_param.vmem;
+	u8 *gamma = rpisense_fb_param.gamma;
+
+	vmem_work[0] = 0;
+	for (j = 0; j < 8; j++) {
+		for (i = 0; i < 8; i++) {
+			vmem_work[(j * 24) + i + 1] =
+				gamma[(mem[(j * 8) + i] >> 11) & 0x1F];
+			vmem_work[(j * 24) + (i + 8) + 1] =
+				gamma[(mem[(j * 8) + i] >> 6) & 0x1F];
+			vmem_work[(j * 24) + (i + 16) + 1] =
+				gamma[(mem[(j * 8) + i]) & 0x1F];
+		}
+	}
+	rpisense_block_write(rpisense, vmem_work, 193);
+}
+
+static struct fb_deferred_io rpisense_fb_defio = {
+	.delay		= HZ/100,
+	.deferred_io	= rpisense_fb_deferred_io,
+};
+
+static int rpisense_fb_ioctl(struct fb_info *info, unsigned int cmd,
+			     unsigned long arg)
+{
+	switch (cmd) {
+	case SENSEFB_FBIOGET_GAMMA:
+		if (copy_to_user((void __user *) arg, rpisense_fb_param.gamma,
+				 sizeof(u8[32])))
+			return -EFAULT;
+		return 0;
+	case SENSEFB_FBIOSET_GAMMA:
+		if (copy_from_user(gamma_user, (void __user *)arg,
+				   sizeof(u8[32])))
+			return -EFAULT;
+		rpisense_fb_param.gamma = gamma_user;
+		schedule_delayed_work(&info->deferred_work,
+				      rpisense_fb_defio.delay);
+		return 0;
+	case SENSEFB_FBIORESET_GAMMA:
+		switch (arg) {
+		case 0:
+			rpisense_fb_param.gamma = gamma_default;
+			break;
+		case 1:
+			rpisense_fb_param.gamma = gamma_low;
+			break;
+		case 2:
+			rpisense_fb_param.gamma = gamma_user;
+			break;
+		default:
+			return -EINVAL;
+		}
+		schedule_delayed_work(&info->deferred_work,
+				      rpisense_fb_defio.delay);
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static struct fb_ops rpisense_fb_ops = {
+	.owner		= THIS_MODULE,
+	.fb_read	= fb_sys_read,
+	.fb_write	= rpisense_fb_write,
+	.fb_fillrect	= rpisense_fb_fillrect,
+	.fb_copyarea	= rpisense_fb_copyarea,
+	.fb_imageblit	= rpisense_fb_imageblit,
+	.fb_ioctl	= rpisense_fb_ioctl,
+};
+
+static int rpisense_fb_probe(struct platform_device *pdev)
+{
+	struct fb_info *info;
+	int ret = -ENOMEM;
+	struct rpisense_fb *rpisense_fb;
+
+	rpisense = rpisense_get_dev();
+	rpisense_fb = &rpisense->framebuffer;
+
+	rpisense_fb_param.vmem = vzalloc(rpisense_fb_param.vmemsize);
+	if (!rpisense_fb_param.vmem)
+		return ret;
+
+	rpisense_fb_param.vmem_work = devm_kmalloc(&pdev->dev, 193, GFP_KERNEL);
+	if (!rpisense_fb_param.vmem_work)
+		goto err_malloc;
+
+	info = framebuffer_alloc(0, &pdev->dev);
+	if (!info) {
+		dev_err(&pdev->dev, "Could not allocate framebuffer.\n");
+		goto err_malloc;
+	}
+	rpisense_fb->info = info;
+
+	rpisense_fb_fix.smem_start = (unsigned long)rpisense_fb_param.vmem;
+	rpisense_fb_fix.smem_len = rpisense_fb_param.vmemsize;
+
+	info->fbops = &rpisense_fb_ops;
+	info->fix = rpisense_fb_fix;
+	info->var = rpisense_fb_var;
+	info->fbdefio = &rpisense_fb_defio;
+	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
+	info->screen_base = rpisense_fb_param.vmem;
+	info->screen_size = rpisense_fb_param.vmemsize;
+
+	if (lowlight)
+		rpisense_fb_param.gamma = gamma_low;
+
+	fb_deferred_io_init(info);
+
+	ret = register_framebuffer(info);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Could not register framebuffer.\n");
+		goto err_fballoc;
+	}
+
+	fb_info(info, "%s frame buffer device\n", info->fix.id);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+	return 0;
+err_fballoc:
+	framebuffer_release(info);
+err_malloc:
+	vfree(rpisense_fb_param.vmem);
+	return ret;
+}
+
+static int rpisense_fb_remove(struct platform_device *pdev)
+{
+	struct rpisense_fb *rpisense_fb = &rpisense->framebuffer;
+	struct fb_info *info = rpisense_fb->info;
+
+	if (info) {
+		unregister_framebuffer(info);
+		fb_deferred_io_cleanup(info);
+		framebuffer_release(info);
+		vfree(rpisense_fb_param.vmem);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rpisense_fb_id[] = {
+	{ .compatible = "rpi,rpi-sense-fb" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, rpisense_fb_id);
+#endif
+
+static struct platform_device_id rpisense_fb_device_id[] = {
+	{ .name = "rpi-sense-fb" },
+	{ },
+};
+MODULE_DEVICE_TABLE(platform, rpisense_fb_device_id);
+
+static struct platform_driver rpisense_fb_driver = {
+	.probe = rpisense_fb_probe,
+	.remove = rpisense_fb_remove,
+	.driver = {
+		.name = "rpi-sense-fb",
+		.owner = THIS_MODULE,
+	},
+};
+
+module_platform_driver(rpisense_fb_driver);
+
+MODULE_DESCRIPTION("Raspberry Pi Sense HAT framebuffer driver");
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_LICENSE("GPL");
+
diff --git a/include/linux/mfd/rpisense/core.h b/include/linux/mfd/rpisense/core.h
new file mode 100644
index 0000000000000..4856aa3c8b066
--- /dev/null
+++ b/include/linux/mfd/rpisense/core.h
@@ -0,0 +1,47 @@
+/*
+ * Raspberry Pi Sense HAT core driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __LINUX_MFD_RPISENSE_CORE_H_
+#define __LINUX_MFD_RPISENSE_CORE_H_
+
+#include <linux/mfd/rpisense/joystick.h>
+#include <linux/mfd/rpisense/framebuffer.h>
+
+/*
+ * Register values.
+ */
+#define RPISENSE_FB			0x00
+#define RPISENSE_WAI			0xF0
+#define RPISENSE_VER			0xF1
+#define RPISENSE_KEYS			0xF2
+#define RPISENSE_EE_WP			0xF3
+
+#define RPISENSE_ID			's'
+
+struct rpisense {
+	struct device *dev;
+	struct i2c_client *i2c_client;
+
+	/* Client devices */
+	struct rpisense_js joystick;
+	struct rpisense_fb framebuffer;
+};
+
+struct rpisense *rpisense_get_dev(void);
+s32 rpisense_reg_read(struct rpisense *rpisense, int reg);
+int rpisense_reg_write(struct rpisense *rpisense, int reg, u16 val);
+int rpisense_block_write(struct rpisense *rpisense, const char *buf, int count);
+
+#endif
diff --git a/include/linux/mfd/rpisense/framebuffer.h b/include/linux/mfd/rpisense/framebuffer.h
new file mode 100644
index 0000000000000..2ba95d7eebaf9
--- /dev/null
+++ b/include/linux/mfd/rpisense/framebuffer.h
@@ -0,0 +1,32 @@
+/*
+ * Raspberry Pi Sense HAT framebuffer driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __LINUX_RPISENSE_FB_H_
+#define __LINUX_RPISENSE_FB_H_
+
+#define SENSEFB_FBIO_IOC_MAGIC 0xF1
+
+#define SENSEFB_FBIOGET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 0)
+#define SENSEFB_FBIOSET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 1)
+#define SENSEFB_FBIORESET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 2)
+
+struct rpisense;
+
+struct rpisense_fb {
+	struct platform_device *pdev;
+	struct fb_info *info;
+};
+
+#endif
diff --git a/include/linux/mfd/rpisense/joystick.h b/include/linux/mfd/rpisense/joystick.h
new file mode 100644
index 0000000000000..56196dc2af10e
--- /dev/null
+++ b/include/linux/mfd/rpisense/joystick.h
@@ -0,0 +1,35 @@
+/*
+ * Raspberry Pi Sense HAT joystick driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __LINUX_RPISENSE_JOYSTICK_H_
+#define __LINUX_RPISENSE_JOYSTICK_H_
+
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+
+struct rpisense;
+
+struct rpisense_js {
+	struct platform_device *pdev;
+	struct input_dev *keys_dev;
+	struct gpio_desc *keys_desc;
+	struct work_struct keys_work_s;
+	int keys_irq;
+};
+
+
+#endif
-- 
GitLab


From 594e1f24838de4ab516c6a6c396dfea86ce00d94 Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Thu, 22 Feb 2018 11:55:06 +0100
Subject: [PATCH 0065/1835] ASoC: pcm512x: implement set_tdm_slot interface

PCM512x can accept data padded with additional BCLK cycles
but the driver currently lacks an interface to configure this.

This leads to the problem that S24_LE format in master mode
can result in non-integer clock divisors and pcm512x running
at a rather off rate.

For example 48kHz with 48fs BCLK and SCLK at 24.576MHz uses
a divisor of 10 (rounded down from 10.6666) and results in a
51.2kHz LRCLK. With 64fs BCLK a divisor of 8 is used and
LRCLK runs at exactly 48kHz.

Fix this by providing a minimal set_tdm_slot implementation
so machine drivers can optionally configure custom BCLK ratios.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/codecs/pcm512x.c | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index f0f2d4fd3769f..9a6a6e3a0eb96 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -53,6 +53,7 @@ struct pcm512x_priv {
 	unsigned long overclock_pll;
 	unsigned long overclock_dac;
 	unsigned long overclock_dsp;
+	int lrclk_div;
 };
 
 /*
@@ -851,7 +852,10 @@ static int pcm512x_set_dividers(struct snd_soc_dai *dai,
 	int fssp;
 	int gpio;
 
-	lrclk_div = snd_soc_params_to_frame_size(params);
+	if (pcm512x->lrclk_div)
+		lrclk_div = pcm512x->lrclk_div;
+	else
+		lrclk_div = snd_soc_params_to_frame_size(params);
 	if (lrclk_div == 0) {
 		dev_err(dev, "No LRCLK?\n");
 		return -EINVAL;
@@ -1319,10 +1323,32 @@ static int pcm512x_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 	return 0;
 }
 
+static int pcm512x_set_tdm_slot(struct snd_soc_dai *dai,
+	unsigned int tx_mask, unsigned int rx_mask,
+	int slots, int width)
+{
+	struct snd_soc_component *component = dai->component;
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+
+	switch (slots) {
+	case 0:
+		pcm512x->lrclk_div = 0;
+		return 0;
+	case 2:
+		if (tx_mask != 0x03 || rx_mask != 0x03)
+			return -EINVAL;
+		pcm512x->lrclk_div = slots * width;
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
 static const struct snd_soc_dai_ops pcm512x_dai_ops = {
 	.startup = pcm512x_dai_startup,
 	.hw_params = pcm512x_hw_params,
 	.set_fmt = pcm512x_set_fmt,
+	.set_tdm_slot = pcm512x_set_tdm_slot,
 };
 
 static struct snd_soc_dai_driver pcm512x_dai = {
-- 
GitLab


From bbdee25dd6402e2c0c517b3064d0da049b33bc8a Mon Sep 17 00:00:00 2001
From: Florian Meier <florian.meier@koalo.de>
Date: Mon, 25 Jan 2016 15:48:59 +0000
Subject: [PATCH 0066/1835] ASoC: Add support for Rpi-DAC

---
 sound/soc/codecs/Kconfig    |  5 +++
 sound/soc/codecs/Makefile   |  2 ++
 sound/soc/codecs/pcm1794a.c | 69 +++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+)
 create mode 100644 sound/soc/codecs/pcm1794a.c

diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 7956d964fe5f0..9473ef0bbde58 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -118,6 +118,7 @@ config SND_SOC_ALL_CODECS
 	select SND_SOC_PCM179X_SPI if SPI_MASTER
 	select SND_SOC_PCM186X_I2C if I2C
 	select SND_SOC_PCM186X_SPI if SPI_MASTER
+	select SND_SOC_PCM1794A if I2C
 	select SND_SOC_PCM3008
 	select SND_SOC_PCM3168A_I2C if I2C
 	select SND_SOC_PCM3168A_SPI if SPI_MASTER
@@ -834,6 +835,10 @@ config SND_SOC_RT5616
 	tristate "Realtek RT5616 CODEC"
 	depends on I2C
 
+config SND_SOC_PCM1794A
+	tristate
+	depends on I2C
+
 config SND_SOC_RT5631
 	tristate "Realtek ALC5631/RT5631 CODEC"
 	depends on I2C
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 7ae7c85e8219f..db39e34f2bd03 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -118,6 +118,7 @@ snd-soc-pcm179x-spi-objs := pcm179x-spi.o
 snd-soc-pcm186x-objs := pcm186x.o
 snd-soc-pcm186x-i2c-objs := pcm186x-i2c.o
 snd-soc-pcm186x-spi-objs := pcm186x-spi.o
+snd-soc-pcm1794a-objs := pcm1794a.o
 snd-soc-pcm3008-objs := pcm3008.o
 snd-soc-pcm3168a-objs := pcm3168a.o
 snd-soc-pcm3168a-i2c-objs := pcm3168a-i2c.o
@@ -386,6 +387,7 @@ obj-$(CONFIG_SND_SOC_PCM5102A)	+= snd-soc-pcm5102a.o
 obj-$(CONFIG_SND_SOC_PCM512x)	+= snd-soc-pcm512x.o
 obj-$(CONFIG_SND_SOC_PCM512x_I2C)	+= snd-soc-pcm512x-i2c.o
 obj-$(CONFIG_SND_SOC_PCM512x_SPI)	+= snd-soc-pcm512x-spi.o
+obj-$(CONFIG_SND_SOC_PCM1794A)	+= snd-soc-pcm1794a.o
 obj-$(CONFIG_SND_SOC_RL6231)	+= snd-soc-rl6231.o
 obj-$(CONFIG_SND_SOC_RL6347A)	+= snd-soc-rl6347a.o
 obj-$(CONFIG_SND_SOC_RT1305)	+= snd-soc-rt1305.o
diff --git a/sound/soc/codecs/pcm1794a.c b/sound/soc/codecs/pcm1794a.c
new file mode 100644
index 0000000000000..36b5b6c26655a
--- /dev/null
+++ b/sound/soc/codecs/pcm1794a.c
@@ -0,0 +1,69 @@
+/*
+ * Driver for the PCM1794A codec
+ *
+ * Author:	Florian Meier <florian.meier@koalo.de>
+ *		Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/soc.h>
+
+static struct snd_soc_dai_driver pcm1794a_dai = {
+	.name = "pcm1794a-hifi",
+	.playback = {
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_8000_192000,
+		.formats = SNDRV_PCM_FMTBIT_S16_LE |
+			   SNDRV_PCM_FMTBIT_S24_LE
+	},
+};
+
+static struct snd_soc_component_driver soc_component_dev_pcm1794a;
+
+static int pcm1794a_probe(struct platform_device *pdev)
+{
+	return snd_soc_register_component(&pdev->dev, &soc_component_dev_pcm1794a,
+			&pcm1794a_dai, 1);
+}
+
+static int pcm1794a_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_component(&pdev->dev);
+	return 0;
+}
+
+static const struct of_device_id pcm1794a_of_match[] = {
+	{ .compatible = "ti,pcm1794a", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, pcm1794a_of_match);
+
+static struct platform_driver pcm1794a_component_driver = {
+	.probe 		= pcm1794a_probe,
+	.remove 	= pcm1794a_remove,
+	.driver		= {
+		.name	= "pcm1794a-codec",
+		.owner	= THIS_MODULE,
+		.of_match_table = of_match_ptr(pcm1794a_of_match),
+	},
+};
+
+module_platform_driver(pcm1794a_component_driver);
+
+MODULE_DESCRIPTION("ASoC PCM1794A codec driver");
+MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From b05ef7478accf7345588c1c35a0fb3416da45b03 Mon Sep 17 00:00:00 2001
From: Gordon Garrity <gordon@iqaudio.com>
Date: Sat, 8 Mar 2014 16:56:57 +0000
Subject: [PATCH 0067/1835] Add IQaudIO Sound Card support for Raspberry Pi

Set a limit of 0dB on Digital Volume Control

The main volume control in the PCM512x DAC has a range up to
+24dB. This is dangerously loud and can potentially cause massive
clipping in the output stages. Therefore this sets a sensible
limit of 0dB for this control.

Allow up to 24dB digital gain to be applied when using IQAudIO DAC+

24db_digital_gain DT param can be used to specify that PCM512x
codec "Digital" volume control should not be limited to 0dB gain,
and if specified will allow the full 24dB gain.

Modify IQAudIO DAC+ ASoC driver to set card/dai config from dt

Add the ability to set the card name, dai name and dai stream name, from
dt config.

Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>

IQaudIO: auto-mute for AMP+ and DigiAMP+

IQAudIO amplifier mute via GPIO22. Add dt params for "one-shot" unmute
and auto mute.

Revision 2, auto mute implementing HiassofT suggestion to mute/unmute
using set_bias_level, rather than startup/shutdown....
"By default DAPM waits 5 seconds (pmdown_time) before shutting down
playback streams so a close/stop immediately followed by open/start
doesn't trigger an amp mute+unmute."

Tested on both AMP+ (via DAC+) and DigiAMP+, with both options...

dtoverlay=iqaudio-dacplus,unmute_amp
 "one-shot" unmute when kernel module loads.

dtoverlay=iqaudio-dacplus,auto_mute_amp
 Unmute amp when ALSA device opened by a client. Mute, with 5 second delay
 when ALSA device closed. (Re-opening the device within the 5 second close
 window, will cancel mute.)

Revision 4, using gpiod.

Revision 5, clean-up formatting before adding mute code.
 - Convert tab plus 4 space formatting to 2x tab
 - Remove '// NOT USED' commented code

Revision 6, don't attempt to "one-shot" unmute amp, unless card is
successfully registered.

Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>

ASoC: iqaudio-dac: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/iqaudio-dac.c | 221 ++++++++++++++++++++++++++++++++++++
 1 file changed, 221 insertions(+)
 create mode 100644 sound/soc/bcm/iqaudio-dac.c

diff --git a/sound/soc/bcm/iqaudio-dac.c b/sound/soc/bcm/iqaudio-dac.c
new file mode 100644
index 0000000000000..4583d199fd83d
--- /dev/null
+++ b/sound/soc/bcm/iqaudio-dac.c
@@ -0,0 +1,221 @@
+/*
+ * ASoC Driver for IQaudIO DAC
+ *
+ * Author:	Florian Meier <florian.meier@koalo.de>
+ *		Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static bool digital_gain_0db_limit = true;
+
+static struct gpio_desc *mute_gpio;
+
+static int snd_rpi_iqaudio_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	if (digital_gain_0db_limit)
+	{
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static void snd_rpi_iqaudio_gpio_mute(struct snd_soc_card *card)
+{
+	if (mute_gpio) {
+		dev_info(card->dev, "%s: muting amp using GPIO22\n",
+			 __func__);
+		gpiod_set_value_cansleep(mute_gpio, 0);
+	}
+}
+
+static void snd_rpi_iqaudio_gpio_unmute(struct snd_soc_card *card)
+{
+	if (mute_gpio) {
+		dev_info(card->dev, "%s: un-muting amp using GPIO22\n",
+			 __func__);
+		gpiod_set_value_cansleep(mute_gpio, 1);
+	}
+}
+
+static int snd_rpi_iqaudio_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *codec_dai;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	codec_dai = rtd->codec_dai;
+
+	if (dapm->dev != codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
+			break;
+
+		/* UNMUTE AMP */
+		snd_rpi_iqaudio_gpio_unmute(card);
+
+		break;
+	case SND_SOC_BIAS_STANDBY:
+		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
+			break;
+
+		/* MUTE AMP */
+		snd_rpi_iqaudio_gpio_mute(card);
+
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_rpi_iqaudio_dac_dai[] = {
+{
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004c",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.init		= snd_rpi_iqaudio_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_iqaudio_dac = {
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_iqaudio_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_iqaudio_dac_dai),
+};
+
+static int snd_rpi_iqaudio_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	bool gpio_unmute = false;
+
+	snd_rpi_iqaudio_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_card *card = &snd_rpi_iqaudio_dac;
+		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_dac_dai[0];
+		bool auto_gpio_mute = false;
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "iqaudio,24db_digital_gain");
+
+		if (of_property_read_string(pdev->dev.of_node, "card_name",
+					    &card->name))
+			card->name = "IQaudIODAC";
+
+		if (of_property_read_string(pdev->dev.of_node, "dai_name",
+					    &dai->name))
+			dai->name = "IQaudIO DAC";
+
+		if (of_property_read_string(pdev->dev.of_node,
+					"dai_stream_name", &dai->stream_name))
+			dai->stream_name = "IQaudIO DAC HiFi";
+
+		/* gpio_unmute - one time unmute amp using GPIO */
+		gpio_unmute = of_property_read_bool(pdev->dev.of_node,
+						    "iqaudio-dac,unmute-amp");
+
+		/* auto_gpio_mute - mute/unmute amp using GPIO */
+		auto_gpio_mute = of_property_read_bool(pdev->dev.of_node,
+						"iqaudio-dac,auto-mute-amp");
+
+		if (auto_gpio_mute || gpio_unmute) {
+			mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
+							    GPIOD_OUT_LOW);
+			if (IS_ERR(mute_gpio)) {
+				ret = PTR_ERR(mute_gpio);
+				dev_err(&pdev->dev,
+					"Failed to get mute gpio: %d\n", ret);
+				return ret;
+			}
+
+			if (auto_gpio_mute && mute_gpio)
+				snd_rpi_iqaudio_dac.set_bias_level =
+						snd_rpi_iqaudio_set_bias_level;
+		}
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_iqaudio_dac);
+	if (ret) {
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+		return ret;
+	}
+
+	if (gpio_unmute && mute_gpio)
+		snd_rpi_iqaudio_gpio_unmute(&snd_rpi_iqaudio_dac);
+
+	return 0;
+}
+
+static int snd_rpi_iqaudio_dac_remove(struct platform_device *pdev)
+{
+	snd_rpi_iqaudio_gpio_mute(&snd_rpi_iqaudio_dac);
+
+	return snd_soc_unregister_card(&snd_rpi_iqaudio_dac);
+}
+
+static const struct of_device_id iqaudio_of_match[] = {
+	{ .compatible = "iqaudio,iqaudio-dac", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, iqaudio_of_match);
+
+static struct platform_driver snd_rpi_iqaudio_dac_driver = {
+	.driver = {
+		.name   = "snd-rpi-iqaudio-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = iqaudio_of_match,
+	},
+	.probe          = snd_rpi_iqaudio_dac_probe,
+	.remove         = snd_rpi_iqaudio_dac_remove,
+};
+
+module_platform_driver(snd_rpi_iqaudio_dac_driver);
+
+MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
+MODULE_DESCRIPTION("ASoC Driver for IQAudio DAC");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 541743a5f262c2fb2651ea2e7ac652d99f0cf124 Mon Sep 17 00:00:00 2001
From: Daniel Matuschek <info@crazy-audio.com>
Date: Mon, 4 Aug 2014 10:06:56 +0200
Subject: [PATCH 0068/1835] Added support for HiFiBerry DAC+

The driver is based on the HiFiBerry DAC driver. However HiFiBerry DAC+ uses
a different codec chip (PCM5122), therefore a new driver is necessary.

Add support for the HiFiBerry DAC+ Pro.

The HiFiBerry DAC+ and DAC+ Pro products both use the existing bcm sound driver with the DAC+ Pro having a special clock device driver representing the two high precision oscillators.

An addition bug fix is included for the PCM512x codec where by the physical size of the sample frame is used in the calculation of the LRCK divisor as it was found to be wrong when using 24-bit depth sample contained in a little endian 4-byte sample frame.

Limit PCM512x "Digital" gain to 0dB by default with HiFiBerry DAC+

24db_digital_gain DT param can be used to specify that PCM512x
codec "Digital" volume control should not be limited to 0dB gain,
and if specified will allow the full 24dB gain.

Add dt param to force HiFiBerry DAC+ Pro into slave mode

"dtoverlay=hifiberry-dacplus,slave"

Add 'slave' param to use HiFiBerry DAC+ Pro in slave mode,
with Pi as master for bit and frame clock.

Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>

Fixed a bug when using 352.8kHz sample rate

Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>

ASoC: pcm512x: revert downstream changes

This partially reverts commit 185ea05465aac8bf02a0d2b2f4289d42c72870b7
which was added by https://github.com/raspberrypi/linux/pull/1152

The downstream pcm512x changes caused a regression, it broke normal
use of the 24bit format with the codec, eg when using simple-audio-card.

The actual bug with 24bit playback is the incorrect usage
of physical_width in various drivers in the downstream tree
which causes 24bit data to be transmitted with 32 clock
cycles. So it's not the pcm512x that needs fixing, it's the
soundcard drivers.

Signed-off-by: Matthias Reichl <hias@horus.com>

ASoC: hifiberry_dacplus: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Signed-off-by: Matthias Reichl <hias@horus.com>

ASoC: hifiberry_dacplus: transmit S24_LE with 64 BCLK cycles

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 drivers/clk/Makefile               |   1 +
 drivers/clk/clk-hifiberry-dacpro.c | 160 +++++++++++++
 sound/soc/bcm/hifiberry_dacplus.c  | 352 +++++++++++++++++++++++++++++
 3 files changed, 513 insertions(+)
 create mode 100644 drivers/clk/clk-hifiberry-dacpro.c
 create mode 100644 sound/soc/bcm/hifiberry_dacplus.c

diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index a84c5573cabea..5555c7d0d18de 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_COMMON_CLK_GEMINI)		+= clk-gemini.o
 obj-$(CONFIG_COMMON_CLK_ASPEED)		+= clk-aspeed.o
 obj-$(CONFIG_ARCH_HIGHBANK)		+= clk-highbank.o
 obj-$(CONFIG_CLK_HSDK)			+= clk-hsdk-pll.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += clk-hifiberry-dacpro.o
 obj-$(CONFIG_COMMON_CLK_MAX77686)	+= clk-max77686.o
 obj-$(CONFIG_COMMON_CLK_MAX9485)	+= clk-max9485.o
 obj-$(CONFIG_ARCH_MOXART)		+= clk-moxart.o
diff --git a/drivers/clk/clk-hifiberry-dacpro.c b/drivers/clk/clk-hifiberry-dacpro.c
new file mode 100644
index 0000000000000..99cee2b1706c4
--- /dev/null
+++ b/drivers/clk/clk-hifiberry-dacpro.c
@@ -0,0 +1,160 @@
+/*
+ * Clock Driver for HiFiBerry DAC Pro
+ *
+ * Author: Stuart MacLean
+ *         Copyright 2015
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 22579200UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 24576000UL
+
+/**
+ * struct hifiberry_dacpro_clk - Common struct to the HiFiBerry DAC Pro
+ * @hw: clk_hw for the common clk framework
+ * @mode: 0 => CLK44EN, 1 => CLK48EN
+ */
+struct clk_hifiberry_hw {
+	struct clk_hw hw;
+	uint8_t mode;
+};
+
+#define to_hifiberry_clk(_hw) container_of(_hw, struct clk_hifiberry_hw, hw)
+
+static const struct of_device_id clk_hifiberry_dacpro_dt_ids[] = {
+	{ .compatible = "hifiberry,dacpro-clk",},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, clk_hifiberry_dacpro_dt_ids);
+
+static unsigned long clk_hifiberry_dacpro_recalc_rate(struct clk_hw *hw,
+	unsigned long parent_rate)
+{
+	return (to_hifiberry_clk(hw)->mode == 0) ? CLK_44EN_RATE :
+		CLK_48EN_RATE;
+}
+
+static long clk_hifiberry_dacpro_round_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long *parent_rate)
+{
+	long actual_rate;
+
+	if (rate <= CLK_44EN_RATE) {
+		actual_rate = (long)CLK_44EN_RATE;
+	} else if (rate >= CLK_48EN_RATE) {
+		actual_rate = (long)CLK_48EN_RATE;
+	} else {
+		long diff44Rate = (long)(rate - CLK_44EN_RATE);
+		long diff48Rate = (long)(CLK_48EN_RATE - rate);
+
+		if (diff44Rate < diff48Rate)
+			actual_rate = (long)CLK_44EN_RATE;
+		else
+			actual_rate = (long)CLK_48EN_RATE;
+	}
+	return actual_rate;
+}
+
+
+static int clk_hifiberry_dacpro_set_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long parent_rate)
+{
+	unsigned long actual_rate;
+	struct clk_hifiberry_hw *clk = to_hifiberry_clk(hw);
+
+	actual_rate = (unsigned long)clk_hifiberry_dacpro_round_rate(hw, rate,
+		&parent_rate);
+	clk->mode = (actual_rate == CLK_44EN_RATE) ? 0 : 1;
+	return 0;
+}
+
+
+const struct clk_ops clk_hifiberry_dacpro_rate_ops = {
+	.recalc_rate = clk_hifiberry_dacpro_recalc_rate,
+	.round_rate = clk_hifiberry_dacpro_round_rate,
+	.set_rate = clk_hifiberry_dacpro_set_rate,
+};
+
+static int clk_hifiberry_dacpro_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct clk_hifiberry_hw *proclk;
+	struct clk *clk;
+	struct device *dev;
+	struct clk_init_data init;
+
+	dev = &pdev->dev;
+
+	proclk = kzalloc(sizeof(struct clk_hifiberry_hw), GFP_KERNEL);
+	if (!proclk)
+		return -ENOMEM;
+
+	init.name = "clk-hifiberry-dacpro";
+	init.ops = &clk_hifiberry_dacpro_rate_ops;
+	init.flags = CLK_IS_BASIC;
+	init.parent_names = NULL;
+	init.num_parents = 0;
+
+	proclk->mode = 0;
+	proclk->hw.init = &init;
+
+	clk = devm_clk_register(dev, &proclk->hw);
+	if (!IS_ERR(clk)) {
+		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
+			clk);
+	} else {
+		dev_err(dev, "Fail to register clock driver\n");
+		kfree(proclk);
+		ret = PTR_ERR(clk);
+	}
+	return ret;
+}
+
+static int clk_hifiberry_dacpro_remove(struct platform_device *pdev)
+{
+	of_clk_del_provider(pdev->dev.of_node);
+	return 0;
+}
+
+static struct platform_driver clk_hifiberry_dacpro_driver = {
+	.probe = clk_hifiberry_dacpro_probe,
+	.remove = clk_hifiberry_dacpro_remove,
+	.driver = {
+		.name = "clk-hifiberry-dacpro",
+		.of_match_table = clk_hifiberry_dacpro_dt_ids,
+	},
+};
+
+static int __init clk_hifiberry_dacpro_init(void)
+{
+	return platform_driver_register(&clk_hifiberry_dacpro_driver);
+}
+core_initcall(clk_hifiberry_dacpro_init);
+
+static void __exit clk_hifiberry_dacpro_exit(void)
+{
+	platform_driver_unregister(&clk_hifiberry_dacpro_driver);
+}
+module_exit(clk_hifiberry_dacpro_exit);
+
+MODULE_DESCRIPTION("HiFiBerry DAC Pro clock driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:clk-hifiberry-dacpro");
diff --git a/sound/soc/bcm/hifiberry_dacplus.c b/sound/soc/bcm/hifiberry_dacplus.c
new file mode 100644
index 0000000000000..ff61d1ed46c3c
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_dacplus.c
@@ -0,0 +1,352 @@
+/*
+ * ASoC Driver for HiFiBerry DAC+ / DAC Pro
+ *
+ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
+ *		Copyright 2014-2015
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/pcm512x.h"
+
+#define HIFIBERRY_DACPRO_NOCLOCK 0
+#define HIFIBERRY_DACPRO_CLK44EN 1
+#define HIFIBERRY_DACPRO_CLK48EN 2
+
+struct pcm512x_priv {
+	struct regmap *regmap;
+	struct clk *sclk;
+};
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 22579200UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 24576000UL
+
+static bool slave;
+static bool snd_rpi_hifiberry_is_dacpro;
+static bool digital_gain_0db_limit = true;
+
+static void snd_rpi_hifiberry_dacplus_select_clk(struct snd_soc_component *component,
+	int clk_id)
+{
+	switch (clk_id) {
+	case HIFIBERRY_DACPRO_NOCLOCK:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
+		break;
+	case HIFIBERRY_DACPRO_CLK44EN:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
+		break;
+	case HIFIBERRY_DACPRO_CLK48EN:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
+		break;
+	}
+}
+
+static void snd_rpi_hifiberry_dacplus_clk_gpio(struct snd_soc_component *component)
+{
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
+}
+
+static bool snd_rpi_hifiberry_dacplus_is_sclk(struct snd_soc_component *component)
+{
+	unsigned int sck;
+
+	snd_soc_component_read(component, PCM512x_RATE_DET_4, &sck);
+	return (!(sck & 0x40));
+}
+
+static bool snd_rpi_hifiberry_dacplus_is_sclk_sleep(
+	struct snd_soc_component *component)
+{
+	msleep(2);
+	return snd_rpi_hifiberry_dacplus_is_sclk(component);
+}
+
+static bool snd_rpi_hifiberry_dacplus_is_pro_card(struct snd_soc_component *component)
+{
+	bool isClk44EN, isClk48En, isNoClk;
+
+	snd_rpi_hifiberry_dacplus_clk_gpio(component);
+
+	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
+	isClk44EN = snd_rpi_hifiberry_dacplus_is_sclk_sleep(component);
+
+	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
+	isNoClk = snd_rpi_hifiberry_dacplus_is_sclk_sleep(component);
+
+	snd_rpi_hifiberry_dacplus_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
+	isClk48En = snd_rpi_hifiberry_dacplus_is_sclk_sleep(component);
+
+	return (isClk44EN && isClk48En && !isNoClk);
+}
+
+static int snd_rpi_hifiberry_dacplus_clk_for_rate(int sample_rate)
+{
+	int type;
+
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+	case 352800:
+		type = HIFIBERRY_DACPRO_CLK44EN;
+		break;
+	default:
+		type = HIFIBERRY_DACPRO_CLK48EN;
+		break;
+	}
+	return type;
+}
+
+static void snd_rpi_hifiberry_dacplus_set_sclk(struct snd_soc_component *component,
+	int sample_rate)
+{
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+
+	if (!IS_ERR(pcm512x->sclk)) {
+		int ctype;
+
+		ctype = snd_rpi_hifiberry_dacplus_clk_for_rate(sample_rate);
+		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
+			? CLK_44EN_RATE : CLK_48EN_RATE);
+		snd_rpi_hifiberry_dacplus_select_clk(component, ctype);
+	}
+}
+
+static int snd_rpi_hifiberry_dacplus_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct pcm512x_priv *priv;
+
+	if (slave)
+		snd_rpi_hifiberry_is_dacpro = false;
+	else
+		snd_rpi_hifiberry_is_dacpro =
+				snd_rpi_hifiberry_dacplus_is_pro_card(component);
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "HiFiBerry DAC+ Pro";
+		dai->stream_name = "HiFiBerry DAC+ Pro HiFi";
+		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBM_CFM;
+
+		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
+		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
+		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
+	} else {
+		priv = snd_soc_component_get_drvdata(component);
+		priv->sclk = ERR_PTR(-ENOENT);
+	}
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+
+	if (digital_gain_0db_limit)
+	{
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplus_update_rate_den(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+	struct snd_ratnum *rats_no_pll;
+	unsigned int num = 0, den = 0;
+	int err;
+
+	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
+	if (!rats_no_pll)
+		return -ENOMEM;
+
+	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
+	rats_no_pll->den_min = 1;
+	rats_no_pll->den_max = 128;
+	rats_no_pll->den_step = 1;
+
+	err = snd_interval_ratnum(hw_param_interval(params,
+		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
+	if (err >= 0 && den) {
+		params->rate_num = num;
+		params->rate_den = den;
+	}
+
+	devm_kfree(rtd->dev, rats_no_pll);
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplus_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	int channels = params_channels(params);
+	int width = 32;
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_component *component = rtd->codec_dai->component;
+
+		width = snd_pcm_format_physical_width(params_format(params));
+
+		snd_rpi_hifiberry_dacplus_set_sclk(component,
+			params_rate(params));
+
+		ret = snd_rpi_hifiberry_dacplus_update_rate_den(
+			substream, params);
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03,
+		channels, width);
+	return ret;
+}
+
+static int snd_rpi_hifiberry_dacplus_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+	return 0;
+}
+
+static void snd_rpi_hifiberry_dacplus_shutdown(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_hifiberry_dacplus_ops = {
+	.hw_params = snd_rpi_hifiberry_dacplus_hw_params,
+	.startup = snd_rpi_hifiberry_dacplus_startup,
+	.shutdown = snd_rpi_hifiberry_dacplus_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_dacplus_dai[] = {
+{
+	.name		= "HiFiBerry DAC+",
+	.stream_name	= "HiFiBerry DAC+ HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_hifiberry_dacplus_ops,
+	.init		= snd_rpi_hifiberry_dacplus_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_hifiberry_dacplus = {
+	.name         = "snd_rpi_hifiberry_dacplus",
+	.driver_name  = "HifiberryDacp",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_dacplus_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplus_dai),
+};
+
+static int snd_rpi_hifiberry_dacplus_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_hifiberry_dacplus.dev = &pdev->dev;
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_rpi_hifiberry_dacplus_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+			"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "hifiberry,24db_digital_gain");
+		slave = of_property_read_bool(pdev->dev.of_node,
+						"hifiberry-dacplus,slave");
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev,
+			&snd_rpi_hifiberry_dacplus);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_rpi_hifiberry_dacplus_of_match[] = {
+	{ .compatible = "hifiberry,hifiberry-dacplus", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplus_of_match);
+
+static struct platform_driver snd_rpi_hifiberry_dacplus_driver = {
+	.driver = {
+		.name   = "snd-rpi-hifiberry-dacplus",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_dacplus_of_match,
+	},
+	.probe          = snd_rpi_hifiberry_dacplus_probe,
+};
+
+module_platform_driver(snd_rpi_hifiberry_dacplus_driver);
+
+MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
+MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 119ce24b90d61d3bfd39b387d945324b920f14bc Mon Sep 17 00:00:00 2001
From: Daniel Matuschek <info@crazy-audio.com>
Date: Mon, 4 Aug 2014 11:09:58 +0200
Subject: [PATCH 0069/1835] Added driver for HiFiBerry Amp amplifier add-on
 board

The driver contains a low-level hardware driver for the TAS5713 and the
drivers for the Raspberry Pi I2S subsystem.

TAS5713: return error if initialisation fails

Existing TAS5713 driver logs errors during initialisation, but does not return
an error code. Therefore even if initialisation fails, the driver will still be
loaded, but won't work. This patch fixes this. I2C communication error will now
reported correctly by a non-zero return code.

HiFiBerry Amp: fix device-tree problems

Some code to load the driver based on device-tree-overlays was missing. This is added by this patch.
---
 sound/soc/codecs/Kconfig   |   4 +
 sound/soc/codecs/Makefile  |   2 +
 sound/soc/codecs/tas5713.c | 366 +++++++++++++++++++++++++++++++++++++
 sound/soc/codecs/tas5713.h | 210 +++++++++++++++++++++
 4 files changed, 582 insertions(+)
 create mode 100644 sound/soc/codecs/tas5713.c
 create mode 100644 sound/soc/codecs/tas5713.h

diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 9473ef0bbde58..5d4a0445f3d25 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -167,6 +167,7 @@ config SND_SOC_ALL_CODECS
 	select SND_SOC_TFA9879 if I2C
 	select SND_SOC_TLV320AIC23_I2C if I2C
 	select SND_SOC_TLV320AIC23_SPI if SPI_MASTER
+	select SND_SOC_TAS5713 if I2C
 	select SND_SOC_TLV320AIC26 if SPI_MASTER
 	select SND_SOC_TLV320AIC31XX if I2C
 	select SND_SOC_TLV320AIC32X4_I2C if I2C
@@ -997,6 +998,9 @@ config SND_SOC_TFA9879
 	tristate "NXP Semiconductors TFA9879 amplifier"
 	depends on I2C
 
+config SND_SOC_TAS5713
+	tristate
+
 config SND_SOC_TLV320AIC23
 	tristate
 
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index db39e34f2bd03..166f169ca06a9 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -176,6 +176,7 @@ snd-soc-tas5720-objs := tas5720.o
 snd-soc-tas6424-objs := tas6424.o
 snd-soc-tda7419-objs := tda7419.o
 snd-soc-tfa9879-objs := tfa9879.o
+snd-soc-tas5713-objs := tas5713.o
 snd-soc-tlv320aic23-objs := tlv320aic23.o
 snd-soc-tlv320aic23-i2c-objs := tlv320aic23-i2c.o
 snd-soc-tlv320aic23-spi-objs := tlv320aic23-spi.o
@@ -436,6 +437,7 @@ obj-$(CONFIG_SND_SOC_TAS5720)	+= snd-soc-tas5720.o
 obj-$(CONFIG_SND_SOC_TAS6424)	+= snd-soc-tas6424.o
 obj-$(CONFIG_SND_SOC_TDA7419)	+= snd-soc-tda7419.o
 obj-$(CONFIG_SND_SOC_TFA9879)	+= snd-soc-tfa9879.o
+obj-$(CONFIG_SND_SOC_TAS5713)	+= snd-soc-tas5713.o
 obj-$(CONFIG_SND_SOC_TLV320AIC23)	+= snd-soc-tlv320aic23.o
 obj-$(CONFIG_SND_SOC_TLV320AIC23_I2C)	+= snd-soc-tlv320aic23-i2c.o
 obj-$(CONFIG_SND_SOC_TLV320AIC23_SPI)	+= snd-soc-tlv320aic23-spi.o
diff --git a/sound/soc/codecs/tas5713.c b/sound/soc/codecs/tas5713.c
new file mode 100644
index 0000000000000..9c1c92e57bbfa
--- /dev/null
+++ b/sound/soc/codecs/tas5713.c
@@ -0,0 +1,366 @@
+/*
+ * ASoC Driver for TAS5713
+ *
+ * Author:	Sebastian Eickhoff <basti.eickhoff@googlemail.com>
+ *		Copyright 2014
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/pm.h>
+#include <linux/i2c.h>
+#include <linux/of_device.h>
+#include <linux/spi/spi.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <asm/uaccess.h>
+
+#include "tas5713.h"
+
+
+static struct i2c_client *i2c;
+
+struct tas5713_priv {
+	struct regmap *regmap;
+	int mclk_div;
+	struct snd_soc_component *component;
+};
+
+static struct tas5713_priv *priv_data;
+
+
+
+
+/*
+ *    _   _    ___   _      ___         _           _
+ *   /_\ | |  / __| /_\    / __|___ _ _| |_ _ _ ___| |___
+ *  / _ \| |__\__ \/ _ \  | (__/ _ \ ' \  _| '_/ _ \ (_-<
+ * /_/ \_\____|___/_/ \_\  \___\___/_||_\__|_| \___/_/__/
+ *
+ */
+
+static const DECLARE_TLV_DB_SCALE(tas5713_vol_tlv, -10000, 50, 1);
+
+
+static const struct snd_kcontrol_new tas5713_snd_controls[] = {
+	SOC_SINGLE_TLV  ("Master"    , TAS5713_VOL_MASTER, 0, 248, 1, tas5713_vol_tlv),
+	SOC_DOUBLE_R_TLV("Channels"  , TAS5713_VOL_CH1, TAS5713_VOL_CH2, 0, 248, 1, tas5713_vol_tlv)
+};
+
+
+
+
+/*
+ *  __  __         _    _            ___      _
+ * |  \/  |__ _ __| |_ (_)_ _  ___  |   \ _ _(_)_ _____ _ _
+ * | |\/| / _` / _| ' \| | ' \/ -_) | |) | '_| \ V / -_) '_|
+ * |_|  |_\__,_\__|_||_|_|_||_\___| |___/|_| |_|\_/\___|_|
+ *
+ */
+
+static int tas5713_hw_params(struct snd_pcm_substream *substream,
+			    struct snd_pcm_hw_params *params,
+			    struct snd_soc_dai *dai)
+{
+	u16 blen = 0x00;
+
+	struct snd_soc_component *component = dai->component;
+	priv_data->component = component;
+
+	switch (params_format(params)) {
+	case SNDRV_PCM_FORMAT_S16_LE:
+		blen = 0x03;
+		break;
+	case SNDRV_PCM_FORMAT_S20_3LE:
+		blen = 0x1;
+		break;
+	case SNDRV_PCM_FORMAT_S24_LE:
+		blen = 0x04;
+		break;
+	case SNDRV_PCM_FORMAT_S32_LE:
+		blen = 0x05;
+		break;
+	default:
+		dev_err(dai->dev, "Unsupported word length: %u\n",
+			params_format(params));
+		return -EINVAL;
+	}
+
+	// set word length
+	snd_soc_component_update_bits(component, TAS5713_SERIAL_DATA_INTERFACE, 0x7, blen);
+
+	return 0;
+}
+
+
+static int tas5713_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
+{
+	unsigned int val = 0;
+
+	struct tas5713_priv *tas5713;
+	struct snd_soc_component *component = dai->component;
+	tas5713 = snd_soc_component_get_drvdata(component);
+
+	if (mute) {
+		val = TAS5713_SOFT_MUTE_ALL;
+	}
+
+	return regmap_write(tas5713->regmap, TAS5713_SOFT_MUTE, val);
+}
+
+
+static const struct snd_soc_dai_ops tas5713_dai_ops = {
+	.hw_params 		= tas5713_hw_params,
+	.mute_stream	= tas5713_mute_stream,
+};
+
+
+static struct snd_soc_dai_driver tas5713_dai = {
+	.name		= "tas5713-hifi",
+	.playback 	= {
+		.stream_name	= "Playback",
+		.channels_min	= 2,
+		.channels_max	= 2,
+		.rates		    = SNDRV_PCM_RATE_8000_48000,
+		.formats	    = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE ),
+	},
+	.ops        = &tas5713_dai_ops,
+};
+
+
+
+
+/*
+ *   ___         _          ___      _
+ *  / __|___  __| |___ __  |   \ _ _(_)_ _____ _ _
+ * | (__/ _ \/ _` / -_) _| | |) | '_| \ V / -_) '_|
+ *  \___\___/\__,_\___\__| |___/|_| |_|\_/\___|_|
+ *
+ */
+
+static void tas5713_remove(struct snd_soc_component *component)
+{
+	struct tas5713_priv *tas5713;
+
+	tas5713 = snd_soc_component_get_drvdata(component);
+}
+
+
+static int tas5713_probe(struct snd_soc_component *component)
+{
+	struct tas5713_priv *tas5713;
+	int i, ret;
+
+	i2c = container_of(component->dev, struct i2c_client, dev);
+
+	tas5713 = snd_soc_component_get_drvdata(component);
+
+	// Reset error
+	ret = snd_soc_component_write(component, TAS5713_ERROR_STATUS, 0x00);
+	if (ret < 0) return ret;
+
+	// Trim oscillator
+	ret = snd_soc_component_write(component, TAS5713_OSC_TRIM, 0x00);
+	if (ret < 0) return ret;
+	msleep(1000);
+
+	// Reset error
+	ret = snd_soc_component_write(component, TAS5713_ERROR_STATUS, 0x00);
+	if (ret < 0) return ret;
+
+	// Clock mode: 44/48kHz, MCLK=64xfs
+	ret = snd_soc_component_write(component, TAS5713_CLOCK_CTRL, 0x60);
+	if (ret < 0) return ret;
+
+	// I2S 24bit
+	ret = snd_soc_component_write(component, TAS5713_SERIAL_DATA_INTERFACE, 0x05);
+	if (ret < 0) return ret;
+
+	// Unmute
+	ret = snd_soc_component_write(component, TAS5713_SYSTEM_CTRL2, 0x00);
+	if (ret < 0) return ret;
+	ret = snd_soc_component_write(component, TAS5713_SOFT_MUTE, 0x00);
+	if (ret < 0) return ret;
+
+	// Set volume to 0db
+	ret = snd_soc_component_write(component, TAS5713_VOL_MASTER, 0x00);
+	if (ret < 0) return ret;
+
+	// Now start programming the default initialization sequence
+	for (i = 0; i < ARRAY_SIZE(tas5713_init_sequence); ++i) {
+		ret = i2c_master_send(i2c,
+				     tas5713_init_sequence[i].data,
+				     tas5713_init_sequence[i].size);
+		if (ret < 0) {
+			printk(KERN_INFO "TAS5713 CODEC PROBE: InitSeq returns: %d\n", ret);
+		}
+	}
+
+	// Unmute
+	ret = snd_soc_component_write(component, TAS5713_SYSTEM_CTRL2, 0x00);
+	if (ret < 0) return ret;
+
+	return 0;
+}
+
+
+static struct snd_soc_component_driver soc_codec_dev_tas5713 = {
+	.probe = tas5713_probe,
+	.remove = tas5713_remove,
+	.controls = tas5713_snd_controls,
+	.num_controls = ARRAY_SIZE(tas5713_snd_controls),
+};
+
+
+
+
+/*
+ *   ___ ___ ___   ___      _
+ *  |_ _|_  ) __| |   \ _ _(_)_ _____ _ _
+ *   | | / / (__  | |) | '_| \ V / -_) '_|
+ *  |___/___\___| |___/|_| |_|\_/\___|_|
+ *
+ */
+
+static const struct reg_default tas5713_reg_defaults[] = {
+	{ 0x07 ,0x80 },     // R7  - VOL_MASTER    - -40dB
+	{ 0x08 ,  30 },     // R8  - VOL_CH1	   -   0dB
+	{ 0x09 ,  30 },     // R9  - VOL_CH2       -   0dB
+	{ 0x0A ,0x80 },     // R10 - VOL_HEADPHONE - -40dB
+};
+
+
+static bool tas5713_reg_volatile(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+		case TAS5713_DEVICE_ID:
+		case TAS5713_ERROR_STATUS:
+			return true;
+	default:
+			return false;
+	}
+}
+
+
+static const struct of_device_id tas5713_of_match[] = {
+	{ .compatible = "ti,tas5713", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, tas5713_of_match);
+
+
+static struct regmap_config tas5713_regmap_config = {
+	.reg_bits = 8,
+	.val_bits = 8,
+
+	.max_register = TAS5713_MAX_REGISTER,
+	.volatile_reg = tas5713_reg_volatile,
+
+	.cache_type = REGCACHE_RBTREE,
+	.reg_defaults = tas5713_reg_defaults,
+	.num_reg_defaults = ARRAY_SIZE(tas5713_reg_defaults),
+};
+
+
+static int tas5713_i2c_probe(struct i2c_client *i2c,
+			    const struct i2c_device_id *id)
+{
+	int ret;
+
+	priv_data = devm_kzalloc(&i2c->dev, sizeof *priv_data, GFP_KERNEL);
+	if (!priv_data)
+		return -ENOMEM;
+
+	priv_data->regmap = devm_regmap_init_i2c(i2c, &tas5713_regmap_config);
+	if (IS_ERR(priv_data->regmap)) {
+		ret = PTR_ERR(priv_data->regmap);
+		return ret;
+	}
+
+	i2c_set_clientdata(i2c, priv_data);
+
+	ret = snd_soc_register_component(&i2c->dev,
+				     &soc_codec_dev_tas5713, &tas5713_dai, 1);
+
+	return ret;
+}
+
+
+static int tas5713_i2c_remove(struct i2c_client *i2c)
+{
+	snd_soc_unregister_component(&i2c->dev);
+	i2c_set_clientdata(i2c, NULL);
+
+	kfree(priv_data);
+
+	return 0;
+}
+
+
+static const struct i2c_device_id tas5713_i2c_id[] = {
+	{ "tas5713", 0 },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(i2c, tas5713_i2c_id);
+
+
+static struct i2c_driver tas5713_i2c_driver = {
+	.driver = {
+		.name = "tas5713",
+		.owner = THIS_MODULE,
+		.of_match_table = tas5713_of_match,
+	},
+	.probe = tas5713_i2c_probe,
+	.remove = tas5713_i2c_remove,
+	.id_table = tas5713_i2c_id
+};
+
+
+static int __init tas5713_modinit(void)
+{
+	int ret = 0;
+
+	ret = i2c_add_driver(&tas5713_i2c_driver);
+	if (ret) {
+		printk(KERN_ERR "Failed to register tas5713 I2C driver: %d\n",
+		       ret);
+	}
+
+	return ret;
+}
+module_init(tas5713_modinit);
+
+
+static void __exit tas5713_exit(void)
+{
+	i2c_del_driver(&tas5713_i2c_driver);
+}
+module_exit(tas5713_exit);
+
+
+MODULE_AUTHOR("Sebastian Eickhoff <basti.eickhoff@googlemail.com>");
+MODULE_DESCRIPTION("ASoC driver for TAS5713");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/tas5713.h b/sound/soc/codecs/tas5713.h
new file mode 100644
index 0000000000000..8f019e0489875
--- /dev/null
+++ b/sound/soc/codecs/tas5713.h
@@ -0,0 +1,210 @@
+/*
+ * ASoC Driver for TAS5713
+ *
+ * Author:      Sebastian Eickhoff <basti.eickhoff@googlemail.com>
+ *              Copyright 2014
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef _TAS5713_H
+#define _TAS5713_H
+
+
+// TAS5713 I2C-bus register addresses
+
+#define TAS5713_CLOCK_CTRL              0x00
+#define TAS5713_DEVICE_ID               0x01
+#define TAS5713_ERROR_STATUS            0x02
+#define TAS5713_SYSTEM_CTRL1            0x03
+#define TAS5713_SERIAL_DATA_INTERFACE   0x04
+#define TAS5713_SYSTEM_CTRL2            0x05
+#define TAS5713_SOFT_MUTE               0x06
+#define TAS5713_VOL_MASTER              0x07
+#define TAS5713_VOL_CH1                 0x08
+#define TAS5713_VOL_CH2                 0x09
+#define TAS5713_VOL_HEADPHONE           0x0A
+#define TAS5713_VOL_CONFIG              0x0E
+#define TAS5713_MODULATION_LIMIT        0x10
+#define TAS5713_IC_DLY_CH1              0x11
+#define TAS5713_IC_DLY_CH2              0x12
+#define TAS5713_IC_DLY_CH3              0x13
+#define TAS5713_IC_DLY_CH4              0x14
+
+#define TAS5713_START_STOP_PERIOD       0x1A
+#define TAS5713_OSC_TRIM                0x1B
+#define TAS5713_BKND_ERR                0x1C
+
+#define TAS5713_INPUT_MUX               0x20
+#define TAS5713_SRC_SELECT_CH4          0x21
+#define TAS5713_PWM_MUX                 0x25
+
+#define TAS5713_CH1_BQ0                 0x29
+#define TAS5713_CH1_BQ1                 0x2A
+#define TAS5713_CH1_BQ2                 0x2B
+#define TAS5713_CH1_BQ3                 0x2C
+#define TAS5713_CH1_BQ4                 0x2D
+#define TAS5713_CH1_BQ5                 0x2E
+#define TAS5713_CH1_BQ6                 0x2F
+#define TAS5713_CH1_BQ7                 0x58
+#define TAS5713_CH1_BQ8                 0x59
+
+#define TAS5713_CH2_BQ0                 0x30
+#define TAS5713_CH2_BQ1                 0x31
+#define TAS5713_CH2_BQ2                 0x32
+#define TAS5713_CH2_BQ3                 0x33
+#define TAS5713_CH2_BQ4                 0x34
+#define TAS5713_CH2_BQ5                 0x35
+#define TAS5713_CH2_BQ6                 0x36
+#define TAS5713_CH2_BQ7                 0x5C
+#define TAS5713_CH2_BQ8                 0x5D
+
+#define TAS5713_CH4_BQ0                 0x5A
+#define TAS5713_CH4_BQ1                 0x5B
+#define TAS5713_CH3_BQ0                 0x5E
+#define TAS5713_CH3_BQ1                 0x5F
+
+#define TAS5713_DRC1_SOFTENING_FILTER_ALPHA_OMEGA       0x3B
+#define TAS5713_DRC1_ATTACK_RELEASE_RATE                0x3C
+#define TAS5713_DRC2_SOFTENING_FILTER_ALPHA_OMEGA       0x3E
+#define TAS5713_DRC2_ATTACK_RELEASE_RATE                0x3F
+#define TAS5713_DRC1_ATTACK_RELEASE_THRES               0x40
+#define TAS5713_DRC2_ATTACK_RELEASE_THRES               0x43
+#define TAS5713_DRC_CTRL                                0x46
+
+#define TAS5713_BANK_SW_CTRL            0x50
+#define TAS5713_CH1_OUTPUT_MIXER        0x51
+#define TAS5713_CH2_OUTPUT_MIXER        0x52
+#define TAS5713_CH1_INPUT_MIXER         0x53
+#define TAS5713_CH2_INPUT_MIXER         0x54
+#define TAS5713_OUTPUT_POST_SCALE       0x56
+#define TAS5713_OUTPUT_PRESCALE         0x57
+
+#define TAS5713_IDF_POST_SCALE          0x62
+
+#define TAS5713_CH1_INLINE_MIXER        0x70
+#define TAS5713_CH1_INLINE_DRC_EN_MIXER 0x71
+#define TAS5713_CH1_R_CHANNEL_MIXER     0x72
+#define TAS5713_CH1_L_CHANNEL_MIXER     0x73
+#define TAS5713_CH2_INLINE_MIXER        0x74
+#define TAS5713_CH2_INLINE_DRC_EN_MIXER 0x75
+#define TAS5713_CH2_L_CHANNEL_MIXER     0x76
+#define TAS5713_CH2_R_CHANNEL_MIXER     0x77
+
+#define TAS5713_UPDATE_DEV_ADDR_KEY     0xF8
+#define TAS5713_UPDATE_DEV_ADDR_REG     0xF9
+
+#define TAS5713_REGISTER_COUNT          0x46
+#define TAS5713_MAX_REGISTER            0xF9
+
+
+// Bitmasks for registers
+#define TAS5713_SOFT_MUTE_ALL           0x07
+
+
+
+struct tas5713_init_command {
+        const int size;
+        const char *const data;
+};
+
+static const struct tas5713_init_command tas5713_init_sequence[] = {
+
+        // Trim oscillator
+    { .size = 2,  .data = "\x1B\x00" },
+    // System control register 1 (0x03): block DC
+    { .size = 2,  .data = "\x03\x80" },
+    // Mute everything
+    { .size = 2,  .data = "\x05\x40" },
+    // Modulation limit register (0x10): 97.7%
+    { .size = 2,  .data = "\x10\x02" },
+    // Interchannel delay registers
+    // (0x11, 0x12, 0x13, and 0x14): BD mode
+    { .size = 2,  .data = "\x11\xB8" },
+    { .size = 2,  .data = "\x12\x60" },
+    { .size = 2,  .data = "\x13\xA0" },
+    { .size = 2,  .data = "\x14\x48" },
+    // PWM shutdown group register (0x19): no shutdown
+    { .size = 2,  .data = "\x19\x00" },
+    // Input multiplexer register (0x20): BD mode
+    { .size = 2,  .data = "\x20\x00\x89\x77\x72" },
+    // PWM output mux register (0x25)
+    // Channel 1 --> OUTA, channel 1 neg --> OUTB
+    // Channel 2 --> OUTC, channel 2 neg --> OUTD
+    { .size = 5,  .data = "\x25\x01\x02\x13\x45" },
+    // DRC control (0x46): DRC off
+    { .size = 5,  .data = "\x46\x00\x00\x00\x00" },
+    // BKND_ERR register (0x1C): 299ms reset period
+    { .size = 2,  .data = "\x1C\x07" },
+    // Mute channel 3
+    { .size = 2,  .data = "\x0A\xFF" },
+    // Volume configuration register (0x0E): volume slew 512 steps
+    { .size = 2,  .data = "\x0E\x90" },
+    // Clock control register (0x00): 44/48kHz, MCLK=64xfs
+    { .size = 2,  .data = "\x00\x60" },
+    // Bank switch and eq control (0x50): no bank switching
+    { .size = 5,  .data = "\x50\x00\x00\x00\x00" },
+    // Volume registers (0x07, 0x08, 0x09, 0x0A)
+    { .size = 2,  .data = "\x07\x20" },
+    { .size = 2,  .data = "\x08\x30" },
+    { .size = 2,  .data = "\x09\x30" },
+    { .size = 2,  .data = "\x0A\xFF" },
+    // 0x72, 0x73, 0x76, 0x77 input mixer:
+    // no intermix between channels
+    { .size = 5,  .data = "\x72\x00\x00\x00\x00" },
+    { .size = 5,  .data = "\x73\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x76\x00\x00\x00\x00" },
+    { .size = 5,  .data = "\x77\x00\x80\x00\x00" },
+    // 0x70, 0x71, 0x74, 0x75 inline DRC mixer:
+    // no inline DRC inmix
+    { .size = 5,  .data = "\x70\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x71\x00\x00\x00\x00" },
+    { .size = 5,  .data = "\x74\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x75\x00\x00\x00\x00" },
+    // 0x56, 0x57 Output scale
+    { .size = 5,  .data = "\x56\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x57\x00\x02\x00\x00" },
+    // 0x3B, 0x3c
+    { .size = 9,  .data = "\x3B\x00\x08\x00\x00\x00\x78\x00\x00" },
+    { .size = 9,  .data = "\x3C\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    { .size = 9,  .data = "\x3E\x00\x08\x00\x00\x00\x78\x00\x00" },
+    { .size = 9,  .data = "\x3F\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    { .size = 9,  .data = "\x40\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    { .size = 9,  .data = "\x43\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    // 0x51, 0x52: output mixer
+    { .size = 9,  .data = "\x51\x00\x80\x00\x00\x00\x00\x00\x00" },
+    { .size = 9,  .data = "\x52\x00\x80\x00\x00\x00\x00\x00\x00" },
+    // PEQ defaults
+    { .size = 21,  .data = "\x29\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x30\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x31\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x32\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x33\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x34\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x35\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x36\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x58\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x59\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+};
+
+
+#endif  /* _TAS5713_H */
-- 
GitLab


From 873dd079e2849850219e3125a184af656b02ffe8 Mon Sep 17 00:00:00 2001
From: Waldemar Brodkorb <wbrodkorb@conet.de>
Date: Wed, 25 Mar 2015 09:26:17 +0100
Subject: [PATCH 0070/1835] Add driver for rpi-proto

Forward port of 3.10.x driver from https://github.com/koalo
We are using a custom board and would like to use rpi 3.18.x
kernel. Patch works fine for our embedded system.

URL to the audio chip:
http://www.mikroe.com/add-on-boards/audio-voice/audio-codec-proto/

Playback tested with devicetree enabled.

Signed-off-by: Waldemar Brodkorb <wbrodkorb@conet.de>
---
 sound/soc/bcm/rpi-proto.c | 145 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 sound/soc/bcm/rpi-proto.c

diff --git a/sound/soc/bcm/rpi-proto.c b/sound/soc/bcm/rpi-proto.c
new file mode 100644
index 0000000000000..8227456cfe7d2
--- /dev/null
+++ b/sound/soc/bcm/rpi-proto.c
@@ -0,0 +1,145 @@
+/*
+ * ASoC driver for PROTO AudioCODEC (with a WM8731)
+ * connected to a Raspberry Pi
+ *
+ * Author:      Florian Meier, <koalo@koalo.de>
+ *	      Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/wm8731.h"
+
+static const unsigned int wm8731_rates_12288000[] = {
+	8000, 32000, 48000, 96000,
+};
+
+static struct snd_pcm_hw_constraint_list wm8731_constraints_12288000 = {
+	.list = wm8731_rates_12288000,
+	.count = ARRAY_SIZE(wm8731_rates_12288000),
+};
+
+static int snd_rpi_proto_startup(struct snd_pcm_substream *substream)
+{
+	/* Setup constraints, because there is a 12.288 MHz XTAL on the board */
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_RATE,
+				&wm8731_constraints_12288000);
+	return 0;
+}
+
+static int snd_rpi_proto_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	int sysclk = 12288000; /* This is fixed on this board */
+
+	/* Set proto bclk */
+	int ret = snd_soc_dai_set_bclk_ratio(cpu_dai,32*2);
+	if (ret < 0){
+		dev_err(rtd->card->dev,
+				"Failed to set BCLK ratio %d\n", ret);
+		return ret;
+	}
+
+	/* Set proto sysclk */
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8731_SYSCLK_XTAL,
+			sysclk, SND_SOC_CLOCK_IN);
+	if (ret < 0) {
+		dev_err(rtd->card->dev,
+				"Failed to set WM8731 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_proto_ops = {
+	.startup = snd_rpi_proto_startup,
+	.hw_params = snd_rpi_proto_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_proto_dai[] = {
+{
+	.name		= "WM8731",
+	.stream_name	= "WM8731 HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8731-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8731.1-001a",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S
+				| SND_SOC_DAIFMT_NB_NF
+				| SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &snd_rpi_proto_ops,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_proto = {
+	.name		= "snd_rpi_proto",
+	.owner		= THIS_MODULE,
+	.dai_link	= snd_rpi_proto_dai,
+	.num_links	= ARRAY_SIZE(snd_rpi_proto_dai),
+};
+
+static int snd_rpi_proto_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_proto.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &snd_rpi_proto_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+				            "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_proto);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_rpi_proto_of_match[] = {
+	{ .compatible = "rpi,rpi-proto", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_proto_of_match);
+
+static struct platform_driver snd_rpi_proto_driver = {
+	.driver = {
+		.name   = "snd-rpi-proto",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_proto_of_match,
+	},
+	.probe	  = snd_rpi_proto_probe,
+};
+
+module_platform_driver(snd_rpi_proto_driver);
+
+MODULE_AUTHOR("Florian Meier");
+MODULE_DESCRIPTION("ASoC Driver for Raspberry Pi connected to PROTO board (WM8731)");
+MODULE_LICENSE("GPL");
-- 
GitLab


From d2793fc3a6dd9a93351411842cf8d6476021dd33 Mon Sep 17 00:00:00 2001
From: Aaron Shaw <shawaj@gmail.com>
Date: Thu, 7 Apr 2016 21:26:21 +0100
Subject: [PATCH 0071/1835] Add Support for JustBoom Audio boards

justboom-dac: Adjust for ALSA API change

As of 4.4, snd_soc_limit_volume now takes a struct snd_soc_card *
rather than a struct snd_soc_codec *.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

ASoC: justboom-dac: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Also remove hw_params as it's no longer needed.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/justboom-dac.c | 145 +++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 sound/soc/bcm/justboom-dac.c

diff --git a/sound/soc/bcm/justboom-dac.c b/sound/soc/bcm/justboom-dac.c
new file mode 100644
index 0000000000000..9e7bb9f68ee2e
--- /dev/null
+++ b/sound/soc/bcm/justboom-dac.c
@@ -0,0 +1,145 @@
+/*
+ * ASoC Driver for JustBoom DAC Raspberry Pi HAT Sound Card
+ *
+ * Author:	Milan Neskovic
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/pcm512x.h"
+
+static bool digital_gain_0db_limit = true;
+
+static int snd_rpi_justboom_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0xf, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
+
+	if (digital_gain_0db_limit)
+	{
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static int snd_rpi_justboom_dac_startup(struct snd_pcm_substream *substream) {
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
+	return 0;
+}
+
+static void snd_rpi_justboom_dac_shutdown(struct snd_pcm_substream *substream) {
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08,0x00);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_justboom_dac_ops = {
+	.startup = snd_rpi_justboom_dac_startup,
+	.shutdown = snd_rpi_justboom_dac_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_justboom_dac_dai[] = {
+{
+	.name		= "JustBoom DAC",
+	.stream_name	= "JustBoom DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_justboom_dac_ops,
+	.init		= snd_rpi_justboom_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_justboom_dac = {
+	.name         = "snd_rpi_justboom_dac",
+	.driver_name  = "JustBoomDac",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_justboom_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_justboom_dac_dai),
+};
+
+static int snd_rpi_justboom_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_justboom_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+	    struct device_node *i2s_node;
+	    struct snd_soc_dai_link *dai = &snd_rpi_justboom_dac_dai[0];
+	    i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+	    if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+	    }
+
+	    digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "justboom,24db_digital_gain");
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_justboom_dac);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_rpi_justboom_dac_of_match[] = {
+	{ .compatible = "justboom,justboom-dac", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_justboom_dac_of_match);
+
+static struct platform_driver snd_rpi_justboom_dac_driver = {
+	.driver = {
+		.name   = "snd-rpi-justboom-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_justboom_dac_of_match,
+	},
+	.probe          = snd_rpi_justboom_dac_probe,
+};
+
+module_platform_driver(snd_rpi_justboom_dac_driver);
+
+MODULE_AUTHOR("Milan Neskovic <info@justboom.co>");
+MODULE_DESCRIPTION("ASoC Driver for JustBoom PI DAC HAT Sound Card");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 71b5893ff50c652b03cf960390e7426b2f041d35 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Mon, 16 May 2016 21:36:31 +1000
Subject: [PATCH 0072/1835] New AudioInjector.net Pi soundcard with low jitter
 audio in and out.

Contains the sound/soc/bcm ALSA machine driver and necessary alterations to the Kconfig and Makefile.
Adds the dts overlay and updates the Makefile and README.
Updates the relevant defconfig files to enable building for the Raspberry Pi.
Thanks to Phil Elwell (pelwell) for the review, simple-card concepts and discussion. Thanks to Clive Messer for overlay naming suggestions.

Added support for headphones, microphone and bclk_ratio settings.

This patch adds headphone and microphone capability to the Audio Injector sound card. The patch also sets the bit clock ratio for use in the bcm2835-i2s driver. The bcm2835-i2s can't handle an 8 kHz sample rate when the bit clock is at 12 MHz because its register is only 10 bits wide which can't represent the ch2 offset of 1508. For that reason, the rate constraint is added.
---
 sound/soc/bcm/audioinjector-pi-soundcard.c | 185 +++++++++++++++++++++
 1 file changed, 185 insertions(+)
 create mode 100644 sound/soc/bcm/audioinjector-pi-soundcard.c

diff --git a/sound/soc/bcm/audioinjector-pi-soundcard.c b/sound/soc/bcm/audioinjector-pi-soundcard.c
new file mode 100644
index 0000000000000..6fc42570a141c
--- /dev/null
+++ b/sound/soc/bcm/audioinjector-pi-soundcard.c
@@ -0,0 +1,185 @@
+/*
+ * ASoC Driver for AudioInjector Pi add on soundcard
+ *
+ *  Created on: 13-May-2016
+ *      Author: flatmax@flatmax.org
+ *              based on code by  Cliff Cai <Cliff.Cai@analog.com> for the ssm2602 machine blackfin.
+ *              with help from Lars-Peter Clausen for simplifying the original code to use the dai_fmt field.
+ *		i2s_node code taken from the other sound/soc/bcm machine drivers.
+ *
+ * Copyright (C) 2016 Flatmax Pty. Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include <sound/control.h>
+
+#include "../codecs/wm8731.h"
+
+static const unsigned int bcm2835_rates_12000000[] = {
+	8000, 16000, 32000, 44100, 48000, 96000, 88200,
+};
+
+static struct snd_pcm_hw_constraint_list bcm2835_constraints_12000000 = {
+	.list = bcm2835_rates_12000000,
+	.count = ARRAY_SIZE(bcm2835_rates_12000000),
+};
+
+static int snd_audioinjector_pi_soundcard_startup(struct snd_pcm_substream *substream)
+{
+	/* Setup constraints, because there is a 12 MHz XTAL on the board */
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_RATE,
+				&bcm2835_constraints_12000000);
+	return 0;
+}
+
+static int snd_audioinjector_pi_soundcard_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	switch (params_rate(params)){
+		case 8000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 1);
+		case 16000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 750);
+		case 32000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 375);
+		case 44100:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 272);
+		case 48000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 250);
+		case 88200:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 136);
+		case 96000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
+		default:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
+	}
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_audioinjector_pi_soundcard_ops = {
+	.startup = snd_audioinjector_pi_soundcard_startup,
+	.hw_params = snd_audioinjector_pi_soundcard_hw_params,
+};
+
+static int audioinjector_pi_soundcard_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return snd_soc_dai_set_sysclk(rtd->codec_dai, WM8731_SYSCLK_XTAL, 12000000, SND_SOC_CLOCK_IN);
+}
+
+static struct snd_soc_dai_link audioinjector_pi_soundcard_dai[] = {
+	{
+		.name = "AudioInjector audio",
+		.stream_name = "AudioInjector audio",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.codec_dai_name = "wm8731-hifi",
+		.platform_name	= "bcm2835-i2s.0",
+		.codec_name = "wm8731.1-001a",
+		.ops = &snd_audioinjector_pi_soundcard_ops,
+		.init = audioinjector_pi_soundcard_dai_init,
+		.dai_fmt = SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|SND_SOC_DAIFMT_NB_NF,
+	},
+};
+
+static const struct snd_soc_dapm_widget wm8731_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_SPK("Ext Spk", NULL),
+	SND_SOC_DAPM_LINE("Line In Jacks", NULL),
+	SND_SOC_DAPM_MIC("Microphone", NULL),
+};
+
+static const struct snd_soc_dapm_route audioinjector_audio_map[] = {
+	/* headphone connected to LHPOUT, RHPOUT */
+	{"Headphone Jack", NULL, "LHPOUT"},
+	{"Headphone Jack", NULL, "RHPOUT"},
+
+	/* speaker connected to LOUT, ROUT */
+	{"Ext Spk", NULL, "ROUT"},
+	{"Ext Spk", NULL, "LOUT"},
+
+	/* line inputs */
+	{"Line In Jacks", NULL, "Line Input"},
+
+	/* mic is connected to Mic Jack, with WM8731 Mic Bias */
+	{"Microphone", NULL, "Mic Bias"},
+};
+
+static struct snd_soc_card snd_soc_audioinjector = {
+	.name = "audioinjector-pi-soundcard",
+	.dai_link = audioinjector_pi_soundcard_dai,
+	.num_links = ARRAY_SIZE(audioinjector_pi_soundcard_dai),
+
+	.dapm_widgets = wm8731_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(wm8731_dapm_widgets),
+	.dapm_routes = audioinjector_audio_map,
+	.num_dapm_routes = ARRAY_SIZE(audioinjector_audio_map),
+};
+
+static int audioinjector_pi_soundcard_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_soc_audioinjector;
+	int ret;
+	
+	card->dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct snd_soc_dai_link *dai = &audioinjector_pi_soundcard_dai[0];
+		struct device_node *i2s_node = of_parse_phandle(pdev->dev.of_node,
+								"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		} else
+			if (!dai->cpu_of_node) {
+				dev_err(&pdev->dev, "Property 'i2s-controller' missing or invalid\n");
+				return -EINVAL;
+			}
+	}
+
+	if ((ret = devm_snd_soc_register_card(&pdev->dev, card))) {
+		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
+	}
+	return ret;
+}
+
+static const struct of_device_id audioinjector_pi_soundcard_of_match[] = {
+	{ .compatible = "ai,audioinjector-pi-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, audioinjector_pi_soundcard_of_match);
+
+static struct platform_driver audioinjector_pi_soundcard_driver = {
+       .driver         = {
+		.name   = "audioinjector-stereo",
+		.owner  = THIS_MODULE,
+		.of_match_table = audioinjector_pi_soundcard_of_match,
+       },
+       .probe          = audioinjector_pi_soundcard_probe,
+};
+
+module_platform_driver(audioinjector_pi_soundcard_driver);
+MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
+MODULE_DESCRIPTION("AudioInjector.net Pi Soundcard");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:audioinjector-pi-soundcard");
+
-- 
GitLab


From 16e895fec9b0ef44d1646a5694b2ffc547df6b7c Mon Sep 17 00:00:00 2001
From: escalator2015 <jmtasende@gmail.com>
Date: Tue, 24 May 2016 16:20:09 +0100
Subject: [PATCH 0073/1835] New driver for RRA DigiDAC1 soundcard using WM8741
 + WM8804

---
 sound/soc/bcm/digidac1-soundcard.c | 416 +++++++++++++++++++++++++++++
 1 file changed, 416 insertions(+)
 create mode 100644 sound/soc/bcm/digidac1-soundcard.c

diff --git a/sound/soc/bcm/digidac1-soundcard.c b/sound/soc/bcm/digidac1-soundcard.c
new file mode 100644
index 0000000000000..b99a0c858ebe7
--- /dev/null
+++ b/sound/soc/bcm/digidac1-soundcard.c
@@ -0,0 +1,416 @@
+/*
+ * ASoC Driver for RRA DigiDAC1
+ * Copyright 2016
+ * Author: José M. Tasende <vintage@redrocksaudio.es>
+ * based on the HifiBerry DAC driver by Florian Meier <florian.meier@koalo.de>
+ * and the Wolfson card driver by Nikesh Oswal, <Nikesh.Oswal@wolfsonmicro.com>
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <sound/soc-dapm.h>
+#include <sound/tlv.h>
+#include <linux/regulator/consumer.h>
+
+#include "../codecs/wm8804.h"
+#include "../codecs/wm8741.h"
+
+#define WM8741_NUM_SUPPLIES 2
+
+/* codec private data */
+struct wm8741_priv {
+	struct wm8741_platform_data pdata;
+	struct regmap *regmap;
+	struct regulator_bulk_data supplies[WM8741_NUM_SUPPLIES];
+	unsigned int sysclk;
+	const struct snd_pcm_hw_constraint_list *sysclk_constraints;
+};
+
+static int samplerate = 44100;
+
+/* New Alsa Controls not exposed by original wm8741 codec driver	*/
+/* in actual driver the att. adjustment is wrong because		*/
+/* this DAC has a coarse attenuation register with 4dB steps		*/
+/* and a fine level register with 0.125dB steps				*/
+/* each register has 32 steps so combining both we have	1024 steps	*/
+/* of 0.125 dB.								*/
+/* The original level controls from driver are removed at startup	*/
+/* and replaced by the corrected ones.					*/
+/* The same wm8741 driver can be used for wm8741 and wm8742 devices	*/
+
+static const DECLARE_TLV_DB_SCALE(dac_tlv_fine, 0, 13, 0);
+static const DECLARE_TLV_DB_SCALE(dac_tlv_coarse, -12700, 400, 1);
+static const char *w8741_dither[4] = {"Off", "RPDF", "TPDF", "HPDF"};
+static const char *w8741_filter[5] = {
+		"Type 1", "Type 2", "Type 3", "Type 4", "Type 5"};
+static const char *w8741_switch[2] = {"Off", "On"};
+static const struct soc_enum w8741_enum[] = {
+SOC_ENUM_SINGLE(WM8741_MODE_CONTROL_2, 0, 4, w8741_dither),/* dithering type */
+SOC_ENUM_SINGLE(WM8741_FILTER_CONTROL, 0, 5, w8741_filter),/* filter type */
+SOC_ENUM_SINGLE(WM8741_FORMAT_CONTROL, 6, 2, w8741_switch),/* phase invert */
+SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 0, 2, w8741_switch),/* volume ramp */
+SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 3, 2, w8741_switch),/* soft mute */
+};
+
+static const struct snd_kcontrol_new w8741_snd_controls_stereo[] = {
+SOC_DOUBLE_R_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
+		WM8741_DACRLSB_ATTENUATION, 0, 31, 1, dac_tlv_fine),
+SOC_DOUBLE_R_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
+		WM8741_DACRMSB_ATTENUATION, 0, 31, 1, dac_tlv_coarse),
+SOC_ENUM("DAC Dither", w8741_enum[0]),
+SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
+SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
+SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
+SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
+};
+
+static const struct snd_kcontrol_new w8741_snd_controls_mono_left[] = {
+SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
+		0, 31, 0, dac_tlv_fine),
+SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
+		0, 31, 1, dac_tlv_coarse),
+SOC_ENUM("DAC Dither", w8741_enum[0]),
+SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
+SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
+SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
+SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
+};
+
+static const struct snd_kcontrol_new w8741_snd_controls_mono_right[] = {
+SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACRLSB_ATTENUATION,
+	0, 31, 0, dac_tlv_fine),
+SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACRMSB_ATTENUATION,
+	0, 31, 1, dac_tlv_coarse),
+SOC_ENUM("DAC Dither", w8741_enum[0]),
+SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
+SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
+SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
+SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
+};
+
+static int w8741_add_controls(struct snd_soc_component *component)
+{
+	struct wm8741_priv *wm8741 = snd_soc_component_get_drvdata(component);
+
+	switch (wm8741->pdata.diff_mode) {
+	case WM8741_DIFF_MODE_STEREO:
+	case WM8741_DIFF_MODE_STEREO_REVERSED:
+		snd_soc_add_component_controls(component,
+				w8741_snd_controls_stereo,
+				ARRAY_SIZE(w8741_snd_controls_stereo));
+		break;
+	case WM8741_DIFF_MODE_MONO_LEFT:
+		snd_soc_add_component_controls(component,
+				w8741_snd_controls_mono_left,
+				ARRAY_SIZE(w8741_snd_controls_mono_left));
+		break;
+	case WM8741_DIFF_MODE_MONO_RIGHT:
+		snd_soc_add_component_controls(component,
+				w8741_snd_controls_mono_right,
+				ARRAY_SIZE(w8741_snd_controls_mono_right));
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int digidac1_soundcard_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_pcm_runtime *wm8741_rtd;
+	struct snd_soc_component *wm8741_component;
+	struct snd_card *sound_card = card->snd_card;
+	struct snd_kcontrol *kctl;
+	int ret;
+
+	wm8741_rtd = snd_soc_get_pcm_runtime(card, card->dai_link[1].name);
+	if (!wm8741_rtd) {
+		dev_warn(card->dev, "digidac1_soundcard_init: couldn't get wm8741 rtd\n");
+		return -EFAULT;
+	}
+	wm8741_component = wm8741_rtd->codec_dai->component;
+	ret = w8741_add_controls(wm8741_component);
+	if (ret < 0)
+		dev_warn(card->dev, "Failed to add new wm8741 controls: %d\n",
+		ret);
+
+	/* enable TX output */
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
+
+	kctl = snd_soc_card_get_kcontrol(card,
+		"Playback Volume");
+	if (kctl) {
+		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
+		snd_ctl_remove(sound_card, kctl);
+		}
+	kctl = snd_soc_card_get_kcontrol(card,
+		"Fine Playback Volume");
+	if (kctl) {
+		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
+		snd_ctl_remove(sound_card, kctl);
+		}
+	return 0;
+}
+
+static int digidac1_soundcard_startup(struct snd_pcm_substream *substream)
+{
+	/* turn on wm8804 digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_pcm_runtime *wm8741_rtd;
+	struct snd_soc_component *wm8741_component;
+
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x00);
+	wm8741_rtd = snd_soc_get_pcm_runtime(card, card->dai_link[1].name);
+	if (!wm8741_rtd) {
+		dev_warn(card->dev, "digidac1_soundcard_startup: couldn't get WM8741 rtd\n");
+		return -EFAULT;
+	}
+	wm8741_component = wm8741_rtd->codec_dai->component;
+
+	/* latch wm8741 level */
+	snd_soc_component_update_bits(wm8741_component, WM8741_DACLLSB_ATTENUATION,
+		WM8741_UPDATELL, WM8741_UPDATELL);
+	snd_soc_component_update_bits(wm8741_component, WM8741_DACLMSB_ATTENUATION,
+		WM8741_UPDATELM, WM8741_UPDATELM);
+	snd_soc_component_update_bits(wm8741_component, WM8741_DACRLSB_ATTENUATION,
+		WM8741_UPDATERL, WM8741_UPDATERL);
+	snd_soc_component_update_bits(wm8741_component, WM8741_DACRMSB_ATTENUATION,
+		WM8741_UPDATERM, WM8741_UPDATERM);
+
+	return 0;
+}
+
+static void digidac1_soundcard_shutdown(struct snd_pcm_substream *substream)
+{
+	/* turn off wm8804 digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x3c);
+}
+
+static int digidac1_soundcard_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_pcm_runtime *wm8741_rtd;
+	struct snd_soc_component *wm8741_component;
+
+	int sysclk = 27000000;
+	long mclk_freq = 0;
+	int mclk_div = 1;
+	int sampling_freq = 1;
+	int ret;
+
+	wm8741_rtd = snd_soc_get_pcm_runtime(card, card->dai_link[1].name);
+	if (!wm8741_rtd) {
+		dev_warn(card->dev, "digidac1_soundcard_hw_params: couldn't get WM8741 rtd\n");
+		return -EFAULT;
+	}
+	wm8741_component = wm8741_rtd->codec_dai->component;
+	samplerate = params_rate(params);
+
+	if (samplerate <= 96000) {
+		mclk_freq = samplerate*256;
+		mclk_div = WM8804_MCLKDIV_256FS;
+	} else {
+		mclk_freq = samplerate*128;
+		mclk_div = WM8804_MCLKDIV_128FS;
+		}
+
+	switch (samplerate) {
+	case 32000:
+		sampling_freq = 0x03;
+		break;
+	case 44100:
+		sampling_freq = 0x00;
+		break;
+	case 48000:
+		sampling_freq = 0x02;
+		break;
+	case 88200:
+		sampling_freq = 0x08;
+		break;
+	case 96000:
+		sampling_freq = 0x0a;
+		break;
+	case 176400:
+		sampling_freq = 0x0c;
+		break;
+	case 192000:
+		sampling_freq = 0x0e;
+		break;
+	default:
+		dev_err(card->dev,
+		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+		samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+		sysclk, SND_SOC_CLOCK_OUT);
+	if (ret < 0) {
+		dev_err(card->dev,
+		"Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+	/* Enable wm8804 TX output */
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
+
+	/* wm8804 Power on */
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x9, 0);
+
+	/* wm8804 set sampling frequency status bits */
+	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f, sampling_freq);
+
+	/* Now update wm8741 registers for the correct oversampling */
+	if (samplerate <= 48000)
+		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
+		 WM8741_OSR_MASK, 0x00);
+	else if (samplerate <= 96000)
+		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
+		 WM8741_OSR_MASK, 0x20);
+	else
+		snd_soc_component_update_bits(wm8741_component, WM8741_MODE_CONTROL_1,
+		 WM8741_OSR_MASK, 0x40);
+
+	/* wm8741 bit size */
+	switch (params_width(params)) {
+	case 16:
+		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x00);
+		break;
+	case 20:
+		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x01);
+		break;
+	case 24:
+		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x02);
+		break;
+	case 32:
+		snd_soc_component_update_bits(wm8741_component, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x03);
+		break;
+	default:
+		dev_dbg(card->dev, "wm8741_hw_params:    Unsupported bit size param = %d",
+			params_width(params));
+		return -EINVAL;
+	}
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+}
+/* machine stream operations */
+static struct snd_soc_ops digidac1_soundcard_ops = {
+	.hw_params	= digidac1_soundcard_hw_params,
+	.startup	= digidac1_soundcard_startup,
+	.shutdown	= digidac1_soundcard_shutdown,
+};
+
+static struct snd_soc_dai_link digidac1_soundcard_dai[] = {
+	{
+	.name		= "RRA DigiDAC1",
+	.stream_name	= "RRA DigiDAC1 HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8804-spdif",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8804.1-003b",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &digidac1_soundcard_ops,
+	.init		= digidac1_soundcard_init,
+	},
+	{
+	.name		= "RRA DigiDAC11",
+	.stream_name	= "RRA DigiDAC11 HiFi",
+	.cpu_dai_name	= "wm8804-spdif",
+	.codec_dai_name	= "wm8741",
+	.codec_name	= "wm8741.1-001a",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S
+			| SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBS_CFS,
+	},
+};
+
+/* audio machine driver */
+static struct snd_soc_card digidac1_soundcard = {
+	.name		= "digidac1-soundcard",
+	.owner		= THIS_MODULE,
+	.dai_link	= digidac1_soundcard_dai,
+	.num_links	= ARRAY_SIZE(digidac1_soundcard_dai),
+};
+
+static int digidac1_soundcard_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	digidac1_soundcard.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &digidac1_soundcard_dai[0];
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &digidac1_soundcard);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static const struct of_device_id digidac1_soundcard_of_match[] = {
+	{ .compatible = "rra,digidac1-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, digidac1_soundcard_of_match);
+
+static struct platform_driver digidac1_soundcard_driver = {
+	.driver = {
+			.name		= "digidac1-audio",
+			.owner		= THIS_MODULE,
+			.of_match_table	= digidac1_soundcard_of_match,
+	},
+	.probe		= digidac1_soundcard_probe,
+};
+
+module_platform_driver(digidac1_soundcard_driver);
+
+MODULE_AUTHOR("José M. Tasende <vintage@redrocksaudio.es>");
+MODULE_DESCRIPTION("ASoC Driver for RRA DigiDAC1");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From e7f33bceae923476f2239d197b13c6d99c3cb704 Mon Sep 17 00:00:00 2001
From: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
Date: Sat, 2 Jul 2016 16:26:19 +0100
Subject: [PATCH 0074/1835] Add support for Dion Audio LOCO DAC-AMP HAT

Using dedicated machine driver and pcm5102a codec driver.

Signed-off-by: DigitalDreamtime <clive.messer@digitaldreamtime.co.uk>
---
 sound/soc/bcm/dionaudio_loco.c | 115 +++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 sound/soc/bcm/dionaudio_loco.c

diff --git a/sound/soc/bcm/dionaudio_loco.c b/sound/soc/bcm/dionaudio_loco.c
new file mode 100644
index 0000000000000..5f786436f90e1
--- /dev/null
+++ b/sound/soc/bcm/dionaudio_loco.c
@@ -0,0 +1,115 @@
+/*
+ * ASoC Driver for Dion Audio LOCO DAC-AMP
+ *
+ * Author:      Miquel Blauw <info@dionaudio.nl>
+ *              Copyright 2016
+ *
+ * Based on the software of the RPi-DAC writen by Florian Meier
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static int snd_rpi_dionaudio_loco_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	unsigned int sample_bits =
+		snd_pcm_format_physical_width(params_format(params));
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_dionaudio_loco_ops = {
+	.hw_params = snd_rpi_dionaudio_loco_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_dionaudio_loco_dai[] = {
+{
+	.name		= "DionAudio LOCO",
+	.stream_name	= "DionAudio LOCO DAC-AMP",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm5102a-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm5102a-codec",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_dionaudio_loco_ops,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_dionaudio_loco = {
+	.name		= "snd_rpi_dionaudio_loco",
+	.dai_link	= snd_rpi_dionaudio_loco_dai,
+	.num_links	= ARRAY_SIZE(snd_rpi_dionaudio_loco_dai),
+};
+
+static int snd_rpi_dionaudio_loco_probe(struct platform_device *pdev)
+{
+	struct device_node *np;
+	int ret = 0;
+
+	snd_rpi_dionaudio_loco.dev = &pdev->dev;
+
+	np = pdev->dev.of_node;
+	if (np) {
+		struct snd_soc_dai_link *dai = &snd_rpi_dionaudio_loco_dai[0];
+		struct device_node *i2s_np;
+
+		i2s_np = of_parse_phandle(np, "i2s-controller", 0);
+		if (i2s_np) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_np;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_np;
+		}
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_dionaudio_loco);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_rpi_dionaudio_loco_of_match[] = {
+	{ .compatible = "dionaudio,loco-pcm5242-tpa3118", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_dionaudio_loco_of_match);
+
+static struct platform_driver snd_rpi_dionaudio_loco_driver = {
+	.driver = {
+		.name		= "snd-dionaudio-loco",
+		.owner		= THIS_MODULE,
+		.of_match_table	= snd_rpi_dionaudio_loco_of_match,
+	},
+	.probe  = snd_rpi_dionaudio_loco_probe,
+};
+
+module_platform_driver(snd_rpi_dionaudio_loco_driver);
+
+MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
+MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 4cea0f03fc9854b8688bcae6e74395fd5615fb5e Mon Sep 17 00:00:00 2001
From: Clive Messer <clive.m.messer@gmail.com>
Date: Mon, 19 Sep 2016 14:01:04 +0100
Subject: [PATCH 0075/1835] Allo Piano DAC boards: Initial 2 channel (stereo)
 support (#1645)

Add initial 2 channel (stereo) support for Allo Piano DAC (2.0/2.1) boards,
using allo-piano-dac-pcm512x-audio overlay and allo-piano-dac ALSA ASoC
machine driver.

NB. The initial support is 2 channel (stereo) ONLY!
(The Piano DAC 2.1 will only support 2 channel (stereo) left/right output,
 pending an update to the upstream pcm512x codec driver, which will have
 to be submitted via upstream. With the initial downstream support,
 provided by this patch, the Piano DAC 2.1 subwoofer outputs will
 not function.)

Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Signed-off-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>
Tested-by: Clive Messer <clive.messer@digitaldreamtime.co.uk>

ASoC: allo-piano-dac: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Also remove hw_params and ops as they are no longer needed.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/allo-piano-dac.c | 120 +++++++++++++++++++++++++++++++++
 1 file changed, 120 insertions(+)
 create mode 100644 sound/soc/bcm/allo-piano-dac.c

diff --git a/sound/soc/bcm/allo-piano-dac.c b/sound/soc/bcm/allo-piano-dac.c
new file mode 100644
index 0000000000000..df5831763aa45
--- /dev/null
+++ b/sound/soc/bcm/allo-piano-dac.c
@@ -0,0 +1,120 @@
+/*
+ * ALSA ASoC Machine Driver for Allo Piano DAC
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+static bool digital_gain_0db_limit = true;
+
+static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
+					   207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				 ret);
+	}
+
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
+{
+	.name		= "Piano DAC",
+	.stream_name	= "Piano DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004c",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.init		= snd_allo_piano_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_piano_dac = {
+	.name         = "PianoDAC",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_allo_piano_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_allo_piano_dac_dai),
+};
+
+static int snd_allo_piano_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_allo_piano_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_allo_piano_dac_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "allo,24db_digital_gain");
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_allo_piano_dac);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_allo_piano_dac_of_match[] = {
+	{ .compatible = "allo,piano-dac", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
+
+static struct platform_driver snd_allo_piano_dac_driver = {
+	.driver = {
+		.name   = "snd-allo-piano-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_allo_piano_dac_of_match,
+	},
+	.probe          = snd_allo_piano_dac_probe,
+};
+
+module_platform_driver(snd_allo_piano_dac_driver);
+
+MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From cbb7f4cb5897bac38906d5aa64643e5f17dddd6e Mon Sep 17 00:00:00 2001
From: Raashid Muhammed <raashidmuhammed@zilogic.com>
Date: Mon, 27 Mar 2017 12:35:00 +0530
Subject: [PATCH 0076/1835] Add support for Allo Piano DAC 2.1 plus add-on
 board for Raspberry Pi.

The Piano DAC 2.1 has support for 4 channels with subwoofer.

Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>

Add clock changes and mute gpios (#1938)

Also improve code style and adhere to ALSA coding conventions.

Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Vijay Kumar B. <vijaykumar@zilogic.com>
Reviewed-by: Raashid Muhammed <raashidmuhammed@zilogic.com>

PianoPlus: Dual Mono & Dual Stereo features added (#2069)

allo-piano-dac-plus: Master volume added + fixes

Master volume added, which controls both DACs volumes.

See: https://github.com/raspberrypi/linux/pull/2149

Also fix initial max volume, default mode value, and unmute.

Signed-off-by: allocom <sparky-dev@allo.com>

ASoC: allo-piano-dac-plus: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/allo-piano-dac-plus.c | 1011 +++++++++++++++++++++++++++
 1 file changed, 1011 insertions(+)
 create mode 100644 sound/soc/bcm/allo-piano-dac-plus.c

diff --git a/sound/soc/bcm/allo-piano-dac-plus.c b/sound/soc/bcm/allo-piano-dac-plus.c
new file mode 100644
index 0000000000000..d35e0553a7634
--- /dev/null
+++ b/sound/soc/bcm/allo-piano-dac-plus.c
@@ -0,0 +1,1011 @@
+/*
+ * ALSA ASoC Machine Driver for Allo Piano DAC Plus Subwoofer
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/gpio/consumer.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <sound/tlv.h>
+#include "../codecs/pcm512x.h"
+
+#define P_DAC_LEFT_MUTE		0x10
+#define P_DAC_RIGHT_MUTE	0x01
+#define P_DAC_MUTE		0x11
+#define P_DAC_UNMUTE		0x00
+#define P_MUTE			1
+#define P_UNMUTE		0
+
+struct dsp_code {
+	char i2c_addr;
+	char offset;
+	char val;
+};
+
+struct glb_pool {
+	struct mutex lock;
+	unsigned int dual_mode;
+	unsigned int set_lowpass;
+	unsigned int set_mode;
+	unsigned int set_rate;
+	unsigned int dsp_page_number;
+};
+
+static bool digital_gain_0db_limit = true;
+bool glb_mclk;
+
+static struct gpio_desc *mute_gpio[2];
+
+static const char * const allo_piano_mode_texts[] = {
+	"None",
+	"2.0",
+	"2.1",
+	"2.2",
+};
+
+static const SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
+		0, 0, allo_piano_mode_texts);
+
+static const char * const allo_piano_dual_mode_texts[] = {
+	"None",
+	"Dual-Mono",
+	"Dual-Stereo",
+};
+
+static const SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
+		0, 0, allo_piano_dual_mode_texts);
+
+static const char * const allo_piano_dsp_low_pass_texts[] = {
+	"60",
+	"70",
+	"80",
+	"90",
+	"100",
+	"110",
+	"120",
+	"130",
+	"140",
+	"150",
+	"160",
+	"170",
+	"180",
+	"190",
+	"200",
+};
+
+static const SOC_ENUM_SINGLE_DECL(allo_piano_enum,
+		0, 0, allo_piano_dsp_low_pass_texts);
+
+static int __snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
+		unsigned int mode, unsigned int rate, unsigned int lowpass)
+{
+	const struct firmware *fw;
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr = card->drvdata;
+	char firmware_name[60];
+	int ret = 0, dac = 0;
+
+	if (rate <= 46000)
+		rate = 44100;
+	else if (rate <= 68000)
+		rate = 48000;
+	else if (rate <= 92000)
+		rate = 88200;
+	else if (rate <= 136000)
+		rate = 96000;
+	else if (rate <= 184000)
+		rate = 176400;
+	else
+		rate = 192000;
+
+	if (lowpass > 14)
+		glb_ptr->set_lowpass = lowpass = 0;
+
+	if (mode > 3)
+		glb_ptr->set_mode = mode = 0;
+
+	if (mode > 0)
+		glb_ptr->dual_mode = 0;
+
+	/* same configuration loaded */
+	if ((rate == glb_ptr->set_rate) && (lowpass == glb_ptr->set_lowpass)
+			&& (mode == glb_ptr->set_mode))
+		return 0;
+
+	switch (mode) {
+	case 0: /* None */
+		return 1;
+
+	case 1: /* 2.0 */
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_MUTE, P_DAC_MUTE);
+		glb_ptr->set_rate = rate;
+		glb_ptr->set_mode = mode;
+		glb_ptr->set_lowpass = lowpass;
+		return 1;
+
+	default:
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+	}
+
+	for (dac = 0; dac < rtd->num_codecs; dac++) {
+		struct dsp_code *dsp_code_read;
+		int i = 1;
+
+		if (dac == 0) { /* high */
+			snprintf(firmware_name, sizeof(firmware_name),
+				"allo/piano/2.2/allo-piano-dsp-%d-%d-%d.bin",
+				rate, ((lowpass * 10) + 60), dac);
+		} else { /* low */
+			snprintf(firmware_name, sizeof(firmware_name),
+				"allo/piano/2.%d/allo-piano-dsp-%d-%d-%d.bin",
+				(mode - 1), rate, ((lowpass * 10) + 60), dac);
+		}
+
+		dev_info(rtd->card->dev, "Dsp Firmware File Name: %s\n",
+				firmware_name);
+
+		ret = request_firmware(&fw, firmware_name, rtd->card->dev);
+		if (ret < 0) {
+			dev_err(rtd->card->dev,
+				"Error: Allo Piano Firmware %s missing. %d\n",
+				firmware_name, ret);
+			goto err;
+		}
+
+		while (i < (fw->size - 1)) {
+			dsp_code_read = (struct dsp_code *)&fw->data[i];
+
+			if (dsp_code_read->offset == 0) {
+				glb_ptr->dsp_page_number = dsp_code_read->val;
+				ret = snd_soc_component_write(rtd->codec_dais[dac]->component,
+						PCM512x_PAGE_BASE(0),
+						dsp_code_read->val);
+
+			} else if (dsp_code_read->offset != 0) {
+				ret = snd_soc_component_write(rtd->codec_dais[dac]->component,
+					(PCM512x_PAGE_BASE(
+						glb_ptr->dsp_page_number) +
+					dsp_code_read->offset),
+					dsp_code_read->val);
+			}
+			if (ret < 0) {
+				dev_err(rtd->card->dev,
+					"Failed to write Register: %d\n", ret);
+				release_firmware(fw);
+				goto err;
+			}
+			i = i + 3;
+		}
+		release_firmware(fw);
+	}
+	glb_ptr->set_rate = rate;
+	glb_ptr->set_mode = mode;
+	glb_ptr->set_lowpass = lowpass;
+	return 1;
+
+err:
+	return ret;
+}
+
+static int snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
+		unsigned int mode, unsigned int rate, unsigned int lowpass)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr = card->drvdata;
+	int ret = 0;
+
+	mutex_lock(&glb_ptr->lock);
+
+	ret = __snd_allo_piano_dsp_program(rtd, mode, rate, lowpass);
+
+	mutex_unlock(&glb_ptr->lock);
+
+	return ret;
+}
+
+static int snd_allo_piano_dual_mode_get(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	ucontrol->value.integer.value[0] = glb_ptr->dual_mode;
+
+	return 0;
+}
+
+static int snd_allo_piano_dual_mode_put(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_card *snd_card_ptr = card->snd_card;
+	struct snd_kcontrol *kctl;
+	struct soc_mixer_control *mc;
+	unsigned int left_val = 0, right_val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	if (ucontrol->value.integer.value[0] > 0) {
+		glb_ptr->dual_mode = ucontrol->value.integer.value[0];
+		glb_ptr->set_mode = 0;
+	} else {
+		if (glb_ptr->set_mode <= 0) {
+			glb_ptr->dual_mode = 1;
+			glb_ptr->set_mode = 0;
+		} else {
+			glb_ptr->dual_mode = 0;
+			return 0;
+		}
+	}
+
+	if (glb_ptr->dual_mode == 1) { // Dual Mono
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_MUTE, P_DAC_RIGHT_MUTE);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_MUTE, P_DAC_LEFT_MUTE);
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_DIGITAL_VOLUME_3, 0xff);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_2, 0xff);
+
+		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
+			if (!strncmp(kctl->id.name, "Digital Playback Volume",
+					sizeof(kctl->id.name))) {
+				mc = (struct soc_mixer_control *)
+					kctl->private_value;
+				mc->rreg = mc->reg;
+				break;
+			}
+		}
+	} else {
+		snd_soc_component_read(rtd->codec_dais[0]->component,
+						PCM512x_DIGITAL_VOLUME_2, &left_val);
+		snd_soc_component_read(rtd->codec_dais[1]->component,
+						PCM512x_DIGITAL_VOLUME_3, &right_val);
+
+		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
+			if (!strncmp(kctl->id.name, "Digital Playback Volume",
+					sizeof(kctl->id.name))) {
+				mc = (struct soc_mixer_control *)
+					kctl->private_value;
+				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
+				break;
+			}
+		}
+
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_DIGITAL_VOLUME_3, left_val);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_2, right_val);
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+	}
+
+	return 0;
+}
+
+static int snd_allo_piano_mode_get(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	ucontrol->value.integer.value[0] = glb_ptr->set_mode;
+	return 0;
+}
+
+static int snd_allo_piano_mode_put(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_card *snd_card_ptr = card->snd_card;
+	struct snd_kcontrol *kctl;
+	struct soc_mixer_control *mc;
+	unsigned int left_val = 0, right_val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	if ((glb_ptr->dual_mode == 1) &&
+			(ucontrol->value.integer.value[0] > 0)) {
+		snd_soc_component_read(rtd->codec_dais[0]->component,
+						PCM512x_DIGITAL_VOLUME_2, &left_val);
+		snd_soc_component_read(rtd->codec_dais[1]->component,
+						PCM512x_DIGITAL_VOLUME_2, &right_val);
+
+		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
+			if (!strncmp(kctl->id.name, "Digital Playback Volume",
+					sizeof(kctl->id.name))) {
+				mc = (struct soc_mixer_control *)
+					kctl->private_value;
+				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
+				break;
+			}
+		}
+		snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_DIGITAL_VOLUME_3, left_val);
+		snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_3, right_val);
+	}
+
+	return(snd_allo_piano_dsp_program(rtd,
+				ucontrol->value.integer.value[0],
+				glb_ptr->set_rate, glb_ptr->set_lowpass));
+}
+
+static int snd_allo_piano_lowpass_get(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	ucontrol->value.integer.value[0] = glb_ptr->set_lowpass;
+	return 0;
+}
+
+static int snd_allo_piano_lowpass_put(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	return(snd_allo_piano_dsp_program(rtd,
+				glb_ptr->set_mode, glb_ptr->set_rate,
+				ucontrol->value.integer.value[0]));
+}
+
+static int pcm512x_get_reg_sub(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = 0;
+	unsigned int right_val = 0;
+	int ret;
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	ret = snd_soc_component_read(rtd->codec_dais[1]->component,
+			PCM512x_DIGITAL_VOLUME_3, &right_val);
+	if (ret < 0)
+		return ret;
+
+	if (glb_ptr->dual_mode != 1) {
+		ret = snd_soc_component_read(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_2, &left_val);
+		if ( ret < 0)
+			return ret;
+
+	} else {
+		left_val = right_val;
+	}
+
+	ucontrol->value.integer.value[0] =
+				(~(left_val >> mc->shift)) & mc->max;
+	ucontrol->value.integer.value[1] =
+				(~(right_val >> mc->shift)) & mc->max;
+
+	return 0;
+}
+
+static int pcm512x_set_reg_sub(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
+	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (glb_ptr->dual_mode != 1) {
+		ret = snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_2, (~left_val));
+		if (ret < 0)
+			return ret;
+	}
+
+	if (digital_gain_0db_limit) {
+		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
+					207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				ret);
+	}
+
+	ret = snd_soc_component_write(rtd->codec_dais[1]->component,
+			PCM512x_DIGITAL_VOLUME_3, (~right_val));
+	if (ret < 0)
+		return ret;
+
+	return 1;
+}
+
+static int pcm512x_get_reg_sub_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	int val = 0;
+	int ret;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	ret = snd_soc_component_read(rtd->codec_dais[1]->component, PCM512x_MUTE, &val);
+	if (ret < 0)
+		return ret;
+
+	ucontrol->value.integer.value[0] =
+			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
+	ucontrol->value.integer.value[1] =
+			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
+
+	return val;
+}
+
+static int pcm512x_set_reg_sub_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+	unsigned int left_val = (ucontrol->value.integer.value[0]);
+	unsigned int right_val = (ucontrol->value.integer.value[1]);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (glb_ptr->set_mode != 1) {
+		ret = snd_soc_component_write(rtd->codec_dais[1]->component, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+	}
+	return 1;
+
+}
+
+static int pcm512x_get_reg_master(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = 0, right_val = 0;
+	int ret;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	ret = snd_soc_component_read(rtd->codec_dais[0]->component,
+			PCM512x_DIGITAL_VOLUME_2, &left_val);
+	if ( ret < 0)
+		return ret;
+
+	if (glb_ptr->dual_mode == 1) {
+		ret = snd_soc_component_read(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_3, &right_val);
+		if (ret < 0)
+			return ret;
+	} else {
+		ret = snd_soc_component_read(rtd->codec_dais[0]->component,
+				PCM512x_DIGITAL_VOLUME_3, &right_val);
+		if (ret < 0)
+			return ret;
+	}
+
+	ucontrol->value.integer.value[0] =
+		(~(left_val  >> mc->shift)) & mc->max;
+	ucontrol->value.integer.value[1] =
+		(~(right_val >> mc->shift)) & mc->max;
+
+	return 0;
+}
+
+static int pcm512x_set_reg_master(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
+	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	if (digital_gain_0db_limit) {
+		ret = snd_soc_limit_volume(card, "Master Playback Volume",
+					207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				ret);
+	}
+
+	if (glb_ptr->dual_mode != 1) {
+		ret = snd_soc_component_write(rtd->codec_dais[1]->component,
+				PCM512x_DIGITAL_VOLUME_2, (~left_val));
+		if (ret < 0)
+			return ret;
+
+		ret = snd_soc_component_write(rtd->codec_dais[0]->component,
+				PCM512x_DIGITAL_VOLUME_3, (~right_val));
+		if (ret < 0)
+			return ret;
+
+	}
+
+	ret = snd_soc_component_write(rtd->codec_dais[1]->component,
+			PCM512x_DIGITAL_VOLUME_3, (~right_val));
+	if (ret < 0)
+		return ret;
+
+	ret = snd_soc_component_write(rtd->codec_dais[0]->component,
+			PCM512x_DIGITAL_VOLUME_2, (~left_val));
+	if (ret < 0)
+		return ret;
+	return 1;
+}
+
+static int pcm512x_get_reg_master_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	int val = 0;
+	int ret;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	ret = snd_soc_component_read(rtd->codec_dais[0]->component, PCM512x_MUTE, &val);
+	if (ret < 0)
+		return ret;
+
+	ucontrol->value.integer.value[0] =
+			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
+
+	if (glb_ptr->dual_mode == 1) {
+		ret = snd_soc_component_read(rtd->codec_dais[1]->component, PCM512x_MUTE, &val);
+		if (ret < 0)
+			return ret;
+	}
+	ucontrol->value.integer.value[1] =
+			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
+
+	return val;
+}
+
+static int pcm512x_set_reg_master_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+	unsigned int left_val = (ucontrol->value.integer.value[0]);
+	unsigned int right_val = (ucontrol->value.integer.value[1]);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (glb_ptr->dual_mode == 1) {
+		ret = snd_soc_component_write(rtd->codec_dais[0]->component, PCM512x_MUTE,
+				~((left_val & 0x01)<<4));
+		if (ret < 0)
+			return ret;
+		ret = snd_soc_component_write(rtd->codec_dais[1]->component, PCM512x_MUTE,
+				~((right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+
+	} else if (glb_ptr->set_mode == 1) {
+		ret = snd_soc_component_write(rtd->codec_dais[0]->component, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+
+	} else {
+		ret = snd_soc_component_write(rtd->codec_dais[0]->component, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+
+		ret = snd_soc_component_write(rtd->codec_dais[1]->component, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+	}
+	return 1;
+}
+
+static const DECLARE_TLV_DB_SCALE(digital_tlv_sub, -10350, 50, 1);
+static const DECLARE_TLV_DB_SCALE(digital_tlv_master, -10350, 50, 1);
+
+static const struct snd_kcontrol_new allo_piano_controls[] = {
+	SOC_ENUM_EXT("Subwoofer mode Route",
+			allo_piano_mode_enum,
+			snd_allo_piano_mode_get,
+			snd_allo_piano_mode_put),
+
+	SOC_ENUM_EXT("Dual Mode Route",
+			allo_piano_dual_mode_enum,
+			snd_allo_piano_dual_mode_get,
+			snd_allo_piano_dual_mode_put),
+
+	SOC_ENUM_EXT("Lowpass Route", allo_piano_enum,
+			snd_allo_piano_lowpass_get,
+			snd_allo_piano_lowpass_put),
+
+	SOC_DOUBLE_R_EXT_TLV("Subwoofer Playback Volume",
+			PCM512x_DIGITAL_VOLUME_2,
+			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
+			pcm512x_get_reg_sub,
+			pcm512x_set_reg_sub,
+			digital_tlv_sub),
+
+	SOC_DOUBLE_EXT("Subwoofer Playback Switch",
+			PCM512x_MUTE,
+			PCM512x_RQML_SHIFT,
+			PCM512x_RQMR_SHIFT, 1, 1,
+			pcm512x_get_reg_sub_switch,
+			pcm512x_set_reg_sub_switch),
+
+	SOC_DOUBLE_R_EXT_TLV("Master Playback Volume",
+			PCM512x_DIGITAL_VOLUME_2,
+			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
+			pcm512x_get_reg_master,
+			pcm512x_set_reg_master,
+			digital_tlv_master),
+
+	SOC_DOUBLE_EXT("Master Playback Switch",
+			PCM512x_MUTE,
+			PCM512x_RQML_SHIFT,
+			PCM512x_RQMR_SHIFT, 1, 1,
+			pcm512x_get_reg_master_switch,
+			pcm512x_set_reg_master_switch),
+};
+
+static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr;
+
+	glb_ptr = kmalloc(sizeof(struct glb_pool), GFP_KERNEL);
+	if (!glb_ptr)
+		return -ENOMEM;
+
+	memset(glb_ptr, 0x00, sizeof(glb_ptr));
+	card->drvdata = glb_ptr;
+	glb_ptr->dual_mode = 2;
+	glb_ptr->set_mode = 0;
+
+	mutex_init(&glb_ptr->lock);
+
+	if (digital_gain_0db_limit) {
+		int ret;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
+					207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				ret);
+	}
+	return 0;
+}
+
+static void snd_allo_piano_gpio_mute(struct snd_soc_card *card)
+{
+	if (mute_gpio[0])
+		gpiod_set_value_cansleep(mute_gpio[0], P_MUTE);
+
+	if (mute_gpio[1])
+		gpiod_set_value_cansleep(mute_gpio[1], P_MUTE);
+}
+
+static void snd_allo_piano_gpio_unmute(struct snd_soc_card *card)
+{
+	if (mute_gpio[0])
+		gpiod_set_value_cansleep(mute_gpio[0], P_UNMUTE);
+
+	if (mute_gpio[1])
+		gpiod_set_value_cansleep(mute_gpio[1], P_UNMUTE);
+}
+
+static int snd_allo_piano_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *codec_dai;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	codec_dai = rtd->codec_dai;
+
+	if (dapm->dev != codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
+			break;
+		/* UNMUTE DAC */
+		snd_allo_piano_gpio_unmute(card);
+		break;
+
+	case SND_SOC_BIAS_STANDBY:
+		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
+			break;
+		/* MUTE DAC */
+		snd_allo_piano_gpio_mute(card);
+		break;
+
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int snd_allo_piano_dac_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_allo_piano_gpio_mute(card);
+
+	return 0;
+}
+
+static int snd_allo_piano_dac_hw_params(
+		struct snd_pcm_substream *substream,
+		struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	unsigned int rate = params_rate(params);
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr = card->drvdata;
+	int ret = 0, val = 0, dac;
+
+	for (dac = 0; (glb_mclk && dac < 2); dac++) {
+		/* Configure the PLL clock reference for both the Codecs */
+		ret = snd_soc_component_read(rtd->codec_dais[dac]->component,
+					PCM512x_RATE_DET_4, &val);
+		if (ret < 0) {
+			dev_err(rtd->codec_dais[dac]->component->dev,
+				"Failed to read register PCM512x_RATE_DET_4\n");
+			return ret;
+		}
+
+		if (val & 0x40) {
+			snd_soc_component_write(rtd->codec_dais[dac]->component,
+					PCM512x_PLL_REF,
+					PCM512x_SREF_BCK);
+
+			dev_info(rtd->codec_dais[dac]->component->dev,
+				"Setting BCLK as input clock & Enable PLL\n");
+		} else {
+			snd_soc_component_write(rtd->codec_dais[dac]->component,
+					PCM512x_PLL_EN,
+					0x00);
+
+			snd_soc_component_write(rtd->codec_dais[dac]->component,
+					PCM512x_PLL_REF,
+					PCM512x_SREF_SCK);
+
+			dev_info(rtd->codec_dais[dac]->component->dev,
+				"Setting SCLK as input clock & disabled PLL\n");
+		}
+	}
+
+	ret = snd_allo_piano_dsp_program(rtd, glb_ptr->set_mode, rate,
+						glb_ptr->set_lowpass);
+	if (ret < 0)
+		return ret;
+
+	return ret;
+}
+
+static int snd_allo_piano_dac_prepare(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_allo_piano_gpio_unmute(card);
+
+	return 0;
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_allo_piano_dac_ops = {
+	.startup = snd_allo_piano_dac_startup,
+	.hw_params = snd_allo_piano_dac_hw_params,
+	.prepare = snd_allo_piano_dac_prepare,
+};
+
+static struct snd_soc_dai_link_component allo_piano_2_1_codecs[] = {
+	{
+		.dai_name = "pcm512x-hifi",
+	},
+	{
+		.dai_name = "pcm512x-hifi",
+	},
+};
+
+static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
+	{
+		.name		= "PianoDACPlus",
+		.stream_name	= "PianoDACPlus",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.platform_name	= "bcm2708-i2s.0",
+		.codecs		= allo_piano_2_1_codecs,
+		.num_codecs	= 2,
+		.dai_fmt	= SND_SOC_DAIFMT_I2S |
+				SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+		.ops		= &snd_allo_piano_dac_ops,
+		.init		= snd_allo_piano_dac_init,
+	},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_piano_dac = {
+	.name = "PianoDACPlus",
+	.owner = THIS_MODULE,
+	.dai_link = snd_allo_piano_dac_dai,
+	.num_links = ARRAY_SIZE(snd_allo_piano_dac_dai),
+	.controls = allo_piano_controls,
+	.num_controls = ARRAY_SIZE(allo_piano_controls),
+};
+
+static int snd_allo_piano_dac_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_allo_piano_dac;
+	int ret = 0, i = 0;
+
+	card->dev = &pdev->dev;
+	platform_set_drvdata(pdev, &snd_allo_piano_dac);
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_allo_piano_dac_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+						"i2s-controller", 0);
+		if (i2s_node) {
+			for (i = 0; i < card->num_links; i++) {
+				dai->cpu_dai_name = NULL;
+				dai->cpu_of_node = i2s_node;
+				dai->platform_name = NULL;
+				dai->platform_of_node = i2s_node;
+			}
+		}
+		digital_gain_0db_limit =
+			!of_property_read_bool(pdev->dev.of_node,
+						"allo,24db_digital_gain");
+
+		glb_mclk = of_property_read_bool(pdev->dev.of_node,
+						"allo,glb_mclk");
+
+		allo_piano_2_1_codecs[0].of_node =
+			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
+		if (!allo_piano_2_1_codecs[0].of_node) {
+			dev_err(&pdev->dev,
+				"Property 'audio-codec' missing or invalid\n");
+			return -EINVAL;
+		}
+
+		allo_piano_2_1_codecs[1].of_node =
+			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
+		if (!allo_piano_2_1_codecs[1].of_node) {
+			dev_err(&pdev->dev,
+				"Property 'audio-codec' missing or invalid\n");
+			return -EINVAL;
+		}
+
+		mute_gpio[0] = devm_gpiod_get_optional(&pdev->dev, "mute1",
+							GPIOD_OUT_LOW);
+		if (IS_ERR(mute_gpio[0])) {
+			ret = PTR_ERR(mute_gpio[0]);
+			dev_err(&pdev->dev,
+				"failed to get mute1 gpio6: %d\n", ret);
+			return ret;
+		}
+
+		mute_gpio[1] = devm_gpiod_get_optional(&pdev->dev, "mute2",
+							GPIOD_OUT_LOW);
+		if (IS_ERR(mute_gpio[1])) {
+			ret = PTR_ERR(mute_gpio[1]);
+			dev_err(&pdev->dev,
+				"failed to get mute2 gpio25: %d\n", ret);
+			return ret;
+		}
+
+		if (mute_gpio[0] && mute_gpio[1])
+			snd_allo_piano_dac.set_bias_level =
+				snd_allo_piano_set_bias_level;
+
+		ret = snd_soc_register_card(&snd_allo_piano_dac);
+		if (ret < 0) {
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+			return ret;
+		}
+
+		if ((mute_gpio[0]) && (mute_gpio[1]))
+			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
+
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int snd_allo_piano_dac_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	kfree(&card->drvdata);
+	snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
+	return snd_soc_unregister_card(&snd_allo_piano_dac);
+}
+
+static const struct of_device_id snd_allo_piano_dac_of_match[] = {
+	{ .compatible = "allo,piano-dac-plus", },
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
+
+static struct platform_driver snd_allo_piano_dac_driver = {
+	.driver = {
+		.name = "snd-allo-piano-dac-plus",
+		.owner = THIS_MODULE,
+		.of_match_table = snd_allo_piano_dac_of_match,
+	},
+	.probe = snd_allo_piano_dac_probe,
+	.remove = snd_allo_piano_dac_remove,
+};
+
+module_platform_driver(snd_allo_piano_dac_driver);
+
+MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC Plus");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 6ba9c33fc492af0310156033709de431f33c5302 Mon Sep 17 00:00:00 2001
From: BabuSubashChandar <babuenir@gmail.com>
Date: Tue, 28 Mar 2017 20:04:42 +0530
Subject: [PATCH 0077/1835] Add support for Allo Boss DAC add-on board for
 Raspberry Pi. (#1924)

Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Deepak <deepak@zilogic.com>
Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>

Add support for new clock rate and mute gpios.

Signed-off-by: Baswaraj K <jaikumar@cem-solutions.net>
Reviewed-by: Deepak <deepak@zilogic.com>
Reviewed-by: BabuSubashChandar <babusubashchandar@zilogic.com>

ASoC: allo-boss-dac: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Signed-off-by: Matthias Reichl <hias@horus.com>

ASoC: allo-boss-dac: transmit S24_LE with 64 BCLK cycles

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 drivers/clk/Makefile          |   1 +
 drivers/clk/clk-allo-dac.c    | 161 ++++++++++++
 sound/soc/bcm/allo-boss-dac.c | 456 ++++++++++++++++++++++++++++++++++
 3 files changed, 618 insertions(+)
 create mode 100644 drivers/clk/clk-allo-dac.c
 create mode 100644 sound/soc/bcm/allo-boss-dac.c

diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index 5555c7d0d18de..9c01de6d26025 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -18,6 +18,7 @@ endif
 
 # hardware specific clock types
 # please keep this section sorted lexicographically by file path name
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC)	+= clk-allo-dac.o
 obj-$(CONFIG_MACH_ASM9260)		+= clk-asm9260.o
 obj-$(CONFIG_COMMON_CLK_AXI_CLKGEN)	+= clk-axi-clkgen.o
 obj-$(CONFIG_ARCH_AXXIA)		+= clk-axm5516.o
diff --git a/drivers/clk/clk-allo-dac.c b/drivers/clk/clk-allo-dac.c
new file mode 100644
index 0000000000000..0baf821d6947e
--- /dev/null
+++ b/drivers/clk/clk-allo-dac.c
@@ -0,0 +1,161 @@
+/*
+ * Clock Driver for Allo DAC
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2016
+ *		based on code by Stuart MacLean
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 45158400UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 49152000UL
+
+/**
+ * struct allo_dac_clk - Common struct to the Allo DAC
+ * @hw: clk_hw for the common clk framework
+ * @mode: 0 => CLK44EN, 1 => CLK48EN
+ */
+struct clk_allo_hw {
+	struct clk_hw hw;
+	uint8_t mode;
+};
+
+#define to_allo_clk(_hw) container_of(_hw, struct clk_allo_hw, hw)
+
+static const struct of_device_id clk_allo_dac_dt_ids[] = {
+	{ .compatible = "allo,dac-clk",},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, clk_allo_dac_dt_ids);
+
+static unsigned long clk_allo_dac_recalc_rate(struct clk_hw *hw,
+	unsigned long parent_rate)
+{
+	return (to_allo_clk(hw)->mode == 0) ? CLK_44EN_RATE :
+		CLK_48EN_RATE;
+}
+
+static long clk_allo_dac_round_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long *parent_rate)
+{
+	long actual_rate;
+
+	if (rate <= CLK_44EN_RATE) {
+		actual_rate = (long)CLK_44EN_RATE;
+	} else if (rate >= CLK_48EN_RATE) {
+		actual_rate = (long)CLK_48EN_RATE;
+	} else {
+		long diff44Rate = (long)(rate - CLK_44EN_RATE);
+		long diff48Rate = (long)(CLK_48EN_RATE - rate);
+
+		if (diff44Rate < diff48Rate)
+			actual_rate = (long)CLK_44EN_RATE;
+		else
+			actual_rate = (long)CLK_48EN_RATE;
+	}
+	return actual_rate;
+}
+
+
+static int clk_allo_dac_set_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long parent_rate)
+{
+	unsigned long actual_rate;
+	struct clk_allo_hw *clk = to_allo_clk(hw);
+
+	actual_rate = (unsigned long)clk_allo_dac_round_rate(hw, rate,
+		&parent_rate);
+	clk->mode = (actual_rate == CLK_44EN_RATE) ? 0 : 1;
+	return 0;
+}
+
+
+const struct clk_ops clk_allo_dac_rate_ops = {
+	.recalc_rate = clk_allo_dac_recalc_rate,
+	.round_rate = clk_allo_dac_round_rate,
+	.set_rate = clk_allo_dac_set_rate,
+};
+
+static int clk_allo_dac_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct clk_allo_hw *proclk;
+	struct clk *clk;
+	struct device *dev;
+	struct clk_init_data init;
+
+	dev = &pdev->dev;
+
+	proclk = kzalloc(sizeof(struct clk_allo_hw), GFP_KERNEL);
+	if (!proclk)
+		return -ENOMEM;
+
+	init.name = "clk-allo-dac";
+	init.ops = &clk_allo_dac_rate_ops;
+	init.flags = CLK_IS_BASIC;
+	init.parent_names = NULL;
+	init.num_parents = 0;
+
+	proclk->mode = 0;
+	proclk->hw.init = &init;
+
+	clk = devm_clk_register(dev, &proclk->hw);
+	if (!IS_ERR(clk)) {
+		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
+			clk);
+	} else {
+		dev_err(dev, "Fail to register clock driver\n");
+		kfree(proclk);
+		ret = PTR_ERR(clk);
+	}
+	return ret;
+}
+
+static int clk_allo_dac_remove(struct platform_device *pdev)
+{
+	of_clk_del_provider(pdev->dev.of_node);
+	return 0;
+}
+
+static struct platform_driver clk_allo_dac_driver = {
+	.probe = clk_allo_dac_probe,
+	.remove = clk_allo_dac_remove,
+	.driver = {
+		.name = "clk-allo-dac",
+		.of_match_table = clk_allo_dac_dt_ids,
+	},
+};
+
+static int __init clk_allo_dac_init(void)
+{
+	return platform_driver_register(&clk_allo_dac_driver);
+}
+core_initcall(clk_allo_dac_init);
+
+static void __exit clk_allo_dac_exit(void)
+{
+	platform_driver_unregister(&clk_allo_dac_driver);
+}
+module_exit(clk_allo_dac_exit);
+
+MODULE_DESCRIPTION("Allo DAC clock driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:clk-allo-dac");
diff --git a/sound/soc/bcm/allo-boss-dac.c b/sound/soc/bcm/allo-boss-dac.c
new file mode 100644
index 0000000000000..6f3509e27e3e1
--- /dev/null
+++ b/sound/soc/bcm/allo-boss-dac.c
@@ -0,0 +1,456 @@
+/*
+ * ALSA ASoC Machine Driver for Allo Boss DAC
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2017
+ *		based on code by Daniel Matuschek,
+ *				 Stuart MacLean <stuart@hifiberry.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../codecs/pcm512x.h"
+
+#define ALLO_BOSS_NOCLOCK 0
+#define ALLO_BOSS_CLK44EN 1
+#define ALLO_BOSS_CLK48EN 2
+
+struct pcm512x_priv {
+	struct regmap *regmap;
+	struct clk *sclk;
+};
+
+static struct gpio_desc *mute_gpio;
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 45158400UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 49152000UL
+
+static bool slave;
+static bool snd_soc_allo_boss_master;
+static bool digital_gain_0db_limit = true;
+
+static void snd_allo_boss_select_clk(struct snd_soc_component *component,
+	int clk_id)
+{
+	switch (clk_id) {
+	case ALLO_BOSS_NOCLOCK:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
+		break;
+	case ALLO_BOSS_CLK44EN:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
+		break;
+	case ALLO_BOSS_CLK48EN:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
+		break;
+	}
+}
+
+static void snd_allo_boss_clk_gpio(struct snd_soc_component *component)
+{
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
+}
+
+static bool snd_allo_boss_is_sclk(struct snd_soc_component *component)
+{
+	unsigned int sck;
+
+	snd_soc_component_read(component, PCM512x_RATE_DET_4, &sck);
+	return (!(sck & 0x40));
+}
+
+static bool snd_allo_boss_is_sclk_sleep(
+	struct snd_soc_component *component)
+{
+	msleep(2);
+	return snd_allo_boss_is_sclk(component);
+}
+
+static bool snd_allo_boss_is_master_card(struct snd_soc_component *component)
+{
+	bool isClk44EN, isClk48En, isNoClk;
+
+	snd_allo_boss_clk_gpio(component);
+
+	snd_allo_boss_select_clk(component, ALLO_BOSS_CLK44EN);
+	isClk44EN = snd_allo_boss_is_sclk_sleep(component);
+
+	snd_allo_boss_select_clk(component, ALLO_BOSS_NOCLOCK);
+	isNoClk = snd_allo_boss_is_sclk_sleep(component);
+
+	snd_allo_boss_select_clk(component, ALLO_BOSS_CLK48EN);
+	isClk48En = snd_allo_boss_is_sclk_sleep(component);
+
+	return (isClk44EN && isClk48En && !isNoClk);
+}
+
+static int snd_allo_boss_clk_for_rate(int sample_rate)
+{
+	int type;
+
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+	case 352800:
+		type = ALLO_BOSS_CLK44EN;
+		break;
+	default:
+		type = ALLO_BOSS_CLK48EN;
+		break;
+	}
+	return type;
+}
+
+static void snd_allo_boss_set_sclk(struct snd_soc_component *component,
+	int sample_rate)
+{
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+
+	if (!IS_ERR(pcm512x->sclk)) {
+		int ctype;
+
+		ctype =	snd_allo_boss_clk_for_rate(sample_rate);
+		clk_set_rate(pcm512x->sclk, (ctype == ALLO_BOSS_CLK44EN)
+				? CLK_44EN_RATE : CLK_48EN_RATE);
+		snd_allo_boss_select_clk(component, ctype);
+	}
+}
+
+static int snd_allo_boss_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct pcm512x_priv *priv = snd_soc_component_get_drvdata(component);
+
+	if (slave)
+		snd_soc_allo_boss_master = false;
+	else
+		snd_soc_allo_boss_master =
+			snd_allo_boss_is_master_card(component);
+
+	if (snd_soc_allo_boss_master) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "BossDAC";
+		dai->stream_name = "Boss DAC HiFi [Master]";
+		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBM_CFM;
+
+		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
+		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
+		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
+		/*
+		* Default sclk to CLK_48EN_RATE, otherwise codec
+		*  pcm512x_dai_startup_master method could call
+		*  snd_pcm_hw_constraint_ratnums using CLK_44EN/64
+		*  which will mask 384k sample rate.
+		*/
+		if (!IS_ERR(priv->sclk))
+			clk_set_rate(priv->sclk, CLK_48EN_RATE);
+	} else {
+		priv->sclk = ERR_PTR(-ENOENT);
+	}
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
+				207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+					ret);
+	}
+
+	return 0;
+}
+
+static int snd_allo_boss_update_rate_den(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+	struct snd_ratnum *rats_no_pll;
+	unsigned int num = 0, den = 0;
+	int err;
+
+	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
+	if (!rats_no_pll)
+		return -ENOMEM;
+
+	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
+	rats_no_pll->den_min = 1;
+	rats_no_pll->den_max = 128;
+	rats_no_pll->den_step = 1;
+
+	err = snd_interval_ratnum(hw_param_interval(params,
+		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
+	if (err >= 0 && den) {
+		params->rate_num = num;
+		params->rate_den = den;
+	}
+
+	devm_kfree(rtd->dev, rats_no_pll);
+	return 0;
+}
+
+static void snd_allo_boss_gpio_mute(struct snd_soc_card *card)
+{
+	if (mute_gpio)
+		gpiod_set_value_cansleep(mute_gpio, 1);
+}
+
+static void snd_allo_boss_gpio_unmute(struct snd_soc_card *card)
+{
+	if (mute_gpio)
+		gpiod_set_value_cansleep(mute_gpio, 0);
+}
+
+static int snd_allo_boss_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *codec_dai;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	codec_dai = rtd->codec_dai;
+
+	if (dapm->dev != codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
+			break;
+		/* UNMUTE DAC */
+		snd_allo_boss_gpio_unmute(card);
+		break;
+
+	case SND_SOC_BIAS_STANDBY:
+		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
+			break;
+		/* MUTE DAC */
+		snd_allo_boss_gpio_mute(card);
+		break;
+
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int snd_allo_boss_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	int channels = params_channels(params);
+	int width = snd_pcm_format_physical_width(params_format(params));
+
+	if (snd_soc_allo_boss_master) {
+		struct snd_soc_component *component = rtd->codec_dai->component;
+
+		snd_allo_boss_set_sclk(component,
+			params_rate(params));
+
+		ret = snd_allo_boss_update_rate_den(
+			substream, params);
+		if (ret)
+			return ret;
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03,
+		channels, width);
+	return ret;
+}
+
+static int snd_allo_boss_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+	snd_allo_boss_gpio_mute(card);
+
+	if (snd_soc_allo_boss_master) {
+		struct pcm512x_priv *priv = snd_soc_component_get_drvdata(component);
+		/*
+		 * Default sclk to CLK_48EN_RATE, otherwise codec
+		 * pcm512x_dai_startup_master method could call
+		 * snd_pcm_hw_constraint_ratnums using CLK_44EN/64
+		 * which will mask 384k sample rate.
+		 */
+		if (!IS_ERR(priv->sclk))
+			clk_set_rate(priv->sclk, CLK_48EN_RATE);
+	}
+
+	return 0;
+}
+
+static void snd_allo_boss_shutdown(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
+}
+
+static int snd_allo_boss_prepare(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_allo_boss_gpio_unmute(card);
+	return 0;
+}
+/* machine stream operations */
+static struct snd_soc_ops snd_allo_boss_ops = {
+	.hw_params = snd_allo_boss_hw_params,
+	.startup = snd_allo_boss_startup,
+	.shutdown = snd_allo_boss_shutdown,
+	.prepare = snd_allo_boss_prepare,
+};
+
+static struct snd_soc_dai_link snd_allo_boss_dai[] = {
+{
+	.name		= "Boss DAC",
+	.stream_name	= "Boss DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_allo_boss_ops,
+	.init		= snd_allo_boss_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_boss = {
+	.name         = "BossDAC",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_allo_boss_dai,
+	.num_links    = ARRAY_SIZE(snd_allo_boss_dai),
+};
+
+static int snd_allo_boss_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_allo_boss.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_allo_boss_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "allo,24db_digital_gain");
+		slave = of_property_read_bool(pdev->dev.of_node,
+						"allo,slave");
+
+		mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
+							GPIOD_OUT_LOW);
+		if (IS_ERR(mute_gpio)) {
+			ret = PTR_ERR(mute_gpio);
+			dev_err(&pdev->dev,
+				"failed to get mute gpio: %d\n", ret);
+			return ret;
+		}
+
+		if (mute_gpio)
+			snd_allo_boss.set_bias_level =
+				snd_allo_boss_set_bias_level;
+
+		ret = snd_soc_register_card(&snd_allo_boss);
+		if (ret) {
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+			return ret;
+		}
+
+		if (mute_gpio)
+			snd_allo_boss_gpio_mute(&snd_allo_boss);
+
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int snd_allo_boss_remove(struct platform_device *pdev)
+{
+	snd_allo_boss_gpio_mute(&snd_allo_boss);
+	return snd_soc_unregister_card(&snd_allo_boss);
+}
+
+static const struct of_device_id snd_allo_boss_of_match[] = {
+	{ .compatible = "allo,boss-dac", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, snd_allo_boss_of_match);
+
+static struct platform_driver snd_allo_boss_driver = {
+	.driver = {
+		.name   = "snd-allo-boss-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_allo_boss_of_match,
+	},
+	.probe          = snd_allo_boss_probe,
+	.remove         = snd_allo_boss_remove,
+};
+
+module_platform_driver(snd_allo_boss_driver);
+
+MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Boss DAC");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From f36f25714e02d2aab4fc5838cf47019c54008fa2 Mon Sep 17 00:00:00 2001
From: gtrainavicius <gtrainavicius@users.noreply.github.com>
Date: Sun, 23 Oct 2016 12:06:53 +0300
Subject: [PATCH 0078/1835] Support for Blokas Labs pisound board

Pisound dynamic overlay (#1760)

Restructuring pisound-overlay.dts, so it can be loaded and unloaded dynamically using dtoverlay.

Print a logline when the kernel module is removed.

pisound improvements:

* Added a writable sysfs object to enable scripts / user space software
to blink MIDI activity LEDs for variable duration.
* Improved hw_param constraints setting.
* Added compatibility with S16_LE sample format.
* Exposed some simple placeholder volume controls, so the card appears
in volumealsa widget.

Add missing SND_PISOUND selects dependency to SND_RAWMIDI

Without it the Pisound module fails to compile.
See https://github.com/raspberrypi/linux/issues/2366

Updates for Pisound module code:

	* Merged 'Fix a warning in DEBUG builds' (1c8b82b).
	* Updating some strings and copyright information.
	* Fix for handling high load of MIDI input and output.
	* Use dual rate oversampling ratio for 96kHz instead of single
	  rate one.

Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>

Fixing memset call in pisound.c

Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>

Fix for Pisound's MIDI Input getting blocked for a while in rare cases.

There was a possible race condition which could lead to Input's FIFO queue
to be underflown, causing high amount of processing in the worker thread for
some period of time.

Signed-off-by: Giedrius Trainavicius <giedrius@blokas.io>
---
 .../devicetree/bindings/vendor-prefixes.txt   |    1 +
 sound/soc/bcm/pisound.c                       | 1204 +++++++++++++++++
 2 files changed, 1205 insertions(+)
 create mode 100644 sound/soc/bcm/pisound.c

diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 2c3fc512e7466..f88e3027cf987 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -56,6 +56,7 @@ axis	Axis Communications AB
 bananapi BIPAI KEJI LIMITED
 bhf	Beckhoff Automation GmbH & Co. KG
 bitmain	Bitmain Technologies
+blokaslabs	Vilniaus Blokas UAB
 boe	BOE Technology Group Co., Ltd.
 bosch	Bosch Sensortec GmbH
 boundary	Boundary Devices Inc.
diff --git a/sound/soc/bcm/pisound.c b/sound/soc/bcm/pisound.c
new file mode 100644
index 0000000000000..ab9ea1f32931a
--- /dev/null
+++ b/sound/soc/bcm/pisound.c
@@ -0,0 +1,1204 @@
+/*
+ * Pisound Linux kernel module.
+ * Copyright (C) 2016-2017  Vilniaus Blokas UAB, https://blokas.io/pisound
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301, USA.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
+#include <linux/delay.h>
+#include <linux/spi/spi.h>
+#include <linux/interrupt.h>
+#include <linux/kfifo.h>
+#include <linux/jiffies.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <sound/rawmidi.h>
+#include <sound/asequencer.h>
+#include <sound/control.h>
+
+static int pisnd_spi_init(struct device *dev);
+static void pisnd_spi_uninit(void);
+
+static void pisnd_spi_flush(void);
+static void pisnd_spi_start(void);
+static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length);
+
+typedef void (*pisnd_spi_recv_cb)(void *data);
+static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data);
+
+static const char *pisnd_spi_get_serial(void);
+static const char *pisnd_spi_get_id(void);
+static const char *pisnd_spi_get_version(void);
+
+static int pisnd_midi_init(struct snd_card *card);
+static void pisnd_midi_uninit(void);
+
+enum task_e {
+	TASK_PROCESS = 0,
+};
+
+static void pisnd_schedule_process(enum task_e task);
+
+#define PISOUND_LOG_PREFIX "pisound: "
+
+#ifdef PISOUND_DEBUG
+#	define printd(...) pr_alert(PISOUND_LOG_PREFIX __VA_ARGS__)
+#else
+#	define printd(...) do {} while (0)
+#endif
+
+#define printe(...) pr_err(PISOUND_LOG_PREFIX __VA_ARGS__)
+#define printi(...) pr_info(PISOUND_LOG_PREFIX __VA_ARGS__)
+
+static struct snd_rawmidi *g_rmidi;
+static struct snd_rawmidi_substream *g_midi_output_substream;
+
+static int pisnd_output_open(struct snd_rawmidi_substream *substream)
+{
+	g_midi_output_substream = substream;
+	return 0;
+}
+
+static int pisnd_output_close(struct snd_rawmidi_substream *substream)
+{
+	g_midi_output_substream = NULL;
+	return 0;
+}
+
+static void pisnd_output_trigger(
+	struct snd_rawmidi_substream *substream,
+	int up
+	)
+{
+	if (substream != g_midi_output_substream) {
+		printe("MIDI output trigger called for an unexpected stream!");
+		return;
+	}
+
+	if (!up)
+		return;
+
+	pisnd_spi_start();
+}
+
+static void pisnd_output_drain(struct snd_rawmidi_substream *substream)
+{
+	pisnd_spi_flush();
+}
+
+static int pisnd_input_open(struct snd_rawmidi_substream *substream)
+{
+	return 0;
+}
+
+static int pisnd_input_close(struct snd_rawmidi_substream *substream)
+{
+	return 0;
+}
+
+static void pisnd_midi_recv_callback(void *substream)
+{
+	uint8_t data[128];
+	uint8_t n = 0;
+
+	while ((n = pisnd_spi_recv(data, sizeof(data)))) {
+		int res = snd_rawmidi_receive(substream, data, n);
+		(void)res;
+		printd("midi recv %u bytes, res = %d\n", n, res);
+	}
+}
+
+static void pisnd_input_trigger(struct snd_rawmidi_substream *substream, int up)
+{
+	if (up) {
+		pisnd_spi_set_callback(pisnd_midi_recv_callback, substream);
+		pisnd_schedule_process(TASK_PROCESS);
+	} else {
+		pisnd_spi_set_callback(NULL, NULL);
+	}
+}
+
+static struct snd_rawmidi_ops pisnd_output_ops = {
+	.open = pisnd_output_open,
+	.close = pisnd_output_close,
+	.trigger = pisnd_output_trigger,
+	.drain = pisnd_output_drain,
+};
+
+static struct snd_rawmidi_ops pisnd_input_ops = {
+	.open = pisnd_input_open,
+	.close = pisnd_input_close,
+	.trigger = pisnd_input_trigger,
+};
+
+static void pisnd_get_port_info(
+	struct snd_rawmidi *rmidi,
+	int number,
+	struct snd_seq_port_info *seq_port_info
+	)
+{
+	seq_port_info->type =
+		SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC |
+		SNDRV_SEQ_PORT_TYPE_HARDWARE |
+		SNDRV_SEQ_PORT_TYPE_PORT;
+	seq_port_info->midi_voices = 0;
+}
+
+static struct snd_rawmidi_global_ops pisnd_global_ops = {
+	.get_port_info = pisnd_get_port_info,
+};
+
+static int pisnd_midi_init(struct snd_card *card)
+{
+	int err;
+
+	g_midi_output_substream = NULL;
+
+	err = snd_rawmidi_new(card, "pisound MIDI", 0, 1, 1, &g_rmidi);
+
+	if (err < 0) {
+		printe("snd_rawmidi_new failed: %d\n", err);
+		return err;
+	}
+
+	strcpy(g_rmidi->name, "pisound MIDI ");
+	strcat(g_rmidi->name, pisnd_spi_get_serial());
+
+	g_rmidi->info_flags =
+		SNDRV_RAWMIDI_INFO_OUTPUT |
+		SNDRV_RAWMIDI_INFO_INPUT |
+		SNDRV_RAWMIDI_INFO_DUPLEX;
+
+	g_rmidi->ops = &pisnd_global_ops;
+
+	g_rmidi->private_data = (void *)0;
+
+	snd_rawmidi_set_ops(
+		g_rmidi,
+		SNDRV_RAWMIDI_STREAM_OUTPUT,
+		&pisnd_output_ops
+		);
+
+	snd_rawmidi_set_ops(
+		g_rmidi,
+		SNDRV_RAWMIDI_STREAM_INPUT,
+		&pisnd_input_ops
+		);
+
+	return 0;
+}
+
+static void pisnd_midi_uninit(void)
+{
+}
+
+static void *g_recvData;
+static pisnd_spi_recv_cb g_recvCallback;
+
+#define FIFO_SIZE 4096
+
+static char g_serial_num[11];
+static char g_id[25];
+static char g_version[5];
+
+static uint8_t g_ledFlashDuration;
+static bool    g_ledFlashDurationChanged;
+
+DEFINE_KFIFO(spi_fifo_in,  uint8_t, FIFO_SIZE);
+DEFINE_KFIFO(spi_fifo_out, uint8_t, FIFO_SIZE);
+
+static struct gpio_desc *data_available;
+static struct gpio_desc *spi_reset;
+
+static struct spi_device *pisnd_spi_device;
+
+static struct workqueue_struct *pisnd_workqueue;
+static struct work_struct pisnd_work_process;
+
+static void pisnd_work_handler(struct work_struct *work);
+
+static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len);
+static uint16_t spi_transfer16(uint16_t val);
+
+static int pisnd_init_workqueues(void)
+{
+	pisnd_workqueue = create_singlethread_workqueue("pisnd_workqueue");
+	INIT_WORK(&pisnd_work_process, pisnd_work_handler);
+
+	return 0;
+}
+
+static void pisnd_uninit_workqueues(void)
+{
+	flush_workqueue(pisnd_workqueue);
+	destroy_workqueue(pisnd_workqueue);
+
+	pisnd_workqueue = NULL;
+}
+
+static bool pisnd_spi_has_more(void)
+{
+	return gpiod_get_value(data_available);
+}
+
+static void pisnd_schedule_process(enum task_e task)
+{
+	if (pisnd_spi_device != NULL &&
+		pisnd_workqueue != NULL &&
+		!work_pending(&pisnd_work_process)
+		) {
+		printd("schedule: has more = %d\n", pisnd_spi_has_more());
+		if (task == TASK_PROCESS)
+			queue_work(pisnd_workqueue, &pisnd_work_process);
+	}
+}
+
+static irqreturn_t data_available_interrupt_handler(int irq, void *dev_id)
+{
+	if (irq == gpiod_to_irq(data_available) && pisnd_spi_has_more()) {
+		printd("schedule from irq\n");
+		pisnd_schedule_process(TASK_PROCESS);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static DEFINE_SPINLOCK(spilock);
+static unsigned long spilockflags;
+
+static uint16_t spi_transfer16(uint16_t val)
+{
+	uint8_t txbuf[2];
+	uint8_t rxbuf[2];
+
+	if (!pisnd_spi_device) {
+		printe("pisnd_spi_device null, returning\n");
+		return 0;
+	}
+
+	txbuf[0] = val >> 8;
+	txbuf[1] = val & 0xff;
+
+	spi_transfer(txbuf, rxbuf, sizeof(txbuf));
+
+	printd("received: %02x%02x\n", rxbuf[0], rxbuf[1]);
+
+	return (rxbuf[0] << 8) | rxbuf[1];
+}
+
+static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len)
+{
+	int err;
+	struct spi_transfer transfer;
+	struct spi_message msg;
+
+	memset(rxbuf, 0, len);
+
+	if (!pisnd_spi_device) {
+		printe("pisnd_spi_device null, returning\n");
+		return;
+	}
+
+	spi_message_init(&msg);
+
+	memset(&transfer, 0, sizeof(transfer));
+
+	transfer.tx_buf = txbuf;
+	transfer.rx_buf = rxbuf;
+	transfer.len = len;
+	transfer.speed_hz = 100000;
+	transfer.delay_usecs = 10;
+	spi_message_add_tail(&transfer, &msg);
+
+	spin_lock_irqsave(&spilock, spilockflags);
+	err = spi_sync(pisnd_spi_device, &msg);
+	spin_unlock_irqrestore(&spilock, spilockflags);
+
+	if (err < 0) {
+		printe("spi_sync error %d\n", err);
+		return;
+	}
+
+	printd("hasMore %d\n", pisnd_spi_has_more());
+}
+
+static int spi_read_bytes(char *dst, size_t length, uint8_t *bytesRead)
+{
+	uint16_t rx;
+	uint8_t size;
+	uint8_t i;
+
+	memset(dst, 0, length);
+	*bytesRead = 0;
+
+	rx = spi_transfer16(0);
+	if (!(rx >> 8))
+		return -EINVAL;
+
+	size = rx & 0xff;
+
+	if (size > length)
+		return -EINVAL;
+
+	for (i = 0; i < size; ++i) {
+		rx = spi_transfer16(0);
+		if (!(rx >> 8))
+			return -EINVAL;
+
+		dst[i] = rx & 0xff;
+	}
+
+	*bytesRead = i;
+
+	return 0;
+}
+
+static int spi_device_match(struct device *dev, void *data)
+{
+	struct spi_device *spi = container_of(dev, struct spi_device, dev);
+
+	printd("      %s %s %dkHz %d bits mode=0x%02X\n",
+		spi->modalias, dev_name(dev), spi->max_speed_hz/1000,
+		spi->bits_per_word, spi->mode);
+
+	if (strcmp("pisound-spi", spi->modalias) == 0) {
+		printi("\tFound!\n");
+		return 1;
+	}
+
+	printe("\tNot found!\n");
+	return 0;
+}
+
+static struct spi_device *pisnd_spi_find_device(void)
+{
+	struct device *dev;
+
+	printi("Searching for spi device...\n");
+	dev = bus_find_device(&spi_bus_type, NULL, NULL, spi_device_match);
+	if (dev != NULL)
+		return container_of(dev, struct spi_device, dev);
+	else
+		return NULL;
+}
+
+static void pisnd_work_handler(struct work_struct *work)
+{
+	enum { TRANSFER_SIZE = 4 };
+	enum { PISOUND_OUTPUT_BUFFER_SIZE = 128 };
+	enum { MIDI_BYTES_PER_SECOND = 3125 };
+	int out_buffer_used = 0;
+	unsigned long now;
+	uint8_t val;
+	uint8_t txbuf[TRANSFER_SIZE];
+	uint8_t rxbuf[TRANSFER_SIZE];
+	uint8_t midibuf[TRANSFER_SIZE];
+	int i, n;
+	bool had_data;
+
+	unsigned long last_transfer_at = jiffies;
+
+	if (work == &pisnd_work_process) {
+		if (pisnd_spi_device == NULL)
+			return;
+
+		do {
+			if (g_midi_output_substream &&
+				kfifo_avail(&spi_fifo_out) >= sizeof(midibuf)) {
+
+				n = snd_rawmidi_transmit_peek(
+					g_midi_output_substream,
+					midibuf, sizeof(midibuf)
+				);
+
+				if (n > 0) {
+					for (i = 0; i < n; ++i)
+						kfifo_put(
+							&spi_fifo_out,
+							midibuf[i]
+							);
+					snd_rawmidi_transmit_ack(
+						g_midi_output_substream,
+						i
+						);
+				}
+			}
+
+			had_data = false;
+			memset(txbuf, 0, sizeof(txbuf));
+			for (i = 0; i < sizeof(txbuf) &&
+				out_buffer_used < PISOUND_OUTPUT_BUFFER_SIZE;
+				i += 2) {
+
+				val = 0;
+
+				if (g_ledFlashDurationChanged) {
+					txbuf[i+0] = 0xf0;
+					txbuf[i+1] = g_ledFlashDuration;
+					g_ledFlashDuration = 0;
+					g_ledFlashDurationChanged = false;
+				} else if (kfifo_get(&spi_fifo_out, &val)) {
+					txbuf[i+0] = 0x0f;
+					txbuf[i+1] = val;
+					++out_buffer_used;
+				}
+			}
+
+			spi_transfer(txbuf, rxbuf, sizeof(txbuf));
+			/* Estimate the Pisound's MIDI output buffer usage, so
+			 * that we don't overflow it. Space in the buffer should
+			 * be becoming available at the UART MIDI byte transfer
+			 * rate.
+			 */
+			now = jiffies;
+			out_buffer_used -=
+				(MIDI_BYTES_PER_SECOND / HZ) /
+				(now - last_transfer_at);
+			if (out_buffer_used < 0)
+				out_buffer_used = 0;
+			last_transfer_at = now;
+
+			for (i = 0; i < sizeof(rxbuf); i += 2) {
+				if (rxbuf[i]) {
+					kfifo_put(&spi_fifo_in, rxbuf[i+1]);
+					if (kfifo_len(&spi_fifo_in) > 16 &&
+						g_recvCallback)
+						g_recvCallback(g_recvData);
+					had_data = true;
+				}
+			}
+		} while (had_data
+			|| !kfifo_is_empty(&spi_fifo_out)
+			|| pisnd_spi_has_more()
+			|| g_ledFlashDurationChanged
+			);
+
+		if (!kfifo_is_empty(&spi_fifo_in) && g_recvCallback)
+			g_recvCallback(g_recvData);
+	}
+}
+
+static int pisnd_spi_gpio_init(struct device *dev)
+{
+	spi_reset = gpiod_get_index(dev, "reset", 1, GPIOD_ASIS);
+	data_available = gpiod_get_index(dev, "data_available", 0, GPIOD_ASIS);
+
+	gpiod_direction_output(spi_reset, 1);
+	gpiod_direction_input(data_available);
+
+	/* Reset the slave. */
+	gpiod_set_value(spi_reset, false);
+	mdelay(1);
+	gpiod_set_value(spi_reset, true);
+
+	/* Give time for spi slave to start. */
+	mdelay(64);
+
+	return 0;
+}
+
+static void pisnd_spi_gpio_uninit(void)
+{
+	gpiod_set_value(spi_reset, false);
+	gpiod_put(spi_reset);
+	spi_reset = NULL;
+
+	gpiod_put(data_available);
+	data_available = NULL;
+}
+
+static int pisnd_spi_gpio_irq_init(struct device *dev)
+{
+	return request_irq(
+		gpiod_to_irq(data_available),
+		data_available_interrupt_handler,
+		IRQF_TIMER | IRQF_TRIGGER_RISING,
+		"data_available_int",
+		NULL
+		);
+}
+
+static void pisnd_spi_gpio_irq_uninit(void)
+{
+	free_irq(gpiod_to_irq(data_available), NULL);
+}
+
+static int spi_read_info(void)
+{
+	uint16_t tmp;
+	uint8_t count;
+	uint8_t n;
+	uint8_t i;
+	uint8_t j;
+	char buffer[257];
+	int ret;
+	char *p;
+
+	memset(g_serial_num, 0, sizeof(g_serial_num));
+	memset(g_version, 0, sizeof(g_version));
+	memset(g_id, 0, sizeof(g_id));
+
+	tmp = spi_transfer16(0);
+
+	if (!(tmp >> 8))
+		return -EINVAL;
+
+	count = tmp & 0xff;
+
+	for (i = 0; i < count; ++i) {
+		memset(buffer, 0, sizeof(buffer));
+		ret = spi_read_bytes(buffer, sizeof(buffer)-1, &n);
+
+		if (ret < 0)
+			return ret;
+
+		switch (i) {
+		case 0:
+			if (n != 2)
+				return -EINVAL;
+
+			snprintf(
+				g_version,
+				sizeof(g_version),
+				"%x.%02x",
+				buffer[0],
+				buffer[1]
+				);
+			break;
+		case 1:
+			if (n >= sizeof(g_serial_num))
+				return -EINVAL;
+
+			memcpy(g_serial_num, buffer, sizeof(g_serial_num));
+			break;
+		case 2:
+			{
+				if (n >= sizeof(g_id))
+					return -EINVAL;
+
+				p = g_id;
+				for (j = 0; j < n; ++j)
+					p += sprintf(p, "%02x", buffer[j]);
+			}
+			break;
+		default:
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int pisnd_spi_init(struct device *dev)
+{
+	int ret;
+	struct spi_device *spi;
+
+	memset(g_serial_num, 0, sizeof(g_serial_num));
+	memset(g_id, 0, sizeof(g_id));
+	memset(g_version, 0, sizeof(g_version));
+
+	spi = pisnd_spi_find_device();
+
+	if (spi != NULL) {
+		printd("initializing spi!\n");
+		pisnd_spi_device = spi;
+		ret = spi_setup(pisnd_spi_device);
+	} else {
+		printe("SPI device not found, deferring!\n");
+		return -EPROBE_DEFER;
+	}
+
+	ret = pisnd_spi_gpio_init(dev);
+
+	if (ret < 0) {
+		printe("SPI GPIO init failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_uninit();
+		return ret;
+	}
+
+	ret = spi_read_info();
+
+	if (ret < 0) {
+		printe("Reading card info failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_uninit();
+		return ret;
+	}
+
+	/* Flash the LEDs. */
+	spi_transfer16(0xf008);
+
+	ret = pisnd_spi_gpio_irq_init(dev);
+	if (ret < 0) {
+		printe("SPI irq request failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_irq_uninit();
+		pisnd_spi_gpio_uninit();
+	}
+
+	ret = pisnd_init_workqueues();
+	if (ret != 0) {
+		printe("Workqueue initialization failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_irq_uninit();
+		pisnd_spi_gpio_uninit();
+		pisnd_uninit_workqueues();
+		return ret;
+	}
+
+	if (pisnd_spi_has_more()) {
+		printd("data is available, scheduling from init\n");
+		pisnd_schedule_process(TASK_PROCESS);
+	}
+
+	return 0;
+}
+
+static void pisnd_spi_uninit(void)
+{
+	pisnd_uninit_workqueues();
+
+	spi_dev_put(pisnd_spi_device);
+	pisnd_spi_device = NULL;
+
+	pisnd_spi_gpio_irq_uninit();
+	pisnd_spi_gpio_uninit();
+}
+
+static void pisnd_spi_flash_leds(uint8_t duration)
+{
+	g_ledFlashDuration = duration;
+	g_ledFlashDurationChanged = true;
+	printd("schedule from spi_flash_leds\n");
+	pisnd_schedule_process(TASK_PROCESS);
+}
+
+static void pisnd_spi_flush(void)
+{
+	while (!kfifo_is_empty(&spi_fifo_out)) {
+		pisnd_spi_start();
+		flush_workqueue(pisnd_workqueue);
+	}
+}
+
+static void pisnd_spi_start(void)
+{
+	printd("schedule from spi_start\n");
+	pisnd_schedule_process(TASK_PROCESS);
+}
+
+static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length)
+{
+	return kfifo_out(&spi_fifo_in, buffer, length);
+}
+
+static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data)
+{
+	g_recvData = data;
+	g_recvCallback = cb;
+}
+
+static const char *pisnd_spi_get_serial(void)
+{
+	if (strlen(g_serial_num))
+		return g_serial_num;
+
+	return "";
+}
+
+static const char *pisnd_spi_get_id(void)
+{
+	if (strlen(g_id))
+		return g_id;
+
+	return "";
+}
+
+static const char *pisnd_spi_get_version(void)
+{
+	if (strlen(g_version))
+		return g_version;
+
+	return "";
+}
+
+static const struct of_device_id pisound_of_match[] = {
+	{ .compatible = "blokaslabs,pisound", },
+	{ .compatible = "blokaslabs,pisound-spi", },
+	{},
+};
+
+enum {
+	SWITCH = 0,
+	VOLUME = 1,
+};
+
+static int pisnd_ctl_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	if (kcontrol->private_value == SWITCH) {
+		uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
+		uinfo->count = 1;
+		uinfo->value.integer.min = 0;
+		uinfo->value.integer.max = 1;
+		return 0;
+	} else if (kcontrol->private_value == VOLUME) {
+		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+		uinfo->count = 1;
+		uinfo->value.integer.min = 0;
+		uinfo->value.integer.max = 100;
+		return 0;
+	}
+	return -EINVAL;
+}
+
+static int pisnd_ctl_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	if (kcontrol->private_value == SWITCH) {
+		ucontrol->value.integer.value[0] = 1;
+		return 0;
+	} else if (kcontrol->private_value == VOLUME) {
+		ucontrol->value.integer.value[0] = 100;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static struct snd_kcontrol_new pisnd_ctl[] = {
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "PCM Playback Switch",
+		.index = 0,
+		.private_value = SWITCH,
+		.access = SNDRV_CTL_ELEM_ACCESS_READ,
+		.info = pisnd_ctl_info,
+		.get = pisnd_ctl_get,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "PCM Playback Volume",
+		.index = 0,
+		.private_value = VOLUME,
+		.access = SNDRV_CTL_ELEM_ACCESS_READ,
+		.info = pisnd_ctl_info,
+		.get = pisnd_ctl_get,
+	},
+};
+
+static int pisnd_ctl_init(struct snd_card *card)
+{
+	int err, i;
+
+	for (i = 0; i < ARRAY_SIZE(pisnd_ctl); ++i) {
+		err = snd_ctl_add(card, snd_ctl_new1(&pisnd_ctl[i], NULL));
+		if (err < 0)
+			return err;
+	}
+
+	return 0;
+}
+
+static int pisnd_ctl_uninit(void)
+{
+	return 0;
+}
+
+static struct gpio_desc *osr0, *osr1, *osr2;
+static struct gpio_desc *reset;
+static struct gpio_desc *button;
+
+static int pisnd_hw_params(
+	struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params
+	)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	/* Pisound runs on fixed 32 clock counts per channel,
+	 * as generated by the master ADC.
+	 */
+	snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
+
+	printd("rate   = %d\n", params_rate(params));
+	printd("ch     = %d\n", params_channels(params));
+	printd("bits   = %u\n",
+		snd_pcm_format_physical_width(params_format(params)));
+	printd("format = %d\n", params_format(params));
+
+	gpiod_set_value(reset, false);
+
+	switch (params_rate(params)) {
+	case 48000:
+		gpiod_set_value(osr0, true);
+		gpiod_set_value(osr1, false);
+		gpiod_set_value(osr2, false);
+		break;
+	case 96000:
+		gpiod_set_value(osr0, true);
+		gpiod_set_value(osr1, false);
+		gpiod_set_value(osr2, true);
+		break;
+	case 192000:
+		gpiod_set_value(osr0, true);
+		gpiod_set_value(osr1, true);
+		gpiod_set_value(osr2, true);
+		break;
+	default:
+		printe("Unsupported rate %u!\n", params_rate(params));
+		return -EINVAL;
+	}
+
+	gpiod_set_value(reset, true);
+
+	return 0;
+}
+
+static unsigned int rates[3] = {
+	48000, 96000, 192000
+};
+
+static struct snd_pcm_hw_constraint_list constraints_rates = {
+	.count = ARRAY_SIZE(rates),
+	.list = rates,
+	.mask = 0,
+};
+
+static int pisnd_startup(struct snd_pcm_substream *substream)
+{
+	int err = snd_pcm_hw_constraint_list(
+		substream->runtime,
+		0,
+		SNDRV_PCM_HW_PARAM_RATE,
+		&constraints_rates
+		);
+
+	if (err < 0)
+		return err;
+
+	err = snd_pcm_hw_constraint_single(
+		substream->runtime,
+		SNDRV_PCM_HW_PARAM_CHANNELS,
+		2
+		);
+
+	if (err < 0)
+		return err;
+
+	err = snd_pcm_hw_constraint_mask64(
+		substream->runtime,
+		SNDRV_PCM_HW_PARAM_FORMAT,
+		SNDRV_PCM_FMTBIT_S16_LE |
+		SNDRV_PCM_FMTBIT_S24_LE |
+		SNDRV_PCM_FMTBIT_S32_LE
+		);
+
+	if (err < 0)
+		return err;
+
+	return 0;
+}
+
+static struct snd_soc_ops pisnd_ops = {
+	.startup = pisnd_startup,
+	.hw_params = pisnd_hw_params,
+};
+
+static struct snd_soc_dai_link pisnd_dai[] = {
+	{
+		.name           = "pisound",
+		.stream_name    = "pisound",
+		.cpu_dai_name   = "bcm2708-i2s.0",
+		.codec_dai_name = "snd-soc-dummy-dai",
+		.platform_name  = "bcm2708-i2s.0",
+		.codec_name     = "snd-soc-dummy",
+		.dai_fmt        =
+			SND_SOC_DAIFMT_I2S |
+			SND_SOC_DAIFMT_NB_NF |
+			SND_SOC_DAIFMT_CBM_CFM,
+		.ops            = &pisnd_ops,
+	},
+};
+
+static int pisnd_card_probe(struct snd_soc_card *card)
+{
+	int err = pisnd_midi_init(card->snd_card);
+
+	if (err < 0) {
+		printe("pisnd_midi_init failed: %d\n", err);
+		return err;
+	}
+
+	err = pisnd_ctl_init(card->snd_card);
+	if (err < 0) {
+		printe("pisnd_ctl_init failed: %d\n", err);
+		return err;
+	}
+
+	return 0;
+}
+
+static int pisnd_card_remove(struct snd_soc_card *card)
+{
+	pisnd_ctl_uninit();
+	pisnd_midi_uninit();
+	return 0;
+}
+
+static struct snd_soc_card pisnd_card = {
+	.name         = "pisound",
+	.owner        = THIS_MODULE,
+	.dai_link     = pisnd_dai,
+	.num_links    = ARRAY_SIZE(pisnd_dai),
+	.probe        = pisnd_card_probe,
+	.remove       = pisnd_card_remove,
+};
+
+static int pisnd_init_gpio(struct device *dev)
+{
+	osr0 = gpiod_get_index(dev, "osr", 0, GPIOD_ASIS);
+	osr1 = gpiod_get_index(dev, "osr", 1, GPIOD_ASIS);
+	osr2 = gpiod_get_index(dev, "osr", 2, GPIOD_ASIS);
+
+	reset = gpiod_get_index(dev, "reset", 0, GPIOD_ASIS);
+
+	button = gpiod_get_index(dev, "button", 0, GPIOD_ASIS);
+
+	gpiod_direction_output(osr0,  1);
+	gpiod_direction_output(osr1,  1);
+	gpiod_direction_output(osr2,  1);
+	gpiod_direction_output(reset, 1);
+
+	gpiod_set_value(reset, false);
+	gpiod_set_value(osr0,   true);
+	gpiod_set_value(osr1,  false);
+	gpiod_set_value(osr2,  false);
+	gpiod_set_value(reset,  true);
+
+	gpiod_export(button, false);
+
+	return 0;
+}
+
+static int pisnd_uninit_gpio(void)
+{
+	int i;
+
+	struct gpio_desc **gpios[] = {
+		&osr0, &osr1, &osr2, &reset, &button,
+	};
+
+	gpiod_unexport(button);
+
+	for (i = 0; i < ARRAY_SIZE(gpios); ++i) {
+		if (*gpios[i] == NULL) {
+			printd("weird, GPIO[%d] is NULL already\n", i);
+			continue;
+		}
+
+		gpiod_put(*gpios[i]);
+		*gpios[i] = NULL;
+	}
+
+	return 0;
+}
+
+static struct kobject *pisnd_kobj;
+
+static ssize_t pisnd_serial_show(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	char *buf
+	)
+{
+	return sprintf(buf, "%s\n", pisnd_spi_get_serial());
+}
+
+static ssize_t pisnd_id_show(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	char *buf
+	)
+{
+	return sprintf(buf, "%s\n", pisnd_spi_get_id());
+}
+
+static ssize_t pisnd_version_show(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	char *buf
+	)
+{
+	return sprintf(buf, "%s\n", pisnd_spi_get_version());
+}
+
+static ssize_t pisnd_led_store(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	const char *buf,
+	size_t length
+	)
+{
+	uint32_t timeout;
+	int err;
+
+	err = kstrtou32(buf, 10, &timeout);
+
+	if (err == 0 && timeout <= 255)
+		pisnd_spi_flash_leds(timeout);
+
+	return length;
+}
+
+static struct kobj_attribute pisnd_serial_attribute =
+	__ATTR(serial, 0444, pisnd_serial_show, NULL);
+static struct kobj_attribute pisnd_id_attribute =
+	__ATTR(id, 0444, pisnd_id_show, NULL);
+static struct kobj_attribute pisnd_version_attribute =
+	__ATTR(version, 0444, pisnd_version_show, NULL);
+static struct kobj_attribute pisnd_led_attribute =
+	__ATTR(led, 0644, NULL, pisnd_led_store);
+
+static struct attribute *attrs[] = {
+	&pisnd_serial_attribute.attr,
+	&pisnd_id_attribute.attr,
+	&pisnd_version_attribute.attr,
+	&pisnd_led_attribute.attr,
+	NULL
+};
+
+static struct attribute_group attr_group = { .attrs = attrs };
+
+static int pisnd_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	int i;
+
+	ret = pisnd_spi_init(&pdev->dev);
+	if (ret < 0) {
+		printe("pisnd_spi_init failed: %d\n", ret);
+		return ret;
+	}
+
+	printi("Detected Pisound card:\n");
+	printi("\tSerial:  %s\n", pisnd_spi_get_serial());
+	printi("\tVersion: %s\n", pisnd_spi_get_version());
+	printi("\tId:      %s\n", pisnd_spi_get_id());
+
+	pisnd_kobj = kobject_create_and_add("pisound", kernel_kobj);
+	if (!pisnd_kobj) {
+		pisnd_spi_uninit();
+		return -ENOMEM;
+	}
+
+	ret = sysfs_create_group(pisnd_kobj, &attr_group);
+	if (ret < 0) {
+		pisnd_spi_uninit();
+		kobject_put(pisnd_kobj);
+		return -ENOMEM;
+	}
+
+	pisnd_init_gpio(&pdev->dev);
+	pisnd_card.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+
+		i2s_node = of_parse_phandle(
+			pdev->dev.of_node,
+			"i2s-controller",
+			0
+			);
+
+		for (i = 0; i < pisnd_card.num_links; ++i) {
+			struct snd_soc_dai_link *dai = &pisnd_dai[i];
+
+			if (i2s_node) {
+				dai->cpu_dai_name = NULL;
+				dai->cpu_of_node = i2s_node;
+				dai->platform_name = NULL;
+				dai->platform_of_node = i2s_node;
+				dai->stream_name = pisnd_spi_get_serial();
+			}
+		}
+	}
+
+	ret = snd_soc_register_card(&pisnd_card);
+
+	if (ret < 0) {
+		if (ret != -EPROBE_DEFER)
+			printe("snd_soc_register_card() failed: %d\n", ret);
+		pisnd_uninit_gpio();
+		kobject_put(pisnd_kobj);
+		pisnd_spi_uninit();
+	}
+
+	return ret;
+}
+
+static int pisnd_remove(struct platform_device *pdev)
+{
+	printi("Unloading.\n");
+
+	if (pisnd_kobj) {
+		kobject_put(pisnd_kobj);
+		pisnd_kobj = NULL;
+	}
+
+	pisnd_spi_uninit();
+
+	/* Turn off */
+	gpiod_set_value(reset, false);
+	pisnd_uninit_gpio();
+
+	return snd_soc_unregister_card(&pisnd_card);
+}
+
+MODULE_DEVICE_TABLE(of, pisound_of_match);
+
+static struct platform_driver pisnd_driver = {
+	.driver = {
+		.name           = "snd-rpi-pisound",
+		.owner          = THIS_MODULE,
+		.of_match_table = pisound_of_match,
+	},
+	.probe              = pisnd_probe,
+	.remove             = pisnd_remove,
+};
+
+module_platform_driver(pisnd_driver);
+
+MODULE_AUTHOR("Giedrius Trainavicius <giedrius@blokas.io>");
+MODULE_DESCRIPTION("ASoC Driver for Pisound, https://blokas.io/pisound");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From ab1f57d353bba8cb9dab5c27202e79d5ae2db31a Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Sun, 22 Jan 2017 12:49:37 +0100
Subject: [PATCH 0079/1835] ASoC: Add driver for Cirrus Logic Audio Card

Note: due to problems with deferred probing of regulators
the following softdep should be added to a modprobe.d file

softdep arizona-spi pre: arizona-ldo1

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/rpi-cirrus.c | 1029 ++++++++++++++++++++++++++++++++++++
 1 file changed, 1029 insertions(+)
 create mode 100644 sound/soc/bcm/rpi-cirrus.c

diff --git a/sound/soc/bcm/rpi-cirrus.c b/sound/soc/bcm/rpi-cirrus.c
new file mode 100644
index 0000000000000..8c9c8d4999329
--- /dev/null
+++ b/sound/soc/bcm/rpi-cirrus.c
@@ -0,0 +1,1029 @@
+/*
+ * ASoC machine driver for Cirrus Logic Audio Card
+ * (with WM5102 and WM8804 codecs)
+ *
+ * Copyright 2015-2017 Matthias Reichl <hias@horus.com>
+ *
+ * Based on rpi-cirrus-sound-pi driver (c) Wolfson / Cirrus Logic Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/delay.h>
+#include <sound/pcm_params.h>
+
+#include <linux/mfd/arizona/registers.h>
+
+#include "../codecs/wm5102.h"
+#include "../codecs/wm8804.h"
+
+#define WM8804_CLKOUT_HZ 12000000
+
+#define RPI_CIRRUS_DEFAULT_RATE 44100
+#define WM5102_MAX_SYSCLK_1 49152000 /* max sysclk for 4K family */
+#define WM5102_MAX_SYSCLK_2 45158400 /* max sysclk for 11.025K family */
+
+static inline unsigned int calc_sysclk(unsigned int rate)
+{
+	return (rate % 4000) ? WM5102_MAX_SYSCLK_2 : WM5102_MAX_SYSCLK_1;
+}
+
+enum {
+	DAI_WM5102 = 0,
+	DAI_WM8804,
+};
+
+struct rpi_cirrus_priv {
+	/* mutex for synchronzing FLL1 access with DAPM */
+	struct mutex lock;
+	unsigned int card_rate;
+	int sync_path_enable;
+	int fll1_freq; /* negative means RefClock in spdif rx case */
+
+	/* track hw params/free for substreams */
+	unsigned int params_set;
+	unsigned int min_rate_idx, max_rate_idx;
+	unsigned char iec958_status[4];
+};
+
+/* helper functions */
+static inline struct snd_soc_pcm_runtime *get_wm5102_runtime(
+	struct snd_soc_card *card) {
+	return snd_soc_get_pcm_runtime(card, card->dai_link[DAI_WM5102].name);
+}
+
+static inline struct snd_soc_pcm_runtime *get_wm8804_runtime(
+	struct snd_soc_card *card) {
+	return snd_soc_get_pcm_runtime(card, card->dai_link[DAI_WM8804].name);
+}
+
+
+struct rate_info {
+	unsigned int value;
+	char *text;
+};
+
+static struct rate_info min_rates[] = {
+	{     0, "off"},
+	{ 32000, "32kHz"},
+	{ 44100, "44.1kHz"}
+};
+
+#define NUM_MIN_RATES ARRAY_SIZE(min_rates)
+
+static int rpi_cirrus_min_rate_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+	uinfo->count = 1;
+	uinfo->value.enumerated.items = NUM_MIN_RATES;
+
+	if (uinfo->value.enumerated.item >= NUM_MIN_RATES)
+		uinfo->value.enumerated.item = NUM_MIN_RATES - 1;
+	strcpy(uinfo->value.enumerated.name,
+		min_rates[uinfo->value.enumerated.item].text);
+	return 0;
+}
+
+static int rpi_cirrus_min_rate_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+
+	ucontrol->value.enumerated.item[0] = priv->min_rate_idx;
+	return 0;
+}
+
+static int rpi_cirrus_min_rate_put(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	int changed = 0;
+
+	if (priv->min_rate_idx != ucontrol->value.enumerated.item[0]) {
+		changed = 1;
+		priv->min_rate_idx = ucontrol->value.enumerated.item[0];
+	}
+
+	return changed;
+}
+
+static struct rate_info max_rates[] = {
+	{     0, "off"},
+	{ 48000, "48kHz"},
+	{ 96000, "96kHz"}
+};
+
+#define NUM_MAX_RATES ARRAY_SIZE(max_rates)
+
+static int rpi_cirrus_max_rate_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+	uinfo->count = 1;
+	uinfo->value.enumerated.items = NUM_MAX_RATES;
+	if (uinfo->value.enumerated.item >= NUM_MAX_RATES)
+		uinfo->value.enumerated.item = NUM_MAX_RATES - 1;
+	strcpy(uinfo->value.enumerated.name,
+		max_rates[uinfo->value.enumerated.item].text);
+	return 0;
+}
+
+static int rpi_cirrus_max_rate_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+
+	ucontrol->value.enumerated.item[0] = priv->max_rate_idx;
+	return 0;
+}
+
+static int rpi_cirrus_max_rate_put(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	int changed = 0;
+
+	if (priv->max_rate_idx != ucontrol->value.enumerated.item[0]) {
+		changed = 1;
+		priv->max_rate_idx = ucontrol->value.enumerated.item[0];
+	}
+
+	return changed;
+}
+
+static int rpi_cirrus_spdif_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
+	uinfo->count = 1;
+	return 0;
+}
+
+static int rpi_cirrus_spdif_playback_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	int i;
+
+	for (i = 0; i < 4; i++)
+		ucontrol->value.iec958.status[i] = priv->iec958_status[i];
+
+	return 0;
+}
+
+static int rpi_cirrus_spdif_playback_put(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_component *wm8804_component =
+		get_wm8804_runtime(card)->codec_dai->component;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	unsigned char *stat = priv->iec958_status;
+	unsigned char *ctrl_stat = ucontrol->value.iec958.status;
+	unsigned int mask;
+	int i, changed = 0;
+
+	for (i = 0; i < 4; i++) {
+		mask = (i == 3) ? 0x3f : 0xff;
+		if ((ctrl_stat[i] & mask) != (stat[i] & mask)) {
+			changed = 1;
+			stat[i] = ctrl_stat[i] & mask;
+			snd_soc_component_update_bits(wm8804_component,
+				WM8804_SPDTX1 + i, mask, stat[i]);
+		}
+	}
+
+	return changed;
+}
+
+static int rpi_cirrus_spdif_mask_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	ucontrol->value.iec958.status[0] = 0xff;
+	ucontrol->value.iec958.status[1] = 0xff;
+	ucontrol->value.iec958.status[2] = 0xff;
+	ucontrol->value.iec958.status[3] = 0x3f;
+
+	return 0;
+}
+
+static int rpi_cirrus_spdif_capture_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_component *wm8804_component =
+		get_wm8804_runtime(card)->codec_dai->component;
+	unsigned int val, mask;
+	int i, ret;
+
+	for (i = 0; i < 4; i++) {
+		ret = snd_soc_component_read(wm8804_component,
+			WM8804_RXCHAN1 + i, &val);
+		if (ret)
+			return ret;
+		mask = (i == 3) ? 0x3f : 0xff;
+		ucontrol->value.iec958.status[i] = val & mask;
+	}
+
+	return 0;
+}
+
+#define SPDIF_FLAG_CTRL(desc, reg, bit, invert) \
+{ \
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ \
+			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER, \
+		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE) \
+				desc " Flag", \
+		.info =    snd_ctl_boolean_mono_info, \
+		.get =     rpi_cirrus_spdif_status_flag_get, \
+		.private_value = \
+			(bit) | ((reg) << 8) | ((invert) << 16) \
+}
+
+static int rpi_cirrus_spdif_status_flag_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_component *wm8804_component =
+		get_wm8804_runtime(card)->codec_dai->component;
+
+	unsigned int bit = kcontrol->private_value & 0xff;
+	unsigned int reg = (kcontrol->private_value >> 8) & 0xff;
+	unsigned int invert = (kcontrol->private_value >> 16) & 0xff;
+	int ret;
+	unsigned int val;
+	bool flag;
+
+	ret = snd_soc_component_read(wm8804_component, reg, &val);
+	if (ret)
+		return ret;
+
+	flag = val & (1 << bit);
+
+	ucontrol->value.integer.value[0] = invert ? !flag : flag;
+
+	return 0;
+}
+
+static const char * const recovered_frequency_texts[] = {
+	"176.4/192 kHz",
+	"88.2/96 kHz",
+	"44.1/48 kHz",
+	"32 kHz"
+};
+
+#define NUM_RECOVERED_FREQUENCIES \
+	ARRAY_SIZE(recovered_frequency_texts)
+
+static int rpi_cirrus_recovered_frequency_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+	uinfo->count = 1;
+	uinfo->value.enumerated.items = NUM_RECOVERED_FREQUENCIES;
+	if (uinfo->value.enumerated.item >= NUM_RECOVERED_FREQUENCIES)
+		uinfo->value.enumerated.item = NUM_RECOVERED_FREQUENCIES - 1;
+	strcpy(uinfo->value.enumerated.name,
+		recovered_frequency_texts[uinfo->value.enumerated.item]);
+	return 0;
+}
+
+static int rpi_cirrus_recovered_frequency_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_component *wm8804_component =
+		get_wm8804_runtime(card)->codec_dai->component;
+	unsigned int val;
+	int ret;
+
+	ret = snd_soc_component_read(wm8804_component, WM8804_SPDSTAT, &val);
+	if (ret)
+		return ret;
+
+	ucontrol->value.enumerated.item[0] = (val >> 4) & 0x03;
+	return 0;
+}
+
+static const struct snd_kcontrol_new rpi_cirrus_controls[] = {
+	{
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    "Min Sample Rate",
+		.info =    rpi_cirrus_min_rate_info,
+		.get =     rpi_cirrus_min_rate_get,
+		.put =     rpi_cirrus_min_rate_put,
+	},
+	{
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    "Max Sample Rate",
+		.info =    rpi_cirrus_max_rate_info,
+		.get =     rpi_cirrus_max_rate_get,
+		.put =     rpi_cirrus_max_rate_put,
+	},
+	{
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
+		.info =    rpi_cirrus_spdif_info,
+		.get =     rpi_cirrus_spdif_playback_get,
+		.put =     rpi_cirrus_spdif_playback_put,
+	},
+	{
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ
+			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, DEFAULT),
+		.info =    rpi_cirrus_spdif_info,
+		.get =     rpi_cirrus_spdif_capture_get,
+	},
+	{
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ,
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, MASK),
+		.info =    rpi_cirrus_spdif_info,
+		.get =     rpi_cirrus_spdif_mask_get,
+	},
+	{
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ
+			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE)
+				"Recovered Frequency",
+		.info =    rpi_cirrus_recovered_frequency_info,
+		.get =     rpi_cirrus_recovered_frequency_get,
+	},
+	SPDIF_FLAG_CTRL("Audio", WM8804_SPDSTAT, 0, 1),
+	SPDIF_FLAG_CTRL("Non-PCM", WM8804_SPDSTAT, 1, 0),
+	SPDIF_FLAG_CTRL("Copyright", WM8804_SPDSTAT, 2, 1),
+	SPDIF_FLAG_CTRL("De-Emphasis", WM8804_SPDSTAT, 3, 0),
+	SPDIF_FLAG_CTRL("Lock", WM8804_SPDSTAT, 6, 1),
+	SPDIF_FLAG_CTRL("Invalid", WM8804_INTSTAT, 1, 0),
+	SPDIF_FLAG_CTRL("TransErr", WM8804_INTSTAT, 3, 0),
+};
+
+static const char * const linein_micbias_texts[] = {
+	"off", "on",
+};
+
+static SOC_ENUM_SINGLE_VIRT_DECL(linein_micbias_enum,
+	linein_micbias_texts);
+
+static const struct snd_kcontrol_new linein_micbias_mux =
+	SOC_DAPM_ENUM("Route", linein_micbias_enum);
+
+static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *kcontrol, int event);
+
+const struct snd_soc_dapm_widget rpi_cirrus_dapm_widgets[] = {
+	SND_SOC_DAPM_MIC("DMIC", NULL),
+	SND_SOC_DAPM_MIC("Headset Mic", NULL),
+	SND_SOC_DAPM_INPUT("Line Input"),
+	SND_SOC_DAPM_MIC("Line Input with Micbias", NULL),
+	SND_SOC_DAPM_MUX("Line Input Micbias", SND_SOC_NOPM, 0, 0,
+		&linein_micbias_mux),
+	SND_SOC_DAPM_INPUT("dummy SPDIF in"),
+	SND_SOC_DAPM_PGA_E("dummy SPDIFRX", SND_SOC_NOPM, 0, 0, NULL, 0,
+		rpi_cirrus_spdif_rx_enable_event,
+		SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_INPUT("Dummy Input"),
+	SND_SOC_DAPM_OUTPUT("Dummy Output"),
+};
+
+const struct snd_soc_dapm_route rpi_cirrus_dapm_routes[] = {
+	{ "IN1L", NULL, "Headset Mic" },
+	{ "IN1R", NULL, "Headset Mic" },
+	{ "Headset Mic", NULL, "MICBIAS1" },
+
+	{ "IN2L", NULL, "DMIC" },
+	{ "IN2R", NULL, "DMIC" },
+	{ "DMIC", NULL, "MICBIAS2" },
+
+	{ "IN3L", NULL, "Line Input Micbias" },
+	{ "IN3R", NULL, "Line Input Micbias" },
+
+	{ "Line Input Micbias", "off", "Line Input" },
+	{ "Line Input Micbias", "on", "Line Input with Micbias" },
+
+	/* Make sure MICVDD is enabled, otherwise we get noise */
+	{ "Line Input", NULL, "MICVDD" },
+	{ "Line Input with Micbias", NULL, "MICBIAS3" },
+
+	/* Dummy routes to check whether SPDIF RX is enabled or not */
+	{"dummy SPDIFRX", NULL, "dummy SPDIF in"},
+	{"AIFTX", NULL, "dummy SPDIFRX"},
+
+	/*
+	 * Dummy routes to keep wm5102 from staying off on
+	 * playback/capture if all mixers are off.
+	 */
+	{ "Dummy Output", NULL, "AIF1RX1" },
+	{ "Dummy Output", NULL, "AIF1RX2" },
+	{ "AIF1TX1", NULL, "Dummy Input" },
+	{ "AIF1TX2", NULL, "Dummy Input" },
+};
+
+static int rpi_cirrus_clear_flls(struct snd_soc_card *card,
+	struct snd_soc_component *wm5102_component) {
+
+	int ret1, ret2;
+
+	ret1 = snd_soc_component_set_pll(wm5102_component,
+		WM5102_FLL1, ARIZONA_FLL_SRC_NONE, 0, 0);
+	ret2 = snd_soc_component_set_pll(wm5102_component,
+		WM5102_FLL1_REFCLK, ARIZONA_FLL_SRC_NONE, 0, 0);
+
+	if (ret1) {
+		dev_warn(card->dev,
+			"setting FLL1 to zero failed: %d\n", ret1);
+		return ret1;
+	}
+	if (ret2) {
+		dev_warn(card->dev,
+			"setting FLL1_REFCLK to zero failed: %d\n", ret2);
+		return ret2;
+	}
+	return 0;
+}
+
+static int rpi_cirrus_set_fll(struct snd_soc_card *card,
+	struct snd_soc_component *wm5102_component, unsigned int clk_freq)
+{
+	int ret = snd_soc_component_set_pll(wm5102_component,
+		WM5102_FLL1,
+		ARIZONA_CLK_SRC_MCLK1,
+		WM8804_CLKOUT_HZ,
+		clk_freq);
+	if (ret)
+		dev_err(card->dev, "Failed to set FLL1 to %d: %d\n",
+			clk_freq, ret);
+
+	usleep_range(1000, 2000);
+	return ret;
+}
+
+static int rpi_cirrus_set_fll_refclk(struct snd_soc_card *card,
+	struct snd_soc_component *wm5102_component,
+	unsigned int clk_freq, unsigned int aif2_freq)
+{
+	int ret = snd_soc_component_set_pll(wm5102_component,
+		WM5102_FLL1_REFCLK,
+		ARIZONA_CLK_SRC_MCLK1,
+		WM8804_CLKOUT_HZ,
+		clk_freq);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set FLL1_REFCLK to %d: %d\n",
+			clk_freq, ret);
+		return ret;
+	}
+
+	ret = snd_soc_component_set_pll(wm5102_component,
+		WM5102_FLL1,
+		ARIZONA_CLK_SRC_AIF2BCLK,
+		aif2_freq, clk_freq);
+	if (ret)
+		dev_err(card->dev,
+			"Failed to set FLL1 with Sync Clock %d to %d: %d\n",
+			aif2_freq, clk_freq, ret);
+
+	usleep_range(1000, 2000);
+	return ret;
+}
+
+static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_card *card = w->dapm->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_component *wm5102_component =
+		get_wm5102_runtime(card)->codec_dai->component;
+
+	unsigned int clk_freq, aif2_freq;
+	int ret = 0;
+
+	switch (event) {
+	case SND_SOC_DAPM_POST_PMU:
+		mutex_lock(&priv->lock);
+
+		/* Enable sync path in case of SPDIF capture use case */
+
+		clk_freq = calc_sysclk(priv->card_rate);
+		aif2_freq = 64 * priv->card_rate;
+
+		dev_dbg(card->dev,
+			"spdif_rx: changing FLL1 to use Ref Clock clk: %d spdif: %d\n",
+			clk_freq, aif2_freq);
+
+		ret = rpi_cirrus_clear_flls(card, wm5102_component);
+		if (ret) {
+			dev_err(card->dev, "spdif_rx: failed to clear FLLs\n");
+			goto out;
+		}
+
+		ret = rpi_cirrus_set_fll_refclk(card, wm5102_component,
+			clk_freq, aif2_freq);
+
+		if (ret) {
+			dev_err(card->dev, "spdif_rx: failed to set FLLs\n");
+			goto out;
+		}
+
+		/* set to negative to indicate we're doing spdif rx */
+		priv->fll1_freq = -clk_freq;
+		priv->sync_path_enable = 1;
+		break;
+
+	case SND_SOC_DAPM_POST_PMD:
+		mutex_lock(&priv->lock);
+		priv->sync_path_enable = 0;
+		break;
+
+	default:
+		return 0;
+	}
+
+out:
+	mutex_unlock(&priv->lock);
+	return ret;
+}
+
+static int rpi_cirrus_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm,
+	enum snd_soc_bias_level level)
+{
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
+	struct snd_soc_component *wm5102_component =
+		wm5102_runtime->codec_dai->component;
+
+	int ret = 0;
+	unsigned int clk_freq;
+
+	if (dapm->dev != wm5102_runtime->codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level == SND_SOC_BIAS_ON)
+			break;
+
+		mutex_lock(&priv->lock);
+
+		if (!priv->sync_path_enable) {
+			clk_freq = calc_sysclk(priv->card_rate);
+
+			dev_dbg(card->dev,
+				"set_bias: changing FLL1 from %d to %d\n",
+				priv->fll1_freq, clk_freq);
+
+			ret = rpi_cirrus_set_fll(card,
+				wm5102_component, clk_freq);
+			if (ret)
+				dev_err(card->dev,
+					"set_bias: Failed to set FLL1\n");
+			else
+				priv->fll1_freq = clk_freq;
+		}
+		mutex_unlock(&priv->lock);
+		break;
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+static int rpi_cirrus_set_bias_level_post(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm,
+	enum snd_soc_bias_level level)
+{
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
+	struct snd_soc_component *wm5102_component =
+		wm5102_runtime->codec_dai->component;
+
+	if (dapm->dev != wm5102_runtime->codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_STANDBY:
+		mutex_lock(&priv->lock);
+
+		dev_dbg(card->dev,
+			"set_bias_post: changing FLL1 from %d to off\n",
+				priv->fll1_freq);
+
+		if (rpi_cirrus_clear_flls(card, wm5102_component))
+			dev_err(card->dev,
+				"set_bias_post: failed to clear FLLs\n");
+		else
+			priv->fll1_freq = 0;
+
+		mutex_unlock(&priv->lock);
+
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int rpi_cirrus_set_wm8804_pll(struct snd_soc_card *card,
+	struct snd_soc_dai *wm8804_dai, unsigned int rate)
+{
+	int ret;
+
+	/* use 256fs */
+	unsigned int clk_freq = rate * 256;
+
+	ret = snd_soc_dai_set_pll(wm8804_dai, 0, 0,
+		WM8804_CLKOUT_HZ, clk_freq);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set WM8804 PLL to %d: %d\n", clk_freq, ret);
+		return ret;
+	}
+
+	/* Set MCLK as PLL Output */
+	ret = snd_soc_dai_set_sysclk(wm8804_dai,
+		WM8804_TX_CLKSRC_PLL, clk_freq, 0);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set MCLK as PLL Output: %d\n", ret);
+		return ret;
+	}
+
+	return ret;
+}
+
+static int rpi_cirrus_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	unsigned int min_rate = min_rates[priv->min_rate_idx].value;
+	unsigned int max_rate = max_rates[priv->max_rate_idx].value;
+
+	if (min_rate || max_rate) {
+		if (max_rate == 0)
+			max_rate = UINT_MAX;
+
+		dev_dbg(card->dev,
+			"startup: limiting rate to %u-%u\n",
+			min_rate, max_rate);
+
+		snd_pcm_hw_constraint_minmax(substream->runtime,
+			SNDRV_PCM_HW_PARAM_RATE, min_rate, max_rate);
+	}
+
+	return 0;
+}
+
+static struct snd_soc_pcm_stream rpi_cirrus_dai_link2_params = {
+	.formats = SNDRV_PCM_FMTBIT_S24_LE,
+	.channels_min = 2,
+	.channels_max = 2,
+	.rate_min = RPI_CIRRUS_DEFAULT_RATE,
+	.rate_max = RPI_CIRRUS_DEFAULT_RATE,
+};
+
+static int rpi_cirrus_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_dai *bcm_i2s_dai = rtd->cpu_dai;
+	struct snd_soc_component *wm5102_component = rtd->codec_dai->component;
+	struct snd_soc_dai *wm8804_dai = get_wm8804_runtime(card)->codec_dai;
+
+	int ret;
+
+	unsigned int width = snd_pcm_format_physical_width(
+		params_format(params));
+	unsigned int rate = params_rate(params);
+	unsigned int clk_freq = calc_sysclk(rate);
+
+	mutex_lock(&priv->lock);
+
+	dev_dbg(card->dev, "hw_params: setting rate to %d\n", rate);
+
+	ret = snd_soc_dai_set_bclk_ratio(bcm_i2s_dai, 2 * width);
+	if (ret) {
+		dev_err(card->dev, "set_bclk_ratio failed: %d\n", ret);
+		goto out;
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03, 2, width);
+	if (ret) {
+		dev_err(card->dev, "set_tdm_slot failed: %d\n", ret);
+		goto out;
+	}
+
+	/* WM8804 supports sample rates from 32k only */
+	if (rate >= 32000) {
+		ret = rpi_cirrus_set_wm8804_pll(card, wm8804_dai, rate);
+		if (ret)
+			goto out;
+	}
+
+	ret = snd_soc_component_set_sysclk(wm5102_component,
+		ARIZONA_CLK_SYSCLK,
+		ARIZONA_CLK_SRC_FLL1,
+		clk_freq,
+		SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(card->dev, "Failed to set SYSCLK: %d\n", ret);
+		goto out;
+	}
+
+	if ((priv->fll1_freq > 0) && (priv->fll1_freq != clk_freq)) {
+		dev_dbg(card->dev,
+			"hw_params: changing FLL1 from %d to %d\n",
+			priv->fll1_freq, clk_freq);
+
+		if (rpi_cirrus_clear_flls(card, wm5102_component)) {
+			dev_err(card->dev, "hw_params: failed to clear FLLs\n");
+			goto out;
+		}
+
+		if (rpi_cirrus_set_fll(card, wm5102_component, clk_freq)) {
+			dev_err(card->dev, "hw_params: failed to set FLL\n");
+			goto out;
+		}
+
+		priv->fll1_freq = clk_freq;
+	}
+
+	priv->card_rate = rate;
+	rpi_cirrus_dai_link2_params.rate_min = rate;
+	rpi_cirrus_dai_link2_params.rate_max = rate;
+
+	priv->params_set |= 1 << substream->stream;
+
+out:
+	mutex_unlock(&priv->lock);
+
+	return ret;
+}
+
+static int rpi_cirrus_hw_free(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_component *wm5102_component = rtd->codec_dai->component;
+	int ret;
+	unsigned int old_params_set = priv->params_set;
+
+	priv->params_set &= ~(1 << substream->stream);
+
+	/* disable sysclk if this was the last open stream */
+	if (priv->params_set == 0 && old_params_set) {
+		dev_dbg(card->dev,
+			"hw_free: Setting SYSCLK to Zero\n");
+
+		ret = snd_soc_component_set_sysclk(wm5102_component,
+			ARIZONA_CLK_SYSCLK,
+			ARIZONA_CLK_SRC_FLL1,
+			0,
+			SND_SOC_CLOCK_IN);
+		if (ret)
+			dev_err(card->dev,
+				"hw_free: Failed to set SYSCLK to Zero: %d\n",
+				ret);
+	}
+	return 0;
+}
+
+static int rpi_cirrus_init_wm5102(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	int ret;
+
+	/* no 32kHz input, derive it from sysclk if needed  */
+	snd_soc_component_update_bits(component,
+			ARIZONA_CLOCK_32K_1, ARIZONA_CLK_32K_SRC_MASK, 2);
+
+	if (rpi_cirrus_clear_flls(rtd->card, component))
+		dev_warn(rtd->card->dev,
+			"init_wm5102: failed to clear FLLs\n");
+
+	ret = snd_soc_component_set_sysclk(component,
+		ARIZONA_CLK_SYSCLK, ARIZONA_CLK_SRC_FLL1,
+		0, SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(rtd->card->dev,
+			"Failed to set SYSCLK to Zero: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int rpi_cirrus_init_wm8804(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_component *component = codec_dai->component;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	unsigned int val, mask;
+	int i, ret;
+
+	for (i = 0; i < 4; i++) {
+		ret = snd_soc_component_read(component,
+			WM8804_SPDTX1 + i, &val);
+		if (ret)
+			return ret;
+		mask = (i == 3) ? 0x3f : 0xff;
+		priv->iec958_status[i] = val & mask;
+	}
+
+	/* Setup for 256fs */
+	ret = snd_soc_dai_set_clkdiv(codec_dai,
+		WM8804_MCLK_DIV, WM8804_MCLKDIV_256FS);
+	if (ret) {
+		dev_err(card->dev,
+			"init_wm8804: Failed to set MCLK_DIV to 256fs: %d\n",
+			ret);
+		return ret;
+	}
+
+	/* Output OSC on CLKOUT */
+	ret = snd_soc_dai_set_sysclk(codec_dai,
+		WM8804_CLKOUT_SRC_OSCCLK, WM8804_CLKOUT_HZ, 0);
+	if (ret)
+		dev_err(card->dev,
+			"init_wm8804: Failed to set CLKOUT as OSC Frequency: %d\n",
+			ret);
+
+	/* Init PLL with default samplerate */
+	ret = rpi_cirrus_set_wm8804_pll(card, codec_dai,
+		RPI_CIRRUS_DEFAULT_RATE);
+	if (ret)
+		dev_err(card->dev,
+			"init_wm8804: Failed to setup PLL for %dHz: %d\n",
+			RPI_CIRRUS_DEFAULT_RATE, ret);
+
+	return ret;
+}
+
+static struct snd_soc_ops rpi_cirrus_ops = {
+	.startup = rpi_cirrus_startup,
+	.hw_params = rpi_cirrus_hw_params,
+	.hw_free = rpi_cirrus_hw_free,
+};
+
+static struct snd_soc_dai_link rpi_cirrus_dai[] = {
+	[DAI_WM5102] = {
+		.name		= "WM5102",
+		.stream_name	= "WM5102 AiFi",
+		.codec_dai_name	= "wm5102-aif1",
+		.codec_name	= "wm5102-codec",
+		.dai_fmt	=   SND_SOC_DAIFMT_I2S
+				  | SND_SOC_DAIFMT_NB_NF
+				  | SND_SOC_DAIFMT_CBM_CFM,
+		.ops		= &rpi_cirrus_ops,
+		.init		= rpi_cirrus_init_wm5102,
+	},
+	[DAI_WM8804] = {
+		.name		= "WM5102 SPDIF",
+		.stream_name	= "SPDIF Tx/Rx",
+		.cpu_dai_name	= "wm5102-aif2",
+		.codec_dai_name	= "wm8804-spdif",
+		.codec_name	= "wm8804.1-003b",
+		.dai_fmt	=   SND_SOC_DAIFMT_I2S
+				  | SND_SOC_DAIFMT_NB_NF
+				  | SND_SOC_DAIFMT_CBM_CFM,
+		.ignore_suspend = 1,
+		.params		= &rpi_cirrus_dai_link2_params,
+		.init		= rpi_cirrus_init_wm8804,
+	},
+};
+
+
+static int rpi_cirrus_late_probe(struct snd_soc_card *card)
+{
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
+	struct snd_soc_pcm_runtime *wm8804_runtime = get_wm8804_runtime(card);
+	int ret;
+
+	dev_dbg(card->dev, "iec958_bits: %02x %02x %02x %02x\n",
+		priv->iec958_status[0],
+		priv->iec958_status[1],
+		priv->iec958_status[2],
+		priv->iec958_status[3]);
+
+	ret = snd_soc_dai_set_sysclk(
+		wm5102_runtime->codec_dai, ARIZONA_CLK_SYSCLK, 0, 0);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set WM5102 codec dai clk domain: %d\n", ret);
+		return ret;
+	}
+
+	ret = snd_soc_dai_set_sysclk(
+		wm8804_runtime->cpu_dai, ARIZONA_CLK_SYSCLK, 0, 0);
+	if (ret)
+		dev_err(card->dev,
+			"Failed to set WM8804 codec dai clk domain: %d\n", ret);
+
+	return ret;
+}
+
+/* audio machine driver */
+static struct snd_soc_card rpi_cirrus_card = {
+	.name			= "RPi-Cirrus",
+	.driver_name		= "RPiCirrus",
+	.owner			= THIS_MODULE,
+	.dai_link		= rpi_cirrus_dai,
+	.num_links		= ARRAY_SIZE(rpi_cirrus_dai),
+	.late_probe		= rpi_cirrus_late_probe,
+	.controls		= rpi_cirrus_controls,
+	.num_controls		= ARRAY_SIZE(rpi_cirrus_controls),
+	.dapm_widgets		= rpi_cirrus_dapm_widgets,
+	.num_dapm_widgets	= ARRAY_SIZE(rpi_cirrus_dapm_widgets),
+	.dapm_routes		= rpi_cirrus_dapm_routes,
+	.num_dapm_routes	= ARRAY_SIZE(rpi_cirrus_dapm_routes),
+	.set_bias_level		= rpi_cirrus_set_bias_level,
+	.set_bias_level_post	= rpi_cirrus_set_bias_level_post,
+};
+
+static int rpi_cirrus_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct rpi_cirrus_priv *priv;
+	struct device_node *i2s_node;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->min_rate_idx = 1; /* min samplerate 32kHz */
+	priv->card_rate = RPI_CIRRUS_DEFAULT_RATE;
+
+	mutex_init(&priv->lock);
+
+	snd_soc_card_set_drvdata(&rpi_cirrus_card, priv);
+
+	if (!pdev->dev.of_node)
+		return -ENODEV;
+
+	i2s_node = of_parse_phandle(
+			pdev->dev.of_node, "i2s-controller", 0);
+	if (!i2s_node) {
+		dev_err(&pdev->dev, "i2s-controller missing in DT\n");
+		return -ENODEV;
+	}
+
+	rpi_cirrus_dai[DAI_WM5102].cpu_of_node = i2s_node;
+	rpi_cirrus_dai[DAI_WM5102].platform_of_node = i2s_node;
+
+	rpi_cirrus_card.dev = &pdev->dev;
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &rpi_cirrus_card);
+	if (ret) {
+		if (ret == -EPROBE_DEFER)
+			dev_dbg(&pdev->dev,
+				"register card requested probe deferral\n");
+		else
+			dev_err(&pdev->dev,
+				"Failed to register card: %d\n", ret);
+	}
+
+	return ret;
+}
+
+static const struct of_device_id rpi_cirrus_of_match[] = {
+	{ .compatible = "wlf,rpi-cirrus", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rpi_cirrus_of_match);
+
+static struct platform_driver rpi_cirrus_driver = {
+	.driver	= {
+		.name   = "snd-rpi-cirrus",
+		.of_match_table = of_match_ptr(rpi_cirrus_of_match),
+	},
+	.probe	= rpi_cirrus_probe,
+};
+
+module_platform_driver(rpi_cirrus_driver);
+
+MODULE_AUTHOR("Matthias Reichl <hias@horus.com>");
+MODULE_DESCRIPTION("ASoC driver for Cirrus Logic Audio Card");
+MODULE_LICENSE("GPL");
-- 
GitLab


From dce438cde3806ba389485235562970be140f6c2c Mon Sep 17 00:00:00 2001
From: Miquel <miquelblauw@hotmail.com>
Date: Fri, 24 Feb 2017 20:51:06 +0100
Subject: [PATCH 0080/1835] sound: Support for Dion Audio LOCO-V2 DAC-AMP HAT

Signed-off-by: Miquel Blauw <info@dionaudio.nl>

ASoC: dionaudio_loco-v2: fix S24_LE format

Remove set_bclk_ratio call so 24-bit data is transmitted in
24 bclk cycles.

Also remove hw_params and ops as they are no longer needed.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/dionaudio_loco-v2.c | 115 ++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 sound/soc/bcm/dionaudio_loco-v2.c

diff --git a/sound/soc/bcm/dionaudio_loco-v2.c b/sound/soc/bcm/dionaudio_loco-v2.c
new file mode 100644
index 0000000000000..192cbfd7baca5
--- /dev/null
+++ b/sound/soc/bcm/dionaudio_loco-v2.c
@@ -0,0 +1,115 @@
+/*
+ * ASoC Driver for Dion Audio LOCO-V2 DAC-AMP
+ *
+ * Author:      Miquel Blauw <info@dionaudio.nl>
+ *              Copyright 2017
+ *
+ * Based on the software of the RPi-DAC writen by Florian Meier
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static bool digital_gain_0db_limit = true;
+
+static int snd_rpi_dionaudio_loco_v2_init(struct snd_soc_pcm_runtime *rtd)
+{
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_rpi_dionaudio_loco_v2_dai[] = {
+{
+	.name		= "DionAudio LOCO-V2",
+	.stream_name	= "DionAudio LOCO-V2 DAC-AMP",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.init		= snd_rpi_dionaudio_loco_v2_init,
+},};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_dionaudio_loco_v2 = {
+	.name         = "Dion Audio LOCO-V2",
+	.dai_link     = snd_rpi_dionaudio_loco_v2_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_dionaudio_loco_v2_dai),
+};
+
+static int snd_rpi_dionaudio_loco_v2_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_dionaudio_loco_v2.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai =
+					&snd_rpi_dionaudio_loco_v2_dai[0];
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "dionaudio,24db_digital_gain");
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_dionaudio_loco_v2);
+	if (ret)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static const struct of_device_id dionaudio_of_match[] = {
+	{ .compatible = "dionaudio,dionaudio-loco-v2", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, dionaudio_of_match);
+
+static struct platform_driver snd_rpi_dionaudio_loco_v2_driver = {
+	.driver = {
+		.name   = "snd-rpi-dionaudio-loco-v2",
+		.owner  = THIS_MODULE,
+		.of_match_table = dionaudio_of_match,
+	},
+	.probe          = snd_rpi_dionaudio_loco_v2_probe,
+};
+
+module_platform_driver(snd_rpi_dionaudio_loco_v2_driver);
+
+MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
+MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO-V2");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 8acf2fed23b4f6916fa4e44759c7369258ff2821 Mon Sep 17 00:00:00 2001
From: Fe-Pi <fe-pi@cox.net>
Date: Wed, 1 Mar 2017 04:42:43 -0700
Subject: [PATCH 0081/1835] Add support for Fe-Pi audio sound card. (#1867)

Fe-Pi Audio Sound Card is based on NXP SGTL5000 codec.
Mechanical specification of the board is the same the Raspberry Pi Zero.
3.5mm jacks for Headphone/Mic, Line In, and Line Out.

Signed-off-by: Henry Kupis <fe-pi@cox.net>
---
 sound/soc/bcm/fe-pi-audio.c | 152 ++++++++++++++++++++++++++++++++++++
 1 file changed, 152 insertions(+)
 create mode 100644 sound/soc/bcm/fe-pi-audio.c

diff --git a/sound/soc/bcm/fe-pi-audio.c b/sound/soc/bcm/fe-pi-audio.c
new file mode 100644
index 0000000000000..c5686eb15b4bc
--- /dev/null
+++ b/sound/soc/bcm/fe-pi-audio.c
@@ -0,0 +1,152 @@
+/*
+ * ASoC Driver for Fe-Pi Audio Sound Card
+ *
+ * Author:	Henry Kupis <kuupaz@gmail.com>
+ *		Copyright 2016
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *		based on code by Shawn Guo <shawn.guo@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/sgtl5000.h"
+
+static int snd_fe_pi_audio_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_dapm_force_enable_pin(&card->dapm, "LO");
+	snd_soc_dapm_force_enable_pin(&card->dapm, "ADC");
+	snd_soc_dapm_force_enable_pin(&card->dapm, "DAC");
+	snd_soc_dapm_force_enable_pin(&card->dapm, "HP");
+	snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
+			SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
+
+	return 0;
+}
+
+static int snd_fe_pi_audio_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct device *dev = rtd->card->dev;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+
+	int ret;
+
+	/* Set SGTL5000's SYSCLK */
+	ret = snd_soc_dai_set_sysclk(codec_dai, SGTL5000_SYSCLK, 12288000, SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(dev, "could not set codec driver clock params\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+
+static struct snd_soc_ops snd_fe_pi_audio_ops = {
+	.hw_params = snd_fe_pi_audio_hw_params,
+};
+
+static struct snd_soc_dai_link snd_fe_pi_audio_dai[] = {
+	{
+		.name		= "FE-PI",
+		.stream_name	= "Fe-Pi HiFi",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.codec_dai_name	= "sgtl5000",
+		.platform_name	= "bcm2708-i2s.0",
+		.codec_name	= "sgtl5000.1-000a",
+		.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+					SND_SOC_DAIFMT_CBM_CFM,
+		.ops		= &snd_fe_pi_audio_ops,
+		.init		= snd_fe_pi_audio_init,
+	},
+};
+
+static const struct snd_soc_dapm_route fe_pi_audio_dapm_routes[] = {
+	{"ADC", NULL, "Mic Bias"},
+};
+
+
+static struct snd_soc_card fe_pi_audio = {
+	.name         = "Fe-Pi Audio",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_fe_pi_audio_dai,
+	.num_links    = ARRAY_SIZE(snd_fe_pi_audio_dai),
+
+	.dapm_routes = fe_pi_audio_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(fe_pi_audio_dapm_routes),
+};
+
+static int snd_fe_pi_audio_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct snd_soc_card *card = &fe_pi_audio;
+	struct device_node *np = pdev->dev.of_node;
+	struct device_node *i2s_node;
+	struct snd_soc_dai_link *dai = &snd_fe_pi_audio_dai[0];
+
+	fe_pi_audio.dev = &pdev->dev;
+
+	i2s_node = of_parse_phandle(np, "i2s-controller", 0);
+	if (!i2s_node) {
+		dev_err(&pdev->dev, "i2s_node phandle missing or invalid\n");
+		return -EINVAL;
+	}
+
+	dai->cpu_dai_name = NULL;
+	dai->cpu_of_node = i2s_node;
+	dai->platform_name = NULL;
+	dai->platform_of_node = i2s_node;
+
+	of_node_put(i2s_node);
+
+	card->dev = &pdev->dev;
+	platform_set_drvdata(pdev, card);
+
+	ret = devm_snd_soc_register_card(&pdev->dev, card);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_fe_pi_audio_of_match[] = {
+	{ .compatible = "fe-pi,fe-pi-audio", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_fe_pi_audio_of_match);
+
+static struct platform_driver snd_fe_pi_audio_driver = {
+        .driver = {
+                .name   = "snd-fe-pi-audio",
+                .owner  = THIS_MODULE,
+                .of_match_table = snd_fe_pi_audio_of_match,
+        },
+        .probe          = snd_fe_pi_audio_probe,
+};
+
+module_platform_driver(snd_fe_pi_audio_driver);
+
+MODULE_AUTHOR("Henry Kupis <fe-pi@cox.net>");
+MODULE_DESCRIPTION("ASoC Driver for Fe-Pi Audio");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From ee5c2ea57a7d83fd4578ec14025fdcb37d9bbe97 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Wed, 8 Mar 2017 20:04:13 +1100
Subject: [PATCH 0082/1835] Add support for the AudioInjector.net Octo sound
 card

AudioInjector Octo: sample rates, regulators, reset

This patch adds new sample rates to the Audioinjector Octo sound card. The
new supported rates are (in kHz) :
96, 48, 32, 24, 16, 8, 88.2, 44.1, 29.4, 22.05, 14.7

Reference the bcm270x DT regulators in the overlay.

This patch adds a reset GPIO for the AudioInjector.net octo sound card.

Audioinjector octo : Make the playback and capture symmetric

This patch ensures that the sample rate and channel count of the audioinjector
octo sound card are symmetric.

audioinjector-octo: Add continuous clock feature

By user request, add a switch to prevent the clocks being stopped when
the stream is paused, stopped or shutdown. Provide access to the switch
by adding a 'non-stop-clocks' parameter to the audioinjector-addons
overlay.

See: https://github.com/raspberrypi/linux/issues/2409

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 sound/soc/bcm/audioinjector-octo-soundcard.c | 336 +++++++++++++++++++
 1 file changed, 336 insertions(+)
 create mode 100644 sound/soc/bcm/audioinjector-octo-soundcard.c

diff --git a/sound/soc/bcm/audioinjector-octo-soundcard.c b/sound/soc/bcm/audioinjector-octo-soundcard.c
new file mode 100644
index 0000000000000..6029a12d77cc0
--- /dev/null
+++ b/sound/soc/bcm/audioinjector-octo-soundcard.c
@@ -0,0 +1,336 @@
+/*
+ * ASoC Driver for AudioInjector Pi octo channel soundcard (hat)
+ *
+ *  Created on: 27-October-2016
+ *      Author: flatmax@flatmax.org
+ *              based on audioinjector-pi-soundcard.c
+ *
+ * Copyright (C) 2016 Flatmax Pty. Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/gpio/consumer.h>
+
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include <sound/control.h>
+
+static struct gpio_descs *mult_gpios;
+static struct gpio_desc *codec_rst_gpio;
+static unsigned int audioinjector_octo_rate;
+static bool non_stop_clocks;
+
+static const unsigned int audioinjector_octo_rates[] = {
+	96000, 48000, 32000, 24000, 16000, 8000, 88200, 44100, 29400, 22050, 14700,
+};
+
+static struct snd_pcm_hw_constraint_list audioinjector_octo_constraints = {
+	.list = audioinjector_octo_rates,
+	.count = ARRAY_SIZE(audioinjector_octo_rates),
+};
+
+static int audioinjector_octo_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return snd_soc_dai_set_bclk_ratio(rtd->cpu_dai, 64);
+}
+
+static int audioinjector_octo_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	rtd->cpu_dai->driver->playback.channels_min = 8;
+	rtd->cpu_dai->driver->playback.channels_max = 8;
+	rtd->cpu_dai->driver->capture.channels_min = 8;
+	rtd->cpu_dai->driver->capture.channels_max = 8;
+	rtd->codec_dai->driver->capture.channels_max = 8;
+	
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_RATE,
+				&audioinjector_octo_constraints);
+
+	return 0;
+}
+
+static void audioinjector_octo_shutdown(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	rtd->cpu_dai->driver->playback.channels_min = 2;
+	rtd->cpu_dai->driver->playback.channels_max = 2;
+	rtd->cpu_dai->driver->capture.channels_min = 2;
+	rtd->cpu_dai->driver->capture.channels_max = 2;
+	rtd->codec_dai->driver->capture.channels_max = 6;
+}
+
+static int audioinjector_octo_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+
+	// set codec DAI configuration
+	int ret = snd_soc_dai_set_fmt(rtd->codec_dai,
+			SND_SOC_DAIFMT_CBS_CFS|SND_SOC_DAIFMT_DSP_A|
+			SND_SOC_DAIFMT_NB_NF);
+	if (ret < 0)
+		return ret;
+
+	// set cpu DAI configuration
+	ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+			SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|
+			SND_SOC_DAIFMT_NB_NF);
+	if (ret < 0)
+		return ret;
+
+	audioinjector_octo_rate = params_rate(params);
+
+	// Set the correct sysclock for the codec
+	switch (audioinjector_octo_rate) {
+	case 96000:
+	case 48000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000,
+									0);
+		break;
+	case 24000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000/2,
+									0);
+		break;
+	case 32000:
+	case 16000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000/3,
+									0);
+		break;
+	case 8000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000/6,
+									0);
+		break;
+	case 88200:
+	case 44100:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 45185400,
+									0);
+		break;
+	case 22050:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 45185400/2,
+									0);
+		break;
+	case 29400:
+	case 14700:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 45185400/3,
+									0);
+		break;
+	default:
+		return -EINVAL;
+	}
+}
+
+static int audioinjector_octo_trigger(struct snd_pcm_substream *substream,
+								int cmd){
+	int mult[4];
+
+	memset(mult, 0, sizeof(mult));
+
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_STOP:
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		if (!non_stop_clocks)
+			break;
+		/* Drop through... */
+	case SNDRV_PCM_TRIGGER_START:
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		switch (audioinjector_octo_rate) {
+		case 96000:
+			mult[3] = 1;
+		case 88200:
+			mult[1] = 1;
+			mult[2] = 1;
+			break;
+		case 48000:
+			mult[3] = 1;
+		case 44100:
+			mult[2] = 1;
+			break;
+		case 32000:
+			mult[3] = 1;
+		case 29400:
+			mult[0] = 1;
+			mult[1] = 1;
+			break;
+		case 24000:
+			mult[3] = 1;
+		case 22050:
+			mult[1] = 1;
+			break;
+		case 16000:
+			mult[3] = 1;
+		case 14700:
+			mult[0] = 1;
+			break;
+		case 8000:
+			mult[3] = 1;
+			break;
+		default:
+			return -EINVAL;
+		}
+		break;
+	default:
+		return -EINVAL;
+	}
+	gpiod_set_array_value_cansleep(mult_gpios->ndescs, mult_gpios->desc,
+									mult);
+
+	return 0;
+}
+
+static struct snd_soc_ops audioinjector_octo_ops = {
+	.startup	= audioinjector_octo_startup,
+	.shutdown	= audioinjector_octo_shutdown,
+	.hw_params = audioinjector_octo_hw_params,
+	.trigger = audioinjector_octo_trigger,
+};
+
+static struct snd_soc_dai_link audioinjector_octo_dai[] = {
+	{
+		.name = "AudioInjector Octo",
+		.stream_name = "AudioInject-HIFI",
+		.codec_dai_name = "cs42448",
+		.ops = &audioinjector_octo_ops,
+		.init = audioinjector_octo_dai_init,
+		.symmetric_rates = 1,
+		.symmetric_channels = 1,
+	},
+};
+
+static const struct snd_soc_dapm_widget audioinjector_octo_widgets[] = {
+	SND_SOC_DAPM_OUTPUT("OUTPUTS0"),
+	SND_SOC_DAPM_OUTPUT("OUTPUTS1"),
+	SND_SOC_DAPM_OUTPUT("OUTPUTS2"),
+	SND_SOC_DAPM_OUTPUT("OUTPUTS3"),
+	SND_SOC_DAPM_INPUT("INPUTS0"),
+	SND_SOC_DAPM_INPUT("INPUTS1"),
+	SND_SOC_DAPM_INPUT("INPUTS2"),
+};
+
+static const struct snd_soc_dapm_route audioinjector_octo_route[] = {
+	/* Balanced outputs */
+	{"OUTPUTS0", NULL, "AOUT1L"},
+	{"OUTPUTS0", NULL, "AOUT1R"},
+	{"OUTPUTS1", NULL, "AOUT2L"},
+	{"OUTPUTS1", NULL, "AOUT2R"},
+	{"OUTPUTS2", NULL, "AOUT3L"},
+	{"OUTPUTS2", NULL, "AOUT3R"},
+	{"OUTPUTS3", NULL, "AOUT4L"},
+	{"OUTPUTS3", NULL, "AOUT4R"},
+
+	/* Balanced inputs */
+	{"AIN1L", NULL, "INPUTS0"},
+	{"AIN1R", NULL, "INPUTS0"},
+	{"AIN2L", NULL, "INPUTS1"},
+	{"AIN2R", NULL, "INPUTS1"},
+	{"AIN3L", NULL, "INPUTS2"},
+	{"AIN3R", NULL, "INPUTS2"},
+};
+
+static struct snd_soc_card snd_soc_audioinjector_octo = {
+	.name = "audioinjector-octo-soundcard",
+	.dai_link = audioinjector_octo_dai,
+	.num_links = ARRAY_SIZE(audioinjector_octo_dai),
+
+	.dapm_widgets = audioinjector_octo_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(audioinjector_octo_widgets),
+	.dapm_routes = audioinjector_octo_route,
+	.num_dapm_routes = ARRAY_SIZE(audioinjector_octo_route),
+};
+
+static int audioinjector_octo_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_soc_audioinjector_octo;
+	int ret;
+
+	card->dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct snd_soc_dai_link *dai = &audioinjector_octo_dai[0];
+		struct device_node *i2s_node =
+					of_parse_phandle(pdev->dev.of_node,
+							"i2s-controller", 0);
+		struct device_node *codec_node =
+					of_parse_phandle(pdev->dev.of_node,
+								"codec", 0);
+
+		mult_gpios = devm_gpiod_get_array_optional(&pdev->dev, "mult",
+								GPIOD_OUT_LOW);
+		if (IS_ERR(mult_gpios))
+			return PTR_ERR(mult_gpios);
+
+		codec_rst_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
+								GPIOD_OUT_LOW);
+		if (IS_ERR(codec_rst_gpio))
+			return PTR_ERR(codec_rst_gpio);
+
+		non_stop_clocks = of_property_read_bool(pdev->dev.of_node, "non-stop-clocks");
+
+		if (codec_rst_gpio)
+			gpiod_set_value(codec_rst_gpio, 1);
+		msleep(500);
+		if (codec_rst_gpio)
+			gpiod_set_value(codec_rst_gpio, 0);
+		msleep(500);
+		if (codec_rst_gpio)
+			gpiod_set_value(codec_rst_gpio, 1);
+		msleep(500);
+
+		if (i2s_node && codec_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+			dai->codec_name = NULL;
+			dai->codec_of_node = codec_node;
+		} else
+			if (!dai->cpu_of_node) {
+				dev_err(&pdev->dev,
+				"i2s-controller missing or invalid in DT\n");
+				return -EINVAL;
+			} else {
+				dev_err(&pdev->dev,
+				"Property 'codec' missing or invalid\n");
+				return -EINVAL;
+			}
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, card);
+	if (ret != 0)
+		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
+	return ret;
+}
+
+static const struct of_device_id audioinjector_octo_of_match[] = {
+	{ .compatible = "ai,audioinjector-octo-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, audioinjector_octo_of_match);
+
+static struct platform_driver audioinjector_octo_driver = {
+	.driver	= {
+		.name			= "audioinjector-octo",
+		.owner			= THIS_MODULE,
+		.of_match_table = audioinjector_octo_of_match,
+	},
+	.probe	= audioinjector_octo_probe,
+};
+
+module_platform_driver(audioinjector_octo_driver);
+MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
+MODULE_DESCRIPTION("AudioInjector.net octo Soundcard");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:audioinjector-octo-soundcard");
-- 
GitLab


From 1545ebd3da300506da51af476c5b5914d5156267 Mon Sep 17 00:00:00 2001
From: Peter Malkin <petermalkin@google.com>
Date: Mon, 27 Mar 2017 16:38:21 -0700
Subject: [PATCH 0083/1835] Driver support for Google voiceHAT soundcard.

ASoC: googlevoicehat-codec: Use correct device when grabbing GPIO

The fixup for the VoiceHAT in 4.18 incorrectly tried to find the
sdmode GPIO pin under the card device, not the codec device.
This failed, and therefore caused the device probe to fail.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>

ASoC: googlevoicehat-codec: Reformat for kernel coding standards

Fix all whitespace, indentation, and bracing errors.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>

ASoC: googlevoicehat-codec: Make driver function structure const

Make voicehat_component_driver a const structure.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>

ASoC: googlevoicehat-codec: Only convert from ms to jiffies once

Minor optimisation and allows to become checkpatch clean.
A msec value is read out of DT or from a define, and convert once to
jiffies, rather than every time that it is used.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 sound/soc/bcm/googlevoicehat-codec.c | 214 +++++++++++++++++++++++++++
 1 file changed, 214 insertions(+)
 create mode 100644 sound/soc/bcm/googlevoicehat-codec.c

diff --git a/sound/soc/bcm/googlevoicehat-codec.c b/sound/soc/bcm/googlevoicehat-codec.c
new file mode 100644
index 0000000000000..871a25aa498e7
--- /dev/null
+++ b/sound/soc/bcm/googlevoicehat-codec.c
@@ -0,0 +1,214 @@
+/*
+ * Driver for the Google voiceHAT audio codec for Raspberry Pi.
+ *
+ * Author:	Peter Malkin <petermalkin@google.com>
+ *		Copyright 2016
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/version.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/soc-dapm.h>
+
+#define ICS43432_RATE_MIN_HZ	7190  /* from data sheet */
+#define ICS43432_RATE_MAX_HZ	52800 /* from data sheet */
+/* Delay in enabling SDMODE after clock settles to remove pop */
+#define SDMODE_DELAY_MS		5
+
+struct voicehat_priv {
+	struct delayed_work enable_sdmode_work;
+	struct gpio_desc *sdmode_gpio;
+	unsigned long sdmode_delay_jiffies;
+};
+
+static void voicehat_enable_sdmode_work(struct work_struct *work)
+{
+	struct voicehat_priv *voicehat = container_of(work,
+						      struct voicehat_priv,
+						      enable_sdmode_work.work);
+	gpiod_set_value(voicehat->sdmode_gpio, 1);
+}
+
+static int voicehat_component_probe(struct snd_soc_component *component)
+{
+	struct voicehat_priv *voicehat =
+				snd_soc_component_get_drvdata(component);
+
+	voicehat->sdmode_gpio = devm_gpiod_get(component->dev, "sdmode",
+					       GPIOD_OUT_LOW);
+	if (IS_ERR(voicehat->sdmode_gpio)) {
+		dev_err(component->dev, "Unable to allocate GPIO pin\n");
+		return PTR_ERR(voicehat->sdmode_gpio);
+	}
+
+	INIT_DELAYED_WORK(&voicehat->enable_sdmode_work,
+			  voicehat_enable_sdmode_work);
+	return 0;
+}
+
+static void voicehat_component_remove(struct snd_soc_component *component)
+{
+	struct voicehat_priv *voicehat =
+				snd_soc_component_get_drvdata(component);
+
+	cancel_delayed_work_sync(&voicehat->enable_sdmode_work);
+}
+
+static const struct snd_soc_dapm_widget voicehat_dapm_widgets[] = {
+	SND_SOC_DAPM_OUTPUT("Speaker"),
+};
+
+static const struct snd_soc_dapm_route voicehat_dapm_routes[] = {
+	{"Speaker", NULL, "HiFi Playback"},
+};
+
+static const struct snd_soc_component_driver voicehat_component_driver = {
+	.probe = voicehat_component_probe,
+	.remove = voicehat_component_remove,
+	.dapm_widgets = voicehat_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(voicehat_dapm_widgets),
+	.dapm_routes = voicehat_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(voicehat_dapm_routes),
+};
+
+static int voicehat_daiops_trigger(struct snd_pcm_substream *substream, int cmd,
+				   struct snd_soc_dai *dai)
+{
+	struct snd_soc_component *component = dai->component;
+	struct voicehat_priv *voicehat =
+				snd_soc_component_get_drvdata(component);
+
+	if (voicehat->sdmode_delay_jiffies == 0)
+		return 0;
+
+	dev_dbg(dai->dev, "CMD             %d", cmd);
+	dev_dbg(dai->dev, "Playback Active %d", dai->playback_active);
+	dev_dbg(dai->dev, "Capture Active  %d", dai->capture_active);
+
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_START:
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		if (dai->playback_active) {
+			dev_info(dai->dev, "Enabling audio amp...\n");
+			queue_delayed_work(
+				system_power_efficient_wq,
+				&voicehat->enable_sdmode_work,
+				voicehat->sdmode_delay_jiffies);
+		}
+		break;
+	case SNDRV_PCM_TRIGGER_STOP:
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		if (dai->playback_active) {
+			cancel_delayed_work(&voicehat->enable_sdmode_work);
+			dev_info(dai->dev, "Disabling audio amp...\n");
+			gpiod_set_value(voicehat->sdmode_gpio, 0);
+		}
+		break;
+	}
+	return 0;
+}
+
+static const struct snd_soc_dai_ops voicehat_dai_ops = {
+	.trigger = voicehat_daiops_trigger,
+};
+
+static struct snd_soc_dai_driver voicehat_dai = {
+	.name = "voicehat-hifi",
+	.capture = {
+		.stream_name = "HiFi Capture",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_48000,
+		.formats = SNDRV_PCM_FMTBIT_S32_LE
+	},
+	.playback = {
+		.stream_name = "HiFi Playback",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_48000,
+		.formats = SNDRV_PCM_FMTBIT_S32_LE
+	},
+	.ops = &voicehat_dai_ops,
+	.symmetric_rates = 1
+};
+
+#ifdef CONFIG_OF
+static const struct of_device_id voicehat_ids[] = {
+		{ .compatible = "google,voicehat", }, {}
+	};
+	MODULE_DEVICE_TABLE(of, voicehat_ids);
+#endif
+
+static int voicehat_platform_probe(struct platform_device *pdev)
+{
+	struct voicehat_priv *voicehat;
+	unsigned int sdmode_delay;
+	int ret;
+
+	voicehat = devm_kzalloc(&pdev->dev, sizeof(*voicehat), GFP_KERNEL);
+	if (!voicehat)
+		return -ENOMEM;
+
+	ret = device_property_read_u32(&pdev->dev, "voicehat_sdmode_delay",
+				       &sdmode_delay);
+
+	if (ret) {
+		sdmode_delay = SDMODE_DELAY_MS;
+		dev_info(&pdev->dev,
+			 "property 'voicehat_sdmode_delay' not found default 5 mS");
+	} else {
+		dev_info(&pdev->dev, "property 'voicehat_sdmode_delay' found delay= %d mS",
+			 sdmode_delay);
+	}
+	voicehat->sdmode_delay_jiffies = msecs_to_jiffies(sdmode_delay);
+
+	dev_set_drvdata(&pdev->dev, voicehat);
+
+	return snd_soc_register_component(&pdev->dev,
+					  &voicehat_component_driver,
+					  &voicehat_dai,
+					  1);
+}
+
+static int voicehat_platform_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_component(&pdev->dev);
+	return 0;
+}
+
+static struct platform_driver voicehat_driver = {
+	.driver = {
+		.name = "voicehat-codec",
+		.of_match_table = of_match_ptr(voicehat_ids),
+	},
+	.probe = voicehat_platform_probe,
+	.remove = voicehat_platform_remove,
+};
+
+module_platform_driver(voicehat_driver);
+
+MODULE_DESCRIPTION("Google voiceHAT Codec driver");
+MODULE_AUTHOR("Peter Malkin <petermalkin@google.com>");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 77b0ce27e1c07d6280e7b80ac3b8b94b820ebac6 Mon Sep 17 00:00:00 2001
From: allocom <sparky-dev@allo.com>
Date: Thu, 19 Apr 2018 12:12:26 +0530
Subject: [PATCH 0084/1835] Driver and overlay for Allo Katana DAC

Allo Katana DAC: Updated default values

Signed-off-by: Jaikumar <jaikumar@cem-solutions.com>
---
 sound/soc/bcm/allo-katana-codec.c | 360 ++++++++++++++++++++++++++++++
 1 file changed, 360 insertions(+)
 create mode 100644 sound/soc/bcm/allo-katana-codec.c

diff --git a/sound/soc/bcm/allo-katana-codec.c b/sound/soc/bcm/allo-katana-codec.c
new file mode 100644
index 0000000000000..99d80767fac5b
--- /dev/null
+++ b/sound/soc/bcm/allo-katana-codec.c
@@ -0,0 +1,360 @@
+/*
+ * Driver for the ALLO KATANA CODEC
+ *
+ * Author: Jaikumar <jaikumar@cem-solutions.net>
+ *		Copyright 2018
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gcd.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/pcm_params.h>
+#include <sound/tlv.h>
+#include <linux/i2c.h>
+
+
+#define KATANA_CODEC_CHIP_ID		0x30
+#define KATANA_CODEC_VIRT_BASE		0x100
+#define KATANA_CODEC_PAGE			0
+
+#define KATANA_CODEC_CHIP_ID_REG	(KATANA_CODEC_VIRT_BASE + 0)
+#define KATANA_CODEC_RESET			(KATANA_CODEC_VIRT_BASE + 1)
+#define KATANA_CODEC_VOLUME_1		(KATANA_CODEC_VIRT_BASE + 2)
+#define KATANA_CODEC_VOLUME_2		(KATANA_CODEC_VIRT_BASE + 3)
+#define KATANA_CODEC_MUTE			(KATANA_CODEC_VIRT_BASE + 4)
+#define KATANA_CODEC_DSP_PROGRAM	(KATANA_CODEC_VIRT_BASE + 5)
+#define KATANA_CODEC_DEEMPHASIS		(KATANA_CODEC_VIRT_BASE + 6)
+#define KATANA_CODEC_DOP			(KATANA_CODEC_VIRT_BASE + 7)
+#define KATANA_CODEC_FORMAT			(KATANA_CODEC_VIRT_BASE + 8)
+#define KATANA_CODEC_COMMAND		(KATANA_CODEC_VIRT_BASE + 9)
+#define KATANA_CODEC_MAX_REGISTER	(KATANA_CODEC_VIRT_BASE + 9)
+
+#define KATANA_CODEC_FMT			0xff
+#define KATANA_CODEC_CHAN_MONO		0x00
+#define KATANA_CODEC_CHAN_STEREO	0x80
+#define KATANA_CODEC_ALEN_16		0x10
+#define KATANA_CODEC_ALEN_24		0x20
+#define KATANA_CODEC_ALEN_32		0x30
+#define KATANA_CODEC_RATE_11025		0x01
+#define KATANA_CODEC_RATE_22050		0x02
+#define KATANA_CODEC_RATE_32000		0x03
+#define KATANA_CODEC_RATE_44100		0x04
+#define KATANA_CODEC_RATE_48000		0x05
+#define KATANA_CODEC_RATE_88200		0x06
+#define KATANA_CODEC_RATE_96000		0x07
+#define KATANA_CODEC_RATE_176400	0x08
+#define KATANA_CODEC_RATE_192000	0x09
+#define KATANA_CODEC_RATE_352800	0x0a
+#define KATANA_CODEC_RATE_384000	0x0b
+
+
+struct katana_codec_priv {
+	struct regmap *regmap;
+	int fmt;
+};
+
+static const struct reg_default katana_codec_reg_defaults[] = {
+	{ KATANA_CODEC_RESET,		0x00 },
+	{ KATANA_CODEC_VOLUME_1,	0xF0 },
+	{ KATANA_CODEC_VOLUME_2,	0xF0 },
+	{ KATANA_CODEC_MUTE,		0x00 },
+	{ KATANA_CODEC_DSP_PROGRAM,	0x04 },
+	{ KATANA_CODEC_DEEMPHASIS,	0x00 },
+	{ KATANA_CODEC_DOP,		0x00 },
+	{ KATANA_CODEC_FORMAT,		0xb4 },
+};
+
+static const char * const katana_codec_dsp_program_texts[] = {
+	"Linear Phase Fast Roll-off Filter",
+	"Linear Phase Slow Roll-off Filter",
+	"Minimum Phase Fast Roll-off Filter",
+	"Minimum Phase Slow Roll-off Filter",
+	"Apodizing Fast Roll-off Filter",
+	"Corrected Minimum Phase Fast Roll-off Filter",
+	"Brick Wall Filter",
+};
+
+static const unsigned int katana_codec_dsp_program_values[] = {
+	0,
+	1,
+	2,
+	3,
+	4,
+	6,
+	7,
+};
+
+static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_dsp_program,
+				  KATANA_CODEC_DSP_PROGRAM, 0, 0x07,
+				  katana_codec_dsp_program_texts,
+				  katana_codec_dsp_program_values);
+
+static const char * const katana_codec_deemphasis_texts[] = {
+	"Bypass",
+	"32kHz",
+	"44.1kHz",
+	"48kHz",
+};
+
+static const unsigned int katana_codec_deemphasis_values[] = {
+	0,
+	1,
+	2,
+	3,
+};
+
+static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_deemphasis,
+				  KATANA_CODEC_DEEMPHASIS, 0, 0x03,
+				  katana_codec_deemphasis_texts,
+				  katana_codec_deemphasis_values);
+
+static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12700, 0);
+
+static const struct snd_kcontrol_new katana_codec_controls[] = {
+	SOC_DOUBLE_R_TLV("Master Playback Volume", KATANA_CODEC_VOLUME_1,
+			KATANA_CODEC_VOLUME_2, 0, 255, 1, master_tlv),
+	SOC_DOUBLE("Master Playback Switch", KATANA_CODEC_MUTE, 0, 0, 1, 1),
+	SOC_ENUM("DSP Program Route", katana_codec_dsp_program),
+	SOC_ENUM("Deemphasis Route", katana_codec_deemphasis),
+	SOC_SINGLE("DoP Playback Switch", KATANA_CODEC_DOP, 0, 1, 1)
+};
+
+static bool katana_codec_readable_register(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case KATANA_CODEC_CHIP_ID_REG:
+		return true;
+	default:
+		return reg < 0xff;
+	}
+}
+
+static int katana_codec_hw_params(struct snd_pcm_substream *substream,
+			     struct snd_pcm_hw_params *params,
+			     struct snd_soc_dai *dai)
+{
+	struct snd_soc_component *component = dai->component;
+	struct katana_codec_priv *katana_codec = snd_soc_component_get_drvdata(component);
+	int fmt = 0;
+	int ret;
+
+	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels\n",
+			params_rate(params),
+			params_channels(params));
+
+	switch (katana_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+	case SND_SOC_DAIFMT_CBM_CFM: // master
+		if (params_channels(params) == 2)
+			fmt = KATANA_CODEC_CHAN_STEREO;
+		else
+			fmt = KATANA_CODEC_CHAN_MONO;
+
+		switch (params_width(params)) {
+		case 16:
+			fmt |= KATANA_CODEC_ALEN_16;
+			break;
+		case 24:
+			fmt |= KATANA_CODEC_ALEN_24;
+			break;
+		case 32:
+			fmt |= KATANA_CODEC_ALEN_32;
+			break;
+		default:
+			dev_err(component->card->dev, "Bad frame size: %d\n",
+					params_width(params));
+			return -EINVAL;
+		}
+
+		switch (params_rate(params)) {
+		case 44100:
+			fmt |= KATANA_CODEC_RATE_44100;
+			break;
+		case 48000:
+			fmt |= KATANA_CODEC_RATE_48000;
+			break;
+		case 88200:
+			fmt |= KATANA_CODEC_RATE_88200;
+			break;
+		case 96000:
+			fmt |= KATANA_CODEC_RATE_96000;
+			break;
+		case 176400:
+			fmt |= KATANA_CODEC_RATE_176400;
+			break;
+		case 192000:
+			fmt |= KATANA_CODEC_RATE_192000;
+			break;
+		case 352800:
+			fmt |= KATANA_CODEC_RATE_352800;
+			break;
+		case 384000:
+			fmt |= KATANA_CODEC_RATE_384000;
+			break;
+		default:
+			dev_err(component->card->dev, "Bad sample rate: %d\n",
+					params_rate(params));
+			return -EINVAL;
+		}
+
+		ret = regmap_write(katana_codec->regmap, KATANA_CODEC_FORMAT, fmt);
+		if (ret != 0) {
+			dev_err(component->card->dev, "Failed to set format: %d\n", ret);
+			return ret;
+		}
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int katana_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+	struct snd_soc_component *component = dai->component;
+	struct katana_codec_priv *katana_codec = snd_soc_component_get_drvdata(component);
+
+	katana_codec->fmt = fmt;
+
+	return 0;
+}
+
+static const struct snd_soc_dai_ops katana_codec_dai_ops = {
+	.hw_params = katana_codec_hw_params,
+	.set_fmt = katana_codec_set_fmt,
+};
+
+static struct snd_soc_dai_driver katana_codec_dai = {
+	.name = "allo-katana-codec",
+	.playback = {
+		.stream_name = "Playback",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_CONTINUOUS,
+		.rate_min = 44100,
+		.rate_max = 384000,
+		.formats = SNDRV_PCM_FMTBIT_S16_LE |
+			SNDRV_PCM_FMTBIT_S32_LE
+	},
+	.ops = &katana_codec_dai_ops,
+};
+
+static struct snd_soc_component_driver katana_codec_component_driver = {
+	.idle_bias_on = true,
+
+	.controls		= katana_codec_controls,
+	.num_controls	= ARRAY_SIZE(katana_codec_controls),
+};
+
+static const struct regmap_range_cfg katana_codec_range = {
+	.name = "Pages", .range_min = KATANA_CODEC_VIRT_BASE,
+	.range_max = KATANA_CODEC_MAX_REGISTER,
+	.selector_reg = KATANA_CODEC_PAGE,
+	.selector_mask = 0xff,
+	.window_start = 0, .window_len = 0x100,
+};
+
+const struct regmap_config katana_codec_regmap = {
+	.reg_bits = 8,
+	.val_bits = 8,
+
+	.ranges = &katana_codec_range,
+	.num_ranges = 1,
+
+	.max_register = KATANA_CODEC_MAX_REGISTER,
+	.readable_reg = katana_codec_readable_register,
+	.reg_defaults = katana_codec_reg_defaults,
+	.num_reg_defaults = ARRAY_SIZE(katana_codec_reg_defaults),
+	.cache_type = REGCACHE_RBTREE,
+};
+
+static int allo_katana_component_probe(struct i2c_client *i2c,
+			     const struct i2c_device_id *id)
+{
+	struct regmap *regmap;
+	struct regmap_config config = katana_codec_regmap;
+	struct device *dev = &i2c->dev;
+	struct katana_codec_priv *katana_codec;
+	unsigned int chip_id = 0;
+	int ret;
+
+	regmap = devm_regmap_init_i2c(i2c, &config);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	katana_codec = devm_kzalloc(dev, sizeof(struct katana_codec_priv),
+								GFP_KERNEL);
+	if (!katana_codec)
+		return -ENOMEM;
+
+	dev_set_drvdata(dev, katana_codec);
+	katana_codec->regmap = regmap;
+
+	ret = regmap_read(regmap, KATANA_CODEC_CHIP_ID_REG, &chip_id);
+	if ((ret != 0) || (chip_id != KATANA_CODEC_CHIP_ID)) {
+		dev_err(dev, "Failed to read Chip or wrong Chip id: %d\n", ret);
+		return ret;
+	}
+	regmap_update_bits(regmap, KATANA_CODEC_RESET, 0x01, 0x01);
+	msleep(10);
+
+	ret = snd_soc_register_component(dev, &katana_codec_component_driver,
+				    &katana_codec_dai, 1);
+	if (ret != 0) {
+		dev_err(dev, "failed to register codec: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int allo_katana_component_remove(struct i2c_client *i2c)
+{
+	snd_soc_unregister_component(&i2c->dev);
+	return 0;
+}
+
+static const struct i2c_device_id allo_katana_component_id[] = {
+	{ "allo-katana-codec", },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, allo_katana_component_id);
+
+static const struct of_device_id allo_katana_codec_of_match[] = {
+	{ .compatible = "allo,allo-katana-codec", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, allo_katana_codec_of_match);
+
+static struct i2c_driver allo_katana_component_driver = {
+	.probe		= allo_katana_component_probe,
+	.remove		= allo_katana_component_remove,
+	.id_table	= allo_katana_component_id,
+	.driver		= {
+		.name	= "allo-katana-codec",
+		.of_match_table = allo_katana_codec_of_match,
+	},
+};
+
+module_i2c_driver(allo_katana_component_driver);
+
+MODULE_DESCRIPTION("ASoC Allo Katana Codec Driver");
+MODULE_AUTHOR("Jaikumar <jaikumar@cem-solutions.net>");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 724984d3591f90e8aba200cf0f9a1a0da03d3730 Mon Sep 17 00:00:00 2001
From: Daniel Matuschek <info@crazy-audio.com>
Date: Wed, 15 Jan 2014 21:41:23 +0100
Subject: [PATCH 0085/1835] ASoC: wm8804: MCLK configuration options, 32-bit

WM8804 can run with PLL frequencies of 256xfs and 128xfs for most sample
rates. At 192kHz only 128xfs is supported. The existing driver selects
128xfs automatically for some lower samples rates. By using an
additional mclk_div divider, it is now possible to control the
behaviour. This allows using 256xfs PLL frequency on all sample rates up
to 96kHz. It should allow lower jitter and better signal quality. The
behavior has to be controlled by the sound card driver, because some
sample frequency share the same setting. e.g. 192kHz and 96kHz use
24.576MHz master clock. The only difference is the MCLK divider.

This also added support for 32bit data.

Signed-off-by: Daniel Matuschek <daniel@matuschek.net>
---
 sound/soc/codecs/wm8804.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c
index 89f13249966ea..813c47766fb48 100644
--- a/sound/soc/codecs/wm8804.c
+++ b/sound/soc/codecs/wm8804.c
@@ -550,6 +550,7 @@ static const struct snd_soc_component_driver soc_component_dev_wm8804 = {
 	.use_pmdown_time	= 1,
 	.endianness		= 1,
 	.non_legacy_dai_naming	= 1,
+	.idle_bias_on		= true,
 };
 
 const struct regmap_config wm8804_regmap_config = {
-- 
GitLab


From 19ab12a3ecca1d0eb6293263b91eb13e7cbc2590 Mon Sep 17 00:00:00 2001
From: Tim Gover <tim.gover@raspberrypi.org>
Date: Wed, 27 Jun 2018 15:59:12 +0100
Subject: [PATCH 0086/1835] ASoC: Add generic RPI driver for simple soundcards.

The RPI simple sound card driver provides a generic ALSA SOC card driver
supporting a variety of Pi HAT soundcards. The intention is to avoid
the duplication of code for cards that can't be fully supported by
the soc simple/graph cards but are otherwise almost identical.

This initial commit adds support for the ADAU1977 ADC, Google VoiceHat,
HifiBerry AMP, HifiBerry DAC and RPI DAC.

Signed-off-by: Tim Gover <tim.gover@raspberrypi.org>

ASoC: Use correct card name in rpi-simple driver

Use the specific card name from drvdata instead of the snd_rpi_simple

rpi-simple-soundcard: Use nicer driver name "RPi-simple"

Rename the driver from "RPI simple soundcard" to "RPi-simple" so that
the driver name won't be mangled allowing to be used unaltered as the
card conf filename.
---
 sound/soc/bcm/rpi-simple-soundcard.c | 268 +++++++++++++++++++++++++++
 1 file changed, 268 insertions(+)
 create mode 100644 sound/soc/bcm/rpi-simple-soundcard.c

diff --git a/sound/soc/bcm/rpi-simple-soundcard.c b/sound/soc/bcm/rpi-simple-soundcard.c
new file mode 100644
index 0000000000000..7fa92e29502aa
--- /dev/null
+++ b/sound/soc/bcm/rpi-simple-soundcard.c
@@ -0,0 +1,268 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * rpi-simple-soundcard.c -- ALSA SoC Raspberry Pi soundcard.
+ *
+ * Copyright (C) 2018 Raspberry Pi.
+ *
+ * Authors: Tim Gover <tim.gover@raspberrypi.org>
+ *
+ * Based on code:
+ * hifiberry_amp.c, hifiberry_dac.c, rpi-dac.c
+ * by Florian Meier <florian.meier@koalo.de>
+ *
+ * googlevoicehat-soundcard.c
+ * by Peter Malkin <petermalkin@google.com>
+ *
+ * adau1977-adc.c
+ * by Andrey Grodzovsky <andrey2805@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+/* Parameters for generic RPI functions */
+struct snd_rpi_simple_drvdata {
+	struct snd_soc_dai_link *dai;
+	const char* card_name;
+	unsigned int fixed_bclk_ratio;
+};
+
+static int snd_rpi_simple_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_rpi_simple_drvdata *drvdata =
+		snd_soc_card_get_drvdata(rtd->card);
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	if (drvdata->fixed_bclk_ratio > 0)
+		return snd_soc_dai_set_bclk_ratio(cpu_dai,
+				drvdata->fixed_bclk_ratio);
+
+	return 0;
+}
+
+static int snd_rpi_simple_hw_params(struct snd_pcm_substream *substream,
+		struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	struct snd_rpi_simple_drvdata *drvdata;
+	unsigned int sample_bits;
+
+	drvdata = snd_soc_card_get_drvdata(rtd->card);
+
+	if (drvdata->fixed_bclk_ratio > 0)
+		return 0; // BCLK is configured in .init
+
+	/* The simple drivers just set the bclk_ratio to sample_bits * 2 so
+	 * hard-code this for now. More complex drivers could just replace
+	 * the hw_params routine.
+	 */
+	sample_bits = snd_pcm_format_physical_width(params_format(params));
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
+}
+
+static struct snd_soc_ops snd_rpi_simple_ops = {
+	.hw_params = snd_rpi_simple_hw_params,
+};
+
+enum adau1977_clk_id {
+	ADAU1977_SYSCLK,
+};
+
+enum adau1977_sysclk_src {
+	ADAU1977_SYSCLK_SRC_MCLK,
+	ADAU1977_SYSCLK_SRC_LRCLK,
+};
+
+static int adau1977_init(struct snd_soc_pcm_runtime *rtd)
+{
+	int ret;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+
+	ret = snd_soc_dai_set_tdm_slot(codec_dai, 0, 0, 0, 0);
+	if (ret < 0)
+		return ret;
+
+	return snd_soc_component_set_sysclk(codec_dai->component,
+			ADAU1977_SYSCLK, ADAU1977_SYSCLK_SRC_MCLK,
+			11289600, SND_SOC_CLOCK_IN);
+}
+
+static struct snd_soc_dai_link snd_rpi_adau1977_dai[] = {
+	{
+	.name           = "adau1977",
+	.stream_name    = "ADAU1977",
+	.codec_dai_name = "adau1977-hifi",
+	.codec_name     = "adau1977.1-0011",
+	.init           = adau1977_init,
+	.dai_fmt = SND_SOC_DAIFMT_I2S |
+		SND_SOC_DAIFMT_NB_NF |
+		SND_SOC_DAIFMT_CBM_CFM,
+	},
+};
+
+static struct snd_rpi_simple_drvdata drvdata_adau1977 = {
+	.card_name = "snd_rpi_adau1977_adc",
+	.dai       = snd_rpi_adau1977_dai,
+};
+
+static struct snd_soc_dai_link snd_googlevoicehat_soundcard_dai[] = {
+{
+	.name           = "Google voiceHAT SoundCard",
+	.stream_name    = "Google voiceHAT SoundCard HiFi",
+	.codec_dai_name = "voicehat-hifi",
+	.codec_name     = "voicehat-codec",
+	.dai_fmt        =  SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+},
+};
+
+static struct snd_rpi_simple_drvdata drvdata_googlevoicehat = {
+	.card_name = "snd_rpi_googlevoicehat_soundcard",
+	.dai       = snd_googlevoicehat_soundcard_dai,
+};
+
+static struct snd_soc_dai_link snd_hifiberry_amp_dai[] = {
+	{
+		.name           = "HifiBerry AMP",
+		.stream_name    = "HifiBerry AMP HiFi",
+		.codec_dai_name = "tas5713-hifi",
+		.codec_name     = "tas5713.1-001b",
+		.dai_fmt        = SND_SOC_DAIFMT_I2S |
+					SND_SOC_DAIFMT_NB_NF |
+					SND_SOC_DAIFMT_CBS_CFS,
+	},
+};
+
+static struct snd_rpi_simple_drvdata drvdata_hifiberry_amp = {
+	.card_name        = "snd_rpi_hifiberry_amp",
+	.dai              = snd_hifiberry_amp_dai,
+	.fixed_bclk_ratio = 64,
+};
+
+static struct snd_soc_dai_link snd_hifiberry_dac_dai[] = {
+	{
+		.name           = "HifiBerry DAC",
+		.stream_name    = "HifiBerry DAC HiFi",
+		.codec_dai_name = "pcm5102a-hifi",
+		.codec_name     = "pcm5102a-codec",
+		.dai_fmt        = SND_SOC_DAIFMT_I2S |
+					SND_SOC_DAIFMT_NB_NF |
+					SND_SOC_DAIFMT_CBS_CFS,
+	},
+};
+
+static struct snd_rpi_simple_drvdata drvdata_hifiberry_dac = {
+	.card_name = "snd_rpi_hifiberry_dac",
+	.dai       = snd_hifiberry_dac_dai,
+};
+
+static struct snd_soc_dai_link snd_rpi_dac_dai[] = {
+{
+	.name		= "RPi-DAC",
+	.stream_name	= "RPi-DAC HiFi",
+	.codec_dai_name	= "pcm1794a-hifi",
+	.codec_name	= "pcm1794a-codec",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+},
+};
+
+static struct snd_rpi_simple_drvdata drvdata_rpi_dac = {
+	.card_name        = "snd_rpi_rpi_dac",
+	.dai              = snd_rpi_dac_dai,
+	.fixed_bclk_ratio = 64,
+};
+
+static const struct of_device_id snd_rpi_simple_of_match[] = {
+	{ .compatible = "adi,adau1977-adc",
+		.data = (void *) &drvdata_adau1977 },
+	{ .compatible = "googlevoicehat,googlevoicehat-soundcard",
+		.data = (void *) &drvdata_googlevoicehat },
+	{ .compatible = "hifiberry,hifiberry-amp",
+		.data = (void *) &drvdata_hifiberry_amp },
+	{ .compatible = "hifiberry,hifiberry-dac",
+		.data = (void *) &drvdata_hifiberry_dac },
+	{ .compatible = "rpi,rpi-dac", &drvdata_rpi_dac},
+	{},
+};
+
+static struct snd_soc_card snd_rpi_simple = {
+	.driver_name  = "RPi-simple",
+	.owner        = THIS_MODULE,
+	.dai_link     = NULL,
+	.num_links    = 1, /* Only a single DAI supported at the moment */
+};
+
+static int snd_rpi_simple_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	const struct of_device_id *of_id;
+
+	snd_rpi_simple.dev = &pdev->dev;
+	of_id = of_match_node(snd_rpi_simple_of_match, pdev->dev.of_node);
+
+	if (pdev->dev.of_node && of_id->data) {
+		struct device_node *i2s_node;
+		struct snd_rpi_simple_drvdata *drvdata =
+			(struct snd_rpi_simple_drvdata *) of_id->data;
+		struct snd_soc_dai_link *dai = drvdata->dai;
+
+		snd_soc_card_set_drvdata(&snd_rpi_simple, drvdata);
+
+		/* More complex drivers might override individual functions */
+		if (!dai->init)
+			dai->init = snd_rpi_simple_init;
+		if (!dai->ops)
+			dai->ops = &snd_rpi_simple_ops;
+
+		snd_rpi_simple.name = drvdata->card_name;
+
+		snd_rpi_simple.dai_link = dai;
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+				"i2s-controller", 0);
+		if (!i2s_node) {
+			pr_err("Failed to find i2s-controller DT node\n");
+			return -ENODEV;
+		}
+
+		dai->cpu_of_node = i2s_node;
+		dai->platform_of_node = i2s_node;
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_simple);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "Failed to register card %d\n", ret);
+
+	return ret;
+}
+
+static struct platform_driver snd_rpi_simple_driver = {
+	.driver = {
+		.name   = "snd-rpi-simple",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_simple_of_match,
+	},
+	.probe          = snd_rpi_simple_probe,
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_simple_of_match);
+
+module_platform_driver(snd_rpi_simple_driver);
+
+MODULE_AUTHOR("Tim Gover <tim.gover@raspberrypi.org>");
+MODULE_DESCRIPTION("ASoC Raspberry Pi simple soundcard driver ");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From caf3ab0dbf2fa63c3d47f1e94b8b03055a538ccf Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 3 Sep 2018 17:00:36 +0100
Subject: [PATCH 0087/1835] ASoC: Add Kconfig and Makefile for sound/soc/bcm

Signed-off-by: popcornmix <popcornmix@gmail.com>
---
 sound/soc/bcm/Kconfig  | 199 +++++++++++++++++++++++++++++++++++++++++
 sound/soc/bcm/Makefile |  42 +++++++++
 2 files changed, 241 insertions(+)

diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 02f50b7a966ff..6f04346347aa5 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -16,3 +16,202 @@ config SND_SOC_CYGNUS
 	  Cygnus chips (bcm958300, bcm958305, bcm911360)
 
 	  If you don't know what to do here, say N.
+
+config SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD
+	tristate "Support for Google voiceHAT soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_VOICEHAT
+	select SND_RPI_SIMPLE_SOUNDCARD
+	help
+          Say Y or M if you want to add support for voiceHAT soundcard.
+
+config SND_BCM2708_SOC_HIFIBERRY_DAC
+        tristate "Support for HifiBerry DAC"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM5102A
+        select SND_RPI_SIMPLE_SOUNDCARD
+        help
+         Say Y or M if you want to add support for HifiBerry DAC.
+
+config SND_BCM2708_SOC_HIFIBERRY_DACPLUS
+        tristate "Support for HifiBerry DAC+"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM512x
+        help
+         Say Y or M if you want to add support for HifiBerry DAC+.
+
+config SND_BCM2708_SOC_HIFIBERRY_DIGI
+        tristate "Support for HifiBerry Digi"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM8804
+        help
+         Say Y or M if you want to add support for HifiBerry Digi S/PDIF output board.
+
+config SND_BCM2708_SOC_HIFIBERRY_AMP
+        tristate "Support for the HifiBerry Amp"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_TAS5713
+        select SND_RPI_SIMPLE_SOUNDCARD
+        help
+         Say Y or M if you want to add support for the HifiBerry Amp amplifier board.
+
+config SND_BCM2708_SOC_RPI_CIRRUS
+        tristate "Support for Cirrus Logic Audio Card"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM5102
+        select SND_SOC_WM8804
+        help
+         Say Y or M if you want to add support for the Wolfson and
+         Cirrus Logic audio cards.
+
+config SND_BCM2708_SOC_RPI_DAC
+        tristate "Support for RPi-DAC"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM1794A
+        select SND_RPI_SIMPLE_SOUNDCARD
+        help
+         Say Y or M if you want to add support for RPi-DAC.
+
+config SND_BCM2708_SOC_RPI_PROTO
+	tristate "Support for Rpi-PROTO"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8731
+	help
+	  Say Y or M if you want to add support for Audio Codec Board PROTO (WM8731).
+
+config SND_BCM2708_SOC_JUSTBOOM_DAC
+	tristate "Support for JustBoom DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x
+	help
+	  Say Y or M if you want to add support for JustBoom DAC.
+
+config SND_BCM2708_SOC_JUSTBOOM_DIGI
+	tristate "Support for JustBoom Digi"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8804
+        select SND_RPI_WM8804_SOUNDCARD
+	help
+	  Say Y or M if you want to add support for JustBoom Digi.
+
+config SND_BCM2708_SOC_IQAUDIO_DAC
+	tristate "Support for IQaudIO-DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for IQaudIO-DAC.
+
+config SND_BCM2708_SOC_IQAUDIO_DIGI
+	tristate "Support for IQAudIO Digi"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8804
+	select SND_RPI_WM8804_SOUNDCARD
+	help
+	  Say Y or M if you want to add support for IQAudIO Digital IO board.
+
+config SND_BCM2708_SOC_ADAU1977_ADC
+	tristate "Support for ADAU1977 ADC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_ADAU1977_I2C
+	select SND_RPI_SIMPLE_SOUNDCARD
+	help
+	  Say Y or M if you want to add support for ADAU1977 ADC.
+
+config SND_AUDIOINJECTOR_PI_SOUNDCARD
+	tristate "Support for audioinjector.net Pi add on soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8731
+	help
+	  Say Y or M if you want to add support for audioinjector.net Pi Hat
+
+config SND_AUDIOINJECTOR_OCTO_SOUNDCARD
+	tristate "Support for audioinjector.net Octo channel (Hat) soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_CS42XX8_I2C
+	help
+	  Say Y or M if you want to add support for audioinjector.net octo add on
+
+config SND_DIGIDAC1_SOUNDCARD
+        tristate "Support for Red Rocks Audio DigiDAC1"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM8804
+        select SND_SOC_WM8741
+        help
+         Say Y or M if you want to add support for Red Rocks Audio DigiDAC1 board.
+
+config SND_BCM2708_SOC_DIONAUDIO_LOCO
+	tristate "Support for Dion Audio LOCO DAC-AMP"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM5102a
+	help
+	  Say Y or M if you want to add support for Dion Audio LOCO.
+
+config SND_BCM2708_SOC_DIONAUDIO_LOCO_V2
+	tristate "Support for Dion Audio LOCO-V2 DAC-AMP"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM5122
+	help
+	  Say Y or M if you want to add support for Dion Audio LOCO-V2.
+
+config SND_BCM2708_SOC_ALLO_PIANO_DAC
+	tristate "Support for Allo Piano DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo Piano DAC.
+
+config SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS
+	tristate "Support for Allo Piano DAC Plus"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo Piano DAC Plus.
+
+config SND_BCM2708_SOC_ALLO_BOSS_DAC
+	tristate "Support for Allo Boss DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo Boss DAC.
+
+config SND_BCM2708_SOC_ALLO_DIGIONE
+	tristate "Support for Allo DigiOne"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8804
+	select SND_RPI_WM8804_SOUNDCARD
+	help
+	  Say Y or M if you want to add support for Allo DigiOne.
+
+config SND_BCM2708_SOC_ALLO_KATANA_DAC
+	tristate "Support for Allo Katana DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	depends on I2C
+	select REGMAP_I2C
+	select SND_AUDIO_GRAPH_CARD
+	help
+	  Say Y or M if you want to add support for Allo Katana DAC.
+
+config SND_BCM2708_SOC_FE_PI_AUDIO
+	tristate "Support for Fe-Pi-Audio"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_SGTL5000
+	help
+	  Say Y or M if you want to add support for Fe-Pi-Audio.
+
+config SND_PISOUND
+	tristate "Support for Blokas Labs pisound"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_RAWMIDI
+	help
+	  Say Y or M if you want to add support for Blokas Labs pisound.
+
+config SND_RPI_SIMPLE_SOUNDCARD
+	tristate "Support for Raspberry Pi simple soundcards"
+	help
+	  Say Y or M if you want to add support Raspbery Pi simple soundcards
+
+config SND_RPI_WM8804_SOUNDCARD
+	tristate "Support for Raspberry Pi generic WM8804 soundcards"
+	help
+	  Say Y or M if you want to add support for the Raspberry Pi
+          generic driver for WM8804 based soundcards.
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index fc739d0078842..4e33ca87ec7e8 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -8,3 +8,45 @@ snd-soc-cygnus-objs := cygnus-pcm.o cygnus-ssp.o
 
 obj-$(CONFIG_SND_SOC_CYGNUS) += snd-soc-cygnus.o
 
+# Google voiceHAT custom codec support
+snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
+
+# BCM2708 Machine Support
+snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
+snd-soc-justboom-dac-objs := justboom-dac.o
+snd-soc-rpi-cirrus-objs := rpi-cirrus.o
+snd-soc-rpi-proto-objs := rpi-proto.o
+snd-soc-iqaudio-dac-objs := iqaudio-dac.o
+snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
+snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
+snd-soc-digidac1-soundcard-objs := digidac1-soundcard.o
+snd-soc-dionaudio-loco-objs := dionaudio_loco.o
+snd-soc-dionaudio-loco-v2-objs := dionaudio_loco-v2.o
+snd-soc-allo-boss-dac-objs := allo-boss-dac.o
+snd-soc-allo-piano-dac-objs := allo-piano-dac.o
+snd-soc-allo-piano-dac-plus-objs := allo-piano-dac-plus.o
+snd-soc-allo-katana-codec-objs := allo-katana-codec.o
+snd-soc-pisound-objs := pisound.o
+snd-soc-fe-pi-audio-objs := fe-pi-audio.o
+snd-soc-rpi-simple-soundcard-objs := rpi-simple-soundcard.o
+snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
+
+obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
+obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
+obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
+obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
+obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
+obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
+obj-$(CONFIG_SND_DIGIDAC1_SOUNDCARD) += snd-soc-digidac1-soundcard.o
+obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO) += snd-soc-dionaudio-loco.o
+obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2) += snd-soc-dionaudio-loco-v2.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC) += snd-soc-allo-boss-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC) += snd-soc-allo-piano-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS) += snd-soc-allo-piano-dac-plus.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC) += snd-soc-allo-katana-codec.o
+obj-$(CONFIG_SND_PISOUND) += snd-soc-pisound.o
+obj-$(CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO) += snd-soc-fe-pi-audio.o
+obj-$(CONFIG_SND_RPI_SIMPLE_SOUNDCARD) += snd-soc-rpi-simple-soundcard.o
+obj-$(CONFIG_SND_RPI_WM8804_SOUNDCARD) += snd-soc-rpi-wm8804-soundcard.o
-- 
GitLab


From 87dde87ba8d01878f6b41982df669eebb074abee Mon Sep 17 00:00:00 2001
From: Tim Gover <tim.gover@raspberrypi.org>
Date: Sat, 21 Jul 2018 20:07:46 +0100
Subject: [PATCH 0088/1835] ASoC: Create a generic Pi Hat WM8804 driver

Reduce the amount of duplicated code by creating a generic driver for
Pi Hat digi cards using the WM8804 codec.

This replaces the
Allo DigiOne, Hifiberry Digi/Pro, JustBoom Digi and IQAudIO Digi
dedicate soundcard drivers with a generic driver.

There are no significant changes to the runtime behavior of the drivers
and end users should not have to change any configuration settings
after upgrading.

Minor changes
* Check the return value of snd_soc_component_update_bits
* Added some pr_debug tracing
* Various checkpatch tidyups
* Updated allodigi-one to use use 128FS at > 96 Khz. This appears to
  be an omission in the original driver code so followed the Hifiberry
  DAC driver approach.
---
 sound/soc/bcm/rpi-wm8804-soundcard.c | 428 +++++++++++++++++++++++++++
 1 file changed, 428 insertions(+)
 create mode 100644 sound/soc/bcm/rpi-wm8804-soundcard.c

diff --git a/sound/soc/bcm/rpi-wm8804-soundcard.c b/sound/soc/bcm/rpi-wm8804-soundcard.c
new file mode 100644
index 0000000000000..361d4784cbd75
--- /dev/null
+++ b/sound/soc/bcm/rpi-wm8804-soundcard.c
@@ -0,0 +1,428 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * rpi--wm8804.c -- ALSA SoC Raspberry Pi soundcard.
+ *
+ * Copyright (C) 2018 Raspberry Pi.
+ *
+ * Authors: Tim Gover <tim.gover@raspberrypi.org>
+ *
+ * Generic driver for Pi Hat WM8804 digi sounds cards
+ *
+ * Based upon code from:
+ * justboom-digi.c
+ * by Milan Neskovic <info@justboom.co>
+ *
+ * iqaudio_digi.c
+ * by Daniel Matuschek <info@crazy-audio.com>
+ *
+ * allo-digione.c
+ * by Baswaraj <jaikumar@cem-solutions.net>
+ *
+ * hifiberry-digi.c
+ * Daniel Matuschek <info@crazy-audio.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+#include <linux/module.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+#include "../codecs/wm8804.h"
+
+struct wm8804_clk_cfg {
+	unsigned int sysclk_freq;
+	unsigned int mclk_freq;
+	unsigned int mclk_div;
+};
+
+/* Parameters for generic functions */
+struct snd_rpi_wm8804_drvdata {
+	/* Required - pointer to the DAI structure */
+	struct snd_soc_dai_link *dai;
+	/* Required - snd_soc_card name */
+	const char *card_name;
+	/* Optional- Overrides the module paramter */
+	unsigned short auto_shutdown_output;
+	/* Optional DT node names if card info is defined in DT */
+	const char *card_name_dt;
+	const char *dai_name_dt;
+	const char *dai_stream_name_dt;
+	/* Optional probe extension - called prior to register_card */
+	int (*probe)(struct platform_device *pdev);
+};
+
+static short int auto_shutdown_output;
+module_param(auto_shutdown_output, short, 0660);
+MODULE_PARM_DESC(auto_shutdown_output, "Shutdown SP/DIF output if playback is stopped");
+
+static struct gpio_desc *snd_clk44gpio;
+static struct gpio_desc *snd_clk48gpio;
+
+#define CLK_44EN_RATE 22579200UL
+#define CLK_48EN_RATE 24576000UL
+
+static int snd_rpi_wm8804_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	int rc;
+
+	pr_debug("%s\n", __func__);
+
+	rc = snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
+	return rc < 0 ? rc : 0;
+}
+
+static int snd_rpi_wm8804_digi_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	int rc;
+
+	pr_debug("%s\n", __func__);
+
+	rc = snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x00);
+	return rc < 0 ? rc : 0;
+}
+
+static void snd_rpi_wm8804_digi_shutdown(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	pr_debug("%s %d\n", __func__, auto_shutdown_output);
+
+	if (auto_shutdown_output)
+		snd_soc_component_update_bits(component, WM8804_PWRDN,
+				0x3c, 0x3c);
+}
+
+static unsigned int snd_rpi_wm8804_enable_clock(unsigned int samplerate)
+{
+	switch (samplerate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+		gpiod_set_value_cansleep(snd_clk44gpio, 1);
+		gpiod_set_value_cansleep(snd_clk48gpio, 0);
+		return CLK_44EN_RATE;
+	default:
+		gpiod_set_value_cansleep(snd_clk48gpio, 1);
+		gpiod_set_value_cansleep(snd_clk44gpio, 0);
+		return CLK_48EN_RATE;
+	}
+}
+
+static void snd_rpi_wm8804_clk_cfg(unsigned int samplerate,
+		struct wm8804_clk_cfg *clk_cfg)
+{
+	clk_cfg->mclk_freq = 0;
+	clk_cfg->mclk_div = 1;
+	clk_cfg->sysclk_freq = 27000000;
+
+	if (samplerate <= 96000) {
+		clk_cfg->mclk_freq = samplerate * 256;
+		clk_cfg->mclk_div = WM8804_MCLKDIV_256FS;
+	} else {
+		clk_cfg->mclk_freq = samplerate * 128;
+		clk_cfg->mclk_div = WM8804_MCLKDIV_128FS;
+	}
+
+	if (!(IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio)))
+		clk_cfg->sysclk_freq = snd_rpi_wm8804_enable_clock(samplerate);
+}
+
+static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
+		struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	int sampling_freq = 1;
+	int ret;
+	struct wm8804_clk_cfg clk_cfg;
+	int samplerate = params_rate(params);
+
+	snd_rpi_wm8804_clk_cfg(samplerate, &clk_cfg);
+
+	pr_debug("%s samplerate: %d mclk_freq: %u mclk_div: %u sysclk: %u\n",
+			__func__, samplerate, clk_cfg.mclk_freq,
+			clk_cfg.mclk_div, clk_cfg.sysclk_freq);
+
+	switch (samplerate) {
+	case 32000:
+		sampling_freq = 0x03;
+		break;
+	case 44100:
+		sampling_freq = 0x00;
+		break;
+	case 48000:
+		sampling_freq = 0x02;
+		break;
+	case 88200:
+		sampling_freq = 0x08;
+		break;
+	case 96000:
+		sampling_freq = 0x0a;
+		break;
+	case 176400:
+		sampling_freq = 0x0c;
+		break;
+	case 192000:
+		sampling_freq = 0x0e;
+		break;
+	default:
+		dev_err(rtd->card->dev,
+		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+		samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, clk_cfg.mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0,
+			clk_cfg.sysclk_freq, clk_cfg.mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+			clk_cfg.sysclk_freq, SND_SOC_CLOCK_OUT);
+	if (ret < 0) {
+		dev_err(rtd->card->dev,
+		"Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	/* Enable TX output */
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
+
+	/* Power on */
+	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x9, 0);
+
+	/* set sampling frequency status bits */
+	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f,
+			sampling_freq);
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+}
+
+static struct snd_soc_ops snd_rpi_wm8804_ops = {
+	.hw_params = snd_rpi_wm8804_hw_params,
+	.startup   = snd_rpi_wm8804_digi_startup,
+	.shutdown  = snd_rpi_wm8804_digi_shutdown,
+};
+
+static struct snd_soc_dai_link snd_justboom_digi_dai[] = {
+{
+	.name        = "JustBoom Digi",
+	.stream_name = "JustBoom Digi HiFi",
+},
+};
+
+static struct snd_rpi_wm8804_drvdata drvdata_justboom_digi = {
+	.card_name            = "snd_rpi_justboom_digi",
+	.dai                  = snd_justboom_digi_dai,
+	.auto_shutdown_output = 1,
+};
+
+static struct snd_soc_dai_link snd_iqaudio_digi_dai[] = {
+{
+	.name        = "IQAudIO Digi",
+	.stream_name = "IQAudIO Digi HiFi",
+},
+};
+
+static struct snd_rpi_wm8804_drvdata drvdata_iqaudio_digi = {
+	.card_name          = "IQAudIODigi",
+	.dai                = snd_iqaudio_digi_dai,
+	.card_name_dt       = "wm8804-digi,card-name",
+	.dai_name_dt        = "wm8804-digi,dai-name",
+	.dai_stream_name_dt = "wm8804-digi,dai-stream-name",
+};
+
+static int snd_allo_digione_probe(struct platform_device *pdev)
+{
+	pr_debug("%s\n", __func__);
+
+	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio)) {
+		dev_err(&pdev->dev, "devm_gpiod_get() failed\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_allo_digione_dai[] = {
+{
+	.name        = "Allo DigiOne",
+	.stream_name = "Allo DigiOne HiFi",
+},
+};
+
+static struct snd_rpi_wm8804_drvdata drvdata_allo_digione = {
+	.card_name = "snd_allo_digione",
+	.dai       = snd_allo_digione_dai,
+	.probe     = snd_allo_digione_probe,
+};
+
+static struct snd_soc_dai_link snd_hifiberry_digi_dai[] = {
+{
+	.name        = "HifiBerry Digi",
+	.stream_name = "HifiBerry Digi HiFi",
+},
+};
+
+static int snd_hifiberry_digi_probe(struct platform_device *pdev)
+{
+	pr_debug("%s\n", __func__);
+
+	if (IS_ERR(snd_clk44gpio) || IS_ERR(snd_clk48gpio))
+		return 0;
+
+	snd_hifiberry_digi_dai->name = "HiFiBerry Digi+ Pro";
+	snd_hifiberry_digi_dai->stream_name = "HiFiBerry Digi+ Pro HiFi";
+	return 0;
+}
+
+static struct snd_rpi_wm8804_drvdata drvdata_hifiberry_digi = {
+	.card_name = "snd_rpi_hifiberry_digi",
+	.dai       = snd_hifiberry_digi_dai,
+	.probe     = snd_hifiberry_digi_probe,
+};
+
+static const struct of_device_id snd_rpi_wm8804_of_match[] = {
+	{ .compatible = "justboom,justboom-digi",
+		.data = (void *) &drvdata_justboom_digi },
+	{ .compatible = "iqaudio,wm8804-digi",
+		.data = (void *) &drvdata_iqaudio_digi },
+	{ .compatible = "allo,allo-digione",
+		.data = (void *) &drvdata_allo_digione },
+	{ .compatible = "hifiberry,hifiberry-digi",
+		.data = (void *) &drvdata_hifiberry_digi },
+	{},
+};
+
+static struct snd_soc_card snd_rpi_wm8804 = {
+	.driver_name  = "RPi-WM8804",
+	.owner        = THIS_MODULE,
+	.dai_link     = NULL,
+	.num_links    = 1,
+};
+
+static int snd_rpi_wm8804_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	const struct of_device_id *of_id;
+
+	snd_rpi_wm8804.dev = &pdev->dev;
+	of_id = of_match_node(snd_rpi_wm8804_of_match, pdev->dev.of_node);
+
+	if (pdev->dev.of_node && of_id->data) {
+		struct device_node *i2s_node;
+		struct snd_rpi_wm8804_drvdata *drvdata =
+			(struct snd_rpi_wm8804_drvdata *) of_id->data;
+		struct snd_soc_dai_link *dai = drvdata->dai;
+
+		snd_soc_card_set_drvdata(&snd_rpi_wm8804, drvdata);
+
+		if (!dai->init)
+			dai->init = snd_rpi_wm8804_init;
+		if (!dai->ops)
+			dai->ops = &snd_rpi_wm8804_ops;
+		if (!dai->codec_dai_name)
+			dai->codec_dai_name = "wm8804-spdif";
+		if (!dai->codec_name)
+			dai->codec_name = "wm8804.1-003b";
+		if (!dai->dai_fmt)
+			dai->dai_fmt = SND_SOC_DAIFMT_I2S |
+				SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBM_CFM;
+
+		if (drvdata->auto_shutdown_output)
+			auto_shutdown_output = 1;
+
+		snd_rpi_wm8804.dai_link = dai;
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+				"i2s-controller", 0);
+		if (!i2s_node) {
+			pr_err("Failed to find i2s-controller DT node\n");
+			return -ENODEV;
+		}
+
+		snd_rpi_wm8804.name = drvdata->card_name;
+
+		/* If requested by in drvdata get card & DAI names from DT */
+		if (drvdata->card_name_dt)
+			of_property_read_string(i2s_node,
+					drvdata->card_name_dt,
+					&snd_rpi_wm8804.name);
+
+		if (drvdata->dai_name_dt)
+			of_property_read_string(i2s_node,
+					drvdata->dai_name_dt,
+					&dai->name);
+
+		if (drvdata->dai_stream_name_dt)
+			of_property_read_string(i2s_node,
+					drvdata->dai_stream_name_dt,
+					&dai->stream_name);
+
+		dai->cpu_of_node = i2s_node;
+		dai->platform_of_node = i2s_node;
+
+		/*
+		 * clk44gpio and clk48gpio are not required by all cards so
+		 * don't check the error status.
+		 */
+		snd_clk44gpio =
+			devm_gpiod_get(&pdev->dev, "clock44", GPIOD_OUT_LOW);
+
+		snd_clk48gpio =
+			devm_gpiod_get(&pdev->dev, "clock48", GPIOD_OUT_LOW);
+
+		if (drvdata->probe) {
+			ret = drvdata->probe(pdev);
+			if (ret < 0) {
+				dev_err(&pdev->dev, "Custom probe failed %d\n",
+						ret);
+				return ret;
+			}
+		}
+
+		pr_debug("%s card: %s dai: %s stream: %s\n", __func__,
+				snd_rpi_wm8804.name,
+				dai->name, dai->stream_name);
+	}
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &snd_rpi_wm8804);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "Failed to register card %d\n", ret);
+
+	return ret;
+}
+
+static struct platform_driver snd_rpi_wm8804_driver = {
+	.driver = {
+		.name           = "snd-rpi-wm8804",
+		.owner          = THIS_MODULE,
+		.of_match_table = snd_rpi_wm8804_of_match,
+	},
+	.probe  = snd_rpi_wm8804_probe,
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_wm8804_of_match);
+
+module_platform_driver(snd_rpi_wm8804_driver);
+
+MODULE_AUTHOR("Tim Gover <tim.gover@raspberrypi.org>");
+MODULE_DESCRIPTION("ASoC Raspberry Pi Hat generic digi driver for WM8804 based cards");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From a7779ce71b73cf1f80f205dfc4eb2044282bbb45 Mon Sep 17 00:00:00 2001
From: P33M <P33M@github.com>
Date: Wed, 21 Oct 2015 14:55:21 +0100
Subject: [PATCH 0089/1835] rpi_display: add backlight driver and overlay

Add a mailbox-driven backlight controller for the Raspberry Pi DSI
touchscreen display. Requires updated GPU firmware to recognise the
mailbox request.

Signed-off-by: Gordon Hollingworth <gordon@raspberrypi.org>

Add Raspberry Pi firmware driver to the dependencies of backlight driver

Otherwise the backlight driver fails to build if the firmware
loading driver is not in the kernel

Signed-off-by: Alex Riesen <alexander.riesen@cetitec.com>
---
 drivers/video/backlight/Kconfig         |   7 ++
 drivers/video/backlight/Makefile        |   1 +
 drivers/video/backlight/rpi_backlight.c | 119 ++++++++++++++++++++++++
 3 files changed, 127 insertions(+)
 create mode 100644 drivers/video/backlight/rpi_backlight.c

diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index 2919e23340527..5268ed6d12c06 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -272,6 +272,13 @@ config BACKLIGHT_PWM
 	  If you have a LCD backlight adjustable by PWM, say Y to enable
 	  this driver.
 
+config BACKLIGHT_RPI
+	tristate "Raspberry Pi display firmware driven backlight"
+	depends on RASPBERRYPI_FIRMWARE
+	help
+	  If you have the Raspberry Pi DSI touchscreen display, say Y to
+	  enable the mailbox-controlled backlight driver.
+
 config BACKLIGHT_DA903X
 	tristate "Backlight Driver for DA9030/DA9034 using WLED"
 	depends on PMIC_DA903X
diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
index 0dcc2c745c03c..476f855a093fe 100644
--- a/drivers/video/backlight/Makefile
+++ b/drivers/video/backlight/Makefile
@@ -52,6 +52,7 @@ obj-$(CONFIG_BACKLIGHT_PANDORA)		+= pandora_bl.o
 obj-$(CONFIG_BACKLIGHT_PCF50633)	+= pcf50633-backlight.o
 obj-$(CONFIG_BACKLIGHT_PM8941_WLED)	+= pm8941-wled.o
 obj-$(CONFIG_BACKLIGHT_PWM)		+= pwm_bl.o
+obj-$(CONFIG_BACKLIGHT_RPI)			+= rpi_backlight.o
 obj-$(CONFIG_BACKLIGHT_SAHARA)		+= kb3886_bl.o
 obj-$(CONFIG_BACKLIGHT_SKY81452)	+= sky81452-backlight.o
 obj-$(CONFIG_BACKLIGHT_TOSA)		+= tosa_bl.o
diff --git a/drivers/video/backlight/rpi_backlight.c b/drivers/video/backlight/rpi_backlight.c
new file mode 100644
index 0000000000000..14a0d9b037395
--- /dev/null
+++ b/drivers/video/backlight/rpi_backlight.c
@@ -0,0 +1,119 @@
+/*
+ * rpi_bl.c - Backlight controller through VPU
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/backlight.h>
+#include <linux/err.h>
+#include <linux/fb.h>
+#include <linux/gpio.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+struct rpi_backlight {
+	struct device *dev;
+	struct device *fbdev;
+	struct rpi_firmware *fw;
+};
+
+static int rpi_backlight_update_status(struct backlight_device *bl)
+{
+	struct rpi_backlight *gbl = bl_get_data(bl);
+	int brightness = bl->props.brightness;
+	int ret;
+
+	if (bl->props.power != FB_BLANK_UNBLANK ||
+	    bl->props.fb_blank != FB_BLANK_UNBLANK ||
+	    bl->props.state & (BL_CORE_SUSPENDED | BL_CORE_FBBLANK))
+		brightness = 0;
+
+	ret = rpi_firmware_property(gbl->fw,
+			RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT,
+			&brightness, sizeof(brightness));
+	if (ret) {
+		dev_err(gbl->dev, "Failed to set brightness\n");
+		return ret;
+	}
+
+	if (brightness < 0) {
+		dev_err(gbl->dev, "Backlight change failed\n");
+		return -EAGAIN;
+	}
+
+	return 0;
+}
+
+static const struct backlight_ops rpi_backlight_ops = {
+	.options	= BL_CORE_SUSPENDRESUME,
+	.update_status	= rpi_backlight_update_status,
+};
+
+static int rpi_backlight_probe(struct platform_device *pdev)
+{
+	struct backlight_properties props;
+	struct backlight_device *bl;
+	struct rpi_backlight *gbl;
+	struct device_node *fw_node;
+
+	gbl = devm_kzalloc(&pdev->dev, sizeof(*gbl), GFP_KERNEL);
+	if (gbl == NULL)
+		return -ENOMEM;
+
+	gbl->dev = &pdev->dev;
+
+	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
+	if (!fw_node) {
+		dev_err(&pdev->dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	gbl->fw = rpi_firmware_get(fw_node);
+	if (!gbl->fw)
+		return -EPROBE_DEFER;
+
+	memset(&props, 0, sizeof(props));
+	props.type = BACKLIGHT_RAW;
+	props.max_brightness = 255;
+	bl = devm_backlight_device_register(&pdev->dev, dev_name(&pdev->dev),
+					&pdev->dev, gbl, &rpi_backlight_ops,
+					&props);
+	if (IS_ERR(bl)) {
+		dev_err(&pdev->dev, "failed to register backlight\n");
+		return PTR_ERR(bl);
+	}
+
+	bl->props.brightness = 255;
+	backlight_update_status(bl);
+
+	platform_set_drvdata(pdev, bl);
+	return 0;
+}
+
+static const struct of_device_id rpi_backlight_of_match[] = {
+	{ .compatible = "raspberrypi,rpi-backlight" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, rpi_backlight_of_match);
+
+static struct platform_driver rpi_backlight_driver = {
+	.driver		= {
+		.name		= "rpi-backlight",
+		.of_match_table = of_match_ptr(rpi_backlight_of_match),
+	},
+	.probe		= rpi_backlight_probe,
+};
+
+module_platform_driver(rpi_backlight_driver);
+
+MODULE_AUTHOR("Gordon Hollingworth <gordon@raspberrypi.org>");
+MODULE_DESCRIPTION("Raspberry Pi mailbox based Backlight Driver");
+MODULE_LICENSE("GPL");
-- 
GitLab


From fd183c9bd0d5bbfef214c937d0b049e0d874aa54 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 23 Feb 2016 19:56:04 +0000
Subject: [PATCH 0090/1835] bcm2835-virtgpio: Virtual GPIO driver

Add a virtual GPIO driver that uses the firmware mailbox interface to
request that the VPU toggles LEDs.
---
 drivers/gpio/Kconfig         |   6 +
 drivers/gpio/Makefile        |   1 +
 drivers/gpio/gpio-bcm-virt.c | 214 +++++++++++++++++++++++++++++++++++
 3 files changed, 221 insertions(+)
 create mode 100644 drivers/gpio/gpio-bcm-virt.c

diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 4f52c3a8ec99b..02b7a1f817de7 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -151,6 +151,12 @@ config GPIO_BCM_KONA
 	help
 	  Turn on GPIO support for Broadcom "Kona" chips.
 
+config GPIO_BCM_VIRT
+	bool "Broadcom Virt GPIO"
+	depends on OF_GPIO && RASPBERRYPI_FIRMWARE && (ARCH_BCM2835 || COMPILE_TEST)
+	help
+	  Turn on virtual GPIO support for Broadcom BCM283X chips.
+
 config GPIO_BRCMSTB
 	tristate "BRCMSTB GPIO support"
 	default y if (ARCH_BRCMSTB || BMIPS_GENERIC)
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index c256aff66a656..73fd4d7b073d8 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -35,6 +35,7 @@ obj-$(CONFIG_GPIO_ASPEED)	+= gpio-aspeed.o
 obj-$(CONFIG_GPIO_RASPBERRYPI_EXP)	+= gpio-raspberrypi-exp.o
 obj-$(CONFIG_GPIO_BCM_KONA)	+= gpio-bcm-kona.o
 obj-$(CONFIG_GPIO_BD9571MWV)	+= gpio-bd9571mwv.o
+obj-$(CONFIG_GPIO_BCM_VIRT)	+= gpio-bcm-virt.o
 obj-$(CONFIG_GPIO_BRCMSTB)	+= gpio-brcmstb.o
 obj-$(CONFIG_GPIO_BT8XX)	+= gpio-bt8xx.o
 obj-$(CONFIG_GPIO_CLPS711X)	+= gpio-clps711x.o
diff --git a/drivers/gpio/gpio-bcm-virt.c b/drivers/gpio/gpio-bcm-virt.c
new file mode 100644
index 0000000000000..c3725546def9d
--- /dev/null
+++ b/drivers/gpio/gpio-bcm-virt.c
@@ -0,0 +1,214 @@
+/*
+ *  brcmvirt GPIO driver
+ *
+ *  Copyright (C) 2012,2013 Dom Cobley <popcornmix@gmail.com>
+ *  Based on gpio-clps711x.c by Alexander Shiyan <shc_work@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MODULE_NAME "brcmvirt-gpio"
+#define NUM_GPIO 2
+
+struct brcmvirt_gpio {
+	struct gpio_chip	gc;
+	u32 __iomem		*ts_base;
+	/* two packed 16-bit counts of enabled and disables
+           Allows host to detect a brief enable that was missed */
+	u32			enables_disables[NUM_GPIO];
+	dma_addr_t		bus_addr;
+};
+
+static int brcmvirt_gpio_dir_in(struct gpio_chip *gc, unsigned off)
+{
+	struct brcmvirt_gpio *gpio;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	return -EINVAL;
+}
+
+static int brcmvirt_gpio_dir_out(struct gpio_chip *gc, unsigned off, int val)
+{
+	struct brcmvirt_gpio *gpio;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	return 0;
+}
+
+static int brcmvirt_gpio_get(struct gpio_chip *gc, unsigned off)
+{
+	struct brcmvirt_gpio *gpio;
+	unsigned v;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	v = readl(gpio->ts_base + off);
+	return (v >> off) & 1;
+}
+
+static void brcmvirt_gpio_set(struct gpio_chip *gc, unsigned off, int val)
+{
+	struct brcmvirt_gpio *gpio;
+	u16 enables, disables;
+	s16 diff;
+	bool lit;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	enables  = gpio->enables_disables[off] >> 16;
+	disables = gpio->enables_disables[off] >>  0;
+	diff = (s16)(enables - disables);
+	lit = diff > 0;
+	if ((val && lit) || (!val && !lit))
+		return;
+	if (val)
+		enables++;
+	else
+		disables++;
+	diff = (s16)(enables - disables);
+	BUG_ON(diff != 0 && diff != 1);
+	gpio->enables_disables[off] = (enables << 16) | (disables << 0);
+	writel(gpio->enables_disables[off], gpio->ts_base + off);
+}
+
+static int brcmvirt_gpio_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *fw_node;
+	struct rpi_firmware *fw;
+	struct brcmvirt_gpio *ucb;
+	u32 gpiovirtbuf;
+
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	fw = rpi_firmware_get(fw_node);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	ucb = devm_kzalloc(dev, sizeof *ucb, GFP_KERNEL);
+	if (!ucb) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	ucb->ts_base = dma_zalloc_coherent(dev, PAGE_SIZE, &ucb->bus_addr, GFP_KERNEL);
+	if (!ucb->ts_base) {
+		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
+				__func__, PAGE_SIZE);
+		err = -ENOMEM;
+		goto out;
+	}
+
+	gpiovirtbuf = (u32)ucb->bus_addr;
+	err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF,
+				    &gpiovirtbuf, sizeof(gpiovirtbuf));
+
+	if (err || gpiovirtbuf != 0) {
+		dev_warn(dev, "Failed to set gpiovirtbuf, trying to get err:%x\n", err);
+		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
+		ucb->ts_base = 0;
+		ucb->bus_addr = 0;
+	}
+
+	if (!ucb->ts_base) {
+		err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF,
+					    &gpiovirtbuf, sizeof(gpiovirtbuf));
+
+		if (err) {
+			dev_err(dev, "Failed to get gpiovirtbuf\n");
+			goto out;
+		}
+
+		if (!gpiovirtbuf) {
+			dev_err(dev, "No virtgpio buffer\n");
+			err = -ENOENT;
+			goto out;
+		}
+
+		// mmap the physical memory
+		gpiovirtbuf &= ~0xc0000000;
+		ucb->ts_base = ioremap(gpiovirtbuf, 4096);
+		if (ucb->ts_base == NULL) {
+			dev_err(dev, "Failed to map physical address\n");
+			err = -ENOENT;
+			goto out;
+		}
+		ucb->bus_addr = 0;
+	}
+	ucb->gc.label = MODULE_NAME;
+	ucb->gc.owner = THIS_MODULE;
+	//ucb->gc.dev = dev;
+	ucb->gc.of_node = np;
+	ucb->gc.base = 100;
+	ucb->gc.ngpio = NUM_GPIO;
+
+	ucb->gc.direction_input = brcmvirt_gpio_dir_in;
+	ucb->gc.direction_output = brcmvirt_gpio_dir_out;
+	ucb->gc.get = brcmvirt_gpio_get;
+	ucb->gc.set = brcmvirt_gpio_set;
+	ucb->gc.can_sleep = true;
+
+	err = gpiochip_add(&ucb->gc);
+	if (err)
+		goto out;
+
+	platform_set_drvdata(pdev, ucb);
+
+	return 0;
+out:
+	if (ucb->bus_addr) {
+		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
+		ucb->bus_addr = 0;
+		ucb->ts_base = NULL;
+	} else if (ucb->ts_base) {
+		iounmap(ucb->ts_base);
+		ucb->ts_base = NULL;
+	}
+	return err;
+}
+
+static int brcmvirt_gpio_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	int err = 0;
+	struct brcmvirt_gpio *ucb = platform_get_drvdata(pdev);
+
+	gpiochip_remove(&ucb->gc);
+	if (ucb->bus_addr)
+		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
+	else if (ucb->ts_base)
+		iounmap(ucb->ts_base);
+	return err;
+}
+
+static const struct of_device_id __maybe_unused brcmvirt_gpio_ids[] = {
+	{ .compatible = "brcm,bcm2835-virtgpio" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, brcmvirt_gpio_ids);
+
+static struct platform_driver brcmvirt_gpio_driver = {
+	.driver	= {
+		.name		= MODULE_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= of_match_ptr(brcmvirt_gpio_ids),
+	},
+	.probe	= brcmvirt_gpio_probe,
+	.remove	= brcmvirt_gpio_remove,
+};
+module_platform_driver(brcmvirt_gpio_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dom Cobley <popcornmix@gmail.com>");
+MODULE_DESCRIPTION("brcmvirt GPIO driver");
+MODULE_ALIAS("platform:brcmvirt-gpio");
-- 
GitLab


From f91ad6b809795ae42687b93fff6f254b49b43245 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 3 Sep 2012 17:10:23 +0100
Subject: [PATCH 0091/1835] net: Add non-mainline source for rtl8192cu wlan

We are now syncing with version from:
https://github.com/pvaret/rtl8192cu-fixes
---
 drivers/net/wireless/realtek/Kconfig          |     1 +
 drivers/net/wireless/realtek/Makefile         |     1 +
 .../net/wireless/realtek/rtl8192cu/Kconfig    |     9 +
 .../net/wireless/realtek/rtl8192cu/Makefile   |   616 +
 drivers/net/wireless/realtek/rtl8192cu/clean  |     5 +
 .../realtek/rtl8192cu/core/efuse/rtw_efuse.c  |  1147 ++
 .../wireless/realtek/rtl8192cu/core/rtw_ap.c  |  2943 ++++
 .../realtek/rtl8192cu/core/rtw_br_ext.c       |  1700 ++
 .../wireless/realtek/rtl8192cu/core/rtw_cmd.c |  3035 ++++
 .../realtek/rtl8192cu/core/rtw_debug.c        |  1337 ++
 .../realtek/rtl8192cu/core/rtw_eeprom.c       |   423 +
 .../realtek/rtl8192cu/core/rtw_ieee80211.c    |  1916 +++
 .../wireless/realtek/rtl8192cu/core/rtw_io.c  |   464 +
 .../realtek/rtl8192cu/core/rtw_ioctl_query.c  |   196 +
 .../realtek/rtl8192cu/core/rtw_ioctl_rtl.c    |  1031 ++
 .../realtek/rtl8192cu/core/rtw_ioctl_set.c    |  1494 ++
 .../wireless/realtek/rtl8192cu/core/rtw_iol.c |   263 +
 .../realtek/rtl8192cu/core/rtw_mlme.c         |  3967 +++++
 .../realtek/rtl8192cu/core/rtw_mlme_ext.c     | 13600 ++++++++++++++++
 .../wireless/realtek/rtl8192cu/core/rtw_mp.c  |  1324 ++
 .../realtek/rtl8192cu/core/rtw_mp_ioctl.c     |  2954 ++++
 .../wireless/realtek/rtl8192cu/core/rtw_p2p.c |  5370 ++++++
 .../realtek/rtl8192cu/core/rtw_pwrctrl.c      |  1551 ++
 .../realtek/rtl8192cu/core/rtw_recv.c         |  4306 +++++
 .../wireless/realtek/rtl8192cu/core/rtw_rf.c  |    95 +
 .../realtek/rtl8192cu/core/rtw_security.c     |  3115 ++++
 .../realtek/rtl8192cu/core/rtw_sreset.c       |   352 +
 .../realtek/rtl8192cu/core/rtw_sta_mgt.c      |   848 +
 .../realtek/rtl8192cu/core/rtw_tdls.c         |  2941 ++++
 .../realtek/rtl8192cu/core/rtw_wlan_util.c    |  2305 +++
 .../realtek/rtl8192cu/core/rtw_xmit.c         |  4156 +++++
 .../realtek/rtl8192cu/hal/HalPwrSeqCmd.c      |   177 +
 .../net/wireless/realtek/rtl8192cu/hal/dm.c   |   314 +
 .../net/wireless/realtek/rtl8192cu/hal/dm.h   |    30 +
 .../wireless/realtek/rtl8192cu/hal/hal_com.c  |   371 +
 .../wireless/realtek/rtl8192cu/hal/hal_intf.c |   546 +
 .../rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c     |  1159 ++
 .../rtl8192cu/hal/rtl8192c/rtl8192c_dm.c      |  5058 ++++++
 .../hal/rtl8192c/rtl8192c_hal_init.c          |  3628 +++++
 .../rtl8192cu/hal/rtl8192c/rtl8192c_mp.c      |  1207 ++
 .../rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c  |  4841 ++++++
 .../rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c  |  1031 ++
 .../rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c  |   876 +
 .../rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c  |    94 +
 .../rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c    |    63 +
 .../hal/rtl8192c/usb/Hal8192CUHWImg.c         |  8758 ++++++++++
 .../hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c  |  2564 +++
 .../hal/rtl8192c/usb/rtl8192cu_led.c          |  2680 +++
 .../hal/rtl8192c/usb/rtl8192cu_recv.c         |   229 +
 .../hal/rtl8192c/usb/rtl8192cu_xmit.c         |  1150 ++
 .../rtl8192cu/hal/rtl8192c/usb/usb_halinit.c  |  6261 +++++++
 .../rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c   |  1207 ++
 .../hal/rtl8192c/usb/usb_ops_linux.c          |  1536 ++
 .../rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c   |  1265 ++
 .../wireless/realtek/rtl8192cu/ifcfg-wlan0    |     4 +
 .../rtl8192cu/include/Hal8192CEHWImg.h        |    85 +
 .../rtl8192cu/include/Hal8192CPhyCfg.h        |   428 +
 .../rtl8192cu/include/Hal8192CPhyReg.h        |  1123 ++
 .../rtl8192cu/include/Hal8192CUHWImg.h        |   105 +
 .../rtl8192cu/include/Hal8192CUHWImg_wowlan.h |    34 +
 .../rtl8192cu/include/Hal8192DEHWImg.h        |    66 +
 .../rtl8192cu/include/Hal8192DPhyCfg.h        |   528 +
 .../rtl8192cu/include/Hal8192DPhyReg.h        |  1171 ++
 .../rtl8192cu/include/Hal8192DUHWImg.h        |    66 +
 .../rtl8192cu/include/Hal8192DUHWImg_wowlan.h |    30 +
 .../realtek/rtl8192cu/include/HalPwrSeqCmd.h  |   137 +
 .../realtek/rtl8192cu/include/autoconf.h      |   336 +
 .../realtek/rtl8192cu/include/basic_types.h   |   321 +
 .../rtl8192cu/include/byteorder/big_endian.h  |    87 +
 .../rtl8192cu/include/byteorder/generic.h     |   212 +
 .../include/byteorder/little_endian.h         |    89 +
 .../rtl8192cu/include/byteorder/swab.h        |   140 +
 .../rtl8192cu/include/byteorder/swabb.h       |   156 +
 .../realtek/rtl8192cu/include/circ_buf.h      |    27 +
 .../realtek/rtl8192cu/include/cmd_osdep.h     |    36 +
 .../realtek/rtl8192cu/include/drv_conf.h      |    78 +
 .../realtek/rtl8192cu/include/drv_types.h     |   662 +
 .../realtek/rtl8192cu/include/drv_types_ce.h  |    92 +
 .../rtl8192cu/include/drv_types_linux.h       |    25 +
 .../rtl8192cu/include/drv_types_sdio.h        |    70 +
 .../realtek/rtl8192cu/include/drv_types_xp.h  |    95 +
 .../realtek/rtl8192cu/include/ethernet.h      |    41 +
 .../realtek/rtl8192cu/include/h2clbk.h        |    35 +
 .../realtek/rtl8192cu/include/hal_com.h       |   146 +
 .../realtek/rtl8192cu/include/hal_intf.h      |   432 +
 .../realtek/rtl8192cu/include/ieee80211.h     |  1580 ++
 .../realtek/rtl8192cu/include/ieee80211_ext.h |   477 +
 .../realtek/rtl8192cu/include/if_ether.h      |   112 +
 .../rtl8192cu/include/ioctl_cfg80211.h        |   184 +
 .../wireless/realtek/rtl8192cu/include/ip.h   |   141 +
 .../rtl8192cu/include/linux/wireless.h        |    90 +
 .../realtek/rtl8192cu/include/mlme_osdep.h    |    40 +
 .../realtek/rtl8192cu/include/mp_custom_oid.h |   353 +
 .../realtek/rtl8192cu/include/nic_spec.h      |    47 +
 .../rtl8192cu/include/osdep_ce_service.h      |   171 +
 .../realtek/rtl8192cu/include/osdep_intf.h    |   155 +
 .../realtek/rtl8192cu/include/osdep_service.h |  1821 +++
 .../realtek/rtl8192cu/include/pci_hal.h       |   168 +
 .../realtek/rtl8192cu/include/pci_ops.h       |    60 +
 .../realtek/rtl8192cu/include/pci_osintf.h    |    33 +
 .../realtek/rtl8192cu/include/recv_osdep.h    |    58 +
 .../realtek/rtl8192cu/include/rtl8192c_cmd.h  |   153 +
 .../realtek/rtl8192cu/include/rtl8192c_dm.h   |   516 +
 .../rtl8192cu/include/rtl8192c_event.h        |    28 +
 .../realtek/rtl8192cu/include/rtl8192c_hal.h  |   937 ++
 .../realtek/rtl8192cu/include/rtl8192c_led.h  |    42 +
 .../realtek/rtl8192cu/include/rtl8192c_recv.h |   184 +
 .../realtek/rtl8192cu/include/rtl8192c_rf.h   |    92 +
 .../realtek/rtl8192cu/include/rtl8192c_spec.h |  1865 +++
 .../rtl8192cu/include/rtl8192c_sreset.h       |    32 +
 .../realtek/rtl8192cu/include/rtl8192c_xmit.h |   129 +
 .../realtek/rtl8192cu/include/rtl8192d_cmd.h  |   142 +
 .../realtek/rtl8192cu/include/rtl8192d_dm.h   |   420 +
 .../realtek/rtl8192cu/include/rtl8192d_hal.h  |  1126 ++
 .../realtek/rtl8192cu/include/rtl8192d_led.h  |    43 +
 .../realtek/rtl8192cu/include/rtl8192d_recv.h |   187 +
 .../realtek/rtl8192cu/include/rtl8192d_rf.h   |    97 +
 .../realtek/rtl8192cu/include/rtl8192d_spec.h |  1841 +++
 .../realtek/rtl8192cu/include/rtl8192d_xmit.h |   145 +
 .../realtek/rtl8192cu/include/rtw_android.h   |    90 +
 .../realtek/rtl8192cu/include/rtw_ap.h        |    64 +
 .../realtek/rtl8192cu/include/rtw_br_ext.h    |    76 +
 .../realtek/rtl8192cu/include/rtw_byteorder.h |    40 +
 .../realtek/rtl8192cu/include/rtw_cmd.h       |  1167 ++
 .../realtek/rtl8192cu/include/rtw_debug.h     |   538 +
 .../realtek/rtl8192cu/include/rtw_eeprom.h    |   152 +
 .../realtek/rtl8192cu/include/rtw_efuse.h     |   124 +
 .../realtek/rtl8192cu/include/rtw_event.h     |   154 +
 .../realtek/rtl8192cu/include/rtw_ht.h        |    50 +
 .../realtek/rtl8192cu/include/rtw_io.h        |   504 +
 .../realtek/rtl8192cu/include/rtw_ioctl.h     |   269 +
 .../rtl8192cu/include/rtw_ioctl_query.h       |    36 +
 .../realtek/rtl8192cu/include/rtw_ioctl_rtl.h |    83 +
 .../realtek/rtl8192cu/include/rtw_ioctl_set.h |    79 +
 .../realtek/rtl8192cu/include/rtw_iol.h       |    89 +
 .../realtek/rtl8192cu/include/rtw_led.h       |   217 +
 .../realtek/rtl8192cu/include/rtw_mlme.h      |   850 +
 .../realtek/rtl8192cu/include/rtw_mlme_ext.h  |   963 ++
 .../realtek/rtl8192cu/include/rtw_mp.h        |   712 +
 .../realtek/rtl8192cu/include/rtw_mp_ioctl.h  |   596 +
 .../rtl8192cu/include/rtw_mp_phy_regdef.h     |  1097 ++
 .../realtek/rtl8192cu/include/rtw_p2p.h       |   161 +
 .../realtek/rtl8192cu/include/rtw_pwrctrl.h   |   362 +
 .../realtek/rtl8192cu/include/rtw_qos.h       |    40 +
 .../realtek/rtl8192cu/include/rtw_recv.h      |   731 +
 .../realtek/rtl8192cu/include/rtw_rf.h        |   152 +
 .../realtek/rtl8192cu/include/rtw_security.h  |   447 +
 .../realtek/rtl8192cu/include/rtw_sreset.h    |    74 +
 .../realtek/rtl8192cu/include/rtw_tdls.h      |   143 +
 .../realtek/rtl8192cu/include/rtw_version.h   |     1 +
 .../realtek/rtl8192cu/include/rtw_xmit.h      |   754 +
 .../realtek/rtl8192cu/include/sta_info.h      |   432 +
 .../realtek/rtl8192cu/include/usb_hal.h       |    37 +
 .../realtek/rtl8192cu/include/usb_ops.h       |   110 +
 .../realtek/rtl8192cu/include/usb_ops_linux.h |    63 +
 .../realtek/rtl8192cu/include/usb_osintf.h    |    38 +
 .../rtl8192cu/include/usb_vendor_req.h        |    59 +
 .../wireless/realtek/rtl8192cu/include/wifi.h |  1248 ++
 .../realtek/rtl8192cu/include/wlan_bssdef.h   |   703 +
 .../realtek/rtl8192cu/include/xmit_osdep.h    |    95 +
 .../rtl8192cu/os_dep/linux/ioctl_cfg80211.c   |  5589 +++++++
 .../rtl8192cu/os_dep/linux/ioctl_linux.c      | 11909 ++++++++++++++
 .../rtl8192cu/os_dep/linux/mlme_linux.c       |   653 +
 .../realtek/rtl8192cu/os_dep/linux/os_intfs.c |  2768 ++++
 .../realtek/rtl8192cu/os_dep/linux/pci_intf.c |  1997 +++
 .../rtl8192cu/os_dep/linux/pci_ops_linux.c    |    24 +
 .../rtl8192cu/os_dep/linux/recv_linux.c       |   461 +
 .../rtl8192cu/os_dep/linux/rtw_android.c      |   839 +
 .../realtek/rtl8192cu/os_dep/linux/usb_intf.c |  1662 ++
 .../rtl8192cu/os_dep/linux/usb_ops_linux.c    |   649 +
 .../rtl8192cu/os_dep/linux/xmit_linux.c       |   421 +
 .../realtek/rtl8192cu/os_dep/osdep_service.c  |  2300 +++
 drivers/net/wireless/realtek/rtl8192cu/runwpa |    20 +
 .../net/wireless/realtek/rtl8192cu/wlan0dhcp  |    15 +
 174 files changed, 171743 insertions(+)
 create mode 100644 drivers/net/wireless/realtek/rtl8192cu/Kconfig
 create mode 100644 drivers/net/wireless/realtek/rtl8192cu/Makefile
 create mode 100644 drivers/net/wireless/realtek/rtl8192cu/clean
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/dm.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/dm.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/ip.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h
 create mode 100644 drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/wifi.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/runwpa
 create mode 100755 drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp

diff --git a/drivers/net/wireless/realtek/Kconfig b/drivers/net/wireless/realtek/Kconfig
index 3db988e689d78..f28b4520b9898 100644
--- a/drivers/net/wireless/realtek/Kconfig
+++ b/drivers/net/wireless/realtek/Kconfig
@@ -13,6 +13,7 @@ if WLAN_VENDOR_REALTEK
 
 source "drivers/net/wireless/realtek/rtl818x/Kconfig"
 source "drivers/net/wireless/realtek/rtlwifi/Kconfig"
+source "drivers/net/wireless/realtek/rtl8192cu/Kconfig"
 source "drivers/net/wireless/realtek/rtl8xxxu/Kconfig"
 
 endif # WLAN_VENDOR_REALTEK
diff --git a/drivers/net/wireless/realtek/Makefile b/drivers/net/wireless/realtek/Makefile
index 9c78deb5eea94..e5407ed508336 100644
--- a/drivers/net/wireless/realtek/Makefile
+++ b/drivers/net/wireless/realtek/Makefile
@@ -5,5 +5,6 @@
 obj-$(CONFIG_RTL8180)		+= rtl818x/
 obj-$(CONFIG_RTL8187)		+= rtl818x/
 obj-$(CONFIG_RTLWIFI)		+= rtlwifi/
+obj-$(CONFIG_RTL8192CU)		+= rtl8192cu/
 obj-$(CONFIG_RTL8XXXU)		+= rtl8xxxu/
 
diff --git a/drivers/net/wireless/realtek/rtl8192cu/Kconfig b/drivers/net/wireless/realtek/rtl8192cu/Kconfig
new file mode 100644
index 0000000000000..cd7830bb9d5de
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/Kconfig
@@ -0,0 +1,9 @@
+config RTL8192CU
+	tristate "Realtek 8192C USB WiFi"
+	depends on MAC80211 && USB
+	select CFG80211_WEXT
+	select WIRELESS_EXT
+	select WEXT_PRIV
+	---help---
+	  This option adds the Realtek RTL8192CU USB device such as Edimax EW-7811Un.
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/Makefile b/drivers/net/wireless/realtek/rtl8192cu/Makefile
new file mode 100644
index 0000000000000..c399011a3e377
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/Makefile
@@ -0,0 +1,616 @@
+EXTRA_CFLAGS += $(USER_EXTRA_CFLAGS)
+EXTRA_CFLAGS += -O1
+#EXTRA_CFLAGS += -O3
+#EXTRA_CFLAGS += -Wall
+#EXTRA_CFLAGS += -Wextra
+#EXTRA_CFLAGS += -Werror
+#EXTRA_CFLAGS += -pedantic
+#EXTRA_CFLAGS += -Wshadow -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes
+
+EXTRA_CFLAGS += -Wno-unused-variable
+EXTRA_CFLAGS += -Wno-unused-value
+EXTRA_CFLAGS += -Wno-unused-label
+EXTRA_CFLAGS += -Wno-unused-parameter
+EXTRA_CFLAGS += -Wno-unused-function
+EXTRA_CFLAGS += -Wno-unused
+
+EXTRA_CFLAGS += -Wno-uninitialized
+
+EXTRA_CFLAGS += -I$(src)/include
+
+CONFIG_AUTOCFG_CP = n
+
+CONFIG_RTL8192C = y
+CONFIG_RTL8192D = n
+CONFIG_RTL8723A = n
+
+CONFIG_USB_HCI = y
+CONFIG_PCI_HCI = n
+CONFIG_SDIO_HCI = n
+
+CONFIG_MP_INCLUDED = n
+CONFIG_POWER_SAVING = y
+CONFIG_USB_AUTOSUSPEND = n
+CONFIG_HW_PWRP_DETECTION = n
+CONFIG_WIFI_TEST = n
+CONFIG_BT_COEXISTENCE = n
+CONFIG_RTL8192CU_REDEFINE_1X1 = n
+CONFIG_INTEL_WIDI = n
+CONFIG_WAKE_ON_WLAN = n
+
+CONFIG_PLATFORM_I386_PC = y
+CONFIG_PLATFORM_TI_AM3517 = n
+CONFIG_PLATFORM_ANDROID_X86 = n
+CONFIG_PLATFORM_JB_X86 = n
+CONFIG_PLATFORM_ARM_S3C2K4 = n
+CONFIG_PLATFORM_ARM_PXA2XX = n
+CONFIG_PLATFORM_ARM_S3C6K4 = n
+CONFIG_PLATFORM_MIPS_RMI = n
+CONFIG_PLATFORM_RTD2880B = n
+CONFIG_PLATFORM_MIPS_AR9132 = n
+CONFIG_PLATFORM_RTK_DMP = n
+CONFIG_PLATFORM_MIPS_PLM = n
+CONFIG_PLATFORM_MSTAR389 = n
+CONFIG_PLATFORM_MT53XX = n
+CONFIG_PLATFORM_ARM_MX51_241H = n
+CONFIG_PLATFORM_FS_MX61 = n
+CONFIG_PLATFORM_ACTIONS_ATJ227X = n
+CONFIG_PLATFORM_TEGRA3_CARDHU = n
+CONFIG_PLATFORM_TEGRA4_DALMORE = n
+CONFIG_PLATFORM_ARM_TCC8900 = n
+CONFIG_PLATFORM_ARM_TCC8920 = n
+CONFIG_PLATFORM_ARM_TCC8920_JB42 = n
+CONFIG_PLATFORM_ARM_RK2818 = n
+CONFIG_PLATFORM_ARM_TI_PANDA = n
+CONFIG_PLATFORM_MIPS_JZ4760 = n
+CONFIG_PLATFORM_DMP_PHILIPS = n
+CONFIG_PLATFORM_TI_DM365 = n
+CONFIG_PLATFORM_MN10300 = n
+CONFIG_PLATFORM_MSTAR_TITANIA12 = n
+CONFIG_PLATFORM_MSTAR_A3 = n
+CONFIG_PLATFORM_ARM_SUNxI = n
+CONFIG_PLATFORM_ARM_SUN6I = n
+
+CONFIG_DRVEXT_MODULE = n
+
+export TopDIR ?= $(shell pwd)
+
+
+ifeq ($(CONFIG_RTL8192C), y)
+
+RTL871X = rtl8192c
+
+ifeq ($(CONFIG_USB_HCI), y)
+MODULE_NAME = 8192cu
+FW_FILES := hal/$(RTL871X)/usb/Hal8192CUHWImg.o
+ifneq ($(CONFIG_WAKE_ON_WLAN), n)
+FW_FILES += hal/$(RTL871X)/usb/Hal8192CUHWImg_wowlan.o
+endif
+endif
+ifeq ($(CONFIG_PCI_HCI), y)
+MODULE_NAME = 8192ce
+FW_FILES := hal/$(RTL871X)/pci/Hal8192CEHWImg.o
+endif
+
+CHIP_FILES := \
+	hal/$(RTL871X)/$(RTL871X)_sreset.o \
+	hal/$(RTL871X)/$(RTL871X)_xmit.o
+CHIP_FILES += $(FW_FILES)
+endif
+
+ifeq ($(CONFIG_RTL8192D), y)
+
+RTL871X = rtl8192d
+
+ifeq ($(CONFIG_USB_HCI), y)
+MODULE_NAME = 8192du
+FW_FILES := hal/$(RTL871X)/usb/Hal8192DUHWImg.o
+ifneq ($(CONFIG_WAKE_ON_WLAN), n)
+FW_FILES += hal/$(RTL871X)/usb/Hal8192DUHWImg_wowlan.o
+endif
+endif
+ifeq ($(CONFIG_PCI_HCI), y)
+MODULE_NAME = 8192de
+FW_FILES := hal/$(RTL871X)/pci/Hal8192DEHWImg.o
+endif
+
+CHIP_FILES := \
+	hal/$(RTL871X)/$(RTL871X)_xmit.o
+CHIP_FILES += $(FW_FILES)
+endif
+
+ifeq ($(CONFIG_RTL8723A), y)
+
+RTL871X = rtl8723a
+
+ifeq ($(CONFIG_SDIO_HCI), y)
+MODULE_NAME = 8723as
+FW_FILES := hal/$(RTL871X)/sdio/Hal8723SHWImg.o
+endif
+
+ifeq ($(CONFIG_USB_HCI), y)
+MODULE_NAME = 8723au
+FW_FILES := hal/$(RTL871X)/usb/Hal8723UHWImg.o
+endif
+
+ifeq ($(CONFIG_PCI_HCI), y)
+MODULE_NAME = 8723ae
+FW_FILES := hal/$(RTL871X)/pci/Hal8723EHWImg.o
+endif
+
+PWRSEQ_FILES := hal/HalPwrSeqCmd.o \
+				hal/$(RTL871X)/Hal8723PwrSeq.o
+
+CHIP_FILES += $(FW_FILES) $(PWRSEQ_FILES)
+
+endif
+
+ifeq ($(CONFIG_SDIO_HCI), y)
+HCI_NAME = sdio
+endif
+
+ifeq ($(CONFIG_USB_HCI), y)
+HCI_NAME = usb
+endif
+
+ifeq ($(CONFIG_PCI_HCI), y)
+HCI_NAME = pci
+endif
+
+
+_OS_INTFS_FILES :=	os_dep/osdep_service.o \
+			os_dep/linux/os_intfs.o \
+			os_dep/linux/$(HCI_NAME)_intf.o \
+			os_dep/linux/$(HCI_NAME)_ops_linux.o \
+			os_dep/linux/ioctl_linux.o \
+			os_dep/linux/xmit_linux.o \
+			os_dep/linux/mlme_linux.o \
+			os_dep/linux/recv_linux.o \
+			os_dep/linux/ioctl_cfg80211.o \
+			os_dep/linux/rtw_android.o
+
+
+_HAL_INTFS_FILES :=	hal/hal_intf.o \
+			hal/hal_com.o \
+			hal/dm.o \
+			hal/$(RTL871X)/$(RTL871X)_hal_init.o \
+			hal/$(RTL871X)/$(RTL871X)_phycfg.o \
+			hal/$(RTL871X)/$(RTL871X)_rf6052.o \
+			hal/$(RTL871X)/$(RTL871X)_dm.o \
+			hal/$(RTL871X)/$(RTL871X)_rxdesc.o \
+			hal/$(RTL871X)/$(RTL871X)_cmd.o \
+			hal/$(RTL871X)/$(HCI_NAME)/$(HCI_NAME)_halinit.o \
+			hal/$(RTL871X)/$(HCI_NAME)/rtl$(MODULE_NAME)_led.o \
+			hal/$(RTL871X)/$(HCI_NAME)/rtl$(MODULE_NAME)_xmit.o \
+			hal/$(RTL871X)/$(HCI_NAME)/rtl$(MODULE_NAME)_recv.o
+
+ifeq ($(CONFIG_SDIO_HCI), y)
+_HAL_INTFS_FILES += hal/$(RTL871X)/$(HCI_NAME)/$(HCI_NAME)_ops.o
+else
+_HAL_INTFS_FILES += hal/$(RTL871X)/$(HCI_NAME)/$(HCI_NAME)_ops_linux.o
+endif
+
+ifeq ($(CONFIG_MP_INCLUDED), y)
+_HAL_INTFS_FILES += hal/$(RTL871X)/$(RTL871X)_mp.o
+endif
+
+_HAL_INTFS_FILES += $(CHIP_FILES)
+
+
+ifeq ($(CONFIG_AUTOCFG_CP), y)
+$(shell cp $(TopDIR)/autoconf_$(RTL871X)_$(HCI_NAME)_linux.h $(TopDIR)/include/autoconf.h)
+endif
+
+
+ifeq ($(CONFIG_USB_HCI), y)
+ifeq ($(CONFIG_USB_AUTOSUSPEND), y)
+EXTRA_CFLAGS += -DCONFIG_USB_AUTOSUSPEND
+endif
+endif
+
+ifeq ($(CONFIG_POWER_SAVING), y)
+EXTRA_CFLAGS += -DCONFIG_POWER_SAVING
+endif
+
+ifeq ($(CONFIG_HW_PWRP_DETECTION), y)
+EXTRA_CFLAGS += -DCONFIG_HW_PWRP_DETECTION
+endif
+
+ifeq ($(CONFIG_WIFI_TEST), y)
+EXTRA_CFLAGS += -DCONFIG_WIFI_TEST
+endif
+
+ifeq ($(CONFIG_BT_COEXISTENCE), y)
+EXTRA_CFLAGS += -DCONFIG_BT_COEXISTENCE
+endif
+
+ifeq ($(CONFIG_RTL8192CU_REDEFINE_1X1), y)
+EXTRA_CFLAGS += -DRTL8192C_RECONFIG_TO_1T1R
+endif
+
+ifeq ($(CONFIG_WAKE_ON_WLAN), y)
+EXTRA_CFLAGS += -DCONFIG_WAKE_ON_WLAN
+endif
+
+ifeq ($(CONFIG_INTEL_WIDI), y)
+EXTRA_CFLAGS += -DCONFIG_INTEL_WIDI
+endif
+
+ifeq ($(CONFIG_PLATFORM_I386_PC), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+SUBARCH := $(shell uname -m | sed -e s/i.86/i386/)
+ARCH ?= $(SUBARCH)
+CROSS_COMPILE ?=
+KVER  := $(shell uname -r)
+KSRC := /lib/modules/$(KVER)/build
+MODDESTDIR := /lib/modules/$(KVER)/kernel/drivers/net/wireless/
+INSTALL_PREFIX :=
+endif
+
+ifeq ($(CONFIG_PLATFORM_TI_AM3517), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ANDROID -DCONFIG_PLATFORM_SHUTTLE
+CROSS_COMPILE := arm-eabi-
+KSRC := $(shell pwd)/../../../Android/kernel
+ARCH := arm
+endif
+
+ifeq ($(CONFIG_PLATFORM_MSTAR_TITANIA12), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MSTAR -DCONFIG_PLATFORM_MSTAR_TITANIA12
+ARCH:=mips
+CROSS_COMPILE:= /usr/src/Mstar_kernel/mips-4.3/bin/mips-linux-gnu-
+KVER:= 2.6.28.9
+KSRC:= /usr/src/Mstar_kernel/2.6.28.9/
+endif
+
+ifeq ($(CONFIG_PLATFORM_MSTAR_A3), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MSTAR -DCONFIG_PLATFORM_MSTAR_A3
+ARCH:=arm
+CROSS_COMPILE:= arm-none-linux-gnueabi-
+KVER:= 2.6.35.11
+KSRC:= /home/gary/PERFORCE/THEALE/RedLion/2.6.35.11/
+MODULE_NAME = wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ANDROID_X86), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+SUBARCH := $(shell uname -m | sed -e s/i.86/i386/)
+ARCH := $(SUBARCH)
+CROSS_COMPILE := /media/DATA-2/android-x86/ics-x86_20120130/prebuilt/linux-x86/toolchain/i686-unknown-linux-gnu-4.2.1/bin/i686-unknown-linux-gnu-
+KSRC := /media/DATA-2/android-x86/ics-x86_20120130/out/target/product/generic_x86/obj/kernel
+MODULE_NAME :=wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_JB_X86), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+SUBARCH := $(shell uname -m | sed -e s/i.86/i386/)
+ARCH := $(SUBARCH)
+CROSS_COMPILE := /home/android_sdk/android-x86_JB/prebuilts/gcc/linux-x86/x86/i686-linux-android-4.7/bin/i686-linux-android-
+KSRC := /home/android_sdk/android-x86_JB/out/target/product/x86/obj/kernel/
+MODULE_NAME :=wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_PXA2XX), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 2.6.34.1
+KSRC ?= /usr/src/linux-2.6.34.1
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_S3C2K4), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := arm-linux-
+KVER  := 2.6.24.7_$(ARCH)
+KSRC := /usr/src/kernels/linux-$(KVER)
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_S3C6K4), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 2.6.34.1
+KSRC ?= /usr/src/linux-2.6.34.1
+endif
+
+ifeq ($(CONFIG_PLATFORM_RTD2880B), y)
+EXTRA_CFLAGS += -DCONFIG_BIG_ENDIAN -DCONFIG_PLATFORM_RTD2880B
+ARCH:=
+CROSS_COMPILE:=
+KVER:=
+KSRC:=
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_RMI), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH:=mips
+CROSS_COMPILE:=mipsisa32r2-uclibc-
+KVER:=
+KSRC:= /root/work/kernel_realtek
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_PLM), y)
+EXTRA_CFLAGS += -DCONFIG_BIG_ENDIAN
+ARCH:=mips
+CROSS_COMPILE:=mipsisa32r2-uclibc-
+KVER:=
+KSRC:= /root/work/kernel_realtek
+endif
+
+ifeq ($(CONFIG_PLATFORM_MSTAR389), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MSTAR389
+ARCH:=mips
+CROSS_COMPILE:= mips-linux-gnu-
+KVER:= 2.6.28.10
+KSRC:= /home/mstar/mstar_linux/2.6.28.9/
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_AR9132), y)
+EXTRA_CFLAGS += -DCONFIG_BIG_ENDIAN
+ARCH := mips
+CROSS_COMPILE := mips-openwrt-linux-
+KSRC := /home/alex/test_openwrt/tmp/linux-2.6.30.9
+endif
+
+ifeq ($(CONFIG_PLATFORM_DMP_PHILIPS), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DRTK_DMP_PLATFORM
+ARCH := mips
+#CROSS_COMPILE:=/usr/local/msdk-4.3.6-mips-EL-2.6.12.6-0.9.30.3/bin/mipsel-linux-
+CROSS_COMPILE:=/usr/local/toolchain_mipsel/bin/mipsel-linux-
+KSRC ?=/usr/local/Jupiter/linux-2.6.12
+endif
+
+ifeq ($(CONFIG_PLATFORM_RTK_DMP), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DRTK_DMP_PLATFORM
+ARCH:=mips
+CROSS_COMPILE:=mipsel-linux-
+KVER:=
+KSRC ?= /usr/src/DMP_Kernel/jupiter/linux-2.6.12
+endif
+
+ifeq ($(CONFIG_PLATFORM_MT53XX), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MT53XX
+ARCH:= arm
+CROSS_COMPILE:= arm11_mtk_le-
+KVER:= 2.6.27
+KSRC?= /proj/mtk00802/BD_Compare/BDP/Dev/BDP_V301/BDP_Linux/linux-2.6.27
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_MX51_241H), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_WISTRON_PLATFORM
+ARCH := arm
+CROSS_COMPILE := /opt/freescale/usr/local/gcc-4.1.2-glibc-2.5-nptl-3/arm-none-linux-gnueabi/bin/arm-none-linux-gnueabi-
+KVER  := 2.6.31
+KSRC ?= /lib/modules/2.6.31-770-g0e46b52/source
+endif
+
+ifeq ($(CONFIG_PLATFORM_FS_MX61), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN 
+ARCH := arm
+CROSS_COMPILE := /home/share/CusEnv/FreeScale/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC ?= /home/share/CusEnv/FreeScale/FS_kernel_env
+endif
+
+
+
+ifeq ($(CONFIG_PLATFORM_ACTIONS_ATJ227X), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ACTIONS_ATJ227X
+ARCH := mips
+CROSS_COMPILE := /home/cnsd4/project/actions/tools-2.6.27/bin/mipsel-linux-gnu-
+KVER  := 2.6.27
+KSRC := /home/cnsd4/project/actions/linux-2.6.27.28
+endif
+
+ifeq ($(CONFIG_PLATFORM_TI_DM365), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_TI_DM365
+ARCH := arm
+CROSS_COMPILE := /home/cnsd4/Appro/mv_pro_5.0/montavista/pro/devkit/arm/v5t_le/bin/arm_v5t_le-
+KVER  := 2.6.18
+KSRC := /home/cnsd4/Appro/mv_pro_5.0/montavista/pro/devkit/lsp/ti-davinci/linux-dm365
+endif
+
+ifeq ($(CONFIG_PLATFORM_TEGRA3_CARDHU), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DRTW_ENABLE_WIFI_CONTROL_FUNC
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/nvidia/tegra-16r3-partner-android-4.1_20120723/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /home/android_sdk/nvidia/tegra-16r3-partner-android-4.1_20120723/out/target/product/cardhu/obj/KERNEL
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_TEGRA4_DALMORE), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DRTW_ENABLE_WIFI_CONTROL_FUNC
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/nvidia/tegra-17r9-partner-android-4.2-dalmore_20130131/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
+KSRC := /home/android_sdk/nvidia/tegra-17r9-partner-android-4.2-dalmore_20130131/out/target/product/dalmore/obj/KERNEL
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TCC8900), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/Telechips/SDK_2304_20110613/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /home/android_sdk/Telechips/SDK_2304_20110613/kernel
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TCC8920), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/Telechips/v12.06_r1-tcc-android-4.0.4/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /home/android_sdk/Telechips/v12.06_r1-tcc-android-4.0.4/kernel
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TCC8920_JB42), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/Telechips/v13.03_r1-tcc-android-4.2.2_ds_patched/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
+KSRC := /home/android_sdk/Telechips/v13.03_r1-tcc-android-4.2.2_ds_patched/kernel
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_RK2818), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ANDROID -DCONFIG_PLATFORM_ROCKCHIPS -DCONFIG_MINIMAL_MEMORY_USAGE
+ARCH := arm
+CROSS_COMPILE := /usr/src/release_fae_version/toolchain/arm-eabi-4.4.0/bin/arm-eabi-
+KSRC := /usr/src/release_fae_version/kernel25_A7_281x
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TI_PANDA), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN #-DCONFIG_MINIMAL_MEMORY_USAGE
+ARCH := arm
+#CROSS_COMPILE := /media/DATA-1/aosp/ics-aosp_20111227/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+#KSRC := /media/DATA-1/aosp/android-omap-panda-3.0_20120104
+CROSS_COMPILE := /media/DATA-1/android-4.0/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /media/DATA-1/android-4.0/panda_kernel/omap
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_JZ4760), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_MINIMAL_MEMORY_USAGE
+ARCH ?= mips
+CROSS_COMPILE ?= /mnt/sdb5/Ingenic/Umido/mips-4.3/bin/mips-linux-gnu-
+KSRC ?= /mnt/sdb5/Ingenic/Umido/kernel
+endif
+
+#Add setting for MN10300
+ifeq ($(CONFIG_PLATFORM_MN10300), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MN10300
+ARCH := mn10300
+CROSS_COMPILE := mn10300-linux-
+KVER := 2.6.32.2
+KSRC := /home/winuser/work/Plat_sLD2T_V3010/usr/src/linux-2.6.32.2
+INSTALL_PREFIX :=
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_SUNxI), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ARM_SUNxI
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 3.0.8
+#KSRC:= ../lichee/linux-3.0/
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_SUN6I), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+EXTRA_CFLAGS += -DCONFIG_PLATFORM_ARM_SUN6I
+EXTRA_CFLAGS += -DCONFIG_USE_USB_BUFFER_ALLOC_TX
+EXTRA_CFLAGS += -DCONFIG_TRAFFIC_PROTECT
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 3.3.0
+#KSRC:= ../lichee/linux-3.3/
+endif
+
+ifneq ($(USER_MODULE_NAME),)
+MODULE_NAME := $(USER_MODULE_NAME)
+endif
+
+ifeq ($(CONFIG_MP_INCLUDED), y)
+MODULE_NAME := $(MODULE_NAME)_mp
+EXTRA_CFLAGS += -DCONFIG_MP_INCLUDED
+endif
+
+
+ifneq ($(KERNELRELEASE),)
+
+
+rtk_core :=	core/rtw_cmd.o \
+		core/rtw_security.o \
+		core/rtw_debug.o \
+		core/rtw_io.o \
+		core/rtw_ioctl_query.o \
+		core/rtw_ioctl_set.o \
+		core/rtw_ieee80211.o \
+		core/rtw_mlme.o \
+		core/rtw_mlme_ext.o \
+		core/rtw_wlan_util.o \
+		core/rtw_pwrctrl.o \
+		core/rtw_rf.o \
+		core/rtw_recv.o \
+		core/rtw_sta_mgt.o \
+		core/rtw_ap.o \
+		core/rtw_xmit.o	\
+		core/rtw_p2p.o \
+		core/rtw_tdls.o \
+		core/rtw_br_ext.o \
+		core/rtw_iol.o \
+		core/rtw_sreset.o
+
+$(MODULE_NAME)-y += $(rtk_core)
+
+$(MODULE_NAME)-$(CONFIG_INTEL_WIDI) += core/rtw_intel_widi.o
+
+$(MODULE_NAME)-y += core/efuse/rtw_efuse.o
+
+$(MODULE_NAME)-y += $(_HAL_INTFS_FILES)
+
+$(MODULE_NAME)-y += $(_OS_INTFS_FILES)
+
+$(MODULE_NAME)-$(CONFIG_MP_INCLUDED) += core/rtw_mp.o \
+					core/rtw_mp_ioctl.o
+
+obj-$(CONFIG_RTL8192CU) := $(MODULE_NAME).o
+
+else
+
+export CONFIG_RTL8192CU = m
+
+all: modules
+
+modules:
+	$(MAKE) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) -C $(KSRC) M=$(shell pwd)  modules
+
+strip:
+	$(CROSS_COMPILE)strip $(MODULE_NAME).ko --strip-unneeded
+
+install:
+	install -p -m 644 $(MODULE_NAME).ko  $(MODDESTDIR)
+	/sbin/depmod -a ${KVER}
+
+uninstall:
+	rm -f $(MODDESTDIR)/$(MODULE_NAME).ko
+	/sbin/depmod -a ${KVER}
+
+
+config_r:
+	@echo "make config"
+	/bin/bash script/Configure script/config.in
+
+.PHONY: modules clean
+
+clean:
+	rm -fr *.mod.c *.mod *.o .*.cmd *.ko *~
+	rm .tmp_versions -fr ; rm Module.symvers -fr
+	rm -fr Module.markers ; rm -fr modules.order
+	cd core/efuse ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd core ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd hal/$(RTL871X)/$(HCI_NAME) ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd hal/$(RTL871X) ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd hal ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd os_dep/linux ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd os_dep ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/clean b/drivers/net/wireless/realtek/rtl8192cu/clean
new file mode 100644
index 0000000000000..87664218b8891
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/clean
@@ -0,0 +1,5 @@
+#!/bin/bash
+rmmod 8192cu
+rmmod 8192ce
+rmmod 8192du
+rmmod 8192de
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c b/drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c
new file mode 100755
index 0000000000000..3d341accc9aa7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c
@@ -0,0 +1,1147 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_EFUSE_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#include <rtw_efuse.h>
+
+
+
+/*------------------------Define local variable------------------------------*/
+u8	fakeEfuseBank=0;
+u32	fakeEfuseUsedBytes=0;
+u8	fakeEfuseContent[EFUSE_MAX_HW_SIZE]={0};
+u8	fakeEfuseInitMap[EFUSE_MAX_MAP_LEN]={0};
+u8	fakeEfuseModifiedMap[EFUSE_MAX_MAP_LEN]={0};
+
+u32	BTEfuseUsedBytes=0;
+u8	BTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+u8	BTEfuseInitMap[EFUSE_BT_MAX_MAP_LEN]={0};
+u8	BTEfuseModifiedMap[EFUSE_BT_MAX_MAP_LEN]={0};
+
+u32	fakeBTEfuseUsedBytes=0;
+u8	fakeBTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+u8	fakeBTEfuseInitMap[EFUSE_BT_MAX_MAP_LEN]={0};
+u8	fakeBTEfuseModifiedMap[EFUSE_BT_MAX_MAP_LEN]={0};
+/*------------------------Define local variable------------------------------*/
+
+//------------------------------------------------------------------------------
+#define REG_EFUSE_CTRL		0x0030
+#define EFUSE_CTRL			REG_EFUSE_CTRL		// E-Fuse Control.
+//------------------------------------------------------------------------------
+
+BOOLEAN
+Efuse_Read1ByteFromFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN OUT	u8		*Value	);
+BOOLEAN
+Efuse_Read1ByteFromFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN OUT	u8		*Value	)
+{
+	if(Offset >= EFUSE_MAX_HW_SIZE)
+	{
+		return _FALSE;
+	}
+	//DbgPrint("Read fake content, offset = %d\n", Offset);
+	if(fakeEfuseBank == 0)
+		*Value = fakeEfuseContent[Offset];
+	else
+		*Value = fakeBTEfuseContent[fakeEfuseBank-1][Offset];
+	return _TRUE;
+}
+
+BOOLEAN
+Efuse_Write1ByteToFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN 		u8		Value	);
+BOOLEAN
+Efuse_Write1ByteToFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN 		u8		Value	)
+{
+	if(Offset >= EFUSE_MAX_HW_SIZE)
+	{
+		return _FALSE;
+	}
+	if(fakeEfuseBank == 0)
+		fakeEfuseContent[Offset] = Value;
+	else
+	{
+		fakeBTEfuseContent[fakeEfuseBank-1][Offset] = Value;
+	}
+	return _TRUE;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	Efuse_PowerSwitch
+ *
+ * Overview:	When we want to enable write operation, we should change to 
+ *				pwr on state. When we stop write, we should switch to 500k mode
+ *				and disable LDO 2.5V.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/17/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+Efuse_PowerSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	pAdapter->HalFunc.EfusePowerSwitch(pAdapter, bWrite, PwrState);
+}	
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_GetCurrentSize
+ *
+ * Overview:	Get current efuse size!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/16/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+u16
+Efuse_GetCurrentSize(
+	IN PADAPTER		pAdapter,
+	IN u8			efuseType,
+	IN BOOLEAN		bPseudoTest)
+{
+	u16 ret=0;
+
+	ret = pAdapter->HalFunc.EfuseGetCurrentSize(pAdapter, efuseType, bPseudoTest);
+
+	return ret;
+}
+
+/*  11/16/2008 MH Add description. Get current efuse area enabled word!!. */
+u8
+Efuse_CalculateWordCnts(IN u8	word_en)
+{
+	u8 word_cnts = 0;
+	if(!(word_en & BIT(0)))	word_cnts++; // 0 : write enable
+	if(!(word_en & BIT(1)))	word_cnts++;
+	if(!(word_en & BIT(2)))	word_cnts++;
+	if(!(word_en & BIT(3)))	word_cnts++;
+	return word_cnts;
+}
+
+//
+//	Description:
+//		Execute E-Fuse read byte operation.
+//		Refered from SD1 Richard.
+//
+//	Assumption:
+//		1. Boot from E-Fuse and successfully auto-load.
+//		2. PASSIVE_LEVEL (USB interface)
+//
+//	Created by Roger, 2008.10.21.
+//
+VOID
+ReadEFuseByte(
+		PADAPTER	Adapter,
+		u16 			_offset, 
+		u8 			*pbuf, 
+		IN BOOLEAN	bPseudoTest) 
+{
+	u32	value32;
+	u8	readbyte;
+	u16	retry;
+	//u32 start=rtw_get_current_time();
+
+	if(bPseudoTest)
+	{
+		Efuse_Read1ByteFromFakeContent(Adapter, _offset, pbuf);
+		return;
+	}
+
+	//Write Address
+	rtw_write8(Adapter, EFUSE_CTRL+1, (_offset & 0xff));  		
+	readbyte = rtw_read8(Adapter, EFUSE_CTRL+2);
+	rtw_write8(Adapter, EFUSE_CTRL+2, ((_offset >> 8) & 0x03) | (readbyte & 0xfc));  		
+
+	//Write bit 32 0
+	readbyte = rtw_read8(Adapter, EFUSE_CTRL+3);		
+	rtw_write8(Adapter, EFUSE_CTRL+3, (readbyte & 0x7f));  	
+	
+	//Check bit 32 read-ready
+	retry = 0;
+	value32 = rtw_read32(Adapter, EFUSE_CTRL);
+	//while(!(((value32 >> 24) & 0xff) & 0x80)  && (retry<10))
+	while(!(((value32 >> 24) & 0xff) & 0x80)  && (retry<10000))
+	{
+		value32 = rtw_read32(Adapter, EFUSE_CTRL);
+		retry++;
+	}
+
+	// 20100205 Joseph: Add delay suggested by SD1 Victor.
+	// This fix the problem that Efuse read error in high temperature condition.
+	// Designer says that there shall be some delay after ready bit is set, or the
+	// result will always stay on last data we read.
+	rtw_udelay_os(50);
+	value32 = rtw_read32(Adapter, EFUSE_CTRL);
+	
+	*pbuf = (u8)(value32 & 0xff);
+	//DBG_871X("ReadEFuseByte _offset:%08u, in %d ms\n",_offset ,rtw_get_passing_time_ms(start));
+	
+}
+
+
+//
+//	Description:
+//		1. Execute E-Fuse read byte operation according as map offset and 
+//		    save to E-Fuse table.
+//		2. Refered from SD1 Richard.
+//
+//	Assumption:
+//		1. Boot from E-Fuse and successfully auto-load.
+//		2. PASSIVE_LEVEL (USB interface)
+//
+//	Created by Roger, 2008.10.21.
+//
+//	2008/12/12 MH 	1. Reorganize code flow and reserve bytes. and add description.
+//					2. Add efuse utilization collect.
+//	2008/12/22 MH	Read Efuse must check if we write section 1 data again!!! Sec1
+//					write addr must be after sec5.
+//
+
+VOID
+efuse_ReadEFuse(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		_offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	);
+VOID
+efuse_ReadEFuse(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		_offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	)
+{
+	Adapter->HalFunc.ReadEFuse(Adapter, efuseType, _offset, _size_byte, pbuf, bPseudoTest);
+}
+
+VOID
+EFUSE_GetEfuseDefinition(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		void		*pOut,
+	IN		BOOLEAN		bPseudoTest
+	)
+{
+	pAdapter->HalFunc.EFUSEGetEfuseDefinition(pAdapter, efuseType, type, pOut, bPseudoTest);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_Read1Byte
+ *
+ * Overview:	Copy from WMAC fot EFUSE read 1 byte.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 09/23/2008 	MHC		Copy from WMAC.
+ *
+ *---------------------------------------------------------------------------*/
+u8
+EFUSE_Read1Byte(	
+	IN	PADAPTER	Adapter, 
+	IN	u16		Address)
+{
+	u8	data;
+	u8	Bytetemp = {0x00};
+	u8	temp = {0x00};
+	u32	k=0;
+	u16	contentLen=0;
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI , TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&contentLen, _FALSE);
+
+	if (Address < contentLen)	//E-fuse 512Byte
+	{
+		//Write E-fuse Register address bit0~7
+		temp = Address & 0xFF;	
+		rtw_write8(Adapter, EFUSE_CTRL+1, temp);	
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+2);	
+		//Write E-fuse Register address bit8~9
+		temp = ((Address >> 8) & 0x03) | (Bytetemp & 0xFC);	
+		rtw_write8(Adapter, EFUSE_CTRL+2, temp);	
+
+		//Write 0x30[31]=0
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		temp = Bytetemp & 0x7F;
+		rtw_write8(Adapter, EFUSE_CTRL+3, temp);
+
+		//Wait Write-ready (0x30[31]=1)
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		while(!(Bytetemp & 0x80))
+		{				
+			Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+			k++;
+			if(k==1000)
+			{
+				k=0;
+				break;
+			}
+		}
+		data=rtw_read8(Adapter, EFUSE_CTRL);
+		return data;
+	}
+	else
+		return 0xFF;
+	
+}/* EFUSE_Read1Byte */
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_Write1Byte
+ *
+ * Overview:	Copy from WMAC fot EFUSE write 1 byte.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 09/23/2008 	MHC		Copy from WMAC.
+ *
+ *---------------------------------------------------------------------------*/
+
+void	
+EFUSE_Write1Byte(	
+	IN	PADAPTER	Adapter, 
+	IN	u16		Address,
+	IN	u8		Value);
+void	
+EFUSE_Write1Byte(	
+	IN	PADAPTER	Adapter, 
+	IN	u16		Address,
+	IN	u8		Value)
+{
+	u8	Bytetemp = {0x00};
+	u8	temp = {0x00};
+	u32	k=0;
+	u16	contentLen=0;
+
+	//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("Addr=%x Data =%x\n", Address, Value));
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI , TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&contentLen, _FALSE);
+
+	if( Address < contentLen)	//E-fuse 512Byte
+	{
+		rtw_write8(Adapter, EFUSE_CTRL, Value);
+
+		//Write E-fuse Register address bit0~7
+		temp = Address & 0xFF;	
+		rtw_write8(Adapter, EFUSE_CTRL+1, temp);	
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+2);	
+		
+		//Write E-fuse Register address bit8~9
+		temp = ((Address >> 8) & 0x03) | (Bytetemp & 0xFC);	
+		rtw_write8(Adapter, EFUSE_CTRL+2, temp);	
+
+		//Write 0x30[31]=1
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		temp = Bytetemp | 0x80;
+		rtw_write8(Adapter, EFUSE_CTRL+3, temp);
+
+		//Wait Write-ready (0x30[31]=0)
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		while(Bytetemp & 0x80)
+		{
+			Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);			
+			k++;
+			if(k==100)
+			{
+				k=0;
+				break;
+			}
+		}
+	}
+}/* EFUSE_Write1Byte */
+
+/*  11/16/2008 MH Read one byte from real Efuse. */
+u8
+efuse_OneByteRead(
+	IN	PADAPTER	pAdapter, 
+	IN	u16			addr,
+	IN	u8			*data,
+	IN	BOOLEAN		bPseudoTest)
+{
+	u8	tmpidx = 0;
+	u8	bResult;
+
+	if(bPseudoTest)
+	{
+		bResult = Efuse_Read1ByteFromFakeContent(pAdapter, addr, data);
+		return bResult;
+	}
+	// -----------------e-fuse reg ctrl ---------------------------------
+	//address			
+	rtw_write8(pAdapter, EFUSE_CTRL+1, (u8)(addr&0xff));		
+	rtw_write8(pAdapter, EFUSE_CTRL+2, ((u8)((addr>>8) &0x03) ) | 
+	(rtw_read8(pAdapter, EFUSE_CTRL+2)&0xFC ));	
+
+	rtw_write8(pAdapter, EFUSE_CTRL+3,  0x72);//read cmd	
+
+	while(!(0x80 &rtw_read8(pAdapter, EFUSE_CTRL+3))&&(tmpidx<100))
+	{
+		tmpidx++;
+	}
+	if(tmpidx<100)
+	{			
+		*data=rtw_read8(pAdapter, EFUSE_CTRL);		
+		bResult = _TRUE;
+	}
+	else
+	{
+		*data = 0xff;	
+		bResult = _FALSE;
+	}
+	return bResult;
+}
+		
+/*  11/16/2008 MH Write one byte to reald Efuse. */
+u8
+efuse_OneByteWrite(
+	IN	PADAPTER	pAdapter,  
+	IN	u16			addr, 
+	IN	u8			data,
+	IN	BOOLEAN		bPseudoTest)
+{
+	u8	tmpidx = 0;
+	u8	bResult;
+
+	if(bPseudoTest)
+	{
+		bResult = Efuse_Write1ByteToFakeContent(pAdapter, addr, data);
+		return bResult;
+	}
+	//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("Addr = %x Data=%x\n", addr, data));
+
+	//return	0;
+
+	// -----------------e-fuse reg ctrl ---------------------------------	
+	//address			
+	rtw_write8(pAdapter, EFUSE_CTRL+1, (u8)(addr&0xff));
+	rtw_write8(pAdapter, EFUSE_CTRL+2, 
+	(rtw_read8(pAdapter, EFUSE_CTRL+2)&0xFC )|(u8)((addr>>8)&0x03) );	
+	rtw_write8(pAdapter, EFUSE_CTRL, data);//data		
+
+	rtw_write8(pAdapter, EFUSE_CTRL+3, 0xF2);//write cmd
+		
+	while((0x80 &  rtw_read8(pAdapter, EFUSE_CTRL+3)) && (tmpidx<100) ){
+		tmpidx++;
+	}
+	
+	if(tmpidx<100)
+	{					
+		bResult = _TRUE;
+	}
+	else
+	{			
+		bResult = _FALSE;
+	}		
+	
+	return bResult;	
+}
+
+int
+Efuse_PgPacketRead(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	ret =  pAdapter->HalFunc.Efuse_PgPacketRead(pAdapter, offset, data, bPseudoTest);
+
+	return ret;
+}
+
+int 
+Efuse_PgPacketWrite(IN	PADAPTER	pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int ret;
+
+	ret =  pAdapter->HalFunc.Efuse_PgPacketWrite(pAdapter, offset, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_WordEnableDataRead
+ *
+ * Overview:	Read allowed word in current efuse section data.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/16/2008 	MHC		Create Version 0.
+ * 11/21/2008 	MHC		Fix Write bug when we only enable late word.
+ *
+ *---------------------------------------------------------------------------*/
+void
+efuse_WordEnableDataRead(IN	u8	word_en,
+							IN	u8	*sourdata,
+							IN	u8	*targetdata)
+{	
+	if (!(word_en&BIT(0)))
+	{
+		targetdata[0] = sourdata[0];
+		targetdata[1] = sourdata[1];
+	}
+	if (!(word_en&BIT(1)))
+	{
+		targetdata[2] = sourdata[2];
+		targetdata[3] = sourdata[3];
+	}
+	if (!(word_en&BIT(2)))
+	{
+		targetdata[4] = sourdata[4];
+		targetdata[5] = sourdata[5];
+	}
+	if (!(word_en&BIT(3)))
+	{
+		targetdata[6] = sourdata[6];
+		targetdata[7] = sourdata[7];
+	}
+}
+
+
+u8
+Efuse_WordEnableDataWrite(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en, 
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u8	ret=0;
+
+	ret =  pAdapter->HalFunc.Efuse_WordEnableDataWrite(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+	
+	return ret;
+}
+
+static u8 efuse_read8(PADAPTER padapter, u16 address, u8 *value)
+{
+	return efuse_OneByteRead(padapter,address, value, _FALSE);
+}
+
+static u8 efuse_write8(PADAPTER padapter, u16 address, u8 *value)
+{
+	return efuse_OneByteWrite(padapter,address, *value, _FALSE);
+}
+
+/*
+ * read/wirte raw efuse data
+ */
+u8 rtw_efuse_access(PADAPTER padapter, u8 bWrite, u16 start_addr, u16 cnts, u8 *data)
+{
+	int i = 0;
+	u16	real_content_len = 0, max_available_size = 0;
+	u8 res = _FAIL ;
+	u8 (*rw8)(PADAPTER, u16, u8*);
+
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&real_content_len, _FALSE);
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+	if (start_addr > real_content_len)
+		return _FAIL;
+
+	if (_TRUE == bWrite) {
+		if ((start_addr + cnts) > max_available_size)
+			return _FAIL;
+		rw8 = &efuse_write8;
+	} else
+		rw8 = &efuse_read8;
+
+	Efuse_PowerSwitch(padapter, bWrite, _TRUE);
+
+	// e-fuse one byte read / write
+	for (i = 0; i < cnts; i++) {
+		if (start_addr >= real_content_len) {
+			res = _FAIL;
+			break;
+		}
+
+		res = rw8(padapter, start_addr++, data++);
+		if (_FAIL == res) break;
+	}
+
+	Efuse_PowerSwitch(padapter, bWrite, _FALSE);
+
+	return res;
+}
+//------------------------------------------------------------------------------
+u16 efuse_GetMaxSize(PADAPTER padapter)
+{
+	u16	max_size;
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI , TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_size, _FALSE);
+	return max_size;
+}
+//------------------------------------------------------------------------------
+u8 efuse_GetCurrentSize(PADAPTER padapter, u16 *size)
+{
+	Efuse_PowerSwitch(padapter, _FALSE, _TRUE);
+	*size = Efuse_GetCurrentSize(padapter, EFUSE_WIFI, _FALSE);
+	Efuse_PowerSwitch(padapter, _FALSE, _FALSE);
+
+	return _SUCCESS;
+}
+//------------------------------------------------------------------------------
+u8 rtw_efuse_map_read(PADAPTER padapter, u16 addr, u16 cnts, u8 *data)
+{
+	u16	mapLen=0;
+
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, _FALSE);
+
+	if ((addr + cnts) > mapLen)
+		return _FAIL;
+
+	Efuse_PowerSwitch(padapter, _FALSE, _TRUE);
+
+	efuse_ReadEFuse(padapter, EFUSE_WIFI, addr, cnts, data, _FALSE);
+
+	Efuse_PowerSwitch(padapter, _FALSE, _FALSE);
+
+	return _SUCCESS;
+}
+//------------------------------------------------------------------------------
+u8 rtw_efuse_map_write(PADAPTER padapter, u16 addr, u16 cnts, u8 *data)
+{
+	u8	offset, word_en;
+	u8	*map;
+	u8	newdata[PGPKT_DATA_SIZE];
+	s32	i, j, idx;
+	u8	ret = _SUCCESS;
+	u16	mapLen=0;
+
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, _FALSE);
+
+	if ((addr + cnts) > mapLen)
+		return _FAIL;
+
+	map = rtw_zmalloc(mapLen);
+	if(map == NULL){
+		return _FAIL;
+	}
+
+	ret = rtw_efuse_map_read(padapter, 0, mapLen, map);
+	if (ret == _FAIL) goto exit;
+
+	Efuse_PowerSwitch(padapter, _TRUE, _TRUE);
+
+	offset = (addr >> 3);
+	word_en = 0xF;
+	_rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE);
+	i = addr & 0x7;	// index of one package
+	j = 0;		// index of new package
+	idx = 0;	// data index
+
+	if (i & 0x1) {
+		// odd start
+		if (data[idx] != map[addr+idx]) {
+			word_en &= ~BIT(i >> 1);
+			newdata[i-1] = map[addr+idx-1];
+			newdata[i] = data[idx];
+		}
+		i++;
+		idx++;
+	}
+	do {
+		for (; i < PGPKT_DATA_SIZE; i += 2)
+		{
+			if (cnts == idx) break;
+			if ((cnts - idx) == 1) {
+				if (data[idx] != map[addr+idx]) {
+					word_en &= ~BIT(i >> 1);
+					newdata[i] = data[idx];
+					newdata[i+1] = map[addr+idx+1];
+				}
+				idx++;
+				break;
+			} else {
+				if ((data[idx] != map[addr+idx]) ||
+				    (data[idx+1] != map[addr+idx+1]))
+				{
+					word_en &= ~BIT(i >> 1);
+					newdata[i] = data[idx];
+					newdata[i+1] = data[idx + 1];
+				}
+				idx += 2;
+			}
+			if (idx == cnts) break;
+		}
+
+		if (word_en != 0xF) {
+			ret = Efuse_PgPacketWrite(padapter, offset, word_en, newdata, _FALSE);
+			DBG_871X("offset=%x \n",offset);
+			DBG_871X("word_en=%x \n",word_en);
+
+			for(i=0;i<PGPKT_DATA_SIZE;i++)
+			{
+				DBG_871X("data=%x \t",newdata[i]);
+			}
+			if (ret == _FAIL) break;
+		}
+
+		if (idx == cnts) break;
+
+		offset++;
+		i = 0;
+		j = 0;
+		word_en = 0xF;
+		_rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE);
+	} while (1);
+
+	Efuse_PowerSwitch(padapter, _TRUE, _FALSE);
+
+exit:
+
+	rtw_mfree(map, mapLen);
+
+	return ret;
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	Efuse_ReadAllMap
+ *
+ * Overview:	Read All Efuse content
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/11/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID 
+Efuse_ReadAllMap(
+	IN		PADAPTER	pAdapter, 
+	IN		u8		efuseType,
+	IN OUT	u8		*Efuse,
+	IN		BOOLEAN		bPseudoTest);
+VOID 
+Efuse_ReadAllMap(
+	IN		PADAPTER	pAdapter, 
+	IN		u8		efuseType,
+	IN OUT	u8		*Efuse,
+	IN		BOOLEAN		bPseudoTest)
+{
+	u16	mapLen=0;
+
+	Efuse_PowerSwitch(pAdapter,_FALSE, _TRUE);
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, bPseudoTest);
+
+	efuse_ReadEFuse(pAdapter, efuseType, 0, mapLen, Efuse, bPseudoTest);
+
+	Efuse_PowerSwitch(pAdapter,_FALSE, _FALSE);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_ShadowRead1Byte
+ *			efuse_ShadowRead2Byte
+ *			efuse_ShadowRead4Byte
+ *
+ * Overview:	Read from efuse init map by one/two/four bytes !!!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+efuse_ShadowRead1Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN OUT	u8		*Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	*Value = pEEPROM->efuse_eeprom_data[Offset];
+
+}	// EFUSE_ShadowRead1Byte
+
+//---------------Read Two Bytes
+static VOID
+efuse_ShadowRead2Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN OUT	u16		*Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	*Value = pEEPROM->efuse_eeprom_data[Offset];
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+1]<<8;
+
+}	// EFUSE_ShadowRead2Byte
+
+//---------------Read Four Bytes
+static VOID
+efuse_ShadowRead4Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN OUT	u32		*Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	*Value = pEEPROM->efuse_eeprom_data[Offset];
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+1]<<8;
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+2]<<16;
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+3]<<24;
+
+}	// efuse_ShadowRead4Byte
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_ShadowWrite1Byte
+ *			efuse_ShadowWrite2Byte
+ *			efuse_ShadowWrite4Byte
+ *
+ * Overview:	Write efuse modify map by one/two/four byte.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+#ifdef PLATFORM
+static VOID
+efuse_ShadowWrite1Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN 	u8		Value);
+#endif //PLATFORM
+static VOID
+efuse_ShadowWrite1Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN 	u8		Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	pEEPROM->efuse_eeprom_data[Offset] = Value;
+
+}	// efuse_ShadowWrite1Byte
+
+//---------------Write Two Bytes
+static VOID
+efuse_ShadowWrite2Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN 	u16		Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	pEEPROM->efuse_eeprom_data[Offset] = Value&0x00FF;
+	pEEPROM->efuse_eeprom_data[Offset+1] = Value>>8;
+
+}	// efuse_ShadowWrite1Byte
+
+//---------------Write Four Bytes
+static VOID
+efuse_ShadowWrite4Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN	u32		Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	pEEPROM->efuse_eeprom_data[Offset] = (u8)(Value&0x000000FF);
+	pEEPROM->efuse_eeprom_data[Offset+1] = (u8)((Value>>8)&0x0000FF);
+	pEEPROM->efuse_eeprom_data[Offset+2] = (u8)((Value>>16)&0x00FF);
+	pEEPROM->efuse_eeprom_data[Offset+3] = (u8)((Value>>24)&0xFF);
+
+}	// efuse_ShadowWrite1Byte
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_ShadowMapUpdate
+ *
+ * Overview:	Transfer current EFUSE content to shadow init and modify map.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/13/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+void EFUSE_ShadowMapUpdate(
+	IN PADAPTER	pAdapter,
+	IN u8		efuseType,
+	IN BOOLEAN	bPseudoTest)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+	u16	mapLen=0;
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, bPseudoTest);
+
+	if (pEEPROM->bautoload_fail_flag == _TRUE)
+	{
+		_rtw_memset(pEEPROM->efuse_eeprom_data, 0xFF, mapLen);
+	}
+	else
+	{
+		#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE			
+		if(_SUCCESS != retriveAdaptorInfoFile(pAdapter->registrypriv.adaptor_info_caching_file_path, pEEPROM)) {
+		#endif
+		
+		Efuse_ReadAllMap(pAdapter, efuseType, pEEPROM->efuse_eeprom_data, bPseudoTest);
+		
+		#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+			storeAdaptorInfoFile(pAdapter->registrypriv.adaptor_info_caching_file_path, pEEPROM);
+		}
+		#endif
+	}
+
+	//PlatformMoveMemory((PVOID)&pHalData->EfuseMap[EFUSE_MODIFY_MAP][0], 
+	//(PVOID)&pHalData->EfuseMap[EFUSE_INIT_MAP][0], mapLen);
+}// EFUSE_ShadowMapUpdate
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_ShadowRead
+ *
+ * Overview:	Read from efuse init map !!!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+void
+EFUSE_ShadowRead(
+	IN		PADAPTER	pAdapter,
+	IN		u8		Type,
+	IN		u16		Offset,
+	IN OUT	u32		*Value	)
+{
+	if (Type == 1)
+		efuse_ShadowRead1Byte(pAdapter, Offset, (u8 *)Value);
+	else if (Type == 2)
+		efuse_ShadowRead2Byte(pAdapter, Offset, (u16 *)Value);
+	else if (Type == 4)
+		efuse_ShadowRead4Byte(pAdapter, Offset, (u32 *)Value);
+	
+}	// EFUSE_ShadowRead
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_ShadowWrite
+ *
+ * Overview:	Write efuse modify map for later update operation to use!!!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+EFUSE_ShadowWrite(
+	IN	PADAPTER	pAdapter,
+	IN	u8		Type,
+	IN	u16		Offset,
+	IN OUT	u32		Value);
+VOID
+EFUSE_ShadowWrite(
+	IN	PADAPTER	pAdapter,
+	IN	u8		Type,
+	IN	u16		Offset,
+	IN OUT	u32		Value)
+{
+#if (MP_DRIVER == 0)
+	return;
+#endif
+
+	if (Type == 1)
+		efuse_ShadowWrite1Byte(pAdapter, Offset, (u8)Value);
+	else if (Type == 2)
+		efuse_ShadowWrite2Byte(pAdapter, Offset, (u16)Value);
+	else if (Type == 4)
+		efuse_ShadowWrite4Byte(pAdapter, Offset, (u32)Value);
+
+}	// EFUSE_ShadowWrite
+
+VOID
+Efuse_InitSomeVar(
+	IN		PADAPTER	pAdapter
+	);
+VOID
+Efuse_InitSomeVar(
+	IN		PADAPTER	pAdapter
+	)
+{
+	u8 i;
+	
+	_rtw_memset((PVOID)&fakeEfuseContent[0], 0xff, EFUSE_MAX_HW_SIZE);
+	_rtw_memset((PVOID)&fakeEfuseInitMap[0], 0xff, EFUSE_MAX_MAP_LEN);
+	_rtw_memset((PVOID)&fakeEfuseModifiedMap[0], 0xff, EFUSE_MAX_MAP_LEN);
+
+	for(i=0; i<EFUSE_MAX_BT_BANK; i++)
+	{
+		_rtw_memset((PVOID)&BTEfuseContent[i][0], EFUSE_MAX_HW_SIZE, 0xff);
+	}
+	_rtw_memset((PVOID)&BTEfuseInitMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+	_rtw_memset((PVOID)&BTEfuseModifiedMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+
+	for(i=0; i<EFUSE_MAX_BT_BANK; i++)
+	{
+		_rtw_memset((PVOID)&fakeBTEfuseContent[i][0], 0xff, EFUSE_MAX_HW_SIZE);
+	}
+	_rtw_memset((PVOID)&fakeBTEfuseInitMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+	_rtw_memset((PVOID)&fakeBTEfuseModifiedMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+}
+
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+//#include <rtw_eeprom.h>
+
+ int isAdaptorInfoFileValid(void)
+{
+	return _TRUE;
+}
+
+int storeAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv)
+{
+	int ret =_SUCCESS;
+
+	if(path && eeprom_priv) {
+		ret = rtw_store_to_file(path, eeprom_priv->efuse_eeprom_data, EEPROM_MAX_SIZE);
+		if(ret == EEPROM_MAX_SIZE)
+			ret = _SUCCESS;
+		else
+			ret = _FAIL;
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret =  _FAIL;
+	}
+	return ret;
+}
+
+int retriveAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv)
+{
+	int ret = _SUCCESS;
+	mm_segment_t oldfs;
+	struct file *fp;
+	
+	if(path && eeprom_priv) {
+
+		ret = rtw_retrive_from_file(path, eeprom_priv->efuse_eeprom_data, EEPROM_MAX_SIZE);
+		
+		if(ret == EEPROM_MAX_SIZE)
+			ret = _SUCCESS;
+		else
+			ret = _FAIL;
+
+		#if 0
+		if(isAdaptorInfoFileValid()) {	
+			return 0;
+		} else {
+			return _FAIL;
+		}
+		#endif
+		
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret = _FAIL;
+	}
+	return ret;
+}
+#endif //CONFIG_ADAPTOR_INFO_CACHING_FILE
+#endif //PLATFORM_LINUX
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c
new file mode 100755
index 0000000000000..14576dd191f3d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c
@@ -0,0 +1,2943 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_AP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+
+
+#ifdef CONFIG_AP_MODE
+
+extern unsigned char	RTW_WPA_OUI[];
+extern unsigned char 	WMM_OUI[];
+extern unsigned char	WPS_OUI[];
+extern unsigned char	P2P_OUI[];
+extern unsigned char	WFD_OUI[];
+
+void init_mlme_ap_info(_adapter *padapter)
+{
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;	
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	
+
+	_rtw_spinlock_init(&pmlmepriv->bcn_update_lock);	
+
+	//for ACL 
+	_rtw_init_queue(&pacl_list->acl_node_q);
+
+	//pmlmeext->bstart_bss = _FALSE;
+
+	start_ap_mode(padapter);
+}
+
+void free_mlme_ap_info(_adapter *padapter)
+{
+	_irqL irqL;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//stop_ap_mode(padapter);
+
+	pmlmepriv->update_bcn = _FALSE;
+	pmlmeext->bstart_bss = _FALSE;	
+	
+	rtw_sta_flush(padapter);
+
+	pmlmeinfo->state = _HW_STATE_NOLINK_;
+
+	//free_assoc_sta_resources
+	rtw_free_all_stainfo(padapter);
+
+	//free bc/mc sta_info
+	psta = rtw_get_bcmc_stainfo(padapter);	
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+	rtw_free_stainfo(padapter, psta);
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	
+
+	_rtw_spinlock_free(&pmlmepriv->bcn_update_lock);
+	
+}
+
+static void update_BCNTIM(_adapter *padapter)
+{
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork_mlmeext = &(pmlmeinfo->network);
+	unsigned char *pie = pnetwork_mlmeext->IEs;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+	
+	//update TIM IE
+	//if(pstapriv->tim_bitmap)
+	if(_TRUE)
+	{
+		u8 *p, *dst_ie, *premainder_ie=NULL, *pbackup_remainder_ie=NULL;
+		u16 tim_bitmap_le;
+		uint offset, tmp_len, tim_ielen, tim_ie_offset, remainder_ielen;	
+	
+		tim_bitmap_le = cpu_to_le16(pstapriv->tim_bitmap);
+
+		p = rtw_get_ie(pie + _FIXED_IE_LENGTH_, _TIM_IE_, &tim_ielen, pnetwork_mlmeext->IELength - _FIXED_IE_LENGTH_);
+		if (p != NULL && tim_ielen>0)
+		{
+			tim_ielen += 2;
+			
+			premainder_ie = p+tim_ielen;
+
+			tim_ie_offset = (sint)(p -pie);
+			
+			remainder_ielen = pnetwork_mlmeext->IELength - tim_ie_offset - tim_ielen;
+
+			//append TIM IE from dst_ie offset
+			dst_ie = p;
+		}
+		else
+		{
+			tim_ielen = 0;
+
+			//calucate head_len		
+			offset = _FIXED_IE_LENGTH_;
+
+			/* get ssid_ie len */
+			p = rtw_get_ie(pie + _BEACON_IE_OFFSET_, _SSID_IE_, &tmp_len, (pnetwork_mlmeext->IELength - _BEACON_IE_OFFSET_));
+			if (p !=  NULL)
+				offset += tmp_len+2;
+
+			// get supported rates len
+			p = rtw_get_ie(pie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &tmp_len, (pnetwork_mlmeext->IELength - _BEACON_IE_OFFSET_));	
+			if (p !=  NULL) 
+			{			
+				offset += tmp_len+2;
+			}
+
+			//DS Parameter Set IE, len=3	
+			offset += 3;
+
+			premainder_ie = pie + offset;
+
+			remainder_ielen = pnetwork_mlmeext->IELength - offset - tim_ielen;	
+
+			//append TIM IE from offset
+			dst_ie = pie + offset;
+			
+		}
+
+		
+		if(remainder_ielen>0)
+		{
+			pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+			if(pbackup_remainder_ie && premainder_ie)
+				_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+		}		
+
+		*dst_ie++=_TIM_IE_;
+
+		if((pstapriv->tim_bitmap&0xff00) && (pstapriv->tim_bitmap&0x00fc))			
+			tim_ielen = 5;
+		else
+			tim_ielen = 4;
+
+		*dst_ie++= tim_ielen;
+		
+		*dst_ie++=0;//DTIM count
+		*dst_ie++=1;//DTIM peroid
+		
+		if(pstapriv->tim_bitmap&BIT(0))//for bc/mc frames
+			*dst_ie++ = BIT(0);//bitmap ctrl 
+		else
+			*dst_ie++ = 0;
+
+		if(tim_ielen==4)
+		{
+			*dst_ie++ = *(u8*)&tim_bitmap_le;
+		}	
+		else if(tim_ielen==5)
+		{
+			_rtw_memcpy(dst_ie, &tim_bitmap_le, 2);
+			dst_ie+=2;				
+		}	
+		
+		//copy remainder IE
+		if(pbackup_remainder_ie)
+		{
+			_rtw_memcpy(dst_ie, pbackup_remainder_ie, remainder_ielen);
+
+			rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+		}	
+
+		offset =  (uint)(dst_ie - pie);
+		pnetwork_mlmeext->IELength = offset + remainder_ielen;
+	
+	}
+
+#ifndef CONFIG_INTERRUPT_BASED_TXBCN 
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+	set_tx_beacon_cmd(padapter);
+#endif
+#endif //!CONFIG_INTERRUPT_BASED_TXBCN
+
+
+}
+
+void rtw_add_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index, u8 *data, u8 len)
+{
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8	bmatch = _FALSE;
+	u8	*pie = pnetwork->IEs;
+	u8	*p=NULL, *dst_ie=NULL, *premainder_ie=NULL, *pbackup_remainder_ie=NULL;
+	u32	i, offset, ielen, ie_offset, remainder_ielen = 0;
+
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pnetwork->IELength;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pnetwork->IEs + i);
+
+		if (pIE->ElementID > index)
+		{
+			break;
+		}
+		else if(pIE->ElementID == index) // already exist the same IE
+		{
+			p = (u8 *)pIE;
+			ielen = pIE->Length;
+			bmatch = _TRUE;
+			break;
+		}
+
+		p = (u8 *)pIE;
+		ielen = pIE->Length;
+		i += (pIE->Length + 2);
+	}
+
+	if (p != NULL && ielen>0)
+	{
+		ielen += 2;
+		
+		premainder_ie = p+ielen;
+
+		ie_offset = (sint)(p -pie);
+		
+		remainder_ielen = pnetwork->IELength - ie_offset - ielen;
+
+		if(bmatch)
+			dst_ie = p;
+		else
+			dst_ie = (p+ielen);
+	}
+
+	if(dst_ie == NULL)
+		return;
+
+	if(remainder_ielen>0)
+	{
+		pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+		if(pbackup_remainder_ie && premainder_ie)
+			_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+	}
+
+	*dst_ie++=index;
+	*dst_ie++=len;
+
+	_rtw_memcpy(dst_ie, data, len);
+	dst_ie+=len;
+
+	//copy remainder IE
+	if(pbackup_remainder_ie)
+	{
+		_rtw_memcpy(dst_ie, pbackup_remainder_ie, remainder_ielen);
+
+		rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+	}
+
+	offset =  (uint)(dst_ie - pie);
+	pnetwork->IELength = offset + remainder_ielen;
+}
+
+void rtw_remove_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index)
+{
+	u8 *p, *dst_ie, *premainder_ie=NULL, *pbackup_remainder_ie=NULL;
+	uint offset, ielen, ie_offset, remainder_ielen = 0;
+	u8	*pie = pnetwork->IEs;
+
+	p = rtw_get_ie(pie + _FIXED_IE_LENGTH_, index, &ielen, pnetwork->IELength - _FIXED_IE_LENGTH_);
+	if (p != NULL && ielen>0)
+	{
+		ielen += 2;
+		
+		premainder_ie = p+ielen;
+
+		ie_offset = (sint)(p -pie);
+		
+		remainder_ielen = pnetwork->IELength - ie_offset - ielen;
+
+		dst_ie = p;
+	}
+	else {
+		return;
+	}
+
+	if(remainder_ielen>0)
+	{
+		pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+		if(pbackup_remainder_ie && premainder_ie)
+			_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+	}
+
+	//copy remainder IE
+	if(pbackup_remainder_ie)
+	{
+		_rtw_memcpy(dst_ie, pbackup_remainder_ie, remainder_ielen);
+
+		rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+	}
+
+	offset =  (uint)(dst_ie - pie);
+	pnetwork->IELength = offset + remainder_ielen;
+}
+
+
+u8 chk_sta_is_alive(struct sta_info *psta);
+u8 chk_sta_is_alive(struct sta_info *psta)
+{
+	u8 ret = _FALSE;
+	#ifdef DBG_EXPIRATION_CHK
+	DBG_871X("sta:"MAC_FMT", rssi:%d, rx:"STA_PKTS_FMT", expire_to:%u, %s%ssq_len:%u\n"
+		, MAC_ARG(psta->hwaddr)
+		, psta->rssi_stat.UndecoratedSmoothedPWDB
+		//, STA_RX_PKTS_ARG(psta)
+		, STA_RX_PKTS_DIFF_ARG(psta)
+		, psta->expire_to
+		, psta->state&WIFI_SLEEP_STATE?"PS, ":""
+		, psta->state&WIFI_STA_ALIVE_CHK_STATE?"SAC, ":""
+		, psta->sleepq_len
+	);
+	#endif
+
+	//if(sta_last_rx_pkts(psta) == sta_rx_pkts(psta))
+	if((psta->sta_stats.last_rx_data_pkts + psta->sta_stats.last_rx_ctrl_pkts) == (psta->sta_stats.rx_data_pkts + psta->sta_stats.rx_ctrl_pkts))
+	{
+		#if 0
+		if(psta->state&WIFI_SLEEP_STATE)
+			ret = _TRUE;
+		#endif
+	}
+	else
+	{
+		ret = _TRUE;
+	}
+
+	sta_update_last_rx_pkts(psta);
+
+	return ret;
+}
+
+void	expire_timeout_chk(_adapter *padapter)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	u8 updated = _FALSE;
+	struct sta_info *psta=NULL;	
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	int i;
+
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+	
+	phead = &pstapriv->auth_list;
+	plist = get_next(phead);
+
+	//check auth_queue
+	#ifdef DBG_EXPIRATION_CHK
+	if (rtw_end_of_queue_search(phead, plist) == _FALSE) {
+		DBG_871X(FUNC_NDEV_FMT" auth_list, cnt:%u\n"
+			, FUNC_NDEV_ARG(padapter->pnetdev), pstapriv->auth_list_cnt);
+	}
+	#endif
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)	
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, auth_list);
+		plist = get_next(plist);
+	
+		if(psta->expire_to>0)
+		{
+			psta->expire_to--;
+			if (psta->expire_to == 0)
+			{				
+				rtw_list_delete(&psta->auth_list);
+				pstapriv->auth_list_cnt--;
+				
+				DBG_871X("auth expire %02X%02X%02X%02X%02X%02X\n",
+					psta->hwaddr[0],psta->hwaddr[1],psta->hwaddr[2],psta->hwaddr[3],psta->hwaddr[4],psta->hwaddr[5]);
+				
+				_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+				
+				_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);	
+				rtw_free_stainfo(padapter, psta);
+				_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);	
+				
+				_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+			}	
+		}	
+		
+	}
+
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	psta = NULL;
+	
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//check asoc_queue
+	#ifdef DBG_EXPIRATION_CHK
+	if (rtw_end_of_queue_search(phead, plist) == _FALSE) {
+		DBG_871X(FUNC_NDEV_FMT" asoc_list, cnt:%u\n"
+			, FUNC_NDEV_ARG(padapter->pnetdev), pstapriv->asoc_list_cnt);
+	}
+	#endif
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+	
+		if (chk_sta_is_alive(psta) || !psta->expire_to) {
+			psta->expire_to = pstapriv->expire_to;
+			psta->keep_alive_trycnt = 0;
+			#ifdef CONFIG_TX_MCAST2UNI
+			psta->under_exist_checking = 0;
+			#endif	// CONFIG_TX_MCAST2UNI
+		} else {
+			psta->expire_to--;
+		}
+
+#ifndef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#ifdef CONFIG_TX_MCAST2UNI
+		if ( (psta->flags & WLAN_STA_HT) && (psta->htpriv.agg_enable_bitmap || psta->under_exist_checking) ) {
+			// check sta by delba(addba) for 11n STA 
+			// ToDo: use CCX report to check for all STAs
+			//DBG_871X("asoc check by DELBA/ADDBA! (pstapriv->expire_to=%d s)(psta->expire_to=%d s), [%02x, %d]\n", pstapriv->expire_to*2, psta->expire_to*2, psta->htpriv.agg_enable_bitmap, psta->under_exist_checking);
+			
+			if ( psta->expire_to <= (pstapriv->expire_to - 50 ) ) {
+				DBG_871X("asoc expire by DELBA/ADDBA! (%d s)\n", (pstapriv->expire_to-psta->expire_to)*2);
+				psta->under_exist_checking = 0;
+				psta->expire_to = 0;
+			} else if ( psta->expire_to <= (pstapriv->expire_to - 3) && (psta->under_exist_checking==0)) {
+				DBG_871X("asoc check by DELBA/ADDBA! (%d s)\n", (pstapriv->expire_to-psta->expire_to)*2);
+				psta->under_exist_checking = 1;
+				//tear down TX AMPDU
+				send_delba(padapter, 1, psta->hwaddr);// // originator
+				psta->htpriv.agg_enable_bitmap = 0x0;//reset
+				psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+			}
+		}
+#endif // CONFIG_TX_MCAST2UNI
+#endif //CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+
+		if (psta->expire_to <= 0)
+		{
+			#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+			struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+			if (padapter->registrypriv.wifi_spec == 1)
+			{
+				psta->expire_to = pstapriv->expire_to;
+				continue;
+			}
+
+			if (psta->state & WIFI_SLEEP_STATE) {
+				if (!(psta->state & WIFI_STA_ALIVE_CHK_STATE)) {
+					//to check if alive by another methods if staion is at ps mode.					
+					psta->expire_to = pstapriv->expire_to;
+					psta->state |= WIFI_STA_ALIVE_CHK_STATE;
+
+					//DBG_871X("alive chk, sta:" MAC_FMT " is at ps mode!\n", MAC_ARG(psta->hwaddr));
+
+					//to update bcn with tim_bitmap for this station
+					pstapriv->tim_bitmap |= BIT(psta->aid);
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+
+					if(!pmlmeext->active_keep_alive_check)
+						continue;
+				}
+			}
+
+			if (pmlmeext->active_keep_alive_check) {
+				int stainfo_offset;
+
+				stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+				if (stainfo_offset_valid(stainfo_offset)) {
+					chk_alive_list[chk_alive_num++] = stainfo_offset;
+				}
+
+				continue;
+			}
+			#endif /* CONFIG_ACTIVE_KEEP_ALIVE_CHECK */
+
+			rtw_list_delete(&psta->asoc_list);
+			pstapriv->asoc_list_cnt--;
+
+			DBG_871X("asoc expire "MAC_FMT", state=0x%x\n", MAC_ARG(psta->hwaddr), psta->state);
+			updated = ap_free_sta(padapter, psta, _FALSE, WLAN_REASON_DEAUTH_LEAVING);
+		}	
+		else
+		{
+			/* TODO: Aging mechanism to digest frames in sleep_q to avoid running out of xmitframe */
+			if (psta->sleepq_len > (NR_XMITFRAME/pstapriv->asoc_list_cnt)
+				&& padapter->xmitpriv.free_xmitframe_cnt < (NR_XMITFRAME/pstapriv->asoc_list_cnt/2)
+			){
+				DBG_871X("%s sta:"MAC_FMT", sleepq_len:%u, free_xmitframe_cnt:%u, asoc_list_cnt:%u, clear sleep_q\n", __func__
+					, MAC_ARG(psta->hwaddr)
+					, psta->sleepq_len, padapter->xmitpriv.free_xmitframe_cnt, pstapriv->asoc_list_cnt);
+				wakeup_sta_to_xmit(padapter, psta);
+			}
+		}
+	}
+
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+if (chk_alive_num) {
+
+	u8 backup_oper_channel=0;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	/* switch to correct channel of current network  before issue keep-alive frames */
+	if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
+		backup_oper_channel = rtw_get_oper_ch(padapter);
+		SelectChannel(padapter, pmlmeext->cur_channel);
+	}
+
+	/* issue null data to check sta alive*/
+	for (i = 0; i < chk_alive_num; i++) {
+		
+		int ret = _FAIL;
+
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+		if(!(psta->state &_FW_LINKED))
+			continue;		
+
+		if (psta->state & WIFI_SLEEP_STATE)
+			ret = issue_nulldata(padapter, psta->hwaddr, 0, 1, 50);
+		else
+			ret = issue_nulldata(padapter, psta->hwaddr, 0, 3, 50);
+
+		psta->keep_alive_trycnt++;
+		if (ret == _SUCCESS)
+		{
+			DBG_871X("asoc check, sta(" MAC_FMT ") is alive\n", MAC_ARG(psta->hwaddr));
+			psta->expire_to = pstapriv->expire_to;
+			psta->keep_alive_trycnt = 0;
+			continue;
+		}
+		else if (psta->keep_alive_trycnt <= 3)
+		{
+			DBG_871X("ack check for asoc expire, keep_alive_trycnt=%d\n", psta->keep_alive_trycnt);
+			psta->expire_to = 1;
+			continue;
+		}
+
+		psta->keep_alive_trycnt = 0;
+
+		DBG_871X("asoc expire "MAC_FMT", state=0x%x\n", MAC_ARG(psta->hwaddr), psta->state);
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		if (rtw_is_list_empty(&psta->asoc_list)==_FALSE) {
+			rtw_list_delete(&psta->asoc_list);
+			pstapriv->asoc_list_cnt--;
+			updated = ap_free_sta(padapter, psta, _FALSE, WLAN_REASON_DEAUTH_LEAVING);
+		}
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	}
+
+	if (backup_oper_channel>0) /* back to the original operation channel */
+		SelectChannel(padapter, backup_oper_channel);
+}
+#endif /* CONFIG_ACTIVE_KEEP_ALIVE_CHECK */
+
+	associated_clients_update(padapter, updated);
+}
+
+
+static void add_RATid(_adapter *padapter, struct sta_info *psta)
+{	
+	int i;
+	u8 rf_type;
+	u32 init_rate=0;
+	unsigned char sta_band = 0, raid, shortGIrate = _FALSE;
+	unsigned char limit;	
+	unsigned int tx_ra_bitmap=0;
+	struct ht_priv	*psta_ht = NULL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pcur_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;	
+
+	
+	if(psta)
+		psta_ht = &psta->htpriv;
+	else
+		return;
+	
+	//b/g mode ra_bitmap  
+	for (i=0; i<sizeof(psta->bssrateset); i++)
+	{
+		if (psta->bssrateset[i])
+			tx_ra_bitmap |= rtw_get_bit_value_from_ieee_value(psta->bssrateset[i]&0x7f);
+	}
+
+	//n mode ra_bitmap
+	if(psta_ht->ht_option) 
+	{
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		if(rf_type == RF_2T2R)
+			limit=16;// 2R
+		else
+			limit=8;//  1R
+
+		for (i=0; i<limit; i++) {
+			if (psta_ht->ht_cap.supp_mcs_set[i/8] & BIT(i%8))
+				tx_ra_bitmap |= BIT(i+12);
+		}
+
+		//max short GI rate
+		shortGIrate = psta_ht->sgi;
+	}
+
+
+#if 0//gtest
+	if(get_rf_mimo_mode(padapter) == RTL8712_RF_2T2R)
+	{
+		//is this a 2r STA?
+		if((pstat->tx_ra_bitmap & 0x0ff00000) != 0 && !(priv->pshare->has_2r_sta & BIT(pstat->aid)))
+		{
+			priv->pshare->has_2r_sta |= BIT(pstat->aid);
+			if(rtw_read16(padapter, 0x102501f6) != 0xffff)
+			{
+				rtw_write16(padapter, 0x102501f6, 0xffff);
+				reset_1r_sta_RA(priv, 0xffff);
+				Switch_1SS_Antenna(priv, 3);
+			}
+		}
+		else// bg or 1R STA? 
+		{ 
+			if((priv->pmib->dot11BssType.net_work_type & WIRELESS_11N) && pstat->ht_cap_len && priv->pshare->has_2r_sta == 0)
+			{
+				if(rtw_read16(padapter, 0x102501f6) != 0x7777)
+				{ // MCS7 SGI
+					rtw_write16(padapter, 0x102501f6,0x7777);
+					reset_1r_sta_RA(priv, 0x7777);
+					Switch_1SS_Antenna(priv, 2);
+				}
+			}
+		}
+		
+	}
+
+	if ((pstat->rssi_level < 1) || (pstat->rssi_level > 3)) 
+	{
+		if (pstat->rssi >= priv->pshare->rf_ft_var.raGoDownUpper)
+			pstat->rssi_level = 1;
+		else if ((pstat->rssi >= priv->pshare->rf_ft_var.raGoDown20MLower) ||
+			((priv->pshare->is_40m_bw) && (pstat->ht_cap_len) &&
+			(pstat->rssi >= priv->pshare->rf_ft_var.raGoDown40MLower) &&
+			(pstat->ht_cap_buf.ht_cap_info & cpu_to_le16(_HTCAP_SUPPORT_CH_WDTH_))))
+			pstat->rssi_level = 2;
+		else
+			pstat->rssi_level = 3;
+	}
+
+	// rate adaptive by rssi
+	if ((priv->pmib->dot11BssType.net_work_type & WIRELESS_11N) && pstat->ht_cap_len)
+	{
+		if ((get_rf_mimo_mode(priv) == MIMO_1T2R) || (get_rf_mimo_mode(priv) == MIMO_1T1R))
+		{
+			switch (pstat->rssi_level) {
+				case 1:
+					pstat->tx_ra_bitmap &= 0x100f0000;
+					break;
+				case 2:
+					pstat->tx_ra_bitmap &= 0x100ff000;
+					break;
+				case 3:
+					if (priv->pshare->is_40m_bw)
+						pstat->tx_ra_bitmap &= 0x100ff005;
+					else
+						pstat->tx_ra_bitmap &= 0x100ff001;
+
+					break;
+			}
+		}
+		else 
+		{
+			switch (pstat->rssi_level) {
+				case 1:
+					pstat->tx_ra_bitmap &= 0x1f0f0000;
+					break;
+				case 2:
+					pstat->tx_ra_bitmap &= 0x1f0ff000;
+					break;
+				case 3:
+					if (priv->pshare->is_40m_bw)
+						pstat->tx_ra_bitmap &= 0x000ff005;
+					else
+						pstat->tx_ra_bitmap &= 0x000ff001;
+
+					break;
+			}
+
+			// Don't need to mask high rates due to new rate adaptive parameters
+			//if (pstat->is_broadcom_sta)		// use MCS12 as the highest rate vs. Broadcom sta
+			//	pstat->tx_ra_bitmap &= 0x81ffffff;
+
+			// NIC driver will report not supporting MCS15 and MCS14 in asoc req
+			//if (pstat->is_rtl8190_sta && !pstat->is_2t_mimo_sta)
+			//	pstat->tx_ra_bitmap &= 0x83ffffff;		// if Realtek 1x2 sta, don't use MCS15 and MCS14
+		}
+	}
+	else if ((priv->pmib->dot11BssType.net_work_type & WIRELESS_11G) && isErpSta(pstat))
+	{
+		switch (pstat->rssi_level) {
+			case 1:
+				pstat->tx_ra_bitmap &= 0x00000f00;
+				break;
+			case 2:
+				pstat->tx_ra_bitmap &= 0x00000ff0;
+				break;
+			case 3:
+				pstat->tx_ra_bitmap &= 0x00000ff5;
+				break;
+		}
+	}
+	else 
+	{
+		pstat->tx_ra_bitmap &= 0x0000000d;
+	}
+
+	// disable tx short GI when station cannot rx MCS15(AP is 2T2R)
+	// disable tx short GI when station cannot rx MCS7 (AP is 1T2R or 1T1R)
+	// if there is only 1r STA and we are 2T2R, DO NOT mask SGI rate
+	if ((!(pstat->tx_ra_bitmap & 0x8000000) && (priv->pshare->has_2r_sta > 0) && (get_rf_mimo_mode(padapter) == RTL8712_RF_2T2R)) ||
+		 (!(pstat->tx_ra_bitmap & 0x80000) && (get_rf_mimo_mode(padapter) != RTL8712_RF_2T2R)))
+	{
+		pstat->tx_ra_bitmap &= ~BIT(28);	
+	}
+#endif
+
+	if ( pcur_network->Configuration.DSConfig > 14 ) {
+		// 5G band
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_5N | WIRELESS_11A;
+		else
+			sta_band |= WIRELESS_11A;
+	} else {
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_24N | WIRELESS_11G | WIRELESS_11B;
+		else if (tx_ra_bitmap & 0xff0)
+			sta_band |= WIRELESS_11G |WIRELESS_11B;
+		else
+			sta_band |= WIRELESS_11B;
+	}
+
+	raid = networktype_to_raid(sta_band);	
+	init_rate = get_highest_rate_idx(tx_ra_bitmap&0x0fffffff)&0x3f;
+	
+	if (psta->aid < NUM_STA) 
+	{
+		u8 arg = 0;
+
+		arg = psta->mac_id&0x1f;
+		
+		arg |= BIT(7);//support entry 2~31
+		
+		if (shortGIrate==_TRUE)
+			arg |= BIT(5);
+
+		tx_ra_bitmap |= ((raid<<28)&0xf0000000);
+
+		DBG_871X("%s=> mac_id:%d , raid:%d , bitmap=0x%x, arg=0x%x\n", 
+			__FUNCTION__ , psta->mac_id, raid ,tx_ra_bitmap, arg);
+
+		//bitmap[0:27] = tx_rate_bitmap
+		//bitmap[28:31]= Rate Adaptive id
+		//arg[0:4] = macid
+		//arg[5] = Short GI
+		rtw_hal_add_ra_tid(padapter, tx_ra_bitmap, arg);
+
+		if (shortGIrate==_TRUE)
+			init_rate |= BIT(6);
+		
+		//set ra_id, init_rate
+		psta->raid = raid;
+		psta->init_rate = init_rate;
+		
+	}
+	else 
+	{
+		DBG_871X("station aid %d exceed the max number\n", psta->aid);
+	}
+
+}
+
+static void update_bmc_sta(_adapter *padapter)
+{
+	_irqL	irqL;
+	u32 init_rate=0;
+	unsigned char	network_type, raid;
+	int i, supportRateNum = 0;	
+	unsigned int tx_ra_bitmap=0;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pcur_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;	
+	struct sta_info *psta = rtw_get_bcmc_stainfo(padapter);
+
+	if(psta)
+	{
+		psta->aid = 0;//default set to 0
+		//psta->mac_id = psta->aid+4;	
+		psta->mac_id = psta->aid + 1;
+
+		psta->qos_option = 0;		
+		psta->htpriv.ht_option = _FALSE;
+
+		psta->ieee8021x_blocked = 0;
+
+		_rtw_memset((void*)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
+
+		//psta->dot118021XPrivacy = _NO_PRIVACY_;//!!! remove it, because it has been set before this.
+
+
+
+		//prepare for add_RATid		
+		supportRateNum = rtw_get_rateset_len((u8*)&pcur_network->SupportedRates);
+		network_type = rtw_check_network_type((u8*)&pcur_network->SupportedRates, supportRateNum, 1);
+		
+		_rtw_memcpy(psta->bssrateset, &pcur_network->SupportedRates, supportRateNum);
+		psta->bssratelen = supportRateNum;
+
+		//b/g mode ra_bitmap  
+		for (i=0; i<supportRateNum; i++)
+		{	
+			if (psta->bssrateset[i])
+				tx_ra_bitmap |= rtw_get_bit_value_from_ieee_value(psta->bssrateset[i]&0x7f);
+		}
+
+		if ( pcur_network->Configuration.DSConfig > 14 ) {
+			//force to A mode. 5G doesn't support CCK rates
+			network_type = WIRELESS_11A;
+			tx_ra_bitmap = 0x150; // 6, 12, 24 Mbps
+		} else {
+			//force to b mode 
+			network_type = WIRELESS_11B;
+			tx_ra_bitmap = 0xf;		
+		}
+
+		//tx_ra_bitmap = update_basic_rate(pcur_network->SupportedRates, supportRateNum);
+
+		raid = networktype_to_raid(network_type);
+		init_rate = get_highest_rate_idx(tx_ra_bitmap&0x0fffffff)&0x3f;
+				
+		//DBG_871X("Add id %d val %08x to ratr for bmc sta\n", psta->aid, tx_ra_bitmap);
+
+		//if(pHalData->fw_ractrl == _TRUE)
+		{
+			u8 arg = 0;
+
+			arg = psta->mac_id&0x1f;
+		
+			arg |= BIT(7);
+		
+			//if (shortGIrate==_TRUE)
+			//	arg |= BIT(5);
+			
+			tx_ra_bitmap |= ((raid<<28)&0xf0000000);			
+
+			DBG_871X("update_bmc_sta, mask=0x%x, arg=0x%x\n", tx_ra_bitmap, arg);
+
+			//bitmap[0:27] = tx_rate_bitmap
+			//bitmap[28:31]= Rate Adaptive id
+			//arg[0:4] = macid
+			//arg[5] = Short GI
+			rtw_hal_add_ra_tid(padapter, tx_ra_bitmap, arg);			
+		
+		}
+
+		//set ra_id, init_rate
+		psta->raid = raid;
+		psta->init_rate = init_rate;
+	 
+		_enter_critical_bh(&psta->lock, &irqL);
+		psta->state = _FW_LINKED;
+		_exit_critical_bh(&psta->lock, &irqL);
+
+	}
+	else
+	{
+		DBG_871X("add_RATid_bmc_sta error!\n");
+	}
+		
+}
+
+//notes:
+//AID: 1~MAX for sta and 0 for bc/mc in ap/adhoc mode 
+//MAC_ID = AID+1 for sta in ap/adhoc mode 
+//MAC_ID = 1 for bc/mc for sta/ap/adhoc
+//MAC_ID = 0 for bssid for sta/ap/adhoc
+//CAM_ID = //0~3 for default key, cmd_id=macid + 3, macid=aid+1;
+
+void update_sta_info_apmode(_adapter *padapter, struct sta_info *psta)
+{	
+	_irqL	irqL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct ht_priv	*phtpriv_ap = &pmlmepriv->htpriv;
+	struct ht_priv	*phtpriv_sta = &psta->htpriv;
+
+	//set intf_tag to if1
+	//psta->intf_tag = 0;
+
+	//psta->mac_id = psta->aid+4;
+	psta->mac_id = psta->aid+1; 
+	
+	if(psecuritypriv->dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)
+		psta->ieee8021x_blocked = _TRUE;
+	else
+		psta->ieee8021x_blocked = _FALSE;
+	
+
+	//update sta's cap
+	
+	//ERP
+	VCS_update(padapter, psta);
+		
+	//HT related cap
+	if(phtpriv_sta->ht_option)
+	{
+		//check if sta supports rx ampdu
+		phtpriv_sta->ampdu_enable = phtpriv_ap->ampdu_enable;
+
+		//check if sta support s Short GI
+		if((phtpriv_sta->ht_cap.cap_info & phtpriv_ap->ht_cap.cap_info) & cpu_to_le16(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40))
+		{
+			phtpriv_sta->sgi = _TRUE;
+		}
+
+		// bwmode
+		if((phtpriv_sta->ht_cap.cap_info & phtpriv_ap->ht_cap.cap_info) & cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH))
+		{
+			//phtpriv_sta->bwmode = HT_CHANNEL_WIDTH_40;
+			phtpriv_sta->bwmode = pmlmeext->cur_bwmode;
+			phtpriv_sta->ch_offset = pmlmeext->cur_ch_offset;
+			
+		}		
+
+		psta->qos_option = _TRUE;
+		
+	}
+	else
+	{
+		phtpriv_sta->ampdu_enable = _FALSE;
+		
+		phtpriv_sta->sgi = _FALSE;
+		phtpriv_sta->bwmode = HT_CHANNEL_WIDTH_20;
+		phtpriv_sta->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	}
+
+	//Rx AMPDU
+	send_delba(padapter, 0, psta->hwaddr);// recipient
+	
+	//TX AMPDU
+	send_delba(padapter, 1, psta->hwaddr);// // originator
+	phtpriv_sta->agg_enable_bitmap = 0x0;//reset
+	phtpriv_sta->candidate_tid_bitmap = 0x0;//reset
+	
+
+	//todo: init other variables
+	
+	_rtw_memset((void*)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
+
+
+	//add ratid
+	//add_RATid(padapter, psta);//move to ap_sta_info_defer_update()
+
+
+	_enter_critical_bh(&psta->lock, &irqL);
+	psta->state |= _FW_LINKED;
+	_exit_critical_bh(&psta->lock, &irqL);
+	
+
+}
+
+static void update_hw_ht_param(_adapter *padapter)
+{
+	unsigned char		max_AMPDU_len;
+	unsigned char		min_MPDU_spacing;
+	struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	DBG_871X("%s\n", __FUNCTION__);
+	
+
+	//handle A-MPDU parameter field
+	/* 	
+		AMPDU_para [1:0]:Max AMPDU Len => 0:8k , 1:16k, 2:32k, 3:64k
+		AMPDU_para [4:2]:Min MPDU Start Spacing	
+	*/
+	max_AMPDU_len = pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x03;	
+	
+	min_MPDU_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c) >> 2;	
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_MIN_SPACE, (u8 *)(&min_MPDU_spacing));
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_FACTOR, (u8 *)(&max_AMPDU_len));
+
+	//
+	// Config SM Power Save setting
+	//
+	pmlmeinfo->SM_PS = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & 0x0C) >> 2;
+	if(pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
+	{
+		/*u8 i;
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			pmlmeinfo->HT_caps.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}*/
+		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n",__FUNCTION__);
+	}
+
+	//
+	// Config current HT Protection mode.
+	//
+	//pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
+
+}
+
+static void start_bss_network(_adapter *padapter, u8 *pbuf)
+{
+	u8 *p;
+	u8 val8, cur_channel, cur_bwmode, cur_ch_offset;
+	u16 bcn_interval;
+	u32	acparm;	
+	int	ie_len;	
+	struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);	
+	WLAN_BSSID_EX *pnetwork = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork_mlmeext = &(pmlmeinfo->network);
+	struct HT_info_element *pht_info=NULL;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#endif //CONFIG_P2P
+	u8 cbw40_enable=0;
+	u8 change_band = _FALSE;
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	bcn_interval = (u16)pnetwork->Configuration.BeaconPeriod;	
+	cur_channel = pnetwork->Configuration.DSConfig;
+	cur_bwmode = HT_CHANNEL_WIDTH_20;;
+	cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	
+
+	//check if there is wps ie, 
+	//if there is wpsie in beacon, the hostapd will update beacon twice when stating hostapd,
+	//and at first time the security ie ( RSN/WPA IE) will not include in beacon.
+	if(NULL == rtw_get_wps_ie(pnetwork->IEs+_FIXED_IE_LENGTH_, pnetwork->IELength-_FIXED_IE_LENGTH_, NULL, NULL))
+	{
+		pmlmeext->bstart_bss = _TRUE;
+	}
+
+	//todo: update wmm, ht cap
+	//pmlmeinfo->WMM_enable;
+	//pmlmeinfo->HT_enable;
+	if(pmlmepriv->qospriv.qos_option)
+		pmlmeinfo->WMM_enable = _TRUE;
+
+	if(pmlmepriv->htpriv.ht_option)
+	{
+		pmlmeinfo->WMM_enable = _TRUE;
+		pmlmeinfo->HT_enable = _TRUE;
+		//pmlmeinfo->HT_info_enable = _TRUE;
+		//pmlmeinfo->HT_caps_enable = _TRUE;
+
+		update_hw_ht_param(padapter);
+	}
+	
+
+	if(pmlmepriv->cur_network.join_res != _TRUE) //setting only at  first time
+	{		
+		//WEP Key will be set before this function, do not clear CAM.
+		if ((psecuritypriv->dot11PrivacyAlgrthm != _WEP40_) && (psecuritypriv->dot11PrivacyAlgrthm != _WEP104_))
+			flush_all_cam_entry(padapter);	//clear CAM
+	}	
+
+	//set MSR to AP_Mode		
+	Set_MSR(padapter, _HW_STATE_AP_);	
+		
+	//Set BSSID REG
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pnetwork->MacAddress);
+
+	//Set EDCA param reg
+#ifdef CONFIG_CONCURRENT_MODE
+	acparm = 0x005ea42b;
+#else
+	acparm = 0x002F3217; // VO
+#endif
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acparm));
+	acparm = 0x005E4317; // VI
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acparm));
+	//acparm = 0x00105320; // BE
+	acparm = 0x005ea42b;
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+	acparm = 0x0000A444; // BK
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acparm));
+
+	//Set Security
+	val8 = (psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X)? 0xcc: 0xcf;
+	rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+	//Beacon Control related register
+	rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&bcn_interval));
+
+	if(pmlmepriv->cur_network.join_res != _TRUE) //setting only at  first time
+	{
+		u32 initialgain;
+
+		initialgain = 0x1e;
+
+
+		//disable dynamic functions, such as high power, DIG
+		//Save_DM_Func_Flag(padapter);
+		//Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+		
+#ifdef CONFIG_CONCURRENT_MODE	
+		if(padapter->adapter_type > PRIMARY_ADAPTER)
+		{
+			if(rtw_buddy_adapter_up(padapter))
+			{
+				_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+
+				//turn on dynamic functions on PRIMARY_ADAPTER, dynamic functions only runs at PRIMARY_ADAPTER
+				Switch_DM_Func(pbuddy_adapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+	
+				rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+			}
+		}
+		else
+#endif
+		{
+			//turn on dynamic functions	
+			Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+			rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+		}	
+	
+	}
+
+	//set channel, bwmode	
+	p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+	if( p && ie_len)
+	{
+		pht_info = (struct HT_info_element *)(p+2);
+
+		if( pmlmeext->cur_channel > 14 )
+		{
+			if( pregpriv->cbw40_enable & BIT(1) )
+				cbw40_enable = 1;
+		}
+		else
+			if( pregpriv->cbw40_enable & BIT(0) )
+				cbw40_enable = 1;
+			
+		if ((cbw40_enable) &&	 (pht_info->infos[0] & BIT(2)))
+		{
+			//switch to the 40M Hz mode
+			//pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+			cur_bwmode = HT_CHANNEL_WIDTH_40;
+			switch (pht_info->infos[0] & 0x3)
+			{
+				case 1:
+					//pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					break;
+			
+				case 3:
+					//pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;					
+					break;
+				
+				default:
+					//pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+					break;
+			}		
+						
+		}
+					
+	}
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_set_ap_channel_bandwidth(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+#else
+	//TODO: need to judge the phy parameters on concurrent mode for single phy
+	//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#ifdef CONFIG_CONCURRENT_MODE
+	if(!check_buddy_fwstate(padapter, _FW_LINKED|_FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+	}
+	else if(check_buddy_fwstate(padapter, _FW_LINKED)==_TRUE)//only second adapter can enter AP Mode
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;		
+		struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	
+		//To sync cur_channel/cur_bwmode/cur_ch_offset with primary adapter
+		DBG_871X("primary iface is at linked state, sync cur_channel/cur_bwmode/cur_ch_offset\n");
+		DBG_871X("primary adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+		DBG_871X("second adapter, CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+		
+		if((cur_channel <= 14 && pbuddy_mlmeext->cur_channel >= 36) ||
+		(cur_channel >= 36 && pbuddy_mlmeext->cur_channel <= 14))
+			change_band = _TRUE;
+		
+		cur_channel = pbuddy_mlmeext->cur_channel;
+		if(cur_bwmode == HT_CHANNEL_WIDTH_40)
+		{
+			if(pht_info)
+				pht_info->infos[0] &= ~(BIT(0)|BIT(1));
+			
+			if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+			{
+				cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+
+				//to update cur_ch_offset value in beacon
+				if(pht_info)
+				{				
+					switch(cur_ch_offset)
+					{
+						case HAL_PRIME_CHNL_OFFSET_LOWER:
+							pht_info->infos[0] |= 0x1;
+							break;
+						case HAL_PRIME_CHNL_OFFSET_UPPER:
+							pht_info->infos[0] |= 0x3;
+							break;
+						case HAL_PRIME_CHNL_OFFSET_DONT_CARE:							
+						default:							
+							break;					
+					}
+				}		
+				
+			}
+			else if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+			{
+				cur_bwmode = HT_CHANNEL_WIDTH_20;
+				cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+			
+				if(cur_channel>0 && cur_channel<5)
+				{
+					if(pht_info)
+						pht_info->infos[0] |= 0x1;		
+
+					cur_bwmode = HT_CHANNEL_WIDTH_40;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				}
+
+				if(cur_channel>7 && cur_channel<(14+1))
+				{
+					if(pht_info)
+						pht_info->infos[0] |= 0x3;
+						
+					cur_bwmode = HT_CHANNEL_WIDTH_40;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				}					
+
+				set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+			}
+			
+		}
+
+		// to update channel value in beacon
+		pnetwork->Configuration.DSConfig = cur_channel;		
+		p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+		if(p && ie_len>0)
+			*(p + 2) = cur_channel;
+		
+		if(pht_info)
+			pht_info->primary_channel = cur_channel;
+		
+		//set buddy adapter channel, bandwidth, offeset to current adapter
+		pmlmeext->cur_channel = cur_channel;	
+		pmlmeext->cur_bwmode = cur_bwmode;
+		pmlmeext->cur_ch_offset = cur_ch_offset;
+		
+		//buddy interface band is different from current interface, update ERP, support rate, ext support rate IE
+		if(change_band == _TRUE)
+			change_band_update_ie(padapter, pnetwork);
+	}
+#else
+	set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+#endif //CONFIG_CONCURRENT_MODE
+
+	DBG_871X("CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+	//
+	pmlmeext->cur_channel = cur_channel;	
+	pmlmeext->cur_bwmode = cur_bwmode;
+	pmlmeext->cur_ch_offset = cur_ch_offset;
+#endif //CONFIG_DUALMAC_CONCURRENT
+	pmlmeext->cur_wireless_mode = pmlmepriv->cur_network.network_type;
+
+	//update cur_wireless_mode
+	update_wireless_mode(padapter);
+
+	//update RRSR after set channel and bandwidth
+	UpdateBrateTbl(padapter, pnetwork->SupportedRates);
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, pnetwork->SupportedRates);
+
+	//udpate capability after cur_wireless_mode updated
+	update_capinfo(padapter, rtw_get_capability((WLAN_BSSID_EX *)pnetwork));
+	
+	//let pnetwork_mlmeext == pnetwork_mlme.
+	_rtw_memcpy(pnetwork_mlmeext, pnetwork, pnetwork->Length);
+
+#ifdef CONFIG_P2P
+	_rtw_memcpy(pwdinfo->p2p_group_ssid, pnetwork->Ssid.Ssid, pnetwork->Ssid.SsidLength);	
+	pwdinfo->p2p_group_ssid_len = pnetwork->Ssid.SsidLength;
+#endif //CONFIG_P2P
+
+	if(_TRUE == pmlmeext->bstart_bss)
+	{
+		update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+
+#ifndef CONFIG_INTERRUPT_BASED_TXBCN //other case will  tx beacon when bcn interrupt coming in.
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+		//issue beacon frame
+		if(send_beacon(padapter)==_FAIL)
+		{
+			DBG_871X("issue_beacon, fail!\n");
+		}
+#endif 
+#endif //!CONFIG_INTERRUPT_BASED_TXBCN
+
+	}
+
+
+	//update bc/mc sta_info
+	update_bmc_sta(padapter);
+	
+	//pmlmeext->bstart_bss = _TRUE;
+	
+}
+
+int rtw_check_beacon_data(_adapter *padapter, u8 *pbuf,  int len)
+{
+	int ret=_SUCCESS;
+	u8 *p;
+	u8 *pHT_caps_ie=NULL;
+	u8 *pHT_info_ie=NULL;
+	struct sta_info *psta = NULL;
+	u16 cap, ht_cap=_FALSE;
+	uint ie_len = 0;
+	int group_cipher, pairwise_cipher;	
+	u8	channel, network_type, supportRate[NDIS_802_11_LENGTH_RATES_EX];
+	int supportRateNum = 0;
+	u8 OUI1[] = {0x00, 0x50, 0xf2,0x01};
+	u8 wps_oui[4]={0x0,0x50,0xf2,0x04};
+	u8 WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};	
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;	
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pbss_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;	
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *ie = pbss_network->IEs;
+	
+
+	/* SSID */
+	/* Supported rates */
+	/* DS Params */
+	/* WLAN_EID_COUNTRY */
+	/* ERP Information element */
+	/* Extended supported rates */
+	/* WPA/WPA2 */
+	/* Wi-Fi Wireless Multimedia Extensions */
+	/* ht_capab, ht_oper */
+	/* WPS IE */
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return _FAIL;
+
+
+	if(len>MAX_IE_SZ)
+		return _FAIL;
+	
+	pbss_network->IELength = len;
+
+	_rtw_memset(ie, 0, MAX_IE_SZ);
+	
+	_rtw_memcpy(ie, pbuf, pbss_network->IELength);
+
+
+	if(pbss_network->InfrastructureMode!=Ndis802_11APMode)
+		return _FAIL;
+
+	pbss_network->Rssi = 0;
+
+	_rtw_memcpy(pbss_network->MacAddress, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	
+	//beacon interval
+	p = rtw_get_beacon_interval_from_ie(ie);//ie + 8;	// 8: TimeStamp, 2: Beacon Interval 2:Capability
+	//pbss_network->Configuration.BeaconPeriod = le16_to_cpu(*(unsigned short*)p);
+	pbss_network->Configuration.BeaconPeriod = RTW_GET_LE16(p);
+	
+	//capability
+	//cap = *(unsigned short *)rtw_get_capability_from_ie(ie);
+	//cap = le16_to_cpu(cap);
+	cap = RTW_GET_LE16(ie);
+
+	//SSID
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, (pbss_network->IELength -_BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		_rtw_memset(&pbss_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+		_rtw_memcpy(pbss_network->Ssid.Ssid, (p + 2), ie_len);
+		pbss_network->Ssid.SsidLength = ie_len;
+	}	
+
+	//chnnel
+	channel = 0;
+	pbss_network->Configuration.Length = 0;
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _DSSET_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+		channel = *(p + 2);
+
+	pbss_network->Configuration.DSConfig = channel;
+
+	
+	_rtw_memset(supportRate, 0, NDIS_802_11_LENGTH_RATES_EX);
+	// get supported rates
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));	
+	if (p !=  NULL) 
+	{
+		_rtw_memcpy(supportRate, p+2, ie_len);	
+		supportRateNum = ie_len;
+	}
+	
+	//get ext_supported rates
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ie_len, pbss_network->IELength - _BEACON_IE_OFFSET_);	
+	if (p !=  NULL)
+	{
+		_rtw_memcpy(supportRate+supportRateNum, p+2, ie_len);
+		supportRateNum += ie_len;
+	
+	}
+
+	network_type = rtw_check_network_type(supportRate, supportRateNum, channel);
+
+	rtw_set_supported_rate(pbss_network->SupportedRates, network_type);
+
+
+	//parsing ERP_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _ERPINFO_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		ERP_IE_handler(padapter, (PNDIS_802_11_VARIABLE_IEs)p);
+	}
+
+	//update privacy/security
+	if (cap & BIT(4))
+		pbss_network->Privacy = 1;
+	else
+		pbss_network->Privacy = 0;
+
+	psecuritypriv->wpa_psk = 0;
+
+	//wpa2
+	group_cipher = 0; pairwise_cipher = 0;
+	psecuritypriv->wpa2_group_cipher = _NO_PRIVACY_;
+	psecuritypriv->wpa2_pairwise_cipher = _NO_PRIVACY_;	
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _RSN_IE_2_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));		
+	if(p && ie_len>0)
+	{
+		if(rtw_parse_wpa2_ie(p, ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			psecuritypriv->dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			
+			psecuritypriv->dot8021xalg = 1;//psk,  todo:802.1x
+			psecuritypriv->wpa_psk |= BIT(1);
+
+			psecuritypriv->wpa2_group_cipher = group_cipher;
+			psecuritypriv->wpa2_pairwise_cipher = pairwise_cipher;
+#if 0
+			switch(group_cipher)
+			{
+				case WPA_CIPHER_NONE:				
+				psecuritypriv->wpa2_group_cipher = _NO_PRIVACY_;
+				break;
+				case WPA_CIPHER_WEP40:				
+				psecuritypriv->wpa2_group_cipher = _WEP40_;
+				break;
+				case WPA_CIPHER_TKIP:				
+				psecuritypriv->wpa2_group_cipher = _TKIP_;
+				break;
+				case WPA_CIPHER_CCMP:				
+				psecuritypriv->wpa2_group_cipher = _AES_;				
+				break;
+				case WPA_CIPHER_WEP104:					
+				psecuritypriv->wpa2_group_cipher = _WEP104_;
+				break;
+			}
+
+			switch(pairwise_cipher)
+			{
+				case WPA_CIPHER_NONE:			
+				psecuritypriv->wpa2_pairwise_cipher = _NO_PRIVACY_;
+				break;
+				case WPA_CIPHER_WEP40:			
+				psecuritypriv->wpa2_pairwise_cipher = _WEP40_;
+				break;
+				case WPA_CIPHER_TKIP:				
+				psecuritypriv->wpa2_pairwise_cipher = _TKIP_;
+				break;
+				case WPA_CIPHER_CCMP:			
+				psecuritypriv->wpa2_pairwise_cipher = _AES_;
+				break;
+				case WPA_CIPHER_WEP104:					
+				psecuritypriv->wpa2_pairwise_cipher = _WEP104_;
+				break;
+			}
+#endif			
+		}
+		
+	}
+
+	//wpa
+	ie_len = 0;
+	group_cipher = 0; pairwise_cipher = 0;
+	psecuritypriv->wpa_group_cipher = _NO_PRIVACY_;
+	psecuritypriv->wpa_pairwise_cipher = _NO_PRIVACY_;	
+	for (p = ie + _BEACON_IE_OFFSET_; ;p += (ie_len + 2))
+	{
+		p = rtw_get_ie(p, _SSN_IE_1_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));		
+		if ((p) && (_rtw_memcmp(p+2, OUI1, 4)))
+		{
+			if(rtw_parse_wpa_ie(p, ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+			{
+				psecuritypriv->dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+				
+				psecuritypriv->dot8021xalg = 1;//psk,  todo:802.1x
+
+				psecuritypriv->wpa_psk |= BIT(0);
+
+				psecuritypriv->wpa_group_cipher = group_cipher;
+				psecuritypriv->wpa_pairwise_cipher = pairwise_cipher;
+
+#if 0
+				switch(group_cipher)
+				{
+					case WPA_CIPHER_NONE:					
+					psecuritypriv->wpa_group_cipher = _NO_PRIVACY_;
+					break;
+					case WPA_CIPHER_WEP40:					
+					psecuritypriv->wpa_group_cipher = _WEP40_;
+					break;
+					case WPA_CIPHER_TKIP:					
+					psecuritypriv->wpa_group_cipher = _TKIP_;
+					break;
+					case WPA_CIPHER_CCMP:					
+					psecuritypriv->wpa_group_cipher = _AES_;				
+					break;
+					case WPA_CIPHER_WEP104:					
+					psecuritypriv->wpa_group_cipher = _WEP104_;
+					break;
+				}
+
+				switch(pairwise_cipher)
+				{
+					case WPA_CIPHER_NONE:					
+					psecuritypriv->wpa_pairwise_cipher = _NO_PRIVACY_;
+					break;
+					case WPA_CIPHER_WEP40:					
+					psecuritypriv->wpa_pairwise_cipher = _WEP40_;
+					break;
+					case WPA_CIPHER_TKIP:					
+					psecuritypriv->wpa_pairwise_cipher = _TKIP_;
+					break;
+					case WPA_CIPHER_CCMP:					
+					psecuritypriv->wpa_pairwise_cipher = _AES_;
+					break;
+					case WPA_CIPHER_WEP104:					
+					psecuritypriv->wpa_pairwise_cipher = _WEP104_;
+					break;
+				}
+#endif				
+			}
+
+			break;
+			
+		}
+			
+		if ((p == NULL) || (ie_len == 0))
+		{
+				break;
+		}
+		
+	}
+
+	//wmm
+	ie_len = 0;
+	pmlmepriv->qospriv.qos_option = 0;
+	if(pregistrypriv->wmm_enable)
+	{
+		for (p = ie + _BEACON_IE_OFFSET_; ;p += (ie_len + 2))
+		{			
+			p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));	
+			if((p) && _rtw_memcmp(p+2, WMM_PARA_IE, 6)) 
+			{
+				pmlmepriv->qospriv.qos_option = 1;	
+
+				*(p+8) |= BIT(7);//QoS Info, support U-APSD
+				
+				/* disable all ACM bits since the WMM admission control is not supported */
+				*(p + 10) &= ~BIT(4); /* BE */
+				*(p + 14) &= ~BIT(4); /* BK */
+				*(p + 18) &= ~BIT(4); /* VI */
+				*(p + 22) &= ~BIT(4); /* VO */
+				
+				break;				
+			}
+			
+			if ((p == NULL) || (ie_len == 0))
+			{
+				break;
+			}			
+		}		
+	}
+
+	//parsing HT_CAP_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		u8 rf_type;
+
+		struct rtw_ieee80211_ht_cap *pht_cap = (struct rtw_ieee80211_ht_cap *)(p+2);
+
+		pHT_caps_ie=p;
+		
+		
+		ht_cap = _TRUE;
+		network_type |= WIRELESS_11_24N;
+
+	
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+		if((psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_CCMP) ||
+			(psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP))
+		{
+			pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&(0x07<<2));
+		}	
+		else
+		{
+			pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&0x00);	
+		}	
+
+		pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_FACTOR & 0x03); //set  Max Rx AMPDU size  to 64K
+
+		if(rf_type == RF_1T1R)
+		{			
+			pht_cap->supp_mcs_set[0] = 0xff;
+			pht_cap->supp_mcs_set[1] = 0x0;				
+		}
+
+		_rtw_memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len);		
+		
+	}
+
+	//parsing HT_INFO_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		pHT_info_ie=p;
+	}
+
+	switch(network_type)
+	{
+		case WIRELESS_11B:
+			pbss_network->NetworkTypeInUse = Ndis802_11DS;
+			break;	
+		case WIRELESS_11G:
+		case WIRELESS_11BG:
+             case WIRELESS_11G_24N:
+		case WIRELESS_11BG_24N:
+			pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;
+			break;
+		case WIRELESS_11A:
+			pbss_network->NetworkTypeInUse = Ndis802_11OFDM5;
+			break;
+		default :
+			pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;
+			break;
+	}
+	
+	pmlmepriv->cur_network.network_type = network_type;
+
+
+	pmlmepriv->htpriv.ht_option = _FALSE;
+#ifdef CONFIG_80211N_HT
+	if( (psecuritypriv->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
+		      (psecuritypriv->wpa_pairwise_cipher&WPA_CIPHER_TKIP))
+	{	
+		//todo:
+		//ht_cap = _FALSE;
+	}
+		      
+	//ht_cap	
+	if(pregistrypriv->ht_enable && ht_cap==_TRUE)
+	{		
+		pmlmepriv->htpriv.ht_option = _TRUE;
+		pmlmepriv->qospriv.qos_option = 1;
+
+		if(pregistrypriv->ampdu_enable==1)
+		{
+			pmlmepriv->htpriv.ampdu_enable = _TRUE;
+		}
+
+		HT_caps_handler(padapter, (PNDIS_802_11_VARIABLE_IEs)pHT_caps_ie);
+		
+		HT_info_handler(padapter, (PNDIS_802_11_VARIABLE_IEs)pHT_info_ie);
+	}
+#endif
+
+
+	pbss_network->Length = get_WLAN_BSSID_EX_sz((WLAN_BSSID_EX  *)pbss_network);
+
+	//issue beacon to start bss network
+	start_bss_network(padapter, (u8*)pbss_network);
+			
+
+	//alloc sta_info for ap itself
+	psta = rtw_get_stainfo(&padapter->stapriv, pbss_network->MacAddress);
+	if(!psta)
+	{
+		psta = rtw_alloc_stainfo(&padapter->stapriv, pbss_network->MacAddress);
+		if (psta == NULL) 
+		{ 
+			return _FAIL;
+		}	
+	}	
+	psta->state |= WIFI_AP_STATE;		//Aries, add,fix bug of flush_cam_entry at STOP AP mode , 0724 	
+	rtw_indicate_connect( padapter);
+
+	pmlmepriv->cur_network.join_res = _TRUE;//for check if already set beacon
+		
+	//update bc/mc sta_info
+	//update_bmc_sta(padapter);
+
+	return ret;
+
+}
+
+void rtw_set_macaddr_acl(_adapter *padapter, int mode)
+{
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+
+	DBG_871X("%s, mode=%d\n", __func__, mode);
+
+	pacl_list->mode = mode;
+}
+
+int rtw_acl_add_sta(_adapter *padapter, u8 *addr)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	u8 added = _FALSE;
+	int i, ret=0;
+	struct rtw_wlan_acl_node *paclnode;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;	
+
+	DBG_871X("%s(acl_num=%d)=" MAC_FMT "\n", __func__, pacl_list->num, MAC_ARG(addr));	
+
+	if((NUM_ACL-1) < pacl_list->num)
+		return (-1);	
+
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);
+		
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(paclnode->addr, addr, ETH_ALEN))
+		{
+			if(paclnode->valid == _TRUE)
+			{
+				added = _TRUE;
+				DBG_871X("%s, sta has been added\n", __func__);
+				break;
+			}
+		}		
+	}
+	
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+
+	if(added == _TRUE)
+		return ret;
+	
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	for(i=0; i< NUM_ACL; i++)
+	{
+		paclnode = &pacl_list->aclnode[i];
+
+		if(paclnode->valid == _FALSE)
+		{
+			_rtw_init_listhead(&paclnode->list);
+	
+			_rtw_memcpy(paclnode->addr, addr, ETH_ALEN);
+		
+			paclnode->valid = _TRUE;
+
+			rtw_list_insert_tail(&paclnode->list, get_list_head(pacl_node_q));
+	
+			pacl_list->num++;
+
+			break;
+		}
+	}
+
+	DBG_871X("%s, acl_num=%d\n", __func__, pacl_list->num);
+	
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	return ret;
+}
+
+int rtw_acl_remove_sta(_adapter *padapter, u8 *addr)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	int i, ret=0;
+	struct rtw_wlan_acl_node *paclnode;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;	
+
+	DBG_871X("%s(acl_num=%d)=" MAC_FMT "\n", __func__, pacl_list->num, MAC_ARG(addr));	
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);
+		
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(paclnode->addr, addr, ETH_ALEN))
+		{
+			if(paclnode->valid == _TRUE)
+			{
+				paclnode->valid = _FALSE;
+
+				rtw_list_delete(&paclnode->list);
+				
+				pacl_list->num--;
+			}
+		}		
+	}
+	
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	DBG_871X("%s, acl_num=%d\n", __func__, pacl_list->num);
+	
+	return ret;
+
+}
+
+#ifdef CONFIG_NATIVEAP_MLME
+
+static void update_bcn_fixed_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_erpinfo_ie(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork = &(pmlmeinfo->network);
+	unsigned char *p, *ie = pnetwork->IEs;
+	u32 len = 0;
+
+	DBG_871X("%s, ERP_enable=%d\n", __FUNCTION__, pmlmeinfo->ERP_enable);
+
+	if(!pmlmeinfo->ERP_enable)
+		return;
+
+	//parsing ERP_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _ERPINFO_IE_, &len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
+	if(p && len>0)
+	{
+		PNDIS_802_11_VARIABLE_IEs pIE = (PNDIS_802_11_VARIABLE_IEs)p;
+
+		if (pmlmepriv->num_sta_non_erp == 1)
+			pIE->data[0] |= RTW_ERP_INFO_NON_ERP_PRESENT|RTW_ERP_INFO_USE_PROTECTION;
+		else
+			pIE->data[0] &= ~(RTW_ERP_INFO_NON_ERP_PRESENT|RTW_ERP_INFO_USE_PROTECTION);
+
+		if(pmlmepriv->num_sta_no_short_preamble > 0)
+			pIE->data[0] |= RTW_ERP_INFO_BARKER_PREAMBLE_MODE;
+		else
+			pIE->data[0] &= ~(RTW_ERP_INFO_BARKER_PREAMBLE_MODE);
+	
+		ERP_IE_handler(padapter, pIE);
+	}
+	
+}
+
+static void update_bcn_htcap_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_htinfo_ie(_adapter *padapter)
+{	
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_rsn_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_wpa_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_wmm_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	
+}
+
+static void update_bcn_wps_ie(_adapter *padapter)
+{
+	u8 *pwps_ie=NULL, *pwps_ie_src, *premainder_ie, *pbackup_remainder_ie=NULL;
+	uint wps_ielen=0, wps_offset, remainder_ielen;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork = &(pmlmeinfo->network);
+	unsigned char *ie = pnetwork->IEs;
+	u32 ielen = pnetwork->IELength;
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	pwps_ie = rtw_get_wps_ie(ie+_FIXED_IE_LENGTH_, ielen-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
+	
+	if(pwps_ie==NULL || wps_ielen==0)
+		return;
+
+	wps_offset = (uint)(pwps_ie-ie);
+
+	premainder_ie = pwps_ie + wps_ielen;
+
+	remainder_ielen = ielen - wps_offset - wps_ielen;
+
+	if(remainder_ielen>0)
+	{
+		pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+		if(pbackup_remainder_ie)
+			_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+	}
+
+	
+	pwps_ie_src = pmlmepriv->wps_beacon_ie;
+	if(pwps_ie_src == NULL)
+		return;
+
+
+	wps_ielen = (uint)pwps_ie_src[1];//to get ie data len
+	if((wps_offset+wps_ielen+2+remainder_ielen)<=MAX_IE_SZ)
+	{
+		_rtw_memcpy(pwps_ie, pwps_ie_src, wps_ielen+2);
+		pwps_ie += (wps_ielen+2);
+
+		if(pbackup_remainder_ie)
+			_rtw_memcpy(pwps_ie, pbackup_remainder_ie, remainder_ielen);
+
+		//update IELength
+		pnetwork->IELength = wps_offset + (wps_ielen+2) + remainder_ielen;
+	}
+
+	if(pbackup_remainder_ie)
+		rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+
+}
+
+static void update_bcn_p2p_ie(_adapter *padapter)
+{
+
+}
+
+static void update_bcn_vendor_spec_ie(_adapter *padapter, u8*oui)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if(_rtw_memcmp(RTW_WPA_OUI, oui, 4))
+	{
+		update_bcn_wpa_ie(padapter);
+	}
+	else if(_rtw_memcmp(WMM_OUI, oui, 4))
+	{
+		update_bcn_wmm_ie(padapter);
+	}
+	else if(_rtw_memcmp(WPS_OUI, oui, 4))
+	{
+		update_bcn_wps_ie(padapter);
+	}
+	else if(_rtw_memcmp(P2P_OUI, oui, 4))
+	{
+		update_bcn_p2p_ie(padapter);
+	}
+	else
+	{
+		DBG_871X("unknown OUI type!\n");
+ 	}
+	
+	
+}
+
+void update_beacon(_adapter *padapter, u8 ie_id, u8 *oui, u8 tx)
+{
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv;
+	struct mlme_ext_priv	*pmlmeext;
+	//struct mlme_ext_info	*pmlmeinfo;
+	
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if(!padapter)
+		return;
+
+	pmlmepriv = &(padapter->mlmepriv);
+	pmlmeext = &(padapter->mlmeextpriv);
+	//pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(_FALSE == pmlmeext->bstart_bss)
+		return;
+
+	_enter_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);
+
+	switch(ie_id)
+	{
+		case 0xFF:
+
+			update_bcn_fixed_ie(padapter);//8: TimeStamp, 2: Beacon Interval 2:Capability
+			
+			break;
+
+		case _TIM_IE_:
+			
+			update_BCNTIM(padapter);
+			
+			break;
+
+		case _ERPINFO_IE_:
+
+			update_bcn_erpinfo_ie(padapter);
+
+			break;
+
+		case _HT_CAPABILITY_IE_:
+
+			update_bcn_htcap_ie(padapter);
+			
+			break;
+
+		case _RSN_IE_2_:
+
+			update_bcn_rsn_ie(padapter);
+
+			break;
+			
+		case _HT_ADD_INFO_IE_:
+
+			update_bcn_htinfo_ie(padapter);
+			
+			break;
+	
+		case _VENDOR_SPECIFIC_IE_:
+
+			update_bcn_vendor_spec_ie(padapter, oui);
+			
+			break;
+			
+		default:
+			break;
+	}
+
+	pmlmepriv->update_bcn = _TRUE;
+	
+	_exit_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);		
+	
+#ifndef CONFIG_INTERRUPT_BASED_TXBCN 
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+	if(tx)
+	{
+		//send_beacon(padapter);//send_beacon must execute on TSR level
+		set_tx_beacon_cmd(padapter);
+	}
+#else
+	{	
+		//PCI will issue beacon when BCN interrupt occurs.		
+	}
+#endif
+#endif //!CONFIG_INTERRUPT_BASED_TXBCN
+	
+}
+
+#ifdef CONFIG_80211N_HT
+
+/*
+op_mode
+Set to 0 (HT pure) under the followign conditions
+	- all STAs in the BSS are 20/40 MHz HT in 20/40 MHz BSS or
+	- all STAs in the BSS are 20 MHz HT in 20 MHz BSS
+Set to 1 (HT non-member protection) if there may be non-HT STAs
+	in both the primary and the secondary channel
+Set to 2 if only HT STAs are associated in BSS,
+	however and at least one 20 MHz HT STA is associated
+Set to 3 (HT mixed mode) when one or more non-HT STAs are associated
+	(currently non-GF HT station is considered as non-HT STA also)
+*/
+static int rtw_ht_operation_update(_adapter *padapter)
+{
+	u16 cur_op_mode, new_op_mode;
+	int op_mode_changes = 0;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct ht_priv	*phtpriv_ap = &pmlmepriv->htpriv;
+
+	if(pmlmepriv->htpriv.ht_option == _TRUE) 
+		return 0;
+	
+	//if (!iface->conf->ieee80211n || iface->conf->ht_op_mode_fixed)
+	//	return 0;
+
+	DBG_871X("%s current operation mode=0x%X\n",
+		   __FUNCTION__, pmlmepriv->ht_op_mode);
+
+	if (!(pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT)
+	    && pmlmepriv->num_sta_ht_no_gf) {
+		pmlmepriv->ht_op_mode |=
+			HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT;
+		op_mode_changes++;
+	} else if ((pmlmepriv->ht_op_mode &
+		    HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT) &&
+		   pmlmepriv->num_sta_ht_no_gf == 0) {
+		pmlmepriv->ht_op_mode &=
+			~HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT;
+		op_mode_changes++;
+	}
+
+	if (!(pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT) &&
+	    (pmlmepriv->num_sta_no_ht || pmlmepriv->olbc_ht)) {
+		pmlmepriv->ht_op_mode |= HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT;
+		op_mode_changes++;
+	} else if ((pmlmepriv->ht_op_mode &
+		    HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT) &&
+		   (pmlmepriv->num_sta_no_ht == 0 && !pmlmepriv->olbc_ht)) {
+		pmlmepriv->ht_op_mode &=
+			~HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT;
+		op_mode_changes++;
+	}
+
+	/* Note: currently we switch to the MIXED op mode if HT non-greenfield
+	 * station is associated. Probably it's a theoretical case, since
+	 * it looks like all known HT STAs support greenfield.
+	 */
+	new_op_mode = 0;
+	if (pmlmepriv->num_sta_no_ht ||
+	    (pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT))
+		new_op_mode = OP_MODE_MIXED;
+	else if ((phtpriv_ap->ht_cap.cap_info & IEEE80211_HT_CAP_SUP_WIDTH)
+		 && pmlmepriv->num_sta_ht_20mhz)
+		new_op_mode = OP_MODE_20MHZ_HT_STA_ASSOCED;
+	else if (pmlmepriv->olbc_ht)
+		new_op_mode = OP_MODE_MAY_BE_LEGACY_STAS;
+	else
+		new_op_mode = OP_MODE_PURE;
+
+	cur_op_mode = pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_OP_MODE_MASK;
+	if (cur_op_mode != new_op_mode) {
+		pmlmepriv->ht_op_mode &= ~HT_INFO_OPERATION_MODE_OP_MODE_MASK;
+		pmlmepriv->ht_op_mode |= new_op_mode;
+		op_mode_changes++;
+	}
+
+	DBG_871X("%s new operation mode=0x%X changes=%d\n",
+		   __FUNCTION__, pmlmepriv->ht_op_mode, op_mode_changes);
+
+	return op_mode_changes;
+	
+}
+
+#endif /* CONFIG_80211N_HT */
+
+void associated_clients_update(_adapter *padapter, u8 updated)
+{
+	//update associcated stations cap.
+	if(updated == _TRUE)
+	{
+		_irqL irqL;
+		_list	*phead, *plist;
+		struct sta_info *psta=NULL;	
+		struct sta_priv *pstapriv = &padapter->stapriv;
+			
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		
+		phead = &pstapriv->asoc_list;
+		plist = get_next(phead);
+		
+		//check asoc_queue
+		while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)	
+		{
+			psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		
+			plist = get_next(plist);
+
+			VCS_update(padapter, psta);		
+		}
+
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	}		
+
+}
+
+/* called > TSR LEVEL for USB or SDIO Interface*/
+void bss_cap_update_on_sta_join(_adapter *padapter, struct sta_info *psta)
+{
+	u8 beacon_updated = _FALSE;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+
+	
+#if 0
+	if (!(psta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
+	    !psta->no_short_preamble_set) {
+		psta->no_short_preamble_set = 1;
+		pmlmepriv->num_sta_no_short_preamble++;
+		if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) && 
+		     (pmlmepriv->num_sta_no_short_preamble == 1))
+			ieee802_11_set_beacons(hapd->iface);
+	}
+#endif
+
+
+	if(!(psta->flags & WLAN_STA_SHORT_PREAMBLE))	
+	{
+		if(!psta->no_short_preamble_set)
+		{
+			psta->no_short_preamble_set = 1;
+			
+			pmlmepriv->num_sta_no_short_preamble++;
+			
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) && 
+		     		(pmlmepriv->num_sta_no_short_preamble == 1))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}	
+			
+		}
+	}
+	else
+	{
+		if(psta->no_short_preamble_set)
+		{
+			psta->no_short_preamble_set = 0;
+			
+			pmlmepriv->num_sta_no_short_preamble--;
+			
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) && 
+		     		(pmlmepriv->num_sta_no_short_preamble == 0))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}	
+			
+		}
+	}
+
+#if 0
+	if (psta->flags & WLAN_STA_NONERP && !psta->nonerp_set) {
+		psta->nonerp_set = 1;
+		pmlmepriv->num_sta_non_erp++;
+		if (pmlmepriv->num_sta_non_erp == 1)
+			ieee802_11_set_beacons(hapd->iface);
+	}
+#endif
+
+	if(psta->flags & WLAN_STA_NONERP)
+	{
+		if(!psta->nonerp_set)
+		{
+			psta->nonerp_set = 1;
+			
+			pmlmepriv->num_sta_non_erp++;
+			
+			if (pmlmepriv->num_sta_non_erp == 1)
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, _ERPINFO_IE_, NULL, _TRUE);
+			}	
+		}
+		
+	}
+	else
+	{
+		if(psta->nonerp_set)
+		{
+			psta->nonerp_set = 0;
+			
+			pmlmepriv->num_sta_non_erp--;
+			
+			if (pmlmepriv->num_sta_non_erp == 0)
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, _ERPINFO_IE_, NULL, _TRUE);
+			}	
+		}
+		
+	}
+
+
+#if 0
+	if (!(psta->capability & WLAN_CAPABILITY_SHORT_SLOT) &&
+	    !psta->no_short_slot_time_set) {
+		psta->no_short_slot_time_set = 1;
+		pmlmepriv->num_sta_no_short_slot_time++;
+		if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+		    (pmlmepriv->num_sta_no_short_slot_time == 1))
+			ieee802_11_set_beacons(hapd->iface);
+	}
+#endif
+
+	if(!(psta->capability & WLAN_CAPABILITY_SHORT_SLOT))
+	{
+		if(!psta->no_short_slot_time_set)
+		{
+			psta->no_short_slot_time_set = 1;
+			
+			pmlmepriv->num_sta_no_short_slot_time++;
+			
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+		   		 (pmlmepriv->num_sta_no_short_slot_time == 1))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}			
+			
+		}
+	}
+	else
+	{
+		if(psta->no_short_slot_time_set)
+		{
+			psta->no_short_slot_time_set = 0;
+			
+			pmlmepriv->num_sta_no_short_slot_time--;
+			
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+		   		 (pmlmepriv->num_sta_no_short_slot_time == 0))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}			
+		}
+	}
+	
+#ifdef CONFIG_80211N_HT
+
+	if (psta->flags & WLAN_STA_HT) 
+	{
+		u16 ht_capab = le16_to_cpu(psta->htpriv.ht_cap.cap_info);
+			
+		DBG_871X("HT: STA " MAC_FMT " HT Capabilities "
+			   "Info: 0x%04x\n", MAC_ARG(psta->hwaddr), ht_capab);
+
+		if (psta->no_ht_set) {
+			psta->no_ht_set = 0;
+			pmlmepriv->num_sta_no_ht--;
+		}
+		
+		if ((ht_capab & IEEE80211_HT_CAP_GRN_FLD) == 0) {
+			if (!psta->no_ht_gf_set) {
+				psta->no_ht_gf_set = 1;
+				pmlmepriv->num_sta_ht_no_gf++;
+			}
+			DBG_871X("%s STA " MAC_FMT " - no "
+				   "greenfield, num of non-gf stations %d\n",
+				   __FUNCTION__, MAC_ARG(psta->hwaddr),
+				   pmlmepriv->num_sta_ht_no_gf);
+		}
+		
+		if ((ht_capab & IEEE80211_HT_CAP_SUP_WIDTH) == 0) {
+			if (!psta->ht_20mhz_set) {
+				psta->ht_20mhz_set = 1;
+				pmlmepriv->num_sta_ht_20mhz++;
+			}
+			DBG_871X("%s STA " MAC_FMT " - 20 MHz HT, "
+				   "num of 20MHz HT STAs %d\n",
+				   __FUNCTION__, MAC_ARG(psta->hwaddr),
+				   pmlmepriv->num_sta_ht_20mhz);
+		}
+		
+	} 
+	else 
+	{
+		if (!psta->no_ht_set) {
+			psta->no_ht_set = 1;
+			pmlmepriv->num_sta_no_ht++;
+		}
+		if(pmlmepriv->htpriv.ht_option == _TRUE) {		
+			DBG_871X("%s STA " MAC_FMT
+				   " - no HT, num of non-HT stations %d\n",
+				   __FUNCTION__, MAC_ARG(psta->hwaddr),
+				   pmlmepriv->num_sta_no_ht);
+		}
+	}
+
+	if (rtw_ht_operation_update(padapter) > 0)
+	{
+		update_beacon(padapter, _HT_CAPABILITY_IE_, NULL, _FALSE);
+		update_beacon(padapter, _HT_ADD_INFO_IE_, NULL, _TRUE);
+	}	
+	
+#endif /* CONFIG_80211N_HT */
+
+	//update associcated stations cap.
+	associated_clients_update(padapter,  beacon_updated);
+
+	DBG_871X("%s, updated=%d\n", __func__, beacon_updated);
+
+}
+
+u8 bss_cap_update_on_sta_leave(_adapter *padapter, struct sta_info *psta)
+{
+	u8 beacon_updated = _FALSE;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+
+	if(!psta)
+		return beacon_updated;
+
+	if (psta->no_short_preamble_set) {
+		psta->no_short_preamble_set = 0;
+		pmlmepriv->num_sta_no_short_preamble--;
+		if (pmlmeext->cur_wireless_mode > WIRELESS_11B
+		    && pmlmepriv->num_sta_no_short_preamble == 0)
+		{
+			beacon_updated = _TRUE;
+			update_beacon(padapter, 0xFF, NULL, _TRUE);
+		}	
+	}	
+
+	if (psta->nonerp_set) {
+		psta->nonerp_set = 0;		
+		pmlmepriv->num_sta_non_erp--;
+		if (pmlmepriv->num_sta_non_erp == 0)
+		{
+			beacon_updated = _TRUE;
+			update_beacon(padapter, _ERPINFO_IE_, NULL, _TRUE);
+		}	
+	}
+
+	if (psta->no_short_slot_time_set) {
+		psta->no_short_slot_time_set = 0;
+		pmlmepriv->num_sta_no_short_slot_time--;
+		if (pmlmeext->cur_wireless_mode > WIRELESS_11B
+		    && pmlmepriv->num_sta_no_short_slot_time == 0)
+		{
+			beacon_updated = _TRUE;
+			update_beacon(padapter, 0xFF, NULL, _TRUE);
+		}	
+	}
+	
+#ifdef CONFIG_80211N_HT
+
+	if (psta->no_ht_gf_set) {
+		psta->no_ht_gf_set = 0;
+		pmlmepriv->num_sta_ht_no_gf--;
+	}
+
+	if (psta->no_ht_set) {
+		psta->no_ht_set = 0;
+		pmlmepriv->num_sta_no_ht--;
+	}
+
+	if (psta->ht_20mhz_set) {
+		psta->ht_20mhz_set = 0;
+		pmlmepriv->num_sta_ht_20mhz--;
+	}
+
+	if (rtw_ht_operation_update(padapter) > 0)
+	{
+		update_beacon(padapter, _HT_CAPABILITY_IE_, NULL, _FALSE);
+		update_beacon(padapter, _HT_ADD_INFO_IE_, NULL, _TRUE);
+	}
+	
+#endif /* CONFIG_80211N_HT */
+
+	//update associcated stations cap.
+	//associated_clients_update(padapter,  beacon_updated); //move it to avoid deadlock
+
+	DBG_871X("%s, updated=%d\n", __func__, beacon_updated);
+
+	return beacon_updated;
+
+}
+
+u8 ap_free_sta(_adapter *padapter, struct sta_info *psta, bool active, u16 reason)
+{
+	_irqL irqL;
+	u8 beacon_updated = _FALSE;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	if(!psta)
+		return beacon_updated;
+
+	if (active == _TRUE)
+	{
+#ifdef CONFIG_80211N_HT
+		//tear down Rx AMPDU
+		send_delba(padapter, 0, psta->hwaddr);// recipient
+	
+		//tear down TX AMPDU
+		send_delba(padapter, 1, psta->hwaddr);// // originator
+		
+#endif //CONFIG_80211N_HT
+
+		issue_deauth(padapter, psta->hwaddr, reason);
+	}
+
+	psta->htpriv.agg_enable_bitmap = 0x0;//reset
+	psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+
+
+	//report_del_sta_event(padapter, psta->hwaddr, reason);
+
+	//clear cam entry / key
+	//clear_cam_entry(padapter, (psta->mac_id + 3));
+	rtw_clearstakey_cmd(padapter, (u8*)psta, (u8)(psta->mac_id + 3), _TRUE);
+
+
+	_enter_critical_bh(&psta->lock, &irqL);
+	psta->state &= ~_FW_LINKED;
+	_exit_critical_bh(&psta->lock, &irqL);
+
+	#ifdef CONFIG_IOCTL_CFG80211
+	if (1) {
+		#ifdef COMPAT_KERNEL_RELEASE
+		rtw_cfg80211_indicate_sta_disassoc(padapter, psta->hwaddr, reason);
+		#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		rtw_cfg80211_indicate_sta_disassoc(padapter, psta->hwaddr, reason);
+		#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		/* will call rtw_cfg80211_indicate_sta_disassoc() in cmd_thread for old API context */
+		#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+	} else
+	#endif //CONFIG_IOCTL_CFG80211
+	{
+		rtw_indicate_sta_disassoc_event(padapter, psta);
+	}
+
+	report_del_sta_event(padapter, psta->hwaddr, reason);
+
+	beacon_updated = bss_cap_update_on_sta_leave(padapter, psta);
+
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);					
+	rtw_free_stainfo(padapter, psta);
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	
+
+	return beacon_updated;
+
+}
+
+int rtw_ap_inform_ch_switch(_adapter *padapter, u8 new_ch, u8 ch_offset)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	int ret=0;	
+	struct sta_info *psta = NULL;	
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return ret;
+
+	DBG_871X(FUNC_NDEV_FMT" with ch:%u, offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev), new_ch, ch_offset);
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+	
+	/* for each sta in asoc_queue */
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)	
+	{		
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		issue_action_spct_ch_switch(padapter, psta->hwaddr, new_ch, ch_offset);
+		psta->expire_to = ((pstapriv->expire_to * 2) > 5) ? 5 : (pstapriv->expire_to * 2);
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	issue_action_spct_ch_switch(padapter, bc_addr, new_ch, ch_offset);
+
+	return ret;
+}
+
+int rtw_sta_flush(_adapter *padapter)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	int ret=0;	
+	struct sta_info *psta = NULL;	
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	int i;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return ret;
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE) {
+		int stainfo_offset;
+		
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		/* Remove sta from asoc_list */
+		rtw_list_delete(&psta->asoc_list);
+		pstapriv->asoc_list_cnt--;
+
+		/* Keep sta for ap_free_sta() beyond this asoc_list loop */
+		stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+		if (stainfo_offset_valid(stainfo_offset)) {
+			chk_alive_list[chk_alive_num++] = stainfo_offset;
+		}
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+
+	/* For each sta in chk_alive_list, call ap_free_sta */
+	for (i = 0; i < chk_alive_num; i++) {
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+		ap_free_sta(padapter, psta, _TRUE, WLAN_REASON_DEAUTH_LEAVING);
+	}
+
+	issue_deauth(padapter, bc_addr, WLAN_REASON_DEAUTH_LEAVING);
+
+	associated_clients_update(padapter, _TRUE);
+
+	return ret;
+
+}
+
+/* called > TSR LEVEL for USB or SDIO Interface*/
+void sta_info_update(_adapter *padapter, struct sta_info *psta)
+{	
+	int flags = psta->flags;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+				
+	//update wmm cap.
+	if(WLAN_STA_WME&flags)
+		psta->qos_option = 1;
+	else
+		psta->qos_option = 0;
+
+	if(pmlmepriv->qospriv.qos_option == 0)	
+		psta->qos_option = 0;
+
+		
+#ifdef CONFIG_80211N_HT		
+	//update 802.11n ht cap.
+	if(WLAN_STA_HT&flags)
+	{
+		psta->htpriv.ht_option = _TRUE;
+		psta->qos_option = 1;	
+	}
+	else		
+	{
+		psta->htpriv.ht_option = _FALSE;
+	}
+		
+	if(pmlmepriv->htpriv.ht_option == _FALSE)	
+		psta->htpriv.ht_option = _FALSE;
+#endif		
+
+
+	update_sta_info_apmode(padapter, psta);
+		
+
+}
+
+/* called >= TSR LEVEL for USB or SDIO Interface*/
+void ap_sta_info_defer_update(_adapter *padapter, struct sta_info *psta)
+{
+	if(psta->state & _FW_LINKED)
+	{	
+		//add ratid
+		add_RATid(padapter, psta);
+	}	
+}
+
+/* restore hw setting from sw data structures */
+void rtw_ap_restore_network(_adapter *padapter)
+{
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct sta_info *psta;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	_irqL irqL;
+	_list	*phead, *plist;
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	int i;
+
+	rtw_setopmode_cmd(padapter, Ndis802_11APMode);
+
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+	start_bss_network(padapter, (u8*)&mlmepriv->cur_network.network);
+
+	if((padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_) ||
+		(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_))
+	{
+		/* restore group key, WEP keys is restored in ips_leave() */
+		rtw_set_key(padapter, psecuritypriv, psecuritypriv->dot118021XGrpKeyid, 0);
+	}
+
+	/* per sta pairwise key and settings */
+	if((padapter->securitypriv.dot11PrivacyAlgrthm != _TKIP_) &&
+		(padapter->securitypriv.dot11PrivacyAlgrthm != _AES_)) {
+		return;
+	}
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE) {
+		int stainfo_offset;
+
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+		if (stainfo_offset_valid(stainfo_offset)) {
+			chk_alive_list[chk_alive_num++] = stainfo_offset;
+		}
+	}
+
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	for (i = 0; i < chk_alive_num; i++) {
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+
+		if (psta == NULL) {
+			DBG_871X(FUNC_ADPT_FMT" sta_info is null\n", FUNC_ADPT_ARG(padapter));
+		} else if (psta->state &_FW_LINKED) {
+			Update_RA_Entry(padapter, psta->mac_id);
+			//pairwise key
+			rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+		}
+	}
+
+}
+
+void start_ap_mode(_adapter *padapter)
+{
+	int i;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	
+	pmlmepriv->update_bcn = _FALSE;
+	
+	//init_mlme_ap_info(padapter);
+	pmlmeext->bstart_bss = _FALSE;
+
+	pmlmepriv->num_sta_non_erp = 0;
+
+	pmlmepriv->num_sta_no_short_slot_time = 0;
+
+	pmlmepriv->num_sta_no_short_preamble = 0;
+
+	pmlmepriv->num_sta_ht_no_gf = 0;
+
+	pmlmepriv->num_sta_no_ht = 0;
+	
+	pmlmepriv->num_sta_ht_20mhz = 0;
+
+	pmlmepriv->olbc = _FALSE;
+
+	pmlmepriv->olbc_ht = _FALSE;
+	
+#ifdef CONFIG_80211N_HT
+	pmlmepriv->ht_op_mode = 0;
+#endif
+
+	for(i=0; i<NUM_STA; i++)
+		pstapriv->sta_aid[i] = NULL;
+
+	pmlmepriv->wps_beacon_ie = NULL;	
+	pmlmepriv->wps_probe_resp_ie = NULL;
+	pmlmepriv->wps_assoc_resp_ie = NULL;
+	
+	pmlmepriv->p2p_beacon_ie = NULL;
+	pmlmepriv->p2p_probe_resp_ie = NULL;
+
+	
+	//for ACL 
+	_rtw_init_listhead(&(pacl_list->acl_node_q.queue));
+	pacl_list->num = 0;
+	pacl_list->mode = 0;
+	for(i = 0; i < NUM_ACL; i++)
+	{		
+		_rtw_init_listhead(&pacl_list->aclnode[i].list);
+		pacl_list->aclnode[i].valid = _FALSE;
+	}
+
+}
+
+void stop_ap_mode(_adapter *padapter)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	struct rtw_wlan_acl_node *paclnode;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;	
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;	
+
+	pmlmepriv->update_bcn = _FALSE;
+	pmlmeext->bstart_bss = _FALSE;
+	//_rtw_spinlock_free(&pmlmepriv->bcn_update_lock);
+	
+	//reset and init security priv , this can refine with rtw_reset_securitypriv
+	_rtw_memset((unsigned char *)&padapter->securitypriv, 0, sizeof (struct security_priv));
+	padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
+	padapter->securitypriv.ndisencryptstatus = Ndis802_11WEPDisabled;
+
+	//for ACL
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);		
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(paclnode->valid == _TRUE)
+		{
+			paclnode->valid = _FALSE;
+
+			rtw_list_delete(&paclnode->list);
+				
+			pacl_list->num--;		
+		}		
+	}	
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+	
+	DBG_871X("%s, free acl_node_queue, num=%d\n", __func__, pacl_list->num);
+	
+	rtw_sta_flush(padapter);
+
+	//free_assoc_sta_resources	
+	rtw_free_all_stainfo(padapter);
+	
+	psta = rtw_get_bcmc_stainfo(padapter);
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+	rtw_free_stainfo(padapter, psta);
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	
+	rtw_init_bcmc_stainfo(padapter);	
+
+	rtw_free_mlme_priv_ie_data(pmlmepriv);
+
+}
+
+#endif //CONFIG_NATIVEAP_MLME
+#endif //CONFIG_AP_MODE
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c
new file mode 100755
index 0000000000000..2f84a38e2fdb8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c
@@ -0,0 +1,1700 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_BR_EXT_C_
+
+#ifdef __KERNEL__
+#include <linux/if_arp.h>
+#include <net/ip.h>
+#include <net/ipx.h>
+#include <linux/atalk.h>
+#include <linux/udp.h>
+#include <linux/if_pppox.h>
+#endif
+
+#if 1	// rtw_wifi_driver
+#include <drv_conf.h>
+#include <drv_types.h>
+#include "rtw_br_ext.h"
+#else	// rtw_wifi_driver
+#include "./8192cd_cfg.h"
+
+#ifndef __KERNEL__
+#include "./sys-support.h"
+#endif
+
+#include "./8192cd.h"
+#include "./8192cd_headers.h"
+#include "./8192cd_br_ext.h"
+#include "./8192cd_debug.h"
+#endif	// rtw_wifi_driver
+
+#ifdef CL_IPV6_PASS
+#ifdef __KERNEL__
+#include <linux/ipv6.h>
+#include <linux/icmpv6.h>
+#include <net/ndisc.h>
+#include <net/checksum.h>
+#include <net/ip6_checksum.h>
+#endif
+#endif
+
+#ifdef CONFIG_BR_EXT
+
+//#define BR_EXT_DEBUG
+
+#define NAT25_IPV4		01
+#define NAT25_IPV6		02
+#define NAT25_IPX		03
+#define NAT25_APPLE		04
+#define NAT25_PPPOE		05
+
+#define RTL_RELAY_TAG_LEN (ETH_ALEN)
+#define TAG_HDR_LEN		4
+
+#define MAGIC_CODE		0x8186
+#define MAGIC_CODE_LEN	2
+#define WAIT_TIME_PPPOE	5	// waiting time for pppoe server in sec
+
+/*-----------------------------------------------------------------
+  How database records network address:
+           0    1    2    3    4    5    6    7    8    9   10
+        |----|----|----|----|----|----|----|----|----|----|----|
+  IPv4  |type|                             |      IP addr      |
+  IPX   |type|      Net addr     |          Node addr          |
+  IPX   |type|      Net addr     |Sckt addr|
+  Apple |type| Network |node|
+  PPPoE |type|   SID   |           AC MAC            |
+-----------------------------------------------------------------*/
+
+
+//Find a tag in pppoe frame and return the pointer
+static __inline__ unsigned char *__nat25_find_pppoe_tag(struct pppoe_hdr *ph, unsigned short type)
+{
+	unsigned char *cur_ptr, *start_ptr;
+	unsigned short tagLen, tagType;
+
+	start_ptr = cur_ptr = (unsigned char *)ph->tag;
+	while((cur_ptr - start_ptr) < ntohs(ph->length)) {
+		// prevent un-alignment access
+		tagType = (unsigned short)((cur_ptr[0] << 8) + cur_ptr[1]);
+		tagLen  = (unsigned short)((cur_ptr[2] << 8) + cur_ptr[3]);
+		if(tagType == type)
+			return cur_ptr;
+		cur_ptr = cur_ptr + TAG_HDR_LEN + tagLen;
+	}
+	return 0;
+}
+
+
+static __inline__ int __nat25_add_pppoe_tag(struct sk_buff *skb, struct pppoe_tag *tag)
+{
+	struct pppoe_hdr *ph = (struct pppoe_hdr *)(skb->data + ETH_HLEN);
+	int data_len;
+
+	data_len = tag->tag_len + TAG_HDR_LEN;
+	if (skb_tailroom(skb) < data_len) {
+		_DEBUG_ERR("skb_tailroom() failed in add SID tag!\n");
+		return -1;
+	}
+
+	skb_put(skb, data_len);
+	// have a room for new tag
+	memmove(((unsigned char *)ph->tag + data_len), (unsigned char *)ph->tag, ntohs(ph->length));
+	ph->length = htons(ntohs(ph->length) + data_len);
+	memcpy((unsigned char *)ph->tag, tag, data_len);
+	return data_len;
+}
+
+static int skb_pull_and_merge(struct sk_buff *skb, unsigned char *src, int len)
+{
+	int tail_len;
+	unsigned long end, tail;
+
+	if ((src+len) > skb_tail_pointer(skb) || skb->len < len)
+		return -1;
+
+	tail = (unsigned long)skb_tail_pointer(skb);
+	end = (unsigned long)src+len;
+	if (tail < end)
+		return -1;
+
+	tail_len = (int)(tail-end);
+	if (tail_len > 0)
+		memmove(src, src+len, tail_len);
+
+	skb_trim(skb, skb->len-len);
+	return 0;
+}
+
+static __inline__ unsigned long __nat25_timeout(_adapter *priv)
+{
+	unsigned long timeout;
+
+	timeout = jiffies - NAT25_AGEING_TIME*HZ;
+
+	return timeout;
+}
+
+
+static __inline__ int  __nat25_has_expired(_adapter *priv,
+				struct nat25_network_db_entry *fdb)
+{
+	if(time_before_eq(fdb->ageing_timer, __nat25_timeout(priv)))
+		return 1;
+
+	return 0;
+}
+
+
+static __inline__ void __nat25_generate_ipv4_network_addr(unsigned char *networkAddr,
+				unsigned int *ipAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPV4;
+	memcpy(networkAddr+7, (unsigned char *)ipAddr, 4);
+}
+
+
+static __inline__ void __nat25_generate_ipx_network_addr_with_node(unsigned char *networkAddr,
+				unsigned int *ipxNetAddr, unsigned char *ipxNodeAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPX;
+	memcpy(networkAddr+1, (unsigned char *)ipxNetAddr, 4);
+	memcpy(networkAddr+5, ipxNodeAddr, 6);
+}
+
+
+static __inline__ void __nat25_generate_ipx_network_addr_with_socket(unsigned char *networkAddr,
+				unsigned int *ipxNetAddr, unsigned short *ipxSocketAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPX;
+	memcpy(networkAddr+1, (unsigned char *)ipxNetAddr, 4);
+	memcpy(networkAddr+5, (unsigned char *)ipxSocketAddr, 2);
+}
+
+
+static __inline__ void __nat25_generate_apple_network_addr(unsigned char *networkAddr,
+				unsigned short *network, unsigned char *node)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_APPLE;
+	memcpy(networkAddr+1, (unsigned char *)network, 2);
+	networkAddr[3] = *node;
+}
+
+
+static __inline__ void __nat25_generate_pppoe_network_addr(unsigned char *networkAddr,
+				unsigned char *ac_mac, unsigned short *sid)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_PPPOE;
+	memcpy(networkAddr+1, (unsigned char *)sid, 2);
+	memcpy(networkAddr+3, (unsigned char *)ac_mac, 6);
+}
+
+
+#ifdef CL_IPV6_PASS
+static  void __nat25_generate_ipv6_network_addr(unsigned char *networkAddr,
+				unsigned int *ipAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPV6;
+	memcpy(networkAddr+1, (unsigned char *)ipAddr, 16);
+}
+
+
+static unsigned char *scan_tlv(unsigned char *data, int len, unsigned char tag, unsigned char len8b)
+{
+	while (len > 0) {
+		if (*data == tag && *(data+1) == len8b && len >= len8b*8)
+			return data+2;	
+		
+		len -= (*(data+1))*8;		
+		data += (*(data+1))*8;		
+	}
+	return NULL;
+}
+
+
+static int update_nd_link_layer_addr(unsigned char *data, int len, unsigned char *replace_mac)
+{
+	struct icmp6hdr *icmphdr = (struct icmp6hdr *)data;
+	unsigned char *mac;
+	
+	if (icmphdr->icmp6_type == NDISC_ROUTER_SOLICITATION) { 
+		if (len >= 8) {
+			mac = scan_tlv(&data[8], len-8, 1, 1);
+			if (mac) {
+				_DEBUG_INFO("Router Solicitation, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],					
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);	
+				return 1;				
+			}
+		}
+	}
+	else if (icmphdr->icmp6_type == NDISC_ROUTER_ADVERTISEMENT) {
+		if (len >= 16) {
+			mac = scan_tlv(&data[16], len-16, 1, 1);
+			if (mac) {
+				_DEBUG_INFO("Router Advertisement, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],					
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);			
+				return 1;				
+			}
+		}		
+	}
+	else if (icmphdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) {
+		if (len >= 24) {
+			mac = scan_tlv(&data[24], len-24, 1, 1);
+			if (mac) {		
+				_DEBUG_INFO("Neighbor Solicitation, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],					
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);	
+				return 1;								
+			}
+		}		
+	}
+	else if (icmphdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) {
+		if (len >= 24) {
+			mac = scan_tlv(&data[24], len-24, 2, 1);
+			if (mac) {
+				_DEBUG_INFO("Neighbor Advertisement, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],					
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);		
+				return 1;				
+			}
+		}		
+	}
+	else if (icmphdr->icmp6_type == NDISC_REDIRECT) {
+		if (len >= 40) {
+			mac = scan_tlv(&data[40], len-40, 2, 1);
+			if (mac) {				
+				_DEBUG_INFO("Redirect,  replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],					
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);	
+				return 1;				
+			}
+		}		
+	}	
+	return 0;
+}
+
+
+static void convert_ipv6_mac_to_mc(struct sk_buff *skb)
+{	
+	struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+	unsigned char *dst_mac = skb->data;
+
+	//dst_mac[0] = 0xff;
+	//dst_mac[1] = 0xff;
+	/*modified by qinjunjie,ipv6 multicast address ix 0x33-33-xx-xx-xx-xx*/
+	dst_mac[0] = 0x33;
+	dst_mac[1] = 0x33;
+	memcpy(&dst_mac[2], &iph->daddr.s6_addr32[3], 4);
+	#if defined(__LINUX_2_6__) 
+	/*modified by qinjunjie,warning:should not remove next line*/
+	skb->pkt_type = PACKET_MULTICAST;
+	#endif
+}
+#endif /* CL_IPV6_PASS */
+
+
+static __inline__ int __nat25_network_hash(unsigned char *networkAddr)
+{
+	if(networkAddr[0] == NAT25_IPV4)
+	{
+		unsigned long x;
+
+		x = networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+	else if(networkAddr[0] == NAT25_IPX)
+	{
+		unsigned long x;
+
+		x = networkAddr[1] ^ networkAddr[2] ^ networkAddr[3] ^ networkAddr[4] ^ networkAddr[5] ^
+			networkAddr[6] ^ networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+	else if(networkAddr[0] == NAT25_APPLE)
+	{
+		unsigned long x;
+
+		x = networkAddr[1] ^ networkAddr[2] ^ networkAddr[3];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+	else if(networkAddr[0] == NAT25_PPPOE)
+	{
+		unsigned long x;
+
+		x = networkAddr[0] ^ networkAddr[1] ^ networkAddr[2] ^ networkAddr[3] ^ networkAddr[4] ^ networkAddr[5] ^ networkAddr[6] ^ networkAddr[7] ^ networkAddr[8];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+#ifdef CL_IPV6_PASS
+	else if(networkAddr[0] == NAT25_IPV6)
+	{
+		unsigned long x;
+
+		x = networkAddr[1] ^ networkAddr[2] ^ networkAddr[3] ^ networkAddr[4] ^ networkAddr[5] ^
+			networkAddr[6] ^ networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10] ^
+			networkAddr[11] ^ networkAddr[12] ^ networkAddr[13] ^ networkAddr[14] ^ networkAddr[15] ^
+			networkAddr[16];
+	
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+#endif	
+	else
+	{
+		unsigned long x = 0;
+		int i;
+
+		for (i=0; i<MAX_NETWORK_ADDR_LEN; i++)
+			x ^= networkAddr[i];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+}
+
+
+static __inline__ void __network_hash_link(_adapter *priv,
+				struct nat25_network_db_entry *ent, int hash)
+{
+	// Caller must _enter_critical_bh already!
+	//_irqL irqL;
+	//_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	ent->next_hash = priv->nethash[hash];
+	if(ent->next_hash != NULL)
+		ent->next_hash->pprev_hash = &ent->next_hash;
+	priv->nethash[hash] = ent;
+	ent->pprev_hash = &priv->nethash[hash];
+
+	//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+static __inline__ void __network_hash_unlink(struct nat25_network_db_entry *ent)
+{
+	// Caller must _enter_critical_bh already!
+	//_irqL irqL;
+	//_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	*(ent->pprev_hash) = ent->next_hash;
+	if(ent->next_hash != NULL)
+		ent->next_hash->pprev_hash = ent->pprev_hash;
+	ent->next_hash = NULL;
+	ent->pprev_hash = NULL;
+
+	//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+static int __nat25_db_network_lookup_and_replace(_adapter *priv,
+				struct sk_buff *skb, unsigned char *networkAddr)
+{
+	struct nat25_network_db_entry *db;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	db = priv->nethash[__nat25_network_hash(networkAddr)];
+	while (db != NULL)
+	{
+		if(!memcmp(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN))
+		{
+			if(!__nat25_has_expired(priv, db))
+			{
+				// replace the destination mac address
+				memcpy(skb->data, db->macAddr, ETH_ALEN);
+				atomic_inc(&db->use_count);
+
+#ifdef CL_IPV6_PASS
+				DEBUG_INFO("NAT25: Lookup M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"	
+							"%02x%02x%02x%02x%02x%02x\n",				
+					db->macAddr[0],
+					db->macAddr[1],
+					db->macAddr[2],
+					db->macAddr[3],
+					db->macAddr[4],
+					db->macAddr[5],
+					db->networkAddr[0],
+					db->networkAddr[1],
+					db->networkAddr[2],
+					db->networkAddr[3],
+					db->networkAddr[4],
+					db->networkAddr[5],
+					db->networkAddr[6],
+					db->networkAddr[7],
+					db->networkAddr[8],
+					db->networkAddr[9],
+					db->networkAddr[10],
+					db->networkAddr[11],
+					db->networkAddr[12],
+					db->networkAddr[13],
+					db->networkAddr[14],
+					db->networkAddr[15],
+					db->networkAddr[16]);
+#else				
+				DEBUG_INFO("NAT25: Lookup M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+					db->macAddr[0],
+					db->macAddr[1],
+					db->macAddr[2],
+					db->macAddr[3],
+					db->macAddr[4],
+					db->macAddr[5],
+					db->networkAddr[0],
+					db->networkAddr[1],
+					db->networkAddr[2],
+					db->networkAddr[3],
+					db->networkAddr[4],
+					db->networkAddr[5],
+					db->networkAddr[6],
+					db->networkAddr[7],
+					db->networkAddr[8],
+					db->networkAddr[9],
+					db->networkAddr[10]);
+#endif
+			}
+			_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			return 1;
+		}
+
+		db = db->next_hash;
+	}
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+	return 0;
+}
+
+
+static void __nat25_db_network_insert(_adapter *priv,
+				unsigned char *macAddr, unsigned char *networkAddr)
+{
+	struct nat25_network_db_entry *db;
+	int hash;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	hash = __nat25_network_hash(networkAddr);
+	db = priv->nethash[hash];
+	while (db != NULL)
+	{
+		if(!memcmp(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN))
+		{
+			memcpy(db->macAddr, macAddr, ETH_ALEN);
+			db->ageing_timer = jiffies;
+			_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			return;
+		}
+
+		db = db->next_hash;
+	}
+
+	db = (struct nat25_network_db_entry *) rtw_malloc(sizeof(*db));
+	if(db == NULL) {
+		_exit_critical_bh(&priv->br_ext_lock, &irqL);
+		return;
+	}
+
+	memcpy(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN);
+	memcpy(db->macAddr, macAddr, ETH_ALEN);
+	atomic_set(&db->use_count, 1);
+	db->ageing_timer = jiffies;
+
+	__network_hash_link(priv, db, hash);
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+static void __nat25_db_print(_adapter *priv)
+{
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+#ifdef BR_EXT_DEBUG
+	static int counter = 0;
+	int i, j;
+	struct nat25_network_db_entry *db;
+
+	counter++;
+	if((counter % 16) != 0)
+		return;
+
+	for(i=0, j=0; i<NAT25_HASH_SIZE; i++)
+	{
+		db = priv->nethash[i];
+
+		while (db != NULL)
+		{
+#ifdef CL_IPV6_PASS
+			panic_printk("NAT25: DB(%d) H(%02d) C(%d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+					"%02x%02x%02x%02x%02x%02x\n",
+				j,
+				i,
+				atomic_read(&db->use_count),
+				db->macAddr[0],
+				db->macAddr[1],
+				db->macAddr[2],
+				db->macAddr[3],
+				db->macAddr[4],
+				db->macAddr[5],
+				db->networkAddr[0],
+				db->networkAddr[1],
+				db->networkAddr[2],
+				db->networkAddr[3],
+				db->networkAddr[4],
+				db->networkAddr[5],
+				db->networkAddr[6],
+				db->networkAddr[7],
+				db->networkAddr[8],
+				db->networkAddr[9],
+				db->networkAddr[10],
+				db->networkAddr[11],
+				db->networkAddr[12],
+				db->networkAddr[13],
+				db->networkAddr[14],
+				db->networkAddr[15],
+				db->networkAddr[16]);
+#else
+			panic_printk("NAT25: DB(%d) H(%02d) C(%d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+				j,
+				i,
+				atomic_read(&db->use_count),
+				db->macAddr[0],
+				db->macAddr[1],
+				db->macAddr[2],
+				db->macAddr[3],
+				db->macAddr[4],
+				db->macAddr[5],
+				db->networkAddr[0],
+				db->networkAddr[1],
+				db->networkAddr[2],
+				db->networkAddr[3],
+				db->networkAddr[4],
+				db->networkAddr[5],
+				db->networkAddr[6],
+				db->networkAddr[7],
+				db->networkAddr[8],
+				db->networkAddr[9],
+				db->networkAddr[10]);
+#endif
+			j++;
+
+			db = db->next_hash;
+		}
+	}
+#endif
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+
+
+/*
+ *	NAT2.5 interface
+ */
+
+void nat25_db_cleanup(_adapter *priv)
+{
+	int i;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+	
+	for(i=0; i<NAT25_HASH_SIZE; i++)
+	{
+		struct nat25_network_db_entry *f;
+		f = priv->nethash[i];
+		while (f != NULL) {
+			struct nat25_network_db_entry *g;
+
+			g = f->next_hash;
+			if(priv->scdb_entry == f)
+			{
+				memset(priv->scdb_mac, 0, ETH_ALEN);
+				memset(priv->scdb_ip, 0, 4);
+				priv->scdb_entry = NULL;
+			}
+			__network_hash_unlink(f);
+			rtw_mfree((u8 *) f, sizeof(struct nat25_network_db_entry));
+
+			f = g;
+		}
+	}
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+void nat25_db_expire(_adapter *priv)
+{
+	int i;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+	
+	//if(!priv->ethBrExtInfo.nat25_disable)
+	{
+		for (i=0; i<NAT25_HASH_SIZE; i++)
+		{
+			struct nat25_network_db_entry *f;
+			f = priv->nethash[i];
+
+			while (f != NULL)
+			{
+				struct nat25_network_db_entry *g;
+				g = f->next_hash;
+
+				if(__nat25_has_expired(priv, f))
+				{
+					if(atomic_dec_and_test(&f->use_count))
+					{
+#ifdef BR_EXT_DEBUG
+#ifdef CL_IPV6_PASS
+						panic_printk("NAT25 Expire H(%02d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+								"%02x%02x%02x%02x%02x%02x\n",
+							i,
+							f->macAddr[0],
+							f->macAddr[1],
+							f->macAddr[2],
+							f->macAddr[3],
+							f->macAddr[4],
+							f->macAddr[5],
+							f->networkAddr[0],
+							f->networkAddr[1],
+							f->networkAddr[2],
+							f->networkAddr[3],
+							f->networkAddr[4],
+							f->networkAddr[5],
+							f->networkAddr[6],
+							f->networkAddr[7],
+							f->networkAddr[8],
+							f->networkAddr[9],
+							f->networkAddr[10],
+							f->networkAddr[11],
+							f->networkAddr[12],
+							f->networkAddr[13],
+							f->networkAddr[14],
+							f->networkAddr[15],
+							f->networkAddr[16]);
+#else
+
+						panic_printk("NAT25 Expire H(%02d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+							i,
+							f->macAddr[0],
+							f->macAddr[1],
+							f->macAddr[2],
+							f->macAddr[3],
+							f->macAddr[4],
+							f->macAddr[5],
+							f->networkAddr[0],
+							f->networkAddr[1],
+							f->networkAddr[2],
+							f->networkAddr[3],
+							f->networkAddr[4],
+							f->networkAddr[5],
+							f->networkAddr[6],
+							f->networkAddr[7],
+							f->networkAddr[8],
+							f->networkAddr[9],
+							f->networkAddr[10]);
+#endif
+#endif
+						if(priv->scdb_entry == f)
+						{
+							memset(priv->scdb_mac, 0, ETH_ALEN);
+							memset(priv->scdb_ip, 0, 4);
+							priv->scdb_entry = NULL;
+						}
+						__network_hash_unlink(f);
+						rtw_mfree((u8 *) f, sizeof(struct nat25_network_db_entry));
+					}
+				}
+
+				f = g;
+			}
+		}
+	}
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+#ifdef SUPPORT_TX_MCAST2UNI
+static int checkIPMcAndReplace(_adapter *priv, struct sk_buff *skb, unsigned int *dst_ip)
+{
+	struct stat_info	*pstat;
+	struct list_head	*phead, *plist;
+	int i;
+
+	phead = &priv->asoc_list;
+	plist = phead->next;
+
+	while (plist != phead) {
+		pstat = list_entry(plist, struct stat_info, asoc_list);
+		plist = plist->next;
+
+		if (pstat->ipmc_num == 0)
+			continue;
+
+		for (i=0; i<MAX_IP_MC_ENTRY; i++) {
+			if (pstat->ipmc[i].used && !memcmp(&pstat->ipmc[i].mcmac[3], ((unsigned char *)dst_ip)+1, 3)) {
+				memcpy(skb->data, pstat->ipmc[i].mcmac, ETH_ALEN);
+				return 1;
+			}
+		}
+	}
+	return 0;
+}
+#endif
+
+int nat25_db_handle(_adapter *priv, struct sk_buff *skb, int method)
+{
+	unsigned short protocol;
+	unsigned char networkAddr[MAX_NETWORK_ADDR_LEN];
+
+	if(skb == NULL)
+		return -1;
+
+	if((method <= NAT25_MIN) || (method >= NAT25_MAX))
+		return -1;
+
+	protocol = *((unsigned short *)(skb->data + 2 * ETH_ALEN));
+
+	/*---------------------------------------------------*/
+	/*                 Handle IP frame                   */
+	/*---------------------------------------------------*/
+	if(protocol == __constant_htons(ETH_P_IP))
+	{
+		struct iphdr* iph = (struct iphdr *)(skb->data + ETH_HLEN);
+
+		if(((unsigned char*)(iph) + (iph->ihl<<2)) >= (skb->data + ETH_HLEN + skb->len))
+		{
+			DEBUG_WARN("NAT25: malformed IP packet !\n");
+			return -1;
+		}
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return -1;
+
+			case NAT25_INSERT:
+				{
+					//some muticast with source IP is all zero, maybe other case is illegal
+					//in class A, B, C, host address is all zero or all one is illegal
+					if (iph->saddr == 0)
+						return 0;
+					DEBUG_INFO("NAT25: Insert IP, SA=%08x, DA=%08x\n", iph->saddr, iph->daddr);
+					__nat25_generate_ipv4_network_addr(networkAddr, &iph->saddr);
+					//record source IP address and , source mac address into db
+					__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+					__nat25_db_print(priv);
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				{
+					DEBUG_INFO("NAT25: Lookup IP, SA=%08x, DA=%08x\n", iph->saddr, iph->daddr);
+#ifdef SUPPORT_TX_MCAST2UNI
+					if (priv->pshare->rf_ft_var.mc2u_disable ||
+							((((OPMODE & (WIFI_STATION_STATE|WIFI_ASOC_STATE))
+							== (WIFI_STATION_STATE|WIFI_ASOC_STATE)) &&
+							!checkIPMcAndReplace(priv, skb, &iph->daddr)) ||
+							(OPMODE & WIFI_ADHOC_STATE)))
+#endif
+					{
+						__nat25_generate_ipv4_network_addr(networkAddr, &iph->daddr);
+
+						if (!__nat25_db_network_lookup_and_replace(priv, skb, networkAddr)) {
+							if (*((unsigned char *)&iph->daddr + 3) == 0xff) {
+								// L2 is unicast but L3 is broadcast, make L2 bacome broadcast
+								DEBUG_INFO("NAT25: Set DA as boardcast\n");
+								memset(skb->data, 0xff, ETH_ALEN);
+							}
+							else {
+								// forward unknow IP packet to upper TCP/IP
+								DEBUG_INFO("NAT25: Replace DA with BR's MAC\n");
+								if ( (*(u32 *)priv->br_mac) == 0 && (*(u16 *)(priv->br_mac+4)) == 0 ) {
+									void netdev_br_init(struct net_device *netdev);
+									printk("Re-init netdev_br_init() due to br_mac==0!\n");
+									netdev_br_init(priv->pnetdev);
+								}
+								memcpy(skb->data, priv->br_mac, ETH_ALEN);
+							}
+						}
+					}
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*                 Handle ARP frame                  */
+	/*---------------------------------------------------*/
+	else if(protocol == __constant_htons(ETH_P_ARP))
+	{
+		struct arphdr *arp = (struct arphdr *)(skb->data + ETH_HLEN);
+		unsigned char *arp_ptr = (unsigned char *)(arp + 1);
+		unsigned int *sender, *target;
+
+		if(arp->ar_pro != __constant_htons(ETH_P_IP))
+		{
+			DEBUG_WARN("NAT25: arp protocol unknown (%4x)!\n", htons(arp->ar_pro));
+			return -1;
+		}
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return 0;	// skb_copy for all ARP frame
+
+			case NAT25_INSERT:
+				{
+					DEBUG_INFO("NAT25: Insert ARP, MAC=%02x%02x%02x%02x%02x%02x\n", arp_ptr[0],
+						arp_ptr[1], arp_ptr[2], arp_ptr[3], arp_ptr[4], arp_ptr[5]);
+
+					// change to ARP sender mac address to wlan STA address
+                                        memcpy(arp_ptr, GET_MY_HWADDR(priv), ETH_ALEN);
+
+					arp_ptr += arp->ar_hln;
+					sender = (unsigned int *)arp_ptr;
+
+					__nat25_generate_ipv4_network_addr(networkAddr, sender);
+
+					__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+					__nat25_db_print(priv);
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				{
+					DEBUG_INFO("NAT25: Lookup ARP\n");
+
+					arp_ptr += arp->ar_hln;
+					sender = (unsigned int *)arp_ptr;
+					arp_ptr += (arp->ar_hln + arp->ar_pln);
+					target = (unsigned int *)arp_ptr;
+
+					__nat25_generate_ipv4_network_addr(networkAddr, target);
+
+					__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+					// change to ARP target mac address to Lookup result
+					arp_ptr = (unsigned char *)(arp + 1);
+					arp_ptr += (arp->ar_hln + arp->ar_pln);
+					memcpy(arp_ptr, skb->data, ETH_ALEN);
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*         Handle IPX and Apple Talk frame           */
+	/*---------------------------------------------------*/
+	else if((protocol == __constant_htons(ETH_P_IPX)) ||
+		(protocol <= __constant_htons(ETH_FRAME_LEN)))
+	{
+		unsigned char ipx_header[2] = {0xFF, 0xFF};
+		struct ipxhdr	*ipx = NULL;
+		struct elapaarp	*ea = NULL;
+		struct ddpehdr	*ddp = NULL;
+		unsigned char *framePtr = skb->data + ETH_HLEN;
+
+		if(protocol == __constant_htons(ETH_P_IPX))
+		{
+			DEBUG_INFO("NAT25: Protocol=IPX (Ethernet II)\n");
+			ipx = (struct ipxhdr *)framePtr;
+		}
+		else if(protocol <= __constant_htons(ETH_FRAME_LEN))
+		{
+			if(!memcmp(ipx_header, framePtr, 2))
+			{
+				DEBUG_INFO("NAT25: Protocol=IPX (Ethernet 802.3)\n");
+				ipx = (struct ipxhdr *)framePtr;
+			}
+			else
+			{
+				unsigned char ipx_8022_type =  0xE0;
+				unsigned char snap_8022_type = 0xAA;
+
+				if(*framePtr == snap_8022_type)
+				{
+					unsigned char ipx_snap_id[5] = {0x0, 0x0, 0x0, 0x81, 0x37};		// IPX SNAP ID
+					unsigned char aarp_snap_id[5] = {0x00, 0x00, 0x00, 0x80, 0xF3};	// Apple Talk AARP SNAP ID
+					unsigned char ddp_snap_id[5] = {0x08, 0x00, 0x07, 0x80, 0x9B};	// Apple Talk DDP SNAP ID
+
+					framePtr += 3;	// eliminate the 802.2 header
+
+					if(!memcmp(ipx_snap_id, framePtr, 5))
+					{
+						framePtr += 5;	// eliminate the SNAP header
+
+						DEBUG_INFO("NAT25: Protocol=IPX (Ethernet SNAP)\n");
+						ipx = (struct ipxhdr *)framePtr;
+					}
+					else if(!memcmp(aarp_snap_id, framePtr, 5))
+					{
+						framePtr += 5;	// eliminate the SNAP header
+
+						ea = (struct elapaarp *)framePtr;
+					}
+					else if(!memcmp(ddp_snap_id, framePtr, 5))
+					{
+						framePtr += 5;	// eliminate the SNAP header
+
+						ddp = (struct ddpehdr *)framePtr;
+					}
+					else
+					{
+						DEBUG_WARN("NAT25: Protocol=Ethernet SNAP %02x%02x%02x%02x%02x\n", framePtr[0],
+							framePtr[1], framePtr[2], framePtr[3], framePtr[4]);
+						return -1;
+					}
+				}
+				else if(*framePtr == ipx_8022_type)
+				{
+					framePtr += 3;	// eliminate the 802.2 header
+
+					if(!memcmp(ipx_header, framePtr, 2))
+					{
+						DEBUG_INFO("NAT25: Protocol=IPX (Ethernet 802.2)\n");
+						ipx = (struct ipxhdr *)framePtr;
+					}
+					else
+						return -1;
+				}
+				else
+					return -1;
+			}
+		}
+		else
+			return -1;
+
+		/*   IPX   */
+		if(ipx != NULL)
+		{
+			switch(method)
+			{
+				case NAT25_CHECK:
+					if(!memcmp(skb->data+ETH_ALEN, ipx->ipx_source.node, ETH_ALEN))
+					{
+						DEBUG_INFO("NAT25: Check IPX skb_copy\n");
+						return 0;
+					}
+					return -1;
+
+				case NAT25_INSERT:
+					{
+						DEBUG_INFO("NAT25: Insert IPX, Dest=%08x,%02x%02x%02x%02x%02x%02x,%04x Source=%08x,%02x%02x%02x%02x%02x%02x,%04x\n",
+							ipx->ipx_dest.net,
+							ipx->ipx_dest.node[0],
+							ipx->ipx_dest.node[1],
+							ipx->ipx_dest.node[2],
+							ipx->ipx_dest.node[3],
+							ipx->ipx_dest.node[4],
+							ipx->ipx_dest.node[5],
+							ipx->ipx_dest.sock,
+							ipx->ipx_source.net,
+							ipx->ipx_source.node[0],
+							ipx->ipx_source.node[1],
+							ipx->ipx_source.node[2],
+							ipx->ipx_source.node[3],
+							ipx->ipx_source.node[4],
+							ipx->ipx_source.node[5],
+							ipx->ipx_source.sock);
+
+						if(!memcmp(skb->data+ETH_ALEN, ipx->ipx_source.node, ETH_ALEN))
+						{
+							DEBUG_INFO("NAT25: Use IPX Net, and Socket as network addr\n");
+
+							__nat25_generate_ipx_network_addr_with_socket(networkAddr, &ipx->ipx_source.net, &ipx->ipx_source.sock);
+
+							// change IPX source node addr to wlan STA address
+                                                        memcpy(ipx->ipx_source.node, GET_MY_HWADDR(priv), ETH_ALEN);
+						}
+						else
+						{
+							__nat25_generate_ipx_network_addr_with_node(networkAddr, &ipx->ipx_source.net, ipx->ipx_source.node);
+						}
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					return 0;
+
+				case NAT25_LOOKUP:
+					{
+                                                if(!memcmp(GET_MY_HWADDR(priv), ipx->ipx_dest.node, ETH_ALEN))
+						{
+							DEBUG_INFO("NAT25: Lookup IPX, Modify Destination IPX Node addr\n");
+
+							__nat25_generate_ipx_network_addr_with_socket(networkAddr, &ipx->ipx_dest.net, &ipx->ipx_dest.sock);
+
+							__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+							// replace IPX destination node addr with Lookup destination MAC addr
+							memcpy(ipx->ipx_dest.node, skb->data, ETH_ALEN);
+						}
+						else
+						{
+							__nat25_generate_ipx_network_addr_with_node(networkAddr, &ipx->ipx_dest.net, ipx->ipx_dest.node);
+
+							__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+						}
+					}
+					return 0;
+
+				default:
+					return -1;
+			}
+		}
+
+		/*   AARP   */
+		else if(ea != NULL)
+		{
+			/* Sanity check fields. */
+			if(ea->hw_len != ETH_ALEN || ea->pa_len != AARP_PA_ALEN)
+			{
+				DEBUG_WARN("NAT25: Appletalk AARP Sanity check fail!\n");
+				return -1;
+			}
+
+			switch(method)
+			{
+				case NAT25_CHECK:
+					return 0;
+
+				case NAT25_INSERT:
+					{
+						// change to AARP source mac address to wlan STA address
+                                                memcpy(ea->hw_src, GET_MY_HWADDR(priv), ETH_ALEN);
+
+						DEBUG_INFO("NAT25: Insert AARP, Source=%d,%d Destination=%d,%d\n",
+							ea->pa_src_net,
+							ea->pa_src_node,
+							ea->pa_dst_net,
+							ea->pa_dst_node);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ea->pa_src_net, &ea->pa_src_node);
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					return 0;
+
+				case NAT25_LOOKUP:
+					{
+						DEBUG_INFO("NAT25: Lookup AARP, Source=%d,%d Destination=%d,%d\n",
+							ea->pa_src_net,
+							ea->pa_src_node,
+							ea->pa_dst_net,
+							ea->pa_dst_node);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ea->pa_dst_net, &ea->pa_dst_node);
+
+						__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+						// change to AARP destination mac address to Lookup result
+						memcpy(ea->hw_dst, skb->data, ETH_ALEN);
+					}
+					return 0;
+
+				default:
+					return -1;
+			}
+		}
+
+		/*   DDP   */
+		else if(ddp != NULL)
+		{
+			switch(method)
+			{
+				case NAT25_CHECK:
+					return -1;
+
+				case NAT25_INSERT:
+					{
+						DEBUG_INFO("NAT25: Insert DDP, Source=%d,%d Destination=%d,%d\n",
+							ddp->deh_snet,
+							ddp->deh_snode,
+							ddp->deh_dnet,
+							ddp->deh_dnode);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ddp->deh_snet, &ddp->deh_snode);
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					return 0;
+
+				case NAT25_LOOKUP:
+					{
+						DEBUG_INFO("NAT25: Lookup DDP, Source=%d,%d Destination=%d,%d\n",
+							ddp->deh_snet,
+							ddp->deh_snode,
+							ddp->deh_dnet,
+							ddp->deh_dnode);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ddp->deh_dnet, &ddp->deh_dnode);
+
+						__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+					}
+					return 0;
+
+				default:
+					return -1;
+			}
+		}
+
+		return -1;
+	}
+
+	/*---------------------------------------------------*/
+	/*                Handle PPPoE frame                 */
+	/*---------------------------------------------------*/
+	else if((protocol == __constant_htons(ETH_P_PPP_DISC)) ||
+		(protocol == __constant_htons(ETH_P_PPP_SES)))
+	{
+		struct pppoe_hdr *ph = (struct pppoe_hdr *)(skb->data + ETH_HLEN);
+		unsigned short *pMagic;
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				if (ph->sid == 0)
+					return 0;
+				return 1;
+
+			case NAT25_INSERT:
+				if(ph->sid == 0)	// Discovery phase according to tag
+				{
+					if(ph->code == PADI_CODE || ph->code == PADR_CODE)
+					{
+						if (priv->ethBrExtInfo.addPPPoETag) {
+							struct pppoe_tag *tag, *pOldTag;
+							unsigned char tag_buf[40];
+							int old_tag_len=0;
+
+							tag = (struct pppoe_tag *)tag_buf;
+							pOldTag = (struct pppoe_tag *)__nat25_find_pppoe_tag(ph, ntohs(PTT_RELAY_SID));
+							if (pOldTag) { // if SID existed, copy old value and delete it
+								old_tag_len = ntohs(pOldTag->tag_len);
+								if (old_tag_len+TAG_HDR_LEN+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN > sizeof(tag_buf)) {
+									DEBUG_ERR("SID tag length too long!\n");
+									return -1;
+								}
+
+								memcpy(tag->tag_data+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN,
+									pOldTag->tag_data, old_tag_len);
+
+								if (skb_pull_and_merge(skb, (unsigned char *)pOldTag, TAG_HDR_LEN+old_tag_len) < 0) {
+									DEBUG_ERR("call skb_pull_and_merge() failed in PADI/R packet!\n");
+									return -1;
+								}
+								ph->length = htons(ntohs(ph->length)-TAG_HDR_LEN-old_tag_len);
+							}
+
+							tag->tag_type = PTT_RELAY_SID;
+							tag->tag_len = htons(MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN+old_tag_len);
+
+							// insert the magic_code+client mac in relay tag
+							pMagic = (unsigned short *)tag->tag_data;
+							*pMagic = htons(MAGIC_CODE);
+							memcpy(tag->tag_data+MAGIC_CODE_LEN, skb->data+ETH_ALEN, ETH_ALEN);
+
+							//Add relay tag
+							if(__nat25_add_pppoe_tag(skb, tag) < 0)
+								return -1;
+
+							DEBUG_INFO("NAT25: Insert PPPoE, forward %s packet\n",
+											(ph->code == PADI_CODE ? "PADI" : "PADR"));
+						}
+						else { // not add relay tag
+							if (priv->pppoe_connection_in_progress &&
+									memcmp(skb->data+ETH_ALEN, priv->pppoe_addr, ETH_ALEN))	 {
+								DEBUG_ERR("Discard PPPoE packet due to another PPPoE connection is in progress!\n");
+								return -2;
+							}
+
+							if (priv->pppoe_connection_in_progress == 0)
+								memcpy(priv->pppoe_addr, skb->data+ETH_ALEN, ETH_ALEN);
+
+							priv->pppoe_connection_in_progress = WAIT_TIME_PPPOE;
+						}
+					}
+					else
+						return -1;
+				}
+				else	// session phase
+				{
+						DEBUG_INFO("NAT25: Insert PPPoE, insert session packet to %s\n", skb->dev->name);
+
+						__nat25_generate_pppoe_network_addr(networkAddr, skb->data, &(ph->sid));
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+
+						if (!priv->ethBrExtInfo.addPPPoETag &&
+								priv->pppoe_connection_in_progress &&
+									!memcmp(skb->data+ETH_ALEN, priv->pppoe_addr, ETH_ALEN))
+							priv->pppoe_connection_in_progress = 0;
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				if(ph->code == PADO_CODE || ph->code == PADS_CODE)
+				{
+					if (priv->ethBrExtInfo.addPPPoETag) {
+						struct pppoe_tag *tag;
+						unsigned char *ptr;
+						unsigned short tagType, tagLen;
+						int offset=0;
+
+						if((ptr = __nat25_find_pppoe_tag(ph, ntohs(PTT_RELAY_SID))) == 0) {
+							DEBUG_ERR("Fail to find PTT_RELAY_SID in FADO!\n");
+							return -1;
+						}
+
+						tag = (struct pppoe_tag *)ptr;
+						tagType = (unsigned short)((ptr[0] << 8) + ptr[1]);
+						tagLen = (unsigned short)((ptr[2] << 8) + ptr[3]);
+
+						if((tagType != ntohs(PTT_RELAY_SID)) || (tagLen < (MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN))) {
+							DEBUG_ERR("Invalid PTT_RELAY_SID tag length [%d]!\n", tagLen);
+							return -1;
+						}
+
+						pMagic = (unsigned short *)tag->tag_data;
+						if (ntohs(*pMagic) != MAGIC_CODE) {
+							DEBUG_ERR("Can't find MAGIC_CODE in %s packet!\n",
+								(ph->code == PADO_CODE ? "PADO" : "PADS"));
+							return -1;
+						}
+
+						memcpy(skb->data, tag->tag_data+MAGIC_CODE_LEN, ETH_ALEN);
+
+						if (tagLen > MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN)
+							offset = TAG_HDR_LEN;
+
+						if (skb_pull_and_merge(skb, ptr+offset, TAG_HDR_LEN+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN-offset) < 0) {
+							DEBUG_ERR("call skb_pull_and_merge() failed in PADO packet!\n");
+							return -1;
+						}
+						ph->length = htons(ntohs(ph->length)-(TAG_HDR_LEN+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN-offset));
+						if (offset > 0)
+							tag->tag_len = htons(tagLen-MAGIC_CODE_LEN-RTL_RELAY_TAG_LEN);
+
+						DEBUG_INFO("NAT25: Lookup PPPoE, forward %s Packet from %s\n",
+							(ph->code == PADO_CODE ? "PADO" : "PADS"),	skb->dev->name);
+					}
+					else { // not add relay tag
+						if (!priv->pppoe_connection_in_progress) {
+							DEBUG_ERR("Discard PPPoE packet due to no connection in progresss!\n");
+							return -1;
+						}
+						memcpy(skb->data, priv->pppoe_addr, ETH_ALEN);
+						priv->pppoe_connection_in_progress = WAIT_TIME_PPPOE;
+					}
+				}
+				else {
+					if(ph->sid != 0)
+					{
+						DEBUG_INFO("NAT25: Lookup PPPoE, lookup session packet from %s\n", skb->dev->name);
+						__nat25_generate_pppoe_network_addr(networkAddr, skb->data+ETH_ALEN, &(ph->sid));
+
+						__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					else
+						return -1;
+
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*                 Handle EAP frame                  */
+	/*---------------------------------------------------*/
+	else if(protocol == __constant_htons(0x888e))
+	{
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return -1;
+
+			case NAT25_INSERT:
+				return 0;
+
+			case NAT25_LOOKUP:
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*         Handle C-Media proprietary frame          */
+	/*---------------------------------------------------*/
+	else if((protocol == __constant_htons(0xe2ae)) ||
+		(protocol == __constant_htons(0xe2af)))
+	{
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return -1;
+
+			case NAT25_INSERT:
+				return 0;
+
+			case NAT25_LOOKUP:
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*         Handle IPV6 frame      							  */
+	/*---------------------------------------------------*/
+#ifdef CL_IPV6_PASS
+	else if(protocol == __constant_htons(ETH_P_IPV6))
+	{
+		struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+
+		if (sizeof(*iph) >= (skb->len - ETH_HLEN))
+		{
+			DEBUG_WARN("NAT25: malformed IPv6 packet !\n");
+			return -1;
+		}
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				if (skb->data[0] & 1)
+					return 0;				
+				return -1;
+
+			case NAT25_INSERT:
+				{
+					DEBUG_INFO("NAT25: Insert IP, SA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x,"
+									" DA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x\n", 
+						iph->saddr.s6_addr16[0],iph->saddr.s6_addr16[1],iph->saddr.s6_addr16[2],iph->saddr.s6_addr16[3],
+						iph->saddr.s6_addr16[4],iph->saddr.s6_addr16[5],iph->saddr.s6_addr16[6],iph->saddr.s6_addr16[7],
+						iph->daddr.s6_addr16[0],iph->daddr.s6_addr16[1],iph->daddr.s6_addr16[2],iph->daddr.s6_addr16[3],
+						iph->daddr.s6_addr16[4],iph->daddr.s6_addr16[5],iph->daddr.s6_addr16[6],iph->daddr.s6_addr16[7]);
+
+					if (memcmp(&iph->saddr, "\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0", 16)) {
+						__nat25_generate_ipv6_network_addr(networkAddr, (unsigned int *)&iph->saddr);
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+						__nat25_db_print(priv);
+
+						if (iph->nexthdr == IPPROTO_ICMPV6 && 
+								skb->len > (ETH_HLEN +  sizeof(*iph) + 4)) {
+							if (update_nd_link_layer_addr(skb->data + ETH_HLEN + sizeof(*iph), 
+                                                                skb->len - ETH_HLEN - sizeof(*iph), GET_MY_HWADDR(priv))) {                                                   
+								struct icmp6hdr  *hdr = (struct icmp6hdr *)(skb->data + ETH_HLEN + sizeof(*iph));
+								hdr->icmp6_cksum = 0;
+								hdr->icmp6_cksum = csum_ipv6_magic(&iph->saddr, &iph->daddr,
+												iph->payload_len,
+												IPPROTO_ICMPV6,
+												csum_partial((__u8 *)hdr, iph->payload_len, 0));
+							}
+						}						
+					}
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				DEBUG_INFO("NAT25: Lookup IP, SA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x,"
+								" DA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x\n", 
+						iph->saddr.s6_addr16[0],iph->saddr.s6_addr16[1],iph->saddr.s6_addr16[2],iph->saddr.s6_addr16[3],
+						iph->saddr.s6_addr16[4],iph->saddr.s6_addr16[5],iph->saddr.s6_addr16[6],iph->saddr.s6_addr16[7],
+						iph->daddr.s6_addr16[0],iph->daddr.s6_addr16[1],iph->daddr.s6_addr16[2],iph->daddr.s6_addr16[3],
+						iph->daddr.s6_addr16[4],iph->daddr.s6_addr16[5],iph->daddr.s6_addr16[6],iph->daddr.s6_addr16[7]);
+			
+
+				__nat25_generate_ipv6_network_addr(networkAddr, (unsigned int *)&iph->daddr);
+				if (!__nat25_db_network_lookup_and_replace(priv, skb, networkAddr)) {
+#ifdef SUPPORT_RX_UNI2MCAST							
+					if (iph->daddr.s6_addr[0] == 0xff)
+						convert_ipv6_mac_to_mc(skb);	
+#endif											
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+#endif	// CL_IPV6_PASS
+
+	return -1;
+}
+
+
+int nat25_handle_frame(_adapter *priv, struct sk_buff *skb)
+{
+#ifdef BR_EXT_DEBUG
+	if((!priv->ethBrExtInfo.nat25_disable) && (!(skb->data[0] & 1)))
+	{
+		panic_printk("NAT25: Input Frame: DA=%02x%02x%02x%02x%02x%02x SA=%02x%02x%02x%02x%02x%02x\n",
+			skb->data[0],
+			skb->data[1],
+			skb->data[2],
+			skb->data[3],
+			skb->data[4],
+			skb->data[5],
+			skb->data[6],
+			skb->data[7],
+			skb->data[8],
+			skb->data[9],
+			skb->data[10],
+			skb->data[11]);
+	}
+#endif
+
+	if(!(skb->data[0] & 1))
+	{
+		int is_vlan_tag=0, i, retval=0;
+		unsigned short vlan_hdr=0;
+
+		if (*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_8021Q)) {
+			is_vlan_tag = 1;
+			vlan_hdr = *((unsigned short *)(skb->data+ETH_ALEN*2+2));
+			for (i=0; i<6; i++)
+				*((unsigned short *)(skb->data+ETH_ALEN*2+2-i*2)) = *((unsigned short *)(skb->data+ETH_ALEN*2-2-i*2));
+			skb_pull(skb, 4);
+		}
+
+		if (!priv->ethBrExtInfo.nat25_disable)
+		{
+			_irqL irqL;
+			_enter_critical_bh(&priv->br_ext_lock, &irqL);
+			/*
+			 *	This function look up the destination network address from
+			 *	the NAT2.5 database. Return value = -1 means that the
+			 *	corresponding network protocol is NOT support.
+			 */
+			if (!priv->ethBrExtInfo.nat25sc_disable &&
+				(*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_IP)) &&
+				!memcmp(priv->scdb_ip, skb->data+ETH_HLEN+16, 4)) {
+				memcpy(skb->data, priv->scdb_mac, ETH_ALEN);
+				
+				_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			}
+			else {
+				_exit_critical_bh(&priv->br_ext_lock, &irqL);
+				
+				retval = nat25_db_handle(priv, skb, NAT25_LOOKUP);
+			}
+		}
+		else {
+			if (((*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_IP)) &&
+					!memcmp(priv->br_ip, skb->data+ETH_HLEN+16, 4)) ||
+				((*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_ARP)) &&
+					!memcmp(priv->br_ip, skb->data+ETH_HLEN+24, 4))) {
+				// for traffic to upper TCP/IP
+				retval = nat25_db_handle(priv, skb, NAT25_LOOKUP);
+			}
+		}
+
+		if (is_vlan_tag) {
+			skb_push(skb, 4);
+			for (i=0; i<6; i++)
+				*((unsigned short *)(skb->data+i*2)) = *((unsigned short *)(skb->data+4+i*2));
+			*((unsigned short *)(skb->data+ETH_ALEN*2)) = __constant_htons(ETH_P_8021Q);
+			*((unsigned short *)(skb->data+ETH_ALEN*2+2)) = vlan_hdr;
+		}
+
+		if(retval == -1) {
+			//DEBUG_ERR("NAT25: Lookup fail!\n");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+#if 0
+void mac_clone(_adapter *priv, unsigned char *addr)
+{
+	struct sockaddr sa;
+
+	memcpy(sa.sa_data, addr, ETH_ALEN);
+	DEBUG_INFO("MAC Clone: Addr=%02x%02x%02x%02x%02x%02x\n",
+		addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+	rtl8192cd_set_hwaddr(priv->dev, &sa);
+}
+
+
+int mac_clone_handle_frame(_adapter *priv, struct sk_buff *skb)
+{
+	if(priv->ethBrExtInfo.macclone_enable && !priv->macclone_completed)
+	{
+		if(!(skb->data[ETH_ALEN] & 1))	//// check any other particular MAC add
+		{
+                        if(memcmp(skb->data+ETH_ALEN, GET_MY_HWADDR(priv), ETH_ALEN) &&
+				((priv->dev->br_port) &&
+				 memcmp(skb->data+ETH_ALEN, priv->br_mac, ETH_ALEN)))
+			{
+				mac_clone(priv, skb->data+ETH_ALEN);
+				priv->macclone_completed = 1;
+			}
+		}
+	}
+
+	return 0;
+}
+#endif // 0
+
+#define SERVER_PORT			67
+#define CLIENT_PORT			68
+#define DHCP_MAGIC			0x63825363
+#define BROADCAST_FLAG		0x8000
+
+struct dhcpMessage {
+	u_int8_t op;
+	u_int8_t htype;
+	u_int8_t hlen;
+	u_int8_t hops;
+	u_int32_t xid;
+	u_int16_t secs;
+	u_int16_t flags;
+	u_int32_t ciaddr;
+	u_int32_t yiaddr;
+	u_int32_t siaddr;
+	u_int32_t giaddr;
+	u_int8_t chaddr[16];
+	u_int8_t sname[64];
+	u_int8_t file[128];
+	u_int32_t cookie;
+	u_int8_t options[308]; /* 312 - cookie */
+};
+
+void dhcp_flag_bcast(_adapter *priv, struct sk_buff *skb)
+{
+	if(skb == NULL)
+		return;
+
+	if(!priv->ethBrExtInfo.dhcp_bcst_disable)
+	{
+		unsigned short protocol = *((unsigned short *)(skb->data + 2 * ETH_ALEN));
+
+		if(protocol == __constant_htons(ETH_P_IP)) // IP
+		{
+			struct iphdr* iph = (struct iphdr *)(skb->data + ETH_HLEN);
+
+			if(iph->protocol == IPPROTO_UDP) // UDP
+			{
+				struct udphdr *udph = (struct udphdr *)((SIZE_PTR)iph + (iph->ihl << 2));
+
+				if((udph->source == __constant_htons(CLIENT_PORT))
+					&& (udph->dest == __constant_htons(SERVER_PORT))) // DHCP request
+				{
+					struct dhcpMessage *dhcph =
+						(struct dhcpMessage *)((SIZE_PTR)udph + sizeof(struct udphdr));
+
+					if(dhcph->cookie == __constant_htonl(DHCP_MAGIC)) // match magic word
+					{
+						if(!(dhcph->flags & htons(BROADCAST_FLAG))) // if not broadcast
+						{
+							register int sum = 0;
+
+							DEBUG_INFO("DHCP: change flag of DHCP request to broadcast.\n");
+							// or BROADCAST flag
+							dhcph->flags |= htons(BROADCAST_FLAG);
+							// recalculate checksum
+							sum = ~(udph->check) & 0xffff;
+							sum += dhcph->flags;
+							while(sum >> 16)
+								sum = (sum & 0xffff) + (sum >> 16);
+							udph->check = ~sum;
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+
+void *scdb_findEntry(_adapter *priv, unsigned char *macAddr,
+				unsigned char *ipAddr)
+{
+	unsigned char networkAddr[MAX_NETWORK_ADDR_LEN];
+	struct nat25_network_db_entry *db;
+	int hash;
+	//_irqL irqL;
+	//_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	__nat25_generate_ipv4_network_addr(networkAddr, (unsigned int *)ipAddr);
+	hash = __nat25_network_hash(networkAddr);
+	db = priv->nethash[hash];
+	while (db != NULL)
+	{
+		if(!memcmp(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN)) {
+			//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			return (void *)db;
+		}
+
+		db = db->next_hash;
+	}
+
+	//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+	return NULL;
+}
+
+#endif	// CONFIG_BR_EXT
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c
new file mode 100755
index 0000000000000..f906eb3489d1e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c
@@ -0,0 +1,3035 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_CMD_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <cmd_osdep.h>
+#include <mlme_osdep.h>
+#include <rtw_byteorder.h>
+#ifdef CONFIG_BR_EXT
+#include <rtw_br_ext.h>
+#endif //CONFIG_BR_EXT
+/*
+Caller and the rtw_cmd_thread can protect cmd_q by spin_lock.
+No irqsave is necessary.
+*/
+
+sint	_rtw_init_cmd_priv (struct	cmd_priv *pcmdpriv)
+{
+	sint res=_SUCCESS;
+	
+_func_enter_;	
+
+	_rtw_init_sema(&(pcmdpriv->cmd_queue_sema), 0);
+	//_rtw_init_sema(&(pcmdpriv->cmd_done_sema), 0);
+	_rtw_init_sema(&(pcmdpriv->terminate_cmdthread_sema), 0);
+	
+	
+	_rtw_init_queue(&(pcmdpriv->cmd_queue));
+	
+	//allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf
+	
+	pcmdpriv->cmd_seq = 1;
+	
+	pcmdpriv->cmd_allocated_buf = rtw_zmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ);
+	
+	if (pcmdpriv->cmd_allocated_buf == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	
+	pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf  +  CMDBUFF_ALIGN_SZ - ( (SIZE_PTR)(pcmdpriv->cmd_allocated_buf) & (CMDBUFF_ALIGN_SZ-1));
+		
+	pcmdpriv->rsp_allocated_buf = rtw_zmalloc(MAX_RSPSZ + 4);
+	
+	if (pcmdpriv->rsp_allocated_buf == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	
+	pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf  +  4 - ( (SIZE_PTR)(pcmdpriv->rsp_allocated_buf) & 3);
+
+	pcmdpriv->cmd_issued_cnt = pcmdpriv->cmd_done_cnt = pcmdpriv->rsp_cnt = 0;
+
+exit:
+	
+_func_exit_;	  
+
+	return res;
+	
+}	
+
+#ifdef CONFIG_C2H_WK
+static void c2h_wk_callback(_workitem *work);
+#endif
+sint _rtw_init_evt_priv(struct evt_priv *pevtpriv)
+{
+	sint res=_SUCCESS;
+
+_func_enter_;	
+
+#ifdef CONFIG_H2CLBK
+	_rtw_init_sema(&(pevtpriv->lbkevt_done), 0);
+	pevtpriv->lbkevt_limit = 0;
+	pevtpriv->lbkevt_num = 0;
+	pevtpriv->cmdevt_parm = NULL;		
+#endif		
+	
+	//allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf
+	ATOMIC_SET(&pevtpriv->event_seq, 0);
+	pevtpriv->evt_done_cnt = 0;
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+
+	_rtw_init_sema(&(pevtpriv->evt_notify), 0);
+	_rtw_init_sema(&(pevtpriv->terminate_evtthread_sema), 0);
+
+	pevtpriv->evt_allocated_buf = rtw_zmalloc(MAX_EVTSZ + 4);	
+	if (pevtpriv->evt_allocated_buf == NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	pevtpriv->evt_buf = pevtpriv->evt_allocated_buf  +  4 - ((unsigned int)(pevtpriv->evt_allocated_buf) & 3);
+	
+		
+#ifdef CONFIG_SDIO_HCI
+	pevtpriv->allocated_c2h_mem = rtw_zmalloc(C2H_MEM_SZ +4); 
+	
+	if (pevtpriv->allocated_c2h_mem == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pevtpriv->c2h_mem = pevtpriv->allocated_c2h_mem +  4\
+	- ( (u32)(pevtpriv->allocated_c2h_mem) & 3);
+#ifdef PLATFORM_OS_XP
+	pevtpriv->pc2h_mdl= IoAllocateMdl((u8 *)pevtpriv->c2h_mem, C2H_MEM_SZ , FALSE, FALSE, NULL);
+	
+	if(pevtpriv->pc2h_mdl == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	MmBuildMdlForNonPagedPool(pevtpriv->pc2h_mdl);
+#endif
+#endif //end of CONFIG_SDIO_HCI
+
+	_rtw_init_queue(&(pevtpriv->evt_queue));
+
+exit:	
+
+#endif //end of CONFIG_EVENT_THREAD_MODE
+
+#ifdef CONFIG_C2H_WK
+	_init_workitem(&pevtpriv->c2h_wk, c2h_wk_callback, NULL);
+	pevtpriv->c2h_wk_alive = _FALSE;
+	pevtpriv->c2h_queue = rtw_cbuf_alloc(C2H_QUEUE_MAX_LEN+1);
+#endif
+
+_func_exit_;		 
+
+	return res;
+}
+
+void _rtw_free_evt_priv (struct	evt_priv *pevtpriv)
+{
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("+_rtw_free_evt_priv \n"));
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+	_rtw_free_sema(&(pevtpriv->evt_notify));
+	_rtw_free_sema(&(pevtpriv->terminate_evtthread_sema));
+
+
+	if (pevtpriv->evt_allocated_buf)
+		rtw_mfree(pevtpriv->evt_allocated_buf, MAX_EVTSZ + 4);
+#endif
+
+#ifdef CONFIG_C2H_WK
+	_cancel_workitem_sync(&pevtpriv->c2h_wk);
+	while(pevtpriv->c2h_wk_alive)
+		rtw_msleep_os(10);
+
+	while (!rtw_cbuf_empty(pevtpriv->c2h_queue)) {
+		void *c2h;
+		if ((c2h = rtw_cbuf_pop(pevtpriv->c2h_queue)) != NULL
+			&& c2h != (void *)pevtpriv) {
+			rtw_mfree(c2h, 16);
+		}
+	}
+	rtw_cbuf_free(pevtpriv->c2h_queue);
+#endif
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("-_rtw_free_evt_priv \n"));
+
+_func_exit_;	  	
+
+}
+
+void _rtw_free_cmd_priv (struct	cmd_priv *pcmdpriv)
+{
+_func_enter_;
+
+	if(pcmdpriv){
+		_rtw_spinlock_free(&(pcmdpriv->cmd_queue.lock));
+		_rtw_free_sema(&(pcmdpriv->cmd_queue_sema));
+		//_rtw_free_sema(&(pcmdpriv->cmd_done_sema));
+		_rtw_free_sema(&(pcmdpriv->terminate_cmdthread_sema));
+
+		if (pcmdpriv->cmd_allocated_buf)
+			rtw_mfree(pcmdpriv->cmd_allocated_buf, MAX_CMDSZ + CMDBUFF_ALIGN_SZ);
+		
+		if (pcmdpriv->rsp_allocated_buf)
+			rtw_mfree(pcmdpriv->rsp_allocated_buf, MAX_RSPSZ + 4);
+	}
+_func_exit_;		
+}
+
+/*
+Calling Context:
+
+rtw_enqueue_cmd can only be called between kernel thread, 
+since only spin_lock is used.
+
+ISR/Call-Back functions can't call this sub-function.
+
+*/
+
+sint	_rtw_enqueue_cmd(_queue *queue, struct cmd_obj *obj)
+{
+	_irqL irqL;
+
+_func_enter_;
+
+	if (obj == NULL)
+		goto exit;
+
+	//_enter_critical_bh(&queue->lock, &irqL);
+	_enter_critical(&queue->lock, &irqL);	
+
+	rtw_list_insert_tail(&obj->list, &queue->queue);
+
+	//_exit_critical_bh(&queue->lock, &irqL);	
+	_exit_critical(&queue->lock, &irqL);
+
+exit:	
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+struct	cmd_obj	*_rtw_dequeue_cmd(_queue *queue)
+{
+	_irqL irqL;
+	struct cmd_obj *obj;
+
+_func_enter_;
+
+	//_enter_critical_bh(&(queue->lock), &irqL);
+	_enter_critical(&queue->lock, &irqL);
+	if (rtw_is_list_empty(&(queue->queue)))
+		obj = NULL;
+	else
+	{
+		obj = LIST_CONTAINOR(get_next(&(queue->queue)), struct cmd_obj, list);
+		rtw_list_delete(&obj->list);
+	}
+
+	//_exit_critical_bh(&(queue->lock), &irqL);
+	_exit_critical(&queue->lock, &irqL);
+
+_func_exit_;	
+
+	return obj;
+}
+
+u32	rtw_init_cmd_priv(struct cmd_priv *pcmdpriv)
+{
+	u32	res;
+_func_enter_;	
+	res = _rtw_init_cmd_priv (pcmdpriv);
+_func_exit_;	
+	return res;	
+}
+
+u32	rtw_init_evt_priv (struct	evt_priv *pevtpriv)
+{
+	int	res;
+_func_enter_;		
+	res = _rtw_init_evt_priv(pevtpriv);
+_func_exit_;		
+	return res;
+}
+
+void rtw_free_evt_priv (struct	evt_priv *pevtpriv)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("rtw_free_evt_priv\n"));
+	_rtw_free_evt_priv(pevtpriv);
+_func_exit_;		
+}	
+
+void rtw_free_cmd_priv (struct	cmd_priv *pcmdpriv)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("rtw_free_cmd_priv\n"));
+	_rtw_free_cmd_priv(pcmdpriv);
+_func_exit_;	
+}	
+
+int rtw_cmd_filter(struct cmd_priv *pcmdpriv, struct cmd_obj *cmd_obj);
+int rtw_cmd_filter(struct cmd_priv *pcmdpriv, struct cmd_obj *cmd_obj)
+{
+	u8 bAllow = _FALSE; //set to _TRUE to allow enqueuing cmd when hw_init_completed is _FALSE
+	
+	#ifdef SUPPORT_HW_RFOFF_DETECTED
+	//To decide allow or not
+	if(	(pcmdpriv->padapter->pwrctrlpriv.bHWPwrPindetect)
+		&&(!pcmdpriv->padapter->registrypriv.usbss_enable)
+	)		
+	{
+		if(cmd_obj->cmdcode == GEN_CMD_CODE(_Set_Drv_Extra) ) 
+		{
+			struct drvextra_cmd_parm	*pdrvextra_cmd_parm = (struct drvextra_cmd_parm	*)cmd_obj->parmbuf;	
+			if(pdrvextra_cmd_parm->ec_id == POWER_SAVING_CTRL_WK_CID)
+			{	
+				//DBG_871X("==>enqueue POWER_SAVING_CTRL_WK_CID\n");
+				bAllow = _TRUE;	
+			}
+		}
+	}
+	#endif
+
+	if(cmd_obj->cmdcode == GEN_CMD_CODE(_SetChannelPlan))
+		bAllow = _TRUE;
+
+	if( (pcmdpriv->padapter->hw_init_completed ==_FALSE && bAllow == _FALSE)
+		|| pcmdpriv->cmdthd_running== _FALSE	//com_thread not running
+	)
+	{
+		//DBG_871X("%s:%s: drop cmdcode:%u, hw_init_completed:%u, cmdthd_running:%u\n", caller_func, __FUNCTION__,
+		//	cmd_obj->cmdcode,
+		//	pcmdpriv->padapter->hw_init_completed,
+		//	pcmdpriv->cmdthd_running
+		//);
+
+		return _FAIL;
+	}	
+	return _SUCCESS;
+}
+
+
+
+u32 rtw_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *cmd_obj)
+{
+	int res = _FAIL;
+	PADAPTER padapter = pcmdpriv->padapter;
+	
+_func_enter_;	
+	
+	if (cmd_obj == NULL) {
+		goto exit;
+	}
+
+	cmd_obj->padapter = padapter;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	//change pcmdpriv to primary's pcmdpriv
+	if (padapter->adapter_type != PRIMARY_ADAPTER && padapter->pbuddy_adapter)
+		pcmdpriv = &(padapter->pbuddy_adapter->cmdpriv);
+#endif	
+
+	if( _FAIL == (res=rtw_cmd_filter(pcmdpriv, cmd_obj)) ) {
+		rtw_free_cmd_obj(cmd_obj);
+		goto exit;
+	}
+
+	res = _rtw_enqueue_cmd(&pcmdpriv->cmd_queue, cmd_obj);
+
+	if(res == _SUCCESS)
+		_rtw_up_sema(&pcmdpriv->cmd_queue_sema);
+	
+exit:	
+	
+_func_exit_;
+
+	return res;
+}
+
+struct	cmd_obj	*rtw_dequeue_cmd(struct cmd_priv *pcmdpriv)
+{
+	struct cmd_obj *cmd_obj;
+	
+_func_enter_;		
+
+	cmd_obj = _rtw_dequeue_cmd(&pcmdpriv->cmd_queue);
+		
+_func_exit_;			
+	return cmd_obj;
+}
+
+void rtw_cmd_clr_isr(struct	cmd_priv *pcmdpriv)
+{
+_func_enter_;
+	pcmdpriv->cmd_done_cnt++;
+	//_rtw_up_sema(&(pcmdpriv->cmd_done_sema));
+_func_exit_;		
+}
+
+void rtw_free_cmd_obj(struct cmd_obj *pcmd)
+{
+_func_enter_;
+
+	if((pcmd->cmdcode!=_JoinBss_CMD_) &&(pcmd->cmdcode!= _CreateBss_CMD_))
+	{
+		//free parmbuf in cmd_obj
+		rtw_mfree((unsigned char*)pcmd->parmbuf, pcmd->cmdsz);
+	}	
+	
+	if(pcmd->rsp!=NULL)
+	{
+		if(pcmd->rspsz!= 0)
+		{
+			//free rsp in cmd_obj
+			rtw_mfree((unsigned char*)pcmd->rsp, pcmd->rspsz);
+		}	
+	}	
+
+	//free cmd_obj
+	rtw_mfree((unsigned char*)pcmd, sizeof(struct cmd_obj));
+	
+_func_exit_;		
+}
+
+void rtw_stop_cmd_thread(_adapter *adapter)
+{
+	if(adapter->cmdThread && adapter->cmdpriv.cmdthd_running == _TRUE
+		&& adapter->cmdpriv.stop_req == 0)
+	{
+		adapter->cmdpriv.stop_req = 1;
+		_rtw_up_sema(&adapter->cmdpriv.cmd_queue_sema);
+		_rtw_down_sema(&adapter->cmdpriv.terminate_cmdthread_sema);
+	}
+}
+
+thread_return rtw_cmd_thread(thread_context context)
+{
+	u8 ret;
+	struct cmd_obj *pcmd;
+	u8 *pcmdbuf, *prspbuf;
+	u8 (*cmd_hdl)(_adapter *padapter, u8* pbuf);
+	void (*pcmd_callback)(_adapter *dev, struct cmd_obj *pcmd);
+       _adapter *padapter = (_adapter *)context;
+	struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
+	
+_func_enter_;
+
+	thread_enter("RTW_CMD_THREAD");
+
+	pcmdbuf = pcmdpriv->cmd_buf;
+	prspbuf = pcmdpriv->rsp_buf;
+
+	pcmdpriv->stop_req = 0;
+	pcmdpriv->cmdthd_running=_TRUE;
+	_rtw_up_sema(&pcmdpriv->terminate_cmdthread_sema);
+	
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("start r871x rtw_cmd_thread !!!!\n"));
+
+	while(1)
+	{
+		if ((_rtw_down_sema(&(pcmdpriv->cmd_queue_sema))) == _FAIL) {
+			LOG_LEVEL(_drv_err_, FUNC_ADPT_FMT" _rtw_down_sema(&pcmdpriv->cmd_queue_sema) return _FAIL, break\n", FUNC_ADPT_ARG(padapter));
+			break;
+		}
+
+		if (pcmdpriv->stop_req) {
+			LOG_LEVEL(_drv_err_, FUNC_ADPT_FMT" stop_req:%u, break\n", FUNC_ADPT_ARG(padapter), pcmdpriv->stop_req);
+			break;
+		}
+
+#ifdef CONFIG_LPS_LCLK
+		if (rtw_register_cmd_alive(padapter) != _SUCCESS)
+		{
+			continue;
+		}
+#endif
+
+_next:
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved == _TRUE))
+		{
+			LOG_LEVEL(_drv_err_, "%s: DriverStopped(%d) SurpriseRemoved(%d) break at line %d\n",
+				__FUNCTION__, padapter->bDriverStopped, padapter->bSurpriseRemoved, __LINE__);
+			break;
+		}
+
+		if(!(pcmd = rtw_dequeue_cmd(pcmdpriv))) {
+#ifdef CONFIG_LPS_LCLK
+			rtw_unregister_cmd_alive(padapter);
+#endif
+			continue;
+		}
+
+		if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) )
+		{
+			pcmd->res = H2C_DROPPED;
+			goto post_process;					
+		}
+
+		if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) ) {
+			rtw_free_cmd_obj(pcmd);
+			continue;
+		}
+
+		pcmdpriv->cmd_issued_cnt++;
+
+		pcmd->cmdsz = _RND4((pcmd->cmdsz));//_RND4
+
+		_rtw_memcpy(pcmdbuf, pcmd->parmbuf, pcmd->cmdsz);
+
+		if(pcmd->cmdcode <= (sizeof(wlancmds) /sizeof(struct cmd_hdl)))
+		{
+			cmd_hdl = wlancmds[pcmd->cmdcode].h2cfuns;
+
+			if (cmd_hdl)
+			{
+				ret = cmd_hdl(pcmd->padapter, pcmdbuf);
+				pcmd->res = ret;
+			}
+
+			pcmdpriv->cmd_seq++;
+		}
+		else
+		{
+			pcmd->res = H2C_PARAMETERS_ERROR;
+		}
+
+		cmd_hdl = NULL;
+
+post_process:
+
+		//call callback function for post-processed
+		if(pcmd->cmdcode <= (sizeof(rtw_cmd_callback) /sizeof(struct _cmd_callback)))
+		{
+			pcmd_callback = rtw_cmd_callback[pcmd->cmdcode].callback;
+			if(pcmd_callback == NULL)
+			{
+				RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("mlme_cmd_hdl(): pcmd_callback=0x%p, cmdcode=0x%x\n", pcmd_callback, pcmd->cmdcode));
+				rtw_free_cmd_obj(pcmd);
+			}
+			else
+			{
+				//todo: !!! fill rsp_buf to pcmd->rsp if (pcmd->rsp!=NULL)
+				pcmd_callback(pcmd->padapter, pcmd);//need conider that free cmd_obj in rtw_cmd_callback
+			}
+		}
+
+		flush_signals_thread();
+
+		goto _next;
+
+	}
+	pcmdpriv->cmdthd_running=_FALSE;
+
+
+	// free all cmd_obj resources
+	do{
+		pcmd = rtw_dequeue_cmd(pcmdpriv);
+		if(pcmd==NULL)
+			break;
+
+		//DBG_871X("%s: leaving... drop cmdcode:%u\n", __FUNCTION__, pcmd->cmdcode);
+
+		rtw_free_cmd_obj(pcmd);	
+	}while(1);
+
+	_rtw_up_sema(&pcmdpriv->terminate_cmdthread_sema);
+
+_func_exit_;
+
+	thread_exit();
+
+}
+
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+u32 rtw_enqueue_evt(struct evt_priv *pevtpriv, struct evt_obj *obj)
+{
+	_irqL irqL;
+	int	res;
+	_queue *queue = &pevtpriv->evt_queue;
+	
+_func_enter_;	
+
+	res = _SUCCESS; 		
+
+	if (obj == NULL) {
+		res = _FAIL;
+		goto exit;
+	}	
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	rtw_list_insert_tail(&obj->list, &queue->queue);
+	
+	_exit_critical_bh(&queue->lock, &irqL);
+
+	//rtw_evt_notify_isr(pevtpriv);
+
+exit:
+	
+_func_exit_;		
+
+	return res;	
+}
+
+struct evt_obj *rtw_dequeue_evt(_queue *queue)
+{
+	_irqL irqL;
+	struct	evt_obj	*pevtobj;
+	
+_func_enter_;		
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (rtw_is_list_empty(&(queue->queue)))
+		pevtobj = NULL;
+	else
+	{
+		pevtobj = LIST_CONTAINOR(get_next(&(queue->queue)), struct evt_obj, list);
+		rtw_list_delete(&pevtobj->list);
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+	
+_func_exit_;			
+
+	return pevtobj;	
+}
+
+void rtw_free_evt_obj(struct evt_obj *pevtobj)
+{
+_func_enter_;
+
+	if(pevtobj->parmbuf)
+		rtw_mfree((unsigned char*)pevtobj->parmbuf, pevtobj->evtsz);
+	
+	rtw_mfree((unsigned char*)pevtobj, sizeof(struct evt_obj));
+	
+_func_exit_;		
+}
+
+void rtw_evt_notify_isr(struct evt_priv *pevtpriv)
+{
+_func_enter_;
+	pevtpriv->evt_done_cnt++;
+	_rtw_up_sema(&(pevtpriv->evt_notify));
+_func_exit_;	
+}
+#endif
+
+
+/*
+u8 rtw_setstandby_cmd(unsigned char  *adapter) 
+*/
+u8 rtw_setstandby_cmd(_adapter *padapter, uint action)
+{
+	struct cmd_obj*			ph2c;
+	struct usb_suspend_parm*	psetusbsuspend;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+
+	u8 ret = _SUCCESS;
+	
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		ret = _FAIL;
+		goto exit;
+	}
+	
+	psetusbsuspend = (struct usb_suspend_parm*)rtw_zmalloc(sizeof(struct usb_suspend_parm)); 
+	if (psetusbsuspend == NULL) {
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		ret = _FAIL;
+		goto exit;
+	}
+
+	psetusbsuspend->action = action;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetusbsuspend, GEN_CMD_CODE(_SetUsbSuspend));
+
+	ret = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+	
+exit:	
+	
+_func_exit_;		
+
+	return ret;
+}
+
+/*
+rtw_sitesurvey_cmd(~)
+	### NOTE:#### (!!!!)
+	MUST TAKE CARE THAT BEFORE CALLING THIS FUNC, YOU SHOULD HAVE LOCKED pmlmepriv->lock
+*/
+u8 rtw_sitesurvey_cmd(_adapter  *padapter, NDIS_802_11_SSID *ssid, int ssid_num,
+	struct rtw_ieee80211_channel *ch, int ch_num)
+{
+	u8 res = _FAIL;
+	struct cmd_obj		*ph2c;
+	struct sitesurvey_parm	*psurveyPara;
+	struct cmd_priv 	*pcmdpriv = &padapter->cmdpriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+#ifdef CONFIG_LPS
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE){
+		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SCAN, 1);
+	}
+#endif
+
+#ifdef CONFIG_P2P_PS
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		p2p_ps_wk_cmd(padapter, P2P_PS_SCAN, 1);
+	}
+#endif // CONFIG_P2P_PS
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL)
+		return _FAIL;
+
+	psurveyPara = (struct sitesurvey_parm*)rtw_zmalloc(sizeof(struct sitesurvey_parm)); 
+	if (psurveyPara == NULL) {
+		rtw_mfree((unsigned char*) ph2c, sizeof(struct cmd_obj));
+		return _FAIL;
+	}
+
+	rtw_free_network_queue(padapter, _FALSE);
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_info_, ("\nflush  network queue\n\n"));
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
+
+	/* psurveyPara->bsslimit = 48; */
+	psurveyPara->scan_mode = pmlmepriv->scan_mode;
+
+	/* prepare ssid list */
+	if (ssid) {
+		int i;
+		for (i=0; i<ssid_num && i< RTW_SSID_SCAN_AMOUNT; i++) {
+			if (ssid[i].SsidLength) {
+				_rtw_memcpy(&psurveyPara->ssid[i], &ssid[i], sizeof(NDIS_802_11_SSID));
+				psurveyPara->ssid_num++;
+				if (0)
+				DBG_871X(FUNC_ADPT_FMT" ssid:(%s, %d)\n", FUNC_ADPT_ARG(padapter),
+					psurveyPara->ssid[i].Ssid, psurveyPara->ssid[i].SsidLength);
+			}
+		}
+	}
+
+	/* prepare channel list */
+	if (ch) {
+		int i;
+		for (i=0; i<ch_num && i< RTW_CHANNEL_SCAN_AMOUNT; i++) {
+			if (ch[i].hw_value && !(ch[i].flags & RTW_IEEE80211_CHAN_DISABLED)) {
+				_rtw_memcpy(&psurveyPara->ch[i], &ch[i], sizeof(struct rtw_ieee80211_channel));
+				psurveyPara->ch_num++;
+				if (0)
+				DBG_871X(FUNC_ADPT_FMT" ch:%u\n", FUNC_ADPT_ARG(padapter),
+					psurveyPara->ch[i].hw_value);
+			}
+		}
+	}
+
+	set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+	if(res == _SUCCESS) {
+
+		pmlmepriv->scan_start_time = rtw_get_current_time();
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if (padapter->pbuddy_adapter == NULL )
+			goto full_scan_timeout;
+		if((padapter->pbuddy_adapter->mlmeextpriv.mlmext_info.state&0x03) == WIFI_FW_AP_STATE)
+			_set_timer(&pmlmepriv->scan_to_timer, 
+				SURVEY_TO * ( padapter->mlmeextpriv.max_chan_nums + ( padapter->mlmeextpriv.max_chan_nums  / RTW_SCAN_NUM_OF_CH ) * RTW_STAY_AP_CH_MILLISECOND ) + 1000 );
+		else
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+full_scan_timeout:
+			_set_timer(&pmlmepriv->scan_to_timer, SCANNING_TIMEOUT);
+
+		rtw_led_control(padapter, LED_CTL_SITE_SURVEY);
+
+		pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+	} else {
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+	}
+
+_func_exit_;		
+
+	return res;
+}
+
+u8 rtw_setdatarate_cmd(_adapter *padapter, u8 *rateset)
+{
+	struct cmd_obj*			ph2c;
+	struct setdatarate_parm*	pbsetdataratepara;
+	struct cmd_priv*		pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	pbsetdataratepara = (struct setdatarate_parm*)rtw_zmalloc(sizeof(struct setdatarate_parm)); 
+	if (pbsetdataratepara == NULL) {
+		rtw_mfree((u8 *) ph2c, sizeof(struct cmd_obj));
+		res = _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pbsetdataratepara, GEN_CMD_CODE(_SetDataRate));
+#ifdef MP_FIRMWARE_OFFLOAD
+	pbsetdataratepara->curr_rateidx = *(u32*)rateset;
+//	_rtw_memcpy(pbsetdataratepara, rateset, sizeof(u32));
+#else
+	pbsetdataratepara->mac_id = 5;
+	_rtw_memcpy(pbsetdataratepara->datarates, rateset, NumRates);
+#endif
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_setbasicrate_cmd(_adapter *padapter, u8 *rateset)
+{
+	struct cmd_obj*			ph2c;
+	struct setbasicrate_parm*	pssetbasicratepara;
+	struct cmd_priv*		pcmdpriv=&padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		res= _FAIL;
+		goto exit;
+	}
+	pssetbasicratepara = (struct setbasicrate_parm*)rtw_zmalloc(sizeof(struct setbasicrate_parm)); 
+
+	if (pssetbasicratepara == NULL) {
+		rtw_mfree((u8*) ph2c, sizeof(struct cmd_obj));
+		res = _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pssetbasicratepara, _SetBasicRate_CMD_);
+
+	_rtw_memcpy(pssetbasicratepara->basicrates, rateset, NumRates);	   
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:	
+
+_func_exit_;		
+
+	return res;
+}
+
+
+/*
+unsigned char rtw_setphy_cmd(unsigned char  *adapter) 
+
+1.  be called only after rtw_update_registrypriv_dev_network( ~) or mp testing program
+2.  for AdHoc/Ap mode or mp mode?
+
+*/
+u8 rtw_setphy_cmd(_adapter *padapter, u8 modem, u8 ch)
+{
+	struct cmd_obj*			ph2c;
+	struct setphy_parm*		psetphypara;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+//	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+//	struct registry_priv*		pregistry_priv = &padapter->registrypriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	psetphypara = (struct setphy_parm*)rtw_zmalloc(sizeof(struct setphy_parm)); 
+
+	if(psetphypara==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetphypara, _SetPhy_CMD_);
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("CH=%d, modem=%d", ch, modem));
+
+	psetphypara->modem = modem;
+	psetphypara->rfchannel = ch;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:	
+_func_exit_;		
+	return res;
+}
+
+u8 rtw_setbbreg_cmd(_adapter*padapter, u8 offset, u8 val)
+{	
+	struct cmd_obj*			ph2c;
+	struct writeBB_parm*		pwritebbparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;	
+	u8	res=_SUCCESS;
+_func_enter_;
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	pwritebbparm = (struct writeBB_parm*)rtw_zmalloc(sizeof(struct writeBB_parm)); 
+
+	if(pwritebbparm==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pwritebbparm, GEN_CMD_CODE(_SetBBReg));	
+
+	pwritebbparm->offset = offset;
+	pwritebbparm->value = val;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:	
+_func_exit_;	
+	return res;
+}
+
+u8 rtw_getbbreg_cmd(_adapter  *padapter, u8 offset, u8 *pval)
+{	
+	struct cmd_obj*			ph2c;
+	struct readBB_parm*		prdbbparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+	
+_func_enter_;
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res=_FAIL;
+		goto exit;
+		}
+	prdbbparm = (struct readBB_parm*)rtw_zmalloc(sizeof(struct readBB_parm)); 
+
+	if(prdbbparm ==NULL){
+		rtw_mfree((unsigned char *) ph2c, sizeof(struct	cmd_obj));
+		return _FAIL;
+	}
+
+	_rtw_init_listhead(&ph2c->list);
+	ph2c->cmdcode =GEN_CMD_CODE(_GetBBReg);
+	ph2c->parmbuf = (unsigned char *)prdbbparm;
+	ph2c->cmdsz =  sizeof(struct readBB_parm);
+	ph2c->rsp = pval;
+	ph2c->rspsz = sizeof(struct readBB_rsp);
+	
+	prdbbparm ->offset = offset;
+	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:
+_func_exit_;	
+	return res;
+}
+
+u8 rtw_setrfreg_cmd(_adapter  *padapter, u8 offset, u32 val)
+{	
+	struct cmd_obj*			ph2c;
+	struct writeRF_parm*		pwriterfparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;	
+	u8	res=_SUCCESS;
+_func_enter_;
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;	
+		goto exit;
+	}
+	pwriterfparm = (struct writeRF_parm*)rtw_zmalloc(sizeof(struct writeRF_parm)); 
+
+	if(pwriterfparm==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pwriterfparm, GEN_CMD_CODE(_SetRFReg));	
+
+	pwriterfparm->offset = offset;
+	pwriterfparm->value = val;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:
+_func_exit_;	
+	return res;
+}
+
+u8 rtw_getrfreg_cmd(_adapter  *padapter, u8 offset, u8 *pval)
+{	
+	struct cmd_obj*			ph2c;
+	struct readRF_parm*		prdrfparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;	
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	prdrfparm = (struct readRF_parm*)rtw_zmalloc(sizeof(struct readRF_parm)); 
+	if(prdrfparm ==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_init_listhead(&ph2c->list);
+	ph2c->cmdcode =GEN_CMD_CODE(_GetRFReg);
+	ph2c->parmbuf = (unsigned char *)prdrfparm;
+	ph2c->cmdsz =  sizeof(struct readRF_parm);
+	ph2c->rsp = pval;
+	ph2c->rspsz = sizeof(struct readRF_rsp);
+	
+	prdrfparm ->offset = offset;
+	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+void rtw_getbbrfreg_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{       
+ _func_enter_;  
+		
+	//rtw_free_cmd_obj(pcmd);
+	rtw_mfree((unsigned char*) pcmd->parmbuf, pcmd->cmdsz);
+	rtw_mfree((unsigned char*) pcmd, sizeof(struct cmd_obj));
+	
+#ifdef CONFIG_MP_INCLUDED	
+	padapter->mppriv.workparam.bcompleted= _TRUE;
+#endif	
+_func_exit_;		
+}
+
+void rtw_readtssi_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+ _func_enter_;  
+
+	rtw_mfree((unsigned char*) pcmd->parmbuf, pcmd->cmdsz);
+	rtw_mfree((unsigned char*) pcmd, sizeof(struct cmd_obj));
+	
+#ifdef CONFIG_MP_INCLUDED	
+	padapter->mppriv.workparam.bcompleted= _TRUE;
+#endif
+
+_func_exit_;
+}
+
+u8 rtw_createbss_cmd(_adapter  *padapter)
+{
+	struct cmd_obj*			pcmd;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	WLAN_BSSID_EX		*pdev_network = &padapter->registrypriv.dev_network;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	rtw_led_control(padapter, LED_CTL_START_TO_LINK);
+
+	if (pmlmepriv->assoc_ssid.SsidLength == 0){
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,(" createbss for Any SSid:%s\n",pmlmepriv->assoc_ssid.Ssid));		
+	} else {
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,(" createbss for SSid:%s\n", pmlmepriv->assoc_ssid.Ssid));
+	}
+		
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_init_listhead(&pcmd->list);
+	pcmd->cmdcode = _CreateBss_CMD_;
+	pcmd->parmbuf = (unsigned char *)pdev_network;
+	pcmd->cmdsz = get_WLAN_BSSID_EX_sz((WLAN_BSSID_EX*)pdev_network);
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;	
+	
+	pdev_network->Length = pcmd->cmdsz;	
+
+#ifdef CONFIG_RTL8712
+	//notes: translate IELength & Length after assign the Length to cmdsz;
+	pdev_network->Length = cpu_to_le32(pcmd->cmdsz);
+	pdev_network->IELength = cpu_to_le32(pdev_network->IELength);
+	pdev_network->Ssid.SsidLength = cpu_to_le32(pdev_network->Ssid.SsidLength);
+#endif
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);	
+
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_createbss_cmd_ex(_adapter  *padapter, unsigned char *pbss, unsigned int sz)
+{
+	struct cmd_obj*	pcmd;
+	struct cmd_priv 	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+	
+_func_enter_;
+			
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_init_listhead(&pcmd->list);
+	pcmd->cmdcode = GEN_CMD_CODE(_CreateBss);
+	pcmd->parmbuf = pbss;
+	pcmd->cmdsz =  sz;
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+	
+_func_exit_;	
+
+	return res;	
+}
+
+u8 rtw_joinbss_cmd(_adapter  *padapter, struct wlan_network* pnetwork)
+{
+	u8	*auth, res = _SUCCESS;
+	uint	t_len = 0;
+	WLAN_BSSID_EX		*psecnetwork;
+	struct cmd_obj		*pcmd;
+	struct cmd_priv		*pcmdpriv=&padapter->cmdpriv;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv		*pqospriv= &pmlmepriv->qospriv;
+	struct security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE ndis_network_mode = pnetwork->network.InfrastructureMode;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+_func_enter_;
+
+	rtw_led_control(padapter, LED_CTL_START_TO_LINK);
+
+	if (pmlmepriv->assoc_ssid.SsidLength == 0){
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_info_, ("+Join cmd: Any SSid\n"));
+	} else {
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+Join cmd: SSid=[%s]\n", pmlmepriv->assoc_ssid.Ssid));
+	}
+
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(pcmd==NULL){
+		res=_FAIL;
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd: memory allocate for cmd_obj fail!!!\n"));
+		goto exit;
+	}
+	/* // for IEs is pointer 
+	t_len = sizeof (ULONG) + sizeof (NDIS_802_11_MAC_ADDRESS) + 2 + 
+			sizeof (NDIS_802_11_SSID) + sizeof (ULONG) + 
+			sizeof (NDIS_802_11_RSSI) + sizeof (NDIS_802_11_NETWORK_TYPE) + 
+			sizeof (NDIS_802_11_CONFIGURATION) +	
+			sizeof (NDIS_802_11_NETWORK_INFRASTRUCTURE) +   
+			sizeof (NDIS_802_11_RATES_EX)+ sizeof(WLAN_PHY_INFO)+ sizeof (ULONG) + MAX_IE_SZ;
+	*/
+	//for IEs is fix buf size
+	t_len = sizeof(WLAN_BSSID_EX);
+
+
+	//for hidden ap to set fw_state here
+	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) != _TRUE)
+	{
+		switch(ndis_network_mode)
+		{
+			case Ndis802_11IBSS:
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+				break;
+
+			case Ndis802_11Infrastructure:
+				set_fwstate(pmlmepriv, WIFI_STATION_STATE);
+				break;
+
+			case Ndis802_11APMode:
+			case Ndis802_11AutoUnknown:
+			case Ndis802_11InfrastructureMax:
+				break;
+
+		}
+	}
+
+	psecnetwork=(WLAN_BSSID_EX *)&psecuritypriv->sec_bss;
+	if(psecnetwork==NULL)
+	{
+		if(pcmd !=NULL)
+			rtw_mfree((unsigned char *)pcmd, sizeof(struct	cmd_obj));
+		
+		res=_FAIL;
+		
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd :psecnetwork==NULL!!!\n"));
+		
+		goto exit;
+	}
+
+	_rtw_memset(psecnetwork, 0, t_len);
+
+	_rtw_memcpy(psecnetwork, &pnetwork->network, get_WLAN_BSSID_EX_sz(&pnetwork->network));
+	
+	auth=&psecuritypriv->authenticator_ie[0];
+	psecuritypriv->authenticator_ie[0]=(unsigned char)psecnetwork->IELength;
+
+	if((psecnetwork->IELength-12) < (256-1)) {
+		_rtw_memcpy(&psecuritypriv->authenticator_ie[1], &psecnetwork->IEs[12], psecnetwork->IELength-12);
+	} else {
+		_rtw_memcpy(&psecuritypriv->authenticator_ie[1], &psecnetwork->IEs[12], (256-1));
+	}
+	  
+	psecnetwork->IELength = 0;
+	// Added by Albert 2009/02/18
+	// If the the driver wants to use the bssid to create the connection.
+	// If not,  we have to copy the connecting AP's MAC address to it so that
+	// the driver just has the bssid information for PMKIDList searching.
+        
+	if ( pmlmepriv->assoc_by_bssid == _FALSE )
+	{
+		_rtw_memcpy( &pmlmepriv->assoc_bssid[ 0 ], &pnetwork->network.MacAddress[ 0 ], ETH_ALEN );
+	}
+
+	psecnetwork->IELength = rtw_restruct_sec_ie(padapter, &pnetwork->network.IEs[0], &psecnetwork->IEs[0], pnetwork->network.IELength);
+
+
+	pqospriv->qos_option = 0;
+	
+	if(pregistrypriv->wmm_enable)	
+	{	
+		u32 tmp_len;
+		
+		tmp_len = rtw_restruct_wmm_ie(padapter, &pnetwork->network.IEs[0], &psecnetwork->IEs[0], pnetwork->network.IELength, psecnetwork->IELength);	
+
+		if (psecnetwork->IELength != tmp_len)		
+		{
+			psecnetwork->IELength = tmp_len;
+			pqospriv->qos_option = 1; //There is WMM IE in this corresp. beacon
+		}
+		else 
+		{
+			pqospriv->qos_option = 0;//There is no WMM IE in this corresp. beacon
+		}		
+	}	
+
+#ifdef CONFIG_80211N_HT
+	phtpriv->ht_option = _FALSE;
+	if(pregistrypriv->ht_enable)
+	{
+		//	Added by Albert 2010/06/23
+		//	For the WEP mode, we will use the bg mode to do the connection to avoid some IOT issue.
+		//	Especially for Realtek 8192u SoftAP.
+		if (	( padapter->securitypriv.dot11PrivacyAlgrthm != _WEP40_ ) &&
+			( padapter->securitypriv.dot11PrivacyAlgrthm != _WEP104_ ) &&
+			( padapter->securitypriv.dot11PrivacyAlgrthm != _TKIP_ ))
+		{
+			//rtw_restructure_ht_ie
+			rtw_restructure_ht_ie(padapter, &pnetwork->network.IEs[0], &psecnetwork->IEs[0], 
+									pnetwork->network.IELength, &psecnetwork->IELength, (u8)psecnetwork->Configuration.DSConfig );
+		}
+	}
+
+#endif
+
+	pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->network.IEs, pnetwork->network.IELength);
+
+	#if 0
+	psecuritypriv->supplicant_ie[0]=(u8)psecnetwork->IELength;
+
+	if(psecnetwork->IELength < (256-1))
+	{
+		_rtw_memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0], psecnetwork->IELength);
+	}
+	else
+	{
+		_rtw_memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0], (256-1));
+	}
+	#endif
+	
+	pcmd->cmdsz = get_WLAN_BSSID_EX_sz(psecnetwork);//get cmdsz before endian conversion
+
+#ifdef CONFIG_RTL8712
+	//wlan_network endian conversion	
+	psecnetwork->Length = cpu_to_le32(psecnetwork->Length);
+	psecnetwork->Ssid.SsidLength= cpu_to_le32(psecnetwork->Ssid.SsidLength);
+	psecnetwork->Privacy = cpu_to_le32(psecnetwork->Privacy);
+	psecnetwork->Rssi = cpu_to_le32(psecnetwork->Rssi);
+	psecnetwork->NetworkTypeInUse = cpu_to_le32(psecnetwork->NetworkTypeInUse);
+	psecnetwork->Configuration.ATIMWindow = cpu_to_le32(psecnetwork->Configuration.ATIMWindow);
+	psecnetwork->Configuration.BeaconPeriod = cpu_to_le32(psecnetwork->Configuration.BeaconPeriod);
+	psecnetwork->Configuration.DSConfig = cpu_to_le32(psecnetwork->Configuration.DSConfig);
+	psecnetwork->Configuration.FHConfig.DwellTime=cpu_to_le32(psecnetwork->Configuration.FHConfig.DwellTime);
+	psecnetwork->Configuration.FHConfig.HopPattern=cpu_to_le32(psecnetwork->Configuration.FHConfig.HopPattern);
+	psecnetwork->Configuration.FHConfig.HopSet=cpu_to_le32(psecnetwork->Configuration.FHConfig.HopSet);
+	psecnetwork->Configuration.FHConfig.Length=cpu_to_le32(psecnetwork->Configuration.FHConfig.Length);	
+	psecnetwork->Configuration.Length = cpu_to_le32(psecnetwork->Configuration.Length);
+	psecnetwork->InfrastructureMode = cpu_to_le32(psecnetwork->InfrastructureMode);
+	psecnetwork->IELength = cpu_to_le32(psecnetwork->IELength);      
+#endif
+
+	_rtw_init_listhead(&pcmd->list);
+	pcmd->cmdcode = _JoinBss_CMD_;//GEN_CMD_CODE(_JoinBss)
+	pcmd->parmbuf = (unsigned char *)psecnetwork;
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+	
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_disassoc_cmd(_adapter*padapter, u32 deauth_timeout_ms, bool enqueue) /* for sta_mode */
+{
+	struct cmd_obj *cmdobj = NULL;
+	struct disconnect_parm *param = NULL;
+	struct cmd_priv *cmdpriv = &padapter->cmdpriv;
+	u8 res = _SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_disassoc_cmd\n"));
+
+	/* prepare cmd parameter */
+	param = (struct disconnect_parm *)rtw_zmalloc(sizeof(*param));
+	if (param == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+	param->deauth_timeout_ms = deauth_timeout_ms;
+
+	if (enqueue) {
+		/* need enqueue, prepare cmd_obj and enqueue */
+		cmdobj = (struct cmd_obj *)rtw_zmalloc(sizeof(*cmdobj));
+		if (cmdobj == NULL) {
+			res = _FAIL;
+			rtw_mfree((u8 *)param, sizeof(*param));
+			goto exit;
+		}
+		init_h2fwcmd_w_parm_no_rsp(cmdobj, param, _DisConnect_CMD_);
+		res = rtw_enqueue_cmd(cmdpriv, cmdobj);
+	} else {
+		/* no need to enqueue, do the cmd hdl directly and free cmd parameter */
+		if (H2C_SUCCESS != disconnect_hdl(padapter, (u8 *)param))
+			res = _FAIL;
+		rtw_mfree((u8 *)param, sizeof(*param));
+	}
+
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_setopmode_cmd(_adapter  *padapter, NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
+{
+	struct	cmd_obj*	ph2c;
+	struct	setopmode_parm* psetop;
+
+	struct	cmd_priv   *pcmdpriv= &padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));			
+	if(ph2c==NULL){
+		res= _FALSE;
+		goto exit;
+	}
+	psetop = (struct setopmode_parm*)rtw_zmalloc(sizeof(struct setopmode_parm)); 
+
+	if(psetop==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res=_FALSE;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetop, _SetOpMode_CMD_);
+	psetop->mode = (u8)networktype;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_setstakey_cmd(_adapter *padapter, u8 *psta, u8 unicast_key)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	struct set_stakey_rsp		*psetstakey_rsp = NULL;
+	
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv 		*psecuritypriv = &padapter->securitypriv;
+	struct sta_info* 			sta = (struct sta_info* )psta;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if ( ph2c == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+	if(psetstakey_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	psetstakey_rsp = (struct set_stakey_rsp*)rtw_zmalloc(sizeof(struct set_stakey_rsp)); 
+	if(psetstakey_rsp == NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		rtw_mfree((u8 *) psetstakey_para, sizeof(struct set_stakey_parm));
+		res=_FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+	ph2c->rsp = (u8 *) psetstakey_rsp;
+	ph2c->rspsz = sizeof(struct set_stakey_rsp);
+
+	_rtw_memcpy(psetstakey_para->addr, sta->hwaddr,ETH_ALEN);
+	
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE)){
+#ifdef CONFIG_TDLS		
+		if(sta->tdls_sta_state&TDLS_LINKED_STATE)
+			psetstakey_para->algorithm=(u8)sta->dot118021XPrivacy;
+		else
+#endif //CONFIG_TDLS
+		psetstakey_para->algorithm =(unsigned char) psecuritypriv->dot11PrivacyAlgrthm;
+	}else{
+		GET_ENCRY_ALGO(psecuritypriv, sta, psetstakey_para->algorithm, _FALSE);
+	}
+
+	if (unicast_key == _TRUE) {
+#ifdef CONFIG_TDLS
+		if(sta->tdls_sta_state&TDLS_LINKED_STATE)
+			_rtw_memcpy(&psetstakey_para->key, sta->tpk.tk, 16);
+		else
+#endif //CONFIG_TDLS
+			_rtw_memcpy(&psetstakey_para->key, &sta->dot118021x_UncstKey, 16);
+        } else {
+		_rtw_memcpy(&psetstakey_para->key, &psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey, 16);
+        }
+
+	//jeff: set this becasue at least sw key is ready
+	padapter->securitypriv.busetkipkey=_TRUE;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_clearstakey_cmd(_adapter *padapter, u8 *psta, u8 entry, u8 enqueue)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	struct set_stakey_rsp		*psetstakey_rsp = NULL;	
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv 		*psecuritypriv = &padapter->securitypriv;
+	struct sta_info* 			sta = (struct sta_info* )psta;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	if(!enqueue)
+	{
+		clear_cam_entry(padapter, entry);
+	}
+	else
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+		if ( ph2c == NULL){
+			res= _FAIL;
+			goto exit;
+		}
+
+		psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+		if(psetstakey_para==NULL){
+			rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+			res=_FAIL;
+			goto exit;
+		}
+
+		psetstakey_rsp = (struct set_stakey_rsp*)rtw_zmalloc(sizeof(struct set_stakey_rsp)); 
+		if(psetstakey_rsp == NULL){
+			rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+			rtw_mfree((u8 *) psetstakey_para, sizeof(struct set_stakey_parm));
+			res=_FAIL;
+			goto exit;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+		ph2c->rsp = (u8 *) psetstakey_rsp;
+		ph2c->rspsz = sizeof(struct set_stakey_rsp);
+
+		_rtw_memcpy(psetstakey_para->addr, sta->hwaddr, ETH_ALEN);
+
+		psetstakey_para->algorithm = _NO_PRIVACY_;
+
+		psetstakey_para->id = entry;
+	
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+		
+	}
+	
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_setrttbl_cmd(_adapter  *padapter, struct setratable_parm *prate_table)
+{
+	struct cmd_obj*			ph2c;
+	struct setratable_parm *	psetrttblparm;	
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	psetrttblparm = (struct setratable_parm*)rtw_zmalloc(sizeof(struct setratable_parm)); 
+
+	if(psetrttblparm==NULL){
+		rtw_mfree((unsigned char *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetrttblparm, GEN_CMD_CODE(_SetRaTable));
+
+	_rtw_memcpy(psetrttblparm,prate_table,sizeof(struct setratable_parm));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:
+_func_exit_;	
+	return res;
+
+}
+
+u8 rtw_getrttbl_cmd(_adapter  *padapter, struct getratable_rsp *pval)
+{
+	struct cmd_obj*			ph2c;
+	struct getratable_parm *	pgetrttblparm;	
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	pgetrttblparm = (struct getratable_parm*)rtw_zmalloc(sizeof(struct getratable_parm)); 
+
+	if(pgetrttblparm==NULL){
+		rtw_mfree((unsigned char *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+//	init_h2fwcmd_w_parm_no_rsp(ph2c, psetrttblparm, GEN_CMD_CODE(_SetRaTable));
+
+	_rtw_init_listhead(&ph2c->list);
+	ph2c->cmdcode =GEN_CMD_CODE(_GetRaTable);
+	ph2c->parmbuf = (unsigned char *)pgetrttblparm;
+	ph2c->cmdsz =  sizeof(struct getratable_parm);
+	ph2c->rsp = (u8*)pval;
+	ph2c->rspsz = sizeof(struct getratable_rsp);
+	
+	pgetrttblparm ->rsvd = 0x0;
+	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+exit:
+_func_exit_;	
+	return res;
+
+}
+
+u8 rtw_setassocsta_cmd(_adapter  *padapter, u8 *mac_addr)
+{
+	struct cmd_priv 		*pcmdpriv = &padapter->cmdpriv;
+	struct cmd_obj*			ph2c;
+	struct set_assocsta_parm	*psetassocsta_para;	
+	struct set_stakey_rsp		*psetassocsta_rsp = NULL;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetassocsta_para = (struct set_assocsta_parm*)rtw_zmalloc(sizeof(struct set_assocsta_parm));
+	if(psetassocsta_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	psetassocsta_rsp = (struct set_stakey_rsp*)rtw_zmalloc(sizeof(struct set_assocsta_rsp)); 
+	if(psetassocsta_rsp==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		rtw_mfree((u8 *) psetassocsta_para, sizeof(struct set_assocsta_parm));
+		return _FAIL;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetassocsta_para, _SetAssocSta_CMD_);
+	ph2c->rsp = (u8 *) psetassocsta_rsp;
+	ph2c->rspsz = sizeof(struct set_assocsta_rsp);
+
+	_rtw_memcpy(psetassocsta_para->addr, mac_addr,ETH_ALEN);
+	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+
+exit:
+
+_func_exit_;	
+
+	return res;
+ }
+
+u8 rtw_addbareq_cmd(_adapter*padapter, u8 tid, u8 *addr)
+{
+	struct cmd_priv		*pcmdpriv = &padapter->cmdpriv;
+	struct cmd_obj*		ph2c;
+	struct addBaReq_parm	*paddbareq_parm;
+
+	u8	res=_SUCCESS;
+	
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	
+	paddbareq_parm = (struct addBaReq_parm*)rtw_zmalloc(sizeof(struct addBaReq_parm)); 
+	if(paddbareq_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	paddbareq_parm->tid = tid;
+	_rtw_memcpy(paddbareq_parm->addr, addr, ETH_ALEN);
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, paddbareq_parm, GEN_CMD_CODE(_AddBAReq));
+
+	//DBG_871X("rtw_addbareq_cmd, tid=%d\n", tid);
+
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+}
+//add for CONFIG_IEEE80211W, none 11w can use it
+u8 rtw_reset_securitypriv_cmd(_adapter*padapter)
+{
+	struct cmd_obj*		ph2c;
+	struct drvextra_cmd_parm  *pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+	
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = RESET_SECURITYPRIV;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = (u8 *)padapter;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+
+u8 rtw_free_assoc_resources_cmd(_adapter*padapter)
+{
+	struct cmd_obj*		ph2c;
+	struct drvextra_cmd_parm  *pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+	
+_func_enter_;	
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = FREE_ASSOC_RESOURCES;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = (u8 *)padapter;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+
+
+u8 rtw_dynamic_chk_wk_cmd(_adapter*padapter)
+{
+	struct cmd_obj*		ph2c;
+	struct drvextra_cmd_parm  *pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+	
+_func_enter_;	
+
+	if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		goto exit;
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->adapter_type != PRIMARY_ADAPTER && padapter->pbuddy_adapter)
+		pcmdpriv = &(padapter->pbuddy_adapter->cmdpriv);
+#endif
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = DYNAMIC_CHK_WK_CID;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = (u8 *)padapter;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+
+u8 rtw_set_ch_cmd(_adapter*padapter, u8 ch, u8 bw, u8 ch_offset, u8 enqueue)
+{
+	struct cmd_obj *pcmdobj;
+	struct set_ch_parm *set_ch_parm;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	u8 res=_SUCCESS;
+
+_func_enter_;
+
+	DBG_871X(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev), ch, bw, ch_offset);
+
+	/* check input parameter */
+
+	/* prepare cmd parameter */
+	set_ch_parm = (struct set_ch_parm *)rtw_zmalloc(sizeof(*set_ch_parm));
+	if (set_ch_parm == NULL) {
+		res= _FAIL;
+		goto exit;
+	}
+	set_ch_parm->ch = ch;
+	set_ch_parm->bw = bw;
+	set_ch_parm->ch_offset = ch_offset;
+
+	if (enqueue) {
+		/* need enqueue, prepare cmd_obj and enqueue */
+		pcmdobj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+		if(pcmdobj == NULL){
+			rtw_mfree((u8 *)set_ch_parm, sizeof(*set_ch_parm));
+			res=_FAIL;
+			goto exit;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(pcmdobj, set_ch_parm, GEN_CMD_CODE(_SetChannel));
+		res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+	} else {
+		/* no need to enqueue, do the cmd hdl directly and free cmd parameter */
+		if( H2C_SUCCESS !=set_ch_hdl(padapter, (u8 *)set_ch_parm) )
+			res = _FAIL;
+		
+		rtw_mfree((u8 *)set_ch_parm, sizeof(*set_ch_parm));
+	}
+
+	/* do something based on res... */
+
+exit:
+
+	DBG_871X(FUNC_NDEV_FMT" res:%u\n", FUNC_NDEV_ARG(padapter->pnetdev), res);
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_set_chplan_cmd(_adapter*padapter, u8 chplan, u8 enqueue)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	SetChannelPlan_param *setChannelPlan_param;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_set_chplan_cmd\n"));
+
+	//check input parameter
+	if(!rtw_is_channel_plan_valid(chplan)) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	//prepare cmd parameter
+	setChannelPlan_param = (struct	SetChannelPlan_param *)rtw_zmalloc(sizeof(struct SetChannelPlan_param));
+	if(setChannelPlan_param == NULL) {
+		res= _FAIL;
+		goto exit;
+	}
+	setChannelPlan_param->channel_plan=chplan;
+
+	if(enqueue)
+	{
+		//need enqueue, prepare cmd_obj and enqueue
+		pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+		if(pcmdobj == NULL){
+			rtw_mfree((u8 *)setChannelPlan_param, sizeof(struct SetChannelPlan_param));
+			res=_FAIL;
+			goto exit;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(pcmdobj, setChannelPlan_param, GEN_CMD_CODE(_SetChannelPlan));
+		res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+	}
+	else
+	{
+		//no need to enqueue, do the cmd hdl directly and free cmd parameter
+		if( H2C_SUCCESS !=set_chplan_hdl(padapter, (unsigned char *)setChannelPlan_param) )
+			res = _FAIL;
+		
+		rtw_mfree((u8 *)setChannelPlan_param, sizeof(struct SetChannelPlan_param));
+	}
+
+	//do something based on res...
+	if(res == _SUCCESS)
+		padapter->mlmepriv.ChannelPlan = chplan;
+	
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_led_blink_cmd(_adapter*padapter, PLED_871x pLed)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	LedBlink_param *ledBlink_param;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_led_blink_cmd\n"));
+	
+	pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmdobj == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+
+	ledBlink_param = (struct	LedBlink_param *)rtw_zmalloc(sizeof(struct	LedBlink_param));
+	if(ledBlink_param == NULL) {
+		rtw_mfree((u8 *)pcmdobj, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	ledBlink_param->pLed=pLed;
+	
+	init_h2fwcmd_w_parm_no_rsp(pcmdobj, ledBlink_param, GEN_CMD_CODE(_LedBlink));
+	res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+	
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_set_csa_cmd(_adapter*padapter, u8 new_ch_no)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	SetChannelSwitch_param*setChannelSwitch_param;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_set_csa_cmd\n"));
+	
+	pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmdobj == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+
+	setChannelSwitch_param = (struct SetChannelSwitch_param *)rtw_zmalloc(sizeof(struct	SetChannelSwitch_param));
+	if(setChannelSwitch_param == NULL) {
+		rtw_mfree((u8 *)pcmdobj, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	setChannelSwitch_param->new_ch_no=new_ch_no;
+	
+	init_h2fwcmd_w_parm_no_rsp(pcmdobj, setChannelSwitch_param, GEN_CMD_CODE(_SetChannelSwitch));
+	res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+	
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+u8 rtw_tdls_cmd(_adapter *padapter, u8 *addr, u8 option)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	TDLSoption_param	*TDLSoption;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+#ifdef CONFIG_TDLS
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_set_tdls_cmd\n"));
+
+	pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmdobj == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+
+	TDLSoption= (struct TDLSoption_param *)rtw_zmalloc(sizeof(struct TDLSoption_param));
+	if(TDLSoption == NULL) {
+		rtw_mfree((u8 *)pcmdobj, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_spinlock(&(padapter->tdlsinfo.cmd_lock));
+	_rtw_memcpy(TDLSoption->addr, addr, 6);	
+	TDLSoption->option = option;
+	_rtw_spinunlock(&(padapter->tdlsinfo.cmd_lock));
+	init_h2fwcmd_w_parm_no_rsp(pcmdobj, TDLSoption, GEN_CMD_CODE(_TDLS));
+	res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+
+#endif	//CONFIG_TDLS
+	
+exit:
+
+
+_func_exit_;	
+
+	return res;
+}
+
+static void traffic_status_watchdog(_adapter *padapter)
+{
+#ifdef CONFIG_LPS
+	u8	bEnterPS;
+#endif
+	u16	BusyThreshold = 100;
+	u8	bBusyTraffic = _FALSE, bTxBusyTraffic = _FALSE, bRxBusyTraffic = _FALSE;
+	u8	bHigherBusyTraffic = _FALSE, bHigherBusyRxTraffic = _FALSE, bHigherBusyTxTraffic = _FALSE;
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &(padapter->tdlsinfo);
+#endif //CONFIG_TDLS
+
+	RT_LINK_DETECT_T * link_detect = &pmlmepriv->LinkDetectInfo;
+
+	//
+	// Determine if our traffic is busy now
+	//
+	if((check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) 
+		/*&& !MgntInitAdapterInProgress(pMgntInfo)*/)
+	{
+
+		// if we raise bBusyTraffic in last watchdog, using lower threshold.
+		if (pmlmepriv->LinkDetectInfo.bBusyTraffic)
+			BusyThreshold = 75;
+		if( pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > BusyThreshold ||
+			pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > BusyThreshold )
+		{
+			bBusyTraffic = _TRUE;
+
+			if(pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > BusyThreshold)
+				bRxBusyTraffic = _TRUE;
+
+			if(pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > BusyThreshold)
+				bTxBusyTraffic = _TRUE;
+		}
+
+		// Higher Tx/Rx data.
+		if( pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > 4000 ||
+			pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > 4000 )
+		{
+			bHigherBusyTraffic = _TRUE;
+
+			// Extremely high Rx data.
+			if(pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > 5000)
+				bHigherBusyRxTraffic = _TRUE;
+
+			// Extremely high Tx data.
+			if(pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > 5000)
+				bHigherBusyTxTraffic = _TRUE;
+		}
+
+#ifdef CONFIG_TRAFFIC_PROTECT
+#define TX_ACTIVE_TH 2
+#define RX_ACTIVE_TH 1
+#define TRAFFIC_PROTECT_PERIOD_MS 4500
+
+	if (link_detect->NumTxOkInPeriod > TX_ACTIVE_TH
+		|| link_detect->NumRxUnicastOkInPeriod > RX_ACTIVE_TH) {
+
+		LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT" acqiure wake_lock for %u ms(tx:%d,rx_unicast:%d)\n",
+			FUNC_ADPT_ARG(padapter),
+			TRAFFIC_PROTECT_PERIOD_MS,
+			link_detect->NumTxOkInPeriod,
+			link_detect->NumRxUnicastOkInPeriod);
+
+		rtw_lock_suspend_timeout(TRAFFIC_PROTECT_PERIOD_MS);
+	}
+#endif
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_TDLS_AUTOSETUP
+		if( ( ptdlsinfo->watchdog_count % TDLS_WATCHDOG_PERIOD ) == 0 )	//TDLS_WATCHDOG_PERIOD * 2sec, periodically sending
+			issue_tdls_dis_req( padapter, NULL );
+		ptdlsinfo->watchdog_count++;
+#endif //CONFIG_TDLS_AUTOSETUP
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_LPS
+		// check traffic for  powersaving.
+		if( ((pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod + pmlmepriv->LinkDetectInfo.NumTxOkInPeriod) > 8 ) ||
+			(pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod > 2) )
+		{
+			//DBG_871X("Tx = %d, Rx = %d \n",pmlmepriv->LinkDetectInfo.NumTxOkInPeriod,pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod);
+			bEnterPS= _FALSE;
+		}
+		else
+		{
+			bEnterPS= _TRUE;
+		}
+
+		// LeisurePS only work in infra mode.
+		if(bEnterPS)
+		{
+			LPS_Enter(padapter);
+		}
+		else
+		{
+			LPS_Leave(padapter);
+		}
+#endif
+	}
+	else
+	{
+#ifdef CONFIG_LPS
+		LPS_Leave(padapter);
+#endif
+	}
+
+	pmlmepriv->LinkDetectInfo.NumRxOkInPeriod = 0;
+	pmlmepriv->LinkDetectInfo.NumTxOkInPeriod = 0;
+	pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod = 0;
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = bBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bTxBusyTraffic = bTxBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bRxBusyTraffic = bRxBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bHigherBusyTraffic = bHigherBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bHigherBusyRxTraffic = bHigherBusyRxTraffic;
+	pmlmepriv->LinkDetectInfo.bHigherBusyTxTraffic = bHigherBusyTxTraffic;
+	
+}
+
+void dynamic_chk_wk_hdl(_adapter *padapter, u8 *pbuf, int sz);
+void dynamic_chk_wk_hdl(_adapter *padapter, u8 *pbuf, int sz)
+{
+	struct mlme_priv *pmlmepriv;
+	
+	if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		return;
+
+	if((void*)padapter != (void*)pbuf && padapter->pbuddy_adapter == NULL)
+		return;		
+
+	padapter = (_adapter *)pbuf;
+
+	if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		return;
+
+	pmlmepriv = &(padapter->mlmepriv);
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{			
+		expire_timeout_chk(padapter);
+	}
+#endif
+#endif //CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+
+	#ifdef DBG_CONFIG_ERROR_DETECT	
+	rtw_hal_sreset_xmit_status_check(padapter);
+	#endif	
+
+	//if(check_fwstate(pmlmepriv, _FW_UNDER_LINKING|_FW_UNDER_SURVEY)==_FALSE)
+	{
+		linked_status_chk(padapter);	
+		traffic_status_watchdog(padapter);
+	}
+
+	rtw_hal_dm_watchdog(padapter);
+
+	//check_hw_pbc(padapter, pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);	
+
+}
+
+#ifdef CONFIG_LPS
+
+void lps_ctrl_wk_hdl(_adapter *padapter, u8 lps_ctrl_type);
+void lps_ctrl_wk_hdl(_adapter *padapter, u8 lps_ctrl_type)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	u8	mstatus;
+	
+_func_enter_;
+
+	if((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)
+		|| (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))
+	{
+		return;
+	}
+
+	switch(lps_ctrl_type)
+	{
+		case LPS_CTRL_SCAN:
+			//DBG_871X("LPS_CTRL_SCAN \n");
+			LeaveAllPowerSaveMode(padapter);
+			break;
+		case LPS_CTRL_JOINBSS:
+			//DBG_871X("LPS_CTRL_JOINBSS \n");
+			LPS_Leave(padapter);
+			break;
+		case LPS_CTRL_CONNECT:
+			//DBG_871X("LPS_CTRL_CONNECT \n");
+			mstatus = 1;
+			// Reset LPS Setting
+			padapter->pwrctrlpriv.LpsIdleCount = 0;
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_JOINBSSRPT, (u8 *)(&mstatus));
+			break;
+		case LPS_CTRL_DISCONNECT:
+			//DBG_871X("LPS_CTRL_DISCONNECT \n");
+			mstatus = 0;
+			LPS_Leave(padapter);
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_JOINBSSRPT, (u8 *)(&mstatus));
+			break;
+		case LPS_CTRL_SPECIAL_PACKET:
+			//DBG_871X("LPS_CTRL_SPECIAL_PACKET \n");
+			pwrpriv->DelayLPSLastTimeStamp = rtw_get_current_time();
+			LPS_Leave(padapter);
+			break;
+
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+u8 rtw_lps_ctrl_wk_cmd(_adapter*padapter, u8 lps_ctrl_type, u8 enqueue)
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	//struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+	u8	res = _SUCCESS;
+	
+_func_enter_;
+
+	//if(!pwrctrlpriv->bLeisurePs)
+	//	return res;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->iface_type != IFACE_PORT0)
+		return res;
+#endif
+
+	if(enqueue)
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+		if(ph2c==NULL){
+			res= _FAIL;
+			goto exit;
+		}
+		
+		pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+		if(pdrvextra_cmd_parm==NULL){
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm->ec_id = LPS_CTRL_WK_CID;
+		pdrvextra_cmd_parm->type_size = lps_ctrl_type;
+		pdrvextra_cmd_parm->pbuf = NULL;
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+	else
+	{
+		lps_ctrl_wk_hdl(padapter, lps_ctrl_type);
+	}
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+
+#endif
+#ifdef CONFIG_ANTENNA_DIVERSITY
+
+void antenna_select_wk_hdl(_adapter *padapter, u8 antenna)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_ANTENNA_DIVERSITY_SELECT, (u8 *)(&antenna));
+}
+
+u8 rtw_antenna_select_cmd(_adapter*padapter, u8 antenna,u8 enqueue)
+{
+	struct cmd_obj		*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8 	bSupportAntDiv = _FALSE;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+	rtw_hal_get_def_var(padapter, HAL_DEF_IS_SUPPORT_ANT_DIV, &(bSupportAntDiv));
+	if(_FALSE == bSupportAntDiv )	return res;
+
+	if(_TRUE == enqueue)
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+		if(ph2c==NULL){
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+		if(pdrvextra_cmd_parm==NULL){
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm->ec_id = ANT_SELECT_WK_CID;
+		pdrvextra_cmd_parm->type_size = antenna;
+		pdrvextra_cmd_parm->pbuf = NULL;
+		init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+	else{
+		antenna_select_wk_hdl(padapter,antenna );
+	}
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+#endif
+
+void power_saving_wk_hdl(_adapter *padapter, u8 *pbuf, int sz);
+void power_saving_wk_hdl(_adapter *padapter, u8 *pbuf, int sz)
+{
+	 rtw_ps_processor(padapter);
+}
+
+//add for CONFIG_IEEE80211W, none 11w can use it
+void reset_securitypriv_hdl(_adapter *padapter)
+{
+	 rtw_reset_securitypriv(padapter);
+}
+
+void free_assoc_resources_hdl(_adapter *padapter)
+{
+	 rtw_free_assoc_resources(padapter, 1);
+}
+
+#ifdef CONFIG_P2P
+u8 p2p_protocol_wk_cmd(_adapter*padapter, int intCmdType )
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+	
+_func_enter_;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		return res;
+	}
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+			
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = P2P_PROTO_WK_CID;
+	pdrvextra_cmd_parm->type_size = intCmdType;	//	As the command tppe.
+	pdrvextra_cmd_parm->pbuf = NULL;		//	Must be NULL here
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+#endif //CONFIG_P2P
+
+u8 rtw_ps_cmd(_adapter*padapter)
+{
+	struct cmd_obj		*ppscmd;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	
+	u8	res = _SUCCESS;
+_func_enter_;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->adapter_type != PRIMARY_ADAPTER)
+		goto exit;
+#endif
+	
+	ppscmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ppscmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+		
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ppscmd, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = POWER_SAVING_CTRL_WK_CID;	
+	pdrvextra_cmd_parm->pbuf = NULL;
+	init_h2fwcmd_w_parm_no_rsp(ppscmd, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ppscmd);
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+
+#ifdef CONFIG_AP_MODE
+
+static void rtw_chk_hi_queue_hdl(_adapter *padapter)
+{
+	int cnt=0;
+	struct sta_info *psta_bmc;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	psta_bmc = rtw_get_bcmc_stainfo(padapter);
+	if(!psta_bmc)
+		return;
+
+
+	if(psta_bmc->sleepq_len==0)
+	{
+		while((rtw_read32(padapter, 0x414)&0x00ffff00)!=0)
+		{
+			rtw_msleep_os(100);
+
+			cnt++;
+			
+			if(cnt>10)
+				break;	
+		}
+
+		if(cnt<=10)
+		{
+			pstapriv->tim_bitmap &= ~BIT(0);
+			pstapriv->sta_dz_bitmap &= ~BIT(0);
+			
+			update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+		}	
+	}	
+	
+}
+
+u8 rtw_chk_hi_queue_cmd(_adapter*padapter)
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;	
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+	
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+			
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = CHECK_HIQ_WK_CID;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = NULL;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+	return res;
+
+}
+#endif
+
+u8 rtw_c2h_wk_cmd(PADAPTER padapter, u8 *c2h_evt)
+{
+	struct cmd_obj *ph2c;
+	struct drvextra_cmd_parm *pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if (pdrvextra_cmd_parm == NULL) {
+		rtw_mfree((u8*)ph2c, sizeof(struct cmd_obj));
+		res = _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = C2H_WK_CID;
+	pdrvextra_cmd_parm->type_size = c2h_evt?16:0;
+	pdrvextra_cmd_parm->pbuf = c2h_evt;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	
+exit:
+	
+	return res;
+}
+
+s32 c2h_evt_hdl(_adapter *adapter, struct c2h_evt_hdr *c2h_evt, c2h_id_filter filter)
+{
+	s32 ret = _FAIL;
+	u8 buf[16];
+
+	if (!c2h_evt) {
+		/* No c2h event in cmd_obj, read c2h event before handling*/
+		if (c2h_evt_read(adapter, buf) == _SUCCESS) {
+			c2h_evt = (struct c2h_evt_hdr *)buf;
+			
+			if (filter && filter(c2h_evt->id) == _FALSE)
+				goto exit;
+
+			ret = rtw_hal_c2h_handler(adapter, c2h_evt);
+		}
+	} else {
+
+		if (filter && filter(c2h_evt->id) == _FALSE)
+			goto exit;
+
+		ret = rtw_hal_c2h_handler(adapter, c2h_evt);
+	}
+exit:
+	return ret;
+}
+
+#ifdef CONFIG_C2H_WK
+static void c2h_wk_callback(_workitem *work)
+{
+	struct evt_priv *evtpriv = container_of(work, struct evt_priv, c2h_wk);
+	_adapter *adapter = container_of(evtpriv, _adapter, evtpriv);
+	struct c2h_evt_hdr *c2h_evt;
+	c2h_id_filter ccx_id_filter = rtw_hal_c2h_id_filter_ccx(adapter);
+
+	evtpriv->c2h_wk_alive = _TRUE;
+
+	while (!rtw_cbuf_empty(evtpriv->c2h_queue)) {
+		if ((c2h_evt = (struct c2h_evt_hdr *)rtw_cbuf_pop(evtpriv->c2h_queue)) != NULL) {
+			/* This C2H event is read, clear it */
+			c2h_evt_clear(adapter);
+		} else if ((c2h_evt = (struct c2h_evt_hdr *)rtw_malloc(16)) != NULL) {
+			/* This C2H event is not read, read & clear now */
+			if (c2h_evt_read(adapter, (u8*)c2h_evt) != _SUCCESS)
+				continue;
+		}
+
+		/* Special pointer to trigger c2h_evt_clear only */
+		if ((void *)c2h_evt == (void *)evtpriv)
+			continue;
+
+		if (!c2h_evt_exist(c2h_evt)) {
+			rtw_mfree((u8*)c2h_evt, 16);
+			continue;
+		}
+		
+		if (ccx_id_filter(c2h_evt->id) == _TRUE) {
+			/* Handle CCX report here */
+			rtw_hal_c2h_handler(adapter, c2h_evt);
+			rtw_mfree((u8*)c2h_evt, 16);
+		} else {
+			/* Enqueue into cmd_thread for others */
+			rtw_c2h_wk_cmd(adapter, (u8 *)c2h_evt);
+		}
+	}
+
+	evtpriv->c2h_wk_alive = _FALSE;
+}
+#endif
+
+u8 rtw_drvextra_cmd_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct drvextra_cmd_parm *pdrvextra_cmd;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	pdrvextra_cmd = (struct drvextra_cmd_parm*)pbuf;
+	
+	switch(pdrvextra_cmd->ec_id)
+	{
+		case DYNAMIC_CHK_WK_CID:
+			dynamic_chk_wk_hdl(padapter, pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);
+			break;
+		case POWER_SAVING_CTRL_WK_CID:
+			power_saving_wk_hdl(padapter, pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);	
+			break;
+#ifdef CONFIG_LPS
+		case LPS_CTRL_WK_CID:
+			lps_ctrl_wk_hdl(padapter, (u8)pdrvextra_cmd->type_size);
+			break;
+#endif
+#ifdef CONFIG_ANTENNA_DIVERSITY
+		case ANT_SELECT_WK_CID:
+			antenna_select_wk_hdl(padapter, pdrvextra_cmd->type_size);
+			break;
+#endif
+#ifdef CONFIG_P2P_PS
+		case P2P_PS_WK_CID:
+			p2p_ps_wk_hdl(padapter, pdrvextra_cmd->type_size);
+			break;
+#endif // CONFIG_P2P_PS
+		case P2P_PROTO_WK_CID:
+			//	Commented by Albert 2011/07/01
+			//	I used the type_size as the type command
+			p2p_protocol_wk_hdl( padapter, pdrvextra_cmd->type_size );
+			break;
+#ifdef CONFIG_AP_MODE
+		case CHECK_HIQ_WK_CID:
+			rtw_chk_hi_queue_hdl(padapter);
+			break;
+#endif //CONFIG_AP_MODE
+#ifdef CONFIG_INTEL_WIDI
+		case INTEl_WIDI_WK_CID:
+			intel_widi_wk_hdl(padapter, pdrvextra_cmd->type_size, pdrvextra_cmd->pbuf);
+			break;
+#endif //CONFIG_INTEL_WIDI
+		//add for CONFIG_IEEE80211W, none 11w can use it
+		case RESET_SECURITYPRIV:
+			reset_securitypriv_hdl(padapter);
+			break;
+		case FREE_ASSOC_RESOURCES:
+			free_assoc_resources_hdl(padapter);
+			break;
+		case C2H_WK_CID:
+			c2h_evt_hdl(padapter, (struct c2h_evt_hdr *)pdrvextra_cmd->pbuf, NULL);
+			break;
+
+		default:
+			break;
+	}
+
+
+	if(pdrvextra_cmd->pbuf && pdrvextra_cmd->type_size>0)
+	{
+		rtw_mfree(pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);
+	}
+
+
+	return H2C_SUCCESS;
+
+}
+
+void rtw_survey_cmd_callback(_adapter*	padapter ,  struct cmd_obj *pcmd)
+{
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if(pcmd->res == H2C_DROPPED)
+	{
+		//TODO: cancel timer and do timeout handler directly...
+		//need to make timeout handlerOS independent
+		_set_timer(&pmlmepriv->scan_to_timer, 1);
+	}
+	else if (pcmd->res != H2C_SUCCESS) {
+		_set_timer(&pmlmepriv->scan_to_timer, 1);
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n ********Error: MgntActrtw_set_802_11_bssid_LIST_SCAN Fail ************\n\n."));
+	} 
+
+	// free cmd
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;	
+}
+void rtw_disassoc_cmd_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+	_irqL	irqL;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	
+_func_enter_;	
+
+	if (pcmd->res != H2C_SUCCESS)
+	{
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+		set_fwstate(pmlmepriv, _FW_LINKED);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+				
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n ***Error: disconnect_cmd_callback Fail ***\n."));
+
+		goto exit;
+	}
+#ifdef CONFIG_BR_EXT
+	else //clear bridge database
+		nat25_db_cleanup(padapter);
+#endif //CONFIG_BR_EXT
+
+	// free cmd
+	rtw_free_cmd_obj(pcmd);
+	
+exit:
+	
+_func_exit_;	
+}
+
+
+void rtw_joinbss_cmd_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;	
+
+	if(pcmd->res == H2C_DROPPED)
+	{
+		//TODO: cancel timer and do timeout handler directly...
+		//need to make timeout handlerOS independent
+		_set_timer(&pmlmepriv->assoc_timer, 1);
+	}
+	else if(pcmd->res != H2C_SUCCESS)
+	{				
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("********Error:rtw_select_and_join_from_scanned_queue Wait Sema  Fail ************\n"));
+		_set_timer(&pmlmepriv->assoc_timer, 1);	
+	}
+	
+	rtw_free_cmd_obj(pcmd);
+	
+_func_exit_;	
+}
+
+void rtw_createbss_cmd_callback(_adapter *padapter, struct cmd_obj *pcmd)
+{	
+	_irqL irqL;
+	u8 timer_cancelled;
+	struct sta_info *psta = NULL;
+	struct wlan_network *pwlan = NULL;		
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;	
+	WLAN_BSSID_EX *pnetwork = (WLAN_BSSID_EX *)pcmd->parmbuf;
+	struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
+
+_func_enter_;	
+
+	if((pcmd->res != H2C_SUCCESS))
+	{	
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n ********Error: rtw_createbss_cmd_callback  Fail ************\n\n."));
+		_set_timer(&pmlmepriv->assoc_timer, 1 );		
+	}
+	
+	_cancel_timer(&pmlmepriv->assoc_timer, &timer_cancelled);
+
+#ifdef CONFIG_FW_MLMLE
+       //endian_convert
+	pnetwork->Length = le32_to_cpu(pnetwork->Length);
+  	pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
+	pnetwork->Privacy =le32_to_cpu(pnetwork->Privacy);
+	pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
+	pnetwork->NetworkTypeInUse =le32_to_cpu(pnetwork->NetworkTypeInUse);	
+	pnetwork->Configuration.ATIMWindow = le32_to_cpu(pnetwork->Configuration.ATIMWindow);
+	//pnetwork->Configuration.BeaconPeriod = le32_to_cpu(pnetwork->Configuration.BeaconPeriod);
+	pnetwork->Configuration.DSConfig =le32_to_cpu(pnetwork->Configuration.DSConfig);
+	pnetwork->Configuration.FHConfig.DwellTime=le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
+	pnetwork->Configuration.FHConfig.HopPattern=le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
+	pnetwork->Configuration.FHConfig.HopSet=le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
+	pnetwork->Configuration.FHConfig.Length=le32_to_cpu(pnetwork->Configuration.FHConfig.Length);	
+	pnetwork->Configuration.Length = le32_to_cpu(pnetwork->Configuration.Length);
+	pnetwork->InfrastructureMode = le32_to_cpu(pnetwork->InfrastructureMode);
+	pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
+#endif
+	
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	
+	
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) )
+	{
+		psta = rtw_get_stainfo(&padapter->stapriv, pnetwork->MacAddress);
+		if(!psta)
+		{
+		psta = rtw_alloc_stainfo(&padapter->stapriv, pnetwork->MacAddress);
+		if (psta == NULL) 
+		{ 
+			RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nCan't alloc sta_info when createbss_cmd_callback\n"));
+			goto createbss_cmd_fail ;
+		}
+		}	
+			
+		rtw_indicate_connect( padapter);
+	}
+	else
+	{	
+		_irqL	irqL;
+
+		pwlan = _rtw_alloc_network(pmlmepriv);
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		if ( pwlan == NULL)
+		{
+			pwlan = rtw_get_oldest_wlan_network(&pmlmepriv->scanned_queue);
+			if( pwlan == NULL)
+			{
+				RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n Error:  can't get pwlan in rtw_joinbss_event_callback \n"));
+				_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+				goto createbss_cmd_fail;
+			}
+			pwlan->last_scanned = rtw_get_current_time();			
+		}	
+		else
+		{
+			rtw_list_insert_tail(&(pwlan->list), &pmlmepriv->scanned_queue.queue);
+		}
+				
+		pnetwork->Length = get_WLAN_BSSID_EX_sz(pnetwork);
+		_rtw_memcpy(&(pwlan->network), pnetwork, pnetwork->Length);
+		//pwlan->fixed = _TRUE;
+
+		//rtw_list_insert_tail(&(pwlan->list), &pmlmepriv->scanned_queue.queue);
+
+		// copy pdev_network information to 	pmlmepriv->cur_network
+		_rtw_memcpy(&tgt_network->network, pnetwork, (get_WLAN_BSSID_EX_sz(pnetwork)));
+
+		// reset DSConfig
+		//tgt_network->network.Configuration.DSConfig = (u32)rtw_ch2freq(pnetwork->Configuration.DSConfig);
+
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+#if 0		
+		if((pmlmepriv->fw_state) & WIFI_AP_STATE)
+		{
+			psta = rtw_alloc_stainfo(&padapter->stapriv, pnetwork->MacAddress);
+
+			if (psta == NULL) { // for AP Mode & Adhoc Master Mode
+				RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nCan't alloc sta_info when createbss_cmd_callback\n"));
+				goto createbss_cmd_fail ;
+			}
+			
+			rtw_indicate_connect( padapter);
+		}
+		else {
+
+			//rtw_indicate_disconnect(dev);
+		}		
+#endif
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		// we will set _FW_LINKED when there is one more sat to join us (rtw_stassoc_event_callback)
+			
+	}
+
+createbss_cmd_fail:
+	
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	rtw_free_cmd_obj(pcmd);
+	
+_func_exit_;	
+
+}
+
+
+
+void rtw_setstaKey_cmdrsp_callback(_adapter*	padapter ,  struct cmd_obj *pcmd)
+{
+	
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct set_stakey_rsp* psetstakey_rsp = (struct set_stakey_rsp*) (pcmd->rsp);
+	struct sta_info*	psta = rtw_get_stainfo(pstapriv, psetstakey_rsp->addr);
+
+_func_enter_;	
+
+	if(psta==NULL)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nERROR: rtw_setstaKey_cmdrsp_callback => can't get sta_info \n\n"));
+		goto exit;
+	}
+	
+	//psta->aid = psta->mac_id = psetstakey_rsp->keyid; //CAM_ID(CAM_ENTRY)
+	
+exit:	
+
+	rtw_free_cmd_obj(pcmd);
+	
+_func_exit_;	
+
+}
+void rtw_setassocsta_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+	_irqL	irqL;
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;	
+	struct set_assocsta_parm* passocsta_parm = (struct set_assocsta_parm*)(pcmd->parmbuf);
+	struct set_assocsta_rsp* passocsta_rsp = (struct set_assocsta_rsp*) (pcmd->rsp);		
+	struct sta_info*	psta = rtw_get_stainfo(pstapriv, passocsta_parm->addr);
+
+_func_enter_;	
+	
+	if(psta==NULL)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nERROR: setassocsta_cmdrsp_callbac => can't get sta_info \n\n"));
+		goto exit;
+	}
+	
+	psta->aid = psta->mac_id = passocsta_rsp->cam_id;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE) && (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE))           	
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+       set_fwstate(pmlmepriv, _FW_LINKED);       	   
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:	  
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;	  
+}
+
+void rtw_getrttbl_cmd_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd);
+void rtw_getrttbl_cmd_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+_func_enter_;	
+	  
+	rtw_free_cmd_obj(pcmd);
+#ifdef CONFIG_MP_INCLUDED
+	padapter->mppriv.workparam.bcompleted=_TRUE;
+#endif
+
+_func_exit_;	  
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c
new file mode 100755
index 0000000000000..f70fcb7b2cd13
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c
@@ -0,0 +1,1337 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_DEBUG_C_
+
+
+#include <rtw_debug.h>
+#include <../hal/dm.h>
+
+//#ifdef CONFIG_DEBUG_RTL871X
+
+	u32 GlobalDebugLevel = _drv_err_;
+
+	u64 GlobalDebugComponents = \
+			_module_rtl871x_xmit_c_ |
+			_module_xmit_osdep_c_ |
+			_module_rtl871x_recv_c_ |
+			_module_recv_osdep_c_ |
+			_module_rtl871x_mlme_c_ |
+			_module_mlme_osdep_c_ |
+			_module_rtl871x_sta_mgt_c_ |
+			_module_rtl871x_cmd_c_ |
+			_module_cmd_osdep_c_ |
+			_module_rtl871x_io_c_ |
+			_module_io_osdep_c_ |
+			_module_os_intfs_c_|
+			_module_rtl871x_security_c_|
+			_module_rtl871x_eeprom_c_|
+			_module_hal_init_c_|
+			_module_hci_hal_init_c_|
+			_module_rtl871x_ioctl_c_|
+			_module_rtl871x_ioctl_set_c_|
+			_module_rtl871x_ioctl_query_c_|
+			_module_rtl871x_pwrctrl_c_|
+			_module_hci_intfs_c_|
+			_module_hci_ops_c_|
+			_module_hci_ops_os_c_|
+			_module_rtl871x_ioctl_os_c|
+			_module_rtl8712_cmd_c_|
+			_module_hal_xmit_c_|
+			_module_rtl8712_recv_c_ |
+			_module_mp_ |
+			_module_efuse_;
+
+//#endif
+
+#ifdef CONFIG_PROC_DEBUG
+#include <rtw_version.h>
+
+int proc_get_drv_version(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "%s\n", DRIVERVERSION);
+				
+	*eof = 1;
+	return len;
+}
+
+int proc_get_log_level(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"log_level:%d\n",
+		GlobalDebugLevel
+		);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_log_level(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 is_signal_dbg;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%d ", &is_signal_dbg);
+
+		if( is_signal_dbg >= 0 && is_signal_dbg < 10 )
+		{
+			GlobalDebugLevel= is_signal_dbg;
+			printk("%d\n", GlobalDebugLevel);
+		}
+	}
+	
+	return count;
+	
+}
+
+#ifdef DBG_MEM_ALLOC
+int proc_get_mstat(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{	
+	int len = 0;
+
+	len += _rtw_mstat_dump(page+len, count-len);
+	*eof = 1;
+
+	return len;
+}
+#endif /* DBG_MEM_ALLOC */
+
+int proc_get_write_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	*eof = 1;
+	return 0;
+}
+
+int proc_set_write_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 addr, val, len;
+
+	if (count < 3)
+	{
+		DBG_871X("argument size is less than 3\n");
+		return -EFAULT;
+	}	
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+
+		if (num !=  3) {
+			DBG_871X("invalid write_reg parameter!\n");
+			return count;
+		}
+
+		switch(len)
+		{
+			case 1:
+				rtw_write8(padapter, addr, (u8)val);				
+				break;
+			case 2:
+				rtw_write16(padapter, addr, (u16)val);				
+				break;
+			case 4:
+				rtw_write32(padapter, addr, val);				
+				break;
+			default:
+				DBG_871X("error write length=%d", len);
+				break;
+		}			
+		
+	}
+	
+	return count;
+	
+}
+
+static u32 proc_get_read_addr=0xeeeeeeee;
+static u32 proc_get_read_len=0x4;
+
+int proc_get_read_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{	
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	
+	int len = 0;
+
+	if(proc_get_read_addr==0xeeeeeeee)
+	{
+		*eof = 1;
+		return len;
+	}	
+
+	switch(proc_get_read_len)
+	{
+		case 1:			
+			len += snprintf(page + len, count - len, "rtw_read8(0x%x)=0x%x\n", proc_get_read_addr, rtw_read8(padapter, proc_get_read_addr));
+			break;
+		case 2:
+			len += snprintf(page + len, count - len, "rtw_read16(0x%x)=0x%x\n", proc_get_read_addr, rtw_read16(padapter, proc_get_read_addr));
+			break;
+		case 4:
+			len += snprintf(page + len, count - len, "rtw_read32(0x%x)=0x%x\n", proc_get_read_addr, rtw_read32(padapter, proc_get_read_addr));
+			break;
+		default:
+			len += snprintf(page + len, count - len, "error read length=%d\n", proc_get_read_len);
+			break;
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_set_read_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	char tmp[16];
+	u32 addr, len;
+
+	if (count < 2)
+	{
+		DBG_871X("argument size is less than 2\n");
+		return -EFAULT;
+	}	
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%x %x", &addr, &len);
+
+		if (num !=  2) {
+			DBG_871X("invalid read_reg parameter!\n");
+			return count;
+		}
+
+		proc_get_read_addr = addr;
+		
+		proc_get_read_len = len;
+	}
+	
+	return count;
+
+}
+
+int proc_get_fwstate(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "fwstate=0x%x\n", get_fwstate(pmlmepriv));
+				
+	*eof = 1;
+	return len;
+}
+
+int proc_get_sec_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "auth_alg=0x%x, enc_alg=0x%x, auth_type=0x%x, enc_type=0x%x\n", 
+						psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm,
+						psecuritypriv->ndisauthtype, psecuritypriv->ndisencryptstatus);
+				
+	*eof = 1;
+	return len;
+}
+
+int proc_get_mlmext_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "pmlmeinfo->state=0x%x\n", pmlmeinfo->state);
+				
+	*eof = 1;
+	return len;
+}
+
+int proc_get_qos_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "qos_option=%d\n", pmlmepriv->qospriv.qos_option);
+				
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_ht_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "ht_option=%d\n", pmlmepriv->htpriv.ht_option);
+				
+	*eof = 1;
+	return len;
+}
+
+int proc_get_rf_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "cur_ch=%d, cur_bw=%d, cur_ch_offet=%d\n"
+		"oper_ch=%d, oper_bw=%d, oper_ch_offet=%d\n",
+		pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset,
+		rtw_get_oper_ch(padapter), rtw_get_oper_bw(padapter), rtw_get_oper_choffset(padapter));
+	*eof = 1;
+
+	return len;
+}
+
+int proc_get_ap_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct sta_info *psta;
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wlan_network *cur_network = &(pmlmepriv->cur_network);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	int len = 0;
+
+	psta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
+	if(psta)
+	{
+		int i;
+		struct recv_reorder_ctrl *preorder_ctrl;
+					
+		len += snprintf(page + len, count - len, "SSID=%s\n", cur_network->network.Ssid.Ssid);		
+		len += snprintf(page + len, count - len, "sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+		len += snprintf(page + len, count - len, "cur_channel=%d, cur_bwmode=%d, cur_ch_offset=%d\n", pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);		
+		len += snprintf(page + len, count - len, "rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+		len += snprintf(page + len, count - len, "qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);	
+		len += snprintf(page + len, count - len, "state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);	
+		len += snprintf(page + len, count - len, "bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);						
+		len += snprintf(page + len, count - len, "ampdu_enable = %d\n", psta->htpriv.ampdu_enable);	
+		len += snprintf(page + len, count - len, "agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+					
+		for(i=0;i<16;i++)
+		{							
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+			if(preorder_ctrl->enable)
+			{
+				len += snprintf(page + len, count - len, "tid=%d, indicate_seq=%d\n", i, preorder_ctrl->indicate_seq);
+			}
+		}	
+							
+	}
+	else
+	{							
+		len += snprintf(page + len, count - len, "can't get sta's macaddr, cur_network's macaddr:" MAC_FMT "\n", MAC_ARG(cur_network->network.MacAddress));
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_adapter_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	
+	len += snprintf(page + len, count - len, "bSurpriseRemoved=%d, bDriverStopped=%d\n", 
+						padapter->bSurpriseRemoved, padapter->bDriverStopped);
+
+	*eof = 1;
+	return len;
+
+}
+	
+int proc_get_trx_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	int i;
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct recv_priv  *precvpriv = &padapter->recvpriv;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(padapter);
+        struct hw_xmit *phwxmit;
+	int len = 0;
+	
+	len += snprintf(page + len, count - len, "free_xmitbuf_cnt=%d, free_xmitframe_cnt=%d"
+				", free_ext_xmitbuf_cnt=%d, free_xframe_ext_cnt=%d"
+				", free_recvframe_cnt=%d\n",
+				pxmitpriv->free_xmitbuf_cnt, pxmitpriv->free_xmitframe_cnt,
+				pxmitpriv->free_xmit_extbuf_cnt, pxmitpriv->free_xframe_ext_cnt,
+				precvpriv->free_recvframe_cnt);
+#ifdef CONFIG_USB_HCI
+	len += snprintf(page + len, count - len, "rx_urb_pending_cnt=%d\n", precvpriv->rx_pending_cnt);
+#endif
+
+	len += snprintf(page + len, count - len, "recvbuf_skb_alloc_fail_cnt=%d\n", precvpriv->recvbuf_skb_alloc_fail_cnt);
+	len += snprintf(page + len, count - len, "recvbuf_null_cnt=%d\n", precvpriv->recvbuf_null_cnt);
+	len += snprintf(page + len, count - len, "read_port_complete_EINPROGRESS_cnt=%d\n", precvpriv->read_port_complete_EINPROGRESS_cnt);
+	len += snprintf(page + len, count - len, "read_port_complete_other_urb_err_cnt=%d\n", precvpriv->read_port_complete_other_urb_err_cnt);
+	len += snprintf(page + len, count - len, "hw_init_completed=%d\n", padapter->hw_init_completed);
+#ifdef CONFIG_USB_HCI
+	len += snprintf(page + len, count - len, "continual_urb_error=%d\n", atomic_read(&pdvobj->continual_urb_error));
+#endif
+
+        for(i = 0; i < 4; i++) 
+	{
+		phwxmit = pxmitpriv->hwxmits + i;
+		len += snprintf(page + len, count - len, "%d, hwq.accnt=%d\n", i, phwxmit->accnt);
+	}
+
+	*eof = 1;
+	return len;
+
+}
+	
+		
+
+int proc_get_mac_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= MAC REG =======\n");
+
+	for(i=0x0;i<0x300;i+=4)
+	{	
+		if(j%4==1)	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");	
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_mac_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= MAC REG =======\n");
+	memset(page, 0, count);
+	for(i=0x300;i<0x600;i+=4)
+	{	
+		if(j%4==1)	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");	
+	}
+	
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_mac_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= MAC REG =======\n");
+
+	for(i=0x600;i<0x800;i+=4)
+	{	
+		if(j%4==1)	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");	
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_bb_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	int len = 0;
+	int i,j=1;		
+
+	len += snprintf(page + len, count - len, "\n======= BB REG =======\n");	
+	for(i=0x800;i<0xB00;i+=4)
+	{
+		if(j%4==1) 	len += snprintf(page + len, count - len,"0x%02x",i);		
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");	
+	}
+	*eof = 1;
+	return len;	
+}
+
+int proc_get_bb_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	int len = 0;
+	int i,j=1;		
+
+	len += snprintf(page + len, count - len, "\n======= BB REG =======\n");	
+	for(i=0xB00;i<0xE00;i+=4)
+	{
+		if(j%4==1) 	len += snprintf(page + len, count - len,"0x%02x",i);		
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");	
+	}
+	*eof = 1;
+	return len;	
+}
+
+int proc_get_bb_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	int len = 0;
+	int i,j=1;		
+
+	len += snprintf(page + len, count - len, "\n======= BB REG =======\n");	
+	for(i=0xE00;i<0x1000;i+=4)
+	{
+		if(j%4==1) 	len += snprintf(page + len, count - len,"0x%02x",i);		
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");	
+	}
+	*eof = 1;
+	return len;	
+}
+
+int proc_get_rf_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;
+	
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 1;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0;i<0xC0;i++)
+	{								
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");	
+	}
+
+	*eof = 1;
+	return len;	
+}
+
+
+int proc_get_rf_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;	
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");	
+	path = 1;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0xC0;i<0x100;i++)
+	{								
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");	
+	}
+	*eof = 1;
+	return len;	
+}
+
+
+int proc_get_rf_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;	
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 2;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0;i<0xC0;i++)
+	{								
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");	
+	}
+
+	*eof = 1;
+	return len;	
+}
+
+
+int proc_get_rf_reg_dump4(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 2;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0xC0;i<0x100;i++)
+	{								
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");
+	}
+	*eof = 1;
+	return len;	
+}
+
+
+		
+int proc_get_rx_signal(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"rssi:%d\n"
+		"rxpwdb:%d\n"
+		"signal_strength:%u\n"
+		"signal_qual:%u\n"
+		"noise:%u\n", 
+		padapter->recvpriv.rssi,
+		padapter->recvpriv.rxpwdb,
+		padapter->recvpriv.signal_strength,
+		padapter->recvpriv.signal_qual,
+		padapter->recvpriv.noise
+		);
+				
+	*eof = 1;
+	return len;
+}
+
+int proc_set_rx_signal(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 is_signal_dbg, signal_strength;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%u %u", &is_signal_dbg, &signal_strength);
+
+		is_signal_dbg = is_signal_dbg==0?0:1;
+		
+		if(is_signal_dbg && num!=2)
+			return count;
+			
+		signal_strength = signal_strength>100?100:signal_strength;
+		signal_strength = signal_strength<0?0:signal_strength;
+
+		padapter->recvpriv.is_signal_dbg = is_signal_dbg;
+		padapter->recvpriv.signal_strength_dbg=signal_strength;
+
+		if(is_signal_dbg)
+			DBG_871X("set %s %u\n", "DBG_SIGNAL_STRENGTH", signal_strength);
+		else
+			DBG_871X("set %s\n", "HW_SIGNAL_STRENGTH");
+		
+	}
+	
+	return count;
+	
+}
+
+int proc_get_ht_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	
+	int len = 0;
+	
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->ht_enable
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_ht_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && mode >= 0 && mode < 2 )
+		{
+			pregpriv->ht_enable= mode;
+			printk("ht_enable=%d\n", pregpriv->ht_enable);
+		}
+	}
+	
+	return count;
+	
+}
+
+
+int proc_get_cbw40_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	
+	int len = 0;
+	
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->cbw40_enable
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_cbw40_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && mode >= 0 && mode < 2 )
+		{
+			pregpriv->cbw40_enable= mode;
+			printk("cbw40_enable=%d\n", mode);
+		}
+	}
+	
+	return count;
+	
+}
+
+int proc_get_ampdu_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	
+	int len = 0;
+	
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->ampdu_enable
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_ampdu_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && mode >= 0 && mode < 3 )
+		{
+			pregpriv->ampdu_enable= mode;
+			printk("ampdu_enable=%d\n", mode);
+		}
+	}
+	
+	return count;
+	
+}
+
+
+int proc_get_two_path_rssi(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	
+	int len = 0;
+	
+	if(padapter)
+		len += snprintf(page + len, count - len,
+			"%d %d\n",
+			padapter->recvpriv.RxRssi[0],
+			padapter->recvpriv.RxRssi[1]
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_rx_stbc(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	
+	int len = 0;
+	
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->rx_stbc
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_rx_stbc(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && (mode == 0 || mode == 1|| mode == 2|| mode == 3))
+		{
+			pregpriv->rx_stbc= mode;
+			printk("rx_stbc=%d\n", mode);
+		}
+	}
+	
+	return count;
+	
+}
+
+int proc_get_vid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u16 VID=0;
+	int len = 0;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_VID, (u8 *)&VID);	
+	len += snprintf(page + len, count - len,
+		"%04x\n",
+		VID
+		);
+
+	*eof = 1;
+	return len;	
+}
+
+int proc_get_pid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u16 PID=0;	
+	int len = 0;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_PID, (u8 *)&PID);		
+	len += snprintf(page + len, count - len,
+		"%04x\n",
+		PID
+		);
+
+	*eof = 1;
+	return len;	
+}
+
+int proc_get_rssi_disp(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	*eof = 1;
+	return 0;
+}
+
+int proc_set_rssi_disp(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 enable=0;
+
+	if (count < 1)
+	{
+		DBG_8192C("argument size is less than 1\n");
+		return -EFAULT;
+	}	
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%x", &enable);
+
+		if (num !=  1) {
+			DBG_8192C("invalid set_rssi_disp parameter!\n");
+			return count;
+		}
+		
+		if(enable)
+		{			
+			DBG_8192C("Turn On Rx RSSI Display Function\n");
+			padapter->bRxRSSIDisplay = enable ;			
+		}
+		else
+		{
+			DBG_8192C("Turn Off Rx RSSI Display Function\n");
+			padapter->bRxRSSIDisplay = 0 ;
+		}
+	
+	}
+	
+	return count;
+	
+}	
+
+		
+#ifdef CONFIG_AP_MODE
+
+int proc_get_all_sta_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	_irqL irqL;
+	struct sta_info *psta;
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	int i, j;
+	_list	*plist, *phead;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	int len = 0;	
+						
+
+	len += snprintf(page + len, count - len, "sta_dz_bitmap=0x%x, tim_bitmap=0x%x\n", pstapriv->sta_dz_bitmap, pstapriv->tim_bitmap);
+					
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	for(i=0; i< NUM_STA; i++)
+	{
+		phead = &(pstapriv->sta_hash[i]);
+		plist = get_next(phead);
+		
+		while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+		{
+			psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+			plist = get_next(plist);
+
+			//if(extra_arg == psta->aid)
+			{
+				len += snprintf(page + len, count - len, "sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+				len += snprintf(page + len, count - len, "rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+				len += snprintf(page + len, count - len, "qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);	
+				len += snprintf(page + len, count - len, "state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);	
+				len += snprintf(page + len, count - len, "bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);						
+				len += snprintf(page + len, count - len, "ampdu_enable = %d\n", psta->htpriv.ampdu_enable);									
+				len += snprintf(page + len, count - len, "agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+				len += snprintf(page + len, count - len, "sleepq_len=%d\n", psta->sleepq_len);
+				len += snprintf(page + len, count - len, "capability=0x%x\n", psta->capability);
+				len += snprintf(page + len, count - len, "flags=0x%x\n", psta->flags);
+				len += snprintf(page + len, count - len, "wpa_psk=0x%x\n", psta->wpa_psk);
+				len += snprintf(page + len, count - len, "wpa2_group_cipher=0x%x\n", psta->wpa2_group_cipher);
+				len += snprintf(page + len, count - len, "wpa2_pairwise_cipher=0x%x\n", psta->wpa2_pairwise_cipher);
+				len += snprintf(page + len, count - len, "qos_info=0x%x\n", psta->qos_info);
+				len += snprintf(page + len, count - len, "dot118021XPrivacy=0x%x\n", psta->dot118021XPrivacy);
+								
+				for(j=0;j<16;j++)
+				{							
+					preorder_ctrl = &psta->recvreorder_ctrl[j];
+					if(preorder_ctrl->enable)
+					{
+						len += snprintf(page + len, count - len, "tid=%d, indicate_seq=%d\n", j, preorder_ctrl->indicate_seq);
+					}
+				}		
+									
+			}							
+			
+		}
+		
+	}
+	
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	*eof = 1;
+	return len;
+
+}
+	
+#endif		
+
+#ifdef DBG_MEMORY_LEAK
+#include <asm/atomic.h>
+extern atomic_t _malloc_cnt;;
+extern atomic_t _malloc_size;;
+
+int proc_get_malloc_cnt(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "_malloc_cnt=%d\n", atomic_read(&_malloc_cnt));
+	len += snprintf(page + len, count - len, "_malloc_size=%d\n", atomic_read(&_malloc_size));
+				
+	*eof = 1;
+	return len;
+}
+#endif /* DBG_MEMORY_LEAK */
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+int proc_get_best_channel(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	int len = 0;
+	u32 i, best_channel_24G = 1, best_channel_5G = 36, index_24G = 0, index_5G = 0;
+
+	for (i=0; pmlmeext->channel_set[i].ChannelNum !=0; i++) {
+		if ( pmlmeext->channel_set[i].ChannelNum == 1)
+			index_24G = i;
+		if ( pmlmeext->channel_set[i].ChannelNum == 36)
+			index_5G = i;
+	}	
+	
+	for (i=0; pmlmeext->channel_set[i].ChannelNum !=0; i++) {
+		// 2.4G
+		if ( pmlmeext->channel_set[i].ChannelNum == 6 ) {
+			if ( pmlmeext->channel_set[i].rx_count < pmlmeext->channel_set[index_24G].rx_count ) {
+				index_24G = i;
+				best_channel_24G = pmlmeext->channel_set[i].ChannelNum;
+			}
+		}
+
+		// 5G
+		if ( pmlmeext->channel_set[i].ChannelNum >= 36
+			&& pmlmeext->channel_set[i].ChannelNum < 140 ) {
+			 // Find primary channel
+			if ( (( pmlmeext->channel_set[i].ChannelNum - 36) % 8 == 0)
+				&& (pmlmeext->channel_set[i].rx_count < pmlmeext->channel_set[index_5G].rx_count) ) {
+				index_5G = i;
+				best_channel_5G = pmlmeext->channel_set[i].ChannelNum;
+			}
+		}
+
+		if ( pmlmeext->channel_set[i].ChannelNum >= 149
+			&& pmlmeext->channel_set[i].ChannelNum < 165) {
+			 // find primary channel
+			if ( (( pmlmeext->channel_set[i].ChannelNum - 149) % 8 == 0)
+				&& (pmlmeext->channel_set[i].rx_count < pmlmeext->channel_set[index_5G].rx_count) ) {
+				index_5G = i;
+				best_channel_5G = pmlmeext->channel_set[i].ChannelNum;
+			}
+		}
+#if 1 // debug
+		len += snprintf(page + len, count - len, "The rx cnt of channel %3d = %d\n", 
+					pmlmeext->channel_set[i].ChannelNum, pmlmeext->channel_set[i].rx_count);
+#endif
+	}
+	
+	len += snprintf(page + len, count - len, "best_channel_5G = %d\n", best_channel_5G);
+	len += snprintf(page + len, count - len, "best_channel_24G = %d\n", best_channel_24G);
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_set_best_channel(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	char tmp[32];
+
+	if(count < 1)
+		return -EFAULT;
+
+	if(buffer && !copy_from_user(tmp, buffer, sizeof(tmp)))
+	{
+		int i;
+		for(i = 0; pmlmeext->channel_set[i].ChannelNum != 0; i++)
+		{
+			pmlmeext->channel_set[i].rx_count = 0;
+		}
+
+		DBG_871X("set %s\n", "Clean Best Channel Count");
+	}
+
+	return count;
+}
+#endif /* CONFIG_FIND_BEST_CHANNEL */
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+#include <rtw_sreset.h>
+int proc_get_sreset(char *page, char **start, off_t offset, int count, int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	int len = 0;
+	
+	*eof = 1;
+	return len;
+}
+
+int proc_set_sreset(struct file *file, const char *buffer, unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	s32 trigger_point;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {		
+
+		int num = sscanf(tmp, "%d", &trigger_point);
+
+		if (trigger_point == SRESET_TGP_NULL)
+			rtw_hal_sreset_reset(padapter);
+		else
+			sreset_set_trigger_point(padapter, trigger_point);
+	}
+	
+	return count;
+	
+}
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+int proc_get_dm_adaptivity(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+
+	len += dm_adaptivity_get_parm_str(padapter, page, count);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_dm_adaptivity(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 TH_L2H_ini;
+	s8 TH_EDCCA_HL_diff;
+	u32 IGI_Base;
+	int ForceEDCCA;
+	u8 AdapEn_RSSI;
+	u8 IGI_LowerBound;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%x %hhd %x %d %hhu %hhu",
+			&TH_L2H_ini, &TH_EDCCA_HL_diff, &IGI_Base, &ForceEDCCA, &AdapEn_RSSI, &IGI_LowerBound);
+
+		if (num != 6)
+			return count;
+
+		dm_adaptivity_set_parm(padapter, (s8)TH_L2H_ini, TH_EDCCA_HL_diff, (s8)IGI_Base, (bool)ForceEDCCA, AdapEn_RSSI, IGI_LowerBound);
+	}
+	
+	return count;
+}
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c
new file mode 100755
index 0000000000000..fd07d64d8724a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c
@@ -0,0 +1,423 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_EEPROM_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+void up_clk(_adapter*	padapter,	 u16 *x)
+{
+_func_enter_;
+	*x = *x | _EESK;
+	rtw_write8(padapter, EE_9346CR, (u8)*x);
+	rtw_udelay_os(CLOCK_RATE);
+
+_func_exit_;
+	
+}
+
+void down_clk(_adapter *	padapter, u16 *x	)
+{
+_func_enter_;
+	*x = *x & ~_EESK;
+	rtw_write8(padapter, EE_9346CR, (u8)*x);
+	rtw_udelay_os(CLOCK_RATE);
+_func_exit_;	
+}
+
+void shift_out_bits(_adapter * padapter, u16 data, u16 count)
+{
+	u16 x,mask;
+_func_enter_;
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	mask = 0x01 << (count - 1);
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~(_EEDO | _EEDI);
+
+	do
+	{
+		x &= ~_EEDI;
+		if(data & mask)
+			x |= _EEDI;
+		if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+		}
+		rtw_write8(padapter, EE_9346CR, (u8)x);
+		rtw_udelay_os(CLOCK_RATE);
+		up_clk(padapter, &x);
+		down_clk(padapter, &x);
+		mask = mask >> 1;
+	} while(mask);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x &= ~_EEDI;
+	rtw_write8(padapter, EE_9346CR, (u8)x);
+out:	
+_func_exit_;		
+}
+
+u16 shift_in_bits (_adapter * padapter)
+{
+	u16 x,d=0,i;
+_func_enter_;	
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~( _EEDO | _EEDI);
+	d = 0;
+
+	for(i=0; i<16; i++)
+	{
+		d = d << 1;
+		up_clk(padapter, &x);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+		x = rtw_read8(padapter, EE_9346CR);
+
+		x &= ~(_EEDI);
+		if(x & _EEDO)
+		d |= 1;
+
+		down_clk(padapter, &x);
+	}
+out:	
+_func_exit_;		
+
+	return d;
+}
+
+void standby(_adapter *	padapter	)
+{
+	u8   x;
+_func_enter_;	
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~(_EECS | _EESK);
+	rtw_write8(padapter, EE_9346CR,x);
+
+	rtw_udelay_os(CLOCK_RATE);
+	x |= _EECS;
+	rtw_write8(padapter, EE_9346CR, x);
+	rtw_udelay_os(CLOCK_RATE);
+_func_exit_;		
+}
+
+u16 wait_eeprom_cmd_done(_adapter* padapter)
+{
+	u8 	x;
+	u16	i,res=_FALSE;
+_func_enter_;	
+	standby(padapter );
+	for (i=0; i<200; i++) 
+	{
+		x = rtw_read8(padapter, EE_9346CR);
+		if (x & _EEDO){
+			res=_TRUE;
+			goto exit;
+			}
+		rtw_udelay_os(CLOCK_RATE);
+	}
+exit:	
+_func_exit_;			
+	return res;
+}
+
+void eeprom_clean(_adapter * padapter)
+{
+	u16 x;
+_func_enter_;		
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x = rtw_read8(padapter, EE_9346CR);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x &= ~(_EECS | _EEDI);
+	rtw_write8(padapter, EE_9346CR, (u8)x);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	up_clk(padapter, &x);
+		if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	down_clk(padapter, &x);
+out:	
+_func_exit_;			
+}
+
+void eeprom_write16(_adapter * padapter, u16 reg, u16 data)
+{
+	u8 x;
+#ifdef CONFIG_RTL8712
+	u8	tmp8_ori,tmp8_new,tmp8_clk_ori,tmp8_clk_new;
+	tmp8_ori=rtw_read8(padapter, 0x102502f1);
+	tmp8_new=tmp8_ori & 0xf7;
+	if(tmp8_ori != tmp8_new){	
+		rtw_write8(padapter, 0x102502f1, tmp8_new);
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x102502f1=====\n"));
+	}
+	tmp8_clk_ori=rtw_read8(padapter,0x10250003);
+	tmp8_clk_new=tmp8_clk_ori|0x20;
+	if(tmp8_clk_new!=tmp8_clk_ori){
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x10250003=====\n"));
+		rtw_write8(padapter, 0x10250003, tmp8_clk_new);
+	}	
+#endif
+_func_enter_;		
+	
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
+	x |= _EEM1 | _EECS;
+	rtw_write8(padapter, EE_9346CR, x);
+
+	shift_out_bits(padapter, EEPROM_EWEN_OPCODE, 5);
+	
+	if(padapter->EepromAddressSize==8)	//CF+ and SDIO
+		shift_out_bits(padapter, 0, 6);
+	else									//USB
+		shift_out_bits(padapter, 0, 4);
+	
+	standby( padapter);
+
+// Commented out by rcnjko, 2004.0
+//	// Erase this particular word.  Write the erase opcode and register
+//	// number in that order. The opcode is 3bits in length; reg is 6 bits long.
+//	shift_out_bits(Adapter, EEPROM_ERASE_OPCODE, 3);
+//	shift_out_bits(Adapter, reg, Adapter->EepromAddressSize);
+//
+//	if (wait_eeprom_cmd_done(Adapter ) == FALSE) 
+//	{
+//		return;
+//	}
+
+
+	standby(padapter );
+
+	// write the new word to the EEPROM
+
+	// send the write opcode the EEPORM
+	shift_out_bits(padapter, EEPROM_WRITE_OPCODE, 3);
+
+	// select which word in the EEPROM that we are writing to.
+	shift_out_bits(padapter, reg, padapter->EepromAddressSize);
+
+	// write the data to the selected EEPROM word.
+	shift_out_bits(padapter, data, 16);
+
+	if (wait_eeprom_cmd_done(padapter ) == _FALSE) 
+	{
+
+		goto exit;
+	}
+
+	standby(padapter );
+
+	shift_out_bits(padapter, EEPROM_EWDS_OPCODE, 5);
+	shift_out_bits(padapter, reg, 4);
+
+	eeprom_clean(padapter );
+exit:	
+#ifdef CONFIG_RTL8712
+	if(tmp8_clk_new!=tmp8_clk_ori)
+		rtw_write8(padapter, 0x10250003, tmp8_clk_ori);
+	if(tmp8_new!=tmp8_ori)
+		rtw_write8(padapter, 0x102502f1, tmp8_ori);
+
+#endif
+_func_exit_;	
+	return;
+}
+
+u16 eeprom_read16(_adapter * padapter, u16 reg) //ReadEEprom
+{
+
+	u16 x;
+	u16 data=0;
+#ifdef CONFIG_RTL8712
+	u8	tmp8_ori,tmp8_new,tmp8_clk_ori,tmp8_clk_new;
+	tmp8_ori= rtw_read8(padapter, 0x102502f1);
+	tmp8_new = tmp8_ori & 0xf7;
+	if(tmp8_ori != tmp8_new){	
+		rtw_write8(padapter, 0x102502f1, tmp8_new);
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x102502f1=====\n"));
+	}
+	tmp8_clk_ori=rtw_read8(padapter,0x10250003);
+	tmp8_clk_new=tmp8_clk_ori|0x20;
+	if(tmp8_clk_new!=tmp8_clk_ori){
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x10250003=====\n"));
+		rtw_write8(padapter, 0x10250003, tmp8_clk_new);
+	}	
+#endif
+_func_enter_;		
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	// select EEPROM, reset bits, set _EECS
+	x = rtw_read8(padapter, EE_9346CR);
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+
+	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
+	x |= _EEM1 | _EECS;
+	rtw_write8(padapter, EE_9346CR, (unsigned char)x);
+
+	// write the read opcode and register number in that order
+	// The opcode is 3bits in length, reg is 6 bits long
+	shift_out_bits(padapter, EEPROM_READ_OPCODE, 3);
+	shift_out_bits(padapter, reg, padapter->EepromAddressSize);
+
+	// Now read the data (16 bits) in from the selected EEPROM word
+	data = shift_in_bits(padapter);
+
+	eeprom_clean(padapter);
+out:	
+#ifdef CONFIG_RTL8712
+	if(tmp8_clk_new!=tmp8_clk_ori)
+		rtw_write8(padapter, 0x10250003, tmp8_clk_ori);
+	if(tmp8_new!=tmp8_ori)
+		rtw_write8(padapter, 0x102502f1, tmp8_ori);
+
+#endif
+_func_exit_;		
+	return data;
+
+
+}
+
+
+
+
+//From even offset
+void eeprom_read_sz(_adapter * padapter, u16 reg, u8* data, u32 sz) 
+{
+
+	u16 x, data16;
+	u32 i;
+_func_enter_;		
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	// select EEPROM, reset bits, set _EECS
+	x = rtw_read8(padapter, EE_9346CR);
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+
+	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
+	x |= _EEM1 | _EECS;
+	rtw_write8(padapter, EE_9346CR, (unsigned char)x);
+
+	// write the read opcode and register number in that order
+	// The opcode is 3bits in length, reg is 6 bits long
+	shift_out_bits(padapter, EEPROM_READ_OPCODE, 3);
+	shift_out_bits(padapter, reg, padapter->EepromAddressSize);
+
+
+	for(i=0; i<sz; i+=2)
+	{
+		data16 = shift_in_bits(padapter);
+		data[i] = data16 & 0xff;
+		data[i+1] = data16 >>8;		
+	}
+
+	eeprom_clean(padapter);
+out:	
+_func_exit_;		
+
+
+
+}
+
+
+//addr_off : address offset of the entry in eeprom (not the tuple number of eeprom (reg); that is addr_off !=reg)
+u8 eeprom_read(_adapter * padapter, u32 addr_off, u8 sz, u8* rbuf)
+{
+	u8 quotient, remainder, addr_2align_odd;
+	u16 reg, stmp , i=0, idx = 0;
+_func_enter_;		
+	reg = (u16)(addr_off >> 1);
+	addr_2align_odd = (u8)(addr_off & 0x1);
+
+	if(addr_2align_odd) //read that start at high part: e.g  1,3,5,7,9,...
+	{
+		stmp = eeprom_read16(padapter, reg);
+		rbuf[idx++] = (u8) ((stmp>>8)&0xff); //return hogh-part of the short
+		reg++; sz--;
+	}
+	
+	quotient = sz >> 1;
+	remainder = sz & 0x1;
+
+	for( i=0 ; i < quotient; i++)
+	{
+		stmp = eeprom_read16(padapter, reg+i);
+		rbuf[idx++] = (u8) (stmp&0xff);
+		rbuf[idx++] = (u8) ((stmp>>8)&0xff);
+	}
+	
+	reg = reg+i;
+	if(remainder){ //end of read at lower part of short : 0,2,4,6,...
+		stmp = eeprom_read16(padapter, reg);
+		rbuf[idx] = (u8)(stmp & 0xff); 
+	}
+_func_exit_;		
+	return _TRUE;
+}
+
+
+
+VOID read_eeprom_content(_adapter *	padapter)
+{
+
+_func_enter_;		
+
+
+_func_exit_;		
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c
new file mode 100755
index 0000000000000..f89ce4a003233
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c
@@ -0,0 +1,1916 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _IEEE80211_C
+
+#include <drv_types.h>
+#include <ieee80211.h>
+#include <wifi.h>
+#include <osdep_service.h>
+#include <wlan_bssdef.h>
+
+u8 RTW_WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
+u16 RTW_WPA_VERSION = 1;
+u8 WPA_AUTH_KEY_MGMT_NONE[] = { 0x00, 0x50, 0xf2, 0 };
+u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x50, 0xf2, 1 };
+u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x50, 0xf2, 2 };
+u8 WPA_CIPHER_SUITE_NONE[] = { 0x00, 0x50, 0xf2, 0 };
+u8 WPA_CIPHER_SUITE_WEP40[] = { 0x00, 0x50, 0xf2, 1 };
+u8 WPA_CIPHER_SUITE_TKIP[] = { 0x00, 0x50, 0xf2, 2 };
+u8 WPA_CIPHER_SUITE_WRAP[] = { 0x00, 0x50, 0xf2, 3 };
+u8 WPA_CIPHER_SUITE_CCMP[] = { 0x00, 0x50, 0xf2, 4 };
+u8 WPA_CIPHER_SUITE_WEP104[] = { 0x00, 0x50, 0xf2, 5 };
+
+u16 RSN_VERSION_BSD = 1;
+u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x0f, 0xac, 1 };
+u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x0f, 0xac, 2 };
+u8 RSN_CIPHER_SUITE_NONE[] = { 0x00, 0x0f, 0xac, 0 };
+u8 RSN_CIPHER_SUITE_WEP40[] = { 0x00, 0x0f, 0xac, 1 };
+u8 RSN_CIPHER_SUITE_TKIP[] = { 0x00, 0x0f, 0xac, 2 };
+u8 RSN_CIPHER_SUITE_WRAP[] = { 0x00, 0x0f, 0xac, 3 };
+u8 RSN_CIPHER_SUITE_CCMP[] = { 0x00, 0x0f, 0xac, 4 };
+u8 RSN_CIPHER_SUITE_WEP104[] = { 0x00, 0x0f, 0xac, 5 };
+//-----------------------------------------------------------
+// for adhoc-master to generate ie and provide supported-rate to fw 
+//-----------------------------------------------------------
+
+static u8 	WIFI_CCKRATES[] = 
+{(IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
+ (IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
+ (IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
+ (IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)};
+
+static u8 	WIFI_OFDMRATES[] = 
+{(IEEE80211_OFDM_RATE_6MB),
+ (IEEE80211_OFDM_RATE_9MB),
+ (IEEE80211_OFDM_RATE_12MB),
+ (IEEE80211_OFDM_RATE_18MB),
+ (IEEE80211_OFDM_RATE_24MB),
+ IEEE80211_OFDM_RATE_36MB,
+ IEEE80211_OFDM_RATE_48MB,
+ IEEE80211_OFDM_RATE_54MB};
+
+
+int rtw_get_bit_value_from_ieee_value(u8 val)
+{
+	unsigned char dot11_rate_table[]={2,4,11,22,12,18,24,36,48,72,96,108,0}; // last element must be zero!!
+
+	int i=0;
+	while(dot11_rate_table[i] != 0) {
+		if (dot11_rate_table[i] == val)
+			return BIT(i);
+		i++;
+	}
+	return 0;
+}
+
+uint	rtw_is_cckrates_included(u8 *rate)
+{	
+		u32	i = 0;			
+
+		while(rate[i]!=0)
+		{		
+			if  (  (((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||		
+			(((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22) )		
+			return _TRUE;	
+			i++;
+		}
+		
+		return _FALSE;
+}
+
+uint	rtw_is_cckratesonly_included(u8 *rate)
+{
+	u32 i = 0;
+
+
+	while(rate[i]!=0)
+	{
+			if  (  (((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+				(((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22) )
+
+			return _FALSE;		
+
+			i++;
+	}
+	
+	return _TRUE;
+
+}
+
+int rtw_check_network_type(unsigned char *rate, int ratelen, int channel)
+{
+	if (channel > 14)
+	{
+		if ((rtw_is_cckrates_included(rate)) == _TRUE)
+			return WIRELESS_INVALID;
+		else
+			return WIRELESS_11A;
+	}	
+	else  // could be pure B, pure G, or B/G
+	{
+		if ((rtw_is_cckratesonly_included(rate)) == _TRUE)	
+			return WIRELESS_11B;
+		else if((rtw_is_cckrates_included(rate)) == _TRUE)
+			return 	WIRELESS_11BG;
+		else
+			return WIRELESS_11G;
+	}
+	
+}
+
+u8 *rtw_set_fixed_ie(unsigned char *pbuf, unsigned int len, unsigned char *source,
+				unsigned int *frlen)
+{
+	_rtw_memcpy((void *)pbuf, (void *)source, len);
+	*frlen = *frlen + len;
+	return (pbuf + len);
+}
+
+// rtw_set_ie will update frame length
+u8 *rtw_set_ie
+(
+	u8 *pbuf, 
+	sint index, 
+	uint len,
+	u8 *source, 
+	uint *frlen //frame length
+)
+{
+_func_enter_;
+	*pbuf = (u8)index;
+
+	*(pbuf + 1) = (u8)len;
+
+	if (len > 0)
+		_rtw_memcpy((void *)(pbuf + 2), (void *)source, len);
+	
+	*frlen = *frlen + (len + 2);
+	
+	return (pbuf + len + 2);
+_func_exit_;	
+}
+
+inline u8 *rtw_set_ie_ch_switch(u8 *buf, u32 *buf_len, u8 ch_switch_mode,
+	u8 new_ch, u8 ch_switch_cnt)
+{
+	u8 ie_data[3];
+
+	ie_data[0] = ch_switch_mode;
+	ie_data[1] = new_ch;
+	ie_data[2] = ch_switch_cnt;
+	return rtw_set_ie(buf, WLAN_EID_CHANNEL_SWITCH,  3, ie_data, buf_len);
+}
+
+inline u8 secondary_ch_offset_to_hal_ch_offset(u8 ch_offset)
+{
+	if (ch_offset == SCN)
+		return HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	else if(ch_offset == SCA)
+		return HAL_PRIME_CHNL_OFFSET_UPPER;
+	else if(ch_offset == SCB)
+		return HAL_PRIME_CHNL_OFFSET_LOWER;
+
+	return HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+}
+
+inline u8 hal_ch_offset_to_secondary_ch_offset(u8 ch_offset)
+{
+	if (ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE)
+		return SCN;
+	else if(ch_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+		return SCB;
+	else if(ch_offset == HAL_PRIME_CHNL_OFFSET_UPPER)
+		return SCA;
+
+	return SCN;
+}
+
+inline u8 *rtw_set_ie_secondary_ch_offset(u8 *buf, u32 *buf_len, u8 secondary_ch_offset)
+{
+	return rtw_set_ie(buf, WLAN_EID_SECONDARY_CHANNEL_OFFSET,  1, &secondary_ch_offset, buf_len);
+}
+
+inline u8 *rtw_set_ie_mesh_ch_switch_parm(u8 *buf, u32 *buf_len, u8 ttl,
+	u8 flags, u16 reason, u16 precedence)
+{
+	u8 ie_data[6];
+
+	ie_data[0] = ttl;
+	ie_data[1] = flags;
+	RTW_PUT_LE16((u8*)&ie_data[2], reason);
+	RTW_PUT_LE16((u8*)&ie_data[4], precedence);
+
+	return rtw_set_ie(buf, 0x118,  6, ie_data, buf_len);
+}
+
+/*----------------------------------------------------------------------------
+index: the information element id index, limit is the limit for search
+-----------------------------------------------------------------------------*/
+u8 *rtw_get_ie(u8 *pbuf, sint index, sint *len, sint limit)
+{
+	sint tmp,i;
+	u8 *p;
+_func_enter_;
+	if (limit < 1){
+		_func_exit_;	
+		return NULL;
+	}
+
+	p = pbuf;
+	i = 0;
+	*len = 0;
+	while(1)
+	{
+		if (*p == index)
+		{
+			*len = *(p + 1);
+			return (p);
+		}
+		else
+		{
+			tmp = *(p + 1);
+			p += (tmp + 2);
+			i += (tmp + 2);
+		}
+		if (i >= limit)
+			break;
+	}
+_func_exit_;		
+	return NULL;
+}
+
+/**
+ * rtw_get_ie_ex - Search specific IE from a series of IEs
+ * @in_ie: Address of IEs to search
+ * @in_len: Length limit from in_ie
+ * @eid: Element ID to match
+ * @oui: OUI to match
+ * @oui_len: OUI length
+ * @ie: If not NULL and the specific IE is found, the IE will be copied to the buf starting from the specific IE
+ * @ielen: If not NULL and the specific IE is found, will set to the length of the entire IE
+ *
+ * Returns: The address of the specific IE found, or NULL
+ */
+u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, uint *ielen)
+{
+	uint cnt;
+	u8 *target_ie = NULL;
+
+
+	if(ielen)
+		*ielen = 0;
+
+	if(!in_ie || in_len<=0)
+		return target_ie;
+
+	cnt = 0;
+
+	while(cnt<in_len)
+	{
+		if(eid == in_ie[cnt]
+			&& ( !oui || _rtw_memcmp(&in_ie[cnt+2], oui, oui_len) == _TRUE))
+		{
+			target_ie = &in_ie[cnt];
+
+			if(ie)
+				_rtw_memcpy(ie, &in_ie[cnt], in_ie[cnt+1]+2);
+			
+			if(ielen)
+				*ielen = in_ie[cnt+1]+2;
+
+			break;
+		}
+		else
+		{
+			cnt+=in_ie[cnt+1]+2; //goto next	
+		}		
+
+	}	
+
+	return target_ie;
+}
+
+/**
+ * rtw_ies_remove_ie - Find matching IEs and remove
+ * @ies: Address of IEs to search
+ * @ies_len: Pointer of length of ies, will update to new length
+ * @offset: The offset to start scarch
+ * @eid: Element ID to match
+ * @oui: OUI to match
+ * @oui_len: OUI length
+ *
+ * Returns: _SUCCESS: ies is updated, _FAIL: not updated
+ */
+int rtw_ies_remove_ie(u8 *ies, uint *ies_len, uint offset, u8 eid, u8 *oui, u8 oui_len)
+{
+	int ret = _FAIL;
+	u8 *target_ie;
+	u32 target_ielen;
+	u8 *start;
+	uint search_len;
+	
+	if(!ies || !ies_len || *ies_len <= offset)
+		goto exit;
+
+	start = ies + offset;
+	search_len = *ies_len - offset;
+
+	while (1) {
+		target_ie = rtw_get_ie_ex(start, search_len, eid, oui, oui_len, NULL, &target_ielen);
+		if (target_ie && target_ielen) {
+			u8 buf[MAX_IE_SZ] = {0};
+			u8 *remain_ies = target_ie + target_ielen;
+			uint remain_len = search_len - (remain_ies - start);
+			
+			_rtw_memcpy(buf, remain_ies, remain_len);
+			_rtw_memcpy(target_ie, buf, remain_len);
+			*ies_len = *ies_len - target_ielen;
+			ret = _SUCCESS;
+
+			start = target_ie;
+			search_len = remain_len;
+		} else {
+			break;
+		}
+	}
+exit:
+	return ret;
+}
+
+void rtw_set_supported_rate(u8* SupportedRates, uint mode) 
+{
+_func_enter_;
+
+	_rtw_memset(SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
+	
+	switch (mode)
+	{
+		case WIRELESS_11B:
+			_rtw_memcpy(SupportedRates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
+			break;
+		
+		case WIRELESS_11G:
+		case WIRELESS_11A:
+		case WIRELESS_11_5N:
+		case WIRELESS_11A_5N://Todo: no basic rate for ofdm ?
+			_rtw_memcpy(SupportedRates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
+			break;
+		
+		case WIRELESS_11BG:
+		case WIRELESS_11G_24N:
+		case WIRELESS_11_24N:
+		case WIRELESS_11BG_24N:
+			_rtw_memcpy(SupportedRates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
+			_rtw_memcpy(SupportedRates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
+			break;
+	
+	}
+_func_exit_;	
+}
+
+uint	rtw_get_rateset_len(u8	*rateset)
+{
+	uint i = 0;
+_func_enter_;	
+	while(1)
+	{
+		if ((rateset[i]) == 0)
+			break;
+			
+		if (i > 12)
+			break;
+			
+		i++;			
+	}
+_func_exit_;		
+	return i;
+}
+
+int rtw_generate_ie(struct registry_priv *pregistrypriv)
+{
+	u8	wireless_mode;
+	int 	sz = 0, rateLen;
+	WLAN_BSSID_EX*	pdev_network = &pregistrypriv->dev_network;
+	u8*	ie = pdev_network->IEs;
+	
+_func_enter_;		
+
+	//timestamp will be inserted by hardware
+	sz += 8;	
+	ie += sz;
+	
+	//beacon interval : 2bytes
+	*(u16*)ie = cpu_to_le16((u16)pdev_network->Configuration.BeaconPeriod);//BCN_INTERVAL;
+	sz += 2; 
+	ie += 2;
+	
+	//capability info
+	*(u16*)ie = 0;
+	
+	*(u16*)ie |= cpu_to_le16(cap_IBSS);
+
+	if(pregistrypriv->preamble == PREAMBLE_SHORT)
+		*(u16*)ie |= cpu_to_le16(cap_ShortPremble);
+	
+	if (pdev_network->Privacy)
+		*(u16*)ie |= cpu_to_le16(cap_Privacy);
+	
+	sz += 2;
+	ie += 2;
+	
+	//SSID
+	ie = rtw_set_ie(ie, _SSID_IE_, pdev_network->Ssid.SsidLength, pdev_network->Ssid.Ssid, &sz);
+	
+	//supported rates
+	if(pregistrypriv->wireless_mode == WIRELESS_11ABGN)
+	{
+		if(pdev_network->Configuration.DSConfig > 14)
+			wireless_mode = WIRELESS_11A_5N;
+		else
+			wireless_mode = WIRELESS_11BG_24N;
+	}
+	else
+	{
+		wireless_mode = pregistrypriv->wireless_mode;
+	}
+	
+	rtw_set_supported_rate(pdev_network->SupportedRates, wireless_mode) ;
+	
+	rateLen = rtw_get_rateset_len(pdev_network->SupportedRates);
+
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, 8, pdev_network->SupportedRates, &sz);
+		//ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (pdev_network->SupportedRates + 8), &sz);
+	}
+	else
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, rateLen, pdev_network->SupportedRates, &sz);
+	}
+
+	//DS parameter set
+	ie = rtw_set_ie(ie, _DSSET_IE_, 1, (u8 *)&(pdev_network->Configuration.DSConfig), &sz);
+
+
+	//IBSS Parameter Set
+	
+	ie = rtw_set_ie(ie, _IBSS_PARA_IE_, 2, (u8 *)&(pdev_network->Configuration.ATIMWindow), &sz);
+
+	if (rateLen > 8)
+	{		
+		ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (pdev_network->SupportedRates + 8), &sz);
+	}
+	
+		
+	//HT Cap.
+	if(((pregistrypriv->wireless_mode&WIRELESS_11_5N)||(pregistrypriv->wireless_mode&WIRELESS_11_24N)) 
+		&& (pregistrypriv->ht_enable==_TRUE))
+	{
+		//todo:
+	}
+
+	//pdev_network->IELength =  sz; //update IELength
+
+_func_exit_;
+
+	//return _SUCCESS;
+
+	return sz;
+
+}
+
+unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit)
+{
+	int len;
+	u16 val16;
+	unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
+	u8 *pbuf = pie;
+
+	while(1) 
+	{
+		pbuf = rtw_get_ie(pbuf, _WPA_IE_ID_, &len, limit);
+
+		if (pbuf) {
+
+			//check if oui matches...
+			if (_rtw_memcmp((pbuf + 2), wpa_oui_type, sizeof (wpa_oui_type)) == _FALSE) {
+
+				goto check_next_ie;
+			}
+
+			//check version...
+			_rtw_memcpy((u8 *)&val16, (pbuf + 6), sizeof(val16));
+
+			val16 = le16_to_cpu(val16);
+			if (val16 != 0x0001)
+				goto check_next_ie;
+
+			*wpa_ie_len = *(pbuf + 1);
+
+			return pbuf;
+		}
+		else {
+
+			*wpa_ie_len = 0;
+			return NULL;
+		}
+
+check_next_ie:
+
+		limit -= (2 + len);
+
+		if (limit <= 0)
+			break;
+
+		pbuf += (2 + len);
+	}
+
+	*wpa_ie_len = 0;
+
+	return NULL;
+}
+
+unsigned char *rtw_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len, int limit)
+{	
+
+	return rtw_get_ie(pie, _WPA2_IE_ID_,rsn_ie_len, limit);
+
+}
+
+int rtw_get_wpa_cipher_suite(u8 *s)
+{
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_NONE;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP40;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_TKIP;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_CCMP;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP104;
+
+	return 0;
+}
+
+int rtw_get_wpa2_cipher_suite(u8 *s)
+{
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_NONE;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP40;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_TKIP;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_CCMP;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP104;
+
+	return 0;
+}
+
+
+int rtw_parse_wpa_ie(u8* wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher)
+{
+	int i, ret=_SUCCESS;
+	int left, count;
+	u8 *pos;
+
+	if (wpa_ie_len <= 0) {
+		/* No WPA IE - fail silently */
+		return _FAIL;
+	}
+
+	
+	if ((*wpa_ie != _WPA_IE_ID_) || (*(wpa_ie+1) != (u8)(wpa_ie_len - 2)) ||
+	   (_rtw_memcmp(wpa_ie+2, RTW_WPA_OUI_TYPE, WPA_SELECTOR_LEN) != _TRUE) )
+	{		
+		return _FAIL;
+	}
+
+	pos = wpa_ie;
+
+	pos += 8;
+	left = wpa_ie_len - 8;	
+
+
+	//group_cipher
+	if (left >= WPA_SELECTOR_LEN) {
+
+		*group_cipher = rtw_get_wpa_cipher_suite(pos);
+		
+		pos += WPA_SELECTOR_LEN;
+		left -= WPA_SELECTOR_LEN;
+		
+	} 
+	else if (left > 0)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie length mismatch, %u too much", __FUNCTION__, left));
+		
+		return _FAIL;
+	}
+
+
+	//pairwise_cipher
+	if (left >= 2)
+	{		
+                //count = le16_to_cpu(*(u16*)pos);	
+		count = RTW_GET_LE16(pos);
+		pos += 2;
+		left -= 2;
+		
+		if (count == 0 || left < count * WPA_SELECTOR_LEN) {
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie count botch (pairwise), "
+				   		"count %u left %u", __FUNCTION__, count, left));
+			return _FAIL;
+		}
+		
+		for (i = 0; i < count; i++)
+		{
+			*pairwise_cipher |= rtw_get_wpa_cipher_suite(pos);
+			
+			pos += WPA_SELECTOR_LEN;
+			left -= WPA_SELECTOR_LEN;
+		}
+		
+	} 
+	else if (left == 1)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie too short (for key mgmt)",   __FUNCTION__));
+		return _FAIL;
+	}
+
+	
+	return ret;
+	
+}
+
+int rtw_parse_wpa2_ie(u8* rsn_ie, int rsn_ie_len, int *group_cipher, int *pairwise_cipher)
+{
+	int i, ret=_SUCCESS;
+	int left, count;
+	u8 *pos;
+
+	if (rsn_ie_len <= 0) {
+		/* No RSN IE - fail silently */
+		return _FAIL;
+	}
+
+
+	if ((*rsn_ie!= _WPA2_IE_ID_) || (*(rsn_ie+1) != (u8)(rsn_ie_len - 2)))
+	{		
+		return _FAIL;
+	}
+	
+	pos = rsn_ie;
+	pos += 4;
+	left = rsn_ie_len - 4;	
+
+	//group_cipher
+	if (left >= RSN_SELECTOR_LEN) {
+
+		*group_cipher = rtw_get_wpa2_cipher_suite(pos);
+		
+		pos += RSN_SELECTOR_LEN;
+		left -= RSN_SELECTOR_LEN;
+		
+	} else if (left > 0) {
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie length mismatch, %u too much", __FUNCTION__, left));
+		return _FAIL;
+	}
+
+	//pairwise_cipher
+	if (left >= 2)
+	{		
+	        //count = le16_to_cpu(*(u16*)pos);
+		count = RTW_GET_LE16(pos);
+		pos += 2;
+		left -= 2;
+
+		if (count == 0 || left < count * RSN_SELECTOR_LEN) {
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie count botch (pairwise), "
+				  		 "count %u left %u", __FUNCTION__, count, left));
+			return _FAIL;
+		}
+		
+		for (i = 0; i < count; i++)
+		{			
+			*pairwise_cipher |= rtw_get_wpa2_cipher_suite(pos);
+			
+			pos += RSN_SELECTOR_LEN;
+			left -= RSN_SELECTOR_LEN;
+		}
+
+	} 
+	else if (left == 1)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie too short (for key mgmt)",  __FUNCTION__));
+		
+		return _FAIL;
+	}
+
+
+	return ret;
+	
+}
+
+int rtw_get_sec_ie(u8 *in_ie,uint in_len,u8 *rsn_ie,u16 *rsn_len,u8 *wpa_ie,u16 *wpa_len)
+{
+	u8 authmode, sec_idx, i;
+	u8 wpa_oui[4]={0x0,0x50,0xf2,0x01};
+	uint 	cnt;
+	
+_func_enter_;
+
+	//Search required WPA or WPA2 IE and copy to sec_ie[ ]
+	
+	cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_);
+	
+	sec_idx=0;
+		
+	while(cnt<in_len)
+	{
+		authmode=in_ie[cnt];
+		
+		if((authmode==_WPA_IE_ID_)&&(_rtw_memcmp(&in_ie[cnt+2], &wpa_oui[0],4)==_TRUE))
+		{	
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n rtw_get_wpa_ie: sec_idx=%d in_ie[cnt+1]+2=%d\n",sec_idx,in_ie[cnt+1]+2));		
+
+				_rtw_memcpy(wpa_ie, &in_ie[cnt],in_ie[cnt+1]+2);
+
+				for(i=0;i<(in_ie[cnt+1]+2);i=i+8){
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n %2x,%2x,%2x,%2x,%2x,%2x,%2x,%2x\n",wpa_ie[i],wpa_ie[i+1],wpa_ie[i+2],wpa_ie[i+3],wpa_ie[i+4],wpa_ie[i+5],wpa_ie[i+6],wpa_ie[i+7]));
+				}
+
+				*wpa_len=in_ie[cnt+1]+2;
+				cnt+=in_ie[cnt+1]+2;  //get next
+		}
+		else
+		{
+			if(authmode==_WPA2_IE_ID_)
+			{
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n get_rsn_ie: sec_idx=%d in_ie[cnt+1]+2=%d\n",sec_idx,in_ie[cnt+1]+2));		
+
+				_rtw_memcpy(rsn_ie, &in_ie[cnt],in_ie[cnt+1]+2);
+
+				for(i=0;i<(in_ie[cnt+1]+2);i=i+8){
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n %2x,%2x,%2x,%2x,%2x,%2x,%2x,%2x\n",rsn_ie[i],rsn_ie[i+1],rsn_ie[i+2],rsn_ie[i+3],rsn_ie[i+4],rsn_ie[i+5],rsn_ie[i+6],rsn_ie[i+7]));
+				}
+
+				*rsn_len=in_ie[cnt+1]+2;
+				cnt+=in_ie[cnt+1]+2;  //get next
+			}
+			else
+			{
+				cnt+=in_ie[cnt+1]+2;   //get next
+			}	
+		}
+		
+	}
+	
+_func_exit_;
+
+	return (*rsn_len+*wpa_len);
+	
+}
+
+u8 rtw_is_wps_ie(u8 *ie_ptr, uint *wps_ielen)
+{	
+	u8 match = _FALSE;
+	u8 eid, wps_oui[4]={0x0,0x50,0xf2,0x04};
+	
+	if(ie_ptr == NULL) return match;
+	
+	eid = ie_ptr[0];
+	
+	if((eid==_WPA_IE_ID_)&&(_rtw_memcmp(&ie_ptr[2], wps_oui, 4)==_TRUE))
+	{			
+		//printk("==> found WPS_IE.....\n");		
+		*wps_ielen = ie_ptr[1]+2;			
+		match=_TRUE;
+	}	
+	return match;
+}
+
+/**
+ * rtw_get_wps_ie - Search WPS IE from a series of IEs
+ * @in_ie: Address of IEs to search
+ * @in_len: Length limit from in_ie
+ * @wps_ie: If not NULL and WPS IE is found, WPS IE will be copied to the buf starting from wps_ie
+ * @wps_ielen: If not NULL and WPS IE is found, will set to the length of the entire WPS IE
+ *
+ * Returns: The address of the WPS IE found, or NULL
+ */
+u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
+{
+	uint cnt;
+	u8 *wpsie_ptr=NULL;
+	u8 eid, wps_oui[4]={0x0,0x50,0xf2,0x04};
+
+	if(wps_ielen)
+		*wps_ielen = 0;
+
+	if(!in_ie || in_len<=0)
+		return wpsie_ptr;
+
+	cnt = 0;
+
+	while(cnt<in_len)
+	{
+		eid = in_ie[cnt];
+
+		if((eid==_WPA_IE_ID_)&&(_rtw_memcmp(&in_ie[cnt+2], wps_oui, 4)==_TRUE))
+		{
+			wpsie_ptr = &in_ie[cnt];
+
+			if(wps_ie)
+				_rtw_memcpy(wps_ie, &in_ie[cnt], in_ie[cnt+1]+2);
+			
+			if(wps_ielen)
+				*wps_ielen = in_ie[cnt+1]+2;
+			
+			cnt+=in_ie[cnt+1]+2;
+
+			break;
+		}
+		else
+		{
+			cnt+=in_ie[cnt+1]+2; //goto next	
+		}		
+
+	}	
+
+	return wpsie_ptr;
+}
+
+/**
+ * rtw_get_wps_attr - Search a specific WPS attribute from a given WPS IE
+ * @wps_ie: Address of WPS IE to search
+ * @wps_ielen: Length limit from wps_ie
+ * @target_attr_id: The attribute ID of WPS attribute to search
+ * @buf_attr: If not NULL and the WPS attribute is found, WPS attribute will be copied to the buf starting from buf_attr
+ * @len_attr: If not NULL and the WPS attribute is found, will set to the length of the entire WPS attribute
+ *
+ * Returns: the address of the specific WPS attribute found, or NULL
+ */
+u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_attr, u32 *len_attr)
+{
+	u8 *attr_ptr = NULL;
+	u8 * target_attr_ptr = NULL;
+	u8 wps_oui[4]={0x00,0x50,0xF2,0x04};
+
+	if(len_attr)
+		*len_attr = 0;
+
+	if ( ( wps_ie[0] != _VENDOR_SPECIFIC_IE_ ) ||
+		( _rtw_memcmp( wps_ie + 2, wps_oui , 4 ) != _TRUE ) )
+	{
+		return attr_ptr;
+	}
+
+	// 6 = 1(Element ID) + 1(Length) + 4(WPS OUI)
+	attr_ptr = wps_ie + 6; //goto first attr
+	
+	while(attr_ptr - wps_ie < wps_ielen)
+	{
+		// 4 = 2(Attribute ID) + 2(Length)
+		u16 attr_id = RTW_GET_BE16(attr_ptr);
+		u16 attr_data_len = RTW_GET_BE16(attr_ptr + 2);
+		u16 attr_len = attr_data_len + 4;
+		
+		//DBG_871X("%s attr_ptr:%p, id:%u, length:%u\n", __FUNCTION__, attr_ptr, attr_id, attr_data_len);
+		if( attr_id == target_attr_id )
+		{
+			target_attr_ptr = attr_ptr;
+		
+			if(buf_attr)
+				_rtw_memcpy(buf_attr, attr_ptr, attr_len);
+			
+			if(len_attr)
+				*len_attr = attr_len;
+			
+			break;
+		}
+		else
+		{
+			attr_ptr += attr_len; //goto next
+		}		
+		
+	}	
+
+	return target_attr_ptr;
+}
+
+/**
+ * rtw_get_wps_attr_content - Search a specific WPS attribute content from a given WPS IE
+ * @wps_ie: Address of WPS IE to search
+ * @wps_ielen: Length limit from wps_ie
+ * @target_attr_id: The attribute ID of WPS attribute to search
+ * @buf_content: If not NULL and the WPS attribute is found, WPS attribute content will be copied to the buf starting from buf_content
+ * @len_content: If not NULL and the WPS attribute is found, will set to the length of the WPS attribute content
+ *
+ * Returns: the address of the specific WPS attribute content found, or NULL
+ */
+u8 *rtw_get_wps_attr_content(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_content, uint *len_content)
+{
+	u8 *attr_ptr;
+	u32 attr_len;
+
+	if(len_content)
+		*len_content = 0;
+	
+	attr_ptr = rtw_get_wps_attr(wps_ie, wps_ielen, target_attr_id, NULL, &attr_len);
+
+	if(attr_ptr && attr_len)
+	{
+		if(buf_content)
+			_rtw_memcpy(buf_content, attr_ptr+4, attr_len-4);
+
+		if(len_content)
+			*len_content = attr_len-4;
+
+		return attr_ptr+4;
+	}
+
+	return NULL;
+}
+
+static int rtw_ieee802_11_parse_vendor_specific(u8 *pos, uint elen,
+					    struct rtw_ieee802_11_elems *elems,
+					    int show_errors)
+{
+	unsigned int oui;
+
+	/* first 3 bytes in vendor specific information element are the IEEE
+	 * OUI of the vendor. The following byte is used a vendor specific
+	 * sub-type. */
+	if (elen < 4) {
+		if (show_errors) {
+			DBG_871X("short vendor specific "
+				   "information element ignored (len=%lu)\n",
+				   (unsigned long) elen);
+		}
+		return -1;
+	}
+
+	oui = RTW_GET_BE24(pos);
+	switch (oui) {
+	case OUI_MICROSOFT:
+		/* Microsoft/Wi-Fi information elements are further typed and
+		 * subtyped */
+		switch (pos[3]) {
+		case 1:
+			/* Microsoft OUI (00:50:F2) with OUI Type 1:
+			 * real WPA information element */
+			elems->wpa_ie = pos;
+			elems->wpa_ie_len = elen;
+			break;
+		case WME_OUI_TYPE: /* this is a Wi-Fi WME info. element */
+			if (elen < 5) {
+				DBG_871X("short WME "
+					   "information element ignored "
+					   "(len=%lu)\n",
+					   (unsigned long) elen);
+				return -1;
+			}
+			switch (pos[4]) {
+			case WME_OUI_SUBTYPE_INFORMATION_ELEMENT:
+			case WME_OUI_SUBTYPE_PARAMETER_ELEMENT:
+				elems->wme = pos;
+				elems->wme_len = elen;
+				break;
+			case WME_OUI_SUBTYPE_TSPEC_ELEMENT:
+				elems->wme_tspec = pos;
+				elems->wme_tspec_len = elen;
+				break;
+			default:
+				DBG_871X("unknown WME "
+					   "information element ignored "
+					   "(subtype=%d len=%lu)\n",
+					   pos[4], (unsigned long) elen);
+				return -1;
+			}
+			break;
+		case 4:
+			/* Wi-Fi Protected Setup (WPS) IE */
+			elems->wps_ie = pos;
+			elems->wps_ie_len = elen;
+			break;
+		default:
+			DBG_871X("Unknown Microsoft "
+				   "information element ignored "
+				   "(type=%d len=%lu)\n",
+				   pos[3], (unsigned long) elen);
+			return -1;
+		}
+		break;
+
+	case OUI_BROADCOM:
+		switch (pos[3]) {
+		case VENDOR_HT_CAPAB_OUI_TYPE:
+			elems->vendor_ht_cap = pos;
+			elems->vendor_ht_cap_len = elen;
+			break;
+		default:
+			DBG_871X("Unknown Broadcom "
+				   "information element ignored "
+				   "(type=%d len=%lu)\n",
+				   pos[3], (unsigned long) elen);
+			return -1;
+		}
+		break;
+
+	default:
+		DBG_871X("unknown vendor specific information "
+			   "element ignored (vendor OUI %02x:%02x:%02x "
+			   "len=%lu)\n",
+			   pos[0], pos[1], pos[2], (unsigned long) elen);
+		return -1;
+	}
+
+	return 0;
+	
+}
+
+/**
+ * ieee802_11_parse_elems - Parse information elements in management frames
+ * @start: Pointer to the start of IEs
+ * @len: Length of IE buffer in octets
+ * @elems: Data structure for parsed elements
+ * @show_errors: Whether to show parsing errors in debug log
+ * Returns: Parsing result
+ */
+ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
+				struct rtw_ieee802_11_elems *elems,
+				int show_errors)
+{
+	uint left = len;
+	u8 *pos = start;
+	int unknown = 0;
+
+	_rtw_memset(elems, 0, sizeof(*elems));
+
+	while (left >= 2) {
+		u8 id, elen;
+
+		id = *pos++;
+		elen = *pos++;
+		left -= 2;
+
+		if (elen > left) {
+			if (show_errors) {
+				DBG_871X("IEEE 802.11 element "
+					   "parse failed (id=%d elen=%d "
+					   "left=%lu)\n",
+					   id, elen, (unsigned long) left);				
+			}
+			return ParseFailed;
+		}
+
+		switch (id) {
+		case WLAN_EID_SSID:
+			elems->ssid = pos;
+			elems->ssid_len = elen;
+			break;
+		case WLAN_EID_SUPP_RATES:
+			elems->supp_rates = pos;
+			elems->supp_rates_len = elen;
+			break;
+		case WLAN_EID_FH_PARAMS:
+			elems->fh_params = pos;
+			elems->fh_params_len = elen;
+			break;
+		case WLAN_EID_DS_PARAMS:
+			elems->ds_params = pos;
+			elems->ds_params_len = elen;
+			break;
+		case WLAN_EID_CF_PARAMS:
+			elems->cf_params = pos;
+			elems->cf_params_len = elen;
+			break;
+		case WLAN_EID_TIM:
+			elems->tim = pos;
+			elems->tim_len = elen;
+			break;
+		case WLAN_EID_IBSS_PARAMS:
+			elems->ibss_params = pos;
+			elems->ibss_params_len = elen;
+			break;
+		case WLAN_EID_CHALLENGE:
+			elems->challenge = pos;
+			elems->challenge_len = elen;
+			break;
+		case WLAN_EID_ERP_INFO:
+			elems->erp_info = pos;
+			elems->erp_info_len = elen;
+			break;
+		case WLAN_EID_EXT_SUPP_RATES:
+			elems->ext_supp_rates = pos;
+			elems->ext_supp_rates_len = elen;
+			break;
+		case WLAN_EID_VENDOR_SPECIFIC:
+			if (rtw_ieee802_11_parse_vendor_specific(pos, elen,
+							     elems,
+							     show_errors))
+				unknown++;
+			break;
+		case WLAN_EID_RSN:
+			elems->rsn_ie = pos;
+			elems->rsn_ie_len = elen;
+			break;
+		case WLAN_EID_PWR_CAPABILITY:
+			elems->power_cap = pos;
+			elems->power_cap_len = elen;
+			break;
+		case WLAN_EID_SUPPORTED_CHANNELS:
+			elems->supp_channels = pos;
+			elems->supp_channels_len = elen;
+			break;
+		case WLAN_EID_MOBILITY_DOMAIN:
+			elems->mdie = pos;
+			elems->mdie_len = elen;
+			break;
+		case WLAN_EID_FAST_BSS_TRANSITION:
+			elems->ftie = pos;
+			elems->ftie_len = elen;
+			break;
+		case WLAN_EID_TIMEOUT_INTERVAL:
+			elems->timeout_int = pos;
+			elems->timeout_int_len = elen;
+			break;
+		case WLAN_EID_HT_CAP:
+			elems->ht_capabilities = pos;
+			elems->ht_capabilities_len = elen;
+			break;
+		case WLAN_EID_HT_OPERATION:
+			elems->ht_operation = pos;
+			elems->ht_operation_len = elen;
+			break;
+		default:
+			unknown++;
+			if (!show_errors)
+				break;
+			DBG_871X("IEEE 802.11 element parse "
+				   "ignored unknown element (id=%d elen=%d)\n",
+				   id, elen);
+			break;
+		}
+
+		left -= elen;
+		pos += elen;
+	}
+
+	if (left)
+		return ParseFailed;
+
+	return unknown ? ParseUnknown : ParseOK;
+	
+}
+
+static u8 key_char2num(u8 ch);
+static u8 key_char2num(u8 ch)
+{
+    if((ch>='0')&&(ch<='9'))
+        return ch - '0';
+    else if ((ch>='a')&&(ch<='f'))
+        return ch - 'a' + 10;
+    else if ((ch>='A')&&(ch<='F'))
+        return ch - 'A' + 10;
+    else
+	 return 0xff;
+}
+
+u8 str_2char2num(u8 hch, u8 lch);
+u8 str_2char2num(u8 hch, u8 lch)
+{
+    return ((key_char2num(hch) * 10 ) + key_char2num(lch));
+}
+
+u8 key_2char2num(u8 hch, u8 lch);
+u8 key_2char2num(u8 hch, u8 lch)
+{
+    return ((key_char2num(hch) << 4) | key_char2num(lch));
+}
+
+u8 convert_ip_addr(u8 hch, u8 mch, u8 lch)
+{
+    return ((key_char2num(hch) * 100) + (key_char2num(mch) * 10 ) + key_char2num(lch));
+}
+
+extern char* rtw_initmac;
+void rtw_macaddr_cfg(u8 *mac_addr)
+{
+	u8 mac[ETH_ALEN];
+	if(mac_addr == NULL)	return;
+	
+	if ( rtw_initmac )
+	{	//	Users specify the mac address
+		int jj,kk;
+
+		for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+		{
+			mac[jj] = key_2char2num(rtw_initmac[kk], rtw_initmac[kk+ 1]);
+		}
+		_rtw_memcpy(mac_addr, mac, ETH_ALEN);
+	}
+	else
+	{	//	Use the mac address stored in the Efuse
+		_rtw_memcpy(mac, mac_addr, ETH_ALEN);
+	}
+	
+	if (((mac[0]==0xff) &&(mac[1]==0xff) && (mac[2]==0xff) &&
+	     (mac[3]==0xff) && (mac[4]==0xff) &&(mac[5]==0xff)) ||
+	    ((mac[0]==0x0) && (mac[1]==0x0) && (mac[2]==0x0) &&
+	     (mac[3]==0x0) && (mac[4]==0x0) &&(mac[5]==0x0)))
+	{
+		mac[0] = 0x00;
+		mac[1] = 0xe0;
+		mac[2] = 0x4c;
+		mac[3] = 0x87;
+		mac[4] = 0x00;
+		mac[5] = 0x00;
+		// use default mac addresss
+		_rtw_memcpy(mac_addr, mac, ETH_ALEN);
+		DBG_871X("MAC Address from efuse error, assign default one !!!\n");
+	}	
+
+	DBG_871X("rtw_macaddr_cfg MAC Address  = "MAC_FMT"\n", MAC_ARG(mac_addr));
+}
+
+void dump_ies(u8 *buf, u32 buf_len) {
+	u8* pos = (u8*)buf;
+	u8 id, len;
+	
+	while(pos-buf<=buf_len){
+		id = *pos;
+		len = *(pos+1);
+
+		DBG_871X("%s ID:%u, LEN:%u\n", __FUNCTION__, id, len);
+		#ifdef CONFIG_P2P
+		dump_p2p_ie(pos, len);
+		#endif
+		dump_wps_ie(pos, len);
+
+		pos+=(2+len);
+	}	
+}
+
+void dump_wps_ie(u8 *ie, u32 ie_len) {
+	u8* pos = (u8*)ie;
+	u16 id;
+	u16 len;
+
+	u8 *wps_ie;
+	uint wps_ielen;
+	
+	wps_ie = rtw_get_wps_ie(ie, ie_len, NULL, &wps_ielen);
+	if(wps_ie != ie || wps_ielen == 0)
+		return;
+
+	pos+=6;
+	while(pos-ie < ie_len){
+		id = RTW_GET_BE16(pos);
+		len = RTW_GET_BE16(pos + 2);
+
+		DBG_871X("%s ID:0x%04x, LEN:%u\n", __FUNCTION__, id, len);
+
+		pos+=(4+len);
+	}	
+}
+
+#ifdef CONFIG_P2P
+/**
+ * rtw_get_p2p_merged_len - Get merged ie length from muitiple p2p ies.
+ * @in_ie: Pointer of the first p2p ie
+ * @in_len: Total len of muiltiple p2p ies
+ * Returns: Length of merged p2p ie length
+ */
+u32 rtw_get_p2p_merged_ies_len(u8 *in_ie, u32 in_len)
+{
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 OUI[4] = { 0x50, 0x6f, 0x9a, 0x09 };
+	int i=0;
+	int j=0, len=0;
+
+	while( i < in_len)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(in_ie+ i);
+
+		if( pIE->ElementID == _VENDOR_SPECIFIC_IE_ && _rtw_memcmp(pIE->data, OUI, 4) )
+		{
+			len += pIE->Length-4; // 4 is P2P OUI length, don't count it in this loop
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	return len + 4;	// Append P2P OUI length at last.
+}
+
+/**
+ * rtw_p2p_merge_ies - Merge muitiple p2p ies into one
+ * @in_ie: Pointer of the first p2p ie
+ * @in_len: Total len of muiltiple p2p ies
+ * @merge_ie: Pointer of merged ie
+ * Returns: Length of merged p2p ie
+ */
+int rtw_p2p_merge_ies(u8 *in_ie, u32 in_len, u8 *merge_ie)
+{
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 len = 0;
+	u8 OUI[4] = { 0x50, 0x6f, 0x9a, 0x09 };
+	u8 ELOUI[6] = { 0xDD, 0x00, 0x50, 0x6f, 0x9a, 0x09 };	//EID;Len;OUI, Len would copy at the end of function
+	int i=0;
+
+	if( merge_ie != NULL)
+	{
+		//Set first P2P OUI
+		_rtw_memcpy(merge_ie, ELOUI, 6);
+		merge_ie += 6;
+
+		while( i < in_len)
+		{
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(in_ie+ i);
+
+			// Take out the rest of P2P OUIs
+			if( pIE->ElementID == _VENDOR_SPECIFIC_IE_ && _rtw_memcmp(pIE->data, OUI, 4) )
+			{
+				_rtw_memcpy( merge_ie, pIE->data +4, pIE->Length -4);
+				len += pIE->Length-4;
+				merge_ie += pIE->Length-4;
+			}
+
+			i += (pIE->Length + 2);
+		}
+
+		return len + 4;	// 4 is for P2P OUI
+
+	}
+
+	return 0;
+}
+
+void dump_p2p_ie(u8 *ie, u32 ie_len) {
+	u8* pos = (u8*)ie;
+	u8 id;
+	u16 len;
+
+	u8 *p2p_ie;
+	uint p2p_ielen;
+	
+	p2p_ie = rtw_get_p2p_ie(ie, ie_len, NULL, &p2p_ielen);
+	if(p2p_ie != ie || p2p_ielen == 0)
+		return;
+
+	pos+=6;
+	while(pos-ie < ie_len){
+		id = *pos;
+		len = RTW_GET_LE16(pos+1);
+
+		DBG_871X("%s ID:%u, LEN:%u\n", __FUNCTION__, id, len);
+
+		pos+=(3+len);
+	}	
+}
+
+/**
+ * rtw_get_p2p_ie - Search P2P IE from a series of IEs
+ * @in_ie: Address of IEs to search
+ * @in_len: Length limit from in_ie
+ * @p2p_ie: If not NULL and P2P IE is found, P2P IE will be copied to the buf starting from p2p_ie
+ * @p2p_ielen: If not NULL and P2P IE is found, will set to the length of the entire P2P IE
+ *
+ * Returns: The address of the P2P IE found, or NULL
+ */
+u8 *rtw_get_p2p_ie(u8 *in_ie, int in_len, u8 *p2p_ie, uint *p2p_ielen)
+{
+	uint cnt = 0;
+	u8 *p2p_ie_ptr;
+	u8 eid, p2p_oui[4]={0x50,0x6F,0x9A,0x09};
+
+	if ( p2p_ielen != NULL )
+		*p2p_ielen = 0;
+
+	while(cnt<in_len)
+	{
+		eid = in_ie[cnt];
+		if ((in_len < 0) || (cnt > MAX_IE_SZ)) {
+#ifdef PLATFORM_LINUX
+			dump_stack();
+#endif
+			return NULL;
+		}
+		if( ( eid == _VENDOR_SPECIFIC_IE_ ) && ( _rtw_memcmp( &in_ie[cnt+2], p2p_oui, 4) == _TRUE ) )
+		{
+			p2p_ie_ptr = in_ie + cnt;
+		
+			if ( p2p_ie != NULL )
+			{
+				_rtw_memcpy( p2p_ie, &in_ie[ cnt ], in_ie[ cnt + 1 ] + 2 );
+			}
+
+			if ( p2p_ielen != NULL )
+			{
+				*p2p_ielen = in_ie[ cnt + 1 ] + 2;
+			}
+			
+			return p2p_ie_ptr;
+
+			break;
+		}
+		else
+		{
+			cnt += in_ie[ cnt + 1 ] +2; //goto next	
+		}		
+		
+	}	
+
+	return NULL;
+
+}
+
+/**
+ * rtw_get_p2p_attr - Search a specific P2P attribute from a given P2P IE
+ * @p2p_ie: Address of P2P IE to search
+ * @p2p_ielen: Length limit from p2p_ie
+ * @target_attr_id: The attribute ID of P2P attribute to search
+ * @buf_attr: If not NULL and the P2P attribute is found, P2P attribute will be copied to the buf starting from buf_attr
+ * @len_attr: If not NULL and the P2P attribute is found, will set to the length of the entire P2P attribute
+ *
+ * Returns: the address of the specific WPS attribute found, or NULL
+ */
+u8 *rtw_get_p2p_attr(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_attr, u32 *len_attr)
+{
+	u8 *attr_ptr = NULL;
+	u8 *target_attr_ptr = NULL;
+	u8 p2p_oui[4]={0x50,0x6F,0x9A,0x09};
+
+	if(len_attr)
+		*len_attr = 0;
+
+	if ( !p2p_ie || ( p2p_ie[0] != _VENDOR_SPECIFIC_IE_ ) ||
+		( _rtw_memcmp( p2p_ie + 2, p2p_oui , 4 ) != _TRUE ) )
+	{
+		return attr_ptr;
+	}
+
+	// 6 = 1(Element ID) + 1(Length) + 3 (OUI) + 1(OUI Type)
+	attr_ptr = p2p_ie + 6; //goto first attr
+	
+	while(attr_ptr - p2p_ie < p2p_ielen)
+	{
+		// 3 = 1(Attribute ID) + 2(Length)
+		u8 attr_id = *attr_ptr;
+		u16 attr_data_len = RTW_GET_LE16(attr_ptr + 1);
+		u16 attr_len = attr_data_len + 3;
+		
+		//DBG_871X("%s attr_ptr:%p, id:%u, length:%u\n", __FUNCTION__, attr_ptr, attr_id, attr_data_len);
+		if( attr_id == target_attr_id )
+		{
+			target_attr_ptr = attr_ptr;
+		
+			if(buf_attr)
+				_rtw_memcpy(buf_attr, attr_ptr, attr_len);
+			
+			if(len_attr)
+				*len_attr = attr_len;
+			
+			break;
+		}
+		else
+		{
+			attr_ptr += attr_len; //goto next
+		}		
+		
+	}	
+
+	return target_attr_ptr;
+}
+
+/**
+ * rtw_get_p2p_attr_content - Search a specific P2P attribute content from a given P2P IE
+ * @p2p_ie: Address of P2P IE to search
+ * @p2p_ielen: Length limit from p2p_ie
+ * @target_attr_id: The attribute ID of P2P attribute to search
+ * @buf_content: If not NULL and the P2P attribute is found, P2P attribute content will be copied to the buf starting from buf_content
+ * @len_content: If not NULL and the P2P attribute is found, will set to the length of the P2P attribute content
+ *
+ * Returns: the address of the specific P2P attribute content found, or NULL
+ */
+u8 *rtw_get_p2p_attr_content(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_content, uint *len_content)
+{
+	u8 *attr_ptr;
+	u32 attr_len;
+
+	if(len_content)
+		*len_content = 0;
+	
+	attr_ptr = rtw_get_p2p_attr(p2p_ie, p2p_ielen, target_attr_id, NULL, &attr_len);
+
+	if(attr_ptr && attr_len)
+	{
+		if(buf_content)
+			_rtw_memcpy(buf_content, attr_ptr+3, attr_len-3);
+
+		if(len_content)
+			*len_content = attr_len-3;
+
+		return attr_ptr+3;
+	}
+
+	return NULL;
+}
+
+u32 rtw_set_p2p_attr_content(u8 *pbuf, u8 attr_id, u16 attr_len, u8 *pdata_attr)
+{	
+	u32 a_len;
+
+	*pbuf = attr_id;
+		
+	//*(u16*)(pbuf + 1) = cpu_to_le16(attr_len);
+	RTW_PUT_LE16(pbuf + 1, attr_len);
+
+	if(pdata_attr)
+		_rtw_memcpy(pbuf + 3, pdata_attr, attr_len);		
+		
+	a_len = attr_len + 3;
+		
+	return a_len;
+}
+
+static uint rtw_p2p_attr_remove(u8 *ie, uint ielen_ori, u8 attr_id)
+{
+	u8 *target_attr;
+	u32 target_attr_len;
+	uint ielen = ielen_ori;
+	int index=0;
+
+	while(1) {
+		target_attr=rtw_get_p2p_attr(ie, ielen, attr_id, NULL, &target_attr_len);
+		if(target_attr && target_attr_len)
+		{
+			u8 *next_attr = target_attr+target_attr_len;
+			uint remain_len = ielen-(next_attr-ie);
+			//dump_ies(ie, ielen);
+			#if 0
+			DBG_871X("[%d] ie:%p, ielen:%u\n"
+				"target_attr:%p, target_attr_len:%u\n"
+				"next_attr:%p, remain_len:%u\n"
+				, index++
+				, ie, ielen
+				, target_attr, target_attr_len
+				, next_attr, remain_len
+			);
+			#endif
+
+			_rtw_memset(target_attr, 0, target_attr_len);
+			_rtw_memcpy(target_attr, next_attr, remain_len);
+			_rtw_memset(target_attr+remain_len, 0, target_attr_len);
+			*(ie+1) -= target_attr_len;
+			ielen-=target_attr_len;
+		}
+		else
+		{
+			//if(index>0)
+			//	dump_ies(ie, ielen);
+			break;
+		}
+	}
+
+	return ielen;
+}
+
+void rtw_WLAN_BSSID_EX_remove_p2p_attr(WLAN_BSSID_EX *bss_ex, u8 attr_id)
+{
+	u8 *p2p_ie;
+	uint p2p_ielen, p2p_ielen_ori;
+	int cnt;
+	
+	if( (p2p_ie=rtw_get_p2p_ie(bss_ex->IEs+_FIXED_IE_LENGTH_, bss_ex->IELength-_FIXED_IE_LENGTH_, NULL, &p2p_ielen_ori)) ) 
+	{
+		#if 0
+		if(rtw_get_p2p_attr(p2p_ie, p2p_ielen_ori, attr_id, NULL, NULL)) {
+			DBG_871X("rtw_get_p2p_attr: GOT P2P_ATTR:%u!!!!!!!!\n", attr_id);
+			dump_ies(bss_ex->IEs+_FIXED_IE_LENGTH_, bss_ex->IELength-_FIXED_IE_LENGTH_);
+		}
+		#endif
+
+		p2p_ielen=rtw_p2p_attr_remove(p2p_ie, p2p_ielen_ori, attr_id);
+		if(p2p_ielen != p2p_ielen_ori) {
+			
+			u8 *next_ie_ori = p2p_ie+p2p_ielen_ori;
+			u8 *next_ie = p2p_ie+p2p_ielen;
+			uint remain_len = bss_ex->IELength-(next_ie_ori-bss_ex->IEs);
+
+			_rtw_memcpy(next_ie, next_ie_ori, remain_len);
+			_rtw_memset(next_ie+remain_len, 0, p2p_ielen_ori-p2p_ielen);
+			bss_ex->IELength -= p2p_ielen_ori-p2p_ielen;
+
+			#if 0
+			DBG_871X("remove P2P_ATTR:%u!\n", attr_id);
+			dump_ies(bss_ex->IEs+_FIXED_IE_LENGTH_, bss_ex->IELength-_FIXED_IE_LENGTH_);
+			#endif
+		}
+	}
+}
+
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_WFD
+int rtw_get_wfd_ie(u8 *in_ie, int in_len, u8 *wfd_ie, uint *wfd_ielen)
+{
+	int match;
+	uint cnt = 0;	
+	u8 eid, wfd_oui[4]={0x50,0x6F,0x9A,0x0A};
+
+
+	match=_FALSE;
+
+	if ( in_len < 0 )
+	{
+		return match;
+	}
+	
+	while(cnt<in_len)
+	{
+		eid = in_ie[cnt];
+		
+		if( ( eid == _VENDOR_SPECIFIC_IE_ ) && ( _rtw_memcmp( &in_ie[cnt+2], wfd_oui, 4) == _TRUE ) )
+		{
+			if ( wfd_ie != NULL )
+			{
+				_rtw_memcpy( wfd_ie, &in_ie[ cnt ], in_ie[ cnt + 1 ] + 2 );
+			
+			}
+			else
+			{
+				if ( wfd_ielen != NULL )
+				{
+					*wfd_ielen = 0;
+				}
+			}
+			
+			if ( wfd_ielen != NULL )
+			{
+				*wfd_ielen = in_ie[ cnt + 1 ] + 2;
+			}
+			
+			cnt += in_ie[ cnt + 1 ] + 2;
+
+			match = _TRUE;
+			break;
+		}
+		else
+		{
+			cnt += in_ie[ cnt + 1 ] +2; //goto next	
+		}		
+		
+	}	
+
+	if ( match == _TRUE )
+	{
+		match = cnt;
+	}
+	
+	return match;
+
+}
+
+//	attr_content: The output buffer, contains the "body field" of WFD attribute.
+//	attr_contentlen: The data length of the "body field" of WFD attribute.
+int rtw_get_wfd_attr_content(u8 *wfd_ie, uint wfd_ielen, u8 target_attr_id ,u8 *attr_content, uint *attr_contentlen)
+{
+	int match;
+	uint cnt = 0;	
+	u8 attr_id, wfd_oui[4]={0x50,0x6F,0x9A,0x0A};
+
+
+	match=_FALSE;
+
+	if ( ( wfd_ie[ 0 ] != _VENDOR_SPECIFIC_IE_ ) ||
+		( _rtw_memcmp( wfd_ie + 2, wfd_oui , 4 ) != _TRUE ) )
+	{
+		return( match );
+	}
+
+	//	1 ( WFD IE ) + 1 ( Length ) + 3 ( OUI ) + 1 ( OUI Type )
+	cnt = 6;
+	while( cnt < wfd_ielen )
+	{
+		u16 attrlen = RTW_GET_BE16(wfd_ie + cnt + 1);		
+		
+		attr_id = wfd_ie[cnt];
+		if( attr_id == target_attr_id )
+		{
+			//	3 -> 1 byte for attribute ID field, 2 bytes for length field
+			if(attr_content)
+				_rtw_memcpy( attr_content, &wfd_ie[ cnt + 3 ], attrlen );
+			
+			if(attr_contentlen)
+				*attr_contentlen = attrlen;
+			
+			cnt += attrlen + 3;
+
+			match = _TRUE;
+			break;
+		}
+		else
+		{
+			cnt += attrlen + 3; //goto next	
+		}		
+		
+	}	
+
+	return match;
+
+}
+#endif // CONFIG_WFD
+
+//Baron adds to avoid FreeBSD warning
+int ieee80211_is_empty_essid(const char *essid, int essid_len)
+{
+	/* Single white space is for Linksys APs */
+	if (essid_len == 1 && essid[0] == ' ')
+		return 1;
+
+	/* Otherwise, if the entire essid is 0, we assume it is hidden */
+	while (essid_len) {
+		essid_len--;
+		if (essid[essid_len] != '\0')
+			return 0;
+	}
+
+	return 1;
+}
+
+int ieee80211_get_hdrlen(u16 fc)
+{
+	int hdrlen = 24;
+
+	switch (WLAN_FC_GET_TYPE(fc)) {
+	case RTW_IEEE80211_FTYPE_DATA:
+		if (fc & RTW_IEEE80211_STYPE_QOS_DATA)
+			hdrlen += 2;
+		if ((fc & RTW_IEEE80211_FCTL_FROMDS) && (fc & RTW_IEEE80211_FCTL_TODS))
+			hdrlen += 6; /* Addr4 */
+		break;
+	case RTW_IEEE80211_FTYPE_CTL:
+		switch (WLAN_FC_GET_STYPE(fc)) {
+		case RTW_IEEE80211_STYPE_CTS:
+		case RTW_IEEE80211_STYPE_ACK:
+			hdrlen = 10;
+			break;
+		default:
+			hdrlen = 16;
+			break;
+		}
+		break;
+	}
+
+	return hdrlen;
+}
+
+//show MCS rate, unit: 100Kbps
+u16 rtw_mcs_rate(u8 rf_type, u8 bw_40MHz, u8 short_GI_20, u8 short_GI_40, unsigned char * MCS_rate)
+{
+	u16 max_rate = 0;
+	
+	if(rf_type == RF_1T1R)
+	{
+		if(MCS_rate[0] & BIT(7))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?1500:1350):((short_GI_20)?722:650);
+		else if(MCS_rate[0] & BIT(6))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?1350:1215):((short_GI_20)?650:585);
+		else if(MCS_rate[0] & BIT(5))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?1200:1080):((short_GI_20)?578:520);
+		else if(MCS_rate[0] & BIT(4))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?900:810):((short_GI_20)?433:390);
+		else if(MCS_rate[0] & BIT(3))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?600:540):((short_GI_20)?289:260);
+		else if(MCS_rate[0] & BIT(2))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?450:405):((short_GI_20)?217:195);
+		else if(MCS_rate[0] & BIT(1))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?300:270):((short_GI_20)?144:130);
+		else if(MCS_rate[0] & BIT(0))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?150:135):((short_GI_20)?72:65);
+	}
+	else
+	{
+		if(MCS_rate[1])
+		{
+			if(MCS_rate[1] & BIT(7))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?3000:2700):((short_GI_20)?1444:1300);
+			else if(MCS_rate[1] & BIT(6))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?2700:2430):((short_GI_20)?1300:1170);
+			else if(MCS_rate[1] & BIT(5))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?2400:2160):((short_GI_20)?1156:1040);
+			else if(MCS_rate[1] & BIT(4))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1800:1620):((short_GI_20)?867:780);
+			else if(MCS_rate[1] & BIT(3))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1200:1080):((short_GI_20)?578:520);
+			else if(MCS_rate[1] & BIT(2))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?900:810):((short_GI_20)?433:390);
+			else if(MCS_rate[1] & BIT(1))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?600:540):((short_GI_20)?289:260);
+			else if(MCS_rate[1] & BIT(0))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?300:270):((short_GI_20)?144:130);
+		}
+		else
+		{
+			if(MCS_rate[0] & BIT(7))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1500:1350):((short_GI_20)?722:650);
+			else if(MCS_rate[0] & BIT(6))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1350:1215):((short_GI_20)?650:585);
+			else if(MCS_rate[0] & BIT(5))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1200:1080):((short_GI_20)?578:520);
+			else if(MCS_rate[0] & BIT(4))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?900:810):((short_GI_20)?433:390);
+			else if(MCS_rate[0] & BIT(3))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?600:540):((short_GI_20)?289:260);
+			else if(MCS_rate[0] & BIT(2))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?450:405):((short_GI_20)?217:195);
+			else if(MCS_rate[0] & BIT(1))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?300:270):((short_GI_20)?144:130);
+			else if(MCS_rate[0] & BIT(0))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?150:135):((short_GI_20)?72:65);
+		}
+	}
+	return max_rate;
+}
+
+int rtw_action_frame_parse(const u8 *frame, u32 frame_len, u8* category, u8 *action)
+{
+	const u8 *frame_body = frame + sizeof(struct rtw_ieee80211_hdr_3addr);
+	u16 fc;
+	u8 c;
+	u8 a = ACT_PUBLIC_MAX;
+
+	fc = le16_to_cpu(((struct rtw_ieee80211_hdr_3addr *)frame)->frame_ctl);
+
+	if ((fc & (RTW_IEEE80211_FCTL_FTYPE|RTW_IEEE80211_FCTL_STYPE))
+		!= (RTW_IEEE80211_FTYPE_MGMT|RTW_IEEE80211_STYPE_ACTION)
+	)
+	{
+		return _FALSE;
+	}
+
+	c = frame_body[0];
+
+	switch(c) {
+	case RTW_WLAN_CATEGORY_P2P: /* vendor-specific */
+		break;
+	default:
+		a = frame_body[1];
+	}
+
+	if (category)
+		*category = c;
+	if (action)
+		*action = a;
+
+	return _TRUE;
+}
+
+static const char *_action_public_str[] = {
+	"ACT_PUB_BSSCOEXIST",
+	"ACT_PUB_DSE_ENABLE",
+	"ACT_PUB_DSE_DEENABLE",
+	"ACT_PUB_DSE_REG_LOCATION",
+	"ACT_PUB_EXT_CHL_SWITCH",
+	"ACT_PUB_DSE_MSR_REQ",
+	"ACT_PUB_DSE_MSR_RPRT",
+	"ACT_PUB_MP",
+	"ACT_PUB_DSE_PWR_CONSTRAINT",
+	"ACT_PUB_VENDOR",
+	"ACT_PUB_GAS_INITIAL_REQ",
+	"ACT_PUB_GAS_INITIAL_RSP",
+	"ACT_PUB_GAS_COMEBACK_REQ",
+	"ACT_PUB_GAS_COMEBACK_RSP",
+	"ACT_PUB_TDLS_DISCOVERY_RSP",
+	"ACT_PUB_LOCATION_TRACK",
+	"ACT_PUB_RSVD",
+};
+
+const char *action_public_str(u8 action)
+{
+	action = (action >= ACT_PUBLIC_MAX) ? ACT_PUBLIC_MAX : action;
+	return _action_public_str[action];
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c
new file mode 100755
index 0000000000000..4ffaa50d3c5df
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c
@@ -0,0 +1,464 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*
+
+The purpose of rtw_io.c
+
+a. provides the API
+
+b. provides the protocol engine
+
+c. provides the software interface between caller and the hardware interface
+
+
+Compiler Flag Option:
+
+1. CONFIG_SDIO_HCI:
+    a. USE_SYNC_IRP:  Only sync operations are provided.
+    b. USE_ASYNC_IRP:Both sync/async operations are provided.
+
+2. CONFIG_USB_HCI:
+   a. USE_ASYNC_IRP: Both sync/async operations are provided.
+
+3. CONFIG_CFIO_HCI:
+   b. USE_SYNC_IRP: Only sync operations are provided.
+
+
+Only sync read/rtw_write_mem operations are provided.
+
+jackson@realtek.com.tw
+
+*/
+
+#define _RTW_IO_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_io.h>
+#include <osdep_intf.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+#ifdef CONFIG_SDIO_HCI
+#include <sdio_ops.h>
+#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_ops.h>
+#endif
+
+
+u8 _rtw_read8(_adapter *adapter, u32 addr)
+{
+	u8 r_val;
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
+	_func_enter_;
+	_read8 = pintfhdl->io_ops._read8;
+
+	r_val = _read8(pintfhdl, addr);
+	_func_exit_;
+	return r_val;
+}
+
+u16 _rtw_read16(_adapter *adapter, u32 addr)
+{
+	u16 r_val;
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u16 	(*_read16)(struct intf_hdl *pintfhdl, u32 addr);
+	_func_enter_;
+	_read16 = pintfhdl->io_ops._read16;
+
+	r_val = _read16(pintfhdl, addr);
+	_func_exit_;
+	return r_val;
+}
+
+u32 _rtw_read32(_adapter *adapter, u32 addr)
+{
+	u32 r_val;
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u32 	(*_read32)(struct intf_hdl *pintfhdl, u32 addr);
+	_func_enter_;
+	_read32 = pintfhdl->io_ops._read32;
+
+	r_val = _read32(pintfhdl, addr);
+	_func_exit_;
+	return r_val;
+
+}
+
+int _rtw_write8(_adapter *adapter, u32 addr, u8 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+	int ret;
+	_func_enter_;
+	_write8 = pintfhdl->io_ops._write8;
+
+	ret = _write8(pintfhdl, addr, val);
+	_func_exit_;
+	
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write16(_adapter *adapter, u32 addr, u16 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+	int ret;
+	_func_enter_;
+	_write16 = pintfhdl->io_ops._write16;
+
+	ret = _write16(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write32(_adapter *adapter, u32 addr, u32 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+	int ret;
+	_func_enter_;
+	_write32 = pintfhdl->io_ops._write32;
+
+	ret = _write32(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+
+int _rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *pdata)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+        struct	intf_hdl	*pintfhdl = (struct intf_hdl*)(&(pio_priv->intf));
+	int (*_writeN)(struct intf_hdl *pintfhdl, u32 addr,u32 length, u8 *pdata);
+	int ret;
+	_func_enter_;
+	_writeN = pintfhdl->io_ops._writeN;
+
+	ret = _writeN(pintfhdl, addr,length,pdata);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write8_async(_adapter *adapter, u32 addr, u8 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write8_async)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+	int ret;
+	_func_enter_;
+	_write8_async = pintfhdl->io_ops._write8_async;
+
+	ret = _write8_async(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write16_async(_adapter *adapter, u32 addr, u16 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+	int ret;
+	_func_enter_;
+	_write16_async = pintfhdl->io_ops._write16_async;
+
+	ret = _write16_async(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write32_async(_adapter *adapter, u32 addr, u32 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+	int ret;
+	_func_enter_;
+	_write32_async = pintfhdl->io_ops._write32_async;
+
+	ret = _write32_async(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+void _rtw_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+
+	_func_enter_;
+
+	if( (adapter->bDriverStopped ==_TRUE) || (adapter->bSurpriseRemoved == _TRUE))
+	{
+	     RT_TRACE(_module_rtl871x_io_c_, _drv_info_, ("rtw_read_mem:bDriverStopped(%d) OR bSurpriseRemoved(%d)", adapter->bDriverStopped, adapter->bSurpriseRemoved));	    
+	     return;
+	}
+
+	_read_mem = pintfhdl->io_ops._read_mem;
+
+	_read_mem(pintfhdl, addr, cnt, pmem);
+
+	_func_exit_;
+
+}
+
+void _rtw_write_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+
+	_func_enter_;
+
+	_write_mem = pintfhdl->io_ops._write_mem;
+
+	_write_mem(pintfhdl, addr, cnt, pmem);
+
+	_func_exit_;
+
+}
+
+void _rtw_read_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+
+	_func_enter_;
+
+	if( (adapter->bDriverStopped ==_TRUE) || (adapter->bSurpriseRemoved == _TRUE))
+	{
+	     RT_TRACE(_module_rtl871x_io_c_, _drv_info_, ("rtw_read_port:bDriverStopped(%d) OR bSurpriseRemoved(%d)", adapter->bDriverStopped, adapter->bSurpriseRemoved));	    
+	     return;
+	}
+
+	_read_port = pintfhdl->io_ops._read_port;
+
+	_read_port(pintfhdl, addr, cnt, pmem);
+
+	_func_exit_;
+
+}
+
+void _rtw_read_port_cancel(_adapter *adapter)
+{
+	void (*_read_port_cancel)(struct intf_hdl *pintfhdl);
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct intf_hdl *pintfhdl = &(pio_priv->intf);
+
+	_read_port_cancel = pintfhdl->io_ops._read_port_cancel;
+
+	if(_read_port_cancel)
+		_read_port_cancel(pintfhdl);
+
+}
+
+u32 _rtw_write_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u32 ret = _SUCCESS;
+
+	_func_enter_;
+
+	_write_port = pintfhdl->io_ops._write_port;
+	
+	ret = _write_port(pintfhdl, addr, cnt, pmem);
+
+	 _func_exit_;
+
+	return ret;
+}
+
+u32 _rtw_write_port_and_wait(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem, int timeout_ms)
+{
+	int ret = _SUCCESS;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pmem;
+	struct submit_ctx sctx;
+
+	rtw_sctx_init(&sctx, timeout_ms);
+	pxmitbuf->sctx = &sctx;
+
+	ret = _rtw_write_port(adapter, addr, cnt, pmem);
+
+	if (ret == _SUCCESS)
+		ret = rtw_sctx_wait(&sctx);
+
+	 return ret;
+}
+
+void _rtw_write_port_cancel(_adapter *adapter)
+{
+	void (*_write_port_cancel)(struct intf_hdl *pintfhdl);
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct intf_hdl *pintfhdl = &(pio_priv->intf);
+
+	_write_port_cancel = pintfhdl->io_ops._write_port_cancel;
+
+	if(_write_port_cancel)
+		_write_port_cancel(pintfhdl);
+
+}
+
+int rtw_init_io_priv(_adapter *padapter, void (*set_intf_ops)(struct _io_ops *pops))
+{
+	struct io_priv	*piopriv = &padapter->iopriv;
+	struct intf_hdl *pintf = &piopriv->intf;
+
+	if (set_intf_ops == NULL)
+		return _FAIL;
+
+	piopriv->padapter = padapter;
+	pintf->padapter = padapter;
+	pintf->pintf_dev = adapter_to_dvobj(padapter);
+
+	set_intf_ops(&pintf->io_ops);
+
+	return _SUCCESS;
+}
+
+#ifdef DBG_IO
+
+u16 read_sniff_ranges[][2] = {
+	//{0x550, 0x551},
+}; 
+
+u16 write_sniff_ranges[][2] = {
+	//{0x550, 0x551},
+	//{0x4c, 0x4c},
+}; 
+
+int read_sniff_num = sizeof(read_sniff_ranges)/sizeof(u16)/2;
+int write_sniff_num = sizeof(write_sniff_ranges)/sizeof(u16)/2;
+
+bool match_read_sniff_ranges(u16 addr, u16 len)
+{
+	int i;
+	for (i = 0; i<read_sniff_num; i++) {
+		if (addr + len > read_sniff_ranges[i][0] && addr <= read_sniff_ranges[i][1])
+			return _TRUE;
+	}
+	
+	return _FALSE;
+}
+
+bool match_write_sniff_ranges(u16 addr, u16 len)
+{
+	int i;
+	for (i = 0; i<write_sniff_num; i++) {
+		if (addr + len > write_sniff_ranges[i][0] && addr <= write_sniff_ranges[i][1])
+			return _TRUE;
+	}
+	
+	return _FALSE;
+}
+
+u8 dbg_rtw_read8(_adapter *adapter, u32 addr, const char *caller, const int line)
+{
+	u8 val = _rtw_read8(adapter, addr);
+
+	if (match_read_sniff_ranges(addr, 1))
+		DBG_871X("DBG_IO %s:%d rtw_read8(0x%04x) return 0x%02x\n", caller, line, addr, val);
+
+	return val;
+}
+
+u16 dbg_rtw_read16(_adapter *adapter, u32 addr, const char *caller, const int line)
+{
+	u16 val = _rtw_read16(adapter, addr);
+	
+	if (match_read_sniff_ranges(addr, 2))
+		DBG_871X("DBG_IO %s:%d rtw_read16(0x%04x) return 0x%04x\n", caller, line, addr, val);
+
+	return val;
+}
+
+u32 dbg_rtw_read32(_adapter *adapter, u32 addr, const char *caller, const int line)
+{
+	u32 val = _rtw_read32(adapter, addr);
+	
+	if (match_read_sniff_ranges(addr, 4))
+		DBG_871X("DBG_IO %s:%d rtw_read32(0x%04x) return 0x%08x\n", caller, line, addr, val);
+
+	return val;
+}
+
+int dbg_rtw_write8(_adapter *adapter, u32 addr, u8 val, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 1))
+		DBG_871X("DBG_IO %s:%d rtw_write8(0x%04x, 0x%02x)\n", caller, line, addr, val);
+	
+	return _rtw_write8(adapter, addr, val);
+}
+int dbg_rtw_write16(_adapter *adapter, u32 addr, u16 val, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 2))
+		DBG_871X("DBG_IO %s:%d rtw_write16(0x%04x, 0x%04x)\n", caller, line, addr, val);
+	
+	return _rtw_write16(adapter, addr, val);
+}
+int dbg_rtw_write32(_adapter *adapter, u32 addr, u32 val, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 4))
+		DBG_871X("DBG_IO %s:%d rtw_write32(0x%04x, 0x%08x)\n", caller, line, addr, val);
+	
+	return _rtw_write32(adapter, addr, val);
+}
+int dbg_rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *data, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, length))
+		DBG_871X("DBG_IO %s:%d rtw_writeN(0x%04x, %u)\n", caller, line, addr, length);
+
+	return _rtw_writeN(adapter, addr, length, data);
+}
+#endif
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c
new file mode 100755
index 0000000000000..06018867e34dd
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c
@@ -0,0 +1,196 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_IOCTL_QUERY_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_ioctl_query.h>
+#include <wifi.h>
+
+
+#ifdef PLATFORM_WINDOWS
+//
+// Added for WPA2-PSK, by Annie, 2005-09-20.
+//
+u8
+query_802_11_capability(
+	_adapter*		Adapter,
+	u8*			pucBuf,
+	u32 *		pulOutLen
+)
+{
+	static NDIS_802_11_AUTHENTICATION_ENCRYPTION szAuthEnc[] = 
+	{
+		{Ndis802_11AuthModeOpen, Ndis802_11EncryptionDisabled}, 
+		{Ndis802_11AuthModeOpen, Ndis802_11Encryption1Enabled},
+		{Ndis802_11AuthModeShared, Ndis802_11EncryptionDisabled}, 
+		{Ndis802_11AuthModeShared, Ndis802_11Encryption1Enabled},
+		{Ndis802_11AuthModeWPA, Ndis802_11Encryption2Enabled}, 
+		{Ndis802_11AuthModeWPA, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPAPSK, Ndis802_11Encryption2Enabled}, 
+		{Ndis802_11AuthModeWPAPSK, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPANone, Ndis802_11Encryption2Enabled}, 
+		{Ndis802_11AuthModeWPANone, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPA2, Ndis802_11Encryption2Enabled}, 
+		{Ndis802_11AuthModeWPA2, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPA2PSK, Ndis802_11Encryption2Enabled}, 
+		{Ndis802_11AuthModeWPA2PSK, Ndis802_11Encryption3Enabled}
+	};	
+	static ULONG	ulNumOfPairSupported = sizeof(szAuthEnc)/sizeof(NDIS_802_11_AUTHENTICATION_ENCRYPTION);
+	NDIS_802_11_CAPABILITY * pCap = (NDIS_802_11_CAPABILITY *)pucBuf;
+	u8*	pucAuthEncryptionSupported = (u8*) pCap->AuthenticationEncryptionSupported;
+
+
+	pCap->Length = sizeof(NDIS_802_11_CAPABILITY);
+	if(ulNumOfPairSupported > 1 )
+		pCap->Length += 	(ulNumOfPairSupported-1) * sizeof(NDIS_802_11_AUTHENTICATION_ENCRYPTION);
+	
+	pCap->Version = 2;	
+	pCap->NoOfPMKIDs = NUM_PMKID_CACHE;	
+	pCap->NoOfAuthEncryptPairsSupported = ulNumOfPairSupported;
+
+	if( sizeof (szAuthEnc) <= 240 )		// 240 = 256 - 4*4	// SecurityInfo.szCapability: only 256 bytes in size.
+	{
+		_rtw_memcpy( pucAuthEncryptionSupported, (u8*)szAuthEnc,  sizeof (szAuthEnc) );
+		*pulOutLen = pCap->Length;
+		return _TRUE;
+	}
+	else
+	{
+		*pulOutLen = 0;
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("_query_802_11_capability(): szAuthEnc size is too large.\n"));
+		return _FALSE;
+	}
+}
+
+u8 query_802_11_association_information(	_adapter *padapter,PNDIS_802_11_ASSOCIATION_INFORMATION	pAssocInfo)
+{
+	struct wlan_network *tgt_network;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct	security_priv  *psecuritypriv=&(padapter->securitypriv);
+	WLAN_BSSID_EX	*psecnetwork=(WLAN_BSSID_EX*)&(psecuritypriv->sec_bss);					
+	u8 *	pDest = (u8 *)pAssocInfo + sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+	unsigned char i,*auth_ie,*supp_ie;
+
+	//NdisZeroMemory(pAssocInfo, sizeof(NDIS_802_11_ASSOCIATION_INFORMATION));
+	_rtw_memset(pAssocInfo, 0, sizeof(NDIS_802_11_ASSOCIATION_INFORMATION));
+	//pAssocInfo->Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+
+	//------------------------------------------------------
+	// Association Request related information
+	//------------------------------------------------------
+	// Req_1. AvailableRequestFixedIEs
+	if(psecnetwork!=NULL){
+		
+	pAssocInfo->AvailableRequestFixedIEs |= NDIS_802_11_AI_REQFI_CAPABILITIES|NDIS_802_11_AI_REQFI_CURRENTAPADDRESS;
+	pAssocInfo->RequestFixedIEs.Capabilities = (unsigned short)* & psecnetwork->IEs[10];
+	_rtw_memcpy(pAssocInfo->RequestFixedIEs.CurrentAPAddress,
+		& psecnetwork->MacAddress, 6);
+
+	pAssocInfo->OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+
+	if(check_fwstate( pmlmepriv, _FW_UNDER_LINKING|_FW_LINKED)==_TRUE)
+	{
+		
+		if(psecuritypriv->ndisauthtype>=Ndis802_11AuthModeWPA2)
+			pDest[0] =48;		//RSN Information Element
+		else 
+			pDest[0] =221;	//WPA(SSN) Information Element
+		
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n Adapter->ndisauthtype==Ndis802_11AuthModeWPA)?0xdd:0x30 [%d]",pDest[0]));
+		supp_ie=&psecuritypriv->supplicant_ie[0];
+		for(i=0;i<supp_ie[0];i++)
+		{
+			RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("IEs [%d] = 0x%x \n\n", i,supp_ie[i]));
+		}
+
+		i=13;	//0~11 is fixed information element		
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("i= %d tgt_network->network.IELength=%d\n\n", i,(int)psecnetwork->IELength));
+		while((i<supp_ie[0]) && (i<256)){
+			if((unsigned char)supp_ie[i]==pDest[0]){
+						_rtw_memcpy((u8 *)(pDest),
+							&supp_ie[i], 
+							supp_ie[1+i]+2);
+			
+				break;
+			}
+			
+			i=i+supp_ie[i+1]+2;
+			if(supp_ie[1+i]==0)
+				i=i+1;
+			RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("iteration i=%d IEs [%d] = 0x%x \n\n", i,i,supp_ie[i+1]));
+			
+		}
+		
+
+		pAssocInfo->RequestIELength += (2 + supp_ie[1+i]);// (2 + psecnetwork->IEs[1+i]+4);
+
+	}
+	
+
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n psecnetwork != NULL,fwstate==_FW_UNDER_LINKING \n"));
+
+	}
+	
+
+	//------------------------------------------------------
+	// Association Response related information
+	//------------------------------------------------------
+
+	if(check_fwstate( pmlmepriv, _FW_LINKED)==_TRUE)
+	{
+		tgt_network =&(pmlmepriv->cur_network);
+		if(tgt_network!=NULL){
+		pAssocInfo->AvailableResponseFixedIEs =
+				NDIS_802_11_AI_RESFI_CAPABILITIES
+				|NDIS_802_11_AI_RESFI_ASSOCIATIONID
+				;
+
+		pAssocInfo->ResponseFixedIEs.Capabilities =(unsigned short)* & tgt_network->network.IEs[10];
+		pAssocInfo->ResponseFixedIEs.StatusCode = 0;
+		pAssocInfo->ResponseFixedIEs.AssociationId =(unsigned short) tgt_network->aid;
+
+		pDest = (u8 *)pAssocInfo + sizeof(NDIS_802_11_ASSOCIATION_INFORMATION)+pAssocInfo->RequestIELength;
+		auth_ie=&psecuritypriv->authenticator_ie[0];
+
+		for(i=0;i<auth_ie[0];i++)
+			RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("IEs [%d] = 0x%x \n\n", i,auth_ie[i]));
+
+		i=auth_ie[0]-12;
+		if(i>0){
+			_rtw_memcpy((u8 *)&pDest[0],&auth_ie[1],i);
+			pAssocInfo->ResponseIELength =i; 
+		}
+
+
+		pAssocInfo->OffsetResponseIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION) + pAssocInfo->RequestIELength;  
+
+
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n tgt_network != NULL,fwstate==_FW_LINKED \n"));
+		}
+	}												  	
+	RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n exit query_802_11_association_information \n"));
+_func_exit_;
+
+	return _TRUE;
+}
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c
new file mode 100755
index 0000000000000..31b4704d43478
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c
@@ -0,0 +1,1031 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _RTW_IOCTL_RTL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+#include <wifi.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_set.h>
+#include <rtw_ioctl_query.h>
+#include <rtw_ioctl_rtl.h>
+#include <mp_custom_oid.h>
+#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp.h>
+#include <rtw_mp_ioctl.h>
+#endif
+
+struct oid_obj_priv oid_rtl_seg_01_01[] =
+{
+	{1, &oid_null_function},										//0x80
+	{1, &oid_null_function},										//0x81
+	{1, &oid_null_function},										//0x82
+	{1, &oid_null_function},										//0x83//OID_RT_SET_SNIFFER_MODE
+	{1, &oid_rt_get_signal_quality_hdl},							//0x84
+	{1, &oid_rt_get_small_packet_crc_hdl},						//0x85
+	{1, &oid_rt_get_middle_packet_crc_hdl},						//0x86
+	{1, &oid_rt_get_large_packet_crc_hdl},						//0x87
+	{1, &oid_rt_get_tx_retry_hdl},								//0x88
+	{1, &oid_rt_get_rx_retry_hdl},								//0x89
+	{1, &oid_rt_pro_set_fw_dig_state_hdl},						//0x8A
+	{1, &oid_rt_pro_set_fw_ra_state_hdl}	,						//0x8B
+	{1, &oid_null_function},										//0x8C
+	{1, &oid_null_function},										//0x8D
+	{1, &oid_null_function},										//0x8E
+	{1, &oid_null_function},										//0x8F
+	{1, &oid_rt_get_rx_total_packet_hdl},							//0x90
+	{1, &oid_rt_get_tx_beacon_ok_hdl},							//0x91
+	{1, &oid_rt_get_tx_beacon_err_hdl},							//0x92
+	{1, &oid_rt_get_rx_icv_err_hdl},								//0x93
+	{1, &oid_rt_set_encryption_algorithm_hdl},					//0x94
+	{1, &oid_null_function},										//0x95
+	{1, &oid_rt_get_preamble_mode_hdl},							//0x96
+	{1, &oid_null_function},										//0x97
+	{1, &oid_rt_get_ap_ip_hdl},									//0x98
+	{1, &oid_rt_get_channelplan_hdl},							//0x99	
+	{1, &oid_rt_set_preamble_mode_hdl},	 						//0x9A
+	{1, &oid_rt_set_bcn_intvl_hdl},								//0x9B
+	{1, &oid_null_function},										//0x9C
+	{1, &oid_rt_dedicate_probe_hdl},								//0x9D
+	{1, &oid_null_function},										//0x9E
+	{1, &oid_null_function},										//0x9F
+	{1, &oid_null_function},										//0xA0
+	{1, &oid_null_function},										//0xA1
+	{1, &oid_null_function},										//0xA2
+	{1, &oid_null_function},										//0xA3
+	{1, &oid_null_function},										//0xA4
+	{1, &oid_null_function},										//0xA5
+	{1, &oid_null_function},										//0xA6
+	{1, &oid_rt_get_total_tx_bytes_hdl},							//0xA7
+	{1, &oid_rt_get_total_rx_bytes_hdl},							//0xA8
+	{1, &oid_rt_current_tx_power_level_hdl},						//0xA9	
+	{1, &oid_rt_get_enc_key_mismatch_count_hdl},	 			//0xAA
+	{1, &oid_rt_get_enc_key_match_count_hdl},					//0xAB
+	{1, &oid_rt_get_channel_hdl},								//0xAC
+	{1, &oid_rt_set_channelplan_hdl},								//0xAD
+	{1, &oid_rt_get_hardware_radio_off_hdl},						//0xAE
+	{1, &oid_null_function},										//0xAF
+	{1, &oid_null_function},										//0xB0
+	{1, &oid_null_function},										//0xB1
+	{1, &oid_null_function},										//0xB2
+	{1, &oid_null_function},										//0xB3
+	{1, &oid_rt_get_key_mismatch_hdl},							//0xB4
+	{1, &oid_null_function},										//0xB5
+	{1, &oid_null_function},										//0xB6
+	{1, &oid_null_function},										//0xB7
+	{1, &oid_null_function},										//0xB8
+	{1, &oid_null_function},										//0xB9	
+	{1, &oid_null_function},	 									//0xBA
+	{1, &oid_rt_supported_wireless_mode_hdl},					//0xBB
+	{1, &oid_rt_get_channel_list_hdl},							//0xBC
+	{1, &oid_rt_get_scan_in_progress_hdl},						//0xBD
+	{1, &oid_null_function},										//0xBE
+	{1, &oid_null_function},										//0xBF
+	{1, &oid_null_function},										//0xC0
+	{1, &oid_rt_forced_data_rate_hdl},							//0xC1
+	{1, &oid_rt_wireless_mode_for_scan_list_hdl},					//0xC2
+	{1, &oid_rt_get_bss_wireless_mode_hdl},						//0xC3
+	{1, &oid_rt_scan_with_magic_packet_hdl},					//0xC4
+	{1, &oid_null_function},										//0xC5
+	{1, &oid_null_function},										//0xC6
+	{1, &oid_null_function},										//0xC7
+	{1, &oid_null_function},										//0xC8
+	{1, &oid_null_function},										//0xC9	
+	{1, &oid_null_function},	 									//0xCA
+	{1, &oid_null_function},										//0xCB
+	{1, &oid_null_function},										//0xCC
+	{1, &oid_null_function},										//0xCD
+	{1, &oid_null_function},										//0xCE
+	{1, &oid_null_function},										//0xCF
+	
+};
+
+struct oid_obj_priv oid_rtl_seg_01_03[] =
+{
+	{1, &oid_rt_ap_get_associated_station_list_hdl},				//0x00
+	{1, &oid_null_function},										//0x01
+	{1, &oid_rt_ap_switch_into_ap_mode_hdl},					//0x02
+	{1, &oid_null_function},										//0x03
+	{1, &oid_rt_ap_supported_hdl},								//0x04
+	{1, &oid_rt_ap_set_passphrase_hdl},							//0x05
+
+};
+
+struct oid_obj_priv oid_rtl_seg_01_11[] =
+{
+	{1, &oid_null_function},					//0xC0	OID_RT_PRO_RX_FILTER	
+	{1, &oid_null_function},					//0xC1	OID_CE_USB_WRITE_REGISTRY
+	{1, &oid_null_function},					//0xC2	OID_CE_USB_READ_REGISTRY
+	{1, &oid_null_function},					//0xC3	OID_RT_PRO_SET_INITIAL_GAIN
+	{1, &oid_null_function},					//0xC4	OID_RT_PRO_SET_BB_RF_STANDBY_MODE
+	{1, &oid_null_function},					//0xC5	OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE
+	{1, &oid_null_function},					//0xC6	OID_RT_PRO_SET_TX_CHARGE_PUMP
+	{1, &oid_null_function},					//0xC7	OID_RT_PRO_SET_RX_CHARGE_PUMP
+	{1, &oid_rt_pro_rf_write_registry_hdl},	//0xC8	
+	{1, &oid_rt_pro_rf_read_registry_hdl},	//0xC9	
+	{1, &oid_null_function}					//0xCA	OID_RT_PRO_QUERY_RF_TYPE
+	
+};
+
+struct oid_obj_priv oid_rtl_seg_03_00[] =
+{
+	{1, &oid_null_function},										//0x00
+	{1, &oid_rt_get_connect_state_hdl},							//0x01
+	{1, &oid_null_function},										//0x02
+	{1, &oid_null_function},										//0x03
+	{1, &oid_rt_set_default_key_id_hdl},							//0x04
+
+	
+};
+
+
+//**************  oid_rtl_seg_01_01 section start ************** 
+
+NDIS_STATUS oid_rt_pro_set_fw_dig_state_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL			oldirql;
+	
+	_func_enter_;
+	
+	if(poid_par_priv->type_of_oid != SET_OID) 
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+			
+	_irqlevel_changed_(&oldirql,LOWER);
+	if(poid_par_priv->information_buf_len >= sizeof(struct setdig_parm))
+	{
+		//DEBUG_ERR(("===> oid_rt_pro_set_fw_dig_state_hdl. type:0x%02x.\n",*((unsigned char*)poid_par_priv->information_buf )));	
+		if(!rtw_setfwdig_cmd(Adapter,*((unsigned char*)poid_par_priv->information_buf )))			
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+		                   
+	}
+	else{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+	}  
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+#endif
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_fw_ra_state_hdl(struct oid_par_priv* poid_par_priv)
+{
+
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL			oldirql;
+	
+	_func_enter_;	
+	if(poid_par_priv->type_of_oid != SET_OID) 
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+					
+	_irqlevel_changed_(&oldirql,LOWER);
+	
+	if(poid_par_priv->information_buf_len >= sizeof(struct setra_parm))
+	{
+		//DEBUG_ERR(("===> oid_rt_pro_set_fw_ra_state_hdl. type:0x%02x.\n",*((unsigned char*)poid_par_priv->information_buf )));	
+		if(!rtw_setfwra_cmd(Adapter,*((unsigned char*)poid_par_priv->information_buf )))			
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+		                   
+	}
+	else{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+	}  
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+#endif
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_signal_quality_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	//DEBUG_ERR(("<**********************oid_rt_get_signal_quality_hdl \n"));
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+#if 0
+		if(pMgntInfo->mAssoc || pMgntInfo->mIbss)
+		{
+			ulInfo = pAdapter->RxStats.SignalQuality;
+			*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		}
+		else
+		{
+			ulInfo = 0xffffffff; // It stands for -1 in 4-byte integer.
+		}
+		break;
+#endif
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+
+NDIS_STATUS oid_rt_get_small_packet_crc_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+		
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{		
+		*(ULONG *)poid_par_priv->information_buf = padapter->recvpriv.rx_smallpacket_crcerr;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;		
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{		
+		*(ULONG *)poid_par_priv->information_buf = padapter->recvpriv.rx_middlepacket_crcerr;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;		
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_large_packet_crc_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}	
+
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{		
+		*(ULONG *)poid_par_priv->information_buf = padapter->recvpriv.rx_largepacket_crcerr;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;		
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_tx_retry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_rx_retry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_rx_total_packet_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}	
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{		
+		*(u64 *)poid_par_priv->information_buf = padapter->recvpriv.rx_pkts + padapter->recvpriv.rx_drop;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;		
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_rx_icv_err_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len>= sizeof(u32))
+	{
+		//_rtw_memcpy(*(uint *)poid_par_priv->information_buf,padapter->recvpriv.rx_icv_err,sizeof(u32));
+		*(uint *)poid_par_priv->information_buf = padapter->recvpriv.rx_icv_err;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+	
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}	
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_preamble_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	ULONG			preamblemode = 0 ;			
+		
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{		
+		if(padapter->registrypriv.preamble == PREAMBLE_LONG)
+			preamblemode = 0;
+		else if (padapter->registrypriv.preamble == PREAMBLE_AUTO)
+			preamblemode = 1;
+		else if (padapter->registrypriv.preamble == PREAMBLE_SHORT)
+			preamblemode = 2;
+		
+			
+		*(ULONG *)poid_par_priv->information_buf = preamblemode ;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_ap_ip_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_get_channelplan_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct eeprom_priv*	peeprompriv = &padapter->eeprompriv;	
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	*(u16 *)poid_par_priv->information_buf = peeprompriv->channel_plan ;
+
+	return status;
+}
+NDIS_STATUS oid_rt_set_channelplan_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct eeprom_priv*	peeprompriv = &padapter->eeprompriv;	
+	
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+	
+	peeprompriv->channel_plan = *(u16 *)poid_par_priv->information_buf ;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_preamble_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	ULONG			preamblemode = 0;
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	 
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{		
+		preamblemode = *(ULONG *)poid_par_priv->information_buf ;
+		if( preamblemode == 0)
+			padapter->registrypriv.preamble = PREAMBLE_LONG;
+		else if (preamblemode==1 )
+			padapter->registrypriv.preamble = PREAMBLE_AUTO;
+		else if ( preamblemode==2 )
+			padapter->registrypriv.preamble = PREAMBLE_SHORT;		
+			
+		*(ULONG *)poid_par_priv->information_buf = preamblemode ;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}	
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_bcn_intvl_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_dedicate_probe_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}	
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{		
+		*(u64 *)poid_par_priv->information_buf = padapter->xmitpriv.tx_bytes;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+	
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{
+		//_rtw_memcpy(*(uint *)poid_par_priv->information_buf,padapter->recvpriv.rx_icv_err,sizeof(u32));
+		*(u64 *)poid_par_priv->information_buf = padapter->recvpriv.rx_bytes;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_current_tx_power_level_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_channel_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	NDIS_802_11_CONFIGURATION		*pnic_Config;
+
+	ULONG   channelnum;
+
+	_func_enter_;
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	if ( (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
+		pnic_Config = &pmlmepriv->cur_network.network.Configuration;
+	else
+		pnic_Config = &padapter->registrypriv.dev_network.Configuration;
+
+	channelnum = pnic_Config->DSConfig;
+	*(ULONG *)poid_par_priv->information_buf = channelnum;
+	
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	_func_exit_;
+
+
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_key_mismatch_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_supported_wireless_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	ULONG 			ulInfo = 0 ;
+	//DEBUG_ERR(("<**********************oid_rt_supported_wireless_mode_hdl \n"));	
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+	if(poid_par_priv->information_buf_len >= sizeof(ULONG)){
+		ulInfo |= 0x0100; //WIRELESS_MODE_B
+		ulInfo |= 0x0200; //WIRELESS_MODE_G
+		ulInfo |= 0x0400; //WIRELESS_MODE_A
+
+		*(ULONG *) poid_par_priv->information_buf = ulInfo;		
+		//DEBUG_ERR(("<===oid_rt_supported_wireless_mode %x\n",ulInfo));	
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_channel_list_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_scan_in_progress_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+
+
+NDIS_STATUS oid_rt_forced_data_rate_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+//**************  oid_rtl_seg_01_01 section end ************** 
+
+//**************  oid_rtl_seg_01_03 section start ************** 
+NDIS_STATUS oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+NDIS_STATUS oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_ap_supported_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_ap_set_passphrase_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	return status;
+}
+
+//**************  oid_rtl_seg_01_03 section end ************** 
+
+//****************  oid_rtl_seg_01_11   section start ****************
+NDIS_STATUS oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL			oldirql;
+	_func_enter_;
+	//DEBUG_ERR(("<**********************oid_rt_pro_rf_write_registry_hdl \n"));
+	if(poid_par_priv->type_of_oid != SET_OID) //QUERY_OID
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	
+	_irqlevel_changed_(&oldirql,LOWER);
+	if(poid_par_priv->information_buf_len== (sizeof(unsigned long)*3))
+	{      
+		//RegOffsetValue	- The offset of RF register to write.
+		//RegDataWidth	- The data width of RF register to write.
+		//RegDataValue	- The value to write. 
+		//RegOffsetValue = *((unsigned long*)InformationBuffer);
+		//RegDataWidth = *((unsigned long*)InformationBuffer+1);	   
+		//RegDataValue =  *((unsigned long*)InformationBuffer+2);	
+		if(!rtw_setrfreg_cmd(Adapter, 
+						*(unsigned char*)poid_par_priv->information_buf, 
+						(unsigned long)(*((unsigned long*)poid_par_priv->information_buf+2))))
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+	                   
+	}
+	else{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}   
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL	oldirql;
+	_func_enter_;
+
+	//DEBUG_ERR(("<**********************oid_rt_pro_rf_read_registry_hdl \n"));
+	if(poid_par_priv->type_of_oid != SET_OID) //QUERY_OID
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}	
+	
+	_irqlevel_changed_(&oldirql,LOWER);
+	if(poid_par_priv->information_buf_len== (sizeof(unsigned long)*3))
+	{
+		if(Adapter->mppriv.act_in_progress == _TRUE)
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+		else
+		{
+			//init workparam
+			Adapter->mppriv.act_in_progress = _TRUE;
+			Adapter->mppriv.workparam.bcompleted= _FALSE;
+			Adapter->mppriv.workparam.act_type = MPT_READ_RF;
+			Adapter->mppriv.workparam.io_offset = *(unsigned long*)poid_par_priv->information_buf;		
+			Adapter->mppriv.workparam.io_value = 0xcccccccc;
+				       
+			//RegOffsetValue	- The offset of RF register to read.
+			//RegDataWidth	- The data width of RF register to read.
+			//RegDataValue	- The value to read. 
+			//RegOffsetValue = *((unsigned long*)InformationBuffer);
+			//RegDataWidth = *((unsigned long*)InformationBuffer+1);	   
+			//RegDataValue =  *((unsigned long*)InformationBuffer+2);	   	 	                   
+			if(!rtw_getrfreg_cmd(Adapter, 
+							*(unsigned char*)poid_par_priv->information_buf, 
+							(unsigned char*)&Adapter->mppriv.workparam.io_value))
+			{
+				status = NDIS_STATUS_NOT_ACCEPTED;
+			}
+		}
+				      		   
+		                   
+	}
+	else	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+#endif
+	return status;
+}
+
+//****************  oid_rtl_seg_01_11   section end****************	
+
+
+//**************  oid_rtl_seg_03_00 section start **************  
+enum _CONNECT_STATE_{
+	CHECKINGSTATUS,
+	ASSOCIATED,
+	ADHOCMODE,
+	NOTASSOCIATED
+};
+
+NDIS_STATUS oid_rt_get_connect_state_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	ULONG ulInfo;
+		
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}		
+
+	// nStatus==0	CheckingStatus
+	// nStatus==1	Associated
+	// nStatus==2	AdHocMode
+	// nStatus==3	NotAssociated
+	
+	if(check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE)
+		ulInfo = CHECKINGSTATUS;
+	else if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	
+		ulInfo = ASSOCIATED;
+	else if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)== _TRUE)
+		ulInfo = ADHOCMODE;
+	else
+		ulInfo = NOTASSOCIATED ;
+
+	*(ULONG *)poid_par_priv->information_buf = ulInfo;
+	*poid_par_priv->bytes_rw =  poid_par_priv->information_buf_len;
+
+#if 0
+	// Rearrange the order to let the UI still shows connection when scan is in progress
+	RT_TRACE(COMP_OID_QUERY, DBG_LOUD, ("===> Query OID_RT_GET_CONNECT_STATE.\n"));
+	if(pMgntInfo->mAssoc)
+		ulInfo = 1;
+	else if(pMgntInfo->mIbss)
+		ulInfo = 2;
+	else if(pMgntInfo->bScanInProgress)
+		ulInfo = 0;
+	else
+		ulInfo = 3;
+	ulInfoLen = sizeof(ULONG);
+	RT_TRACE(COMP_OID_QUERY, DBG_LOUD, ("<=== Query OID_RT_GET_CONNECT_STATE: %d\n", ulInfo));
+#endif
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_set_default_key_id_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	
+	return status;
+}
+//**************  oid_rtl_seg_03_00 section end **************  
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c
new file mode 100755
index 0000000000000..564ff6eaebec8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c
@@ -0,0 +1,1494 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_IOCTL_SET_C_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_ioctl_set.h>
+#include <hal_intf.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_osintf.h>
+#include <usb_ops.h>
+#endif
+#ifdef CONFIG_SDIO_HCI
+#include <sdio_osintf.h>
+#endif
+
+extern void indicate_wx_scan_complete_event(_adapter *padapter);
+
+#define IS_MAC_ADDRESS_BROADCAST(addr) \
+( \
+	( (addr[0] == 0xff) && (addr[1] == 0xff) && \
+		(addr[2] == 0xff) && (addr[3] == 0xff) && \
+		(addr[4] == 0xff) && (addr[5] == 0xff) )  ? _TRUE : _FALSE \
+)
+
+u8 rtw_validate_bssid(const u8 *bssid)
+{
+	u8 ret = _TRUE;
+
+	if (is_zero_mac_addr(bssid)
+		|| is_broadcast_mac_addr(bssid)
+		|| is_multicast_mac_addr(bssid)
+	) { 
+		ret = _FALSE;
+	}
+
+	return ret;
+}
+
+u8 rtw_validate_ssid(NDIS_802_11_SSID *ssid)
+{
+	u8	 i;
+	u8	ret=_TRUE;
+
+_func_enter_;	
+
+	if (ssid->SsidLength > 32) {
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_, ("ssid length >32\n"));
+		ret= _FALSE;
+		goto exit;
+	}
+
+#ifdef CONFIG_VALIDATE_SSID
+	for(i = 0; i < ssid->SsidLength; i++)
+	{
+		//wifi, printable ascii code must be supported
+		if(!( (ssid->Ssid[i] >= 0x20) && (ssid->Ssid[i] <= 0x7e) )){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_, ("ssid has nonprintabl ascii\n"));
+			ret= _FALSE;
+			break;
+		}
+	}
+#endif /* CONFIG_VALIDATE_SSID */
+
+exit:	
+
+_func_exit_;
+
+	return ret;
+}
+
+u8 rtw_do_join(_adapter * padapter);
+u8 rtw_do_join(_adapter * padapter)
+{
+	_irqL	irqL;
+	_list	*plist, *phead;
+	u8* pibss = NULL;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	u8 ret=_SUCCESS;
+
+_func_enter_;
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("\n rtw_do_join: phead = %p; plist = %p \n\n\n", phead, plist));
+
+	pmlmepriv->cur_network.join_res = -2;
+		
+	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+
+	pmlmepriv->pscanned = plist;
+
+	pmlmepriv->to_join = _TRUE;
+
+	if(_rtw_queue_empty(queue)== _TRUE)
+	{	
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+            		
+		//when set_ssid/set_bssid for rtw_do_join(), but scanning queue is empty
+		//we try to issue sitesurvey firstly	
+            		
+		if (pmlmepriv->LinkDetectInfo.bBusyTraffic ==_FALSE
+			|| rtw_to_roaming(padapter) > 0
+		)
+		{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_do_join(): site survey if scanned_queue is empty\n."));
+			// submit site_survey_cmd
+			if(_SUCCESS!=(ret=rtw_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)) ) {
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_do_join(): site survey return error\n."));
+			}
+		}
+		
+		goto exit;
+	}	
+	else 	
+	{
+		int select_ret;
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		if((select_ret=rtw_select_and_join_from_scanned_queue(pmlmepriv))==_SUCCESS)
+		{
+			pmlmepriv->to_join = _FALSE;
+			_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
+		}
+		else if(ret == 2)//there is no need to wait for join
+		{
+			ret = _SUCCESS;
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			rtw_indicate_connect(padapter);
+		}
+		else	
+		{
+			if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE)
+			{
+				// submit createbss_cmd to change to a ADHOC_MASTER
+
+ 				//pmlmepriv->lock has been acquired by caller...
+				WLAN_BSSID_EX    *pdev_network = &(padapter->registrypriv.dev_network);
+
+				pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
+				
+				pibss = padapter->registrypriv.dev_network.MacAddress;
+
+				_rtw_memset(&pdev_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+				_rtw_memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(NDIS_802_11_SSID));
+	
+				rtw_update_registrypriv_dev_network(padapter);
+
+				rtw_generate_random_ibss(pibss);
+					
+				if(rtw_createbss_cmd(padapter)!=_SUCCESS)
+				{
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("***Error=>do_goin: rtw_createbss_cmd status FAIL*** \n "));						
+					ret =  _FALSE;
+					goto exit;
+				}
+
+			     	pmlmepriv->to_join = _FALSE;
+
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("***Error=> rtw_select_and_join_from_scanned_queue FAIL under STA_Mode*** \n "));						
+
+			}			
+			else
+			{ 
+				// can't associate ; reset under-linking			
+				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+#if 0	
+				if((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE))
+				{
+					if(_rtw_memcmp(pmlmepriv->cur_network.network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength))
+					{ 
+						// for funk to do roaming
+						// funk will reconnect, but funk will not sitesurvey before reconnect
+						RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("for funk to do roaming"));
+						if(pmlmepriv->sitesurveyctrl.traffic_busy==_FALSE)
+							rtw_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid, 1, NULL, 0);
+					}
+				
+				}				
+#endif
+
+				//when set_ssid/set_bssid for rtw_do_join(), but there are no desired bss in scanning queue
+				//we try to issue sitesurvey firstly			
+				if(pmlmepriv->LinkDetectInfo.bBusyTraffic==_FALSE
+					|| rtw_to_roaming(padapter) > 0
+				)
+				{
+					//DBG_871X("rtw_do_join() when   no desired bss in scanning queue \n");
+					if( _SUCCESS!=(ret=rtw_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)) ){
+						RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("do_join(): site survey return error\n."));
+					}
+				}				
+
+
+			}
+
+		}
+
+	}
+	
+exit:
+	
+_func_exit_;	
+
+	return ret;	
+}
+
+#ifdef PLATFORM_WINDOWS
+u8 rtw_pnp_set_power_wakeup(_adapter* padapter)
+{
+	u8 res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("==>rtw_pnp_set_power_wakeup!!!\n"));
+	
+	res = rtw_setstandby_cmd(padapter, 0);
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("<==rtw_pnp_set_power_wakeup!!!\n"));
+
+_func_exit_;
+	
+	return res;
+}
+
+u8 rtw_pnp_set_power_sleep(_adapter* padapter)
+{
+	u8 res=_SUCCESS;	
+	
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("==>rtw_pnp_set_power_sleep!!!\n"));
+	//DbgPrint("+rtw_pnp_set_power_sleep\n");
+
+	res = rtw_setstandby_cmd(padapter, 1);
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("<==rtw_pnp_set_power_sleep!!!\n"));
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_set_802_11_reload_defaults(_adapter * padapter, NDIS_802_11_RELOAD_DEFAULTS reloadDefaults)
+{
+_func_enter_;
+
+	switch( reloadDefaults)
+	{
+		case Ndis802_11ReloadWEPKeys:
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("SetInfo OID_802_11_RELOAD_DEFAULTS : Ndis802_11ReloadWEPKeys\n"));
+			break;
+	}
+
+	// SecClearAllKeys(Adapter);
+	// 8711 CAM was not for En/Decrypt only
+	// so, we can't clear all keys.
+	// should we disable WPAcfg (ox0088) bit 1-2, instead of clear all CAM
+	
+	//TO DO...
+
+_func_exit_;
+	
+	return _TRUE;
+}
+
+u8 set_802_11_test(_adapter* padapter, NDIS_802_11_TEST *test)
+{
+	u8 ret=_TRUE;
+	
+_func_enter_;
+
+	switch(test->Type)
+	{
+		case 1:
+			NdisMIndicateStatus(padapter->hndis_adapter, NDIS_STATUS_MEDIA_SPECIFIC_INDICATION, (PVOID)&test->AuthenticationEvent, test->Length - 8);
+			NdisMIndicateStatusComplete(padapter->hndis_adapter);
+			break;
+
+		case 2:
+			NdisMIndicateStatus(padapter->hndis_adapter, NDIS_STATUS_MEDIA_SPECIFIC_INDICATION, (PVOID)&test->RssiTrigger, sizeof(NDIS_802_11_RSSI));
+			NdisMIndicateStatusComplete(padapter->hndis_adapter);
+			break;
+
+		default:
+			ret=_FALSE;
+			break;
+	}
+
+_func_exit_;
+
+	return ret;	
+}
+
+u8	rtw_set_802_11_pmkid(_adapter*	padapter, NDIS_802_11_PMKID *pmkid)
+{
+	u8	ret=_SUCCESS;
+
+	return ret;
+}
+
+#endif
+
+u8 rtw_set_802_11_bssid(_adapter* padapter, u8 *bssid)
+{	
+	_irqL irqL;	
+	u8 status=_SUCCESS;
+	u32 cur_time = 0;
+
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	
+_func_enter_;
+	
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_notice_,
+		 ("+rtw_set_802_11_bssid: bssid="MAC_FMT"\n", MAC_ARG(bssid) ));
+
+	if ((bssid[0]==0x00 && bssid[1]==0x00 && bssid[2]==0x00 && bssid[3]==0x00 && bssid[4]==0x00 &&bssid[5]==0x00) ||
+	    (bssid[0]==0xFF && bssid[1]==0xFF && bssid[2]==0xFF && bssid[3]==0xFF && bssid[4]==0xFF &&bssid[5]==0xFF))
+	{
+		status = _FAIL;
+		goto exit;
+	}
+		
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	DBG_871X("Set BSSID under fw_state=0x%08x\n", get_fwstate(pmlmepriv));
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		goto handle_tkip_countermeasure;
+	} else if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		goto release_mlme_lock;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_info_, ("set_bssid: _FW_LINKED||WIFI_ADHOC_MASTER_STATE\n"));
+
+		if (_rtw_memcmp(&pmlmepriv->cur_network.network.MacAddress, bssid, ETH_ALEN) == _TRUE)
+		{		
+			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _FALSE)
+				goto release_mlme_lock;//it means driver is in WIFI_ADHOC_MASTER_STATE, we needn't create bss again.
+		} else {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("Set BSSID not the same bssid\n"));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("set_bssid="MAC_FMT"\n", MAC_ARG(bssid) ));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("cur_bssid="MAC_FMT"\n", MAC_ARG(pmlmepriv->cur_network.network.MacAddress) ));
+
+			rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				rtw_indicate_disconnect(padapter);
+
+			rtw_free_assoc_resources(padapter, 1);
+
+			if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
+				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+			}		
+		}
+	}
+
+handle_tkip_countermeasure:
+	if (rtw_handle_tkip_countermeasure(padapter, __func__) == _FAIL) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	_rtw_memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN);
+	pmlmepriv->assoc_by_bssid=_TRUE;
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		pmlmepriv->to_join = _TRUE;	
+	}
+	else {
+		status = rtw_do_join(padapter);
+	}
+
+release_mlme_lock:
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		
+exit:
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+		("rtw_set_802_11_bssid: status=%d\n", status));
+	
+_func_exit_;
+
+	return status;
+}
+
+u8 rtw_set_802_11_ssid(_adapter* padapter, NDIS_802_11_SSID *ssid)
+{	
+	_irqL irqL;
+	u8 status = _SUCCESS;
+	u32 cur_time = 0;
+
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network *pnetwork = &pmlmepriv->cur_network;
+	
+_func_enter_;
+	
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_notice_,
+		 ("+rtw_set_802_11_ssid: ssid=[%s] fw_state=0x%08x\n",
+		  ssid->Ssid, get_fwstate(pmlmepriv)));
+
+	if(padapter->hw_init_completed==_FALSE){
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+			 ("set_ssid: hw_init_completed==_FALSE=>exit!!!\n"));
+		status = _FAIL;
+		goto exit;
+	}
+		
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	DBG_871X("Set SSID under fw_state=0x%08x\n", get_fwstate(pmlmepriv));
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {	
+		goto handle_tkip_countermeasure;
+	} else if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		goto release_mlme_lock;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_info_,
+			 ("set_ssid: _FW_LINKED||WIFI_ADHOC_MASTER_STATE\n"));
+
+		if ((pmlmepriv->assoc_ssid.SsidLength == ssid->SsidLength) &&
+		    (_rtw_memcmp(&pmlmepriv->assoc_ssid.Ssid, ssid->Ssid, ssid->SsidLength) == _TRUE))
+		{			
+			if((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _FALSE))
+			{
+				RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+					 ("Set SSID is the same ssid, fw_state=0x%08x\n",
+					  get_fwstate(pmlmepriv)));
+
+				if(rtw_is_same_ibss(padapter, pnetwork) == _FALSE)
+				{				
+					//if in WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE, create bss or rejoin again
+					rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+					if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+						rtw_indicate_disconnect(padapter);
+						
+					rtw_free_assoc_resources(padapter, 1);
+
+					if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) {
+						_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+						set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+					}
+				}
+				else
+				{
+					goto release_mlme_lock;//it means driver is in WIFI_ADHOC_MASTER_STATE, we needn't create bss again.
+				}
+			}
+#ifdef CONFIG_LPS
+			else {
+				rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_JOINBSS, 1);
+			}
+#endif
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("Set SSID not the same ssid\n"));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("set_ssid=[%s] len=0x%x\n", ssid->Ssid, (unsigned int)ssid->SsidLength));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("assoc_ssid=[%s] len=0x%x\n", pmlmepriv->assoc_ssid.Ssid, (unsigned int)pmlmepriv->assoc_ssid.SsidLength));
+
+			rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				rtw_indicate_disconnect(padapter);
+			
+			rtw_free_assoc_resources(padapter, 1);
+
+			if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) {
+				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+			}
+		}		
+	}
+
+handle_tkip_countermeasure:
+	if (rtw_handle_tkip_countermeasure(padapter, __func__) == _FAIL) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	if (rtw_validate_ssid(ssid) == _FALSE) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	_rtw_memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(NDIS_802_11_SSID));
+	pmlmepriv->assoc_by_bssid=_FALSE;
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		pmlmepriv->to_join = _TRUE;	
+	}
+	else {
+		status = rtw_do_join(padapter);
+	}
+
+release_mlme_lock:
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+		("-rtw_set_802_11_ssid: status=%d\n", status));
+	
+_func_exit_;
+
+	return status;
+	
+}
+
+u8 rtw_set_802_11_connect(_adapter *padapter, const u8 *bssid, NDIS_802_11_SSID *ssid)
+{
+	_irqL irqL;
+	u8 status = _SUCCESS;
+	u32 cur_time = 0;
+	bool bssid_valid = _TRUE;
+	bool ssid_valid = _TRUE;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if (!ssid || rtw_validate_ssid(ssid) == _FALSE)
+		ssid_valid = _FALSE;
+
+	if (!bssid || rtw_validate_bssid(bssid) == _FALSE)
+		bssid_valid = _FALSE;
+
+	if (ssid_valid == _FALSE && bssid_valid == _FALSE) {
+		DBG_871X(FUNC_ADPT_FMT" ssid:%p, ssid_valid:%d, bssid:%p, bssid_valid:%d\n",
+			FUNC_ADPT_ARG(padapter), ssid, ssid_valid, bssid, bssid_valid);
+		status = _FAIL;
+		goto exit;
+	}
+
+	if(padapter->hw_init_completed==_FALSE){
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+			 ("set_ssid: hw_init_completed==_FALSE=>exit!!!\n"));
+		status = _FAIL;
+		goto exit;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT"  fw_state=0x%08x\n",
+		FUNC_ADPT_ARG(padapter), get_fwstate(pmlmepriv));
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		goto handle_tkip_countermeasure;
+	} else if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		goto release_mlme_lock;
+	}
+
+handle_tkip_countermeasure:
+	if (rtw_handle_tkip_countermeasure(padapter, __func__) == _FAIL) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	if (ssid && ssid_valid)
+		_rtw_memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(NDIS_802_11_SSID));
+
+	if (bssid && bssid_valid) {
+		_rtw_memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN);
+		pmlmepriv->assoc_by_bssid = _TRUE;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		pmlmepriv->to_join = _TRUE;	
+	}
+	else {
+		status = rtw_do_join(padapter);
+	}
+
+release_mlme_lock:
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:
+	
+_func_exit_;
+
+	return status;
+}
+
+/*
+rtw_set_802_11_infrastructure_mode(~)
+	### NOTE:#### (!!!!)
+	MUST TAKE CARE THAT BEFORE CALLING THIS FUNC, YOU SHOULD HAVE LOCKED pmlmepriv->lock and scanned_queue->lock in sequence
+*/
+u8 rtw_set_802_11_infrastructure_mode(_adapter* padapter, 
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
+{
+	_irqL irqL;
+	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct	wlan_network	*cur_network = &pmlmepriv->cur_network;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE* pold_state = &(cur_network->network.InfrastructureMode);
+	
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_notice_,
+		 ("+rtw_set_802_11_infrastructure_mode: old=%d new=%d fw_state=0x%08x\n",
+		  *pold_state, networktype, get_fwstate(pmlmepriv)));
+	
+	if(*pold_state != networktype)
+	{
+		
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,(" change mode!"));
+		//DBG_871X("change mode, old_mode=%d, new_mode=%d, fw_state=0x%x\n", *pold_state, networktype, get_fwstate(pmlmepriv));
+
+		if(*pold_state==Ndis802_11APMode)
+		{		
+			//change to other mode from Ndis802_11APMode			
+			cur_network->join_res = -1;
+			
+#ifdef CONFIG_NATIVEAP_MLME
+			stop_ap_mode(padapter);
+#endif
+		}	
+
+		if((check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) ||(*pold_state==Ndis802_11IBSS))
+			rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+		if((check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) ||
+			(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)== _TRUE) )
+			rtw_free_assoc_resources(padapter, 0);
+
+		if((*pold_state == Ndis802_11Infrastructure) ||(*pold_state == Ndis802_11IBSS))
+	       {
+			if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+			{		
+				rtw_indicate_disconnect(padapter); //will clr Linked_state; before this function, we must have chked whether  issue dis-assoc_cmd or not
+			}
+	       }
+
+		*pold_state = networktype;
+
+		_clr_fwstate_(pmlmepriv, ~WIFI_NULL_STATE);
+				
+		switch(networktype)
+		{
+			case Ndis802_11IBSS:
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+				break;
+				
+			case Ndis802_11Infrastructure:
+				set_fwstate(pmlmepriv, WIFI_STATION_STATE);
+				break;
+				
+			case Ndis802_11APMode:
+				set_fwstate(pmlmepriv, WIFI_AP_STATE);
+#ifdef CONFIG_NATIVEAP_MLME
+				start_ap_mode(padapter);
+				//rtw_indicate_connect(padapter);
+#endif				
+				
+				break;
+
+			case Ndis802_11AutoUnknown:
+			case Ndis802_11InfrastructureMax:
+				break;                        				
+		}
+
+		//SecClearAllKeys(adapter);
+		
+		//RT_TRACE(COMP_OID_SET, DBG_LOUD, ("set_infrastructure: fw_state:%x after changing mode\n",
+		//									get_fwstate(pmlmepriv) ));
+
+	}
+
+_func_exit_;
+
+	return _TRUE;
+}
+
+
+u8 rtw_set_802_11_disassociate(_adapter *padapter)
+{
+	_irqL irqL;
+	struct mlme_priv * pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_disassociate: rtw_indicate_disconnect\n"));
+
+		rtw_disassoc_cmd(padapter, 0, _TRUE);
+		rtw_indicate_disconnect(padapter);
+		//modify for CONFIG_IEEE80211W, none 11w can use it
+		rtw_free_assoc_resources_cmd(padapter);
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	
+_func_exit_;
+
+	return _TRUE;	
+}
+
+u8 rtw_set_802_11_bssid_list_scan(_adapter* padapter, NDIS_802_11_SSID *pssid, int ssid_max_num)
+{	
+	_irqL	irqL;
+	struct	mlme_priv		*pmlmepriv= &padapter->mlmepriv;
+	u8	res=_TRUE;
+	
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("+rtw_set_802_11_bssid_list_scan(), fw_state=%x\n", get_fwstate(pmlmepriv)));
+
+	if (padapter == NULL) {
+		res=_FALSE;
+		goto exit;
+	}
+	if (padapter->hw_init_completed==_FALSE){
+		res = _FALSE;
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n===rtw_set_802_11_bssid_list_scan:hw_init_completed==_FALSE===\n"));
+		goto exit;
+	}
+	
+	if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE) ||
+		(pmlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE))
+	{
+		// Scan or linking is in progress, do nothing.
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_bssid_list_scan fail since fw_state = %x\n", get_fwstate(pmlmepriv)));
+		res = _TRUE;
+
+		if(check_fwstate(pmlmepriv, (_FW_UNDER_SURVEY|_FW_UNDER_LINKING))== _TRUE){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n###_FW_UNDER_SURVEY|_FW_UNDER_LINKING\n\n"));
+		} else {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n###pmlmepriv->sitesurveyctrl.traffic_busy==_TRUE\n\n"));
+		}
+	} else {		
+		if (rtw_is_scan_deny(padapter)) {
+			DBG_871X(FUNC_ADPT_FMT": scan deny\n", FUNC_ADPT_ARG(padapter));
+			indicate_wx_scan_complete_event(padapter);
+			return _SUCCESS;
+		}
+		
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);		
+		
+		res = rtw_sitesurvey_cmd(padapter, pssid, ssid_max_num, NULL, 0);
+		
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	}
+exit:
+	
+_func_exit_;
+
+	return res;	
+}
+
+u8 rtw_set_802_11_authentication_mode(_adapter* padapter, NDIS_802_11_AUTHENTICATION_MODE authmode) 
+{
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	int res;
+	u8 ret;
+	
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("set_802_11_auth.mode(): mode=%x\n", authmode));
+
+	psecuritypriv->ndisauthtype=authmode;
+	
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_authentication_mode:psecuritypriv->ndisauthtype=%d", psecuritypriv->ndisauthtype));
+	
+	if(psecuritypriv->ndisauthtype>3)
+		psecuritypriv->dot11AuthAlgrthm=dot11AuthAlgrthm_8021X;
+	
+	res=rtw_set_auth(padapter,psecuritypriv);
+	
+	if(res==_SUCCESS)
+		ret=_TRUE;
+	else
+		ret=_FALSE;
+	
+_func_exit_;
+
+	return ret;
+}
+
+u8 rtw_set_802_11_add_wep(_adapter* padapter, NDIS_802_11_WEP *wep){
+
+	u8		bdefaultkey;
+	u8		btransmitkey;
+	sint		keyid,res;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	u8		ret=_SUCCESS;
+
+_func_enter_;
+
+	bdefaultkey=(wep->KeyIndex & 0x40000000) > 0 ? _FALSE : _TRUE;   //for ???
+	btransmitkey= (wep->KeyIndex & 0x80000000) > 0 ? _TRUE  : _FALSE;	//for ???
+	keyid=wep->KeyIndex & 0x3fffffff;
+
+	if(keyid>4)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("MgntActrtw_set_802_11_add_wep:keyid>4=>fail\n"));
+		ret=_FALSE;
+		goto exit;
+	}
+	
+	switch(wep->KeyLength)
+	{
+		case 5:
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP40_;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_add_wep:wep->KeyLength=5\n"));
+			break;
+		case 13:
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP104_;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_add_wep:wep->KeyLength=13\n"));
+			break;
+		default:
+			psecuritypriv->dot11PrivacyAlgrthm=_NO_PRIVACY_;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_add_wep:wep->KeyLength!=5 or 13\n"));
+			break;
+	}
+	
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_wep:befor memcpy, wep->KeyLength=0x%x wep->KeyIndex=0x%x  keyid =%x\n",wep->KeyLength,wep->KeyIndex,keyid));
+
+	_rtw_memcpy(&(psecuritypriv->dot11DefKey[keyid].skey[0]),&(wep->KeyMaterial),wep->KeyLength);
+
+	psecuritypriv->dot11DefKeylen[keyid]=wep->KeyLength;
+
+	psecuritypriv->dot11PrivacyKeyIndex=keyid;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_wep:security key material : %x %x %x %x %x %x %x %x %x %x %x %x %x \n",
+		psecuritypriv->dot11DefKey[keyid].skey[0],psecuritypriv->dot11DefKey[keyid].skey[1],psecuritypriv->dot11DefKey[keyid].skey[2],
+		psecuritypriv->dot11DefKey[keyid].skey[3],psecuritypriv->dot11DefKey[keyid].skey[4],psecuritypriv->dot11DefKey[keyid].skey[5],
+		psecuritypriv->dot11DefKey[keyid].skey[6],psecuritypriv->dot11DefKey[keyid].skey[7],psecuritypriv->dot11DefKey[keyid].skey[8],
+		psecuritypriv->dot11DefKey[keyid].skey[9],psecuritypriv->dot11DefKey[keyid].skey[10],psecuritypriv->dot11DefKey[keyid].skey[11],
+		psecuritypriv->dot11DefKey[keyid].skey[12]));
+
+	res=rtw_set_key(padapter,psecuritypriv, keyid, 1);
+	
+	if(res==_FAIL)
+		ret= _FALSE;
+exit:
+	
+_func_exit_;
+
+	return ret;
+	
+}
+
+u8 rtw_set_802_11_remove_wep(_adapter* padapter, u32 keyindex){
+	
+	u8 ret=_SUCCESS;
+	
+_func_enter_;
+
+	if (keyindex >= 0x80000000 || padapter == NULL){
+		
+		ret=_FALSE;
+		goto exit;
+
+	}
+	else 
+	{
+		int res;
+		struct security_priv* psecuritypriv=&(padapter->securitypriv);
+		if( keyindex < 4 ){
+			
+			_rtw_memset(&psecuritypriv->dot11DefKey[keyindex], 0, 16);
+			
+			res=rtw_set_key(padapter,psecuritypriv,keyindex, 0);
+			
+			psecuritypriv->dot11DefKeylen[keyindex]=0;
+			
+			if(res==_FAIL)
+				ret=_FAIL;
+			
+		}
+		else
+		{			
+			ret=_FAIL;
+		}
+		
+	}
+	
+exit:	
+	
+_func_exit_;
+
+	return ret;
+	
+}
+
+u8 rtw_set_802_11_add_key(_adapter* padapter, NDIS_802_11_KEY *key){
+
+	uint	encryptionalgo;
+	u8 * pbssid;
+	struct sta_info *stainfo;
+	u8	bgroup = _FALSE;
+	u8	bgrouptkey = _FALSE;//can be remove later
+	u8	ret=_SUCCESS;
+	
+_func_enter_;
+
+	if (((key->KeyIndex & 0x80000000) == 0) && ((key->KeyIndex & 0x40000000) > 0)){
+
+		// It is invalid to clear bit 31 and set bit 30. If the miniport driver encounters this combination, 
+		// it must fail the request and return NDIS_STATUS_INVALID_DATA.
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_key: ((key->KeyIndex & 0x80000000) == 0)[=%d] ",(int)(key->KeyIndex & 0x80000000) == 0));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_key:((key->KeyIndex & 0x40000000) > 0)[=%d]" , (int)(key->KeyIndex & 0x40000000) > 0));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_key: key->KeyIndex=%d \n" ,(int)key->KeyIndex));
+		ret= _FAIL;
+		goto exit;
+	}
+
+	if(key->KeyIndex & 0x40000000)
+	{ 
+		// Pairwise key
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ Pairwise key +++++\n"));
+	
+		pbssid=get_bssid(&padapter->mlmepriv);
+		stainfo=rtw_get_stainfo(&padapter->stapriv, pbssid);
+
+		if((stainfo!=NULL)&&(padapter->securitypriv.dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY:( stainfo!=NULL)&&(Adapter->securitypriv.dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)\n"));
+			encryptionalgo=stainfo->dot118021XPrivacy;
+		}
+		else{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: stainfo==NULL)||(Adapter->securitypriv.dot11AuthAlgrthm!=dot11AuthAlgrthm_8021X)\n"));
+			encryptionalgo=padapter->securitypriv.dot11PrivacyAlgrthm;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (encryptionalgo ==%d)!\n",encryptionalgo ));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (Adapter->securitypriv.dot11PrivacyAlgrthm ==%d)!\n",padapter->securitypriv.dot11PrivacyAlgrthm));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (Adapter->securitypriv.dot11AuthAlgrthm ==%d)!\n",padapter->securitypriv.dot11AuthAlgrthm));
+
+		if((stainfo!=NULL)){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (stainfo->dot118021XPrivacy ==%d)!\n", stainfo->dot118021XPrivacy));
+		}
+		
+		if(key->KeyIndex & 0x000000FF){
+			// The key index is specified in the lower 8 bits by values of zero to 255.
+			// The key index should be set to zero for a Pairwise key, and the driver should fail with
+			// NDIS_STATUS_INVALID_DATA if the lower 8 bits is not zero
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" key->KeyIndex & 0x000000FF.\n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// check BSSID
+		if (IS_MAC_ADDRESS_BROADCAST(key->BSSID) == _TRUE){
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("MacAddr_isBcst(key->BSSID)\n"));
+			ret= _FALSE;
+			goto exit;
+		}
+
+		// Check key length for TKIP.
+		//if(encryptionAlgorithm == RT_ENC_TKIP_ENCRYPTION && key->KeyLength != 32)
+		if((encryptionalgo== _TKIP_)&& (key->KeyLength != 32)){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("TKIP KeyLength:0x%x != 32\n", key->KeyLength));
+			ret=_FAIL;
+			goto exit;
+
+		}
+
+		// Check key length for AES.
+		if((encryptionalgo== _AES_)&& (key->KeyLength != 16)) {
+			// For our supplicant, EAPPkt9x.vxd, cannot differentiate TKIP and AES case.
+			if(key->KeyLength == 32) {
+				key->KeyLength = 16; 
+			} else {
+				ret= _FAIL;
+				goto exit;
+			}
+		}
+
+		// Check key length for WEP. For NDTEST, 2005.01.27, by rcnjko.
+		if(	(encryptionalgo== _WEP40_|| encryptionalgo== _WEP104_) && (key->KeyLength != 5 || key->KeyLength != 13)) {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("WEP KeyLength:0x%x != 5 or 13\n", key->KeyLength));
+			ret=_FAIL;
+			goto exit;
+		}
+
+		bgroup = _FALSE;
+
+		// Check the pairwise key. Added by Annie, 2005-07-06.
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("[Pairwise Key set]\n"));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key index: 0x%8x(0x%8x)\n", key->KeyIndex,(key->KeyIndex&0x3)));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key Length: %d\n", key->KeyLength));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+	
+	}
+	else 
+	{	
+		// Group key - KeyIndex(BIT30==0)
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ Group key +++++\n"));
+
+
+		// when add wep key through add key and didn't assigned encryption type before
+		if((padapter->securitypriv.ndisauthtype<=3)&&(padapter->securitypriv.dot118021XGrpPrivacy==0))
+		{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("keylen=%d( Adapter->securitypriv.dot11PrivacyAlgrthm=%x  )padapter->securitypriv.dot118021XGrpPrivacy(%x)\n", key->KeyLength,padapter->securitypriv.dot11PrivacyAlgrthm,padapter->securitypriv.dot118021XGrpPrivacy));
+
+			switch(key->KeyLength)
+			{
+				case 5:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("Adapter->securitypriv.dot11PrivacyAlgrthm= %x key->KeyLength=%u\n", padapter->securitypriv.dot11PrivacyAlgrthm,key->KeyLength));
+					break;
+				case 13:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("Adapter->securitypriv.dot11PrivacyAlgrthm= %x key->KeyLength=%u\n", padapter->securitypriv.dot11PrivacyAlgrthm,key->KeyLength));
+					break;
+				default:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("Adapter->securitypriv.dot11PrivacyAlgrthm= %x key->KeyLength=%u \n", padapter->securitypriv.dot11PrivacyAlgrthm,key->KeyLength));
+					break;
+			}
+			
+			encryptionalgo=padapter->securitypriv.dot11PrivacyAlgrthm;
+			
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" Adapter->securitypriv.dot11PrivacyAlgrthm=%x\n", padapter->securitypriv.dot11PrivacyAlgrthm));
+			
+		}
+		else 
+		{
+			encryptionalgo=padapter->securitypriv.dot118021XGrpPrivacy;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("( Adapter->securitypriv.dot11PrivacyAlgrthm=%x  )encryptionalgo(%x)=padapter->securitypriv.dot118021XGrpPrivacy(%x)keylen=%d\n", padapter->securitypriv.dot11PrivacyAlgrthm,encryptionalgo,padapter->securitypriv.dot118021XGrpPrivacy,key->KeyLength));
+
+		}
+		
+		if((check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE)==_TRUE) && (IS_MAC_ADDRESS_BROADCAST(key->BSSID) == _FALSE)) {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" IBSS but BSSID is not Broadcast Address.\n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// Check key length for TKIP
+		if((encryptionalgo== _TKIP_) && (key->KeyLength != 32)) {
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" TKIP GTK KeyLength:%u != 32\n", key->KeyLength));
+			ret= _FAIL;
+			goto exit;
+
+		} else if(encryptionalgo== _AES_ && (key->KeyLength != 16 && key->KeyLength != 32) ) {
+			
+			// Check key length for AES
+			// For NDTEST, we allow keylen=32 in this case. 2005.01.27, by rcnjko.
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("<=== SetInfo, OID_802_11_ADD_KEY: AES GTK KeyLength:%u != 16 or 32\n", key->KeyLength));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// Change the key length for EAPPkt9x.vxd. Added by Annie, 2005-11-03.
+		if((encryptionalgo==  _AES_) && (key->KeyLength == 32) ) {
+			key->KeyLength = 16; 
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("AES key length changed: %u\n", key->KeyLength) );
+		}
+
+		if(key->KeyIndex & 0x8000000) {//error ??? 0x8000_0000
+			bgrouptkey = _TRUE;
+		}
+
+		if((check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE)==_TRUE)&&(check_fwstate(&padapter->mlmepriv, _FW_LINKED)==_TRUE))
+		{
+			bgrouptkey = _TRUE;
+		}
+
+		bgroup = _TRUE;
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n") );
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("[Group Key set]\n") );
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n")) ;
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key index: 0x%8x(0x%8x)\n", key->KeyIndex,(key->KeyIndex&0x3)));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key Length: %d\n", key->KeyLength)) ;
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+		
+	}	
+
+	// If WEP encryption algorithm, just call rtw_set_802_11_add_wep().
+	if((padapter->securitypriv.dot11AuthAlgrthm !=dot11AuthAlgrthm_8021X)&&(encryptionalgo== _WEP40_  || encryptionalgo== _WEP104_))
+	{
+		u8 ret;		
+		u32 keyindex;		
+		u32 len = FIELD_OFFSET(NDIS_802_11_KEY, KeyMaterial) + key->KeyLength;
+		NDIS_802_11_WEP *wep = &padapter->securitypriv.ndiswep;
+				
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ WEP key +++++\n"));
+
+		wep->Length = len;
+		keyindex = key->KeyIndex&0x7fffffff;
+		wep->KeyIndex = keyindex ;
+		wep->KeyLength = key->KeyLength;
+		
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY:Before memcpy \n"));
+
+		_rtw_memcpy(wep->KeyMaterial, key->KeyMaterial, key->KeyLength);	
+		_rtw_memcpy(&(padapter->securitypriv.dot11DefKey[keyindex].skey[0]), key->KeyMaterial, key->KeyLength);
+
+		padapter->securitypriv.dot11DefKeylen[keyindex]=key->KeyLength;		
+		padapter->securitypriv.dot11PrivacyKeyIndex=keyindex;
+		
+		ret = rtw_set_802_11_add_wep(padapter, wep);
+	
+		goto exit;
+		
+	}
+
+	if(key->KeyIndex & 0x20000000){
+		// SetRSC
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ SetRSC+++++\n"));
+		if(bgroup == _TRUE)
+		{
+			NDIS_802_11_KEY_RSC keysrc=key->KeyRSC & 0x00FFFFFFFFFFFFULL;
+			_rtw_memcpy(&padapter->securitypriv.dot11Grprxpn, &keysrc, 8);			
+		} 
+		else 
+		{		
+			NDIS_802_11_KEY_RSC keysrc=key->KeyRSC & 0x00FFFFFFFFFFFFULL;	
+			_rtw_memcpy(&padapter->securitypriv.dot11Grptxpn, &keysrc, 8);			
+		}
+			
+	}
+
+	// Indicate this key idx is used for TX
+	// Save the key in KeyMaterial
+	if(bgroup == _TRUE) // Group transmit key
+	{
+		int res;
+		
+		if(bgrouptkey == _TRUE)
+		{		
+			padapter->securitypriv.dot118021XGrpKeyid=(u8)key->KeyIndex;
+		}
+		
+		if((key->KeyIndex&0x3) == 0){
+			ret = _FAIL;
+			goto exit;
+		}		
+		
+		_rtw_memset(&padapter->securitypriv.dot118021XGrpKey[(u8)((key->KeyIndex) & 0x03)], 0, 16);
+		_rtw_memset(&padapter->securitypriv.dot118021XGrptxmickey[(u8)((key->KeyIndex) & 0x03)], 0, 16);
+		_rtw_memset(&padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)], 0, 16);
+		
+		if((key->KeyIndex & 0x10000000))
+		{
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrptxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 16, 8);
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 24, 8);
+			
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rx mic :0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[0],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[1],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[2],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[3],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[4],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[5],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[6],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[7]));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:set Group mic key!!!!!!!!\n"));
+
+		}
+		else
+		{
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrptxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 24, 8);
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 16, 8);
+			
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rx mic :0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[0],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[1],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[2],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[3],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[4],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[5],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[6],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[7]));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:set Group mic key!!!!!!!!\n"));
+		
+		}
+
+		//set group key by index
+		_rtw_memcpy(&padapter->securitypriv.dot118021XGrpKey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial, key->KeyLength);
+		
+		key->KeyIndex=key->KeyIndex & 0x03;
+		
+		padapter->securitypriv.binstallGrpkey=_TRUE;
+		
+		padapter->securitypriv.bcheck_grpkey=_FALSE;
+		
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("reset group key"));
+		
+		res=rtw_set_key(padapter,&padapter->securitypriv, key->KeyIndex, 1);
+
+		if(res==_FAIL)
+			ret= _FAIL;
+
+		goto exit;
+			
+	}
+	else // Pairwise Key
+	{
+		u8 res;
+		
+		pbssid=get_bssid(&padapter->mlmepriv);
+		stainfo=rtw_get_stainfo(&padapter->stapriv , pbssid );
+		
+		if(stainfo!=NULL)
+		{			
+			_rtw_memset( &stainfo->dot118021x_UncstKey, 0, 16);// clear keybuffer
+			
+			_rtw_memcpy(&stainfo->dot118021x_UncstKey, key->KeyMaterial, 16);
+			
+			if(encryptionalgo== _TKIP_)
+			{
+				padapter->securitypriv.busetkipkey=_FALSE;
+				
+				//_set_timer(&padapter->securitypriv.tkip_timer, 50);
+				
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n ==========_set_timer\n"));
+				
+				// if TKIP, save the Receive/Transmit MIC key in KeyMaterial[128-255]
+				if((key->KeyIndex & 0x10000000)){
+					_rtw_memcpy(&stainfo->dot11tkiptxmickey, key->KeyMaterial + 16, 8);
+					_rtw_memcpy(&stainfo->dot11tkiprxmickey, key->KeyMaterial + 24, 8);
+
+				} else {
+					_rtw_memcpy(&stainfo->dot11tkiptxmickey, key->KeyMaterial + 24, 8);
+					_rtw_memcpy(&stainfo->dot11tkiprxmickey, key->KeyMaterial + 16, 8);
+
+				}
+		
+			}
+			else if(encryptionalgo == _AES_)
+			{		
+	
+			}
+
+		
+			//Set key to CAM through H2C command
+			if(bgrouptkey)//never go to here
+			{
+				res=rtw_setstakey_cmd(padapter, (unsigned char *)stainfo, _FALSE);
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rtw_setstakey_cmd(group)\n"));
+			}
+			else{
+				res=rtw_setstakey_cmd(padapter, (unsigned char *)stainfo, _TRUE);
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rtw_setstakey_cmd(unicast)\n"));
+			}
+			
+			if(res ==_FALSE)
+				ret= _FAIL;
+			
+		}
+
+	}
+
+exit:
+	
+_func_exit_;
+
+	return ret;	
+}
+
+u8 rtw_set_802_11_remove_key(_adapter*	padapter, NDIS_802_11_REMOVE_KEY *key){
+	
+	uint				encryptionalgo;
+	u8 * pbssid;
+	struct sta_info *stainfo;
+	u8	bgroup = (key->KeyIndex & 0x4000000) > 0 ? _FALSE: _TRUE;
+	u8	keyIndex = (u8)key->KeyIndex & 0x03;
+	u8	ret=_SUCCESS;
+	
+_func_enter_;
+
+	if ((key->KeyIndex & 0xbffffffc) > 0) {
+		ret=_FAIL;
+		goto exit;
+	}
+
+	if (bgroup == _TRUE) {
+		encryptionalgo= padapter->securitypriv.dot118021XGrpPrivacy;
+		// clear group key by index
+		//NdisZeroMemory(Adapter->MgntInfo.SecurityInfo.KeyBuf[keyIndex], MAX_WEP_KEY_LEN);
+		//Adapter->MgntInfo.SecurityInfo.KeyLen[keyIndex] = 0;
+		
+		_rtw_memset(&padapter->securitypriv.dot118021XGrpKey[keyIndex], 0, 16);
+		
+		//! \todo Send a H2C Command to Firmware for removing this Key in CAM Entry.
+	
+	} else {
+	
+		pbssid=get_bssid(&padapter->mlmepriv);
+		stainfo=rtw_get_stainfo(&padapter->stapriv , pbssid );
+		if(stainfo !=NULL){
+			encryptionalgo=stainfo->dot118021XPrivacy;
+
+		// clear key by BSSID
+		_rtw_memset(&stainfo->dot118021x_UncstKey, 0, 16);
+		
+		//! \todo Send a H2C Command to Firmware for disable this Key in CAM Entry.
+
+		}
+		else{
+			ret= _FAIL;
+			goto exit;
+		}
+	}
+
+exit:
+	
+_func_exit_;
+
+	return _TRUE;
+	
+}
+
+/*
+* rtw_get_cur_max_rate - 
+* @adapter: pointer to _adapter structure
+* 
+* Return 0 or 100Kbps
+*/
+u16 rtw_get_cur_max_rate(_adapter *adapter)
+{
+	int	i = 0;
+	u8	*p;
+	u16	rate = 0, max_rate = 0;
+	struct mlme_ext_priv	*pmlmeext = &adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct registry_priv *pregistrypriv = &adapter->registrypriv;
+	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+#ifdef CONFIG_80211N_HT
+	struct rtw_ieee80211_ht_cap *pht_capie;
+	u8	rf_type = 0;
+	u8	bw_40MHz=0, short_GI_20=0, short_GI_40=0;
+	u16	mcs_rate=0;
+	u32	ht_ielen = 0;	
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+	if (adapter->registrypriv.mp_mode == 1)
+	{	
+		if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+			return 0;
+	}
+#endif
+
+	if((check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE) 
+		&& (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) != _TRUE))
+		return 0;
+
+#ifdef CONFIG_80211N_HT
+	if (pmlmeext->cur_wireless_mode & (WIRELESS_11_24N|WIRELESS_11_5N)) {
+		p = rtw_get_ie(&pcur_bss->IEs[12], _HT_CAPABILITY_IE_, &ht_ielen, pcur_bss->IELength-12);
+		if(p && ht_ielen>0)
+		{
+			pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);
+		
+			_rtw_memcpy(&mcs_rate , pht_capie->supp_mcs_set, 2);
+
+			//bw_40MHz = (pht_capie->cap_info&IEEE80211_HT_CAP_SUP_WIDTH) ? 1:0;
+			//cur_bwmod is updated by beacon, pmlmeinfo is updated by association response
+			bw_40MHz = (pmlmeext->cur_bwmode && (HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH & pmlmeinfo->HT_info.infos[0])) ? 1:0;
+			
+			//short_GI = (pht_capie->cap_info&(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40)) ? 1:0;
+			short_GI_20 = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info&IEEE80211_HT_CAP_SGI_20) ? 1:0;
+			short_GI_40 = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info&IEEE80211_HT_CAP_SGI_40) ? 1:0;
+
+			rtw_hal_get_hwreg(adapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+			max_rate = rtw_mcs_rate(
+				rf_type,
+				bw_40MHz & (pregistrypriv->cbw40_enable), 
+				short_GI_20,
+				short_GI_40,
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate
+			);
+		}
+	} 
+	else
+#endif //CONFIG_80211N_HT
+	{
+		while( (pcur_bss->SupportedRates[i]!=0) && (pcur_bss->SupportedRates[i]!=0xFF))
+		{
+			rate = pcur_bss->SupportedRates[i]&0x7F;
+			if(rate>max_rate)
+				max_rate = rate;
+			i++;
+		}
+	
+		max_rate = max_rate*10/2;
+	}
+
+	return max_rate;
+}
+
+/*
+* rtw_set_scan_mode - 
+* @adapter: pointer to _adapter structure
+* @scan_mode: 
+* 
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_scan_mode(_adapter *adapter, RT_SCAN_TYPE scan_mode)
+{
+	if(scan_mode != SCAN_ACTIVE && scan_mode != SCAN_PASSIVE)
+		return _FAIL;
+	
+	adapter->mlmepriv.scan_mode = scan_mode;
+
+	return _SUCCESS;
+}
+
+/*
+* rtw_set_channel_plan - 
+* @adapter: pointer to _adapter structure
+* @channel_plan: 
+* 
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_channel_plan(_adapter *adapter, u8 channel_plan)
+{
+	struct registry_priv *pregistrypriv = &adapter->registrypriv;
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+
+	//handle by cmd_thread to sync with scan operation
+	return rtw_set_chplan_cmd(adapter, channel_plan, 1);
+}
+
+/*
+* rtw_set_country - 
+* @adapter: pointer to _adapter structure
+* @country_code: string of country code
+* 
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_country(_adapter *adapter, const char *country_code)
+{
+	int channel_plan = RT_CHANNEL_DOMAIN_WORLD_WIDE_5G;
+
+	DBG_871X("%s country_code:%s\n", __func__, country_code);
+
+	//TODO: should have a table to match country code and RT_CHANNEL_DOMAIN
+	//TODO: should consider 2-character and 3-character country code
+	if(0 == strcmp(country_code, "US"))
+		channel_plan = RT_CHANNEL_DOMAIN_FCC;
+	else if(0 == strcmp(country_code, "EU"))
+		channel_plan = RT_CHANNEL_DOMAIN_ETSI;
+	else if(0 == strcmp(country_code, "JP"))
+		channel_plan = RT_CHANNEL_DOMAIN_MKK;
+	else if(0 == strcmp(country_code, "CN"))
+		channel_plan = RT_CHANNEL_DOMAIN_CHINA;
+	else
+		DBG_871X("%s unknown country_code:%s\n", __FUNCTION__, country_code);
+	
+	return rtw_set_channel_plan(adapter, channel_plan);
+}
+
+/*
+* rtw_set_band - 
+* @adapter: pointer to _adapter structure
+* @band: band to set
+* 
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_band(_adapter *adapter, enum _BAND band)
+{
+	if (rtw_band_valid(band)) {
+		DBG_871X(FUNC_ADPT_FMT" band:%d\n", FUNC_ADPT_ARG(adapter), band);
+		adapter->setband = band;
+		return _SUCCESS;
+	}
+
+	DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" band:%d fail\n", FUNC_ADPT_ARG(adapter), band);
+	return _FAIL;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c
new file mode 100755
index 0000000000000..872cc4234fc4d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c
@@ -0,0 +1,263 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include<rtw_iol.h>
+
+#ifdef CONFIG_IOL
+struct xmit_frame	*rtw_IOL_accquire_xmit_frame(ADAPTER *adapter)
+{
+	struct xmit_frame	*xmit_frame;
+	struct xmit_buf	*xmitbuf;
+	struct pkt_attrib	*pattrib;
+	struct xmit_priv	*pxmitpriv = &(adapter->xmitpriv);
+
+#if 1
+	if ((xmit_frame = rtw_alloc_xmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s rtw_alloc_xmitframe return null\n", __FUNCTION__);
+		goto exit;
+	}
+	
+	if ((xmitbuf = rtw_alloc_xmitbuf(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s rtw_alloc_xmitbuf return null\n", __FUNCTION__);
+		rtw_free_xmitframe(pxmitpriv, xmit_frame);
+		xmit_frame=NULL;
+		goto exit;
+	}
+	
+	xmit_frame->frame_tag = MGNT_FRAMETAG;
+	xmit_frame->pxmitbuf = xmitbuf;
+	xmit_frame->buf_addr = xmitbuf->pbuf;
+	xmitbuf->priv_data = xmit_frame;
+
+	pattrib = &xmit_frame->attrib;
+	update_mgntframe_attrib(adapter, pattrib);
+	pattrib->qsel = 0x10;
+	pattrib->pktlen = pattrib->last_txcmdsz = 0;
+
+#else
+	if ((xmit_frame = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s alloc_mgtxmitframe return null\n", __FUNCTION__);
+	}
+	else {
+		pattrib = &xmit_frame->attrib;
+		update_mgntframe_attrib(adapter, pattrib);
+		pattrib->qsel = 0x10;
+		pattrib->pktlen = pattrib->last_txcmdsz = 0;
+	}
+#endif
+
+exit:
+	return xmit_frame;
+}
+
+
+int rtw_IOL_append_cmds(struct xmit_frame *xmit_frame, u8 *IOL_cmds, u32 cmd_len)
+{
+	struct pkt_attrib	*pattrib = &xmit_frame->attrib;
+	u16 buf_offset;
+	u32 ori_len;
+
+//Todo: bulkout without this offset
+#ifdef CONFIG_USB_HCI
+	buf_offset = TXDESC_OFFSET;
+#else
+	buf_offset = 0;
+#endif
+
+	ori_len = buf_offset+pattrib->pktlen;
+
+	//check if the io_buf can accommodate new cmds
+	if(ori_len + cmd_len + 8 > MAX_XMITBUF_SZ) {
+		DBG_871X("%s %u is large than MAX_XMITBUF_SZ:%u, can't accommodate new cmds\n", __FUNCTION__
+			, ori_len + cmd_len + 8, MAX_XMITBUF_SZ);
+		return _FAIL;
+	}
+
+	_rtw_memcpy(xmit_frame->buf_addr + buf_offset + pattrib->pktlen, IOL_cmds, cmd_len);
+	pattrib->pktlen += cmd_len;
+	pattrib->last_txcmdsz += cmd_len;
+
+	//DBG_871X("%s ori:%u + cmd_len:%u = %u\n", __FUNCTION__, ori_len, cmd_len, buf_offset+pattrib->pktlen);
+	
+	return _SUCCESS;
+}
+
+int rtw_IOL_append_LLT_cmd(struct xmit_frame *xmit_frame, u8 page_boundary)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_LLT, 0x0, 0x0};
+	
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)page_boundary);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int _rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_WB_REG, 0x0, 0x0};
+	
+	RTW_PUT_BE16((u8*)&cmd.address, (u16)addr);
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)value);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int _rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_WW_REG, 0x0, 0x0};
+	
+	RTW_PUT_BE16((u8*)&cmd.address, (u16)addr);
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)value);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int _rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_WD_REG, 0x0, 0x0};
+	u8* pos = (u8 *)&cmd;
+	
+	RTW_PUT_BE16((u8*)&cmd.address, (u16)addr);
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)value);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+#ifdef DBG_IO
+int dbg_rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 1))
+		DBG_871X("DBG_IO %s:%d IOL_WB(0x%04x, 0x%02x)\n", caller, line, addr, value);
+
+	return _rtw_IOL_append_WB_cmd(xmit_frame, addr, value);
+}
+
+int dbg_rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 2))
+		DBG_871X("DBG_IO %s:%d IOL_WW(0x%04x, 0x%04x)\n", caller, line, addr, value);
+
+	return _rtw_IOL_append_WW_cmd(xmit_frame, addr, value);
+}
+
+int dbg_rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 4))
+		DBG_871X("DBG_IO %s:%d IOL_WD(0x%04x, 0x%08x)\n", caller, line, addr, value);
+
+	return _rtw_IOL_append_WD_cmd(xmit_frame, addr, value);
+}
+#endif
+
+int rtw_IOL_append_DELAY_US_cmd(struct xmit_frame *xmit_frame, u16 us)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_DELAY_US, 0x0, 0x0};
+	
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)us);
+
+	//DBG_871X("%s %u\n", __FUNCTION__, us);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int rtw_IOL_append_DELAY_MS_cmd(struct xmit_frame *xmit_frame, u16 ms)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_DELAY_MS, 0x0, 0x0};
+	
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)ms);
+
+	//DBG_871X("%s %u\n", __FUNCTION__, ms);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int rtw_IOL_append_END_cmd(struct xmit_frame *xmit_frame)
+{
+	struct pkt_attrib	*pattrib = &xmit_frame->attrib;
+	u16 buf_offset;
+	u32 ori_len;
+	IOL_CMD end_cmd = {0x0, IOL_CMD_END, 0x0, 0x0};
+
+//Todo: bulkout without this offset
+#ifdef CONFIG_USB_HCI
+	buf_offset = TXDESC_OFFSET;
+#else
+	buf_offset = 0;
+#endif
+
+	ori_len = buf_offset+pattrib->pktlen;
+
+	//check if the io_buf can accommodate new cmds
+	if(ori_len + 8 > MAX_XMITBUF_SZ) {
+		DBG_871X("%s %u is large than MAX_XMITBUF_SZ:%u, can't accommodate end cmd\n", __FUNCTION__
+			, ori_len + 8, MAX_XMITBUF_SZ);
+		return _FAIL;
+	}
+
+	_rtw_memcpy(xmit_frame->buf_addr + buf_offset + pattrib->pktlen, (u8*)&end_cmd, 8);
+	pattrib->pktlen += 8;
+	pattrib->last_txcmdsz += 8;
+
+	//DBG_871X("%s ori:%u + 8 = %u\n", __FUNCTION__ , ori_len, buf_offset+pattrib->pktlen);
+	
+	return _SUCCESS;
+}
+
+int rtw_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms)
+{
+	return rtw_hal_iol_cmd(adapter, xmit_frame, max_wating_ms);
+}
+
+int rtw_IOL_exec_cmd_array_sync(PADAPTER adapter, u8 *IOL_cmds, u32 cmd_num, u32 max_wating_ms)
+{
+	struct xmit_frame	*xmit_frame;
+
+	if((xmit_frame=rtw_IOL_accquire_xmit_frame(adapter)) == NULL)
+		return _FAIL;
+
+	if(rtw_IOL_append_cmds(xmit_frame, IOL_cmds, cmd_num<<3) == _FAIL)
+		return _FAIL;
+
+	return rtw_IOL_exec_cmds_sync(adapter, xmit_frame, max_wating_ms);
+}
+
+int rtw_IOL_exec_empty_cmds_sync(ADAPTER *adapter, u32 max_wating_ms)
+{
+	IOL_CMD end_cmd = {0x0, IOL_CMD_END, 0x0, 0x0};
+	return rtw_IOL_exec_cmd_array_sync(adapter, (u8*)&end_cmd, 1, max_wating_ms);
+}
+
+bool rtw_IOL_applied(ADAPTER *adapter)
+{
+	if(adapter->registrypriv.force_iol)
+		return _TRUE;
+
+#ifdef CONFIG_USB_HCI
+	if(!adapter_to_dvobj(adapter)->ishighspeed)
+		return _TRUE;
+#endif
+
+	return _FALSE;
+}
+
+#endif //CONFIG_IOL
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c
new file mode 100755
index 0000000000000..00edd9cc69551
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c
@@ -0,0 +1,3967 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MLME_C_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <hal_intf.h>
+#include <mlme_osdep.h>
+#include <sta_info.h>
+#include <wifi.h>
+#include <wlan_bssdef.h>
+#include <rtw_ioctl_set.h>
+
+extern void indicate_wx_scan_complete_event(_adapter *padapter);
+extern u8 rtw_do_join(_adapter * padapter);
+
+#ifdef CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_2R_MCS13TO15_OFF[16];
+extern unsigned char	MCS_rate_2R[16];
+#else //CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_2R[16];
+#endif //CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_1R[16];
+
+sint	_rtw_init_mlme_priv (_adapter* padapter)
+{
+	sint	i;
+	u8	*pbuf;
+	struct wlan_network	*pnetwork;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	sint	res = _SUCCESS;
+
+_func_enter_;
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((u8 *)pmlmepriv, 0, sizeof(struct mlme_priv));
+
+	pmlmepriv->nic_hdl = (u8 *)padapter;
+
+	pmlmepriv->pscanned = NULL;
+	pmlmepriv->fw_state = 0;
+	pmlmepriv->cur_network.network.InfrastructureMode = Ndis802_11AutoUnknown;
+	pmlmepriv->scan_mode=SCAN_ACTIVE;// 1: active, 0: pasive. Maybe someday we should rename this varable to "active_mode" (Jeff)
+
+	_rtw_spinlock_init(&(pmlmepriv->lock));	
+	_rtw_init_queue(&(pmlmepriv->free_bss_pool));
+	_rtw_init_queue(&(pmlmepriv->scanned_queue));
+
+	set_scanned_network_val(pmlmepriv, 0);
+	
+	_rtw_memset(&pmlmepriv->assoc_ssid,0,sizeof(NDIS_802_11_SSID));
+
+	pbuf = rtw_zvmalloc(MAX_BSS_CNT * (sizeof(struct wlan_network)));
+	
+	if (pbuf == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+	pmlmepriv->free_bss_buf = pbuf;
+		
+	pnetwork = (struct wlan_network *)pbuf;
+	
+	for(i = 0; i < MAX_BSS_CNT; i++)
+	{		
+		_rtw_init_listhead(&(pnetwork->list));
+
+		rtw_list_insert_tail(&(pnetwork->list), &(pmlmepriv->free_bss_pool.queue));
+
+		pnetwork++;
+	}
+
+	//allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf
+
+	rtw_clear_scan_deny(padapter);
+
+	rtw_init_mlme_timer(padapter);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}	
+
+void rtw_mfree_mlme_priv_lock (struct mlme_priv *pmlmepriv);
+void rtw_mfree_mlme_priv_lock (struct mlme_priv *pmlmepriv)
+{
+	_rtw_spinlock_free(&pmlmepriv->lock);
+	_rtw_spinlock_free(&(pmlmepriv->free_bss_pool.lock));
+	_rtw_spinlock_free(&(pmlmepriv->scanned_queue.lock));
+}
+
+static void rtw_free_mlme_ie_data(u8 **ppie, u32 *plen)
+{
+	if(*ppie)
+	{		
+		rtw_mfree(*ppie, *plen);
+		*plen = 0;
+		*ppie=NULL;
+	}	
+}
+
+void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
+{
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
+	rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_beacon_ie, &pmlmepriv->wps_beacon_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_probe_req_ie, &pmlmepriv->wps_probe_req_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_probe_resp_ie, &pmlmepriv->wps_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_assoc_resp_ie, &pmlmepriv->wps_assoc_resp_ie_len);
+	
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_beacon_ie, &pmlmepriv->p2p_beacon_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_probe_req_ie, &pmlmepriv->p2p_probe_req_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_probe_resp_ie, &pmlmepriv->p2p_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_go_probe_resp_ie, &pmlmepriv->p2p_go_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_assoc_req_ie, &pmlmepriv->p2p_assoc_req_ie_len);
+#endif
+
+#if defined(CONFIG_WFD) && defined(CONFIG_IOCTL_CFG80211)	
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_beacon_ie, &pmlmepriv->wfd_beacon_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_probe_req_ie, &pmlmepriv->wfd_probe_req_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_probe_resp_ie, &pmlmepriv->wfd_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_go_probe_resp_ie, &pmlmepriv->wfd_go_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_assoc_req_ie, &pmlmepriv->wfd_assoc_req_ie_len);
+#endif
+
+}
+
+void _rtw_free_mlme_priv (struct mlme_priv *pmlmepriv)
+{
+_func_enter_;
+
+	rtw_free_mlme_priv_ie_data(pmlmepriv);
+
+	if(pmlmepriv){
+		rtw_mfree_mlme_priv_lock (pmlmepriv);
+
+		if (pmlmepriv->free_bss_buf) {
+			rtw_vmfree(pmlmepriv->free_bss_buf, MAX_BSS_CNT * sizeof(struct wlan_network));
+		}
+	}
+_func_exit_;	
+}
+
+sint	_rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork)
+{
+	_irqL irqL;
+
+_func_enter_;	
+
+	if (pnetwork == NULL)
+		goto exit;
+	
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	rtw_list_insert_tail(&pnetwork->list, &queue->queue);
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+exit:	
+
+_func_exit_;		
+
+	return _SUCCESS;
+}
+
+struct	wlan_network *_rtw_dequeue_network(_queue *queue)
+{
+	_irqL irqL;
+
+	struct wlan_network *pnetwork;
+
+_func_enter_;	
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (_rtw_queue_empty(queue) == _TRUE)
+
+		pnetwork = NULL;
+	
+	else
+	{
+		pnetwork = LIST_CONTAINOR(get_next(&queue->queue), struct wlan_network, list);
+		
+		rtw_list_delete(&(pnetwork->list));
+	}
+	
+	_exit_critical_bh(&queue->lock, &irqL);
+
+_func_exit_;		
+
+	return pnetwork;
+}
+
+struct	wlan_network *_rtw_alloc_network(struct	mlme_priv *pmlmepriv )//(_queue *free_queue)
+{
+	_irqL	irqL;
+	struct	wlan_network	*pnetwork;	
+	_queue *free_queue = &pmlmepriv->free_bss_pool;
+	_list* plist = NULL;
+	
+_func_enter_;	
+
+	_enter_critical_bh(&free_queue->lock, &irqL);
+	
+	if (_rtw_queue_empty(free_queue) == _TRUE) {
+		pnetwork=NULL;
+		goto exit;
+	}
+	plist = get_next(&(free_queue->queue));
+	
+	pnetwork = LIST_CONTAINOR(plist , struct wlan_network, list);
+	
+	rtw_list_delete(&pnetwork->list);
+	
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("_rtw_alloc_network: ptr=%p\n", plist));
+	pnetwork->network_type = 0;
+	pnetwork->fixed = _FALSE;
+	pnetwork->last_scanned = rtw_get_current_time();
+	pnetwork->aid=0;	
+	pnetwork->join_res=0;
+
+	pmlmepriv->num_of_scanned ++;
+	
+exit:
+	_exit_critical_bh(&free_queue->lock, &irqL);
+
+_func_exit_;		
+
+	return pnetwork;	
+}
+
+void _rtw_free_network(struct	mlme_priv *pmlmepriv ,struct wlan_network *pnetwork, u8 isfreeall)
+{
+	u32 curr_time, delta_time;
+	u32 lifetime = SCANQUEUE_LIFETIME;
+	_irqL irqL;	
+	_queue *free_queue = &(pmlmepriv->free_bss_pool);
+	
+_func_enter_;		
+
+	if (pnetwork == NULL)
+		goto exit;
+
+	if (pnetwork->fixed == _TRUE)
+		goto exit;
+
+	curr_time = rtw_get_current_time();	
+
+	if ( (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)==_TRUE ) || 
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE ) )
+		lifetime = 1;
+
+	if(!isfreeall)
+	{
+#ifdef PLATFORM_WINDOWS
+
+		delta_time = (curr_time -pnetwork->last_scanned)/10;
+
+		if(delta_time  < lifetime*1000000)// unit:usec
+		{
+			goto exit;
+		}
+
+#endif
+
+#ifdef PLATFORM_LINUX
+
+		delta_time = (curr_time -pnetwork->last_scanned)/HZ;	
+
+		if(delta_time < lifetime)// unit:sec
+		{		
+			goto exit;
+		}
+
+#endif
+
+#ifdef PLATFORM_FREEBSD
+        //i think needs to check again
+		delta_time = (curr_time -pnetwork->last_scanned)/hz;	
+
+		if(delta_time < lifetime)// unit:sec
+		{		
+			goto exit;
+		}
+
+#endif
+	}
+
+	_enter_critical_bh(&free_queue->lock, &irqL);
+	
+	rtw_list_delete(&(pnetwork->list));
+
+	rtw_list_insert_tail(&(pnetwork->list),&(free_queue->queue));
+		
+	pmlmepriv->num_of_scanned --;
+	
+
+	//DBG_871X("_rtw_free_network:SSID=%s\n", pnetwork->network.Ssid.Ssid);
+	
+	_exit_critical_bh(&free_queue->lock, &irqL);
+	
+exit:		
+	
+_func_exit_;			
+
+}
+
+void _rtw_free_network_nolock(struct	mlme_priv *pmlmepriv, struct wlan_network *pnetwork)
+{
+
+	_queue *free_queue = &(pmlmepriv->free_bss_pool);
+
+_func_enter_;		
+
+	if (pnetwork == NULL)
+		goto exit;
+
+	if (pnetwork->fixed == _TRUE)
+		goto exit;
+
+	//_enter_critical(&free_queue->lock, &irqL);
+	
+	rtw_list_delete(&(pnetwork->list));
+
+	rtw_list_insert_tail(&(pnetwork->list), get_list_head(free_queue));
+		
+	pmlmepriv->num_of_scanned --;
+	
+	//_exit_critical(&free_queue->lock, &irqL);
+	
+exit:		
+
+_func_exit_;			
+
+}
+
+
+/*
+	return the wlan_network with the matching addr
+
+	Shall be calle under atomic context... to avoid possible racing condition...
+*/
+struct wlan_network *_rtw_find_network(_queue *scanned_queue, u8 *addr)
+{
+
+	//_irqL irqL;
+	_list	*phead, *plist;
+	struct	wlan_network *pnetwork = NULL;
+	u8 zero_addr[ETH_ALEN] = {0,0,0,0,0,0};
+	
+_func_enter_;	
+
+	if(_rtw_memcmp(zero_addr, addr, ETH_ALEN)){
+		pnetwork=NULL;
+		goto exit;
+	}
+	
+	//_enter_critical_bh(&scanned_queue->lock, &irqL);
+	
+	phead = get_list_head(scanned_queue);
+	plist = get_next(phead);
+	 
+	while (plist != phead)
+       {
+                pnetwork = LIST_CONTAINOR(plist, struct wlan_network ,list);
+
+		if (_rtw_memcmp(addr, pnetwork->network.MacAddress, ETH_ALEN) == _TRUE)
+                        break;
+		
+		plist = get_next(plist);
+        }
+
+	if(plist == phead)
+		pnetwork = NULL;
+
+	//_exit_critical_bh(&scanned_queue->lock, &irqL);
+	
+exit:		
+	
+_func_exit_;		
+
+	return pnetwork;
+	
+}
+
+
+void _rtw_free_network_queue(_adapter *padapter, u8 isfreeall)
+{
+	_irqL irqL;
+	_list *phead, *plist;
+	struct wlan_network *pnetwork;
+	struct mlme_priv* pmlmepriv = &padapter->mlmepriv;
+	_queue *scanned_queue = &pmlmepriv->scanned_queue;
+
+_func_enter_;	
+	
+
+	_enter_critical_bh(&scanned_queue->lock, &irqL);
+
+	phead = get_list_head(scanned_queue);
+	plist = get_next(phead);
+
+	while (rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		plist = get_next(plist);
+
+		_rtw_free_network(pmlmepriv,pnetwork, isfreeall);
+		
+	}
+
+	_exit_critical_bh(&scanned_queue->lock, &irqL);
+	
+_func_exit_;		
+
+}
+
+
+
+
+sint rtw_if_up(_adapter *padapter)	{
+
+	sint res;
+_func_enter_;		
+
+	if( padapter->bDriverStopped || padapter->bSurpriseRemoved ||
+		(check_fwstate(&padapter->mlmepriv, _FW_LINKED)== _FALSE)){		
+		RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_if_up:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));	
+		res=_FALSE;
+	}
+	else
+		res=  _TRUE;
+	
+_func_exit_;
+	return res;
+}
+
+
+void rtw_generate_random_ibss(u8* pibss)
+{
+	u32	curtime = rtw_get_current_time();
+
+_func_enter_;
+	pibss[0] = 0x02;  //in ad-hoc mode bit1 must set to 1
+	pibss[1] = 0x11;
+	pibss[2] = 0x87;
+	pibss[3] = (u8)(curtime & 0xff) ;//p[0];
+	pibss[4] = (u8)((curtime>>8) & 0xff) ;//p[1];
+	pibss[5] = (u8)((curtime>>16) & 0xff) ;//p[2];
+_func_exit_;
+	return;
+}
+
+u8 *rtw_get_capability_from_ie(u8 *ie)
+{
+	return (ie + 8 + 2);
+}
+
+
+u16 rtw_get_capability(WLAN_BSSID_EX *bss)
+{
+	u16	val;
+_func_enter_;	
+
+	_rtw_memcpy((u8 *)&val, rtw_get_capability_from_ie(bss->IEs), 2); 
+
+_func_exit_;		
+	return le16_to_cpu(val);
+}
+
+u8 *rtw_get_timestampe_from_ie(u8 *ie)
+{
+	return (ie + 0);	
+}
+
+u8 *rtw_get_beacon_interval_from_ie(u8 *ie)
+{
+	return (ie + 8);	
+}
+
+
+int	rtw_init_mlme_priv (_adapter *padapter)//(struct	mlme_priv *pmlmepriv)
+{
+	int	res;
+_func_enter_;	
+	res = _rtw_init_mlme_priv(padapter);// (pmlmepriv);
+_func_exit_;	
+	return res;
+}
+
+void rtw_free_mlme_priv (struct mlme_priv *pmlmepriv)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_mlme_priv\n"));
+	_rtw_free_mlme_priv (pmlmepriv);
+_func_exit_;	
+}
+
+int	rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork);
+int	rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork)
+{
+	int	res;
+_func_enter_;		
+	res = _rtw_enqueue_network(queue, pnetwork);
+_func_exit_;		
+	return res;
+}
+
+
+#ifndef PLATFORM_FREEBSD //Baron
+static struct	wlan_network *rtw_dequeue_network(_queue *queue)
+{
+	struct wlan_network *pnetwork;
+_func_enter_;		
+	pnetwork = _rtw_dequeue_network(queue);
+_func_exit_;		
+	return pnetwork;
+}
+#endif //PLATFORM_FREEBSD
+
+struct	wlan_network *rtw_alloc_network(struct	mlme_priv *pmlmepriv );
+struct	wlan_network *rtw_alloc_network(struct	mlme_priv *pmlmepriv )//(_queue	*free_queue)
+{
+	struct	wlan_network	*pnetwork;
+_func_enter_;			
+	pnetwork = _rtw_alloc_network(pmlmepriv);
+_func_exit_;			
+	return pnetwork;
+}
+
+void rtw_free_network(struct mlme_priv *pmlmepriv, struct	wlan_network *pnetwork, u8 is_freeall);
+void rtw_free_network(struct mlme_priv *pmlmepriv, struct	wlan_network *pnetwork, u8 is_freeall)//(struct	wlan_network *pnetwork, _queue	*free_queue)
+{
+_func_enter_;		
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_network==> ssid = %s \n\n" , pnetwork->network.Ssid.Ssid));
+	_rtw_free_network(pmlmepriv, pnetwork, is_freeall);
+_func_exit_;		
+}
+
+void rtw_free_network_nolock(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork );
+void rtw_free_network_nolock(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork )
+{
+_func_enter_;		
+	//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_network==> ssid = %s \n\n" , pnetwork->network.Ssid.Ssid));
+	_rtw_free_network_nolock(pmlmepriv, pnetwork);
+_func_exit_;		
+}
+
+
+void rtw_free_network_queue(_adapter* dev, u8 isfreeall)
+{
+_func_enter_;		
+	_rtw_free_network_queue(dev, isfreeall);
+_func_exit_;			
+}
+
+/*
+	return the wlan_network with the matching addr
+
+	Shall be calle under atomic context... to avoid possible racing condition...
+*/
+struct	wlan_network *rtw_find_network(_queue *scanned_queue, u8 *addr)
+{
+	struct	wlan_network *pnetwork = _rtw_find_network(scanned_queue, addr);
+
+	return pnetwork;
+}
+
+int rtw_is_same_ibss(_adapter *adapter, struct wlan_network *pnetwork)
+{
+	int ret=_TRUE;
+	struct security_priv *psecuritypriv = &adapter->securitypriv;
+
+	if ( (psecuritypriv->dot11PrivacyAlgrthm != _NO_PRIVACY_ ) &&
+		    ( pnetwork->network.Privacy == 0 ) )
+	{
+		ret=_FALSE;
+	}
+	else if((psecuritypriv->dot11PrivacyAlgrthm == _NO_PRIVACY_ ) &&
+		 ( pnetwork->network.Privacy == 1 ) )
+	{
+		ret=_FALSE;
+	}
+	else
+	{
+		ret=_TRUE;
+	}
+	
+	return ret;
+	
+}
+
+inline int is_same_ess(WLAN_BSSID_EX *a, WLAN_BSSID_EX *b);
+inline int is_same_ess(WLAN_BSSID_EX *a, WLAN_BSSID_EX *b)
+{
+	//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("(%s,%d)(%s,%d)\n",
+	//		a->Ssid.Ssid,a->Ssid.SsidLength,b->Ssid.Ssid,b->Ssid.SsidLength));
+	return (a->Ssid.SsidLength == b->Ssid.SsidLength) 
+		&&  _rtw_memcmp(a->Ssid.Ssid, b->Ssid.Ssid, a->Ssid.SsidLength)==_TRUE;
+}
+
+int is_same_network(WLAN_BSSID_EX *src, WLAN_BSSID_EX *dst)
+{
+	 u16 s_cap, d_cap;
+	 
+_func_enter_;	
+
+#ifdef PLATFORM_OS_XP
+	 if ( ((uint)dst) <= 0x7fffffff || 
+	 	((uint)src) <= 0x7fffffff ||
+	 	((uint)&s_cap) <= 0x7fffffff ||
+	 	((uint)&d_cap) <= 0x7fffffff)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n@@@@ error address of dst\n"));
+			
+		KeBugCheckEx(0x87110000, (ULONG_PTR)dst, (ULONG_PTR)src,(ULONG_PTR)&s_cap, (ULONG_PTR)&d_cap);
+
+		return _FALSE;
+	}
+#endif
+
+
+	_rtw_memcpy((u8 *)&s_cap, rtw_get_capability_from_ie(src->IEs), 2);
+	_rtw_memcpy((u8 *)&d_cap, rtw_get_capability_from_ie(dst->IEs), 2);
+
+	
+	s_cap = le16_to_cpu(s_cap);
+	d_cap = le16_to_cpu(d_cap);
+	
+_func_exit_;			
+
+	return ((src->Ssid.SsidLength == dst->Ssid.SsidLength) &&
+		//	(src->Configuration.DSConfig == dst->Configuration.DSConfig) &&
+			( (_rtw_memcmp(src->MacAddress, dst->MacAddress, ETH_ALEN)) == _TRUE) &&
+			( (_rtw_memcmp(src->Ssid.Ssid, dst->Ssid.Ssid, src->Ssid.SsidLength)) == _TRUE) &&
+			((s_cap & WLAN_CAPABILITY_IBSS) == 
+			(d_cap & WLAN_CAPABILITY_IBSS)) &&
+			((s_cap & WLAN_CAPABILITY_BSS) == 
+			(d_cap & WLAN_CAPABILITY_BSS)));
+	
+}
+
+struct	wlan_network	* rtw_get_oldest_wlan_network(_queue *scanned_queue)
+{
+	_list	*plist, *phead;
+
+	
+	struct	wlan_network	*pwlan = NULL;
+	struct	wlan_network	*oldest = NULL;
+_func_enter_;		
+	phead = get_list_head(scanned_queue);
+	
+	plist = get_next(phead);
+
+	while(1)
+	{
+		
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+		
+		pwlan= LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		if(pwlan->fixed!=_TRUE)
+		{		
+			if (oldest == NULL ||time_after(oldest->last_scanned, pwlan->last_scanned))
+				oldest = pwlan;
+		}
+		
+		plist = get_next(plist);
+	}
+_func_exit_;		
+	return oldest;
+	
+}
+
+static void update_network(WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src,
+	_adapter * padapter, bool update_ie)
+{
+	u8 ss_ori = dst->PhyInfo.SignalStrength;
+	u8 sq_ori = dst->PhyInfo.SignalQuality;
+	long rssi_ori = dst->Rssi;
+
+	u8 ss_smp = src->PhyInfo.SignalStrength;
+	u8 sq_smp = src->PhyInfo.SignalQuality;
+	long rssi_smp = src->Rssi;
+
+	u8 ss_final;
+	u8 sq_final;
+	long rssi_final;
+
+_func_enter_;		
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	rtw_hal_antdiv_rssi_compared(padapter, dst, src); //this will update src.Rssi, need consider again
+#endif
+
+	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) && 1
+	if(strcmp(dst->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
+		DBG_871X(FUNC_ADPT_FMT" %s("MAC_FMT", ch%u) ss_ori:%3u, sq_ori:%3u, rssi_ori:%3ld, ss_smp:%3u, sq_smp:%3u, rssi_smp:%3ld\n"
+			, FUNC_ADPT_ARG(padapter)
+			, src->Ssid.Ssid, MAC_ARG(src->MacAddress), src->Configuration.DSConfig
+			,ss_ori, sq_ori, rssi_ori
+			,ss_smp, sq_smp, rssi_smp
+		);
+	}
+	#endif
+
+	/* The rule below is 1/5 for sample value, 4/5 for history value */
+	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) && is_same_network(&(padapter->mlmepriv.cur_network.network), src)) {
+		/* Take the recvpriv's value for the connected AP*/
+		ss_final = padapter->recvpriv.signal_strength;
+		sq_final = padapter->recvpriv.signal_qual;
+		/* the rssi value here is undecorated, and will be used for antenna diversity */
+		if(sq_smp != 101) /* from the right channel */
+			rssi_final = (src->Rssi+dst->Rssi*4)/5;
+		else
+			rssi_final = rssi_ori;
+	}
+	else {
+		if(sq_smp != 101) { /* from the right channel */
+			ss_final = ((u32)(src->PhyInfo.SignalStrength)+(u32)(dst->PhyInfo.SignalStrength)*4)/5;
+			sq_final = ((u32)(src->PhyInfo.SignalQuality)+(u32)(dst->PhyInfo.SignalQuality)*4)/5;
+			rssi_final = (src->Rssi+dst->Rssi*4)/5;
+		} else {
+			/* bss info not receving from the right channel, use the original RX signal infos */
+			ss_final = dst->PhyInfo.SignalStrength;
+			sq_final = dst->PhyInfo.SignalQuality;
+			rssi_final = dst->Rssi;
+		}
+		
+	}
+
+	if (update_ie)
+		_rtw_memcpy((u8 *)dst, (u8 *)src, get_WLAN_BSSID_EX_sz(src));
+
+	dst->PhyInfo.SignalStrength = ss_final;
+	dst->PhyInfo.SignalQuality = sq_final;
+	dst->Rssi = rssi_final;
+
+	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) && 1
+	if(strcmp(dst->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
+		DBG_871X(FUNC_ADPT_FMT" %s("MAC_FMT"), SignalStrength:%u, SignalQuality:%u, RawRSSI:%ld\n"
+			, FUNC_ADPT_ARG(padapter)
+			, dst->Ssid.Ssid, MAC_ARG(dst->MacAddress), dst->PhyInfo.SignalStrength, dst->PhyInfo.SignalQuality, dst->Rssi);
+	}
+	#endif
+
+#if 0 // old codes, may be useful one day...
+//	DBG_871X("update_network: rssi=0x%lx dst->Rssi=%d ,dst->Rssi=0x%lx , src->Rssi=0x%lx",(dst->Rssi+src->Rssi)/2,dst->Rssi,dst->Rssi,src->Rssi);
+	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) && is_same_network(&(padapter->mlmepriv.cur_network.network), src))
+	{
+	
+		//DBG_871X("b:ssid=%s update_network: src->rssi=0x%d padapter->recvpriv.ui_rssi=%d\n",src->Ssid.Ssid,src->Rssi,padapter->recvpriv.signal);
+		if(padapter->recvpriv.signal_qual_data.total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX)
+	        {
+	              padapter->recvpriv.signal_qual_data.total_num = PHY_LINKQUALITY_SLID_WIN_MAX;
+	              last_evm = padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index];
+	              padapter->recvpriv.signal_qual_data.total_val -= last_evm;
+	        }
+               	padapter->recvpriv.signal_qual_data.total_val += query_rx_pwr_percentage(src->Rssi);
+
+              	padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index++] = query_rx_pwr_percentage(src->Rssi);
+                if(padapter->recvpriv.signal_qual_data.index >= PHY_LINKQUALITY_SLID_WIN_MAX)
+                       padapter->recvpriv.signal_qual_data.index = 0;
+
+		//DBG_871X("Total SQ=%d  pattrib->signal_qual= %d\n", padapter->recvpriv.signal_qual_data.total_val, src->Rssi);
+
+		// <1> Showed on UI for user,in percentage.
+		tmpVal = padapter->recvpriv.signal_qual_data.total_val/padapter->recvpriv.signal_qual_data.total_num;
+                padapter->recvpriv.signal=(u8)tmpVal;//Link quality
+
+		src->Rssi= translate_percentage_to_dbm(padapter->recvpriv.signal) ;
+	}
+	else{
+//	DBG_871X("ELSE:ssid=%s update_network: src->rssi=0x%d dst->rssi=%d\n",src->Ssid.Ssid,src->Rssi,dst->Rssi);
+		src->Rssi=(src->Rssi +dst->Rssi)/2;//dBM
+	}	
+
+//	DBG_871X("a:update_network: src->rssi=0x%d padapter->recvpriv.ui_rssi=%d\n",src->Rssi,padapter->recvpriv.signal);
+
+#endif
+
+_func_exit_;		
+}
+
+static void update_current_network(_adapter *adapter, WLAN_BSSID_EX *pnetwork)
+{
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	
+_func_enter_;		
+
+#ifdef PLATFORM_OS_XP
+	if ((unsigned long)(&(pmlmepriv->cur_network.network)) < 0x7ffffff)
+	{		
+		KeBugCheckEx(0x87111c1c, (ULONG_PTR)(&(pmlmepriv->cur_network.network)), 0, 0,0);
+	}
+#endif
+
+	if ( (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) && (is_same_network(&(pmlmepriv->cur_network.network), pnetwork)))
+	{
+		//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"Same Network\n");
+
+		//if(pmlmepriv->cur_network.network.IELength<= pnetwork->IELength)
+		{
+			update_network(&(pmlmepriv->cur_network.network), pnetwork,adapter, _TRUE);
+			rtw_update_protection(adapter, (pmlmepriv->cur_network.network.IEs) + sizeof (NDIS_802_11_FIXED_IEs), 
+									pmlmepriv->cur_network.network.IELength);
+		}
+	}
+
+_func_exit_;			
+
+}
+
+
+/*
+
+Caller must hold pmlmepriv->lock first.
+
+
+*/
+void rtw_update_scanned_network(_adapter *adapter, WLAN_BSSID_EX *target)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	ULONG	bssid_ex_sz;
+	struct mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct wlan_network	*pnetwork = NULL;
+	struct wlan_network	*oldest = NULL;
+
+_func_enter_;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork	= LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		if ((unsigned long)(pnetwork) < 0x7ffffff)
+		{
+#ifdef PLATFORM_OS_XP
+			KeBugCheckEx(0x87111c1c, (ULONG_PTR)pnetwork, 0, 0,0);
+#endif
+		}
+
+		if (is_same_network(&(pnetwork->network), target))
+			break;
+
+		if ((oldest == ((struct wlan_network *)0)) ||
+		time_after(oldest->last_scanned, pnetwork->last_scanned))
+			oldest = pnetwork;
+
+		plist = get_next(plist);
+
+	}
+	
+	
+	/* If we didn't find a match, then get a new network slot to initialize
+	 * with this beacon's information */
+	if (rtw_end_of_queue_search(phead,plist)== _TRUE) {
+		
+		if (_rtw_queue_empty(&(pmlmepriv->free_bss_pool)) == _TRUE) {
+			/* If there are no more slots, expire the oldest */
+			//list_del_init(&oldest->list);
+			pnetwork = oldest;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			//target->PhyInfo.Optimum_antenna = pHalData->CurAntenna;//optimum_antenna=>For antenna diversity
+			rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(target->PhyInfo.Optimum_antenna));
+#endif
+			_rtw_memcpy(&(pnetwork->network), target,  get_WLAN_BSSID_EX_sz(target));
+			//pnetwork->last_scanned = rtw_get_current_time();
+			// variable initialize
+			pnetwork->fixed = _FALSE;
+			pnetwork->last_scanned = rtw_get_current_time();
+
+			pnetwork->network_type = 0;	
+			pnetwork->aid=0;		
+			pnetwork->join_res=0;
+
+			/* bss info not receving from the right channel */
+			if (pnetwork->network.PhyInfo.SignalQuality == 101)
+				pnetwork->network.PhyInfo.SignalQuality = 0;
+		}
+		else {
+			/* Otherwise just pull from the free list */
+
+			pnetwork = rtw_alloc_network(pmlmepriv); // will update scan_time
+
+			if(pnetwork==NULL){ 
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n\n\nsomething wrong here\n\n\n"));
+				goto exit;
+			}
+
+			bssid_ex_sz = get_WLAN_BSSID_EX_sz(target);
+			target->Length = bssid_ex_sz;
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			//target->PhyInfo.Optimum_antenna = pHalData->CurAntenna;
+			rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(target->PhyInfo.Optimum_antenna));
+#endif
+			_rtw_memcpy(&(pnetwork->network), target, bssid_ex_sz );
+
+			pnetwork->last_scanned = rtw_get_current_time();
+
+			/* bss info not receving from the right channel */
+			if (pnetwork->network.PhyInfo.SignalQuality == 101)
+				pnetwork->network.PhyInfo.SignalQuality = 0;
+
+			rtw_list_insert_tail(&(pnetwork->list),&(queue->queue)); 
+
+		}
+	}
+	else {
+		/* we have an entry and we are going to update it. But this entry may
+		 * be already expired. In this case we do the same as we found a new 
+		 * net and call the new_net handler
+		 */
+		bool update_ie = _TRUE;
+
+		pnetwork->last_scanned = rtw_get_current_time();
+
+		//target.Reserved[0]==1, means that scaned network is a bcn frame.
+		if((pnetwork->network.IELength>target->IELength) && (target->Reserved[0]==1))
+			update_ie = _FALSE;
+
+		update_network(&(pnetwork->network), target,adapter, update_ie);
+	}
+
+exit:
+	_exit_critical_bh(&queue->lock, &irqL);
+
+_func_exit_;
+}
+
+void rtw_add_network(_adapter *adapter, WLAN_BSSID_EX *pnetwork);
+void rtw_add_network(_adapter *adapter, WLAN_BSSID_EX *pnetwork)
+{
+	_irqL irqL;
+	struct	mlme_priv	*pmlmepriv = &(((_adapter *)adapter)->mlmepriv);
+	//_queue	*queue	= &(pmlmepriv->scanned_queue);
+
+_func_enter_;		
+
+	//_enter_critical_bh(&queue->lock, &irqL);
+
+	#if defined(CONFIG_P2P) && defined(CONFIG_P2P_REMOVE_GROUP_INFO)
+	rtw_WLAN_BSSID_EX_remove_p2p_attr(pnetwork, P2P_ATTR_GROUP_INFO);
+	#endif
+	
+	update_current_network(adapter, pnetwork);
+	
+	rtw_update_scanned_network(adapter, pnetwork);
+
+	//_exit_critical_bh(&queue->lock, &irqL);
+	
+_func_exit_;		
+}
+
+//select the desired network based on the capability of the (i)bss.
+// check items: (1) security
+//			   (2) network_type
+//			   (3) WMM
+//			   (4) HT
+//                     (5) others
+int rtw_is_desired_network(_adapter *adapter, struct wlan_network *pnetwork);
+int rtw_is_desired_network(_adapter *adapter, struct wlan_network *pnetwork)
+{
+	struct security_priv *psecuritypriv = &adapter->securitypriv;
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	u32 desired_encmode;
+	u32 privacy;
+
+	//u8 wps_ie[512];
+	uint wps_ielen;
+
+	int bselected = _TRUE;
+	
+	desired_encmode = psecuritypriv->ndisencryptstatus;
+	privacy = pnetwork->network.Privacy;
+
+	if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+	{
+		if(rtw_get_wps_ie(pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen)!=NULL)
+		{
+			return _TRUE;
+		}
+		else
+		{	
+			return _FALSE;
+		}	
+	}
+	if (adapter->registrypriv.wifi_spec == 1) //for  correct flow of 8021X  to do....
+	{
+		u8 *p=NULL;
+		uint ie_len=0;
+
+		if ((desired_encmode == Ndis802_11EncryptionDisabled) && (privacy != 0))
+	            bselected = _FALSE;
+
+		if ( psecuritypriv->ndisauthtype == Ndis802_11AuthModeWPA2PSK) {
+			p = rtw_get_ie(pnetwork->network.IEs + _BEACON_IE_OFFSET_, _RSN_IE_2_, &ie_len, (pnetwork->network.IELength - _BEACON_IE_OFFSET_));
+			if (p && ie_len>0) {
+				bselected = _TRUE;
+			} else {
+				bselected = _FALSE;
+			}
+		}
+	}
+	
+
+ 	if ((desired_encmode != Ndis802_11EncryptionDisabled) && (privacy == 0)) {
+		DBG_871X("desired_encmode: %d, privacy: %d\n", desired_encmode, privacy);
+		bselected = _FALSE;
+ 	}
+
+	if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+	{
+		if(pnetwork->network.InfrastructureMode != pmlmepriv->cur_network.network.InfrastructureMode)
+			bselected = _FALSE;
+	}	
+		
+
+	return bselected;
+}
+
+/* TODO: Perry : For Power Management */
+void rtw_atimdone_event_callback(_adapter	*adapter , u8 *pbuf)
+{
+
+_func_enter_;		
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("receive atimdone_evet\n"));	
+_func_exit_;			
+	return;	
+}
+
+
+void rtw_survey_event_callback(_adapter	*adapter, u8 *pbuf)
+{
+	_irqL  irqL;
+	u32 len;
+	WLAN_BSSID_EX *pnetwork;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+
+_func_enter_;		
+
+	pnetwork = (WLAN_BSSID_EX *)pbuf;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_survey_event_callback, ssid=%s\n",  pnetwork->Ssid.Ssid));
+
+#ifdef CONFIG_RTL8712
+        //endian_convert
+ 	pnetwork->Length = le32_to_cpu(pnetwork->Length);
+  	pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);	
+	pnetwork->Privacy =le32_to_cpu( pnetwork->Privacy);
+	pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
+	pnetwork->NetworkTypeInUse =le32_to_cpu(pnetwork->NetworkTypeInUse);	
+	pnetwork->Configuration.ATIMWindow = le32_to_cpu(pnetwork->Configuration.ATIMWindow);
+	pnetwork->Configuration.BeaconPeriod = le32_to_cpu(pnetwork->Configuration.BeaconPeriod);
+	pnetwork->Configuration.DSConfig =le32_to_cpu(pnetwork->Configuration.DSConfig);
+	pnetwork->Configuration.FHConfig.DwellTime=le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
+	pnetwork->Configuration.FHConfig.HopPattern=le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
+	pnetwork->Configuration.FHConfig.HopSet=le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
+	pnetwork->Configuration.FHConfig.Length=le32_to_cpu(pnetwork->Configuration.FHConfig.Length);	
+	pnetwork->Configuration.Length = le32_to_cpu(pnetwork->Configuration.Length);
+	pnetwork->InfrastructureMode = le32_to_cpu(pnetwork->InfrastructureMode);
+	pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
+#endif	
+
+	len = get_WLAN_BSSID_EX_sz(pnetwork);
+	if(len > (sizeof(WLAN_BSSID_EX)))
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n ****rtw_survey_event_callback: return a wrong bss ***\n"));
+		return;
+	}
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	// update IBSS_network 's timestamp
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) == _TRUE)
+	{
+		//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"rtw_survey_event_callback : WIFI_ADHOC_MASTER_STATE \n\n");
+		if(_rtw_memcmp(&(pmlmepriv->cur_network.network.MacAddress), pnetwork->MacAddress, ETH_ALEN))
+		{
+			struct wlan_network* ibss_wlan = NULL;
+			_irqL	irqL;
+			
+			_rtw_memcpy(pmlmepriv->cur_network.network.IEs, pnetwork->IEs, 8);
+			_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			ibss_wlan = rtw_find_network(&pmlmepriv->scanned_queue,  pnetwork->MacAddress);
+			if(ibss_wlan)
+			{
+				_rtw_memcpy(ibss_wlan->network.IEs , pnetwork->IEs, 8);			
+				_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);		
+				goto exit;
+			}
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		}
+	}
+
+	// lock pmlmepriv->lock when you accessing network_q
+	if ((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == _FALSE)
+	{		
+   	        if( pnetwork->Ssid.Ssid[0] == 0 )
+		{
+			pnetwork->Ssid.SsidLength = 0;
+		}	
+		rtw_add_network(adapter, pnetwork);
+	}	
+
+exit:	
+		
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+_func_exit_;		
+
+	return;	
+}
+
+
+
+void rtw_surveydone_event_callback(_adapter	*adapter, u8 *pbuf)
+{
+	_irqL  irqL;
+	u8 timer_cancelled = _FALSE;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	
+#ifdef CONFIG_MLME_EXT	
+
+	mlmeext_surveydone_event_callback(adapter);
+
+#endif
+
+_func_enter_;			
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	if(pmlmepriv->wps_probe_req_ie)
+	{
+		u32 free_len = pmlmepriv->wps_probe_req_ie_len;
+		pmlmepriv->wps_probe_req_ie_len = 0;
+		rtw_mfree(pmlmepriv->wps_probe_req_ie, free_len);
+		pmlmepriv->wps_probe_req_ie = NULL;			
+	}
+	
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_surveydone_event_callback: fw_state:%x\n\n", get_fwstate(pmlmepriv)));
+	
+	if (check_fwstate(pmlmepriv,_FW_UNDER_SURVEY))
+	{
+		//u8 timer_cancelled;
+
+		timer_cancelled = _TRUE;
+		//_cancel_timer(&pmlmepriv->scan_to_timer, &timer_cancelled);
+		
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+	}
+	else {
+	
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("nic status =%x, survey done event comes too late!\n", get_fwstate(pmlmepriv)));	
+	}
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if(timer_cancelled)
+		_cancel_timer(&pmlmepriv->scan_to_timer, &timer_cancelled);
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&adapter->recvpriv);
+	#endif
+
+	if(pmlmepriv->to_join == _TRUE)
+	{
+		if((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE) )
+		{
+			if(check_fwstate(pmlmepriv, _FW_LINKED)==_FALSE)
+			{
+				set_fwstate(pmlmepriv, _FW_UNDER_LINKING);	
+				
+		   		if(rtw_select_and_join_from_scanned_queue(pmlmepriv)==_SUCCESS)
+		   		{
+		       			_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT );	 
+                  		}
+		   		else	
+		  		{
+					WLAN_BSSID_EX    *pdev_network = &(adapter->registrypriv.dev_network); 			
+					u8 *pibss = adapter->registrypriv.dev_network.MacAddress;
+
+					//pmlmepriv->fw_state ^= _FW_UNDER_SURVEY;//because don't set assoc_timer
+					_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("switching to adhoc master\n"));
+				
+					_rtw_memset(&pdev_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+					_rtw_memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(NDIS_802_11_SSID));
+	
+					rtw_update_registrypriv_dev_network(adapter);
+					rtw_generate_random_ibss(pibss);
+
+                       			pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
+			
+					if(rtw_createbss_cmd(adapter)!=_SUCCESS)
+					{
+	                     		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Error=>rtw_createbss_cmd status FAIL\n"));						
+					}	
+
+			     		pmlmepriv->to_join = _FALSE;
+		   		}
+		 	}
+		}
+		else
+		{
+			int s_ret;
+			set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+			pmlmepriv->to_join = _FALSE;
+			if(_SUCCESS == (s_ret=rtw_select_and_join_from_scanned_queue(pmlmepriv)))
+			{
+	     		     _set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);	 
+			}
+			else if(s_ret == 2)//there is no need to wait for join
+			{
+				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+				rtw_indicate_connect(adapter);
+			}
+			else
+			{
+				DBG_871X("try_to_join, but select scanning queue fail, to_roaming:%d\n", rtw_to_roaming(adapter));
+				#ifdef CONFIG_LAYER2_ROAMING
+				if (rtw_to_roaming(adapter) != 0) {
+					if( --pmlmepriv->to_roaming == 0
+						|| _SUCCESS != rtw_sitesurvey_cmd(adapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)
+					) {
+						rtw_set_roaming(adapter, 0);
+#ifdef CONFIG_INTEL_WIDI
+						if(adapter->mlmepriv.widi_state == INTEL_WIDI_STATE_ROAMING)
+						{
+							_rtw_memset(pmlmepriv->sa_ext, 0x00, L2SDTA_SERVICE_VE_LEN);
+							intel_widi_wk_cmd(adapter, INTEL_WIDI_LISTEN_WK, NULL);
+							DBG_871X("change to widi listen\n");
+						}
+#endif // CONFIG_INTEL_WIDI
+						rtw_free_assoc_resources(adapter, 1);
+						rtw_indicate_disconnect(adapter);
+					} else {
+						pmlmepriv->to_join = _TRUE;
+					}
+				}
+				#endif
+				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			}
+		}
+	}
+
+	indicate_wx_scan_complete_event(adapter);
+	//DBG_871X("scan complete in %dms\n",rtw_get_passing_time_ms(pmlmepriv->scan_start_time));
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+#ifdef CONFIG_P2P_PS
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		p2p_ps_wk_cmd(adapter, P2P_PS_SCAN_DONE, 0);
+	}
+#endif // CONFIG_P2P_PS
+
+	rtw_os_xmit_schedule(adapter);
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_os_xmit_schedule(adapter->pbuddy_adapter);
+#endif
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_resume_xmit(adapter);
+#endif
+
+#ifdef CONFIG_DRVEXT_MODULE_WSC
+	drvext_surveydone_callback(&adapter->drvextpriv);
+#endif
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+#ifdef CONFIG_INTEL_WIDI
+	if (adapter->mlmepriv.widi_state == INTEL_WIDI_STATE_NONE)
+#endif
+	{
+		struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;		
+		if(pmlmeext->sitesurvey_res.bss_cnt == 0){
+			rtw_hal_sreset_reset(adapter);
+		}
+	}
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_surveydone_event_callback(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+_func_exit_;	
+
+}
+
+void rtw_dummy_event_callback(_adapter *adapter , u8 *pbuf)
+{
+
+}
+
+void rtw_fwdbg_event_callback(_adapter *adapter , u8 *pbuf)
+{
+
+}
+
+static void free_scanqueue(struct	mlme_priv *pmlmepriv)
+{
+	_irqL irqL, irqL0;
+	_queue *free_queue = &pmlmepriv->free_bss_pool;
+	_queue *scan_queue = &pmlmepriv->scanned_queue;
+	_list	*plist, *phead, *ptemp;
+	
+_func_enter_;		
+	
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+free_scanqueue\n"));
+	_enter_critical_bh(&scan_queue->lock, &irqL0);
+	_enter_critical_bh(&free_queue->lock, &irqL);
+
+	phead = get_list_head(scan_queue);
+	plist = get_next(phead);
+
+	while (plist != phead)
+       {
+		ptemp = get_next(plist);
+		rtw_list_delete(plist);
+		rtw_list_insert_tail(plist, &free_queue->queue);
+		plist =ptemp;
+		pmlmepriv->num_of_scanned --;
+        }
+	
+	_exit_critical_bh(&free_queue->lock, &irqL);
+	_exit_critical_bh(&scan_queue->lock, &irqL0);
+	
+_func_exit_;
+}
+	
+/*
+*rtw_free_assoc_resources: the caller has to lock pmlmepriv->lock
+*/
+void rtw_free_assoc_resources(_adapter *adapter, int lock_scanned_queue)
+{
+	_irqL irqL;
+	struct wlan_network* pwlan = NULL;
+     	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
+   	struct	sta_priv *pstapriv = &adapter->stapriv;
+	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
+	
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+#endif //CONFIG_TDLS	
+_func_enter_;			
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+rtw_free_assoc_resources\n"));
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("tgt_network->network.MacAddress="MAC_FMT" ssid=%s\n",
+		MAC_ARG(tgt_network->network.MacAddress), tgt_network->network.Ssid.Ssid));
+
+	if(check_fwstate( pmlmepriv, WIFI_STATION_STATE|WIFI_AP_STATE))
+	{
+		struct sta_info* psta;
+		
+		psta = rtw_get_stainfo(&adapter->stapriv, tgt_network->network.MacAddress);
+
+#ifdef CONFIG_TDLS
+		if(ptdlsinfo->setup_state != TDLS_STATE_NONE)
+		{
+			rtw_tdls_cmd(adapter, myid(&(adapter->eeprompriv)), TDLS_RS_RCR);
+			rtw_reset_tdls_info(adapter);
+			rtw_free_all_stainfo(adapter);
+			_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		}
+		else
+#endif //CONFIG_TDLS
+		{
+			_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+			rtw_free_stainfo(adapter,  psta);
+		}
+
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		
+	}
+
+	if(check_fwstate( pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
+	{
+		struct sta_info* psta;
+	
+		rtw_free_all_stainfo(adapter);
+
+		psta = rtw_get_bcmc_stainfo(adapter);
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+		rtw_free_stainfo(adapter, psta);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+
+		rtw_init_bcmc_stainfo(adapter);	
+	}
+
+	if(lock_scanned_queue)
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	
+	pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
+	if(pwlan)
+	{
+		pwlan->fixed = _FALSE;
+#ifdef CONFIG_P2P
+		if(!rtw_p2p_chk_state(&adapter->wdinfo, P2P_STATE_NONE))
+		{
+			u32 p2p_ielen=0;
+			u8  *p2p_ie;
+			//u16 capability;
+			u8 *pcap = NULL;
+			u32 capability_len=0;
+
+			//DBG_871X("free disconnecting network\n");
+			//rtw_free_network_nolock(pmlmepriv, pwlan);
+
+			if((p2p_ie=rtw_get_p2p_ie(pwlan->network.IEs+_FIXED_IE_LENGTH_, pwlan->network.IELength-_FIXED_IE_LENGTH_, NULL, &p2p_ielen)))
+			{
+				pcap = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, NULL, &capability_len);
+				if(pcap && capability_len==2)
+				{
+					u16 cap = *(u16*)pcap ;
+					*(u16*)pcap = cap&0x00ff;//clear group capability when free this network
+				}
+			}
+
+			rtw_set_scan_deny(adapter, 2000);
+			//rtw_clear_scan_deny(adapter);
+		}
+#endif //CONFIG_P2P
+	}
+	else
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_assoc_resources : pwlan== NULL \n\n"));
+	}
+
+
+	if((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) && (adapter->stapriv.asoc_sta_count== 1))
+		/*||check_fwstate(pmlmepriv, WIFI_STATION_STATE)*/)
+	{
+		rtw_free_network_nolock(pmlmepriv, pwlan);
+	}
+
+	if(lock_scanned_queue)
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	
+	adapter->securitypriv.key_mask = 0;
+
+_func_exit_;
+	
+}
+
+/*
+*rtw_indicate_connect: the caller has to lock pmlmepriv->lock
+*/
+void rtw_indicate_connect(_adapter *padapter)
+{
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_indicate_connect\n"));
+ 
+	pmlmepriv->to_join = _FALSE;
+
+	if(!check_fwstate(&padapter->mlmepriv, _FW_LINKED)) 
+	{
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	rtw_hal_set_hwreg(padapter, HW_VAR_ANTENNA_DIVERSITY_LINK, 0);
+#endif
+	set_fwstate(pmlmepriv, _FW_LINKED);
+
+	rtw_led_control(padapter, LED_CTL_LINK);
+
+#ifdef CONFIG_DRVEXT_MODULE
+	if(padapter->drvextpriv.enable_wpa)
+	{
+		indicate_l2_connect(padapter);
+	}
+	else
+#endif
+	{
+		rtw_os_indicate_connect(padapter);
+	}
+
+	}
+
+	rtw_set_roaming(padapter, 0);
+
+#ifdef CONFIG_INTEL_WIDI
+	if(padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_ROAMING)
+	{
+		_rtw_memset(pmlmepriv->sa_ext, 0x00, L2SDTA_SERVICE_VE_LEN);
+		intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_WK, NULL);
+		DBG_871X("change to widi listen\n");
+	}
+#endif // CONFIG_INTEL_WIDI
+
+	rtw_set_scan_deny(padapter, 3000);
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("-rtw_indicate_connect: fw_state=0x%08x\n", get_fwstate(pmlmepriv)));
+ 
+_func_exit_;
+
+}
+
+
+/*
+*rtw_indicate_disconnect: the caller has to lock pmlmepriv->lock
+*/
+void rtw_indicate_disconnect( _adapter *padapter )
+{
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;	
+
+_func_enter_;	
+	
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_indicate_disconnect\n"));
+
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING|WIFI_UNDER_WPS);
+
+	if(rtw_to_roaming(padapter) > 0)
+		_clr_fwstate_(pmlmepriv, _FW_LINKED);
+
+	if(check_fwstate(&padapter->mlmepriv, _FW_LINKED) 
+		|| (rtw_to_roaming(padapter) <= 0)
+	)
+	{
+		rtw_os_indicate_disconnect(padapter);
+
+		//set ips_deny_time to avoid enter IPS before LPS leave
+		padapter->pwrctrlpriv.ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(3000);
+
+	      _clr_fwstate_(pmlmepriv, _FW_LINKED);
+
+		rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+		rtw_clear_scan_deny(padapter);
+
+	}
+
+#ifdef CONFIG_P2P_PS
+	p2p_ps_wk_cmd(padapter, P2P_PS_DISABLE, 1);
+#endif // CONFIG_P2P_PS
+
+#ifdef CONFIG_LPS
+#ifdef CONFIG_WOWLAN
+	if(padapter->pwrctrlpriv.wowlan_mode==_FALSE)
+#endif //CONFIG_WOWLAN
+	rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_DISCONNECT, 1);
+
+#endif
+
+_func_exit_;	
+}
+
+inline void rtw_indicate_scan_done( _adapter *padapter, bool aborted)
+{
+	rtw_os_indicate_scan_done(padapter, aborted);
+}
+
+void rtw_scan_abort(_adapter *adapter)
+{
+	u32 cnt=0;
+	u32 start;
+	struct mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(adapter->mlmeextpriv);
+
+	start = rtw_get_current_time();
+	pmlmeext->scan_abort = _TRUE;
+	while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)
+		&& rtw_get_passing_time_ms(start) <= 200) {
+
+		if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
+			break;
+
+		DBG_871X(FUNC_NDEV_FMT"fw_state=_FW_UNDER_SURVEY!\n", FUNC_NDEV_ARG(adapter->pnetdev));
+		rtw_msleep_os(20);
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
+		if (!adapter->bDriverStopped && !adapter->bSurpriseRemoved)
+			DBG_871X(FUNC_NDEV_FMT"waiting for scan_abort time out!\n", FUNC_NDEV_ARG(adapter->pnetdev));
+		#ifdef CONFIG_PLATFORM_MSTAR
+		//_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+		set_survey_timer(pmlmeext, 0);
+		_set_timer(&pmlmepriv->scan_to_timer, 50);
+		#endif
+		rtw_indicate_scan_done(adapter, _TRUE);
+	}
+	pmlmeext->scan_abort = _FALSE;
+}
+
+static struct sta_info *rtw_joinbss_update_stainfo(_adapter *padapter, struct wlan_network *pnetwork)
+{
+	int i;
+	struct sta_info *bmc_sta, *psta=NULL;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	struct sta_priv *pstapriv = &padapter->stapriv;	
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	psta = rtw_get_stainfo(pstapriv, pnetwork->network.MacAddress);
+	if(psta==NULL) {
+		psta = rtw_alloc_stainfo(pstapriv, pnetwork->network.MacAddress);
+	}
+
+	if(psta) //update ptarget_sta
+	{
+		DBG_871X("%s\n", __FUNCTION__);
+	
+		psta->aid  = pnetwork->join_res;
+#ifdef CONFIG_CONCURRENT_MODE	
+
+		if(PRIMARY_ADAPTER == padapter->adapter_type)
+			psta->mac_id=0;
+		else
+			psta->mac_id=2;
+#else
+		psta->mac_id=0;
+#endif
+
+		psta->raid = networktype_to_raid(pmlmeext->cur_wireless_mode);
+
+		//security related
+		if(padapter->securitypriv.dot11AuthAlgrthm== dot11AuthAlgrthm_8021X)
+		{						
+			padapter->securitypriv.binstallGrpkey=_FALSE;
+			padapter->securitypriv.busetkipkey=_FALSE;						
+			padapter->securitypriv.bgrpkey_handshake=_FALSE;
+
+			psta->ieee8021x_blocked=_TRUE;
+			psta->dot118021XPrivacy=padapter->securitypriv.dot11PrivacyAlgrthm;
+						
+			_rtw_memset((u8 *)&psta->dot118021x_UncstKey, 0, sizeof (union Keytype));
+						
+			_rtw_memset((u8 *)&psta->dot11tkiprxmickey, 0, sizeof (union Keytype));
+			_rtw_memset((u8 *)&psta->dot11tkiptxmickey, 0, sizeof (union Keytype));
+						
+			_rtw_memset((u8 *)&psta->dot11txpn, 0, sizeof (union pn48));
+#ifdef CONFIG_IEEE80211W
+			_rtw_memset((u8 *)&psta->dot11wtxpn, 0, sizeof (union pn48));
+#endif //CONFIG_IEEE80211W
+			_rtw_memset((u8 *)&psta->dot11rxpn, 0, sizeof (union pn48));	
+		}
+
+		//	Commented by Albert 2012/07/21
+		//	When doing the WPS, the wps_ie_len won't equal to 0
+		//	And the Wi-Fi driver shouldn't allow the data packet to be tramsmitted.
+		if ( padapter->securitypriv.wps_ie_len != 0 )
+		{
+			psta->ieee8021x_blocked=_TRUE;
+			padapter->securitypriv.wps_ie_len = 0;
+		}
+
+
+		//for A-MPDU Rx reordering buffer control for bmc_sta & sta_info
+		//if A-MPDU Rx is enabled, reseting  rx_ordering_ctrl wstart_b(indicate_seq) to default value=0xffff
+		//todo: check if AP can send A-MPDU packets
+		for(i=0; i < 16 ; i++)
+		{
+			//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+			preorder_ctrl->enable = _FALSE;
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+		}
+
+		
+		bmc_sta = rtw_get_bcmc_stainfo(padapter);
+		if(bmc_sta)
+		{
+			for(i=0; i < 16 ; i++)
+			{
+				//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+				preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
+				preorder_ctrl->enable = _FALSE;
+				preorder_ctrl->indicate_seq = 0xffff;
+				#ifdef DBG_RX_SEQ
+				DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+					preorder_ctrl->indicate_seq);
+				#endif
+				preorder_ctrl->wend_b= 0xffff;
+				preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+			}
+		}
+
+	
+		//misc.
+		update_sta_info(padapter, psta);
+		
+	}
+					
+	return psta;
+	
+}
+
+//pnetwork : returns from rtw_joinbss_event_callback
+//ptarget_wlan: found from scanned_queue
+static void rtw_joinbss_update_network(_adapter *padapter, struct wlan_network *ptarget_wlan, struct wlan_network  *pnetwork)
+{
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);	
+	struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
+
+	DBG_871X("%s\n", __FUNCTION__);
+	
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\nfw_state:%x, BSSID:"MAC_FMT"\n"
+		,get_fwstate(pmlmepriv), MAC_ARG(pnetwork->network.MacAddress)));
+
+				
+	// why not use ptarget_wlan??
+	_rtw_memcpy(&cur_network->network, &pnetwork->network, pnetwork->network.Length);
+
+	cur_network->aid = pnetwork->join_res;
+
+				
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&padapter->recvpriv);
+#endif
+	padapter->recvpriv.signal_strength = ptarget_wlan->network.PhyInfo.SignalStrength;
+	padapter->recvpriv.signal_qual = ptarget_wlan->network.PhyInfo.SignalQuality;
+	//the ptarget_wlan->network.Rssi is raw data, we use ptarget_wlan->network.PhyInfo.SignalStrength instead (has scaled)
+	padapter->recvpriv.rssi = translate_percentage_to_dbm(ptarget_wlan->network.PhyInfo.SignalStrength);
+	#if defined(DBG_RX_SIGNAL_DISPLAY_PROCESSING) && 1
+		DBG_871X(FUNC_ADPT_FMT" signal_strength:%3u, rssi:%3d, signal_qual:%3u"
+			"\n"
+			, FUNC_ADPT_ARG(padapter)
+			, padapter->recvpriv.signal_strength
+			, padapter->recvpriv.rssi
+			, padapter->recvpriv.signal_qual
+	);
+	#endif
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&padapter->recvpriv);
+#endif
+				
+	//update fw_state //will clr _FW_UNDER_LINKING here indirectly
+	switch(pnetwork->network.InfrastructureMode)
+	{	
+		case Ndis802_11Infrastructure:						
+			
+				if(pmlmepriv->fw_state&WIFI_UNDER_WPS)
+					pmlmepriv->fw_state = WIFI_STATION_STATE|WIFI_UNDER_WPS;
+				else
+					pmlmepriv->fw_state = WIFI_STATION_STATE;
+				
+				break;
+		case Ndis802_11IBSS:		
+				pmlmepriv->fw_state = WIFI_ADHOC_STATE;
+				break;
+		default:
+				pmlmepriv->fw_state = WIFI_NULL_STATE;
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Invalid network_mode\n"));
+				break;
+	}
+
+	rtw_update_protection(padapter, (cur_network->network.IEs) + sizeof (NDIS_802_11_FIXED_IEs), 
+									(cur_network->network.IELength));
+			
+#ifdef CONFIG_80211N_HT			
+	rtw_update_ht_cap(padapter, cur_network->network.IEs, cur_network->network.IELength, (u8) cur_network->network.Configuration.DSConfig);
+#endif
+
+
+}
+
+//Notes: the fucntion could be > passive_level (the same context as Rx tasklet)
+//pnetwork : returns from rtw_joinbss_event_callback
+//ptarget_wlan: found from scanned_queue
+//if join_res > 0, for (fw_state==WIFI_STATION_STATE), we check if  "ptarget_sta" & "ptarget_wlan" exist.	
+//if join_res > 0, for (fw_state==WIFI_ADHOC_STATE), we only check if "ptarget_wlan" exist.
+//if join_res > 0, update "cur_network->network" from "pnetwork->network" if (ptarget_wlan !=NULL).
+//
+//#define REJOIN
+void rtw_joinbss_event_prehandle(_adapter *adapter, u8 *pbuf)
+{
+	_irqL irqL,irqL2;
+	static u8 retry=0;
+	u8 timer_cancelled;
+	struct sta_info *ptarget_sta= NULL, *pcur_sta = NULL;
+   	struct	sta_priv *pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	struct wlan_network 	*pnetwork	= (struct wlan_network *)pbuf;
+	struct wlan_network 	*cur_network = &(pmlmepriv->cur_network);
+	struct wlan_network	*pcur_wlan = NULL, *ptarget_wlan = NULL;
+	unsigned int 		the_same_macaddr = _FALSE;	
+
+_func_enter_;	
+
+#ifdef CONFIG_RTL8712
+       //endian_convert
+	pnetwork->join_res = le32_to_cpu(pnetwork->join_res);
+	pnetwork->network_type = le32_to_cpu(pnetwork->network_type);
+	pnetwork->network.Length = le32_to_cpu(pnetwork->network.Length);
+	pnetwork->network.Ssid.SsidLength = le32_to_cpu(pnetwork->network.Ssid.SsidLength);
+	pnetwork->network.Privacy =le32_to_cpu( pnetwork->network.Privacy);
+	pnetwork->network.Rssi = le32_to_cpu(pnetwork->network.Rssi);
+	pnetwork->network.NetworkTypeInUse =le32_to_cpu(pnetwork->network.NetworkTypeInUse) ;	
+	pnetwork->network.Configuration.ATIMWindow = le32_to_cpu(pnetwork->network.Configuration.ATIMWindow);
+	pnetwork->network.Configuration.BeaconPeriod = le32_to_cpu(pnetwork->network.Configuration.BeaconPeriod);
+	pnetwork->network.Configuration.DSConfig = le32_to_cpu(pnetwork->network.Configuration.DSConfig);
+	pnetwork->network.Configuration.FHConfig.DwellTime=le32_to_cpu(pnetwork->network.Configuration.FHConfig.DwellTime);
+	pnetwork->network.Configuration.FHConfig.HopPattern=le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopPattern);
+	pnetwork->network.Configuration.FHConfig.HopSet=le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopSet);
+	pnetwork->network.Configuration.FHConfig.Length=le32_to_cpu(pnetwork->network.Configuration.FHConfig.Length);	
+	pnetwork->network.Configuration.Length = le32_to_cpu(pnetwork->network.Configuration.Length);
+	pnetwork->network.InfrastructureMode = le32_to_cpu(pnetwork->network.InfrastructureMode);
+	pnetwork->network.IELength = le32_to_cpu(pnetwork->network.IELength );
+#endif
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("joinbss event call back received with res=%d\n", pnetwork->join_res));
+
+	rtw_get_encrypt_decrypt_from_registrypriv(adapter);
+	
+
+	if (pmlmepriv->assoc_ssid.SsidLength == 0)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("@@@@@   joinbss event call back  for Any SSid\n"));		
+	}
+	else
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("@@@@@   rtw_joinbss_event_callback for SSid:%s\n", pmlmepriv->assoc_ssid.Ssid));
+	}
+	
+	the_same_macaddr = _rtw_memcmp(pnetwork->network.MacAddress, cur_network->network.MacAddress, ETH_ALEN);
+
+	pnetwork->network.Length = get_WLAN_BSSID_EX_sz(&pnetwork->network);
+	if(pnetwork->network.Length > sizeof(WLAN_BSSID_EX))
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n\n ***joinbss_evt_callback return a wrong bss ***\n\n"));
+		goto ignore_joinbss_callback;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n rtw_joinbss_event_callback !! _enter_critical \n"));
+
+	if(pnetwork->join_res > 0)
+	{
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		retry = 0;
+		if (check_fwstate(pmlmepriv,_FW_UNDER_LINKING) )
+		{
+			//s1. find ptarget_wlan
+			if(check_fwstate(pmlmepriv, _FW_LINKED) )
+			{
+				if(the_same_macaddr == _TRUE)
+				{
+					ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);					
+				}
+				else
+				{
+					pcur_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
+					if(pcur_wlan)	pcur_wlan->fixed = _FALSE;
+
+					pcur_sta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
+					if(pcur_sta){
+						_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+						rtw_free_stainfo(adapter,  pcur_sta);
+						_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+					}
+
+					ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, pnetwork->network.MacAddress);
+					if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE){
+						if(ptarget_wlan)	ptarget_wlan->fixed = _TRUE;			
+					}
+				}
+
+			}
+			else
+			{
+				ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, pnetwork->network.MacAddress);
+				if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE){
+					if(ptarget_wlan)	ptarget_wlan->fixed = _TRUE;			
+				}
+			}
+		
+			//s2. update cur_network 
+			if(ptarget_wlan)
+			{			
+				rtw_joinbss_update_network(adapter, ptarget_wlan, pnetwork);
+			}
+			else
+			{
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Can't find ptarget_wlan when joinbss_event callback\n"));
+				_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+				goto ignore_joinbss_callback;
+			}
+			
+			
+			//s3. find ptarget_sta & update ptarget_sta after update cur_network only for station mode 
+			if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+			{
+				ptarget_sta = rtw_joinbss_update_stainfo(adapter, pnetwork);
+				if(ptarget_sta==NULL)
+				{
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Can't update stainfo when joinbss_event callback\n"));
+					_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+					goto ignore_joinbss_callback;
+				}
+			}	
+					
+			//s4. indicate connect			
+			if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+			{
+				rtw_indicate_connect(adapter);
+			}
+			else
+			{
+				//adhoc mode will rtw_indicate_connect when rtw_stassoc_event_callback
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("adhoc mode, fw_state:%x", get_fwstate(pmlmepriv)));
+			}
+
+
+			//s5. Cancle assoc_timer					
+			_cancel_timer(&pmlmepriv->assoc_timer, &timer_cancelled);
+			
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("Cancle assoc_timer\n"));
+				
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_joinbss_event_callback err: fw_state:%x", get_fwstate(pmlmepriv)));	
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			goto ignore_joinbss_callback;
+		}
+		
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+				
+	}
+	else if(pnetwork->join_res == -4) 
+	{
+		rtw_reset_securitypriv(adapter);
+		_set_timer(&pmlmepriv->assoc_timer, 1);					
+
+		//rtw_free_assoc_resources(adapter, 1);
+
+		if((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == _TRUE)
+		{		
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("fail! clear _FW_UNDER_LINKING ^^^fw_state=%x\n", get_fwstate(pmlmepriv)));
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+		}	
+		
+	}
+	else //if join_res < 0 (join fails), then try again
+	{
+	
+		#ifdef REJOIN
+		res = _FAIL;
+		if(retry < 2) {
+			res = rtw_select_and_join_from_scanned_queue(pmlmepriv);
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_select_and_join_from_scanned_queue again! res:%d\n",res));
+		}
+
+		 if(res == _SUCCESS)
+		{
+			//extend time of assoc_timer
+			_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
+			retry++;
+		}
+		else if(res == 2)//there is no need to wait for join
+		{
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			rtw_indicate_connect(adapter);
+		}	
+		else
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Set Assoc_Timer = 1; can't find match ssid in scanned_q \n"));
+		#endif
+			
+			_set_timer(&pmlmepriv->assoc_timer, 1);
+			//rtw_free_assoc_resources(adapter, 1);
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			
+		#ifdef REJOIN
+			retry = 0;	
+		}
+		#endif
+	}
+
+ignore_joinbss_callback:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	_func_exit_;	
+}
+
+void rtw_joinbss_event_callback(_adapter *adapter, u8 *pbuf)
+{
+	struct wlan_network 	*pnetwork	= (struct wlan_network *)pbuf;
+
+_func_enter_;
+
+	mlmeext_joinbss_event_callback(adapter, pnetwork->join_res);
+
+	rtw_os_xmit_schedule(adapter);
+
+#ifdef CONFIG_CONCURRENT_MODE	
+	rtw_os_xmit_schedule(adapter->pbuddy_adapter);
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_resume_xmit(adapter);
+#endif
+
+_func_exit_;
+}
+
+void rtw_stassoc_event_callback(_adapter *adapter, u8 *pbuf)
+{
+	_irqL irqL;	
+	struct sta_info *psta;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+	struct stassoc_event	*pstassoc	= (struct stassoc_event*)pbuf;
+	struct wlan_network 	*cur_network = &(pmlmepriv->cur_network);
+	struct wlan_network	*ptarget_wlan = NULL;
+
+_func_enter_;	
+	
+	if(rtw_access_ctrl(adapter, pstassoc->macaddr) == _FALSE)
+		return;
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+	{
+		psta = rtw_get_stainfo(&adapter->stapriv, pstassoc->macaddr);	
+		if(psta)
+		{
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef COMPAT_KERNEL_RELEASE
+
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+			u8 *passoc_req = NULL;
+			u32 assoc_req_len;
+
+			_enter_critical_bh(&psta->lock, &irqL);
+			if(psta->passoc_req && psta->assoc_req_len>0)
+			{				
+				passoc_req = rtw_zmalloc(psta->assoc_req_len);
+				if(passoc_req)
+				{
+					assoc_req_len = psta->assoc_req_len;
+					_rtw_memcpy(passoc_req, psta->passoc_req, assoc_req_len);
+					
+					rtw_mfree(psta->passoc_req , psta->assoc_req_len);
+					psta->passoc_req = NULL;
+					psta->assoc_req_len = 0;
+				}
+			}			
+			_exit_critical_bh(&psta->lock, &irqL);
+
+			if(passoc_req && assoc_req_len>0)
+			{
+				rtw_cfg80211_indicate_sta_assoc(adapter, passoc_req, assoc_req_len);
+
+				rtw_mfree(passoc_req, assoc_req_len);
+			}
+#endif //(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+#endif //CONFIG_IOCTL_CFG80211	
+
+			//bss_cap_update_on_sta_join(adapter, psta);
+			//sta_info_update(adapter, psta);
+			ap_sta_info_defer_update(adapter, psta);
+		}	
+		
+		goto exit;
+	}	
+#endif	
+
+	psta = rtw_get_stainfo(&adapter->stapriv, pstassoc->macaddr);	
+	if( psta != NULL)
+	{
+		//the sta have been in sta_info_queue => do nothing 
+		
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Error: rtw_stassoc_event_callback: sta has been in sta_hash_queue \n"));
+		
+		goto exit; //(between drv has received this event before and  fw have not yet to set key to CAM_ENTRY)
+	}
+
+	psta = rtw_alloc_stainfo(&adapter->stapriv, pstassoc->macaddr);	
+	if (psta == NULL) {
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Can't alloc sta_info when rtw_stassoc_event_callback\n"));
+		goto exit;
+	}	
+	
+	//to do : init sta_info variable
+	psta->qos_option = 0;
+	psta->mac_id = (uint)pstassoc->cam_id;
+	//psta->aid = (uint)pstassoc->cam_id;
+	
+	if(adapter->securitypriv.dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)
+		psta->dot118021XPrivacy = adapter->securitypriv.dot11PrivacyAlgrthm;
+
+	psta->ieee8021x_blocked = _FALSE;		
+	
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if ( (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)==_TRUE ) || 
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE ) )
+	{
+		if(adapter->stapriv.asoc_sta_count== 2)
+		{
+			_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
+			if(ptarget_wlan)	ptarget_wlan->fixed = _TRUE;
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			// a sta + bc/mc_stainfo (not Ibss_stainfo)
+			rtw_indicate_connect(adapter);
+		}
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	mlmeext_sta_add_event_callback(adapter, psta);
+	
+#ifdef CONFIG_RTL8711
+	//submit SetStaKey_cmd to tell fw, fw will allocate an CAM entry for this sta	
+	rtw_setstakey_cmd(adapter, (unsigned char*)psta, _FALSE);
+#endif
+		
+exit:
+	
+_func_exit_;	
+
+}
+
+void rtw_stadel_event_callback(_adapter *adapter, u8 *pbuf)
+{
+	_irqL irqL,irqL2;	
+	struct sta_info *psta;
+	struct wlan_network* pwlan = NULL;
+	WLAN_BSSID_EX    *pdev_network=NULL;
+	u8* pibss = NULL;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	struct 	stadel_event *pstadel	= (struct stadel_event*)pbuf;
+   	struct	sta_priv *pstapriv = &adapter->stapriv;
+	struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
+	
+_func_enter_;	
+
+        if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+        {
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef COMPAT_KERNEL_RELEASE
+
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		rtw_cfg80211_indicate_sta_disassoc(adapter, pstadel->macaddr, *(u16*)pstadel->rsvd);
+#endif //(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+#endif //CONFIG_IOCTL_CFG80211
+
+		return;
+        }
+
+
+	mlmeext_sta_del_event_callback(adapter);
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL2);
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) )
+	{
+		#ifdef CONFIG_LAYER2_ROAMING
+		if (rtw_to_roaming(adapter) > 0)
+			pmlmepriv->to_roaming--; /* this stadel_event is caused by roaming, decrease to_roaming */
+		else if (rtw_to_roaming(adapter) == 0)
+			rtw_set_roaming(adapter, adapter->registrypriv.max_roaming_times);
+#ifdef CONFIG_INTEL_WIDI
+		if(adapter->mlmepriv.widi_state != INTEL_WIDI_STATE_CONNECTED)
+#endif // CONFIG_INTEL_WIDI
+		if(*((unsigned short *)(pstadel->rsvd)) != WLAN_REASON_EXPIRATION_CHK)
+			rtw_set_roaming(adapter, 0); /* don't roam */
+		#endif
+
+		rtw_free_uc_swdec_pending_queue(adapter);
+
+		rtw_free_assoc_resources(adapter, 1);
+		rtw_indicate_disconnect(adapter);
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		// remove the network entry in scanned_queue
+		pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);	
+		if (pwlan) {			
+			pwlan->fixed = _FALSE;
+			rtw_free_network_nolock(pmlmepriv, pwlan);
+		}
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+		_rtw_roaming(adapter, tgt_network);
+		
+#ifdef CONFIG_INTEL_WIDI
+		if (!rtw_to_roaming(adapter))
+			process_intel_widi_disconnect(adapter, 1);
+#endif // CONFIG_INTEL_WIDI
+	}
+
+	if ( check_fwstate(pmlmepriv,WIFI_ADHOC_MASTER_STATE) || 
+	      check_fwstate(pmlmepriv,WIFI_ADHOC_STATE))
+	{
+		psta = rtw_get_stainfo(&adapter->stapriv, pstadel->macaddr);
+		
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		rtw_free_stainfo(adapter,  psta);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		
+		if(adapter->stapriv.asoc_sta_count== 1) //a sta + bc/mc_stainfo (not Ibss_stainfo)
+		{ 
+			//rtw_indicate_disconnect(adapter);//removed@20091105
+			_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			//free old ibss network
+			//pwlan = rtw_find_network(&pmlmepriv->scanned_queue, pstadel->macaddr);
+			pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
+			if(pwlan)	
+			{
+				pwlan->fixed = _FALSE;
+				rtw_free_network_nolock(pmlmepriv, pwlan); 
+			}
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			//re-create ibss
+			pdev_network = &(adapter->registrypriv.dev_network);			
+			pibss = adapter->registrypriv.dev_network.MacAddress;
+
+			_rtw_memcpy(pdev_network, &tgt_network->network, get_WLAN_BSSID_EX_sz(&tgt_network->network));
+			
+			_rtw_memset(&pdev_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+			_rtw_memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(NDIS_802_11_SSID));
+	
+			rtw_update_registrypriv_dev_network(adapter);			
+
+			rtw_generate_random_ibss(pibss);
+			
+			if(check_fwstate(pmlmepriv,WIFI_ADHOC_STATE))
+			{
+				set_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_STATE);
+			}
+
+			if(rtw_createbss_cmd(adapter)!=_SUCCESS)
+			{
+
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("***Error=>stadel_event_callback: rtw_createbss_cmd status FAIL*** \n "));										
+
+			}
+
+			
+		}
+		
+	}
+	
+	_exit_critical_bh(&pmlmepriv->lock, &irqL2);
+	
+_func_exit_;	
+
+}
+
+
+void rtw_cpwm_event_callback(PADAPTER padapter, u8 *pbuf)
+{
+#ifdef CONFIG_LPS_LCLK
+	struct reportpwrstate_parm *preportpwrstate;
+#endif
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_cpwm_event_callback !!!\n"));
+#ifdef CONFIG_LPS_LCLK
+	preportpwrstate = (struct reportpwrstate_parm*)pbuf;
+	preportpwrstate->state |= (u8)(padapter->pwrctrlpriv.cpwm_tog + 0x80);
+	cpwm_int_hdl(padapter, preportpwrstate);
+#endif
+
+_func_exit_;
+
+}
+
+/*
+* _rtw_join_timeout_handler - Timeout/faliure handler for CMD JoinBss
+* @adapter: pointer to _adapter structure
+*/
+void _rtw_join_timeout_handler (_adapter *adapter)
+{
+	_irqL irqL;
+	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
+#ifdef CONFIG_LAYER2_ROAMING
+	int do_join_r;
+#endif //CONFIG_LAYER2_ROAMING
+
+#if 0
+	if (adapter->bDriverStopped == _TRUE){
+		_rtw_up_sema(&pmlmepriv->assoc_terminate);
+		return;
+	}
+#endif	
+
+_func_enter_;		
+#ifdef PLATFORM_FREEBSD
+		rtw_mtx_lock(NULL);
+		 if (callout_pending(&adapter->mlmepriv.assoc_timer.callout)) {
+			 /* callout was reset */
+			 //mtx_unlock(&sc->sc_mtx);
+			 rtw_mtx_unlock(NULL);
+			 return;
+		 }
+		 if (!callout_active(&adapter->mlmepriv.assoc_timer.callout)) {
+			 /* callout was stopped */
+			 //mtx_unlock(&sc->sc_mtx);
+			 rtw_mtx_unlock(NULL);
+			 return;
+		 }
+		 callout_deactivate(&adapter->mlmepriv.assoc_timer.callout);
+	
+	
+#endif
+
+	DBG_871X("%s, fw_state=%x\n", __FUNCTION__, get_fwstate(pmlmepriv));
+	
+	if(adapter->bDriverStopped ||adapter->bSurpriseRemoved)
+		return;
+
+	
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	#ifdef CONFIG_LAYER2_ROAMING
+	if (rtw_to_roaming(adapter) > 0) { /* join timeout caused by roaming */
+		while(1) {
+			pmlmepriv->to_roaming--;
+			if (rtw_to_roaming(adapter) != 0) { /* try another */
+				DBG_871X("%s try another roaming\n", __FUNCTION__);
+				if( _SUCCESS!=(do_join_r=rtw_do_join(adapter)) ) {
+					DBG_871X("%s roaming do_join return %d\n", __FUNCTION__ ,do_join_r);
+					continue;
+				}
+				break;
+			} else {
+#ifdef CONFIG_INTEL_WIDI
+				if(adapter->mlmepriv.widi_state == INTEL_WIDI_STATE_ROAMING)
+				{
+					_rtw_memset(pmlmepriv->sa_ext, 0x00, L2SDTA_SERVICE_VE_LEN);
+					intel_widi_wk_cmd(adapter, INTEL_WIDI_LISTEN_WK, NULL);
+					DBG_871X("change to widi listen\n");
+				}
+#endif // CONFIG_INTEL_WIDI
+				DBG_871X("%s We've try roaming but fail\n", __FUNCTION__);
+				rtw_indicate_disconnect(adapter);
+				break;
+			}
+		}
+		
+	} else 
+	#endif
+	{
+		rtw_indicate_disconnect(adapter);
+		free_scanqueue(pmlmepriv);//???
+
+#ifdef CONFIG_IOCTL_CFG80211
+		//indicate disconnect for the case that join_timeout and check_fwstate != FW_LINKED
+		rtw_cfg80211_indicate_disconnect(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+ 	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	
+
+#ifdef CONFIG_DRVEXT_MODULE_WSC	
+	drvext_assoc_fail_indicate(&adapter->drvextpriv);	
+#endif	
+#ifdef PLATFORM_FREEBSD
+		rtw_mtx_unlock(NULL);
+#endif
+	
+_func_exit_;
+
+}
+
+/*
+* rtw_scan_timeout_handler - Timeout/Faliure handler for CMD SiteSurvey
+* @adapter: pointer to _adapter structure
+*/
+void rtw_scan_timeout_handler (_adapter *adapter)
+{	
+	_irqL irqL;
+	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	
+	DBG_871X(FUNC_ADPT_FMT" fw_state=%x\n", FUNC_ADPT_ARG(adapter), get_fwstate(pmlmepriv));
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	rtw_indicate_scan_done(adapter, _TRUE);
+
+}
+
+static void rtw_auto_scan_handler(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	//auto site survey per 60sec
+	if(pmlmepriv->scan_interval >0)
+	{
+		pmlmepriv->scan_interval--;
+		if(pmlmepriv->scan_interval==0)
+		{
+/*		
+			if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE) 
+			{
+				DBG_871X("exit %s when _FW_UNDER_SURVEY|_FW_UNDER_LINKING -> \n", __FUNCTION__);
+				return;
+			}
+			
+			if(pmlmepriv->sitesurveyctrl.traffic_busy == _TRUE)
+			{
+				DBG_871X("%s exit cause traffic_busy(%x)\n",__FUNCTION__, pmlmepriv->sitesurveyctrl.traffic_busy);
+				return;
+			}
+*/
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if (rtw_buddy_adapter_up(padapter))
+			{
+				if ((check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE) ||
+					(padapter->pbuddy_adapter->mlmepriv.LinkDetectInfo.bBusyTraffic == _TRUE))
+				{		
+					DBG_871X("%s, but buddy_intf is under scanning or linking or BusyTraffic\n", __FUNCTION__);
+					return;
+				}
+			}
+#endif
+
+			DBG_871X("%s\n", __FUNCTION__);
+
+			rtw_set_802_11_bssid_list_scan(padapter, NULL, 0);			
+			
+			pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+			
+		}
+		
+	}
+
+}
+
+void rtw_dynamic_check_timer_handlder(_adapter *adapter)
+{
+#ifdef CONFIG_AP_MODE
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+#endif //CONFIG_AP_MODE
+	struct registry_priv *pregistrypriv = &adapter->registrypriv;
+#ifdef CONFIG_CONCURRENT_MODE	
+	PADAPTER pbuddy_adapter = adapter->pbuddy_adapter;	
+#endif
+
+	if(!adapter)
+		return;	
+
+	if(adapter->hw_init_completed == _FALSE)
+		return;
+
+	if ((adapter->bDriverStopped == _TRUE)||(adapter->bSurpriseRemoved== _TRUE))
+		return;
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pbuddy_adapter)
+	{
+		if(adapter->net_closed == _TRUE && pbuddy_adapter->net_closed == _TRUE)
+		{
+			return;
+		}		
+	}
+	else
+#endif //CONFIG_CONCURRENT_MODE
+	if(adapter->net_closed == _TRUE)
+	{
+		return;
+	}	
+
+	rtw_dynamic_chk_wk_cmd(adapter);
+
+	if(pregistrypriv->wifi_spec==1)
+	{	
+#ifdef CONFIG_P2P
+		struct wifidirect_info *pwdinfo = &adapter->wdinfo;
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+#endif	
+		{
+			//auto site survey
+			rtw_auto_scan_handler(adapter);
+		}	
+	}
+
+#ifndef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		expire_timeout_chk(adapter);
+	}	
+#endif
+#endif //!CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+
+#ifdef CONFIG_BR_EXT
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35)) 
+	if( adapter->pnetdev->br_port 
+#else	// (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	if( rcu_dereference(adapter->pnetdev->rx_handler_data)
+#endif	// (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		&& (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE) )
+	{
+		// expire NAT2.5 entry
+		void nat25_db_expire(_adapter *priv);
+		nat25_db_expire(adapter);
+
+		if (adapter->pppoe_connection_in_progress > 0) {
+			adapter->pppoe_connection_in_progress--;
+		}
+		
+		// due to rtw_dynamic_check_timer_handlder() is called every 2 seconds
+		if (adapter->pppoe_connection_in_progress > 0) {
+			adapter->pppoe_connection_in_progress--;
+		}
+	}
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_unlock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+
+#endif	// CONFIG_BR_EXT
+	
+}
+
+
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+inline bool rtw_is_scan_deny(_adapter *adapter)
+{
+	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+	return (ATOMIC_READ(&mlmepriv->set_scan_deny) != 0) ? _TRUE : _FALSE;
+}
+
+inline void rtw_clear_scan_deny(_adapter *adapter)
+{
+	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+	ATOMIC_SET(&mlmepriv->set_scan_deny, 0);
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter));
+}
+
+void rtw_set_scan_deny_timer_hdl(_adapter *adapter)
+{
+	rtw_clear_scan_deny(adapter);
+}
+
+void rtw_set_scan_deny(_adapter *adapter, u32 ms)
+{
+	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+#ifdef CONFIG_CONCURRENT_MODE
+	struct mlme_priv *b_mlmepriv;
+#endif
+
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter));
+	ATOMIC_SET(&mlmepriv->set_scan_deny, 1);
+	_set_timer(&mlmepriv->set_scan_deny_timer, ms);
+	
+#ifdef CONFIG_CONCURRENT_MODE
+	if (!adapter->pbuddy_adapter)
+		return;
+
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter->pbuddy_adapter));
+ 	b_mlmepriv = &adapter->pbuddy_adapter->mlmepriv;
+	ATOMIC_SET(&b_mlmepriv->set_scan_deny, 1);
+	_set_timer(&b_mlmepriv->set_scan_deny_timer, ms);	
+#endif
+	
+}
+#endif
+
+#if defined(IEEE80211_SCAN_RESULT_EXPIRE)
+#define RTW_SCAN_RESULT_EXPIRE IEEE80211_SCAN_RESULT_EXPIRE/HZ*1000 -1000 //3000 -1000
+#else
+#define RTW_SCAN_RESULT_EXPIRE 2000
+#endif
+
+#ifndef PLATFORM_FREEBSD
+/*
+* Select a new join candidate from the original @param candidate and @param competitor
+* @return _TRUE: candidate is updated
+* @return _FALSE: candidate is not updated
+*/
+static int rtw_check_join_candidate(struct mlme_priv *pmlmepriv
+	, struct wlan_network **candidate, struct wlan_network *competitor)
+{
+	int updated = _FALSE;
+	_adapter *adapter = container_of(pmlmepriv, _adapter, mlmepriv);
+
+
+	//check bssid, if needed
+	if(pmlmepriv->assoc_by_bssid==_TRUE) {
+		if(_rtw_memcmp(competitor->network.MacAddress, pmlmepriv->assoc_bssid, ETH_ALEN) ==_FALSE)
+			goto exit;
+	}
+
+	//check ssid, if needed
+	if(pmlmepriv->assoc_ssid.Ssid && pmlmepriv->assoc_ssid.SsidLength) {
+		if(	competitor->network.Ssid.SsidLength != pmlmepriv->assoc_ssid.SsidLength
+			|| _rtw_memcmp(competitor->network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength) == _FALSE
+		)
+			goto exit;
+	}
+
+	if(rtw_is_desired_network(adapter, competitor)  == _FALSE)
+		goto exit;
+
+#ifdef  CONFIG_LAYER2_ROAMING
+	if(rtw_to_roaming(adapter) > 0) {
+		if(	rtw_get_passing_time_ms((u32)competitor->last_scanned) >= RTW_SCAN_RESULT_EXPIRE
+			|| is_same_ess(&competitor->network, &pmlmepriv->cur_network.network) == _FALSE
+		)
+			goto exit;
+	}
+#endif
+	
+	if(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+	{
+		*candidate = competitor;
+		updated = _TRUE;
+	}
+
+#if 0
+	if(pmlmepriv->assoc_by_bssid==_TRUE) { // associate with bssid
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+			&& _rtw_memcmp(competitor->network.MacAddress, pmlmepriv->assoc_bssid, ETH_ALEN)==_TRUE
+		) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+	} else  if (pmlmepriv->assoc_ssid.SsidLength == 0 ) { // associate with ssid, but ssidlength is 0
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi ) ) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+	} else
+#ifdef  CONFIG_LAYER2_ROAMING
+	if(rtw_to_roaming(adapter)) { // roaming
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+			&& is_same_ess(&competitor->network, &pmlmepriv->cur_network.network) 
+			//&&(!is_same_network(&competitor->network, &pmlmepriv->cur_network.network))
+			&& rtw_get_passing_time_ms((u32)competitor->last_scanned) < RTW_SCAN_RESULT_EXPIRE
+			&& rtw_is_desired_network(adapter, competitor)
+		) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+		
+	} else
+#endif
+	{ // associate with ssid
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+			&& (competitor->network.Ssid.SsidLength==pmlmepriv->assoc_ssid.SsidLength)
+			&&((_rtw_memcmp(competitor->network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength)) == _TRUE)
+			&& rtw_is_desired_network(adapter, competitor)
+		) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+	}
+#endif
+
+	if(updated){
+		DBG_871X("[by_bssid:%u][assoc_ssid:%s]"
+			#ifdef  CONFIG_LAYER2_ROAMING
+			"[to_roaming:%u] "
+			#endif
+			"new candidate: %s("MAC_FMT", ch%u) rssi:%d\n",
+			pmlmepriv->assoc_by_bssid,
+			pmlmepriv->assoc_ssid.Ssid,
+			#ifdef  CONFIG_LAYER2_ROAMING
+			rtw_to_roaming(adapter),
+			#endif
+			(*candidate)->network.Ssid.Ssid,
+			MAC_ARG((*candidate)->network.MacAddress),
+			(*candidate)->network.Configuration.DSConfig,
+			(int)(*candidate)->network.Rssi
+		);
+	}
+
+exit:
+	return updated;
+}
+
+/*
+Calling context:
+The caller of the sub-routine will be in critical section...
+
+The caller must hold the following spinlock
+
+pmlmepriv->lock
+
+
+*/
+
+int rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv )
+{
+	_irqL	irqL;
+	int ret;
+	_list	*phead;
+	_adapter *adapter;	
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	struct	wlan_network	*candidate = NULL;
+	u8 		bSupportAntDiv = _FALSE;
+
+_func_enter_;
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	phead = get_list_head(queue);		
+	adapter = (_adapter *)pmlmepriv->nic_hdl;
+
+	pmlmepriv->pscanned = get_next( phead );
+
+	while (!rtw_end_of_queue_search(phead, pmlmepriv->pscanned)) {
+
+		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+		if(pnetwork==NULL){
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s return _FAIL:(pnetwork==NULL)\n", __FUNCTION__));
+			ret = _FAIL;
+			goto exit;
+		}
+		
+		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+		#if 0
+		DBG_871X("MacAddress:"MAC_FMT" ssid:%s\n", MAC_ARG(pnetwork->network.MacAddress), pnetwork->network.Ssid.Ssid);
+		#endif
+
+		rtw_check_join_candidate(pmlmepriv, &candidate, pnetwork);
+ 
+ 	}
+
+	if(candidate == NULL) {
+		DBG_871X("%s: return _FAIL(candidate == NULL)\n", __FUNCTION__);
+		ret = _FAIL;
+		goto exit;
+	} else {
+		DBG_871X("%s: candidate: %s("MAC_FMT", ch:%u)\n", __FUNCTION__,
+			candidate->network.Ssid.Ssid, MAC_ARG(candidate->network.MacAddress),
+			candidate->network.Configuration.DSConfig);
+	}
+	
+
+	// check for situation of  _FW_LINKED 
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		DBG_871X("%s: _FW_LINKED while ask_for_joinbss!!!\n", __FUNCTION__);
+
+		#if 0 // for WPA/WPA2 authentication, wpa_supplicant will expect authentication from AP, it is needed to reconnect AP...
+		if(is_same_network(&pmlmepriv->cur_network.network, &candidate->network))
+		{
+			DBG_871X("%s: _FW_LINKED and is same network, it needn't join again\n", __FUNCTION__);
+
+			rtw_indicate_connect(adapter);//rtw_indicate_connect again
+				
+			ret = 2;
+			goto exit;
+		}
+		else
+		#endif
+		{
+			rtw_disassoc_cmd(adapter, 0, _TRUE);
+			rtw_indicate_disconnect(adapter);
+			rtw_free_assoc_resources(adapter, 0);
+		}
+	}
+	
+	#ifdef CONFIG_ANTENNA_DIVERSITY
+	rtw_hal_get_def_var(adapter, HAL_DEF_IS_SUPPORT_ANT_DIV, &(bSupportAntDiv));
+	if(_TRUE == bSupportAntDiv)	
+	{
+		u8 CurrentAntenna;
+		rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(CurrentAntenna));			
+		DBG_871X("#### Opt_Ant_(%s) , cur_Ant(%s)\n",
+			(2==candidate->network.PhyInfo.Optimum_antenna)?"A":"B",
+			(2==CurrentAntenna)?"A":"B"
+		);
+	}
+	#endif
+	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+	ret = rtw_joinbss_cmd(adapter, candidate);
+	
+exit:
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+_func_exit_;
+
+	return ret;
+}
+#else
+int rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv )
+{	
+	_irqL	irqL;
+	_list	*phead;
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	u8 CurrentAntenna;
+#endif
+	unsigned char *dst_ssid, *src_ssid;
+	_adapter *adapter;	
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	struct	wlan_network	*pnetwork_max_rssi = NULL;
+	#ifdef CONFIG_LAYER2_ROAMING
+	struct wlan_network * roaming_candidate=NULL;
+	u32 cur_time=rtw_get_current_time();
+	#endif
+
+_func_enter_;
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	phead = get_list_head(queue);		
+	adapter = (_adapter *)pmlmepriv->nic_hdl;
+
+	pmlmepriv->pscanned = get_next( phead );
+
+	while (!rtw_end_of_queue_search(phead, pmlmepriv->pscanned)) {
+
+		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+		if(pnetwork==NULL){
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("(2)rtw_select_and_join_from_scanned_queue return _FAIL:(pnetwork==NULL)\n"));
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			return _FAIL;	
+		}
+
+		dst_ssid = pnetwork->network.Ssid.Ssid;
+		src_ssid = pmlmepriv->assoc_ssid.Ssid;
+		
+		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+		#if 0
+		DBG_871X("MacAddress:"MAC_FMT" ssid:%s\n", MAC_ARG(pnetwork->network.MacAddress), pnetwork->network.Ssid.Ssid);
+		#endif
+
+		if(pmlmepriv->assoc_by_bssid==_TRUE)
+		{
+			if(_rtw_memcmp(pnetwork->network.MacAddress, pmlmepriv->assoc_bssid, ETH_ALEN)==_TRUE)
+			{
+				//remove the condition @ 20081125
+				//if((pmlmepriv->cur_network.network.InfrastructureMode==Ndis802_11AutoUnknown)||
+				//	pmlmepriv->cur_network.network.InfrastructureMode == pnetwork->network.InfrastructureMode)
+				//		goto ask_for_joinbss;
+				
+				if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				{
+					if(is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network))
+					{
+						//DBG_871X("select_and_join(1): _FW_LINKED and is same network, it needn't join again\n");
+
+						rtw_indicate_connect(adapter);//rtw_indicate_connect again
+						_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);	
+						return 2;
+					}
+					else
+					{
+						rtw_disassoc_cmd(adapter, 0, _TRUE);
+						rtw_indicate_disconnect(adapter);
+						rtw_free_assoc_resources(adapter, 0);
+						_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+						goto ask_for_joinbss;
+						
+					}
+				}
+				else
+				{
+					_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+					goto ask_for_joinbss;
+				}
+							
+			}
+			
+		} else if (pmlmepriv->assoc_ssid.SsidLength == 0) {
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			goto ask_for_joinbss;//anyway, join first selected(dequeued) pnetwork if ssid_len=0				
+	
+		#ifdef CONFIG_LAYER2_ROAMING
+		} else if (rtw_to_roaming(adapter) > 0) {
+		
+			if(	(roaming_candidate == NULL ||roaming_candidate->network.Rssi<pnetwork->network.Rssi )
+				&& is_same_ess(&pnetwork->network, &pmlmepriv->cur_network.network) 
+				//&&(!is_same_network(&pnetwork->network, &pmlmepriv->cur_network.network))
+				&&  rtw_get_time_interval_ms((u32)pnetwork->last_scanned,cur_time) < 5000
+				) {
+				roaming_candidate = pnetwork;
+				//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,
+				DBG_871X
+					("roaming_candidate???: %s("MAC_FMT")\n",
+					roaming_candidate->network.Ssid.Ssid, MAC_ARG(roaming_candidate->network.MacAddress) )
+					//)
+					;
+			}
+			continue;
+		#endif
+
+		} else if ( (pnetwork->network.Ssid.SsidLength==pmlmepriv->assoc_ssid.SsidLength)
+			&&((_rtw_memcmp(dst_ssid, src_ssid, pmlmepriv->assoc_ssid.SsidLength)) == _TRUE)
+			)
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("dst_ssid=%s, src_ssid=%s \n", dst_ssid, src_ssid));
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(CurrentAntenna));			
+			DBG_871X("#### dst_ssid=(%s) Opt_Ant_(%s) , cur_Ant(%s)\n", dst_ssid,
+				(2==pnetwork->network.PhyInfo.Optimum_antenna)?"A":"B",
+				(2==CurrentAntenna)?"A":"B");
+#endif
+			//remove the condition @ 20081125
+			//if((pmlmepriv->cur_network.network.InfrastructureMode==Ndis802_11AutoUnknown)||
+			//	pmlmepriv->cur_network.network.InfrastructureMode == pnetwork->network.InfrastructureMode)
+			//{
+			//	_rtw_memcpy(pmlmepriv->assoc_bssid, pnetwork->network.MacAddress, ETH_ALEN);
+			//	goto ask_for_joinbss;
+			//}
+
+			if(pmlmepriv->assoc_by_rssi==_TRUE)//if the ssid is the same, select the bss which has the max rssi
+			{
+				if( NULL==pnetwork_max_rssi|| pnetwork->network.Rssi > pnetwork_max_rssi->network.Rssi)
+						pnetwork_max_rssi = pnetwork;					
+			}
+			else if(rtw_is_desired_network(adapter, pnetwork) == _TRUE)
+			{
+				if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				{
+#if 0				
+					if(is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network))
+					{
+						DBG_871X("select_and_join(2): _FW_LINKED and is same network, it needn't join again\n");
+						
+						rtw_indicate_connect(adapter);//rtw_indicate_connect again
+						
+						return 2;
+					}
+					else
+#endif						
+					{
+						rtw_disassoc_cmd(adapter, 0, _TRUE);
+						//rtw_indicate_disconnect(adapter);//
+						rtw_free_assoc_resources(adapter, 0);
+						_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+						goto ask_for_joinbss;						
+					}
+				}
+				else
+				{
+					_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+					goto ask_for_joinbss;
+				}				
+
+			}
+		
+			
+		}
+ 	
+ 	}
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	#ifdef CONFIG_LAYER2_ROAMING
+	if(rtw_to_roaming(adapter) > 0 && roaming_candidate ){
+		pnetwork=roaming_candidate;
+		DBG_871X("select_and_join_from_scanned_queue: roaming_candidate: %s("MAC_FMT")\n",
+			pnetwork->network.Ssid.Ssid, MAC_ARG(pnetwork->network.MacAddress));
+		goto ask_for_joinbss;
+	}
+	#endif
+
+	if((pmlmepriv->assoc_by_rssi==_TRUE)  && (pnetwork_max_rssi!=NULL))
+	{
+		pnetwork = pnetwork_max_rssi;
+		DBG_871X("select_and_join_from_scanned_queue: pnetwork_max_rssi: %s("MAC_FMT")\n",
+			pnetwork->network.Ssid.Ssid, MAC_ARG(pnetwork->network.MacAddress));
+		goto ask_for_joinbss;
+	}
+
+	DBG_871X("(1)rtw_select_and_join_from_scanned_queue return _FAIL\n");
+	
+_func_exit_;	
+
+     return _FAIL;
+
+ask_for_joinbss:
+	
+_func_exit_;
+
+	return rtw_joinbss_cmd(adapter, pnetwork);
+
+}
+#endif //PLATFORM_FREEBSD
+
+
+sint rtw_set_auth(_adapter * adapter,struct security_priv *psecuritypriv)
+{
+	struct	cmd_obj* pcmd;
+	struct 	setauth_parm *psetauthparm;
+	struct	cmd_priv	*pcmdpriv=&(adapter->cmdpriv);
+	sint		res=_SUCCESS;
+	
+_func_enter_;	
+
+	pcmd = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;  //try again
+		goto exit;
+	}
+	
+	psetauthparm=(struct setauth_parm*)rtw_zmalloc(sizeof(struct setauth_parm));
+	if(psetauthparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetauthparm, 0, sizeof(struct setauth_parm));
+	psetauthparm->mode=(unsigned char)psecuritypriv->dot11AuthAlgrthm;
+	
+	pcmd->cmdcode = _SetAuth_CMD_;
+	pcmd->parmbuf = (unsigned char *)psetauthparm;   
+	pcmd->cmdsz =  (sizeof(struct setauth_parm));  
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("after enqueue set_auth_cmd, auth_mode=%x\n", psecuritypriv->dot11AuthAlgrthm));
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+
+sint rtw_set_key(_adapter * adapter,struct security_priv *psecuritypriv,sint keyid, u8 set_tx)
+{
+	u8	keylen;
+	struct cmd_obj		*pcmd;
+	struct setkey_parm	*psetkeyparm;
+	struct cmd_priv		*pcmdpriv = &(adapter->cmdpriv);
+	struct mlme_priv		*pmlmepriv = &(adapter->mlmepriv);
+	sint	res=_SUCCESS;
+	
+_func_enter_;
+	
+	pcmd = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;  //try again
+		goto exit;
+	}
+	psetkeyparm=(struct setkey_parm*)rtw_zmalloc(sizeof(struct setkey_parm));
+	if(psetkeyparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));
+
+	if(psecuritypriv->dot11AuthAlgrthm ==dot11AuthAlgrthm_8021X){		
+		psetkeyparm->algorithm=(unsigned char)psecuritypriv->dot118021XGrpPrivacy;	
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key: psetkeyparm->algorithm=(unsigned char)psecuritypriv->dot118021XGrpPrivacy=%d \n", psetkeyparm->algorithm));
+	}	
+	else{
+		psetkeyparm->algorithm=(u8)psecuritypriv->dot11PrivacyAlgrthm;
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key: psetkeyparm->algorithm=(u8)psecuritypriv->dot11PrivacyAlgrthm=%d \n", psetkeyparm->algorithm));
+
+	}
+	psetkeyparm->keyid = (u8)keyid;//0~3
+	psetkeyparm->set_tx = set_tx;
+	if (is_wep_enc(psetkeyparm->algorithm))
+		psecuritypriv->key_mask |= BIT(psetkeyparm->keyid);
+
+	DBG_871X("==> rtw_set_key algorithm(%x),keyid(%x),key_mask(%x)\n",psetkeyparm->algorithm,psetkeyparm->keyid, psecuritypriv->key_mask);
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key: psetkeyparm->algorithm=%d psetkeyparm->keyid=(u8)keyid=%d \n",psetkeyparm->algorithm, keyid));
+
+	switch(psetkeyparm->algorithm){
+		
+		case _WEP40_:
+			keylen=5;
+			_rtw_memcpy(&(psetkeyparm->key[0]), &(psecuritypriv->dot11DefKey[keyid].skey[0]), keylen);
+			break;
+		case _WEP104_:
+			keylen=13;
+			_rtw_memcpy(&(psetkeyparm->key[0]), &(psecuritypriv->dot11DefKey[keyid].skey[0]), keylen);
+			break;
+		case _TKIP_:
+			keylen=16;			
+			_rtw_memcpy(&psetkeyparm->key, &psecuritypriv->dot118021XGrpKey[keyid], keylen);
+			psetkeyparm->grpkey=1;
+			break;
+		case _AES_:
+			keylen=16;			
+			_rtw_memcpy(&psetkeyparm->key, &psecuritypriv->dot118021XGrpKey[keyid], keylen);
+			psetkeyparm->grpkey=1;
+			break;
+		default:
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key:psecuritypriv->dot11PrivacyAlgrthm = %x (must be 1 or 2 or 4 or 5)\n",psecuritypriv->dot11PrivacyAlgrthm));
+			res= _FAIL;
+			goto exit;
+	}
+
+	
+	pcmd->cmdcode = _SetKey_CMD_;
+	pcmd->parmbuf = (u8 *)psetkeyparm;   
+	pcmd->cmdsz =  (sizeof(struct setkey_parm));  
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	//_rtw_init_sema(&(pcmd->cmd_sem), 0);
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+_func_exit_;
+	return res;
+
+}
+
+
+//adjust IEs for rtw_joinbss_cmd in WMM
+int rtw_restruct_wmm_ie(_adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_len, uint initial_out_len)
+{
+	unsigned	int ielength=0;
+	unsigned int i, j;
+
+	i = 12; //after the fixed IE
+	while(i<in_len)
+	{
+		ielength = initial_out_len;		
+		
+		if(in_ie[i] == 0xDD && in_ie[i+2] == 0x00 && in_ie[i+3] == 0x50  && in_ie[i+4] == 0xF2 && in_ie[i+5] == 0x02 && i+5 < in_len) //WMM element ID and OUI
+		{
+
+			//Append WMM IE to the last index of out_ie
+			/*
+			for(j=i; j< i+(in_ie[i+1]+2); j++)
+			{
+				out_ie[ielength] = in_ie[j];				
+				ielength++;
+			}
+			out_ie[initial_out_len+8] = 0x00; //force the QoS Info Field to be zero
+	                */
+                       
+                        for ( j = i; j < i + 9; j++ )
+                        {
+                            out_ie[ ielength] = in_ie[ j ];
+                            ielength++;
+                        } 
+                        out_ie[ initial_out_len + 1 ] = 0x07;
+                        out_ie[ initial_out_len + 6 ] = 0x00;
+                        out_ie[ initial_out_len + 8 ] = 0x00;
+	
+			break;
+		}
+
+		i+=(in_ie[i+1]+2); // to the next IE element
+	}
+	
+	return ielength;
+	
+}
+
+
+//
+// Ported from 8185: IsInPreAuthKeyList(). (Renamed from SecIsInPreAuthKeyList(), 2006-10-13.)
+// Added by Annie, 2006-05-07.
+//
+// Search by BSSID,
+// Return Value:
+//		-1 		:if there is no pre-auth key in the  table
+//		>=0		:if there is pre-auth key, and   return the entry id
+//
+//
+
+static int SecIsInPMKIDList(_adapter *Adapter, u8 *bssid)
+{
+	struct security_priv *psecuritypriv=&Adapter->securitypriv;
+	int i=0;
+
+	do
+	{
+		if( ( psecuritypriv->PMKIDList[i].bUsed ) && 
+                    (  _rtw_memcmp( psecuritypriv->PMKIDList[i].Bssid, bssid, ETH_ALEN ) == _TRUE ) )
+		{
+			break;
+		}
+		else
+		{	
+			i++;
+			//continue;
+		}
+		
+	}while(i<NUM_PMKID_CACHE);
+
+	if( i == NUM_PMKID_CACHE )
+	{ 
+		i = -1;// Could not find.
+	}
+	else
+	{ 
+		// There is one Pre-Authentication Key for the specific BSSID.
+	}
+
+	return (i);
+	
+}
+
+//
+// Check the RSN IE length
+// If the RSN IE length <= 20, the RSN IE didn't include the PMKID information
+// 0-11th element in the array are the fixed IE
+// 12th element in the array is the IE
+// 13th element in the array is the IE length  
+//
+
+static int rtw_append_pmkid(_adapter *Adapter,int iEntry, u8 *ie, uint ie_len)
+{
+	struct security_priv *psecuritypriv=&Adapter->securitypriv;
+
+	if(ie[13]<=20){	
+		// The RSN IE didn't include the PMK ID, append the PMK information 
+			ie[ie_len]=1;
+			ie_len++;
+			ie[ie_len]=0;	//PMKID count = 0x0100
+			ie_len++;
+			_rtw_memcpy(	&ie[ie_len], &psecuritypriv->PMKIDList[iEntry].PMKID, 16);
+		
+			ie_len+=16;
+			ie[13]+=18;//PMKID length = 2+16
+
+	}
+	return (ie_len);
+	
+}
+sint rtw_restruct_sec_ie(_adapter *adapter,u8 *in_ie, u8 *out_ie, uint in_len)
+{
+	u8 authmode, securitytype, match;
+	u8 sec_ie[255], uncst_oui[4], bkup_ie[255];
+	u8 wpa_oui[4]={0x0, 0x50, 0xf2, 0x01};
+	uint 	ielength, cnt, remove_cnt;
+	int iEntry;
+
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	struct security_priv *psecuritypriv=&adapter->securitypriv;
+	uint 	ndisauthmode=psecuritypriv->ndisauthtype;
+	uint ndissecuritytype = psecuritypriv->ndisencryptstatus;
+	
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+		 ("+rtw_restruct_sec_ie: ndisauthmode=%d ndissecuritytype=%d\n",
+		  ndisauthmode, ndissecuritytype));
+	
+	//copy fixed ie only
+	_rtw_memcpy(out_ie, in_ie,12);
+	ielength=12;
+	if((ndisauthmode==Ndis802_11AuthModeWPA)||(ndisauthmode==Ndis802_11AuthModeWPAPSK))
+			authmode=_WPA_IE_ID_;
+	if((ndisauthmode==Ndis802_11AuthModeWPA2)||(ndisauthmode==Ndis802_11AuthModeWPA2PSK))
+			authmode=_WPA2_IE_ID_;
+
+	if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+	{
+		_rtw_memcpy(out_ie+ielength, psecuritypriv->wps_ie, psecuritypriv->wps_ie_len);
+		
+		ielength += psecuritypriv->wps_ie_len;
+	}
+	else if((authmode==_WPA_IE_ID_)||(authmode==_WPA2_IE_ID_))
+	{		
+		//copy RSN or SSN		
+		_rtw_memcpy(&out_ie[ielength], &psecuritypriv->supplicant_ie[0], psecuritypriv->supplicant_ie[1]+2);
+		/* debug for CONFIG_IEEE80211W
+		{
+			int jj;
+			printk("supplicant_ie_length=%d &&&&&&&&&&&&&&&&&&&\n", psecuritypriv->supplicant_ie[1]+2);
+			for(jj=0; jj < psecuritypriv->supplicant_ie[1]+2; jj++)
+				printk(" %02x ", psecuritypriv->supplicant_ie[jj]);
+			printk("\n");
+		}*/
+		ielength+=psecuritypriv->supplicant_ie[1]+2;
+		rtw_report_sec_ie(adapter, authmode, psecuritypriv->supplicant_ie);
+	
+#ifdef CONFIG_DRVEXT_MODULE
+		drvext_report_sec_ie(&adapter->drvextpriv, authmode, sec_ie);	
+#endif
+	}
+
+	iEntry = SecIsInPMKIDList(adapter, pmlmepriv->assoc_bssid);
+	if(iEntry<0)
+	{
+		return ielength;
+	}
+	else
+	{
+		if(authmode == _WPA2_IE_ID_)
+		{
+			ielength=rtw_append_pmkid(adapter, iEntry, out_ie, ielength);
+		}
+	}
+
+_func_exit_;
+	
+	return ielength;	
+}
+
+void rtw_init_registrypriv_dev_network(	_adapter* adapter)
+{
+	struct registry_priv* pregistrypriv = &adapter->registrypriv;
+	struct eeprom_priv* peepriv = &adapter->eeprompriv;
+	WLAN_BSSID_EX    *pdev_network = &pregistrypriv->dev_network;
+	u8 *myhwaddr = myid(peepriv);
+	
+_func_enter_;
+
+	_rtw_memcpy(pdev_network->MacAddress, myhwaddr, ETH_ALEN);
+
+	_rtw_memcpy(&pdev_network->Ssid, &pregistrypriv->ssid, sizeof(NDIS_802_11_SSID));
+	
+	pdev_network->Configuration.Length=sizeof(NDIS_802_11_CONFIGURATION);
+	pdev_network->Configuration.BeaconPeriod = 100;	
+	pdev_network->Configuration.FHConfig.Length = 0;
+	pdev_network->Configuration.FHConfig.HopPattern = 0;
+	pdev_network->Configuration.FHConfig.HopSet = 0;
+	pdev_network->Configuration.FHConfig.DwellTime = 0;
+	
+	
+_func_exit_;	
+	
+}
+
+void rtw_update_registrypriv_dev_network(_adapter* adapter) 
+{
+	int sz=0;
+	struct registry_priv* pregistrypriv = &adapter->registrypriv;	
+	WLAN_BSSID_EX    *pdev_network = &pregistrypriv->dev_network;
+	struct	security_priv*	psecuritypriv = &adapter->securitypriv;
+	struct	wlan_network	*cur_network = &adapter->mlmepriv.cur_network;
+	//struct	xmit_priv	*pxmitpriv = &adapter->xmitpriv;
+
+_func_enter_;
+
+#if 0
+	pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense;
+	pxmitpriv->vcs = pregistrypriv->vcs_type;
+	pxmitpriv->vcs_type = pregistrypriv->vcs_type;
+	//pxmitpriv->rts_thresh = pregistrypriv->rts_thresh;
+	pxmitpriv->frag_len = pregistrypriv->frag_thresh;
+	
+	adapter->qospriv.qos_option = pregistrypriv->wmm_enable;
+#endif	
+
+	pdev_network->Privacy = (psecuritypriv->dot11PrivacyAlgrthm > 0 ? 1 : 0) ; // adhoc no 802.1x
+
+	pdev_network->Rssi = 0;
+
+	switch(pregistrypriv->wireless_mode)
+	{
+		case WIRELESS_11B:
+			pdev_network->NetworkTypeInUse = (Ndis802_11DS);
+			break;	
+		case WIRELESS_11G:
+		case WIRELESS_11BG:
+		case WIRELESS_11_24N:
+		case WIRELESS_11G_24N:
+		case WIRELESS_11BG_24N:
+			pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
+			break;
+		case WIRELESS_11A:
+		case WIRELESS_11A_5N:
+			pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
+			break;
+		case WIRELESS_11ABGN:
+			if(pregistrypriv->channel > 14)
+				pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
+			else
+				pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
+			break;
+		default :
+			// TODO
+			break;
+	}
+	
+	pdev_network->Configuration.DSConfig = (pregistrypriv->channel);
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("pregistrypriv->channel=%d, pdev_network->Configuration.DSConfig=0x%x\n", pregistrypriv->channel, pdev_network->Configuration.DSConfig));	
+
+	if(cur_network->network.InfrastructureMode == Ndis802_11IBSS)
+		pdev_network->Configuration.ATIMWindow = (0);
+
+	pdev_network->InfrastructureMode = (cur_network->network.InfrastructureMode);
+
+	// 1. Supported rates
+	// 2. IE
+
+	//rtw_set_supported_rate(pdev_network->SupportedRates, pregistrypriv->wireless_mode) ; // will be called in rtw_generate_ie
+	sz = rtw_generate_ie(pregistrypriv);
+
+	pdev_network->IELength = sz;
+
+	pdev_network->Length = get_WLAN_BSSID_EX_sz((WLAN_BSSID_EX  *)pdev_network);
+
+	//notes: translate IELength & Length after assign the Length to cmdsz in createbss_cmd();
+	//pdev_network->IELength = cpu_to_le32(sz);
+		
+_func_exit_;	
+
+}
+
+void rtw_get_encrypt_decrypt_from_registrypriv(_adapter* adapter)
+{
+_func_enter_;
+
+
+_func_exit_;	
+	
+}
+
+//the fucntion is at passive_level 
+void rtw_joinbss_reset(_adapter *padapter)
+{
+	u8	threshold;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+
+#ifdef CONFIG_80211N_HT	
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+#endif
+
+	//todo: if you want to do something io/reg/hw setting before join_bss, please add code here
+	
+
+
+
+#ifdef CONFIG_80211N_HT
+
+	pmlmepriv->num_FortyMHzIntolerant = 0;
+
+	pmlmepriv->num_sta_no_ht = 0;
+
+	phtpriv->ampdu_enable = _FALSE;//reset to disabled
+
+#ifdef CONFIG_USB_HCI
+	// TH=1 => means that invalidate usb rx aggregation
+	// TH=0 => means that validate usb rx aggregation, use init value.
+	if(phtpriv->ht_option)
+	{
+		if(padapter->registrypriv.wifi_spec==1)		
+			threshold = 1;
+		else
+			threshold = 0;
+		rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+	}
+	else
+	{
+		threshold = 1;
+		rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+	}
+#endif
+
+#endif	
+
+}
+
+
+#ifdef CONFIG_80211N_HT
+
+//the fucntion is >= passive_level 
+unsigned int rtw_restructure_ht_ie(_adapter *padapter, u8 *in_ie, u8 *out_ie, uint in_len, uint *pout_len, u8 channel)
+{
+	u32 ielen, out_len;
+	unsigned char *p, *pframe;
+	struct rtw_ieee80211_ht_cap ht_capie;
+	unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv   	*pqospriv= &pmlmepriv->qospriv;
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	u8 cbw40_enable = 0;
+
+	phtpriv->ht_option = _FALSE;
+
+	p = rtw_get_ie(in_ie+12, _HT_CAPABILITY_IE_, &ielen, in_len-12);
+
+	if(p && ielen>0)
+	{
+		if(pqospriv->qos_option == 0)
+		{
+			out_len = *pout_len;
+			pframe = rtw_set_ie(out_ie+out_len, _VENDOR_SPECIFIC_IE_, 
+								_WMM_IE_Length_, WMM_IE, pout_len);
+
+			pqospriv->qos_option = 1;
+		}
+
+		out_len = *pout_len;
+
+		_rtw_memset(&ht_capie, 0, sizeof(struct rtw_ieee80211_ht_cap));
+
+		ht_capie.cap_info =  IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_TX_STBC |
+							IEEE80211_HT_CAP_DSSSCCK40;
+		//if insert module set only support 20MHZ, don't add the 40MHZ and SGI_40
+		if( channel > 14 )
+		{
+			if( pregpriv->cbw40_enable & BIT(1) )
+				cbw40_enable = 1;
+		}
+		else
+			if( pregpriv->cbw40_enable & BIT(0) )
+				cbw40_enable = 1;
+
+		if ( cbw40_enable != 0 )
+			ht_capie.cap_info |= IEEE80211_HT_CAP_SUP_WIDTH | IEEE80211_HT_CAP_SGI_40;
+				
+
+
+		{
+			u32 rx_packet_offset, max_recvbuf_sz;
+			rtw_hal_get_def_var(padapter, HAL_DEF_RX_PACKET_OFFSET, &rx_packet_offset);
+			rtw_hal_get_def_var(padapter, HAL_DEF_MAX_RECVBUF_SZ, &max_recvbuf_sz);
+			//if(max_recvbuf_sz-rx_packet_offset>(8191-256)) {
+			//	DBG_871X("%s IEEE80211_HT_CAP_MAX_AMSDU is set\n", __FUNCTION__);
+			//	ht_capie.cap_info = ht_capie.cap_info |IEEE80211_HT_CAP_MAX_AMSDU;
+			//}
+		}
+		
+		ht_capie.ampdu_params_info = (IEEE80211_HT_CAP_AMPDU_FACTOR&0x03);
+
+		if(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_ )
+			ht_capie.ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&(0x07<<2));
+		else
+			ht_capie.ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&0x00);										
+
+		
+		pframe = rtw_set_ie(out_ie+out_len, _HT_CAPABILITY_IE_, 
+							sizeof(struct rtw_ieee80211_ht_cap), (unsigned char*)&ht_capie, pout_len);
+
+
+		//_rtw_memcpy(out_ie+out_len, p, ielen+2);//gtest
+		//*pout_len = *pout_len + (ielen+2);
+
+							
+		phtpriv->ht_option = _TRUE;
+
+		p = rtw_get_ie(in_ie+12, _HT_ADD_INFO_IE_, &ielen, in_len-12);
+		if(p && (ielen==sizeof(struct ieee80211_ht_addt_info)))
+		{
+			out_len = *pout_len;		
+			pframe = rtw_set_ie(out_ie+out_len, _HT_ADD_INFO_IE_, ielen, p+2 , pout_len);
+		}
+
+	}
+	
+	return (phtpriv->ht_option);
+	
+}
+
+//the fucntion is > passive_level (in critical_section)
+void rtw_update_ht_cap(_adapter *padapter, u8 *pie, uint ie_len, u8 channel)
+{	
+	u8 *p, max_ampdu_sz;
+	int len;		
+	//struct sta_info *bmc_sta, *psta;	
+	struct rtw_ieee80211_ht_cap *pht_capie;
+	struct ieee80211_ht_addt_info *pht_addtinfo;
+	//struct recv_reorder_ctrl *preorder_ctrl;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+	//struct recv_priv *precvpriv = &padapter->recvpriv;
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	//struct wlan_network *pcur_network = &(pmlmepriv->cur_network);;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);	
+	u8 cbw40_enable=0;
+
+	if(!phtpriv->ht_option)
+		return;
+
+	if ((!pmlmeinfo->HT_info_enable) || (!pmlmeinfo->HT_caps_enable))
+		return;
+
+	DBG_871X("+rtw_update_ht_cap()\n");
+
+	//maybe needs check if ap supports rx ampdu.
+	if((phtpriv->ampdu_enable==_FALSE) &&(pregistrypriv->ampdu_enable==1))
+	{
+		//In the wifi cert. test, the test Lab should turn off the AP's RX AMPDU. client doen't need to close the TX AMPDU
+		/*if(pregistrypriv->wifi_spec==1)
+		{
+			phtpriv->ampdu_enable = _FALSE;
+		}
+		else*/
+		{
+			phtpriv->ampdu_enable = _TRUE;
+		}
+	}
+	else if(pregistrypriv->ampdu_enable==2)
+	{
+		phtpriv->ampdu_enable = _TRUE;
+	}
+
+	
+	//check Max Rx A-MPDU Size 
+	len = 0;
+	p = rtw_get_ie(pie+sizeof (NDIS_802_11_FIXED_IEs), _HT_CAPABILITY_IE_, &len, ie_len-sizeof (NDIS_802_11_FIXED_IEs));
+	if(p && len>0)	
+	{
+		pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);
+		max_ampdu_sz = (pht_capie->ampdu_params_info & IEEE80211_HT_CAP_AMPDU_FACTOR);
+		max_ampdu_sz = 1 << (max_ampdu_sz+3); // max_ampdu_sz (kbytes);
+		
+		//DBG_871X("rtw_update_ht_cap(): max_ampdu_sz=%d\n", max_ampdu_sz);
+		phtpriv->rx_ampdu_maxlen = max_ampdu_sz;
+		
+	}
+
+
+	len=0;
+	p = rtw_get_ie(pie+sizeof (NDIS_802_11_FIXED_IEs), _HT_ADD_INFO_IE_, &len, ie_len-sizeof (NDIS_802_11_FIXED_IEs));
+	if(p && len>0)	
+	{
+		pht_addtinfo = (struct ieee80211_ht_addt_info *)(p+2);
+		//todo:
+	}
+
+	if( channel > 14 )
+	{
+		if( pregistrypriv->cbw40_enable & BIT(1) )
+			cbw40_enable = 1;
+	}
+	else
+		if( pregistrypriv->cbw40_enable & BIT(0) )
+			cbw40_enable = 1;
+
+
+	//update cur_bwmode & cur_ch_offset
+	if ((cbw40_enable) &&
+		(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & BIT(1)) && 
+		(pmlmeinfo->HT_info.infos[0] & BIT(2)))
+	{
+		int i;
+		u8	rf_type;
+
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			if((rf_type == RF_1T1R) || (rf_type == RF_1T2R))
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+			}
+			else
+			{
+				#ifdef CONFIG_DISABLE_MCS13TO15
+				if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40 && pregistrypriv->wifi_spec != 1 )
+				{
+					pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R_MCS13TO15_OFF[i];
+				}
+				else
+					pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+				#else
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+				#endif //CONFIG_DISABLE_MCS13TO15
+			}
+			#ifdef RTL8192C_RECONFIG_TO_1T1R
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+			}
+			#endif
+
+			if(pregistrypriv->special_rf_path)
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+
+		}
+		//switch to the 40M Hz mode accoring to the AP
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+		switch ((pmlmeinfo->HT_info.infos[0] & 0x3))
+		{
+			case HT_EXTCHNL_OFFSET_UPPER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				break;
+			
+			case HT_EXTCHNL_OFFSET_LOWER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				break;
+				
+			default:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+				break;
+		}		
+	}
+
+	//
+	// Config SM Power Save setting
+	//
+	pmlmeinfo->SM_PS = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & 0x0C) >> 2;
+	if(pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
+	{
+		/*u8 i;
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			pmlmeinfo->HT_caps.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}*/
+		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n",__FUNCTION__);
+	}
+
+	//
+	// Config current HT Protection mode.
+	//
+	pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
+
+	
+	
+#if 0 //move to rtw_update_sta_info_client()
+	//for A-MPDU Rx reordering buffer control for bmc_sta & sta_info
+	//if A-MPDU Rx is enabled, reseting  rx_ordering_ctrl wstart_b(indicate_seq) to default value=0xffff
+	//todo: check if AP can send A-MPDU packets
+	bmc_sta = rtw_get_bcmc_stainfo(padapter);
+	if(bmc_sta)
+	{
+		for(i=0; i < 16 ; i++)
+		{
+			//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+			preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
+			preorder_ctrl->enable = _FALSE;
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+		}
+	}
+
+	psta = rtw_get_stainfo(&padapter->stapriv, pcur_network->network.MacAddress);
+	if(psta)
+	{
+		for(i=0; i < 16 ; i++)
+		{
+			//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+			preorder_ctrl->enable = _FALSE;
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+		}
+	}
+#endif	
+
+}
+
+void rtw_issue_addbareq_cmd(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	u8 issued;
+	int priority;
+	struct sta_info *psta=NULL;
+	struct ht_priv	*phtpriv;
+	struct pkt_attrib *pattrib =&pxmitframe->attrib;
+	s32 bmcst = IS_MCAST(pattrib->ra);
+
+	if(bmcst || (padapter->mlmepriv.LinkDetectInfo.bTxBusyTraffic == _FALSE))
+		return;
+	
+	priority = pattrib->priority;
+
+	if (pattrib->psta)
+		psta = pattrib->psta;
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+	}	
+	
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return;
+	}	
+
+	
+	phtpriv = &psta->htpriv;
+
+	if((phtpriv->ht_option==_TRUE) && (phtpriv->ampdu_enable==_TRUE)) 
+	{
+		issued = (phtpriv->agg_enable_bitmap>>priority)&0x1;
+		issued |= (phtpriv->candidate_tid_bitmap>>priority)&0x1;
+
+		if(0==issued)
+		{
+			DBG_871X("rtw_issue_addbareq_cmd, p=%d\n", priority);
+			psta->htpriv.candidate_tid_bitmap |= BIT((u8)priority);
+			rtw_addbareq_cmd(padapter,(u8) priority, pattrib->ra);
+		}
+	}
+	
+}
+
+#endif
+
+#ifdef CONFIG_LAYER2_ROAMING
+inline void rtw_set_roaming(_adapter *adapter, u8 to_roaming)
+{
+	if (to_roaming == 0)
+		adapter->mlmepriv.to_join = _FALSE;
+	adapter->mlmepriv.to_roaming = to_roaming;
+}
+
+inline u8 rtw_to_roaming(_adapter *adapter)
+{
+	return adapter->mlmepriv.to_roaming;
+}
+
+void rtw_roaming(_adapter *padapter, struct wlan_network *tgt_network)
+{
+	_irqL irqL;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_rtw_roaming(padapter, tgt_network);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+void _rtw_roaming(_adapter *padapter, struct wlan_network *tgt_network)
+{
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	int do_join_r;
+
+	struct wlan_network *pnetwork;
+
+	if(tgt_network != NULL)
+		pnetwork = tgt_network;
+	else
+		pnetwork = &pmlmepriv->cur_network;
+	
+	if(0 < rtw_to_roaming(padapter)) {
+		DBG_871X("roaming from %s("MAC_FMT"), length:%d\n",
+				pnetwork->network.Ssid.Ssid, MAC_ARG(pnetwork->network.MacAddress),
+				pnetwork->network.Ssid.SsidLength);
+		_rtw_memcpy(&pmlmepriv->assoc_ssid, &pnetwork->network.Ssid, sizeof(NDIS_802_11_SSID));
+
+		pmlmepriv->assoc_by_bssid = _FALSE;
+
+		while(1) {
+			if( _SUCCESS==(do_join_r=rtw_do_join(padapter)) ) {
+				break;
+			} else {
+				DBG_871X("roaming do_join return %d\n", do_join_r);
+				pmlmepriv->to_roaming--;
+				
+				if(0< rtw_to_roaming(padapter)) {
+					continue;
+				} else {
+					DBG_871X("%s(%d) -to roaming fail, indicate_disconnect\n", __FUNCTION__,__LINE__);
+					rtw_indicate_disconnect(padapter);
+					break;
+				}
+			}
+		}
+	}
+	
+}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+sint rtw_buddy_adapter_up(_adapter *padapter)
+{	
+	sint res = _FALSE;
+	
+	if(padapter == NULL)
+		return res;
+
+
+	if(padapter->pbuddy_adapter == NULL)
+	{
+		res = _FALSE;
+	}
+	else if( (padapter->pbuddy_adapter->bDriverStopped) || (padapter->pbuddy_adapter->bSurpriseRemoved) ||
+		(padapter->pbuddy_adapter->bup == _FALSE) || (padapter->pbuddy_adapter->hw_init_completed == _FALSE))
+	{		
+		res = _FALSE;
+	}
+	else
+	{
+		res = _TRUE;
+	}	
+
+	return res;	
+
+}
+
+sint check_buddy_fwstate(_adapter *padapter, sint state)
+{
+	if(padapter == NULL)
+		return _FALSE;	
+	
+	if(padapter->pbuddy_adapter == NULL)
+		return _FALSE;	
+		
+	if ((state == WIFI_FW_NULL_STATE) && 
+		(padapter->pbuddy_adapter->mlmepriv.fw_state == WIFI_FW_NULL_STATE))
+		return _TRUE;
+	
+	if (padapter->pbuddy_adapter->mlmepriv.fw_state & state)
+		return _TRUE;
+
+	return _FALSE;
+}
+#endif //CONFIG_CONCURRENT_MODE
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c
new file mode 100755
index 0000000000000..e20c116a9cf8c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c
@@ -0,0 +1,13600 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MLME_EXT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+#include <rtw_mlme_ext.h>
+#include <wlan_bssdef.h>
+#include <mlme_osdep.h>
+#include <recv_osdep.h>
+
+struct mlme_handler mlme_sta_tbl[]={
+	{WIFI_ASSOCREQ,		"OnAssocReq",	&OnAssocReq},
+	{WIFI_ASSOCRSP,		"OnAssocRsp",	&OnAssocRsp},
+	{WIFI_REASSOCREQ,	"OnReAssocReq",	&OnAssocReq},
+	{WIFI_REASSOCRSP,	"OnReAssocRsp",	&OnAssocRsp},
+	{WIFI_PROBEREQ,		"OnProbeReq",	&OnProbeReq},
+	{WIFI_PROBERSP,		"OnProbeRsp",		&OnProbeRsp},
+
+	/*----------------------------------------------------------
+					below 2 are reserved
+	-----------------------------------------------------------*/
+	{0,					"DoReserved",		&DoReserved},
+	{0,					"DoReserved",		&DoReserved},
+	{WIFI_BEACON,		"OnBeacon",		&OnBeacon},
+	{WIFI_ATIM,			"OnATIM",		&OnAtim},
+	{WIFI_DISASSOC,		"OnDisassoc",		&OnDisassoc},
+	{WIFI_AUTH,			"OnAuth",		&OnAuthClient},
+	{WIFI_DEAUTH,		"OnDeAuth",		&OnDeAuth},
+	{WIFI_ACTION,		"OnAction",		&OnAction},
+};
+
+#ifdef _CONFIG_NATIVEAP_MLME_
+struct mlme_handler mlme_ap_tbl[]={
+	{WIFI_ASSOCREQ,		"OnAssocReq",	&OnAssocReq},
+	{WIFI_ASSOCRSP,		"OnAssocRsp",	&OnAssocRsp},
+	{WIFI_REASSOCREQ,	"OnReAssocReq",	&OnAssocReq},
+	{WIFI_REASSOCRSP,	"OnReAssocRsp",	&OnAssocRsp},
+	{WIFI_PROBEREQ,		"OnProbeReq",	&OnProbeReq},
+	{WIFI_PROBERSP,		"OnProbeRsp",		&OnProbeRsp},
+
+	/*----------------------------------------------------------
+					below 2 are reserved
+	-----------------------------------------------------------*/
+	{0,					"DoReserved",		&DoReserved},
+	{0,					"DoReserved",		&DoReserved},
+	{WIFI_BEACON,		"OnBeacon",		&OnBeacon},
+	{WIFI_ATIM,			"OnATIM",		&OnAtim},
+	{WIFI_DISASSOC,		"OnDisassoc",		&OnDisassoc},
+	{WIFI_AUTH,			"OnAuth",		&OnAuth},
+	{WIFI_DEAUTH,		"OnDeAuth",		&OnDeAuth},
+	{WIFI_ACTION,		"OnAction",		&OnAction},
+};
+#endif
+
+struct action_handler OnAction_tbl[]={
+	{RTW_WLAN_CATEGORY_SPECTRUM_MGMT,	 "ACTION_SPECTRUM_MGMT", on_action_spct},
+	{RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
+	{RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
+	{RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
+	{RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
+	{RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
+	{RTW_WLAN_CATEGORY_FT, "ACTION_FT",	&DoReserved},
+	{RTW_WLAN_CATEGORY_HT,	"ACTION_HT",	&OnAction_ht},
+#ifdef CONFIG_IEEE80211W
+	{RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &OnAction_sa_query},
+#else
+	{RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
+#endif //CONFIG_IEEE80211W
+	//add for CONFIG_IEEE80211W
+	{RTW_WLAN_CATEGORY_UNPROTECTED_WNM, "ACTION_UNPROTECTED_WNM", &DoReserved},
+	{RTW_WLAN_CATEGORY_SELF_PROTECTED, "ACTION_SELF_PROTECTED", &DoReserved},
+	{RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},	
+	{RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},	
+};
+
+
+u8	null_addr[ETH_ALEN]= {0,0,0,0,0,0};
+
+/**************************************************
+OUI definitions for the vendor specific IE
+***************************************************/
+unsigned char	RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
+unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
+unsigned char	WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
+unsigned char	P2P_OUI[] = {0x50,0x6F,0x9A,0x09};
+unsigned char	WFD_OUI[] = {0x50,0x6F,0x9A,0x0A};
+
+unsigned char	WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
+unsigned char	WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
+
+unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
+unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
+
+extern unsigned char REALTEK_96B_IE[];
+
+/********************************************************
+MCS rate definitions
+*********************************************************/
+#ifdef CONFIG_DISABLE_MCS13TO15
+unsigned char	MCS_rate_2R_MCS13TO15_OFF[16] = {0xff, 0x1f, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+unsigned char	MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+#else //CONFIG_DISABLE_MCS13TO15
+unsigned char	MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+#endif //CONFIG_DISABLE_MCS13TO15
+unsigned char	MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+
+/********************************************************
+ChannelPlan definitions
+*********************************************************/
+/*static RT_CHANNEL_PLAN	DefaultChannelPlan[RT_CHANNEL_DOMAIN_MAX] = {
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,132,136,140,149,153,157,161,165},32},					// 0x00, RT_CHANNEL_DOMAIN_FCC
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},31},						// 0x01, RT_CHANNEL_DOMAIN_IC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},32},						// 0x02, RT_CHANNEL_DOMAIN_ETSI
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x03, RT_CHANNEL_DOMAIN_SPAIN
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x04, RT_CHANNEL_DOMAIN_FRANCE
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x05, RT_CHANNEL_DOMAIN_MKK
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x06, RT_CHANNEL_DOMAIN_MKK1
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},																// 0x07, RT_CHANNEL_DOMAIN_ISRAEL
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,40,44,48,52,56,60,64},22},															// 0x08, RT_CHANNEL_DOMAIN_TELEC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14},14},																				// 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13
+	{{1,2,3,4,5,6,7,8,9,10,11,56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},26},									// 0x0B, RT_CHANNEL_DOMAIN_TAIWAN
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,149,153,157,161,165},18},																// 0x0C, RT_CHANNEL_DOMAIN_CHINA
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,149,153,157,161,165},24},												// 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,149,153,157,161,165},31},						// 0x0E, RT_CHANNEL_DOMAIN_KOREA
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64},19},																	// 0x0F, RT_CHANNEL_DOMAIN_TURKEY
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},32},						// 0x10, RT_CHANNEL_DOMAIN_JAPAN
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,149,153,157,161,165},20},															// 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48},17},																		// 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165},37},	// 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G
+	{{1,2,3,4,5,6,7,8,9,10,11,56,60,64,149,153,157,161,165},19},																// 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS
+};*/
+
+static RT_CHANNEL_PLAN_2G	RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},		// 0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},		// 0x01, RT_CHANNEL_DOMAIN_2G_ETSI1
+	{{1,2,3,4,5,6,7,8,9,10,11},11},			// 0x02, RT_CHANNEL_DOMAIN_2G_FCC1
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14},14},	// 0x03, RT_CHANNEL_DOMAIN_2G_MIKK1
+	{{10,11,12,13},4},						// 0x04, RT_CHANNEL_DOMAIN_2G_ETSI2
+	{{},0},									// 0x05, RT_CHANNEL_DOMAIN_2G_NULL
+};
+
+static RT_CHANNEL_PLAN_5G	RTW_ChannelPlan5G[RT_CHANNEL_DOMAIN_5G_MAX] = {
+	{{},0},																					// 0x00, RT_CHANNEL_DOMAIN_5G_NULL
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},19},						// 0x01, RT_CHANNEL_DOMAIN_5G_ETSI1
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165},24},	// 0x02, RT_CHANNEL_DOMAIN_5G_ETSI2
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,149,153,157,161,165},22},			// 0x03, RT_CHANNEL_DOMAIN_5G_ETSI3
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165},24},	// 0x04, RT_CHANNEL_DOMAIN_5G_FCC1
+	{{36,40,44,48,149,153,157,161,165},9},														// 0x05, RT_CHANNEL_DOMAIN_5G_FCC2
+	{{36,40,44,48,52,56,60,64,149,153,157,161,165},13},											// 0x06, RT_CHANNEL_DOMAIN_5G_FCC3
+	{{36,40,44,48,52,56,60,64,149,153,157,161},12},												// 0x07, RT_CHANNEL_DOMAIN_5G_FCC4
+	{{149,153,157,161,165},5},																	// 0x08, RT_CHANNEL_DOMAIN_5G_FCC5
+	{{36,40,44,48,52,56,60,64},8},																// 0x09, RT_CHANNEL_DOMAIN_5G_FCC6
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},20},					// 0x0A, RT_CHANNEL_DOMAIN_5G_FCC7_IC1
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,149,153,157,161,165},20},					// 0x0B, RT_CHANNEL_DOMAIN_5G_KCC1
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},19},						// 0x0C, RT_CHANNEL_DOMAIN_5G_MKK1
+	{{36,40,44,48,52,56,60,64},8},																// 0x0D, RT_CHANNEL_DOMAIN_5G_MKK2
+	{{100,104,108,112,116,120,124,128,132,136,140},11},											// 0x0E, RT_CHANNEL_DOMAIN_5G_MKK3
+	{{56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},15},								// 0x0F, RT_CHANNEL_DOMAIN_5G_NCC1
+	{{56,60,64,149,153,157,161,165},8},															// 0x10, RT_CHANNEL_DOMAIN_5G_NCC2
+
+	//===== Driver self defined for old channel plan Compatible ,Remember to modify if have new channel plan definition =====
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,132,136,140,149,153,157,161,165},21},				// 0x11, RT_CHANNEL_DOMAIN_5G_FCC
+	{{36,40,44,48},4},																			// 0x12, RT_CHANNEL_DOMAIN_5G_JAPAN_NO_DFS
+	{{36,40,44,48,149,153,157,161},8},																// 0x13, RT_CHANNEL_DOMAIN_5G_FCC4_NO_DFS
+};
+
+static RT_CHANNEL_PLAN_MAP	RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
+	//===== 0x00 ~ 0x1F , Old Define =====
+	{0x02,0x11},	//0x00, RT_CHANNEL_DOMAIN_FCC
+	{0x02,0x0A},	//0x01, RT_CHANNEL_DOMAIN_IC
+	{0x01,0x01},	//0x02, RT_CHANNEL_DOMAIN_ETSI
+	{0x01,0x00},	//0x03, RT_CHANNEL_DOMAIN_SPAIN
+	{0x01,0x00},	//0x04, RT_CHANNEL_DOMAIN_FRANCE
+	{0x03,0x00},	//0x05, RT_CHANNEL_DOMAIN_MKK
+	{0x03,0x00},	//0x06, RT_CHANNEL_DOMAIN_MKK1
+	{0x01,0x09},	//0x07, RT_CHANNEL_DOMAIN_ISRAEL
+	{0x03,0x09},	//0x08, RT_CHANNEL_DOMAIN_TELEC
+	{0x03,0x00},	//0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN
+	{0x00,0x00},	//0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13
+	{0x02,0x0F},	//0x0B, RT_CHANNEL_DOMAIN_TAIWAN
+	{0x01,0x08},	//0x0C, RT_CHANNEL_DOMAIN_CHINA
+	{0x02,0x06},	//0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO
+	{0x02,0x0B},	//0x0E, RT_CHANNEL_DOMAIN_KOREA
+	{0x02,0x09},	//0x0F, RT_CHANNEL_DOMAIN_TURKEY
+	{0x01,0x01},	//0x10, RT_CHANNEL_DOMAIN_JAPAN
+	{0x02,0x05},	//0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS
+	{0x01,0x12},	//0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS
+	{0x00,0x04},	//0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G
+	{0x02,0x10},	//0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS
+	{0x00,0x12},	//0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS
+	{0x00,0x13},	//0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS
+	{0x03,0x12},	//0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS
+	{0x05,0x08},	//0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS
+	{0x02,0x08},	//0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS
+	{0x00,0x00},	//0x1A,
+	{0x00,0x00},	//0x1B,
+	{0x00,0x00},	//0x1C,
+	{0x00,0x00},	//0x1D,
+	{0x00,0x00},	//0x1E,
+	{0x05,0x04},	//0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G
+	//===== 0x20 ~ 0x7F ,New Define =====
+	{0x00,0x00},	//0x20, RT_CHANNEL_DOMAIN_WORLD_NULL
+	{0x01,0x00},	//0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL
+	{0x02,0x00},	//0x22, RT_CHANNEL_DOMAIN_FCC1_NULL
+	{0x03,0x00},	//0x23, RT_CHANNEL_DOMAIN_MKK1_NULL
+	{0x04,0x00},	//0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL
+	{0x02,0x04},	//0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1
+	{0x00,0x01},	//0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1
+	{0x03,0x0C},	//0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1
+	{0x00,0x0B},	//0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1
+	{0x00,0x05},	//0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2
+	{0x00,0x00},	//0x2A,
+	{0x00,0x00},	//0x2B,
+	{0x00,0x00},	//0x2C,
+	{0x00,0x00},	//0x2D,
+	{0x00,0x00},	//0x2E,
+	{0x00,0x00},	//0x2F,
+	{0x00,0x06},	//0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3
+	{0x00,0x07},	//0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4
+	{0x00,0x08},	//0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5
+	{0x00,0x09},	//0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6
+	{0x02,0x0A},	//0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7
+	{0x00,0x02},	//0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2
+	{0x00,0x03},	//0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3
+	{0x03,0x0D},	//0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2
+	{0x03,0x0E},	//0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3
+	{0x02,0x0F},	//0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1
+	{0x00,0x00},	//0x3A,
+	{0x00,0x00},	//0x3B,
+	{0x00,0x00},	//0x3C,
+	{0x00,0x00},	//0x3D,
+	{0x00,0x00},	//0x3E,
+	{0x00,0x00},	//0x3F,
+	{0x02,0x10},	//0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2
+};
+
+static RT_CHANNEL_PLAN_MAP	RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03,0x02}; //use the conbination for max channel numbers
+
+/*
+ * Search the @param ch in given @param ch_set
+ * @ch_set: the given channel set
+ * @ch: the given channel number
+ * 
+ * return the index of channel_num in channel_set, -1 if not found
+ */
+int rtw_ch_set_search_ch(RT_CHANNEL_INFO *ch_set, const u32 ch)
+{
+	int i;
+	for(i=0;ch_set[i].ChannelNum!=0;i++){
+		if(ch == ch_set[i].ChannelNum)
+			break;
+	}
+	
+	if(i >= ch_set[i].ChannelNum)
+		return -1;
+	return i;
+}
+
+/*
+ * Check the @param ch is fit with setband setting of @param adapter
+ * @adapter: the given adapter
+ * @ch: the given channel number
+ * 
+ * return _TRUE when check valid, _FALSE not valid
+ */
+bool rtw_mlme_band_check(_adapter *adapter, const u32 ch)
+{
+	if (adapter->setband == GHZ24_50 /* 2.4G and 5G */
+		|| (adapter->setband == GHZ_24 && ch < 35) /* 2.4G only */
+		|| (adapter->setband == GHZ_50 && ch > 35) /* 5G only */
+	) {
+		return _TRUE;
+	}
+	return _FALSE;
+}
+
+/****************************************************************************
+
+Following are the initialization functions for WiFi MLME
+
+*****************************************************************************/
+
+int init_hw_mlme_ext(_adapter *padapter)
+{
+	struct	mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	//set_opmode_cmd(padapter, infra_client_with_mlme);//removed
+
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+	return _SUCCESS;
+}
+
+static void init_mlme_ext_priv_value(_adapter* padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//unsigned char default_channel_set[MAX_CHANNEL_NUM] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 0, 0};
+	unsigned char	mixed_datarate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,_9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_, _48M_RATE_, _54M_RATE_, 0xff};
+	unsigned char	mixed_basicrate[NumRates] ={_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _12M_RATE_, _24M_RATE_, 0xff,};
+
+	ATOMIC_SET(&pmlmeext->event_seq, 0);
+	pmlmeext->mgnt_seq = 0;//reset to zero when disconnect at client mode
+#ifdef CONFIG_IEEE80211W
+	pmlmeext->sa_query_seq = 0;
+	pmlmeext->mgnt_80211w_IPN=0;
+	pmlmeext->mgnt_80211w_IPN_rx=0;
+#endif //CONFIG_IEEE80211W
+	pmlmeext->cur_channel = padapter->registrypriv.channel;
+	pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+	pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	pmlmeext->retry = 0;
+
+	pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
+
+	//_rtw_memcpy(pmlmeext->channel_set, DefaultChannelPlan[padapter->mlmepriv.ChannelPlan].Channel, DefaultChannelPlan[padapter->mlmepriv.ChannelPlan].Len);
+	//_rtw_memcpy(pmlmeext->channel_set, default_channel_set, MAX_CHANNEL_NUM);
+	_rtw_memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
+	_rtw_memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
+
+	if(pmlmeext->cur_channel > 14)
+		pmlmeext->tx_rate = IEEE80211_OFDM_RATE_6MB;
+	else
+		pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
+
+	pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
+	pmlmeext->sitesurvey_res.channel_idx = 0;
+	pmlmeext->sitesurvey_res.bss_cnt = 0;
+	pmlmeext->scan_abort = _FALSE;
+
+	pmlmeinfo->state = WIFI_FW_NULL_STATE;
+	pmlmeinfo->reauth_count = 0;
+	pmlmeinfo->reassoc_count = 0;
+	pmlmeinfo->link_count = 0;
+	pmlmeinfo->auth_seq = 0;
+	pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
+	pmlmeinfo->key_index = 0;
+	pmlmeinfo->iv = 0;
+
+	pmlmeinfo->enc_algo = _NO_PRIVACY_;
+	pmlmeinfo->authModeToggle = 0;
+
+	_rtw_memset(pmlmeinfo->chg_txt, 0, 128);
+
+	pmlmeinfo->slotTime = SHORT_SLOT_TIME;
+	pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
+
+	pmlmeinfo->dialogToken = 0;
+
+	pmlmeext->action_public_rxseq = 0xffff;
+	pmlmeext->action_public_dialog_token = 0xff;
+}
+
+static int has_channel(RT_CHANNEL_INFO *channel_set,
+					   u8 chanset_size,
+					   u8 chan) {
+	int i;
+
+	for (i = 0; i < chanset_size; i++) {
+		if (channel_set[i].ChannelNum == chan) {
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
+static void init_channel_list(_adapter *padapter, RT_CHANNEL_INFO *channel_set,
+							  u8 chanset_size,
+							  struct p2p_channels *channel_list) {
+
+	struct p2p_oper_class_map op_class[] = {
+		{ IEEE80211G,  81,   1,  13,  1, BW20 },
+		{ IEEE80211G,  82,  14,  14,  1, BW20 },
+#if 0 /* Do not enable HT40 on 2 GHz */
+		{ IEEE80211G,  83,   1,   9,  1, BW40PLUS },
+		{ IEEE80211G,  84,   5,  13,  1, BW40MINUS },
+#endif
+		{ IEEE80211A, 115,  36,  48,  4, BW20 },
+		{ IEEE80211A, 116,  36,  44,  8, BW40PLUS },
+		{ IEEE80211A, 117,  40,  48,  8, BW40MINUS },
+		{ IEEE80211A, 124, 149, 161,  4, BW20 },
+		{ IEEE80211A, 125, 149, 169,  4, BW20 },
+		{ IEEE80211A, 126, 149, 157,  8, BW40PLUS },
+		{ IEEE80211A, 127, 153, 161,  8, BW40MINUS },
+		{ -1, 0, 0, 0, 0, BW20 }
+	};
+
+	int cla, op;
+
+	cla = 0;
+
+	for (op = 0; op_class[op].op_class; op++) {
+		u8 ch;
+		struct p2p_oper_class_map *o = &op_class[op];
+		struct p2p_reg_class *reg = NULL;
+
+		for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
+			if (!has_channel(channel_set, chanset_size, ch)) {
+				continue;
+			}
+
+			if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
+				continue;
+
+			if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
+				((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
+				continue;
+				
+			if (reg == NULL) {
+				reg = &channel_list->reg_class[cla];
+				cla++;
+				reg->reg_class = o->op_class;
+				reg->channels = 0;
+			}
+			reg->channel[reg->channels] = ch;
+			reg->channels++;
+		}
+	}
+	channel_list->reg_classes = cla;
+
+}
+
+static u8 init_channel_set(_adapter* padapter, u8 ChannelPlan, RT_CHANNEL_INFO *channel_set)
+{
+	u8	index,chanset_size = 0;
+	u8	b5GBand = _FALSE, b2_4GBand = _FALSE;
+	u8	Index2G = 0, Index5G=0;
+
+	_rtw_memset(channel_set, 0, sizeof(RT_CHANNEL_INFO)*MAX_CHANNEL_NUM);
+
+	if(ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
+	{
+		DBG_871X("ChannelPlan ID %x error !!!!!\n",ChannelPlan);
+		return chanset_size;
+	}
+
+	if(padapter->registrypriv.wireless_mode & WIRELESS_11G)
+	{
+		b2_4GBand = _TRUE;
+		if(RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
+			Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
+		else
+			Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
+	}
+
+	if(padapter->registrypriv.wireless_mode & WIRELESS_11A)
+	{
+		b5GBand = _TRUE;
+		if(RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
+			Index5G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index5G;
+		else
+			Index5G = RTW_ChannelPlanMap[ChannelPlan].Index5G;
+	}
+
+	if(b2_4GBand)
+	{
+		for(index=0;index<RTW_ChannelPlan2G[Index2G].Len;index++)
+		{
+			channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
+
+			if(RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) //Channel 1~11 is active, and 12~14 is passive
+			{
+				if(channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+				else if((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
+					channel_set[chanset_size].ScanType  = SCAN_PASSIVE;			
+			}
+			else if(RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
+				RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan ||
+				RT_CHANNEL_DOMAIN_2G_WORLD == Index2G)// channel 12~13, passive scan
+			{
+				if(channel_set[chanset_size].ChannelNum <= 11)
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+				else
+					channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+			}
+			else
+			{
+				channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+			}
+
+			chanset_size++;
+		}
+	}
+
+	if(b5GBand)
+	{
+		for(index=0;index<RTW_ChannelPlan5G[Index5G].Len;index++)
+		{
+#ifdef CONFIG_DFS
+			channel_set[chanset_size].ChannelNum = RTW_ChannelPlan5G[Index5G].Channel[index];
+			if ( channel_set[chanset_size].ChannelNum <= 48 
+				|| channel_set[chanset_size].ChannelNum >= 149 )
+			{
+				if(RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan)//passive scan for all 5G channels
+					channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+				else
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+			}
+			else
+			{
+				channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+			}
+			chanset_size++;
+#else /* CONFIG_DFS */
+			if ( RTW_ChannelPlan5G[Index5G].Channel[index] <= 48 
+				|| RTW_ChannelPlan5G[Index5G].Channel[index] >= 149 ) {
+				channel_set[chanset_size].ChannelNum = RTW_ChannelPlan5G[Index5G].Channel[index];
+				if(RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan)//passive scan for all 5G channels
+					channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+				else
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+				DBG_871X("%s(): channel_set[%d].ChannelNum = %d\n", __FUNCTION__, chanset_size, channel_set[chanset_size].ChannelNum);
+				chanset_size++;
+			}
+#endif /* CONFIG_DFS */
+		}
+	}
+
+	return chanset_size;
+}
+
+int	init_mlme_ext_priv(_adapter* padapter)
+{
+	int	res = _SUCCESS;
+	struct registry_priv* pregistrypriv = &padapter->registrypriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((u8 *)pmlmeext, 0, sizeof(struct mlme_ext_priv));
+
+	pmlmeext->padapter = padapter;
+
+	//fill_fwpriv(padapter, &(pmlmeext->fwpriv));
+
+	init_mlme_ext_priv_value(padapter);
+	pmlmeinfo->bAcceptAddbaReq = pregistrypriv->bAcceptAddbaReq;
+	
+	init_mlme_ext_timer(padapter);
+
+#ifdef CONFIG_AP_MODE
+	init_mlme_ap_info(padapter);	
+#endif
+
+	pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan,pmlmeext->channel_set);
+	init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
+	
+	pmlmeext->chan_scan_time = SURVEY_TO;
+	pmlmeext->mlmeext_init = _TRUE;
+
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK	
+	pmlmeext->active_keep_alive_check = _TRUE;
+#endif
+
+	return res;
+
+}
+
+void free_mlme_ext_priv (struct mlme_ext_priv *pmlmeext)
+{
+	_adapter *padapter = pmlmeext->padapter;
+
+	if (!padapter)
+		return;
+
+	if (padapter->bDriverStopped == _TRUE)
+	{
+		_cancel_timer_ex(&pmlmeext->survey_timer);
+		_cancel_timer_ex(&pmlmeext->link_timer);
+		//_cancel_timer_ex(&pmlmeext->ADDBA_timer);
+	}
+}
+
+static u8 cmp_pkt_chnl_diff(_adapter *padapter,u8* pframe,uint packet_len)
+{	// if the channel is same, return 0. else return channel differential	
+	uint len;
+	u8 channel;	
+	u8 *p;		
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_, _DSSET_IE_, &len, packet_len - _BEACON_IE_OFFSET_);	
+	if (p)	
+	{	
+		channel = *(p + 2);		
+		if(padapter->mlmeextpriv.cur_channel >= channel)		
+		{			
+			return (padapter->mlmeextpriv.cur_channel - channel);		
+		}		
+		else		
+		{			
+			return (channel-padapter->mlmeextpriv.cur_channel);		
+		}	
+	}	
+	else
+	{		
+		return 0;	
+	}
+}
+
+static void _mgt_dispatcher(_adapter *padapter, struct mlme_handler *ptable, union recv_frame *precv_frame)
+{
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 *pframe = precv_frame->u.hdr.rx_data; 
+
+	  if(ptable->func)
+        {
+       	 //receive the frames that ra(a1) is my address or ra(a1) is bc address.
+		if (!_rtw_memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
+			!_rtw_memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN)) 
+		{
+			return;
+		}
+		
+		ptable->func(padapter, precv_frame);
+        }
+	
+}
+
+void mgt_dispatcher(_adapter *padapter, union recv_frame *precv_frame)
+{
+	int index;
+	struct mlme_handler *ptable;
+#ifdef CONFIG_AP_MODE
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //CONFIG_AP_MODE
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
+		 ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
+		  GetFrameType(pframe), GetFrameSubType(pframe)));
+
+#if 0
+	{
+		u8 *pbuf;
+		pbuf = GetAddr1Ptr(pframe);
+		DBG_871X("A1-%x:%x:%x:%x:%x:%x\n", *pbuf, *(pbuf+1), *(pbuf+2), *(pbuf+3), *(pbuf+4), *(pbuf+5));
+		pbuf = GetAddr2Ptr(pframe);
+		DBG_871X("A2-%x:%x:%x:%x:%x:%x\n", *pbuf, *(pbuf+1), *(pbuf+2), *(pbuf+3), *(pbuf+4), *(pbuf+5));
+		pbuf = GetAddr3Ptr(pframe);
+		DBG_871X("A3-%x:%x:%x:%x:%x:%x\n", *pbuf, *(pbuf+1), *(pbuf+2), *(pbuf+3), *(pbuf+4), *(pbuf+5));
+	}
+#endif
+
+	if (GetFrameType(pframe) != WIFI_MGT_TYPE)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("mgt_dispatcher: type(0x%x) error!\n", GetFrameType(pframe)));
+		return;
+	}
+
+	//receive the frames that ra(a1) is my address or ra(a1) is bc address.
+	if (!_rtw_memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
+		!_rtw_memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
+	{
+		return;
+	}
+
+	ptable = mlme_sta_tbl;
+
+	index = GetFrameSubType(pframe) >> 4;
+
+#ifdef CONFIG_TDLS
+	if((index << 4)==WIFI_ACTION){
+		//category==RTW_WLAN_CATEGORY_PUBLIC, action==TDLS_DISCOVERY_RESPONSE
+		if(*(pframe + IEEE80211_MGMT_HDR_LEN ) == RTW_WLAN_CATEGORY_PUBLIC
+			&& *(pframe + IEEE80211_MGMT_HDR_LEN + 1) == TDLS_DISCOVERY_RESPONSE )
+		{
+			DBG_871X("recv tdls discovery response frame\n");
+			On_TDLS_Dis_Rsp(padapter, precv_frame);
+		}
+	}
+#endif //CONFIG_TDLS
+
+	if (index > 13)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Currently we do not support reserved sub-fr-type=%d\n", index));
+		return;
+	}
+	ptable += index;
+
+#if 1
+	if (psta != NULL)
+	{
+		if (GetRetry(pframe))
+		{
+			if (precv_frame->u.hdr.attrib.seq_num == psta->RxMgmtFrameSeqNum)
+			{
+				/* drop the duplicate management frame */
+				DBG_871X("Drop duplicate management frame with seq_num = %d.\n", precv_frame->u.hdr.attrib.seq_num);
+				return;
+			}
+		}
+		psta->RxMgmtFrameSeqNum = precv_frame->u.hdr.attrib.seq_num;
+	}
+#else
+
+	if(GetRetry(pframe))
+	{
+		//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("drop due to decache!\n"));
+		//return;
+	}
+#endif
+
+#ifdef CONFIG_AP_MODE
+	switch (GetFrameSubType(pframe)) 
+	{
+		case WIFI_AUTH:
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+				ptable->func = &OnAuth;
+			else
+				ptable->func = &OnAuthClient;
+			//pass through
+		case WIFI_ASSOCREQ:
+		case WIFI_REASSOCREQ:
+			_mgt_dispatcher(padapter, ptable, precv_frame);	
+#ifdef CONFIG_HOSTAPD_MLME				
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+				rtw_hostapd_mlme_rx(padapter, precv_frame);
+#endif			
+			break;
+		case WIFI_PROBEREQ:
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+			{
+#ifdef CONFIG_HOSTAPD_MLME		
+				rtw_hostapd_mlme_rx(padapter, precv_frame);		
+#else
+				_mgt_dispatcher(padapter, ptable, precv_frame);
+#endif
+			}
+			else
+				_mgt_dispatcher(padapter, ptable, precv_frame);
+			break;
+		case WIFI_BEACON:			
+			_mgt_dispatcher(padapter, ptable, precv_frame);
+			break;
+		case WIFI_ACTION:
+			//if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+			_mgt_dispatcher(padapter, ptable, precv_frame);		
+			break;
+		default:
+			_mgt_dispatcher(padapter, ptable, precv_frame);	
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+				rtw_hostapd_mlme_rx(padapter, precv_frame);			
+			break;
+	}
+#else
+
+	_mgt_dispatcher(padapter, ptable, precv_frame);	
+	
+#endif
+
+}
+
+#ifdef CONFIG_P2P
+u32 p2p_listen_state_process(_adapter *padapter, unsigned char *da)
+{
+	bool response = _TRUE;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+	{
+		if (wdev_to_priv(padapter->rtw_wdev)->p2p_enabled == _FALSE
+			|| padapter->mlmepriv.wps_probe_resp_ie == NULL
+			|| padapter->mlmepriv.p2p_probe_resp_ie == NULL
+		)
+		{
+			DBG_871X("DON'T issue_probersp_p2p: p2p_enabled:%d, wps_probe_resp_ie:%p, p2p_probe_resp_ie:%p\n",
+				wdev_to_priv(padapter->rtw_wdev)->p2p_enabled,
+				padapter->mlmepriv.wps_probe_resp_ie,
+				padapter->mlmepriv.p2p_probe_resp_ie);
+			response = _FALSE;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	if( padapter->wdinfo.driver_interface == DRIVER_WEXT )
+	{
+		//	do nothing if the device name is empty
+		if ( !padapter->wdinfo.device_name_len )
+		{
+			response	= _FALSE;
+		}
+	}
+
+	if (response == _TRUE)
+		issue_probersp_p2p( padapter, da);
+	
+	return _SUCCESS;
+}
+#endif //CONFIG_P2P
+
+
+/****************************************************************************
+
+Following are the callback functions for each subtype of the management frames
+
+*****************************************************************************/
+
+unsigned int OnProbeReq(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int	ielen;
+	unsigned char	*p;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 	*cur = &(pmlmeinfo->network);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	u8 is_valid_p2p_probereq = _FALSE;
+
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	struct rx_pkt_attrib	*pattrib = &precv_frame->u.hdr.attrib;
+	u8 wifi_test_chk_rate = 1;
+	
+	if (	!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) && 
+		!rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE) && 
+		!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) &&
+		!rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH) &&
+		!rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN)
+	   )
+	{
+		//	Commented by Albert 2011/03/17
+		//	mcs_rate = 0 -> CCK 1M rate
+		//	mcs_rate = 1 -> CCK 2M rate
+		//	mcs_rate = 2 -> CCK 5.5M rate
+		//	mcs_rate = 3 -> CCK 11M rate
+		//	In the P2P mode, the driver should not support the CCK rate
+
+		//	Commented by Kurt 2012/10/16
+		//	IOT issue: Google Nexus7 use 1M rate to send p2p_probe_req after GO nego completed and Nexus7 is client
+#ifdef CONFIG_WIFI_TEST
+		if ( pattrib->mcs_rate <= 3 )
+		{
+			wifi_test_chk_rate = 0;
+		}
+#endif //CONFIG_WIFI_TEST
+
+		if( wifi_test_chk_rate == 1 )
+		{
+			if((is_valid_p2p_probereq = process_probe_req_p2p_ie(pwdinfo, pframe, len)) == _TRUE)
+			{
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE))
+				{
+					p2p_listen_state_process( padapter,  get_sa(pframe));
+
+					return _SUCCESS;	
+				}
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					goto _continue;
+				}
+			}
+		}
+	}
+
+_continue:
+#endif //CONFIG_P2P
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE))
+	{
+		return _SUCCESS;
+	}
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE && 
+		check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE)==_FALSE)
+	{
+		return _SUCCESS;
+	}
+
+
+	//DBG_871X("+OnProbeReq\n");
+
+#ifdef CONFIG_AUTO_AP_MODE
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE &&
+			pmlmepriv->cur_network.join_res == _TRUE)
+	{
+		_irqL	irqL;
+		struct sta_info	*psta;
+		u8 *mac_addr, *peer_addr;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+		u8 RC_OUI[4]={0x00,0xE0,0x4C,0x0A};
+		//EID[1] + EID_LEN[1] + RC_OUI[4] + MAC[6] + PairingID[2] + ChannelNum[2]
+
+		p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, (int *)&ielen,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+		if(!p || ielen !=14)
+			goto _non_rc_device;
+
+		if(!_rtw_memcmp(p+2, RC_OUI, sizeof(RC_OUI)))
+			goto _non_rc_device;
+
+		if(!_rtw_memcmp(p+6, get_sa(pframe), ETH_ALEN))
+		{
+			DBG_871X("%s, do rc pairing ("MAC_FMT"), but mac addr mismatch!("MAC_FMT")\n", __FUNCTION__,
+				MAC_ARG(get_sa(pframe)), MAC_ARG(p+6));
+
+			goto _non_rc_device;
+		}
+
+		DBG_871X("%s, got the pairing device("MAC_FMT")\n", __FUNCTION__,  MAC_ARG(get_sa(pframe)));
+
+		//new a station
+		psta = rtw_get_stainfo(pstapriv, get_sa(pframe));
+		if (psta == NULL)
+		{
+			// allocate a new one
+			DBG_871X("going to alloc stainfo for rc="MAC_FMT"\n",  MAC_ARG(get_sa(pframe)));
+			psta = rtw_alloc_stainfo(pstapriv, get_sa(pframe));
+			if (psta == NULL)
+			{
+				//TODO:
+				DBG_871X(" Exceed the upper limit of supported clients...\n");
+				return _SUCCESS;
+			}
+
+			_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+			if (rtw_is_list_empty(&psta->asoc_list))
+			{
+				psta->expire_to = pstapriv->expire_to;
+				rtw_list_insert_tail(&psta->asoc_list, &pstapriv->asoc_list);
+				pstapriv->asoc_list_cnt++;
+			}
+			_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+			//generate pairing ID
+			mac_addr = myid(&(padapter->eeprompriv));
+			peer_addr = psta->hwaddr;
+			psta->pid = (u16)(((mac_addr[4]<<8) + mac_addr[5]) + ((peer_addr[4]<<8) + peer_addr[5]));
+
+			//update peer stainfo
+			psta->isrc = _TRUE;
+			//psta->aid = 0;
+			//psta->mac_id = 2;
+
+			/* get a unique AID */
+			if (psta->aid > 0) {
+				DBG_871X("old AID %d\n", psta->aid);
+			} else {
+				for (psta->aid = 1; psta->aid <= NUM_STA; psta->aid++)
+					if (pstapriv->sta_aid[psta->aid - 1] == NULL)
+						break;
+
+				if (psta->aid > pstapriv->max_num_sta) {
+					psta->aid = 0;
+					DBG_871X("no room for more AIDs\n");
+					return _SUCCESS;
+				} else {
+					pstapriv->sta_aid[psta->aid - 1] = psta;
+					DBG_871X("allocate new AID = (%d)\n", psta->aid);
+				}
+			}
+			
+			psta->qos_option = 1;
+			psta->htpriv.ht_option = _TRUE;
+			psta->ieee8021x_blocked = _FALSE;
+			psta->htpriv.ampdu_enable = _FALSE;
+			psta->htpriv.sgi = _FALSE;
+			psta->htpriv.bwmode = HT_CHANNEL_WIDTH_20;
+			psta->htpriv.ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+			//rtw_hal_set_odm_var(padapter, HAL_ODM_STA_INFO, psta, _TRUE);
+
+			psta->htpriv.agg_enable_bitmap = 0x0;//reset
+			psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+
+			_rtw_memset((void*)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
+
+			_enter_critical_bh(&psta->lock, &irqL);
+			psta->state |= _FW_LINKED;
+			_exit_critical_bh(&psta->lock, &irqL);
+
+			report_add_sta_event(padapter, psta->hwaddr, psta->aid);
+
+		}
+
+		issue_probersp(padapter, get_sa(pframe), _FALSE);
+
+		return _SUCCESS;
+
+	}
+
+_non_rc_device:
+
+	return _SUCCESS;
+#endif //CONFIG_AUTO_AP_MODE
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+		check_buddy_fwstate(padapter, _FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		//don't process probe req
+		return _SUCCESS;
+	}
+#endif		
+
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ielen,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+
+	//check (wildcard) SSID 
+	if (p != NULL)
+	{
+		if(is_valid_p2p_probereq == _TRUE)
+		{
+			goto _issue_probersp;
+		}
+
+		if ( (ielen != 0 && _FALSE ==_rtw_memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength))
+			|| (ielen == 0 && pmlmeinfo->hidden_ssid_mode)
+		)
+		{
+			return _SUCCESS;
+		}
+
+_issue_probersp:
+
+		if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE && 
+			pmlmepriv->cur_network.join_res == _TRUE)
+		{
+			//DBG_871X("+issue_probersp during ap mode\n");
+			issue_probersp(padapter, get_sa(pframe), is_valid_p2p_probereq);		
+		}
+
+	}
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnProbeRsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct sta_info		*psta;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	u8	*pframe = precv_frame->u.hdr.rx_data;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &padapter->wdinfo;
+#endif
+
+
+#ifdef CONFIG_P2P
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+	{
+		if ( _TRUE == pwdinfo->tx_prov_disc_info.benable )
+		{
+			if( _rtw_memcmp( pwdinfo->tx_prov_disc_info.peerIFAddr, GetAddr2Ptr(pframe), ETH_ALEN ) )
+			{
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT))
+				{
+					pwdinfo->tx_prov_disc_info.benable = _FALSE;
+					issue_p2p_provision_request( padapter,
+												pwdinfo->tx_prov_disc_info.ssid.Ssid, 
+												pwdinfo->tx_prov_disc_info.ssid.SsidLength,
+												pwdinfo->tx_prov_disc_info.peerDevAddr );
+				}
+				else if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) || rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+				{
+					pwdinfo->tx_prov_disc_info.benable = _FALSE;
+					issue_p2p_provision_request( padapter,
+												NULL, 
+												0,
+												pwdinfo->tx_prov_disc_info.peerDevAddr );
+				}
+			}		
+		}
+		return _SUCCESS;
+	}
+	else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+	{
+		if ( _TRUE == pwdinfo->nego_req_info.benable )
+		{
+			DBG_871X( "[%s] P2P State is GONEGO ING!\n", __FUNCTION__ );
+			if( _rtw_memcmp( pwdinfo->nego_req_info.peerDevAddr, GetAddr2Ptr(pframe), ETH_ALEN ) )
+			{
+				pwdinfo->nego_req_info.benable = _FALSE;
+				issue_p2p_GO_request( padapter, pwdinfo->nego_req_info.peerDevAddr);
+			}
+		}
+	}
+	else if( rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_INVITE_REQ ) )
+	{
+		if ( _TRUE == pwdinfo->invitereq_info.benable )
+		{
+			DBG_871X( "[%s] P2P_STATE_TX_INVITE_REQ!\n", __FUNCTION__ );
+			if( _rtw_memcmp( pwdinfo->invitereq_info.peer_macaddr, GetAddr2Ptr(pframe), ETH_ALEN ) )
+			{
+				pwdinfo->invitereq_info.benable = _FALSE;
+				issue_p2p_invitation_request( padapter, pwdinfo->invitereq_info.peer_macaddr );
+			}
+		}
+	}
+#endif
+
+
+	if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+	{
+		report_survey_event(padapter, precv_frame);	
+#ifdef CONFIG_CONCURRENT_MODE
+		report_survey_event(padapter->pbuddy_adapter, precv_frame);	
+#endif
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		dc_report_survey_event(padapter, precv_frame);
+#endif
+		return _SUCCESS;
+	}
+
+	#if 0 //move to validate_recv_mgnt_frame
+	if (_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
+	{
+		if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+		{
+			if ((psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe))) != NULL)
+			{
+				psta->sta_stats.rx_mgnt_pkts++;
+			}
+		}
+	}
+	#endif
+	
+	return _SUCCESS;
+	
+}
+
+unsigned int OnBeacon(_adapter *padapter, union recv_frame *precv_frame)
+{
+	int cam_idx;
+	struct sta_info	*psta;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv	*pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	u8 *p = NULL;
+	u32 ielen = 0;
+
+#ifdef CONFIG_ATTEMPT_TO_FIX_AP_BEACON_ERROR
+	p = rtw_get_ie(pframe + sizeof(struct rtw_ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ielen, precv_frame->u.hdr.len -sizeof(struct rtw_ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_);
+	if ((p != NULL) && (ielen > 0))
+	{
+		if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D))
+		{
+			/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */	
+		       	DBG_871X("[WIFIDBG] Error in ESR IE is detected in Beacon of BSSID:"MAC_FMT". Fix the length of ESR IE to avoid failed Beacon parsing.\n", MAC_ARG(GetAddr3Ptr(pframe)));
+		       	*(p + 1) = ielen - 1;
+		}
+	}
+#endif
+
+	if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+	{
+		report_survey_event(padapter, precv_frame);
+#ifdef CONFIG_CONCURRENT_MODE
+		report_survey_event(padapter->pbuddy_adapter, precv_frame);	
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		dc_report_survey_event(padapter, precv_frame);
+#endif
+
+		return _SUCCESS;
+	}
+
+	if (_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
+	{
+		if (pmlmeinfo->state & WIFI_FW_AUTH_NULL)
+		{
+			//check the vendor of the assoc AP
+			pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct rtw_ieee80211_hdr_3addr), len-sizeof(struct rtw_ieee80211_hdr_3addr));				
+#ifdef CONFIG_P2P_PS
+			// do P2P PS Before link ? , ToDo
+			//process_p2p_ps_ie(padapter, (pframe + WLAN_HDR_A3_LEN), (len - WLAN_HDR_A3_LEN));
+#endif // CONFIG_P2P_PS
+
+			//update TSF Value
+			update_TSF(pmlmeext, pframe, len);
+
+			//start auth
+			start_clnt_auth(padapter);
+
+			return _SUCCESS;
+		}
+
+		if(((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
+		{
+			if ((psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe))) != NULL)
+			{
+				#ifdef CONFIG_PATCH_JOIN_WRONG_CHANNEL        
+				//Merge from 8712 FW code
+				if (cmp_pkt_chnl_diff(padapter,pframe,len) != 0)        
+				{            // join wrong channel, deauth and reconnect           
+					issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
+
+					report_del_sta_event(padapter,(&(pmlmeinfo->network))->MacAddress, WLAN_REASON_JOIN_WRONG_CHANNEL);    		
+					pmlmeinfo->state &= (~WIFI_FW_ASSOC_SUCCESS);    		
+					return _SUCCESS;
+				}        
+				#endif //CONFIG_PATCH_JOIN_WRONG_CHANNEL
+
+				//update WMM, ERP in the beacon
+				//todo: the timer is used instead of the number of the beacon received
+				if ((sta_rx_pkts(psta) & 0xf) == 0)
+				{
+					//DBG_871X("update_bcn_info\n");
+					update_beacon_info(padapter, pframe, len, psta);
+				}
+				
+#ifdef CONFIG_DFS
+				process_csa_ie(padapter, pframe, len);	//channel switch announcement
+#endif //CONFIG_DFS
+
+#ifdef CONFIG_P2P_PS
+				//if(psta->ieee8021x_blocked == _FALSE) // do not allow P2P PS during EAPOL handshake ?
+				process_p2p_ps_ie(padapter, (pframe + WLAN_HDR_A3_LEN), (len - WLAN_HDR_A3_LEN));
+#endif //CONFIG_P2P_PS
+
+				#if 0 //move to validate_recv_mgnt_frame
+				psta->sta_stats.rx_mgnt_pkts++;
+				#endif
+			}
+		}
+		else if((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+		{
+			if ((psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe))) != NULL)
+			{
+				//update WMM, ERP in the beacon
+				//todo: the timer is used instead of the number of the beacon received
+				if ((sta_rx_pkts(psta) & 0xf) == 0)
+				{
+					//DBG_871X("update_bcn_info\n");
+					update_beacon_info(padapter, pframe, len, psta);
+				}
+
+				#if 0 //move to validate_recv_mgnt_frame
+				psta->sta_stats.rx_mgnt_pkts++;
+				#endif
+			}
+			else
+			{
+				//allocate a new CAM entry for IBSS station
+				if ((cam_idx = allocate_fw_sta_entry(padapter)) == NUM_STA)
+				{
+					goto _END_ONBEACON_;
+				}
+
+				//get supported rate
+				if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL)
+				{
+					pmlmeinfo->FW_sta_info[cam_idx].status = 0;
+					goto _END_ONBEACON_;
+				}
+
+				//update TSF Value
+				update_TSF(pmlmeext, pframe, len);			
+
+				//report sta add event
+				report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
+			}
+		}
+	}
+
+_END_ONBEACON_:
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnAuth(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	_irqL irqL;
+	unsigned int	auth_mode, seq, ie_len;	
+	unsigned char	*sa, *p;	
+	u16	algorithm;
+	int	status;
+	static struct sta_info stat;	
+	struct	sta_info	*pstat=NULL;	
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data; 
+	uint len = precv_frame->u.hdr.len;
+
+	
+#ifdef CONFIG_CONCURRENT_MODE	
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+		check_buddy_fwstate(padapter, _FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		//don't process auth request;
+		return _SUCCESS;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return _FAIL;
+
+	DBG_871X("+OnAuth\n");
+	
+	sa = GetAddr2Ptr(pframe);
+	
+	auth_mode = psecuritypriv->dot11AuthAlgrthm;
+	seq = cpu_to_le16(*(u16*)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + 2));
+	algorithm = cpu_to_le16(*(u16*)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN));
+
+	if (GetPrivacy(pframe))
+	{	
+#if 0 //TODO: SW rtw_wep_decrypt
+		if (SWCRYPTO)
+		{
+			status = rtw_wep_decrypt(priv, pframe, pfrinfo->pktlen,
+				priv->pmib->dot1180211AuthEntry.dot11PrivacyAlgrthm);
+			if (status == FALSE)
+			{
+				SAVE_INT_AND_CLI(flags);
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"wep-decrypt a Auth frame error!\n");
+				status = _STATS_CHALLENGE_FAIL_;
+				goto auth_fail;
+			}
+		}
+
+		seq = cpu_to_le16(*(unsigned short *)((unsigned int)pframe + WLAN_HDR_A3_LEN + 4 + 2));
+		algorithm = cpu_to_le16(*(unsigned short *)((unsigned int)pframe + WLAN_HDR_A3_LEN + 4));
+#endif
+	}
+
+
+	DBG_871X("auth alg=%x, seq=%X\n", algorithm, seq);
+
+	if (auth_mode == 2 &&
+			psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
+			psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
+		auth_mode = 0;
+
+	if ((algorithm > 0 && auth_mode == 0) ||	// rx a shared-key auth but shared not enabled
+		(algorithm == 0 && auth_mode == 1) )	// rx a open-system auth but shared-key is enabled
+	{		
+		DBG_871X("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
+			algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
+		
+		status = _STATS_NO_SUPP_ALG_;
+		
+		goto auth_fail;
+	}
+	
+#if 0 //ACL control	
+	phead = &priv->wlan_acl_list;
+	plist = phead->next;
+	//check sa
+	if (acl_mode == 1)		// 1: positive check, only those on acl_list can be connected.
+		res = FAIL;
+	else
+		res = SUCCESS;
+
+	while(plist != phead)
+	{
+		paclnode = list_entry(plist, struct rtw_wlan_acl_node, list);
+		plist = plist->next;
+		if (!memcmp((void *)sa, paclnode->addr, 6)) {
+			if (paclnode->mode & 2) { // deny
+				res = FAIL;
+				break;
+			}
+			else {
+				res = SUCCESS;
+				break;
+			}
+		}
+	}
+
+	if (res != SUCCESS) {
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"auth abort because ACL!\n");
+		return FAIL;
+	}
+#else
+	if(rtw_access_ctrl(padapter, sa) == _FALSE)
+	{
+		status = _STATS_UNABLE_HANDLE_STA_;
+		goto auth_fail;
+	}	
+#endif
+
+	pstat = rtw_get_stainfo(pstapriv, sa);
+	if (pstat == NULL)
+	{
+		// allocate a new one
+		DBG_871X("going to alloc stainfo for sa="MAC_FMT"\n",  MAC_ARG(sa));
+		pstat = rtw_alloc_stainfo(pstapriv, sa);
+		if (pstat == NULL)
+		{
+			DBG_871X(" Exceed the upper limit of supported clients...\n");
+			status = _STATS_UNABLE_HANDLE_STA_;
+			goto auth_fail;
+		}
+		
+		pstat->state = WIFI_FW_AUTH_NULL;
+		pstat->auth_seq = 0;
+		
+		//pstat->flags = 0;
+		//pstat->capability = 0;
+	}
+	else
+	{		
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		if(rtw_is_list_empty(&pstat->asoc_list)==_FALSE)
+		{			
+			rtw_list_delete(&pstat->asoc_list);
+			pstapriv->asoc_list_cnt--;
+			if (pstat->expire_to > 0)
+			{
+				//TODO: STA re_auth within expire_to
+			}
+		}
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		
+		if (seq==1) {
+			//TODO: STA re_auth and auth timeout 
+		}
+	}
+
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+	if (rtw_is_list_empty(&pstat->auth_list))
+	{		
+		rtw_list_insert_tail(&pstat->auth_list, &pstapriv->auth_list);
+		pstapriv->auth_list_cnt++;
+	}	
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	if (pstat->auth_seq == 0)
+		pstat->expire_to = pstapriv->auth_to;
+
+	if ((pstat->auth_seq + 1) != seq)
+	{
+		DBG_871X("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
+			seq, pstat->auth_seq+1);
+		status = _STATS_OUT_OF_AUTH_SEQ_;
+		goto auth_fail;
+	}
+
+	if (algorithm==0 && (auth_mode == 0 || auth_mode == 2))
+	{
+		if (seq == 1)
+		{
+			pstat->state &= ~WIFI_FW_AUTH_NULL;
+			pstat->state |= WIFI_FW_AUTH_SUCCESS;
+			pstat->expire_to = pstapriv->assoc_to;
+			pstat->authalg = algorithm;
+		}
+		else
+		{
+			DBG_871X("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
+				seq, pstat->auth_seq+1);
+			status = _STATS_OUT_OF_AUTH_SEQ_;
+			goto auth_fail;
+		}
+	}
+	else // shared system or auto authentication
+	{
+		if (seq == 1)
+		{
+			//prepare for the challenging txt...
+			
+			//get_random_bytes((void *)pstat->chg_txt, 128);//TODO:
+			
+			pstat->state &= ~WIFI_FW_AUTH_NULL;
+			pstat->state |= WIFI_FW_AUTH_STATE;
+			pstat->authalg = algorithm;
+			pstat->auth_seq = 2;
+		}
+		else if (seq == 3)
+		{
+			//checking for challenging txt...
+			DBG_871X("checking for challenging txt...\n");
+			
+			p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_ , _CHLGETXT_IE_, (int *)&ie_len,
+					len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
+
+			if((p==NULL) || (ie_len<=0))
+			{
+				DBG_871X("auth rejected because challenge failure!(1)\n");
+				status = _STATS_CHALLENGE_FAIL_;
+				goto auth_fail;
+			}
+			
+			if (_rtw_memcmp((void *)(p + 2), pstat->chg_txt, 128))
+			{
+				pstat->state &= (~WIFI_FW_AUTH_STATE);
+				pstat->state |= WIFI_FW_AUTH_SUCCESS;
+				// challenging txt is correct...
+				pstat->expire_to =  pstapriv->assoc_to;
+			}
+			else
+			{
+				DBG_871X("auth rejected because challenge failure!\n");
+				status = _STATS_CHALLENGE_FAIL_;
+				goto auth_fail;
+			}
+		}
+		else
+		{
+			DBG_871X("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
+				seq, pstat->auth_seq+1);
+			status = _STATS_OUT_OF_AUTH_SEQ_;
+			goto auth_fail;
+		}
+	}
+
+
+	// Now, we are going to issue_auth...
+	pstat->auth_seq = seq + 1;	
+	
+#ifdef CONFIG_NATIVEAP_MLME
+	issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
+#endif
+
+	if (pstat->state & WIFI_FW_AUTH_SUCCESS)
+		pstat->auth_seq = 0;
+
+		
+	return _SUCCESS;
+
+auth_fail:
+
+	if(pstat)
+		rtw_free_stainfo(padapter , pstat);
+	
+	pstat = &stat;
+	_rtw_memset((char *)pstat, '\0', sizeof(stat));
+	pstat->auth_seq = 2;
+	_rtw_memcpy(pstat->hwaddr, sa, 6);	
+	
+#ifdef CONFIG_NATIVEAP_MLME
+	issue_auth(padapter, pstat, (unsigned short)status);	
+#endif
+
+#endif
+	return _FAIL;
+
+}
+
+unsigned int OnAuthClient(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int	seq, len, status, algthm, offset;
+	unsigned char	*p;
+	unsigned int	go2asoc = 0;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint pkt_len = precv_frame->u.hdr.len;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//check A1 matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
+		return _SUCCESS;
+
+	if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
+		return _SUCCESS;
+
+	offset = (GetPrivacy(pframe))? 4: 0;
+
+	algthm 	= le16_to_cpu(*(unsigned short *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset));
+	seq 	= le16_to_cpu(*(unsigned short *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
+	status 	= le16_to_cpu(*(unsigned short *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 4));
+
+	if (status != 0)
+	{
+		DBG_871X("clnt auth fail, status: %d\n", status);
+		if(status == 13)//&& pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto)
+		{
+			if(pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
+				pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
+			else
+				pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
+			//pmlmeinfo->reauth_count = 0;
+		}
+		
+		set_link_timer(pmlmeext, 1);
+		goto authclnt_fail;
+	}
+
+	if (seq == 2)
+	{
+		if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
+		{
+			 // legendary shared system
+			p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&len,
+				pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
+
+			if (p == NULL)
+			{
+				//DBG_871X("marc: no challenge text?\n");
+				goto authclnt_fail;
+			}
+
+			_rtw_memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
+			pmlmeinfo->auth_seq = 3;
+			issue_auth(padapter, NULL, 0);
+			set_link_timer(pmlmeext, REAUTH_TO);
+
+			return _SUCCESS;
+		}
+		else
+		{
+			// open system
+			go2asoc = 1;
+		}
+	}
+	else if (seq == 4)
+	{
+		if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
+		{
+			go2asoc = 1;
+		}
+		else
+		{
+			goto authclnt_fail;
+		}
+	}
+	else
+	{
+		// this is also illegal
+		//DBG_871X("marc: clnt auth failed due to illegal seq=%x\n", seq);
+		goto authclnt_fail;
+	}
+
+	if (go2asoc)
+	{
+		start_clnt_assoc(padapter);
+		return _SUCCESS;
+	}
+
+authclnt_fail:
+
+	//pmlmeinfo->state &= ~(WIFI_FW_AUTH_STATE);
+
+	return _FAIL;
+
+}
+
+unsigned int OnAssocReq(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	_irqL irqL;
+	u16 capab_info, listen_interval;
+	struct rtw_ieee802_11_elems elems;	
+	struct sta_info	*pstat;
+	unsigned char		reassoc, *p, *pos, *wpa_ie;
+	unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
+	int		i, ie_len, wpa_ie_len, left;
+	unsigned char		supportRate[16];
+	int					supportRateNum;
+	unsigned short		status = _STATS_SUCCESSFUL_;
+	unsigned short		frame_type, ie_offset=0;	
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);	
+	WLAN_BSSID_EX 	*cur = &(pmlmeinfo->network);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint pkt_len = precv_frame->u.hdr.len;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8 p2p_status_code = P2P_STATUS_SUCCESS;
+	u8 *p2pie;
+	u32 p2pielen = 0;
+#ifdef CONFIG_WFD
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+#endif // CONFIG_WFD
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+		check_buddy_fwstate(padapter, _FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		//don't process assoc request;
+		return _SUCCESS;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return _FAIL;
+	
+	frame_type = GetFrameSubType(pframe);
+	if (frame_type == WIFI_ASSOCREQ)
+	{
+		reassoc = 0;
+		ie_offset = _ASOCREQ_IE_OFFSET_;
+	}	
+	else // WIFI_REASSOCREQ
+	{
+		reassoc = 1;
+		ie_offset = _REASOCREQ_IE_OFFSET_;
+	}
+	
+
+	if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
+		DBG_871X("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
+		       "\n", reassoc, (unsigned long)pkt_len);
+		return _FAIL;
+	}
+	
+	pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+	if (pstat == (struct sta_info *)NULL)
+	{
+		status = _RSON_CLS2_;
+		goto asoc_class2_error;
+	}
+
+	capab_info = RTW_GET_LE16(pframe + WLAN_HDR_A3_LEN);
+	//capab_info = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));	
+	//listen_interval = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN+2));
+	listen_interval = RTW_GET_LE16(pframe + WLAN_HDR_A3_LEN+2);
+
+	left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
+	pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
+	
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	// check if this stat has been successfully authenticated/assocated
+	if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS))
+	{
+		if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS))
+		{
+			status = _RSON_CLS2_;
+			goto asoc_class2_error;
+		}
+		else
+		{
+			pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
+			pstat->state |= WIFI_FW_ASSOC_STATE;				
+		}
+	}
+	else
+	{
+		pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
+		pstat->state |= WIFI_FW_ASSOC_STATE;
+	}
+
+
+#if 0// todo:tkip_countermeasures
+	if (hapd->tkip_countermeasures) {
+		resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
+		goto fail;
+	}
+#endif
+
+	pstat->capability = capab_info;
+
+#if 0//todo:
+	//check listen_interval
+	if (listen_interval > hapd->conf->max_listen_interval) {
+		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG,
+			       "Too large Listen Interval (%d)",
+			       listen_interval);
+		resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
+		goto fail;
+	}
+	
+	pstat->listen_interval = listen_interval;
+#endif
+
+	//now parse all ieee802_11 ie to point to elems
+	if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
+	    !elems.ssid) {
+		DBG_871X("STA " MAC_FMT " sent invalid association request\n",
+		       MAC_ARG(pstat->hwaddr));
+		status = _STATS_FAILURE_;		
+		goto OnAssocReqFail;
+	}
+
+
+	// now we should check all the fields...
+	// checking SSID
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
+		pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+	if (p == NULL)
+	{
+		status = _STATS_FAILURE_;		
+	}
+
+	if (ie_len == 0) // broadcast ssid, however it is not allowed in assocreq
+		status = _STATS_FAILURE_;
+	else
+	{
+		// check if ssid match
+		if (!_rtw_memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
+			status = _STATS_FAILURE_;
+
+		if (ie_len != cur->Ssid.SsidLength)
+			status = _STATS_FAILURE_;
+	}
+
+	if(_STATS_SUCCESSFUL_ != status)
+		goto OnAssocReqFail;
+
+	// check if the supported rate is ok
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+	if (p == NULL) {
+		DBG_871X("Rx a sta assoc-req which supported rate is empty!\n");
+		// use our own rate set as statoin used
+		//_rtw_memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN);
+		//supportRateNum = AP_BSSRATE_LEN;
+		
+		status = _STATS_FAILURE_;
+		goto OnAssocReqFail;
+	}
+	else {
+		_rtw_memcpy(supportRate, p+2, ie_len);
+		supportRateNum = ie_len;
+
+		p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_ , &ie_len,
+				pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+		if (p !=  NULL) {
+			
+			if(supportRateNum<=sizeof(supportRate))
+			{
+				_rtw_memcpy(supportRate+supportRateNum, p+2, ie_len);
+				supportRateNum += ie_len;
+			}			
+		}
+	}
+
+	//todo: mask supportRate between AP & STA -> move to update raid
+	//get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0);
+
+	//update station supportRate	
+	pstat->bssratelen = supportRateNum;
+	_rtw_memcpy(pstat->bssrateset, supportRate, supportRateNum);
+
+
+	//check RSN/WPA/WPS
+	pstat->dot8021xalg = 0;
+      	pstat->wpa_psk = 0;
+	pstat->wpa_group_cipher = 0;
+	pstat->wpa2_group_cipher = 0;
+	pstat->wpa_pairwise_cipher = 0;
+	pstat->wpa2_pairwise_cipher = 0;
+	_rtw_memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
+	if((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
+
+		int group_cipher=0, pairwise_cipher=0;	
+		
+		wpa_ie = elems.rsn_ie;
+		wpa_ie_len = elems.rsn_ie_len;
+
+		if(rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			pstat->dot8021xalg = 1;//psk,  todo:802.1x						
+			pstat->wpa_psk |= BIT(1);
+
+			pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;				
+			pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
+			
+			if(!pstat->wpa2_group_cipher)
+				status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
+
+			if(!pstat->wpa2_pairwise_cipher)
+				status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
+		}
+		else
+		{
+			status = WLAN_STATUS_INVALID_IE;
+		}	
+			
+	} else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
+
+		int group_cipher=0, pairwise_cipher=0;	
+		
+		wpa_ie = elems.wpa_ie;
+		wpa_ie_len = elems.wpa_ie_len;
+
+		if(rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			pstat->dot8021xalg = 1;//psk,  todo:802.1x						
+			pstat->wpa_psk |= BIT(0);
+
+			pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;				
+			pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
+			
+			if(!pstat->wpa_group_cipher)
+				status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
+
+			if(!pstat->wpa_pairwise_cipher)
+				status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
+		
+		}
+		else
+		{
+			status = WLAN_STATUS_INVALID_IE;
+		}
+		
+	} else {
+		wpa_ie = NULL;
+		wpa_ie_len = 0;
+	}
+
+	if(_STATS_SUCCESSFUL_ != status)
+		goto OnAssocReqFail;
+
+	pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
+	//if (hapd->conf->wps_state && wpa_ie == NULL) { //todo: to check ap if supporting WPS
+	if(wpa_ie == NULL) {
+		if (elems.wps_ie) {
+			DBG_871X("STA included WPS IE in "
+				   "(Re)Association Request - assume WPS is "
+				   "used\n");
+			pstat->flags |= WLAN_STA_WPS;
+			//wpabuf_free(sta->wps_ie);
+			//sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4,
+			//				elems.wps_ie_len - 4);
+		} else {
+			DBG_871X("STA did not include WPA/RSN IE "
+				   "in (Re)Association Request - possible WPS "
+				   "use\n");
+			pstat->flags |= WLAN_STA_MAYBE_WPS;
+		}
+
+
+		// AP support WPA/RSN, and sta is going to do WPS, but AP is not ready
+		// that the selected registrar of AP is _FLASE
+		if((psecuritypriv->wpa_psk >0)  
+			&& (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS)))
+		{
+			if(pmlmepriv->wps_beacon_ie)
+			{	
+				u8 selected_registrar = 0;
+				
+				rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR , &selected_registrar, NULL);
+
+				if(!selected_registrar)
+				{						
+					DBG_871X("selected_registrar is _FALSE , or AP is not ready to do WPS\n");
+						
+					status = _STATS_UNABLE_HANDLE_STA_;
+			
+					goto OnAssocReqFail;
+				}						
+			}			
+		}
+			
+	}
+	else
+	{
+		int copy_len;
+
+		if(psecuritypriv->wpa_psk == 0)
+		{
+			DBG_871X("STA " MAC_FMT ": WPA/RSN IE in association "
+		       	"request, but AP don't support WPA/RSN\n", MAC_ARG(pstat->hwaddr));
+			
+			status = WLAN_STATUS_INVALID_IE;
+			
+			goto OnAssocReqFail;
+
+		}
+
+		if (elems.wps_ie) {
+			DBG_871X("STA included WPS IE in "
+				   "(Re)Association Request - WPS is "
+				   "used\n");
+			pstat->flags |= WLAN_STA_WPS;
+			copy_len=0;
+		}
+		else
+		{
+			copy_len = ((wpa_ie_len+2) > sizeof(pstat->wpa_ie)) ? (sizeof(pstat->wpa_ie)):(wpa_ie_len+2);
+		}
+
+		
+		if(copy_len>0)
+			_rtw_memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
+		
+	}
+
+
+	// check if there is WMM IE & support WWM-PS
+	pstat->flags &= ~WLAN_STA_WME;
+	pstat->qos_option = 0;
+	pstat->qos_info = 0;
+	pstat->has_legacy_ac = _TRUE;
+	pstat->uapsd_vo = 0;
+	pstat->uapsd_vi = 0;
+	pstat->uapsd_be = 0;
+	pstat->uapsd_bk = 0;
+	if (pmlmepriv->qospriv.qos_option) 
+	{
+		p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
+		for (;;) 
+		{
+			p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+			if (p != NULL) {
+				if (_rtw_memcmp(p+2, WMM_IE, 6)) {
+
+					pstat->flags |= WLAN_STA_WME;
+					
+					pstat->qos_option = 1;				
+					pstat->qos_info = *(p+8);
+					
+					pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
+
+					if((pstat->qos_info&0xf) !=0xf)
+						pstat->has_legacy_ac = _TRUE;
+					else
+						pstat->has_legacy_ac = _FALSE;
+					
+					if(pstat->qos_info&0xf)
+					{
+						if(pstat->qos_info&BIT(0))
+							pstat->uapsd_vo = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_vo = 0;
+		
+						if(pstat->qos_info&BIT(1))
+							pstat->uapsd_vi = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_vi = 0;
+			
+						if(pstat->qos_info&BIT(2))
+							pstat->uapsd_bk = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_bk = 0;
+			
+						if(pstat->qos_info&BIT(3))			
+							pstat->uapsd_be = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_be = 0;
+		
+					}
+	
+					break;
+				}
+			}
+			else {
+				break;
+			}
+			p = p + ie_len + 2;
+		}
+	}
+
+
+#ifdef CONFIG_80211N_HT
+	/* save HT capabilities in the sta object */
+	_rtw_memset(&pstat->htpriv.ht_cap, 0, sizeof(struct rtw_ieee80211_ht_cap));
+	if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct rtw_ieee80211_ht_cap)) 
+	{
+		pstat->flags |= WLAN_STA_HT;
+		
+		pstat->flags |= WLAN_STA_WME;
+		
+		_rtw_memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct rtw_ieee80211_ht_cap));			
+		
+	} else
+		pstat->flags &= ~WLAN_STA_HT;
+
+	
+	if((pmlmepriv->htpriv.ht_option == _FALSE) && (pstat->flags&WLAN_STA_HT))
+	{
+		status = _STATS_FAILURE_;
+		goto OnAssocReqFail;
+	}
+		
+
+	if ((pstat->flags & WLAN_STA_HT) &&
+		    ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
+		      (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP)))
+	{		    
+		DBG_871X("HT: " MAC_FMT " tried to "
+				   "use TKIP with HT association\n", MAC_ARG(pstat->hwaddr));
+		
+		//status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
+		//goto OnAssocReqFail;
+	}
+#endif /* CONFIG_80211N_HT */
+
+       //
+       //if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)//?
+	pstat->flags |= WLAN_STA_NONERP;	
+	for (i = 0; i < pstat->bssratelen; i++) {
+		if ((pstat->bssrateset[i] & 0x7f) > 22) {
+			pstat->flags &= ~WLAN_STA_NONERP;
+			break;
+		}
+	}
+
+	if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+		pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
+	else
+		pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
+
+	
+	
+	if (status != _STATS_SUCCESSFUL_)
+		goto OnAssocReqFail;
+
+#ifdef CONFIG_P2P
+	pstat->is_p2p_device = _FALSE;
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{		
+		if( (p2pie=rtw_get_p2p_ie(pframe + WLAN_HDR_A3_LEN + ie_offset , pkt_len - WLAN_HDR_A3_LEN - ie_offset , NULL, &p2pielen)))
+		{
+			pstat->is_p2p_device = _TRUE;
+			if((p2p_status_code=(u8)process_assoc_req_p2p_ie(pwdinfo, pframe, pkt_len, pstat))>0)
+			{
+				pstat->p2p_status_code = p2p_status_code;
+				status = _STATS_CAP_FAIL_;
+				goto OnAssocReqFail;
+			}
+		}
+#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(pframe + WLAN_HDR_A3_LEN + ie_offset , pkt_len - WLAN_HDR_A3_LEN - ie_offset , wfd_ie, &wfd_ielen ))
+		{
+			u8	attr_content[ 10 ] = { 0x00 };
+			u32	attr_contentlen = 0;
+
+			DBG_8192C( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+			rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+			if ( attr_contentlen )
+			{
+				pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+				DBG_8192C( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+			}
+		}
+#endif
+	}
+	pstat->p2p_status_code = p2p_status_code;
+#endif //CONFIG_P2P
+
+	//TODO: identify_proprietary_vendor_ie();
+	// Realtek proprietary IE
+	// identify if this is Broadcom sta
+	// identify if this is ralink sta
+	// Customer proprietary IE
+
+	
+
+	/* get a unique AID */
+	if (pstat->aid > 0) {
+		DBG_871X("  old AID %d\n", pstat->aid);
+	} else {
+		for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
+			if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
+				break;
+				
+		//if (pstat->aid > NUM_STA) {
+		if (pstat->aid > pstapriv->max_num_sta) {
+				
+			pstat->aid = 0;
+				
+			DBG_871X("  no room for more AIDs\n");
+
+			status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
+				
+			goto OnAssocReqFail;
+				
+			
+		} else {
+			pstapriv->sta_aid[pstat->aid - 1] = pstat;
+			DBG_871X("allocate new AID = (%d)\n", pstat->aid);
+		}	
+	}
+
+
+	pstat->state &= (~WIFI_FW_ASSOC_STATE);	
+	pstat->state |= WIFI_FW_ASSOC_SUCCESS;
+	
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+	if (!rtw_is_list_empty(&pstat->auth_list))
+	{
+		rtw_list_delete(&pstat->auth_list);
+		pstapriv->auth_list_cnt--;
+	}
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);	
+	if (rtw_is_list_empty(&pstat->asoc_list))
+	{
+		pstat->expire_to = pstapriv->expire_to;
+		rtw_list_insert_tail(&pstat->asoc_list, &pstapriv->asoc_list);
+		pstapriv->asoc_list_cnt++;
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	// now the station is qualified to join our BSS...	
+	if(pstat && (pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_==status))
+	{
+#ifdef CONFIG_NATIVEAP_MLME
+		//.1 bss_cap_update & sta_info_update
+		bss_cap_update_on_sta_join(padapter, pstat);
+		sta_info_update(padapter, pstat);
+
+		//issue assoc rsp before notify station join event.
+		if (frame_type == WIFI_ASSOCREQ)
+			issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
+		else
+			issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
+
+		//.2 - report to upper layer 
+		DBG_871X("indicate_sta_join_event to upper layer - hostapd\n");
+
+#ifdef CONFIG_IOCTL_CFG80211
+		#ifdef COMPAT_KERNEL_RELEASE
+		rtw_cfg80211_indicate_sta_assoc(padapter, pframe, pkt_len);
+		#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		rtw_cfg80211_indicate_sta_assoc(padapter, pframe, pkt_len);
+		#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		_enter_critical_bh(&pstat->lock, &irqL);
+		if(pstat->passoc_req)
+		{
+			rtw_mfree(pstat->passoc_req, pstat->assoc_req_len);
+			pstat->passoc_req = NULL;
+			pstat->assoc_req_len = 0;
+		}
+
+		pstat->passoc_req =  rtw_zmalloc(pkt_len);
+		if(pstat->passoc_req)
+		{
+			_rtw_memcpy(pstat->passoc_req, pframe, pkt_len);
+			pstat->assoc_req_len = pkt_len;
+		}
+		_exit_critical_bh(&pstat->lock, &irqL);		
+		#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+#else
+		rtw_indicate_sta_assoc_event(padapter, pstat);
+#endif //CONFIG_IOCTL_CFG80211
+
+		//.3-(1) report sta add event
+		report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
+		
+/*		
+		//issue assoc rsp before notify station join event.
+		if (frame_type == WIFI_ASSOCREQ)
+			issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
+		else
+			issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
+*/			
+	
+#endif
+	}
+
+	return _SUCCESS;
+
+asoc_class2_error:
+
+#ifdef CONFIG_NATIVEAP_MLME
+	issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
+#endif
+
+	return _FAIL;		
+
+OnAssocReqFail:
+
+
+#ifdef CONFIG_NATIVEAP_MLME
+	pstat->aid = 0;
+	if (frame_type == WIFI_ASSOCREQ)
+		issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
+	else
+		issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
+#endif
+
+
+#endif /* CONFIG_AP_MODE */
+
+	return _FAIL;		
+
+}
+
+unsigned int OnAssocRsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	uint i;
+	int res;
+	unsigned short	status;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	//WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint pkt_len = precv_frame->u.hdr.len;
+
+	DBG_871X("%s\n", __FUNCTION__);
+	
+	//check A1 matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
+		return _SUCCESS;
+
+	if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
+		return _SUCCESS;
+
+	if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+		return _SUCCESS;
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	//status
+	if ((status = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN + 2))) > 0)
+	{
+		DBG_871X("assoc reject, status code: %d\n", status);
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		res = -4;
+		goto report_assoc_result;
+	}
+
+	//get capabilities
+	pmlmeinfo->capability = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+
+	//set slot time
+	pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10))? 9: 20;
+
+	//AID
+	res = pmlmeinfo->aid = (int)(le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
+
+	//following are moved to join event callback function
+	//to handle HT, WMM, rate adaptive, update MAC reg
+	//for not to handle the synchronous IO in the tasklet
+	for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_:
+				if (_rtw_memcmp(pIE->data, WMM_PARA_OUI, 6))	//WMM
+				{
+					WMM_param_handler(padapter, pIE);
+				}
+#if defined(CONFIG_P2P) && defined(CONFIG_WFD)
+				else if ( _rtw_memcmp(pIE->data, WFD_OUI, 4))		//WFD
+				{
+					DBG_871X( "[%s] Found WFD IE\n", __FUNCTION__ );
+					WFD_info_handler( padapter, pIE );
+				}
+#endif				
+				break;
+
+			case _HT_CAPABILITY_IE_:	//HT caps
+				HT_caps_handler(padapter, pIE);
+				break;
+
+			case _HT_EXTRA_INFO_IE_:	//HT info
+				HT_info_handler(padapter, pIE);
+				break;
+
+			case _ERPINFO_IE_:
+				ERP_IE_handler(padapter, pIE);
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
+	pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
+
+	//Update Basic Rate Table for spec, 2010-12-28 , by thomas
+	UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (!rtw_cfg80211_check_bss(padapter)) {
+		DBG_871X("rtw_cfg80211_check_bss() : BSS not found !!\n");
+		res = -2;
+		goto report_assoc_result;
+	}
+#endif
+
+report_assoc_result:
+	if (res > 0) {
+		rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
+	} else {
+		rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
+	}
+
+	report_join_res(padapter, res);
+	return _SUCCESS;
+}
+
+unsigned int OnDeAuth(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned short	reason;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+	//check A3
+	if (!(_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
+		return _SUCCESS;
+
+#ifdef CONFIG_P2P
+	if ( pwdinfo->rx_invitereq_info.scan_op_ch_only )
+	{
+		_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+		_set_timer( &pwdinfo->reset_ch_sitesurvey, 10 );
+	}
+#endif //CONFIG_P2P
+
+	reason = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+
+	DBG_871X("%s Reason code(%d)\n", __FUNCTION__,reason);
+
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{		
+		_irqL irqL;
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+		
+		//_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+		//rtw_free_stainfo(padapter, psta);
+		//_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+
+		DBG_871X("%s, STA:" MAC_FMT "\n", __FUNCTION__, MAC_ARG(GetAddr2Ptr(pframe)));
+
+		psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));	
+		if(psta)
+		{
+			u8 updated = _FALSE;
+		
+			_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+			if(rtw_is_list_empty(&psta->asoc_list)==_FALSE)
+			{			
+				rtw_list_delete(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+				updated = ap_free_sta(padapter, psta, _FALSE, reason);
+
+			}
+			_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+			associated_clients_update(padapter, updated);
+		}
+		
+
+		return _SUCCESS;
+	}
+	else
+#endif
+	{
+		int	ignore_received_deauth = 0;
+
+		//	Commented by Albert 20130604
+		//	Before sending the auth frame to start the STA/GC mode connection with AP/GO, 
+		//	we will send the deauth first.
+		//	However, the Win8.1 with BRCM Wi-Fi will send the deauth with reason code 6 to us after receieving our deauth.
+		//	Added the following code to avoid this case.
+		if ( ( pmlmeinfo->state & WIFI_FW_AUTH_STATE ) ||
+			( pmlmeinfo->state & WIFI_FW_ASSOC_STATE ) )
+		{
+			if ( reason == WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA )
+			{
+				ignore_received_deauth = 1;
+			} else if (WLAN_REASON_PREV_AUTH_NOT_VALID == reason) {
+				// TODO: 802.11r
+				ignore_received_deauth = 1;
+			}
+		}
+
+		DBG_871X("%s, STA:" MAC_FMT ", ignore = %d\n", __FUNCTION__, MAC_ARG(GetAddr3Ptr(pframe)), ignore_received_deauth);
+		if ( 0 == ignore_received_deauth )
+		{
+			receive_disconnect(padapter, GetAddr3Ptr(pframe) ,reason);
+		}
+	}	
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = _FALSE;
+	return _SUCCESS;
+
+}
+
+unsigned int OnDisassoc(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned short	reason;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+	//check A3
+	if (!(_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
+		return _SUCCESS;
+
+#ifdef CONFIG_P2P
+	if ( pwdinfo->rx_invitereq_info.scan_op_ch_only )
+	{
+		_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+		_set_timer( &pwdinfo->reset_ch_sitesurvey, 10 );
+	}
+#endif //CONFIG_P2P
+
+	reason = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+
+        DBG_871X("%s Reason code(%d)\n", __FUNCTION__,reason);
+
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{	
+		_irqL irqL;
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+		
+		//_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);	
+		//rtw_free_stainfo(padapter, psta);
+		//_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+
+		DBG_871X("%s, STA:" MAC_FMT "\n", __FUNCTION__, MAC_ARG(GetAddr2Ptr(pframe)));
+
+		psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));	
+		if(psta)
+		{
+			u8 updated = _FALSE;
+			
+			_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+			if(rtw_is_list_empty(&psta->asoc_list)==_FALSE)
+			{
+				rtw_list_delete(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+				updated = ap_free_sta(padapter, psta, _FALSE, reason);
+			
+			}
+			_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+			associated_clients_update(padapter, updated);
+		}
+
+		return _SUCCESS;
+	}
+	else
+#endif
+	{
+		DBG_871X("%s, STA:" MAC_FMT "\n", __FUNCTION__, MAC_ARG(GetAddr3Ptr(pframe)));
+		
+		receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
+	}	
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = _FALSE;
+	return _SUCCESS;
+
+}
+
+unsigned int OnAtim(_adapter *padapter, union recv_frame *precv_frame)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	return _SUCCESS;
+}
+
+unsigned int on_action_spct_ch_switch(_adapter *padapter, struct sta_info *psta, u8 *ies, uint ies_len)
+{
+	unsigned int ret = _FAIL;
+	struct mlme_ext_priv *mlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(mlmeext->mlmext_info);
+
+	if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
+		ret = _SUCCESS;	
+		goto exit;
+	}
+
+	if ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE) {
+		
+		int ch_switch_mode = -1, ch = -1, ch_switch_cnt = -1;
+		int ch_offset = -1;
+		u8 bwmode;
+		struct ieee80211_info_element *ie;
+
+		DBG_871X(FUNC_NDEV_FMT" from "MAC_FMT"\n",
+			FUNC_NDEV_ARG(padapter->pnetdev), MAC_ARG(psta->hwaddr));
+
+		for_each_ie(ie, ies, ies_len) {
+			if (ie->id == WLAN_EID_CHANNEL_SWITCH) {
+				ch_switch_mode = ie->data[0];
+				ch = ie->data[1];
+				ch_switch_cnt = ie->data[2];
+				DBG_871X("ch_switch_mode:%d, ch:%d, ch_switch_cnt:%d\n",
+					ch_switch_mode, ch, ch_switch_cnt);
+			}
+			else if (ie->id == WLAN_EID_SECONDARY_CHANNEL_OFFSET) {
+				ch_offset = secondary_ch_offset_to_hal_ch_offset(ie->data[0]);
+				DBG_871X("ch_offset:%d\n", ch_offset);
+			}
+		}
+
+		if (ch == -1)
+			return _SUCCESS;
+
+		if (ch_offset == -1)
+			bwmode = mlmeext->cur_bwmode;
+		else
+			bwmode = (ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE) ?
+				HT_CHANNEL_WIDTH_20 : HT_CHANNEL_WIDTH_40;
+
+		ch_offset = (ch_offset == -1) ? mlmeext->cur_ch_offset : ch_offset;
+
+		/* todo:
+		 * 1. the decision of channel switching
+		 * 2. things after channel switching
+		 */
+
+		ret = rtw_set_ch_cmd(padapter, ch, bwmode, ch_offset, _TRUE);
+	}
+
+exit:
+	return ret;
+}
+
+unsigned int on_action_spct(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int ret = _FAIL;
+	struct sta_info *psta = NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = (u8 *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+	u8 category;
+	u8 action;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
+
+	psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+
+	if (!psta)
+		goto exit;
+
+	category = frame_body[0];
+	if(category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
+		goto exit;
+
+	action = frame_body[1];
+	switch (action) {
+	case RTW_WLAN_ACTION_SPCT_MSR_REQ:
+	case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
+	case RTW_WLAN_ACTION_SPCT_TPC_REQ:
+	case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
+		break;
+	case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
+		#ifdef CONFIG_SPCT_CH_SWITCH
+		ret = on_action_spct_ch_switch(padapter, psta, &frame_body[2],
+			frame_len-(frame_body-pframe)-2);
+		#endif
+		break;
+	default:
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+unsigned int OnAction_qos(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+unsigned int OnAction_dls(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+unsigned int OnAction_back(_adapter *padapter, union recv_frame *precv_frame)
+{
+	u8 *addr;
+	struct sta_info *psta=NULL;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	unsigned char		*frame_body;
+	unsigned char		category, action;
+	unsigned short	tid, status, reason_code = 0;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	//check RA matches or not	
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))//for if1, sta/ap mode
+		return _SUCCESS;
+
+/*
+	//check A1 matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
+		return _SUCCESS;
+*/
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)	
+		if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
+			return _SUCCESS;
+
+	addr = GetAddr2Ptr(pframe);
+	psta = rtw_get_stainfo(pstapriv, addr);
+
+	if(psta==NULL)
+		return _SUCCESS;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	category = frame_body[0];
+	if (category == RTW_WLAN_CATEGORY_BACK)// representing Block Ack
+	{
+#ifdef CONFIG_TDLS
+		if((psta->tdls_sta_state & TDLS_LINKED_STATE) && 
+			(psta->htpriv.ht_option==_TRUE) &&
+			(psta->htpriv.ampdu_enable==_TRUE) )
+		{
+			//do nothing; just don't want to return _SUCCESS;
+		}
+		else
+#endif //CONFIG_TDLS
+		if (!pmlmeinfo->HT_enable)
+		{
+			return _SUCCESS;
+		}
+
+		action = frame_body[1];
+		DBG_871X("%s, action=%d\n", __FUNCTION__, action);
+		switch (action)
+		{
+			case RTW_WLAN_ACTION_ADDBA_REQ: //ADDBA request
+
+				_rtw_memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
+				//process_addba_req(padapter, (u8*)&(pmlmeinfo->ADDBA_req), GetAddr3Ptr(pframe));
+				process_addba_req(padapter, (u8*)&(pmlmeinfo->ADDBA_req), addr);
+				
+				if(pmlmeinfo->bAcceptAddbaReq == _TRUE)
+				{
+					issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 0);
+				}
+				else
+				{
+					issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 37);//reject ADDBA Req
+				}
+								
+				break;
+
+			case RTW_WLAN_ACTION_ADDBA_RESP: //ADDBA response
+
+				//status = frame_body[3] | (frame_body[4] << 8); //endian issue
+				status = RTW_GET_LE16(&frame_body[3]);
+				tid = ((frame_body[5] >> 2) & 0x7);
+
+				if (status == 0)
+				{	//successful					
+					DBG_871X("agg_enable for TID=%d\n", tid);
+					psta->htpriv.agg_enable_bitmap |= 1 << tid;					
+					psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);				
+				}
+				else
+				{					
+					psta->htpriv.agg_enable_bitmap &= ~BIT(tid);					
+				}
+
+				//DBG_871X("marc: ADDBA RSP: %x\n", pmlmeinfo->agg_enable_bitmap);
+				break;
+
+			case RTW_WLAN_ACTION_DELBA: //DELBA
+				if ((frame_body[3] & BIT(3)) == 0)
+				{
+					psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
+					psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
+					
+					//reason_code = frame_body[4] | (frame_body[5] << 8);
+					reason_code = RTW_GET_LE16(&frame_body[4]);
+				}
+				else if((frame_body[3] & BIT(3)) == BIT(3))
+				{						
+					tid = (frame_body[3] >> 4) & 0x0F;
+				
+					preorder_ctrl =  &psta->recvreorder_ctrl[tid];
+					preorder_ctrl->enable = _FALSE;
+					preorder_ctrl->indicate_seq = 0xffff;
+					#ifdef DBG_RX_SEQ
+					DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+						preorder_ctrl->indicate_seq);
+					#endif
+				}
+				
+				DBG_871X("%s(): DELBA: %x(%x)\n", __FUNCTION__,pmlmeinfo->agg_enable_bitmap, reason_code);
+				//todo: how to notify the host while receiving DELETE BA
+				break;
+
+			default:
+				break;
+		}
+	}
+
+	return _SUCCESS;
+}
+
+#ifdef CONFIG_P2P
+
+static int get_reg_classes_full_count(struct p2p_channels channel_list) {
+	int cnt = 0;
+	int i;
+
+	for (i = 0; i < channel_list.reg_classes; i++) {
+		cnt += channel_list.reg_class[i].channels;
+	}
+
+	return cnt;
+}
+
+static void get_channel_cnt_24g_5gl_5gh(  struct mlme_ext_priv *pmlmeext, u8* p24g_cnt, u8* p5gl_cnt, u8* p5gh_cnt )
+{
+	int	i = 0;
+
+	*p24g_cnt = 0;
+	*p5gl_cnt = 0;
+	*p5gh_cnt = 0;	
+	
+	for( i = 0; i < pmlmeext->max_chan_nums; i++ )
+	{
+		if ( pmlmeext->channel_set[ i ].ChannelNum <= 14 )
+		{
+			(*p24g_cnt)++;
+		}
+		else if ( ( pmlmeext->channel_set[ i ].ChannelNum > 14 ) && ( pmlmeext->channel_set[ i ].ChannelNum <= 48 ) )
+		{
+			//	Just include the channel 36, 40, 44, 48 channels for 5G low
+			(*p5gl_cnt)++;
+		}
+		else if ( ( pmlmeext->channel_set[ i ].ChannelNum >= 149 ) && ( pmlmeext->channel_set[ i ].ChannelNum <= 161 ) )
+		{
+			//	Just include the channel 149, 153, 157, 161 channels for 5G high
+			(*p5gh_cnt)++;
+		}
+	}
+}
+
+void issue_p2p_GO_request(_adapter *padapter, u8* raddr)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_GO_NEGO_REQ;
+	u8			wpsie[ 255 ] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u8			wpsielen = 0, p2pielen = 0, i;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh = 0;
+	u16			len_channellist_attr = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD		
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pwdinfo->negotiation_dialog_token = 1;	//	Initialize the dialog value
+	pframe = rtw_set_fixed_ie(pframe, 1, &pwdinfo->negotiation_dialog_token, &(pattrib->pktlen));
+
+	
+
+	//	WPS Section
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Device Password ID
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_PWID );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+
+	if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PEER_DISPLAY_PIN )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_USER_SPEC );
+	}
+	else if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_SELF_DISPLAY_PIN )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_REGISTRAR_SPEC );
+	}
+	else if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PBC )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_PBC );
+	}
+
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110306
+	//	According to the P2P Specification, the group negoitation request frame should contain 9 P2P attributes
+	//	1. P2P Capability
+	//	2. Group Owner Intent
+	//	3. Configuration Timeout
+	//	4. Listen Channel
+	//	5. Extended Listen Timing
+	//	6. Intended P2P Interface Address
+	//	7. Channel List
+	//	8. P2P Device Info
+	//	9. Operating Channel
+
+
+	//	P2P Capability
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN | P2P_GRPCAP_PERSISTENT_GROUP;
+	}
+	else
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN;
+	}
+
+
+	//	Group Owner Intent
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_GO_INTENT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Todo the tie breaker bit.
+	p2pie[ p2pielen++ ] = ( ( pwdinfo->intent << 1 ) | BIT(0) );
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+
+	//	Listen Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_LISTEN_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+	
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->listen_channel;	//	listening channel number
+	
+
+	//	Extended Listen Timing ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Availability Period
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	p2pielen += 2;
+
+	//	Availability Interval
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	p2pielen += 2;
+
+
+	//	Intended P2P Interface Address
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_INTENTED_IF_ADDR;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	// Length:
+	// Country String(3)
+	// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+	// + number of channels in all classes
+	len_channellist_attr = 3
+	   + (1 + 1) * (u16)(pmlmeext->channel_list.reg_classes)
+	   + get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+	}
+	else
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+	}
+#else
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+#endif
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Channel Entry List
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;	
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//	Operating Class
+		if ( pbuddy_mlmeext->cur_channel > 14 )
+		{
+			if ( pbuddy_mlmeext->cur_channel >= 149 )
+			{
+				p2pie[ p2pielen++ ] = 0x7c;
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x73;
+			}
+		}
+		else
+		{
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+
+		//	Number of Channels
+		//	Just support 1 channel and this channel is AP's channel
+		p2pie[ p2pielen++ ] = 1;
+
+		//	Channel List
+		p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		int i,j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#else // CONFIG_CONCURRENT_MODE
+	{
+		int i,j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#endif // CONFIG_CONCURRENT_MODE
+
+	//	Device Info
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	p2pielen += 2;
+
+	//	OUI
+	*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	p2pielen += 4;
+
+	//	Sub Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	p2pielen += 2;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name , pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;	
+	
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	if ( pwdinfo->operating_channel <= 14 )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x51;
+	}
+	else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x73;
+	}
+	else
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x7c;
+	}
+
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );		
+
+#ifdef CONFIG_WFD
+	wfdielen = build_nego_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+
+void issue_p2p_GO_response(_adapter *padapter, u8* raddr, u8* frame_body,uint len, u8 result)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_GO_NEGO_RESP;
+	u8			wpsie[ 255 ] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u8			p2pielen = 0, i;
+	uint			wpsielen = 0;
+	u16			wps_devicepassword_id = 0x0000;
+	uint			wps_devicepassword_id_len = 0;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh;
+	u16			len_channellist_attr = 0;
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In, result = %d\n", __FUNCTION__,  result );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pwdinfo->negotiation_dialog_token = frame_body[7];	//	The Dialog Token of provisioning discovery request frame.
+	pframe = rtw_set_fixed_ie(pframe, 1, &(pwdinfo->negotiation_dialog_token), &(pattrib->pktlen));
+
+	//	Commented by Albert 20110328
+	//	Try to get the device password ID from the WPS IE of group negotiation request frame
+	//	WiFi Direct test plan 5.1.15
+	rtw_get_wps_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, wpsie, &wpsielen);
+	rtw_get_wps_attr_content( wpsie, wpsielen, WPS_ATTR_DEVICE_PWID, (u8*) &wps_devicepassword_id, &wps_devicepassword_id_len);
+	wps_devicepassword_id = be16_to_cpu( wps_devicepassword_id );
+
+	_rtw_memset( wpsie, 0x00, 255 );
+	wpsielen = 0;
+
+	//	WPS Section
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Device Password ID
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_PWID );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+	if ( wps_devicepassword_id == WPS_DPID_USER_SPEC )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_REGISTRAR_SPEC );
+	}
+	else if ( wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_USER_SPEC );
+	}
+	else
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_PBC );
+	}
+	wpsielen += 2;
+
+	//	Commented by Kurt 20120113
+	//	If some device wants to do p2p handshake without sending prov_disc_req
+	//	We have to get peer_req_cm from here.
+	if(_rtw_memcmp( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "000", 3) )
+	{
+		if ( wps_devicepassword_id == WPS_DPID_USER_SPEC )
+		{
+			_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "dis", 3 );
+		}
+		else if ( wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC )
+		{
+			_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pad", 3 );	
+		}
+		else
+		{
+			_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pbc", 3 );	
+		}
+	}
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20100908
+	//	According to the P2P Specification, the group negoitation response frame should contain 9 P2P attributes
+	//	1. Status
+	//	2. P2P Capability
+	//	3. Group Owner Intent
+	//	4. Configuration Timeout
+	//	5. Operating Channel
+	//	6. Intended P2P Interface Address
+	//	7. Channel List
+	//	8. Device Info
+	//	9. Group ID	( Only GO )
+
+
+	//	ToDo:
+
+	//	P2P Status
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_STATUS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = result;
+	
+	//	P2P Capability
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		//	Commented by Albert 2011/03/08
+		//	According to the P2P specification
+		//	if the sending device will be client, the P2P Capability should be reserved of group negotation response frame
+		p2pie[ p2pielen++ ] = 0;
+	}
+	else
+	{
+		//	Be group owner or meet the error case
+		p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+	}
+	
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN | P2P_GRPCAP_PERSISTENT_GROUP;
+	}
+	else
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN;
+	}
+
+	//	Group Owner Intent
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_GO_INTENT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	if ( pwdinfo->peer_intent & 0x01 )
+	{
+		//	Peer's tie breaker bit is 1, our tie breaker bit should be 0
+		p2pie[ p2pielen++ ] = ( pwdinfo->intent << 1 );
+	}
+	else
+	{
+		//	Peer's tie breaker bit is 0, our tie breaker bit should be 1
+		p2pie[ p2pielen++ ] = ( ( pwdinfo->intent << 1 ) | BIT(0) );
+	}
+
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	if ( pwdinfo->operating_channel <= 14 )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x51;
+	}
+	else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x73;
+	}
+	else
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x7c;
+	}
+	
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+
+	//	Intended P2P Interface Address	
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_INTENTED_IF_ADDR;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	// Country String(3)
+	// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+	// + number of channels in all classes
+	len_channellist_attr = 3
+	   + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
+	   + get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+	}
+	else
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+	}
+#else
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+ #endif
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Channel Entry List
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;	
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//	Operating Class
+		if ( pbuddy_mlmeext->cur_channel > 14 )
+		{
+			if ( pbuddy_mlmeext->cur_channel >= 149 )
+			{
+				p2pie[ p2pielen++ ] = 0x7c;
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x73;
+			}
+		}
+		else
+		{
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+
+		//	Number of Channels
+		//	Just support 1 channel and this channel is AP's channel
+		p2pie[ p2pielen++ ] = 1;
+
+		//	Channel List
+		p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#else // CONFIG_CONCURRENT_MODE
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#endif // CONFIG_CONCURRENT_MODE
+	
+	//	Device Info
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	p2pielen += 2;
+
+	//	OUI
+	*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	p2pielen += 4;
+
+	//	Sub Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	p2pielen += 2;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name , pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;	
+	
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+	{
+		//	Group ID Attribute
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN + pwdinfo->nego_ssidlen );
+		p2pielen += 2;
+
+		//	Value:
+		//	p2P Device Address
+		_rtw_memcpy( p2pie + p2pielen , pwdinfo->device_addr, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+
+		//	SSID
+		_rtw_memcpy( p2pie + p2pielen, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+		p2pielen += pwdinfo->nego_ssidlen;
+		
+	}
+	
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );	
+	
+#ifdef CONFIG_WFD
+	wfdielen = build_nego_resp_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_GO_confirm(_adapter *padapter, u8* raddr, u8 result)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_GO_NEGO_CONF;
+	u8			wpsie[ 255 ] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u8			wpsielen = 0, p2pielen = 0;
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(pwdinfo->negotiation_dialog_token), &(pattrib->pktlen));
+
+	
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110306
+	//	According to the P2P Specification, the group negoitation request frame should contain 5 P2P attributes
+	//	1. Status
+	//	2. P2P Capability
+	//	3. Operating Channel
+	//	4. Channel List
+	//	5. Group ID	( if this WiFi is GO )
+
+	//	P2P Status
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_STATUS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = result;
+
+	//	P2P Capability
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+	
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN | P2P_GRPCAP_PERSISTENT_GROUP;
+	}
+	else
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN;
+	}
+
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		if ( pwdinfo->peer_operating_ch <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->peer_operating_ch >= 36 ) && ( pwdinfo->peer_operating_ch <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+		
+		p2pie[ p2pielen++ ] = pwdinfo->peer_operating_ch;
+	}
+	else
+	{
+		if ( pwdinfo->operating_channel <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+		
+		//	Channel Number
+		p2pie[ p2pielen++ ] = pwdinfo->operating_channel;		//	Use the listen channel as the operating channel
+	}
+
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	*(u16*) ( p2pie + p2pielen ) = 6;
+	p2pielen += 2;
+
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Value:
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		if ( pwdinfo->peer_operating_ch <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->peer_operating_ch >= 36 ) && ( pwdinfo->peer_operating_ch <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+		p2pie[ p2pielen++ ] = 1;
+		p2pie[ p2pielen++ ] = pwdinfo->peer_operating_ch;
+	}
+	else
+	{
+		if ( pwdinfo->operating_channel <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+		
+		//	Channel Number
+		p2pie[ p2pielen++ ] = 1;
+		p2pie[ p2pielen++ ] = pwdinfo->operating_channel;		//	Use the listen channel as the operating channel
+	}
+
+	if (rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+	{
+		//	Group ID Attribute
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN + pwdinfo->nego_ssidlen );
+		p2pielen += 2;
+
+		//	Value:
+		//	p2P Device Address
+		_rtw_memcpy( p2pie + p2pielen , pwdinfo->device_addr, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+
+		//	SSID
+		_rtw_memcpy( p2pie + p2pielen, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+		p2pielen += pwdinfo->nego_ssidlen;
+	}
+	
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+	
+#ifdef CONFIG_WFD
+	wfdielen = build_nego_confirm_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_invitation_request(_adapter *padapter, u8* raddr )
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_INVIT_REQ;
+	u8			p2pie[ 255 ] = { 0x00 };
+	u8			p2pielen = 0, i;
+	u8			dialogToken = 3;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh = 0;
+	u16			len_channellist_attr = 0;	
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, raddr,  ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20101011
+	//	According to the P2P Specification, the P2P Invitation request frame should contain 7 P2P attributes
+	//	1. Configuration Timeout
+	//	2. Invitation Flags
+	//	3. Operating Channel	( Only GO )
+	//	4. P2P Group BSSID	( Should be included if I am the GO )
+	//	5. Channel List
+	//	6. P2P Group ID
+	//	7. P2P Device Info
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+	//	Invitation Flags
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_INVITATION_FLAGS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = P2P_INVITATION_FLAGS_PERSISTENT;
+
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	if ( pwdinfo->invitereq_info.operating_ch <= 14 )
+		p2pie[ p2pielen++ ] = 0x51;
+	else if ( ( pwdinfo->invitereq_info.operating_ch >= 36 ) && ( pwdinfo->invitereq_info.operating_ch <= 48 ) )
+		p2pie[ p2pielen++ ] = 0x73;
+	else
+		p2pie[ p2pielen++ ] = 0x7c;
+	
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->invitereq_info.operating_ch;	//	operating channel number
+
+	if ( _rtw_memcmp( myid( &padapter->eeprompriv ), pwdinfo->invitereq_info.go_bssid, ETH_ALEN ) )
+	{
+		//	P2P Group BSSID
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_BSSID;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+		p2pielen += 2;
+
+		//	Value:
+		//	P2P Device Address for GO
+		_rtw_memcpy( p2pie + p2pielen, pwdinfo->invitereq_info.go_bssid, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+	}
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	
+	//	Length:
+	// Country String(3)
+	// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+	// + number of channels in all classes
+	len_channellist_attr = 3
+	   + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
+	   + get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+	}
+	else
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+	}
+#else
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+ #endif
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+	
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Channel Entry List
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;	
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//	Operating Class
+		if ( pbuddy_mlmeext->cur_channel > 14 )
+		{
+			if ( pbuddy_mlmeext->cur_channel >= 149 )
+			{
+				p2pie[ p2pielen++ ] = 0x7c;
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x73;
+			}
+		}
+		else
+		{
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+
+		//	Number of Channels
+		//	Just support 1 channel and this channel is AP's channel
+		p2pie[ p2pielen++ ] = 1;
+
+		//	Channel List
+		p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#else // CONFIG_CONCURRENT_MODE
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#endif // CONFIG_CONCURRENT_MODE
+
+
+	//	P2P Group ID
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 6 + pwdinfo->invitereq_info.ssidlen );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address for GO
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->invitereq_info.go_bssid, ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	SSID
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->invitereq_info.go_ssid, pwdinfo->invitereq_info.ssidlen );
+	p2pielen += pwdinfo->invitereq_info.ssidlen;
+	
+
+	//	Device Info
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	p2pielen += 2;
+	
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_DISPLAY );
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	p2pielen += 2;
+
+	//	OUI
+	*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	p2pielen += 4;
+
+	//	Sub Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	p2pielen += 2;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+		
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );	
+
+#ifdef CONFIG_WFD
+	wfdielen = build_invitation_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD	
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_invitation_response(_adapter *padapter, u8* raddr, u8 dialogToken, u8 status_code)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_INVIT_RESP;
+	u8			p2pie[ 255 ] = { 0x00 };
+	u8			p2pielen = 0, i;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh = 0;
+	u16			len_channellist_attr = 0;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif	
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, raddr,  ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20101005
+	//	According to the P2P Specification, the P2P Invitation response frame should contain 5 P2P attributes
+	//	1. Status
+	//	2. Configuration Timeout
+	//	3. Operating Channel	( Only GO )
+	//	4. P2P Group BSSID	( Only GO )
+	//	5. Channel List
+
+	//	P2P Status
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_STATUS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	//	When status code is P2P_STATUS_FAIL_INFO_UNAVAILABLE.
+	//	Sent the event receiving the P2P Invitation Req frame to DMP UI.
+	//	DMP had to compare the MAC address to find out the profile.
+	//	So, the WiFi driver will send the P2P_STATUS_FAIL_INFO_UNAVAILABLE to NB.
+	//	If the UI found the corresponding profile, the WiFi driver sends the P2P Invitation Req
+	//	to NB to rebuild the persistent group.
+	p2pie[ p2pielen++ ] = status_code;
+	
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+	if( status_code == P2P_STATUS_SUCCESS )
+	{
+		if( rtw_p2p_chk_role( pwdinfo, P2P_ROLE_GO ) )
+		{
+			//	The P2P Invitation request frame asks this Wi-Fi device to be the P2P GO
+			//	In this case, the P2P Invitation response frame should carry the two more P2P attributes.
+			//	First one is operating channel attribute.
+			//	Second one is P2P Group BSSID attribute.
+
+			//	Operating Channel
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Country String
+			p2pie[ p2pielen++ ] = 'X';
+			p2pie[ p2pielen++ ] = 'X';
+		
+			//	The third byte should be set to 0x04.
+			//	Described in the "Operating Channel Attribute" section.
+			p2pie[ p2pielen++ ] = 0x04;
+
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+		
+			//	Channel Number
+			p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+			
+
+			//	P2P Group BSSID
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_BSSID;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+			p2pielen += 2;
+
+			//	Value:
+			//	P2P Device Address for GO
+			_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+			p2pielen += ETH_ALEN;
+
+		}
+
+		//	Channel List
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+		//	Length:
+		// Country String(3)
+		// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+		// + number of channels in all classes
+		len_channellist_attr = 3
+			+ (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
+			+ get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+		}
+		else
+		{
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+		}
+#else
+
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+#endif
+		p2pielen += 2;
+
+		//	Value:
+		//	Country String
+		p2pie[ p2pielen++ ] = 'X';
+		p2pie[ p2pielen++ ] = 'X';
+
+		//	The third byte should be set to 0x04.
+		//	Described in the "Operating Channel Attribute" section.
+		p2pie[ p2pielen++ ] = 0x04;
+
+		//	Channel Entry List
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_adapter *pbuddy_adapter = padapter->pbuddy_adapter;	
+			struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+			//	Operating Class
+			if ( pbuddy_mlmeext->cur_channel > 14 )
+			{
+				if ( pbuddy_mlmeext->cur_channel >= 149 )
+				{
+					p2pie[ p2pielen++ ] = 0x7c;
+				}
+				else
+				{
+					p2pie[ p2pielen++ ] = 0x73;
+				}
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x51;
+			}
+
+			//	Number of Channels
+			//	Just support 1 channel and this channel is AP's channel
+			p2pie[ p2pielen++ ] = 1;
+
+			//	Channel List
+			p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+		}
+		else
+		{
+			int i, j;
+			for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+				//	Operating Class
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+				//	Number of Channels
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+				//	Channel List
+				for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+					p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+				}
+			}
+		}
+#else // CONFIG_CONCURRENT_MODE
+		{
+			int i, j;
+			for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+				//	Operating Class
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+				//	Number of Channels
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+				//	Channel List
+				for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+					p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+				}
+			}
+		}
+#endif // CONFIG_CONCURRENT_MODE
+	}
+		
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );	
+	
+#ifdef CONFIG_WFD
+	wfdielen = build_invitation_resp_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_provision_request(_adapter *padapter, u8* pssid, u8 ussidlen, u8* pdev_raddr )
+{
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u8			dialogToken = 1;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_PROVISION_DISC_REQ;
+	u8			wpsie[ 100 ] = { 0x00 };
+	u8			wpsielen = 0;
+	u32			p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD		
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, pdev_raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pdev_raddr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));		
+
+	p2pielen = build_prov_disc_request_p2p_ie( pwdinfo, pframe, pssid, ussidlen, pdev_raddr );
+
+	pframe += p2pielen;
+	pattrib->pktlen += p2pielen;
+
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Config Method
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->tx_prov_disc_info.wps_config_method_request );
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+#ifdef CONFIG_WFD
+	wfdielen = build_provdisc_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+
+u8 is_matched_in_profilelist( u8* peermacaddr, struct profile_info* profileinfo )
+{
+	u8 i, match_result = 0;
+
+	DBG_871X( "[%s] peermac = %.2X %.2X %.2X %.2X %.2X %.2X\n", __FUNCTION__,
+	  	    peermacaddr[0], peermacaddr[1],peermacaddr[2],peermacaddr[3],peermacaddr[4],peermacaddr[5]);
+	
+	for( i = 0; i < P2P_MAX_PERSISTENT_GROUP_NUM; i++, profileinfo++ )
+	{
+	       DBG_871X( "[%s] profileinfo_mac = %.2X %.2X %.2X %.2X %.2X %.2X\n", __FUNCTION__,
+		   	    profileinfo->peermac[0], profileinfo->peermac[1],profileinfo->peermac[2],profileinfo->peermac[3],profileinfo->peermac[4],profileinfo->peermac[5]);		   
+		if ( _rtw_memcmp( peermacaddr, profileinfo->peermac, ETH_ALEN ) )
+		{
+			match_result = 1;
+			DBG_871X( "[%s] Match!\n", __FUNCTION__ );
+			break;
+		}
+	}
+	
+	return (match_result );
+}
+
+void issue_probersp_p2p(_adapter *padapter, unsigned char *da)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;	
+	unsigned char					*mac;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	//WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u16					beacon_interval = 100;
+	u16					capInfo = 0;
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8					wpsie[255] = { 0x00 };
+	u32					wpsielen = 0, p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#ifdef CONFIG_INTEL_WIDI
+	u8 zero_array_check[L2SDTA_SERVICE_VE_LEN] = { 0x00 };
+#endif //CONFIG_INTEL_WIDI
+
+	//DBG_871X("%s\n", __FUNCTION__);
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);	
+	
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+		
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;	
+	
+	mac = myid(&(padapter->eeprompriv));
+	
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+	
+	//	Use the device address for BSSID field.	
+	_rtw_memcpy(pwlanhdr->addr3, mac, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(fctrl, WIFI_PROBERSP);
+	
+	pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = pattrib->hdrlen;
+	pframe += pattrib->hdrlen;
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	pattrib->pktlen += 8;
+
+	// beacon interval: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *) &beacon_interval, 2); 
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//	capability info: 2 bytes
+	//	ESS and IBSS bits must be 0 (defined in the 3.1.2.1.1 of WiFi Direct Spec)
+	capInfo |= cap_ShortPremble;
+	capInfo |= cap_ShortSlot;
+	
+	_rtw_memcpy(pframe, (unsigned char *) &capInfo, 2);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, 7, pwdinfo->p2p_wildcard_ssid, &pattrib->pktlen);
+
+	// supported rates...
+	//	Use the OFDM rate in the P2P probe response frame. ( 6(B), 9(B), 12, 18, 24, 36, 48, 54 )
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pwdinfo->support_rate, &pattrib->pktlen);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&pwdinfo->listen_channel, &pattrib->pktlen);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if( pmlmepriv->wps_probe_resp_ie != NULL && pmlmepriv->p2p_probe_resp_ie != NULL )
+		{
+			//WPS IE
+			_rtw_memcpy(pframe, pmlmepriv->wps_probe_resp_ie, pmlmepriv->wps_probe_resp_ie_len);
+			pattrib->pktlen += pmlmepriv->wps_probe_resp_ie_len;
+			pframe += pmlmepriv->wps_probe_resp_ie_len;
+
+			//P2P IE
+			_rtw_memcpy(pframe, pmlmepriv->p2p_probe_resp_ie, pmlmepriv->p2p_probe_resp_ie_len);
+			pattrib->pktlen += pmlmepriv->p2p_probe_resp_ie_len;
+			pframe += pmlmepriv->p2p_probe_resp_ie_len;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211		
+	{
+
+		//	Todo: WPS IE
+		//	Noted by Albert 20100907
+		//	According to the WPS specification, all the WPS attribute is presented by Big Endian.
+
+		wpsielen = 0;
+		//	WPS OUI
+		*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	WPS version
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+#ifdef CONFIG_INTEL_WIDI
+		//	Commented by Kurt
+		//	Appended WiDi info. only if we did issued_probereq_widi(), and then we saved ven. ext. in pmlmepriv->sa_ext.
+		if(  _rtw_memcmp(pmlmepriv->sa_ext, zero_array_check, L2SDTA_SERVICE_VE_LEN) == _FALSE 
+			|| pmlmepriv->num_p2p_sdt != 0 )
+		{
+			//Sec dev type
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_SEC_DEV_TYPE_LIST );
+			wpsielen += 2;
+
+			//	Length:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0008 );
+			wpsielen += 2;
+
+			//	Value:
+			//	Category ID
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_CID_DISPLAYS );
+			wpsielen += 2;
+
+			//	OUI
+			*(u32*) ( wpsie + wpsielen ) = cpu_to_be32( INTEL_DEV_TYPE_OUI );
+			wpsielen += 4;
+
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_SCID_WIDI_CONSUMER_SINK );
+			wpsielen += 2;
+
+			if(  _rtw_memcmp(pmlmepriv->sa_ext, zero_array_check, L2SDTA_SERVICE_VE_LEN) == _FALSE )
+			{
+				//	Vendor Extension
+				_rtw_memcpy( wpsie + wpsielen, pmlmepriv->sa_ext, L2SDTA_SERVICE_VE_LEN );
+				wpsielen += L2SDTA_SERVICE_VE_LEN;
+			}
+		}
+#endif //CONFIG_INTEL_WIDI
+
+		//	WiFi Simple Config State
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_SIMPLE_CONF_STATE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_WSC_STATE_NOT_CONFIG;	//	Not Configured.
+
+		//	Response Type
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_RESP_TYPE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_RESPONSE_TYPE_8021X;
+
+		//	UUID-E
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_UUID_E );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0010 );
+		wpsielen += 2;
+
+		//	Value:
+		if (pwdinfo->external_uuid == 0) {
+			_rtw_memset( wpsie + wpsielen, 0x0, 16 );
+			_rtw_memcpy( wpsie + wpsielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+		} else {
+			_rtw_memcpy( wpsie + wpsielen, pwdinfo->uuid, 0x10 );
+		}
+		wpsielen += 0x10;
+
+		//	Manufacturer
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_MANUFACTURER );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0007 );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, "Realtek", 7 );
+		wpsielen += 7;
+
+		//	Model Name
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_MODEL_NAME );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0006 );
+		wpsielen += 2;	
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, "8192CU", 6 );
+		wpsielen += 6;
+
+		//	Model Number
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_MODEL_NUMBER );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[ wpsielen++ ] = 0x31;		//	character 1
+
+		//	Serial Number
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_SERIAL_NUMBER );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( ETH_ALEN );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, "123456" , ETH_ALEN );
+		wpsielen += ETH_ALEN;
+
+		//	Primary Device Type
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_PRIMARY_DEV_TYPE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0008 );
+		wpsielen += 2;
+
+		//	Value:
+		//	Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_CID_RTK_WIDI );
+		wpsielen += 2;
+
+		//	OUI
+		*(u32*) ( wpsie + wpsielen ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	Sub Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_SCID_RTK_DMP );
+		wpsielen += 2;
+
+		//	Device Name
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->device_name_len );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, pwdinfo->device_name, pwdinfo->device_name_len );
+		wpsielen += pwdinfo->device_name_len;
+
+		//	Config Method
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+		wpsielen += 2;
+
+		//	Value:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+		wpsielen += 2;
+		
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+		
+
+		p2pielen = build_probe_resp_p2p_ie(pwdinfo, pframe);
+		pframe += p2pielen;
+		pattrib->pktlen += p2pielen;
+	}
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( _TRUE == pwdinfo->wfd_info->wfd_enable )
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		wfdielen = build_probe_resp_wfd_ie(pwdinfo, pframe, 0);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#ifdef CONFIG_IOCTL_CFG80211
+	else if (pmlmepriv->wfd_probe_resp_ie != NULL && pmlmepriv->wfd_probe_resp_ie_len>0)
+	{
+		//WFD IE
+		_rtw_memcpy(pframe, pmlmepriv->wfd_probe_resp_ie, pmlmepriv->wfd_probe_resp_ie_len);
+		pattrib->pktlen += pmlmepriv->wfd_probe_resp_ie_len;
+		pframe += pmlmepriv->wfd_probe_resp_ie_len;		
+	}
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_WFD	
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	
+
+	dump_mgntframe(padapter, pmgntframe);
+	
+	return;
+
+}
+
+int _issue_probereq_p2p(_adapter *padapter, u8 *da, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	unsigned char			*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short		*fctrl;
+	unsigned char			*mac;
+	unsigned char			bssrate[NumRates];
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int	bssrate_len = 0;
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);	
+	u8					wpsie[255] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u16					wpsielen = 0, p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if (da) {
+		_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, da, ETH_ALEN);
+	} else {
+		if ( ( pwdinfo->p2p_info.scan_op_ch_only ) || ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) )
+		{
+			//	This two flags will be set when this is only the P2P client mode.
+			_rtw_memcpy(pwlanhdr->addr1, pwdinfo->p2p_peer_interface_addr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, pwdinfo->p2p_peer_interface_addr, ETH_ALEN);
+		}
+		else
+		{
+			//	broadcast probe request frame
+			_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, bc_addr, ETH_ALEN);
+		}
+ 	}
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_PROBEREQ);
+
+	pframe += sizeof (struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+	{
+		pframe = rtw_set_ie(pframe, _SSID_IE_, pwdinfo->tx_prov_disc_info.ssid.SsidLength, pwdinfo->tx_prov_disc_info.ssid.Ssid, &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SSID_IE_, P2P_WILDCARD_SSID_LEN, pwdinfo->p2p_wildcard_ssid, &(pattrib->pktlen));
+	}
+	//	Use the OFDM rate in the P2P probe request frame. ( 6(B), 9(B), 12(B), 24(B), 36, 48, 54 )
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pwdinfo->support_rate, &pattrib->pktlen);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if( pmlmepriv->wps_probe_req_ie != NULL && pmlmepriv->p2p_probe_req_ie != NULL )
+		{
+			//WPS IE
+			_rtw_memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
+			pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
+			pframe += pmlmepriv->wps_probe_req_ie_len;
+
+			//P2P IE
+			_rtw_memcpy(pframe, pmlmepriv->p2p_probe_req_ie, pmlmepriv->p2p_probe_req_ie_len);
+			pattrib->pktlen += pmlmepriv->p2p_probe_req_ie_len;
+			pframe += pmlmepriv->p2p_probe_req_ie_len;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+
+		//	WPS IE
+		//	Noted by Albert 20110221
+		//	According to the WPS specification, all the WPS attribute is presented by Big Endian.
+
+		wpsielen = 0;
+		//	WPS OUI
+		*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	WPS version
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+		if( pmlmepriv->wps_probe_req_ie == NULL )
+		{
+			//	UUID-E
+			//	Type:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_UUID_E );
+			wpsielen += 2;
+
+			//	Length:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0010 );
+			wpsielen += 2;
+
+			//	Value:
+			if (pwdinfo->external_uuid == 0) {
+				_rtw_memset( wpsie + wpsielen, 0x0, 16 );
+				_rtw_memcpy( wpsie + wpsielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+			} else {
+				_rtw_memcpy( wpsie + wpsielen, pwdinfo->uuid, 0x10 );
+			}
+			wpsielen += 0x10;
+
+			//	Config Method
+			//	Type:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+			wpsielen += 2;
+
+			//	Length:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+			wpsielen += 2;
+
+			//	Value:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+			wpsielen += 2;
+		}
+
+		//	Device Name
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->device_name_len );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, pwdinfo->device_name, pwdinfo->device_name_len );
+		wpsielen += pwdinfo->device_name_len;
+
+		//	Primary Device Type
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_PRIMARY_DEV_TYPE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0008 );
+		wpsielen += 2;
+
+		//	Value:
+		//	Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+		wpsielen += 2;
+
+		//	OUI
+		*(u32*) ( wpsie + wpsielen ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	Sub Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+		wpsielen += 2;
+
+		//	Device Password ID
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_PWID );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+		wpsielen += 2;
+
+		//	Value:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_REGISTRAR_SPEC );	//	Registrar-specified
+		wpsielen += 2;	
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+		
+		//	P2P OUI
+		p2pielen = 0;
+		p2pie[ p2pielen++ ] = 0x50;
+		p2pie[ p2pielen++ ] = 0x6F;
+		p2pie[ p2pielen++ ] = 0x9A;
+		p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+		//	Commented by Albert 20110221
+		//	According to the P2P Specification, the probe request frame should contain 5 P2P attributes
+		//	1. P2P Capability
+		//	2. P2P Device ID if this probe request wants to find the specific P2P device
+		//	3. Listen Channel
+		//	4. Extended Listen Timing
+		//	5. Operating Channel if this WiFi is working as the group owner now
+
+		//	P2P Capability
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+		p2pielen += 2;
+
+		//	Value:
+		//	Device Capability Bitmap, 1 byte
+		p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+		
+		//	Group Capability Bitmap, 1 byte
+		if ( pwdinfo->persistent_supported )
+			p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+		else
+			p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+		//	Listen Channel
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_LISTEN_CH;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+		p2pielen += 2;
+
+		//	Value:
+		//	Country String
+		p2pie[ p2pielen++ ] = 'X';
+		p2pie[ p2pielen++ ] = 'X';
+		
+		//	The third byte should be set to 0x04.
+		//	Described in the "Operating Channel Attribute" section.
+		p2pie[ p2pielen++ ] = 0x04;
+
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+		
+		//	Channel Number
+		p2pie[ p2pielen++ ] = pwdinfo->listen_channel;	//	listen channel
+		
+
+		//	Extended Listen Timing
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+		p2pielen += 2;
+
+		//	Value:
+		//	Availability Period
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+		p2pielen += 2;
+
+		//	Availability Interval
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+		p2pielen += 2;
+
+		if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+		{
+			//	Operating Channel (if this WiFi is working as the group owner now)
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Country String
+			p2pie[ p2pielen++ ] = 'X';
+			p2pie[ p2pielen++ ] = 'X';
+		
+			//	The third byte should be set to 0x04.
+			//	Described in the "Operating Channel Attribute" section.
+			p2pie[ p2pielen++ ] = 0x04;
+
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+		
+			//	Channel Number
+			p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+			
+		}
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+		if( pmlmepriv->wps_probe_req_ie != NULL )
+		{
+			//WPS IE
+			_rtw_memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
+			pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
+			pframe += pmlmepriv->wps_probe_req_ie_len;
+		}
+	}
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( _TRUE == pwdinfo->wfd_info->wfd_enable )
+#endif
+	{
+		wfdielen = build_probe_req_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#ifdef CONFIG_IOCTL_CFG80211
+	else if (pmlmepriv->wfd_probe_req_ie != NULL && pmlmepriv->wfd_probe_req_ie_len>0)		
+	{
+		//WFD IE
+		_rtw_memcpy(pframe, pmlmepriv->wfd_probe_req_ie, pmlmepriv->wfd_probe_req_ie_len);
+		pattrib->pktlen += pmlmepriv->wfd_probe_req_ie_len;
+		pframe += pmlmepriv->wfd_probe_req_ie_len;		
+	}
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
+
+	if (wait_ack) {
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	} else {
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+inline void issue_probereq_p2p(_adapter *adapter, u8 *da)
+{
+	_issue_probereq_p2p(adapter, da, _FALSE);
+}
+
+int issue_probereq_p2p_ex(_adapter *adapter, u8 *da, int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+
+	do
+	{
+		ret = _issue_probereq_p2p(adapter, da, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(adapter), MAC_ARG(da), rtw_get_oper_ch(adapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(adapter), rtw_get_oper_ch(adapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+#endif //CONFIG_P2P
+
+s32 rtw_action_public_decache(union recv_frame *recv_frame, s32 token)
+{
+	_adapter *adapter = recv_frame->u.hdr.adapter;
+	struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
+	u8 *frame = recv_frame->u.hdr.rx_data;
+	u16 seq_ctrl = ( (recv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
+		(recv_frame->u.hdr.attrib.frag_num & 0xf);
+	
+	if (GetRetry(frame)) {
+		if (token >= 0) {
+			if ((seq_ctrl == mlmeext->action_public_rxseq)
+				&& (token == mlmeext->action_public_dialog_token))
+			{
+				DBG_871X(FUNC_ADPT_FMT" seq_ctrl=0x%x, rxseq=0x%x, token:%d\n",
+					FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
+				return _FAIL;
+			}
+		} else {
+			if (seq_ctrl == mlmeext->action_public_rxseq) {
+				DBG_871X(FUNC_ADPT_FMT" seq_ctrl=0x%x, rxseq=0x%x\n",
+					FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
+				return _FAIL;
+			}
+		}
+	}
+	
+	mlmeext->action_public_rxseq = seq_ctrl;
+	
+	if (token >= 0)
+		mlmeext->action_public_dialog_token = token;
+
+	return _SUCCESS;
+}
+
+unsigned int on_action_public_p2p(union recv_frame *precv_frame)
+{
+	_adapter *padapter = precv_frame->u.hdr.adapter;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	u8 *frame_body;
+	u8 dialogToken=0;
+#ifdef CONFIG_P2P
+	u8 *p2p_ie;
+	u32	p2p_ielen, wps_ielen;
+	struct	wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8	result = P2P_STATUS_SUCCESS;
+	u8	empty_addr[ETH_ALEN] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+	u8 *merged_p2pie = NULL;
+	u32 merged_p2p_ielen = 0;
+#endif //CONFIG_P2P
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	dialogToken = frame_body[7];
+
+	if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
+		return _FAIL;
+	
+#ifdef CONFIG_P2P
+	_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211)
+	{
+		rtw_cfg80211_rx_p2p_action_public(padapter, pframe, len);
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		//	Do nothing if the driver doesn't enable the P2P function.
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+			return _SUCCESS;
+
+		len -= sizeof(struct rtw_ieee80211_hdr_3addr);
+
+		switch( frame_body[ 6 ] )//OUI Subtype
+		{
+			case P2P_GO_NEGO_REQ:
+			{
+				DBG_871X( "[%s] Got GO Nego Req Frame\n", __FUNCTION__);
+				_rtw_memset( &pwdinfo->groupid_info, 0x00, sizeof( struct group_id_info ) );
+
+				if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ))
+				{
+					rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+				}
+
+				if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
+				{
+					//	Commented by Albert 20110526
+					//	In this case, this means the previous nego fail doesn't be reset yet.
+					_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+					//	Restore the previous p2p state
+					rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+					DBG_871X( "[%s] Restore the previous p2p state to %d\n", __FUNCTION__, rtw_p2p_state(pwdinfo) );						
+				}					
+#ifdef CONFIG_CONCURRENT_MODE
+				if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+				{
+					_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+				}
+#endif // CONFIG_CONCURRENT_MODE
+
+				//	Commented by Kurt 20110902
+				//Add if statement to avoid receiving duplicate prov disc req. such that pre_p2p_state would be covered.
+				if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+					rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+
+				//	Commented by Kurt 20120113
+				//	Get peer_dev_addr here if peer doesn't issue prov_disc frame.
+				if( _rtw_memcmp(pwdinfo->rx_prov_disc_info.peerDevAddr, empty_addr, ETH_ALEN) )
+					_rtw_memcpy(pwdinfo->rx_prov_disc_info.peerDevAddr, GetAddr2Ptr(pframe), ETH_ALEN);
+
+				result = process_p2p_group_negotation_req( pwdinfo, frame_body, len );
+				issue_p2p_GO_response( padapter, GetAddr2Ptr(pframe), frame_body, len, result );
+#ifdef CONFIG_INTEL_WIDI
+				if( (padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_LISTEN) && (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_WFD_CONNECTION) )
+				{
+					padapter->mlmepriv.widi_state = INTEL_WIDI_STATE_WFD_CONNECTION;
+					_cancel_timer_ex(&(padapter->mlmepriv.listen_timer));
+					intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_STOP_WK, NULL);
+				}
+#endif //CONFIG_INTEL_WIDI
+
+				//	Commented by Albert 20110718
+				//	No matter negotiating or negotiation failure, the driver should set up the restore P2P state timer.
+#ifdef CONFIG_CONCURRENT_MODE
+				//	Commented by Albert 20120107
+				_set_timer( &pwdinfo->restore_p2p_state_timer, 3000 );
+#else // CONFIG_CONCURRENT_MODE
+				_set_timer( &pwdinfo->restore_p2p_state_timer, 5000 );
+#endif // CONFIG_CONCURRENT_MODE
+				break;					
+			}
+			case P2P_GO_NEGO_RESP:
+			{
+				DBG_871X( "[%s] Got GO Nego Resp Frame\n", __FUNCTION__);
+
+				if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+				{
+					//	Commented by Albert 20110425
+					//	The restore timer is enabled when issuing the nego request frame of rtw_p2p_connect function.
+					_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+					pwdinfo->nego_req_info.benable = _FALSE;
+					result = process_p2p_group_negotation_resp( pwdinfo, frame_body, len);
+					issue_p2p_GO_confirm( pwdinfo->padapter, GetAddr2Ptr(pframe), result);
+					if ( P2P_STATUS_SUCCESS == result )
+					{
+						if ( rtw_p2p_role(pwdinfo) == P2P_ROLE_CLIENT )
+						{
+							pwdinfo->p2p_info.operation_ch[ 0 ] = pwdinfo->peer_operating_ch;
+							#ifdef P2P_OP_CHECK_SOCIAL_CH
+							pwdinfo->p2p_info.operation_ch[ 1 ] = 1;	//Check whether GO is operating in channel 1;
+							pwdinfo->p2p_info.operation_ch[ 2 ] = 6;	//Check whether GO is operating in channel 6;
+							pwdinfo->p2p_info.operation_ch[ 3 ] = 11;	//Check whether GO is operating in channel 11;
+							#endif //P2P_OP_CHECK_SOCIAL_CH
+							pwdinfo->p2p_info.scan_op_ch_only = 1;
+							_set_timer( &pwdinfo->reset_ch_sitesurvey2, P2P_RESET_SCAN_CH );
+						}
+ 					}
+
+					//	Reset the dialog token for group negotiation frames.
+					pwdinfo->negotiation_dialog_token = 1;
+
+					if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
+					{
+						_set_timer( &pwdinfo->restore_p2p_state_timer, 5000 );
+					}
+				}
+				else
+				{
+					DBG_871X( "[%s] Skipped GO Nego Resp Frame (p2p_state != P2P_STATE_GONEGO_ING)\n", __FUNCTION__);
+				}
+						
+				break;
+			}
+			case P2P_GO_NEGO_CONF:
+			{
+				DBG_871X( "[%s] Got GO Nego Confirm Frame\n", __FUNCTION__);
+				result = process_p2p_group_negotation_confirm( pwdinfo, frame_body, len);
+				if ( P2P_STATUS_SUCCESS == result )
+				{
+					if ( rtw_p2p_role(pwdinfo) == P2P_ROLE_CLIENT )
+					{
+						pwdinfo->p2p_info.operation_ch[ 0 ] = pwdinfo->peer_operating_ch;
+						#ifdef P2P_OP_CHECK_SOCIAL_CH
+						pwdinfo->p2p_info.operation_ch[ 1 ] = 1;	//Check whether GO is operating in channel 1;
+						pwdinfo->p2p_info.operation_ch[ 2 ] = 6;	//Check whether GO is operating in channel 6;
+						pwdinfo->p2p_info.operation_ch[ 3 ] = 11;	//Check whether GO is operating in channel 11;
+						#endif //P2P_OP_CHECK_SOCIAL_CH
+						pwdinfo->p2p_info.scan_op_ch_only = 1;
+						_set_timer( &pwdinfo->reset_ch_sitesurvey2, P2P_RESET_SCAN_CH );
+					}
+ 				}
+				break;
+			}
+			case P2P_INVIT_REQ:
+			{
+				//	Added by Albert 2010/10/05
+				//	Received the P2P Invite Request frame.
+						
+				DBG_871X( "[%s] Got invite request frame!\n", __FUNCTION__ );
+				if ( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)) )
+				{
+					//	Parse the necessary information from the P2P Invitation Request frame.
+					//	For example: The MAC address of sending this P2P Invitation Request frame.
+					u32	attr_contentlen = 0;
+					u8	status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+					struct group_id_info group_id;
+					u8	invitation_flag = 0;
+
+					merged_p2p_ielen = rtw_get_p2p_merged_ies_len(frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_);
+
+					merged_p2pie = rtw_malloc(merged_p2p_ielen);
+					if (merged_p2pie == NULL)
+					{
+						DBG_871X( "[%s] Malloc p2p ie fail\n", __FUNCTION__);
+						goto exit;
+					}
+					_rtw_memset(merged_p2pie, 0x00, merged_p2p_ielen);					
+
+					merged_p2p_ielen = rtw_p2p_merge_ies(frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, merged_p2pie);
+
+					rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_INVITATION_FLAGS, &invitation_flag, &attr_contentlen);
+					if ( attr_contentlen )
+					{
+
+						rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_GROUP_BSSID, pwdinfo->p2p_peer_interface_addr, &attr_contentlen);
+						//	Commented by Albert 20120510
+						//	Copy to the pwdinfo->p2p_peer_interface_addr.
+						//	So that the WFD UI ( or Sigma ) can get the peer interface address by using the following command.
+						//	#> iwpriv wlan0 p2p_get peer_ifa
+						//	After having the peer interface address, the sigma can find the correct conf file for wpa_supplicant.
+
+						if ( attr_contentlen )
+						{
+							DBG_871X( "[%s] GO's BSSID = %.2X %.2X %.2X %.2X %.2X %.2X\n", __FUNCTION__,
+									pwdinfo->p2p_peer_interface_addr[0], pwdinfo->p2p_peer_interface_addr[1],
+									pwdinfo->p2p_peer_interface_addr[2], pwdinfo->p2p_peer_interface_addr[3],
+									pwdinfo->p2p_peer_interface_addr[4], pwdinfo->p2p_peer_interface_addr[5] );
+						}								
+
+						if ( invitation_flag & P2P_INVITATION_FLAGS_PERSISTENT )
+						{
+							//	Re-invoke the persistent group.
+							
+							_rtw_memset( &group_id, 0x00, sizeof( struct group_id_info ) );
+							rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_GROUP_ID, ( u8* ) &group_id, &attr_contentlen);
+							if ( attr_contentlen )
+							{
+								if ( _rtw_memcmp( group_id.go_device_addr, myid( &padapter->eeprompriv ), ETH_ALEN ) )
+								{
+									//	The p2p device sending this p2p invitation request wants this Wi-Fi device to be the persistent GO.
+									rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_GO );
+									rtw_p2p_set_role( pwdinfo, P2P_ROLE_GO );
+									status_code = P2P_STATUS_SUCCESS;
+								}
+								else
+								{
+									//	The p2p device sending this p2p invitation request wants to be the persistent GO.
+									if ( is_matched_in_profilelist( pwdinfo->p2p_peer_interface_addr, &pwdinfo->profileinfo[ 0 ] ) )
+									{
+										u8 operatingch_info[5] = { 0x00 };
+
+										if ( rtw_get_p2p_attr_content(merged_p2pie, merged_p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+										{
+											if( rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, (u32)operatingch_info[4] ) >= 0 )
+											{
+												//	The operating channel is acceptable for this device.
+												pwdinfo->rx_invitereq_info.operation_ch[0]= operatingch_info[4];
+												#ifdef P2P_OP_CHECK_SOCIAL_CH
+												pwdinfo->rx_invitereq_info.operation_ch[1]= 1;		//Check whether GO is operating in channel 1;
+												pwdinfo->rx_invitereq_info.operation_ch[2]= 6;		//Check whether GO is operating in channel 6;
+												pwdinfo->rx_invitereq_info.operation_ch[3]= 11;		//Check whether GO is operating in channel 11;
+												#endif //P2P_OP_CHECK_SOCIAL_CH
+												pwdinfo->rx_invitereq_info.scan_op_ch_only = 1;
+												_set_timer( &pwdinfo->reset_ch_sitesurvey, P2P_RESET_SCAN_CH );
+												rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_MATCH );
+												rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+												status_code = P2P_STATUS_SUCCESS;
+											}
+											else
+											{
+												//	The operating channel isn't supported by this device.
+												rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_DISMATCH );
+												rtw_p2p_set_role( pwdinfo, P2P_ROLE_DEVICE );
+												status_code = P2P_STATUS_FAIL_NO_COMMON_CH;
+												_set_timer( &pwdinfo->restore_p2p_state_timer, 3000 );
+											}
+										}
+										else
+										{
+											//	Commented by Albert 20121130
+											//	Intel will use the different P2P IE to store the operating channel information
+											//	Workaround for Intel WiDi 3.5
+											rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_MATCH );
+											rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+											status_code = P2P_STATUS_SUCCESS;
+										}
+									}
+									else
+									{
+										rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_DISMATCH );
+										#ifdef CONFIG_INTEL_WIDI
+										_rtw_memcpy( pwdinfo->p2p_peer_device_addr, group_id.go_device_addr , ETH_ALEN );
+										rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+										#endif //CONFIG_INTEL_WIDI
+
+										status_code = P2P_STATUS_FAIL_UNKNOWN_P2PGROUP;
+									}
+								}
+							}
+							else
+							{
+								DBG_871X( "[%s] P2P Group ID Attribute NOT FOUND!\n", __FUNCTION__ );
+								status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+							}									
+						}
+						else
+						{
+							//	Received the invitation to join a P2P group.
+
+							_rtw_memset( &group_id, 0x00, sizeof( struct group_id_info ) );
+							rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_GROUP_ID, ( u8* ) &group_id, &attr_contentlen);
+							if ( attr_contentlen )
+							{
+								if ( _rtw_memcmp( group_id.go_device_addr, myid( &padapter->eeprompriv ), ETH_ALEN ) )
+								{
+									//	In this case, the GO can't be myself.
+									rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_DISMATCH );
+									status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+								}
+								else
+								{
+									//	The p2p device sending this p2p invitation request wants to join an existing P2P group
+									//	Commented by Albert 2012/06/28
+									//	In this case, this Wi-Fi device should use the iwpriv command to get the peer device address.
+									//	The peer device address should be the destination address for the provisioning discovery request.
+									//	Then, this Wi-Fi device should use the iwpriv command to get the peer interface address.
+									//	The peer interface address should be the address for WPS mac address
+									_rtw_memcpy( pwdinfo->p2p_peer_device_addr, group_id.go_device_addr , ETH_ALEN );											
+									rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+									rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_JOIN );
+									status_code = P2P_STATUS_SUCCESS;
+								}
+							}
+							else
+							{
+								DBG_871X( "[%s] P2P Group ID Attribute NOT FOUND!\n", __FUNCTION__ );
+								status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+							}
+						}
+					}
+					else
+					{
+						DBG_871X( "[%s] P2P Invitation Flags Attribute NOT FOUND!\n", __FUNCTION__ );
+						status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+					}							
+
+					DBG_871X( "[%s] status_code = %d\n", __FUNCTION__, status_code );
+
+					pwdinfo->inviteresp_info.token = frame_body[ 7 ];
+					issue_p2p_invitation_response( padapter, GetAddr2Ptr(pframe), pwdinfo->inviteresp_info.token, status_code );
+					_set_timer( &pwdinfo->restore_p2p_state_timer, 3000 );
+				}
+#ifdef CONFIG_INTEL_WIDI
+				if( (padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_LISTEN) && (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_WFD_CONNECTION) )
+				{
+					padapter->mlmepriv.widi_state = INTEL_WIDI_STATE_WFD_CONNECTION;
+					_cancel_timer_ex(&(padapter->mlmepriv.listen_timer));
+					intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_STOP_WK, NULL);
+				}
+#endif //CONFIG_INTEL_WIDI
+				break;
+			}
+			case P2P_INVIT_RESP:
+			{
+				u8	attr_content = 0x00;
+				u32	attr_contentlen = 0;
+				
+				DBG_871X( "[%s] Got invite response frame!\n", __FUNCTION__ );
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				if ( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)) )
+				{
+					rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, &attr_content, &attr_contentlen);
+									
+					if ( attr_contentlen == 1 )
+					{
+						DBG_871X( "[%s] Status = %d\n", __FUNCTION__, attr_content );
+						pwdinfo->invitereq_info.benable = _FALSE;
+
+						if ( attr_content == P2P_STATUS_SUCCESS )
+						{
+							if ( _rtw_memcmp( pwdinfo->invitereq_info.go_bssid, myid( &padapter->eeprompriv ), ETH_ALEN ))
+							{
+								rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO );
+							}
+							else
+							{
+								rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+							}
+							rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_OK );
+						}
+						else
+						{
+							rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+							rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL );
+						}
+					}
+					else
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+						rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL );
+					}
+				}
+				else
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+					rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL );
+				}
+
+				if ( rtw_p2p_chk_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL ) )
+				{
+					_set_timer( &pwdinfo->restore_p2p_state_timer, 5000 );
+				}
+				break;
+			}
+			case P2P_DEVDISC_REQ:
+
+				process_p2p_devdisc_req(pwdinfo, pframe, len);
+
+				break;
+
+			case P2P_DEVDISC_RESP:
+
+				process_p2p_devdisc_resp(pwdinfo, pframe, len);
+
+				break;
+
+			case P2P_PROVISION_DISC_REQ:
+				DBG_871X( "[%s] Got Provisioning Discovery Request Frame\n", __FUNCTION__ );
+				process_p2p_provdisc_req(pwdinfo, pframe, len);
+				_rtw_memcpy(pwdinfo->rx_prov_disc_info.peerDevAddr, GetAddr2Ptr(pframe), ETH_ALEN);
+
+				//20110902 Kurt
+				//Add the following statement to avoid receiving duplicate prov disc req. such that pre_p2p_state would be covered.
+				if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ))
+					rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+				
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ);
+				_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+#ifdef CONFIG_INTEL_WIDI
+				if( (padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_LISTEN) && (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_WFD_CONNECTION) )
+				{
+					padapter->mlmepriv.widi_state = INTEL_WIDI_STATE_WFD_CONNECTION;
+					_cancel_timer_ex(&(padapter->mlmepriv.listen_timer));
+					intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_STOP_WK, NULL);
+				}
+#endif //CONFIG_INTEL_WIDI
+				break;
+
+			case P2P_PROVISION_DISC_RESP:
+				//	Commented by Albert 20110707
+				//	Should we check the pwdinfo->tx_prov_disc_info.bsent flag here??
+				DBG_871X( "[%s] Got Provisioning Discovery Response Frame\n", __FUNCTION__ );
+				//	Commented by Albert 20110426
+				//	The restore timer is enabled when issuing the provisioing request frame in rtw_p2p_prov_disc function.
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_RSP);
+				process_p2p_provdisc_resp(pwdinfo, pframe);
+				_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+				break;
+
+		}
+	}
+#endif //CONFIG_P2P
+
+exit:
+
+	if(merged_p2pie)
+	{
+		rtw_mfree(merged_p2pie, merged_p2p_ielen);
+	}
+
+	return _SUCCESS;
+}
+
+unsigned int on_action_public_vendor(union recv_frame *precv_frame)
+{
+	unsigned int ret = _FAIL;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	if (_rtw_memcmp(frame_body + 2, P2P_OUI, 4) == _TRUE) {
+		ret = on_action_public_p2p(precv_frame);
+	}
+
+	return ret;
+}
+
+unsigned int on_action_public_default(union recv_frame *precv_frame, u8 action)
+{
+	unsigned int ret = _FAIL;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+	u8 token;
+	_adapter *adapter = precv_frame->u.hdr.adapter;
+	int cnt = 0;
+	char msg[64];
+
+	token = frame_body[2];
+
+	if (rtw_action_public_decache(precv_frame, token) == _FAIL)
+		goto exit;
+
+	#ifdef CONFIG_IOCTL_CFG80211
+	cnt += sprintf((msg+cnt), "%s(token:%u)", action_public_str(action), token);
+	rtw_cfg80211_rx_action(adapter, pframe, frame_len, msg);
+	#endif
+
+	ret = _SUCCESS;
+	
+exit:
+	return ret;
+}
+
+unsigned int on_action_public(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int ret = _FAIL;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+	u8 category, action;
+
+	/* check RA matches or not */
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
+		goto exit;
+
+	category = frame_body[0];
+	if(category != RTW_WLAN_CATEGORY_PUBLIC)
+		goto exit;
+
+	action = frame_body[1];
+	switch (action) {
+	case ACT_PUBLIC_VENDOR:
+		ret = on_action_public_vendor(precv_frame);
+		break;
+	default:
+		ret = on_action_public_default(precv_frame, action);
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+unsigned int OnAction_ht(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+#ifdef CONFIG_IEEE80211W
+unsigned int OnAction_sa_query(_adapter *padapter, union recv_frame *precv_frame)
+{
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	unsigned short tid;
+	//Baron
+	
+	DBG_871X("OnAction_sa_query\n");
+	
+	switch (pframe[WLAN_HDR_A3_LEN+1])
+	{
+		case 0: //SA Query req
+			_rtw_memcpy(&tid, &pframe[WLAN_HDR_A3_LEN+2], sizeof(unsigned short));
+			DBG_871X("OnAction_sa_query request,action=%d, tid=%04x\n", pframe[WLAN_HDR_A3_LEN+1], tid);
+			issue_action_SA_Query(padapter, GetAddr2Ptr(pframe), 1, tid);
+			break;
+
+		case 1: //SA Query rsp
+			_cancel_timer_ex(&pmlmeext->sa_query_timer);
+			DBG_871X("OnAction_sa_query response,action=%d, tid=%04x, cancel timer\n", pframe[WLAN_HDR_A3_LEN+1], pframe[WLAN_HDR_A3_LEN+2]);
+			break;
+		default:
+			break;
+	}
+	if(0)
+	{
+		int pp;
+		printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
+		for(pp=0;pp< pattrib->pkt_len; pp++)
+			printk(" %02x ", pframe[pp]);
+		printk("\n");
+	}	
+	
+	return _SUCCESS;
+}
+#endif //CONFIG_IEEE80211W
+
+unsigned int OnAction_wmm(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+unsigned int OnAction_p2p(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_P2P
+	u8 *frame_body;
+	u8 category, OUI_Subtype, dialogToken=0;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	struct	wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	
+
+	DBG_871X("%s\n", __FUNCTION__);
+	
+	//check RA matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))//for if1, sta/ap mode
+		return _SUCCESS;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	category = frame_body[0];
+	if(category != RTW_WLAN_CATEGORY_P2P)
+		return _SUCCESS;
+
+	if ( cpu_to_be32( *( ( u32* ) ( frame_body + 1 ) ) ) != P2POUI )
+		return _SUCCESS;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		rtw_cfg80211_rx_action_p2p(padapter, pframe, len);
+		return _SUCCESS;
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		len -= sizeof(struct rtw_ieee80211_hdr_3addr);
+		OUI_Subtype = frame_body[5];
+		dialogToken = frame_body[6];
+
+		switch(OUI_Subtype)
+		{
+			case P2P_NOTICE_OF_ABSENCE:
+				
+				break;
+				
+			case P2P_PRESENCE_REQUEST:
+
+				process_p2p_presence_req(pwdinfo, pframe, len);			
+				
+				break;
+				
+			case P2P_PRESENCE_RESPONSE:
+				
+				break;
+				
+			case P2P_GO_DISC_REQUEST:
+				
+				break;
+				
+			default:
+				break;
+				
+		}
+	}
+#endif //CONFIG_P2P
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnAction(_adapter *padapter, union recv_frame *precv_frame)
+{
+	int i;
+	unsigned char	category;
+	struct action_handler *ptable;
+	unsigned char	*frame_body;
+	u8 *pframe = precv_frame->u.hdr.rx_data; 
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+	
+	category = frame_body[0];
+	
+	for(i = 0; i < sizeof(OnAction_tbl)/sizeof(struct action_handler); i++)	
+	{
+		ptable = &OnAction_tbl[i];
+		
+		if(category == ptable->num)
+			ptable->func(padapter, precv_frame);
+	
+	}
+
+	return _SUCCESS;
+
+}
+
+unsigned int DoReserved(_adapter *padapter, union recv_frame *precv_frame)
+{
+
+	//DBG_871X("rcvd mgt frame(%x, %x)\n", (GetFrameSubType(pframe) >> 4), *(unsigned int *)GetAddr1Ptr(pframe));
+	return _SUCCESS;
+}
+
+struct xmit_frame *_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv, bool once)
+{
+	struct xmit_frame *pmgntframe;
+	struct xmit_buf *pxmitbuf;
+
+	if (once)
+		pmgntframe = rtw_alloc_xmitframe_once(pxmitpriv);
+	else
+		pmgntframe = rtw_alloc_xmitframe_ext(pxmitpriv);
+
+	if (pmgntframe == NULL) {
+		DBG_871X(FUNC_ADPT_FMT" alloc xmitframe fail, once:%d\n", FUNC_ADPT_ARG(pxmitpriv->adapter), once);
+		goto exit;
+	}
+
+	if ((pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv)) == NULL) {
+		DBG_871X(FUNC_ADPT_FMT" alloc xmitbuf fail\n", FUNC_ADPT_ARG(pxmitpriv->adapter));
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		pmgntframe = NULL;
+		goto exit;
+	}
+
+	pmgntframe->frame_tag = MGNT_FRAMETAG;
+	pmgntframe->pxmitbuf = pxmitbuf;
+	pmgntframe->buf_addr = pxmitbuf->pbuf;
+	pxmitbuf->priv_data = pmgntframe;
+
+exit:
+	return pmgntframe;
+
+}
+
+inline struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
+{
+	return _alloc_mgtxmitframe(pxmitpriv, _FALSE);
+}
+
+inline struct xmit_frame *alloc_mgtxmitframe_once(struct xmit_priv *pxmitpriv)
+{
+	return _alloc_mgtxmitframe(pxmitpriv, _TRUE);
+}
+
+
+/****************************************************************************
+
+Following are some TX fuctions for WiFi MLME
+
+*****************************************************************************/
+
+void update_mgnt_tx_rate(_adapter *padapter, u8 rate)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	pmlmeext->tx_rate = rate;
+
+	//DBG_871X("%s(): rate = %x\n",__FUNCTION__, rate);
+}
+
+void update_mgntframe_attrib(_adapter *padapter, struct pkt_attrib *pattrib)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	_rtw_memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
+
+	pattrib->hdrlen = 24;
+	pattrib->nr_frags = 1;
+	pattrib->priority = 7;
+	pattrib->mac_id = 0;
+	pattrib->qsel = 0x12;
+
+	pattrib->pktlen = 0;
+
+	if(pmlmeext->cur_wireless_mode & WIRELESS_11B)
+		pattrib->raid = 6;//b mode
+	else
+		pattrib->raid = 5;//a/g mode
+
+	pattrib->encrypt = _NO_PRIVACY_;
+	pattrib->bswenc = _FALSE;	
+
+	pattrib->qos_en = _FALSE;
+	pattrib->ht_en = _FALSE;
+	pattrib->bwmode = HT_CHANNEL_WIDTH_20;
+	pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	pattrib->sgi = _FALSE;
+
+	pattrib->seqnum = pmlmeext->mgnt_seq;
+
+	pattrib->retry_ctrl = _TRUE;
+
+}
+
+void dump_mgntframe(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+	if(padapter->bSurpriseRemoved == _TRUE ||
+		padapter->bDriverStopped == _TRUE)
+	{
+		rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
+		return;
+	}
+
+	rtw_hal_mgnt_xmit(padapter, pmgntframe);
+}
+
+s32 dump_mgntframe_and_wait(_adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms)
+{
+	s32 ret = _FAIL;
+	_irqL irqL;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
+	struct submit_ctx sctx;
+
+	if(padapter->bSurpriseRemoved == _TRUE ||
+		padapter->bDriverStopped == _TRUE)
+	{
+		rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
+		return ret;
+	}
+
+	rtw_sctx_init(&sctx, timeout_ms);
+	pxmitbuf->sctx = &sctx;
+
+	ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
+
+	if (ret == _SUCCESS)
+		ret = rtw_sctx_wait(&sctx);
+
+	_enter_critical(&pxmitpriv->lock_sctx, &irqL);
+	pxmitbuf->sctx = NULL;
+	_exit_critical(&pxmitpriv->lock_sctx, &irqL);
+
+	 return ret;
+}
+
+s32 dump_mgntframe_and_wait_ack(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+#ifdef CONFIG_XMIT_ACK
+	s32 ret = _FAIL;
+	u32 timeout_ms = 500;//  500ms
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->pbuddy_adapter && !padapter->isprimary)
+		pxmitpriv = &(padapter->pbuddy_adapter->xmitpriv);
+	#endif
+
+	if(padapter->bSurpriseRemoved == _TRUE ||
+		padapter->bDriverStopped == _TRUE)
+	{
+		rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
+		return -1;
+	}
+
+	_enter_critical_mutex(&pxmitpriv->ack_tx_mutex, NULL);
+	pxmitpriv->ack_tx = _TRUE;
+
+	pmgntframe->ack_report = 1;
+	if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS) {
+		ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
+	}
+
+	pxmitpriv->ack_tx = _FALSE;
+	_exit_critical_mutex(&pxmitpriv->ack_tx_mutex, NULL);
+
+	 return ret;
+#else //!CONFIG_XMIT_ACK
+	dump_mgntframe(padapter, pmgntframe);
+	rtw_msleep_os(50);
+	return _SUCCESS;
+#endif //!CONFIG_XMIT_ACK	 
+}
+
+int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
+{
+	u8 *ssid_ie;
+	sint ssid_len_ori;
+	int len_diff = 0;
+	
+	ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
+
+	//DBG_871X("%s hidden_ssid_mode:%u, ssid_ie:%p, ssid_len_ori:%d\n", __FUNCTION__, hidden_ssid_mode, ssid_ie, ssid_len_ori);
+	
+	if(ssid_ie && ssid_len_ori>0)
+	{
+		switch(hidden_ssid_mode)
+		{
+			case 1:
+			{
+				u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
+				u32 remain_len = 0;
+				
+				remain_len = ies_len -(next_ie-ies);
+				
+				ssid_ie[1] = 0;				
+				_rtw_memcpy(ssid_ie+2, next_ie, remain_len);
+				len_diff -= ssid_len_ori;
+				
+				break;
+			}		
+			case 2:
+				_rtw_memset(&ssid_ie[2], 0, ssid_len_ori);
+				break;
+			default:
+				break;
+		}
+	}
+
+	return len_diff;
+}
+
+void issue_beacon(_adapter *padapter)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	unsigned char	*pframe;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	unsigned int	rate_len;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s, alloc mgnt frame fail\n", __FUNCTION__);
+		return;
+	}
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	_enter_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->qsel = 0x10;
+	
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+		
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;	
+	
+	
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	
+	_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
+	//pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_BEACON);
+	
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);	
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+	
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		//DBG_871X("ie len=%d\n", cur_network->IELength);
+#ifdef CONFIG_P2P
+		// for P2P : Primary Device Type & Device Name
+		u32 wpsielen=0, insert_len=0;
+		u8 *wpsie=NULL;		
+		wpsie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wpsielen);
+		
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) && wpsie && wpsielen>0)
+		{
+			uint wps_offset, remainder_ielen;
+			u8 *premainder_ie, *pframe_wscie;
+	
+			wps_offset = (uint)(wpsie - cur_network->IEs);
+
+			premainder_ie = wpsie + wpsielen;
+
+			remainder_ielen = cur_network->IELength - wps_offset - wpsielen;
+
+#ifdef CONFIG_IOCTL_CFG80211
+			if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+			{
+				if(pmlmepriv->wps_beacon_ie && pmlmepriv->wps_beacon_ie_len>0)
+				{
+					_rtw_memcpy(pframe, cur_network->IEs, wps_offset);
+					pframe += wps_offset;
+					pattrib->pktlen += wps_offset;
+
+					_rtw_memcpy(pframe, pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len);
+					pframe += pmlmepriv->wps_beacon_ie_len;
+					pattrib->pktlen += pmlmepriv->wps_beacon_ie_len;
+
+					//copy remainder_ie to pframe
+					_rtw_memcpy(pframe, premainder_ie, remainder_ielen);
+					pframe += remainder_ielen;		
+					pattrib->pktlen += remainder_ielen;
+				}
+				else
+				{
+					_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+					pframe += cur_network->IELength;
+					pattrib->pktlen += cur_network->IELength;
+				}
+			}
+			else
+#endif //CONFIG_IOCTL_CFG80211
+			{
+				pframe_wscie = pframe + wps_offset;
+				_rtw_memcpy(pframe, cur_network->IEs, wps_offset+wpsielen);			
+				pframe += (wps_offset + wpsielen);		
+				pattrib->pktlen += (wps_offset + wpsielen);
+
+				//now pframe is end of wsc ie, insert Primary Device Type & Device Name
+				//	Primary Device Type
+				//	Type:
+				*(u16*) ( pframe + insert_len) = cpu_to_be16( WPS_ATTR_PRIMARY_DEV_TYPE );
+				insert_len += 2;
+				
+				//	Length:
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( 0x0008 );
+				insert_len += 2;
+				
+				//	Value:
+				//	Category ID
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+				insert_len += 2;
+
+				//	OUI
+				*(u32*) ( pframe + insert_len ) = cpu_to_be32( WPSOUI );
+				insert_len += 4;
+
+				//	Sub Category ID
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+				insert_len += 2;
+
+
+				//	Device Name
+				//	Type:
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+				insert_len += 2;
+
+				//	Length:
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( pwdinfo->device_name_len );
+				insert_len += 2;
+
+				//	Value:
+				_rtw_memcpy( pframe + insert_len, pwdinfo->device_name, pwdinfo->device_name_len );
+				insert_len += pwdinfo->device_name_len;
+
+
+				//update wsc ie length
+				*(pframe_wscie+1) = (wpsielen -2) + insert_len;
+
+				//pframe move to end
+				pframe+=insert_len;
+				pattrib->pktlen += insert_len;
+
+				//copy remainder_ie to pframe
+				_rtw_memcpy(pframe, premainder_ie, remainder_ielen);
+				pframe += remainder_ielen;		
+				pattrib->pktlen += remainder_ielen;
+			}
+		}
+		else
+#endif //CONFIG_P2P
+		{
+			int len_diff;
+			_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+			len_diff = update_hidden_ssid(
+				pframe+_BEACON_IE_OFFSET_
+				, cur_network->IELength-_BEACON_IE_OFFSET_
+				, pmlmeinfo->hidden_ssid_mode
+			);
+			pframe += (cur_network->IELength+len_diff);
+			pattrib->pktlen += (cur_network->IELength+len_diff);
+		}
+
+		{
+			u8 *wps_ie;
+			uint wps_ielen;
+			u8 sr = 0;
+			wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof (struct rtw_ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
+				pattrib->pktlen-sizeof (struct rtw_ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
+			if (wps_ie && wps_ielen>0) {
+				rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8*)(&sr), NULL);
+			}
+			if (sr != 0)
+				set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
+			else
+				_clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
+		}
+
+#ifdef CONFIG_P2P
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+		{
+			u32 len;
+#ifdef CONFIG_IOCTL_CFG80211
+			if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+			{
+				len = pmlmepriv->p2p_beacon_ie_len;
+				if(pmlmepriv->p2p_beacon_ie && len>0)				
+					_rtw_memcpy(pframe, pmlmepriv->p2p_beacon_ie, len);
+			}
+			else
+#endif //CONFIG_IOCTL_CFG80211
+			{
+				len = build_beacon_p2p_ie(pwdinfo, pframe);
+			}
+
+			pframe += len;
+			pattrib->pktlen += len;
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+			if(_TRUE == pwdinfo->wfd_info->wfd_enable)
+#endif //CONFIG_IOCTL_CFG80211
+			{
+				len = build_beacon_wfd_ie( pwdinfo, pframe );
+			}
+#ifdef CONFIG_IOCTL_CFG80211
+			else
+			{	
+				len = 0;
+				if(pmlmepriv->wfd_beacon_ie && pmlmepriv->wfd_beacon_ie_len>0)
+				{
+					len = pmlmepriv->wfd_beacon_ie_len;
+					_rtw_memcpy(pframe, pmlmepriv->wfd_beacon_ie, len);	
+				}
+			}
+#endif //CONFIG_IOCTL_CFG80211
+			pframe += len;
+			pattrib->pktlen += len;
+#endif //CONFIG_WFD
+		}
+#endif //CONFIG_P2P
+
+		goto _issue_bcn;
+
+	}
+
+	//below for ad-hoc mode
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	pattrib->pktlen += 8;
+
+	// beacon interval: 2 bytes
+
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2); 
+
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	// capability info: 2 bytes
+
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
+
+	// supported rates...
+	rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &pattrib->pktlen);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
+
+	//if( (pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		u8 erpinfo=0;
+		u32 ATIMWindow;
+		// IBSS Parameter Set...
+		//ATIMWindow = cur->Configuration.ATIMWindow;
+		ATIMWindow = 0;
+		pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
+
+		//ERP IE
+		pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
+	}	
+
+
+	// EXTERNDED SUPPORTED RATE
+	if (rate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
+	}
+
+
+	//todo:HT for adhoc
+
+_issue_bcn:
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	pmlmepriv->update_bcn = _FALSE;
+	
+	_exit_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);	
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+
+	if ((pattrib->pktlen + TXDESC_SIZE) > 512)
+	{
+		DBG_871X("beacon frame too large\n");
+		return;
+	}
+	
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	//DBG_871X("issue bcn_sz=%d\n", pattrib->last_txcmdsz);
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+void issue_probersp(_adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;	
+	unsigned char					*mac, *bssid;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	u8 *pwps_ie;
+	uint wps_ielen;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	unsigned int	rate_len;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s, alloc mgnt frame fail\n", __FUNCTION__);
+		return;
+	}
+
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);	
+	
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+		
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;	
+	
+	mac = myid(&(padapter->eeprompriv));
+	bssid = cur_network->MacAddress;
+	
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(fctrl, WIFI_PROBERSP);
+	
+	pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = pattrib->hdrlen;
+	pframe += pattrib->hdrlen;
+
+
+	if(cur_network->IELength>MAX_IE_SZ)
+		return;
+	
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
+	
+		//inerset & update wps_probe_resp_ie
+		if((pmlmepriv->wps_probe_resp_ie!=NULL) && pwps_ie && (wps_ielen>0))
+		{
+			uint wps_offset, remainder_ielen;
+			u8 *premainder_ie;		
+	
+			wps_offset = (uint)(pwps_ie - cur_network->IEs);
+
+			premainder_ie = pwps_ie + wps_ielen;
+
+			remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
+
+			_rtw_memcpy(pframe, cur_network->IEs, wps_offset);		
+			pframe += wps_offset;		
+			pattrib->pktlen += wps_offset;		
+
+			wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];//to get ie data len
+			if((wps_offset+wps_ielen+2)<=MAX_IE_SZ)
+			{
+				_rtw_memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
+				pframe += wps_ielen+2;		
+				pattrib->pktlen += wps_ielen+2;	
+			}
+
+			if((wps_offset+wps_ielen+2+remainder_ielen)<=MAX_IE_SZ)
+			{
+				_rtw_memcpy(pframe, premainder_ie, remainder_ielen);
+				pframe += remainder_ielen;		
+				pattrib->pktlen += remainder_ielen;	
+			}
+		}
+		else
+		{
+			_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+			pframe += cur_network->IELength;
+			pattrib->pktlen += cur_network->IELength;
+		}
+
+		/* retrieve SSID IE from cur_network->Ssid */
+		{
+			u8 *ssid_ie;
+			sint ssid_ielen;
+			sint ssid_ielen_diff;
+			u8 buf[MAX_IE_SZ];
+			u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct rtw_ieee80211_hdr_3addr);
+
+			ssid_ie = rtw_get_ie(ies+_FIXED_IE_LENGTH_, _SSID_IE_, &ssid_ielen,
+				(pframe-ies)-_FIXED_IE_LENGTH_);
+
+			ssid_ielen_diff = cur_network->Ssid.SsidLength - ssid_ielen;
+
+			if (ssid_ie &&  cur_network->Ssid.SsidLength) {
+				uint remainder_ielen;
+				u8 *remainder_ie;
+				remainder_ie = ssid_ie+2;
+				remainder_ielen = (pframe-remainder_ie);
+
+				LOG_LEVEL(_drv_warning_, FUNC_ADPT_FMT" remainder_ielen > MAX_IE_SZ\n", FUNC_ADPT_ARG(padapter));
+				if (remainder_ielen > MAX_IE_SZ) {
+					remainder_ielen = MAX_IE_SZ;
+				}
+
+				_rtw_memcpy(buf, remainder_ie, remainder_ielen);
+				_rtw_memcpy(remainder_ie+ssid_ielen_diff, buf, remainder_ielen);
+				*(ssid_ie+1) = cur_network->Ssid.SsidLength;
+				_rtw_memcpy(ssid_ie+2, cur_network->Ssid.Ssid, cur_network->Ssid.SsidLength);
+
+				pframe += ssid_ielen_diff;
+				pattrib->pktlen += ssid_ielen_diff;
+			}
+		}
+	}	
+	else		
+#endif		
+	{
+	
+		//timestamp will be inserted by hardware
+		pframe += 8;
+		pattrib->pktlen += 8;
+
+		// beacon interval: 2 bytes
+
+		_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2); 
+
+		pframe += 2;
+		pattrib->pktlen += 2;
+
+		// capability info: 2 bytes
+
+		_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+		pframe += 2;
+		pattrib->pktlen += 2;
+
+		//below for ad-hoc mode
+
+		// SSID
+		pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
+
+		// supported rates...
+		rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &pattrib->pktlen);
+
+		// DS parameter set
+		pframe =rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
+
+		if( (pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+		{
+			u8 erpinfo=0;
+			u32 ATIMWindow;
+			// IBSS Parameter Set...
+			//ATIMWindow = cur->Configuration.ATIMWindow;
+			ATIMWindow = 0;
+			pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
+
+			//ERP IE
+			pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
+		}
+
+		
+		// EXTERNDED SUPPORTED RATE
+		if (rate_len > 8)
+		{
+			pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
+		}
+
+
+		//todo:HT for adhoc
+
+	}	
+
+#ifdef CONFIG_P2P
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) /*&& is_valid_p2p_probereq*/)
+	{
+		u32 len;
+#ifdef CONFIG_IOCTL_CFG80211
+		if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			//if pwdinfo->role == P2P_ROLE_DEVICE will call issue_probersp_p2p()
+			len = pmlmepriv->p2p_go_probe_resp_ie_len;
+			if(pmlmepriv->p2p_go_probe_resp_ie && len>0)
+				_rtw_memcpy(pframe, pmlmepriv->p2p_go_probe_resp_ie, len);
+		}
+		else
+#endif //CONFIG_IOCTL_CFG80211
+		{
+			len = build_probe_resp_p2p_ie(pwdinfo, pframe);
+		}
+
+		pframe += len;
+		pattrib->pktlen += len;
+		
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+		if(_TRUE == pwdinfo->wfd_info->wfd_enable)
+#endif //CONFIG_IOCTL_CFG80211
+		{
+			len = build_probe_resp_wfd_ie(pwdinfo, pframe, 0);
+		}
+#ifdef CONFIG_IOCTL_CFG80211
+		else
+		{	
+			len = 0;
+			if(pmlmepriv->wfd_probe_resp_ie && pmlmepriv->wfd_probe_resp_ie_len>0)
+			{
+				len = pmlmepriv->wfd_probe_resp_ie_len;
+				_rtw_memcpy(pframe, pmlmepriv->wfd_probe_resp_ie, len);	
+			}	
+		}
+#endif //CONFIG_IOCTL_CFG80211		
+		pframe += len;
+		pattrib->pktlen += len;
+#endif //CONFIG_WFD
+
+	}
+#endif //CONFIG_P2P
+
+
+#ifdef CONFIG_AUTO_AP_MODE
+{
+	struct sta_info *psta;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("(%s)\n", __FUNCTION__);
+
+	//check rc station
+	psta = rtw_get_stainfo(pstapriv, da);
+	if (psta && psta->isrc && psta->pid>0)
+	{
+		u8 RC_OUI[4]={0x00,0xE0,0x4C,0x0A};
+		u8 RC_INFO[14] = {0};
+		//EID[1] + EID_LEN[1] + RC_OUI[4] + MAC[6] + PairingID[2] + ChannelNum[2]
+		u16 cu_ch = (u16)cur_network->Configuration.DSConfig;
+
+		DBG_871X("%s, reply rc(pid=0x%x) device "MAC_FMT" in ch=%d\n", __FUNCTION__,
+			psta->pid, MAC_ARG(psta->hwaddr), cu_ch);
+
+		//append vendor specific ie
+		_rtw_memcpy(RC_INFO, RC_OUI, sizeof(RC_OUI));
+		_rtw_memcpy(&RC_INFO[4], mac, ETH_ALEN);
+		_rtw_memcpy(&RC_INFO[10], (u8*)&psta->pid, 2);
+		_rtw_memcpy(&RC_INFO[12], (u8*)&cu_ch, 2);
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, sizeof(RC_INFO), RC_INFO, &pattrib->pktlen);
+	}
+}
+#endif //CONFIG_AUTO_AP_MODE
+
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	
+
+	dump_mgntframe(padapter, pmgntframe);
+	
+	return;
+
+}
+
+int _issue_probereq(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	unsigned char			*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short		*fctrl;
+	unsigned char			*mac;
+	unsigned char			bssrate[NumRates];
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int	bssrate_len = 0;
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_notice_,("+issue_probereq\n"));
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if (da)
+	{
+		//	unicast probe request frame
+		_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, da, ETH_ALEN);
+	}
+	else
+	{
+		//	broadcast probe request frame
+		_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, bc_addr, ETH_ALEN);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_PROBEREQ);
+
+	pframe += sizeof (struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	if(pssid)
+		pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
+	else
+		pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
+
+	get_rate_set(padapter, bssrate, &bssrate_len);
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+#if 0
+	//add wps_ie for wps2.0
+	if(pmlmepriv->probereq_wpsie_len>0 && pmlmepriv->probereq_wpsie_len<MAX_WPS_IE_LEN)
+	{
+		_rtw_memcpy(pframe, pmlmepriv->probereq_wpsie, pmlmepriv->probereq_wpsie_len);
+		pframe += pmlmepriv->probereq_wpsie_len;
+		pattrib->pktlen += pmlmepriv->probereq_wpsie_len;
+		//pmlmepriv->probereq_wpsie_len = 0 ;//reset to zero		
+	}	
+#else
+	//add wps_ie for wps2.0
+	if(pmlmepriv->wps_probe_req_ie_len>0 && pmlmepriv->wps_probe_req_ie)
+	{
+		_rtw_memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
+		pframe += pmlmepriv->wps_probe_req_ie_len;
+		pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
+		//pmlmepriv->wps_probe_req_ie_len = 0 ;//reset to zero		
+	}	
+#endif
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_notice_,("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
+
+	if (wait_ack) {
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	} else {
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+inline void issue_probereq(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da)
+{
+	_issue_probereq(padapter, pssid, da, _FALSE);
+}
+
+int issue_probereq_ex(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da,
+	int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+
+	do
+	{
+		ret = _issue_probereq(padapter, pssid, da, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+// if psta == NULL, indiate we are station(client) now...
+void issue_auth(_adapter *padapter, struct sta_info *psta, unsigned short status)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned int					val32;
+	unsigned short				val16;
+	int use_shared_key = 0;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_AUTH);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+
+	if(psta)// for AP mode
+	{
+#ifdef CONFIG_NATIVEAP_MLME
+
+		_rtw_memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);		
+		_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	
+		// setting auth algo number	
+		val16 = (u16)psta->authalg;
+
+		if(status != _STATS_SUCCESSFUL_)
+			val16 = 0;
+
+		if (val16)	{
+			val16 = cpu_to_le16(val16);	
+			use_shared_key = 1;
+		}
+
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// setting auth seq number
+		val16 =(u16)psta->auth_seq;
+		val16 = cpu_to_le16(val16);	
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// setting status code...
+		val16 = status;
+		val16 = cpu_to_le16(val16);	
+		pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// added challenging text...
+		if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key==1))
+		{
+			pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));			
+		}
+#endif
+	}
+	else
+	{		
+		_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
+	
+		// setting auth algo number		
+		val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)? 1: 0;// 0:OPEN System, 1:Shared key
+		if (val16)	{
+			val16 = cpu_to_le16(val16);	
+			use_shared_key = 1;
+		}	
+		//DBG_871X("%s auth_algo= %s auth_seq=%d\n",__FUNCTION__,(pmlmeinfo->auth_algo==0)?"OPEN":"SHARED",pmlmeinfo->auth_seq);
+		
+		//setting IV for auth seq #3
+		if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key==1))
+		{
+			//DBG_871X("==> iv(%d),key_index(%d)\n",pmlmeinfo->iv,pmlmeinfo->key_index);
+			val32 = ((pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30));
+			val32 = cpu_to_le32(val32);
+			pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *)&val32, &(pattrib->pktlen));
+
+			pattrib->iv_len = 4;
+		}
+
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+		
+		// setting auth seq number
+		val16 = pmlmeinfo->auth_seq;
+		val16 = cpu_to_le16(val16);	
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		
+		// setting status code...
+		val16 = status;
+		val16 = cpu_to_le16(val16);	
+		pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// then checking to see if sending challenging text...
+		if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key==1))
+		{
+			pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
+
+			SetPrivacy(fctrl);
+			
+			pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);			
+			
+			pattrib->encrypt = _WEP40_;
+
+			pattrib->icv_len = 4;
+			
+			pattrib->pktlen += pattrib->icv_len;			
+			
+		}
+		
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+}
+
+
+void issue_asocrsp(_adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type)
+{
+#ifdef CONFIG_AP_MODE
+	struct xmit_frame	*pmgntframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	struct pkt_attrib *pattrib;
+	unsigned char	*pbuf, *pframe;
+	unsigned short val;		
+	unsigned short *fctrl;
+	struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);	
+	WLAN_BSSID_EX *pnetwork = &(pmlmeinfo->network);
+	u8 *ie = pnetwork->IEs; 
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
+	_rtw_memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy((void *)GetAddr3Ptr(pwlanhdr), get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
+		SetFrameSubType(pwlanhdr, pkt_type);		
+	else
+		return;
+
+	pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen += pattrib->hdrlen;
+	pframe += pattrib->hdrlen;
+
+	//capability
+	val = *(unsigned short *)rtw_get_capability_from_ie(ie);
+
+	pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_ , (unsigned char *)&val, &(pattrib->pktlen));
+
+	status = cpu_to_le16(status);
+	pframe = rtw_set_fixed_ie(pframe , _STATUS_CODE_ , (unsigned char *)&status, &(pattrib->pktlen));
+	
+	val = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
+	pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_ , (unsigned char *)&val, &(pattrib->pktlen));
+
+	if (pstat->bssratelen <= 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
+	}	
+	else 
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_80211N_HT
+	if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option))
+	{
+		uint ie_len=0;
+		
+		//FILL HT CAP INFO IE
+		//p = hostapd_eid_ht_capabilities_info(hapd, p);
+		pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
+		if(pbuf && ie_len>0)
+		{
+			_rtw_memcpy(pframe, pbuf, ie_len+2);
+			pframe += (ie_len+2);
+			pattrib->pktlen +=(ie_len+2);
+		}
+
+		//FILL HT ADD INFO IE
+		//p = hostapd_eid_ht_operation(hapd, p);
+		pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
+		if(pbuf && ie_len>0)
+		{
+			_rtw_memcpy(pframe, pbuf, ie_len+2);
+			pframe += (ie_len+2);
+			pattrib->pktlen +=(ie_len+2);
+		}
+		
+	}	
+#endif
+
+	//FILL WMM IE
+	if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option))
+	{
+		uint ie_len=0;
+		unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};	
+		
+		for (pbuf = ie + _BEACON_IE_OFFSET_; ;pbuf+= (ie_len + 2))
+		{			
+			pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));	
+			if(pbuf && _rtw_memcmp(pbuf+2, WMM_PARA_IE, 6)) 
+			{				
+				_rtw_memcpy(pframe, pbuf, ie_len+2);
+				pframe += (ie_len+2);
+				pattrib->pktlen +=(ie_len+2);
+				
+				break;				
+			}
+			
+			if ((pbuf == NULL) || (ie_len == 0))
+			{
+				break;
+			}			
+		}
+		
+	}
+
+
+	if (pmlmeinfo->assoc_AP_vendor == realtekAP)
+	{
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
+	}
+
+	//add WPS IE ie for wps 2.0
+	if(pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len>0)
+	{
+		_rtw_memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
+		
+		pframe += pmlmepriv->wps_assoc_resp_ie_len;
+		pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
+	}
+
+#ifdef CONFIG_P2P
+	if( padapter->wdinfo.driver_interface == DRIVER_WEXT )
+	{
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) && (pstat->is_p2p_device == _TRUE))
+		{
+			u32 len;
+
+			len = build_assoc_resp_p2p_ie(pwdinfo, pframe, pstat->p2p_status_code);
+
+			pframe += len;
+			pattrib->pktlen += len;
+		}
+	}
+#ifdef CONFIG_WFD
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO)
+#ifdef CONFIG_IOCTL_CFG80211		
+		&& (_TRUE == pwdinfo->wfd_info->wfd_enable)
+#endif //CONFIG_IOCTL_CFG80211	
+	)
+	{
+		wfdielen = build_assoc_resp_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	
+	dump_mgntframe(padapter, pmgntframe);
+	
+#endif
+}
+
+void issue_assocreq(_adapter *padapter)
+{
+	int ret = _FAIL;
+	struct xmit_frame				*pmgntframe;
+	struct pkt_attrib				*pattrib;
+	unsigned char					*pframe, *p;
+	struct rtw_ieee80211_hdr			*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned short				val16;
+	unsigned int					i, j, ie_len, index=0;
+	unsigned char					rf_type, bssrate[NumRates], sta_bssrate[NumRates];
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int	bssrate_len = 0, sta_bssrate_len = 0;
+	u8	cbw40_enable = 0;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8					p2pie[ 255 ] = { 0x00 };
+	u16					p2pielen = 0;	
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_DFS
+	u16	cap;
+	u8 pow_cap_ele[2] = { 0x00 };
+	u8 sup_ch[ 30 * 2 ] = {0x00 }, sup_ch_idx = 0, idx_5g = 2;	//For supported channel
+#endif //CONFIG_DFS
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+		goto exit;
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ASSOCREQ);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//caps
+
+#ifdef CONFIG_DFS
+	_rtw_memcpy(&cap, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+	if(pmlmeext->cur_channel > 14)
+		cap |= BIT(8); //Spectrum Mgmt. Enabled
+	_rtw_memcpy(pframe, &cap, 2);
+#else
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+#endif //CONFIG_DFS
+
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//listen interval
+	//todo: listen interval for power saving
+	val16 = cpu_to_le16(3);
+	_rtw_memcpy(pframe ,(unsigned char *)&val16, 2);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
+
+	//supported rate & extended supported rate
+
+#if 1	// Check if the AP's supported rates are also supported by STA.
+	get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
+	//DBG_871X("sta_bssrate_len=%d\n", sta_bssrate_len);
+	
+	if(pmlmeext->cur_channel == 14)// for JAPAN, channel 14 can only uses B Mode(CCK) 
+	{
+		sta_bssrate_len = 4;
+	}
+
+	
+	//for (i = 0; i < sta_bssrate_len; i++) {
+	//	DBG_871X("sta_bssrate[%d]=%02X\n", i, sta_bssrate[i]);
+	//}
+
+	for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
+		if (pmlmeinfo->network.SupportedRates[i] == 0) break;
+		DBG_871X("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
+	}
+	
+
+	for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
+		if (pmlmeinfo->network.SupportedRates[i] == 0) break;
+
+		
+		// Check if the AP's supported rates are also supported by STA.
+		for (j=0; j < sta_bssrate_len; j++) {
+			 // Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP
+			if ( (pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK) 
+					== (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK)) {
+				//DBG_871X("match i = %d, j=%d\n", i, j);
+				break;
+			} else {
+				//DBG_871X("not match: %02X != %02X\n", (pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK), (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK));
+			}
+		}
+		
+		if (j == sta_bssrate_len) {
+			// the rate is not supported by STA
+			DBG_871X("%s(): the rate[%d]=%02X is not supported by STA!\n",__FUNCTION__, i, pmlmeinfo->network.SupportedRates[i]);
+		} else {
+			// the rate is supported by STA
+			bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
+		}
+	}
+	
+	bssrate_len = index;
+	DBG_871X("bssrate_len = %d\n", bssrate_len);
+
+#else	// Check if the AP's supported rates are also supported by STA.
+#if 0
+	get_rate_set(padapter, bssrate, &bssrate_len);
+#else
+	for (bssrate_len = 0; bssrate_len < NumRates; bssrate_len++) {
+		if (pmlmeinfo->network.SupportedRates[bssrate_len] == 0) break;
+
+		if (pmlmeinfo->network.SupportedRates[bssrate_len] == 0x2C) // Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP
+			break;
+
+		bssrate[bssrate_len] = pmlmeinfo->network.SupportedRates[bssrate_len];
+	}
+#endif
+#endif	// Check if the AP's supported rates are also supported by STA.
+
+	if (bssrate_len == 0) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit; //don't connect to AP if no joint supported rate
+	}
+
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_DFS
+	if(pmlmeext->cur_channel > 14)
+	{
+		pow_cap_ele[0] = 13;	// Minimum transmit power capability
+		pow_cap_ele[1] = 21;	// Maximum transmit power capability
+		pframe = rtw_set_ie(pframe, _POW_CAP_IE_, 2, pow_cap_ele, &(pattrib->pktlen));
+
+		//supported channels
+		do{
+			if( pmlmeext->channel_set[sup_ch_idx].ChannelNum <= 14 )
+			{
+				sup_ch[0] = 1;	//First channel number
+				sup_ch[1] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;	//Number of channel
+			}
+			else
+			{
+				sup_ch[idx_5g++] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;
+				sup_ch[idx_5g++] = 1;
+			}
+			sup_ch_idx++;
+		}
+		while( pmlmeext->channel_set[sup_ch_idx].ChannelNum != 0 );
+		pframe = rtw_set_ie(pframe, _SUPPORTED_CH_IE_, idx_5g, sup_ch, &(pattrib->pktlen));
+	}
+#endif //CONFIG_DFS
+
+	//RSN
+	p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(NDIS_802_11_FIXED_IEs)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+	if (p != NULL)
+	{
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_80211N_HT
+	//HT caps
+	if(padapter->mlmepriv.htpriv.ht_option==_TRUE)
+	{
+		p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+		if ((p != NULL) && (!(is_ap_in_tkip(padapter))))
+		{
+			_rtw_memcpy(&(pmlmeinfo->HT_caps), (p + 2), sizeof(struct HT_caps_element));
+
+			//to disable 40M Hz support while gd_bw_40MHz_en = 0
+			if( pmlmeext->cur_channel > 14)
+			{
+				if(pregpriv->cbw40_enable & BIT(1) )
+					cbw40_enable=1;
+			}
+			else
+				if(pregpriv->cbw40_enable & BIT(0) )
+					cbw40_enable=1;
+
+			if (cbw40_enable == 0)
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info &= (~(BIT(6) | BIT(1)));
+			}
+			else
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= BIT(1);
+			}
+
+			//todo: disable SM power save mode
+			pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= 0x000c;
+
+			rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+			//switch (pregpriv->rf_config)
+			switch(rf_type)
+			{
+				case RF_1T1R:
+				
+					if(pregpriv->rx_stbc)
+						pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);//RX STBC One spatial stream
+						
+					_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
+					break;
+
+				case RF_2T2R:
+				case RF_1T2R:
+				default:
+					
+
+					if(pregpriv->special_rf_path)
+					{
+						if(pregpriv->rx_stbc)
+							pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);//RX STBC One spatial stream
+						_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
+						break;
+					}
+
+					if((pregpriv->rx_stbc == 0x3) ||//enable for 2.4/5 GHz	
+						((pmlmeext->cur_wireless_mode & WIRELESS_11_24N) && (pregpriv->rx_stbc == 0x1)) || //enable for 2.4GHz
+						((pmlmeext->cur_wireless_mode & WIRELESS_11_5N) && (pregpriv->rx_stbc == 0x2)) || //enable for 5GHz
+						(pregpriv->wifi_spec==1))
+					{
+						DBG_871X("declare supporting RX STBC\n");
+						pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0200);//RX STBC two spatial stream
+					}
+					#ifdef CONFIG_DISABLE_MCS13TO15
+					if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40 && (pregpriv->wifi_spec!=1))
+						_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R_MCS13TO15_OFF, 16);
+					else
+					_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R, 16);
+					#else //CONFIG_DISABLE_MCS13TO15
+					_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R, 16);
+					#endif //CONFIG_DISABLE_MCS13TO15
+					break;
+			}
+#ifdef RTL8192C_RECONFIG_TO_1T1R
+			{
+				if(pregpriv->rx_stbc)
+					pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);//RX STBC One spatial stream
+			
+				_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
+			}
+#endif
+			pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info = cpu_to_le16(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info);
+			pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len , (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
+
+		}
+	}
+#endif
+
+	//vendor specific IE, such as WPA, WMM, WPS
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pmlmeinfo->network.IELength;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pmlmeinfo->network.IEs + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_:
+				if ((_rtw_memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
+						(_rtw_memcmp(pIE->data, WMM_OUI, 4)) ||
+						(_rtw_memcmp(pIE->data, WPS_OUI, 4)))
+				{
+					if(!padapter->registrypriv.wifi_spec)
+					{
+						//Commented by Kurt 20110629
+						//In some older APs, WPS handshake
+						//would be fail if we append vender extensions informations to AP
+						if(_rtw_memcmp(pIE->data, WPS_OUI, 4)){
+							pIE->Length=14;
+						}
+					}
+					pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
+				}
+				break;
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	if (pmlmeinfo->assoc_AP_vendor == realtekAP)
+	{
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_P2P
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(pmlmepriv->p2p_assoc_req_ie && pmlmepriv->p2p_assoc_req_ie_len>0)
+		{
+			_rtw_memcpy(pframe, pmlmepriv->p2p_assoc_req_ie, pmlmepriv->p2p_assoc_req_ie_len);
+			pframe += pmlmepriv->p2p_assoc_req_ie_len;
+			pattrib->pktlen += pmlmepriv->p2p_assoc_req_ie_len;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) && !rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+		{
+			//	Should add the P2P IE in the association request frame.	
+			//	P2P OUI
+			
+			p2pielen = 0;
+			p2pie[ p2pielen++ ] = 0x50;
+			p2pie[ p2pielen++ ] = 0x6F;
+			p2pie[ p2pielen++ ] = 0x9A;
+			p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+			//	Commented by Albert 20101109
+			//	According to the P2P Specification, the association request frame should contain 3 P2P attributes
+			//	1. P2P Capability
+			//	2. Extended Listen Timing
+			//	3. Device Info
+			//	Commented by Albert 20110516
+			//	4. P2P Interface
+
+			//	P2P Capability
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Device Capability Bitmap, 1 byte
+			p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+			//	Group Capability Bitmap, 1 byte
+			if ( pwdinfo->persistent_supported )
+				p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+			else
+				p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+			//	Extended Listen Timing
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Availability Period
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+			p2pielen += 2;
+
+			//	Availability Interval
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+			p2pielen += 2;
+
+			//	Device Info
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+			//	Length:
+			//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+			//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+			p2pielen += 2;
+
+			//	Value:
+			//	P2P Device Address
+			_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+			p2pielen += ETH_ALEN;
+
+			//	Config Method
+			//	This field should be big endian. Noted by P2P specification.
+			if ( ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PEER_DISPLAY_PIN ) ||
+				( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_SELF_DISPLAY_PIN ) )
+			{
+				*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_DISPLAY );
+			}
+			else
+			{
+				*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_PBC );
+			}
+
+			p2pielen += 2;
+
+			//	Primary Device Type
+			//	Category ID
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+			p2pielen += 2;
+
+			//	OUI
+			*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+			p2pielen += 4;
+
+			//	Sub Category ID
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+			p2pielen += 2;
+
+			//	Number of Secondary Device Types
+			p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+			//	Device Name
+			//	Type:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+			p2pielen += 2;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+			p2pielen += 2;
+
+			//	Value:
+			_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+			p2pielen += pwdinfo->device_name_len;
+		
+			//	P2P Interface
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_INTERFACE;
+			
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x000D );
+			p2pielen += 2;
+			
+			//	Value:
+			_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );	//	P2P Device Address
+			p2pielen += ETH_ALEN;
+
+			p2pie[ p2pielen++ ] = 1;	//	P2P Interface Address Count
+			
+			_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );	//	P2P Interface Address List
+			p2pielen += ETH_ALEN;
+		
+			pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+			//wfdielen = build_assoc_req_wfd_ie(pwdinfo, pframe);
+			//pframe += wfdielen;
+			//pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+		}
+	}
+
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( _TRUE == pwdinfo->wfd_info->wfd_enable )
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		wfdielen = build_assoc_req_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#ifdef CONFIG_IOCTL_CFG80211
+	else if (pmlmepriv->wfd_assoc_req_ie != NULL && pmlmepriv->wfd_assoc_req_ie_len>0)		
+	{
+		//WFD IE
+		_rtw_memcpy(pframe, pmlmepriv->wfd_assoc_req_ie, pmlmepriv->wfd_assoc_req_ie_len);
+		pattrib->pktlen += pmlmepriv->wfd_assoc_req_ie_len;
+		pframe += pmlmepriv->wfd_assoc_req_ie_len;		
+	}
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_WFD	
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	dump_mgntframe(padapter, pmgntframe);
+
+	ret = _SUCCESS;
+
+exit:
+	if (ret == _SUCCESS)
+		rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
+	else
+		rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
+
+	return;
+}
+
+//when wait_ack is ture, this function shoule be called at process context
+static int _issue_nulldata(_adapter *padapter, unsigned char *da, unsigned int power_mode, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv	*pxmitpriv;
+	struct mlme_ext_priv	*pmlmeext;
+	struct mlme_ext_info	*pmlmeinfo;
+
+	//DBG_871X("%s:%d\n", __FUNCTION__, power_mode);
+
+	if(!padapter)
+		goto exit;
+
+	pxmitpriv = &(padapter->xmitpriv);
+	pmlmeext = &(padapter->mlmeextpriv);
+	pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->retry_ctrl = _FALSE;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		SetFrDs(fctrl);
+	}
+	else if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		SetToDs(fctrl);
+	}
+	
+	if (power_mode)
+	{
+		SetPwrMgt(fctrl);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	if(wait_ack)
+	{
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	}
+	else
+	{
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+
+//when wait_ms >0 , this function shoule be called at process context
+//da == NULL for station mode
+int issue_nulldata(_adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	/* da == NULL, assum it's null data for sta to ap*/
+	if (da == NULL)
+		da = get_my_bssid(&(pmlmeinfo->network));
+
+	do
+	{
+		ret = _issue_nulldata(padapter, da, power_mode, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+//when wait_ack is ture, this function shoule be called at process context
+static int _issue_qos_nulldata(_adapter *padapter, unsigned char *da, u16 tid, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl, *qc;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	pattrib->hdrlen +=2;
+	pattrib->qos_en = _TRUE;
+	pattrib->eosp = 1;
+	pattrib->ack_policy = 0;
+	pattrib->mdata = 0;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		SetFrDs(fctrl);
+	}
+	else if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		SetToDs(fctrl);
+	}
+
+	if(pattrib->mdata)
+		SetMData(fctrl);
+
+	qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
+	
+	SetPriority(qc, tid);
+
+	SetEOSP(qc, pattrib->eosp);
+
+	SetAckpolicy(qc, pattrib->ack_policy);
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr_qos);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr_qos);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	
+	if(wait_ack)
+	{
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	}
+	else
+	{
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+//when wait_ms >0 , this function shoule be called at process context
+//da == NULL for station mode
+int issue_qos_nulldata(_adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	/* da == NULL, assum it's null data for sta to ap*/
+	if (da == NULL)
+		da = get_my_bssid(&(pmlmeinfo->network));
+	
+	do
+	{
+		ret = _issue_qos_nulldata(padapter, da, tid, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+static int _issue_deauth(_adapter *padapter, unsigned char *da, unsigned short reason, u8 wait_ack)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int ret = _FAIL;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+	
+	//DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da));
+
+#ifdef CONFIG_P2P
+	if ( !( rtw_p2p_chk_state( pwdinfo, P2P_STATE_NONE ) ) && ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) )
+	{
+		_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+		_set_timer( &pwdinfo->reset_ch_sitesurvey, 10 );
+	}
+#endif //CONFIG_P2P
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->retry_ctrl = _FALSE;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_DEAUTH);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	reason = cpu_to_le16(reason);
+	pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_ , (unsigned char *)&reason, &(pattrib->pktlen));
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+
+	if(wait_ack)
+	{
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	}
+	else
+	{
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+int issue_deauth(_adapter *padapter, unsigned char *da, unsigned short reason)
+{
+	DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da));
+	return _issue_deauth(padapter, da, reason, _FALSE);
+}
+
+int issue_deauth_ex(_adapter *padapter, u8 *da, unsigned short reason, int try_cnt,
+	int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+
+	do
+	{
+		ret = _issue_deauth(padapter, da, reason, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+void issue_action_spct_ch_switch(_adapter *padapter, u8 *ra, u8 new_ch, u8 ch_offset)
+{	
+	_irqL	irqL;
+	_list		*plist, *phead;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char				*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short			*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	DBG_871X(FUNC_NDEV_FMT" ra="MAC_FMT", ch:%u, offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev), MAC_ARG(ra), new_ch, ch_offset);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+		return;
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, ra, ETH_ALEN); /* RA */
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN); /* TA */
+	_rtw_memcpy(pwlanhdr->addr3, ra, ETH_ALEN); /* DA = RA */
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	/* category, action */
+	{
+		u8 category, action;
+		category = RTW_WLAN_CATEGORY_SPECTRUM_MGMT;
+		action = RTW_WLAN_ACTION_SPCT_CHL_SWITCH;
+
+		pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+		pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	}
+
+	pframe = rtw_set_ie_ch_switch(pframe, &(pattrib->pktlen), 0, new_ch, 0);
+	pframe = rtw_set_ie_secondary_ch_offset(pframe, &(pattrib->pktlen),
+		hal_ch_offset_to_secondary_ch_offset(ch_offset));
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+#ifdef CONFIG_IEEE80211W
+void issue_action_SA_Query(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid)
+{
+	u8	category = RTW_WLAN_CATEGORY_SA_QUERY;
+	u16	reason_code;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	u8					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_info		*psta;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct registry_priv	 	*pregpriv = &padapter->registrypriv;
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s: alloc_mgtxmitframe fail\n", __FUNCTION__);
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if(raddr)
+		_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	else
+		_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
+	pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
+
+	switch (action)
+	{
+		case 0: //SA Query req
+			pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&pmlmeext->sa_query_seq, &pattrib->pktlen);
+			pmlmeext->sa_query_seq++;
+			//send sa query request to AP, AP should reply sa query response in 1 second
+			set_sa_query_timer(pmlmeext, 1000);
+			break;
+
+		case 1: //SA Query rsp
+			tid = cpu_to_le16(tid);
+			pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&tid, &pattrib->pktlen);
+			break;
+		default:
+			break;
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+}
+#endif //CONFIG_IEEE80211W
+
+void issue_action_BA(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status)
+{
+	u8	category = RTW_WLAN_CATEGORY_BACK;
+	u16	start_seq;
+	u16	BA_para_set;
+	u16	reason_code;
+	u16	BA_timeout_value;
+	u16	BA_starting_seqctrl;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	u8					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_info		*psta;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct registry_priv	 	*pregpriv = &padapter->registrypriv;
+
+
+	DBG_871X("%s, category=%d, action=%d, status=%d\n", __FUNCTION__, category, action, status);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	//_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+
+      status = cpu_to_le16(status);
+	
+
+	if (category == 3)
+	{
+		switch (action)
+		{
+			case 0: //ADDBA req
+				do {
+					pmlmeinfo->dialogToken++;
+				} while (pmlmeinfo->dialogToken == 0);
+				pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
+
+				BA_para_set = (0x1002 | ((status & 0xf) << 2)); //immediate ack & 64 buffer size
+				//sys_mib.BA_para_set = 0x0802; //immediate ack & 32 buffer size
+				BA_para_set = cpu_to_le16(BA_para_set);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_para_set)), &(pattrib->pktlen));
+
+				//BA_timeout_value = 0xffff;//max: 65535 TUs(~ 65 ms)
+				BA_timeout_value = 5000;//~ 5ms
+				BA_timeout_value = cpu_to_le16(BA_timeout_value);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_timeout_value)), &(pattrib->pktlen));
+
+				//if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL)
+				if ((psta = rtw_get_stainfo(pstapriv, raddr)) != NULL)
+				{
+					start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
+
+					DBG_871X("BA_starting_seqctrl = %d for TID=%d\n", start_seq, status & 0x07);
+					
+					psta->BA_starting_seqctrl[status & 0x07] = start_seq;
+					
+					BA_starting_seqctrl = start_seq << 4;
+				}
+				
+				BA_starting_seqctrl = cpu_to_le16(BA_starting_seqctrl);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_starting_seqctrl)), &(pattrib->pktlen));
+				break;
+
+			case 1: //ADDBA rsp
+				pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->ADDBA_req.dialog_token), &(pattrib->pktlen));
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&status), &(pattrib->pktlen));
+
+				//BA_para_set = cpu_to_le16((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); //64 buffer size
+				BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); //64 buffer size
+
+				if(pregpriv->ampdu_amsdu==0)//disabled
+					BA_para_set = cpu_to_le16(BA_para_set & ~BIT(0));
+				else if(pregpriv->ampdu_amsdu==1)//enabled
+					BA_para_set = cpu_to_le16(BA_para_set | BIT(0));
+				else //auto
+					BA_para_set = cpu_to_le16(BA_para_set);
+				
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_para_set)), &(pattrib->pktlen));
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(pmlmeinfo->ADDBA_req.BA_timeout_value)), &(pattrib->pktlen));
+				break;
+			case 2://DELBA
+				BA_para_set = (status & 0x1F) << 3;
+				BA_para_set = cpu_to_le16(BA_para_set);				
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_para_set)), &(pattrib->pktlen));
+
+				reason_code = 37;//Requested from peer STA as it does not want to use the mechanism
+				reason_code = cpu_to_le16(reason_code);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(reason_code)), &(pattrib->pktlen));
+				break;
+			default:
+				break;
+		}
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+}
+
+static void issue_action_BSSCoexistPacket(_adapter *padapter)
+{	
+	_irqL	irqL;
+	_list		*plist, *phead;
+	unsigned char category, action;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char				*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short			*fctrl;
+	struct	wlan_network	*pnetwork = NULL;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	_queue		*queue	= &(pmlmepriv->scanned_queue);
+	u8 InfoContent[16] = {0};
+	u8 ICS[8][15];
+	
+	if((pmlmepriv->num_FortyMHzIntolerant==0) || (pmlmepriv->num_sta_no_ht==0))
+		return;
+
+	if(_TRUE == pmlmeinfo->bwmode_updated)
+		return;
+	
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+
+	category = RTW_WLAN_CATEGORY_PUBLIC;
+	action = ACT_PUBLIC_BSSCOEXIST;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+
+
+	//
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+	{
+		u8 iedata=0;
+		
+		iedata |= BIT(2);//20 MHz BSS Width Request
+
+		pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
+		
+	}
+	
+
+	//
+	_rtw_memset(ICS, 0, sizeof(ICS));
+	if(pmlmepriv->num_sta_no_ht>0)
+	{	
+		int i;
+	
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+		phead = get_list_head(queue);
+		plist = get_next(phead);
+       
+		while(1)
+		{
+			int len;
+			u8 *p;
+			WLAN_BSSID_EX *pbss_network;
+	
+			if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+				break;		
+
+			pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);      
+		
+			plist = get_next(plist);
+
+			pbss_network = (WLAN_BSSID_EX *)&pnetwork->network;
+
+			p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
+			if((p==NULL) || (len==0))//non-HT
+			{
+				if((pbss_network->Configuration.DSConfig<=0) || (pbss_network->Configuration.DSConfig>14))
+					continue;
+				
+				ICS[0][pbss_network->Configuration.DSConfig]=1;
+				
+				if(ICS[0][0] == 0)
+					ICS[0][0] = 1;		
+			}		
+	
+		}        
+
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+
+		for(i= 0;i<8;i++)
+		{
+			if(ICS[i][0] == 1)
+			{
+				int j, k = 0;
+				
+				InfoContent[k] = i;				
+				//SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent,i);
+				k++;
+				
+				for(j=1;j<=14;j++)
+				{
+					if(ICS[i][j]==1)
+					{
+						if(k<16)
+						{
+							InfoContent[k] = j; //channel number
+							//SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j);
+							k++;
+						}	
+					}	
+				}	
+
+				pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
+				
+			}
+			
+		}
+		
+
+	}
+		
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+unsigned int send_delba(_adapter *padapter, u8 initiator, u8 *addr)
+{
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *psta = NULL;
+	//struct recv_reorder_ctrl *preorder_ctrl;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u16 tid;
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)	
+		if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
+			return _SUCCESS;
+	
+	psta = rtw_get_stainfo(pstapriv, addr);
+	if(psta==NULL)
+		return _SUCCESS;
+
+	//DBG_871X("%s:%s\n", __FUNCTION__, (initiator==0)?"RX_DIR":"TX_DIR");
+	
+	if(initiator==0) // recipient
+	{
+		for(tid = 0;tid<MAXTID;tid++)
+		{
+			if(psta->recvreorder_ctrl[tid].enable == _TRUE)
+			{
+				DBG_871X("rx agg disable tid(%d)\n",tid);
+				issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid <<1) |initiator)&0x1F));
+				psta->recvreorder_ctrl[tid].enable = _FALSE;
+				psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
+				#ifdef DBG_RX_SEQ
+				DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+					psta->recvreorder_ctrl[tid].indicate_seq);
+				#endif
+			}		
+		}
+	}
+	else if(initiator == 1)// originator
+	{
+		//DBG_871X("tx agg_enable_bitmap(0x%08x)\n", psta->htpriv.agg_enable_bitmap);
+		for(tid = 0;tid<MAXTID;tid++)
+		{
+			if(psta->htpriv.agg_enable_bitmap & BIT(tid))
+			{
+				DBG_871X("tx agg disable tid(%d)\n",tid);
+				issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid <<1) |initiator)&0x1F) );
+				psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
+				psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
+				
+			}			
+		}
+	}
+	
+	return _SUCCESS;
+	
+}
+
+unsigned int send_beacon(_adapter *padapter)
+{
+	u8	bxmitok = _FALSE;
+	int	issue=0;
+	int poll = 0;
+//#ifdef CONFIG_CONCURRENT_MODE
+	//struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	//struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	//_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+	//struct mlme_priv *pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+//#endif		
+
+#ifdef CONFIG_PCI_HCI
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	issue_beacon(padapter);
+
+	return _SUCCESS;
+
+#endif
+
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+	u32 start = rtw_get_current_time();
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
+	do{
+		issue_beacon(padapter);
+		issue++;
+		do {
+			rtw_yield_os();
+			rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
+			poll++;
+		}while((poll%10)!=0 && _FALSE == bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
+
+	}while(_FALSE == bxmitok && issue<100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
+
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped)
+	{
+		return _FAIL;
+	}
+	if(_FALSE == bxmitok)
+	{
+		DBG_871X("%s fail! %u ms\n", __FUNCTION__, rtw_get_passing_time_ms(start));
+		return _FAIL;
+	}
+	else
+	{
+		u32 passing_time = rtw_get_passing_time_ms(start);
+
+		if(passing_time > 100 || issue > 3)
+			DBG_871X("%s success, issue:%d, poll:%d, %u ms\n", __FUNCTION__, issue, poll, rtw_get_passing_time_ms(start));
+		//else
+		//	DBG_871X("%s success, issue:%d, poll:%d, %u ms\n", __FUNCTION__, issue, poll, rtw_get_passing_time_ms(start));
+		
+		return _SUCCESS;
+	}
+
+#endif
+
+}
+
+/****************************************************************************
+
+Following are some utitity fuctions for WiFi MLME
+
+*****************************************************************************/
+
+BOOLEAN IsLegal5GChannel(
+	IN PADAPTER			Adapter,
+	IN u8			channel)
+{
+	
+	int i=0;
+	u8 Channel_5G[45] = {36,38,40,42,44,46,48,50,52,54,56,58,
+		60,62,64,100,102,104,106,108,110,112,114,116,118,120,122,
+		124,126,128,130,132,134,136,138,140,149,151,153,155,157,159,
+		161,163,165};
+	for(i=0;i<sizeof(Channel_5G);i++)
+		if(channel == Channel_5G[i])
+			return _TRUE;
+	return _FALSE;
+}
+
+void site_survey(_adapter *padapter)
+{
+	unsigned char		survey_channel = 0, val8;
+	RT_SCAN_TYPE	ScanType = SCAN_PASSIVE;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u32 initialgain = 0;
+	u8 restore_initial_gain = 1;
+
+#ifdef CONFIG_P2P
+
+#ifdef CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+	u8 stay_buddy_ch = 0;
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;			
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+#endif //CONFIG_CONCURRENT_MODE
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	static unsigned char  prev_survey_channel = 0;
+	static unsigned int p2p_scan_count = 0;	
+
+
+	if ( ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) || ( pwdinfo->p2p_info.scan_op_ch_only ) )
+	{
+		if ( pwdinfo->rx_invitereq_info.scan_op_ch_only )
+		{
+			survey_channel = pwdinfo->rx_invitereq_info.operation_ch[pmlmeext->sitesurvey_res.channel_idx];
+		}
+		else
+		{
+			survey_channel = pwdinfo->p2p_info.operation_ch[pmlmeext->sitesurvey_res.channel_idx];
+		}
+		ScanType = SCAN_ACTIVE;
+	}
+	else if(rtw_p2p_findphase_ex_is_social(pwdinfo))
+	{
+		//	Commented by Albert 2011/06/03
+		//	The driver is in the find phase, it should go through the social channel.
+		int ch_set_idx;
+		survey_channel = pwdinfo->social_chan[pmlmeext->sitesurvey_res.channel_idx];
+		ch_set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, survey_channel);
+		if (ch_set_idx >= 0)
+			ScanType = pmlmeext->channel_set[ch_set_idx].ScanType;
+		else
+			ScanType = SCAN_ACTIVE;
+	}
+	else
+#endif //CONFIG_P2P
+	{
+		struct rtw_ieee80211_channel *ch;
+		if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
+			ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
+			survey_channel = ch->hw_value;
+			ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
+		}
+	}
+
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT" ch:%u(cnt:%u,idx:%d) at %dms, %c%c%c\n"
+		, FUNC_ADPT_ARG(padapter)
+		, survey_channel
+		, pwdinfo->find_phase_state_exchange_cnt, pmlmeext->sitesurvey_res.channel_idx
+		, rtw_get_passing_time_ms(padapter->mlmepriv.scan_start_time)
+		, ScanType?'A':'P', pmlmeext->sitesurvey_res.scan_mode?'A':'P'
+		, pmlmeext->sitesurvey_res.ssid[0].SsidLength?'S':' ' 
+	);
+
+	if(survey_channel != 0)
+	{
+		//PAUSE 4-AC Queue when site_survey
+		//rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8));
+		//val8 |= 0x0f;
+		//rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8));
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if((padapter->pbuddy_adapter->mlmeextpriv.mlmext_info.state&0x03) == WIFI_FW_AP_STATE)
+		{
+			if( pmlmeinfo->scan_cnt == RTW_SCAN_NUM_OF_CH )
+			{
+				pmlmeinfo->scan_cnt = 0;
+				survey_channel = pbuddy_mlmeext->cur_channel;
+				stay_buddy_ch = 1;
+			}
+			else 
+			{
+				if( pmlmeinfo->scan_cnt == 0 )
+					stay_buddy_ch = 2;
+				pmlmeinfo->scan_cnt++;
+			}
+		}
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+#endif //CONFIG_CONCURRENT_MODE
+		if(pmlmeext->sitesurvey_res.channel_idx == 0)
+		{
+			set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+		else
+		{
+			SelectChannel(padapter, survey_channel);
+		}
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if( stay_buddy_ch == 1 )
+		{
+			val8 = 0; //survey done
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+			if(check_buddy_mlmeinfo_state(padapter, WIFI_FW_AP_STATE) &&
+				check_buddy_fwstate(padapter, _FW_LINKED))
+			{
+				update_beacon(padapter->pbuddy_adapter, 0, NULL, _TRUE);
+			}
+		}
+		else if( stay_buddy_ch == 2 )
+		{
+			val8 = 1; //under site survey
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+		}
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+
+		if(ScanType == SCAN_ACTIVE) //obey the channel plan setting...
+		{
+			#ifdef CONFIG_P2P
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN) || 
+				rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH)
+			)
+			{
+				issue_probereq_p2p(padapter, NULL);
+				issue_probereq_p2p(padapter, NULL);
+				issue_probereq_p2p(padapter, NULL);
+			}
+			else
+			#endif //CONFIG_P2P
+			{
+				int i;
+				for(i=0;i<RTW_SSID_SCAN_AMOUNT;i++){
+					if(pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
+						//todo: to issue two probe req???
+						issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
+						//rtw_msleep_os(SURVEY_TO>>1);
+						issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
+					} else {
+						break;
+					}
+				}
+
+				if(pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
+					//todo: to issue two probe req???
+					issue_probereq(padapter, NULL, NULL);
+					//rtw_msleep_os(SURVEY_TO>>1);
+					issue_probereq(padapter, NULL, NULL);
+				}
+			}
+		}
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if( stay_buddy_ch == 1 )
+			set_survey_timer(pmlmeext, pmlmeext->chan_scan_time * RTW_STAY_AP_CH_MILLISECOND );
+		else
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+			set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
+
+	}
+	else
+	{
+
+		//	channel number is 0 or this channel is not valid.
+
+#ifdef CONFIG_CONCURRENT_MODE
+		u8 cur_channel;
+		u8 cur_bwmode;
+		u8 cur_ch_offset;
+
+		if (rtw_get_ch_setting_union(padapter, &cur_channel, &cur_bwmode, &cur_ch_offset) != 0)
+		{
+			if (0)
+			DBG_871X(FUNC_ADPT_FMT" back to linked union - ch:%u, bw:%u, offset:%u\n",
+				FUNC_ADPT_ARG(padapter), cur_channel, cur_bwmode, cur_ch_offset);
+		}
+		#ifdef CONFIG_IOCTL_CFG80211
+		else if(padapter->pbuddy_adapter
+			&& pbuddy_adapter->wdinfo.driver_interface == DRIVER_CFG80211
+			&& wdev_to_priv(pbuddy_adapter->rtw_wdev)->p2p_enabled
+			&& rtw_p2p_chk_state(&pbuddy_adapter->wdinfo, P2P_STATE_LISTEN)
+			)
+		{
+			cur_channel = pbuddy_adapter->wdinfo.listen_channel;
+			cur_bwmode = pbuddy_mlmeext->cur_bwmode;
+			cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+		}
+		#endif
+		else
+		{
+			cur_channel = pmlmeext->cur_channel;
+			cur_bwmode = pmlmeext->cur_bwmode;
+			cur_ch_offset = pmlmeext->cur_ch_offset;
+		}		
+#endif
+
+	
+#ifdef CONFIG_P2P
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH))
+		{
+			if( ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) || ( pwdinfo->p2p_info.scan_op_ch_only ) )
+			{
+				//	Set the find_phase_state_exchange_cnt to P2P_FINDPHASE_EX_CNT.
+				//	This will let the following flow to run the scanning end.
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_MAX);
+			}
+			#ifdef CONFIG_DBG_P2P
+			DBG_871X( "[%s] find phase exchange cnt = %d\n", __FUNCTION__, pwdinfo->find_phase_state_exchange_cnt );
+			#endif
+		}
+
+		if(rtw_p2p_findphase_ex_is_needed(pwdinfo))
+		{
+			//	Set the P2P State to the listen state of find phase and set the current channel to the listen channel
+			set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_LISTEN);
+			pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
+
+			//turn on dynamic functions
+			Restore_DM_Func_Flag(padapter);
+			//Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+			
+			_set_timer( &pwdinfo->find_phase_timer, ( u32 ) ( ( u32 ) ( pwdinfo->listen_dwell ) * 100 ) );
+		}
+		else
+#endif //CONFIG_P2P
+		{
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+			pmlmeinfo->scan_cnt = 0;
+#endif //CONFIG_DMP_STA_NODE_SCAN_UNDER_AP_MODE
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			// 20100721:Interrupt scan operation here.
+			// For SW antenna diversity before link, it needs to switch to another antenna and scan again.
+			// It compares the scan result and select beter one to do connection.
+			if(rtw_hal_antdiv_before_linked(padapter))
+			{				
+				pmlmeext->sitesurvey_res.bss_cnt = 0;
+				pmlmeext->sitesurvey_res.channel_idx = -1;
+				pmlmeext->chan_scan_time = SURVEY_TO /2;			
+				set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
+				return;
+			}
+#endif
+
+#ifdef CONFIG_P2P
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH))
+			{
+			#ifdef CONFIG_CONCURRENT_MODE
+				if( pwdinfo->driver_interface == DRIVER_WEXT )
+				{
+					if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+					{
+						_set_timer( &pwdinfo->ap_p2p_switch_timer, 500 );
+					}
+				}
+				rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+			#else
+				rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+			#endif
+			}
+			rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+#endif //CONFIG_P2P
+			
+			pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
+
+			//switch back to the original channel
+			//SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset);
+
+			{
+#ifdef CONFIG_CONCURRENT_MODE
+				set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+#else
+#ifdef CONFIG_DUALMAC_CONCURRENT
+				dc_set_channel_bwmode_survey_done(padapter);
+#else
+				if( pwdinfo->driver_interface == DRIVER_WEXT )
+				{
+					if( rtw_p2p_chk_state(pwdinfo, P2P_STATE_LISTEN) )
+					{
+						set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+					}
+					else
+						set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+				}
+				else if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+				{
+					set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+				}
+#endif //CONFIG_DUALMAC_CONCURRENT
+#endif //CONFIG_CONCURRENT_MODE
+			}
+
+			//flush 4-AC Queue after site_survey
+			//val8 = 0;
+			//rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8));
+
+			val8 = 0; //survey done
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+			//config MSR
+			Set_MSR(padapter, (pmlmeinfo->state & 0x3));
+
+
+#ifdef CONFIG_IOCTL_CFG80211
+			if((wdev_to_priv(padapter->rtw_wdev))->p2p_enabled == _TRUE)
+			{
+				restore_initial_gain = 0;
+			}
+#endif //CONFIG_IOCTL_CFG80211
+
+			if(restore_initial_gain == 1)
+			{
+				initialgain = 0xff; //restore RX GAIN
+				rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));	
+			}
+
+			//turn on dynamic functions
+			Restore_DM_Func_Flag(padapter);
+			//Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+			if (is_client_associated_to_ap(padapter) == _TRUE)
+			{
+				issue_nulldata(padapter, NULL, 0, 3, 500);
+				
+#ifdef CONFIG_CONCURRENT_MODE
+				if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+				{
+					DBG_871X("adapter is surveydone(buddy_adapter is linked), issue nulldata(pwrbit=0)\n");
+					
+					issue_nulldata(padapter->pbuddy_adapter, NULL, 0, 3, 500);
+				}
+#endif	
+			}
+#ifdef CONFIG_CONCURRENT_MODE
+			else if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+			{
+				issue_nulldata(padapter->pbuddy_adapter, NULL, 0, 3, 500);
+			}
+#endif	
+
+			report_surveydone_event(padapter);
+
+			pmlmeext->chan_scan_time = SURVEY_TO;
+			pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
+
+			issue_action_BSSCoexistPacket(padapter);
+			issue_action_BSSCoexistPacket(padapter);
+			issue_action_BSSCoexistPacket(padapter);
+
+		}
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(check_buddy_mlmeinfo_state(padapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(padapter, _FW_LINKED))
+		{
+
+			DBG_871X("survey done, current CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+			DBG_871X("restart pbuddy_adapter's beacon\n");
+		
+			update_beacon(padapter->pbuddy_adapter, 0, NULL, _TRUE);
+		}
+#endif
+
+	}
+
+	return;
+
+}
+
+//collect bss info from Beacon and Probe response frames.
+u8 collect_bss_info(_adapter *padapter, union recv_frame *precv_frame, WLAN_BSSID_EX *bssid)
+{
+	int	i;
+	u32	len;
+	u8	*p;
+	u16	val16, subtype;
+	u8	*pframe = precv_frame->u.hdr.rx_data;
+	u32	packet_len = precv_frame->u.hdr.len;
+	struct registry_priv 	*pregistrypriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	len = packet_len - sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	if (len > MAX_IE_SZ)
+	{
+		//DBG_871X("IE too long for survey event\n");
+		return _FAIL;
+	}
+
+	_rtw_memset(bssid, 0, sizeof(WLAN_BSSID_EX));
+
+	subtype = GetFrameSubType(pframe);
+
+	if(subtype==WIFI_BEACON)
+		bssid->Reserved[0] = 1;
+	else
+		bssid->Reserved[0] = 0;
+		
+	bssid->Length = sizeof(WLAN_BSSID_EX) - MAX_IE_SZ + len;
+
+	//below is to copy the information element
+	bssid->IELength = len;
+	_rtw_memcpy(bssid->IEs, (pframe + sizeof(struct rtw_ieee80211_hdr_3addr)), bssid->IELength);
+
+	//get the signal strength
+	bssid->PhyInfo.SignalQuality = precv_frame->u.hdr.attrib.signal_qual;//in percentage 
+	bssid->PhyInfo.SignalStrength = precv_frame->u.hdr.attrib.signal_strength;//in percentage
+	bssid->Rssi = precv_frame->u.hdr.attrib.RecvSignalPower; // in dBM.raw data
+	
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	//rtw_hal_get_hwreg(padapter, HW_VAR_CURRENT_ANTENNA, (u8 *)(&bssid->PhyInfo.Optimum_antenna));
+	rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
+#endif
+
+	// checking SSID
+	if ((p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _SSID_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_)) == NULL)
+	{
+		DBG_871X("marc: cannot find SSID for survey event\n");
+		return _FAIL;
+	}
+
+	if (*(p + 1))
+	{
+		if (len > NDIS_802_11_LENGTH_SSID)
+		{
+			DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __FUNCTION__, __LINE__, len);
+			return _FAIL;
+		}
+		_rtw_memcpy(bssid->Ssid.Ssid, (p + 2), *(p + 1));
+		bssid->Ssid.SsidLength = *(p + 1);
+	}
+	else
+	{
+		bssid->Ssid.SsidLength = 0;
+	}
+
+	_rtw_memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
+
+	//checking rate info...
+	i = 0;
+	p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _SUPPORTEDRATES_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+	if (p != NULL)
+	{
+		if (len > NDIS_802_11_LENGTH_RATES_EX)
+		{
+			DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __FUNCTION__, __LINE__, len);
+			return _FAIL;
+		}
+		_rtw_memcpy(bssid->SupportedRates, (p + 2), len);
+		i = len;
+	}
+
+	p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+	if (p != NULL)
+	{
+		if (len > (NDIS_802_11_LENGTH_RATES_EX-i))
+		{
+			DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __FUNCTION__, __LINE__, len);
+			return _FAIL;
+		}
+		_rtw_memcpy(bssid->SupportedRates + i, (p + 2), len);
+	}
+
+	//todo:
+#if 0
+	if (judge_network_type(bssid->SupportedRates, (len + i)) == WIRELESS_11B)
+	{
+		bssid->NetworkTypeInUse = Ndis802_11DS;
+	}
+	else
+#endif
+	{
+		bssid->NetworkTypeInUse = Ndis802_11OFDM24;
+	}
+
+	if (bssid->IELength < 12)
+		return _FAIL;
+
+	// Checking for DSConfig
+	p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _DSSET_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+
+	bssid->Configuration.DSConfig = 0;
+	bssid->Configuration.Length = 0;
+
+	if (p)
+	{
+		bssid->Configuration.DSConfig = *(p + 2);
+	}
+	else
+	{// In 5G, some ap do not have DSSET IE
+		// checking HT info for channel
+		p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _HT_ADD_INFO_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+		if(p)
+		{
+			struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
+			bssid->Configuration.DSConfig = HT_info->primary_channel;
+		}
+		else
+		{ // use current channel
+			bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
+		}
+	}
+
+	_rtw_memcpy(&bssid->Configuration.BeaconPeriod, rtw_get_beacon_interval_from_ie(bssid->IEs), 2);
+	bssid->Configuration.BeaconPeriod = le32_to_cpu(bssid->Configuration.BeaconPeriod);
+
+	val16 = rtw_get_capability((WLAN_BSSID_EX *)bssid);
+
+	if (val16 & BIT(0))
+	{
+		bssid->InfrastructureMode = Ndis802_11Infrastructure;
+		_rtw_memcpy(bssid->MacAddress, GetAddr2Ptr(pframe), ETH_ALEN);
+	}
+	else
+	{
+		bssid->InfrastructureMode = Ndis802_11IBSS;
+		_rtw_memcpy(bssid->MacAddress, GetAddr3Ptr(pframe), ETH_ALEN);
+	}
+
+	if (val16 & BIT(4))
+		bssid->Privacy = 1;
+	else
+		bssid->Privacy = 0;
+
+	bssid->Configuration.ATIMWindow = 0;
+
+	//20/40 BSS Coexistence check
+	if((pregistrypriv->wifi_spec==1) && (_FALSE == pmlmeinfo->bwmode_updated))
+	{	
+		struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+		
+		p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+		if(p && len>0)
+		{
+			struct HT_caps_element	*pHT_caps;
+			pHT_caps = (struct HT_caps_element	*)(p + 2);
+			
+			if(pHT_caps->u.HT_cap_element.HT_caps_info&BIT(14))
+			{				
+				pmlmepriv->num_FortyMHzIntolerant++;
+			}
+		}
+		else
+		{
+			pmlmepriv->num_sta_no_ht++;
+		}
+		
+	}
+
+#ifdef CONFIG_INTEL_WIDI
+	//process_intel_widi_query_or_tigger(padapter, bssid);
+	if(process_intel_widi_query_or_tigger(padapter, bssid))
+	{
+		return _FAIL;
+	}
+#endif // CONFIG_INTEL_WIDI
+
+	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) & 1
+	if(strcmp(bssid->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
+		DBG_871X("Receiving %s("MAC_FMT", DSConfig:%u) from ch%u with ss:%3u, sq:%3u, RawRSSI:%3ld\n"
+			, bssid->Ssid.Ssid, MAC_ARG(bssid->MacAddress), bssid->Configuration.DSConfig
+			, rtw_get_oper_ch(padapter)
+			, bssid->PhyInfo.SignalStrength, bssid->PhyInfo.SignalQuality, bssid->Rssi
+		);
+	}
+	#endif
+
+	// mark bss info receving from nearby channel as SignalQuality 101
+	if(bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
+	{
+		bssid->PhyInfo.SignalQuality= 101;
+	}
+
+	return _SUCCESS;
+}
+
+void start_create_ibss(_adapter* padapter)
+{
+	unsigned short	caps;
+	u8	val8;
+	u8	join_type;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
+	pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
+
+	//update wireless mode
+	update_wireless_mode(padapter);
+
+	//udpate capability
+	caps = rtw_get_capability((WLAN_BSSID_EX *)pnetwork);
+	update_capinfo(padapter, caps);
+	if(caps&cap_IBSS)//adhoc master
+	{
+		//set_opmode_cmd(padapter, adhoc);//removed
+
+		val8 = 0xcf;
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+		//switch channel
+		//SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE);
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+
+		beacon_timing_control(padapter);
+
+		//set msr to WIFI_FW_ADHOC_STATE
+		pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
+		Set_MSR(padapter, (pmlmeinfo->state & 0x3));
+
+		//issue beacon
+		if(send_beacon(padapter)==_FAIL)
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("issuing beacon frame fail....\n"));
+
+			report_join_res(padapter, -1);
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		}
+		else
+		{
+			rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
+			join_type = 0;
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+
+			report_join_res(padapter, 1);
+			pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
+		}
+	}
+	else
+	{
+		DBG_871X("start_create_ibss, invalid cap:%x\n", caps);
+		return;
+	}
+
+}
+
+void start_clnt_join(_adapter* padapter)
+{
+	unsigned short	caps;
+	u8	val8;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+
+	//update wireless mode
+	update_wireless_mode(padapter);
+
+	//udpate capability
+	caps = rtw_get_capability((WLAN_BSSID_EX *)pnetwork);
+	update_capinfo(padapter, caps);
+	if (caps&cap_ESS)
+	{
+		Set_MSR(padapter, WIFI_FW_STATION_STATE);
+
+		val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X)? 0xcc: 0xcf;
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+		#ifdef CONFIG_DEAUTH_BEFORE_CONNECT
+		// Because of AP's not receiving deauth before
+		// AP may: 1)not response auth or 2)deauth us after link is complete
+		// issue deauth before issuing auth to deal with the situation
+
+		//	Commented by Albert 2012/07/21
+		//	For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it.
+		{
+			#ifdef CONFIG_P2P
+			_queue *queue = &(padapter->mlmepriv.scanned_queue);
+			_list	*head = get_list_head(queue);
+			_list *pos = get_next(head);
+			struct wlan_network *scanned = NULL;
+			u8 ie_offset = 0;
+			_irqL irqL;
+			bool has_p2p_ie = _FALSE;
+
+			_enter_critical_bh(&(padapter->mlmepriv.scanned_queue.lock), &irqL);
+
+			for (pos = get_next(head);!rtw_end_of_queue_search(head, pos); pos = get_next(pos)) {
+				
+				scanned = LIST_CONTAINOR(pos, struct wlan_network, list);
+				if(scanned==NULL)
+					rtw_warn_on(1);
+
+				if (_rtw_memcmp(&(scanned->network.Ssid), &(pnetwork->Ssid), sizeof(NDIS_802_11_SSID)) == _TRUE
+					&& _rtw_memcmp(scanned->network.MacAddress, pnetwork->MacAddress, sizeof(NDIS_802_11_MAC_ADDRESS)) == _TRUE
+				) {
+					ie_offset = (scanned->network.Reserved[0] == 2? 0:12);
+					if (rtw_get_p2p_ie(scanned->network.IEs+ie_offset, scanned->network.IELength-ie_offset, NULL, NULL))
+						has_p2p_ie = _TRUE;
+					break;
+				}
+			}
+	
+			_exit_critical_bh(&(padapter->mlmepriv.scanned_queue.lock), &irqL);
+
+			if (scanned == NULL || rtw_end_of_queue_search(head, pos) || has_p2p_ie == _FALSE)
+			#endif /* CONFIG_P2P */
+				issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
+		}
+		#endif /* CONFIG_DEAUTH_BEFORE_CONNECT */
+
+		//here wait for receiving the beacon to start auth
+		//and enable a timer
+		set_link_timer(pmlmeext, decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval));
+
+		pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
+	}
+	else if (caps&cap_IBSS) //adhoc client
+	{
+		Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
+
+		val8 = 0xcf;
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+		//switch channel
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+		beacon_timing_control(padapter);
+
+		pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
+
+		report_join_res(padapter, 1);
+	}
+	else
+	{
+		//DBG_871X("marc: invalid cap:%x\n", caps);
+		return;
+	}
+
+}
+
+void start_clnt_auth(_adapter* padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
+	pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
+
+	pmlmeinfo->auth_seq = 1;
+	pmlmeinfo->reauth_count = 0;
+	pmlmeinfo->reassoc_count = 0;
+	pmlmeinfo->link_count = 0;
+	pmlmeext->retry = 0;
+
+
+	issue_auth(padapter, NULL, 0);
+
+	set_link_timer(pmlmeext, REAUTH_TO);
+
+}
+
+
+void start_clnt_assoc(_adapter* padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
+	pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
+
+	issue_assocreq(padapter);
+
+	set_link_timer(pmlmeext, REASSOC_TO);
+}
+
+unsigned int receive_disconnect(_adapter *padapter, unsigned char *MacAddr, unsigned short reason)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//check A3
+	if (!(_rtw_memcmp(MacAddr, get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
+		return _SUCCESS;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+		{
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+			report_del_sta_event(padapter, MacAddr, reason);
+
+		}
+		else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE)
+		{
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+			report_join_res(padapter, -2);
+		}
+	}
+
+	return _SUCCESS;
+}
+
+#ifdef CONFIG_80211D
+static void process_80211d(PADAPTER padapter, WLAN_BSSID_EX *bssid)
+{
+	struct registry_priv *pregistrypriv;
+	struct mlme_ext_priv *pmlmeext;
+	RT_CHANNEL_INFO *chplan_new;
+	u8 channel;
+	u8 i;
+
+
+	pregistrypriv = &padapter->registrypriv;
+	pmlmeext = &padapter->mlmeextpriv;
+
+	// Adjust channel plan by AP Country IE
+	if (pregistrypriv->enable80211d &&
+		(!pmlmeext->update_channel_plan_by_ap_done))
+	{
+		u8 *ie, *p;
+		u32 len;
+		RT_CHANNEL_PLAN chplan_ap;
+		RT_CHANNEL_INFO chplan_sta[MAX_CHANNEL_NUM];
+		u8 country[4];
+		u8 fcn; // first channel number
+		u8 noc; // number of channel
+		u8 j, k;
+
+		ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+		if (!ie) return;
+		if (len < 6) return;
+
+		ie += 2;
+		p = ie;
+		ie += len;
+
+		_rtw_memset(country, 0, 4);
+		_rtw_memcpy(country, p, 3);
+		p += 3;
+		RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+				("%s: 802.11d country=%s\n", __FUNCTION__, country));
+
+		i = 0;
+		while ((ie - p) >= 3)
+		{
+			fcn = *(p++);
+			noc = *(p++);
+			p++;
+
+			for (j = 0; j < noc; j++)
+			{
+				if (fcn <= 14) channel = fcn + j; // 2.4 GHz
+				else channel = fcn + j*4; // 5 GHz
+
+				chplan_ap.Channel[i++] = channel;
+			}
+		}
+		chplan_ap.Len = i;
+
+#ifdef CONFIG_DEBUG_RTL871X
+#ifdef PLATFORM_LINUX
+		i = 0;
+		printk("%s: AP[%s] channel plan {", __func__, bssid->Ssid.Ssid);
+		while ((i < chplan_ap.Len) && (chplan_ap.Channel[i] != 0))
+		{
+			printk("%02d,", chplan_ap.Channel[i]);
+			i++;
+		}
+		printk("}\n");
+#endif
+#endif
+
+		_rtw_memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
+#ifdef CONFIG_DEBUG_RTL871X
+#ifdef PLATFORM_LINUX
+		i = 0;
+		printk("%s: STA channel plan {", __func__);
+		while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0))
+		{
+			printk("%02d(%c),", chplan_sta[i].ChannelNum, chplan_sta[i].ScanType==SCAN_PASSIVE?'p':'a');
+			i++;
+		}
+		printk("}\n");
+#endif
+#endif
+
+		_rtw_memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
+		chplan_new = pmlmeext->channel_set;
+
+		i = j = k = 0;
+		if (pregistrypriv->wireless_mode & WIRELESS_11G)
+		{
+			do {
+				if ((i == MAX_CHANNEL_NUM) ||
+					(chplan_sta[i].ChannelNum == 0) ||
+					(chplan_sta[i].ChannelNum > 14))
+					break;
+
+				if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
+					break;
+
+				if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					i++;
+					j++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//					chplan_new[k].ScanType = chplan_sta[i].ScanType;
+					chplan_new[k].ScanType = SCAN_PASSIVE;
+					i++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					j++;
+					k++;
+				}
+			} while (1);
+
+			// change AP not support channel to Passive scan
+			while ((i < MAX_CHANNEL_NUM) &&
+				(chplan_sta[i].ChannelNum != 0) &&
+				(chplan_sta[i].ChannelNum <= 14))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				chplan_new[k].ScanType = SCAN_PASSIVE;
+				i++;
+				k++;
+			}
+
+			// add channel AP supported
+			while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
+			{
+				chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+				chplan_new[k].ScanType = SCAN_ACTIVE;
+				j++;
+				k++;
+			}
+		}
+		else
+		{
+			// keep original STA 2.4G channel plan
+			while ((i < MAX_CHANNEL_NUM) &&
+				(chplan_sta[i].ChannelNum != 0) &&
+				(chplan_sta[i].ChannelNum <= 14))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				i++;
+				k++;
+			}
+
+			// skip AP 2.4G channel plan
+			while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
+			{
+				j++;
+			}
+		}
+
+		if (pregistrypriv->wireless_mode & WIRELESS_11A)
+		{
+			do {
+				if ((i == MAX_CHANNEL_NUM) ||
+					(chplan_sta[i].ChannelNum == 0))
+					break;
+
+				if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] == 0))
+					break;
+
+				if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					i++;
+					j++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//					chplan_new[k].ScanType = chplan_sta[i].ScanType;
+					chplan_new[k].ScanType = SCAN_PASSIVE;
+					i++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					j++;
+					k++;
+				}
+			} while (1);
+
+			// change AP not support channel to Passive scan
+			while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				chplan_new[k].ScanType = SCAN_PASSIVE;
+				i++;
+				k++;
+			}
+
+			// add channel AP supported
+			while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] != 0))
+			{
+				chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+				chplan_new[k].ScanType = SCAN_ACTIVE;
+				j++;
+				k++;
+			}
+		}
+		else
+		{
+			// keep original STA 5G channel plan
+			while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				i++;
+				k++;
+			}
+		}
+
+		pmlmeext->update_channel_plan_by_ap_done = 1;
+
+#ifdef CONFIG_DEBUG_RTL871X
+#ifdef PLATFORM_LINUX
+		k = 0;
+		printk("%s: new STA channel plan {", __func__);
+		while ((k < MAX_CHANNEL_NUM) && (chplan_new[k].ChannelNum != 0))
+		{
+			printk("%02d(%c),", chplan_new[k].ChannelNum, chplan_new[k].ScanType==SCAN_PASSIVE?'p':'c');
+			k++;
+		}
+		printk("}\n");
+#endif
+#endif
+
+#if 0
+		// recover the right channel index
+		channel = chplan_sta[pmlmeext->sitesurvey_res.channel_idx].ChannelNum;
+		k = 0;
+		while ((k < MAX_CHANNEL_NUM) && (chplan_new[k].ChannelNum != 0))
+		{
+			if (chplan_new[k].ChannelNum == channel) {
+				RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+						 ("%s: change mlme_ext sitesurvey channel index from %d to %d\n",
+						  __FUNCTION__, pmlmeext->sitesurvey_res.channel_idx, k));
+				pmlmeext->sitesurvey_res.channel_idx = k;
+				break;
+			}
+			k++;
+		}
+#endif
+	}
+
+	// If channel is used by AP, set channel scan type to active
+	channel = bssid->Configuration.DSConfig;
+	chplan_new = pmlmeext->channel_set;
+	i = 0;
+	while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0))
+	{
+		if (chplan_new[i].ChannelNum == channel)
+		{
+			if (chplan_new[i].ScanType == SCAN_PASSIVE)
+			{
+				//5G Bnad 2, 3 (DFS) doesn't change to active scan
+				if(channel >= 52 && channel <= 144)
+					break;
+				
+				chplan_new[i].ScanType = SCAN_ACTIVE;
+				RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+						 ("%s: change channel %d scan type from passive to active\n",
+						  __FUNCTION__, channel));
+			}
+			break;
+		}
+		i++;
+	}
+}
+#endif
+
+/****************************************************************************
+
+Following are the functions to report events
+
+*****************************************************************************/
+
+void report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct survey_event	*psurvey_evt;
+	struct C2HEvent_Header *pc2h_evt_hdr;
+	struct mlme_ext_priv *pmlmeext;
+	struct cmd_priv *pcmdpriv;
+	//u8 *pframe = precv_frame->u.hdr.rx_data;
+	//uint len = precv_frame->u.hdr.len;
+
+	if(!padapter)
+		return;
+
+	pmlmeext = &padapter->mlmeextpriv;
+	pcmdpriv = &padapter->cmdpriv;
+	
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct survey_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	psurvey_evt = (struct survey_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+
+	if (collect_bss_info(padapter, precv_frame, (WLAN_BSSID_EX *)&psurvey_evt->bss) == _FAIL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		rtw_mfree((u8 *)pevtcmd, cmdsz);
+		return;
+	}
+
+#ifdef CONFIG_80211D
+	process_80211d(padapter, &psurvey_evt->bss);
+#endif
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	pmlmeext->sitesurvey_res.bss_cnt++;
+
+	return;
+
+}
+
+void report_surveydone_event(_adapter *padapter)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct surveydone_event *psurveydone_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct surveydone_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	psurveydone_evt = (struct surveydone_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
+
+	DBG_871X("survey done event(%x) band:%d for "ADPT_FMT"\n", psurveydone_evt->bss_cnt, padapter->setband, ADPT_ARG(padapter));
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+
+}
+
+void report_join_res(_adapter *padapter, int res)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct joinbss_event		*pjoinbss_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct joinbss_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	pjoinbss_evt = (struct joinbss_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	_rtw_memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(WLAN_BSSID_EX));
+	pjoinbss_evt->network.join_res 	= pjoinbss_evt->network.aid = res;
+
+	DBG_871X("report_join_res(%d)\n", res);
+	
+	
+	rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
+	
+	
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+
+}
+
+void report_del_sta_event(_adapter *padapter, unsigned char* MacAddr, unsigned short reason)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct sta_info *psta;
+	int	mac_id;
+	struct stadel_event			*pdel_sta_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct stadel_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	pdel_sta_evt = (struct stadel_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	_rtw_memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
+	_rtw_memcpy((unsigned char *)(pdel_sta_evt->rsvd),(unsigned char *)(&reason),2);
+
+
+	psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
+	if(psta)
+		mac_id = (int)psta->mac_id;	
+	else
+		mac_id = (-1);
+
+	pdel_sta_evt->mac_id = mac_id;
+
+	DBG_871X("report_del_sta_event: delete STA, mac_id=%d\n", mac_id);
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+}
+
+void report_add_sta_event(_adapter *padapter, unsigned char* MacAddr, int cam_idx)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct stassoc_event		*padd_sta_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct stassoc_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	padd_sta_evt = (struct stassoc_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	_rtw_memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
+	padd_sta_evt->cam_id = cam_idx;
+
+	DBG_871X("report_add_sta_event: add STA\n");
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+}
+
+
+/****************************************************************************
+
+Following are the event callback functions
+
+*****************************************************************************/
+
+//for sta/adhoc mode
+void update_sta_info(_adapter *padapter, struct sta_info *psta)
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//ERP
+	VCS_update(padapter, psta);
+
+
+	//HT
+	if(pmlmepriv->htpriv.ht_option)
+	{
+		psta->htpriv.ht_option = _TRUE;
+
+		psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
+
+		if (support_short_GI(padapter, &(pmlmeinfo->HT_caps)))
+			psta->htpriv.sgi = _TRUE;
+
+		psta->qos_option = _TRUE;
+		
+	}
+	else
+	{
+		psta->htpriv.ht_option = _FALSE;
+
+		psta->htpriv.ampdu_enable = _FALSE;
+		
+		psta->htpriv.sgi = _FALSE;
+
+		psta->qos_option = _FALSE;
+
+	}
+	
+	psta->htpriv.bwmode = pmlmeext->cur_bwmode;
+	psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
+	
+	psta->htpriv.agg_enable_bitmap = 0x0;//reset
+	psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+	
+
+	//QoS
+	if(pmlmepriv->qospriv.qos_option)
+		psta->qos_option = _TRUE;
+	
+
+	psta->state = _FW_LINKED;
+
+}
+
+void mlmeext_joinbss_event_callback(_adapter *padapter, int join_res)
+{
+	struct sta_info		*psta, *psta_bmc;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	u8	join_type;
+
+	if(join_res < 0)
+	{
+		join_type = 1;
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+		rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
+
+		//restore to initial setting.
+		update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+#if 0 //temply remove
+#ifdef CONFIG_INTEL_WIDI
+#ifdef DBG_CONFIG_ERROR_DETECT
+		DBG_871X("%s(): do silentreset\n",__FUNCTION__);
+		rtw_hal_sreset_reset(padapter);
+#endif
+#endif
+#endif
+		goto exit_mlmeext_joinbss_event_callback;
+	}
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		//for bc/mc
+		psta_bmc = rtw_get_bcmc_stainfo(padapter);
+		if(psta_bmc)
+		{
+			pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
+			update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
+			Update_RA_Entry(padapter, psta_bmc->mac_id);
+		}
+	}
+
+
+	//turn on dynamic functions
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+	// update IOT-releated issue
+	update_IOT_info(padapter);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
+
+	//BCN interval
+	rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
+
+	//udpate capability
+	update_capinfo(padapter, pmlmeinfo->capability);
+
+	//WMM, Update EDCA param
+	WMMOnAssocRsp(padapter);
+
+	//HT
+	HTOnAssocRsp(padapter);
+
+#ifndef CONFIG_CONCURRENT_MODE
+	//	Call set_channel_bwmode when the CONFIG_CONCURRENT_MODE doesn't be defined.
+	//Set cur_channel&cur_bwmode&cur_ch_offset
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#endif
+
+	psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
+	if (psta) //only for infra. mode
+	{
+		pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
+
+		//DBG_871X("set_sta_rate\n");
+	
+		//set per sta rate after updating HT cap.
+		set_sta_rate(padapter, psta);
+	}
+
+	join_type = 2;
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		// correcting TSF
+		correct_TSF(padapter, pmlmeext);
+	
+		//set_link_timer(pmlmeext, DISCONNECT_TO);
+	}
+
+#ifdef CONFIG_LPS
+	rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
+#endif
+
+exit_mlmeext_joinbss_event_callback:
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_handle_join_done(padapter, join_res);
+#endif
+#ifdef CONFIG_CONCURRENT_MODE
+	concurrent_chk_joinbss_done(padapter, join_res);
+#endif
+
+	DBG_871X("=>%s\n", __FUNCTION__);
+
+}
+
+void mlmeext_sta_add_event_callback(_adapter *padapter, struct sta_info *psta)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8	join_type;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		if(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)//adhoc master or sta_count>1
+		{
+			//nothing to do
+		}
+		else//adhoc client
+		{
+			//update TSF Value
+			//update_TSF(pmlmeext, pframe, len);			
+
+			// correcting TSF
+			correct_TSF(padapter, pmlmeext);
+
+			//start beacon
+			if(send_beacon(padapter)==_FAIL)
+			{
+				pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
+
+				pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
+
+				return;
+			}
+
+			pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
+				
+		}
+
+		join_type = 2;
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+	}
+
+	pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
+
+	//rate radaptive
+	Update_RA_Entry(padapter, psta->mac_id);
+
+	//update adhoc sta_info
+	update_sta_info(padapter, psta);
+
+}
+
+void mlmeext_sta_del_event_callback(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter))
+	{
+		//set_opmode_cmd(padapter, infra_client_with_mlme);
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, 0);
+		rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
+
+		//restore to initial setting.
+		update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		dc_set_channel_bwmode_disconnect(padapter);
+#else
+#ifdef CONFIG_CONCURRENT_MODE
+		if((check_buddy_fwstate(padapter, _FW_LINKED)) != _TRUE)
+		{
+#endif //CONFIG_CONCURRENT_MODE
+
+		//switch to the 20M Hz mode after disconnect
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+		//SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset);
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	
+#ifdef CONFIG_CONCURRENT_MODE
+		}
+#endif //CONFIG_CONCURRENT_MODE
+#endif //CONFIG_DUALMAC_CONCURRENT
+
+		flush_all_cam_entry(padapter);
+
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+
+		//set MSR to no link state -> infra. mode
+		Set_MSR(padapter, _HW_STATE_STATION_);
+
+		_cancel_timer_ex(&pmlmeext->link_timer);
+
+	}
+
+}
+
+/****************************************************************************
+
+Following are the functions for the timer handlers
+
+*****************************************************************************/
+void _linked_rx_signal_strehgth_display(_adapter *padapter);
+void _linked_rx_signal_strehgth_display(_adapter *padapter)
+{
+	int	UndecoratedSmoothedPWDB;
+	
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	DBG_871X("============ pbuddy_adapter linked status check ===================\n");
+	DBG_871X("buddy_adapter_type=%d\n", pbuddy_adapter->adapter_type);
+	DBG_871X("pbuddy_adapter pathA Rx SNRdb:%d\n",pbuddy_adapter->recvpriv.RxSNRdB[0]);
+	DBG_871X("pbuddy_adapter pathA Rx PWDB:%d\n",pbuddy_adapter->recvpriv.rxpwdb);
+	DBG_871X("pbuddy_adapter pathA Rx RSSI:%d,pathB Rx RSSI:%d\n"
+	,pbuddy_adapter->recvpriv.RxRssi[0],pbuddy_adapter->recvpriv.RxRssi[1]);
+	rtw_hal_get_def_var(pbuddy_adapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
+	DBG_871X("pbuddy_adapter UndecoratedSmoothedPWDB:%d\n",UndecoratedSmoothedPWDB);
+	DBG_871X("Rx RSSI:%d\n",pbuddy_adapter->recvpriv.rssi);
+	DBG_871X("Rx Signal_strength:%d\n",pbuddy_adapter->recvpriv.signal_strength);
+	DBG_871X("Rx Signal_qual:%d \n",pbuddy_adapter->recvpriv.signal_qual);
+	DBG_871X("============ linked status check ===================\n");
+	DBG_871X("adapter_type=%d\n", padapter->adapter_type);
+#else //CONFIG_CONCURRENT_MODE
+	DBG_871X("============ linked status check ===================\n");
+#endif //CONFIG_CONCURRENT_MODE
+	DBG_871X("pathA Rx SNRdb:%d, pathB Rx SNRdb:%d\n",padapter->recvpriv.RxSNRdB[0], padapter->recvpriv.RxSNRdB[1]);
+	DBG_871X("pathA Rx PWDB:%d\n",padapter->recvpriv.rxpwdb);
+	DBG_871X("pathA Rx RSSI:%d,pathB Rx RSSI:%d\n",padapter->recvpriv.RxRssi[0],padapter->recvpriv.RxRssi[1]);
+	rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
+	DBG_871X("UndecoratedSmoothedPWDB:%d\n",UndecoratedSmoothedPWDB);
+	DBG_871X("Rx RSSI:%d\n",padapter->recvpriv.rssi);
+	DBG_871X("Rx Signal_strength:%d\n",padapter->recvpriv.signal_strength);
+	DBG_871X("Rx Signal_qual:%d \n",padapter->recvpriv.signal_qual);
+	if ( check_fwstate( &padapter->mlmepriv,  _FW_LINKED ))
+	{
+		DBG_871X("bw mode: %d, channel: %d\n", padapter->mlmeextpriv.cur_bwmode, padapter->mlmeextpriv.cur_channel );
+		DBG_871X("received bytes = %d\n", (u32) (padapter->recvpriv.rx_bytes - padapter->recvpriv.last_rx_bytes ) );
+	}
+	DBG_871X("============ linked status check ===================\n");
+	DBG_871X(" DIG PATH-A(0x%02x), PATH-B(0x%02x)\n",rtw_read8(padapter,0xc50),rtw_read8(padapter,0xc58));
+	DBG_871X(" OFDM -Alarm DA2(0x%04x),DA4(0x%04x),DA6(0x%04x),DA8(0x%04x)\n",
+		rtw_read16(padapter,0xDA2),rtw_read16(padapter,0xDA4),rtw_read16(padapter,0xDA6),rtw_read16(padapter,0xDA8));
+
+	DBG_871X(" CCK -Alarm A5B(0x%02x),A5C(0x%02x)\n",rtw_read8(padapter,0xA5B),rtw_read8(padapter,0xA5C));
+	DBG_871X(" FalseAlmCnt_all(%d)\n",padapter->recvpriv.FalseAlmCnt_all);
+	
+}
+
+u8 chk_ap_is_alive(_adapter *padapter, struct sta_info *psta)
+{
+	u8 ret = _FALSE;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	#ifdef DBG_EXPIRATION_CHK
+	DBG_871X(FUNC_ADPT_FMT" rx:"STA_PKTS_FMT", beacon:%llu, probersp_to_self:%llu"
+				/*", probersp_bm:%llu, probersp_uo:%llu, probereq:%llu, BI:%u"*/
+				", retry:%u\n"
+		, FUNC_ADPT_ARG(padapter)
+		, STA_RX_PKTS_DIFF_ARG(psta)
+		, psta->sta_stats.rx_beacon_pkts - psta->sta_stats.last_rx_beacon_pkts
+		, psta->sta_stats.rx_probersp_pkts - psta->sta_stats.last_rx_probersp_pkts
+		/*, psta->sta_stats.rx_probersp_bm_pkts - psta->sta_stats.last_rx_probersp_bm_pkts
+		, psta->sta_stats.rx_probersp_uo_pkts - psta->sta_stats.last_rx_probersp_uo_pkts
+		, psta->sta_stats.rx_probereq_pkts - psta->sta_stats.last_rx_probereq_pkts
+		, pmlmeinfo->bcn_interval*/
+		, pmlmeext->retry
+	);
+
+	DBG_871X(FUNC_ADPT_FMT" tx_pkts:%llu, link_count:%u\n", FUNC_ADPT_ARG(padapter)
+		, padapter->xmitpriv.tx_pkts
+		, pmlmeinfo->link_count
+	);
+	#endif
+
+	if((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta))
+		&& sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta)
+		&& sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta)
+	)
+	{
+		ret = _FALSE;
+	}
+	else
+	{
+		ret = _TRUE;
+	}
+
+	sta_update_last_rx_pkts(psta);
+
+	return ret;
+}
+
+void linked_status_chk(_adapter *padapter)
+{
+	u32	i;
+	struct sta_info		*psta;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+
+	if(padapter->bRxRSSIDisplay)
+		 _linked_rx_signal_strehgth_display(padapter);
+
+	#ifdef DBG_CONFIG_ERROR_DETECT	
+	rtw_hal_sreset_linked_status_check(padapter);
+	#endif
+
+	if (is_client_associated_to_ap(padapter))
+	{
+		//linked infrastructure client mode
+
+		int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
+		int rx_chk_limit;
+
+		#if defined(DBG_ROAMING_TEST)
+		rx_chk_limit = 1;
+		#elif defined(CONFIG_ACTIVE_KEEP_ALIVE_CHECK)
+		rx_chk_limit = 4;
+		#else
+		rx_chk_limit = 8;
+		#endif
+
+		// Marked by Kurt 20130715
+		// For WiDi 3.5 and later on, they don't ask WiDi sink to do roaming, so we could not check rx limit that strictly.
+		// todo: To check why rx_chk would be _FALSE under miracast session.
+		//#ifdef CONFIG_INTEL_WIDI
+		//if (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_NONE)
+		//	rx_chk_limit = 1;
+		//#endif
+		
+		if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL)
+		{
+			bool is_p2p_enable = _FALSE;
+			#ifdef CONFIG_P2P
+			is_p2p_enable = !rtw_p2p_chk_state(&padapter->wdinfo, P2P_STATE_NONE);
+			#endif
+			
+			if (chk_ap_is_alive(padapter, psta) == _FALSE)
+				rx_chk = _FAIL;
+
+			if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
+				tx_chk = _FAIL;
+
+			#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+			if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
+				u8 backup_oper_channel=0;
+
+				/* switch to correct channel of current network  before issue keep-alive frames */
+				if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
+					backup_oper_channel = rtw_get_oper_ch(padapter);
+					SelectChannel(padapter, pmlmeext->cur_channel);
+				}
+
+				if (rx_chk != _SUCCESS)
+					issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
+
+				if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
+					tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
+					/* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
+					if (tx_chk == _SUCCESS && !is_p2p_enable)
+						rx_chk = _SUCCESS;
+				}
+
+				/* back to the original operation channel */
+				if(backup_oper_channel>0)
+					SelectChannel(padapter, backup_oper_channel);
+
+			}
+			else
+			#endif /* CONFIG_ACTIVE_KEEP_ALIVE_CHECK */
+			{
+				if (rx_chk != _SUCCESS) {
+					if (pmlmeext->retry == 0) {
+						#ifdef DBG_EXPIRATION_CHK
+						DBG_871X("issue_probereq to trigger probersp, retry=%d\n", pmlmeext->retry);
+						#endif
+						issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
+						issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
+						issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
+					}
+				}
+
+				if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) {
+					#ifdef DBG_EXPIRATION_CHK
+					DBG_871X("%s issue_nulldata 0\n", __FUNCTION__);
+					#endif
+					tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
+				}
+			}
+
+			if (rx_chk == _FAIL) {
+				pmlmeext->retry++;
+				if (pmlmeext->retry > rx_chk_limit) {
+					DBG_871X(FUNC_ADPT_FMT" disconnect or roaming\n",
+						FUNC_ADPT_ARG(padapter));
+					receive_disconnect(padapter, pmlmeinfo->network.MacAddress
+						, WLAN_REASON_EXPIRATION_CHK);
+					return;
+				}
+			} else {
+				pmlmeext->retry = 0;
+			}
+
+			if (tx_chk == _FAIL) {
+				pmlmeinfo->link_count &= 0xf;
+			} else {
+				pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
+				pmlmeinfo->link_count = 0;
+			}
+
+		} //end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL)
+	}
+	else if (is_client_associated_to_ibss(padapter))
+	{
+		//linked IBSS mode
+		//for each assoc list entry to check the rx pkt counter
+		for (i = IBSS_START_MAC_ID; i < NUM_STA; i++)
+		{
+			if (pmlmeinfo->FW_sta_info[i].status == 1)
+			{
+				psta = pmlmeinfo->FW_sta_info[i].psta;
+
+				if(NULL==psta) continue;
+
+				if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta))
+				{
+
+					if(pmlmeinfo->FW_sta_info[i].retry<3)
+					{
+						pmlmeinfo->FW_sta_info[i].retry++;
+					}
+					else
+					{
+						pmlmeinfo->FW_sta_info[i].retry = 0;
+						pmlmeinfo->FW_sta_info[i].status = 0;
+						report_del_sta_event(padapter, psta->hwaddr
+							, 65535// indicate disconnect caused by no rx
+						);
+					}	
+				}
+				else
+				{
+					pmlmeinfo->FW_sta_info[i].retry = 0;
+					pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
+				}
+			}
+		}
+
+		//set_link_timer(pmlmeext, DISCONNECT_TO);
+
+	}
+
+}
+
+void survey_timer_hdl(_adapter *padapter)
+{
+	struct cmd_obj	*ph2c;
+	struct sitesurvey_parm	*psurveyPara;
+	struct cmd_priv					*pcmdpriv=&padapter->cmdpriv;
+	struct mlme_ext_priv 		*pmlmeext = &padapter->mlmeextpriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+
+	//DBG_871X("marc: survey timer\n");
+#ifdef PLATFORM_FREEBSD
+	rtw_mtx_lock(NULL);
+	 if (callout_pending(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was reset */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 if (!callout_active(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was stopped */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 callout_deactivate(&padapter->mlmeextpriv.survey_timer.callout);
+
+
+#endif
+
+	//issue rtw_sitesurvey_cmd
+	if (pmlmeext->sitesurvey_res.state > SCAN_START)
+	{
+		if(pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
+		{
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+			if( padapter->mlmeextpriv.mlmext_info.scan_cnt != RTW_SCAN_NUM_OF_CH )
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+				pmlmeext->sitesurvey_res.channel_idx++;
+		}
+
+		if(pmlmeext->scan_abort == _TRUE)
+		{
+			#ifdef CONFIG_P2P
+			if(!rtw_p2p_chk_state(&padapter->wdinfo, P2P_STATE_NONE))
+			{
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_MAX);
+				pmlmeext->sitesurvey_res.channel_idx = 3;
+				DBG_871X("%s idx:%d, cnt:%u\n", __FUNCTION__
+					, pmlmeext->sitesurvey_res.channel_idx
+					, pwdinfo->find_phase_state_exchange_cnt
+				);
+			}
+			else
+			#endif
+			{
+				pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
+				DBG_871X("%s idx:%d\n", __FUNCTION__
+					, pmlmeext->sitesurvey_res.channel_idx
+				);
+			}
+
+			pmlmeext->scan_abort = _FALSE;//reset
+		}
+
+		if ((ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+		{
+			goto exit_survey_timer_hdl;
+		}
+
+		if ((psurveyPara = (struct sitesurvey_parm*)rtw_zmalloc(sizeof(struct sitesurvey_parm))) == NULL)
+		{
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			goto exit_survey_timer_hdl;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
+		rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+
+
+exit_survey_timer_hdl:
+#ifdef PLATFORM_FREEBSD
+		rtw_mtx_unlock(NULL);
+#endif
+
+	return;
+}
+
+void link_timer_hdl(_adapter *padapter)
+{
+	//static unsigned int		rx_pkt = 0;
+	//static u64				tx_cnt = 0;
+	//struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	//struct sta_priv		*pstapriv = &padapter->stapriv;
+
+#ifdef PLATFORM_FREEBSD
+	rtw_mtx_lock(NULL);
+	 if (callout_pending(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was reset */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 if (!callout_active(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was stopped */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 callout_deactivate(&padapter->mlmeextpriv.survey_timer.callout);
+
+	
+#endif
+
+	if (pmlmeinfo->state & WIFI_FW_AUTH_NULL)
+	{
+		DBG_871X("link_timer_hdl:no beacon while connecting\n");
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		report_join_res(padapter, -3);
+	}
+	else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE)
+	{
+		//re-auth timer
+		if (++pmlmeinfo->reauth_count > REAUTH_LIMIT)
+		{
+			//if (pmlmeinfo->auth_algo != dot11AuthAlgrthm_Auto)
+			//{
+				pmlmeinfo->state = 0;
+				report_join_res(padapter, -1);
+				return;
+			//}
+			//else
+			//{
+			//	pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
+			//	pmlmeinfo->reauth_count = 0;
+			//}
+		}
+		
+		DBG_871X("link_timer_hdl: auth timeout and try again\n");
+		pmlmeinfo->auth_seq = 1;
+		issue_auth(padapter, NULL, 0);
+		set_link_timer(pmlmeext, REAUTH_TO);
+	}
+	else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE)
+	{
+		//re-assoc timer
+		if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT)
+		{
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+			report_join_res(padapter, -2);
+			return;
+		}
+
+		DBG_871X("link_timer_hdl: assoc timeout and try again\n");
+		issue_assocreq(padapter);
+		set_link_timer(pmlmeext, REASSOC_TO);
+	}
+#if 0
+	else if (is_client_associated_to_ap(padapter))
+	{
+		//linked infrastructure client mode
+		if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL)
+		{
+			/*to monitor whether the AP is alive or not*/
+			if (rx_pkt == psta->sta_stats.rx_pkts)
+			{
+				receive_disconnect(padapter, pmlmeinfo->network.MacAddress);
+				return;
+			}
+			else
+			{
+				rx_pkt = psta->sta_stats.rx_pkts;
+				set_link_timer(pmlmeext, DISCONNECT_TO);
+			}
+
+			//update the EDCA paramter according to the Tx/RX mode
+			update_EDCA_param(padapter);
+
+			/*to send the AP a nulldata if no frame is xmitted in order to keep alive*/
+			if (pmlmeinfo->link_count++ == 0)
+			{
+				tx_cnt = pxmitpriv->tx_pkts;
+			}
+			else if ((pmlmeinfo->link_count & 0xf) == 0)
+			{
+				if (tx_cnt == pxmitpriv->tx_pkts)
+				{
+					issue_nulldata(padapter, NULL, 0, 0, 0);
+				}
+
+				tx_cnt = pxmitpriv->tx_pkts;
+			}
+		} //end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL)
+	}
+	else if (is_client_associated_to_ibss(padapter))
+	{
+		//linked IBSS mode
+		//for each assoc list entry to check the rx pkt counter
+		for (i = IBSS_START_MAC_ID; i < NUM_STA; i++)
+		{
+			if (pmlmeinfo->FW_sta_info[i].status == 1)
+			{
+				psta = pmlmeinfo->FW_sta_info[i].psta;
+
+				if (pmlmeinfo->FW_sta_info[i].rx_pkt == psta->sta_stats.rx_pkts)
+				{
+					pmlmeinfo->FW_sta_info[i].status = 0;
+					report_del_sta_event(padapter, psta->hwaddr);
+				}
+				else
+				{
+					pmlmeinfo->FW_sta_info[i].rx_pkt = psta->sta_stats.rx_pkts;
+				}
+			}
+		}
+
+		set_link_timer(pmlmeext, DISCONNECT_TO);
+	}
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	rtw_mtx_unlock(NULL);
+#endif
+
+	return;
+}
+
+void addba_timer_hdl(struct sta_info *psta)
+{
+	struct ht_priv	*phtpriv;
+
+	if(!psta)
+		return;
+	
+	phtpriv = &psta->htpriv;
+
+	if((phtpriv->ht_option==_TRUE) && (phtpriv->ampdu_enable==_TRUE)) 
+	{
+		if(phtpriv->candidate_tid_bitmap)
+			phtpriv->candidate_tid_bitmap=0x0;
+		
+	}
+}
+
+#ifdef CONFIG_IEEE80211W
+void sa_query_timer_hdl(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv * pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	//disconnect
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		rtw_disassoc_cmd(padapter, 0, _TRUE);
+		rtw_indicate_disconnect(padapter);
+		rtw_free_assoc_resources(padapter, 1);	
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	DBG_871X("SA query timeout disconnect\n");
+}
+#endif //CONFIG_IEEE80211W
+
+u8 NULL_hdl(_adapter *padapter, u8 *pbuf)
+{
+	return H2C_SUCCESS;
+}
+
+#ifdef CONFIG_AUTO_AP_MODE
+void rtw_start_auto_ap(_adapter *adapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+	rtw_set_802_11_infrastructure_mode(adapter, Ndis802_11APMode);
+
+	rtw_setopmode_cmd(adapter, Ndis802_11APMode);
+}
+
+static int rtw_auto_ap_start_beacon(_adapter *adapter)
+{
+	int ret=0;
+	u8 *pbuf = NULL;
+	uint len;
+	u8	supportRate[16];
+	int 	sz = 0, rateLen;
+	u8 *	ie;
+	u8	wireless_mode, oper_channel;
+	u8 ssid[3] = {0}; //hidden ssid
+	u32 ssid_len = sizeof(ssid);
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+
+	len = 128;
+	pbuf = rtw_zmalloc(len);
+	if(!pbuf)
+		return -ENOMEM;
+
+
+	//generate beacon
+	ie = pbuf;
+
+	//timestamp will be inserted by hardware
+	sz += 8;
+	ie += sz;
+
+	//beacon interval : 2bytes
+	*(u16*)ie = cpu_to_le16((u16)100);//BCN_INTERVAL=100;
+	sz += 2;
+	ie += 2;
+
+	//capability info
+	*(u16*)ie = 0;
+	*(u16*)ie |= cpu_to_le16(cap_ESS);
+	*(u16*)ie |= cpu_to_le16(cap_ShortPremble);
+	//*(u16*)ie |= cpu_to_le16(cap_Privacy);
+	sz += 2;
+	ie += 2;
+
+	//SSID
+	ie = rtw_set_ie(ie, _SSID_IE_, ssid_len, ssid, &sz);
+
+	//supported rates
+	wireless_mode = WIRELESS_11BG_24N;
+	rtw_set_supported_rate(supportRate, wireless_mode) ;
+	rateLen = rtw_get_rateset_len(supportRate);
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, 8, supportRate, &sz);
+	}
+	else
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, rateLen, supportRate, &sz);
+	}
+
+
+	//DS parameter set
+	if(check_buddy_fwstate(adapter, _FW_LINKED) &&
+		check_buddy_fwstate(adapter, WIFI_STATION_STATE))
+	{
+		PADAPTER pbuddy_adapter = adapter->pbuddy_adapter;
+		struct mlme_ext_priv *pbuddy_mlmeext  = &pbuddy_adapter->mlmeextpriv;
+
+		oper_channel = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		oper_channel = adapter_to_dvobj(adapter)->oper_channel;
+	}
+	ie = rtw_set_ie(ie, _DSSET_IE_, 1, &oper_channel, &sz);
+
+	//ext supported rates
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (supportRate + 8), &sz);
+	}
+
+	DBG_871X("%s, start auto ap beacon sz=%d\n", __FUNCTION__, sz);
+
+	//lunch ap mode & start to issue beacon
+	if(rtw_check_beacon_data(adapter, pbuf,  sz) == _SUCCESS)
+	{
+
+	}
+	else
+	{
+		ret = -EINVAL;
+	}
+
+
+	rtw_mfree(pbuf, len);
+
+	return ret;
+
+}
+#endif//CONFIG_AUTO_AP_MODE
+
+u8 setopmode_hdl(_adapter *padapter, u8 *pbuf)
+{
+	u8	type;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
+
+	if(psetop->mode == Ndis802_11APMode)
+	{
+		pmlmeinfo->state = WIFI_FW_AP_STATE;
+		type = _HW_STATE_AP_;
+#ifdef CONFIG_NATIVEAP_MLME
+		//start_ap_mode(padapter);
+#endif
+	}
+	else if(psetop->mode == Ndis802_11Infrastructure)
+	{
+		pmlmeinfo->state &= ~(BIT(0)|BIT(1));// clear state
+		pmlmeinfo->state |= WIFI_FW_STATION_STATE;//set to 	STATION_STATE
+		type = _HW_STATE_STATION_;
+	}
+	else if(psetop->mode == Ndis802_11IBSS)
+	{
+		type = _HW_STATE_ADHOC_;
+	}
+	else
+	{
+		type = _HW_STATE_NOLINK_;
+	}
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
+	//Set_NETYPE0_MSR(padapter, type);
+
+#ifdef CONFIG_AUTO_AP_MODE
+	if(psetop->mode == Ndis802_11APMode)
+		rtw_auto_ap_start_beacon(padapter);
+#endif
+
+	return H2C_SUCCESS;
+	
+}
+
+u8 createbss_hdl(_adapter *padapter, u8 *pbuf)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX	*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	struct joinbss_parm *pparm = (struct joinbss_parm *)pbuf;
+	u32	initialgain;
+
+	
+	if(pparm->network.InfrastructureMode == Ndis802_11APMode)
+	{
+#ifdef CONFIG_AP_MODE
+	
+		if(pmlmeinfo->state == WIFI_FW_AP_STATE)
+		{		
+			//todo:
+			return H2C_SUCCESS;		
+		}		
+#endif
+	}
+
+	//below is for ad-hoc master
+	if(pparm->network.InfrastructureMode == Ndis802_11IBSS)
+	{
+		rtw_joinbss_reset(padapter);
+	
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset= HAL_PRIME_CHNL_OFFSET_DONT_CARE;	
+		pmlmeinfo->ERP_enable = 0;
+		pmlmeinfo->WMM_enable = 0;
+		pmlmeinfo->HT_enable = 0;
+		pmlmeinfo->HT_caps_enable = 0;
+		pmlmeinfo->HT_info_enable = 0;
+		pmlmeinfo->agg_enable_bitmap = 0;
+		pmlmeinfo->candidate_tid_bitmap = 0;
+
+		//disable dynamic functions, such as high power, DIG
+		Save_DM_Func_Flag(padapter);
+		Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+		//config the initial gain under linking, need to write the BB registers
+		initialgain = 0x1E;
+		rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+
+		//cancel link timer 
+		_cancel_timer_ex(&pmlmeext->link_timer);
+
+		//clear CAM
+		flush_all_cam_entry(padapter);	
+
+		_rtw_memcpy(pnetwork, pbuf, FIELD_OFFSET(WLAN_BSSID_EX, IELength)); 
+		pnetwork->IELength = ((WLAN_BSSID_EX *)pbuf)->IELength;
+
+		if(pnetwork->IELength>MAX_IE_SZ)//Check pbuf->IELength
+			return H2C_PARAMETERS_ERROR;
+
+		_rtw_memcpy(pnetwork->IEs, ((WLAN_BSSID_EX *)pbuf)->IEs, pnetwork->IELength);
+	
+		start_create_ibss(padapter);
+
+	}	
+
+	return H2C_SUCCESS;
+
+}
+
+u8 join_cmd_hdl(_adapter *padapter, u8 *pbuf)
+{
+	u8	join_type;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	struct joinbss_parm	*pparm = (struct joinbss_parm *)pbuf;
+#endif //CONFIG_ANTENNA_DIVERSITY
+	u32	initialgain, i;
+	u8 cbw40_enable=0;
+	//u32	acparm;
+
+	//check already connecting to AP or not
+	if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+	{
+		if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
+		{
+			issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
+		}
+
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		
+		//clear CAM
+		flush_all_cam_entry(padapter);		
+		
+		_cancel_timer_ex(&pmlmeext->link_timer);
+		
+		//set MSR to nolink -> infra. mode		
+		//Set_MSR(padapter, _HW_STATE_NOLINK_);
+		Set_MSR(padapter, _HW_STATE_STATION_);	
+		
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, 0);
+	}
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	rtw_antenna_select_cmd(padapter, pparm->network.PhyInfo.Optimum_antenna, _FALSE);
+#endif
+
+	rtw_joinbss_reset(padapter);
+	
+	pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+	pmlmeext->cur_ch_offset= HAL_PRIME_CHNL_OFFSET_DONT_CARE;	
+	pmlmeinfo->ERP_enable = 0;
+	pmlmeinfo->WMM_enable = 0;
+	pmlmeinfo->HT_enable = 0;
+	pmlmeinfo->HT_caps_enable = 0;
+	pmlmeinfo->HT_info_enable = 0;
+	pmlmeinfo->agg_enable_bitmap = 0;
+	pmlmeinfo->candidate_tid_bitmap = 0;
+	pmlmeinfo->bwmode_updated = _FALSE;
+	//pmlmeinfo->assoc_AP_vendor = maxAP;
+
+	_rtw_memcpy(pnetwork, pbuf, FIELD_OFFSET(WLAN_BSSID_EX, IELength)); 
+	pnetwork->IELength = ((WLAN_BSSID_EX *)pbuf)->IELength;
+	
+	if(pnetwork->IELength>MAX_IE_SZ)//Check pbuf->IELength
+		return H2C_PARAMETERS_ERROR;	
+		
+	_rtw_memcpy(pnetwork->IEs, ((WLAN_BSSID_EX *)pbuf)->IEs, pnetwork->IELength); 
+
+	pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
+	pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
+
+	//Check AP vendor to move rtw_joinbss_cmd()
+	//pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->IEs, pnetwork->IELength);
+
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pnetwork->IELength;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pnetwork->IEs + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_://Get WMM IE.
+				if ( _rtw_memcmp(pIE->data, WMM_OUI, 4) )
+				{
+					pmlmeinfo->WMM_enable = 1;
+				}
+				break;
+
+			case _HT_CAPABILITY_IE_:	//Get HT Cap IE.
+				pmlmeinfo->HT_caps_enable = 1;
+				break;
+
+			case _HT_EXTRA_INFO_IE_:	//Get HT Info IE.
+				pmlmeinfo->HT_info_enable = 1;
+
+				//spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz	
+//#if !defined(CONFIG_CONCURRENT_MODE) && !defined(CONFIG_DUALMAC_CONCURRENT)
+//				if(pmlmeinfo->assoc_AP_vendor == ciscoAP)
+//#endif
+				{				
+					struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
+							
+					if( pnetwork->Configuration.DSConfig > 14 )
+					{
+						if( pregpriv->cbw40_enable & BIT(1) )
+							cbw40_enable = 1;
+					}
+					else
+						if( pregpriv->cbw40_enable & BIT(0) )
+							cbw40_enable = 1;
+						
+					if ((cbw40_enable) &&	 (pht_info->infos[0] & BIT(2)))
+					{
+						//switch to the 40M Hz mode according to the AP
+						pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+						switch (pht_info->infos[0] & 0x3)
+						{
+							case 1:
+								pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+								break;
+			
+							case 3:
+								pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+								break;
+				
+							default:
+								pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+								break;
+						}
+
+						DBG_871X("set ch/bw before connected\n");
+					}
+				}
+				break;
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+#if 0
+	if (padapter->registrypriv.wifi_spec) {
+		// for WiFi test, follow WMM test plan spec
+		acparm = 0x002F431C; // VO
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acparm));
+		acparm = 0x005E541C; // VI
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acparm));
+		acparm = 0x0000A525; // BE
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+		acparm = 0x0000A549; // BK
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acparm));
+	
+		// for WiFi test, mixed mode with intel STA under bg mode throughput issue
+		if (padapter->mlmepriv.htpriv.ht_option == _FALSE){
+			acparm = 0x00004320;
+			rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+		}
+	}
+	else {
+		acparm = 0x002F3217; // VO
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acparm));
+		acparm = 0x005E4317; // VI
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acparm));
+		acparm = 0x00105320; // BE
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+		acparm = 0x0000A444; // BK
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acparm));
+	}
+#endif
+
+	/* check channel, bandwidth, offset and switch */
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if(dc_handle_join_request(padapter) == _FAIL) {
+		DBG_871X("dc_handle_join_request fail !!!\n");
+		return H2C_SUCCESS;
+	}
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#else //NON CONFIG_DUALMAC_CONCURRENT
+	if(rtw_chk_start_clnt_join(padapter) == _FAIL) {
+		report_join_res(padapter, (-4));
+		return H2C_SUCCESS;
+	}
+#endif
+
+	//disable dynamic functions, such as high power, DIG
+	//Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	//config the initial gain under linking, need to write the BB registers
+	
+	initialgain = 0x1E;
+	rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+	
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
+	join_type = 0;
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+
+	//cancel link timer 
+	_cancel_timer_ex(&pmlmeext->link_timer);
+	
+	start_clnt_join(padapter);
+	
+	return H2C_SUCCESS;
+	
+}
+
+u8 disconnect_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	u8	val8;
+
+	if (is_client_associated_to_ap(padapter))
+	{
+		issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
+	}
+
+	//set_opmode_cmd(padapter, infra_client_with_mlme);
+
+	//pmlmeinfo->state = WIFI_FW_NULL_STATE;
+	
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, 0);
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
+
+	//restore to initial setting.
+	update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//Stop BCN
+		val8 = 0;
+		rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
+	}
+
+
+	//set MSR to no link state -> infra. mode
+	Set_MSR(padapter, _HW_STATE_STATION_);
+
+	pmlmeinfo->state = WIFI_FW_NULL_STATE;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_set_channel_bwmode_disconnect(padapter);
+#else
+#ifdef CONFIG_CONCURRENT_MODE	
+	if((check_buddy_fwstate(padapter, _FW_LINKED)) != _TRUE)
+	{
+#endif //CONFIG_CONCURRENT_MODE
+		//switch to the 20M Hz mode after disconnect
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#ifdef CONFIG_CONCURRENT_MODE
+	}
+#endif //CONFIG_CONCURRENT_MODE
+#endif //CONFIG_DUALMAC_CONCURRENT
+
+	flush_all_cam_entry(padapter);
+		
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	rtw_free_uc_swdec_pending_queue(padapter);
+	
+	return 	H2C_SUCCESS;
+}
+
+int rtw_scan_ch_decision(_adapter *padapter, struct rtw_ieee80211_channel *out,
+	u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
+{
+	int i, j;
+	int scan_ch_num = 0;
+	int set_idx;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	/* clear first */
+	_rtw_memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
+
+	/* acquire channels from in */
+	j = 0;
+	for (i=0;i<in_num;i++) {
+
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" "CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(&in[i]));
+
+		if(in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
+			&& (set_idx=rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value)) >=0
+			&& rtw_mlme_band_check(padapter, in[i].hw_value) == _TRUE
+		)
+		{
+			if (j >= out_num) {
+				DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
+					FUNC_ADPT_ARG(padapter), out_num);
+				break;
+			}
+
+			_rtw_memcpy(&out[j], &in[i], sizeof(struct rtw_ieee80211_channel));
+			
+			if(pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
+				out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
+				
+			j++;
+		}
+		if(j>=out_num)
+			break;
+	}
+	
+	/* if out is empty, use channel_set as default */
+	if(j == 0) {
+		for (i=0;i<pmlmeext->max_chan_nums;i++) {
+
+			if (0)
+			DBG_871X(FUNC_ADPT_FMT" ch:%u\n", FUNC_ADPT_ARG(padapter), pmlmeext->channel_set[i].ChannelNum);
+
+			if (rtw_mlme_band_check(padapter, pmlmeext->channel_set[i].ChannelNum) == _TRUE) {
+
+				if (j >= out_num) {
+					DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
+						FUNC_ADPT_ARG(padapter), out_num);
+					break;
+				}
+
+				out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
+			
+				if(pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
+					out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
+
+				j++;
+			}
+		}
+	}
+
+	return j;
+}
+
+u8 sitesurvey_cmd_hdl(_adapter *padapter, u8 *pbuf)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct sitesurvey_parm	*pparm = (struct sitesurvey_parm *)pbuf;
+	u8	bdelayscan = _FALSE;
+	u8	val8;
+	u32	initialgain;
+	u32	i;
+	u8	write_initial_gain = 1;
+
+#ifdef CONFIG_P2P
+	struct wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif
+
+	if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE)
+	{
+#ifdef CONFIG_CONCURRENT_MODE	
+		//for first time sitesurvey_cmd
+		rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);	
+#endif //CONFIG_CONCURRENT_MODE
+		
+		pmlmeext->sitesurvey_res.state = SCAN_START;
+		pmlmeext->sitesurvey_res.bss_cnt = 0;
+		pmlmeext->sitesurvey_res.channel_idx = 0;
+
+		for(i=0;i<RTW_SSID_SCAN_AMOUNT;i++){
+			if(pparm->ssid[i].SsidLength) {
+				_rtw_memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
+				pmlmeext->sitesurvey_res.ssid[i].SsidLength= pparm->ssid[i].SsidLength;
+			} else {
+				pmlmeext->sitesurvey_res.ssid[i].SsidLength= 0;
+			}
+		}
+
+		pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
+			, pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
+			, pparm->ch, pparm->ch_num
+		);
+
+		pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		bdelayscan = dc_handle_site_survey(padapter);
+#endif
+
+		//issue null data if associating to the AP
+		if (is_client_associated_to_ap(padapter) == _TRUE)
+		{
+			pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
+
+			issue_nulldata(padapter, NULL, 1, 3, 500);
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+			{
+				DBG_871X("adapter is scanning(buddy_adapter is linked), issue nulldata(pwrbit=1)\n");
+				
+				issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+			}
+#endif
+			bdelayscan = _TRUE;
+		}
+#ifdef CONFIG_CONCURRENT_MODE
+		else if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+		{
+			#ifdef CONFIG_TDLS
+			if(padapter->pbuddy_adapter->wdinfo.wfd_tdls_enable == 1)
+			{
+				issue_tunneled_probe_req(padapter->pbuddy_adapter);
+			}
+			#endif //CONFIG_TDLS
+
+			pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
+
+			issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+
+			bdelayscan = _TRUE;			
+		}
+#endif		
+		if(bdelayscan)
+		{
+			//delay 50ms to protect nulldata(1).
+			set_survey_timer(pmlmeext, 50);
+			return H2C_SUCCESS;
+		}
+	}
+
+	if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL))
+	{
+#ifdef CONFIG_FIND_BEST_CHANNEL
+#if 0
+		for (i=0; pmlmeext->channel_set[i].ChannelNum !=0; i++) {
+			pmlmeext->channel_set[i].rx_count = 0;				
+		}
+#endif
+#endif /* CONFIG_FIND_BEST_CHANNEL */
+
+		//disable dynamic functions, such as high power, DIG
+		Save_DM_Func_Flag(padapter);
+		Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+		//config the initial gain under scaning, need to write the BB registers
+
+#ifdef CONFIG_P2P
+#ifdef CONFIG_IOCTL_CFG80211
+		if((wdev_to_priv(padapter->rtw_wdev))->p2p_enabled == _TRUE && pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			write_initial_gain = 0;
+		}
+		else
+#endif //CONFIG_IOCTL_CFG80211
+		if ( !rtw_p2p_chk_state( pwdinfo, P2P_STATE_NONE ) )
+			initialgain = 0x28;
+		else
+#endif //CONFIG_P2P
+			initialgain = 0x17;
+
+		if(write_initial_gain == 1)
+			rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+
+		//set MSR to no link state
+		Set_MSR(padapter, _HW_STATE_NOLINK_);
+
+		val8 = 1; //under site survey
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+		pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
+	}
+
+	site_survey(padapter);
+
+	return H2C_SUCCESS;
+	
+}
+
+u8 setauth_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct setauth_parm		*pparm = (struct setauth_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	if (pparm->mode < 4)
+	{
+		pmlmeinfo->auth_algo = pparm->mode;
+	}
+
+	return 	H2C_SUCCESS;
+}
+
+u8 setkey_hdl(_adapter *padapter, u8 *pbuf)
+{
+	unsigned short				ctrl;
+	struct setkey_parm		*pparm = (struct setkey_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	unsigned char					null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	//main tx key for wep.
+	if(pparm->set_tx)
+		pmlmeinfo->key_index = pparm->keyid;
+	
+	//write cam
+	ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;	
+
+	write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
+
+	//allow multicast packets to driver
+	rtw_hal_set_hwreg(padapter, HW_VAR_ON_RCR_AM, null_addr);
+
+	return H2C_SUCCESS;
+}
+
+u8 set_stakey_hdl(_adapter *padapter, u8 *pbuf)
+{
+	u16 ctrl=0;
+	u8 cam_id=0;//cam_entry
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct set_stakey_parm	*pparm = (struct set_stakey_parm *)pbuf;
+#ifdef CONFIG_TDLS
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	struct sta_priv	*pstapriv = &padapter->stapriv;
+	struct sta_info	*psta;
+#endif //CONFIG_TDLS
+
+	//cam_entry:
+	//0~3 for default key
+	
+	//for concurrent mode (ap+sta):
+	//default key is disable, using sw encrypt/decrypt
+	//cam_entry = 4 //for sta mode (macid=0)
+	//cam_entry(macid+3) = 5 ~ N//for ap mode (aid=1~N, macid=2 ~N)
+
+	//for concurrent mode (sta+sta):
+	//default key is disable, using sw encrypt/decrypt
+	//cam_entry = 4 //mapping to macid=0
+	//cam_entry = 5 //mapping to macid=2
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		struct sta_priv	*pstapriv = &padapter->stapriv;
+		struct sta_info	*psta;
+		
+		psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
+
+		if(psta && psta->mac_id==2)
+		{
+			cam_id = 5;
+		}
+		else
+		{
+			cam_id = 4;
+		}
+/*		
+		if(padapter->iface_type > PRIMARY_IFACE)
+		{
+			cam_id = 5;
+		}
+		else
+		{
+			cam_id = 4;
+		}
+*/		
+	}	
+#else
+	cam_id = 4;
+#endif
+
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+	
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+
+		if(pparm->algorithm == _NO_PRIVACY_)	// clear cam entry
+		{
+			clear_cam_entry(padapter, pparm->id);
+			return H2C_SUCCESS_RSP;
+		}
+		
+		psta = rtw_get_stainfo(pstapriv, pparm->addr);
+		if(psta)
+		{			
+			ctrl = (BIT(15) | ((pparm->algorithm) << 2));
+
+			DBG_871X("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
+
+			if((psta->mac_id<1) || (psta->mac_id>(NUM_STA-4)))
+			{
+				DBG_871X("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
+				return H2C_REJECTED;
+			}	
+				 
+			cam_id = (psta->mac_id + 3);//0~3 for default key, cmd_id=macid + 3, macid=aid+1;
+
+			DBG_871X("Write CAM, mac_addr=%x:%x:%x:%x:%x:%x, cam_entry=%d\n", pparm->addr[0], 
+						pparm->addr[1], pparm->addr[2], pparm->addr[3], pparm->addr[4],
+						pparm->addr[5], cam_id);
+
+			write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
+	
+			return H2C_SUCCESS_RSP;
+		
+		}
+		else
+		{
+			DBG_871X("r871x_set_stakey_hdl(): sta has been free\n");
+			return H2C_REJECTED;
+		}
+		
+	}
+
+	//below for sta mode
+	
+	if(pparm->algorithm == _NO_PRIVACY_)	// clear cam entry
+	{
+		clear_cam_entry(padapter, pparm->id);
+		return H2C_SUCCESS;
+	}
+	
+	ctrl = BIT(15) | ((pparm->algorithm) << 2);	
+	
+#ifdef CONFIG_TDLS
+	if(ptdlsinfo->clear_cam!=0){
+		clear_cam_entry(padapter, ptdlsinfo->clear_cam);
+		ptdlsinfo->clear_cam=0;
+
+		return H2C_SUCCESS;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, pparm->addr);//Get TDLS Peer STA
+	if( psta->tdls_sta_state&TDLS_LINKED_STATE ){
+		write_cam(padapter, psta->mac_id, ctrl, pparm->addr, pparm->key);
+	}
+	else
+#endif //CONFIG_TDLS	
+	write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
+
+	pmlmeinfo->enc_algo = pparm->algorithm;
+	
+	return H2C_SUCCESS;
+}
+
+u8 add_ba_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct addBaReq_parm 	*pparm = (struct addBaReq_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
+	
+	if(!psta)
+		return 	H2C_SUCCESS;
+		
+
+	if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
+		((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//pmlmeinfo->ADDBA_retry_count = 0;
+		//pmlmeinfo->candidate_tid_bitmap |= (0x1 << pparm->tid);		
+		//psta->htpriv.candidate_tid_bitmap |= BIT(pparm->tid);
+		issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);		
+		//_set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO);
+		_set_timer(&psta->addba_retry_timer, ADDBA_TO);
+	}
+#ifdef CONFIG_TDLS
+	else if((psta->tdls_sta_state & TDLS_LINKED_STATE)&& 
+		(psta->htpriv.ht_option==_TRUE) && 
+		(psta->htpriv.ampdu_enable==_TRUE) )
+	{
+		issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);		
+		//_set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO);
+		_set_timer(&psta->addba_retry_timer, ADDBA_TO);
+	}
+#endif //CONFIG
+	else
+	{		
+		psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);		
+	}
+	
+	return 	H2C_SUCCESS;
+}
+
+u8 set_tx_beacon_cmd(_adapter* padapter)
+{
+	struct cmd_obj	*ph2c;
+	struct Tx_Beacon_param 	*ptxBeacon_parm;	
+	struct cmd_priv	*pcmdpriv = &(padapter->cmdpriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8	res = _SUCCESS;
+	int len_diff = 0;
+	
+_func_enter_;	
+	
+	if ((ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		res= _FAIL;
+		goto exit;
+	}
+	
+	if ((ptxBeacon_parm = (struct Tx_Beacon_param *)rtw_zmalloc(sizeof(struct Tx_Beacon_param))) == NULL)
+	{
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memcpy(&(ptxBeacon_parm->network), &(pmlmeinfo->network), sizeof(WLAN_BSSID_EX));
+	
+	len_diff = update_hidden_ssid(
+		ptxBeacon_parm->network.IEs+_BEACON_IE_OFFSET_
+		, ptxBeacon_parm->network.IELength-_BEACON_IE_OFFSET_
+		, pmlmeinfo->hidden_ssid_mode
+	);
+	ptxBeacon_parm->network.IELength += len_diff;
+		
+	init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+}
+
+
+u8 mlme_evt_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	u8 evt_code, evt_seq;
+	u16 evt_sz;
+	uint 	*peventbuf;
+	void (*event_callback)(_adapter *dev, u8 *pbuf);
+	struct evt_priv *pevt_priv = &(padapter->evtpriv);
+
+	peventbuf = (uint*)pbuf;
+	evt_sz = (u16)(*peventbuf&0xffff);
+	evt_seq = (u8)((*peventbuf>>24)&0x7f);
+	evt_code = (u8)((*peventbuf>>16)&0xff);
+	
+		
+	#ifdef CHECK_EVENT_SEQ
+	// checking event sequence...		
+	if (evt_seq != (ATOMIC_READ(&pevt_priv->event_seq) & 0x7f) )
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("Evetn Seq Error! %d vs %d\n", (evt_seq & 0x7f), (ATOMIC_READ(&pevt_priv->event_seq) & 0x7f)));
+	
+		pevt_priv->event_seq = (evt_seq+1)&0x7f;
+
+		goto _abort_event_;
+	}
+	#endif
+
+	// checking if event code is valid
+	if (evt_code >= MAX_C2HEVT)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nEvent Code(%d) mismatch!\n", evt_code));
+		goto _abort_event_;
+	}
+
+	// checking if event size match the event parm size	
+	if ((wlanevents[evt_code].parmsize != 0) && 
+			(wlanevents[evt_code].parmsize != evt_sz))
+	{
+			
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n", 
+			evt_code, wlanevents[evt_code].parmsize, evt_sz));
+		goto _abort_event_;	
+			
+	}
+
+	ATOMIC_INC(&pevt_priv->event_seq);
+
+	peventbuf += 2;
+				
+	if(peventbuf)
+	{
+		event_callback = wlanevents[evt_code].event_callback;
+		event_callback(padapter, (u8*)peventbuf);
+
+		pevt_priv->evt_done_cnt++;
+	}
+
+
+_abort_event_:
+
+
+	return H2C_SUCCESS;
+		
+}
+
+u8 h2c_msg_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	return H2C_SUCCESS;
+}
+
+u8 tx_beacon_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	if(send_beacon(padapter)==_FAIL)
+	{
+		DBG_871X("issue_beacon, fail!\n");
+		return H2C_PARAMETERS_ERROR;
+	}
+#ifdef CONFIG_AP_MODE
+	else //tx bc/mc frames after update TIM 
+	{	
+		_irqL irqL;
+		struct sta_info *psta_bmc;
+		_list	*xmitframe_plist, *xmitframe_phead;
+		struct xmit_frame *pxmitframe=NULL;
+		struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+		struct sta_priv  *pstapriv = &padapter->stapriv;
+		
+		//for BC/MC Frames
+		psta_bmc = rtw_get_bcmc_stainfo(padapter);
+		if(!psta_bmc)
+			return H2C_SUCCESS;
+	
+		if((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len>0))
+		{				
+#ifndef CONFIG_PCI_HCI
+			rtw_msleep_os(10);// 10ms, ATIM(HIQ) Windows
+#endif
+			//_enter_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+			_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+			xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
+			xmitframe_plist = get_next(xmitframe_phead);
+
+			while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+			{			
+				pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+				xmitframe_plist = get_next(xmitframe_plist);
+
+				rtw_list_delete(&pxmitframe->list);
+
+				psta_bmc->sleepq_len--;
+				if(psta_bmc->sleepq_len>0)
+					pxmitframe->attrib.mdata = 1;
+				else
+					pxmitframe->attrib.mdata = 0;
+
+				pxmitframe->attrib.triggered=1;
+
+				pxmitframe->attrib.qsel = 0x11;//HIQ
+
+#if 0
+				_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+				if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+				{		
+					rtw_os_xmit_complete(padapter, pxmitframe);
+				}
+				_enter_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+
+#endif
+				rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+				//pstapriv->tim_bitmap &= ~BIT(0);				
+		
+			}	
+	
+			//_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+	               _exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+		}
+
+	}
+#endif
+
+	return H2C_SUCCESS;
+	
+}
+
+void change_band_update_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork)
+{
+	u8	network_type,rate_len, total_rate_len,remainder_rate_len;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8	erpinfo=0x4;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if(pmlmeext->cur_channel >= 36)
+	{
+		network_type = WIRELESS_11A;
+		total_rate_len = IEEE80211_NUM_OFDM_RATESLEN;
+		DBG_871X("%s(): change to 5G Band\n",__FUNCTION__);
+		rtw_remove_bcn_ie(padapter, pnetwork, _ERPINFO_IE_);
+	}
+	else
+	{
+		network_type = WIRELESS_11BG;
+		total_rate_len = IEEE80211_CCK_RATE_LEN+IEEE80211_NUM_OFDM_RATESLEN;
+		DBG_871X("%s(): change to 2.4G Band\n",__FUNCTION__);
+		rtw_add_bcn_ie(padapter, pnetwork, _ERPINFO_IE_, &erpinfo, 1);
+	}
+
+	rtw_set_supported_rate(pnetwork->SupportedRates, network_type);
+
+	UpdateBrateTbl(padapter, pnetwork->SupportedRates);
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, pnetwork->SupportedRates);
+
+	if(total_rate_len > 8)
+	{
+		rate_len = 8;
+		remainder_rate_len = total_rate_len - 8;
+	}
+	else
+	{
+		rate_len = total_rate_len;
+		remainder_rate_len = 0;
+	}
+
+	rtw_add_bcn_ie(padapter, pnetwork, _SUPPORTEDRATES_IE_, pnetwork->SupportedRates, rate_len);
+
+	if(remainder_rate_len)
+	{
+		rtw_add_bcn_ie(padapter, pnetwork, _EXT_SUPPORTEDRATES_IE_, (pnetwork->SupportedRates+8), remainder_rate_len);
+	}
+	else
+	{
+		rtw_remove_bcn_ie(padapter, pnetwork, _EXT_SUPPORTEDRATES_IE_);
+	}
+}
+
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+void dc_SelectChannel(_adapter *padapter, unsigned char channel)
+{
+	PADAPTER ptarget_adapter;
+
+	if( (padapter->pbuddy_adapter != NULL) && 
+		(padapter->DualMacConcurrent == _TRUE) &&
+		(padapter->adapter_type == SECONDARY_ADAPTER))
+	{
+		// only mac0 could control BB&RF
+		ptarget_adapter = padapter->pbuddy_adapter;
+	}
+	else
+	{
+		ptarget_adapter = padapter;
+	}
+
+	_enter_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setch_mutex), NULL);
+
+	rtw_hal_set_chan(ptarget_adapter, channel);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setch_mutex), NULL);
+}
+
+void dc_SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset)
+{
+	PADAPTER ptarget_adapter;
+
+	if( (padapter->pbuddy_adapter != NULL) && 
+		(padapter->DualMacConcurrent == _TRUE) &&
+		(padapter->adapter_type == SECONDARY_ADAPTER))
+	{
+		// only mac0 could control BB&RF
+		ptarget_adapter = padapter->pbuddy_adapter;
+	}
+	else
+	{
+		ptarget_adapter = padapter;
+	}
+
+	_enter_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setbw_mutex), NULL);
+
+	rtw_hal_set_bwmode(ptarget_adapter, (HT_CHANNEL_WIDTH)bwmode, channel_offset);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setbw_mutex), NULL);
+}
+
+void dc_set_channel_bwmode_disconnect(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		if((check_fwstate(pbuddy_mlmepriv, _FW_LINKED)) != _TRUE)
+		{
+			//switch to the 20M Hz mode after disconnect
+			pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+			set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+		}
+	}
+	else
+	{
+		//switch to the 20M Hz mode after disconnect
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	}
+}
+
+u8 dc_handle_join_request(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;		
+	struct mlme_ext_priv *pbuddy_mlmeext = NULL;
+	struct mlme_priv	*pbuddy_mlmepriv = NULL;
+	u8	ret = _SUCCESS;
+
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+
+		if(pmlmeext->cur_channel != pbuddy_mlmeext->cur_channel ||
+			pmlmeext->cur_bwmode != pbuddy_mlmeext->cur_bwmode ||
+			pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset)
+		{
+			if((check_fwstate(pbuddy_mlmepriv, WIFI_AP_STATE)) == _TRUE)
+			{
+				//issue deauth to all stas if if2 is at ap mode
+				rtw_sta_flush(pbuddy_adapter);
+
+				//rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
+				rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_CHECK_TXBUF, 0);
+			}
+			else if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED) == _TRUE)
+			{
+				if(pmlmeext->cur_channel == pbuddy_mlmeext->cur_channel)
+				{
+					// HT_CHANNEL_WIDTH_40 or HT_CHANNEL_WIDTH_20 but channel offset is different
+					if((pmlmeext->cur_bwmode == pbuddy_mlmeext->cur_bwmode) &&
+						(pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset) )
+					{
+						report_join_res(padapter, -4);
+						ret = _FAIL;
+					}
+				}
+				else
+				{
+					report_join_res(padapter, -4);
+					ret = _FAIL;
+				}
+			}
+		}
+		else	 if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			issue_nulldata(pbuddy_adapter, NULL, 1, 0, 0);
+		}
+	}
+
+	return ret;
+}
+
+void dc_handle_join_done(_adapter *padapter, u8 join_res)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv *pbuddy_mlmeext = NULL;
+	struct mlme_ext_info *pbuddy_mlmeinfo = NULL;
+	WLAN_BSSID_EX *pbuddy_network_mlmeext = NULL;
+	u8	change_band = _FALSE;
+
+
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+		pbuddy_network_mlmeext = &(pbuddy_mlmeinfo->network);
+	
+		if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+				check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+		{
+			//restart and update beacon
+			DBG_871X("after join, current adapter, CH=%d, BW=%d, offset=%d\n", pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+
+			if(join_res >= 0)
+			{
+				u8 *p;
+				int	ie_len;
+				struct HT_info_element *pht_info=NULL;
+
+				if((pbuddy_mlmeext->cur_channel <= 14 && pmlmeext->cur_channel >= 36) ||
+					(pbuddy_mlmeext->cur_channel >= 36 && pmlmeext->cur_channel <= 14))
+				{
+					change_band = _TRUE;
+				}
+
+				//sync channel/bwmode/ch_offset with another adapter
+				pbuddy_mlmeext->cur_channel = pmlmeext->cur_channel;
+				
+				if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				{
+					p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+					if( p && ie_len)
+					{
+						pht_info = (struct HT_info_element *)(p+2);
+						pht_info->infos[0] &= ~(BIT(0)|BIT(1)); //no secondary channel is present
+					}	
+				
+					if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+					{
+						pbuddy_mlmeext->cur_ch_offset = pmlmeext->cur_ch_offset;
+
+						//to update cur_ch_offset value in beacon
+						if( pht_info )
+						{
+							switch(pmlmeext->cur_ch_offset)
+							{
+								case HAL_PRIME_CHNL_OFFSET_LOWER:
+									pht_info->infos[0] |= 0x1;
+									break;
+								case HAL_PRIME_CHNL_OFFSET_UPPER:
+									pht_info->infos[0] |= 0x3;
+									break;
+								case HAL_PRIME_CHNL_OFFSET_DONT_CARE:							
+								default:							
+									break;					
+							}
+						}
+					}
+					else if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+					{
+						pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+						pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+						if(pmlmeext->cur_channel>0 && pmlmeext->cur_channel<5)
+						{
+							if(pht_info)
+								pht_info->infos[0] |= 0x1;
+
+							pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+							pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+						}
+
+						if(pmlmeext->cur_channel>7 && pmlmeext->cur_channel<(14+1))
+						{
+							if(pht_info)
+								pht_info->infos[0] |= 0x3;
+
+							pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+							pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+						}
+
+						set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+					}
+				}
+
+				// to update channel value in beacon
+				pbuddy_network_mlmeext->Configuration.DSConfig = pmlmeext->cur_channel;
+				p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+				if(p && ie_len>0)
+					*(p + 2) = pmlmeext->cur_channel;
+
+				p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+				if( p && ie_len)
+				{
+					pht_info = (struct HT_info_element *)(p+2);
+					pht_info->primary_channel = pmlmeext->cur_channel;
+				}
+
+				// update mlmepriv's cur_network
+				_rtw_memcpy(&pbuddy_mlmepriv->cur_network.network, pbuddy_network_mlmeext, pbuddy_network_mlmeext->Length);
+			}
+			else
+			{
+				// switch back to original channel/bwmode/ch_offset;
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			}
+
+			DBG_871X("after join, another adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+			if(change_band == _TRUE)
+				change_band_update_ie(pbuddy_adapter, pbuddy_network_mlmeext);
+
+			DBG_871X("update pbuddy_adapter's beacon\n");
+
+			update_beacon(pbuddy_adapter, 0, NULL, _TRUE);
+		}
+		else	 if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			if((pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+				(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20))
+			{
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			}
+		
+			issue_nulldata(pbuddy_adapter, NULL, 0, 0, 0);
+		}
+	}
+}
+
+sint	dc_check_fwstate(_adapter *padapter, sint fw_state)
+{
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+
+	if(padapter->pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+
+		return check_fwstate(pbuddy_mlmepriv, fw_state);
+	}
+
+	return _FALSE;
+}
+
+u8 dc_handle_site_survey(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;		
+
+	// only mac0 can do scan request, help issue nulldata(1) for mac1
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
+		
+			issue_nulldata(pbuddy_adapter, NULL, 1, 2, 0);			
+
+			return _TRUE;
+		}
+	}
+
+	return _FALSE;
+}
+
+void	dc_report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
+{
+	if(padapter->pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		report_survey_event(padapter->pbuddy_adapter, precv_frame);	
+	}
+}
+
+void dc_set_channel_bwmode_survey_done(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv *pbuddy_mlmeext = NULL;
+	struct mlme_ext_info *pbuddy_mlmeinfo = NULL;
+	u8 cur_channel;
+	u8 cur_bwmode;
+	u8 cur_ch_offset;
+
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+
+		if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+		{
+			if(check_fwstate(pmlmepriv, _FW_LINKED) &&
+				(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40))
+			{
+				cur_channel = pmlmeext->cur_channel;
+				cur_bwmode = pmlmeext->cur_bwmode;
+				cur_ch_offset = pmlmeext->cur_ch_offset;
+			}
+			else
+			{
+				cur_channel = pbuddy_mlmeext->cur_channel;
+				cur_bwmode = pbuddy_mlmeext->cur_bwmode;
+				cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+			}
+		}
+		else
+		{
+			cur_channel = pmlmeext->cur_channel;
+			cur_bwmode = pmlmeext->cur_bwmode;
+			cur_ch_offset = pmlmeext->cur_ch_offset;
+		}
+
+		set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+
+		if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			//issue null data 
+			issue_nulldata(pbuddy_adapter, NULL, 0, 0, 0);
+		}
+
+		if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+			check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+		{
+
+			DBG_871X("survey done, current CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+			DBG_871X("restart pbuddy_adapter's beacon\n");
+		
+			update_beacon(pbuddy_adapter, 0, NULL, _TRUE);
+		}
+	}
+	else
+	{
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	}
+}
+
+void dc_set_ap_channel_bandwidth(_adapter *padapter, u8 channel, u8 channel_offset, u8 bwmode)
+{
+	u8	*p;
+	u8	val8, cur_channel, cur_bwmode, cur_ch_offset, change_band;
+	int	ie_len;	
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct HT_info_element	*pht_info=NULL;
+	_adapter	*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv	*pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv	*pbuddy_mlmeext = NULL;
+
+	DBG_871X("dualmac_concurrent_ap_set_channel_bwmode ==>\n");
+
+	cur_channel = channel;
+	cur_bwmode = bwmode;
+	cur_ch_offset = channel_offset;
+	change_band = _FALSE;
+
+	p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+	if( p && ie_len)
+	{
+		pht_info = (struct HT_info_element *)(p+2);
+	}
+
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		
+		if(!check_fwstate(pbuddy_mlmepriv, _FW_LINKED|_FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+		{
+			set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+		}
+		else if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED)==_TRUE)
+		{
+			//To sync cur_channel/cur_bwmode/cur_ch_offset with another adapter
+			DBG_871X("Another iface is at linked state, sync cur_channel/cur_bwmode/cur_ch_offset\n");
+			DBG_871X("Another adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+			DBG_871X("Current adapter, CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+			
+			cur_channel = pbuddy_mlmeext->cur_channel;
+			if(cur_bwmode == HT_CHANNEL_WIDTH_40)
+			{
+				if(pht_info)
+					pht_info->infos[0] &= ~(BIT(0)|BIT(1));
+
+				if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				{
+					cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+
+					//to update cur_ch_offset value in beacon
+					if(pht_info)
+					{				
+						switch(cur_ch_offset)
+						{
+							case HAL_PRIME_CHNL_OFFSET_LOWER:
+								pht_info->infos[0] |= 0x1;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_UPPER:
+								pht_info->infos[0] |= 0x3;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_DONT_CARE:
+							default:							
+								break;					
+						}
+					}
+				}
+				else if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+				{
+					cur_bwmode = HT_CHANNEL_WIDTH_20;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+					if(cur_channel>0 && cur_channel<5)
+					{
+						if(pht_info)
+							pht_info->infos[0] |= 0x1;		
+
+						cur_bwmode = HT_CHANNEL_WIDTH_40;
+						cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					}
+
+					if(cur_channel>7 && cur_channel<(14+1))
+					{
+						if(pht_info)
+							pht_info->infos[0] |= 0x3;
+
+						cur_bwmode = HT_CHANNEL_WIDTH_40;
+						cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+					}
+
+					set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+				}
+			}
+
+			// to update channel value in beacon
+			pnetwork->Configuration.DSConfig = cur_channel;		
+			p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+			if(p && ie_len>0)
+				*(p + 2) = cur_channel;
+
+			if(pht_info)
+				pht_info->primary_channel = cur_channel;
+		}
+	}
+	else
+	{
+		set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+	}
+
+	DBG_871X("CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+	if((channel <= 14 && cur_channel >= 36) ||
+		(channel >= 36 && cur_channel <= 14))
+	{
+		change_band = _TRUE;
+	}
+
+	pmlmeext->cur_channel = cur_channel;
+	pmlmeext->cur_bwmode = cur_bwmode;
+	pmlmeext->cur_ch_offset = cur_ch_offset;
+
+	if(change_band == _TRUE)
+		change_band_update_ie(padapter, pnetwork);
+
+	DBG_871X("dualmac_concurrent_ap_set_channel_bwmode <==\n");
+}
+
+void dc_resume_xmit(_adapter *padapter)
+{
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		DBG_871X("dc_resume_xmit,  resume pbuddy_adapter Tx\n");
+		rtw_os_xmit_schedule(pbuddy_adapter);
+	}
+}
+
+u8	dc_check_xmit(_adapter *padapter)
+{
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+
+	if(pbuddy_adapter != NULL && 
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		if (check_fwstate(pbuddy_mlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		{
+			DBG_871X("dc_check_xmit  pbuddy_adapter is under survey or under linking\n");
+			return _FALSE;
+		}
+	}
+
+	return _TRUE;
+}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+sint check_buddy_mlmeinfo_state(_adapter *padapter, u32 state)
+{
+	PADAPTER pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext;
+	struct mlme_ext_info *pbuddy_mlmeinfo;
+
+	if(padapter == NULL)
+		return _FALSE;	
+	
+	pbuddy_adapter = padapter->pbuddy_adapter;
+
+	if(pbuddy_adapter == NULL)
+		return _FALSE;	
+
+
+	pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+		
+	if((pbuddy_mlmeinfo->state&0x03) == state)
+		return _TRUE;		
+
+	return _FALSE;
+	
+}
+
+void concurrent_chk_joinbss_done(_adapter *padapter, int join_res)
+{
+	struct mlme_ext_priv	*pmlmeext;
+	struct mlme_ext_info	*pmlmeinfo;	
+	PADAPTER pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv;
+	struct mlme_ext_priv *pbuddy_mlmeext;
+	struct mlme_ext_info *pbuddy_mlmeinfo;
+	WLAN_BSSID_EX *pbuddy_network_mlmeext;
+
+	pmlmeext = &padapter->mlmeextpriv;
+	pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	if(!rtw_buddy_adapter_up(padapter))
+	{
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+		return;
+	}
+
+	pbuddy_adapter = padapter->pbuddy_adapter;
+	pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+	pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+	pbuddy_network_mlmeext = &(pbuddy_mlmeinfo->network);
+
+	if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+			check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+	{
+		//restart and update beacon
+
+		DBG_871X("after join,primary adapter, CH=%d, BW=%d, offset=%d\n"
+			, pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+		
+
+		if(join_res >= 0)
+		{
+			u8 *p;
+			int	ie_len;
+			u8	change_band = _FALSE;
+			struct HT_info_element *pht_info=NULL;
+
+			if((pmlmeext->cur_channel <= 14 && pbuddy_mlmeext->cur_channel >= 36) ||
+				(pmlmeext->cur_channel >= 36 && pbuddy_mlmeext->cur_channel <= 14))
+				change_band = _TRUE;
+
+			//sync channel/bwmode/ch_offset with primary adapter
+			pbuddy_mlmeext->cur_channel = pmlmeext->cur_channel;
+			if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+			{
+				p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+				if( p && ie_len)
+				{
+					pht_info = (struct HT_info_element *)(p+2);
+					pht_info->infos[0] &= ~(BIT(0)|BIT(1)); //no secondary channel is present
+				}
+			
+				if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				{
+					pbuddy_mlmeext->cur_ch_offset = pmlmeext->cur_ch_offset;
+
+					//to update cur_ch_offset value in beacon
+					if( pht_info )
+					{
+						switch(pmlmeext->cur_ch_offset)
+						{
+							case HAL_PRIME_CHNL_OFFSET_LOWER:
+								pht_info->infos[0] |= 0x1;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_UPPER:
+								pht_info->infos[0] |= 0x3;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_DONT_CARE:							
+							default:							
+								break;					
+						}
+						
+					}					
+				
+				}
+				else if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+				{
+					if(pmlmeext->cur_channel>=1 && pmlmeext->cur_channel<=4)
+					{
+						if(pht_info)
+							pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE;		
+
+						pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+						pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					}
+					else if(pmlmeext->cur_channel>=5 && pmlmeext->cur_channel<=14)
+					{
+						if(pht_info)
+							pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW;
+						
+						pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+						pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;						
+					}
+					else
+					{
+						switch(pmlmeext->cur_channel)
+						{
+							case 36:
+							case 44:
+							case 52:
+							case 60:
+							case 100:
+							case 108:
+							case 116:
+							case 124:
+							case 132:
+							case 149:
+							case 157:
+							{
+								if(pht_info)
+									pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE;		
+								pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+								pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+								break;
+							}
+							case 40:
+							case 48:
+							case 56:
+							case 64:
+							case 104:
+							case 112:
+							case 120:
+							case 128:
+							case 136:
+							case 153:
+							case 161:
+							{
+								if(pht_info)
+									pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW;
+								
+								pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+								pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+								break;
+							}
+							default:
+								if(pht_info)
+									pht_info->infos[0] &= ~HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW;
+								pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+								pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+								break;								
+
+						}
+						
+					}
+
+				}
+
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+				
+			}
+			else
+			{
+				set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+			}
+
+
+			// to update channel value in beacon
+			pbuddy_network_mlmeext->Configuration.DSConfig = pmlmeext->cur_channel;		
+			p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+			if(p && ie_len>0)
+				*(p + 2) = pmlmeext->cur_channel;
+
+			p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+			if( p && ie_len)
+			{
+				pht_info = (struct HT_info_element *)(p+2);
+				pht_info->primary_channel = pmlmeext->cur_channel;
+			}
+
+			//buddy interface band is different from current interface, update ERP, support rate, ext support rate IE
+			if(change_band == _TRUE)
+				change_band_update_ie(pbuddy_adapter, pbuddy_network_mlmeext);
+		}
+		else
+		{
+			// switch back to original channel/bwmode/ch_offset;
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+		}
+
+		DBG_871X("after join, second adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+		DBG_871X("update pbuddy_adapter's beacon\n");
+		
+		update_beacon(pbuddy_adapter, 0, NULL, _TRUE);
+
+	}
+	else if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) &&
+			check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+	{		
+		if(join_res >= 0)
+		{	
+			pbuddy_mlmeext->cur_channel = pmlmeext->cur_channel;
+			if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);		
+			else if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);		
+			else
+				set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+		else
+		{
+			// switch back to original channel/bwmode/ch_offset;
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+		}			
+	}
+	else
+	{
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	}
+	
+}
+#endif //CONFIG_CONCURRENT_MODE
+
+int rtw_chk_start_clnt_join(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	unsigned char	cur_ch = pmlmeext->cur_channel;
+	unsigned char	cur_bw = pmlmeext->cur_bwmode;
+	unsigned char	cur_ch_offset = pmlmeext->cur_ch_offset;
+	bool chbw_allow = _TRUE;
+	bool connect_allow = _TRUE;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter;	
+	struct mlme_ext_priv *pbuddy_mlmeext;
+	struct mlme_ext_info	*pbuddy_pmlmeinfo;
+	struct mlme_priv *pbuddy_mlmepriv;
+
+	if (!rtw_buddy_adapter_up(padapter)) {
+		goto start_join_set_ch_bw;
+	}
+
+	pbuddy_adapter = padapter->pbuddy_adapter;		
+	pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	pbuddy_pmlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+	pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+
+	if((pbuddy_pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)//for AP MODE
+	{
+		DBG_871X("start_clnt_join: "ADPT_FMT"(ch=%d, bw=%d, ch_offset=%d)"
+			", "ADPT_FMT" AP mode(ch=%d, bw=%d, ch_offset=%d)\n",
+			ADPT_ARG(padapter), pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset,
+			ADPT_ARG(pbuddy_adapter), pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+		if(pmlmeext->cur_channel != pbuddy_mlmeext->cur_channel)
+		{
+			chbw_allow = _FALSE;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset))
+		{
+			chbw_allow = _FALSE;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40))
+		{
+			cur_ch = pmlmeext->cur_channel;
+			cur_bw = pbuddy_mlmeext->cur_bwmode;
+			cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+		}
+
+		DBG_871X("start_clnt_join: connect_allow:%d, chbw_allow:%d\n", connect_allow, chbw_allow);
+		if (chbw_allow == _FALSE) {
+			#ifdef CONFIG_SPCT_CH_SWITCH
+			if (1) {
+				rtw_ap_inform_ch_switch(pbuddy_adapter, pmlmeext->cur_channel , pmlmeext->cur_ch_offset);
+			} else
+			#endif
+			{
+				//issue deauth to all stas if if2 is at ap mode
+				rtw_sta_flush(pbuddy_adapter);
+			}
+			rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
+		}
+	}
+	else if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED) == _TRUE &&
+		check_fwstate(pbuddy_mlmepriv, WIFI_STATION_STATE) == _TRUE) //for Client Mode/p2p client
+	{
+		DBG_871X("start_clnt_join: "ADPT_FMT"(ch=%d, bw=%d, ch_offset=%d)"
+			", "ADPT_FMT" STA mode(ch=%d, bw=%d, ch_offset=%d)\n",
+			ADPT_ARG(padapter), pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset,
+			ADPT_ARG(pbuddy_adapter), pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+		if(pmlmeext->cur_channel != pbuddy_mlmeext->cur_channel)
+		{
+			chbw_allow = _FALSE;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40))
+		{
+			cur_bw = HT_CHANNEL_WIDTH_40;
+			cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset))
+		{
+			chbw_allow = _FALSE;
+		}
+
+		connect_allow = chbw_allow;
+
+		#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211)
+		/* wlan0-sta mode has higher priority than p2p0-p2p client */
+		if (!rtw_p2p_chk_state(&(pbuddy_adapter->wdinfo), P2P_STATE_NONE)
+			&& pbuddy_adapter->wdinfo.driver_interface == DRIVER_CFG80211)
+		{
+			connect_allow = _TRUE;
+		}
+		#endif /* CONFIG_P2P && CONFIG_IOCTL_CFG80211 */
+
+		DBG_871X("start_clnt_join: connect_allow:%d, chbw_allow:%d\n", connect_allow, chbw_allow);
+		if (connect_allow == _TRUE && chbw_allow == _FALSE) {
+			/* disconnect buddy's connection */
+			rtw_disassoc_cmd(pbuddy_adapter, 500, _FALSE);
+			rtw_indicate_disconnect(pbuddy_adapter);
+			rtw_free_assoc_resources(pbuddy_adapter, 1);
+		}
+	}	
+
+start_join_set_ch_bw:
+#endif /* CONFIG_CONCURRENT_MODE */
+
+	if (connect_allow == _TRUE) {
+		DBG_871X("start_join_set_ch_bw: ch=%d, bwmode=%d, ch_offset=%d\n", cur_ch, cur_bw, cur_ch_offset);
+		set_channel_bwmode(padapter, cur_ch, cur_ch_offset, cur_bw);
+	}
+
+	return connect_allow == _TRUE ? _SUCCESS : _FAIL;
+}
+
+/* Find union about ch, bw, ch_offset of all linked interfaces */
+int rtw_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset)
+{
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+	_adapter *iface;
+	struct mlme_ext_priv *mlmeext;
+	int i;
+	u8 ch_ret = 0;
+	u8 bw_ret = HT_CHANNEL_WIDTH_20;
+	u8 offset_ret = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	int num = 0;
+
+	if (ch) *ch = 0;
+	if (bw) *bw = HT_CHANNEL_WIDTH_20;
+	if (offset) *offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	for (i = 0; i<dvobj->iface_nums; i++) {
+		iface = dvobj->padapters[i];
+		mlmeext = &iface->mlmeextpriv;
+
+		if (!check_fwstate(&iface->mlmepriv, _FW_LINKED))
+			continue;
+
+		if (num == 0) {
+			ch_ret = mlmeext->cur_channel;
+			bw_ret = mlmeext->cur_bwmode;
+			offset_ret = mlmeext->cur_ch_offset;
+			num++;
+			continue;
+		}
+
+		if (ch_ret != mlmeext->cur_channel) {
+			num = 0;
+			break;
+		}
+
+		if (bw_ret < mlmeext->cur_bwmode) {
+			bw_ret = mlmeext->cur_bwmode;
+			offset_ret = mlmeext->cur_ch_offset;
+		} else if (bw_ret == mlmeext->cur_bwmode && offset_ret != mlmeext->cur_ch_offset) {
+			num = 0;
+			break;
+		}
+
+		num++;
+	}
+
+	if (num) {
+		if (ch) *ch = ch_ret;
+		if (bw) *bw = bw_ret;
+		if (offset) *offset = offset_ret;
+	}
+
+	return num;
+}
+
+u8 set_ch_hdl(_adapter *padapter, u8 *pbuf)
+{
+	struct set_ch_parm *set_ch_parm;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	set_ch_parm = (struct set_ch_parm *)pbuf;
+
+	DBG_871X(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev),
+		set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
+
+	pmlmeext->cur_channel = set_ch_parm->ch;
+	pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
+	pmlmeext->cur_bwmode = set_ch_parm->bw;
+
+	set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
+
+	return 	H2C_SUCCESS;
+}
+
+u8 set_chplan_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct SetChannelPlan_param *setChannelPlan_param;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
+
+	pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
+	init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);	
+
+	return 	H2C_SUCCESS;
+}
+
+u8 led_blink_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct LedBlink_param *ledBlink_param;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	ledBlink_param = (struct LedBlink_param *)pbuf;
+
+	#ifdef CONFIG_LED_HANDLED_BY_CMD_THREAD
+	BlinkHandler(ledBlink_param->pLed);
+	#endif
+
+	return 	H2C_SUCCESS;
+}
+
+u8 set_csa_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+#ifdef CONFIG_DFS
+	struct SetChannelSwitch_param *setChannelSwitch_param;
+	struct SetChannelPlan_param *setChannelPlan_param;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+	u8 new_ch_no;
+	u8 gval8 = 0x00, sval8 = 0xff;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	setChannelSwitch_param = (struct SetChannelSwitch_param *)pbuf;
+	new_ch_no = setChannelSwitch_param->new_ch_no;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, &gval8);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, &sval8);
+
+	DBG_871X("DFS detected! Swiching channel to %d!\n", new_ch_no);
+	SelectChannel(padapter, new_ch_no);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, &gval8);
+
+	rtw_free_network_queue(padapter, _TRUE);
+	rtw_indicate_disconnect(padapter);
+
+	if ( ((new_ch_no >= 52) && (new_ch_no <= 64)) ||((new_ch_no >= 100) && (new_ch_no <= 140)) ) {
+		DBG_871X("Switched to DFS band (ch %02x) again!!\n", new_ch_no);
+	}
+
+	return 	H2C_SUCCESS;
+#else
+	return	H2C_REJECTED;
+#endif //CONFIG_DFS
+
+}
+
+// TDLS_WRCR		: write RCR DATA BIT
+// TDLS_SD_PTI		: issue peer traffic indication
+// TDLS_CS_OFF		: go back to the channel linked with AP, terminating channel switch procedure
+// TDLS_INIT_CH_SEN	: init channel sensing, receive all data and mgnt frame
+// TDLS_DONE_CH_SEN: channel sensing and report candidate channel
+// TDLS_OFF_CH		: first time set channel to off channel
+// TDLS_BASE_CH		: go back tp the channel linked with AP when set base channel as target channel
+// TDLS_P_OFF_CH	: periodically go to off channel
+// TDLS_P_BASE_CH	: periodically go back to base channel
+// TDLS_RS_RCR		: restore RCR
+// TDLS_CKALV_PH1	: check alive timer phase1
+// TDLS_CKALV_PH2	: check alive timer phase2
+// TDLS_FREE_STA	: free tdls sta
+u8 tdls_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+#ifdef CONFIG_TDLS
+	_irqL irqL;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct TDLSoption_param *TDLSoption;
+	struct sta_info *ptdls_sta;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+	u8 survey_channel, i, min, option;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	TDLSoption = (struct TDLSoption_param *)pbuf;
+
+	ptdls_sta = rtw_get_stainfo( &(padapter->stapriv), TDLSoption->addr );
+	option = TDLSoption->option;
+
+	if( ptdls_sta == NULL )
+	{
+		if( option != TDLS_RS_RCR )
+			return H2C_REJECTED;
+	}
+
+	//_enter_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+	DBG_871X("[%s] option:%d\n", __FUNCTION__, option);
+		
+	switch(option){
+		case TDLS_WRCR:
+			//As long as TDLS handshake success, we should set RCR_CBSSID_DATA bit to 0
+			//such we can receive all kinds of data frames.
+			rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_WRCR, 0);
+			DBG_871X("TDLS with "MAC_FMT"\n", MAC_ARG(ptdls_sta->hwaddr));
+
+			pmlmeinfo->FW_sta_info[ptdls_sta->mac_id].psta = ptdls_sta;
+			//set TDLS sta rate.
+			set_sta_rate(padapter, ptdls_sta);
+			break;
+		case TDLS_SD_PTI:
+			issue_tdls_peer_traffic_indication(padapter, ptdls_sta);
+			break;
+		case TDLS_CS_OFF:
+			_cancel_timer_ex(&ptdls_sta->base_ch_timer);
+			_cancel_timer_ex(&ptdls_sta->off_ch_timer);
+			SelectChannel(padapter, pmlmeext->cur_channel);
+			ptdls_sta->tdls_sta_state &= ~(TDLS_CH_SWITCH_ON_STATE | 
+								TDLS_PEER_AT_OFF_STATE | 
+								TDLS_AT_OFF_CH_STATE);
+			DBG_871X("go back to base channel\n ");
+			issue_nulldata(padapter, NULL, 0, 0, 0);
+			break;
+		case TDLS_INIT_CH_SEN:
+			rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_INIT_CH_SEN, 0);
+			pmlmeext->sitesurvey_res.channel_idx = 0;
+			ptdls_sta->option = TDLS_DONE_CH_SEN;
+			rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_DONE_CH_SEN);
+			break;
+		case TDLS_DONE_CH_SEN:
+			survey_channel = pmlmeext->channel_set[pmlmeext->sitesurvey_res.channel_idx].ChannelNum;
+			if(survey_channel){
+				SelectChannel(padapter, survey_channel);
+				ptdlsinfo->cur_channel = survey_channel;
+				pmlmeext->sitesurvey_res.channel_idx++;
+				_set_timer(&ptdls_sta->option_timer, SURVEY_TO);
+			}else{
+				SelectChannel(padapter, pmlmeext->cur_channel);
+
+				rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_DONE_CH_SEN, 0);
+
+				if(ptdlsinfo->ch_sensing==1){
+					ptdlsinfo->ch_sensing=0;
+					ptdlsinfo->cur_channel=1;
+					min=ptdlsinfo->collect_pkt_num[0];
+					for(i=1; i<MAX_CHANNEL_NUM-1; i++){
+						if(min > ptdlsinfo->collect_pkt_num[i]){
+							ptdlsinfo->cur_channel=i+1;
+							min=ptdlsinfo->collect_pkt_num[i];
+						}
+						ptdlsinfo->collect_pkt_num[i]=0;
+					}
+					ptdlsinfo->collect_pkt_num[0]=0;
+					ptdlsinfo->candidate_ch=ptdlsinfo->cur_channel;
+					DBG_871X("TDLS channel sensing done, candidate channel: %02x\n", ptdlsinfo->candidate_ch);
+					ptdlsinfo->cur_channel=0;
+
+				}
+
+				if(ptdls_sta->tdls_sta_state & TDLS_PEER_SLEEP_STATE){
+					ptdls_sta->tdls_sta_state |= TDLS_APSD_CHSW_STATE;
+				}else{
+					//send null data with pwrbit==1 before send ch_switching_req to peer STA.
+					issue_nulldata(padapter, NULL, 1, 0, 0);
+
+					ptdls_sta->tdls_sta_state |= TDLS_CH_SW_INITIATOR_STATE;
+
+					issue_tdls_ch_switch_req(padapter, ptdls_sta->hwaddr);
+					DBG_871X("issue tdls ch switch req\n");
+				}
+			}
+			break;
+		case TDLS_OFF_CH:
+			issue_nulldata(padapter, NULL, 1, 0, 0);
+			SelectChannel(padapter, ptdls_sta->off_ch);
+
+			DBG_871X("change channel to tar ch:%02x\n", ptdls_sta->off_ch);
+			ptdls_sta->tdls_sta_state |= TDLS_AT_OFF_CH_STATE;
+			ptdls_sta->tdls_sta_state &= ~(TDLS_PEER_AT_OFF_STATE);
+			_set_timer(&ptdls_sta->option_timer, (u32)ptdls_sta->ch_switch_time);
+			break;
+		case TDLS_BASE_CH:
+			_cancel_timer_ex(&ptdls_sta->base_ch_timer);
+			_cancel_timer_ex(&ptdls_sta->off_ch_timer);
+			SelectChannel(padapter, pmlmeext->cur_channel);
+			ptdls_sta->tdls_sta_state &= ~(TDLS_CH_SWITCH_ON_STATE | 
+								TDLS_PEER_AT_OFF_STATE | 
+								TDLS_AT_OFF_CH_STATE);
+			DBG_871X("go back to base channel\n ");
+			issue_nulldata(padapter, NULL, 0, 0, 0);
+			_set_timer(&ptdls_sta->option_timer, (u32)ptdls_sta->ch_switch_time);
+			break;
+		case TDLS_P_OFF_CH:
+			SelectChannel(padapter, pmlmeext->cur_channel);
+			issue_nulldata(padapter, NULL, 0, 0, 0);
+			DBG_871X("change channel to base ch:%02x\n", pmlmeext->cur_channel);
+			ptdls_sta->tdls_sta_state &= ~(TDLS_PEER_AT_OFF_STATE| TDLS_AT_OFF_CH_STATE);
+			_set_timer(&ptdls_sta->off_ch_timer, TDLS_STAY_TIME);
+			break;
+		case TDLS_P_BASE_CH:
+			issue_nulldata(ptdls_sta->padapter, NULL, 1, 0, 0);
+			SelectChannel(padapter, ptdls_sta->off_ch);
+			DBG_871X("change channel to off ch:%02x\n", ptdls_sta->off_ch);
+			ptdls_sta->tdls_sta_state |= TDLS_AT_OFF_CH_STATE;
+			if((ptdls_sta->tdls_sta_state & TDLS_PEER_AT_OFF_STATE) != TDLS_PEER_AT_OFF_STATE){
+				issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 0);
+			}
+			_set_timer(&ptdls_sta->base_ch_timer, TDLS_STAY_TIME);	
+			break;
+		case TDLS_RS_RCR:
+			rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_RS_RCR, 0);
+			DBG_871X("wirte REG_RCR, set bit6 on\n");
+			break;
+		case TDLS_CKALV_PH1:
+			_set_timer(&ptdls_sta->alive_timer2, TDLS_ALIVE_TIMER_PH2);
+			break;
+		case TDLS_CKALV_PH2:
+			_set_timer(&ptdls_sta->alive_timer1, TDLS_ALIVE_TIMER_PH1);
+			break;
+		case TDLS_FREE_STA:
+			free_tdls_sta(padapter, ptdls_sta);
+			break;
+			
+	}
+
+	//_exit_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+
+	return H2C_SUCCESS;
+#else
+	return H2C_REJECTED;
+#endif //CONFIG_TDLS
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c
new file mode 100755
index 0000000000000..9af42cdc980a8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c
@@ -0,0 +1,1324 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MP_C_
+
+#include <drv_types.h>
+
+#ifdef PLATFORM_FREEBSD
+#include <sys/unistd.h>		/* for RFHIGHPID */
+#endif
+
+#ifdef CONFIG_RTL8712
+#include <rtw_mp_phy_regdef.h>
+#endif
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+#ifdef CONFIG_RTL8723A
+#include <rtl8723a_hal.h>
+#endif
+
+
+#ifdef CONFIG_MP_INCLUDED
+
+u32 read_macreg(_adapter *padapter, u32 addr, u32 sz)
+{
+	u32 val = 0;
+
+	switch(sz)
+	{
+		case 1:
+			val = rtw_read8(padapter, addr);
+			break;
+		case 2:
+			val = rtw_read16(padapter, addr);
+			break;
+		case 4:
+			val = rtw_read32(padapter, addr);
+			break;
+		default:
+			val = 0xffffffff;
+			break;
+	}
+
+	return val;
+	
+}
+
+void write_macreg(_adapter *padapter, u32 addr, u32 val, u32 sz)
+{
+	switch(sz)
+	{
+		case 1:
+			rtw_write8(padapter, addr, (u8)val);
+			break;
+		case 2:
+			rtw_write16(padapter, addr, (u16)val);
+			break;
+		case 4:
+			rtw_write32(padapter, addr, val);
+			break;
+		default:
+			break;
+	}
+
+}
+
+u32 read_bbreg(_adapter *padapter, u32 addr, u32 bitmask)
+{
+	return rtw_hal_read_bbreg(padapter, addr, bitmask);
+}
+
+void write_bbreg(_adapter *padapter, u32 addr, u32 bitmask, u32 val)
+{
+	rtw_hal_write_bbreg(padapter, addr, bitmask, val);
+}
+
+u32 _read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask)
+{
+	return rtw_hal_read_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bitmask);
+}
+
+void _write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask, u32 val)
+{
+	rtw_hal_write_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bitmask, val);
+}
+
+u32 read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr)
+{
+	return _read_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bRFRegOffsetMask);
+}
+
+void write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 val)
+{
+	_write_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bRFRegOffsetMask, val);
+}
+
+static void _init_mp_priv_(struct mp_priv *pmp_priv)
+{
+	WLAN_BSSID_EX *pnetwork;
+
+	_rtw_memset(pmp_priv, 0, sizeof(struct mp_priv));
+
+	pmp_priv->mode = MP_OFF;
+
+	pmp_priv->channel = 1;
+	pmp_priv->bandwidth = HT_CHANNEL_WIDTH_20;
+	pmp_priv->prime_channel_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	pmp_priv->rateidx = MPT_RATE_1M;
+	pmp_priv->txpoweridx = 0x2A;
+
+	pmp_priv->antenna_tx = ANTENNA_A;
+	pmp_priv->antenna_rx = ANTENNA_AB;
+
+	pmp_priv->check_mp_pkt = 0;
+
+	pmp_priv->tx_pktcount = 0;
+
+	pmp_priv->rx_pktcount = 0;
+	pmp_priv->rx_crcerrpktcount = 0;
+
+	pmp_priv->network_macaddr[0] = 0x00;
+	pmp_priv->network_macaddr[1] = 0xE0;
+	pmp_priv->network_macaddr[2] = 0x4C;
+	pmp_priv->network_macaddr[3] = 0x87;
+	pmp_priv->network_macaddr[4] = 0x66;
+	pmp_priv->network_macaddr[5] = 0x55;
+
+	pnetwork = &pmp_priv->mp_network.network;
+	_rtw_memcpy(pnetwork->MacAddress, pmp_priv->network_macaddr, ETH_ALEN);
+
+	pnetwork->Ssid.SsidLength = 8;
+	_rtw_memcpy(pnetwork->Ssid.Ssid, "mp_871x", pnetwork->Ssid.SsidLength);
+}
+
+#ifdef PLATFORM_WINDOWS
+/*
+void mp_wi_callback(
+	IN NDIS_WORK_ITEM*	pwk_item,
+	IN PVOID			cntx
+	)
+{
+	_adapter* padapter =(_adapter *)cntx;
+	struct mp_priv *pmppriv=&padapter->mppriv;
+	struct mp_wi_cntx	*pmp_wi_cntx=&pmppriv->wi_cntx;
+
+	// Execute specified action.
+	if(pmp_wi_cntx->curractfunc != NULL)
+	{
+		LARGE_INTEGER	cur_time;
+		ULONGLONG start_time, end_time;
+		NdisGetCurrentSystemTime(&cur_time);	// driver version
+		start_time = cur_time.QuadPart/10; // The return value is in microsecond
+
+		pmp_wi_cntx->curractfunc(padapter);
+
+		NdisGetCurrentSystemTime(&cur_time);	// driver version
+		end_time = cur_time.QuadPart/10; // The return value is in microsecond
+
+		RT_TRACE(_module_mp_, _drv_info_,
+			 ("WorkItemActType: %d, time spent: %I64d us\n",
+			  pmp_wi_cntx->param.act_type, (end_time-start_time)));
+	}
+
+	NdisAcquireSpinLock(&(pmp_wi_cntx->mp_wi_lock));
+	pmp_wi_cntx->bmp_wi_progress= _FALSE;
+	NdisReleaseSpinLock(&(pmp_wi_cntx->mp_wi_lock));
+
+	if (pmp_wi_cntx->bmpdrv_unload)
+	{
+		NdisSetEvent(&(pmp_wi_cntx->mp_wi_evt));
+	}
+
+}
+*/
+
+static int init_mp_priv_by_os(struct mp_priv *pmp_priv)
+{
+	struct mp_wi_cntx *pmp_wi_cntx;
+
+	if (pmp_priv == NULL) return _FAIL;
+
+	pmp_priv->rx_testcnt = 0;
+	pmp_priv->rx_testcnt1 = 0;
+	pmp_priv->rx_testcnt2 = 0;
+
+	pmp_priv->tx_testcnt = 0;
+	pmp_priv->tx_testcnt1 = 0;
+
+	pmp_wi_cntx = &pmp_priv->wi_cntx
+	pmp_wi_cntx->bmpdrv_unload = _FALSE;
+	pmp_wi_cntx->bmp_wi_progress = _FALSE;
+	pmp_wi_cntx->curractfunc = NULL;
+
+	return _SUCCESS;
+}
+#endif
+
+#ifdef PLATFORM_LINUX
+static int init_mp_priv_by_os(struct mp_priv *pmp_priv)
+{
+	int i, res;
+	struct mp_xmit_frame *pmp_xmitframe;
+
+	if (pmp_priv == NULL) return _FAIL;
+
+	_rtw_init_queue(&pmp_priv->free_mp_xmitqueue);
+
+	pmp_priv->pallocated_mp_xmitframe_buf = NULL;
+	pmp_priv->pallocated_mp_xmitframe_buf = rtw_zmalloc(NR_MP_XMITFRAME * sizeof(struct mp_xmit_frame) + 4);
+	if (pmp_priv->pallocated_mp_xmitframe_buf == NULL) {
+		res = _FAIL;
+		goto _exit_init_mp_priv;
+	}
+
+	pmp_priv->pmp_xmtframe_buf = pmp_priv->pallocated_mp_xmitframe_buf + 4 - ((uint) (pmp_priv->pallocated_mp_xmitframe_buf) & 3);
+
+	pmp_xmitframe = (struct mp_xmit_frame*)pmp_priv->pmp_xmtframe_buf;
+
+	for (i = 0; i < NR_MP_XMITFRAME; i++)
+	{
+		_rtw_init_listhead(&pmp_xmitframe->list);
+		rtw_list_insert_tail(&pmp_xmitframe->list, &pmp_priv->free_mp_xmitqueue.queue);
+
+		pmp_xmitframe->pkt = NULL;
+		pmp_xmitframe->frame_tag = MP_FRAMETAG;
+		pmp_xmitframe->padapter = pmp_priv->papdater;
+
+		pmp_xmitframe++;
+	}
+
+	pmp_priv->free_mp_xmitframe_cnt = NR_MP_XMITFRAME;
+
+	res = _SUCCESS;
+
+_exit_init_mp_priv:
+
+	return res;
+}
+#endif
+
+static void mp_init_xmit_attrib(struct mp_tx *pmptx, PADAPTER padapter)
+{
+	struct pkt_attrib *pattrib;
+	struct tx_desc *desc;
+
+	// init xmitframe attribute
+	pattrib = &pmptx->attrib;
+	_rtw_memset(pattrib, 0, sizeof(struct pkt_attrib));
+	desc = &pmptx->desc;
+	_rtw_memset(desc, 0, TXDESC_SIZE);
+
+	pattrib->ether_type = 0x8712;
+	//_rtw_memcpy(pattrib->src, padapter->eeprompriv.mac_addr, ETH_ALEN);
+//	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	_rtw_memset(pattrib->dst, 0xFF, ETH_ALEN);
+//	pattrib->pctrl = 0;
+//	pattrib->dhcp_pkt = 0;
+//	pattrib->pktlen = 0;
+	pattrib->ack_policy = 0;
+//	pattrib->pkt_hdrlen = ETH_HLEN;
+	pattrib->hdrlen = WLAN_HDR_A3_LEN;
+	pattrib->subtype = WIFI_DATA;
+	pattrib->priority = 0;
+	pattrib->qsel = pattrib->priority;
+//	do_queue_select(padapter, pattrib);
+	pattrib->nr_frags = 1;
+	pattrib->encrypt = 0;
+	pattrib->bswenc = _FALSE;
+	pattrib->qos_en = _FALSE;
+}
+
+s32 init_mp_priv(PADAPTER padapter)
+{
+	struct mp_priv *pmppriv = &padapter->mppriv;
+
+	_init_mp_priv_(pmppriv);
+	pmppriv->papdater = padapter;
+
+	pmppriv->tx.stop = 1;
+	mp_init_xmit_attrib(&pmppriv->tx, padapter);
+
+	switch (padapter->registrypriv.rf_config) {
+		case RF_1T1R:
+			pmppriv->antenna_tx = ANTENNA_A;
+			pmppriv->antenna_rx = ANTENNA_A;
+			break;
+		case RF_1T2R:
+		default:
+			pmppriv->antenna_tx = ANTENNA_A;
+			pmppriv->antenna_rx = ANTENNA_AB;
+			break;
+		case RF_2T2R:
+		case RF_2T2R_GREEN:
+			pmppriv->antenna_tx = ANTENNA_AB;
+			pmppriv->antenna_rx = ANTENNA_AB;
+			break;
+		case RF_2T4R:
+			pmppriv->antenna_tx = ANTENNA_AB;
+			pmppriv->antenna_rx = ANTENNA_ABCD;
+			break;
+	}
+
+	return _SUCCESS;
+}
+
+void free_mp_priv(struct mp_priv *pmp_priv)
+{
+	if (pmp_priv->pallocated_mp_xmitframe_buf) {
+		rtw_mfree(pmp_priv->pallocated_mp_xmitframe_buf, 0);
+		pmp_priv->pallocated_mp_xmitframe_buf = NULL;
+	}
+	pmp_priv->pmp_xmtframe_buf = NULL;
+}
+
+#ifdef CONFIG_RTL8192C
+#define PHY_IQCalibrate(a,b)	rtl8192c_PHY_IQCalibrate(a,b)
+#define PHY_LCCalibrate(a)	rtl8192c_PHY_LCCalibrate(a)
+#define dm_CheckTXPowerTracking(a)	rtl8192c_dm_CheckTXPowerTracking(a)
+#define PHY_SetRFPathSwitch(a,b)	rtl8192c_PHY_SetRFPathSwitch(a,b)
+#endif
+
+#ifdef CONFIG_RTL8192D
+#define PHY_IQCalibrate(a)	rtl8192d_PHY_IQCalibrate(a)
+#define PHY_LCCalibrate(a)	rtl8192d_PHY_LCCalibrate(a)
+#define dm_CheckTXPowerTracking(a)	rtl8192d_dm_CheckTXPowerTracking(a)
+#define PHY_SetRFPathSwitch(a,b)	rtl8192d_PHY_SetRFPathSwitch(a,b)
+#endif
+
+s32
+MPT_InitializeAdapter(
+	IN	PADAPTER			pAdapter,
+	IN	u8				Channel
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	s32		rtStatus = _SUCCESS;
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+	u32		ledsetting;
+
+	//-------------------------------------------------------------------------
+	// HW Initialization for 8190 MPT.
+	//-------------------------------------------------------------------------
+	//-------------------------------------------------------------------------
+	// SW Initialization for 8190 MP.
+	//-------------------------------------------------------------------------
+	pMptCtx->bMptDrvUnload = _FALSE;
+	pMptCtx->bMassProdTest = _FALSE;
+	pMptCtx->bMptIndexEven = _TRUE;	//default gain index is -6.0db
+
+	/* Init mpt event. */
+#if 0 // for Windows
+	NdisInitializeEvent( &(pMptCtx->MptWorkItemEvent) );
+	NdisAllocateSpinLock( &(pMptCtx->MptWorkItemSpinLock) );
+
+	PlatformInitializeWorkItem(
+		Adapter,
+		&(pMptCtx->MptWorkItem),
+		(RT_WORKITEM_CALL_BACK)MPT_WorkItemCallback,
+		(PVOID)Adapter,
+		"MptWorkItem");
+#endif
+	pMptCtx->bMptWorkItemInProgress = _FALSE;
+	pMptCtx->CurrMptAct = NULL;
+	//-------------------------------------------------------------------------
+
+#if 1
+	// Don't accept any packets
+	rtw_write32(pAdapter, REG_RCR, 0);
+#else
+	// Accept CRC error and destination address
+	pHalData->ReceiveConfig |= (RCR_ACRC32|RCR_AAP);
+	rtw_write32(pAdapter, REG_RCR, pHalData->ReceiveConfig);
+#endif
+
+#if 0
+	// If EEPROM or EFUSE is empty,we assign as RF 2T2R for MP.
+	if (pHalData->AutoloadFailFlag == TRUE)
+	{
+		pHalData->RF_Type = RF_2T2R;
+	}
+#endif
+	ledsetting = rtw_read32(pAdapter, REG_LEDCFG0);
+	rtw_write32(pAdapter, REG_LEDCFG0, ledsetting & ~LED0DIS);
+
+#ifdef CONFIG_RTL8192C
+	PHY_IQCalibrate(pAdapter, _FALSE);
+	dm_CheckTXPowerTracking(pAdapter);	//trigger thermal meter
+	PHY_LCCalibrate(pAdapter);
+#endif
+
+#ifdef CONFIG_RTL8192D
+	PHY_IQCalibrate(pAdapter);
+	dm_CheckTXPowerTracking(pAdapter);	//trigger thermal meter
+	PHY_LCCalibrate(pAdapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	PHY_SetRFPathSwitch(pAdapter, 1/*pHalData->bDefaultAntenna*/);	//Wifi default use Main
+#else
+
+#ifdef CONFIG_RTL8192C
+#if 1
+	if (pHalData->BoardType == BOARD_MINICARD)
+		PHY_SetRFPathSwitch(pAdapter, 1/*pHalData->bDefaultAntenna*/); //default use Main
+#else
+	if(pAdapter->HalFunc.GetInterfaceSelectionHandler(pAdapter) == INTF_SEL2_MINICARD )
+		PHY_SetRFPathSwitch(Adapter, pAdapter->MgntInfo.bDefaultAntenna); //default use Main
+#endif
+
+#endif
+
+#endif
+
+	pMptCtx->backup0xc50 = (u1Byte)PHY_QueryBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0);
+	pMptCtx->backup0xc58 = (u1Byte)PHY_QueryBBReg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0);
+	pMptCtx->backup0xc30 = (u1Byte)PHY_QueryBBReg(pAdapter, rOFDM0_RxDetector1, bMaskByte0);
+
+	return	rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	MPT_DeInitAdapter()
+ *
+ * Overview:	Extra DeInitialization for Mass Production Test.
+ *
+ * Input:		PADAPTER	pAdapter
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/08/2007	MHC		Create Version 0.
+ *	05/18/2007	MHC		Add normal driver MPHalt code.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+MPT_DeInitAdapter(
+	IN	PADAPTER	pAdapter
+	)
+{
+	PMPT_CONTEXT		pMptCtx = &pAdapter->mppriv.MptCtx;
+
+	pMptCtx->bMptDrvUnload = _TRUE;
+#if 0 // for Windows
+	PlatformFreeWorkItem( &(pMptCtx->MptWorkItem) );
+
+	while(pMptCtx->bMptWorkItemInProgress)
+	{
+		if(NdisWaitEvent(&(pMptCtx->MptWorkItemEvent), 50))
+		{
+			break;
+		}
+	}
+	NdisFreeSpinLock( &(pMptCtx->MptWorkItemSpinLock) );
+#endif
+}
+
+static u8 mpt_ProStartTest(PADAPTER padapter)
+{
+	PMPT_CONTEXT pMptCtx = &padapter->mppriv.MptCtx;
+
+	pMptCtx->bMassProdTest = _TRUE;
+	pMptCtx->bStartContTx = _FALSE;
+	pMptCtx->bCckContTx = _FALSE;
+	pMptCtx->bOfdmContTx = _FALSE;
+	pMptCtx->bSingleCarrier = _FALSE;
+	pMptCtx->bCarrierSuppression = _FALSE;
+	pMptCtx->bSingleTone = _FALSE;
+
+	return _SUCCESS;
+}
+
+/*
+ * General use
+ */
+s32 SetPowerTracking(PADAPTER padapter, u8 enable)
+{
+
+	Hal_SetPowerTracking( padapter, enable );
+	return 0;
+}
+
+void GetPowerTracking(PADAPTER padapter, u8 *enable)
+{
+	Hal_GetPowerTracking( padapter, enable );
+}
+
+static void disable_dm(PADAPTER padapter)
+{
+#ifndef CONFIG_RTL8723A
+	u8 v8;
+#endif
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	//3 1. disable firmware dynamic mechanism
+	// disable Power Training, Rate Adaptive
+#ifdef CONFIG_RTL8723A
+	SetBcnCtrlReg(padapter, 0, EN_BCN_FUNCTION);
+#else
+	v8 = rtw_read8(padapter, REG_BCN_CTRL);
+	v8 &= ~EN_BCN_FUNCTION;
+	rtw_write8(padapter, REG_BCN_CTRL, v8);
+#endif
+
+	//3 2. disable driver dynamic mechanism
+	// disable Dynamic Initial Gain
+	// disable High Power
+	// disable Power Tracking
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	// enable APK, LCK and IQK but disable power tracking
+	pdmpriv->TxPowerTrackControl = _FALSE;
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_SS, _TRUE);
+}
+
+//This function initializes the DUT to the MP test mode
+s32 mp_start_test(PADAPTER padapter)
+{
+	WLAN_BSSID_EX bssid;
+	struct sta_info *psta;
+	u32 length;
+	u8 val8;
+
+	_irqL irqL;
+	s32 res = _SUCCESS;
+
+	struct mp_priv *pmppriv = &padapter->mppriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
+
+
+	//3 disable dynamic mechanism
+	disable_dm(padapter);
+
+	//3 0. update mp_priv
+#if  defined (CONFIG_RTL8192C)  ||  defined (CONFIG_RTL8192D)
+	if (padapter->registrypriv.rf_config == RF_819X_MAX_TYPE) {
+//		HAL_DATA_TYPE *phal = GET_HAL_DATA(padapter);
+//		switch (phal->rf_type) {
+		switch (GET_RF_TYPE(padapter)) {
+			case RF_1T1R:
+				pmppriv->antenna_tx = ANTENNA_A;
+				pmppriv->antenna_rx = ANTENNA_A;
+				break;
+			case RF_1T2R:
+			default:
+				pmppriv->antenna_tx = ANTENNA_A;
+				pmppriv->antenna_rx = ANTENNA_AB;
+				break;
+			case RF_2T2R:
+			case RF_2T2R_GREEN:
+				pmppriv->antenna_tx = ANTENNA_AB;
+				pmppriv->antenna_rx = ANTENNA_AB;
+				break;
+			case RF_2T4R:
+				pmppriv->antenna_tx = ANTENNA_AB;
+				pmppriv->antenna_rx = ANTENNA_ABCD;
+				break;
+		}
+	}
+#endif
+	mpt_ProStartTest(padapter);
+
+	//3 1. initialize a new WLAN_BSSID_EX
+//	_rtw_memset(&bssid, 0, sizeof(WLAN_BSSID_EX));
+	_rtw_memcpy(bssid.MacAddress, pmppriv->network_macaddr, ETH_ALEN);
+	bssid.Ssid.SsidLength = strlen("mp_pseudo_adhoc");
+	_rtw_memcpy(bssid.Ssid.Ssid, (u8*)"mp_pseudo_adhoc", bssid.Ssid.SsidLength);
+	bssid.InfrastructureMode = Ndis802_11IBSS;
+	bssid.NetworkTypeInUse = Ndis802_11DS;
+	bssid.IELength = 0;
+
+	length = get_WLAN_BSSID_EX_sz(&bssid);
+	if (length % 4)
+		bssid.Length = ((length >> 2) + 1) << 2; //round up to multiple of 4 bytes.
+	else
+		bssid.Length = length;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+		goto end_of_mp_start_test;
+
+	//init mp_start_test status
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		rtw_disassoc_cmd(padapter, 500, _TRUE);
+		rtw_indicate_disconnect(padapter);
+		rtw_free_assoc_resources(padapter, 1);
+	}
+	pmppriv->prev_fw_state = get_fwstate(pmlmepriv);
+	pmlmepriv->fw_state = WIFI_MP_STATE;
+#if 0
+	if (pmppriv->mode == _LOOPBOOK_MODE_) {
+		set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); //append txdesc
+		RT_TRACE(_module_mp_, _drv_notice_, ("+start mp in Lookback mode\n"));
+	} else {
+		RT_TRACE(_module_mp_, _drv_notice_, ("+start mp in normal mode\n"));
+	}
+#endif
+	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+
+	//3 2. create a new psta for mp driver
+	//clear psta in the cur_network, if any
+	psta = rtw_get_stainfo(&padapter->stapriv, tgt_network->network.MacAddress);
+	if (psta) rtw_free_stainfo(padapter, psta);
+
+	psta = rtw_alloc_stainfo(&padapter->stapriv, bssid.MacAddress);
+	if (psta == NULL) {
+		RT_TRACE(_module_mp_, _drv_err_, ("mp_start_test: Can't alloc sta_info!\n"));
+		pmlmepriv->fw_state = pmppriv->prev_fw_state;
+		res = _FAIL;
+		goto end_of_mp_start_test;
+	}
+
+	//3 3. join psudo AdHoc
+	tgt_network->join_res = 1;
+	tgt_network->aid = psta->aid = 1;
+	_rtw_memcpy(&tgt_network->network, &bssid, length);
+
+	rtw_indicate_connect(padapter);
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+end_of_mp_start_test:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (res == _SUCCESS)
+	{
+		// set MSR to WIFI_FW_ADHOC_STATE
+#if  defined (CONFIG_RTL8192C)  ||  defined (CONFIG_RTL8192D)
+		val8 = rtw_read8(padapter, MSR) & 0xFC; // 0x0102
+		val8 |= WIFI_FW_ADHOC_STATE;
+		rtw_write8(padapter, MSR, val8); // Link in ad hoc network
+#endif
+
+#if  !defined (CONFIG_RTL8192C)  &&  !defined (CONFIG_RTL8192D)
+		rtw_write8(padapter, MSR, 1); // Link in ad hoc network
+		rtw_write8(padapter, RCR, 0); // RCR : disable all pkt, 0x10250048
+		rtw_write8(padapter, RCR+2, 0x57); // RCR disable Check BSSID, 0x1025004a
+
+		// disable RX filter map , mgt frames will put in RX FIFO 0
+		rtw_write16(padapter, RXFLTMAP0, 0x0); // 0x10250116
+
+		val8 = rtw_read8(padapter, EE_9346CR); // 0x1025000A
+		if (!(val8 & _9356SEL))//boot from EFUSE
+			efuse_change_max_size(padapter);
+#endif
+	}
+
+	return res;
+}
+//------------------------------------------------------------------------------
+//This function change the DUT from the MP test mode into normal mode
+void mp_stop_test(PADAPTER padapter)
+{
+	struct mp_priv *pmppriv = &padapter->mppriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
+	struct sta_info *psta;
+
+	_irqL irqL;
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _FALSE)
+		goto end_of_mp_stop_test;
+
+	//3 1. disconnect psudo AdHoc
+	rtw_indicate_disconnect(padapter);
+
+	//3 2. clear psta used in mp test mode.
+//	rtw_free_assoc_resources(padapter, 1);
+	psta = rtw_get_stainfo(&padapter->stapriv, tgt_network->network.MacAddress);
+	if (psta) rtw_free_stainfo(padapter, psta);
+
+	//3 3. return to normal state (default:station mode)
+	pmlmepriv->fw_state = pmppriv->prev_fw_state; // WIFI_STATION_STATE;
+
+	//flush the cur_network
+	_rtw_memset(tgt_network, 0, sizeof(struct wlan_network));
+
+	_clr_fwstate_(pmlmepriv, WIFI_MP_STATE);
+
+end_of_mp_stop_test:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+/*---------------------------hal\rtl8192c\MPT_Phy.c---------------------------*/
+#if 0
+//#ifdef CONFIG_USB_HCI
+static VOID mpt_AdjustRFRegByRateByChan92CU(PADAPTER pAdapter, u8 RateIdx, u8 Channel, u8 BandWidthID)
+{
+	u8		eRFPath;
+	u32		rfReg0x26;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+
+	if (RateIdx < MPT_RATE_6M) {	// CCK rate,for 88cu
+		rfReg0x26 = 0xf400;
+	}
+	else if ((RateIdx >= MPT_RATE_6M) && (RateIdx <= MPT_RATE_54M)) {// OFDM rate,for 88cu
+		if ((4 == Channel) || (8 == Channel) || (12 == Channel))
+			rfReg0x26 = 0xf000;
+		else if ((5 == Channel) || (7 == Channel) || (13 == Channel) || (14 == Channel))
+			rfReg0x26 = 0xf400;
+		else
+			rfReg0x26 = 0x4f200;
+	}
+	else if ((RateIdx >= MPT_RATE_MCS0) && (RateIdx <= MPT_RATE_MCS15)) {// MCS 20M ,for 88cu // MCS40M rate,for 88cu
+
+		if (HT_CHANNEL_WIDTH_20 == BandWidthID) {
+			if ((4 == Channel) || (8 == Channel))
+				rfReg0x26 = 0xf000;
+			else if ((5 == Channel) || (7 == Channel) || (13 == Channel) || (14 == Channel))
+				rfReg0x26 = 0xf400;
+			else
+				rfReg0x26 = 0x4f200;
+		}
+		else{
+			if ((4 == Channel) || (8 == Channel))
+				rfReg0x26 = 0xf000;
+			else if ((5 == Channel) || (7 == Channel))
+				rfReg0x26 = 0xf400;
+			else
+				rfReg0x26 = 0x4f200;
+		}
+	}
+
+//	RT_TRACE(COMP_CMD, DBG_LOUD, ("\n mpt_AdjustRFRegByRateByChan92CU():Chan:%d Rate=%d rfReg0x26:0x%08x\n",Channel, RateIdx,rfReg0x26));
+	for (eRFPath = 0; eRFPath < pHalData->NumTotalRFPath; eRFPath++) {
+		write_rfreg(pAdapter, eRFPath, RF_SYN_G2, rfReg0x26);
+	}
+}
+#endif
+/*-----------------------------------------------------------------------------
+ * Function:	mpt_SwitchRfSetting
+ *
+ * Overview:	Change RF Setting when we siwthc channel/rate/BW for MP.
+ *
+ * Input:       IN	PADAPTER				pAdapter
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 01/08/2009	MHC		Suggestion from SD3 Willis for 92S series.
+ * 01/09/2009	MHC		Add CCK modification for 40MHZ. Suggestion from SD3.
+ *
+ *---------------------------------------------------------------------------*/
+static void mpt_SwitchRfSetting(PADAPTER pAdapter)
+{
+	Hal_mpt_SwitchRfSetting(pAdapter);
+    }
+
+/*---------------------------hal\rtl8192c\MPT_Phy.c---------------------------*/
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+static void MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14)
+{
+	Hal_MPT_CCKTxPowerAdjust(Adapter,bInCH14);
+}
+
+static void MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven)
+{
+	Hal_MPT_CCKTxPowerAdjustbyIndex(pAdapter,beven);
+	}
+
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+
+/*
+ * SetChannel
+ * Description
+ *	Use H2C command to change channel,
+ *	not only modify rf register, but also other setting need to be done.
+ */
+void SetChannel(PADAPTER pAdapter)
+{
+	Hal_SetChannel(pAdapter);
+
+}
+
+/*
+ * Notice
+ *	Switch bandwitdth may change center frequency(channel)
+ */
+void SetBandwidth(PADAPTER pAdapter)
+{
+	Hal_SetBandwidth(pAdapter);
+
+}
+
+static void SetCCKTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	Hal_SetCCKTxPower(pAdapter,TxPower);
+}
+
+static void SetOFDMTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	Hal_SetOFDMTxPower(pAdapter,TxPower);
+	}
+
+
+void SetAntenna(PADAPTER pAdapter)
+	{
+	Hal_SetAntenna(pAdapter);
+}
+
+void	SetAntennaPathPower(PADAPTER pAdapter)
+{
+	Hal_SetAntennaPathPower(pAdapter);
+}
+	
+void SetTxPower(PADAPTER pAdapter)
+{
+	Hal_SetTxPower(pAdapter);
+	}
+
+void SetTxAGCOffset(PADAPTER pAdapter, u32 ulTxAGCOffset)
+{
+	u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D,tmpAGC;
+
+	TxAGCOffset_B = (ulTxAGCOffset&0x000000ff);
+	TxAGCOffset_C = ((ulTxAGCOffset&0x0000ff00)>>8);
+	TxAGCOffset_D = ((ulTxAGCOffset&0x00ff0000)>>16);
+
+	tmpAGC = (TxAGCOffset_D<<8 | TxAGCOffset_C<<4 | TxAGCOffset_B);
+	write_bbreg(pAdapter, rFPGA0_TxGainStage,
+			(bXBTxAGC|bXCTxAGC|bXDTxAGC), tmpAGC);
+}
+
+void SetDataRate(PADAPTER pAdapter)
+{
+	Hal_SetDataRate(pAdapter);
+}
+
+#if  !defined (CONFIG_RTL8192C)  &&  !defined (CONFIG_RTL8192D)
+/*------------------------------Define structure----------------------------*/
+typedef struct _R_ANTENNA_SELECT_OFDM {
+	u32	r_tx_antenna:4;
+	u32	r_ant_l:4;
+	u32	r_ant_non_ht:4;
+	u32	r_ant_ht1:4;
+	u32	r_ant_ht2:4;
+	u32	r_ant_ht_s1:4;
+	u32	r_ant_non_ht_s1:4;
+	u32	OFDM_TXSC:2;
+	u32	Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK {
+	u8	r_cckrx_enable_2:2;
+	u8	r_cckrx_enable:2;
+	u8	r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+#endif
+
+s32 SetThermalMeter(PADAPTER pAdapter, u8 target_ther)
+{
+	return Hal_SetThermalMeter( pAdapter, target_ther);
+}
+
+static void TriggerRFThermalMeter(PADAPTER pAdapter)
+{
+	Hal_TriggerRFThermalMeter(pAdapter);
+}
+
+static u8 ReadRFThermalMeter(PADAPTER pAdapter)
+{
+	return Hal_ReadRFThermalMeter(pAdapter);
+}
+
+void GetThermalMeter(PADAPTER pAdapter, u8 *value)
+{
+	Hal_GetThermalMeter(pAdapter,value);
+}
+
+void SetSingleCarrierTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetSingleCarrierTx(pAdapter,bStart);
+}
+
+void SetSingleToneTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetSingleToneTx(pAdapter,bStart);
+}
+
+void SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetCarrierSuppressionTx(pAdapter, bStart);
+}
+
+void SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart)
+		{
+	Hal_SetCCKContinuousTx(pAdapter,bStart);
+		}
+
+void SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart)
+        {
+   Hal_SetOFDMContinuousTx( pAdapter, bStart);
+}/* mpt_StartOfdmContTx */
+
+void SetContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetContinuousTx(pAdapter,bStart);
+}
+
+//------------------------------------------------------------------------------
+static void dump_mpframe(PADAPTER padapter, struct xmit_frame *pmpframe)
+{
+	rtw_hal_mgnt_xmit(padapter, pmpframe);
+}
+
+static struct xmit_frame *alloc_mp_xmitframe(struct xmit_priv *pxmitpriv)
+{
+	struct xmit_frame	*pmpframe;
+	struct xmit_buf	*pxmitbuf;
+
+	if ((pmpframe = rtw_alloc_xmitframe(pxmitpriv)) == NULL)
+	{
+		return NULL;
+	}
+
+	if ((pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv)) == NULL)
+	{
+		rtw_free_xmitframe(pxmitpriv, pmpframe);
+		return NULL;
+	}
+
+	pmpframe->frame_tag = MP_FRAMETAG;
+
+	pmpframe->pxmitbuf = pxmitbuf;
+
+	pmpframe->buf_addr = pxmitbuf->pbuf;
+
+	pxmitbuf->priv_data = pmpframe;
+
+	return pmpframe;
+
+}
+
+static thread_return mp_xmit_packet_thread(thread_context context)
+{
+	struct xmit_frame	*pxmitframe;
+	struct mp_tx		*pmptx;
+	struct mp_priv	*pmp_priv;
+	struct xmit_priv	*pxmitpriv;
+	PADAPTER padapter;
+
+	pmp_priv = (struct mp_priv *)context;
+	pmptx = &pmp_priv->tx;
+	padapter = pmp_priv->papdater;
+	pxmitpriv = &(padapter->xmitpriv);
+
+	thread_enter("RTW_MP_THREAD");
+
+	DBG_871X("%s:pkTx Start\n", __func__);
+	while (1) {
+		pxmitframe = alloc_mp_xmitframe(pxmitpriv);
+		if (pxmitframe == NULL) {
+			if (pmptx->stop ||
+			    padapter->bSurpriseRemoved ||
+			    padapter->bDriverStopped) {
+				goto exit;
+			}
+			else {
+				rtw_msleep_os(1);
+				continue;
+			}
+		}
+
+		_rtw_memcpy((u8 *)(pxmitframe->buf_addr+TXDESC_OFFSET), pmptx->buf, pmptx->write_size);
+		_rtw_memcpy(&(pxmitframe->attrib), &(pmptx->attrib), sizeof(struct pkt_attrib));
+
+		dump_mpframe(padapter, pxmitframe);
+
+		pmptx->sended++;
+		pmp_priv->tx_pktcount++;
+
+		if (pmptx->stop ||
+		    padapter->bSurpriseRemoved ||
+		    padapter->bDriverStopped)
+			goto exit;
+		if ((pmptx->count != 0) &&
+		    (pmptx->count == pmptx->sended))
+			goto exit;
+
+		flush_signals_thread();
+	}
+
+exit:
+	//DBG_871X("%s:pkTx Exit\n", __func__);
+	rtw_mfree(pmptx->pallocated_buf, pmptx->buf_size);
+	pmptx->pallocated_buf = NULL;
+	pmptx->stop = 1;
+
+	thread_exit();
+}
+
+void fill_txdesc_for_mp(PADAPTER padapter, struct tx_desc *ptxdesc)
+{		
+	struct mp_priv *pmp_priv = &padapter->mppriv;
+	_rtw_memcpy(ptxdesc, &(pmp_priv->tx.desc), TXDESC_SIZE);
+}
+
+void SetPacketTx(PADAPTER padapter)
+{
+	u8 *ptr, *pkt_start, *pkt_end;
+	u32 pkt_size;
+	struct tx_desc *desc;
+	struct rtw_ieee80211_hdr *hdr;
+	u8 payload;
+	s32 bmcast;
+	struct pkt_attrib *pattrib;
+	struct mp_priv *pmp_priv;
+
+
+	pmp_priv = &padapter->mppriv;
+	if (pmp_priv->tx.stop) return;
+	pmp_priv->tx.sended = 0;
+	pmp_priv->tx.stop = 0;
+	pmp_priv->tx_pktcount = 0;
+
+	//3 1. update_attrib()
+	pattrib = &pmp_priv->tx.attrib;
+	_rtw_memcpy(pattrib->src, padapter->eeprompriv.mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+	bmcast = IS_MCAST(pattrib->ra);
+	if (bmcast) {
+		pattrib->mac_id = 1;
+		pattrib->psta = rtw_get_bcmc_stainfo(padapter);
+	} else {
+		pattrib->mac_id = 0;
+		pattrib->psta = rtw_get_stainfo(&padapter->stapriv, get_bssid(&padapter->mlmepriv));
+	}
+
+	pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->pktlen;
+
+	//3 2. allocate xmit buffer
+	pkt_size = pattrib->last_txcmdsz;
+
+	if (pmp_priv->tx.pallocated_buf)
+		rtw_mfree(pmp_priv->tx.pallocated_buf, pmp_priv->tx.buf_size);
+	pmp_priv->tx.write_size = pkt_size;
+	pmp_priv->tx.buf_size = pkt_size + XMITBUF_ALIGN_SZ;
+	pmp_priv->tx.pallocated_buf = rtw_zmalloc(pmp_priv->tx.buf_size);
+	if (pmp_priv->tx.pallocated_buf == NULL) {
+		DBG_871X("%s: malloc(%d) fail!!\n", __func__, pmp_priv->tx.buf_size);
+		return;
+	}
+	pmp_priv->tx.buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pmp_priv->tx.pallocated_buf), XMITBUF_ALIGN_SZ);
+	ptr = pmp_priv->tx.buf;
+
+	desc = &(pmp_priv->tx.desc);
+	_rtw_memset(desc, 0, TXDESC_SIZE);
+	pkt_start = ptr;
+	pkt_end = pkt_start + pkt_size;
+
+	//3 3. init TX descriptor
+	// offset 0
+	//desc->txdw0 |= cpu_to_le32(pkt_size & 0x0000FFFF); // packet size
+	//desc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
+	//desc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) & 0x00FF0000); //32 bytes for TX Desc
+	//if (bmcast) desc->txdw0 |= cpu_to_le32(BMC); // broadcast packet
+
+	// offset 4
+	desc->txdw1 |= cpu_to_le32(BK); // don't aggregate(AMPDU)
+	desc->txdw1 |= cpu_to_le32((pattrib->mac_id) & 0x1F); //CAM_ID(MAC_ID)
+	desc->txdw1 |= cpu_to_le32((pattrib->qsel << QSEL_SHT) & 0x00001F00); // Queue Select, TID
+	desc->txdw1 |= cpu_to_le32((pattrib->raid << Rate_ID_SHT) & 0x000F0000); // Rate Adaptive ID
+
+	// offset 8
+	// offset 12
+	//desc->txdw3 |= cpu_to_le32((pattrib->seqnum << SEQ_SHT) & 0xffff0000);
+
+	// offset 16
+	//desc->txdw4 |= cpu_to_le32(QoS);
+	desc->txdw4 |= cpu_to_le32(HW_SEQ_EN);
+	desc->txdw4 |= cpu_to_le32(USERATE);
+	desc->txdw4 |= cpu_to_le32(DISDATAFB);
+
+	if( pmp_priv->preamble ){
+		if (pmp_priv->rateidx <=  MPT_RATE_54M)
+			desc->txdw4 |= cpu_to_le32(DATA_SHORT); // CCK Short Preamble
+	}
+	if (pmp_priv->bandwidth == HT_CHANNEL_WIDTH_40)
+		desc->txdw4 |= cpu_to_le32(DATA_BW);
+
+	// offset 20
+	desc->txdw5 |= cpu_to_le32(pmp_priv->rateidx & 0x0000001F);
+
+	if( pmp_priv->preamble ){
+		if (pmp_priv->rateidx > MPT_RATE_54M)
+			desc->txdw5 |= cpu_to_le32(SGI); // MCS Short Guard Interval
+	}
+	desc->txdw5 |= cpu_to_le32(0x0001FF00); // DATA/RTS Rate Fallback Limit
+
+	//3 4. make wlan header, make_wlanhdr()
+	hdr = (struct rtw_ieee80211_hdr *)pkt_start;
+	SetFrameSubType(&hdr->frame_ctl, pattrib->subtype);
+	_rtw_memcpy(hdr->addr1, pattrib->dst, ETH_ALEN); // DA
+	_rtw_memcpy(hdr->addr2, pattrib->src, ETH_ALEN); // SA
+	_rtw_memcpy(hdr->addr3, get_bssid(&padapter->mlmepriv), ETH_ALEN); // RA, BSSID
+
+	//3 5. make payload
+	ptr = pkt_start + pattrib->hdrlen;
+
+	switch (pmp_priv->tx.payload) {
+		case 0:
+			payload = 0x00;
+			break;
+		case 1:
+			payload = 0x5a;
+			break;
+		case 2:
+			payload = 0xa5;
+			break;
+		case 3:
+			payload = 0xff;
+			break;
+		default:
+			payload = 0x00;
+			break;
+	}
+
+	_rtw_memset(ptr, payload, pkt_end - ptr);
+
+	//3 6. start thread
+#ifdef PLATFORM_LINUX
+	pmp_priv->tx.PktTxThread = kthread_run(mp_xmit_packet_thread, pmp_priv, "RTW_MP_THREAD");
+	if (IS_ERR(pmp_priv->tx.PktTxThread))
+		DBG_871X("Create PktTx Thread Fail !!!!!\n");
+#endif
+#ifdef PLATFORM_FREEBSD
+{
+	struct proc *p;
+	struct thread *td;
+	pmp_priv->tx.PktTxThread = kproc_kthread_add(mp_xmit_packet_thread, pmp_priv,
+					&p, &td, RFHIGHPID, 0, "MPXmitThread", "MPXmitThread");
+
+	if (pmp_priv->tx.PktTxThread < 0)
+		DBG_871X("Create PktTx Thread Fail !!!!!\n");
+}
+#endif
+}
+
+void SetPacketRx(PADAPTER pAdapter, u8 bStartRx)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	if(bStartRx)
+	{
+		pHalData->ReceiveConfig = AAP | APM | AM | AB | APP_ICV | ADF | AMF | HTC_LOC_CTRL | APP_MIC | APP_PHYSTS;
+	
+		pHalData->ReceiveConfig |= ACRC32;
+	
+		rtw_write32(pAdapter, REG_RCR, pHalData->ReceiveConfig);
+
+		// Accept all data frames
+		rtw_write16(pAdapter, REG_RXFLTMAP2, 0xFFFF);
+	}
+	else
+	{
+		rtw_write32(pAdapter, REG_RCR, 0);
+	}
+}
+
+void ResetPhyRxPktCount(PADAPTER pAdapter)
+{
+	u32 i, phyrx_set = 0;
+
+	for (i = 0; i <= 0xF; i++) {
+		phyrx_set = 0;
+		phyrx_set |= _RXERR_RPT_SEL(i);	//select
+		phyrx_set |= RXERR_RPT_RST;	// set counter to zero
+		rtw_write32(pAdapter, REG_RXERR_RPT, phyrx_set);
+	}
+}
+
+static u32 GetPhyRxPktCounts(PADAPTER pAdapter, u32 selbit)
+{
+	//selection
+	u32 phyrx_set = 0, count = 0;
+
+	phyrx_set = _RXERR_RPT_SEL(selbit & 0xF);
+	rtw_write32(pAdapter, REG_RXERR_RPT, phyrx_set);
+
+	//Read packet count
+	count = rtw_read32(pAdapter, REG_RXERR_RPT) & RXERR_COUNTER_MASK;
+
+	return count;
+}
+
+u32 GetPhyRxPktReceived(PADAPTER pAdapter)
+{
+	u32 OFDM_cnt = 0, CCK_cnt = 0, HT_cnt = 0;
+
+	OFDM_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_OFDM_MPDU_OK);
+	CCK_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_CCK_MPDU_OK);
+	HT_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_HT_MPDU_OK);
+
+	return OFDM_cnt + CCK_cnt + HT_cnt;
+}
+
+u32 GetPhyRxPktCRC32Error(PADAPTER pAdapter)
+{
+	u32 OFDM_cnt = 0, CCK_cnt = 0, HT_cnt = 0;
+
+	OFDM_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_OFDM_MPDU_FAIL);
+	CCK_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_CCK_MPDU_FAIL);
+	HT_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_HT_MPDU_FAIL);
+
+	return OFDM_cnt + CCK_cnt + HT_cnt;
+}
+
+//reg 0x808[9:0]: FFT data x
+//reg 0x808[22]:  0  -->  1  to get 1 FFT data y
+//reg 0x8B4[15:0]: FFT data y report
+static u32 GetPSDData(PADAPTER pAdapter, u32 point)
+{
+	int psd_val;
+
+
+	psd_val = rtw_read32(pAdapter, 0x808);
+	psd_val &= 0xFFBFFC00;
+	psd_val |= point;
+
+	rtw_write32(pAdapter, 0x808, psd_val);
+	rtw_mdelay_os(1);
+	psd_val |= 0x00400000;
+
+	rtw_write32(pAdapter, 0x808, psd_val);
+	rtw_mdelay_os(1);
+	psd_val = rtw_read32(pAdapter, 0x8B4);
+
+	psd_val &= 0x0000FFFF;
+
+	return psd_val;
+}
+
+/*
+ * pts	start_point_min		stop_point_max
+ * 128	64			64 + 128 = 192
+ * 256	128			128 + 256 = 384
+ * 512	256			256 + 512 = 768
+ * 1024	512			512 + 1024 = 1536
+ *
+ */
+u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
+{
+	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
+	u32 psd_data=0;
+	
+#ifdef PLATFORM_LINUX
+	if (!netif_running(pAdapter->pnetdev)) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("mp_query_psd: Fail! interface not opened!\n"));
+		return 0;
+	}
+#endif
+
+	if (check_fwstate(&pAdapter->mlmepriv, WIFI_MP_STATE) == _FALSE) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("mp_query_psd: Fail! not in MP mode!\n"));
+		return 0;
+	}
+
+	if (strlen(data) == 0) { //default value
+		psd_pts = 128;
+		psd_start = 64;
+		psd_stop = 128;   
+	} else {
+		sscanf(data, "pts=%d,start=%d,stop=%d", &psd_pts, &psd_start, &psd_stop);
+	}
+
+	_rtw_memset(data, '\0', sizeof(data));
+
+	i = psd_start;
+	while (i < psd_stop)
+	{
+		if (i >= psd_pts) {
+			psd_data = GetPSDData(pAdapter, i-psd_pts);
+		} else {
+			psd_data = GetPSDData(pAdapter, i);
+		}
+		sprintf(data, "%s%x ", data, psd_data);
+		i++;
+	}
+
+	#ifdef CONFIG_LONG_DELAY_ISSUE
+	rtw_msleep_os(100);
+	#else
+	rtw_mdelay_os(100);
+	#endif
+
+	return strlen(data)+1;
+}
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c
new file mode 100755
index 0000000000000..b941e2ce72dbf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c
@@ -0,0 +1,2954 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MP_IOCTL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <mlme_osdep.h>
+
+//#include <rtw_mp.h>
+#include <rtw_mp_ioctl.h>
+
+
+//****************  oid_rtl_seg_81_85   section start ****************
+NDIS_STATUS oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		Adapter->registrypriv.wireless_mode = *(u8*)poid_par_priv->information_buf;
+	} else if (poid_par_priv->type_of_oid == QUERY_OID) {
+		*(u8*)poid_par_priv->information_buf = Adapter->registrypriv.wireless_mode;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		 RT_TRACE(_module_mp_, _drv_info_, ("-query Wireless Mode=%d\n", Adapter->registrypriv.wireless_mode));
+	} else {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_87_80   section start ****************
+NDIS_STATUS oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct bb_reg_param *pbbreg;
+	u16 offset;
+	u32 value;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_write_bb_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
+
+	offset = (u16)(pbbreg->offset) & 0xFFF; //0ffset :0x800~0xfff
+	if (offset < BB_REG_BASE_ADDR) offset |= BB_REG_BASE_ADDR;
+
+	value = pbbreg->value;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_write_bb_reg_hdl: offset=0x%03X value=0x%08X\n",
+		  offset, value));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	write_bbreg(Adapter, offset, 0xFFFFFFFF, value);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct bb_reg_param *pbbreg;
+	u16 offset;
+	u32 value;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_read_bb_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
+
+	offset = (u16)(pbbreg->offset) & 0xFFF; //0ffset :0x800~0xfff
+	if (offset < BB_REG_BASE_ADDR) offset |= BB_REG_BASE_ADDR;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	value = read_bbreg(Adapter, offset, 0xFFFFFFFF);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	pbbreg->value = value;
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_read_bb_reg_hdl: offset=0x%03X value:0x%08X\n",
+		  offset, value));
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct rf_reg_param *pbbreg;
+	u8 path;
+	u8 offset;
+	u32 value;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_write_rf_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
+
+	if (pbbreg->path >= MAX_RF_PATH_NUMS)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	if (pbbreg->offset > 0xFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	if (pbbreg->value > 0xFFFFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	path = (u8)pbbreg->path;
+	offset = (u8)pbbreg->offset;
+	value = pbbreg->value;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_write_rf_reg_hdl: path=%d offset=0x%02X value=0x%05X\n",
+		  path, offset, value));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+ 	write_rfreg(Adapter, path, offset, value);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct rf_reg_param *pbbreg;
+	u8 path;
+	u8 offset;
+	u32 value;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_read_rf_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
+
+	if (pbbreg->path >= MAX_RF_PATH_NUMS)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	if (pbbreg->offset > 0xFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	path = (u8)pbbreg->path;
+	offset = (u8)pbbreg->offset;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	value = read_rfreg(Adapter, path, offset);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	pbbreg->value = value;
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_read_rf_reg_hdl: path=%d offset=0x%02X value=0x%05X\n",
+		  path, offset, value));
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_87_00   section end****************
+//------------------------------------------------------------------------------
+
+//****************  oid_rtl_seg_81_80_00   section start ****************
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_data_rate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		ratevalue;//4
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("+oid_rt_pro_set_data_rate_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	ratevalue = *((u32*)poid_par_priv->information_buf);//4
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_set_data_rate_hdl: data rate idx=%d\n", ratevalue));
+	if (ratevalue >= MPT_RATE_LAST)
+		return NDIS_STATUS_INVALID_DATA;
+
+	Adapter->mppriv.rateidx = ratevalue;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetDataRate(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		mode;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_start_test_hdl\n"));
+
+	if (Adapter->registrypriv.mp_mode == 0)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	//IQCalibrateBcut(Adapter);
+
+	mode = *((u32*)poid_par_priv->information_buf);
+	Adapter->mppriv.mode = mode;// 1 for loopback
+
+	if (mp_start_test(Adapter) == _FAIL) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		goto exit;
+	}
+
+exit:
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-oid_rt_pro_start_test_hdl: mp_mode=%d\n", Adapter->mppriv.mode));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Set OID_RT_PRO_STOP_TEST\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	mp_stop_test(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-Set OID_RT_PRO_STOP_TEST\n"));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		Channel;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_channel_direct_call_hdl\n"));
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == QUERY_OID) {
+		*((u32*)poid_par_priv->information_buf) = Adapter->mppriv.channel;
+		return NDIS_STATUS_SUCCESS;
+	}
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	Channel = *((u32*)poid_par_priv->information_buf);
+	RT_TRACE(_module_mp_, _drv_notice_, ("oid_rt_pro_set_channel_direct_call_hdl: Channel=%d\n", Channel));
+	if (Channel > 14)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	Adapter->mppriv.channel = Channel;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetChannel(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u16		bandwidth;
+	u16		channel_offset;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("+oid_rt_set_bandwidth_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	bandwidth = *((u32*)poid_par_priv->information_buf);//4
+	channel_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	if (bandwidth != HT_CHANNEL_WIDTH_40)
+		bandwidth = HT_CHANNEL_WIDTH_20;
+	padapter->mppriv.bandwidth = (u8)bandwidth;
+	padapter->mppriv.prime_channel_offset = (u8)channel_offset;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetBandwidth(padapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_set_bandwidth_hdl: bandwidth=%d channel_offset=%d\n",
+		  bandwidth, channel_offset));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		antenna;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_antenna_bb_hdl\n"));
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == SET_OID)
+	{
+		antenna = *(u32*)poid_par_priv->information_buf;
+
+		Adapter->mppriv.antenna_tx = (u16)((antenna & 0xFFFF0000) >> 16);
+		Adapter->mppriv.antenna_rx = (u16)(antenna & 0x0000FFFF);
+		RT_TRACE(_module_mp_, _drv_notice_,
+			 ("oid_rt_pro_set_antenna_bb_hdl: tx_ant=0x%04x rx_ant=0x%04x\n",
+			  Adapter->mppriv.antenna_tx, Adapter->mppriv.antenna_rx));
+
+		_irqlevel_changed_(&oldirql, LOWER);
+		SetAntenna(Adapter);
+		_irqlevel_changed_(&oldirql, RAISE);
+	} else {
+		antenna = (Adapter->mppriv.antenna_tx << 16)|Adapter->mppriv.antenna_rx;
+		*(u32*)poid_par_priv->information_buf = antenna;
+	}
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		tx_pwr_idx;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_pro_set_tx_power_control_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	tx_pwr_idx = *((u32*)poid_par_priv->information_buf);
+	if (tx_pwr_idx > MAX_TX_PWR_INDEX_N_MODE)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	Adapter->mppriv.txpoweridx = (u8)tx_pwr_idx;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_set_tx_power_control_hdl: idx=0x%2x\n",
+		  Adapter->mppriv.txpoweridx));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetTxPower(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+//****************  oid_rtl_seg_81_80_20   section start ****************
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid !=QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		*(ULONG*)poid_par_priv->information_buf =  Adapter->mppriv.tx_pktcount;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	RT_TRACE(_module_mp_, _drv_alert_, ("===> oid_rt_pro_query_rx_packet_received_hdl.\n"));
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		*(ULONG*)poid_par_priv->information_buf =  Adapter->mppriv.rx_pktcount;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		RT_TRACE(_module_mp_, _drv_alert_, ("recv_ok:%d \n",Adapter->mppriv.rx_pktcount));
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	RT_TRACE(_module_mp_, _drv_alert_, ("===> oid_rt_pro_query_rx_packet_crc32_error_hdl.\n"));
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		*(ULONG*)poid_par_priv->information_buf =  Adapter->mppriv.rx_crcerrpktcount;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		RT_TRACE(_module_mp_, _drv_alert_, ("recv_err:%d \n",Adapter->mppriv.rx_crcerrpktcount));
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+
+NDIS_STATUS oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	RT_TRACE(_module_mp_, _drv_alert_, ("===> oid_rt_pro_reset_tx_packet_sent_hdl.\n"));
+	Adapter->mppriv.tx_pktcount = 0;
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		Adapter->mppriv.rx_pktcount = 0;
+		Adapter->mppriv.rx_crcerrpktcount = 0;
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	ResetPhyRxPktCount(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_get_phy_rx_packet_received_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len != sizeof(ULONG))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	*(ULONG*)poid_par_priv->information_buf = GetPhyRxPktReceived(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-oid_rt_get_phy_rx_packet_received_hdl: recv_ok=%d\n", *(ULONG*)poid_par_priv->information_buf));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_get_phy_rx_packet_crc32_error_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+
+	if (poid_par_priv->information_buf_len != sizeof(ULONG))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	*(ULONG*)poid_par_priv->information_buf = GetPhyRxPktCRC32Error(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_get_phy_rx_packet_crc32_error_hdl: recv_err=%d\n", *(ULONG*)poid_par_priv->information_buf));
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_80_20   section end ****************
+NDIS_STATUS oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_continuous_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetContinuousTx(Adapter,(u8)bStartTest);
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &Adapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(Adapter);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_alert_, ("+oid_rt_pro_set_single_carrier_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetSingleCarrierTx(Adapter, (u8)bStartTest);
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &Adapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(Adapter);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_carrier_suppression_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetCarrierSuppressionTx(Adapter, (u8)bStartTest);
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &Adapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(Adapter);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32 		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_alert_, ("+oid_rt_pro_set_single_tone_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetSingleToneTx(Adapter,(u8)bStartTest);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_modulation_hdl(struct oid_par_priv* poid_par_priv)
+{
+	return 0;
+}
+
+NDIS_STATUS oid_rt_pro_trigger_gpio_hdl(struct oid_par_priv *poid_par_priv)
+{
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	rtw_hal_set_hwreg(Adapter, HW_VAR_TRIGGER_GPIO_0, 0);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_80_00   section end ****************
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro8711_join_bss_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	PNDIS_802_11_SSID pssid;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = (u32)sizeof(NDIS_802_11_SSID);
+	*poid_par_priv->bytes_rw = 0;
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pssid = (PNDIS_802_11_SSID)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (mp_start_joinbss(Adapter, pssid) == _FAIL)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = sizeof(NDIS_802_11_SSID);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pRW_Reg 	RegRWStruct;
+	u32		offset, width;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("+oid_rt_pro_read_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	RegRWStruct = (pRW_Reg)poid_par_priv->information_buf;
+	offset = RegRWStruct->offset;
+	width = RegRWStruct->width;
+
+	if (offset > 0xFFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	switch (width) {
+		case 1:
+			RegRWStruct->value = rtw_read8(Adapter, offset);
+			break;
+		case 2:
+			RegRWStruct->value = rtw_read16(Adapter, offset);
+			break;
+		default:
+			width = 4;
+			RegRWStruct->value = rtw_read32(Adapter, offset);
+			break;
+	}
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_read_register_hdl: offset:0x%04X value:0x%X\n",
+		  offset, RegRWStruct->value));
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = width;
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pRW_Reg 	RegRWStruct;
+	u32		offset, width, value;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("+oid_rt_pro_write_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	RegRWStruct = (pRW_Reg)poid_par_priv->information_buf;
+	offset = RegRWStruct->offset;
+	width = RegRWStruct->width;
+	value = RegRWStruct->value;
+
+	if (offset > 0xFFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	switch (RegRWStruct->width)
+	{
+		case 1:
+			if (value > 0xFF) {
+				status = NDIS_STATUS_NOT_ACCEPTED;
+				break;
+			}
+			rtw_write8(padapter, offset, (u8)value);
+			break;
+		case 2:
+			if (value > 0xFFFF) {
+				status = NDIS_STATUS_NOT_ACCEPTED;
+				break;
+			}
+			rtw_write16(padapter, offset, (u16)value);
+			break;
+		case 4:
+			rtw_write32(padapter, offset, value);
+			break;
+		default:
+			status = NDIS_STATUS_NOT_ACCEPTED;
+			break;
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_pro_write_register_hdl: offset=0x%08X width=%d value=0x%X\n",
+		  offset, width, value));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_burst_read_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pBurst_RW_Reg	pBstRwReg;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_burst_read_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pBstRwReg = (pBurst_RW_Reg)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	rtw_read_mem(padapter, pBstRwReg->offset, (u32)pBstRwReg->len, pBstRwReg->Data);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_pro_burst_read_register_hdl\n"));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_burst_write_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pBurst_RW_Reg	pBstRwReg;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_burst_write_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pBstRwReg = (pBurst_RW_Reg)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	rtw_write_mem(padapter, pBstRwReg->offset, (u32)pBstRwReg->len, pBstRwReg->Data);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_pro_burst_write_register_hdl\n"));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_txcmd_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+
+	TX_CMD_Desc	*TxCmd_Info;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+Set OID_RT_PRO_WRITE_TXCMD\n"));
+
+	TxCmd_Info=(TX_CMD_Desc*)poid_par_priv->information_buf;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:Addr=%.8X\n", TxCmd_Info->offset));
+  	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:1.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[0]));
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:2.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[1]));
+	RT_TRACE(_module_mp_, _drv_info_, (("WRITE_TXCMD:3.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[2]));
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:4.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[3]));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	rtw_write32(Adapter, TxCmd_Info->offset + 0, (unsigned int)TxCmd_Info->TxCMD.value[0]);
+	rtw_write32(Adapter, TxCmd_Info->offset + 4, (unsigned int)TxCmd_Info->TxCMD.value[1]);
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-Set OID_RT_PRO_WRITE_TXCMD: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read16_eeprom_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pEEPROM_RWParam pEEPROM;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+Query OID_RT_PRO_READ16_EEPROM\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pEEPROM = (pEEPROM_RWParam)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	pEEPROM->value = eeprom_read16(padapter, (u16)(pEEPROM->offset >> 1));
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_,  _drv_notice_,
+		 ("-Query OID_RT_PRO_READ16_EEPROM: offset=0x%x value=0x%x\n",
+		  pEEPROM->offset, pEEPROM->value));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write16_eeprom_hdl (struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pEEPROM_RWParam pEEPROM;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Set OID_RT_PRO_WRITE16_EEPROM\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pEEPROM = (pEEPROM_RWParam)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	eeprom_write16(padapter, (u16)(pEEPROM->offset >> 1), pEEPROM->value);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro8711_wi_poll_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct mp_wiparam *pwi_param;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct mp_wiparam))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (Adapter->mppriv.workparam.bcompleted == _FALSE)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pwi_param = (struct mp_wiparam *)poid_par_priv->information_buf;
+
+	_rtw_memcpy(pwi_param, &Adapter->mppriv.workparam, sizeof(struct mp_wiparam));
+	Adapter->mppriv.act_in_progress = _FALSE;
+//	RT_TRACE(_module_mp_, _drv_info_, ("rf:%x\n", pwiparam->IoValue));
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro8711_pkt_loss_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro8711_pkt_loss_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(uint)*2) {
+		RT_TRACE(_module_mp_, _drv_err_, ("-oid_rt_pro8711_pkt_loss_hdl: buf_len=%d\n", (int)poid_par_priv->information_buf_len));
+		return NDIS_STATUS_INVALID_LENGTH;
+	}
+
+	if (*(uint*)poid_par_priv->information_buf == 1)//init==1
+		Adapter->mppriv.rx_pktloss = 0;
+
+	*((uint*)poid_par_priv->information_buf+1) = Adapter->mppriv.rx_pktloss;
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_rd_attrib_mem_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+	struct io_queue *pio_queue = (struct io_queue *)Adapter->pio_queue;
+	struct intf_hdl	*pintfhdl = &pio_queue->intf;
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+#ifdef CONFIG_SDIO_HCI
+	void (*_attrib_read)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+#endif
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Query OID_RT_RD_ATTRIB_MEM\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+#ifdef CONFIG_SDIO_HCI
+	_irqlevel_changed_(&oldirql, LOWER);
+{
+	u32 *plmem = (u32*)poid_par_priv->information_buf+2;
+	_attrib_read = pintfhdl->io_ops._attrib_read;
+	_attrib_read(pintfhdl, *((u32*)poid_par_priv->information_buf),
+				*((u32*)poid_par_priv->information_buf+1), (u8*)plmem);
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+}
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_wr_attrib_mem_hdl (struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct io_queue *pio_queue = (struct io_queue *)Adapter->pio_queue;
+	struct intf_hdl	*pintfhdl = &pio_queue->intf;
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+#ifdef CONFIG_SDIO_HCI
+	void (*_attrib_write)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+#endif
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+#ifdef CONFIG_SDIO_HCI
+	_irqlevel_changed_(&oldirql, LOWER);
+{
+	u32 *plmem = (u32*)poid_par_priv->information_buf + 2;
+	_attrib_write = pintfhdl->io_ops._attrib_write;
+	_attrib_write(pintfhdl, *(u32*)poid_par_priv->information_buf,
+				*((u32*)poid_par_priv->information_buf+1), (u8*)plmem);
+}
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS  oid_rt_pro_set_rf_intfs_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+OID_RT_PRO_SET_RF_INTFS\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (rtw_setrfintfs_cmd(Adapter, *(unsigned char*)poid_par_priv->information_buf) == _FAIL)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_poll_rx_status_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_rtw_memcpy(poid_par_priv->information_buf, (unsigned char*)&Adapter->mppriv.rxstat, sizeof(struct recv_stat));
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_cfg_debug_message_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	PCFG_DBG_MSG_STRUCT pdbg_msg;
+
+_func_enter_;
+
+//	RT_TRACE(0xffffffffff,_drv_alert_,("===> oid_rt_pro_cfg_debug_message_hdl.\n"));
+
+#if 0//#ifdef CONFIG_DEBUG_RTL871X
+
+	pdbg_msg = (PCFG_DBG_MSG_STRUCT)(poid_par_priv->information_buf);
+
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		RT_TRACE(0xffffffffff, _drv_alert_,
+			 ("===>Set level :0x%08x, H32:0x%08x L32:0x%08x\n",
+			  pdbg_msg->DebugLevel, pdbg_msg->DebugComponent_H32, pdbg_msg->DebugComponent_L32));
+
+		GlobalDebugLevel = pdbg_msg->DebugLevel;
+		GlobalDebugComponents = (pdbg_msg->DebugComponent_H32 << 32) | pdbg_msg->DebugComponent_L32;
+		RT_TRACE(0xffffffffff, _drv_alert_,
+			 ("===> Set level :0x%08x, component:0x%016x\n",
+			  GlobalDebugLevel, (u32)GlobalDebugComponents));
+	} else {
+		pdbg_msg->DebugLevel = GlobalDebugLevel;
+		pdbg_msg->DebugComponent_H32 = (u32)(GlobalDebugComponents >> 32);
+		pdbg_msg->DebugComponent_L32 = (u32)GlobalDebugComponents;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+		RT_TRACE(0xffffffffff, _drv_alert_,
+			 ("===>Query level:0x%08x H32:0x%08x L32:0x%08x\n",
+			  (u32)pdbg_msg->DebugLevel, (u32)pdbg_msg->DebugComponent_H32, (u32)pdbg_msg->DebugComponent_L32));
+	}
+
+#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_data_rate_ex_hdl(struct oid_par_priv *poid_par_priv)
+{
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+OID_RT_PRO_SET_DATA_RATE_EX\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (rtw_setdatarate_cmd(Adapter, poid_par_priv->information_buf) !=_SUCCESS)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_thermal_meter_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	u8 thermal = 0;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_get_thermal_meter_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	GetThermalMeter(Adapter, &thermal);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*(u32*)poid_par_priv->information_buf = (u32)thermal;
+	*poid_par_priv->bytes_rw = sizeof(u32);
+
+_func_exit_;
+
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_tssi_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_read_tssi_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (Adapter->mppriv.act_in_progress == _TRUE)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	//init workparam
+	Adapter->mppriv.act_in_progress = _TRUE;
+	Adapter->mppriv.workparam.bcompleted = _FALSE;
+	Adapter->mppriv.workparam.act_type = MPT_READ_TSSI;
+	Adapter->mppriv.workparam.io_offset = 0;
+	Adapter->mppriv.workparam.io_value = 0xFFFFFFFF;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (!rtw_gettssi_cmd(Adapter,0, (u8*)&Adapter->mppriv.workparam.io_value))
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_power_tracking_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+
+_func_enter_;
+
+//	if (poid_par_priv->type_of_oid != SET_OID)
+//		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		u8 enable;
+
+		enable = *(u8*)poid_par_priv->information_buf;
+		RT_TRACE(_module_mp_, _drv_notice_,
+			 ("+oid_rt_pro_set_power_tracking_hdl: enable=%d\n", enable));
+
+		SetPowerTracking(Adapter, enable);
+	} else {
+		GetPowerTracking(Adapter, (u8*)poid_par_priv->information_buf);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_basic_rate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32 ratevalue;
+	u8 datarates[NumRates];
+	int i;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+OID_RT_PRO_SET_BASIC_RATE\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+#if 0
+	ratevalue = *((u32*)poid_par_priv->information_buf);
+
+	for (i = 0; i < NumRates; i++) {
+		if (ratevalue == mpdatarate[i])
+			datarates[i] = mpdatarate[i];
+		else
+			datarates[i] = 0xff;
+		RT_TRACE(_module_rtl871x_ioctl_c_, _drv_info_, ("basicrate_inx=%d\n", datarates[i]));
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (rtw_setbasicrate_cmd(padapter, datarates) != _SUCCESS)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-OID_RT_PRO_SET_BASIC_RATE: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_qry_pwrstate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < 8)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	*poid_par_priv->bytes_rw = 8;
+	_rtw_memcpy(poid_par_priv->information_buf, &(Adapter->pwrctrlpriv.pwr_mode), 8);
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_qry_pwrstate_hdl: pwr_mode=%d smart_ps=%d\n",
+		  Adapter->pwrctrlpriv.pwr_mode, Adapter->pwrctrlpriv.smart_ps));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_pwrstate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	uint pwr_mode, smart_ps;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Set OID_RT_PRO_SET_PWRSTATE\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_rw = 0;
+	*poid_par_priv->bytes_needed = 8;
+
+	if (poid_par_priv->information_buf_len < 8)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pwr_mode = *(uint *)(poid_par_priv->information_buf);
+	smart_ps = *(uint *)((int)poid_par_priv->information_buf + 4);
+
+	*poid_par_priv->bytes_rw = 8;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_h2c_set_rate_table_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct setratable_parm *prate_table;
+	u8		res;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed  = sizeof(struct setratable_parm);
+	if (poid_par_priv->information_buf_len < sizeof(struct setratable_parm))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	prate_table = (struct setratable_parm*)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	res = rtw_setrttbl_cmd(Adapter, prate_table);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	if (res == _FAIL)
+		status = NDIS_STATUS_FAILURE;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_h2c_get_rate_table_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	#if 0
+			struct mp_wi_cntx *pmp_wi_cntx=&(Adapter->mppriv.wi_cntx);
+			u8 res=_SUCCESS;
+			DEBUG_INFO(("===> Set OID_RT_PRO_H2C_GET_RATE_TABLE.\n"));
+
+			if(pmp_wi_cntx->bmp_wi_progress ==_TRUE){
+				DEBUG_ERR(("\n mp workitem is progressing, not allow to set another workitem right now!!!\n"));
+				Status = NDIS_STATUS_NOT_ACCEPTED;
+				break;
+			}
+			else{
+				pmp_wi_cntx->bmp_wi_progress=_TRUE;
+				pmp_wi_cntx->param.bcompleted=_FALSE;
+				pmp_wi_cntx->param.act_type=MPT_GET_RATE_TABLE;
+				pmp_wi_cntx->param.io_offset=0x0;
+				pmp_wi_cntx->param.bytes_cnt=sizeof(struct getratable_rsp);
+				pmp_wi_cntx->param.io_value=0xffffffff;
+
+				res=rtw_getrttbl_cmd(Adapter,(struct getratable_rsp *)pmp_wi_cntx->param.data);
+				*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+				if(res != _SUCCESS)
+				{
+					Status = NDIS_STATUS_NOT_ACCEPTED;
+				}
+			}
+			DEBUG_INFO(("\n <=== Set OID_RT_PRO_H2C_GET_RATE_TABLE.\n"));
+	#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+//****************  oid_rtl_seg_87_12_00   section start ****************
+NDIS_STATUS oid_rt_pro_encryption_ctrl_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct security_priv *psecuritypriv = &Adapter->securitypriv;
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	ENCRY_CTRL_STATE encry_mode;
+
+
+	*poid_par_priv->bytes_needed = sizeof(u8);
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == SET_OID)
+	{
+		encry_mode = *((u8*)poid_par_priv->information_buf);
+		switch (encry_mode)
+		{
+			case HW_CONTROL:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_FALSE;
+				Adapter->registrypriv.software_encrypt=_FALSE;
+				#else
+				psecuritypriv->sw_decrypt = _FALSE;
+				psecuritypriv->sw_encrypt = _FALSE;
+				#endif
+				break;
+			case SW_CONTROL:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_TRUE;
+				Adapter->registrypriv.software_encrypt=_TRUE;
+				#else
+				psecuritypriv->sw_decrypt = _TRUE;
+				psecuritypriv->sw_encrypt = _TRUE;
+				#endif
+				break;
+			case HW_ENCRY_SW_DECRY:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_TRUE;
+				Adapter->registrypriv.software_encrypt=_FALSE;
+				#else
+				psecuritypriv->sw_decrypt = _TRUE;
+				psecuritypriv->sw_encrypt = _FALSE;
+				#endif
+				break;
+			case SW_ENCRY_HW_DECRY:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_FALSE;
+				Adapter->registrypriv.software_encrypt=_TRUE;
+				#else
+				psecuritypriv->sw_decrypt = _FALSE;
+				psecuritypriv->sw_encrypt = _TRUE;
+				#endif
+				break;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_c_, _drv_notice_,
+			 ("-oid_rt_pro_encryption_ctrl_hdl: SET encry_mode=0x%x sw_encrypt=0x%x sw_decrypt=0x%x\n",
+			  encry_mode, psecuritypriv->sw_encrypt, psecuritypriv->sw_decrypt));
+	}
+	else {
+		#if 0
+		if (Adapter->registrypriv.software_encrypt == _FALSE) {
+			if (Adapter->registrypriv.software_decrypt == _FALSE)
+				encry_mode = HW_CONTROL;
+			else
+				encry_mode = HW_ENCRY_SW_DECRY;
+		}
+		else {
+			if (Adapter->registrypriv.software_decrypt == _FALSE)
+				encry_mode = SW_ENCRY_HW_DECRY;
+			else
+				encry_mode = SW_CONTROL;
+		}
+		#else
+
+		if ((psecuritypriv->sw_encrypt == _FALSE) && (psecuritypriv->sw_decrypt == _FALSE))
+			encry_mode = HW_CONTROL;
+		else if ((psecuritypriv->sw_encrypt == _FALSE) && (psecuritypriv->sw_decrypt == _TRUE))
+			encry_mode = HW_ENCRY_SW_DECRY;
+		else if ((psecuritypriv->sw_encrypt == _TRUE) && (psecuritypriv->sw_decrypt == _FALSE))
+			encry_mode = SW_ENCRY_HW_DECRY;
+		else if ((psecuritypriv->sw_encrypt == _TRUE) && (psecuritypriv->sw_decrypt == _TRUE))
+			encry_mode = SW_CONTROL;
+
+		#endif
+
+		*(u8*)poid_par_priv->information_buf =  encry_mode;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+		RT_TRACE(_module_mp_, _drv_notice_,
+			 ("-oid_rt_pro_encryption_ctrl_hdl: QUERY encry_mode=0x%x\n",
+			  encry_mode));
+	}
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_add_sta_info_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct sta_info *psta = NULL;
+	UCHAR 		*macaddr;
+
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = ETH_ALEN;
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	macaddr = (UCHAR *) poid_par_priv->information_buf ;
+
+	RT_TRACE(_module_rtl871x_ioctl_c_,_drv_notice_,
+		 ("OID_RT_PRO_ADD_STA_INFO: addr="MAC_FMT"\n", MAC_ARG(macaddr) ));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	psta = rtw_get_stainfo(&Adapter->stapriv, macaddr);
+
+	if (psta == NULL) { // the sta have been in sta_info_queue => do nothing
+		psta = rtw_alloc_stainfo(&Adapter->stapriv, macaddr);
+
+		if (psta == NULL) {
+			RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_,("Can't alloc sta_info when OID_RT_PRO_ADD_STA_INFO\n"));
+			status = NDIS_STATUS_FAILURE;
+		}
+	} else { //(between drv has received this event before and  fw have not yet to set key to CAM_ENTRY)
+		RT_TRACE(_module_rtl871x_ioctl_c_, _drv_err_,
+			("Error: OID_RT_PRO_ADD_STA_INFO: sta has been in sta_hash_queue \n"));
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_dele_sta_info_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct sta_info *psta = NULL;
+	UCHAR		*macaddr;
+
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = ETH_ALEN;
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	macaddr = (UCHAR *) poid_par_priv->information_buf ;
+	RT_TRACE(_module_rtl871x_ioctl_c_,_drv_notice_,
+		 ("+OID_RT_PRO_ADD_STA_INFO: addr="MAC_FMT"\n", MAC_ARG(macaddr) ));
+
+	psta = rtw_get_stainfo(&Adapter->stapriv, macaddr);
+	if (psta != NULL) {
+		_enter_critical(&(Adapter->stapriv.sta_hash_lock), &irqL);
+		rtw_free_stainfo(Adapter, psta);
+		_exit_critical(&(Adapter->stapriv.sta_hash_lock), &irqL);
+	}
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+#if 0
+#include <sdio_osintf.h>
+static u32 mp_query_drv_var(_adapter *padapter, u8 offset, u32 var)
+{
+#ifdef CONFIG_SDIO_HCI
+
+	if (offset == 1) {
+		u16 tmp_blk_num;
+		tmp_blk_num = rtw_read16(padapter, SDIO_RX0_RDYBLK_NUM);
+		RT_TRACE(_module_mp_, _drv_err_, ("Query Information, mp_query_drv_var  SDIO_RX0_RDYBLK_NUM=0x%x   adapter_to_dvobj(padapter)->rxblknum=0x%x\n", tmp_blk_num, adapter_to_dvobj(padapter)->rxblknum));
+		if (adapter_to_dvobj(padapter)->rxblknum != tmp_blk_num) {
+			RT_TRACE(_module_mp_,_drv_err_, ("Query Information, mp_query_drv_var  call recv rx\n"));
+		//	sd_recv_rxfifo(padapter);
+		}
+	}
+
+#if 0
+	if(offset <=100){  //For setting data rate and query data rate
+		if(offset==100){ //For query data rate
+			RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d): query rate=0x%.2x \n",offset,padapter->registrypriv.tx_rate));
+			var=padapter->registrypriv.tx_rate;
+
+		}
+		else if(offset<0x1d){  //For setting data rate
+			padapter->registrypriv.tx_rate=offset;
+			var=padapter->registrypriv.tx_rate;
+			padapter->registrypriv.use_rate=_TRUE;
+			RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d): set rate=0x%.2x \n",offset,padapter->registrypriv.tx_rate));
+		}
+		else{ //not use the data rate
+			padapter->registrypriv.use_rate=_FALSE;
+			RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d) out of rate range\n",offset));
+		}
+	}
+	else if (offset<=110){  //for setting debug level
+		RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var: offset(%d) for set debug level\n",offset));
+		if(offset==110){ //For query data rate
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var: offset(%d): query dbg level=0x%.2x \n",offset,padapter->registrypriv.dbg_level));
+			padapter->registrypriv.dbg_level=GlobalDebugLevel;
+			var=padapter->registrypriv.dbg_level;
+		}
+		else if(offset<110 && offset>100){
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var: offset(%d): set dbg level=0x%.2x \n",offset,offset-100));
+			padapter->registrypriv.dbg_level=GlobalDebugLevel=offset-100;
+			var=padapter->registrypriv.dbg_level;
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var(_drv_emerg_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_alert_, (" mp_query_drv_var(_drv_alert_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_crit_, (" mp_query_drv_var(_drv_crit_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_err_, (" mp_query_drv_var(_drv_err_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_warning_, (" mp_query_drv_var(_drv_warning_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_notice_, (" mp_query_drv_var(_drv_notice_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_info_, (" mp_query_drv_var(_drv_info_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_debug_, (" mp_query_drv_var(_drv_debug_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+
+		}
+	}
+	else if(offset >110 &&offset <116){
+		if(115==offset){
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var(_drv_emerg_): offset(%d): query TRX access type: [tx_block_mode=%x,rx_block_mode=%x]\n",\
+															offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+		}
+		else {
+			switch(offset){
+				case 111:
+					adapter_to_dvobj(padapter)->tx_block_mode=1;
+					adapter_to_dvobj(padapter)->rx_block_mode=1;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX block/RX block) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				case 112:
+					adapter_to_dvobj(padapter)->tx_block_mode=1;
+					adapter_to_dvobj(padapter)->rx_block_mode=0;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX block/RX byte) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				case 113:
+					adapter_to_dvobj(padapter)->tx_block_mode=0;
+					adapter_to_dvobj(padapter)->rx_block_mode=1;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX byte/RX block) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				case 114:
+					adapter_to_dvobj(padapter)->tx_block_mode=0;
+					adapter_to_dvobj(padapter)->rx_block_mode=0;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX byte/RX byte) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				default :
+					break;
+
+			}
+
+		}
+
+	}
+	else if(offset>=127){
+		u64	prnt_dbg_comp;
+		u8   chg_idx;
+		u64	tmp_dbg_comp;
+		chg_idx=offset-0x80;
+		tmp_dbg_comp=BIT(chg_idx);
+		prnt_dbg_comp=padapter->registrypriv.dbg_component= GlobalDebugComponents;
+		RT_TRACE(_module_mp_, _drv_emerg_, (" 1: mp_query_drv_var: offset(%d;0x%x):for dbg conpoment prnt_dbg_comp=0x%.16x GlobalDebugComponents=0x%.16x padapter->registrypriv.dbg_component=0x%.16x\n",offset,offset,prnt_dbg_comp,GlobalDebugComponents,padapter->registrypriv.dbg_component));
+		if(offset==127){
+	//		prnt_dbg_comp=padapter->registrypriv.dbg_component= GlobalDebugComponents;
+			var=(u32)(padapter->registrypriv.dbg_component);
+			RT_TRACE(0xffffffff, _drv_emerg_, ("2: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h) \n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+			prnt_dbg_comp=GlobalDebugComponents;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("2-1: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h)\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+			prnt_dbg_comp=GlobalDebugComponents=padapter->registrypriv.dbg_component;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("2-2: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h)\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+
+		}
+		else{
+			RT_TRACE(0xffffffff, _drv_emerg_, ("3: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h) GlobalDebugComponents=0x%x(l) 0x%x(h) chg_idx=%d\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp,chg_idx));
+			prnt_dbg_comp=GlobalDebugComponents;
+			RT_TRACE(0xffffffff, _drv_emerg_,("3-1: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h) chg_idx=%d\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp,chg_idx));// ("3-1: mp_query_drv_var: offset(%d;0x%x):before set dbg conpoment=0x%x chg_idx=%d or0x%x BIT(chg_idx[%d]=0x%x)\n",offset,offset,prnt_dbg_comp,chg_idx,chg_idx,(chg_idx),tmp_dbg_comp)
+			prnt_dbg_comp=GlobalDebugComponents=padapter->registrypriv.dbg_component;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("3-2: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h)\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+
+			if(GlobalDebugComponents&tmp_dbg_comp){
+				//this bit is already set, now clear it
+				GlobalDebugComponents=GlobalDebugComponents&(~tmp_dbg_comp);
+			}
+			else{
+				//this bit is not set, now set it.
+				GlobalDebugComponents =GlobalDebugComponents|tmp_dbg_comp;
+			}
+			RT_TRACE(0xffffffff, _drv_emerg_, ("4: mp_query_drv_var: offset(%d;0x%x):before set dbg conpoment tmp_dbg_comp=0x%x GlobalDebugComponents=0x%x(l) 0x%x(h)",offset,offset,tmp_dbg_comp,prnt_dbg_comp));
+			prnt_dbg_comp=GlobalDebugComponents;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("4-1: mp_query_drv_var: offset(%d;0x%x):before set dbg conpoment tmp_dbg_comp=0x%x GlobalDebugComponents=0x%x(l) 0x%x(h)",offset,offset,tmp_dbg_comp,prnt_dbg_comp));
+
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_emerg_, ("0: mp_query_drv_var(_module_rtl871x_xmit_c_:0): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,prnt_dbg_comp));
+			RT_TRACE(_module_xmit_osdep_c_, _drv_emerg_, ("1: mp_query_drv_var(_module_xmit_osdep_c_:1): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_emerg_, ("2: mp_query_drv_var(_module_rtl871x_recv_c_:2): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_recv_osdep_c_, _drv_emerg_, ("3: mp_query_drv_var(_module_recv_osdep_c_:3): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_mlme_c_, _drv_emerg_, ("4: mp_query_drv_var(_module_rtl871x_mlme_c_:4): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_mlme_osdep_c_, _drv_emerg_, (" 5:mp_query_drv_var(_module_mlme_osdep_c_:5): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_sta_mgt_c_, _drv_emerg_, ("6: mp_query_drv_var(_module_rtl871x_sta_mgt_c_:6): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_cmd_c_, _drv_emerg_, ("7: mp_query_drv_var(_module_rtl871x_cmd_c_:7): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_cmd_osdep_c_, _drv_emerg_, ("8: mp_query_drv_var(_module_cmd_osdep_c_:8): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_io_c_, _drv_emerg_, ("9: mp_query_drv_var(_module_rtl871x_io_c_:9): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_io_osdep_c_, _drv_emerg_, ("10: mp_query_drv_var(_module_io_osdep_c_:10): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_os_intfs_c_, _drv_emerg_, ("11: mp_query_drv_var(_module_os_intfs_c_:11): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_security_c_, _drv_emerg_, ("12: mp_query_drv_var(_module_rtl871x_security_c_:12): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_eeprom_c_, _drv_emerg_, ("13: mp_query_drv_var(_module_rtl871x_eeprom_c_:13): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hal_init_c_, _drv_emerg_, ("14: mp_query_drv_var(_module_hal_init_c_:14): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_hal_init_c_, _drv_emerg_, ("15: mp_query_drv_var(_module_hci_hal_init_c_:15): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_ioctl_c_, _drv_emerg_, ("16: mp_query_drv_var(_module_rtl871x_ioctl_c_:16): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_emerg_, ("17: mp_query_drv_var(_module_rtl871x_ioctl_set_c_:17): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_ioctl_query_c_, _drv_emerg_, ("18: mp_query_drv_var(_module_rtl871x_ioctl_query_c_:18): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_emerg_, ("19: mp_query_drv_var(_module_rtl871x_pwrctrl_c_:19): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_intfs_c_, _drv_emerg_, ("20: mp_query_drv_var(_module_hci_intfs_c_:20): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_ops_c_, _drv_emerg_, ("21: mp_query_drv_var(_module_hci_ops_c_:21): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_osdep_service_c_, _drv_emerg_, ("22: mp_query_drv_var(_module_osdep_service_c_:22): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_mp_, _drv_emerg_, ("23: mp_query_drv_var(_module_mp_:23): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_ops_os_c_, _drv_emerg_, ("24: mp_query_drv_var(_module_hci_ops_os_c_:24): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			var=(u32)(GlobalDebugComponents);
+			//GlobalDebugComponents=padapter->registrypriv.dbg_component;
+			RT_TRACE(0xffffffff, _drv_emerg_, (" ==mp_query_drv_var(_module_mp_): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+
+		}
+	}
+	else{
+		RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d) >110\n",offset));
+	}
+#endif
+#endif
+
+	return var;
+}
+#endif
+
+NDIS_STATUS oid_rt_pro_query_dr_variable_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL			oldirql;
+#endif
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+
+	DR_VARIABLE_STRUCT	*pdrv_var;
+
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = sizeof(DR_VARIABLE_STRUCT);
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Query Information, OID_RT_PRO_QUERY_DR_VARIABLE\n"));
+
+	pdrv_var = (struct _DR_VARIABLE_STRUCT_ *)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	pdrv_var->variable = mp_query_drv_var(Adapter, pdrv_var->offset, pdrv_var->variable);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_query_dr_variable_hdl: offset=0x%x valule=0x%x\n",
+		  pdrv_var->offset, pdrv_var->variable));
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	RT_TRACE(_module_mp_, _drv_err_, ("oid_rt_pro_rx_packet_type_hdl...................\n"));
+
+	if (poid_par_priv->information_buf_len < sizeof (UCHAR)) {
+		status = NDIS_STATUS_INVALID_LENGTH;
+		*poid_par_priv->bytes_needed = sizeof(UCHAR);
+		return status;
+	}
+
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		Adapter->mppriv.rx_with_status = *(UCHAR *) poid_par_priv->information_buf;
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_, ("Query Information, OID_RT_PRO_RX_PACKET_TYPE:%d \n",\
+												Adapter->mppriv.rx_with_status));
+
+		//*(u32 *)&Adapter->eeprompriv.mac_addr[0]=rtw_read32(Adapter, 0x10250050);
+		//*(u16 *)&Adapter->eeprompriv.mac_addr[4]=rtw_read16(Adapter, 0x10250054);
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_,("MAC addr=0x%x:0x%x:0x%x:0x%x:0x%x:0x%x  \n",
+			Adapter->eeprompriv.mac_addr[0],Adapter->eeprompriv.mac_addr[1],Adapter->eeprompriv.mac_addr[2],\
+			Adapter->eeprompriv.mac_addr[3],Adapter->eeprompriv.mac_addr[4],Adapter->eeprompriv.mac_addr[5]));
+
+	}
+	else {
+		*(UCHAR *) poid_par_priv->information_buf = Adapter->mppriv.rx_with_status;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_, ("Query Information, OID_RT_PRO_RX_PACKET_TYPE:%d \n", \
+												Adapter->mppriv.rx_with_status));
+
+		//*(u32 *)&Adapter->eeprompriv.mac_addr[0]=rtw_read32(Adapter, 0x10250050);
+		//*(u16 *)&Adapter->eeprompriv.mac_addr[4]=rtw_read16(Adapter, 0x10250054);
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_,("MAC addr=0x%x:0x%x:0x%x:0x%x:0x%x:0x%x  \n",
+			Adapter->eeprompriv.mac_addr[0],Adapter->eeprompriv.mac_addr[1],Adapter->eeprompriv.mac_addr[2],\
+			Adapter->eeprompriv.mac_addr[3],Adapter->eeprompriv.mac_addr[4],Adapter->eeprompriv.mac_addr[5]));
+	}
+#endif
+
+	return NDIS_STATUS_SUCCESS;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	PEFUSE_ACCESS_STRUCT pefuse;
+	u8 *data;
+	u16 addr = 0, cnts = 0, max_available_size = 0;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(EFUSE_ACCESS_STRUCT))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pefuse = (PEFUSE_ACCESS_STRUCT)poid_par_priv->information_buf;
+	addr = pefuse->start_addr;
+	cnts = pefuse->cnts;
+	data = pefuse->data;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		("+oid_rt_pro_read_efuse_hd: buf_len=%ld addr=%d cnts=%d\n",
+		 poid_par_priv->information_buf_len, addr, cnts));
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+	if ((addr + cnts) > max_available_size) {
+		RT_TRACE(_module_mp_, _drv_err_, ("!oid_rt_pro_read_efuse_hdl: parameter error!\n"));
+		return NDIS_STATUS_NOT_ACCEPTED;
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	if (rtw_efuse_access(Adapter, _FALSE, addr, cnts, data) == _FAIL) {
+		RT_TRACE(_module_mp_, _drv_err_, ("!oid_rt_pro_read_efuse_hdl: rtw_efuse_access FAIL!\n"));
+		status = NDIS_STATUS_FAILURE;
+	} else
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	PEFUSE_ACCESS_STRUCT pefuse;
+	u8 *data;
+	u16 addr = 0, cnts = 0, max_available_size = 0;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pefuse = (PEFUSE_ACCESS_STRUCT)poid_par_priv->information_buf;
+	addr = pefuse->start_addr;
+	cnts = pefuse->cnts;
+	data = pefuse->data;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("+oid_rt_pro_write_efuse_hdl: buf_len=%ld addr=0x%04x cnts=%d\n",
+		  poid_par_priv->information_buf_len, addr, cnts));
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+	if ((addr + cnts) > max_available_size) {
+		RT_TRACE(_module_mp_, _drv_err_, ("!oid_rt_pro_write_efuse_hdl: parameter error"));
+		return NDIS_STATUS_NOT_ACCEPTED;
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	if (rtw_efuse_access(Adapter, _TRUE, addr, cnts, data) == _FAIL)
+		status = NDIS_STATUS_FAILURE;
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_rw_efuse_pgpkt_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	PPGPKT_STRUCT	ppgpkt;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+//	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_pro_rw_efuse_pgpkt_hdl\n"));
+
+	*poid_par_priv->bytes_rw = 0;
+
+	if (poid_par_priv->information_buf_len < sizeof(PGPKT_STRUCT))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	ppgpkt = (PPGPKT_STRUCT)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (poid_par_priv->type_of_oid == QUERY_OID)
+	{
+		RT_TRACE(_module_mp_, _drv_notice_,
+			("oid_rt_pro_rw_efuse_pgpkt_hdl: Read offset=0x%x\n",\
+			ppgpkt->offset));
+
+		Efuse_PowerSwitch(Adapter, _FALSE, _TRUE);
+		if (Efuse_PgPacketRead(Adapter, ppgpkt->offset, ppgpkt->data, _FALSE) == _TRUE)
+			*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		else
+			status = NDIS_STATUS_FAILURE;
+		Efuse_PowerSwitch(Adapter, _FALSE, _FALSE);
+	} else {
+		RT_TRACE(_module_mp_, _drv_notice_,
+			("oid_rt_pro_rw_efuse_pgpkt_hdl: Write offset=0x%x word_en=0x%x\n",\
+			ppgpkt->offset, ppgpkt->word_en));
+
+		Efuse_PowerSwitch(Adapter, _TRUE, _TRUE);
+		if (Efuse_PgPacketWrite(Adapter, ppgpkt->offset, ppgpkt->word_en, ppgpkt->data, _FALSE) == _TRUE)
+			*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		else
+			status = NDIS_STATUS_FAILURE;
+		Efuse_PowerSwitch(Adapter, _TRUE, _FALSE);
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_pro_rw_efuse_pgpkt_hdl: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u16 size;
+	u8 ret;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len <sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	ret = efuse_GetCurrentSize(Adapter, &size);
+	_irqlevel_changed_(&oldirql, RAISE);
+	if (ret == _SUCCESS) {
+		*(u32*)poid_par_priv->information_buf = size;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	} else
+		status = NDIS_STATUS_FAILURE;
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	*(u32*)poid_par_priv->information_buf = efuse_GetMaxSize(Adapter);
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_get_efuse_max_size_hdl: size=%d status=0x%08X\n",
+		  *(int*)poid_par_priv->information_buf, status));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_pro_efuse_hdl\n"));
+
+	if (poid_par_priv->type_of_oid == QUERY_OID)
+		status = oid_rt_pro_read_efuse_hdl(poid_par_priv);
+	else
+		status = oid_rt_pro_write_efuse_hdl(poid_par_priv);
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_pro_efuse_hdl: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u8		*data;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	u16	mapLen=0;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_efuse_map_hdl\n"));
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, _FALSE);
+
+	*poid_par_priv->bytes_rw = 0;
+
+	if (poid_par_priv->information_buf_len < mapLen)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	data = (u8*)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (poid_par_priv->type_of_oid == QUERY_OID)
+	{
+		RT_TRACE(_module_mp_, _drv_info_,
+			("oid_rt_pro_efuse_map_hdl: READ\n"));
+
+		if (rtw_efuse_map_read(Adapter, 0, mapLen, data) == _SUCCESS)
+			*poid_par_priv->bytes_rw = mapLen;
+		else {
+			RT_TRACE(_module_mp_, _drv_err_,
+				("oid_rt_pro_efuse_map_hdl: READ fail\n"));
+			status = NDIS_STATUS_FAILURE;
+		}
+	} else {
+		// SET_OID
+		RT_TRACE(_module_mp_, _drv_info_,
+			("oid_rt_pro_efuse_map_hdl: WRITE\n"));
+
+		if (rtw_efuse_map_write(Adapter, 0, mapLen, data) == _SUCCESS)
+			*poid_par_priv->bytes_rw = mapLen;
+		else {
+			RT_TRACE(_module_mp_, _drv_err_,
+				("oid_rt_pro_efuse_map_hdl: WRITE fail\n"));
+			status = NDIS_STATUS_FAILURE;
+		}
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_pro_efuse_map_hdl: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_set_crystal_cap_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+
+	u32		crystal_cap = 0;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len <sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	crystal_cap = *((u32*)poid_par_priv->information_buf);//4
+	if (crystal_cap > 0xf)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	Adapter->mppriv.curr_crystalcap = crystal_cap;
+
+	_irqlevel_changed_(&oldirql,LOWER);
+	SetCrystalCap(Adapter);
+	_irqlevel_changed_(&oldirql,RAISE);
+
+_func_exit_;
+
+#endif
+	return status;
+}
+
+NDIS_STATUS oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u8		rx_pkt_type;
+//	u32		rcr_val32;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+//	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_set_rx_packet_type_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	rx_pkt_type = *((u8*)poid_par_priv->information_buf);//4
+
+	RT_TRACE(_module_mp_, _drv_info_, ("rx_pkt_type: %x\n",rx_pkt_type ));
+#if 0
+	_irqlevel_changed_(&oldirql, LOWER);
+#if 0
+	rcr_val8 = rtw_read8(Adapter, 0x10250048);//RCR
+	rcr_val8 &= ~(RCR_AB|RCR_AM|RCR_APM|RCR_AAP);
+
+	if(rx_pkt_type == RX_PKT_BROADCAST){
+		rcr_val8 |= (RCR_AB | RCR_ACRC32 );
+	}
+	else if(rx_pkt_type == RX_PKT_DEST_ADDR){
+		rcr_val8 |= (RCR_AAP| RCR_AM |RCR_ACRC32);
+	}
+	else if(rx_pkt_type == RX_PKT_PHY_MATCH){
+		rcr_val8 |= (RCR_APM|RCR_ACRC32);
+	}
+	else{
+		rcr_val8 &= ~(RCR_AAP|RCR_APM|RCR_AM|RCR_AB|RCR_ACRC32);
+	}
+	rtw_write8(padapter, 0x10250048,rcr_val8);
+#else
+	rcr_val32 = rtw_read32(padapter, RCR);//RCR = 0x10250048
+	rcr_val32 &= ~(RCR_CBSSID|RCR_AB|RCR_AM|RCR_APM|RCR_AAP);
+#if 0
+	if(rx_pkt_type == RX_PKT_BROADCAST){
+		rcr_val32 |= (RCR_AB|RCR_AM|RCR_APM|RCR_AAP|RCR_ACRC32);
+	}
+	else if(rx_pkt_type == RX_PKT_DEST_ADDR){
+		//rcr_val32 |= (RCR_CBSSID|RCR_AAP|RCR_AM|RCR_ACRC32);
+		rcr_val32 |= (RCR_CBSSID|RCR_APM|RCR_ACRC32);
+	}
+	else if(rx_pkt_type == RX_PKT_PHY_MATCH){
+		rcr_val32 |= (RCR_APM|RCR_ACRC32);
+		//rcr_val32 |= (RCR_AAP|RCR_ACRC32);
+	}
+	else{
+		rcr_val32 &= ~(RCR_AAP|RCR_APM|RCR_AM|RCR_AB|RCR_ACRC32);
+	}
+#else
+	switch (rx_pkt_type)
+	{
+		case RX_PKT_BROADCAST :
+			rcr_val32 |= (RCR_AB|RCR_AM|RCR_APM|RCR_AAP|RCR_ACRC32);
+			break;
+		case RX_PKT_DEST_ADDR :
+			rcr_val32 |= (RCR_AB|RCR_AM|RCR_APM|RCR_AAP|RCR_ACRC32);
+			break;
+		case RX_PKT_PHY_MATCH:
+			rcr_val32 |= (RCR_APM|RCR_ACRC32);
+			break;
+		default:
+			rcr_val32 &= ~(RCR_AAP|RCR_APM|RCR_AM|RCR_AB|RCR_ACRC32);
+			break;
+	}
+
+	if (rx_pkt_type == RX_PKT_DEST_ADDR) {
+		padapter->mppriv.check_mp_pkt = 1;
+	} else {
+		padapter->mppriv.check_mp_pkt = 0;
+	}
+#endif
+	rtw_write32(padapter, RCR, rcr_val32);
+
+#endif
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_tx_agc_offset_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	u32 		txagc;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	txagc = *(u32*)poid_par_priv->information_buf;
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("oid_rt_pro_set_tx_agc_offset_hdl: 0x%08x\n", txagc));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetTxAGCOffset(Adapter, txagc);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+NDIS_STATUS oid_rt_pro_set_pkt_test_mode_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+	struct mp_priv		*pmppriv = &Adapter->mppriv;
+	u32 			type;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len <sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	type = *(u32*)poid_par_priv->information_buf;
+
+	if (_LOOPBOOK_MODE_ == type) {
+		pmppriv->mode = type;
+		set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); //append txdesc
+		RT_TRACE(_module_mp_, _drv_info_, ("test mode change to loopback mode:0x%08x.\n", get_fwstate(pmlmepriv)));
+	} else if (_2MAC_MODE_ == type){
+		pmppriv->mode = type;
+		_clr_fwstate_(pmlmepriv, WIFI_MP_LPBK_STATE);
+		RT_TRACE(_module_mp_, _drv_info_, ("test mode change to 2mac mode:0x%08x.\n", get_fwstate(pmlmepriv)));
+	} else
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv)
+{
+	PMP_XMIT_PARM pparm;
+	PADAPTER padapter;
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+%s\n", __func__));
+
+	pparm = (PMP_XMIT_PARM)poid_par_priv->information_buf;
+	padapter = (PADAPTER)poid_par_priv->adapter_context;
+	pmp_priv = &padapter->mppriv;
+
+	if (poid_par_priv->type_of_oid == QUERY_OID) {
+		pparm->enable = !pmp_priv->tx.stop;
+		pparm->count = pmp_priv->tx.sended;
+	} else {
+		if (pparm->enable == 0) {
+			pmp_priv->tx.stop = 1;
+		} else if (pmp_priv->tx.stop == 1) {
+			pmp_priv->tx.stop = 0;
+			pmp_priv->tx.count = pparm->count;
+			pmp_priv->tx.payload = pparm->payload_type;
+			pattrib = &pmp_priv->tx.attrib;
+			pattrib->pktlen = pparm->length;
+			_rtw_memcpy(pattrib->dst, pparm->da, ETH_ALEN);
+			SetPacketTx(padapter);
+		} else
+			return NDIS_STATUS_FAILURE;
+	}
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+#if 0
+unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv)
+{
+	unsigned char *pframe, *pmp_pkt;
+	struct ethhdr *pethhdr;
+	struct pkt_attrib *pattrib;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	int llc_sz, payload_len;
+	struct mp_xmit_frame *pxframe=  NULL;
+	struct mp_xmit_packet *pmp_xmitpkt = (struct mp_xmit_packet*)param;
+	u8 addr3[] = {0x02, 0xE0, 0x4C, 0x87, 0x66, 0x55};
+
+//	DBG_871X("+mp_ioctl_xmit_packet_hdl\n");
+
+	pxframe = alloc_mp_xmitframe(&padapter->mppriv);
+	if (pxframe == NULL)
+	{
+		DEBUG_ERR(("Can't alloc pmpframe %d:%s\n", __LINE__, __FILE__));
+		return -1;
+	}
+
+	//mp_xmit_pkt
+	payload_len = pmp_xmitpkt->len - 14;
+	pmp_pkt = (unsigned char*)pmp_xmitpkt->mem;
+	pethhdr = (struct ethhdr *)pmp_pkt;
+
+	//DBG_871X("payload_len=%d, pkt_mem=0x%x\n", pmp_xmitpkt->len, (void*)pmp_xmitpkt->mem);
+
+	//DBG_871X("pxframe=0x%x\n", (void*)pxframe);
+	//DBG_871X("pxframe->mem=0x%x\n", (void*)pxframe->mem);
+
+	//update attribute
+	pattrib = &pxframe->attrib;
+	memset((u8 *)(pattrib), 0, sizeof (struct pkt_attrib));
+	pattrib->pktlen = pmp_xmitpkt->len;
+	pattrib->ether_type = ntohs(pethhdr->h_proto);
+	pattrib->hdrlen = 24;
+	pattrib->nr_frags = 1;
+	pattrib->priority = 0;
+#ifndef CONFIG_MP_LINUX
+	if(IS_MCAST(pethhdr->h_dest))
+		pattrib->mac_id = 4;
+	else
+		pattrib->mac_id = 5;
+#else
+	pattrib->mac_id = 5;
+#endif
+
+	//
+	memset(pxframe->mem, 0 , WLANHDR_OFFSET);
+	pframe = (u8 *)(pxframe->mem) + WLANHDR_OFFSET;
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	SetFrameSubType(pframe, WIFI_DATA);
+
+	_rtw_memcpy(pwlanhdr->addr1, pethhdr->h_dest, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pethhdr->h_source, ETH_ALEN);
+
+	_rtw_memcpy(pwlanhdr->addr3, addr3, ETH_ALEN);
+
+	pwlanhdr->seq_ctl = 0;
+	pframe += pattrib->hdrlen;
+
+	llc_sz= rtw_put_snap(pframe, pattrib->ether_type);
+	pframe += llc_sz;
+
+	_rtw_memcpy(pframe, (void*)(pmp_pkt+14),  payload_len);
+
+	pattrib->last_txcmdsz = pattrib->hdrlen + llc_sz + payload_len;
+
+	DEBUG_INFO(("issuing mp_xmit_frame, tx_len=%d, ether_type=0x%x\n", pattrib->last_txcmdsz, pattrib->ether_type));
+	xmit_mp_frame(padapter, pxframe);
+
+	return _SUCCESS;
+}
+#endif
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_power_down_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u8		bpwrup;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_SDIO_HCI
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+#endif
+#endif
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("\n ===> Setoid_rt_set_power_down_hdl.\n"));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	bpwrup = *(u8 *)poid_par_priv->information_buf;
+	//CALL  the power_down function
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_SDIO_HCI
+	dev_power_down(padapter,bpwrup);
+#endif
+#endif
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	//DEBUG_ERR(("\n <=== Query OID_RT_PRO_READ_REGISTER.
+	//	Add:0x%08x Width:%d Value:0x%08x\n",RegRWStruct->offset,RegRWStruct->width,RegRWStruct->value));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_power_mode_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+//#ifdef PLATFORM_OS_XP
+//	_irqL		oldirql;
+//#endif
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if (poid_par_priv->information_buf_len < sizeof(u32)) {
+		status = NDIS_STATUS_INVALID_LENGTH;
+		return status;
+	}
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("\n ===> oid_rt_get_power_mode_hdl.\n"));
+
+//	_irqlevel_changed_(&oldirql, LOWER);
+	*(int*)poid_par_priv->information_buf = Adapter->registrypriv.low_power ? POWER_LOW : POWER_NORMAL;
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+//	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c
new file mode 100755
index 0000000000000..18a1b772cd957
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c
@@ -0,0 +1,5370 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_P2P_C_
+
+#include <drv_types.h>
+#include <rtw_p2p.h>
+#include <wifi.h>
+
+#ifdef CONFIG_P2P
+
+int rtw_p2p_is_channel_list_ok( u8 desired_ch, u8* ch_list, u8 ch_cnt )
+{
+	int found = 0, i = 0;
+
+	for( i = 0; i < ch_cnt; i++ )
+	{
+		if ( ch_list[ i ] == desired_ch )
+		{
+			found = 1;
+			break;
+		}
+	}
+	return( found );
+}
+
+int is_any_client_associated(_adapter *padapter)
+{
+	return padapter->stapriv.asoc_list_cnt ? _TRUE : _FALSE;
+}
+
+static u32 go_add_group_info_attr(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	u32 len=0;
+	u16 attr_len = 0;
+	u8 tmplen, *pdata_attr, *pstart, *pcur;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = pwdinfo->padapter;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	pdata_attr = rtw_zmalloc(MAX_P2P_IE_LEN);
+
+	pstart = pdata_attr;
+	pcur = pdata_attr;
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//look up sta asoc_queue
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)	
+	{		
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		
+		plist = get_next(plist);
+		
+
+		if(psta->is_p2p_device)
+		{
+			tmplen = 0;
+			
+			pcur++;
+		
+			//P2P device address
+			_rtw_memcpy(pcur, psta->dev_addr, ETH_ALEN);
+			pcur += ETH_ALEN;
+
+			//P2P interface address
+			_rtw_memcpy(pcur, psta->hwaddr, ETH_ALEN);
+			pcur += ETH_ALEN;
+
+			*pcur = psta->dev_cap;
+			pcur++;
+
+			//*(u16*)(pcur) = cpu_to_be16(psta->config_methods);
+			RTW_PUT_BE16(pcur, psta->config_methods);
+			pcur += 2;
+
+			_rtw_memcpy(pcur, psta->primary_dev_type, 8);
+			pcur += 8;
+
+			*pcur = psta->num_of_secdev_type;
+			pcur++;
+
+			_rtw_memcpy(pcur, psta->secdev_types_list, psta->num_of_secdev_type*8);
+			pcur += psta->num_of_secdev_type*8;
+			
+			if(psta->dev_name_len>0)
+			{
+				//*(u16*)(pcur) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+				RTW_PUT_BE16(pcur, WPS_ATTR_DEVICE_NAME);
+				pcur += 2;
+
+				//*(u16*)(pcur) = cpu_to_be16( psta->dev_name_len );
+				RTW_PUT_BE16(pcur, psta->dev_name_len);
+				pcur += 2;
+
+				_rtw_memcpy(pcur, psta->dev_name, psta->dev_name_len);
+				pcur += psta->dev_name_len;
+			}
+
+
+			tmplen = (u8)(pcur-pstart);
+			
+			*pstart = (tmplen-1);
+
+			attr_len += tmplen;
+
+			//pstart += tmplen;
+			pstart = pcur;
+			
+		}
+		
+		
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	if(attr_len>0)
+	{
+		len = rtw_set_p2p_attr_content(pbuf, P2P_ATTR_GROUP_INFO, attr_len, pdata_attr);
+	}
+
+	rtw_mfree(pdata_attr, MAX_P2P_IE_LEN);
+
+	return len;
+
+}
+
+static void issue_group_disc_req(struct wifidirect_info *pwdinfo, u8 *da)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	_adapter *padapter = pwdinfo->padapter;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);	
+	unsigned char category = RTW_WLAN_CATEGORY_P2P;//P2P action frame	
+	u32	p2poui = cpu_to_be32(P2POUI);
+	u8	oui_subtype = P2P_GO_DISC_REQUEST;
+	u8	dialogToken=0;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pwdinfo->interface_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->interface_addr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//Build P2P action frame header
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));		
+
+	//there is no IE in this P2P action frame
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+static void issue_p2p_devdisc_resp(struct wifidirect_info *pwdinfo, u8 *da, u8 status, u8 dialogToken)
+{	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	_adapter *padapter = pwdinfo->padapter;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);	
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_DEVDISC_RESP;
+	u8 p2pie[8] = { 0x00 };
+	u32 p2pielen = 0;	
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pwdinfo->device_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->device_addr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//Build P2P public action frame header
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));		
+
+
+	//Build P2P IE
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	// P2P_ATTR_STATUS
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_STATUS, 1, &status);
+	
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, p2pie, &pattrib->pktlen);	
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+static void issue_p2p_provision_resp(struct wifidirect_info *pwdinfo, u8* raddr, u8* frame_body, u16 config_method)
+{
+	_adapter *padapter = pwdinfo->padapter;
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u8			dialogToken = frame_body[7];	//	The Dialog Token of provisioning discovery request frame.
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_PROVISION_DISC_RESP;
+	u8			wpsie[ 100 ] = { 0x00 };
+	u8			wpsielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD		
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));		
+
+	wpsielen = 0;
+	//	WPS OUI
+	//*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	RTW_PUT_BE32(wpsie, WPSOUI);
+	wpsielen += 4;
+
+#if 0
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+#endif
+
+	//	Config Method
+	//	Type:
+	//*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+	RTW_PUT_BE16(wpsie + wpsielen, WPS_ATTR_CONF_METHOD);
+	wpsielen += 2;
+
+	//	Length:
+	//*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	RTW_PUT_BE16(wpsie + wpsielen, 0x0002);
+	wpsielen += 2;
+
+	//	Value:
+	//*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( config_method );
+	RTW_PUT_BE16(wpsie + wpsielen, config_method);
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );	
+
+#ifdef CONFIG_WFD
+	wfdielen = build_provdisc_resp_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+static void issue_p2p_presence_resp(struct wifidirect_info *pwdinfo, u8 *da, u8 status, u8 dialogToken)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	_adapter *padapter = pwdinfo->padapter;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);	
+	unsigned char category = RTW_WLAN_CATEGORY_P2P;//P2P action frame	
+	u32	p2poui = cpu_to_be32(P2POUI);
+	u8	oui_subtype = P2P_PRESENCE_RESPONSE;	
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u8 noa_attr_content[32] = { 0x00 };
+	u32 p2pielen = 0;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pwdinfo->interface_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->interface_addr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//Build P2P action frame header
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));	
+
+
+	//Add P2P IE header
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//Add Status attribute in P2P IE 
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_STATUS, 1, &status);
+
+	//Add NoA attribute in P2P IE
+	noa_attr_content[0] = 0x1;//index
+	noa_attr_content[1] = 0x0;//CTWindow and OppPS Parameters
+	
+	//todo: Notice of Absence Descriptor(s)
+	
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_NOA, 2, noa_attr_content);
+
+
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, p2pie, &(pattrib->pktlen));
+
+	
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+u32 build_beacon_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u16 capability=0;
+	u32 len=0, p2pielen = 0;
+	
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+
+	//	According to the P2P Specification, the beacon frame should contain 3 P2P attributes
+	//	1. P2P Capability
+	//	2. P2P Device ID
+	//	3. Notice of Absence ( NOA )	
+
+	//	P2P Capability ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	//	Be able to participate in additional P2P Groups and
+	//	support the P2P Invitation Procedure	
+	//	Group Capability Bitmap, 1 byte	
+	capability = P2P_DEVCAP_INVITATION_PROC|P2P_DEVCAP_CLIENT_DISCOVERABILITY;
+	capability |=  ((P2P_GRPCAP_GO | P2P_GRPCAP_INTRABSS) << 8);
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+		capability |= (P2P_GRPCAP_GROUP_FORMATION<<8);
+
+	capability = cpu_to_le16(capability);
+
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_CAPABILITY, 2, (u8*)&capability);
+
+	
+	// P2P Device ID ATTR
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_DEVICE_ID, ETH_ALEN, pwdinfo->device_addr);
+
+	
+	// Notice of Absence ATTR
+	//	Type: 
+	//	Length:
+	//	Value:
+	
+	//go_add_noa_attr(pwdinfo);
+	
+	
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+	
+	
+	return len;
+	
+}
+
+#ifdef CONFIG_WFD
+u32 build_beacon_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the beacon frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		if ( is_any_client_associated( pwdinfo->padapter ) )
+		{
+			//	WFD primary sink + WiFi Direct mode + WSD (WFD Service Discovery)
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD );			
+		}
+		else
+		{
+			//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD (WFD Service Discovery)
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+		}
+
+	}
+	else
+	{
+		//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+		RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	}
+	
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_probe_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe request frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	
+	if ( 1 == pwdinfo->wfd_tdls_enable )
+	{
+		//	WFD primary sink + available for WFD session + WiFi TDLS mode + WSC ( WFD Service Discovery )	
+		RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | 
+						WFD_DEVINFO_SESSION_AVAIL | 
+						WFD_DEVINFO_WSD |
+						WFD_DEVINFO_PC_TDLS );
+	}
+	else
+	{
+		//	WFD primary sink + available for WFD session + WiFi Direct mode + WSC ( WFD Service Discovery )	
+		RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type |
+						WFD_DEVINFO_SESSION_AVAIL | 
+						WFD_DEVINFO_WSD );
+	}
+	
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_probe_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 tunneled)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe response frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+	//	4. WFD Session Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode
+	
+	if (  _TRUE == pwdinfo->session_available )
+	{
+		if ( P2P_ROLE_GO == pwdinfo->role )
+		{
+			if ( is_any_client_associated( pwdinfo->padapter ) )
+			{
+				if ( pwdinfo->wfd_tdls_enable )
+				{
+					//	TDLS mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+				}
+				else
+				{
+					//	WiFi Direct mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+				}				
+			}
+			else
+			{
+				if ( pwdinfo->wfd_tdls_enable )
+				{
+					//	available for WFD session + TDLS mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+				}
+				else
+				{
+					//	available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+				}				
+			}
+		}
+		else
+		{
+			if ( pwdinfo->wfd_tdls_enable )
+			{
+				//	available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+				RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+			}
+			else
+			{
+
+				//	available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+				RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+			}
+		}
+	}
+	else
+	{
+		if ( pwdinfo->wfd_tdls_enable )
+		{
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD |WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+		}
+		else
+		{
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+		}
+
+	}
+
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		//	WFD Session Information ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_SESSION_INFO;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen, 0x0000);
+		wfdielen += 2;
+
+		//	Todo: to add the list of WFD device info descriptor in WFD group.
+
+	}
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_TDLS
+	if ( ( tunneled == 0 ) && ( padapter->pbuddy_adapter->wdinfo.wfd_tdls_enable == 1 ) )
+	{
+		//	Alternative MAC Address ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_ALTER_MAC;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen,  ETH_ALEN );
+		wfdielen += 2;
+
+		//	Value:
+		//	Alternative MAC Address
+		_rtw_memcpy( wfdie + wfdielen, &padapter->pbuddy_adapter->eeprompriv.mac_addr[ 0 ], ETH_ALEN );
+		//	This mac address is used to make the WFD session when TDLS is enable.
+
+		wfdielen += ETH_ALEN;
+	}
+#endif // CONFIG_TDLS
+#endif // CONFIG_CONCURRENT_MODE
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_assoc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter 					*padapter = NULL;
+	struct mlme_priv			*pmlmepriv = NULL;
+	struct wifi_display_info		*pwfd_info = NULL;
+
+	//	WFD OUI
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+	{
+		return 0;
+	}
+
+	padapter = pwdinfo->padapter;
+	pmlmepriv = &padapter->mlmepriv;
+	pwfd_info = padapter->wdinfo.wfd_info;
+	
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe request frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_assoc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe request frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_nego_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + WiFi Direct mode + WSD ( WFD Service Discovery ) + WFD Session Available
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_SESSION_AVAIL);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_nego_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + WiFi Direct mode + WSD ( WFD Service Discovery ) + WFD Session Available
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_SESSION_AVAIL);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_nego_confirm_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + WiFi Direct mode + WSD ( WFD Service Discovery ) + WFD Session Available
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_SESSION_AVAIL);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_invitation_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		//	WFD Session Information ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_SESSION_INFO;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen, 0x0000);
+		wfdielen += 2;
+
+		//	Todo: to add the list of WFD device info descriptor in WFD group.
+
+	}
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_invitation_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		//	WFD Session Information ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_SESSION_INFO;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen, 0x0000);
+		wfdielen += 2;
+
+		//	Todo: to add the list of WFD device info descriptor in WFD group.
+
+	}
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_provdisc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+u32 build_provdisc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery response frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+	
+}
+
+#endif //CONFIG_WFD
+
+u32 build_probe_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u32 len=0, p2pielen = 0;	
+#ifdef CONFIG_INTEL_WIDI
+	struct mlme_priv *pmlmepriv = &(pwdinfo->padapter->mlmepriv);
+	u8 zero_array_check[L2SDTA_SERVICE_VE_LEN] = { 0x00 };
+	u8 widi_version = 0, i = 0;
+
+	if( _rtw_memcmp( pmlmepriv->sa_ext, zero_array_check, L2SDTA_SERVICE_VE_LEN ) == _FALSE )
+	{
+		widi_version = 35;
+	}
+	else if( pmlmepriv->num_p2p_sdt != 0 )
+	{
+		widi_version = 40;
+	}
+#endif //CONFIG_INTEL_WIDI
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20100907
+	//	According to the P2P Specification, the probe response frame should contain 5 P2P attributes
+	//	1. P2P Capability
+	//	2. Extended Listen Timing
+	//	3. Notice of Absence ( NOA )	( Only GO needs this )
+	//	4. Device Info
+	//	5. Group Info	( Only GO need this )
+
+	//	P2P Capability ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	RTW_PUT_LE16(p2pie + p2pielen, 0x0002);
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+	
+	//	Group Capability Bitmap, 1 byte
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		p2pie[ p2pielen ] = (P2P_GRPCAP_GO | P2P_GRPCAP_INTRABSS);
+
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+			p2pie[ p2pielen ] |= P2P_GRPCAP_GROUP_FORMATION;
+
+		p2pielen++;
+	}
+	else if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) )
+	{
+		//	Group Capability Bitmap, 1 byte
+		if ( pwdinfo->persistent_supported )
+			p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+		else
+			p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+	}
+
+	//	Extended Listen Timing ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+	RTW_PUT_LE16(p2pie + p2pielen, 0x0004);
+	p2pielen += 2;
+
+	//	Value:
+	//	Availability Period
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	RTW_PUT_LE16(p2pie + p2pielen, 0xFFFF);
+	p2pielen += 2;
+
+	//	Availability Interval
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	RTW_PUT_LE16(p2pie + p2pielen, 0xFFFF);
+	p2pielen += 2;
+
+
+	// Notice of Absence ATTR
+	//	Type: 
+	//	Length:
+	//	Value:
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		//go_add_noa_attr(pwdinfo);
+	}	
+
+	//	Device Info ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+#ifdef CONFIG_INTEL_WIDI
+	if( widi_version == 35 )
+	{
+		RTW_PUT_LE16(p2pie + p2pielen, 21 + 8 + pwdinfo->device_name_len);
+	}
+	else if( widi_version == 40 )
+	{
+		RTW_PUT_LE16(p2pie + p2pielen, 21 + 8 * pmlmepriv->num_p2p_sdt + pwdinfo->device_name_len);
+	}
+	else
+#endif //CONFIG_INTEL_WIDI
+	RTW_PUT_LE16(p2pie + p2pielen, 21 + pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+	RTW_PUT_BE16(p2pie + p2pielen, pwdinfo->supported_wps_cm);
+	p2pielen += 2;
+
+#ifdef CONFIG_INTEL_WIDI
+	if( widi_version == 40 )
+	{
+		//	Primary Device Type
+		//	Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+		RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_pdt_cid );
+		p2pielen += 2;
+
+		//	OUI
+		//*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+		RTW_PUT_BE32(p2pie + p2pielen, WPSOUI);
+		p2pielen += 4;
+
+		//	Sub Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+		RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_pdt_scid);
+		p2pielen += 2;
+	}
+	else
+#endif //CONFIG_INTEL_WIDI
+	{
+		//	Primary Device Type
+		//	Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_CID_MULIT_MEDIA);
+		p2pielen += 2;
+
+		//	OUI
+		//*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+		RTW_PUT_BE32(p2pie + p2pielen, WPSOUI);
+		p2pielen += 4;
+
+		//	Sub Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_SCID_MEDIA_SERVER);
+		p2pielen += 2;
+	}
+
+	//	Number of Secondary Device Types
+#ifdef CONFIG_INTEL_WIDI
+	if( widi_version == 35 )
+	{
+		p2pie[ p2pielen++ ] = 0x01;
+		
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_CID_DISPLAYS);
+		p2pielen += 2;
+
+		RTW_PUT_BE32(p2pie + p2pielen, INTEL_DEV_TYPE_OUI);
+		p2pielen += 4;
+
+		RTW_PUT_BE16(p2pie + p2pielen, P2P_SCID_WIDI_CONSUMER_SINK);
+		p2pielen += 2;
+	}
+	else if( widi_version == 40 )
+	{
+		p2pie[ p2pielen++ ] = pmlmepriv->num_p2p_sdt;
+		for( ; i < pmlmepriv->num_p2p_sdt; i++ )
+		{
+			RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_sdt_cid[i]);
+			p2pielen += 2;
+
+			RTW_PUT_BE32(p2pie + p2pielen, INTEL_DEV_TYPE_OUI);
+			p2pielen += 4;
+
+			RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_sdt_scid[i]);
+			p2pielen += 2;
+		}
+	}
+	else
+#endif //CONFIG_INTEL_WIDI
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_ATTR_DEVICE_NAME);
+	p2pielen += 2;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	RTW_PUT_BE16(p2pie + p2pielen, pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+	// Group Info ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		p2pielen += go_add_group_info_attr(pwdinfo, p2pie + p2pielen);
+	}
+
+	
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+	
+
+	return len;
+	
+}
+
+u32 build_prov_disc_request_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8* pssid, u8 ussidlen, u8* pdev_raddr )
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u32 len=0, p2pielen = 0;	
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110301
+	//	According to the P2P Specification, the provision discovery request frame should contain 3 P2P attributes
+	//	1. P2P Capability
+	//	2. Device Info
+	//	3. Group ID ( When joining an operating P2P Group )
+
+	//	P2P Capability ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	RTW_PUT_LE16(p2pie + p2pielen, 0x0002);
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+	
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+	else
+		p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+
+	//	Device Info ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	RTW_PUT_LE16(p2pie + p2pielen, 21 + pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+	if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PBC )
+	{
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_PBC );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_CONFIG_METHOD_PBC);
+	}
+	else
+	{
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_DISPLAY );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_CONFIG_METHOD_DISPLAY);
+	}
+
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_CID_MULIT_MEDIA);
+	p2pielen += 2;
+
+	//	OUI
+	//*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	RTW_PUT_BE32(p2pie + p2pielen, WPSOUI);
+	p2pielen += 4;
+
+	//	Sub Category ID
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_SCID_MEDIA_SERVER);
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_ATTR_DEVICE_NAME);
+	p2pielen += 2;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	RTW_PUT_BE16(p2pie + p2pielen, pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		//	Added by Albert 2011/05/19
+		//	In this case, the pdev_raddr is the device address of the group owner.
+		
+		//	P2P Group ID ATTR
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+		//	Length:
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN + ussidlen );
+		RTW_PUT_LE16(p2pie + p2pielen, ETH_ALEN + ussidlen);
+		p2pielen += 2;
+
+		//	Value:
+		_rtw_memcpy( p2pie + p2pielen, pdev_raddr, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+
+		_rtw_memcpy( p2pie + p2pielen, pssid, ussidlen );
+		p2pielen += ussidlen;
+		
+	}
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+	
+
+	return len;
+	
+}
+
+
+u32 build_assoc_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 status_code)
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u32 len=0, p2pielen = 0;	
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	// According to the P2P Specification, the Association response frame should contain 2 P2P attributes
+	//	1. Status
+	//	2. Extended Listen Timing (optional)
+
+
+	//	Status ATTR
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_STATUS, 1, &status_code);
+
+
+	// Extended Listen Timing ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+	
+	return len;
+	
+}
+
+u32 build_deauth_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u32 len=0;
+	
+	return len;
+}
+
+u32 process_probe_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{	
+	u8 *p;
+	u32 ret=_FALSE;
+	u8 *p2pie;
+	u32	p2pielen = 0;
+	int ssid_len=0, rate_cnt = 0;
+
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SUPPORTEDRATES_IE_, (int *)&rate_cnt,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+	if ( rate_cnt <= 4 )
+	{
+		int i, g_rate =0;
+
+		for( i = 0; i < rate_cnt; i++ )
+		{
+			if ( ( ( *( p + 2 + i ) & 0xff ) != 0x02 ) &&
+				( ( *( p + 2 + i ) & 0xff ) != 0x04 ) &&
+				( ( *( p + 2 + i ) & 0xff ) != 0x0B ) &&
+				( ( *( p + 2 + i ) & 0xff ) != 0x16 ) )
+			{
+				g_rate = 1;
+			}
+		}
+
+		if ( g_rate == 0 )
+		{
+			//	There is no OFDM rate included in SupportedRates IE of this probe request frame
+			//	The driver should response this probe request.
+			return ret;
+		}
+	}
+	else
+	{
+		//	rate_cnt > 4 means the SupportRates IE contains the OFDM rate because the count of CCK rates are 4.
+		//	We should proceed the following check for this probe request.
+	}
+
+	//	Added comments by Albert 20100906
+	//	There are several items we should check here.
+	//	1. This probe request frame must contain the P2P IE. (Done)
+	//	2. This probe request frame must contain the wildcard SSID. (Done)
+	//	3. Wildcard BSSID. (Todo)
+	//	4. Destination Address. ( Done in mgt_dispatcher function )
+	//	5. Requested Device Type in WSC IE. (Todo)
+	//	6. Device ID attribute in P2P IE. (Todo)
+
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ssid_len,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);	
+
+	ssid_len &= 0xff;	//	Just last 1 byte is valid for ssid len of the probe request
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) || rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		if((p2pie=rtw_get_p2p_ie( pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_ , len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_ , NULL, &p2pielen)))
+		{
+			if ( (p != NULL) && _rtw_memcmp( ( void * ) ( p+2 ), ( void * ) pwdinfo->p2p_wildcard_ssid , 7 ))
+			{
+				//todo:
+				//Check Requested Device Type attributes in WSC IE.
+				//Check Device ID attribute in P2P IE
+
+				ret = _TRUE;			
+			}		
+			else if ( (p != NULL) && ( ssid_len == 0 ) )
+			{
+				ret = _TRUE;
+			}
+		}
+		else
+		{
+			//non -p2p device
+		}
+		
+	}	
+
+	
+	return ret;
+	
+}
+
+u32 process_assoc_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len, struct sta_info *psta)
+{
+	u8 status_code = P2P_STATUS_SUCCESS;
+	u8 *pbuf, *pattr_content=NULL;
+	u32 attr_contentlen = 0;
+	u16 cap_attr=0;
+	unsigned short	frame_type, ie_offset=0;
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+	u32	p2p_ielen = 0;
+
+	if(!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+		return P2P_STATUS_FAIL_REQUEST_UNABLE;
+
+	frame_type = GetFrameSubType(pframe);
+	if (frame_type == WIFI_ASSOCREQ)
+	{
+		ie_offset = _ASOCREQ_IE_OFFSET_;
+	}	
+	else // WIFI_REASSOCREQ
+	{
+		ie_offset = _REASOCREQ_IE_OFFSET_;
+	}
+	
+	ies = pframe + WLAN_HDR_A3_LEN + ie_offset;
+	ies_len = len - WLAN_HDR_A3_LEN - ie_offset;
+
+	p2p_ie = rtw_get_p2p_ie(ies , ies_len , NULL, &p2p_ielen);
+
+	if ( !p2p_ie )
+	{
+		DBG_8192C( "[%s] P2P IE not Found!!\n", __FUNCTION__ );
+		status_code =  P2P_STATUS_FAIL_INVALID_PARAM;
+	}
+	else
+	{
+		DBG_8192C( "[%s] P2P IE Found!!\n", __FUNCTION__ );
+	}
+	
+	while ( p2p_ie )
+	{
+		//Check P2P Capability ATTR
+		if( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*) &attr_contentlen) )
+		{
+			DBG_8192C( "[%s] Got P2P Capability Attr!!\n", __FUNCTION__ );
+			cap_attr = le16_to_cpu(cap_attr);
+			psta->dev_cap = cap_attr&0xff;
+		}
+
+		//Check Extended Listen Timing ATTR
+	
+
+		//Check P2P Device Info ATTR
+		if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_INFO, NULL, (uint*)&attr_contentlen))
+		{
+			DBG_8192C( "[%s] Got P2P DEVICE INFO Attr!!\n", __FUNCTION__ );		
+			pattr_content = pbuf = rtw_zmalloc(attr_contentlen);
+			if(pattr_content)
+			{
+				u8 num_of_secdev_type;
+				u16 dev_name_len;
+			
+		
+				rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_INFO , pattr_content, (uint*)&attr_contentlen);
+
+				_rtw_memcpy(psta->dev_addr, 	pattr_content, ETH_ALEN);//P2P Device Address
+
+				pattr_content += ETH_ALEN;
+
+				_rtw_memcpy(&psta->config_methods, pattr_content, 2);//Config Methods
+				psta->config_methods = be16_to_cpu(psta->config_methods);
+
+				pattr_content += 2;
+
+				_rtw_memcpy(psta->primary_dev_type, pattr_content, 8);
+
+				pattr_content += 8;
+
+				num_of_secdev_type = *pattr_content;
+				pattr_content += 1;
+
+				if(num_of_secdev_type==0)
+				{
+					psta->num_of_secdev_type = 0;
+				}
+				else
+				{
+					u32 len;
+
+					psta->num_of_secdev_type = num_of_secdev_type;
+
+					len = (sizeof(psta->secdev_types_list)<(num_of_secdev_type*8)) ? (sizeof(psta->secdev_types_list)) : (num_of_secdev_type*8);
+
+					_rtw_memcpy(psta->secdev_types_list, pattr_content, len);
+	
+					pattr_content += (num_of_secdev_type*8);
+				}
+
+
+				//dev_name_len = attr_contentlen - ETH_ALEN - 2 - 8 - 1 - (num_of_secdev_type*8);
+				psta->dev_name_len=0;
+				if(WPS_ATTR_DEVICE_NAME == be16_to_cpu(*(u16*)pattr_content))
+				{				
+					dev_name_len = be16_to_cpu(*(u16*)(pattr_content+2));
+
+					psta->dev_name_len = (sizeof(psta->dev_name)<dev_name_len) ? sizeof(psta->dev_name):dev_name_len;
+
+					_rtw_memcpy(psta->dev_name, pattr_content+4, psta->dev_name_len);
+				}
+
+				rtw_mfree(pbuf, attr_contentlen);
+
+			}
+
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+		
+	}
+
+	return status_code;
+
+}
+
+u32 process_p2p_devdisc_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	u8 *frame_body;
+	u8 status, dialogToken;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = pwdinfo->padapter;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *p2p_ie;
+	u32	p2p_ielen = 0;	
+	
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	dialogToken = frame_body[7];
+	status = P2P_STATUS_FAIL_UNKNOWN_P2PGROUP;
+		
+	if ( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)) )
+	{
+		u8 groupid[ 38 ] = { 0x00 };
+		u8 dev_addr[ETH_ALEN] = { 0x00 };		
+		u32	attr_contentlen = 0;
+
+		if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, groupid, &attr_contentlen))
+		{
+			if(_rtw_memcmp(pwdinfo->device_addr, groupid, ETH_ALEN) && 
+				_rtw_memcmp(pwdinfo->p2p_group_ssid, groupid+ETH_ALEN, pwdinfo->p2p_group_ssid_len))
+			{
+				attr_contentlen=0;
+				if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_ID, dev_addr, &attr_contentlen))
+				{
+					_irqL irqL;
+					_list	*phead, *plist;					
+
+					_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+					phead = &pstapriv->asoc_list;
+					plist = get_next(phead);
+
+					//look up sta asoc_queue
+					while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)	
+					{		
+						psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		
+						plist = get_next(plist);
+
+						if(psta->is_p2p_device && (psta->dev_cap&P2P_DEVCAP_CLIENT_DISCOVERABILITY) &&
+							_rtw_memcmp(psta->dev_addr, dev_addr, ETH_ALEN))
+						{
+
+							//_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+							//issue GO Discoverability Request
+							issue_group_disc_req(pwdinfo, psta->hwaddr);
+							//_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+							
+							status = P2P_STATUS_SUCCESS;
+							
+							break;
+						}
+						else
+						{
+							status = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+						}
+		
+					}				
+					_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+					
+				}
+				else
+				{
+					status = P2P_STATUS_FAIL_INVALID_PARAM;
+				}
+
+			}
+			else
+			{
+				status = P2P_STATUS_FAIL_INVALID_PARAM;
+			}
+			
+		}	
+		
+	}
+
+	
+	//issue Device Discoverability Response
+	issue_p2p_devdisc_resp(pwdinfo, GetAddr2Ptr(pframe), status, dialogToken);
+	
+	
+	return (status==P2P_STATUS_SUCCESS) ? _TRUE:_FALSE;
+	
+}
+
+u32 process_p2p_devdisc_resp(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	return _TRUE;
+}
+
+u8 process_p2p_provdisc_req(struct wifidirect_info *pwdinfo,  u8 *pframe, uint len )
+{
+	u8 *frame_body;
+	u8 *wpsie;
+	uint	wps_ielen = 0, attr_contentlen = 0;
+	u16	uconfig_method = 0;
+	
+
+	frame_body = (pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	if ( (wpsie=rtw_get_wps_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &wps_ielen)) )
+	{
+		if ( rtw_get_wps_attr_content( wpsie, wps_ielen, WPS_ATTR_CONF_METHOD , ( u8* ) &uconfig_method, &attr_contentlen) )
+		{
+			uconfig_method = be16_to_cpu( uconfig_method );
+			switch( uconfig_method )
+			{
+				case WPS_CM_DISPLYA:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "dis", 3 );
+					break;
+				}
+				case WPS_CM_LABEL:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "lab", 3 );
+					break;
+				}
+				case WPS_CM_PUSH_BUTTON:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pbc", 3 );
+					break;
+				}
+				case WPS_CM_KEYPAD:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pad", 3 );
+					break;
+				}
+			}
+			issue_p2p_provision_resp( pwdinfo, GetAddr2Ptr(pframe), frame_body, uconfig_method);
+		}
+	}
+	DBG_871X( "[%s] config method = %s\n", __FUNCTION__, pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req );
+	return _TRUE;
+	
+}
+	
+u8 process_p2p_provdisc_resp(struct wifidirect_info *pwdinfo,  u8 *pframe)
+{
+
+	return _TRUE;
+}
+
+u8 rtw_p2p_get_peer_ch_list(struct wifidirect_info *pwdinfo, u8 *ch_content, u8 ch_cnt, u8 *peer_ch_list)
+{
+	u8 i = 0, j = 0;
+	u8 temp = 0;
+	u8 ch_no = 0;
+	ch_content += 3;
+	ch_cnt -= 3;
+
+	while( ch_cnt > 0)
+	{
+		ch_content += 1;
+		ch_cnt -= 1;
+		temp = *ch_content;
+		for( i = 0 ; i < temp ; i++, j++ )
+		{
+			peer_ch_list[j] = *( ch_content + 1 + i );
+		}
+		ch_content += (temp + 1);
+		ch_cnt -= (temp + 1);
+		ch_no += temp ;
+	}
+
+	return ch_no;
+}
+
+u8 rtw_p2p_check_peer_oper_ch(struct mlme_ext_priv *pmlmeext, u8 ch)
+{
+	u8 i = 0;
+
+	for( i = 0; i < pmlmeext->max_chan_nums; i++ )
+	{
+		if ( pmlmeext->channel_set[ i ].ChannelNum == ch )
+		{
+			return _SUCCESS;
+		}
+	}
+
+	return _FAIL;
+}
+
+u8 rtw_p2p_ch_inclusion(struct mlme_ext_priv *pmlmeext, u8 *peer_ch_list, u8 peer_ch_num, u8 *ch_list_inclusioned)
+{
+	int	i = 0, j = 0, temp = 0;
+	u8 ch_no = 0;
+
+	for( i = 0; i < peer_ch_num; i++ )
+	{
+		for( j = temp; j < pmlmeext->max_chan_nums; j++ )
+		{
+			if( *( peer_ch_list + i ) == pmlmeext->channel_set[ j ].ChannelNum )
+			{
+				ch_list_inclusioned[ ch_no++ ] = *( peer_ch_list + i );
+				temp = j;
+				break;
+			}
+		}
+	}
+
+	return ch_no;
+}
+
+u8 process_p2p_group_negotation_req( struct wifidirect_info *pwdinfo, u8 *pframe, uint len )
+{
+	_adapter *padapter = pwdinfo->padapter;
+	u8	result = P2P_STATUS_SUCCESS;
+	u32	p2p_ielen = 0, wps_ielen = 0;
+	u8 * ies;
+	u32 ies_len;
+	u8 *p2p_ie;
+	u8 *wpsie;
+	u16		wps_devicepassword_id = 0x0000;
+	uint	wps_devicepassword_id_len = 0;
+#ifdef CONFIG_WFD
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+#endif // CONFIG_TDLS	
+#endif // CONFIG_WFD
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = pwdinfo->padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif
+
+	if ( (wpsie=rtw_get_wps_ie( pframe + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &wps_ielen)) )
+	{
+		//	Commented by Kurt 20120113
+		//	If some device wants to do p2p handshake without sending prov_disc_req
+		//	We have to get peer_req_cm from here.
+		if(_rtw_memcmp( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "000", 3) )
+		{
+			rtw_get_wps_attr_content( wpsie, wps_ielen, WPS_ATTR_DEVICE_PWID, (u8*) &wps_devicepassword_id, &wps_devicepassword_id_len);
+			wps_devicepassword_id = be16_to_cpu( wps_devicepassword_id );
+
+			if ( wps_devicepassword_id == WPS_DPID_USER_SPEC )
+			{
+				_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "dis", 3 );
+			}
+			else if ( wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC )
+			{
+				_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pad", 3 );	
+			}
+			else
+			{
+				_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pbc", 3 );	
+			}
+		}
+	}
+	else
+	{
+		DBG_871X( "[%s] WPS IE not Found!!\n", __FUNCTION__ );
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+		return( result );
+	}
+
+	if ( pwdinfo->ui_got_wps_info == P2P_NO_WPSINFO )
+	{
+		result = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_TX_INFOR_NOREADY);
+		return( result );
+	}
+
+	ies = pframe + _PUBLIC_ACTION_IE_OFFSET_;
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+					
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	if ( !p2p_ie )
+	{
+		DBG_871X( "[%s] P2P IE not Found!!\n", __FUNCTION__ );
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+	}
+	
+	while ( p2p_ie )
+	{
+		u8	attr_content = 0x00;
+		u32	attr_contentlen = 0;						
+		u8	ch_content[100] = { 0x00 };
+		uint	ch_cnt = 0;
+		u8	peer_ch_list[100] = { 0x00 };
+		u8	peer_ch_num = 0;
+		u8	ch_list_inclusioned[100] = { 0x00 };
+		u8	ch_num_inclusioned = 0;
+		u16	cap_attr;
+
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_ING);
+
+		//Check P2P Capability ATTR
+		if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*)&attr_contentlen) )
+		{
+			cap_attr = le16_to_cpu(cap_attr);
+	
+#if defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+			if(!(cap_attr & P2P_GRPCAP_INTRABSS) )
+				ptdlsinfo->ap_prohibited = _TRUE;
+#endif //defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+		}
+
+		if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT , &attr_content, &attr_contentlen) )
+		{
+			DBG_871X( "[%s] GO Intent = %d, tie = %d\n", __FUNCTION__, attr_content >> 1, attr_content & 0x01 );
+			pwdinfo->peer_intent = attr_content;	//	include both intent and tie breaker values.
+
+			if ( pwdinfo->intent == ( pwdinfo->peer_intent >> 1 ) )
+			{
+				//	Try to match the tie breaker value
+				if ( pwdinfo->intent == P2P_MAX_INTENT )
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+					result = P2P_STATUS_FAIL_BOTH_GOINTENT_15;
+				}
+				else
+				{
+					if ( attr_content & 0x01 )
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+					}
+					else
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+					}
+				}							
+			}
+			else if ( pwdinfo->intent > ( pwdinfo->peer_intent >> 1 ) )
+			{
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+			}
+			else
+			{
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+			}
+
+			if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+			{
+				//	Store the group id information.
+				_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, pwdinfo->device_addr, ETH_ALEN );
+				_rtw_memcpy( pwdinfo->groupid_info.ssid, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );		
+			}
+		}
+
+		
+		attr_contentlen = 0;
+		if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_INTENTED_IF_ADDR, pwdinfo->p2p_peer_interface_addr, &attr_contentlen ) )
+		{
+			if ( attr_contentlen != ETH_ALEN )
+			{
+				_rtw_memset( pwdinfo->p2p_peer_interface_addr, 0x00, ETH_ALEN );
+			}
+		}
+
+		if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, ch_content, &ch_cnt) )
+		{
+			peer_ch_num = rtw_p2p_get_peer_ch_list(pwdinfo, ch_content, ch_cnt, peer_ch_list);
+			ch_num_inclusioned = rtw_p2p_ch_inclusion(&padapter->mlmeextpriv, peer_ch_list, peer_ch_num, ch_list_inclusioned);
+
+			if( ch_num_inclusioned == 0)
+			{
+				DBG_871X( "[%s] No common channel in channel list!\n", __FUNCTION__ );
+				result = P2P_STATUS_FAIL_NO_COMMON_CH;
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+				break;
+			}
+
+			if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+			{
+				if ( !rtw_p2p_is_channel_list_ok( pwdinfo->operating_channel, 
+												ch_list_inclusioned, ch_num_inclusioned) )
+				{
+#ifdef CONFIG_CONCURRENT_MODE
+					if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+					{
+						DBG_871X( "[%s] desired channel NOT Found!\n", __FUNCTION__ );
+						result = P2P_STATUS_FAIL_NO_COMMON_CH;
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+						break;
+					}
+					else
+#endif //CONFIG_CONCURRENT_MODE
+					{
+						u8 operatingch_info[5] = { 0x00 }, peer_operating_ch = 0;
+						attr_contentlen = 0;
+
+						if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+						{		
+							peer_operating_ch = operatingch_info[4];
+						}
+
+						if ( rtw_p2p_is_channel_list_ok( peer_operating_ch, 
+														ch_list_inclusioned, ch_num_inclusioned) )
+						{
+							/**
+							 *	Change our operating channel as peer's for compatibility.
+							 */
+							pwdinfo->operating_channel = peer_operating_ch;
+							DBG_871X( "[%s] Change op ch to %02x as peer's\n", __FUNCTION__, pwdinfo->operating_channel);
+						}
+						else
+						{
+							// Take first channel of ch_list_inclusioned as operating channel
+							pwdinfo->operating_channel = ch_list_inclusioned[0];
+							DBG_871X( "[%s] Change op ch to %02x\n", __FUNCTION__, pwdinfo->operating_channel);
+						}
+					}
+
+				}
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+	
+#ifdef CONFIG_WFD
+	//	Added by Albert 20110823
+	//	Try to get the TCP port information when receiving the negotiation request.
+	if ( rtw_get_wfd_ie( pframe + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, wfd_ie, &wfd_ielen ) )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		DBG_871X( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_871X( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+		}
+	}
+#endif // CONFIG_WFD
+
+	return( result );
+}
+
+u8 process_p2p_group_negotation_resp( struct wifidirect_info *pwdinfo, u8 *pframe, uint len )
+{
+	_adapter *padapter = pwdinfo->padapter;
+	u8	result = P2P_STATUS_SUCCESS;
+	u32	p2p_ielen, wps_ielen;
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+#ifdef CONFIG_WFD
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+#endif // CONFIG_TDLS	
+#endif // CONFIG_WFD	
+
+	ies = pframe + _PUBLIC_ACTION_IE_OFFSET_;
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	//	Be able to know which one is the P2P GO and which one is P2P client.
+					
+	if ( rtw_get_wps_ie( ies, ies_len, NULL, &wps_ielen) )
+	{
+
+	}
+	else
+	{
+		DBG_871X( "[%s] WPS IE not Found!!\n", __FUNCTION__ );
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+	}
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+	if ( !p2p_ie )
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+	}
+	else
+	{
+
+		u8	attr_content = 0x00;
+		u32	attr_contentlen = 0;
+		u8	operatingch_info[5] = { 0x00 };
+		uint	ch_cnt = 0;
+		u8	ch_content[100] = { 0x00 };
+		u8	groupid[ 38 ];
+		u16	cap_attr;
+		u8	peer_ch_list[100] = { 0x00 };
+		u8	peer_ch_num = 0;
+		u8	ch_list_inclusioned[100] = { 0x00 };
+		u8	ch_num_inclusioned = 0;
+
+		while ( p2p_ie )	//	Found the P2P IE.
+		{
+
+			//Check P2P Capability ATTR
+			if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*)&attr_contentlen) )
+			{
+				cap_attr = le16_to_cpu(cap_attr);
+#if defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+			if(!(cap_attr & P2P_GRPCAP_INTRABSS) )
+				ptdlsinfo->ap_prohibited = _TRUE;
+#endif //defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+			}
+
+			rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, &attr_content, &attr_contentlen);
+			if ( attr_contentlen == 1 )
+			{			
+				DBG_871X( "[%s] Status = %d\n", __FUNCTION__, attr_content );
+				if ( attr_content == P2P_STATUS_SUCCESS )
+				{
+					//	Do nothing.
+				}
+				else
+				{
+					if ( P2P_STATUS_FAIL_INFO_UNAVAILABLE == attr_content ) {
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_RX_INFOR_NOREADY);
+					} else {
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+					}
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+					result = attr_content;
+					break;
+				}
+			}
+
+			//	Try to get the peer's interface address
+			attr_contentlen = 0;
+			if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_INTENTED_IF_ADDR, pwdinfo->p2p_peer_interface_addr, &attr_contentlen ) )
+			{
+				if ( attr_contentlen != ETH_ALEN )
+				{
+					_rtw_memset( pwdinfo->p2p_peer_interface_addr, 0x00, ETH_ALEN );
+				}
+			}
+			
+			//	Try to get the peer's intent and tie breaker value.
+			attr_content = 0x00;
+			attr_contentlen = 0;
+			if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT , &attr_content, &attr_contentlen) )
+			{
+				DBG_871X( "[%s] GO Intent = %d, tie = %d\n", __FUNCTION__, attr_content >> 1, attr_content & 0x01 );
+				pwdinfo->peer_intent = attr_content;	//	include both intent and tie breaker values.
+
+				if ( pwdinfo->intent == ( pwdinfo->peer_intent >> 1 ) )
+				{
+					//	Try to match the tie breaker value
+					if ( pwdinfo->intent == P2P_MAX_INTENT )
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+						result = P2P_STATUS_FAIL_BOTH_GOINTENT_15;
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+					}
+					else
+					{
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+						rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+						if ( attr_content & 0x01 )
+						{
+							rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+						}
+						else
+						{
+							rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+						}
+					}							
+				}
+				else if ( pwdinfo->intent > ( pwdinfo->peer_intent >> 1 ) )
+				{
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+				}
+				else
+				{
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+				}
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					//	Store the group id information.
+					_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, pwdinfo->device_addr, ETH_ALEN );
+					_rtw_memcpy( pwdinfo->groupid_info.ssid, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+		
+				}
+			}
+			
+			//	Try to get the operation channel information
+					
+			attr_contentlen = 0;
+			if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen))
+			{
+				DBG_871X( "[%s] Peer's operating channel = %d\n", __FUNCTION__, operatingch_info[4] );
+				pwdinfo->peer_operating_ch = operatingch_info[4];
+			}
+			
+			//	Try to get the channel list information
+			if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, pwdinfo->channel_list_attr, &pwdinfo->channel_list_attr_len ) )
+			{
+				DBG_871X( "[%s] channel list attribute found, len = %d\n", __FUNCTION__,  pwdinfo->channel_list_attr_len );
+
+				peer_ch_num = rtw_p2p_get_peer_ch_list(pwdinfo, pwdinfo->channel_list_attr, pwdinfo->channel_list_attr_len, peer_ch_list);
+				ch_num_inclusioned = rtw_p2p_ch_inclusion(&padapter->mlmeextpriv, peer_ch_list, peer_ch_num, ch_list_inclusioned);
+
+				if( ch_num_inclusioned == 0)
+				{
+					DBG_871X( "[%s] No common channel in channel list!\n", __FUNCTION__ );
+					result = P2P_STATUS_FAIL_NO_COMMON_CH;
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+					break;
+				}
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					if ( !rtw_p2p_is_channel_list_ok( pwdinfo->operating_channel, 
+													ch_list_inclusioned, ch_num_inclusioned) )
+					{
+#ifdef CONFIG_CONCURRENT_MODE
+						if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+						{
+							DBG_871X( "[%s] desired channel NOT Found!\n", __FUNCTION__ );
+							result = P2P_STATUS_FAIL_NO_COMMON_CH;
+							rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+							break;
+						}
+						else
+#endif //CONFIG_CONCURRENT_MODE
+						{
+							u8 operatingch_info[5] = { 0x00 }, peer_operating_ch = 0;
+							attr_contentlen = 0;
+
+							if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+							{		
+								peer_operating_ch = operatingch_info[4];
+							}
+
+							if ( rtw_p2p_is_channel_list_ok( peer_operating_ch, 
+															ch_list_inclusioned, ch_num_inclusioned) )
+							{
+								/**
+								 *	Change our operating channel as peer's for compatibility.
+								 */
+								pwdinfo->operating_channel = peer_operating_ch;
+								DBG_871X( "[%s] Change op ch to %02x as peer's\n", __FUNCTION__, pwdinfo->operating_channel);
+							}
+							else
+							{
+								// Take first channel of ch_list_inclusioned as operating channel
+								pwdinfo->operating_channel = ch_list_inclusioned[0];
+								DBG_871X( "[%s] Change op ch to %02x\n", __FUNCTION__, pwdinfo->operating_channel);
+							}
+						}
+
+					}
+				}
+
+			}
+			else
+			{
+				DBG_871X( "[%s] channel list attribute not found!\n", __FUNCTION__);
+			}
+
+			//	Try to get the group id information if peer is GO
+			attr_contentlen = 0;
+			_rtw_memset( groupid, 0x00, 38 );
+			if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, groupid, &attr_contentlen) )
+			{
+				_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, &groupid[0], ETH_ALEN );
+				_rtw_memcpy( pwdinfo->groupid_info.ssid, &groupid[6], attr_contentlen - ETH_ALEN );
+			}
+			
+			//Get the next P2P IE
+			p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+		}
+		
+	}
+
+#ifdef CONFIG_WFD
+	//	Added by Albert 20111122
+	//	Try to get the TCP port information when receiving the negotiation response.
+	if ( rtw_get_wfd_ie( pframe + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, wfd_ie, &wfd_ielen ) )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		DBG_8192C( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_8192C( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+		}
+	}
+#endif // CONFIG_WFD
+
+	return( result );
+
+}
+
+u8 process_p2p_group_negotation_confirm( struct wifidirect_info *pwdinfo, u8 *pframe, uint len )
+{
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+	u32	p2p_ielen = 0;
+	u8	result = P2P_STATUS_SUCCESS;
+	ies = pframe + _PUBLIC_ACTION_IE_OFFSET_;
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+	while ( p2p_ie )	//	Found the P2P IE.
+	{
+		u8	attr_content = 0x00, operatingch_info[5] = { 0x00 };
+		u8	groupid[ 38 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		pwdinfo->negotiation_dialog_token = 1;
+		rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, &attr_content, &attr_contentlen);
+		if ( attr_contentlen == 1 )
+		{
+			DBG_871X( "[%s] Status = %d\n", __FUNCTION__, attr_content );
+			result = attr_content;
+
+			if ( attr_content == P2P_STATUS_SUCCESS )
+			{
+				u8	bcancelled = 0;
+																
+				_cancel_timer( &pwdinfo->restore_p2p_state_timer, &bcancelled );
+
+				//	Commented by Albert 20100911
+				//	Todo: Need to handle the case which both Intents are the same.
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+				rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+				if ( ( pwdinfo->intent ) > ( pwdinfo->peer_intent >> 1 ) )
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+				}
+				else if ( ( pwdinfo->intent ) < ( pwdinfo->peer_intent >> 1 ) )
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+				}
+				else
+				{
+					//	Have to compare the Tie Breaker
+					if ( pwdinfo->peer_intent & 0x01 )
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+					}
+					else
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+					}
+				}								
+				
+#ifdef CONFIG_CONCURRENT_MODE
+				if ( check_buddy_fwstate(pwdinfo->padapter , _FW_LINKED ) )
+				{
+					//	Switch back to the AP channel soon.
+					_set_timer( &pwdinfo->ap_p2p_switch_timer, 100 );
+				}
+#endif				
+			}
+			else
+			{
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+				break;
+			}
+		}
+
+		//	Try to get the group id information
+		attr_contentlen = 0;
+		_rtw_memset( groupid, 0x00, 38 );
+		if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, groupid, &attr_contentlen) )
+		{
+			DBG_871X( "[%s] Ssid = %s, ssidlen = %d\n", __FUNCTION__, &groupid[ETH_ALEN], (u32)strlen(&groupid[ETH_ALEN]) );
+			_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, &groupid[0], ETH_ALEN );
+			_rtw_memcpy( pwdinfo->groupid_info.ssid, &groupid[6], attr_contentlen - ETH_ALEN );			
+		}
+
+		attr_contentlen = 0;
+		if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+		{		
+			DBG_871X( "[%s] Peer's operating channel = %d\n", __FUNCTION__, operatingch_info[4] );
+			pwdinfo->peer_operating_ch = operatingch_info[4];
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+		
+	}
+
+	return( result );
+}
+
+u8 process_p2p_presence_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	u8 *frame_body;	
+	u8 dialogToken=0;
+	u8 status = P2P_STATUS_SUCCESS;
+	
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	dialogToken = frame_body[6];
+
+	//todo: check NoA attribute
+
+	issue_p2p_presence_resp(pwdinfo, GetAddr2Ptr(pframe), status, dialogToken);
+
+	return _TRUE;
+}
+
+void find_phase_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	NDIS_802_11_SSID 	ssid;
+	_irqL				irqL;
+	u8					_status = 0;
+
+_func_enter_;
+
+	_rtw_memset((unsigned char*)&ssid, 0, sizeof(NDIS_802_11_SSID));
+	_rtw_memcpy(ssid.Ssid, pwdinfo->p2p_wildcard_ssid, P2P_WILDCARD_SSID_LEN );
+	ssid.SsidLength = P2P_WILDCARD_SSID_LEN;
+
+	rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+		
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_status = rtw_sitesurvey_cmd(padapter, &ssid, 1, NULL, 0);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+_func_exit_;
+}
+
+void p2p_concurrent_handler(  _adapter* padapter );
+
+void restore_p2p_state_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;	
+	
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_RSP))
+		{
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			
+			issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+		}
+	}
+#endif
+
+	rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+	
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE))
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		p2p_concurrent_handler( padapter );
+#else
+		//	In the P2P client mode, the driver should not switch back to its listen channel
+		//	because this P2P client should stay at the operating channel of P2P GO.
+		set_channel_bwmode( padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+#endif
+	}
+_func_exit_;
+}
+
+void pre_tx_invitereq_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	u8	val8 = 1;
+_func_enter_;
+
+	set_channel_bwmode(padapter, pwdinfo->invitereq_info.peer_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));	
+	issue_probereq_p2p(padapter, NULL);
+	_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+	
+_func_exit_;
+}
+
+void pre_tx_provdisc_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	u8	val8 = 1;
+_func_enter_;
+
+	set_channel_bwmode(padapter, pwdinfo->tx_prov_disc_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+	issue_probereq_p2p(padapter, NULL);
+	_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+	
+_func_exit_;
+}
+
+void pre_tx_negoreq_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	u8	val8 = 1;
+_func_enter_;
+
+	set_channel_bwmode(padapter, pwdinfo->nego_req_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));	
+	issue_probereq_p2p(padapter, NULL);
+	_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+	
+_func_exit_;
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+void p2p_concurrent_handler( _adapter*	padapter )
+{
+	struct wifidirect_info	*pwdinfo = &padapter->wdinfo;
+	//_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	//struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	//struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	//struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	u8					val8;
+_func_enter_;
+
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;			
+		struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		pwdinfo->operating_channel = pbuddy_mlmeext->cur_channel;
+
+		if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			DBG_871X("%s, switch ch back to buddy's cur_channel=%d\n", __func__, pbuddy_mlmeext->cur_channel);
+
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+		
+			issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+		}
+		else if( pwdinfo->driver_interface == DRIVER_WEXT )
+		{
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+			{
+				//	Now, the driver stays on the AP's channel.
+				//	If the pwdinfo->ext_listen_period = 0, that means the P2P listen state is not available on listen channel.
+				if ( pwdinfo->ext_listen_period > 0 )
+				{
+					DBG_8192C( "[%s] P2P_STATE_IDLE, ext_listen_period = %d\n", __FUNCTION__, pwdinfo->ext_listen_period );
+
+					if ( pbuddy_mlmeext->cur_channel != pwdinfo->listen_channel )
+					{
+						//	Will switch to listen channel so that need to send the NULL data with PW bit to AP.
+						issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+						set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+					}
+
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+					val8 = 1;
+					rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+					//	Todo: To check the value of pwdinfo->ext_listen_period is equal to 0 or not.
+					_set_timer( &pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_period );
+				}
+			}
+			else if ( rtw_p2p_chk_state(pwdinfo, P2P_STATE_LISTEN) || 
+					rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL) ||
+					( rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) && pwdinfo->nego_req_info.benable == _FALSE ) ||
+					rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ) )
+			{
+				//	Now, the driver is in the listen state of P2P mode.
+				DBG_8192C( "[%s] P2P_STATE_IDLE, ext_listen_interval = %d\n", __FUNCTION__, pwdinfo->ext_listen_interval );
+
+				//	Commented by Albert 2012/11/01
+				//	If the AP's channel is the same as the listen channel, we should still be in the listen state
+				//	Other P2P device is still able to find this device out even this device is in the AP's channel.
+				//	So, configure this device to be able to receive the probe request frame and set it to listen state.
+				if ( pbuddy_mlmeext->cur_channel != pwdinfo->listen_channel )
+				{
+					set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+					val8 = 0;
+					padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_IDLE);
+					issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+				}
+
+				//	Todo: To check the value of pwdinfo->ext_listen_interval is equal to 0 or not.
+				_set_timer( &pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_interval );
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_OK))
+			{
+				//	The driver had finished the P2P handshake successfully.
+				val8 = 0;
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+				issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+			{
+				val8 = 1;
+				set_channel_bwmode(padapter, pwdinfo->tx_prov_disc_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				issue_probereq_p2p(padapter, NULL);
+				_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) && pwdinfo->nego_req_info.benable == _TRUE)
+			{
+				val8 = 1;
+				set_channel_bwmode(padapter, pwdinfo->nego_req_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				issue_probereq_p2p(padapter, NULL);
+				_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+			}		
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_INVITE_REQ ) && pwdinfo->invitereq_info.benable == _TRUE)
+			{
+				/*
+				val8 = 1;
+				set_channel_bwmode(padapter, , HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				issue_probereq_p2p(padapter, NULL);
+				_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+				*/
+			}
+		}
+	}	
+	else
+	{
+		set_channel_bwmode( padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);	
+	}
+	
+_func_exit_;
+}
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+static void ro_ch_handler(_adapter *padapter)
+{
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	u8 ch, bw, offset;
+_func_enter_;
+
+	if (rtw_get_ch_setting_union(padapter, &ch, &bw, &offset) != 0) {
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" back to linked union - ch:%u, bw:%u, offset:%u\n",
+			FUNC_ADPT_ARG(padapter), ch, bw, offset);
+	}
+	else if (wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->listen_channel) {
+		ch = pwdinfo->listen_channel;
+		bw = HT_CHANNEL_WIDTH_20;
+		offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" back to listen ch - ch:%u, bw:%u, offset:%u\n",
+			FUNC_ADPT_ARG(padapter), ch, bw, offset);
+	}
+	else {
+		ch = pcfg80211_wdinfo->restore_channel;
+		bw = HT_CHANNEL_WIDTH_20;
+		offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" back to restore ch - ch:%u, bw:%u, offset:%u\n",
+			FUNC_ADPT_ARG(padapter), ch, bw, offset);
+	}
+
+	set_channel_bwmode(padapter, ch, offset, bw);
+
+	rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+#endif
+
+	pcfg80211_wdinfo->is_ro_ch = _FALSE;
+
+	DBG_871X("cfg80211_remain_on_channel_expired\n");
+
+	rtw_cfg80211_remain_on_channel_expired(padapter, 
+		pcfg80211_wdinfo->remain_on_ch_cookie, 
+		&pcfg80211_wdinfo->remain_on_ch_channel,
+		pcfg80211_wdinfo->remain_on_ch_type, GFP_KERNEL);
+
+_func_exit_;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void ro_ch_timer_process (void *FunctionContext)
+#else
+static void ro_ch_timer_process(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_adapter *adapter = (_adapter *)FunctionContext;
+#else
+	_adapter *adapter = from_timer(adapter, t, cfg80211_wdinfo.remain_on_ch_timer);
+#endif
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(adapter->rtw_wdev);
+
+	//printk("%s \n", __FUNCTION__);
+	
+#ifdef	CONFIG_CONCURRENT_MODE
+	ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);
+#endif
+
+	p2p_protocol_wk_cmd( adapter, P2P_RO_CH_WK);
+}
+
+static void rtw_change_p2pie_op_ch(_adapter *padapter, const u8 *frame_body, u32 len, u8 ch)
+{
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while ( p2p_ie ) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_OPERATING_CH
+		attr_contentlen = 0;
+		pattr = NULL;
+		if((pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, (uint*)&attr_contentlen))!=NULL)
+		{
+			*(pattr+4) = ch;
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+}
+
+static void rtw_change_p2pie_ch_list(_adapter *padapter, const u8 *frame_body, u32 len, u8 ch)
+{
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while (p2p_ie) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_CH_LIST
+		if ((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, (uint*)&attr_contentlen))!=NULL) {
+			int i;
+			u32 num_of_ch;
+			u8 *pattr_temp = pattr + 3 ;
+
+			attr_contentlen -= 3;
+			
+			while (attr_contentlen>0) {
+				num_of_ch = *(pattr_temp+1);
+
+				for(i=0; i<num_of_ch; i++)
+					*(pattr_temp+2+i) = ch;
+
+				pattr_temp += (2+num_of_ch);
+				attr_contentlen -= (2+num_of_ch);
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+}
+
+static bool rtw_chk_p2pie_ch_list_with_buddy(_adapter *padapter, const u8 *frame_body, u32 len)
+{
+	bool fit = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	u8 buddy_ch = pbuddy_mlmeext->cur_channel;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while (p2p_ie) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_CH_LIST
+		if ((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, (uint*)&attr_contentlen))!=NULL) {
+			int i;
+			u32 num_of_ch;
+			u8 *pattr_temp = pattr + 3 ;
+
+			attr_contentlen -= 3;
+
+			while (attr_contentlen>0) {
+				num_of_ch = *(pattr_temp+1);
+
+				for(i=0; i<num_of_ch; i++) {
+					if (*(pattr_temp+2+i) == buddy_ch) {
+						DBG_871X(FUNC_ADPT_FMT" ch_list fit buddy_ch:%u\n", FUNC_ADPT_ARG(padapter), buddy_ch);
+						fit = _TRUE;
+						break;
+					}
+				}
+
+				pattr_temp += (2+num_of_ch);
+				attr_contentlen -= (2+num_of_ch);
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+#endif
+	return fit;
+}
+
+static bool rtw_chk_p2pie_op_ch_with_buddy(_adapter *padapter, const u8 *frame_body, u32 len)
+{
+	bool fit = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	u8 buddy_ch = pbuddy_mlmeext->cur_channel;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while (p2p_ie) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_OPERATING_CH
+		attr_contentlen = 0;
+		pattr = NULL;
+		if((pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, (uint*)&attr_contentlen))!=NULL) {
+			if (*(pattr+4) == buddy_ch) {
+				DBG_871X(FUNC_ADPT_FMT" op_ch fit buddy_ch:%u\n", FUNC_ADPT_ARG(padapter), buddy_ch);
+				fit = _TRUE;
+				break;
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+#endif
+	return fit;
+}
+
+static void rtw_cfg80211_adjust_p2pie_channel(_adapter *padapter, const u8 *frame_body, u32 len)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;			
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+					
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while ( p2p_ie )
+	{	
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+				
+		//Check P2P_ATTR_CH_LIST
+		if((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, (uint*)&attr_contentlen))!=NULL)
+		{
+			int i;
+			u32 num_of_ch;
+			u8 *pattr_temp = pattr + 3 ;
+
+			attr_contentlen -= 3;
+			
+			while(attr_contentlen>0)
+			{				
+				num_of_ch = *(pattr_temp+1);
+								
+				for(i=0; i<num_of_ch; i++)
+					*(pattr_temp+2+i) = pbuddy_mlmeext->cur_channel;//forcing to the same channel
+
+				pattr_temp += (2+num_of_ch);
+				attr_contentlen -= (2+num_of_ch);
+			}	
+		}
+
+		//Check P2P_ATTR_OPERATING_CH
+		attr_contentlen = 0;
+		pattr = NULL;
+		if((pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, (uint*)&attr_contentlen))!=NULL)
+		{
+			*(pattr+4) = pbuddy_mlmeext->cur_channel;//forcing to the same channel			
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+		
+	}
+
+#endif
+}
+
+#ifdef CONFIG_WFD
+void rtw_append_wfd_ie(_adapter *padapter, u8 *buf, u32* len)
+{
+	unsigned char	*frame_body;
+	u8 category, action, OUI_Subtype, dialogToken=0;
+	u32	wfdielen = 0;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	
+	frame_body = (unsigned char *)(buf + sizeof(struct rtw_ieee80211_hdr_3addr));	
+	category = frame_body[0];
+
+	if(category == RTW_WLAN_CATEGORY_PUBLIC)
+	{
+		action = frame_body[1];
+		if (action == ACT_PUBLIC_VENDOR
+			&& _rtw_memcmp(frame_body+2, P2P_OUI, 4) == _TRUE
+		)
+		{
+			OUI_Subtype = frame_body[6];
+			dialogToken = frame_body[7];
+			switch( OUI_Subtype )//OUI Subtype
+			{
+				case P2P_GO_NEGO_REQ:
+				{
+					wfdielen = build_nego_req_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_GO_NEGO_RESP:
+				{
+					wfdielen = build_nego_resp_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_GO_NEGO_CONF:
+				{
+					wfdielen = build_nego_confirm_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_INVIT_REQ:
+				{
+					wfdielen = build_invitation_req_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_INVIT_RESP:
+				{
+					wfdielen = build_invitation_resp_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_DEVDISC_REQ:
+					break;
+				case P2P_DEVDISC_RESP:
+
+					break;
+				case P2P_PROVISION_DISC_REQ:
+				{
+					wfdielen = build_provdisc_req_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_PROVISION_DISC_RESP:
+				{
+					wfdielen = build_provdisc_resp_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				default:
+
+					break;	
+			}
+
+		}
+		
+	}	
+	else if(category == RTW_WLAN_CATEGORY_P2P)
+	{
+		OUI_Subtype = frame_body[5];
+		dialogToken = frame_body[6];
+
+#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("ACTION_CATEGORY_P2P: OUI=0x%x, OUI_Subtype=%d, dialogToken=%d\n",
+					cpu_to_be32( *( ( u32* ) ( frame_body + 1 ) ) ), OUI_Subtype, dialogToken);
+#endif
+
+		switch(OUI_Subtype)
+		{
+			case P2P_NOTICE_OF_ABSENCE:
+
+				break;			
+			case P2P_PRESENCE_REQUEST:
+
+				break;			
+			case P2P_PRESENCE_RESPONSE:
+
+				break;			
+			case P2P_GO_DISC_REQUEST:
+
+				break;			
+			default:
+
+				break;			
+		}	
+
+	}	
+	else 
+	{
+		DBG_871X("%s, action frame category=%d\n", __func__, category);
+		//is_p2p_frame = (-1);		
+	}
+
+	return;
+}
+#endif
+
+u8 *dump_p2p_attr_ch_list(u8 *p2p_ie, uint p2p_ielen, u8 *buf, u32 buf_len)
+{
+	uint attr_contentlen = 0;
+	u8 *pattr = NULL;
+	int w_sz = 0;
+	u8 ch_cnt = 0;
+	u8 ch_list[40];
+	bool continuous = _FALSE;
+
+	if ((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, &attr_contentlen))!=NULL) {
+		int i, j;
+		u32 num_of_ch;
+		u8 *pattr_temp = pattr + 3 ;
+
+		attr_contentlen -= 3;
+
+		_rtw_memset(ch_list, 0, 40);
+
+		while (attr_contentlen>0) {
+			num_of_ch = *(pattr_temp+1);
+							
+			for(i=0; i<num_of_ch; i++) {
+				for (j=0;j<ch_cnt;j++) {
+					if (ch_list[j] == *(pattr_temp+2+i))
+						break;
+				}
+				if (j>=ch_cnt)
+					ch_list[ch_cnt++] = *(pattr_temp+2+i);
+
+			}
+
+			pattr_temp += (2+num_of_ch);
+			attr_contentlen -= (2+num_of_ch);
+		}
+
+		for (j=0;j<ch_cnt;j++) {
+			if (j == 0) {
+				w_sz += snprintf(buf+w_sz, buf_len-w_sz, "%u", ch_list[j]);
+			} else if (ch_list[j] - ch_list[j-1] != 1) {
+				w_sz += snprintf(buf+w_sz, buf_len-w_sz, ", %u", ch_list[j]);
+			} else if (j != ch_cnt-1 && ch_list[j+1] - ch_list[j] == 1) {
+				/* empty */
+			} else {
+				w_sz += snprintf(buf+w_sz, buf_len-w_sz, "-%u", ch_list[j]);
+			}
+		}
+	}
+	return buf;
+}
+
+/*
+ * return _TRUE if requester is GO, _FALSE if responder is GO
+ */
+bool rtw_p2p_nego_intent_compare(u8 req, u8 resp)
+{
+	if (req>>1 == resp >>1)
+		return  req&0x01 ? _TRUE : _FALSE;
+	else if (req>>1 > resp>>1)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+int rtw_p2p_check_frames(_adapter *padapter, const u8 *buf, u32 len, u8 tx)
+{
+	int is_p2p_frame = (-1);
+	unsigned char	*frame_body;
+	u8 category, action, OUI_Subtype, dialogToken=0;
+	u8 *p2p_ie = NULL;
+	uint p2p_ielen = 0;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	int status = -1;
+	u8 ch_list_buf[128] = {'\0'};
+	int op_ch = -1;
+	int listen_ch = -1;
+	u8 intent = 0;
+	
+	frame_body = (unsigned char *)(buf + sizeof(struct rtw_ieee80211_hdr_3addr));	
+	category = frame_body[0];
+	//just for check
+	if(category == RTW_WLAN_CATEGORY_PUBLIC)
+	{
+		action = frame_body[1];
+		if (action == ACT_PUBLIC_VENDOR
+			&& _rtw_memcmp(frame_body+2, P2P_OUI, 4) == _TRUE
+		)
+		{
+			OUI_Subtype = frame_body[6];
+			dialogToken = frame_body[7];
+			is_p2p_frame = OUI_Subtype;
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_871X("ACTION_CATEGORY_PUBLIC: ACT_PUBLIC_VENDOR, OUI=0x%x, OUI_Subtype=%d, dialogToken=%d\n",
+				cpu_to_be32( *( ( u32* ) ( frame_body + 2 ) ) ), OUI_Subtype, dialogToken);
+			#endif
+
+			p2p_ie = rtw_get_p2p_ie(
+				(u8 *)buf+sizeof(struct rtw_ieee80211_hdr_3addr)+_PUBLIC_ACTION_IE_OFFSET_,
+				len-sizeof(struct rtw_ieee80211_hdr_3addr)-_PUBLIC_ACTION_IE_OFFSET_,
+				NULL, &p2p_ielen);
+
+			switch( OUI_Subtype )//OUI Subtype
+			{
+				u8 *cont;
+				uint cont_len;
+				case P2P_GO_NEGO_REQ:
+				{
+					struct rtw_wdev_nego_info* nego_info = &pwdev_priv->nego_info;
+
+					if (tx) {
+						#ifdef CONFIG_DRV_ISSUE_PROV_REQ // IOT FOR S2
+						if(pwdev_priv->provdisc_req_issued == _FALSE) {
+							rtw_cfg80211_issue_p2p_provision_request(padapter, buf, len);
+							pwdev_priv->provdisc_req_issued = _TRUE;
+							rtw_msleep_os(200);
+						}
+						#endif //CONFIG_DRV_ISSUE_PROV_REQ
+
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_LISTEN_CH, NULL, &cont_len)))
+						listen_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT, NULL, &cont_len)))
+						intent = *cont;
+
+					if (nego_info->token != dialogToken)
+						rtw_wdev_nego_info_init(nego_info);
+
+					_rtw_memcpy(nego_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN);
+					nego_info->active = tx ? 1 : 0;
+					nego_info->token = dialogToken;
+					nego_info->req_op_ch = op_ch;
+					nego_info->req_listen_ch = listen_ch;
+					nego_info->req_intent = intent;
+					nego_info->state = 0;
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_GO_NEGO_REQ, dialogToken=%d, intent:%u%s, listen_ch:%d, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, (intent>>1), intent&0x1 ? "+" : "-", listen_ch, op_ch, ch_list_buf);
+
+					if (!tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED)
+							&& rtw_chk_p2pie_ch_list_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE)
+						{
+							DBG_871X(FUNC_ADPT_FMT" ch_list has no intersect with buddy\n", FUNC_ADPT_ARG(padapter));
+							rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+						}
+						#endif
+					}
+
+					break;
+				}
+				case P2P_GO_NEGO_RESP:
+				{
+					struct rtw_wdev_nego_info* nego_info = &pwdev_priv->nego_info;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT, NULL, &cont_len)))
+						intent = *cont;
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len)))
+						status = *cont;
+
+					if (nego_info->token == dialogToken && nego_info->state == 0
+						&& _rtw_memcmp(nego_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN) == _TRUE
+					) {
+						nego_info->status = (status==-1) ? 0xff : status;
+						nego_info->rsp_op_ch= op_ch;
+						nego_info->rsp_intent = intent;
+						nego_info->state = 1;
+						if (status != 0)
+							nego_info->token = 0; /* init */
+					}
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_GO_NEGO_RESP, dialogToken=%d, intent:%u%s, status:%d, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, (intent>>1), intent&0x1 ? "+" : "-", status, op_ch, ch_list_buf);
+
+					if (!tx) {
+						pwdev_priv->provdisc_req_issued = _FALSE;
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED)
+							&& rtw_chk_p2pie_ch_list_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE)
+						{
+							DBG_871X(FUNC_ADPT_FMT" ch_list has no intersect with buddy\n", FUNC_ADPT_ARG(padapter));
+							rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+						}
+						#endif
+					}
+
+					break;
+				}
+				case P2P_GO_NEGO_CONF:
+				{
+					struct rtw_wdev_nego_info* nego_info = &pwdev_priv->nego_info;
+					bool is_go = _FALSE;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len)))
+						status = *cont;
+
+					if (nego_info->token == dialogToken && nego_info->state == 1
+						&& _rtw_memcmp(nego_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN) == _TRUE
+					) {
+						nego_info->status = (status==-1) ? 0xff : status;
+						nego_info->conf_op_ch = (op_ch==-1) ? 0 : op_ch;
+						nego_info->state = 2;
+
+						if (status == 0) {
+							if (rtw_p2p_nego_intent_compare(nego_info->req_intent, nego_info->rsp_intent) && tx)
+								is_go = _TRUE;
+						}
+
+						nego_info->token = 0; /* init */
+					}
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_GO_NEGO_CONF, dialogToken=%d, status:%d, op_ch:%d, ch_list:%s\n",
+						(tx==_TRUE)?"Tx":"Rx", dialogToken, status, op_ch, ch_list_buf);
+
+					if (!tx) {
+					}
+
+					break;
+				}
+				case P2P_INVIT_REQ:
+				{
+					struct rtw_wdev_invit_info* invit_info = &pwdev_priv->invit_info;
+					int flags = -1;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_INVITATION_FLAGS, NULL, &cont_len)))
+						flags = *cont;
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+
+					if (invit_info->token != dialogToken)
+						rtw_wdev_invit_info_init(invit_info);
+
+					_rtw_memcpy(invit_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN);
+					invit_info->active = tx ? 1 : 0;
+					invit_info->token = dialogToken;
+					invit_info->flags = (flags==-1) ? 0x0 : flags;
+					invit_info->req_op_ch= op_ch;
+					invit_info->state = 0;
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_INVIT_REQ, dialogToken=%d, flags:0x%02x, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, flags, op_ch, ch_list_buf);
+
+					if (!tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED)) {
+							if (op_ch != -1 && rtw_chk_p2pie_op_ch_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE) {
+								DBG_871X(FUNC_ADPT_FMT" op_ch:%u has no intersect with buddy\n", FUNC_ADPT_ARG(padapter), op_ch);
+								rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+							} else if (rtw_chk_p2pie_ch_list_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE) {
+								DBG_871X(FUNC_ADPT_FMT" ch_list has no intersect with buddy\n", FUNC_ADPT_ARG(padapter));
+								rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+							}
+						}
+						#endif
+					}
+
+					break;
+				}
+				case P2P_INVIT_RESP:
+				{
+					struct rtw_wdev_invit_info* invit_info = &pwdev_priv->invit_info;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len)))
+					{
+#ifdef CONFIG_P2P_INVITE_IOT
+						if(tx && *cont==7)
+						{
+							DBG_871X("TX_P2P_INVITE_RESP, status is no common channel, change to unknown group\n");
+							*cont = 8; //unknow group status
+						}
+#endif //CONFIG_P2P_INVITE_IOT
+						status = *cont;
+					}	
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+
+					if (invit_info->token == dialogToken && invit_info->state == 0
+						&& _rtw_memcmp(invit_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN) == _TRUE
+					) {
+						invit_info->status = (status==-1) ? 0xff : status;
+						invit_info->rsp_op_ch= op_ch;
+						invit_info->state = 1;
+						invit_info->token = 0; /* init */
+					}
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_INVIT_RESP, dialogToken=%d, status:%d, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, status, op_ch, ch_list_buf);
+
+					if (!tx) {
+					}
+
+					break;
+				}
+				case P2P_DEVDISC_REQ:
+					DBG_871X("RTW_%s:P2P_DEVDISC_REQ, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken);
+					break;
+				case P2P_DEVDISC_RESP:
+					cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len);
+					DBG_871X("RTW_%s:P2P_DEVDISC_RESP, dialogToken=%d, status:%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken, cont?*cont:-1);
+					break;
+				case P2P_PROVISION_DISC_REQ:
+				{
+					size_t frame_body_len = len - sizeof(struct rtw_ieee80211_hdr_3addr);
+					u8 *p2p_ie;
+					uint p2p_ielen = 0;
+					uint contentlen = 0;
+					
+					DBG_871X("RTW_%s:P2P_PROVISION_DISC_REQ, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken);
+
+					//if(tx)
+					{
+						pwdev_priv->provdisc_req_issued = _FALSE;
+					
+						if( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, frame_body_len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)))
+						{	
+
+							if(rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, NULL, &contentlen))
+							{
+								pwdev_priv->provdisc_req_issued = _FALSE;//case: p2p_client join p2p GO
+							}
+							else
+							{
+								#ifdef CONFIG_DEBUG_CFG80211
+								DBG_871X("provdisc_req_issued is _TRUE\n");
+								#endif //CONFIG_DEBUG_CFG80211
+								pwdev_priv->provdisc_req_issued = _TRUE;//case: p2p_devices connection before Nego req.
+							}
+												
+						}						
+					}				
+				}	
+					break;
+				case P2P_PROVISION_DISC_RESP:
+					DBG_871X("RTW_%s:P2P_PROVISION_DISC_RESP, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken);
+					break;
+				default:
+					DBG_871X("RTW_%s:OUI_Subtype=%d, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", OUI_Subtype, dialogToken);
+					break;	
+			}
+
+		}
+		
+	}	
+	else if(category == RTW_WLAN_CATEGORY_P2P)
+	{
+		OUI_Subtype = frame_body[5];
+		dialogToken = frame_body[6];
+
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("ACTION_CATEGORY_P2P: OUI=0x%x, OUI_Subtype=%d, dialogToken=%d\n",
+			cpu_to_be32( *( ( u32* ) ( frame_body + 1 ) ) ), OUI_Subtype, dialogToken);
+		#endif
+
+		is_p2p_frame = OUI_Subtype;
+
+		switch(OUI_Subtype)
+		{
+			case P2P_NOTICE_OF_ABSENCE:
+				DBG_871X("RTW_%s:P2P_NOTICE_OF_ABSENCE, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;			
+			case P2P_PRESENCE_REQUEST:
+				DBG_871X("RTW_%s:P2P_PRESENCE_REQUEST, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;			
+			case P2P_PRESENCE_RESPONSE:
+				DBG_871X("RTW_%s:P2P_PRESENCE_RESPONSE, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;			
+			case P2P_GO_DISC_REQUEST:
+				DBG_871X("RTW_%s:P2P_GO_DISC_REQUEST, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;			
+			default:
+				DBG_871X("RTW_%s:OUI_Subtype=%d, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", OUI_Subtype, dialogToken);
+				break;			
+		}	
+
+	}	
+	else
+	{
+		DBG_871X("RTW_%s:action frame category=%d\n", (tx==_TRUE)?"TX":"RX", category);
+	}
+
+	return is_p2p_frame;
+}
+
+void rtw_init_cfg80211_wifidirect_info( _adapter*	padapter)
+{
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+
+	_rtw_memset(pcfg80211_wdinfo, 0x00, sizeof(struct cfg80211_wifidirect_info) );
+	
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_init_timer( &pcfg80211_wdinfo->remain_on_ch_timer, padapter->pnetdev, ro_ch_timer_process, padapter );
+#else
+        timer_setup(&pcfg80211_wdinfo->remain_on_ch_timer, ro_ch_timer_process, 0);
+#endif
+}
+#endif //CONFIG_IOCTL_CFG80211	
+
+void p2p_protocol_wk_hdl(_adapter *padapter, int intCmdType)
+{
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+	
+_func_enter_;
+
+	switch(intCmdType)
+	{
+		case P2P_FIND_PHASE_WK:
+		{
+			find_phase_handler( padapter );
+			break;
+		}
+		case P2P_RESTORE_STATE_WK:
+		{
+			restore_p2p_state_handler( padapter );
+			break;
+		}
+		case P2P_PRE_TX_PROVDISC_PROCESS_WK:
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+			{
+				p2p_concurrent_handler( padapter );
+			}
+			else
+			{
+				pre_tx_provdisc_handler( padapter );
+			}
+#else
+			pre_tx_provdisc_handler( padapter );
+#endif
+			break;
+		}
+		case P2P_PRE_TX_INVITEREQ_PROCESS_WK:
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+			{
+				p2p_concurrent_handler( padapter );
+			}
+			else
+			{
+				pre_tx_invitereq_handler( padapter );
+			}
+#else			
+			pre_tx_invitereq_handler( padapter );
+#endif
+			break;
+		}		
+		case P2P_PRE_TX_NEGOREQ_PROCESS_WK:
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+			{
+				p2p_concurrent_handler( padapter );
+			}
+			else
+			{
+				pre_tx_negoreq_handler( padapter );
+			}
+#else			
+			pre_tx_negoreq_handler( padapter );
+#endif
+			break;
+		}
+#ifdef CONFIG_P2P
+#ifdef CONFIG_CONCURRENT_MODE
+		case P2P_AP_P2P_CH_SWITCH_PROCESS_WK:
+		{
+			p2p_concurrent_handler( padapter );
+			break;
+		}		
+#endif
+#endif
+#ifdef CONFIG_IOCTL_CFG80211
+		case P2P_RO_CH_WK:
+		{
+			ro_ch_handler( padapter );
+			break;
+		}		
+#endif //CONFIG_IOCTL_CFG80211		
+
+	}
+	
+_func_exit_;
+}
+
+#ifdef CONFIG_P2P_PS
+void process_p2p_ps_ie(PADAPTER padapter, u8 *IEs, u32 IELength)
+{
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+	u32	p2p_ielen = 0;
+	u8	noa_attr[MAX_P2P_IE_LEN] = { 0x00 };// NoA length should be n*(13) + 2
+	u32	attr_contentlen = 0;
+	
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8	find_p2p = _FALSE, find_p2p_ps = _FALSE;
+	u8	noa_offset, noa_num, noa_index;
+
+_func_enter_;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		return;
+	}
+	
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type != IFACE_PORT0) 
+		return;
+#endif
+	if(IELength <= _BEACON_IE_OFFSET_)
+		return;
+	
+	ies = IEs + _BEACON_IE_OFFSET_;
+	ies_len = IELength - _BEACON_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen);
+	
+	while(p2p_ie)
+	{
+		find_p2p = _TRUE;
+		// Get Notice of Absence IE.
+		if(rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_NOA, noa_attr, &attr_contentlen))
+		{
+			find_p2p_ps = _TRUE;
+			noa_index = noa_attr[0];
+
+			if( (pwdinfo->p2p_ps_mode == P2P_PS_NONE) ||
+				(noa_index != pwdinfo->noa_index) )// if index change, driver should reconfigure related setting.
+			{
+				pwdinfo->noa_index = noa_index;
+				pwdinfo->opp_ps = noa_attr[1] >> 7;
+				pwdinfo->ctwindow = noa_attr[1] & 0x7F;
+
+				noa_offset = 2;
+				noa_num = 0;
+				// NoA length should be n*(13) + 2
+				if(attr_contentlen > 2)
+				{
+					while(noa_offset < attr_contentlen)
+					{
+						//_rtw_memcpy(&wifidirect_info->noa_count[noa_num], &noa_attr[noa_offset], 1);
+						pwdinfo->noa_count[noa_num] = noa_attr[noa_offset];
+						noa_offset += 1;
+
+						_rtw_memcpy(&pwdinfo->noa_duration[noa_num], &noa_attr[noa_offset], 4);
+						noa_offset += 4;
+
+						_rtw_memcpy(&pwdinfo->noa_interval[noa_num], &noa_attr[noa_offset], 4);
+						noa_offset += 4;
+
+						_rtw_memcpy(&pwdinfo->noa_start_time[noa_num], &noa_attr[noa_offset], 4);
+						noa_offset += 4;
+
+						noa_num++;
+					}
+				}
+				pwdinfo->noa_num = noa_num;
+
+				if( pwdinfo->opp_ps == 1 )
+				{
+					pwdinfo->p2p_ps_mode = P2P_PS_CTWINDOW;
+					// driver should wait LPS for entering CTWindow
+					if(padapter->pwrctrlpriv.bFwCurrentInPSMode == _TRUE)
+					{
+						p2p_ps_wk_cmd(padapter, P2P_PS_ENABLE, 1);
+					}
+				}
+				else if( pwdinfo->noa_num > 0 )
+				{
+					pwdinfo->p2p_ps_mode = P2P_PS_NOA;
+					p2p_ps_wk_cmd(padapter, P2P_PS_ENABLE, 1);
+				}
+				else if( pwdinfo->p2p_ps_mode > P2P_PS_NONE)
+				{
+					p2p_ps_wk_cmd(padapter, P2P_PS_DISABLE, 1);
+				}
+			}
+
+			break; // find target, just break.
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+
+	}
+
+	if(find_p2p == _TRUE)
+	{
+		if( (pwdinfo->p2p_ps_mode > P2P_PS_NONE) && (find_p2p_ps == _FALSE) )
+		{
+			p2p_ps_wk_cmd(padapter, P2P_PS_DISABLE, 1);
+		}
+	}
+
+_func_exit_;
+}
+
+void p2p_ps_wk_hdl(_adapter *padapter, u8 p2p_ps_state)
+{
+	struct pwrctrl_priv		*pwrpriv = &padapter->pwrctrlpriv;
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+	
+_func_enter_;
+
+	switch(p2p_ps_state)
+	{
+		case P2P_PS_DISABLE:
+			pwdinfo->p2p_ps_state = p2p_ps_state;
+			
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_P2P_PS_OFFLOAD, (u8 *)(&p2p_ps_state));
+
+			pwdinfo->noa_index = 0;
+			pwdinfo->ctwindow = 0;
+			pwdinfo->opp_ps = 0;
+			pwdinfo->noa_num = 0;
+			pwdinfo->p2p_ps_mode = P2P_PS_NONE;
+			if(padapter->pwrctrlpriv.bFwCurrentInPSMode == _TRUE)
+			{
+				if(pwrpriv->smart_ps == 0)
+				{
+					pwrpriv->smart_ps = 2;
+					rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&(padapter->pwrctrlpriv.pwr_mode)));
+				}
+			}
+			break;
+		case P2P_PS_ENABLE:
+			if (pwdinfo->p2p_ps_mode > P2P_PS_NONE) {
+				pwdinfo->p2p_ps_state = p2p_ps_state;
+				
+				if( pwdinfo->ctwindow > 0 )
+				{
+					if(pwrpriv->smart_ps != 0)
+					{
+						pwrpriv->smart_ps = 0;
+						DBG_871X("%s(): Enter CTW, change SmartPS\n", __FUNCTION__);
+						rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&(padapter->pwrctrlpriv.pwr_mode)));
+					}
+				}
+				rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_P2P_PS_OFFLOAD, (u8 *)(&p2p_ps_state));
+			}
+			break;
+		case P2P_PS_SCAN:
+		case P2P_PS_SCAN_DONE:
+		case P2P_PS_ALLSTASLEEP:
+			if (pwdinfo->p2p_ps_mode > P2P_PS_NONE) {
+				pwdinfo->p2p_ps_state = p2p_ps_state;
+				rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_P2P_PS_OFFLOAD, (u8 *)(&p2p_ps_state));
+			}
+			break;
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+u8 p2p_ps_wk_cmd(_adapter*padapter, u8 p2p_ps_state, u8 enqueue)
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+	
+_func_enter_;
+
+	if ( rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) 
+#ifdef CONFIG_CONCURRENT_MODE
+		|| (padapter->iface_type != IFACE_PORT0) 
+#endif
+		)
+	{
+		return res;
+	}
+
+	if(enqueue)
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));	
+		if(ph2c==NULL){
+			res= _FAIL;
+			goto exit;
+		}
+		
+		pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm)); 
+		if(pdrvextra_cmd_parm==NULL){
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm->ec_id = P2P_PS_WK_CID;
+		pdrvextra_cmd_parm->type_size = p2p_ps_state;
+		pdrvextra_cmd_parm->pbuf = NULL;
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+	else
+	{
+		p2p_ps_wk_hdl(padapter, p2p_ps_state);
+	}
+	
+exit:
+	
+_func_exit_;
+
+	return res;
+
+}
+#endif // CONFIG_P2P_PS
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void reset_ch_sitesurvey_timer_process (void *FunctionContext)
+#else
+static void reset_ch_sitesurvey_timer_process(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, wdinfo.reset_ch_sitesurvey);
+#endif
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//	Reset the operation channel information
+	pwdinfo->rx_invitereq_info.operation_ch[0] = 0;
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.operation_ch[1] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[2] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[3] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH 
+	pwdinfo->rx_invitereq_info.scan_op_ch_only = 0;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void reset_ch_sitesurvey_timer_process2(void *FunctionContext)
+#else
+static void reset_ch_sitesurvey_timer_process2(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, wdinfo.reset_ch_sitesurvey2);
+#endif
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//	Reset the operation channel information
+	pwdinfo->p2p_info.operation_ch[0] = 0;
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.operation_ch[1] = 0;
+	pwdinfo->p2p_info.operation_ch[2] = 0;
+	pwdinfo->p2p_info.operation_ch[3] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.scan_op_ch_only = 0;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void restore_p2p_state_timer_process (void *FunctionContext)
+#else
+static void restore_p2p_state_timer_process(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, wdinfo.restore_p2p_state_timer);
+#endif
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return; 
+	
+	p2p_protocol_wk_cmd( adapter, P2P_RESTORE_STATE_WK );
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void pre_tx_scan_timer_process (void *FunctionContext)
+#else
+static void pre_tx_scan_timer_process(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *) FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, wdinfo.pre_tx_scan_timer);
+#endif
+	struct	wifidirect_info				*pwdinfo = &adapter->wdinfo;
+	_irqL							irqL;
+	struct mlme_priv					*pmlmepriv = &adapter->mlmepriv;
+	u8								_status = 0;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+	
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	//	Commented by Albert 20110805
+	//	Todo: Use the issuing probe request directly instead of using the rtw_sitesurvey_cmd!!
+	
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+	{
+		if ( _TRUE == pwdinfo->tx_prov_disc_info.benable )	//	the provision discovery request frame is trigger to send or not
+		{
+			p2p_protocol_wk_cmd( adapter, P2P_PRE_TX_PROVDISC_PROCESS_WK );			
+			//issue_probereq_p2p(adapter, NULL);
+			//_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		}
+	}
+	else if (rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+	{
+		if ( _TRUE == pwdinfo->nego_req_info.benable )
+		{
+			p2p_protocol_wk_cmd( adapter, P2P_PRE_TX_NEGOREQ_PROCESS_WK );
+			//issue_probereq_p2p(adapter, NULL);
+			//_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		}
+	}
+	else if ( rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_INVITE_REQ ) )
+	{
+		if ( _TRUE == pwdinfo->invitereq_info.benable )
+		{
+			p2p_protocol_wk_cmd( adapter, P2P_PRE_TX_INVITEREQ_PROCESS_WK );
+		}
+	}
+	else
+	{
+		DBG_8192C( "[%s] p2p_state is %d, ignore!!\n", __FUNCTION__, rtw_p2p_state(pwdinfo) );
+	}
+	
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void find_phase_timer_process (void *FunctionContext)
+#else
+static void find_phase_timer_process(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, wdinfo.find_phase_timer);
+#endif
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	adapter->wdinfo.find_phase_state_exchange_cnt++;
+
+	p2p_protocol_wk_cmd( adapter, P2P_FIND_PHASE_WK );
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void ap_p2p_switch_timer_process (void *FunctionContext)
+#else
+void ap_p2p_switch_timer_process(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, wdinfo.ap_p2p_switch_timer);
+#endif
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+#ifdef CONFIG_IOCTL_CFG80211	
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(adapter->rtw_wdev);
+#endif
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	ATOMIC_SET(&pwdev_priv->switch_ch_to, 1);
+#endif
+
+	p2p_protocol_wk_cmd( adapter, P2P_AP_P2P_CH_SWITCH_PROCESS_WK );
+}
+#endif
+
+void reset_global_wifidirect_info( _adapter* padapter )
+{
+	struct wifidirect_info	*pwdinfo;
+
+	pwdinfo = &padapter->wdinfo;
+	pwdinfo->persistent_supported = 0;
+	pwdinfo->session_available = _TRUE;
+	pwdinfo->wfd_tdls_enable = 0;
+	pwdinfo->wfd_tdls_weaksec = 0;
+}
+
+#ifdef CONFIG_WFD
+int rtw_init_wifi_display_info(_adapter* padapter)
+{
+	int	res = _SUCCESS;
+	struct wifi_display_info *pwfd_info = &padapter->wfd_info;
+
+	// Used in P2P and TDLS
+	pwfd_info->rtsp_ctrlport = 554;
+	pwfd_info->peer_rtsp_ctrlport = 0;	//	Reset to 0
+	pwfd_info->wfd_enable = _FALSE;
+	pwfd_info->wfd_device_type = WFD_DEVINFO_PSINK;
+	pwfd_info->scan_result_type = SCAN_RESULT_P2P_ONLY;
+
+	// Used in P2P	
+	pwfd_info->peer_session_avail = _TRUE;
+	pwfd_info->wfd_pc = _FALSE;
+
+	// Used in TDLS
+	_rtw_memset( pwfd_info->ip_address, 0x00, 4 );
+	_rtw_memset( pwfd_info->peer_ip_address, 0x00, 4 );
+	return res;
+
+}
+#endif //CONFIG_WFD
+
+void rtw_init_wifidirect_timers(_adapter* padapter)
+{
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_init_timer( &pwdinfo->find_phase_timer, padapter->pnetdev, find_phase_timer_process, padapter );
+	_init_timer( &pwdinfo->restore_p2p_state_timer, padapter->pnetdev, restore_p2p_state_timer_process, padapter );
+	_init_timer( &pwdinfo->pre_tx_scan_timer, padapter->pnetdev, pre_tx_scan_timer_process, padapter );
+	_init_timer( &pwdinfo->reset_ch_sitesurvey, padapter->pnetdev, reset_ch_sitesurvey_timer_process, padapter );
+	_init_timer( &pwdinfo->reset_ch_sitesurvey2, padapter->pnetdev, reset_ch_sitesurvey_timer_process2, padapter );
+#ifdef CONFIG_CONCURRENT_MODE
+	_init_timer( &pwdinfo->ap_p2p_switch_timer, padapter->pnetdev, ap_p2p_switch_timer_process, padapter );
+#endif
+#else
+        timer_setup(&pwdinfo->find_phase_timer, find_phase_timer_process, 0);
+        timer_setup(&pwdinfo->restore_p2p_state_timer, restore_p2p_state_timer_process, 0);
+        timer_setup(&pwdinfo->pre_tx_scan_timer, pre_tx_scan_timer_process, 0);
+        timer_setup(&pwdinfo->reset_ch_sitesurvey, reset_ch_sitesurvey_timer_process, 0);
+        timer_setup(&pwdinfo->reset_ch_sitesurvey2, reset_ch_sitesurvey_timer_process2, 0);
+#ifdef CONFIG_CONCURRENT_MODE
+        timer_setup(&pwdinfo->ap_p2p_switch_timer, ap_p2p_switch_timer_process, 0);
+#endif
+#endif
+}
+
+void rtw_init_wifidirect_addrs(_adapter* padapter, u8 *dev_addr, u8 *iface_addr)
+{
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+
+	/*init device&interface address */
+	if (dev_addr) {
+		_rtw_memcpy(pwdinfo->device_addr, dev_addr, ETH_ALEN);
+	}
+	if (iface_addr) {
+		_rtw_memcpy(pwdinfo->interface_addr, iface_addr, ETH_ALEN);
+	}
+#endif
+}
+
+void init_wifidirect_info( _adapter* padapter, enum P2P_ROLE role)
+{
+	struct wifidirect_info	*pwdinfo;
+#ifdef CONFIG_WFD
+	struct wifi_display_info	*pwfd_info = &padapter->wfd_info;
+#endif
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = NULL;
+	struct mlme_priv		*pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv	*pbuddy_mlmeext = NULL;
+#endif
+
+	pwdinfo = &padapter->wdinfo;
+
+	pwdinfo->padapter = padapter;
+	
+	//	1, 6, 11 are the social channel defined in the WiFi Direct specification.
+	pwdinfo->social_chan[0] = 1;
+	pwdinfo->social_chan[1] = 6;
+	pwdinfo->social_chan[2] = 11;
+	pwdinfo->social_chan[3] = 0;	//	channel 0 for scanning ending in site survey function.
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (pbuddy_adapter) {
+		pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+		pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	}
+
+	if ( ( check_buddy_fwstate(padapter, _FW_LINKED ) == _TRUE ) && 
+	      ( ( pbuddy_mlmeext->cur_channel == 1) || ( pbuddy_mlmeext->cur_channel == 6 ) || ( pbuddy_mlmeext->cur_channel == 11 ) )
+	   )
+	{
+		//	Use the AP's channel as the listen channel
+		//	This will avoid the channel switch between AP's channel and listen channel.
+		pwdinfo->listen_channel = pbuddy_mlmeext->cur_channel;
+	}
+	else
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		//	Use the channel 11 as the listen channel
+		pwdinfo->listen_channel = 11;
+	}
+
+	if (role == P2P_ROLE_DEVICE)
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+		#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) == _TRUE )
+		{
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_IDLE);
+		}
+		else
+		#endif
+		{
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+		}
+		pwdinfo->intent = 1;
+		rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_LISTEN);
+	}
+	else if (role == P2P_ROLE_CLIENT)
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+		pwdinfo->intent = 1;
+		rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+	}	
+	else if (role == P2P_ROLE_GO)
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+		pwdinfo->intent = 15;
+		rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+	}
+
+//	Use the OFDM rate in the P2P probe response frame. ( 6(B), 9(B), 12, 18, 24, 36, 48, 54 )	
+	pwdinfo->support_rate[0] = 0x8c;	//	6(B)
+	pwdinfo->support_rate[1] = 0x92;	//	9(B)
+	pwdinfo->support_rate[2] = 0x18;	//	12
+	pwdinfo->support_rate[3] = 0x24;	//	18
+	pwdinfo->support_rate[4] = 0x30;	//	24
+	pwdinfo->support_rate[5] = 0x48;	//	36
+	pwdinfo->support_rate[6] = 0x60;	//	48
+	pwdinfo->support_rate[7] = 0x6c;	//	54
+
+	_rtw_memcpy( ( void* ) pwdinfo->p2p_wildcard_ssid, "DIRECT-", 7 );
+
+	_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );
+	pwdinfo->device_name_len = 0;
+
+	_rtw_memset( &pwdinfo->invitereq_info, 0x00, sizeof( struct tx_invite_req_info ) );
+	pwdinfo->invitereq_info.token = 3;	//	Token used for P2P invitation request frame.
+	
+	_rtw_memset( &pwdinfo->inviteresp_info, 0x00, sizeof( struct tx_invite_resp_info ) );
+	pwdinfo->inviteresp_info.token = 0;
+
+	pwdinfo->profileindex = 0;
+	_rtw_memset( &pwdinfo->profileinfo[ 0 ], 0x00, sizeof( struct profile_info ) * P2P_MAX_PERSISTENT_GROUP_NUM );
+
+	rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+
+	pwdinfo->listen_dwell = ( u8 ) (( rtw_get_current_time() % 3 ) + 1);
+	//DBG_8192C( "[%s] listen_dwell time is %d00ms\n", __FUNCTION__, pwdinfo->listen_dwell );
+
+	_rtw_memset( &pwdinfo->tx_prov_disc_info, 0x00, sizeof( struct tx_provdisc_req_info ) );
+	pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_NONE;
+
+	_rtw_memset( &pwdinfo->nego_req_info, 0x00, sizeof( struct tx_nego_req_info ) );
+
+	pwdinfo->device_password_id_for_nego = WPS_DPID_PBC;
+	pwdinfo->negotiation_dialog_token = 1;
+
+	_rtw_memset( pwdinfo->nego_ssid, 0x00, WLAN_SSID_MAXLEN );
+	pwdinfo->nego_ssidlen = 0;
+
+	pwdinfo->ui_got_wps_info = P2P_NO_WPSINFO;
+#ifdef CONFIG_WFD
+	pwdinfo->supported_wps_cm = WPS_CONFIG_METHOD_DISPLAY  | WPS_CONFIG_METHOD_PBC;
+	pwdinfo->wfd_info = pwfd_info;
+#else
+	pwdinfo->supported_wps_cm = WPS_CONFIG_METHOD_DISPLAY | WPS_CONFIG_METHOD_PBC | WPS_CONFIG_METHOD_KEYPAD;
+#endif //CONFIG_WFD
+	pwdinfo->channel_list_attr_len = 0;
+	_rtw_memset( pwdinfo->channel_list_attr, 0x00, 100 );
+
+	_rtw_memset( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, 0x00, 4 );
+	_rtw_memset( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, '0', 3 );
+	_rtw_memset( &pwdinfo->groupid_info, 0x00, sizeof( struct group_id_info ) );
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_IOCTL_CFG80211
+	pwdinfo->ext_listen_interval = 1000; //The interval to be available with legacy AP during p2p0-find/scan
+	pwdinfo->ext_listen_period = 3000; //The time period to be available for P2P during nego
+#else //!CONFIG_IOCTL_CFG80211
+	//pwdinfo->ext_listen_interval = 3000;
+	//pwdinfo->ext_listen_period = 400;
+	pwdinfo->ext_listen_interval = 1000;
+	pwdinfo->ext_listen_period = 1000;
+#endif //!CONFIG_IOCTL_CFG80211
+#endif
+
+// Commented by Kurt 20130319
+// For WiDi purpose: Use CFG80211 interface but controled WFD/RDS frame by driver itself.
+#ifdef CONFIG_IOCTL_CFG80211
+	pwdinfo->driver_interface = DRIVER_CFG80211;
+#else
+	pwdinfo->driver_interface = DRIVER_WEXT;
+#endif //CONFIG_IOCTL_CFG80211
+
+	pwdinfo->wfd_tdls_enable = 0;
+	_rtw_memset( pwdinfo->p2p_peer_interface_addr, 0x00, ETH_ALEN );
+	_rtw_memset( pwdinfo->p2p_peer_device_addr, 0x00, ETH_ALEN );
+
+	pwdinfo->rx_invitereq_info.operation_ch[0] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[1] = 0;	//	Used to indicate the scan end in site survey function
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.operation_ch[2] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[3] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[4] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.scan_op_ch_only = 0;
+	pwdinfo->p2p_info.operation_ch[0] = 0;
+	pwdinfo->p2p_info.operation_ch[1] = 0;			//	Used to indicate the scan end in site survey function
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.operation_ch[2] = 0;
+	pwdinfo->p2p_info.operation_ch[3] = 0;
+	pwdinfo->p2p_info.operation_ch[4] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.scan_op_ch_only = 0;
+}
+
+#ifdef CONFIG_DBG_P2P
+
+/**
+ * rtw_p2p_role_txt - Get the p2p role name as a text string
+ * @role: P2P role
+ * Returns: The state name as a printable text string
+ */
+const char * rtw_p2p_role_txt(enum P2P_ROLE role)
+{
+	switch (role) {
+	case P2P_ROLE_DISABLE:
+		return "P2P_ROLE_DISABLE";
+	case P2P_ROLE_DEVICE:
+		return "P2P_ROLE_DEVICE";
+	case P2P_ROLE_CLIENT:
+		return "P2P_ROLE_CLIENT";
+	case P2P_ROLE_GO:
+		return "P2P_ROLE_GO";
+	default:
+		return "UNKNOWN";
+	}
+}
+
+/**
+ * rtw_p2p_state_txt - Get the p2p state name as a text string
+ * @state: P2P state
+ * Returns: The state name as a printable text string
+ */
+const char * rtw_p2p_state_txt(enum P2P_STATE state)
+{
+	switch (state) {
+	case P2P_STATE_NONE:
+		return "P2P_STATE_NONE";
+	case P2P_STATE_IDLE:
+		return "P2P_STATE_IDLE";
+	case P2P_STATE_LISTEN:
+		return "P2P_STATE_LISTEN";
+	case P2P_STATE_SCAN:
+		return "P2P_STATE_SCAN";
+	case P2P_STATE_FIND_PHASE_LISTEN:
+		return "P2P_STATE_FIND_PHASE_LISTEN";
+	case P2P_STATE_FIND_PHASE_SEARCH:
+		return "P2P_STATE_FIND_PHASE_SEARCH";
+	case P2P_STATE_TX_PROVISION_DIS_REQ:
+		return "P2P_STATE_TX_PROVISION_DIS_REQ";
+	case P2P_STATE_RX_PROVISION_DIS_RSP:
+		return "P2P_STATE_RX_PROVISION_DIS_RSP";
+	case P2P_STATE_RX_PROVISION_DIS_REQ:
+		return "P2P_STATE_RX_PROVISION_DIS_REQ";
+	case P2P_STATE_GONEGO_ING:
+		return "P2P_STATE_GONEGO_ING";
+	case P2P_STATE_GONEGO_OK:
+		return "P2P_STATE_GONEGO_OK";
+	case P2P_STATE_GONEGO_FAIL:
+		return "P2P_STATE_GONEGO_FAIL";
+	case P2P_STATE_RECV_INVITE_REQ_MATCH:
+		return "P2P_STATE_RECV_INVITE_REQ_MATCH";
+	case P2P_STATE_PROVISIONING_ING:
+		return "P2P_STATE_PROVISIONING_ING";
+	case P2P_STATE_PROVISIONING_DONE:
+		return "P2P_STATE_PROVISIONING_DONE";
+	case P2P_STATE_TX_INVITE_REQ:
+		return "P2P_STATE_TX_INVITE_REQ";
+	case P2P_STATE_RX_INVITE_RESP_OK:
+		return "P2P_STATE_RX_INVITE_RESP_OK";
+	case P2P_STATE_RECV_INVITE_REQ_DISMATCH:
+		return "P2P_STATE_RECV_INVITE_REQ_DISMATCH";
+	case P2P_STATE_RECV_INVITE_REQ_GO:
+		return "P2P_STATE_RECV_INVITE_REQ_GO";
+	case P2P_STATE_RECV_INVITE_REQ_JOIN:
+		return "P2P_STATE_RECV_INVITE_REQ_JOIN";
+	case P2P_STATE_RX_INVITE_RESP_FAIL:
+		return "P2P_STATE_RX_INVITE_RESP_FAIL";
+	case P2P_STATE_RX_INFOR_NOREADY:
+		return "P2P_STATE_RX_INFOR_NOREADY";
+	case P2P_STATE_TX_INFOR_NOREADY:
+		return "P2P_STATE_TX_INFOR_NOREADY";
+	default:
+		return "UNKNOWN";
+	}
+}
+
+void dbg_rtw_p2p_set_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line)
+{
+	if(!_rtw_p2p_chk_state(wdinfo, state)) {
+		enum P2P_STATE old_state = _rtw_p2p_state(wdinfo);
+		_rtw_p2p_set_state(wdinfo, state);
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_state from %s to %s\n", caller, line
+			, rtw_p2p_state_txt(old_state), rtw_p2p_state_txt(_rtw_p2p_state(wdinfo))
+		);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_state to same state %s\n", caller, line
+			, rtw_p2p_state_txt(_rtw_p2p_state(wdinfo))
+		);
+	}
+}
+void dbg_rtw_p2p_set_pre_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line)
+{
+	if(_rtw_p2p_pre_state(wdinfo) != state) {
+		enum P2P_STATE old_state = _rtw_p2p_pre_state(wdinfo); 
+		_rtw_p2p_set_pre_state(wdinfo, state);
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_pre_state from %s to %s\n", caller, line
+			, rtw_p2p_state_txt(old_state), rtw_p2p_state_txt(_rtw_p2p_pre_state(wdinfo))
+		);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_pre_state to same state %s\n", caller, line
+			, rtw_p2p_state_txt(_rtw_p2p_pre_state(wdinfo))
+		);
+	}
+}
+#if 0
+void dbg_rtw_p2p_restore_state(struct wifidirect_info *wdinfo, const char *caller, int line)
+{
+	if(wdinfo->pre_p2p_state != -1) {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d restore from %s to %s\n", caller, line
+			, p2p_state_str[wdinfo->p2p_state], p2p_state_str[wdinfo->pre_p2p_state]
+		);
+		_rtw_p2p_restore_state(wdinfo);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d restore no pre state, cur state %s\n", caller, line
+			, p2p_state_str[wdinfo->p2p_state]
+		);		
+	}
+}
+#endif
+void dbg_rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role, const char *caller, int line)
+{
+	if(wdinfo->role != role) {
+		enum P2P_ROLE old_role = wdinfo->role;
+		_rtw_p2p_set_role(wdinfo, role);
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_role from %s to %s\n", caller, line
+			, rtw_p2p_role_txt(old_role), rtw_p2p_role_txt(wdinfo->role)
+		);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_role to same role %s\n", caller, line
+			, rtw_p2p_role_txt(wdinfo->role)
+		);
+	}
+}
+#endif //CONFIG_DBG_P2P
+
+
+int rtw_p2p_enable(_adapter *padapter, enum P2P_ROLE role)
+{
+	int ret = _SUCCESS;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+	if (role == P2P_ROLE_DEVICE || role == P2P_ROLE_CLIENT|| role == P2P_ROLE_GO)
+	{
+		u8 channel, ch_offset;
+		u16 bwmode;
+
+#ifdef CONFIG_CONCURRENT_MODE
+		_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+		struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+		//	Commented by Albert 2011/12/30
+		//	The driver just supports 1 P2P group operation.
+		//	So, this function will do nothing if the buddy adapter had enabled the P2P function.
+		if(!rtw_p2p_chk_state(pbuddy_wdinfo, P2P_STATE_NONE))
+		{
+			//	The buddy adapter had enabled the P2P function.
+			return ret;
+		}
+#endif //CONFIG_CONCURRENT_MODE
+
+		//leave IPS/Autosuspend
+		if (_FAIL == rtw_pwr_wakeup(padapter)) {
+			ret = _FAIL;
+			goto exit;
+		}
+		
+
+		//	Added by Albert 2011/03/22
+		//	In the P2P mode, the driver should not support the b mode.
+		//	So, the Tx packet shouldn't use the CCK rate
+		update_tx_basic_rate(padapter, WIRELESS_11AGN);
+
+		//Enable P2P function
+		init_wifidirect_info(padapter, role);
+	}
+	else if (role == P2P_ROLE_DISABLE)
+	{
+#ifdef CONFIG_INTEL_WIDI
+		if( padapter->mlmepriv.p2p_reject_disable == _TRUE )
+			return ret;
+#endif //CONFIG_INTEL_WIDI
+
+		if (_FAIL == rtw_pwr_wakeup(padapter)) {
+			ret = _FAIL;
+			goto exit;
+		}	
+
+		//Disable P2P function
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+			_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey);
+			_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey2);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+                        reset_ch_sitesurvey_timer_process( padapter );
+                        reset_ch_sitesurvey_timer_process2( padapter );
+#else
+                        reset_ch_sitesurvey_timer_process(&padapter->wdinfo.reset_ch_sitesurvey);
+                        reset_ch_sitesurvey_timer_process(&padapter->wdinfo.reset_ch_sitesurvey2);
+#endif
+			#ifdef CONFIG_CONCURRENT_MODE			
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer);
+			#endif
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_NONE);
+			rtw_p2p_set_role(pwdinfo, P2P_ROLE_DISABLE);
+			_rtw_memset(&pwdinfo->rx_prov_disc_info, 0x00, sizeof(struct rx_provdisc_req_info));
+		}
+
+		//Restore to initial setting.
+		update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+
+#ifdef CONFIG_INTEL_WIDI
+		rtw_reset_widi_info(padapter);
+#endif //CONFIG_INTEL_WIDI
+
+		//For WiDi purpose.
+#ifdef CONFIG_IOCTL_CFG80211
+		pwdinfo->driver_interface = DRIVER_CFG80211;
+#else
+		pwdinfo->driver_interface = DRIVER_WEXT;
+#endif //CONFIG_IOCTL_CFG80211
+
+	}
+
+exit:	
+	return ret;
+}
+
+#endif //CONFIG_P2P
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c
new file mode 100755
index 0000000000000..e2329fb235355
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c
@@ -0,0 +1,1551 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_PWRCTRL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+
+#ifdef CONFIG_IPS
+void _ips_enter(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+	pwrpriv->bips_processing = _TRUE;
+
+	// syn ips_mode with request
+	pwrpriv->ips_mode = pwrpriv->ips_mode_req;
+
+	pwrpriv->ips_enter_cnts++;
+	DBG_871X("==>ips_enter cnts:%d\n",pwrpriv->ips_enter_cnts);
+
+	if(rf_off == pwrpriv->change_rfpwrstate)
+	{
+		if(pwrpriv->ips_mode == IPS_LEVEL_2)
+			pwrpriv->bkeepfwalive = _TRUE;
+
+		rtw_ips_pwr_down(padapter);
+		pwrpriv->rf_pwrstate = rf_off;
+	}
+	pwrpriv->bips_processing = _FALSE;
+
+}
+
+void ips_enter(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrpriv->lock);
+	_ips_enter(padapter);
+	_exit_pwrlock(&pwrpriv->lock);
+}
+
+int _ips_leave(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	int result = _SUCCESS;
+
+	if((pwrpriv->rf_pwrstate == rf_off) &&(!pwrpriv->bips_processing))
+	{
+		pwrpriv->bips_processing = _TRUE;
+		pwrpriv->change_rfpwrstate = rf_on;
+		pwrpriv->ips_leave_cnts++;
+		DBG_871X("==>ips_leave cnts:%d\n",pwrpriv->ips_leave_cnts);
+
+		if ((result = rtw_ips_pwr_up(padapter)) == _SUCCESS) {
+			pwrpriv->rf_pwrstate = rf_on;
+		}
+
+		DBG_871X("==> ips_leave.....LED(0x%08x)...\n",rtw_read32(padapter,0x4c));
+		pwrpriv->bips_processing = _FALSE;
+
+		pwrpriv->bkeepfwalive = _FALSE;
+	}
+
+	return result;
+}
+
+int ips_leave(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	int ret;
+
+	_enter_pwrlock(&pwrpriv->lock);
+	ret = _ips_leave(padapter);
+	_exit_pwrlock(&pwrpriv->lock);
+
+	return ret;
+}
+#endif /* CONFIG_IPS */
+
+#ifdef CONFIG_AUTOSUSPEND
+extern void autosuspend_enter(_adapter* padapter);	
+extern int autoresume_enter(_adapter* padapter);
+#endif
+
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+int rtw_hw_suspend(_adapter *padapter );
+int rtw_hw_resume(_adapter *padapter);
+#endif
+
+bool rtw_pwr_unassociated_idle(_adapter *adapter)
+{
+	_adapter *buddy = adapter->pbuddy_adapter;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(adapter->wdinfo);
+#ifdef CONFIG_IOCTL_CFG80211
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &adapter->cfg80211_wdinfo;
+#endif
+#endif
+
+	bool ret = _FALSE;
+
+	if (adapter->pwrctrlpriv.ips_deny_time >= rtw_get_current_time()) {
+		//DBG_871X("%s ips_deny_time\n", __func__);
+		goto exit;
+	}
+
+	if (check_fwstate(pmlmepriv, WIFI_ASOC_STATE|WIFI_SITE_MONITOR)
+		|| check_fwstate(pmlmepriv, WIFI_UNDER_LINKING|WIFI_UNDER_WPS)
+		|| check_fwstate(pmlmepriv, WIFI_AP_STATE)
+		|| check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_ADHOC_STATE)
+		#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) && defined(CONFIG_P2P_IPS)
+		|| pcfg80211_wdinfo->is_ro_ch
+		#elif defined(CONFIG_P2P)
+		|| !rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE)
+		#endif
+	) {
+		goto exit;
+	}
+
+	/* consider buddy, if exist */
+	if (buddy) {
+		struct mlme_priv *b_pmlmepriv = &(buddy->mlmepriv);
+		#ifdef CONFIG_P2P
+		struct wifidirect_info *b_pwdinfo = &(buddy->wdinfo);
+		#ifdef CONFIG_IOCTL_CFG80211		
+		struct cfg80211_wifidirect_info *b_pcfg80211_wdinfo = &buddy->cfg80211_wdinfo;
+		#endif
+		#endif
+
+		if (check_fwstate(b_pmlmepriv, WIFI_ASOC_STATE|WIFI_SITE_MONITOR)
+			|| check_fwstate(b_pmlmepriv, WIFI_UNDER_LINKING|WIFI_UNDER_WPS)
+			|| check_fwstate(b_pmlmepriv, WIFI_AP_STATE)
+			|| check_fwstate(b_pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_ADHOC_STATE)
+			#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) && defined(CONFIG_P2P_IPS)
+			|| b_pcfg80211_wdinfo->is_ro_ch
+			#elif defined(CONFIG_P2P)
+			|| !rtw_p2p_chk_state(b_pwdinfo, P2P_STATE_NONE)
+			#endif
+		) {
+			goto exit;
+		}
+	}
+
+#ifdef CONFIG_INTEL_PROXIM
+	if(adapter->proximity.proxim_on==_TRUE){
+		return;
+	}
+#endif
+
+	ret = _TRUE;
+
+exit:
+	return ret;
+}
+
+#if defined (PLATFORM_LINUX)||defined (PLATFORM_FREEBSD)
+void rtw_ps_processor(_adapter*padapter)
+{
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+#endif //CONFIG_P2P
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	rt_rf_power_state rfpwrstate;
+#endif //SUPPORT_HW_RFOFF_DETECTED
+
+	pwrpriv->ps_processing = _TRUE;
+
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	if(pwrpriv->bips_processing == _TRUE)
+		goto exit;
+	
+	//DBG_871X("==> fw report state(0x%x)\n",rtw_read8(padapter,0x1ca));	
+	if(padapter->pwrctrlpriv.bHWPwrPindetect) 
+	{
+	#ifdef CONFIG_AUTOSUSPEND
+		if(padapter->registrypriv.usbss_enable)
+		{
+			if(pwrpriv->rf_pwrstate == rf_on)
+			{
+				if(padapter->net_closed == _TRUE)
+					pwrpriv->ps_flag = _TRUE;
+
+				rfpwrstate = RfOnOffDetect(padapter);
+				DBG_871X("@@@@- #1  %s==> rfstate:%s \n",__FUNCTION__,(rfpwrstate==rf_on)?"rf_on":"rf_off");
+				if(rfpwrstate!= pwrpriv->rf_pwrstate)
+				{
+					if(rfpwrstate == rf_off)
+					{
+						pwrpriv->change_rfpwrstate = rf_off;
+						
+						pwrpriv->bkeepfwalive = _TRUE;	
+						pwrpriv->brfoffbyhw = _TRUE;						
+						
+						autosuspend_enter(padapter);							
+					}
+				}
+			}			
+		}
+		else
+	#endif //CONFIG_AUTOSUSPEND
+		{
+			rfpwrstate = RfOnOffDetect(padapter);
+			DBG_871X("@@@@- #2  %s==> rfstate:%s \n",__FUNCTION__,(rfpwrstate==rf_on)?"rf_on":"rf_off");
+
+			if(rfpwrstate!= pwrpriv->rf_pwrstate)
+			{
+				if(rfpwrstate == rf_off)
+				{	
+					pwrpriv->change_rfpwrstate = rf_off;														
+					pwrpriv->brfoffbyhw = _TRUE;
+					padapter->bCardDisableWOHSM = _TRUE;
+					rtw_hw_suspend(padapter );	
+				}
+				else
+				{
+					pwrpriv->change_rfpwrstate = rf_on;
+					rtw_hw_resume(padapter );			
+				}
+				DBG_871X("current rf_pwrstate(%s)\n",(pwrpriv->rf_pwrstate == rf_off)?"rf_off":"rf_on");
+			}
+		}
+		pwrpriv->pwr_state_check_cnts ++;	
+	}
+#endif //SUPPORT_HW_RFOFF_DETECTED
+
+	if (pwrpriv->ips_mode_req == IPS_NONE
+		#ifdef CONFIG_CONCURRENT_MODE
+		|| padapter->pbuddy_adapter->pwrctrlpriv.ips_mode_req == IPS_NONE
+		#endif
+	)
+		goto exit;
+
+	if (rtw_pwr_unassociated_idle(padapter) == _FALSE)
+		goto exit;
+
+	if((pwrpriv->rf_pwrstate == rf_on) && ((pwrpriv->pwr_state_check_cnts%4)==0))
+	{
+		DBG_871X("==>%s .fw_state(%x)\n",__FUNCTION__,get_fwstate(pmlmepriv));
+		pwrpriv->change_rfpwrstate = rf_off;
+
+		#ifdef CONFIG_AUTOSUSPEND
+		if(padapter->registrypriv.usbss_enable)
+		{		
+			if(pwrpriv->bHWPwrPindetect) 
+				pwrpriv->bkeepfwalive = _TRUE;
+			
+			if(padapter->net_closed == _TRUE)
+				pwrpriv->ps_flag = _TRUE;
+
+			padapter->bCardDisableWOHSM = _TRUE;
+			autosuspend_enter(padapter);
+		}		
+		else if(pwrpriv->bHWPwrPindetect)
+		{
+		}
+		else
+		#endif //CONFIG_AUTOSUSPEND
+		{
+			#ifdef CONFIG_IPS	
+			ips_enter(padapter);			
+			#endif
+		}
+	}
+exit:
+	rtw_set_pwr_state_check_timer(&padapter->pwrctrlpriv);
+	pwrpriv->ps_processing = _FALSE;
+	return;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void pwr_state_check_handler(RTW_TIMER_HDL_ARGS)
+#else
+void pwr_state_check_handler(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *padapter = (_adapter *)FunctionContext;
+#else
+        _adapter *padapter = from_timer(padapter, t, pwrctrlpriv.pwr_state_check_timer);
+#endif
+        rtw_ps_cmd(padapter);
+}
+#endif
+
+
+#ifdef CONFIG_LPS
+/*
+ *
+ * Parameters
+ *	padapter
+ *	pslv			power state level, only could be PS_STATE_S0 ~ PS_STATE_S4
+ *
+ */
+void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
+{
+	u8	rpwm;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+_func_enter_;
+
+	pslv = PS_STATE(pslv);
+
+	if (pwrpriv->rpwm == pslv) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_,_drv_err_,
+			("%s: Already set rpwm[0x%02x]!\n", __FUNCTION__, pslv));
+		return;
+	}
+
+	if ((padapter->bDriverStopped == _TRUE) ||
+		(padapter->bSurpriseRemoved == _TRUE)) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_err_,
+				 ("%s: bDriverStopped(%d) bSurpriseRemoved(%d)\n",
+				  __FUNCTION__, padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		return;
+	}
+
+	rpwm = pslv | pwrpriv->tog;
+#ifdef CONFIG_LPS_LCLK
+	if ((pwrpriv->cpwm < PS_STATE_S2) && (pslv >= PS_STATE_S2))
+		rpwm |= PS_ACK;
+#endif
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_set_rpwm: rpwm=0x%02x cpwm=0x%02x\n", rpwm, pwrpriv->cpwm));
+
+	pwrpriv->rpwm = pslv;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_SET_RPWM, (u8 *)(&rpwm));
+
+	pwrpriv->tog += 0x80;
+
+	if (!(rpwm & PS_ACK)) pwrpriv->cpwm = pslv;
+
+_func_exit_;
+}
+
+u8 PS_RDY_CHECK(_adapter * padapter);
+u8 PS_RDY_CHECK(_adapter * padapter)
+{
+	u32 curr_time, delta_time;
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	curr_time = rtw_get_current_time();	
+
+	delta_time = curr_time -pwrpriv->DelayLPSLastTimeStamp;
+
+	if(delta_time < LPS_DELAY_TIME)
+	{		
+		return _FALSE;
+	}
+
+	if ((check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE) ||
+		(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_UNDER_WPS) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) )
+		return _FALSE;
+
+	if(_TRUE == pwrpriv->bInSuspend )
+		return _FALSE;
+	
+	if( (padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) && (padapter->securitypriv.binstallGrpkey == _FALSE) )
+	{
+		DBG_871X("Group handshake still in progress !!!\n");
+		return _FALSE;
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (!rtw_cfg80211_pwr_mgmt(padapter))
+		return _FALSE;
+#endif	
+
+	return _TRUE;
+}
+
+void rtw_set_ps_mode(PADAPTER padapter, u8 ps_mode, u8 smart_ps)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+#endif //CONFIG_P2P
+#ifdef CONFIG_TDLS
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	_irqL irqL;
+	int i, j;
+	_list	*plist, *phead;
+	struct sta_info *ptdls_sta;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("%s: PowerMode=%d Smart_PS=%d\n",
+			  __FUNCTION__, ps_mode, smart_ps));
+
+	if(ps_mode > PM_Card_Disable) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_,_drv_err_,("ps_mode:%d error\n", ps_mode));
+		return;
+	}
+
+	if((pwrpriv->pwr_mode == ps_mode) &&
+		(pwrpriv->smart_ps == smart_ps)){
+		return;
+	}
+
+	//if(pwrpriv->pwr_mode == PS_MODE_ACTIVE)
+	if(ps_mode == PS_MODE_ACTIVE)
+	{
+#ifdef CONFIG_P2P_PS
+		if(pwdinfo->opp_ps == 0)
+#endif // CONFIG_P2P_PS
+		{
+#ifdef CONFIG_LPS_LCLK
+			_enter_pwrlock(&pwrpriv->lock);
+#endif
+			DBG_871X("rtw_set_ps_mode(): Busy Traffic , Leave 802.11 power save..\n");
+
+#ifdef CONFIG_TDLS
+			_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+			for(i=0; i< NUM_STA; i++)
+			{
+				phead = &(pstapriv->sta_hash[i]);
+				plist = get_next(phead);
+
+				while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+				{
+					ptdls_sta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+					if( ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE )
+						issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 0);
+					plist = get_next(plist);
+				}
+			}
+
+			_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+#endif //CONFIG_TDLS
+
+			pwrpriv->smart_ps = smart_ps;
+			pwrpriv->pwr_mode = ps_mode;
+
+			rtw_set_rpwm(padapter, PS_STATE_S4);
+#ifdef CONFIG_LPS_LCLK
+{
+			u32 n = 0;
+			while (pwrpriv->cpwm != PS_STATE_S4) {
+				n++;
+				if (n == 10000) break;
+				if (padapter->bSurpriseRemoved == _TRUE) break;
+				rtw_msleep_os(1);
+			}
+			if (n == 10000)
+				printk(KERN_ERR "%s: wait CPWM to S4 too long! cpwm=0x%02x\n", __func__, pwrpriv->cpwm);
+}
+#endif
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&ps_mode));
+			pwrpriv->bFwCurrentInPSMode = _FALSE;
+#ifdef CONFIG_LPS_LCLK
+			_exit_pwrlock(&pwrpriv->lock);
+#endif
+		}
+	}
+	else
+	{
+		if(PS_RDY_CHECK(padapter))
+		{
+#ifdef CONFIG_LPS_LCLK
+			_enter_pwrlock(&pwrpriv->lock);
+#endif
+			DBG_871X("rtw_set_ps_mode(): Enter 802.11 power save mode...\n");
+
+#ifdef CONFIG_TDLS
+			_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+			for(i=0; i< NUM_STA; i++)
+			{
+				phead = &(pstapriv->sta_hash[i]);
+				plist = get_next(phead);
+
+				while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+				{
+					ptdls_sta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+					if( ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE )
+						issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 1);
+					plist = get_next(plist);
+				}
+			}
+
+			_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+#endif //CONFIG_TDLS
+
+			pwrpriv->smart_ps = smart_ps;
+			pwrpriv->pwr_mode = ps_mode;
+			pwrpriv->bFwCurrentInPSMode = _TRUE;
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&ps_mode));
+#ifdef CONFIG_P2P_PS
+			// Set CTWindow after LPS
+			if(pwdinfo->opp_ps == 1)
+				p2p_ps_wk_cmd(padapter, P2P_PS_ENABLE, 0);
+#endif // CONFIG_P2P_PS
+#ifdef CONFIG_LPS_LCLK
+			if (pwrpriv->alives == 0)
+				rtw_set_rpwm(padapter, PS_STATE_S0);
+#else
+			rtw_set_rpwm(padapter, PS_STATE_S2);
+#endif
+#ifdef CONFIG_LPS_LCLK
+			_exit_pwrlock(&pwrpriv->lock);
+#endif
+		}
+		//else
+		//{
+		//	pwrpriv->pwr_mode = PS_MODE_ACTIVE;
+		//}
+	}
+
+_func_exit_;
+}
+
+
+//
+//	Description:
+//		Enter the leisure power save mode.
+//
+void LPS_Enter(PADAPTER padapter)
+{
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_adapter *buddy = padapter->pbuddy_adapter;
+
+_func_enter_;
+
+//	DBG_871X("+LeisurePSEnter\n");
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->iface_type != IFACE_PORT0)
+		return; /* Skip power saving for concurrent mode port 1*/
+
+	/* consider buddy, if exist */
+	if (buddy) {
+		struct mlme_priv *b_pmlmepriv = &(buddy->mlmepriv);
+		#ifdef CONFIG_P2P
+		struct wifidirect_info *b_pwdinfo = &(buddy->wdinfo);
+		#ifdef CONFIG_IOCTL_CFG80211		
+		struct cfg80211_wifidirect_info *b_pcfg80211_wdinfo = &buddy->cfg80211_wdinfo;
+		#endif
+		#endif
+		
+		if (check_fwstate(b_pmlmepriv, WIFI_ASOC_STATE|WIFI_SITE_MONITOR)
+			|| check_fwstate(b_pmlmepriv, WIFI_UNDER_LINKING|WIFI_UNDER_WPS)
+			|| check_fwstate(b_pmlmepriv, WIFI_AP_STATE)
+			|| check_fwstate(b_pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_ADHOC_STATE)
+			#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) && defined(CONFIG_P2P_IPS)
+			|| b_pcfg80211_wdinfo->is_ro_ch
+			#elif defined(CONFIG_P2P)
+			|| !rtw_p2p_chk_state(b_pwdinfo, P2P_STATE_NONE)
+			#endif
+			|| rtw_is_scan_deny(buddy)
+		) {
+			return;
+		}
+	}
+#endif
+
+#ifdef CONFIG_INTEL_PROXIM
+	if(padapter->proximity.proxim_on==_TRUE){
+		return;
+	}
+#endif
+	if (	(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE) ||
+		(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) )
+		return;
+
+	if(_TRUE == pwrpriv->bInSuspend )
+		return ;
+	
+	if (pwrpriv->bLeisurePs)
+	{
+		// Idle for a while if we connect to AP a while ago.
+		if(pwrpriv->LpsIdleCount >= 2) //  4 Sec 
+		{
+			if(pwrpriv->pwr_mode == PS_MODE_ACTIVE)
+			{
+				rtw_set_ps_mode(padapter, pwrpriv->power_mgnt, 2);
+			}	
+		}
+		else
+			pwrpriv->LpsIdleCount++;
+	}
+
+//	DBG_871X("-LeisurePSEnter\n");
+
+_func_exit_;
+}
+
+
+//
+//	Description:
+//		Leave the leisure power save mode.
+//
+void LPS_Leave(PADAPTER padapter)
+{
+#define LPS_LEAVE_TIMEOUT_MS 100
+
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	u32 start_time;
+	BOOLEAN bAwake = _FALSE;
+	
+_func_enter_;
+
+//	DBG_871X("+LeisurePSLeave\n");
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->iface_type != IFACE_PORT0)
+		return; /* Skip power saving for concurrent mode port 1*/
+#endif
+
+	if (pwrpriv->bLeisurePs)
+	{	
+		if(pwrpriv->pwr_mode != PS_MODE_ACTIVE)
+		{
+			rtw_set_ps_mode(padapter, PS_MODE_ACTIVE, 0);
+
+			if(pwrpriv->pwr_mode == PS_MODE_ACTIVE)
+			{
+				start_time = rtw_get_current_time();		
+				while(1)			
+				{
+					rtw_hal_get_hwreg(padapter, HW_VAR_FWLPS_RF_ON, (u8 *)(&bAwake));
+						
+					if(bAwake || padapter->bSurpriseRemoved)
+						break;
+					
+					if(rtw_get_passing_time_ms(start_time)>LPS_LEAVE_TIMEOUT_MS)
+					{
+						DBG_871X("Wait for FW LPS leave more than %u ms!!!\n", LPS_LEAVE_TIMEOUT_MS);
+						break;
+					}
+					rtw_usleep_os(100);
+				}
+			}
+		}
+	}
+
+
+//	DBG_871X("-LeisurePSLeave\n");
+
+_func_exit_;
+}
+
+#endif
+
+//
+// Description: Leave all power save mode: LPS, FwLPS, IPS if needed.
+// Move code to function by tynli. 2010.03.26. 
+//
+void LeaveAllPowerSaveMode(IN PADAPTER Adapter)
+{
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+
+_func_enter_;
+
+	//DBG_871X("%s.....\n",__FUNCTION__);
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{ //connect
+#ifdef CONFIG_P2P_PS
+		p2p_ps_wk_cmd(Adapter, P2P_PS_DISABLE, 0);
+#endif // CONFIG_P2P_PS
+#ifdef CONFIG_LPS
+		//DBG_871X("==> leave LPS.......\n");
+		LPS_Leave(Adapter);
+#endif
+	}
+	else
+	{
+		if(Adapter->pwrctrlpriv.rf_pwrstate== rf_off)
+		{
+			#ifdef CONFIG_AUTOSUSPEND
+			if(Adapter->registrypriv.usbss_enable)
+			{
+				#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+				usb_disable_autosuspend(adapter_to_dvobj(Adapter)->pusbdev);
+				#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,34))
+				adapter_to_dvobj(Adapter)->pusbdev->autosuspend_disabled = Adapter->bDisableAutosuspend;//autosuspend disabled by the user
+				#endif
+			}
+			else
+			#endif
+			{
+			/*
+				#ifdef CONFIG_IPS
+				if(_FALSE == ips_leave(Adapter))
+				{
+					DBG_871X("======> ips_leave fail.............\n");			
+				}
+				#endif
+			*/
+			}				
+		}	
+	}
+
+_func_exit_;
+}
+
+#ifdef CONFIG_LPS_LCLK
+/*
+ * Caller:ISR handler...
+ *
+ * This will be called when CPWM interrupt is up.
+ *
+ * using to update cpwn of drv; and drv willl make a decision to up or down pwr level
+ */
+void cpwm_int_hdl(
+	PADAPTER padapter,
+	struct reportpwrstate_parm *preportpwrstate)
+{
+	struct pwrctrl_priv *pwrpriv;
+
+
+_func_enter_;
+
+	pwrpriv = &padapter->pwrctrlpriv;
+#if 0
+	if (pwrpriv->cpwm_tog == (preportpwrstate->state & PS_TOGGLE)) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_err_,
+				 ("cpwm_int_hdl: tog(old)=0x%02x cpwm(new)=0x%02x toggle bit didn't change!?\n",
+				  pwrpriv->cpwm_tog, preportpwrstate->state));
+		goto exit;
+	}
+#endif
+//	_enter_pwrlock(&pwrpriv->lock);
+
+	pwrpriv->cpwm = PS_STATE(preportpwrstate->state);
+	pwrpriv->cpwm_tog = preportpwrstate->state & PS_TOGGLE;
+
+	if (pwrpriv->cpwm >= PS_STATE_S2) {
+		if (pwrpriv->alives & CMD_ALIVE)
+			_rtw_up_sema(&padapter->cmdpriv.cmd_queue_sema);
+
+		if (pwrpriv->alives & XMIT_ALIVE)
+			_rtw_up_sema(&padapter->xmitpriv.xmit_sema);
+	}
+
+//	_exit_pwrlock(&pwrpriv->lock);
+
+exit:
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("cpwm_int_hdl: cpwm=0x%02x\n", pwrpriv->cpwm));
+
+_func_exit_;
+}
+
+__inline static void register_task_alive(struct pwrctrl_priv *pwrctrl, u32 tag)
+{
+	pwrctrl->alives |= tag;
+}
+
+__inline static void unregister_task_alive(struct pwrctrl_priv *pwrctrl, u32 tag)
+{
+	pwrctrl->alives &= ~tag;
+}
+
+/*
+ * Caller: rtw_xmit_thread
+ * 
+ * Check if the fw_pwrstate is okay for xmit.
+ * If not (cpwm is less than S3), then the sub-routine
+ * will raise the cpwm to be greater than or equal to S3. 
+ *
+ * Calling Context: Passive
+ * 
+ * Return Value:
+ *	 _SUCCESS	rtw_xmit_thread can write fifo/txcmd afterwards.
+ *	 _FAIL		rtw_xmit_thread can not do anything.
+ */
+s32 rtw_register_tx_alive(PADAPTER padapter)
+{
+	s32 res;
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	res = _SUCCESS;
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, XMIT_ALIVE);
+
+	if (pwrctrl->bFwCurrentInPSMode == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_err_,
+				 ("rtw_register_tx_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+
+		if (pwrctrl->cpwm < PS_STATE_S2) {
+			if (pwrctrl->rpwm < PS_STATE_S2)
+				rtw_set_rpwm(padapter, PS_STATE_S2);
+			res = _FAIL;
+		}
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return res;	
+}
+
+/*
+ * Caller: rtw_cmd_thread
+ *
+ * Check if the fw_pwrstate is okay for issuing cmd.
+ * If not (cpwm should be is less than S2), then the sub-routine
+ * will raise the cpwm to be greater than or equal to S2.
+ *
+ * Calling Context: Passive
+ *
+ * Return Value:
+ *	_SUCCESS	rtw_cmd_thread can issue cmds to firmware afterwards.
+ *	_FAIL		rtw_cmd_thread can not do anything.
+ */
+s32 rtw_register_cmd_alive(PADAPTER padapter)
+{
+	s32 res;
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	res = _SUCCESS;
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, CMD_ALIVE);
+
+	if (pwrctrl->bFwCurrentInPSMode == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+				 ("rtw_register_cmd_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+
+		if (pwrctrl->cpwm < PS_STATE_S2) {
+			if (pwrctrl->rpwm < PS_STATE_S2)
+				rtw_set_rpwm(padapter, PS_STATE_S2);
+			res = _FAIL;
+		}
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return res;
+}
+
+/*
+ * Caller: rx_isr
+ *
+ * Calling Context: Dispatch/ISR
+ *
+ * Return Value:
+ *	_SUCCESS
+ *	_FAIL
+ */
+s32 rtw_register_rx_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, RECV_ALIVE);
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_register_rx_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+/*
+ * Caller: evt_isr or evt_thread
+ *
+ * Calling Context: Dispatch/ISR or Passive
+ *
+ * Return Value:
+ *	_SUCCESS
+ *	_FAIL
+ */
+s32 rtw_register_evt_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, EVT_ALIVE);
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_register_evt_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+/*
+ * Caller: ISR
+ *
+ * If ISR's txdone,
+ * No more pkts for TX,
+ * Then driver shall call this fun. to power down firmware again.
+ */
+void rtw_unregister_tx_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	unregister_task_alive(pwrctrl, XMIT_ALIVE);
+
+	if ((pwrctrl->pwr_mode != PS_MODE_ACTIVE) &&
+		(pwrctrl->bFwCurrentInPSMode == _TRUE))
+	{
+		if ((pwrctrl->alives == 0) &&
+			(pwrctrl->cpwm > PS_STATE_S0))
+		{
+			rtw_set_rpwm(padapter, PS_STATE_S0);
+		}
+
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+				 ("rtw_unregister_tx_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+
+/*
+ * Caller: ISR
+ *
+ * If all commands have been done,
+ * and no more command to do,
+ * then driver shall call this fun. to power down firmware again.
+ */
+void rtw_unregister_cmd_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	unregister_task_alive(pwrctrl, CMD_ALIVE);
+
+	if ((pwrctrl->pwr_mode != PS_MODE_ACTIVE) &&
+		(pwrctrl->bFwCurrentInPSMode == _TRUE))
+	{
+		if ((pwrctrl->alives == 0) &&
+			(pwrctrl->cpwm > PS_STATE_S0))
+		{
+			rtw_set_rpwm(padapter, PS_STATE_S0);
+		}
+
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+				 ("rtw_unregister_cmd_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+
+/*
+ * Caller: ISR
+ */
+void rtw_unregister_rx_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	unregister_task_alive(pwrctrl, RECV_ALIVE);
+
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_unregister_rx_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+
+void rtw_unregister_evt_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	unregister_task_alive(pwrctrl, EVT_ALIVE);
+
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_unregister_evt_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+#endif	/* CONFIG_LPS_LCLK */
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+static void resume_workitem_callback(struct work_struct *work);
+#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+void rtw_init_pwrctrl_priv(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+_func_enter_;
+
+#ifdef PLATFORM_WINDOWS
+	pwrctrlpriv->pnp_current_pwr_state=NdisDeviceStateD0;
+#endif
+
+	_init_pwrlock(&pwrctrlpriv->lock);
+	pwrctrlpriv->rf_pwrstate = rf_on;
+	pwrctrlpriv->ips_enter_cnts=0;
+	pwrctrlpriv->ips_leave_cnts=0;
+
+	pwrctrlpriv->ips_mode = padapter->registrypriv.ips_mode;
+	pwrctrlpriv->ips_mode_req = padapter->registrypriv.ips_mode;
+
+	pwrctrlpriv->pwr_state_check_interval = RTW_PWR_STATE_CHK_INTERVAL;
+	pwrctrlpriv->pwr_state_check_cnts = 0;
+	pwrctrlpriv->bInternalAutoSuspend = _FALSE;
+	pwrctrlpriv->bInSuspend = _FALSE;
+	pwrctrlpriv->bkeepfwalive = _FALSE;
+
+#ifdef CONFIG_AUTOSUSPEND
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	pwrctrlpriv->pwr_state_check_interval = (pwrctrlpriv->bHWPwrPindetect) ?1000:2000;		
+#endif
+#endif
+
+	pwrctrlpriv->LpsIdleCount = 0;
+	//pwrctrlpriv->FWCtrlPSMode =padapter->registrypriv.power_mgnt;// PS_MODE_MIN;
+	pwrctrlpriv->power_mgnt =padapter->registrypriv.power_mgnt;// PS_MODE_MIN;
+	pwrctrlpriv->bLeisurePs = (PS_MODE_ACTIVE != pwrctrlpriv->power_mgnt)?_TRUE:_FALSE;
+
+	pwrctrlpriv->bFwCurrentInPSMode = _FALSE;
+
+	pwrctrlpriv->cpwm = PS_STATE_S4;
+
+	pwrctrlpriv->pwr_mode = PS_MODE_ACTIVE;
+
+
+	pwrctrlpriv->smart_ps = 0;
+
+	pwrctrlpriv->tog = 0x80;
+
+#ifdef PLATFORM_LINUX
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_init_timer(&(pwrctrlpriv->pwr_state_check_timer), padapter->pnetdev, pwr_state_check_handler, (u8 *)padapter);
+#else
+	timer_setup(&pwrctrlpriv->pwr_state_check_timer, pwr_state_check_handler, 0);
+#endif
+#endif
+
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	_init_workitem(&pwrctrlpriv->resume_work, resume_workitem_callback, NULL);
+	pwrctrlpriv->rtw_workqueue = create_singlethread_workqueue("rtw_workqueue");
+	#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+	#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	pwrctrlpriv->early_suspend.suspend = NULL;
+	rtw_register_early_suspend(pwrctrlpriv);
+	#endif //CONFIG_HAS_EARLYSUSPEND || CONFIG_ANDROID_POWER
+
+
+_func_exit_;
+
+}
+
+
+void rtw_free_pwrctrl_priv(PADAPTER adapter)
+{
+	struct pwrctrl_priv *pwrctrlpriv = &adapter->pwrctrlpriv;
+
+_func_enter_;
+
+	//_rtw_memset((unsigned char *)pwrctrlpriv, 0, sizeof(struct pwrctrl_priv));
+
+
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	if (pwrctrlpriv->rtw_workqueue) { 
+		flush_workqueue(pwrctrlpriv->rtw_workqueue);
+		destroy_workqueue(pwrctrlpriv->rtw_workqueue);
+	}
+	#endif
+
+
+	#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	rtw_unregister_early_suspend(pwrctrlpriv);
+	#endif //CONFIG_HAS_EARLYSUSPEND || CONFIG_ANDROID_POWER
+
+	_free_pwrlock(&pwrctrlpriv->lock);
+
+_func_exit_;
+}
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+extern int rtw_resume_process(_adapter *padapter);
+#endif
+static void resume_workitem_callback(struct work_struct *work)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(work, struct pwrctrl_priv, resume_work);
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+	DBG_871X("%s\n",__FUNCTION__);
+
+	#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+	rtw_resume_process(adapter);
+	#endif
+	
+}
+
+void rtw_resume_in_workqueue(struct pwrctrl_priv *pwrpriv)
+{
+	// accquire system's suspend lock preventing from falliing asleep while resume in workqueue
+	rtw_lock_suspend();
+	
+	#if 1
+	queue_work(pwrpriv->rtw_workqueue, &pwrpriv->resume_work);	
+	#else
+	_set_workitem(&pwrpriv->resume_work);
+	#endif
+}
+#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+inline bool rtw_is_earlysuspend_registered(struct pwrctrl_priv *pwrpriv)
+{
+	return (pwrpriv->early_suspend.suspend) ? _TRUE : _FALSE;
+}
+
+inline bool rtw_is_do_late_resume(struct pwrctrl_priv *pwrpriv)
+{
+	return (pwrpriv->do_late_resume) ? _TRUE : _FALSE;
+}
+
+inline void rtw_set_do_late_resume(struct pwrctrl_priv *pwrpriv, bool enable)
+{
+	pwrpriv->do_late_resume = enable;
+}
+#endif
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+extern int rtw_resume_process(_adapter *padapter);
+#endif
+static void rtw_early_suspend(struct early_suspend *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	DBG_871X("%s\n",__FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+}
+
+static void rtw_late_resume(struct early_suspend *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+	DBG_871X("%s\n",__FUNCTION__);
+	if(pwrpriv->do_late_resume) {
+		#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+		rtw_set_do_late_resume(pwrpriv, _FALSE);
+		rtw_resume_process(adapter);
+		#endif
+	}
+}
+
+void rtw_register_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif	
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//jeff: set the early suspend level before blank screen, so we wll do late resume after scree is lit
+	pwrpriv->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN - 20;
+	pwrpriv->early_suspend.suspend = rtw_early_suspend;
+	pwrpriv->early_suspend.resume = rtw_late_resume;
+	register_early_suspend(&pwrpriv->early_suspend);	
+
+	
+}
+
+void rtw_unregister_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+
+	if (pwrpriv->early_suspend.suspend) 
+		unregister_early_suspend(&pwrpriv->early_suspend);
+
+	pwrpriv->early_suspend.suspend = NULL;
+	pwrpriv->early_suspend.resume = NULL;
+}
+#endif //CONFIG_HAS_EARLYSUSPEND
+
+#ifdef CONFIG_ANDROID_POWER
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+extern int rtw_resume_process(PADAPTER padapter);
+#endif
+static void rtw_early_suspend(android_early_suspend_t *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	DBG_871X("%s\n",__FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+}
+
+static void rtw_late_resume(android_early_suspend_t *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+	DBG_871X("%s\n",__FUNCTION__);
+	if(pwrpriv->do_late_resume) {
+		#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+		rtw_set_do_late_resume(pwrpriv, _FALSE);
+		rtw_resume_process(adapter);
+		#endif
+	}
+}
+
+void rtw_register_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//jeff: set the early suspend level before blank screen, so we wll do late resume after scree is lit
+	pwrpriv->early_suspend.level = ANDROID_EARLY_SUSPEND_LEVEL_BLANK_SCREEN - 20;
+	pwrpriv->early_suspend.suspend = rtw_early_suspend;
+	pwrpriv->early_suspend.resume = rtw_late_resume;
+	android_register_early_suspend(&pwrpriv->early_suspend);	
+}
+
+void rtw_unregister_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+
+	if (pwrpriv->early_suspend.suspend) 
+		android_unregister_early_suspend(&pwrpriv->early_suspend);
+
+	pwrpriv->early_suspend.suspend = NULL;
+	pwrpriv->early_suspend.resume = NULL;
+}
+#endif //CONFIG_ANDROID_POWER
+
+u8 rtw_interface_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id,u8* val)
+{
+	u8 bResult = _TRUE;
+
+	rtw_hal_intf_ps_func(padapter,efunc_id,val);
+
+	return bResult;
+}
+
+
+inline void rtw_set_ips_deny(_adapter *padapter, u32 ms)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	pwrpriv->ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(ms);
+}
+
+/*
+* rtw_pwr_wakeup - Wake the NIC up from: 1)IPS. 2)USB autosuspend
+* @adapter: pointer to _adapter structure
+* @ips_deffer_ms: the ms wiil prevent from falling into IPS after wakeup
+* Return _SUCCESS or _FAIL
+*/
+int _rtw_pwr_wakeup(_adapter *padapter, u32 ips_deffer_ms, const char *caller)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;	
+	int ret = _SUCCESS;
+	u32 start = rtw_get_current_time();
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->pbuddy_adapter)
+		LeaveAllPowerSaveMode(padapter->pbuddy_adapter);
+
+	if ((padapter->isprimary == _FALSE) && padapter->pbuddy_adapter){
+		padapter = padapter->pbuddy_adapter;
+		pwrpriv = &padapter->pwrctrlpriv;
+		pmlmepriv = &padapter->mlmepriv;
+	}
+#endif
+
+	if (pwrpriv->ips_deny_time < rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms))
+		pwrpriv->ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms);
+
+	if (pwrpriv->ps_processing) {
+		DBG_871X("%s wait ps_processing...\n", __func__);
+		while (pwrpriv->ps_processing && rtw_get_passing_time_ms(start) <= 3000)
+			rtw_msleep_os(10);
+		if (pwrpriv->ps_processing)
+			DBG_871X("%s wait ps_processing timeout\n", __func__);
+		else
+			DBG_871X("%s wait ps_processing done\n", __func__);
+	}
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	if (rtw_hal_sreset_inprogress(padapter)) {
+		DBG_871X("%s wait sreset_inprogress...\n", __func__);
+		while (rtw_hal_sreset_inprogress(padapter) && rtw_get_passing_time_ms(start) <= 4000)
+			rtw_msleep_os(10);
+		if (rtw_hal_sreset_inprogress(padapter))
+			DBG_871X("%s wait sreset_inprogress timeout\n", __func__);
+		else
+			DBG_871X("%s wait sreset_inprogress done\n", __func__);
+	}
+#endif
+
+	if (pwrpriv->bInternalAutoSuspend == _FALSE && pwrpriv->bInSuspend) {
+		DBG_871X("%s wait bInSuspend...\n", __func__);
+		while (pwrpriv->bInSuspend 
+			&& ((rtw_get_passing_time_ms(start) <= 3000 && !rtw_is_do_late_resume(pwrpriv))
+				|| (rtw_get_passing_time_ms(start) <= 500 && rtw_is_do_late_resume(pwrpriv)))
+		) {
+			rtw_msleep_os(10);
+		}
+		if (pwrpriv->bInSuspend)
+			DBG_871X("%s wait bInSuspend timeout\n", __func__);
+		else
+			DBG_871X("%s wait bInSuspend done\n", __func__);
+	}
+
+	//System suspend is not allowed to wakeup
+	if((pwrpriv->bInternalAutoSuspend == _FALSE) && (_TRUE == pwrpriv->bInSuspend )){
+		ret = _FAIL;
+		goto exit;
+	}
+
+	//block???
+	if((pwrpriv->bInternalAutoSuspend == _TRUE)  && (padapter->net_closed == _TRUE)) {
+		ret = _FAIL;
+		goto exit;
+	}
+
+	//I think this should be check in IPS, LPS, autosuspend functions...
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		ret = _SUCCESS;
+		goto exit;
+	}
+
+	if(rf_off == pwrpriv->rf_pwrstate )
+	{		
+#ifdef CONFIG_USB_HCI
+#ifdef CONFIG_AUTOSUSPEND
+		 if(pwrpriv->brfoffbyhw==_TRUE)
+		{
+			DBG_8192C("hw still in rf_off state ...........\n");
+			ret = _FAIL;
+			goto exit;
+		}
+		else if(padapter->registrypriv.usbss_enable)
+		{
+			DBG_8192C("%s call autoresume_enter....\n",__FUNCTION__);
+			if(_FAIL ==  autoresume_enter(padapter))
+			{
+				DBG_8192C("======> autoresume fail.............\n");
+				ret = _FAIL;
+				goto exit;
+			}	
+		}
+		else
+#endif
+#endif
+		{
+#ifdef CONFIG_IPS
+			DBG_8192C("%s call ips_leave....\n",__FUNCTION__);
+			if(_FAIL ==  ips_leave(padapter))
+			{
+				DBG_8192C("======> ips_leave fail.............\n");
+				ret = _FAIL;
+				goto exit;
+			}
+#endif
+		}
+	}
+
+	//TODO: the following checking need to be merged...
+	if(padapter->bDriverStopped
+		|| !padapter->bup
+		|| !padapter->hw_init_completed
+	){
+		DBG_8192C("%s: bDriverStopped=%d, bup=%d, hw_init_completed=%u\n"
+			, caller
+		   	, padapter->bDriverStopped
+		   	, padapter->bup
+		   	, padapter->hw_init_completed);
+		ret= _FALSE;
+		goto exit;
+	}
+
+exit:
+	if (pwrpriv->ips_deny_time < rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms))
+		pwrpriv->ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms);
+	return ret;
+
+}
+
+int rtw_pm_set_lps(_adapter *padapter, u8 mode)
+{
+	int	ret = 0;	
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+	
+	if ( mode < PS_MODE_NUM )
+	{
+		if(pwrctrlpriv->power_mgnt !=mode)
+		{
+			if(PS_MODE_ACTIVE == mode)
+			{
+				LeaveAllPowerSaveMode(padapter);
+			}
+			else
+			{
+				pwrctrlpriv->LpsIdleCount = 2;
+			}
+			pwrctrlpriv->power_mgnt = mode;
+			pwrctrlpriv->bLeisurePs = (PS_MODE_ACTIVE != pwrctrlpriv->power_mgnt)?_TRUE:_FALSE;
+		}
+	}
+	else
+	{
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+int rtw_pm_set_ips(_adapter *padapter, u8 mode)
+{
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	if( mode == IPS_NORMAL || mode == IPS_LEVEL_2 ) {
+		rtw_ips_mode_req(pwrctrlpriv, mode);
+		DBG_871X("%s %s\n", __FUNCTION__, mode == IPS_NORMAL?"IPS_NORMAL":"IPS_LEVEL_2");
+		return 0;
+	} 
+	else if(mode ==IPS_NONE){
+		rtw_ips_mode_req(pwrctrlpriv, mode);
+		DBG_871X("%s %s\n", __FUNCTION__, "IPS_NONE");
+		if((padapter->bSurpriseRemoved ==0)&&(_FAIL == rtw_pwr_wakeup(padapter)) )
+			return -EFAULT;
+	}
+	else {
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c
new file mode 100755
index 0000000000000..edf85b205b3f5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c
@@ -0,0 +1,4306 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_RECV_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <mlme_osdep.h>
+#include <ip.h>
+#include <if_ether.h>
+#include <ethernet.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <wifi.h>
+#include <circ_buf.h>
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void rtw_signal_stat_timer_hdl(RTW_TIMER_HDL_ARGS);
+#else
+void rtw_signal_stat_timer_hdl(struct timer_list *t);
+#endif
+
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+
+void _rtw_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv)
+{
+
+
+_func_enter_;
+
+	_rtw_memset((u8 *)psta_recvpriv, 0, sizeof (struct sta_recv_priv));
+
+	_rtw_spinlock_init(&psta_recvpriv->lock);
+
+	//for(i=0; i<MAX_RX_NUMBLKS; i++)
+	//	_rtw_init_queue(&psta_recvpriv->blk_strms[i]);
+
+	_rtw_init_queue(&psta_recvpriv->defrag_q);
+
+_func_exit_;
+
+}
+
+sint _rtw_init_recv_priv(struct recv_priv *precvpriv, _adapter *padapter)
+{
+	sint i;
+
+	union recv_frame *precvframe;
+
+	sint	res=_SUCCESS;
+
+_func_enter_;
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((unsigned char *)precvpriv, 0, sizeof (struct  recv_priv));
+
+	_rtw_spinlock_init(&precvpriv->lock);
+
+	_rtw_init_queue(&precvpriv->free_recv_queue);
+	_rtw_init_queue(&precvpriv->recv_pending_queue);
+	_rtw_init_queue(&precvpriv->uc_swdec_pending_queue);
+
+	precvpriv->adapter = padapter;
+
+	precvpriv->free_recvframe_cnt = NR_RECVFRAME;
+
+	rtw_os_recv_resource_init(precvpriv, padapter);
+
+	precvpriv->pallocated_frame_buf = rtw_zvmalloc(NR_RECVFRAME * sizeof(union recv_frame) + RXFRAME_ALIGN_SZ);
+	
+	if(precvpriv->pallocated_frame_buf==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	//_rtw_memset(precvpriv->pallocated_frame_buf, 0, NR_RECVFRAME * sizeof(union recv_frame) + RXFRAME_ALIGN_SZ);
+
+	precvpriv->precv_frame_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(precvpriv->pallocated_frame_buf), RXFRAME_ALIGN_SZ);
+	//precvpriv->precv_frame_buf = precvpriv->pallocated_frame_buf + RXFRAME_ALIGN_SZ -
+	//						((SIZE_PTR) (precvpriv->pallocated_frame_buf) &(RXFRAME_ALIGN_SZ-1));
+
+	precvframe = (union recv_frame*) precvpriv->precv_frame_buf;
+
+
+	for(i=0; i < NR_RECVFRAME ; i++)
+	{
+		_rtw_init_listhead(&(precvframe->u.list));
+
+		rtw_list_insert_tail(&(precvframe->u.list), &(precvpriv->free_recv_queue.queue));
+
+		res = rtw_os_recv_resource_alloc(padapter, precvframe);
+
+		precvframe->u.hdr.adapter =padapter;
+		precvframe++;
+
+	}
+
+#ifdef CONFIG_USB_HCI
+
+	precvpriv->rx_pending_cnt=1;
+
+	_rtw_init_sema(&precvpriv->allrxreturnevt, 0);
+
+#endif
+
+	res = rtw_hal_init_recv_priv(padapter);
+
+	precvpriv->recvbuf_skb_alloc_fail_cnt = 0;
+	precvpriv->recvbuf_null_cnt = 0;
+	precvpriv->read_port_complete_EINPROGRESS_cnt = 0;
+	precvpriv->read_port_complete_other_urb_err_cnt = 0;
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	#ifdef PLATFORM_LINUX
+		#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+			_init_timer(&precvpriv->signal_stat_timer, padapter->pnetdev, RTW_TIMER_HDL_NAME(signal_stat), padapter);
+		#else
+			timer_setup(&precvpriv->signal_stat_timer, RTW_TIMER_HDL_NAME(signal_stat), 0);
+		#endif
+	#elif defined(PLATFORM_OS_CE) || defined(PLATFORM_WINDOWS)
+	_init_timer(&precvpriv->signal_stat_timer, padapter->hndis_adapter, RTW_TIMER_HDL_NAME(signal_stat), padapter);
+	#endif
+
+	precvpriv->signal_stat_sampling_interval = 1000; //ms
+	//precvpriv->signal_stat_converging_constant = 5000; //ms
+
+	rtw_set_signal_stat_timer(precvpriv);
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+void rtw_mfree_recv_priv_lock(struct recv_priv *precvpriv);
+void rtw_mfree_recv_priv_lock(struct recv_priv *precvpriv)
+{
+	_rtw_spinlock_free(&precvpriv->lock);
+#ifdef CONFIG_RECV_THREAD_MODE	
+	_rtw_free_sema(&precvpriv->recv_sema);
+	_rtw_free_sema(&precvpriv->terminate_recvthread_sema);
+#endif
+
+	_rtw_spinlock_free(&precvpriv->free_recv_queue.lock);
+	_rtw_spinlock_free(&precvpriv->recv_pending_queue.lock);
+
+	_rtw_spinlock_free(&precvpriv->free_recv_buf_queue.lock);
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	_rtw_spinlock_free(&precvpriv->recv_buf_pending_queue.lock);
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+}
+
+void _rtw_free_recv_priv (struct recv_priv *precvpriv)
+{
+	_adapter	*padapter = precvpriv->adapter;
+
+_func_enter_;
+
+	rtw_free_uc_swdec_pending_queue(padapter);
+
+	rtw_mfree_recv_priv_lock(precvpriv);
+
+	rtw_os_recv_resource_free(precvpriv);
+
+	if(precvpriv->pallocated_frame_buf) {
+		rtw_vmfree(precvpriv->pallocated_frame_buf, NR_RECVFRAME * sizeof(union recv_frame) + RXFRAME_ALIGN_SZ);
+	}
+
+	rtw_hal_free_recv_priv(padapter);
+
+_func_exit_;
+
+}
+
+union recv_frame *_rtw_alloc_recvframe (_queue *pfree_recv_queue)
+{
+
+	union recv_frame  *precvframe;
+	_list	*plist, *phead;
+	_adapter *padapter;
+	struct recv_priv *precvpriv;
+_func_enter_;
+
+	if(_rtw_queue_empty(pfree_recv_queue) == _TRUE)
+	{
+		precvframe = NULL;
+	}
+	else
+	{
+		phead = get_list_head(pfree_recv_queue);
+
+		plist = get_next(phead);
+
+		precvframe = LIST_CONTAINOR(plist, union recv_frame, u);
+
+		rtw_list_delete(&precvframe->u.hdr.list);
+		padapter=precvframe->u.hdr.adapter;
+		if(padapter !=NULL){
+			precvpriv=&padapter->recvpriv;
+			if(pfree_recv_queue == &precvpriv->free_recv_queue)
+				precvpriv->free_recvframe_cnt--;
+		}
+	}
+
+_func_exit_;
+
+	return precvframe;
+
+}
+
+union recv_frame *rtw_alloc_recvframe (_queue *pfree_recv_queue)
+{
+	_irqL irqL;
+	union recv_frame  *precvframe;
+	
+	_enter_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+	precvframe = _rtw_alloc_recvframe(pfree_recv_queue);
+
+	_exit_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+	return precvframe;
+}
+
+void rtw_init_recvframe(union recv_frame *precvframe, struct recv_priv *precvpriv)
+{
+	/* Perry: This can be removed */
+	_rtw_init_listhead(&precvframe->u.hdr.list);
+
+	precvframe->u.hdr.len=0;
+}
+
+int rtw_free_recvframe(union recv_frame *precvframe, _queue *pfree_recv_queue)
+{
+	_irqL irqL;
+	_adapter *padapter=precvframe->u.hdr.adapter;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+
+_func_enter_;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->adapter_type > PRIMARY_ADAPTER)
+	{
+		padapter = padapter->pbuddy_adapter;//get primary_padapter
+		precvpriv = &padapter->recvpriv;
+		pfree_recv_queue = &precvpriv->free_recv_queue;
+		precvframe->u.hdr.adapter = padapter;		
+	}	
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+	rtw_os_read_port(padapter, precvframe->u.hdr.precvbuf);
+#endif
+
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+
+	if(precvframe->u.hdr.pkt)
+	{
+#ifdef CONFIG_BSD_RX_USE_MBUF
+		m_freem(precvframe->u.hdr.pkt);
+#else	// CONFIG_BSD_RX_USE_MBUF
+		rtw_skb_free(precvframe->u.hdr.pkt);//free skb by driver
+#endif	// CONFIG_BSD_RX_USE_MBUF
+		precvframe->u.hdr.pkt = NULL;
+	}
+
+#endif //defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+
+	_enter_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+	rtw_list_delete(&(precvframe->u.hdr.list));
+
+	rtw_list_insert_tail(&(precvframe->u.hdr.list), get_list_head(pfree_recv_queue));
+
+	if(padapter !=NULL){
+		if(pfree_recv_queue == &precvpriv->free_recv_queue)
+				precvpriv->free_recvframe_cnt++;
+	}
+
+      _exit_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+
+
+
+sint _rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue)
+{
+
+	_adapter *padapter=precvframe->u.hdr.adapter;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+
+_func_enter_;
+
+	//_rtw_init_listhead(&(precvframe->u.hdr.list));
+	rtw_list_delete(&(precvframe->u.hdr.list));
+
+
+	rtw_list_insert_tail(&(precvframe->u.hdr.list), get_list_head(queue));
+
+	if (padapter != NULL) {
+		if (queue == &precvpriv->free_recv_queue)
+			precvpriv->free_recvframe_cnt++;
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+sint rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue)
+{
+	sint ret;
+	_irqL irqL;
+	
+	//_spinlock(&pfree_recv_queue->lock);
+	_enter_critical_bh(&queue->lock, &irqL);
+	ret = _rtw_enqueue_recvframe(precvframe, queue);
+	//_rtw_spinunlock(&pfree_recv_queue->lock);
+	_exit_critical_bh(&queue->lock, &irqL);
+
+	return ret;
+}
+
+/*
+sint	rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue)
+{
+	return rtw_free_recvframe(precvframe, queue);
+}
+*/
+
+
+
+
+/*
+caller : defrag ; recvframe_chk_defrag in recv_thread  (passive)
+pframequeue: defrag_queue : will be accessed in recv_thread  (passive)
+
+using spinlock to protect
+
+*/
+
+void rtw_free_recvframe_queue(_queue *pframequeue,  _queue *pfree_recv_queue)
+{
+	union	recv_frame 	*precvframe;
+	_list	*plist, *phead;
+
+_func_enter_;
+	_rtw_spinlock(&pframequeue->lock);
+
+	phead = get_list_head(pframequeue);
+	plist = get_next(phead);
+
+	while(rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		precvframe = LIST_CONTAINOR(plist, union recv_frame, u);
+
+		plist = get_next(plist);
+
+		//rtw_list_delete(&precvframe->u.hdr.list); // will do this in rtw_free_recvframe()
+
+		rtw_free_recvframe(precvframe, pfree_recv_queue);
+	}
+
+	_rtw_spinunlock(&pframequeue->lock);
+
+_func_exit_;
+
+}
+
+u32 rtw_free_uc_swdec_pending_queue(_adapter *adapter)
+{
+	u32 cnt = 0;
+	union recv_frame *pending_frame;
+	while((pending_frame=rtw_alloc_recvframe(&adapter->recvpriv.uc_swdec_pending_queue))) {
+		rtw_free_recvframe(pending_frame, &adapter->recvpriv.free_recv_queue);
+		DBG_871X("%s: dequeue uc_swdec_pending_queue\n", __func__);
+		cnt++;
+	}
+
+	return cnt;
+}
+
+
+sint rtw_enqueue_recvbuf_to_head(struct recv_buf *precvbuf, _queue *queue)
+{
+	_irqL irqL;
+
+	_enter_critical(&queue->lock, &irqL);
+
+	rtw_list_delete(&precvbuf->list);
+	rtw_list_insert_head(&precvbuf->list, get_list_head(queue));
+
+	_exit_critical(&queue->lock, &irqL);
+
+	return _SUCCESS;
+}
+
+sint rtw_enqueue_recvbuf(struct recv_buf *precvbuf, _queue *queue)
+{
+	_irqL irqL;	
+
+	_enter_critical(&queue->lock, &irqL);
+
+	rtw_list_delete(&precvbuf->list);
+
+	rtw_list_insert_tail(&precvbuf->list, get_list_head(queue));
+	
+	_exit_critical(&queue->lock, &irqL);
+
+
+	return _SUCCESS;
+	
+}
+
+struct recv_buf *rtw_dequeue_recvbuf (_queue *queue)
+{
+	_irqL irqL;
+	struct recv_buf *precvbuf;
+	_list	*plist, *phead;	
+
+	_enter_critical(&queue->lock, &irqL);
+
+	if(_rtw_queue_empty(queue) == _TRUE)
+	{
+		precvbuf = NULL;
+	}
+	else
+	{
+		phead = get_list_head(queue);
+
+		plist = get_next(phead);
+
+		precvbuf = LIST_CONTAINOR(plist, struct recv_buf, list);
+
+		rtw_list_delete(&precvbuf->list);
+		
+	}
+
+	_exit_critical(&queue->lock, &irqL);
+
+
+	return precvbuf;
+
+}
+
+sint recvframe_chkmic(_adapter *adapter,  union recv_frame *precvframe);
+sint recvframe_chkmic(_adapter *adapter,  union recv_frame *precvframe){
+
+	sint	i,res=_SUCCESS;
+	u32	datalen;
+	u8	miccode[8];
+	u8	bmic_err=_FALSE,brpt_micerror = _TRUE;
+	u8	*pframe, *payload,*pframemic;
+	u8	*mickey;
+	//u8	*iv,rxdata_key_idx=0;
+	struct	sta_info		*stainfo;
+	struct	rx_pkt_attrib	*prxattrib=&precvframe->u.hdr.attrib;
+	struct 	security_priv	*psecuritypriv=&adapter->securitypriv;
+
+	struct mlme_ext_priv	*pmlmeext = &adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+_func_enter_;
+
+	stainfo=rtw_get_stainfo(&adapter->stapriv ,&prxattrib->ta[0]);
+
+	if(prxattrib->encrypt ==_TKIP_)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n recvframe_chkmic:prxattrib->encrypt ==_TKIP_\n"));
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n recvframe_chkmic:da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+			prxattrib->ra[0],prxattrib->ra[1],prxattrib->ra[2],prxattrib->ra[3],prxattrib->ra[4],prxattrib->ra[5]));
+
+		//calculate mic code
+		if(stainfo!= NULL)
+		{
+			if(IS_MCAST(prxattrib->ra))
+			{
+				//mickey=&psecuritypriv->dot118021XGrprxmickey.skey[0];
+				//iv = precvframe->u.hdr.rx_data+prxattrib->hdrlen;
+				//rxdata_key_idx =( ((iv[3])>>6)&0x3) ;
+				mickey=&psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
+				
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n recvframe_chkmic: bcmc key \n"));
+				//DBG_871X("\n recvframe_chkmic: bcmc key psecuritypriv->dot118021XGrpKeyid(%d),pmlmeinfo->key_index(%d) ,recv key_id(%d)\n",
+				//								psecuritypriv->dot118021XGrpKeyid,pmlmeinfo->key_index,rxdata_key_idx);
+				
+				if(psecuritypriv->binstallGrpkey==_FALSE)
+				{
+					res=_FAIL;
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n recvframe_chkmic:didn't install group key!!!!!!!!!!\n"));
+					DBG_871X("\n recvframe_chkmic:didn't install group key!!!!!!!!!!\n");
+					goto exit;
+				}
+			}
+			else{
+				mickey=&stainfo->dot11tkiprxmickey.skey[0];
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n recvframe_chkmic: unicast key \n"));
+			}
+
+			datalen=precvframe->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len-prxattrib->icv_len-8;//icv_len included the mic code
+			pframe=precvframe->u.hdr.rx_data;
+			payload=pframe+prxattrib->hdrlen+prxattrib->iv_len;
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n",prxattrib->iv_len,prxattrib->icv_len));
+
+			//rtw_seccalctkipmic(&stainfo->dot11tkiprxmickey.skey[0],pframe,payload, datalen ,&miccode[0],(unsigned char)prxattrib->priority); //care the length of the data
+
+			rtw_seccalctkipmic(mickey,pframe,payload, datalen ,&miccode[0],(unsigned char)prxattrib->priority); //care the length of the data
+
+			pframemic=payload+datalen;
+
+			bmic_err=_FALSE;
+
+			for(i=0;i<8;i++){
+				if(miccode[i] != *(pframemic+i)){
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chkmic:miccode[%d](%02x) != *(pframemic+%d)(%02x) ",i,miccode[i],i,*(pframemic+i)));
+					bmic_err=_TRUE;
+				}
+			}
+
+
+			if(bmic_err==_TRUE){
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+					*(pframemic-8),*(pframemic-7),*(pframemic-6),*(pframemic-5),*(pframemic-4),*(pframemic-3),*(pframemic-2),*(pframemic-1)));
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+					*(pframemic-16),*(pframemic-15),*(pframemic-14),*(pframemic-13),*(pframemic-12),*(pframemic-11),*(pframemic-10),*(pframemic-9)));
+
+				{
+					uint i;
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n ======demp packet (len=%d)======\n",precvframe->u.hdr.len));
+					for(i=0;i<precvframe->u.hdr.len;i=i+8){
+						RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
+							*(precvframe->u.hdr.rx_data+i),*(precvframe->u.hdr.rx_data+i+1),
+							*(precvframe->u.hdr.rx_data+i+2),*(precvframe->u.hdr.rx_data+i+3),
+							*(precvframe->u.hdr.rx_data+i+4),*(precvframe->u.hdr.rx_data+i+5),
+							*(precvframe->u.hdr.rx_data+i+6),*(precvframe->u.hdr.rx_data+i+7)));
+					}
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n ======demp packet end [len=%d]======\n",precvframe->u.hdr.len));
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n hrdlen=%d, \n",prxattrib->hdrlen));
+				}
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
+					prxattrib->ra[0],prxattrib->ra[1],prxattrib->ra[2],
+					prxattrib->ra[3],prxattrib->ra[4],prxattrib->ra[5],psecuritypriv->binstallGrpkey));
+
+				// double check key_index for some timing issue ,
+				// cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue
+				if((IS_MCAST(prxattrib->ra)==_TRUE)  && (prxattrib->key_index != pmlmeinfo->key_index ))
+					brpt_micerror = _FALSE;
+				
+				if(brpt_micerror == _TRUE)
+				{
+					rtw_handle_tkip_mic_err(adapter,(u8)IS_MCAST(prxattrib->ra));
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" mic error :prxattrib->bdecrypted=%d \n", brpt_micerror));
+					DBG_871X(" mic error :brpt_micerror=%d\n", brpt_micerror);
+				}
+
+				res=_FAIL;
+
+			}
+			else{
+				//mic checked ok
+				if((psecuritypriv->bcheck_grpkey ==_FALSE)&&(IS_MCAST(prxattrib->ra)==_TRUE)){
+					psecuritypriv->bcheck_grpkey =_TRUE;
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("psecuritypriv->bcheck_grpkey =_TRUE"));
+				}
+			}
+
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chkmic: rtw_get_stainfo==NULL!!!\n"));
+		}
+
+		recvframe_pull_tail(precvframe, 8);
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+//decrypt and set the ivlen,icvlen of the recv_frame
+union recv_frame * decryptor(_adapter *padapter,union recv_frame *precv_frame);
+union recv_frame * decryptor(_adapter *padapter,union recv_frame *precv_frame)
+{
+
+	struct rx_pkt_attrib *prxattrib = &precv_frame->u.hdr.attrib;
+	struct security_priv *psecuritypriv=&padapter->securitypriv;
+	union recv_frame *return_packet=precv_frame;
+	u32	 res=_SUCCESS;
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("prxstat->decrypted=%x prxattrib->encrypt = 0x%03x\n",prxattrib->bdecrypted,prxattrib->encrypt));
+
+	if(prxattrib->encrypt>0)
+	{
+		u8 *iv = precv_frame->u.hdr.rx_data+prxattrib->hdrlen;
+		prxattrib->key_index = ( ((iv[3])>>6)&0x3) ;
+
+		if(prxattrib->key_index > WEP_KEYS)
+		{
+			DBG_871X("prxattrib->key_index(%d) > WEP_KEYS \n", prxattrib->key_index);
+
+			switch(prxattrib->encrypt){
+				case _WEP40_:
+				case _WEP104_:
+					prxattrib->key_index = psecuritypriv->dot11PrivacyKeyIndex;
+					break;
+				case _TKIP_:			
+				case _AES_:						
+				default:
+					prxattrib->key_index = psecuritypriv->dot118021XGrpKeyid;
+					break;
+			}	
+		}			
+	}
+
+	if((prxattrib->encrypt>0) && ((prxattrib->bdecrypted==0) ||(psecuritypriv->sw_decrypt==_TRUE)))
+	{
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(!IS_MCAST(prxattrib->ra))//bc/mc packets use sw decryption for concurrent mode
+#endif			
+		psecuritypriv->hw_decrypted=_FALSE;
+
+		#ifdef DBG_RX_DECRYPTOR
+		DBG_871X("prxstat->bdecrypted:%d,  prxattrib->encrypt:%d,  Setting psecuritypriv->hw_decrypted = %d\n"
+			, prxattrib->bdecrypted ,prxattrib->encrypt, psecuritypriv->hw_decrypted);
+		#endif
+
+		switch(prxattrib->encrypt){
+		case _WEP40_:
+		case _WEP104_:
+			rtw_wep_decrypt(padapter, (u8 *)precv_frame);
+			break;
+		case _TKIP_:
+			res = rtw_tkip_decrypt(padapter, (u8 *)precv_frame);
+			break;
+		case _AES_:
+			res = rtw_aes_decrypt(padapter, (u8 * )precv_frame);
+			break;
+		default:
+				break;
+		}
+	}
+	else if(prxattrib->bdecrypted==1
+		&& prxattrib->encrypt >0
+		&& (psecuritypriv->busetkipkey==1 || prxattrib->encrypt !=_TKIP_ )
+		)
+	{
+#if 0
+		if((prxstat->icv==1)&&(prxattrib->encrypt!=_AES_))
+		{
+			psecuritypriv->hw_decrypted=_FALSE;
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("psecuritypriv->hw_decrypted=_FALSE"));
+
+			rtw_free_recvframe(precv_frame, &padapter->recvpriv.free_recv_queue);
+
+			return_packet=NULL;
+
+		}
+		else
+#endif
+		{
+			psecuritypriv->hw_decrypted=_TRUE;
+			#ifdef DBG_RX_DECRYPTOR
+			DBG_871X("prxstat->bdecrypted:%d,  prxattrib->encrypt:%d,  Setting psecuritypriv->hw_decrypted = %d\n"
+			, prxattrib->bdecrypted ,prxattrib->encrypt, psecuritypriv->hw_decrypted);
+			#endif
+
+		}
+	}
+	else {
+		#ifdef DBG_RX_DECRYPTOR
+		DBG_871X("prxstat->bdecrypted:%d,  prxattrib->encrypt:%d,  psecuritypriv->hw_decrypted:%d\n"
+		, prxattrib->bdecrypted ,prxattrib->encrypt, psecuritypriv->hw_decrypted);
+		#endif
+	}
+	
+	if(res == _FAIL)
+	{
+		rtw_free_recvframe(return_packet,&padapter->recvpriv.free_recv_queue);			
+		return_packet = NULL;
+		
+	}
+	//recvframe_chkmic(adapter, precv_frame);   //move to recvframme_defrag function
+	
+_func_exit_;
+
+	return return_packet;
+
+}
+//###set the security information in the recv_frame
+union recv_frame * portctrl(_adapter *adapter,union recv_frame * precv_frame);
+union recv_frame * portctrl(_adapter *adapter,union recv_frame * precv_frame)
+{
+	u8   *psta_addr,*ptr;
+	uint  auth_alg;
+	struct recv_frame_hdr *pfhdr;
+	struct sta_info * psta;
+	struct sta_priv *pstapriv ;
+	union recv_frame * prtnframe;
+	u16	ether_type=0;
+	u16  eapol_type = 0x888e;//for Funia BD's WPA issue  
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+
+_func_enter_;
+
+	pstapriv = &adapter->stapriv;
+	ptr = get_recvframe_data(precv_frame);
+	pfhdr = &precv_frame->u.hdr;
+	psta_addr = pfhdr->attrib.ta;
+	psta = rtw_get_stainfo(pstapriv, psta_addr);
+
+	auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("########portctrl:adapter->securitypriv.dot11AuthAlgrthm= 0x%d\n",adapter->securitypriv.dot11AuthAlgrthm));
+
+	if(auth_alg==2)
+	{
+		if ((psta!=NULL) && (psta->ieee8021x_blocked))
+		{
+			//blocked
+			//only accept EAPOL frame
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("########portctrl:psta->ieee8021x_blocked==1\n"));
+
+			prtnframe=precv_frame;
+
+			//get ether_type
+			ptr=ptr+pfhdr->attrib.hdrlen+pfhdr->attrib.iv_len+LLC_HEADER_SIZE;
+			_rtw_memcpy(&ether_type,ptr, 2);
+			ether_type= ntohs((unsigned short )ether_type);
+
+		        if (ether_type == eapol_type) {
+				prtnframe=precv_frame;
+			}
+			else {
+				//free this frame
+				rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue);
+				prtnframe=NULL;
+			}
+		}
+		else
+		{
+			//allowed
+			//check decryption status, and decrypt the frame if needed
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("########portctrl:psta->ieee8021x_blocked==0\n"));
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("portctrl:precv_frame->hdr.attrib.privacy=%x\n",precv_frame->u.hdr.attrib.privacy));
+
+			if(pattrib->bdecrypted==0)
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("portctrl:prxstat->decrypted=%x\n", pattrib->bdecrypted));
+
+			prtnframe=precv_frame;
+			//check is the EAPOL frame or not (Rekey)
+			if(ether_type == eapol_type){
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("########portctrl:ether_type == 0x888e\n"));
+				//check Rekey
+
+				prtnframe=precv_frame;
+			}
+			else{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("########portctrl:ether_type = 0x%.4x\n",ether_type));
+			}
+		}
+	}
+	else
+	{
+		prtnframe=precv_frame;
+	}
+
+_func_exit_;
+
+		return prtnframe;
+
+}
+
+sint recv_decache(union recv_frame *precv_frame, u8 bretry, struct stainfo_rxcache *prxcache);
+sint recv_decache(union recv_frame *precv_frame, u8 bretry, struct stainfo_rxcache *prxcache)
+{
+	sint tid = precv_frame->u.hdr.attrib.priority;
+
+	u16 seq_ctrl = ( (precv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
+		(precv_frame->u.hdr.attrib.frag_num & 0xf);
+
+_func_enter_;
+
+	if(tid>15)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_decache, (tid>15)! seq_ctrl=0x%x, tid=0x%x\n", seq_ctrl, tid));
+
+		return _FAIL;
+	}
+
+	if(1)//if(bretry)
+	{
+		if(seq_ctrl == prxcache->tid_rxseq[tid])
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_decache, seq_ctrl=0x%x, tid=0x%x, tid_rxseq=0x%x\n", seq_ctrl, tid, prxcache->tid_rxseq[tid]));
+
+			return _FAIL;
+		}
+	}
+
+	prxcache->tid_rxseq[tid] = seq_ctrl;
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+void process_pwrbit_data(_adapter *padapter, union recv_frame *precv_frame);
+void process_pwrbit_data(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	unsigned char pwrbit;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *psta=NULL;
+
+	psta = rtw_get_stainfo(pstapriv, pattrib->src);
+
+	pwrbit = GetPwrMgt(ptr);
+
+	if(psta)
+	{
+		if(pwrbit)
+		{
+			if(!(psta->state & WIFI_SLEEP_STATE))
+			{
+				//psta->state |= WIFI_SLEEP_STATE;
+				//pstapriv->sta_dz_bitmap |= BIT(psta->aid);
+
+				stop_sta_xmit(padapter, psta);
+
+				//DBG_871X("to sleep, sta_dz_bitmap=%x\n", pstapriv->sta_dz_bitmap);
+			}
+		}
+		else
+		{
+			if(psta->state & WIFI_SLEEP_STATE)
+			{
+				//psta->state ^= WIFI_SLEEP_STATE;
+				//pstapriv->sta_dz_bitmap &= ~BIT(psta->aid);				
+
+				wakeup_sta_to_xmit(padapter, psta);
+
+				//DBG_871X("to wakeup, sta_dz_bitmap=%x\n", pstapriv->sta_dz_bitmap);
+			}
+		}
+
+	}
+
+#endif
+}
+
+void process_wmmps_data(_adapter *padapter, union recv_frame *precv_frame);
+void process_wmmps_data(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE		
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *psta=NULL;
+
+	psta = rtw_get_stainfo(pstapriv, pattrib->src);
+	
+	if(!psta) return;
+
+#ifdef CONFIG_TDLS
+	if( !(psta->tdls_sta_state & TDLS_LINKED_STATE ) )
+	{
+#endif //CONFIG_TDLS
+
+	if(!psta->qos_option)
+		return;
+
+	if(!(psta->qos_info&0xf))
+		return;
+		
+#ifdef CONFIG_TDLS
+	}
+#endif //CONFIG_TDLS	
+
+	if(psta->state&WIFI_SLEEP_STATE)
+	{
+		u8 wmmps_ac=0;	
+		
+		switch(pattrib->priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(1);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(1);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(1);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(1);
+				break;	
+		}
+
+		if(wmmps_ac)
+		{
+			if(psta->sleepq_ac_len>0)
+			{
+				//process received triggered frame
+				xmit_delivery_enabled_frames(padapter, psta);
+			}
+			else
+			{
+				//issue one qos null frame with More data bit = 0 and the EOSP bit set (=1)
+				issue_qos_nulldata(padapter, psta->hwaddr, (u16)pattrib->priority, 0, 0);
+			}
+		}
+				
+	}
+
+	
+#endif	
+
+}
+
+#ifdef CONFIG_TDLS
+sint OnTDLS(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct rx_pkt_attrib	*pattrib = & precv_frame->u.hdr.attrib;
+	sint ret = _SUCCESS;
+	u8 *paction = get_recvframe_data(precv_frame);
+	u8 category_field = 1;
+#ifdef CONFIG_WFD
+	u8 WFA_OUI[3] = { 0x50, 0x6f, 0x9a };
+#endif //CONFIG_WFD
+	struct tdls_info *ptdlsinfo = &(adapter->tdlsinfo);
+
+	//point to action field
+	paction+=pattrib->hdrlen 
+			+ pattrib->iv_len 
+			+ SNAP_SIZE 
+			+ ETH_TYPE_LEN 
+			+ PAYLOAD_TYPE_LEN 
+			+ category_field;
+
+	if(ptdlsinfo->enable == 0)
+	{
+		DBG_871X("recv tdls frame, "
+				"but tdls haven't enabled\n");
+		ret = _FAIL;
+		return ret;
+	}
+	
+	switch(*paction){
+		case TDLS_SETUP_REQUEST:
+			DBG_871X("recv tdls setup request frame\n");
+			ret=On_TDLS_Setup_Req(adapter, precv_frame);
+			break;
+		case TDLS_SETUP_RESPONSE:
+			DBG_871X("recv tdls setup response frame\n");			
+			ret=On_TDLS_Setup_Rsp(adapter, precv_frame);
+			break;
+		case TDLS_SETUP_CONFIRM:
+			DBG_871X("recv tdls setup confirm frame\n");
+			ret=On_TDLS_Setup_Cfm(adapter, precv_frame);
+			break;
+		case TDLS_TEARDOWN:
+			DBG_871X("recv tdls teardown, free sta_info\n");
+			ret=On_TDLS_Teardown(adapter, precv_frame);
+			break;
+		case TDLS_DISCOVERY_REQUEST:
+			DBG_871X("recv tdls discovery request frame\n");
+			ret=On_TDLS_Dis_Req(adapter, precv_frame);
+			break;
+		case TDLS_PEER_TRAFFIC_RESPONSE:
+			DBG_871X("recv tdls peer traffic response frame\n");
+			ret=On_TDLS_Peer_Traffic_Rsp(adapter, precv_frame);
+			break;
+		case TDLS_CHANNEL_SWITCH_REQUEST:
+			DBG_871X("recv tdls channel switch request frame\n");
+			ret=On_TDLS_Ch_Switch_Req(adapter, precv_frame);
+			break;
+		case TDLS_CHANNEL_SWITCH_RESPONSE:
+			DBG_871X("recv tdls channel switch response frame\n");
+			ret=On_TDLS_Ch_Switch_Rsp(adapter, precv_frame);
+			break;
+#ifdef CONFIG_WFD			
+		case 0x50:	//First byte of WFA OUI
+			if( _rtw_memcmp(WFA_OUI, (paction), 3) )
+			{
+				if( *(paction + 3) == 0x04)	//Probe request frame
+				{
+					//WFDTDLS: for sigma test, do not setup direct link automatically
+					ptdlsinfo->dev_discovered = 1;
+					DBG_871X("recv tunneled probe request frame\n");
+					issue_tunneled_probe_rsp(adapter, precv_frame);
+				}
+				if( *(paction + 3) == 0x05)	//Probe response frame
+				{
+					//WFDTDLS: for sigma test, do not setup direct link automatically
+					ptdlsinfo->dev_discovered = 1;
+					DBG_871X("recv tunneled probe response frame\n");
+				}
+			}
+			break;
+#endif //CONFIG_WFD
+		default:
+			DBG_871X("receive TDLS frame but not supported\n");
+			ret=_FAIL;
+			break;
+	}
+
+exit:
+	return ret;
+	
+}
+#endif //CONFIG_TDLS
+
+void count_rx_stats(_adapter *padapter, union recv_frame *prframe, struct sta_info*sta);
+void count_rx_stats(_adapter *padapter, union recv_frame *prframe, struct sta_info*sta)
+{
+	int	sz;
+	struct sta_info		*psta = NULL;
+	struct stainfo_stats	*pstats = NULL;
+	struct rx_pkt_attrib	*pattrib = & prframe->u.hdr.attrib;
+	struct recv_priv		*precvpriv = &padapter->recvpriv;
+
+	sz = get_recvframe_len(prframe);
+	precvpriv->rx_bytes += sz;
+
+	padapter->mlmepriv.LinkDetectInfo.NumRxOkInPeriod++;
+
+	if( (!MacAddr_isBcst(pattrib->dst)) && (!IS_MCAST(pattrib->dst))){
+		padapter->mlmepriv.LinkDetectInfo.NumRxUnicastOkInPeriod++;
+	}
+
+	if(sta)
+		psta = sta;
+	else
+		psta = prframe->u.hdr.psta;
+
+	if(psta)
+	{
+		pstats = &psta->sta_stats;
+
+		pstats->rx_data_pkts++;
+		pstats->rx_bytes += sz;
+	}
+
+}
+
+sint sta2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta
+);
+sint sta2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta
+)
+{
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	sint ret = _SUCCESS;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	struct	sta_priv 		*pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	u8 *mybssid  = get_bssid(pmlmepriv);
+	u8 *myhwaddr = myid(&adapter->eeprompriv);
+	u8 * sta_addr = NULL;
+	sint bmcast = IS_MCAST(pattrib->dst);
+
+#ifdef CONFIG_TDLS	
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct sta_info *ptdls_sta=NULL;
+	u8 *psnap_type=ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	u8 *pframe_body = psnap_type + ETH_TYPE_LEN + PAYLOAD_TYPE_LEN;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
+	{
+
+		// filter packets that SA is myself or multicast or broadcast
+		if (_rtw_memcmp(myhwaddr, pattrib->src, ETH_ALEN)){
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" SA==myself \n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if( (!_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN))	&& (!bmcast) ){
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if( _rtw_memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		   _rtw_memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		   (!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN)) ) {
+			ret= _FAIL;
+			goto exit;
+		}
+
+		sta_addr = pattrib->src;
+
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+#ifdef CONFIG_TDLS
+		//direct link data transfer
+		if(ptdlsinfo->setup_state == TDLS_LINKED_STATE){
+			ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->src);
+			if(ptdls_sta==NULL)
+			{
+				ret=_FAIL;
+				goto exit;
+			}
+			else if(ptdls_sta->tdls_sta_state&TDLS_LINKED_STATE)
+			{
+				//drop QoS-SubType Data, including QoS NULL, excluding QoS-Data
+				if( (GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE )== WIFI_QOS_DATA_TYPE)
+				{
+					if(GetFrameSubType(ptr)&(BIT(4)|BIT(5)|BIT(6)))
+					{
+						DBG_871X("drop QoS-Sybtype Data\n");
+						ret= _FAIL;
+						goto exit;
+					}
+				}
+				// filter packets that SA is myself or multicast or broadcast
+				if (_rtw_memcmp(myhwaddr, pattrib->src, ETH_ALEN)){
+					ret= _FAIL;
+					goto exit;
+				}
+				// da should be for me
+				if((!_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN))&& (!bmcast))
+				{
+					ret= _FAIL;
+					goto exit;
+				}
+				// check BSSID
+				if( _rtw_memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+				     _rtw_memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+				     (!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN)) )
+				{
+					ret= _FAIL;
+					goto exit;
+				}
+
+				//process UAPSD tdls sta
+				process_pwrbit_data(adapter, precv_frame);
+
+				// if NULL-frame, check pwrbit
+				if ((GetFrameSubType(ptr)) == WIFI_DATA_NULL)
+				{
+					//NULL-frame with pwrbit=1, buffer_STA should buffer frames for sleep_STA
+					if(GetPwrMgt(ptr))
+					{
+						DBG_871X("TDLS: recv peer null frame with pwr bit 1\n");
+						ptdls_sta->tdls_sta_state|=TDLS_PEER_SLEEP_STATE;
+					}
+					// it would be triggered when we are off channel and receiving NULL DATA
+					// we can confirm that peer STA is at off channel
+					else if(ptdls_sta->tdls_sta_state&TDLS_CH_SWITCH_ON_STATE)
+					{
+						if((ptdls_sta->tdls_sta_state & TDLS_PEER_AT_OFF_STATE) != TDLS_PEER_AT_OFF_STATE)
+						{
+							issue_nulldata_to_TDLS_peer_STA(adapter, ptdls_sta, 0);
+							ptdls_sta->tdls_sta_state |= TDLS_PEER_AT_OFF_STATE;
+							On_TDLS_Peer_Traffic_Rsp(adapter, precv_frame);
+						}
+					}
+
+					ret= _FAIL;
+					goto exit;
+				}
+				//receive some of all TDLS management frames, process it at ON_TDLS
+				if((_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_TDLS, 2))){
+					ret= OnTDLS(adapter, precv_frame);
+					goto exit;
+				}
+				
+			}
+
+			sta_addr = pattrib->src;
+			
+		}		
+		else
+#endif //CONFIG_TDLS
+		{
+			// For Station mode, sa and bssid should always be BSSID, and DA is my mac-address
+			if(!_rtw_memcmp(pattrib->bssid, pattrib->src, ETH_ALEN) )
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("bssid != TA under STATION_MODE; drop pkt\n"));
+				ret= _FAIL;
+				goto exit;
+			}
+
+			sta_addr = pattrib->bssid;
+		}
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		if (bmcast)
+		{
+			// For AP mode, if DA == MCAST, then BSSID should be also MCAST
+			if (!IS_MCAST(pattrib->bssid)){
+					ret= _FAIL;
+					goto exit;
+			}
+		}
+		else // not mc-frame
+		{
+			// For AP mode, if DA is non-MCAST, then it must be BSSID, and bssid == BSSID
+			if(!_rtw_memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN)) {
+				ret= _FAIL;
+				goto exit;
+			}
+
+			sta_addr = pattrib->src;
+		}
+
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		_rtw_memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+		sta_addr = mybssid;
+	}
+	else
+	{
+		ret  = _FAIL;
+	}
+
+
+
+	if(bmcast)
+		*psta = rtw_get_bcmc_stainfo(adapter);
+	else
+		*psta = rtw_get_stainfo(pstapriv, sta_addr); // get ap_info
+
+#ifdef CONFIG_TDLS
+	if(ptdls_sta != NULL)
+		*psta = ptdls_sta;
+#endif //CONFIG_TDLS
+
+
+	if (*psta == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("can't get psta under sta2sta_data_frame ; drop pkt\n"));
+#ifdef CONFIG_MP_INCLUDED
+		if(check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+		adapter->mppriv.rx_pktloss++;
+#endif
+		ret= _FAIL;
+		goto exit;
+	}
+
+exit:
+_func_exit_;
+	return ret;
+
+}
+
+sint ap2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta );
+sint ap2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta )
+{
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	sint ret = _SUCCESS;
+	struct	sta_priv 		*pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	u8 *mybssid  = get_bssid(pmlmepriv);
+	u8 *myhwaddr = myid(&adapter->eeprompriv);
+	sint bmcast = IS_MCAST(pattrib->dst);
+
+_func_enter_;
+
+	if ((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+		&& (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE 
+			|| check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE	)
+		)
+	{
+
+		// filter packets that SA is myself or multicast or broadcast
+		if (_rtw_memcmp(myhwaddr, pattrib->src, ETH_ALEN)){
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" SA==myself \n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s SA=%x:%x:%x:%x:%x:%x, myhwaddr= %x:%x:%x:%x:%x:%x\n", __FUNCTION__,
+				pattrib->src[0], pattrib->src[1], pattrib->src[2],
+				pattrib->src[3], pattrib->src[4], pattrib->src[5],
+				*(myhwaddr), *(myhwaddr+1), *(myhwaddr+2),
+				*(myhwaddr+3), *(myhwaddr+4), *(myhwaddr+5));
+			#endif			
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// da should be for me
+		if((!_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN))&& (!bmcast))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,
+				(" ap2sta_data_frame:  compare DA fail; DA="MAC_FMT"\n", MAC_ARG(pattrib->dst)));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s DA="MAC_FMT"\n", __func__, MAC_ARG(pattrib->dst));
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+
+		// check BSSID
+		if( _rtw_memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		     _rtw_memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		     (!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN)) )
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,
+				(" ap2sta_data_frame:  compare BSSID fail ; BSSID="MAC_FMT"\n", MAC_ARG(pattrib->bssid)));
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("mybssid="MAC_FMT"\n", MAC_ARG(mybssid)));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s BSSID="MAC_FMT", mybssid="MAC_FMT"\n",
+				__FUNCTION__, MAC_ARG(pattrib->bssid), MAC_ARG(mybssid));
+			DBG_871X( "this adapter = %d, buddy adapter = %d\n", adapter->adapter_type, adapter->pbuddy_adapter->adapter_type );
+			#endif
+
+			if(!bmcast)
+			{
+				DBG_871X("issue_deauth to the nonassociated ap=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->bssid));
+				issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+			}
+
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if(bmcast)
+			*psta = rtw_get_bcmc_stainfo(adapter);
+		else
+			*psta = rtw_get_stainfo(pstapriv, pattrib->bssid); // get ap_info
+
+		if (*psta == NULL) {
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("ap2sta: can't get psta under STATION_MODE ; drop pkt\n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s can't get psta under STATION_MODE ; drop pkt\n", __FUNCTION__);
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE) {
+		}
+
+		if (GetFrameSubType(ptr) & BIT(6)) {
+			/* No data, will not indicate to upper layer, temporily count it here */
+			count_rx_stats(adapter, precv_frame, *psta);
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+
+	}
+	else if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE) &&
+		     (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) )
+	{
+		_rtw_memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+		//
+		_rtw_memcpy(pattrib->bssid,  mybssid, ETH_ALEN);
+
+
+		*psta = rtw_get_stainfo(pstapriv, pattrib->bssid); // get sta_info
+		if (*psta == NULL) {
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("can't get psta under MP_MODE ; drop pkt\n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s can't get psta under WIFI_MP_STATE ; drop pkt\n", __FUNCTION__);
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+
+	}
+	else if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		/* Special case */
+		ret = RTW_RX_HANDLED;
+		goto exit;
+	}
+	else
+	{
+		if(_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN)&& (!bmcast))
+		{
+			*psta = rtw_get_stainfo(pstapriv, pattrib->bssid); // get sta_info
+			if (*psta == NULL)
+			{
+				DBG_871X("issue_deauth to the ap=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->bssid));
+		
+				issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+			}
+		}	
+	
+		ret = _FAIL;
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s fw_state:0x%x\n", __FUNCTION__, get_fwstate(pmlmepriv));
+		#endif
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+
+}
+
+sint sta2ap_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta );
+sint sta2ap_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta )
+{
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	struct	sta_priv 		*pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	unsigned char *mybssid  = get_bssid(pmlmepriv);	
+	sint ret=_SUCCESS;
+
+_func_enter_;
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		//For AP mode, RA=BSSID, TX=STA(SRC_ADDR), A3=DST_ADDR
+		if(!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN))
+		{
+			ret= _FAIL;
+			goto exit;
+		}
+
+		*psta = rtw_get_stainfo(pstapriv, pattrib->src);
+		if (*psta == NULL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("can't get psta under AP_MODE; drop pkt\n"));
+			DBG_871X("issue_deauth to sta=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->src));
+
+			issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+
+		process_pwrbit_data(adapter, precv_frame);
+
+		if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE) {
+			process_wmmps_data(adapter, precv_frame);
+		}
+
+		if (GetFrameSubType(ptr) & BIT(6)) {
+			/* No data, will not indicate to upper layer, temporily count it here */
+			count_rx_stats(adapter, precv_frame, *psta);
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+	}
+	else {
+		u8 *myhwaddr = myid(&adapter->eeprompriv);
+		if (!_rtw_memcmp(pattrib->ra, myhwaddr, ETH_ALEN)) {
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+		DBG_871X("issue_deauth to sta=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->src));
+		issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+		ret = RTW_RX_HANDLED;
+		goto exit;
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+
+}
+
+sint validate_recv_ctrl_frame(_adapter *padapter, union recv_frame *precv_frame);
+sint validate_recv_ctrl_frame(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	//uint len = precv_frame->u.hdr.len;
+		
+	//DBG_871X("+validate_recv_ctrl_frame\n");
+
+	if (GetFrameType(pframe) != WIFI_CTRL_TYPE)
+	{		
+		return _FAIL;
+	}
+
+	//receive the frames that ra(a1) is my address
+	if (!_rtw_memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN))
+	{
+		return _FAIL;
+	}
+
+	//only handle ps-poll
+	if(GetFrameSubType(pframe) == WIFI_PSPOLL)
+	{
+		u16 aid;
+		u8 wmmps_ac=0;	
+		struct sta_info *psta=NULL;
+	
+		aid = GetAid(pframe);
+		psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+		
+		if((psta==NULL) || (psta->aid!=aid))
+		{
+			return _FAIL;
+		}
+
+		//for rx pkt statistics
+		psta->sta_stats.rx_ctrl_pkts++;
+
+		switch(pattrib->priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(0);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(0);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(0);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(0);
+				break;	
+		}
+
+		if(wmmps_ac)
+			return _FAIL;
+
+		if(psta->state & WIFI_STA_ALIVE_CHK_STATE)
+		{					
+			DBG_871X("%s alive check-rx ps-poll\n", __func__);
+			psta->expire_to = pstapriv->expire_to;
+			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
+		}	
+
+		if((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid)))
+		{
+			_irqL irqL;	 
+			_list	*xmitframe_plist, *xmitframe_phead;
+			struct xmit_frame *pxmitframe=NULL;
+			struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+		
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+			_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+			xmitframe_phead = get_list_head(&psta->sleep_q);
+			xmitframe_plist = get_next(xmitframe_phead);
+
+			if ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+			{			
+				pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+				xmitframe_plist = get_next(xmitframe_plist);
+
+				rtw_list_delete(&pxmitframe->list);
+
+				psta->sleepq_len--;
+
+				if(psta->sleepq_len>0)
+					pxmitframe->attrib.mdata = 1;
+                                else
+					pxmitframe->attrib.mdata = 0;
+
+				pxmitframe->attrib.triggered = 1;
+
+	                        //DBG_871X("handling ps-poll, q_len=%d, tim=%x\n", psta->sleepq_len, pstapriv->tim_bitmap);
+
+#if 0
+				_exit_critical_bh(&psta->sleep_q.lock, &irqL);		
+				if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+				{		
+					rtw_os_xmit_complete(padapter, pxmitframe);
+				}
+				_enter_critical_bh(&psta->sleep_q.lock, &irqL);	
+#endif
+				rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+				if(psta->sleepq_len==0)
+				{
+					pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+					//DBG_871X("after handling ps-poll, tim=%x\n", pstapriv->tim_bitmap);
+
+					//upate BCN for TIM IE
+					//update_BCNTIM(padapter);		
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+				}
+				
+				//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				_exit_critical_bh(&pxmitpriv->lock, &irqL);
+				
+			}
+			else
+			{
+				//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				_exit_critical_bh(&pxmitpriv->lock, &irqL);
+			
+				//DBG_871X("no buffered packets to xmit\n");
+				if(pstapriv->tim_bitmap&BIT(psta->aid))
+				{
+					if(psta->sleepq_len==0)
+					{
+						DBG_871X("no buffered packets to xmit\n");
+
+						//issue nulldata with More data bit = 0 to indicate we have no buffered packets
+						issue_nulldata(padapter, psta->hwaddr, 0, 0, 0);
+					}
+					else
+					{
+						DBG_871X("error!psta->sleepq_len=%d\n", psta->sleepq_len);
+						psta->sleepq_len=0;						
+					}
+				
+					pstapriv->tim_bitmap &= ~BIT(psta->aid);					
+
+					//upate BCN for TIM IE
+					//update_BCNTIM(padapter);
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+				}
+				
+			}				
+			
+		}
+		
+	}
+	
+#endif
+
+	return _FAIL;
+
+}
+
+union recv_frame* recvframe_chk_defrag(PADAPTER padapter, union recv_frame *precv_frame);
+sint validate_recv_mgnt_frame(PADAPTER padapter, union recv_frame *precv_frame);
+sint validate_recv_mgnt_frame(PADAPTER padapter, union recv_frame *precv_frame)
+{
+	//struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+
+	RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("+validate_recv_mgnt_frame\n"));
+
+#if 0
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+#ifdef CONFIG_NATIVEAP_MLME
+		mgt_dispatcher(padapter, precv_frame);
+#else
+		rtw_hostapd_mlme_rx(padapter, precv_frame);
+#endif
+	}
+	else
+	{
+		mgt_dispatcher(padapter, precv_frame);
+	}
+#endif
+
+	precv_frame = recvframe_chk_defrag(padapter, precv_frame);
+	if (precv_frame == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,("%s: fragment packet\n",__FUNCTION__));
+		return _SUCCESS;
+	}
+
+	{
+		//for rx pkt statistics
+		struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(precv_frame->u.hdr.rx_data));
+		if (psta) {
+			psta->sta_stats.rx_mgnt_pkts++;
+			if (GetFrameSubType(precv_frame->u.hdr.rx_data) == WIFI_BEACON)
+				psta->sta_stats.rx_beacon_pkts++;
+			else if (GetFrameSubType(precv_frame->u.hdr.rx_data) == WIFI_PROBEREQ)
+				psta->sta_stats.rx_probereq_pkts++;
+			else if (GetFrameSubType(precv_frame->u.hdr.rx_data) == WIFI_PROBERSP) {
+				if (_rtw_memcmp(padapter->eeprompriv.mac_addr, GetAddr1Ptr(precv_frame->u.hdr.rx_data), ETH_ALEN) == _TRUE)
+					psta->sta_stats.rx_probersp_pkts++;
+				else if (is_broadcast_mac_addr(GetAddr1Ptr(precv_frame->u.hdr.rx_data))
+					|| is_multicast_mac_addr(GetAddr1Ptr(precv_frame->u.hdr.rx_data)))
+					psta->sta_stats.rx_probersp_bm_pkts++;
+				else 
+					psta->sta_stats.rx_probersp_uo_pkts++;
+			}
+		}
+	}
+
+#ifdef CONFIG_INTEL_PROXIM
+	if(padapter->proximity.proxim_on==_TRUE)
+	{
+		struct rx_pkt_attrib * pattrib=&precv_frame->u.hdr.attrib;
+		 struct recv_stat* prxstat=( struct recv_stat * )  precv_frame->u.hdr.rx_head ;
+		 u8 * pda,*psa,*pbssid,*ptr;
+		 ptr=precv_frame->u.hdr.rx_data; 
+		pda = get_da(ptr);
+		psa = get_sa(ptr);
+		pbssid = get_hdr_bssid(ptr);
+
+
+		_rtw_memcpy(pattrib->dst, pda, ETH_ALEN);
+		_rtw_memcpy(pattrib->src, psa, ETH_ALEN);
+
+		_rtw_memcpy(pattrib->bssid, pbssid, ETH_ALEN);
+
+	switch(pattrib->to_fr_ds)
+	{
+		case 0:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			break;
+
+		case 1:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, pbssid, ETH_ALEN);
+			break;
+
+		case 2:
+			_rtw_memcpy(pattrib->ra, pbssid, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			break;
+
+		case 3:
+			_rtw_memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" case 3\n"));
+			break;
+
+		default:
+			break;
+
+		}	
+			pattrib->priority=0;
+			pattrib->hdrlen = pattrib->to_fr_ds==3 ? 30 : 24;
+
+		 padapter->proximity.proxim_rx(padapter,precv_frame);
+	}
+#endif
+	mgt_dispatcher(padapter, precv_frame);
+
+	return _SUCCESS;
+
+}
+
+sint validate_recv_data_frame(_adapter *adapter, union recv_frame *precv_frame);
+sint validate_recv_data_frame(_adapter *adapter, union recv_frame *precv_frame)
+{
+	u8 bretry;
+	u8 *psa, *pda, *pbssid;
+	struct sta_info *psta = NULL;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*pattrib = & precv_frame->u.hdr.attrib;
+	struct security_priv	*psecuritypriv = &adapter->securitypriv;	
+	sint ret = _SUCCESS;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+	bretry = GetRetry(ptr);
+	pda = get_da(ptr);
+	psa = get_sa(ptr);
+	pbssid = get_hdr_bssid(ptr);
+
+	if(pbssid == NULL){
+		ret= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memcpy(pattrib->dst, pda, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, psa, ETH_ALEN);
+
+	_rtw_memcpy(pattrib->bssid, pbssid, ETH_ALEN);
+
+	switch(pattrib->to_fr_ds)
+	{
+		case 0:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			ret = sta2sta_data_frame(adapter, precv_frame, &psta);
+			break;
+
+		case 1:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, pbssid, ETH_ALEN);
+			ret = ap2sta_data_frame(adapter, precv_frame, &psta);
+			break;
+
+		case 2:
+			_rtw_memcpy(pattrib->ra, pbssid, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			ret = sta2ap_data_frame(adapter, precv_frame, &psta);
+			break;
+
+		case 3:
+			_rtw_memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
+			ret =_FAIL;
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" case 3\n"));
+			break;
+
+		default:
+			ret =_FAIL;
+			break;
+
+	}
+
+	if(ret ==_FAIL){
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s case:%d, res:%d\n", __FUNCTION__, pattrib->to_fr_ds, ret);
+		#endif
+		goto exit;
+	} else if (ret == RTW_RX_HANDLED) {
+		goto exit;
+	}
+
+
+	if(psta==NULL){
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" after to_fr_ds_chk; psta==NULL \n"));
+		ret= _FAIL;
+		goto exit;
+	}
+	
+	//psta->rssi = prxcmd->rssi;
+	//psta->signal_quality= prxcmd->sq;
+	precv_frame->u.hdr.psta = psta;
+		
+
+	pattrib->amsdu=0;
+	pattrib->ack_policy = 0;
+	//parsing QC field
+	if(pattrib->qos == 1)
+	{
+		pattrib->priority = GetPriority((ptr + 24));
+		pattrib->ack_policy = GetAckpolicy((ptr + 24));
+		pattrib->amsdu = GetAMsdu((ptr + 24));
+		pattrib->hdrlen = pattrib->to_fr_ds==3 ? 32 : 26;
+
+		if(pattrib->priority!=0 && pattrib->priority!=3)
+		{
+			adapter->recvpriv.bIsAnyNonBEPkts = _TRUE;
+		}
+	}
+	else
+	{
+		pattrib->priority=0;
+		pattrib->hdrlen = pattrib->to_fr_ds==3 ? 30 : 24;
+	}
+
+
+	if(pattrib->order)//HT-CTRL 11n
+	{
+		pattrib->hdrlen += 4;
+	}
+
+	precv_frame->u.hdr.preorder_ctrl = &psta->recvreorder_ctrl[pattrib->priority];
+
+	// decache, drop duplicate recv packets
+	if(recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("decache : drop pkt\n"));
+		ret= _FAIL;
+		goto exit;
+	}
+
+#if 0
+	if(psta->tdls_sta_state & TDLS_LINKED_STATE )
+	{
+		if(psta->dot118021XPrivacy==_AES_)
+			pattrib->encrypt=psta->dot118021XPrivacy;
+	}
+#endif //CONFIG_TDLS
+
+	if(pattrib->privacy){
+
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("validate_recv_data_frame:pattrib->privacy=%x\n", pattrib->privacy));
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0],IS_MCAST(pattrib->ra)));
+
+#ifdef CONFIG_TDLS
+		if((psta->tdls_sta_state & TDLS_LINKED_STATE) && (psta->dot118021XPrivacy==_AES_))
+		{
+				pattrib->encrypt=psta->dot118021XPrivacy;
+		}
+		else
+#endif //CONFIG_TDLS
+		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, IS_MCAST(pattrib->ra));
+
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n pattrib->encrypt=%d\n",pattrib->encrypt));
+
+		SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
+	}
+	else
+	{
+		pattrib->encrypt = 0;
+		pattrib->iv_len = pattrib->icv_len = 0;
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+
+#ifdef CONFIG_IEEE80211W
+static sint validate_80211w_mgmt(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	u8 type;
+	u8 subtype;
+			
+	type =  GetFrameType(ptr);
+	subtype = GetFrameSubType(ptr); //bit(7)~bit(2)
+			
+	//only support station mode
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) && check_fwstate(pmlmepriv, _FW_LINKED) 
+		&& adapter->securitypriv.binstallBIPkey == _TRUE)
+	{
+		//unicast management frame decrypt
+		if(pattrib->privacy && !(IS_MCAST(GetAddr1Ptr(ptr))) && 
+			(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC || subtype == WIFI_ACTION))
+		{
+			u8 *ppp, *mgmt_DATA;
+			u32 data_len=0;
+			ppp = GetAddr2Ptr(ptr);
+			
+			pattrib->bdecrypted = 0;
+			pattrib->encrypt = _AES_;
+			pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+			//set iv and icv length
+			SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
+			_rtw_memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
+			//actual management data frame body
+			data_len = pattrib->pkt_len - pattrib->hdrlen - pattrib->iv_len - pattrib->icv_len;
+			mgmt_DATA = rtw_zmalloc(data_len);
+			if(mgmt_DATA == NULL)
+			{
+				DBG_871X("%s mgmt allocate fail  !!!!!!!!!\n", __FUNCTION__);
+				goto validate_80211w_fail;
+			}
+			/*//dump the packet content before decrypt
+			{
+				int pp;
+				printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
+				for(pp=0;pp< pattrib->pkt_len; pp++)
+					printk(" %02x ", ptr[pp]);
+				printk("\n");
+			}*/
+			
+			precv_frame = decryptor(adapter, precv_frame);
+			//save actual management data frame body
+			_rtw_memcpy(mgmt_DATA, ptr+pattrib->hdrlen+pattrib->iv_len, data_len);
+			//overwrite the iv field
+			_rtw_memcpy(ptr+pattrib->hdrlen, mgmt_DATA, data_len);
+			//remove the iv and icv length
+			pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
+			rtw_mfree(mgmt_DATA, data_len);
+			/*//print packet content after decryption
+			{
+				int pp;
+				printk("after decryption pattrib->pktlen = %d @@=>", pattrib->pkt_len);
+				for(pp=0;pp< pattrib->pkt_len; pp++)
+					printk(" %02x ", ptr[pp]);
+				printk("\n");
+			}*/
+			if(!precv_frame)
+			{
+				DBG_871X("%s mgmt descrypt fail  !!!!!!!!!\n", __FUNCTION__);
+				goto validate_80211w_fail;
+			}
+		}
+		else if(IS_MCAST(GetAddr1Ptr(ptr)) &&
+			(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC))
+		{
+			sint BIP_ret = _SUCCESS;
+			//verify BIP MME IE of broadcast/multicast de-auth/disassoc packet
+			BIP_ret = rtw_BIP_verify(adapter, (u8 * )precv_frame);
+			if(BIP_ret == _FAIL)
+			{
+				//DBG_871X("802.11w BIP verify fail\n");
+				goto validate_80211w_fail;
+			}
+			else if(BIP_ret == RTW_RX_HANDLED)
+			{
+				//DBG_871X("802.11w recv none protected packet\n");
+				//issue sa query request
+				issue_action_SA_Query(adapter, NULL, 0, 0);
+				goto validate_80211w_fail;
+			}
+		}//802.11w protect
+		else
+		{
+			if(subtype == WIFI_ACTION)
+			{
+				//according 802.11-2012 standard, these five types are not robust types
+				if( ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_PUBLIC          &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_HT              &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_UNPROTECTED_WNM &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_SELF_PROTECTED  &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_P2P)
+				{
+					DBG_871X("action frame category=%d should robust\n", ptr[WLAN_HDR_A3_LEN]);
+					goto validate_80211w_fail;
+				}
+			}
+			else if(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC)
+			{
+				DBG_871X("802.11w recv none protected packet\n");
+				//issue sa query request
+				issue_action_SA_Query(adapter, NULL, 0, 0);
+				goto validate_80211w_fail;
+			}
+		}
+	}
+	return _SUCCESS;
+			
+validate_80211w_fail:
+	return _FAIL;
+	
+}
+#endif //CONFIG_IEEE80211W
+
+sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame);
+sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame)
+{
+	//shall check frame subtype, to / from ds, da, bssid
+
+	//then call check if rx seq/frag. duplicated.
+
+	u8 type;
+	u8 subtype;
+	sint retval = _SUCCESS;
+
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	u8  ver =(unsigned char) (*ptr)&0x3 ;
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+#endif
+
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
+		int ch_set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, rtw_get_oper_ch(adapter));
+		if (ch_set_idx >= 0)
+			pmlmeext->channel_set[ch_set_idx].rx_count++;
+	}
+#endif
+
+#ifdef CONFIG_TDLS
+	if(ptdlsinfo->ch_sensing==1 && ptdlsinfo->cur_channel !=0){
+		ptdlsinfo->collect_pkt_num[ptdlsinfo->cur_channel-1]++;
+	}
+#endif //CONFIG_TDLS
+
+#ifdef RTK_DMP_PLATFORM
+	if ( 0 )
+	{
+		DBG_871X("++\n");
+		{
+			int i;
+			for(i=0; i<64;i=i+8)
+				DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:", *(ptr+i),
+				*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+
+		}
+		DBG_871X("--\n");
+	}
+#endif //RTK_DMP_PLATFORM
+
+	//add version chk
+	if(ver!=0){
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_data_frame fail! (ver!=0)\n"));
+		retval= _FAIL;
+		goto exit;
+	}
+
+	type =  GetFrameType(ptr);
+	subtype = GetFrameSubType(ptr); //bit(7)~bit(2)
+
+	pattrib->to_fr_ds = get_tofr_ds(ptr);
+
+	pattrib->frag_num = GetFragNum(ptr);
+	pattrib->seq_num = GetSequence(ptr);
+
+	pattrib->pw_save = GetPwrMgt(ptr);
+	pattrib->mfrag = GetMFrag(ptr);
+	pattrib->mdata = GetMData(ptr);
+	pattrib->privacy = GetPrivacy(ptr);
+	pattrib->order = GetOrder(ptr);
+#if 0 //for debug
+
+if(pHalData->bDumpRxPkt ==1){
+	int i;
+	DBG_871X("############################# \n");
+	
+	for(i=0; i<64;i=i+8)
+		DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:\n", *(ptr+i),
+		*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+	DBG_871X("############################# \n");
+}
+else if(pHalData->bDumpRxPkt ==2){
+	if(type== WIFI_MGT_TYPE){
+		int i;
+		DBG_871X("############################# \n");
+
+		for(i=0; i<64;i=i+8)
+			DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:\n", *(ptr+i),
+			*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+		DBG_871X("############################# \n");
+	}
+}
+else if(pHalData->bDumpRxPkt ==3){
+	if(type== WIFI_DATA_TYPE){
+		int i;
+		DBG_871X("############################# \n");
+		
+		for(i=0; i<64;i=i+8)
+			DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:\n", *(ptr+i),
+			*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+		DBG_871X("############################# \n");
+	}
+}
+
+#endif
+	switch (type)
+	{
+		case WIFI_MGT_TYPE: //mgnt
+#ifdef CONFIG_IEEE80211W
+			if(validate_80211w_mgmt(adapter, precv_frame) == _FAIL)
+			{
+				retval = _FAIL;
+				break;
+			}
+#endif //CONFIG_IEEE80211W
+			
+			retval = validate_recv_mgnt_frame(adapter, precv_frame);
+			if (retval == _FAIL)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_mgnt_frame fail\n"));
+			}
+			retval = _FAIL; // only data frame return _SUCCESS
+			break;
+		case WIFI_CTRL_TYPE: //ctrl
+			retval = validate_recv_ctrl_frame(adapter, precv_frame);
+			if (retval == _FAIL)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_ctrl_frame fail\n"));
+			}
+			retval = _FAIL; // only data frame return _SUCCESS
+			break;
+		case WIFI_DATA_TYPE: //data
+			rtw_led_control(adapter, LED_CTL_RX);
+			pattrib->qos = (subtype & BIT(7))? 1:0;
+			retval = validate_recv_data_frame(adapter, precv_frame);
+			if (retval == _FAIL)
+			{
+				struct recv_priv *precvpriv = &adapter->recvpriv;
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_data_frame fail\n"));
+				precvpriv->rx_drop++;
+			}
+			break;
+		default:
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_data_frame fail! type=0x%x\n", type));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME validate_recv_data_frame fail! type=0x%x\n", type);
+			#endif
+			retval = _FAIL;
+			break;
+	}
+
+exit:
+
+_func_exit_;
+
+	return retval;
+}
+
+
+//remove the wlanhdr and add the eth_hdr
+#if 1
+
+sint wlanhdr_to_ethhdr ( union recv_frame *precvframe);
+sint wlanhdr_to_ethhdr ( union recv_frame *precvframe)
+{
+	sint	rmv_len;
+	u16	eth_type, len;
+	u8	bsnaphdr;
+	u8	*psnap_type;
+	struct ieee80211_snap_hdr	*psnap;
+	
+	sint ret=_SUCCESS;
+	_adapter			*adapter =precvframe->u.hdr.adapter;
+	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+
+	u8	*ptr = get_recvframe_data(precvframe) ; // point to frame_ctrl field
+	struct rx_pkt_attrib *pattrib = & precvframe->u.hdr.attrib;
+
+_func_enter_;
+
+	if(pattrib->encrypt){
+		recvframe_pull_tail(precvframe, pattrib->icv_len);	
+	}
+
+	psnap=(struct ieee80211_snap_hdr	*)(ptr+pattrib->hdrlen + pattrib->iv_len);
+	psnap_type=ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	/* convert hdr + possible LLC headers into Ethernet header */
+	//eth_type = (psnap_type[0] << 8) | psnap_type[1];
+	if((_rtw_memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
+		(_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == _FALSE) && 
+		(_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_AARP, 2)==_FALSE) )||
+		//eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
+		 _rtw_memcmp(psnap, rtw_bridge_tunnel_header, SNAP_SIZE)){
+		/* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
+		bsnaphdr = _TRUE;
+	}
+	else {
+		/* Leave Ethernet header part of hdr and full payload */
+		bsnaphdr = _FALSE;
+	}
+
+	rmv_len = pattrib->hdrlen + pattrib->iv_len +(bsnaphdr?SNAP_SIZE:0);
+	len = precvframe->u.hdr.len - rmv_len;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n===pattrib->hdrlen: %x,  pattrib->iv_len:%x ===\n\n", pattrib->hdrlen,  pattrib->iv_len));
+
+	_rtw_memcpy(&eth_type, ptr+rmv_len, 2);
+	eth_type= ntohs((unsigned short )eth_type); //pattrib->ether_type
+	pattrib->eth_type = eth_type;
+
+	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE))	   	
+	{
+		ptr += rmv_len ;	
+		*ptr = 0x87;
+		*(ptr+1) = 0x12;
+
+		eth_type = 0x8712;
+		// append rx status for mp test packets
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2)-24);
+		_rtw_memcpy(ptr, get_rxmem(precvframe), 24);
+		ptr+=24;
+	}
+	else {
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+ (bsnaphdr?2:0)));
+	}
+
+	_rtw_memcpy(ptr, pattrib->dst, ETH_ALEN);
+	_rtw_memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+
+	if(!bsnaphdr) {
+		len = htons(len);
+		_rtw_memcpy(ptr+12, &len, 2);
+	}
+
+_func_exit_;	
+	return ret;
+
+}
+
+#else
+
+sint wlanhdr_to_ethhdr ( union recv_frame *precvframe)
+{
+	sint rmv_len;
+	u16 eth_type;
+	u8	bsnaphdr;
+	u8	*psnap_type;
+	struct ieee80211_snap_hdr	*psnap;
+
+	sint ret=_SUCCESS;
+	_adapter	*adapter =precvframe->u.hdr.adapter;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+
+	u8* ptr = get_recvframe_data(precvframe) ; // point to frame_ctrl field
+	struct rx_pkt_attrib *pattrib = & precvframe->u.hdr.attrib;
+	struct _vlan *pvlan = NULL;
+
+_func_enter_;
+
+	psnap=(struct ieee80211_snap_hdr	*)(ptr+pattrib->hdrlen + pattrib->iv_len);
+	psnap_type=ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	if (psnap->dsap==0xaa && psnap->ssap==0xaa && psnap->ctrl==0x03)
+	{
+		if (_rtw_memcmp(psnap->oui, oui_rfc1042, WLAN_IEEE_OUI_LEN))
+			bsnaphdr=_TRUE;//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_RFC1042;	
+		else if (_rtw_memcmp(psnap->oui, SNAP_HDR_APPLETALK_DDP, WLAN_IEEE_OUI_LEN) &&
+			_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_DDP, 2) )
+			bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_APPLETALK;
+		else if (_rtw_memcmp( psnap->oui, oui_8021h, WLAN_IEEE_OUI_LEN))
+			bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_TUNNEL;
+		else {
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("drop pkt due to invalid frame format!\n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+	} else
+		bsnaphdr=_FALSE;//wlan_pkt_format = WLAN_PKT_FORMAT_OTHERS;
+
+	rmv_len = pattrib->hdrlen + pattrib->iv_len +(bsnaphdr?SNAP_SIZE:0);
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("===pattrib->hdrlen: %x,  pattrib->iv_len:%x ===\n", pattrib->hdrlen,  pattrib->iv_len));
+
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		ptr += rmv_len ;
+		*ptr = 0x87;
+		*(ptr+1) = 0x12;
+
+		//back to original pointer
+		ptr -= rmv_len;
+	}
+
+	ptr += rmv_len ;
+
+	_rtw_memcpy(&eth_type, ptr, 2);
+	eth_type= ntohs((unsigned short )eth_type); //pattrib->ether_type
+	ptr +=2;
+
+	if(pattrib->encrypt){
+		recvframe_pull_tail(precvframe, pattrib->icv_len);
+	}
+
+	if(eth_type == 0x8100) //vlan
+	{
+		pvlan = (struct _vlan *) ptr;
+
+		//eth_type = get_vlan_encap_proto(pvlan);
+		//eth_type = pvlan->h_vlan_encapsulated_proto;//?
+		rmv_len += 4;
+		ptr+=4;
+	}
+
+	if(eth_type==0x0800)//ip
+	{
+		//struct iphdr*  piphdr = (struct iphdr*) ptr;
+		//__u8 tos = (unsigned char)(pattrib->priority & 0xff);
+
+		//piphdr->tos = tos;
+
+		//if (piphdr->protocol == 0x06)
+		//{
+		//	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("@@@===recv tcp len:%d @@@===\n", precvframe->u.hdr.len));
+		//}
+	}
+	else if(eth_type==0x8712)// append rx status for mp test packets
+	{
+		//ptr -= 16;
+		//_rtw_memcpy(ptr, get_rxmem(precvframe), 16);
+	}
+	else
+	{
+#ifdef PLATFORM_OS_XP
+		NDIS_PACKET_8021Q_INFO VlanPriInfo;
+		UINT32 UserPriority = precvframe->u.hdr.attrib.priority;
+		UINT32 VlanID = (pvlan!=NULL ? get_vlan_id(pvlan) : 0 );
+
+		VlanPriInfo.Value =          // Get current value.
+				NDIS_PER_PACKET_INFO_FROM_PACKET(precvframe->u.hdr.pkt, Ieee8021QInfo);
+
+		VlanPriInfo.TagHeader.UserPriority = UserPriority;
+		VlanPriInfo.TagHeader.VlanId =  VlanID ;
+
+		VlanPriInfo.TagHeader.CanonicalFormatId = 0; // Should be zero.
+		VlanPriInfo.TagHeader.Reserved = 0; // Should be zero.
+		NDIS_PER_PACKET_INFO_FROM_PACKET(precvframe->u.hdr.pkt, Ieee8021QInfo) = VlanPriInfo.Value;
+#endif
+	}
+
+	if(eth_type==0x8712)// append rx status for mp test packets
+	{
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2)-24);
+		_rtw_memcpy(ptr, get_rxmem(precvframe), 24);
+		ptr+=24;
+	}
+	else
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2));
+
+	_rtw_memcpy(ptr, pattrib->dst, ETH_ALEN);
+	_rtw_memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+
+	eth_type = htons((unsigned short)eth_type) ;
+	_rtw_memcpy(ptr+12, &eth_type, 2);
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+#endif
+
+
+#ifdef CONFIG_SDIO_HCI
+#ifdef PLATFORM_LINUX
+static void recvframe_expand_pkt(
+	PADAPTER padapter,
+	union recv_frame *prframe)
+{
+	struct recv_frame_hdr *pfhdr;
+	_pkt *ppkt;
+	u8 shift_sz;
+	u32 alloc_sz;
+
+
+	pfhdr = &prframe->u.hdr;
+
+	//	6 is for IP header 8 bytes alignment in QoS packet case.
+	if (pfhdr->attrib.qos)
+		shift_sz = 6;
+	else
+		shift_sz = 0;
+
+	// for first fragment packet, need to allocate
+	// (1536 + RXDESC_SIZE + drvinfo_sz) to reassemble packet
+	//	8 is for skb->data 8 bytes alignment.
+//	alloc_sz = _RND(1536 + RXDESC_SIZE + pfhdr->attrib.drvinfosize + shift_sz + 8, 128);
+	alloc_sz = 1664; // round (1536 + 24 + 32 + shift_sz + 8) to 128 bytes alignment
+
+	//3 1. alloc new skb
+	// prepare extra space for 4 bytes alignment
+	ppkt = rtw_skb_alloc(alloc_sz);
+
+	if (!ppkt) return; // no way to expand
+
+	//3 2. Prepare new skb to replace & release old skb
+	// force ppkt->data at 8-byte alignment address
+	skb_reserve(ppkt, 8 - ((SIZE_PTR)ppkt->data & 7));
+	// force ip_hdr at 8-byte alignment address according to shift_sz
+	skb_reserve(ppkt, shift_sz);
+
+	// copy data to new pkt
+	_rtw_memcpy(skb_put(ppkt, pfhdr->len), pfhdr->rx_data, pfhdr->len);
+
+	rtw_skb_free(pfhdr->pkt);
+
+	// attach new pkt to recvframe
+	pfhdr->pkt = ppkt;
+	pfhdr->rx_head = ppkt->head;
+	pfhdr->rx_data = ppkt->data;
+	pfhdr->rx_tail = skb_tail_pointer(ppkt);
+	pfhdr->rx_end = skb_end_pointer(ppkt);
+}
+#else
+#warning "recvframe_expand_pkt not implement, defrag may crash system"
+#endif
+#endif
+
+//perform defrag
+union recv_frame * recvframe_defrag(_adapter *adapter,_queue *defrag_q);
+union recv_frame * recvframe_defrag(_adapter *adapter,_queue *defrag_q)
+{
+	_list	 *plist, *phead;
+	u8	*data,wlanhdr_offset;
+	u8	curfragnum;
+	struct recv_frame_hdr *pfhdr,*pnfhdr;
+	union recv_frame* prframe, *pnextrframe;
+	_queue	*pfree_recv_queue;
+
+_func_enter_;
+
+	curfragnum=0;
+	pfree_recv_queue=&adapter->recvpriv.free_recv_queue;
+
+	phead = get_list_head(defrag_q);
+	plist = get_next(phead);
+	prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+	pfhdr=&prframe->u.hdr;
+	rtw_list_delete(&(prframe->u.list));
+
+	if(curfragnum!=pfhdr->attrib.frag_num)
+	{
+		//the first fragment number must be 0
+		//free the whole queue
+		rtw_free_recvframe(prframe, pfree_recv_queue);
+		rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
+
+		return NULL;
+	}
+
+#ifdef CONFIG_SDIO_HCI
+	recvframe_expand_pkt(adapter, prframe);
+#endif
+
+	curfragnum++;
+
+	plist= get_list_head(defrag_q);
+
+	plist = get_next(plist);
+
+	data=get_recvframe_data(prframe);
+
+	while(rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		pnextrframe = LIST_CONTAINOR(plist, union recv_frame , u);
+		pnfhdr=&pnextrframe->u.hdr;
+
+
+		//check the fragment sequence  (2nd ~n fragment frame)
+
+		if(curfragnum!=pnfhdr->attrib.frag_num)
+		{
+			//the fragment number must be increasing  (after decache)
+			//release the defrag_q & prframe
+			rtw_free_recvframe(prframe, pfree_recv_queue);
+			rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
+			return NULL;
+		}
+
+		curfragnum++;
+
+		//copy the 2nd~n fragment frame's payload to the first fragment
+		//get the 2nd~last fragment frame's payload
+
+		wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
+
+		recvframe_pull(pnextrframe, wlanhdr_offset);
+
+		//append  to first fragment frame's tail (if privacy frame, pull the ICV)
+		recvframe_pull_tail(prframe, pfhdr->attrib.icv_len);
+
+		//memcpy
+		_rtw_memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
+
+		recvframe_put(prframe, pnfhdr->len);
+
+		pfhdr->attrib.icv_len=pnfhdr->attrib.icv_len;
+		plist = get_next(plist);
+
+	};
+
+	//free the defrag_q queue and return the prframe
+	rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("Performance defrag!!!!!\n"));
+
+_func_exit_;
+
+	return prframe;
+}
+
+//check if need to defrag, if needed queue the frame to defrag_q
+union recv_frame* recvframe_chk_defrag(PADAPTER padapter, union recv_frame *precv_frame)
+{
+	u8	ismfrag;
+	u8	fragnum;
+	u8	*psta_addr;
+	struct recv_frame_hdr *pfhdr;
+	struct sta_info *psta;
+	struct sta_priv *pstapriv;
+	_list *phead;
+	union recv_frame *prtnframe = NULL;
+	_queue *pfree_recv_queue, *pdefrag_q;
+
+_func_enter_;
+
+	pstapriv = &padapter->stapriv;
+
+	pfhdr = &precv_frame->u.hdr;
+
+	pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+
+	//need to define struct of wlan header frame ctrl
+	ismfrag = pfhdr->attrib.mfrag;
+	fragnum = pfhdr->attrib.frag_num;
+
+	psta_addr = pfhdr->attrib.ta;
+	psta = rtw_get_stainfo(pstapriv, psta_addr);
+	if (psta == NULL)
+	{
+		u8 type = GetFrameType(pfhdr->rx_data);
+		if (type != WIFI_DATA_TYPE) {
+			psta = rtw_get_bcmc_stainfo(padapter);
+			pdefrag_q = &psta->sta_recvpriv.defrag_q;
+		} else
+			pdefrag_q = NULL;
+	}
+	else
+		pdefrag_q = &psta->sta_recvpriv.defrag_q;
+
+	if ((ismfrag==0) && (fragnum==0))
+	{
+		prtnframe = precv_frame;//isn't a fragment frame
+	}
+
+	if (ismfrag==1)
+	{
+		//0~(n-1) fragment frame
+		//enqueue to defraf_g
+		if(pdefrag_q != NULL)
+		{
+			if(fragnum==0)
+			{
+				//the first fragment
+				if(_rtw_queue_empty(pdefrag_q) == _FALSE)
+				{
+					//free current defrag_q
+					rtw_free_recvframe_queue(pdefrag_q, pfree_recv_queue);
+				}
+			}
+
+
+			//Then enqueue the 0~(n-1) fragment into the defrag_q
+
+			//_rtw_spinlock(&pdefrag_q->lock);
+			phead = get_list_head(pdefrag_q);
+			rtw_list_insert_tail(&pfhdr->list, phead);
+			//_rtw_spinunlock(&pdefrag_q->lock);
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("Enqueuq: ismfrag = %d, fragnum= %d\n", ismfrag,fragnum));
+
+			prtnframe=NULL;
+
+		}
+		else
+		{
+			//can't find this ta's defrag_queue, so free this recv_frame
+			rtw_free_recvframe(precv_frame, pfree_recv_queue);
+			prtnframe=NULL;
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("Free because pdefrag_q ==NULL: ismfrag = %d, fragnum= %d\n", ismfrag, fragnum));
+		}
+
+	}
+
+	if((ismfrag==0)&&(fragnum!=0))
+	{
+		//the last fragment frame
+		//enqueue the last fragment
+		if(pdefrag_q != NULL)
+		{
+			//_rtw_spinlock(&pdefrag_q->lock);
+			phead = get_list_head(pdefrag_q);
+			rtw_list_insert_tail(&pfhdr->list,phead);
+			//_rtw_spinunlock(&pdefrag_q->lock);
+
+			//call recvframe_defrag to defrag
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("defrag: ismfrag = %d, fragnum= %d\n", ismfrag, fragnum));
+			precv_frame = recvframe_defrag(padapter, pdefrag_q);
+			prtnframe=precv_frame;
+
+		}
+		else
+		{
+			//can't find this ta's defrag_queue, so free this recv_frame
+			rtw_free_recvframe(precv_frame, pfree_recv_queue);
+			prtnframe=NULL;
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("Free because pdefrag_q ==NULL: ismfrag = %d, fragnum= %d\n", ismfrag,fragnum));
+		}
+
+	}
+
+
+	if((prtnframe!=NULL)&&(prtnframe->u.hdr.attrib.privacy))
+	{
+		//after defrag we must check tkip mic code
+		if(recvframe_chkmic(padapter,  prtnframe)==_FAIL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chkmic(padapter,  prtnframe)==_FAIL\n"));
+			rtw_free_recvframe(prtnframe,pfree_recv_queue);
+			prtnframe=NULL;
+		}
+	}
+
+_func_exit_;
+
+	return prtnframe;
+
+}
+
+#define ENDIAN_FREE 1
+
+int amsdu_to_msdu(_adapter *padapter, union recv_frame *prframe);
+int amsdu_to_msdu(_adapter *padapter, union recv_frame *prframe)
+{
+#if defined (PLATFORM_LINUX) || defined (PLATFORM_FREEBSD)  //for amsdu TP improvement,Creator: Thomas 
+	int	a_len, padding_len;
+	u16	eth_type, nSubframe_Length;	
+	u8	nr_subframes, i;
+	unsigned char *pdata;
+	struct rx_pkt_attrib *pattrib;
+#ifndef PLATFORM_FREEBSD
+	unsigned char *data_ptr;
+	_pkt *sub_skb,*subframes[MAX_SUBFRAME_COUNT];
+#endif //PLATFORM_FREEBSD
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
+	int	ret = _SUCCESS;
+#ifdef PLATFORM_FREEBSD
+	struct mbuf *sub_m=NULL, *subframes[MAX_SUBFRAME_COUNT];	
+	u8 *ptr,offset;
+#endif //PLATFORM_FREEBSD
+	nr_subframes = 0;
+
+	pattrib = &prframe->u.hdr.attrib;
+
+	recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
+	
+	if(prframe->u.hdr.attrib.iv_len >0)
+	{
+		recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
+	}
+
+	a_len = prframe->u.hdr.len;
+
+	pdata = prframe->u.hdr.rx_data;
+
+	while(a_len > ETH_HLEN) {
+		
+		/* Offset 12 denote 2 mac address */
+#ifdef ENDIAN_FREE
+		//nSubframe_Length = ntohs(*((u16*)(pdata + 12)));
+		nSubframe_Length = RTW_GET_BE16(pdata + 12);
+#else // ENDIAN_FREE
+		nSubframe_Length = *((u16*)(pdata + 12));
+		//==m==>change the length order
+		nSubframe_Length = (nSubframe_Length>>8) + (nSubframe_Length<<8);
+		//ntohs(nSubframe_Length);
+#endif // ENDIAN_FREE
+
+		if( a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length) ) {
+			DBG_871X("nRemain_Length is %d and nSubframe_Length is : %d\n",a_len,nSubframe_Length);
+			goto exit;
+		}
+
+#ifndef PLATFORM_FREEBSD
+		/* move the data point to data content */
+		pdata += ETH_HLEN;
+		a_len -= ETH_HLEN;
+
+		/* Allocate new skb for releasing to upper layer */
+#ifdef CONFIG_SKB_COPY
+		sub_skb = rtw_skb_alloc(nSubframe_Length + 12);
+		if(sub_skb)
+		{
+			skb_reserve(sub_skb, 12);
+			data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length);
+			_rtw_memcpy(data_ptr, pdata, nSubframe_Length);
+		}
+		else
+#endif // CONFIG_SKB_COPY
+		{
+			sub_skb = rtw_skb_clone(prframe->u.hdr.pkt);
+			if(sub_skb)
+			{
+				sub_skb->data = pdata;
+				sub_skb->len = nSubframe_Length;
+				skb_set_tail_pointer(sub_skb, nSubframe_Length);
+			}
+			else
+			{
+				DBG_871X("rtw_skb_clone() Fail!!! , nr_subframes = %d\n",nr_subframes);
+				break;
+			}
+		}
+
+#else   // PLATFORM_FREEBSD
+
+		//PLATFORM_FREEBSD
+		//Allocate a mbuff,  
+		//sub_m =m_devget(pdata, nSubframe_Length+12, 12, padapter->pifp,NULL);
+		sub_m =m_devget(pdata, nSubframe_Length+ETH_HLEN, ETHER_ALIGN, padapter->pifp,NULL);
+
+		pdata += ETH_HLEN;
+		a_len -= ETH_HLEN;
+#endif	// PLATFORM_FREEBSD	
+
+#ifndef PLATFORM_FREEBSD
+		//sub_skb->dev = padapter->pnetdev;
+		subframes[nr_subframes++] = sub_skb;
+#else  //PLATFORM_FREEBSD
+		//PLATFORM_FREEBSD
+		subframes[nr_subframes++] = sub_m;
+#endif  //PLATFORM_FREEBSD
+
+		if(nr_subframes >= MAX_SUBFRAME_COUNT) {
+			DBG_871X("ParseSubframe(): Too many Subframes! Packets dropped!\n");
+			break;
+		}
+
+		pdata += nSubframe_Length;
+		a_len -= nSubframe_Length;
+		if(a_len != 0) {
+			padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4-1));
+			if(padding_len == 4) {
+				padding_len = 0;
+			}
+
+			if(a_len < padding_len) {
+				goto exit;
+			}
+			pdata += padding_len;
+			a_len -= padding_len;
+		}
+	}
+
+	for(i=0; i<nr_subframes; i++){
+#ifndef PLATFORM_FREEBSD
+		sub_skb = subframes[i];
+		/* convert hdr + possible LLC headers into Ethernet header */
+#ifdef ENDIAN_FREE
+		//eth_type = ntohs(*(u16*)&sub_skb->data[6]);
+		eth_type = RTW_GET_BE16(&sub_skb->data[6]);
+#else // ENDIAN_FREE		
+		eth_type = (sub_skb->data[6] << 8) | sub_skb->data[7];
+#endif // ENDIAN_FREE
+		if (sub_skb->len >= 8 &&
+			((_rtw_memcmp(sub_skb->data, rtw_rfc1042_header, SNAP_SIZE) &&
+			  eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
+			 _rtw_memcmp(sub_skb->data, rtw_bridge_tunnel_header, SNAP_SIZE) )) {
+			/* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
+			skb_pull(sub_skb, SNAP_SIZE);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
+		} else {
+			u16 len;
+			/* Leave Ethernet header part of hdr and full payload */
+			len = htons(sub_skb->len);
+			_rtw_memcpy(skb_push(sub_skb, 2), &len, 2);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
+		}
+
+		/* Indicat the packets to upper layer */
+		if (sub_skb) {
+			//memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
+
+#ifdef CONFIG_BR_EXT
+			// Insert NAT2.5 RX here!
+			struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+			void *br_port = NULL;
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+			br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+			rcu_read_lock();
+			br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+			rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+
+
+			if( br_port && (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE) )
+			{
+				int nat25_handle_frame(_adapter *priv, struct sk_buff *skb);
+				if (nat25_handle_frame(padapter, sub_skb) == -1) {
+					//priv->ext_stats.rx_data_drops++;
+					//DEBUG_ERR("RX DROP: nat25_handle_frame fail!\n");
+					//return FAIL;
+					
+#if 1
+					// bypass this frame to upper layer!!
+#else
+					rtw_skb_free(sub_skb);
+					continue;
+#endif
+				}							
+			}
+#endif	// CONFIG_BR_EXT
+
+			sub_skb->protocol = eth_type_trans(sub_skb, padapter->pnetdev);
+			sub_skb->dev = padapter->pnetdev;
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+			if ( (pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1) ) {
+				sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
+			} else {
+				sub_skb->ip_summed = CHECKSUM_NONE;
+			}
+#else /* !CONFIG_TCP_CSUM_OFFLOAD_RX */
+			sub_skb->ip_summed = CHECKSUM_NONE;
+#endif //CONFIG_TCP_CSUM_OFFLOAD_RX
+
+			rtw_netif_rx(padapter->pnetdev, sub_skb);
+		}
+#else //PLATFORM_FREEBSD
+
+		//PLATFORM_FREEBSD
+		sub_m = subframes[i];
+		ptr=mtod(sub_m, u8 *);
+		offset=ETH_HLEN;
+		/* convert hdr + possible LLC headers into Ethernet header */
+#ifdef ENDIAN_FREE
+		eth_type = ntohs(*(u16*)&ptr[offset+6]);
+#else // ENDIAN_FREE
+		eth_type = (  ptr[offset+6] << 8) | ptr[offset+7];
+#endif // ENDIAN_FREE
+		if (sub_m->m_pkthdr.len >= ETH_HLEN+8 &&
+			((_rtw_memcmp(ptr+ETH_HLEN, rtw_rfc1042_header, SNAP_SIZE) &&
+			  eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
+			 _rtw_memcmp(ptr+ETH_HLEN, rtw_bridge_tunnel_header, SNAP_SIZE) )) {
+			/* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
+			offset+=SNAP_SIZE;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->src, ETH_ALEN);
+			offset-=ETH_ALEN;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->dst, ETH_ALEN);
+			offset-=ETH_ALEN;
+		} else {
+			u16 len;
+			/* Leave Ethernet header part of hdr and full payload */
+			len = htons(sub_m->m_pkthdr.len-offset);
+			_rtw_memcpy(&ptr[offset- 2], &len, 2);
+			offset-=2;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->src, ETH_ALEN);
+			offset-=ETH_ALEN;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->dst, ETH_ALEN);
+			offset-=ETH_ALEN;
+		}
+
+		m_adj(sub_m,offset);
+
+		/* Indicat the packets to upper layer */
+		if (sub_m) {
+
+#if 0
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+			if ( (pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1) ) {
+				sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
+			} else {
+				sub_skb->ip_summed = CHECKSUM_NONE;
+			}
+#else /* !CONFIG_TCP_CSUM_OFFLOAD_RX */
+			sub_skb->ip_summed = CHECKSUM_NONE;
+#endif //CONFIG_TCP_CSUM_OFFLOAD_RX
+#endif //0
+
+			if ( ((u32)(mtod(sub_m, caddr_t) + 14) % 4) != 0)
+				printf("%s()-%d: mtod(sub_m) = %p\n", __FUNCTION__, __LINE__, mtod(sub_m, caddr_t));
+#ifdef CONFIG_RX_INDICATE_QUEUE
+			IF_ENQUEUE(&precvpriv->rx_indicate_queue, sub_m);
+			if (_IF_QLEN(&precvpriv->rx_indicate_queue) <= 1) {
+				taskqueue_enqueue(taskqueue_thread, &precvpriv->rx_indicate_tasklet);
+			}
+#else	// CONFIG_RX_INDICATE_QUEUE
+			(*padapter->pifp->if_input)(padapter->pifp, sub_m);	
+#endif	// CONFIG_RX_INDICATE_QUEUE
+		}		
+
+#endif //PLATFORM_FREEBSD
+	}
+
+exit:
+
+	prframe->u.hdr.len=0;
+	rtw_free_recvframe(prframe, pfree_recv_queue);//free this recv_frame
+	
+	return ret;
+#else  // || defined (PLATFORM_LINUX) || defined (PLATFORM_FREEBSD) 
+#ifdef PLATFORM_WINDOWS
+	_irqL irql;
+#endif //PLATFORM_WINDOWS
+	unsigned char *ptr, *pdata, *pbuf, *psnap_type;
+	union recv_frame *pnrframe, *pnrframe_new;
+	int a_len, mv_len, padding_len;
+	u16 eth_type, type_len;
+	u8 bsnaphdr;
+	struct ieee80211_snap_hdr	*psnap;
+	struct _vlan *pvlan;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
+	int ret = _SUCCESS;
+#ifdef PLATFORM_WINDOWS
+	struct recv_buf *precvbuf = prframe->u.hdr.precvbuf;
+#endif //PLATFORM_WINDOWS
+	a_len = prframe->u.hdr.len - prframe->u.hdr.attrib.hdrlen;
+
+	recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
+
+	if(prframe->u.hdr.attrib.iv_len >0)
+	{
+		recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
+	}
+
+	pdata = prframe->u.hdr.rx_data;
+
+	prframe->u.hdr.len=0;
+
+	pnrframe = prframe;
+
+
+	do{
+
+		mv_len=0;
+		pnrframe->u.hdr.rx_data = pnrframe->u.hdr.rx_tail = pdata;
+		ptr = pdata;
+
+
+		_rtw_memcpy(pnrframe->u.hdr.attrib.dst, ptr, ETH_ALEN);
+		ptr+=ETH_ALEN;
+		_rtw_memcpy(pnrframe->u.hdr.attrib.src, ptr, ETH_ALEN);
+		ptr+=ETH_ALEN;
+
+		_rtw_memcpy(&type_len, ptr, 2);
+		type_len= ntohs((unsigned short )type_len);
+		ptr +=2;
+		mv_len += ETH_HLEN;
+
+		recvframe_put(pnrframe, type_len+ETH_HLEN);//update tail;
+
+		if(pnrframe->u.hdr.rx_data >= pnrframe->u.hdr.rx_tail || type_len<8)
+		{
+			//panic("pnrframe->u.hdr.rx_data >= pnrframe->u.hdr.rx_tail || type_len<8\n");
+
+			rtw_free_recvframe(pnrframe, pfree_recv_queue);
+
+			goto exit;
+		}
+
+		psnap=(struct ieee80211_snap_hdr *)(ptr);
+		psnap_type=ptr+SNAP_SIZE;
+		if (psnap->dsap==0xaa && psnap->ssap==0xaa && psnap->ctrl==0x03)
+		{
+			if ( _rtw_memcmp(psnap->oui, oui_rfc1042, WLAN_IEEE_OUI_LEN))
+			{
+				bsnaphdr=_TRUE;//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_RFC1042;
+			}
+			else if (_rtw_memcmp(psnap->oui, SNAP_HDR_APPLETALK_DDP, WLAN_IEEE_OUI_LEN) &&
+					_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_DDP, 2) )
+			{
+				bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_APPLETALK;
+			}
+			else if (_rtw_memcmp( psnap->oui, oui_8021h, WLAN_IEEE_OUI_LEN))
+			{
+				bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_TUNNEL;
+			}
+			else
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("drop pkt due to invalid frame format!\n"));
+
+				//KeBugCheckEx(0x87123333, 0xe0, 0x4c, 0x87, 0xdd);
+
+				//panic("0x87123333, 0xe0, 0x4c, 0x87, 0xdd\n");
+
+				rtw_free_recvframe(pnrframe, pfree_recv_queue);
+
+				goto exit;
+			}
+
+		}
+		else
+		{
+			bsnaphdr=_FALSE;//wlan_pkt_format = WLAN_PKT_FORMAT_OTHERS;
+		}
+
+		ptr += (bsnaphdr?SNAP_SIZE:0);
+		_rtw_memcpy(&eth_type, ptr, 2);
+		eth_type= ntohs((unsigned short )eth_type); //pattrib->ether_type
+
+		mv_len+= 2+(bsnaphdr?SNAP_SIZE:0);
+		ptr += 2;//now move to iphdr;
+
+		pvlan = NULL;
+		if(eth_type == 0x8100) //vlan
+		{
+			pvlan = (struct _vlan *)ptr;
+			ptr+=4;
+			mv_len+=4;
+		}
+
+		if(eth_type==0x0800)//ip
+		{
+			struct iphdr*  piphdr = (struct iphdr*)ptr;
+
+
+			if (piphdr->protocol == 0x06)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("@@@===recv tcp len:%d @@@===\n", pnrframe->u.hdr.len));
+			}
+		}
+#ifdef PLATFORM_OS_XP
+		else
+		{
+			NDIS_PACKET_8021Q_INFO VlanPriInfo;
+			UINT32 UserPriority = pnrframe->u.hdr.attrib.priority;
+			UINT32 VlanID = (pvlan!=NULL ? get_vlan_id(pvlan) : 0 );
+
+			VlanPriInfo.Value =          // Get current value.
+					NDIS_PER_PACKET_INFO_FROM_PACKET(pnrframe->u.hdr.pkt, Ieee8021QInfo);
+
+			VlanPriInfo.TagHeader.UserPriority = UserPriority;
+			VlanPriInfo.TagHeader.VlanId =  VlanID;
+
+			VlanPriInfo.TagHeader.CanonicalFormatId = 0; // Should be zero.
+			VlanPriInfo.TagHeader.Reserved = 0; // Should be zero.
+			NDIS_PER_PACKET_INFO_FROM_PACKET(pnrframe->u.hdr.pkt, Ieee8021QInfo) = VlanPriInfo.Value;
+
+		}
+#endif //PLATFORM_OS_XP
+
+		pbuf = recvframe_pull(pnrframe, (mv_len-sizeof(struct ethhdr)));
+
+		_rtw_memcpy(pbuf, pnrframe->u.hdr.attrib.dst, ETH_ALEN);
+		_rtw_memcpy(pbuf+ETH_ALEN, pnrframe->u.hdr.attrib.src, ETH_ALEN);
+
+		eth_type = htons((unsigned short)eth_type) ;
+		_rtw_memcpy(pbuf+12, &eth_type, 2);
+
+		padding_len = (4) - ((type_len + ETH_HLEN)&(4-1));
+
+		a_len -= (type_len + ETH_HLEN + padding_len) ;
+
+
+#if 0
+
+	if(a_len > ETH_HLEN)
+	{
+		pnrframe_new = rtw_alloc_recvframe(pfree_recv_queue);
+		if(pnrframe_new)
+		{
+			_pkt *pskb_copy;
+			unsigned int copy_len  = pnrframe->u.hdr.len;
+
+			_rtw_init_listhead(&pnrframe_new->u.hdr.list);
+
+			pskb_copy = rtw_skb_alloc(copy_len+64);
+
+			if(pskb_copy==NULL)
+			{
+				DBG_871X("amsdu_to_msdu:can not all(ocate memory for skb copy\n");
+			}
+
+			pnrframe_new->u.hdr.pkt = pskb_copy;
+
+			_rtw_memcpy(pskb_copy->data, pnrframe->u.hdr.rx_data, copy_len);
+
+			pnrframe_new->u.hdr.rx_data = pnrframe->u.hdr.rx_data;
+			pnrframe_new->u.hdr.rx_tail = pnrframe->u.hdr.rx_data + copy_len;
+
+
+			if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE))
+			{
+				rtw_recv_indicatepkt(padapter, pnrframe_new);//indicate this recv_frame
+			}
+			else
+			{
+				rtw_free_recvframe(pnrframe_new, pfree_recv_queue);//free this recv_frame
+			}
+
+		}
+		else
+		{
+			DBG_871X("amsdu_to_msdu:can not allocate memory for pnrframe_new\n");
+		}
+
+	}
+	else
+	{
+		if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE))
+		{
+			rtw_recv_indicatepkt(padapter, pnrframe);//indicate this recv_frame
+		}
+		else
+		{
+			rtw_free_recvframe(pnrframe, pfree_recv_queue);//free this recv_frame
+		}
+
+		pnrframe = NULL;
+
+	}
+
+#else // 0
+
+		//padding_len = (4) - ((type_len + ETH_HLEN)&(4-1));
+
+		//a_len -= (type_len + ETH_HLEN + padding_len) ;
+
+		pnrframe_new = NULL;
+
+
+		if(a_len > ETH_HLEN)
+		{
+			pnrframe_new = rtw_alloc_recvframe(pfree_recv_queue);
+
+			if(pnrframe_new)
+			{
+
+
+				//pnrframe_new->u.hdr.precvbuf = precvbuf;//precvbuf is assigned before call rtw_init_recvframe()
+				//rtw_init_recvframe(pnrframe_new, precvpriv);
+				{
+#ifdef PLATFORM_LINUX
+						_pkt *pskb = pnrframe->u.hdr.pkt;
+#endif //PLATFORM_LINUX						
+						_rtw_init_listhead(&pnrframe_new->u.hdr.list);
+
+						pnrframe_new->u.hdr.len=0;
+
+#ifdef PLATFORM_LINUX
+						if(pskb)
+						{
+							pnrframe_new->u.hdr.pkt = rtw_skb_clone(pskb);
+						}
+#endif //PLATFORM_LINUX
+
+				}
+
+				pdata += (type_len + ETH_HLEN + padding_len);
+				pnrframe_new->u.hdr.rx_head = pnrframe_new->u.hdr.rx_data = pnrframe_new->u.hdr.rx_tail = pdata;
+				pnrframe_new->u.hdr.rx_end = pdata + a_len + padding_len;//
+
+#ifdef PLATFORM_WINDOWS
+				pnrframe_new->u.hdr.precvbuf=precvbuf;
+				_enter_critical_bh(&precvbuf->recvbuf_lock, &irql);
+				precvbuf->ref_cnt++;
+				_exit_critical_bh(&precvbuf->recvbuf_lock, &irql);
+#endif //PLATFORM_WINDOWS
+
+			}
+			else
+			{
+				//panic("pnrframe_new=%x\n", pnrframe_new);
+			}
+		}
+
+
+		if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE) )
+		{
+			rtw_recv_indicatepkt(padapter, pnrframe);//indicate this recv_frame
+		}
+		else
+		{
+			rtw_free_recvframe(pnrframe, pfree_recv_queue);//free this recv_frame
+		}
+
+
+		pnrframe = NULL;
+		if(pnrframe_new)
+		{
+			pnrframe = pnrframe_new;
+		}
+
+
+#endif // end defined (PLATFORM_LINUX) || defined (PLATFORM_FREEBSD) 
+
+	}while(pnrframe);
+
+exit:
+
+	return ret;
+#endif
+}
+
+int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, u16 seq_num);
+int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, u16 seq_num)
+{
+	u8	wsize = preorder_ctrl->wsize_b;
+	u16	wend = (preorder_ctrl->indicate_seq + wsize -1) & 0xFFF;//% 4096;
+
+	// Rx Reorder initialize condition.
+	if (preorder_ctrl->indicate_seq == 0xFFFF)
+	{
+		preorder_ctrl->indicate_seq = seq_num;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d init IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+
+		//DbgPrint("check_indicate_seq, 1st->indicate_seq=%d\n", precvpriv->indicate_seq);
+	}
+
+	//DbgPrint("enter->check_indicate_seq(): IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+	// Drop out the packet which SeqNum is smaller than WinStart
+	if( SN_LESS(seq_num, preorder_ctrl->indicate_seq) )
+	{
+		//RT_TRACE(COMP_RX_REORDER, DBG_LOUD, ("CheckRxTsIndicateSeq(): Packet Drop! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, NewSeqNum));
+		//DbgPrint("CheckRxTsIndicateSeq(): Packet Drop! IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("%s IndicateSeq: %d > NewSeq: %d\n", __FUNCTION__, 
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+
+
+		return _FALSE;
+	}
+
+	//
+	// Sliding window manipulation. Conditions includes:
+	// 1. Incoming SeqNum is equal to WinStart =>Window shift 1
+	// 2. Incoming SeqNum is larger than the WinEnd => Window shift N
+	//
+	if( SN_EQUAL(seq_num, preorder_ctrl->indicate_seq) )
+	{
+		preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d SN_EQUAL IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+	}
+	else if(SN_LESS(wend, seq_num))
+	{
+		//RT_TRACE(COMP_RX_REORDER, DBG_LOUD, ("CheckRxTsIndicateSeq(): Window Shift! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, NewSeqNum));
+		//DbgPrint("CheckRxTsIndicateSeq(): Window Shift! IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+		// boundary situation, when seq_num cross 0xFFF
+		if(seq_num >= (wsize - 1))
+			preorder_ctrl->indicate_seq = seq_num + 1 -wsize;
+		else
+			preorder_ctrl->indicate_seq = 0xFFF - (wsize - (seq_num + 1)) + 1;
+
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d SN_LESS(wend, seq_num) IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+	}
+
+	//DbgPrint("exit->check_indicate_seq(): IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+	return _TRUE;
+}
+
+int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl, union recv_frame *prframe);
+int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl, union recv_frame *prframe)
+{
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+	_list	*phead, *plist;
+	union recv_frame *pnextrframe;
+	struct rx_pkt_attrib *pnextattrib;
+
+	//DbgPrint("+enqueue_reorder_recvframe()\n");
+
+	//_enter_critical_ex(&ppending_recvframe_queue->lock, &irql);
+	//_rtw_spinlock_ex(&ppending_recvframe_queue->lock);
+
+
+	phead = get_list_head(ppending_recvframe_queue);
+	plist = get_next(phead);
+
+	while(rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		pnextrframe = LIST_CONTAINOR(plist, union recv_frame, u);
+		pnextattrib = &pnextrframe->u.hdr.attrib;
+
+		if(SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
+		{
+			plist = get_next(plist);
+		}
+		else if( SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
+		{
+			//Duplicate entry is found!! Do not insert current entry.
+			//RT_TRACE(COMP_RX_REORDER, DBG_TRACE, ("InsertRxReorderList(): Duplicate packet is dropped!! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, SeqNum));
+
+			//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+			return _FALSE;
+		}
+		else
+		{
+			break;
+		}
+
+		//DbgPrint("enqueue_reorder_recvframe():while\n");
+
+	}
+
+
+	//_enter_critical_ex(&ppending_recvframe_queue->lock, &irql);
+	//_rtw_spinlock_ex(&ppending_recvframe_queue->lock);
+
+	rtw_list_delete(&(prframe->u.hdr.list));
+
+	rtw_list_insert_tail(&(prframe->u.hdr.list), plist);
+
+	//_rtw_spinunlock_ex(&ppending_recvframe_queue->lock);
+	//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+
+	//RT_TRACE(COMP_RX_REORDER, DBG_TRACE, ("InsertRxReorderList(): Pkt insert into buffer!! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, SeqNum));
+	return _TRUE;
+
+}
+
+int recv_indicatepkts_in_order(_adapter *padapter, struct recv_reorder_ctrl *preorder_ctrl, int bforced);
+int recv_indicatepkts_in_order(_adapter *padapter, struct recv_reorder_ctrl *preorder_ctrl, int bforced)
+{
+	//_irqL irql;
+	//u8 bcancelled;
+	_list	*phead, *plist;
+	union recv_frame *prframe;
+	struct rx_pkt_attrib *pattrib;
+	//u8 index = 0;
+	int bPktInBuf = _FALSE;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+	//DbgPrint("+recv_indicatepkts_in_order\n");
+
+	//_enter_critical_ex(&ppending_recvframe_queue->lock, &irql);
+	//_rtw_spinlock_ex(&ppending_recvframe_queue->lock);
+
+	phead = 	get_list_head(ppending_recvframe_queue);
+	plist = get_next(phead);
+
+#if 0
+	// Check if there is any other indication thread running.
+	if(pTS->RxIndicateState == RXTS_INDICATE_PROCESSING)
+		return;
+#endif
+
+	// Handling some condition for forced indicate case.
+	if(bforced==_TRUE)
+	{
+		if(rtw_is_list_empty(phead))
+		{
+			// _exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+			//_rtw_spinunlock_ex(&ppending_recvframe_queue->lock);
+			return _TRUE;
+		}
+	
+		 prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+	        pattrib = &prframe->u.hdr.attrib;	
+		preorder_ctrl->indicate_seq = pattrib->seq_num;		
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, pattrib->seq_num);
+		#endif
+	}
+
+	// Prepare indication list and indication.
+	// Check if there is any packet need indicate.
+	while(!rtw_is_list_empty(phead))
+	{
+	
+		prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+		pattrib = &prframe->u.hdr.attrib;
+
+		if(!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
+				 ("recv_indicatepkts_in_order: indicate=%d seq=%d amsdu=%d\n",
+				  preorder_ctrl->indicate_seq, pattrib->seq_num, pattrib->amsdu));
+
+#if 0
+			// This protect buffer from overflow.
+			if(index >= REORDER_WIN_SIZE)
+			{
+				RT_ASSERT(FALSE, ("IndicateRxReorderList(): Buffer overflow!! \n"));
+				bPktInBuf = TRUE;
+				break;
+			}
+#endif
+
+			plist = get_next(plist);
+			rtw_list_delete(&(prframe->u.hdr.list));
+
+			if(SN_EQUAL(preorder_ctrl->indicate_seq, pattrib->seq_num))
+			{
+				preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
+				#ifdef DBG_RX_SEQ
+				DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+					preorder_ctrl->indicate_seq, pattrib->seq_num);
+				#endif
+			}
+
+#if 0
+			index++;
+			if(index==1)
+			{
+				//Cancel previous pending timer.
+				//PlatformCancelTimer(Adapter, &pTS->RxPktPendingTimer);
+				if(bforced!=_TRUE)
+				{
+					//DBG_871X("_cancel_timer(&preorder_ctrl->reordering_ctrl_timer, &bcancelled);\n");
+					_cancel_timer(&preorder_ctrl->reordering_ctrl_timer, &bcancelled);
+				}
+			}
+#endif
+
+			//Set this as a lock to make sure that only one thread is indicating packet.
+			//pTS->RxIndicateState = RXTS_INDICATE_PROCESSING;
+
+			// Indicate packets
+			//RT_ASSERT((index<=REORDER_WIN_SIZE), ("RxReorderIndicatePacket(): Rx Reorder buffer full!! \n"));
+
+
+			//indicate this recv_frame
+			//DbgPrint("recv_indicatepkts_in_order, indicate_seq=%d, seq_num=%d\n", precvpriv->indicate_seq, pattrib->seq_num);
+			if(!pattrib->amsdu)
+			{
+				//DBG_871X("recv_indicatepkts_in_order, amsdu!=1, indicate_seq=%d, seq_num=%d\n", preorder_ctrl->indicate_seq, pattrib->seq_num);
+
+				if ((padapter->bDriverStopped == _FALSE) &&
+				    (padapter->bSurpriseRemoved == _FALSE))
+				{
+					
+					rtw_recv_indicatepkt(padapter, prframe);//indicate this recv_frame
+										
+				}
+			}
+			else if(pattrib->amsdu==1)
+			{
+				if(amsdu_to_msdu(padapter, prframe)!=_SUCCESS)
+				{
+					rtw_free_recvframe(prframe, &precvpriv->free_recv_queue);
+				}
+			}
+			else
+			{
+				//error condition;
+			}
+
+
+			//Update local variables.
+			bPktInBuf = _FALSE;
+
+		}
+		else
+		{
+			bPktInBuf = _TRUE;
+			break;
+		}
+
+		//DbgPrint("recv_indicatepkts_in_order():while\n");
+
+	}
+
+	//_rtw_spinunlock_ex(&ppending_recvframe_queue->lock);
+	//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+/*
+	//Release the indication lock and set to new indication step.
+	if(bPktInBuf)
+	{
+		// Set new pending timer.
+		//pTS->RxIndicateState = RXTS_INDICATE_REORDER;
+		//PlatformSetTimer(Adapter, &pTS->RxPktPendingTimer, pHTInfo->RxReorderPendingTime);
+		//DBG_871X("_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME)\n");
+		_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME);
+	}
+	else
+	{
+		//pTS->RxIndicateState = RXTS_INDICATE_IDLE;
+	}
+*/
+	//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+	//return _TRUE;
+	return bPktInBuf;
+
+}
+
+int recv_indicatepkt_reorder(_adapter *padapter, union recv_frame *prframe);
+int recv_indicatepkt_reorder(_adapter *padapter, union recv_frame *prframe)
+{
+	_irqL irql;
+	int retval = _SUCCESS;
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	struct recv_reorder_ctrl *preorder_ctrl = prframe->u.hdr.preorder_ctrl;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+	if(!pattrib->amsdu)
+	{
+		//s1.
+		wlanhdr_to_ethhdr(prframe);
+
+		//if ((pattrib->qos!=1) /*|| pattrib->priority!=0 || IS_MCAST(pattrib->ra)*/
+		//	|| (pattrib->eth_type==0x0806) || (pattrib->ack_policy!=0))
+		if (pattrib->qos!=1)
+		{
+			if ((padapter->bDriverStopped == _FALSE) &&
+			    (padapter->bSurpriseRemoved == _FALSE))
+			{
+				RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("@@@@  recv_indicatepkt_reorder -recv_func recv_indicatepkt\n" ));
+
+				rtw_recv_indicatepkt(padapter, prframe);
+				return _SUCCESS;
+
+			}
+			
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s pattrib->qos !=1\n", __FUNCTION__);
+			#endif
+			
+			return _FAIL;
+		
+		}
+
+		if (preorder_ctrl->enable == _FALSE)
+		{
+			//indicate this recv_frame			
+			preorder_ctrl->indicate_seq = pattrib->seq_num;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+			
+			rtw_recv_indicatepkt(padapter, prframe);		
+			
+			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+			
+			return _SUCCESS;	
+		}			
+
+#ifndef CONFIG_RECV_REORDERING_CTRL
+		//indicate this recv_frame
+		rtw_recv_indicatepkt(padapter, prframe);
+		return _SUCCESS;
+#endif
+
+	}
+	else if(pattrib->amsdu==1) //temp filter -> means didn't support A-MSDUs in a A-MPDU
+	{
+		if (preorder_ctrl->enable == _FALSE)
+		{
+			preorder_ctrl->indicate_seq = pattrib->seq_num;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+
+			retval = amsdu_to_msdu(padapter, prframe);
+
+			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+
+			if(retval != _SUCCESS){
+				#ifdef DBG_RX_DROP_FRAME
+				DBG_871X("DBG_RX_DROP_FRAME %s amsdu_to_msdu fail\n", __FUNCTION__);
+				#endif
+			}
+
+			return retval;
+		}
+	}
+	else
+	{
+
+	}
+
+	_enter_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+	RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
+		 ("recv_indicatepkt_reorder: indicate=%d seq=%d\n",
+		  preorder_ctrl->indicate_seq, pattrib->seq_num));
+
+	//s2. check if winstart_b(indicate_seq) needs to been updated
+	if(!check_indicate_seq(preorder_ctrl, pattrib->seq_num))
+	{
+		//pHTInfo->RxReorderDropCounter++;
+		//ReturnRFDList(Adapter, pRfd);
+		//RT_TRACE(COMP_RX_REORDER, DBG_TRACE, ("RxReorderIndicatePacket() ==> Packet Drop!!\n"));
+		//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+		//return _FAIL;
+
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s check_indicate_seq fail\n", __FUNCTION__);
+		#endif
+#if 0		
+		rtw_recv_indicatepkt(padapter, prframe);
+
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+		
+		goto _success_exit;
+#else
+		goto _err_exit;
+#endif
+	}
+
+
+	//s3. Insert all packet into Reorder Queue to maintain its ordering.
+	if(!enqueue_reorder_recvframe(preorder_ctrl, prframe))
+	{
+		//DbgPrint("recv_indicatepkt_reorder, enqueue_reorder_recvframe fail!\n");
+		//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+		//return _FAIL;
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s enqueue_reorder_recvframe fail\n", __FUNCTION__);
+		#endif
+		goto _err_exit;
+	}
+
+
+	//s4.
+	// Indication process.
+	// After Packet dropping and Sliding Window shifting as above, we can now just indicate the packets
+	// with the SeqNum smaller than latest WinStart and buffer other packets.
+	//
+	// For Rx Reorder condition:
+	// 1. All packets with SeqNum smaller than WinStart => Indicate
+	// 2. All packets with SeqNum larger than or equal to WinStart => Buffer it.
+	//
+
+	//recv_indicatepkts_in_order(padapter, preorder_ctrl, _TRUE);
+	if(recv_indicatepkts_in_order(padapter, preorder_ctrl, _FALSE)==_TRUE)
+	{
+		_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME);
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+	}
+	else
+	{
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+		_cancel_timer_ex(&preorder_ctrl->reordering_ctrl_timer);
+	}
+
+
+_success_exit:
+
+	return _SUCCESS;
+
+_err_exit:
+
+        _exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+	return _FAIL;
+}
+
+
+void rtw_reordering_ctrl_timeout_handler(void *pcontext)
+{
+	_irqL irql;
+	struct recv_reorder_ctrl *preorder_ctrl = (struct recv_reorder_ctrl *)pcontext;
+	_adapter *padapter = preorder_ctrl->padapter;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+
+	if(padapter->bDriverStopped ||padapter->bSurpriseRemoved)
+	{
+		return;
+	}
+
+	//DBG_871X("+rtw_reordering_ctrl_timeout_handler()=>\n");
+
+	_enter_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+	if(recv_indicatepkts_in_order(padapter, preorder_ctrl, _TRUE)==_TRUE)
+	{
+		_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME);		
+	}
+
+	_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+}
+
+int process_recv_indicatepkts(_adapter *padapter, union recv_frame *prframe);
+int process_recv_indicatepkts(_adapter *padapter, union recv_frame *prframe)
+{
+	int retval = _SUCCESS;
+	//struct recv_priv *precvpriv = &padapter->recvpriv;
+	//struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+#ifdef CONFIG_TDLS
+	struct sta_info *psta = prframe->u.hdr.psta;
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_80211N_HT
+
+	struct ht_priv	*phtpriv = &pmlmepriv->htpriv;
+
+#ifdef CONFIG_TDLS
+	if( (phtpriv->ht_option==_TRUE) ||
+		((psta->tdls_sta_state & TDLS_LINKED_STATE) && 
+		 (psta->htpriv.ht_option==_TRUE) &&
+		 (psta->htpriv.ampdu_enable==_TRUE))) //B/G/N Mode
+#else
+	if(phtpriv->ht_option==_TRUE)  //B/G/N Mode
+#endif //CONFIG_TDLS
+	{
+		//prframe->u.hdr.preorder_ctrl = &precvpriv->recvreorder_ctrl[pattrib->priority];
+
+		if(recv_indicatepkt_reorder(padapter, prframe)!=_SUCCESS)// including perform A-MPDU Rx Ordering Buffer Control
+		{
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s recv_indicatepkt_reorder error!\n", __FUNCTION__);
+			#endif
+		
+			if ((padapter->bDriverStopped == _FALSE) &&
+			    (padapter->bSurpriseRemoved == _FALSE))
+			{
+				retval = _FAIL;
+				return retval;
+			}
+		}
+	}
+	else //B/G mode
+#endif
+	{
+		retval=wlanhdr_to_ethhdr (prframe);
+		if(retval != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("wlanhdr_to_ethhdr: drop pkt \n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s wlanhdr_to_ethhdr error!\n", __FUNCTION__);
+			#endif
+			return retval;
+		}
+
+		if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE))
+		{
+			//indicate this recv_frame
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ process_recv_indicatepkts- recv_func recv_indicatepkt\n" ));
+			rtw_recv_indicatepkt(padapter, prframe);
+
+
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ process_recv_indicatepkts- recv_func free_indicatepkt\n" ));
+
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+			retval = _FAIL;
+			return retval;
+		}
+
+	}
+
+	return retval;
+
+}
+
+static int recv_func_prehandle(_adapter *padapter, union recv_frame *rframe)
+{
+	int ret = _SUCCESS;
+	struct rx_pkt_attrib *pattrib = &rframe->u.hdr.attrib;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+	
+#ifdef CONFIG_MP_INCLUDED
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //CONFIG_MP_INCLUDED
+
+#ifdef CONFIG_MP_INCLUDED
+	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE))//&&(padapter->mppriv.check_mp_pkt == 0))
+	{
+		if (pattrib->crc_err == 1)
+			padapter->mppriv.rx_crcerrpktcount++;
+		else
+			padapter->mppriv.rx_pktcount++;
+
+		if (check_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE) == _FALSE) {
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("MP - Not in loopback mode , drop pkt \n"));
+			ret = _FAIL;
+			rtw_free_recvframe(rframe, pfree_recv_queue);//free this recv_frame
+			goto exit;
+		}
+	}
+#endif
+
+	//check the frame crtl field and decache
+	ret = validate_recv_frame(padapter, rframe);
+	if (ret != _SUCCESS)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
+		rtw_free_recvframe(rframe, pfree_recv_queue);//free this recv_frame
+		goto exit;
+	}
+
+exit:
+	return ret;
+}
+
+static int recv_func_posthandle(_adapter *padapter, union recv_frame *prframe)
+{
+	int ret = _SUCCESS;
+	union recv_frame *orig_prframe = prframe;
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+	
+#ifdef CONFIG_MP_INCLUDED
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //CONFIG_MP_INCLUDED
+
+#ifdef CONFIG_TDLS
+	u8 *psnap_type, *pcategory;
+	struct sta_info *ptdls_sta = NULL;
+#endif //CONFIG_TDLS
+
+
+	// DATA FRAME
+	rtw_led_control(padapter, LED_CTL_RX);
+
+	prframe = decryptor(padapter, prframe);
+	if (prframe == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("decryptor: drop pkt\n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s decryptor: drop pkt\n", __FUNCTION__);
+		#endif
+		ret = _FAIL;
+		goto _recv_data_drop;
+	}
+
+#if 0
+	if ( padapter->adapter_type == PRIMARY_ADAPTER )
+	{
+		DBG_871X("+++\n");
+		{
+			int i;
+			u8	*ptr = get_recvframe_data(prframe);
+			for(i=0; i<140;i=i+8)
+				DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:", *(ptr+i),
+				*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+
+		}
+		DBG_871X("---\n");
+	}
+#endif //RTK_DMP_PLATFORM
+
+#ifdef CONFIG_TDLS
+	//check TDLS frame
+	psnap_type = get_recvframe_data(orig_prframe);
+	psnap_type+=pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	pcategory = psnap_type + ETH_TYPE_LEN + PAYLOAD_TYPE_LEN;
+
+	if((_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_TDLS, ETH_TYPE_LEN)) &&
+		((*pcategory==RTW_WLAN_CATEGORY_TDLS) || (*pcategory==RTW_WLAN_CATEGORY_P2P))){
+		ret = OnTDLS(padapter, prframe);	//all of functions will return _FAIL
+		goto _exit_recv_func;
+	}
+#endif //CONFIG_TDLS
+
+	prframe = recvframe_chk_defrag(padapter, prframe);
+	if(prframe==NULL)	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chk_defrag: drop pkt\n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s recvframe_chk_defrag: drop pkt\n", __FUNCTION__);
+		#endif
+		goto _recv_data_drop;		
+	}
+
+	prframe=portctrl(padapter, prframe);
+	if (prframe == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("portctrl: drop pkt \n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s portctrl: drop pkt\n", __FUNCTION__);
+		#endif
+		ret = _FAIL;
+		goto _recv_data_drop;
+	}
+
+#ifdef CONFIG_TDLS
+	if(padapter->tdlsinfo.setup_state == TDLS_LINKED_STATE)
+		ptdls_sta = rtw_get_stainfo(&padapter->stapriv, pattrib->src);
+	count_rx_stats(padapter, prframe, ptdls_sta);
+#else
+	count_rx_stats(padapter, prframe, NULL);
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_80211N_HT
+
+	ret = process_recv_indicatepkts(padapter, prframe);
+	if (ret != _SUCCESS)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recv_func: process_recv_indicatepkts fail! \n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s recv_func: process_recv_indicatepkts fail!\n", __FUNCTION__);
+		#endif
+		rtw_free_recvframe(orig_prframe, pfree_recv_queue);//free this recv_frame
+		goto _recv_data_drop;
+	}
+
+#else // CONFIG_80211N_HT
+
+	if (!pattrib->amsdu)
+	{
+		ret = wlanhdr_to_ethhdr (prframe);
+		if (ret != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("wlanhdr_to_ethhdr: drop pkt \n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s wlanhdr_to_ethhdr: drop pkt\n", __FUNCTION__);
+			#endif
+			rtw_free_recvframe(orig_prframe, pfree_recv_queue);//free this recv_frame
+			goto _recv_data_drop;
+		}
+
+		if ((padapter->bDriverStopped == _FALSE) && (padapter->bSurpriseRemoved == _FALSE))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("@@@@ recv_func: recv_func rtw_recv_indicatepkt\n" ));
+			//indicate this recv_frame
+			ret = rtw_recv_indicatepkt(padapter, prframe);
+			if (ret != _SUCCESS)
+			{	
+				#ifdef DBG_RX_DROP_FRAME
+				DBG_871X("DBG_RX_DROP_FRAME %s rtw_recv_indicatepkt fail!\n", __FUNCTION__);
+				#endif
+				goto _recv_data_drop;
+			}
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("@@@@  recv_func: rtw_free_recvframe\n" ));
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_debug_, ("recv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s ecv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)\n", __FUNCTION__,
+				padapter->bDriverStopped, padapter->bSurpriseRemoved);
+			#endif
+			ret = _FAIL;
+			rtw_free_recvframe(orig_prframe, pfree_recv_queue); //free this recv_frame
+		}
+
+	}
+	else if(pattrib->amsdu==1)
+	{
+
+		ret = amsdu_to_msdu(padapter, prframe);
+		if(ret != _SUCCESS)
+		{
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s amsdu_to_msdu fail\n", __FUNCTION__);
+			#endif
+			rtw_free_recvframe(orig_prframe, pfree_recv_queue);
+			goto _recv_data_drop;
+		}
+	}
+	else
+	{
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s what is this condition??\n", __FUNCTION__);
+		#endif
+		goto _recv_data_drop;
+	}
+#endif // CONFIG_80211N_HT
+
+_exit_recv_func:
+	return ret;
+
+_recv_data_drop:
+	precvpriv->rx_drop++;
+	return ret;
+}
+
+
+static int recv_func(_adapter *padapter, union recv_frame *rframe)
+{
+	int ret;
+	struct rx_pkt_attrib *prxattrib = &rframe->u.hdr.attrib;
+	struct recv_priv *recvpriv = &padapter->recvpriv;
+	struct security_priv *psecuritypriv=&padapter->securitypriv;
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+
+	/* check if need to handle uc_swdec_pending_queue*/
+	if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey)
+	{
+		union recv_frame *pending_frame;
+		_irqL irqL;
+
+		while((pending_frame=rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue))) {
+			if (recv_func_posthandle(padapter, pending_frame) == _SUCCESS)
+				DBG_871X("%s: dequeue uc_swdec_pending_queue\n", __func__);
+		}
+	}
+
+	ret = recv_func_prehandle(padapter, rframe);
+
+	if(ret == _SUCCESS) {
+		
+		/* check if need to enqueue into uc_swdec_pending_queue*/
+		if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
+			!IS_MCAST(prxattrib->ra) && prxattrib->encrypt>0 &&
+			(prxattrib->bdecrypted == 0 ||psecuritypriv->sw_decrypt == _TRUE) &&
+			!is_wep_enc(psecuritypriv->dot11PrivacyAlgrthm) &&
+			!psecuritypriv->busetkipkey) {
+			rtw_enqueue_recvframe(rframe, &padapter->recvpriv.uc_swdec_pending_queue);
+			DBG_871X("%s: no key, enqueue uc_swdec_pending_queue\n", __func__);
+			goto exit;
+		}
+		
+		ret = recv_func_posthandle(padapter, rframe);
+	}
+
+exit:
+	return ret;
+}
+
+
+s32 rtw_recv_entry(union recv_frame *precvframe)
+{
+	_adapter *padapter;
+	struct recv_priv *precvpriv;
+	s32 ret=_SUCCESS;
+
+_func_enter_;
+
+//	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("+rtw_recv_entry\n"));
+
+	padapter = precvframe->u.hdr.adapter;
+
+	precvpriv = &padapter->recvpriv;
+
+
+	if ((ret = recv_func(padapter, precvframe)) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("rtw_recv_entry: recv_func return fail!!!\n"));
+		goto _recv_entry_drop;
+	}
+
+
+	precvpriv->rx_pkts++;
+
+_func_exit_;
+
+	return ret;
+
+_recv_entry_drop:
+
+#ifdef CONFIG_MP_INCLUDED
+	padapter->mppriv.rx_pktloss = precvpriv->rx_drop;
+#endif
+
+	//RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("_recv_entry_drop\n"));
+
+_func_exit_;
+
+	return ret;
+}
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void rtw_signal_stat_timer_hdl(RTW_TIMER_HDL_ARGS)
+#else
+void rtw_signal_stat_timer_hdl(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, recvpriv.signal_stat_timer);
+#endif
+	struct recv_priv *recvpriv = &adapter->recvpriv;
+	
+	u32 tmp_s, tmp_q;
+	u8 avg_signal_strength = 0;
+	u8 avg_signal_qual = 0;
+	u32 num_signal_strength = 0;
+	u32 num_signal_qual = 0;
+	u8 _alpha = 3; // this value is based on converging_constant = 5000 and sampling_interval = 1000
+
+	if(adapter->recvpriv.is_signal_dbg) {
+		//update the user specific value, signal_strength_dbg, to signal_strength, rssi
+		adapter->recvpriv.signal_strength= adapter->recvpriv.signal_strength_dbg;
+		adapter->recvpriv.rssi=(s8)translate_percentage_to_dbm((u8)adapter->recvpriv.signal_strength_dbg);
+	} else {
+
+		if(recvpriv->signal_strength_data.update_req == 0) {// update_req is clear, means we got rx
+			avg_signal_strength = recvpriv->signal_strength_data.avg_val;
+			num_signal_strength = recvpriv->signal_strength_data.total_num;
+			// after avg_vals are accquired, we can re-stat the signal values
+			recvpriv->signal_strength_data.update_req = 1;
+		}
+		
+		if(recvpriv->signal_qual_data.update_req == 0) {// update_req is clear, means we got rx
+			avg_signal_qual = recvpriv->signal_qual_data.avg_val;
+			num_signal_qual = recvpriv->signal_qual_data.total_num;
+			// after avg_vals are accquired, we can re-stat the signal values
+			recvpriv->signal_qual_data.update_req = 1;
+		}
+
+		if (num_signal_strength == 0) {
+			if (rtw_get_on_cur_ch_time(adapter) == 0
+				|| rtw_get_passing_time_ms(rtw_get_on_cur_ch_time(adapter)) < 2 * adapter->mlmeextpriv.mlmext_info.bcn_interval
+			) {
+				goto set_timer;
+			}
+		}
+
+		if(check_fwstate(&adapter->mlmepriv, _FW_UNDER_SURVEY) == _TRUE
+			|| check_fwstate(&adapter->mlmepriv, _FW_LINKED) == _FALSE
+		) { 
+			goto set_timer;
+		}
+
+		#ifdef CONFIG_CONCURRENT_MODE
+		if (check_buddy_fwstate(adapter, _FW_UNDER_SURVEY) == _TRUE)
+			goto set_timer;
+		#endif
+
+		//update value of signal_strength, rssi, signal_qual
+		tmp_s = (avg_signal_strength+(_alpha-1)*recvpriv->signal_strength);
+		if(tmp_s %_alpha)
+			tmp_s = tmp_s/_alpha + 1;
+		else
+			tmp_s = tmp_s/_alpha;
+		if(tmp_s>100)
+			tmp_s = 100;
+
+		tmp_q = (avg_signal_qual+(_alpha-1)*recvpriv->signal_qual);
+		if(tmp_q %_alpha)
+			tmp_q = tmp_q/_alpha + 1;
+		else
+			tmp_q = tmp_q/_alpha;
+		if(tmp_q>100)
+			tmp_q = 100;
+
+		recvpriv->signal_strength = tmp_s;
+		recvpriv->rssi = (s8)translate_percentage_to_dbm(tmp_s);
+		recvpriv->signal_qual = tmp_q;
+
+		#if defined(DBG_RX_SIGNAL_DISPLAY_PROCESSING) && 1
+		DBG_871X(FUNC_ADPT_FMT" signal_strength:%3u, rssi:%3d, signal_qual:%3u"
+			", num_signal_strength:%u, num_signal_qual:%u"
+			", on_cur_ch_ms:%d"
+			"\n"
+			, FUNC_ADPT_ARG(adapter)
+			, recvpriv->signal_strength
+			, recvpriv->rssi
+			, recvpriv->signal_qual
+			, num_signal_strength, num_signal_qual
+			, rtw_get_on_cur_ch_time(adapter) ? rtw_get_passing_time_ms(rtw_get_on_cur_ch_time(adapter)) : 0
+		);
+		#endif
+	}
+
+set_timer:
+	rtw_set_signal_stat_timer(recvpriv);
+	
+}
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c
new file mode 100755
index 0000000000000..7ae86351b9f04
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c
@@ -0,0 +1,95 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_RF_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+
+
+struct ch_freq {
+	u32 channel;
+	u32 frequency;
+};
+
+struct ch_freq ch_freq_map[] = {
+	{1, 2412},{2, 2417},{3, 2422},{4, 2427},{5, 2432},
+	{6, 2437},{7, 2442},{8, 2447},{9, 2452},{10, 2457},
+	{11, 2462},{12, 2467},{13, 2472},{14, 2484},
+	/*  UNII */
+	{36, 5180},{40, 5200},{44, 5220},{48, 5240},{52, 5260},
+	{56, 5280},{60, 5300},{64, 5320},{149, 5745},{153, 5765},
+	{157, 5785},{161, 5805},{165, 5825},{167, 5835},{169, 5845},
+	{171, 5855},{173, 5865},
+	/* HiperLAN2 */
+	{100, 5500},{104, 5520},{108, 5540},{112, 5560},{116, 5580},
+	{120, 5600},{124, 5620},{128, 5640},{132, 5660},{136, 5680},
+	{140, 5700},
+	/* Japan MMAC */
+	{34, 5170},{38, 5190},{42, 5210},{46, 5230},
+	/*  Japan */
+	{184, 4920},{188, 4940},{192, 4960},{196, 4980},
+	{208, 5040},/* Japan, means J08 */
+	{212, 5060},/* Japan, means J12 */
+	{216, 5080},/* Japan, means J16 */
+};
+
+int ch_freq_map_num = (sizeof(ch_freq_map) / sizeof(struct ch_freq));
+
+u32 rtw_ch2freq(u32 channel)
+{
+	u8	i;
+	u32	freq = 0;
+
+	for (i = 0; i < ch_freq_map_num; i++)
+	{
+		if (channel == ch_freq_map[i].channel)
+		{
+			freq = ch_freq_map[i].frequency;
+				break;
+		}
+	}
+	if (i == ch_freq_map_num)
+		freq = 2412;
+
+	return freq;
+}
+
+u32 rtw_freq2ch(u32 freq)
+{
+	u8	i;
+	u32	ch = 0;
+
+	for (i = 0; i < ch_freq_map_num; i++)
+	{
+		if (freq == ch_freq_map[i].frequency)
+		{
+			ch = ch_freq_map[i].channel;
+				break;
+		}
+	}
+	if (i == ch_freq_map_num)
+		ch = 1;
+
+	return ch;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c
new file mode 100755
index 0000000000000..8fa8ed51b721c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c
@@ -0,0 +1,3115 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _RTW_SECURITY_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+#include <osdep_intf.h>
+
+
+//=====WEP related===== 
+
+#define CRC32_POLY 0x04c11db7
+
+struct arc4context
+{
+	u32 x;
+	u32 y;
+	u8 state[256];
+};
+
+
+static void arcfour_init(struct arc4context 	*parc4ctx, u8 * key,u32	key_len)
+{
+	u32	t, u;
+	u32	keyindex;
+	u32	stateindex;
+	u8 * state;
+	u32	counter;
+_func_enter_;
+	state = parc4ctx->state;
+	parc4ctx->x = 0;
+	parc4ctx->y = 0;
+	for (counter = 0; counter < 256; counter++)
+		state[counter] = (u8)counter;
+	keyindex = 0;
+	stateindex = 0;
+	for (counter = 0; counter < 256; counter++)
+	{
+		t = state[counter];
+		stateindex = (stateindex + key[keyindex] + t) & 0xff;
+		u = state[stateindex];
+		state[stateindex] = (u8)t;
+		state[counter] = (u8)u;
+		if (++keyindex >= key_len)
+			keyindex = 0;
+	}
+_func_exit_;	
+}
+static u32 arcfour_byte(	struct arc4context	*parc4ctx)
+{
+	u32 x;
+	u32 y;
+	u32 sx, sy;
+	u8 * state;
+_func_enter_;
+	state = parc4ctx->state;
+	x = (parc4ctx->x + 1) & 0xff;
+	sx = state[x];
+	y = (sx + parc4ctx->y) & 0xff;
+	sy = state[y];
+	parc4ctx->x = x;
+	parc4ctx->y = y;
+	state[y] = (u8)sx;
+	state[x] = (u8)sy;
+_func_exit_;	
+	return state[(sx + sy) & 0xff];
+}
+              
+           
+static void arcfour_encrypt(	struct arc4context	*parc4ctx, 
+	u8 * dest,
+	u8 * src, 
+	u32 len)
+{
+	u32	i;
+_func_enter_;	
+	for (i = 0; i < len; i++)
+		dest[i] = src[i] ^ (unsigned char)arcfour_byte(parc4ctx);
+_func_exit_;		
+}
+
+static sint bcrc32initialized = 0;
+static u32 crc32_table[256];
+
+
+static u8 crc32_reverseBit( u8 data)
+{
+	return( (u8)((data<<7)&0x80) | ((data<<5)&0x40) | ((data<<3)&0x20) | ((data<<1)&0x10) | ((data>>1)&0x08) | ((data>>3)&0x04) | ((data>>5)&0x02) | ((data>>7)&0x01) );
+}
+
+static void crc32_init(void)
+{
+_func_enter_;	
+	if (bcrc32initialized == 1) 
+		goto exit;
+	else{
+		sint i, j;
+		u32 c;
+		u8 *p=(u8 *)&c, *p1;
+		u8 k;
+
+		c = 0x12340000;
+
+		for (i = 0; i < 256; ++i) 
+		{
+			k = crc32_reverseBit((u8)i);
+			for (c = ((u32)k) << 24, j = 8; j > 0; --j){
+				c = c & 0x80000000 ? (c << 1) ^ CRC32_POLY : (c << 1);
+			}
+			p1 = (u8 *)&crc32_table[i];
+
+			p1[0] = crc32_reverseBit(p[3]);
+			p1[1] = crc32_reverseBit(p[2]);
+			p1[2] = crc32_reverseBit(p[1]);
+			p1[3] = crc32_reverseBit(p[0]);
+		}
+		bcrc32initialized= 1;
+	}
+exit:	
+_func_exit_;			
+}
+
+static u32 getcrc32(u8 *buf, sint len)
+{
+	u8 *p;
+	u32  crc;
+_func_enter_;	
+	if (bcrc32initialized == 0) crc32_init();
+
+	crc = 0xffffffff;       /* preload shift register, per CRC-32 spec */
+
+	for (p = buf; len > 0; ++p, --len) 
+	{
+		crc = crc32_table[ (crc ^ *p) & 0xff] ^ (crc >> 8);
+	}
+_func_exit_;				
+	return ~crc;    /* transmit complement, per CRC-32 spec */
+}
+
+
+/*
+	Need to consider the fragment  situation
+*/
+void rtw_wep_encrypt(_adapter *padapter, u8 *pxmitframe)
+{																	// exclude ICV
+	
+	unsigned char	crc[4];
+	struct arc4context	 mycontext;
+
+	sint	curfragnum,length;
+	u32	keylength;
+
+	u8	*pframe, *payload,*iv;    //,*wepkey
+	u8	wepkey[16];
+	struct	pkt_attrib	 *pattrib = &((struct xmit_frame*)pxmitframe)->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+	
+_func_enter_;	
+
+	
+	if(((struct xmit_frame*)pxmitframe)->buf_addr==NULL)
+		return;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_SIZE +
+		 (((struct xmit_frame*)pxmitframe)->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_OFFSET;
+#endif
+	
+	//start to encrypt each fragment
+	if((pattrib->encrypt==_WEP40_)||(pattrib->encrypt==_WEP104_))
+	{
+		keylength=psecuritypriv->dot11DefKeylen[psecuritypriv->dot11PrivacyKeyIndex];
+
+		for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++)
+		{
+			iv=pframe+pattrib->hdrlen;
+			_rtw_memcpy(&wepkey[0], iv, 3);
+			_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0],keylength);
+			payload=pframe+pattrib->iv_len+pattrib->hdrlen;
+
+			if((curfragnum+1)==pattrib->nr_frags)
+			{	//the last fragment
+			
+				length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len- pattrib->icv_len;
+			
+				*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));
+
+				arcfour_init(&mycontext, wepkey,3+keylength);
+				arcfour_encrypt(&mycontext, payload, payload, length);
+				arcfour_encrypt(&mycontext, payload+length, crc, 4);
+
+			}
+			else
+			{
+			length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len ;
+				*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));
+				arcfour_init(&mycontext, wepkey,3+keylength);
+				arcfour_encrypt(&mycontext, payload, payload, length);
+				arcfour_encrypt(&mycontext, payload+length, crc, 4);
+	
+			pframe+=pxmitpriv->frag_len;
+			pframe=(u8 *)RND4((SIZE_PTR)(pframe));
+
+			}
+			
+		}		
+						
+	}
+	
+_func_exit_;						
+
+}
+
+void rtw_wep_decrypt(_adapter  *padapter, u8 *precvframe)
+{								
+	// exclude ICV
+	u8	crc[4];
+	struct arc4context	 mycontext;
+	sint 	length;
+	u32	keylength;
+	u8	*pframe, *payload,*iv,wepkey[16];
+	u8	 keyindex;
+	struct	rx_pkt_attrib	 *prxattrib = &(((union recv_frame*)precvframe)->u.hdr.attrib);
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+
+_func_enter_;	
+
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	
+	//start to decrypt recvframe
+	if((prxattrib->encrypt==_WEP40_)||(prxattrib->encrypt==_WEP104_))
+	{
+		iv=pframe+prxattrib->hdrlen;
+		//keyindex=(iv[3]&0x3);
+		keyindex = prxattrib->key_index;
+		keylength=psecuritypriv->dot11DefKeylen[keyindex];
+		_rtw_memcpy(&wepkey[0], iv, 3);
+		//_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0],keylength);
+		_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[keyindex].skey[0],keylength);
+		length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
+
+		payload=pframe+prxattrib->iv_len+prxattrib->hdrlen;
+		
+		//decrypt payload include icv
+		arcfour_init(&mycontext, wepkey,3+keylength);
+		arcfour_encrypt(&mycontext, payload, payload,  length);
+				
+		//calculate icv and compare the icv
+		*((u32 *)crc)=le32_to_cpu(getcrc32(payload,length-4));
+		
+		if(crc[3]!=payload[length-1] || crc[2]!=payload[length-2] || crc[1]!=payload[length-3] || crc[0]!=payload[length-4])
+		{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
+						crc[3],payload[length-1],crc[2],payload[length-2],crc[1],payload[length-3],crc[0],payload[length-4]));
+		}	
+						
+	}
+	
+_func_exit_;		
+
+	return;
+	
+}
+
+//3 		=====TKIP related=====
+
+static u32 secmicgetuint32( u8 * p )
+// Convert from Byte[] to Us4Byte32 in a portable way
+{
+	s32 i;
+	u32 res = 0;
+_func_enter_;		
+	for( i=0; i<4; i++ )
+	{
+		res |= ((u32)(*p++)) << (8*i);
+	}
+_func_exit_;		
+	return res;
+}
+
+static void secmicputuint32( u8 * p, u32 val )
+// Convert from Us4Byte32 to Byte[] in a portable way
+{
+	long i;
+_func_enter_;			
+	for( i=0; i<4; i++ )
+	{
+		*p++ = (u8) (val & 0xff);
+		val >>= 8;
+	}
+_func_exit_;		
+}
+
+static void secmicclear(struct mic_data *pmicdata)
+{
+// Reset the state to the empty message.
+_func_enter_;	
+	pmicdata->L = pmicdata->K0;
+	pmicdata->R = pmicdata->K1;
+	pmicdata->nBytesInM = 0;
+	pmicdata->M = 0;
+_func_exit_;	
+}
+
+void rtw_secmicsetkey(struct mic_data *pmicdata, u8 * key )
+{
+	// Set the key
+_func_enter_;		
+	pmicdata->K0 = secmicgetuint32( key );
+	pmicdata->K1 = secmicgetuint32( key + 4 );
+	// and reset the message
+	secmicclear(pmicdata);
+_func_exit_;		
+}
+
+void rtw_secmicappendbyte(struct mic_data *pmicdata, u8 b )
+{
+_func_enter_;	
+	// Append the byte to our word-sized buffer
+	pmicdata->M |= ((unsigned long)b) << (8*pmicdata->nBytesInM);
+	pmicdata->nBytesInM++;
+	// Process the word if it is full.
+	if( pmicdata->nBytesInM >= 4 )
+	{
+		pmicdata->L ^= pmicdata->M;
+		pmicdata->R ^= ROL32( pmicdata->L, 17 );
+		pmicdata->L += pmicdata->R;
+		pmicdata->R ^= ((pmicdata->L & 0xff00ff00) >> 8) | ((pmicdata->L & 0x00ff00ff) << 8);
+		pmicdata->L += pmicdata->R;
+		pmicdata->R ^= ROL32( pmicdata->L, 3 );
+		pmicdata->L += pmicdata->R;
+		pmicdata->R ^= ROR32( pmicdata->L, 2 );
+		pmicdata->L += pmicdata->R;
+		// Clear the buffer
+		pmicdata->M = 0;
+		pmicdata->nBytesInM = 0;
+	}
+_func_exit_;			
+}
+
+void rtw_secmicappend(struct mic_data *pmicdata, u8 * src, u32 nbytes )
+{
+_func_enter_;	
+	// This is simple
+	while( nbytes > 0 )
+	{
+		rtw_secmicappendbyte(pmicdata, *src++ );
+		nbytes--;
+	}
+_func_exit_;			
+}
+
+void rtw_secgetmic(struct mic_data *pmicdata, u8 * dst )
+{
+_func_enter_;	
+	// Append the minimum padding
+	rtw_secmicappendbyte(pmicdata, 0x5a );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	// and then zeroes until the length is a multiple of 4
+	while( pmicdata->nBytesInM != 0 )
+	{
+		rtw_secmicappendbyte(pmicdata, 0 );
+	}
+	// The appendByte function has already computed the result.
+	secmicputuint32( dst, pmicdata->L );
+	secmicputuint32( dst+4, pmicdata->R );
+	// Reset to the empty message.
+	secmicclear(pmicdata);
+_func_exit_;		
+}
+
+
+void rtw_seccalctkipmic(u8 * key,u8 *header,u8 *data,u32 data_len,u8 *mic_code, u8 pri)
+{
+
+	struct mic_data	micdata;
+	u8 priority[4]={0x0,0x0,0x0,0x0};
+_func_enter_;		
+	rtw_secmicsetkey(&micdata, key);
+	priority[0]=pri;
+	
+	/* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
+	if(header[1]&1){   //ToDS==1
+			rtw_secmicappend(&micdata, &header[16], 6);  //DA
+		if(header[1]&2)  //From Ds==1
+			rtw_secmicappend(&micdata, &header[24], 6);
+		else
+			rtw_secmicappend(&micdata, &header[10], 6);		
+	}	
+	else{	//ToDS==0
+		rtw_secmicappend(&micdata, &header[4], 6);   //DA
+		if(header[1]&2)  //From Ds==1
+			rtw_secmicappend(&micdata, &header[16], 6);
+		else
+			rtw_secmicappend(&micdata, &header[10], 6);
+
+	}
+	rtw_secmicappend(&micdata, &priority[0], 4);
+
+	
+	rtw_secmicappend(&micdata, data, data_len);
+
+	rtw_secgetmic(&micdata,mic_code);
+_func_exit_;	
+}
+
+
+
+
+/* macros for extraction/creation of unsigned char/unsigned short values  */
+#define RotR1(v16)   ((((v16) >> 1) & 0x7FFF) ^ (((v16) & 1) << 15))
+#define   Lo8(v16)   ((u8)( (v16)       & 0x00FF))
+#define   Hi8(v16)   ((u8)(((v16) >> 8) & 0x00FF))
+#define  Lo16(v32)   ((u16)( (v32)       & 0xFFFF))
+#define  Hi16(v32)   ((u16)(((v32) >>16) & 0xFFFF))
+#define  Mk16(hi,lo) ((lo) ^ (((u16)(hi)) << 8))
+
+/* select the Nth 16-bit word of the temporal key unsigned char array TK[]   */
+#define  TK16(N)     Mk16(tk[2*(N)+1],tk[2*(N)])
+
+/* S-box lookup: 16 bits --> 16 bits */
+#define _S_(v16)     (Sbox1[0][Lo8(v16)] ^ Sbox1[1][Hi8(v16)])
+
+/* fixed algorithm "parameters" */
+#define PHASE1_LOOP_CNT   8    /* this needs to be "big enough"     */
+#define TA_SIZE           6    /*  48-bit transmitter address       */
+#define TK_SIZE          16    /* 128-bit temporal key              */
+#define P1K_SIZE         10    /*  80-bit Phase1 key                */
+#define RC4_KEY_SIZE     16    /* 128-bit RC4KEY (104 bits unknown) */
+
+
+/* 2-unsigned char by 2-unsigned char subset of the full AES S-box table */
+static const unsigned short Sbox1[2][256]=       /* Sbox for hash (can be in ROM)     */
+{ {
+   0xC6A5,0xF884,0xEE99,0xF68D,0xFF0D,0xD6BD,0xDEB1,0x9154,
+   0x6050,0x0203,0xCEA9,0x567D,0xE719,0xB562,0x4DE6,0xEC9A,
+   0x8F45,0x1F9D,0x8940,0xFA87,0xEF15,0xB2EB,0x8EC9,0xFB0B,
+   0x41EC,0xB367,0x5FFD,0x45EA,0x23BF,0x53F7,0xE496,0x9B5B,
+   0x75C2,0xE11C,0x3DAE,0x4C6A,0x6C5A,0x7E41,0xF502,0x834F,
+   0x685C,0x51F4,0xD134,0xF908,0xE293,0xAB73,0x6253,0x2A3F,
+   0x080C,0x9552,0x4665,0x9D5E,0x3028,0x37A1,0x0A0F,0x2FB5,
+   0x0E09,0x2436,0x1B9B,0xDF3D,0xCD26,0x4E69,0x7FCD,0xEA9F,
+   0x121B,0x1D9E,0x5874,0x342E,0x362D,0xDCB2,0xB4EE,0x5BFB,
+   0xA4F6,0x764D,0xB761,0x7DCE,0x527B,0xDD3E,0x5E71,0x1397,
+   0xA6F5,0xB968,0x0000,0xC12C,0x4060,0xE31F,0x79C8,0xB6ED,
+   0xD4BE,0x8D46,0x67D9,0x724B,0x94DE,0x98D4,0xB0E8,0x854A,
+   0xBB6B,0xC52A,0x4FE5,0xED16,0x86C5,0x9AD7,0x6655,0x1194,
+   0x8ACF,0xE910,0x0406,0xFE81,0xA0F0,0x7844,0x25BA,0x4BE3,
+   0xA2F3,0x5DFE,0x80C0,0x058A,0x3FAD,0x21BC,0x7048,0xF104,
+   0x63DF,0x77C1,0xAF75,0x4263,0x2030,0xE51A,0xFD0E,0xBF6D,
+   0x814C,0x1814,0x2635,0xC32F,0xBEE1,0x35A2,0x88CC,0x2E39,
+   0x9357,0x55F2,0xFC82,0x7A47,0xC8AC,0xBAE7,0x322B,0xE695,
+   0xC0A0,0x1998,0x9ED1,0xA37F,0x4466,0x547E,0x3BAB,0x0B83,
+   0x8CCA,0xC729,0x6BD3,0x283C,0xA779,0xBCE2,0x161D,0xAD76,
+   0xDB3B,0x6456,0x744E,0x141E,0x92DB,0x0C0A,0x486C,0xB8E4,
+   0x9F5D,0xBD6E,0x43EF,0xC4A6,0x39A8,0x31A4,0xD337,0xF28B,
+   0xD532,0x8B43,0x6E59,0xDAB7,0x018C,0xB164,0x9CD2,0x49E0,
+   0xD8B4,0xACFA,0xF307,0xCF25,0xCAAF,0xF48E,0x47E9,0x1018,
+   0x6FD5,0xF088,0x4A6F,0x5C72,0x3824,0x57F1,0x73C7,0x9751,
+   0xCB23,0xA17C,0xE89C,0x3E21,0x96DD,0x61DC,0x0D86,0x0F85,
+   0xE090,0x7C42,0x71C4,0xCCAA,0x90D8,0x0605,0xF701,0x1C12,
+   0xC2A3,0x6A5F,0xAEF9,0x69D0,0x1791,0x9958,0x3A27,0x27B9,
+   0xD938,0xEB13,0x2BB3,0x2233,0xD2BB,0xA970,0x0789,0x33A7,
+   0x2DB6,0x3C22,0x1592,0xC920,0x8749,0xAAFF,0x5078,0xA57A,
+   0x038F,0x59F8,0x0980,0x1A17,0x65DA,0xD731,0x84C6,0xD0B8,
+   0x82C3,0x29B0,0x5A77,0x1E11,0x7BCB,0xA8FC,0x6DD6,0x2C3A,
+  },
+ 
+
+  {  /* second half of table is unsigned char-reversed version of first! */
+   0xA5C6,0x84F8,0x99EE,0x8DF6,0x0DFF,0xBDD6,0xB1DE,0x5491,
+   0x5060,0x0302,0xA9CE,0x7D56,0x19E7,0x62B5,0xE64D,0x9AEC,
+   0x458F,0x9D1F,0x4089,0x87FA,0x15EF,0xEBB2,0xC98E,0x0BFB,
+   0xEC41,0x67B3,0xFD5F,0xEA45,0xBF23,0xF753,0x96E4,0x5B9B,
+   0xC275,0x1CE1,0xAE3D,0x6A4C,0x5A6C,0x417E,0x02F5,0x4F83,
+   0x5C68,0xF451,0x34D1,0x08F9,0x93E2,0x73AB,0x5362,0x3F2A,
+   0x0C08,0x5295,0x6546,0x5E9D,0x2830,0xA137,0x0F0A,0xB52F,
+   0x090E,0x3624,0x9B1B,0x3DDF,0x26CD,0x694E,0xCD7F,0x9FEA,
+   0x1B12,0x9E1D,0x7458,0x2E34,0x2D36,0xB2DC,0xEEB4,0xFB5B,
+   0xF6A4,0x4D76,0x61B7,0xCE7D,0x7B52,0x3EDD,0x715E,0x9713,
+   0xF5A6,0x68B9,0x0000,0x2CC1,0x6040,0x1FE3,0xC879,0xEDB6,
+   0xBED4,0x468D,0xD967,0x4B72,0xDE94,0xD498,0xE8B0,0x4A85,
+   0x6BBB,0x2AC5,0xE54F,0x16ED,0xC586,0xD79A,0x5566,0x9411,
+   0xCF8A,0x10E9,0x0604,0x81FE,0xF0A0,0x4478,0xBA25,0xE34B,
+   0xF3A2,0xFE5D,0xC080,0x8A05,0xAD3F,0xBC21,0x4870,0x04F1,
+   0xDF63,0xC177,0x75AF,0x6342,0x3020,0x1AE5,0x0EFD,0x6DBF,
+   0x4C81,0x1418,0x3526,0x2FC3,0xE1BE,0xA235,0xCC88,0x392E,
+   0x5793,0xF255,0x82FC,0x477A,0xACC8,0xE7BA,0x2B32,0x95E6,
+   0xA0C0,0x9819,0xD19E,0x7FA3,0x6644,0x7E54,0xAB3B,0x830B,
+   0xCA8C,0x29C7,0xD36B,0x3C28,0x79A7,0xE2BC,0x1D16,0x76AD,
+   0x3BDB,0x5664,0x4E74,0x1E14,0xDB92,0x0A0C,0x6C48,0xE4B8,
+   0x5D9F,0x6EBD,0xEF43,0xA6C4,0xA839,0xA431,0x37D3,0x8BF2,
+   0x32D5,0x438B,0x596E,0xB7DA,0x8C01,0x64B1,0xD29C,0xE049,
+   0xB4D8,0xFAAC,0x07F3,0x25CF,0xAFCA,0x8EF4,0xE947,0x1810,
+   0xD56F,0x88F0,0x6F4A,0x725C,0x2438,0xF157,0xC773,0x5197,
+   0x23CB,0x7CA1,0x9CE8,0x213E,0xDD96,0xDC61,0x860D,0x850F,
+   0x90E0,0x427C,0xC471,0xAACC,0xD890,0x0506,0x01F7,0x121C,
+   0xA3C2,0x5F6A,0xF9AE,0xD069,0x9117,0x5899,0x273A,0xB927,
+   0x38D9,0x13EB,0xB32B,0x3322,0xBBD2,0x70A9,0x8907,0xA733,
+   0xB62D,0x223C,0x9215,0x20C9,0x4987,0xFFAA,0x7850,0x7AA5,
+   0x8F03,0xF859,0x8009,0x171A,0xDA65,0x31D7,0xC684,0xB8D0,
+   0xC382,0xB029,0x775A,0x111E,0xCB7B,0xFCA8,0xD66D,0x3A2C,
+  }
+};
+ 
+ /*
+**********************************************************************
+* Routine: Phase 1 -- generate P1K, given TA, TK, IV32
+*
+* Inputs:
+*     tk[]      = temporal key                         [128 bits]
+*     ta[]      = transmitter's MAC address            [ 48 bits]
+*     iv32      = upper 32 bits of IV                  [ 32 bits]
+* Output:
+*     p1k[]     = Phase 1 key                          [ 80 bits]
+*
+* Note:
+*     This function only needs to be called every 2**16 packets,
+*     although in theory it could be called every packet.
+*
+**********************************************************************
+*/
+static void phase1(u16 *p1k,const u8 *tk,const u8 *ta,u32 iv32)
+{
+	sint  i;
+_func_enter_;
+	/* Initialize the 80 bits of P1K[] from IV32 and TA[0..5]     */
+	p1k[0]      = Lo16(iv32);
+	p1k[1]      = Hi16(iv32);
+	p1k[2]      = Mk16(ta[1],ta[0]); /* use TA[] as little-endian */
+	p1k[3]      = Mk16(ta[3],ta[2]);
+	p1k[4]      = Mk16(ta[5],ta[4]);
+
+	/* Now compute an unbalanced Feistel cipher with 80-bit block */
+	/* size on the 80-bit block P1K[], using the 128-bit key TK[] */
+	for (i=0; i < PHASE1_LOOP_CNT ;i++)
+	{                 /* Each add operation here is mod 2**16 */
+      		p1k[0] += _S_(p1k[4] ^ TK16((i&1)+0));
+		p1k[1] += _S_(p1k[0] ^ TK16((i&1)+2));
+		p1k[2] += _S_(p1k[1] ^ TK16((i&1)+4));
+		p1k[3] += _S_(p1k[2] ^ TK16((i&1)+6));
+		p1k[4] += _S_(p1k[3] ^ TK16((i&1)+0));
+		p1k[4] +=  (unsigned short)i;                    /* avoid "slide attacks" */
+        }
+_func_exit_;
+}
+ 
+
+/*
+**********************************************************************
+* Routine: Phase 2 -- generate RC4KEY, given TK, P1K, IV16
+*
+* Inputs:
+*     tk[]      = Temporal key                         [128 bits]
+*     p1k[]     = Phase 1 output key                   [ 80 bits]
+*     iv16      = low 16 bits of IV counter            [ 16 bits]
+* Output:
+*     rc4key[]  = the key used to encrypt the packet   [128 bits]
+*
+* Note:
+*     The value {TA,IV32,IV16} for Phase1/Phase2 must be unique
+*     across all packets using the same key TK value. Then, for a
+*     given value of TK[], this TKIP48 construction guarantees that
+*     the final RC4KEY value is unique across all packets.
+*
+* Suggested implementation optimization: if PPK[] is "overlaid"
+*     appropriately on RC4KEY[], there is no need for the final
+*     for loop below that copies the PPK[] result into RC4KEY[].
+*
+**********************************************************************
+*/
+static void phase2(u8 *rc4key,const u8 *tk,const u16 *p1k,u16 iv16)
+{
+	sint  i;
+	u16 PPK[6];                          /* temporary key for mixing    */
+_func_enter_;
+	/* Note: all adds in the PPK[] equations below are mod 2**16         */
+	for (i=0;i<5;i++) PPK[i]=p1k[i];      /* first, copy P1K to PPK      */
+		PPK[5]  =  p1k[4] +iv16;             /* next,  add in IV16          */
+
+	/* Bijective non-linear mixing of the 96 bits of PPK[0..5]           */
+	PPK[0] +=    _S_(PPK[5] ^ TK16(0));   /* Mix key in each "round"     */
+	PPK[1] +=    _S_(PPK[0] ^ TK16(1));
+	PPK[2] +=    _S_(PPK[1] ^ TK16(2));
+	PPK[3] +=    _S_(PPK[2] ^ TK16(3));
+	PPK[4] +=    _S_(PPK[3] ^ TK16(4));
+	PPK[5] +=    _S_(PPK[4] ^ TK16(5));   /* Total # S-box lookups == 6  */
+
+	/* Final sweep: bijective, "linear". Rotates kill LSB correlations   */
+	PPK[0] +=  RotR1(PPK[5] ^ TK16(6));
+	PPK[1] +=  RotR1(PPK[0] ^ TK16(7));   /* Use all of TK[] in Phase2   */
+	PPK[2] +=  RotR1(PPK[1]);
+	PPK[3] +=  RotR1(PPK[2]);
+	PPK[4] +=  RotR1(PPK[3]);
+	PPK[5] +=  RotR1(PPK[4]);
+	/* Note: At this point, for a given key TK[0..15], the 96-bit output */
+	/*       value PPK[0..5] is guaranteed to be unique, as a function   */
+	/*       of the 96-bit "input" value   {TA,IV32,IV16}. That is, P1K  */
+	/*       is now a keyed permutation of {TA,IV32,IV16}.               */
+
+	/* Set RC4KEY[0..3], which includes "cleartext" portion of RC4 key   */
+	rc4key[0] = Hi8(iv16);                /* RC4KEY[0..2] is the WEP IV  */
+	rc4key[1] =(Hi8(iv16) | 0x20) & 0x7F; /* Help avoid weak (FMS) keys  */
+	rc4key[2] = Lo8(iv16);
+	rc4key[3] = Lo8((PPK[5] ^ TK16(0)) >> 1);
+	 
+
+	/* Copy 96 bits of PPK[0..5] to RC4KEY[4..15]  (little-endian)       */
+	for (i=0;i<6;i++)
+	{
+		rc4key[4+2*i] = Lo8(PPK[i]);
+		rc4key[5+2*i] = Hi8(PPK[i]);
+	}
+_func_exit_;	
+}
+
+
+//The hlen isn't include the IV
+u32	rtw_tkip_encrypt(_adapter *padapter, u8 *pxmitframe)
+{																	// exclude ICV
+	u16	pnl;
+	u32	pnh;
+	u8	rc4key[16];
+	u8   ttkey[16];
+	u8	crc[4];
+	struct arc4context mycontext;
+	sint 			curfragnum,length;
+	u32	prwskeylen;
+
+	u8	*pframe, *payload,*iv,*prwskey;
+	union pn48 dot11txpn;
+	struct	sta_info		*stainfo;
+	struct	pkt_attrib	 *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+	u32	res=_SUCCESS;
+_func_enter_;
+
+	if(((struct xmit_frame*)pxmitframe)->buf_addr==NULL)
+		return _FAIL;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_SIZE +
+		 (((struct xmit_frame*)pxmitframe)->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_OFFSET;
+#endif
+
+	//4 start to encrypt each fragment
+	if(pattrib->encrypt==_TKIP_){
+
+		if(pattrib->psta)
+		{
+			stainfo = pattrib->psta;
+		}
+		else
+		{
+			DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+			stainfo=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0] );
+		}	
+		
+		if (stainfo!=NULL){
+
+			if(!(stainfo->state &_FW_LINKED))
+			{
+				DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
+				return _FAIL;
+			}
+			
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_encrypt: stainfo!=NULL!!!\n"));
+
+			if(IS_MCAST(pattrib->ra))
+			{
+				prwskey=psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+			}
+			else
+			{
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+			}
+
+			prwskeylen=16;
+
+			for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++){
+				iv=pframe+pattrib->hdrlen;
+				payload=pframe+pattrib->iv_len+pattrib->hdrlen;
+				
+				GET_TKIP_PN(iv, dot11txpn);
+
+				pnl=(u16)(dot11txpn.val);
+				pnh=(u32)(dot11txpn.val>>16);
+
+				phase1((u16 *)&ttkey[0],prwskey,&pattrib->ta[0],pnh);
+
+				phase2(&rc4key[0],prwskey,(u16 *)&ttkey[0],pnl);	
+
+				if((curfragnum+1)==pattrib->nr_frags){	//4 the last fragment
+					length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len- pattrib->icv_len;
+					RT_TRACE(_module_rtl871x_security_c_,_drv_info_,("pattrib->iv_len =%x, pattrib->icv_len =%x\n", pattrib->iv_len,pattrib->icv_len));
+					*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));/* modified by Amy*/
+
+					arcfour_init(&mycontext, rc4key,16);
+					arcfour_encrypt(&mycontext, payload, payload, length);
+					arcfour_encrypt(&mycontext, payload+length, crc, 4);
+
+				}
+				else{
+					length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len ;
+					*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));/* modified by Amy*/
+					arcfour_init(&mycontext,rc4key,16);
+					arcfour_encrypt(&mycontext, payload, payload, length);
+					arcfour_encrypt(&mycontext, payload+length, crc, 4);
+	
+				pframe+=pxmitpriv->frag_len;
+				pframe=(u8 *)RND4((SIZE_PTR)(pframe));
+
+				}
+			}
+
+
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_encrypt: stainfo==NULL!!!\n"));
+                        DBG_871X("%s, psta==NUL\n", __func__);
+			res=_FAIL;
+		}
+						
+	}
+_func_exit_;	
+	return res;
+				
+}
+
+
+//The hlen isn't include the IV
+u32 rtw_tkip_decrypt(_adapter *padapter, u8 *precvframe)
+{																	// exclude ICV
+	u16 pnl;
+	u32 pnh;
+	u8   rc4key[16];
+	u8   ttkey[16];
+	u8	crc[4];
+	struct arc4context mycontext;
+	sint 			length;
+	u32	prwskeylen;
+
+	u8	*pframe, *payload,*iv,*prwskey;
+	union pn48 dot11txpn;
+	struct	sta_info		*stainfo;
+	struct	rx_pkt_attrib	 *prxattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+//	struct	recv_priv		*precvpriv=&padapter->recvpriv;
+	u32		res=_SUCCESS;
+
+_func_enter_;
+
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	
+	//4 start to decrypt recvframe
+	if(prxattrib->encrypt==_TKIP_){
+
+		stainfo=rtw_get_stainfo(&padapter->stapriv ,&prxattrib->ta[0] );
+		if (stainfo!=NULL){
+
+			if(IS_MCAST(prxattrib->ra))
+			{
+				static u32 start = 0;
+				static u32 no_gkey_bc_cnt = 0;
+				static u32 no_gkey_mc_cnt = 0;
+
+				if(psecuritypriv->binstallGrpkey==_FALSE)
+				{
+					res=_FAIL;
+
+					if (start == 0)
+						start = rtw_get_current_time();
+
+					if (is_broadcast_mac_addr(prxattrib->ra))
+						no_gkey_bc_cnt++;
+					else
+						no_gkey_mc_cnt++;
+
+					if (rtw_get_passing_time_ms(start) > 1000) {
+						if (no_gkey_bc_cnt || no_gkey_mc_cnt) {
+							DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" no_gkey_bc_cnt:%u, no_gkey_mc_cnt:%u\n",
+								FUNC_ADPT_ARG(padapter), no_gkey_bc_cnt, no_gkey_mc_cnt);
+						}
+						start = rtw_get_current_time();
+						no_gkey_bc_cnt = 0;
+						no_gkey_mc_cnt = 0;
+					}
+					goto exit;
+				}
+
+				if (no_gkey_bc_cnt || no_gkey_mc_cnt) {
+					DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" gkey installed. no_gkey_bc_cnt:%u, no_gkey_mc_cnt:%u\n",
+						FUNC_ADPT_ARG(padapter), no_gkey_bc_cnt, no_gkey_mc_cnt);
+				}
+				start = 0;
+				no_gkey_bc_cnt = 0;
+				no_gkey_mc_cnt = 0;
+
+				//DBG_871X("rx bc/mc packets, to perform sw rtw_tkip_decrypt\n");
+				//prwskey = psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+				prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
+				prwskeylen=16;
+			}
+			else
+			{
+			        RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_decrypt: stainfo!=NULL!!!\n"));
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+				prwskeylen=16;
+			}
+			
+			iv=pframe+prxattrib->hdrlen;
+			payload=pframe+prxattrib->iv_len+prxattrib->hdrlen;
+			length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
+				
+			GET_TKIP_PN(iv, dot11txpn);
+
+			pnl=(u16)(dot11txpn.val);
+			pnh=(u32)(dot11txpn.val>>16);
+
+			phase1((u16 *)&ttkey[0],prwskey,&prxattrib->ta[0],pnh);
+			phase2(&rc4key[0],prwskey,(unsigned short *)&ttkey[0],pnl);	
+
+			//4 decrypt payload include icv
+					
+			arcfour_init(&mycontext, rc4key,16);
+			arcfour_encrypt(&mycontext, payload, payload, length);
+
+			*((u32 *)crc)=le32_to_cpu(getcrc32(payload,length-4));
+
+			if(crc[3]!=payload[length-1] || crc[2]!=payload[length-2] || crc[1]!=payload[length-3] || crc[0]!=payload[length-4])
+			{
+			    RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
+						crc[3],payload[length-1],crc[2],payload[length-2],crc[1],payload[length-3],crc[0],payload[length-4]));
+				res=_FAIL;
+			}
+						
+		
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
+			res=_FAIL;
+		}
+						
+	}
+_func_exit_;	
+exit:
+	return res;
+				
+}
+
+
+//3			=====AES related=====
+
+
+
+#define MAX_MSG_SIZE	2048
+/*****************************/
+/******** SBOX Table *********/
+/*****************************/
+
+  static  u8 sbox_table[256] =
+    {
+        0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
+        0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
+        0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
+        0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
+        0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
+        0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+        0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
+        0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
+        0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
+        0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
+        0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
+        0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+        0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
+        0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
+        0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
+        0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
+        0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
+        0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+        0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
+        0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
+        0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
+        0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
+        0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
+        0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+        0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
+        0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
+        0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
+        0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
+        0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
+        0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+        0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
+        0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+    };
+
+/*****************************/
+/**** Function Prototypes ****/
+/*****************************/
+
+static void bitwise_xor(u8 *ina, u8 *inb, u8 *out);
+static void construct_mic_iv(
+                        u8 *mic_header1,
+                        sint qc_exists,
+                        sint a4_exists,
+                        u8 *mpdu,
+                        uint payload_length,
+                        u8 * pn_vector,
+                        uint frtype);// add for CONFIG_IEEE80211W, none 11w also can use
+static void construct_mic_header1(
+                        u8 *mic_header1,
+                        sint header_length,
+                        u8 *mpdu,
+                        uint frtype);// add for CONFIG_IEEE80211W, none 11w also can use
+static void construct_mic_header2(
+                    u8 *mic_header2,
+                    u8 *mpdu,
+                    sint a4_exists,
+                    sint qc_exists);
+static void construct_ctr_preload(
+                        u8 *ctr_preload,
+                        sint a4_exists,
+                        sint qc_exists,
+                        u8 *mpdu,
+                        u8 *pn_vector,
+                        sint c,
+                        uint frtype);// add for CONFIG_IEEE80211W, none 11w also can use
+static void xor_128(u8 *a, u8 *b, u8 *out);
+static void xor_32(u8 *a, u8 *b, u8 *out);
+static u8 sbox(u8 a);
+static void next_key(u8 *key, sint round);
+static void byte_sub(u8 *in, u8 *out);
+static void shift_row(u8 *in, u8 *out);
+static void mix_column(u8 *in, u8 *out);
+#ifndef PLATFORM_FREEBSD 
+static void add_round_key( u8 *shiftrow_in,
+                    u8 *mcol_in,
+                    u8 *block_in,
+                    sint round,
+                    u8 *out);
+#endif //PLATFORM_FREEBSD
+static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext);
+
+
+/****************************************/
+/* aes128k128d()                        */
+/* Performs a 128 bit AES encrypt with  */
+/* 128 bit data.                        */
+/****************************************/
+static void xor_128(u8 *a, u8 *b, u8 *out)
+{
+    sint i;
+_func_enter_;	
+    for (i=0;i<16; i++)
+    {
+        out[i] = a[i] ^ b[i];
+    }
+_func_exit_;		
+}
+
+
+static void xor_32(u8 *a, u8 *b, u8 *out)
+{
+    sint i;
+_func_enter_;		
+    for (i=0;i<4; i++)
+    {
+        out[i] = a[i] ^ b[i];
+    }
+_func_exit_;		
+}
+
+
+static u8 sbox(u8 a)
+{
+    return sbox_table[(sint)a];
+}
+
+
+static void next_key(u8 *key, sint round)
+{
+    u8 rcon;
+    u8 sbox_key[4];
+    u8 rcon_table[12] =
+    {
+        0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
+        0x1b, 0x36, 0x36, 0x36
+    };
+_func_enter_;		
+    sbox_key[0] = sbox(key[13]);
+    sbox_key[1] = sbox(key[14]);
+    sbox_key[2] = sbox(key[15]);
+    sbox_key[3] = sbox(key[12]);
+
+    rcon = rcon_table[round];
+
+    xor_32(&key[0], sbox_key, &key[0]);
+    key[0] = key[0] ^ rcon;
+
+    xor_32(&key[4], &key[0], &key[4]);
+    xor_32(&key[8], &key[4], &key[8]);
+    xor_32(&key[12], &key[8], &key[12]);
+_func_exit_;		
+}
+
+
+static void byte_sub(u8 *in, u8 *out)
+{
+    sint i;
+_func_enter_;			
+    for (i=0; i< 16; i++)
+    {
+        out[i] = sbox(in[i]);
+    }
+_func_exit_;	
+}
+
+
+static void shift_row(u8 *in, u8 *out)
+{
+_func_enter_;	
+    out[0] =  in[0];
+    out[1] =  in[5];
+    out[2] =  in[10];
+    out[3] =  in[15];
+    out[4] =  in[4];
+    out[5] =  in[9];
+    out[6] =  in[14];
+    out[7] =  in[3];
+    out[8] =  in[8];
+    out[9] =  in[13];
+    out[10] = in[2];
+    out[11] = in[7];
+    out[12] = in[12];
+    out[13] = in[1];
+    out[14] = in[6];
+    out[15] = in[11];
+_func_exit_;		
+}
+
+
+static void mix_column(u8 *in, u8 *out)
+{
+    sint i;
+    u8 add1b[4];
+    u8 add1bf7[4];
+    u8 rotl[4];
+    u8 swap_halfs[4];
+    u8 andf7[4];
+    u8 rotr[4];
+    u8 temp[4];
+    u8 tempb[4];
+_func_enter_;	
+    for (i=0 ; i<4; i++)
+    {
+        if ((in[i] & 0x80)== 0x80)
+            add1b[i] = 0x1b;
+        else
+            add1b[i] = 0x00;
+    }
+
+    swap_halfs[0] = in[2];    /* Swap halfs */
+    swap_halfs[1] = in[3];
+    swap_halfs[2] = in[0];
+    swap_halfs[3] = in[1];
+
+    rotl[0] = in[3];        /* Rotate left 8 bits */
+    rotl[1] = in[0];
+    rotl[2] = in[1];
+    rotl[3] = in[2];
+
+    andf7[0] = in[0] & 0x7f;
+    andf7[1] = in[1] & 0x7f;
+    andf7[2] = in[2] & 0x7f;
+    andf7[3] = in[3] & 0x7f;
+
+    for (i = 3; i>0; i--)    /* logical shift left 1 bit */
+    {
+        andf7[i] = andf7[i] << 1;
+        if ((andf7[i-1] & 0x80) == 0x80)
+        {
+            andf7[i] = (andf7[i] | 0x01);
+        }
+    }
+    andf7[0] = andf7[0] << 1;
+    andf7[0] = andf7[0] & 0xfe;
+
+    xor_32(add1b, andf7, add1bf7);
+
+    xor_32(in, add1bf7, rotr);
+
+    temp[0] = rotr[0];         /* Rotate right 8 bits */
+    rotr[0] = rotr[1];
+    rotr[1] = rotr[2];
+    rotr[2] = rotr[3];
+    rotr[3] = temp[0];
+
+    xor_32(add1bf7, rotr, temp);
+    xor_32(swap_halfs, rotl,tempb);
+    xor_32(temp, tempb, out);
+_func_exit_;		
+}
+
+
+static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext)
+{
+    sint round;
+    sint i;
+    u8 intermediatea[16];
+    u8 intermediateb[16];
+    u8 round_key[16];
+_func_enter_;	
+    for(i=0; i<16; i++) round_key[i] = key[i];
+
+    for (round = 0; round < 11; round++)
+    {
+        if (round == 0)
+        {
+            xor_128(round_key, data, ciphertext);
+            next_key(round_key, round);
+        }
+        else if (round == 10)
+        {
+            byte_sub(ciphertext, intermediatea);
+            shift_row(intermediatea, intermediateb);
+            xor_128(intermediateb, round_key, ciphertext);
+        }
+        else    /* 1 - 9 */
+        {
+            byte_sub(ciphertext, intermediatea);
+            shift_row(intermediatea, intermediateb);
+            mix_column(&intermediateb[0], &intermediatea[0]);
+            mix_column(&intermediateb[4], &intermediatea[4]);
+            mix_column(&intermediateb[8], &intermediatea[8]);
+            mix_column(&intermediateb[12], &intermediatea[12]);
+            xor_128(intermediatea, round_key, ciphertext);
+            next_key(round_key, round);
+        }
+    }
+_func_exit_;	
+}
+
+
+/************************************************/
+/* construct_mic_iv()                           */
+/* Builds the MIC IV from header fields and PN  */
+/* Baron think the function is construct CCM    */
+/* nonce                                        */
+/************************************************/
+static void construct_mic_iv(
+                        u8 *mic_iv,
+                        sint qc_exists,
+                        sint a4_exists,
+                        u8 *mpdu,
+                        uint payload_length,
+                        u8 *pn_vector,
+                        uint frtype// add for CONFIG_IEEE80211W, none 11w also can use
+                        )
+{
+    sint i;
+_func_enter_;	
+    mic_iv[0] = 0x59;
+    if (qc_exists && a4_exists) mic_iv[1] = mpdu[30] & 0x0f;    /* QoS_TC           */
+    if (qc_exists && !a4_exists) mic_iv[1] = mpdu[24] & 0x0f;   /* mute bits 7-4    */
+    if (!qc_exists) mic_iv[1] = 0x00;
+#ifdef CONFIG_IEEE80211W
+	//802.11w management frame should set management bit(4)
+    if(frtype == WIFI_MGT_TYPE)
+		mic_iv[1] |= BIT(4);
+#endif //CONFIG_IEEE80211W
+    for (i = 2; i < 8; i++)
+        mic_iv[i] = mpdu[i + 8];                    /* mic_iv[2:7] = A2[0:5] = mpdu[10:15] */
+    #ifdef CONSISTENT_PN_ORDER
+        for (i = 8; i < 14; i++)
+            mic_iv[i] = pn_vector[i - 8];           /* mic_iv[8:13] = PN[0:5] */
+    #else
+        for (i = 8; i < 14; i++)
+            mic_iv[i] = pn_vector[13 - i];          /* mic_iv[8:13] = PN[5:0] */
+    #endif
+    mic_iv[14] = (unsigned char) (payload_length / 256);
+    mic_iv[15] = (unsigned char) (payload_length % 256);
+_func_exit_;		
+}
+
+
+/************************************************/
+/* construct_mic_header1()                      */
+/* Builds the first MIC header block from       */
+/* header fields.                               */
+/* Build AAD SC,A1,A2                           */
+/************************************************/
+static void construct_mic_header1(
+                        u8 *mic_header1,
+                        sint header_length,
+                        u8 *mpdu,
+                        uint frtype// add for CONFIG_IEEE80211W, none 11w also can use
+                        )
+{
+_func_enter_;	
+    mic_header1[0] = (u8)((header_length - 2) / 256);
+    mic_header1[1] = (u8)((header_length - 2) % 256);
+#ifdef CONFIG_IEEE80211W
+    //802.11w management frame don't AND subtype bits 4,5,6 of frame control field
+    if(frtype == WIFI_MGT_TYPE)
+		mic_header1[2] = mpdu[0];
+	else
+#endif //CONFIG_IEEE80211W
+		mic_header1[2] = mpdu[0] & 0xcf;    /* Mute CF poll & CF ack bits */
+    
+    mic_header1[3] = mpdu[1] & 0xc7;    /* Mute retry, more data and pwr mgt bits */
+    mic_header1[4] = mpdu[4];       /* A1 */
+    mic_header1[5] = mpdu[5];
+    mic_header1[6] = mpdu[6];
+    mic_header1[7] = mpdu[7];
+    mic_header1[8] = mpdu[8];
+    mic_header1[9] = mpdu[9];
+    mic_header1[10] = mpdu[10];     /* A2 */
+    mic_header1[11] = mpdu[11];
+    mic_header1[12] = mpdu[12];
+    mic_header1[13] = mpdu[13];
+    mic_header1[14] = mpdu[14];
+    mic_header1[15] = mpdu[15];
+_func_exit_;	
+}
+
+
+/************************************************/
+/* construct_mic_header2()                      */
+/* Builds the last MIC header block from        */
+/* header fields.                               */
+/************************************************/
+static void construct_mic_header2(
+                u8 *mic_header2,
+                u8 *mpdu,
+                sint a4_exists,
+                sint qc_exists
+                )
+{
+    sint i;
+_func_enter_;	
+    for (i = 0; i<16; i++) mic_header2[i]=0x00;
+
+    mic_header2[0] = mpdu[16];    /* A3 */
+    mic_header2[1] = mpdu[17];
+    mic_header2[2] = mpdu[18];
+    mic_header2[3] = mpdu[19];
+    mic_header2[4] = mpdu[20];
+    mic_header2[5] = mpdu[21];
+
+    //mic_header2[6] = mpdu[22] & 0xf0;   /* SC */
+    mic_header2[6] = 0x00;
+    mic_header2[7] = 0x00; /* mpdu[23]; */
+
+
+    if (!qc_exists && a4_exists)
+    {
+        for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
+
+    }
+
+    if (qc_exists && !a4_exists)
+    {
+        mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */
+        mic_header2[9] = mpdu[25] & 0x00;
+    }
+
+    if (qc_exists && a4_exists)
+    {
+        for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
+
+        mic_header2[14] = mpdu[30] & 0x0f;
+        mic_header2[15] = mpdu[31] & 0x00;
+    }
+
+_func_exit_;	
+}
+
+
+/************************************************/
+/* construct_mic_header2()                      */
+/* Builds the last MIC header block from        */
+/* header fields.                               */
+/* Baron think the function is construct CCM    */
+/* nonce                                        */
+/************************************************/
+static void construct_ctr_preload(
+                        u8 *ctr_preload,
+                        sint a4_exists,
+                        sint qc_exists,
+                        u8 *mpdu,
+                        u8 *pn_vector,
+                        sint c,
+                        uint frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                        )
+{
+    sint i = 0;
+_func_enter_;		
+    for (i=0; i<16; i++) ctr_preload[i] = 0x00;
+    i = 0;
+	
+    ctr_preload[0] = 0x01;                                  /* flag */
+    if (qc_exists && a4_exists) 
+		ctr_preload[1] = mpdu[30] & 0x0f;   /* QoC_Control */
+    if (qc_exists && !a4_exists) 
+		ctr_preload[1] = mpdu[24] & 0x0f;
+#ifdef CONFIG_IEEE80211W
+	//802.11w management frame should set management bit(4)
+	if(frtype == WIFI_MGT_TYPE)
+		ctr_preload[1] |= BIT(4);
+#endif //CONFIG_IEEE80211W
+    for (i = 2; i < 8; i++)
+        ctr_preload[i] = mpdu[i + 8];                       /* ctr_preload[2:7] = A2[0:5] = mpdu[10:15] */
+    #ifdef CONSISTENT_PN_ORDER
+      for (i = 8; i < 14; i++)
+            ctr_preload[i] =    pn_vector[i - 8];           /* ctr_preload[8:13] = PN[0:5] */
+    #else
+      for (i = 8; i < 14; i++)
+            ctr_preload[i] =    pn_vector[13 - i];          /* ctr_preload[8:13] = PN[5:0] */
+    #endif
+    ctr_preload[14] =  (unsigned char) (c / 256); /* Ctr */
+    ctr_preload[15] =  (unsigned char) (c % 256);
+_func_exit_;		
+}
+
+
+/************************************/
+/* bitwise_xor()                    */
+/* A 128 bit, bitwise exclusive or  */
+/************************************/
+static void bitwise_xor(u8 *ina, u8 *inb, u8 *out)
+{
+    sint i;
+_func_enter_;		
+    for (i=0; i<16; i++)
+    {
+        out[i] = ina[i] ^ inb[i];
+    }
+_func_exit_;		
+}
+
+
+static sint aes_cipher(u8 *key, uint	hdrlen,
+			u8 *pframe, uint plen)
+{
+//	/*static*/ unsigned char	message[MAX_MSG_SIZE];
+	uint	qc_exists, a4_exists, i, j, payload_remainder,
+		num_blocks, payload_index;
+
+	u8 pn_vector[6];
+	u8 mic_iv[16];
+	u8 mic_header1[16];
+	u8 mic_header2[16];
+	u8 ctr_preload[16];
+
+	/* Intermediate Buffers */
+	u8 chain_buffer[16];
+	u8 aes_out[16];
+	u8 padded_buffer[16];
+	u8 mic[8];
+//	uint	offset = 0;
+	uint	frtype  = GetFrameType(pframe);
+	uint	frsubtype  = GetFrameSubType(pframe);
+	
+_func_enter_;		
+	frsubtype=frsubtype>>4;
+
+
+	_rtw_memset((void *)mic_iv, 0, 16);
+	_rtw_memset((void *)mic_header1, 0, 16);
+	_rtw_memset((void *)mic_header2, 0, 16);
+	_rtw_memset((void *)ctr_preload, 0, 16);
+	_rtw_memset((void *)chain_buffer, 0, 16);
+	_rtw_memset((void *)aes_out, 0, 16);
+	_rtw_memset((void *)padded_buffer, 0, 16);
+
+	if ((hdrlen == WLAN_HDR_A3_LEN )||(hdrlen ==  WLAN_HDR_A3_QOS_LEN))
+		a4_exists = 0;
+	else
+		a4_exists = 1;
+
+	if (
+		((frtype|frsubtype) == WIFI_DATA_CFACK) ||
+		((frtype|frsubtype) == WIFI_DATA_CFPOLL)||
+		((frtype|frsubtype) == WIFI_DATA_CFACKPOLL))
+		{
+			qc_exists = 1;
+					if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+				 
+					hdrlen += 2;
+			}
+		}
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	else if ((frtype == WIFI_DATA) &&
+		((frsubtype == 0x08) ||
+		(frsubtype == 0x09)||
+		(frsubtype == 0x0a)||
+		(frsubtype == 0x0b)))
+		{
+			if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+				 
+					hdrlen += 2;
+			}
+			qc_exists = 1;
+		}
+	else
+		qc_exists = 0;
+
+	pn_vector[0]=pframe[hdrlen];
+	pn_vector[1]=pframe[hdrlen+1];
+	pn_vector[2]=pframe[hdrlen+4];
+	pn_vector[3]=pframe[hdrlen+5];
+	pn_vector[4]=pframe[hdrlen+6];
+	pn_vector[5]=pframe[hdrlen+7];
+	
+	construct_mic_iv(
+                        mic_iv,
+                        qc_exists,
+                        a4_exists,
+                        pframe,	 //message,
+                        plen,
+                        pn_vector,
+                        frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                        );
+
+    construct_mic_header1(
+                            mic_header1,
+                            hdrlen,
+                            pframe,	//message
+                            frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+    construct_mic_header2(
+                            mic_header2,
+                            pframe,	//message,
+                            a4_exists,
+                            qc_exists
+                            );
+
+
+	payload_remainder = plen % 16;
+    num_blocks = plen / 16;
+
+    /* Find start of payload */
+    payload_index = (hdrlen + 8);
+
+    /* Calculate MIC */
+    aes128k128d(key, mic_iv, aes_out);
+    bitwise_xor(aes_out, mic_header1, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+    bitwise_xor(aes_out, mic_header2, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+
+	for (i = 0; i < num_blocks; i++)
+    {
+        bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);//bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+
+        payload_index += 16;
+        aes128k128d(key, chain_buffer, aes_out);
+    }
+
+    /* Add on the final payload block if it needs padding */
+    if (payload_remainder > 0)
+    {
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = pframe[payload_index++];//padded_buffer[j] = message[payload_index++];
+        }
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        aes128k128d(key, chain_buffer, aes_out);
+
+    }
+
+    for (j = 0 ; j < 8; j++) mic[j] = aes_out[j];
+
+    /* Insert MIC into payload */
+    for (j = 0; j < 8; j++)
+    	pframe[payload_index+j] = mic[j];	//message[payload_index+j] = mic[j];
+
+	payload_index = hdrlen + 8;
+	for (i=0; i< num_blocks; i++)
+    {
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,	//message,
+                                pn_vector,
+                                i+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);//bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+        for (j=0; j<16;j++) pframe[payload_index++] = chain_buffer[j];//for (j=0; j<16;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    if (payload_remainder > 0)          /* If there is a short final block, then pad it,*/
+    {                                   /* encrypt it and copy the unpadded part back   */
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,	//message,
+                                pn_vector,
+                                num_blocks+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = pframe[payload_index+j];//padded_buffer[j] = message[payload_index+j];
+        }
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        for (j=0; j<payload_remainder;j++) pframe[payload_index++] = chain_buffer[j];//for (j=0; j<payload_remainder;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    /* Encrypt the MIC */
+    construct_ctr_preload(
+                        ctr_preload,
+                        a4_exists,
+                        qc_exists,
+                        pframe,	//message,
+                        pn_vector,
+                        0,
+                        frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+    for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+    for (j = 0; j < 8; j++)
+    {
+        padded_buffer[j] = pframe[j+hdrlen+8+plen];//padded_buffer[j] = message[j+hdrlen+8+plen];
+    }
+
+    aes128k128d(key, ctr_preload, aes_out);
+    bitwise_xor(aes_out, padded_buffer, chain_buffer);
+    for (j=0; j<8;j++) pframe[payload_index++] = chain_buffer[j];//for (j=0; j<8;j++) message[payload_index++] = chain_buffer[j];
+_func_exit_;		
+	return _SUCCESS;
+}
+
+
+
+
+u32	rtw_aes_encrypt(_adapter *padapter, u8 *pxmitframe)
+{	// exclude ICV
+
+
+	/*static*/ 
+//	unsigned char	message[MAX_MSG_SIZE];
+
+    	/* Intermediate Buffers */
+	sint 	curfragnum,length;
+	u32	prwskeylen;
+	u8	*pframe,*prwskey;	//, *payload,*iv
+	struct	sta_info		*stainfo=NULL;
+	struct	pkt_attrib	 *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+
+//	uint	offset = 0;
+	u32 res=_SUCCESS;
+_func_enter_;		
+
+	if(((struct xmit_frame*)pxmitframe)->buf_addr==NULL)
+		return _FAIL;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_SIZE +
+		 (((struct xmit_frame*)pxmitframe)->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_OFFSET;
+#endif
+
+	//4 start to encrypt each fragment
+	if((pattrib->encrypt==_AES_)){
+
+		if(pattrib->psta)
+		{
+			stainfo = pattrib->psta;
+		}
+		else
+		{
+			DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+			stainfo=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0] );
+		}	
+		
+		if (stainfo!=NULL){
+
+			if(!(stainfo->state &_FW_LINKED))
+			{
+				DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
+				return _FAIL;
+			}
+			
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_encrypt: stainfo!=NULL!!!\n"));
+
+			if(IS_MCAST(pattrib->ra))
+			{
+				prwskey=psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+			}
+			else
+			{
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+			}
+
+#ifdef CONFIG_TDLS	//swencryption
+			{
+				struct	sta_info		*ptdls_sta;
+				ptdls_sta=rtw_get_stainfo(&padapter->stapriv ,&pattrib->dst[0] );
+				if((ptdls_sta != NULL) && (ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE) )
+				{
+					DBG_871X("[%s] for tdls link\n", __FUNCTION__);
+					prwskey=&ptdls_sta->tpk.tk[0];
+				}
+			}
+#endif //CONFIG_TDLS
+
+			prwskeylen=16;
+	
+			for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++){
+			
+				if((curfragnum+1)==pattrib->nr_frags){	//4 the last fragment
+					length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len- pattrib->icv_len;
+				
+					aes_cipher(prwskey,pattrib->hdrlen,pframe, length);
+				}
+				else{
+					length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len ;
+				
+					aes_cipher(prwskey,pattrib->hdrlen,pframe, length);
+				pframe+=pxmitpriv->frag_len;
+				pframe=(u8*)RND4((SIZE_PTR)(pframe));
+
+				}
+			}
+
+
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_encrypt: stainfo==NULL!!!\n"));
+                        DBG_871X("%s, psta==NUL\n", __func__);
+			res=_FAIL;
+		}
+						
+	}
+
+
+
+_func_exit_;
+		return res;
+}
+
+static sint aes_decipher(u8 *key, uint	hdrlen,
+			u8 *pframe, uint plen)
+{
+	static u8	message[MAX_MSG_SIZE];
+	uint	qc_exists, a4_exists, i, j, payload_remainder,
+			num_blocks, payload_index;
+	sint res = _SUCCESS;
+	u8 pn_vector[6];
+	u8 mic_iv[16];
+	u8 mic_header1[16];
+	u8 mic_header2[16];
+	u8 ctr_preload[16];
+
+    /* Intermediate Buffers */
+	u8 chain_buffer[16];
+	u8 aes_out[16];
+	u8 padded_buffer[16];
+	u8 mic[8];
+
+
+//	uint	offset = 0;
+	uint	frtype  = GetFrameType(pframe);
+	uint	frsubtype  = GetFrameSubType(pframe);
+_func_enter_;			
+	frsubtype=frsubtype>>4;
+
+
+	_rtw_memset((void *)mic_iv, 0, 16);
+	_rtw_memset((void *)mic_header1, 0, 16);
+	_rtw_memset((void *)mic_header2, 0, 16);
+	_rtw_memset((void *)ctr_preload, 0, 16);
+	_rtw_memset((void *)chain_buffer, 0, 16);
+	_rtw_memset((void *)aes_out, 0, 16);
+	_rtw_memset((void *)padded_buffer, 0, 16);
+
+	//start to decrypt the payload
+
+	num_blocks = (plen-8) / 16; //(plen including LLC, payload_length and mic )
+
+	payload_remainder = (plen-8) % 16;
+
+	pn_vector[0]  = pframe[hdrlen];
+	pn_vector[1]  = pframe[hdrlen+1];
+	pn_vector[2]  = pframe[hdrlen+4];
+	pn_vector[3]  = pframe[hdrlen+5];
+	pn_vector[4]  = pframe[hdrlen+6];
+	pn_vector[5]  = pframe[hdrlen+7];
+
+	if ((hdrlen == WLAN_HDR_A3_LEN )||(hdrlen ==  WLAN_HDR_A3_QOS_LEN))
+		a4_exists = 0;
+	else
+		a4_exists = 1;
+
+	if (
+		((frtype|frsubtype) == WIFI_DATA_CFACK) ||
+		((frtype|frsubtype) == WIFI_DATA_CFPOLL)||
+		((frtype|frsubtype) == WIFI_DATA_CFACKPOLL))
+		{
+			qc_exists = 1;
+					if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+				 
+					hdrlen += 2;
+			}
+		}//only for data packet . add for CONFIG_IEEE80211W, none 11w also can use
+	else if ((frtype == WIFI_DATA) &&
+		((frsubtype == 0x08) ||
+		(frsubtype == 0x09)||
+		(frsubtype == 0x0a)||
+		(frsubtype == 0x0b)))
+		{
+			if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+				 
+					hdrlen += 2;
+			}
+			qc_exists = 1;
+		}
+	else
+		qc_exists = 0;
+
+
+	// now, decrypt pframe with hdrlen offset and plen long
+
+	payload_index = hdrlen + 8; // 8 is for extiv
+	
+	for (i=0; i< num_blocks; i++)
+    {
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,
+                                pn_vector,
+                                i+1,
+                                frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
+
+        for (j=0; j<16;j++) pframe[payload_index++] = chain_buffer[j];
+    }
+
+    if (payload_remainder > 0)          /* If there is a short final block, then pad it,*/
+    {                                   /* encrypt it and copy the unpadded part back   */
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,
+                                pn_vector,
+                                num_blocks+1,
+                                frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = pframe[payload_index+j];
+        }
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        for (j=0; j<payload_remainder;j++) pframe[payload_index++] = chain_buffer[j];
+    }
+
+	//start to calculate the mic	
+
+	_rtw_memcpy((void *)message, pframe, (hdrlen +plen+8)); //8 is for ext iv len
+
+
+	pn_vector[0]=pframe[hdrlen];
+	pn_vector[1]=pframe[hdrlen+1];
+	pn_vector[2]=pframe[hdrlen+4];
+	pn_vector[3]=pframe[hdrlen+5];
+	pn_vector[4]=pframe[hdrlen+6];
+	pn_vector[5]=pframe[hdrlen+7];
+
+
+	
+	construct_mic_iv(
+                        mic_iv,
+                        qc_exists,
+                        a4_exists,
+                        message,
+                        plen-8,
+                        pn_vector,
+                        frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                        );
+
+    construct_mic_header1(
+                            mic_header1,
+                            hdrlen,
+                            message,
+                            frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+    construct_mic_header2(
+                            mic_header2,
+                            message,
+                            a4_exists,
+                            qc_exists
+                            );
+
+
+	payload_remainder = (plen-8) % 16;
+    num_blocks = (plen-8) / 16;
+
+    /* Find start of payload */
+    payload_index = (hdrlen + 8);
+
+    /* Calculate MIC */
+    aes128k128d(key, mic_iv, aes_out);
+    bitwise_xor(aes_out, mic_header1, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+    bitwise_xor(aes_out, mic_header2, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+
+	for (i = 0; i < num_blocks; i++)
+    {
+        bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+
+        payload_index += 16;
+        aes128k128d(key, chain_buffer, aes_out);
+    }
+
+    /* Add on the final payload block if it needs padding */
+    if (payload_remainder > 0)
+    {
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = message[payload_index++];
+        }
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        aes128k128d(key, chain_buffer, aes_out);
+
+    }
+
+    for (j = 0 ; j < 8; j++) mic[j] = aes_out[j];
+
+    /* Insert MIC into payload */
+    for (j = 0; j < 8; j++)
+    	message[payload_index+j] = mic[j];
+
+	payload_index = hdrlen + 8;
+	for (i=0; i< num_blocks; i++)
+    {
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                message,
+                                pn_vector,
+                                i+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+        for (j=0; j<16;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    if (payload_remainder > 0)          /* If there is a short final block, then pad it,*/
+    {                                   /* encrypt it and copy the unpadded part back   */
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                message,
+                                pn_vector,
+                                num_blocks+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = message[payload_index+j];
+        }
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        for (j=0; j<payload_remainder;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    /* Encrypt the MIC */
+    construct_ctr_preload(
+                        ctr_preload,
+                        a4_exists,
+                        qc_exists,
+                        message,
+                        pn_vector,
+                        0,
+                        frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+    for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+    for (j = 0; j < 8; j++)
+    {
+        padded_buffer[j] = message[j+hdrlen+8+plen-8];
+    }
+
+    aes128k128d(key, ctr_preload, aes_out);
+    bitwise_xor(aes_out, padded_buffer, chain_buffer);
+    for (j=0; j<8;j++) message[payload_index++] = chain_buffer[j];
+
+	//compare the mic
+	for(i=0;i<8;i++){
+		if(pframe[hdrlen+8+plen-8+i] != message[hdrlen+8+plen-8+i])
+		{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("aes_decipher:mic check error mic[%d]: pframe(%x) != message(%x) \n",
+						i,pframe[hdrlen+8+plen-8+i],message[hdrlen+8+plen-8+i]));
+			DBG_871X("aes_decipher:mic check error mic[%d]: pframe(%x) != message(%x) \n",
+						i,pframe[hdrlen+8+plen-8+i],message[hdrlen+8+plen-8+i]);
+			res = _FAIL;
+		}
+	}
+
+	if(res == _FAIL)
+	{
+		int gg=0;
+		for(gg=0; gg < 32; gg++)
+			DBG_871X(" [%d]=%02x ", gg, pframe[gg]);
+		DBG_871X("error packet header \n");
+	}
+
+_func_exit_;	
+	return res;
+}
+
+u32	rtw_aes_decrypt(_adapter *padapter, u8 *precvframe)
+{	// exclude ICV
+
+
+	/*static*/ 
+//	unsigned char	message[MAX_MSG_SIZE];
+
+
+    	/* Intermediate Buffers */
+
+
+	sint 		length;
+	u8	*pframe,*prwskey;	//, *payload,*iv
+	struct	sta_info		*stainfo;
+	struct	rx_pkt_attrib	 *prxattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+//	struct	recv_priv		*precvpriv=&padapter->recvpriv;
+	u32	res=_SUCCESS;
+_func_enter_;	 
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	//4 start to encrypt each fragment
+	if((prxattrib->encrypt==_AES_)){
+
+		stainfo=rtw_get_stainfo(&padapter->stapriv ,&prxattrib->ta[0] );
+		if (stainfo!=NULL){
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_decrypt: stainfo!=NULL!!!\n"));
+
+			if(IS_MCAST(prxattrib->ra))
+			{
+				//in concurrent we should use sw descrypt in group key, so we remove this message			
+				//DBG_871X("rx bc/mc packets, to perform sw rtw_aes_decrypt\n");
+				//prwskey = psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+				if(psecuritypriv->binstallGrpkey==_FALSE)
+				{
+					res=_FAIL;				
+					DBG_8192C("%s:rx bc/mc packets,but didn't install group key!!!!!!!!!!\n",__FUNCTION__);
+					goto exit;
+				}
+				prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
+
+				if(psecuritypriv->dot118021XGrpKeyid != prxattrib->key_index)
+				{
+					DBG_871X("not match packet_index=%d, install_index=%d \n"
+					, prxattrib->key_index, psecuritypriv->dot118021XGrpKeyid);
+					res=_FAIL;
+					goto exit;
+				}
+			}
+			else
+			{
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+			}
+	
+			length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
+			/*// add for CONFIG_IEEE80211W, debug
+			if(0)
+			printk("@@@@@@@@@@@@@@@@@@ length=%d, prxattrib->hdrlen=%d, prxattrib->pkt_len=%d \n"
+			, length, prxattrib->hdrlen, prxattrib->pkt_len);
+			if(0)
+			{
+				int no;
+				//test print PSK
+				printk("PSK key below:\n");
+				for(no=0;no<16;no++)
+					printk(" %02x ", prwskey[no]);
+				printk("\n");
+			}
+			if(0)
+			{
+				int no;
+				//test print PSK
+				printk("frame:\n");
+				for(no=0;no<prxattrib->pkt_len;no++)
+					printk(" %02x ", pframe[no]);
+				printk("\n");
+			}*/
+
+			res= aes_decipher(prwskey,prxattrib->hdrlen,pframe, length);
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_encrypt: stainfo==NULL!!!\n"));
+			res=_FAIL;
+		}
+						
+	}
+_func_exit_;	
+exit:
+	return res;
+}
+
+#ifdef CONFIG_IEEE80211W
+u32	rtw_BIP_verify(_adapter *padapter, u8 *precvframe)
+{
+	struct rx_pkt_attrib *pattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;
+	u8 *pframe;
+	u8 *BIP_AAD, *p;
+	u32	res=_FAIL;
+	uint len, ori_len;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	u8 mic[16];
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	ori_len = pattrib->pkt_len-WLAN_HDR_A3_LEN+BIP_AAD_SIZE;
+	BIP_AAD = rtw_zmalloc(ori_len);
+	
+	if(BIP_AAD == NULL)
+	{
+		DBG_871X("BIP AAD allocate fail\n");
+		return _FAIL;
+	}
+	//PKT start
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	//mapping to wlan header
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	//save the frame body + MME
+	_rtw_memcpy(BIP_AAD+BIP_AAD_SIZE, pframe+WLAN_HDR_A3_LEN, pattrib->pkt_len-WLAN_HDR_A3_LEN);
+	//find MME IE pointer
+	p = rtw_get_ie(BIP_AAD+BIP_AAD_SIZE, _MME_IE_, &len, pattrib->pkt_len-WLAN_HDR_A3_LEN);
+	//Baron
+	if(p)
+	{
+		u16 keyid=0;
+		u64 temp_ipn=0;
+		//save packet number
+		_rtw_memcpy(&temp_ipn, p+4, 6);
+		temp_ipn = le64_to_cpu(temp_ipn);
+		//BIP packet number should bigger than previous BIP packet
+		if(temp_ipn <= pmlmeext->mgnt_80211w_IPN_rx)
+		{
+			DBG_871X("replay BIP packet\n");
+			goto BIP_exit;
+		}
+		//copy key index
+		_rtw_memcpy(&keyid, p+2, 2);
+		keyid = le16_to_cpu(keyid);
+		if(keyid != padapter->securitypriv.dot11wBIPKeyid)
+		{
+			DBG_871X("BIP key index error!\n");
+			goto BIP_exit;
+		}
+		//clear the MIC field of MME to zero
+		_rtw_memset(p+2+len-8, 0, 8);
+		
+		//conscruct AAD, copy frame control field
+		_rtw_memcpy(BIP_AAD, &pwlanhdr->frame_ctl, 2);
+		ClearRetry(BIP_AAD);
+		ClearPwrMgt(BIP_AAD);
+		ClearMData(BIP_AAD);
+		//conscruct AAD, copy address 1 to address 3
+		_rtw_memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
+		
+		if(omac1_aes_128(padapter->securitypriv.dot11wBIPKey[padapter->securitypriv.dot11wBIPKeyid].skey
+			, BIP_AAD, ori_len, mic))
+			goto BIP_exit;
+		
+		/*//management packet content
+		{
+			int pp;
+			DBG_871X("pkt: ");
+			for(pp=0;pp< pattrib->pkt_len; pp++)
+				printk(" %02x ", pframe[pp]);
+			DBG_871X("\n");
+			//BIP AAD + management frame body + MME(MIC is zero)
+			DBG_871X("AAD+PKT: ");
+			for(pp=0;pp< ori_len; pp++)
+				DBG_871X(" %02x ", BIP_AAD[pp]);
+			DBG_871X("\n");
+			//show the MIC result
+			DBG_871X("mic: ");
+			for(pp=0;pp<16; pp++)
+				DBG_871X(" %02x ", mic[pp]);
+			DBG_871X("\n");
+		}
+		*/
+		//MIC field should be last 8 bytes of packet (packet without FCS)
+		if(_rtw_memcmp(mic, pframe+pattrib->pkt_len-8, 8))
+		{
+			pmlmeext->mgnt_80211w_IPN_rx = temp_ipn;
+			res=_SUCCESS;
+		}
+		else
+			DBG_871X("BIP MIC error!\n");
+		
+	}
+	else
+		res = RTW_RX_HANDLED;
+BIP_exit:
+
+	rtw_mfree(BIP_AAD, ori_len);
+	return res;
+}
+#endif //CONFIG_IEEE80211W
+
+#ifndef PLATFORM_FREEBSD
+/* compress 512-bits */
+static int sha256_compress(struct sha256_state *md, unsigned char *buf)
+{
+	u32 S[8], W[64], t0, t1;
+	u32 t;
+	int i;
+
+	/* copy state into S */
+	for (i = 0; i < 8; i++) {
+		S[i] = md->state[i];
+	}
+
+	/* copy the state into 512-bits into W[0..15] */
+	for (i = 0; i < 16; i++)
+		W[i] = WPA_GET_BE32(buf + (4 * i));
+
+	/* fill W[16..63] */
+	for (i = 16; i < 64; i++) {
+		W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) +
+			W[i - 16];
+	}        
+
+	/* Compress */
+#define RND(a,b,c,d,e,f,g,h,i)                          \
+	t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];	\
+	t1 = Sigma0(a) + Maj(a, b, c);			\
+	d += t0;					\
+	h  = t0 + t1;
+
+	for (i = 0; i < 64; ++i) {
+		RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i);
+		t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4]; 
+		S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
+	}
+
+	/* feedback */
+	for (i = 0; i < 8; i++) {
+		md->state[i] = md->state[i] + S[i];
+	}
+	return 0;
+}
+
+/* Initialize the hash state */
+static void sha256_init(struct sha256_state *md)
+{
+	md->curlen = 0;
+	md->length = 0;
+	md->state[0] = 0x6A09E667UL;
+	md->state[1] = 0xBB67AE85UL;
+	md->state[2] = 0x3C6EF372UL;
+	md->state[3] = 0xA54FF53AUL;
+	md->state[4] = 0x510E527FUL;
+	md->state[5] = 0x9B05688CUL;
+	md->state[6] = 0x1F83D9ABUL;
+	md->state[7] = 0x5BE0CD19UL;
+}
+
+/**
+   Process a block of memory though the hash
+   @param md     The hash state
+   @param in     The data to hash
+   @param inlen  The length of the data (octets)
+   @return CRYPT_OK if successful
+*/
+static int sha256_process(struct sha256_state *md, unsigned char *in,
+			  unsigned long inlen)
+{
+	unsigned long n;
+#define block_size 64
+
+	if (md->curlen > sizeof(md->buf))
+		return -1;
+
+	while (inlen > 0) {
+		if (md->curlen == 0 && inlen >= block_size) {
+			if (sha256_compress(md, (unsigned char *) in) < 0)
+				return -1;
+			md->length += block_size * 8;
+			in += block_size;
+			inlen -= block_size;
+		} else {
+			n = MIN(inlen, (block_size - md->curlen));
+			_rtw_memcpy(md->buf + md->curlen, in, n);
+			md->curlen += n;
+			in += n;
+			inlen -= n;
+			if (md->curlen == block_size) {
+				if (sha256_compress(md, md->buf) < 0)
+					return -1;
+				md->length += 8 * block_size;
+				md->curlen = 0;
+			}
+		}
+	}
+
+	return 0;
+}
+
+
+/**
+   Terminate the hash to get the digest
+   @param md  The hash state
+   @param out [out] The destination of the hash (32 bytes)
+   @return CRYPT_OK if successful
+*/
+static int sha256_done(struct sha256_state *md, unsigned char *out)
+{
+	int i;
+
+	if (md->curlen >= sizeof(md->buf))
+		return -1;
+
+	/* increase the length of the message */
+	md->length += md->curlen * 8;
+
+	/* append the '1' bit */
+	md->buf[md->curlen++] = (unsigned char) 0x80;
+
+	/* if the length is currently above 56 bytes we append zeros
+	 * then compress.  Then we can fall back to padding zeros and length
+	 * encoding like normal.
+	 */
+	if (md->curlen > 56) {
+		while (md->curlen < 64) {
+			md->buf[md->curlen++] = (unsigned char) 0;
+		}
+		sha256_compress(md, md->buf);
+		md->curlen = 0;
+	}
+
+	/* pad upto 56 bytes of zeroes */
+	while (md->curlen < 56) {
+		md->buf[md->curlen++] = (unsigned char) 0;
+	}
+
+	/* store length */
+	WPA_PUT_BE64(md->buf + 56, md->length);
+	sha256_compress(md, md->buf);
+
+	/* copy output */
+	for (i = 0; i < 8; i++)
+		WPA_PUT_BE32(out + (4 * i), md->state[i]);
+
+	return 0;
+}
+
+/**
+ * sha256_vector - SHA256 hash for data vector
+ * @num_elem: Number of elements in the data vector
+ * @addr: Pointers to the data areas
+ * @len: Lengths of the data blocks
+ * @mac: Buffer for the hash
+ * Returns: 0 on success, -1 of failure
+ */
+static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len,
+		  u8 *mac)
+{
+	struct sha256_state ctx;
+	size_t i;
+
+	sha256_init(&ctx);
+	for (i = 0; i < num_elem; i++)
+		if (sha256_process(&ctx, addr[i], len[i]))
+			return -1;
+	if (sha256_done(&ctx, mac))
+		return -1;
+	return 0;
+}
+
+static u8 os_strlen(const char *s)
+{
+	const char *p = s;
+	while (*p)
+		p++;
+	return p - s;
+}
+
+static int os_memcmp(void *s1, void *s2, u8 n)
+{
+	unsigned char *p1 = s1, *p2 = s2;
+
+	if (n == 0)
+		return 0;
+
+	while (*p1 == *p2) {
+		p1++;
+		p2++;
+		n--;
+		if (n == 0)
+			return 0;
+	}
+
+	return *p1 - *p2;
+}
+
+/**
+ * hmac_sha256_vector - HMAC-SHA256 over data vector (RFC 2104)
+ * @key: Key for HMAC operations
+ * @key_len: Length of the key in bytes
+ * @num_elem: Number of elements in the data vector
+ * @addr: Pointers to the data areas
+ * @len: Lengths of the data blocks
+ * @mac: Buffer for the hash (32 bytes)
+ */
+static void hmac_sha256_vector(u8 *key, size_t key_len, size_t num_elem,
+			u8 *addr[], size_t *len, u8 *mac)
+{
+	unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */
+	unsigned char tk[32];
+	u8 *_addr[6];
+	size_t _len[6], i;
+
+	if (num_elem > 5) {
+		/*
+		 * Fixed limit on the number of fragments to avoid having to
+		 * allocate memory (which could fail).
+		 */
+		return;
+	}
+
+        /* if key is longer than 64 bytes reset it to key = SHA256(key) */
+        if (key_len > 64) {
+		sha256_vector(1, &key, &key_len, tk);
+		key = tk;
+		key_len = 32;
+        }
+
+	/* the HMAC_SHA256 transform looks like:
+	 *
+	 * SHA256(K XOR opad, SHA256(K XOR ipad, text))
+	 *
+	 * where K is an n byte key
+	 * ipad is the byte 0x36 repeated 64 times
+	 * opad is the byte 0x5c repeated 64 times
+	 * and text is the data being protected */
+
+	/* start out by storing key in ipad */
+	_rtw_memset(k_pad, 0, sizeof(k_pad));
+	_rtw_memcpy(k_pad, key, key_len);
+	/* XOR key with ipad values */
+	for (i = 0; i < 64; i++)
+		k_pad[i] ^= 0x36;
+
+	/* perform inner SHA256 */
+	_addr[0] = k_pad;
+	_len[0] = 64;
+	for (i = 0; i < num_elem; i++) {
+		_addr[i + 1] = addr[i];
+		_len[i + 1] = len[i];
+	}
+	sha256_vector(1 + num_elem, _addr, _len, mac);
+
+	_rtw_memset(k_pad, 0, sizeof(k_pad));
+	_rtw_memcpy(k_pad, key, key_len);
+	/* XOR key with opad values */
+	for (i = 0; i < 64; i++)
+		k_pad[i] ^= 0x5c;
+
+	/* perform outer SHA256 */
+	_addr[0] = k_pad;
+	_len[0] = 64;
+	_addr[1] = mac;
+	_len[1] = 32;
+	sha256_vector(2, _addr, _len, mac);
+}
+#endif //PLATFORM_FREEBSD
+/**
+ * sha256_prf - SHA256-based Pseudo-Random Function (IEEE 802.11r, 8.5.1.5.2)
+ * @key: Key for PRF
+ * @key_len: Length of the key in bytes
+ * @label: A unique label for each purpose of the PRF
+ * @data: Extra data to bind into the key
+ * @data_len: Length of the data
+ * @buf: Buffer for the generated pseudo-random key
+ * @buf_len: Number of bytes of key to generate
+ *
+ * This function is used to derive new, cryptographically separate keys from a
+ * given key.
+ */
+#ifndef PLATFORM_FREEBSD //Baron
+static void sha256_prf(u8 *key, size_t key_len, char *label,
+		u8 *data, size_t data_len, u8 *buf, size_t buf_len)
+{
+	u16 counter = 1;
+	size_t pos, plen;
+	u8 hash[SHA256_MAC_LEN];
+	u8 *addr[4];
+	size_t len[4];
+	u8 counter_le[2], length_le[2];
+
+	addr[0] = counter_le;
+	len[0] = 2;
+	addr[1] = (u8 *) label;
+	len[1] = os_strlen(label);
+	addr[2] = data;
+	len[2] = data_len;
+	addr[3] = length_le;
+	len[3] = sizeof(length_le);
+
+	WPA_PUT_LE16(length_le, buf_len * 8);
+	pos = 0;
+	while (pos < buf_len) {
+		plen = buf_len - pos;
+		WPA_PUT_LE16(counter_le, counter);
+		if (plen >= SHA256_MAC_LEN) {
+			hmac_sha256_vector(key, key_len, 4, addr, len,
+					   &buf[pos]);
+			pos += SHA256_MAC_LEN;
+		} else {
+			hmac_sha256_vector(key, key_len, 4, addr, len, hash);
+			_rtw_memcpy(&buf[pos], hash, plen);
+			break;
+		}
+		counter++;
+	}
+}
+#endif //PLATFORM_FREEBSD Baron
+
+/* AES tables*/
+const u32 Te0[256] = {
+    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
+    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
+    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
+    0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
+    0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
+    0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
+    0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
+    0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
+    0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
+    0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
+    0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
+    0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
+    0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
+    0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
+    0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
+    0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
+    0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
+    0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
+    0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
+    0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
+    0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
+    0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
+    0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
+    0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
+    0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
+    0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
+    0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
+    0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
+    0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
+    0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
+    0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
+    0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
+    0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
+    0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
+    0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
+    0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
+    0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
+    0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
+    0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
+    0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
+    0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
+    0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
+    0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
+    0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
+    0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
+    0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
+    0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
+    0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
+    0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
+    0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
+    0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
+    0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
+    0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
+    0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
+    0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
+    0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
+    0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
+    0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
+    0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
+    0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
+    0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
+    0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
+    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
+    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
+};
+const u32 Td0[256] = {
+    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
+    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
+    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
+    0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
+    0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
+    0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
+    0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
+    0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
+    0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
+    0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
+    0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
+    0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
+    0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
+    0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
+    0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
+    0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
+    0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
+    0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
+    0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
+    0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
+    0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
+    0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
+    0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
+    0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
+    0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
+    0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
+    0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
+    0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
+    0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
+    0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
+    0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
+    0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
+    0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
+    0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
+    0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
+    0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
+    0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
+    0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
+    0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
+    0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
+    0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
+    0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
+    0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
+    0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
+    0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
+    0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
+    0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
+    0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
+    0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
+    0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
+    0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
+    0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
+    0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
+    0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
+    0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
+    0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
+    0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
+    0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
+    0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
+    0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
+    0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
+    0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
+    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
+    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
+};
+const u8 Td4s[256] = {
+    0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
+    0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
+    0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
+    0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
+    0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
+    0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
+    0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
+    0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
+    0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
+    0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
+    0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
+    0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
+    0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
+    0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
+    0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
+    0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
+    0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
+    0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
+    0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
+    0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
+    0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
+    0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
+    0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
+    0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
+    0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
+    0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
+    0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
+    0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
+    0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
+    0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
+    0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
+    0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
+};
+const u8 rcons[] = {
+	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
+	/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+};
+
+/**
+ * Expand the cipher key into the encryption key schedule.
+ *
+ * @return	the number of rounds for the given cipher key size.
+ */
+#ifndef PLATFORM_FREEBSD //Baron
+static void rijndaelKeySetupEnc(u32 rk[/*44*/], const u8 cipherKey[])
+{
+	int i;
+	u32 temp;
+
+	rk[0] = GETU32(cipherKey     );
+	rk[1] = GETU32(cipherKey +  4);
+	rk[2] = GETU32(cipherKey +  8);
+	rk[3] = GETU32(cipherKey + 12);
+	for (i = 0; i < 10; i++) {
+		temp  = rk[3];
+		rk[4] = rk[0] ^
+			TE421(temp) ^ TE432(temp) ^ TE443(temp) ^ TE414(temp) ^
+			RCON(i);
+		rk[5] = rk[1] ^ rk[4];
+		rk[6] = rk[2] ^ rk[5];
+		rk[7] = rk[3] ^ rk[6];
+		rk += 4;
+	}
+}
+
+static void rijndaelEncrypt(u32 rk[/*44*/], u8 pt[16], u8 ct[16])
+{
+	u32 s0, s1, s2, s3, t0, t1, t2, t3;
+	int Nr = 10;
+#ifndef FULL_UNROLL
+	int r;
+#endif /* ?FULL_UNROLL */
+
+	/*
+	 * map byte array block to cipher state
+	 * and add initial round key:
+	 */
+	s0 = GETU32(pt     ) ^ rk[0];
+	s1 = GETU32(pt +  4) ^ rk[1];
+	s2 = GETU32(pt +  8) ^ rk[2];
+	s3 = GETU32(pt + 12) ^ rk[3];
+
+#define ROUND(i,d,s) \
+d##0 = TE0(s##0) ^ TE1(s##1) ^ TE2(s##2) ^ TE3(s##3) ^ rk[4 * i]; \
+d##1 = TE0(s##1) ^ TE1(s##2) ^ TE2(s##3) ^ TE3(s##0) ^ rk[4 * i + 1]; \
+d##2 = TE0(s##2) ^ TE1(s##3) ^ TE2(s##0) ^ TE3(s##1) ^ rk[4 * i + 2]; \
+d##3 = TE0(s##3) ^ TE1(s##0) ^ TE2(s##1) ^ TE3(s##2) ^ rk[4 * i + 3]
+
+#ifdef FULL_UNROLL
+
+	ROUND(1,t,s);
+	ROUND(2,s,t);
+	ROUND(3,t,s);
+	ROUND(4,s,t);
+	ROUND(5,t,s);
+	ROUND(6,s,t);
+	ROUND(7,t,s);
+	ROUND(8,s,t);
+	ROUND(9,t,s);
+
+	rk += Nr << 2;
+
+#else  /* !FULL_UNROLL */
+
+	/* Nr - 1 full rounds: */
+	r = Nr >> 1;
+	for (;;) {
+		ROUND(1,t,s);
+		rk += 8;
+		if (--r == 0)
+			break;
+		ROUND(0,s,t);
+	}
+
+#endif /* ?FULL_UNROLL */
+
+#undef ROUND
+
+	/*
+	 * apply last round and
+	 * map cipher state to byte array block:
+	 */
+	s0 = TE41(t0) ^ TE42(t1) ^ TE43(t2) ^ TE44(t3) ^ rk[0];
+	PUTU32(ct     , s0);
+	s1 = TE41(t1) ^ TE42(t2) ^ TE43(t3) ^ TE44(t0) ^ rk[1];
+	PUTU32(ct +  4, s1);
+	s2 = TE41(t2) ^ TE42(t3) ^ TE43(t0) ^ TE44(t1) ^ rk[2];
+	PUTU32(ct +  8, s2);
+	s3 = TE41(t3) ^ TE42(t0) ^ TE43(t1) ^ TE44(t2) ^ rk[3];
+	PUTU32(ct + 12, s3);
+}
+
+static void * aes_encrypt_init(u8 *key, size_t len)
+{
+	u32 *rk;
+	if (len != 16)
+		return NULL;
+	rk = (u32*)rtw_malloc(AES_PRIV_SIZE);
+	if (rk == NULL)
+		return NULL;
+	rijndaelKeySetupEnc(rk, key);
+	return rk;
+}
+
+static void aes_128_encrypt(void *ctx, u8 *plain, u8 *crypt)
+{
+	rijndaelEncrypt(ctx, plain, crypt);
+}
+
+
+static void gf_mulx(u8 *pad)
+{
+	int i, carry;
+
+	carry = pad[0] & 0x80;
+	for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
+		pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
+	pad[AES_BLOCK_SIZE - 1] <<= 1;
+	if (carry)
+		pad[AES_BLOCK_SIZE - 1] ^= 0x87;
+}
+
+static void aes_encrypt_deinit(void *ctx)
+{
+	_rtw_memset(ctx, 0, AES_PRIV_SIZE);
+	rtw_mfree(ctx, AES_PRIV_SIZE);
+}
+
+
+/**
+ * omac1_aes_128_vector - One-Key CBC MAC (OMAC1) hash with AES-128
+ * @key: 128-bit key for the hash operation
+ * @num_elem: Number of elements in the data vector
+ * @addr: Pointers to the data areas
+ * @len: Lengths of the data blocks
+ * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
+ * Returns: 0 on success, -1 on failure
+ *
+ * This is a mode for using block cipher (AES in this case) for authentication.
+ * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
+ * (SP) 800-38B.
+ */
+static int omac1_aes_128_vector(u8 *key, size_t num_elem,
+							 u8 *addr[], size_t *len, u8 *mac)
+{
+	void *ctx;
+	u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
+	u8 *pos, *end;
+	size_t i, e, left, total_len;
+
+	ctx = aes_encrypt_init(key, 16);
+	if (ctx == NULL)
+		return -1;
+	_rtw_memset(cbc, 0, AES_BLOCK_SIZE);
+
+	total_len = 0;
+	for (e = 0; e < num_elem; e++)
+		total_len += len[e];
+	left = total_len;
+
+	e = 0;
+	pos = addr[0];
+	end = pos + len[0];
+
+	while (left >= AES_BLOCK_SIZE) {
+		for (i = 0; i < AES_BLOCK_SIZE; i++) {
+			cbc[i] ^= *pos++;
+			if (pos >= end) {
+				e++;
+				pos = addr[e];
+				end = pos + len[e];
+			}
+		}
+		if (left > AES_BLOCK_SIZE)
+			aes_128_encrypt(ctx, cbc, cbc);
+		left -= AES_BLOCK_SIZE;
+	}
+
+	_rtw_memset(pad, 0, AES_BLOCK_SIZE);
+	aes_128_encrypt(ctx, pad, pad);
+	gf_mulx(pad);
+
+	if (left || total_len == 0) {
+		for (i = 0; i < left; i++) {
+			cbc[i] ^= *pos++;
+			if (pos >= end) {
+				e++;
+				pos = addr[e];
+				end = pos + len[e];
+			}
+		}
+		cbc[left] ^= 0x80;
+		gf_mulx(pad);
+	}
+
+	for (i = 0; i < AES_BLOCK_SIZE; i++)
+		pad[i] ^= cbc[i];
+	aes_128_encrypt(ctx, pad, mac);
+	aes_encrypt_deinit(ctx);
+	return 0;
+}
+
+
+/**
+ * omac1_aes_128 - One-Key CBC MAC (OMAC1) hash with AES-128 (aka AES-CMAC)
+ * @key: 128-bit key for the hash operation
+ * @data: Data buffer for which a MAC is determined
+ * @data_len: Length of data buffer in bytes
+ * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
+ * Returns: 0 on success, -1 on failure
+ *
+ * This is a mode for using block cipher (AES in this case) for authentication.
+ * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
+ * (SP) 800-38B.
+ */ //modify for CONFIG_IEEE80211W
+int omac1_aes_128(u8 *key, u8 *data, size_t data_len, u8 *mac)
+{
+	return omac1_aes_128_vector(key, 1, &data, &data_len, mac);
+}
+#endif //PLATFORM_FREEBSD Baron
+
+#ifdef CONFIG_TDLS
+void wpa_tdls_generate_tpk(_adapter *padapter, struct sta_info *psta)
+{
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	u8 *SNonce = psta->SNonce;
+	u8 *ANonce = psta->ANonce;
+
+	u8 key_input[SHA256_MAC_LEN];
+	u8 *nonce[2];
+	size_t len[2];
+	u8 data[3 * ETH_ALEN];
+
+	/* IEEE Std 802.11z-2010 8.5.9.1:
+	 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce))
+	 */
+	len[0] = 32;
+	len[1] = 32;
+	if (os_memcmp(SNonce, ANonce, 32) < 0) {
+		nonce[0] = SNonce;
+		nonce[1] = ANonce;
+	} else {
+		nonce[0] = ANonce;
+		nonce[1] = SNonce;
+	}
+
+	sha256_vector(2, nonce, len, key_input);
+
+	/*
+	 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK",
+	 *	min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY)
+	 * TODO: is N_KEY really included in KDF Context and if so, in which
+	 * presentation format (little endian 16-bit?) is it used? It gets
+	 * added by the KDF anyway..
+	 */
+
+	if (os_memcmp(myid(&(padapter->eeprompriv)), psta->hwaddr, ETH_ALEN) < 0) {
+		_rtw_memcpy(data, myid(&(padapter->eeprompriv)), ETH_ALEN);
+		_rtw_memcpy(data + ETH_ALEN, psta->hwaddr, ETH_ALEN);
+	} else {
+		_rtw_memcpy(data, psta->hwaddr, ETH_ALEN);
+		_rtw_memcpy(data + ETH_ALEN, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	}
+	_rtw_memcpy(data + 2 * ETH_ALEN, get_bssid(pmlmepriv), ETH_ALEN);
+
+	sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), (u8 *) &psta->tpk, sizeof(psta->tpk));	
+
+
+}
+
+/**
+ * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
+ * @kck: TPK-KCK
+ * @lnkid: Pointer to the beginning of Link Identifier IE
+ * @rsnie: Pointer to the beginning of RSN IE used for handshake
+ * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
+ * @ftie: Pointer to the beginning of FT IE
+ * @mic: Pointer for writing MIC
+ *
+ * Calculate MIC for TDLS frame.
+ */
+int wpa_tdls_ftie_mic(u8 *kck, u8 trans_seq, 
+							u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie,
+							u8 *mic)
+{
+	u8 *buf, *pos;
+	struct wpa_tdls_ftie *_ftie;
+	struct wpa_tdls_lnkid *_lnkid;
+	int ret;
+	int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
+		2 + timeoutie[1] + 2 + ftie[1];
+	buf = rtw_zmalloc(len);
+	if (!buf) {
+		DBG_871X("TDLS: No memory for MIC calculation\n");
+		return -1;
+	}
+
+	pos = buf;
+	_lnkid = (struct wpa_tdls_lnkid *) lnkid;
+	/* 1) TDLS initiator STA MAC address */
+	_rtw_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 2) TDLS responder STA MAC address */
+	_rtw_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 3) Transaction Sequence number */
+	*pos++ = trans_seq;
+	/* 4) Link Identifier IE */
+	_rtw_memcpy(pos, lnkid, 2 + lnkid[1]);
+	pos += 2 + lnkid[1];
+	/* 5) RSN IE */
+	_rtw_memcpy(pos, rsnie, 2 + rsnie[1]);
+	pos += 2 + rsnie[1];
+	/* 6) Timeout Interval IE */
+	_rtw_memcpy(pos, timeoutie, 2 + timeoutie[1]);
+	pos += 2 + timeoutie[1];
+	/* 7) FTIE, with the MIC field of the FTIE set to 0 */
+	_rtw_memcpy(pos, ftie, 2 + ftie[1]);
+	_ftie = (struct wpa_tdls_ftie *) pos;
+	_rtw_memset(_ftie->mic, 0, TDLS_MIC_LEN);
+	pos += 2 + ftie[1];
+ 
+	ret = omac1_aes_128(kck, buf, pos - buf, mic);
+	rtw_mfree(buf, len);
+	return ret;
+
+}
+
+int tdls_verify_mic(u8 *kck, u8 trans_seq,
+							u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie)
+{
+	u8 *buf, *pos;
+	int len;
+	u8 mic[16];
+	int ret;
+	u8 *rx_ftie, *tmp_ftie;
+
+	if (lnkid == NULL || rsnie == NULL ||
+	    timeoutie == NULL || ftie == NULL){
+		return 0;
+	}
+	
+	len = 2 * ETH_ALEN + 1 + 2 + 18 + 2 + *(rsnie+1) + 2 + *(timeoutie+1) + 2 + *(ftie+1);
+
+	buf = rtw_zmalloc(len);
+	if (buf == NULL)
+		return 0;
+
+	pos = buf;
+	/* 1) TDLS initiator STA MAC address */
+	_rtw_memcpy(pos, lnkid + ETH_ALEN + 2, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 2) TDLS responder STA MAC address */
+	_rtw_memcpy(pos, lnkid + 2 * ETH_ALEN + 2, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 3) Transaction Sequence number */
+	*pos++ = trans_seq;
+	/* 4) Link Identifier IE */
+	_rtw_memcpy(pos, lnkid, 2 + 18);
+	pos += 2 + 18;
+	/* 5) RSN IE */
+	_rtw_memcpy(pos, rsnie, 2 + *(rsnie+1));
+	pos += 2 + *(rsnie+1);
+	/* 6) Timeout Interval IE */
+	_rtw_memcpy(pos, timeoutie, 2 + *(timeoutie+1));
+	pos += 2 + *(timeoutie+1);
+	/* 7) FTIE, with the MIC field of the FTIE set to 0 */
+	_rtw_memcpy(pos, ftie, 2 + *(ftie+1));
+	pos += 2;
+	tmp_ftie = (u8 *) (pos+2);
+	_rtw_memset(tmp_ftie, 0, 16);
+	pos += *(ftie+1);
+
+	ret = omac1_aes_128(kck, buf, pos - buf, mic);
+	rtw_mfree(buf, len);
+	if (ret)
+		return 0;
+	rx_ftie = ftie+4;
+
+	if (os_memcmp(mic, rx_ftie, 16) == 0) {
+		//Valid MIC
+		return 1;
+	}
+
+	//Invalid MIC
+	DBG_871X( "[%s] Invalid MIC\n", __FUNCTION__);
+	return 0;
+
+}
+#endif //CONFIG_TDLS
+
+#ifdef PLATFORM_WINDOWS
+void rtw_use_tkipkey_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	)
+#endif
+#ifdef PLATFORM_LINUX
+void rtw_use_tkipkey_handler(void *FunctionContext)
+#endif
+#ifdef PLATFORM_FREEBSD
+void rtw_use_tkipkey_handler(void *FunctionContext)
+#endif
+{
+        _adapter *padapter = (_adapter *)FunctionContext;
+
+
+_func_enter_;			
+
+	RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("^^^rtw_use_tkipkey_handler ^^^\n"));
+	
+/*
+	if(padapter->bDriverStopped ||padapter->bSurpriseRemoved){
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("^^^rtw_use_tkipkey_handler (padapter->bDriverStopped %d)(padapter->bSurpriseRemoved %d)^^^\n",padapter->bDriverStopped,padapter->bSurpriseRemoved));
+
+		return;
+	}
+	*/
+	
+	padapter->securitypriv.busetkipkey=_TRUE;
+
+	RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("^^^rtw_use_tkipkey_handler padapter->securitypriv.busetkipkey=%d^^^\n",padapter->securitypriv.busetkipkey));
+
+_func_exit_;	
+
+}
+
+/* Restore HW wep key setting according to key_mask */
+void rtw_sec_restore_wep_key(_adapter *adapter)
+{
+	struct security_priv* securitypriv=&(adapter->securitypriv);
+	sint keyid;
+
+	if((_WEP40_ == securitypriv->dot11PrivacyAlgrthm) ||(_WEP104_ == securitypriv->dot11PrivacyAlgrthm)) {
+		for(keyid=0;keyid<4;keyid++){
+			if(securitypriv->key_mask & BIT(keyid)){
+				if(keyid == securitypriv->dot11PrivacyKeyIndex)
+					rtw_set_key(adapter,securitypriv, keyid, 1);
+				else
+					rtw_set_key(adapter,securitypriv, keyid, 0);
+			}
+		}
+	}
+}
+
+u8 rtw_handle_tkip_countermeasure(_adapter* adapter, const char *caller)
+{
+	struct security_priv* securitypriv=&(adapter->securitypriv);
+	u8 status = _SUCCESS;
+
+	if (securitypriv->btkip_countermeasure == _TRUE) {
+		u32 passing_ms = rtw_get_passing_time_ms(securitypriv->btkip_countermeasure_time);
+		if (passing_ms > 60*1000) {
+			LOG_LEVEL(_drv_info_, "%s("ADPT_FMT") countermeasure time:%ds > 60s \n",
+				caller, ADPT_ARG(adapter), passing_ms/1000);
+			securitypriv->btkip_countermeasure = _FALSE;
+			securitypriv->btkip_countermeasure_time = 0;
+		} else {
+			LOG_LEVEL(_drv_warning_, "%s("ADPT_FMT") countermeasure time:%ds < 60s \n",
+				caller, ADPT_ARG(adapter), passing_ms/1000);
+			status = _FAIL;
+		}
+	}
+
+	return status;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c
new file mode 100755
index 0000000000000..e08b1f7397354
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c
@@ -0,0 +1,352 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include<rtw_sreset.h>
+
+void sreset_init_value(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	_rtw_mutex_init(&psrtpriv->silentreset_mutex);
+	psrtpriv->silent_reset_inprogress = _FALSE;
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+	psrtpriv->last_tx_time =0;
+	psrtpriv->last_tx_complete_time =0;
+#endif
+}
+void sreset_reset_value(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	psrtpriv->silent_reset_inprogress = _FALSE;
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+	psrtpriv->last_tx_time =0;
+	psrtpriv->last_tx_complete_time =0;
+#endif
+}
+
+u8 sreset_get_wifi_status(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	u8 status = WIFI_STATUS_SUCCESS;
+	u32 val32 = 0;
+	_irqL irqL;
+	if(psrtpriv->silent_reset_inprogress == _TRUE)
+        {
+		return status;
+	}
+	val32 =rtw_read32(padapter,REG_TXDMA_STATUS);
+	if(val32==0xeaeaeaea){
+		psrtpriv->Wifi_Error_Status = WIFI_IF_NOT_EXIST;
+	}
+	else if(val32!=0){
+		DBG_8192C("txdmastatu(%x)\n",val32);
+		psrtpriv->Wifi_Error_Status = WIFI_MAC_TXDMA_ERROR;
+	}
+
+	if(WIFI_STATUS_SUCCESS !=psrtpriv->Wifi_Error_Status)
+	{
+		DBG_8192C("==>%s error_status(0x%x) \n",__FUNCTION__,psrtpriv->Wifi_Error_Status);
+		status = (psrtpriv->Wifi_Error_Status &( ~(USB_READ_PORT_FAIL|USB_WRITE_PORT_FAIL)));
+	}
+	DBG_8192C("==> %s wifi_status(0x%x)\n",__FUNCTION__,status);
+
+	//status restore
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+
+	return status;
+#else
+	return WIFI_STATUS_SUCCESS;
+#endif
+}
+
+void sreset_set_wifi_error_status(_adapter *padapter, u32 status)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	pHalData->srestpriv.Wifi_Error_Status = status;
+#endif
+}
+
+void sreset_set_trigger_point(_adapter *padapter, s32 tgp)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	pHalData->srestpriv.dbg_trigger_point = tgp;
+#endif
+}
+
+bool sreset_inprogress(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_RESET)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	return pHalData->srestpriv.silent_reset_inprogress;
+#else
+	return _FALSE;
+#endif
+}
+
+void sreset_restore_security_station(_adapter *padapter)
+{
+	u8 EntryId = 0;
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct sta_info *psta;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct mlme_ext_info	*pmlmeinfo = &padapter->mlmeextpriv.mlmext_info;
+
+	{
+		u8 val8;
+
+		if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) {
+			val8 = 0xcc;
+		#ifdef CONFIG_WAPI_SUPPORT
+		} else if (padapter->wapiInfo.bWapiEnable && pmlmeinfo->auth_algo == dot11AuthAlgrthm_WAPI) {
+			//Disable TxUseDefaultKey, RxUseDefaultKey, RxBroadcastUseDefaultKey.
+			val8 = 0x4c;
+		#endif
+		} else {
+			val8 = 0xcf;
+		}
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+	}
+
+	#if 0
+	if (	( padapter->securitypriv.dot11PrivacyAlgrthm == _WEP40_ ) ||
+		( padapter->securitypriv.dot11PrivacyAlgrthm == _WEP104_ ))
+	{
+
+		for(EntryId=0; EntryId<4; EntryId++)
+		{
+			if(EntryId == psecuritypriv->dot11PrivacyKeyIndex)
+				rtw_set_key(padapter,&padapter->securitypriv, EntryId, 1);
+			else
+				rtw_set_key(padapter,&padapter->securitypriv, EntryId, 0);
+		}
+
+	}
+	else
+	#endif
+	if((padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_) ||
+		(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_))
+	{
+		psta = rtw_get_stainfo(pstapriv, get_bssid(mlmepriv));
+		if (psta == NULL) {
+			//DEBUG_ERR( ("Set wpa_set_encryption: Obtain Sta_info fail \n"));
+		}
+		else
+		{
+			//pairwise key
+			rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+			//group key
+			rtw_set_key(padapter,&padapter->securitypriv,padapter->securitypriv.dot118021XGrpKeyid, 0);
+		}
+	}
+}
+
+void sreset_restore_network_station(_adapter *padapter)
+{
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	#if 0
+	{
+	//=======================================================
+	// reset related register of Beacon control
+
+	//set MSR to nolink
+	Set_MSR(padapter, _HW_STATE_NOLINK_);		
+	// reject all data frame
+	rtw_write16(padapter, REG_RXFLTMAP2,0x00);
+	//reset TSF
+	rtw_write8(padapter, REG_DUAL_TSF_RST, (BIT(0)|BIT(1)));
+
+	// disable update TSF
+	SetBcnCtrlReg(padapter, BIT(4), 0);
+
+	//=======================================================
+	}
+	#endif
+	
+	rtw_setopmode_cmd(padapter, Ndis802_11Infrastructure);
+
+	{
+		u8 threshold;
+		#ifdef CONFIG_USB_HCI
+		// TH=1 => means that invalidate usb rx aggregation
+		// TH=0 => means that validate usb rx aggregation, use init value.
+		if(mlmepriv->htpriv.ht_option) {
+			if(padapter->registrypriv.wifi_spec==1)		
+				threshold = 1;
+			else
+				threshold = 0;
+			rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+		} else {
+			threshold = 1;
+			rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+		}
+		#endif
+	}
+
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+	//disable dynamic functions, such as high power, DIG
+	//Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+	
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
+
+	{
+		u8	join_type = 0;
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+	}
+
+	Set_MSR(padapter, (pmlmeinfo->state & 0x3));
+
+	mlmeext_joinbss_event_callback(padapter, 1);
+	//restore Sequence No.
+	rtw_write8(padapter,0x4dc,padapter->xmitpriv.nqos_ssn);
+
+	sreset_restore_security_station(padapter);
+}
+
+void sreset_restore_network_status(_adapter *padapter)
+{
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (check_fwstate(mlmepriv, WIFI_STATION_STATE)) {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - WIFI_STATION_STATE\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+		sreset_restore_network_station(padapter);
+	} else if (check_fwstate(mlmepriv, WIFI_AP_STATE)) {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - WIFI_AP_STATE\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+		rtw_ap_restore_network(padapter);
+	} else if (check_fwstate(mlmepriv, WIFI_ADHOC_STATE)) {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - WIFI_ADHOC_STATE\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+	} else {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - ???\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+	}
+}
+
+void sreset_stop_adapter(_adapter *padapter)
+{
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+	if (padapter == NULL)
+		return;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (!rtw_netif_queue_stopped(padapter->pnetdev))
+		rtw_netif_stop_queue(padapter->pnetdev);
+
+	rtw_cancel_all_timer(padapter);
+
+	/* TODO: OS and HCI independent */
+	#if defined(PLATFORM_LINUX) && defined(CONFIG_USB_HCI)
+	tasklet_kill(&pxmitpriv->xmit_tasklet);
+	#endif
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
+		rtw_scan_abort(padapter);
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
+		_rtw_join_timeout_handler(padapter);
+
+}
+
+void sreset_start_adapter(_adapter *padapter)
+{
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+	if (padapter == NULL)
+		return;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED)) {
+		sreset_restore_network_status(padapter);
+	}
+
+	/* TODO: OS and HCI independent */
+	#if defined(PLATFORM_LINUX) && defined(CONFIG_USB_HCI)
+	tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+	#endif
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	if (rtw_netif_queue_stopped(padapter->pnetdev))
+		rtw_netif_wake_queue(padapter->pnetdev);
+
+}
+
+void sreset_reset(_adapter *padapter)
+{
+#ifdef DBG_CONFIG_ERROR_RESET
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	_irqL irqL;
+	u32 start = rtw_get_current_time();
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+
+	_enter_pwrlock(&pwrpriv->lock);
+
+	psrtpriv->silent_reset_inprogress = _TRUE;
+	pwrpriv->change_rfpwrstate = rf_off;
+
+	sreset_stop_adapter(padapter);
+	#ifdef CONFIG_CONCURRENT_MODE
+	sreset_stop_adapter(padapter->pbuddy_adapter);
+	#endif
+
+	#ifdef CONFIG_IPS
+	_ips_enter(padapter);
+	_ips_leave(padapter);
+	#endif
+
+	sreset_start_adapter(padapter);
+	#ifdef CONFIG_CONCURRENT_MODE
+	sreset_start_adapter(padapter->pbuddy_adapter);
+	#endif
+
+	psrtpriv->silent_reset_inprogress = _FALSE;
+
+	_exit_pwrlock(&pwrpriv->lock);
+
+	DBG_871X("%s done in %d ms\n", __FUNCTION__, rtw_get_passing_time_ms(start));
+#endif
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c
new file mode 100755
index 0000000000000..a2f1c975f9bcd
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c
@@ -0,0 +1,848 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_STA_MGT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <mlme_osdep.h>
+
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <sta_info.h>
+
+void _rtw_init_stainfo(struct sta_info *psta);
+void _rtw_init_stainfo(struct sta_info *psta)
+{
+
+_func_enter_;
+
+	_rtw_memset((u8 *)psta, 0, sizeof (struct sta_info));
+
+	 _rtw_spinlock_init(&psta->lock);
+	_rtw_init_listhead(&psta->list);
+	_rtw_init_listhead(&psta->hash_list);
+	//_rtw_init_listhead(&psta->asoc_list);
+	//_rtw_init_listhead(&psta->sleep_list);
+	//_rtw_init_listhead(&psta->wakeup_list);	
+
+	_rtw_init_queue(&psta->sleep_q);
+	psta->sleepq_len = 0;
+
+	_rtw_init_sta_xmit_priv(&psta->sta_xmitpriv);
+	_rtw_init_sta_recv_priv(&psta->sta_recvpriv);
+	
+#ifdef CONFIG_AP_MODE
+
+	_rtw_init_listhead(&psta->asoc_list);
+
+	_rtw_init_listhead(&psta->auth_list);
+	
+	psta->expire_to = 0;
+	
+	psta->flags = 0;
+	
+	psta->capability = 0;
+
+	psta->bpairwise_key_installed = _FALSE;
+
+
+#ifdef CONFIG_NATIVEAP_MLME
+	psta->nonerp_set = 0;
+	psta->no_short_slot_time_set = 0;
+	psta->no_short_preamble_set = 0;
+	psta->no_ht_gf_set = 0;
+	psta->no_ht_set = 0;
+	psta->ht_20mhz_set = 0;
+#endif	
+
+#ifdef CONFIG_TX_MCAST2UNI
+	psta->under_exist_checking = 0;
+#endif	// CONFIG_TX_MCAST2UNI
+	
+	psta->keep_alive_trycnt = 0;
+
+#endif	// CONFIG_AP_MODE	
+	
+_func_exit_;	
+
+}
+
+u32	_rtw_init_sta_priv(struct	sta_priv *pstapriv)
+{
+	struct sta_info *psta;
+	s32 i;
+
+_func_enter_;	
+
+	pstapriv->pallocated_stainfo_buf = rtw_zvmalloc (sizeof(struct sta_info) * NUM_STA+ 4);
+	
+	if(!pstapriv->pallocated_stainfo_buf)
+		return _FAIL;
+
+	pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 - 
+		((SIZE_PTR)(pstapriv->pallocated_stainfo_buf ) & 3);
+
+	_rtw_init_queue(&pstapriv->free_sta_queue);
+
+	_rtw_spinlock_init(&pstapriv->sta_hash_lock);
+	
+	//_rtw_init_queue(&pstapriv->asoc_q);
+	pstapriv->asoc_sta_count = 0;
+	_rtw_init_queue(&pstapriv->sleep_q);
+	_rtw_init_queue(&pstapriv->wakeup_q);
+
+	psta = (struct sta_info *)(pstapriv->pstainfo_buf);
+
+		
+	for(i = 0; i < NUM_STA; i++)
+	{
+		_rtw_init_stainfo(psta);
+
+		_rtw_init_listhead(&(pstapriv->sta_hash[i]));
+
+		rtw_list_insert_tail(&psta->list, get_list_head(&pstapriv->free_sta_queue));
+
+		psta++;
+	}
+
+	
+
+#ifdef CONFIG_AP_MODE
+
+	pstapriv->sta_dz_bitmap = 0;
+	pstapriv->tim_bitmap = 0;
+
+	_rtw_init_listhead(&pstapriv->asoc_list);
+	_rtw_init_listhead(&pstapriv->auth_list);
+	_rtw_spinlock_init(&pstapriv->asoc_list_lock);
+	_rtw_spinlock_init(&pstapriv->auth_list_lock);
+	pstapriv->asoc_list_cnt = 0;
+	pstapriv->auth_list_cnt = 0;
+
+	pstapriv->auth_to = 3; // 3*2 = 6 sec 
+	pstapriv->assoc_to = 3;
+	//pstapriv->expire_to = 900;// 900*2 = 1800 sec = 30 min, expire after no any traffic.
+	//pstapriv->expire_to = 30;// 30*2 = 60 sec = 1 min, expire after no any traffic.
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+	pstapriv->expire_to = 3; // 3*2 = 6 sec
+#else
+	pstapriv->expire_to = 60;// 60*2 = 120 sec = 2 min, expire after no any traffic.
+#endif	
+	pstapriv->max_num_sta = NUM_STA;
+		
+#endif
+	
+_func_exit_;		
+
+	return _SUCCESS;
+	
+}
+
+inline int rtw_stainfo_offset(struct sta_priv *stapriv, struct sta_info *sta)
+{
+	int offset = (((u8 *)sta) - stapriv->pstainfo_buf)/sizeof(struct sta_info);
+
+	if (!stainfo_offset_valid(offset))
+		DBG_871X("%s invalid offset(%d), out of range!!!", __func__, offset);
+
+	return offset;
+}
+
+inline struct sta_info *rtw_get_stainfo_by_offset(struct sta_priv *stapriv, int offset)
+{
+	if (!stainfo_offset_valid(offset))
+		DBG_871X("%s invalid offset(%d), out of range!!!", __func__, offset);
+
+	return (struct sta_info *)(stapriv->pstainfo_buf + offset * sizeof(struct sta_info));
+}
+
+void	_rtw_free_sta_xmit_priv_lock(struct sta_xmit_priv *psta_xmitpriv);
+void	_rtw_free_sta_xmit_priv_lock(struct sta_xmit_priv *psta_xmitpriv)
+{
+_func_enter_;
+
+	_rtw_spinlock_free(&psta_xmitpriv->lock);
+
+	_rtw_spinlock_free(&(psta_xmitpriv->be_q.sta_pending.lock));
+	_rtw_spinlock_free(&(psta_xmitpriv->bk_q.sta_pending.lock));
+	_rtw_spinlock_free(&(psta_xmitpriv->vi_q.sta_pending.lock));
+	_rtw_spinlock_free(&(psta_xmitpriv->vo_q.sta_pending.lock));
+_func_exit_;	
+}
+
+static void	_rtw_free_sta_recv_priv_lock(struct sta_recv_priv *psta_recvpriv)
+{
+_func_enter_;	
+
+	_rtw_spinlock_free(&psta_recvpriv->lock);
+
+	_rtw_spinlock_free(&(psta_recvpriv->defrag_q.lock));
+
+_func_exit_;
+
+}
+
+void rtw_mfree_stainfo(struct sta_info *psta);
+void rtw_mfree_stainfo(struct sta_info *psta)
+{
+_func_enter_;
+
+	if(&psta->lock != NULL)
+		 _rtw_spinlock_free(&psta->lock);
+
+	_rtw_free_sta_xmit_priv_lock(&psta->sta_xmitpriv);
+	_rtw_free_sta_recv_priv_lock(&psta->sta_recvpriv);
+	
+_func_exit_;	
+}
+
+
+// this function is used to free the memory of lock || sema for all stainfos
+void rtw_mfree_all_stainfo(struct sta_priv *pstapriv );
+void rtw_mfree_all_stainfo(struct sta_priv *pstapriv )
+{
+	_irqL	 irqL;
+	_list	*plist, *phead;
+	struct sta_info *psta = NULL;
+	
+_func_enter_;	
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	phead = get_list_head(&pstapriv->free_sta_queue);
+	plist = get_next(phead);
+		
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info ,list);
+		plist = get_next(plist);
+
+		rtw_mfree_stainfo(psta);
+	}
+	
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+_func_exit_;	
+
+}
+
+void rtw_mfree_sta_priv_lock(struct	sta_priv *pstapriv);
+void rtw_mfree_sta_priv_lock(struct	sta_priv *pstapriv)
+{
+#ifdef CONFIG_AP_MODE
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+#endif
+
+	 rtw_mfree_all_stainfo(pstapriv); //be done before free sta_hash_lock
+
+	_rtw_spinlock_free(&pstapriv->free_sta_queue.lock);
+
+	_rtw_spinlock_free(&pstapriv->sta_hash_lock);
+	_rtw_spinlock_free(&pstapriv->wakeup_q.lock);
+	_rtw_spinlock_free(&pstapriv->sleep_q.lock);
+
+#ifdef CONFIG_AP_MODE
+	_rtw_spinlock_free(&pstapriv->asoc_list_lock);
+	_rtw_spinlock_free(&pstapriv->auth_list_lock);
+	_rtw_spinlock_free(&pacl_list->acl_node_q.lock);
+#endif
+
+}
+
+u32	_rtw_free_sta_priv(struct	sta_priv *pstapriv)
+{
+	_irqL 	irqL;
+	_list	*phead, *plist;
+	struct sta_info *psta = NULL;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	int 	index;
+
+_func_enter_;
+	if(pstapriv){
+
+		/*	delete all reordering_ctrl_timer		*/ 
+		_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+		for(index = 0; index < NUM_STA; index++)
+		{
+			phead = &(pstapriv->sta_hash[index]);
+			plist = get_next(phead);
+			
+			while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+			{
+				int i;	
+				psta = LIST_CONTAINOR(plist, struct sta_info ,hash_list);
+				plist = get_next(plist);
+
+				for(i=0; i < 16 ; i++)
+				{
+					preorder_ctrl = &psta->recvreorder_ctrl[i];
+					_cancel_timer_ex(&preorder_ctrl->reordering_ctrl_timer);	
+				}
+			}
+		}
+		_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+		/*===============================*/
+		
+		rtw_mfree_sta_priv_lock(pstapriv);
+
+		if(pstapriv->pallocated_stainfo_buf) {
+			rtw_vmfree(pstapriv->pallocated_stainfo_buf, sizeof(struct sta_info)*NUM_STA+4);
+		}
+	}
+	
+_func_exit_;
+	return _SUCCESS;
+}
+
+
+//struct	sta_info *rtw_alloc_stainfo(_queue *pfree_sta_queue, unsigned char *hwaddr)
+struct	sta_info *rtw_alloc_stainfo(struct	sta_priv *pstapriv, u8 *hwaddr) 
+{	
+	_irqL irqL, irqL2;
+	uint tmp_aid;
+	s32	index;
+	_list	*phash_list;
+	struct sta_info	*psta;
+	_queue *pfree_sta_queue;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	int i = 0;
+	u16  wRxSeqInitialValue = 0xffff;
+	
+_func_enter_;	
+
+	pfree_sta_queue = &pstapriv->free_sta_queue;
+	
+	//_enter_critical_bh(&(pfree_sta_queue->lock), &irqL);
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+	if (_rtw_queue_empty(pfree_sta_queue) == _TRUE)
+	{
+		//_exit_critical_bh(&(pfree_sta_queue->lock), &irqL);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+		psta = NULL;
+	}
+	else
+	{
+		psta = LIST_CONTAINOR(get_next(&pfree_sta_queue->queue), struct sta_info, list);
+		
+		rtw_list_delete(&(psta->list));
+
+		//_exit_critical_bh(&(pfree_sta_queue->lock), &irqL);
+		
+		tmp_aid = psta->aid;	
+	
+		_rtw_init_stainfo(psta);
+
+		_rtw_memcpy(psta->hwaddr, hwaddr, ETH_ALEN);
+
+		index = wifi_mac_hash(hwaddr);
+
+		RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_info_,("rtw_alloc_stainfo: index  = %x", index));
+
+		if(index >= NUM_STA){
+			RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_err_,("ERROR=> rtw_alloc_stainfo: index >= NUM_STA"));
+			psta= NULL;	
+			goto exit;
+		}
+		phash_list = &(pstapriv->sta_hash[index]);
+
+		//_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+		rtw_list_insert_tail(&psta->hash_list, phash_list);
+
+		pstapriv->asoc_sta_count ++ ;
+
+		//_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+// Commented by Albert 2009/08/13
+// For the SMC router, the sequence number of first packet of WPS handshake will be 0.
+// In this case, this packet will be dropped by recv_decache function if we use the 0x00 as the default value for tid_rxseq variable.
+// So, we initialize the tid_rxseq variable as the 0xffff.
+
+		for( i = 0; i < 16; i++ )
+		{
+                     _rtw_memcpy( &psta->sta_recvpriv.rxcache.tid_rxseq[ i ], &wRxSeqInitialValue, 2 );
+		}
+
+		RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_info_,("alloc number_%d stainfo  with hwaddr = %x %x %x %x %x %x  \n", 
+		pstapriv->asoc_sta_count , hwaddr[0], hwaddr[1], hwaddr[2],hwaddr[3],hwaddr[4],hwaddr[5]));
+
+		init_addba_retry_timer(pstapriv->padapter, psta);
+
+#ifdef CONFIG_TDLS
+		psta->padapter = pstapriv->padapter;
+		init_TPK_timer(pstapriv->padapter, psta);
+		init_ch_switch_timer(pstapriv->padapter, psta);
+		init_base_ch_timer(pstapriv->padapter, psta);
+		init_off_ch_timer(pstapriv->padapter, psta);
+		init_handshake_timer(pstapriv->padapter, psta);
+		init_tdls_alive_timer(pstapriv->padapter, psta);
+#endif //CONFIG_TDLS
+
+		//for A-MPDU Rx reordering buffer control
+		for(i=0; i < 16 ; i++)
+		{
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+
+			preorder_ctrl->padapter = pstapriv->padapter;
+		
+			preorder_ctrl->enable = _FALSE;
+		
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;       
+			//preorder_ctrl->wsize_b = (NR_RECVBUFF-2);
+			preorder_ctrl->wsize_b = 64;//64;
+
+			_rtw_init_queue(&preorder_ctrl->pending_recvframe_queue);
+
+			rtw_init_recv_timer(preorder_ctrl);
+		}
+
+
+		//init for DM
+		psta->rssi_stat.UndecoratedSmoothedPWDB = 0;
+		psta->rssi_stat.UndecoratedSmoothedCCK = (-1);
+		
+		/* init for the sequence number of received management frame */
+		psta->RxMgmtFrameSeqNum = 0xffff;
+	}
+	
+exit:
+
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+_func_exit_;
+
+	return psta;
+
+
+}
+
+
+// using pstapriv->sta_hash_lock to protect
+u32	rtw_free_stainfo(_adapter *padapter , struct sta_info *psta)
+{	
+	int i;
+	_irqL irqL0;
+	_queue *pfree_sta_queue;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	struct	sta_xmit_priv	*pstaxmitpriv;
+	struct	xmit_priv	*pxmitpriv= &padapter->xmitpriv;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct hw_xmit *phwxmit;
+	
+
+_func_enter_;	
+	
+	if (psta == NULL)
+		goto exit;
+
+
+	_enter_critical_bh(&psta->lock, &irqL0);
+	psta->state &= ~_FW_LINKED;
+	_exit_critical_bh(&psta->lock, &irqL0);
+
+	pfree_sta_queue = &pstapriv->free_sta_queue;
+
+
+	pstaxmitpriv = &psta->sta_xmitpriv;
+	
+	//rtw_list_delete(&psta->sleep_list);
+	
+	//rtw_list_delete(&psta->wakeup_list);
+	
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+	
+	rtw_free_xmitframe_queue(pxmitpriv, &psta->sleep_q);
+	psta->sleepq_len = 0;
+	
+	//vo
+	//_enter_critical_bh(&(pxmitpriv->vo_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->vo_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vo_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits;
+	phwxmit->accnt -= pstaxmitpriv->vo_q.qcnt;
+	pstaxmitpriv->vo_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->vo_pending.lock), &irqL0);
+
+	//vi
+	//_enter_critical_bh(&(pxmitpriv->vi_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->vi_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vi_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits+1;
+	phwxmit->accnt -= pstaxmitpriv->vi_q.qcnt;
+	pstaxmitpriv->vi_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->vi_pending.lock), &irqL0);
+
+	//be
+	//_enter_critical_bh(&(pxmitpriv->be_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->be_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->be_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits+2;
+	phwxmit->accnt -= pstaxmitpriv->be_q.qcnt;
+	pstaxmitpriv->be_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->be_pending.lock), &irqL0);
+	
+	//bk
+	//_enter_critical_bh(&(pxmitpriv->bk_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->bk_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->bk_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits+3;
+	phwxmit->accnt -= pstaxmitpriv->bk_q.qcnt;
+	pstaxmitpriv->bk_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->bk_pending.lock), &irqL0);
+	
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+	
+	rtw_list_delete(&psta->hash_list);
+	RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_err_,("\n free number_%d stainfo  with hwaddr = 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x  \n",pstapriv->asoc_sta_count , psta->hwaddr[0], psta->hwaddr[1], psta->hwaddr[2],psta->hwaddr[3],psta->hwaddr[4],psta->hwaddr[5]));
+	pstapriv->asoc_sta_count --;
+	
+	
+	// re-init sta_info; 20061114 // will be init in alloc_stainfo
+	//_rtw_init_sta_xmit_priv(&psta->sta_xmitpriv);
+	//_rtw_init_sta_recv_priv(&psta->sta_recvpriv);
+
+	_cancel_timer_ex(&psta->addba_retry_timer);
+
+#ifdef CONFIG_TDLS
+	_cancel_timer_ex(&psta->TPK_timer);
+	_cancel_timer_ex(&psta->option_timer);
+	_cancel_timer_ex(&psta->base_ch_timer);
+	_cancel_timer_ex(&psta->off_ch_timer);
+	_cancel_timer_ex(&psta->alive_timer1);
+	_cancel_timer_ex(&psta->alive_timer2);
+#endif //CONFIG_TDLS
+
+	//for A-MPDU Rx reordering buffer control, cancel reordering_ctrl_timer
+	for(i=0; i < 16 ; i++)
+	{
+		_irqL irqL;
+		_list	*phead, *plist;
+		union recv_frame *prframe;
+		_queue *ppending_recvframe_queue;
+		_queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+	
+		preorder_ctrl = &psta->recvreorder_ctrl[i];
+		
+		_cancel_timer_ex(&preorder_ctrl->reordering_ctrl_timer);		
+
+		
+		ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+		_enter_critical_bh(&ppending_recvframe_queue->lock, &irqL);
+
+		phead = 	get_list_head(ppending_recvframe_queue);
+		plist = get_next(phead);
+		
+		while(!rtw_is_list_empty(phead))
+		{	
+			prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+			
+			plist = get_next(plist);
+			
+			rtw_list_delete(&(prframe->u.hdr.list));
+
+			rtw_free_recvframe(prframe, pfree_recv_queue);
+		}
+
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irqL);
+		
+	}
+
+
+#ifdef CONFIG_AP_MODE
+
+/*
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL0);
+	rtw_list_delete(&psta->asoc_list);	
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL0);
+*/
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL0);
+	if (!rtw_is_list_empty(&psta->auth_list)) {
+		rtw_list_delete(&psta->auth_list);
+		pstapriv->auth_list_cnt--;
+	}
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL0);
+	
+	psta->expire_to = 0;
+	
+	psta->sleepq_ac_len = 0;
+	psta->qos_info = 0;
+
+	psta->max_sp_len = 0;
+	psta->uapsd_bk = 0;
+	psta->uapsd_be = 0;
+	psta->uapsd_vi = 0;
+	psta->uapsd_vo = 0;
+
+	psta->has_legacy_ac = 0;
+
+#ifdef CONFIG_NATIVEAP_MLME
+	
+	pstapriv->sta_dz_bitmap &=~BIT(psta->aid);
+	pstapriv->tim_bitmap &=~BIT(psta->aid);	
+
+	//rtw_indicate_sta_disassoc_event(padapter, psta);
+
+	if ((psta->aid >0)&&(pstapriv->sta_aid[psta->aid - 1] == psta))
+	{
+		pstapriv->sta_aid[psta->aid - 1] = NULL;
+		psta->aid = 0;
+	}	
+
+#endif	// CONFIG_NATIVEAP_MLME	
+
+#ifdef CONFIG_TX_MCAST2UNI
+	psta->under_exist_checking = 0;
+#endif	// CONFIG_TX_MCAST2UNI
+
+#endif	// CONFIG_AP_MODE	
+
+	 _rtw_spinlock_free(&psta->lock);
+
+	//_enter_critical_bh(&(pfree_sta_queue->lock), &irqL0);
+	rtw_list_insert_tail(&psta->list, get_list_head(pfree_sta_queue));
+	//_exit_critical_bh(&(pfree_sta_queue->lock), &irqL0);
+
+exit:
+	
+_func_exit_;	
+
+	return _SUCCESS;
+	
+}
+
+// free all stainfo which in sta_hash[all]
+void rtw_free_all_stainfo(_adapter *padapter)
+{
+	_irqL	 irqL;
+	_list	*plist, *phead;
+	s32	index;
+	struct sta_info *psta = NULL;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info* pbcmc_stainfo =rtw_get_bcmc_stainfo( padapter);
+	
+_func_enter_;	
+
+	if(pstapriv->asoc_sta_count==1)
+		goto exit;
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	for(index=0; index< NUM_STA; index++)
+	{
+		phead = &(pstapriv->sta_hash[index]);
+		plist = get_next(phead);
+		
+		while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+		{
+			psta = LIST_CONTAINOR(plist, struct sta_info ,hash_list);
+
+			plist = get_next(plist);
+
+			if(pbcmc_stainfo!=psta)					
+				rtw_free_stainfo(padapter , psta);
+			
+		}
+	}
+	
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+	
+exit:	
+	
+_func_exit_;	
+
+}
+
+/* any station allocated can be searched by hash list */
+struct sta_info *rtw_get_stainfo(struct sta_priv *pstapriv, const u8 *hwaddr)
+{
+
+	_irqL	 irqL;
+
+	_list	*plist, *phead;
+
+	struct sta_info *psta = NULL;
+	
+	u32	index;
+
+	const u8 *addr;
+
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+
+_func_enter_;
+
+	if(hwaddr==NULL)
+		return NULL;
+		
+	if(IS_MCAST(hwaddr))
+	{
+		addr = bc_addr;
+	}
+	else
+	{
+		addr = hwaddr;
+	}
+
+	index = wifi_mac_hash(addr);
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+	
+	phead = &(pstapriv->sta_hash[index]);
+	plist = get_next(phead);
+
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+	
+		psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+		
+		if ((_rtw_memcmp(psta->hwaddr, addr, ETH_ALEN))== _TRUE) 
+		{ // if found the matched address
+			break;
+		}
+		psta=NULL;
+		plist = get_next(plist);
+	}
+
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+_func_exit_;	
+	return psta;
+	
+}
+
+u32 rtw_init_bcmc_stainfo(_adapter* padapter)
+{
+
+	struct sta_info 	*psta;
+	struct tx_servq	*ptxservq;
+	u32 res=_SUCCESS;
+	NDIS_802_11_MAC_ADDRESS	bcast_addr= {0xff,0xff,0xff,0xff,0xff,0xff};
+	
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	//_queue	*pstapending = &padapter->xmitpriv.bm_pending; 
+	
+_func_enter_;
+
+	psta = rtw_alloc_stainfo(pstapriv, bcast_addr);
+	
+	if(psta==NULL){
+		res=_FAIL;
+		RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_err_,("rtw_alloc_stainfo fail"));
+		goto exit;
+	}
+
+	// default broadcast & multicast use macid 1
+	psta->mac_id = 1;
+
+	ptxservq= &(psta->sta_xmitpriv.be_q);
+
+/*
+	_enter_critical(&pstapending->lock, &irqL0);
+
+	if (rtw_is_list_empty(&ptxservq->tx_pending))
+		rtw_list_insert_tail(&ptxservq->tx_pending, get_list_head(pstapending));
+
+	_exit_critical(&pstapending->lock, &irqL0);
+*/
+	
+exit:
+_func_exit_;		
+	return _SUCCESS;
+
+}
+
+
+struct sta_info* rtw_get_bcmc_stainfo(_adapter* padapter)
+{
+	struct sta_info 	*psta;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+_func_enter_;
+	 psta = rtw_get_stainfo(pstapriv, bc_addr);
+_func_exit_;		 
+	return psta;
+
+}
+
+u8 rtw_access_ctrl(_adapter *padapter, u8 *mac_addr)
+{
+	u8 res = _TRUE;
+#ifdef  CONFIG_AP_MODE
+	_irqL irqL;
+	_list	*plist, *phead;
+	struct rtw_wlan_acl_node *paclnode;
+	u8 match = _FALSE;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;
+	
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);		
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(paclnode->addr, mac_addr, ETH_ALEN))
+		{
+			if(paclnode->valid == _TRUE)
+			{
+				match = _TRUE;
+				break;
+			}
+		}		
+	}	
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+	
+
+	if(pacl_list->mode == 1)//accept unless in deny list
+	{
+		res = (match == _TRUE) ?  _FALSE:_TRUE;
+	}	
+	else if(pacl_list->mode == 2)//deny unless in accept list
+	{
+		res = (match == _TRUE) ?  _TRUE:_FALSE;
+	}
+	else
+	{
+		 res = _TRUE;
+	}		
+	
+#endif
+
+	return res;
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c
new file mode 100755
index 0000000000000..e8c4d4cc7a73a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c
@@ -0,0 +1,2941 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_TDLS_C_
+
+#include <drv_types.h>
+#include <ethernet.h>
+#include <rtw_tdls.h>
+#include <wifi.h>
+
+#ifdef CONFIG_TDLS
+extern unsigned char MCS_rate_2R[16];
+extern unsigned char MCS_rate_1R[16];
+extern void process_wmmps_data(_adapter *padapter, union recv_frame *precv_frame);
+extern s32 rtw_dump_xframe(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+void rtw_reset_tdls_info(_adapter* padapter)
+{
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	ptdlsinfo->ap_prohibited = _FALSE;
+	ptdlsinfo->setup_state = TDLS_STATE_NONE;
+	ptdlsinfo->sta_cnt = 0;
+	ptdlsinfo->sta_maximum = _FALSE;
+	ptdlsinfo->macid_index= 6;
+	ptdlsinfo->clear_cam= 0;
+	ptdlsinfo->ch_sensing = 0;
+	ptdlsinfo->cur_channel = 0;
+	ptdlsinfo->candidate_ch = 1;	//when inplement channel switching, default candidate channel is 1
+	ptdlsinfo->watchdog_count = 0;
+	ptdlsinfo->dev_discovered = 0;
+
+#ifdef CONFIG_WFD
+	ptdlsinfo->wfd_info = &padapter->wfd_info;
+#endif //CONFIG_WFD
+}
+
+int rtw_init_tdls_info(_adapter* padapter)
+{
+	int	res = _SUCCESS;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	ptdlsinfo->enable = 1;
+	rtw_reset_tdls_info(padapter);
+
+	_rtw_spinlock_init(&ptdlsinfo->cmd_lock);
+	_rtw_spinlock_init(&ptdlsinfo->hdl_lock);
+
+	return res;
+
+}
+
+void rtw_free_tdls_info(struct tdls_info *ptdlsinfo)
+{
+	_rtw_spinlock_free(&ptdlsinfo->cmd_lock);
+	_rtw_spinlock_free(&ptdlsinfo->hdl_lock);
+
+	_rtw_memset(ptdlsinfo, 0, sizeof(struct tdls_info) );
+
+}
+
+void issue_nulldata_to_TDLS_peer_STA(_adapter *padapter, struct sta_info *ptdls_sta, unsigned int power_mode)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+//	SetToDs(fctrl);
+	if (power_mode)
+	{
+		SetPwrMgt(fctrl);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr1, ptdls_sta->hwaddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+	ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+	pattrib->seqnum = ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority];
+	SetSeqNum(pwlanhdr, pattrib->seqnum);
+
+	SetFrameSubType(pframe, WIFI_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+}
+
+s32 update_tdls_attrib(_adapter *padapter, struct pkt_attrib *pattrib)
+{
+
+	struct sta_info *psta = NULL;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv		*pqospriv= &pmlmepriv->qospriv;
+
+	s32 res=_SUCCESS;
+	sint bmcast;
+
+	bmcast = IS_MCAST(pattrib->ra);
+	
+	psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+	if (psta == NULL)	{ 
+		res =_FAIL;
+		goto exit;
+	}
+
+	pattrib->mac_id = psta->mac_id;
+				
+	pattrib->psta = psta;
+
+	pattrib->ack_policy = 0;
+	// get ether_hdr_len
+	pattrib->pkt_hdrlen = ETH_HLEN;//(pattrib->ether_type == 0x8100) ? (14 + 4 ): 14; //vlan tag
+
+	if (pqospriv->qos_option &&  psta->qos_option) {
+		pattrib->priority = 1;	//tdls management frame should be AC_BK
+		pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
+		pattrib->subtype = WIFI_QOS_DATA_TYPE;
+	} else {
+		pattrib->hdrlen = WLAN_HDR_A3_LEN;
+		pattrib->subtype = WIFI_DATA_TYPE;	
+		pattrib->priority = 0;
+	}
+
+	if (psta->ieee8021x_blocked == _TRUE)
+	{
+		pattrib->encrypt = 0;
+	}
+	else
+	{
+		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
+
+		switch(psecuritypriv->dot11AuthAlgrthm)
+		{
+			case dot11AuthAlgrthm_Open:
+			case dot11AuthAlgrthm_Shared:
+			case dot11AuthAlgrthm_Auto:				
+				pattrib->key_idx = (u8)psecuritypriv->dot11PrivacyKeyIndex;
+				break;
+			case dot11AuthAlgrthm_8021X:
+				pattrib->key_idx = 0;
+				break;
+			default:
+				pattrib->key_idx = 0;
+				break;
+		}
+	}
+
+	switch (pattrib->encrypt)
+	{
+		case _WEP40_:
+		case _WEP104_:
+			pattrib->iv_len = 4;
+			pattrib->icv_len = 4;
+			break;
+		case _TKIP_:
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 4;
+			if(padapter->securitypriv.busetkipkey==_FAIL)
+			{
+				res =_FAIL;
+				goto exit;
+			}
+			break;			
+		case _AES_:
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 8;
+			break;
+		default:
+			pattrib->iv_len = 0;
+			pattrib->icv_len = 0;
+			break;
+	}
+
+	if (pattrib->encrypt &&
+	    ((padapter->securitypriv.sw_encrypt == _TRUE) || (psecuritypriv->hw_decrypted == _FALSE)))
+	{
+		pattrib->bswenc = _TRUE;
+	} else {
+		pattrib->bswenc = _FALSE;
+	}
+
+	//qos_en, ht_en, init rate, ,bw, ch_offset, sgi
+	pattrib->qos_en = psta->qos_option;
+	pattrib->ht_en = psta->htpriv.ht_option;
+	pattrib->raid = psta->raid;
+	pattrib->bwmode = psta->htpriv.bwmode;
+	pattrib->ch_offset = psta->htpriv.ch_offset;
+	pattrib->sgi= psta->htpriv.sgi;
+	pattrib->ampdu_en = _FALSE;
+	
+	//if(pattrib->ht_en && psta->htpriv.ampdu_enable)
+	//{
+	//	if(psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
+	//		pattrib->ampdu_en = _TRUE;
+	//}	
+
+exit:
+
+	return res;
+}
+
+void free_tdls_sta(_adapter *padapter, struct sta_info *ptdls_sta)
+{
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+   	struct sta_priv *pstapriv = &padapter->stapriv;
+	_irqL irqL;
+	
+	//free peer sta_info
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	if(ptdlsinfo->sta_cnt != 0)
+		ptdlsinfo->sta_cnt--;
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	if( ptdlsinfo->sta_cnt < (NUM_STA - 2) )	// -2: AP + BC/MC sta
+	{
+		ptdlsinfo->sta_maximum = _FALSE;
+		_rtw_memset( &ptdlsinfo->ss_record, 0x00, sizeof(struct tdls_ss_record) );
+	}
+	//ready to clear cam
+	if(ptdls_sta->mac_id!=0){
+		ptdlsinfo->clear_cam=ptdls_sta->mac_id;
+		rtw_setstakey_cmd(padapter, (u8 *)ptdls_sta, _TRUE);
+	}
+
+	if(ptdlsinfo->sta_cnt==0){
+		rtw_tdls_cmd(padapter, myid(&(padapter->eeprompriv)), TDLS_RS_RCR);
+		ptdlsinfo->setup_state=TDLS_STATE_NONE;
+	}
+	else
+		DBG_871X("Remain tdls sta:%02x\n", ptdlsinfo->sta_cnt);
+
+	rtw_free_stainfo(padapter,  ptdls_sta);
+	
+}
+
+// cam entry will be the same as mac_id
+void rtw_tdls_set_mac_id(struct tdls_info *ptdlsinfo, struct sta_info *ptdls_sta)
+{
+	if(ptdls_sta->mac_id==0)
+	{
+		ptdls_sta->mac_id = ptdlsinfo->macid_index;
+		if( (++ptdlsinfo->macid_index) > (NUM_STA -2) )
+			ptdlsinfo->macid_index= TDLS_INI_MACID_ENTRY;
+	}
+}
+
+//TDLS encryption(if needed) will always be CCMP
+void rtw_tdls_set_key(_adapter *adapter, struct rx_pkt_attrib *prx_pkt_attrib, struct sta_info *ptdls_sta)
+{
+	if(prx_pkt_attrib->encrypt)
+	{
+		ptdls_sta->dot118021XPrivacy=_AES_;
+		rtw_setstakey_cmd(adapter, (u8*)ptdls_sta, _TRUE);
+	}
+}
+
+void rtw_tdls_process_ht_cap(_adapter *adapter, struct sta_info *ptdls_sta, u8 *data, u8 Length)
+{
+	/* save HT capabilities in the sta object */
+	_rtw_memset(&ptdls_sta->htpriv.ht_cap, 0, sizeof(struct rtw_ieee80211_ht_cap));
+	if (data && Length >= sizeof(struct rtw_ieee80211_ht_cap) )
+	{
+		ptdls_sta->flags |= WLAN_STA_HT;
+		
+		ptdls_sta->flags |= WLAN_STA_WME;
+		
+		_rtw_memcpy(&ptdls_sta->htpriv.ht_cap, data, sizeof(struct rtw_ieee80211_ht_cap));			
+		
+	} else
+		ptdls_sta->flags &= ~WLAN_STA_HT;
+
+	if(ptdls_sta->flags & WLAN_STA_HT)
+	{
+		if(adapter->registrypriv.ht_enable == _TRUE)
+		{
+			ptdls_sta->htpriv.ht_option = _TRUE;
+		}
+		else
+		{
+			ptdls_sta->htpriv.ht_option = _FALSE;
+			ptdls_sta->stat_code = _STATS_FAILURE_;
+		}
+	}
+
+	//HT related cap
+	if(ptdls_sta->htpriv.ht_option)
+	{
+		//check if sta supports rx ampdu
+		if(adapter->registrypriv.ampdu_enable==1)
+			ptdls_sta->htpriv.ampdu_enable = _TRUE;
+
+		//check if sta support s Short GI
+		if(ptdls_sta->htpriv.ht_cap.cap_info & cpu_to_le16(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40))
+		{
+			ptdls_sta->htpriv.sgi = _TRUE;
+		}
+
+		// bwmode would still followed AP's setting
+		if(ptdls_sta->htpriv.ht_cap.cap_info & cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH))
+		{
+			ptdls_sta->htpriv.bwmode = adapter->mlmeextpriv.cur_bwmode;
+			ptdls_sta->htpriv.ch_offset = adapter->mlmeextpriv.cur_ch_offset;
+		}
+	}
+}
+
+u8 *rtw_tdls_set_ht_cap(_adapter *padapter, u8 *pframe, struct pkt_attrib *pattrib)
+{
+	struct rtw_ieee80211_ht_cap ht_capie;
+	u8 rf_type;
+
+	//HT capabilities
+	_rtw_memset(&ht_capie, 0, sizeof(struct rtw_ieee80211_ht_cap));
+
+	ht_capie.cap_info = IEEE80211_HT_CAP_SUP_WIDTH |IEEE80211_HT_CAP_SGI_20 |IEEE80211_HT_CAP_SM_PS |
+						IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_TX_STBC |IEEE80211_HT_CAP_DSSSCCK40;
+
+	{
+		u32 rx_packet_offset, max_recvbuf_sz;
+		rtw_hal_get_def_var(padapter, HAL_DEF_RX_PACKET_OFFSET, &rx_packet_offset);
+		rtw_hal_get_def_var(padapter, HAL_DEF_MAX_RECVBUF_SZ, &max_recvbuf_sz);
+		if(max_recvbuf_sz-rx_packet_offset>(8191-256))
+			ht_capie.cap_info = ht_capie.cap_info |IEEE80211_HT_CAP_MAX_AMSDU;
+	}
+	
+	ht_capie.ampdu_params_info = (IEEE80211_HT_CAP_AMPDU_FACTOR&0x03);
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+	switch(rf_type)
+	{
+		case RF_1T1R:
+			ht_capie.cap_info |= 0x0100;//RX STBC One spatial stream
+			_rtw_memcpy(ht_capie.supp_mcs_set, MCS_rate_1R, 16);
+			break;
+
+		case RF_2T2R:
+		case RF_1T2R:
+		default:
+			ht_capie.cap_info|= 0x0200;//RX STBC two spatial stream
+			_rtw_memcpy(ht_capie.supp_mcs_set, MCS_rate_2R, 16);
+			break;
+	}
+			
+	return(rtw_set_ie(pframe, _HT_CAPABILITY_IE_, 
+						sizeof(struct rtw_ieee80211_ht_cap), (unsigned char*)&ht_capie, &(pattrib->pktlen)));
+}
+
+u8 *rtw_tdls_set_sup_ch(struct mlme_ext_priv *pmlmeext, u8 *pframe, struct pkt_attrib *pattrib)
+{
+	u8 sup_ch[ 30 * 2 ] = { 0x00 }, sup_ch_idx = 0, idx_5g = 2;	//For supported channel
+	do{
+		if( pmlmeext->channel_set[sup_ch_idx].ChannelNum <= 14 )
+		{
+			sup_ch[0] = 1;	//First channel number
+			sup_ch[1] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;	//Number of channel
+		}
+		else
+		{
+			sup_ch[idx_5g++] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;
+			sup_ch[idx_5g++] = 1;
+		}
+		
+		sup_ch_idx++;
+	}
+	while( pmlmeext->channel_set[sup_ch_idx].ChannelNum != 0 );
+	return(rtw_set_ie(pframe, _SUPPORTED_CH_IE_, idx_5g, sup_ch, &(pattrib->pktlen)));
+}
+
+#ifdef CONFIG_WFD
+void rtw_tdls_process_wfd_ie(struct tdls_info *ptdlsinfo, u8 *ptr, u8 length)
+{
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+	u32	wfd_offset = 0;
+	//	Try to get the TCP port information when receiving the negotiation response.
+	//
+
+	wfd_offset = 0;
+	wfd_offset = rtw_get_wfd_ie( ptr + wfd_offset, length - wfd_offset, wfd_ie, &wfd_ielen );
+	while( wfd_offset )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+		int	i;
+
+		DBG_871X( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			ptdlsinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_871X( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, ptdlsinfo->wfd_info->peer_rtsp_ctrlport );
+		}
+
+		_rtw_memset( attr_content, 0x00, 10);
+		attr_contentlen = 0;
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_LOCAL_IP_ADDR, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			_rtw_memcpy(ptdlsinfo->wfd_info->peer_ip_address, ( attr_content + 1 ), 4);
+			DBG_871X( "[%s] Peer IP = %02u.%02u.%02u.%02u \n", __FUNCTION__, 
+				ptdlsinfo->wfd_info->peer_ip_address[0], ptdlsinfo->wfd_info->peer_ip_address[1],
+				ptdlsinfo->wfd_info->peer_ip_address[2], ptdlsinfo->wfd_info->peer_ip_address[3]
+				);
+		}
+		wfd_offset = rtw_get_wfd_ie( ptr + wfd_offset, length - wfd_offset, wfd_ie, &wfd_ielen );
+	}
+}
+
+void issue_tunneled_probe_req(_adapter *padapter)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	u8 baddr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; 
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, baddr, ETH_ALEN);
+	
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TUNNELED_PROBE_REQ) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tunneled_probe_rsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct rx_pkt_attrib	*rx_pkt_pattrib = &precv_frame->u.hdr.attrib;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, rx_pkt_pattrib->src, ETH_ALEN);
+	
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TUNNELED_PROBE_RSP) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+#endif //CONFIG_WFD
+
+void issue_tdls_setup_req(_adapter *padapter, u8 *mac_addr)
+{
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+   	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta= NULL;
+	_irqL irqL;
+	static u8 dialogtoken = 0;
+	u32 timeout_interval= TPK_RESEND_COUNT * 1000;	//retry timer should set at least 301 sec, using TPK_count counting 301 times.
+
+	if(ptdlsinfo->ap_prohibited == _TRUE)
+		goto exit;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;		
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+
+	//init peer sta_info
+	ptdls_sta = rtw_get_stainfo(pstapriv, mac_addr);
+	if(ptdls_sta==NULL)
+	{
+		ptdls_sta = rtw_alloc_stainfo(pstapriv, mac_addr);
+		if(ptdls_sta)
+		{
+			_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);	
+			if(!(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE))
+				ptdlsinfo->sta_cnt++;
+			_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);	
+			if( ptdlsinfo->sta_cnt == (NUM_STA - 2) )	// -2: AP + BC/MC sta
+			{
+				ptdlsinfo->sta_maximum  = _TRUE;
+			}
+		}
+		else
+		{
+			rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+			rtw_free_xmitframe(pxmitpriv, pmgntframe);
+			goto exit;
+		}
+	}
+	
+	if(ptdls_sta){	
+		ptdls_sta->tdls_sta_state |= TDLS_RESPONDER_STATE;
+		//for tdls; ptdls_sta->aid is used to fill dialogtoken
+		ptdls_sta->dialog = dialogtoken;
+		dialogtoken = (dialogtoken+1)%256;
+		ptdls_sta->TDLS_PeerKey_Lifetime = timeout_interval;
+		_set_timer( &ptdls_sta->handshake_timer, TDLS_HANDSHAKE_TIME );
+	}
+
+	pattrib->qsel=pattrib->priority;
+	if(rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_SETUP_REQUEST) !=_SUCCESS ){
+		rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tdls_teardown(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info	*ptdls_sta=NULL;
+	_irqL irqL;
+
+	ptdls_sta = rtw_get_stainfo(pstapriv, mac_addr);
+	if(ptdls_sta==NULL){
+		DBG_871X("issue tdls teardown unsuccessful\n");
+		return;
+	}else{
+		ptdls_sta->tdls_sta_state=TDLS_STATE_NONE;
+	}
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_TEARDOWN) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+	if(ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE){
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+	}
+	
+	if( ptdls_sta->timer_flag == 1 )
+	{
+		_enter_critical_bh(&(padapter->tdlsinfo.hdl_lock), &irqL);
+		ptdls_sta->timer_flag = 2;
+		_exit_critical_bh(&(padapter->tdlsinfo.hdl_lock), &irqL);
+	}
+	else
+		rtw_tdls_cmd(padapter, mac_addr, TDLS_FREE_STA );
+
+
+exit:
+
+	return;
+}
+
+void issue_tdls_dis_req(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	u8 baddr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; 
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	if(mac_addr == NULL)
+		_rtw_memcpy(pattrib->dst, baddr, ETH_ALEN);
+	else
+		_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_DISCOVERY_REQUEST) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+	DBG_871X("issue tdls dis req\n");
+
+exit:
+
+	return;
+}
+
+void issue_tdls_setup_rsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct rx_pkt_attrib	*rx_pkt_pattrib = &precv_frame->u.hdr.attrib;
+	_irqL irqL;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, rx_pkt_pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, rx_pkt_pattrib->bssid, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_SETUP_RESPONSE) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+
+}
+
+void issue_tdls_setup_cfm(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct sta_info		*ptdls_sta=NULL;
+	_irqL irqL;
+
+	struct rx_pkt_attrib	*rx_pkt_pattrib = & precv_frame->u.hdr.attrib;
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, rx_pkt_pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, rx_pkt_pattrib->bssid, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_SETUP_CONFIRM) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;		
+	}
+
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+
+}
+
+//TDLS Discovery Response frame is a management action frame
+void issue_tdls_dis_rsp(_adapter *padapter, union recv_frame *precv_frame, u8 dialog)
+{
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	unsigned char			*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short		*fctrl;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	struct rx_pkt_attrib	*rx_pkt_pattrib = &precv_frame->u.hdr.attrib;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	//	unicast probe request frame
+	_rtw_memcpy(pwlanhdr->addr1, rx_pkt_pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->dst, pwlanhdr->addr1, ETH_ALEN);
+	
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pattrib->src, pwlanhdr->addr2, ETH_ALEN);
+
+	_rtw_memcpy(pwlanhdr->addr3, rx_pkt_pattrib->bssid, ETH_ALEN);
+	_rtw_memcpy(pattrib->ra, pwlanhdr->addr3, ETH_ALEN);
+	
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof (struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+	
+	rtw_build_tdls_dis_rsp_ies(padapter, pmgntframe, pframe, dialog);
+
+	pattrib->nr_frags = 1;
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+}
+
+void issue_tdls_peer_traffic_indication(_adapter *padapter, struct sta_info *ptdls_sta)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+
+	static u8 dialogtoken=0;
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, ptdls_sta->hwaddr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	//for tdls; pattrib->nr_frags is used to fill dialogtoken
+	ptdls_sta->dialog = dialogtoken;
+	dialogtoken = (dialogtoken+1)%256;
+	//PTI frame's priority should be AC_VO
+	pattrib->priority = 7; 
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_PEER_TRAFFIC_INDICATION) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+	
+exit:
+
+	return;
+}
+
+void issue_tdls_ch_switch_req(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;		
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+
+	pattrib->qsel=pattrib->priority;
+	if(rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_CHANNEL_SWITCH_REQUEST) !=_SUCCESS ){
+		rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tdls_ch_switch_rsp(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+
+        _irqL irqL;	
+		
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;		
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+
+	pattrib->qsel=pattrib->priority;
+/*
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+	if(xmitframe_enqueue_for_tdls_sleeping_sta(padapter, pmgntframe)==_TRUE){
+		_exit_critical_bh(&pxmitpriv->lock, &irqL);
+		return _FALSE;
+	}
+*/
+	if(rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_CHANNEL_SWITCH_RESPONSE) !=_SUCCESS ){
+		rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;	
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+sint On_TDLS_Dis_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct sta_info *ptdls_sta = NULL, *psta = rtw_get_stainfo(&(adapter->stapriv), get_bssid(&(adapter->mlmepriv)));
+	struct recv_priv *precvpriv = &(adapter->recvpriv);
+	u8 *ptr = precv_frame->u.hdr.rx_data, *psa;
+	struct rx_pkt_attrib *pattrib = &(precv_frame->u.hdr.attrib);
+	struct tdls_info *ptdlsinfo = &(adapter->tdlsinfo);
+	u8 empty_addr[ETH_ALEN] = { 0x00 };
+	int UndecoratedSmoothedPWDB;
+	
+
+	//WFDTDLS: for sigma test, not to setup direct link automatically
+	ptdlsinfo->dev_discovered = 1;
+	
+#ifdef CONFIG_TDLS_AUTOSETUP	
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(&(adapter->stapriv), psa);
+
+	if(ptdls_sta != NULL)
+	{
+		ptdls_sta->tdls_sta_state |= TDLS_ALIVE_STATE;
+
+		//Record the tdls sta with lowest signal strength
+		if( (ptdlsinfo->sta_maximum == _TRUE) && (ptdls_sta->alive_count >= 1) )
+		{
+			if( _rtw_memcmp(ptdlsinfo->ss_record.macaddr, empty_addr, ETH_ALEN) )
+			{
+				_rtw_memcpy(ptdlsinfo->ss_record.macaddr, psa, ETH_ALEN);
+				ptdlsinfo->ss_record.RxPWDBAll = pattrib->RxPWDBAll;
+			}
+			else
+			{
+				if( ptdlsinfo->ss_record.RxPWDBAll < pattrib->RxPWDBAll )
+				{
+					_rtw_memcpy(ptdlsinfo->ss_record.macaddr, psa, ETH_ALEN);
+					ptdlsinfo->ss_record.RxPWDBAll = pattrib->RxPWDBAll;
+				}
+			}
+	}
+
+	}
+	else
+	{
+		if( ptdlsinfo->sta_maximum == _TRUE)
+		{
+			if( _rtw_memcmp( ptdlsinfo->ss_record.macaddr, empty_addr, ETH_ALEN ) )
+			{
+				//All traffics are busy, do not set up another direct link.
+				return _FAIL;
+			}
+			else
+			{
+				if( pattrib->RxPWDBAll > ptdlsinfo->ss_record.RxPWDBAll )
+				{
+					issue_tdls_teardown(adapter, ptdlsinfo->ss_record.macaddr);
+				}
+				else
+				{
+					return _FAIL;
+				}
+			}
+		}
+
+		rtw_hal_get_def_var(adapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
+
+		if( pattrib->RxPWDBAll + TDLS_SIGNAL_THRESH >= UndecoratedSmoothedPWDB);
+		{
+			DBG_871X("pattrib->RxPWDBAll=%d, pdmpriv->UndecoratedSmoothedPWDB=%d\n", pattrib->RxPWDBAll, UndecoratedSmoothedPWDB);
+			issue_tdls_setup_req(adapter, psa);
+		}
+	}
+#endif //CONFIG_TDLS_AUTOSETUP
+
+	return _SUCCESS;
+}
+
+sint On_TDLS_Setup_Req(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	u8 *psa, *pmyid;
+	struct sta_info *ptdls_sta= NULL;
+   	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+	struct security_priv *psecuritypriv = &adapter->securitypriv;
+	_irqL irqL;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *prsnie, *ppairwise_cipher;
+	u8 i, k, pairwise_count;
+	u8 ccmp_have=0, rsnie_have=0;
+	u16 j;
+	u8 SNonce[32];
+	u32 *timeout_interval;
+	sint parsing_length;	//frame body length, without icv_len
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE = 5;
+	unsigned char		supportRate[16];
+	int				supportRateNum = 0;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	pmyid=myid(&(adapter->eeprompriv));
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+
+	if(ptdlsinfo->ap_prohibited == _TRUE)
+	{
+		goto exit;
+	}
+
+	if(ptdls_sta==NULL){
+		ptdls_sta = rtw_alloc_stainfo(pstapriv, psa);
+	}else{
+		if(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE){
+			//If the direct link is already set up
+			//Process as re-setup after tear down
+			DBG_871X("re-setup a direct link\n");
+		}
+		//already receiving TDLS setup request
+		else if(ptdls_sta->tdls_sta_state & TDLS_INITIATOR_STATE){
+			DBG_871X("receive duplicated TDLS setup request frame in handshaking\n");
+			goto exit;
+		}
+		//When receiving and sending setup_req to the same link at the same time, STA with higher MAC_addr would be initiator
+		//following is to check out MAC_addr
+		else if(ptdls_sta->tdls_sta_state & TDLS_RESPONDER_STATE){
+			DBG_871X("receive setup_req after sending setup_req\n");
+			for (i=0;i<6;i++){
+				if(*(pmyid+i)==*(psa+i)){
+				}
+				else if(*(pmyid+i)>*(psa+i)){
+					goto exit;
+				}else if(*(pmyid+i)<*(psa+i)){
+					ptdls_sta->tdls_sta_state=TDLS_INITIATOR_STATE;
+					break;
+				}
+			}
+		}
+	}
+
+	if(ptdls_sta) 
+	{
+		ptdls_sta->dialog = *(ptr+2);	//copy dialog token
+		ptdls_sta->stat_code = 0;
+
+		//parsing information element
+		for(j=FIXED_IE; j<parsing_length;){
+
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+			switch (pIE->ElementID)
+			{
+				case _SUPPORTEDRATES_IE_:
+					_rtw_memcpy(supportRate, pIE->data, pIE->Length);
+					supportRateNum = pIE->Length;
+					break;
+				case _COUNTRY_IE_:
+					break;
+				case _EXT_SUPPORTEDRATES_IE_:
+					if(supportRateNum<=sizeof(supportRate))
+					{
+						_rtw_memcpy(supportRate+supportRateNum, pIE->data, pIE->Length);
+						supportRateNum += pIE->Length;
+					}
+					break;
+				case _SUPPORTED_CH_IE_:
+					break;
+				case _RSN_IE_2_:
+					rsnie_have=1;
+					if(prx_pkt_attrib->encrypt){
+						prsnie=(u8*)pIE;
+						//check whether initiator STA has CCMP pairwise_cipher.
+						ppairwise_cipher=prsnie+10;
+						_rtw_memcpy(&pairwise_count, (u16*)(ppairwise_cipher-2), 1);
+						for(k=0;k<pairwise_count;k++){
+							if(_rtw_memcmp( ppairwise_cipher+4*k, RSN_CIPHER_SUITE_CCMP, 4)==_TRUE)
+								ccmp_have=1;
+						}
+						if(ccmp_have==0){
+							//invalid contents of RSNIE
+							ptdls_sta->stat_code=72;
+						}
+					}
+					break;
+				case _EXT_CAP_IE_:
+					break;
+				case _VENDOR_SPECIFIC_IE_:
+					break;
+				case _FTIE_:
+					if(prx_pkt_attrib->encrypt)
+						_rtw_memcpy(SNonce, (ptr+j+52), 32);
+					break;
+				case _TIMEOUT_ITVL_IE_:
+					if(prx_pkt_attrib->encrypt)
+						timeout_interval = (u32 *)(ptr+j+3);
+					break;
+				case _RIC_Descriptor_IE_:
+					break;
+				case _HT_CAPABILITY_IE_:
+					rtw_tdls_process_ht_cap(adapter, ptdls_sta, pIE->data, pIE->Length);
+					break;
+				case EID_BSSCoexistence:
+					break;
+				case _LINK_ID_IE_:
+					if(_rtw_memcmp(get_bssid(pmlmepriv), pIE->data, 6) == _FALSE)
+					{
+						//not in the same BSS
+						ptdls_sta->stat_code=7;
+					}
+					break;
+				default:
+					break;
+			}
+
+			j += (pIE->Length + 2);
+			
+		}
+
+		//update station supportRate	
+		ptdls_sta->bssratelen = supportRateNum;
+		_rtw_memcpy(ptdls_sta->bssrateset, supportRate, supportRateNum);
+
+		//check status code
+		//if responder STA has/hasn't security on AP, but request hasn't/has RSNIE, it should reject
+		if(ptdls_sta->stat_code == 0 )
+		{
+			if(rsnie_have && (prx_pkt_attrib->encrypt==0)){
+				//security disabled
+				ptdls_sta->stat_code = 5;
+			}else if(rsnie_have==0 && (prx_pkt_attrib->encrypt)){
+				//request haven't RSNIE
+				ptdls_sta->stat_code = 38;
+			}
+
+#ifdef CONFIG_WFD
+			//WFD test plan version 0.18.2 test item 5.1.5
+			//SoUT does not use TDLS if AP uses weak security
+			if ( adapter->wdinfo.wfd_tdls_enable )
+			{
+				if(rsnie_have && (prx_pkt_attrib->encrypt != _AES_))
+				{
+					ptdls_sta->stat_code = 5;
+				}
+			}
+#endif //CONFIG_WFD
+		}
+
+		ptdls_sta->tdls_sta_state|= TDLS_INITIATOR_STATE;
+		if(prx_pkt_attrib->encrypt){
+			_rtw_memcpy(ptdls_sta->SNonce, SNonce, 32);
+			_rtw_memcpy(&(ptdls_sta->TDLS_PeerKey_Lifetime), timeout_interval, 4);
+		}
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+		if(!(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE))
+			ptdlsinfo->sta_cnt++;
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);	
+		if( ptdlsinfo->sta_cnt == (NUM_STA - 2) )	// -2: AP + BC/MC sta
+		{
+			ptdlsinfo->sta_maximum = _TRUE;
+		}
+
+#ifdef CONFIG_WFD
+		rtw_tdls_process_wfd_ie(ptdlsinfo, ptr + FIXED_IE, parsing_length - FIXED_IE);
+#endif // CONFIG_WFD
+
+	}
+	else
+	{
+		goto exit;
+	}
+
+ 	issue_tdls_setup_rsp(adapter, precv_frame);
+
+	if(ptdls_sta->stat_code==0)
+	{
+		_set_timer( &ptdls_sta->handshake_timer, TDLS_HANDSHAKE_TIME);
+	}
+	else		//status code!=0 ; setup unsuccess
+	{
+		free_tdls_sta(adapter, ptdls_sta);
+	}
+		
+exit:
+	
+	return _FAIL;
+}
+
+sint On_TDLS_Setup_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct sta_info *ptdls_sta= NULL;
+   	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	_irqL irqL;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa;
+	u16 stat_code;
+	sint parsing_length;	//frame body length, without icv_len
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =7;
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic, *ppairwise_cipher;
+	u16 pairwise_count, j, k;
+	u8 verify_ccmp=0;
+	unsigned char		supportRate[16];
+	int				supportRateNum = 0;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	if ( NULL == ptdls_sta )
+	{
+		return _FAIL;
+	}
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-TYPE_LENGTH_FIELD_SIZE
+			-1
+			-FIXED_IE;
+
+	_rtw_memcpy(&stat_code, ptr+2, 2);
+	
+	if(stat_code!=0)
+	{
+		DBG_871X( "[%s] status_code = %d, free_tdls_sta\n", __FUNCTION__, stat_code );
+		free_tdls_sta(adapter, ptdls_sta);
+		return _FAIL;
+	}
+
+	stat_code = 0;
+
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _SUPPORTEDRATES_IE_:
+				_rtw_memcpy(supportRate, pIE->data, pIE->Length);
+				supportRateNum = pIE->Length;
+				break;
+			case _COUNTRY_IE_:
+				break;
+			case _EXT_SUPPORTEDRATES_IE_:
+				if(supportRateNum<=sizeof(supportRate))
+				{
+					_rtw_memcpy(supportRate+supportRateNum, pIE->data, pIE->Length);
+					supportRateNum += pIE->Length;
+				}
+				break;
+			case _SUPPORTED_CH_IE_:
+				break;
+			case _RSN_IE_2_:
+				prsnie=(u8*)pIE;
+				//check whether responder STA has CCMP pairwise_cipher.
+				ppairwise_cipher=prsnie+10;
+				_rtw_memcpy(&pairwise_count, (u16*)(ppairwise_cipher-2), 2);
+				for(k=0;k<pairwise_count;k++){
+					if(_rtw_memcmp( ppairwise_cipher+4*k, RSN_CIPHER_SUITE_CCMP, 4)==_TRUE)
+						verify_ccmp=1;
+				}
+			case _EXT_CAP_IE_:
+				break;
+			case _VENDOR_SPECIFIC_IE_:
+				break;
+			case _FTIE_:
+				pftie=(u8*)pIE;
+				_rtw_memcpy(ptdls_sta->ANonce, (ptr+j+20), 32);
+				break;
+			case _TIMEOUT_ITVL_IE_:
+				ptimeout_ie=(u8*)pIE;
+				break;
+			case _RIC_Descriptor_IE_:
+				break;
+			case _HT_CAPABILITY_IE_:
+				rtw_tdls_process_ht_cap(adapter, ptdls_sta, pIE->data, pIE->Length);
+				break;
+			case EID_BSSCoexistence:
+				break;
+			case _LINK_ID_IE_:
+				plinkid_ie=(u8*)pIE;
+				break;
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+		
+	}
+
+	//update station supportRate	
+	ptdls_sta->bssratelen = supportRateNum;
+	_rtw_memcpy(ptdls_sta->bssrateset, supportRate, supportRateNum);
+
+#ifdef CONFIG_WFD
+	rtw_tdls_process_wfd_ie(ptdlsinfo, ptr + FIXED_IE, parsing_length - FIXED_IE);
+#endif // CONFIG_WFD
+
+	if(stat_code != 0)
+	{
+		ptdls_sta->stat_code = stat_code;
+	}
+	else
+	{
+		if(prx_pkt_attrib->encrypt)
+		{
+			if(verify_ccmp==1)
+			{
+				wpa_tdls_generate_tpk(adapter, ptdls_sta);
+				ptdls_sta->stat_code=0;
+				if(tdls_verify_mic(ptdls_sta->tpk.kck, 2, plinkid_ie, prsnie, ptimeout_ie, pftie)==0)	//0: Invalid, 1: valid
+				{
+					free_tdls_sta(adapter, ptdls_sta);
+					return _FAIL;
+				}
+			}
+			else
+			{
+				ptdls_sta->stat_code=72;	//invalide contents of RSNIE
+			}
+
+		}else{
+			ptdls_sta->stat_code=0;
+		}
+	}
+
+	DBG_871X("issue_tdls_setup_cfm\n");
+	issue_tdls_setup_cfm(adapter, precv_frame);
+
+	if(ptdls_sta->stat_code==0)
+	{
+		ptdlsinfo->setup_state = TDLS_LINKED_STATE;
+
+		if( ptdls_sta->tdls_sta_state & TDLS_RESPONDER_STATE )
+		{
+			ptdls_sta->tdls_sta_state |= TDLS_LINKED_STATE;
+			_cancel_timer_ex( &ptdls_sta->handshake_timer);
+#ifdef CONFIG_TDLS_AUTOCHECKALIVE
+			_set_timer( &ptdls_sta->alive_timer1, TDLS_ALIVE_TIMER_PH1);
+#endif //CONFIG_TDLS_AUTOSETUP
+		}
+
+		rtw_tdls_set_mac_id(ptdlsinfo, ptdls_sta);
+		rtw_tdls_set_key(adapter, prx_pkt_attrib, ptdls_sta);
+
+		rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_WRCR);
+
+	}
+	else //status code!=0 ; setup unsuccessful
+	{
+		free_tdls_sta(adapter, ptdls_sta);
+	}
+
+	return _FAIL;
+
+}
+
+sint On_TDLS_Setup_Cfm(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct sta_info *ptdls_sta= NULL;
+   	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	_irqL irqL;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa; 
+	u16 stat_code;
+	sint parsing_length;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =5;
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic, *ppairwise_cipher;
+	u16 j, pairwise_count;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+	_rtw_memcpy(&stat_code, ptr+2, 2);
+
+	if(stat_code!=0){
+		DBG_871X( "[%s] stat_code = %d\n, free_tdls_sta", __FUNCTION__, stat_code );
+		free_tdls_sta(adapter, ptdls_sta);
+		return _FAIL;
+	}
+
+	if(prx_pkt_attrib->encrypt){
+		//parsing information element
+		for(j=FIXED_IE; j<parsing_length;){
+
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+			switch (pIE->ElementID)
+			{
+				case _RSN_IE_2_:
+					prsnie=(u8*)pIE;
+					break;
+				case _VENDOR_SPECIFIC_IE_:
+					break;
+	 			case _FTIE_:
+					pftie=(u8*)pIE;
+					break;
+				case _TIMEOUT_ITVL_IE_:
+					ptimeout_ie=(u8*)pIE;
+					break;
+				case _HT_EXTRA_INFO_IE_:
+					break;
+	 			case _LINK_ID_IE_:
+					plinkid_ie=(u8*)pIE;
+					break;
+				default:
+					break;
+			}
+
+			j += (pIE->Length + 2);
+			
+		}
+
+		//verify mic in FTIE MIC field
+		if(tdls_verify_mic(ptdls_sta->tpk.kck, 3, plinkid_ie, prsnie, ptimeout_ie, pftie)==0){	//0: Invalid, 1: Valid
+			free_tdls_sta(adapter, ptdls_sta);
+			return _FAIL;
+		}
+
+	}
+
+	ptdlsinfo->setup_state = TDLS_LINKED_STATE;
+	if( ptdls_sta->tdls_sta_state & TDLS_INITIATOR_STATE )
+	{
+		ptdls_sta->tdls_sta_state|=TDLS_LINKED_STATE;
+		_cancel_timer_ex( &ptdls_sta->handshake_timer);
+#ifdef CONFIG_TDLS_AUTOCHECKALIVE
+		_set_timer( &ptdls_sta->alive_timer1, TDLS_ALIVE_TIMER_PH1);
+#endif //CONFIG_TDLS_AUTOCHECKALIVE
+	}
+
+	rtw_tdls_set_mac_id(ptdlsinfo, ptdls_sta);
+	rtw_tdls_set_key(adapter, prx_pkt_attrib, ptdls_sta);
+
+	rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_WRCR);
+	
+	return _FAIL;
+
+}
+
+sint On_TDLS_Dis_Req(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	struct sta_info *psta_ap;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	sint parsing_length;	//frame body length, without icv_len
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE = 3, *dst, *pdialog = NULL;
+	u16 j;
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len + LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE + 1;
+	pdialog=ptr+2;
+
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-TYPE_LENGTH_FIELD_SIZE
+			-1
+			-FIXED_IE;
+
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;){
+
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _LINK_ID_IE_:
+				psta_ap = rtw_get_stainfo(pstapriv, pIE->data);
+				if(psta_ap == NULL)
+				{
+					goto exit;
+				}
+				dst = pIE->data + 12;
+				if( (MacAddr_isBcst(dst) == _FALSE) && (_rtw_memcmp(myid(&(adapter->eeprompriv)), dst, 6) == _FALSE) )
+				{
+					goto exit;
+				}
+				break;
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+		
+	}
+
+	//check frame contents
+
+	issue_tdls_dis_rsp(adapter, precv_frame, *(pdialog) );
+
+exit:
+
+	return _FAIL;
+	
+}
+
+sint On_TDLS_Teardown(_adapter *adapter, union recv_frame *precv_frame)
+{
+	u8 *psa;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	struct mlme_ext_priv	*pmlmeext = &(adapter->mlmeextpriv);	
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv 	*pstapriv = &adapter->stapriv;
+	struct sta_info *ptdls_sta= NULL;
+	_irqL irqL;
+
+	psa = get_sa(ptr);
+
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+	if(ptdls_sta!=NULL){
+		if(ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE){
+			rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+		}
+		free_tdls_sta(adapter, ptdls_sta);
+	}
+		
+	return _FAIL;
+	
+}
+
+u8 TDLS_check_ch_state(uint state){
+	if(	(state & TDLS_CH_SWITCH_ON_STATE) &&
+		(state & TDLS_AT_OFF_CH_STATE) &&
+		(state & TDLS_PEER_AT_OFF_STATE) ){
+
+		if(state & TDLS_PEER_SLEEP_STATE)
+			return 2;	//U-APSD + ch. switch
+		else
+			return 1;	//ch. switch
+	}else
+		return 0;
+}
+
+//we process buffered data for 1. U-APSD, 2. ch. switch, 3. U-APSD + ch. switch here
+sint On_TDLS_Peer_Traffic_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+	struct rx_pkt_attrib	*pattrib = & precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	//get peer sta infomation
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->src);
+	u8 wmmps_ac=0, state=TDLS_check_ch_state(ptdls_sta->tdls_sta_state);
+	int i;
+	
+	ptdls_sta->sta_stats.rx_data_pkts++;
+
+	//receive peer traffic response frame, sleeping STA wakes up
+	//ptdls_sta->tdls_sta_state &= ~(TDLS_PEER_SLEEP_STATE);
+	process_wmmps_data( adapter, precv_frame);
+
+	// if noticed peer STA wakes up by receiving peer traffic response
+	// and we want to do channel swtiching, then we will transmit channel switch request first
+	if(ptdls_sta->tdls_sta_state & TDLS_APSD_CHSW_STATE){
+		issue_tdls_ch_switch_req(adapter, pattrib->src);
+		ptdls_sta->tdls_sta_state &= ~(TDLS_APSD_CHSW_STATE);
+		return  _FAIL;
+	}
+
+	//check 4-AC queue bit
+	if(ptdls_sta->uapsd_vo || ptdls_sta->uapsd_vi || ptdls_sta->uapsd_be || ptdls_sta->uapsd_bk)
+		wmmps_ac=1;
+
+	//if it's a direct link and have buffered frame
+	if(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE){
+		if(wmmps_ac && state)
+		{
+			_irqL irqL;	 
+			_list	*xmitframe_plist, *xmitframe_phead;
+			struct xmit_frame *pxmitframe=NULL;
+		
+			_enter_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);	
+
+			xmitframe_phead = get_list_head(&ptdls_sta->sleep_q);
+			xmitframe_plist = get_next(xmitframe_phead);
+
+			//transmit buffered frames
+			while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+			{			
+				pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+				xmitframe_plist = get_next(xmitframe_plist);
+				rtw_list_delete(&pxmitframe->list);
+
+				ptdls_sta->sleepq_len--;
+				if(ptdls_sta->sleepq_len>0){
+					pxmitframe->attrib.mdata = 1;
+					pxmitframe->attrib.eosp = 0;
+				}else{
+					pxmitframe->attrib.mdata = 0;
+					pxmitframe->attrib.eosp = 1;
+				}
+				//pxmitframe->attrib.triggered = 1;	//maybe doesn't need in TDLS
+				if(rtw_hal_xmit(adapter, pxmitframe) == _TRUE)
+				{		
+					rtw_os_xmit_complete(adapter, pxmitframe);
+				}
+
+			}
+
+			if(ptdls_sta->sleepq_len==0)
+			{
+				DBG_871X("no buffered packets for tdls to xmit\n");
+				//on U-APSD + CH. switch state, when there is no buffered date to xmit,
+				// we should go back to base channel
+				if(state==2){
+					rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+				}else if(ptdls_sta->tdls_sta_state&TDLS_SW_OFF_STATE){
+						ptdls_sta->tdls_sta_state &= ~(TDLS_SW_OFF_STATE);
+						ptdlsinfo->candidate_ch= pmlmeext->cur_channel;
+						issue_tdls_ch_switch_req(adapter, pattrib->src);
+						DBG_871X("issue tdls ch switch req back to base channel\n");
+				}
+				
+			}
+			else
+			{
+				DBG_871X("error!psta->sleepq_len=%d\n", ptdls_sta->sleepq_len);
+				ptdls_sta->sleepq_len=0;						
+			}
+
+			_exit_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);			
+		
+		}
+
+	}
+
+	return _FAIL;
+}
+
+sint On_TDLS_Ch_Switch_Req(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct sta_info *ptdls_sta= NULL;
+   	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa; 
+	sint parsing_length;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =3;
+	u16 j;
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+	
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+
+	ptdls_sta->off_ch = *(ptr+2);
+	
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;){
+
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _COUNTRY_IE_:
+				break;
+			case _CH_SWTICH_ANNOUNCE_:
+				break;
+ 			case _LINK_ID_IE_:
+				break;
+			case _CH_SWITCH_TIMING_:
+				_rtw_memcpy(&ptdls_sta->ch_switch_time, pIE->data, 2);
+				_rtw_memcpy(&ptdls_sta->ch_switch_timeout, pIE->data+2, 2);
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+		
+	}
+
+	//todo: check status
+	ptdls_sta->stat_code=0;
+	ptdls_sta->tdls_sta_state |= TDLS_CH_SWITCH_ON_STATE;
+
+	issue_nulldata(adapter, NULL, 1, 0, 0);
+
+	issue_tdls_ch_switch_rsp(adapter, psa);
+
+	DBG_871X("issue tdls channel switch response\n");
+
+	if((ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE) && ptdls_sta->off_ch==pmlmeext->cur_channel){
+		DBG_871X("back to base channel %x\n", pmlmeext->cur_channel);
+		ptdls_sta->option=7;
+		rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_BASE_CH);
+	}else{		
+		ptdls_sta->option=6;
+		rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_OFF_CH);
+	}
+	return _FAIL;
+}
+
+sint On_TDLS_Ch_Switch_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct sta_info *ptdls_sta= NULL;
+   	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa; 
+	sint parsing_length;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =4;
+	u16 stat_code, j, switch_time, switch_timeout;
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	//if channel switch is running and receiving Unsolicited TDLS Channel Switch Response,
+	//it will go back to base channel and terminate this channel switch procedure
+	if(ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE ){
+		if(pmlmeext->cur_channel==ptdls_sta->off_ch){
+			DBG_871X("back to base channel %x\n", pmlmeext->cur_channel);
+			ptdls_sta->option=7;
+			rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_OFF_CH);
+		}else{
+			DBG_871X("receive unsolicited channel switch response \n");
+			rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+		}
+		return _FAIL;
+	}
+
+	//avoiding duplicated or unconditional ch. switch. rsp
+	if((ptdls_sta->tdls_sta_state & TDLS_CH_SW_INITIATOR_STATE) != TDLS_CH_SW_INITIATOR_STATE)
+		return _FAIL;
+	
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+
+	_rtw_memcpy(&stat_code, ptr+2, 2);
+
+	if(stat_code!=0){
+		return _FAIL;
+	}
+	
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;){
+
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+ 			case _LINK_ID_IE_:
+				break;
+			case _CH_SWITCH_TIMING_:
+				_rtw_memcpy(&switch_time, pIE->data, 2);
+				if(switch_time > ptdls_sta->ch_switch_time)
+					_rtw_memcpy(&ptdls_sta->ch_switch_time, &switch_time, 2);
+
+				_rtw_memcpy(&switch_timeout, pIE->data+2, 2);
+				if(switch_timeout > ptdls_sta->ch_switch_timeout)
+					_rtw_memcpy(&ptdls_sta->ch_switch_timeout, &switch_timeout, 2);
+
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+		
+	}
+
+	ptdls_sta->tdls_sta_state &= ~(TDLS_CH_SW_INITIATOR_STATE);
+	ptdls_sta->tdls_sta_state |=TDLS_CH_SWITCH_ON_STATE;
+
+	//goto set_channel_workitem_callback()
+	ptdls_sta->option=6;
+	rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_OFF_CH);
+
+	return _FAIL;	
+}
+
+#ifdef CONFIG_WFD
+void wfd_ie_tdls(_adapter * padapter, u8 *pframe, u32 *pktlen )
+{
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info	*pwfd_info = padapter->tdlsinfo.wfd_info;
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 wfdielen = 0;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	available for WFD session + Preferred TDLS + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL 
+								| WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_WSD);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate( pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	//	Local IP Address ATTR
+	wfdie[ wfdielen++ ] = WFD_ATTR_LOCAL_IP_ADDR;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0005);
+	wfdielen += 2;
+
+	//	Version:
+	//	0x01: Version1;IPv4
+	wfdie[ wfdielen++ ] = 0x01;	
+
+	//	IPv4 Address
+	_rtw_memcpy( wfdie + wfdielen, pwfd_info->ip_address, 4 );
+	wfdielen += 4;
+	
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, pktlen);
+	
+}
+#endif //CONFIG_WFD
+
+void rtw_build_tdls_setup_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &pmlmeext->mlmext_info;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+	struct sta_info *ptdls_sta=rtw_get_stainfo( (&padapter->stapriv) , pattrib->dst);
+
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_TDLS;
+	u8 action = TDLS_SETUP_REQUEST;
+	u8 bssrate[NDIS_802_11_LENGTH_RATES_EX]; //Use NDIS_802_11_LENGTH_RATES_EX in order to call func.rtw_set_supported_rate
+ 	int	bssrate_len = 0, i = 0 ;
+	u8 more_supportedrates = 0;
+	unsigned int ie_len;
+	u8 *p;
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8 link_id_addr[18] = {0};
+	u8 iedata=0;
+	u8 sup_ch[ 30 * 2 ] = {0x00 }, sup_ch_idx = 0, idx_5g = 2;	//For supported channel
+	u8 timeout_itvl[5];	//set timeout interval to maximum value
+	u32 time;
+
+	//SNonce	
+	if(pattrib->encrypt){
+		for(i=0;i<8;i++){
+			time=rtw_get_current_time();
+			_rtw_memcpy(&ptdls_sta->SNonce[4*i], (u8 *)&time, 4);
+		}
+	}
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	//capability
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+
+	if(pattrib->encrypt)
+		*pframe =*pframe | BIT(4);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//supported rates
+	rtw_set_supported_rate(bssrate, WIRELESS_11BG_24N);
+	bssrate_len = IEEE80211_CCK_RATE_LEN + IEEE80211_NUM_OFDM_RATESLEN;
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		more_supportedrates = 1;
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+	//country(optional)
+	//extended supported rates
+	if(more_supportedrates==1){
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+
+	//supported channels
+	pframe = rtw_tdls_set_sup_ch(pmlmeext, pframe, pattrib);
+	
+	//	SRC IE
+	pframe = rtw_set_ie( pframe, _SRC_IE_, 16, TDLS_SRC, &(pattrib->pktlen));
+	
+	//RSNIE
+	if(pattrib->encrypt)
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+	
+	//extended capabilities
+	pframe = rtw_set_ie(pframe, _EXT_CAP_IE_ , 5, TDLS_EXT_CAPIE, &(pattrib->pktlen));
+
+	//QoS capability(WMM_IE)
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 7, TDLS_WMMIE,  &(pattrib->pktlen));
+
+
+	if(pattrib->encrypt){
+		//FTIE
+		_rtw_memset(pframe, 0, 84);	//All fields except SNonce shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		_rtw_memcpy((pframe+52), ptdls_sta->SNonce, 32);
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, (u8 *)(&ptdls_sta->TDLS_PeerKey_Lifetime), 4);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//Sup_reg_classes(optional)
+	//HT capabilities
+	pframe = rtw_tdls_set_ht_cap(padapter, pframe, pattrib);
+
+	//20/40 BSS coexistence
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+		iedata |= BIT(2);//20 MHz BSS Width Request
+	pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
+	
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+#ifdef CONFIG_WFD
+	wfd_ie_tdls( padapter, pframe, &(pattrib->pktlen) );
+#endif //CONFIG_WFD
+
+}
+
+void rtw_build_tdls_setup_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_info *ptdls_sta;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+
+	u8 payload_type = 0x02;	
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_SETUP_RESPONSE;
+	unsigned char	bssrate[NDIS_802_11_LENGTH_RATES_EX];	
+	int	bssrate_len = 0;
+	u8 more_supportedrates = 0;
+	unsigned int ie_len;
+	unsigned char *p;
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8 link_id_addr[18] = {0};
+	u8 iedata=0;
+	u8 timeout_itvl[5];	//setup response timeout interval will copy from request
+	u8 ANonce[32];	//maybe it can put in ontdls_req
+	u8 k;		//for random ANonce
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic;
+	u32 time;
+
+	ptdls_sta = rtw_get_stainfo( &(padapter->stapriv) , pattrib->dst);
+
+	if(ptdls_sta == NULL )
+	{
+		DBG_871X("[%s] %d\n", __FUNCTION__, __LINE__);
+		return;
+	}
+
+	if(pattrib->encrypt){
+		for(k=0;k<8;k++){
+			time=rtw_get_current_time();
+			_rtw_memcpy(&ptdls_sta->ANonce[4*k], (u8*)&time, 4);
+		}
+	}
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));	
+	//category, action, status code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 2, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+
+	if(ptdls_sta->stat_code!=0)	//invalid setup request
+	{
+		DBG_871X("ptdls_sta->stat_code:%04x \n", ptdls_sta->stat_code);		
+		return;
+	}
+	
+	//dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	//capability
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+
+	if(pattrib->encrypt )
+		*pframe =*pframe | BIT(4);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//supported rates
+	rtw_set_supported_rate(bssrate, WIRELESS_11BG_24N);
+	bssrate_len = IEEE80211_CCK_RATE_LEN + IEEE80211_NUM_OFDM_RATESLEN;
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		more_supportedrates = 1;
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+	//country(optional)
+	//extended supported rates
+	if(more_supportedrates==1){
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+
+	//supported channels
+	pframe = rtw_tdls_set_sup_ch(pmlmeext, pframe, pattrib);
+	
+	// SRC IE
+	pframe = rtw_set_ie(pframe, _SRC_IE_ , 16, TDLS_SRC, &(pattrib->pktlen));
+
+	//RSNIE
+	if(pattrib->encrypt){
+		prsnie = pframe;
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+	}
+
+	//extended capabilities
+	pframe = rtw_set_ie(pframe, _EXT_CAP_IE_ , 5, TDLS_EXT_CAPIE, &(pattrib->pktlen));
+
+	//QoS capability(WMM_IE)
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 7, TDLS_WMMIE,  &(pattrib->pktlen));
+
+	if(pattrib->encrypt){
+		wpa_tdls_generate_tpk(padapter, ptdls_sta);
+
+		//FTIE
+		pftie = pframe;
+		pftie_mic = pframe+4;
+		_rtw_memset(pframe, 0, 84);	//All fields except SNonce shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		_rtw_memcpy((pframe+20), ptdls_sta->ANonce, 32);
+		_rtw_memcpy((pframe+52), ptdls_sta->SNonce, 32);
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		ptimeout_ie = pframe;
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, (u8 *)(&ptdls_sta->TDLS_PeerKey_Lifetime), 4);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//Sup_reg_classes(optional)
+	//HT capabilities
+	pframe = rtw_tdls_set_ht_cap(padapter, pframe, pattrib);
+
+	//20/40 BSS coexistence
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+		iedata |= BIT(2);//20 MHz BSS Width Request
+	pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
+
+	//Link identifier
+	plinkid_ie = pframe;
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->dst, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->src, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//fill FTIE mic
+	if(pattrib->encrypt)
+		wpa_tdls_ftie_mic(ptdls_sta->tpk.kck, 2, plinkid_ie, prsnie, ptimeout_ie, pftie, pftie_mic);
+
+#ifdef CONFIG_WFD
+	wfd_ie_tdls( padapter, pframe, &(pattrib->pktlen) );
+#endif //CONFIG_WFD
+
+}
+
+void rtw_build_tdls_setup_cfm_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_info *ptdls_sta=rtw_get_stainfo( (&padapter->stapriv) , pattrib->dst);
+
+	u8 payload_type = 0x02;	
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_SETUP_CONFIRM;
+	u8 more_supportedrates = 0;
+	unsigned int ie_len;
+	unsigned char *p;
+	u8 timeout_itvl[5];	//set timeout interval to maximum value
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8	link_id_addr[18] = {0};
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, status code, dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 2, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	if(ptdls_sta->stat_code!=0)	//invalid setup request
+		return;
+	
+	//RSNIE
+	if(pattrib->encrypt){
+		prsnie = pframe;
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+	}
+	
+	//EDCA param set; WMM param ele.
+	if(pattrib->encrypt){
+		//FTIE
+		pftie = pframe;
+		pftie_mic = pframe+4;
+		_rtw_memset(pframe, 0, 84);	//All fields except SNonce shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		_rtw_memcpy((pframe+20), ptdls_sta->ANonce, 32);
+		_rtw_memcpy((pframe+52), ptdls_sta->SNonce, 32);
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		ptimeout_ie = pframe;
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, (u8 *)(&ptdls_sta->TDLS_PeerKey_Lifetime), 4);
+		ptdls_sta->TPK_count=0;
+		_set_timer(&ptdls_sta->TPK_timer, ptdls_sta->TDLS_PeerKey_Lifetime/TPK_RESEND_COUNT);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//HT operation; todo
+	//Link identifier
+	plinkid_ie = pframe;
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//fill FTIE mic
+	if(pattrib->encrypt)
+		wpa_tdls_ftie_mic(ptdls_sta->tpk.kck, 3, plinkid_ie, prsnie, ptimeout_ie, pftie, pftie_mic);
+
+}
+
+void rtw_build_tdls_teardown_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_TEARDOWN;
+	u8	link_id_addr[18] = {0};
+	
+	struct sta_info *ptdls_sta = rtw_get_stainfo( &(padapter->stapriv) , pattrib->dst);
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));	
+	//category, action, reason code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+
+	//Link identifier
+	if(ptdls_sta->tdls_sta_state & TDLS_INITIATOR_STATE){	
+		_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+		_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+		_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	}else  if(ptdls_sta->tdls_sta_state & TDLS_RESPONDER_STATE){
+		_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+		_rtw_memcpy((link_id_addr+6), pattrib->dst, 6);
+		_rtw_memcpy((link_id_addr+12), pattrib->src, 6);
+	}
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+	
+}
+
+void rtw_build_tdls_dis_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_TDLS;
+	u8 action = TDLS_DISCOVERY_REQUEST;
+	u8	link_id_addr[18] = {0};
+	static u8 dialogtoken=0;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));		
+	//category, action, reason code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogtoken), &(pattrib->pktlen));
+	dialogtoken = (dialogtoken+1)%256;
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+	
+}
+
+void rtw_build_tdls_dis_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe, u8 dialog)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &pmlmeext->mlmext_info;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+
+	u8 category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8 action = TDLS_DISCOVERY_RESPONSE;
+	u8 bssrate[NDIS_802_11_LENGTH_RATES_EX];
+ 	int bssrate_len = 0;
+	u8 more_supportedrates = 0;
+	u8 *p;
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8 link_id_addr[18] = {0};
+	u8 iedata=0;
+	u8 timeout_itvl[5];	//set timeout interval to maximum value
+	u32 timeout_interval= TPK_RESEND_COUNT * 1000;
+	
+	//category, action, dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialog), &(pattrib->pktlen));
+
+	//capability
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+
+	if(pattrib->encrypt)
+		*pframe =*pframe | BIT(4);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//supported rates
+	rtw_set_supported_rate(bssrate, WIRELESS_11BG_24N);
+	bssrate_len = IEEE80211_CCK_RATE_LEN + IEEE80211_NUM_OFDM_RATESLEN;
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		more_supportedrates = 1;
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+	//extended supported rates
+	if(more_supportedrates==1){
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+
+	//supported channels
+	pframe = rtw_tdls_set_sup_ch(pmlmeext, pframe, pattrib);
+
+	//RSNIE
+	if(pattrib->encrypt)
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+	
+	//extended capability
+	pframe = rtw_set_ie(pframe, _EXT_CAP_IE_ , 5, TDLS_EXT_CAPIE, &(pattrib->pktlen));
+
+	if(pattrib->encrypt){
+		//FTIE
+		_rtw_memset(pframe, 0, 84);	//All fields shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, &timeout_interval, 4);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//Sup_reg_classes(optional)
+	//HT capabilities
+	pframe = rtw_tdls_set_ht_cap(padapter, pframe, pattrib);
+
+	//20/40 BSS coexistence
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+		iedata |= BIT(2);//20 MHz BSS Width Request
+	pframe = rtw_set_ie(pframe, EID_BSSCoexistence, 1, &iedata, &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->dst, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->src, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_, 18, link_id_addr, &(pattrib->pktlen));
+	
+}
+
+void rtw_build_tdls_peer_traffic_indication_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_PEER_TRAFFIC_INDICATION;
+
+	u8	link_id_addr[18] = {0};
+	u8 AC_queue=0;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;	
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));	
+	//category, action, reason code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//PTI control
+	//PU buffer status
+	if(ptdls_sta->uapsd_bk&BIT(1))
+		AC_queue=BIT(0);
+	if(ptdls_sta->uapsd_be&BIT(1))
+		AC_queue=BIT(1);
+	if(ptdls_sta->uapsd_vi&BIT(1))
+		AC_queue=BIT(2);
+	if(ptdls_sta->uapsd_vo&BIT(1))
+		AC_queue=BIT(3);
+	pframe = rtw_set_ie(pframe, _PTI_BUFFER_STATUS_, 1, &AC_queue, &(pattrib->pktlen));
+	
+}
+
+void rtw_build_tdls_ch_switch_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_CHANNEL_SWITCH_REQUEST;
+	u8	link_id_addr[18] = {0};
+	struct sta_priv 	*pstapriv = &padapter->stapriv;	
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+	u8 ch_switch_timing[4] = {0};
+	u16 switch_time= CH_SWITCH_TIME, switch_timeout=CH_SWITCH_TIMEOUT;	
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));	
+	//category, action, target_ch
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdlsinfo->candidate_ch), &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//ch switch timing
+	_rtw_memcpy(ch_switch_timing, &switch_time, 2);
+	_rtw_memcpy(ch_switch_timing+2, &switch_timeout, 2);
+	pframe = rtw_set_ie(pframe, _CH_SWITCH_TIMING_,  4, ch_switch_timing, &(pattrib->pktlen));
+
+	//update ch switch attrib to sta_info
+	ptdls_sta->off_ch=ptdlsinfo->candidate_ch;
+	ptdls_sta->ch_switch_time=switch_time;
+	ptdls_sta->ch_switch_timeout=switch_timeout;
+
+}
+
+void rtw_build_tdls_ch_switch_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_CHANNEL_SWITCH_RESPONSE;
+	u8	link_id_addr[18] = {0};
+	struct sta_priv 	*pstapriv = &padapter->stapriv;	
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+	u8 ch_switch_timing[4] = {0};
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));	
+	//category, action, status_code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 2, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//ch switch timing
+	_rtw_memcpy(ch_switch_timing, &ptdls_sta->ch_switch_time, 2);
+	_rtw_memcpy(ch_switch_timing+2, &ptdls_sta->ch_switch_timeout, 2);
+	pframe = rtw_set_ie(pframe, _CH_SWITCH_TIMING_,  4, ch_switch_timing, &(pattrib->pktlen));
+
+}
+
+#ifdef CONFIG_WFD
+void rtw_build_tunneled_probe_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct wifidirect_info *pbuddy_wdinfo = &padapter->pbuddy_adapter->wdinfo;
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_P2P;
+	u8 WFA_OUI[3] = { 0x50, 0x6f, 0x9a};
+	u8 probe_req = 4;
+	u8 wfdielen = 0;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));		
+	//category, OUI, frame_body_type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 3, WFA_OUI, &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(probe_req), &(pattrib->pktlen));
+
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_req_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+	else if(!rtw_p2p_chk_state(pbuddy_wdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_req_wfd_ie(pbuddy_wdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+	
+}
+
+void rtw_build_tunneled_probe_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct wifidirect_info *pbuddy_wdinfo = &padapter->pbuddy_adapter->wdinfo;
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_P2P;
+	u8 WFA_OUI[3] = { 0x50, 0x6f, 0x9a};
+	u8 probe_rsp = 5;
+	u8 wfdielen = 0;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));		
+	//category, OUI, frame_body_type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 3, WFA_OUI, &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(probe_rsp), &(pattrib->pktlen));
+
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_resp_wfd_ie(pwdinfo, pframe, 1);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+	else if(!rtw_p2p_chk_state(pbuddy_wdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_resp_wfd_ie(pbuddy_wdinfo, pframe, 1);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+
+}
+#endif //CONFIG_WFD
+
+void _TPK_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+
+	ptdls_sta->TPK_count++;
+	//TPK_timer set 1000 as default
+	//retry timer should set at least 301 sec.
+	if(ptdls_sta->TPK_count==TPK_RESEND_COUNT){
+		ptdls_sta->TPK_count=0;
+		issue_tdls_setup_req(ptdls_sta->padapter, ptdls_sta->hwaddr);
+	}
+	
+	_set_timer(&ptdls_sta->TPK_timer, ptdls_sta->TDLS_PeerKey_Lifetime/TPK_RESEND_COUNT);
+}
+
+void init_TPK_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+
+	_init_timer(&psta->TPK_timer, padapter->pnetdev, _TPK_timer_hdl, psta);
+}
+
+// TDLS_DONE_CH_SEN: channel sensing and report candidate channel
+// TDLS_OFF_CH: first time set channel to off channel
+// TDLS_BASE_CH: when go back to the channel linked with AP, send null data to peer STA as an indication
+void _ch_switch_timer_hdl(void *FunctionContext)
+{
+
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	_adapter *padapter = ptdls_sta->padapter;
+	
+	if( ptdls_sta->option == TDLS_DONE_CH_SEN ){
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_DONE_CH_SEN);
+	}else if( ptdls_sta->option == TDLS_OFF_CH ){
+		issue_nulldata_to_TDLS_peer_STA(ptdls_sta->padapter, ptdls_sta, 0);
+		_set_timer(&ptdls_sta->base_ch_timer, 500);
+	}else if( ptdls_sta->option == TDLS_BASE_CH){
+		issue_nulldata_to_TDLS_peer_STA(ptdls_sta->padapter, ptdls_sta, 0);
+	}
+}
+
+void init_ch_switch_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->option_timer, padapter->pnetdev, _ch_switch_timer_hdl, psta);
+}
+
+void _base_ch_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	rtw_tdls_cmd(ptdls_sta->padapter, ptdls_sta->hwaddr, TDLS_P_OFF_CH);
+}
+
+void init_base_ch_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->base_ch_timer, padapter->pnetdev, _base_ch_timer_hdl, psta);
+}
+
+void _off_ch_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	rtw_tdls_cmd(ptdls_sta->padapter, ptdls_sta->hwaddr, TDLS_P_BASE_CH );
+}
+	
+void init_off_ch_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->off_ch_timer, padapter->pnetdev, _off_ch_timer_hdl, psta);
+}
+
+void _tdls_handshake_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+
+	if(ptdls_sta != NULL)
+	{
+		if( !(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE) )
+		{
+			DBG_871X("tdls handshake time out\n");
+			free_tdls_sta(ptdls_sta->padapter, ptdls_sta);
+		}
+	}
+}
+
+void init_handshake_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->handshake_timer, padapter->pnetdev, _tdls_handshake_timer_hdl, psta);
+}
+
+//Check tdls peer sta alive.
+void _tdls_alive_timer_phase1_hdl(void *FunctionContext)
+{
+	_irqL irqL;
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	_adapter *padapter = ptdls_sta->padapter;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	
+	_enter_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+	ptdls_sta->timer_flag = 1;
+	_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+
+	ptdls_sta->tdls_sta_state &= (~TDLS_ALIVE_STATE);
+
+	DBG_871X("issue_tdls_dis_req to check alive\n");
+	issue_tdls_dis_req( padapter, ptdls_sta->hwaddr);
+	rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CKALV_PH1);
+	sta_update_last_rx_pkts(ptdls_sta);
+
+	if (	ptdls_sta->timer_flag == 2 )
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_FREE_STA);		
+	else
+	{
+		_enter_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+		ptdls_sta->timer_flag = 0;
+		_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+	}
+
+}
+
+void _tdls_alive_timer_phase2_hdl(void *FunctionContext)
+{
+	_irqL irqL;
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	_adapter *padapter = ptdls_sta->padapter;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	
+	_enter_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+	ptdls_sta->timer_flag = 1;
+	_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+
+	if( (ptdls_sta->tdls_sta_state & TDLS_ALIVE_STATE) && 
+		(sta_last_rx_pkts(ptdls_sta) + 3 <= sta_rx_pkts(ptdls_sta)) )
+	{
+		DBG_871X("TDLS STA ALIVE, ptdls_sta->sta_stats.last_rx_pkts:%llu, ptdls_sta->sta_stats.rx_pkts:%llu\n",
+			sta_last_rx_pkts(ptdls_sta), sta_rx_pkts(ptdls_sta));
+
+		ptdls_sta->alive_count = 0;
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CKALV_PH2);
+	}
+	else
+	{
+		if( !(ptdls_sta->tdls_sta_state & TDLS_ALIVE_STATE) )
+			DBG_871X("TDLS STA TOO FAR\n");
+		if( !(sta_last_rx_pkts(ptdls_sta) + 3 <= sta_rx_pkts(ptdls_sta)))
+			DBG_871X("TDLS LINK WITH LOW TRAFFIC, ptdls_sta->sta_stats.last_rx_pkts:%llu, ptdls_sta->sta_stats.rx_pkts:%llu\n",
+				sta_last_rx_pkts(ptdls_sta), sta_rx_pkts(ptdls_sta));
+
+		ptdls_sta->alive_count++;
+		if( ptdls_sta->alive_count == TDLS_ALIVE_COUNT )
+		{
+			ptdls_sta->stat_code = _RSON_TDLS_TEAR_TOOFAR_;
+			issue_tdls_teardown(padapter, ptdls_sta->hwaddr);
+		}
+		else
+		{
+			rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CKALV_PH2);
+		}
+	}
+
+	if (	ptdls_sta->timer_flag == 2 )
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_FREE_STA);		
+	else
+	{
+		_enter_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+		ptdls_sta->timer_flag = 0;
+		_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+}
+
+}
+
+void init_tdls_alive_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->alive_timer1, padapter->pnetdev, _tdls_alive_timer_phase1_hdl, psta);
+	_init_timer(&psta->alive_timer2, padapter->pnetdev, _tdls_alive_timer_phase2_hdl, psta);
+}
+
+int update_sgi_tdls(_adapter *padapter, struct sta_info *psta)
+{
+	struct ht_priv	*psta_ht = NULL;
+	psta_ht = &psta->htpriv;
+
+	if(psta_ht->ht_option)
+	{
+		return psta_ht->sgi;
+	}
+	else
+		return _FALSE;
+}
+
+u32 update_mask_tdls(_adapter *padapter, struct sta_info *psta)
+{
+	int i;
+	u8 rf_type, id;
+	unsigned char sta_band = 0;
+	unsigned char limit;	
+	unsigned int tx_ra_bitmap=0;
+	struct ht_priv	*psta_ht = NULL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pcur_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+
+	psta_ht = &psta->htpriv;
+	//b/g mode ra_bitmap  
+	for (i=0; i<sizeof(psta->bssrateset); i++)
+	{
+		if (psta->bssrateset[i])
+			tx_ra_bitmap |= rtw_get_bit_value_from_ieee_value(psta->bssrateset[i]&0x7f);
+	}
+
+	//n mode ra_bitmap
+	if(psta_ht->ht_option) 
+	{
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		if(rf_type == RF_2T2R)
+			limit=16;// 2R
+		else
+			limit=8;//  1R
+
+		for (i=0; i<limit; i++) {
+			if (psta_ht->ht_cap.supp_mcs_set[i/8] & BIT(i%8))
+				tx_ra_bitmap |= BIT(i+12);
+		}
+	}
+
+	if ( pcur_network->Configuration.DSConfig > 14 ) {
+		// 5G band
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_5N | WIRELESS_11A;
+		else
+			sta_band |= WIRELESS_11A;
+	} else {
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_24N | WIRELESS_11G | WIRELESS_11B;
+		else if (tx_ra_bitmap & 0xff0)
+			sta_band |= WIRELESS_11G |WIRELESS_11B;
+		else
+			sta_band |= WIRELESS_11B;
+	}
+
+	id = networktype_to_raid(sta_band);
+	tx_ra_bitmap |= ((id<<28)&0xf0000000);
+	return tx_ra_bitmap;
+}
+
+#endif //CONFIG_TDLS
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c
new file mode 100755
index 0000000000000..051445cba2f04
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c
@@ -0,0 +1,2305 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_WLAN_UTIL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+
+
+unsigned char ARTHEROS_OUI1[] = {0x00, 0x03, 0x7f};
+unsigned char ARTHEROS_OUI2[] = {0x00, 0x13, 0x74};
+
+unsigned char BROADCOM_OUI1[] = {0x00, 0x10, 0x18};
+unsigned char BROADCOM_OUI2[] = {0x00, 0x0a, 0xf7};
+unsigned char BROADCOM_OUI3[] = {0x00, 0x05, 0xb5};
+
+unsigned char CISCO_OUI[] = {0x00, 0x40, 0x96};
+unsigned char MARVELL_OUI[] = {0x00, 0x50, 0x43};
+unsigned char RALINK_OUI[] = {0x00, 0x0c, 0x43};
+unsigned char REALTEK_OUI[] = {0x00, 0xe0, 0x4c};
+unsigned char AIRGOCAP_OUI[] = {0x00, 0x0a, 0xf5};
+
+unsigned char REALTEK_96B_IE[] = {0x00, 0xe0, 0x4c, 0x02, 0x01, 0x20};
+
+extern unsigned char	MCS_rate_2R[16];
+#ifdef CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_2R_MCS13TO15_OFF[16];
+#endif //CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_1R[16];
+extern unsigned char RTW_WPA_OUI[];
+extern unsigned char WPA_TKIP_CIPHER[4];
+extern unsigned char RSN_TKIP_CIPHER[4];
+
+#define R2T_PHY_DELAY	(0)
+
+//#define WAIT_FOR_BCN_TO_MIN	(3000)
+#define WAIT_FOR_BCN_TO_MIN	(6000)
+#define WAIT_FOR_BCN_TO_MAX	(20000)
+
+static u8 rtw_basic_rate_cck[4] = {
+	IEEE80211_CCK_RATE_1MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_2MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_CCK_RATE_5MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_11MB|IEEE80211_BASIC_RATE_MASK
+};
+
+static u8 rtw_basic_rate_ofdm[3] = {
+	IEEE80211_OFDM_RATE_6MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_OFDM_RATE_12MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_OFDM_RATE_24MB|IEEE80211_BASIC_RATE_MASK
+};
+
+static u8 rtw_basic_rate_mix[7] = {
+	IEEE80211_CCK_RATE_1MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_2MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_CCK_RATE_5MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_11MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_OFDM_RATE_6MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_OFDM_RATE_12MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_OFDM_RATE_24MB|IEEE80211_BASIC_RATE_MASK
+};
+
+
+int cckrates_included(unsigned char *rate, int ratelen)
+{
+	int	i;
+	
+	for(i = 0; i < ratelen; i++)
+	{
+		if  (  (((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||
+			   (((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22) )
+		return _TRUE;	
+	}
+
+	return _FALSE;
+
+}
+
+int cckratesonly_included(unsigned char *rate, int ratelen)
+{
+	int	i;
+	
+	for(i = 0; i < ratelen; i++)
+	{
+		if  ( (((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+			   (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22) )
+		return _FALSE;	
+	}
+	
+	return _TRUE;
+}
+
+unsigned char networktype_to_raid(unsigned char network_type)
+{
+	unsigned char raid;
+
+	switch(network_type)
+	{
+		case WIRELESS_11B:
+			raid = 6;
+			break;
+		case WIRELESS_11A:
+		case WIRELESS_11G:
+			raid = 5;
+			break;
+		case WIRELESS_11BG:
+			raid = 4;
+			break;
+		case WIRELESS_11_24N:
+		case WIRELESS_11_5N:
+			raid = 3;
+			break;
+		case WIRELESS_11A_5N:
+		case WIRELESS_11G_24N:
+			raid = 1;
+			break;
+		case WIRELESS_11BG_24N:
+			raid = 0;
+			break;
+		default:
+			raid = 4;
+			break;	
+
+	}
+
+	return raid;
+	
+}
+
+int judge_network_type(_adapter *padapter, unsigned char *rate, int ratelen)
+{
+	int network_type = 0;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+
+	if(pmlmeext->cur_channel > 14)
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_5N;
+		}
+	
+		network_type |= WIRELESS_11A;
+	}
+	else
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_24N;
+		}
+
+		if ((cckratesonly_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11B;
+		}
+		else if((cckrates_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11BG;
+		}
+		else
+		{
+			network_type |= WIRELESS_11G;
+		}
+	}
+		
+	return 	network_type;
+}
+
+unsigned char ratetbl_val_2wifirate(unsigned char rate);
+unsigned char ratetbl_val_2wifirate(unsigned char rate)
+{
+	unsigned char val = 0;
+
+	switch (rate & 0x7f) 
+	{
+		case 0:
+			val = IEEE80211_CCK_RATE_1MB;
+			break;
+
+		case 1:
+			val = IEEE80211_CCK_RATE_2MB;
+			break;
+
+		case 2:
+			val = IEEE80211_CCK_RATE_5MB;
+			break;
+
+		case 3:
+			val = IEEE80211_CCK_RATE_11MB;
+			break;
+			
+		case 4:
+			val = IEEE80211_OFDM_RATE_6MB;
+			break;
+
+		case 5:
+			val = IEEE80211_OFDM_RATE_9MB;
+			break;
+
+		case 6:
+			val = IEEE80211_OFDM_RATE_12MB;
+			break;
+			
+		case 7:
+			val = IEEE80211_OFDM_RATE_18MB;
+			break;
+
+		case 8:
+			val = IEEE80211_OFDM_RATE_24MB;
+			break;
+			
+		case 9:
+			val = IEEE80211_OFDM_RATE_36MB;
+			break;
+
+		case 10:
+			val = IEEE80211_OFDM_RATE_48MB;
+			break;
+		
+		case 11:
+			val = IEEE80211_OFDM_RATE_54MB;
+			break;
+
+	}
+
+	return val;
+
+}
+
+int is_basicrate(_adapter *padapter, unsigned char rate);
+int is_basicrate(_adapter *padapter, unsigned char rate)
+{
+	int i;
+	unsigned char val;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	
+	for(i = 0; i < NumRates; i++)
+	{
+		val = pmlmeext->basicrate[i];
+
+		if ((val != 0xff) && (val != 0xfe))
+		{
+			if (rate == ratetbl_val_2wifirate(val))
+			{
+				return _TRUE;
+			}
+		}
+	}
+	
+	return _FALSE;
+}
+
+unsigned int ratetbl2rateset(_adapter *padapter, unsigned char *rateset);
+unsigned int ratetbl2rateset(_adapter *padapter, unsigned char *rateset)
+{
+	int i;
+	unsigned char rate;
+	unsigned int	len = 0;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	for (i = 0; i < NumRates; i++)
+	{
+		rate = pmlmeext->datarate[i];
+
+		switch (rate)
+		{
+			case 0xff:
+				return len;
+				
+			case 0xfe:
+				continue;
+				
+			default:
+				rate = ratetbl_val_2wifirate(rate);
+
+				if (is_basicrate(padapter, rate) == _TRUE)
+				{
+					rate |= IEEE80211_BASIC_RATE_MASK;
+				}
+				
+				rateset[len] = rate;
+				len++;
+				break;
+		}
+	}
+	return len;
+}
+
+
+void get_rate_set(_adapter *padapter, unsigned char *pbssrate, int *bssrate_len)
+{
+	unsigned char supportedrates[NumRates];
+
+	_rtw_memset(supportedrates, 0, NumRates);
+	*bssrate_len = ratetbl2rateset(padapter, supportedrates);
+	_rtw_memcpy(pbssrate, supportedrates, *bssrate_len);
+}
+
+void UpdateBrateTbl(
+	IN PADAPTER		Adapter,
+	IN u8			*mBratesOS
+)
+{
+	u8	i;
+	u8	rate;
+
+	// 1M, 2M, 5.5M, 11M, 6M, 12M, 24M are mandatory.
+	for(i=0;i<NDIS_802_11_LENGTH_RATES_EX;i++)
+	{
+		rate = mBratesOS[i] & 0x7f;
+		switch(rate)
+		{
+			case IEEE80211_CCK_RATE_1MB:
+			case IEEE80211_CCK_RATE_2MB:
+			case IEEE80211_CCK_RATE_5MB:
+			case IEEE80211_CCK_RATE_11MB:
+			case IEEE80211_OFDM_RATE_6MB:
+			case IEEE80211_OFDM_RATE_12MB:
+			case IEEE80211_OFDM_RATE_24MB:
+				mBratesOS[i] |= IEEE80211_BASIC_RATE_MASK;
+				break;
+		}
+	}
+
+}
+
+void UpdateBrateTblForSoftAP(u8 *bssrateset, u32 bssratelen)
+{
+	u8	i;
+	u8	rate;
+
+	for(i=0;i<bssratelen;i++)
+	{
+		rate = bssrateset[i] & 0x7f;
+		switch(rate)
+		{
+			case IEEE80211_CCK_RATE_1MB:
+			case IEEE80211_CCK_RATE_2MB:
+			case IEEE80211_CCK_RATE_5MB:
+			case IEEE80211_CCK_RATE_11MB:
+				bssrateset[i] |= IEEE80211_BASIC_RATE_MASK;
+				break;
+		}
+	}
+
+}
+
+void Save_DM_Func_Flag(_adapter *padapter)
+{
+	u8	bSaveFlag = _TRUE;
+
+#ifdef CONFIG_CONCURRENT_MODE	
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+	if(pbuddy_adapter)
+	rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+#endif
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+
+}
+
+void Restore_DM_Func_Flag(_adapter *padapter)
+{
+	u8	bSaveFlag = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE	
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+	if(pbuddy_adapter)
+	rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+#endif
+	rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+}
+
+void Switch_DM_Func(_adapter *padapter, u8 mode, u8 enable)
+{
+#ifdef CONFIG_CONCURRENT_MODE	
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+#endif
+
+	if(enable == _TRUE)
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if(pbuddy_adapter)
+		rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_SET, (u8 *)(&mode));
+#endif
+		rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_SET, (u8 *)(&mode));
+	}
+	else
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if(pbuddy_adapter)
+		rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_CLR, (u8 *)(&mode));
+#endif
+		rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_CLR, (u8 *)(&mode));
+	}
+
+#if 0
+	u8 val8;
+
+	val8 = rtw_read8(padapter, FW_DYNAMIC_FUN_SWITCH);
+
+	if(enable == _TRUE)
+	{
+		rtw_write8(padapter, FW_DYNAMIC_FUN_SWITCH, (val8 | mode));
+	}
+	else
+	{
+		rtw_write8(padapter, FW_DYNAMIC_FUN_SWITCH, (val8 & mode));
+	}
+#endif
+
+}
+
+static void Set_NETYPE1_MSR(_adapter *padapter, u8 type)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_MEDIA_STATUS1, (u8 *)(&type));
+}
+
+static void Set_NETYPE0_MSR(_adapter *padapter, u8 type)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_MEDIA_STATUS, (u8 *)(&type));
+}
+
+void Set_MSR(_adapter *padapter, u8 type)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type == IFACE_PORT1)
+	{
+		Set_NETYPE1_MSR(padapter, type);
+	}
+	else
+#endif
+	{
+		Set_NETYPE0_MSR(padapter, type);
+	}
+}
+
+inline u8 rtw_get_oper_ch(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->oper_channel;
+}
+
+inline void rtw_set_oper_ch(_adapter *adapter, u8 ch)
+{
+	if (adapter_to_dvobj(adapter)->oper_channel != ch)
+		adapter_to_dvobj(adapter)->on_oper_ch_time = rtw_get_current_time();
+
+	adapter_to_dvobj(adapter)->oper_channel = ch;
+}
+
+inline u8 rtw_get_oper_bw(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->oper_bwmode;
+}
+
+inline void rtw_set_oper_bw(_adapter *adapter, u8 bw)
+{
+	adapter_to_dvobj(adapter)->oper_bwmode = bw;
+}
+
+inline u8 rtw_get_oper_choffset(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->oper_ch_offset;
+}
+
+inline void rtw_set_oper_choffset(_adapter *adapter, u8 offset)
+{
+	adapter_to_dvobj(adapter)->oper_ch_offset = offset;
+}
+
+inline u32 rtw_get_on_oper_ch_time(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->on_oper_ch_time;
+}
+
+inline u32 rtw_get_on_cur_ch_time(_adapter *adapter)
+{
+	if (adapter->mlmeextpriv.cur_channel == adapter_to_dvobj(adapter)->oper_channel)
+		return adapter_to_dvobj(adapter)->on_oper_ch_time;
+	else
+		return 0;
+}
+
+void SelectChannel(_adapter *padapter, unsigned char channel)
+{
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;	
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	//saved channel info
+	rtw_set_oper_ch(padapter, channel);
+	dc_SelectChannel(padapter, channel);
+#else //CONFIG_DUALMAC_CONCURRENT
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+	
+	//saved channel info
+	rtw_set_oper_ch(padapter, channel);
+
+	rtw_hal_set_chan(padapter, channel);
+	
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+
+#endif // CONFIG_DUALMAC_CONCURRENT
+}
+
+void SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset)
+{
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	//saved bw info
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+	dc_SetBWMode(padapter, bwmode, channel_offset);
+#else //CONFIG_DUALMAC_CONCURRENT
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->setbw_mutex), NULL);
+
+	//saved bw info
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+
+	rtw_hal_set_bwmode(padapter, (HT_CHANNEL_WIDTH)bwmode, channel_offset);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->setbw_mutex), NULL);
+
+#endif // CONFIG_DUALMAC_CONCURRENT
+}
+
+void set_channel_bwmode(_adapter *padapter, unsigned char channel, unsigned char channel_offset, unsigned short bwmode)
+{
+	u8 center_ch;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	if ( padapter->bNotifyChannelChange )
+	{
+		DBG_871X( "[%s] ch = %d, offset = %d, bwmode = %d\n", __FUNCTION__, channel, channel_offset, bwmode );
+	}
+
+	if((bwmode == HT_CHANNEL_WIDTH_20)||(channel_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE))
+	{
+		//SelectChannel(padapter, channel);
+		center_ch = channel;
+	}
+	else		
+	{
+		//switch to the proper channel
+		if (channel_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+		{
+			//SelectChannel(padapter, channel + 2);
+			center_ch = channel + 2;
+		}
+		else
+		{
+			//SelectChannel(padapter, channel - 2);
+			center_ch = channel - 2;
+		}
+	}	
+
+	//set Channel , must be independant for correct co_ch value/
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	//saved channel/bw info
+	rtw_set_oper_ch(padapter, channel);
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+	dc_SelectChannel(padapter, center_ch);// set center channel
+#else //CONFIG_DUALMAC_CONCURRENT
+	
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+	
+	//saved channel/bw info
+	rtw_set_oper_ch(padapter, channel);
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+
+	rtw_hal_set_chan(padapter, center_ch);
+
+        _exit_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+
+#endif // CONFIG_DUALMAC_CONCURRENT
+
+
+	//set BandWidth
+	SetBWMode(padapter, bwmode, channel_offset);
+	
+}
+
+int get_bsstype(unsigned short capability)
+{
+	if (capability & BIT(0))
+	{
+		return WIFI_FW_AP_STATE;
+	}
+	else if (capability & BIT(1))
+	{
+		return WIFI_FW_ADHOC_STATE;
+	}
+	else
+	{
+		return 0;		
+	}
+}
+
+__inline u8 *get_my_bssid(WLAN_BSSID_EX *pnetwork)
+{	
+	return (pnetwork->MacAddress); 
+}
+
+u16 get_beacon_interval(WLAN_BSSID_EX *bss)
+{
+	unsigned short val;
+	_rtw_memcpy((unsigned char *)&val, rtw_get_beacon_interval_from_ie(bss->IEs), 2);
+
+	return le16_to_cpu(val);	
+
+}
+
+int is_client_associated_to_ap(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext;
+	struct mlme_ext_info	*pmlmeinfo;
+
+	if(!padapter)
+		return _FAIL;
+
+	pmlmeext = &padapter->mlmeextpriv;
+	pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	if ((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE))
+	{
+		return _TRUE;
+	}
+	else
+	{
+		return _FAIL;
+	}
+}
+
+int is_client_associated_to_ibss(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	if ((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE))
+	{
+		return _TRUE;
+	}
+	else
+	{
+		return _FAIL;
+	}
+}
+
+int is_IBSS_empty(_adapter *padapter)
+{
+	unsigned int i;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	for (i = IBSS_START_MAC_ID; i < NUM_STA; i++)
+	{
+		if (pmlmeinfo->FW_sta_info[i].status == 1)
+		{
+			return _FAIL;
+		}
+	}
+	
+	return _TRUE;
+	
+}
+
+unsigned int decide_wait_for_beacon_timeout(unsigned int bcn_interval)
+{
+	if ((bcn_interval << 2) < WAIT_FOR_BCN_TO_MIN)
+	{
+		return WAIT_FOR_BCN_TO_MIN;
+	} 
+	else if ((bcn_interval << 2) > WAIT_FOR_BCN_TO_MAX)
+	{
+		return WAIT_FOR_BCN_TO_MAX;
+	}	
+	else
+	{
+		return ((bcn_interval << 2));
+	}
+}
+
+void CAM_empty_entry(
+	PADAPTER     	Adapter,	
+	u8 			ucIndex
+)
+{
+	rtw_hal_set_hwreg(Adapter, HW_VAR_CAM_EMPTY_ENTRY, (u8 *)(&ucIndex));
+}
+
+void invalidate_cam_all(_adapter *padapter)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_INVALID_ALL, 0);
+}
+#if 0
+static u32 _ReadCAM(_adapter *padapter ,u32 addr)
+{
+	u32 count = 0, cmd;
+	cmd = CAM_POLLINIG |addr ;
+	rtw_write32(padapter, RWCAM, cmd);
+
+	do{
+		if(0 == (rtw_read32(padapter,REG_CAMCMD) & CAM_POLLINIG)){
+			break;
+		}
+	}while(count++ < 100);		
+
+	return rtw_read32(padapter,REG_CAMREAD);	
+}
+void read_cam(_adapter *padapter ,u8 entry)
+{
+	u32	j,count = 0, addr, cmd;
+	addr = entry << 3;
+
+	printk("********* DUMP CAM Entry_#%02d***************\n",entry);
+	for (j = 0; j < 6; j++)
+	{	
+		cmd = _ReadCAM(padapter ,addr+j);
+		printk("offset:0x%02x => 0x%08x \n",addr+j,cmd);
+	}
+	printk("*********************************\n");
+}
+#endif
+
+void write_cam(_adapter *padapter, u8 entry, u16 ctrl, u8 *mac, u8 *key)
+{
+	unsigned int	i, val, addr;
+	//unsigned int    cmd;
+	int j;
+	u32	cam_val[2];
+
+	addr = entry << 3;
+
+	for (j = 5; j >= 0; j--)
+	{	
+		switch (j)
+		{
+			case 0:
+				val = (ctrl | (mac[0] << 16) | (mac[1] << 24) );
+				break;
+				
+			case 1:
+				val = (mac[2] | ( mac[3] << 8) | (mac[4] << 16) | (mac[5] << 24));
+				break;
+			
+			default:
+				i = (j - 2) << 2;
+				val = (key[i] | (key[i+1] << 8) | (key[i+2] << 16) | (key[i+3] << 24));
+				break;
+				
+		}
+
+		cam_val[0] = val;
+		cam_val[1] = addr + (unsigned int)j;
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_CAM_WRITE, (u8 *)cam_val);
+		
+		//rtw_write32(padapter, WCAMI, val);
+		
+		//cmd = CAM_POLLINIG | CAM_WRITE | (addr + j);
+		//rtw_write32(padapter, RWCAM, cmd);
+		
+		//DBG_871X("%s=> cam write: %x, %x\n",__FUNCTION__, cmd, val);
+		
+	}
+
+}
+
+void clear_cam_entry(_adapter *padapter, u8 entry)
+{	
+#if 0
+	u32	addr, val=0;
+	u32	cam_val[2];
+
+	addr = entry << 3;
+	
+
+	cam_val[0] = val;
+	cam_val[1] = addr + (unsigned int)0;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_WRITE, (u8 *)cam_val);
+
+
+
+	cam_val[0] = val;
+	cam_val[1] = addr + (unsigned int)1;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_WRITE, (u8 *)cam_val);
+#else
+
+	unsigned char null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	unsigned char null_key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00};
+
+	write_cam(padapter, entry, 0, null_sta, null_key);
+
+#endif
+}
+
+int allocate_fw_sta_entry(_adapter *padapter)
+{
+	unsigned int mac_id;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	for (mac_id = IBSS_START_MAC_ID; mac_id < NUM_STA; mac_id++)
+	{
+		if (pmlmeinfo->FW_sta_info[mac_id].status == 0)
+		{
+			pmlmeinfo->FW_sta_info[mac_id].status = 1;
+			pmlmeinfo->FW_sta_info[mac_id].retry = 0;
+			break;
+		}
+	}
+	
+	return mac_id;
+}
+
+void flush_all_cam_entry(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+#ifdef CONFIG_CONCURRENT_MODE
+
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	//if(check_buddy_mlmeinfo_state(padapter, _HW_STATE_NOLINK_))	
+	if(check_buddy_fwstate(padapter, _FW_LINKED) == _FALSE)
+	{
+		rtw_hal_set_hwreg(padapter, HW_VAR_CAM_INVALID_ALL, 0);		
+	}
+	else
+	{
+		if(check_fwstate(pmlmepriv, WIFI_STATION_STATE))
+		{
+			struct sta_priv	*pstapriv = &padapter->stapriv;
+			struct sta_info	*psta;
+			u8 cam_id=0;//cam_entry
+
+			psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
+			if(psta) {
+				if(psta->state & WIFI_AP_STATE)
+				{}   //clear cam when ap free per sta_info        
+				else {
+					if(psta->mac_id==2)
+						cam_id = 5;
+					else
+						cam_id = 4;
+				}
+				//clear_cam_entry(padapter, cam_id);
+				rtw_clearstakey_cmd(padapter, (u8*)psta, cam_id, _FALSE);
+			}
+		}
+		else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+		{
+			//clear cam when ap free per sta_info 
+		}			
+	}
+#else //CONFIG_CONCURRENT_MODE
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_INVALID_ALL, 0);	
+
+#endif //CONFIG_CONCURRENT_MODE
+
+	_rtw_memset((u8 *)(pmlmeinfo->FW_sta_info), 0, sizeof(pmlmeinfo->FW_sta_info));
+
+}
+
+#if defined(CONFIG_P2P) && defined(CONFIG_WFD)
+int WFD_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE)
+{
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo;	
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+
+
+	pwdinfo = &padapter->wdinfo;
+	if ( rtw_get_wfd_ie( ( u8* ) pIE, pIE->Length, wfd_ie, &wfd_ielen ) )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+			
+		printk( "[%s] Found WFD IE\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_8192C( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+			return( _TRUE );
+		}		
+	}
+	else
+	{
+		printk( "[%s] NO WFD IE\n", __FUNCTION__ );
+
+	}
+	return( _FAIL );
+}
+#endif
+
+int WMM_param_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE)
+{
+	//struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);	
+	
+	if(pmlmepriv->qospriv.qos_option==0)
+	{
+		pmlmeinfo->WMM_enable = 0;
+		return _FAIL;
+	}	
+
+	pmlmeinfo->WMM_enable = 1;
+	_rtw_memcpy(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element));
+	return _TRUE;
+
+	/*if (pregpriv->wifi_spec == 1)
+	{
+		if (pmlmeinfo->WMM_enable == 1)
+		{
+			//todo: compare the parameter set count & decide wheher to update or not
+			return _FAIL;
+		}
+		else
+		{
+			pmlmeinfo->WMM_enable = 1;
+			_rtw_rtw_memcpy(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element));
+			return _TRUE;
+		}
+	}
+	else
+	{
+		pmlmeinfo->WMM_enable = 0;
+		return _FAIL;
+	}*/
+	
+}
+
+void WMMOnAssocRsp(_adapter *padapter)
+{
+	u8	ACI, ACM, AIFS, ECWMin, ECWMax, aSifsTime;
+	u8	acm_mask;
+	u16	TXOP;
+	u32	acParm, i;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (pmlmeinfo->WMM_enable == 0)
+	{
+		padapter->mlmepriv.acm_mask = 0;
+		return;
+	}
+
+	acm_mask = 0;
+
+	if( pmlmeext->cur_wireless_mode == WIRELESS_11B)
+		aSifsTime = 10;
+	else
+		aSifsTime = 16;
+
+	for (i = 0; i < 4; i++)  
+	{
+		ACI = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN >> 5) & 0x03;
+		ACM = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN >> 4) & 0x01;
+
+		//AIFS = AIFSN * slot time + SIFS - r2t phy delay
+		AIFS = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN & 0x0f) * pmlmeinfo->slotTime + aSifsTime;
+
+		ECWMin = (pmlmeinfo->WMM_param.ac_param[i].CW & 0x0f);
+		ECWMax = (pmlmeinfo->WMM_param.ac_param[i].CW & 0xf0) >> 4;
+		TXOP = le16_to_cpu(pmlmeinfo->WMM_param.ac_param[i].TXOP_limit);
+
+		acParm = AIFS | (ECWMin << 8) | (ECWMax << 12) | (TXOP << 16);
+
+		switch (ACI)
+		{
+			case 0x0:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acParm));
+				acm_mask |= (ACM? BIT(1):0);
+				break;
+
+			case 0x1:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acParm));
+				//acm_mask |= (ACM? BIT(0):0);
+				break;
+
+			case 0x2:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acParm));
+				acm_mask |= (ACM? BIT(2):0);
+				break;
+
+			case 0x3:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acParm));
+				acm_mask |= (ACM? BIT(3):0);
+				break;							
+		}
+
+		DBG_871X("WMM(%x): %x, %x\n", ACI, ACM, acParm);
+	}
+
+	if(padapter->registrypriv.acm_method == 1)
+		rtw_hal_set_hwreg(padapter, HW_VAR_ACM_CTRL, (u8 *)(&acm_mask));
+	else
+		padapter->mlmepriv.acm_mask = acm_mask;
+
+	return;	
+}
+
+static void bwmode_update_check(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	unsigned char	 new_bwmode;
+	unsigned char  new_ch_offset;
+	struct HT_info_element	 *pHT_info;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+	u8 cbw40_enable=0;
+
+	if(!pIE)
+		return;
+
+	if(phtpriv->ht_option == _FALSE)	return;
+
+	if(pIE->Length > sizeof(struct HT_info_element))
+		return;
+	
+	pHT_info = (struct HT_info_element *)pIE->data;
+
+	if (pmlmeext->cur_channel > 14) {
+		if (pregistrypriv->cbw40_enable & BIT(1))
+			cbw40_enable = 1;
+	} else {
+		if (pregistrypriv->cbw40_enable & BIT(0))
+			cbw40_enable = 1;
+	}
+	
+	if((pHT_info->infos[0] & BIT(2)) && cbw40_enable )
+	{
+		new_bwmode = HT_CHANNEL_WIDTH_40;
+
+		switch (pHT_info->infos[0] & 0x3)
+		{
+			case 1:
+				new_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				break;
+			
+			case 3:
+				new_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				break;
+				
+			default:
+				new_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+				break;
+		}
+	}
+	else
+	{
+		new_bwmode = HT_CHANNEL_WIDTH_20;
+		new_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	}	
+
+	
+	if((new_bwmode!= pmlmeext->cur_bwmode) || (new_ch_offset!=pmlmeext->cur_ch_offset))
+	{
+		pmlmeinfo->bwmode_updated = _TRUE;
+		
+		pmlmeext->cur_bwmode = new_bwmode;
+		pmlmeext->cur_ch_offset = new_ch_offset;
+
+		//update HT info also
+		HT_info_handler(padapter, pIE);
+	}
+	else
+	{
+		pmlmeinfo->bwmode_updated = _FALSE;
+	}
+		
+
+	if(_TRUE == pmlmeinfo->bwmode_updated)
+	{
+		struct sta_info *psta;
+		WLAN_BSSID_EX 	*cur_network = &(pmlmeinfo->network);
+		struct sta_priv	*pstapriv = &padapter->stapriv;
+	
+		//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+		
+		//update ap's stainfo
+		psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
+		if(psta)
+		{
+			struct ht_priv	*phtpriv_sta = &psta->htpriv;
+			
+			if(phtpriv_sta->ht_option)
+			{				
+				// bwmode				
+				phtpriv_sta->bwmode = pmlmeext->cur_bwmode;
+				phtpriv_sta->ch_offset = pmlmeext->cur_ch_offset;		
+			}
+			else
+			{
+				phtpriv_sta->bwmode = HT_CHANNEL_WIDTH_20;
+				phtpriv_sta->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+			}
+			
+		}
+
+		//pmlmeinfo->bwmode_updated = _FALSE;//bwmode_updated done, reset it!
+		
+	}	
+
+}
+
+void HT_caps_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	unsigned int	i;
+	u8	rf_type;
+	u8	max_AMPDU_len, min_MPDU_spacing;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;	
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+	struct registry_priv 	*pregistrypriv = &padapter->registrypriv;
+	
+	if(pIE==NULL) return;
+	
+	if(phtpriv->ht_option == _FALSE)	return;
+
+	pmlmeinfo->HT_caps_enable = 1;
+	
+	for (i = 0; i < (pIE->Length); i++)
+	{
+		if (i != 2)
+		{
+			//	Commented by Albert 2010/07/12
+			//	Got the endian issue here.
+			pmlmeinfo->HT_caps.u.HT_cap[i] &= (pIE->data[i]);
+		}
+		else
+		{
+			//modify from  fw by Thomas 2010/11/17
+			if ((pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x3) > (pIE->data[i] & 0x3))
+			{
+				max_AMPDU_len = (pIE->data[i] & 0x3);
+			}
+			else
+			{
+				max_AMPDU_len = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x3);
+			}
+			
+			if ((pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c) > (pIE->data[i] & 0x1c))
+			{
+				min_MPDU_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c);
+			}
+			else
+			{
+				min_MPDU_spacing = (pIE->data[i] & 0x1c);
+			}
+
+			pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para = max_AMPDU_len | min_MPDU_spacing;
+		}
+	}
+
+	//	Commented by Albert 2010/07/12
+	//	Have to handle the endian issue after copying.
+	//	HT_ext_caps didn't be used yet.	
+	pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info = le16_to_cpu( pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info );
+	pmlmeinfo->HT_caps.u.HT_cap_element.HT_ext_caps = le16_to_cpu( pmlmeinfo->HT_caps.u.HT_cap_element.HT_ext_caps );
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+	//update the MCS rates
+	for (i = 0; i < 16; i++)
+	{
+		if((rf_type == RF_1T1R) || (rf_type == RF_1T2R))
+		{
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}
+		else
+		{
+			#ifdef CONFIG_DISABLE_MCS13TO15
+			if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40 && (pregistrypriv->wifi_spec!=1))
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R_MCS13TO15_OFF[i];
+			else
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+			#else
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+			#endif //CONFIG_DISABLE_MCS13TO15
+		}
+	        #ifdef RTL8192C_RECONFIG_TO_1T1R
+		{
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}
+		#endif
+
+		if(pregistrypriv->special_rf_path)
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+
+	}
+	
+	return;
+}
+
+void HT_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;	
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+
+	if(pIE==NULL) return;
+
+	if(phtpriv->ht_option == _FALSE)	return;
+
+
+	if(pIE->Length > sizeof(struct HT_info_element))
+		return;
+	
+	pmlmeinfo->HT_info_enable = 1;
+	_rtw_memcpy(&(pmlmeinfo->HT_info), pIE->data, pIE->Length);
+	
+	return;
+}
+
+void HTOnAssocRsp(_adapter *padapter)
+{
+	unsigned char		max_AMPDU_len;
+	unsigned char		min_MPDU_spacing;
+	//struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable))
+	{
+		pmlmeinfo->HT_enable = 1;
+	}
+	else
+	{
+		pmlmeinfo->HT_enable = 0;
+		//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+		return;
+	}
+	
+	//handle A-MPDU parameter field
+	/* 	
+		AMPDU_para [1:0]:Max AMPDU Len => 0:8k , 1:16k, 2:32k, 3:64k
+		AMPDU_para [4:2]:Min MPDU Start Spacing	
+	*/
+	max_AMPDU_len = pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x03;	
+	
+	min_MPDU_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c) >> 2;	
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_MIN_SPACE, (u8 *)(&min_MPDU_spacing));
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_FACTOR, (u8 *)(&max_AMPDU_len));
+
+#if 0 //move to rtw_update_ht_cap()
+	if ((pregpriv->cbw40_enable) &&
+		(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & BIT(1)) && 
+		(pmlmeinfo->HT_info.infos[0] & BIT(2)))
+	{
+		//switch to the 40M Hz mode accoring to the AP
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+		switch ((pmlmeinfo->HT_info.infos[0] & 0x3))
+		{
+			case HT_EXTCHNL_OFFSET_UPPER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				break;
+			
+			case HT_EXTCHNL_OFFSET_LOWER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				break;
+				
+			default:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+				break;
+		}
+		
+		//SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset);
+	}
+#endif
+
+	//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+#if 0 //move to rtw_update_ht_cap()
+	//
+	// Config SM Power Save setting
+	//
+	pmlmeinfo->SM_PS = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & 0x0C) >> 2;
+	if(pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
+	{
+		/*u8 i;
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			pmlmeinfo->HT_caps.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}*/
+		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n",__FUNCTION__);
+	}
+
+	//
+	// Config current HT Protection mode.
+	//
+	pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
+#endif
+	
+}
+
+void ERP_IE_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(pIE->Length>1)
+		return;
+	
+	pmlmeinfo->ERP_enable = 1;
+	_rtw_memcpy(&(pmlmeinfo->ERP_IE), pIE->data, pIE->Length);
+}
+
+void VCS_update(_adapter *padapter, struct sta_info *psta)
+{
+	struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	switch (pregpriv->vrtl_carrier_sense)/* 0:off 1:on 2:auto */
+	{
+		case 0: //off
+			psta->rtsen = 0;
+			psta->cts2self = 0;
+			break;
+			
+		case 1: //on
+			if (pregpriv->vcs_type == 1) /* 1:RTS/CTS 2:CTS to self */
+			{
+				psta->rtsen = 1;
+				psta->cts2self = 0;
+			}
+			else
+			{
+				psta->rtsen = 0;
+				psta->cts2self = 1;
+			}
+			break;
+			
+		case 2: //auto
+		default:
+			if ((pmlmeinfo->ERP_enable) && (pmlmeinfo->ERP_IE & BIT(1)))
+			{
+				if (pregpriv->vcs_type == 1)
+				{
+					psta->rtsen = 1;
+					psta->cts2self = 0;
+				}
+				else
+				{
+					psta->rtsen = 0;
+					psta->cts2self = 1;
+				}
+			}
+			else
+			{
+				psta->rtsen = 0;
+				psta->cts2self = 0;
+			}	
+			break;
+	}
+}
+
+#ifdef CONFIG_TDLS
+int check_ap_tdls_prohibited(u8 *pframe, u8 pkt_len)
+{
+	u8 tdls_prohibited_bit = 0x40; //bit(38); TDLS_prohibited
+
+	if(pkt_len < 5)
+	{
+		return _FALSE;
+	}
+
+	pframe += 4;
+	if( (*pframe) & tdls_prohibited_bit )
+		return _TRUE;
+
+	return _FALSE;
+}
+#endif //CONFIG_TDLS
+
+void update_beacon_info(_adapter *padapter, u8 *pframe, uint pkt_len, struct sta_info *psta)
+{
+	unsigned int i;
+	unsigned int len;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+		
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	u8 tdls_prohibited[] = { 0x00, 0x00, 0x00, 0x00, 0x10 }; //bit(38): TDLS_prohibited
+#endif //CONFIG_TDLS
+
+	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
+
+	for (i = 0; i < len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+		
+		switch (pIE->ElementID)
+		{
+#if 0			
+			case _VENDOR_SPECIFIC_IE_:		
+				//todo: to update WMM paramter set while receiving beacon			
+				if (_rtw_memcmp(pIE->data, WMM_PARA_OUI, 6))	//WMM
+				{
+					(WMM_param_handler(padapter, pIE))? WMMOnAssocRsp(padapter): 0;
+				}				
+				break;
+#endif
+
+			case _HT_EXTRA_INFO_IE_:	//HT info				
+				//HT_info_handler(padapter, pIE);
+				bwmode_update_check(padapter, pIE);
+				break;
+
+			case _ERPINFO_IE_:
+				ERP_IE_handler(padapter, pIE);
+				VCS_update(padapter, psta);
+				break;
+				
+#ifdef CONFIG_TDLS
+			case _EXT_CAP_IE_:
+				if( check_ap_tdls_prohibited(pIE->data, pIE->Length) == _TRUE )
+					ptdlsinfo->ap_prohibited = _TRUE;
+				break;
+#endif //CONFIG_TDLS
+			default:
+				break;
+		}
+		
+		i += (pIE->Length + 2);
+	}
+}
+
+#ifdef CONFIG_DFS
+void process_csa_ie(_adapter *padapter, u8 *pframe, uint pkt_len)
+{
+	unsigned int i;
+	unsigned int len;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 new_ch_no = 0; 
+		
+	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
+
+	for (i = 0; i < len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+		
+		switch (pIE->ElementID)
+		{
+			case _CH_SWTICH_ANNOUNCE_:
+				_rtw_memcpy(&new_ch_no, pIE->data+1, 1);
+				rtw_set_csa_cmd(padapter, new_ch_no);
+				break;
+
+			default:
+				break;
+		}
+		
+		i += (pIE->Length + 2);
+	}
+}
+#endif //CONFIG_DFS
+
+unsigned int is_ap_in_tkip(_adapter *padapter)
+{
+	u32 i;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+
+	if (rtw_get_capability((WLAN_BSSID_EX *)cur_network) & WLAN_CAPABILITY_PRIVACY)
+	{
+		for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pmlmeinfo->network.IELength;)
+		{
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(pmlmeinfo->network.IEs + i);
+		
+			switch (pIE->ElementID)
+			{
+				case _VENDOR_SPECIFIC_IE_:
+					if ((_rtw_memcmp(pIE->data, RTW_WPA_OUI, 4)) && (_rtw_memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4))) 
+					{
+						return _TRUE;
+					}
+					break;
+				
+				case _RSN_IE_2_:
+					if (_rtw_memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4)) 
+					{
+						return _TRUE;
+					}
+					
+				default:
+					break;
+			}
+		
+			i += (pIE->Length + 2);
+		}
+		
+		return _FALSE;
+	}
+	else
+	{
+		return _FALSE;
+	}
+	
+}
+
+int wifirate2_ratetbl_inx(unsigned char rate);
+int wifirate2_ratetbl_inx(unsigned char rate)
+{
+	int	inx = 0;
+	rate = rate & 0x7f;
+
+	switch (rate) 
+	{
+		case 54*2:
+			inx = 11;
+			break;
+
+		case 48*2:
+			inx = 10;
+			break;
+
+		case 36*2:
+			inx = 9;
+			break;
+
+		case 24*2:
+			inx = 8;
+			break;
+			
+		case 18*2:
+			inx = 7;
+			break;
+
+		case 12*2:
+			inx = 6;
+			break;
+
+		case 9*2:
+			inx = 5;
+			break;
+			
+		case 6*2:
+			inx = 4;
+			break;
+
+		case 11*2:
+			inx = 3;
+			break;
+		case 11:
+			inx = 2;
+			break;
+
+		case 2*2:
+			inx = 1;
+			break;
+		
+		case 1*2:
+			inx = 0;
+			break;
+
+	}
+	return inx;	
+}
+
+unsigned int update_basic_rate(unsigned char *ptn, unsigned int ptn_sz)
+{
+	unsigned int i, num_of_rate;
+	unsigned int mask = 0;
+	
+	num_of_rate = (ptn_sz > NumRates)? NumRates: ptn_sz;
+		
+	for (i = 0; i < num_of_rate; i++)
+	{
+		if ((*(ptn + i)) & 0x80)
+		{
+			mask |= 0x1 << wifirate2_ratetbl_inx(*(ptn + i));
+		}
+	}
+	return mask;
+}
+
+unsigned int update_supported_rate(unsigned char *ptn, unsigned int ptn_sz)
+{
+	unsigned int i, num_of_rate;
+	unsigned int mask = 0;
+	
+	num_of_rate = (ptn_sz > NumRates)? NumRates: ptn_sz;
+		
+	for (i = 0; i < num_of_rate; i++)
+	{
+		mask |= 0x1 << wifirate2_ratetbl_inx(*(ptn + i));
+	}
+
+	return mask;
+}
+
+unsigned int update_MSC_rate(struct HT_caps_element *pHT_caps)
+{
+	unsigned int mask = 0;
+	
+	mask = ((pHT_caps->u.HT_cap_element.MCS_rate[0] << 12) | (pHT_caps->u.HT_cap_element.MCS_rate[1] << 20));
+						
+	return mask;
+}
+
+int support_short_GI(_adapter *padapter, struct HT_caps_element *pHT_caps)
+{
+	unsigned char					bit_offset;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	if (!(pmlmeinfo->HT_enable))
+		return _FAIL;
+	
+	if ((pmlmeinfo->assoc_AP_vendor == ralinkAP))
+		return _FAIL;
+		
+	bit_offset = (pmlmeext->cur_bwmode & HT_CHANNEL_WIDTH_40)? 6: 5;
+	
+	if (pHT_caps->u.HT_cap_element.HT_caps_info & (0x1 << bit_offset))
+	{
+		return _SUCCESS;
+	}
+	else
+	{
+		return _FAIL;
+	}		
+}
+
+unsigned char get_highest_rate_idx(u32 mask)
+{
+	int i;
+	unsigned char rate_idx=0;
+
+	for(i=27; i>=0; i--)
+	{
+		if(mask & BIT(i))
+		{
+			rate_idx = i;
+			break;
+		}
+	}
+
+	return rate_idx;
+}
+
+unsigned char get_highest_mcs_rate(struct HT_caps_element *pHT_caps);
+unsigned char get_highest_mcs_rate(struct HT_caps_element *pHT_caps)
+{
+	int i, mcs_rate;
+	
+	mcs_rate = (pHT_caps->u.HT_cap_element.MCS_rate[0] | (pHT_caps->u.HT_cap_element.MCS_rate[1] << 8));
+	
+	for (i = 15; i >= 0; i--)
+	{
+		if (mcs_rate & (0x1 << i))
+		{
+			break;
+		}
+	}
+	
+	return i;
+}
+
+void Update_RA_Entry(_adapter *padapter, u32 mac_id)
+{
+	rtw_hal_update_ra_mask(padapter, mac_id);
+}
+
+void enable_rate_adaptive(_adapter *padapter, u32 mac_id);
+void enable_rate_adaptive(_adapter *padapter, u32 mac_id)
+{
+	Update_RA_Entry(padapter, mac_id);
+}
+
+void set_sta_rate(_adapter *padapter, struct sta_info *psta)
+{
+	//rate adaptive	
+	enable_rate_adaptive(padapter, psta->mac_id);
+}
+
+// Update RRSR and Rate for USERATE
+void update_tx_basic_rate(_adapter *padapter, u8 wirelessmode)
+{
+	NDIS_802_11_RATES_EX	supported_rates;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info*	pwdinfo = &padapter->wdinfo;
+
+	//	Added by Albert 2011/03/22
+	//	In the P2P mode, the driver should not support the b mode.
+	//	So, the Tx packet shouldn't use the CCK rate
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+#endif //CONFIG_P2P
+#ifdef CONFIG_INTEL_WIDI
+	if (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_NONE)
+		return;
+#endif //CONFIG_INTEL_WIDI
+
+	_rtw_memset(supported_rates, 0, NDIS_802_11_LENGTH_RATES_EX);
+
+	//clear B mod if current channel is in 5G band, avoid tx cck rate in 5G band.
+	if(pmlmeext->cur_channel > 14)
+		wirelessmode &= ~(WIRELESS_11B);
+
+	if ((wirelessmode & WIRELESS_11B) && (wirelessmode == WIRELESS_11B)) {
+		_rtw_memcpy(supported_rates, rtw_basic_rate_cck, 4);
+	} else if (wirelessmode & WIRELESS_11B) {
+		_rtw_memcpy(supported_rates, rtw_basic_rate_mix, 7);
+	} else {
+		_rtw_memcpy(supported_rates, rtw_basic_rate_ofdm, 3);
+	}
+
+	if (wirelessmode & WIRELESS_11B)
+		update_mgnt_tx_rate(padapter, IEEE80211_CCK_RATE_1MB);
+	else
+		update_mgnt_tx_rate(padapter, IEEE80211_OFDM_RATE_6MB);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, supported_rates);
+}
+
+unsigned char check_assoc_AP(u8 *pframe, uint len)
+{
+	unsigned int	i;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + i);
+		
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_:
+				if ((_rtw_memcmp(pIE->data, ARTHEROS_OUI1, 3)) || (_rtw_memcmp(pIE->data, ARTHEROS_OUI2, 3)))
+				{
+					DBG_871X("link to Artheros AP\n");
+					return atherosAP;
+				}
+				else if ((_rtw_memcmp(pIE->data, BROADCOM_OUI1, 3))
+							|| (_rtw_memcmp(pIE->data, BROADCOM_OUI2, 3))
+							|| (_rtw_memcmp(pIE->data, BROADCOM_OUI2, 3)))
+				{
+					DBG_871X("link to Broadcom AP\n");
+					return broadcomAP;
+				}
+				else if (_rtw_memcmp(pIE->data, MARVELL_OUI, 3))
+				{
+					DBG_871X("link to Marvell AP\n");
+					return marvellAP;
+				}
+				else if (_rtw_memcmp(pIE->data, RALINK_OUI, 3))
+				{
+					DBG_871X("link to Ralink AP\n");
+					return ralinkAP;
+				}
+				else if (_rtw_memcmp(pIE->data, CISCO_OUI, 3))
+				{
+					DBG_871X("link to Cisco AP\n");
+					return ciscoAP;
+				}
+				else if (_rtw_memcmp(pIE->data, REALTEK_OUI, 3))
+				{
+					DBG_871X("link to Realtek 96B\n");
+					return realtekAP;
+				}
+				else if (_rtw_memcmp(pIE->data, AIRGOCAP_OUI,3))
+				{
+					DBG_871X("link to Airgo Cap\n");
+					return airgocapAP;
+				}
+				else
+				{
+					break;
+				}
+						
+			default:
+				break;
+		}
+				
+		i += (pIE->Length + 2);
+	}
+	
+	DBG_871X("link to new AP\n");
+	return unknownAP;
+}
+
+void update_IOT_info(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	switch (pmlmeinfo->assoc_AP_vendor)
+	{
+		case marvellAP:
+			pmlmeinfo->turboMode_cts2self = 1;
+			pmlmeinfo->turboMode_rtsen = 0;
+			break;
+		
+		case ralinkAP:
+			pmlmeinfo->turboMode_cts2self = 0;
+			pmlmeinfo->turboMode_rtsen = 1;
+			//disable high power			
+			Switch_DM_Func(padapter, (~DYNAMIC_FUNC_HP), _FALSE);
+			break;
+		case realtekAP:
+			//rtw_write16(padapter, 0x4cc, 0xffff);
+			//rtw_write16(padapter, 0x546, 0x01c0);
+			//disable high power			
+			Switch_DM_Func(padapter, (~DYNAMIC_FUNC_HP), _FALSE);
+			break;
+		default:
+			pmlmeinfo->turboMode_cts2self = 0;
+			pmlmeinfo->turboMode_rtsen = 1;
+			break;	
+	}
+	
+}
+
+void update_capinfo(PADAPTER Adapter, u16 updateCap)
+{
+	struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	BOOLEAN		ShortPreamble;
+
+	// Check preamble mode, 2005.01.06, by rcnjko.
+	// Mark to update preamble value forever, 2008.03.18 by lanhsin
+	//if( pMgntInfo->RegPreambleMode == PREAMBLE_AUTO )
+	{
+			
+		if(updateCap & cShortPreamble)
+		{ // Short Preamble
+			if(pmlmeinfo->preamble_mode != PREAMBLE_SHORT) // PREAMBLE_LONG or PREAMBLE_AUTO
+			{
+				ShortPreamble = _TRUE;
+				pmlmeinfo->preamble_mode = PREAMBLE_SHORT;
+				rtw_hal_set_hwreg( Adapter, HW_VAR_ACK_PREAMBLE, (u8 *)&ShortPreamble );
+			}
+		}
+		else
+		{ // Long Preamble
+			if(pmlmeinfo->preamble_mode != PREAMBLE_LONG)  // PREAMBLE_SHORT or PREAMBLE_AUTO
+			{
+				ShortPreamble = _FALSE;
+				pmlmeinfo->preamble_mode = PREAMBLE_LONG;
+				rtw_hal_set_hwreg( Adapter, HW_VAR_ACK_PREAMBLE, (u8 *)&ShortPreamble );
+			}
+		}
+	}
+
+	if ( updateCap & cIBSS ) {
+		//Filen: See 802.11-2007 p.91
+		pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
+	}
+	else
+	{
+		//Filen: See 802.11-2007 p.90
+		if( pmlmeext->cur_wireless_mode & (WIRELESS_11G | WIRELESS_11_24N))
+		{
+			if( (updateCap & cShortSlotTime) /* && (!(pMgntInfo->pHTInfo->RT2RT_HT_Mode & RT_HT_CAP_USE_LONG_PREAMBLE)) */)
+			{ // Short Slot Time
+				if(pmlmeinfo->slotTime != SHORT_SLOT_TIME)
+				{
+					pmlmeinfo->slotTime = SHORT_SLOT_TIME;
+				}
+			}
+			else
+			{ // Long Slot Time
+				if(pmlmeinfo->slotTime != NON_SHORT_SLOT_TIME)
+				{
+					pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
+				}
+			}
+		}
+		else if( pmlmeext->cur_wireless_mode & (WIRELESS_11A | WIRELESS_11_5N))
+		{
+			pmlmeinfo->slotTime = SHORT_SLOT_TIME;
+		}
+		else
+		{
+			//B Mode
+			pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
+		}
+ 	}
+ 
+	rtw_hal_set_hwreg( Adapter, HW_VAR_SLOT_TIME, &pmlmeinfo->slotTime );
+
+}
+
+void update_wireless_mode(_adapter *padapter)
+{
+	u8	init_rate=0;
+	int	ratelen, network_type = 0;
+	u32	SIFS_Timer, mask;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	unsigned char			*rate = cur_network->SupportedRates;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+#endif //CONFIG_CONCURRENT_MODE
+
+	ratelen = rtw_get_rateset_len(cur_network->SupportedRates);
+
+	if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable))
+	{
+		pmlmeinfo->HT_enable = 1;
+	}
+
+	if(pmlmeext->cur_channel > 14)
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_5N;
+		}
+
+		network_type |= WIRELESS_11A;
+	}
+	else
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_24N;
+		}
+	
+		if ((cckratesonly_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11B;
+		}
+		else if((cckrates_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11BG;
+		}
+		else
+		{
+			network_type |= WIRELESS_11G;
+		}
+	}
+
+	pmlmeext->cur_wireless_mode = network_type & padapter->registrypriv.wireless_mode;
+
+	//For STA mode, driver need to modify initial data rate, or MAC will use wrong tx rate.
+	//Modified by Thomas 2012-12-3
+	mask = update_supported_rate(cur_network->SupportedRates, ratelen);
+	init_rate = get_highest_rate_idx(mask)&0x3f;
+	rtw_hal_set_hwreg( padapter, HW_VAR_INIT_DATA_RATE,  (u8 *)&init_rate);
+	
+/*
+	if((pmlmeext->cur_wireless_mode==WIRELESS_11G) ||
+		(pmlmeext->cur_wireless_mode==WIRELESS_11BG))//WIRELESS_MODE_G)
+		SIFS_Timer = 0x0a0a;//CCK
+	else
+		SIFS_Timer = 0x0e0e;//pHalData->SifsTime; //OFDM
+*/
+	
+	SIFS_Timer = 0x0a0a0808; //0x0808 -> for CCK, 0x0a0a -> for OFDM
+                             //change this value if having IOT issues.
+		
+	rtw_hal_set_hwreg( padapter, HW_VAR_RESP_SIFS,  (u8 *)&SIFS_Timer);
+
+	if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
+		update_mgnt_tx_rate(padapter, IEEE80211_CCK_RATE_1MB);
+	else
+	{
+		update_mgnt_tx_rate(padapter, IEEE80211_OFDM_RATE_6MB);
+#ifdef CONFIG_CONCURRENT_MODE
+		if(pbuddy_adapter && (pmlmeext->cur_wireless_mode & WIRELESS_11A))
+			update_mgnt_tx_rate(pbuddy_adapter, IEEE80211_OFDM_RATE_6MB);
+#endif //CONFIG_CONCURRENT_MODE
+	}
+}
+
+void fire_write_MAC_cmd(_adapter *padapter, unsigned int addr, unsigned int value);
+void fire_write_MAC_cmd(_adapter *padapter, unsigned int addr, unsigned int value)
+{
+#if 0
+	struct cmd_obj					*ph2c;
+	struct reg_rw_parm			*pwriteMacPara;
+	struct cmd_priv					*pcmdpriv = &(padapter->cmdpriv);
+
+	if ((ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}	
+
+	if ((pwriteMacPara = (struct reg_rw_parm*)rtw_malloc(sizeof(struct reg_rw_parm))) == NULL) 
+	{		
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		return;
+	}
+	
+	pwriteMacPara->rw = 1;
+	pwriteMacPara->addr = addr;
+	pwriteMacPara->value = value;
+	
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pwriteMacPara, GEN_CMD_CODE(_Write_MACREG));
+	rtw_enqueue_cmd(pcmdpriv, ph2c);
+#endif	
+}
+
+void update_bmc_sta_support_rate(_adapter *padapter, u32 mac_id)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(pmlmeext->cur_wireless_mode & WIRELESS_11B)
+	{
+		// Only B, B/G, and B/G/N AP could use CCK rate
+		_rtw_memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_cck, 4);
+	}
+	else
+	{
+		_rtw_memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_ofdm, 3);
+	}
+}
+
+int update_sta_support_rate(_adapter *padapter, u8* pvar_ie, uint var_ie_len, int cam_idx)
+{
+	unsigned int	ie_len;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	int	supportRateNum = 0;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	pIE = (PNDIS_802_11_VARIABLE_IEs)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+	if (pIE == NULL)
+	{
+		return _FAIL;
+	}
+	
+	_rtw_memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
+	supportRateNum = ie_len;
+				
+	pIE = (PNDIS_802_11_VARIABLE_IEs)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+	if (pIE)
+	{
+		_rtw_memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
+	}
+
+	return _SUCCESS;
+	
+}
+
+void process_addba_req(_adapter *padapter, u8 *paddba_req, u8 *addr)
+{
+	struct sta_info *psta;
+	u16 tid, start_seq, param;	
+	struct recv_reorder_ctrl *preorder_ctrl;
+	struct sta_priv *pstapriv = &padapter->stapriv;	
+	struct ADDBA_request	*preq = (struct ADDBA_request*)paddba_req;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	psta = rtw_get_stainfo(pstapriv, addr);
+
+	if(psta)
+	{
+		start_seq = le16_to_cpu(preq->BA_starting_seqctrl) >> 4;
+			
+		param = le16_to_cpu(preq->BA_para_set);
+		tid = (param>>2)&0x0f;
+		
+		preorder_ctrl = &psta->recvreorder_ctrl[tid];
+
+		#ifdef CONFIG_UPDATE_INDICATE_SEQ_WHILE_PROCESS_ADDBA_REQ
+		preorder_ctrl->indicate_seq = start_seq;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, start_seq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, start_seq);
+		#endif
+		#else
+		preorder_ctrl->indicate_seq = 0xffff;
+		#endif
+		
+		preorder_ctrl->enable =(pmlmeinfo->bAcceptAddbaReq == _TRUE)? _TRUE :_FALSE;
+	}
+
+}
+
+void update_TSF(struct mlme_ext_priv *pmlmeext, u8 *pframe, uint len)
+{	
+	u8* pIE;
+	u32 *pbuf;
+		
+	pIE = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+	pbuf = (u32*)pIE;
+
+	pmlmeext->TSFValue = le32_to_cpu(*(pbuf+1));
+	
+	pmlmeext->TSFValue = pmlmeext->TSFValue << 32;
+
+	pmlmeext->TSFValue |= le32_to_cpu(*pbuf);
+}
+
+void correct_TSF(_adapter *padapter, struct mlme_ext_priv *pmlmeext)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_CORRECT_TSF, 0);
+}
+
+void beacon_timing_control(_adapter *padapter)
+{
+	rtw_hal_bcn_related_reg_setting(padapter);
+}
+
+#if 0
+unsigned int setup_beacon_frame(_adapter *padapter, unsigned char *beacon_frame)
+{
+	unsigned short				ATIMWindow;
+	unsigned char					*pframe;
+	struct tx_desc 				*ptxdesc;
+	struct rtw_ieee80211_hdr 	*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned int					rate_len, len = 0;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	
+	_rtw_memset(beacon_frame, 0, 256);
+	
+	pframe = beacon_frame + TXDESC_SIZE;
+	
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;	
+	
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	
+	_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
+	
+	SetFrameSubType(pframe, WIFI_BEACON);
+	
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);	
+	len = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	len += 8;
+
+	// beacon interval: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2); 
+
+	pframe += 2;
+	len += 2;
+
+	// capability info: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	len += 2;
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &len);
+
+	// supported rates...
+	rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &len);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &len);
+
+	// IBSS Parameter Set...
+	//ATIMWindow = cur->Configuration.ATIMWindow;
+	ATIMWindow = 0;
+	pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &len);
+
+	//todo: ERP IE
+	
+	// EXTERNDED SUPPORTED RATE
+	if (rate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &len);
+	}
+
+	if ((len + TXDESC_SIZE) > 256)
+	{
+		//DBG_871X("marc: beacon frame too large\n");
+		return 0;
+	}
+
+	//fill the tx descriptor
+	ptxdesc = (struct tx_desc *)beacon_frame;
+	
+	//offset 0	
+	ptxdesc->txdw0 |= cpu_to_le32(len & 0x0000ffff); 
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) & 0x00ff0000); //default = 32 bytes for TX Desc
+	
+	//offset 4	
+	ptxdesc->txdw1 |= cpu_to_le32((0x10 << QSEL_SHT) & 0x00001f00);
+	
+	//offset 8		
+	ptxdesc->txdw2 |= cpu_to_le32(BMC);
+	ptxdesc->txdw2 |= cpu_to_le32(BK);
+
+	//offset 16		
+	ptxdesc->txdw4 = 0x80000000;
+	
+	//offset 20
+	ptxdesc->txdw5 = 0x00000000; //1M	
+	
+	return (len + TXDESC_SIZE);
+}
+#endif
+
+static _adapter *pbuddy_padapter = NULL;
+
+int rtw_handle_dualmac(_adapter *adapter, bool init)
+{
+	int status = _SUCCESS;
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+
+	if (!IS_HARDWARE_TYPE_8192D(adapter))
+		goto exit;
+
+	if (init) {
+		rtw_hal_get_def_var(adapter, HAL_DEF_DUAL_MAC_MODE, &dvobj->DualMacMode);
+		if (dvobj->DualMacMode == _TRUE) {
+			// temply disable IPS For 92D-VC
+			adapter->registrypriv.ips_mode = IPS_NONE;
+		}
+		
+		/* For SMSP on 92DU-VC, driver do not probe another Interface. */
+		if ((dvobj->DualMacMode != _TRUE) && (dvobj->InterfaceNumber != 0)) {
+			DBG_871X("%s(): Do not init another Interface because SMSP\n",__FUNCTION__);
+			status = _FAIL;
+			goto exit;
+		}
+
+#ifndef CONFIG_CONCURRENT_MODE
+		if (dvobj->DualMacMode == _TRUE) {
+			if (pbuddy_padapter == NULL) {
+				pbuddy_padapter = adapter;
+				DBG_871X("%s(): pbuddy_padapter == NULL, Set pbuddy_padapter\n",__FUNCTION__);
+			} else {
+				adapter->pbuddy_adapter = pbuddy_padapter;
+				pbuddy_padapter->pbuddy_adapter = adapter;
+				// clear global value
+				pbuddy_padapter = NULL;
+				DBG_871X("%s(): pbuddy_padapter exist, Exchange Information\n",__FUNCTION__);
+			}
+		}
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		if (dvobj->InterfaceNumber == 0) {
+			//set adapter_type/iface type
+			adapter->isprimary = _TRUE;
+			adapter->adapter_type = PRIMARY_ADAPTER;
+			adapter->iface_type = IFACE_PORT0;
+			DBG_871X("%s(): PRIMARY_ADAPTER\n",__FUNCTION__);
+		} else {
+			//set adapter_type/iface type
+			adapter->isprimary = _FALSE;
+			adapter->adapter_type = SECONDARY_ADAPTER;
+			adapter->iface_type = IFACE_PORT1;
+			DBG_871X("%s(): SECONDARY_ADAPTER\n",__FUNCTION__);
+		}
+#endif
+#endif
+	}else {
+		pbuddy_padapter = NULL;
+	}
+exit:
+	return status;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c
new file mode 100755
index 0000000000000..c080fbf59e177
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c
@@ -0,0 +1,4156 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_XMIT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+#include <wifi.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+#include <ip.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+#ifdef PLATFORM_WINDOWS
+#include <if_ether.h>
+#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+
+static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
+static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
+
+static void _init_txservq(struct tx_servq *ptxservq)
+{
+_func_enter_;
+	_rtw_init_listhead(&ptxservq->tx_pending);
+	_rtw_init_queue(&ptxservq->sta_pending);
+	ptxservq->qcnt = 0;
+_func_exit_;		
+}
+
+
+void	_rtw_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
+{	
+	
+_func_enter_;
+
+	_rtw_memset((unsigned char *)psta_xmitpriv, 0, sizeof (struct sta_xmit_priv));
+
+	_rtw_spinlock_init(&psta_xmitpriv->lock);
+	
+	//for(i = 0 ; i < MAX_NUMBLKS; i++)
+	//	_init_txservq(&(psta_xmitpriv->blk_q[i]));
+
+	_init_txservq(&psta_xmitpriv->be_q);
+	_init_txservq(&psta_xmitpriv->bk_q);
+	_init_txservq(&psta_xmitpriv->vi_q);
+	_init_txservq(&psta_xmitpriv->vo_q);
+	_rtw_init_listhead(&psta_xmitpriv->legacy_dz);
+	_rtw_init_listhead(&psta_xmitpriv->apsd);
+	
+_func_exit_;	
+
+}
+
+s32	_rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, _adapter *padapter)
+{
+	int i;
+	struct xmit_buf *pxmitbuf;
+	struct xmit_frame *pxframe;
+	sint	res=_SUCCESS;   
+
+_func_enter_;   	
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));
+	
+	_rtw_spinlock_init(&pxmitpriv->lock);
+	_rtw_spinlock_init(&pxmitpriv->lock_sctx);
+	_rtw_init_sema(&pxmitpriv->xmit_sema, 0);
+	_rtw_init_sema(&pxmitpriv->terminate_xmitthread_sema, 0);
+
+	/* 
+	Please insert all the queue initializaiton using _rtw_init_queue below
+	*/
+
+	pxmitpriv->adapter = padapter;
+	
+	//for(i = 0 ; i < MAX_NUMBLKS; i++)
+	//	_rtw_init_queue(&pxmitpriv->blk_strms[i]);
+	
+	_rtw_init_queue(&pxmitpriv->be_pending);
+	_rtw_init_queue(&pxmitpriv->bk_pending);
+	_rtw_init_queue(&pxmitpriv->vi_pending);
+	_rtw_init_queue(&pxmitpriv->vo_pending);
+	_rtw_init_queue(&pxmitpriv->bm_pending);
+
+	//_rtw_init_queue(&pxmitpriv->legacy_dz_queue);
+	//_rtw_init_queue(&pxmitpriv->apsd_queue);
+
+	_rtw_init_queue(&pxmitpriv->free_xmit_queue);
+
+	/*	
+	Please allocate memory with the sz = (struct xmit_frame) * NR_XMITFRAME, 
+	and initialize free_xmit_frame below.
+	Please also apply  free_txobj to link_up all the xmit_frames...
+	*/
+
+	pxmitpriv->pallocated_frame_buf = rtw_zvmalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4);
+	
+	if (pxmitpriv->pallocated_frame_buf  == NULL){
+		pxmitpriv->pxmit_frame_buf =NULL;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xmit_frame fail!\n"));	
+		res= _FAIL;
+		goto exit;
+	}
+	pxmitpriv->pxmit_frame_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_frame_buf), 4);
+	//pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 -
+	//						((SIZE_PTR) (pxmitpriv->pallocated_frame_buf) &3);
+
+	pxframe = (struct xmit_frame*) pxmitpriv->pxmit_frame_buf;
+
+	for (i = 0; i < NR_XMITFRAME; i++)
+	{
+		_rtw_init_listhead(&(pxframe->list));
+
+		pxframe->padapter = padapter;
+		pxframe->frame_tag = NULL_FRAMETAG;
+
+		pxframe->pkt = NULL;		
+
+		pxframe->buf_addr = NULL;
+		pxframe->pxmitbuf = NULL;
+ 
+		rtw_list_insert_tail(&(pxframe->list), &(pxmitpriv->free_xmit_queue.queue));
+
+		pxframe++;
+	}
+
+	pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
+
+	pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
+
+
+	//init xmit_buf
+	_rtw_init_queue(&pxmitpriv->free_xmitbuf_queue);
+	_rtw_init_queue(&pxmitpriv->pending_xmitbuf_queue);
+
+	pxmitpriv->pallocated_xmitbuf = rtw_zvmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4);
+	
+	if (pxmitpriv->pallocated_xmitbuf  == NULL){
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xmit_buf fail!\n"));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pxmitpriv->pxmitbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmitbuf), 4);
+	//pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -
+	//						((SIZE_PTR) (pxmitpriv->pallocated_xmitbuf) &3);
+
+	pxmitbuf = (struct xmit_buf*)pxmitpriv->pxmitbuf;
+
+	for (i = 0; i < NR_XMITBUFF; i++)
+	{
+		_rtw_init_listhead(&pxmitbuf->list);
+
+		pxmitbuf->priv_data = NULL;
+		pxmitbuf->padapter = padapter;
+		pxmitbuf->ext_tag = _FALSE;
+
+/*
+		pxmitbuf->pallocated_buf = rtw_zmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ);
+		if (pxmitbuf->pallocated_buf == NULL)
+		{
+			res = _FAIL;
+			goto exit;
+		}
+
+		pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), XMITBUF_ALIGN_SZ);
+		//pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -((SIZE_PTR) (pxmitbuf->pallocated_buf) &(XMITBUF_ALIGN_SZ-1));
+*/
+
+		if((res=rtw_os_xmit_resource_alloc(padapter, pxmitbuf,(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ))) == _FAIL) {
+			res= _FAIL;
+			goto exit;
+		}
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->phead = pxmitbuf->pbuf;
+		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMITBUF_SZ;
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+
+		pxmitbuf->flags = XMIT_VO_QUEUE;
+		
+		rtw_list_insert_tail(&pxmitbuf->list, &(pxmitpriv->free_xmitbuf_queue.queue));
+		#ifdef DBG_XMIT_BUF
+		pxmitbuf->no=i;
+		#endif
+
+		pxmitbuf++;
+		
+	}
+
+	pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
+
+	/* init xframe_ext queue,  the same count as extbuf  */
+	_rtw_init_queue(&pxmitpriv->free_xframe_ext_queue);
+	
+	pxmitpriv->xframe_ext_alloc_addr = rtw_zvmalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_frame) + 4);
+	
+	if (pxmitpriv->xframe_ext_alloc_addr  == NULL){
+		pxmitpriv->xframe_ext = NULL;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xframe_ext fail!\n"));	
+		res= _FAIL;
+		goto exit;
+	}
+	pxmitpriv->xframe_ext = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->xframe_ext_alloc_addr), 4);
+	pxframe = (struct xmit_frame*)pxmitpriv->xframe_ext;
+
+	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
+		_rtw_init_listhead(&(pxframe->list));
+
+		pxframe->padapter = padapter;
+		pxframe->frame_tag = NULL_FRAMETAG;
+
+		pxframe->pkt = NULL;		
+
+		pxframe->buf_addr = NULL;
+		pxframe->pxmitbuf = NULL;
+		
+		pxframe->ext_tag = 1;
+ 
+		rtw_list_insert_tail(&(pxframe->list), &(pxmitpriv->free_xframe_ext_queue.queue));
+
+		pxframe++;
+	}
+	pxmitpriv->free_xframe_ext_cnt = NR_XMIT_EXTBUFF;
+
+	// Init xmit extension buff
+	_rtw_init_queue(&pxmitpriv->free_xmit_extbuf_queue);
+
+	pxmitpriv->pallocated_xmit_extbuf = rtw_zvmalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_buf) + 4);
+	
+	if (pxmitpriv->pallocated_xmit_extbuf  == NULL){
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xmit_extbuf fail!\n"));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pxmitpriv->pxmit_extbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmit_extbuf), 4);
+
+	pxmitbuf = (struct xmit_buf*)pxmitpriv->pxmit_extbuf;
+
+	for (i = 0; i < NR_XMIT_EXTBUFF; i++)
+	{
+		_rtw_init_listhead(&pxmitbuf->list);
+
+		pxmitbuf->priv_data = NULL;
+		pxmitbuf->padapter = padapter;
+		pxmitbuf->ext_tag = _TRUE;
+
+/*
+		pxmitbuf->pallocated_buf = rtw_zmalloc(MAX_XMIT_EXTBUF_SZ);
+		if (pxmitbuf->pallocated_buf == NULL)
+		{
+			res = _FAIL;
+			goto exit;
+		}
+
+		pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), 4);
+*/		
+
+		if((res=rtw_os_xmit_resource_alloc(padapter, pxmitbuf,MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ)) == _FAIL) {
+			res= _FAIL;
+			goto exit;
+		}
+		
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->phead = pxmitbuf->pbuf;
+		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMIT_EXTBUF_SZ;
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+
+		rtw_list_insert_tail(&pxmitbuf->list, &(pxmitpriv->free_xmit_extbuf_queue.queue));
+		#ifdef DBG_XMIT_BUF
+		pxmitbuf->no=i;
+		#endif
+		pxmitbuf++;
+		
+	}
+
+	pxmitpriv->free_xmit_extbuf_cnt = NR_XMIT_EXTBUFF;
+
+	rtw_alloc_hwxmits(padapter);
+	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
+
+#ifdef CONFIG_USB_HCI
+	pxmitpriv->txirp_cnt=1;
+
+	_rtw_init_sema(&(pxmitpriv->tx_retevt), 0);
+
+	//per AC pending irp
+	pxmitpriv->beq_cnt = 0;
+	pxmitpriv->bkq_cnt = 0;
+	pxmitpriv->viq_cnt = 0;
+	pxmitpriv->voq_cnt = 0;
+#endif
+
+
+#ifdef CONFIG_XMIT_ACK
+	pxmitpriv->ack_tx = _FALSE;
+	_rtw_mutex_init(&pxmitpriv->ack_tx_mutex);
+	rtw_sctx_init(&pxmitpriv->ack_tx_ops, 0);	
+#endif
+
+	rtw_hal_init_xmit_priv(padapter);
+
+exit:
+
+_func_exit_;	
+
+	return res;
+}
+
+void  rtw_mfree_xmit_priv_lock (struct xmit_priv *pxmitpriv);
+void  rtw_mfree_xmit_priv_lock (struct xmit_priv *pxmitpriv)
+{
+	_rtw_spinlock_free(&pxmitpriv->lock);
+	_rtw_free_sema(&pxmitpriv->xmit_sema);
+	_rtw_free_sema(&pxmitpriv->terminate_xmitthread_sema);
+
+	_rtw_spinlock_free(&pxmitpriv->be_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->bk_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->vi_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->vo_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->bm_pending.lock);
+
+	//_rtw_spinlock_free(&pxmitpriv->legacy_dz_queue.lock);
+	//_rtw_spinlock_free(&pxmitpriv->apsd_queue.lock);
+
+	_rtw_spinlock_free(&pxmitpriv->free_xmit_queue.lock);
+	_rtw_spinlock_free(&pxmitpriv->free_xmitbuf_queue.lock);
+	_rtw_spinlock_free(&pxmitpriv->pending_xmitbuf_queue.lock);
+}
+
+
+void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv)
+{
+       int i;
+      _adapter *padapter = pxmitpriv->adapter;
+	struct xmit_frame	*pxmitframe = (struct xmit_frame*) pxmitpriv->pxmit_frame_buf;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
+
+ _func_enter_;   
+
+	rtw_hal_free_xmit_priv(padapter);
+ 
+	rtw_mfree_xmit_priv_lock(pxmitpriv);
+ 
+ 	if(pxmitpriv->pxmit_frame_buf==NULL)
+		goto out;
+	
+	for(i=0; i<NR_XMITFRAME; i++)
+	{	
+		rtw_os_xmit_complete(padapter, pxmitframe);
+
+		pxmitframe++;
+	}		
+	
+	for(i=0; i<NR_XMITBUFF; i++)
+	{
+		rtw_os_xmit_resource_free(padapter, pxmitbuf,(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ));
+
+		//if(pxmitbuf->pallocated_buf)
+		//	rtw_mfree(pxmitbuf->pallocated_buf, MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ);
+		
+		pxmitbuf++;
+	}
+
+	if(pxmitpriv->pallocated_frame_buf) {
+		rtw_vmfree(pxmitpriv->pallocated_frame_buf, NR_XMITFRAME * sizeof(struct xmit_frame) + 4);
+	}
+	
+
+	if(pxmitpriv->pallocated_xmitbuf) {
+		rtw_vmfree(pxmitpriv->pallocated_xmitbuf, NR_XMITBUFF * sizeof(struct xmit_buf) + 4);
+	}
+
+	/* free xframe_ext queue,  the same count as extbuf  */
+	if ((pxmitframe = (struct xmit_frame*)pxmitpriv->xframe_ext)) {
+		for (i=0; i<NR_XMIT_EXTBUFF; i++) {
+			rtw_os_xmit_complete(padapter, pxmitframe);
+			pxmitframe++;
+		}
+	}
+	if (pxmitpriv->xframe_ext_alloc_addr)
+		rtw_vmfree(pxmitpriv->xframe_ext_alloc_addr, NR_XMIT_EXTBUFF * sizeof(struct xmit_frame) + 4);
+	_rtw_spinlock_free(&pxmitpriv->free_xframe_ext_queue.lock);
+
+	// free xmit extension buff
+	_rtw_spinlock_free(&pxmitpriv->free_xmit_extbuf_queue.lock);
+
+	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
+	for(i=0; i<NR_XMIT_EXTBUFF; i++)
+	{
+		rtw_os_xmit_resource_free(padapter, pxmitbuf,(MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ));
+
+		//if(pxmitbuf->pallocated_buf)
+		//	rtw_mfree(pxmitbuf->pallocated_buf, MAX_XMIT_EXTBUF_SZ);
+		
+		pxmitbuf++;
+	}
+
+	if(pxmitpriv->pallocated_xmit_extbuf) {
+		rtw_vmfree(pxmitpriv->pallocated_xmit_extbuf, NR_XMIT_EXTBUFF * sizeof(struct xmit_buf) + 4);	
+	}
+
+	rtw_free_hwxmits(padapter);
+
+#ifdef CONFIG_XMIT_ACK	
+	_rtw_mutex_free(&pxmitpriv->ack_tx_mutex);	
+#endif	
+
+out:	
+
+_func_exit_;		
+
+}
+
+static void update_attrib_vcs_info(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	u32	sz;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_info	*psta = pattrib->psta;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+        if(pattrib->psta)
+	{
+		psta = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0] );
+	}
+
+        if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return;
+	}
+
+	if (pattrib->nr_frags != 1)
+	{
+		sz = padapter->xmitpriv.frag_len;
+	}
+	else //no frag
+	{
+		sz = pattrib->last_txcmdsz;
+	}
+
+	// (1) RTS_Threshold is compared to the MPDU, not MSDU.
+	// (2) If there are more than one frag in  this MSDU, only the first frag uses protection frame.
+	//		Other fragments are protected by previous fragment.
+	//		So we only need to check the length of first fragment.
+	if(pmlmeext->cur_wireless_mode < WIRELESS_11_24N  || padapter->registrypriv.wifi_spec)
+	{
+		if(sz > padapter->registrypriv.rts_thresh)
+		{
+			pattrib->vcs_mode = RTS_CTS;
+		}
+		else
+		{
+			if(psta->rtsen)
+				pattrib->vcs_mode = RTS_CTS;
+			else if(psta->cts2self)
+				pattrib->vcs_mode = CTS_TO_SELF;
+			else
+				pattrib->vcs_mode = NONE_VCS;
+		}
+	}
+	else
+	{
+		while (_TRUE)
+		{
+#if 0 //Todo
+			//check IOT action
+			if(pHTInfo->IOTAction & HT_IOT_ACT_FORCED_CTS2SELF)
+			{
+				pattrib->vcs_mode = CTS_TO_SELF;
+				pattrib->rts_rate = MGN_24M;
+				break;
+			}
+			else if(pHTInfo->IOTAction & (HT_IOT_ACT_FORCED_RTS|HT_IOT_ACT_PURE_N_MODE))
+			{
+				pattrib->vcs_mode = RTS_CTS;
+				pattrib->rts_rate = MGN_24M;
+				break;
+			}
+#endif
+
+			//IOT action
+			if((pmlmeinfo->assoc_AP_vendor == atherosAP) && (pattrib->ampdu_en==_TRUE) &&
+				(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_ ))
+			{
+				pattrib->vcs_mode = CTS_TO_SELF;
+				break;
+			}	
+			
+
+			//check ERP protection
+			if(psta->rtsen || psta->cts2self)
+			{
+				if(psta->rtsen)
+					pattrib->vcs_mode = RTS_CTS;
+				else if(psta->cts2self)
+					pattrib->vcs_mode = CTS_TO_SELF;
+
+				break;
+			}
+
+			//check HT op mode
+			if(pattrib->ht_en)
+			{
+				u8 HTOpMode = pmlmeinfo->HT_protection;
+				if((pmlmeext->cur_bwmode && (HTOpMode == 2 || HTOpMode == 3)) ||
+					(!pmlmeext->cur_bwmode && HTOpMode == 3) )
+				{
+					pattrib->vcs_mode = RTS_CTS;
+					break;
+				}
+			}
+
+			//check rts
+			if(sz > padapter->registrypriv.rts_thresh)
+			{
+				pattrib->vcs_mode = RTS_CTS;
+				break;
+			}
+
+			//to do list: check MIMO power save condition.
+
+			//check AMPDU aggregation for TXOP
+			if(pattrib->ampdu_en==_TRUE)
+			{
+				pattrib->vcs_mode = RTS_CTS;
+				break;
+			}
+
+			pattrib->vcs_mode = NONE_VCS;
+			break;
+		}
+	}
+}
+
+static void update_attrib_phy_info(struct pkt_attrib *pattrib, struct sta_info *psta)
+{
+	/*if(psta->rtsen)	
+		pattrib->vcs_mode = RTS_CTS;	
+	else if(psta->cts2self)	
+		pattrib->vcs_mode = CTS_TO_SELF;	
+	else
+		pattrib->vcs_mode = NONE_VCS;*/
+	
+	pattrib->mdata = 0;
+	pattrib->eosp = 0;
+	pattrib->triggered=0;
+	
+	//qos_en, ht_en, init rate, ,bw, ch_offset, sgi
+	pattrib->qos_en = psta->qos_option;
+	pattrib->ht_en = psta->htpriv.ht_option;
+	pattrib->raid = psta->raid;
+	pattrib->bwmode = psta->htpriv.bwmode;
+	pattrib->ch_offset = psta->htpriv.ch_offset;
+	pattrib->sgi= psta->htpriv.sgi;
+	pattrib->ampdu_en = _FALSE;
+
+	//if(pattrib->ht_en && psta->htpriv.ampdu_enable)
+	//{
+	//	if(psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
+	//		pattrib->ampdu_en = _TRUE;
+	//}	
+
+
+	pattrib->retry_ctrl = _FALSE;
+
+}
+
+u8	qos_acm(u8 acm_mask, u8 priority)
+{
+	u8	change_priority = priority;
+
+	switch (priority)
+	{
+		case 0:
+		case 3:
+			if(acm_mask & BIT(1))
+				change_priority = 1;
+			break;
+		case 1:
+		case 2:
+			break;
+		case 4:
+		case 5:
+			if(acm_mask & BIT(2))
+				change_priority = 0;
+			break;
+		case 6:
+		case 7:
+			if(acm_mask & BIT(3))
+				change_priority = 5;
+			break;
+		default:
+			DBG_871X("qos_acm(): invalid pattrib->priority: %d!!!\n", priority);
+			break;
+	}
+
+	return change_priority;
+}
+
+static void set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib)
+{
+	struct ethhdr etherhdr;
+	struct iphdr ip_hdr;
+	s32 UserPriority = 0;
+
+
+	_rtw_open_pktfile(ppktfile->pkt, ppktfile);
+	_rtw_pktfile_read(ppktfile, (unsigned char*)&etherhdr, ETH_HLEN);
+
+	// get UserPriority from IP hdr
+	if (pattrib->ether_type == 0x0800) {
+		_rtw_pktfile_read(ppktfile, (u8*)&ip_hdr, sizeof(ip_hdr));
+//		UserPriority = (ntohs(ip_hdr.tos) >> 5) & 0x3;
+		UserPriority = ip_hdr.tos >> 5;
+	} else if (pattrib->ether_type == 0x888e) {
+		// "When priority processing of data frames is supported,
+		// a STA's SME should send EAPOL-Key frames at the highest priority."
+		UserPriority = 7;
+	}
+
+	pattrib->priority = UserPriority;
+	pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
+	pattrib->subtype = WIFI_QOS_DATA_TYPE;
+}
+
+static s32 update_attrib(_adapter *padapter, _pkt *pkt, struct pkt_attrib *pattrib)
+{
+	uint i;
+	struct pkt_file pktfile;
+	struct sta_info *psta = NULL;
+	struct ethhdr etherhdr;
+
+	sint bmcast;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv		*pqospriv= &pmlmepriv->qospriv;
+	sint res = _SUCCESS;
+
+ _func_enter_;
+
+	_rtw_open_pktfile(pkt, &pktfile);
+	i = _rtw_pktfile_read(&pktfile, (u8*)&etherhdr, ETH_HLEN);
+
+	pattrib->ether_type = ntohs(etherhdr.h_proto);
+
+
+	_rtw_memcpy(pattrib->dst, &etherhdr.h_dest, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, &etherhdr.h_source, ETH_ALEN);
+
+	pattrib->pctrl = 0;
+
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	}
+	else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
+		_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	}
+	else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
+	}
+
+	pattrib->pktlen = pktfile.pkt_len;
+
+	if (ETH_P_IP == pattrib->ether_type)
+	{
+		// The following is for DHCP and ARP packet, we use cck1M to tx these packets and let LPS awake some time 
+		// to prevent DHCP protocol fail
+		u8 tmp[24];
+		_rtw_pktfile_read(&pktfile, &tmp[0], 24);
+		pattrib->dhcp_pkt = 0;
+		if (pktfile.pkt_len > 282) {//MINIMUM_DHCP_PACKET_SIZE) {
+			if (ETH_P_IP == pattrib->ether_type) {// IP header
+				if (((tmp[21] == 68) && (tmp[23] == 67)) ||
+					((tmp[21] == 67) && (tmp[23] == 68))) {
+					// 68 : UDP BOOTP client
+					// 67 : UDP BOOTP server
+					RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("======================update_attrib: get DHCP Packet \n"));
+					// Use low rate to send DHCP packet.
+					//if(pMgntInfo->IOTAction & HT_IOT_ACT_WA_IOT_Broadcom) 
+					//{
+					//	tcb_desc->DataRate = MgntQuery_TxRateExcludeCCKRates(ieee);//0xc;//ofdm 6m
+					//	tcb_desc->bTxDisableRateFallBack = false;
+					//}
+					//else
+					//	pTcb->DataRate = Adapter->MgntInfo.LowestBasicRate; 
+					//RTPRINT(FDM, WA_IOT, ("DHCP TranslateHeader(), pTcb->DataRate = 0x%x\n", pTcb->DataRate)); 
+					pattrib->dhcp_pkt = 1;
+				}
+			}
+		}
+	}
+
+	if ( (pattrib->ether_type == 0x888e) || (pattrib->dhcp_pkt == 1) )
+	{
+		rtw_set_scan_deny(padapter, 3000);
+	}
+
+#ifdef CONFIG_LPS
+	// If EAPOL , ARP , OR DHCP packet, driver must be in active mode.
+	if ( (pattrib->ether_type == 0x0806) || (pattrib->ether_type == 0x888e) || (pattrib->dhcp_pkt == 1) )
+	{
+		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SPECIAL_PACKET, 1);
+	}
+#endif
+
+	bmcast = IS_MCAST(pattrib->ra);
+	
+	// get sta_info
+	if (bmcast) {
+		psta = rtw_get_bcmc_stainfo(padapter);
+	} else {
+		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+		if (psta == NULL)	{ // if we cannot get psta => drrp the pkt
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("\nupdate_attrib => get sta_info fail, ra:" MAC_FMT"\n", MAC_ARG(pattrib->ra)));
+			#ifdef DBG_TX_DROP_FRAME
+			DBG_871X("DBG_TX_DROP_FRAME %s get sta_info fail, ra:" MAC_FMT"\n", __FUNCTION__, MAC_ARG(pattrib->ra));
+			#endif
+			res =_FAIL;
+			goto exit;
+		}
+		else if((check_fwstate(pmlmepriv, WIFI_AP_STATE)==_TRUE)&&(!(psta->state & _FW_LINKED)))
+		{
+			res =_FAIL;
+			goto exit;
+		}
+	}
+
+	if (psta)
+	{
+		pattrib->mac_id = psta->mac_id;
+		pattrib->psta = psta;
+	}
+	else
+	{
+		// if we cannot get psta => drop the pkt
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("\nupdate_attrib => get sta_info fail, ra:" MAC_FMT "\n", MAC_ARG(pattrib->ra)));
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s get sta_info fail, ra:" MAC_FMT"\n", __FUNCTION__, MAC_ARG(pattrib->ra));
+		#endif
+		res = _FAIL;
+		goto exit;
+	}
+
+	pattrib->ack_policy = 0;
+	// get ether_hdr_len
+	pattrib->pkt_hdrlen = ETH_HLEN;//(pattrib->ether_type == 0x8100) ? (14 + 4 ): 14; //vlan tag
+
+	pattrib->hdrlen = WLAN_HDR_A3_LEN;
+	pattrib->subtype = WIFI_DATA_TYPE;	
+	pattrib->priority = 0;
+	
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE))
+	{
+		if(psta->qos_option)
+			set_qos(&pktfile, pattrib);
+	}
+	else
+	{
+		if(pqospriv->qos_option)
+		{
+			set_qos(&pktfile, pattrib);
+
+			if(pmlmepriv->acm_mask != 0)
+			{
+				pattrib->priority = qos_acm(pmlmepriv->acm_mask, pattrib->priority);
+			}
+		}
+	}
+
+	//pattrib->priority = 5; //force to used VI queue, for testing
+
+	if (psta->ieee8021x_blocked == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\n psta->ieee8021x_blocked == _TRUE \n"));
+
+		pattrib->encrypt = 0;
+
+		if((pattrib->ether_type != 0x888e) && (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _FALSE))
+		{
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\npsta->ieee8021x_blocked == _TRUE,  pattrib->ether_type(%.4x) != 0x888e\n",pattrib->ether_type));
+			#ifdef DBG_TX_DROP_FRAME
+			DBG_871X("DBG_TX_DROP_FRAME %s psta->ieee8021x_blocked == _TRUE,  pattrib->ether_type(%.4x) != 0x888e\n", __FUNCTION__,pattrib->ether_type);
+			#endif
+			res = _FAIL;
+			goto exit;
+		}
+	}
+	else
+	{
+		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
+
+		switch(psecuritypriv->dot11AuthAlgrthm)
+		{
+			case dot11AuthAlgrthm_Open:
+			case dot11AuthAlgrthm_Shared:
+			case dot11AuthAlgrthm_Auto:				
+				pattrib->key_idx = (u8)psecuritypriv->dot11PrivacyKeyIndex;
+				break;
+			case dot11AuthAlgrthm_8021X:
+				if(bmcast)					
+					pattrib->key_idx = (u8)psecuritypriv->dot118021XGrpKeyid;	
+				else
+					pattrib->key_idx = 0;
+				break;
+			default:
+				pattrib->key_idx = 0;
+				break;
+		}
+		
+			
+	}
+
+	switch (pattrib->encrypt)
+	{
+		case _WEP40_:
+		case _WEP104_:
+			pattrib->iv_len = 4;
+			pattrib->icv_len = 4;
+			break;
+
+		case _TKIP_:
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 4;
+			
+			if(padapter->securitypriv.busetkipkey==_FAIL)
+			{
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\npadapter->securitypriv.busetkipkey(%d)==_FAIL drop packet\n", padapter->securitypriv.busetkipkey));
+				#ifdef DBG_TX_DROP_FRAME
+				DBG_871X("DBG_TX_DROP_FRAME %s padapter->securitypriv.busetkipkey(%d)==_FAIL drop packet\n", __FUNCTION__, padapter->securitypriv.busetkipkey);
+				#endif
+				res =_FAIL;
+				goto exit;
+			}
+					
+			break;			
+		case _AES_:
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\n pattrib->encrypt=%d  (_AES_)\n",pattrib->encrypt));
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 8;
+			break;
+			
+		default:
+			pattrib->iv_len = 0;
+			pattrib->icv_len = 0;
+			break;
+	}
+
+	RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_,
+		 ("update_attrib: encrypt=%d  securitypriv.sw_encrypt=%d\n",
+		  pattrib->encrypt, padapter->securitypriv.sw_encrypt));
+
+	if (pattrib->encrypt &&
+	    ((padapter->securitypriv.sw_encrypt == _TRUE) || (psecuritypriv->hw_decrypted == _FALSE)))
+	{
+		pattrib->bswenc = _TRUE;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,
+			 ("update_attrib: encrypt=%d securitypriv.hw_decrypted=%d bswenc=_TRUE\n",
+			  pattrib->encrypt, padapter->securitypriv.sw_encrypt));
+	} else {
+		pattrib->bswenc = _FALSE;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("update_attrib: bswenc=_FALSE\n"));
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if((pattrib->encrypt && bmcast) || (pattrib->encrypt ==_WEP40_) || (pattrib->encrypt ==_WEP104_))
+	{
+		pattrib->bswenc = _TRUE;//force using sw enc.
+	}
+#endif
+
+	rtw_set_tx_chksum_offload(pkt, pattrib);
+
+	update_attrib_phy_info(pattrib, psta);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+static s32 xmitframe_addmic(_adapter *padapter, struct xmit_frame *pxmitframe){
+	sint 			curfragnum,length;
+	u8	*pframe, *payload,mic[8];
+	struct	mic_data		micdata;
+	struct	sta_info		*stainfo;
+	struct	qos_priv   *pqospriv= &(padapter->mlmepriv.qospriv);	
+	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+	u8 priority[4]={0x0,0x0,0x0,0x0};
+	sint bmcst = IS_MCAST(pattrib->ra);
+
+	if(pattrib->psta)
+	{
+		stainfo = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		stainfo=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0]);
+	}	
+
+	if(stainfo==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FAIL;
+	}
+	
+	if(!(stainfo->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
+		return _FAIL;
+	}
+
+_func_enter_;
+
+	if(pattrib->encrypt ==_TKIP_)//if(psecuritypriv->dot11PrivacyAlgrthm==_TKIP_PRIVACY_) 
+	{
+		//encode mic code
+		if(stainfo!= NULL){
+			u8 null_key[16]={0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0};
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+			pframe = pxmitframe->buf_addr + TXDESC_SIZE + (pxmitframe->pkt_offset * PACKET_OFFSET_SZ);
+#else
+			pframe = pxmitframe->buf_addr + TXDESC_OFFSET;
+#endif
+			
+			if(bmcst)
+			{
+				if(_rtw_memcmp(psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey, null_key, 16)==_TRUE){
+					//DbgPrint("\nxmitframe_addmic:stainfo->dot11tkiptxmickey==0\n");
+					//rtw_msleep_os(10);
+					return _FAIL;
+				}				
+				//start to calculate the mic code
+				rtw_secmicsetkey(&micdata, psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey);
+			}
+			else
+			{
+				if(_rtw_memcmp(&stainfo->dot11tkiptxmickey.skey[0],null_key, 16)==_TRUE){
+					//DbgPrint("\nxmitframe_addmic:stainfo->dot11tkiptxmickey==0\n");
+					//rtw_msleep_os(10);
+					return _FAIL;
+				}
+				//start to calculate the mic code
+				rtw_secmicsetkey(&micdata, &stainfo->dot11tkiptxmickey.skey[0]);
+			}
+			
+			if(pframe[1]&1){   //ToDS==1
+				rtw_secmicappend(&micdata, &pframe[16], 6);  //DA
+				if(pframe[1]&2)  //From Ds==1
+					rtw_secmicappend(&micdata, &pframe[24], 6);
+				else
+				rtw_secmicappend(&micdata, &pframe[10], 6);		
+			}	
+			else{	//ToDS==0
+				rtw_secmicappend(&micdata, &pframe[4], 6);   //DA
+				if(pframe[1]&2)  //From Ds==1
+					rtw_secmicappend(&micdata, &pframe[16], 6);
+				else
+					rtw_secmicappend(&micdata, &pframe[10], 6);
+
+			}
+
+                    //if(pqospriv->qos_option==1)
+                    if(pattrib->qos_en)
+				priority[0]=(u8)pxmitframe->attrib.priority;
+
+			
+			rtw_secmicappend(&micdata, &priority[0], 4);
+	
+			payload=pframe;
+
+			for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++){
+				payload=(u8 *)RND4((SIZE_PTR)(payload));
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("===curfragnum=%d, pframe= 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x,!!!\n",
+					curfragnum,*payload, *(payload+1),*(payload+2),*(payload+3),*(payload+4),*(payload+5),*(payload+6),*(payload+7)));
+
+				payload=payload+pattrib->hdrlen+pattrib->iv_len;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("curfragnum=%d pattrib->hdrlen=%d pattrib->iv_len=%d",curfragnum,pattrib->hdrlen,pattrib->iv_len));
+				if((curfragnum+1)==pattrib->nr_frags){
+					length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len-( (pattrib->bswenc) ? pattrib->icv_len : 0);
+					rtw_secmicappend(&micdata, payload,length);
+					payload=payload+length;
+				}
+				else{
+					length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-( (pattrib->bswenc) ? pattrib->icv_len : 0);
+					rtw_secmicappend(&micdata, payload, length);
+					payload=payload+length+pattrib->icv_len;
+					RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("curfragnum=%d length=%d pattrib->icv_len=%d",curfragnum,length,pattrib->icv_len));
+				}
+			}
+			rtw_secgetmic(&micdata,&(mic[0]));
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: before add mic code!!!\n"));
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: pattrib->last_txcmdsz=%d!!!\n",pattrib->last_txcmdsz));
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: mic[0]=0x%.2x ,mic[1]=0x%.2x ,mic[2]=0x%.2x ,mic[3]=0x%.2x \n\
+  mic[4]=0x%.2x ,mic[5]=0x%.2x ,mic[6]=0x%.2x ,mic[7]=0x%.2x !!!!\n",
+				mic[0],mic[1],mic[2],mic[3],mic[4],mic[5],mic[6],mic[7]));
+			//add mic code  and add the mic code length in last_txcmdsz
+
+			_rtw_memcpy(payload, &(mic[0]),8);
+			pattrib->last_txcmdsz+=8;
+			
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("\n ========last pkt========\n"));
+			payload=payload-pattrib->last_txcmdsz+8;
+			for(curfragnum=0;curfragnum<pattrib->last_txcmdsz;curfragnum=curfragnum+8)
+					RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,(" %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x ",
+					*(payload+curfragnum), *(payload+curfragnum+1), *(payload+curfragnum+2),*(payload+curfragnum+3),
+					*(payload+curfragnum+4),*(payload+curfragnum+5),*(payload+curfragnum+6),*(payload+curfragnum+7)));
+			}
+			else{
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: rtw_get_stainfo==NULL!!!\n"));
+			}
+	}
+	
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+static s32 xmitframe_swencrypt(_adapter *padapter, struct xmit_frame *pxmitframe){
+
+	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
+	//struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	
+_func_enter_;
+
+	//if((psecuritypriv->sw_encrypt)||(pattrib->bswenc))	
+	if(pattrib->bswenc)
+	{
+		//DBG_871X("start xmitframe_swencrypt\n");
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_alert_,("### xmitframe_swencrypt\n"));
+		switch(pattrib->encrypt){
+		case _WEP40_:
+		case _WEP104_:
+			rtw_wep_encrypt(padapter, (u8 *)pxmitframe);
+			break;
+		case _TKIP_:
+			rtw_tkip_encrypt(padapter, (u8 *)pxmitframe);
+			break;
+		case _AES_:
+			rtw_aes_encrypt(padapter, (u8 * )pxmitframe);
+			break;
+		default:
+				break;
+		}
+
+	} else {
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_notice_,("### xmitframe_hwencrypt\n"));
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+s32 rtw_make_wlanhdr (_adapter *padapter , u8 *hdr, struct pkt_attrib *pattrib)
+{
+	u16 *qc;
+
+	struct rtw_ieee80211_hdr *pwlanhdr = (struct rtw_ieee80211_hdr *)hdr;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
+	u8 qos_option = _FALSE;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta=NULL, *psta_backup=NULL;
+	u8 direct_link=0;
+#endif //CONFIG_TDLS
+
+	sint res = _SUCCESS;
+	u16 *fctrl = &pwlanhdr->frame_ctl;
+
+	struct sta_info *psta;
+
+	sint bmcst = IS_MCAST(pattrib->ra);
+
+_func_enter_;
+
+	if (pattrib->psta) {
+		psta = pattrib->psta;
+	} else {
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		if(bmcst) {
+			psta = rtw_get_bcmc_stainfo(padapter);
+		} else {
+			psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+		}
+	}
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FAIL;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FAIL;
+	}
+
+	_rtw_memset(hdr, 0, WLANHDR_OFFSET);
+
+	SetFrameSubType(fctrl, pattrib->subtype);
+
+	if (pattrib->subtype & WIFI_DATA_TYPE)
+	{
+		if ((check_fwstate(pmlmepriv,  WIFI_STATION_STATE) == _TRUE)) {
+			//to_ds = 1, fr_ds = 0;
+#ifdef CONFIG_TDLS
+			if((ptdlsinfo->setup_state == TDLS_LINKED_STATE)){
+				ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+				if((ptdls_sta!=NULL)&&(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE)&&(pattrib->ether_type!=0x0806)){
+					//TDLS data transfer, ToDS=0, FrDs=0
+					_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+					direct_link=1;
+				}else{
+					// 1.Data transfer to AP
+					// 2.Arp pkt will relayed by AP
+					SetToDs(fctrl);							
+					_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+				} 
+			}else
+#endif //CONFIG_TDLS
+			{
+				//Data transfer to AP
+				SetToDs(fctrl);							
+				_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+			} 
+
+			if (pqospriv->qos_option)
+				qos_option = _TRUE;
+
+		}
+		else if ((check_fwstate(pmlmepriv,  WIFI_AP_STATE) == _TRUE) ) {
+			//to_ds = 0, fr_ds = 1;
+			SetFrDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
+
+			if(psta->qos_option)			
+				qos_option = _TRUE;
+		}
+		else if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
+			_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+
+			if(psta->qos_option)			
+				qos_option = _TRUE;
+		}
+		else {
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
+			res = _FAIL;
+			goto exit;
+		}
+
+		if(pattrib->mdata)
+			SetMData(fctrl);
+
+		if (pattrib->encrypt)
+			SetPrivacy(fctrl);
+
+		if (qos_option)
+		{
+			qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
+
+			if (pattrib->priority)
+				SetPriority(qc, pattrib->priority);
+
+			SetEOSP(qc, pattrib->eosp);
+
+			SetAckpolicy(qc, pattrib->ack_policy);
+		}
+
+		//TODO: fill HT Control Field
+
+		//Update Seq Num will be handled by f/w
+		{
+			if(psta){
+#ifdef CONFIG_TDLS
+				if(direct_link==1)
+				{
+					psta_backup = psta;
+					psta = ptdls_sta;
+				}
+#endif //CONFIG_TDLS
+
+				psta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+				psta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+
+				pattrib->seqnum = psta->sta_xmitpriv.txseq_tid[pattrib->priority];
+
+				SetSeqNum(hdr, pattrib->seqnum);
+
+
+				//check if enable ampdu
+				if(pattrib->ht_en && psta->htpriv.ampdu_enable)
+				{
+					if(psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
+					pattrib->ampdu_en = _TRUE;
+				}
+
+				//re-check if enable ampdu by BA_starting_seqctrl
+				if(pattrib->ampdu_en == _TRUE)
+				{					
+					u16 tx_seq;
+
+					tx_seq = psta->BA_starting_seqctrl[pattrib->priority & 0x0f];
+		
+					//check BA_starting_seqctrl
+					if(SN_LESS(pattrib->seqnum, tx_seq))
+					{
+						//DBG_871X("tx ampdu seqnum(%d) < tx_seq(%d)\n", pattrib->seqnum, tx_seq);
+						pattrib->ampdu_en = _FALSE;//AGG BK
+					}
+					else if(SN_EQUAL(pattrib->seqnum, tx_seq))
+					{					
+						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (tx_seq+1)&0xfff;
+					
+						pattrib->ampdu_en = _TRUE;//AGG EN
+					}
+					else
+					{
+						//DBG_871X("tx ampdu over run\n");
+						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (pattrib->seqnum+1)&0xfff;
+						pattrib->ampdu_en = _TRUE;//AGG EN
+					}
+
+				}
+
+#ifdef CONFIG_TDLS
+				if(direct_link==1)
+				{
+					if (pattrib->encrypt){
+						pattrib->encrypt= _AES_;
+						pattrib->iv_len=8;
+						pattrib->icv_len=8;
+					}
+
+					//qos_en, ht_en, init rate, ,bw, ch_offset, sgi
+					//pattrib->qos_en = ptdls_sta->qos_option;
+					pattrib->ht_en = ptdls_sta->htpriv.ht_option;
+					pattrib->raid = ptdls_sta->raid;
+					pattrib->bwmode = ptdls_sta->htpriv.bwmode;
+					pattrib->ch_offset = ptdls_sta->htpriv.ch_offset;
+					pattrib->sgi= ptdls_sta->htpriv.sgi;
+
+					pattrib->mac_id = ptdls_sta->mac_id;
+
+					psta = psta_backup;
+				}
+#endif //CONFIG_TDLS
+
+			}
+		}
+		
+	}
+	else
+	{
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+s32 rtw_txframes_pending(_adapter *padapter)
+{
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	return ((_rtw_queue_empty(&pxmitpriv->be_pending) == _FALSE) || 
+			 (_rtw_queue_empty(&pxmitpriv->bk_pending) == _FALSE) || 
+			 (_rtw_queue_empty(&pxmitpriv->vi_pending) == _FALSE) ||
+			 (_rtw_queue_empty(&pxmitpriv->vo_pending) == _FALSE));
+}
+
+s32 rtw_txframes_sta_ac_pending(_adapter *padapter, struct pkt_attrib *pattrib)
+{	
+	struct sta_info *psta;
+	struct tx_servq *ptxservq;
+	int priority = pattrib->priority;
+
+	if(pattrib->psta)
+	{
+	psta = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0]);
+	}	
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return 0;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return 0;
+	}
+	
+	switch(priority) 
+	{
+			case 1:
+			case 2:
+				ptxservq = &(psta->sta_xmitpriv.bk_q);				
+				break;
+			case 4:
+			case 5:
+				ptxservq = &(psta->sta_xmitpriv.vi_q);				
+				break;
+			case 6:
+			case 7:
+				ptxservq = &(psta->sta_xmitpriv.vo_q);							
+				break;
+			case 0:
+			case 3:
+			default:
+				ptxservq = &(psta->sta_xmitpriv.be_q);							
+			break;
+	
+	}	
+
+	return ptxservq->qcnt;	
+}
+
+#ifdef CONFIG_TDLS
+
+int rtw_build_tdls_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe, u8 action)
+{
+	int res=_SUCCESS;
+
+	switch(action){
+		case TDLS_SETUP_REQUEST:
+			rtw_build_tdls_setup_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_SETUP_RESPONSE:
+			rtw_build_tdls_setup_rsp_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_SETUP_CONFIRM:
+			rtw_build_tdls_setup_cfm_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_TEARDOWN:
+			rtw_build_tdls_teardown_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_DISCOVERY_REQUEST:
+			rtw_build_tdls_dis_req_ies(padapter, pxmitframe, pframe);
+			break;			
+		case TDLS_PEER_TRAFFIC_INDICATION:
+			rtw_build_tdls_peer_traffic_indication_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_CHANNEL_SWITCH_REQUEST:
+			rtw_build_tdls_ch_switch_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_CHANNEL_SWITCH_RESPONSE:
+			rtw_build_tdls_ch_switch_rsp_ies(padapter, pxmitframe, pframe);
+			break;
+#ifdef CONFIG_WFD			
+		case TUNNELED_PROBE_REQ:
+			rtw_build_tunneled_probe_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TUNNELED_PROBE_RSP:
+			rtw_build_tunneled_probe_rsp_ies(padapter, pxmitframe, pframe);
+			break;
+#endif //CONFIG_WFD
+		default:
+			res=_FAIL;
+			break;
+	}
+
+	return res;
+}
+
+s32 rtw_make_tdls_wlanhdr (_adapter *padapter , u8 *hdr, struct pkt_attrib *pattrib, u8 action)
+{
+	u16 *qc;
+	struct rtw_ieee80211_hdr *pwlanhdr = (struct rtw_ieee80211_hdr *)hdr;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *psta=NULL, *ptdls_sta=NULL;
+	u8 tdls_seq=0, baddr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+	sint res = _SUCCESS;
+	u16 *fctrl = &pwlanhdr->frame_ctl;
+
+_func_enter_;
+
+	_rtw_memset(hdr, 0, WLANHDR_OFFSET);
+
+	SetFrameSubType(fctrl, pattrib->subtype);
+
+	switch(action){
+		case TDLS_SETUP_REQUEST:
+		case TDLS_SETUP_RESPONSE:
+		case TDLS_SETUP_CONFIRM:
+		case TDLS_TEARDOWN:	//directly to peer STA or via AP
+		case TDLS_PEER_TRAFFIC_INDICATION:
+		case TDLS_PEER_PSM_REQUEST:	//directly to peer STA or via AP
+		case TUNNELED_PROBE_REQ:
+		case TUNNELED_PROBE_RSP:		
+			SetToDs(fctrl);							
+			_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+			break;
+		case TDLS_CHANNEL_SWITCH_REQUEST:
+		case TDLS_CHANNEL_SWITCH_RESPONSE:
+		case TDLS_PEER_PSM_RESPONSE:
+		case TDLS_PEER_TRAFFIC_RESPONSE:
+			_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+			tdls_seq=1;
+			break;
+		case TDLS_DISCOVERY_REQUEST:	//unicast: directly to peer sta, Bcast: via AP
+			if(_rtw_memcmp(pattrib->dst, baddr, ETH_ALEN) )
+			{
+				SetToDs(fctrl);							
+				_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+			}
+			else
+			{
+				_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+				tdls_seq=1;
+			}
+			break;
+	}
+
+	if (pattrib->encrypt)
+		SetPrivacy(fctrl);
+
+	if (pqospriv->qos_option)
+	{
+		qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
+		if (pattrib->priority)
+			SetPriority(qc, pattrib->priority);
+		SetAckpolicy(qc, pattrib->ack_policy);
+	}
+
+	psta = pattrib->psta;
+ 
+	//  1. update seq_num per link by sta_info
+	//  2. rewrite encrypt to _AES_, also rewrite iv_len, icv_len
+	if(tdls_seq==1){
+		ptdls_sta=rtw_get_stainfo(pstapriv, pattrib->dst);
+		if(ptdls_sta){
+			ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+			ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+			pattrib->seqnum = ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority];
+			SetSeqNum(hdr, pattrib->seqnum);
+
+			if (pattrib->encrypt){
+				pattrib->encrypt= _AES_;
+				pattrib->iv_len=8;
+				pattrib->icv_len=8;
+			}
+		}else{
+			res=_FAIL;
+			goto exit;
+		}
+	}else if(psta){
+		psta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+		psta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+		pattrib->seqnum = psta->sta_xmitpriv.txseq_tid[pattrib->priority];
+		SetSeqNum(hdr, pattrib->seqnum);
+	}
+
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+s32 rtw_xmit_tdls_coalesce(_adapter * padapter, struct xmit_frame * pxmitframe, u8 action)
+{
+	s32 llc_sz;
+
+	u8 *pframe, *mem_start;
+
+	struct sta_info		*psta;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 *pbuf_start;
+	s32 bmcst = IS_MCAST(pattrib->ra);
+	s32 res = _SUCCESS;
+	
+_func_enter_;
+
+	if (pattrib->psta) {
+		psta = pattrib->psta;
+	} else {	
+		if(bmcst) {
+			psta = rtw_get_bcmc_stainfo(padapter);
+		} else {
+			psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+	        }
+	}
+
+	if(psta==NULL)
+		return _FAIL;
+
+	if (pxmitframe->buf_addr == NULL)
+		return _FAIL;
+
+	pbuf_start = pxmitframe->buf_addr;
+	mem_start = pbuf_start + TXDESC_OFFSET;
+
+	if (rtw_make_tdls_wlanhdr(padapter, mem_start, pattrib, action) == _FAIL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	pframe = mem_start;
+	pframe += pattrib->hdrlen;
+
+	//adding icv, if necessary...
+	if (pattrib->iv_len)
+	{
+		if (psta != NULL)
+		{
+			switch(pattrib->encrypt)
+			{
+				case _WEP40_:
+				case _WEP104_:
+						WEP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);	
+					break;
+				case _TKIP_:			
+					if(bmcst)
+						TKIP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+					else
+						TKIP_IV(pattrib->iv, psta->dot11txpn, 0);
+					break;			
+				case _AES_:
+					if(bmcst)
+						AES_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+					else
+						AES_IV(pattrib->iv, psta->dot11txpn, 0);
+					break;
+			}
+		}
+
+		_rtw_memcpy(pframe, pattrib->iv, pattrib->iv_len);
+		pframe += pattrib->iv_len;
+
+	}
+
+	llc_sz = rtw_put_snap(pframe, pattrib->ether_type);
+	pframe += llc_sz;
+
+	//pattrib->pktlen will be counted in rtw_build_tdls_ies
+	pattrib->pktlen = 0;
+
+	rtw_build_tdls_ies(padapter, pxmitframe, pframe, action);
+
+	if ((pattrib->icv_len >0 )&& (pattrib->bswenc)) {
+		pframe += pattrib->pktlen;
+		_rtw_memcpy(pframe, pattrib->icv, pattrib->icv_len); 
+		pframe += pattrib->icv_len;
+	}
+
+	pattrib->nr_frags = 1;
+	pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->iv_len + llc_sz + 
+			((pattrib->bswenc) ? pattrib->icv_len : 0) + pattrib->pktlen;
+	
+	if (xmitframe_addmic(padapter, pxmitframe) == _FAIL)
+	{
+		goto exit;
+	}
+
+	xmitframe_swencrypt(padapter, pxmitframe);
+	
+	update_attrib_vcs_info(padapter, pxmitframe);
+	
+exit:	
+	
+_func_exit_;	
+
+	return res;
+}
+#endif //CONFIG_TDLS
+
+/*
+ * Calculate wlan 802.11 packet MAX size from pkt_attrib
+ * This function doesn't consider fragment case
+ */
+u32 rtw_calculate_wlan_pkt_size_by_attribue(struct pkt_attrib *pattrib)
+{
+	u32	len = 0;
+
+	len = pattrib->hdrlen + pattrib->iv_len; // WLAN Header and IV
+	len += SNAP_SIZE + sizeof(u16); // LLC
+	len += pattrib->pktlen;
+	if (pattrib->encrypt == _TKIP_) len += 8; // MIC
+	len += pattrib->icv_len; // ICV
+
+	return len;
+}
+
+/*
+
+This sub-routine will perform all the following:
+
+1. remove 802.3 header.
+2. create wlan_header, based on the info in pxmitframe
+3. append sta's iv/ext-iv
+4. append LLC
+5. move frag chunk from pframe to pxmitframe->mem
+6. apply sw-encrypt, if necessary. 
+
+*/
+s32 rtw_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe)
+{
+	struct pkt_file pktfile;
+
+	s32 frg_inx, frg_len, mpdu_len, llc_sz, mem_sz;
+
+	SIZE_PTR addr;
+
+	u8 *pframe, *mem_start;
+
+	struct sta_info		*psta;
+	//struct sta_priv		*pstapriv = &padapter->stapriv;
+	//struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+
+	u8 *pbuf_start;
+
+	s32 bmcst = IS_MCAST(pattrib->ra);
+	s32 res = _SUCCESS;
+
+_func_enter_;
+
+	if (pattrib->psta)
+	{
+		psta = pattrib->psta;
+	} else
+	{	
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+	}
+
+	if(psta==NULL)
+        {
+		
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FAIL;
+	}
+
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FAIL;
+	}
+
+	if (pxmitframe->buf_addr == NULL){
+		DBG_8192C("==> %s buf_addr==NULL \n",__FUNCTION__);
+		return _FAIL;
+	}
+
+	pbuf_start = pxmitframe->buf_addr;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	mem_start = pbuf_start + TXDESC_SIZE + (pxmitframe->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	mem_start = pbuf_start + TXDESC_OFFSET;
+#endif
+
+	if (rtw_make_wlanhdr(padapter, mem_start, pattrib) == _FAIL) {
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("rtw_xmitframe_coalesce: rtw_make_wlanhdr fail; drop pkt\n"));
+		res = _FAIL;
+		goto exit;
+	}
+
+	_rtw_open_pktfile(pkt, &pktfile);
+	_rtw_pktfile_read(&pktfile, NULL, pattrib->pkt_hdrlen);
+
+	frg_inx = 0;
+	frg_len = pxmitpriv->frag_len - 4;//2346-4 = 2342
+
+	while (1)
+	{
+		llc_sz = 0;
+
+		mpdu_len = frg_len;
+
+		pframe = mem_start;
+
+		SetMFrag(mem_start);
+
+		pframe += pattrib->hdrlen;
+		mpdu_len -= pattrib->hdrlen;
+
+		//adding icv, if necessary...
+		if (pattrib->iv_len)
+		{
+			//if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
+			//	psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));
+			//else
+			//	psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+
+			if (psta != NULL)
+			{
+				switch(pattrib->encrypt)
+				{
+					case _WEP40_:
+					case _WEP104_:
+							WEP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);	
+						break;
+					case _TKIP_:			
+						if(bmcst)
+							TKIP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+						else
+							TKIP_IV(pattrib->iv, psta->dot11txpn, 0);
+						break;			
+					case _AES_:
+						if(bmcst)
+							AES_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+						else
+							AES_IV(pattrib->iv, psta->dot11txpn, 0);
+						break;
+				}
+			}
+
+			_rtw_memcpy(pframe, pattrib->iv, pattrib->iv_len);
+
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_notice_,
+				 ("rtw_xmitframe_coalesce: keyid=%d pattrib->iv[3]=%.2x pframe=%.2x %.2x %.2x %.2x\n",
+				  padapter->securitypriv.dot11PrivacyKeyIndex, pattrib->iv[3], *pframe, *(pframe+1), *(pframe+2), *(pframe+3)));
+
+			pframe += pattrib->iv_len;
+
+			mpdu_len -= pattrib->iv_len;
+		}
+
+		if (frg_inx == 0) {
+			llc_sz = rtw_put_snap(pframe, pattrib->ether_type);
+			pframe += llc_sz;
+			mpdu_len -= llc_sz;
+		}
+
+		if ((pattrib->icv_len >0) && (pattrib->bswenc)) {
+			mpdu_len -= pattrib->icv_len;
+		}
+
+
+		if (bmcst) {
+			// don't do fragment to broadcat/multicast packets
+			mem_sz = _rtw_pktfile_read(&pktfile, pframe, pattrib->pktlen);
+		} else {
+			mem_sz = _rtw_pktfile_read(&pktfile, pframe, mpdu_len);
+		}
+
+		pframe += mem_sz;
+
+		if ((pattrib->icv_len >0 )&& (pattrib->bswenc)) {
+			_rtw_memcpy(pframe, pattrib->icv, pattrib->icv_len); 
+			pframe += pattrib->icv_len;
+		}
+
+		frg_inx++;
+
+		if (bmcst || (rtw_endofpktfile(&pktfile) == _TRUE))
+		{
+			pattrib->nr_frags = frg_inx;
+
+			pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->iv_len + ((pattrib->nr_frags==1)? llc_sz:0) + 
+					((pattrib->bswenc) ? pattrib->icv_len : 0) + mem_sz;
+			
+			ClearMFrag(mem_start);
+
+			break;
+		} else {
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("%s: There're still something in packet!\n", __FUNCTION__));
+		}
+
+		addr = (SIZE_PTR)(pframe);
+		
+		mem_start = (unsigned char *)RND4(addr) + TXDESC_OFFSET;
+		_rtw_memcpy(mem_start, pbuf_start + TXDESC_OFFSET, pattrib->hdrlen);		
+	}
+
+	if (xmitframe_addmic(padapter, pxmitframe) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic(padapter, pxmitframe)==_FAIL\n"));
+		res = _FAIL;
+		goto exit;
+	}
+
+	xmitframe_swencrypt(padapter, pxmitframe);
+
+	if(bmcst == _FALSE)
+		update_attrib_vcs_info(padapter, pxmitframe);
+	else
+		pattrib->vcs_mode = NONE_VCS;
+
+exit:	
+	
+_func_exit_;	
+
+	return res;
+}
+
+#ifdef CONFIG_IEEE80211W
+//broadcast or multicast management pkt use BIP, unicast management pkt use CCMP encryption
+s32 rtw_mgmt_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe)
+{
+	struct pkt_file pktfile;
+	s32 frg_inx, frg_len, mpdu_len, llc_sz, mem_sz;
+	SIZE_PTR addr;
+	u8 *pframe, *mem_start = NULL, *tmp_buf=NULL;
+	u8 hw_hdr_offset, subtype ;
+	struct sta_info		*psta = NULL;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 *pbuf_start;
+	s32 bmcst = IS_MCAST(pattrib->ra);
+	s32 res = _FAIL;
+	u8 *BIP_AAD=NULL;
+	u8 *MGMT_body=NULL;
+	
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u8 MME[_MME_IE_LENGTH_];
+	
+	_irqL irqL;
+	u32	ori_len;
+	mem_start = pframe = (u8 *)(pxmitframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	
+_func_enter_;
+	ori_len = BIP_AAD_SIZE+pattrib->pktlen;
+	tmp_buf = BIP_AAD = rtw_zmalloc(ori_len);
+	subtype = GetFrameSubType(pframe); //bit(7)~bit(2)
+	
+	if(BIP_AAD == NULL)
+		return _FAIL;
+			
+	_enter_critical_bh(&padapter->security_key_mutex, &irqL);
+	
+	//only support station mode
+	if(!check_fwstate(pmlmepriv, WIFI_STATION_STATE) || !check_fwstate(pmlmepriv, _FW_LINKED))
+		goto xmitframe_coalesce_success;
+	
+	//IGTK key is not install, it may not support 802.11w
+	if(padapter->securitypriv.binstallBIPkey != _TRUE)
+	{
+		DBG_871X("no instll BIP key\n");
+		goto xmitframe_coalesce_success;
+	}
+	//station mode doesn't need TX BIP, just ready the code
+	if(bmcst)
+	{
+		int frame_body_len;
+		u8 mic[16];
+		
+		_rtw_memset(MME, 0, 18);
+				
+		//other types doesn't need the BIP
+		if(GetFrameSubType(pframe) != WIFI_DEAUTH && GetFrameSubType(pframe) != WIFI_DISASSOC)
+			goto xmitframe_coalesce_fail;
+		
+		MGMT_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+		pframe += pattrib->pktlen;
+		
+		//octent 0 and 1 is key index ,BIP keyid is 4 or 5, LSB only need octent 0
+		MME[0]=padapter->securitypriv.dot11wBIPKeyid;
+		//copy packet number
+		_rtw_memcpy(&MME[2], &pmlmeext->mgnt_80211w_IPN, 6);
+		//increase the packet number
+		pmlmeext->mgnt_80211w_IPN++;
+		
+		//add MME IE with MIC all zero, MME string doesn't include element id and length
+		pframe = rtw_set_ie(pframe, _MME_IE_ , 16 , MME, &(pattrib->pktlen));
+		pattrib->last_txcmdsz = pattrib->pktlen;
+		// total frame length - header length
+		frame_body_len = pattrib->pktlen - sizeof(struct rtw_ieee80211_hdr_3addr);
+		
+		//conscruct AAD, copy frame control field
+		_rtw_memcpy(BIP_AAD, &pwlanhdr->frame_ctl, 2);
+		ClearRetry(BIP_AAD);
+		ClearPwrMgt(BIP_AAD);
+		ClearMData(BIP_AAD);
+		//conscruct AAD, copy address 1 to address 3
+		_rtw_memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
+		//copy management fram body
+		_rtw_memcpy(BIP_AAD+BIP_AAD_SIZE, MGMT_body, frame_body_len);
+		/*//dump total packet include MME with zero MIC
+		{
+			int i;
+			printk("Total packet: ");
+			for(i=0; i < BIP_AAD_SIZE+frame_body_len; i++)
+				printk(" %02x ", BIP_AAD[i]);
+			printk("\n");
+		}*/
+		//calculate mic
+		if(omac1_aes_128(padapter->securitypriv.dot11wBIPKey[padapter->securitypriv.dot11wBIPKeyid].skey
+			, BIP_AAD, BIP_AAD_SIZE+frame_body_len, mic))
+			goto xmitframe_coalesce_fail;
+		
+		/*//dump calculated mic result
+		{
+			int i;
+			printk("Calculated mic result: ");
+			for(i=0; i<16; i++)
+				printk(" %02x ", mic[i]);
+			printk("\n");
+		}*/
+		//copy right BIP mic value, total is 128bits, we use the 0~63 bits
+		_rtw_memcpy(pframe-8, mic, 8);
+		/*/dump all packet after mic ok
+		{
+			int pp;
+			printk("pattrib->pktlen = %d \n", pattrib->pktlen);
+			for(pp=0;pp< pattrib->pktlen; pp++)
+				printk(" %02x ", mem_start[pp]);
+			printk("\n");
+		}*/
+	}
+	else //unicast mgmt frame TX
+	{
+		//start to encrypt mgmt frame
+		if(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC ||
+			subtype == WIFI_REASSOCREQ || subtype == WIFI_ACTION)
+		{
+			if (pattrib->psta)
+				psta = pattrib->psta;
+			else
+			{
+				psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+			}
+		
+			if(psta==NULL)
+			{
+				
+				DBG_871X("%s, psta==NUL\n", __func__);
+				goto xmitframe_coalesce_fail;
+			}
+		
+			if(!(psta->state & _FW_LINKED) || pxmitframe->buf_addr==NULL)
+			{
+				DBG_871X("%s, not _FW_LINKED or addr null\n", __func__);
+				goto xmitframe_coalesce_fail;
+			}
+			
+			//DBG_871X("%s, action frame category=%d \n", __func__, pframe[WLAN_HDR_A3_LEN]);
+			//according 802.11-2012 standard, these five types are not robust types
+			if(subtype == WIFI_ACTION && 
+			(pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_PUBLIC ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_HT ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_UNPROTECTED_WNM ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_SELF_PROTECTED  ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_P2P))
+				goto xmitframe_coalesce_fail;
+			//before encrypt dump the management packet content
+			/*{
+				int i;
+				printk("Management pkt: ");
+				for(i=0; i<pattrib->pktlen; i++)
+				printk(" %02x ", pframe[i]);
+				printk("=======\n");
+			}*/
+			if(pattrib->encrypt>0)
+				_rtw_memcpy(pattrib->dot118021x_UncstKey.skey, psta->dot118021x_UncstKey.skey, 16);
+			//bakeup original management packet
+			_rtw_memcpy(tmp_buf, pframe, pattrib->pktlen);
+			//move to data portion
+			pframe += pattrib->hdrlen;
+			
+			//802.11w unicast management packet must be _AES_
+			pattrib->iv_len = 8;
+			//it's MIC of AES
+			pattrib->icv_len = 8;
+			
+			switch(pattrib->encrypt)
+			{
+				case _AES_:
+						//set AES IV header
+						AES_IV(pattrib->iv, psta->dot11wtxpn, 0);
+					break;
+				default:
+					goto xmitframe_coalesce_fail;
+			}
+			//insert iv header into management frame
+			_rtw_memcpy(pframe, pattrib->iv, pattrib->iv_len);
+			pframe += pattrib->iv_len;
+			//copy mgmt data portion after CCMP header
+			_rtw_memcpy(pframe, tmp_buf+pattrib->hdrlen, pattrib->pktlen-pattrib->hdrlen);
+			//move pframe to end of mgmt pkt
+			pframe += pattrib->pktlen-pattrib->hdrlen;
+			//add 8 bytes CCMP IV header to length
+			pattrib->pktlen += pattrib->iv_len;
+			/*//dump management packet include AES IV header
+			{
+				int i;
+				printk("Management pkt + IV: ");
+				//for(i=0; i<pattrib->pktlen; i++)
+				//printk(" %02x ", mem_start[i]);
+				printk("@@@@@@@@@@@@@\n");
+			}*/
+			
+			if ((pattrib->icv_len >0 )&& (pattrib->bswenc)) {
+				_rtw_memcpy(pframe, pattrib->icv, pattrib->icv_len); 
+				pframe += pattrib->icv_len;
+			}
+			//add 8 bytes MIC
+			pattrib->pktlen += pattrib->icv_len;
+			//set final tx command size
+			pattrib->last_txcmdsz = pattrib->pktlen;
+	
+			//set protected bit must be beofre SW encrypt
+			SetPrivacy(mem_start);
+			/*//dump management packet include AES header
+			{
+				int i;
+				printk("prepare to enc Management pkt + IV: ");
+				for(i=0; i<pattrib->pktlen; i++)
+				printk(" %02x ", mem_start[i]);
+				printk("@@@@@@@@@@@@@\n");
+			}*/
+			//software encrypt
+			xmitframe_swencrypt(padapter, pxmitframe);
+		}
+	}
+
+xmitframe_coalesce_success:
+	_exit_critical_bh(&padapter->security_key_mutex, &irqL);
+	rtw_mfree(BIP_AAD, ori_len);
+_func_exit_;
+	return _SUCCESS;
+	
+xmitframe_coalesce_fail:
+	_exit_critical_bh(&padapter->security_key_mutex, &irqL);
+	rtw_mfree(BIP_AAD, ori_len);
+_func_exit_;
+
+	return _FAIL;
+}
+#endif //CONFIG_IEEE80211W
+
+/* Logical Link Control(LLC) SubNetwork Attachment Point(SNAP) header
+ * IEEE LLC/SNAP header contains 8 octets
+ * First 3 octets comprise the LLC portion
+ * SNAP portion, 5 octets, is divided into two fields:
+ *	Organizationally Unique Identifier(OUI), 3 octets,
+ *	type, defined by that organization, 2 octets.
+ */
+s32 rtw_put_snap(u8 *data, u16 h_proto)
+{
+	struct ieee80211_snap_hdr *snap;
+	u8 *oui;
+
+_func_enter_;
+
+	snap = (struct ieee80211_snap_hdr *)data;
+	snap->dsap = 0xaa;
+	snap->ssap = 0xaa;
+	snap->ctrl = 0x03;
+
+	if (h_proto == 0x8137 || h_proto == 0x80f3)
+		oui = P802_1H_OUI;
+	else
+		oui = RFC1042_OUI;
+	
+	snap->oui[0] = oui[0];
+	snap->oui[1] = oui[1];
+	snap->oui[2] = oui[2];
+
+	*(u16 *)(data + SNAP_SIZE) = htons(h_proto);
+
+_func_exit_;
+
+	return SNAP_SIZE + sizeof(u16);
+}
+
+void rtw_update_protection(_adapter *padapter, u8 *ie, uint ie_len)
+{
+
+	uint	protection;
+	u8	*perp;
+	sint	 erp_len;
+	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct	registry_priv *pregistrypriv = &padapter->registrypriv;
+	
+_func_enter_;
+	
+	switch(pxmitpriv->vcs_setting)
+	{
+		case DISABLE_VCS:
+			pxmitpriv->vcs = NONE_VCS;
+			break;
+	
+		case ENABLE_VCS:
+			break;
+	
+		case AUTO_VCS:
+		default:
+			perp = rtw_get_ie(ie, _ERPINFO_IE_, &erp_len, ie_len);
+			if(perp == NULL)
+			{
+				pxmitpriv->vcs = NONE_VCS;
+			}
+			else
+			{
+				protection = (*(perp + 2)) & BIT(1);
+				if (protection)
+				{
+					if(pregistrypriv->vcs_type == RTS_CTS)
+						pxmitpriv->vcs = RTS_CTS;
+					else
+						pxmitpriv->vcs = CTS_TO_SELF;
+				}
+				else
+					pxmitpriv->vcs = NONE_VCS;
+			}
+
+			break;			
+	
+	}
+
+_func_exit_;
+
+}
+
+void rtw_count_tx_stats(_adapter *padapter, struct xmit_frame *pxmitframe, int sz)
+{
+	struct sta_info *psta = NULL;
+	struct stainfo_stats *pstats = NULL;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG)
+	{
+		pxmitpriv->tx_bytes += sz;
+#ifdef CONFIG_USB_TX_AGGREGATION
+		pmlmepriv->LinkDetectInfo.NumTxOkInPeriod += pxmitframe->agg_num;
+#else
+		pmlmepriv->LinkDetectInfo.NumTxOkInPeriod++;
+#endif
+
+		psta = pxmitframe->attrib.psta;
+
+		if(psta)
+		{
+			pstats = &psta->sta_stats;
+#ifdef CONFIG_USB_TX_AGGREGATION
+			pstats->tx_pkts += pxmitframe->agg_num;
+#else
+			pstats->tx_pkts++;
+#endif
+			pstats->tx_bytes += sz;
+		}
+	}
+	
+}
+
+struct xmit_buf *rtw_alloc_xmitbuf_ext(struct xmit_priv *pxmitpriv)
+{
+	_irqL irqL;
+	struct xmit_buf *pxmitbuf =  NULL;
+	_list *plist, *phead;
+	_queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
+
+_func_enter_;
+
+	_enter_critical(&pfree_queue->lock, &irqL);
+
+	if(_rtw_queue_empty(pfree_queue) == _TRUE) {
+		pxmitbuf = NULL;
+	} else {
+
+		phead = get_list_head(pfree_queue);
+
+		plist = get_next(phead);
+
+		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
+
+		rtw_list_delete(&(pxmitbuf->list));
+	}
+
+	if (pxmitbuf !=  NULL)
+	{
+		pxmitpriv->free_xmit_extbuf_cnt--;
+		#ifdef DBG_XMIT_BUF
+		DBG_871X("DBG_XMIT_BUF ALLOC no=%d,  free_xmit_extbuf_cnt=%d\n",pxmitbuf->no, pxmitpriv->free_xmit_extbuf_cnt);
+		#endif
+		
+	
+		pxmitbuf->priv_data = NULL;
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+#ifdef CONFIG_PCI_HCI
+		pxmitbuf->len = 0;
+#endif
+
+		if (pxmitbuf->sctx) {
+			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
+			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
+		}
+
+	}
+
+	_exit_critical(&pfree_queue->lock, &irqL);
+
+_func_exit_;
+
+	return pxmitbuf;
+}
+
+s32 rtw_free_xmitbuf_ext(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+	_irqL irqL;
+	_queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
+
+_func_enter_;
+
+	if(pxmitbuf==NULL)
+	{
+		return _FAIL;
+	}
+
+	_enter_critical(&pfree_queue->lock, &irqL);
+
+	rtw_list_delete(&pxmitbuf->list);
+
+	rtw_list_insert_tail(&(pxmitbuf->list), get_list_head(pfree_queue));
+	pxmitpriv->free_xmit_extbuf_cnt++;
+	#ifdef DBG_XMIT_BUF
+	DBG_871X("DBG_XMIT_BUF FREE no=%d, free_xmit_extbuf_cnt=%d\n",pxmitbuf->no ,pxmitpriv->free_xmit_extbuf_cnt);
+	#endif
+
+	_exit_critical(&pfree_queue->lock, &irqL);
+
+_func_exit_;
+
+	return _SUCCESS;
+} 
+
+struct xmit_buf *rtw_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
+{
+	_irqL irqL;
+	struct xmit_buf *pxmitbuf =  NULL;
+	_list *plist, *phead;
+	_queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
+
+_func_enter_;
+
+	//DBG_871X("+rtw_alloc_xmitbuf\n");
+
+	_enter_critical(&pfree_xmitbuf_queue->lock, &irqL);
+
+	if(_rtw_queue_empty(pfree_xmitbuf_queue) == _TRUE) {
+		pxmitbuf = NULL;
+	} else {
+
+		phead = get_list_head(pfree_xmitbuf_queue);
+
+		plist = get_next(phead);
+
+		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
+
+		rtw_list_delete(&(pxmitbuf->list));
+	}
+
+	if (pxmitbuf !=  NULL)
+	{
+		pxmitpriv->free_xmitbuf_cnt--;
+		#ifdef DBG_XMIT_BUF
+		DBG_871X("DBG_XMIT_BUF ALLOC no=%d,  free_xmitbuf_cnt=%d\n",pxmitbuf->no, pxmitpriv->free_xmitbuf_cnt);
+		#endif
+		//DBG_871X("alloc, free_xmitbuf_cnt=%d\n", pxmitpriv->free_xmitbuf_cnt);
+
+		pxmitbuf->priv_data = NULL;
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+#ifdef CONFIG_PCI_HCI
+		pxmitbuf->len = 0;
+#endif
+
+		if (pxmitbuf->sctx) {
+			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
+			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
+		}
+	}
+	#ifdef DBG_XMIT_BUF
+	else
+	{
+		DBG_871X("DBG_XMIT_BUF rtw_alloc_xmitbuf return NULL\n");
+	}
+	#endif
+
+	_exit_critical(&pfree_xmitbuf_queue->lock, &irqL);
+
+_func_exit_;
+
+	return pxmitbuf;
+}
+
+s32 rtw_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+	_irqL irqL;
+	_queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
+
+_func_enter_;
+
+	//DBG_871X("+rtw_free_xmitbuf\n");
+
+	if(pxmitbuf==NULL)
+	{
+		return _FAIL;
+	}
+
+	if (pxmitbuf->sctx) {
+		DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_FREE);
+	}
+
+	if(pxmitbuf->ext_tag)
+	{
+		rtw_free_xmitbuf_ext(pxmitpriv, pxmitbuf);
+	}
+	else
+	{
+		_enter_critical(&pfree_xmitbuf_queue->lock, &irqL);
+
+		rtw_list_delete(&pxmitbuf->list);	
+
+		rtw_list_insert_tail(&(pxmitbuf->list), get_list_head(pfree_xmitbuf_queue));
+
+		pxmitpriv->free_xmitbuf_cnt++;
+		//DBG_871X("FREE, free_xmitbuf_cnt=%d\n", pxmitpriv->free_xmitbuf_cnt);
+		#ifdef DBG_XMIT_BUF
+		DBG_871X("DBG_XMIT_BUF FREE no=%d, free_xmitbuf_cnt=%d\n",pxmitbuf->no ,pxmitpriv->free_xmitbuf_cnt);
+		#endif
+		_exit_critical(&pfree_xmitbuf_queue->lock, &irqL);
+	}
+
+_func_exit_;	 
+
+	return _SUCCESS;	
+} 
+
+void rtw_init_xmitframe(struct xmit_frame *pxframe)
+{
+	if (pxframe !=  NULL)//default value setting
+	{
+		pxframe->buf_addr = NULL;
+		pxframe->pxmitbuf = NULL;
+
+		_rtw_memset(&pxframe->attrib, 0, sizeof(struct pkt_attrib));
+		//pxframe->attrib.psta = NULL;
+
+		pxframe->frame_tag = DATA_FRAMETAG;
+
+#ifdef CONFIG_USB_HCI
+		pxframe->pkt = NULL;
+		pxframe->pkt_offset = 1;//default use pkt_offset to fill tx desc
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+		pxframe->agg_num = 1;
+#endif
+
+#endif //#ifdef CONFIG_USB_HCI
+
+#if defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+		pxframe->pg_num = 1;
+		pxframe->agg_num = 1;
+#endif
+
+#ifdef CONFIG_XMIT_ACK
+		pxframe->ack_report = 0;
+#endif
+
+	}
+}
+
+/*
+Calling context:
+1. OS_TXENTRY
+2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
+
+If we turn on USE_RXTHREAD, then, no need for critical section.
+Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
+
+Must be very very cautious...
+
+*/
+struct xmit_frame *rtw_alloc_xmitframe(struct xmit_priv *pxmitpriv)//(_queue *pfree_xmit_queue)
+{
+	/*
+		Please remember to use all the osdep_service api,
+		and lock/unlock or _enter/_exit critical to protect 
+		pfree_xmit_queue
+	*/
+
+	_irqL irqL;
+	struct xmit_frame *pxframe = NULL;
+	_list *plist, *phead;
+	_queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
+#ifdef PLATFORM_LINUX
+	_adapter *padapter = pxmitpriv->adapter;
+#endif //PLATFORM_LINUX
+
+_func_enter_;
+
+	_enter_critical_bh(&pfree_xmit_queue->lock, &irqL);
+
+	if (_rtw_queue_empty(pfree_xmit_queue) == _TRUE) {
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_alloc_xmitframe:%d\n", pxmitpriv->free_xmitframe_cnt));
+		pxframe =  NULL;
+	} else {
+		phead = get_list_head(pfree_xmit_queue);
+
+		plist = get_next(phead);
+
+		pxframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		rtw_list_delete(&(pxframe->list));
+		pxmitpriv->free_xmitframe_cnt--;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe():free_xmitframe_cnt=%d\n", pxmitpriv->free_xmitframe_cnt));
+	}
+
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35))
+		if(pxmitpriv->free_xmitframe_cnt==1)
+		{
+			if (!rtw_netif_queue_stopped(padapter->pnetdev))
+				rtw_netif_stop_queue(padapter->pnetdev);
+		}
+#endif
+#endif
+
+	_exit_critical_bh(&pfree_xmit_queue->lock, &irqL);
+
+	rtw_init_xmitframe(pxframe);
+
+_func_exit_;
+
+	return pxframe;
+}
+
+struct xmit_frame *rtw_alloc_xmitframe_ext(struct xmit_priv *pxmitpriv)
+{
+	_irqL irqL;
+	struct xmit_frame *pxframe = NULL;
+	_list *plist, *phead;
+	_queue *queue = &pxmitpriv->free_xframe_ext_queue;
+
+_func_enter_;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (_rtw_queue_empty(queue) == _TRUE) {
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_alloc_xmitframe_ext:%d\n", pxmitpriv->free_xframe_ext_cnt));
+		pxframe =  NULL;
+	} else {
+		phead = get_list_head(queue);
+		plist = get_next(phead);
+		pxframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		rtw_list_delete(&(pxframe->list));
+		pxmitpriv->free_xframe_ext_cnt--;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe_ext():free_xmitframe_cnt=%d\n", pxmitpriv->free_xframe_ext_cnt));
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+	rtw_init_xmitframe(pxframe);
+
+_func_exit_;
+
+	return pxframe;
+}
+
+struct xmit_frame *rtw_alloc_xmitframe_once(struct xmit_priv *pxmitpriv)
+{
+	struct xmit_frame *pxframe = NULL;
+	u8 *alloc_addr;
+
+	alloc_addr = rtw_zmalloc(sizeof(struct xmit_frame) + 4);
+	
+	if (alloc_addr == NULL)
+		goto exit;
+		
+	pxframe = (struct xmit_frame *)N_BYTE_ALIGMENT((SIZE_PTR)(alloc_addr), 4);
+	pxframe->alloc_addr = alloc_addr;
+
+	pxframe->padapter = pxmitpriv->adapter;
+	pxframe->frame_tag = NULL_FRAMETAG;
+
+	pxframe->pkt = NULL;
+
+	pxframe->buf_addr = NULL;
+	pxframe->pxmitbuf = NULL;
+
+	rtw_init_xmitframe(pxframe);
+
+	DBG_871X("################## %s ##################\n", __func__);
+
+exit:
+	return pxframe;
+}
+
+s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitframe)
+{	
+	_irqL irqL;
+	_queue *queue = NULL;
+	_adapter *padapter = pxmitpriv->adapter;
+	_pkt *pndis_pkt = NULL;
+
+_func_enter_;	
+
+	if (pxmitframe == NULL) {
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("======rtw_free_xmitframe():pxmitframe==NULL!!!!!!!!!!\n"));
+		goto exit;
+	}
+
+	if (pxmitframe->pkt){
+		pndis_pkt = pxmitframe->pkt;
+		pxmitframe->pkt = NULL;
+	}
+
+	if (pxmitframe->alloc_addr) {
+		DBG_871X("################## %s with alloc_addr ##################\n", __func__);
+		rtw_mfree(pxmitframe->alloc_addr, sizeof(struct xmit_frame) + 4);
+		goto check_pkt_complete;
+	}
+
+	if (pxmitframe->ext_tag == 0)
+		queue = &pxmitpriv->free_xmit_queue;
+	else if(pxmitframe->ext_tag == 1)
+		queue = &pxmitpriv->free_xframe_ext_queue;
+	else
+	{}
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	rtw_list_delete(&pxmitframe->list);	
+	rtw_list_insert_tail(&pxmitframe->list, get_list_head(queue));
+	if (pxmitframe->ext_tag == 0) {
+		pxmitpriv->free_xmitframe_cnt++;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_debug_, ("rtw_free_xmitframe():free_xmitframe_cnt=%d\n", pxmitpriv->free_xmitframe_cnt));
+	} else if(pxmitframe->ext_tag == 1) {
+		pxmitpriv->free_xframe_ext_cnt++;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_debug_, ("rtw_free_xmitframe():free_xframe_ext_cnt=%d\n", pxmitpriv->free_xframe_ext_cnt));
+	} else {
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+check_pkt_complete:
+
+	if(pndis_pkt)
+		rtw_os_pkt_complete(padapter, pndis_pkt);
+
+exit:
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, _queue *pframequeue)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	struct	xmit_frame 	*pxmitframe;
+
+_func_enter_;	
+
+	_enter_critical_bh(&(pframequeue->lock), &irqL);
+
+	phead = get_list_head(pframequeue);
+	plist = get_next(phead);
+	
+	while (rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+			
+		pxmitframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		plist = get_next(plist); 
+		
+		rtw_free_xmitframe(pxmitpriv,pxmitframe);
+			
+	}
+	_exit_critical_bh(&(pframequeue->lock), &irqL);
+
+_func_exit_;
+}
+
+s32 rtw_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	if (rtw_xmit_classifier(padapter, pxmitframe) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_,
+			 ("rtw_xmitframe_enqueue: drop xmit pkt for classifier fail\n"));
+//		pxmitframe->pkt = NULL;
+		return _FAIL;
+	}
+
+	return _SUCCESS;
+}
+
+static struct xmit_frame *dequeue_one_xmitframe(struct xmit_priv *pxmitpriv, struct hw_xmit *phwxmit, struct tx_servq *ptxservq, _queue *pframe_queue)
+{
+	_list	*xmitframe_plist, *xmitframe_phead;
+	struct	xmit_frame	*pxmitframe=NULL;
+
+	xmitframe_phead = get_list_head(pframe_queue);
+	xmitframe_plist = get_next(xmitframe_phead);
+
+	while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+		xmitframe_plist = get_next(xmitframe_plist);
+
+/*#ifdef RTK_DMP_PLATFORM
+#ifdef CONFIG_USB_TX_AGGREGATION
+		if((ptxservq->qcnt>0) && (ptxservq->qcnt<=2))
+		{
+			pxmitframe = NULL;
+
+			tasklet_schedule(&pxmitpriv->xmit_tasklet);
+
+			break;
+		}
+#endif
+#endif*/
+		rtw_list_delete(&pxmitframe->list);
+
+		ptxservq->qcnt--;
+
+			break;
+
+		pxmitframe = NULL;
+
+	}
+
+	return pxmitframe;
+}
+
+struct xmit_frame* rtw_dequeue_xframe(struct xmit_priv *pxmitpriv, struct hw_xmit *phwxmit_i, sint entry)
+{
+	_irqL irqL0;
+	_list *sta_plist, *sta_phead;
+	struct hw_xmit *phwxmit;
+	struct tx_servq *ptxservq = NULL;
+	_queue *pframe_queue = NULL;
+	struct xmit_frame *pxmitframe = NULL;
+	_adapter *padapter = pxmitpriv->adapter;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	int i, inx[4];
+#ifdef CONFIG_USB_HCI
+//	int j, tmp, acirp_cnt[4];
+#endif
+
+_func_enter_;
+
+	inx[0] = 0; inx[1] = 1; inx[2] = 2; inx[3] = 3;
+
+	if(pregpriv->wifi_spec==1)
+	{
+		int j, tmp, acirp_cnt[4];
+#if 0
+		if(flags<XMIT_QUEUE_ENTRY)
+		{
+			//priority exchange according to the completed xmitbuf flags.
+			inx[flags] = 0;
+			inx[0] = flags;
+		}
+#endif	
+	
+#ifdef CONFIG_USB_HCI
+		//entry indx: 0->vo, 1->vi, 2->be, 3->bk.
+		acirp_cnt[0] = pxmitpriv->voq_cnt;
+		acirp_cnt[1] = pxmitpriv->viq_cnt;
+		acirp_cnt[2] = pxmitpriv->beq_cnt;
+		acirp_cnt[3] = pxmitpriv->bkq_cnt;
+
+		for(i=0; i<4; i++)
+		{
+			for(j=i+1; j<4; j++)
+			{
+				if(acirp_cnt[j]<acirp_cnt[i])
+				{
+					tmp = acirp_cnt[i];
+					acirp_cnt[i] = acirp_cnt[j];
+					acirp_cnt[j] = tmp;
+
+					tmp = inx[i];
+					inx[i] = inx[j];
+					inx[j] = tmp;
+				}
+			}
+		}
+#endif
+	}
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+
+	for(i = 0; i < entry; i++) 
+	{
+		phwxmit = phwxmit_i + inx[i];
+
+		//_enter_critical_ex(&phwxmit->sta_queue->lock, &irqL0);
+
+		sta_phead = get_list_head(phwxmit->sta_queue);
+		sta_plist = get_next(sta_phead);
+
+		while ((rtw_end_of_queue_search(sta_phead, sta_plist)) == _FALSE)
+		{
+
+			ptxservq= LIST_CONTAINOR(sta_plist, struct tx_servq, tx_pending);
+
+			pframe_queue = &ptxservq->sta_pending;
+
+			pxmitframe = dequeue_one_xmitframe(pxmitpriv, phwxmit, ptxservq, pframe_queue);
+
+			if(pxmitframe)
+			{
+				phwxmit->accnt--;
+
+				//Remove sta node when there is no pending packets.
+				if(_rtw_queue_empty(pframe_queue)) //must be done after get_next and before break
+					rtw_list_delete(&ptxservq->tx_pending);
+
+				//_exit_critical_ex(&phwxmit->sta_queue->lock, &irqL0);
+
+				goto exit;
+			}
+
+			sta_plist = get_next(sta_plist);
+
+		}
+
+		//_exit_critical_ex(&phwxmit->sta_queue->lock, &irqL0);
+
+	}
+
+exit:
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+
+_func_exit_;
+
+	return pxmitframe;
+}
+
+#if 1
+struct tx_servq *rtw_get_sta_pending(_adapter *padapter, struct sta_info *psta, sint up, u8 *ac)
+{
+	struct tx_servq *ptxservq=NULL;
+	
+_func_enter_;	
+
+	switch (up) 
+	{
+		case 1:
+		case 2:
+			ptxservq = &(psta->sta_xmitpriv.bk_q);
+			*(ac) = 3;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BK \n"));
+			break;
+
+		case 4:
+		case 5:
+			ptxservq = &(psta->sta_xmitpriv.vi_q);
+			*(ac) = 1;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VI\n"));
+			break;
+
+		case 6:
+		case 7:
+			ptxservq = &(psta->sta_xmitpriv.vo_q);
+			*(ac) = 0;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VO \n"));			
+			break;
+
+		case 0:
+		case 3:
+		default:
+			ptxservq = &(psta->sta_xmitpriv.be_q);
+			*(ac) = 2;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BE \n"));				
+		break;
+		
+	}
+
+_func_exit_;
+
+	return ptxservq;			
+}
+#else
+__inline static struct tx_servq *rtw_get_sta_pending
+	(_adapter *padapter, _queue **ppstapending, struct sta_info *psta, sint up)
+{
+	struct tx_servq *ptxservq;
+	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
+	
+_func_enter_;	
+
+#ifdef CONFIG_RTL8711
+
+	if(IS_MCAST(psta->hwaddr))
+	{
+		ptxservq = &(psta->sta_xmitpriv.be_q); // we will use be_q to queue bc/mc frames in BCMC_stainfo
+		*ppstapending = &padapter->xmitpriv.bm_pending; 
+	}
+	else
+#endif		
+	{
+		switch (up) 
+		{
+			case 1:
+			case 2:
+				ptxservq = &(psta->sta_xmitpriv.bk_q);
+				*ppstapending = &padapter->xmitpriv.bk_pending;
+				(phwxmits+3)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BK \n"));
+				break;
+
+			case 4:
+			case 5:
+				ptxservq = &(psta->sta_xmitpriv.vi_q);
+				*ppstapending = &padapter->xmitpriv.vi_pending;
+				(phwxmits+1)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VI\n"));
+				break;
+
+			case 6:
+			case 7:
+				ptxservq = &(psta->sta_xmitpriv.vo_q);
+				*ppstapending = &padapter->xmitpriv.vo_pending;
+				(phwxmits+0)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VO \n"));			
+				break;
+
+			case 0:
+			case 3:
+			default:
+				ptxservq = &(psta->sta_xmitpriv.be_q);
+				*ppstapending = &padapter->xmitpriv.be_pending;
+				(phwxmits+2)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BE \n"));				
+			break;
+			
+		}
+
+	}
+
+_func_exit_;
+
+	return ptxservq;			
+}
+#endif
+
+/*
+ * Will enqueue pxmitframe to the proper queue,
+ * and indicate it to xx_pending list.....
+ */
+s32 rtw_xmit_classifier(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	//_irqL irqL0;
+	u8	ac_index;
+	struct sta_info	*psta;
+	struct tx_servq	*ptxservq;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_priv	*pstapriv = &padapter->stapriv;
+	struct hw_xmit	*phwxmits =  padapter->xmitpriv.hwxmits;
+	sint res = _SUCCESS;
+
+_func_enter_;
+
+	if (pattrib->psta) {
+		psta = pattrib->psta;		
+	} else {
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+	}
+
+	if (psta == NULL) {
+		res = _FAIL;
+		DBG_8192C("rtw_xmit_classifier: psta == NULL\n");
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("rtw_xmit_classifier: psta == NULL\n"));
+		goto exit;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FAIL;
+	}
+
+	ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
+
+	//_enter_critical(&pstapending->lock, &irqL0);
+
+	if (rtw_is_list_empty(&ptxservq->tx_pending)) {
+		rtw_list_insert_tail(&ptxservq->tx_pending, get_list_head(phwxmits[ac_index].sta_queue));
+	}
+
+	//_enter_critical(&ptxservq->sta_pending.lock, &irqL1);
+
+	rtw_list_insert_tail(&pxmitframe->list, get_list_head(&ptxservq->sta_pending));
+	ptxservq->qcnt++;
+	phwxmits[ac_index].accnt++;
+
+	//_exit_critical(&ptxservq->sta_pending.lock, &irqL1);
+
+	//_exit_critical(&pstapending->lock, &irqL0);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+void rtw_alloc_hwxmits(_adapter *padapter)
+{
+	struct hw_xmit *hwxmits;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
+
+	pxmitpriv->hwxmits = (struct hw_xmit *)rtw_zmalloc(sizeof (struct hw_xmit) * pxmitpriv->hwxmit_entry);	
+	
+	hwxmits = pxmitpriv->hwxmits;
+
+	if(pxmitpriv->hwxmit_entry == 5)
+	{
+		//pxmitpriv->bmc_txqueue.head = 0;
+		//hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue;
+		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
+	
+		//pxmitpriv->vo_txqueue.head = 0;
+		//hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue;
+		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
+
+		//pxmitpriv->vi_txqueue.head = 0;
+		//hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue;
+		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
+	
+		//pxmitpriv->bk_txqueue.head = 0;
+		//hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
+		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+
+      		//pxmitpriv->be_txqueue.head = 0;
+		//hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue;
+		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
+		
+	}	
+	else if(pxmitpriv->hwxmit_entry == 4)
+	{
+
+		//pxmitpriv->vo_txqueue.head = 0;
+		//hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue;
+		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
+
+		//pxmitpriv->vi_txqueue.head = 0;
+		//hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue;
+		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
+
+		//pxmitpriv->be_txqueue.head = 0;
+		//hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue;
+		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
+	
+		//pxmitpriv->bk_txqueue.head = 0;
+		//hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
+		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+	}
+	else
+	{
+		
+
+	}
+	
+
+}
+
+void rtw_free_hwxmits(_adapter *padapter)
+{
+	struct hw_xmit *hwxmits;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	hwxmits = pxmitpriv->hwxmits;
+	if(hwxmits)
+		rtw_mfree((u8 *)hwxmits, (sizeof (struct hw_xmit) * pxmitpriv->hwxmit_entry));
+}
+
+void rtw_init_hwxmits(struct hw_xmit *phwxmit, sint entry)
+{
+	sint i;
+_func_enter_;	
+	for(i = 0; i < entry; i++, phwxmit++)
+	{
+		//_rtw_spinlock_init(&phwxmit->xmit_lock);
+		//_rtw_init_listhead(&phwxmit->pending);		
+		//phwxmit->txcmdcnt = 0;
+		phwxmit->accnt = 0;
+	}
+_func_exit_;	
+}
+
+#ifdef CONFIG_BR_EXT
+int rtw_br_client_tx(_adapter *padapter, struct sk_buff **pskb)
+{
+	struct sk_buff *skb = *pskb;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	_irqL irqL;
+	//if(check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE)
+	{
+		void dhcp_flag_bcast(_adapter *priv, struct sk_buff *skb);
+		int res, is_vlan_tag=0, i, do_nat25=1;
+		unsigned short vlan_hdr=0;
+		void *br_port = NULL;
+
+		//mac_clone_handle_frame(priv, skb);
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		rcu_read_lock();
+		br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+		rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		_enter_critical_bh(&padapter->br_ext_lock, &irqL);
+		if (	!(skb->data[0] & 1) &&
+				br_port &&
+				memcmp(skb->data+MACADDRLEN, padapter->br_mac, MACADDRLEN) &&
+				*((unsigned short *)(skb->data+MACADDRLEN*2)) != __constant_htons(ETH_P_8021Q) &&
+				*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_IP) &&
+				!memcmp(padapter->scdb_mac, skb->data+MACADDRLEN, MACADDRLEN) && padapter->scdb_entry) {
+			memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+			padapter->scdb_entry->ageing_timer = jiffies;
+			_exit_critical_bh(&padapter->br_ext_lock, &irqL);
+		}
+		else
+		//if (!priv->pmib->ethBrExtInfo.nat25_disable) 		
+		{
+//			if (priv->dev->br_port &&
+//				 !memcmp(skb->data+MACADDRLEN, priv->br_mac, MACADDRLEN)) {
+#if 1
+			if (*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_8021Q)) {
+				is_vlan_tag = 1;
+				vlan_hdr = *((unsigned short *)(skb->data+MACADDRLEN*2+2));
+				for (i=0; i<6; i++)
+					*((unsigned short *)(skb->data+MACADDRLEN*2+2-i*2)) = *((unsigned short *)(skb->data+MACADDRLEN*2-2-i*2));
+				skb_pull(skb, 4);
+			}
+			//if SA == br_mac && skb== IP  => copy SIP to br_ip ?? why
+			if (!memcmp(skb->data+MACADDRLEN, padapter->br_mac, MACADDRLEN) &&
+				(*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_IP)))
+				memcpy(padapter->br_ip, skb->data+WLAN_ETHHDR_LEN+12, 4);
+
+			if (*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_IP)) {
+				if (memcmp(padapter->scdb_mac, skb->data+MACADDRLEN, MACADDRLEN)) {
+					void *scdb_findEntry(_adapter *priv, unsigned char *macAddr, unsigned char *ipAddr);
+					
+					if ((padapter->scdb_entry = (struct nat25_network_db_entry *)scdb_findEntry(padapter,
+								skb->data+MACADDRLEN, skb->data+WLAN_ETHHDR_LEN+12)) != NULL) {
+						memcpy(padapter->scdb_mac, skb->data+MACADDRLEN, MACADDRLEN);
+						memcpy(padapter->scdb_ip, skb->data+WLAN_ETHHDR_LEN+12, 4);
+						padapter->scdb_entry->ageing_timer = jiffies;
+						do_nat25 = 0;
+					}
+				}
+				else {
+					if (padapter->scdb_entry) {
+						padapter->scdb_entry->ageing_timer = jiffies;
+						do_nat25 = 0;
+					}
+					else {
+						memset(padapter->scdb_mac, 0, MACADDRLEN);
+						memset(padapter->scdb_ip, 0, 4);
+					}
+				}
+			}
+			_exit_critical_bh(&padapter->br_ext_lock, &irqL);
+#endif // 1
+			if (do_nat25)
+			{
+				int nat25_db_handle(_adapter *priv, struct sk_buff *skb, int method);
+				if (nat25_db_handle(padapter, skb, NAT25_CHECK) == 0) {
+					struct sk_buff *newskb;
+
+					if (is_vlan_tag) {
+						skb_push(skb, 4);
+						for (i=0; i<6; i++)
+							*((unsigned short *)(skb->data+i*2)) = *((unsigned short *)(skb->data+4+i*2));
+						*((unsigned short *)(skb->data+MACADDRLEN*2)) = __constant_htons(ETH_P_8021Q);
+						*((unsigned short *)(skb->data+MACADDRLEN*2+2)) = vlan_hdr;
+					}
+
+					newskb = rtw_skb_copy(skb);
+					if (newskb == NULL) {
+						//priv->ext_stats.tx_drops++;
+						DEBUG_ERR("TX DROP: rtw_skb_copy fail!\n");
+						//goto stop_proc;
+						return -1;
+					}
+					rtw_skb_free(skb);
+
+					*pskb = skb = newskb;
+					if (is_vlan_tag) {
+						vlan_hdr = *((unsigned short *)(skb->data+MACADDRLEN*2+2));
+						for (i=0; i<6; i++)
+							*((unsigned short *)(skb->data+MACADDRLEN*2+2-i*2)) = *((unsigned short *)(skb->data+MACADDRLEN*2-2-i*2));
+						skb_pull(skb, 4);
+					}
+				}
+
+				if (skb_is_nonlinear(skb))
+					DEBUG_ERR("%s(): skb_is_nonlinear!!\n", __FUNCTION__);
+					
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
+				res = skb_linearize(skb, GFP_ATOMIC);
+#else	// (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
+				res = skb_linearize(skb);
+#endif	// (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
+				if (res < 0) {				
+						DEBUG_ERR("TX DROP: skb_linearize fail!\n");
+						//goto free_and_stop;
+						return -1;
+				}
+				
+				res = nat25_db_handle(padapter, skb, NAT25_INSERT);
+				if (res < 0) {
+					if (res == -2) {
+						//priv->ext_stats.tx_drops++;
+						DEBUG_ERR("TX DROP: nat25_db_handle fail!\n");
+						//goto free_and_stop;
+						return -1;
+
+					}
+					// we just print warning message and let it go
+					//DEBUG_WARN("%s()-%d: nat25_db_handle INSERT Warning!\n", __FUNCTION__, __LINE__);
+					//return -1; // return -1 will cause system crash on 2011/08/30!
+					return 0;
+				}
+			}
+
+			memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+
+			dhcp_flag_bcast(padapter, skb);
+
+			if (is_vlan_tag) {
+				skb_push(skb, 4);
+				for (i=0; i<6; i++)
+					*((unsigned short *)(skb->data+i*2)) = *((unsigned short *)(skb->data+4+i*2));
+				*((unsigned short *)(skb->data+MACADDRLEN*2)) = __constant_htons(ETH_P_8021Q);
+				*((unsigned short *)(skb->data+MACADDRLEN*2+2)) = vlan_hdr;
+			}
+		}
+#if 0		
+		else{
+			if (*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_8021Q)) {
+				is_vlan_tag = 1;
+			}
+				
+			if(is_vlan_tag){
+				if(ICMPV6_MCAST_MAC(skb->data) && ICMPV6_PROTO1A_VALN(skb->data)){
+                                        memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+				}
+			}else
+			{
+				if(ICMPV6_MCAST_MAC(skb->data) && ICMPV6_PROTO1A(skb->data)){
+                                        memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+				}
+			}	
+		}
+#endif	// 0
+
+		// check if SA is equal to our MAC
+		if (memcmp(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN)) {
+			//priv->ext_stats.tx_drops++;
+			DEBUG_ERR("TX DROP: untransformed frame SA:%02X%02X%02X%02X%02X%02X!\n",
+				skb->data[6],skb->data[7],skb->data[8],skb->data[9],skb->data[10],skb->data[11]);
+			//goto free_and_stop;
+			return -1;
+		}
+	}
+	return 0;
+}
+#endif	// CONFIG_BR_EXT
+
+static void do_queue_select(_adapter	*padapter, struct pkt_attrib *pattrib)
+{
+	u8 qsel;
+		
+	qsel = pattrib->priority;
+	RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("### do_queue_select priority=%d ,qsel = %d\n",pattrib->priority ,qsel));
+
+#ifdef CONFIG_CONCURRENT_MODE	
+//	if (check_fwstate(&padapter->mlmepriv, WIFI_AP_STATE) == _TRUE)
+//		qsel = 7;//
+#endif
+	
+	pattrib->qsel = qsel;
+}
+
+/*
+ * The main transmit(tx) entry
+ *
+ * Return
+ *	1	enqueue
+ *	0	success, hardware will handle this xmit frame(packet)
+ *	<0	fail
+ */
+s32 rtw_xmit(_adapter *padapter, _pkt **ppkt)
+{
+	static u32 start = 0;
+	static u32 drop_cnt = 0;
+#ifdef CONFIG_AP_MODE
+	_irqL irqL0;
+#endif
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct xmit_frame *pxmitframe = NULL;
+#ifdef CONFIG_BR_EXT
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	void *br_port = NULL;
+#endif	// CONFIG_BR_EXT
+
+	s32 res;
+
+	if (start == 0)
+		start = rtw_get_current_time();
+
+	pxmitframe = rtw_alloc_xmitframe(pxmitpriv);
+
+	if (rtw_get_passing_time_ms(start) > 2000) {
+		if (drop_cnt)
+			DBG_871X("DBG_TX_DROP_FRAME %s no more pxmitframe, drop_cnt:%u\n", __FUNCTION__, drop_cnt);
+		start = rtw_get_current_time();
+		drop_cnt = 0;
+	}
+
+	if (pxmitframe == NULL) {
+		drop_cnt ++;
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit: no more pxmitframe\n"));
+		return -1;
+	}
+
+#ifdef CONFIG_BR_EXT
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+	br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+	rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+
+	if( br_port	&& check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE)
+	{
+		res = rtw_br_client_tx(padapter, ppkt);
+		if (res == -1)
+		{
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			return -1;
+		}
+	}	
+
+#endif	// CONFIG_BR_EXT
+
+	res = update_attrib(padapter, *ppkt, &pxmitframe->attrib);
+	if (res == _FAIL) {
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit: update attrib fail\n"));
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s update attrib fail\n", __FUNCTION__);
+		#endif
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+		return -1;
+	}
+	pxmitframe->pkt = *ppkt;
+
+	rtw_led_control(padapter, LED_CTL_TX);
+
+	do_queue_select(padapter, &pxmitframe->attrib);
+
+#if defined(CONFIG_AP_MODE) || defined(CONFIG_TDLS)
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+	if(xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe) == _TRUE)
+	{
+		_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+		return 1;		
+	}
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+#endif
+
+	if (rtw_hal_xmit(padapter, pxmitframe) == _FALSE)
+		return 1;
+
+	return 0;
+}
+
+#ifdef CONFIG_TDLS
+sint xmitframe_enqueue_for_tdls_sleeping_sta(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	sint ret=_FALSE;
+
+	_irqL irqL;
+	struct sta_info *ptdls_sta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	int i;
+	
+	ptdls_sta=rtw_get_stainfo(pstapriv, pattrib->dst);
+	if(ptdls_sta==NULL){
+		return ret;
+	}else if(ptdls_sta->tdls_sta_state&TDLS_LINKED_STATE){
+
+		if(pattrib->triggered==1)
+		{
+			ret = _TRUE;
+			return ret;
+			}
+
+		_enter_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);	
+		
+		if(ptdls_sta->state&WIFI_SLEEP_STATE)
+		{
+			rtw_list_delete(&pxmitframe->list);
+		
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);	
+			
+			rtw_list_insert_tail(&pxmitframe->list, get_list_head(&ptdls_sta->sleep_q));
+			
+			ptdls_sta->sleepq_len++;
+			ptdls_sta->sleepq_ac_len++;
+
+			//indicate 4-AC queue bit in TDLS peer traffic indication
+			switch(pattrib->priority)
+			{
+				case 1:
+				case 2:
+					ptdls_sta->uapsd_bk = ptdls_sta->uapsd_bk | BIT(1);
+					break;
+				case 4:
+				case 5:
+					ptdls_sta->uapsd_vi = ptdls_sta->uapsd_vi | BIT(1);
+					break;
+				case 6:
+				case 7:
+					ptdls_sta->uapsd_vo = ptdls_sta->uapsd_vo | BIT(1);
+					break;
+				case 0:
+				case 3:
+				default:
+					ptdls_sta->uapsd_be = ptdls_sta->uapsd_be | BIT(1);
+					break;
+			}
+
+			if(ptdls_sta->sleepq_len==1)
+			{
+				//transmit TDLS PTI via AP
+				rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_SD_PTI);
+			}
+			ret = _TRUE;
+
+		}
+
+		_exit_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);	
+	}
+
+	return ret;
+	
+}
+#endif //CONFIG_TDLS
+
+#if defined(CONFIG_AP_MODE) || defined(CONFIG_TDLS)
+
+sint xmitframe_enqueue_for_sleeping_sta(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	_irqL irqL;
+	sint ret=_FALSE;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	sint bmcst = IS_MCAST(pattrib->ra);
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	if( ptdlsinfo->setup_state == TDLS_LINKED_STATE )
+	{
+		ret = xmitframe_enqueue_for_tdls_sleeping_sta(padapter, pxmitframe);
+		return ret;
+	}
+#endif //CONFIG_TDLS
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _FALSE)
+	    return ret;
+
+	if(pattrib->psta)
+	{
+		psta = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta=rtw_get_stainfo(pstapriv, pattrib->ra);
+	}
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FALSE;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FALSE;
+	}
+
+	if(pattrib->triggered==1)
+	{
+		//DBG_871X("directly xmit pspoll_triggered packet\n");
+
+		//pattrib->triggered=0;
+
+		if(bmcst)
+			pattrib->qsel = 0x11;//HIQ
+		
+
+		return ret;
+	}
+
+
+	if(bmcst)
+	{
+		_enter_critical_bh(&psta->sleep_q.lock, &irqL);	
+	
+		if(pstapriv->sta_dz_bitmap)//if anyone sta is in ps mode
+		{
+			//pattrib->qsel = 0x11;//HIQ
+			
+			rtw_list_delete(&pxmitframe->list);
+			
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);	
+			
+			rtw_list_insert_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
+			
+			psta->sleepq_len++;
+
+			pstapriv->tim_bitmap |= BIT(0);//
+			pstapriv->sta_dz_bitmap |= BIT(0);
+			
+			//DBG_871X("enqueue, sq_len=%d, tim=%x\n", psta->sleepq_len, pstapriv->tim_bitmap);
+
+			update_beacon(padapter, _TIM_IE_, NULL, _FALSE);//tx bc/mc packets after upate bcn
+			
+			//_exit_critical_bh(&psta->sleep_q.lock, &irqL);				
+			
+			ret = _TRUE;			
+			
+		}
+		
+		_exit_critical_bh(&psta->sleep_q.lock, &irqL);	
+		
+		return ret;
+		
+	}
+	
+
+	_enter_critical_bh(&psta->sleep_q.lock, &irqL);	
+	
+	if(psta->state&WIFI_SLEEP_STATE)
+	{
+		u8 wmmps_ac=0;
+	
+		if(pstapriv->sta_dz_bitmap&BIT(psta->aid))	
+		{			
+			rtw_list_delete(&pxmitframe->list);
+		
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);	
+			
+			rtw_list_insert_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
+			
+			psta->sleepq_len++;
+
+			switch(pattrib->priority)
+			{
+				case 1:
+				case 2:
+					wmmps_ac = psta->uapsd_bk&BIT(0);
+					break;
+				case 4:
+				case 5:
+					wmmps_ac = psta->uapsd_vi&BIT(0);
+					break;
+				case 6:
+				case 7:
+					wmmps_ac = psta->uapsd_vo&BIT(0);
+					break;
+				case 0:
+				case 3:
+				default:
+					wmmps_ac = psta->uapsd_be&BIT(0);
+					break;
+			}
+
+			if(wmmps_ac)
+				psta->sleepq_ac_len++;
+
+			if(((psta->has_legacy_ac) && (!wmmps_ac)) ||((!psta->has_legacy_ac)&&(wmmps_ac)))
+			{
+				pstapriv->tim_bitmap |= BIT(psta->aid);
+
+				//DBG_871X("enqueue, sq_len=%d, tim=%x\n", psta->sleepq_len, pstapriv->tim_bitmap);
+
+				if(psta->sleepq_len==1)
+				{
+					//DBG_871X("sleepq_len==1, update BCNTIM\n");
+					//upate BCN for TIM IE
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+				}
+			}
+
+			//_exit_critical_bh(&psta->sleep_q.lock, &irqL);			
+
+			//if(psta->sleepq_len > (NR_XMITFRAME>>3))
+			//{
+			//	wakeup_sta_to_xmit(padapter, psta);
+			//}	
+
+			ret = _TRUE;
+
+		}
+
+	}
+
+	_exit_critical_bh(&psta->sleep_q.lock, &irqL);	
+
+	return ret;
+	
+}
+
+static void dequeue_xmitframes_to_sleeping_queue(_adapter *padapter, struct sta_info *psta, _queue *pframequeue)
+{
+	sint ret;
+	_list	*plist, *phead;
+	u8	ac_index;
+	struct tx_servq	*ptxservq;
+	struct pkt_attrib	*pattrib;
+	struct xmit_frame 	*pxmitframe;
+	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
+	
+	phead = get_list_head(pframequeue);
+	plist = get_next(phead);
+	
+	while (rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{			
+		pxmitframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		plist = get_next(plist);	
+		
+		ret = xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe);	
+
+		if(_TRUE == ret)
+		{
+		pattrib = &pxmitframe->attrib;
+
+		ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
+
+		ptxservq->qcnt--;
+		phwxmits[ac_index].accnt--;		
+	}
+		else
+		{
+			//DBG_871X("xmitframe_enqueue_for_sleeping_sta return _FALSE\n");
+		}
+		
+	}
+	
+}
+
+void stop_sta_xmit(_adapter *padapter, struct sta_info *psta)
+{	
+	_irqL irqL0;	
+	struct sta_info *psta_bmc;
+	struct sta_xmit_priv *pstaxmitpriv;
+	struct sta_priv *pstapriv = &padapter->stapriv;	
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;	
+	
+	pstaxmitpriv = &psta->sta_xmitpriv;
+
+	//for BC/MC Frames
+	psta_bmc = rtw_get_bcmc_stainfo(padapter);
+	
+			
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+
+	psta->state |= WIFI_SLEEP_STATE;
+	
+#ifdef CONFIG_TDLS
+	if( !(psta->tdls_sta_state & TDLS_LINKED_STATE) )
+#endif //CONFIG_TDLS	
+	pstapriv->sta_dz_bitmap |= BIT(psta->aid);
+	
+	
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vo_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vo_q.tx_pending));
+
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vi_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vi_q.tx_pending));
+
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->be_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->be_q.tx_pending));
+	
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->bk_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->bk_q.tx_pending));
+
+#ifdef CONFIG_TDLS
+	if( !(psta->tdls_sta_state & TDLS_LINKED_STATE) )
+	{
+		if( psta_bmc != NULL )
+		{
+#endif //CONFIG_TDLS
+
+
+	//for BC/MC Frames
+	pstaxmitpriv = &psta_bmc->sta_xmitpriv;
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta_bmc, &pstaxmitpriv->be_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->be_q.tx_pending));
+	
+
+#ifdef CONFIG_TDLS	
+		}
+	}
+#endif //CONFIG_TDLS	
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+	
+
+}	
+
+void wakeup_sta_to_xmit(_adapter *padapter, struct sta_info *psta)
+{	 
+	_irqL irqL;	 
+	u8 update_mask=0, wmmps_ac=0;
+	struct sta_info *psta_bmc;
+	_list	*xmitframe_plist, *xmitframe_phead;
+	struct xmit_frame *pxmitframe=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	psta_bmc = rtw_get_bcmc_stainfo(padapter);
+	
+
+	//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	xmitframe_phead = get_list_head(&psta->sleep_q);
+	xmitframe_plist = get_next(xmitframe_phead);
+
+	while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+	{			
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+		xmitframe_plist = get_next(xmitframe_plist);            
+
+		rtw_list_delete(&pxmitframe->list);
+
+		switch(pxmitframe->attrib.priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(1);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(1);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(1);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(1);
+				break;	
+		}
+
+		psta->sleepq_len--;
+		if(psta->sleepq_len>0)
+			pxmitframe->attrib.mdata = 1;
+		else
+			pxmitframe->attrib.mdata = 0;
+
+		if(wmmps_ac)
+		{
+			psta->sleepq_ac_len--;
+			if(psta->sleepq_ac_len>0)
+			{
+				pxmitframe->attrib.mdata = 1;
+				pxmitframe->attrib.eosp = 0;
+			}
+			else
+			{
+				pxmitframe->attrib.mdata = 0;
+				pxmitframe->attrib.eosp = 1;
+			}
+		}
+		
+		pxmitframe->attrib.triggered = 1;
+
+/*
+		_exit_critical_bh(&psta->sleep_q.lock, &irqL);	
+		if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+		{		
+			rtw_os_xmit_complete(padapter, pxmitframe);
+		}		
+		_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+*/
+		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+		
+	}	
+	
+	//for BC/MC Frames
+	if(!psta_bmc)
+		goto _exit;
+
+	if((pstapriv->sta_dz_bitmap&0xfffe) == 0x0)//no any sta in ps mode
+	{
+		xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
+		xmitframe_plist = get_next(xmitframe_phead);
+
+		while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+		{			
+			pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+			xmitframe_plist = get_next(xmitframe_plist);
+
+			rtw_list_delete(&pxmitframe->list);
+
+			psta_bmc->sleepq_len--;
+			if(psta_bmc->sleepq_len>0)
+				pxmitframe->attrib.mdata = 1;
+			else
+				pxmitframe->attrib.mdata = 0;
+			
+
+			pxmitframe->attrib.triggered = 1;
+/*
+			_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);	
+			if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+			{		
+				rtw_os_xmit_complete(padapter, pxmitframe);
+			}
+			_enter_critical_bh(&psta_bmc->sleep_q.lock, &irqL);	
+
+*/
+			rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+		}	
+	
+		if(psta_bmc->sleepq_len==0)
+		{
+			pstapriv->tim_bitmap &= ~BIT(0);
+			pstapriv->sta_dz_bitmap &= ~BIT(0);
+
+			//DBG_871X("wakeup to xmit, qlen==0, update_BCNTIM, tim=%x\n", pstapriv->tim_bitmap);
+			//upate BCN for TIM IE
+			//update_BCNTIM(padapter);
+			update_mask |= BIT(1);
+		}		
+	
+	}	
+
+	if(psta->sleepq_len==0)
+	{
+#ifdef CONFIG_TDLS
+		if( psta->tdls_sta_state & TDLS_LINKED_STATE )
+		{
+			if(psta->state&WIFI_SLEEP_STATE)
+				psta->state ^= WIFI_SLEEP_STATE;
+
+			goto _exit;
+	}	
+#endif //CONFIG_TDLS
+		pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+		//DBG_871X("wakeup to xmit, qlen==0, update_BCNTIM, tim=%x\n", pstapriv->tim_bitmap);
+		//upate BCN for TIM IE
+		//update_BCNTIM(padapter);
+		update_mask = BIT(0);
+
+		if(psta->state&WIFI_SLEEP_STATE)
+			psta->state ^= WIFI_SLEEP_STATE;
+
+		if(psta->state & WIFI_STA_ALIVE_CHK_STATE)
+		{
+			psta->expire_to = pstapriv->expire_to;
+			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
+		}
+
+		pstapriv->sta_dz_bitmap &= ~BIT(psta->aid);
+	}
+
+_exit:
+
+	//_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);	
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+	
+	if(update_mask)
+	{
+		//update_BCNTIM(padapter);
+		//printk("%s => call update_beacon\n",__FUNCTION__);
+		update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+	}	
+	
+}
+
+void xmit_delivery_enabled_frames(_adapter *padapter, struct sta_info *psta)
+{
+	_irqL irqL;
+	u8 wmmps_ac=0;
+	_list	*xmitframe_plist, *xmitframe_phead;
+	struct xmit_frame *pxmitframe=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+
+	//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	xmitframe_phead = get_list_head(&psta->sleep_q);
+	xmitframe_plist = get_next(xmitframe_phead);
+
+	while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+	{			
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+		xmitframe_plist = get_next(xmitframe_plist);
+
+		switch(pxmitframe->attrib.priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(1);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(1);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(1);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(1);
+				break;	
+		}
+		
+		if(!wmmps_ac)
+			continue;
+
+		rtw_list_delete(&pxmitframe->list);
+
+		psta->sleepq_len--;
+		psta->sleepq_ac_len--;
+
+		if(psta->sleepq_ac_len>0)
+		{
+			pxmitframe->attrib.mdata = 1;
+			pxmitframe->attrib.eosp = 0;
+		}
+		else
+		{
+			pxmitframe->attrib.mdata = 0;
+			pxmitframe->attrib.eosp = 1;
+		}
+
+		pxmitframe->attrib.triggered = 1;
+
+/*
+		if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+		{		
+			rtw_os_xmit_complete(padapter, pxmitframe);
+		}
+*/
+		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+		if((psta->sleepq_ac_len==0) && (!psta->has_legacy_ac) && (wmmps_ac))
+		{
+#ifdef CONFIG_TDLS
+			if(psta->tdls_sta_state & TDLS_LINKED_STATE )
+			{
+				//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				_exit_critical_bh(&pxmitpriv->lock, &irqL);
+				return;
+			}
+#endif //CONFIG_TDLS
+			pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+			//DBG_871X("wakeup to xmit, qlen==0, update_BCNTIM, tim=%x\n", pstapriv->tim_bitmap);
+			//upate BCN for TIM IE
+			//update_BCNTIM(padapter);
+			update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+			//update_mask = BIT(0);
+		}
+	
+	}
+	
+	//_exit_critical_bh(&psta->sleep_q.lock, &irqL);	
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+}
+
+#endif
+
+void rtw_sctx_init(struct submit_ctx *sctx, int timeout_ms)
+{
+	sctx->timeout_ms = timeout_ms;
+	sctx->submit_time= rtw_get_current_time();
+#ifdef PLATFORM_LINUX /* TODO: add condition wating interface for other os */
+	init_completion(&sctx->done);
+#endif
+	sctx->status = RTW_SCTX_SUBMITTED;
+}
+
+int rtw_sctx_wait(struct submit_ctx *sctx)
+{
+	int ret = _FAIL;
+	unsigned long expire; 
+	int status = 0;
+
+#ifdef PLATFORM_LINUX
+	expire= sctx->timeout_ms ? msecs_to_jiffies(sctx->timeout_ms) : MAX_SCHEDULE_TIMEOUT;
+	if (!wait_for_completion_timeout(&sctx->done, expire)) {
+		/* timeout, do something?? */
+		status = RTW_SCTX_DONE_TIMEOUT;
+		DBG_871X("%s timeout\n", __func__);	
+	} else {
+		status = sctx->status;
+	}
+#endif
+
+	if (status == RTW_SCTX_DONE_SUCCESS) {
+		ret = _SUCCESS;
+	}
+
+	return ret;
+}
+
+bool rtw_sctx_chk_waring_status(int status)
+{
+	switch(status) {
+	case RTW_SCTX_DONE_UNKNOWN:
+	case RTW_SCTX_DONE_BUF_ALLOC:
+	case RTW_SCTX_DONE_BUF_FREE:
+
+	case RTW_SCTX_DONE_DRV_STOP:
+	case RTW_SCTX_DONE_DEV_REMOVE:
+		return _TRUE;
+	default:
+		return _FALSE;
+	}
+}
+
+void rtw_sctx_done_err(struct submit_ctx **sctx, int status)
+{
+	if (*sctx) {
+		if (rtw_sctx_chk_waring_status(status))
+			DBG_871X("%s status:%d\n", __func__, status);
+		(*sctx)->status = status;
+		#ifdef PLATFORM_LINUX
+		complete(&((*sctx)->done));
+		#endif
+		*sctx = NULL;
+	}
+}
+
+void rtw_sctx_done(struct submit_ctx **sctx)
+{
+	rtw_sctx_done_err(sctx, RTW_SCTX_DONE_SUCCESS);
+}
+
+#ifdef CONFIG_XMIT_ACK
+
+#ifdef CONFIG_XMIT_ACK_POLLING
+s32 c2h_evt_hdl(_adapter *adapter, struct c2h_evt_hdr *c2h_evt, c2h_id_filter filter);
+
+/**
+ * rtw_ack_tx_polling -
+ * @pxmitpriv: xmit_priv to address ack_tx_ops
+ * @timeout_ms: timeout msec
+ *
+ * Init ack_tx_ops and then do c2h_evt_hdl() and polling ack_tx_ops repeatedly
+ * till tx report or timeout
+ * Returns: _SUCCESS if TX report ok, _FAIL for others
+ */
+int rtw_ack_tx_polling(struct xmit_priv *pxmitpriv, u32 timeout_ms)
+{
+	int ret = _FAIL;
+	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
+	_adapter *adapter = container_of(pxmitpriv, _adapter, xmitpriv);
+
+	pack_tx_ops->submit_time = rtw_get_current_time();
+	pack_tx_ops->timeout_ms = timeout_ms;
+	pack_tx_ops->status = RTW_SCTX_SUBMITTED;
+
+	do {
+		c2h_evt_hdl(adapter, NULL, rtw_hal_c2h_id_filter_ccx(adapter));
+		if (pack_tx_ops->status != RTW_SCTX_SUBMITTED)
+			break;
+
+		if (adapter->bDriverStopped) {
+			pack_tx_ops->status = RTW_SCTX_DONE_DRV_STOP;
+			break;
+		}
+		if (adapter->bSurpriseRemoved) {
+			pack_tx_ops->status = RTW_SCTX_DONE_DEV_REMOVE;
+			break;
+		}
+		
+		rtw_msleep_os(10);
+	} while (rtw_get_passing_time_ms(pack_tx_ops->submit_time) < timeout_ms);
+
+	if (pack_tx_ops->status == RTW_SCTX_SUBMITTED) {
+		pack_tx_ops->status = RTW_SCTX_DONE_TIMEOUT;
+		DBG_871X("%s timeout\n", __func__);
+	}
+
+	if (pack_tx_ops->status == RTW_SCTX_DONE_SUCCESS)
+		ret = _SUCCESS;
+
+	return ret;
+}
+#endif
+
+int rtw_ack_tx_wait(struct xmit_priv *pxmitpriv, u32 timeout_ms)
+{
+#ifdef CONFIG_XMIT_ACK_POLLING
+	return rtw_ack_tx_polling(pxmitpriv, timeout_ms);
+#else
+	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
+
+	pack_tx_ops->submit_time = rtw_get_current_time();
+	pack_tx_ops->timeout_ms = timeout_ms;
+	pack_tx_ops->status = RTW_SCTX_SUBMITTED;
+
+	return rtw_sctx_wait(pack_tx_ops);
+#endif
+}
+
+void rtw_ack_tx_done(struct xmit_priv *pxmitpriv, int status)
+{
+	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
+	
+	if (pxmitpriv->ack_tx) {
+		rtw_sctx_done_err(&pack_tx_ops, status);
+	} else {
+		DBG_871X("%s ack_tx not set\n", __func__);
+	}
+}
+#endif //CONFIG_XMIT_ACK
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c b/drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c
new file mode 100755
index 0000000000000..c59bb664de934
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c
@@ -0,0 +1,177 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*++
+Copyright (c) Realtek Semiconductor Corp. All rights reserved.
+
+Module Name:
+	HalPwrSeqCmd.c
+
+Abstract:
+	Implement HW Power sequence configuration CMD handling routine for Realtek devices.
+
+Major Change History:
+	When       Who               What
+	---------- ---------------   -------------------------------
+	2011-10-26 Lucas            Modify to be compatible with SD4-CE driver.
+	2011-07-07 Roger            Create.
+
+--*/
+#include <HalPwrSeqCmd.h>
+#include <sdio_ops.h>
+
+
+//
+//	Description:
+//		This routine deal with the Power Configuration CMDs parsing for RTL8723/RTL8188E Series IC.
+//
+//	Assumption:
+//		We should follow specific format which was released from HW SD.
+//
+//	2011.07.07, added by Roger.
+//
+u8 HalPwrSeqCmdParsing(
+	PADAPTER		padapter,
+	u8				CutVersion,
+	u8				FabVersion,
+	u8				InterfaceType,
+	WLAN_PWR_CFG	PwrSeqCmd[])
+{
+	WLAN_PWR_CFG 	PwrCfgCmd = {0};
+	u8				bPollingBit = _FALSE;
+	u32				AryIdx = 0;
+	u8				value = 0;
+	u32				offset = 0;
+	u32				pollingCount = 0; // polling autoload done.
+	u32				maxPollingCnt = 5000;
+
+	do {
+		PwrCfgCmd = PwrSeqCmd[AryIdx];
+
+		RT_TRACE(_module_hal_init_c_ , _drv_info_,
+				 ("HalPwrSeqCmdParsing: offset(%#x) cut_msk(%#x) fab_msk(%#x) interface_msk(%#x) base(%#x) cmd(%#x) msk(%#x) value(%#x)\n",
+					GET_PWR_CFG_OFFSET(PwrCfgCmd),
+					GET_PWR_CFG_CUT_MASK(PwrCfgCmd),
+					GET_PWR_CFG_FAB_MASK(PwrCfgCmd),
+					GET_PWR_CFG_INTF_MASK(PwrCfgCmd),
+					GET_PWR_CFG_BASE(PwrCfgCmd),
+					GET_PWR_CFG_CMD(PwrCfgCmd),
+					GET_PWR_CFG_MASK(PwrCfgCmd),
+					GET_PWR_CFG_VALUE(PwrCfgCmd)));
+
+		//2 Only Handle the command whose FAB, CUT, and Interface are matched
+		if ((GET_PWR_CFG_FAB_MASK(PwrCfgCmd) & FabVersion) &&
+			(GET_PWR_CFG_CUT_MASK(PwrCfgCmd) & CutVersion) &&
+			(GET_PWR_CFG_INTF_MASK(PwrCfgCmd) & InterfaceType))
+		{
+			switch (GET_PWR_CFG_CMD(PwrCfgCmd))
+			{
+				case PWR_CMD_READ:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_READ\n"));
+					break;
+
+				case PWR_CMD_WRITE:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_WRITE\n"));
+					offset = GET_PWR_CFG_OFFSET(PwrCfgCmd);
+
+#ifdef CONFIG_SDIO_HCI
+					//
+					// <Roger_Notes> We should deal with interface specific address mapping for some interfaces, e.g., SDIO interface
+					// 2011.07.07.
+					//
+					if (GET_PWR_CFG_BASE(PwrCfgCmd) == PWR_BASEADDR_SDIO)
+					{
+						// Read Back SDIO Local value
+						value = SdioLocalCmd52Read1Byte(padapter, offset);
+
+						value &= ~(GET_PWR_CFG_MASK(PwrCfgCmd));
+						value |= (GET_PWR_CFG_VALUE(PwrCfgCmd) & GET_PWR_CFG_MASK(PwrCfgCmd));
+
+						// Write Back SDIO Local value
+						SdioLocalCmd52Write1Byte(padapter, offset, value);
+					}
+					else
+#endif
+					{
+						// Read the value from system register
+						value = rtw_read8(padapter, offset);
+
+						value &= ~(GET_PWR_CFG_MASK(PwrCfgCmd));
+						value |= (GET_PWR_CFG_VALUE(PwrCfgCmd) & GET_PWR_CFG_MASK(PwrCfgCmd));
+
+						// Write the value back to sytem register
+						rtw_write8(padapter, offset, value);
+					}
+					break;
+
+				case PWR_CMD_POLLING:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_POLLING\n"));
+
+					bPollingBit = _FALSE;
+					offset = GET_PWR_CFG_OFFSET(PwrCfgCmd);
+
+					do {
+#ifdef CONFIG_SDIO_HCI
+						if (GET_PWR_CFG_BASE(PwrCfgCmd) == PWR_BASEADDR_SDIO)
+							value = SdioLocalCmd52Read1Byte(padapter, offset);
+						else
+#endif
+							value = rtw_read8(padapter, offset);
+
+						value &= GET_PWR_CFG_MASK(PwrCfgCmd);
+						if (value == (GET_PWR_CFG_VALUE(PwrCfgCmd) & GET_PWR_CFG_MASK(PwrCfgCmd)))
+							bPollingBit = _TRUE;
+						else
+							rtw_udelay_os(10);
+
+						if (pollingCount++ > maxPollingCnt) {
+							RT_TRACE(_module_hal_init_c_ , _drv_err_, ("Fail to polling Offset[%#x]\n", offset));
+							return _FALSE;
+						}
+					} while (!bPollingBit);
+
+					break;
+
+				case PWR_CMD_DELAY:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_DELAY\n"));
+					if (GET_PWR_CFG_VALUE(PwrCfgCmd) == PWRSEQ_DELAY_US)
+						rtw_udelay_os(GET_PWR_CFG_OFFSET(PwrCfgCmd));
+					else
+						rtw_udelay_os(GET_PWR_CFG_OFFSET(PwrCfgCmd)*1000);
+					break;
+
+				case PWR_CMD_END:
+					// When this command is parsed, end the process
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_END\n"));
+					return _TRUE;
+					break;
+
+				default:
+					RT_TRACE(_module_hal_init_c_ , _drv_err_, ("HalPwrSeqCmdParsing: Unknown CMD!!\n"));
+					break;
+			}
+		}
+
+		AryIdx++;//Add Array Index
+	}while(1);
+
+	return _TRUE;
+}
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/dm.c b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.c
new file mode 100755
index 0000000000000..465ca826c9fd6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.c
@@ -0,0 +1,314 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2013 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+
+bool rtw_adapter_linked(_adapter *adapter)
+{
+	bool linked = _FALSE;
+	struct mlme_priv	*mlmepriv = &adapter->mlmepriv;
+
+	if(	(check_fwstate(mlmepriv, WIFI_AP_STATE) == _TRUE) ||
+		(check_fwstate(mlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE))
+	{				
+		if(adapter->stapriv.asoc_sta_count > 2)
+			linked = _TRUE;
+	}
+	else{//Station mode
+		if(check_fwstate(mlmepriv, _FW_LINKED)== _TRUE)
+			linked = _TRUE;
+	}
+
+	return linked;
+}
+
+bool dm_linked(_adapter *adapter)
+{
+	bool linked;
+
+	if ((linked = rtw_adapter_linked(adapter)))
+		goto exit;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ((adapter =  adapter->pbuddy_adapter) == NULL)
+		goto exit;
+	linked = rtw_adapter_linked(adapter);
+#endif
+
+exit:
+	return linked;
+}
+
+#if 0
+void dm_enable_EDCCA(_adapter *adapter)
+{
+	// Enable EDCCA. The value is suggested by SD3 Wilson.
+
+	//
+	// Revised for ASUS 11b/g performance issues, suggested by BB Neil, 2012.04.13.
+	//
+	/*if((pDM_Odm->SupportICType == ODM_RTL8723A)&&(IS_WIRELESS_MODE_G(pAdapter)))
+	{
+		rtw_write8(adapter,rOFDM0_ECCAThreshold,0x00);
+		rtw_write8(adapter,rOFDM0_ECCAThreshold+2,0xFD);
+		
+	}	
+	else*/
+	{
+		rtw_write8(adapter,rOFDM0_ECCAThreshold,0x03);
+		rtw_write8(adapter,rOFDM0_ECCAThreshold+2,0x00);
+	}
+}
+
+void dm_disable_EDCCA(_adapter *adapter)
+{	
+	// Disable EDCCA..
+	rtw_write8(adapter, rOFDM0_ECCAThreshold, 0x7f);
+	rtw_write8(adapter, rOFDM0_ECCAThreshold+2, 0x7f);
+}
+
+//
+// Description: According to initial gain value to determine to enable or disable EDCCA.
+//
+// Suggested by SD3 Wilson. Added by tynli. 2011.11.25.
+//
+void dm_dynamic_EDCCA(_adapter *pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+	u8 RegC50, RegC58;
+	
+	RegC50 = (u8)PHY_QueryBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0);
+	RegC58 = (u8)PHY_QueryBBReg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0);
+
+
+ 	if((RegC50 > 0x28 && RegC58 > 0x28)
+  		/*|| ((pDM_Odm->SupportICType == ODM_RTL8723A && IS_WIRELESS_MODE_G(pAdapter) && RegC50>0x26))
+  		|| (pDM_Odm->SupportICType == ODM_RTL8188E && RegC50 > 0x28)*/
+  	)
+	{
+		if(!dmpriv->bPreEdccaEnable)
+		{
+			dm_enable_EDCCA(pAdapter);
+			dmpriv->bPreEdccaEnable = _TRUE;
+		}
+		
+	}
+	else if((RegC50 < 0x25 && RegC58 < 0x25)
+		/*|| (pDM_Odm->SupportICType == ODM_RTL8188E && RegC50 < 0x25)*/
+	)
+	{
+		if(dmpriv->bPreEdccaEnable)
+		{
+			dm_disable_EDCCA(pAdapter);
+			dmpriv->bPreEdccaEnable = _FALSE;
+		}
+	}
+}
+#endif
+
+#define DM_ADAPTIVITY_VER "ADAPTIVITY_V001"
+
+int dm_adaptivity_get_parm_str(_adapter *pAdapter, char *buf, int len)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+
+	return snprintf(buf, len, DM_ADAPTIVITY_VER"\n"
+		"TH_L2H_ini\tTH_EDCCA_HL_diff\tIGI_Base\tForceEDCCA\tAdapEn_RSSI\tIGI_LowerBound\n"
+		"0x%02x\t%d\t0x%02x\t%d\t%u\t%u\n",
+		(u8)dmpriv->TH_L2H_ini,
+		dmpriv->TH_EDCCA_HL_diff,
+		dmpriv->IGI_Base,
+		dmpriv->ForceEDCCA,
+		dmpriv->AdapEn_RSSI,
+		dmpriv->IGI_LowerBound
+	);
+#endif /* CONFIG_DM_ADAPTIVITY */
+	return 0;
+}
+
+void dm_adaptivity_set_parm(_adapter *pAdapter, s8 TH_L2H_ini, s8 TH_EDCCA_HL_diff,
+	s8 IGI_Base, bool ForceEDCCA, u8 AdapEn_RSSI, u8 IGI_LowerBound)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+
+	dmpriv->TH_L2H_ini = TH_L2H_ini;
+	dmpriv->TH_EDCCA_HL_diff = TH_EDCCA_HL_diff;
+	dmpriv->IGI_Base = IGI_Base;
+	dmpriv->ForceEDCCA = ForceEDCCA;
+	dmpriv->AdapEn_RSSI = AdapEn_RSSI;
+	dmpriv->IGI_LowerBound = IGI_LowerBound;
+
+#endif /* CONFIG_DM_ADAPTIVITY */
+}
+
+void dm_adaptivity_init(_adapter *pAdapter)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+
+	/*
+	if(pDM_Odm->SupportICType == ODM_RTL8723B)
+	{
+		pDM_Odm->TH_L2H_ini = 0xf8; // -8
+	}
+	if((pDM_Odm->SupportICType == ODM_RTL8192E)&&(pDM_Odm->SupportInterface == ODM_ITRF_PCIE))
+	{
+		pDM_Odm->TH_L2H_ini = 0xf0; // -16
+	}
+	else */
+	{
+		dmpriv->TH_L2H_ini = 0xf9; // -7
+	}
+
+	dmpriv->TH_EDCCA_HL_diff = 7;
+	dmpriv->IGI_Base = 0x32;
+	dmpriv->IGI_target = 0x1c;
+	dmpriv->ForceEDCCA = 0;
+	dmpriv->AdapEn_RSSI = 20;
+	dmpriv->IGI_LowerBound = 0;
+
+	//Reg524[11]=0 is easily to transmit packets during adaptivity test
+	PHY_SetBBReg(pAdapter, 0x524, BIT11, 1); // stop counting if EDCCA is asserted
+
+#endif /* CONFIG_DM_ADAPTIVITY */
+}
+
+void dm_adaptivity(_adapter *pAdapter)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	s8 TH_L2H_dmc, TH_H2L_dmc;
+	s8 TH_L2H, TH_H2L, Diff, IGI_target;
+	u32 value32;
+	BOOLEAN EDCCA_State;
+
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+	DIG_T *pDigTable = &dmpriv->DM_DigTable;
+	u8 IGI = pDigTable->CurIGValue;
+	u8 RSSI_Min = pDigTable->Rssi_val_min;
+	HT_CHANNEL_WIDTH BandWidth = pHalData->CurrentChannelBW;
+
+	if (!(dmpriv->DMFlag & DYNAMIC_FUNC_ADAPTIVITY))
+	{
+		LOG_LEVEL(_drv_info_, "Go to odm_DynamicEDCCA() \n");
+		// Add by Neil Chen to enable edcca to MP Platform 
+		// Adjust EDCCA.
+		/*if(pDM_Odm->SupportICType & ODM_IC_11N_SERIES)
+			dm_dynamic_EDCCA(pAdapter);
+		*/
+		return;
+	}
+	LOG_LEVEL(_drv_info_, "odm_Adaptivity() =====> \n");
+
+	LOG_LEVEL(_drv_info_, "ForceEDCCA=%d, IGI_Base=0x%x, TH_L2H_ini = %d, TH_EDCCA_HL_diff = %d, AdapEn_RSSI = %d\n", 
+		dmpriv->ForceEDCCA, dmpriv->IGI_Base, dmpriv->TH_L2H_ini, dmpriv->TH_EDCCA_HL_diff, dmpriv->AdapEn_RSSI);
+
+	/*if(pDM_Odm->SupportICType & ODM_IC_11AC_SERIES)
+		PHY_SetBBReg(0x800, BIT10, 0); //ADC_mask enable
+	*/
+	
+	if(!dm_linked(pAdapter) || pHalData->CurrentChannel > 149) /* Band4 doesn't need adaptivity */
+	{
+		/*if(pDM_Odm->SupportICType & ODM_IC_11N_SERIES)*/
+		{
+			PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte0, 0x7f);
+			PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte2, 0x7f);
+		}
+		/*else
+		{
+			ODM_SetBBReg(pDM_Odm, rFPGA0_XB_LSSIReadBack, 0xFFFF, (0x7f<<8) | 0x7f);
+		}*/
+		return;
+	}
+
+	if(!dmpriv->ForceEDCCA)
+	{
+		if(RSSI_Min > dmpriv->AdapEn_RSSI)
+			EDCCA_State = 1;
+		else if(RSSI_Min < (dmpriv->AdapEn_RSSI - 5))
+			EDCCA_State = 0;
+	}
+	else
+		EDCCA_State = 1;
+	//if((pDM_Odm->SupportICType & ODM_IC_11AC_SERIES) && (*pDM_Odm->pBandType == BAND_ON_5G))
+		//IGI_target = pDM_Odm->IGI_Base;
+	//else
+	{
+
+		if(BandWidth == HT_CHANNEL_WIDTH_20) //CHANNEL_WIDTH_20
+			IGI_target = dmpriv->IGI_Base;
+		else if(BandWidth == HT_CHANNEL_WIDTH_40)
+			IGI_target = dmpriv->IGI_Base + 2;
+		/*else if(*pDM_Odm->pBandWidth == ODM_BW80M)
+			IGI_target = pDM_Odm->IGI_Base + 6;*/
+		else
+			IGI_target = dmpriv->IGI_Base;
+	}
+
+	dmpriv->IGI_target = (u8)IGI_target;
+
+	LOG_LEVEL(_drv_info_, "BandWidth=%s, IGI_target=0x%x, EDCCA_State=%d\n",
+		(BandWidth==HT_CHANNEL_WIDTH_40)?"40M":"20M", IGI_target, EDCCA_State);
+
+	if(EDCCA_State == 1)
+	{
+		Diff = IGI_target -(s8)IGI;
+		TH_L2H_dmc = dmpriv->TH_L2H_ini + Diff;
+		if(TH_L2H_dmc > 10) 	TH_L2H_dmc = 10;
+		TH_H2L_dmc = TH_L2H_dmc - dmpriv->TH_EDCCA_HL_diff;
+	}
+	else
+	{
+		TH_L2H_dmc = 0x7f;
+		TH_H2L_dmc = 0x7f;
+	}
+
+	LOG_LEVEL(_drv_info_, "IGI=0x%x, TH_L2H_dmc = %d, TH_H2L_dmc = %d\n", 
+		IGI, TH_L2H_dmc, TH_H2L_dmc);
+
+	/*if(pDM_Odm->SupportICType & ODM_IC_11N_SERIES)*/
+	{
+		PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte0, (u8)TH_L2H_dmc);
+		PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte2, (u8)TH_H2L_dmc);
+	}
+	/*else
+		PHY_SetBBReg(pAdapter, rFPGA0_XB_LSSIReadBack, 0xFFFF, ((u8)TH_H2L_dmc<<8) | (u8)TH_L2H_dmc);*/
+
+skip_dm:
+	return;
+#endif /* CONFIG_DM_ADAPTIVITY */
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/dm.h b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.h
new file mode 100755
index 0000000000000..dd9a57d9d8f4c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.h
@@ -0,0 +1,30 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2013 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+ #ifndef	__DM_H__
+#define __DM_H__
+
+int dm_adaptivity_get_parm_str(_adapter *pAdapter, char *buf, int len);
+void dm_adaptivity_set_parm(_adapter *pAdapter, s8 TH_L2H_ini, s8 TH_EDCCA_HL_diff,
+	s8 IGI_Base, bool ForceEDCCA, u8 AdapEn_RSSI, u8 IGI_LowerBound);
+void dm_adaptivity_init(_adapter *pAdapter);
+void dm_adaptivity(_adapter *pAdapter);
+
+#endif /* __DM_H__ */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c
new file mode 100755
index 0000000000000..4dcafd656eaea
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c
@@ -0,0 +1,371 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <hal_intf.h>
+#include <hal_com.h>
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+
+#define _HAL_COM_C_
+
+//============================================================
+// Global var
+//============================================================
+u32 OFDMSwingTable[OFDM_TABLE_SIZE_92D] = {
+	0x7f8001fe, // 0, +6.0dB
+	0x788001e2, // 1, +5.5dB
+	0x71c001c7, // 2, +5.0dB
+	0x6b8001ae, // 3, +4.5dB
+	0x65400195, // 4, +4.0dB
+	0x5fc0017f, // 5, +3.5dB
+	0x5a400169, // 6, +3.0dB
+	0x55400155, // 7, +2.5dB
+	0x50800142, // 8, +2.0dB
+	0x4c000130, // 9, +1.5dB
+	0x47c0011f, // 10, +1.0dB
+	0x43c0010f, // 11, +0.5dB
+	0x40000100, // 12, +0dB
+	0x3c8000f2, // 13, -0.5dB
+	0x390000e4, // 14, -1.0dB
+	0x35c000d7, // 15, -1.5dB
+	0x32c000cb, // 16, -2.0dB
+	0x300000c0, // 17, -2.5dB
+	0x2d4000b5, // 18, -3.0dB
+	0x2ac000ab, // 19, -3.5dB
+	0x288000a2, // 20, -4.0dB
+	0x26000098, // 21, -4.5dB
+	0x24000090, // 22, -5.0dB
+	0x22000088, // 23, -5.5dB
+	0x20000080, // 24, -6.0dB
+	0x1e400079, // 25, -6.5dB
+	0x1c800072, // 26, -7.0dB
+	0x1b00006c, // 27. -7.5dB
+	0x19800066, // 28, -8.0dB
+	0x18000060, // 29, -8.5dB
+	0x16c0005b, // 30, -9.0dB
+	0x15800056, // 31, -9.5dB
+	0x14400051, // 32, -10.0dB
+	0x1300004c, // 33, -10.5dB
+	0x12000048, // 34, -11.0dB
+	0x11000044, // 35, -11.5dB
+	0x10000040, // 36, -12.0dB
+	0x0f00003c,// 37, -12.5dB
+	0x0e400039,// 38, -13.0dB    
+	0x0d800036,// 39, -13.5dB
+	0x0cc00033,// 40, -14.0dB
+	0x0c000030,// 41, -14.5dB
+	0x0b40002d,// 42, -15.0dB	
+};
+
+
+u8 CCKSwingTable_Ch1_Ch13[CCK_TABLE_SIZE][8] = {
+	{0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04},	// 0, +0dB
+	{0x33, 0x32, 0x2b, 0x23, 0x1a, 0x11, 0x08, 0x04},	// 1, -0.5dB
+	{0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03},	// 2, -1.0dB
+	{0x2d, 0x2d, 0x27, 0x1f, 0x18, 0x0f, 0x08, 0x03},	// 3, -1.5dB
+	{0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03},	// 4, -2.0dB 
+	{0x28, 0x28, 0x22, 0x1c, 0x15, 0x0d, 0x07, 0x03},	// 5, -2.5dB
+	{0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03},	// 6, -3.0dB
+	{0x24, 0x23, 0x1f, 0x19, 0x13, 0x0c, 0x06, 0x03},	// 7, -3.5dB
+	{0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02},	// 8, -4.0dB 
+	{0x20, 0x20, 0x1b, 0x16, 0x11, 0x08, 0x05, 0x02},	// 9, -4.5dB
+	{0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02},	// 10, -5.0dB 
+	{0x1d, 0x1c, 0x18, 0x14, 0x0f, 0x0a, 0x05, 0x02},	// 11, -5.5dB
+	{0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02},	// 12, -6.0dB 
+	{0x1a, 0x19, 0x16, 0x12, 0x0d, 0x09, 0x04, 0x02},	// 13, -6.5dB
+	{0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02},	// 14, -7.0dB 
+	{0x17, 0x16, 0x13, 0x10, 0x0c, 0x08, 0x04, 0x02},	// 15, -7.5dB
+	{0x16, 0x15, 0x12, 0x0f, 0x0b, 0x07, 0x04, 0x01},	// 16, -8.0dB 
+	{0x14, 0x14, 0x11, 0x0e, 0x0b, 0x07, 0x03, 0x02},	// 17, -8.5dB
+	{0x13, 0x13, 0x10, 0x0d, 0x0a, 0x06, 0x03, 0x01},	// 18, -9.0dB 
+	{0x12, 0x12, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},	// 19, -9.5dB
+	{0x11, 0x11, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},	// 20, -10.0dB
+	{0x10, 0x10, 0x0e, 0x0b, 0x08, 0x05, 0x03, 0x01},	// 21, -10.5dB
+	{0x0f, 0x0f, 0x0d, 0x0b, 0x08, 0x05, 0x03, 0x01},	// 22, -11.0dB
+	{0x0e, 0x0e, 0x0c, 0x0a, 0x08, 0x05, 0x02, 0x01},	// 23, -11.5dB
+	{0x0d, 0x0d, 0x0c, 0x0a, 0x07, 0x05, 0x02, 0x01},	// 24, -12.0dB
+	{0x0d, 0x0c, 0x0b, 0x09, 0x07, 0x04, 0x02, 0x01},	// 25, -12.5dB
+	{0x0c, 0x0c, 0x0a, 0x09, 0x06, 0x04, 0x02, 0x01},	// 26, -13.0dB
+	{0x0b, 0x0b, 0x0a, 0x08, 0x06, 0x04, 0x02, 0x01},	// 27, -13.5dB
+	{0x0b, 0x0a, 0x09, 0x08, 0x06, 0x04, 0x02, 0x01},	// 28, -14.0dB
+	{0x0a, 0x0a, 0x09, 0x07, 0x05, 0x03, 0x02, 0x01},	// 29, -14.5dB
+	{0x0a, 0x09, 0x08, 0x07, 0x05, 0x03, 0x02, 0x01},	// 30, -15.0dB
+	{0x09, 0x09, 0x08, 0x06, 0x05, 0x03, 0x01, 0x01},	// 31, -15.5dB
+	{0x09, 0x08, 0x07, 0x06, 0x04, 0x03, 0x01, 0x01}	// 32, -16.0dB
+};
+
+
+u8 CCKSwingTable_Ch14 [CCK_TABLE_SIZE][8]= {
+	{0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00},	// 0, +0dB	
+	{0x33, 0x32, 0x2b, 0x19, 0x00, 0x00, 0x00, 0x00},	// 1, -0.5dB 
+	{0x30, 0x2f, 0x29, 0x18, 0x00, 0x00, 0x00, 0x00},	// 2, -1.0dB  
+	{0x2d, 0x2d, 0x17, 0x17, 0x00, 0x00, 0x00, 0x00},	// 3, -1.5dB
+	{0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00},	// 4, -2.0dB  
+	{0x28, 0x28, 0x24, 0x14, 0x00, 0x00, 0x00, 0x00},	// 5, -2.5dB
+	{0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00},	// 6, -3.0dB  
+	{0x24, 0x23, 0x1f, 0x12, 0x00, 0x00, 0x00, 0x00},	// 7, -3.5dB  
+	{0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00},	// 8, -4.0dB  
+	{0x20, 0x20, 0x1b, 0x10, 0x00, 0x00, 0x00, 0x00},	// 9, -4.5dB
+	{0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00},	// 10, -5.0dB  
+	{0x1d, 0x1c, 0x18, 0x0e, 0x00, 0x00, 0x00, 0x00},	// 11, -5.5dB
+	{0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00},	// 12, -6.0dB  
+	{0x1a, 0x19, 0x16, 0x0d, 0x00, 0x00, 0x00, 0x00},	// 13, -6.5dB 
+	{0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00},	// 14, -7.0dB  
+	{0x17, 0x16, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00},	// 15, -7.5dB
+	{0x16, 0x15, 0x12, 0x0b, 0x00, 0x00, 0x00, 0x00},	// 16, -8.0dB  
+	{0x14, 0x14, 0x11, 0x0a, 0x00, 0x00, 0x00, 0x00},	// 17, -8.5dB
+	{0x13, 0x13, 0x10, 0x0a, 0x00, 0x00, 0x00, 0x00},	// 18, -9.0dB  
+	{0x12, 0x12, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},	// 19, -9.5dB
+	{0x11, 0x11, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},	// 20, -10.0dB
+	{0x10, 0x10, 0x0e, 0x08, 0x00, 0x00, 0x00, 0x00},	// 21, -10.5dB
+	{0x0f, 0x0f, 0x0d, 0x08, 0x00, 0x00, 0x00, 0x00},	// 22, -11.0dB
+	{0x0e, 0x0e, 0x0c, 0x07, 0x00, 0x00, 0x00, 0x00},	// 23, -11.5dB
+	{0x0d, 0x0d, 0x0c, 0x07, 0x00, 0x00, 0x00, 0x00},	// 24, -12.0dB
+	{0x0d, 0x0c, 0x0b, 0x06, 0x00, 0x00, 0x00, 0x00},	// 25, -12.5dB
+	{0x0c, 0x0c, 0x0a, 0x06, 0x00, 0x00, 0x00, 0x00},	// 26, -13.0dB
+	{0x0b, 0x0b, 0x0a, 0x06, 0x00, 0x00, 0x00, 0x00},	// 27, -13.5dB
+	{0x0b, 0x0a, 0x09, 0x05, 0x00, 0x00, 0x00, 0x00},	// 28, -14.0dB
+	{0x0a, 0x0a, 0x09, 0x05, 0x00, 0x00, 0x00, 0x00},	// 29, -14.5dB
+	{0x0a, 0x09, 0x08, 0x05, 0x00, 0x00, 0x00, 0x00},	// 30, -15.0dB
+	{0x09, 0x09, 0x08, 0x05, 0x00, 0x00, 0x00, 0x00},	// 31, -15.5dB
+	{0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}	// 32, -16.0dB
+};	
+
+
+#ifdef CONFIG_CHIP_VER_INTEGRATION
+void dump_chip_info(HAL_VERSION	ChipVersion)
+{
+	if(IS_81XXC(ChipVersion)){
+		DBG_871X("Chip Version Info: %s_",IS_92C_SERIAL(ChipVersion)?"CHIP_8192C":"CHIP_8188C");
+	}
+	else if(IS_92D(ChipVersion)){
+		DBG_871X("Chip Version Info: CHIP_8192D_");
+	}
+	else if(IS_8723_SERIES(ChipVersion)){
+		DBG_871X("Chip Version Info: CHIP_8723A_");
+	}
+	else if(IS_8188E(ChipVersion)){
+		DBG_871X("Chip Version Info: CHIP_8188E_");
+	}
+
+	DBG_871X("%s_",IS_NORMAL_CHIP(ChipVersion)?"Normal_Chip":"Test_Chip");	
+	DBG_871X("%s_",IS_CHIP_VENDOR_TSMC(ChipVersion)?"TSMC":"UMC");
+	if(IS_A_CUT(ChipVersion)) DBG_871X("A_CUT_");	
+	else if(IS_B_CUT(ChipVersion)) DBG_871X("B_CUT_");	
+	else if(IS_C_CUT(ChipVersion)) DBG_871X("C_CUT_");	
+	else if(IS_D_CUT(ChipVersion)) DBG_871X("D_CUT_");	
+	else if(IS_E_CUT(ChipVersion)) DBG_871X("E_CUT_");	
+	else DBG_871X("UNKNOWN_CUT(%d)_",ChipVersion.CUTVersion);
+	
+	if(IS_1T1R(ChipVersion))	DBG_871X("1T1R_");	
+	else if(IS_1T2R(ChipVersion))	DBG_871X("1T2R_");	
+	else if(IS_2T2R(ChipVersion))	DBG_871X("2T2R_");
+	else DBG_871X("UNKNOWN_RFTYPE(%d)_",ChipVersion.RFType);
+
+	
+	DBG_871X("RomVer(%d)\n",ChipVersion.ROMVer);	
+}
+
+#endif
+
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK	0x80
+
+u8	//return the final channel plan decision
+hal_com_get_channel_plan(
+	IN	PADAPTER	padapter,
+	IN	u8			hw_channel_plan,	//channel plan from HW (efuse/eeprom)
+	IN	u8			sw_channel_plan,	//channel plan from SW (registry/module param)
+	IN	u8			def_channel_plan,	//channel plan used when the former two is invalid
+	IN	BOOLEAN		AutoLoadFail
+	)
+{
+	u8 swConfig;
+	u8 chnlPlan;
+
+	swConfig = _TRUE;
+	if (!AutoLoadFail)
+	{
+		if (!rtw_is_channel_plan_valid(sw_channel_plan))
+			swConfig = _FALSE;
+		if (hw_channel_plan & EEPROM_CHANNEL_PLAN_BY_HW_MASK)
+			swConfig = _FALSE;
+	}
+
+	if (swConfig == _TRUE)
+		chnlPlan = sw_channel_plan;
+	else
+		chnlPlan = hw_channel_plan & (~EEPROM_CHANNEL_PLAN_BY_HW_MASK);
+
+	if (!rtw_is_channel_plan_valid(chnlPlan))
+		chnlPlan = def_channel_plan;
+
+	return chnlPlan;
+}
+
+u8	MRateToHwRate(u8 rate)
+{
+	u8	ret = DESC_RATE1M;
+		
+	switch(rate)
+	{
+		// CCK and OFDM non-HT rates
+	case IEEE80211_CCK_RATE_1MB:	ret = DESC_RATE1M;	break;
+	case IEEE80211_CCK_RATE_2MB:	ret = DESC_RATE2M;	break;
+	case IEEE80211_CCK_RATE_5MB:	ret = DESC_RATE5_5M;	break;
+	case IEEE80211_CCK_RATE_11MB:	ret = DESC_RATE11M;	break;
+	case IEEE80211_OFDM_RATE_6MB:	ret = DESC_RATE6M;	break;
+	case IEEE80211_OFDM_RATE_9MB:	ret = DESC_RATE9M;	break;
+	case IEEE80211_OFDM_RATE_12MB:	ret = DESC_RATE12M;	break;
+	case IEEE80211_OFDM_RATE_18MB:	ret = DESC_RATE18M;	break;
+	case IEEE80211_OFDM_RATE_24MB:	ret = DESC_RATE24M;	break;
+	case IEEE80211_OFDM_RATE_36MB:	ret = DESC_RATE36M;	break;
+	case IEEE80211_OFDM_RATE_48MB:	ret = DESC_RATE48M;	break;
+	case IEEE80211_OFDM_RATE_54MB:	ret = DESC_RATE54M;	break;
+
+		// HT rates since here
+	//case MGN_MCS0:		ret = DESC_RATEMCS0;	break;
+	//case MGN_MCS1:		ret = DESC_RATEMCS1;	break;
+	//case MGN_MCS2:		ret = DESC_RATEMCS2;	break;
+	//case MGN_MCS3:		ret = DESC_RATEMCS3;	break;
+	//case MGN_MCS4:		ret = DESC_RATEMCS4;	break;
+	//case MGN_MCS5:		ret = DESC_RATEMCS5;	break;
+	//case MGN_MCS6:		ret = DESC_RATEMCS6;	break;
+	//case MGN_MCS7:		ret = DESC_RATEMCS7;	break;
+
+	default:		break;
+	}
+
+	return ret;
+}
+
+void	HalSetBrateCfg(
+	IN PADAPTER		Adapter,
+	IN u8			*mBratesOS,
+	OUT u16			*pBrateCfg)
+{
+	u8	i, is_brate, brate;
+
+	for(i=0;i<NDIS_802_11_LENGTH_RATES_EX;i++)
+	{
+		is_brate = mBratesOS[i] & IEEE80211_BASIC_RATE_MASK;
+		brate = mBratesOS[i] & 0x7f;
+		
+		if( is_brate )
+		{		
+			switch(brate)
+			{
+				case IEEE80211_CCK_RATE_1MB:	*pBrateCfg |= RATE_1M;	break;
+				case IEEE80211_CCK_RATE_2MB:	*pBrateCfg |= RATE_2M;	break;
+				case IEEE80211_CCK_RATE_5MB:	*pBrateCfg |= RATE_5_5M;break;
+				case IEEE80211_CCK_RATE_11MB:	*pBrateCfg |= RATE_11M;	break;
+				case IEEE80211_OFDM_RATE_6MB:	*pBrateCfg |= RATE_6M;	break;
+				case IEEE80211_OFDM_RATE_9MB:	*pBrateCfg |= RATE_9M;	break;
+				case IEEE80211_OFDM_RATE_12MB:	*pBrateCfg |= RATE_12M;	break;
+				case IEEE80211_OFDM_RATE_18MB:	*pBrateCfg |= RATE_18M;	break;
+				case IEEE80211_OFDM_RATE_24MB:	*pBrateCfg |= RATE_24M;	break;
+				case IEEE80211_OFDM_RATE_36MB:	*pBrateCfg |= RATE_36M;	break;
+				case IEEE80211_OFDM_RATE_48MB:	*pBrateCfg |= RATE_48M;	break;
+				case IEEE80211_OFDM_RATE_54MB:	*pBrateCfg |= RATE_54M;	break;
+			}
+		}
+	}
+}
+
+void hal_init_macaddr(_adapter *adapter)
+{
+	rtw_hal_set_hwreg(adapter, HW_VAR_MAC_ADDR, adapter->eeprompriv.mac_addr);
+#ifdef  CONFIG_CONCURRENT_MODE
+	if (adapter->pbuddy_adapter)
+		rtw_hal_set_hwreg(adapter->pbuddy_adapter, HW_VAR_MAC_ADDR, adapter->pbuddy_adapter->eeprompriv.mac_addr);
+#endif
+}
+
+/* 
+* C2H event format:
+* Field	 TRIGGER		CONTENT	   CMD_SEQ 	CMD_LEN		 CMD_ID
+* BITS	 [127:120]	[119:16]      [15:8]		  [7:4]	 	   [3:0]
+*/
+
+void c2h_evt_clear(_adapter *adapter)
+{
+	rtw_write8(adapter, REG_C2HEVT_CLEAR, C2H_EVT_HOST_CLOSE);
+}
+
+s32 c2h_evt_read(_adapter *adapter, u8 *buf)
+{
+	s32 ret = _FAIL;
+	struct c2h_evt_hdr *c2h_evt;
+	int i;
+	u8 trigger;
+
+	if (buf == NULL)
+		goto exit;
+
+	trigger = rtw_read8(adapter, REG_C2HEVT_CLEAR);
+
+	if (trigger == C2H_EVT_HOST_CLOSE) {
+		goto exit; /* Not ready */
+	} else if (trigger != C2H_EVT_FW_CLOSE) {
+		goto clear_evt; /* Not a valid value */
+	}
+
+	c2h_evt = (struct c2h_evt_hdr *)buf;
+
+	_rtw_memset(c2h_evt, 0, 16);
+
+	*buf = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL);
+	*(buf+1) = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + 1);	
+
+	RT_PRINT_DATA(_module_hal_init_c_, _drv_info_, "c2h_evt_read(): ",
+		&c2h_evt , sizeof(c2h_evt));
+
+	if (0) {
+		DBG_871X("%s id:%u, len:%u, seq:%u, trigger:0x%02x\n", __func__
+			, c2h_evt->id, c2h_evt->plen, c2h_evt->seq, trigger);
+	}
+
+	/* Read the content */
+	for (i = 0; i < c2h_evt->plen; i++)
+		c2h_evt->payload[i] = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + sizeof(*c2h_evt) + i);
+
+	RT_PRINT_DATA(_module_hal_init_c_, _drv_info_, "c2h_evt_read(): Command Content:\n",
+		c2h_evt->payload, c2h_evt->plen);
+
+	ret = _SUCCESS;
+
+clear_evt:
+	/* 
+	* Clear event to notify FW we have read the command.
+	* If this field isn't clear, the FW won't update the next command message.
+	*/
+	c2h_evt_clear(adapter);
+exit:
+	return ret;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c
new file mode 100755
index 0000000000000..6c56e72d2588d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c
@@ -0,0 +1,546 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#define _HAL_INTF_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <hal_intf.h>
+
+#ifdef CONFIG_SDIO_HCI
+	#include <sdio_hal.h>
+#elif defined(CONFIG_USB_HCI)
+	#include <usb_hal.h>
+#elif defined(CONFIG_GSPI_HCI)
+	#include <gspi_hal.h>
+#endif
+
+void rtw_hal_chip_configure(_adapter *padapter)
+{
+	if(padapter->HalFunc.intf_chip_configure)
+		padapter->HalFunc.intf_chip_configure(padapter);
+}
+
+void rtw_hal_read_chip_info(_adapter *padapter)
+{
+	if(padapter->HalFunc.read_adapter_info)
+		padapter->HalFunc.read_adapter_info(padapter);
+}
+
+void rtw_hal_read_chip_version(_adapter *padapter)
+{
+	if(padapter->HalFunc.read_chip_version)
+		padapter->HalFunc.read_chip_version(padapter);
+}
+
+void rtw_hal_def_value_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.init_default_value)
+		padapter->HalFunc.init_default_value(padapter);
+}
+
+void rtw_hal_free_data(_adapter *padapter)
+{
+	if(padapter->HalFunc.free_hal_data)
+		padapter->HalFunc.free_hal_data(padapter);
+}
+
+void rtw_hal_dm_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.dm_init)
+		padapter->HalFunc.dm_init(padapter);
+}
+
+void rtw_hal_dm_deinit(_adapter *padapter)
+{
+	// cancel dm  timer
+	if(padapter->HalFunc.dm_deinit)
+		padapter->HalFunc.dm_deinit(padapter);	
+}
+
+void rtw_hal_sw_led_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.InitSwLeds)
+		padapter->HalFunc.InitSwLeds(padapter);
+}
+
+void rtw_hal_sw_led_deinit(_adapter *padapter)
+{
+	if(padapter->HalFunc.DeInitSwLeds)
+		padapter->HalFunc.DeInitSwLeds(padapter);
+}
+
+uint	 rtw_hal_init(_adapter *padapter) 
+{
+	uint	status = _SUCCESS;
+
+	if(padapter->hw_init_completed == _TRUE)
+	{
+		DBG_871X("rtw_hal_init: hw_init_completed == _TRUE\n");
+		goto success;
+	}
+#ifdef CONFIG_DEINIT_BEFORE_INIT
+	status = padapter->HalFunc.hal_deinit(padapter);
+	if(status != _SUCCESS){
+		DBG_871X("rtw_hal_init: hal_deinit before hal_init FAIL !!\n");
+		goto fail;
+	}
+#endif
+	
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	// before init mac0, driver must init mac1 first to avoid usb rx error.
+	if((padapter->pbuddy_adapter != NULL) && (padapter->DualMacConcurrent == _TRUE)
+		&& (padapter->adapter_type == PRIMARY_ADAPTER))
+	{
+		if(padapter->pbuddy_adapter->hw_init_completed == _TRUE)
+		{
+			DBG_871X("rtw_hal_init: pbuddy_adapter hw_init_completed == _TRUE\n");
+		}
+		else
+		{
+#ifdef CONFIG_DEINIT_BEFORE_INIT
+			status = padapter->HalFunc.hal_deinit(padapter->pbuddy_adapter);
+			if(status != _SUCCESS){
+				DBG_871X("rtw_hal_init: hal_deinit before hal_init FAIL !!(pbuddy_adapter)\n");
+				goto fail;
+			}
+#endif
+			status = 	padapter->HalFunc.hal_init(padapter->pbuddy_adapter);
+			if(status == _SUCCESS){
+				padapter->pbuddy_adapter->hw_init_completed = _TRUE;
+			}
+			else{
+			 	padapter->pbuddy_adapter->hw_init_completed = _FALSE;
+				RT_TRACE(_module_hal_init_c_,_drv_err_,("rtw_hal_init: hal__init fail(pbuddy_adapter)\n"));
+				goto fail;
+			}
+		}
+	}
+#else
+	if(adapter_to_dvobj(padapter)->DualMacMode == _TRUE)
+	{
+		if(padapter->pbuddy_adapter != NULL) {
+			if(padapter->pbuddy_adapter->hw_init_completed == _FALSE)
+			{
+#ifdef CONFIG_DEINIT_BEFORE_INIT
+				status = padapter->HalFunc.hal_deinit(padapter->pbuddy_adapter);
+				if(status != _SUCCESS){
+					DBG_871X("rtw_hal_init: hal_deinit before hal_init FAIL !!(pbuddy_adapter)\n");
+					goto fail;
+				}
+#endif
+				status = padapter->HalFunc.hal_init(padapter->pbuddy_adapter);
+				if(status == _SUCCESS){
+					padapter->pbuddy_adapter->hw_init_completed = _TRUE;
+				}
+				else{
+					padapter->pbuddy_adapter->hw_init_completed = _FALSE;
+					RT_TRACE(_module_hal_init_c_,_drv_err_,("rtw_hal_init: hal__init fail for another interface\n"));
+				}
+			}
+		}
+	}
+#endif
+
+	padapter->hw_init_completed=_FALSE;
+
+	status = padapter->HalFunc.hal_init(padapter);
+
+	if(status == _SUCCESS){
+		padapter->hw_init_completed = _TRUE;
+	}
+	else{
+	 	padapter->hw_init_completed = _FALSE;
+		RT_TRACE(_module_hal_init_c_,_drv_err_,("rtw_hal_init: hal__init fail\n"));
+		goto fail;
+	}
+
+success:
+
+	if (padapter->registrypriv.notch_filter == 1)
+		rtw_hal_notch_filter(padapter, 1);
+
+	rtw_hal_reset_security_engine(padapter);
+
+	rtw_sec_restore_wep_key(padapter);
+
+	init_hw_mlme_ext(padapter);
+
+fail:
+
+	RT_TRACE(_module_hal_init_c_,_drv_err_,("-rtl871x_hal_init:status=0x%x\n",status));
+
+	return status;
+}	
+
+uint rtw_hal_deinit(_adapter *padapter)
+{
+	uint	status = _SUCCESS;
+	
+_func_enter_;
+
+	status = padapter->HalFunc.hal_deinit(padapter);
+
+	if(status == _SUCCESS){
+		padapter->hw_init_completed = _FALSE;
+	}
+	else
+	{
+		RT_TRACE(_module_hal_init_c_,_drv_err_,("\n rtw_hal_deinit: hal_init fail\n"));
+	}
+	
+_func_exit_;
+	
+	return status;
+}
+
+void rtw_hal_set_hwreg(_adapter *padapter, u8 variable, u8 *val)
+{
+	if (padapter->HalFunc.SetHwRegHandler)
+		padapter->HalFunc.SetHwRegHandler(padapter, variable, val);
+}
+
+void rtw_hal_get_hwreg(_adapter *padapter, u8 variable, u8 *val)
+{
+	if (padapter->HalFunc.GetHwRegHandler)
+		padapter->HalFunc.GetHwRegHandler(padapter, variable, val);
+}
+
+u8 rtw_hal_set_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue)
+{	
+	if(padapter->HalFunc.SetHalDefVarHandler)
+		return padapter->HalFunc.SetHalDefVarHandler(padapter,eVariable,pValue);
+	return _FAIL;
+}
+
+u8 rtw_hal_get_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue)
+{	
+	if(padapter->HalFunc.GetHalDefVarHandler)
+		return padapter->HalFunc.GetHalDefVarHandler(padapter,eVariable,pValue);
+	return _FAIL;	
+}
+
+void rtw_hal_enable_interrupt(_adapter *padapter)
+{
+	if (padapter->HalFunc.enable_interrupt)
+		padapter->HalFunc.enable_interrupt(padapter);
+	else 
+		DBG_871X("%s: HalFunc.enable_interrupt is NULL!\n", __FUNCTION__);
+	
+}
+void rtw_hal_disable_interrupt(_adapter *padapter)
+{
+	if (padapter->HalFunc.disable_interrupt)
+		padapter->HalFunc.disable_interrupt(padapter);
+	else 
+		DBG_871X("%s: HalFunc.disable_interrupt is NULL!\n", __FUNCTION__);
+	
+}
+
+u32	rtw_hal_inirp_init(_adapter *padapter)
+{
+	u32 rst = _FAIL;
+	if(padapter->HalFunc.inirp_init)	
+		rst = padapter->HalFunc.inirp_init(padapter);	
+	else		
+		DBG_871X(" %s HalFunc.inirp_init is NULL!!!\n",__FUNCTION__);		
+	return rst;
+}
+	
+u32	rtw_hal_inirp_deinit(_adapter *padapter)
+{
+	
+	if(padapter->HalFunc.inirp_deinit)
+		return padapter->HalFunc.inirp_deinit(padapter);
+
+	return _FAIL;
+		
+}
+
+u8 rtw_hal_intf_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id, u8* val)
+{
+	if(padapter->HalFunc.interface_ps_func)
+		return padapter->HalFunc.interface_ps_func(padapter,efunc_id,val);
+	return _FAIL;
+}
+
+s32	rtw_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	if(padapter->HalFunc.hal_xmitframe_enqueue)
+		return padapter->HalFunc.hal_xmitframe_enqueue(padapter, pxmitframe);
+
+	return _FALSE;	
+}
+
+s32 rtw_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	if(padapter->HalFunc.hal_xmit)
+		return padapter->HalFunc.hal_xmit(padapter, pxmitframe);
+
+	return _FALSE;
+}
+
+s32	rtw_hal_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+	s32 ret = _FAIL;
+	unsigned char	*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	_rtw_memcpy(pmgntframe->attrib.ra, pwlanhdr->addr1, ETH_ALEN);
+
+#ifdef CONFIG_IEEE80211W
+	if(padapter->securitypriv.binstallBIPkey == _TRUE)
+	{
+		if(IS_MCAST(pmgntframe->attrib.ra))
+		{
+			pmgntframe->attrib.encrypt = _BIP_;
+			//pmgntframe->attrib.bswenc = _TRUE;
+		}	
+		else
+		{
+			pmgntframe->attrib.encrypt = _AES_;
+			pmgntframe->attrib.bswenc = _TRUE;
+		}
+		rtw_mgmt_xmitframe_coalesce(padapter, pmgntframe->pkt, pmgntframe);
+	}
+#endif //CONFIG_IEEE80211W
+	
+	if(padapter->HalFunc.mgnt_xmit)
+		ret = padapter->HalFunc.mgnt_xmit(padapter, pmgntframe);
+	return ret;
+}
+
+s32 rtw_hal_init_xmit_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.init_xmit_priv != NULL)
+		return padapter->HalFunc.init_xmit_priv(padapter);
+	return _FAIL;
+}
+
+void rtw_hal_free_xmit_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.free_xmit_priv != NULL)
+		padapter->HalFunc.free_xmit_priv(padapter);
+}
+
+s32 rtw_hal_init_recv_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.init_recv_priv)
+		return padapter->HalFunc.init_recv_priv(padapter);
+
+	return _FAIL;
+}
+
+void rtw_hal_free_recv_priv(_adapter *padapter)
+{	
+	if(padapter->HalFunc.free_recv_priv)
+		padapter->HalFunc.free_recv_priv(padapter);
+}
+
+void rtw_hal_update_ra_mask(_adapter *padapter, u32 mac_id)
+{
+	if(padapter->HalFunc.UpdateRAMaskHandler)
+		padapter->HalFunc.UpdateRAMaskHandler(padapter,mac_id);
+}
+
+void rtw_hal_add_ra_tid(_adapter *padapter, u32 bitmap, u8 arg)
+{
+	if(padapter->HalFunc.Add_RateATid)
+		padapter->HalFunc.Add_RateATid(padapter, bitmap, arg);
+}
+
+u32 rtw_hal_read_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask)
+{
+	u32 data = 0;
+	if (padapter->HalFunc.read_bbreg)
+		data = padapter->HalFunc.read_bbreg(padapter, RegAddr, BitMask);
+	return data;
+}
+
+void rtw_hal_write_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask, u32 Data)
+{
+	if (padapter->HalFunc.write_bbreg)
+		padapter->HalFunc.write_bbreg(padapter, RegAddr, BitMask, Data);
+}
+
+u32 rtw_hal_read_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask)
+{
+	u32 data = 0;
+	if (padapter->HalFunc.read_rfreg)
+		data = padapter->HalFunc.read_rfreg(padapter, eRFPath, RegAddr, BitMask);
+	return data;
+}
+
+void rtw_hal_write_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask, u32 Data)
+{
+	if (padapter->HalFunc.write_rfreg)
+		padapter->HalFunc.write_rfreg(padapter, eRFPath, RegAddr, BitMask, Data);
+}
+
+s32 rtw_hal_interrupt_handler(_adapter *padapter)
+{
+	if(padapter->HalFunc.interrupt_handler)
+		return padapter->HalFunc.interrupt_handler(padapter);
+	return _FAIL;
+}
+
+void rtw_hal_set_bwmode(_adapter *padapter, HT_CHANNEL_WIDTH Bandwidth, u8 Offset)
+{
+	if(padapter->HalFunc.set_bwmode_handler)
+		padapter->HalFunc.set_bwmode_handler(padapter, Bandwidth, Offset);
+}
+
+void rtw_hal_set_chan(_adapter *padapter, u8 channel)
+{
+	if(padapter->HalFunc.set_channel_handler)
+		padapter->HalFunc.set_channel_handler(padapter, channel);
+}
+
+void rtw_hal_dm_watchdog(_adapter *padapter)
+{
+	if(padapter->HalFunc.hal_dm_watchdog)
+		padapter->HalFunc.hal_dm_watchdog(padapter);
+}
+
+void rtw_hal_bcn_related_reg_setting(_adapter *padapter)
+{
+	if(padapter->HalFunc.SetBeaconRelatedRegistersHandler)
+		padapter->HalFunc.SetBeaconRelatedRegistersHandler(padapter);
+}
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+u8 rtw_hal_antdiv_before_linked(_adapter *padapter)
+{
+	if (padapter->HalFunc.AntDivBeforeLinkHandler)
+		return padapter->HalFunc.AntDivBeforeLinkHandler(padapter);
+	return _FALSE;
+}
+
+void rtw_hal_antdiv_rssi_compared(_adapter *padapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src)
+{
+	if (padapter->HalFunc.AntDivCompareHandler)
+		padapter->HalFunc.AntDivCompareHandler(padapter, dst, src);
+}
+#endif
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtw_hal_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt)
+{
+	if (padapter->HalFunc.hostap_mgnt_xmit_entry)
+		return padapter->HalFunc.hostap_mgnt_xmit_entry(padapter, pkt);
+	return _FAIL;
+}
+#endif //CONFIG_HOSTAPD_MLME
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+void rtw_hal_sreset_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.sreset_init_value)
+		padapter->HalFunc.sreset_init_value(padapter);
+}
+
+void rtw_hal_sreset_reset(_adapter *padapter)
+{
+	padapter = GET_PRIMARY_ADAPTER(padapter);
+
+	if(padapter->HalFunc.silentreset)
+		padapter->HalFunc.silentreset(padapter);
+}
+
+void rtw_hal_sreset_reset_value(_adapter *padapter)
+{
+	if(padapter->HalFunc.sreset_reset_value)
+		padapter->HalFunc.sreset_reset_value(padapter);
+}
+
+void rtw_hal_sreset_xmit_status_check(_adapter *padapter)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+	if(padapter->HalFunc.sreset_xmit_status_check)
+		padapter->HalFunc.sreset_xmit_status_check(padapter);
+}
+
+void rtw_hal_sreset_linked_status_check(_adapter *padapter)
+{
+	if(padapter->HalFunc.sreset_linked_status_check)
+		padapter->HalFunc.sreset_linked_status_check(padapter);
+}
+
+u8 rtw_hal_sreset_get_wifi_status(_adapter *padapter)
+{
+	u8 status = 0;
+	if(padapter->HalFunc.sreset_get_wifi_status)
+		status = padapter->HalFunc.sreset_get_wifi_status(padapter);
+	return status;
+}
+
+bool rtw_hal_sreset_inprogress(_adapter *padapter)
+{
+	bool inprogress = _FALSE;
+
+	padapter = GET_PRIMARY_ADAPTER(padapter);
+
+	if(padapter->HalFunc.sreset_inprogress)
+		inprogress = padapter->HalFunc.sreset_inprogress(padapter);
+	return inprogress;
+}
+#endif //DBG_CONFIG_ERROR_DETECT
+
+#ifdef CONFIG_IOL
+int rtw_hal_iol_cmd(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms)
+{
+	if (adapter->HalFunc.IOL_exec_cmds_sync)
+		return adapter->HalFunc.IOL_exec_cmds_sync(adapter, xmit_frame, max_wating_ms);
+	return _FAIL;
+}
+#endif
+
+void rtw_hal_notch_filter(_adapter *adapter, bool enable)
+{
+	if(adapter->HalFunc.hal_notch_filter)
+		adapter->HalFunc.hal_notch_filter(adapter,enable);
+}
+
+void rtw_hal_reset_security_engine(_adapter * adapter)
+{
+	if(adapter->HalFunc.hal_reset_security_engine)
+		adapter->HalFunc.hal_reset_security_engine(adapter);
+}
+
+s32 rtw_hal_c2h_handler(_adapter *adapter, struct c2h_evt_hdr *c2h_evt)
+{
+	s32 ret = _FAIL;
+	if (adapter->HalFunc.c2h_handler)
+		ret = adapter->HalFunc.c2h_handler(adapter, c2h_evt);
+	return ret;
+}
+
+c2h_id_filter rtw_hal_c2h_id_filter_ccx(_adapter *adapter)
+{
+	return adapter->HalFunc.c2h_id_filter_ccx;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c
new file mode 100755
index 0000000000000..33921e2ed5abc
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c
@@ -0,0 +1,1159 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_CMD_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <cmd_osdep.h>
+#include <mlme_osdep.h>
+#include <rtw_byteorder.h>
+#include <circ_buf.h>
+#include <rtw_ioctl_set.h>
+
+#include <rtl8192c_hal.h>
+
+
+#define RTL92C_MAX_H2C_BOX_NUMS	4
+#define RTL92C_MAX_CMD_LEN	5
+#define MESSAGE_BOX_SIZE		4
+#define EX_MESSAGE_BOX_SIZE	2
+
+static u8 _is_fw_read_cmd_down(_adapter* padapter, u8 msgbox_num)
+{
+	u8	read_down = _FALSE;
+	int 	retry_cnts = 100;
+	
+	u8 valid;
+
+//	DBG_8192C(" _is_fw_read_cmd_down ,isnormal_chip(%x),reg_1cc(%x),msg_box(%d)...\n",isvern,rtw_read8(padapter,REG_HMETFR),msgbox_num);
+	
+	do{
+		valid = rtw_read8(padapter,REG_HMETFR) & BIT(msgbox_num);
+		if(0 == valid ){
+			read_down = _TRUE;
+		}			
+	}while( (!read_down) && (retry_cnts--));
+
+	return read_down;
+	
+}
+
+
+/*****************************************
+* H2C Msg format :
+*| 31 - 8		|7		| 6 - 0	|	
+*| h2c_msg 	|Ext_bit	|CMD_ID	|
+*
+******************************************/
+int rtl8192c_FillH2CCmd(_adapter* padapter, u8 ElementID, u32 CmdLen, u8* pCmdBuffer)
+{
+	u8	bcmd_down = _FALSE;
+	int 	retry_cnts = 100;
+	u8	h2c_box_num;
+	u32	msgbox_addr;
+	u32  msgbox_ex_addr;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	u32	h2c_cmd = 0;
+	u16	h2c_cmd_ex = 0;
+	int ret = _FAIL;
+
+_func_enter_;	
+
+	padapter = GET_PRIMARY_ADAPTER(padapter);		
+	pHalData = GET_HAL_DATA(padapter);
+
+	if(padapter->bFWReady == _FALSE)
+	{
+		DBG_8192C("FillH2CCmd(): return H2C cmd because fw is not ready\n");
+		return ret;
+	}
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->h2c_fwcmd_mutex), NULL);
+
+	if(!pCmdBuffer){
+		goto exit;
+	}
+	if(CmdLen > RTL92C_MAX_CMD_LEN){
+		goto exit;
+	}
+	//pay attention to if  race condition happened in  H2C cmd setting.
+	do{
+		h2c_box_num = pHalData->LastHMEBoxNum;
+
+		if(!_is_fw_read_cmd_down(padapter, h2c_box_num)){
+			DBG_8192C(" fw read cmd failed...\n");
+			goto exit;
+		}
+
+		if(CmdLen<=3)
+		{
+			_rtw_memcpy((u8*)(&h2c_cmd)+1, pCmdBuffer, CmdLen );
+		}
+		else{
+			_rtw_memcpy((u8*)(&h2c_cmd_ex), pCmdBuffer, EX_MESSAGE_BOX_SIZE);
+			_rtw_memcpy((u8*)(&h2c_cmd)+1, pCmdBuffer+2,( CmdLen-EX_MESSAGE_BOX_SIZE));
+			*(u8*)(&h2c_cmd) |= BIT(7);
+		}
+
+		*(u8*)(&h2c_cmd) |= ElementID;
+
+		if(h2c_cmd & BIT(7)){
+			msgbox_ex_addr = REG_HMEBOX_EXT_0 + (h2c_box_num *EX_MESSAGE_BOX_SIZE);
+			h2c_cmd_ex = cpu_to_le16( h2c_cmd_ex );
+			rtw_write16(padapter, msgbox_ex_addr, h2c_cmd_ex);
+		}
+		msgbox_addr =REG_HMEBOX_0 + (h2c_box_num *MESSAGE_BOX_SIZE);
+		h2c_cmd = cpu_to_le32( h2c_cmd );
+		rtw_write32(padapter,msgbox_addr, h2c_cmd);
+
+		bcmd_down = _TRUE;
+
+	//	DBG_8192C("MSG_BOX:%d,CmdLen(%d), reg:0x%x =>h2c_cmd:0x%x, reg:0x%x =>h2c_cmd_ex:0x%x ..\n"
+	//	 	,pHalData->LastHMEBoxNum ,CmdLen,msgbox_addr,h2c_cmd,msgbox_ex_addr,h2c_cmd_ex);
+
+		 pHalData->LastHMEBoxNum = (h2c_box_num+1) % RTL92C_MAX_H2C_BOX_NUMS ;
+
+	}while((!bcmd_down) && (retry_cnts--));
+/*
+	if(bcmd_down)
+		DBG_8192C("H2C Cmd exe down. \n"	);	
+	else
+		DBG_8192C("H2C Cmd exe failed. \n"	);
+*/
+	ret = _SUCCESS;
+
+exit:
+
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->h2c_fwcmd_mutex), NULL);	
+
+_func_exit_;
+
+	return ret;
+
+}
+
+u8 rtl8192c_h2c_msg_hdl(_adapter *padapter, unsigned char *pbuf)
+{	
+	u8 ElementID, CmdLen;
+	u8 *pCmdBuffer;
+	struct cmd_msg_parm  *pcmdmsg;
+	
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	pcmdmsg = (struct cmd_msg_parm*)pbuf;
+	ElementID = pcmdmsg->eid;
+	CmdLen = pcmdmsg->sz;
+	pCmdBuffer = pcmdmsg->buf;
+
+	rtl8192c_FillH2CCmd(padapter, ElementID, CmdLen, pCmdBuffer);
+
+	return H2C_SUCCESS;
+}
+
+#if defined(CONFIG_AUTOSUSPEND) && defined(SUPPORT_HW_RFOFF_DETECTED)
+u8 rtl8192c_set_FwSelectSuspend_cmd(_adapter *padapter ,u8 bfwpoll, u16 period)
+{
+	u8	res=_SUCCESS;
+	struct H2C_SS_RFOFF_PARAM param;
+	DBG_8192C("==>%s bfwpoll(%x)\n",__FUNCTION__,bfwpoll);
+	param.gpio_period = period;//Polling GPIO_11 period time
+	param.ROFOn = (_TRUE == bfwpoll)?1:0;
+	rtl8192c_FillH2CCmd(padapter, SELECTIVE_SUSPEND_ROF_CMD, sizeof(param), (u8*)(&param));		
+	return res;
+}
+#endif //CONFIG_AUTOSUSPEND && SUPPORT_HW_RFOFF_DETECTED
+
+u8 rtl8192c_set_rssi_cmd(_adapter*padapter, u8 *param)
+{	
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	*((u32*) param ) = cpu_to_le32( *((u32*) param ) );
+
+	rtl8192c_FillH2CCmd(padapter, RSSI_SETTING_EID, 3, param);
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtl8192c_set_raid_cmd(_adapter*padapter, u32 mask, u8 arg)
+{	
+	u8	buf[5];
+	u8	res=_SUCCESS;
+	
+_func_enter_;	
+	
+	_rtw_memset(buf, 0, 5);
+	mask = cpu_to_le32( mask );
+	_rtw_memcpy(buf, &mask, 4);
+	buf[4]  = arg;
+
+	rtl8192c_FillH2CCmd(padapter, MACID_CONFIG_EID, 5, buf);
+	
+_func_exit_;
+
+	return res;
+
+}
+
+//bitmap[0:27] = tx_rate_bitmap
+//bitmap[28:31]= Rate Adaptive id
+//arg[0:4] = macid
+//arg[5] = Short GI
+void rtl8192c_Add_RateATid(PADAPTER pAdapter, u32 bitmap, u8 arg)
+{	
+	
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+		
+	if(pHalData->fw_ractrl == _TRUE)
+	{
+		rtl8192c_set_raid_cmd(pAdapter, bitmap, arg);
+	}
+	else
+	{
+		u8 macid, init_rate, shortGIrate=_FALSE;
+
+		init_rate = get_highest_rate_idx(bitmap&0x0fffffff)&0x3f;
+		
+		macid = arg&0x1f;
+		
+		shortGIrate = (arg&BIT(5)) ? _TRUE:_FALSE;
+		
+		if (shortGIrate==_TRUE)
+			init_rate |= BIT(6);
+
+		rtw_write8(pAdapter, (REG_INIDATA_RATE_SEL+macid), (u8)init_rate);		
+	}
+
+}
+
+void rtl8192c_set_FwPwrMode_cmd(_adapter*padapter, u8 Mode)
+{
+	SETPWRMODE_PARM H2CSetPwrMode;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	
+_func_enter_;
+
+	DBG_871X("%s(): Mode = %d, SmartPS = %d\n", __FUNCTION__,Mode,pwrpriv->smart_ps);
+
+	H2CSetPwrMode.Mode = Mode;
+
+	H2CSetPwrMode.SmartPS = pwrpriv->smart_ps;
+
+	H2CSetPwrMode.BcnPassTime = 1;//pPSC->RegMaxLPSAwakeIntvl;
+
+	rtl8192c_FillH2CCmd(padapter, SET_PWRMODE_EID, sizeof(H2CSetPwrMode), (u8 *)&H2CSetPwrMode);
+	
+_func_exit_;
+}
+
+void ConstructBeacon(_adapter *padapter, u8 *pframe, u32 *pLength)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u32					rate_len, pktlen;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;	
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	
+	_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
+	//pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_BEACON);
+	
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);	
+	pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+	
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	pktlen += 8;
+
+	// beacon interval: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2); 
+
+	pframe += 2;
+	pktlen += 2;
+
+	// capability info: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	pktlen += 2;
+
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		//DBG_871X("ie len=%d\n", cur_network->IELength);
+		pktlen += cur_network->IELength - sizeof(NDIS_802_11_FIXED_IEs);
+		_rtw_memcpy(pframe, cur_network->IEs+sizeof(NDIS_802_11_FIXED_IEs), pktlen);
+		
+		goto _ConstructBeacon;
+	}
+
+	//below for ad-hoc mode
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pktlen);
+
+	// supported rates...
+	rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &pktlen);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pktlen);
+
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		u32 ATIMWindow;
+		// IBSS Parameter Set...
+		//ATIMWindow = cur->Configuration.ATIMWindow;
+		ATIMWindow = 0;
+		pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pktlen);
+	}	
+
+
+	//todo: ERP IE
+	
+	
+	// EXTERNDED SUPPORTED RATE
+	if (rate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pktlen);
+	}
+
+
+	//todo:HT for adhoc
+
+_ConstructBeacon:
+
+	if ((pktlen + TXDESC_SIZE) > 512)
+	{
+		DBG_871X("beacon frame too large\n");
+		return;
+	}
+
+	*pLength = pktlen;
+
+	//DBG_871X("%s bcn_sz=%d\n", __FUNCTION__, pktlen);
+
+}
+
+void ConstructPSPoll(_adapter *padapter, u8 *pframe, u32 *pLength)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u32					pktlen;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	// Frame control.
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	SetPwrMgt(fctrl);
+	SetFrameSubType(pframe, WIFI_PSPOLL);
+
+	// AID.
+	SetDuration(pframe, (pmlmeinfo->aid | 0xc000));
+
+	// BSSID.
+	_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	// TA.
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	*pLength = 16;
+}
+
+void ConstructNullFunctionData(_adapter *padapter, u8 *pframe, u32 *pLength, u8 *StaAddr, BOOLEAN bForcePowerSave)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u32					pktlen;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network	*cur_network = &pmlmepriv->cur_network;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//DBG_871X("%s:%d\n", __FUNCTION__, bForcePowerSave);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	if (bForcePowerSave)
+	{
+		SetPwrMgt(fctrl);
+	}
+
+	switch(cur_network->network.InfrastructureMode)
+	{			
+		case Ndis802_11Infrastructure:
+			SetToDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, StaAddr, ETH_ALEN);
+			break;
+		case Ndis802_11APMode:
+			SetFrDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, StaAddr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+			break;
+		case Ndis802_11IBSS:
+		default:
+			_rtw_memcpy(pwlanhdr->addr1, StaAddr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+			break;
+	}
+
+	SetSeqNum(pwlanhdr, 0);
+
+	SetFrameSubType(pframe, WIFI_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	*pLength = pktlen;
+}
+
+void ConstructProbeRsp(_adapter *padapter, u8 *pframe, u32 *pLength, u8 *StaAddr, BOOLEAN bHideSSID)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;	
+	u8					*mac, *bssid;
+	u32					pktlen;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	
+	
+	//DBG_871X("%s\n", __FUNCTION__);
+	
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;	
+	
+	mac = myid(&(padapter->eeprompriv));
+	bssid = cur_network->MacAddress;
+	
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, StaAddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, 0);
+	SetFrameSubType(fctrl, WIFI_PROBERSP);
+	
+	pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pframe += pktlen;
+
+	if(cur_network->IELength>MAX_IE_SZ)
+		return;
+
+	_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+	pframe += cur_network->IELength;
+	pktlen += cur_network->IELength;
+	
+	*pLength = pktlen;
+}
+
+//
+// Description: In normal chip, we should send some packet to Hw which will be used by Fw
+//			in FW LPS mode. The function is to fill the Tx descriptor of this packets, then 
+//			Fw can tell Hw to send these packet derectly.
+// Added by tynli. 2009.10.15.
+//
+static VOID
+FillFakeTxDescriptor92C(
+	IN PADAPTER		Adapter,
+	IN u8*			pDesc,
+	IN u32			BufferLen,
+	IN BOOLEAN		IsPsPoll
+)
+{
+	struct tx_desc	*ptxdesc = (struct tx_desc *)pDesc;
+
+	// Clear all status
+	_rtw_memset(pDesc, 0, 32);
+
+	//offset 0
+	ptxdesc->txdw0 |= cpu_to_le32( OWN | FSG | LSG); //own, bFirstSeg, bLastSeg;
+
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE+OFFSET_SZ)<<OFFSET_SHT)&0x00ff0000); //32 bytes for TX Desc
+
+	ptxdesc->txdw0 |= cpu_to_le32(BufferLen&0x0000ffff); // Buffer size + command header
+
+	//offset 4
+	ptxdesc->txdw1 |= cpu_to_le32((QSLT_MGNT<<QSEL_SHT)&0x00001f00); // Fixed queue of Mgnt queue
+
+	//Set NAVUSEHDR to prevent Ps-poll AId filed to be changed to error vlaue by Hw.
+	if(IsPsPoll)
+	{
+		ptxdesc->txdw1 |= cpu_to_le32(NAVUSEHDR);
+	}
+	else
+	{
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(7)); // Hw set sequence number
+		ptxdesc->txdw3 |= cpu_to_le32((8 <<28)); //set bit3 to 1. Suugested by TimChen. 2009.12.29.
+	}
+
+	//offset 16
+	ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+#ifdef CONFIG_USB_HCI
+	// USB interface drop packet if the checksum of descriptor isn't correct.
+	// Using this checksum can let hardware recovery from packet bulk out error (e.g. Cancel URC, Bulk out error.).
+	rtl8192cu_cal_txdesc_chksum(ptxdesc);
+#endif
+	
+	//RT_PRINT_DATA(COMP_CMD, DBG_TRACE, "TxFillCmdDesc8192C(): H2C Tx Cmd Content ----->\n", pDesc, TX_DESC_SIZE);
+}
+
+// To check if reserved page content is destroyed by beacon beacuse beacon is too large.
+// 2010.06.23. Added by tynli.
+VOID
+CheckFwRsvdPageContent(
+	IN	PADAPTER		Adapter
+)
+{
+	HAL_DATA_TYPE*	pHalData = GET_HAL_DATA(Adapter);
+	u32	MaxBcnPageNum;	
+	
+ 	if(pHalData->FwRsvdPageStartOffset != 0)
+ 	{
+ 		/*MaxBcnPageNum = PageNum_128(pMgntInfo->MaxBeaconSize);
+		RT_ASSERT((MaxBcnPageNum <= pHalData->FwRsvdPageStartOffset), 
+			("CheckFwRsvdPageContent(): The reserved page content has been"\
+			"destroyed by beacon!!! MaxBcnPageNum(%d) FwRsvdPageStartOffset(%d)\n!",
+			MaxBcnPageNum, pHalData->FwRsvdPageStartOffset));*/
+ 	}
+}
+
+//
+// Description: Fill the reserved packets that FW will use to RSVD page. 
+//			Now we just send 4 types packet to rsvd page.
+//			(1)Beacon, (2)Ps-poll, (3)Null data, (4)ProbeRsp.
+//	Input: 
+//	    bDLFinished - FALSE: At the first time we will send all the packets as a large packet to Hw,
+//				 		so we need to set the packet length to total lengh.
+//			      TRUE: At the second time, we should send the first packet (default:beacon)
+//						to Hw again and set the lengh in descriptor to the real beacon lengh.
+// 2009.10.15 by tynli.
+static void SetFwRsvdPagePkt(PADAPTER Adapter, BOOLEAN bDLFinished)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);	
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	struct xmit_priv	*pxmitpriv = &(Adapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(Adapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u32	BeaconLength, ProbeRspLength, PSPollLength, NullFunctionDataLength;
+	u8	*ReservedPagePacket;
+	u8	PageNum=0, U1bTmp, TxDescLen=0, TxDescOffset=0;
+	u16	BufIndex=0;
+	u32	TotalPacketLen;
+	RSVDPAGE_LOC	RsvdPageLoc;
+	BOOLEAN	bDLOK = _FALSE;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	ReservedPagePacket = (u8*)rtw_malloc(1000);
+	if(ReservedPagePacket == NULL){
+		DBG_871X("%s(): alloc ReservedPagePacket fail !!!\n", __FUNCTION__);
+		return;
+	}
+
+	_rtw_memset(ReservedPagePacket, 0, 1000);
+
+	TxDescLen = 32;//TX_DESC_SIZE;
+
+#ifdef CONFIG_USB_HCI
+	BufIndex = TXDESC_OFFSET;
+	TxDescOffset = TxDescLen+8; //Shift index for 8 bytes because the dummy bytes in the first descipstor.
+#else
+	BufIndex = 0;
+	TxDescOffset = 0;
+#endif
+
+	//(1) beacon
+	ConstructBeacon(Adapter,&ReservedPagePacket[BufIndex],&BeaconLength);
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: BCN\n", &ReservedPagePacket[BufIndex], (BeaconLength+BufIndex));
+
+//--------------------------------------------------------------------
+
+	// When we count the first page size, we need to reserve description size for the RSVD 
+	// packet, it will be filled in front of the packet in TXPKTBUF.
+	U1bTmp = (u8)PageNum_128(BeaconLength+TxDescLen);
+	PageNum += U1bTmp;
+	// To reserved 2 pages for beacon buffer. 2010.06.24.
+	if(PageNum == 1)
+		PageNum+=1;
+	pHalData->FwRsvdPageStartOffset = PageNum;
+
+	BufIndex = (PageNum*128) + TxDescOffset;
+		
+	//(2) ps-poll
+	ConstructPSPoll(Adapter, &ReservedPagePacket[BufIndex],&PSPollLength);
+	
+	FillFakeTxDescriptor92C(Adapter, &ReservedPagePacket[BufIndex-TxDescLen], PSPollLength, _TRUE);
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: PS-POLL\n", &ReservedPagePacket[BufIndex-TxDescLen], (PSPollLength+TxDescLen));
+
+	RsvdPageLoc.LocPsPoll = PageNum;
+
+//------------------------------------------------------------------
+			
+	U1bTmp = (u8)PageNum_128(PSPollLength+TxDescLen);
+	PageNum += U1bTmp;
+
+	BufIndex = (PageNum*128) + TxDescOffset;
+
+	//(3) null data
+	ConstructNullFunctionData(
+		Adapter, 
+		&ReservedPagePacket[BufIndex],
+		&NullFunctionDataLength,
+		get_my_bssid(&(pmlmeinfo->network)),
+		_FALSE);
+	
+	FillFakeTxDescriptor92C(Adapter, &ReservedPagePacket[BufIndex-TxDescLen], NullFunctionDataLength, _FALSE);
+
+	RsvdPageLoc.LocNullData = PageNum;
+	
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: NULL DATA \n", &ReservedPagePacket[BufIndex-TxDescLen], (NullFunctionDataLength+TxDescLen));
+//------------------------------------------------------------------
+
+	U1bTmp = (u8)PageNum_128(NullFunctionDataLength+TxDescLen);
+	PageNum += U1bTmp;
+
+	BufIndex = (PageNum*128) + TxDescOffset;
+	
+	//(4) probe response
+	ConstructProbeRsp(
+		Adapter, 
+		&ReservedPagePacket[BufIndex],
+		&ProbeRspLength,
+		get_my_bssid(&(pmlmeinfo->network)),
+		_FALSE);
+	
+	FillFakeTxDescriptor92C(Adapter, &ReservedPagePacket[BufIndex-TxDescLen], ProbeRspLength, _FALSE);
+
+	RsvdPageLoc.LocProbeRsp = PageNum;
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: PROBE RSP \n", &ReservedPagePacket[BufIndex-TxDescLen], (ProbeRspLength-TxDescLen));
+
+//------------------------------------------------------------------
+
+	U1bTmp = (u8)PageNum_128(ProbeRspLength+TxDescLen);
+
+	PageNum += U1bTmp;
+
+	TotalPacketLen = (PageNum*128);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(Adapter, pattrib);
+	pattrib->qsel = 0x10;
+	pattrib->pktlen = pattrib->last_txcmdsz = TotalPacketLen - TxDescLen;
+	_rtw_memcpy(pmgntframe->buf_addr, ReservedPagePacket, TotalPacketLen);
+
+	rtw_hal_mgnt_xmit(Adapter, pmgntframe);
+
+	bDLOK = _TRUE;
+
+	if(bDLOK)
+	{
+		DBG_871X("Set RSVD page location to Fw.\n");
+		rtl8192c_FillH2CCmd(Adapter, RSVD_PAGE_EID, sizeof(RsvdPageLoc), (u8 *)&RsvdPageLoc);
+	}
+
+	rtw_mfree(ReservedPagePacket,1000);
+
+}
+
+void rtl8192c_set_FwJoinBssReport_cmd(_adapter* padapter, u8 mstatus)
+{
+	JOINBSSRPT_PARM	JoinBssRptParm;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+_func_enter_;
+
+	DBG_871X("%s mstatus(%x)\n", __FUNCTION__,mstatus);
+
+	if(mstatus == 1)
+	{
+		BOOLEAN bRecover = _FALSE;
+	
+		// We should set AID, correct TSF, HW seq enable before set JoinBssReport to Fw in 88/92C.
+		// Suggested by filen. Added by tynli.
+		rtw_write16(padapter, REG_BCN_PSR_RPT, (0xC000|pmlmeinfo->aid));
+		// Do not set TSF again here or vWiFi beacon DMA INT will not work.
+		//correct_TSF(padapter, pmlmeext);
+		// Hw sequende enable by dedault. 2010.06.23. by tynli.
+		//rtw_write16(padapter, REG_NQOS_SEQ, ((pmlmeext->mgnt_seq+100)&0xFFF));
+		//rtw_write8(padapter, REG_HWSEQ_CTRL, 0xFF);
+
+		//set REG_CR bit 8
+		//U1bTmp = rtw_read8(padapter, REG_CR+1);
+		rtw_write8(padapter,  REG_CR+1, 0x03);
+
+		// Disable Hw protection for a time which revserd for Hw sending beacon.
+		// Fix download reserved page packet fail that access collision with the protection time.
+		// 2010.05.11. Added by tynli.
+		//SetBcnCtrlReg(padapter, 0, BIT3);
+		//SetBcnCtrlReg(padapter, BIT4, 0);
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)&(~BIT(3)));
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)|BIT(4));
+
+		// Set FWHW_TXQ_CTRL 0x422[6]=0 to tell Hw the packet is not a real beacon frame.
+		if(pHalData->RegFwHwTxQCtrl&BIT6)
+			bRecover = _TRUE;
+
+		// To tell Hw the packet is not a real beacon frame.
+		//U1bTmp = rtw_read8(padapter, REG_FWHW_TXQ_CTRL+2);
+		rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl&(~BIT6)));
+		pHalData->RegFwHwTxQCtrl &= (~BIT6);
+		SetFwRsvdPagePkt(padapter, 0);
+
+		// 2010.05.11. Added by tynli.
+		//SetBcnCtrlReg(padapter, BIT3, 0);
+		//SetBcnCtrlReg(padapter, 0, BIT4);
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)|BIT(3));
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)&(~BIT(4)));
+
+		// To make sure that if there exists an adapter which would like to send beacon.
+		// If exists, the origianl value of 0x422[6] will be 1, we should check this to
+		// prevent from setting 0x422[6] to 0 after download reserved page, or it will cause 
+		// the beacon cannot be sent by HW.
+		// 2010.06.23. Added by tynli.
+		if(bRecover)
+		{
+			rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl|BIT6));
+			pHalData->RegFwHwTxQCtrl |= BIT6;
+		}
+
+		// Clear CR[8] or beacon packet will not be send to TxBuf anymore.
+		rtw_write8(padapter, REG_CR+1, 0x02);
+	}
+
+	JoinBssRptParm.OpMode = mstatus;
+
+	rtl8192c_FillH2CCmd(padapter, JOINBSS_RPT_EID, sizeof(JoinBssRptParm), (u8 *)&JoinBssRptParm);
+	
+_func_exit_;
+}
+
+#ifdef CONFIG_P2P_PS
+void rtl8192c_set_p2p_ctw_period_cmd(_adapter* padapter, u8 ctwindow)
+{
+	struct P2P_PS_CTWPeriod_t p2p_ps_ctw;
+
+	p2p_ps_ctw.CTWPeriod = ctwindow;
+
+	rtl8192c_FillH2CCmd(padapter, P2P_PS_CTW_CMD_EID, 1, (u8 *)(&p2p_ps_ctw));
+	
+}
+
+void rtl8192c_set_p2p_ps_offload_cmd(_adapter* padapter, u8 p2p_ps_state)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);	
+	struct pwrctrl_priv		*pwrpriv = &padapter->pwrctrlpriv;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	struct P2P_PS_Offload_t	*p2p_ps_offload = &pHalData->p2p_ps_offload;
+	u8	i;
+	u16	ctwindow;
+	u32	start_time, tsf_low;
+
+_func_enter_;
+
+	switch(p2p_ps_state)
+	{
+		case P2P_PS_DISABLE:
+			DBG_8192C("P2P_PS_DISABLE \n");
+			_rtw_memset(p2p_ps_offload, 0 ,1);
+			break;
+		case P2P_PS_ENABLE:
+			DBG_8192C("P2P_PS_ENABLE \n");
+			// update CTWindow value.
+			if( pwdinfo->ctwindow > 0 )
+			{
+				p2p_ps_offload->CTWindow_En = 1;
+				ctwindow = pwdinfo->ctwindow;
+				if(IS_HARDWARE_TYPE_8723A(padapter))
+				{
+					//rtw_write16(padapter, REG_ATIMWND, ctwindow);
+				}
+				else
+				{
+					rtl8192c_set_p2p_ctw_period_cmd(padapter, ctwindow);
+				}
+			}
+
+			// hw only support 2 set of NoA
+			for( i=0 ; i<pwdinfo->noa_num ; i++)
+			{
+				// To control the register setting for which NOA
+				rtw_write8(padapter, 0x5CF, (i << 4));
+				if(i == 0)
+					p2p_ps_offload->NoA0_En = 1;
+				else
+					p2p_ps_offload->NoA1_En = 1;
+
+				// config P2P NoA Descriptor Register
+				rtw_write32(padapter, 0x5E0, pwdinfo->noa_duration[i]);
+
+				rtw_write32(padapter, 0x5E4, pwdinfo->noa_interval[i]);
+
+				//Get Current TSF value
+				tsf_low = rtw_read32(padapter, REG_TSFTR);
+
+				start_time = pwdinfo->noa_start_time[i];
+				if(pwdinfo->noa_count[i] != 1)
+				{
+					while( start_time <= (tsf_low+(50*1024) ) )
+					{
+						start_time += pwdinfo->noa_interval[i];
+						if(pwdinfo->noa_count[i] != 255)
+							pwdinfo->noa_count[i]--;
+					}
+				}
+				//DBG_8192C("%s(): start_time = %x\n",__FUNCTION__,start_time);
+				rtw_write32(padapter, 0x5E8, start_time);
+
+				rtw_write8(padapter, 0x5EC, pwdinfo->noa_count[i]);
+			}
+
+			if( (pwdinfo->opp_ps == 1) || (pwdinfo->noa_num > 0) )
+			{
+				// rst p2p circuit
+				rtw_write8(padapter, REG_DUAL_TSF_RST, BIT(4));
+
+				p2p_ps_offload->Offload_En = 1;
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					p2p_ps_offload->role= 1;
+					p2p_ps_offload->AllStaSleep = 0;
+				}
+				else
+				{
+					p2p_ps_offload->role= 0;
+				}
+
+				p2p_ps_offload->discovery = 0;
+			}
+			break;
+		case P2P_PS_SCAN:
+			DBG_8192C("P2P_PS_SCAN \n");
+			p2p_ps_offload->discovery = 1;
+			break;
+		case P2P_PS_SCAN_DONE:
+			DBG_8192C("P2P_PS_SCAN_DONE \n");
+			p2p_ps_offload->discovery = 0;
+			pwdinfo->p2p_ps_state = P2P_PS_ENABLE;
+			break;
+		default:
+			break;
+	}
+
+	rtl8192c_FillH2CCmd(padapter, P2P_PS_OFFLOAD_EID, 1, (u8 *)p2p_ps_offload);
+
+_func_exit_;
+
+}
+#endif // CONFIG_P2P_PS
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+int rtl8192c_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms)
+{
+	IO_OFFLOAD_LOC	IoOffloadLoc;
+	u32 start_time = rtw_get_current_time();
+	u32 passing_time_ms;
+	u8 polling_ret;
+	int ret = _FAIL;
+
+	if (rtw_IOL_append_END_cmd(xmit_frame) != _SUCCESS)
+		goto exit;
+
+	dump_mgntframe_and_wait(adapter, xmit_frame, max_wating_ms);
+
+	IoOffloadLoc.LocCmd = 0;
+	if(_SUCCESS != rtl8192c_FillH2CCmd(adapter, H2C_92C_IO_OFFLOAD, sizeof(IO_OFFLOAD_LOC), (u8 *)&IoOffloadLoc))
+		goto exit;
+
+	//polling if the IO offloading is done
+	while( (passing_time_ms=rtw_get_passing_time_ms(start_time)) <= max_wating_ms) {
+		#if 0 //C2H
+		if(0xff == rtw_read8(adapter, REG_C2HEVT_CLEAR))
+			break;
+		#else// 0x1c3
+		if(0x00 != (polling_ret=rtw_read8(adapter, 0x1c3)))
+			break;
+		#endif
+		rtw_msleep_os(5);
+	}
+	#if 0 //debug
+	DBG_871X("IOL %s, polling_ret:0x%02x, 0x1c0=0x%08x, 0x1c4=0x%08x, 0x1cc=0x%08x, 0x1e8=0x%08x, 0x130=0x%08x, 0x134=0x%08x\n"
+			, polling_ret==0xff?"success":"error"
+			, polling_ret
+			, rtw_read32(adapter, 0x1c0)
+			, rtw_read32(adapter, 0x1c4)
+			, rtw_read32(adapter, 0x1cc)
+			, rtw_read32(adapter, 0x1e8)
+			, rtw_read32(adapter, 0x130)
+			, rtw_read32(adapter, 0x134)
+	);
+	rtw_write32(adapter, 0x1c0, 0x0);
+	#endif
+
+	if(polling_ret == 0xff)
+		ret =_SUCCESS;
+	else {
+		DBG_871X("IOL %s, polling_ret:0x%02x\n"
+			//", 0x1c0=0x%08x, 0x1c4=0x%08x, 0x1cc=0x%08x, 0x1e8=0x%08x, 0x130=0x%08x, 0x134=0x%08x\n"
+			, polling_ret==0xff?"success":"error"
+			, polling_ret
+			//, rtw_read32(adapter, 0x1c0)
+			//, rtw_read32(adapter, 0x1c4)
+			//, rtw_read32(adapter, 0x1cc)
+			//, rtw_read32(adapter, 0x1e8)
+			//, rtw_read32(adapter, 0x130)
+			//, rtw_read32(adapter, 0x134)
+		);
+		#if 0 //debug
+		rtw_write16(adapter, 0x1c4, 0x0000); 
+		rtw_msleep_os(10);
+		DBG_871X("after reset, 0x1c4=0x%08x\n", rtw_read32(adapter, 0x1c4));
+		#endif
+
+	}
+
+	{
+		#if 0 //C2H
+		u32 c2h_evt;
+		int i;
+		c2h_evt = rtw_read32(adapter, REG_C2HEVT_MSG_NORMAL);
+		DBG_871X("%s io-offloading complete, in %ums: 0x%08x\n", __FUNCTION__, passing_time_ms, c2h_evt);
+		rtw_write8(adapter, REG_C2HEVT_CLEAR, 0x0);
+		#else// 0x1c3
+		DBG_871X("IOL %s complete in %ums\n", __FUNCTION__, passing_time_ms);
+		rtw_write8(adapter, 0x1c3, 0x0);
+		#endif
+	}
+
+exit:
+	return ret;
+
+}
+#endif //CONFIG_IOL
+
+
+#ifdef CONFIG_BEACON_DISABLE_OFFLOAD
+/* 
+ rtl8192c_dis_beacon_fun_cmd()
+	This function shall only be called by PORT1.
+	PORT0's beacon function can't be disabled, because it's used by RA function in FW/HW.
+	
+	// Still has the REG_BCN_CTRL_1 modified by unknowned party issue in case of Primary Interface + PORT1 combination.
+*/
+u8 rtl8192c_dis_beacon_fun_cmd(_adapter* padapter)
+{	
+	u8	buf[2];
+	u8	res=_SUCCESS;
+	
+_func_enter_;	
+	
+	_rtw_memset(buf, 0, sizeof(buf));
+
+	if (padapter->iface_type == IFACE_PORT0) {
+		//buf[0] = 0x1;
+		DBG_871X("%s(): ERROR! padapter->iface_type = %d\n", __FUNCTION__, padapter->iface_type);
+		return _FAIL;		
+	} else
+		buf[1] = 0x1;
+
+	rtl8192c_FillH2CCmd(padapter, H2C_92C_DISABLE_BCN_FUNC, 2, buf);
+	
+_func_exit_;
+
+	return res;
+
+}
+#endif  // CONFIG_BEACON_DISABLE_OFFLOAD
+
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+/*
+	ask FW to Reset sync register at Beacon early interrupt
+*/
+u8 rtl8192c_reset_tsf(_adapter *padapter, u8 reset_port )
+{	
+	u8	buf[2];
+	u8	res=_SUCCESS;
+	
+_func_enter_;
+	if (IFACE_PORT0==reset_port) {
+		buf[0] = 0x1; buf[1] = 0;
+	
+	} else{
+		buf[0] = 0x0; buf[1] = 0x1;
+	}
+	rtl8192c_FillH2CCmd(padapter, H2C_92C_RESET_TSF, 2, buf);
+_func_exit_;
+
+	return res;
+}
+
+int reset_tsf(PADAPTER Adapter, u8 reset_port )
+{
+	u8 reset_cnt_before = 0, reset_cnt_after = 0, loop_cnt = 0;
+	u32 reg_reset_tsf_cnt = (IFACE_PORT0==reset_port) ?
+				REG_FW_RESET_TSF_CNT_0:REG_FW_RESET_TSF_CNT_1;
+
+	rtw_scan_abort(Adapter->pbuddy_adapter);	/*	site survey will cause reset_tsf fail	*/
+	reset_cnt_after = reset_cnt_before = rtw_read8(Adapter,reg_reset_tsf_cnt);
+	rtl8192c_reset_tsf(Adapter, reset_port);
+
+	while ((reset_cnt_after == reset_cnt_before ) && (loop_cnt < 10)) {
+		rtw_msleep_os(100);
+		loop_cnt++;
+		reset_cnt_after = rtw_read8(Adapter, reg_reset_tsf_cnt);
+	}
+
+	return(loop_cnt >= 10) ? _FAIL : _TRUE;
+}
+
+
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+#ifdef CONFIG_WOWLAN
+
+void rtl8192c_set_wowlan_cmd(_adapter* padapter)
+{
+	u8	res=_SUCCESS;
+	SETWOWLAN_PARM pwowlan_parm;
+	struct pwrctrl_priv *pwrpriv=&padapter->pwrctrlpriv;
+	
+_func_enter_;
+
+	pwowlan_parm.mode =0;
+	pwowlan_parm.gpio_index=0;
+	pwowlan_parm.gpio_duration=0;
+	pwowlan_parm.second_mode =0;
+	pwowlan_parm.reserve=0;
+	
+	if(pwrpriv->wowlan_mode ==_TRUE){
+		pwowlan_parm.mode |=FW_WOWLAN_FUN_EN;
+		//printk("\n %s 1.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		if(pwrpriv->wowlan_pattern ==_TRUE){
+			pwowlan_parm.mode |= FW_WOWLAN_PATTERN_MATCH;
+		//printk("\n %s 2.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		}
+		if(pwrpriv->wowlan_magic ==_TRUE){
+			pwowlan_parm.mode |=FW_WOWLAN_MAGIC_PKT;
+		//printk("\n %s 3.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		}
+		if(pwrpriv->wowlan_unicast ==_TRUE){
+			pwowlan_parm.mode |=FW_WOWLAN_UNICAST;
+		//printk("\n %s 4.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		}
+		//WOWLAN_GPIO_ACTIVE means GPIO high active
+		//pwowlan_parm.mode |=FW_WOWLAN_GPIO_ACTIVE;
+		pwowlan_parm.mode |=FW_WOWLAN_REKEY_WAKEUP;
+		pwowlan_parm.mode |=FW_WOWLAN_DEAUTH_WAKEUP;
+		
+		rtl8192c_set_FwJoinBssReport_cmd( padapter, 1);
+		
+		//GPIO3
+		pwowlan_parm.gpio_index=3;
+		
+		//duration unit is 64us
+		pwowlan_parm.gpio_duration=0xff;
+		//
+		pwowlan_parm.second_mode|=FW_WOWLAN_GPIO_WAKEUP_EN;
+		//printk("\n %s 5.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		{	u8 *ptr=(u8 *)&pwowlan_parm;
+			printk("\n %s H2C_WO_WLAN=%x %02x:%02x:%02x:%02x:%02x \n",__FUNCTION__,H2C_WO_WLAN_CMD,ptr[0],ptr[1],ptr[2],ptr[3],ptr[4] );
+		}
+		rtl8192c_FillH2CCmd(padapter, H2C_WO_WLAN_CMD, 4, (u8 *)&pwowlan_parm);
+
+		//keep alive period = 3 * 10 BCN interval
+		pwowlan_parm.mode =3;
+		pwowlan_parm.gpio_index=3;
+		rtl8192c_FillH2CCmd(padapter, KEEP_ALIVE_CONTROL_CMD, 2, (u8 *)&pwowlan_parm);
+		printk("%s after KEEP_ALIVE_CONTROL_CMD register 0x81=%x \n",__FUNCTION__,rtw_read8(padapter, 0x81));
+
+		pwowlan_parm.mode =1;
+		pwowlan_parm.gpio_index=0;
+		pwowlan_parm.gpio_duration=0;
+		rtl8192c_FillH2CCmd(padapter, DISCONNECT_DECISION_CTRL_CMD, 3, (u8 *)&pwowlan_parm);
+		printk("%s after DISCONNECT_DECISION_CTRL_CMD register 0x81=%x \n",__FUNCTION__,rtw_read8(padapter, 0x81));
+		
+		//enable GPIO wakeup
+		pwowlan_parm.mode =1;
+		pwowlan_parm.gpio_index=0;
+		pwowlan_parm.gpio_duration=0;
+		rtl8192c_FillH2CCmd(padapter, REMOTE_WAKE_CTRL_CMD, 3, (u8 *)&pwowlan_parm);
+	}
+	else
+		rtl8192c_FillH2CCmd(padapter, H2C_WO_WLAN_CMD, 3, (u8 *)&pwowlan_parm);
+
+	
+_func_exit_;
+
+	return ;
+
+}
+
+#endif  //CONFIG_WOWLAN
+
+
+
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c
new file mode 100755
index 0000000000000..8a4c15307fbfc
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c
@@ -0,0 +1,5058 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+//============================================================
+// Description:
+//
+// This file is for 92CE/92CU dynamic mechanism only
+//
+//
+//============================================================
+
+//============================================================
+// include files
+//============================================================
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <rtl8192c_hal.h>
+#include "../dm.h"
+#ifdef CONFIG_INTEL_PROXIM
+#include "../proxim/intel_proxim.h"	
+#endif
+//============================================================
+// Global var
+//============================================================
+static u32 EDCAParam[maxAP][3] =
+{          // UL			DL
+	{0x5ea322, 0x00a630, 0x00a44f}, //atheros AP
+	{0x5ea32b, 0x5ea42b, 0x5e4322}, //broadcom AP
+	{0x3ea430, 0x00a630, 0x3ea44f}, //cisco AP
+	{0x5ea44f, 0x00a44f, 0x5ea42b}, //marvell AP
+	{0x5ea422, 0x00a44f, 0x00a44f}, //ralink AP
+	//{0x5ea44f, 0x5ea44f, 0x5ea44f}, //realtek AP
+	{0xa44f, 0x5ea44f, 0x5e431c}, //realtek AP
+	{0x5ea42b, 0xa630, 0x5e431c}, //airgocap AP
+	{0x5ea42b, 0x5ea42b, 0x5ea42b}, //unknown AP
+//	{0x5e4322, 0x00a44f, 0x5ea44f}, //unknown AP
+};
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_DIGInit()
+ *
+ * Overview:	Set DIG scheme init value.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *
+ *---------------------------------------------------------------------------*/
+static void	dm_DIGInit(
+	IN	PADAPTER	pAdapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	
+
+	pDigTable->Dig_Enable_Flag = _TRUE;
+	pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_MAX;
+	
+	pDigTable->CurIGValue = 0x20;
+	pDigTable->PreIGValue = 0x0;
+
+	pDigTable->CurSTAConnectState = pDigTable->PreSTAConnectState = DIG_STA_DISCONNECT;
+	pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_DISCONNECT;
+
+	pDigTable->RssiLowThresh 	= DM_DIG_THRESH_LOW;
+	pDigTable->RssiHighThresh 	= DM_DIG_THRESH_HIGH;
+
+	pDigTable->FALowThresh	= DM_FALSEALARM_THRESH_LOW;
+	pDigTable->FAHighThresh	= DM_FALSEALARM_THRESH_HIGH;
+
+	
+	pDigTable->rx_gain_range_max = DM_DIG_MAX;
+	pDigTable->rx_gain_range_min = DM_DIG_MIN;
+	pDigTable->rx_gain_range_min_nolink = 0;
+
+	pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+	pDigTable->BackoffVal_range_max = DM_DIG_BACKOFF_MAX;
+	pDigTable->BackoffVal_range_min = DM_DIG_BACKOFF_MIN;
+
+	pDigTable->PreCCKPDState = CCK_PD_STAGE_MAX;
+	pDigTable->CurCCKPDState = CCK_PD_STAGE_LowRssi;
+
+	pDigTable->ForbiddenIGI = DM_DIG_MIN;
+	pDigTable->LargeFAHit = 0;
+	pDigTable->Recover_cnt = 0;
+	pdmpriv->DIG_Dynamic_MIN  = 0x25; //for FUNAI_TV
+}
+
+
+static u8 dm_initial_gain_MinPWDB(
+	IN	PADAPTER	pAdapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T			*pDigTable = &pdmpriv->DM_DigTable;
+	int	Rssi_val_min = 0;
+	
+	if((pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT) &&
+		(pDigTable->CurSTAConnectState == DIG_STA_CONNECT) )
+	{
+		if(pdmpriv->EntryMinUndecoratedSmoothedPWDB != 0)
+#ifdef CONFIG_CONCURRENT_MODE
+			Rssi_val_min  =  (pdmpriv->UndecoratedSmoothedPWDB+pdmpriv->EntryMinUndecoratedSmoothedPWDB)/2;
+#else
+			Rssi_val_min  =  (pdmpriv->EntryMinUndecoratedSmoothedPWDB > pdmpriv->UndecoratedSmoothedPWDB)?
+					pdmpriv->UndecoratedSmoothedPWDB:pdmpriv->EntryMinUndecoratedSmoothedPWDB;		
+#endif //CONFIG_CONCURRENT_MODE
+		else
+			Rssi_val_min = pdmpriv->UndecoratedSmoothedPWDB;
+	}
+	else if(pDigTable->CurSTAConnectState == DIG_STA_CONNECT || 
+			pDigTable->CurSTAConnectState == DIG_STA_BEFORE_CONNECT) 
+		Rssi_val_min = pdmpriv->UndecoratedSmoothedPWDB;
+	else if(pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT)
+		Rssi_val_min = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+
+	//printk("%s CurMultiSTAConnectState(0x%02x) UndecoratedSmoothedPWDB(%d),EntryMinUndecoratedSmoothedPWDB(%d)\n"
+	//,__FUNCTION__,pDigTable->CurSTAConnectState,
+	//pdmpriv->UndecoratedSmoothedPWDB,pdmpriv->EntryMinUndecoratedSmoothedPWDB);
+
+	return (u8)Rssi_val_min;
+}
+
+
+static VOID 
+dm_FalseAlarmCounterStatistics(
+	IN	PADAPTER	Adapter
+	)
+{
+	u32 ret_value;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+#endif //CONFIG_CONCURRENT_MODE
+	
+	ret_value = PHY_QueryBBReg(Adapter, rOFDM_PHYCounter1, bMaskDWord);
+       FalseAlmCnt->Cnt_Parity_Fail = ((ret_value&0xffff0000)>>16);	
+
+       ret_value = PHY_QueryBBReg(Adapter, rOFDM_PHYCounter2, bMaskDWord);
+	FalseAlmCnt->Cnt_Rate_Illegal = (ret_value&0xffff);
+	FalseAlmCnt->Cnt_Crc8_fail = ((ret_value&0xffff0000)>>16);
+	ret_value = PHY_QueryBBReg(Adapter, rOFDM_PHYCounter3, bMaskDWord);
+	FalseAlmCnt->Cnt_Mcs_fail = (ret_value&0xffff);
+	ret_value = PHY_QueryBBReg(Adapter, rOFDM0_FrameSync, bMaskDWord);
+	FalseAlmCnt->Cnt_Fast_Fsync = (ret_value&0xffff);
+	FalseAlmCnt->Cnt_SB_Search_fail = ((ret_value&0xffff0000)>>16);
+
+	FalseAlmCnt->Cnt_Ofdm_fail = 	FalseAlmCnt->Cnt_Parity_Fail + FalseAlmCnt->Cnt_Rate_Illegal +
+								FalseAlmCnt->Cnt_Crc8_fail + FalseAlmCnt->Cnt_Mcs_fail+
+								FalseAlmCnt->Cnt_Fast_Fsync + FalseAlmCnt->Cnt_SB_Search_fail;
+
+	
+	//hold cck counter
+	PHY_SetBBReg(Adapter, rCCK0_FalseAlarmReport, BIT(14), 1);
+	
+	ret_value = PHY_QueryBBReg(Adapter, rCCK0_FACounterLower, bMaskByte0);
+	FalseAlmCnt->Cnt_Cck_fail = ret_value;
+
+	ret_value = PHY_QueryBBReg(Adapter, rCCK0_FACounterUpper, bMaskByte3);
+	FalseAlmCnt->Cnt_Cck_fail +=  (ret_value& 0xff)<<8;
+	
+	FalseAlmCnt->Cnt_all = (	FalseAlmCnt->Cnt_Parity_Fail +
+						FalseAlmCnt->Cnt_Rate_Illegal +
+						FalseAlmCnt->Cnt_Crc8_fail +
+						FalseAlmCnt->Cnt_Mcs_fail +
+						FalseAlmCnt->Cnt_Cck_fail);	
+
+	Adapter->recvpriv.FalseAlmCnt_all = FalseAlmCnt->Cnt_all;
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pbuddy_adapter)
+		pbuddy_adapter->recvpriv.FalseAlmCnt_all = FalseAlmCnt->Cnt_all;
+#endif //CONFIG_CONCURRENT_MODE
+
+	//reset false alarm counter registers
+	PHY_SetBBReg(Adapter, rOFDM1_LSTF, 0x08000000, 1);
+	PHY_SetBBReg(Adapter, rOFDM1_LSTF, 0x08000000, 0);
+	//reset cck counter
+	PHY_SetBBReg(Adapter, rCCK0_FalseAlarmReport, 0x0000c000, 0);
+	//enable cck counter
+	PHY_SetBBReg(Adapter, rCCK0_FalseAlarmReport, 0x0000c000, 2);
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("Cnt_Parity_Fail = %ld, Cnt_Rate_Illegal = %ld, Cnt_Crc8_fail = %ld, Cnt_Mcs_fail = %ld\n", 
+	//			FalseAlmCnt->Cnt_Parity_Fail, FalseAlmCnt->Cnt_Rate_Illegal, FalseAlmCnt->Cnt_Crc8_fail, FalseAlmCnt->Cnt_Mcs_fail) );
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("Cnt_Ofdm_fail = %ld, Cnt_Cck_fail = %ld, Cnt_all = %ld\n", 
+	//			FalseAlmCnt->Cnt_Ofdm_fail, FalseAlmCnt->Cnt_Cck_fail, FalseAlmCnt->Cnt_all) );
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("Cnt_Ofdm_fail = %ld, Cnt_Cck_fail = %ld, Cnt_all = %ld\n", 
+	//			FalseAlmCnt->Cnt_Ofdm_fail, FalseAlmCnt->Cnt_Cck_fail, FalseAlmCnt->Cnt_all) );
+}
+
+
+static VOID
+DM_Write_DIG(
+	IN	PADAPTER	pAdapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	
+#ifdef CONFIG_CONCURRENT_MODE
+	if(rtw_buddy_adapter_up(pAdapter))
+	{
+		PADAPTER pbuddy_adapter = pAdapter->pbuddy_adapter;
+		PHAL_DATA_TYPE	pbuddy_HalData = GET_HAL_DATA(pbuddy_adapter);
+		struct dm_priv *pbuddy_dmpriv = &pbuddy_HalData->dmpriv;
+		DIG_T	*pbuddy_DigTable = &pbuddy_dmpriv->DM_DigTable;
+
+		//sync IGValue
+		pbuddy_DigTable->PreIGValue = pDigTable->PreIGValue;
+		pbuddy_DigTable->CurIGValue = pDigTable->CurIGValue;
+	}
+#endif //CONFIG_CONCURRENT_MODE	
+
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("CurIGValue = 0x%lx, PreIGValue = 0x%lx, BackoffVal = %d\n", 
+	//			DM_DigTable.CurIGValue, DM_DigTable.PreIGValue, DM_DigTable.BackoffVal));
+
+	if (pDigTable->Dig_Enable_Flag == _FALSE)
+	{
+		//RT_TRACE(	COMP_DIG, DBG_LOUD, ("DIG is disabled\n"));
+		pDigTable->PreIGValue = 0x17;
+		return;
+	}
+
+	if( (pDigTable->PreIGValue != pDigTable->CurIGValue) || ( pAdapter->bForceWriteInitGain ) )
+	{
+		// Set initial gain.
+		//PHY_SetBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, pDigTable->CurIGValue);
+		//PHY_SetBBReg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, pDigTable->CurIGValue);
+		//printk("%s DIG(0x%02x)\n",__FUNCTION__,pDigTable->CurIGValue);
+
+#if defined CONFIG_WIDI_DIG_3E && defined CONFIG_INTEL_WIDI
+		if( pAdapter->mlmepriv.widi_enable == _TRUE )
+		{
+			PHY_SetBBReg(pAdapter, rOFDM0_XAAGCCore1, 0x7f, 0x3e);
+			PHY_SetBBReg(pAdapter, rOFDM0_XBAGCCore1, 0x7f, 0x3e);
+		}
+		else
+#endif //defined CONFIG_WIDI_DIG_3E && defined CONFIG_INTEL_WIDI
+		{
+			PHY_SetBBReg(pAdapter, rOFDM0_XAAGCCore1, 0x7f, pDigTable->CurIGValue);
+			PHY_SetBBReg(pAdapter, rOFDM0_XBAGCCore1, 0x7f, pDigTable->CurIGValue);
+		}
+		pDigTable->PreIGValue = pDigTable->CurIGValue;
+	}
+}
+
+
+static VOID 
+dm_CtrlInitGainByFA(
+	IN	PADAPTER	pAdapter
+)	
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+
+	u8	value_IGI = pDigTable->CurIGValue;
+	
+	if(FalseAlmCnt->Cnt_all < DM_DIG_FA_TH0)	
+		value_IGI --;
+	else if(FalseAlmCnt->Cnt_all < DM_DIG_FA_TH1)	
+		value_IGI += 0;
+	else if(FalseAlmCnt->Cnt_all < DM_DIG_FA_TH2)	
+		value_IGI ++;
+	else if(FalseAlmCnt->Cnt_all >= DM_DIG_FA_TH2)	
+		value_IGI +=2;
+	
+	if(value_IGI > DM_DIG_FA_UPPER)			
+		value_IGI = DM_DIG_FA_UPPER;
+	if(value_IGI < DM_DIG_FA_LOWER)
+		value_IGI = DM_DIG_FA_LOWER;
+
+	if(FalseAlmCnt->Cnt_all > 10000)
+		value_IGI = DM_DIG_FA_UPPER;
+	
+	pDigTable->CurIGValue = value_IGI;
+	
+	DM_Write_DIG(pAdapter);
+	
+}
+
+#ifdef CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+VOID dm_CtrlInitGainByRssi( IN PADAPTER pAdapter) 
+{ 
+
+	u32 isBT;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+#ifdef CONFIG_DM_ADAPTIVITY
+	u8 Adap_IGI_Upper = pdmpriv->IGI_target + 30 + (u8) pdmpriv->TH_L2H_ini -(u8) pdmpriv->TH_EDCCA_HL_diff;
+#endif
+
+	 //modify DIG upper bound
+	if((pDigTable->Rssi_val_min + 20) > DM_DIG_MAX )
+		pDigTable->rx_gain_range_max = DM_DIG_MAX;
+ 	else
+  		pDigTable->rx_gain_range_max = pDigTable->Rssi_val_min + 20;
+
+	//modify DIG lower bound	
+	if((FalseAlmCnt->Cnt_all > 500)&&(pdmpriv->DIG_Dynamic_MIN < 0x25))
+  		pdmpriv->DIG_Dynamic_MIN++;
+ 	if((FalseAlmCnt->Cnt_all < 500)&&(pdmpriv->DIG_Dynamic_MIN > DM_DIG_MIN))
+  		pdmpriv->DIG_Dynamic_MIN--;
+	if((pDigTable->Rssi_val_min < 8) && (pdmpriv->DIG_Dynamic_MIN > DM_DIG_MIN))
+		pdmpriv->DIG_Dynamic_MIN--;
+	
+ 	//modify DIG lower bound, deal with abnorally large false alarm
+ 	if(FalseAlmCnt->Cnt_all > 10000)
+ 	{
+ 		//RT_TRACE(COMP_DIG, DBG_LOUD, ("dm_DIG(): Abnornally false alarm case. \n"));
+  		pDigTable->LargeFAHit++;
+ 		 if(pDigTable->ForbiddenIGI < pDigTable->CurIGValue)
+  		{
+   			pDigTable->ForbiddenIGI = pDigTable->CurIGValue;
+	  		pDigTable->LargeFAHit = 1;
+	  	}
+	  	if(pDigTable->LargeFAHit >= 3)
+	  	{
+			if((pDigTable->ForbiddenIGI+1) >pDigTable->rx_gain_range_max)
+		    		pDigTable->rx_gain_range_min = pDigTable->rx_gain_range_max;
+		   	else
+		    		pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+		   	pDigTable->Recover_cnt = 3600; //3600=2hr
+		  }
+	 }
+	 else
+	 {
+	  //Recovery mechanism for IGI lower bound
+	  	if(pDigTable->Recover_cnt != 0){
+	   		pDigTable->Recover_cnt --;
+	  	}
+	  	else
+	 	{
+			if(pDigTable->LargeFAHit == 0 )
+	   		{
+	   			if((pDigTable->ForbiddenIGI -1) < pdmpriv->DIG_Dynamic_MIN) //DM_DIG_MIN)
+			    	{
+			     		pDigTable->ForbiddenIGI = pdmpriv->DIG_Dynamic_MIN; //DM_DIG_MIN;
+			     		pDigTable->rx_gain_range_min = pdmpriv->DIG_Dynamic_MIN; //DM_DIG_MIN;
+			    	}
+			    	else
+			    	{
+			     		pDigTable->ForbiddenIGI --;
+			     		pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+			    	}
+	   		}
+	   		else if(pDigTable->LargeFAHit == 3 )
+	   		{
+	    			pDigTable->LargeFAHit = 0;
+	   		}
+	  	}
+	 }
+ #ifdef CONFIG_USB_HCI
+	if(FalseAlmCnt->Cnt_all < 250)
+	{
+#endif
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by SS mode\n");
+		
+		isBT = rtw_read8(pAdapter, 0x4fd) & 0x01;
+
+		if(!isBT){
+
+			if(FalseAlmCnt->Cnt_all > pDigTable->FAHighThresh)
+			{
+				if((pDigTable->BackoffVal -2) < pDigTable->BackoffVal_range_min)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_min;
+				else
+					pDigTable->BackoffVal -= 2; 
+			}	
+			else if(FalseAlmCnt->Cnt_all < pDigTable->FALowThresh)
+			{
+				if((pDigTable->BackoffVal+2) > pDigTable->BackoffVal_range_max)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_max;
+				else
+					pDigTable->BackoffVal +=2;
+			}	
+		}
+		else
+			pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+
+		pDigTable->CurIGValue = pDigTable->Rssi_val_min+10-pDigTable->BackoffVal;	
+
+		//DBG_8192C("Rssi_val_min = %x BackoffVal %x\n",pDigTable->Rssi_val_min, pDigTable->BackoffVal);
+#ifdef CONFIG_USB_HCI
+	}
+	else
+	{		
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by FA mode\n");
+		//DBG_8192C("RSSI = 0x%x", pDigTable->Rssi_val_min);
+
+		//Adjust initial gain by false alarm		
+		if(FalseAlmCnt->Cnt_all > 1000)
+			pDigTable->CurIGValue = pDigTable ->PreIGValue+2;
+		else if (FalseAlmCnt->Cnt_all > 750)
+			pDigTable->CurIGValue = pDigTable->PreIGValue+1;
+		else if(FalseAlmCnt->Cnt_all < 500)
+			pDigTable->CurIGValue = pDigTable->PreIGValue-1;	
+	}
+#endif
+
+	//Check initial gain by upper/lower bound
+	if(pDigTable->CurIGValue >pDigTable->rx_gain_range_max)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_max;
+
+	if(pDigTable->CurIGValue < pDigTable->rx_gain_range_min)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_min;
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	if(pdmpriv->DMFlag & DYNAMIC_FUNC_ADAPTIVITY)
+	{
+		if(pDigTable->CurIGValue > Adap_IGI_Upper)
+			pDigTable->CurIGValue = Adap_IGI_Upper;
+
+		if(pdmpriv->IGI_LowerBound != 0)
+		{
+			if(pDigTable->CurIGValue < pdmpriv->IGI_LowerBound)
+				pDigTable->CurIGValue = pdmpriv->IGI_LowerBound;
+		}
+		LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT": pdmpriv->IGI_LowerBound = %d\n",
+			FUNC_ADPT_ARG(pAdapter), pdmpriv->IGI_LowerBound);
+	}
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+	//printk("%s => rx_gain_range_max(0x%02x) rx_gain_range_min(0x%02x)\n",__FUNCTION__,
+	//	pDigTable->rx_gain_range_max,pDigTable->rx_gain_range_min);
+	//printk("%s CurIGValue(0x%02x)  <====\n",__FUNCTION__,pDigTable->CurIGValue );		
+
+	DM_Write_DIG(pAdapter);
+
+}
+#else
+static VOID dm_CtrlInitGainByRssi(IN	PADAPTER	pAdapter)	
+{
+	u32 isBT;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+	u8 RSSI_tmp = dm_initial_gain_MinPWDB(pAdapter);
+#ifdef CONFIG_DM_ADAPTIVITY
+	u8 Adap_IGI_Upper = pdmpriv->IGI_target + 30 + (u8) pdmpriv->TH_L2H_ini -(u8) pdmpriv->TH_EDCCA_HL_diff;
+#endif
+
+	//modify DIG upper bound
+	if((pDigTable->Rssi_val_min + 20) > DM_DIG_MAX )
+		pDigTable->rx_gain_range_max = DM_DIG_MAX;
+	else
+		pDigTable->rx_gain_range_max = pDigTable->Rssi_val_min + 20;
+	//printk("%s Rssi_val_min(0x%02x),rx_gain_range_max(0x%02x)\n",__FUNCTION__,pDigTable->Rssi_val_min,pDigTable->rx_gain_range_max);
+	//modify DIG lower bound, deal with abnorally large false alarm
+	if(FalseAlmCnt->Cnt_all > 10000)
+	{
+		//RT_TRACE(COMP_DIG, DBG_LOUD, ("dm_DIG(): Abnornally false alarm case. \n"));
+
+		pDigTable->LargeFAHit++;
+		if(pDigTable->ForbiddenIGI < pDigTable->CurIGValue)
+		{
+			pDigTable->ForbiddenIGI = pDigTable->CurIGValue;
+			pDigTable->LargeFAHit = 1;
+		}
+
+		if(pDigTable->LargeFAHit >= 3)
+		{
+			if((pDigTable->ForbiddenIGI+1) > pDigTable->rx_gain_range_max)
+				pDigTable->rx_gain_range_min = pDigTable->rx_gain_range_max;
+			else
+				pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+			pDigTable->Recover_cnt = 3600; //3600=2hr
+		}
+	}
+	else
+	{
+		//Recovery mechanism for IGI lower bound
+		if(pDigTable->Recover_cnt != 0)
+			pDigTable->Recover_cnt --;
+		else
+		{
+			if(pDigTable->LargeFAHit == 0 )
+			{
+				if((pDigTable->ForbiddenIGI -1) < DM_DIG_MIN)
+				{
+					pDigTable->ForbiddenIGI = DM_DIG_MIN;
+					pDigTable->rx_gain_range_min = DM_DIG_MIN;
+				}
+				else
+				{
+					pDigTable->ForbiddenIGI --;
+					pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+				}
+			}
+			else if(pDigTable->LargeFAHit == 3 )
+			{
+				pDigTable->LargeFAHit = 0;
+			}
+		}
+	}
+
+	//RT_TRACE(COMP_DIG, DBG_LOUD, ("DM_DigTable.ForbiddenIGI = 0x%x, DM_DigTable.LargeFAHit = 0x%x\n",pDigTable->ForbiddenIGI, pDigTable->LargeFAHit));
+	//RT_TRACE(COMP_DIG, DBG_LOUD, ("DM_DigTable.rx_gain_range_max = 0x%x, DM_DigTable.rx_gain_range_min = 0x%x\n",pDigTable->rx_gain_range_max, pDigTable->rx_gain_range_min));
+
+#ifdef CONFIG_USB_HCI
+	if(FalseAlmCnt->Cnt_all < 250)
+	{
+#endif
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by SS mode\n");
+		
+		isBT = rtw_read8(pAdapter, 0x4fd) & 0x01;
+
+		if(!isBT){
+
+			if(FalseAlmCnt->Cnt_all > pDigTable->FAHighThresh)
+			{
+				if((pDigTable->BackoffVal -2) < pDigTable->BackoffVal_range_min)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_min;
+				else
+					pDigTable->BackoffVal -= 2; 
+			}	
+			else if(FalseAlmCnt->Cnt_all < pDigTable->FALowThresh)
+			{
+				if((pDigTable->BackoffVal+2) > pDigTable->BackoffVal_range_max)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_max;
+				else
+					pDigTable->BackoffVal +=2;
+			}	
+		}
+		else
+			pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+
+		pDigTable->CurIGValue = pDigTable->Rssi_val_min+10-pDigTable->BackoffVal;	
+
+		//DBG_8192C("Rssi_val_min = %x BackoffVal %x\n",pDigTable->Rssi_val_min, pDigTable->BackoffVal);
+#ifdef CONFIG_USB_HCI
+	}
+	else
+	{		
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by FA mode\n");
+		//DBG_8192C("RSSI = 0x%x", pDigTable->Rssi_val_min);
+
+		//Adjust initial gain by false alarm		
+		if(FalseAlmCnt->Cnt_all > 1000)
+			pDigTable->CurIGValue = pDigTable ->PreIGValue+2;
+		else if (FalseAlmCnt->Cnt_all > 750)
+			pDigTable->CurIGValue = pDigTable->PreIGValue+1;
+		else if(FalseAlmCnt->Cnt_all < 500)
+			pDigTable->CurIGValue = pDigTable->PreIGValue-1;	
+	}
+#endif
+
+	if(RSSI_tmp <= DM_DIG_MIN)
+		pDigTable->rx_gain_range_min = DM_DIG_MIN;
+	else if(RSSI_tmp >= DM_DIG_MAX)
+		pDigTable->rx_gain_range_min = DM_DIG_MAX;
+	else
+		pDigTable->rx_gain_range_min = RSSI_tmp;
+
+
+	//Check initial gain by upper/lower bound
+	if(pDigTable->CurIGValue >pDigTable->rx_gain_range_max)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_max;
+
+	if(pDigTable->CurIGValue < pDigTable->rx_gain_range_min)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_min;
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	if(pdmpriv->DMFlag & DYNAMIC_FUNC_ADAPTIVITY)
+	{
+		if(pDigTable->CurIGValue > Adap_IGI_Upper)
+			pDigTable->CurIGValue = Adap_IGI_Upper;
+
+		if(pdmpriv->IGI_LowerBound != 0)
+		{
+			if(pDigTable->CurIGValue < pdmpriv->IGI_LowerBound)
+				pDigTable->CurIGValue = pdmpriv->IGI_LowerBound;
+		}
+		LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT": pdmpriv->IGI_LowerBound = %d\n",
+			FUNC_ADPT_ARG(pAdapter), pdmpriv->IGI_LowerBound);
+	}
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+	//printk("%s => rx_gain_range_max(0x%02x) rx_gain_range_min(0x%02x)\n",__FUNCTION__,
+	//	pDigTable->rx_gain_range_max,pDigTable->rx_gain_range_min);
+	//printk("%s CurIGValue(0x%02x)  <====\n",__FUNCTION__,pDigTable->CurIGValue );		
+
+	DM_Write_DIG(pAdapter);
+
+}
+#endif
+
+static VOID
+dm_initial_gain_Multi_STA(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &(pAdapter->mlmepriv);
+	DIG_T			*pDigTable = &pdmpriv->DM_DigTable;
+	int				rssi_strength =  pdmpriv->EntryMinUndecoratedSmoothedPWDB;	
+	BOOLEAN			bMulti_STA = _FALSE;
+	
+#ifdef CONFIG_CONCURRENT_MODE
+	//AP Mode
+	if(check_buddy_fwstate(pAdapter, WIFI_AP_STATE) == _TRUE && (rssi_strength !=0))
+	{
+		bMulti_STA = _TRUE;
+	}	
+	else if(pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT && rssi_strength==0) //STA+STA MODE
+	{
+		bMulti_STA = _TRUE;
+		rssi_strength = pdmpriv->UndecoratedSmoothedPWDB;		
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+
+	//ADHOC and AP Mode
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		bMulti_STA = _TRUE;
+	}
+
+
+	if((bMulti_STA == _FALSE) 
+		|| (pDigTable->CurSTAConnectState == DIG_STA_DISCONNECT))	 
+	{
+		pdmpriv->binitialized = _FALSE;
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_MAX;
+		return;
+	}	
+	else if(pdmpriv->binitialized == _FALSE)
+	{
+		pdmpriv->binitialized = _TRUE;
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_0;
+		pDigTable->CurIGValue = 0x20;
+		DM_Write_DIG(pAdapter);
+	}
+
+	// Initial gain control by ap mode 
+	if(pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT)
+	{
+		if (	(rssi_strength < pDigTable->RssiLowThresh) 	&& 
+			(pDigTable->Dig_Ext_Port_Stage != DIG_EXT_PORT_STAGE_1))
+		{					
+			// Set to dig value to 0x20 for Luke's opinion after disable dig
+			if(pDigTable->Dig_Ext_Port_Stage == DIG_EXT_PORT_STAGE_2)
+			{
+				pDigTable->CurIGValue = 0x20;
+				DM_Write_DIG(pAdapter);				
+			}	
+			pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_1;	
+		}	
+		else if (rssi_strength > pDigTable->RssiHighThresh)
+		{
+			pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_2;
+			dm_CtrlInitGainByFA(pAdapter);
+		} 
+	}	
+	else if(pDigTable->Dig_Ext_Port_Stage != DIG_EXT_PORT_STAGE_0)
+	{
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_0;
+		pDigTable->CurIGValue = 0x20;
+		DM_Write_DIG(pAdapter);
+	}
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("CurMultiSTAConnectState = %x Dig_Ext_Port_Stage %x\n", 
+	//			DM_DigTable.CurMultiSTAConnectState, DM_DigTable.Dig_Ext_Port_Stage));
+}
+
+static VOID 
+dm_initial_gain_STA_beforelinked(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS pFalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+	
+	//CurrentIGI = pDM_DigTable->rx_gain_range_min;//pDM_DigTable->CurIGValue = pDM_DigTable->rx_gain_range_min
+	//ODM_RT_TRACE(pDM_Odm, ODM_COMP_DIG, ODM_DBG_LOUD, ("odm_DIG(): DIG BeforeLink\n"));
+	//2012.03.30 LukeLee: enable DIG before link but with very high thresholds
+	//	Updated by Albert 2012/09/27
+	//	Copy the same rule from 8192du code.
+      	if( pFalseAlmCnt->Cnt_all > 2000 )
+		pDigTable->CurIGValue += 2;
+	else if ( ( pFalseAlmCnt->Cnt_all > 1000 ) && ( pFalseAlmCnt->Cnt_all <= 1000 ) )
+		pDigTable->CurIGValue += 1;
+	else if(pFalseAlmCnt->Cnt_all < 500)
+		 pDigTable->CurIGValue -= 1;
+
+	//Check initial gain by upper/lower bound
+	if(pDigTable->CurIGValue >pDigTable->rx_gain_range_max)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_max;
+
+	if(pDigTable->CurIGValue < pDigTable->rx_gain_range_min)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_min;
+	
+	printk("%s ==> FalseAlmCnt->Cnt_all:%d CurIGValue:0x%02x \n",__FUNCTION__,pFalseAlmCnt->Cnt_all ,pDigTable->CurIGValue);		 
+}
+
+static VOID 
+dm_initial_gain_STA(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("PreSTAConnectState = %x, CurSTAConnectState = %x\n", 
+	//			DM_DigTable.PreSTAConnectState, DM_DigTable.CurSTAConnectState));
+
+
+	if(pDigTable->PreSTAConnectState == pDigTable->CurSTAConnectState||
+	   pDigTable->CurSTAConnectState == DIG_STA_BEFORE_CONNECT ||
+	   pDigTable->CurSTAConnectState == DIG_STA_CONNECT)
+	{
+		// beforeconnect -> beforeconnect or  connect -> connect
+		// (dis)connect -> beforeconnect
+		// disconnect -> connecct or beforeconnect -> connect
+		if(pDigTable->CurSTAConnectState != DIG_STA_DISCONNECT)
+		{
+			pDigTable->Rssi_val_min = dm_initial_gain_MinPWDB(pAdapter);
+			dm_CtrlInitGainByRssi(pAdapter);
+		}	
+#if 0
+		else if((wdev_to_priv(pAdapter->rtw_wdev))->p2p_enabled == _TRUE 
+				&& pAdapter->wdinfo.driver_interface == DRIVER_CFG80211)
+		{
+			//pDigTable->CurIGValue = 0x30;
+			DM_Write_DIG(pAdapter);
+		}
+#endif
+		else{ // pDigTable->CurSTAConnectState == DIG_STA_DISCONNECT 
+		#ifdef CONFIG_BEFORE_LINKED_DIG
+			//printk("%s==> ##1 CurIGI(0x%02x),PreIGValue(0x%02x) \n",__FUNCTION__,pDigTable->CurIGValue,pDigTable->PreIGValue );
+			dm_initial_gain_STA_beforelinked(pAdapter);
+			DM_Write_DIG(pAdapter);
+		#endif //CONFIG_BEFORE_LINKED_DIG
+		}
+	}
+	else	
+	{		
+		// connect -> disconnect or beforeconnect -> disconnect
+		pDigTable->Rssi_val_min = 0;
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_MAX;
+		pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+		pDigTable->CurIGValue = 0x20;
+		pDigTable->PreIGValue = 0;	
+		#ifdef CONFIG_BEFORE_LINKED_DIG			
+		//printk("%s==> ##2 CurIGI(0x%02x),PreIGValue(0x%02x) \n",__FUNCTION__,pDigTable->CurIGValue,pDigTable->PreIGValue );	
+		dm_initial_gain_STA_beforelinked(pAdapter);			 
+ 		#endif //CONFIG_BEFORE_LINKED_DIG
+		
+
+		DM_Write_DIG(pAdapter);
+	}
+
+}
+
+
+static void dm_CCK_PacketDetectionThresh(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	if(pDigTable->CurSTAConnectState == DIG_STA_CONNECT)
+	{
+		pDigTable->Rssi_val_min = dm_initial_gain_MinPWDB(pAdapter);
+		if(pDigTable->PreCCKPDState == CCK_PD_STAGE_LowRssi)
+		{
+			if(pDigTable->Rssi_val_min <= 25)
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_LowRssi;
+			else
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_HighRssi;
+		}
+		else{
+			if(pDigTable->Rssi_val_min <= 20)
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_LowRssi;
+			else
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_HighRssi;
+		}
+	}
+	else
+		pDigTable->CurCCKPDState=CCK_PD_STAGE_MAX;
+	
+	if(pDigTable->PreCCKPDState != pDigTable->CurCCKPDState)
+	{
+		if((pDigTable->CurCCKPDState == CCK_PD_STAGE_LowRssi)||
+			(pDigTable->CurCCKPDState == CCK_PD_STAGE_MAX))
+		{
+			PHY_SetBBReg(pAdapter, rCCK0_CCA, bMaskByte2, 0x83);
+				
+			//PHY_SetBBReg(pAdapter, rCCK0_System, bMaskByte1, 0x40);
+			//if(IS_92C_SERIAL(pHalData->VersionID))
+				//PHY_SetBBReg(pAdapter, rCCK0_FalseAlarmReport , bMaskByte2, 0xd7);
+		}
+		else
+		{
+			PHY_SetBBReg(pAdapter, rCCK0_CCA, bMaskByte2, 0xcd);
+			//PHY_SetBBReg(pAdapter,rCCK0_System, bMaskByte1, 0x47);
+			//if(IS_92C_SERIAL(pHalData->VersionID))
+				//PHY_SetBBReg(pAdapter, rCCK0_FalseAlarmReport , bMaskByte2, 0xd3);
+		}
+
+		pDigTable->PreCCKPDState = pDigTable->CurCCKPDState;
+	}
+	
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("CCKPDStage=%x\n",pDigTable->CurCCKPDState));
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("is92C=%x\n",IS_92C_SERIAL(pHalData->VersionID)));
+	
+}
+
+
+static	void
+dm_CtrlInitGainByTwoPort(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &(pAdapter->mlmepriv);
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE)
+	{
+#ifdef CONFIG_IOCTL_CFG80211
+		if((wdev_to_priv(pAdapter->rtw_wdev))->p2p_enabled == _TRUE)
+		{
+		}
+		else
+#endif
+			return;
+	}
+
+	// Decide the current status and if modify initial gain or not
+	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE)
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_BEFORE_CONNECT;
+	}
+	else if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) 
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_CONNECT;
+	}	
+	else
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_DISCONNECT;
+	}
+	
+
+	pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_DISCONNECT;
+	if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		if((is_IBSS_empty(pAdapter)==_FAIL) && (pAdapter->stapriv.asoc_sta_count > 2))
+			pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_CONNECT;
+	}
+	
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		if(pAdapter->stapriv.asoc_sta_count > 2)
+			pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_CONNECT;					
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(check_buddy_fwstate(pAdapter, WIFI_AP_STATE) == _TRUE)
+	{
+		PADAPTER pbuddy_adapter = pAdapter->pbuddy_adapter;
+		
+		if(pbuddy_adapter->stapriv.asoc_sta_count > 2)
+		{
+			pDigTable->CurSTAConnectState = DIG_STA_CONNECT;
+			pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_CONNECT;	
+		}	
+	}	
+	else if(check_buddy_fwstate(pAdapter, WIFI_STATION_STATE) == _TRUE	&& 
+		check_buddy_fwstate(pAdapter, _FW_LINKED) == _TRUE)
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_CONNECT;
+
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+
+	dm_initial_gain_STA(pAdapter);
+	dm_initial_gain_Multi_STA(pAdapter);
+	//Baron temp DIG solution for DMP
+	//dm_CtrlInitGainByFA(pAdapter);
+
+	dm_CCK_PacketDetectionThresh(pAdapter);
+
+	pDigTable->PreSTAConnectState = pDigTable->CurSTAConnectState;
+	
+}
+
+
+static void dm_DIG(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	//Read 0x0c50; Initial gain
+	pDigTable->PreIGValue = (u8)PHY_QueryBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0);
+
+	//RTPRINT(FDM, DM_Monitor, ("dm_DIG() ==>\n"));
+	
+	if(pdmpriv->bDMInitialGainEnable == _FALSE)
+		return;
+	
+	//if(pDigTable->Dig_Enable_Flag == _FALSE)
+	//	return;
+	
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_DIG))
+		return;
+	
+	//RTPRINT(FDM, DM_Monitor, ("dm_DIG() progress \n"));
+
+	dm_CtrlInitGainByTwoPort(pAdapter);
+	
+	//RTPRINT(FDM, DM_Monitor, ("dm_DIG() <==\n"));
+}
+
+static void dm_SavePowerIndex(IN	PADAPTER	Adapter)
+{
+	u8			index;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u32			Power_Index_REG[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+	
+	for(index = 0; index< 6; index++)
+		pdmpriv->PowerIndex_backup[index] = rtw_read8(Adapter, Power_Index_REG[index]);
+}
+
+static void dm_RestorePowerIndex(IN	PADAPTER	Adapter)
+{
+	u8			index;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u32			Power_Index_REG[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+	
+	for(index = 0; index< 6; index++)
+		rtw_write8(Adapter, Power_Index_REG[index], pdmpriv->PowerIndex_backup[index]);
+}
+
+static void dm_WritePowerIndex(
+		IN	PADAPTER	Adapter, 
+		IN 	u8		Value)
+{
+	u8			index;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32			Power_Index_REG[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+	
+	for(index = 0; index< 6; index++)
+		rtw_write8(Adapter, Power_Index_REG[index], Value);
+}
+
+static void dm_InitDynamicTxPower(IN	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+#ifdef CONFIG_USB_HCI
+#ifdef CONFIG_INTEL_PROXIM
+	if((pHalData->BoardType == BOARD_USB_High_PA)||(Adapter->proximity.proxim_support==_TRUE))
+#else
+	if(pHalData->BoardType == BOARD_USB_High_PA)
+#endif
+	{
+		dm_SavePowerIndex(Adapter);
+		pdmpriv->bDynamicTxPowerEnable = _TRUE;
+	}		
+	else	
+#else
+		pdmpriv->bDynamicTxPowerEnable = _FALSE;
+#endif
+
+	pdmpriv->LastDTPLvl = TxHighPwrLevel_Normal;
+	pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+}
+
+
+static void dm_DynamicTxPower(IN	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+	int	UndecoratedSmoothedPWDB;
+
+	if(!pdmpriv->bDynamicTxPowerEnable)
+		return;
+
+	// If dynamic high power is disabled.
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_HP) )
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+		return;
+	}
+
+	// STA not connected and AP not connected
+	if((check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE) &&	
+		(pdmpriv->EntryMinUndecoratedSmoothedPWDB == 0))
+	{
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("Not connected to any \n"));
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+
+		//the LastDTPlvl should reset when disconnect, 
+		//otherwise the tx power level wouldn't change when disconnect and connect again.
+		// Maddest 20091220.
+		pdmpriv->LastDTPLvl=TxHighPwrLevel_Normal;
+		return;
+	}
+#ifdef CONFIG_INTEL_PROXIM
+	if(Adapter->proximity.proxim_on== _TRUE){
+		struct proximity_priv *prox_priv=Adapter->proximity.proximity_priv;
+	// Intel set fixed tx power 
+	printk("\n %s  Adapter->proximity.proxim_on=%d prox_priv->proxim_modeinfo->power_output=%d \n",__FUNCTION__,Adapter->proximity.proxim_on,prox_priv->proxim_modeinfo->power_output);
+	if(prox_priv!=NULL){
+	if(prox_priv->proxim_modeinfo->power_output> 0)
+	
+	{
+		switch(prox_priv->proxim_modeinfo->power_output){
+			case 1:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_100;
+				printk("TxHighPwrLevel_100\n");
+				break;
+			case 2:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_70;
+				printk("TxHighPwrLevel_70\n");
+				break;
+			case 3:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_50;
+				printk("TxHighPwrLevel_50\n");
+				break;
+			case 4:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_35;
+				printk("TxHighPwrLevel_35\n");
+				break;
+			case 5:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_15;
+				printk("TxHighPwrLevel_15\n");
+				break;
+			default:
+				pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_100;
+				printk("TxHighPwrLevel_100\n");
+				break;
+		}		
+	}
+	}
+	}
+	else
+#endif		
+{
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	// Default port
+	{
+		//todo: AP Mode
+		if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		       (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))
+		{
+			UndecoratedSmoothedPWDB = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("AP Client PWDB = 0x%x \n", UndecoratedSmoothedPWDB));
+		}
+		else
+		{
+			UndecoratedSmoothedPWDB = pdmpriv->UndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("STA Default Port PWDB = 0x%x \n", UndecoratedSmoothedPWDB));
+		}
+	}
+	else // associated entry pwdb
+	{	
+		UndecoratedSmoothedPWDB = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("AP Ext Port PWDB = 0x%x \n", UndecoratedSmoothedPWDB));
+	}
+		
+	if(UndecoratedSmoothedPWDB >= TX_POWER_NEAR_FIELD_THRESH_LVL2)
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Level2;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("TxHighPwrLevel_Level1 (TxPwr=0x0)\n"));
+	}
+	else if((UndecoratedSmoothedPWDB < (TX_POWER_NEAR_FIELD_THRESH_LVL2-3)) &&
+		(UndecoratedSmoothedPWDB >= TX_POWER_NEAR_FIELD_THRESH_LVL1) )
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Level1;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("TxHighPwrLevel_Level1 (TxPwr=0x10)\n"));
+	}
+	else if(UndecoratedSmoothedPWDB < (TX_POWER_NEAR_FIELD_THRESH_LVL1-5))
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("TxHighPwrLevel_Normal\n"));
+	}
+}
+	if( (pdmpriv->DynamicTxHighPowerLvl != pdmpriv->LastDTPLvl) )
+	{
+		PHY_SetTxPowerLevel8192C(Adapter, pHalData->CurrentChannel);
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Normal) // HP1 -> Normal  or HP2 -> Normal
+			dm_RestorePowerIndex(Adapter);
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level1)
+			dm_WritePowerIndex(Adapter, 0x14);
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level2)
+			dm_WritePowerIndex(Adapter, 0x10);
+	}
+	pdmpriv->LastDTPLvl = pdmpriv->DynamicTxHighPowerLvl;
+	
+}
+
+
+static VOID
+DM_ChangeDynamicInitGainThresh(
+	IN	PADAPTER	pAdapter,
+	IN	u32		DM_Type,
+	IN	u32		DM_Value)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	if (DM_Type == DIG_TYPE_THRESH_HIGH)
+	{
+		pDigTable->RssiHighThresh = DM_Value;		
+	}
+	else if (DM_Type == DIG_TYPE_THRESH_LOW)
+	{
+		pDigTable->RssiLowThresh = DM_Value;
+	}
+	else if (DM_Type == DIG_TYPE_ENABLE)
+	{
+		pDigTable->Dig_Enable_Flag = _TRUE;
+	}	
+	else if (DM_Type == DIG_TYPE_DISABLE)
+	{
+		pDigTable->Dig_Enable_Flag = _FALSE;
+	}	
+	else if (DM_Type == DIG_TYPE_BACKOFF)
+	{
+		if(DM_Value > 30)
+			DM_Value = 30;
+		pDigTable->BackoffVal = (u8)DM_Value;
+	}
+	else if(DM_Type == DIG_TYPE_RX_GAIN_MIN)
+	{
+		if(DM_Value == 0)
+			DM_Value = 0x1;
+		pDigTable->rx_gain_range_min = (u8)DM_Value;
+	}
+	else if(DM_Type == DIG_TYPE_RX_GAIN_MAX)
+	{
+		if(DM_Value > 0x50)
+			DM_Value = 0x50;
+		pDigTable->rx_gain_range_max = (u8)DM_Value;
+	}
+}	/* DM_ChangeDynamicInitGainThresh */
+
+
+static VOID PWDB_Monitor(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	int	i;
+	int	tmpEntryMaxPWDB=0, tmpEntryMinPWDB=0xff;
+	u8 	sta_cnt=0;
+	u32 PWDB_rssi[NUM_STA]={0};//[0~15]:MACID, [16~31]:PWDB_rssi
+
+	if(check_fwstate(&Adapter->mlmepriv, _FW_LINKED) != _TRUE)
+		return;
+
+
+	if(check_fwstate(&Adapter->mlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		_irqL irqL;
+		_list	*plist, *phead;
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &Adapter->stapriv;
+		u8 bcast_addr[ETH_ALEN]= {0xff,0xff,0xff,0xff,0xff,0xff};
+	
+		_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+		for(i=0; i< NUM_STA; i++)
+		{
+			phead = &(pstapriv->sta_hash[i]);
+			plist = get_next(phead);
+		
+			while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+			{
+				psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+				plist = get_next(plist);
+
+				if(_rtw_memcmp(psta	->hwaddr, bcast_addr, ETH_ALEN) || 
+					_rtw_memcmp(psta->hwaddr, myid(&Adapter->eeprompriv), ETH_ALEN))
+					continue;
+
+				if(psta->state & WIFI_ASOC_STATE)
+				{
+					
+					if(psta->rssi_stat.UndecoratedSmoothedPWDB < tmpEntryMinPWDB)
+						tmpEntryMinPWDB = psta->rssi_stat.UndecoratedSmoothedPWDB;
+
+					if(psta->rssi_stat.UndecoratedSmoothedPWDB > tmpEntryMaxPWDB)
+						tmpEntryMaxPWDB = psta->rssi_stat.UndecoratedSmoothedPWDB;
+
+					PWDB_rssi[sta_cnt++] = (psta->mac_id | (psta->rssi_stat.UndecoratedSmoothedPWDB<<16));
+				}
+			
+			}
+
+		}
+	
+		_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+
+		
+		if(pHalData->fw_ractrl == _TRUE)
+		{
+			// Report every sta's RSSI to FW
+			for(i=0; i< sta_cnt; i++)
+			{
+				rtl8192c_set_rssi_cmd(Adapter, (u8*)&PWDB_rssi[i]);
+			}
+		}
+
+	}
+
+
+
+	if(tmpEntryMaxPWDB != 0)	// If associated entry is found
+	{
+		pdmpriv->EntryMaxUndecoratedSmoothedPWDB = tmpEntryMaxPWDB;		
+	}
+	else
+	{
+		pdmpriv->EntryMaxUndecoratedSmoothedPWDB = 0;
+	}
+	
+	if(tmpEntryMinPWDB != 0xff) // If associated entry is found
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = tmpEntryMinPWDB;		
+	}
+	else
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = 0;
+	}
+
+
+	if(check_fwstate(&Adapter->mlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+	
+		if(pHalData->fw_ractrl == _TRUE)
+		{
+			u32 param = (u32)(pdmpriv->UndecoratedSmoothedPWDB<<16);
+		
+			param |= 0;//macid=0 for sta mode;
+			
+			rtl8192c_set_rssi_cmd(Adapter, (u8*)&param);
+		}
+	}
+
+}
+
+
+static void
+DM_InitEdcaTurbo(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	pHalData->bCurrentTurboEDCA = _FALSE;
+	Adapter->recvpriv.bIsAnyNonBEPkts = _FALSE;
+
+}
+
+
+static void
+dm_CheckEdcaTurbo(
+	IN	PADAPTER	Adapter
+	)
+{
+	u32 	trafficIndex;
+	u32	edca_param;
+	u64	cur_tx_bytes = 0;
+	u64	cur_rx_bytes = 0;
+	u8	bbtchange = _FALSE;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct xmit_priv		*pxmitpriv = &(Adapter->xmitpriv);
+	struct recv_priv		*precvpriv = &(Adapter->recvpriv);
+	struct registry_priv	*pregpriv = &Adapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &(Adapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);	
+#endif
+
+
+	if ((pregpriv->wifi_spec == 1) || (pmlmeinfo->HT_enable == 0))
+	{
+		goto dm_CheckEdcaTurbo_EXIT;
+	}
+
+	if (pmlmeinfo->assoc_AP_vendor >= maxAP)
+	{
+		goto dm_CheckEdcaTurbo_EXIT;
+	}
+
+#ifdef CONFIG_BT_COEXIST
+	if(pbtpriv->BT_Coexist)
+	{
+		if( (pbtpriv->BT_EDCA[UP_LINK]!=0) ||  (pbtpriv->BT_EDCA[DOWN_LINK]!=0))
+		{
+			bbtchange = _TRUE;		
+		}
+	}
+#endif
+
+	// Check if the status needs to be changed.
+	if((bbtchange) || (!precvpriv->bIsAnyNonBEPkts) )
+	{
+		cur_tx_bytes = pxmitpriv->tx_bytes - pxmitpriv->last_tx_bytes;
+		cur_rx_bytes = precvpriv->rx_bytes - precvpriv->last_rx_bytes;
+
+		//traffic, TX or RX
+		if((pmlmeinfo->assoc_AP_vendor == ralinkAP)||(pmlmeinfo->assoc_AP_vendor == atherosAP))
+		{
+			if (cur_tx_bytes > (cur_rx_bytes << 2))
+			{ // Uplink TP is present.
+				trafficIndex = UP_LINK; 
+			}
+			else
+			{ // Balance TP is present.
+				trafficIndex = DOWN_LINK;
+			}
+		}
+		else
+		{
+			if (cur_rx_bytes > (cur_tx_bytes << 2))
+			{ // Downlink TP is present.
+				trafficIndex = DOWN_LINK;
+			}
+			else
+			{ // Balance TP is present.
+				trafficIndex = UP_LINK;
+			}
+		}
+
+		if ((pdmpriv->prv_traffic_idx != trafficIndex) || (!pHalData->bCurrentTurboEDCA))
+		{
+#ifdef CONFIG_BT_COEXIST
+			if(_TRUE == bbtchange)
+			{
+				edca_param = pbtpriv->BT_EDCA[trafficIndex];
+			}
+			else
+#endif
+			{
+#if 0
+				//adjust EDCA parameter for BE queue
+				edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+#else
+
+				if((pmlmeinfo->assoc_AP_vendor == ciscoAP) && (pmlmeext->cur_wireless_mode & WIRELESS_11_24N))
+				{
+					edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+				}
+				else
+				{
+					edca_param = EDCAParam[unknownAP][trafficIndex];
+				}
+#endif
+			}
+
+#ifdef CONFIG_PCI_HCI
+			if(IS_92C_SERIAL(pHalData->VersionID))
+			{
+				edca_param = 0x60a42b;
+			}
+			else
+			{
+				edca_param = 0x6ea42b;
+			}
+#endif
+			rtw_write32(Adapter, REG_EDCA_BE_PARAM, edca_param);
+
+			pdmpriv->prv_traffic_idx = trafficIndex;
+		}
+		
+		pHalData->bCurrentTurboEDCA = _TRUE;
+	}
+	else
+	{
+		//
+		// Turn Off EDCA turbo here.
+		// Restore original EDCA according to the declaration of AP.
+		//
+		 if(pHalData->bCurrentTurboEDCA)
+		{
+			rtw_write32(Adapter, REG_EDCA_BE_PARAM, pHalData->AcParam_BE);
+			pHalData->bCurrentTurboEDCA = _FALSE;
+		}
+	}
+
+dm_CheckEdcaTurbo_EXIT:
+	// Set variables for next time.
+	precvpriv->bIsAnyNonBEPkts = _FALSE;
+	pxmitpriv->last_tx_bytes = pxmitpriv->tx_bytes;
+	precvpriv->last_rx_bytes = precvpriv->rx_bytes;
+
+}
+
+#define DPK_DELTA_MAPPING_NUM	13
+#define index_mapping_HP_NUM		15
+
+static	VOID
+dm_TXPowerTrackingCallback_ThermalMeter_92C(
+            IN PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8			ThermalValue = 0, delta, delta_LCK, delta_IQK, delta_HP, TimeOut = 100;
+	int 			ele_A, ele_D, TempCCk, X, value32;
+	int			Y, ele_C;
+	s8			OFDM_index[2], CCK_index = 0, OFDM_index_old[2], CCK_index_old = 0;
+	int			i = 0;
+	BOOLEAN		is2T = IS_92C_SERIAL(pHalData->VersionID);
+
+#if MP_DRIVER == 1
+	PMPT_CONTEXT	pMptCtx = &(Adapter->mppriv.MptCtx);	
+	u8			*TxPwrLevel = pMptCtx->TxPwrLevel;
+#endif
+	u8			OFDM_min_index = 6, rf; //OFDM BB Swing should be less than +3.0dB, which is required by Arthur
+#if 0
+	u32			DPK_delta_mapping[2][DPK_DELTA_MAPPING_NUM] = {
+					{0x1c, 0x1c, 0x1d, 0x1d, 0x1e, 
+					 0x1f, 0x00, 0x00, 0x01, 0x01,
+					 0x02, 0x02, 0x03},
+					{0x1c, 0x1d, 0x1e, 0x1e, 0x1e,
+					 0x1f, 0x00, 0x00, 0x01, 0x02,
+					 0x02, 0x03, 0x03}};
+#endif
+#ifdef CONFIG_USB_HCI
+	u8			ThermalValue_HP_count = 0;
+	u32			ThermalValue_HP = 0;
+	s32			index_mapping_HP[index_mapping_HP_NUM] = {
+					0,	1,	3,	4,	6,	
+					7,	9,	10,	12,	13,	
+					15,	16,	18,	19,	21
+					};
+
+	s8			index_HP;
+#endif
+
+	pdmpriv->TXPowerTrackingCallbackCnt++;	//cosa add for debug
+	pdmpriv->bTXPowerTrackingInit = _TRUE;
+
+	if(pHalData->CurrentChannel == 14 && !pdmpriv->bCCKinCH14)
+		pdmpriv->bCCKinCH14 = _TRUE;
+	else if(pHalData->CurrentChannel != 14 && pdmpriv->bCCKinCH14)
+		pdmpriv->bCCKinCH14 = _FALSE;
+
+	//DBG_8192C("===>dm_TXPowerTrackingCallback_ThermalMeter_92C\n");
+
+	ThermalValue = (u8)PHY_QueryRFReg(Adapter, RF_PATH_A, RF_T_METER, 0x1f);	// 0x24: RF Reg[4:0]	
+
+	//DBG_8192C("\n\nReadback Thermal Meter = 0x%x pre thermal meter 0x%x EEPROMthermalmeter 0x%x\n",ThermalValue,pdmpriv->ThermalValue,  pHalData->EEPROMThermalMeter);
+
+	rtl8192c_PHY_APCalibrate(Adapter, (ThermalValue - pHalData->EEPROMThermalMeter));
+
+	if(is2T)
+		rf = 2;
+	else
+		rf = 1;
+	
+	if(ThermalValue)
+	{
+//		if(!pHalData->ThermalValue)
+		{
+			//Query OFDM path A default setting 		
+			ele_D = PHY_QueryBBReg(Adapter, rOFDM0_XATxIQImbalance, bMaskDWord)&bMaskOFDM_D;
+			for(i=0; i<OFDM_TABLE_SIZE_92C; i++)	//find the index
+			{
+				if(ele_D == (OFDMSwingTable[i]&bMaskOFDM_D))
+				{
+					OFDM_index_old[0] = (u8)i;
+					//DBG_8192C("Initial pathA ele_D reg0x%x = 0x%x, OFDM_index=0x%x\n", rOFDM0_XATxIQImbalance, ele_D, OFDM_index_old[0]);
+					break;
+				}
+			}
+
+			//Query OFDM path B default setting 
+			if(is2T)
+			{
+				ele_D = PHY_QueryBBReg(Adapter, rOFDM0_XBTxIQImbalance, bMaskDWord)&bMaskOFDM_D;
+				for(i=0; i<OFDM_TABLE_SIZE_92C; i++)	//find the index
+				{
+					if(ele_D == (OFDMSwingTable[i]&bMaskOFDM_D))
+					{
+						OFDM_index_old[1] = (u8)i;
+						//DBG_8192C("Initial pathB ele_D reg0x%x = 0x%x, OFDM_index=0x%x\n",rOFDM0_XBTxIQImbalance, ele_D, OFDM_index_old[1]);
+						break;
+					}
+				}
+			}
+
+			//Query CCK default setting From 0xa24
+			TempCCk = PHY_QueryBBReg(Adapter, rCCK0_TxFilter2, bMaskDWord)&bMaskCCK;
+			for(i=0 ; i<CCK_TABLE_SIZE ; i++)
+			{
+				if(pdmpriv->bCCKinCH14)
+				{
+					if(_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch14[i][2], 4)==_TRUE)
+					{
+						CCK_index_old =(u8)i;
+						//DBG_8192C("Initial reg0x%x = 0x%x, CCK_index=0x%x, ch 14 %d\n", rCCK0_TxFilter2, TempCCk, CCK_index_old, pdmpriv->bCCKinCH14);
+						break;
+					}
+				}
+				else
+				{
+					if(_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch1_Ch13[i][2], 4)==_TRUE)
+					{
+						CCK_index_old =(u8)i;
+						//DBG_8192C("Initial reg0x%x = 0x%x, CCK_index=0x%x, ch14 %d\n", rCCK0_TxFilter2, TempCCk, CCK_index_old, pdmpriv->bCCKinCH14);
+						break;
+					}			
+				}
+			}	
+
+			if(!pdmpriv->ThermalValue)
+			{
+				pdmpriv->ThermalValue = pHalData->EEPROMThermalMeter;
+				pdmpriv->ThermalValue_LCK = ThermalValue;
+				pdmpriv->ThermalValue_IQK = ThermalValue;
+				pdmpriv->ThermalValue_DPK = pHalData->EEPROMThermalMeter;
+
+#ifdef CONFIG_USB_HCI
+				for(i = 0; i < rf; i++)
+					pdmpriv->OFDM_index_HP[i] = pdmpriv->OFDM_index[i] = OFDM_index_old[i];
+				pdmpriv->CCK_index_HP = pdmpriv->CCK_index = CCK_index_old;
+#else
+				for(i = 0; i < rf; i++)
+					pdmpriv->OFDM_index[i] = OFDM_index_old[i];
+				pdmpriv->CCK_index = CCK_index_old;
+#endif
+			}
+
+#ifdef CONFIG_USB_HCI
+			if(pHalData->BoardType == BOARD_USB_High_PA)
+			{
+				pdmpriv->ThermalValue_HP[pdmpriv->ThermalValue_HP_index] = ThermalValue;
+				pdmpriv->ThermalValue_HP_index++;
+				if(pdmpriv->ThermalValue_HP_index == HP_THERMAL_NUM)
+					pdmpriv->ThermalValue_HP_index = 0;
+
+				for(i = 0; i < HP_THERMAL_NUM; i++)
+				{
+					if(pdmpriv->ThermalValue_HP[i])
+					{
+						ThermalValue_HP += pdmpriv->ThermalValue_HP[i];
+						ThermalValue_HP_count++;
+					}			
+				}
+		
+				if(ThermalValue_HP_count)
+					ThermalValue = (u8)(ThermalValue_HP / ThermalValue_HP_count);
+			}
+#endif
+		}
+
+		delta = (ThermalValue > pdmpriv->ThermalValue)?(ThermalValue - pdmpriv->ThermalValue):(pdmpriv->ThermalValue - ThermalValue);
+#ifdef CONFIG_USB_HCI
+		if(pHalData->BoardType == BOARD_USB_High_PA)
+		{
+			if(pdmpriv->bDoneTxpower)
+				delta_HP = (ThermalValue > pdmpriv->ThermalValue)?(ThermalValue - pdmpriv->ThermalValue):(pdmpriv->ThermalValue - ThermalValue);
+			else
+				delta_HP = ThermalValue > pHalData->EEPROMThermalMeter?(ThermalValue - pHalData->EEPROMThermalMeter):(pHalData->EEPROMThermalMeter - ThermalValue);						
+		}
+		else
+#endif	
+		{
+			delta_HP = 0;			
+		}
+		delta_LCK = (ThermalValue > pdmpriv->ThermalValue_LCK)?(ThermalValue - pdmpriv->ThermalValue_LCK):(pdmpriv->ThermalValue_LCK - ThermalValue);
+		delta_IQK = (ThermalValue > pdmpriv->ThermalValue_IQK)?(ThermalValue - pdmpriv->ThermalValue_IQK):(pdmpriv->ThermalValue_IQK - ThermalValue);
+
+		//DBG_8192C("Readback Thermal Meter = 0x%lx pre thermal meter 0x%lx EEPROMthermalmeter 0x%lx delta 0x%lx delta_LCK 0x%lx delta_IQK 0x%lx\n", ThermalValue, pHalData->ThermalValue, pHalData->EEPROMThermalMeter, delta, delta_LCK, delta_IQK);
+
+		if(delta_LCK > 1)
+		{
+			pdmpriv->ThermalValue_LCK = ThermalValue;
+			rtl8192c_PHY_LCCalibrate(Adapter);
+		}
+		
+		if((delta > 0 || delta_HP > 0) && pdmpriv->TxPowerTrackControl)
+		{
+#ifdef CONFIG_USB_HCI
+			if(pHalData->BoardType == BOARD_USB_High_PA)
+			{
+				pdmpriv->bDoneTxpower = _TRUE;
+				delta_HP = ThermalValue > pHalData->EEPROMThermalMeter?(ThermalValue - pHalData->EEPROMThermalMeter):(pHalData->EEPROMThermalMeter - ThermalValue);						
+				
+				if(delta_HP > index_mapping_HP_NUM-1)					
+					index_HP = index_mapping_HP[index_mapping_HP_NUM-1];
+				else
+					index_HP = index_mapping_HP[delta_HP];
+				
+				if(ThermalValue > pHalData->EEPROMThermalMeter)	//set larger Tx power
+				{
+					for(i = 0; i < rf; i++)
+					 	OFDM_index[i] = pdmpriv->OFDM_index_HP[i] - index_HP;
+					CCK_index = pdmpriv->CCK_index_HP -index_HP;						
+				}
+				else
+				{
+					for(i = 0; i < rf; i++)
+						OFDM_index[i] = pdmpriv->OFDM_index_HP[i] + index_HP;
+					CCK_index = pdmpriv->CCK_index_HP + index_HP;						
+				}	
+				
+				delta_HP = (ThermalValue > pdmpriv->ThermalValue)?(ThermalValue - pdmpriv->ThermalValue):(pdmpriv->ThermalValue - ThermalValue);
+				
+			}
+			else
+#endif
+			{
+				if(ThermalValue > pdmpriv->ThermalValue)
+				{ 
+					for(i = 0; i < rf; i++)
+					 	pdmpriv->OFDM_index[i] -= delta;
+					pdmpriv->CCK_index -= delta;
+				}
+				else
+				{
+					for(i = 0; i < rf; i++)			
+						pdmpriv->OFDM_index[i] += delta;
+					pdmpriv->CCK_index += delta;
+				}
+			}
+
+			/*if(is2T)
+			{
+				DBG_8192C("temp OFDM_A_index=0x%x, OFDM_B_index=0x%x, CCK_index=0x%x\n", 
+					pdmpriv->OFDM_index[0], pdmpriv->OFDM_index[1], pdmpriv->CCK_index);
+			}
+			else
+			{
+				DBG_8192C("temp OFDM_A_index=0x%x, CCK_index=0x%x\n",
+					pdmpriv->OFDM_index[0], pdmpriv->CCK_index);
+			}*/
+
+			//no adjust
+#ifdef CONFIG_USB_HCI
+			if(pHalData->BoardType != BOARD_USB_High_PA)
+#endif
+			{
+				if(ThermalValue > pHalData->EEPROMThermalMeter)
+				{
+					for(i = 0; i < rf; i++)			
+						OFDM_index[i] = pdmpriv->OFDM_index[i]+1;
+					CCK_index = pdmpriv->CCK_index+1;			
+				}
+				else
+				{
+					for(i = 0; i < rf; i++)			
+						OFDM_index[i] = pdmpriv->OFDM_index[i];
+					CCK_index = pdmpriv->CCK_index;						
+				}
+
+#if MP_DRIVER == 1
+				for(i = 0; i < rf; i++)
+				{
+					if(TxPwrLevel[i] >=0 && TxPwrLevel[i] <=26)
+					{
+						if(ThermalValue > pHalData->EEPROMThermalMeter)
+						{
+							if (delta < 5)
+								OFDM_index[i] -= 1;					
+							else 
+								OFDM_index[i] -= 2;					
+						}
+						else if(delta > 5 && ThermalValue < pHalData->EEPROMThermalMeter)
+						{
+							OFDM_index[i] += 1;
+						}
+					}
+					else if (TxPwrLevel[i] >= 27 && TxPwrLevel[i] <= 32 && ThermalValue > pHalData->EEPROMThermalMeter)
+					{
+						if (delta < 5)
+							OFDM_index[i] -= 1;					
+						else 
+							OFDM_index[i] -= 2;								
+					}
+					else if (TxPwrLevel[i] >= 32 && TxPwrLevel[i] <= 38 && ThermalValue > pHalData->EEPROMThermalMeter && delta > 5)
+					{
+						OFDM_index[i] -= 1;								
+					}
+				}
+
+				{
+					if(TxPwrLevel[i] >=0 && TxPwrLevel[i] <=26)
+					{
+						if(ThermalValue > pHalData->EEPROMThermalMeter)
+						{
+							if (delta < 5)
+								CCK_index -= 1; 				
+							else 
+								CCK_index -= 2; 				
+						}
+						else if(delta > 5 && ThermalValue < pHalData->EEPROMThermalMeter)
+						{
+							CCK_index += 1;
+						}
+					}
+					else if (TxPwrLevel[i] >= 27 && TxPwrLevel[i] <= 32 && ThermalValue > pHalData->EEPROMThermalMeter)
+					{
+						if (delta < 5)
+							CCK_index -= 1; 				
+						else 
+							CCK_index -= 2; 							
+					}
+					else if (TxPwrLevel[i] >= 32 && TxPwrLevel[i] <= 38 && ThermalValue > pHalData->EEPROMThermalMeter && delta > 5)
+					{
+						CCK_index -= 1; 							
+					}
+				}
+#endif
+			}
+
+			for(i = 0; i < rf; i++)
+			{
+				if(OFDM_index[i] > (OFDM_TABLE_SIZE_92C-1))
+					OFDM_index[i] = (OFDM_TABLE_SIZE_92C-1);
+				else if (OFDM_index[i] < OFDM_min_index)
+					OFDM_index[i] = OFDM_min_index;
+			}
+						
+			if(CCK_index > (CCK_TABLE_SIZE-1))
+				CCK_index = (CCK_TABLE_SIZE-1);
+			else if (CCK_index < 0)
+				CCK_index = 0;		
+
+			/*if(is2T)
+			{
+				DBG_8192C("new OFDM_A_index=0x%x, OFDM_B_index=0x%x, CCK_index=0x%x\n", 
+					OFDM_index[0], OFDM_index[1], CCK_index);
+			}
+			else
+			{
+				DBG_8192C("new OFDM_A_index=0x%x, CCK_index=0x%x\n", 
+					OFDM_index[0], CCK_index);
+			}*/
+		}
+
+		if(pdmpriv->TxPowerTrackControl && (delta != 0 || delta_HP != 0))
+		{
+			//Adujst OFDM Ant_A according to IQK result
+			ele_D = (OFDMSwingTable[OFDM_index[0]] & 0xFFC00000)>>22;
+			X = pdmpriv->RegE94;
+			Y = pdmpriv->RegE9C;		
+
+			if(X != 0)
+			{
+				if ((X & 0x00000200) != 0)
+					X = X | 0xFFFFFC00;
+				ele_A = ((X * ele_D)>>8)&0x000003FF;
+					
+				//new element C = element D x Y
+				if ((Y & 0x00000200) != 0)
+					Y = Y | 0xFFFFFC00;
+				ele_C = ((Y * ele_D)>>8)&0x000003FF;
+				
+				//wirte new elements A, C, D to regC80 and regC94, element B is always 0
+				value32 = (ele_D<<22)|((ele_C&0x3F)<<16)|ele_A;
+				PHY_SetBBReg(Adapter, rOFDM0_XATxIQImbalance, bMaskDWord, value32);
+				
+				value32 = (ele_C&0x000003C0)>>6;
+				PHY_SetBBReg(Adapter, rOFDM0_XCTxAFE, bMaskH4Bits, value32);
+
+				value32 = ((X * ele_D)>>7)&0x01;
+				PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT31, value32);
+
+				value32 = ((Y * ele_D)>>7)&0x01;
+				PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT29, value32);
+
+			}
+			else
+			{
+				PHY_SetBBReg(Adapter, rOFDM0_XATxIQImbalance, bMaskDWord, OFDMSwingTable[OFDM_index[0]]);				
+				PHY_SetBBReg(Adapter, rOFDM0_XCTxAFE, bMaskH4Bits, 0x00);
+				PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT31|BIT29, 0x00);
+			}
+
+			//RTPRINT(FINIT, INIT_IQK, ("TxPwrTracking path A: X = 0x%x, Y = 0x%x ele_A = 0x%x ele_C = 0x%x ele_D = 0x%x\n", X, Y, ele_A, ele_C, ele_D));		
+
+			//Adjust CCK according to IQK result
+			if(!pdmpriv->bCCKinCH14){
+				rtw_write8(Adapter, 0xa22, CCKSwingTable_Ch1_Ch13[CCK_index][0]);
+				rtw_write8(Adapter, 0xa23, CCKSwingTable_Ch1_Ch13[CCK_index][1]);
+				rtw_write8(Adapter, 0xa24, CCKSwingTable_Ch1_Ch13[CCK_index][2]);
+				rtw_write8(Adapter, 0xa25, CCKSwingTable_Ch1_Ch13[CCK_index][3]);
+				rtw_write8(Adapter, 0xa26, CCKSwingTable_Ch1_Ch13[CCK_index][4]);
+				rtw_write8(Adapter, 0xa27, CCKSwingTable_Ch1_Ch13[CCK_index][5]);
+				rtw_write8(Adapter, 0xa28, CCKSwingTable_Ch1_Ch13[CCK_index][6]);
+				rtw_write8(Adapter, 0xa29, CCKSwingTable_Ch1_Ch13[CCK_index][7]);
+			}
+			else{
+				rtw_write8(Adapter, 0xa22, CCKSwingTable_Ch14[CCK_index][0]);
+				rtw_write8(Adapter, 0xa23, CCKSwingTable_Ch14[CCK_index][1]);
+				rtw_write8(Adapter, 0xa24, CCKSwingTable_Ch14[CCK_index][2]);
+				rtw_write8(Adapter, 0xa25, CCKSwingTable_Ch14[CCK_index][3]);
+				rtw_write8(Adapter, 0xa26, CCKSwingTable_Ch14[CCK_index][4]);
+				rtw_write8(Adapter, 0xa27, CCKSwingTable_Ch14[CCK_index][5]);
+				rtw_write8(Adapter, 0xa28, CCKSwingTable_Ch14[CCK_index][6]);
+				rtw_write8(Adapter, 0xa29, CCKSwingTable_Ch14[CCK_index][7]);	
+			}		
+
+			if(is2T)
+			{						
+				ele_D = (OFDMSwingTable[(u8)OFDM_index[1]] & 0xFFC00000)>>22;
+				
+				//new element A = element D x X
+				X = pdmpriv->RegEB4;
+				Y = pdmpriv->RegEBC;
+				
+				if(X != 0){
+					if ((X & 0x00000200) != 0)	//consider minus
+						X = X | 0xFFFFFC00;
+					ele_A = ((X * ele_D)>>8)&0x000003FF;
+					
+					//new element C = element D x Y
+					if ((Y & 0x00000200) != 0)
+						Y = Y | 0xFFFFFC00;
+					ele_C = ((Y * ele_D)>>8)&0x00003FF;
+					
+					//wirte new elements A, C, D to regC88 and regC9C, element B is always 0
+					value32=(ele_D<<22)|((ele_C&0x3F)<<16) |ele_A;
+					PHY_SetBBReg(Adapter, rOFDM0_XBTxIQImbalance, bMaskDWord, value32);
+
+					value32 = (ele_C&0x000003C0)>>6;
+					PHY_SetBBReg(Adapter, rOFDM0_XDTxAFE, bMaskH4Bits, value32);	
+
+					value32 = ((X * ele_D)>>7)&0x01;
+					PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT27, value32);
+
+					value32 = ((Y * ele_D)>>7)&0x01;
+					PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT25, value32);
+
+				}
+				else{
+					PHY_SetBBReg(Adapter, rOFDM0_XBTxIQImbalance, bMaskDWord, OFDMSwingTable[OFDM_index[1]]);										
+					PHY_SetBBReg(Adapter, rOFDM0_XDTxAFE, bMaskH4Bits, 0x00);
+					PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT27|BIT25, 0x00);
+				}
+
+				//DBG_8192C("TxPwrTracking path B: X = 0x%x, Y = 0x%x ele_A = 0x%x ele_C = 0x%x ele_D = 0x%x\n", X, Y, ele_A, ele_C, ele_D);
+			}
+
+			/*
+			DBG_8192C("TxPwrTracking 0xc80 = 0x%x, 0xc94 = 0x%x RF 0x24 = 0x%x\n", \
+					PHY_QueryBBReg(Adapter, 0xc80, bMaskDWord),\
+					PHY_QueryBBReg(Adapter, 0xc94, bMaskDWord), \
+					PHY_QueryRFReg(Adapter, RF_PATH_A, 0x24, bMaskDWord));
+			*/
+		}
+
+#if MP_DRIVER == 1
+		if(delta_IQK > 1)
+#else
+		if(delta_IQK > 3)
+#endif
+		{
+			pdmpriv->ThermalValue_IQK = ThermalValue;
+			rtl8192c_PHY_IQCalibrate(Adapter,_FALSE);
+		}
+
+		//update thermal meter value
+		if(pdmpriv->TxPowerTrackControl)
+			pdmpriv->ThermalValue = ThermalValue;
+
+	}
+
+	//DBG_8192C("<===dm_TXPowerTrackingCallback_ThermalMeter_92C\n");
+	
+	pdmpriv->TXPowercount = 0;
+
+}
+
+
+static	VOID
+dm_InitializeTXPowerTracking_ThermalMeter(
+	IN	PADAPTER		Adapter)
+{	
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	//pMgntInfo->bTXPowerTracking = _TRUE;
+	pdmpriv->TXPowercount = 0;
+	pdmpriv->bTXPowerTrackingInit = _FALSE;
+	pdmpriv->ThermalValue = 0;
+	
+#if	(MP_DRIVER != 1)	//for mp driver, turn off txpwrtracking as default
+	pdmpriv->TxPowerTrackControl = _TRUE;
+#endif
+	
+	MSG_8192C("pdmpriv->TxPowerTrackControl = %d\n", pdmpriv->TxPowerTrackControl);
+}
+
+
+static VOID
+DM_InitializeTXPowerTracking(
+	IN	PADAPTER		Adapter)
+{
+	dm_InitializeTXPowerTracking_ThermalMeter(Adapter);	
+}	
+
+//
+//	Description:
+//		- Dispatch TxPower Tracking direct call ONLY for 92s.
+//		- We shall NOT schedule Workitem within PASSIVE LEVEL, which will cause system resource
+//		   leakage under some platform.
+//
+//	Assumption:
+//		PASSIVE_LEVEL when this routine is called.
+//
+//	Added by Roger, 2009.06.18.
+//
+static VOID
+DM_TXPowerTracking92CDirectCall(
+            IN	PADAPTER		Adapter)
+{	
+	dm_TXPowerTrackingCallback_ThermalMeter_92C(Adapter);
+}
+
+static VOID
+dm_CheckTXPowerTracking_ThermalMeter(
+	IN	PADAPTER		Adapter)
+{	
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	//u1Byte					TxPowerCheckCnt = 5;	//10 sec
+
+	//if(!pMgntInfo->bTXPowerTracking /*|| (!pdmpriv->TxPowerTrackControl && pdmpriv->bAPKdone)*/)
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_SS))
+	{
+		return;
+	}
+
+	if(!pdmpriv->TM_Trigger)		//at least delay 1 sec
+	{
+		//pHalData->TxPowerCheckCnt++;	//cosa add for debug
+		PHY_SetRFReg(Adapter, RF_PATH_A, RF_T_METER, bRFRegOffsetMask, 0x60);
+		//DBG_8192C("Trigger 92C Thermal Meter!!\n");
+		
+		pdmpriv->TM_Trigger = 1;
+		return;
+		
+	}
+	else
+	{
+		//DBG_8192C("Schedule TxPowerTracking direct call!!\n");
+		DM_TXPowerTracking92CDirectCall(Adapter); //Using direct call is instead, added by Roger, 2009.06.18.
+		pdmpriv->TM_Trigger = 0;
+	}
+
+}
+
+
+VOID
+rtl8192c_dm_CheckTXPowerTracking(
+	IN	PADAPTER		Adapter)
+{
+	dm_CheckTXPowerTracking_ThermalMeter(Adapter);
+}
+
+#ifdef CONFIG_BT_COEXIST
+static BOOLEAN BT_BTStateChange(PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(Adapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	struct registry_priv	*registry_par = &Adapter->registrypriv;
+	
+	struct mlme_priv *pmlmepriv = &(Adapter->mlmepriv);
+	
+	u32 		Polling, Ratio_Tx, Ratio_PRI;
+	u32 			BT_Tx, BT_PRI;
+	u8			BT_State;
+	static u8		ServiceTypeCnt = 0;
+	u8			CurServiceType;
+	static u8		LastServiceType = BT_Idle;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE)	
+		return _FALSE;
+	
+	BT_State = rtw_read8(Adapter, 0x4fd);
+/*
+	temp = PlatformEFIORead4Byte(Adapter, 0x488);
+	BT_Tx = (u2Byte)(((temp<<8)&0xff00)+((temp>>8)&0xff));
+	BT_PRI = (u2Byte)(((temp>>8)&0xff00)+((temp>>24)&0xff));
+
+	temp = PlatformEFIORead4Byte(Adapter, 0x48c);
+	Polling = ((temp<<8)&0xff000000) + ((temp>>8)&0x00ff0000) + 
+			((temp<<8)&0x0000ff00) + ((temp>>8)&0x000000ff);
+	
+*/
+	BT_Tx = rtw_read32(Adapter, 0x488);
+	
+	DBG_8192C("Ratio 0x488  =%x\n", BT_Tx);
+	BT_Tx =BT_Tx & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_Tx  =%x\n", BT_Tx));
+
+	BT_PRI = rtw_read32(Adapter, 0x48c);
+	
+	DBG_8192C("Ratio 0x48c  =%x\n", BT_PRI);
+	BT_PRI =BT_PRI & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_PRI  =%x\n", BT_PRI));
+
+
+	Polling = rtw_read32(Adapter, 0x490);
+	//RTPRINT(FBT, BT_TRACE, ("Ratio 0x490  =%x\n", Polling));
+
+
+	if(BT_Tx==0xffffffff && BT_PRI==0xffffffff && Polling==0xffffffff && BT_State==0xff)
+		return _FALSE;
+
+	BT_State &= BIT0;
+
+	if(BT_State != pbtpriv->BT_CUR_State)
+	{
+		pbtpriv->BT_CUR_State = BT_State;
+	
+		if(registry_par->bt_sco == 3)
+		{
+			ServiceTypeCnt = 0;
+		
+			pbtpriv->BT_Service = BT_Idle;
+
+			DBG_8192C("BT_%s\n", BT_State?"ON":"OFF");
+
+			BT_State = BT_State | 
+					((pbtpriv->BT_Ant_isolation==1)?0:BIT1) |BIT2;
+
+			rtw_write8(Adapter, 0x4fd, BT_State);
+			DBG_8192C("BT set 0x4fd to %x\n", BT_State);
+		}
+		
+		return _TRUE;
+	}
+	DBG_8192C("bRegBT_Sco =  %d\n",registry_par->bt_sco);
+
+	Ratio_Tx = BT_Tx*1000/Polling;
+	Ratio_PRI = BT_PRI*1000/Polling;
+
+	pbtpriv->Ratio_Tx=Ratio_Tx;
+	pbtpriv->Ratio_PRI=Ratio_PRI;
+	
+	DBG_8192C("Ratio_Tx=%d\n", Ratio_Tx);
+	DBG_8192C("Ratio_PRI=%d\n", Ratio_PRI);
+
+	
+	if(BT_State && registry_par->bt_sco==3)
+	{
+		DBG_8192C("bt_sco  ==3 Follow Counter\n");
+//		if(BT_Tx==0xffff && BT_PRI==0xffff && Polling==0xffffffff)
+//		{
+//			ServiceTypeCnt = 0;
+//			return FALSE;
+//		}
+//		else
+		{
+		/*
+			Ratio_Tx = BT_Tx*1000/Polling;
+			Ratio_PRI = BT_PRI*1000/Polling;
+
+			pHalData->bt_coexist.Ratio_Tx=Ratio_Tx;
+			pHalData->bt_coexist.Ratio_PRI=Ratio_PRI;
+			
+			RTPRINT(FBT, BT_TRACE, ("Ratio_Tx=%d\n", Ratio_Tx));
+			RTPRINT(FBT, BT_TRACE, ("Ratio_PRI=%d\n", Ratio_PRI));
+
+		*/	
+			if((Ratio_Tx < 30)  && (Ratio_PRI < 30)) 
+			  	CurServiceType = BT_Idle;
+			else if((Ratio_PRI > 110) && (Ratio_PRI < 250))
+				CurServiceType = BT_SCO;
+			else if((Ratio_Tx >= 200)&&(Ratio_PRI >= 200))
+				CurServiceType = BT_Busy;
+			else if((Ratio_Tx >=350) && (Ratio_Tx < 500))
+				CurServiceType = BT_OtherBusy;
+			else if(Ratio_Tx >=500)
+				CurServiceType = BT_PAN;
+			else
+				CurServiceType=BT_OtherAction;
+		}
+
+/*		if(pHalData->bt_coexist.bStopCount)
+		{
+			ServiceTypeCnt=0;
+			pHalData->bt_coexist.bStopCount=FALSE;
+		}
+*/
+//		if(CurServiceType == BT_OtherBusy)
+		{
+			ServiceTypeCnt=2;
+			LastServiceType=CurServiceType;
+		}
+#if 0
+		else if(CurServiceType == LastServiceType)
+		{
+			if(ServiceTypeCnt<3)
+				ServiceTypeCnt++;
+		}
+		else
+		{
+			ServiceTypeCnt = 0;
+			LastServiceType = CurServiceType;
+		}
+#endif
+
+		if(ServiceTypeCnt==2)
+		{
+			pbtpriv->BT_Service = LastServiceType;
+			BT_State = BT_State | 
+					((pbtpriv->BT_Ant_isolation==1)?0:BIT1) |
+					//((pbtpriv->BT_Service==BT_SCO)?0:BIT2);
+					((pbtpriv->BT_Service!=BT_Idle)?0:BIT2);
+
+			//if(pbtpriv->BT_Service==BT_Busy)
+			//	BT_State&= ~(BIT2);
+
+			if(pbtpriv->BT_Service==BT_SCO)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_SCO\n");
+			}
+			else if(pbtpriv->BT_Service==BT_Idle)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_Idle\n");
+			}
+			else if(pbtpriv->BT_Service==BT_OtherAction)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_OtherAction\n");
+			}
+			else if(pbtpriv->BT_Service==BT_Busy)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_Busy\n");
+			}
+			else if(pbtpriv->BT_Service==BT_PAN)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_PAN\n");
+			}
+			else
+			{
+				DBG_8192C("BT TYPE Set to ==> BT_OtherBusy\n");
+			}
+				
+			//Add interrupt migration when bt is not in idel state (no traffic).
+			//suggestion by Victor.
+			if(pbtpriv->BT_Service!=BT_Idle)//EDCA_VI_PARAM modify
+			{
+			
+				rtw_write16(Adapter, 0x504, 0x0ccc);
+				rtw_write8(Adapter, 0x506, 0x54);
+				rtw_write8(Adapter, 0x507, 0x54);
+			
+			}
+			else
+			{
+				rtw_write8(Adapter, 0x506, 0x00);
+				rtw_write8(Adapter, 0x507, 0x00);			
+			}
+				
+			rtw_write8(Adapter, 0x4fd, BT_State);
+			DBG_8192C("BT_SCO set 0x4fd to %x\n", BT_State);
+			return _TRUE;
+		}
+	}
+
+	return _FALSE;
+
+}
+
+static BOOLEAN
+BT_WifiConnectChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	struct mlme_priv *pmlmepriv = &(Adapter->mlmepriv);
+//	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	static BOOLEAN	bMediaConnect = _FALSE;
+
+	//if(!pMgntInfo->bMediaConnect || MgntRoamingInProgress(pMgntInfo))
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE)	
+	{
+		bMediaConnect = _FALSE;
+	}
+	else
+	{
+		if(!bMediaConnect)
+		{
+			bMediaConnect = _TRUE;
+			return _TRUE;
+		}
+		bMediaConnect = _TRUE;
+	}
+
+	return _FALSE;
+}
+
+#define BT_RSSI_STATE_NORMAL_POWER	BIT0
+#define BT_RSSI_STATE_AMDPU_OFF		BIT1
+#define BT_RSSI_STATE_SPECIAL_LOW	BIT2
+#define BT_RSSI_STATE_BG_EDCA_LOW	BIT3
+
+static s32 GET_UNDECORATED_AVERAGE_RSSI(PADAPTER	Adapter)	
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	s32 	average_rssi;
+	
+	if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
+	{	
+		average_rssi = 	pdmpriv->EntryMinUndecoratedSmoothedPWDB;	
+	}
+	else
+	{
+		average_rssi = 	pdmpriv->UndecoratedSmoothedPWDB;
+	}
+	return average_rssi;
+}
+
+static u8 BT_RssiStateChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv		*pmlmepriv = &(Adapter->mlmepriv);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	//PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	s32			UndecoratedSmoothedPWDB;
+	u8			CurrBtRssiState = 0x00;
+
+
+
+
+	//if(pMgntInfo->bMediaConnect)	// Default port
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	
+	{
+		UndecoratedSmoothedPWDB = GET_UNDECORATED_AVERAGE_RSSI(Adapter);
+	}
+	else // associated entry pwdb
+	{
+		if(pdmpriv->EntryMinUndecoratedSmoothedPWDB == 0)
+			UndecoratedSmoothedPWDB = 100;	// No any RSSI information. Assume to be MAX.
+		else
+			UndecoratedSmoothedPWDB = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+	}
+
+	// Check RSSI to determine HighPower/NormalPower state for BT coexistence.
+	if(UndecoratedSmoothedPWDB >= 67)
+		CurrBtRssiState &= (~BT_RSSI_STATE_NORMAL_POWER);
+	else if(UndecoratedSmoothedPWDB < 62)
+		CurrBtRssiState |= BT_RSSI_STATE_NORMAL_POWER;
+
+	// Check RSSI to determine AMPDU setting for BT coexistence.
+	if(UndecoratedSmoothedPWDB >= 40)
+		CurrBtRssiState &= (~BT_RSSI_STATE_AMDPU_OFF);
+	else if(UndecoratedSmoothedPWDB <= 32)
+		CurrBtRssiState |= BT_RSSI_STATE_AMDPU_OFF;
+
+	// Marked RSSI state. It will be used to determine BT coexistence setting later.
+	if(UndecoratedSmoothedPWDB < 35)
+		CurrBtRssiState |=  BT_RSSI_STATE_SPECIAL_LOW;
+	else
+		CurrBtRssiState &= (~BT_RSSI_STATE_SPECIAL_LOW);
+
+	// Check BT state related to BT_Idle in B/G mode.
+	if(UndecoratedSmoothedPWDB < 15)
+		CurrBtRssiState |=  BT_RSSI_STATE_BG_EDCA_LOW;
+	else
+		CurrBtRssiState &= (~BT_RSSI_STATE_BG_EDCA_LOW);
+	
+	if(CurrBtRssiState != pbtpriv->BtRssiState)
+	{
+		pbtpriv->BtRssiState = CurrBtRssiState;
+		return _TRUE;
+	}
+	else
+	{
+		return _FALSE;
+	}
+}
+
+static void dm_BTCoexist(PADAPTER Adapter )
+{
+	HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv			*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	 		*pmlmepriv = &(Adapter->mlmepriv);
+	struct mlme_ext_info		*pmlmeinfo = &Adapter->mlmeextpriv.mlmext_info;
+	struct mlme_ext_priv		*pmlmeext = &Adapter->mlmeextpriv;
+
+	struct btcoexist_priv		*pbtpriv = &(pHalData->bt_coexist);
+	//PMGNT_INFO				pMgntInfo = &Adapter->MgntInfo;
+	//PRT_HIGH_THROUGHPUT		pHTInfo = GET_HT_INFO(pMgntInfo);
+	
+	//PRX_TS_RECORD	pRxTs = NULL;
+	u8			BT_gpio_mux;
+
+	BOOLEAN		bWifiConnectChange, bBtStateChange,bRssiStateChange;
+
+	if(pbtpriv->bCOBT == _FALSE)		return;
+
+	if(!( pdmpriv->DMFlag & DYNAMIC_FUNC_BT)) return;
+	
+	if( (pbtpriv->BT_Coexist) &&(pbtpriv->BT_CoexistType == BT_CSR_BC4) && (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _FALSE)	)
+	{
+		bWifiConnectChange = BT_WifiConnectChange(Adapter);
+		bBtStateChange	= BT_BTStateChange(Adapter);
+		bRssiStateChange 	= BT_RssiStateChange(Adapter);
+		
+		DBG_8192C("bWifiConnectChange %d, bBtStateChange  %d,bRssiStateChange  %d\n",
+			bWifiConnectChange,bBtStateChange,bRssiStateChange);
+
+		// add by hpfan for debug message
+		BT_gpio_mux = rtw_read8(Adapter, REG_GPIO_MUXCFG);
+		DBG_8192C("BTCoexit Reg_0x40 (%2x)\n", BT_gpio_mux);
+
+		if( bWifiConnectChange ||bBtStateChange  ||bRssiStateChange )
+		{
+			if(pbtpriv->BT_CUR_State)
+			{
+				
+				// Do not allow receiving A-MPDU aggregation.
+				if(pbtpriv->BT_Ampdu)// 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU.
+				{
+			
+					if(pmlmeinfo->assoc_AP_vendor == ciscoAP)	
+					{
+						if(pbtpriv->BT_Service!=BT_Idle)
+						{
+							if(pmlmeinfo->bAcceptAddbaReq)
+							{
+								DBG_8192C("BT_Disallow AMPDU \n");	
+								pmlmeinfo->bAcceptAddbaReq = _FALSE;
+								send_delba(Adapter,0, get_my_bssid(&(pmlmeinfo->network)));
+							}
+						}
+						else
+						{
+							if(!pmlmeinfo->bAcceptAddbaReq)
+							{
+								DBG_8192C("BT_Allow AMPDU  RSSI >=40\n");	
+								pmlmeinfo->bAcceptAddbaReq = _TRUE;
+							}
+						}
+					}
+					else
+					{
+						if(!pmlmeinfo->bAcceptAddbaReq)
+						{
+							DBG_8192C("BT_Allow AMPDU BT Idle\n");	
+							pmlmeinfo->bAcceptAddbaReq = _TRUE;
+						}
+					}
+				}
+				
+#if 0
+				else if((pHalData->bt_coexist.BT_Service==BT_SCO) || (pHalData->bt_coexist.BT_Service==BT_Busy))
+				{				
+					if(pHalData->bt_coexist.BtRssiState & BT_RSSI_STATE_AMDPU_OFF)
+					{
+						if(pMgntInfo->bBT_Ampdu && pHTInfo->bAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Disallow AMPDU RSSI <=32\n"));	
+							pHTInfo->bAcceptAddbaReq = FALSE;
+							if(GetTs(Adapter, (PTS_COMMON_INFO*)(&pRxTs), pMgntInfo->Bssid, 0, RX_DIR, FALSE))
+								TsInitDelBA(Adapter, (PTS_COMMON_INFO)pRxTs, RX_DIR);
+						}
+					}
+					else
+					{
+						if(pMgntInfo->bBT_Ampdu && !pHTInfo->bAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU  RSSI >=40\n"));	
+							pHTInfo->bAcceptAddbaReq = TRUE;
+						}
+					}
+				}
+				else
+				{
+					if(pMgntInfo->bBT_Ampdu && !pHTInfo->bAcceptAddbaReq)
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU BT not in SCO or BUSY\n"));	
+						pHTInfo->bAcceptAddbaReq = TRUE;
+					}
+				}
+#endif
+
+				if(pbtpriv->BT_Ant_isolation)
+				{			
+					DBG_8192C("BT_IsolationLow\n");
+
+// 20100427 Joseph: Do not adjust Rate adaptive for BT coexist suggested by SD3.
+#if 0
+					RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+					if(pMgntInfo->bUseRAMask)
+					{
+						// 20100407 Joseph: Fix rate adaptive modification for BT coexist.
+						// This fix is not complete yet. It shall also consider VWifi and Adhoc case,
+						// which connect with multiple STAs.
+						Adapter->HalFunc.UpdateHalRAMaskHandler(
+												Adapter,
+												FALSE,
+												0,
+												NULL,
+												NULL,
+												pMgntInfo->RateAdaptive.RATRState,
+												RAMask_Normal);
+					}
+					else
+					{
+						Adapter->HalFunc.UpdateHalRATRTableHandler(
+									Adapter, 
+									&pMgntInfo->dot11OperationalRateSet,
+									pMgntInfo->dot11HTOperationalRateSet,NULL);
+					}
+#endif
+
+					// 20100415 Joseph: Modify BT coexist mechanism suggested by Yaying.
+					// Now we only enable HW BT coexist when BT in "Busy" state.
+					if(1)//pMgntInfo->LinkDetectInfo.NumRecvDataInPeriod >= 20)
+					{
+						if((pmlmeinfo->assoc_AP_vendor == ciscoAP)	&&
+							pbtpriv->BT_Service==BT_OtherAction)
+						{
+							DBG_8192C("BT_Turn ON Coexist\n");
+							rtw_write8(Adapter, REG_GPIO_MUXCFG, 0xa0);	
+						}
+						else
+						{
+							if((pbtpriv->BT_Service==BT_Busy) &&
+								(pbtpriv->BtRssiState & BT_RSSI_STATE_NORMAL_POWER))
+							{
+								DBG_8192C("BT_Turn ON Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0xa0);
+							}
+							else if((pbtpriv->BT_Service==BT_OtherAction) &&
+									(pbtpriv->BtRssiState & BT_RSSI_STATE_SPECIAL_LOW))
+							{
+								DBG_8192C("BT_Turn ON Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0xa0);	
+							}
+							else if(pbtpriv->BT_Service==BT_PAN)
+							{
+								DBG_8192C("BT_Turn ON Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);	
+							}
+							else
+							{
+								DBG_8192C("BT_Turn OFF Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+							}
+						}
+					}
+					else
+					{
+						DBG_8192C("BT: There is no Wifi traffic!! Turn off Coexist\n");
+						rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+					}
+
+					if(1)//pMgntInfo->LinkDetectInfo.NumRecvDataInPeriod >= 20)
+					{
+						if(pbtpriv->BT_Service==BT_PAN)
+						{
+							DBG_8192C("BT_Turn ON Coexist(Reg0x44 = 0x10100)\n");
+							rtw_write32(Adapter, REG_GPIO_PIN_CTRL, 0x10100);	
+						}
+						else
+						{
+							DBG_8192C("BT_Turn OFF Coexist(Reg0x44 = 0x0)\n");
+							rtw_write32(Adapter, REG_GPIO_PIN_CTRL, 0x0);	
+						}
+					}
+					else
+					{
+						DBG_8192C("BT: There is no Wifi traffic!! Turn off Coexist(Reg0x44 = 0x0)\n");
+						rtw_write32(Adapter, REG_GPIO_PIN_CTRL, 0x0);	
+					}
+
+					// 20100430 Joseph: Integrate the BT coexistence EDCA tuning here.
+					if(pbtpriv->BtRssiState & BT_RSSI_STATE_NORMAL_POWER)
+					{
+						if(pbtpriv->BT_Service==BT_OtherBusy)
+						{
+							//pbtpriv->BtEdcaUL = 0x5ea72b;
+							//pbtpriv->BtEdcaDL = 0x5ea72b;
+							pbtpriv->BT_EDCA[UP_LINK] = 0x5ea72b;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0x5ea72b;							
+							
+							DBG_8192C("BT in BT_OtherBusy state Tx (%d) >350 parameter(0x%x) = 0x%x\n", pbtpriv->Ratio_Tx ,REG_EDCA_BE_PARAM, 0x5ea72b);
+						}
+						else if(pbtpriv->BT_Service==BT_Busy)
+						{
+							//pbtpriv->BtEdcaUL = 0x5eb82f;
+							//pbtpriv->BtEdcaDL = 0x5eb82f;
+
+							pbtpriv->BT_EDCA[UP_LINK] = 0x5eb82f;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0x5eb82f;							
+							
+							DBG_8192C("BT in BT_Busy state parameter(0x%x) = 0x%x\n", REG_EDCA_BE_PARAM, 0x5eb82f);		
+						}
+						else if(pbtpriv->BT_Service==BT_SCO)
+						{
+							if(pbtpriv->Ratio_Tx>160)
+							{
+								//pbtpriv->BtEdcaUL = 0x5ea72f;
+								//pbtpriv->BtEdcaDL = 0x5ea72f;
+								pbtpriv->BT_EDCA[UP_LINK] = 0x5ea72f;
+								pbtpriv->BT_EDCA[DOWN_LINK] = 0x5ea72f;							
+								DBG_8192C("BT in BT_SCO state Tx (%d) >160 parameter(0x%x) = 0x%x\n",pbtpriv->Ratio_Tx, REG_EDCA_BE_PARAM, 0x5ea72f);
+							}
+							else
+							{
+								//pbtpriv->BtEdcaUL = 0x5ea32b;
+								//pbtpriv->BtEdcaDL = 0x5ea42b;
+
+								pbtpriv->BT_EDCA[UP_LINK] = 0x5ea32b;
+								pbtpriv->BT_EDCA[DOWN_LINK] = 0x5ea42b;						
+								
+								DBG_8192C("BT in BT_SCO state Tx (%d) <160 parameter(0x%x) = 0x%x\n", pbtpriv->Ratio_Tx,REG_EDCA_BE_PARAM, 0x5ea32f);
+							}									
+						}
+						else
+						{
+							// BT coexistence mechanism does not control EDCA parameter.
+							//pbtpriv->BtEdcaUL = 0;
+							//pbtpriv->BtEdcaDL = 0;
+
+							pbtpriv->BT_EDCA[UP_LINK] = 0;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0;							
+							DBG_8192C("BT in  State  %d  and parameter(0x%x) use original setting.\n",pbtpriv->BT_Service, REG_EDCA_BE_PARAM);
+						}
+
+						if((pbtpriv->BT_Service!=BT_Idle) &&
+							(pmlmeext->cur_wireless_mode  == WIRELESS_MODE_G) &&
+							(pbtpriv->BtRssiState & BT_RSSI_STATE_BG_EDCA_LOW))
+						{
+							//pbtpriv->BtEdcaUL = 0x5eb82b;
+							//pbtpriv->BtEdcaDL = 0x5eb82b;
+
+							pbtpriv->BT_EDCA[UP_LINK] = 0x5eb82b;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0x5eb82b;							
+							
+							DBG_8192C("BT set parameter(0x%x) = 0x%x\n", REG_EDCA_BE_PARAM, 0x5eb82b);		
+						}
+					}
+					else
+					{
+						// BT coexistence mechanism does not control EDCA parameter.
+						//pbtpriv->BtEdcaUL = 0;
+						//pbtpriv->BtEdcaDL = 0;
+
+						pbtpriv->BT_EDCA[UP_LINK] = 0;
+						pbtpriv->BT_EDCA[DOWN_LINK] = 0;					
+					}
+
+					// 20100415 Joseph: Set RF register 0x1E and 0x1F for BT coexist suggested by Yaying.
+					if(pbtpriv->BT_Service!=BT_Idle)
+					{
+						DBG_8192C("BT Set RfReg0x1E[7:4] = 0x%x \n", 0xf);
+						PHY_SetRFReg(Adapter, PathA, 0x1e, 0xf0, 0xf);
+						//RTPRINT(FBT, BT_TRACE, ("BT Set RfReg0x1E[7:4] = 0x%x \n", 0xf));
+						//PHY_SetRFReg(Adapter, PathA, 0x1f, 0xf0, 0xf);
+					}
+					else
+					{
+						DBG_8192C("BT Set RfReg0x1E[7:4] = 0x%x \n",pbtpriv->BtRfRegOrigin1E);
+						PHY_SetRFReg(Adapter, PathA, 0x1e, 0xf0, pbtpriv->BtRfRegOrigin1E);
+						//RTPRINT(FBT, BT_TRACE, ("BT Set RfReg0x1F[7:4] = 0x%x \n", pHalData->bt_coexist.BtRfRegOrigin1F));
+						//PHY_SetRFReg(Adapter, PathA, 0x1f, 0xf0, pHalData->bt_coexist.BtRfRegOrigin1F);
+					}	
+				}
+				else
+				{
+					DBG_8192C("BT_IsolationHigh\n");
+					// Do nothing.
+				}			
+			}
+			else
+			{
+			
+				if(pbtpriv->BT_Ampdu && !pmlmeinfo->bAcceptAddbaReq)
+				{
+					DBG_8192C("BT_Allow AMPDU bt is off\n");	
+					pmlmeinfo->bAcceptAddbaReq = _TRUE;
+				}
+			
+				DBG_8192C("BT_Turn OFF Coexist bt is off \n");
+				rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+
+				DBG_8192C("BT Set RfReg0x1E[7:4] = 0x%x \n", pbtpriv->BtRfRegOrigin1E);
+				PHY_SetRFReg(Adapter, PathA, 0x1e, 0xf0, pbtpriv->BtRfRegOrigin1E);
+				//RTPRINT(FBT, BT_TRACE, ("BT Set RfReg0x1F[7:4] = 0x%x \n", pHalData->bt_coexist.BtRfRegOrigin1F));
+				//PHY_SetRFReg(Adapter, PathA, 0x1f, 0xf0, pHalData->bt_coexist.BtRfRegOrigin1F);
+
+				// BT coexistence mechanism does not control EDCA parameter since BT is disabled.
+				//pbtpriv->BtEdcaUL = 0;
+				//pbtpriv->BtEdcaDL = 0;
+				pbtpriv->BT_EDCA[UP_LINK] = 0;
+				pbtpriv->BT_EDCA[DOWN_LINK] = 0;				
+				
+
+// 20100427 Joseph: Do not adjust Rate adaptive for BT coexist suggested by SD3.
+#if 0
+				RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+				if(pMgntInfo->bUseRAMask)
+				{
+					// 20100407 Joseph: Fix rate adaptive modification for BT coexist.
+					// This fix is not complete yet. It shall also consider VWifi and Adhoc case,
+					// which connect with multiple STAs.
+					Adapter->HalFunc.UpdateHalRAMaskHandler(
+											Adapter,
+											FALSE,
+											0,
+											NULL,
+											NULL,
+											pMgntInfo->RateAdaptive.RATRState,
+											RAMask_Normal);
+				}
+				else
+				{
+					Adapter->HalFunc.UpdateHalRATRTableHandler(
+								Adapter, 
+								&pMgntInfo->dot11OperationalRateSet,
+								pMgntInfo->dot11HTOperationalRateSet,NULL);
+				}
+#endif
+			}
+		}
+	}
+}
+
+static void dm_InitBtCoexistDM(	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+
+	if( !pbtpriv->BT_Coexist ) return;
+	
+	pbtpriv->BtRfRegOrigin1E = (u8)PHY_QueryRFReg(Adapter, PathA, 0x1e, 0xf0);
+	pbtpriv->BtRfRegOrigin1F = (u8)PHY_QueryRFReg(Adapter, PathA, 0x1f, 0xf0);
+}
+
+void rtl8192c_set_dm_bt_coexist(_adapter *padapter, u8 bStart)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	
+	pbtpriv->bCOBT = bStart;
+	send_delba(padapter,0, get_my_bssid(&(pmlmeinfo->network)));
+	send_delba(padapter,1, get_my_bssid(&(pmlmeinfo->network)));
+	
+}
+
+void rtl8192c_issue_delete_ba(_adapter *padapter, u8 dir)
+{
+	struct mlme_ext_info		*pmlmeinfo = &padapter->mlmeextpriv.mlmext_info;
+	DBG_8192C("issue_delete_ba : %s...\n",(dir==0)?"RX_DIR":"TX_DIR");
+	send_delba(padapter,dir, get_my_bssid(&(pmlmeinfo->network)));
+}
+
+#endif
+
+#if 0//def CONFIG_PCI_HCI
+
+BOOLEAN
+BT_BTStateChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	
+	u4Byte 			temp, Polling, Ratio_Tx, Ratio_PRI;
+	u4Byte 			BT_Tx, BT_PRI;
+	u1Byte			BT_State;
+	static u1Byte		ServiceTypeCnt = 0;
+	u1Byte			CurServiceType;
+	static u1Byte		LastServiceType = BT_Idle;
+
+	if(!pMgntInfo->bMediaConnect)
+		return FALSE;
+	
+	BT_State = PlatformEFIORead1Byte(Adapter, 0x4fd);
+/*
+	temp = PlatformEFIORead4Byte(Adapter, 0x488);
+	BT_Tx = (u2Byte)(((temp<<8)&0xff00)+((temp>>8)&0xff));
+	BT_PRI = (u2Byte)(((temp>>8)&0xff00)+((temp>>24)&0xff));
+
+	temp = PlatformEFIORead4Byte(Adapter, 0x48c);
+	Polling = ((temp<<8)&0xff000000) + ((temp>>8)&0x00ff0000) + 
+			((temp<<8)&0x0000ff00) + ((temp>>8)&0x000000ff);
+	
+*/
+	BT_Tx = PlatformEFIORead4Byte(Adapter, 0x488);
+	
+	RTPRINT(FBT, BT_TRACE, ("Ratio 0x488  =%x\n", BT_Tx));
+	BT_Tx =BT_Tx & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_Tx  =%x\n", BT_Tx));
+
+	BT_PRI = PlatformEFIORead4Byte(Adapter, 0x48c);
+	
+	RTPRINT(FBT, BT_TRACE, ("Ratio Ratio 0x48c  =%x\n", BT_PRI));
+	BT_PRI =BT_PRI & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_PRI  =%x\n", BT_PRI));
+
+
+	Polling = PlatformEFIORead4Byte(Adapter, 0x490);
+	//RTPRINT(FBT, BT_TRACE, ("Ratio 0x490  =%x\n", Polling));
+
+
+	if(BT_Tx==0xffffffff && BT_PRI==0xffffffff && Polling==0xffffffffff && BT_State==0xff)
+		return FALSE;
+
+	BT_State &= BIT0;
+
+	if(BT_State != pHalData->bt_coexist.BT_CUR_State)
+	{
+		pHalData->bt_coexist.BT_CUR_State = BT_State;
+	
+		if(pMgntInfo->bRegBT_Sco == 3)
+		{
+			ServiceTypeCnt = 0;
+		
+			pHalData->bt_coexist.BT_Service = BT_Idle;
+
+			RTPRINT(FBT, BT_TRACE, ("BT_%s\n", BT_State?"ON":"OFF"));
+
+			BT_State = BT_State | 
+					((pHalData->bt_coexist.BT_Ant_isolation==1)?0:BIT1) |BIT2;
+
+			PlatformEFIOWrite1Byte(Adapter, 0x4fd, BT_State);
+			RTPRINT(FBT, BT_TRACE, ("BT set 0x4fd to %x\n", BT_State));
+		}
+		
+		return TRUE;
+	}
+	RTPRINT(FBT, BT_TRACE, ("bRegBT_Sco   %d\n", pMgntInfo->bRegBT_Sco));
+
+	Ratio_Tx = BT_Tx*1000/Polling;
+	Ratio_PRI = BT_PRI*1000/Polling;
+
+	pHalData->bt_coexist.Ratio_Tx=Ratio_Tx;
+	pHalData->bt_coexist.Ratio_PRI=Ratio_PRI;
+	
+	RTPRINT(FBT, BT_TRACE, ("Ratio_Tx=%d\n", Ratio_Tx));
+	RTPRINT(FBT, BT_TRACE, ("Ratio_PRI=%d\n", Ratio_PRI));
+
+	
+	if(BT_State && pMgntInfo->bRegBT_Sco==3)
+	{
+		RTPRINT(FBT, BT_TRACE, ("bRegBT_Sco  ==3 Follow Counter\n"));
+//		if(BT_Tx==0xffff && BT_PRI==0xffff && Polling==0xffffffff)
+//		{
+//			ServiceTypeCnt = 0;
+//			return FALSE;
+//		}
+//		else
+		{
+		/*
+			Ratio_Tx = BT_Tx*1000/Polling;
+			Ratio_PRI = BT_PRI*1000/Polling;
+
+			pHalData->bt_coexist.Ratio_Tx=Ratio_Tx;
+			pHalData->bt_coexist.Ratio_PRI=Ratio_PRI;
+			
+			RTPRINT(FBT, BT_TRACE, ("Ratio_Tx=%d\n", Ratio_Tx));
+			RTPRINT(FBT, BT_TRACE, ("Ratio_PRI=%d\n", Ratio_PRI));
+
+		*/	
+			if((Ratio_Tx <= 50)  && (Ratio_PRI <= 50)) 
+			  	CurServiceType = BT_Idle;
+			else if((Ratio_PRI > 150) && (Ratio_PRI < 200))
+				CurServiceType = BT_SCO;
+			else if((Ratio_Tx >= 200)&&(Ratio_PRI >= 200))
+				CurServiceType = BT_Busy;
+			else if(Ratio_Tx >= 350)
+				CurServiceType = BT_OtherBusy;
+			else
+				CurServiceType=BT_OtherAction;
+
+		}
+/*		if(pHalData->bt_coexist.bStopCount)
+		{
+			ServiceTypeCnt=0;
+			pHalData->bt_coexist.bStopCount=FALSE;
+		}
+*/
+		if(CurServiceType == BT_OtherBusy)
+		{
+			ServiceTypeCnt=2;
+			LastServiceType=CurServiceType;
+		}
+		else if(CurServiceType == LastServiceType)
+		{
+			if(ServiceTypeCnt<3)
+				ServiceTypeCnt++;
+		}
+		else
+		{
+			ServiceTypeCnt = 0;
+			LastServiceType = CurServiceType;
+		}
+
+		if(ServiceTypeCnt==2)
+		{
+			pHalData->bt_coexist.BT_Service = LastServiceType;
+			BT_State = BT_State | 
+					((pHalData->bt_coexist.BT_Ant_isolation==1)?0:BIT1) |
+					((pHalData->bt_coexist.BT_Service==BT_SCO)?0:BIT2);
+
+			if(pHalData->bt_coexist.BT_Service==BT_Busy)
+				BT_State&= ~(BIT2);
+
+			if(pHalData->bt_coexist.BT_Service==BT_SCO)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_SCO\n"));
+			}
+			else if(pHalData->bt_coexist.BT_Service==BT_Idle)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_Idle\n"));
+			}
+			else if(pHalData->bt_coexist.BT_Service==BT_OtherAction)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_OtherAction\n"));
+			}
+			else if(pHalData->bt_coexist.BT_Service==BT_Busy)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_Busy\n"));
+			}
+			else
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to ==> BT_OtherBusy\n"));
+			}
+				
+			//Add interrupt migration when bt is not in idel state (no traffic).
+			//suggestion by Victor.
+			if(pHalData->bt_coexist.BT_Service!=BT_Idle)
+			{
+			
+				PlatformEFIOWrite2Byte(Adapter, 0x504, 0x0ccc);
+				PlatformEFIOWrite1Byte(Adapter, 0x506, 0x54);
+				PlatformEFIOWrite1Byte(Adapter, 0x507, 0x54);
+			
+			}
+			else
+			{
+				PlatformEFIOWrite1Byte(Adapter, 0x506, 0x00);
+				PlatformEFIOWrite1Byte(Adapter, 0x507, 0x00);			
+			}
+				
+			PlatformEFIOWrite1Byte(Adapter, 0x4fd, BT_State);
+			RTPRINT(FBT, BT_TRACE, ("BT_SCO set 0x4fd to %x\n", BT_State));
+			return TRUE;
+		}
+	}
+
+	return FALSE;
+
+}
+
+BOOLEAN
+BT_WifiConnectChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	static BOOLEAN	bMediaConnect = FALSE;
+
+	if(!pMgntInfo->bMediaConnect || MgntRoamingInProgress(pMgntInfo))
+	{
+		bMediaConnect = FALSE;
+	}
+	else
+	{
+		if(!bMediaConnect)
+		{
+			bMediaConnect = TRUE;
+			return TRUE;
+		}
+		bMediaConnect = TRUE;
+	}
+
+	return FALSE;
+}
+
+BOOLEAN
+BT_RSSIChangeWithAMPDU(
+	IN	PADAPTER	Adapter
+	)
+{
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(!Adapter->pNdisCommon->bRegBT_Ampdu || !Adapter->pNdisCommon->bRegAcceptAddbaReq)
+		return FALSE;
+
+	RTPRINT(FBT, BT_TRACE, ("RSSI is %d\n",pHalData->UndecoratedSmoothedPWDB));
+	
+	if((pHalData->UndecoratedSmoothedPWDB<=32) && pMgntInfo->pHTInfo->bAcceptAddbaReq)
+	{
+		RTPRINT(FBT, BT_TRACE, ("BT_Disallow AMPDU RSSI <=32  Need change\n"));				
+		return TRUE;
+
+	}
+	else if((pHalData->UndecoratedSmoothedPWDB>=40) && !pMgntInfo->pHTInfo->bAcceptAddbaReq )
+	{
+		RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU RSSI >=40, Need change\n"));
+		return TRUE;
+	}
+	else 
+		return FALSE;
+
+}
+
+
+VOID
+dm_BTCoexist(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	static u1Byte		LastTxPowerLvl = 0xff;
+	PRX_TS_RECORD	pRxTs = NULL;
+
+	BOOLEAN			bWifiConnectChange, bBtStateChange,bRSSIChangeWithAMPDU;
+
+	if( (pHalData->bt_coexist.BluetoothCoexist) &&
+		(pHalData->bt_coexist.BT_CoexistType == BT_CSR_BC4) && 
+		(!ACTING_AS_AP(Adapter))	)
+	{
+		bWifiConnectChange = BT_WifiConnectChange(Adapter);
+		bBtStateChange = BT_BTStateChange(Adapter);
+		bRSSIChangeWithAMPDU = BT_RSSIChangeWithAMPDU(Adapter);
+		RTPRINT(FBT, BT_TRACE, ("bWifiConnectChange %d, bBtStateChange  %d,LastTxPowerLvl  %x,  DynamicTxHighPowerLvl  %x\n",
+			bWifiConnectChange,bBtStateChange,LastTxPowerLvl,pHalData->DynamicTxHighPowerLvl));
+		if( bWifiConnectChange ||bBtStateChange  ||
+			(LastTxPowerLvl != pHalData->DynamicTxHighPowerLvl)	||bRSSIChangeWithAMPDU)
+		{
+			LastTxPowerLvl = pHalData->DynamicTxHighPowerLvl;
+
+			if(pHalData->bt_coexist.BT_CUR_State)
+			{
+				// Do not allow receiving A-MPDU aggregation.
+				if((pHalData->bt_coexist.BT_Service==BT_SCO) || (pHalData->bt_coexist.BT_Service==BT_Busy))
+				{
+					if(pHalData->UndecoratedSmoothedPWDB<=32)
+					{
+						if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Disallow AMPDU RSSI <=32\n"));	
+							pMgntInfo->pHTInfo->bAcceptAddbaReq = FALSE;
+							if(GetTs(Adapter, (PTS_COMMON_INFO*)(&pRxTs), pMgntInfo->Bssid, 0, RX_DIR, FALSE))
+								TsInitDelBA(Adapter, (PTS_COMMON_INFO)pRxTs, RX_DIR);
+						}
+					}
+					else if(pHalData->UndecoratedSmoothedPWDB>=40)
+					{
+						if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU  RSSI >=40\n"));	
+							pMgntInfo->pHTInfo->bAcceptAddbaReq = TRUE;
+						}
+					}
+				}
+				else
+				{
+					if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU BT not in SCO or BUSY\n"));	
+						pMgntInfo->pHTInfo->bAcceptAddbaReq = TRUE;
+					}
+				}
+
+				if(pHalData->bt_coexist.BT_Ant_isolation)
+				{			
+					RTPRINT(FBT, BT_TRACE, ("BT_IsolationLow\n"));
+					RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+					Adapter->HalFunc.UpdateHalRATRTableHandler(
+								Adapter, 
+								&pMgntInfo->dot11OperationalRateSet,
+								pMgntInfo->dot11HTOperationalRateSet,NULL);
+					
+					if(pHalData->bt_coexist.BT_Service==BT_SCO)
+					{
+
+						RTPRINT(FBT, BT_TRACE, ("BT_Turn OFF Coexist with SCO \n"));
+						PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0x14);					
+					}
+					else if(pHalData->DynamicTxHighPowerLvl == TxHighPwrLevel_Normal)
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Turn ON Coexist\n"));
+						PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0xb4);
+					}
+					else
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Turn OFF Coexist\n"));
+						PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0x14);
+					}
+				}
+				else
+				{
+					RTPRINT(FBT, BT_TRACE, ("BT_IsolationHigh\n"));
+					// Do nothing.
+				}
+			}
+			else
+			{
+				if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+				{
+					RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU bt is off\n"));	
+					pMgntInfo->pHTInfo->bAcceptAddbaReq = TRUE;
+				}
+
+				RTPRINT(FBT, BT_TRACE, ("BT_Turn OFF Coexist bt is off \n"));
+				PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0x14);
+
+				RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+				Adapter->HalFunc.UpdateHalRATRTableHandler(
+							Adapter, 
+							&pMgntInfo->dot11OperationalRateSet,
+							pMgntInfo->dot11HTOperationalRateSet,NULL);
+			}
+		}
+	}
+}
+#endif
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_CheckRfCtrlGPIO()
+ *
+ * Overview:	Copy 8187B template for 9xseries.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/10/2008	MHC		Create Version 0.  
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+dm_CheckRfCtrlGPIO(
+	IN	PADAPTER	Adapter
+	)
+{
+#if 0
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+#if defined (CONFIG_USB_HCI) || defined (CONFIG_SDIO_HCI)
+	#ifdef CONFIG_USB_HCI
+		// 2010/08/12 MH Add for CU selective suspend.
+		PRT_USB_DEVICE		pDevice = GET_RT_USB_DEVICE(Adapter);
+	#else
+		PRT_SDIO_DEVICE	pDevice = GET_RT_SDIO_DEVICE(Adapter);
+	#endif
+#endif
+
+	if(!Adapter->MgntInfo.PowerSaveControl.bGpioRfSw)
+		return;
+
+	RTPRINT(FPWR, PWRHW, ("dm_CheckRfCtrlGPIO \n"));
+
+#if defined (CONFIG_USB_HCI) || defined (CONFIG_SDIO_HCI)
+	// Walk around for DTM test, we will not enable HW - radio on/off because r/w
+	// page 1 register before Lextra bus is enabled cause system fails when resuming
+	// from S4. 20080218, Emily
+	if(Adapter->bInHctTest)
+		return;
+
+//#if ((HAL_CODE_BASE == RTL8192_S) )
+	//Adapter->HalFunc.GPIOChangeRFHandler(Adapter, GPIORF_POLLING);
+//#else
+	// 2010/07/27 MH Only Minicard and support selective suspend, we can not turn off all MAC power to 
+	// stop 8051. For dongle and minicard, we both support selective suspend mode.
+	//if(pDevice->RegUsbSS && Adapter->HalFunc.GetInterfaceSelectionHandler(Adapter) == INTF_SEL2_MINICARD)
+
+	//
+	// 2010/08/12 MH We support severl power consumption combination as below.
+	//
+	// Power consumption combination  
+	//	SS Enable: (LPS disable + IPS + SW/HW radio off)
+	//	1. Dongle + PDN  (support HW radio off)
+	//	2. Dongle + Normal  (No HW radio off)
+	//	3. MiniCard + PDN (support HW radio off)
+	//	4. MiniCard + Normal (support HW radio off)
+	//
+	//	SS Disable: (LPS + IPS + SW/HW radio off)
+	//	1. Dongle + PDN  (support HW radio off)
+	//	2. Dongle + Normal  (No HW radio off)
+	//	3. MiniCard + PDN (support HW radio off)
+	//	4. MiniCard + Normal (support HW radio off)
+	//
+	//	For Power down module detection. We need to read power register no matter
+	//	dongle or minicard, we will add the item is the detection method.
+	//
+	//
+	//vivi add du case
+	if ((IS_HARDWARE_TYPE_8192CU(Adapter)||IS_HARDWARE_TYPE_8192DU(Adapter))
+		&& pDevice->RegUsbSS)
+	{
+		RT_TRACE(COMP_RF, DBG_LOUD, ("USB SS Enabled\n"));
+		if (SUPPORT_HW_RADIO_DETECT(Adapter))
+		{	// Support HW radio detection
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB Card Type 2/3/4 support GPIO Detect\n"));
+			GpioDetectTimerStart(Adapter);
+		}
+		else
+		{	// Dongle does not support HW radio detection.?? In the fufure??
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB DONGLE Non-GPIO-Detect\n"));				
+		}			
+	}
+	else if (IS_HARDWARE_TYPE_8192CU(Adapter) ||
+		IS_HARDWARE_TYPE_8723AU(Adapter)||
+		IS_HARDWARE_TYPE_8192DU(Adapter) ||
+		IS_HARDWARE_TYPE_8723AS(Adapter))
+	{	// Not support Selective suspend 
+		RT_TRACE(COMP_RF, DBG_LOUD, ("USB SS Disable\n"));
+		if (SUPPORT_HW_RADIO_DETECT(Adapter))
+		{
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB Card Type 2/3/4 support GPIO Detect\n"));
+			PlatformScheduleWorkItem( &(pHalData->GPIOChangeRFWorkItem) );
+		}
+		else
+		{
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB DONGLE Non-GPIO-Detect\n"));
+		}
+	}
+	else
+	{	// CE only support noemal HW radio detection now. Support timers GPIO detection in SE/CU.		
+		PlatformScheduleWorkItem( &(pHalData->GPIOChangeRFWorkItem) );
+	}
+//#endif
+#else if defined CONFIG_PCI_HCI
+	if(Adapter->bInHctTest)
+		return;
+
+	// CE only support noemal HW radio detection now. We support timers GPIO detection in SE.		
+	PlatformScheduleWorkItem( &(pHalData->GPIOChangeRFWorkItem) );
+#endif
+#endif
+}	/* dm_CheckRfCtrlGPIO */
+
+static VOID
+dm_InitRateAdaptiveMask(
+	IN	PADAPTER	Adapter	
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PRATE_ADAPTIVE	pRA = (PRATE_ADAPTIVE)&pdmpriv->RateAdaptive;
+	
+	pRA->RATRState = DM_RATR_STA_INIT;
+	pRA->PreRATRState = DM_RATR_STA_INIT;
+
+	if (pdmpriv->DM_Type == DM_Type_ByDriver)
+		pdmpriv->bUseRAMask = _TRUE;
+	else
+		pdmpriv->bUseRAMask = _FALSE;	
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_RefreshRateAdaptiveMask()
+ *
+ * Overview:	Update rate table mask according to rssi
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/27/2009	hpfan	Create Version 0.  
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+dm_RefreshRateAdaptiveMask(	IN	PADAPTER	pAdapter)
+{
+#if 0
+	PADAPTER 				pTargetAdapter;
+	HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(pAdapter);
+	PMGNT_INFO				pMgntInfo = &(ADJUST_TO_ADAPTIVE_ADAPTER(pAdapter, TRUE)->MgntInfo);
+	PRATE_ADAPTIVE			pRA = (PRATE_ADAPTIVE)&pMgntInfo->RateAdaptive;
+	u4Byte					LowRSSIThreshForRA = 0, HighRSSIThreshForRA = 0;
+
+	if(pAdapter->bDriverStopped)
+	{
+		RT_TRACE(COMP_RATR, DBG_TRACE, ("<---- dm_RefreshRateAdaptiveMask(): driver is going to unload\n"));
+		return;
+	}
+
+	if(!pMgntInfo->bUseRAMask)
+	{
+		RT_TRACE(COMP_RATR, DBG_LOUD, ("<---- dm_RefreshRateAdaptiveMask(): driver does not control rate adaptive mask\n"));
+		return;
+	}
+
+	// if default port is connected, update RA table for default port (infrastructure mode only)
+	if(pAdapter->MgntInfo.mAssoc && (!ACTING_AS_AP(pAdapter)))
+	{
+		
+		// decide rastate according to rssi
+		switch (pRA->PreRATRState)
+		{
+			case DM_RATR_STA_HIGH:
+				HighRSSIThreshForRA = 50;
+				LowRSSIThreshForRA = 20;
+				break;
+			
+			case DM_RATR_STA_MIDDLE:
+				HighRSSIThreshForRA = 55;
+				LowRSSIThreshForRA = 20;
+				break;
+			
+			case DM_RATR_STA_LOW:
+				HighRSSIThreshForRA = 50;
+				LowRSSIThreshForRA = 25;
+				break;
+
+			default:
+				HighRSSIThreshForRA = 50;
+				LowRSSIThreshForRA = 20;
+				break;
+		}
+
+		if(pHalData->UndecoratedSmoothedPWDB > (s4Byte)HighRSSIThreshForRA)
+			pRA->RATRState = DM_RATR_STA_HIGH;
+		else if(pHalData->UndecoratedSmoothedPWDB > (s4Byte)LowRSSIThreshForRA)
+			pRA->RATRState = DM_RATR_STA_MIDDLE;
+		else
+			pRA->RATRState = DM_RATR_STA_LOW;
+
+		if(pRA->PreRATRState != pRA->RATRState)
+		{
+			RT_PRINT_ADDR(COMP_RATR, DBG_LOUD, ("Target AP addr : "), pMgntInfo->Bssid);
+			RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI = %d\n", pHalData->UndecoratedSmoothedPWDB));
+			RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI_LEVEL = %d\n", pRA->RATRState));
+			RT_TRACE(COMP_RATR, DBG_LOUD, ("PreState = %d, CurState = %d\n", pRA->PreRATRState, pRA->RATRState));
+			pAdapter->HalFunc.UpdateHalRAMaskHandler(
+									pAdapter,
+									FALSE,
+									0,
+									NULL,
+									NULL,
+									pRA->RATRState);
+			pRA->PreRATRState = pRA->RATRState;
+		}
+	}
+
+	//
+	// The following part configure AP/VWifi/IBSS rate adaptive mask.
+	//
+	if(ACTING_AS_AP(pAdapter) || ACTING_AS_IBSS(pAdapter))
+	{
+		pTargetAdapter = pAdapter;
+	}
+	else
+	{
+		pTargetAdapter = ADJUST_TO_ADAPTIVE_ADAPTER(pAdapter, FALSE);
+		if(!ACTING_AS_AP(pTargetAdapter))
+			pTargetAdapter = NULL;
+	}
+
+	// if extension port (softap) is started, updaet RA table for more than one clients associate
+	if(pTargetAdapter != NULL)
+	{
+		int	i;
+		PRT_WLAN_STA	pEntry;
+		PRATE_ADAPTIVE     pEntryRA;
+
+		for(i = 0; i < ASSOCIATE_ENTRY_NUM; i++)
+		{
+			if(	pTargetAdapter->MgntInfo.AsocEntry[i].bUsed && pTargetAdapter->MgntInfo.AsocEntry[i].bAssociated)
+			{
+				pEntry = pTargetAdapter->MgntInfo.AsocEntry+i;
+				pEntryRA = &pEntry->RateAdaptive;
+
+				switch (pEntryRA->PreRATRState)
+				{
+					case DM_RATR_STA_HIGH:
+					{
+						HighRSSIThreshForRA = 50;
+						LowRSSIThreshForRA = 20;
+					}
+					break;
+					
+					case DM_RATR_STA_MIDDLE:
+					{
+						HighRSSIThreshForRA = 55;
+						LowRSSIThreshForRA = 20;
+					}
+					break;
+					
+					case DM_RATR_STA_LOW:
+					{
+						HighRSSIThreshForRA = 50;
+						LowRSSIThreshForRA = 25;
+					}
+					break;
+
+					default:
+					{
+						HighRSSIThreshForRA = 50;
+						LowRSSIThreshForRA = 20;
+					}
+				}
+
+				if(pEntry->rssi_stat.UndecoratedSmoothedPWDB > (s4Byte)HighRSSIThreshForRA)
+					pEntryRA->RATRState = DM_RATR_STA_HIGH;
+				else if(pEntry->rssi_stat.UndecoratedSmoothedPWDB > (s4Byte)LowRSSIThreshForRA)
+					pEntryRA->RATRState = DM_RATR_STA_MIDDLE;
+				else
+					pEntryRA->RATRState = DM_RATR_STA_LOW;
+
+				if(pEntryRA->PreRATRState != pEntryRA->RATRState)
+				{
+					RT_PRINT_ADDR(COMP_RATR, DBG_LOUD, ("AsocEntry addr : "), pEntry->MacAddr);
+					RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI = %d\n", pEntry->rssi_stat.UndecoratedSmoothedPWDB));
+					RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI_LEVEL = %d\n", pEntryRA->RATRState));
+					RT_TRACE(COMP_RATR, DBG_LOUD, ("PreState = %d, CurState = %d\n", pEntryRA->PreRATRState, pEntryRA->RATRState));
+					pAdapter->HalFunc.UpdateHalRAMaskHandler(
+											pTargetAdapter,
+											FALSE,
+											pEntry->AID+1,
+											pEntry->MacAddr,
+											pEntry,
+											pEntryRA->RATRState);
+					pEntryRA->PreRATRState = pEntryRA->RATRState;
+				}
+
+			}
+		}
+	}
+#endif	
+}
+
+static VOID
+dm_CheckProtection(
+	IN	PADAPTER	Adapter
+	)
+{
+#if 0
+	PMGNT_INFO		pMgntInfo = &(Adapter->MgntInfo);
+	u1Byte			CurRate, RateThreshold;
+
+	if(pMgntInfo->pHTInfo->bCurBW40MHz)
+		RateThreshold = MGN_MCS1;
+	else
+		RateThreshold = MGN_MCS3;
+
+	if(Adapter->TxStats.CurrentInitTxRate <= RateThreshold)
+	{
+		pMgntInfo->bDmDisableProtect = TRUE;
+		DbgPrint("Forced disable protect: %x\n", Adapter->TxStats.CurrentInitTxRate);
+	}
+	else
+	{
+		pMgntInfo->bDmDisableProtect = FALSE;
+		DbgPrint("Enable protect: %x\n", Adapter->TxStats.CurrentInitTxRate);
+	}
+#endif
+}
+
+static VOID
+dm_CheckStatistics(
+	IN	PADAPTER	Adapter
+	)
+{
+#if 0
+	if(!Adapter->MgntInfo.bMediaConnect)
+		return;
+
+	//2008.12.10 tynli Add for getting Current_Tx_Rate_Reg flexibly.
+	rtw_hal_get_hwreg( Adapter, HW_VAR_INIT_TX_RATE, (pu1Byte)(&Adapter->TxStats.CurrentInitTxRate) );
+
+	// Calculate current Tx Rate(Successful transmited!!)
+
+	// Calculate current Rx Rate(Successful received!!)
+	
+	//for tx tx retry count
+	rtw_hal_get_hwreg( Adapter, HW_VAR_RETRY_COUNT, (pu1Byte)(&Adapter->TxStats.NumTxRetryCount) );
+#endif	
+}
+
+static void dm_CheckPbcGPIO(_adapter *padapter)
+{	
+	u8	tmp1byte;
+	u8	bPbcPressed = _FALSE;
+	int i=0;
+
+	if(!padapter->registrypriv.hw_wps_pbc)
+		return;
+
+	do
+	{
+		i++;
+#ifdef CONFIG_USB_HCI
+	tmp1byte = rtw_read8(padapter, GPIO_IO_SEL);
+	tmp1byte |= (HAL_8192C_HW_GPIO_WPS_BIT);
+	rtw_write8(padapter, GPIO_IO_SEL, tmp1byte);	//enable GPIO[2] as output mode
+
+	tmp1byte &= ~(HAL_8192C_HW_GPIO_WPS_BIT);
+	rtw_write8(padapter,  GPIO_IN, tmp1byte);		//reset the floating voltage level
+
+	tmp1byte = rtw_read8(padapter, GPIO_IO_SEL);
+	tmp1byte &= ~(HAL_8192C_HW_GPIO_WPS_BIT);
+	rtw_write8(padapter, GPIO_IO_SEL, tmp1byte);	//enable GPIO[2] as input mode
+
+	tmp1byte =rtw_read8(padapter, GPIO_IN);
+	
+	if (tmp1byte == 0xff)
+	{
+		bPbcPressed = _FALSE;
+		break ;
+	}	
+
+	if (tmp1byte&HAL_8192C_HW_GPIO_WPS_BIT)
+	{
+		bPbcPressed = _TRUE;
+
+		if(i<=3)
+			rtw_msleep_os(50);
+	}
+#else
+	tmp1byte = rtw_read8(padapter, GPIO_IN);
+	//RT_TRACE(COMP_IO, DBG_TRACE, ("dm_CheckPbcGPIO - %x\n", tmp1byte));
+
+	if (tmp1byte == 0xff || padapter->init_adpt_in_progress)
+	{
+		bPbcPressed = _FALSE;
+		break ;
+	}
+
+	if((tmp1byte&HAL_8192C_HW_GPIO_WPS_BIT)==0)
+	{
+		bPbcPressed = _TRUE;
+
+		if(i<=3)
+			rtw_msleep_os(50);
+	}
+#endif		
+
+	}while(i<=3 && bPbcPressed == _TRUE);
+	
+	if( _TRUE == bPbcPressed)
+	{
+		// Here we only set bPbcPressed to true
+		// After trigger PBC, the variable will be set to false		
+		DBG_8192C("CheckPbcGPIO - PBC is pressed, try_cnt=%d\n", i-1);
+                
+#ifdef RTK_DMP_PLATFORM
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+		kobject_uevent(&padapter->pnetdev->dev.kobj, KOBJ_NET_PBC);
+#else
+		kobject_hotplug(&padapter->pnetdev->class_dev.kobj, KOBJ_NET_PBC);
+#endif
+#else
+
+		if ( padapter->pid[0] == 0 )
+		{	//	0 is the default value and it means the application monitors the HW PBC doesn't privde its pid to driver.
+			return;
+		}
+
+#ifdef PLATFORM_LINUX
+		rtw_signal_process(padapter->pid[0], SIGUSR1);
+#endif
+#endif
+	}	
+}
+
+#ifdef CONFIG_PCI_HCI
+//
+//	Description:
+//		Perform interrupt migration dynamically to reduce CPU utilization.
+//
+//	Assumption:
+//		1. Do not enable migration under WIFI test.
+//
+//	Created by Roger, 2010.03.05.
+//
+VOID
+dm_InterruptMigration(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	BOOLEAN			bCurrentIntMt, bCurrentACIntDisable;
+	BOOLEAN			IntMtToSet = _FALSE; 
+	BOOLEAN			ACIntToSet = _FALSE;
+	
+	
+	// Retrieve current interrupt migration and Tx four ACs IMR settings first.
+	bCurrentIntMt = pHalData->bInterruptMigration;
+	bCurrentACIntDisable = pHalData->bDisableTxInt;
+
+	//
+	// <Roger_Notes> Currently we use busy traffic for reference instead of RxIntOK counts to prevent non-linear Rx statistics 
+	// when interrupt migration is set before. 2010.03.05.
+	// 
+	if(!Adapter->registrypriv.wifi_spec && 
+		(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) &&
+		pmlmepriv->LinkDetectInfo.bHigherBusyTraffic)
+	{			
+		IntMtToSet = _TRUE;
+
+		// To check whether we should disable Tx interrupt or not.
+		if(pmlmepriv->LinkDetectInfo.bHigherBusyRxTraffic )
+			ACIntToSet = _TRUE;				
+	}		
+	
+	//Update current settings.
+	if( bCurrentIntMt != IntMtToSet ){
+		DBG_8192C("%s(): Update interrrupt migration(%d)\n",__FUNCTION__,IntMtToSet);
+		if(IntMtToSet)
+		{
+			//
+			// <Roger_Notes> Set interrrupt migration timer and corresponging Tx/Rx counter. 
+			// timer 25ns*0xfa0=100us for 0xf packets.
+			// 2010.03.05.
+			//
+			rtw_write32(Adapter, REG_INT_MIG, 0xff000fa0);// 0x306:Rx, 0x307:Tx
+			pHalData->bInterruptMigration = IntMtToSet;
+		}
+		else
+		{
+			// Reset all interrupt migration settings.
+			rtw_write32(Adapter, REG_INT_MIG, 0);
+			pHalData->bInterruptMigration = IntMtToSet;
+		}
+	}
+
+	/*if( bCurrentACIntDisable != ACIntToSet ){
+		DBG_8192C("%s(): Update AC interrrupt(%d)\n",__FUNCTION__,ACIntToSet);
+		if(ACIntToSet) // Disable four ACs interrupts.
+		{
+			//
+			// <Roger_Notes> Disable VO, VI, BE and BK four AC interrupts to gain more efficient CPU utilization.
+			// When extremely highly Rx OK occurs, we will disable Tx interrupts.
+			// 2010.03.05.
+			//
+			UpdateInterruptMask8192CE( Adapter, 0, RT_AC_INT_MASKS );
+			pHalData->bDisableTxInt = ACIntToSet;
+		}
+		else// Enable four ACs interrupts.
+		{
+			UpdateInterruptMask8192CE( Adapter, RT_AC_INT_MASKS, 0 );
+			pHalData->bDisableTxInt = ACIntToSet;
+		}
+	}*/
+	
+}
+
+#endif
+
+//
+// Initialize GPIO setting registers
+//
+static void
+dm_InitGPIOSetting(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(Adapter);
+	
+	u8	tmp1byte;
+	
+	tmp1byte = rtw_read8(Adapter, REG_GPIO_MUXCFG);
+	tmp1byte &= (GPIOSEL_GPIO | ~GPIOSEL_ENBT);
+	
+#ifdef CONFIG_BT_COEXIST
+	// UMB-B cut bug. We need to support the modification.
+	if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID) && 
+		pHalData->bt_coexist.BT_Coexist)
+	{
+		tmp1byte |= (BIT5);	
+	}
+#endif	
+	rtw_write8(Adapter, REG_GPIO_MUXCFG, tmp1byte);
+
+}
+
+static void update_EDCA_param(_adapter *padapter)
+{
+	u32 	trafficIndex;
+	u32	edca_param;
+	u64	cur_tx_bytes = 0;
+	u64	cur_rx_bytes = 0;
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct recv_priv		*precvpriv = &(padapter->recvpriv);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);	
+	u8	bbtchange = _FALSE;
+#endif
+	
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	//associated AP
+	if ((pregpriv->wifi_spec == 1) || (pmlmeinfo->HT_enable == 0))
+	{
+		return;
+	}
+	
+	if (pmlmeinfo->assoc_AP_vendor >= maxAP)
+	{
+		return;
+	}
+
+	cur_tx_bytes = pxmitpriv->tx_bytes - pxmitpriv->last_tx_bytes;
+	cur_rx_bytes = precvpriv->rx_bytes - precvpriv->last_rx_bytes;
+
+	//traffic, TX or RX
+	if((pmlmeinfo->assoc_AP_vendor == ralinkAP)||(pmlmeinfo->assoc_AP_vendor == atherosAP))
+	{
+		if (cur_tx_bytes > (cur_rx_bytes << 2))
+		{ // Uplink TP is present.
+			trafficIndex = UP_LINK; 
+		}
+		else
+		{ // Balance TP is present.
+			trafficIndex = DOWN_LINK;
+		}
+	}
+	else
+	{
+		if (cur_rx_bytes > (cur_tx_bytes << 2))
+		{ // Downlink TP is present.
+			trafficIndex = DOWN_LINK;
+		}
+		else
+		{ // Balance TP is present.
+			trafficIndex = UP_LINK;
+		}
+	}
+
+#ifdef CONFIG_BT_COEXIST
+	if(pbtpriv->BT_Coexist)
+	{
+		if( (pbtpriv->BT_EDCA[UP_LINK]!=0) ||  (pbtpriv->BT_EDCA[DOWN_LINK]!=0))
+		{
+			bbtchange = _TRUE;
+		}
+	}
+#endif
+
+	if (pdmpriv->prv_traffic_idx != trafficIndex)
+	{
+#if 0
+#ifdef CONFIG_BT_COEXIST
+		if(_TRUE == bbtchange)		
+			rtw_write32(padapter, REG_EDCA_BE_PARAM, pbtpriv->BT_EDCA[trafficIndex]);		
+		else
+#endif
+		//adjust EDCA parameter for BE queue
+		//fire_write_MAC_cmd(padapter, EDCA_BE_PARAM, EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex]);
+		rtw_write32(padapter, REG_EDCA_BE_PARAM, EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex]);
+
+#else
+		if((pmlmeinfo->assoc_AP_vendor == ciscoAP) && (pmlmeext->cur_wireless_mode & WIRELESS_11_24N))
+		{
+			edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+		}
+		else if((pmlmeinfo->assoc_AP_vendor == airgocapAP) &&
+			((pmlmeext->cur_wireless_mode == WIRELESS_11G) ||(pmlmeext->cur_wireless_mode == WIRELESS_11BG)))
+		{
+			edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+		}
+		else
+		{
+			edca_param = EDCAParam[unknownAP][trafficIndex];
+		}
+
+#ifdef CONFIG_BT_COEXIST
+		if(_TRUE == bbtchange)		
+			edca_param = pbtpriv->BT_EDCA[trafficIndex];
+#endif
+
+		rtw_write32(padapter, REG_EDCA_BE_PARAM, edca_param);
+#endif
+		pdmpriv->prv_traffic_idx = trafficIndex;
+	}
+	
+//exit_update_EDCA_param:	
+
+	pxmitpriv->last_tx_bytes = pxmitpriv->tx_bytes;
+	precvpriv->last_rx_bytes = precvpriv->rx_bytes;
+
+	return;
+}
+
+static void dm_InitDynamicBBPowerSaving(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	pPSTable->PreCCAState = CCA_MAX;
+	pPSTable->CurCCAState = CCA_MAX;
+	pPSTable->PreRFState = RF_MAX;
+	pPSTable->CurRFState = RF_MAX;
+	pPSTable->Rssi_val_min = 0;
+}
+
+static void dm_1R_CCA(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	if(pPSTable->Rssi_val_min != 0)
+	{
+		if(pPSTable->PreCCAState == CCA_2R)
+		{
+			if(pPSTable->Rssi_val_min >= 35)
+				pPSTable->CurCCAState = CCA_1R;
+			else
+				pPSTable->CurCCAState = CCA_2R;
+		}
+		else{
+			if(pPSTable->Rssi_val_min <= 30)
+				pPSTable->CurCCAState = CCA_2R;
+			else
+				pPSTable->CurCCAState = CCA_1R;
+		}
+	}
+	else
+		pPSTable->CurCCAState=CCA_MAX;
+
+	if(pPSTable->PreCCAState != pPSTable->CurCCAState)
+	{
+		if(pPSTable->CurCCAState == CCA_1R)
+		{
+			if(pHalData->rf_type == RF_2T2R)
+			{
+				PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable  , bMaskByte0, 0x13);
+				PHY_SetBBReg(pAdapter, 0xe70, bMaskByte3, 0x20);
+			}
+			else
+			{
+				PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable  , bMaskByte0, 0x23);
+				PHY_SetBBReg(pAdapter, 0xe70, 0x7fc00000, 0x10c); // Set RegE70[30:22] = 9b'100001100
+			}
+		}
+		else
+		{
+			PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable, bMaskByte0, 0x33);
+			PHY_SetBBReg(pAdapter,0xe70, bMaskByte3, 0x63);
+		}
+		pPSTable->PreCCAState = pPSTable->CurCCAState;
+	}
+	//DBG_8192C("dm_1R_CCA(): CCAStage=%x\n", pPSTable->CurCCAState);
+}
+
+void
+rtl8192c_dm_RF_Saving(
+	IN	PADAPTER	pAdapter,
+	IN	u8	bForceInNormal 
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	if(pdmpriv->initialize == 0){
+		pdmpriv->rf_saving_Reg874 = (PHY_QueryBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW, bMaskDWord)&0x1CC000)>>14;
+		pdmpriv->rf_saving_RegC70 = (PHY_QueryBBReg(pAdapter, rOFDM0_AGCParameter1, bMaskDWord)&BIT3)>>3;
+		pdmpriv->rf_saving_Reg85C = (PHY_QueryBBReg(pAdapter, rFPGA0_XCD_SwitchControl, bMaskDWord)&0xFF000000)>>24;
+		pdmpriv->rf_saving_RegA74 = (PHY_QueryBBReg(pAdapter, 0xa74, bMaskDWord)&0xF000)>>12;
+		//Reg818 = PHY_QueryBBReg(pAdapter, 0x818, bMaskDWord);
+		pdmpriv->initialize = 1;
+	}
+
+	if(!bForceInNormal)
+	{
+		if(pPSTable->Rssi_val_min != 0)
+		{
+			 
+			if(pPSTable->PreRFState == RF_Normal)
+			{
+			#ifdef CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+				if(pPSTable->Rssi_val_min >= 50)
+			#else
+				if(pPSTable->Rssi_val_min >= 30)
+			#endif
+					pPSTable->CurRFState = RF_Save;
+				else
+					pPSTable->CurRFState = RF_Normal;
+			}
+			else{
+			#ifdef CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+				if(pPSTable->Rssi_val_min <= 45)
+			#else
+				if(pPSTable->Rssi_val_min <= 25)
+			#endif
+					pPSTable->CurRFState = RF_Normal;
+				else
+					pPSTable->CurRFState = RF_Save;
+			}
+		}
+		else
+			pPSTable->CurRFState=RF_MAX;
+	}
+	else
+	{
+		pPSTable->CurRFState = RF_Normal;
+	}
+	
+	if(pPSTable->PreRFState != pPSTable->CurRFState)
+	{
+		if(pPSTable->CurRFState == RF_Save)
+		{
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW  , 0x1C0000, 0x2); //Reg874[20:18]=3'b010
+			PHY_SetBBReg(pAdapter, rOFDM0_AGCParameter1, BIT3, 0); //RegC70[3]=1'b0
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_SwitchControl, 0xFF000000, 0x63); //Reg85C[31:24]=0x63
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW, 0xC000, 0x2); //Reg874[15:14]=2'b10
+			PHY_SetBBReg(pAdapter, 0xa74, 0xF000, 0x3); //RegA75[7:4]=0x3
+			PHY_SetBBReg(pAdapter, 0x818, BIT28, 0x0); //Reg818[28]=1'b0
+			PHY_SetBBReg(pAdapter, 0x818, BIT28, 0x1); //Reg818[28]=1'b1
+			DBG_8192C("%s(): RF_Save\n", __FUNCTION__);
+		}
+		else
+		{
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW  , 0x1CC000, pdmpriv->rf_saving_Reg874);
+			PHY_SetBBReg(pAdapter, rOFDM0_AGCParameter1, BIT3, pdmpriv->rf_saving_RegC70);
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_SwitchControl, 0xFF000000, pdmpriv->rf_saving_Reg85C);
+			PHY_SetBBReg(pAdapter, 0xa74, 0xF000, pdmpriv->rf_saving_RegA74);
+			PHY_SetBBReg(pAdapter, 0x818, BIT28, 0x0);
+			DBG_8192C("%s(): RF_Normal\n", __FUNCTION__);
+		}
+		pPSTable->PreRFState = pPSTable->CurRFState;
+	}
+}
+
+static void
+dm_DynamicBBPowerSaving(
+IN	PADAPTER	pAdapter
+	)
+{	
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct mlme_priv	*pmlmepriv = &pAdapter->mlmepriv;
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	//1 1.Determine the minimum RSSI 
+	if((check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE) &&	
+		(pdmpriv->EntryMinUndecoratedSmoothedPWDB == 0))
+	{
+		pPSTable->Rssi_val_min = 0;
+		//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("Not connected to any \n"));
+	}
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	// Default port
+	{
+		//if(ACTING_AS_AP(pAdapter) || pMgntInfo->mIbss)
+		 if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+			       (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))	//todo: AP Mode
+		{
+			pPSTable->Rssi_val_min = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("AP Client PWDB = 0x%lx \n", pPSTable->Rssi_val_min));
+		}
+		else
+		{
+			pPSTable->Rssi_val_min = pdmpriv->UndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("STA Default Port PWDB = 0x%lx \n", pPSTable->Rssi_val_min));
+		}
+	}
+	else // associated entry pwdb
+	{	
+		pPSTable->Rssi_val_min = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+		//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("AP Ext Port PWDB = 0x%lx \n", pPSTable->Rssi_val_min));
+	}
+	
+	//1 2.Power Saving for 92C
+	if(IS_92C_SERIAL(pHalData->VersionID))
+	{
+		//dm_1R_CCA(pAdapter);
+	}
+	
+	// 20100628 Joseph: Turn off BB power save for 88CE because it makesthroughput unstable.
+	// 20100831 Joseph: Turn ON BB power save again after modifying AGC delay from 900ns to 600ns. 
+	//1 3.Power Saving for 88C
+	else
+	{
+		rtl8192c_dm_RF_Saving(pAdapter, _FALSE);
+	}
+}
+
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+// Add new function to reset the state of antenna diversity before link.
+//
+void SwAntDivResetBeforeLink8192C(IN PADAPTER Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T *pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+	
+	pDM_SWAT_Table->SWAS_NoLink_State = 0;
+}
+
+// Compare RSSI for deciding antenna
+void	SwAntDivCompare8192C(PADAPTER Adapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if((0 != pHalData->AntDivCfg) && (!IS_92C_SERIAL(pHalData->VersionID)) )
+	{
+		//DBG_8192C("update_network=> orgRSSI(%d)(%d),newRSSI(%d)(%d)\n",dst->Rssi,query_rx_pwr_percentage(dst->Rssi),
+		//	src->Rssi,query_rx_pwr_percentage(src->Rssi));
+		//select optimum_antenna for before linked =>For antenna diversity
+		if(dst->Rssi >=  src->Rssi )//keep org parameter
+		{
+			src->Rssi = dst->Rssi;
+			src->PhyInfo.Optimum_antenna = dst->PhyInfo.Optimum_antenna;						
+		}
+	}
+}
+
+// Add new function to reset the state of antenna diversity before link.
+u8 SwAntDivBeforeLink8192C(IN PADAPTER Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T			*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	
+	// Condition that does not need to use antenna diversity.
+	if(IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))
+	{
+		//DBG_8192C("SwAntDivBeforeLink8192C(): No AntDiv Mechanism.\n");
+		return _FALSE;
+	}
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	
+	{
+		pDM_SWAT_Table->SWAS_NoLink_State = 0;
+		return _FALSE;
+	}
+	// Since driver is going to set BB register, it shall check if there is another thread controlling BB/RF.
+/*	
+	if(pHalData->eRFPowerState!=eRfOn || pMgntInfo->RFChangeInProgress || pMgntInfo->bMediaConnect)
+	{
+	
+	
+		RT_TRACE(COMP_SWAS, DBG_LOUD, 
+				("SwAntDivCheckBeforeLink8192C(): RFChangeInProgress(%x), eRFPowerState(%x)\n", 
+				pMgntInfo->RFChangeInProgress,
+				pHalData->eRFPowerState));
+	
+		pDM_SWAT_Table->SWAS_NoLink_State = 0;
+		
+		return FALSE;
+	}
+*/	
+	
+	if(pDM_SWAT_Table->SWAS_NoLink_State == 0){
+		//switch channel
+		pDM_SWAT_Table->SWAS_NoLink_State = 1;
+		pDM_SWAT_Table->CurAntenna = (pDM_SWAT_Table->CurAntenna==Antenna_A)?Antenna_B:Antenna_A;
+
+		//PHY_SetBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300, pDM_SWAT_Table->CurAntenna);
+		rtw_antenna_select_cmd(Adapter, pDM_SWAT_Table->CurAntenna, _FALSE);
+		//DBG_8192C("%s change antenna to ANT_( %s ).....\n",__FUNCTION__, (pDM_SWAT_Table->CurAntenna==Antenna_A)?"A":"B");
+		return _TRUE;
+	}
+	else
+	{
+		pDM_SWAT_Table->SWAS_NoLink_State = 0;
+		return _FALSE;
+	}
+		
+
+
+}
+#endif
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+//
+// 20100514 Luke/Joseph:
+// Add new function to reset antenna diversity state after link.
+//
+void
+SwAntDivRestAfterLink8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T			*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))	
+		return;
+
+	//DBG_8192C("======>   SwAntDivRestAfterLink <========== \n");
+	pHalData->RSSI_cnt_A= 0;
+	pHalData->RSSI_cnt_B= 0;
+	pHalData->RSSI_test = _FALSE;
+	
+	pDM_SWAT_Table->try_flag = 0xff;
+	pDM_SWAT_Table->RSSI_Trying = 0;	
+	pDM_SWAT_Table->SelectAntennaMap=0xAA;
+	pDM_SWAT_Table->CurAntenna = pHalData->CurAntenna;
+	pDM_SWAT_Table->PreAntenna = pHalData->CurAntenna;
+		
+	pdmpriv->lastTxOkCnt=0;
+	pdmpriv->lastRxOkCnt=0;
+
+	pdmpriv->TXByteCnt_A=0;
+	pdmpriv->TXByteCnt_B=0;
+	pdmpriv->RXByteCnt_A=0;
+	pdmpriv->RXByteCnt_B=0;
+	pdmpriv->DoubleComfirm=0;	
+	pdmpriv->TrafficLoad = TRAFFIC_LOW;
+	
+}
+
+
+//
+// 20100514 Luke/Joseph:
+// Add new function for antenna diversity after link.
+// This is the main function of antenna diversity after link.
+// This function is called in HalDmWatchDog() and dm_SW_AntennaSwitchCallback().
+// HalDmWatchDog() calls this function with SWAW_STEP_PEAK to initialize the antenna test.
+// In SWAW_STEP_PEAK, another antenna and a 500ms timer will be set for testing.
+// After 500ms, dm_SW_AntennaSwitchCallback() calls this function to compare the signal just
+// listened on the air with the RSSI of original antenna.
+// It chooses the antenna with better RSSI.
+// There is also a aged policy for error trying. Each error trying will cost more 5 seconds waiting 
+// penalty to get next try.
+//
+static VOID
+dm_SW_AntennaSwitch(
+	PADAPTER	Adapter,
+	u8			Step
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T	*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+	s32			curRSSI=100, RSSI_A, RSSI_B;
+	u64			curTxOkCnt, curRxOkCnt;
+	u64			CurByteCnt = 0, PreByteCnt = 0;	
+	u8		nextAntenna = 0;
+	u8			Score_A=0, Score_B=0;
+	u8			i;
+
+	// Condition that does not need to use antenna diversity.
+	if(IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))
+	{
+		//RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): No AntDiv Mechanism.\n"));
+		return;
+	}
+	// If dynamic ant_div is disabled.
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_ANT_DIV) )
+	{	
+		return;
+	}
+	
+	if (check_fwstate(&Adapter->mlmepriv, _FW_LINKED)	==_FALSE)
+		return;
+#if 0 //to do
+	// Radio off: Status reset to default and return.
+	if(pHalData->eRFPowerState==eRfOff)
+	{
+		SwAntDivRestAfterLink(Adapter);
+		return;
+	}
+#endif
+	//DBG_8192C("\n............................ %s.........................\n",__FUNCTION__);
+	// Handling step mismatch condition.
+	// Peak step is not finished at last time. Recover the variable and check again.
+	if( Step != pDM_SWAT_Table->try_flag	)
+	{
+		SwAntDivRestAfterLink8192C(Adapter);
+	}
+
+
+	if(pDM_SWAT_Table->try_flag == 0xff)
+	{
+#if 0
+		// Select RSSI checking target
+		if(pMgntInfo->mAssoc && !ACTING_AS_AP(Adapter))
+		{
+			// Target: Infrastructure mode AP.
+			pHalData->RSSI_target = NULL;
+			RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): RSSI_target is DEF AP!\n"));
+		}
+		else
+		{
+			u8			index = 0;
+			PRT_WLAN_STA	pEntry = NULL;
+			PADAPTER		pTargetAdapter = NULL;
+		
+			if(	pMgntInfo->mIbss || ACTING_AS_AP(Adapter) )
+			{
+				// Target: AP/IBSS peer.
+				pTargetAdapter = Adapter;
+			}
+			else if(ACTING_AS_AP(ADJUST_TO_ADAPTIVE_ADAPTER(Adapter, FALSE)))
+			{
+				// Target: VWIFI peer.
+				pTargetAdapter = ADJUST_TO_ADAPTIVE_ADAPTER(Adapter, FALSE);
+			}
+
+			if(pTargetAdapter != NULL)
+			{
+				for(index=0; index<ASSOCIATE_ENTRY_NUM; index++)
+				{
+					pEntry = AsocEntry_EnumStation(pTargetAdapter, index);
+					if(pEntry != NULL)
+					{
+						if(pEntry->bAssociated)
+							break;			
+					}
+				}
+			}
+
+			if(pEntry == NULL)
+			{
+				SwAntDivRestAfterLink(Adapter);
+				RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): No Link.\n"));
+				return;
+			}
+			else
+			{
+				pHalData->RSSI_target = pEntry;
+				RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): RSSI_target is PEER STA\n"));
+			}
+		}
+			
+			
+#endif
+		
+		pHalData->RSSI_cnt_A= 0;
+		pHalData->RSSI_cnt_B= 0;
+		pDM_SWAT_Table->try_flag = 0;
+	//	DBG_8192C("dm_SW_AntennaSwitch(): Set try_flag to 0 prepare for peak!\n");
+		return;
+	}
+	else
+	{
+		curTxOkCnt = Adapter->xmitpriv.tx_bytes - pdmpriv->lastTxOkCnt;
+		curRxOkCnt = Adapter->recvpriv.rx_bytes - pdmpriv->lastRxOkCnt;
+
+		pdmpriv->lastTxOkCnt = Adapter->xmitpriv.tx_bytes ;
+		pdmpriv->lastRxOkCnt = Adapter->recvpriv.rx_bytes ;
+
+		if(pDM_SWAT_Table->try_flag == 1)
+		{
+			if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+		{
+				pdmpriv->TXByteCnt_A += curTxOkCnt;
+				pdmpriv->RXByteCnt_A += curRxOkCnt;
+				//DBG_8192C("#####  TXByteCnt_A(%lld) , RXByteCnt_A(%lld) ####\n",pdmpriv->TXByteCnt_A,pdmpriv->RXByteCnt_A);
+			}
+			else
+			{
+				pdmpriv->TXByteCnt_B += curTxOkCnt;
+				pdmpriv->RXByteCnt_B += curRxOkCnt;
+				//DBG_8192C("#####  TXByteCnt_B(%lld) , RXByteCnt_B(%lld) ####\n",pdmpriv->TXByteCnt_B,pdmpriv->RXByteCnt_B);
+			}
+		
+			nextAntenna = (pDM_SWAT_Table->CurAntenna == Antenna_A)? Antenna_B : Antenna_A;
+			pDM_SWAT_Table->RSSI_Trying--;
+			//DBG_8192C("RSSI_Trying = %d\n",pDM_SWAT_Table->RSSI_Trying);
+			
+			if(pDM_SWAT_Table->RSSI_Trying == 0)
+			{
+				CurByteCnt = (pDM_SWAT_Table->CurAntenna == Antenna_A)? (pdmpriv->TXByteCnt_A+pdmpriv->RXByteCnt_A) : (pdmpriv->TXByteCnt_B+pdmpriv->RXByteCnt_B);
+				PreByteCnt = (pDM_SWAT_Table->CurAntenna == Antenna_A)? (pdmpriv->TXByteCnt_B+pdmpriv->RXByteCnt_B) : (pdmpriv->TXByteCnt_A+pdmpriv->RXByteCnt_A);
+
+				//DBG_8192C("CurByteCnt = %lld\n", CurByteCnt);
+				//DBG_8192C("PreByteCnt = %lld\n",PreByteCnt);		
+				
+				if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				{
+					PreByteCnt = PreByteCnt*9;	//normalize:Cur=90ms:Pre=10ms					
+				}
+				else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+				{					
+					//CurByteCnt = CurByteCnt/2;
+					CurByteCnt = CurByteCnt>>1;//normalize:100ms:50ms					
+				}
+
+
+				//DBG_8192C("After DIV=>CurByteCnt = %lld\n", CurByteCnt);
+				//DBG_8192C("PreByteCnt = %lld\n",PreByteCnt);		
+
+				if(pHalData->RSSI_cnt_A > 0)
+					RSSI_A = pHalData->RSSI_sum_A/pHalData->RSSI_cnt_A; 
+				else
+					RSSI_A = 0;
+				if(pHalData->RSSI_cnt_B > 0)
+					RSSI_B = pHalData->RSSI_sum_B/pHalData->RSSI_cnt_B; 
+				else
+					RSSI_B = 0;
+				
+				curRSSI = (pDM_SWAT_Table->CurAntenna == Antenna_A)? RSSI_A : RSSI_B;
+				pDM_SWAT_Table->PreRSSI =  (pDM_SWAT_Table->CurAntenna == Antenna_A)? RSSI_B : RSSI_A;
+				//DBG_8192C("Luke:PreRSSI = %d, CurRSSI = %d\n",pDM_SWAT_Table->PreRSSI, curRSSI);
+				//DBG_8192C("SWAS: preAntenna= %s, curAntenna= %s \n", 
+				//(pDM_SWAT_Table->PreAntenna == Antenna_A?"A":"B"), (pDM_SWAT_Table->CurAntenna == Antenna_A?"A":"B"));
+				//DBG_8192C("Luke:RSSI_A= %d, RSSI_cnt_A = %d, RSSI_B= %d, RSSI_cnt_B = %d\n",
+					//RSSI_A, pHalData->RSSI_cnt_A, RSSI_B, pHalData->RSSI_cnt_B);
+			}
+
+			}
+			else
+			{
+		
+			if(pHalData->RSSI_cnt_A > 0)
+				RSSI_A = pHalData->RSSI_sum_A/pHalData->RSSI_cnt_A; 
+			else
+				RSSI_A = 0;
+			if(pHalData->RSSI_cnt_B > 0)
+				RSSI_B = pHalData->RSSI_sum_B/pHalData->RSSI_cnt_B; 
+			else
+				RSSI_B = 0;
+			curRSSI = (pDM_SWAT_Table->CurAntenna == Antenna_A)? RSSI_A : RSSI_B;
+			pDM_SWAT_Table->PreRSSI =  (pDM_SWAT_Table->PreAntenna == Antenna_A)? RSSI_A : RSSI_B;
+			//DBG_8192C("Ekul:PreRSSI = %d, CurRSSI = %d\n", pDM_SWAT_Table->PreRSSI, curRSSI);
+			//DBG_8192C("SWAS: preAntenna= %s, curAntenna= %s \n", 
+			//(pDM_SWAT_Table->PreAntenna == Antenna_A?"A":"B"), (pDM_SWAT_Table->CurAntenna == Antenna_A?"A":"B"));
+
+			//DBG_8192C("Ekul:RSSI_A= %d, RSSI_cnt_A = %d, RSSI_B= %d, RSSI_cnt_B = %d\n",
+			//	RSSI_A, pHalData->RSSI_cnt_A, RSSI_B, pHalData->RSSI_cnt_B);
+			//RT_TRACE(COMP_SWAS, DBG_LOUD, ("Ekul:curTxOkCnt = %d\n", curTxOkCnt));
+			//RT_TRACE(COMP_SWAS, DBG_LOUD, ("Ekul:curRxOkCnt = %d\n", curRxOkCnt));
+			}
+
+		//1 Trying State
+		if((pDM_SWAT_Table->try_flag == 1)&&(pDM_SWAT_Table->RSSI_Trying == 0))
+		{
+
+			if(pDM_SWAT_Table->TestMode == TP_MODE)
+			{
+				//DBG_8192C("SWAS: TestMode = TP_MODE\n");
+				//DBG_8192C("TRY:CurByteCnt = %lld\n", CurByteCnt);
+				//DBG_8192C("TRY:PreByteCnt = %lld\n",PreByteCnt);		
+				if(CurByteCnt < PreByteCnt)
+				{
+					if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+						pDM_SWAT_Table->SelectAntennaMap=pDM_SWAT_Table->SelectAntennaMap<<1;
+					else
+						pDM_SWAT_Table->SelectAntennaMap=(pDM_SWAT_Table->SelectAntennaMap<<1)+1;
+				}
+				else
+				{
+					if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+						pDM_SWAT_Table->SelectAntennaMap=(pDM_SWAT_Table->SelectAntennaMap<<1)+1;
+					else
+						pDM_SWAT_Table->SelectAntennaMap=pDM_SWAT_Table->SelectAntennaMap<<1;
+				}
+				for (i= 0; i<8; i++)
+				{
+					if(((pDM_SWAT_Table->SelectAntennaMap>>i)&BIT0) == 1)
+						Score_A++;
+					else
+						Score_B++;
+				}
+				//DBG_8192C("SelectAntennaMap=%x\n ",pDM_SWAT_Table->SelectAntennaMap);
+				//DBG_8192C("Score_A=%d, Score_B=%d\n", Score_A, Score_B);
+				
+				if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+				{
+					nextAntenna = (Score_A > Score_B)?Antenna_A:Antenna_B;
+				}
+				else
+				{
+					nextAntenna = (Score_B > Score_A)?Antenna_B:Antenna_A;
+				}
+				//RT_TRACE(COMP_SWAS, DBG_LOUD, ("nextAntenna=%s\n",(nextAntenna==Antenna_A)?"A":"B"));
+				//RT_TRACE(COMP_SWAS, DBG_LOUD, ("preAntenna= %s, curAntenna= %s \n", 
+					//(DM_SWAT_Table.PreAntenna == Antenna_A?"A":"B"), (DM_SWAT_Table.CurAntenna == Antenna_A?"A":"B")));
+
+				if(nextAntenna != pDM_SWAT_Table->CurAntenna)
+				{
+					//DBG_8192C("SWAS: Switch back to another antenna\n");
+				}
+				else
+				{
+					//DBG_8192C("SWAS: current anntena is good\n");
+				}	
+			}
+
+			if(pDM_SWAT_Table->TestMode == RSSI_MODE)
+			{	
+				//DBG_8192C("SWAS: TestMode = RSSI_MODE\n");
+				pDM_SWAT_Table->SelectAntennaMap=0xAA;
+				if(curRSSI < pDM_SWAT_Table->PreRSSI) //Current antenna is worse than previous antenna
+				{
+					//DBG_8192C("SWAS: Switch back to another antenna\n");
+					nextAntenna = (pDM_SWAT_Table->CurAntenna == Antenna_A)? Antenna_B : Antenna_A;
+				}
+				else // current anntena is good
+				{
+					nextAntenna = pDM_SWAT_Table->CurAntenna;
+					//DBG_8192C("SWAS: current anntena is good\n");
+				}
+				}
+				pDM_SWAT_Table->try_flag = 0;
+				pHalData->RSSI_test = _FALSE;
+				pHalData->RSSI_sum_A = 0;
+				pHalData->RSSI_cnt_A = 0;
+				pHalData->RSSI_sum_B = 0;
+				pHalData->RSSI_cnt_B = 0;
+				pdmpriv->TXByteCnt_A = 0;
+				pdmpriv->TXByteCnt_B = 0;
+				pdmpriv->RXByteCnt_A = 0;
+				pdmpriv->RXByteCnt_B = 0;
+			
+			}
+
+		//1 Normal State
+		else if(pDM_SWAT_Table->try_flag == 0)
+			{
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				{
+				if(((curTxOkCnt+curRxOkCnt)>>1) > 1875000)
+					pdmpriv->TrafficLoad = TRAFFIC_HIGH;
+				else
+					pdmpriv->TrafficLoad = TRAFFIC_LOW;
+			}
+			else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+				{
+				if(((curTxOkCnt+curRxOkCnt)>>1) > 1875000)
+					pdmpriv->TrafficLoad = TRAFFIC_HIGH;
+				else
+					pdmpriv->TrafficLoad = TRAFFIC_LOW;
+			}
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				pDM_SWAT_Table->bTriggerAntennaSwitch = 0;
+			//DBG_8192C("Normal:TrafficLoad = %lld\n", curTxOkCnt+curRxOkCnt);
+
+			//Prepare To Try Antenna		
+					nextAntenna = (pDM_SWAT_Table->CurAntenna == Antenna_A)? Antenna_B : Antenna_A;
+					pDM_SWAT_Table->try_flag = 1;
+					pHalData->RSSI_test = _TRUE;
+			if((curRxOkCnt+curTxOkCnt) > 1000)
+			{
+				pDM_SWAT_Table->RSSI_Trying = 4;
+				pDM_SWAT_Table->TestMode = TP_MODE;
+				}
+				else
+				{
+				pDM_SWAT_Table->RSSI_Trying = 2;
+				pDM_SWAT_Table->TestMode = RSSI_MODE;
+
+			}
+			//DBG_8192C("SWAS: Normal State -> Begin Trying! TestMode=%s\n",(pDM_SWAT_Table->TestMode == TP_MODE)?"TP":"RSSI");
+			
+			
+			pHalData->RSSI_sum_A = 0;
+			pHalData->RSSI_cnt_A = 0;
+			pHalData->RSSI_sum_B = 0;
+			pHalData->RSSI_cnt_B = 0;
+		}
+	}
+
+	//1 4.Change TRX antenna
+	if(nextAntenna != pDM_SWAT_Table->CurAntenna)
+	{
+		//DBG_8192C("@@@@@@@@ SWAS: Change TX Antenna!\n ");		
+		rtw_antenna_select_cmd(Adapter, nextAntenna, 1);
+	}
+
+	//1 5.Reset Statistics
+	pDM_SWAT_Table->PreAntenna = pDM_SWAT_Table->CurAntenna;
+	pDM_SWAT_Table->CurAntenna = nextAntenna;
+	pDM_SWAT_Table->PreRSSI = curRSSI;
+
+
+	//1 6.Set next timer
+
+	if(pDM_SWAT_Table->RSSI_Trying == 0)
+		return;
+
+	if(pDM_SWAT_Table->RSSI_Trying%2 == 0)
+	{
+		if(pDM_SWAT_Table->TestMode == TP_MODE)
+		{
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+			{
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer,10 ); //ms
+				//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 10 ms\n");
+			}
+			else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+			{
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer, 50 ); //ms
+				//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 50 ms\n");
+			}
+	}
+	else
+	{
+			_set_timer(&pdmpriv->SwAntennaSwitchTimer, 500 ); //ms
+			//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 500 ms\n");
+		}
+	}
+	else
+	{
+		if(pDM_SWAT_Table->TestMode == TP_MODE)
+		{
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)			
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer,90 ); //ms			
+			else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer,100 ); //ms
+		}
+		else
+		{
+			_set_timer(&pdmpriv->SwAntennaSwitchTimer,500 ); //ms
+			//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 500 ms\n");
+		}
+	}
+
+//	RT_TRACE(COMP_SWAS, DBG_LOUD, ("SWAS: -----The End-----\n "));
+
+}
+
+//
+// 20100514 Luke/Joseph:
+// Callback function for 500ms antenna test trying.
+//
+static void dm_SW_AntennaSwitchCallback(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+
+	if(padapter->net_closed == _TRUE)
+			return;
+	// Only 
+	dm_SW_AntennaSwitch(padapter, SWAW_STEP_DETERMINE);
+}
+
+
+//
+// 20100722
+// This function is used to gather the RSSI information for antenna testing.
+// It selects the RSSI of the peer STA that we want to know.
+//
+void SwAntDivRSSICheck8192C(_adapter *padapter ,u32 RxPWDBAll)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);	
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	SWAT_T	*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||pHalData->AntDivCfg==0)
+		return;
+	
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)		
+	{			
+		if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+		{			
+			pHalData->RSSI_sum_A += RxPWDBAll;
+			pHalData->RSSI_cnt_A++;
+		}
+		else
+		{
+			pHalData->RSSI_sum_B+= RxPWDBAll;
+			pHalData->RSSI_cnt_B++;
+		
+		}
+		//DBG_8192C("%s Ant_(%s),RSSI_sum(%d),RSSI_cnt(%d)\n",__FUNCTION__,(2==pHalData->CurAntenna)?"A":"B",pHalData->RSSI_sum,pHalData->RSSI_cnt);
+	}
+	
+}
+
+
+
+static VOID
+dm_SW_AntennaSwitchInit(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T	*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	pHalData->RSSI_sum_A = 0;	
+	pHalData->RSSI_sum_B = 0;
+	pHalData->RSSI_cnt_A = 0;
+	pHalData->RSSI_cnt_B = 0;
+
+	pDM_SWAT_Table->CurAntenna = pHalData->CurAntenna;
+	pDM_SWAT_Table->PreAntenna = pHalData->CurAntenna;
+	pDM_SWAT_Table->try_flag = 0xff;
+	pDM_SWAT_Table->PreRSSI = 0;
+	pDM_SWAT_Table->bTriggerAntennaSwitch = 0;	
+	pDM_SWAT_Table->SelectAntennaMap=0xAA;
+	
+	// Move the timer initialization to InitializeVariables function.
+	//PlatformInitializeTimer(Adapter, &pMgntInfo->SwAntennaSwitchTimer, (RT_TIMER_CALL_BACK)dm_SW_AntennaSwitchCallback, NULL, "SwAntennaSwitchTimer");	
+}
+
+#endif
+
+//#define	RSSI_CCK	0
+//#define	RSSI_OFDM	1
+static void dm_RSSIMonitorInit(
+	IN	PADAPTER	Adapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	pdmpriv->OFDM_Pkt_Cnt = 0;
+	pdmpriv->RSSI_Select = RSSI_DEFAULT;
+}
+
+static void dm_RSSIMonitorCheck(
+	IN	PADAPTER	Adapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE)
+		return;
+		
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE |WIFI_ADHOC_STATE) == _TRUE )
+	{
+		if(Adapter->stapriv.asoc_sta_count < 2)
+			return;			
+	}		
+	
+	if(pdmpriv->OFDM_Pkt_Cnt == 0)
+		pdmpriv->RSSI_Select = RSSI_CCK;
+	else
+		pdmpriv->RSSI_Select = RSSI_OFDM;
+
+	pdmpriv->OFDM_Pkt_Cnt = 0;	
+	//DBG_8192C("RSSI_Select=%s OFDM_Pkt_Cnt(%d)\n",
+		//(pdmpriv->RSSI_Select == RSSI_OFDM)?"RSSI_OFDM":"RSSI_CCK",
+		//pdmpriv->OFDM_Pkt_Cnt);
+}
+
+//============================================================
+// functions
+//============================================================
+void rtl8192c_init_dm_priv(IN PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	//_rtw_memset(pdmpriv, 0, sizeof(struct dm_priv));
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_init_timer(&(pdmpriv->SwAntennaSwitchTimer),  Adapter->pnetdev , dm_SW_AntennaSwitchCallback, Adapter);
+#endif
+#endif
+}
+
+void rtl8192c_deinit_dm_priv(IN PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	_cancel_timer_ex(&pdmpriv->SwAntennaSwitchTimer);
+#endif
+}
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+void dm_InitHybridAntDiv(IN PADAPTER Adapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||pHalData->AntDivCfg==0)
+		return;
+	
+	//Set OFDM HW RX Antenna Diversity
+	PHY_SetBBReg(Adapter,0xc50, BIT7, 1); //Enable Hardware antenna switch
+	PHY_SetBBReg(Adapter,0x870, BIT9|BIT8, 0); //Enable hardware control of "ANT_SEL" & "ANT_SELB"
+	PHY_SetBBReg(Adapter,0xCA4, BIT11, 0); //Switch to another antenna by checking pwdb threshold
+	PHY_SetBBReg(Adapter,0xCA4, 0x7FF, 0x080); //Pwdb threshold=8dB
+	PHY_SetBBReg(Adapter,0xC54, BIT23, 1); //Decide final antenna by comparing 2 antennas' pwdb
+	PHY_SetBBReg(Adapter,0x874, BIT23, 0); //No update ANTSEL during GNT_BT=1
+	PHY_SetBBReg(Adapter,0x80C, BIT21, 1); //TX atenna selection from tx_info
+	//Set CCK HW RX Antenna Diversity
+	PHY_SetBBReg(Adapter,0xA00, BIT15, 1);//Enable antenna diversity
+	PHY_SetBBReg(Adapter,0xA0C, BIT4, 0); //Antenna diversity decision period = 32 sample
+	PHY_SetBBReg(Adapter,0xA0C, 0xf, 0xf); //Threshold for antenna diversity. Check another antenna power if input power < ANT_lim*4
+	PHY_SetBBReg(Adapter,0xA10, BIT13, 1); //polarity ana_A=1 and ana_B=0
+	PHY_SetBBReg(Adapter,0xA14, 0x1f, 0x8); //default antenna power = inpwr*(0.5 + r_ant_step/16)
+	
+	pHalData->CCK_Ant1_Cnt = 0;
+	pHalData->CCK_Ant2_Cnt = 0;
+	pHalData->OFDM_Ant1_Cnt = 0;
+	pHalData->OFDM_Ant2_Cnt = 0;
+}
+
+
+#define 	RxDefaultAnt1		0x65a9
+#define	RxDefaultAnt2		0x569a
+
+void dm_SelectRXDefault(IN	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	
+	if(IS_92C_SERIAL(pHalData->VersionID) ||pHalData->AntDivCfg==0)
+		return;
+	
+	//DbgPrint(" Ant1_Cnt=%d, Ant2_Cnt=%d\n", pHalData->Ant1_Cnt, pHalData->Ant2_Cnt);
+	//DBG_8192C(" CCK_Ant1_Cnt = %d,  CCK_Ant2_Cnt = %d\n", pHalData->CCK_Ant1_Cnt, pHalData->CCK_Ant2_Cnt);
+	//DBG_8192C(" OFDM_Ant1_Cnt = %d,  OFDM_Ant2_Cnt = %d\n", pHalData->OFDM_Ant1_Cnt, pHalData->OFDM_Ant2_Cnt);
+	if((pHalData->OFDM_Ant1_Cnt == 0) && (pHalData->OFDM_Ant2_Cnt == 0)) 
+	{
+		if((pHalData->CCK_Ant1_Cnt + pHalData->CCK_Ant2_Cnt) >=10 )
+		{
+			if(pHalData->CCK_Ant1_Cnt > (5*pHalData->CCK_Ant2_Cnt))
+			{
+				DBG_8192C(" RX Default = Ant1\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt1);
+			}
+			else if(pHalData->CCK_Ant2_Cnt > (5*pHalData->CCK_Ant1_Cnt))
+			{
+				DBG_8192C(" RX Default = Ant2\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt2);
+			}
+			else if(pHalData->CCK_Ant1_Cnt > pHalData->CCK_Ant2_Cnt)
+			{
+				DBG_8192C(" RX Default = Ant2\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt2);
+			}
+			else
+			{
+				DBG_8192C(" RX Default = Ant1\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt1);
+			}
+			pHalData->CCK_Ant1_Cnt = 0;
+			pHalData->CCK_Ant2_Cnt = 0;
+			pHalData->OFDM_Ant1_Cnt = 0;
+			pHalData->OFDM_Ant2_Cnt = 0;
+		}
+	}
+	else
+	{
+		if(pHalData->OFDM_Ant1_Cnt > pHalData->OFDM_Ant2_Cnt)
+		{
+			DBG_8192C(" RX Default = Ant1\n");
+			PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt1);
+		}
+		else
+		{
+			DBG_8192C(" RX Default = Ant2\n");
+			PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt2);
+		}
+		pHalData->CCK_Ant1_Cnt = 0;
+		pHalData->CCK_Ant2_Cnt = 0;
+		pHalData->OFDM_Ant1_Cnt = 0;
+		pHalData->OFDM_Ant2_Cnt = 0;
+	}
+
+
+}
+
+#endif
+
+void
+rtl8192c_InitHalDm(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	i;
+
+#ifdef CONFIG_USB_HCI
+	dm_InitGPIOSetting(Adapter);
+#endif
+
+	pdmpriv->DM_Type = DM_Type_ByDriver;	
+	pdmpriv->DMFlag = DYNAMIC_FUNC_DISABLE;
+	pdmpriv->UndecoratedSmoothedPWDB = (-1);
+	pdmpriv->UndecoratedSmoothedCCK = (-1);
+	
+	
+	//.1 DIG INIT
+	pdmpriv->bDMInitialGainEnable = _TRUE;
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_DIG;
+	dm_DIGInit(Adapter);
+
+	//.2 DynamicTxPower INIT
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_HP;
+	dm_InitDynamicTxPower(Adapter);
+
+	//.3
+	DM_InitEdcaTurbo(Adapter);
+
+	//.4 RateAdaptive INIT
+	dm_InitRateAdaptiveMask(Adapter);
+
+	//.5 Tx Power Tracking Init.
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_SS;
+	DM_InitializeTXPowerTracking(Adapter);
+
+#ifdef CONFIG_BT_COEXIST
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_BT;
+	dm_InitBtCoexistDM(Adapter);
+#endif
+
+	dm_InitDynamicBBPowerSaving(Adapter);
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_ANT_DIV;
+	dm_SW_AntennaSwitchInit(Adapter);
+#endif
+
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_ANT_DIV;
+	dm_InitHybridAntDiv(Adapter);
+#endif
+
+	dm_RSSIMonitorInit(Adapter);
+
+	pdmpriv->DMFlag_tmp = pdmpriv->DMFlag;
+
+	// Save REG_INIDATA_RATE_SEL value for TXDESC.
+	for(i = 0 ; i<32 ; i++)
+	{
+		pdmpriv->INIDATA_RATE[i] = rtw_read8(Adapter, REG_INIDATA_RATE_SEL+i) & 0x3f;
+	}
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_ADAPTIVITY;
+	dm_adaptivity_init(Adapter);
+#endif
+
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+static void FindMinimumRSSI(PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE	pbuddy_HalData;
+	struct dm_priv *pbuddy_dmpriv;
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+	struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
+
+	if(!rtw_buddy_adapter_up(Adapter))
+		return;
+	
+	pbuddy_HalData = GET_HAL_DATA(pbuddy_adapter);
+	pbuddy_dmpriv = &pbuddy_HalData->dmpriv;
+
+	//get min. [PWDB] when both interfaces are connected
+	if((check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE 
+		&& Adapter->stapriv.asoc_sta_count > 2 
+		&& check_buddy_fwstate(Adapter, _FW_LINKED)) || 
+		(check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE 
+		&& pbuddy_adapter->stapriv.asoc_sta_count > 2
+		&& check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_STATION_STATE) 
+		&& check_fwstate(pmlmepriv, _FW_LINKED)
+		&& check_buddy_fwstate(Adapter,WIFI_STATION_STATE) 
+		&& check_buddy_fwstate(Adapter,_FW_LINKED)))
+	{
+		if(pdmpriv->UndecoratedSmoothedPWDB > pbuddy_dmpriv->UndecoratedSmoothedPWDB)
+			pdmpriv->UndecoratedSmoothedPWDB = pbuddy_dmpriv->UndecoratedSmoothedPWDB;
+	}//primary interface is not connected
+	else if((check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE 
+		&& pbuddy_adapter->stapriv.asoc_sta_count > 2) || 
+		(check_buddy_fwstate(Adapter,WIFI_STATION_STATE) 
+		&& check_buddy_fwstate(Adapter,_FW_LINKED)))
+	{
+		pdmpriv->UndecoratedSmoothedPWDB = pbuddy_dmpriv->UndecoratedSmoothedPWDB;
+	}
+	//secondary is not connected
+	else if((check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE 
+		&& Adapter->stapriv.asoc_sta_count > 2) || 
+		(check_fwstate(pmlmepriv, WIFI_STATION_STATE) 
+		&& check_fwstate(pmlmepriv, _FW_LINKED)))
+	{
+		pbuddy_dmpriv->UndecoratedSmoothedPWDB = 0;
+	}
+	//both interfaces are not connected
+	else
+	{
+		pdmpriv->UndecoratedSmoothedPWDB = 0;
+		pbuddy_dmpriv->UndecoratedSmoothedPWDB = 0;
+	}
+		
+	//primary interface is ap mode
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE && Adapter->stapriv.asoc_sta_count > 2)
+	{
+		pbuddy_dmpriv->EntryMinUndecoratedSmoothedPWDB = 0;
+	}//secondary interface is ap mode
+	else if(check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE && pbuddy_adapter->stapriv.asoc_sta_count > 2)
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = pbuddy_dmpriv->EntryMinUndecoratedSmoothedPWDB;
+	}
+	else //both interfaces are not ap mode
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = pbuddy_dmpriv->EntryMinUndecoratedSmoothedPWDB = 0;
+	}
+
+} 
+
+#endif //CONFIG_CONCURRENT_MODE
+
+VOID
+rtl8192c_HalDmWatchDog(
+	IN	PADAPTER	Adapter
+	)
+{
+	BOOLEAN		bFwCurrentInPSMode = _FALSE;
+	BOOLEAN		bFwPSAwake = _TRUE;
+	u8 hw_init_completed = _FALSE;
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+#endif //CONFIG_CONCURRENT_MODE
+
+	#if defined(CONFIG_CONCURRENT_MODE)
+	if (Adapter->isprimary == _FALSE && pbuddy_adapter) {
+		hw_init_completed = pbuddy_adapter->hw_init_completed;
+	} else
+	#endif
+	{
+		hw_init_completed = Adapter->hw_init_completed;
+	}
+
+	if (hw_init_completed == _FALSE)
+		goto skip_dm;
+
+#ifdef CONFIG_LPS
+	#if defined(CONFIG_CONCURRENT_MODE)
+	if (Adapter->iface_type != IFACE_PORT0 && pbuddy_adapter) {
+		bFwCurrentInPSMode = pbuddy_adapter->pwrctrlpriv.bFwCurrentInPSMode;
+		rtw_hal_get_hwreg(pbuddy_adapter, HW_VAR_FWLPS_RF_ON, (u8 *)(&bFwPSAwake));
+	} else
+	#endif
+	{
+		bFwCurrentInPSMode = Adapter->pwrctrlpriv.bFwCurrentInPSMode;
+		rtw_hal_get_hwreg(Adapter, HW_VAR_FWLPS_RF_ON, (u8 *)(&bFwPSAwake));
+	}
+#endif
+
+#ifdef CONFIG_P2P_PS
+	// Fw is under p2p powersaving mode, driver should stop dynamic mechanism.
+	// modifed by thomas. 2011.06.11.
+	if(Adapter->wdinfo.p2p_ps_mode)
+		bFwPSAwake = _FALSE;
+#endif // CONFIG_P2P_PS
+
+	// Stop dynamic mechanism when:
+	// 1. RF is OFF. (No need to do DM.)
+	// 2. Fw is under power saving mode for FwLPS. (Prevent from SW/FW I/O racing.)
+	// 3. IPS workitem is scheduled. (Prevent from IPS sequence to be swapped with DM.
+	//     Sometimes DM execution time is longer than 100ms such that the assertion
+	//     in MgntActSet_RF_State() called by InactivePsWorkItem will be triggered by 
+	//     wating to long for RFChangeInProgress.)
+	// 4. RFChangeInProgress is TRUE. (Prevent from broken by IPS/HW/SW Rf off.)
+	// Noted by tynli. 2010.06.01.
+	//if(rfState == eRfOn)
+	if( (hw_init_completed == _TRUE) 
+		&& ((!bFwCurrentInPSMode) && bFwPSAwake))
+	{
+		//
+		// Calculate Tx/Rx statistics.
+		//
+		dm_CheckStatistics(Adapter);
+
+		//
+		// For PWDB monitor and record some value for later use.
+		//
+		PWDB_Monitor(Adapter);
+
+		dm_RSSIMonitorCheck(Adapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(Adapter->adapter_type > PRIMARY_ADAPTER)
+			goto _record_initrate;
+
+		FindMinimumRSSI(Adapter);
+#endif
+
+		//
+		// Dynamic Initial Gain mechanism.
+		//
+		dm_FalseAlarmCounterStatistics(Adapter);
+		dm_DIG(Adapter);
+		dm_adaptivity(Adapter);
+
+		//
+		//Dynamic BB Power Saving Mechanism
+		//
+		dm_DynamicBBPowerSaving(Adapter);
+
+		//
+		// Dynamic Tx Power mechanism.
+		//
+		dm_DynamicTxPower(Adapter);
+
+		//
+		// Tx Power Tracking.
+		//
+#if MP_DRIVER == 0
+#ifdef CONFIG_BUSY_TRAFFIC_SKIP_PWR_TRACK
+		if(pmlmepriv->LinkDetectInfo.bBusyTraffic == _FALSE)
+#endif //CONFIG_BUSY_TRAFFIC_SKIP_PWR_TRACK
+#endif
+			rtl8192c_dm_CheckTXPowerTracking(Adapter);
+
+		//
+		// Rate Adaptive by Rx Signal Strength mechanism.
+		//
+		dm_RefreshRateAdaptiveMask(Adapter);
+
+#ifdef CONFIG_BT_COEXIST
+		//BT-Coexist
+		dm_BTCoexist(Adapter);
+#endif
+
+		// EDCA turbo
+		//update the EDCA paramter according to the Tx/RX mode
+		//update_EDCA_param(Adapter);
+		dm_CheckEdcaTurbo(Adapter);
+
+		//
+		// Dynamically switch RTS/CTS protection.
+		//
+		//dm_CheckProtection(Adapter);
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+		//
+		// Software Antenna diversity
+		//
+		dm_SW_AntennaSwitch(Adapter, SWAW_STEP_PEAK);
+#endif
+
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+		//Hybrid Antenna Diversity
+		dm_SelectRXDefault(Adapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+		// 20100630 Joseph: Disable Interrupt Migration mechanism temporarily because it degrades Rx throughput.
+		// Tx Migration settings.
+		//dm_InterruptMigration(Adapter);
+
+		//if(Adapter->HalFunc.TxCheckStuckHandler(Adapter))
+		//	PlatformScheduleWorkItem(&(GET_HAL_DATA(Adapter)->HalResetWorkItem));
+#endif
+
+
+_record_initrate:
+
+		// Read REG_INIDATA_RATE_SEL value for TXDESC.
+		if(check_fwstate(&Adapter->mlmepriv, WIFI_STATION_STATE) == _TRUE)
+		{
+			pdmpriv->INIDATA_RATE[0] = rtw_read8(Adapter, REG_INIDATA_RATE_SEL) & 0x3f;
+
+#ifdef CONFIG_TDLS
+			if(Adapter->tdlsinfo.setup_state == TDLS_LINKED_STATE)
+			{
+				u8 i=1;
+				for(; i < (Adapter->tdlsinfo.macid_index) ; i++)
+				{
+					pdmpriv->INIDATA_RATE[i] = rtw_read8(Adapter, (REG_INIDATA_RATE_SEL+i)) & 0x3f;
+				}
+			}
+#endif //CONFIG_TDLS
+
+		}
+		else
+		{
+			u8	i;
+			for(i=1 ; i < (Adapter->stapriv.asoc_sta_count + 1); i++)
+			{
+				pdmpriv->INIDATA_RATE[i] = rtw_read8(Adapter, (REG_INIDATA_RATE_SEL+i)) & 0x3f;
+			}
+		}
+	}
+
+skip_dm:
+
+	// Check GPIO to determine current RF on/off and Pbc status.
+	// Check Hardware Radio ON/OFF or not	
+	//if(Adapter->MgntInfo.PowerSaveControl.bGpioRfSw)
+	//{
+		//RTPRINT(FPWR, PWRHW, ("dm_CheckRfCtrlGPIO \n"));
+	//	dm_CheckRfCtrlGPIO(Adapter);
+	//}
+
+#ifdef CONFIG_PCI_HCI
+	if(pHalData->bGpioHwWpsPbc)
+#endif
+	{
+		dm_CheckPbcGPIO(Adapter);				// Add by hpfan 2008-03-11
+	}
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c
new file mode 100755
index 0000000000000..b9e91d70ce21c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c
@@ -0,0 +1,3628 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#define _RTL8192C_HAL_INIT_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+#include <rtw_efuse.h>
+
+#include <rtl8192c_hal.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_hal.h>
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_hal.h>
+#endif
+
+static BOOLEAN
+hal_EfusePgPacketWrite2ByteHeader(
+	IN	PADAPTER		pAdapter,
+	IN	u8				efuseType,
+	IN	u16				*pAddr,
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	BOOLEAN			bPseudoTest);
+static BOOLEAN
+hal_EfusePgPacketWrite1ByteHeader(
+	IN	PADAPTER		pAdapter, 
+	IN	u8				efuseType,
+	IN	u16				*pAddr,
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	BOOLEAN			bPseudoTest);
+static BOOLEAN
+hal_EfusePgPacketWriteData(
+	IN	PADAPTER		pAdapter, 
+	IN	u8				efuseType,
+	IN	u16				*pAddr,
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	BOOLEAN			bPseudoTest);
+static BOOLEAN 
+hal_EfusePgPacketWrite_BT(
+	IN	PADAPTER		pAdapter, 
+	IN	u8				offset,
+	IN	u8				word_en,
+	IN	u8				*pData,
+	IN	BOOLEAN			bPseudoTest);
+
+static VOID
+_FWDownloadEnable(
+	IN	PADAPTER		Adapter,
+	IN	BOOLEAN			enable
+	)
+{
+	u8	tmp;
+
+	if(enable)
+	{
+		#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+		{
+			u8 val;
+			if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+				DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+		}
+		#endif
+	
+		// 8051 enable
+		tmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, tmp|0x04);
+
+		// MCU firmware download enable.
+		tmp = rtw_read8(Adapter, REG_MCUFWDL);
+		rtw_write8(Adapter, REG_MCUFWDL, tmp|0x01);
+
+		// 8051 reset
+		tmp = rtw_read8(Adapter, REG_MCUFWDL+2);
+		rtw_write8(Adapter, REG_MCUFWDL+2, tmp&0xf7);
+	}
+	else
+	{
+		// MCU firmware download enable.
+		tmp = rtw_read8(Adapter, REG_MCUFWDL);
+		rtw_write8(Adapter, REG_MCUFWDL, tmp&0xfe);
+
+		// Reserved for fw extension.
+		rtw_write8(Adapter, REG_MCUFWDL+1, 0x00);
+	}
+}
+
+
+#define MAX_REG_BOLCK_SIZE	196
+#define MIN_REG_BOLCK_SIZE	8
+
+static int
+_BlockWrite(
+	IN		PADAPTER		Adapter,
+	IN		PVOID		buffer,
+	IN		u32			size
+	)
+{
+	int ret = _SUCCESS;
+
+#ifdef CONFIG_PCI_HCI
+	u32			blockSize	= sizeof(u32);	// Use 4-byte write to download FW
+	u8			*bufferPtr	= (u8 *)buffer;
+	u32			*pu4BytePtr	= (u32 *)buffer;
+	u32			i, offset, blockCount, remainSize;
+	u8			remainFW[4] = {0, 0, 0, 0};
+	u8			*p = NULL;
+
+	blockCount = size / blockSize;
+	remainSize = size % blockSize;
+
+	for(i = 0 ; i < blockCount ; i++){
+		offset = i * blockSize;
+		rtw_write32(Adapter, (FW_8192C_START_ADDRESS + offset), cpu_to_le32(*(pu4BytePtr + i)));
+	}
+
+	p = (u8*)((u32*)(bufferPtr + blockCount * blockSize));
+	if(remainSize){
+		switch (remainSize) {
+		case 0:
+			break;
+		case 3:
+			remainFW[2]=*(p+2);
+		case 2: 	
+			remainFW[1]=*(p+1);
+		case 1: 	
+			remainFW[0]=*(p);
+			ret = rtw_write32(Adapter, (FW_8192C_START_ADDRESS + blockCount * blockSize), 
+				 le32_to_cpu(*(u32*)remainFW));	
+		}
+		return ret;
+	}
+#else
+  
+#ifdef SUPPORTED_BLOCK_IO
+	u32			blockSize	= MAX_REG_BOLCK_SIZE;	// Use 196-byte write to download FW	
+	u32			blockSize2  	= MIN_REG_BOLCK_SIZE;	
+#else
+	u32			blockSize	= sizeof(u32);	// Use 4-byte write to download FW
+	u32*		pu4BytePtr	= (u32*)buffer;
+	u32			blockSize2  	= sizeof(u8);
+#endif
+	u8*			bufferPtr	= (u8*)buffer;
+	u32			i, offset = 0, offset2, blockCount, remainSize, remainSize2;
+
+	blockCount = size / blockSize;
+	remainSize = size % blockSize;
+
+	for(i = 0 ; i < blockCount ; i++){
+		offset = i * blockSize;
+		#ifdef SUPPORTED_BLOCK_IO
+		ret = rtw_writeN(Adapter, (FW_8192C_START_ADDRESS + offset), blockSize, (bufferPtr + offset));
+		#else
+		ret = rtw_write32(Adapter, (FW_8192C_START_ADDRESS + offset), le32_to_cpu(*(pu4BytePtr + i)));
+		#endif
+
+		if(ret == _FAIL)
+			goto exit;
+	}
+
+	if(remainSize){
+		#if defined(SUPPORTED_BLOCK_IO) && defined(DBG_BLOCK_WRITE_ISSUE) //Can this be enabled?
+		offset = blockCount * blockSize;
+		ret = rtw_writeN(Adapter, (FW_8192C_START_ADDRESS + offset), remainSize, (bufferPtr + offset));
+		goto exit;
+		#endif
+		offset2 = blockCount * blockSize;		
+		blockCount = remainSize / blockSize2;
+		remainSize2 = remainSize % blockSize2;
+
+		for(i = 0 ; i < blockCount ; i++){
+			offset = offset2 + i * blockSize2;
+			#ifdef SUPPORTED_BLOCK_IO
+			ret = rtw_writeN(Adapter, (FW_8192C_START_ADDRESS + offset), blockSize2, (bufferPtr + offset));
+			#else
+			ret = rtw_write8(Adapter, (FW_8192C_START_ADDRESS + offset ), *(bufferPtr + offset));
+			#endif
+
+			if(ret == _FAIL)
+				goto exit;
+		}		
+
+		if(remainSize2)
+		{
+			offset += blockSize2;
+			bufferPtr += offset;
+			
+			for(i = 0 ; i < remainSize2 ; i++){
+				ret = rtw_write8(Adapter, (FW_8192C_START_ADDRESS + offset + i), *(bufferPtr + i));
+
+				if(ret == _FAIL)
+					goto exit;
+			}
+		}
+	}
+#endif
+
+exit:
+	return ret;
+}
+
+static int
+_PageWrite(
+	IN		PADAPTER	Adapter,
+	IN		u32			page,
+	IN		PVOID		buffer,
+	IN		u32			size
+	)
+{
+	u8 value8;
+	u8 u8Page = (u8) (page & 0x07) ;
+
+	value8 = (rtw_read8(Adapter, REG_MCUFWDL+2)& 0xF8 ) | u8Page ;
+	rtw_write8(Adapter, REG_MCUFWDL+2,value8);
+	return _BlockWrite(Adapter,buffer,size);
+}
+
+static VOID
+_FillDummy(
+	u8*		pFwBuf,
+	u32*	pFwLen
+	)
+{
+	u32	FwLen = *pFwLen;
+	u8	remain = (u8)(FwLen%4);
+	remain = (remain==0)?0:(4-remain);
+
+	while(remain>0)
+	{
+		pFwBuf[FwLen] = 0;
+		FwLen++;
+		remain--;
+	}
+
+	*pFwLen = FwLen;
+}
+
+static int
+_WriteFW(
+	IN		PADAPTER		Adapter,
+	IN		PVOID			buffer,
+	IN		u32			size
+	)
+{
+	// Since we need dynamic decide method of dwonload fw, so we call this function to get chip version.
+	// We can remove _ReadChipVersion from ReadAdapterInfo8192C later.
+
+	int ret = _SUCCESS;
+	u32 	pageNums,remainSize ;
+	u32 	page,offset;
+	u8*	bufferPtr = (u8*)buffer;
+
+#ifdef CONFIG_PCI_HCI
+	// 20100120 Joseph: Add for 88CE normal chip. 
+	// Fill in zero to make firmware image to dword alignment.
+//		_FillDummy(bufferPtr, &size);
+#endif
+
+	pageNums = size / MAX_PAGE_SIZE ;		
+	//RT_ASSERT((pageNums <= 4), ("Page numbers should not greater then 4 \n"));			
+	remainSize = size % MAX_PAGE_SIZE;		
+	
+	for(page = 0; page < pageNums;  page++){
+		offset = page *MAX_PAGE_SIZE;
+		ret = _PageWrite(Adapter,page, (bufferPtr+offset),MAX_PAGE_SIZE);			
+		
+		if(ret == _FAIL)
+			goto exit;
+	}
+	if(remainSize){
+		offset = pageNums *MAX_PAGE_SIZE;
+		page = pageNums;
+		ret = _PageWrite(Adapter,page, (bufferPtr+offset),remainSize);
+
+		if(ret == _FAIL)
+			goto exit;
+	}	
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("_WriteFW Done- for Normal chip.\n"));
+
+exit:
+	return ret;
+}
+
+static int _FWFreeToGo(
+	IN		PADAPTER		Adapter
+	)
+{
+	u32			counter = 0;
+	u32			value32;
+	u32	restarted = _FALSE;
+	
+	// polling CheckSum report
+	do{
+		value32 = rtw_read32(Adapter, REG_MCUFWDL);
+	}while((counter ++ < POLLING_READY_TIMEOUT_COUNT) && (!(value32 & FWDL_ChkSum_rpt)));	
+
+	if(counter >= POLLING_READY_TIMEOUT_COUNT){	
+		DBG_8192C("chksum report faill ! REG_MCUFWDL:0x%08x\n",value32);
+		return _FAIL;
+	} else {
+		//DBG_8192C("chksum report success ! REG_MCUFWDL:0x%08x, counter:%u\n",value32, counter);
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Checksum report OK ! REG_MCUFWDL:0x%08x .\n",value32));
+
+
+	value32 = rtw_read32(Adapter, REG_MCUFWDL);
+	value32 |= MCUFWDL_RDY;
+	value32 &= ~WINTINI_RDY;
+	rtw_write32(Adapter, REG_MCUFWDL, value32);
+	
+
+POLLING_FW_READY:	
+	// polling for FW ready
+	counter = 0;
+	do
+	{
+		if(rtw_read32(Adapter, REG_MCUFWDL) & WINTINI_RDY){
+			//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("Polling FW ready success!! REG_MCUFWDL:0x%08x .\n",PlatformIORead4Byte(Adapter, REG_MCUFWDL)) );
+			return _SUCCESS;
+		}
+		rtw_udelay_os(5);
+	}while(counter++ < POLLING_READY_TIMEOUT_COUNT);
+
+	DBG_8192C("Polling FW ready fail!! REG_MCUFWDL:0x%08x .\n", rtw_read32(Adapter, REG_MCUFWDL));
+
+	if(restarted == _FALSE) {
+		u8 tmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		DBG_8192C("Reset 51 write8 REG_SYS_FUNC_EN:0x%04x\n", tmp & ~BIT2);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, tmp & ~BIT2);
+		DBG_8192C("Reset 51 write8 REG_SYS_FUNC_EN:0x%04x\n", tmp|BIT2);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, tmp|BIT2);
+		restarted = _TRUE;
+		goto POLLING_FW_READY;
+	}
+		
+	
+	return _FAIL;
+	
+}
+
+
+VOID
+rtl8192c_FirmwareSelfReset(
+	IN		PADAPTER		Adapter
+)
+{
+	u8	u1bTmp;
+	u8	Delay = 100;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+		
+	if((pHalData->FirmwareVersion > 0x21) ||
+		(pHalData->FirmwareVersion == 0x21 &&
+		pHalData->FirmwareSubVersion >= 0x01)) // after 88C Fw v33.1
+	{
+		//0x1cf=0x20. Inform 8051 to reset. 2009.12.25. tynli_test
+		rtw_write8(Adapter, REG_HMETFR+3, 0x20);
+	
+		u1bTmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		while(u1bTmp&BIT2)
+		{
+			Delay--;
+			if(Delay == 0)
+				break;
+			rtw_udelay_os(50);
+			u1bTmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		}
+
+		if((u1bTmp&BIT2) && (Delay == 0))
+		{
+			DBG_8192C("FirmwareDownload92C():fw reset by itself Fail!!!!!! 0x03 = %x\n", u1bTmp);
+			//RT_ASSERT(FALSE, ("PowerOffAdapter8192CE(): 0x03 = %x\n", u1bTmp));
+			#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+			{
+				u8 val;
+				if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+					DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+			}
+			#endif
+			rtw_write8(Adapter,REG_SYS_FUNC_EN+1,(rtw_read8(Adapter, REG_SYS_FUNC_EN+1)&~BIT2));
+		}
+
+		DBG_8192C("%s =====> 8051 reset success (%d) .\n", __FUNCTION__ ,Delay);
+	}
+}
+
+#ifdef CONFIG_FILE_FWIMG
+extern char *rtw_fw_file_path;
+u8	FwBuffer8192C[FW_8192C_SIZE];
+#endif //CONFIG_FILE_FWIMG
+//
+//	Description:
+//		Download 8192C firmware code.
+//
+//
+int FirmwareDownload92C(
+	IN	PADAPTER			Adapter,
+	IN	BOOLEAN			bUsedWoWLANFw
+)
+{	
+	int	rtStatus = _SUCCESS;	
+	u8 writeFW_retry = 0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	s8 			R92CFwImageFileName_TSMC[] ={RTL8192C_FW_TSMC_IMG};
+	s8 			R92CFwImageFileName_UMC[] ={RTL8192C_FW_UMC_IMG};
+	s8 			R92CFwImageFileName_UMC_B[] ={RTL8192C_FW_UMC_B_IMG};
+#ifdef CONFIG_WOWLAN
+	s8 			R92CFwImageFileName_TSMC_WW[] ={RTL8192C_FW_TSMC_WW_IMG};
+	s8 			R92CFwImageFileName_UMC_WW[] ={RTL8192C_FW_UMC_WW_IMG};
+	s8 			R92CFwImageFileName_UMC_B_WW[] ={RTL8192C_FW_UMC_B_WW_IMG};
+#endif //CONFIG_WOWLAN
+	
+	//s8 			R8723FwImageFileName_UMC[] ={RTL8723_FW_UMC_IMG};
+	u8*			FwImage = NULL;
+	u32			FwImageLen = 0;
+	char*		pFwImageFileName;	
+#ifdef CONFIG_WOWLAN
+	u8*			FwImageWoWLAN;
+	u32			FwImageWoWLANLen;
+	char*		pFwImageFileName_WoWLAN;
+#endif	//CONFIG_WOWLAN
+	u8*			pucMappedFile = NULL;
+	//vivi, merge 92c and 92s into one driver, 20090817
+	//vivi modify this temply, consider it later!!!!!!!!
+	//PRT_FIRMWARE	pFirmware = GET_FIRMWARE_819X(Adapter);	
+	//PRT_FIRMWARE_92C	pFirmware = GET_FIRMWARE_8192C(Adapter);
+	PRT_FIRMWARE_92C	pFirmware = NULL;
+	PRT_8192C_FIRMWARE_HDR		pFwHdr = NULL;
+	u8		*pFirmwareBuf;
+	u32		FirmwareLen;
+
+	pFirmware = (PRT_FIRMWARE_92C)rtw_zvmalloc(sizeof(RT_FIRMWARE_92C));
+	
+	if(!pFirmware)
+	{
+		rtStatus = _FAIL;
+		goto Exit;
+	}
+
+	if(IS_VENDOR_UMC_A_CUT(pHalData->VersionID) && !IS_92C_SERIAL(pHalData->VersionID))
+	{
+		pFwImageFileName = R92CFwImageFileName_UMC;
+		FwImage = Rtl819XFwUMCACutImageArray;
+		FwImageLen = UMCACutImgArrayLength;
+#ifdef CONFIG_WOWLAN
+		pFwImageFileName_WoWLAN = R92CFwImageFileName_UMC_WW;
+		FwImageWoWLAN= Rtl8192C_FwUMCWWImageArray;
+		FwImageWoWLANLen =UMCACutWWImgArrayLength ;
+#endif	//CONFIG_WOWLAN		
+		DBG_8192C(" ===> FirmwareDownload91C() fw:Rtl819XFwImageArray_UMC\n");
+	}
+	else if(IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+	{
+		// The ROM code of UMC B-cut Fw is the same as TSMC. by tynli. 2011.01.14.
+		pFwImageFileName = R92CFwImageFileName_UMC_B;
+		FwImage = Rtl819XFwUMCBCutImageArray;
+		FwImageLen = UMCBCutImgArrayLength;
+#ifdef CONFIG_WOWLAN
+		pFwImageFileName_WoWLAN = R92CFwImageFileName_UMC_B_WW;
+		FwImageWoWLAN= Rtl8192C_FwUMCBCutWWImageArray;
+		FwImageWoWLANLen =UMCBCutWWImgArrayLength ;
+#endif //CONFIG_WOWLAN
+		
+		DBG_8192C(" ===> FirmwareDownload91C() fw:Rtl819XFwImageArray_UMC_B\n");
+	}
+	else
+	{
+		pFwImageFileName = R92CFwImageFileName_TSMC;
+		FwImage = Rtl819XFwTSMCImageArray;
+		FwImageLen = TSMCImgArrayLength;
+#ifdef CONFIG_WOWLAN
+		pFwImageFileName_WoWLAN = R92CFwImageFileName_TSMC_WW;
+		FwImageWoWLAN= Rtl8192C_FwTSMCWWImageArray;
+		FwImageWoWLANLen =TSMCWWImgArrayLength ;
+#endif //CONFIG_WOWLAN
+		DBG_8192C(" ===> FirmwareDownload91C() fw:Rtl819XFwImageArray_TSMC\n");
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" ===> FirmwareDownload91C() fw:%s\n", pFwImageFileName));
+
+	#ifdef CONFIG_FILE_FWIMG
+	if(rtw_is_file_readable(rtw_fw_file_path) == _TRUE)
+	{
+		DBG_871X("%s accquire FW from file:%s\n", __FUNCTION__, rtw_fw_file_path);
+		pFirmware->eFWSource = FW_SOURCE_IMG_FILE; // We should decided by Reg.
+	}
+	else
+	#endif //CONFIG_FILE_FWIMG
+	{
+		DBG_871X("%s accquire FW from embedded image\n", __FUNCTION__);
+		pFirmware->eFWSource = FW_SOURCE_HEADER_FILE;
+	}
+
+
+	switch(pFirmware->eFWSource)
+	{
+		case FW_SOURCE_IMG_FILE:
+			
+			#ifdef CONFIG_FILE_FWIMG
+			rtStatus = rtw_retrive_from_file(rtw_fw_file_path, FwBuffer8192C, FW_8192C_SIZE);
+			pFirmware->ulFwLength = rtStatus>=0?rtStatus:0;
+			pFirmware->szFwBuffer = FwBuffer8192C;
+			#endif //CONFIG_FILE_FWIMG
+
+			if(pFirmware->ulFwLength <= 0)
+			{
+				rtStatus = _FAIL;
+				goto Exit;
+			}
+			break;
+		case FW_SOURCE_HEADER_FILE:
+			if(FwImageLen > FW_8192C_SIZE){
+				rtStatus = _FAIL;
+				//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("Firmware size exceed 0x%X. Check it.\n", FW_8192C_SIZE) );
+				DBG_871X("Firmware size exceed 0x%X. Check it.\n", FW_8192C_SIZE);
+				goto Exit;
+			}
+
+			pFirmware->szFwBuffer = FwImage;
+			pFirmware->ulFwLength = FwImageLen;
+#ifdef CONFIG_WOWLAN
+			{
+				pFirmware->szWoWLANFwBuffer=FwImageWoWLAN;
+				pFirmware->ulWoWLANFwLength = FwImageWoWLANLen;
+			}
+#endif //CONFIG_WOWLAN
+			
+			break;
+	}
+
+#ifdef CONFIG_WOWLAN	
+	if(bUsedWoWLANFw)	{		
+		pFirmwareBuf = pFirmware->szWoWLANFwBuffer;		
+		FirmwareLen = pFirmware->ulWoWLANFwLength;		
+		pFwHdr = (PRT_8192C_FIRMWARE_HDR)pFirmware->szWoWLANFwBuffer;	
+	}	
+	else
+#endif	//CONFIG_WOWLAN
+	{	
+	#ifdef DBG_FW_STORE_FILE_PATH //used to store firmware to file...
+	if(pFirmware->ulFwLength > 0)
+	{
+		rtw_store_to_file(DBG_FW_STORE_FILE_PATH, pFirmware->szFwBuffer, pFirmware->ulFwLength);
+	}
+	#endif
+
+	pFirmwareBuf = pFirmware->szFwBuffer;
+	FirmwareLen = pFirmware->ulFwLength;
+
+	// To Check Fw header. Added by tynli. 2009.12.04.
+	pFwHdr = (PRT_8192C_FIRMWARE_HDR)pFirmware->szFwBuffer;
+	}
+	pHalData->FirmwareVersion =  le16_to_cpu(pFwHdr->Version); 
+	pHalData->FirmwareSubVersion = le16_to_cpu(pFwHdr->Subversion); 
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" FirmwareVersion(%#x), Signature(%#x)\n", 
+	//	Adapter->MgntInfo.FirmwareVersion, pFwHdr->Signature));
+
+	DBG_8192C("fw_ver=v%d, fw_subver=%d, sig=0x%x\n", 
+		pHalData->FirmwareVersion, pHalData->FirmwareSubVersion, le16_to_cpu(pFwHdr->Signature)&0xFFF0);
+
+	if(IS_FW_HEADER_EXIST(pFwHdr))
+	{
+		//RT_TRACE(COMP_INIT, DBG_LOUD,("Shift 32 bytes for FW header!!\n"));
+		pFirmwareBuf = pFirmwareBuf + 32;
+		FirmwareLen = FirmwareLen -32;
+	}
+		
+	// Suggested by Filen. If 8051 is running in RAM code, driver should inform Fw to reset by itself,
+	// or it will cause download Fw fail. 2010.02.01. by tynli.
+	if(rtw_read8(Adapter, REG_MCUFWDL)&BIT7) //8051 RAM code
+	{	
+		rtl8192c_FirmwareSelfReset(Adapter);
+		rtw_write8(Adapter, REG_MCUFWDL, 0x00);		
+	}
+
+		
+	_FWDownloadEnable(Adapter, _TRUE);
+	while(1) {
+		u8 tmp8;
+		tmp8 = rtw_read8(Adapter, REG_MCUFWDL);
+		
+		//reset the FWDL chksum
+		rtw_write8(Adapter, REG_MCUFWDL, tmp8|FWDL_ChkSum_rpt);
+		
+		//tmp8 = rtw_read8(Adapter, REG_MCUFWDL);
+		//DBG_8192C("Before _WriteFW, REG_MCUFWDL:0x%02x, writeFW_retry:%u\n", tmp8, writeFW_retry);
+		
+		rtStatus = _WriteFW(Adapter, pFirmwareBuf, FirmwareLen);
+		
+		//tmp8 = rtw_read8(Adapter, REG_MCUFWDL);
+		//DBG_8192C("After _WriteFW, REG_MCUFWDL:0x%02x, rtStatus:%d\n", tmp8, rtStatus);
+
+		if(rtStatus == _SUCCESS || ++writeFW_retry>3)
+			break;
+	} 
+	_FWDownloadEnable(Adapter, _FALSE);
+
+	if(_SUCCESS != rtStatus){
+		DBG_8192C("DL Firmware failed!\n");
+		goto Exit;
+	}
+
+	rtStatus = _FWFreeToGo(Adapter);
+	if(_SUCCESS != rtStatus){
+		DBG_8192C("DL Firmware failed!\n");
+		goto Exit;
+	}	
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" Firmware is ready to run!\n"));
+
+Exit:
+
+	if(pFirmware) {
+		rtw_vmfree((u8*)pFirmware, sizeof(RT_FIRMWARE_92C));
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" <=== FirmwareDownload91C()\n"));
+	return rtStatus;
+
+}
+
+VOID
+InitializeFirmwareVars92C(
+	IN	PADAPTER		Adapter
+)
+{
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(Adapter);
+
+	// Init Fw LPS related.
+	Adapter->pwrctrlpriv.bFwCurrentInPSMode = _FALSE;
+
+	//Init H2C counter. by tynli. 2009.12.09.
+	pHalData->LastHMEBoxNum = 0;
+}
+
+#ifdef CONFIG_WOWLAN
+//===========================================
+
+//
+// Description: Prepare some information to Fw for WoWLAN.
+//			(1) Download wowlan Fw.
+//			(2) Download RSVD page packets.
+//			(3) Enable AP offload if needed.
+//
+// 2011.04.12 by tynli.
+//
+VOID
+SetFwRelatedForWoWLAN8192CU(
+	IN	PADAPTER			padapter,
+	IN	u8			bHostIsGoingtoSleep
+)
+{	
+	int	status=_FAIL;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	u8	 bRecover = _FALSE;
+	
+	if(bHostIsGoingtoSleep)
+	{
+		//
+		// 1. Before WoWLAN we need to re-download WoWLAN Fw.
+		//
+		status = FirmwareDownload92C(padapter, bHostIsGoingtoSleep);
+		if(status != _SUCCESS)
+		{
+			DBG_8192C("ConfigFwRelatedForWoWLAN8192CU(): Re-Download Firmware failed!!\n");
+			return;
+		}
+		else
+		{
+			DBG_8192C("ConfigFwRelatedForWoWLAN8192CU(): Re-Download Firmware Success !!\n");
+		}
+
+		//
+		// 2. Re-Init the variables about Fw related setting.
+		//
+		InitializeFirmwareVars92C(padapter);
+
+		
+	}
+}
+#endif // CONFIG_WOWLAN
+
+#ifdef CONFIG_BT_COEXIST
+static void _update_bt_param(_adapter *padapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	struct registry_priv	*registry_par = &padapter->registrypriv;
+
+	if(2 != registry_par->bt_iso)
+		pbtpriv->BT_Ant_isolation = registry_par->bt_iso;// 0:Low, 1:High, 2:From Efuse
+
+	if(registry_par->bt_sco == 1) // 0:Idle, 1:None-SCO, 2:SCO, 3:From Counter, 4.Busy, 5.OtherBusy
+		pbtpriv->BT_Service = BT_OtherAction;
+	else if(registry_par->bt_sco==2)
+		pbtpriv->BT_Service = BT_SCO;
+	else if(registry_par->bt_sco==4)
+		pbtpriv->BT_Service = BT_Busy;
+	else if(registry_par->bt_sco==5)
+		pbtpriv->BT_Service = BT_OtherBusy;		
+	else
+		pbtpriv->BT_Service = BT_Idle;
+
+	pbtpriv->BT_Ampdu = registry_par->bt_ampdu;
+	pbtpriv->bCOBT = _TRUE;
+#if 1
+	DBG_8192C("BT Coexistance = %s\n", (pbtpriv->BT_Coexist==_TRUE)?"enable":"disable");
+	if(pbtpriv->BT_Coexist)
+	{
+		if(pbtpriv->BT_Ant_Num == Ant_x2)
+		{
+			DBG_8192C("BlueTooth BT_Ant_Num = Antx2\n");
+		}
+		else if(pbtpriv->BT_Ant_Num == Ant_x1)
+		{
+			DBG_8192C("BlueTooth BT_Ant_Num = Antx1\n");
+		}
+		switch(pbtpriv->BT_CoexistType)
+		{
+			case BT_2Wire:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_2Wire\n");
+				break;
+			case BT_ISSC_3Wire:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_ISSC_3Wire\n");
+				break;
+			case BT_Accel:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_Accel\n");
+				break;
+			case BT_CSR_BC4:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_CSR_BC4\n");
+				break;
+			case BT_RTL8756:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_RTL8756\n");
+				break;
+			default:
+				DBG_8192C("BlueTooth BT_CoexistType = Unknown\n");
+				break;
+		}
+		DBG_8192C("BlueTooth BT_Ant_isolation = %d\n", pbtpriv->BT_Ant_isolation);
+
+
+		switch(pbtpriv->BT_Service)
+		{
+			case BT_OtherAction:
+				DBG_8192C("BlueTooth BT_Service = BT_OtherAction\n");
+				break;
+			case BT_SCO:
+				DBG_8192C("BlueTooth BT_Service = BT_SCO\n");
+				break;
+			case BT_Busy:
+				DBG_8192C("BlueTooth BT_Service = BT_Busy\n");
+				break;
+			case BT_OtherBusy:
+				DBG_8192C("BlueTooth BT_Service = BT_OtherBusy\n");
+				break;			
+			default:
+				DBG_8192C("BlueTooth BT_Service = BT_Idle\n");
+				break;
+		}
+
+		DBG_8192C("BT_RadioSharedType = 0x%x\n", pbtpriv->BT_RadioSharedType);
+	}
+#endif
+
+}
+
+
+#define GET_BT_COEXIST(priv) (&priv->bt_coexist)
+
+void rtl8192c_ReadBluetoothCoexistInfo(
+	IN	PADAPTER	Adapter,	
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	u8	rf_opt4;
+
+	if(AutoloadFail){
+		pbtpriv->BT_Coexist = _FALSE;
+		pbtpriv->BT_CoexistType= BT_2Wire;
+		pbtpriv->BT_Ant_Num = Ant_x2;
+		pbtpriv->BT_Ant_isolation= 0;
+		pbtpriv->BT_RadioSharedType = BT_Radio_Shared;		
+		return;
+	}
+
+	pbtpriv->BT_Coexist = (((PROMContent[EEPROM_RF_OPT1]&BOARD_TYPE_NORMAL_MASK)>>5) == BOARD_USB_COMBO)?_TRUE:_FALSE;	// bit [7:5]
+	rf_opt4 = PROMContent[EEPROM_RF_OPT4];
+	pbtpriv->BT_CoexistType 		= ((rf_opt4&0xe)>>1);			// bit [3:1]
+	pbtpriv->BT_Ant_Num 		= (rf_opt4&0x1);				// bit [0]
+	pbtpriv->BT_Ant_isolation 	= ((rf_opt4&0x10)>>4);			// bit [4]
+	pbtpriv->BT_RadioSharedType 	= ((rf_opt4&0x20)>>5);			// bit [5]
+
+	_update_bt_param(Adapter);
+
+}
+#endif
+
+VERSION_8192C
+rtl8192c_ReadChipVersion(
+	IN	PADAPTER	Adapter
+	)
+{
+	u32			value32;
+	//VERSION_8192C	version;
+	u32			ChipVersion=0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	value32 = rtw_read32(Adapter, REG_SYS_CFG);
+
+	if (value32 & TRP_VAUX_EN)
+	{
+#if 0
+		// Test chip.
+		if(IS_HARDWARE_TYPE_8723A(Adapter)) {
+			ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+			ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.			
+		}
+		else	 {
+		version = (value32 & TYPE_ID) ?VERSION_TEST_CHIP_92C :VERSION_TEST_CHIP_88C;		
+	}
+#else
+		// tynli_test. 2011.01.10.
+		if(IS_HARDWARE_TYPE_8192C(Adapter))
+		{
+			ChipVersion = (value32 & TYPE_ID) ? VERSION_TEST_CHIP_92C : VERSION_TEST_CHIP_88C;						
+		}
+		else
+		{
+			ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+			ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.			
+		}
+#endif
+	}
+	else
+	{
+#if 0
+		// Normal mass production chip.
+		ChipVersion = NORMAL_CHIP;
+#if !RTL8723_FPGA_TRUE_PHY_VERIFICATION
+		ChipVersion |= ((value32 & TYPE_ID) ? CHIP_92C : 0);
+#endif
+		ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+		ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.
+		if(IS_8723_SERIES(ChipVersion))
+		{
+			if(IS_VENDOR_UMC(ChipVersion))
+				ChipVersion |= ((value32 & CHIP_VER_RTL_MASK) ? CHIP_VENDOR_UMC_B_CUT : 0);
+		}
+		else
+		{
+			// Mark out by tynli. UMC B-cut IC will not set the SYS_CFG[19] to UMC
+			// because we do not want the custmor to know. 2011.01.11.
+			//if(IS_VENDOR_UMC(ChipVersion))
+			{
+				// To check the value of B-cut. by tynli. 2011.01.11.
+				u1bTmp = (u1Byte)((value32 & CHIP_VER_RTL_MASK)>>12);
+				if(u1bTmp == 1)
+				{	// B-cut
+					ChipVersion |= CHIP_VENDOR_UMC_B_CUT;
+				}
+			}
+		}
+#else
+		// Normal mass production chip.
+		ChipVersion = NORMAL_CHIP;
+//#if !RTL8723_FPGA_TRUE_PHY_VERIFICATION
+		ChipVersion |= ((value32 & TYPE_ID) ? RF_TYPE_2T2R : 0); //92c
+//#endif
+		ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+		ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.
+		if(IS_HARDWARE_TYPE_8192C(Adapter))
+		{
+			// 88/92C UMC B-cut IC will not set the SYS_CFG[19] to UMC
+			// because we do not want the custmor to know. by tynli. 2011.01.17.
+			//MSG_8192C("mask result = 0x%x is_UMC %d chipversion 0x%x\n", (value32 & CHIP_VER_RTL_MASK), IS_CHIP_VENDOR_UMC(ChipVersion), ChipVersion);
+			if((!IS_CHIP_VENDOR_UMC(ChipVersion) )&& (value32 & CHIP_VER_RTL_MASK))
+			{
+				//MSG_8192C("chip mask result = 0x%x\n", ((value32 & CHIP_VER_RTL_MASK) | CHIP_VENDOR_UMC));
+				ChipVersion |= ((value32 & CHIP_VER_RTL_MASK) | CHIP_VENDOR_UMC); // IC version (CUT)
+				//MSG_8192C("chip version = 0x%x\n", ChipVersion);
+			}
+		}
+		else
+		{
+			if(IS_CHIP_VENDOR_UMC(ChipVersion))
+				ChipVersion |= ((value32 & CHIP_VER_RTL_MASK)); // IC version (CUT)
+		}
+
+		if(IS_92C_SERIAL(ChipVersion))
+		{
+			value32 = rtw_read32(Adapter, REG_HPON_FSM);
+			ChipVersion |= ((CHIP_BONDING_IDENTIFIER(value32) == CHIP_BONDING_92C_1T2R) ? RF_TYPE_1T2R : 0);			
+		}
+		else if(IS_8723_SERIES(ChipVersion))
+		{
+			//RT_ASSERT(IS_HARDWARE_TYPE_8723A(Adapter), ("Incorrect chip version!!\n"));
+			value32 = rtw_read32(Adapter, REG_GPIO_OUTSTS);
+			ChipVersion |= ((value32 & RF_RL_ID)>>20);	 //ROM code version.	
+		}
+#endif
+
+	}
+
+	//version = (VERSION_8192C)ChipVersion;
+
+	// For multi-function consideration. Added by Roger, 2010.10.06.
+	if(IS_8723_SERIES(ChipVersion))
+	{
+		pHalData->MultiFunc = RT_MULTI_FUNC_NONE;
+		value32 = rtw_read32(Adapter, REG_MULTI_FUNC_CTRL);
+		pHalData->MultiFunc =(RT_MULTI_FUNC) (pHalData->MultiFunc| ((value32 & WL_FUNC_EN) ?  RT_MULTI_FUNC_WIFI : 0) );
+		pHalData->MultiFunc =(RT_MULTI_FUNC) (pHalData->MultiFunc| ((value32 & BT_FUNC_EN) ?  RT_MULTI_FUNC_BT : 0) );
+		pHalData->MultiFunc =(RT_MULTI_FUNC) (pHalData->MultiFunc| ((value32 & GPS_FUNC_EN) ?  RT_MULTI_FUNC_GPS : 0) );
+		pHalData->PolarityCtl = ((value32 & WL_HWPDN_SL) ?  RT_POLARITY_HIGH_ACT : RT_POLARITY_LOW_ACT);
+		//MSG_8192C("ReadChipVersion(): MultiFunc(%x), PolarityCtl(%x) \n", pHalData->MultiFunc, pHalData->PolarityCtl);
+
+		//For regulator mode. by tynli. 2011.01.14
+		pHalData->RegulatorMode = ((value32 & TRP_BT_EN) ? RT_LDO_REGULATOR : RT_SWITCHING_REGULATOR);
+		//MSG_8192C("ReadChipVersion(): RegulatorMode(%x) \n", pHalData->RegulatorMode);
+	}
+
+//#if DBG
+#if 1
+	switch(ChipVersion)
+	{
+		case VERSION_NORMAL_TSMC_CHIP_92C_1T2R:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_TSMC_CHIP_92C_1T2R.\n");
+			break;
+		case VERSION_NORMAL_TSMC_CHIP_92C:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_TSMC_CHIP_92C.\n");
+			break;
+		case VERSION_NORMAL_TSMC_CHIP_88C:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_TSMC_CHIP_88C.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_88C_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_88C_A_CUT.\n");
+			break;			
+		case VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_B_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_88C_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_88C_B_CUT.\n");
+			break;
+		case VERSION_TEST_CHIP_92C:
+			MSG_8192C("Chip Version ID: VERSION_TEST_CHIP_92C.\n");
+			break;
+		case VERSION_TEST_CHIP_88C:
+			MSG_8192C("Chip Version ID: VERSION_TEST_CHIP_88C.\n");
+			break;
+		case VERSION_TEST_UMC_CHIP_8723:
+			MSG_8192C("Chip Version ID: VERSION_TEST_UMC_CHIP_8723.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_8723_1T1R_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMA_UMC_CHIP_8723_1T1R_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_8723_1T1R_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMA_UMC_CHIP_8723_1T1R_B_CUT.\n");
+			break;			
+		default:
+			MSG_8192C("Chip Version ID: ???????????????.\n");
+			break;
+	}
+#endif
+
+	pHalData->VersionID = ChipVersion;
+
+	if(IS_1T2R(ChipVersion))
+		pHalData->rf_type = RF_1T2R;
+	else if(IS_2T2R(ChipVersion))
+		pHalData->rf_type = RF_2T2R;
+	else if(IS_8723_SERIES(ChipVersion))
+		pHalData->rf_type = RF_1T1R;
+	else
+		pHalData->rf_type = RF_1T1R;
+
+	MSG_8192C("RF_Type is %x!!\n", pHalData->rf_type);
+
+	return ChipVersion;
+}
+
+void
+rtl8192c_EfuseParseChnlPlan(
+	IN	PADAPTER		padapter,
+	IN	u8*			hwinfo,
+	IN	BOOLEAN			AutoLoadFail
+	)
+{
+	padapter->mlmepriv.ChannelPlan = hal_com_get_channel_plan(
+		padapter
+		, hwinfo?hwinfo[EEPROM_CHANNEL_PLAN]:0xFF
+		, padapter->registrypriv.channel_plan
+		, RT_CHANNEL_DOMAIN_WORLD_WIDE_13
+		, AutoLoadFail
+	);
+
+	DBG_871X("mlmepriv.ChannelPlan = 0x%02x\n", padapter->mlmepriv.ChannelPlan);
+}
+
+u8 GetEEPROMSize8192C(PADAPTER Adapter)
+{
+	u8	size = 0;
+	u32	curRCR;
+
+	curRCR = rtw_read16(Adapter, REG_9346CR);
+	size = (curRCR & BOOT_FROM_EEPROM) ? 6 : 4; // 6: EEPROM used is 93C46, 4: boot from E-Fuse.
+	
+	MSG_8192C("EEPROM type is %s\n", size==4 ? "E-FUSE" : "93C46");
+	
+	return size;
+}
+
+void rtl8192c_free_hal_data(_adapter * padapter)
+{
+_func_enter_;
+
+	DBG_8192C("=====> rtl8192c_free_hal_data =====\n");
+
+	if(padapter->HalData)
+		rtw_mfree(padapter->HalData, sizeof(HAL_DATA_TYPE));
+	DBG_8192C("<===== rtl8192c_free_hal_data =====\n");
+
+_func_exit_;
+}
+
+//===========================================================
+//				Efuse related code
+//===========================================================
+enum{
+		VOLTAGE_V25						= 0x03,
+		LDOE25_SHIFT						= 28 ,
+	};
+
+static VOID
+hal_EfusePowerSwitch_RTL8192C(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	u8	tempval;
+	u16	tmpV16;
+
+	if (PwrState == _TRUE)
+	{
+		// 1.2V Power: From VDDON with Power Cut(0x0000h[15]), defualt valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_ISO_CTRL);
+		if( ! (tmpV16 & PWC_EV12V ) ){
+			tmpV16 |= PWC_EV12V ;
+			rtw_write16(pAdapter,REG_SYS_ISO_CTRL,tmpV16);
+		}
+		// Reset: 0x0000h[28], default valid
+		tmpV16 =  rtw_read16(pAdapter,REG_SYS_FUNC_EN);
+		if( !(tmpV16 & FEN_ELDR) ){
+			tmpV16 |= FEN_ELDR ;
+			rtw_write16(pAdapter,REG_SYS_FUNC_EN,tmpV16);
+		}
+
+		// Clock: Gated(0x0008h[5]) 8M(0x0008h[1]) clock from ANA, default valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_CLKR);
+		if( (!(tmpV16 & LOADER_CLK_EN) )  ||(!(tmpV16 & ANA8M) ) ){
+			tmpV16 |= (LOADER_CLK_EN |ANA8M ) ;
+			rtw_write16(pAdapter,REG_SYS_CLKR,tmpV16);
+		}
+
+		if(bWrite == _TRUE)
+		{
+			// Enable LDO 2.5V before read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			tempval &= 0x0F;
+			tempval |= (VOLTAGE_V25 << 4);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval | 0x80));
+		}
+	}
+	else
+	{
+		if(bWrite == _TRUE){
+			// Disable LDO 2.5V after read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval & 0x7F));
+		}
+	}
+}
+
+static VOID
+hal_EfusePowerSwitch_RTL8723(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	u8	tempval;
+	u16	tmpV16;
+
+	if (PwrState == _TRUE)
+	{
+		rtw_write8(pAdapter, REG_EFUSE_ACCESS, EFUSE_ACCESS_ON);	
+
+		// 1.2V Power: From VDDON with Power Cut(0x0000h[15]), defualt valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_ISO_CTRL);
+		if( ! (tmpV16 & PWC_EV12V ) ){
+			tmpV16 |= PWC_EV12V ;
+			 rtw_write16(pAdapter,REG_SYS_ISO_CTRL,tmpV16);
+		}
+		// Reset: 0x0000h[28], default valid
+		tmpV16 =  rtw_read16(pAdapter,REG_SYS_FUNC_EN);
+		if( !(tmpV16 & FEN_ELDR) ){
+			tmpV16 |= FEN_ELDR ;
+			rtw_write16(pAdapter,REG_SYS_FUNC_EN,tmpV16);
+		}
+
+		// Clock: Gated(0x0008h[5]) 8M(0x0008h[1]) clock from ANA, default valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_CLKR);
+		if( (!(tmpV16 & LOADER_CLK_EN) )  ||(!(tmpV16 & ANA8M) ) ){
+			tmpV16 |= (LOADER_CLK_EN |ANA8M ) ;
+			rtw_write16(pAdapter,REG_SYS_CLKR,tmpV16);
+		}
+
+		if(bWrite == _TRUE)
+		{
+			// Enable LDO 2.5V before read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			tempval &= 0x0F;
+			tempval |= (VOLTAGE_V25 << 4);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval | 0x80));
+		}
+	}
+	else
+	{
+		rtw_write8(pAdapter, REG_EFUSE_ACCESS, EFUSE_ACCESS_OFF);
+
+		if(bWrite == _TRUE){
+			// Disable LDO 2.5V after read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval & 0x7F));
+		}
+	}	
+}
+
+static VOID
+rtl8192c_EfusePowerSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	if(IS_HARDWARE_TYPE_8192C(pAdapter))
+	{
+		hal_EfusePowerSwitch_RTL8192C(pAdapter, bWrite, PwrState);
+	}
+	else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+	{
+		hal_EfusePowerSwitch_RTL8723(pAdapter, bWrite, PwrState);
+	}	
+}
+
+static VOID
+ReadEFuse_RTL8192C(
+	PADAPTER	Adapter,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN		bPseudoTest
+	)
+{
+	u8	efuseTbl[EFUSE_MAP_LEN];
+	u8	rtemp8[1];
+	u16 	eFuse_Addr = 0;
+	u8  	offset, wren;
+	u16	i, j;
+	u16	eFuseWord[EFUSE_MAX_SECTION][EFUSE_MAX_WORD_UNIT];
+	u16	efuse_utilized = 0;
+	u8	efuse_usage = 0;
+
+	//
+	// Do NOT excess total size of EFuse table. Added by Roger, 2008.11.10.
+	//
+	if((_offset + _size_byte)>EFUSE_MAP_LEN)
+	{// total E-Fuse table is 128bytes
+		//DBG_8192C("ReadEFuse_RTL8192C(): Invalid offset(%#x) with read bytes(%#x)!!\n",_offset, _size_byte);
+		return;
+	}
+
+	// 0. Refresh efuse init map as all oxFF.
+	for (i = 0; i < EFUSE_MAX_SECTION; i++)
+		for (j = 0; j < EFUSE_MAX_WORD_UNIT; j++)
+			eFuseWord[i][j] = 0xFFFF;
+
+
+	//
+	// 1. Read the first byte to check if efuse is empty!!!
+	// 
+	//
+	ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);	
+	if(*rtemp8 != 0xFF)
+	{
+		efuse_utilized++;
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+		eFuse_Addr++;
+	}
+
+	//
+	// 2. Read real efuse content. Filter PG header and every section data.
+	//
+	while((*rtemp8 != 0xFF) && (eFuse_Addr < EFUSE_REAL_CONTENT_LEN))
+	{
+		// Check PG header for section num.
+		offset = ((*rtemp8 >> 4) & 0x0f);
+
+		if(offset < EFUSE_MAX_SECTION)
+		{
+			// Get word enable value from PG header
+			wren = (*rtemp8 & 0x0f);
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Offset-%d Worden=%x\n", offset, wren));
+
+			for(i=0; i<EFUSE_MAX_WORD_UNIT; i++)
+			{
+				// Check word enable condition in the section				
+				if(!(wren & 0x01))
+				{
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+					ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);	eFuse_Addr++;
+					efuse_utilized++;
+					eFuseWord[offset][i] = (*rtemp8 & 0xff);
+					
+
+					if(eFuse_Addr >= EFUSE_REAL_CONTENT_LEN) 
+						break;
+
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+					ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);	eFuse_Addr++;
+					efuse_utilized++;
+					eFuseWord[offset][i] |= (((u16)*rtemp8 << 8) & 0xff00);
+
+					if(eFuse_Addr >= EFUSE_REAL_CONTENT_LEN) 
+						break;
+				}
+				
+				wren >>= 1;
+				
+			}
+		}
+
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+		// Read next PG header
+		ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);	
+		if(*rtemp8 != 0xFF && (eFuse_Addr < 512))
+		{
+			efuse_utilized++;
+			eFuse_Addr++;
+		}
+	}
+
+	//
+	// 3. Collect 16 sections and 4 word unit into Efuse map.
+	//
+	for(i=0; i<EFUSE_MAX_SECTION; i++)
+	{
+		for(j=0; j<EFUSE_MAX_WORD_UNIT; j++)
+		{
+			efuseTbl[(i*8)+(j*2)]=(eFuseWord[i][j] & 0xff);
+			efuseTbl[(i*8)+((j*2)+1)]=((eFuseWord[i][j] >> 8) & 0xff);
+		}
+	}
+
+	//
+	// 4. Copy from Efuse map to output pointer memory!!!
+	//
+	for(i=0; i<_size_byte; i++)
+	{		
+		pbuf[i] = efuseTbl[_offset+i];
+	}
+
+	//
+	// 5. Calculate Efuse utilization.
+	//
+	efuse_usage = (u8)((efuse_utilized*100)/EFUSE_REAL_CONTENT_LEN);
+	rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_utilized);
+	//rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_USAGE, (pu1Byte)&efuse_usage);
+}
+
+static VOID
+ReadEFuse_RTL8723(
+	PADAPTER	Adapter,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN		bPseudoTest
+	)
+{
+	u8	efuseTbl[EFUSE_MAP_LEN_8723];
+	u16	eFuse_Addr = 0;
+	u8	offset = 0, wden = 0;
+	u16	i, j;
+	u16	eFuseWord[EFUSE_MAX_SECTION_8723][EFUSE_MAX_WORD_UNIT];
+	u16	efuse_utilized = 0;
+	u8	efuse_usage = 0;
+	u8	offset_2_0=0;
+	u8	efuseHeader=0, efuseExtHdr=0, efuseData=0;
+	//
+	// Do NOT excess total size of EFuse table. Added by Roger, 2008.11.10.
+	//
+	if((_offset + _size_byte)>EFUSE_MAP_LEN_8723)
+	{
+		//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("ReadEFuse_RTL8723(): Invalid offset(%#x) with read bytes(%#x)!!\n",_offset, _size_byte));
+		return;
+	}
+
+	// 0. Refresh efuse init map as all oxFF.
+	for (i = 0; i < EFUSE_MAX_SECTION_8723; i++)
+		for (j = 0; j < EFUSE_MAX_WORD_UNIT; j++)
+			eFuseWord[i][j] = 0xFFFF;
+
+	//
+	// 1. Read the first byte to check if efuse is empty!!!
+	// 
+	//
+	ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+	
+	if(efuseHeader != 0xFF)
+	{
+		efuse_utilized++;
+	}
+	else
+	{
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("EFUSE is empty\n"));
+		return;
+	}
+
+
+	//
+	// 2. Read real efuse content. Filter PG header and every section data.
+	//
+	while((efuseHeader != 0xFF) && AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+	{
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseHeader));
+	
+		// Check PG header for section num.
+		if(EXT_HEADER(efuseHeader))		//extended header
+		{
+			offset_2_0 = GET_HDR_OFFSET_2_0(efuseHeader);
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("extended header offset_2_0=%x\n", offset_2_0));
+
+			ReadEFuseByte(Adapter, eFuse_Addr++, &efuseExtHdr, bPseudoTest);
+
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseExtHdr));
+
+			if(efuseExtHdr != 0xff)
+			{
+				efuse_utilized++;
+				if(ALL_WORDS_DISABLED(efuseExtHdr))
+				{
+					ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+					if(efuseHeader != 0xff)
+					{
+						efuse_utilized++;
+					}
+					continue;
+				}
+				else
+				{
+					offset = ((efuseExtHdr & 0xF0) >> 1) | offset_2_0;
+					wden = (efuseExtHdr & 0x0F);
+				}
+			}
+			else
+			{
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Error condition, extended = 0xff\n"));
+				// We should handle this condition.
+			}
+		}
+		else
+		{
+			offset = ((efuseHeader >> 4) & 0x0f);
+			wden = (efuseHeader & 0x0f);
+		}
+
+		if(offset < EFUSE_MAX_SECTION_8723)
+		{
+			// Get word enable value from PG header
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Offset-%d Worden=%x\n", offset, wden));
+
+			for(i=0; i<EFUSE_MAX_WORD_UNIT; i++)
+			{
+				// Check word enable condition in the section				
+				if(!(wden & (0x01<<i)))
+				{
+					ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseData));
+					efuse_utilized++;
+					eFuseWord[offset][i] = (efuseData & 0xff);
+
+					if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+						break;
+
+					ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseData));
+					efuse_utilized++;
+					eFuseWord[offset][i] |= (((u16)efuseData << 8) & 0xff00);
+
+					if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr)) 
+						break;
+				}
+			}
+		}
+
+		// Read next PG header
+		ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+
+		if(efuseHeader != 0xFF)
+		{
+			efuse_utilized++;
+		}
+	}
+
+	//
+	// 3. Collect 16 sections and 4 word unit into Efuse map.
+	//
+	for(i=0; i<EFUSE_MAX_SECTION_8723; i++)
+	{
+		for(j=0; j<EFUSE_MAX_WORD_UNIT; j++)
+		{
+			efuseTbl[(i*8)+(j*2)]=(eFuseWord[i][j] & 0xff);
+			efuseTbl[(i*8)+((j*2)+1)]=((eFuseWord[i][j] >> 8) & 0xff);
+		}
+	}
+
+	//
+	// 4. Copy from Efuse map to output pointer memory!!!
+	//
+	for(i=0; i<_size_byte; i++)
+	{		
+		pbuf[i] = efuseTbl[_offset+i];
+	}
+
+	//
+	// 5. Calculate Efuse utilization.
+	//
+	efuse_usage = (u8)((efuse_utilized*100)/EFUSE_REAL_CONTENT_LEN);
+	rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_utilized);
+	//rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_USAGE, (pu1Byte)&efuse_usage);
+}
+
+static BOOLEAN
+Hal_EfuseSwitchToBank(
+	IN		PADAPTER	pAdapter,
+	IN		u8			bank,
+	IN		BOOLEAN		bPseudoTest
+	)
+{
+	BOOLEAN		bRet = _FALSE;
+	u32		value32=0;
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Efuse switch bank to %d\n", bank));
+	if(bPseudoTest)
+	{
+		fakeEfuseBank = bank;
+		bRet = _TRUE;
+	}
+	else
+	{
+		if(IS_HARDWARE_TYPE_8723A(pAdapter) && 
+			INCLUDE_MULTI_FUNC_BT(pAdapter))
+		{		
+			value32 = rtw_read32(pAdapter, EFUSE_TEST);
+			bRet = _TRUE;
+			switch(bank)
+			{
+			case 0:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_WIFI_SEL_0);
+				break;
+			case 1:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_BT_SEL_0);
+				break;
+			case 2:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_BT_SEL_1);
+				break;
+			case 3:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_BT_SEL_2);
+				break;
+			default:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_WIFI_SEL_0);
+				bRet = _FALSE;
+				break;
+			}
+			rtw_write32(pAdapter, EFUSE_TEST, value32);
+		}
+		else
+			bRet = _TRUE;
+	}
+	return bRet;
+}
+
+static VOID
+ReadEFuse_BT(
+	PADAPTER	Adapter,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	)
+{
+	u8  	*efuseTbl;
+	u16 	eFuse_Addr = 0;
+	u8  	offset = 0, wden = 0;
+	u16	i, j;
+	u16 	**eFuseWord;
+	u16	efuse_utilized = 0;
+	u8	efuse_usage = 0;
+	u8	offset_2_0=0;
+	u8	efuseHeader=0, efuseExtHdr=0, efuseData=0;
+	u8	bank=0;
+	BOOLEAN	bCheckNextBank=_FALSE;
+
+	efuseTbl = rtw_malloc(EFUSE_BT_MAP_LEN);
+	if(efuseTbl == NULL){
+		DBG_8192C("efuseTbl malloc fail !\n");
+		return;
+	}
+
+	eFuseWord = (u16 **)rtw_zmalloc(sizeof(u16 *)*EFUSE_BT_MAX_SECTION);
+	if(eFuseWord == NULL){
+		DBG_8192C("eFuseWord malloc fail !\n");
+		return;
+	}
+	else{
+		for(i=0;i<EFUSE_BT_MAX_SECTION;i++){
+			eFuseWord[i]= (u16 *)rtw_zmalloc(sizeof(u16)*EFUSE_MAX_WORD_UNIT);
+			if(eFuseWord[i]==NULL){
+				DBG_8192C("eFuseWord[] malloc fail !\n");
+				return;
+			}
+		}
+	}
+
+	//
+	// Do NOT excess total size of EFuse table. Added by Roger, 2008.11.10.
+	//
+	if((_offset + _size_byte)>EFUSE_BT_MAP_LEN)
+	{
+		//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("ReadEFuse_BT(): Invalid offset(%#x) with read bytes(%#x)!!\n",_offset, _size_byte));
+		return;
+	}
+
+	// 0. Refresh efuse init map as all oxFF.
+	for (i = 0; i < EFUSE_BT_MAX_SECTION; i++)
+		for (j = 0; j < EFUSE_MAX_WORD_UNIT; j++)
+			eFuseWord[i][j] = 0xFFFF;
+
+	for(bank=1; bank<EFUSE_MAX_BANK; bank++)
+	{
+		if(!Hal_EfuseSwitchToBank(Adapter, bank, bPseudoTest))
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Hal_EfuseSwitchToBank() Fail!!\n"));
+			return;
+		}
+		eFuse_Addr = 0;
+		//
+		// 1. Read the first byte to check if efuse is empty!!!
+		// 
+		ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+		
+		if(efuseHeader != 0xFF)
+		{
+			efuse_utilized++;
+		}
+		else
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("EFUSE is empty\n"));
+			return;
+		}
+		//
+		// 2. Read real efuse content. Filter PG header and every section data.
+		//
+		while((efuseHeader != 0xFF) && AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x (header)\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseHeader));
+		
+			// Check PG header for section num.
+			if(EXT_HEADER(efuseHeader))		//extended header
+			{
+				offset_2_0 = GET_HDR_OFFSET_2_0(efuseHeader);
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("extended header offset_2_0=%x\n", offset_2_0));
+
+				ReadEFuseByte(Adapter, eFuse_Addr++, &efuseExtHdr, bPseudoTest);
+
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x (ext header)\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseExtHdr));
+
+				if(efuseExtHdr != 0xff)
+				{
+					efuse_utilized++;
+					if(ALL_WORDS_DISABLED(efuseExtHdr))
+					{
+						ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+						if(efuseHeader != 0xff)
+						{
+							efuse_utilized++;
+						}
+						continue;
+					}
+					else
+					{
+						offset = ((efuseExtHdr & 0xF0) >> 1) | offset_2_0;
+						wden = (efuseExtHdr & 0x0F);
+					}
+				}
+				else
+				{
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Error condition, extended = 0xff\n"));
+					// We should handle this condition.
+				}
+			}
+			else
+			{
+				offset = ((efuseHeader >> 4) & 0x0f);
+				wden = (efuseHeader & 0x0f);
+			}
+
+			if(offset < EFUSE_BT_MAX_SECTION)
+			{
+				// Get word enable value from PG header
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Offset-%d Worden=%x\n", offset, wden));
+
+				for(i=0; i<EFUSE_MAX_WORD_UNIT; i++)
+				{
+					// Check word enable condition in the section				
+					if(!(wden & (0x01<<i)))
+					{
+						ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+						//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseData));
+						efuse_utilized++;
+						eFuseWord[offset][i] = (efuseData & 0xff);
+
+						if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+							break;
+
+						ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+						//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseData));
+						efuse_utilized++;
+						eFuseWord[offset][i] |= (((u16)efuseData << 8) & 0xff00);
+
+						if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr)) 
+							break;
+					}
+				}
+			}
+
+			// Read next PG header
+			ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+
+			if(efuseHeader != 0xFF)
+			{
+				efuse_utilized++;
+			}
+			else
+			{
+				if((eFuse_Addr + EFUSE_PROTECT_BYTES_BANK) >= EFUSE_REAL_CONTENT_LEN)
+					bCheckNextBank = _TRUE;
+				else
+					bCheckNextBank = _FALSE;
+			}
+		}
+		if(!bCheckNextBank)
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Stop to check next bank\n"));
+			break;
+		}
+	}
+
+	// switch bank back to bank 0 for later BT and wifi use.
+	Hal_EfuseSwitchToBank(Adapter, 0, bPseudoTest);
+		
+	//
+	// 3. Collect 16 sections and 4 word unit into Efuse map.
+	//
+	for(i=0; i<EFUSE_BT_MAX_SECTION; i++)
+	{
+		for(j=0; j<EFUSE_MAX_WORD_UNIT; j++)
+		{
+			efuseTbl[(i*8)+(j*2)]=(eFuseWord[i][j] & 0xff);
+			efuseTbl[(i*8)+((j*2)+1)]=((eFuseWord[i][j] >> 8) & 0xff);
+		}
+	}
+
+	//
+	// 4. Copy from Efuse map to output pointer memory!!!
+	//
+	for(i=0; i<_size_byte; i++)
+	{		
+		pbuf[i] = efuseTbl[_offset+i];
+	}
+	
+	//
+	// 5. Calculate Efuse utilization.
+	//
+	efuse_usage = (u8)((efuse_utilized*100)/EFUSE_BT_REAL_CONTENT_LEN);
+	if(bPseudoTest)
+	{
+		fakeBTEfuseUsedBytes =  (EFUSE_REAL_CONTENT_LEN*(bank-1))+eFuse_Addr-1;
+	}
+	else
+	{
+		BTEfuseUsedBytes =  (EFUSE_REAL_CONTENT_LEN*(bank-1))+eFuse_Addr-1;
+	}
+
+	for(i=0;i<EFUSE_BT_MAX_SECTION;i++)
+		rtw_mfree((u8 *)eFuseWord[i], sizeof(u16)*EFUSE_MAX_WORD_UNIT);
+	rtw_mfree((u8 *)eFuseWord, sizeof(u16 *)*EFUSE_BT_MAX_SECTION);
+	rtw_mfree(efuseTbl, EFUSE_BT_MAP_LEN);
+}
+
+
+static VOID
+ReadEFuseByIC(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN BOOLEAN	bPseudoTest
+	)
+{
+	if(efuseType == EFUSE_WIFI)
+	{
+		if(IS_HARDWARE_TYPE_8192C(Adapter))
+		{
+			ReadEFuse_RTL8192C(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+		}
+		else if(IS_HARDWARE_TYPE_8723A(Adapter))
+		{
+			ReadEFuse_RTL8723(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+		}
+	}
+	else
+		ReadEFuse_BT(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+}
+
+static VOID
+ReadEFuse_Pseudo(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN BOOLEAN	bPseudoTest
+	)
+{
+	if(efuseType == EFUSE_WIFI)
+		ReadEFuse_RTL8723(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+	else
+		ReadEFuse_BT(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+}
+
+static VOID
+rtl8192c_ReadEFuse(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		_offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	)
+{
+	if(bPseudoTest)
+	{
+		ReadEFuse_Pseudo(Adapter, efuseType, _offset, _size_byte, pbuf, bPseudoTest);
+	}
+	else
+	{
+		ReadEFuseByIC(Adapter, efuseType, _offset, _size_byte, pbuf, bPseudoTest);
+	}
+}
+
+static VOID
+Hal_EFUSEGetEfuseDefinition(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		PVOID		*pOut
+	)
+{
+	switch(type)
+	{
+		case TYPE_EFUSE_MAX_SECTION:
+			{
+				u8	*pMax_section;
+				pMax_section = (u8 *)pOut;
+
+				if(efuseType == EFUSE_WIFI)
+				{
+					if(IS_HARDWARE_TYPE_8192C(pAdapter))
+					{
+						*pMax_section = EFUSE_MAX_SECTION;
+					}
+					else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+					{
+						*pMax_section = EFUSE_MAX_SECTION_8723;
+					}
+				}
+				else
+					*pMax_section = EFUSE_BT_MAX_SECTION;
+			}
+			break;
+		case TYPE_EFUSE_REAL_CONTENT_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = EFUSE_REAL_CONTENT_LEN;
+				else
+					*pu2Tmp = EFUSE_BT_REAL_CONTENT_LEN;
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_BANK:
+			{
+				u16	*pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_TOTAL:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_BT_REAL_CONTENT_LEN-(EFUSE_PROTECT_BYTES_BANK*3));
+			}
+			break;
+		case TYPE_EFUSE_MAP_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+
+				if(efuseType == EFUSE_WIFI)
+				{
+					if(IS_HARDWARE_TYPE_8192C(pAdapter))
+					{
+						*pu2Tmp = (u16)EFUSE_MAP_LEN;
+					}
+					else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+					{
+						*pu2Tmp = (u16)EFUSE_MAP_LEN_8723;
+					}
+				}
+				else
+					*pu2Tmp = (u16)EFUSE_BT_MAP_LEN;
+			}
+			break;
+		case TYPE_EFUSE_PROTECT_BYTES_BANK:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu1Tmp = (u8)(EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu1Tmp = (u8)(EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		default:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				*pu1Tmp = 0;
+			}
+			break;
+	}
+}
+
+static VOID
+Hal_EFUSEGetEfuseDefinition_Pseudo(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		PVOID		*pOut
+	)
+{
+	switch(type)
+	{
+		case TYPE_EFUSE_MAX_SECTION:
+			{
+				u8	*pMax_section;
+				pMax_section = (u8 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pMax_section = EFUSE_MAX_SECTION_8723;
+				else
+					*pMax_section = EFUSE_BT_MAX_SECTION;
+			}
+			break;
+		case TYPE_EFUSE_REAL_CONTENT_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = EFUSE_REAL_CONTENT_LEN;
+				else
+					*pu2Tmp = EFUSE_BT_REAL_CONTENT_LEN;
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_BANK:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_TOTAL:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_BT_REAL_CONTENT_LEN-(EFUSE_PROTECT_BYTES_BANK*3));
+			}
+			break;
+		case TYPE_EFUSE_MAP_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)EFUSE_MAP_LEN_8723;
+				else
+					*pu2Tmp = (u16)EFUSE_BT_MAP_LEN;
+			}
+			break;
+		case TYPE_EFUSE_PROTECT_BYTES_BANK:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu1Tmp = (u8)(EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu1Tmp = (u8)(EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		default:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				*pu1Tmp = 0;
+			}
+			break;
+	}
+}
+
+static VOID
+rtl8192c_EFUSE_GetEfuseDefinition(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		PVOID		*pOut,
+	IN		BOOLEAN		bPseudoTest
+	)
+{
+	if(bPseudoTest)
+	{
+		Hal_EFUSEGetEfuseDefinition_Pseudo(pAdapter, efuseType, type, pOut);
+	}
+	else
+	{
+		Hal_EFUSEGetEfuseDefinition(pAdapter, efuseType, type, pOut);
+	}
+}
+
+static u8
+Hal_EfuseWordEnableDataWrite(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en, 
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{		
+	u16	tmpaddr = 0;
+	u16	start_addr = efuse_addr;
+	u8	badworden = 0x0F;
+	u8	tmpdata[8]; 
+	
+	_rtw_memset((PVOID)tmpdata, 0xff, PGPKT_DATA_SIZE);
+	//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("word_en = %x efuse_addr=%x\n", word_en, efuse_addr));
+
+	if(!(word_en&BIT0))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[0], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[1], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr, &tmpdata[0], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[1], bPseudoTest);
+		if((data[0]!=tmpdata[0])||(data[1]!=tmpdata[1])){
+			badworden &= (~BIT0);
+		}
+	}
+	if(!(word_en&BIT1))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[2], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[3], bPseudoTest);
+				
+		efuse_OneByteRead(pAdapter,tmpaddr    , &tmpdata[2], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[3], bPseudoTest);
+		if((data[2]!=tmpdata[2])||(data[3]!=tmpdata[3])){
+			badworden &=( ~BIT1);
+		}
+	}
+	if(!(word_en&BIT2))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[4], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[5], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr, &tmpdata[4], bPseudoTest);							
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[5], bPseudoTest);
+		if((data[4]!=tmpdata[4])||(data[5]!=tmpdata[5])){
+			badworden &=( ~BIT2);
+		}
+	}
+	if(!(word_en&BIT3))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[6], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[7], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr, &tmpdata[6], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[7], bPseudoTest);
+		if((data[6]!=tmpdata[6])||(data[7]!=tmpdata[7])){
+			badworden &=( ~BIT3);
+		}
+	}
+	return badworden;
+}
+
+static u8
+Hal_EfuseWordEnableDataWrite_Pseudo(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en, 
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u8	ret=0;
+	
+	ret = Hal_EfuseWordEnableDataWrite(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+static u8
+rtl8192c_Efuse_WordEnableDataWrite(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en, 
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u8	ret=0;
+
+	if(bPseudoTest)
+	{
+		ret = Hal_EfuseWordEnableDataWrite_Pseudo(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+	}
+	else
+	{
+		ret = Hal_EfuseWordEnableDataWrite(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+	}
+	
+	return ret;
+}
+
+
+static u16
+hal_EfuseGetCurrentSize_8192C(IN	PADAPTER	pAdapter,
+	IN		BOOLEAN		bPseudoTest)
+{
+	int bContinual = _TRUE;
+
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;	
+	u8	efuse_data,word_cnts=0;
+		
+	while (	bContinual && 
+			efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) && 
+			(efuse_addr  < EFUSE_REAL_CONTENT_LEN) )
+	{			
+		if(efuse_data!=0xFF)
+		{					
+			hoffset = (efuse_data>>4) & 0x0F;
+			hworden =  efuse_data & 0x0F;									
+			word_cnts = Efuse_CalculateWordCnts(hworden);
+			//read next header							
+			efuse_addr = efuse_addr + (word_cnts*2)+1;						
+		}
+		else
+		{
+			bContinual = _FALSE ;			
+		}
+	}
+
+	return efuse_addr;	
+}
+
+static u16
+Hal_EfuseGetCurrentSize_BT(IN	PADAPTER	pAdapter,
+		IN		BOOLEAN			bPseudoTest)
+{
+	int	bContinual = _TRUE;
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;	
+	u8	efuse_data,word_cnts=0;
+	u8	bank=0, startBank=0;
+	u16	retU2=0;
+	u32	total_efuse_used=0;
+
+	if(bPseudoTest)
+	{
+		efuse_addr = (u16)((fakeBTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN));
+		startBank = (u8)(1+(fakeBTEfuseUsedBytes/EFUSE_REAL_CONTENT_LEN));
+	}
+	else
+	{
+		efuse_addr = (u16)((BTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN));
+		startBank = (u8)(1+(BTEfuseUsedBytes/EFUSE_REAL_CONTENT_LEN));
+	}
+
+	if((startBank < 1) || (startBank >= EFUSE_MAX_BANK))
+		DBG_8192C("Error, bank error, bank=%d\n", bank);
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Hal_EfuseGetCurrentSize_BT(), start bank=%d, start_efuse_addr = %d\n", startBank, efuse_addr));
+	
+	for(bank=startBank; bank<EFUSE_MAX_BANK; bank++)
+	{
+		if(!Hal_EfuseSwitchToBank(pAdapter, bank, bPseudoTest))
+			break;
+		else
+		{
+			bContinual = _TRUE;
+			if(bank != startBank)	// only when bank is switched we have to reset the efuse_addr.
+				efuse_addr = 0;
+		}
+		
+		while (	bContinual && 
+				efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) && 
+				AVAILABLE_EFUSE_ADDR(efuse_addr))
+		{			
+			if(efuse_data!=0xFF)
+			{
+				if((efuse_data&0x1F) == 0x0F)		//extended header
+				{
+					hoffset = efuse_data;
+					efuse_addr++;
+					efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest);
+					if((efuse_data & 0x0F) == 0x0F)
+					{
+						efuse_addr++;
+						continue;
+					}
+					else
+					{
+						hoffset = ((hoffset & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+						hworden = efuse_data & 0x0F;
+					}
+				}		
+				else
+				{
+					hoffset = (efuse_data>>4) & 0x0F;
+					hworden =  efuse_data & 0x0F;									
+				}
+				word_cnts = Efuse_CalculateWordCnts(hworden);
+				//read next header							
+				efuse_addr = efuse_addr + (word_cnts*2)+1;						
+			}
+			else
+			{
+				bContinual = _FALSE ;
+			}
+		}
+
+		// Check if we need to check next bank efuse
+		if(efuse_addr < (EFUSE_REAL_CONTENT_LEN-EFUSE_PROTECT_BYTES_BANK))
+		{
+			break;// don't need to check next bank.
+		}
+	}
+
+	retU2 = ((bank-1)*EFUSE_REAL_CONTENT_LEN)+efuse_addr;
+	if(bPseudoTest)
+	{
+		fakeBTEfuseUsedBytes = retU2;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("Hal_EfuseGetCurrentSize_BT(), return %d\n", fakeBTEfuseUsedBytes));
+	}
+	else
+	{
+		BTEfuseUsedBytes = retU2;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("Hal_EfuseGetCurrentSize_BT(), return %d\n", BTEfuseUsedBytes));
+	}
+
+	return retU2;
+}	
+
+
+static u16
+hal_EfuseGetCurrentSize_8723(IN	PADAPTER	pAdapter,
+		IN		BOOLEAN			bPseudoTest)
+{
+	int	bContinual = _TRUE;
+
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;	
+	u8	efuse_data,word_cnts=0;
+
+	if(bPseudoTest)
+	{
+		efuse_addr = (u16)(fakeEfuseUsedBytes);
+	}
+	else
+	{
+		rtw_hal_get_hwreg(pAdapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_addr);
+	}
+	//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseGetCurrentSize_8723(), start_efuse_addr = %d\n", efuse_addr));
+	
+	while (	bContinual && 
+			efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) && 
+			AVAILABLE_EFUSE_ADDR(efuse_addr))
+	{			
+		if(efuse_data!=0xFF)
+		{					
+			if((efuse_data&0x1F) == 0x0F)		//extended header
+			{
+				hoffset = efuse_data;
+				efuse_addr++;
+				efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest);
+				if((efuse_data & 0x0F) == 0x0F)
+				{
+					efuse_addr++;
+					continue;
+				}
+				else
+				{
+					hoffset = ((hoffset & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+					hworden = efuse_data & 0x0F;
+				}
+			}		
+			else
+			{
+				hoffset = (efuse_data>>4) & 0x0F;
+				hworden =  efuse_data & 0x0F;									
+			}
+			word_cnts = Efuse_CalculateWordCnts(hworden);
+			//read next header							
+			efuse_addr = efuse_addr + (word_cnts*2)+1;						
+		}
+		else
+		{
+			bContinual = _FALSE ;			
+		}
+	}
+
+	if(bPseudoTest)
+	{
+		fakeEfuseUsedBytes = efuse_addr;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseGetCurrentSize_8723(), return %d\n", fakeEfuseUsedBytes));
+	}
+	else
+	{
+		rtw_hal_set_hwreg(pAdapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_addr);
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseGetCurrentSize_8723(), return %d\n", efuse_addr));
+	}
+	
+	return efuse_addr;	
+}	
+
+static u16
+Hal_EfuseGetCurrentSize_Pseudo(IN	PADAPTER	pAdapter,
+		IN		BOOLEAN			bPseudoTest)
+{
+	u16	ret=0;
+	
+	ret = hal_EfuseGetCurrentSize_8723(pAdapter, bPseudoTest);
+
+	return ret;
+}
+
+static u16
+rtl8192c_EfuseGetCurrentSize(
+	IN	PADAPTER	pAdapter,
+	IN	u8			efuseType,
+	IN	BOOLEAN		bPseudoTest)
+{
+	u16	ret=0;
+
+	if(efuseType == EFUSE_WIFI)
+	{
+		if(bPseudoTest)
+		{
+			ret = Hal_EfuseGetCurrentSize_Pseudo(pAdapter, bPseudoTest);
+		}
+		else
+		{
+			if(IS_HARDWARE_TYPE_8192C(pAdapter))
+			{
+				ret = hal_EfuseGetCurrentSize_8192C(pAdapter, bPseudoTest);
+			}
+			else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+			{
+				ret = hal_EfuseGetCurrentSize_8723(pAdapter, bPseudoTest);
+			}
+		}
+	}
+	else
+	{
+		ret = Hal_EfuseGetCurrentSize_BT(pAdapter, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static int
+hal_EfusePgPacketRead_8192C(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN			bPseudoTest)
+{	
+	u8	ReadState = PG_STATE_HEADER;	
+	
+	int	bContinual = _TRUE;
+	int	bDataEmpty = _TRUE ;	
+
+	u8	efuse_data,word_cnts=0;
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;	
+	u8	tmpidx=0;
+	u8	tmpdata[8];
+	
+	if(data==NULL)	return _FALSE;
+	if(offset>15)		return _FALSE;	
+	
+
+	_rtw_memset((PVOID)data, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+	_rtw_memset((PVOID)tmpdata, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+	
+	//
+	// <Roger_TODO> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// Skip dummy parts to prevent unexpected data read from Efuse.
+	// By pass right now. 2009.02.19.
+	//
+	while(bContinual && (efuse_addr  < EFUSE_REAL_CONTENT_LEN) )
+	{			
+		//-------  Header Read -------------
+		if(ReadState & PG_STATE_HEADER)
+		{
+			if(efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest)&&(efuse_data!=0xFF)){				
+				hoffset = (efuse_data>>4) & 0x0F;
+				hworden =  efuse_data & 0x0F;									
+				word_cnts = Efuse_CalculateWordCnts(hworden);
+				bDataEmpty = _TRUE ;
+
+				if(hoffset==offset){
+					for(tmpidx = 0;tmpidx< word_cnts*2 ;tmpidx++){
+						if(efuse_OneByteRead(pAdapter, efuse_addr+1+tmpidx ,&efuse_data, bPseudoTest) ){
+							tmpdata[tmpidx] = efuse_data;
+							if(efuse_data!=0xff){						
+								bDataEmpty = _FALSE;
+							}
+						}					
+					}
+					if(bDataEmpty==_FALSE){
+						ReadState = PG_STATE_DATA;							
+					}else{//read next header							
+						efuse_addr = efuse_addr + (word_cnts*2)+1;
+						ReadState = PG_STATE_HEADER; 
+					}
+				}
+				else{//read next header	
+					efuse_addr = efuse_addr + (word_cnts*2)+1;
+					ReadState = PG_STATE_HEADER; 
+				}
+				
+			}
+			else{
+				bContinual = _FALSE ;
+			}
+		}		
+		//-------  Data section Read -------------
+		else if(ReadState & PG_STATE_DATA)
+		{
+			efuse_WordEnableDataRead(hworden,tmpdata,data);
+			efuse_addr = efuse_addr + (word_cnts*2)+1;
+			ReadState = PG_STATE_HEADER; 
+		}
+		
+	}
+		
+	if(	(data[0]==0xff) &&(data[1]==0xff) && (data[2]==0xff)  && (data[3]==0xff) &&
+		(data[4]==0xff) &&(data[5]==0xff) && (data[6]==0xff)  && (data[7]==0xff))
+		return _FALSE;
+	else
+		return _TRUE;
+
+}
+
+static int
+hal_EfusePgPacketRead_8723(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN			bPseudoTest)
+{	
+	u8	ReadState = PG_STATE_HEADER;	
+	
+	int	bContinual = _TRUE;
+	int	bDataEmpty = _TRUE ;	
+
+	u8	efuse_data,word_cnts=0;
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;	
+	u8	tmpidx=0;
+	u8	tmpdata[8];
+	u8	max_section=0;
+	u8	tmp_header = 0;
+
+	EFUSE_GetEfuseDefinition(pAdapter, EFUSE_WIFI, TYPE_EFUSE_MAX_SECTION, (PVOID)&max_section, bPseudoTest);
+	
+	if(data==NULL)
+		return _FALSE;
+	if(offset>max_section)
+		return _FALSE;
+
+	_rtw_memset((PVOID)data, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+	_rtw_memset((PVOID)tmpdata, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+	
+	
+	//
+	// <Roger_TODO> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// Skip dummy parts to prevent unexpected data read from Efuse.
+	// By pass right now. 2009.02.19.
+	//
+	while(bContinual && AVAILABLE_EFUSE_ADDR(efuse_addr) )
+	{			
+		//-------  Header Read -------------
+		if(ReadState & PG_STATE_HEADER)
+		{
+			if(efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest)&&(efuse_data!=0xFF))			
+			{
+				if(EXT_HEADER(efuse_data))
+				{
+					tmp_header = efuse_data;
+					efuse_addr++;
+					efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest);
+					if(!ALL_WORDS_DISABLED(efuse_data))
+					{
+						hoffset = ((tmp_header & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+						hworden = efuse_data & 0x0F;						
+					}
+					else
+					{
+						DBG_8192C("Error, All words disabled\n");
+						efuse_addr++;
+						continue;
+					}
+				}
+				else	
+				{
+					hoffset = (efuse_data>>4) & 0x0F;
+					hworden =  efuse_data & 0x0F;									
+				}
+				word_cnts = Efuse_CalculateWordCnts(hworden);
+				bDataEmpty = _TRUE ;
+
+				if(hoffset==offset)
+				{
+					for(tmpidx = 0;tmpidx< word_cnts*2 ;tmpidx++)
+					{
+						if(efuse_OneByteRead(pAdapter, efuse_addr+1+tmpidx ,&efuse_data, bPseudoTest) )
+						{
+							tmpdata[tmpidx] = efuse_data;
+							if(efuse_data!=0xff)
+							{						
+								bDataEmpty = _FALSE;
+							}
+						}					
+					}
+					if(bDataEmpty==_FALSE){
+						ReadState = PG_STATE_DATA;							
+					}else{//read next header							
+						efuse_addr = efuse_addr + (word_cnts*2)+1;
+						ReadState = PG_STATE_HEADER; 
+					}
+				}
+				else{//read next header	
+					efuse_addr = efuse_addr + (word_cnts*2)+1;
+					ReadState = PG_STATE_HEADER; 
+				}
+				
+			}
+			else{
+				bContinual = _FALSE ;
+			}
+		}		
+		//-------  Data section Read -------------
+		else if(ReadState & PG_STATE_DATA)
+		{
+			efuse_WordEnableDataRead(hworden,tmpdata,data);
+			efuse_addr = efuse_addr + (word_cnts*2)+1;
+			ReadState = PG_STATE_HEADER; 
+		}
+		
+	}			
+	
+	if(	(data[0]==0xff) &&(data[1]==0xff) && (data[2]==0xff)  && (data[3]==0xff) &&
+		(data[4]==0xff) &&(data[5]==0xff) && (data[6]==0xff)  && (data[7]==0xff))
+		return _FALSE;
+	else
+		return _TRUE;
+
+}
+
+static int
+Hal_EfusePgPacketRead(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN			bPseudoTest)
+{
+	int	ret=0;
+
+	if(IS_HARDWARE_TYPE_8192C(pAdapter))
+	{
+		ret = hal_EfusePgPacketRead_8192C(pAdapter, offset, data, bPseudoTest);
+	}
+	else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+	{
+		ret = hal_EfusePgPacketRead_8723(pAdapter, offset, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static int
+Hal_EfusePgPacketRead_Pseudo(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+	
+	ret = hal_EfusePgPacketRead_8723(pAdapter, offset, data, bPseudoTest);
+
+	return ret;
+}
+
+static int
+rtl8192c_Efuse_PgPacketRead(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	if(bPseudoTest)
+	{
+		ret = Hal_EfusePgPacketRead_Pseudo(pAdapter, offset, data, bPseudoTest);
+	}
+	else
+	{
+		ret = Hal_EfusePgPacketRead(pAdapter, offset, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static BOOLEAN
+hal_EfuseFixHeaderProcess(
+	IN		PADAPTER			pAdapter,
+	IN		u8					efuseType,
+	IN		PPGPKT_STRUCT		pFixPkt,
+	IN		u16					*pAddr,
+	IN		BOOLEAN				bPseudoTest
+)
+{
+	u8	originaldata[8], badworden=0;
+	u16	efuse_addr=*pAddr;
+	u32	PgWriteSuccess=0;
+	
+	_rtw_memset((PVOID)originaldata, 0xff, 8);
+					
+	if(Efuse_PgPacketRead(pAdapter, pFixPkt->offset, originaldata, bPseudoTest))
+	{	//check if data exist
+		badworden = Efuse_WordEnableDataWrite(pAdapter, efuse_addr+1, pFixPkt->word_en, originaldata, bPseudoTest);
+
+		if(badworden != 0xf)	// write fail
+		{
+			if(efuseType == EFUSE_WIFI)
+				PgWriteSuccess = Efuse_PgPacketWrite(pAdapter, pFixPkt->offset, badworden, originaldata, bPseudoTest);
+			else
+				PgWriteSuccess = hal_EfusePgPacketWrite_BT(pAdapter, pFixPkt->offset, badworden, originaldata, bPseudoTest);
+			if(!PgWriteSuccess)
+				return _FALSE;
+			else
+				efuse_addr = Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest);
+		}
+		else
+		{
+			efuse_addr = efuse_addr + (pFixPkt->word_cnts*2) +1;
+		}
+	}
+	else
+	{
+		efuse_addr = efuse_addr + (pFixPkt->word_cnts*2) +1;
+	}
+	*pAddr = efuse_addr;
+	return _TRUE;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWrite2ByteHeader(
+	IN			PADAPTER		pAdapter,
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN		bRet=_FALSE, bContinual=_TRUE;
+	u16	efuse_addr=*pAddr, efuse_max_available_len=0;
+	u8	pg_header=0, tmp_header=0, pg_header_temp=0;
+	u8	repeatcnt=0;
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Wirte 2byte header\n"));
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_AVAILABLE_EFUSE_BYTES_BANK, (PVOID)&efuse_max_available_len, bPseudoTest);
+
+	while(efuse_addr < efuse_max_available_len)
+	{
+		pg_header = ((pTargetPkt->offset & 0x07) << 5) | 0x0F;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("pg_header = 0x%x\n", pg_header));
+		efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+		efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+
+		while(tmp_header == 0xFF)
+		{
+			if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+			{
+				//RTPRINT(FEEPROM, EFUSE_PG, ("Repeat over limit for pg_header!!\n"));
+				return _FALSE;
+			}
+
+			efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+			efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+		}
+		
+		//to write ext_header
+		if(tmp_header == pg_header)
+		{
+			efuse_addr++;
+			pg_header_temp = pg_header;
+			pg_header = ((pTargetPkt->offset & 0x78) << 1) | pTargetPkt->word_en;
+
+			efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+			efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+
+			while(tmp_header == 0xFF)
+			{											
+				if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+				{
+					//RTPRINT(FEEPROM, EFUSE_PG, ("Repeat over limit for ext_header!!\n"));
+					return _FALSE;
+				}							
+
+				efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+				efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+			}
+
+			if((tmp_header & 0x0F) == 0x0F)	//word_en PG fail
+			{
+				if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+				{
+					//RTPRINT(FEEPROM, EFUSE_PG, ("Repeat over limit for word_en!!\n"));
+					return _FALSE;
+				}
+				else
+				{
+					efuse_addr++;
+					continue;
+				}
+			}
+			else if(pg_header != tmp_header)	//offset PG fail						
+			{
+				PGPKT_STRUCT	fixPkt;
+				//RTPRINT(FEEPROM, EFUSE_PG, ("Error condition for offset PG fail, need to cover the existed data\n"));
+				fixPkt.offset = ((pg_header_temp & 0xE0) >> 5) | ((tmp_header & 0xF0) >> 1);
+				fixPkt.word_en = tmp_header & 0x0F;					
+				fixPkt.word_cnts = Efuse_CalculateWordCnts(fixPkt.word_en);
+				if(!hal_EfuseFixHeaderProcess(pAdapter, efuseType, &fixPkt, &efuse_addr, bPseudoTest))
+					return _FALSE;
+			}
+			else
+			{
+				bRet = _TRUE;
+				break;
+			}
+		}
+		else if ((tmp_header & 0x1F) == 0x0F)		//wrong extended header
+		{
+			efuse_addr+=2;
+			continue;						
+		}
+	}
+
+	*pAddr = efuse_addr;
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWrite1ByteHeader(
+	IN			PADAPTER		pAdapter, 
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN		bRet=_FALSE;
+	u8	pg_header=0, tmp_header=0;
+	u16	efuse_addr=*pAddr;
+	u8	repeatcnt=0;
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Wirte 1byte header\n"));
+	pg_header = ((pTargetPkt->offset << 4) & 0xf0) |pTargetPkt->word_en;
+	
+	efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+	efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+
+	while(tmp_header == 0xFF)
+	{
+		if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+		{
+			return _FALSE;
+		}
+		efuse_OneByteWrite(pAdapter,efuse_addr, pg_header, bPseudoTest);
+		efuse_OneByteRead(pAdapter,efuse_addr, &tmp_header, bPseudoTest);
+	}
+	
+	if(pg_header == tmp_header)
+	{
+		bRet = _TRUE;
+	}
+	else
+	{
+		PGPKT_STRUCT	fixPkt;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("Error condition for fixed PG packet, need to cover the existed data\n"));
+		fixPkt.offset = (tmp_header>>4) & 0x0F;
+		fixPkt.word_en = tmp_header & 0x0F;					
+		fixPkt.word_cnts = Efuse_CalculateWordCnts(fixPkt.word_en);
+		if(!hal_EfuseFixHeaderProcess(pAdapter, efuseType, &fixPkt, &efuse_addr, bPseudoTest))
+			return _FALSE;
+	}
+	
+	*pAddr = efuse_addr;
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWriteData(
+	IN			PADAPTER		pAdapter, 
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN	bRet=_FALSE;
+	u16	efuse_addr=*pAddr;
+	u8	badworden=0;
+	u32	PgWriteSuccess=0;
+
+	badworden = 0x0f;
+	badworden = Efuse_WordEnableDataWrite(pAdapter, efuse_addr+1, pTargetPkt->word_en, pTargetPkt->data, bPseudoTest);
+	if(badworden == 0x0F)
+	{
+		// write ok
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgPacketWriteData ok!!\n"));
+		return _TRUE;
+	}
+	else
+	{
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgPacketWriteData Fail!!\n"));
+		//reorganize other pg packet
+		if(efuseType == EFUSE_WIFI)
+			PgWriteSuccess = Efuse_PgPacketWrite(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+		else
+			PgWriteSuccess = hal_EfusePgPacketWrite_BT(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+		if(!PgWriteSuccess)
+			return _FALSE;
+		else
+			return _TRUE;
+	}
+
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWriteHeader(
+	IN			PADAPTER		pAdapter, 
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN		bRet=_FALSE;
+
+	if(pTargetPkt->offset >= EFUSE_MAX_SECTION_BASE)
+	{
+		bRet = hal_EfusePgPacketWrite2ByteHeader(pAdapter, efuseType, pAddr, pTargetPkt, bPseudoTest);
+	}
+	else
+	{
+		bRet = hal_EfusePgPacketWrite1ByteHeader(pAdapter, efuseType, pAddr, pTargetPkt, bPseudoTest);
+	}
+
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgCheckAvailableAddr(
+	IN	PADAPTER	pAdapter,
+	IN	u8			efuseType,
+	IN	BOOLEAN		bPseudoTest
+	)
+{
+	u16	efuse_max_available_len=0;
+	
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&efuse_max_available_len, bPseudoTest);
+	//RTPRINT(FEEPROM, EFUSE_PG, ("efuse_max_available_len = %d\n", efuse_max_available_len));
+
+	if(Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest) >= efuse_max_available_len)
+	{
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgCheckAvailableAddr error!!\n"));
+		return _FALSE;
+	}
+	return _TRUE;
+}
+
+static VOID
+hal_EfuseConstructPGPkt(
+					IN	u8 				offset,
+					IN	u8				word_en,
+					IN	u8				*pData,
+					IN	PPGPKT_STRUCT	pTargetPkt
+
+)
+{
+	_rtw_memset((PVOID)pTargetPkt->data, 0xFF, sizeof(u8)*8);
+	pTargetPkt->offset = offset;
+	pTargetPkt->word_en= word_en;
+	efuse_WordEnableDataRead(word_en, pData, pTargetPkt->data);
+	pTargetPkt->word_cnts = Efuse_CalculateWordCnts(pTargetPkt->word_en);
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseConstructPGPkt(), targetPkt, offset=%d, word_en=0x%x, word_cnts=%d\n", pTargetPkt->offset, pTargetPkt->word_en, pTargetPkt->word_cnts));
+}
+
+static BOOLEAN
+hal_EfuseCheckIfDatafollowed(
+	IN		PADAPTER		pAdapter,
+	IN		u8				word_cnts,
+	IN		u16				startAddr,
+	IN		BOOLEAN			bPseudoTest
+	)
+{
+	BOOLEAN		bRet=_FALSE;
+	u8	i, efuse_data;
+	
+	for(i=0; i<(word_cnts*2) ; i++)
+	{
+		if(efuse_OneByteRead(pAdapter, (startAddr+i) ,&efuse_data, bPseudoTest)&&(efuse_data != 0xFF))
+			bRet = _TRUE;
+	}
+
+	return bRet;
+}
+
+static BOOLEAN
+wordEnMatched(
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	PPGPKT_STRUCT	pCurPkt,
+	IN	u8				*pWden
+)
+{
+	u8	match_word_en = 0x0F;	// default all words are disabled
+	u8	i;
+
+	// check if the same words are enabled both target and current PG packet
+	if( ((pTargetPkt->word_en & BIT0) == 0) &&
+		((pCurPkt->word_en & BIT0) == 0) )
+	{
+		match_word_en &= ~BIT0;				// enable word 0
+	}
+	if( ((pTargetPkt->word_en & BIT1) == 0) &&
+		((pCurPkt->word_en & BIT1) == 0) )
+	{
+		match_word_en &= ~BIT1;				// enable word 1
+	}
+	if( ((pTargetPkt->word_en & BIT2) == 0) &&
+		((pCurPkt->word_en & BIT2) == 0) )
+	{
+		match_word_en &= ~BIT2;				// enable word 2
+	}
+	if( ((pTargetPkt->word_en & BIT3) == 0) &&
+		((pCurPkt->word_en & BIT3) == 0) )
+	{
+		match_word_en &= ~BIT3;				// enable word 3
+	}
+
+	*pWden = match_word_en;
+
+	if(match_word_en != 0xf)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+static BOOLEAN
+hal_EfusePartialWriteCheck(
+					IN	PADAPTER		pAdapter,
+					IN	u8				efuseType,
+					IN	u16				*pAddr,
+					IN	PPGPKT_STRUCT	pTargetPkt,
+					IN	BOOLEAN			bPseudoTest
+					)
+{
+	BOOLEAN		bRet=_FALSE;
+	u8	i, efuse_data=0, cur_header=0;
+	u8	new_wden=0, matched_wden=0, badworden=0;
+	u16	startAddr=0, efuse_max_available_len=0, efuse_max=0;
+	PGPKT_STRUCT	curPkt;
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_AVAILABLE_EFUSE_BYTES_BANK, (PVOID)&efuse_max_available_len, bPseudoTest);
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&efuse_max, bPseudoTest);
+
+	if(efuseType == EFUSE_WIFI)
+	{
+		if(bPseudoTest)
+		{
+			startAddr = (u16)(fakeEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN);
+		}
+		else
+		{
+			rtw_hal_get_hwreg(pAdapter, HW_VAR_EFUSE_BYTES, (u8 *)&startAddr);
+			startAddr%=EFUSE_REAL_CONTENT_LEN;
+		}
+	}
+	else
+	{
+		if(bPseudoTest)
+		{
+			startAddr = (u16)(fakeBTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN);
+		}
+		else
+		{
+			startAddr = (u16)(BTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN);
+		}
+	}
+	//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePartialWriteCheck(), startAddr=%d\n", startAddr));
+
+	while(1)
+	{
+		if(startAddr >= efuse_max_available_len) 
+		{
+			bRet = _FALSE;
+			break;
+		}
+		
+		if(efuse_OneByteRead(pAdapter, startAddr, &efuse_data, bPseudoTest) && (efuse_data!=0xFF))
+		{
+			if(EXT_HEADER(efuse_data))
+			{
+				cur_header = efuse_data;
+				startAddr++;
+				efuse_OneByteRead(pAdapter, startAddr, &efuse_data, bPseudoTest);
+				if(ALL_WORDS_DISABLED(efuse_data))
+				{
+					//RTPRINT(FEEPROM, EFUSE_PG, ("Error condition, all words disabled"));
+					bRet = _FALSE;
+					break;
+				}
+				else
+				{
+					curPkt.offset = ((cur_header & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+					curPkt.word_en = efuse_data & 0x0F;
+				}
+			}
+			else
+			{
+				cur_header  =  efuse_data;					
+				curPkt.offset = (cur_header>>4) & 0x0F;
+				curPkt.word_en = cur_header & 0x0F;
+			}
+
+			curPkt.word_cnts = Efuse_CalculateWordCnts(curPkt.word_en);
+			// if same header is found but no data followed
+			// write some part of data followed by the header.
+			if( (curPkt.offset == pTargetPkt->offset) && 
+				(!hal_EfuseCheckIfDatafollowed(pAdapter, curPkt.word_cnts, startAddr+1, bPseudoTest)) &&
+				wordEnMatched(pTargetPkt, &curPkt, &matched_wden) )
+			{
+				//RTPRINT(FEEPROM, EFUSE_PG, ("Need to partial write data by the previous wrote header\n"));
+				// Here to write partial data
+				badworden = Efuse_WordEnableDataWrite(pAdapter, startAddr+1, matched_wden, pTargetPkt->data, bPseudoTest);
+				if(badworden != 0x0F)
+				{
+					u32	PgWriteSuccess=0;
+					// if write fail on some words, write these bad words again
+					if(efuseType == EFUSE_WIFI)
+						PgWriteSuccess = Efuse_PgPacketWrite(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+					else
+						PgWriteSuccess = hal_EfusePgPacketWrite_BT(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+
+					if(!PgWriteSuccess)
+					{
+						bRet = _FALSE;	// write fail, return
+						break;
+					}					
+				}
+				// partial write ok, update the target packet for later use		
+				for(i=0; i<4; i++)
+				{
+					if((matched_wden & (0x1<<i)) == 0)	// this word has been written
+					{
+						pTargetPkt->word_en |= (0x1<<i);	// disable the word
+					}
+				}
+				pTargetPkt->word_cnts = Efuse_CalculateWordCnts(pTargetPkt->word_en);
+			}
+			// read from next header
+			startAddr = startAddr + (curPkt.word_cnts*2) +1;	
+		}
+		else
+		{
+			// not used header, 0xff
+			*pAddr = startAddr;
+			//RTPRINT(FEEPROM, EFUSE_PG, ("Started from unused header offset=%d\n", startAddr));
+			bRet = _TRUE;
+			break;
+		}
+	}	
+	return bRet;
+}
+
+static BOOLEAN 
+hal_EfusePgPacketWrite_BT(
+					IN	PADAPTER	pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*pData,
+					IN	BOOLEAN		bPseudoTest
+					)
+{
+	PGPKT_STRUCT 	targetPkt;
+	u16	startAddr=0;
+	u8	efuseType=EFUSE_BT;
+	
+	if(!hal_EfusePgCheckAvailableAddr(pAdapter, efuseType, bPseudoTest))
+		return _FALSE;
+
+	hal_EfuseConstructPGPkt(offset, word_en, pData, &targetPkt);
+
+	if(!hal_EfusePartialWriteCheck(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteHeader(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteData(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	return _TRUE;
+}
+
+static BOOLEAN 
+hal_EfusePgPacketWrite_8723(
+					IN	PADAPTER		pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*pData,
+					IN	BOOLEAN		bPseudoTest
+					)
+{
+	PGPKT_STRUCT 	targetPkt;
+	u16			startAddr=0;
+	u8			efuseType=EFUSE_WIFI;
+	
+	if(!hal_EfusePgCheckAvailableAddr(pAdapter, efuseType, bPseudoTest))
+		return _FALSE;
+
+	hal_EfuseConstructPGPkt(offset, word_en, pData, &targetPkt);
+
+	if(!hal_EfusePartialWriteCheck(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteHeader(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteData(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	return _TRUE;
+}
+
+static int
+hal_EfusePgPacketWrite_8192C(IN	PADAPTER	pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	u8	WriteState = PG_STATE_HEADER;		
+
+	int	bContinual = _TRUE,bDataEmpty=_TRUE, bResult = _TRUE;
+	u16	efuse_addr = 0;
+	u8	efuse_data;
+
+	u8	pg_header = 0;
+
+	u8	tmp_word_cnts=0,target_word_cnts=0;
+	u8	tmp_header,match_word_en,tmp_word_en;
+
+	PGPKT_STRUCT target_pkt;	
+	PGPKT_STRUCT tmp_pkt;
+	
+	u8	originaldata[sizeof(u8)*8];
+	u8	tmpindex = 0,badworden = 0x0F;
+
+	static int	repeat_times = 0;
+	u8	efuseType=EFUSE_WIFI;
+
+	//
+	// <Roger_Notes> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// So we have to prevent unexpected data string connection, which will cause
+	// incorrect data auto-load from HW. The total size is equal or smaller than 498bytes
+	// (i.e., offset 0~497, and dummy 1bytes) expected after CP test.
+	// 2009.02.19.
+	//
+	if( Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest) >= (EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES))
+	{
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgPacketWrite_8192C(), over size\n"));
+		return _FALSE;
+	}
+
+	// Init the 8 bytes content as 0xff
+	target_pkt.offset = offset;
+	target_pkt.word_en= word_en;
+
+	_rtw_memset((PVOID)target_pkt.data, 0xFF, sizeof(u8)*8);
+	
+	efuse_WordEnableDataRead(word_en,data,target_pkt.data);
+	target_word_cnts = Efuse_CalculateWordCnts(target_pkt.word_en);
+
+	//efuse_reg_ctrl(pAdapter,_TRUE);//power on
+	//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE Power ON\n"));
+
+	//
+	// <Roger_Notes> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// So we have to prevent unexpected data string connection, which will cause
+	// incorrect data auto-load from HW. Dummy 1bytes is additional.
+	// 2009.02.19.
+	//
+	while( bContinual && (efuse_addr  < (EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES)) )
+	{
+		
+		if(WriteState==PG_STATE_HEADER)
+		{	
+			bDataEmpty=_TRUE;
+			badworden = 0x0F;		
+			//************  so *******************
+			//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER\n"));
+			if (	efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) &&
+				(efuse_data!=0xFF))
+			{ 	
+				tmp_header  =  efuse_data;
+				
+				tmp_pkt.offset 	= (tmp_header>>4) & 0x0F;
+				tmp_pkt.word_en 	= tmp_header & 0x0F;					
+				tmp_word_cnts =  Efuse_CalculateWordCnts(tmp_pkt.word_en);
+
+				//************  so-1 *******************
+				if(tmp_pkt.offset  != target_pkt.offset)
+				{
+					efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet
+					#if (EFUSE_ERROE_HANDLE == 1)
+					WriteState = PG_STATE_HEADER;
+					#endif
+				}
+				else
+				{	
+					//************  so-2 *******************
+					for(tmpindex=0 ; tmpindex<(tmp_word_cnts*2) ; tmpindex++)
+					{
+						if(efuse_OneByteRead(pAdapter, (efuse_addr+1+tmpindex) ,&efuse_data, bPseudoTest)&&(efuse_data != 0xFF)){
+							bDataEmpty = _FALSE;	
+						}
+					}	
+					//************  so-2-1 *******************
+					if(bDataEmpty == _FALSE)
+					{						
+						efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet										
+						#if (EFUSE_ERROE_HANDLE == 1)
+						WriteState=PG_STATE_HEADER;
+						#endif
+					}
+					else
+					{//************  so-2-2 *******************
+						match_word_en = 0x0F;
+						if(   !( (target_pkt.word_en&BIT0)|(tmp_pkt.word_en&BIT0)  ))
+						{
+							 match_word_en &= (~BIT0);
+						}	
+						if(   !( (target_pkt.word_en&BIT1)|(tmp_pkt.word_en&BIT1)  ))
+						{
+							 match_word_en &= (~BIT1);
+						}
+						if(   !( (target_pkt.word_en&BIT2)|(tmp_pkt.word_en&BIT2)  ))
+						{
+							 match_word_en &= (~BIT2);
+						}
+						if(   !( (target_pkt.word_en&BIT3)|(tmp_pkt.word_en&BIT3)  ))
+						{
+							 match_word_en &= (~BIT3);
+						}					
+												
+						//************  so-2-2-A *******************
+						if((match_word_en&0x0F)!=0x0F)
+						{							
+							badworden = Efuse_WordEnableDataWrite(pAdapter,efuse_addr+1, tmp_pkt.word_en ,target_pkt.data, bPseudoTest);
+							
+							//************  so-2-2-A-1 *******************
+							//############################
+							if(0x0F != (badworden&0x0F))
+							{														
+								u8	reorg_offset = offset;
+								u8	reorg_worden=badworden;								
+								Efuse_PgPacketWrite(pAdapter,reorg_offset,reorg_worden,originaldata, bPseudoTest);
+							}	
+							//############################						
+
+							tmp_word_en = 0x0F;	
+							if(  (target_pkt.word_en&BIT0)^(match_word_en&BIT0)  )
+							{
+								tmp_word_en &= (~BIT0);
+							}
+							if(   (target_pkt.word_en&BIT1)^(match_word_en&BIT1) )
+							{
+								tmp_word_en &=  (~BIT1);
+							}
+							if(   (target_pkt.word_en&BIT2)^(match_word_en&BIT2) )
+							{
+								tmp_word_en &= (~BIT2);
+							}						
+							if(   (target_pkt.word_en&BIT3)^(match_word_en&BIT3) )
+							{
+								tmp_word_en &=(~BIT3);
+							}							
+						
+							//************  so-2-2-A-2 *******************	
+							if((tmp_word_en&0x0F)!=0x0F){
+								//reorganize other pg packet						
+								//efuse_addr = efuse_addr + (2*tmp_word_cnts) +1;//next pg packet addr							
+								efuse_addr = Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest);
+								//===========================
+								target_pkt.offset = offset;
+								target_pkt.word_en= tmp_word_en;					
+								//===========================
+							}else{								
+								bContinual = _FALSE;
+							}
+							#if (EFUSE_ERROE_HANDLE == 1)
+							WriteState=PG_STATE_HEADER;
+							repeat_times++;
+							if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+								bContinual = _FALSE;
+								bResult = _FALSE;
+							}
+							#endif
+						}
+						else{//************  so-2-2-B *******************
+							//reorganize other pg packet						
+							efuse_addr = efuse_addr + (2*tmp_word_cnts) +1;//next pg packet addr							
+							//===========================
+							target_pkt.offset = offset;
+							target_pkt.word_en= target_pkt.word_en;					
+							//===========================			
+							#if (EFUSE_ERROE_HANDLE == 1)
+							WriteState=PG_STATE_HEADER;
+							#endif
+						}		
+					}				
+				}				
+				//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER-1\n"));
+			}
+			else		//************  s1: header == oxff  *******************
+			{
+				pg_header = ((target_pkt.offset << 4)&0xf0) |target_pkt.word_en;
+
+				efuse_OneByteWrite(pAdapter,efuse_addr, pg_header, bPseudoTest);
+				efuse_OneByteRead(pAdapter,efuse_addr, &tmp_header, bPseudoTest);
+		
+				if(tmp_header == pg_header)
+				{ //************  s1-1*******************								
+					WriteState = PG_STATE_DATA;						
+				}				
+				#if (EFUSE_ERROE_HANDLE == 1)
+				else if(tmp_header == 0xFF){//************  s1-3: if Write or read func doesn't work *******************		
+					//efuse_addr doesn't change
+					WriteState = PG_STATE_HEADER;					
+					repeat_times++;
+					if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+						bContinual = _FALSE;
+						bResult = _FALSE;
+					}
+				}
+				#endif
+				else
+				{//************  s1-2 : fixed the header procedure *******************							
+					tmp_pkt.offset = (tmp_header>>4) & 0x0F;
+					tmp_pkt.word_en=  tmp_header & 0x0F;					
+					tmp_word_cnts =  Efuse_CalculateWordCnts(tmp_pkt.word_en);
+																											
+					//************  s1-2-A :cover the exist data *******************
+					//memset(originaldata,0xff,sizeof(UINT8)*8);
+					_rtw_memset((PVOID)originaldata, 0xff, sizeof(u8)*8);
+					
+					if(Efuse_PgPacketRead( pAdapter, tmp_pkt.offset,originaldata, bPseudoTest))
+					{	//check if data exist 					
+						//efuse_reg_ctrl(pAdapter,_TRUE);//power on
+						badworden = Efuse_WordEnableDataWrite(pAdapter,efuse_addr+1,tmp_pkt.word_en,originaldata, bPseudoTest);	
+						//############################
+						if(0x0F != (badworden&0x0F))
+						{														
+							u8	reorg_offset = tmp_pkt.offset;
+							u8	reorg_worden=badworden;								
+							Efuse_PgPacketWrite(pAdapter,reorg_offset,reorg_worden,originaldata, bPseudoTest);
+							efuse_addr = Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest);	 
+						}
+						//############################
+						else{
+							efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet							
+						}
+					}
+					 //************  s1-2-B: wrong address*******************
+					else
+					{
+						efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet
+					}
+
+					#if (EFUSE_ERROE_HANDLE == 1)
+					WriteState=PG_STATE_HEADER;	
+					repeat_times++;
+					if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+						bContinual = _FALSE;
+						bResult = _FALSE;
+					}
+					#endif
+					
+					//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER-2\n"));
+				}
+
+			}
+
+		}
+		//write data state
+		else if(WriteState==PG_STATE_DATA) 
+		{	//************  s1-1  *******************
+			//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_DATA\n"));
+			badworden = 0x0f;
+			badworden = Efuse_WordEnableDataWrite(pAdapter,efuse_addr+1,target_pkt.word_en,target_pkt.data, bPseudoTest);	
+			if((badworden&0x0F)==0x0F)
+			{ //************  s1-1-A *******************
+				bContinual = _FALSE;
+			}
+			else
+			{//reorganize other pg packet //************  s1-1-B *******************
+				efuse_addr = efuse_addr + (2*target_word_cnts) +1;//next pg packet addr
+										
+				//===========================
+				target_pkt.offset = offset;
+				target_pkt.word_en= badworden;		
+				target_word_cnts =  Efuse_CalculateWordCnts(target_pkt.word_en); 
+				//===========================			
+				#if (EFUSE_ERROE_HANDLE == 1)
+				WriteState=PG_STATE_HEADER;	
+				repeat_times++;
+				if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+					bContinual = _FALSE;
+					bResult = _FALSE;
+				}
+				#endif
+				//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER-3\n"));
+			}
+		}
+	}
+
+	if(efuse_addr  >= (EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES))
+	{
+		//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("hal_EfusePgPacketWrite_8192C(): efuse_addr(%#x) Out of size!!\n", efuse_addr));
+	}
+	//efuse_reg_ctrl(pAdapter,_FALSE);//power off
+	
+	return _TRUE;
+}
+
+static int 
+Hal_EfusePgPacketWrite_Pseudo(IN	PADAPTER	pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int ret;
+	
+	ret = hal_EfusePgPacketWrite_8723(pAdapter, offset, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+static int
+Hal_EfusePgPacketWrite(IN	PADAPTER	pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	if(IS_HARDWARE_TYPE_8192C(pAdapter))
+	{
+		ret = hal_EfusePgPacketWrite_8192C(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+	else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+	{
+		ret = hal_EfusePgPacketWrite_8723(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static int 
+rtl8192c_Efuse_PgPacketWrite(IN	PADAPTER	pAdapter, 
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret;
+
+	if(bPseudoTest)
+	{
+		ret = Hal_EfusePgPacketWrite_Pseudo(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+	else
+	{
+		ret = Hal_EfusePgPacketWrite(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+	return ret;
+}
+
+VOID
+rtl8192c_EfuseParseIDCode(
+	IN	PADAPTER	pAdapter,
+	IN	u8			*hwinfo
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	u16			i,EEPROMId;
+	
+	// Checl 0x8129 again for making sure autoload status!!
+	EEPROMId = *((u16 *)&hwinfo[0]);
+	if( le16_to_cpu(EEPROMId) != RTL_EEPROM_ID)
+	{
+		DBG_8192C("EEPROM ID(%#x) is invalid!!\n", EEPROMId);
+		pEEPROM->bautoload_fail_flag = _TRUE;
+	}
+	else
+	{
+		pEEPROM->bautoload_fail_flag = _FALSE;
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("EEPROM ID = 0x%4x\n", EEPROMId));
+}
+
+void rtl8192c_read_chip_version(PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(pAdapter);
+	pHalData->VersionID = rtl8192c_ReadChipVersion(pAdapter);
+}
+
+void hal_notch_filter_8192c(_adapter *adapter, bool enable)
+{
+	if (enable) {
+		DBG_871X("Enable notch filter\n");
+		rtw_write8(adapter, rOFDM0_RxDSP+1, rtw_read8(adapter, rOFDM0_RxDSP+1) | BIT1);
+	} else {
+		DBG_871X("Disable notch filter\n");
+		rtw_write8(adapter, rOFDM0_RxDSP+1, rtw_read8(adapter, rOFDM0_RxDSP+1) & ~BIT1);
+	}
+}
+
+void hal_reset_security_engine_8192c(_adapter * adapter)
+{
+	rtw_write8(adapter, 0x522, 0xFF);
+	rtw_write8(adapter, 0x21, 0x35);
+	rtw_usleep_os(300);
+	rtw_write8(adapter, 0x101, rtw_read8(adapter,0x101)&~0x02);
+	rtw_write8(adapter, 0x101, rtw_read8(adapter,0x101)|0x02);
+	rtw_write8(adapter, 0x21, 0x55);
+	rtw_write8(adapter, 0x522, 0x00);
+}
+
+s32 c2h_id_filter_ccx_8192c(u8 id)
+{
+	s32 ret = _FALSE;
+	if (id == C2H_CCX_TX_RPT)
+		ret = _TRUE;
+	
+	return ret;
+}
+
+static s32 c2h_handler_8192c(_adapter *padapter, struct c2h_evt_hdr *c2h_evt)
+{
+	s32 ret = _SUCCESS;
+	u8 i = 0;
+
+	if (c2h_evt == NULL) {
+		DBG_8192C("%s c2h_evt is NULL\n",__FUNCTION__);
+		ret = _FAIL;
+		goto exit;
+	}
+
+	switch (c2h_evt->id) {
+	case C2H_CCX_TX_RPT:
+		handle_txrpt_ccx_8192c(padapter, c2h_evt->payload);
+		break;
+	default:
+		ret = _FAIL;
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+void rtl8192c_set_hal_ops(struct hal_ops *pHalFunc)
+{
+	pHalFunc->free_hal_data = &rtl8192c_free_hal_data;
+
+	pHalFunc->dm_init = &rtl8192c_init_dm_priv;
+	pHalFunc->dm_deinit = &rtl8192c_deinit_dm_priv;
+	pHalFunc->read_chip_version = &rtl8192c_read_chip_version;
+
+	pHalFunc->set_bwmode_handler = &PHY_SetBWMode8192C;
+	pHalFunc->set_channel_handler = &PHY_SwChnl8192C;
+
+	pHalFunc->hal_dm_watchdog = &rtl8192c_HalDmWatchDog;
+
+	pHalFunc->Add_RateATid = &rtl8192c_Add_RateATid;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	pHalFunc->AntDivBeforeLinkHandler = &SwAntDivBeforeLink8192C;
+	pHalFunc->AntDivCompareHandler = &SwAntDivCompare8192C;
+#endif
+
+	pHalFunc->read_bbreg = &rtl8192c_PHY_QueryBBReg;
+	pHalFunc->write_bbreg = &rtl8192c_PHY_SetBBReg;
+	pHalFunc->read_rfreg = &rtl8192c_PHY_QueryRFReg;
+	pHalFunc->write_rfreg = &rtl8192c_PHY_SetRFReg;
+
+	//Efuse related function
+	pHalFunc->EfusePowerSwitch = &rtl8192c_EfusePowerSwitch;
+	pHalFunc->ReadEFuse = &rtl8192c_ReadEFuse;
+	pHalFunc->EFUSEGetEfuseDefinition = &rtl8192c_EFUSE_GetEfuseDefinition;
+	pHalFunc->EfuseGetCurrentSize = &rtl8192c_EfuseGetCurrentSize;
+	pHalFunc->Efuse_PgPacketRead = &rtl8192c_Efuse_PgPacketRead;
+	pHalFunc->Efuse_PgPacketWrite = &rtl8192c_Efuse_PgPacketWrite;
+	pHalFunc->Efuse_WordEnableDataWrite = &rtl8192c_Efuse_WordEnableDataWrite;
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	pHalFunc->sreset_init_value = &sreset_init_value;
+	pHalFunc->sreset_reset_value = &sreset_reset_value;	
+	pHalFunc->silentreset = &sreset_reset;
+	pHalFunc->sreset_xmit_status_check = &rtl8192c_sreset_xmit_status_check;
+	pHalFunc->sreset_linked_status_check  = &rtl8192c_sreset_linked_status_check;
+	pHalFunc->sreset_get_wifi_status  = &sreset_get_wifi_status;
+	pHalFunc->sreset_inprogress= &sreset_inprogress;
+#endif
+
+#ifdef CONFIG_IOL
+	pHalFunc->IOL_exec_cmds_sync = &rtl8192c_IOL_exec_cmds_sync;
+#endif
+	pHalFunc->hal_notch_filter = &hal_notch_filter_8192c;
+	pHalFunc->hal_reset_security_engine = hal_reset_security_engine_8192c;
+
+	pHalFunc->c2h_handler = c2h_handler_8192c;
+	pHalFunc->c2h_id_filter_ccx = c2h_id_filter_ccx_8192c;
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c
new file mode 100755
index 0000000000000..a4194c4cbe7f7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c
@@ -0,0 +1,1207 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_MP_C_
+#ifdef CONFIG_MP_INCLUDED
+
+#include <drv_types.h>
+#include <rtw_mp.h>
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+
+
+
+s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	if (!netif_running(padapter->pnetdev)) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetPowerTracking! Fail: interface not opened!\n"));
+		return _FAIL;
+	}
+
+	if (check_fwstate(&padapter->mlmepriv, WIFI_MP_STATE) == _FALSE) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetPowerTracking! Fail: not in MP mode!\n"));
+		return _FAIL;
+	}
+
+	if (enable)
+		pdmpriv->TxPowerTrackControl = _TRUE;
+	else
+		pdmpriv->TxPowerTrackControl = _FALSE;
+
+	return _SUCCESS;
+}
+
+void Hal_GetPowerTracking(PADAPTER padapter, u8 *enable)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	*enable = pdmpriv->TxPowerTrackControl;
+}
+
+static void Hal_disable_dm(PADAPTER padapter)
+{
+	u8 v8;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	//3 1. disable firmware dynamic mechanism
+	// disable Power Training, Rate Adaptive
+	v8 = rtw_read8(padapter, REG_BCN_CTRL);
+	v8 &= ~EN_BCN_FUNCTION;
+	rtw_write8(padapter, REG_BCN_CTRL, v8);
+
+	//3 2. disable driver dynamic mechanism
+	// disable Dynamic Initial Gain
+	// disable High Power
+	// disable Power Tracking
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	// enable APK, LCK and IQK but disable power tracking
+	pdmpriv->TxPowerTrackControl = _FALSE;
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_SS, _TRUE);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	mpt_SwitchRfSetting
+ *
+ * Overview:	Change RF Setting when we siwthc channel/rate/BW for MP.
+ *
+ * Input:       IN	PADAPTER				pAdapter
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 01/08/2009	MHC		Suggestion from SD3 Willis for 92S series.
+ * 01/09/2009	MHC		Add CCK modification for 40MHZ. Suggestion from SD3.
+ *
+ *---------------------------------------------------------------------------*/
+void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct mp_priv *pmp = &pAdapter->mppriv;
+	u8 ChannelToSw = pmp->channel, eRFPath = RF_PATH_A;
+	u8 ulRateIdx = pmp->rateidx;
+	u8 ulbandwidth = pmp->bandwidth;
+	PMPT_CONTEXT	pMptCtx = &(pAdapter->mppriv.MptCtx);
+    BOOLEAN             bInteralPA = _FALSE;
+    u32				value = 0;
+
+#ifdef CONFIG_USB_HCI
+	if (IS_92C_SERIAL(pHalData->VersionID))
+	{
+		//92CE-VAU (92cu mCard)
+		if( BOARD_MINICARD == pHalData->BoardType)
+		{
+			if (ulRateIdx < MPT_RATE_6M)					// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else 											//OFDM~MCS rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F000);
+			}
+		}
+		else	//92CU dongle
+		{
+			if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else if (ChannelToSw & BIT0)	// OFDM rate, odd number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+			else if (ChannelToSw == 4)	// OFDM rate, even number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x28200);
+				write_rfreg(pAdapter, 0, RF_SYN_G6, 0xe0004);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x709);
+				rtw_msleep_os(1);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x4B333);
+			}
+			else if(ChannelToSw == 10)	// OFDM rate, even number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x28000);
+				write_rfreg(pAdapter, 0, RF_SYN_G6, 0xe000A);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x709);
+				rtw_msleep_os(1);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x7B333);
+			}
+			else if(ChannelToSw == 12)	// OFDM rate, even number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x28200);
+				write_rfreg(pAdapter, 0, RF_SYN_G6, 0xe000C);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x50B);
+				rtw_msleep_os(1);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x4B333);
+			}
+			else
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+		}
+	}
+	else	//88cu
+	{
+
+		//mcard interface
+
+		if( BOARD_MINICARD == pHalData->BoardType)
+		{
+			if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else 	//OFDM~MCS rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+
+			if(ChannelToSw == 6 || ChannelToSw == 8)
+			{
+				write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, 0x22);
+				write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, 0x22);
+				write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, 0x4F);
+			}
+			else
+			{
+				write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, 0x20);
+				write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, 0x20);
+				write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, pMptCtx->backup0xc30);
+			}
+		}
+		else
+		{
+			if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else if (ChannelToSw & BIT0)	// OFDM rate, odd number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+			else
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F000);
+			}
+		}
+	}
+
+#else	//PCI_INTERFACE
+
+	if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+	{
+		write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+	}
+	else	//OFDM~MCS rate
+	{
+		write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F000);
+	}
+	//88CE
+	if(!IS_92C_SERIAL(pHalData->VersionID))
+	{
+		if(ChannelToSw == 6 || ChannelToSw == 8)
+		{
+			write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, 0x22);
+			write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, 0x22);
+			write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, 0x4F);
+		}
+		else
+		{
+			write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, pMptCtx->backup0xc50);
+			write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, pMptCtx->backup0xc58);
+			write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, pMptCtx->backup0xc30);
+		}
+	 }
+
+#endif //CONFIG_USB_HCI
+
+
+}
+/*---------------------------hal\rtl8192c\MPT_Phy.c---------------------------*/
+
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14)
+{
+	u32		TempVal = 0, TempVal2 = 0, TempVal3 = 0;
+	u32		CurrCCKSwingVal = 0, CCKSwingIndex = 12;
+	u8		i;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+
+	// get current cck swing value and check 0xa22 & 0xa23 later to match the table.
+	CurrCCKSwingVal = read_bbreg(Adapter, rCCK0_TxFilter1, bMaskHWord);
+
+	if (!bInCH14)
+	{
+		// Readback the current bb cck swing value and compare with the table to
+		// get the current swing index
+		for (i = 0; i < CCK_TABLE_SIZE; i++)
+		{
+			if (((CurrCCKSwingVal&0xff) == (u32)CCKSwingTable_Ch1_Ch13[i][0]) &&
+				(((CurrCCKSwingVal&0xff00)>>8) == (u32)CCKSwingTable_Ch1_Ch13[i][1]))
+			{
+				CCKSwingIndex = i;
+//				RT_TRACE(COMP_INIT, DBG_LOUD,("Ch1~13, Current reg0x%x = 0x%lx, CCKSwingIndex=0x%x\n",
+//					(rCCK0_TxFilter1+2), CurrCCKSwingVal, CCKSwingIndex));
+				break;
+			}
+		}
+
+		//Write 0xa22 0xa23
+		TempVal = CCKSwingTable_Ch1_Ch13[CCKSwingIndex][0] +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][1]<<8) ;
+
+
+		//Write 0xa24 ~ 0xa27
+		TempVal2 = 0;
+		TempVal2 = CCKSwingTable_Ch1_Ch13[CCKSwingIndex][2] +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][3]<<8) +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][4]<<16 )+
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][5]<<24);
+
+		//Write 0xa28  0xa29
+		TempVal3 = 0;
+		TempVal3 = CCKSwingTable_Ch1_Ch13[CCKSwingIndex][6] +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][7]<<8) ;
+	}
+	else
+	{
+		for (i = 0; i < CCK_TABLE_SIZE; i++)
+		{
+			if (((CurrCCKSwingVal&0xff) == (u32)CCKSwingTable_Ch14[i][0]) &&
+				(((CurrCCKSwingVal&0xff00)>>8) == (u32)CCKSwingTable_Ch14[i][1]))
+			{
+				CCKSwingIndex = i;
+//				RT_TRACE(COMP_INIT, DBG_LOUD,("Ch14, Current reg0x%x = 0x%lx, CCKSwingIndex=0x%x\n",
+//					(rCCK0_TxFilter1+2), CurrCCKSwingVal, CCKSwingIndex));
+				break;
+			}
+		}
+
+		//Write 0xa22 0xa23
+		TempVal = CCKSwingTable_Ch14[CCKSwingIndex][0] +
+				(CCKSwingTable_Ch14[CCKSwingIndex][1]<<8) ;
+
+		//Write 0xa24 ~ 0xa27
+		TempVal2 = 0;
+		TempVal2 = CCKSwingTable_Ch14[CCKSwingIndex][2] +
+				(CCKSwingTable_Ch14[CCKSwingIndex][3]<<8) +
+				(CCKSwingTable_Ch14[CCKSwingIndex][4]<<16 )+
+				(CCKSwingTable_Ch14[CCKSwingIndex][5]<<24);
+
+		//Write 0xa28  0xa29
+		TempVal3 = 0;
+		TempVal3 = CCKSwingTable_Ch14[CCKSwingIndex][6] +
+				(CCKSwingTable_Ch14[CCKSwingIndex][7]<<8) ;
+	}
+
+	write_bbreg(Adapter, rCCK0_TxFilter1, bMaskHWord, TempVal);
+	write_bbreg(Adapter, rCCK0_TxFilter2, bMaskDWord, TempVal2);
+	write_bbreg(Adapter, rCCK0_DebugPort, bMaskLWord, TempVal3);
+}
+
+void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven)
+{
+	s32		TempCCk;
+	u8		CCK_index, CCK_index_old;
+	u8		Action = 0;	//0: no action, 1: even->odd, 2:odd->even
+	u8		TimeOut = 100;
+	s32		i = 0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+
+
+	if (!IS_92C_SERIAL(pHalData->VersionID))
+		return;
+#if 0
+	while(PlatformAtomicExchange(&Adapter->IntrCCKRefCount, TRUE) == TRUE)
+	{
+		PlatformSleepUs(100);
+		TimeOut--;
+		if(TimeOut <= 0)
+		{
+			RTPRINT(FINIT, INIT_TxPower,
+			 ("!!!MPT_CCKTxPowerAdjustbyIndex Wait for check CCK gain index too long!!!\n" ));
+			break;
+		}
+	}
+#endif
+	if (beven && !pMptCtx->bMptIndexEven)	//odd->even
+	{
+		Action = 2;
+		pMptCtx->bMptIndexEven = _TRUE;
+	}
+	else if (!beven && pMptCtx->bMptIndexEven)	//even->odd
+	{
+		Action = 1;
+		pMptCtx->bMptIndexEven = _FALSE;
+	}
+
+	if (Action != 0)
+	{
+		//Query CCK default setting From 0xa24
+		TempCCk = read_bbreg(pAdapter, rCCK0_TxFilter2, bMaskDWord) & bMaskCCK;
+		for (i = 0; i < CCK_TABLE_SIZE; i++)
+		{
+			if (pHalData->dmpriv.bCCKinCH14)
+			{
+				if (_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch14[i][2], 4) == _TRUE)
+				{
+					CCK_index_old = (u8) i;
+//					RTPRINT(FINIT, INIT_TxPower,("MPT_CCKTxPowerAdjustbyIndex: Initial reg0x%x = 0x%lx, CCK_index=0x%x, ch 14 %d\n",
+//						rCCK0_TxFilter2, TempCCk, CCK_index_old, pHalData->bCCKinCH14));
+					break;
+				}
+			}
+			else
+			{
+				if (_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch1_Ch13[i][2], 4) == _TRUE)
+				{
+					CCK_index_old = (u8) i;
+//					RTPRINT(FINIT, INIT_TxPower,("MPT_CCKTxPowerAdjustbyIndex: Initial reg0x%x = 0x%lx, CCK_index=0x%x, ch14 %d\n",
+//						rCCK0_TxFilter2, TempCCk, CCK_index_old, pHalData->bCCKinCH14));
+					break;
+				}
+			}
+		}
+
+		if (Action == 1)
+			CCK_index = CCK_index_old - 1;
+		else
+			CCK_index = CCK_index_old + 1;
+
+//		RTPRINT(FINIT, INIT_TxPower,("MPT_CCKTxPowerAdjustbyIndex: new CCK_index=0x%x\n",
+//			 CCK_index));
+
+		//Adjust CCK according to gain index
+		if (!pHalData->dmpriv.bCCKinCH14) {
+			rtw_write8(pAdapter, 0xa22, CCKSwingTable_Ch1_Ch13[CCK_index][0]);
+			rtw_write8(pAdapter, 0xa23, CCKSwingTable_Ch1_Ch13[CCK_index][1]);
+			rtw_write8(pAdapter, 0xa24, CCKSwingTable_Ch1_Ch13[CCK_index][2]);
+			rtw_write8(pAdapter, 0xa25, CCKSwingTable_Ch1_Ch13[CCK_index][3]);
+			rtw_write8(pAdapter, 0xa26, CCKSwingTable_Ch1_Ch13[CCK_index][4]);
+			rtw_write8(pAdapter, 0xa27, CCKSwingTable_Ch1_Ch13[CCK_index][5]);
+			rtw_write8(pAdapter, 0xa28, CCKSwingTable_Ch1_Ch13[CCK_index][6]);
+			rtw_write8(pAdapter, 0xa29, CCKSwingTable_Ch1_Ch13[CCK_index][7]);
+		} else {
+			rtw_write8(pAdapter, 0xa22, CCKSwingTable_Ch14[CCK_index][0]);
+			rtw_write8(pAdapter, 0xa23, CCKSwingTable_Ch14[CCK_index][1]);
+			rtw_write8(pAdapter, 0xa24, CCKSwingTable_Ch14[CCK_index][2]);
+			rtw_write8(pAdapter, 0xa25, CCKSwingTable_Ch14[CCK_index][3]);
+			rtw_write8(pAdapter, 0xa26, CCKSwingTable_Ch14[CCK_index][4]);
+			rtw_write8(pAdapter, 0xa27, CCKSwingTable_Ch14[CCK_index][5]);
+			rtw_write8(pAdapter, 0xa28, CCKSwingTable_Ch14[CCK_index][6]);
+			rtw_write8(pAdapter, 0xa29, CCKSwingTable_Ch14[CCK_index][7]);
+		}
+	}
+#if 0
+	RTPRINT(FINIT, INIT_TxPower,
+	("MPT_CCKTxPowerAdjustbyIndex 0xa20=%x\n", PlatformEFIORead4Byte(Adapter, 0xa20)));
+
+	PlatformAtomicExchange(&Adapter->IntrCCKRefCount, FALSE);
+#endif
+}
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+
+/*
+ * SetChannel
+ * Description
+ *	Use H2C command to change channel,
+ *	not only modify rf register, but also other setting need to be done.
+ */
+void Hal_SetChannel(PADAPTER pAdapter)
+{
+#if 0
+	struct mp_priv *pmp = &pAdapter->mppriv;
+
+//	SelectChannel(pAdapter, pmp->channel);
+	set_channel_bwmode(pAdapter, pmp->channel, pmp->channel_offset, pmp->bandwidth);
+#else
+	u8 		eRFPath;
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct mp_priv	*pmp = &pAdapter->mppriv;
+	u8		channel = pmp->channel;
+	u8		bandwidth = pmp->bandwidth;
+	u8		rate = pmp->rateidx;
+
+
+	// set RF channel register
+	for (eRFPath = 0; eRFPath < pHalData->NumTotalRFPath; eRFPath++)
+	{
+      if(IS_HARDWARE_TYPE_8192D(pAdapter))
+			_write_rfreg(pAdapter, (RF_RADIO_PATH_E)eRFPath, rRfChannel, 0xFF, channel);
+		else
+		_write_rfreg(pAdapter, eRFPath, rRfChannel, 0x3FF, channel);
+	}
+	Hal_mpt_SwitchRfSetting(pAdapter);
+
+	SelectChannel(pAdapter, channel);
+
+	if (pHalData->CurrentChannel == 14 && !pHalData->dmpriv.bCCKinCH14) {
+		pHalData->dmpriv.bCCKinCH14 = _TRUE;
+		Hal_MPT_CCKTxPowerAdjust(pAdapter, pHalData->dmpriv.bCCKinCH14);
+	}
+	else if (pHalData->CurrentChannel != 14 && pHalData->dmpriv.bCCKinCH14) {
+		pHalData->dmpriv.bCCKinCH14 = _FALSE;
+		Hal_MPT_CCKTxPowerAdjust(pAdapter, pHalData->dmpriv.bCCKinCH14);
+	}
+
+#endif
+}
+
+/*
+ * Notice
+ *	Switch bandwitdth may change center frequency(channel)
+ */
+void Hal_SetBandwidth(PADAPTER pAdapter)
+{
+	struct mp_priv *pmp = &pAdapter->mppriv;
+
+
+	SetBWMode(pAdapter, pmp->bandwidth, pmp->prime_channel_offset);
+	Hal_mpt_SwitchRfSetting(pAdapter);
+}
+
+void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	u32 tmpval = 0;
+
+
+	// rf-A cck tx power
+	write_bbreg(pAdapter, rTxAGC_A_CCK1_Mcs32, bMaskByte1, TxPower[RF_PATH_A]);
+	tmpval = (TxPower[RF_PATH_A]<<16) | (TxPower[RF_PATH_A]<<8) | TxPower[RF_PATH_A];
+	write_bbreg(pAdapter, rTxAGC_B_CCK11_A_CCK2_11, 0xffffff00, tmpval);
+
+	// rf-B cck tx power
+	write_bbreg(pAdapter, rTxAGC_B_CCK11_A_CCK2_11, bMaskByte0, TxPower[RF_PATH_B]);
+	tmpval = (TxPower[RF_PATH_B]<<16) | (TxPower[RF_PATH_B]<<8) | TxPower[RF_PATH_B];
+	write_bbreg(pAdapter, rTxAGC_B_CCK1_55_Mcs32, 0xffffff00, tmpval);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-SetCCKTxPower: A[0x%02x] B[0x%02x]\n",
+		  TxPower[RF_PATH_A], TxPower[RF_PATH_B]));
+}
+
+void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	u32 TxAGC = 0;
+	u8 tmpval = 0;
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+
+	// HT Tx-rf(A)
+	tmpval = TxPower[RF_PATH_A];
+	TxAGC = (tmpval<<24) | (tmpval<<16) | (tmpval<<8) | tmpval;
+
+	write_bbreg(pAdapter, rTxAGC_A_Rate18_06, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Rate54_24, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs03_Mcs00, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs07_Mcs04, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs11_Mcs08, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs15_Mcs12, bMaskDWord, TxAGC);
+
+	// HT Tx-rf(B)
+	tmpval = TxPower[RF_PATH_B];
+	TxAGC = (tmpval<<24) | (tmpval<<16) | (tmpval<<8) | tmpval;
+
+	write_bbreg(pAdapter, rTxAGC_B_Rate18_06, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Rate54_24, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs03_Mcs00, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs07_Mcs04, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs11_Mcs08, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs15_Mcs12, bMaskDWord, TxAGC);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-SetOFDMTxPower: A[0x%02x] B[0x%02x]\n",
+		  TxPower[RF_PATH_A], TxPower[RF_PATH_B]));
+}
+
+void Hal_SetAntennaPathPower(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	u8 TxPowerLevel[MAX_RF_PATH_NUMS];
+	u8 rfPath;
+
+	TxPowerLevel[RF_PATH_A] = pAdapter->mppriv.txpoweridx;
+	TxPowerLevel[RF_PATH_B] = pAdapter->mppriv.txpoweridx_b;
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+		default:
+			rfPath = RF_PATH_A;
+			break;
+		case ANTENNA_B:
+			rfPath = RF_PATH_B;
+			break;
+		case ANTENNA_C:
+			rfPath = RF_PATH_C;
+			break;
+	}
+
+	switch (pHalData->rf_chip)
+	{
+		case RF_8225:
+		case RF_8256:
+		case RF_6052:
+			Hal_SetCCKTxPower(pAdapter, TxPowerLevel);
+			if (pAdapter->mppriv.rateidx < MPT_RATE_6M)	// CCK rate
+				Hal_MPT_CCKTxPowerAdjustbyIndex(pAdapter, TxPowerLevel[rfPath]%2 == 0);
+			Hal_SetOFDMTxPower(pAdapter, TxPowerLevel);
+			break;
+
+		default:
+			break;
+	}
+}
+
+void Hal_SetTxPower(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	u8 TxPower = pAdapter->mppriv.txpoweridx;
+	u8 TxPowerLevel[MAX_RF_PATH_NUMS];
+	u8 rf, rfPath;
+
+	for (rf = 0; rf < MAX_RF_PATH_NUMS; rf++) {
+		TxPowerLevel[rf] = TxPower;
+	}
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+		default:
+			rfPath = RF_PATH_A;
+			break;
+		case ANTENNA_B:
+			rfPath = RF_PATH_B;
+			break;
+		case ANTENNA_C:
+			rfPath = RF_PATH_C;
+			break;
+	}
+
+	switch (pHalData->rf_chip)
+	{
+		// 2008/09/12 MH Test only !! We enable the TX power tracking for MP!!!!!
+		// We should call normal driver API later!!
+		case RF_8225:
+		case RF_8256:
+		case RF_6052:
+			Hal_SetCCKTxPower(pAdapter, TxPowerLevel);
+			if (pAdapter->mppriv.rateidx < MPT_RATE_6M)	// CCK rate
+				Hal_MPT_CCKTxPowerAdjustbyIndex(pAdapter, TxPowerLevel[rfPath]%2 == 0);
+			Hal_SetOFDMTxPower(pAdapter, TxPowerLevel);
+			break;
+
+		default:
+			break;
+	}
+
+//	SetCCKTxPower(pAdapter, TxPower);
+//	SetOFDMTxPower(pAdapter, TxPower);
+}
+
+void Hal_SetTxAGCOffset(PADAPTER pAdapter, u32 ulTxAGCOffset)
+{
+	u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D,tmpAGC;
+
+	TxAGCOffset_B = (ulTxAGCOffset&0x000000ff);
+	TxAGCOffset_C = ((ulTxAGCOffset&0x0000ff00)>>8);
+	TxAGCOffset_D = ((ulTxAGCOffset&0x00ff0000)>>16);
+
+	tmpAGC = (TxAGCOffset_D<<8 | TxAGCOffset_C<<4 | TxAGCOffset_B);
+	write_bbreg(pAdapter, rFPGA0_TxGainStage,
+			(bXBTxAGC|bXCTxAGC|bXDTxAGC), tmpAGC);
+}
+
+void Hal_SetDataRate(PADAPTER pAdapter)
+{
+	Hal_mpt_SwitchRfSetting(pAdapter);
+}
+
+#if  !defined (CONFIG_RTL8192C)  &&  !defined (CONFIG_RTL8192D)
+/*------------------------------Define structure----------------------------*/
+typedef struct _R_ANTENNA_SELECT_OFDM {
+	u32	r_tx_antenna:4;
+	u32	r_ant_l:4;
+	u32	r_ant_non_ht:4;
+	u32	r_ant_ht1:4;
+	u32	r_ant_ht2:4;
+	u32	r_ant_ht_s1:4;
+	u32	r_ant_non_ht_s1:4;
+	u32	OFDM_TXSC:2;
+	u32	Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK {
+	u8	r_cckrx_enable_2:2;
+	u8	r_cckrx_enable:2;
+	u8	r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+#endif
+
+void Hal_SetAntenna(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	R_ANTENNA_SELECT_OFDM *p_ofdm_tx;	/* OFDM Tx register */
+	R_ANTENNA_SELECT_CCK *p_cck_txrx;
+
+	u8	r_rx_antenna_ofdm = 0, r_ant_select_cck_val = 0;
+	u8	chgTx = 0, chgRx = 0;
+	u32	r_ant_sel_cck_val = 0, r_ant_select_ofdm_val = 0, r_ofdm_tx_en_val = 0;
+
+
+	p_ofdm_tx = (R_ANTENNA_SELECT_OFDM *)&r_ant_select_ofdm_val;
+	p_cck_txrx = (R_ANTENNA_SELECT_CCK *)&r_ant_select_cck_val;
+
+	p_ofdm_tx->r_ant_ht1	= 0x1;
+	p_ofdm_tx->r_ant_ht2	= 0x2;	// Second TX RF path is A
+	p_ofdm_tx->r_ant_non_ht = 0x3;	// 0x1+0x2=0x3
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+			p_ofdm_tx->r_tx_antenna		= 0x1;
+			r_ofdm_tx_en_val		= 0x1;
+			p_ofdm_tx->r_ant_l 		= 0x1;
+			p_ofdm_tx->r_ant_ht_s1 		= 0x1;
+			p_ofdm_tx->r_ant_non_ht_s1 	= 0x1;
+			p_cck_txrx->r_ccktx_enable	= 0x8;
+			chgTx = 1;
+
+			// From SD3 Willis suggestion !!! Set RF A=TX and B as standby
+//			if (IS_HARDWARE_TYPE_8192S(pAdapter))
+			{
+			write_bbreg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
+			write_bbreg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 1);
+			r_ofdm_tx_en_val		= 0x3;
+
+			// Power save
+			//cosa r_ant_select_ofdm_val = 0x11111111;
+
+			// We need to close RFB by SW control
+			if (pHalData->rf_type == RF_2T2R)
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT1, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT17, 0);
+			}
+			}
+			break;
+
+		case ANTENNA_B:
+			p_ofdm_tx->r_tx_antenna		= 0x2;
+			r_ofdm_tx_en_val		= 0x2;
+			p_ofdm_tx->r_ant_l 		= 0x2;
+			p_ofdm_tx->r_ant_ht_s1 		= 0x2;
+			p_ofdm_tx->r_ant_non_ht_s1 	= 0x2;
+			p_cck_txrx->r_ccktx_enable	= 0x4;
+			chgTx = 1;
+
+			// From SD3 Willis suggestion !!! Set RF A as standby
+			//if (IS_HARDWARE_TYPE_8192S(pAdapter))
+			{
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 1);
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
+//			r_ofdm_tx_en_val		= 0x3;
+
+			// Power save
+			//cosa r_ant_select_ofdm_val = 0x22222222;
+
+			// 2008/10/31 MH From SD3 Willi's suggestion. We must read RF 1T table.
+			// 2009/01/08 MH From Sd3 Willis. We need to close RFA by SW control
+			if (pHalData->rf_type == RF_2T2R || pHalData->rf_type == RF_1T2R)
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 0);
+//				PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT1, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT17, 1);
+			}
+			}
+		break;
+
+		case ANTENNA_AB:	// For 8192S
+			p_ofdm_tx->r_tx_antenna		= 0x3;
+			r_ofdm_tx_en_val		= 0x3;
+			p_ofdm_tx->r_ant_l 		= 0x3;
+			p_ofdm_tx->r_ant_ht_s1 		= 0x3;
+			p_ofdm_tx->r_ant_non_ht_s1 	= 0x3;
+			p_cck_txrx->r_ccktx_enable	= 0xC;
+			chgTx = 1;
+
+			// From SD3 Willis suggestion !!! Set RF B as standby
+			//if (IS_HARDWARE_TYPE_8192S(pAdapter))
+			{
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
+
+			// Disable Power save
+			//cosa r_ant_select_ofdm_val = 0x3321333;
+#if 0
+			// 2008/10/31 MH From SD3 Willi's suggestion. We must read RFA 2T table.
+			if ((pHalData->VersionID == VERSION_8192S_ACUT)) // For RTL8192SU A-Cut only, by Roger, 2008.11.07.
+			{
+				mpt_RFConfigFromPreParaArrary(pAdapter, 1, RF_PATH_A);
+			}
+#endif
+			// 2009/01/08 MH From Sd3 Willis. We need to enable RFA/B by SW control
+			if (pHalData->rf_type == RF_2T2R)
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 0);
+//				PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT1, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT17, 1);
+			}
+			}
+			break;
+
+		default:
+			break;
+	}
+
+	//
+	// r_rx_antenna_ofdm, bit0=A, bit1=B, bit2=C, bit3=D
+	// r_cckrx_enable : CCK default, 0=A, 1=B, 2=C, 3=D
+	// r_cckrx_enable_2 : CCK option, 0=A, 1=B, 2=C, 3=D
+	//
+	switch (pAdapter->mppriv.antenna_rx)
+	{
+		case ANTENNA_A:
+			r_rx_antenna_ofdm 		= 0x1;	// A
+			p_cck_txrx->r_cckrx_enable 	= 0x0;	// default: A
+			p_cck_txrx->r_cckrx_enable_2	= 0x0;	// option: A
+			chgRx = 1;
+			break;
+
+		case ANTENNA_B:
+			r_rx_antenna_ofdm 		= 0x2;	// B
+			p_cck_txrx->r_cckrx_enable 	= 0x1;	// default: B
+			p_cck_txrx->r_cckrx_enable_2	= 0x1;	// option: B
+			chgRx = 1;
+			break;
+
+		case ANTENNA_AB:
+			r_rx_antenna_ofdm 		= 0x3;	// AB
+			p_cck_txrx->r_cckrx_enable 	= 0x0;	// default:A
+			p_cck_txrx->r_cckrx_enable_2	= 0x1;	// option:B
+			chgRx = 1;
+			break;
+
+		default:
+			break;
+	}
+
+	if (chgTx && chgRx)
+	{
+		switch(pHalData->rf_chip)
+		{
+			case RF_8225:
+			case RF_8256:
+			case RF_6052:
+				//r_ant_sel_cck_val = r_ant_select_cck_val;
+				PHY_SetBBReg(pAdapter, rFPGA1_TxInfo, 0x7fffffff, r_ant_select_ofdm_val);	//OFDM Tx
+				PHY_SetBBReg(pAdapter, rFPGA0_TxInfo, 0x0000000f, r_ofdm_tx_en_val);		//OFDM Tx
+				PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable, 0x0000000f, r_rx_antenna_ofdm);	//OFDM Rx
+				PHY_SetBBReg(pAdapter, rOFDM1_TRxPathEnable, 0x0000000f, r_rx_antenna_ofdm);	//OFDM Rx
+				PHY_SetBBReg(pAdapter, rCCK0_AFESetting, bMaskByte3, r_ant_select_cck_val);//r_ant_sel_cck_val);		//CCK TxRx
+
+				break;
+
+			default:
+				break;
+		}
+	}
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-SwitchAntenna: finished\n"));
+}
+
+s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+
+
+	if (!netif_running(pAdapter->pnetdev)) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetThermalMeter! Fail: interface not opened!\n"));
+		return _FAIL;
+	}
+
+	if (check_fwstate(&pAdapter->mlmepriv, WIFI_MP_STATE) == _FALSE) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetThermalMeter: Fail! not in MP mode!\n"));
+		return _FAIL;
+	}
+
+	target_ther &= 0xff;
+	if (target_ther < 0x07)
+		target_ther = 0x07;
+	else if (target_ther > 0x1d)
+		target_ther = 0x1d;
+
+	pHalData->EEPROMThermalMeter = target_ther;
+
+	return _SUCCESS;
+}
+
+void Hal_TriggerRFThermalMeter(PADAPTER pAdapter)
+{
+  
+	write_rfreg(pAdapter, RF_PATH_A, RF_T_METER, 0x60);	// 0x24: RF Reg[6:5]
+
+//	RT_TRACE(_module_mp_,_drv_alert_, ("TriggerRFThermalMeter() finished.\n" ));
+}
+
+u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter)
+{
+	u32 ThermalValue = 0;
+
+	ThermalValue = _read_rfreg(pAdapter, RF_PATH_A, RF_T_METER, 0x1F);	// 0x24: RF Reg[4:0]
+//	RT_TRACE(_module_mp_, _drv_alert_, ("ThermalValue = 0x%x\n", ThermalValue));
+	return (u8)ThermalValue;
+}
+
+void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value)
+{
+#if 0
+	fw_cmd(pAdapter, IOCMD_GET_THERMAL_METER);
+	rtw_msleep_os(1000);
+	fw_cmd_data(pAdapter, value, 1);
+	*value &= 0xFF;
+#else
+
+	Hal_TriggerRFThermalMeter(pAdapter);
+	rtw_msleep_os(1000);
+	*value = Hal_ReadRFThermalMeter(pAdapter);
+#endif
+}
+
+void Hal_SetSingleCarrierTx(PADAPTER pAdapter, u8 bStart)
+{
+    HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	pAdapter->mppriv.MptCtx.bSingleCarrier = bStart;
+	if (bStart)// Start Single Carrier.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleCarrierTx: test start\n"));
+		// 1. if OFDM block on?
+		if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn))
+			write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);//set OFDM block on
+
+		{
+		// 2. set CCK test mode off, set to CCK normal mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
+		// 3. turn on scramble setting
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
+         }
+		// 4. Turn On Single Carrier Tx and turn off the other test modes.
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bEnable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+#ifdef CONFIG_RTL8192C
+		// 5. Disable TX power saving at STF & LLTF
+		write_bbreg(pAdapter, rOFDM1_LSTF, BIT22, 1);
+#endif
+	}
+	else// Stop Single Carrier.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleCarrierTx: test stop\n"));
+
+		// Turn off all test modes.
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+#ifdef CONFIG_RTL8192C
+		// Cancel disable TX power saving at STF&LLTF
+		write_bbreg(pAdapter, rOFDM1_LSTF, BIT22, 0);
+#endif
+		//Delay 10 ms //delay_ms(10);
+		rtw_msleep_os(10);
+
+		//BB Reset
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+	}
+}
+
+
+void Hal_SetSingleToneTx(PADAPTER pAdapter, u8 bStart)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	BOOLEAN		is92C = IS_92C_SERIAL(pHalData->VersionID);
+
+	u8 rfPath;
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+		default:
+			rfPath = RF_PATH_A;
+			break;
+		case ANTENNA_B:
+			rfPath = RF_PATH_B;
+			break;
+		case ANTENNA_C:
+			rfPath = RF_PATH_C;
+			break;
+	}
+
+	pAdapter->mppriv.MptCtx.bSingleTone = bStart;
+	if (bStart)// Start Single Tone.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleToneTx: test start\n"));
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, 0x0);
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, 0x0);
+
+		if (is92C)
+       		 {
+			_write_rfreg(pAdapter, RF_PATH_A, 0x21, BIT19, 0x01);
+			rtw_usleep_os(100);
+			if (rfPath == RF_PATH_A)
+				write_rfreg(pAdapter, RF_PATH_B, 0x00, 0x10000); // PAD all on.
+			else if (rfPath == RF_PATH_B)
+				write_rfreg(pAdapter, RF_PATH_A, 0x00, 0x10000); // PAD all on.
+		} else {
+			write_rfreg(pAdapter, rfPath, 0x21, 0xd4000);
+			rtw_usleep_os(100);
+		}
+		
+		write_rfreg(pAdapter, rfPath, 0x00, 0x2001f); // PAD all on.
+		rtw_usleep_os(100);
+	}
+	else// Stop Single Tone.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleToneTx: test stop\n"));
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, 0x1);
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, 0x1);
+
+		if (is92C) {
+			_write_rfreg(pAdapter, RF_PATH_A, 0x21, BIT19, 0x00);
+			rtw_usleep_os(100);
+			write_rfreg(pAdapter, RF_PATH_A, 0x00, 0x32d75); // PAD all on.
+			write_rfreg(pAdapter, RF_PATH_B, 0x00, 0x32d75); // PAD all on.
+			rtw_usleep_os(100);
+		} else {
+			write_rfreg(pAdapter, rfPath, 0x21, 0x54000);
+			rtw_usleep_os(100);
+
+			write_rfreg(pAdapter, rfPath, 0x00, 0x30000); // PAD all on.
+			rtw_usleep_os(100);
+		}
+	}
+	
+}
+
+
+void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart)
+{
+	pAdapter->mppriv.MptCtx.bCarrierSuppression = bStart;
+	if (bStart) // Start Carrier Suppression.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetCarrierSuppressionTx: test start\n"));
+		//if(pMgntInfo->dot11CurrentWirelessMode == WIRELESS_MODE_B)
+		if (pAdapter->mppriv.rateidx <= MPT_RATE_11M)
+		  {
+			// 1. if CCK block on?
+			if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn))
+				write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);//set CCK block on
+
+			//Turn Off All Test Mode
+			write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+			write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+			write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+
+			write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);    //transmit mode
+			write_bbreg(pAdapter, rCCK0_System, bCCKScramble, 0x0);  //turn off scramble setting
+
+			//Set CCK Tx Test Rate
+			//PHY_SetBBReg(pAdapter, rCCK0_System, bCCKTxRate, pMgntInfo->ForcedDataRate);
+			write_bbreg(pAdapter, rCCK0_System, bCCKTxRate, 0x0);    //Set FTxRate to 1Mbps
+		}
+	}
+	else// Stop Carrier Suppression.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetCarrierSuppressionTx: test stop\n"));
+		//if(pMgntInfo->dot11CurrentWirelessMode == WIRELESS_MODE_B)
+		if (pAdapter->mppriv.rateidx <= MPT_RATE_11M ) {
+			write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);    //normal mode
+			write_bbreg(pAdapter, rCCK0_System, bCCKScramble, 0x1);  //turn on scramble setting
+
+			//BB Reset
+			write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+			write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+		}
+	}
+	//DbgPrint("\n MPT_ProSetCarrierSupp() is finished. \n");
+}
+
+void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+	u32 cckrate;
+
+	if (bStart)
+	{
+		RT_TRACE(_module_mp_, _drv_alert_,
+			 ("SetCCKContinuousTx: test start\n"));
+
+		// 1. if CCK block on?
+		if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn))
+			write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);//set CCK block on
+
+		//Turn Off All Test Mode
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+		//Set CCK Tx Test Rate
+		#if 0
+		switch(pAdapter->mppriv.rateidx)
+		{
+			case 2:
+				cckrate = 0;
+				break;
+			case 4:
+				cckrate = 1;
+				break;
+			case 11:
+				cckrate = 2;
+				break;
+			case 22:
+				cckrate = 3;
+				break;
+			default:
+				cckrate = 0;
+				break;
+		}
+		#else
+		cckrate  = pAdapter->mppriv.rateidx;
+		#endif
+		write_bbreg(pAdapter, rCCK0_System, bCCKTxRate, cckrate);
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);	//transmit mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);	//turn on scramble setting
+
+#ifdef CONFIG_RTL8192C
+		// Patch for CCK 11M waveform
+		if (cckrate == MPT_RATE_1M)
+			write_bbreg(pAdapter, 0xA71, BIT(6), bDisable);
+		else
+			write_bbreg(pAdapter, 0xA71, BIT(6), bEnable);
+#endif
+
+	}
+	else {
+		RT_TRACE(_module_mp_, _drv_info_,
+			 ("SetCCKContinuousTx: test stop\n"));
+
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);	//normal mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);	//turn on scramble setting
+
+		//BB Reset
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+	}
+
+	pAdapter->mppriv.MptCtx.bCckContTx = bStart;
+	pAdapter->mppriv.MptCtx.bOfdmContTx = _FALSE;
+}/* mpt_StartCckContTx */
+
+void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+    HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	if (bStart) {
+		RT_TRACE(_module_mp_, _drv_info_, ("SetOFDMContinuousTx: test start\n"));
+		// 1. if OFDM block on?
+		if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn))
+			write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);//set OFDM block on
+        {
+
+		// 2. set CCK test mode off, set to CCK normal mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
+
+		// 3. turn on scramble setting
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
+        }
+		// 4. Turn On Continue Tx and turn off the other test modes.
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bEnable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+	} else {
+		RT_TRACE(_module_mp_,_drv_info_, ("SetOFDMContinuousTx: test stop\n"));
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+		//Delay 10 ms
+		rtw_msleep_os(10);
+		//BB Reset
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+	}
+
+	pAdapter->mppriv.MptCtx.bCckContTx = _FALSE;
+	pAdapter->mppriv.MptCtx.bOfdmContTx = bStart;
+}/* mpt_StartOfdmContTx */
+
+void Hal_SetContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+#if 0
+	// ADC turn off [bit24-21] adc port0 ~ port1
+	if (bStart) {
+		write_bbreg(pAdapter, rRx_Wait_CCCA, read_bbreg(pAdapter, rRx_Wait_CCCA) & 0xFE1FFFFF);
+		rtw_usleep_os(100);
+	}
+#endif
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("SetContinuousTx: rate:%d\n", pAdapter->mppriv.rateidx));
+
+	pAdapter->mppriv.MptCtx.bStartContTx = bStart;
+	if (pAdapter->mppriv.rateidx <= MPT_RATE_11M)
+	{
+		Hal_SetCCKContinuousTx(pAdapter, bStart);
+	}
+	else if ((pAdapter->mppriv.rateidx >= MPT_RATE_6M) &&
+		 (pAdapter->mppriv.rateidx <= MPT_RATE_MCS15))
+	{
+		Hal_SetOFDMContinuousTx(pAdapter, bStart);
+	}
+#if 0
+	// ADC turn on [bit24-21] adc port0 ~ port1
+	if (!bStart) {
+		write_bbreg(pAdapter, rRx_Wait_CCCA, read_bbreg(pAdapter, rRx_Wait_CCCA) | 0x01E00000);
+	}
+#endif
+}
+
+#endif // CONFIG_MP_INCLUDE
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c
new file mode 100755
index 0000000000000..1bae6dad889da
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c
@@ -0,0 +1,4841 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+
+ Module:	rtl8192c_phycfg.c	
+
+ Note:		Merge 92SE/SU PHY config as below
+			1. BB register R/W API
+ 			2. RF register R/W API
+ 			3. Initial BB/RF/MAC config by reading BB/MAC/RF txt.
+ 			3. Power setting API
+ 			4. Channel switch API
+ 			5. Initial gain switch API.
+ 			6. Other BB/MAC/RF API.
+ 			
+ Function:	PHY: Extern function, phy: local function
+ 		 
+ Export:	PHY_FunctionName
+
+ Abbrev:	NONE
+
+ History:
+	Data		Who		Remark	
+	08/08/2008  MHC    	1. Port from 9x series phycfg.c
+						2. Reorganize code arch and ad description.
+						3. Collect similar function.
+						4. Seperate extern/local API.
+	08/12/2008	MHC		We must merge or move USB PHY relative function later.
+	10/07/2008	MHC		Add IQ calibration for PHY.(Only 1T2R mode now!!!)
+	11/06/2008	MHC		Add TX Power index PG file to config in 0xExx register
+						area to map with EEPROM/EFUSE tx pwr index.
+	
+******************************************************************************/
+#define _HAL_8192C_PHYCFG_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+#endif
+
+#include <rtl8192c_hal.h>
+
+
+/*---------------------------Define Local Constant---------------------------*/
+/* Channel switch:The size of command tables for switch channel*/
+#define MAX_PRECMD_CNT 16
+#define MAX_RFDEPENDCMD_CNT 16
+#define MAX_POSTCMD_CNT 16
+
+#define MAX_DOZE_WAITING_TIMES_9x 64
+
+/*---------------------------Define Local Constant---------------------------*/
+
+
+/*------------------------Define global variable-----------------------------*/
+
+/*------------------------Define local variable------------------------------*/
+
+
+/*--------------------Define export function prototype-----------------------*/
+// Please refer to header file
+/*--------------------Define export function prototype-----------------------*/
+
+/*----------------------------Function Body----------------------------------*/
+//
+// 1. BB register R/W API
+//
+
+/**
+* Function:	phy_CalculateBitShift
+*
+* OverView:	Get shifted position of the BitMask
+*
+* Input:
+*			u4Byte		BitMask,	
+*
+* Output:	none
+* Return:		u4Byte		Return the shift bit bit position of the mask
+*/
+static	u32
+phy_CalculateBitShift(
+	u32 BitMask
+	)
+{
+	u32 i;
+
+	for(i=0; i<=31; i++)
+	{
+		if ( ((BitMask>>i) &  0x1 ) == 1)
+			break;
+	}
+
+	return (i);
+}
+
+
+/**
+* Function:	PHY_QueryBBReg
+*
+* OverView:	Read "sepcific bits" from BB register
+*
+* Input:
+*			PADAPTER		Adapter,
+*			u4Byte			RegAddr,		//The target address to be readback
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be readback	
+* Output:	None
+* Return:		u4Byte			Data			//The readback register value
+* Note:		This function is equal to "GetRegSetting" in PHY programming guide
+*/
+u32
+rtl8192c_PHY_QueryBBReg(
+	IN	PADAPTER	Adapter,
+	IN	u32		RegAddr,
+	IN	u32		BitMask
+	)
+{	
+  	u32	ReturnValue = 0, OriginalValue, BitShift;
+	u16	BBWaitCounter = 0;
+
+#if (DISABLE_BB_RF == 1)
+	return 0;
+#endif
+
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_QueryBBReg(): RegAddr(%#lx), BitMask(%#lx)\n", RegAddr, BitMask));
+
+	OriginalValue = rtw_read32(Adapter, RegAddr);
+	BitShift = phy_CalculateBitShift(BitMask);
+	ReturnValue = (OriginalValue & BitMask) >> BitShift;
+
+	//RTPRINT(FPHY, PHY_BBR, ("BBR MASK=0x%lx Addr[0x%lx]=0x%lx\n", BitMask, RegAddr, OriginalValue));
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_QueryBBReg(): RegAddr(%#lx), BitMask(%#lx), OriginalValue(%#lx)\n", RegAddr, BitMask, OriginalValue));
+
+	return (ReturnValue);
+
+}
+
+
+/**
+* Function:	PHY_SetBBReg
+*
+* OverView:	Write "Specific bits" to BB register (page 8~) 
+*
+* Input:
+*			PADAPTER		Adapter,
+*			u4Byte			RegAddr,		//The target address to be modified
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be modified	
+*			u4Byte			Data			//The new register value in the target bit position
+*										//of the target address			
+*
+* Output:	None
+* Return:		None
+* Note:		This function is equal to "PutRegSetting" in PHY programming guide
+*/
+
+VOID
+rtl8192c_PHY_SetBBReg(
+	IN	PADAPTER	Adapter,
+	IN	u32		RegAddr,
+	IN	u32		BitMask,
+	IN	u32		Data
+	)
+{
+	HAL_DATA_TYPE	*pHalData		= GET_HAL_DATA(Adapter);
+	//u16			BBWaitCounter	= 0;
+	u32			OriginalValue, BitShift;
+
+#if (DISABLE_BB_RF == 1)
+	return;
+#endif
+
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_SetBBReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx)\n", RegAddr, BitMask, Data));
+
+	if(BitMask!= bMaskDWord){//if not "double word" write
+		OriginalValue = rtw_read32(Adapter, RegAddr);
+		BitShift = phy_CalculateBitShift(BitMask);
+		Data = ((OriginalValue & (~BitMask)) | ((Data << BitShift) & BitMask));
+	}
+
+	rtw_write32(Adapter, RegAddr, Data);
+
+	//RTPRINT(FPHY, PHY_BBW, ("BBW MASK=0x%lx Addr[0x%lx]=0x%lx\n", BitMask, RegAddr, Data));
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_SetBBReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx)\n", RegAddr, BitMask, Data));
+	
+}
+
+
+//
+// 2. RF register R/W API
+//
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_FwRFSerialRead()
+ *
+ * Overview:	We support firmware to execute RF-R/W.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/21/2008	MHC		Create Version 0.  
+ *
+ *---------------------------------------------------------------------------*/
+static	u32
+phy_FwRFSerialRead(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset	)
+{
+	u32		retValue = 0;		
+	//RT_ASSERT(FALSE,("deprecate!\n"));
+	return	(retValue);
+
+}	/* phy_FwRFSerialRead */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_FwRFSerialWrite()
+ *
+ * Overview:	We support firmware to execute RF-R/W.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/21/2008	MHC		Create Version 0.  
+ *
+ *---------------------------------------------------------------------------*/
+static	VOID
+phy_FwRFSerialWrite(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u32				Data	)
+{
+	//RT_ASSERT(FALSE,("deprecate!\n"));
+}
+
+
+/**
+* Function:	phy_RFSerialRead
+*
+* OverView:	Read regster from RF chips 
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			Offset,		//The target address to be read			
+*
+* Output:	None
+* Return:		u4Byte			reback value
+* Note:		Threre are three types of serial operations: 
+*			1. Software serial write
+*			2. Hardware LSSI-Low Speed Serial Interface 
+*			3. Hardware HSSI-High speed
+*			serial write. Driver need to implement (1) and (2).
+*			This function is equal to the combination of RF_ReadReg() and  RFLSSIRead()
+*/
+static	u32
+phy_RFSerialRead(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset
+	)
+{
+	u32						retValue = 0;
+	HAL_DATA_TYPE				*pHalData = GET_HAL_DATA(Adapter);
+	BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+	u32						NewOffset;
+	u32 						tmplong,tmplong2;
+	u8					RfPiEnable=0;
+#if 0
+	if(pHalData->RFChipID == RF_8225 && Offset > 0x24) //36 valid regs
+		return	retValue;
+	if(pHalData->RFChipID == RF_8256 && Offset > 0x2D) //45 valid regs
+		return	retValue;
+#endif
+	//
+	// Make sure RF register offset is correct 
+	//
+	Offset &= 0x3f;
+
+	//
+	// Switch page for 8256 RF IC
+	//
+	NewOffset = Offset;
+
+	// 2009/06/17 MH We can not execute IO for power save or other accident mode.
+	//if(RT_CANNOT_IO(Adapter))
+	//{
+	//	RTPRINT(FPHY, PHY_RFR, ("phy_RFSerialRead return all one\n"));
+	//	return	0xFFFFFFFF;
+	//}
+
+	// For 92S LSSI Read RFLSSIRead
+	// For RF A/B write 0x824/82c(does not work in the future) 
+	// We must use 0x824 for RF A and B to execute read trigger
+	tmplong = PHY_QueryBBReg(Adapter, rFPGA0_XA_HSSIParameter2, bMaskDWord);
+	if(eRFPath == RF_PATH_A)
+		tmplong2 = tmplong;
+	else
+		tmplong2 = PHY_QueryBBReg(Adapter, pPhyReg->rfHSSIPara2, bMaskDWord);
+
+	tmplong2 = (tmplong2 & (~bLSSIReadAddress)) | (NewOffset<<23) | bLSSIReadEdge;	//T65 RF
+	
+	PHY_SetBBReg(Adapter, rFPGA0_XA_HSSIParameter2, bMaskDWord, tmplong&(~bLSSIReadEdge));	
+	rtw_udelay_os(10);// PlatformStallExecution(10);
+	
+	PHY_SetBBReg(Adapter, pPhyReg->rfHSSIPara2, bMaskDWord, tmplong2);	
+	rtw_udelay_os(100);//PlatformStallExecution(100);
+	
+	PHY_SetBBReg(Adapter, rFPGA0_XA_HSSIParameter2, bMaskDWord, tmplong|bLSSIReadEdge);	
+	rtw_udelay_os(10);//PlatformStallExecution(10);
+
+	if(eRFPath == RF_PATH_A)
+		RfPiEnable = (u8)PHY_QueryBBReg(Adapter, rFPGA0_XA_HSSIParameter1, BIT8);
+	else if(eRFPath == RF_PATH_B)
+		RfPiEnable = (u8)PHY_QueryBBReg(Adapter, rFPGA0_XB_HSSIParameter1, BIT8);
+	
+	if(RfPiEnable)
+	{	// Read from BBreg8b8, 12 bits for 8190, 20bits for T65 RF
+		retValue = PHY_QueryBBReg(Adapter, pPhyReg->rfLSSIReadBackPi, bLSSIReadBackData);
+		//DBG_8192C("Readback from RF-PI : 0x%x\n", retValue);
+	}
+	else
+	{	//Read from BBreg8a0, 12 bits for 8190, 20 bits for T65 RF
+		retValue = PHY_QueryBBReg(Adapter, pPhyReg->rfLSSIReadBack, bLSSIReadBackData);
+		//DBG_8192C("Readback from RF-SI : 0x%x\n", retValue);
+	}
+	//DBG_8192C("RFR-%d Addr[0x%x]=0x%x\n", eRFPath, pPhyReg->rfLSSIReadBack, retValue);
+	
+	return retValue;	
+		
+}
+
+
+
+/**
+* Function:	phy_RFSerialWrite
+*
+* OverView:	Write data to RF register (page 8~) 
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			Offset,		//The target address to be read			
+*			u4Byte			Data			//The new register Data in the target bit position
+*										//of the target to be read			
+*
+* Output:	None
+* Return:		None
+* Note:		Threre are three types of serial operations: 
+*			1. Software serial write
+*			2. Hardware LSSI-Low Speed Serial Interface 
+*			3. Hardware HSSI-High speed
+*			serial write. Driver need to implement (1) and (2).
+*			This function is equal to the combination of RF_ReadReg() and  RFLSSIRead()
+ *
+ * Note: 		  For RF8256 only
+ *			 The total count of RTL8256(Zebra4) register is around 36 bit it only employs 
+ *			 4-bit RF address. RTL8256 uses "register mode control bit" (Reg00[12], Reg00[10]) 
+ *			 to access register address bigger than 0xf. See "Appendix-4 in PHY Configuration
+ *			 programming guide" for more details. 
+ *			 Thus, we define a sub-finction for RTL8526 register address conversion
+ *		       ===========================================================
+ *			 Register Mode		RegCTL[1]		RegCTL[0]		Note
+ *								(Reg00[12])		(Reg00[10])
+ *		       ===========================================================
+ *			 Reg_Mode0				0				x			Reg 0 ~15(0x0 ~ 0xf)
+ *		       ------------------------------------------------------------------
+ *			 Reg_Mode1				1				0			Reg 16 ~30(0x1 ~ 0xf)
+ *		       ------------------------------------------------------------------
+ *			 Reg_Mode2				1				1			Reg 31 ~ 45(0x1 ~ 0xf)
+ *		       ------------------------------------------------------------------
+ *
+ *	2008/09/02	MH	Add 92S RF definition
+ *	
+ *
+ *
+*/
+static	VOID
+phy_RFSerialWrite(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u32				Data
+	)
+{
+	u32						DataAndAddr = 0;
+	HAL_DATA_TYPE				*pHalData = GET_HAL_DATA(Adapter);
+	BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+	u32						NewOffset;
+	
+#if 0
+	//<Roger_TODO> We should check valid regs for RF_6052 case.
+	if(pHalData->RFChipID == RF_8225 && Offset > 0x24) //36 valid regs
+		return;
+	if(pHalData->RFChipID == RF_8256 && Offset > 0x2D) //45 valid regs
+		return;
+#endif
+
+	// 2009/06/17 MH We can not execute IO for power save or other accident mode.
+	//if(RT_CANNOT_IO(Adapter))
+	//{
+	//	RTPRINT(FPHY, PHY_RFW, ("phy_RFSerialWrite stop\n"));
+	//	return;
+	//}
+
+	Offset &= 0x3f;
+
+	//
+	// Shadow Update
+	//
+	//PHY_RFShadowWrite(Adapter, eRFPath, Offset, Data);
+
+	//
+	// Switch page for 8256 RF IC
+	//
+	NewOffset = Offset;
+
+	//
+	// Put write addr in [5:0]  and write data in [31:16]
+	//
+	//DataAndAddr = (Data<<16) | (NewOffset&0x3f);
+	DataAndAddr = ((NewOffset<<20) | (Data&0x000fffff)) & 0x0fffffff;	// T65 RF
+
+	//
+	// Write Operation
+	//
+	PHY_SetBBReg(Adapter, pPhyReg->rf3wireOffset, bMaskDWord, DataAndAddr);
+	//RTPRINT(FPHY, PHY_RFW, ("RFW-%d Addr[0x%lx]=0x%lx\n", eRFPath, pPhyReg->rf3wireOffset, DataAndAddr));
+
+}
+
+
+/**
+* Function:	PHY_QueryRFReg
+*
+* OverView:	Query "Specific bits" to RF register (page 8~) 
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			RegAddr,		//The target address to be read
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be read	
+*
+* Output:	None
+* Return:		u4Byte			Readback value
+* Note:		This function is equal to "GetRFRegSetting" in PHY programming guide
+*/
+u32
+rtl8192c_PHY_QueryRFReg(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				RegAddr,
+	IN	u32				BitMask
+	)
+{
+	u32 Original_Value, Readback_Value, BitShift;	
+	//HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	//u8	RFWaitCounter = 0;
+	//_irqL	irqL;
+
+#if (DISABLE_BB_RF == 1)
+	return 0;
+#endif
+	
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_QueryRFReg(): RegAddr(%#lx), eRFPath(%#x), BitMask(%#lx)\n", RegAddr, eRFPath,BitMask));
+	
+#ifdef CONFIG_USB_HCI
+	//PlatformAcquireMutex(&pHalData->mxRFOperate);
+#else
+	//_enter_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+	
+	Original_Value = phy_RFSerialRead(Adapter, eRFPath, RegAddr);
+	
+	BitShift =  phy_CalculateBitShift(BitMask);
+	Readback_Value = (Original_Value & BitMask) >> BitShift;	
+
+#ifdef CONFIG_USB_HCI
+	//PlatformReleaseMutex(&pHalData->mxRFOperate);
+#else
+	//_exit_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+
+	//RTPRINT(FPHY, PHY_RFR, ("RFR-%d MASK=0x%lx Addr[0x%lx]=0x%lx\n", eRFPath, BitMask, RegAddr, Original_Value));//BitMask(%#lx),BitMask,
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_QueryRFReg(): RegAddr(%#lx), eRFPath(%#x),  Original_Value(%#lx)\n", 
+	//				RegAddr, eRFPath, Original_Value));
+	
+	return (Readback_Value);
+}
+
+/**
+* Function:	PHY_SetRFReg
+*
+* OverView:	Write "Specific bits" to RF register (page 8~) 
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			RegAddr,		//The target address to be modified
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be modified	
+*			u4Byte			Data			//The new register Data in the target bit position
+*										//of the target address			
+*
+* Output:	None
+* Return:		None
+* Note:		This function is equal to "PutRFRegSetting" in PHY programming guide
+*/
+VOID
+rtl8192c_PHY_SetRFReg(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				RegAddr,
+	IN	u32				BitMask,
+	IN	u32				Data
+	)
+{
+
+	//HAL_DATA_TYPE	*pHalData		= GET_HAL_DATA(Adapter);
+	//u1Byte			RFWaitCounter	= 0;
+	u32		Original_Value, BitShift;
+	//_irqL	irqL;
+
+#if (DISABLE_BB_RF == 1)
+	return;
+#endif
+	
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_SetRFReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx), eRFPath(%#x)\n", 
+	//	RegAddr, BitMask, Data, eRFPath));
+	//RTPRINT(FINIT, INIT_RF, ("PHY_SetRFReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx), eRFPath(%#x)\n", 
+	//	RegAddr, BitMask, Data, eRFPath));
+
+
+#ifdef CONFIG_USB_HCI
+	//PlatformAcquireMutex(&pHalData->mxRFOperate);
+#else
+	//_enter_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+	
+	// RF data is 12 bits only
+	if (BitMask != bRFRegOffsetMask) 
+	{
+		Original_Value = phy_RFSerialRead(Adapter, eRFPath, RegAddr);
+		BitShift =  phy_CalculateBitShift(BitMask);
+		Data = ((Original_Value & (~BitMask)) | (Data<< BitShift));
+	}
+		
+	phy_RFSerialWrite(Adapter, eRFPath, RegAddr, Data);
+	
+
+
+#ifdef CONFIG_USB_HCI
+	//PlatformReleaseMutex(&pHalData->mxRFOperate);
+#else
+	//_exit_critical(&pHalData->rf_lock, &irqL);
+#endif
+	
+	//PHY_QueryRFReg(Adapter,eRFPath,RegAddr,BitMask);
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_SetRFReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx), eRFPath(%#x)\n", 
+	//		RegAddr, BitMask, Data, eRFPath));
+
+}
+
+
+//
+// 3. Initial MAC/BB/RF config by reading MAC/BB/RF txt.
+//
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigMACWithParaFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write 
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName			
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *			
+ * Note: 		The format of MACPHY_REG.txt is different from PHY and RF. 
+ *			[Register][Mask][Value]
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigMACWithParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	int		rtStatus = _SUCCESS;
+
+	return rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigMACWithHeaderFile()
+ *
+ * Overview:    This function read BB parameters from Header file we gen, and do register
+ *			  Read/Write 
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName			
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *			
+ * Note: 		The format of MACPHY_REG.txt is different from PHY and RF. 
+ *			[Register][Mask][Value]
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigMACWithHeaderFile(
+	IN	PADAPTER		Adapter
+)
+{
+	u32					i = 0;
+	u32					ArrayLength = 0;
+	u32*				ptrArray;	
+	//HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(Adapter);
+
+	//2008.11.06 Modified by tynli.
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Read Rtl819XMACPHY_Array\n"));
+	ArrayLength = MAC_2T_ArrayLength;
+	ptrArray = Rtl819XMAC_Array;
+
+#ifdef CONFIG_IOL_MAC
+	if(rtw_IOL_applied(Adapter))
+	{
+		struct xmit_frame	*xmit_frame;
+		if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL)
+			return _FAIL;
+
+		for(i = 0 ;i < ArrayLength;i=i+2){ // Add by tynli for 2 column
+			rtw_IOL_append_WB_cmd(xmit_frame, ptrArray[i], (u8)ptrArray[i+1]);
+		}
+
+		return rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+	}
+	else
+#endif
+	{
+		for(i = 0 ;i < ArrayLength;i=i+2){ // Add by tynli for 2 column
+			rtw_write8(Adapter, ptrArray[i], (u8)ptrArray[i+1]);
+		}
+	}
+	
+	return _SUCCESS;
+	
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_MACConfig8192C
+ *
+ * Overview:	Condig MAC by header file or parameter file.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When		Who		Remark
+ *  08/12/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+int
+PHY_MACConfig8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	int		rtStatus = _SUCCESS;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	s8			*pszMACRegFile;
+	s8			sz88CMACRegFile[] = RTL8188C_PHY_MACREG;
+	s8			sz92CMACRegFile[] = RTL8192C_PHY_MACREG;
+	BOOLEAN		is92C = IS_92C_SERIAL(pHalData->VersionID);
+
+	if(is92C)
+		pszMACRegFile = sz92CMACRegFile;
+	else
+		pszMACRegFile = sz88CMACRegFile;
+
+	//
+	// Config MAC
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigMACWithHeaderFile(Adapter);
+#else
+	
+	// Not make sure EEPROM, add later
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Read MACREG.txt\n"));
+	rtStatus = phy_ConfigMACWithParaFile(Adapter, pszMACRegFile);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	//this switching setting cause some 8192cu hw have redownload fw fail issue
+	//improve 2-stream TX EVM by Jenyu
+	if(is92C)
+		rtw_write8(Adapter, REG_SPS0_CTRL+3,0x71);
+#endif
+
+
+	// 2010.07.13 AMPDU aggregation number 9
+	//rtw_write16(Adapter, REG_MAX_AGGR_NUM, MAX_AGGR_NUM);
+	rtw_write8(Adapter, REG_MAX_AGGR_NUM, 0x0A); //By tynli. 2010.11.18.
+#ifdef CONFIG_USB_HCI
+	if(is92C && (BOARD_USB_DONGLE == pHalData->BoardType))
+		rtw_write8(Adapter, 0x40,0x04);	
+#endif		
+
+	return rtStatus;
+
+}
+
+
+/**
+* Function:	phy_InitBBRFRegisterDefinition
+*
+* OverView:	Initialize Register definition offset for Radio Path A/B/C/D
+*
+* Input:
+*			PADAPTER		Adapter,
+*
+* Output:	None
+* Return:		None
+* Note:		The initialization value is constant and it should never be changes
+*/
+static	VOID
+phy_InitBBRFRegisterDefinition(
+	IN	PADAPTER		Adapter
+)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);	
+
+	// RF Interface Sowrtware Control
+	pHalData->PHYRegDef[RF_PATH_A].rfintfs = rFPGA0_XAB_RFInterfaceSW; // 16 LSBs if read 32-bit from 0x870
+	pHalData->PHYRegDef[RF_PATH_B].rfintfs = rFPGA0_XAB_RFInterfaceSW; // 16 MSBs if read 32-bit from 0x870 (16-bit for 0x872)
+	pHalData->PHYRegDef[RF_PATH_C].rfintfs = rFPGA0_XCD_RFInterfaceSW;// 16 LSBs if read 32-bit from 0x874
+	pHalData->PHYRegDef[RF_PATH_D].rfintfs = rFPGA0_XCD_RFInterfaceSW;// 16 MSBs if read 32-bit from 0x874 (16-bit for 0x876)
+
+	// RF Interface Readback Value
+	pHalData->PHYRegDef[RF_PATH_A].rfintfi = rFPGA0_XAB_RFInterfaceRB; // 16 LSBs if read 32-bit from 0x8E0	
+	pHalData->PHYRegDef[RF_PATH_B].rfintfi = rFPGA0_XAB_RFInterfaceRB;// 16 MSBs if read 32-bit from 0x8E0 (16-bit for 0x8E2)
+	pHalData->PHYRegDef[RF_PATH_C].rfintfi = rFPGA0_XCD_RFInterfaceRB;// 16 LSBs if read 32-bit from 0x8E4
+	pHalData->PHYRegDef[RF_PATH_D].rfintfi = rFPGA0_XCD_RFInterfaceRB;// 16 MSBs if read 32-bit from 0x8E4 (16-bit for 0x8E6)
+
+	// RF Interface Output (and Enable)
+	pHalData->PHYRegDef[RF_PATH_A].rfintfo = rFPGA0_XA_RFInterfaceOE; // 16 LSBs if read 32-bit from 0x860
+	pHalData->PHYRegDef[RF_PATH_B].rfintfo = rFPGA0_XB_RFInterfaceOE; // 16 LSBs if read 32-bit from 0x864
+
+	// RF Interface (Output and)  Enable
+	pHalData->PHYRegDef[RF_PATH_A].rfintfe = rFPGA0_XA_RFInterfaceOE; // 16 MSBs if read 32-bit from 0x860 (16-bit for 0x862)
+	pHalData->PHYRegDef[RF_PATH_B].rfintfe = rFPGA0_XB_RFInterfaceOE; // 16 MSBs if read 32-bit from 0x864 (16-bit for 0x866)
+
+	//Addr of LSSI. Wirte RF register by driver
+	pHalData->PHYRegDef[RF_PATH_A].rf3wireOffset = rFPGA0_XA_LSSIParameter; //LSSI Parameter
+	pHalData->PHYRegDef[RF_PATH_B].rf3wireOffset = rFPGA0_XB_LSSIParameter;
+
+	// RF parameter
+	pHalData->PHYRegDef[RF_PATH_A].rfLSSI_Select = rFPGA0_XAB_RFParameter;  //BB Band Select
+	pHalData->PHYRegDef[RF_PATH_B].rfLSSI_Select = rFPGA0_XAB_RFParameter;
+	pHalData->PHYRegDef[RF_PATH_C].rfLSSI_Select = rFPGA0_XCD_RFParameter;
+	pHalData->PHYRegDef[RF_PATH_D].rfLSSI_Select = rFPGA0_XCD_RFParameter;
+
+	// Tx AGC Gain Stage (same for all path. Should we remove this?)
+	pHalData->PHYRegDef[RF_PATH_A].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	pHalData->PHYRegDef[RF_PATH_B].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	pHalData->PHYRegDef[RF_PATH_C].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	pHalData->PHYRegDef[RF_PATH_D].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+
+	// Tranceiver A~D HSSI Parameter-1
+	pHalData->PHYRegDef[RF_PATH_A].rfHSSIPara1 = rFPGA0_XA_HSSIParameter1;  //wire control parameter1
+	pHalData->PHYRegDef[RF_PATH_B].rfHSSIPara1 = rFPGA0_XB_HSSIParameter1;  //wire control parameter1
+
+	// Tranceiver A~D HSSI Parameter-2
+	pHalData->PHYRegDef[RF_PATH_A].rfHSSIPara2 = rFPGA0_XA_HSSIParameter2;  //wire control parameter2
+	pHalData->PHYRegDef[RF_PATH_B].rfHSSIPara2 = rFPGA0_XB_HSSIParameter2;  //wire control parameter2
+
+	// RF switch Control
+	pHalData->PHYRegDef[RF_PATH_A].rfSwitchControl = rFPGA0_XAB_SwitchControl; //TR/Ant switch control
+	pHalData->PHYRegDef[RF_PATH_B].rfSwitchControl = rFPGA0_XAB_SwitchControl;
+	pHalData->PHYRegDef[RF_PATH_C].rfSwitchControl = rFPGA0_XCD_SwitchControl;
+	pHalData->PHYRegDef[RF_PATH_D].rfSwitchControl = rFPGA0_XCD_SwitchControl;
+
+	// AGC control 1 
+	pHalData->PHYRegDef[RF_PATH_A].rfAGCControl1 = rOFDM0_XAAGCCore1;
+	pHalData->PHYRegDef[RF_PATH_B].rfAGCControl1 = rOFDM0_XBAGCCore1;
+	pHalData->PHYRegDef[RF_PATH_C].rfAGCControl1 = rOFDM0_XCAGCCore1;
+	pHalData->PHYRegDef[RF_PATH_D].rfAGCControl1 = rOFDM0_XDAGCCore1;
+
+	// AGC control 2 
+	pHalData->PHYRegDef[RF_PATH_A].rfAGCControl2 = rOFDM0_XAAGCCore2;
+	pHalData->PHYRegDef[RF_PATH_B].rfAGCControl2 = rOFDM0_XBAGCCore2;
+	pHalData->PHYRegDef[RF_PATH_C].rfAGCControl2 = rOFDM0_XCAGCCore2;
+	pHalData->PHYRegDef[RF_PATH_D].rfAGCControl2 = rOFDM0_XDAGCCore2;
+
+	// RX AFE control 1 
+	pHalData->PHYRegDef[RF_PATH_A].rfRxIQImbalance = rOFDM0_XARxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_B].rfRxIQImbalance = rOFDM0_XBRxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_C].rfRxIQImbalance = rOFDM0_XCRxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_D].rfRxIQImbalance = rOFDM0_XDRxIQImbalance;	
+
+	// RX AFE control 1  
+	pHalData->PHYRegDef[RF_PATH_A].rfRxAFE = rOFDM0_XARxAFE;
+	pHalData->PHYRegDef[RF_PATH_B].rfRxAFE = rOFDM0_XBRxAFE;
+	pHalData->PHYRegDef[RF_PATH_C].rfRxAFE = rOFDM0_XCRxAFE;
+	pHalData->PHYRegDef[RF_PATH_D].rfRxAFE = rOFDM0_XDRxAFE;	
+
+	// Tx AFE control 1 
+	pHalData->PHYRegDef[RF_PATH_A].rfTxIQImbalance = rOFDM0_XATxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_B].rfTxIQImbalance = rOFDM0_XBTxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_C].rfTxIQImbalance = rOFDM0_XCTxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_D].rfTxIQImbalance = rOFDM0_XDTxIQImbalance;	
+
+	// Tx AFE control 2 
+	pHalData->PHYRegDef[RF_PATH_A].rfTxAFE = rOFDM0_XATxAFE;
+	pHalData->PHYRegDef[RF_PATH_B].rfTxAFE = rOFDM0_XBTxAFE;
+	pHalData->PHYRegDef[RF_PATH_C].rfTxAFE = rOFDM0_XCTxAFE;
+	pHalData->PHYRegDef[RF_PATH_D].rfTxAFE = rOFDM0_XDTxAFE;	
+
+	// Tranceiver LSSI Readback SI mode 
+	pHalData->PHYRegDef[RF_PATH_A].rfLSSIReadBack = rFPGA0_XA_LSSIReadBack;
+	pHalData->PHYRegDef[RF_PATH_B].rfLSSIReadBack = rFPGA0_XB_LSSIReadBack;
+	pHalData->PHYRegDef[RF_PATH_C].rfLSSIReadBack = rFPGA0_XC_LSSIReadBack;
+	pHalData->PHYRegDef[RF_PATH_D].rfLSSIReadBack = rFPGA0_XD_LSSIReadBack;	
+
+	// Tranceiver LSSI Readback PI mode 
+	pHalData->PHYRegDef[RF_PATH_A].rfLSSIReadBackPi = TransceiverA_HSPI_Readback;
+	pHalData->PHYRegDef[RF_PATH_B].rfLSSIReadBackPi = TransceiverB_HSPI_Readback;
+	//pHalData->PHYRegDef[RF_PATH_C].rfLSSIReadBackPi = rFPGA0_XC_LSSIReadBack;
+	//pHalData->PHYRegDef[RF_PATH_D].rfLSSIReadBackPi = rFPGA0_XD_LSSIReadBack;	
+
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigBBWithParaFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write 
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName			
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *	2008/11/06	MH	For 92S we do not support silent reset now. Disable 
+ *					parameter file compare!!!!!!??
+ *			
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	int		rtStatus = _SUCCESS;
+
+	return rtStatus;	
+}
+
+
+
+//****************************************
+// The following is for High Power PA
+//****************************************
+VOID
+phy_ConfigBBExternalPA(
+	IN	PADAPTER			Adapter
+)
+{
+#ifdef CONFIG_USB_HCI
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u16 i=0;
+	u32 temp=0;
+
+	if(!pHalData->ExternalPA)
+	{
+		return;
+	}
+
+	// 2010/10/19 MH According to Jenyu/EEChou 's opinion, we need not to execute the 
+	// same code as SU. It is already updated in PHY_REG_1T_HP.txt.
+#if 0
+	PHY_SetBBReg(Adapter, 0xee8, BIT28, 1);
+	temp = PHY_QueryBBReg(Adapter, 0x860, bMaskDWord);
+	temp |= (BIT26|BIT21|BIT10|BIT5);
+	PHY_SetBBReg(Adapter, 0x860, bMaskDWord, temp);
+	PHY_SetBBReg(Adapter, 0x870, BIT10, 0);
+	PHY_SetBBReg(Adapter, 0xc80, bMaskDWord, 0x20000080);
+	PHY_SetBBReg(Adapter, 0xc88, bMaskDWord, 0x40000100);
+#endif
+
+#endif
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigBBWithHeaderFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write 
+ *
+ * Input:      	PADAPTER		Adapter
+ *			u1Byte 			ConfigType     0 => PHY_CONFIG
+ *										 1 =>AGC_TAB
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *			
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithHeaderFile(
+	IN	PADAPTER		Adapter,
+	IN	u8 			ConfigType
+)
+{
+	int i;
+	u32*	Rtl819XPHY_REGArray_Table;
+	u32*	Rtl819XAGCTAB_Array_Table;
+	u16	PHY_REGArrayLen, AGCTAB_ArrayLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	int ret = _SUCCESS;
+
+	//
+	// 2009.11.24. Modified by tynli.
+	//
+	if(IS_92C_SERIAL(pHalData->VersionID))
+	{
+		AGCTAB_ArrayLen = AGCTAB_2TArrayLength;
+		Rtl819XAGCTAB_Array_Table = Rtl819XAGCTAB_2TArray;
+		PHY_REGArrayLen = PHY_REG_2TArrayLength;
+		Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_2TArray;
+#ifdef CONFIG_USB_HCI
+		if(pHalData->BoardType == BOARD_MINICARD )
+		{
+			PHY_REGArrayLen = PHY_REG_2T_mCardArrayLength;
+			Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_2T_mCardArray;			
+		}
+#endif
+	}
+	else
+	{
+		AGCTAB_ArrayLen = AGCTAB_1TArrayLength;
+		Rtl819XAGCTAB_Array_Table = Rtl819XAGCTAB_1TArray;
+		PHY_REGArrayLen = PHY_REG_1TArrayLength;
+		Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_1TArray;
+#ifdef CONFIG_USB_HCI
+		if(pHalData->BoardType == BOARD_MINICARD )
+		{
+			PHY_REGArrayLen = PHY_REG_1T_mCardArrayLength;
+			Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_1T_mCardArray;			
+		}
+		else if(pHalData->BoardType == BOARD_USB_High_PA)
+		{
+			AGCTAB_ArrayLen = AGCTAB_1T_HPArrayLength;
+			Rtl819XAGCTAB_Array_Table = Rtl819XAGCTAB_1T_HPArray;
+			PHY_REGArrayLen = PHY_REG_1T_HPArrayLength;
+			Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_1T_HPArray;			
+		}
+#endif
+	}
+
+	if(ConfigType == BaseBand_Config_PHY_REG)
+	{
+		#ifdef CONFIG_IOL_BB_PHY_REG
+		if(rtw_IOL_applied(Adapter))
+		{
+			struct xmit_frame	*xmit_frame;
+			u32 tmp_value;
+
+			if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+				ret = _FAIL;
+				goto exit;
+			}
+
+			for(i=0;i<PHY_REGArrayLen;i=i+2)
+			{
+				tmp_value=Rtl819XPHY_REGArray_Table[i+1];
+				
+				if (Rtl819XPHY_REGArray_Table[i] == 0xfe)
+					rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 50);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfd)
+					rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfc)
+					rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 1);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfb)
+					rtw_IOL_append_DELAY_US_cmd(xmit_frame, 50);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfa)
+					rtw_IOL_append_DELAY_US_cmd(xmit_frame, 5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xf9)
+					rtw_IOL_append_DELAY_US_cmd(xmit_frame, 1);
+
+				rtw_IOL_append_WD_cmd(xmit_frame, Rtl819XPHY_REGArray_Table[i], tmp_value);	
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XPHY_REGArray_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XPHY_REGArray_Table[i], Rtl819XPHY_REGArray_Table[i+1]));
+			}
+		
+			ret = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+		}
+		else
+		#endif
+		{
+			for(i=0;i<PHY_REGArrayLen;i=i+2)
+			{
+				if (Rtl819XPHY_REGArray_Table[i] == 0xfe){
+					#ifdef CONFIG_LONG_DELAY_ISSUE
+					rtw_msleep_os(50);
+					#else
+					rtw_mdelay_os(50);
+					#endif
+				}
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfd)
+					rtw_mdelay_os(5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfc)
+					rtw_mdelay_os(1);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfb)
+					rtw_udelay_os(50);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfa)
+					rtw_udelay_os(5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xf9)
+					rtw_udelay_os(1);
+
+				PHY_SetBBReg(Adapter, Rtl819XPHY_REGArray_Table[i], bMaskDWord, Rtl819XPHY_REGArray_Table[i+1]);
+
+				// Add 1us delay between BB/RF register setting.
+				rtw_udelay_os(1);
+
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XPHY_REGArray_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XPHY_REGArray_Table[i], Rtl819XPHY_REGArray_Table[i+1]));
+			}
+		}
+	
+		// for External PA
+		phy_ConfigBBExternalPA(Adapter);
+	}
+	else if(ConfigType == BaseBand_Config_AGC_TAB)
+	{
+		#ifdef CONFIG_IOL_BB_AGC_TAB
+		if(rtw_IOL_applied(Adapter))
+		{
+			struct xmit_frame	*xmit_frame;
+
+			if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+				ret = _FAIL;
+				goto exit;
+			}
+
+			for(i=0;i<AGCTAB_ArrayLen;i=i+2)
+			{
+				rtw_IOL_append_WD_cmd(xmit_frame, Rtl819XAGCTAB_Array_Table[i], Rtl819XAGCTAB_Array_Table[i+1]);							
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XAGCTAB_Array_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XAGCTAB_Array_Table[i], Rtl819XAGCTAB_Array_Table[i+1]));
+			}
+		
+			ret = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+		}
+		else
+		#endif
+		{
+			for(i=0;i<AGCTAB_ArrayLen;i=i+2)
+			{
+				PHY_SetBBReg(Adapter, Rtl819XAGCTAB_Array_Table[i], bMaskDWord, Rtl819XAGCTAB_Array_Table[i+1]);		
+
+				// Add 1us delay between BB/RF register setting.
+				rtw_udelay_os(1);
+				
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XAGCTAB_Array_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XAGCTAB_Array_Table[i], Rtl819XAGCTAB_Array_Table[i+1]));
+			}
+		}
+	}
+
+exit:
+	return ret;
+	
+}
+
+
+VOID
+storePwrIndexDiffRateOffset(
+	IN	PADAPTER	Adapter,
+	IN	u32		RegAddr,
+	IN	u32		BitMask,
+	IN	u32		Data
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	if(RegAddr == rTxAGC_A_Rate18_06)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][0] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][0] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][0]));
+	}
+	if(RegAddr == rTxAGC_A_Rate54_24)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][1] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][1] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][1]));
+	}
+	if(RegAddr == rTxAGC_A_CCK1_Mcs32)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][6] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][6] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][6]));
+	}
+	if(RegAddr == rTxAGC_B_CCK11_A_CCK2_11 && BitMask == 0xffffff00)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][7] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][7] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][7]));
+	}	
+	if(RegAddr == rTxAGC_A_Mcs03_Mcs00)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][2] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][2] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][2]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs07_Mcs04)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][3] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][3] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][3]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs11_Mcs08)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][4] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][4] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][4]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs15_Mcs12)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][5] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][5] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][5]));
+	}
+	if(RegAddr == rTxAGC_B_Rate18_06)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][8] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][8] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][8]));
+	}
+	if(RegAddr == rTxAGC_B_Rate54_24)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][9] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][9] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][9]));
+	}
+	if(RegAddr == rTxAGC_B_CCK1_55_Mcs32)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][14] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][14] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][14]));
+	}
+	if(RegAddr == rTxAGC_B_CCK11_A_CCK2_11 && BitMask == 0x000000ff)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][15] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][15] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][15]));
+	}	
+	if(RegAddr == rTxAGC_B_Mcs03_Mcs00)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][10] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][10] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][10]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs07_Mcs04)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][11] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][11] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][11]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs11_Mcs08)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][12] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][12] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][12]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs15_Mcs12)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][13] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][13] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][13]));
+		pHalData->pwrGroupCnt++;
+	}
+}
+/*-----------------------------------------------------------------------------
+ * Function:	phy_ConfigBBWithPgParaFile
+ *
+ * Overview:	
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/06/2008 	MHC		Create Version 0.
+ * 2009/07/29	tynli		(porting from 92SE branch)2009/03/11 Add copy parameter file to buffer for silent reset
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithPgParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	int		rtStatus = _SUCCESS;
+
+
+	return rtStatus;
+	
+}	/* phy_ConfigBBWithPgParaFile */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_ConfigBBWithPgHeaderFile
+ *
+ * Overview:	Config PHY_REG_PG array 
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/06/2008 	MHC		Add later!!!!!!.. Please modify for new files!!!!
+ * 11/10/2008	tynli		Modify to mew files.
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithPgHeaderFile(
+	IN	PADAPTER		Adapter,
+	IN	u8 			ConfigType)
+{
+	int i;
+	u32*	Rtl819XPHY_REGArray_Table_PG;
+	u16	PHY_REGArrayPGLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	// Default: pHalData->RF_Type = RF_2T2R.
+	PHY_REGArrayPGLen = PHY_REG_Array_PGLength;
+	Rtl819XPHY_REGArray_Table_PG = Rtl819XPHY_REG_Array_PG;
+
+#ifdef CONFIG_USB_HCI
+// 2010/10/19 Chiyoko According to Alex/Willson opinion, VAU/dongle can share the same PHY_REG_PG.txt
+/*
+	if(pHalData->BoardType == BOARD_MINICARD )
+	{
+		PHY_REGArrayPGLen = PHY_REG_Array_PG_mCardLength;
+		Rtl819XPHY_REGArray_Table_PG = Rtl819XPHY_REG_Array_PG_mCard;
+	}
+	else */if(pHalData->BoardType ==BOARD_USB_High_PA )
+	{
+		PHY_REGArrayPGLen = PHY_REG_Array_PG_HPLength;
+		Rtl819XPHY_REGArray_Table_PG = Rtl819XPHY_REG_Array_PG_HP;
+	}
+#endif
+
+	if(ConfigType == BaseBand_Config_PHY_REG)
+	{
+		for(i=0;i<PHY_REGArrayPGLen;i=i+3)
+		{
+			#if 0 //without IO, no delay is neeeded...
+			if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfe){
+				#ifdef CONFIG_LONG_DELAY_ISSUE
+				rtw_msleep_os(50);
+				#else
+				rtw_mdelay_os(50);
+				#endif
+			}
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfd)
+				rtw_mdelay_os(5);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfc)
+				rtw_mdelay_os(1);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfb)
+				rtw_udelay_os(50);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfa)
+				rtw_udelay_os(5);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xf9)
+				rtw_udelay_os(1);
+			//PHY_SetBBReg(Adapter, Rtl819XPHY_REGArray_Table_PG[i], Rtl819XPHY_REGArray_Table_PG[i+1], Rtl819XPHY_REGArray_Table_PG[i+2]);		
+			#endif
+			
+			storePwrIndexDiffRateOffset(Adapter, Rtl819XPHY_REGArray_Table_PG[i], 
+				Rtl819XPHY_REGArray_Table_PG[i+1], 
+				Rtl819XPHY_REGArray_Table_PG[i+2]);
+			//RT_TRACE(COMP_SEND, DBG_TRACE, ("The Rtl819XPHY_REGArray_Table_PG[0] is %lx Rtl819XPHY_REGArray_Table_PG[1] is %lx \n",Rtl819XPHY_REGArray_Table_PG[i], Rtl819XPHY_REGArray_Table_PG[i+1]));
+		}
+	}
+	else
+	{
+
+		//RT_TRACE(COMP_SEND, DBG_LOUD, ("phy_ConfigBBWithPgHeaderFile(): ConfigType != BaseBand_Config_PHY_REG\n"));
+	}
+	
+	return _SUCCESS;
+	
+}	/* phy_ConfigBBWithPgHeaderFile */
+
+#if (MP_DRIVER == 1)
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigBBWithMpParaFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write 
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName			
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *	2008/11/06	MH	For 92S we do not support silent reset now. Disable 
+ *					parameter file compare!!!!!!??
+ *			
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithMpParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName
+)
+{
+#if 1
+	int		rtStatus = _SUCCESS;
+#else
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	s4Byte			nLinesRead, ithLine;
+	RT_STATUS		rtStatus = RT_STATUS_SUCCESS;
+	ps1Byte 		szLine;
+	u4Byte			u4bRegOffset, u4bRegMask, u4bRegValue;
+	u4Byte			u4bMove;
+	
+	if(ADAPTER_TEST_STATUS_FLAG(Adapter, ADAPTER_STATUS_FIRST_INIT))
+	{
+		rtStatus = PlatformReadFile(
+					Adapter, 
+					pFileName,
+					(pu1Byte)(pHalData->BufOfLines),
+					MAX_LINES_HWCONFIG_TXT,
+					MAX_BYTES_LINE_HWCONFIG_TXT,
+					&nLinesRead
+					);
+		if(rtStatus == RT_STATUS_SUCCESS)
+		{
+			PlatformMoveMemory(pHalData->BufOfLines6, pHalData->BufOfLines, nLinesRead*MAX_BYTES_LINE_HWCONFIG_TXT);
+			pHalData->nLinesRead6 = nLinesRead;
+		}
+		else
+		{
+			// Temporarily skip PHY_REG_MP.txt if file does not exist.
+			pHalData->nLinesRead6 = 0;
+			RT_TRACE(COMP_INIT, DBG_LOUD, ("No matched file \r\n"));
+			return RT_STATUS_SUCCESS;
+		}
+	}
+	else
+	{
+		PlatformMoveMemory(pHalData->BufOfLines, pHalData->BufOfLines6, MAX_LINES_HWCONFIG_TXT*MAX_BYTES_LINE_HWCONFIG_TXT);
+		nLinesRead = pHalData->nLinesRead6;
+		rtStatus = RT_STATUS_SUCCESS;
+	}
+
+
+	if(rtStatus == RT_STATUS_SUCCESS)
+	{
+		RT_TRACE(COMP_INIT, DBG_LOUD, ("phy_ConfigBBWithMpParaFile(): read %s ok\n", pFileName));
+
+		for(ithLine = 0; ithLine < nLinesRead; ithLine++)
+		{
+			szLine = pHalData->BufOfLines[ithLine];
+
+			if(!IsCommentString(szLine))
+			{
+				// Get 1st hex value as register offset.
+				if(GetHexValueFromString(szLine, &u4bRegOffset, &u4bMove))
+				{
+					if(u4bRegOffset == 0xff)
+					{ // Ending.
+						break;
+					}
+					else if (u4bRegOffset == 0xfe)
+						delay_ms(50);
+					else if (u4bRegOffset == 0xfd)
+						delay_ms(5);
+					else if (u4bRegOffset == 0xfc)
+						delay_ms(1);
+					else if (u4bRegOffset == 0xfb)
+						PlatformStallExecution(50);
+					else if (u4bRegOffset == 0xfa)
+						PlatformStallExecution(5);
+					else if (u4bRegOffset == 0xf9)
+						PlatformStallExecution(1);
+					
+					// Get 2nd hex value as register value.
+					szLine += u4bMove;
+					if(GetHexValueFromString(szLine, &u4bRegValue, &u4bMove))
+					{
+						RT_TRACE(COMP_FPGA, DBG_TRACE, ("[ADDR]%03lX=%08lX\n", u4bRegOffset, u4bRegValue));
+						PHY_SetBBReg(Adapter, u4bRegOffset, bMaskDWord, u4bRegValue);
+
+						// Add 1us delay between BB/RF register setting.
+						PlatformStallExecution(1);
+					}
+				}
+			}
+		}
+	}
+	else
+	{
+		RT_TRACE(COMP_INIT, DBG_LOUD, ("phy_ConfigBBWithMpParaFile(): Failed%s\n", pFileName));
+	}
+#endif
+
+	return rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_ConfigBBWithMpHeaderFile
+ *
+ * Overview:	Config PHY_REG_MP array 
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 02/04/2010	chiyokolin		Modify to new files.
+ *---------------------------------------------------------------------------*/
+static int
+phy_ConfigBBWithMpHeaderFile(
+	IN	PADAPTER		Adapter,
+	IN	u1Byte 			ConfigType)
+{
+	int i;
+	u32*	Rtl8192CPHY_REGArray_Table_MP;
+	u16	PHY_REGArrayMPLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	PHY_REGArrayMPLen = PHY_REG_Array_MPLength;
+	Rtl8192CPHY_REGArray_Table_MP = Rtl819XPHY_REG_Array_MP;
+
+	if(ConfigType == BaseBand_Config_PHY_REG)
+	{
+		for(i=0;i<PHY_REGArrayMPLen;i=i+2)
+		{
+			if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfe) {
+				#ifdef CONFIG_LONG_DELAY_ISSUE
+				rtw_msleep_os(50);
+				#else
+				rtw_mdelay_os(50);
+				#endif
+			}
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfd)
+				rtw_mdelay_os(5);
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfc)
+				rtw_mdelay_os(1);
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfb) {
+				#ifdef CONFIG_LONG_DELAY_ISSUE
+				rtw_msleep_os(50);
+				#else
+				rtw_mdelay_os(50);
+				#endif
+			}
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfa)
+				rtw_mdelay_os(5);
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xf9)
+				rtw_mdelay_os(1);
+			PHY_SetBBReg(Adapter, Rtl8192CPHY_REGArray_Table_MP[i], bMaskDWord, Rtl8192CPHY_REGArray_Table_MP[i+1]);		
+
+			// Add 1us delay between BB/RF register setting.
+			rtw_mdelay_os(1);
+
+//			RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl8192CPHY_REGArray_Table_MP[%d] is %lx Rtl8192CPHY_REGArray_Table_MP[%d] is %lx \n", i, i+1, Rtl8192CPHY_REGArray_Table_MP[i], Rtl8192CPHY_REGArray_Table_MP[i+1]));
+		}
+	}
+	else
+	{
+//		RT_TRACE(COMP_SEND, DBG_LOUD, ("phy_ConfigBBWithMpHeaderFile(): ConfigType != BaseBand_Config_PHY_REG\n"));
+	}
+
+	return _SUCCESS;
+}	/* phy_ConfigBBWithMpHeaderFile */
+
+#endif	// #if (MP_DRIVER == 1)
+
+static VOID
+phy_BB8192C_Config_1T(
+	IN PADAPTER Adapter
+	)
+{
+#if 0
+	//for path - A
+	PHY_SetBBReg(Adapter, rFPGA0_TxInfo, 0x3, 0x1);
+	PHY_SetBBReg(Adapter, rFPGA1_TxInfo, 0x0303, 0x0101);
+	PHY_SetBBReg(Adapter, 0xe74, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe78, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe7c, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe80, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe88, 0x0c000000, 0x1);
+#endif
+	//for path - B
+	PHY_SetBBReg(Adapter, rFPGA0_TxInfo, 0x3, 0x2);
+	PHY_SetBBReg(Adapter, rFPGA1_TxInfo, 0x300033, 0x200022);
+
+	// 20100519 Joseph: Add for 1T2R config. Suggested by Kevin, Jenyu and Yunan.
+	PHY_SetBBReg(Adapter, rCCK0_AFESetting, bMaskByte3, 0x45);
+	PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, bMaskByte0, 0x23);
+	PHY_SetBBReg(Adapter, rOFDM0_AGCParameter1, 0x30, 0x1);	// B path first AGC
+	
+	PHY_SetBBReg(Adapter, 0xe74, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe78, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe7c, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe80, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe88, 0x0c000000, 0x2);
+
+	
+}
+
+// Joseph test: new initialize order!!
+// Test only!! This part need to be re-organized.
+// Now it is just for 8256.
+static	int
+phy_BB8190_Config_HardCode(
+	IN	PADAPTER	Adapter
+	)
+{
+	//RT_ASSERT(FALSE, ("This function is not implement yet!! \n"));
+	return _SUCCESS;
+}
+
+static	int
+phy_BB8192C_Config_ParaFile(
+	IN	PADAPTER	Adapter
+	)
+{
+	EEPROM_EFUSE_PRIV	*pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	int			rtStatus = _SUCCESS;
+
+	u8				szBBRegPgFile[] = RTL819X_PHY_REG_PG;
+	
+	u8				sz88CBBRegFile[] = RTL8188C_PHY_REG;	
+	u8				sz88CAGCTableFile[] = RTL8188C_AGC_TAB;
+
+	u8				sz92CBBRegFile[] = RTL8192C_PHY_REG;	
+	u8				sz92CAGCTableFile[] = RTL8192C_AGC_TAB;
+	
+	u8				*pszBBRegFile, *pszAGCTableFile, *pszBBRegMpFile;
+	
+	//RT_TRACE(COMP_INIT, DBG_TRACE, ("==>phy_BB8192S_Config_ParaFile\n"));
+
+	if(IS_92C_SERIAL(pHalData->VersionID)){
+		pszBBRegFile=(u8*)&sz92CBBRegFile ;
+		pszAGCTableFile =(u8*)&sz92CAGCTableFile;
+	}
+	else{
+		pszBBRegFile=(u8*)&sz88CBBRegFile ;
+		pszAGCTableFile =(u8*)&sz88CAGCTableFile;
+	}
+
+	//
+	// 1. Read PHY_REG.TXT BB INIT!!
+	// We will seperate as 88C / 92C according to chip version
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigBBWithHeaderFile(Adapter, BaseBand_Config_PHY_REG);	
+#else	
+	// No matter what kind of CHIP we always read PHY_REG.txt. We must copy different 
+	// type of parameter files to phy_reg.txt at first.	
+	rtStatus = phy_ConfigBBWithParaFile(Adapter,pszBBRegFile);
+#endif
+
+	if(rtStatus != _SUCCESS){
+		//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():Write BB Reg Fail!!"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+
+#if MP_DRIVER == 1
+	//
+	// 1.1 Read PHY_REG_MP.TXT BB INIT!!
+	// We will seperate as 88C / 92C according to chip version
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigBBWithMpHeaderFile(Adapter, BaseBand_Config_PHY_REG);	
+#else	
+	// No matter what kind of CHIP we always read PHY_REG.txt. We must copy different 
+	// type of parameter files to phy_reg.txt at first.	
+	rtStatus = phy_ConfigBBWithMpParaFile(Adapter, pszBBRegMpFile);
+#endif
+
+	if(rtStatus != _SUCCESS){
+//		RT_TRACE(COMP_INIT, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():Write BB Reg MP Fail!!"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}	
+#endif	// #if (MP_DRIVER == 1)
+
+	//
+	// 20100318 Joseph: Config 2T2R to 1T2R if necessary.
+	//
+	if(pHalData->rf_type == RF_1T2R)
+	{
+		phy_BB8192C_Config_1T(Adapter);
+		DBG_8192C("phy_BB8192C_Config_ParaFile():Config to 1T!!\n");
+	}
+
+	//
+	// 2. If EEPROM or EFUSE autoload OK, We must config by PHY_REG_PG.txt
+	//
+	if (pEEPROM->bautoload_fail_flag == _FALSE)
+	{
+		pHalData->pwrGroupCnt = 0;
+
+#ifdef CONFIG_EMBEDDED_FWIMG
+		rtStatus = phy_ConfigBBWithPgHeaderFile(Adapter, BaseBand_Config_PHY_REG);
+#else
+		rtStatus = phy_ConfigBBWithPgParaFile(Adapter, (u8*)&szBBRegPgFile);
+#endif
+	}
+	
+	if(rtStatus != _SUCCESS){
+		//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():BB_PG Reg Fail!!"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+
+	//
+	// 3. BB AGC table Initialization
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigBBWithHeaderFile(Adapter, BaseBand_Config_AGC_TAB);
+#else
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("phy_BB8192S_Config_ParaFile AGC_TAB.txt\n"));
+	rtStatus = phy_ConfigBBWithParaFile(Adapter, pszAGCTableFile);
+#endif
+
+	if(rtStatus != _SUCCESS){
+		//RT_TRACE(COMP_FPGA, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():AGC Table Fail\n"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+
+	// Check if the CCK HighPower is turned ON.
+	// This is used to calculate PWDB.
+	pHalData->bCckHighPower = (BOOLEAN)(PHY_QueryBBReg(Adapter, rFPGA0_XA_HSSIParameter2, 0x200));
+	
+phy_BB8190_Config_ParaFile_Fail:
+
+	return rtStatus;
+}
+
+
+int
+PHY_BBConfig8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	int	rtStatus = _SUCCESS;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32	RegVal;
+	u8	TmpU1B=0;
+	u8	value8;
+
+	phy_InitBBRFRegisterDefinition(Adapter);
+
+	if(IS_HARDWARE_TYPE_8723A(Adapter))
+	{
+		// Suggested by Scott. tynli_test. 2010.12.30.
+		//1. 0x28[1] = 1
+		TmpU1B = rtw_read8(Adapter, REG_AFE_PLL_CTRL);
+		rtw_udelay_os(2);
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL, (TmpU1B|BIT1));
+		rtw_udelay_os(2);
+		
+		//2. 0x29[7:0] = 0xFF
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL+1, 0xff);
+		rtw_udelay_os(2);
+		
+		//3. 0x02[1:0] = 2b'11
+		TmpU1B = rtw_read8(Adapter, REG_SYS_FUNC_EN);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN, (TmpU1B|FEN_BB_GLB_RSTn|FEN_BBRSTB));
+		
+		//undo clock gated
+		rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)&(~BIT31));
+		
+		//4. 0x25[6] = 0
+		TmpU1B = rtw_read8(Adapter, REG_AFE_XTAL_CTRL+1);
+		rtw_write8(Adapter, REG_AFE_XTAL_CTRL+1, (TmpU1B&(~BIT6)));
+		
+		//5. 0x24[20] = 0 	//Advised by SD3 Alex Wang. 2011.02.09.
+		TmpU1B = rtw_read8(Adapter, REG_AFE_XTAL_CTRL+2);
+		rtw_write8(Adapter, REG_AFE_XTAL_CTRL+2, (TmpU1B&(~BIT4)));
+		
+		//6. 0x1f[7:0] = 0x07
+		rtw_write8(Adapter, REG_RF_CTRL, 0x07);
+	}
+	else
+	{
+		// Enable BB and RF
+		RegVal = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+		rtw_write16(Adapter, REG_SYS_FUNC_EN, (u16)(RegVal|BIT13|BIT0|BIT1));
+
+		// 20090923 Joseph: Advised by Steven and Jenyu. Power sequence before init RF.
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x83);
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL+1, 0xdb);
+
+		rtw_write8(Adapter, REG_RF_CTRL, RF_EN|RF_RSTB|RF_SDMRSTB);
+
+#ifdef CONFIG_USB_HCI
+		rtw_write8(Adapter, REG_SYS_FUNC_EN, FEN_USBA | FEN_USBD | FEN_BB_GLB_RSTn | FEN_BBRSTB);
+#else
+		rtw_write8(Adapter, REG_SYS_FUNC_EN, FEN_PPLL|FEN_PCIEA|FEN_DIO_PCIE|FEN_BB_GLB_RSTn|FEN_BBRSTB);
+#endif
+		
+		//undo clock gated
+		rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)&(~BIT31));
+
+		// 2009/10/21 by SD1 Jong. Modified by tynli. Not in Documented in V8.1. 
+#ifdef CONFIG_USB_HCI
+		//To Fix MAC loopback mode fail. Suggested by SD4 Johnny. 2010.03.23.
+		rtw_write8(Adapter, REG_LDOHCI12_CTRL, 0x0f);	
+		rtw_write8(Adapter, 0x15, 0xe9);
+#endif
+
+		rtw_write8(Adapter, REG_AFE_XTAL_CTRL+1, 0x80);
+
+#ifdef CONFIG_PCI_HCI
+		// Force use left antenna by default for 88C.
+	//	if(!IS_92C_SERIAL(pHalData->VersionID) || IS_92C_1T2R(pHalData->VersionID))
+		if(Adapter->ledpriv.LedStrategy != SW_LED_MODE10)
+		{
+			RegVal = rtw_read32(Adapter, REG_LEDCFG0);
+			rtw_write32(Adapter, REG_LEDCFG0, RegVal|BIT23);
+		}
+#endif
+	}
+
+	//
+	// Config BB and AGC
+	//
+	rtStatus = phy_BB8192C_Config_ParaFile(Adapter);
+#if 0	
+	switch(Adapter->MgntInfo.bRegHwParaFile)
+	{
+		case 0:
+			phy_BB8190_Config_HardCode(Adapter);
+			break;
+
+		case 1:
+			rtStatus = phy_BB8192C_Config_ParaFile(Adapter);
+			break;
+
+		case 2:
+			// Partial Modify. 
+			phy_BB8190_Config_HardCode(Adapter);
+			phy_BB8192C_Config_ParaFile(Adapter);
+			break;
+
+		default:
+			phy_BB8190_Config_HardCode(Adapter);
+			break;
+	}
+#endif	
+#ifdef CONFIG_USB_HCI
+	if(IS_HARDWARE_TYPE_8192CU(Adapter)&&IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID)
+		&&(pHalData->BoardType == BOARD_USB_High_PA))
+			rtw_write8(Adapter, 0xc72, 0x50);		
+#endif
+
+	return rtStatus;
+}
+
+
+int
+PHY_RFConfig8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	int		rtStatus = _SUCCESS;
+
+	//
+	// RF config
+	//
+	rtStatus = PHY_RF6052_Config8192C(Adapter);
+#if 0	
+	switch(pHalData->rf_chip)
+	{
+		case RF_6052:
+			rtStatus = PHY_RF6052_Config(Adapter);
+			break;
+		case RF_8225:
+			rtStatus = PHY_RF8225_Config(Adapter);
+			break;
+		case RF_8256:			
+			rtStatus = PHY_RF8256_Config(Adapter);
+			break;
+		case RF_8258:
+			break;
+		case RF_PSEUDO_11N:
+			rtStatus = PHY_RF8225_Config(Adapter);
+			break;
+		default: //for MacOs Warning: "RF_TYPE_MIN" not handled in switch
+			break;
+	}
+#endif
+	return rtStatus;
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_ConfigRFWithParaFile()
+ *
+ * Overview:    This function read RF parameters from general file format, and do RF 3-wire
+ *
+ * Input:      	PADAPTER			Adapter
+ *			ps1Byte 				pFileName			
+ *			RF_RADIO_PATH_E	eRFPath
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *			
+ * Note:		Delay may be required for RF configuration
+ *---------------------------------------------------------------------------*/
+int
+rtl8192c_PHY_ConfigRFWithParaFile(
+	IN	PADAPTER			Adapter,
+	IN	u8* 				pFileName,
+	RF_RADIO_PATH_E		eRFPath
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	int	rtStatus = _SUCCESS;
+
+
+	return rtStatus;
+	
+}
+
+//****************************************
+// The following is for High Power PA
+//****************************************
+#define HighPowerRadioAArrayLen 22
+//This is for High power PA
+u32 Rtl8192S_HighPower_RadioA_Array[HighPowerRadioAArrayLen] = {
+0x013,0x00029ea4,
+0x013,0x00025e74,
+0x013,0x00020ea4,
+0x013,0x0001ced0,
+0x013,0x00019f40,
+0x013,0x00014e70,
+0x013,0x000106a0,
+0x013,0x0000c670,
+0x013,0x000082a0,
+0x013,0x00004270,
+0x013,0x00000240,
+};
+
+int
+PHY_ConfigRFExternalPA(
+	IN	PADAPTER			Adapter,
+	RF_RADIO_PATH_E		eRFPath
+)
+{
+	int	rtStatus = _SUCCESS;
+#ifdef CONFIG_USB_HCI
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u16 i=0;
+
+	if(!pHalData->ExternalPA)
+	{
+		return rtStatus;
+	}
+	
+	// 2010/10/19 MH According to Jenyu/EEChou 's opinion, we need not to execute the 
+	// same code as SU. It is already updated in radio_a_1T_HP.txt.
+#if 0	
+	//add for SU High Power PA
+	for(i = 0;i<HighPowerRadioAArrayLen; i=i+2)
+	{
+		RT_TRACE(COMP_INIT, DBG_LOUD, ("External PA, write RF 0x%lx=0x%lx\n", Rtl8192S_HighPower_RadioA_Array[i], Rtl8192S_HighPower_RadioA_Array[i+1]));
+		PHY_SetRFReg(Adapter, eRFPath, Rtl8192S_HighPower_RadioA_Array[i], bRFRegOffsetMask, Rtl8192S_HighPower_RadioA_Array[i+1]);
+	}
+#endif
+
+#endif
+	return rtStatus;
+}
+//****************************************
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_ConfigRFWithHeaderFile()
+ *
+ * Overview:    This function read RF parameters from general file format, and do RF 3-wire
+ *
+ * Input:      	PADAPTER			Adapter
+ *			ps1Byte 				pFileName			
+ *			RF_RADIO_PATH_E	eRFPath
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *			
+ * Note:		Delay may be required for RF configuration
+ *---------------------------------------------------------------------------*/
+int
+rtl8192c_PHY_ConfigRFWithHeaderFile(
+	IN	PADAPTER			Adapter,
+	RF_RADIO_PATH_E		eRFPath
+)
+{
+
+	int			i;
+	int			rtStatus = _SUCCESS;
+	u32*		Rtl819XRadioA_Array_Table;
+	u32*		Rtl819XRadioB_Array_Table;
+	u16		RadioA_ArrayLen,RadioB_ArrayLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	//
+	// 2009.11.24. Modified by tynli.
+	//
+	if(IS_92C_SERIAL(pHalData->VersionID))
+	{
+		RadioA_ArrayLen = RadioA_2TArrayLength;
+		Rtl819XRadioA_Array_Table = Rtl819XRadioA_2TArray;
+		RadioB_ArrayLen = RadioB_2TArrayLength;
+		Rtl819XRadioB_Array_Table = Rtl819XRadioB_2TArray;
+	}
+	else
+	{
+		RadioA_ArrayLen = RadioA_1TArrayLength;
+		Rtl819XRadioA_Array_Table = Rtl819XRadioA_1TArray;
+		RadioB_ArrayLen = RadioB_1TArrayLength;	
+		Rtl819XRadioB_Array_Table = Rtl819XRadioB_1TArray;
+#ifdef CONFIG_USB_HCI
+		if( BOARD_MINICARD == pHalData->BoardType )
+		{
+			RadioA_ArrayLen = RadioA_1T_mCardArrayLength;
+			Rtl819XRadioA_Array_Table = Rtl819XRadioA_1T_mCardArray;
+			RadioB_ArrayLen = RadioB_1T_mCardArrayLength;	
+			Rtl819XRadioB_Array_Table = Rtl819XRadioB_1T_mCardArray;			
+		}
+		else if( BOARD_USB_High_PA == pHalData->BoardType )
+		{
+			RadioA_ArrayLen = RadioA_1T_HPArrayLength;
+			Rtl819XRadioA_Array_Table = Rtl819XRadioA_1T_HPArray;
+		}
+#endif
+	}
+
+	switch(eRFPath){
+		case RF_PATH_A:
+			#ifdef CONFIG_IOL_RF_RF90_PATH_A
+			if(rtw_IOL_applied(Adapter))
+			{
+				struct xmit_frame	*xmit_frame;
+				if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+					rtStatus = _FAIL;
+					goto exit;
+				}
+				
+				for(i = 0;i<RadioA_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioA_Array_Table[i] == 0xfe)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfd)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfc)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 1);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfb)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfa)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xf9)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 1);
+					else
+					{
+						BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+						u32	NewOffset = 0;
+						u32	DataAndAddr = 0;
+						
+						NewOffset = Rtl819XRadioA_Array_Table[i] & 0x3f;
+						DataAndAddr = ((NewOffset<<20) | (Rtl819XRadioA_Array_Table[i+1]&0x000fffff)) & 0x0fffffff;	// T65 RF
+						rtw_IOL_append_WD_cmd(xmit_frame, pPhyReg->rf3wireOffset, DataAndAddr);
+					}
+				}	
+				rtStatus = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+			}
+			else
+			#endif
+			{
+				for(i = 0;i<RadioA_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioA_Array_Table[i] == 0xfe) {
+						#ifdef CONFIG_LONG_DELAY_ISSUE
+						rtw_msleep_os(50);
+						#else
+						rtw_mdelay_os(50);
+						#endif
+					}
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfd)
+						rtw_mdelay_os(5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfc)
+						rtw_mdelay_os(1);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfb)
+						rtw_udelay_os(50);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfa)
+						rtw_udelay_os(5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xf9)
+						rtw_udelay_os(1);
+					else
+					{
+						PHY_SetRFReg(Adapter, eRFPath, Rtl819XRadioA_Array_Table[i], bRFRegOffsetMask, Rtl819XRadioA_Array_Table[i+1]);
+						// Add 1us delay between BB/RF register setting.
+						rtw_udelay_os(1);
+					}
+				}
+			}
+
+			//Add for High Power PA
+			PHY_ConfigRFExternalPA(Adapter, eRFPath);
+			break;
+		case RF_PATH_B:
+			#ifdef CONFIG_IOL_RF_RF90_PATH_B
+			if(rtw_IOL_applied(Adapter))
+			{
+				struct xmit_frame	*xmit_frame;
+				if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+					rtStatus = _FAIL;
+					goto exit;
+				}
+			
+				for(i = 0;i<RadioB_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioB_Array_Table[i] == 0xfe)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfd)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfc)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 1);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfb)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfa)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xf9)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 1);
+					else
+					{
+						BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+						u32	NewOffset = 0;
+						u32	DataAndAddr = 0;
+						
+						NewOffset = Rtl819XRadioB_Array_Table[i] & 0x3f;
+						DataAndAddr = ((NewOffset<<20) | (Rtl819XRadioB_Array_Table[i+1]&0x000fffff)) & 0x0fffffff;	// T65 RF
+						rtw_IOL_append_WD_cmd(xmit_frame, pPhyReg->rf3wireOffset, DataAndAddr);
+					}
+				}	
+				rtStatus = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+			}
+			else
+			#endif
+			{
+				for(i = 0;i<RadioB_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioB_Array_Table[i] == 0xfe)
+					{ // Deay specific ms. Only RF configuration require delay.												
+#if 0//#ifdef CONFIG_USB_HCI
+						#ifdef CONFIG_LONG_DELAY_ISSUE
+						rtw_msleep_os(1000);
+						#else
+						rtw_mdelay_os(1000);
+						#endif
+#else
+						#ifdef CONFIG_LONG_DELAY_ISSUE
+						rtw_msleep_os(50);
+						#else
+						rtw_mdelay_os(50);
+						#endif
+#endif
+					}
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfd)
+						rtw_mdelay_os(5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfc)
+						rtw_mdelay_os(1);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfb)
+						rtw_udelay_os(50);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfa)
+						rtw_udelay_os(5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xf9)
+						rtw_udelay_os(1);
+					else
+					{
+						PHY_SetRFReg(Adapter, eRFPath, Rtl819XRadioB_Array_Table[i], bRFRegOffsetMask, Rtl819XRadioB_Array_Table[i+1]);
+						// Add 1us delay between BB/RF register setting.
+						rtw_udelay_os(1);
+					}	
+				}
+			}
+
+			break;
+		case RF_PATH_C:
+			break;
+		case RF_PATH_D:
+			break;
+	}
+
+exit:	
+	return rtStatus;
+
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_CheckBBAndRFOK()
+ *
+ * Overview:    This function is write register and then readback to make sure whether
+ *			  BB[PHY0, PHY1], RF[Patha, path b, path c, path d] is Ok
+ *
+ * Input:      	PADAPTER			Adapter
+ *			HW90_BLOCK_E		CheckBlock
+ *			RF_RADIO_PATH_E	eRFPath		// it is used only when CheckBlock is HW90_BLOCK_RF
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: PHY is OK
+ *			
+ * Note:		This function may be removed in the ASIC
+ *---------------------------------------------------------------------------*/
+int
+PHY_CheckBBAndRFOK(
+	IN	PADAPTER			Adapter,
+	IN	HW90_BLOCK_E		CheckBlock,
+	IN	RF_RADIO_PATH_E	eRFPath
+	)
+{
+	int			rtStatus = _SUCCESS;
+
+	u32				i, CheckTimes = 4,ulRegRead = 0;
+
+	u32				WriteAddr[4];
+	u32				WriteData[] = {0xfffff027, 0xaa55a02f, 0x00000027, 0x55aa502f};
+
+	// Initialize register address offset to be checked
+	WriteAddr[HW90_BLOCK_MAC] = 0x100;
+	WriteAddr[HW90_BLOCK_PHY0] = 0x900;
+	WriteAddr[HW90_BLOCK_PHY1] = 0x800;
+	WriteAddr[HW90_BLOCK_RF] = 0x3;
+	
+	for(i=0 ; i < CheckTimes ; i++)
+	{
+
+		//
+		// Write Data to register and readback
+		//
+		switch(CheckBlock)
+		{
+		case HW90_BLOCK_MAC:
+			//RT_ASSERT(FALSE, ("PHY_CheckBBRFOK(): Never Write 0x100 here!"));
+			//RT_TRACE(COMP_INIT, DBG_LOUD, ("PHY_CheckBBRFOK(): Never Write 0x100 here!\n"));
+			break;
+			
+		case HW90_BLOCK_PHY0:
+		case HW90_BLOCK_PHY1:
+			rtw_write32(Adapter, WriteAddr[CheckBlock], WriteData[i]);
+			ulRegRead = rtw_read32(Adapter, WriteAddr[CheckBlock]);
+			break;
+
+		case HW90_BLOCK_RF:
+			// When initialization, we want the delay function(delay_ms(), delay_us() 
+			// ==> actually we call PlatformStallExecution()) to do NdisStallExecution()
+			// [busy wait] instead of NdisMSleep(). So we acquire RT_INITIAL_SPINLOCK 
+			// to run at Dispatch level to achive it.	
+			//cosa PlatformAcquireSpinLock(Adapter, RT_INITIAL_SPINLOCK);
+			WriteData[i] &= 0xfff;
+			PHY_SetRFReg(Adapter, eRFPath, WriteAddr[HW90_BLOCK_RF], bRFRegOffsetMask, WriteData[i]);
+			// TODO: we should not delay for such a long time. Ask SD3
+			rtw_mdelay_os(10);
+			ulRegRead = PHY_QueryRFReg(Adapter, eRFPath, WriteAddr[HW90_BLOCK_RF], bMaskDWord);				
+			rtw_mdelay_os(10);
+			//cosa PlatformReleaseSpinLock(Adapter, RT_INITIAL_SPINLOCK);
+			break;
+			
+		default:
+			rtStatus = _FAIL;
+			break;
+		}
+
+
+		//
+		// Check whether readback data is correct
+		//
+		if(ulRegRead != WriteData[i])
+		{
+			//RT_TRACE(COMP_FPGA, DBG_LOUD, ("ulRegRead: %lx, WriteData: %lx \n", ulRegRead, WriteData[i]));
+			rtStatus = _FAIL;			
+			break;
+		}
+	}
+
+	return rtStatus;
+}
+
+
+VOID
+rtl8192c_PHY_GetHWRegOriginalValue(
+	IN	PADAPTER		Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	// read rx initial gain
+	pHalData->DefaultInitialGain[0] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XAAGCCore1, bMaskByte0);
+	pHalData->DefaultInitialGain[1] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XBAGCCore1, bMaskByte0);
+	pHalData->DefaultInitialGain[2] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XCAGCCore1, bMaskByte0);
+	pHalData->DefaultInitialGain[3] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XDAGCCore1, bMaskByte0);
+	//RT_TRACE(COMP_INIT, DBG_LOUD,
+	//("Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x) \n", 
+	//pHalData->DefaultInitialGain[0], pHalData->DefaultInitialGain[1], 
+	//pHalData->DefaultInitialGain[2], pHalData->DefaultInitialGain[3]));
+
+	// read framesync
+	pHalData->framesync = (u8)PHY_QueryBBReg(Adapter, rOFDM0_RxDetector3, bMaskByte0);	 
+	pHalData->framesyncC34 = PHY_QueryBBReg(Adapter, rOFDM0_RxDetector2, bMaskDWord);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Default framesync (0x%x) = 0x%x \n", 
+	//	rOFDM0_RxDetector3, pHalData->framesync));
+}
+
+
+//
+//	Description:
+//		Map dBm into Tx power index according to 
+//		current HW model, for example, RF and PA, and
+//		current wireless mode.
+//	By Bruce, 2008-01-29.
+//
+static	u8
+phy_DbmToTxPwrIdx(
+	IN	PADAPTER		Adapter,
+	IN	WIRELESS_MODE	WirelessMode,
+	IN	int			PowerInDbm
+	)
+{
+	u8				TxPwrIdx = 0;
+	int				Offset = 0;
+	
+
+	//
+	// Tested by MP, we found that CCK Index 0 equals to 8dbm, OFDM legacy equals to 
+	// 3dbm, and OFDM HT equals to 0dbm repectively.
+	// Note:
+	//	The mapping may be different by different NICs. Do not use this formula for what needs accurate result.  
+	// By Bruce, 2008-01-29.
+	// 
+	switch(WirelessMode)
+	{
+	case WIRELESS_MODE_B:
+		Offset = -7;
+		break;
+
+	case WIRELESS_MODE_G:
+	case WIRELESS_MODE_N_24G:
+		Offset = -8;
+		break;
+	default:
+		Offset = -8;
+		break;
+	}
+
+	if((PowerInDbm - Offset) > 0)
+	{
+		TxPwrIdx = (u8)((PowerInDbm - Offset) * 2);
+	}
+	else
+	{
+		TxPwrIdx = 0;
+	}
+
+	// Tx Power Index is too large.
+	if(TxPwrIdx > MAX_TXPWR_IDX_NMODE_92S)
+		TxPwrIdx = MAX_TXPWR_IDX_NMODE_92S;
+
+	return TxPwrIdx;
+}
+
+//
+//	Description:
+//		Map Tx power index into dBm according to 
+//		current HW model, for example, RF and PA, and
+//		current wireless mode.
+//	By Bruce, 2008-01-29.
+//
+int
+phy_TxPwrIdxToDbm(
+	IN	PADAPTER		Adapter,
+	IN	WIRELESS_MODE	WirelessMode,
+	IN	u8			TxPwrIdx
+	)
+{
+	int				Offset = 0;
+	int				PwrOutDbm = 0;
+	
+	//
+	// Tested by MP, we found that CCK Index 0 equals to -7dbm, OFDM legacy equals to -8dbm.
+	// Note:
+	//	The mapping may be different by different NICs. Do not use this formula for what needs accurate result.  
+	// By Bruce, 2008-01-29.
+	// 
+	switch(WirelessMode)
+	{
+	case WIRELESS_MODE_B:
+		Offset = -7;
+		break;
+
+	case WIRELESS_MODE_G:
+	case WIRELESS_MODE_N_24G:
+		Offset = -8;
+	default:
+		Offset = -8;	
+		break;
+	}
+
+	PwrOutDbm = TxPwrIdx / 2 + Offset; // Discard the decimal part.
+
+	return PwrOutDbm;
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    GetTxPowerLevel8190()
+ *
+ * Overview:    This function is export to "common" moudule
+ *
+ * Input:       PADAPTER		Adapter
+ *			psByte			Power Level
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+PHY_GetTxPowerLevel8192C(
+	IN	PADAPTER		Adapter,
+	OUT u32*    		powerlevel
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			TxPwrLevel = 0;
+	int			TxPwrDbm;
+	
+	//
+	// Because the Tx power indexes are different, we report the maximum of them to 
+	// meet the CCX TPC request. By Bruce, 2008-01-31.
+	//
+
+	// CCK
+	TxPwrLevel = pHalData->CurrentCckTxPwrIdx;
+	TxPwrDbm = phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_B, TxPwrLevel);
+
+	// Legacy OFDM
+	TxPwrLevel = pHalData->CurrentOfdm24GTxPwrIdx + pHalData->LegacyHTTxPowerDiff;
+
+	// Compare with Legacy OFDM Tx power.
+	if(phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_G, TxPwrLevel) > TxPwrDbm)
+		TxPwrDbm = phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_G, TxPwrLevel);
+
+	// HT OFDM
+	TxPwrLevel = pHalData->CurrentOfdm24GTxPwrIdx;
+	
+	// Compare with HT OFDM Tx power.
+	if(phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_N_24G, TxPwrLevel) > TxPwrDbm)
+		TxPwrDbm = phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_N_24G, TxPwrLevel);
+
+	*powerlevel = TxPwrDbm;
+}
+
+
+static void getTxPowerIndex(
+	IN	PADAPTER		Adapter,
+	IN	u8			channel,
+	IN OUT u8*		cckPowerLevel,
+	IN OUT u8*		ofdmPowerLevel
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8				index = (channel -1);
+	// 1. CCK
+	cckPowerLevel[RF_PATH_A] = pHalData->TxPwrLevelCck[RF_PATH_A][index];	//RF-A
+	cckPowerLevel[RF_PATH_B] = pHalData->TxPwrLevelCck[RF_PATH_B][index];	//RF-B
+
+	// 2. OFDM for 1S or 2S
+	if (GET_RF_TYPE(Adapter) == RF_1T2R || GET_RF_TYPE(Adapter) == RF_1T1R)
+	{
+		// Read HT 40 OFDM TX power
+		ofdmPowerLevel[RF_PATH_A] = pHalData->TxPwrLevelHT40_1S[RF_PATH_A][index];
+		ofdmPowerLevel[RF_PATH_B] = pHalData->TxPwrLevelHT40_1S[RF_PATH_B][index];
+	}
+	else if (GET_RF_TYPE(Adapter) == RF_2T2R)
+	{
+		// Read HT 40 OFDM TX power
+		ofdmPowerLevel[RF_PATH_A] = pHalData->TxPwrLevelHT40_2S[RF_PATH_A][index];
+		ofdmPowerLevel[RF_PATH_B] = pHalData->TxPwrLevelHT40_2S[RF_PATH_B][index];
+	}
+	//RTPRINT(FPHY, PHY_TXPWR, ("Channel-%d, set tx power index !!\n", channel));
+}
+
+static void ccxPowerIndexCheck(
+	IN	PADAPTER		Adapter,
+	IN	u8			channel,
+	IN OUT u8*		cckPowerLevel,
+	IN OUT u8*		ofdmPowerLevel
+	)
+{
+#if 0
+	PMGNT_INFO			pMgntInfo = &(Adapter->MgntInfo);
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	PRT_CCX_INFO		pCcxInfo = GET_CCX_INFO(pMgntInfo);
+
+	//
+	// CCX 2 S31, AP control of client transmit power:
+	// 1. We shall not exceed Cell Power Limit as possible as we can.
+	// 2. Tolerance is +/- 5dB.
+	// 3. 802.11h Power Contraint takes higher precedence over CCX Cell Power Limit.
+	// 
+	// TODO: 
+	// 1. 802.11h power contraint 
+	//
+	// 071011, by rcnjko.
+	//
+	if(	pMgntInfo->OpMode == RT_OP_MODE_INFRASTRUCTURE && 
+		pMgntInfo->mAssoc &&
+		pCcxInfo->bUpdateCcxPwr &&
+		pCcxInfo->bWithCcxCellPwr &&
+		channel == pMgntInfo->dot11CurrentChannelNumber)
+	{
+		u1Byte	CckCellPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_B, pCcxInfo->CcxCellPwr);
+		u1Byte	LegacyOfdmCellPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_G, pCcxInfo->CcxCellPwr);
+		u1Byte	OfdmCellPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_N_24G, pCcxInfo->CcxCellPwr);
+
+		RT_TRACE(COMP_TXAGC, DBG_LOUD, 
+		("CCX Cell Limit: %d dbm => CCK Tx power index : %d, Legacy OFDM Tx power index : %d, OFDM Tx power index: %d\n", 
+		pCcxInfo->CcxCellPwr, CckCellPwrIdx, LegacyOfdmCellPwrIdx, OfdmCellPwrIdx));
+		RT_TRACE(COMP_TXAGC, DBG_LOUD, 
+		("EEPROM channel(%d) => CCK Tx power index: %d, Legacy OFDM Tx power index : %d, OFDM Tx power index: %d\n",
+		channel, cckPowerLevel[0], ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff, ofdmPowerLevel[0])); 
+
+		// CCK
+		if(cckPowerLevel[0] > CckCellPwrIdx)
+			cckPowerLevel[0] = CckCellPwrIdx;
+		// Legacy OFDM, HT OFDM
+		if(ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff > LegacyOfdmCellPwrIdx)
+		{
+			if((OfdmCellPwrIdx - pHalData->LegacyHTTxPowerDiff) > 0)
+			{
+				ofdmPowerLevel[0] = OfdmCellPwrIdx - pHalData->LegacyHTTxPowerDiff;
+			}
+			else
+			{
+				ofdmPowerLevel[0] = 0;
+			}
+		}
+
+		RT_TRACE(COMP_TXAGC, DBG_LOUD, 
+		("Altered CCK Tx power index : %d, Legacy OFDM Tx power index: %d, OFDM Tx power index: %d\n", 
+		cckPowerLevel[0], ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff, ofdmPowerLevel[0]));
+	}
+
+	pHalData->CurrentCckTxPwrIdx = cckPowerLevel[0];
+	pHalData->CurrentOfdm24GTxPwrIdx = ofdmPowerLevel[0];
+
+	RT_TRACE(COMP_TXAGC, DBG_LOUD, 
+		("PHY_SetTxPowerLevel8192S(): CCK Tx power index : %d, Legacy OFDM Tx power index: %d, OFDM Tx power index: %d\n", 
+		cckPowerLevel[0], ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff, ofdmPowerLevel[0]));
+#endif	
+}
+/*-----------------------------------------------------------------------------
+ * Function:    SetTxPowerLevel8190()
+ *
+ * Overview:    This function is export to "HalCommon" moudule
+ *			We must consider RF path later!!!!!!!
+ *
+ * Input:       PADAPTER		Adapter
+ *			u1Byte		channel
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *	2008/11/04	MHC		We remove EEPROM_93C56.
+ *						We need to move CCX relative code to independet file.
+ *	2009/01/21	MHC		Support new EEPROM format from SD3 requirement.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+PHY_SetTxPowerLevel8192C(
+	IN	PADAPTER		Adapter,
+	IN	u8			channel
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8	cckPowerLevel[2], ofdmPowerLevel[2];	// [0]:RF-A, [1]:RF-B
+
+#if(MP_DRIVER == 1)
+	return;
+#endif
+
+	if(pHalData->bTXPowerDataReadFromEEPORM == _FALSE)
+		return;
+
+	getTxPowerIndex(Adapter, channel, &cckPowerLevel[0], &ofdmPowerLevel[0]);
+	//RTPRINT(FPHY, PHY_TXPWR, ("Channel-%d, cckPowerLevel (A / B) = 0x%x / 0x%x,   ofdmPowerLevel (A / B) = 0x%x / 0x%x\n", 
+	//	channel, cckPowerLevel[0], cckPowerLevel[1], ofdmPowerLevel[0], ofdmPowerLevel[1]));
+
+	ccxPowerIndexCheck(Adapter, channel, &cckPowerLevel[0], &ofdmPowerLevel[0]);
+
+	rtl8192c_PHY_RF6052SetCckTxPower(Adapter, &cckPowerLevel[0]);
+	rtl8192c_PHY_RF6052SetOFDMTxPower(Adapter, &ofdmPowerLevel[0], channel);
+
+#if 0
+	switch(pHalData->rf_chip)
+	{
+		case RF_8225:
+			PHY_SetRF8225CckTxPower(Adapter, cckPowerLevel[0]);
+			PHY_SetRF8225OfdmTxPower(Adapter, ofdmPowerLevel[0]);
+		break;
+
+		case RF_8256:
+			PHY_SetRF8256CCKTxPower(Adapter, cckPowerLevel[0]);
+			PHY_SetRF8256OFDMTxPower(Adapter, ofdmPowerLevel[0]);
+			break;
+
+		case RF_6052:
+			PHY_RF6052SetCckTxPower(Adapter, &cckPowerLevel[0]);
+			PHY_RF6052SetOFDMTxPower(Adapter, &ofdmPowerLevel[0], channel);
+			break;
+
+		case RF_8258:
+			break;
+	}
+#endif
+
+}
+
+
+//
+//	Description:
+//		Update transmit power level of all channel supported.
+//
+//	TODO: 
+//		A mode.
+//	By Bruce, 2008-02-04.
+//
+BOOLEAN
+PHY_UpdateTxPowerDbm8192C(
+	IN	PADAPTER	Adapter,
+	IN	int		powerInDbm
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8				idx;
+	u8			rf_path;
+
+	// TODO: A mode Tx power.
+	u8	CckTxPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_B, powerInDbm);
+	u8	OfdmTxPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_N_24G, powerInDbm);
+
+	if(OfdmTxPwrIdx - pHalData->LegacyHTTxPowerDiff > 0)
+		OfdmTxPwrIdx -= pHalData->LegacyHTTxPowerDiff;
+	else
+		OfdmTxPwrIdx = 0;
+
+	//RT_TRACE(COMP_TXAGC, DBG_LOUD, ("PHY_UpdateTxPowerDbm8192S(): %ld dBm , CckTxPwrIdx = %d, OfdmTxPwrIdx = %d\n", powerInDbm, CckTxPwrIdx, OfdmTxPwrIdx));
+
+	for(idx = 0; idx < 14; idx++)
+	{
+		for (rf_path = 0; rf_path < 2; rf_path++)
+		{
+			pHalData->TxPwrLevelCck[rf_path][idx] = CckTxPwrIdx;
+			pHalData->TxPwrLevelHT40_1S[rf_path][idx] = 
+			pHalData->TxPwrLevelHT40_2S[rf_path][idx] = OfdmTxPwrIdx;
+		}
+	}
+
+	//Adapter->HalFunc.SetTxPowerLevelHandler(Adapter, pHalData->CurrentChannel);//gtest:todo
+
+	return _TRUE;	
+}
+
+
+/*
+	Description:
+		When beacon interval is changed, the values of the 
+		hw registers should be modified.
+	By tynli, 2008.10.24.
+
+*/
+
+
+void	
+rtl8192c_PHY_SetBeaconHwReg(	
+	IN	PADAPTER		Adapter,
+	IN	u16			BeaconInterval	
+	)
+{
+
+}
+
+
+VOID 
+PHY_ScanOperationBackup8192C(
+	IN	PADAPTER	Adapter,
+	IN	u8		Operation
+	)
+{
+#if 0
+	IO_TYPE	IoType;
+	
+	if(!Adapter->bDriverStopped)
+	{
+		switch(Operation)
+		{
+			case SCAN_OPT_BACKUP:
+				IoType = IO_CMD_PAUSE_DM_BY_SCAN;
+				rtw_hal_set_hwreg(Adapter,HW_VAR_IO_CMD,  (pu1Byte)&IoType);
+
+				break;
+
+			case SCAN_OPT_RESTORE:
+				IoType = IO_CMD_RESUME_DM_BY_SCAN;
+				rtw_hal_set_hwreg(Adapter,HW_VAR_IO_CMD,  (pu1Byte)&IoType);
+				break;
+
+			default:
+				RT_TRACE(COMP_SCAN, DBG_LOUD, ("Unknown Scan Backup Operation. \n"));
+				break;
+		}
+	}
+#endif	
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_SetBWModeCallback8192C()
+ *
+ * Overview:    Timer callback function for SetSetBWMode
+ *
+ * Input:       	PRT_TIMER		pTimer
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Note:		(1) We do not take j mode into consideration now
+ *			(2) Will two workitem of "switch channel" and "switch channel bandwidth" run
+ *			     concurrently?
+ *---------------------------------------------------------------------------*/
+static VOID
+_PHY_SetBWMode92C(
+	IN	PADAPTER	Adapter
+)
+{
+//	PADAPTER			Adapter = (PADAPTER)pTimer->Adapter;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8				regBwOpMode;
+	u8				regRRSR_RSC;
+
+	//return;
+
+	// Added it for 20/40 mhz switch time evaluation by guangan 070531
+	//u4Byte				NowL, NowH;
+	//u8Byte				BeginTime, EndTime; 
+
+	/*RT_TRACE(COMP_SCAN, DBG_LOUD, ("==>PHY_SetBWModeCallback8192C()  Switch to %s bandwidth\n", \
+					pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz"))*/
+
+	if(pHalData->rf_chip == RF_PSEUDO_11N)
+	{
+		//pHalData->SetBWModeInProgress= _FALSE;
+		return;
+	}
+
+	// There is no 40MHz mode in RF_8225.
+	if(pHalData->rf_chip==RF_8225)
+		return;
+
+	if(Adapter->bDriverStopped)
+		return;
+
+	// Added it for 20/40 mhz switch time evaluation by guangan 070531
+	//NowL = PlatformEFIORead4Byte(Adapter, TSFR);
+	//NowH = PlatformEFIORead4Byte(Adapter, TSFR+4);
+	//BeginTime = ((u8Byte)NowH << 32) + NowL;
+		
+	//3//
+	//3//<1>Set MAC register
+	//3//
+	//Adapter->HalFunc.SetBWModeHandler();
+	
+	regBwOpMode = rtw_read8(Adapter, REG_BWOPMODE);
+	regRRSR_RSC = rtw_read8(Adapter, REG_RRSR+2);
+	//regBwOpMode = rtw_hal_get_hwreg(Adapter,HW_VAR_BWMODE,(pu1Byte)&regBwOpMode);
+	
+	switch(pHalData->CurrentChannelBW)
+	{
+		case HT_CHANNEL_WIDTH_20:
+			regBwOpMode |= BW_OPMODE_20MHZ;
+			   // 2007/02/07 Mark by Emily becasue we have not verify whether this register works
+			rtw_write8(Adapter, REG_BWOPMODE, regBwOpMode);
+			break;
+			   
+		case HT_CHANNEL_WIDTH_40:
+			regBwOpMode &= ~BW_OPMODE_20MHZ;
+				// 2007/02/07 Mark by Emily becasue we have not verify whether this register works
+			rtw_write8(Adapter, REG_BWOPMODE, regBwOpMode);
+
+			regRRSR_RSC = (regRRSR_RSC&0x90) |(pHalData->nCur40MhzPrimeSC<<5);
+			rtw_write8(Adapter, REG_RRSR+2, regRRSR_RSC);
+			break;
+
+		default:
+			/*RT_TRACE(COMP_DBG, DBG_LOUD, ("PHY_SetBWModeCallback8192C():
+						unknown Bandwidth: %#X\n",pHalData->CurrentChannelBW));*/
+			break;
+	}
+	
+	//3//
+	//3//<2>Set PHY related register
+	//3//
+	switch(pHalData->CurrentChannelBW)
+	{
+		/* 20 MHz channel*/
+		case HT_CHANNEL_WIDTH_20:
+			PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bRFMOD, 0x0);
+			PHY_SetBBReg(Adapter, rFPGA1_RFMOD, bRFMOD, 0x0);
+			PHY_SetBBReg(Adapter, rFPGA0_AnalogParameter2, BIT10, 1);
+			
+			break;
+
+
+		/* 40 MHz channel*/
+		case HT_CHANNEL_WIDTH_40:
+			PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bRFMOD, 0x1);
+			PHY_SetBBReg(Adapter, rFPGA1_RFMOD, bRFMOD, 0x1);
+			
+			// Set Control channel to upper or lower. These settings are required only for 40MHz
+			PHY_SetBBReg(Adapter, rCCK0_System, bCCKSideBand, (pHalData->nCur40MhzPrimeSC>>1));
+			PHY_SetBBReg(Adapter, rOFDM1_LSTF, 0xC00, pHalData->nCur40MhzPrimeSC);
+			PHY_SetBBReg(Adapter, rFPGA0_AnalogParameter2, BIT10, 0);
+
+			PHY_SetBBReg(Adapter, 0x818, (BIT26|BIT27), (pHalData->nCur40MhzPrimeSC==HAL_PRIME_CHNL_OFFSET_LOWER)?2:1);
+			
+			break;
+
+
+			
+		default:
+			/*RT_TRACE(COMP_DBG, DBG_LOUD, ("PHY_SetBWModeCallback8192C(): unknown Bandwidth: %#X\n"\
+						,pHalData->CurrentChannelBW));*/
+			break;
+			
+	}
+	//Skip over setting of J-mode in BB register here. Default value is "None J mode". Emily 20070315
+
+	// Added it for 20/40 mhz switch time evaluation by guangan 070531
+	//NowL = PlatformEFIORead4Byte(Adapter, TSFR);
+	//NowH = PlatformEFIORead4Byte(Adapter, TSFR+4);
+	//EndTime = ((u8Byte)NowH << 32) + NowL;
+	//RT_TRACE(COMP_SCAN, DBG_LOUD, ("SetBWModeCallback8190Pci: time of SetBWMode = %I64d us!\n", (EndTime - BeginTime)));
+
+	//3<3>Set RF related register
+	switch(pHalData->rf_chip)
+	{
+		case RF_8225:		
+			//PHY_SetRF8225Bandwidth(Adapter, pHalData->CurrentChannelBW);
+			break;	
+			
+		case RF_8256:
+			// Please implement this function in Hal8190PciPhy8256.c
+			//PHY_SetRF8256Bandwidth(Adapter, pHalData->CurrentChannelBW);
+			break;
+			
+		case RF_8258:
+			// Please implement this function in Hal8190PciPhy8258.c
+			// PHY_SetRF8258Bandwidth();
+			break;
+
+		case RF_PSEUDO_11N:
+			// Do Nothing
+			break;
+			
+		case RF_6052:
+			rtl8192c_PHY_RF6052SetBandwidth(Adapter, pHalData->CurrentChannelBW);
+			break;	
+			
+		default:
+			//RT_ASSERT(FALSE, ("Unknown RFChipID: %d\n", pHalData->RFChipID));
+			break;
+	}
+
+	//pHalData->SetBWModeInProgress= FALSE;
+
+	//RT_TRACE(COMP_SCAN, DBG_LOUD, ("<==PHY_SetBWModeCallback8192C() \n" ));
+}
+
+
+ /*-----------------------------------------------------------------------------
+ * Function:   SetBWMode8190Pci()
+ *
+ * Overview:  This function is export to "HalCommon" moudule
+ *
+ * Input:       	PADAPTER			Adapter
+ *			HT_CHANNEL_WIDTH	Bandwidth	//20M or 40M
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Note:		We do not take j mode into consideration now
+ *---------------------------------------------------------------------------*/
+VOID
+PHY_SetBWMode8192C(
+	IN	PADAPTER					Adapter,
+	IN	HT_CHANNEL_WIDTH	Bandwidth,	// 20M or 40M
+	IN	unsigned char	Offset		// Upper, Lower, or Don't care
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	HT_CHANNEL_WIDTH 	tmpBW= pHalData->CurrentChannelBW;
+	// Modified it for 20/40 mhz switch by guangan 070531
+	//PMGNT_INFO	pMgntInfo=&Adapter->MgntInfo;
+
+	//return;
+	
+	//if(pHalData->SwChnlInProgress)
+//	if(pMgntInfo->bScanInProgress)
+//	{
+//		RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SetBWMode8192C() %s Exit because bScanInProgress!\n", 
+//					Bandwidth == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz"));
+//		return;
+//	}
+
+//	if(pHalData->SetBWModeInProgress)
+//	{
+//		// Modified it for 20/40 mhz switch by guangan 070531
+//		RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SetBWMode8192C() %s cancel last timer because SetBWModeInProgress!\n", 
+//					Bandwidth == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz"));
+//		PlatformCancelTimer(Adapter, &pHalData->SetBWModeTimer);
+//		//return;
+//	}
+
+	//if(pHalData->SetBWModeInProgress)
+	//	return;
+
+	//pHalData->SetBWModeInProgress= TRUE;
+	
+	pHalData->CurrentChannelBW = Bandwidth;
+
+#if 0
+	if(Offset==HT_EXTCHNL_OFFSET_LOWER)
+		pHalData->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_UPPER;
+	else if(Offset==HT_EXTCHNL_OFFSET_UPPER)
+		pHalData->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_LOWER;
+	else
+		pHalData->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+#else
+	pHalData->nCur40MhzPrimeSC = Offset;
+#endif
+
+	if((!Adapter->bDriverStopped) && (!Adapter->bSurpriseRemoved))
+	{
+#ifdef USE_WORKITEM	
+		//PlatformScheduleWorkItem(&(pHalData->SetBWModeWorkItem));
+#else
+	#if 0
+		//PlatformSetTimer(Adapter, &(pHalData->SetBWModeTimer), 0);
+	#else
+		_PHY_SetBWMode92C(Adapter);
+	#endif
+#endif		
+	}
+	else
+	{
+		//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SetBWMode8192C() SetBWModeInProgress FALSE driver sleep or unload\n"));	
+		//pHalData->SetBWModeInProgress= FALSE;	
+		pHalData->CurrentChannelBW = tmpBW;
+	}
+	
+}
+
+
+static void _PHY_SwChnl8192C(PADAPTER Adapter, u8 channel)
+{
+	u8 eRFPath;
+	u32 param1, param2;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if ( Adapter->bNotifyChannelChange )
+	{
+		DBG_871X( "[%s] ch = %d\n", __FUNCTION__, channel );
+	}
+
+	//s1. pre common command - CmdID_SetTxPowerLevel
+	PHY_SetTxPowerLevel8192C(Adapter, channel);
+
+	//s2. RF dependent command - CmdID_RF_WriteReg, param1=RF_CHNLBW, param2=channel
+	param1 = RF_CHNLBW;
+	param2 = channel;
+	for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	{
+		pHalData->RfRegChnlVal[eRFPath] = ((pHalData->RfRegChnlVal[eRFPath] & 0xfffffc00) | param2);
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, param1, bRFRegOffsetMask, pHalData->RfRegChnlVal[eRFPath]);
+	}
+	
+	
+	//s3. post common command - CmdID_End, None
+
+}
+
+VOID
+PHY_SwChnl8192C(	// Call after initialization
+	IN	PADAPTER	Adapter,
+	IN	u8		channel
+	)
+{
+	//PADAPTER Adapter =  ADJUST_TO_ADAPTIVE_ADAPTER(pAdapter, _TRUE);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8	tmpchannel = pHalData->CurrentChannel;
+	BOOLEAN  bResult = _TRUE;
+
+	if(pHalData->rf_chip == RF_PSEUDO_11N)
+	{
+		//pHalData->SwChnlInProgress=FALSE;
+		return; 								//return immediately if it is peudo-phy	
+	}
+	
+	//if(pHalData->SwChnlInProgress)
+	//	return;
+
+	//if(pHalData->SetBWModeInProgress)
+	//	return;
+
+	//--------------------------------------------
+	switch(pHalData->CurrentWirelessMode)
+	{
+		case WIRELESS_MODE_A:
+		case WIRELESS_MODE_N_5G:
+			//RT_ASSERT((channel>14), ("WIRELESS_MODE_A but channel<=14"));		
+			break;
+		
+		case WIRELESS_MODE_B:
+			//RT_ASSERT((channel<=14), ("WIRELESS_MODE_B but channel>14"));
+			break;
+		
+		case WIRELESS_MODE_G:
+		case WIRELESS_MODE_N_24G:
+			//RT_ASSERT((channel<=14), ("WIRELESS_MODE_G but channel>14"));
+			break;
+
+		default:
+			//RT_ASSERT(FALSE, ("Invalid WirelessMode(%#x)!!\n", pHalData->CurrentWirelessMode));
+			break;
+	}
+	//--------------------------------------------
+	
+	//pHalData->SwChnlInProgress = TRUE;
+	if(channel == 0)
+		channel = 1;
+	
+	pHalData->CurrentChannel=channel;
+
+	//pHalData->SwChnlStage=0;
+	//pHalData->SwChnlStep=0;
+
+	if((!Adapter->bDriverStopped) && (!Adapter->bSurpriseRemoved))
+	{
+#ifdef USE_WORKITEM	
+		//bResult = PlatformScheduleWorkItem(&(pHalData->SwChnlWorkItem));
+#else
+		#if 0		
+		//PlatformSetTimer(Adapter, &(pHalData->SwChnlTimer), 0);
+		#else
+		_PHY_SwChnl8192C(Adapter, channel);
+		#endif
+#endif
+		if(bResult)
+		{
+			//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SwChnl8192C SwChnlInProgress TRUE schdule workitem done\n"));
+		}
+		else
+		{
+			//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SwChnl8192C SwChnlInProgress FALSE schdule workitem error\n"));		
+			//if(IS_HARDWARE_TYPE_8192SU(Adapter))
+			//{
+			//	pHalData->SwChnlInProgress = FALSE; 	
+				pHalData->CurrentChannel = tmpchannel;			
+			//}
+		}
+
+	}
+	else
+	{
+		//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SwChnl8192C SwChnlInProgress FALSE driver sleep or unload\n"));	
+		//if(IS_HARDWARE_TYPE_8192SU(Adapter))
+		//{
+		//	pHalData->SwChnlInProgress = FALSE;		
+			pHalData->CurrentChannel = tmpchannel;
+		//}
+	}
+}
+
+
+static	BOOLEAN
+phy_SwChnlStepByStep(
+	IN	PADAPTER	Adapter,
+	IN	u8		channel,
+	IN	u8		*stage,
+	IN	u8		*step,
+	OUT u32		*delay
+	)
+{
+#if 0
+	HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(Adapter);
+	PCHANNEL_ACCESS_SETTING	pChnlAccessSetting;
+	SwChnlCmd				PreCommonCmd[MAX_PRECMD_CNT];
+	u4Byte					PreCommonCmdCnt;
+	SwChnlCmd				PostCommonCmd[MAX_POSTCMD_CNT];
+	u4Byte					PostCommonCmdCnt;
+	SwChnlCmd				RfDependCmd[MAX_RFDEPENDCMD_CNT];
+	u4Byte					RfDependCmdCnt;
+	SwChnlCmd				*CurrentCmd;	
+	u1Byte					eRFPath;	
+	u4Byte					RfTXPowerCtrl;
+	BOOLEAN					bAdjRfTXPowerCtrl = _FALSE;
+	
+	
+	RT_ASSERT((Adapter != NULL), ("Adapter should not be NULL\n"));
+#if(MP_DRIVER != 1)
+	RT_ASSERT(IsLegalChannel(Adapter, channel), ("illegal channel: %d\n", channel));
+#endif
+	RT_ASSERT((pHalData != NULL), ("pHalData should not be NULL\n"));
+	
+	pChnlAccessSetting = &Adapter->MgntInfo.Info8185.ChannelAccessSetting;
+	RT_ASSERT((pChnlAccessSetting != NULL), ("pChnlAccessSetting should not be NULL\n"));
+	
+	//for(eRFPath = RF_PATH_A; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	//for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	//{
+		// <1> Fill up pre common command.
+	PreCommonCmdCnt = 0;
+	phy_SetSwChnlCmdArray(PreCommonCmd, PreCommonCmdCnt++, MAX_PRECMD_CNT, 
+				CmdID_SetTxPowerLevel, 0, 0, 0);
+	phy_SetSwChnlCmdArray(PreCommonCmd, PreCommonCmdCnt++, MAX_PRECMD_CNT, 
+				CmdID_End, 0, 0, 0);
+	
+		// <2> Fill up post common command.
+	PostCommonCmdCnt = 0;
+
+	phy_SetSwChnlCmdArray(PostCommonCmd, PostCommonCmdCnt++, MAX_POSTCMD_CNT, 
+				CmdID_End, 0, 0, 0);
+	
+		// <3> Fill up RF dependent command.
+	RfDependCmdCnt = 0;
+	switch( pHalData->RFChipID )
+	{
+		case RF_8225:		
+		RT_ASSERT((channel >= 1 && channel <= 14), ("illegal channel for Zebra: %d\n", channel));
+		// 2008/09/04 MH Change channel. 
+		if(channel==14) channel++;
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT, 
+			CmdID_RF_WriteReg, rZebra1_Channel, (0x10+channel-1), 10);
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT, 
+		CmdID_End, 0, 0, 0);
+		break;	
+		
+	case RF_8256:
+		// TEST!! This is not the table for 8256!!
+		RT_ASSERT((channel >= 1 && channel <= 14), ("illegal channel for Zebra: %d\n", channel));
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT, 
+			CmdID_RF_WriteReg, rRfChannel, channel, 10);
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT, 
+		CmdID_End, 0, 0, 0);
+		break;
+		
+	case RF_6052:
+		RT_ASSERT((channel >= 1 && channel <= 14), ("illegal channel for Zebra: %d\n", channel));
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT, 
+			CmdID_RF_WriteReg, RF_CHNLBW, channel, 10);		
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT, 
+		CmdID_End, 0, 0, 0);		
+		
+		break;
+
+	case RF_8258:
+		break;
+
+	// For FPGA two MAC verification
+	case RF_PSEUDO_11N:
+		return TRUE;
+	default:
+		RT_ASSERT(FALSE, ("Unknown RFChipID: %d\n", pHalData->RFChipID));
+		return FALSE;
+		break;
+	}
+
+	
+	do{
+		switch(*stage)
+		{
+		case 0:
+			CurrentCmd=&PreCommonCmd[*step];
+			break;
+		case 1:
+			CurrentCmd=&RfDependCmd[*step];
+			break;
+		case 2:
+			CurrentCmd=&PostCommonCmd[*step];
+			break;
+		}
+		
+		if(CurrentCmd->CmdID==CmdID_End)
+		{
+			if((*stage)==2)
+			{
+				return TRUE;
+			}
+			else
+			{
+				(*stage)++;
+				(*step)=0;
+				continue;
+			}
+		}
+		
+		switch(CurrentCmd->CmdID)
+		{
+		case CmdID_SetTxPowerLevel:
+			PHY_SetTxPowerLevel8192C(Adapter,channel);
+			break;
+		case CmdID_WritePortUlong:
+			PlatformEFIOWrite4Byte(Adapter, CurrentCmd->Para1, CurrentCmd->Para2);
+			break;
+		case CmdID_WritePortUshort:
+			PlatformEFIOWrite2Byte(Adapter, CurrentCmd->Para1, (u2Byte)CurrentCmd->Para2);
+			break;
+		case CmdID_WritePortUchar:
+			PlatformEFIOWrite1Byte(Adapter, CurrentCmd->Para1, (u1Byte)CurrentCmd->Para2);
+			break;
+		case CmdID_RF_WriteReg:	// Only modify channel for the register now !!!!!
+			for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+			{
+#if 1
+				pHalData->RfRegChnlVal[eRFPath] = ((pHalData->RfRegChnlVal[eRFPath] & 0xfffffc00) | CurrentCmd->Para2);
+				PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, CurrentCmd->Para1, bRFRegOffsetMask, pHalData->RfRegChnlVal[eRFPath]);
+#else
+				PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, CurrentCmd->Para1, bRFRegOffsetMask, (CurrentCmd->Para2));
+#endif
+			}
+			break;
+		}
+		
+		break;
+	}while(TRUE);
+	//cosa }/*for(Number of RF paths)*/
+
+	(*delay)=CurrentCmd->msDelay;
+	(*step)++;
+	return FALSE;
+#endif	
+	return _TRUE;
+}
+
+
+static	BOOLEAN
+phy_SetSwChnlCmdArray(
+	SwChnlCmd*		CmdTable,
+	u32			CmdTableIdx,
+	u32			CmdTableSz,
+	SwChnlCmdID		CmdID,
+	u32			Para1,
+	u32			Para2,
+	u32			msDelay
+	)
+{
+	SwChnlCmd* pCmd;
+
+	if(CmdTable == NULL)
+	{
+		//RT_ASSERT(FALSE, ("phy_SetSwChnlCmdArray(): CmdTable cannot be NULL.\n"));
+		return _FALSE;
+	}
+	if(CmdTableIdx >= CmdTableSz)
+	{
+		//RT_ASSERT(FALSE, 
+		//		("phy_SetSwChnlCmdArray(): Access invalid index, please check size of the table, CmdTableIdx:%ld, CmdTableSz:%ld\n",
+		//		CmdTableIdx, CmdTableSz));
+		return _FALSE;
+	}
+
+	pCmd = CmdTable + CmdTableIdx;
+	pCmd->CmdID = CmdID;
+	pCmd->Para1 = Para1;
+	pCmd->Para2 = Para2;
+	pCmd->msDelay = msDelay;
+
+	return _TRUE;
+}
+
+
+static	void
+phy_FinishSwChnlNow(	// We should not call this function directly
+		IN	PADAPTER	Adapter,
+		IN	u8		channel
+		)
+{
+#if 0
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32			delay;
+  
+	while(!phy_SwChnlStepByStep(Adapter,channel,&pHalData->SwChnlStage,&pHalData->SwChnlStep,&delay))
+	{
+		if(delay>0)
+			rtw_mdelay_os(delay);
+	}
+#endif	
+}
+
+
+
+//
+// Description:
+//	Switch channel synchronously. Called by SwChnlByDelayHandler.
+//
+// Implemented by Bruce, 2008-02-14.
+// The following procedure is operted according to SwChanlCallback8190Pci().
+// However, this procedure is performed synchronously  which should be running under
+// passive level.
+// 
+VOID
+PHY_SwChnlPhy8192C(	// Only called during initialize
+	IN	PADAPTER	Adapter,
+	IN	u8		channel
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	//RT_TRACE(COMP_SCAN | COMP_RM, DBG_LOUD, ("==>PHY_SwChnlPhy8192S(), switch from channel %d to channel %d.\n", pHalData->CurrentChannel, channel));
+
+	// Cannot IO.
+	//if(RT_CANNOT_IO(Adapter))
+	//	return;
+
+	// Channel Switching is in progress.
+	//if(pHalData->SwChnlInProgress)
+	//	return;
+	
+	//return immediately if it is peudo-phy
+	if(pHalData->rf_chip == RF_PSEUDO_11N)
+	{
+		//pHalData->SwChnlInProgress=FALSE;
+		return;
+	}
+	
+	//pHalData->SwChnlInProgress = TRUE;
+	if( channel == 0)
+		channel = 1;
+	
+	pHalData->CurrentChannel=channel;
+	
+	//pHalData->SwChnlStage = 0;
+	//pHalData->SwChnlStep = 0;
+	
+	phy_FinishSwChnlNow(Adapter,channel);
+	
+	//pHalData->SwChnlInProgress = FALSE;
+}
+
+
+//
+//	Description:
+//		Configure H/W functionality to enable/disable Monitor mode.
+//		Note, because we possibly need to configure BB and RF in this function, 
+//		so caller should in PASSIVE_LEVEL. 080118, by rcnjko.
+//
+VOID
+PHY_SetMonitorMode8192C(
+	IN	PADAPTER			pAdapter,
+	IN	BOOLEAN				bEnableMonitorMode
+	)
+{
+#if 0
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(pAdapter);
+	BOOLEAN				bFilterOutNonAssociatedBSSID = FALSE;
+
+	//2 Note: we may need to stop antenna diversity.
+	if(bEnableMonitorMode)
+	{
+		bFilterOutNonAssociatedBSSID = FALSE;
+		RT_TRACE(COMP_RM, DBG_LOUD, ("PHY_SetMonitorMode8192S(): enable monitor mode\n"));
+
+		pHalData->bInMonitorMode = TRUE;
+		pAdapter->HalFunc.AllowAllDestAddrHandler(pAdapter, TRUE, TRUE);
+		rtw_hal_set_hwreg(pAdapter, HW_VAR_CHECK_BSSID, (pu1Byte)&bFilterOutNonAssociatedBSSID);
+	}
+	else
+	{
+		bFilterOutNonAssociatedBSSID = TRUE;
+		RT_TRACE(COMP_RM, DBG_LOUD, ("PHY_SetMonitorMode8192S(): disable monitor mode\n"));
+
+		pAdapter->HalFunc.AllowAllDestAddrHandler(pAdapter, FALSE, TRUE);
+		pHalData->bInMonitorMode = FALSE;
+		rtw_hal_set_hwreg(pAdapter, HW_VAR_CHECK_BSSID, (pu1Byte)&bFilterOutNonAssociatedBSSID);
+	}
+#endif	
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	PHYCheckIsLegalRfPath8190Pci()
+ *
+ * Overview:	Check different RF type to execute legal judgement. If RF Path is illegal
+ *			We will return false.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	11/15/2007	MHC		Create Version 0.  
+ *
+ *---------------------------------------------------------------------------*/
+BOOLEAN	
+PHY_CheckIsLegalRfPath8192C(	
+	IN	PADAPTER	pAdapter,
+	IN	u32	eRFPath)
+{
+//	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	BOOLEAN				rtValue = _TRUE;
+
+	// NOt check RF Path now.!
+#if 0	
+	if (pHalData->RF_Type == RF_1T2R && eRFPath != RF_PATH_A)
+	{		
+		rtValue = FALSE;
+	}
+	if (pHalData->RF_Type == RF_1T2R && eRFPath != RF_PATH_A)
+	{
+
+	}
+#endif
+	return	rtValue;
+
+}	/* PHY_CheckIsLegalRfPath8192C */
+
+//-------------------------------------------------------------------------
+//
+//	IQK
+//
+//-------------------------------------------------------------------------
+#define MAX_TOLERANCE		5
+#define IQK_DELAY_TIME		1 	//ms
+
+static u8			//bit0 = 1 => Tx OK, bit1 = 1 => Rx OK
+_PHY_PathA_IQK(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		configPathB
+	)
+{
+	u32 regEAC, regE94, regE9C, regEA4;
+	u8 result = 0x00;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	//RTPRINT(FINIT, INIT_IQK, ("Path A IQK!\n"));
+
+	//path-A IQK setting
+	//RTPRINT(FINIT, INIT_IQK, ("Path-A IQK setting!\n"));
+	PHY_SetBBReg(pAdapter, rTx_IQK_Tone_A, bMaskDWord, 0x10008c1f);
+	PHY_SetBBReg(pAdapter, rRx_IQK_Tone_A, bMaskDWord, 0x10008c1f);
+	PHY_SetBBReg(pAdapter, rTx_IQK_PI_A, bMaskDWord, 0x82140102);
+
+	PHY_SetBBReg(pAdapter, rRx_IQK_PI_A, bMaskDWord, configPathB ? 0x28160202 : 
+		IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID)?0x28160202:0x28160502);
+
+	//path-B IQK setting
+	if(configPathB)
+	{
+		PHY_SetBBReg(pAdapter, rTx_IQK_Tone_B, bMaskDWord, 0x10008c22);
+		PHY_SetBBReg(pAdapter, rRx_IQK_Tone_B, bMaskDWord, 0x10008c22);
+		PHY_SetBBReg(pAdapter, rTx_IQK_PI_B, bMaskDWord, 0x82140102);
+		PHY_SetBBReg(pAdapter, rRx_IQK_PI_B, bMaskDWord, 0x28160202);
+	}
+
+	//LO calibration setting
+	//RTPRINT(FINIT, INIT_IQK, ("LO calibration setting!\n"));
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Rsp, bMaskDWord, 0x001028d1);
+
+	//One shot, path A LOK & IQK
+	//RTPRINT(FINIT, INIT_IQK, ("One shot, path A LOK & IQK!\n"));
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Pts, bMaskDWord, 0xf9000000);
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Pts, bMaskDWord, 0xf8000000);
+	
+	// delay x ms
+	//RTPRINT(FINIT, INIT_IQK, ("Delay %d ms for One shot, path A LOK & IQK.\n", IQK_DELAY_TIME));
+	rtw_udelay_os(IQK_DELAY_TIME*1000);//PlatformStallExecution(IQK_DELAY_TIME*1000);
+
+	// Check failed
+	regEAC = PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_A_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xeac = 0x%x\n", regEAC));
+	regE94 = PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_A, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xe94 = 0x%x\n", regE94));
+	regE9C= PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_A, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xe9c = 0x%x\n", regE9C));
+	regEA4= PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_A_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xea4 = 0x%x\n", regEA4));
+
+        if(!(regEAC & BIT28) &&		
+		(((regE94 & 0x03FF0000)>>16) != 0x142) &&
+		(((regE9C & 0x03FF0000)>>16) != 0x42) )
+		result |= 0x01;
+	else							//if Tx not OK, ignore Rx
+		return result;
+
+	if(!(regEAC & BIT27) &&		//if Tx is OK, check whether Rx is OK
+		(((regEA4 & 0x03FF0000)>>16) != 0x132) &&
+		(((regEAC & 0x03FF0000)>>16) != 0x36))
+		result |= 0x02;
+	else
+		DBG_8192C("Path A Rx IQK fail!!\n");
+	
+	return result;
+
+
+}
+
+static u8				//bit0 = 1 => Tx OK, bit1 = 1 => Rx OK
+_PHY_PathB_IQK(
+	IN	PADAPTER	pAdapter
+	)
+{
+	u32 regEAC, regEB4, regEBC, regEC4, regECC;
+	u8	result = 0x00;
+	//RTPRINT(FINIT, INIT_IQK, ("Path B IQK!\n"));
+
+	//One shot, path B LOK & IQK
+	//RTPRINT(FINIT, INIT_IQK, ("One shot, path A LOK & IQK!\n"));
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Cont, bMaskDWord, 0x00000002);
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Cont, bMaskDWord, 0x00000000);
+
+	// delay x ms
+	//RTPRINT(FINIT, INIT_IQK, ("Delay %d ms for One shot, path B LOK & IQK.\n", IQK_DELAY_TIME));
+	rtw_udelay_os(IQK_DELAY_TIME*1000);//PlatformStallExecution(IQK_DELAY_TIME*1000);
+
+	// Check failed
+	regEAC = PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_A_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xeac = 0x%x\n", regEAC));
+	regEB4 = PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_B, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xeb4 = 0x%x\n", regEB4));
+	regEBC= PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_B, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xebc = 0x%x\n", regEBC));
+	regEC4= PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_B_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xec4 = 0x%x\n", regEC4));
+	regECC= PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_B_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xecc = 0x%x\n", regECC));
+
+	if(!(regEAC & BIT31) &&
+		(((regEB4 & 0x03FF0000)>>16) != 0x142) &&
+		(((regEBC & 0x03FF0000)>>16) != 0x42))
+		result |= 0x01;
+	else
+		return result;
+
+	if(!(regEAC & BIT30) &&
+		(((regEC4 & 0x03FF0000)>>16) != 0x132) &&
+		(((regECC & 0x03FF0000)>>16) != 0x36))
+		result |= 0x02;
+	else
+		DBG_8192C("Path B Rx IQK fail!!\n");
+	
+
+	return result;
+
+}
+
+static VOID
+_PHY_PathAFillIQKMatrix(
+	IN	PADAPTER	pAdapter,
+	IN 	BOOLEAN    	bIQKOK,
+	IN	int			result[][8],
+	IN	u8			final_candidate,
+	IN 	BOOLEAN		bTxOnly
+	)
+{
+	u32	Oldval_0, X, TX0_A, reg;
+	s32	Y, TX0_C;
+
+	DBG_8192C("Path A IQ Calibration %s !\n",(bIQKOK)?"Success":"Failed");
+
+	if(final_candidate == 0xFF)
+		return;
+	else if(bIQKOK)
+	{
+		Oldval_0 = (PHY_QueryBBReg(pAdapter, rOFDM0_XATxIQImbalance, bMaskDWord) >> 22) & 0x3FF;
+
+		X = result[final_candidate][0];
+		if ((X & 0x00000200) != 0)
+			X = X | 0xFFFFFC00;
+		TX0_A = (X * Oldval_0) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("X = 0x%lx, TX0_A = 0x%lx, Oldval_0 0x%lx\n", X, TX0_A, Oldval_0));
+		PHY_SetBBReg(pAdapter, rOFDM0_XATxIQImbalance, 0x3FF, TX0_A);
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(31), ((X* Oldval_0>>7) & 0x1));
+
+		Y = result[final_candidate][1];
+		if ((Y & 0x00000200) != 0)
+			Y = Y | 0xFFFFFC00;
+		TX0_C = (Y * Oldval_0) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("Y = 0x%lx, TX = 0x%lx\n", Y, TX0_C));
+		PHY_SetBBReg(pAdapter, rOFDM0_XCTxAFE, 0xF0000000, ((TX0_C&0x3C0)>>6));
+		PHY_SetBBReg(pAdapter, rOFDM0_XATxIQImbalance, 0x003F0000, (TX0_C&0x3F));
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(29), ((Y* Oldval_0>>7) & 0x1));
+
+	        if(bTxOnly)
+		{
+			DBG_8192C("_PHY_PathAFillIQKMatrix only Tx OK\n");
+			return;
+		}
+
+		reg = result[final_candidate][2];
+		PHY_SetBBReg(pAdapter, rOFDM0_XARxIQImbalance, 0x3FF, reg);
+
+		reg = result[final_candidate][3] & 0x3F;
+		PHY_SetBBReg(pAdapter, rOFDM0_XARxIQImbalance, 0xFC00, reg);
+
+		reg = (result[final_candidate][3] >> 6) & 0xF;
+		PHY_SetBBReg(pAdapter, rOFDM0_RxIQExtAnta, 0xF0000000, reg);
+	}
+}
+
+static VOID
+_PHY_PathBFillIQKMatrix(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN   	bIQKOK,
+	IN	int			result[][8],
+	IN	u8			final_candidate,
+	IN	BOOLEAN		bTxOnly			//do Tx only
+	)
+{
+	u32	Oldval_1, X, TX1_A, reg;
+	s32	Y, TX1_C;
+	
+	DBG_8192C("Path B IQ Calibration %s !\n",(bIQKOK)?"Success":"Failed");
+
+	if(final_candidate == 0xFF)
+		return;
+	else if(bIQKOK)
+	{
+		Oldval_1 = (PHY_QueryBBReg(pAdapter, rOFDM0_XBTxIQImbalance, bMaskDWord) >> 22) & 0x3FF;
+
+		X = result[final_candidate][4];
+		if ((X & 0x00000200) != 0)
+			X = X | 0xFFFFFC00;		
+		TX1_A = (X * Oldval_1) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("X = 0x%lx, TX1_A = 0x%lx\n", X, TX1_A));
+		PHY_SetBBReg(pAdapter, rOFDM0_XBTxIQImbalance, 0x3FF, TX1_A);
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(27), ((X* Oldval_1>>7) & 0x1));
+
+		Y = result[final_candidate][5];
+		if ((Y & 0x00000200) != 0)
+			Y = Y | 0xFFFFFC00;		
+		TX1_C = (Y * Oldval_1) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("Y = 0x%lx, TX1_C = 0x%lx\n", Y, TX1_C));
+		PHY_SetBBReg(pAdapter, rOFDM0_XDTxAFE, 0xF0000000, ((TX1_C&0x3C0)>>6));
+		PHY_SetBBReg(pAdapter, rOFDM0_XBTxIQImbalance, 0x003F0000, (TX1_C&0x3F));
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(25), ((Y* Oldval_1>>7) & 0x1));
+
+		if(bTxOnly)
+			return;
+
+		reg = result[final_candidate][6];
+		PHY_SetBBReg(pAdapter, rOFDM0_XBRxIQImbalance, 0x3FF, reg);
+
+		reg = result[final_candidate][7] & 0x3F;
+		PHY_SetBBReg(pAdapter, rOFDM0_XBRxIQImbalance, 0xFC00, reg);
+
+		reg = (result[final_candidate][7] >> 6) & 0xF;
+		PHY_SetBBReg(pAdapter, rOFDM0_AGCRSSITable, 0x0000F000, reg);
+	}
+}
+
+static VOID
+_PHY_SaveADDARegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		ADDAReg,
+	IN	u32*		ADDABackup,
+	IN	u32			RegisterNum
+	)
+{
+	u32	i;
+	
+	//RTPRINT(FINIT, INIT_IQK, ("Save ADDA parameters.\n"));
+	for( i = 0 ; i < RegisterNum ; i++){
+		ADDABackup[i] = PHY_QueryBBReg(pAdapter, ADDAReg[i], bMaskDWord);
+	}
+}
+
+static VOID
+_PHY_SaveMACRegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		MACReg,
+	IN	u32*		MACBackup
+	)
+{
+	u32	i;
+	
+	//RTPRINT(FINIT, INIT_IQK, ("Save MAC parameters.\n"));
+	for( i = 0 ; i < (IQK_MAC_REG_NUM - 1); i++){
+		MACBackup[i] =rtw_read8(pAdapter, MACReg[i]);		
+	}
+	MACBackup[i] = rtw_read32(pAdapter, MACReg[i]);		
+
+}
+
+static VOID
+_PHY_ReloadADDARegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		ADDAReg,
+	IN	u32*		ADDABackup,
+	IN	u32			RegiesterNum
+	)
+{
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("Reload ADDA power saving parameters !\n"));
+	for(i = 0 ; i < RegiesterNum ; i++){
+		PHY_SetBBReg(pAdapter, ADDAReg[i], bMaskDWord, ADDABackup[i]);
+	}
+}
+
+static VOID
+_PHY_ReloadMACRegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		MACReg,
+	IN	u32*		MACBackup
+	)
+{
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("Reload MAC parameters !\n"));
+	for(i = 0 ; i < (IQK_MAC_REG_NUM - 1); i++){
+		rtw_write8(pAdapter, MACReg[i], (u8)MACBackup[i]);
+	}
+	rtw_write32(pAdapter, MACReg[i], MACBackup[i]);	
+}
+
+static VOID
+_PHY_PathADDAOn(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		ADDAReg,
+	IN	BOOLEAN		isPathAOn,
+	IN	BOOLEAN		is2T
+	)
+{
+	u32	pathOn;
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("ADDA ON.\n"));
+
+	pathOn = isPathAOn ? 0x04db25a4 : 0x0b1b25a4;
+	if(_FALSE == is2T){
+		pathOn = 0x0bdb25a0;
+		PHY_SetBBReg(pAdapter, ADDAReg[0], bMaskDWord, 0x0b1b25a0);
+	}
+	else{
+		PHY_SetBBReg(pAdapter, ADDAReg[0], bMaskDWord, pathOn);
+	}
+	
+	for( i = 1 ; i < IQK_ADDA_REG_NUM ; i++){
+		PHY_SetBBReg(pAdapter, ADDAReg[i], bMaskDWord, pathOn);
+	}
+	
+}
+
+static VOID
+_PHY_MACSettingCalibration(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		MACReg,
+	IN	u32*		MACBackup	
+	)
+{
+	u32	i = 0;
+
+	//RTPRINT(FINIT, INIT_IQK, ("MAC settings for Calibration.\n"));
+
+	rtw_write8(pAdapter, MACReg[i], 0x3F);
+
+	for(i = 1 ; i < (IQK_MAC_REG_NUM - 1); i++){
+		rtw_write8(pAdapter, MACReg[i], (u8)(MACBackup[i]&(~BIT3)));
+	}
+	rtw_write8(pAdapter, MACReg[i], (u8)(MACBackup[i]&(~BIT5)));	
+
+}
+
+static VOID
+_PHY_PathAStandBy(
+	IN	PADAPTER	pAdapter
+	)
+{
+	//RTPRINT(FINIT, INIT_IQK, ("Path-A standby mode!\n"));
+
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x0);
+	PHY_SetBBReg(pAdapter, 0x840, bMaskDWord, 0x00010000);
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x80800000);
+}
+
+static VOID
+_PHY_PIModeSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		PIMode
+	)
+{
+	u32	mode;
+
+	//RTPRINT(FINIT, INIT_IQK, ("BB Switch to %s mode!\n", (PIMode ? "PI" : "SI")));
+
+	mode = PIMode ? 0x01000100 : 0x01000000;
+	PHY_SetBBReg(pAdapter, 0x820, bMaskDWord, mode);
+	PHY_SetBBReg(pAdapter, 0x828, bMaskDWord, mode);
+}
+
+/*
+return _FALSE => do IQK again
+*/
+static BOOLEAN							
+_PHY_SimularityCompare(
+	IN	PADAPTER	pAdapter,
+	IN	int 		result[][8],
+	IN	u8		 c1,
+	IN	u8		 c2
+	)
+{
+	u32		i, j, diff, SimularityBitMap, bound = 0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);	
+	u8		final_candidate[2] = {0xFF, 0xFF};	//for path A and path B
+	BOOLEAN		bResult = _TRUE, is2T = IS_92C_SERIAL( pHalData->VersionID);
+	
+	if(is2T)
+		bound = 8;
+	else
+		bound = 4;
+
+	SimularityBitMap = 0;
+	
+	for( i = 0; i < bound; i++ )
+	{
+		diff = (result[c1][i] > result[c2][i]) ? (result[c1][i] - result[c2][i]) : (result[c2][i] - result[c1][i]);
+		if (diff > MAX_TOLERANCE)
+		{
+			if((i == 2 || i == 6) && !SimularityBitMap)
+			{
+				if(result[c1][i]+result[c1][i+1] == 0)
+					final_candidate[(i/4)] = c2;
+				else if (result[c2][i]+result[c2][i+1] == 0)
+					final_candidate[(i/4)] = c1;
+				else
+					SimularityBitMap = SimularityBitMap|(1<<i);
+			}
+			else
+				SimularityBitMap = SimularityBitMap|(1<<i);
+		}
+	}
+	
+	if ( SimularityBitMap == 0)
+	{
+		for( i = 0; i < (bound/4); i++ )
+		{
+			if(final_candidate[i] != 0xFF)
+			{
+				for( j = i*4; j < (i+1)*4-2; j++)
+					result[3][j] = result[final_candidate[i]][j];
+				bResult = _FALSE;
+			}
+		}
+		return bResult;
+	}
+	else if (!(SimularityBitMap & 0x0F))			//path A OK
+	{
+		for(i = 0; i < 4; i++)
+			result[3][i] = result[c1][i];
+		return _FALSE;
+	}
+	else if (!(SimularityBitMap & 0xF0) && is2T)	//path B OK
+	{
+		for(i = 4; i < 8; i++)
+			result[3][i] = result[c1][i];
+		return _FALSE;
+	}	
+	else		
+		return _FALSE;
+	
+}
+
+static VOID	
+_PHY_IQCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	int 		result[][8],
+	IN	u8		t,
+	IN	BOOLEAN		is2T
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u32			i;
+	u8			PathAOK, PathBOK;
+	u32			ADDA_REG[IQK_ADDA_REG_NUM] = {	
+						rFPGA0_XCD_SwitchControl, 	rBlue_Tooth, 	
+						rRx_Wait_CCA, 		rTx_CCK_RFON,
+						rTx_CCK_BBON, 	rTx_OFDM_RFON, 	
+						rTx_OFDM_BBON, 	rTx_To_Rx,
+						rTx_To_Tx, 		rRx_CCK, 	
+						rRx_OFDM, 		rRx_Wait_RIFS,
+						rRx_TO_Rx, 		rStandby, 	
+						rSleep, 			rPMPD_ANAEN };
+
+	u32			IQK_MAC_REG[IQK_MAC_REG_NUM] = {
+						REG_TXPAUSE, 		REG_BCN_CTRL,	
+						REG_BCN_CTRL_1,	REG_GPIO_MUXCFG};
+
+	u32			IQK_BB_REG_92C[IQK_BB_REG_NUM] = {
+							rOFDM0_TRxPathEnable, 		rOFDM0_TRMuxPar,	
+							rFPGA0_XCD_RFInterfaceSW,	rConfig_AntA,	rConfig_AntB,
+							rFPGA0_XAB_RFInterfaceSW,	rFPGA0_XA_RFInterfaceOE,	
+							rFPGA0_XB_RFInterfaceOE,	rFPGA0_RFMOD	
+							};
+
+#if MP_DRIVER
+	const u32	retryCount = 9;
+#else
+	const u32	retryCount = 2;
+#endif
+
+	// Note: IQ calibration must be performed after loading 
+	// 		PHY_REG.txt , and radio_a, radio_b.txt	
+	
+	u32 bbvalue;
+
+	if(t==0)
+	{
+	 	bbvalue = PHY_QueryBBReg(pAdapter, rFPGA0_RFMOD, bMaskDWord);
+		//RTPRINT(FINIT, INIT_IQK, ("PHY_IQCalibrate()==>0x%08lx\n",bbvalue));
+
+		//RTPRINT(FINIT, INIT_IQK, ("IQ Calibration for %s\n", (is2T ? "2T2R" : "1T1R")));
+	
+	 	// Save ADDA parameters, turn Path A ADDA on
+	 	_PHY_SaveADDARegisters(pAdapter, ADDA_REG, pdmpriv->ADDA_backup,IQK_ADDA_REG_NUM);
+		_PHY_SaveMACRegisters(pAdapter, IQK_MAC_REG, pdmpriv->IQK_MAC_backup);
+		_PHY_SaveADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup, IQK_BB_REG_NUM);
+	}
+ 	_PHY_PathADDAOn(pAdapter, ADDA_REG, _TRUE, is2T);
+
+	if(t==0)
+	{
+		pdmpriv->bRfPiEnable = (u8)PHY_QueryBBReg(pAdapter, rFPGA0_XA_HSSIParameter1, BIT(8));
+	}
+
+	if(!pdmpriv->bRfPiEnable){
+		// Switch BB to PI mode to do IQ Calibration.
+		_PHY_PIModeSwitch(pAdapter, _TRUE);
+	}
+
+	PHY_SetBBReg(pAdapter, rFPGA0_RFMOD, BIT24, 0x00);
+	PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable, bMaskDWord, 0x03a05600);
+	PHY_SetBBReg(pAdapter, rOFDM0_TRMuxPar, bMaskDWord, 0x000800e4);
+	PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW, bMaskDWord, 0x22204000);
+	PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 0x01);
+	PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 0x01);
+	PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, BIT10, 0x00);
+	PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0x00);
+
+	if(is2T)
+	{
+		PHY_SetBBReg(pAdapter, rFPGA0_XA_LSSIParameter, bMaskDWord, 0x00010000);
+		PHY_SetBBReg(pAdapter, rFPGA0_XB_LSSIParameter, bMaskDWord, 0x00010000);
+	}
+	
+	//MAC settings
+	_PHY_MACSettingCalibration(pAdapter, IQK_MAC_REG, pdmpriv->IQK_MAC_backup);
+
+	//Page B init
+	PHY_SetBBReg(pAdapter, rConfig_AntA, bMaskDWord, 0x00080000);
+	
+	if(is2T)
+	{
+		PHY_SetBBReg(pAdapter, rConfig_AntB, bMaskDWord, 0x00080000);
+	}
+	
+	// IQ calibration setting
+	//RTPRINT(FINIT, INIT_IQK, ("IQK setting!\n"));		
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x80800000);
+	PHY_SetBBReg(pAdapter, rTx_IQK, bMaskDWord, 0x01007c00);
+	PHY_SetBBReg(pAdapter, rRx_IQK, bMaskDWord, 0x01004800);
+
+	for(i = 0 ; i < retryCount ; i++){
+		PathAOK = _PHY_PathA_IQK(pAdapter, is2T);
+		if(PathAOK == 0x03){
+				DBG_8192C("Path A IQK Success!!\n");
+				result[t][0] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+				result[t][1] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+				result[t][2] = (PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_A_2, bMaskDWord)&0x3FF0000)>>16;
+				result[t][3] = (PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_A_2, bMaskDWord)&0x3FF0000)>>16;
+			break;
+		}
+		else if (i == (retryCount-1) && PathAOK == 0x01)	//Tx IQK OK
+		{
+			DBG_8192C("Path A IQK Only  Tx Success!!\n");
+			
+			result[t][0] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+			result[t][1] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_A, bMaskDWord)&0x3FF0000)>>16;			
+		}
+	}
+
+	if(0x00 == PathAOK){		
+		DBG_8192C("Path A IQK failed!!\n");
+	}
+
+	if(is2T){
+		_PHY_PathAStandBy(pAdapter);
+
+		// Turn Path B ADDA on
+		_PHY_PathADDAOn(pAdapter, ADDA_REG, _FALSE, is2T);
+
+		for(i = 0 ; i < retryCount ; i++){
+			PathBOK = _PHY_PathB_IQK(pAdapter);
+			if(PathBOK == 0x03){
+				DBG_8192C("Path B IQK Success!!\n");
+				result[t][4] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+				result[t][5] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+				result[t][6] = (PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_B_2, bMaskDWord)&0x3FF0000)>>16;
+				result[t][7] = (PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_B_2, bMaskDWord)&0x3FF0000)>>16;
+				break;
+			}
+			else if (i == (retryCount - 1) && PathBOK == 0x01)	//Tx IQK OK
+			{
+				DBG_8192C("Path B Only Tx IQK Success!!\n");
+				result[t][4] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+				result[t][5] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+			}
+		}
+
+		if(0x00 == PathBOK){		
+			DBG_8192C("Path B IQK failed!!\n");
+		}
+	}
+
+	//Back to BB mode, load original value
+	//RTPRINT(FINIT, INIT_IQK, ("IQK:Back to BB mode, load original value!\n"));
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0);
+
+	if(t!=0)
+	{
+		if(!pdmpriv->bRfPiEnable){
+			// Switch back BB to SI mode after finish IQ Calibration.
+			_PHY_PIModeSwitch(pAdapter, _FALSE);
+		}
+
+		// Reload ADDA power saving parameters
+	 	_PHY_ReloadADDARegisters(pAdapter, ADDA_REG, pdmpriv->ADDA_backup, IQK_ADDA_REG_NUM);
+
+		// Reload MAC parameters
+		_PHY_ReloadMACRegisters(pAdapter, IQK_MAC_REG, pdmpriv->IQK_MAC_backup);
+
+	 	// Reload BB parameters
+	 	_PHY_ReloadADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup, IQK_BB_REG_NUM);
+
+		// Restore RX initial gain
+		PHY_SetBBReg(pAdapter, rFPGA0_XA_LSSIParameter, bMaskDWord, 0x00032ed3);
+		if(is2T){
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_LSSIParameter, bMaskDWord, 0x00032ed3);
+		}
+
+		//load 0xe30 IQC default value
+		PHY_SetBBReg(pAdapter, rTx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+		PHY_SetBBReg(pAdapter, rRx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+
+	}
+	//RTPRINT(FINIT, INIT_IQK, ("_PHY_IQCalibrate() <==\n"));
+
+}
+
+
+static VOID	
+_PHY_LCCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		is2T
+	)
+{
+	u8	tmpReg;
+	u32 	RF_Amode = 0, RF_Bmode = 0, LC_Cal;
+
+	//Check continuous TX and Packet TX
+	tmpReg = rtw_read8(pAdapter, 0xd03);
+
+	if((tmpReg&0x70) != 0)			//Deal with contisuous TX case
+		rtw_write8(pAdapter, 0xd03, tmpReg&0x8F);	//disable all continuous TX
+	else 							// Deal with Packet TX case
+		rtw_write8(pAdapter, REG_TXPAUSE, 0xFF);			// block all queues
+
+	if((tmpReg&0x70) != 0)
+	{
+		//1. Read original RF mode
+		//Path-A
+		RF_Amode = PHY_QueryRFReg(pAdapter, RF_PATH_A, RF_AC, bMask12Bits);
+
+		//Path-B
+		if(is2T)
+			RF_Bmode = PHY_QueryRFReg(pAdapter, RF_PATH_B, RF_AC, bMask12Bits);	
+
+		//2. Set RF mode = standby mode
+		//Path-A
+		PHY_SetRFReg(pAdapter, RF_PATH_A, RF_AC, bMask12Bits, (RF_Amode&0x8FFFF)|0x10000);
+
+		//Path-B
+		if(is2T)
+			PHY_SetRFReg(pAdapter, RF_PATH_B, RF_AC, bMask12Bits, (RF_Bmode&0x8FFFF)|0x10000);
+	}
+	
+	//3. Read RF reg18
+	LC_Cal = PHY_QueryRFReg(pAdapter, RF_PATH_A, RF_CHNLBW, bMask12Bits);
+	
+	//4. Set LC calibration begin
+	PHY_SetRFReg(pAdapter, RF_PATH_A, RF_CHNLBW, bMask12Bits, LC_Cal|0x08000);
+
+	#ifdef CONFIG_LONG_DELAY_ISSUE
+	rtw_msleep_os(100);	
+	#else
+	rtw_mdelay_os(100);		
+	#endif
+
+	//Restore original situation
+	if((tmpReg&0x70) != 0)	//Deal with contisuous TX case 
+	{  
+		//Path-A
+		rtw_write8(pAdapter, 0xd03, tmpReg);
+		PHY_SetRFReg(pAdapter, RF_PATH_A, RF_AC, bMask12Bits, RF_Amode);
+		
+		//Path-B
+		if(is2T)
+			PHY_SetRFReg(pAdapter, RF_PATH_B, RF_AC, bMask12Bits, RF_Bmode);
+	}
+	else // Deal with Packet TX case
+	{
+		rtw_write8(pAdapter, REG_TXPAUSE, 0x00);	
+	}
+	
+}
+
+
+//Analog Pre-distortion calibration
+#define		APK_BB_REG_NUM	8
+#define		APK_CURVE_REG_NUM 4
+#define		PATH_NUM		2
+
+static VOID	
+_PHY_APCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	char 		delta,
+	IN	BOOLEAN		is2T
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	u32 			regD[PATH_NUM];
+	u32			tmpReg, index, offset, i, apkbound;
+	u8			path, pathbound = PATH_NUM;
+	u32			BB_backup[APK_BB_REG_NUM];
+	u32			BB_REG[APK_BB_REG_NUM] = {	
+						rFPGA1_TxBlock, 	rOFDM0_TRxPathEnable, 
+						rFPGA0_RFMOD, 	rOFDM0_TRMuxPar, 
+						rFPGA0_XCD_RFInterfaceSW,	rFPGA0_XAB_RFInterfaceSW, 
+						rFPGA0_XA_RFInterfaceOE, 	rFPGA0_XB_RFInterfaceOE	};
+	u32			BB_AP_MODE[APK_BB_REG_NUM] = {	
+						0x00000020, 0x00a05430, 0x02040000, 
+						0x000800e4, 0x00204000 };
+	u32			BB_normal_AP_MODE[APK_BB_REG_NUM] = {	
+						0x00000020, 0x00a05430, 0x02040000, 
+						0x000800e4, 0x22204000 };						
+
+	u32			AFE_backup[IQK_ADDA_REG_NUM];
+	u32			AFE_REG[IQK_ADDA_REG_NUM] = {	
+						rFPGA0_XCD_SwitchControl, 	rBlue_Tooth, 	
+						rRx_Wait_CCA, 		rTx_CCK_RFON,
+						rTx_CCK_BBON, 	rTx_OFDM_RFON, 	
+						rTx_OFDM_BBON, 	rTx_To_Rx,
+						rTx_To_Tx, 		rRx_CCK, 	
+						rRx_OFDM, 		rRx_Wait_RIFS,
+						rRx_TO_Rx, 		rStandby, 	
+						rSleep, 			rPMPD_ANAEN };
+
+	u32			MAC_backup[IQK_MAC_REG_NUM];
+	u32			MAC_REG[IQK_MAC_REG_NUM] = {
+						REG_TXPAUSE, 		REG_BCN_CTRL,	
+						REG_BCN_CTRL_1,	REG_GPIO_MUXCFG};
+
+	u32			APK_RF_init_value[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x0852c, 0x1852c, 0x5852c, 0x1852c, 0x5852c},
+					{0x2852e, 0x0852e, 0x3852e, 0x0852e, 0x0852e}
+					};	
+
+	u32			APK_normal_RF_init_value[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x0852c, 0x0a52c, 0x3a52c, 0x5a52c, 0x5a52c},	//path settings equal to path b settings
+					{0x0852c, 0x0a52c, 0x5a52c, 0x5a52c, 0x5a52c}
+					};
+	
+	u32			APK_RF_value_0[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x52019, 0x52014, 0x52013, 0x5200f, 0x5208d},
+					{0x5201a, 0x52019, 0x52016, 0x52033, 0x52050}
+					};
+
+	u32			APK_normal_RF_value_0[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x52019, 0x52017, 0x52010, 0x5200d, 0x5206a},	//path settings equal to path b settings
+					{0x52019, 0x52017, 0x52010, 0x5200d, 0x5206a}
+					};
+#if 0
+	u32			APK_RF_value_A[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x1adb0, 0x1adb0, 0x1ada0, 0x1ad90, 0x1ad80},		
+					{0x00fb0, 0x00fb0, 0x00fa0, 0x00f90, 0x00f80}						
+					};
+#endif
+	u32			AFE_on_off[PATH_NUM] = {
+					0x04db25a4, 0x0b1b25a4};	//path A on path B off / path A off path B on
+
+	u32			APK_offset[PATH_NUM] = {
+					rConfig_AntA, rConfig_AntB};
+
+	u32			APK_normal_offset[PATH_NUM] = {
+					rConfig_Pmpd_AntA, rConfig_Pmpd_AntB};
+					
+	u32			APK_value[PATH_NUM] = {
+					0x92fc0000, 0x12fc0000};					
+
+	u32			APK_normal_value[PATH_NUM] = {
+					0x92680000, 0x12680000};					
+
+	char			APK_delta_mapping[APK_BB_REG_NUM][13] = {
+					{-4, -3, -2, -2, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-4, -3, -2, -2, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-6, -4, -2, -2, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-1, -1, -1, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-11, -9, -7, -5, -3, -1, 0, 0, 0, 0, 0, 0, 0}
+					};
+	
+	u32			APK_normal_setting_value_1[13] = {
+					0x01017018, 0xf7ed8f84, 0x1b1a1816, 0x2522201e, 0x322e2b28,
+					0x433f3a36, 0x5b544e49, 0x7b726a62, 0xa69a8f84, 0xdfcfc0b3,
+					0x12680000, 0x00880000, 0x00880000
+					};
+
+	u32			APK_normal_setting_value_2[16] = {
+					0x01c7021d, 0x01670183, 0x01000123, 0x00bf00e2, 0x008d00a3,
+					0x0068007b, 0x004d0059, 0x003a0042, 0x002b0031, 0x001f0025,
+					0x0017001b, 0x00110014, 0x000c000f, 0x0009000b, 0x00070008,
+					0x00050006
+					};
+	
+	u32			APK_result[PATH_NUM][APK_BB_REG_NUM];	//val_1_1a, val_1_2a, val_2a, val_3a, val_4a
+	//u32			AP_curve[PATH_NUM][APK_CURVE_REG_NUM];
+
+	int			BB_offset, delta_V, delta_offset;
+
+#if (MP_DRIVER == 1)
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+
+	pMptCtx->APK_bound[0] = 45;
+	pMptCtx->APK_bound[1] = 52;
+#endif
+
+	//RTPRINT(FINIT, INIT_IQK, ("==>PHY_APCalibrate() delta %d\n", delta));
+	
+	//RTPRINT(FINIT, INIT_IQK, ("AP Calibration for %s %s\n", (is2T ? "2T2R" : "1T1R"), (isNormal ? "Normal chip" : "Test chip")));
+
+	if(!is2T)
+		pathbound = 1;
+
+	//2 FOR NORMAL CHIP SETTINGS
+
+// Temporarily do not allow normal driver to do the following settings because these offset
+// and value will cause RF internal PA to be unpredictably disabled by HW, such that RF Tx signal
+// will disappear after disable/enable card many times on 88CU. RF SD and DD have not find the
+// root cause, so we remove these actions temporarily. Added by tynli and SD3 Allen. 2010.05.31.
+#if (MP_DRIVER != 1)
+	return;
+#endif
+
+	//settings adjust for normal chip
+	for(index = 0; index < PATH_NUM; index ++)
+	{
+		APK_offset[index] = APK_normal_offset[index];
+		APK_value[index] = APK_normal_value[index];
+		AFE_on_off[index] = 0x6fdb25a4;
+	}
+
+	for(index = 0; index < APK_BB_REG_NUM; index ++)
+	{
+		for(path = 0; path < pathbound; path++)
+		{
+			APK_RF_init_value[path][index] = APK_normal_RF_init_value[path][index];
+			APK_RF_value_0[path][index] = APK_normal_RF_value_0[path][index];
+		}
+		BB_AP_MODE[index] = BB_normal_AP_MODE[index];
+	}
+
+	apkbound = 6;
+
+	//save BB default value	
+	for(index = 0; index < APK_BB_REG_NUM ; index++)
+	{
+		if(index == 0)		//skip 
+			continue;				
+		BB_backup[index] = PHY_QueryBBReg(pAdapter, BB_REG[index], bMaskDWord);
+	}
+
+	//save MAC default value													
+	_PHY_SaveMACRegisters(pAdapter, MAC_REG, MAC_backup);
+
+	//save AFE default value
+	_PHY_SaveADDARegisters(pAdapter, AFE_REG, AFE_backup, IQK_ADDA_REG_NUM);
+
+	for(path = 0; path < pathbound; path++)
+	{
+		if(path == RF_PATH_A)
+		{
+			//path A APK
+			//load APK setting
+			//path-A		
+			offset = rPdp_AntA;
+			for(index = 0; index < 11; index ++)			
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord))); 	
+				
+				offset += 0x04;
+			}
+			
+			PHY_SetBBReg(pAdapter, rConfig_Pmpd_AntB, bMaskDWord, 0x12680000);
+			
+			offset = rConfig_AntA;
+			for(; index < 13; index ++) 		
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord))); 	
+				
+				offset += 0x04;
+			}	
+			
+			//page-B1
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x40000000);
+			
+			//path A
+			offset = rPdp_AntA;
+			for(index = 0; index < 16; index++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_2[index]);		
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord))); 	
+				
+				offset += 0x04;
+			}				
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x00000000);							
+		}
+		else if(path == RF_PATH_B)
+		{
+			//path B APK
+			//load APK setting
+			//path-B		
+			offset = rPdp_AntB;
+			for(index = 0; index < 10; index ++)			
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord))); 	
+				
+				offset += 0x04;
+			}
+			PHY_SetBBReg(pAdapter, rConfig_Pmpd_AntA, bMaskDWord, 0x12680000);
+			
+			PHY_SetBBReg(pAdapter, rConfig_Pmpd_AntB, bMaskDWord, 0x12680000);
+			
+			offset = rConfig_AntA;
+			index = 11;
+			for(; index < 13; index ++) //offset 0xb68, 0xb6c		
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord))); 	
+				
+				offset += 0x04;
+			}	
+			
+			//page-B1
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x40000000);
+			
+			//path B
+			offset = 0xb60;
+			for(index = 0; index < 16; index++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_2[index]);		
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord))); 	
+				
+				offset += 0x04;
+			}				
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x00000000);							
+		}		
+
+		//save RF default value
+		regD[path] = PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_TXBIAS_A, bRFRegOffsetMask);
+		
+		//Path A AFE all on, path B AFE All off or vise versa
+		for(index = 0; index < IQK_ADDA_REG_NUM ; index++)
+			PHY_SetBBReg(pAdapter, AFE_REG[index], bMaskDWord, AFE_on_off[path]);
+		//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xe70 %x\n", PHY_QueryBBReg(pAdapter, 0xe70, bMaskDWord)));		
+
+		//BB to AP mode
+		if(path == 0)
+		{
+			for(index = 0; index < APK_BB_REG_NUM ; index++)
+			{
+				if(index == 0)		//skip 
+					continue;
+				else if (index < 5)
+					PHY_SetBBReg(pAdapter, BB_REG[index], bMaskDWord, BB_AP_MODE[index]);
+				else if (BB_REG[index] == 0x870)
+					PHY_SetBBReg(pAdapter, BB_REG[index], bMaskDWord, BB_backup[index]|BIT10|BIT26);
+				else
+					PHY_SetBBReg(pAdapter, BB_REG[index], BIT10, 0x0);
+			}
+			PHY_SetBBReg(pAdapter, rTx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+			PHY_SetBBReg(pAdapter, rRx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+		}
+		else		//path B
+		{
+			PHY_SetBBReg(pAdapter, rTx_IQK_Tone_B, bMaskDWord, 0x01008c00);
+			PHY_SetBBReg(pAdapter, rRx_IQK_Tone_B, bMaskDWord, 0x01008c00);
+		}
+
+		//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x800 %x\n", PHY_QueryBBReg(pAdapter, 0x800, bMaskDWord)));				
+
+		//MAC settings
+		_PHY_MACSettingCalibration(pAdapter, MAC_REG, MAC_backup);
+
+		if(path == RF_PATH_A)	//Path B to standby mode
+		{
+			PHY_SetRFReg(pAdapter, RF_PATH_B, RF_AC, bRFRegOffsetMask, 0x10000);			
+		}
+		else			//Path A to standby mode
+		{
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_AC, bRFRegOffsetMask, 0x10000);			
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE1, bRFRegOffsetMask, 0x1000f);			
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE2, bRFRegOffsetMask, 0x20103);						
+		}
+
+		delta_offset = ((delta+14)/2);
+		if(delta_offset < 0)
+			delta_offset = 0;
+		else if (delta_offset > 12)
+			delta_offset = 12;
+			
+		//AP calibration
+		for(index = 0; index < APK_BB_REG_NUM; index++)
+		{
+			if(index != 1)		//only DO PA11+PAD01001, AP RF setting
+				continue;
+					
+			tmpReg = APK_RF_init_value[path][index];
+#if 1			
+			if(!pdmpriv->bAPKThermalMeterIgnore)
+			{
+				BB_offset = (tmpReg & 0xF0000) >> 16;
+
+				if(!(tmpReg & BIT15)) //sign bit 0
+				{
+					BB_offset = -BB_offset;
+				}
+
+				delta_V = APK_delta_mapping[index][delta_offset];
+				
+				BB_offset += delta_V;
+
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() APK num %d delta_V %d delta_offset %d\n", index, delta_V, delta_offset));		
+				
+				if(BB_offset < 0)
+				{
+					tmpReg = tmpReg & (~BIT15);
+					BB_offset = -BB_offset;
+				}
+				else
+				{
+					tmpReg = tmpReg | BIT15;
+				}
+				tmpReg = (tmpReg & 0xFFF0FFFF) | (BB_offset << 16);
+			}
+#endif
+
+#ifdef CONFIG_PCI_HCI
+			if(IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+				PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_IPA_A, bRFRegOffsetMask, 0x894ae);
+			else
+#endif
+				PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_IPA_A, bRFRegOffsetMask, 0x8992e);
+			//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xc %x\n", PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, 0xc, bMaskDWord)));
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_AC, bRFRegOffsetMask, APK_RF_value_0[path][index]);
+			//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x0 %x\n", PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, 0x0, bMaskDWord)));		
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_TXBIAS_A, bRFRegOffsetMask, tmpReg);
+			//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xd %x\n", PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, 0xd, bMaskDWord)));
+
+			// PA11+PAD01111, one shot	
+			i = 0;
+			do
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x80000000);
+				{
+					PHY_SetBBReg(pAdapter, APK_offset[path], bMaskDWord, APK_value[0]);		
+					//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", APK_offset[path], PHY_QueryBBReg(pAdapter, APK_offset[path], bMaskDWord)));
+					rtw_mdelay_os(3);				
+					PHY_SetBBReg(pAdapter, APK_offset[path], bMaskDWord, APK_value[1]);
+					//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", APK_offset[path], PHY_QueryBBReg(pAdapter, APK_offset[path], bMaskDWord)));
+					#ifdef CONFIG_LONG_DELAY_ISSUE
+					rtw_msleep_os(20);
+					#else
+					rtw_mdelay_os(20);
+					#endif
+				}
+				PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x00000000);
+				
+				if(path == RF_PATH_A)
+					tmpReg = PHY_QueryBBReg(pAdapter, rAPK, 0x03E00000);
+				else
+					tmpReg = PHY_QueryBBReg(pAdapter, rAPK, 0xF8000000);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xbd8[25:21] %x\n", tmpReg));
+
+				i++;
+			}
+			while(tmpReg > apkbound && i < 4);
+
+			APK_result[path][index] = tmpReg;
+		}
+	}
+
+	//reload MAC default value	
+	_PHY_ReloadMACRegisters(pAdapter, MAC_REG, MAC_backup);
+
+	//reload BB default value	
+	for(index = 0; index < APK_BB_REG_NUM ; index++)
+	{
+		if(index == 0)		//skip 
+			continue;
+		PHY_SetBBReg(pAdapter, BB_REG[index], bMaskDWord, BB_backup[index]);
+	}
+
+	//reload AFE default value
+	_PHY_ReloadADDARegisters(pAdapter, AFE_REG, AFE_backup, IQK_ADDA_REG_NUM);
+
+	//reload RF path default value
+	for(path = 0; path < pathbound; path++)
+	{
+		PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_TXBIAS_A, bRFRegOffsetMask, regD[path]);
+		if(path == RF_PATH_B)
+		{
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE1, bRFRegOffsetMask, 0x1000f);			
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE2, bRFRegOffsetMask, 0x20101);						
+		}
+
+		//note no index == 0
+		if (APK_result[path][1] > 6)
+			APK_result[path][1] = 6;
+		//RTPRINT(FINIT, INIT_IQK, ("apk path %d result %d 0x%x \t", path, 1, APK_result[path][1]));
+	}
+
+	//RTPRINT(FINIT, INIT_IQK, ("\n"));
+	
+
+	for(path = 0; path < pathbound; path++)
+	{
+		PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G1_G4, bRFRegOffsetMask, 
+		((APK_result[path][1] << 15) | (APK_result[path][1] << 10) | (APK_result[path][1] << 5) | APK_result[path][1]));
+		if(path == RF_PATH_A)
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G5_G8, bRFRegOffsetMask, 
+			((APK_result[path][1] << 15) | (APK_result[path][1] << 10) | (0x00 << 5) | 0x05));
+		else
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G5_G8, bRFRegOffsetMask, 
+			((APK_result[path][1] << 15) | (APK_result[path][1] << 10) | (0x02 << 5) | 0x05));
+		PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G9_G11, bRFRegOffsetMask, 
+		((0x08 << 15) | (0x08 << 10) | (0x08 << 5) | 0x08));
+	}
+
+	pdmpriv->bAPKdone = _TRUE;
+
+	//RTPRINT(FINIT, INIT_IQK, ("<==PHY_APCalibrate()\n"));
+}
+
+static VOID _PHY_SetRFPathSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		bMain,
+	IN	BOOLEAN		is2T
+	)
+{
+	u8	u1bTmp;
+
+	if(!pAdapter->hw_init_completed)
+	{
+		u1bTmp = rtw_read8(pAdapter, REG_LEDCFG2) | BIT7;
+		rtw_write8(pAdapter, REG_LEDCFG2, u1bTmp);
+		//PHY_SetBBReg(pAdapter, REG_LEDCFG0, BIT23, 0x01);
+		PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT13, 0x01);
+	}
+
+	if(is2T)
+	{
+		if(bMain)
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT5|BIT6, 0x1);	//92C_Path_A			
+		else
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT5|BIT6, 0x2);	//BT							
+	}
+	else
+	{
+	
+		if(bMain)
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, 0x300, 0x2);	//Main
+		else
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, 0x300, 0x1);	//Aux		
+	}
+
+}
+
+//return value TRUE => Main; FALSE => Aux
+
+static BOOLEAN _PHY_QueryRFPathSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		is2T
+	)
+{
+//	if(is2T)
+//		return _TRUE;
+	
+	if(!pAdapter->hw_init_completed)
+	{
+		PHY_SetBBReg(pAdapter, REG_LEDCFG0, BIT23, 0x01);
+		PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT13, 0x01);
+	}
+
+	if(is2T)
+	{
+		if(PHY_QueryBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT5|BIT6) == 0x01)
+			return _TRUE;
+		else
+			return _FALSE;
+	}
+	else
+	{
+		if(PHY_QueryBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, 0x300) == 0x02)
+			return _TRUE;
+		else
+			return _FALSE;
+	}
+}
+
+VOID
+rtl8192c_PHY_IQCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN 	bReCovery
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	s32			result[4][8];	//last is final result
+	u8			i, final_candidate;
+	BOOLEAN		bPathAOK, bPathBOK;
+	s32			RegE94, RegE9C, RegEA4, RegEAC, RegEB4, RegEBC, RegEC4, RegECC, RegTmp = 0;
+	BOOLEAN		is12simular, is13simular, is23simular;	
+	BOOLEAN 	bStartContTx = _FALSE, bSingleTone = _FALSE, bCarrierSuppression = _FALSE;
+	u32			IQK_BB_REG_92C[IQK_BB_REG_NUM] = {
+					rOFDM0_XARxIQImbalance, 	rOFDM0_XBRxIQImbalance, 
+					rOFDM0_ECCAThreshold, 	rOFDM0_AGCRSSITable,
+					rOFDM0_XATxIQImbalance, 	rOFDM0_XBTxIQImbalance, 
+					rOFDM0_XCTxAFE, 			rOFDM0_XDTxAFE, 
+					rOFDM0_RxIQExtAnta};
+
+
+#if MP_DRIVER == 1	
+	bStartContTx = pAdapter->mppriv.MptCtx.bStartContTx;
+	bSingleTone = pAdapter->mppriv.MptCtx.bSingleTone;
+	bCarrierSuppression = pAdapter->mppriv.MptCtx.bCarrierSuppression;	
+#endif
+
+	//ignore IQK when continuous Tx
+	if(bStartContTx || bSingleTone || bCarrierSuppression)
+		return;
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	if(bReCovery)
+	{
+		_PHY_ReloadADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup_recover, 9);
+		return;
+	}
+	DBG_8192C("IQK:Start!!!\n");
+
+	for(i = 0; i < 8; i++)
+	{
+		result[0][i] = 0;
+		result[1][i] = 0;
+		result[2][i] = 0;
+		result[3][i] = 0;
+	}
+	final_candidate = 0xff;
+	bPathAOK = _FALSE;
+	bPathBOK = _FALSE;
+	is12simular = _FALSE;
+	is23simular = _FALSE;
+	is13simular = _FALSE;
+
+	for (i=0; i<3; i++)
+	{
+	 	if(IS_92C_SERIAL( pHalData->VersionID)){
+			 _PHY_IQCalibrate(pAdapter, result, i, _TRUE);
+	 	}
+	 	else{
+	 		// For 88C 1T1R
+	 		_PHY_IQCalibrate(pAdapter, result, i, _FALSE);
+ 		}
+		
+		if(i == 1)
+		{
+			is12simular = _PHY_SimularityCompare(pAdapter, result, 0, 1);
+			if(is12simular)
+			{
+				final_candidate = 0;
+				break;
+			}
+		}
+		
+		if(i == 2)
+		{
+			is13simular = _PHY_SimularityCompare(pAdapter, result, 0, 2);
+			if(is13simular)
+			{
+				final_candidate = 0;			
+				break;
+			}
+			
+			is23simular = _PHY_SimularityCompare(pAdapter, result, 1, 2);
+			if(is23simular)
+				final_candidate = 1;
+			else
+			{
+				for(i = 0; i < 8; i++)
+					RegTmp += result[3][i];
+
+				if(RegTmp != 0)
+					final_candidate = 3;			
+				else
+					final_candidate = 0xFF;
+			}
+		}
+	}
+
+        for (i=0; i<4; i++)
+	{
+		RegE94 = result[i][0];
+		RegE9C = result[i][1];
+		RegEA4 = result[i][2];
+		RegEAC = result[i][3];
+		RegEB4 = result[i][4];
+		RegEBC = result[i][5];
+		RegEC4 = result[i][6];
+		RegECC = result[i][7];
+		//RTPRINT(FINIT, INIT_IQK, ("IQK: RegE94=%lx RegE9C=%lx RegEA4=%lx RegEAC=%lx RegEB4=%lx RegEBC=%lx RegEC4=%lx RegECC=%lx\n ", RegE94, RegE9C, RegEA4, RegEAC, RegEB4, RegEBC, RegEC4, RegECC));
+	}
+
+	if(final_candidate != 0xff)
+	{
+		pdmpriv->RegE94 = RegE94 = result[final_candidate][0];
+		pdmpriv->RegE9C = RegE9C = result[final_candidate][1];
+		RegEA4 = result[final_candidate][2];
+		RegEAC = result[final_candidate][3];
+		pdmpriv->RegEB4 = RegEB4 = result[final_candidate][4];
+		pdmpriv->RegEBC = RegEBC = result[final_candidate][5];
+		RegEC4 = result[final_candidate][6];
+		RegECC = result[final_candidate][7];
+		DBG_8192C("IQK: final_candidate is %x\n", final_candidate);
+		DBG_8192C("IQK: RegE94=%x RegE9C=%x RegEA4=%x RegEAC=%x RegEB4=%x RegEBC=%x RegEC4=%x RegECC=%x\n ", RegE94, RegE9C, RegEA4, RegEAC, RegEB4, RegEBC, RegEC4, RegECC);
+		bPathAOK = bPathBOK = _TRUE;
+	}
+	else
+	{
+		RegE94 = RegEB4 = pdmpriv->RegE94 = pdmpriv->RegEB4 = 0x100;	//X default value
+		RegE9C = RegEBC = pdmpriv->RegE9C = pdmpriv->RegEBC = 0x0;		//Y default value
+	}
+	
+	if((RegE94 != 0)/*&&(RegEA4 != 0)*/)
+		_PHY_PathAFillIQKMatrix(pAdapter, bPathAOK, result, final_candidate, (RegEA4 == 0));
+	
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		if((RegEB4 != 0)/*&&(RegEC4 != 0)*/)
+		_PHY_PathBFillIQKMatrix(pAdapter, bPathBOK, result, final_candidate, (RegEC4 == 0));
+	}
+
+	_PHY_SaveADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup_recover, 9);
+
+}
+
+
+VOID
+rtl8192c_PHY_LCCalibrate(
+	IN	PADAPTER	pAdapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct mlme_ext_priv	*pmlmeext = &pAdapter->mlmeextpriv;
+	BOOLEAN 	bStartContTx = _FALSE, bSingleTone = _FALSE, bCarrierSuppression = _FALSE;
+
+#if MP_DRIVER == 1
+	bStartContTx = pAdapter->mppriv.MptCtx.bStartContTx;
+	bSingleTone = pAdapter->mppriv.MptCtx.bSingleTone;
+	bCarrierSuppression = pAdapter->mppriv.MptCtx.bCarrierSuppression;
+#endif
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	//ignore IQK when continuous Tx
+	if(bStartContTx || bSingleTone || bCarrierSuppression)
+		return;
+
+	if(pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+		return;
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		_PHY_LCCalibrate(pAdapter, _TRUE);
+	}
+	else{
+		// For 88C 1T1R
+		_PHY_LCCalibrate(pAdapter, _FALSE);
+	}
+}
+
+VOID
+rtl8192c_PHY_APCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	char 		delta	
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	//default disable APK, because Tx NG issue, suggest by Jenyu, 2011.11.25
+	return;
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	if(pdmpriv->bAPKdone)
+		return;
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		_PHY_APCalibrate(pAdapter, delta, _TRUE);
+	}
+	else{
+		// For 88C 1T1R
+		_PHY_APCalibrate(pAdapter, delta, _FALSE);
+	}
+}
+
+VOID rtl8192c_PHY_SetRFPathSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		bMain
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		_PHY_SetRFPathSwitch(pAdapter, bMain, _TRUE);
+	}
+	else{
+		// For 88C 1T1R
+		_PHY_SetRFPathSwitch(pAdapter, bMain, _FALSE);
+	}
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c
new file mode 100755
index 0000000000000..b1af006d055b5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c
@@ -0,0 +1,1031 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+ * 
+ * 
+ * Module:	rtl8192c_rf6052.c	( Source C File)
+ * 
+ * Note:	Provide RF 6052 series relative API.	 
+ *
+ * Function:	
+ * 		 
+ * Export:	
+ * 
+ * Abbrev:	
+ * 
+ * History:
+ * Data			Who		Remark
+ * 
+ * 09/25/2008	MHC		Create initial version.
+ * 11/05/2008 	MHC		Add API for tw power setting.
+ * 
+ * 	
+******************************************************************************/
+
+#define _RTL8192C_RF6052_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <rtl8192c_hal.h>
+
+/*---------------------------Define Local Constant---------------------------*/
+// Define local structure for debug!!!!!
+typedef struct RF_Shadow_Compare_Map {
+	// Shadow register value
+	u32		Value;
+	// Compare or not flag
+	u8		Compare;
+	// Record If it had ever modified unpredicted
+	u8		ErrorOrNot;
+	// Recorver Flag
+	u8		Recorver;
+	//
+	u8		Driver_Write;
+}RF_SHADOW_T;
+/*---------------------------Define Local Constant---------------------------*/
+
+
+/*------------------------Define global variable-----------------------------*/
+/*------------------------Define global variable-----------------------------*/
+
+
+/*------------------------Define local variable------------------------------*/
+// 2008/11/20 MH For Debug only, RF
+//static	RF_SHADOW_T	RF_Shadow[RF6052_MAX_PATH][RF6052_MAX_REG] = {0};
+static	RF_SHADOW_T	RF_Shadow[RF6052_MAX_PATH][RF6052_MAX_REG];
+/*------------------------Define local variable------------------------------*/
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	RF_ChangeTxPath
+ *
+ * Overview:	For RL6052, we must change some RF settign for 1T or 2T.
+ *
+ * Input:		u2Byte DataRate		// 0x80-8f, 0x90-9f
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 09/25/2008 	MHC		Create Version 0.
+ *						Firmwaer support the utility later.
+ *
+ *---------------------------------------------------------------------------*/
+void rtl8192c_RF_ChangeTxPath(	IN	PADAPTER	Adapter, 
+										IN	u16		DataRate)
+{
+// We do not support gain table change inACUT now !!!! Delete later !!!
+#if 0//(RTL92SE_FPGA_VERIFY == 0)
+	static	u1Byte	RF_Path_Type = 2;	// 1 = 1T 2= 2T			
+	static	u4Byte	tx_gain_tbl1[6] 
+			= {0x17f50, 0x11f40, 0x0cf30, 0x08720, 0x04310, 0x00100};
+	static	u4Byte	tx_gain_tbl2[6] 
+			= {0x15ea0, 0x10e90, 0x0c680, 0x08250, 0x04040, 0x00030};
+	u1Byte	i;
+	
+	if (RF_Path_Type == 2 && (DataRate&0xF) <= 0x7)
+	{
+		// Set TX SYNC power G2G3 loop filter
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+					RF_TXPA_G2, bRFRegOffsetMask, 0x0f000);
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+					RF_TXPA_G3, bRFRegOffsetMask, 0xeacf1);
+
+		// Change TX AGC gain table
+		for (i = 0; i < 6; i++)					
+			PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+						RF_TX_AGC, bRFRegOffsetMask, tx_gain_tbl1[i]);
+
+		// Set PA to high value
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+					RF_TXPA_G2, bRFRegOffsetMask, 0x01e39);
+	}
+	else if (RF_Path_Type == 1 && (DataRate&0xF) >= 0x8)
+	{
+		// Set TX SYNC power G2G3 loop filter
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+					RF_TXPA_G2, bRFRegOffsetMask, 0x04440);
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+					RF_TXPA_G3, bRFRegOffsetMask, 0xea4f1);
+
+		// Change TX AGC gain table
+		for (i = 0; i < 6; i++)
+			PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+						RF_TX_AGC, bRFRegOffsetMask, tx_gain_tbl2[i]);
+
+		// Set PA low gain
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A, 
+					RF_TXPA_G2, bRFRegOffsetMask, 0x01e19);
+	}
+#endif	
+	
+}	/* RF_ChangeTxPath */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_RF6052SetBandwidth()
+ *
+ * Overview:    This function is called by SetBWModeCallback8190Pci() only
+ *
+ * Input:       PADAPTER				Adapter
+ *			WIRELESS_BANDWIDTH_E	Bandwidth	//20M or 40M
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Note:		For RF type 0222D
+ *---------------------------------------------------------------------------*/
+VOID
+rtl8192c_PHY_RF6052SetBandwidth(
+	IN	PADAPTER				Adapter,
+	IN	HT_CHANNEL_WIDTH		Bandwidth)	//20M or 40M
+{	
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	switch(Bandwidth)
+	{
+		case HT_CHANNEL_WIDTH_20:
+			pHalData->RfRegChnlVal[0] = ((pHalData->RfRegChnlVal[0] & 0xfffff3ff) | 0x0400);
+			PHY_SetRFReg(Adapter, RF_PATH_A, RF_CHNLBW, bRFRegOffsetMask, pHalData->RfRegChnlVal[0]);
+			break;
+				
+		case HT_CHANNEL_WIDTH_40:
+			pHalData->RfRegChnlVal[0] = ((pHalData->RfRegChnlVal[0] & 0xfffff3ff));
+			PHY_SetRFReg(Adapter, RF_PATH_A, RF_CHNLBW, bRFRegOffsetMask, pHalData->RfRegChnlVal[0]);			
+			break;
+				
+		default:
+			//RT_TRACE(COMP_DBG, DBG_LOUD, ("PHY_SetRF8225Bandwidth(): unknown Bandwidth: %#X\n",Bandwidth ));
+			break;			
+	}
+	
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	PHY_RF6052SetCckTxPower
+ *
+ * Overview:	
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/05/2008 	MHC		Simulate 8192series..
+ *
+ *---------------------------------------------------------------------------*/
+
+VOID
+rtl8192c_PHY_RF6052SetCckTxPower(
+	IN	PADAPTER		Adapter,
+	IN	u8*			pPowerlevel)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct mlme_ext_priv 		*pmlmeext = &Adapter->mlmeextpriv;
+	//PMGNT_INFO		pMgntInfo=&Adapter->MgntInfo;	
+	u32			TxAGC[2]={0, 0}, tmpval=0;
+	BOOLEAN		TurboScanOff = _FALSE;
+	u8			idx1, idx2;
+	u8*			ptr;
+
+	// 2010/10/18 MH Accorsing to SD3 eechou's suggestion, we need to disable turbo scan for RU.	
+	// Otherwise, external PA will be broken if power index > 0x20.
+#ifdef CONFIG_USB_HCI
+	if (pHalData->EEPROMRegulatory != 0 || pHalData->ExternalPA)
+#else
+	if (pHalData->EEPROMRegulatory != 0)
+#endif
+	{
+		//DbgPrint("TurboScanOff=1 EEPROMRegulatory=%d ExternalPA=%d\n", pHalData->EEPROMRegulatory, pHalData->ExternalPA);
+		TurboScanOff = _TRUE;
+	}
+
+	if(pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+	{
+		TxAGC[RF_PATH_A] = 0x3f3f3f3f;
+		TxAGC[RF_PATH_B] = 0x3f3f3f3f;
+
+		TurboScanOff = _TRUE;//disable turbo scan
+		
+		if(TurboScanOff)
+		{
+			for(idx1=RF_PATH_A; idx1<=RF_PATH_B; idx1++)
+			{
+				TxAGC[idx1] = 
+					pPowerlevel[idx1] | (pPowerlevel[idx1]<<8) |
+					(pPowerlevel[idx1]<<16) | (pPowerlevel[idx1]<<24);
+#ifdef CONFIG_USB_HCI
+				// 2010/10/18 MH For external PA module. We need to limit power index to be less than 0x20.
+				if (TxAGC[idx1] > 0x20 && pHalData->ExternalPA)
+					TxAGC[idx1] = 0x20;
+#endif
+			}
+		}
+	}
+	else
+	{
+// 20100427 Joseph: Driver dynamic Tx power shall not affect Tx power. It shall be determined by power training mechanism.
+// Currently, we cannot fully disable driver dynamic tx power mechanism because it is referenced by BT coexist mechanism.
+// In the future, two mechanism shall be separated from each other and maintained independantly. Thanks for Lanhsin's reminder.
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level1)
+		{	
+			TxAGC[RF_PATH_A] = 0x10101010;
+			TxAGC[RF_PATH_B] = 0x10101010;
+		}
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level2)
+		{	
+			TxAGC[RF_PATH_A] = 0x00000000;
+			TxAGC[RF_PATH_B] = 0x00000000;
+		}
+		else
+		{
+			for(idx1=RF_PATH_A; idx1<=RF_PATH_B; idx1++)
+			{
+				TxAGC[idx1] = 
+					pPowerlevel[idx1] | (pPowerlevel[idx1]<<8) |
+					(pPowerlevel[idx1]<<16) | (pPowerlevel[idx1]<<24);
+			}
+
+			if(pHalData->EEPROMRegulatory==0)
+			{
+				tmpval = (pHalData->MCSTxPowerLevelOriginalOffset[0][6]) + 
+						(pHalData->MCSTxPowerLevelOriginalOffset[0][7]<<8);
+				TxAGC[RF_PATH_A] += tmpval;
+				
+				tmpval = (pHalData->MCSTxPowerLevelOriginalOffset[0][14]) + 
+						(pHalData->MCSTxPowerLevelOriginalOffset[0][15]<<24);
+				TxAGC[RF_PATH_B] += tmpval;
+			}
+		}
+	}
+
+	for(idx1=RF_PATH_A; idx1<=RF_PATH_B; idx1++)
+	{
+		ptr = (u8*)(&(TxAGC[idx1]));
+		for(idx2=0; idx2<4; idx2++)
+		{
+			if(*ptr > RF6052_MAX_TX_PWR)
+				*ptr = RF6052_MAX_TX_PWR;
+			ptr++;
+		}
+	}
+
+	// rf-A cck tx power
+	tmpval = TxAGC[RF_PATH_A]&0xff;
+	PHY_SetBBReg(Adapter, rTxAGC_A_CCK1_Mcs32, bMaskByte1, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 1M (rf-A) = 0x%x (reg 0x%x)\n", tmpval, rTxAGC_A_CCK1_Mcs32));
+	tmpval = TxAGC[RF_PATH_A]>>8;
+	PHY_SetBBReg(Adapter, rTxAGC_B_CCK11_A_CCK2_11, 0xffffff00, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 2~11M (rf-A) = 0x%x (reg 0x%x)\n", tmpval, rTxAGC_B_CCK11_A_CCK2_11));
+
+	// rf-B cck tx power
+	tmpval = TxAGC[RF_PATH_B]>>24;
+	PHY_SetBBReg(Adapter, rTxAGC_B_CCK11_A_CCK2_11, bMaskByte0, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 11M (rf-B) = 0x%x (reg 0x%x)\n", tmpval, rTxAGC_B_CCK11_A_CCK2_11));
+	tmpval = TxAGC[RF_PATH_B]&0x00ffffff;
+	PHY_SetBBReg(Adapter, rTxAGC_B_CCK1_55_Mcs32, 0xffffff00, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 1~5.5M (rf-B) = 0x%x (reg 0x%x)\n", 
+	//	tmpval, rTxAGC_B_CCK1_55_Mcs32));
+	
+}	/* PHY_RF6052SetCckTxPower */
+
+//
+// powerbase0 for OFDM rates
+// powerbase1 for HT MCS rates
+//
+static void getPowerBase(
+	IN	PADAPTER	Adapter,
+	IN	u8*		pPowerLevel,
+	IN	u8		Channel,
+	IN OUT u32*	OfdmBase,
+	IN OUT u32*	MCSBase
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32			powerBase0, powerBase1;
+	u8			Legacy_pwrdiff=0;
+	s8			HT20_pwrdiff=0;
+	u8			i, powerlevel[2];
+
+	for(i=0; i<2; i++)
+	{
+		powerlevel[i] = pPowerLevel[i];
+		Legacy_pwrdiff = pHalData->TxPwrLegacyHtDiff[i][Channel-1];			
+		powerBase0 = powerlevel[i] + Legacy_pwrdiff; 
+
+		powerBase0 = (powerBase0<<24) | (powerBase0<<16) |(powerBase0<<8) |powerBase0;
+		*(OfdmBase+i) = powerBase0;
+		//RTPRINT(FPHY, PHY_TXPWR, (" [OFDM power base index rf(%c) = 0x%x]\n", ((i==0)?'A':'B'), *(OfdmBase+i)));
+	}
+
+	for(i=0; i<2; i++)
+	{
+		//Check HT20 to HT40 diff
+		if(pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_20)
+		{
+			HT20_pwrdiff = pHalData->TxPwrHt20Diff[i][Channel-1];
+			powerlevel[i] += HT20_pwrdiff;
+		}
+		powerBase1 = powerlevel[i];
+		powerBase1 = (powerBase1<<24) | (powerBase1<<16) |(powerBase1<<8) |powerBase1;
+		*(MCSBase+i) = powerBase1;
+		//RTPRINT(FPHY, PHY_TXPWR, (" [MCS power base index rf(%c) = 0x%x]\n", ((i==0)?'A':'B'), *(MCSBase+i)));
+	}
+}
+
+static void getTxPowerWriteValByRegulatory(
+	IN		PADAPTER	Adapter,
+	IN		u8		Channel,
+	IN		u8		index,
+	IN		u32*		powerBase0,
+	IN		u32*		powerBase1,
+	OUT		u32*		pOutWriteVal
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	i, chnlGroup = 0, pwr_diff_limit[4];
+	u32 	writeVal, customer_limit, rf;
+	
+	//
+	// Index 0 & 1= legacy OFDM, 2-5=HT_MCS rate
+	//
+	for(rf=0; rf<2; rf++)
+	{
+		switch(pHalData->EEPROMRegulatory)
+		{
+			case 0:	// Realtek better performance
+					// increase power diff defined by Realtek for large power
+				chnlGroup = 0;
+				//RTPRINT(FPHY, PHY_TXPWR, ("MCSTxPowerLevelOriginalOffset[%d][%d] = 0x%x\n", 
+				//	chnlGroup, index, pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]));
+				writeVal = pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)] + 
+					((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("RTK better performance, writeVal(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+			case 1:	// Realtek regulatory
+					// increase power diff defined by Realtek for regulatory
+				{
+					if(pHalData->pwrGroupCnt == 1)
+						chnlGroup = 0;
+					if(pHalData->pwrGroupCnt >= 3)
+					{
+						if(Channel <= 3)
+							chnlGroup = 0;
+						else if(Channel >= 4 && Channel <= 9)
+							chnlGroup = 1;
+						else if(Channel > 9)
+							chnlGroup = 2;
+
+						if(pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_20)
+							chnlGroup++;
+						else
+							chnlGroup+=4;
+					}
+					//RTPRINT(FPHY, PHY_TXPWR, ("MCSTxPowerLevelOriginalOffset[%d][%d] = 0x%x\n", 
+					//chnlGroup, index, pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]));
+					writeVal = pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)] + 
+							((index<2)?powerBase0[rf]:powerBase1[rf]);
+					//RTPRINT(FPHY, PHY_TXPWR, ("Realtek regulatory, 20MHz, writeVal(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				}
+				break;
+			case 2:	// Better regulatory
+					// don't increase any power diff
+				writeVal = ((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("Better regulatory, writeVal(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+			case 3:	// Customer defined power diff.
+					// increase power diff defined by customer.
+				chnlGroup = 0;
+				//RTPRINT(FPHY, PHY_TXPWR, ("MCSTxPowerLevelOriginalOffset[%d][%d] = 0x%x\n", 
+				//	chnlGroup, index, pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]));
+
+				if (pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_40)
+				{
+					//RTPRINT(FPHY, PHY_TXPWR, ("customer's limit, 40MHz rf(%c) = 0x%x\n", 
+					//	((rf==0)?'A':'B'), pHalData->PwrGroupHT40[rf][Channel-1]));
+				}
+				else
+				{
+					//RTPRINT(FPHY, PHY_TXPWR, ("customer's limit, 20MHz rf(%c) = 0x%x\n", 
+					//	((rf==0)?'A':'B'), pHalData->PwrGroupHT20[rf][Channel-1]));
+				}
+				for (i=0; i<4; i++)
+				{
+					pwr_diff_limit[i] = (u8)((pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]&(0x7f<<(i*8)))>>(i*8));
+					if (pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_40)
+					{
+						if(pwr_diff_limit[i] > pHalData->PwrGroupHT40[rf][Channel-1])
+							pwr_diff_limit[i] = pHalData->PwrGroupHT40[rf][Channel-1];
+					}
+					else
+					{
+						if(pwr_diff_limit[i] > pHalData->PwrGroupHT20[rf][Channel-1])
+							pwr_diff_limit[i] = pHalData->PwrGroupHT20[rf][Channel-1];
+					}
+				}
+				customer_limit = (pwr_diff_limit[3]<<24) | (pwr_diff_limit[2]<<16) |
+								(pwr_diff_limit[1]<<8) | (pwr_diff_limit[0]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("Customer's limit rf(%c) = 0x%x\n", ((rf==0)?'A':'B'), customer_limit));
+
+				writeVal = customer_limit + ((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("Customer, writeVal rf(%c)= 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+			default:
+				chnlGroup = 0;
+				writeVal = pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)] + 
+						((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("RTK better performance, writeVal rf(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+		}
+
+// 20100427 Joseph: Driver dynamic Tx power shall not affect Tx power. It shall be determined by power training mechanism.
+// Currently, we cannot fully disable driver dynamic tx power mechanism because it is referenced by BT coexist mechanism.
+// In the future, two mechanism shall be separated from each other and maintained independantly. Thanks for Lanhsin's reminder.
+
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level1)
+			writeVal = 0x14141414;
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level2)
+			writeVal = 0x00000000;
+
+
+		// 20100628 Joseph: High power mode for BT-Coexist mechanism.
+		// This mechanism is only applied when Driver-Highpower-Mechanism is OFF.
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_BT1)
+		{
+			//RTPRINT(FBT, BT_TRACE, ("Tx Power (-6)\n"));
+			writeVal = writeVal - 0x06060606;
+		}
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_BT2)
+		{
+			//RTPRINT(FBT, BT_TRACE, ("Tx Power (-0)\n"));
+			writeVal = writeVal;
+		}
+		*(pOutWriteVal+rf) = writeVal;
+	}
+}
+
+static void writeOFDMPowerReg(
+	IN		PADAPTER	Adapter,
+	IN		u8		index,
+	IN 		u32*		pValue
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u16 RegOffset_A[6] = {	rTxAGC_A_Rate18_06, rTxAGC_A_Rate54_24, 
+							rTxAGC_A_Mcs03_Mcs00, rTxAGC_A_Mcs07_Mcs04, 
+							rTxAGC_A_Mcs11_Mcs08, rTxAGC_A_Mcs15_Mcs12};
+	u16 RegOffset_B[6] = {	rTxAGC_B_Rate18_06, rTxAGC_B_Rate54_24, 
+							rTxAGC_B_Mcs03_Mcs00, rTxAGC_B_Mcs07_Mcs04,
+							rTxAGC_B_Mcs11_Mcs08, rTxAGC_B_Mcs15_Mcs12};
+	u8 i, rf, pwr_val[4];
+	u32 writeVal;
+	u16 RegOffset;
+
+	for(rf=0; rf<2; rf++)
+	{
+		writeVal = pValue[rf];
+		for(i=0; i<4; i++)
+		{
+			pwr_val[i] = (u8)((writeVal & (0x7f<<(i*8)))>>(i*8));
+			if (pwr_val[i]  > RF6052_MAX_TX_PWR)
+				pwr_val[i]  = RF6052_MAX_TX_PWR;
+		}
+		writeVal = (pwr_val[3]<<24) | (pwr_val[2]<<16) |(pwr_val[1]<<8) |pwr_val[0];
+
+		if(rf == 0)
+			RegOffset = RegOffset_A[index];
+		else
+			RegOffset = RegOffset_B[index];
+		
+		PHY_SetBBReg(Adapter, RegOffset, bMaskDWord, writeVal);
+		//RTPRINT(FPHY, PHY_TXPWR, ("Set 0x%x = %08x\n", RegOffset, writeVal));
+
+		// 201005115 Joseph: Set Tx Power diff for Tx power training mechanism.
+		if(((pHalData->rf_type == RF_2T2R) && 
+				(RegOffset == rTxAGC_A_Mcs15_Mcs12 || RegOffset == rTxAGC_B_Mcs15_Mcs12))||
+		     ((pHalData->rf_type != RF_2T2R) && 
+				(RegOffset == rTxAGC_A_Mcs07_Mcs04 || RegOffset == rTxAGC_B_Mcs07_Mcs04))	)
+		{
+			writeVal = pwr_val[3];
+			if(RegOffset == rTxAGC_A_Mcs15_Mcs12 || RegOffset == rTxAGC_A_Mcs07_Mcs04)
+				RegOffset = 0xc90;
+			if(RegOffset == rTxAGC_B_Mcs15_Mcs12 || RegOffset == rTxAGC_B_Mcs07_Mcs04)
+				RegOffset = 0xc98;
+			for(i=0; i<3; i++)
+			{
+				if(i!=2)
+					writeVal = (writeVal>8)?(writeVal-8):0;
+				else
+					writeVal = (writeVal>6)?(writeVal-6):0;
+				rtw_write8(Adapter, (u32)(RegOffset+i), (u8)writeVal);
+			}
+		}
+	}
+}
+/*-----------------------------------------------------------------------------
+ * Function:	PHY_RF6052SetOFDMTxPower
+ *
+ * Overview:	For legacy and HY OFDM, we must read EEPROM TX power index for 
+ *			different channel and read original value in TX power register area from
+ *			0xe00. We increase offset and original value to be correct tx pwr.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/05/2008 	MHC		Simulate 8192 series method.
+ * 01/06/2009	MHC		1. Prevent Path B tx power overflow or underflow dure to
+ *						A/B pwr difference or legacy/HT pwr diff.
+ *						2. We concern with path B legacy/HT OFDM difference.
+ * 01/22/2009	MHC		Support new EPRO format from SD3.
+ *
+ *---------------------------------------------------------------------------*/
+VOID 
+rtl8192c_PHY_RF6052SetOFDMTxPower(
+	IN	PADAPTER	Adapter,
+	IN	u8*		pPowerLevel,
+	IN	u8		Channel)
+{
+	//HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32 writeVal[2], powerBase0[2], powerBase1[2];
+	u8 index = 0;
+
+	getPowerBase(Adapter, pPowerLevel, Channel, &powerBase0[0], &powerBase1[0]);
+
+	for(index=0; index<6; index++)
+	{
+		getTxPowerWriteValByRegulatory(Adapter, Channel, index, 
+			&powerBase0[0], &powerBase1[0], &writeVal[0]);
+
+		writeOFDMPowerReg(Adapter, index, &writeVal[0]);
+	}
+	
+}
+
+
+static VOID
+phy_RF6052_Config_HardCode(
+	IN	PADAPTER		Adapter
+	)
+{
+	
+	// Set Default Bandwidth to 20M
+	//Adapter->HalFunc	.SetBWModeHandler(Adapter, HT_CHANNEL_WIDTH_20);
+
+	// TODO: Set Default Channel to channel one for RTL8225
+	
+}
+
+static int
+phy_RF6052_Config_ParaFile(
+	IN	PADAPTER		Adapter
+	)
+{
+	u32					u4RegValue=0;
+	u8					eRFPath;		
+	BB_REGISTER_DEFINITION_T	*pPhyReg;	
+
+	int					rtStatus = _SUCCESS;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	static char			sz88CRadioAFile[] = RTL8188C_PHY_RADIO_A;	
+	static char			sz88CRadioBFile[] = RTL8188C_PHY_RADIO_B;
+#ifdef CONFIG_USB_HCI
+	static char			sz88CRadioAFile_mCard[] = RTL8188C_PHY_RADIO_A_mCard;	
+	static char			sz88CRadioBFile_mCard[] = RTL8188C_PHY_RADIO_B_mCard;
+	static char			sz88CRadioAFile_HP[] = RTL8188C_PHY_RADIO_A_HP;	
+#endif
+	static char			sz92CRadioAFile[] = RTL8192C_PHY_RADIO_A;	
+	static char			sz92CRadioBFile[] = RTL8192C_PHY_RADIO_B;
+	static char			sz8723RadioAFile[] = RTL8723_PHY_RADIO_A;	
+	static char			sz8723RadioBFile[] = RTL8723_PHY_RADIO_B;
+	char					*pszRadioAFile, *pszRadioBFile;	
+
+
+	if(IS_HARDWARE_TYPE_8192C(Adapter))
+	{
+		if(IS_92C_SERIAL( pHalData->VersionID))// 88c's IPA  is different from 92c's
+		{
+			pszRadioAFile = sz92CRadioAFile;
+			pszRadioBFile = sz92CRadioBFile;
+		}
+		else
+		{
+			pszRadioAFile = sz88CRadioAFile;
+			pszRadioBFile = sz88CRadioBFile;
+#ifdef CONFIG_USB_HCI
+			if( BOARD_MINICARD == pHalData->BoardType)
+			{
+				pszRadioAFile = sz88CRadioAFile_mCard;
+				pszRadioBFile = sz88CRadioBFile_mCard;
+			}
+			else if( BOARD_USB_High_PA == pHalData->BoardType)
+			{
+				pszRadioAFile = sz88CRadioAFile_HP;
+			}
+#endif	
+		}
+	}
+	else if(IS_HARDWARE_TYPE_8723A(Adapter))
+	{
+		pszRadioAFile = sz8723RadioAFile;
+		pszRadioBFile = sz8723RadioBFile;	
+	}
+
+	//3//-----------------------------------------------------------------
+	//3// <2> Initialize RF
+	//3//-----------------------------------------------------------------
+	//for(eRFPath = RF_PATH_A; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	{
+
+		pPhyReg = &pHalData->PHYRegDef[eRFPath];
+		
+		/*----Store original RFENV control type----*/		
+		switch(eRFPath)
+		{
+		case RF_PATH_A:
+		case RF_PATH_C:
+			u4RegValue = PHY_QueryBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV);
+			break;
+		case RF_PATH_B :
+		case RF_PATH_D:
+			u4RegValue = PHY_QueryBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV<<16);
+			break;
+		}
+
+		/*----Set RF_ENV enable----*/		
+		PHY_SetBBReg(Adapter, pPhyReg->rfintfe, bRFSI_RFENV<<16, 0x1);
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+		
+		/*----Set RF_ENV output high----*/
+		PHY_SetBBReg(Adapter, pPhyReg->rfintfo, bRFSI_RFENV, 0x1);
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		/* Set bit number of Address and Data for RF register */
+		PHY_SetBBReg(Adapter, pPhyReg->rfHSSIPara2, b3WireAddressLength, 0x0); 	// Set 1 to 4 bits for 8255
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		PHY_SetBBReg(Adapter, pPhyReg->rfHSSIPara2, b3WireDataLength, 0x0);	// Set 0 to 12  bits for 8255
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		/*----Initialize RF fom connfiguration file----*/
+		switch(eRFPath)
+		{
+		case RF_PATH_A:
+#ifdef CONFIG_EMBEDDED_FWIMG
+			rtStatus= rtl8192c_PHY_ConfigRFWithHeaderFile(Adapter,(RF_RADIO_PATH_E)eRFPath);
+#else
+			rtStatus = rtl8192c_PHY_ConfigRFWithParaFile(Adapter, pszRadioAFile, (RF_RADIO_PATH_E)eRFPath);
+#endif
+			break;
+		case RF_PATH_B:
+#ifdef CONFIG_EMBEDDED_FWIMG
+			rtStatus = rtl8192c_PHY_ConfigRFWithHeaderFile(Adapter,(RF_RADIO_PATH_E)eRFPath);
+#else			
+			rtStatus = rtl8192c_PHY_ConfigRFWithParaFile(Adapter, pszRadioBFile, (RF_RADIO_PATH_E)eRFPath);
+#endif
+			break;
+		case RF_PATH_C:
+			break;
+		case RF_PATH_D:
+			break;
+		}
+
+		/*----Restore RFENV control type----*/;
+		switch(eRFPath)
+		{
+		case RF_PATH_A:
+		case RF_PATH_C:
+			PHY_SetBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV, u4RegValue);
+			break;
+		case RF_PATH_B :
+		case RF_PATH_D:
+			PHY_SetBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV<<16, u4RegValue);
+			break;
+		}
+
+		if(rtStatus != _SUCCESS){
+			//RT_TRACE(COMP_FPGA, DBG_LOUD, ("phy_RF6052_Config_ParaFile():Radio[%d] Fail!!", eRFPath));
+			goto phy_RF6052_Config_ParaFile_Fail;
+		}
+
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("<---phy_RF6052_Config_ParaFile()\n"));
+	return rtStatus;
+	
+phy_RF6052_Config_ParaFile_Fail:	
+	return rtStatus;
+}
+
+
+int
+PHY_RF6052_Config8192C(
+	IN	PADAPTER		Adapter)
+{
+	HAL_DATA_TYPE				*pHalData = GET_HAL_DATA(Adapter);
+	int					rtStatus = _SUCCESS;	
+	
+	//
+	// Initialize general global value
+	//
+	// TODO: Extend RF_PATH_C and RF_PATH_D in the future
+	if(pHalData->rf_type == RF_1T1R)
+		pHalData->NumTotalRFPath = 1;
+	else
+		pHalData->NumTotalRFPath = 2;
+
+	//
+	// Config BB and RF
+	//
+	rtStatus = phy_RF6052_Config_ParaFile(Adapter);
+#if 0	
+	switch( Adapter->MgntInfo.bRegHwParaFile )
+	{
+		case 0:
+			phy_RF6052_Config_HardCode(Adapter);
+			break;
+
+		case 1:
+			rtStatus = phy_RF6052_Config_ParaFile(Adapter);
+			break;
+
+		case 2:
+			// Partial Modify. 
+			phy_RF6052_Config_HardCode(Adapter);
+			phy_RF6052_Config_ParaFile(Adapter);
+			break;
+
+		default:
+			phy_RF6052_Config_HardCode(Adapter);
+			break;
+	}
+#endif	
+	return rtStatus;
+		
+}
+
+
+//
+// ==> RF shadow Operation API Code Section!!!
+//
+/*-----------------------------------------------------------------------------
+ * Function:	PHY_RFShadowRead
+ *				PHY_RFShadowWrite
+ *				PHY_RFShadowCompare
+ *				PHY_RFShadowRecorver
+ *				PHY_RFShadowCompareAll
+ *				PHY_RFShadowRecorverAll
+ *				PHY_RFShadowCompareFlagSet
+ *				PHY_RFShadowRecorverFlagSet
+ *
+ * Overview:	When we set RF register, we must write shadow at first.
+ *			When we are running, we must compare shadow abd locate error addr.
+ *			Decide to recorver or not.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/20/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+u32
+PHY_RFShadowRead(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset)
+{
+	return	RF_Shadow[eRFPath][Offset].Value;
+	
+}	/* PHY_RFShadowRead */
+
+
+VOID
+PHY_RFShadowWrite(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u32				Data)
+{
+	RF_Shadow[eRFPath][Offset].Value = (Data & bRFRegOffsetMask);
+	RF_Shadow[eRFPath][Offset].Driver_Write = _TRUE;
+	
+}	/* PHY_RFShadowWrite */
+
+
+BOOLEAN
+PHY_RFShadowCompare(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset)
+{
+	u32	reg;
+	// Check if we need to check the register
+	if (RF_Shadow[eRFPath][Offset].Compare == _TRUE)
+	{
+		reg = PHY_QueryRFReg(Adapter, eRFPath, Offset, bRFRegOffsetMask);
+		// Compare shadow and real rf register for 20bits!!
+		if (RF_Shadow[eRFPath][Offset].Value != reg)
+		{
+			// Locate error position.
+			RF_Shadow[eRFPath][Offset].ErrorOrNot = _TRUE;
+			//RT_TRACE(COMP_INIT, DBG_LOUD, 
+			//("PHY_RFShadowCompare RF-%d Addr%02lx Err = %05lx\n", 
+			//eRFPath, Offset, reg));
+		}
+		return RF_Shadow[eRFPath][Offset].ErrorOrNot ;
+	}
+	return _FALSE;
+}	/* PHY_RFShadowCompare */
+
+
+VOID
+PHY_RFShadowRecorver(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset)
+{
+	// Check if the address is error
+	if (RF_Shadow[eRFPath][Offset].ErrorOrNot == _TRUE)
+	{
+		// Check if we need to recorver the register.
+		if (RF_Shadow[eRFPath][Offset].Recorver == _TRUE)
+		{
+			PHY_SetRFReg(Adapter, eRFPath, Offset, bRFRegOffsetMask, 
+							RF_Shadow[eRFPath][Offset].Value);
+			//RT_TRACE(COMP_INIT, DBG_LOUD, 
+			//("PHY_RFShadowRecorver RF-%d Addr%02lx=%05lx", 
+			//eRFPath, Offset, RF_Shadow[eRFPath][Offset].Value));
+		}
+	}
+	
+}	/* PHY_RFShadowRecorver */
+
+
+VOID
+PHY_RFShadowCompareAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			PHY_RFShadowCompare(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset);
+		}
+	}
+	
+}	/* PHY_RFShadowCompareAll */
+
+
+VOID
+PHY_RFShadowRecorverAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			PHY_RFShadowRecorver(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset);
+		}
+	}
+	
+}	/* PHY_RFShadowRecorverAll */
+
+
+VOID
+PHY_RFShadowCompareFlagSet(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u8				Type)
+{
+	// Set True or False!!!
+	RF_Shadow[eRFPath][Offset].Compare = Type;
+		
+}	/* PHY_RFShadowCompareFlagSet */
+
+
+VOID
+PHY_RFShadowRecorverFlagSet(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u8				Type)
+{
+	// Set True or False!!!
+	RF_Shadow[eRFPath][Offset].Recorver= Type;
+		
+}	/* PHY_RFShadowRecorverFlagSet */
+
+
+VOID
+PHY_RFShadowCompareFlagSetAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			// 2008/11/20 MH For S3S4 test, we only check reg 26/27 now!!!!
+			if (Offset != 0x26 && Offset != 0x27)
+				PHY_RFShadowCompareFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _FALSE);
+			else
+				PHY_RFShadowCompareFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _TRUE);
+		}
+	}
+		
+}	/* PHY_RFShadowCompareFlagSetAll */
+
+
+VOID
+PHY_RFShadowRecorverFlagSetAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			// 2008/11/20 MH For S3S4 test, we only check reg 26/27 now!!!!
+			if (Offset != 0x26 && Offset != 0x27)
+				PHY_RFShadowRecorverFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _FALSE);
+			else
+				PHY_RFShadowRecorverFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _TRUE);
+		}
+	}
+		
+}	/* PHY_RFShadowCompareFlagSetAll */
+
+VOID
+PHY_RFShadowRefresh(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset < RF6052_MAX_REG; Offset++)
+		{
+			RF_Shadow[eRFPath][Offset].Value = 0;
+			RF_Shadow[eRFPath][Offset].Compare = _FALSE;
+			RF_Shadow[eRFPath][Offset].Recorver  = _FALSE;
+			RF_Shadow[eRFPath][Offset].ErrorOrNot = _FALSE;
+			RF_Shadow[eRFPath][Offset].Driver_Write = _FALSE;
+		}
+	}
+	
+}	/* PHY_RFShadowRead */
+
+/* End of HalRf6052.c */
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c
new file mode 100755
index 0000000000000..3e0d795ed27ac
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c
@@ -0,0 +1,876 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_REDESC_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtl8192c_hal.h>
+
+static u8 evm_db2percentage(s8 value)
+{
+	//
+	// -33dB~0dB to 0%~99%
+	//
+	s8 ret_val;
+
+	ret_val = value;
+	//ret_val /= 2;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("EVMdbToPercentage92S Value=%d / %x \n", ret_val, ret_val));
+
+	if(ret_val >= 0)
+		ret_val = 0;
+	if(ret_val <= -33)
+		ret_val = -33;
+
+	ret_val = 0 - ret_val;
+	ret_val*=3;
+
+	if(ret_val == 99)
+		ret_val = 100;
+
+	return(ret_val);
+}
+
+
+static s32 signal_scale_mapping(_adapter *padapter, s32 cur_sig )
+{
+	s32 ret_sig;
+
+#ifdef CONFIG_USB_HCI
+	if(cur_sig >= 51 && cur_sig <= 100)
+	{
+		ret_sig = 100;
+	}
+	else if(cur_sig >= 41 && cur_sig <= 50)
+	{
+		ret_sig = 80 + ((cur_sig - 40)*2);
+	}
+	else if(cur_sig >= 31 && cur_sig <= 40)
+	{
+		ret_sig = 66 + (cur_sig - 30);
+	}
+	else if(cur_sig >= 21 && cur_sig <= 30)
+	{
+		ret_sig = 54 + (cur_sig - 20);
+	}
+	else if(cur_sig >= 10 && cur_sig <= 20)
+	{
+		ret_sig = 42 + (((cur_sig - 10) * 2) / 3);
+	}
+	else if(cur_sig >= 5 && cur_sig <= 9)
+	{
+		ret_sig = 22 + (((cur_sig - 5) * 3) / 2);
+	}
+	else if(cur_sig >= 1 && cur_sig <= 4)
+	{
+		ret_sig = 6 + (((cur_sig - 1) * 3) / 2);
+	}
+	else
+	{
+		ret_sig = cur_sig;
+	}
+#else
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+
+	if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+	{
+		// Step 1. Scale mapping.
+		// 20100611 Joseph: Re-tunning RSSI presentation for Lenovo.
+		// 20100426 Joseph: Modify Signal strength mapping.
+		// This modification makes the RSSI indication similar to Intel solution.
+		// 20100414 Joseph: Tunning RSSI for Lenovo according to RTL8191SE.
+		if(cur_sig >= 54 && cur_sig <= 100)
+		{
+			ret_sig = 100;
+		}
+		else if(cur_sig>=42 && cur_sig <= 53 )
+		{
+			ret_sig = 95;
+		}
+		else if(cur_sig>=36 && cur_sig <= 41 )
+		{
+			ret_sig = 74 + ((cur_sig - 36) *20)/6;
+		}
+		else if(cur_sig>=33 && cur_sig <= 35 )
+		{
+			ret_sig = 65 + ((cur_sig - 33) *8)/2;
+		}
+		else if(cur_sig>=18 && cur_sig <= 32 )
+		{
+			ret_sig = 62 + ((cur_sig - 18) *2)/15;
+		}
+		else if(cur_sig>=15 && cur_sig <= 17 )
+		{
+			ret_sig = 33 + ((cur_sig - 15) *28)/2;
+		}
+		else if(cur_sig>=10 && cur_sig <= 14 )
+		{
+			ret_sig = 39;
+		}
+		else if(cur_sig>=8 && cur_sig <= 9 )
+		{
+			ret_sig = 33;
+		}
+		else if(cur_sig <= 8 )
+		{
+			ret_sig = 19;
+		}
+	}
+	else
+	{
+		// Step 1. Scale mapping.
+		if(cur_sig >= 61 && cur_sig <= 100)
+		{
+			ret_sig = 90 + ((cur_sig - 60) / 4);
+		}
+		else if(cur_sig >= 41 && cur_sig <= 60)
+		{
+			ret_sig = 78 + ((cur_sig - 40) / 2);
+		}
+		else if(cur_sig >= 31 && cur_sig <= 40)
+		{
+			ret_sig = 66 + (cur_sig - 30);
+		}
+		else if(cur_sig >= 21 && cur_sig <= 30)
+		{
+			ret_sig = 54 + (cur_sig - 20);
+		}
+		else if(cur_sig >= 5 && cur_sig <= 20)
+		{
+			ret_sig = 42 + (((cur_sig - 5) * 2) / 3);
+		}
+		else if(cur_sig == 4)
+		{
+			ret_sig = 36;
+		}
+		else if(cur_sig == 3)
+		{
+			ret_sig = 27;
+		}
+		else if(cur_sig == 2)
+		{
+			ret_sig = 18;
+		}
+		else if(cur_sig == 1)
+		{
+			ret_sig = 9;
+		}
+		else
+		{
+			ret_sig = cur_sig;
+		}
+	}
+#endif
+
+	return ret_sig;
+}
+
+
+static s32  translate2dbm(u8 signal_strength_idx)
+{
+	s32	signal_power; // in dBm.
+
+
+	// Translate to dBm (x=0.5y-95).
+	signal_power = (s32)((signal_strength_idx + 1) >> 1);
+	signal_power -= 95;
+
+	return signal_power;
+}
+
+static void query_rx_phy_status(union recv_frame *prframe, struct phy_stat *pphy_stat)
+{
+	PHY_STS_OFDM_8192CD_T	*pOfdm_buf;
+	PHY_STS_CCK_8192CD_T	*pCck_buf;
+	u8	i, max_spatial_stream, evm;
+	s8	rx_pwr[4], rx_pwr_all = 0;
+	u8	pwdb_all;
+	u32	rssi,total_rssi=0;
+	u8 	bcck_rate=0, rf_rx_num = 0, cck_highpwr = 0;
+	_adapter				*padapter = prframe->u.hdr.adapter;
+	struct rx_pkt_attrib	*pattrib = &prframe->u.hdr.attrib;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	u8	tmp_rxsnr;
+	s8	rx_snrX;
+
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	PHY_RX_DRIVER_INFO_8192CD *pDrvInfo = ((PHY_RX_DRIVER_INFO_8192CD *)pphy_stat);
+	u8 	bant1_sel = (pDrvInfo->ANTSEL == 1)?_TRUE:_FALSE;	
+#endif
+
+	// Record it for next packet processing
+	bcck_rate=(pattrib->mcs_rate<=3? 1:0);
+
+	if(bcck_rate) //CCK
+	{
+		u8 report;
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY		
+		if(bant1_sel == _TRUE)
+			pHalData->CCK_Ant1_Cnt++;
+		else
+			pHalData->CCK_Ant2_Cnt++;
+#endif		
+
+		// CCK Driver info Structure is not the same as OFDM packet.
+		pCck_buf = (PHY_STS_CCK_8192CD_T *)pphy_stat;
+		//Adapter->RxStats.NumQryPhyStatusCCK++;
+
+		//
+		// (1)Hardware does not provide RSSI for CCK
+		// (2)PWDB, Average PWDB cacluated by hardware (for rate adaptive)
+		//
+
+		if(padapter->pwrctrlpriv.rf_pwrstate == rf_on)
+			cck_highpwr = (u8)pHalData->bCckHighPower;
+		else
+			cck_highpwr = _FALSE;
+
+		if(!cck_highpwr)
+		{
+			report = pCck_buf->cck_agc_rpt&0xc0;
+			report = report>>6;
+			switch(report)
+			{
+				// 03312009 modified by cosa
+				// Modify the RF RNA gain value to -40, -20, -2, 14 by Jenyu's suggestion
+				// Note: different RF with the different RNA gain.
+				case 0x3:
+					rx_pwr_all = (-46) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x2:
+					rx_pwr_all = (-26) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x1:
+					rx_pwr_all = (-12) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x0:
+					rx_pwr_all = (16) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+			}
+		}
+		else
+		{
+			report = pCck_buf->cck_agc_rpt & 0x60;
+			report = report>>5;
+			switch(report)
+			{
+				case 0x3:
+					rx_pwr_all = (-46) - ((pCck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+				case 0x2:
+					rx_pwr_all = (-26)- ((pCck_buf->cck_agc_rpt & 0x1f)<<1);
+					break;
+				case 0x1:
+					rx_pwr_all = (-12) - ((pCck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+				case 0x0:
+					rx_pwr_all = (16) - ((pCck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+			}
+		}
+
+		pwdb_all= query_rx_pwr_percentage(rx_pwr_all);
+		if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+		{
+			// CCK gain is smaller than OFDM/MCS gain,
+			// so we add gain diff by experiences, the val is 6
+			pwdb_all+=6;
+			if(pwdb_all > 100)
+				pwdb_all = 100;
+			// modify the offset to make the same gain index with OFDM.
+			if(pwdb_all > 34 && pwdb_all <= 42)
+				pwdb_all -= 2;
+			else if(pwdb_all > 26 && pwdb_all <= 34)
+				pwdb_all -= 6;
+			else if(pwdb_all > 14 && pwdb_all <= 26)
+				pwdb_all -= 8;
+			else if(pwdb_all > 4 && pwdb_all <= 14)
+				pwdb_all -= 4;
+		}
+
+		pattrib->RxPWDBAll = pwdb_all;	//for DIG/rate adaptive
+		pattrib->RecvSignalPower = rx_pwr_all;	//dBM
+		padapter->recvpriv.rxpwdb = rx_pwr_all;
+		//
+		// (3) Get Signal Quality (EVM)
+		//
+		//if(bPacketMatchBSSID)
+		{
+			u8	sq;
+
+			if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+			{
+				// mapping to 5 bars for vista signal strength
+				// signal quality in driver will be displayed to signal strength
+				// in vista.
+				if(pwdb_all >= 50)
+					sq = 100;
+				else if(pwdb_all >= 35 && pwdb_all < 50)
+					sq = 80;
+				else if(pwdb_all >= 22 && pwdb_all < 35)
+					sq = 60;
+				else if(pwdb_all >= 18 && pwdb_all < 22)
+					sq = 40;
+				else
+					sq = 20;
+			}
+			else
+			{
+				if(pwdb_all> 40)
+				{
+					sq = 100;
+				}
+				else
+				{
+					sq = pCck_buf->SQ_rpt;
+
+					if(pCck_buf->SQ_rpt > 64)
+						sq = 0;
+					else if (pCck_buf->SQ_rpt < 20)
+						sq= 100;
+					else
+						sq = ((64-sq) * 100) / 44;
+
+				}
+			}
+
+			pattrib->signal_qual=sq;
+			pattrib->rx_mimo_signal_qual[0]=sq;
+			pattrib->rx_mimo_signal_qual[1]=(-1);
+		}
+
+	}
+	else //OFDM/HT
+	{
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY	
+		if(bant1_sel == _TRUE)
+			pHalData->OFDM_Ant1_Cnt++;
+		else
+			pHalData->OFDM_Ant2_Cnt++;
+#endif
+		pdmpriv->OFDM_Pkt_Cnt++;
+
+		pOfdm_buf = (PHY_STS_OFDM_8192CD_T *)pphy_stat;
+	
+		//
+		// (1)Get RSSI per-path
+		//
+		for(i=0; i<pHalData->NumTotalRFPath; i++)
+		{
+			// 2008/01/30 MH we will judge RF RX path now.
+			if (pHalData->bRFPathRxEnable[i])
+				rf_rx_num++;
+			//else
+				//continue;
+
+			rx_pwr[i] =  ((pOfdm_buf->trsw_gain_X[i]&0x3F)*2) - 110;
+			padapter->recvpriv.RxRssi[i] = rx_pwr[i];
+			/* Translate DBM to percentage. */
+			pattrib->rx_rssi[i] = rssi = query_rx_pwr_percentage(rx_pwr[i]);
+			total_rssi += rssi;
+
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("RF-%d RXPWR=%x RSSI=%d\n", i, rx_pwr[i], rssi));
+
+			//Get Rx snr value in DB
+			tmp_rxsnr =	pOfdm_buf->rxsnr_X[i];
+			rx_snrX = (s8)(tmp_rxsnr);
+			rx_snrX >>= 1;
+			padapter->recvpriv.RxSNRdB[i] =  (int)rx_snrX;
+			pattrib->rx_snr[i]=pOfdm_buf->rxsnr_X[i];
+			/* Record Signal Strength for next packet */
+			//if(bPacketMatchBSSID)
+			{
+				//pRfd->Status.RxMIMOSignalStrength[i] =(u1Byte) RSSI;
+
+				//The following is for lenovo signal strength in vista
+				if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+				{
+					u8	sq;
+
+					if(i == 0)
+					{
+						// mapping to 5 bars for vista signal strength
+						// signal quality in driver will be displayed to signal strength
+						// in vista.
+						if(rssi >= 50)
+							sq = 100;
+						else if(rssi >= 35 && rssi < 50)
+							sq = 80;
+						else if(rssi >= 22 && rssi < 35)
+							sq = 60;
+						else if(rssi >= 18 && rssi < 22)
+							sq = 40;
+						else
+							sq = 20;
+						//DbgPrint("ofdm/mcs RSSI=%d\n", RSSI);
+						//pRfd->Status.SignalQuality = SQ;
+						//DbgPrint("ofdm/mcs SQ = %d\n", pRfd->Status.SignalQuality);
+					}
+				}
+			}
+		}
+
+
+		//
+		// (2)PWDB, Average PWDB cacluated by hardware (for rate adaptive),average
+		//
+		rx_pwr_all = (((pOfdm_buf->pwdb_all ) >> 1 )& 0x7f) -110;//for OFDM Average RSSI
+		pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
+
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("PWDB_ALL=%d\n",	pwdb_all));
+
+		pattrib->RxPWDBAll = pwdb_all;	//for DIG/rate adaptive
+		pattrib->RecvSignalPower = rx_pwr_all;//dBM
+		padapter->recvpriv.rxpwdb = rx_pwr_all;
+		//
+		// (3)EVM of HT rate
+		//
+		if(pHalData->CustomerID != RT_CID_819x_Lenovo)
+		{
+			if(pattrib->rxht &&  pattrib->mcs_rate >=20 && pattrib->mcs_rate<=27)
+				max_spatial_stream = 2; //both spatial stream make sense
+			else
+				max_spatial_stream = 1; //only spatial stream 1 makes sense
+
+			for(i=0; i<max_spatial_stream; i++)
+			{
+				// Do not use shift operation like "rx_evmX >>= 1" because the compilor of free build environment
+				// fill most significant bit to "zero" when doing shifting operation which may change a negative
+				// value to positive one, then the dbm value (which is supposed to be negative)  is not correct anymore.
+				evm = evm_db2percentage( (pOfdm_buf->rxevm_X[i]/*/ 2*/));//dbm
+
+				RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("RXRATE=%x RXEVM=%x EVM=%s%d\n",
+					pattrib->mcs_rate, pOfdm_buf->rxevm_X[i], "%",evm));
+
+				//if(bPacketMatchBSSID)
+				{
+					if(i==0) // Fill value in RFD, Get the first spatial stream only
+					{
+						pattrib->signal_qual = (u8)(evm & 0xff);
+					}
+					pattrib->rx_mimo_signal_qual[i] = (u8)(evm & 0xff);
+				}
+			}
+
+		}
+
+		//
+		// 4. Record rx statistics for debug
+		//
+
+	}
+
+
+	//UI BSS List signal strength(in percentage), make it good looking, from 0~100.
+	//It is assigned to the BSS List in GetValueFromBeaconOrProbeRsp().
+	if(bcck_rate)
+	{
+		pattrib->signal_strength=(u8)signal_scale_mapping(padapter, pwdb_all);
+	}
+	else
+	{
+		if (rf_rx_num != 0)
+		{
+			pattrib->signal_strength= (u8)(signal_scale_mapping(padapter, total_rssi/=rf_rx_num));
+		}
+	}
+	//DBG_8192C("%s,rx_pwr_all(%d),RxPWDBAll(%d)\n",__FUNCTION__,rx_pwr_all,pattrib->RxPWDBAll);
+
+}
+
+
+static void process_rssi(_adapter *padapter,union recv_frame *prframe)
+{
+	u32	last_rssi, tmp_val;
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	struct signal_stat * signal_stat = &padapter->recvpriv.signal_strength_data;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	//DBG_8192C("process_rssi=> pattrib->rssil(%d) signal_strength(%d)\n ",pattrib->RecvSignalPower,pattrib->signal_strength);
+	//if(pRfd->Status.bPacketToSelf || pRfd->Status.bPacketBeacon)
+	{
+	
+	#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+		if(signal_stat->update_req) {
+			signal_stat->total_num = 0;
+			signal_stat->total_val = 0;
+			signal_stat->update_req = 0;
+		}
+
+		signal_stat->total_num++;
+		signal_stat->total_val  += pattrib->signal_strength;
+		signal_stat->avg_val = signal_stat->total_val / signal_stat->total_num;		
+	#else //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	
+		//Adapter->RxStats.RssiCalculateCnt++;	//For antenna Test
+		if(padapter->recvpriv.signal_strength_data.total_num++ >= PHY_RSSI_SLID_WIN_MAX)
+		{
+			padapter->recvpriv.signal_strength_data.total_num = PHY_RSSI_SLID_WIN_MAX;
+			last_rssi = padapter->recvpriv.signal_strength_data.elements[padapter->recvpriv.signal_strength_data.index];
+			padapter->recvpriv.signal_strength_data.total_val -= last_rssi;
+		}
+		padapter->recvpriv.signal_strength_data.total_val  +=pattrib->signal_strength;
+
+		padapter->recvpriv.signal_strength_data.elements[padapter->recvpriv.signal_strength_data.index++] = pattrib->signal_strength;
+		if(padapter->recvpriv.signal_strength_data.index >= PHY_RSSI_SLID_WIN_MAX)
+			padapter->recvpriv.signal_strength_data.index = 0;
+
+
+		tmp_val = padapter->recvpriv.signal_strength_data.total_val/padapter->recvpriv.signal_strength_data.total_num;
+		
+		if(padapter->recvpriv.is_signal_dbg) {
+			padapter->recvpriv.signal_strength= padapter->recvpriv.signal_strength_dbg;
+			padapter->recvpriv.rssi=(s8)translate2dbm((u8)padapter->recvpriv.signal_strength_dbg);
+		} else {
+			padapter->recvpriv.signal_strength= tmp_val;
+			padapter->recvpriv.rssi=(s8)translate2dbm((u8)tmp_val);
+		}
+
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("UI RSSI = %d, ui_rssi.TotalVal = %d, ui_rssi.TotalNum = %d\n", tmp_val, padapter->recvpriv.signal_strength_data.total_val,padapter->recvpriv.signal_strength_data.total_num));
+	#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	}
+
+}// Process_UI_RSSI_8192C
+
+
+static void process_PWDB(_adapter *padapter, union recv_frame *prframe)
+{
+	int	UndecoratedSmoothedPWDB;
+	int	UndecoratedSmoothedCCK;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct rx_pkt_attrib	*pattrib= &prframe->u.hdr.attrib;
+	struct sta_info		*psta = prframe->u.hdr.psta;
+	u8 isCCKrate=(pattrib->mcs_rate<=3? 1:0);
+
+
+	if(psta)
+	{
+		UndecoratedSmoothedPWDB = psta->rssi_stat.UndecoratedSmoothedPWDB;
+		UndecoratedSmoothedCCK = psta->rssi_stat.UndecoratedSmoothedCCK;
+	}
+	else
+	{
+		UndecoratedSmoothedPWDB = pdmpriv->UndecoratedSmoothedPWDB;
+		UndecoratedSmoothedCCK = pdmpriv->UndecoratedSmoothedCCK;
+	}
+
+	//if(pRfd->Status.bPacketToSelf || pRfd->Status.bPacketBeacon)
+
+	if(!isCCKrate)
+	{
+		// Process OFDM RSSI
+		if(UndecoratedSmoothedPWDB < 0) // initialize
+		{
+			UndecoratedSmoothedPWDB = pattrib->RxPWDBAll;
+		}
+
+		if(pattrib->RxPWDBAll > (u32)UndecoratedSmoothedPWDB)
+		{
+			UndecoratedSmoothedPWDB =
+					( ((UndecoratedSmoothedPWDB)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+
+			UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB + 1;
+		}
+		else
+		{
+			UndecoratedSmoothedPWDB =
+					( ((UndecoratedSmoothedPWDB)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+		}
+	}
+	else
+	{
+		// Process CCK RSSI
+		if(UndecoratedSmoothedCCK < 0) // initialize
+		{
+			UndecoratedSmoothedCCK = pattrib->RxPWDBAll;
+		}
+
+		if(pattrib->RxPWDBAll > (u32)UndecoratedSmoothedCCK)
+		{
+			UndecoratedSmoothedCCK =
+					( ((UndecoratedSmoothedCCK)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+
+			UndecoratedSmoothedCCK = UndecoratedSmoothedCCK + 1;
+		}
+		else
+		{
+			UndecoratedSmoothedCCK =
+					( ((UndecoratedSmoothedCCK)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+		}
+	}
+	
+	
+	if(psta)
+	{
+		//psta->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;//todo:
+		pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+
+		if(pdmpriv->RSSI_Select == RSSI_OFDM){
+			psta->rssi_stat.UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+		}
+		else if(pdmpriv->RSSI_Select == RSSI_CCK){
+			psta->rssi_stat.UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+		}
+		else{
+			if(UndecoratedSmoothedPWDB <0 ) 
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+			else
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+		}
+		psta->rssi_stat.UndecoratedSmoothedCCK = UndecoratedSmoothedCCK;
+	}
+	else
+	{
+		//pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+
+		if(pdmpriv->RSSI_Select == RSSI_OFDM){
+			pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+		}
+		else if(pdmpriv->RSSI_Select == RSSI_CCK){
+			pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+		}
+		else	{
+			if(UndecoratedSmoothedPWDB <0 ) 
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+			else
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+			
+		}
+		pdmpriv->UndecoratedSmoothedCCK = UndecoratedSmoothedCCK;
+	}
+
+	//UpdateRxSignalStatistics8192C(padapter, prframe);
+
+}
+
+
+static void process_link_qual(_adapter *padapter,union recv_frame *prframe)
+{
+	u32	last_evm=0, tmpVal;
+ 	struct rx_pkt_attrib *pattrib;
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	struct signal_stat * signal_stat;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	if(prframe == NULL || padapter==NULL){
+		return;
+	}
+
+	pattrib = &prframe->u.hdr.attrib;
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	signal_stat = &padapter->recvpriv.signal_qual_data;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	//DBG_8192C("process_link_qual=> pattrib->signal_qual(%d)\n ",pattrib->signal_qual);
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	if(signal_stat->update_req) {
+		signal_stat->total_num = 0;
+		signal_stat->total_val = 0;
+		signal_stat->update_req = 0;
+	}
+
+	signal_stat->total_num++;
+	signal_stat->total_val  += pattrib->signal_qual;
+	signal_stat->avg_val = signal_stat->total_val / signal_stat->total_num;
+	
+#else //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	if(pattrib->signal_qual != 0)
+	{
+			//
+			// 1. Record the general EVM to the sliding window.
+			//
+			if(padapter->recvpriv.signal_qual_data.total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX)
+			{
+				padapter->recvpriv.signal_qual_data.total_num = PHY_LINKQUALITY_SLID_WIN_MAX;
+				last_evm = padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index];
+				padapter->recvpriv.signal_qual_data.total_val -= last_evm;
+			}
+			padapter->recvpriv.signal_qual_data.total_val += pattrib->signal_qual;
+
+			padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index++] = pattrib->signal_qual;
+			if(padapter->recvpriv.signal_qual_data.index >= PHY_LINKQUALITY_SLID_WIN_MAX)
+				padapter->recvpriv.signal_qual_data.index = 0;
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("Total SQ=%d  pattrib->signal_qual= %d\n", padapter->recvpriv.signal_qual_data.total_val, pattrib->signal_qual));
+
+			// <1> Showed on UI for user, in percentage.
+			tmpVal = padapter->recvpriv.signal_qual_data.total_val/padapter->recvpriv.signal_qual_data.total_num;
+			padapter->recvpriv.signal_qual=(u8)tmpVal;
+
+	}
+	else
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" pattrib->signal_qual =%d\n", pattrib->signal_qual));
+	}
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+}// Process_UiLinkQuality8192S
+
+
+static void process_phy_info(_adapter *padapter, union recv_frame *prframe)
+{
+	union recv_frame *precvframe = (union recv_frame *)prframe;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	// If we switch to the antenna for testing, the signal strength 
+	// of the packets in this time shall not be counted into total receiving power. 
+	// This prevents error counting Rx signal strength and affecting other dynamic mechanism.
+
+	// Select the packets to do RSSI checking for antenna switching.
+	SwAntDivRSSICheck8192C(padapter, precvframe->u.hdr.attrib.RxPWDBAll);
+
+	if(GET_HAL_DATA(padapter)->RSSI_test == _TRUE)
+		return;
+#endif
+	//
+	// Check RSSI
+	//
+	process_rssi(padapter, precvframe);
+	//
+	// Check PWDB.
+	//
+	process_PWDB(padapter, precvframe); 
+	//
+	// Check EVM
+	//
+	process_link_qual(padapter,  precvframe);
+
+}
+
+
+void rtl8192c_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_info)
+{
+	struct rx_pkt_attrib	*pattrib = &precvframe->u.hdr.attrib;
+	_adapter				*padapter = precvframe->u.hdr.adapter;
+	u8	bPacketMatchBSSID =_FALSE;
+	u8	bPacketToSelf = _FALSE;
+	u8	bPacketBeacon = _FALSE;
+
+	if((pattrib->physt) && (pphy_info != NULL))
+	{
+		bPacketMatchBSSID = ((!IsFrameTypeCtrl(precvframe->u.hdr.rx_data)) && !(pattrib->icv_err) && !(pattrib->crc_err) &&
+			_rtw_memcmp(get_hdr_bssid(precvframe->u.hdr.rx_data), get_my_bssid(&padapter->mlmeextpriv.mlmext_info.network), ETH_ALEN));
+			
+
+		bPacketToSelf = bPacketMatchBSSID &&  (_rtw_memcmp(get_da(precvframe->u.hdr.rx_data), myid(&padapter->eeprompriv), ETH_ALEN));
+
+		bPacketBeacon =bPacketMatchBSSID && (GetFrameSubType(precvframe->u.hdr.rx_data) ==  WIFI_BEACON);
+
+		query_rx_phy_status(precvframe, pphy_info);
+
+		precvframe->u.hdr.psta = NULL;
+		if(bPacketMatchBSSID && check_fwstate(&padapter->mlmepriv, WIFI_AP_STATE) == _TRUE)
+		{
+			u8 *sa;
+			struct sta_info *psta=NULL;
+			struct sta_priv *pstapriv = &padapter->stapriv;
+			
+			sa = get_sa(precvframe->u.hdr.rx_data);
+
+			psta = rtw_get_stainfo(pstapriv, sa);
+			if(psta)
+			{
+				precvframe->u.hdr.psta = psta;
+				process_phy_info(padapter, precvframe);
+			}
+		}
+		else if(bPacketToSelf || bPacketBeacon)
+		{
+			if(check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+			{
+				u8 *sa;
+				struct sta_info *psta=NULL;
+				struct sta_priv *pstapriv = &padapter->stapriv;
+			
+				sa = get_sa(precvframe->u.hdr.rx_data);
+
+				psta = rtw_get_stainfo(pstapriv, sa);
+				if(psta)
+				{
+					precvframe->u.hdr.psta = psta;
+				}				
+			}
+					
+			process_phy_info(padapter, precvframe);
+		}
+	}
+}
+
+void rtl8192c_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc)
+{
+	struct rx_pkt_attrib	*pattrib = &precvframe->u.hdr.attrib;
+
+	//Offset 0
+	pattrib->physt = (u8)((le32_to_cpu(pdesc->rxdw0) >> 26) & 0x1);
+	pattrib->pkt_len =  (u16)(le32_to_cpu(pdesc->rxdw0)&0x00003fff);
+	pattrib->drvinfo_sz = (u8)((le32_to_cpu(pdesc->rxdw0) >> 16) & 0xf) * 8;//uint 2^3 = 8 bytes
+
+	pattrib->shift_sz = (u8)((le32_to_cpu(pdesc->rxdw0) >> 24) & 0x3);
+
+	pattrib->crc_err = (u8)((le32_to_cpu(pdesc->rxdw0) >> 14) & 0x1);
+	pattrib->icv_err = (u8)((le32_to_cpu(pdesc->rxdw0) >> 15) & 0x1);
+	pattrib->qos = (u8)(( le32_to_cpu( pdesc->rxdw0 ) >> 23) & 0x1);// Qos data, wireless lan header length is 26
+	pattrib->bdecrypted = (le32_to_cpu(pdesc->rxdw0) & BIT(27))? 0:1;
+
+	//Offset 4
+	pattrib->mfrag = (u8)((le32_to_cpu(pdesc->rxdw1) >> 27) & 0x1);//more fragment bit
+
+	//Offset 8
+	pattrib->frag_num = (u8)((le32_to_cpu(pdesc->rxdw2) >> 12) & 0xf);//fragmentation number
+
+	//Offset 12
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	if ( le32_to_cpu(pdesc->rxdw3) & BIT(13)){
+		pattrib->tcpchk_valid = 1; // valid
+		if ( le32_to_cpu(pdesc->rxdw3) & BIT(11) ) {
+			pattrib->tcp_chkrpt = 1; // correct
+			//DBG_8192C("tcp csum ok\n");
+		}
+		else
+			pattrib->tcp_chkrpt = 0; // incorrect
+
+		if ( le32_to_cpu(pdesc->rxdw3) & BIT(12) )
+			pattrib->ip_chkrpt = 1; // correct
+		else
+			pattrib->ip_chkrpt = 0; // incorrect
+	}
+	else {
+		pattrib->tcpchk_valid = 0; // invalid
+	}
+#endif
+
+	pattrib->mcs_rate=(u8)((le32_to_cpu(pdesc->rxdw3))&0x3f);
+	pattrib->rxht=(u8)((le32_to_cpu(pdesc->rxdw3) >>6)&0x1);
+	pattrib->sgi=(u8)((le32_to_cpu(pdesc->rxdw3) >>8)&0x1);
+	//Offset 16
+	//Offset 20
+
+}
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c
new file mode 100755
index 0000000000000..1368d66ac686d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c
@@ -0,0 +1,94 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#include <rtl8192c_sreset.h>
+#include <rtl8192c_hal.h>
+#ifdef DBG_CONFIG_ERROR_DETECT
+void rtl8192c_sreset_xmit_status_check(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);	
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;	
+	
+	unsigned long current_time;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	unsigned int diff_time;
+	u32 txdma_status;
+	if( (txdma_status=rtw_read32(padapter, REG_TXDMA_STATUS)) !=0x00){
+		DBG_871X("%s REG_TXDMA_STATUS:0x%08x\n", __FUNCTION__, txdma_status);
+		rtw_hal_sreset_reset(padapter);						
+	}
+	
+	//total xmit irp = 4
+	//DBG_8192C("==>%s free_xmitbuf_cnt(%d),txirp_cnt(%d)\n",__FUNCTION__,pxmitpriv->free_xmitbuf_cnt,pxmitpriv->txirp_cnt);
+	//if(pxmitpriv->txirp_cnt == NR_XMITBUFF+1)
+	current_time = rtw_get_current_time();
+
+	if(0 == pxmitpriv->free_xmitbuf_cnt || 0 == pxmitpriv->free_xmit_extbuf_cnt) {
+
+		diff_time = rtw_get_passing_time_ms(psrtpriv->last_tx_time);
+
+		if (diff_time > 2000) {
+			if (psrtpriv->last_tx_complete_time == 0) {
+				psrtpriv->last_tx_complete_time = current_time;
+			}
+			else{
+				diff_time = rtw_get_passing_time_ms(psrtpriv->last_tx_complete_time);
+				if (diff_time > 4000) {
+					//padapter->Wifi_Error_Status = WIFI_TX_HANG;
+					DBG_871X("%s tx hang\n", __FUNCTION__);
+					rtw_hal_sreset_reset(padapter);
+				}
+			}
+		}
+	}
+
+	if (psrtpriv->dbg_trigger_point == SRESET_TGP_XMIT_STATUS) {
+		psrtpriv->dbg_trigger_point = SRESET_TGP_NULL;
+		rtw_hal_sreset_reset(padapter);
+		return;
+	}
+}
+void rtl8192c_sreset_linked_status_check(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	u32 regc50,regc58,reg824,reg800;
+	regc50 = rtw_read32(padapter,0xc50);
+	regc58 = rtw_read32(padapter,0xc58);
+	reg824 = rtw_read32(padapter,0x824);
+	reg800 = rtw_read32(padapter,0x800);	
+	if(	((regc50&0xFFFFFF00)!= 0x69543400)||
+		((regc58&0xFFFFFF00)!= 0x69543400)||
+		(((reg824&0xFFFFFF00)!= 0x00390000)&&(((reg824&0xFFFFFF00)!= 0x80390000)))||
+		( ((reg800&0xFFFFFF00)!= 0x03040000)&&((reg800&0xFFFFFF00)!= 0x83040000)))
+	{
+		DBG_8192C("%s regc50:0x%08x, regc58:0x%08x, reg824:0x%08x, reg800:0x%08x,\n", __FUNCTION__,
+			regc50, regc58, reg824, reg800);
+		rtw_hal_sreset_reset(padapter);	
+	}
+
+	if (psrtpriv->dbg_trigger_point == SRESET_TGP_LINK_STATUS) {
+		psrtpriv->dbg_trigger_point = SRESET_TGP_NULL;
+		rtw_hal_sreset_reset(padapter);
+		return;
+	}
+}
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c
new file mode 100755
index 0000000000000..2cfd851a1793a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c
@@ -0,0 +1,63 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_XMIT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtl8192c_hal.h>
+
+#ifdef CONFIG_XMIT_ACK
+void dump_txrpt_ccx_8192c(void *buf)
+{
+	struct txrpt_ccx_8192c *txrpt_ccx = buf; 
+
+	DBG_871X("%s:\n"
+		"retry_cnt:%u, rsvd_0:%u, rts_retry_cnt:%u, rsvd_1:%u\n"
+		"ccx_qtime:%u, missed_pkt_num:%u, rsvd_4:%u\n"
+		"mac_id:%u, des1_fragssn:%u\n"
+		"rpt_pkt_num:%u, pkt_drop:%u, lifetime_over:%u, retry_over:%u\n"
+		"edca_tx_queue:%u, rsvd_7:%u, bmc:%u, pkt_ok:%u, init_ccx:%u\n"
+		, __func__
+		, txrpt_ccx->retry_cnt, txrpt_ccx->rsvd_0, txrpt_ccx->rts_retry_cnt, txrpt_ccx->rsvd_1
+		, txrpt_ccx_qtime_8192c(txrpt_ccx), txrpt_ccx->missed_pkt_num, txrpt_ccx->rsvd_4
+		, txrpt_ccx->mac_id, txrpt_ccx->des1_fragssn
+		, txrpt_ccx->rpt_pkt_num, txrpt_ccx->pkt_drop, txrpt_ccx->lifetime_over, txrpt_ccx->retry_over
+		, txrpt_ccx->edca_tx_queue, txrpt_ccx->rsvd_7, txrpt_ccx->bmc, txrpt_ccx->pkt_ok, txrpt_ccx->int_ccx
+	);
+}
+
+void handle_txrpt_ccx_8192c(_adapter *adapter, void *buf)
+{
+	struct txrpt_ccx_8192c *txrpt_ccx = buf; 
+
+	#ifdef DBG_CCX
+	dump_txrpt_ccx_8192c(buf);
+	#endif
+
+	if (txrpt_ccx->int_ccx) {
+		if (txrpt_ccx->pkt_ok)
+			rtw_ack_tx_done(&adapter->xmitpriv, RTW_SCTX_DONE_SUCCESS);
+		else
+			rtw_ack_tx_done(&adapter->xmitpriv, RTW_SCTX_DONE_CCX_PKT_FAIL);
+	}
+}
+#endif //CONFIG_XMIT_ACK
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c
new file mode 100755
index 0000000000000..b49486b45fb63
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c
@@ -0,0 +1,8758 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+/*Created on  2011/ 6/15,  5:45*/
+
+#include <basic_types.h>
+#include "Hal8192CUHWImg.h"
+
+#ifdef CONFIG_BT_COEXISTENCE
+// =================== v84 TSMC COMMON 2012-04-13 =======================
+u8 Rtl8192CUFwTSMCImgArray[TSMCImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x54,0x00,0x01,0x00,0x04,0x13,0x11,0x07,0x3a,0x3d,0x00,0x00,
+0x58,0x97,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x50,0xa1,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0x91,0x00,0x00,0x00,0x00,0x00,0xa1,0xe8,0x00,0x00,0x00,
+0x05,0x04,0x03,0x02,0x00,0x03,0x06,0x05,0x04,0x03,0x00,0x04,0x06,0x05,0x04,0x02,
+0x00,0x04,0x08,0x07,0x06,0x04,0x00,0x06,0x0a,0x09,0x08,0x06,0x00,0x08,0x0a,0x09,
+0x08,0x04,0x00,0x08,0x0a,0x09,0x08,0x02,0x00,0x08,0x0a,0x09,0x08,0x00,0x00,0x08,
+0x12,0x11,0x10,0x08,0x00,0x10,0x1a,0x19,0x18,0x10,0x00,0x18,0x22,0x21,0x20,0x18,
+0x00,0x20,0x22,0x21,0x20,0x10,0x00,0x20,0x22,0x21,0x20,0x08,0x00,0x20,0x22,0x21,
+0x1c,0x08,0x00,0x20,0x22,0x21,0x14,0x08,0x00,0x20,0x22,0x20,0x18,0x08,0x00,0x20,
+0x31,0x30,0x20,0x10,0x00,0x30,0x31,0x30,0x18,0x00,0x00,0x30,0x31,0x2f,0x10,0x10,
+0x00,0x30,0x31,0x2c,0x10,0x10,0x00,0x30,0x31,0x28,0x10,0x00,0x00,0x30,0x31,0x20,
+0x10,0x00,0x00,0x30,0x31,0x10,0x10,0x00,0x00,0x30,0x04,0x04,0x04,0x05,0x04,0x04,
+0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,
+0x05,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x05,0x05,0x05,0x05,0x06,0x07,0x0a,0x0b,
+0x0d,0x10,0x04,0x05,0x05,0x06,0x06,0x09,0x0c,0x11,0x08,0x08,0x09,0x09,0x0a,0x0c,
+0x10,0x11,0x04,0x04,0x04,0x05,0x04,0x04,0x05,0x07,0x07,0x07,0x08,0x0a,0x04,0x04,
+0x04,0x04,0x06,0x0a,0x0b,0x0d,0x05,0x05,0x07,0x07,0x08,0x0b,0x0d,0x0f,0x04,0x04,
+0x04,0x05,0x07,0x07,0x09,0x09,0x0c,0x0e,0x10,0x12,0x04,0x04,0x05,0x05,0x06,0x0a,
+0x11,0x13,0x09,0x09,0x09,0x09,0x0c,0x0e,0x11,0x13,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x24,0x26,0x2a,0x18,0x1a,0x1d,0x1f,0x21,0x27,0x29,0x2a,0x00,0x00,
+0x00,0x1f,0x23,0x28,0x2a,0x2c,0x00,0x04,0x00,0x04,0x00,0x08,0x00,0x10,0x00,0x18,
+0x00,0x24,0x00,0x30,0x00,0x48,0x00,0x60,0x00,0x90,0x00,0xc0,0x00,0xd8,0x00,0x50,
+0x00,0x78,0x00,0xa0,0x00,0xc8,0x01,0x40,0x01,0x90,0x01,0xe0,0x02,0x30,0x01,0x2c,
+0x01,0x40,0x01,0xe0,0x02,0xd0,0x03,0xe8,0x04,0xb0,0x06,0x40,0x07,0xd0,0x00,0x02,
+0x00,0x02,0x00,0x04,0x00,0x08,0x00,0x0c,0x00,0x12,0x00,0x18,0x00,0x24,0x00,0x30,
+0x00,0x48,0x00,0x60,0x00,0x6c,0x00,0x28,0x00,0x3c,0x00,0x50,0x00,0x64,0x00,0xa0,
+0x00,0xc8,0x00,0xf0,0x01,0x18,0x00,0x64,0x00,0xa0,0x00,0xf0,0x01,0x68,0x01,0xf4,
+0x02,0x58,0x03,0x20,0x03,0xe8,0x02,0x02,0x02,0x02,0x02,0x02,0x03,0x03,0x04,0x04,
+0x05,0x07,0x04,0x04,0x07,0x0a,0x0a,0x0c,0x0c,0x12,0x05,0x07,0x07,0x08,0x0b,0x12,
+0x24,0x3c,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x01,0x02,
+0x03,0x04,0x05,0x06,0x07,0x08,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x20,0x1e,
+0x1c,0x18,0x10,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,0x83,0xe0,0xf5,
+0xf0,0xa3,0xe0,0x22,0x50,0x06,0x87,0xf0,0x09,0xe7,0x19,0x22,0xbb,0xfe,0x07,0xe3,
+0xf5,0xf0,0x09,0xe3,0x19,0x22,0x89,0x82,0x8a,0x83,0xe4,0x93,0xf5,0xf0,0x74,0x01,
+0x93,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,
+0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,0x86,0xf0,0x08,0xe6,0x22,
+0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,0xe2,0x22,0xe5,0x83,0x2a,
+0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,
+0x83,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x06,0xf7,0x09,0xa7,0xf0,0x19,0x22,0xbb,
+0xfe,0x06,0xf3,0xe5,0xf0,0x09,0xf3,0x19,0x22,0xf8,0xbb,0x01,0x11,0xe5,0x82,0x29,
+0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x09,
+0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,0xfe,0x09,0xe9,0x25,0x82,0xc8,
+0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,0x4a,0xfe,0xed,0x49,0xfd,0xec,
+0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xa4,
+0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,0x22,0xe0,0xfb,0xa3,0xe0,0xfa,
+0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,0xf9,0x25,0xf0,0xf0,0xe5,0x82,
+0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,0x22,0xeb,0xf0,0xa3,0xea,0xf0,
+0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,
+0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,
+0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,0x02,0x43,0xf8,0x02,0x48,0x29,
+0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,0x08,0xdf,0xf4,
+0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,0xc4,0x54,0x0f,
+0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,0xe4,0x80,0x0b,
+0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x3d,0xe4,0x7e,0x01,0x93,0x60,
+0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,0xa3,0x60,0x01,
+0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,0xfa,0xe4,0x93,
+0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xf0,0xa3,0xc8,
+0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,0x41,0x9e,0x77,
+0x00,0x41,0x9e,0xae,0x00,0x41,0x9e,0x54,0x80,0x41,0x9e,0xb0,0x00,0x00,0xf0,0x90,
+0x9e,0x5d,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x85,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,
+0x45,0x12,0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x08,0xf0,0xe4,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,0x86,
+0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,0x74,0x05,0xf0,
+0x90,0x06,0x92,0x74,0x02,0xf0,0x90,0x9e,0x63,0x14,0xf0,0xe5,0x61,0x54,0x0f,0xc3,
+0x94,0x0c,0x50,0x03,0x12,0x54,0xe3,0x22,0x8f,0x82,0x8e,0x83,0xa3,0xa3,0xa3,0xe4,
+0xf0,0x22,0xe4,0xf5,0x65,0x7f,0x60,0x7e,0x01,0x80,0xed,0x7d,0x01,0xaf,0x62,0x02,
+0x54,0xe7,0xb1,0xb0,0xbf,0x01,0x12,0x90,0x9e,0x79,0xe0,0xff,0xe4,0xfd,0xf1,0x79,
+0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xb1,0xb0,0xbf,0x01,0x0f,0x90,
+0x02,0x09,0xe0,0xff,0x7d,0x01,0xf1,0x79,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x22,
+0x22,0x22,0x00,0x02,0x45,0x03,0x02,0x45,0x06,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x8b,0x20,0x8a,0x21,0x89,0x22,0x90,0x9e,0x87,0x71,0x8b,0xab,0x23,0xaa,0x24,0xa9,
+0x25,0x90,0x9e,0x8a,0x71,0x8b,0xaf,0x26,0x15,0x26,0xef,0x60,0x1b,0x90,0x9e,0x8a,
+0xe4,0x75,0xf0,0x01,0x71,0x74,0x12,0x29,0xd9,0xff,0x90,0x9e,0x87,0xe4,0x75,0xf0,
+0x01,0x71,0x74,0xef,0x51,0x4d,0x80,0xde,0xab,0x20,0xaa,0x21,0xa9,0x22,0xd0,0xd0,
+0x92,0xaf,0x22,0x90,0x9e,0x11,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0x90,0x06,0xa9,
+0xe0,0x90,0x9e,0x10,0xf0,0xe0,0x54,0xc0,0x70,0x08,0x53,0x64,0xfe,0x53,0x64,0xfd,
+0x91,0xcb,0x90,0x9e,0x10,0xe0,0x30,0xe6,0x13,0x43,0x64,0x01,0x90,0x9e,0x66,0xe0,
+0x64,0x02,0x60,0x04,0x91,0xd2,0x80,0x07,0x91,0x79,0x80,0x03,0x53,0x64,0xfe,0x90,
+0x9e,0x10,0xe0,0x30,0xe7,0x16,0x43,0x64,0x02,0xe4,0x90,0x9e,0x85,0x91,0x4e,0x90,
+0x01,0x57,0x74,0x05,0xf0,0x90,0x9e,0x67,0x74,0x01,0xf0,0x22,0x53,0x64,0xfd,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,0x74,0xb0,0xf0,0x74,0x45,0xa3,
+0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,0xe0,0x54,0x90,0x60,0x07,0x90,
+0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,0x30,0xe1,0xe4,0x7f,0x00,0x80,
+0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,
+0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0x75,0x13,0x00,0x90,0x01,0xc4,0x74,0xe8,0xf0,0x74,0x45,
+0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,0x55,
+0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,0xe5,
+0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x09,0x90,
+0x01,0x3c,0x74,0x02,0xf0,0x12,0x61,0xc9,0xe5,0x34,0x30,0xe2,0x38,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,
+0x9e,0x5b,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x91,0x5e,
+0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x07,0x90,0x9e,
+0x64,0xe4,0xf0,0x91,0xcb,0xe5,0x34,0x30,0xe3,0x38,0x90,0x01,0x3c,0x74,0x08,0xf0,
+0x90,0x06,0x92,0xe0,0x30,0xe1,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,0x9e,0x5b,0xe0,
+0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x07,0x90,0x9e,0x63,0xe4,0xf0,
+0x91,0xcb,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,0x12,0x4b,0xfb,
+0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,0x4c,0x3d,0xe5,0x35,
+0x30,0xe0,0x44,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,0x44,0x7f,0xf0,
+0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x13,0xb4,0x01,0x02,0x80,0x1c,0xe5,0x13,0xb4,
+0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x13,0xb4,0x04,0x05,0x90,0x00,0x83,0x80,
+0x08,0xe5,0x13,0xb4,0x0c,0x06,0x90,0x00,0x83,0xe0,0xf5,0x62,0x90,0x01,0xbb,0xe5,
+0x62,0xf0,0x12,0x60,0xc0,0x91,0xcb,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,
+0x04,0xf0,0xe5,0x35,0x30,0xe4,0x06,0x90,0x01,0x3d,0x74,0x10,0xf0,0xe5,0x36,0x30,
+0xe0,0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,
+0x74,0x02,0xf0,0x74,0xe8,0x04,0x90,0x01,0xc4,0xf0,0x74,0x45,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x9e,0x98,0xef,0xf0,0xa3,0xed,
+0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,0x63,0x60,0x05,0xe4,0xff,0x12,0x54,0x97,0x90,
+0x9e,0x98,0xe0,0x30,0xe0,0x09,0x90,0x9e,0x9a,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,
+0x9e,0x98,0xe0,0xff,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,
+0x9e,0x99,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x80,0xf0,0x90,0x9e,0x9a,0xa3,0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,
+0xf7,0xf0,0x90,0x9e,0x9a,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0x75,0x28,0x33,0xe4,0xf5,
+0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,0xf0,
+0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x9e,0x16,0xf0,0xa3,0xf0,
+0x75,0x8e,0x02,0xf1,0xa1,0xf1,0xe9,0x90,0x9e,0x7e,0xef,0xf0,0xf1,0xdd,0x90,0x9e,
+0x80,0xef,0xf0,0xf1,0xf6,0x90,0x9e,0x75,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,0x57,
+0x12,0x6e,0x77,0xf1,0xd4,0x12,0x60,0x4b,0x12,0x32,0x3d,0xf1,0xc9,0x11,0x0b,0x12,
+0x50,0x0e,0xf1,0xcd,0xf1,0xb1,0x12,0x44,0xff,0xf1,0x45,0x90,0x9e,0x18,0xe5,0xd9,
+0xf0,0x11,0xd0,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,0xf0,0xb1,0x45,0x75,0xe8,
+0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x9e,0x16,0xe0,0x64,0x01,0xf0,0x24,0x29,0x90,
+0x01,0xc4,0xf0,0x74,0x48,0xa3,0xf0,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,
+0xef,0xd2,0xaf,0x12,0x58,0x74,0xe5,0x57,0x30,0xe6,0x17,0xc2,0xaf,0x53,0x57,0xbf,
+0xd2,0xaf,0x12,0x67,0xa1,0x90,0x9e,0x43,0xe0,0xff,0x60,0x03,0xb4,0x01,0x03,0x12,
+0x7b,0x5c,0x90,0x9e,0x43,0xe0,0x70,0x03,0x12,0x7c,0x5f,0x12,0x73,0x85,0x80,0xb6,
+0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,0x31,0x05,0x7d,0xff,0x7f,0x55,0x31,0x05,0x7d,
+0xff,0x7f,0x56,0x31,0x05,0x7d,0xff,0x7f,0x57,0x80,0x0a,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,
+0x00,0xed,0xf0,0xb1,0x45,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,
+0x66,0x24,0x02,0x60,0x02,0x21,0xc1,0x90,0x9e,0x3f,0x74,0x02,0xf0,0x90,0x00,0x48,
+0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,
+0x9e,0x3f,0xf0,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x31,
+0x05,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,
+0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,0x90,0x9e,0x3f,0x74,0x01,0xf0,0x90,0x9e,0x45,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,
+0x10,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x31,
+0x05,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x41,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,0x9e,0x40,0xf0,0x12,0x29,0xd9,0x25,0xe0,0x25,
+0xe0,0x90,0x9e,0x44,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,
+0xe0,0x90,0x9e,0x50,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,
+0xe0,0x90,0x9e,0x52,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,
+0x9e,0x40,0xe0,0xff,0x91,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x90,0x9e,
+0x41,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,0x40,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,
+0x44,0xe0,0x70,0x02,0x41,0xc8,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,
+0x90,0x9e,0x53,0x74,0x01,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x11,0xfc,
+0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,
+0x15,0x90,0x9e,0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,
+0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,
+0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,
+0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,
+0x20,0xe4,0xff,0x12,0x37,0x00,0x80,0x2b,0x90,0x9e,0x41,0xe0,0x70,0x2d,0x90,0x9e,
+0x53,0x11,0xfb,0x90,0x00,0x46,0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x31,0x05,0x90,0x05,
+0x22,0xe4,0xf0,0xa2,0xaf,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,
+0x12,0x36,0x92,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x14,0x8a,0x15,
+0x89,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x42,0xf0,0xe0,0x30,0xe0,0x4b,
+0x90,0x9e,0x39,0x74,0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0x3b,
+0x12,0x2a,0x7f,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0xe4,0xfc,0xfd,0xfe,0x78,0x1a,0x12,0x2a,0x6c,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0x90,0x9e,0x3b,0x12,0x43,0x53,0xec,0x54,0x03,0xfc,0x12,0x43,0x46,0x90,0x9e,
+0x45,0x12,0x2a,0x7f,0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x9e,0x39,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,
+0x9e,0x3b,0x12,0x2a,0x7f,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x42,0xe0,0x30,0xe1,0x19,0x7d,
+0x0c,0x7f,0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x44,0x10,0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,
+0x46,0xe0,0x54,0xef,0xfd,0x7f,0x46,0x31,0x05,0xe4,0x90,0x9e,0x3f,0xf0,0x22,0x90,
+0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x38,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x31,0x05,0xe4,0xfd,0x7f,0x51,0x31,0x05,0xe4,
+0xfd,0x7f,0x52,0x31,0x05,0xe4,0xfd,0x7f,0x53,0x21,0x05,0xe5,0x65,0x64,0x01,0x70,
+0x3b,0xd1,0x85,0xbf,0x01,0x04,0x7f,0x01,0xd1,0x79,0x90,0x00,0x46,0xe0,0x44,0x04,
+0xfd,0x7f,0x46,0x31,0x05,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x31,0x05,0x7f,0x02,0xd1,0xa1,0x8f,
+0x69,0x90,0x01,0xc9,0xe5,0x69,0xf0,0xb4,0x01,0x02,0xd1,0x19,0x22,0x90,0x9e,0x41,
+0xe0,0x64,0x01,0x60,0x02,0x81,0xef,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,
+0x31,0x05,0x90,0x9e,0x53,0xe0,0x70,0x31,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x9e,0x40,0xe0,0xff,0x91,0xf0,
+0x90,0x9e,0x53,0x74,0x01,0x11,0xfb,0x80,0x3f,0x90,0x9e,0x53,0xe0,0x64,0x01,0x70,
+0x37,0x90,0x9e,0x44,0xe0,0xff,0x91,0xf0,0xe4,0x90,0x9e,0x53,0xf0,0x90,0x00,0x45,
+0xe0,0x44,0x01,0xfd,0x7f,0x45,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,
+0x9e,0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,
+0x9e,0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0x22,
+0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x50,0xf0,
+0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x52,0xf0,
+0xc3,0x74,0xff,0x9f,0xfe,0x90,0x9e,0x50,0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,
+0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,
+0x9e,0x52,0x80,0x03,0x90,0x9e,0x51,0xe0,0x04,0xf0,0x22,0x90,0x9e,0x50,0xe0,0x2f,
+0xf0,0x22,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,0xfe,
+0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x2a,0xed,
+0xf0,0x90,0x9e,0x29,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,
+0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,
+0xb1,0x45,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x59,0x90,0x9e,0x29,0xe0,0x24,0xf8,0xf0,
+0xa3,0xe0,0x70,0x1d,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,
+0x1a,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0xb1,0x45,0x90,0x9e,0x29,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x43,0xb1,0x42,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x9e,0xb1,
+0xf0,0xe0,0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x31,0x05,0x90,0x9e,0xb1,0xe0,
+0x44,0xb0,0xfd,0x7f,0x49,0x21,0x05,0x90,0x9e,0x27,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0x65,0x01,0x8e,0x66,0xf5,0x67,0xe4,0xfd,0x7f,0x0b,0xb1,0x55,0xe4,0xfd,0x7f,0x02,
+0xb1,0x55,0xd1,0x85,0xe4,0xff,0xd1,0x79,0xe4,0xf5,0x69,0x90,0x01,0xc9,0xe5,0x69,
+0xf0,0x90,0x9e,0x27,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,
+0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0x90,0x01,0xca,0xe5,0x68,0xf0,0xef,
+0x60,0x02,0xd1,0x19,0x22,0x7f,0x0b,0xd1,0xa1,0xef,0x65,0x68,0x60,0x10,0xe5,0x68,
+0xb4,0x01,0x05,0xe4,0xf5,0x68,0x80,0x03,0x75,0x68,0x01,0x7f,0x01,0x22,0x7f,0x00,
+0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0xb2,0xef,0xf0,0xd3,0x94,0x07,
+0x50,0x43,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x46,0xb1,0x42,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,
+0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,
+0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,
+0xd8,0xf8,0xff,0x80,0x4b,0x90,0x9e,0xb2,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,
+0xf0,0xb1,0x45,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x42,0xe0,0xfb,0xe4,0xfe,
+0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,
+0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfd,0x7f,0x45,0x31,0x05,0x90,0x04,0xfd,0xe4,0xf0,
+0xa3,0xf0,0x90,0x9e,0x43,0xf0,0x90,0x9e,0x49,0xf0,0x90,0x9e,0x4c,0xf0,0x90,0x9e,
+0x4a,0xf0,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4b,0xf0,0x90,0x9e,0x4e,0xf0,0x90,0x9e,
+0x35,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x3a,0xf0,0x90,0x9e,
+0x3f,0xf0,0x90,0x9e,0x41,0xf0,0x90,0x9e,0x53,0xf0,0x90,0x9e,0x44,0xf0,0x90,0x9e,
+0x40,0xf0,0x90,0x9e,0x39,0xf0,0x90,0x00,0x51,0xe0,0x44,0xc0,0xfd,0x7f,0x51,0x21,
+0x05,0xe4,0x90,0x9e,0x7d,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,0x21,
+0x05,0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,
+0xa3,0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0xe4,0xf5,0x68,0x22,0x90,0x01,0x64,
+0x74,0xa0,0xf0,0x22,0x90,0x9e,0x80,0xe0,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0xf3,
+0xe0,0x7f,0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,
+0x01,0x60,0x02,0x7f,0x00,0x22,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,
+0xe0,0x30,0xe7,0x05,0x7e,0xfd,0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x90,0x00,
+0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,
+0xe4,0xf0,0x22,0x90,0x01,0x02,0xe0,0x54,0x03,0xff,0xe0,0x54,0x0c,0x13,0x13,0x54,
+0x3f,0xfe,0xef,0x64,0x01,0x60,0x04,0xef,0xb4,0x03,0x10,0x90,0x9e,0x10,0x74,0x01,
+0xf0,0xa3,0x74,0x37,0xf0,0xa3,0x74,0x01,0xf0,0x80,0x1a,0xee,0x64,0x01,0x60,0x07,
+0xaf,0x06,0xee,0x64,0x03,0x70,0x49,0x90,0x9e,0x10,0x74,0x01,0xf0,0xa3,0x74,0x3d,
+0xf0,0xa3,0x74,0x40,0xf0,0x90,0x9e,0x10,0xe0,0xfe,0xa3,0xe0,0xff,0xf5,0x82,0x8e,
+0x83,0xe0,0xfd,0x90,0x9e,0x12,0xe0,0xfc,0xed,0x5c,0x60,0x0c,0x8f,0x82,0x8e,0x83,
+0xec,0xf0,0xe4,0x90,0x9e,0x77,0xf0,0x22,0x90,0x9e,0x77,0xe0,0x04,0xf0,0xe0,0xc3,
+0x94,0x0a,0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x44,0xea,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0xa1,0xf0,0x74,0x50,0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,
+0xa3,0xe0,0x55,0x29,0xf5,0x2d,0xa3,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,
+0xf5,0x2f,0xe5,0x2c,0x20,0xe0,0x02,0x41,0x46,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,
+0xd1,0x4d,0x85,0xd2,0x4e,0x85,0xd3,0x4f,0x85,0xd4,0x50,0x85,0xd5,0x51,0x85,0xd6,
+0x52,0x85,0xd7,0x53,0x85,0xd9,0x54,0xe5,0x54,0x54,0x40,0xc3,0x13,0xff,0xe5,0x53,
+0x54,0x20,0x6f,0x70,0x02,0x21,0xf5,0xe5,0x54,0x30,0xe5,0x02,0x21,0xf5,0xe5,0x52,
+0x54,0x3f,0xf5,0x08,0xe5,0x4d,0x54,0x3f,0xf5,0x09,0xe5,0x51,0x54,0x1f,0xff,0xe5,
+0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,
+0x42,0x81,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x09,0xd3,0x94,0x04,0x40,
+0x03,0x75,0x09,0x04,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,0x75,
+0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xe0,0xfe,0xa3,0xe0,0xff,0xe5,0x53,0x54,0x1f,
+0x2f,0xff,0xe4,0x3e,0xfe,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,
+0x75,0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xee,0xf0,0xa3,0xef,0xf0,0xe5,0x54,0x20,
+0xe6,0x24,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,0x30,0xe7,0x36,0xaf,
+0x08,0x12,0x63,0x51,0x80,0x2f,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,
+0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,
+0x30,0xe7,0x12,0xe5,0x4f,0x54,0x7f,0xfd,0xe5,0x53,0x54,0x1f,0xf5,0x0d,0xab,0x09,
+0xaf,0x08,0x12,0x62,0xee,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,0x9e,
+0x66,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0x71,
+0xc3,0xef,0x64,0x01,0x70,0x30,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,
+0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x5e,0x90,0x01,0x5b,0x74,
+0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x9e,0x64,0xf0,0x80,0x08,0x71,0xc3,
+0xbf,0x01,0x03,0x12,0x44,0xcb,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,0x02,
+0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,0x5c,
+0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0xd2,0xe5,0x2c,0x30,0xe3,0x06,
+0x90,0x01,0x34,0x74,0x08,0xf0,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,
+0xf0,0x43,0x57,0x10,0xe5,0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,
+0xe0,0x54,0xdf,0xf0,0x90,0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,
+0x12,0x4b,0xcf,0x90,0x00,0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4d,0x45,0x80,0xfe,0xe5,
+0x2c,0x30,0xe6,0x06,0x90,0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x12,0x90,
+0x9e,0x7f,0x74,0x01,0xf0,0x90,0x01,0x36,0xf0,0x12,0x61,0x4e,0x90,0x9e,0x7f,0xe4,
+0xf0,0xe5,0x2e,0x30,0xe1,0x0b,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x11,
+0x23,0xe5,0x2e,0x30,0xe2,0x09,0x90,0x01,0x36,0x74,0x04,0xf0,0x12,0x60,0xdf,0xe5,
+0x2e,0x30,0xe3,0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x60,0x64,0x01,0x70,0x1c,
+0xe5,0x63,0x60,0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,
+0x9e,0x85,0xe4,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,
+0x2b,0x90,0x01,0x36,0x74,0x10,0xf0,0xe5,0x60,0xb4,0x01,0x20,0xe5,0x63,0x60,0x1c,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x67,0xe4,0xf0,
+0x53,0x64,0xfd,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,0xe5,0x2e,0x30,0xe5,
+0x1f,0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x60,0xb4,0x01,0x14,0xe5,0x63,0x60,0x10,
+0x90,0x9e,0x66,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xd2,0x80,0x03,0x12,0x44,0x79,
+0xe5,0x2e,0x30,0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x60,0xb4,0x01,0x10,
+0xe5,0x63,0x60,0x0c,0x53,0x64,0xfe,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,
+0xe5,0x2f,0x30,0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x91,0x64,0x74,0xa1,0x04,
+0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,
+0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,
+0x00,0x22,0x90,0x9e,0x10,0xe0,0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,
+0x7b,0x00,0x7a,0x00,0x79,0x58,0x90,0x9e,0x90,0x12,0x43,0x8b,0x0b,0x7a,0x9e,0x79,
+0x10,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x8d,0x12,0x43,0x8b,0x90,0x9e,
+0xb0,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x12,0x42,0x5f,0x7f,0xaf,0x7e,0x01,
+0x12,0x71,0x7a,0xef,0x60,0x49,0x90,0x9e,0x8d,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,
+0x89,0x25,0x75,0x26,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0x12,0x45,0x09,0x90,0x9e,
+0x90,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,0x89,0x25,0x90,0x9e,0x8d,0x12,0x43,0x6b,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x26,0x7b,0x01,0x7a,0x01,0x79,0xa2,0x12,
+0x45,0x09,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,
+0xd0,0x92,0xaf,0x22,0x90,0x9e,0xa0,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,
+0x14,0x24,0xfd,0x50,0x02,0x80,0x1f,0x90,0x9e,0x66,0xe0,0x60,0x06,0x7d,0x01,0x7f,
+0x0c,0x80,0x0d,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,0x06,0x7d,0x01,0x7f,0x04,
+0x91,0xe7,0xe4,0xff,0x91,0x97,0x22,0xef,0x60,0x0b,0x90,0x9e,0x80,0xe0,0xb4,0x01,
+0x10,0xe4,0xff,0x80,0x09,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x75,
+0xa5,0x22,0x90,0x01,0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x74,
+0x12,0xef,0x70,0x06,0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,
+0xe6,0xe5,0x63,0x60,0x04,0x7f,0x01,0x91,0x97,0x12,0x74,0xd2,0x53,0x61,0xf0,0x43,
+0x61,0x02,0x22,0x7d,0x01,0x7f,0x0c,0x8f,0x6a,0x8d,0x6b,0xe5,0x6a,0x54,0x0f,0xff,
+0xe5,0x61,0x54,0x0f,0x6f,0x60,0x65,0xe5,0x6a,0x30,0xe2,0x28,0xe5,0x61,0x20,0xe2,
+0x04,0x7f,0x01,0xd1,0xc2,0xe5,0x61,0x30,0xe3,0x0c,0xe5,0x6a,0x20,0xe3,0x07,0xb1,
+0x5d,0xef,0x60,0x48,0xa1,0xa5,0xe5,0x61,0x20,0xe3,0x41,0xe5,0x6a,0x30,0xe3,0x3c,
+0xaf,0x6b,0xc1,0xdc,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x0c,0x0c,0xe5,0x6a,0x20,0xe3,
+0x07,0xb1,0x5d,0xef,0x60,0x26,0xb1,0xa5,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x04,0x0c,
+0xe5,0x6a,0x20,0xe2,0x07,0xf1,0x21,0xef,0x60,0x12,0x91,0xb2,0xe5,0x61,0x54,0x0f,
+0xff,0xbf,0x02,0x08,0x12,0x60,0xbd,0xef,0x60,0x02,0xd1,0xaf,0x22,0x71,0xc3,0xef,
+0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x9e,0x64,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x9e,0x63,0xe0,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x62,0x54,0x0f,0xd3,0x94,0x04,0x40,
+0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,
+0x08,0xf0,0x7f,0x00,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x60,0xb4,0x01,
+0x04,0x7f,0x01,0xd1,0xf6,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0xef,0x64,0x01,0x70,
+0x2e,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,0x36,0x75,0x90,
+0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x91,0xe3,0xe4,0xff,0x91,0x97,
+0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,
+0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,0x7b,0xff,0x12,0x36,0xe6,0x7d,
+0x02,0x7f,0x03,0x12,0x36,0xe6,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,
+0xe0,0x44,0x07,0xf0,0x12,0x62,0x4c,0xe5,0x60,0x20,0xe0,0x05,0xe4,0x90,0x9e,0x58,
+0xf0,0x22,0x8b,0x14,0x8a,0x15,0x89,0x16,0x12,0x60,0xb1,0xab,0x14,0xaa,0x15,0xa9,
+0x16,0x12,0x29,0xd9,0xf5,0x63,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,
+0x03,0x70,0x40,0x7f,0x01,0x80,0x3a,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0xe4,0xff,0xd1,0x84,0x80,0x27,0xab,0x14,0xaa,0x15,0xa9,0x16,
+0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x01,0xd1,0x84,0x1f,0x80,0x13,0xab,0x14,
+0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0xd1,0x84,0xe4,
+0xff,0xb1,0xbc,0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x9e,0x65,0x74,
+0x01,0xf0,0x80,0x16,0xed,0x70,0x0a,0x90,0x9e,0x62,0xe0,0x90,0x9e,0x65,0xf0,0x80,
+0x05,0x90,0x9e,0x65,0xed,0xf0,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,0x22,0x53,
+0x61,0xf0,0x43,0x61,0x01,0x12,0x45,0x00,0x12,0x45,0x01,0x53,0x61,0xf0,0x43,0x61,
+0x02,0x22,0x90,0x9e,0xaf,0xef,0xf0,0x12,0x74,0x53,0x90,0x9e,0xaf,0xe0,0x60,0x05,
+0x90,0x05,0x22,0xe4,0xf0,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0x90,0x06,0x04,0xe0,
+0x54,0xbf,0xf0,0xef,0x60,0x09,0xe5,0x60,0xb4,0x01,0x04,0xe4,0xff,0xd1,0xf6,0x53,
+0x61,0xf0,0x43,0x61,0x0c,0x22,0x8f,0x27,0x12,0x45,0xb0,0xbf,0x01,0x22,0x90,0x9e,
+0x7a,0xe0,0xff,0x7d,0x01,0x12,0x47,0x79,0xab,0x07,0xaa,0x06,0xad,0x03,0xac,0x02,
+0xaf,0x27,0x12,0x60,0x2a,0xaf,0x03,0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0x71,0xc3,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x58,
+0xe5,0x64,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,0xe5,0x62,
+0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x39,0xe5,
+0x64,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x64,0x30,0xe4,
+0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x9e,0x58,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x9e,0x5e,0xe0,0x60,0x08,0x90,0x01,0xb9,
+0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,
+0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,0xff,0x90,0x00,0x56,0xe0,
+0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,0x74,0x10,0xf0,0xe5,0x3d,
+0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,0x30,0xe6,0x1b,0x90,0x00,
+0x55,0x74,0x40,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x0b,0x90,0x9e,
+0x3f,0xe0,0x60,0x05,0x7f,0x01,0x12,0x49,0x1a,0xe5,0x3d,0x30,0xe7,0x15,0x90,0x00,
+0x55,0x74,0x80,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x05,0x7f,0x02,
+0x12,0x49,0x1a,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,0x74,0x01,0xf0,0xe5,0x3e,
+0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,0x30,0xe2,0x06,0x90,0x00,
+0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,0x56,0x74,0x08,0xf0,0x90,
+0x01,0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,
+0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,
+0xf0,0xd0,0xe0,0x32,0x90,0x01,0xcc,0xe0,0x54,0x0f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfd,0x70,0x02,0x21,0xb5,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0x7e,0x00,
+0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,
+0x02,0x21,0xae,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1a,0xf0,0x75,0x23,0x01,0x75,0x24,0x9e,0x75,0x25,0x1a,0x75,0x26,
+0x01,0x7b,0x01,0x7a,0x9e,0x79,0x1b,0x12,0x45,0x09,0x90,0x9e,0x1b,0xe0,0xff,0xc4,
+0x13,0x13,0x13,0x54,0x01,0x90,0x9e,0xae,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,
+0x00,0x88,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,
+0x02,0x90,0x00,0x89,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0x90,0x9e,
+0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1f,0xf0,
+0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,
+0x20,0xf0,0x80,0x33,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,
+0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x9e,0x79,
+0x1c,0x31,0xb6,0x90,0x9e,0x19,0xe0,0xff,0x90,0x9e,0xae,0xe0,0xfe,0x74,0x01,0xa8,
+0x06,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0x5f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0xae,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,
+0xcc,0xf0,0x90,0x9e,0xae,0xe0,0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x7e,0x90,0x01,
+0xc6,0xe0,0x44,0x02,0xf0,0x22,0x90,0x9e,0x21,0x12,0x43,0x8b,0xef,0x12,0x43,0x94,
+0x59,0xfc,0x01,0x59,0xf4,0x02,0x5a,0x20,0x03,0x5a,0x29,0x05,0x5a,0x32,0x06,0x5a,
+0x7e,0x07,0x5a,0x3a,0x09,0x5a,0x43,0x0b,0x5a,0x4c,0x0c,0x5a,0x55,0x0d,0x5a,0x5e,
+0x0e,0x5a,0x67,0x1b,0x5a,0x6f,0x1c,0x5a,0x05,0x2d,0x5a,0x0e,0x2e,0x5a,0x17,0x3b,
+0x00,0x00,0x5a,0x77,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xe9,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x71,0xd0,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x0b,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x72,0x53,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x8c,
+0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0xb6,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,
+0x70,0x4a,0x90,0x9e,0x21,0x12,0x43,0x6b,0x80,0x45,0x90,0x9e,0x21,0x12,0x43,0x6b,
+0x02,0x72,0xfe,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x70,0xa2,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x49,0xc2,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x7b,0x29,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x4a,0xfc,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xef,0x90,
+0x9e,0x21,0x12,0x43,0x6b,0xe1,0xd1,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0x90,
+0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x1f,0xfe,0xef,0x54,0x20,0xc4,0x13,0x54,0x07,
+0xfd,0xaf,0x06,0x90,0x9e,0x24,0xef,0xf0,0xa3,0xed,0xf0,0xa3,0x12,0x43,0x8b,0x90,
+0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0xf0,0xc4,0x54,0x0f,
+0x90,0x9e,0x29,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0x54,0x40,0xc4,0x13,0x13,0x54,
+0x03,0x90,0x9e,0x2a,0xf0,0x90,0x9e,0x24,0xe0,0xff,0x75,0xf0,0x09,0x90,0x96,0x46,
+0x12,0x43,0x5f,0xad,0x82,0xac,0x83,0x90,0x9e,0x2b,0xec,0xf0,0xa3,0xed,0xf0,0xef,
+0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,0x35,0xf0,0xfa,0x7b,0x01,0xa3,0x12,
+0x43,0x8b,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x0f,
+0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0xef,0x12,0x42,0x4d,0x90,0x9e,0x26,0x12,0x43,
+0x6b,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0x90,0x00,
+0x01,0xef,0x12,0x42,0x5f,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,
+0x20,0xff,0x90,0x9e,0x2b,0xe0,0xfc,0xa3,0xe0,0xfd,0xf5,0x82,0x8c,0x83,0xef,0xf0,
+0x12,0x29,0xd9,0x8d,0x82,0x8c,0x83,0xa3,0xf0,0x90,0x9e,0x29,0xe0,0xfe,0x90,0x9e,
+0x24,0xe0,0xff,0x24,0x82,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0x90,0x9e,
+0x25,0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4a,0x12,0x43,0x5f,0xee,0xf0,0x75,
+0xf0,0x09,0xef,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x90,0x9e,0x2a,0xe0,
+0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4c,0x12,0x43,0x5f,0xee,0xf0,0x8f,0x14,0xef,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xaf,0x82,0xf5,0x16,0x8f,0x17,0xe5,
+0x14,0x75,0xf0,0x02,0xa4,0x24,0x02,0xf9,0x74,0x95,0x35,0xf0,0x75,0x18,0x01,0xf5,
+0x19,0x89,0x1a,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x46,0x12,0x43,0x5f,0xaf,0x82,
+0x85,0x83,0x1b,0x8f,0x1c,0xe5,0x14,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,
+0x35,0xf0,0x75,0x1d,0x01,0xf5,0x1e,0x89,0x1f,0x74,0x82,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xe0,0x12,0x43,0x94,0x5c,0x0d,0x00,0x5c,0x22,0x01,0x5c,0x37,
+0x02,0x5c,0x4c,0x03,0x5c,0x75,0x04,0x5c,0x8a,0x05,0x5c,0x9f,0x06,0x5c,0xc5,0x0c,
+0x5c,0xf2,0x0d,0x5d,0x1f,0x0e,0x5d,0x4c,0x0f,0x00,0x00,0x5d,0x80,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x15,
+0x80,0x3c,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,
+0xf0,0xf0,0xa3,0x74,0x10,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,
+0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x05,0x80,0x12,0xe5,0x14,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0xe4,0xf0,0xe5,
+0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0f,0xf0,0xa3,
+0x74,0x8f,0xf0,0xa1,0x80,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf5,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,
+0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf0,0x80,0x12,0xe5,
+0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0x74,
+0x0d,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe4,
+0xf0,0xa3,0xf0,0xa1,0x80,0x90,0x04,0x47,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,
+0x42,0x4d,0x90,0x04,0x46,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,
+0x42,0x5f,0x90,0x04,0x45,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x44,
+0xa1,0x77,0x90,0x04,0x4b,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,
+0x04,0x4a,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,
+0x04,0x49,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x48,0x80,0x58,0x90,
+0x04,0x4f,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x4e,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x4d,0xe0,
+0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x4c,0x80,0x2b,0x90,0x04,0x53,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x52,0xe0,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x51,0xe0,0x85,0x17,0x82,
+0x85,0x16,0x83,0xf0,0x90,0x04,0x50,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,0xf0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0xc0,0x03,0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,
+0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x12,0x29,0xd9,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,
+0x12,0x42,0x4d,0xab,0x18,0xe5,0x1a,0x24,0x01,0xf9,0xe4,0x35,0x19,0xfa,0xc0,0x03,
+0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x90,0x00,
+0x01,0x12,0x42,0x20,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,0x12,0x42,0x4d,0x85,0x17,
+0x82,0x85,0x16,0x83,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,
+0xe0,0xfe,0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,
+0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,0xa3,0xe0,0xfe,0xef,
+0x5e,0xd0,0x82,0xd0,0x83,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0x75,0x15,0x0b,0x74,0x01,0x7e,
+0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,
+0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x5d,0x15,0x15,0xe5,0x15,0xc3,0x94,
+0x00,0x50,0xca,0x80,0x56,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3d,0x75,0x15,0x0f,0x74,0x01,0x7e,0x00,
+0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,
+0x4e,0x60,0x08,0x90,0x9e,0x30,0xe5,0x15,0xf0,0x80,0x10,0x15,0x15,0xe5,0x15,0xc3,
+0x94,0x00,0x50,0xc8,0x80,0x05,0xe4,0x90,0x9e,0x30,0xf0,0xe5,0x14,0x25,0xe0,0x24,
+0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0xe4,
+0xf5,0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,
+0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x08,0x90,0x9e,0x31,0xe5,0x15,0xf0,0x80,
+0x5b,0x05,0x15,0xe5,0x15,0xb4,0x10,0xca,0x80,0x52,0xe5,0x14,0x25,0xe0,0x24,0x02,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x39,0xe4,0xf5,
+0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,
+0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x0a,0x05,0x15,
+0xe5,0x15,0xb4,0x0c,0xcc,0x80,0x05,0xe4,0x90,0x9e,0x31,0xf0,0x90,0x9e,0x30,0xe0,
+0xff,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,0x43,0x5f,0xef,0xf0,0x90,0x9e,
+0x31,0xe0,0xfe,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x49,0x12,0x43,0x5f,0xee,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0xd3,0x9f,0x40,0x06,
+0x90,0x9e,0x30,0x12,0x62,0x94,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,
+0x83,0xe0,0xff,0x90,0x9e,0x31,0xe0,0xfe,0xef,0xc3,0x9e,0x50,0x03,0x12,0x62,0x94,
+0x90,0x9e,0x30,0xe0,0xff,0xd3,0x94,0x13,0x40,0x07,0x90,0x96,0x43,0x74,0x03,0xf0,
+0x22,0xef,0xd3,0x94,0x0b,0x40,0x07,0x90,0x96,0x43,0x74,0x02,0xf0,0x22,0xef,0xd3,
+0x94,0x03,0x40,0x07,0x90,0x96,0x43,0x74,0x01,0xf0,0x22,0xe4,0x90,0x96,0x43,0xf0,
+0x22,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x3f,0xfe,0xef,0x54,0x80,0xc4,0x13,
+0x13,0x13,0x54,0x01,0xfd,0xaf,0x06,0x41,0x93,0x12,0x29,0xd9,0xf5,0x60,0x22,0x12,
+0x29,0xd9,0x90,0x95,0x01,0xf0,0x22,0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x22,0xe4,0xf5,0x60,0xf5,0x64,
+0xf5,0x63,0x75,0x62,0x0c,0x75,0x61,0x0c,0x90,0x9e,0x66,0xf0,0x90,0x9e,0x64,0xf0,
+0x90,0x9e,0x63,0xf0,0x90,0x9e,0x65,0x04,0xf0,0x90,0x9e,0x56,0xf0,0xe4,0x90,0x9e,
+0x67,0xf0,0x90,0x9e,0x58,0xf0,0x90,0x9e,0x61,0x74,0x07,0xf0,0xe4,0x90,0x9e,0x57,
+0xf0,0x90,0x9e,0x5f,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x9e,0x5c,0x74,0x0a,0xf0,0xa3,
+0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,0x05,0xf0,0xe4,
+0x90,0x9e,0x5a,0xf0,0x90,0x9e,0x55,0xf0,0x90,0x9e,0x7f,0xf0,0x90,0x9e,0x5e,0xf0,
+0x22,0xe4,0x90,0x9e,0x67,0xf0,0x90,0x9e,0x57,0xf0,0xf5,0x64,0x22,0x7f,0x00,0x22,
+0xe5,0x62,0x30,0xe6,0x19,0xe5,0x62,0x54,0x0f,0xff,0x90,0x9e,0x54,0xe0,0xfe,0x4f,
+0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,0x9e,0x54,0xf0,0x53,0x62,0xbf,0x22,0xe5,
+0x60,0x64,0x01,0x70,0x68,0xe5,0x63,0x60,0x64,0xe5,0x63,0x64,0x02,0x60,0x06,0xe5,
+0x63,0x64,0x05,0x70,0x27,0x90,0x06,0xab,0xe0,0x90,0x9e,0x56,0xf0,0x90,0x06,0xaa,
+0xe0,0x90,0x9e,0x65,0xf0,0x90,0x9e,0x56,0xe0,0x70,0x07,0x90,0x9e,0x65,0xe0,0xff,
+0x80,0x05,0x90,0x9e,0x56,0xe0,0xff,0x90,0x9e,0x56,0xef,0xf0,0x90,0x9e,0x58,0xe0,
+0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,0x9e,0x57,0xf0,0x90,0x05,0x58,0x74,0x03,0xf0,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x64,0xfd,0x53,0x64,
+0xef,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0x53,0x22,0xe4,0xfb,
+0x90,0x9e,0x9c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,0x60,0x6a,0xe5,0x60,
+0x64,0x01,0x70,0x64,0xe5,0x63,0x14,0x60,0x2b,0x24,0xfd,0x60,0x27,0x24,0x02,0x24,
+0xfb,0x50,0x02,0x80,0x21,0x90,0x9e,0x56,0xe0,0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,
+0x60,0x14,0x90,0x9e,0x56,0xe0,0x70,0x08,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,
+0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x2f,0x43,0x64,0x10,0xe4,0x90,0x9e,0x85,
+0xf0,0x90,0x9e,0x57,0xe0,0x75,0xf0,0x03,0xa4,0xff,0x90,0x9e,0x61,0xe0,0x2f,0x12,
+0x44,0x53,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,
+0x07,0x7d,0x01,0x7f,0x04,0x12,0x54,0xe7,0x22,0xe4,0x90,0x9e,0x15,0xf0,0xe5,0x63,
+0x60,0x79,0x90,0x9e,0x67,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x64,0xfd,0xe5,0x64,0x54,
+0x07,0x70,0x68,0x80,0x63,0x90,0x9e,0x57,0xe0,0x04,0xf0,0x53,0x64,0xef,0x90,0x9e,
+0x15,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,0x33,0xfc,0x90,0x9e,0x57,0xe0,
+0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,0x24,0x02,0xff,0xe4,0x3e,0xfe,
+0x90,0x9e,0x57,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,0x06,0x90,0x05,0x58,0xe0,0x04,
+0xf0,0xe9,0xff,0x90,0x9e,0x5c,0xe0,0x2f,0xff,0xe4,0x33,0xfe,0x90,0x9e,0x57,0xe0,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,0x0d,0xe5,0x60,0xb4,0x01,0x0b,
+0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,0xcb,0x22,0x90,0x9e,0x5f,0xe0,
+0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,
+0x93,0x12,0x43,0x8b,0x90,0x9e,0x96,0xe0,0x54,0xf0,0x44,0x06,0xff,0xf0,0xed,0x54,
+0x0f,0xc4,0x54,0xf0,0xfe,0xef,0x54,0x0f,0x4e,0xf0,0x90,0x9e,0x93,0x12,0x43,0x6b,
+0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x96,0x12,0x53,0xf1,0xd0,
+0xd0,0x92,0xaf,0x22,0xe0,0xfd,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9d,0xf5,
+0x83,0xed,0xf0,0xaf,0x14,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xef,0xc3,0x94,0x20,
+0x50,0x0e,0x74,0x84,0x2f,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xed,0xf0,0x80,0x29,
+0x74,0xa6,0x2f,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xed,0xf0,0x90,0x9e,0x68,0xef,
+0xf0,0x24,0xa6,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x90,0x9e,0x69,0xf0,0x7b,
+0x01,0x7a,0x9e,0x79,0x68,0x7d,0x02,0x51,0x57,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x0a,
+0x8d,0x0b,0xe5,0x0b,0x54,0x1f,0xf5,0x10,0x74,0x01,0x2f,0xf5,0x82,0xe4,0x34,0x94,
+0xf5,0x83,0xe0,0xf5,0x0e,0x90,0x04,0xfd,0xe0,0xb4,0x01,0x05,0x75,0x11,0x03,0x80,
+0x03,0x75,0x11,0x01,0xeb,0xc3,0x95,0x11,0x40,0x04,0xaf,0x0a,0x80,0x33,0xe5,0x0e,
+0x25,0x0d,0xf5,0x0f,0xe5,0x10,0x90,0x41,0xd6,0x93,0xff,0xe5,0x0f,0xd3,0x9f,0x74,
+0x01,0x40,0x11,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe4,0xf0,0xad,0x0b,
+0xaf,0x0a,0x41,0xa5,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe5,0x0f,0xf0,
+0x22,0xad,0x07,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x74,
+0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xe0,0x54,0x1f,0xf5,0x12,0xd3,0x9f,
+0x40,0x02,0x8f,0x12,0xe5,0x12,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x12,0x25,0xe0,0x24,0x66,0xf5,0x82,
+0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,
+0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,
+0xf0,0xa3,0xef,0xf0,0xaf,0x05,0xad,0x12,0x51,0xa5,0xaf,0x12,0x22,0xac,0x07,0xec,
+0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2c,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x80,0x0b,0x74,0xa6,0x2c,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,
+0x1f,0xe5,0x1f,0x54,0x1f,0xff,0x90,0x9e,0x25,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,
+0x49,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x27,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,0x48,
+0x12,0x43,0x5f,0xe0,0xfe,0x90,0x9e,0x28,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x29,0xcb,0xf0,0xa3,0xeb,
+0xf0,0xec,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfb,0xa3,
+0xe0,0x90,0x9e,0x2b,0xcb,0xf0,0xa3,0xeb,0xf0,0xef,0xd3,0x9e,0x40,0x0a,0x90,0x9e,
+0x28,0xe0,0x90,0x9e,0x25,0xf0,0xf5,0x1f,0xed,0x70,0x02,0xa1,0x13,0x90,0x9e,0x26,
+0xed,0xf0,0xe5,0x1f,0x30,0xe6,0x0a,0x90,0x9e,0x25,0xe0,0xf5,0x1f,0xa3,0xe0,0x14,
+0xf0,0x90,0x9e,0x26,0xe0,0x70,0x02,0xa1,0x13,0x90,0x9e,0x25,0xe0,0xff,0xd3,0x94,
+0x00,0x50,0x02,0xa1,0x13,0xe4,0x90,0x9e,0x24,0xf0,0xef,0x14,0x90,0x9e,0x23,0xf0,
+0x90,0x9e,0x27,0xe0,0xfd,0x90,0x9e,0x23,0xe0,0xff,0xd3,0x9d,0x40,0x6b,0xef,0x94,
+0x10,0x40,0x21,0xef,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x2b,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x70,0x27,0x90,0x9e,0x23,0xe0,0xff,0xc3,0x94,0x10,0x50,0x33,0x74,0x01,
+0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,
+0x9e,0x29,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x16,0x90,0x9e,0x23,0xe0,0xf5,
+0x1f,0xa3,0xe0,0x04,0xf0,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,0x24,0xe0,0x6f,0x60,
+0x08,0x90,0x9e,0x23,0xe0,0x14,0xf0,0x80,0x87,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,
+0x24,0xe0,0xc3,0x9f,0x50,0x0d,0x90,0x9e,0x23,0xe0,0xb5,0x05,0x06,0x90,0x9e,0x27,
+0xe0,0xf5,0x1f,0xe5,0x1f,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,
+0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x1f,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xec,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x04,0xad,0x1f,0x51,0xa5,0xaf,0x1f,0x22,0xad,0x07,0xed,0xc3,
+0x94,0x20,0x50,0x0d,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x80,
+0x0b,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,0x1f,
+0xe5,0x1f,0x54,0x1f,0xfc,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,
+0xff,0x90,0x9e,0x23,0xf0,0xed,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,
+0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x24,0xcb,0xf0,0xa3,0xeb,0xf0,0xed,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x26,
+0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfa,0x74,0x01,0x93,0xfb,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xea,0xf0,0xa3,0xeb,0xf0,0xec,0xc3,0x9f,0x40,0x02,0xc1,0x7a,
+0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x04,0xfb,0x90,0x9e,
+0x23,0xe0,0xff,0xeb,0xd3,0x9f,0x40,0x02,0xc1,0xab,0xeb,0xc3,0x94,0x10,0x40,0x21,
+0xeb,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x24,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x70,
+0x23,0xeb,0xc3,0x94,0x10,0x50,0x40,0x74,0x01,0x7e,0x00,0xa8,0x03,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x26,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x23,0xbb,0x11,0x09,0x90,0x9e,0x25,0xe0,0x30,0xe7,0x02,0x7b,0x17,
+0xeb,0x64,0x13,0x60,0x03,0xbb,0x12,0x09,0x90,0x9e,0x24,0xe0,0x30,0xe0,0x02,0x7b,
+0x18,0xac,0x03,0x8c,0x1f,0x80,0x34,0x0b,0x80,0x84,0x90,0x9e,0x23,0xe0,0xfb,0x6c,
+0x70,0x69,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x75,0xf0,
+0x09,0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,0xe0,0xb4,0x01,0x0c,0xe5,0x1f,0x20,0xe6,
+0x07,0xec,0x44,0x40,0xf5,0x1f,0x80,0x03,0xaf,0x1f,0x22,0xec,0x25,0xe0,0x24,0x9e,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,
+0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,
+0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x80,0x5b,0xec,0xd3,0x9b,0x40,0x56,
+0x90,0x9e,0x23,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,
+0xf0,0xac,0x07,0x8f,0x1f,0xec,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x1f,0x22,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,
+0xe4,0xf0,0xaf,0x05,0xe5,0x1f,0x44,0x80,0xfd,0x51,0xa5,0xe5,0x1f,0x44,0x80,0xff,
+0x22,0xef,0xc3,0x94,0x20,0x50,0x39,0xef,0x30,0xe0,0x17,0xed,0xc4,0x54,0xf0,0xfd,
+0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x54,0x0f,
+0x80,0x10,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x54,0xf0,0xf0,0x74,0xa4,0x2e,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x4d,0xf0,
+0x22,0xe4,0xf5,0x14,0xe5,0x14,0xb4,0x20,0x14,0x90,0x9a,0xc5,0xe0,0x04,0xf0,0x90,
+0x95,0x01,0xe0,0xff,0x90,0x9a,0xc5,0xe0,0xb5,0x07,0x02,0xe4,0xf0,0x75,0xf0,0x09,
+0xe5,0x14,0x90,0x96,0x4b,0x12,0x43,0x5f,0xe0,0x64,0x01,0x60,0x03,0x02,0x6e,0x6a,
+0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xfe,0xa3,
+0xe0,0xd3,0x94,0x00,0xee,0x94,0x00,0x50,0x03,0x02,0x6e,0x6a,0xe5,0x14,0x94,0x20,
+0x40,0x09,0x90,0x9a,0xc5,0xe0,0x60,0x03,0x02,0x6e,0x76,0xe5,0x14,0x75,0xf0,0x0a,
+0xa4,0x24,0x00,0xf9,0x74,0x90,0x35,0xf0,0x75,0x18,0x01,0xf5,0x19,0x89,0x1a,0xe5,
+0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xff,0xa3,0xe0,
+0x90,0x9e,0x1b,0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x1d,0xcf,0xf0,0xa3,0xef,
+0xf0,0xe5,0x14,0xc3,0x94,0x20,0x50,0x14,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x80,0x12,0x74,0xa6,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfe,0x54,0x1f,0xa3,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x20,0xf0,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe0,0xc3,0x94,0x05,0x40,0x02,0x41,0x9f,0x90,0x9e,0x20,0xe0,0xff,0x90,
+0x9e,0x1a,0xe0,0x9f,0x40,0x13,0x90,0x9e,0x20,0xe0,0x90,0x9e,0x1a,0xf0,0xee,0x54,
+0x40,0xfe,0x90,0x9e,0x19,0xf0,0xef,0x4e,0xf0,0x90,0x04,0xfd,0xe0,0x54,0x05,0x64,
+0x01,0x70,0x29,0x90,0x9e,0x1a,0xe0,0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x40,
+0xda,0x80,0x30,0x90,0x9e,0x1a,0xe0,0x90,0x40,0xf6,0x80,0x27,0x90,0x9e,0x1a,0xe0,
+0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,
+0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x41,0x12,0x80,0x07,0x90,0x9e,0x1a,0xe0,
+0x90,0x41,0x2e,0x93,0x90,0x9e,0x1f,0xf0,0x90,0x9e,0x1f,0xe0,0x75,0xf0,0x06,0xa4,
+0x24,0x50,0xf9,0x74,0x40,0x35,0xf0,0xfa,0x7b,0xff,0x8b,0x15,0xf5,0x16,0x89,0x17,
+0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xf5,0x1b,
+0xa3,0xe0,0xf5,0x1c,0x12,0x29,0xd9,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,
+0x12,0x42,0x97,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,
+0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x02,0x12,0x42,0xc2,0xfd,0xac,
+0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,
+0xaa,0x16,0xa9,0x17,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x04,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,
+0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,
+0x00,0x03,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,
+0x06,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,
+0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x04,0x12,0x42,0x20,
+0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x08,0x12,0x42,0xc2,0xfd,
+0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,
+0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x05,0x12,0x42,0x20,0xff,0x7e,0x00,0x90,0x9e,
+0x1b,0xe0,0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0xd3,0xe5,0x1c,0x9f,0xe5,0x1b,0x9e,
+0x40,0x0c,0xe5,0x1c,0x9f,0xf5,0x1c,0xe5,0x1b,0x9e,0xf5,0x1b,0x80,0x05,0xe4,0xf5,
+0x1b,0xf5,0x1c,0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe5,0x1b,0xf0,0xa3,0xe5,0x1c,0xf0,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,0x66,0xf5,
+0x82,0xe4,0x34,0x41,0xf5,0x83,0xc3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,0x95,0x1b,
+0x50,0x07,0xaf,0x14,0x12,0x65,0x5c,0xa1,0x31,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,
+0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xd3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,
+0x95,0x1b,0x50,0x02,0xa1,0x31,0x7d,0x01,0xaf,0x14,0x12,0x63,0xbd,0xa1,0x31,0x74,
+0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xfc,0x64,0x05,0x60,0x02,
+0x81,0x3a,0x90,0x96,0x43,0xe0,0xff,0xb4,0x03,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x19,0x40,0x3d,0x80,0x2e,0xef,0xb4,0x02,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,0x11,
+0x40,0x2e,0x80,0x1f,0x90,0x96,0x43,0xe0,0xff,0xb4,0x01,0x0b,0x90,0x9e,0x1a,0xe0,
+0xc3,0x94,0x0a,0x40,0x1b,0x80,0x0c,0xef,0x70,0x11,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x03,0x40,0x0d,0x90,0x9a,0x84,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9a,0x84,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0x74,0x44,
+0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xc3,0x94,0x30,0x50,0x02,
+0x61,0xe7,0x90,0x9a,0x84,0xe0,0x64,0x01,0x60,0x02,0x61,0xe7,0x74,0x85,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0x64,0x0a,0x60,0x51,0xef,0x24,0x05,0xff,
+0xe4,0x33,0xfe,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xfd,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x32,0xed,0x24,0x05,0xff,0xe4,
+0x33,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xd3,0x9f,
+0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x14,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9d,0xf5,0x83,0xe0,0xff,0x90,0x9e,0x1a,0xe0,0x6f,0x60,0x3d,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xd3,0x94,0x42,0x40,0x05,0x75,
+0x1e,0x05,0x80,0x0e,0xef,0xd3,0x94,0x39,0x40,0x05,0x75,0x1e,0x03,0x80,0x03,0x75,
+0x1e,0x01,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xef,0xf0,0x74,
+0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0x80,0x29,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe0,0x04,0xf0,0x80,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1a,0xe0,0xff,0x74,0x26,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x4c,0x12,
+0x43,0x5f,0xe0,0xb4,0x01,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0xad,0x1e,0xa1,0x2c,0xec,0x64,0x06,0x60,0x02,0xa1,
+0x31,0xf5,0x1b,0xf5,0x1c,0x90,0x42,0x13,0x93,0xff,0x7e,0x00,0x90,0x9e,0x1b,0xe0,
+0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0x90,0x9e,0x21,0xee,0xf0,0xa3,0xef,0xf0,0x74,
+0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0xe4,0xf5,0x1d,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x75,0xf0,0x02,0xe5,0x1d,0xa4,0xf5,0x82,0x85,0xf0,
+0x83,0x12,0x42,0xc2,0xfd,0xac,0xf0,0xe5,0x1d,0x90,0x42,0x0e,0x93,0xff,0x7e,0x00,
+0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xc3,0x90,0x9e,
+0x22,0xe0,0x95,0x1c,0x90,0x9e,0x21,0xe0,0x95,0x1b,0x40,0x07,0x05,0x1d,0xe5,0x1d,
+0xb4,0x05,0xbd,0xe5,0x1d,0xc3,0x13,0xf5,0x1d,0xe5,0x1e,0xb4,0x01,0x06,0xe5,0x1d,
+0x70,0x46,0x80,0x13,0xe5,0x1e,0xb4,0x03,0x15,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x03,
+0x80,0x39,0xe5,0x1d,0xb4,0x01,0x05,0x75,0x1e,0x01,0x80,0x2f,0x80,0x2a,0xe5,0x1e,
+0xb4,0x05,0x28,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x05,0x80,0x0d,0xe5,0x1d,0xb4,0x01,
+0x05,0x75,0x1e,0x03,0x80,0x03,0x75,0x1e,0x01,0xd3,0x90,0x9e,0x1e,0xe0,0x94,0x03,
+0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0xd3,0x90,0x9e,0x1e,0xe0,
+0x94,0x03,0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0x74,0x84,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0xfd,0xaf,0x14,0x12,0x67,
+0x61,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xd3,0x94,0x05,
+0x74,0xe6,0x50,0x0e,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x04,0xf0,
+0x80,0x0b,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1d,
+0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,
+0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,0x10,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0x74,0xff,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,
+0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,
+0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,
+0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,
+0x10,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xff,0xf0,0xa3,
+0xf0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0xe4,0xf5,0xf0,0x12,0x42,0xfa,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x02,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x04,0xe4,
+0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x06,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,
+0x08,0xe4,0xf5,0xf0,0x12,0x43,0x19,0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0x05,0x14,0xe5,0x14,0xc3,0x94,
+0x40,0x50,0x03,0x02,0x67,0xa4,0x22,0x90,0x04,0x44,0x74,0x11,0xf0,0xa3,0x74,0xf0,
+0xf0,0xa3,0x74,0x0f,0xf0,0xa3,0xe4,0xf0,0xfd,0x74,0xa4,0x2d,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe4,0xf0,0x0d,0xbd,0x10,0xf0,0xe4,0x90,0x9a,0xc5,0xf0,0x90,0x95,
+0x01,0x04,0xf0,0xe4,0xfd,0x75,0xf0,0x0a,0xed,0x90,0x90,0x00,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x02,0x12,0x43,0x5f,0xe4,0xf0,0xa3,
+0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x04,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,
+0xf0,0x0a,0xed,0x90,0x90,0x06,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,
+0xed,0x90,0x90,0x08,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x74,0x26,0x2d,0xf5,0x82,
+0xe4,0x34,0x9d,0xf5,0x83,0x74,0x13,0xf0,0x74,0x85,0x2d,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe4,0xf0,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,
+0xed,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0x74,0x86,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x46,0x2d,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0xe6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe4,0xf0,0x90,0x41,0xc4,0x93,0xfe,0x74,0x01,0x93,0xff,0x90,0x41,0x8c,
+0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,
+0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x75,0xf0,0x09,0xed,
+0x90,0x96,0x4a,0x12,0x43,0x5f,0x74,0x01,0xf0,0x74,0x82,0x2d,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0x74,0x0c,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x46,0x12,0x43,0x5f,
+0x74,0xff,0xf0,0xa3,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x44,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0x74,0x0f,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0x74,
+0x13,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x49,0x12,0x43,0x5f,0xe4,0xf0,0xed,0xc3,
+0x94,0x20,0x50,0x0f,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0x74,0x13,
+0xf0,0x80,0x0d,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0x74,0x13,0xf0,
+0x0d,0xed,0x64,0x40,0x60,0x03,0x02,0x6e,0xa5,0x22,0x12,0x29,0xd9,0xf5,0x14,0xc3,
+0x94,0x40,0x50,0x15,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x74,0x44,0x25,0x14,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xef,0xf0,0x22,0xe5,0x14,0xb4,0x40,0x0a,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x96,0x42,0xf0,0x22,0x90,0x9e,0x30,0x12,0x43,0x8b,0x90,
+0x9e,0x33,0xe0,0x54,0xf0,0x44,0x02,0xf0,0x54,0x0f,0x44,0xc0,0xf0,0x90,0x9e,0x30,
+0x12,0x43,0x6b,0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x33,0x02,
+0x53,0xf1,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x90,0x00,0x01,0x12,0x42,0x20,0xfc,
+0xed,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfd,0xec,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfc,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,
+0xfb,0xea,0x90,0x9e,0x24,0xf0,0xeb,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x26,0xf0,0xeb,
+0xa3,0xf0,0xa3,0xed,0xf0,0xa3,0x74,0xff,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2a,0xf0,0xeb,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,
+0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2c,0xf0,0xeb,0xa3,0xf0,0xa3,0xec,0xf0,0xa3,0x74,
+0xff,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0x7b,0x01,0x7a,0x9e,0x79,0x24,0x01,0x79,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0xa4,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,
+0xa4,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x9e,0xa7,
+0xe0,0x94,0xe8,0x90,0x9e,0xa6,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,0x44,
+0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x9e,0xa6,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,
+0x7f,0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x9e,0x66,0xf0,0x90,0x00,0x03,0x12,0x42,
+0x20,0x90,0x9e,0x55,0xf0,0x12,0x56,0x22,0x90,0x01,0xe5,0xe5,0x63,0xf0,0x90,0x9e,
+0x66,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0xff,0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x9e,0x5c,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x90,0x9e,0x5d,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x5b,0xf0,0x90,
+0x00,0x03,0x12,0x42,0x20,0x90,0x9e,0x62,0xf0,0x22,0x90,0x9e,0x5c,0x74,0x0a,0xf0,
+0x90,0x9e,0x5d,0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,
+0x05,0xf0,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x61,
+0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0xef,0xf0,
+0x80,0x0f,0x90,0x9e,0x61,0x74,0x07,0xf0,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0x74,0x03,
+0xf0,0x90,0x9e,0x5f,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x9e,0x24,0x12,
+0x2a,0x8b,0x00,0x00,0x00,0x00,0x12,0x29,0xd9,0x60,0x0d,0x90,0x9e,0x5e,0xf0,0xe4,
+0xfd,0x7f,0x04,0x12,0x54,0xe7,0x80,0x05,0xe4,0x90,0x9e,0x5e,0xf0,0x90,0x9e,0x5e,
+0xe0,0x90,0x01,0xe7,0xf0,0x22,0x90,0x02,0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,
+0x05,0xed,0x2e,0x90,0x9e,0x78,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,
+0x90,0x9e,0x79,0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7a,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7b,0xf0,0x90,0x00,
+0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,0x2f,0x90,0x9e,0x7c,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x43,0x8b,0x90,0x9e,0x24,0x12,0x43,
+0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x43,0x19,0x12,
+0x29,0xd9,0xff,0x60,0x2d,0xb5,0x65,0x16,0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,
+0x01,0x12,0x42,0xc2,0x65,0x67,0x70,0x04,0xe5,0x66,0x65,0xf0,0x60,0x24,0x90,0x9e,
+0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xff,0xae,0xf0,0x12,0x4e,0x37,
+0x80,0x10,0x90,0x9e,0x24,0x12,0x43,0x6b,0x12,0x29,0xd9,0x65,0x65,0x60,0x03,0x12,
+0x44,0xc2,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x24,0x14,0x70,0x1a,0x7b,0x01,
+0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x71,0xb0,0xbf,0x01,0x09,0x90,0x06,0x35,
+0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0x80,0xcd,0xe4,0x90,0x06,0x34,0xf0,0x22,
+0x8e,0x14,0x8f,0x15,0x8b,0x16,0x8a,0x17,0x89,0x18,0xe4,0x90,0x9e,0x19,0xf0,0xef,
+0x90,0x00,0x31,0xf0,0x12,0x4d,0x45,0xe5,0x14,0x54,0x03,0xff,0x90,0x00,0x32,0xe0,
+0x54,0xfc,0x4f,0xf0,0x12,0x4d,0x45,0x90,0x00,0x33,0xe0,0x54,0x7f,0xf0,0x12,0x4d,
+0x45,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,
+0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,0x10,0x90,
+0x00,0x30,0xe0,0xab,0x16,0xaa,0x17,0xa9,0x18,0x12,0x42,0x4d,0x7f,0x01,0x22,0x7f,
+0x00,0x22,0xe4,0x90,0x9e,0xac,0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,
+0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,
+0x9e,0xad,0xe0,0x94,0xe8,0x90,0x9e,0xac,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,
+0x7f,0x32,0x7e,0x00,0x12,0x37,0x54,0x90,0x9e,0xac,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x80,0xc6,0x90,0x00,0x11,0xe0,0x44,0x09,0xf0,0x12,0x4d,0x45,0x90,0x9d,0xff,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x9e,0x03,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,
+0x12,0x2f,0xd9,0x90,0x9e,0x07,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x0b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,
+0x03,0x2d,0x95,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x11,
+0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x34,
+0x81,0x22,0x7f,0x78,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xff,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,0x03,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,
+0x12,0x27,0xde,0x90,0x9e,0x07,0x12,0x2a,0x7f,0x90,0x9e,0x80,0xe0,0x90,0x9d,0xff,
+0xb4,0x01,0x0d,0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,
+0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,
+0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x03,0x12,0x43,0x53,0xef,0x54,0x0f,0xff,0xec,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9e,0x07,
+0x12,0x43,0x53,0xef,0x44,0x02,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,
+0x7e,0x08,0x12,0x2f,0xd9,0x7f,0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9e,0x0b,0x12,
+0x2a,0x7f,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,
+0x12,0x34,0x81,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,
+0x00,0x00,0x00,0x00,0xe4,0xfd,0x7f,0x01,0x12,0x34,0x81,0x90,0x00,0x11,0xe0,0x54,
+0xf6,0xf0,0x02,0x4d,0x45,0xef,0x70,0x02,0xe1,0x5c,0x90,0x9e,0x0f,0xe0,0x60,0x03,
+0x02,0x7b,0x28,0x90,0x9d,0xfb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xa7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xab,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xaf,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x9d,0xb3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x9d,0xb7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x74,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xbb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xbf,0x12,0x43,0x53,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xc3,0x12,0x43,
+0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,
+0xc7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x9d,0xcb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xcf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd3,0x12,0x43,0x53,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd7,0x12,0x43,0x53,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xdb,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x9d,0xdf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x9d,0xe3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xe7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xeb,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9d,0xef,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x90,
+0x9d,0xf3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x2f,0xd9,0x90,0x9d,0xf7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x0f,0x74,0x01,0xf0,0x22,0x90,0x9e,0x0f,0xe0,
+0x64,0x01,0x60,0x03,0x02,0x7b,0x28,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,
+0xfb,0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xa7,0x12,0x2a,
+0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xab,0x12,0x2a,0x7f,0x7f,0x6c,
+0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xaf,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x9d,0xb3,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x9d,0xb7,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbb,0x12,
+0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbf,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xc3,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x9d,0xc7,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x9d,0xcb,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xcf,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xd3,0x12,0x2a,0x7f,
+0x7f,0xd4,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xd7,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x9d,0xdb,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x9d,0xdf,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,
+0xe3,0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xe7,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9d,0xeb,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0d,0x12,0x27,0xde,0x90,0x9d,0xef,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x27,0xde,0x90,0x9d,0xf3,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x9d,0xf7,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,
+0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x44,0xc0,0xfd,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,
+0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,0x9e,
+0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x9e,
+0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,
+0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,
+0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,
+0xd9,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,
+0xa8,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,
+0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,
+0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,
+0x12,0x2f,0xd9,0xe4,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,
+0x9e,0x43,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x14,
+0xc2,0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x49,0x05,0x7d,0x40,
+0x7f,0x01,0x12,0x36,0xaf,0xe5,0x14,0x24,0xff,0x92,0xaf,0x22,0x90,0x9e,0x3a,0xe0,
+0xc3,0x94,0x14,0x50,0x05,0xe0,0x04,0xf0,0x81,0x14,0x90,0x9e,0x3a,0xe0,0x64,0x14,
+0x60,0x02,0x81,0x14,0x90,0x9e,0x49,0xe0,0x70,0x25,0x90,0x9e,0x4c,0xe0,0x70,0x1f,
+0x90,0x9e,0x4a,0xe0,0x70,0x19,0x90,0x9e,0x4d,0xe0,0x70,0x13,0x90,0x9e,0x4b,0xe0,
+0x70,0x0d,0x90,0x9e,0x4e,0xe0,0x70,0x07,0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,
+0x9e,0x49,0xe0,0x90,0x04,0x44,0xf0,0x90,0x9e,0x4a,0xe0,0x90,0x04,0x45,0xf0,0x90,
+0x9e,0x4b,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x4c,0xe0,0x90,0x04,
+0x48,0xf0,0x90,0x9e,0x4d,0xe0,0x90,0x04,0x49,0xf0,0x90,0x9e,0x4e,0xe0,0x90,0x04,
+0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x35,0xe0,0x90,0x04,0x4c,0xf0,0x90,0x9e,0x36,
+0xe0,0x90,0x04,0x4d,0xf0,0x90,0x9e,0x37,0xe0,0x90,0x04,0x4e,0xf0,0x90,0x9e,0x38,
+0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x9e,0x3a,0xf0,0x90,0x9e,0x35,0x04,0xf0,0xe4,
+0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x49,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x19,0xf0,0x90,0x05,0x61,0xe0,
+0x90,0x9e,0x1a,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x1b,0xf0,0x90,0x05,0x63,0xe0,
+0x90,0x9e,0x1c,0xf0,0x90,0x9e,0x52,0xe0,0xff,0x90,0x9e,0x1c,0xe0,0xfe,0xd3,0x9f,
+0x50,0x0b,0x90,0x9e,0x52,0xe0,0xc3,0x9e,0xd3,0x94,0x01,0x40,0x11,0x90,0x9e,0x40,
+0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x9e,0x44,0xe0,0xff,0x12,0x4c,0xf0,0x22,0x90,
+0x9e,0x53,0xe0,0x64,0x01,0x60,0x08,0x90,0x9e,0x41,0xe0,0x60,0x02,0xa1,0x36,0x90,
+0x9e,0x35,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x9e,0x36,
+0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x28,0x90,0x9e,0x37,0xe0,
+0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x36,0xf0,0x80,0x15,0x90,
+0x9e,0x38,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x37,0xf0,
+0x90,0x9e,0x36,0xf0,0x90,0x9e,0x35,0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,
+0xe0,0x30,0xe2,0x32,0x90,0x9e,0x49,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,
+0x80,0x24,0x90,0x9e,0x4a,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,
+0x11,0x90,0x9e,0x4b,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,
+0x4a,0xf0,0x90,0x9e,0x49,0xf0,0x90,0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x9e,0x4c,
+0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x9e,0x4d,0xe0,0xc3,
+0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,0x4e,0xe0,0xc3,0x94,
+0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4c,0xf0,0x90,
+0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,0x00,0x37,0xda,};
+
+// =================== v79 UMC A Cut COMMON 2011-10-06 =====================
+u8 Rtl8192CUFwUMCACutImgArray[UMCACutImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x4f,0x00,0x00,0x00,0x0a,0x06,0x18,0x09,0x58,0x3f,0x01,0x00,
+0x61,0x80,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5a,0x45,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5f,0xfb,0x00,0x00,0x00,0x00,0x00,0xa1,0xdf,0x00,0x00,0x00,
+0x05,0x04,0x03,0x02,0x00,0x03,0x06,0x05,0x04,0x03,0x00,0x04,0x06,0x05,0x04,0x02,
+0x00,0x04,0x08,0x07,0x06,0x04,0x00,0x06,0x0a,0x09,0x08,0x06,0x00,0x08,0x0a,0x09,
+0x08,0x04,0x00,0x08,0x0a,0x09,0x08,0x02,0x00,0x08,0x0a,0x09,0x08,0x00,0x00,0x08,
+0x12,0x11,0x10,0x08,0x00,0x10,0x1a,0x19,0x18,0x10,0x00,0x18,0x22,0x21,0x20,0x18,
+0x00,0x20,0x22,0x21,0x20,0x10,0x00,0x20,0x22,0x21,0x20,0x08,0x00,0x20,0x22,0x21,
+0x1c,0x08,0x00,0x20,0x22,0x21,0x14,0x08,0x00,0x20,0x22,0x20,0x18,0x08,0x00,0x20,
+0x31,0x30,0x20,0x10,0x00,0x30,0x31,0x30,0x18,0x00,0x00,0x30,0x31,0x2f,0x10,0x10,
+0x00,0x30,0x31,0x2c,0x10,0x10,0x00,0x30,0x31,0x28,0x10,0x00,0x00,0x30,0x31,0x20,
+0x10,0x00,0x00,0x30,0x31,0x10,0x10,0x00,0x00,0x30,0x04,0x04,0x04,0x05,0x04,0x04,
+0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,
+0x05,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x05,0x05,0x05,0x05,0x06,0x07,0x0a,0x0b,
+0x0d,0x10,0x04,0x05,0x05,0x06,0x06,0x09,0x0c,0x11,0x08,0x08,0x09,0x09,0x0a,0x0c,
+0x10,0x11,0x04,0x04,0x04,0x05,0x04,0x04,0x05,0x07,0x07,0x07,0x08,0x0a,0x04,0x04,
+0x04,0x04,0x06,0x0a,0x0b,0x0d,0x05,0x05,0x07,0x07,0x08,0x0b,0x0d,0x0f,0x04,0x04,
+0x04,0x05,0x07,0x07,0x09,0x09,0x0c,0x0e,0x10,0x12,0x04,0x04,0x05,0x05,0x06,0x0a,
+0x11,0x13,0x09,0x09,0x09,0x09,0x0c,0x0e,0x11,0x13,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x24,0x26,0x2a,0x18,0x1a,0x1d,0x1f,0x21,0x27,0x29,0x2a,0x00,0x00,
+0x00,0x1f,0x23,0x28,0x2a,0x2c,0x00,0x04,0x00,0x04,0x00,0x08,0x00,0x10,0x00,0x18,
+0x00,0x24,0x00,0x30,0x00,0x48,0x00,0x60,0x00,0x90,0x00,0xc0,0x00,0xd8,0x00,0x50,
+0x00,0x78,0x00,0xa0,0x00,0xc8,0x01,0x40,0x01,0x90,0x01,0xe0,0x02,0x30,0x01,0x2c,
+0x01,0x40,0x01,0xe0,0x02,0xd0,0x03,0xe8,0x04,0xb0,0x06,0x40,0x07,0xd0,0x00,0x02,
+0x00,0x02,0x00,0x04,0x00,0x08,0x00,0x0c,0x00,0x12,0x00,0x18,0x00,0x24,0x00,0x30,
+0x00,0x48,0x00,0x60,0x00,0x6c,0x00,0x28,0x00,0x3c,0x00,0x50,0x00,0x64,0x00,0xa0,
+0x00,0xc8,0x00,0xf0,0x01,0x18,0x00,0x64,0x00,0xa0,0x00,0xf0,0x01,0x68,0x01,0xf4,
+0x02,0x58,0x03,0x20,0x03,0xe8,0x02,0x02,0x02,0x02,0x02,0x02,0x03,0x03,0x04,0x04,
+0x05,0x07,0x04,0x04,0x07,0x0a,0x0a,0x0c,0x0c,0x12,0x05,0x07,0x07,0x08,0x0b,0x12,
+0x24,0x3c,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x01,0x02,
+0x03,0x04,0x05,0x06,0x07,0x08,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x20,0x1e,
+0x1c,0x18,0x10,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,0x83,0xe0,0xf5,
+0xf0,0xa3,0xe0,0x22,0x50,0x06,0x87,0xf0,0x09,0xe7,0x19,0x22,0xbb,0xfe,0x07,0xe3,
+0xf5,0xf0,0x09,0xe3,0x19,0x22,0x89,0x82,0x8a,0x83,0xe4,0x93,0xf5,0xf0,0x74,0x01,
+0x93,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,
+0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,0x86,0xf0,0x08,0xe6,0x22,
+0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,0xe2,0x22,0xe5,0x83,0x2a,
+0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,
+0x83,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x06,0xf7,0x09,0xa7,0xf0,0x19,0x22,0xbb,
+0xfe,0x06,0xf3,0xe5,0xf0,0x09,0xf3,0x19,0x22,0xf8,0xbb,0x01,0x11,0xe5,0x82,0x29,
+0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x09,
+0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,0xfe,0x09,0xe9,0x25,0x82,0xc8,
+0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,0x4a,0xfe,0xed,0x49,0xfd,0xec,
+0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xa4,
+0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,0x22,0xe0,0xfb,0xa3,0xe0,0xfa,
+0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,0xf9,0x25,0xf0,0xf0,0xe5,0x82,
+0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,0x22,0xeb,0xf0,0xa3,0xea,0xf0,
+0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,
+0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,
+0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,0x02,0x43,0xf8,0x02,0x50,0xa9,
+0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,0x08,0xdf,0xf4,
+0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,0xc4,0x54,0x0f,
+0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,0xe4,0x80,0x0b,
+0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x3d,0xe4,0x7e,0x01,0x93,0x60,
+0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,0xa3,0x60,0x01,
+0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,0xfa,0xe4,0x93,
+0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xf0,0xa3,0xc8,
+0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,0x41,0x9e,0x66,
+0x00,0x41,0x9e,0xae,0x00,0x41,0x9e,0x4d,0x80,0x41,0x9e,0x4e,0x80,0x41,0x9e,0xb0,
+0x00,0x00,0xf0,0x90,0x9e,0x57,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,
+0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x88,0xeb,0xf0,0xa3,0xe0,
+0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,0x30,0x62,0xd0,0xd0,0x92,0xaf,0x22,
+0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x08,0xf0,0xe4,0x90,0x9e,0x89,0xf0,
+0x90,0x9e,0x55,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,
+0x62,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x90,0x9e,0x5c,
+0x14,0xf0,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xc3,0x94,0x0c,0x50,0x02,0xf1,0x16,0x22,
+0x8f,0x82,0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x22,0x7f,0x60,0x7e,
+0x01,0x80,0xed,0x90,0x9e,0x60,0xe0,0xff,0x7d,0x01,0xe1,0x1a,0xb1,0xb1,0xbf,0x01,
+0x0f,0x90,0x9e,0x68,0xe0,0xff,0xe4,0xfd,0xf1,0xfe,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0x90,0x01,0xca,0xe5,0x25,0xf0,0xef,0x60,0x03,0x12,0x4f,0x2a,0x22,0x22,0x22,
+0x22,0x22,0x00,0x02,0x60,0x8d,0x02,0x60,0x94,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x8b,0x1b,0x8a,0x1c,0x89,0x1d,0x90,0x9e,0x8b,0x71,0x8b,0xab,0x1e,0xaa,0x1f,0xa9,
+0x20,0x90,0x9e,0x8e,0x71,0x8b,0xaf,0x21,0x15,0x21,0xef,0x60,0x1b,0x90,0x9e,0x8e,
+0xe4,0x75,0xf0,0x01,0x71,0x74,0x12,0x24,0x62,0xff,0x90,0x9e,0x8b,0xe4,0x75,0xf0,
+0x01,0x71,0x74,0xef,0x51,0x4d,0x80,0xde,0xab,0x1b,0xaa,0x1c,0xa9,0x1d,0xd0,0xd0,
+0x92,0xaf,0x22,0x90,0x06,0xa9,0xe0,0xf5,0x50,0x54,0xc0,0x70,0x0d,0x90,0x9e,0x63,
+0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0x91,0xd3,0xe5,0x50,0x30,0xe6,0x17,0x90,
+0x9e,0x63,0xe0,0x44,0x01,0xf0,0x90,0x9e,0x61,0xe0,0x64,0x02,0x60,0x04,0x91,0xdc,
+0x80,0x0b,0x91,0x80,0x80,0x07,0x90,0x9e,0x63,0xe0,0x54,0xfe,0xf0,0xe5,0x50,0x90,
+0x9e,0x63,0x30,0xe7,0x17,0xe0,0x44,0x02,0xf0,0xe4,0x90,0x9e,0x89,0x91,0x52,0x90,
+0x01,0x57,0x74,0x05,0xf0,0x90,0x9e,0x62,0x74,0x01,0xf0,0x22,0xe0,0x54,0xfd,0xf0,
+0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,
+0x22,0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,
+0xe0,0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xc0,
+0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,
+0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,
+0xdf,0xf0,0x74,0x45,0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,
+0x34,0xa3,0xe0,0x55,0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,
+0x33,0xf5,0x37,0xe5,0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,
+0x30,0xe1,0x08,0x90,0x01,0x3c,0x74,0x02,0xf0,0xf1,0xbc,0xe5,0x34,0x30,0xe2,0x38,
+0x90,0x01,0x3c,0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x24,0x90,0x9e,0x89,
+0xe4,0xf0,0x90,0x9e,0x55,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,
+0x01,0x91,0x62,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,
+0x07,0x90,0x9e,0x5d,0xe4,0xf0,0x91,0xd3,0xe5,0x34,0x30,0xe3,0x38,0x90,0x01,0x3c,
+0x74,0x08,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe1,0x24,0x90,0x9e,0x89,0xe4,0xf0,0x90,
+0x9e,0x55,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x62,
+0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x07,0x90,0x9e,
+0x5c,0xe4,0xf0,0x91,0xd3,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,
+0x12,0x4d,0xe2,0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,0x4e,
+0x25,0xe5,0x35,0x30,0xe0,0x1a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,
+0x44,0x7f,0xf0,0x90,0x00,0x83,0xe0,0x90,0x9e,0x60,0xf0,0x12,0x64,0xa1,0x91,0xd3,
+0x74,0xdf,0x04,0x90,0x01,0xc4,0xf0,0x74,0x45,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,
+0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,
+0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x7d,0x01,0x7f,0x0c,0x8f,0x71,0x8d,0x72,0xe5,0x71,
+0x54,0x0f,0xff,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0x6f,0x60,0x72,0xe5,0x71,0x30,0xe2,
+0x2b,0x90,0x9e,0x5e,0xe0,0x20,0xe2,0x05,0x7f,0x01,0x12,0x63,0x92,0x90,0x9e,0x5e,
+0xe0,0x30,0xe3,0x07,0xe5,0x71,0x20,0xe3,0x02,0x80,0x54,0x90,0x9e,0x5e,0xe0,0x20,
+0xe3,0x4c,0xe5,0x71,0x30,0xe3,0x47,0xaf,0x72,0x02,0x63,0x2e,0x90,0x9e,0x5e,0xe0,
+0x54,0x0f,0xff,0xbf,0x0c,0x0d,0xe5,0x71,0x20,0xe3,0x08,0x12,0x5e,0xf1,0xef,0x60,
+0x2d,0xf1,0x9f,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xff,0xbf,0x04,0x0e,0xe5,0x71,0x20,
+0xe2,0x09,0x12,0x62,0x50,0xef,0x60,0x16,0x12,0x48,0xaa,0x90,0x9e,0x5e,0xe0,0x54,
+0x0f,0xff,0xbf,0x02,0x09,0x12,0x62,0xbb,0xef,0x60,0x03,0x12,0x64,0x87,0x22,0x90,
+0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x73,0xb4,0x01,0x05,0x7f,0x01,0x12,0x63,0x4d,
+0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x04,0xf0,0x22,0x90,0x9e,0x62,0xe0,
+0x60,0x0e,0xe4,0xf0,0xa3,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0x07,0x70,0x2b,0x80,0x27,
+0x90,0x9e,0x51,0xe0,0x04,0xf0,0x90,0x9e,0x63,0xe0,0x54,0xef,0xf0,0x90,0x9e,0x56,
+0xe0,0xff,0x90,0x9e,0x51,0xe0,0xd3,0x9f,0x40,0x0d,0xe5,0x73,0xb4,0x01,0x0a,0xa3,
+0xe0,0x70,0x06,0xe0,0x04,0xf0,0x22,0x91,0xd3,0x22,0xe0,0xff,0x7d,0x01,0x90,0x9e,
+0x9c,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,0x74,0x60,0x04,0xe4,
+0xff,0x11,0x8f,0x90,0x9e,0x9c,0xe0,0x30,0xe0,0x09,0x90,0x9e,0x9e,0xe4,0xf0,0xa3,
+0x74,0x80,0xf0,0x90,0x9e,0x9c,0xe0,0xff,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x90,0x04,
+0x25,0xef,0xf0,0x90,0x9e,0x9d,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,0xff,0x24,0x0f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,0x2f,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x9e,0x9e,0xa3,0xe0,0xff,0xfd,0x24,
+0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,0x2d,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x9e,0x9e,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xef,
+0x60,0x0b,0x90,0x9e,0x77,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,0x09,0x90,0x9e,0x77,
+0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x77,0x66,0x22,0x90,0x01,0x37,0x74,0x02,0xf0,
+0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x77,0x1c,0xef,0x70,0x06,0x90,0x01,0xc8,0x74,
+0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x31,0x9d,0xe5,0x74,0x60,0x04,0x7f,0x01,0x11,
+0x8f,0x11,0xdf,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x02,0xf0,0x22,0x7f,
+0x78,0x7e,0x08,0x12,0x22,0x65,0x90,0x9d,0xff,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,
+0x12,0x22,0x65,0x90,0x9e,0x03,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x22,0x65,
+0x90,0x9e,0x07,0x12,0x25,0x08,0x90,0x9e,0x77,0xe0,0x90,0x9d,0xff,0xb4,0x01,0x0d,
+0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x53,
+0xef,0x54,0xc7,0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,
+0x2b,0x08,0x90,0x9e,0x03,0x12,0x43,0x53,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x9e,0x07,0x12,0x43,0x53,
+0xef,0x44,0x02,0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,
+0x2b,0x08,0x7f,0x70,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9e,0x0b,0x12,0x25,0x08,0x90,
+0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x30,0x2c,
+0x90,0x9e,0x77,0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x00,0x00,
+0x00,0xe4,0xfd,0x7f,0x01,0x12,0x30,0x2c,0x90,0x00,0x11,0xe0,0x54,0xf6,0xf0,0x80,
+0x08,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x7f,0x10,0xdf,0xfe,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x9e,0xad,0xed,0xf0,0x90,0x9e,0xac,0xef,0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,
+0x47,0xe0,0x5f,0xf0,0x31,0xb9,0x90,0x9e,0xac,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,
+0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x46,0xe0,0x4f,0xf0,0x31,0xb9,0x90,
+0x9e,0xad,0xe0,0x60,0x16,0x90,0x9e,0xac,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x45,0x80,0x66,0x90,0x9e,0xac,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,
+0x80,0x6b,0x90,0x9e,0xac,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,
+0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0x31,0xb1,0x90,0x9e,0xac,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,
+0x4f,0xf0,0x31,0xb9,0x90,0x9e,0xad,0xe0,0x60,0x1b,0x90,0x9e,0xac,0xe0,0xff,0x74,
+0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,
+0x42,0xe0,0x4f,0x80,0x1a,0x90,0x9e,0xac,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,
+0x31,0xb9,0xd0,0xd0,0x92,0xaf,0x22,0xf0,0x90,0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,
+0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,0x00,0xed,0xf0,0x31,
+0xb9,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,0x66,0x24,0x02,0x60,
+0x02,0x61,0x7d,0x90,0x9e,0x1a,0x74,0x02,0xf0,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,
+0x7f,0x48,0x51,0xc1,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,0x47,0x51,0xc1,0x90,
+0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,0x9e,0x1a,0xf0,0x90,
+0x9e,0x16,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,
+0x2b,0x08,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x51,0xc1,0x90,0x00,0x45,
+0xe0,0x54,0xef,0xfd,0x7f,0x45,0x51,0xc1,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,
+0x46,0x80,0x38,0x90,0x9e,0x1a,0x74,0x01,0xf0,0x90,0x9e,0x20,0x12,0x43,0x53,0x90,
+0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x90,0x00,0x45,0xe0,
+0x44,0x20,0xfd,0x7f,0x45,0x51,0xc1,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,
+0x51,0xc1,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x51,0xc1,0x22,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x9e,0x1c,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,
+0x25,0xe0,0x90,0x9e,0x1b,0xf0,0x12,0x24,0x62,0x25,0xe0,0x25,0xe0,0x90,0x9e,0x1f,
+0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x2a,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x2b,
+0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x2c,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x2d,
+0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x3f,0xf0,0xc2,0xaf,0x90,0x9e,0x1b,0xe0,0xff,
+0xd1,0xd8,0x90,0x9e,0x3f,0xe0,0x24,0xff,0x92,0xaf,0x90,0x9e,0x1c,0xe0,0x70,0x02,
+0x81,0x84,0x90,0x9e,0x1b,0xe0,0x70,0x02,0x81,0x84,0x90,0x9e,0x1f,0xe0,0x70,0x02,
+0x81,0x84,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x3f,0xf0,0xc2,0xaf,0x90,0x9e,0x2e,0x74,
+0x01,0xf0,0x90,0x9e,0x3f,0xe0,0x24,0xff,0x92,0xaf,0x51,0xb8,0x90,0x00,0x46,0xe0,
+0x44,0x01,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x9e,0x14,0xe0,0x60,0x15,0x90,0x9e,0x20,
+0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,
+0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,
+0x45,0x51,0xc1,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,0x2a,0xe0,0x90,0x05,
+0x84,0xf0,0x90,0x9e,0x2b,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,0x2c,0xe0,0x90,0x05,
+0x86,0xf0,0x90,0x9e,0x2d,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,
+0x3f,0xf0,0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,
+0x31,0xb7,0x80,0x2b,0x90,0x9e,0x1c,0xe0,0x70,0x2d,0x90,0x9e,0x2e,0x51,0xb7,0x90,
+0x00,0x46,0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x05,0x22,0xe4,0xf0,0xa2,
+0xaf,0x33,0x90,0x9e,0x3f,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x31,0x49,0x90,
+0x9e,0x3f,0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x59,0x8a,0x5a,0x89,0x5b,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x9e,0x1d,0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x9e,0x14,0x74,
+0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x22,0x65,0x90,0x9e,0x16,0x12,0x25,0x08,0xab,
+0x59,0xaa,0x5a,0xa9,0x5b,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,
+0x78,0x1a,0x12,0x24,0xf5,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x9e,0x16,
+0x12,0x43,0x53,0xec,0x54,0x03,0xfc,0x12,0x43,0x46,0x90,0x9e,0x20,0x12,0x25,0x08,
+0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x9e,0x14,0xf0,0x7f,0x80,0x7e,0x08,
+0x12,0x22,0x65,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,0x9e,0x16,0x12,0x25,
+0x08,0x90,0x9e,0x16,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,
+0x08,0x12,0x2b,0x08,0x90,0x9e,0x1d,0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0x51,
+0xc1,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x51,0xc1,0x90,0x00,0x46,0xe0,
+0x44,0x10,0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,0x47,0x51,0xc1,0x90,
+0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x51,0xc1,0x90,0x00,0x46,0xe0,0x54,0xef,
+0xfd,0x7f,0x46,0x51,0xc1,0xe4,0x90,0x9e,0x1a,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,
+0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,
+0x7f,0x54,0x51,0xc1,0x7d,0xff,0x7f,0x55,0x51,0xc1,0x7d,0xff,0x7f,0x56,0x51,0xc1,
+0x7d,0xff,0x7f,0x57,0x41,0xc1,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0x90,0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x51,0xc1,
+0xe4,0xfd,0x7f,0x51,0x51,0xc1,0xe4,0xfd,0x7f,0x52,0x51,0xc1,0xe4,0xfd,0x7f,0x53,
+0x41,0xc1,0xe5,0x22,0x64,0x01,0x70,0x3c,0xf1,0xbe,0xbf,0x01,0x05,0x7f,0x01,0x12,
+0x44,0xf1,0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x00,0x44,
+0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x51,0xc1,0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,
+0x46,0x51,0xc1,0x7f,0x02,0xf1,0xea,0x8f,0x26,0x90,0x01,0xc9,0xe5,0x26,0xf0,0xb4,
+0x01,0x02,0xf1,0x2a,0x22,0x90,0x9e,0x1c,0xe0,0x64,0x01,0x60,0x02,0xc1,0xd7,0x90,
+0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x9e,0x2e,0xe0,0x70,0x31,
+0x90,0x9e,0x14,0xe0,0x60,0x15,0x90,0x9e,0x20,0x12,0x43,0x53,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,
+0xf0,0x90,0x9e,0x1b,0xe0,0xff,0xd1,0xd8,0x90,0x9e,0x2e,0x74,0x01,0x51,0xb7,0x80,
+0x3f,0x90,0x9e,0x2e,0xe0,0x64,0x01,0x70,0x37,0x90,0x9e,0x1f,0xe0,0xff,0xd1,0xd8,
+0xe4,0x90,0x9e,0x2e,0xf0,0x90,0x00,0x45,0xe0,0x44,0x01,0xfd,0x7f,0x45,0x51,0xc1,
+0x90,0x9e,0x14,0xe0,0x60,0x15,0x90,0x9e,0x16,0x12,0x43,0x53,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,
+0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,0x2a,0xe0,0x90,0x05,0x84,0xf0,0x90,
+0x9e,0x2b,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,0x2c,0xe0,0x90,0x05,0x86,0xf0,0x90,
+0x9e,0x2d,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,0x05,0x60,0xe0,0x90,0x9e,0x2a,0xf0,
+0x90,0x05,0x61,0xe0,0x90,0x9e,0x2b,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x2c,0xf0,
+0x90,0x05,0x63,0xe0,0x90,0x9e,0x2d,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x9e,0x2b,
+0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,
+0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x9e,0x2d,0x80,0x03,0x90,0x9e,0x2c,0xe0,
+0x04,0xf0,0x22,0x90,0x9e,0x2b,0xe0,0x2f,0xf0,0x22,0x90,0x00,0x49,0xe0,0x90,0x9e,
+0xb1,0xf0,0xe0,0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x51,0xc1,0x90,0x9e,0xb1,
+0xe0,0x44,0xb0,0xfd,0x7f,0x49,0x41,0xc1,0x8e,0x59,0x8f,0x5a,0x8b,0x5b,0x8a,0x5c,
+0x89,0x5d,0xe4,0x90,0x9e,0x34,0xf0,0xef,0x90,0x00,0x31,0xf0,0x31,0xb9,0xe5,0x59,
+0x54,0x03,0xff,0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x31,0xb9,0x90,0x00,0x33,
+0xe0,0x54,0x7f,0xf0,0x31,0xb9,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x9e,0x34,
+0xe0,0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x9e,0x34,0xe0,0xc3,
+0x94,0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x12,0x42,
+0x4d,0x7f,0x01,0x22,0x7f,0x00,0x22,0x12,0x45,0xb1,0xbf,0x01,0x10,0x90,0x02,0x09,
+0xe0,0xff,0x7d,0x01,0x12,0x47,0xfe,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x7f,0x0b,
+0xf1,0xea,0xef,0x65,0x25,0x60,0x10,0xe5,0x25,0xb4,0x01,0x05,0xe4,0xf5,0x25,0x80,
+0x03,0x75,0x25,0x01,0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x9e,0x74,0xf0,0x90,
+0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,0x41,0xc1,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0xb2,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,
+0x12,0x49,0xb9,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,
+0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,
+0x80,0x44,0x90,0x9e,0xb2,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,
+0x80,0x02,0xc3,0x33,0xd8,0xfc,0x12,0x49,0xb1,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,
+0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,
+0x00,0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,
+0x13,0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0x75,0x28,0x33,0xe4,0xf5,
+0x29,0x75,0x2a,0x03,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,0xf0,
+0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x9e,0x31,0xf0,0xa3,0xf0,
+0x75,0x8e,0x02,0x12,0x4f,0xda,0x12,0x5f,0xa9,0x12,0x5f,0xbc,0xe4,0xf5,0x12,0x12,
+0x6f,0xa1,0x12,0x77,0x5d,0x12,0x60,0x9b,0x12,0x2e,0x01,0x12,0x77,0x18,0x11,0x8b,
+0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,0x90,0x05,0x5a,
+0xf0,0xa3,0xe4,0xf0,0x12,0x5f,0xf4,0x12,0x5f,0x91,0x12,0x44,0xfe,0x12,0x7d,0x1d,
+0x90,0x9e,0x33,0xe5,0xd9,0xf0,0x12,0x4d,0x8b,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,
+0x40,0xf0,0x12,0x49,0xb9,0x75,0xe8,0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x01,0xbe,
+0xe0,0x04,0xf0,0x90,0x01,0xc0,0xe0,0x04,0xf0,0x90,0x9e,0x31,0xe0,0x64,0x01,0xf0,
+0x24,0xa9,0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x12,0x30,0xe4,0x09,0xc2,
+0xaf,0x53,0x12,0xef,0xd2,0xaf,0x31,0x8e,0xe5,0x12,0x30,0xe6,0x17,0xc2,0xaf,0x53,
+0x12,0xbf,0xd2,0xaf,0x12,0x69,0x51,0x90,0x9e,0x1e,0xe0,0xff,0x60,0x03,0xb4,0x01,
+0x03,0x12,0x7d,0x7b,0x90,0x9e,0x1e,0xe0,0x70,0x03,0x12,0x7e,0x7e,0x31,0x61,0x80,
+0xb8,0x90,0x06,0x34,0xe0,0x60,0x26,0x14,0x70,0x1b,0x7b,0x01,0x7a,0x06,0x79,0x35,
+0x7f,0xf9,0x7e,0x01,0x12,0x4f,0x48,0xbf,0x01,0x09,0x90,0x06,0x35,0xe0,0x54,0x0f,
+0xf0,0x80,0x05,0x80,0x00,0x02,0x77,0x0a,0xe4,0x90,0x06,0x34,0xf0,0x22,0x90,0x01,
+0xcc,0xe0,0x54,0x0f,0x90,0x9e,0x34,0xf0,0x90,0x9e,0x34,0xe0,0xfd,0x70,0x02,0x41,
+0xcf,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,
+0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0x41,0xc8,0x90,0x9e,0xae,
+0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x35,0xf0,0x75,
+0x1e,0x01,0x75,0x1f,0x9e,0x75,0x20,0x35,0x75,0x21,0x01,0x7b,0x01,0x7a,0x9e,0x79,
+0x36,0x12,0x45,0x09,0x90,0x9e,0x36,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x90,
+0x9e,0xae,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,0x5f,0xe0,
+0x90,0x9e,0x37,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,0x12,0x43,
+0x5f,0xe0,0x90,0x9e,0x38,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,
+0x12,0x43,0x5f,0xe0,0x90,0x9e,0x39,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,
+0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x3a,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x3b,0xf0,0x80,0x33,0xe0,0x75,
+0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x37,0xf0,0x90,0x9e,0xae,
+0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x38,0xf0,0x90,
+0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x39,
+0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x9e,0x79,0x37,0x51,0xd0,0x90,0x9e,0x34,
+0xe0,0xff,0x90,0x9e,0xae,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0x5f,0x90,0x9e,0x34,0xf0,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,0x9e,0xae,0xe0,
+0x04,0xf0,0xe0,0x54,0x03,0xf0,0x21,0x98,0x90,0x01,0xc6,0xe0,0x44,0x02,0xf0,0x22,
+0x90,0x9e,0x3c,0x12,0x43,0x8b,0xef,0x12,0x43,0x94,0x53,0x0b,0x01,0x53,0x14,0x02,
+0x53,0x2f,0x03,0x53,0x38,0x05,0x53,0x41,0x06,0x53,0x8f,0x07,0x53,0x49,0x09,0x53,
+0x52,0x0c,0x53,0x5b,0x0d,0x53,0x64,0x0e,0x53,0x6d,0x1b,0x53,0x76,0x1c,0x53,0x7f,
+0x2c,0x53,0x1d,0x2d,0x53,0x26,0x2e,0x00,0x00,0x53,0x88,0x90,0x9e,0x3c,0x12,0x43,
+0x6b,0x02,0x61,0x9d,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x71,0xc4,0x90,0x9e,0x3c,
+0x12,0x43,0x6b,0x02,0x71,0xca,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x72,0x12,0x90,
+0x9e,0x3c,0x12,0x43,0x6b,0x02,0x72,0x40,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x71,
+0x74,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x80,0x47,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,
+0x72,0x88,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x4b,0x7e,0x90,0x9e,0x3c,0x12,0x43,
+0x6b,0x02,0x7c,0xea,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x4c,0xb8,0x90,0x9e,0x3c,
+0x12,0x43,0x6b,0x02,0x71,0xbc,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x71,0xa3,0x90,
+0x9e,0x3c,0x12,0x43,0x6b,0x02,0x75,0xea,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,
+0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x1f,0xfe,0xef,0x54,0x20,0xc4,0x13,0x54,
+0x07,0xfd,0xaf,0x06,0x90,0x9e,0x3f,0xef,0xf0,0xa3,0xed,0xf0,0xa3,0x12,0x43,0x8b,
+0x90,0x9e,0x41,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0xf0,0xc4,0x54,
+0x0f,0x90,0x9e,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0x54,0x40,0xc4,0x13,0x13,
+0x54,0x03,0x90,0x9e,0x45,0xf0,0x90,0x9e,0x3f,0xe0,0xff,0x75,0xf0,0x09,0x90,0x96,
+0x46,0x12,0x43,0x5f,0xad,0x82,0xac,0x83,0x90,0x9e,0x46,0xec,0xf0,0xa3,0xed,0xf0,
+0xef,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,0x35,0xf0,0xfa,0x7b,0x01,0xa3,
+0x12,0x43,0x8b,0x90,0x9e,0x41,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,
+0x0f,0xff,0x90,0x9e,0x48,0x12,0x43,0x6b,0xef,0x12,0x42,0x4d,0x90,0x9e,0x41,0x12,
+0x43,0x6b,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x90,0x9e,0x48,0x12,0x43,0x6b,0x90,
+0x00,0x01,0xef,0x12,0x42,0x5f,0x90,0x9e,0x41,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,
+0x42,0x20,0xff,0x90,0x9e,0x46,0xe0,0xfc,0xa3,0xe0,0xfd,0xf5,0x82,0x8c,0x83,0xef,
+0xf0,0x12,0x24,0x62,0x8d,0x82,0x8c,0x83,0xa3,0xf0,0x90,0x9e,0x44,0xe0,0xfe,0x90,
+0x9e,0x3f,0xe0,0xff,0x24,0x82,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0x90,
+0x9e,0x40,0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4a,0x12,0x43,0x5f,0xee,0xf0,
+0x75,0xf0,0x09,0xef,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x90,0x9e,0x45,
+0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4c,0x12,0x43,0x5f,0xee,0xf0,0x8f,0x59,
+0xef,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xaf,0x82,0xf5,0x5b,0x8f,0x5c,
+0xe5,0x59,0x75,0xf0,0x02,0xa4,0x24,0x02,0xf9,0x74,0x95,0x35,0xf0,0x75,0x5d,0x01,
+0xf5,0x5e,0x89,0x5f,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x46,0x12,0x43,0x5f,0xaf,
+0x82,0x85,0x83,0x60,0x8f,0x61,0xe5,0x59,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,
+0x96,0x35,0xf0,0x75,0x62,0x01,0xf5,0x63,0x89,0x64,0x74,0x82,0x25,0x59,0xf5,0x82,
+0xe4,0x34,0x95,0xf5,0x83,0xe0,0x12,0x43,0x94,0x55,0x1e,0x00,0x55,0x33,0x01,0x55,
+0x48,0x02,0x55,0x5d,0x03,0x55,0x86,0x04,0x55,0x9b,0x05,0x55,0xb0,0x06,0x55,0xd6,
+0x0c,0x56,0x03,0x0d,0x56,0x30,0x0e,0x56,0x5d,0x0f,0x00,0x00,0x56,0x91,0xe5,0x59,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,
+0x15,0x80,0x3c,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,
+0x74,0xf0,0xf0,0xa3,0x74,0x10,0x80,0x27,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x05,0x80,0x12,0xe5,0x59,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0xe4,0xf0,
+0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0f,0xf0,
+0xa3,0x74,0x8f,0xf0,0xc1,0x91,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,
+0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf5,0x80,0x27,0xe5,0x59,0x25,0xe0,0x24,
+0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf0,0x80,0x12,
+0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,
+0x74,0x0d,0xf0,0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe4,0xf0,0xa3,0xf0,0xc1,0x91,0x90,0x04,0x47,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,
+0x12,0x42,0x4d,0x90,0x04,0x46,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,
+0x12,0x42,0x5f,0x90,0x04,0x45,0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,
+0x44,0xc1,0x88,0x90,0x04,0x4b,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x12,0x42,0x4d,
+0x90,0x04,0x4a,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,0x12,0x42,0x5f,
+0x90,0x04,0x49,0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,0x48,0x80,0x58,
+0x90,0x04,0x4f,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x12,0x42,0x4d,0x90,0x04,0x4e,
+0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x4d,
+0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,0x4c,0x80,0x2b,0x90,0x04,0x53,
+0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x12,0x42,0x4d,0x90,0x04,0x52,0xe0,0xab,0x5d,
+0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x51,0xe0,0x85,0x5c,
+0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,0x50,0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xa3,
+0xf0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0xc0,0x03,0xc0,0x02,0xc0,0x01,0x12,0x24,0x62,
+0xff,0xab,0x62,0xaa,0x63,0xa9,0x64,0x12,0x24,0x62,0x5f,0xd0,0x01,0xd0,0x02,0xd0,
+0x03,0x12,0x42,0x4d,0xab,0x5d,0xe5,0x5f,0x24,0x01,0xf9,0xe4,0x35,0x5e,0xfa,0xc0,
+0x03,0xc0,0x02,0xc0,0x01,0x12,0x24,0x62,0xff,0xab,0x62,0xaa,0x63,0xa9,0x64,0x90,
+0x00,0x01,0x12,0x42,0x20,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,0x12,0x42,0x4d,0x85,
+0x5c,0x82,0x85,0x5b,0x83,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x61,0x82,0x85,0x60,
+0x83,0xe0,0xfe,0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0x85,0x5c,0x82,0x85,0x5b,0x83,
+0xa3,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x61,0x82,0x85,0x60,0x83,0xa3,0xe0,0xfe,
+0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0x75,0x5a,0x0b,0x74,0x01,
+0x7e,0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,
+0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,
+0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x5a,0x24,0x10,0x80,0x5d,0x15,0x5a,0xe5,0x5a,0xc3,
+0x94,0x00,0x50,0xca,0x80,0x56,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,
+0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3d,0x75,0x5a,0x0f,0x74,0x01,0x7e,
+0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x59,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x08,0x90,0x9e,0x4b,0xe5,0x5a,0xf0,0x80,0x10,0x15,0x5a,0xe5,0x5a,
+0xc3,0x94,0x00,0x50,0xc8,0x80,0x05,0xe4,0x90,0x9e,0x4b,0xf0,0xe5,0x59,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,
+0xe4,0xf5,0x5a,0x74,0x01,0x7e,0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,
+0xce,0xd8,0xf9,0xff,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,
+0x83,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x08,0x90,0x9e,0x4c,0xe5,0x5a,0xf0,
+0x80,0x5b,0x05,0x5a,0xe5,0x5a,0xb4,0x10,0xca,0x80,0x52,0xe5,0x59,0x25,0xe0,0x24,
+0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x39,0xe4,
+0xf5,0x5a,0x74,0x01,0x7e,0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x5a,0x24,0x10,0x80,0x0a,0x05,
+0x5a,0xe5,0x5a,0xb4,0x0c,0xcc,0x80,0x05,0xe4,0x90,0x9e,0x4c,0xf0,0x90,0x9e,0x4b,
+0xe0,0xff,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x48,0x12,0x43,0x5f,0xef,0xf0,0x90,
+0x9e,0x4c,0xe0,0xfe,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x49,0x12,0x43,0x5f,0xee,
+0xf0,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0xd3,0x9f,0x40,
+0x05,0x90,0x9e,0x4b,0x11,0xe0,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x04,0xf5,
+0x83,0xe0,0xff,0x90,0x9e,0x4c,0xe0,0xfe,0xef,0xc3,0x9e,0x50,0x02,0x11,0xe0,0x90,
+0x9e,0x4b,0xe0,0xff,0xd3,0x94,0x13,0x40,0x07,0x90,0x96,0x43,0x74,0x03,0xf0,0x22,
+0xef,0xd3,0x94,0x0b,0x40,0x07,0x90,0x96,0x43,0x74,0x02,0xf0,0x22,0xef,0xd3,0x94,
+0x03,0x40,0x07,0x90,0x96,0x43,0x74,0x01,0xf0,0x22,0xe4,0x90,0x96,0x43,0xf0,0x22,
+0xe0,0xfd,0x74,0x26,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xed,0xf0,0xaf,
+0x59,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xef,0xc3,0x94,0x20,0x50,0x0e,0x74,0x84,
+0x2f,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xed,0xf0,0x80,0x29,0x74,0xa6,0x2f,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xed,0xf0,0x90,0x9e,0x78,0xef,0xf0,0x24,0xa6,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x90,0x9e,0x79,0xf0,0x7b,0x01,0x7a,0x9e,0x79,
+0x78,0x7d,0x02,0x31,0x3a,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0x97,0x12,0x43,0x8b,0x90,0x9e,0x9a,0xe0,0x54,0xf0,0x44,0x06,0xff,
+0xf0,0xed,0x54,0x0f,0xc4,0x54,0xf0,0xfe,0xef,0x54,0x0f,0x4e,0xf0,0x90,0x9e,0x97,
+0x12,0x43,0x6b,0x90,0x9e,0x94,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x9a,0xd1,
+0x14,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x50,0x8d,0x51,0xe5,0x51,0x54,0x1f,0xf5,0x56,
+0x74,0x01,0x2f,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xf5,0x54,0x90,0x04,0xfd,
+0xe0,0xb4,0x01,0x05,0x75,0x57,0x03,0x80,0x03,0x75,0x57,0x01,0xeb,0xc3,0x95,0x57,
+0x40,0x04,0xaf,0x50,0x80,0x33,0xe5,0x54,0x25,0x53,0xf5,0x55,0xe5,0x56,0x90,0x41,
+0xd6,0x93,0xff,0xe5,0x55,0xd3,0x9f,0x74,0x01,0x40,0x11,0x25,0x50,0xf5,0x82,0xe4,
+0x34,0x94,0xf5,0x83,0xe4,0xf0,0xad,0x51,0xaf,0x50,0x01,0xf1,0x25,0x50,0xf5,0x82,
+0xe4,0x34,0x94,0xf5,0x83,0xe5,0x55,0xf0,0x22,0xad,0x07,0x75,0xf0,0x09,0xed,0x90,
+0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,
+0x83,0xe0,0x54,0x1f,0xf5,0x58,0xd3,0x9f,0x40,0x02,0x8f,0x58,0xe5,0x58,0x25,0xe0,
+0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,
+0xe5,0x58,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,
+0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0xaf,0x05,0xad,0x58,
+0x11,0xf1,0xaf,0x58,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,
+0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,
+0xc0,0x07,0x90,0x01,0xc4,0x74,0x45,0xf0,0x74,0x5a,0xa3,0xf0,0x90,0x01,0x34,0xe0,
+0x55,0x28,0xf5,0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,
+0xf5,0x2f,0xe5,0x2c,0x20,0xe0,0x02,0x61,0xe1,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,
+0xd1,0x08,0x85,0xd2,0x09,0x85,0xd3,0x0a,0x85,0xd4,0x0b,0x85,0xd5,0x0c,0x85,0xd6,
+0x0d,0x85,0xd7,0x0e,0x85,0xd9,0x0f,0xe5,0x0f,0x54,0x40,0xc3,0x13,0xff,0xe5,0x0e,
+0x54,0x20,0x6f,0x70,0x02,0x61,0x93,0xe5,0x0f,0x30,0xe5,0x02,0x61,0x93,0xe5,0x0d,
+0x54,0x3f,0xf5,0x4d,0xe5,0x08,0x54,0x3f,0xf5,0x4e,0xe5,0x0c,0x54,0x1f,0xff,0xe5,
+0x4d,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,
+0x42,0x81,0xe5,0x0e,0x54,0x1f,0xff,0xe5,0x4d,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4e,0xd3,0x94,0x04,0x40,
+0x03,0x75,0x4e,0x04,0x75,0xf0,0x0a,0xe5,0x4d,0x90,0x90,0x00,0x12,0x43,0x5f,0x75,
+0xf0,0x02,0xe5,0x4e,0x12,0x43,0x5f,0xe0,0xfe,0xa3,0xe0,0xff,0xe5,0x0e,0x54,0x1f,
+0x2f,0xff,0xe4,0x3e,0xfe,0x75,0xf0,0x0a,0xe5,0x4d,0x90,0x90,0x00,0x12,0x43,0x5f,
+0x75,0xf0,0x02,0xe5,0x4e,0x12,0x43,0x5f,0xee,0xf0,0xa3,0xef,0xf0,0xe5,0x0f,0x20,
+0xe6,0x23,0xe5,0x0e,0x54,0x1f,0xff,0xe5,0x4d,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x0a,0x30,0xe7,0x34,0xaf,
+0x4d,0x31,0xd9,0x80,0x2e,0xe5,0x0e,0x54,0x1f,0xff,0xe5,0x4d,0x25,0xe0,0x24,0x44,
+0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x0a,0x30,
+0xe7,0x11,0xe5,0x0a,0x54,0x7f,0xfd,0xe5,0x0e,0x54,0x1f,0xf5,0x53,0xab,0x4e,0xaf,
+0x4d,0x31,0x76,0xe5,0x74,0x14,0x24,0xfd,0x50,0x02,0x80,0x45,0x90,0x9e,0x61,0xe0,
+0x60,0x37,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0xd1,0x05,0xef,
+0x64,0x01,0x70,0x2d,0x90,0x9e,0x55,0xe0,0xf5,0x44,0x75,0x45,0x00,0xe4,0xfb,0xfd,
+0x7f,0x58,0x7e,0x01,0x12,0x30,0x62,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,
+0x74,0x01,0xf0,0x90,0x9e,0x5d,0xf0,0x80,0x08,0xd1,0x05,0xbf,0x01,0x03,0x12,0x44,
+0xd3,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,0x02,0xf0,0x85,0xd1,0x13,0x85,
+0xd2,0x14,0x85,0xd3,0x15,0x85,0xd4,0x16,0x85,0xd5,0x17,0x85,0xd6,0x18,0x85,0xd7,
+0x19,0x85,0xd9,0x1a,0xd1,0x9c,0xe5,0x2c,0x30,0xe3,0x06,0x90,0x01,0x34,0x74,0x08,
+0xf0,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,0xf0,0x43,0x12,0x10,0xe5,
+0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,0xe0,0x54,0xdf,0xf0,0x90,
+0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,0x12,0x4d,0xb6,0x90,0x00,
+0x03,0xe0,0x54,0xfb,0xf0,0x12,0x49,0xb9,0x80,0xfe,0xe5,0x2c,0x30,0xe6,0x06,0x90,
+0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe1,0x3c,0x90,0x01,0x36,0x74,0x02,0xf0,
+0x43,0x12,0x40,0x90,0x01,0x02,0xe0,0x54,0x03,0x64,0x01,0x70,0x29,0x90,0x01,0x37,
+0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,0x9e,0x66,0xe4,0xf0,0x80,0x18,0x90,0x9e,
+0x66,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,
+0x30,0xe0,0x03,0x12,0x4f,0xa7,0xe5,0x2e,0x30,0xe0,0x12,0x90,0x9e,0x76,0x74,0x01,
+0xf0,0x90,0x01,0x36,0xf0,0x12,0x64,0xfe,0x90,0x9e,0x76,0xe4,0xf0,0xe5,0x2e,0x30,
+0xe2,0x78,0x90,0x01,0x36,0x74,0x04,0xf0,0x90,0x01,0xbd,0xe0,0x04,0xf0,0xe5,0x73,
+0x64,0x01,0x70,0x66,0xe5,0x74,0x60,0x62,0xe5,0x74,0x64,0x02,0x60,0x06,0xe5,0x74,
+0x64,0x05,0x70,0x27,0x90,0x06,0xab,0xe0,0x90,0x9e,0x50,0xf0,0x90,0x06,0xaa,0xe0,
+0x90,0x9e,0x5f,0xf0,0x90,0x9e,0x50,0xe0,0x70,0x07,0x90,0x9e,0x5f,0xe0,0xff,0x80,
+0x05,0x90,0x9e,0x50,0xe0,0xff,0x90,0x9e,0x50,0xef,0xf0,0x90,0x9e,0x52,0xe0,0x60,
+0x03,0xe0,0x14,0xf0,0x90,0x9e,0x51,0xe4,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,
+0x74,0x02,0xf0,0x90,0x9e,0x63,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xef,0xf0,0xe5,0x74,
+0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0x53,0xe5,0x2e,0x30,0xe3,0x28,0x90,
+0x01,0x36,0x74,0x08,0xf0,0xe5,0x73,0x64,0x01,0x70,0x1c,0xe5,0x74,0x60,0x18,0x90,
+0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x89,0xe4,0x12,0x44,
+0x52,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,0x2f,0x90,0x01,0x36,0x74,
+0x10,0xf0,0xe5,0x73,0x64,0x01,0x70,0x23,0xe5,0x74,0x60,0x1f,0x90,0x01,0x57,0xe4,
+0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x62,0xe4,0xf0,0x90,0x9e,0x63,0xe0,
+0x54,0xfd,0xf0,0xe0,0x54,0x07,0x70,0x03,0x12,0x44,0xd3,0xe5,0x2e,0x30,0xe5,0x1f,
+0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x73,0xb4,0x01,0x14,0xe5,0x74,0x60,0x10,0x90,
+0x9e,0x61,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xdc,0x80,0x03,0x12,0x44,0x80,0xe5,
+0x2e,0x30,0xe6,0x1e,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x73,0xb4,0x01,0x13,0xe5,
+0x74,0x60,0x0f,0x90,0x9e,0x63,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x07,0x70,0x03,0x12,
+0x44,0xd3,0xe5,0x2f,0x30,0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0xd1,0xbd,0x74,
+0x45,0x04,0x90,0x01,0xc4,0xf0,0x74,0x5a,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,
+0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,
+0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,
+0x02,0x7f,0x00,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x91,0x12,0x43,
+0x8b,0x90,0x9e,0x75,0xe0,0x64,0x02,0x60,0x6e,0x90,0x9e,0x75,0xe0,0x64,0x01,0x70,
+0x66,0x90,0x9e,0xb0,0xe0,0xff,0x04,0xf0,0x90,0x9e,0x91,0x12,0x43,0x6b,0x90,0x00,
+0x01,0xef,0x12,0x42,0x5f,0x7f,0xaf,0x7e,0x01,0xf1,0x3b,0xef,0x60,0x49,0x90,0x9e,
+0x91,0x12,0x43,0x6b,0x8b,0x1e,0x8a,0x1f,0x89,0x20,0x75,0x21,0x02,0x7b,0x01,0x7a,
+0x01,0x79,0xa0,0x12,0x45,0x09,0x90,0x9e,0x94,0x12,0x43,0x6b,0x8b,0x1e,0x8a,0x1f,
+0x89,0x20,0x90,0x9e,0x91,0x12,0x43,0x6b,0x12,0x24,0x62,0xff,0xc4,0x54,0x0f,0xf5,
+0x21,0x7b,0x01,0x7a,0x01,0x79,0xa2,0x12,0x45,0x09,0x90,0x01,0xaf,0x74,0xff,0xf0,
+0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x9e,0x2f,0xe0,
+0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x13,
+0x90,0x9e,0x94,0x12,0x43,0x8b,0x0b,0x7a,0x9e,0x79,0x2f,0xc1,0x14,0x7d,0x02,0x7f,
+0x03,0x12,0x31,0x2c,0xe5,0x74,0x14,0x24,0xfd,0x50,0x02,0x80,0x23,0x90,0x9e,0x61,
+0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0f,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xc3,
+0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x1a,0xe4,0xff,0x12,0x48,0x8f,
+0x22,0xd1,0x05,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x32,
+0x90,0x9e,0x5d,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x24,0x90,0x9e,
+0x5c,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x16,0x90,0x9e,0x60,0xe0,
+0x54,0x0f,0xd3,0x94,0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,
+0x01,0x22,0x90,0x01,0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0xd3,0x10,0xaf,0x01,0xc3,
+0xc0,0xd0,0x90,0x9e,0xa0,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,
+0x9e,0xa0,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x9e,
+0xa3,0xe0,0x94,0xe8,0x90,0x9e,0xa2,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,
+0x44,0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x9e,0xa2,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x7f,0x0a,0x7e,0x00,0x12,0x32,0x15,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,
+0x22,0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,
+0xa3,0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x90,
+0x9e,0x75,0x60,0x04,0x74,0x01,0xf0,0x22,0x74,0x02,0xf0,0x22,0x90,0x00,0xf3,0xe0,
+0x30,0xe3,0x08,0x90,0x9e,0x77,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9e,0x77,0xf0,
+0x90,0x9e,0x77,0xe0,0xb4,0x01,0x12,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x0b,0x90,0x9e,
+0x64,0x74,0xfd,0xf0,0xa3,0x74,0x33,0xf0,0x22,0x90,0x9e,0x64,0x74,0xfd,0xf0,0xa3,
+0x74,0x2f,0xf0,0x22,0x90,0x01,0x64,0x74,0xa0,0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,
+0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,
+0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xfb,0xf0,0x74,0x5f,
+0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,0x90,0x00,0x55,0xe0,0x5f,0xf5,
+0x3d,0xe5,0x3d,0x30,0xe6,0x18,0x74,0x40,0xf0,0x90,0x9e,0x1d,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x0b,0x90,0x9e,0x1a,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4a,0xd6,0xe5,0x3d,
+0x30,0xe7,0x15,0x90,0x00,0x55,0x74,0x80,0xf0,0x90,0x9e,0x1d,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x05,0x7f,0x02,0x12,0x4a,0xd6,0x90,0x01,0xc4,0x74,0xfb,0xf0,0x74,0x5f,
+0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,
+0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x8f,0x6b,0x8c,
+0x6c,0x8d,0x6d,0x22,0x8f,0x6e,0x8c,0x6f,0x8d,0x70,0x22,0xe4,0xf5,0x73,0x90,0x9e,
+0x63,0xf0,0xf5,0x74,0x90,0x9e,0x60,0x74,0x0c,0xf0,0x90,0x9e,0x5e,0xf0,0xe4,0x90,
+0x9e,0x61,0xf0,0x90,0x9e,0x5d,0xf0,0x90,0x9e,0x5c,0xf0,0x90,0x9e,0x5f,0x04,0xf0,
+0x90,0x9e,0x50,0xf0,0xe4,0x90,0x9e,0x62,0xf0,0x90,0x9e,0x52,0xf0,0x90,0x9e,0x5a,
+0x74,0x07,0xf0,0xe4,0x90,0x9e,0x51,0xf0,0x90,0x9e,0x58,0xf0,0xa3,0x74,0x02,0xf0,
+0x90,0x9e,0x56,0x14,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x9e,0x55,0x74,0x14,0xf0,0x90,
+0x9e,0x5b,0x74,0x05,0xf0,0xe4,0x90,0x9e,0x54,0xf0,0x90,0x9e,0x4f,0xf0,0x90,0x9e,
+0x76,0xf0,0x22,0xe4,0x90,0x9e,0x62,0xf0,0x90,0x9e,0x51,0xf0,0x90,0x9e,0x63,0xf0,
+0x22,0x8b,0x59,0x8a,0x5a,0x89,0x5b,0x31,0x03,0xab,0x59,0xaa,0x5a,0xa9,0x5b,0x12,
+0x24,0x62,0xf5,0x74,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,
+0x40,0x7f,0x01,0x80,0x3a,0xab,0x59,0xaa,0x5a,0xa9,0x5b,0x90,0x00,0x02,0x12,0x42,
+0x20,0xfd,0xe4,0xff,0x31,0x72,0x80,0x27,0xab,0x59,0xaa,0x5a,0xa9,0x5b,0x90,0x00,
+0x02,0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0x72,0x1f,0x80,0x13,0xab,0x59,0xaa,0x5a,
+0xa9,0x5b,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0x72,0xe4,0xff,0x31,
+0xc6,0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x9e,0x5f,0x74,0x01,0xf0,
+0x80,0x16,0xed,0x70,0x0a,0x90,0x9e,0x5b,0xe0,0x90,0x9e,0x5f,0xf0,0x80,0x05,0x90,
+0x9e,0x5f,0xed,0xf0,0x90,0x9e,0x5f,0xe0,0x90,0x9e,0x50,0xf0,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x9e,0x61,0xf0,0x90,0x00,
+0x03,0x12,0x42,0x20,0x90,0x9e,0x4f,0xf0,0x12,0x24,0x62,0x65,0x74,0x60,0x02,0x31,
+0x11,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x64,0x01,0x70,0x30,0x7d,0x7c,0x7f,0x02,0x12,
+0x31,0x2c,0x7d,0x02,0x7f,0x03,0x12,0x31,0x2c,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x02,0xf0,0x12,0x47,0x16,0xe4,0xff,0x12,0x48,0x8f,0x90,0x06,0x04,0xe0,
+0x54,0x7f,0xf0,0x90,0x06,0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7c,
+0xf0,0xa3,0x74,0x02,0xf0,0x7d,0x7c,0xff,0x12,0x31,0x9d,0x7d,0x02,0x7f,0x03,0x12,
+0x31,0x9d,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,0x07,0xf0,
+0x90,0x9e,0x58,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0xe5,0x73,0x30,0xe0,0x1b,0x90,
+0x9e,0x52,0xe0,0x70,0x1a,0xe0,0x04,0xf0,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xc3,0x94,
+0x04,0x50,0x0c,0x7d,0x01,0x7f,0x04,0x02,0x47,0x1a,0xe4,0x90,0x9e,0x52,0xf0,0x22,
+0x12,0x5e,0x05,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x52,
+0x90,0x9e,0x63,0xe0,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x42,
+0x90,0x9e,0x60,0xe0,0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,
+0xf0,0x80,0x2f,0x90,0x9e,0x63,0xe0,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,
+0x80,0x20,0x90,0x9e,0x63,0xe0,0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,
+0x11,0x90,0x9e,0x52,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,0x03,0x7f,
+0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,0x22,0xe5,0x12,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x01,0xf0,0x80,0x5e,0x90,0x9e,0x60,0xe0,0x54,0x0f,0xd3,0x94,0x01,
+0x40,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4b,0x90,0x02,0x87,0xe0,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x3d,0x90,0x9e,0x75,0xe0,0xb4,0x02,0x10,0x90,
+0x9e,0x64,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x17,0x80,0x26,0x90,
+0x9e,0x75,0xe0,0xb4,0x01,0x0e,0x90,0x01,0xaf,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,
+0x08,0xf0,0x80,0x11,0x90,0x9e,0x54,0xe0,0x70,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,
+0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x02,0xf0,0x7f,0x00,0x22,0x90,0x06,
+0x04,0xe0,0x54,0xbf,0xf0,0xef,0x60,0x09,0xe5,0x73,0xb4,0x01,0x04,0xe4,0xff,0x71,
+0x4d,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x0c,0xf0,0x22,0x8f,0x76,0x90,
+0x9e,0x5e,0xe0,0x90,0x01,0xc1,0xf0,0xa3,0xe5,0x12,0xf0,0x12,0x45,0xb1,0xef,0x64,
+0x01,0x70,0x2e,0x90,0x9e,0x69,0x12,0x47,0xfa,0xe5,0x76,0x60,0x10,0x74,0x21,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,
+0xf0,0x22,0x90,0x9e,0xaf,0xef,0xf0,0x71,0xb0,0x90,0x9e,0xaf,0xe0,0x60,0x05,0x90,
+0x05,0x22,0xe4,0xf0,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x04,0xf0,0x22,
+0x90,0x00,0x11,0xe0,0x44,0x09,0xf0,0x12,0x49,0xb9,0x90,0x9d,0xff,0x12,0x43,0x53,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9e,0x03,
+0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,
+0x90,0x9e,0x07,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,
+0x12,0x2b,0x08,0x90,0x9e,0x0b,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x03,0x2d,0x95,
+0xe4,0xfd,0xff,0x12,0x30,0x2c,0x90,0x9e,0x77,0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,
+0x12,0x25,0x14,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x30,0x2c,0x22,0x8f,
+0x27,0xe4,0x90,0x9e,0xa8,0xf0,0xa3,0xf0,0x90,0x01,0x09,0xe0,0x7f,0x00,0x30,0xe7,
+0x02,0x7f,0x01,0xef,0x65,0x27,0x60,0x3e,0xc3,0x90,0x9e,0xa9,0xe0,0x94,0x88,0x90,
+0x9e,0xa8,0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,0x44,0x80,0xf0,0x22,0x90,
+0x9e,0xa8,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,0x7e,0x00,0x12,0x32,0x15,
+0xd3,0x90,0x9e,0xa9,0xe0,0x94,0x32,0x90,0x9e,0xa8,0xe0,0x94,0x00,0x40,0xb9,0x90,
+0x01,0xc7,0xe0,0x30,0xe0,0xb2,0x22,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,
+0x01,0xf0,0x12,0x44,0xff,0x12,0x45,0x00,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x02,0xf0,
+0x22,0x90,0x9e,0x60,0xe0,0x30,0xe6,0x1c,0xe0,0x54,0x0f,0xff,0x90,0x9e,0x4e,0xe0,
+0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,0x9e,0x4e,0xf0,0x90,0x9e,0x60,
+0xe0,0x54,0xbf,0xf0,0x22,0x8f,0x75,0x12,0x45,0xb1,0xef,0x64,0x01,0x70,0x2e,0x90,
+0x9e,0x6a,0x12,0x47,0xfa,0xe5,0x75,0x60,0x10,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xe4,0x90,
+0x9e,0x2f,0xf0,0xe5,0x74,0x60,0x6a,0xe5,0x73,0x64,0x01,0x70,0x64,0xe5,0x74,0x14,
+0x60,0x29,0x24,0xfd,0x60,0x25,0x24,0x02,0x24,0xfb,0x50,0x02,0x80,0x23,0x90,0x9e,
+0x50,0xe0,0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,0x60,0x16,0x90,0x9e,0x50,0xe0,0x70,
+0x0a,0x90,0x9e,0x5f,0xe0,0x90,0x9e,0x50,0xf0,0x80,0x00,0x90,0x9e,0x2f,0x74,0x01,
+0xf0,0x90,0x9e,0x2f,0xe0,0x60,0x2a,0x90,0x9e,0x63,0xe0,0x44,0x10,0xf0,0xe4,0x90,
+0x9e,0x89,0xf0,0x90,0x9e,0x5a,0x12,0x44,0x56,0x90,0x01,0x57,0x74,0x05,0xf0,0x90,
+0x9e,0x5e,0xe0,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,
+0x1a,0x22,0xef,0xc3,0x94,0x20,0x50,0x39,0xef,0x30,0xe0,0x17,0xed,0xc4,0x54,0xf0,
+0xfd,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x54,
+0x0f,0x80,0x10,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,
+0xe0,0x54,0xf0,0xf0,0x74,0xa4,0x2e,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x4d,
+0xf0,0x22,0xad,0x07,0xed,0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2d,0xf5,0x82,0xe4,
+0x34,0x04,0xf5,0x83,0xe0,0x80,0x0b,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,
+0x83,0xe0,0x54,0x7f,0xf5,0x64,0xe5,0x64,0x54,0x1f,0xfc,0x75,0xf0,0x09,0xed,0x90,
+0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x90,0x9e,0x3e,0xf0,0xed,0x25,0xe0,0x24,0x02,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x3f,0xcb,0xf0,
+0xa3,0xeb,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,
+0xfb,0xa3,0xe0,0x90,0x9e,0x41,0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x66,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfa,0x74,0x01,0x93,0xfb,0xed,0x25,
+0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xea,0xf0,0xa3,0xeb,0xf0,0xec,
+0xc3,0x9f,0x40,0x02,0xc1,0xc9,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,
+0xec,0xf0,0x04,0xfb,0x90,0x9e,0x3e,0xe0,0xff,0xeb,0xd3,0x9f,0x40,0x02,0xc1,0xfa,
+0xeb,0xc3,0x94,0x10,0x40,0x21,0xeb,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,
+0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x3f,0xe0,0x5e,
+0xfe,0xa3,0xe0,0x5f,0x4e,0x70,0x23,0xeb,0xc3,0x94,0x10,0x50,0x39,0x74,0x01,0x7e,
+0x00,0xa8,0x03,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,
+0x41,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x1c,0xeb,0x64,0x13,0x60,0x08,0xeb,
+0x64,0x12,0x60,0x03,0xbb,0x11,0x09,0x90,0x9e,0x3f,0xe0,0x30,0xe0,0x02,0x7b,0x18,
+0xac,0x03,0x8c,0x64,0x80,0x34,0x0b,0x80,0x8b,0x90,0x9e,0x3e,0xe0,0xfb,0x6c,0x70,
+0x69,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x75,0xf0,0x09,
+0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,0xe0,0xb4,0x01,0x0c,0xe5,0x64,0x20,0xe6,0x07,
+0xec,0x44,0x40,0xf5,0x64,0x80,0x03,0xaf,0x64,0x22,0xec,0x25,0xe0,0x24,0x9e,0xf5,
+0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,
+0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,
+0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x80,0x5b,0xec,0xd3,0x9b,0x40,0x56,0x90,
+0x9e,0x3e,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,
+0xac,0x07,0x8f,0x64,0xec,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,
+0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,
+0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,
+0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,
+0xef,0xf0,0xaf,0x64,0x22,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe4,
+0xf0,0xaf,0x05,0xe5,0x64,0x44,0x80,0xfd,0x12,0x58,0xf1,0xe5,0x64,0x44,0x80,0xff,
+0x22,0xac,0x07,0xec,0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2c,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe0,0x80,0x0b,0x74,0xa6,0x2c,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,
+0xe0,0x54,0x7f,0xf5,0x64,0xe5,0x64,0x54,0x1f,0xff,0x90,0x9e,0x40,0xf0,0x75,0xf0,
+0x09,0xec,0x90,0x96,0x49,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x42,0xf0,0x75,0xf0,0x09,
+0xec,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,0xfe,0x90,0x9e,0x43,0xf0,0xec,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x44,
+0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,
+0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x46,0xcb,0xf0,0xa3,0xeb,0xf0,0xef,0xd3,0x9e,
+0x40,0x0a,0x90,0x9e,0x43,0xe0,0x90,0x9e,0x40,0xf0,0xf5,0x64,0xed,0x70,0x02,0x21,
+0x07,0x90,0x9e,0x41,0xed,0xf0,0xe5,0x64,0x30,0xe6,0x0a,0x90,0x9e,0x40,0xe0,0xf5,
+0x64,0xa3,0xe0,0x14,0xf0,0x90,0x9e,0x41,0xe0,0x70,0x02,0x21,0x07,0x90,0x9e,0x40,
+0xe0,0xff,0xd3,0x94,0x00,0x50,0x02,0x21,0x07,0xe4,0x90,0x9e,0x3f,0xf0,0xef,0x14,
+0x90,0x9e,0x3e,0xf0,0x90,0x9e,0x42,0xe0,0xfd,0x90,0x9e,0x3e,0xe0,0xff,0xd3,0x9d,
+0x40,0x6b,0xef,0x94,0x10,0x40,0x21,0xef,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,
+0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x46,0xe0,
+0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x70,0x27,0x90,0x9e,0x3e,0xe0,0xff,0xc3,0x94,0x10,
+0x50,0x33,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0x90,0x9e,0x44,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x16,0x90,
+0x9e,0x3e,0xe0,0xf5,0x64,0xa3,0xe0,0x04,0xf0,0x90,0x9e,0x41,0xe0,0xff,0x90,0x9e,
+0x3f,0xe0,0x6f,0x60,0x08,0x90,0x9e,0x3e,0xe0,0x14,0xf0,0x80,0x87,0x90,0x9e,0x41,
+0xe0,0xff,0x90,0x9e,0x3f,0xe0,0xc3,0x9f,0x50,0x0d,0x90,0x9e,0x3e,0xe0,0xb5,0x05,
+0x06,0x90,0x9e,0x42,0xe0,0xf5,0x64,0xe5,0x64,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x64,0x25,0xe0,0x24,
+0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,
+0xc3,0x13,0xfe,0xef,0x13,0xff,0xec,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,
+0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0xaf,0x04,0xad,0x64,0x12,0x58,0xf1,0xaf,0x64,
+0x22,0xe4,0xf5,0x59,0xe5,0x59,0xb4,0x20,0x14,0x90,0x9a,0xc5,0xe0,0x04,0xf0,0x90,
+0x95,0x01,0xe0,0xff,0x90,0x9a,0xc5,0xe0,0xb5,0x07,0x02,0xe4,0xf0,0x75,0xf0,0x09,
+0xe5,0x59,0x90,0x96,0x4b,0x12,0x43,0x5f,0xe0,0x64,0x01,0x60,0x02,0xe1,0x95,0xe5,
+0x59,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,
+0xd3,0x94,0x00,0xee,0x94,0x00,0x50,0x02,0xe1,0x95,0xe5,0x59,0x94,0x20,0x40,0x08,
+0x90,0x9a,0xc5,0xe0,0x60,0x02,0xe1,0xa0,0xe5,0x59,0x75,0xf0,0x0a,0xa4,0x24,0x00,
+0xf9,0x74,0x90,0x35,0xf0,0x75,0x5e,0x01,0xf5,0x5f,0x89,0x60,0xe5,0x59,0x25,0xe0,
+0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x38,
+0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x59,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,
+0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x3a,0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x59,
+0xc3,0x94,0x20,0x50,0x14,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,
+0xe0,0x54,0x3f,0x90,0x9e,0x34,0xf0,0x80,0x12,0x74,0xa6,0x25,0x59,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x34,0xf0,0x90,0x9e,0x34,0xe0,0xfe,
+0x54,0x1f,0xa3,0xf0,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,
+0x90,0x9e,0x3d,0xf0,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,
+0xc3,0x94,0x05,0x40,0x02,0x81,0x6e,0x90,0x9e,0x3d,0xe0,0xff,0x90,0x9e,0x35,0xe0,
+0x9f,0x40,0x13,0x90,0x9e,0x3d,0xe0,0x90,0x9e,0x35,0xf0,0xee,0x54,0x40,0xfe,0x90,
+0x9e,0x34,0xf0,0xef,0x4e,0xf0,0x90,0x04,0xfd,0xe0,0x64,0x01,0x70,0x29,0x90,0x9e,
+0x35,0xe0,0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x40,0xda,0x80,0x30,0x90,0x9e,
+0x35,0xe0,0x90,0x40,0xf6,0x80,0x27,0x90,0x9e,0x35,0xe0,0xff,0x90,0x41,0x4a,0x93,
+0xfe,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,
+0x06,0xef,0x90,0x41,0x12,0x80,0x07,0x90,0x9e,0x35,0xe0,0x90,0x41,0x2e,0x93,0x90,
+0x9e,0x3c,0xf0,0x90,0x9e,0x3c,0xe0,0x75,0xf0,0x06,0xa4,0x24,0x50,0xf9,0x74,0x40,
+0x35,0xf0,0x75,0x5b,0xff,0xf5,0x5c,0x89,0x5d,0x90,0x9e,0x34,0xe0,0x90,0x41,0xf2,
+0x93,0xff,0xd3,0x90,0x9e,0x3b,0xe0,0x9f,0x90,0x9e,0x3a,0xe0,0x94,0x00,0x40,0x09,
+0xe4,0xfd,0xaf,0x59,0x12,0x67,0xb1,0xe1,0x2c,0xe5,0x59,0x25,0xe0,0x24,0xc2,0xf5,
+0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xf5,0x61,0xa3,0xe0,0xf5,0x62,0xab,0x5b,0xaa,
+0x5c,0xa9,0x5d,0x12,0x24,0x62,0xff,0x7e,0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x12,
+0x42,0x97,0xfd,0xac,0xf0,0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,
+0xf5,0x61,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x7e,
+0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,0x02,0x12,0x42,0xc2,0xfd,0xac,0xf0,
+0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xab,0x5b,0xaa,
+0x5c,0xa9,0x5d,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x5e,0xaa,0x5f,
+0xa9,0x60,0x90,0x00,0x04,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x24,0x7b,0xef,0x25,
+0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x90,0x00,
+0x03,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,0x06,
+0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,
+0x61,0xf5,0x61,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0x7e,0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,0x08,0x12,0x42,0xc2,0xfd,0xac,
+0xf0,0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xab,0x5b,
+0xaa,0x5c,0xa9,0x5d,0x90,0x00,0x05,0x12,0x42,0x20,0xff,0x7e,0x00,0x90,0x9e,0x38,
+0xe0,0xfc,0xa3,0xe0,0xfd,0x12,0x24,0x7b,0xd3,0xe5,0x62,0x9f,0xe5,0x61,0x9e,0x40,
+0x0c,0xe5,0x62,0x9f,0xf5,0x62,0xe5,0x61,0x9e,0xf5,0x61,0x80,0x05,0xe4,0xf5,0x61,
+0xf5,0x62,0xe5,0x59,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe5,
+0x61,0xf0,0xa3,0xe5,0x62,0xf0,0x90,0x9e,0x34,0xe0,0x25,0xe0,0x24,0x66,0xf5,0x82,
+0xe4,0x34,0x41,0xf5,0x83,0xc3,0x74,0x01,0x93,0x95,0x62,0xe4,0x93,0x95,0x61,0x50,
+0x07,0xaf,0x59,0x12,0x65,0xb2,0xe1,0x00,0x90,0x9e,0x34,0xe0,0x25,0xe0,0x24,0x9e,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xd3,0x74,0x01,0x93,0x95,0x62,0xe4,0x93,0x95,
+0x61,0x50,0x02,0xe1,0x00,0x7d,0x01,0xaf,0x59,0x12,0x67,0xb1,0xe1,0x00,0x74,0xe6,
+0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xfc,0x64,0x05,0x60,0x02,0xc1,
+0x09,0x90,0x96,0x43,0xe0,0xff,0xb4,0x03,0x0b,0x90,0x9e,0x35,0xe0,0xc3,0x94,0x19,
+0x40,0x3d,0x80,0x2e,0xef,0xb4,0x02,0x0b,0x90,0x9e,0x35,0xe0,0xc3,0x94,0x11,0x40,
+0x2e,0x80,0x1f,0x90,0x96,0x43,0xe0,0xff,0xb4,0x01,0x0b,0x90,0x9e,0x35,0xe0,0xc3,
+0x94,0x0a,0x40,0x1b,0x80,0x0c,0xef,0x70,0x11,0x90,0x9e,0x35,0xe0,0xc3,0x94,0x03,
+0x40,0x0d,0x90,0x9a,0x84,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9a,0x84,0xf0,0x74,
+0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x63,0x74,0x44,0x25,
+0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xc3,0x94,0x30,0x50,0x02,0xa1,
+0xb6,0x90,0x9a,0x84,0xe0,0x64,0x01,0x60,0x02,0xa1,0xb6,0x74,0x85,0x25,0x59,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0x64,0x0a,0x60,0x51,0xef,0x24,0x05,0xff,0xe4,
+0x33,0xfe,0x74,0x41,0x25,0x59,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xfd,0xd3,
+0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x32,0xed,0x24,0x05,0xff,0xe4,0x33,
+0xfe,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xd3,0x9f,0xee,
+0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x14,0x74,0x26,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x9d,0xf5,0x83,0xe0,0xff,0x90,0x9e,0x35,0xe0,0x6f,0x60,0x3d,0x74,0x44,0x25,0x59,
+0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xd3,0x94,0x42,0x40,0x05,0x75,0x63,
+0x05,0x80,0x0e,0xef,0xd3,0x94,0x39,0x40,0x05,0x75,0x63,0x03,0x80,0x03,0x75,0x63,
+0x01,0x74,0x41,0x25,0x59,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xef,0xf0,0x74,0x85,
+0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0x80,0x29,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x85,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,
+0x83,0xe0,0x04,0xf0,0x80,0x10,0xe4,0xf5,0x63,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x35,0xe0,0xff,0x74,0x26,0x25,0x59,0xf5,
+0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x98,0xf5,0x83,0xe5,0x63,0xf0,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x4c,0x12,0x43,
+0x5f,0xe0,0xb4,0x01,0x10,0xe4,0xf5,0x63,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x9c,0xf5,0x83,0xe4,0xf0,0xad,0x63,0xc1,0xfb,0xec,0x64,0x06,0x60,0x02,0xe1,0x00,
+0xf5,0x61,0xf5,0x62,0x90,0x42,0x13,0x93,0xff,0x7e,0x00,0x90,0x9e,0x38,0xe0,0xfc,
+0xa3,0xe0,0xfd,0x12,0x24,0x7b,0x90,0x9e,0x36,0xee,0xf0,0xa3,0xef,0xf0,0x74,0x84,
+0x25,0x59,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x63,0xe4,0xf5,0x5a,0xab,
+0x5e,0xaa,0x5f,0xa9,0x60,0x75,0xf0,0x02,0xe5,0x5a,0xa4,0xf5,0x82,0x85,0xf0,0x83,
+0x12,0x42,0xc2,0xfd,0xac,0xf0,0xe5,0x5a,0x90,0x42,0x0e,0x93,0xff,0x7e,0x00,0x12,
+0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xc3,0x90,0x9e,0x37,
+0xe0,0x95,0x62,0x90,0x9e,0x36,0xe0,0x95,0x61,0x40,0x07,0x05,0x5a,0xe5,0x5a,0xb4,
+0x05,0xbd,0xe5,0x5a,0xc3,0x13,0xf5,0x5a,0xe5,0x63,0xb4,0x01,0x06,0xe5,0x5a,0x70,
+0x46,0x80,0x13,0xe5,0x63,0xb4,0x03,0x15,0xe5,0x5a,0x70,0x05,0x75,0x63,0x03,0x80,
+0x39,0xe5,0x5a,0xb4,0x01,0x05,0x75,0x63,0x01,0x80,0x2f,0x80,0x2a,0xe5,0x63,0xb4,
+0x05,0x28,0xe5,0x5a,0x70,0x05,0x75,0x63,0x05,0x80,0x0d,0xe5,0x5a,0xb4,0x01,0x05,
+0x75,0x63,0x03,0x80,0x03,0x75,0x63,0x01,0xd3,0x90,0x9e,0x3b,0xe0,0x94,0x03,0x90,
+0x9e,0x3a,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x63,0xd3,0x90,0x9e,0x3b,0xe0,0x94,
+0x03,0x90,0x9e,0x3a,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x63,0x74,0x84,0x25,0x59,
+0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe5,0x63,0xf0,0xfd,0xaf,0x59,0x12,0x65,0x72,
+0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xd3,0x94,0x05,0x74,
+0xe6,0x50,0x0e,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x04,0xf0,0x80,
+0x0b,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0xab,0x5e,0xaa,0x5f,
+0xa9,0x60,0xe4,0xf5,0xf0,0x12,0x42,0xfa,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,
+0x02,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x04,0xe4,0xf5,0xf0,0x12,0x43,0x19,
+0x90,0x00,0x06,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x08,0xe4,0xf5,0xf0,0x12,
+0x43,0x19,0xe5,0x59,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,
+0xf0,0xa3,0xf0,0xe5,0x59,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,
+0xe4,0xf0,0xa3,0xf0,0xe5,0x59,0x25,0xe0,0x24,0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,
+0x83,0xe4,0xf0,0xa3,0xf0,0x05,0x59,0xe5,0x59,0xc3,0x94,0x40,0x50,0x02,0x21,0x54,
+0x22,0x90,0x04,0x44,0x74,0x11,0xf0,0xa3,0x74,0xf0,0xf0,0xa3,0x74,0x0f,0xf0,0xa3,
+0xe4,0xf0,0xfd,0x74,0xa4,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe4,0xf0,0x0d,
+0xbd,0x10,0xf0,0xe4,0x90,0x9a,0xc5,0xf0,0x90,0x95,0x01,0x04,0xf0,0xe4,0xfd,0x75,
+0xf0,0x0a,0xed,0x90,0x90,0x00,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,
+0xed,0x90,0x90,0x02,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,
+0x90,0x04,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x06,
+0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x08,0x12,0x43,
+0x5f,0xe4,0xf0,0xa3,0xf0,0x74,0x26,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0x74,
+0x13,0xf0,0x74,0x85,0x2d,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0x74,0x84,
+0x2d,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xed,0x25,0xe0,0x24,0x80,0xf5,
+0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0xc4,0xf5,
+0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0xc4,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x44,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,
+0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0x74,0x86,0x2d,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x46,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,
+0xe4,0xf0,0x74,0xe6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x41,
+0xc4,0x93,0xfe,0x74,0x01,0x93,0xff,0x90,0x41,0x8c,0x74,0x01,0x93,0x2f,0xff,0xe4,
+0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x4b,
+0x12,0x43,0x5f,0x74,0x01,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,
+0x74,0x01,0xf0,0x74,0x82,0x2d,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0c,0xf0,
+0x75,0xf0,0x09,0xed,0x90,0x96,0x46,0x12,0x43,0x5f,0x74,0xff,0xf0,0xa3,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x44,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0x74,0x0f,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0x74,0x13,0xf0,0x75,0xf0,0x09,0xed,
+0x90,0x96,0x49,0x12,0x43,0x5f,0xe4,0xf0,0xed,0xc3,0x94,0x20,0x50,0x0f,0x74,0x84,
+0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0x74,0x13,0xf0,0x80,0x0d,0x74,0xa6,0x2d,
+0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0x74,0x13,0xf0,0x0d,0xed,0x64,0x40,0x60,0x03,
+0x02,0x6f,0xcf,0x22,0x12,0x24,0x62,0xf5,0x59,0xc3,0x94,0x40,0x50,0x15,0x90,0x00,
+0x02,0x12,0x42,0x20,0xff,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,
+0xef,0xf0,0x22,0xe5,0x59,0xb4,0x40,0x0a,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x96,
+0x42,0xf0,0x22,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x3f,0xfe,0xef,0x54,0x80,
+0xc4,0x13,0x13,0x13,0x54,0x01,0xfd,0xaf,0x06,0x02,0x53,0xa4,0x12,0x24,0x62,0x90,
+0x95,0x01,0xf0,0x22,0x12,0x24,0x62,0xf5,0x73,0x22,0x90,0x00,0x02,0x12,0x42,0x20,
+0xff,0x30,0xe0,0x25,0x12,0x24,0x62,0x90,0x9e,0x56,0xf0,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x9e,0x57,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x55,0xf0,0x90,0x00,
+0x03,0x12,0x42,0x20,0x90,0x9e,0x5b,0xf0,0x22,0x90,0x9e,0x56,0x74,0x01,0xf0,0x90,
+0x9e,0x57,0x74,0x03,0xf0,0x90,0x9e,0x55,0x74,0x14,0xf0,0x90,0x9e,0x5b,0x74,0x05,
+0xf0,0x22,0x12,0x24,0x62,0x30,0xe0,0x18,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x5a,0xf0,
+0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x9e,0x58,0xe4,0xf0,0xa3,0xef,0xf0,0x22,
+0x90,0x9e,0x5a,0x74,0x07,0xf0,0x90,0x9e,0x58,0xe4,0xf0,0xa3,0x74,0x02,0xf0,0x22,
+0x90,0x02,0x09,0xe0,0xfd,0x12,0x24,0x62,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x9e,0x67,
+0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x68,0xf0,0x90,0x00,
+0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x69,0xf0,0x90,0x00,0x03,0x12,0x42,
+0x20,0xff,0xed,0x2f,0x90,0x9e,0x6a,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0xae,
+0x05,0xed,0x2f,0x90,0x9e,0x6b,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,
+0x9e,0x3f,0x12,0x43,0x8b,0x90,0x9e,0x3f,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,
+0xc2,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,0x90,0x9e,0x3f,0x12,0x43,0x6b,
+0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x43,0x19,0x12,0x24,0x62,0xff,0x60,0x2c,0xb5,
+0x22,0x16,0x90,0x9e,0x3f,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0x65,0x24,
+0x70,0x04,0xe5,0x23,0x65,0xf0,0x60,0x23,0x90,0x9e,0x3f,0x12,0x43,0x6b,0x90,0x00,
+0x01,0x12,0x42,0xc2,0xff,0xae,0xf0,0x71,0x00,0x80,0x10,0x90,0x9e,0x3f,0x12,0x43,
+0x6b,0x12,0x24,0x62,0x65,0x22,0x60,0x03,0x12,0x44,0xca,0xd0,0xd0,0x92,0xaf,0x22,
+0x90,0x9e,0x42,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x22,0x01,0x8e,0x23,0xf5,0x24,0xe4,
+0xfd,0x7f,0x0b,0x71,0x44,0xe4,0xfd,0x7f,0x02,0x71,0x44,0x12,0x4f,0xbe,0xe4,0xff,
+0x12,0x44,0xf1,0xe4,0xf5,0x26,0x90,0x01,0xc9,0xe5,0x26,0xf0,0x90,0x9e,0x42,0xe0,
+0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,0x7d,0x01,0x7f,0x60,0x7e,
+0x01,0x02,0x30,0x62,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x45,0xed,0xf0,
+0x90,0x9e,0x44,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4f,0xa3,0xe0,0x70,0x1a,0x90,0x9e,
+0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,
+0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,0x12,
+0x49,0xb9,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x5a,0x90,0x9e,0x44,0xe0,0x24,0xf8,0xf0,
+0xa3,0xe0,0x70,0x1d,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,
+0x1a,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x12,0x49,0xb9,0x90,0x9e,
+0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,
+0x90,0x00,0x43,0xe0,0x5f,0xf0,0x12,0x49,0xb9,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x6d,0xe0,0x90,0x9e,0x40,0xf0,0x90,0x9e,0x6e,
+0xe0,0xf5,0x64,0xa3,0xe0,0xf5,0x65,0xe4,0xf5,0x61,0x74,0x70,0x25,0x61,0xf5,0x82,
+0xe4,0x34,0x9e,0xf5,0x83,0xe0,0xff,0x74,0x66,0x25,0x61,0xf8,0xa6,0x07,0x05,0x61,
+0xe5,0x61,0xb4,0x04,0xe5,0x90,0x9e,0x40,0xe0,0x12,0x43,0x94,0x74,0x6b,0x00,0x75,
+0x93,0x01,0x74,0x71,0x02,0x74,0x71,0x03,0x74,0x71,0x04,0x75,0x93,0x05,0x75,0x63,
+0x80,0x75,0x79,0x81,0x75,0x93,0x82,0x00,0x00,0x75,0x8f,0xaf,0x69,0xb1,0x9a,0xa1,
+0x93,0x90,0x9e,0x40,0xe0,0xff,0xb4,0x02,0x08,0x90,0x9e,0x3f,0x74,0x01,0xf0,0x80,
+0x0f,0xef,0x90,0x9e,0x3f,0xb4,0x03,0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,
+0xc3,0xe5,0x64,0x94,0x08,0x50,0x49,0xe4,0xf5,0x61,0x90,0x9e,0x3f,0xe0,0xff,0xe5,
+0x61,0xc3,0x9f,0x40,0x02,0xa1,0x93,0xc3,0xe5,0x64,0x94,0x01,0x50,0x14,0xe5,0x61,
+0x25,0x65,0xff,0xc3,0x74,0x03,0x95,0x61,0x24,0x66,0xf8,0xe6,0xfd,0x12,0x4a,0xc1,
+0x80,0x1a,0xc3,0x74,0x03,0x95,0x61,0x24,0x66,0xf8,0xe6,0xff,0xe5,0x61,0x7c,0x00,
+0x25,0x65,0xfd,0xec,0x35,0x64,0x8d,0x82,0xf5,0x83,0xef,0xf0,0x05,0x61,0x80,0xba,
+0xc3,0xe5,0x64,0x94,0x10,0x40,0x02,0xa1,0x93,0x90,0x9e,0x40,0xe0,0x64,0x04,0x60,
+0x02,0xa1,0x93,0xaf,0x67,0xfc,0xfd,0xfe,0x78,0x10,0x12,0x24,0xf5,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0xaf,0x66,0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x24,0xf5,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x43,0x46,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0xaf,0x68,0xe4,0xfc,0xfd,0xfe,0x78,0x08,0x12,0x24,0xf5,0xd0,0x03,
+0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x43,0x46,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0xaf,0x69,0xe4,0xfc,0xfd,0xfe,0x12,0x43,0x46,0xa3,0x12,0x25,0x08,0x90,0x9e,
+0x41,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0xaf,0x65,0xae,0x64,0x12,0x2b,
+0x08,0x80,0x30,0xe5,0x68,0x7f,0x00,0xfe,0xef,0x25,0x69,0xf5,0x63,0xe4,0x3e,0xf5,
+0x62,0xaf,0x63,0xfe,0x12,0x32,0x15,0x80,0x1a,0xe5,0x68,0x7f,0x00,0xfe,0xef,0x25,
+0x69,0xf5,0x63,0xe4,0x3e,0xf5,0x62,0xaf,0x63,0xfe,0x12,0x31,0x82,0x80,0x04,0x7f,
+0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x6a,0xe4,0x90,0x9e,0x45,
+0xf0,0xe5,0x6a,0x14,0xfe,0x90,0x9e,0x45,0xe0,0xff,0xc3,0x9e,0x50,0x0e,0xef,0x04,
+0xfd,0x12,0x2d,0x4d,0x90,0x9e,0x45,0xe0,0x04,0xf0,0x80,0xe5,0xe5,0x6a,0x14,0xff,
+0x7d,0xff,0x12,0x2d,0x4d,0x90,0x9e,0x45,0xe5,0x6a,0xf0,0x90,0x9e,0x45,0xe0,0xc3,
+0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x2d,0x4d,0x90,0x9e,0x45,0xe0,0x04,
+0xf0,0x80,0xe8,0xad,0x6a,0x7f,0xff,0x02,0x2d,0x4d,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0xf5,0x5b,0x75,0x5c,0x04,0xf5,0x5d,0xf5,0x5f,0xf5,0x60,0x90,0x02,0x09,
+0xe0,0xff,0x12,0x24,0x62,0xfe,0xef,0x2e,0xf5,0x5e,0x30,0xe0,0x08,0x75,0x59,0x00,
+0x75,0x5a,0x80,0x80,0x05,0xe4,0xf5,0x59,0xf5,0x5a,0xe5,0x5e,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x74,0x20,0x25,0x5b,0xf5,0x5b,0xad,0x5a,0xe5,0x5b,0x2d,0xff,0x24,0x01,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x9e,0x6d,0xf0,0x74,0x02,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x5b,0x2d,0x24,0x03,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x9e,0x6e,0xf0,0xa3,0xef,
+0xf0,0x7f,0x04,0xe5,0x5b,0x25,0x5a,0x2f,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0xfe,0x74,0x6c,0x2f,0xf5,0x82,0xe4,0x34,0x9e,0xf5,0x83,0xee,0xf0,0x0f,
+0xbf,0x08,0xe0,0x91,0x0e,0xef,0x70,0x3f,0x90,0x01,0xc3,0xe0,0x60,0x25,0xc3,0xe5,
+0x60,0x94,0xe8,0xe5,0x5f,0x94,0x03,0x40,0x09,0x90,0x01,0xc6,0xe0,0x44,0x10,0xf0,
+0x80,0x63,0x05,0x60,0xe5,0x60,0x70,0x02,0x05,0x5f,0x7f,0x0a,0x7e,0x00,0x12,0x32,
+0x15,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,0xe2,0x05,0x74,0xfe,0xf0,
+0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x5b,0xb4,0x78,0x23,0xe4,0xf5,0x5b,0x05,
+0x5e,0xe5,0x5a,0x64,0x80,0x45,0x59,0x70,0x06,0xf5,0x59,0xf5,0x5a,0x80,0x06,0x75,
+0x59,0x00,0x75,0x5a,0x80,0xe5,0x5e,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x80,0x06,0x74,
+0x08,0x25,0x5b,0xf5,0x5b,0xe5,0x5d,0x15,0x5d,0x70,0x02,0x15,0x5c,0xe5,0x5d,0x45,
+0x5c,0x60,0x02,0xc1,0x28,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,
+0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x22,0xe4,0xf5,0x25,0x22,0xe4,0x90,0x9e,0xaa,
+0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,
+0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,0x9e,0xab,0xe0,0x94,0xe8,0x90,
+0x9e,0xaa,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x32,
+0x15,0x90,0x9e,0xaa,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0x90,0x9e,0x77,
+0xe0,0x90,0x9e,0x0f,0xf0,0x22,0xef,0x70,0x03,0x02,0x79,0x1e,0x90,0x9e,0x0f,0xe0,
+0x60,0x03,0x02,0x7c,0xe9,0x90,0x9d,0xfb,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9d,0xa7,0x12,0x43,0x53,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9d,0xab,0x12,0x43,
+0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9d,
+0xaf,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x9d,0xb3,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x9d,0xb7,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xbb,0x12,0x43,0x53,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xbf,0x12,0x43,0x53,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xc3,
+0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x9d,0xc7,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x84,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x9d,0xcb,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x88,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xcf,0x12,0x43,0x53,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xd3,0x12,0x43,0x53,0x90,
+0x80,0x96,0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xd7,0x12,
+0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd4,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x9d,0xdb,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd8,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x9d,0xdf,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xe3,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xe7,0x12,0x43,0x53,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xeb,0x12,0x43,
+0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x9d,
+0xef,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,
+0x08,0x90,0x9d,0xf3,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,
+0x09,0x12,0x2b,0x08,0x90,0x9d,0xf7,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x04,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9e,0x0f,0x74,0x01,0xf0,0x22,0x90,0x9e,
+0x0f,0xe0,0x64,0x01,0x60,0x02,0x81,0xe9,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,
+0x9d,0xfb,0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x22,0x65,0x90,0x9d,0xa7,0x12,
+0x25,0x08,0x7f,0x5c,0x7e,0x08,0x12,0x22,0x65,0x90,0x9d,0xab,0x12,0x25,0x08,0x7f,
+0x6c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xaf,0x12,0x25,0x08,0x7f,0x70,0x7e,0x0e,
+0x12,0x22,0x65,0x90,0x9d,0xb3,0x12,0x25,0x08,0x7f,0x74,0x7e,0x0e,0x12,0x22,0x65,
+0x90,0x9d,0xb7,0x12,0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xbb,
+0x12,0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xbf,0x12,0x25,0x08,
+0x7f,0x80,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xc3,0x12,0x25,0x08,0x7f,0x84,0x7e,
+0x0e,0x12,0x22,0x65,0x90,0x9d,0xc7,0x12,0x25,0x08,0x7f,0x88,0x7e,0x0e,0x12,0x22,
+0x65,0x90,0x9d,0xcb,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,
+0xcf,0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xd3,0x12,0x25,
+0x08,0x7f,0xd4,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xd7,0x12,0x25,0x08,0x7f,0xd8,
+0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xdb,0x12,0x25,0x08,0x7f,0xdc,0x7e,0x0e,0x12,
+0x22,0x65,0x90,0x9d,0xdf,0x12,0x25,0x08,0x7f,0xe0,0x7e,0x0e,0x12,0x22,0x65,0x90,
+0x9d,0xe3,0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xe7,0x12,
+0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,0x9d,0xeb,0x12,0x25,0x08,0x7f,
+0x04,0x7e,0x0d,0x12,0x22,0x65,0x90,0x9d,0xef,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,
+0x12,0x22,0x65,0x90,0x9d,0xf3,0x12,0x25,0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,
+0x90,0x9d,0xf7,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,0x9e,0xa4,
+0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xed,0x44,0xc0,0xfd,0xec,0x90,0x9e,
+0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x01,0x00,
+0x00,0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0xdb,
+0x25,0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,
+0xdb,0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,
+0x20,0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,
+0x14,0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,
+0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,
+0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,
+0x96,0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x80,0x96,0x12,0x25,0x14,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x80,0x96,0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd8,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,0x7f,
+0xdc,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x24,0xdb,0x25,
+0xa4,0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,
+0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,
+0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,
+0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x22,0x65,0x90,
+0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,
+0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x01,0xff,
+0xec,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,
+0x65,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xe4,0xff,0xec,
+0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x11,0xff,
+0xec,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,
+0x65,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xed,0x54,0x0f,
+0xfd,0xec,0x54,0xf0,0xfc,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,
+0x53,0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,
+0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,
+0x2b,0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,
+0x9e,0xa4,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa4,0x12,0x25,0x08,
+0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa4,0x12,0x25,
+0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,
+0x08,0x12,0x2b,0x08,0xe4,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,
+0x90,0x9e,0x1e,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,
+0x59,0xc2,0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4a,0xc1,0x7d,
+0x40,0x7f,0x01,0x12,0x31,0x66,0xe5,0x59,0x24,0xff,0x92,0xaf,0x22,0xe4,0xfd,0x7f,
+0x45,0x12,0x4a,0xc1,0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x9e,0x1e,0xf0,0x90,
+0x9e,0x24,0xf0,0x90,0x9e,0x27,0xf0,0x90,0x9e,0x25,0xf0,0x90,0x9e,0x28,0xf0,0x90,
+0x9e,0x26,0xf0,0x90,0x9e,0x29,0xf0,0x90,0x9e,0x10,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x9e,0x15,0xf0,0x90,0x9e,0x1a,0xf0,0x90,0x9e,0x1c,0xf0,0x90,
+0x9e,0x2e,0xf0,0x90,0x9e,0x1f,0xf0,0x90,0x9e,0x1b,0xf0,0x90,0x9e,0x14,0xf0,0x90,
+0x00,0x51,0xe0,0x44,0xc0,0xfd,0x7f,0x51,0x02,0x4a,0xc1,0x90,0x9e,0x15,0xe0,0xc3,
+0x94,0x14,0x50,0x05,0xe0,0x04,0xf0,0xc1,0x33,0x90,0x9e,0x15,0xe0,0x64,0x14,0x60,
+0x02,0xc1,0x33,0x90,0x9e,0x24,0xe0,0x70,0x25,0x90,0x9e,0x27,0xe0,0x70,0x1f,0x90,
+0x9e,0x25,0xe0,0x70,0x19,0x90,0x9e,0x28,0xe0,0x70,0x13,0x90,0x9e,0x26,0xe0,0x70,
+0x0d,0x90,0x9e,0x29,0xe0,0x70,0x07,0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,0x9e,
+0x24,0xe0,0x90,0x04,0x44,0xf0,0x90,0x9e,0x25,0xe0,0x90,0x04,0x45,0xf0,0x90,0x9e,
+0x26,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x27,0xe0,0x90,0x04,0x48,
+0xf0,0x90,0x9e,0x28,0xe0,0x90,0x04,0x49,0xf0,0x90,0x9e,0x29,0xe0,0x90,0x04,0x4a,
+0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x10,0xe0,0x90,0x04,0x4c,0xf0,0x90,0x9e,0x11,0xe0,
+0x90,0x04,0x4d,0xf0,0x90,0x9e,0x12,0xe0,0x90,0x04,0x4e,0xf0,0x90,0x9e,0x13,0xe0,
+0x90,0x04,0x4f,0xf0,0xe4,0x90,0x9e,0x15,0xf0,0x90,0x9e,0x10,0x04,0xf0,0xe4,0xa3,
+0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x24,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x34,0xf0,0x90,0x05,0x61,0xe0,0x90,
+0x9e,0x35,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x36,0xf0,0x90,0x05,0x63,0xe0,0x90,
+0x9e,0x37,0xf0,0x90,0x9e,0x2d,0xe0,0xff,0x90,0x9e,0x37,0xe0,0xfe,0xd3,0x9f,0x50,
+0x0b,0x90,0x9e,0x2d,0xe0,0xc3,0x9e,0xd3,0x94,0x01,0x40,0x11,0x90,0x9e,0x1b,0xe0,
+0xb4,0x01,0x02,0x80,0x03,0x90,0x9e,0x1f,0xe0,0xff,0x12,0x4e,0xd8,0x22,0x90,0x9e,
+0x2e,0xe0,0x64,0x01,0x60,0x08,0x90,0x9e,0x1c,0xe0,0x60,0x02,0xe1,0x55,0x90,0x9e,
+0x10,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x9e,0x11,0xe0,
+0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x28,0x90,0x9e,0x12,0xe0,0xc3,
+0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x11,0xf0,0x80,0x15,0x90,0x9e,
+0x13,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x12,0xf0,0x90,
+0x9e,0x11,0xf0,0x90,0x9e,0x10,0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,0xe0,
+0x30,0xe2,0x32,0x90,0x9e,0x24,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,
+0x24,0x90,0x9e,0x25,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,
+0x90,0x9e,0x26,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x25,
+0xf0,0x90,0x9e,0x24,0xf0,0x90,0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x9e,0x27,0xe0,
+0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x9e,0x28,0xe0,0xc3,0x94,
+0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,0x29,0xe0,0xc3,0x94,0xff,
+0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x28,0xf0,0x90,0x9e,0x27,0xf0,0x90,0x04,
+0xfd,0xe0,0x44,0x01,0xf0,0x22,0xf5,0x67,};
+
+// =================== v84 UMC B Cut COMMON 2012-04-13 =====================
+u8 Rtl8192CUFwUMCBCutImgArray[UMCBCutImgArrayLength] = {
+0xc2,0x88,0x02,0x00,0x54,0x00,0x01,0x00,0x04,0x13,0x11,0x08,0x26,0x3d,0x01,0x00,
+0x58,0x97,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x50,0xa1,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0x91,0x00,0x00,0x00,0x00,0x00,0xa1,0xe8,0x00,0x00,0x00,
+0x05,0x04,0x03,0x02,0x00,0x03,0x06,0x05,0x04,0x03,0x00,0x04,0x06,0x05,0x04,0x02,
+0x00,0x04,0x08,0x07,0x06,0x04,0x00,0x06,0x0a,0x09,0x08,0x06,0x00,0x08,0x0a,0x09,
+0x08,0x04,0x00,0x08,0x0a,0x09,0x08,0x02,0x00,0x08,0x0a,0x09,0x08,0x00,0x00,0x08,
+0x12,0x11,0x10,0x08,0x00,0x10,0x1a,0x19,0x18,0x10,0x00,0x18,0x22,0x21,0x20,0x18,
+0x00,0x20,0x22,0x21,0x20,0x10,0x00,0x20,0x22,0x21,0x20,0x08,0x00,0x20,0x22,0x21,
+0x1c,0x08,0x00,0x20,0x22,0x21,0x14,0x08,0x00,0x20,0x22,0x20,0x18,0x08,0x00,0x20,
+0x31,0x30,0x20,0x10,0x00,0x30,0x31,0x30,0x18,0x00,0x00,0x30,0x31,0x2f,0x10,0x10,
+0x00,0x30,0x31,0x2c,0x10,0x10,0x00,0x30,0x31,0x28,0x10,0x00,0x00,0x30,0x31,0x20,
+0x10,0x00,0x00,0x30,0x31,0x10,0x10,0x00,0x00,0x30,0x04,0x04,0x04,0x05,0x04,0x04,
+0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,
+0x05,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x05,0x05,0x05,0x05,0x06,0x07,0x0a,0x0b,
+0x0d,0x10,0x04,0x05,0x05,0x06,0x06,0x09,0x0c,0x11,0x08,0x08,0x09,0x09,0x0a,0x0c,
+0x10,0x11,0x04,0x04,0x04,0x05,0x04,0x04,0x05,0x07,0x07,0x07,0x08,0x0a,0x04,0x04,
+0x04,0x04,0x06,0x0a,0x0b,0x0d,0x05,0x05,0x07,0x07,0x08,0x0b,0x0d,0x0f,0x04,0x04,
+0x04,0x05,0x07,0x07,0x09,0x09,0x0c,0x0e,0x10,0x12,0x04,0x04,0x05,0x05,0x06,0x0a,
+0x11,0x13,0x09,0x09,0x09,0x09,0x0c,0x0e,0x11,0x13,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x24,0x26,0x2a,0x18,0x1a,0x1d,0x1f,0x21,0x27,0x29,0x2a,0x00,0x00,
+0x00,0x1f,0x23,0x28,0x2a,0x2c,0x00,0x04,0x00,0x04,0x00,0x08,0x00,0x10,0x00,0x18,
+0x00,0x24,0x00,0x30,0x00,0x48,0x00,0x60,0x00,0x90,0x00,0xc0,0x00,0xd8,0x00,0x50,
+0x00,0x78,0x00,0xa0,0x00,0xc8,0x01,0x40,0x01,0x90,0x01,0xe0,0x02,0x30,0x01,0x2c,
+0x01,0x40,0x01,0xe0,0x02,0xd0,0x03,0xe8,0x04,0xb0,0x06,0x40,0x07,0xd0,0x00,0x02,
+0x00,0x02,0x00,0x04,0x00,0x08,0x00,0x0c,0x00,0x12,0x00,0x18,0x00,0x24,0x00,0x30,
+0x00,0x48,0x00,0x60,0x00,0x6c,0x00,0x28,0x00,0x3c,0x00,0x50,0x00,0x64,0x00,0xa0,
+0x00,0xc8,0x00,0xf0,0x01,0x18,0x00,0x64,0x00,0xa0,0x00,0xf0,0x01,0x68,0x01,0xf4,
+0x02,0x58,0x03,0x20,0x03,0xe8,0x02,0x02,0x02,0x02,0x02,0x02,0x03,0x03,0x04,0x04,
+0x05,0x07,0x04,0x04,0x07,0x0a,0x0a,0x0c,0x0c,0x12,0x05,0x07,0x07,0x08,0x0b,0x12,
+0x24,0x3c,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x01,0x02,
+0x03,0x04,0x05,0x06,0x07,0x08,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x20,0x1e,
+0x1c,0x18,0x10,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,0x83,0xe0,0xf5,
+0xf0,0xa3,0xe0,0x22,0x50,0x06,0x87,0xf0,0x09,0xe7,0x19,0x22,0xbb,0xfe,0x07,0xe3,
+0xf5,0xf0,0x09,0xe3,0x19,0x22,0x89,0x82,0x8a,0x83,0xe4,0x93,0xf5,0xf0,0x74,0x01,
+0x93,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,
+0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,0x86,0xf0,0x08,0xe6,0x22,
+0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,0xe2,0x22,0xe5,0x83,0x2a,
+0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,
+0x83,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x06,0xf7,0x09,0xa7,0xf0,0x19,0x22,0xbb,
+0xfe,0x06,0xf3,0xe5,0xf0,0x09,0xf3,0x19,0x22,0xf8,0xbb,0x01,0x11,0xe5,0x82,0x29,
+0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x09,
+0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,0xfe,0x09,0xe9,0x25,0x82,0xc8,
+0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,0x4a,0xfe,0xed,0x49,0xfd,0xec,
+0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xa4,
+0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,0x22,0xe0,0xfb,0xa3,0xe0,0xfa,
+0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,0xf9,0x25,0xf0,0xf0,0xe5,0x82,
+0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,0x22,0xeb,0xf0,0xa3,0xea,0xf0,
+0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,
+0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,
+0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,0x02,0x43,0xf8,0x02,0x48,0x29,
+0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,0x08,0xdf,0xf4,
+0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,0xc4,0x54,0x0f,
+0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,0xe4,0x80,0x0b,
+0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x3d,0xe4,0x7e,0x01,0x93,0x60,
+0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,0xa3,0x60,0x01,
+0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,0xfa,0xe4,0x93,
+0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xf0,0xa3,0xc8,
+0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,0x41,0x9e,0x77,
+0x00,0x41,0x9e,0xae,0x00,0x41,0x9e,0x54,0x80,0x41,0x9e,0xb0,0x00,0x00,0xf0,0x90,
+0x9e,0x5d,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x85,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,
+0x45,0x12,0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x08,0xf0,0xe4,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,0x86,
+0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,0x74,0x05,0xf0,
+0x90,0x06,0x92,0x74,0x02,0xf0,0x90,0x9e,0x63,0x14,0xf0,0xe5,0x61,0x54,0x0f,0xc3,
+0x94,0x0c,0x50,0x03,0x12,0x54,0xe3,0x22,0x8f,0x82,0x8e,0x83,0xa3,0xa3,0xa3,0xe4,
+0xf0,0x22,0xe4,0xf5,0x65,0x7f,0x60,0x7e,0x01,0x80,0xed,0x7d,0x01,0xaf,0x62,0x02,
+0x54,0xe7,0xb1,0xb0,0xbf,0x01,0x12,0x90,0x9e,0x79,0xe0,0xff,0xe4,0xfd,0xf1,0x79,
+0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xb1,0xb0,0xbf,0x01,0x0f,0x90,
+0x02,0x09,0xe0,0xff,0x7d,0x01,0xf1,0x79,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x22,
+0x22,0x22,0x00,0x02,0x45,0x03,0x02,0x45,0x06,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x8b,0x20,0x8a,0x21,0x89,0x22,0x90,0x9e,0x87,0x71,0x8b,0xab,0x23,0xaa,0x24,0xa9,
+0x25,0x90,0x9e,0x8a,0x71,0x8b,0xaf,0x26,0x15,0x26,0xef,0x60,0x1b,0x90,0x9e,0x8a,
+0xe4,0x75,0xf0,0x01,0x71,0x74,0x12,0x29,0xd9,0xff,0x90,0x9e,0x87,0xe4,0x75,0xf0,
+0x01,0x71,0x74,0xef,0x51,0x4d,0x80,0xde,0xab,0x20,0xaa,0x21,0xa9,0x22,0xd0,0xd0,
+0x92,0xaf,0x22,0x90,0x9e,0x11,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0x90,0x06,0xa9,
+0xe0,0x90,0x9e,0x10,0xf0,0xe0,0x54,0xc0,0x70,0x08,0x53,0x64,0xfe,0x53,0x64,0xfd,
+0x91,0xcb,0x90,0x9e,0x10,0xe0,0x30,0xe6,0x13,0x43,0x64,0x01,0x90,0x9e,0x66,0xe0,
+0x64,0x02,0x60,0x04,0x91,0xd2,0x80,0x07,0x91,0x79,0x80,0x03,0x53,0x64,0xfe,0x90,
+0x9e,0x10,0xe0,0x30,0xe7,0x16,0x43,0x64,0x02,0xe4,0x90,0x9e,0x85,0x91,0x4e,0x90,
+0x01,0x57,0x74,0x05,0xf0,0x90,0x9e,0x67,0x74,0x01,0xf0,0x22,0x53,0x64,0xfd,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,0x74,0xb0,0xf0,0x74,0x45,0xa3,
+0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,0xe0,0x54,0x90,0x60,0x07,0x90,
+0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,0x30,0xe1,0xe4,0x7f,0x00,0x80,
+0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,
+0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0x75,0x13,0x00,0x90,0x01,0xc4,0x74,0xe8,0xf0,0x74,0x45,
+0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,0x55,
+0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,0xe5,
+0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x09,0x90,
+0x01,0x3c,0x74,0x02,0xf0,0x12,0x61,0xc9,0xe5,0x34,0x30,0xe2,0x38,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,
+0x9e,0x5b,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x91,0x5e,
+0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x07,0x90,0x9e,
+0x64,0xe4,0xf0,0x91,0xcb,0xe5,0x34,0x30,0xe3,0x38,0x90,0x01,0x3c,0x74,0x08,0xf0,
+0x90,0x06,0x92,0xe0,0x30,0xe1,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,0x9e,0x5b,0xe0,
+0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x07,0x90,0x9e,0x63,0xe4,0xf0,
+0x91,0xcb,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,0x12,0x4b,0xfb,
+0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,0x4c,0x3d,0xe5,0x35,
+0x30,0xe0,0x44,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,0x44,0x7f,0xf0,
+0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x13,0xb4,0x01,0x02,0x80,0x1c,0xe5,0x13,0xb4,
+0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x13,0xb4,0x04,0x05,0x90,0x00,0x83,0x80,
+0x08,0xe5,0x13,0xb4,0x0c,0x06,0x90,0x00,0x83,0xe0,0xf5,0x62,0x90,0x01,0xbb,0xe5,
+0x62,0xf0,0x12,0x60,0xc0,0x91,0xcb,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,
+0x04,0xf0,0xe5,0x35,0x30,0xe4,0x06,0x90,0x01,0x3d,0x74,0x10,0xf0,0xe5,0x36,0x30,
+0xe0,0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,
+0x74,0x02,0xf0,0x74,0xe8,0x04,0x90,0x01,0xc4,0xf0,0x74,0x45,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x9e,0x98,0xef,0xf0,0xa3,0xed,
+0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,0x63,0x60,0x05,0xe4,0xff,0x12,0x54,0x97,0x90,
+0x9e,0x98,0xe0,0x30,0xe0,0x09,0x90,0x9e,0x9a,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,
+0x9e,0x98,0xe0,0xff,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,
+0x9e,0x99,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x80,0xf0,0x90,0x9e,0x9a,0xa3,0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,
+0xf7,0xf0,0x90,0x9e,0x9a,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0x75,0x28,0x33,0xe4,0xf5,
+0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,0xf0,
+0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x9e,0x16,0xf0,0xa3,0xf0,
+0x75,0x8e,0x02,0xf1,0xa1,0xf1,0xe9,0x90,0x9e,0x7e,0xef,0xf0,0xf1,0xdd,0x90,0x9e,
+0x80,0xef,0xf0,0xf1,0xf6,0x90,0x9e,0x75,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,0x57,
+0x12,0x6e,0x77,0xf1,0xd4,0x12,0x60,0x4b,0x12,0x32,0x3d,0xf1,0xc9,0x11,0x0b,0x12,
+0x50,0x0e,0xf1,0xcd,0xf1,0xb1,0x12,0x44,0xff,0xf1,0x45,0x90,0x9e,0x18,0xe5,0xd9,
+0xf0,0x11,0xd0,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,0xf0,0xb1,0x45,0x75,0xe8,
+0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x9e,0x16,0xe0,0x64,0x01,0xf0,0x24,0x29,0x90,
+0x01,0xc4,0xf0,0x74,0x48,0xa3,0xf0,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,
+0xef,0xd2,0xaf,0x12,0x58,0x74,0xe5,0x57,0x30,0xe6,0x17,0xc2,0xaf,0x53,0x57,0xbf,
+0xd2,0xaf,0x12,0x67,0xa1,0x90,0x9e,0x43,0xe0,0xff,0x60,0x03,0xb4,0x01,0x03,0x12,
+0x7b,0x49,0x90,0x9e,0x43,0xe0,0x70,0x03,0x12,0x7c,0x4c,0x12,0x73,0x85,0x80,0xb6,
+0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,0x31,0x05,0x7d,0xff,0x7f,0x55,0x31,0x05,0x7d,
+0xff,0x7f,0x56,0x31,0x05,0x7d,0xff,0x7f,0x57,0x80,0x0a,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,
+0x00,0xed,0xf0,0xb1,0x45,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,
+0x66,0x24,0x02,0x60,0x02,0x21,0xc1,0x90,0x9e,0x3f,0x74,0x02,0xf0,0x90,0x00,0x48,
+0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,
+0x9e,0x3f,0xf0,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x31,
+0x05,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,
+0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,0x90,0x9e,0x3f,0x74,0x01,0xf0,0x90,0x9e,0x45,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,
+0x10,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x31,
+0x05,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x41,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,0x9e,0x40,0xf0,0x12,0x29,0xd9,0x25,0xe0,0x25,
+0xe0,0x90,0x9e,0x44,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,
+0xe0,0x90,0x9e,0x50,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,
+0xe0,0x90,0x9e,0x52,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,
+0x9e,0x40,0xe0,0xff,0x91,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x90,0x9e,
+0x41,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,0x40,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,
+0x44,0xe0,0x70,0x02,0x41,0xc8,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,
+0x90,0x9e,0x53,0x74,0x01,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x11,0xfc,
+0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,
+0x15,0x90,0x9e,0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,
+0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,
+0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,
+0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,
+0x20,0xe4,0xff,0x12,0x37,0x00,0x80,0x2b,0x90,0x9e,0x41,0xe0,0x70,0x2d,0x90,0x9e,
+0x53,0x11,0xfb,0x90,0x00,0x46,0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x31,0x05,0x90,0x05,
+0x22,0xe4,0xf0,0xa2,0xaf,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,
+0x12,0x36,0x92,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x14,0x8a,0x15,
+0x89,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x42,0xf0,0xe0,0x30,0xe0,0x4b,
+0x90,0x9e,0x39,0x74,0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0x3b,
+0x12,0x2a,0x7f,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0xe4,0xfc,0xfd,0xfe,0x78,0x1a,0x12,0x2a,0x6c,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0x90,0x9e,0x3b,0x12,0x43,0x53,0xec,0x54,0x03,0xfc,0x12,0x43,0x46,0x90,0x9e,
+0x45,0x12,0x2a,0x7f,0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x9e,0x39,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,
+0x9e,0x3b,0x12,0x2a,0x7f,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x42,0xe0,0x30,0xe1,0x19,0x7d,
+0x0c,0x7f,0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x44,0x10,0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,
+0x46,0xe0,0x54,0xef,0xfd,0x7f,0x46,0x31,0x05,0xe4,0x90,0x9e,0x3f,0xf0,0x22,0x90,
+0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x38,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x31,0x05,0xe4,0xfd,0x7f,0x51,0x31,0x05,0xe4,
+0xfd,0x7f,0x52,0x31,0x05,0xe4,0xfd,0x7f,0x53,0x21,0x05,0xe5,0x65,0x64,0x01,0x70,
+0x3b,0xd1,0x85,0xbf,0x01,0x04,0x7f,0x01,0xd1,0x79,0x90,0x00,0x46,0xe0,0x44,0x04,
+0xfd,0x7f,0x46,0x31,0x05,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x31,0x05,0x7f,0x02,0xd1,0xa1,0x8f,
+0x69,0x90,0x01,0xc9,0xe5,0x69,0xf0,0xb4,0x01,0x02,0xd1,0x19,0x22,0x90,0x9e,0x41,
+0xe0,0x64,0x01,0x60,0x02,0x81,0xef,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,
+0x31,0x05,0x90,0x9e,0x53,0xe0,0x70,0x31,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x9e,0x40,0xe0,0xff,0x91,0xf0,
+0x90,0x9e,0x53,0x74,0x01,0x11,0xfb,0x80,0x3f,0x90,0x9e,0x53,0xe0,0x64,0x01,0x70,
+0x37,0x90,0x9e,0x44,0xe0,0xff,0x91,0xf0,0xe4,0x90,0x9e,0x53,0xf0,0x90,0x00,0x45,
+0xe0,0x44,0x01,0xfd,0x7f,0x45,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,
+0x9e,0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,
+0x9e,0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0x22,
+0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x50,0xf0,
+0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x52,0xf0,
+0xc3,0x74,0xff,0x9f,0xfe,0x90,0x9e,0x50,0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,
+0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,
+0x9e,0x52,0x80,0x03,0x90,0x9e,0x51,0xe0,0x04,0xf0,0x22,0x90,0x9e,0x50,0xe0,0x2f,
+0xf0,0x22,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,0xfe,
+0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x2a,0xed,
+0xf0,0x90,0x9e,0x29,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,
+0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,
+0xb1,0x45,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x59,0x90,0x9e,0x29,0xe0,0x24,0xf8,0xf0,
+0xa3,0xe0,0x70,0x1d,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,
+0x1a,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0xb1,0x45,0x90,0x9e,0x29,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x43,0xb1,0x42,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x9e,0xb1,
+0xf0,0xe0,0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x31,0x05,0x90,0x9e,0xb1,0xe0,
+0x44,0xb0,0xfd,0x7f,0x49,0x21,0x05,0x90,0x9e,0x27,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0x65,0x01,0x8e,0x66,0xf5,0x67,0xe4,0xfd,0x7f,0x0b,0xb1,0x55,0xe4,0xfd,0x7f,0x02,
+0xb1,0x55,0xd1,0x85,0xe4,0xff,0xd1,0x79,0xe4,0xf5,0x69,0x90,0x01,0xc9,0xe5,0x69,
+0xf0,0x90,0x9e,0x27,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,
+0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0x90,0x01,0xca,0xe5,0x68,0xf0,0xef,
+0x60,0x02,0xd1,0x19,0x22,0x7f,0x0b,0xd1,0xa1,0xef,0x65,0x68,0x60,0x10,0xe5,0x68,
+0xb4,0x01,0x05,0xe4,0xf5,0x68,0x80,0x03,0x75,0x68,0x01,0x7f,0x01,0x22,0x7f,0x00,
+0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0xb2,0xef,0xf0,0xd3,0x94,0x07,
+0x50,0x43,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x46,0xb1,0x42,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,
+0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,
+0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,
+0xd8,0xf8,0xff,0x80,0x4b,0x90,0x9e,0xb2,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,
+0xf0,0xb1,0x45,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x42,0xe0,0xfb,0xe4,0xfe,
+0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,
+0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfd,0x7f,0x45,0x31,0x05,0x90,0x04,0xfd,0xe4,0xf0,
+0xa3,0xf0,0x90,0x9e,0x43,0xf0,0x90,0x9e,0x49,0xf0,0x90,0x9e,0x4c,0xf0,0x90,0x9e,
+0x4a,0xf0,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4b,0xf0,0x90,0x9e,0x4e,0xf0,0x90,0x9e,
+0x35,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x3a,0xf0,0x90,0x9e,
+0x3f,0xf0,0x90,0x9e,0x41,0xf0,0x90,0x9e,0x53,0xf0,0x90,0x9e,0x44,0xf0,0x90,0x9e,
+0x40,0xf0,0x90,0x9e,0x39,0xf0,0x90,0x00,0x51,0xe0,0x44,0xc0,0xfd,0x7f,0x51,0x21,
+0x05,0xe4,0x90,0x9e,0x7d,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,0x21,
+0x05,0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,
+0xa3,0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0xe4,0xf5,0x68,0x22,0x90,0x01,0x64,
+0x74,0xa0,0xf0,0x22,0x90,0x9e,0x80,0xe0,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0xf3,
+0xe0,0x7f,0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,
+0x01,0x60,0x02,0x7f,0x00,0x22,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,
+0xe0,0x30,0xe7,0x05,0x7e,0xfd,0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x90,0x00,
+0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,
+0xe4,0xf0,0x22,0x90,0x01,0x02,0xe0,0x54,0x03,0xff,0xe0,0x54,0x0c,0x13,0x13,0x54,
+0x3f,0xfe,0xef,0x64,0x01,0x60,0x04,0xef,0xb4,0x03,0x10,0x90,0x9e,0x10,0x74,0x01,
+0xf0,0xa3,0x74,0x37,0xf0,0xa3,0x74,0x01,0xf0,0x80,0x1a,0xee,0x64,0x01,0x60,0x07,
+0xaf,0x06,0xee,0x64,0x03,0x70,0x49,0x90,0x9e,0x10,0x74,0x01,0xf0,0xa3,0x74,0x3d,
+0xf0,0xa3,0x74,0x40,0xf0,0x90,0x9e,0x10,0xe0,0xfe,0xa3,0xe0,0xff,0xf5,0x82,0x8e,
+0x83,0xe0,0xfd,0x90,0x9e,0x12,0xe0,0xfc,0xed,0x5c,0x60,0x0c,0x8f,0x82,0x8e,0x83,
+0xec,0xf0,0xe4,0x90,0x9e,0x77,0xf0,0x22,0x90,0x9e,0x77,0xe0,0x04,0xf0,0xe0,0xc3,
+0x94,0x0a,0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x44,0xea,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0xa1,0xf0,0x74,0x50,0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,
+0xa3,0xe0,0x55,0x29,0xf5,0x2d,0xa3,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,
+0xf5,0x2f,0xe5,0x2c,0x20,0xe0,0x02,0x41,0x46,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,
+0xd1,0x4d,0x85,0xd2,0x4e,0x85,0xd3,0x4f,0x85,0xd4,0x50,0x85,0xd5,0x51,0x85,0xd6,
+0x52,0x85,0xd7,0x53,0x85,0xd9,0x54,0xe5,0x54,0x54,0x40,0xc3,0x13,0xff,0xe5,0x53,
+0x54,0x20,0x6f,0x70,0x02,0x21,0xf5,0xe5,0x54,0x30,0xe5,0x02,0x21,0xf5,0xe5,0x52,
+0x54,0x3f,0xf5,0x08,0xe5,0x4d,0x54,0x3f,0xf5,0x09,0xe5,0x51,0x54,0x1f,0xff,0xe5,
+0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,
+0x42,0x81,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x09,0xd3,0x94,0x04,0x40,
+0x03,0x75,0x09,0x04,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,0x75,
+0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xe0,0xfe,0xa3,0xe0,0xff,0xe5,0x53,0x54,0x1f,
+0x2f,0xff,0xe4,0x3e,0xfe,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,
+0x75,0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xee,0xf0,0xa3,0xef,0xf0,0xe5,0x54,0x20,
+0xe6,0x24,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,0x30,0xe7,0x36,0xaf,
+0x08,0x12,0x63,0x51,0x80,0x2f,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,
+0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,
+0x30,0xe7,0x12,0xe5,0x4f,0x54,0x7f,0xfd,0xe5,0x53,0x54,0x1f,0xf5,0x0d,0xab,0x09,
+0xaf,0x08,0x12,0x62,0xee,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,0x9e,
+0x66,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0x71,
+0xc3,0xef,0x64,0x01,0x70,0x30,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,
+0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x5e,0x90,0x01,0x5b,0x74,
+0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x9e,0x64,0xf0,0x80,0x08,0x71,0xc3,
+0xbf,0x01,0x03,0x12,0x44,0xcb,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,0x02,
+0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,0x5c,
+0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0xd2,0xe5,0x2c,0x30,0xe3,0x06,
+0x90,0x01,0x34,0x74,0x08,0xf0,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,
+0xf0,0x43,0x57,0x10,0xe5,0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,
+0xe0,0x54,0xdf,0xf0,0x90,0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,
+0x12,0x4b,0xcf,0x90,0x00,0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4d,0x45,0x80,0xfe,0xe5,
+0x2c,0x30,0xe6,0x06,0x90,0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x12,0x90,
+0x9e,0x7f,0x74,0x01,0xf0,0x90,0x01,0x36,0xf0,0x12,0x61,0x4e,0x90,0x9e,0x7f,0xe4,
+0xf0,0xe5,0x2e,0x30,0xe1,0x0b,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x11,
+0x23,0xe5,0x2e,0x30,0xe2,0x09,0x90,0x01,0x36,0x74,0x04,0xf0,0x12,0x60,0xdf,0xe5,
+0x2e,0x30,0xe3,0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x60,0x64,0x01,0x70,0x1c,
+0xe5,0x63,0x60,0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,
+0x9e,0x85,0xe4,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,
+0x2b,0x90,0x01,0x36,0x74,0x10,0xf0,0xe5,0x60,0xb4,0x01,0x20,0xe5,0x63,0x60,0x1c,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x67,0xe4,0xf0,
+0x53,0x64,0xfd,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,0xe5,0x2e,0x30,0xe5,
+0x1f,0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x60,0xb4,0x01,0x14,0xe5,0x63,0x60,0x10,
+0x90,0x9e,0x66,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xd2,0x80,0x03,0x12,0x44,0x79,
+0xe5,0x2e,0x30,0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x60,0xb4,0x01,0x10,
+0xe5,0x63,0x60,0x0c,0x53,0x64,0xfe,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,
+0xe5,0x2f,0x30,0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x91,0x64,0x74,0xa1,0x04,
+0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,
+0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,
+0x00,0x22,0x90,0x9e,0x10,0xe0,0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,
+0x7b,0x00,0x7a,0x00,0x79,0x58,0x90,0x9e,0x90,0x12,0x43,0x8b,0x0b,0x7a,0x9e,0x79,
+0x10,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x8d,0x12,0x43,0x8b,0x90,0x9e,
+0xb0,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x12,0x42,0x5f,0x7f,0xaf,0x7e,0x01,
+0x12,0x71,0x7a,0xef,0x60,0x49,0x90,0x9e,0x8d,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,
+0x89,0x25,0x75,0x26,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0x12,0x45,0x09,0x90,0x9e,
+0x90,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,0x89,0x25,0x90,0x9e,0x8d,0x12,0x43,0x6b,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x26,0x7b,0x01,0x7a,0x01,0x79,0xa2,0x12,
+0x45,0x09,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,
+0xd0,0x92,0xaf,0x22,0x90,0x9e,0xa0,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,
+0x14,0x24,0xfd,0x50,0x02,0x80,0x1f,0x90,0x9e,0x66,0xe0,0x60,0x06,0x7d,0x01,0x7f,
+0x0c,0x80,0x0d,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,0x06,0x7d,0x01,0x7f,0x04,
+0x91,0xe7,0xe4,0xff,0x91,0x97,0x22,0xef,0x60,0x0b,0x90,0x9e,0x80,0xe0,0xb4,0x01,
+0x10,0xe4,0xff,0x80,0x09,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x75,
+0x92,0x22,0x90,0x01,0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x74,
+0x12,0xef,0x70,0x06,0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,
+0xe6,0xe5,0x63,0x60,0x04,0x7f,0x01,0x91,0x97,0x12,0x74,0xc8,0x53,0x61,0xf0,0x43,
+0x61,0x02,0x22,0x7d,0x01,0x7f,0x0c,0x8f,0x6a,0x8d,0x6b,0xe5,0x6a,0x54,0x0f,0xff,
+0xe5,0x61,0x54,0x0f,0x6f,0x60,0x65,0xe5,0x6a,0x30,0xe2,0x28,0xe5,0x61,0x20,0xe2,
+0x04,0x7f,0x01,0xd1,0xc2,0xe5,0x61,0x30,0xe3,0x0c,0xe5,0x6a,0x20,0xe3,0x07,0xb1,
+0x5d,0xef,0x60,0x48,0xa1,0xa5,0xe5,0x61,0x20,0xe3,0x41,0xe5,0x6a,0x30,0xe3,0x3c,
+0xaf,0x6b,0xc1,0xdc,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x0c,0x0c,0xe5,0x6a,0x20,0xe3,
+0x07,0xb1,0x5d,0xef,0x60,0x26,0xb1,0xa5,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x04,0x0c,
+0xe5,0x6a,0x20,0xe2,0x07,0xf1,0x21,0xef,0x60,0x12,0x91,0xb2,0xe5,0x61,0x54,0x0f,
+0xff,0xbf,0x02,0x08,0x12,0x60,0xbd,0xef,0x60,0x02,0xd1,0xaf,0x22,0x71,0xc3,0xef,
+0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x9e,0x64,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x9e,0x63,0xe0,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x62,0x54,0x0f,0xd3,0x94,0x04,0x40,
+0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,
+0x08,0xf0,0x7f,0x00,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x60,0xb4,0x01,
+0x04,0x7f,0x01,0xd1,0xf6,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0xef,0x64,0x01,0x70,
+0x2e,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,0x36,0x75,0x90,
+0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x91,0xe3,0xe4,0xff,0x91,0x97,
+0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,
+0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,0x7b,0xff,0x12,0x36,0xe6,0x7d,
+0x02,0x7f,0x03,0x12,0x36,0xe6,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,
+0xe0,0x44,0x07,0xf0,0x12,0x62,0x4c,0xe5,0x60,0x20,0xe0,0x05,0xe4,0x90,0x9e,0x58,
+0xf0,0x22,0x8b,0x14,0x8a,0x15,0x89,0x16,0x12,0x60,0xb1,0xab,0x14,0xaa,0x15,0xa9,
+0x16,0x12,0x29,0xd9,0xf5,0x63,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,
+0x03,0x70,0x40,0x7f,0x01,0x80,0x3a,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0xe4,0xff,0xd1,0x84,0x80,0x27,0xab,0x14,0xaa,0x15,0xa9,0x16,
+0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x01,0xd1,0x84,0x1f,0x80,0x13,0xab,0x14,
+0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0xd1,0x84,0xe4,
+0xff,0xb1,0xbc,0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x9e,0x65,0x74,
+0x01,0xf0,0x80,0x16,0xed,0x70,0x0a,0x90,0x9e,0x62,0xe0,0x90,0x9e,0x65,0xf0,0x80,
+0x05,0x90,0x9e,0x65,0xed,0xf0,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,0x22,0x53,
+0x61,0xf0,0x43,0x61,0x01,0x12,0x45,0x00,0x12,0x45,0x01,0x53,0x61,0xf0,0x43,0x61,
+0x02,0x22,0x90,0x9e,0xaf,0xef,0xf0,0x12,0x74,0x53,0x90,0x9e,0xaf,0xe0,0x60,0x05,
+0x90,0x05,0x22,0xe4,0xf0,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0x90,0x06,0x04,0xe0,
+0x54,0xbf,0xf0,0xef,0x60,0x09,0xe5,0x60,0xb4,0x01,0x04,0xe4,0xff,0xd1,0xf6,0x53,
+0x61,0xf0,0x43,0x61,0x0c,0x22,0x8f,0x27,0x12,0x45,0xb0,0xbf,0x01,0x22,0x90,0x9e,
+0x7a,0xe0,0xff,0x7d,0x01,0x12,0x47,0x79,0xab,0x07,0xaa,0x06,0xad,0x03,0xac,0x02,
+0xaf,0x27,0x12,0x60,0x2a,0xaf,0x03,0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0x71,0xc3,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x58,
+0xe5,0x64,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,0xe5,0x62,
+0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x39,0xe5,
+0x64,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x64,0x30,0xe4,
+0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x9e,0x58,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x9e,0x5e,0xe0,0x60,0x08,0x90,0x01,0xb9,
+0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,
+0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,0xff,0x90,0x00,0x56,0xe0,
+0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,0x74,0x10,0xf0,0xe5,0x3d,
+0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,0x30,0xe6,0x1b,0x90,0x00,
+0x55,0x74,0x40,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x0b,0x90,0x9e,
+0x3f,0xe0,0x60,0x05,0x7f,0x01,0x12,0x49,0x1a,0xe5,0x3d,0x30,0xe7,0x15,0x90,0x00,
+0x55,0x74,0x80,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x05,0x7f,0x02,
+0x12,0x49,0x1a,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,0x74,0x01,0xf0,0xe5,0x3e,
+0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,0x30,0xe2,0x06,0x90,0x00,
+0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,0x56,0x74,0x08,0xf0,0x90,
+0x01,0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,
+0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,
+0xf0,0xd0,0xe0,0x32,0x90,0x01,0xcc,0xe0,0x54,0x0f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfd,0x70,0x02,0x21,0xb5,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0x7e,0x00,
+0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,
+0x02,0x21,0xae,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1a,0xf0,0x75,0x23,0x01,0x75,0x24,0x9e,0x75,0x25,0x1a,0x75,0x26,
+0x01,0x7b,0x01,0x7a,0x9e,0x79,0x1b,0x12,0x45,0x09,0x90,0x9e,0x1b,0xe0,0xff,0xc4,
+0x13,0x13,0x13,0x54,0x01,0x90,0x9e,0xae,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,
+0x00,0x88,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,
+0x02,0x90,0x00,0x89,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0x90,0x9e,
+0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1f,0xf0,
+0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,
+0x20,0xf0,0x80,0x33,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,
+0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x9e,0x79,
+0x1c,0x31,0xb6,0x90,0x9e,0x19,0xe0,0xff,0x90,0x9e,0xae,0xe0,0xfe,0x74,0x01,0xa8,
+0x06,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0x5f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0xae,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,
+0xcc,0xf0,0x90,0x9e,0xae,0xe0,0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x7e,0x90,0x01,
+0xc6,0xe0,0x44,0x02,0xf0,0x22,0x90,0x9e,0x21,0x12,0x43,0x8b,0xef,0x12,0x43,0x94,
+0x59,0xfc,0x01,0x59,0xf4,0x02,0x5a,0x20,0x03,0x5a,0x29,0x05,0x5a,0x32,0x06,0x5a,
+0x7e,0x07,0x5a,0x3a,0x09,0x5a,0x43,0x0b,0x5a,0x4c,0x0c,0x5a,0x55,0x0d,0x5a,0x5e,
+0x0e,0x5a,0x67,0x1b,0x5a,0x6f,0x1c,0x5a,0x05,0x2d,0x5a,0x0e,0x2e,0x5a,0x17,0x3b,
+0x00,0x00,0x5a,0x77,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xe9,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x71,0xd0,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x0b,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x72,0x53,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x8c,
+0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0xb6,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,
+0x70,0x4a,0x90,0x9e,0x21,0x12,0x43,0x6b,0x80,0x45,0x90,0x9e,0x21,0x12,0x43,0x6b,
+0x02,0x72,0xfe,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x70,0xa2,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x49,0xc2,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x7b,0x16,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x4a,0xfc,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xef,0x90,
+0x9e,0x21,0x12,0x43,0x6b,0xe1,0xd1,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0x90,
+0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x1f,0xfe,0xef,0x54,0x20,0xc4,0x13,0x54,0x07,
+0xfd,0xaf,0x06,0x90,0x9e,0x24,0xef,0xf0,0xa3,0xed,0xf0,0xa3,0x12,0x43,0x8b,0x90,
+0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0xf0,0xc4,0x54,0x0f,
+0x90,0x9e,0x29,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0x54,0x40,0xc4,0x13,0x13,0x54,
+0x03,0x90,0x9e,0x2a,0xf0,0x90,0x9e,0x24,0xe0,0xff,0x75,0xf0,0x09,0x90,0x96,0x46,
+0x12,0x43,0x5f,0xad,0x82,0xac,0x83,0x90,0x9e,0x2b,0xec,0xf0,0xa3,0xed,0xf0,0xef,
+0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,0x35,0xf0,0xfa,0x7b,0x01,0xa3,0x12,
+0x43,0x8b,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x0f,
+0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0xef,0x12,0x42,0x4d,0x90,0x9e,0x26,0x12,0x43,
+0x6b,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0x90,0x00,
+0x01,0xef,0x12,0x42,0x5f,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,
+0x20,0xff,0x90,0x9e,0x2b,0xe0,0xfc,0xa3,0xe0,0xfd,0xf5,0x82,0x8c,0x83,0xef,0xf0,
+0x12,0x29,0xd9,0x8d,0x82,0x8c,0x83,0xa3,0xf0,0x90,0x9e,0x29,0xe0,0xfe,0x90,0x9e,
+0x24,0xe0,0xff,0x24,0x82,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0x90,0x9e,
+0x25,0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4a,0x12,0x43,0x5f,0xee,0xf0,0x75,
+0xf0,0x09,0xef,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x90,0x9e,0x2a,0xe0,
+0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4c,0x12,0x43,0x5f,0xee,0xf0,0x8f,0x14,0xef,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xaf,0x82,0xf5,0x16,0x8f,0x17,0xe5,
+0x14,0x75,0xf0,0x02,0xa4,0x24,0x02,0xf9,0x74,0x95,0x35,0xf0,0x75,0x18,0x01,0xf5,
+0x19,0x89,0x1a,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x46,0x12,0x43,0x5f,0xaf,0x82,
+0x85,0x83,0x1b,0x8f,0x1c,0xe5,0x14,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,
+0x35,0xf0,0x75,0x1d,0x01,0xf5,0x1e,0x89,0x1f,0x74,0x82,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xe0,0x12,0x43,0x94,0x5c,0x0d,0x00,0x5c,0x22,0x01,0x5c,0x37,
+0x02,0x5c,0x4c,0x03,0x5c,0x75,0x04,0x5c,0x8a,0x05,0x5c,0x9f,0x06,0x5c,0xc5,0x0c,
+0x5c,0xf2,0x0d,0x5d,0x1f,0x0e,0x5d,0x4c,0x0f,0x00,0x00,0x5d,0x80,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x15,
+0x80,0x3c,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,
+0xf0,0xf0,0xa3,0x74,0x10,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,
+0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x05,0x80,0x12,0xe5,0x14,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0xe4,0xf0,0xe5,
+0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0f,0xf0,0xa3,
+0x74,0x8f,0xf0,0xa1,0x80,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf5,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,
+0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf0,0x80,0x12,0xe5,
+0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0x74,
+0x0d,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe4,
+0xf0,0xa3,0xf0,0xa1,0x80,0x90,0x04,0x47,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,
+0x42,0x4d,0x90,0x04,0x46,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,
+0x42,0x5f,0x90,0x04,0x45,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x44,
+0xa1,0x77,0x90,0x04,0x4b,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,
+0x04,0x4a,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,
+0x04,0x49,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x48,0x80,0x58,0x90,
+0x04,0x4f,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x4e,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x4d,0xe0,
+0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x4c,0x80,0x2b,0x90,0x04,0x53,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x52,0xe0,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x51,0xe0,0x85,0x17,0x82,
+0x85,0x16,0x83,0xf0,0x90,0x04,0x50,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,0xf0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0xc0,0x03,0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,
+0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x12,0x29,0xd9,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,
+0x12,0x42,0x4d,0xab,0x18,0xe5,0x1a,0x24,0x01,0xf9,0xe4,0x35,0x19,0xfa,0xc0,0x03,
+0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x90,0x00,
+0x01,0x12,0x42,0x20,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,0x12,0x42,0x4d,0x85,0x17,
+0x82,0x85,0x16,0x83,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,
+0xe0,0xfe,0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,
+0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,0xa3,0xe0,0xfe,0xef,
+0x5e,0xd0,0x82,0xd0,0x83,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0x75,0x15,0x0b,0x74,0x01,0x7e,
+0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,
+0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x5d,0x15,0x15,0xe5,0x15,0xc3,0x94,
+0x00,0x50,0xca,0x80,0x56,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3d,0x75,0x15,0x0f,0x74,0x01,0x7e,0x00,
+0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,
+0x4e,0x60,0x08,0x90,0x9e,0x30,0xe5,0x15,0xf0,0x80,0x10,0x15,0x15,0xe5,0x15,0xc3,
+0x94,0x00,0x50,0xc8,0x80,0x05,0xe4,0x90,0x9e,0x30,0xf0,0xe5,0x14,0x25,0xe0,0x24,
+0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0xe4,
+0xf5,0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,
+0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x08,0x90,0x9e,0x31,0xe5,0x15,0xf0,0x80,
+0x5b,0x05,0x15,0xe5,0x15,0xb4,0x10,0xca,0x80,0x52,0xe5,0x14,0x25,0xe0,0x24,0x02,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x39,0xe4,0xf5,
+0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,
+0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x0a,0x05,0x15,
+0xe5,0x15,0xb4,0x0c,0xcc,0x80,0x05,0xe4,0x90,0x9e,0x31,0xf0,0x90,0x9e,0x30,0xe0,
+0xff,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,0x43,0x5f,0xef,0xf0,0x90,0x9e,
+0x31,0xe0,0xfe,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x49,0x12,0x43,0x5f,0xee,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0xd3,0x9f,0x40,0x06,
+0x90,0x9e,0x30,0x12,0x62,0x94,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,
+0x83,0xe0,0xff,0x90,0x9e,0x31,0xe0,0xfe,0xef,0xc3,0x9e,0x50,0x03,0x12,0x62,0x94,
+0x90,0x9e,0x30,0xe0,0xff,0xd3,0x94,0x13,0x40,0x07,0x90,0x96,0x43,0x74,0x03,0xf0,
+0x22,0xef,0xd3,0x94,0x0b,0x40,0x07,0x90,0x96,0x43,0x74,0x02,0xf0,0x22,0xef,0xd3,
+0x94,0x03,0x40,0x07,0x90,0x96,0x43,0x74,0x01,0xf0,0x22,0xe4,0x90,0x96,0x43,0xf0,
+0x22,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x3f,0xfe,0xef,0x54,0x80,0xc4,0x13,
+0x13,0x13,0x54,0x01,0xfd,0xaf,0x06,0x41,0x93,0x12,0x29,0xd9,0xf5,0x60,0x22,0x12,
+0x29,0xd9,0x90,0x95,0x01,0xf0,0x22,0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x22,0xe4,0xf5,0x60,0xf5,0x64,
+0xf5,0x63,0x75,0x62,0x0c,0x75,0x61,0x0c,0x90,0x9e,0x66,0xf0,0x90,0x9e,0x64,0xf0,
+0x90,0x9e,0x63,0xf0,0x90,0x9e,0x65,0x04,0xf0,0x90,0x9e,0x56,0xf0,0xe4,0x90,0x9e,
+0x67,0xf0,0x90,0x9e,0x58,0xf0,0x90,0x9e,0x61,0x74,0x07,0xf0,0xe4,0x90,0x9e,0x57,
+0xf0,0x90,0x9e,0x5f,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x9e,0x5c,0x74,0x0a,0xf0,0xa3,
+0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,0x05,0xf0,0xe4,
+0x90,0x9e,0x5a,0xf0,0x90,0x9e,0x55,0xf0,0x90,0x9e,0x7f,0xf0,0x90,0x9e,0x5e,0xf0,
+0x22,0xe4,0x90,0x9e,0x67,0xf0,0x90,0x9e,0x57,0xf0,0xf5,0x64,0x22,0x7f,0x00,0x22,
+0xe5,0x62,0x30,0xe6,0x19,0xe5,0x62,0x54,0x0f,0xff,0x90,0x9e,0x54,0xe0,0xfe,0x4f,
+0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,0x9e,0x54,0xf0,0x53,0x62,0xbf,0x22,0xe5,
+0x60,0x64,0x01,0x70,0x68,0xe5,0x63,0x60,0x64,0xe5,0x63,0x64,0x02,0x60,0x06,0xe5,
+0x63,0x64,0x05,0x70,0x27,0x90,0x06,0xab,0xe0,0x90,0x9e,0x56,0xf0,0x90,0x06,0xaa,
+0xe0,0x90,0x9e,0x65,0xf0,0x90,0x9e,0x56,0xe0,0x70,0x07,0x90,0x9e,0x65,0xe0,0xff,
+0x80,0x05,0x90,0x9e,0x56,0xe0,0xff,0x90,0x9e,0x56,0xef,0xf0,0x90,0x9e,0x58,0xe0,
+0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,0x9e,0x57,0xf0,0x90,0x05,0x58,0x74,0x03,0xf0,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x64,0xfd,0x53,0x64,
+0xef,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0x53,0x22,0xe4,0xfb,
+0x90,0x9e,0x9c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,0x60,0x6a,0xe5,0x60,
+0x64,0x01,0x70,0x64,0xe5,0x63,0x14,0x60,0x2b,0x24,0xfd,0x60,0x27,0x24,0x02,0x24,
+0xfb,0x50,0x02,0x80,0x21,0x90,0x9e,0x56,0xe0,0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,
+0x60,0x14,0x90,0x9e,0x56,0xe0,0x70,0x08,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,
+0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x2f,0x43,0x64,0x10,0xe4,0x90,0x9e,0x85,
+0xf0,0x90,0x9e,0x57,0xe0,0x75,0xf0,0x03,0xa4,0xff,0x90,0x9e,0x61,0xe0,0x2f,0x12,
+0x44,0x53,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,
+0x07,0x7d,0x01,0x7f,0x04,0x12,0x54,0xe7,0x22,0xe4,0x90,0x9e,0x15,0xf0,0xe5,0x63,
+0x60,0x79,0x90,0x9e,0x67,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x64,0xfd,0xe5,0x64,0x54,
+0x07,0x70,0x68,0x80,0x63,0x90,0x9e,0x57,0xe0,0x04,0xf0,0x53,0x64,0xef,0x90,0x9e,
+0x15,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,0x33,0xfc,0x90,0x9e,0x57,0xe0,
+0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,0x24,0x02,0xff,0xe4,0x3e,0xfe,
+0x90,0x9e,0x57,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,0x06,0x90,0x05,0x58,0xe0,0x04,
+0xf0,0xe9,0xff,0x90,0x9e,0x5c,0xe0,0x2f,0xff,0xe4,0x33,0xfe,0x90,0x9e,0x57,0xe0,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,0x0d,0xe5,0x60,0xb4,0x01,0x0b,
+0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,0xcb,0x22,0x90,0x9e,0x5f,0xe0,
+0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,
+0x93,0x12,0x43,0x8b,0x90,0x9e,0x96,0xe0,0x54,0xf0,0x44,0x06,0xff,0xf0,0xed,0x54,
+0x0f,0xc4,0x54,0xf0,0xfe,0xef,0x54,0x0f,0x4e,0xf0,0x90,0x9e,0x93,0x12,0x43,0x6b,
+0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x96,0x12,0x53,0xf1,0xd0,
+0xd0,0x92,0xaf,0x22,0xe0,0xfd,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9d,0xf5,
+0x83,0xed,0xf0,0xaf,0x14,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xef,0xc3,0x94,0x20,
+0x50,0x0e,0x74,0x84,0x2f,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xed,0xf0,0x80,0x29,
+0x74,0xa6,0x2f,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xed,0xf0,0x90,0x9e,0x68,0xef,
+0xf0,0x24,0xa6,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x90,0x9e,0x69,0xf0,0x7b,
+0x01,0x7a,0x9e,0x79,0x68,0x7d,0x02,0x51,0x57,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x0a,
+0x8d,0x0b,0xe5,0x0b,0x54,0x1f,0xf5,0x10,0x74,0x01,0x2f,0xf5,0x82,0xe4,0x34,0x94,
+0xf5,0x83,0xe0,0xf5,0x0e,0x90,0x04,0xfd,0xe0,0xb4,0x01,0x05,0x75,0x11,0x03,0x80,
+0x03,0x75,0x11,0x01,0xeb,0xc3,0x95,0x11,0x40,0x04,0xaf,0x0a,0x80,0x33,0xe5,0x0e,
+0x25,0x0d,0xf5,0x0f,0xe5,0x10,0x90,0x41,0xd6,0x93,0xff,0xe5,0x0f,0xd3,0x9f,0x74,
+0x01,0x40,0x11,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe4,0xf0,0xad,0x0b,
+0xaf,0x0a,0x41,0xa5,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe5,0x0f,0xf0,
+0x22,0xad,0x07,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x74,
+0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xe0,0x54,0x1f,0xf5,0x12,0xd3,0x9f,
+0x40,0x02,0x8f,0x12,0xe5,0x12,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x12,0x25,0xe0,0x24,0x66,0xf5,0x82,
+0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,
+0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,
+0xf0,0xa3,0xef,0xf0,0xaf,0x05,0xad,0x12,0x51,0xa5,0xaf,0x12,0x22,0xac,0x07,0xec,
+0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2c,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x80,0x0b,0x74,0xa6,0x2c,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,
+0x1f,0xe5,0x1f,0x54,0x1f,0xff,0x90,0x9e,0x25,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,
+0x49,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x27,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,0x48,
+0x12,0x43,0x5f,0xe0,0xfe,0x90,0x9e,0x28,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x29,0xcb,0xf0,0xa3,0xeb,
+0xf0,0xec,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfb,0xa3,
+0xe0,0x90,0x9e,0x2b,0xcb,0xf0,0xa3,0xeb,0xf0,0xef,0xd3,0x9e,0x40,0x0a,0x90,0x9e,
+0x28,0xe0,0x90,0x9e,0x25,0xf0,0xf5,0x1f,0xed,0x70,0x02,0xa1,0x13,0x90,0x9e,0x26,
+0xed,0xf0,0xe5,0x1f,0x30,0xe6,0x0a,0x90,0x9e,0x25,0xe0,0xf5,0x1f,0xa3,0xe0,0x14,
+0xf0,0x90,0x9e,0x26,0xe0,0x70,0x02,0xa1,0x13,0x90,0x9e,0x25,0xe0,0xff,0xd3,0x94,
+0x00,0x50,0x02,0xa1,0x13,0xe4,0x90,0x9e,0x24,0xf0,0xef,0x14,0x90,0x9e,0x23,0xf0,
+0x90,0x9e,0x27,0xe0,0xfd,0x90,0x9e,0x23,0xe0,0xff,0xd3,0x9d,0x40,0x6b,0xef,0x94,
+0x10,0x40,0x21,0xef,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x2b,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x70,0x27,0x90,0x9e,0x23,0xe0,0xff,0xc3,0x94,0x10,0x50,0x33,0x74,0x01,
+0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,
+0x9e,0x29,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x16,0x90,0x9e,0x23,0xe0,0xf5,
+0x1f,0xa3,0xe0,0x04,0xf0,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,0x24,0xe0,0x6f,0x60,
+0x08,0x90,0x9e,0x23,0xe0,0x14,0xf0,0x80,0x87,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,
+0x24,0xe0,0xc3,0x9f,0x50,0x0d,0x90,0x9e,0x23,0xe0,0xb5,0x05,0x06,0x90,0x9e,0x27,
+0xe0,0xf5,0x1f,0xe5,0x1f,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,
+0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x1f,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xec,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x04,0xad,0x1f,0x51,0xa5,0xaf,0x1f,0x22,0xad,0x07,0xed,0xc3,
+0x94,0x20,0x50,0x0d,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x80,
+0x0b,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,0x1f,
+0xe5,0x1f,0x54,0x1f,0xfc,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,
+0xff,0x90,0x9e,0x23,0xf0,0xed,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,
+0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x24,0xcb,0xf0,0xa3,0xeb,0xf0,0xed,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x26,
+0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfa,0x74,0x01,0x93,0xfb,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xea,0xf0,0xa3,0xeb,0xf0,0xec,0xc3,0x9f,0x40,0x02,0xc1,0x7a,
+0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x04,0xfb,0x90,0x9e,
+0x23,0xe0,0xff,0xeb,0xd3,0x9f,0x40,0x02,0xc1,0xab,0xeb,0xc3,0x94,0x10,0x40,0x21,
+0xeb,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x24,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x70,
+0x23,0xeb,0xc3,0x94,0x10,0x50,0x40,0x74,0x01,0x7e,0x00,0xa8,0x03,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x26,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x23,0xbb,0x11,0x09,0x90,0x9e,0x25,0xe0,0x30,0xe7,0x02,0x7b,0x17,
+0xeb,0x64,0x13,0x60,0x03,0xbb,0x12,0x09,0x90,0x9e,0x24,0xe0,0x30,0xe0,0x02,0x7b,
+0x18,0xac,0x03,0x8c,0x1f,0x80,0x34,0x0b,0x80,0x84,0x90,0x9e,0x23,0xe0,0xfb,0x6c,
+0x70,0x69,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x75,0xf0,
+0x09,0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,0xe0,0xb4,0x01,0x0c,0xe5,0x1f,0x20,0xe6,
+0x07,0xec,0x44,0x40,0xf5,0x1f,0x80,0x03,0xaf,0x1f,0x22,0xec,0x25,0xe0,0x24,0x9e,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,
+0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,
+0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x80,0x5b,0xec,0xd3,0x9b,0x40,0x56,
+0x90,0x9e,0x23,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,
+0xf0,0xac,0x07,0x8f,0x1f,0xec,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x1f,0x22,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,
+0xe4,0xf0,0xaf,0x05,0xe5,0x1f,0x44,0x80,0xfd,0x51,0xa5,0xe5,0x1f,0x44,0x80,0xff,
+0x22,0xef,0xc3,0x94,0x20,0x50,0x39,0xef,0x30,0xe0,0x17,0xed,0xc4,0x54,0xf0,0xfd,
+0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x54,0x0f,
+0x80,0x10,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x54,0xf0,0xf0,0x74,0xa4,0x2e,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x4d,0xf0,
+0x22,0xe4,0xf5,0x14,0xe5,0x14,0xb4,0x20,0x14,0x90,0x9a,0xc5,0xe0,0x04,0xf0,0x90,
+0x95,0x01,0xe0,0xff,0x90,0x9a,0xc5,0xe0,0xb5,0x07,0x02,0xe4,0xf0,0x75,0xf0,0x09,
+0xe5,0x14,0x90,0x96,0x4b,0x12,0x43,0x5f,0xe0,0x64,0x01,0x60,0x03,0x02,0x6e,0x6a,
+0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xfe,0xa3,
+0xe0,0xd3,0x94,0x00,0xee,0x94,0x00,0x50,0x03,0x02,0x6e,0x6a,0xe5,0x14,0x94,0x20,
+0x40,0x09,0x90,0x9a,0xc5,0xe0,0x60,0x03,0x02,0x6e,0x76,0xe5,0x14,0x75,0xf0,0x0a,
+0xa4,0x24,0x00,0xf9,0x74,0x90,0x35,0xf0,0x75,0x18,0x01,0xf5,0x19,0x89,0x1a,0xe5,
+0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xff,0xa3,0xe0,
+0x90,0x9e,0x1b,0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x1d,0xcf,0xf0,0xa3,0xef,
+0xf0,0xe5,0x14,0xc3,0x94,0x20,0x50,0x14,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x80,0x12,0x74,0xa6,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfe,0x54,0x1f,0xa3,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x20,0xf0,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe0,0xc3,0x94,0x05,0x40,0x02,0x41,0x9f,0x90,0x9e,0x20,0xe0,0xff,0x90,
+0x9e,0x1a,0xe0,0x9f,0x40,0x13,0x90,0x9e,0x20,0xe0,0x90,0x9e,0x1a,0xf0,0xee,0x54,
+0x40,0xfe,0x90,0x9e,0x19,0xf0,0xef,0x4e,0xf0,0x90,0x04,0xfd,0xe0,0x54,0x05,0x64,
+0x01,0x70,0x29,0x90,0x9e,0x1a,0xe0,0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x40,
+0xda,0x80,0x30,0x90,0x9e,0x1a,0xe0,0x90,0x40,0xf6,0x80,0x27,0x90,0x9e,0x1a,0xe0,
+0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,
+0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x41,0x12,0x80,0x07,0x90,0x9e,0x1a,0xe0,
+0x90,0x41,0x2e,0x93,0x90,0x9e,0x1f,0xf0,0x90,0x9e,0x1f,0xe0,0x75,0xf0,0x06,0xa4,
+0x24,0x50,0xf9,0x74,0x40,0x35,0xf0,0xfa,0x7b,0xff,0x8b,0x15,0xf5,0x16,0x89,0x17,
+0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xf5,0x1b,
+0xa3,0xe0,0xf5,0x1c,0x12,0x29,0xd9,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,
+0x12,0x42,0x97,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,
+0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x02,0x12,0x42,0xc2,0xfd,0xac,
+0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,
+0xaa,0x16,0xa9,0x17,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x04,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,
+0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,
+0x00,0x03,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,
+0x06,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,
+0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x04,0x12,0x42,0x20,
+0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x08,0x12,0x42,0xc2,0xfd,
+0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,
+0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x05,0x12,0x42,0x20,0xff,0x7e,0x00,0x90,0x9e,
+0x1b,0xe0,0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0xd3,0xe5,0x1c,0x9f,0xe5,0x1b,0x9e,
+0x40,0x0c,0xe5,0x1c,0x9f,0xf5,0x1c,0xe5,0x1b,0x9e,0xf5,0x1b,0x80,0x05,0xe4,0xf5,
+0x1b,0xf5,0x1c,0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe5,0x1b,0xf0,0xa3,0xe5,0x1c,0xf0,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,0x66,0xf5,
+0x82,0xe4,0x34,0x41,0xf5,0x83,0xc3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,0x95,0x1b,
+0x50,0x07,0xaf,0x14,0x12,0x65,0x5c,0xa1,0x31,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,
+0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xd3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,
+0x95,0x1b,0x50,0x02,0xa1,0x31,0x7d,0x01,0xaf,0x14,0x12,0x63,0xbd,0xa1,0x31,0x74,
+0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xfc,0x64,0x05,0x60,0x02,
+0x81,0x3a,0x90,0x96,0x43,0xe0,0xff,0xb4,0x03,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x19,0x40,0x3d,0x80,0x2e,0xef,0xb4,0x02,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,0x11,
+0x40,0x2e,0x80,0x1f,0x90,0x96,0x43,0xe0,0xff,0xb4,0x01,0x0b,0x90,0x9e,0x1a,0xe0,
+0xc3,0x94,0x0a,0x40,0x1b,0x80,0x0c,0xef,0x70,0x11,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x03,0x40,0x0d,0x90,0x9a,0x84,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9a,0x84,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0x74,0x44,
+0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xc3,0x94,0x30,0x50,0x02,
+0x61,0xe7,0x90,0x9a,0x84,0xe0,0x64,0x01,0x60,0x02,0x61,0xe7,0x74,0x85,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0x64,0x0a,0x60,0x51,0xef,0x24,0x05,0xff,
+0xe4,0x33,0xfe,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xfd,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x32,0xed,0x24,0x05,0xff,0xe4,
+0x33,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xd3,0x9f,
+0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x14,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9d,0xf5,0x83,0xe0,0xff,0x90,0x9e,0x1a,0xe0,0x6f,0x60,0x3d,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xd3,0x94,0x42,0x40,0x05,0x75,
+0x1e,0x05,0x80,0x0e,0xef,0xd3,0x94,0x39,0x40,0x05,0x75,0x1e,0x03,0x80,0x03,0x75,
+0x1e,0x01,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xef,0xf0,0x74,
+0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0x80,0x29,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe0,0x04,0xf0,0x80,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1a,0xe0,0xff,0x74,0x26,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x4c,0x12,
+0x43,0x5f,0xe0,0xb4,0x01,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0xad,0x1e,0xa1,0x2c,0xec,0x64,0x06,0x60,0x02,0xa1,
+0x31,0xf5,0x1b,0xf5,0x1c,0x90,0x42,0x13,0x93,0xff,0x7e,0x00,0x90,0x9e,0x1b,0xe0,
+0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0x90,0x9e,0x21,0xee,0xf0,0xa3,0xef,0xf0,0x74,
+0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0xe4,0xf5,0x1d,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x75,0xf0,0x02,0xe5,0x1d,0xa4,0xf5,0x82,0x85,0xf0,
+0x83,0x12,0x42,0xc2,0xfd,0xac,0xf0,0xe5,0x1d,0x90,0x42,0x0e,0x93,0xff,0x7e,0x00,
+0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xc3,0x90,0x9e,
+0x22,0xe0,0x95,0x1c,0x90,0x9e,0x21,0xe0,0x95,0x1b,0x40,0x07,0x05,0x1d,0xe5,0x1d,
+0xb4,0x05,0xbd,0xe5,0x1d,0xc3,0x13,0xf5,0x1d,0xe5,0x1e,0xb4,0x01,0x06,0xe5,0x1d,
+0x70,0x46,0x80,0x13,0xe5,0x1e,0xb4,0x03,0x15,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x03,
+0x80,0x39,0xe5,0x1d,0xb4,0x01,0x05,0x75,0x1e,0x01,0x80,0x2f,0x80,0x2a,0xe5,0x1e,
+0xb4,0x05,0x28,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x05,0x80,0x0d,0xe5,0x1d,0xb4,0x01,
+0x05,0x75,0x1e,0x03,0x80,0x03,0x75,0x1e,0x01,0xd3,0x90,0x9e,0x1e,0xe0,0x94,0x03,
+0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0xd3,0x90,0x9e,0x1e,0xe0,
+0x94,0x03,0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0x74,0x84,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0xfd,0xaf,0x14,0x12,0x67,
+0x61,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xd3,0x94,0x05,
+0x74,0xe6,0x50,0x0e,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x04,0xf0,
+0x80,0x0b,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1d,
+0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,
+0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,0x10,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0x74,0xff,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,
+0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,
+0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,
+0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,
+0x10,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xff,0xf0,0xa3,
+0xf0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0xe4,0xf5,0xf0,0x12,0x42,0xfa,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x02,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x04,0xe4,
+0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x06,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,
+0x08,0xe4,0xf5,0xf0,0x12,0x43,0x19,0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0x05,0x14,0xe5,0x14,0xc3,0x94,
+0x40,0x50,0x03,0x02,0x67,0xa4,0x22,0x90,0x04,0x44,0x74,0x11,0xf0,0xa3,0x74,0xf0,
+0xf0,0xa3,0x74,0x0f,0xf0,0xa3,0xe4,0xf0,0xfd,0x74,0xa4,0x2d,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe4,0xf0,0x0d,0xbd,0x10,0xf0,0xe4,0x90,0x9a,0xc5,0xf0,0x90,0x95,
+0x01,0x04,0xf0,0xe4,0xfd,0x75,0xf0,0x0a,0xed,0x90,0x90,0x00,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x02,0x12,0x43,0x5f,0xe4,0xf0,0xa3,
+0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x04,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,
+0xf0,0x0a,0xed,0x90,0x90,0x06,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,
+0xed,0x90,0x90,0x08,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x74,0x26,0x2d,0xf5,0x82,
+0xe4,0x34,0x9d,0xf5,0x83,0x74,0x13,0xf0,0x74,0x85,0x2d,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe4,0xf0,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,
+0xed,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0x74,0x86,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x46,0x2d,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0xe6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe4,0xf0,0x90,0x41,0xc4,0x93,0xfe,0x74,0x01,0x93,0xff,0x90,0x41,0x8c,
+0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,
+0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x75,0xf0,0x09,0xed,
+0x90,0x96,0x4a,0x12,0x43,0x5f,0x74,0x01,0xf0,0x74,0x82,0x2d,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0x74,0x0c,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x46,0x12,0x43,0x5f,
+0x74,0xff,0xf0,0xa3,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x44,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0x74,0x0f,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0x74,
+0x13,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x49,0x12,0x43,0x5f,0xe4,0xf0,0xed,0xc3,
+0x94,0x20,0x50,0x0f,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0x74,0x13,
+0xf0,0x80,0x0d,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0x74,0x13,0xf0,
+0x0d,0xed,0x64,0x40,0x60,0x03,0x02,0x6e,0xa5,0x22,0x12,0x29,0xd9,0xf5,0x14,0xc3,
+0x94,0x40,0x50,0x15,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x74,0x44,0x25,0x14,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xef,0xf0,0x22,0xe5,0x14,0xb4,0x40,0x0a,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x96,0x42,0xf0,0x22,0x90,0x9e,0x30,0x12,0x43,0x8b,0x90,
+0x9e,0x33,0xe0,0x54,0xf0,0x44,0x02,0xf0,0x54,0x0f,0x44,0xc0,0xf0,0x90,0x9e,0x30,
+0x12,0x43,0x6b,0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x33,0x02,
+0x53,0xf1,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x90,0x00,0x01,0x12,0x42,0x20,0xfc,
+0xed,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfd,0xec,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfc,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,
+0xfb,0xea,0x90,0x9e,0x24,0xf0,0xeb,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x26,0xf0,0xeb,
+0xa3,0xf0,0xa3,0xed,0xf0,0xa3,0x74,0xff,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2a,0xf0,0xeb,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,
+0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2c,0xf0,0xeb,0xa3,0xf0,0xa3,0xec,0xf0,0xa3,0x74,
+0xff,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0x7b,0x01,0x7a,0x9e,0x79,0x24,0x01,0x79,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0xa4,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,
+0xa4,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x9e,0xa7,
+0xe0,0x94,0xe8,0x90,0x9e,0xa6,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,0x44,
+0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x9e,0xa6,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,
+0x7f,0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x9e,0x66,0xf0,0x90,0x00,0x03,0x12,0x42,
+0x20,0x90,0x9e,0x55,0xf0,0x12,0x56,0x22,0x90,0x01,0xe5,0xe5,0x63,0xf0,0x90,0x9e,
+0x66,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0xff,0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x9e,0x5c,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x90,0x9e,0x5d,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x5b,0xf0,0x90,
+0x00,0x03,0x12,0x42,0x20,0x90,0x9e,0x62,0xf0,0x22,0x90,0x9e,0x5c,0x74,0x0a,0xf0,
+0x90,0x9e,0x5d,0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,
+0x05,0xf0,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x61,
+0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0xef,0xf0,
+0x80,0x0f,0x90,0x9e,0x61,0x74,0x07,0xf0,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0x74,0x03,
+0xf0,0x90,0x9e,0x5f,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x9e,0x24,0x12,
+0x2a,0x8b,0x00,0x00,0x00,0x00,0x12,0x29,0xd9,0x60,0x0d,0x90,0x9e,0x5e,0xf0,0xe4,
+0xfd,0x7f,0x04,0x12,0x54,0xe7,0x80,0x05,0xe4,0x90,0x9e,0x5e,0xf0,0x90,0x9e,0x5e,
+0xe0,0x90,0x01,0xe7,0xf0,0x22,0x90,0x02,0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,
+0x05,0xed,0x2e,0x90,0x9e,0x78,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,
+0x90,0x9e,0x79,0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7a,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7b,0xf0,0x90,0x00,
+0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,0x2f,0x90,0x9e,0x7c,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x43,0x8b,0x90,0x9e,0x24,0x12,0x43,
+0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x43,0x19,0x12,
+0x29,0xd9,0xff,0x60,0x2d,0xb5,0x65,0x16,0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,
+0x01,0x12,0x42,0xc2,0x65,0x67,0x70,0x04,0xe5,0x66,0x65,0xf0,0x60,0x24,0x90,0x9e,
+0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xff,0xae,0xf0,0x12,0x4e,0x37,
+0x80,0x10,0x90,0x9e,0x24,0x12,0x43,0x6b,0x12,0x29,0xd9,0x65,0x65,0x60,0x03,0x12,
+0x44,0xc2,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x24,0x14,0x70,0x1a,0x7b,0x01,
+0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x71,0xb0,0xbf,0x01,0x09,0x90,0x06,0x35,
+0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0x80,0xcd,0xe4,0x90,0x06,0x34,0xf0,0x22,
+0x8e,0x14,0x8f,0x15,0x8b,0x16,0x8a,0x17,0x89,0x18,0xe4,0x90,0x9e,0x19,0xf0,0xef,
+0x90,0x00,0x31,0xf0,0x12,0x4d,0x45,0xe5,0x14,0x54,0x03,0xff,0x90,0x00,0x32,0xe0,
+0x54,0xfc,0x4f,0xf0,0x12,0x4d,0x45,0x90,0x00,0x33,0xe0,0x54,0x7f,0xf0,0x12,0x4d,
+0x45,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,
+0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,0x10,0x90,
+0x00,0x30,0xe0,0xab,0x16,0xaa,0x17,0xa9,0x18,0x12,0x42,0x4d,0x7f,0x01,0x22,0x7f,
+0x00,0x22,0xe4,0x90,0x9e,0xac,0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,
+0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,
+0x9e,0xad,0xe0,0x94,0xe8,0x90,0x9e,0xac,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,
+0x7f,0x32,0x7e,0x00,0x12,0x37,0x54,0x90,0x9e,0xac,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x80,0xc6,0x90,0x9d,0xff,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x03,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9e,0x07,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x0b,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,
+0x9e,0x80,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,
+0xe4,0xfd,0x7f,0x01,0x12,0x34,0x81,0x22,0x7f,0x78,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x9d,0xff,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,0x03,0x12,
+0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0x07,0x12,0x2a,0x7f,0x90,
+0x9e,0x80,0xe0,0x90,0x9d,0xff,0xb4,0x01,0x0d,0x12,0x43,0x53,0xef,0x54,0xc7,0xff,
+0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xec,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x03,0x12,0x43,
+0x53,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,
+0x12,0x2f,0xd9,0x90,0x9e,0x07,0x12,0x43,0x53,0xef,0x44,0x02,0xff,0xec,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x9e,0x0b,0x12,0x2a,0x7f,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,
+0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,
+0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x11,
+0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0x7f,0x01,0x12,0x34,
+0x81,0x22,0xef,0x70,0x02,0xe1,0x49,0x90,0x9e,0x0f,0xe0,0x60,0x03,0x02,0x7b,0x15,
+0x90,0x9d,0xfb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,
+0x12,0x2f,0xd9,0x90,0x9d,0xa7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xab,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xaf,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xb3,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x9d,0xb7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x9d,0xbb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xbf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xc3,0x12,0x43,0x53,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xc7,0x12,0x43,
+0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,
+0xcb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x9d,0xcf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd7,0x12,0x43,0x53,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xdb,0x12,0x43,0x53,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xdf,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x9d,0xe3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x9d,0xe7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xeb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9d,0xef,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x90,0x9d,0xf3,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x90,
+0x9d,0xf7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,
+0x2f,0xd9,0x90,0x9e,0x0f,0x74,0x01,0xf0,0x22,0x90,0x9e,0x0f,0xe0,0x64,0x01,0x60,
+0x03,0x02,0x7b,0x15,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xfb,0x12,0x2a,
+0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xa7,0x12,0x2a,0x7f,0x7f,0x5c,
+0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xab,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x9d,0xaf,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x9d,0xb3,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xb7,0x12,
+0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbb,0x12,0x2a,0x7f,0x7f,
+0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbf,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x9d,0xc3,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x9d,0xc7,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xcb,
+0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xcf,0x12,0x2a,0x7f,
+0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xd3,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x9d,0xd7,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x9d,0xdb,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,
+0xdf,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xe3,0x12,0x2a,
+0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xe7,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0c,0x12,0x27,0xde,0x90,0x9d,0xeb,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,
+0x27,0xde,0x90,0x9d,0xef,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,0x90,
+0x9d,0xf3,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xf7,0x12,
+0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,
+0x9e,0xa8,0x12,0x43,0x53,0xed,0x44,0xc0,0xfd,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,
+0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,0x7f,0x44,0x7e,
+0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,0xa4,0x7f,0x5c,
+0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,
+0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,
+0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,
+0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,
+0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x04,
+0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xe0,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,0x7f,0xec,0x7e,
+0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,
+0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,
+0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,
+0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,
+0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,
+0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa8,0x12,
+0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,0xa8,0x12,
+0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x54,0x0f,0xfd,0xec,0x54,0xf0,
+0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x44,0x10,
+0xfd,0xec,0x44,0x01,0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,
+0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x04,
+0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,
+0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,
+0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x2f,0xd9,
+0xe4,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x43,0xf0,
+0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x14,0xc2,0xaf,0x90,
+0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x49,0x05,0x7d,0x40,0x7f,0x01,0x12,
+0x36,0xaf,0xe5,0x14,0x24,0xff,0x92,0xaf,0x22,0x90,0x9e,0x3a,0xe0,0xc3,0x94,0x14,
+0x50,0x05,0xe0,0x04,0xf0,0x81,0x01,0x90,0x9e,0x3a,0xe0,0x64,0x14,0x60,0x02,0x81,
+0x01,0x90,0x9e,0x49,0xe0,0x70,0x25,0x90,0x9e,0x4c,0xe0,0x70,0x1f,0x90,0x9e,0x4a,
+0xe0,0x70,0x19,0x90,0x9e,0x4d,0xe0,0x70,0x13,0x90,0x9e,0x4b,0xe0,0x70,0x0d,0x90,
+0x9e,0x4e,0xe0,0x70,0x07,0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,0x9e,0x49,0xe0,
+0x90,0x04,0x44,0xf0,0x90,0x9e,0x4a,0xe0,0x90,0x04,0x45,0xf0,0x90,0x9e,0x4b,0xe0,
+0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x4c,0xe0,0x90,0x04,0x48,0xf0,0x90,
+0x9e,0x4d,0xe0,0x90,0x04,0x49,0xf0,0x90,0x9e,0x4e,0xe0,0x90,0x04,0x4a,0xf0,0xa3,
+0xe4,0xf0,0x90,0x9e,0x35,0xe0,0x90,0x04,0x4c,0xf0,0x90,0x9e,0x36,0xe0,0x90,0x04,
+0x4d,0xf0,0x90,0x9e,0x37,0xe0,0x90,0x04,0x4e,0xf0,0x90,0x9e,0x38,0xe0,0x90,0x04,
+0x4f,0xf0,0xe4,0x90,0x9e,0x3a,0xf0,0x90,0x9e,0x35,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x9e,0x49,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x19,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x1a,
+0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x1b,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x1c,
+0xf0,0x90,0x9e,0x52,0xe0,0xff,0x90,0x9e,0x1c,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,
+0x9e,0x52,0xe0,0xc3,0x9e,0xd3,0x94,0x01,0x40,0x11,0x90,0x9e,0x40,0xe0,0xb4,0x01,
+0x02,0x80,0x03,0x90,0x9e,0x44,0xe0,0xff,0x12,0x4c,0xf0,0x22,0x90,0x9e,0x53,0xe0,
+0x64,0x01,0x60,0x08,0x90,0x9e,0x41,0xe0,0x60,0x02,0xa1,0x23,0x90,0x9e,0x35,0xe0,
+0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x9e,0x36,0xe0,0xc3,0x94,
+0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x28,0x90,0x9e,0x37,0xe0,0xc3,0x94,0xff,
+0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x36,0xf0,0x80,0x15,0x90,0x9e,0x38,0xe0,
+0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x37,0xf0,0x90,0x9e,0x36,
+0xf0,0x90,0x9e,0x35,0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,
+0x32,0x90,0x9e,0x49,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,
+0x9e,0x4a,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,
+0x4b,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x4a,0xf0,0x90,
+0x9e,0x49,0xf0,0x90,0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x9e,0x4c,0xe0,0xc3,0x94,
+0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x9e,0x4d,0xe0,0xc3,0x94,0xff,0x50,
+0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,0x4e,0xe0,0xc3,0x94,0xff,0x50,0x0c,
+0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4c,0xf0,0x90,0x04,0xfd,0xe0,
+0x44,0x01,0xf0,0x22,0x68,0x4c,};
+#else
+// =================== v88 TSMC P2PPS with CCX report C2H 2012-12-05 =======================
+u8 Rtl8192CUFwTSMCImgArray[TSMCImgArrayLength] = {
+0xC1, 0x88, 0x02, 0x05, 0x58, 0x00, 0x02, 0x00, 0x12, 0x05, 0x17, 0x12, 0xDE, 0x3E, 0x00, 0x00,
+0x94, 0x18, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x02, 0x46, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x60, 0xF2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x68, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x4B, 0x87, 0x00, 0x00,
+0x05, 0x04, 0x03, 0x02, 0x00, 0x03, 0x06, 0x05, 0x04, 0x03, 0x00, 0x04, 0x06, 0x05, 0x04, 0x02,
+0x00, 0x04, 0x08, 0x07, 0x06, 0x04, 0x00, 0x06, 0x0A, 0x09, 0x08, 0x06, 0x00, 0x08, 0x0A, 0x09,
+0x08, 0x04, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x02, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x00, 0x00, 0x08,
+0x12, 0x11, 0x10, 0x08, 0x00, 0x10, 0x1A, 0x19, 0x18, 0x10, 0x00, 0x18, 0x22, 0x21, 0x20, 0x18,
+0x00, 0x20, 0x22, 0x21, 0x20, 0x10, 0x00, 0x20, 0x22, 0x21, 0x20, 0x08, 0x00, 0x20, 0x22, 0x21,
+0x1C, 0x08, 0x00, 0x20, 0x22, 0x21, 0x14, 0x08, 0x00, 0x20, 0x22, 0x20, 0x18, 0x08, 0x00, 0x20,
+0x31, 0x30, 0x20, 0x10, 0x00, 0x30, 0x31, 0x30, 0x18, 0x00, 0x00, 0x30, 0x31, 0x2F, 0x10, 0x10,
+0x00, 0x30, 0x31, 0x2C, 0x10, 0x10, 0x00, 0x30, 0x31, 0x28, 0x10, 0x00, 0x00, 0x30, 0x31, 0x20,
+0x10, 0x00, 0x00, 0x30, 0x31, 0x10, 0x10, 0x00, 0x00, 0x30, 0x04, 0x04, 0x04, 0x05, 0x04, 0x04,
+0x05, 0x07, 0x07, 0x07, 0x08, 0x0A, 0x04, 0x04, 0x04, 0x04, 0x06, 0x0A, 0x0B, 0x0D, 0x05, 0x05,
+0x07, 0x07, 0x08, 0x0B, 0x0D, 0x0F, 0x04, 0x04, 0x04, 0x05, 0x07, 0x07, 0x09, 0x09, 0x0C, 0x0E,
+0x10, 0x12, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0E, 0x11, 0x13, 0x09, 0x09, 0x09, 0x09, 0x0C, 0x0E,
+0x11, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x26, 0x2A, 0x18, 0x1A,
+0x1D, 0x1F, 0x21, 0x27, 0x29, 0x2A, 0x00, 0x00, 0x00, 0x1F, 0x23, 0x28, 0x2A, 0x2C, 0x00, 0x04,
+0x00, 0x04, 0x00, 0x08, 0x00, 0x10, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60,
+0x00, 0x90, 0x00, 0xC0, 0x00, 0xD8, 0x00, 0x50, 0x00, 0x78, 0x00, 0xA0, 0x00, 0xC8, 0x01, 0x40,
+0x01, 0x90, 0x01, 0xE0, 0x02, 0x30, 0x01, 0x2C, 0x01, 0x40, 0x01, 0xE0, 0x02, 0xD0, 0x03, 0xE8,
+0x04, 0xB0, 0x06, 0x40, 0x07, 0xD0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0C,
+0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x28,
+0x00, 0x3C, 0x00, 0x50, 0x00, 0x64, 0x00, 0xA0, 0x00, 0xC8, 0x00, 0xF0, 0x01, 0x18, 0x00, 0x64,
+0x00, 0xA0, 0x00, 0xF0, 0x01, 0x68, 0x01, 0xF4, 0x02, 0x58, 0x03, 0x20, 0x03, 0xE8, 0x02, 0x02,
+0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x04, 0x04, 0x05, 0x07, 0x02, 0x03, 0x04, 0x0A, 0x0C, 0x0E,
+0x10, 0x12, 0x05, 0x07, 0x07, 0x08, 0x0B, 0x12, 0x24, 0x3C, 0x01, 0x01, 0x01, 0x01, 0x01, 0x02,
+0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x05, 0x06,
+0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x20, 0x1E, 0x1C, 0x18, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0xBB, 0x01, 0x0C, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0, 0x22, 0x50,
+0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE6, 0x22, 0xBB, 0xFE, 0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0x22,
+0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0xBB, 0x01, 0x06,
+0x89, 0x82, 0x8A, 0x83, 0xF0, 0x22, 0x50, 0x02, 0xF7, 0x22, 0xBB, 0xFE, 0x01, 0xF3, 0x22, 0xF8,
+0xBB, 0x01, 0x0D, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0x22,
+0x50, 0x06, 0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x22, 0xBB, 0xFE, 0x05, 0xE9, 0x25, 0x82, 0xC8, 0xF2,
+0x22, 0xC5, 0xF0, 0xF8, 0xA3, 0xE0, 0x28, 0xF0, 0xC5, 0xF0, 0xF8, 0xE5, 0x82, 0x15, 0x82, 0x70,
+0x02, 0x15, 0x83, 0xE0, 0x38, 0xF0, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A, 0x83, 0xE0, 0xF5,
+0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x06, 0x87, 0xF0, 0x09, 0xE7, 0x19, 0x22, 0xBB, 0xFE, 0x07, 0xE3,
+0xF5, 0xF0, 0x09, 0xE3, 0x19, 0x22, 0x89, 0x82, 0x8A, 0x83, 0xE4, 0x93, 0xF5, 0xF0, 0x74, 0x01,
+0x93, 0x22, 0xBB, 0x01, 0x10, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0,
+0xF5, 0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x09, 0xE9, 0x25, 0x82, 0xF8, 0x86, 0xF0, 0x08, 0xE6, 0x22,
+0xBB, 0xFE, 0x0A, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0xF5, 0xF0, 0x08, 0xE2, 0x22, 0xE5, 0x83, 0x2A,
+0xF5, 0x83, 0xE9, 0x93, 0xF5, 0xF0, 0xA3, 0xE9, 0x93, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A,
+0x83, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x06, 0xF7, 0x09, 0xA7, 0xF0, 0x19, 0x22, 0xBB,
+0xFE, 0x06, 0xF3, 0xE5, 0xF0, 0x09, 0xF3, 0x19, 0x22, 0xF8, 0xBB, 0x01, 0x11, 0xE5, 0x82, 0x29,
+0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x09,
+0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x08, 0xA6, 0xF0, 0x22, 0xBB, 0xFE, 0x09, 0xE9, 0x25, 0x82, 0xC8,
+0xF2, 0xE5, 0xF0, 0x08, 0xF2, 0x22, 0xEF, 0x4B, 0xFF, 0xEE, 0x4A, 0xFE, 0xED, 0x49, 0xFD, 0xEC,
+0x48, 0xFC, 0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x22, 0xA4,
+0x25, 0x82, 0xF5, 0x82, 0xE5, 0xF0, 0x35, 0x83, 0xF5, 0x83, 0x22, 0xE0, 0xFB, 0xA3, 0xE0, 0xFA,
+0xA3, 0xE0, 0xF9, 0x22, 0xF8, 0xE0, 0xFB, 0xA3, 0xA3, 0xE0, 0xF9, 0x25, 0xF0, 0xF0, 0xE5, 0x82,
+0x15, 0x82, 0x70, 0x02, 0x15, 0x83, 0xE0, 0xFA, 0x38, 0xF0, 0x22, 0xEB, 0xF0, 0xA3, 0xEA, 0xF0,
+0xA3, 0xE9, 0xF0, 0x22, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4, 0x93, 0x70, 0x12, 0x74, 0x01, 0x93,
+0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5, 0x82, 0x88, 0x83, 0xE4, 0x73, 0x74,
+0x02, 0x93, 0x68, 0x60, 0xEF, 0xA3, 0xA3, 0xA3, 0x80, 0xDF, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4,
+0x93, 0x70, 0x12, 0x74, 0x01, 0x93, 0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5,
+0x82, 0x88, 0x83, 0xE4, 0x73, 0x74, 0x02, 0x93, 0xB5, 0xF0, 0x06, 0x74, 0x03, 0x93, 0x68, 0x60,
+0xE9, 0xA3, 0xA3, 0xA3, 0xA3, 0x80, 0xD8, 0xE4, 0x90, 0x8A, 0xC5, 0xF0, 0xE5, 0x24, 0x70, 0x03,
+0x02, 0x44, 0x9D, 0xE5, 0x21, 0x64, 0x01, 0x60, 0x03, 0x02, 0x44, 0x9D, 0xE5, 0x24, 0x14, 0x60,
+0x29, 0x24, 0xFD, 0x60, 0x25, 0x24, 0x02, 0x24, 0xFB, 0x50, 0x02, 0x80, 0x23, 0x90, 0x8B, 0x0B,
+0xE0, 0x14, 0xF0, 0xE0, 0x60, 0x04, 0xA3, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x0A,
+0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B, 0xF0, 0x80, 0x00, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x16, 0xA3, 0xE0, 0xB4, 0x06, 0x05, 0xE4, 0x90, 0x8A, 0xC5,
+0xF0, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x70, 0x04, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A, 0xC5,
+0xE0, 0x60, 0x4A, 0x43, 0x25, 0x10, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0C, 0xE0, 0x75,
+0xF0, 0x03, 0xA4, 0xFF, 0x90, 0x8B, 0x15, 0xE0, 0x2F, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0xE5, 0x22, 0x54,
+0x0F, 0xC3, 0x94, 0x04, 0x50, 0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x2C,
+0xE0, 0x30, 0xE0, 0x09, 0x12, 0x7D, 0xC1, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0xE4, 0xF5,
+0x25, 0xF5, 0x24, 0x75, 0x23, 0x0C, 0x75, 0x22, 0x0C, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x8B, 0x18,
+0xF0, 0x90, 0x8B, 0x17, 0xF0, 0x90, 0x8B, 0x19, 0x04, 0xF0, 0x90, 0x8B, 0x0B, 0xF0, 0xE4, 0x90,
+0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0D, 0xF0, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0xE4, 0x90, 0x8B,
+0x0C, 0xF0, 0x90, 0x8B, 0x13, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x10, 0xF0, 0xA3, 0x74,
+0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0xE4, 0x90,
+0x8B, 0x0E, 0xF0, 0x90, 0x8B, 0x0A, 0xF0, 0x90, 0x8B, 0x08, 0xF0, 0x90, 0x8B, 0x12, 0xF0, 0x22,
+0x7F, 0x00, 0x22, 0x02, 0x45, 0x03, 0x02, 0x45, 0x06, 0x8E, 0x64, 0x8F, 0x65, 0xAD, 0x65, 0xAC,
+0x64, 0xAF, 0x63, 0x12, 0x4A, 0x5B, 0xAF, 0x65, 0xAE, 0x64, 0x90, 0x04, 0x80, 0xE0, 0x54, 0x0F,
+0xFD, 0xAC, 0x07, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x01,
+0xF0, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xFB, 0xF0, 0xAC,
+0x07, 0x74, 0x16, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0xFA, 0xF0, 0x74,
+0x15, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x1F, 0xF0, 0xAC, 0x07, 0x74,
+0x06, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x0F, 0xF0, 0x90, 0x04, 0x53,
+0xE4, 0xF0, 0x90, 0x04, 0x52, 0xF0, 0x90, 0x04, 0x51, 0x74, 0xFF, 0xF0, 0x90, 0x04, 0x50, 0x74,
+0xFD, 0xF0, 0x74, 0x14, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xC0, 0x4D,
+0xFD, 0x74, 0x14, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xED, 0xF0, 0x22, 0x7D, 0x01,
+0x7F, 0x0C, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x67, 0x8D, 0x68, 0xE5, 0x67, 0x54,
+0x0F, 0xFF, 0xE5, 0x22, 0x54, 0x0F, 0x6F, 0x60, 0x72, 0xE5, 0x67, 0x30, 0xE2, 0x30, 0xE5, 0x22,
+0x20, 0xE2, 0x05, 0x7F, 0x01, 0x12, 0x4A, 0xB2, 0xE5, 0x22, 0x30, 0xE3, 0x10, 0xE5, 0x67, 0x20,
+0xE3, 0x0B, 0x12, 0x49, 0xD5, 0xEF, 0x60, 0x53, 0x12, 0x4A, 0xCC, 0x80, 0x4E, 0xE5, 0x22, 0x20,
+0xE3, 0x49, 0xE5, 0x67, 0x30, 0xE3, 0x44, 0xAF, 0x68, 0x12, 0x4A, 0x7C, 0x80, 0x3D, 0xE5, 0x22,
+0x54, 0x0F, 0xFF, 0xBF, 0x0C, 0x0E, 0xE5, 0x67, 0x20, 0xE3, 0x09, 0x12, 0x49, 0xD5, 0xEF, 0x60,
+0x2A, 0x12, 0x4A, 0xCC, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF, 0x04, 0x0E, 0xE5, 0x67, 0x20, 0xE2,
+0x09, 0x12, 0x49, 0x93, 0xEF, 0x60, 0x14, 0x12, 0x4A, 0x32, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF,
+0x02, 0x09, 0x12, 0x45, 0x00, 0xEF, 0x60, 0x03, 0x12, 0x4B, 0x10, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x02, 0x46, 0x6E, 0x02, 0x50, 0xC6, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0x40, 0x03, 0xF6,
+0x80, 0x01, 0xF2, 0x08, 0xDF, 0xF4, 0x80, 0x29, 0xE4, 0x93, 0xA3, 0xF8, 0x54, 0x07, 0x24, 0x0C,
+0xC8, 0xC3, 0x33, 0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40, 0x04, 0xF4, 0x56, 0x80, 0x01,
+0x46, 0xF6, 0xDF, 0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x90, 0x4B,
+0x23, 0xE4, 0x7E, 0x01, 0x93, 0x60, 0xBC, 0xA3, 0xFF, 0x54, 0x3F, 0x30, 0xE5, 0x09, 0x54, 0x1F,
+0xFE, 0xE4, 0x93, 0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25, 0xE0, 0x60, 0xA8, 0x40, 0xB8,
+0xE4, 0x93, 0xA3, 0xFA, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA,
+0xC5, 0x83, 0xCA, 0xF0, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA, 0xC5, 0x83, 0xCA, 0xDF, 0xE9, 0xDE,
+0xE7, 0x80, 0xBE, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x67, 0xE5, 0x24, 0x60, 0x63, 0xE5, 0x24, 0x64,
+0x02, 0x60, 0x06, 0xE5, 0x24, 0x64, 0x05, 0x70, 0x27, 0x90, 0x06, 0xAB, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x90, 0x06, 0xAA, 0xE0, 0x90, 0x8B, 0x19, 0xF0, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x07, 0x90,
+0x8B, 0x19, 0xE0, 0xFF, 0x80, 0x05, 0x90, 0x8B, 0x0B, 0xE0, 0xFF, 0x90, 0x8B, 0x0B, 0xEF, 0xF0,
+0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x02, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x0C, 0xF0, 0x90, 0x05, 0x58,
+0x74, 0x03, 0xF0, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x53, 0x25,
+0xFD, 0x53, 0x25, 0xEF, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x03, 0x12, 0x47, 0x8E,
+0x22, 0xEF, 0x64, 0x01, 0x70, 0x35, 0x7D, 0x78, 0x7F, 0x02, 0x12, 0x36, 0x75, 0x7D, 0x02, 0x7F,
+0x03, 0x12, 0x36, 0x75, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x12,
+0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12, 0x7D, 0xC1, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0x7F, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x54, 0xF8, 0xF0, 0x22, 0x90, 0x01, 0x36, 0x74, 0x7B,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x7D, 0x7B, 0xFF, 0x12, 0x36, 0xE6, 0x7D, 0x02, 0x7F, 0x03, 0x12,
+0x36, 0xE6, 0x90, 0x06, 0x04, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x44, 0x07, 0xF0,
+0x12, 0x4B, 0x4F, 0xE5, 0x21, 0x20, 0xE0, 0x05, 0xE4, 0x90, 0x8B, 0x0D, 0xF0, 0x22, 0xE4, 0x90,
+0x8A, 0xC5, 0xF0, 0x90, 0x06, 0xA9, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0xE0, 0x54, 0xC0, 0x70, 0x09,
+0x53, 0x25, 0xFE, 0x53, 0x25, 0xFD, 0x12, 0x4A, 0xFC, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE6, 0x15,
+0x43, 0x25, 0x01, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A, 0x97, 0x80, 0x08,
+0x12, 0x49, 0x49, 0x80, 0x03, 0x53, 0x25, 0xFE, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE7, 0x27, 0x43,
+0x25, 0x02, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4,
+0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0x90,
+0x8B, 0x1B, 0x74, 0x01, 0xF0, 0x22, 0x53, 0x25, 0xFD, 0x22, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x8B,
+0x12, 0x4B, 0x43, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xF5, 0x24, 0x14, 0x60,
+0x0E, 0x14, 0x60, 0x1F, 0x14, 0x60, 0x31, 0x24, 0x03, 0x70, 0x44, 0x7F, 0x01, 0x80, 0x3D, 0x90,
+0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD, 0xE4, 0xFF, 0x12, 0x4A,
+0x07, 0x80, 0x29, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD,
+0x7F, 0x01, 0x12, 0x4A, 0x07, 0x1F, 0x80, 0x14, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x02, 0x12, 0x42, 0x20, 0xFD, 0x7F, 0x02, 0x12, 0x4A, 0x07, 0xE4, 0xFF, 0x12, 0x47, 0x21, 0x22,
+0xE4, 0x90, 0x8A, 0xCB, 0xF0, 0xE5, 0x24, 0x60, 0x49, 0x90, 0x8B, 0x1B, 0xE0, 0x60, 0x0D, 0xE4,
+0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x38, 0x80, 0x33, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8A, 0xCB, 0xE0, 0xFF, 0x90, 0x8B, 0x10, 0xE0, 0x2F, 0xFF,
+0xE4, 0x33, 0xFE, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0xEE, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x40, 0x0D, 0xE5, 0x21, 0xB4, 0x01, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xE0, 0x04, 0xF0, 0x22, 0x12,
+0x4A, 0xFC, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x63, 0x90, 0x04, 0x1D, 0xE0,
+0x60, 0x24, 0x90, 0x05, 0x22, 0xE0, 0xF5, 0x66, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xBF, 0x01,
+0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x12, 0x45, 0x09, 0x90, 0x05,
+0x22, 0xE5, 0x66, 0xF0, 0x80, 0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD,
+0x12, 0x45, 0x09, 0x90, 0x04, 0x1F, 0x74, 0x20, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE5, 0x24,
+0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x41, 0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x12, 0x45, 0x9E,
+0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x58, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92,
+0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x22, 0xE5, 0x22, 0x54, 0x0F, 0xC3, 0x94, 0x04, 0x50,
+0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x22, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E,
+0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x5C, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05,
+0xF0, 0x90, 0x06, 0x92, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x17, 0x14, 0xF0, 0xE5, 0x22, 0x54, 0x0F,
+0xC3, 0x94, 0x0C, 0x50, 0x0D, 0x12, 0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12,
+0x7D, 0xC1, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x37, 0xE5, 0x25, 0x54, 0x03, 0x70,
+0x31, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x02, 0x50, 0x28, 0xE5, 0x25, 0x20, 0xE2, 0x23, 0xE5,
+0x25, 0x20, 0xE4, 0x1E, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x18, 0x90, 0x8B, 0x12, 0xE0, 0x70, 0x12,
+0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x04, 0xF0, 0x7F,
+0x01, 0x22, 0x7F, 0x00, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x27, 0x90, 0x8B, 0x18,
+0xE0, 0x70, 0x21, 0x90, 0x8B, 0x17, 0xE0, 0x70, 0x1B, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x04,
+0x50, 0x12, 0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x08,
+0xF0, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xEF, 0x24, 0xFE, 0x60, 0x0B, 0x04, 0x70, 0x22, 0x90,
+0x8B, 0x19, 0x74, 0x01, 0xF0, 0x80, 0x16, 0xED, 0x70, 0x0A, 0x90, 0x8B, 0x16, 0xE0, 0x90, 0x8B,
+0x19, 0xF0, 0x80, 0x05, 0x90, 0x8B, 0x19, 0xED, 0xF0, 0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x22, 0x90, 0x01, 0x37, 0x74, 0x02, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E,
+0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8, 0x74, 0xFD, 0xF0, 0x7D, 0x02, 0x7F, 0x03, 0x12, 0x36,
+0xE6, 0x12, 0x7C, 0x50, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x02, 0x22, 0xEF, 0x60, 0x0F, 0x74, 0x21,
+0x2D, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x10, 0xF0, 0x22, 0x74, 0x21, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xEF, 0xF0, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0xBF, 0xF0, 0xEF, 0x60, 0x0A, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0xE4, 0xFF, 0x12, 0x48, 0xB3,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x0C, 0x22, 0x90, 0x04, 0x1D, 0xE0, 0x70, 0x14, 0x90, 0x8A, 0xF8,
+0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5F, 0xFD, 0x8E, 0x69, 0x8F, 0x6A, 0x90, 0x04, 0x1F, 0x74, 0x20,
+0xF0, 0x22, 0x90, 0x8B, 0x52, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x52, 0xE0, 0x60, 0x05,
+0x90, 0x05, 0x22, 0xE4, 0xF0, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x04, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x44, 0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0x7F, 0x01, 0x12, 0x48, 0xB3, 0x53, 0x22, 0xF0,
+0x43, 0x22, 0x04, 0x22, 0xE5, 0x23, 0x30, 0xE6, 0x12, 0xE5, 0x23, 0x54, 0x0F, 0xFF, 0x90, 0x01,
+0x2F, 0xE0, 0x54, 0x80, 0x4F, 0x64, 0x80, 0xF0, 0x53, 0x23, 0xBF, 0x22, 0x90, 0x8B, 0x2C, 0xE0,
+0x30, 0xE0, 0x05, 0xAF, 0x23, 0x02, 0x7E, 0x06, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x22,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x01, 0x12, 0x4B, 0x5A, 0x12, 0x4B, 0x5B, 0x53, 0x22, 0xF0, 0x43,
+0x22, 0x02, 0x22, 0x41, 0x8A, 0xF6, 0x00, 0x41, 0x8B, 0x05, 0x00, 0x41, 0x8B, 0x51, 0x00, 0x41,
+0x8B, 0x53, 0x00, 0x00, 0x90, 0x04, 0x1B, 0xE0, 0x54, 0x7F, 0x64, 0x7F, 0x7F, 0x01, 0x60, 0x02,
+0x7F, 0x00, 0x22, 0xE4, 0x90, 0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0C, 0xF0, 0xF5, 0x25, 0x22, 0x90,
+0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x22, 0x22, 0xF0, 0x90, 0x8B, 0x0F,
+0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x58, 0x7E, 0x01, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x3D, 0xE0, 0xFB, 0xA3, 0xE0, 0xF5, 0x44, 0xE4, 0xF5, 0x45, 0x12,
+0x35, 0xAB, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0,
+0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05,
+0xC0, 0x06, 0xC0, 0x07, 0x75, 0x0E, 0x00, 0x90, 0x01, 0xC4, 0x74, 0x87, 0xF0, 0x74, 0x4B, 0xA3,
+0xF0, 0x53, 0x91, 0xDF, 0x90, 0x01, 0x3C, 0xE0, 0x55, 0x30, 0xF5, 0x34, 0xA3, 0xE0, 0x55, 0x31,
+0xF5, 0x35, 0xA3, 0xE0, 0x55, 0x32, 0xF5, 0x36, 0xA3, 0xE0, 0x55, 0x33, 0xF5, 0x37, 0xE5, 0x34,
+0x30, 0xE0, 0x51, 0x90, 0x01, 0x3C, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x1F,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x34, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x1D, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x16, 0x90, 0x8B,
+0x2E, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF,
+0x70, 0x02, 0xD1, 0x56, 0xE5, 0x34, 0x30, 0xE1, 0x08, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x11,
+0x60, 0xE5, 0x34, 0x30, 0xE2, 0x28, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0x90, 0x06, 0x92, 0xE0,
+0x30, 0xE0, 0x14, 0x90, 0x8B, 0x3D, 0xE4, 0x71, 0x5C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90,
+0x06, 0x92, 0x74, 0x01, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x18, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34,
+0x30, 0xE3, 0x38, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0x90, 0x06, 0x92, 0xE0, 0x30, 0xE1, 0x24,
+0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x5C, 0x7E, 0x01, 0x71, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74,
+0x02, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x17, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34, 0x30, 0xE4, 0x09,
+0x90, 0x01, 0x3C, 0x74, 0x10, 0xF0, 0x12, 0x51, 0xC9, 0xE5, 0x34, 0x30, 0xE5, 0x06, 0x90, 0x01,
+0x3C, 0x74, 0x20, 0xF0, 0xE5, 0x35, 0x30, 0xE0, 0x10, 0x90, 0x01, 0x3D, 0x74, 0x01, 0xF0, 0x90,
+0x00, 0x83, 0xE0, 0xF5, 0x23, 0x51, 0xE4, 0x51, 0xFC, 0xE5, 0x35, 0x30, 0xE2, 0x06, 0x90, 0x01,
+0x3D, 0x74, 0x04, 0xF0, 0xE5, 0x35, 0x30, 0xE4, 0x1B, 0x90, 0x01, 0x3D, 0x74, 0x10, 0xF0, 0x90,
+0x8B, 0x05, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05, 0x53, 0xE0, 0x44, 0x01, 0xF0, 0x90, 0x05,
+0xFD, 0xE0, 0x04, 0xF0, 0xE5, 0x36, 0x30, 0xE0, 0x75, 0x90, 0x01, 0x3E, 0x74, 0x01, 0xF0, 0x90,
+0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x36, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64,
+0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0xD1, 0x89, 0x90, 0x8B,
+0x2C, 0xE0, 0x30, 0xE0, 0x49, 0x90, 0x8B, 0x30, 0xE4, 0xF0, 0xFF, 0xB1, 0xE0, 0xEF, 0x60, 0x3E,
+0x12, 0x65, 0x5F, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60, 0x32, 0xEF, 0xB4, 0x04, 0x02,
+0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F,
+0x01, 0x12, 0x65, 0x82, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x12, 0x7D, 0xC1, 0xE5, 0x36,
+0x30, 0xE1, 0x47, 0x90, 0x01, 0x3E, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x19,
+0x90, 0x8B, 0x36, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01,
+0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x1A,
+0x90, 0x8B, 0x30, 0x74, 0x01, 0xF0, 0x12, 0x7E, 0x2B, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60,
+0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF, 0x70, 0x02, 0xD1, 0x56, 0x74, 0x87, 0x04, 0x90, 0x01, 0xC4,
+0xF0, 0x74, 0x4B, 0xA3, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0,
+0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32,
+0xEF, 0x64, 0x01, 0x70, 0x3D, 0x90, 0x8B, 0x35, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x08, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x34, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22,
+0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0B, 0xEF, 0xC4, 0x13, 0x54,
+0x07, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x36, 0xE0, 0x7F, 0x01, 0x60, 0x36, 0x7F,
+0x00, 0x22, 0x90, 0x8B, 0x2F, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x08, 0xE0, 0x60,
+0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2E, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2C,
+0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x30, 0xE0, 0x7F,
+0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0x7F, 0x05, 0x80, 0x1F, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x01, 0x70, 0x1A, 0x7F, 0x02,
+0x80, 0x13, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0x7F, 0x03, 0x80, 0x08, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x05, 0x7F, 0x04, 0x12, 0x65, 0x82, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x33, 0xE0, 0x90, 0x8B, 0x55, 0xF0, 0x6F, 0x70, 0x02, 0xE1, 0x55, 0xEF, 0x14, 0x60,
+0x3B, 0x14, 0x60, 0x5F, 0x14, 0x70, 0x02, 0xE1, 0x30, 0x24, 0x03, 0x60, 0x02, 0xE1, 0x55, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x04, 0xF1, 0xC2, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x02,
+0x04, 0xF1, 0xAF, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04, 0x04, 0xF1, 0xC6, 0xE1, 0x55,
+0x90, 0x8B, 0x55, 0xE0, 0x64, 0x01, 0x70, 0x7D, 0xF1, 0xB1, 0x80, 0x79, 0x90, 0x8B, 0x55, 0xE0,
+0xFF, 0xB4, 0x03, 0x04, 0xF1, 0xCA, 0x80, 0x6D, 0xEF, 0xB4, 0x02, 0x04, 0xF1, 0xA1, 0x80, 0x65,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0xD5, 0x80, 0x59, 0xEF, 0x70, 0x56, 0xF1,
+0x8E, 0x80, 0x52, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x05, 0x12, 0x7C, 0x41, 0x80, 0x46, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0x72, 0x80, 0x3B, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04,
+0x05, 0x12, 0x7D, 0x23, 0x80, 0x2F, 0x90, 0x8B, 0x55, 0xE0, 0x70, 0x29, 0xF1, 0x70, 0x80, 0x25,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x01, 0x04, 0xF1, 0x5A, 0x80, 0x19, 0xEF, 0xB4, 0x02, 0x04,
+0xF1, 0x6B, 0x80, 0x11, 0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0x5A, 0x80, 0x05,
+0xEF, 0x70, 0x02, 0xF1, 0x67, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x33, 0x74, 0x03, 0xF0, 0x22, 0xF1, 0x8E, 0x80, 0xEF, 0x12, 0x7D, 0x42, 0x80, 0xEA,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01,
+0xC8, 0x74, 0xFD, 0xF0, 0x12, 0x7C, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x01,
+0x3E, 0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8B, 0x33, 0x74, 0x01, 0xF0,
+0x22, 0x12, 0x7D, 0x42, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1,
+0xA1, 0x7D, 0x03, 0x7F, 0x02, 0x12, 0x36, 0x92, 0x90, 0x05, 0x27, 0xE4, 0xF0, 0x90, 0x8B, 0x33,
+0xF0, 0x22, 0xF1, 0xCA, 0x80, 0xEB, 0xF1, 0xD5, 0x80, 0xE7, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90,
+0x8B, 0x33, 0x04, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90,
+0x02, 0x84, 0xEF, 0xF0, 0xA3, 0xEE, 0xF0, 0xA3, 0x74, 0x05, 0xF0, 0x22, 0xEF, 0x8E, 0xF0, 0x12,
+0x43, 0xBA, 0x50, 0x1A, 0x00, 0x40, 0x50, 0x42, 0x00, 0x80, 0x50, 0x6D, 0x01, 0x00, 0x50, 0x81,
+0x02, 0x00, 0x50, 0x99, 0x04, 0x00, 0x00, 0x00, 0x50, 0xB6, 0xED, 0x54, 0x3F, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x40, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x06,
+0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78, 0x06, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0x80, 0x26, 0xED, 0x54, 0x7F, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x80, 0xEF,
+0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x07, 0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78,
+0x07, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFD, 0xAC, 0x06, 0x80, 0x49, 0xED, 0x70, 0x04,
+0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x01, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x7D, 0x00, 0xFC, 0x80,
+0x35, 0xEC, 0x54, 0x01, 0x4D, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x02, 0x7F, 0x00, 0xEF,
+0x2D, 0xEE, 0x3C, 0xC3, 0x13, 0x7D, 0x00, 0x80, 0x1A, 0xEC, 0x54, 0x03, 0x4D, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x04, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x13, 0x13, 0x54, 0x3F, 0x7D,
+0x00, 0x25, 0xE0, 0x25, 0xE0, 0xFC, 0xAE, 0x04, 0xAF, 0x05, 0x22, 0x90, 0x01, 0xE4, 0x74, 0x58,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCC, 0xF0, 0xA3, 0xF0, 0x75, 0x8E, 0x02,
+0x91, 0x0E, 0x12, 0x68, 0x44, 0x90, 0x8B, 0x07, 0xEF, 0xF0, 0x12, 0x68, 0x51, 0x90, 0x8B, 0x09,
+0xEF, 0xF0, 0x12, 0x68, 0x5D, 0x90, 0x8A, 0xF4, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0xF5, 0x55,
+0xF5, 0x21, 0x12, 0x72, 0x55, 0x12, 0x44, 0x9E, 0x12, 0x32, 0x3D, 0x7F, 0x03, 0x12, 0x78, 0x42,
+0x12, 0x7C, 0x3D, 0x12, 0x68, 0x0A, 0x12, 0x68, 0x75, 0x12, 0x68, 0x8A, 0x12, 0x68, 0x28, 0x12,
+0x68, 0x43, 0x90, 0x8A, 0xCE, 0xE5, 0xD9, 0xF0, 0x31, 0x5F, 0xC2, 0xAF, 0x90, 0x00, 0x80, 0xE0,
+0x44, 0x40, 0xF0, 0x51, 0x0E, 0x75, 0xE8, 0x03, 0x43, 0xA8, 0x85, 0xD2, 0xAF, 0x11, 0xBB, 0x90,
+0x8A, 0xCC, 0xE0, 0x64, 0x01, 0xF0, 0x24, 0xC6, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x50, 0xA3, 0xF0,
+0xE5, 0x55, 0x30, 0xE4, 0x09, 0xC2, 0xAF, 0x53, 0x55, 0xEF, 0xD2, 0xAF, 0xB1, 0x59, 0xE5, 0x55,
+0x30, 0xE6, 0xDC, 0xC2, 0xAF, 0x53, 0x55, 0xBF, 0xD2, 0xAF, 0x12, 0x6B, 0xBD, 0x80, 0xD0, 0x90,
+0x01, 0x3C, 0x74, 0xFF, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xF0, 0xA3, 0xF0, 0xA3,
+0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x54, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x55, 0x31, 0x88, 0x7D, 0xFF,
+0x7F, 0x56, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x57, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F,
+0x82, 0x75, 0x83, 0x00, 0xED, 0xF0, 0x51, 0x0E, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x01, 0x30,
+0xE4, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x38, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xFD, 0x7F, 0x50, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x51, 0x31, 0x88, 0xE4, 0xFD, 0x7F,
+0x52, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x53, 0x80, 0xBF, 0xE5, 0x5E, 0x64, 0x01, 0x70, 0x3B, 0x71,
+0x4E, 0xBF, 0x01, 0x04, 0x7F, 0x01, 0x71, 0x42, 0x90, 0x00, 0x46, 0xE0, 0x44, 0x04, 0xFD, 0x7F,
+0x46, 0x31, 0x88, 0x90, 0x00, 0x44, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x44, 0x31, 0x88, 0x90, 0x00,
+0x46, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x46, 0x31, 0x88, 0x7F, 0x02, 0x71, 0x6A, 0x8F, 0x62, 0x90,
+0x01, 0xC9, 0xE5, 0x62, 0xF0, 0xB4, 0x01, 0x02, 0x51, 0xE2, 0x22, 0xE0, 0x5F, 0xF0, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x7F, 0x10, 0xDF, 0xFE, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xE0, 0xED, 0xF0, 0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0xD3,
+0x94, 0x07, 0x50, 0x4E, 0xA3, 0xE0, 0x70, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x5F, 0xF0,
+0x80, 0x17, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46,
+0x80, 0x59, 0x90, 0x8A, 0xDF, 0xE0, 0x24, 0xF8, 0xF0, 0xA3, 0xE0, 0x70, 0x1D, 0x90, 0x8A, 0xDF,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0,
+0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x80, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0, 0xFF, 0x90, 0x00,
+0x43, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08,
+0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0x51, 0x0B, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x90, 0x00, 0x49, 0xE0, 0x90, 0x8B, 0x54, 0xF0, 0xE0, 0x54, 0x0F, 0xF0, 0x44, 0xF0,
+0xFD, 0x7F, 0x49, 0x31, 0x88, 0x90, 0x8B, 0x54, 0xE0, 0x44, 0xB0, 0xFD, 0x7F, 0x49, 0x21, 0x88,
+0x90, 0x8A, 0xDD, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0x5E, 0x01, 0x8E, 0x5F, 0xF5, 0x60, 0xE4,
+0xFD, 0x7F, 0x0B, 0x51, 0x1E, 0xE4, 0xFD, 0x7F, 0x02, 0x51, 0x1E, 0x71, 0x4E, 0xE4, 0xFF, 0x71,
+0x42, 0xE4, 0xF5, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0xEC, 0xFB, 0x8D, 0x44, 0xE4, 0xF5, 0x45, 0x7D, 0x01, 0x7F, 0x60, 0x7E, 0x01, 0x02,
+0x35, 0xAB, 0x90, 0x01, 0xCA, 0xE5, 0x61, 0xF0, 0xEF, 0x60, 0x02, 0x51, 0xE2, 0x22, 0x7F, 0x0B,
+0x71, 0x6A, 0xEF, 0x65, 0x61, 0x60, 0x10, 0xE5, 0x61, 0xB4, 0x01, 0x05, 0xE4, 0xF5, 0x61, 0x80,
+0x03, 0x75, 0x61, 0x01, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8B, 0x57, 0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x43, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46, 0x51, 0x0B, 0x90,
+0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x44, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05,
+0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0x80, 0x4B, 0x90, 0x8B,
+0x57, 0xE0, 0x24, 0xF8, 0xF0, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x51, 0x0E, 0x90, 0x8B, 0x57, 0xE0,
+0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x00, 0x42, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05, 0x08, 0x80, 0x06,
+0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0x90,
+0x8B, 0x04, 0xF0, 0x90, 0x00, 0x80, 0xE0, 0x44, 0x80, 0xFD, 0x7F, 0x80, 0x21, 0x88, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFA, 0xE5, 0xF0, 0x24, 0x00, 0xFF, 0xE4, 0x3A, 0xFE,
+0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEE, 0x8F, 0xF0, 0x12, 0x43, 0x19, 0x12,
+0x29, 0xD9, 0xFF, 0x60, 0x2C, 0xB5, 0x5E, 0x16, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x01, 0x12, 0x42, 0xC2, 0x65, 0x60, 0x70, 0x04, 0xE5, 0x5F, 0x65, 0xF0, 0x60, 0x22, 0x90, 0x8A,
+0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFF, 0xAE, 0xF0, 0x71, 0x00, 0x80,
+0x0F, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0x65, 0x5E, 0x60, 0x02, 0x91, 0x95,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0xF5, 0x5E, 0x7F, 0x60, 0x7E, 0x01, 0x8F, 0x82, 0x8E, 0x83,
+0xA3, 0xA3, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x8B, 0xEF, 0x12, 0x43, 0x94,
+0x54, 0xE7, 0x01, 0x54, 0xDE, 0x02, 0x55, 0x0B, 0x03, 0x55, 0x14, 0x05, 0x55, 0x1D, 0x06, 0x55,
+0x58, 0x07, 0x55, 0x25, 0x08, 0x55, 0x2E, 0x09, 0x55, 0x36, 0x20, 0x55, 0x3F, 0x2C, 0x54, 0xF0,
+0x2D, 0x54, 0xF9, 0x2E, 0x55, 0x02, 0x3B, 0x55, 0x48, 0x4B, 0x00, 0x00, 0x55, 0x51, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x85, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x8B,
+0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0xB8, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02,
+0x75, 0x00, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x39, 0x90, 0x8A, 0xD7, 0x12, 0x43,
+0x6B, 0x02, 0x75, 0x52, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x0F, 0x90, 0x8A, 0xD7,
+0x12, 0x43, 0x6B, 0xC1, 0xA6, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x9A, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x81, 0x1E, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x78, 0x81, 0x90,
+0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7A, 0xC2, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7C,
+0x2B, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x01, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x01, 0xCC, 0xE0, 0x54, 0x0F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x70,
+0x02, 0xC1, 0xA1, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xEF, 0x5D, 0x70, 0x02, 0xC1, 0x9A, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD0, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD0,
+0xF0, 0x75, 0x1D, 0x01, 0x75, 0x1E, 0x8A, 0x75, 0x1F, 0xD0, 0x75, 0x20, 0x01, 0x7B, 0x01, 0x7A,
+0x8A, 0x79, 0xD1, 0x12, 0x5E, 0xE4, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x13, 0x54,
+0x01, 0x90, 0x8B, 0x51, 0x30, 0xE0, 0x59, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x88, 0x12, 0x43,
+0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x89,
+0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90,
+0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0,
+0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD5, 0xF0, 0x90, 0x8B, 0x51, 0xE0,
+0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD6, 0xF0, 0x80, 0x33,
+0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3,
+0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90,
+0x8A, 0xD4, 0xF0, 0xEF, 0x54, 0x7F, 0xFF, 0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD2, 0x91, 0xA6, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x90, 0x8B, 0x51, 0xE0, 0xFE, 0x74, 0x01, 0xA8, 0x06, 0x08, 0x80, 0x02,
+0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0x5F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0x90, 0x01, 0xCC, 0xF0, 0x90, 0x8B,
+0x51, 0xE0, 0x04, 0xF0, 0xE0, 0x54, 0x03, 0xF0, 0xA1, 0x6A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x02,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF, 0x54, 0x1F, 0xFE,
+0xEF, 0x54, 0x20, 0xC4, 0x13, 0x54, 0x07, 0xFD, 0xAF, 0x06, 0x90, 0x8A, 0xDA, 0xEF, 0xF0, 0xA3,
+0xED, 0xF0, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x54, 0xF0, 0xC4, 0x54, 0x0F, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42,
+0x20, 0x54, 0x40, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x75, 0xF0, 0x09, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAD, 0x82, 0xAC, 0x83, 0x90, 0x8A,
+0xE1, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87,
+0x35, 0xF0, 0xFA, 0x7B, 0x01, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90,
+0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0x0F, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43, 0x6B, 0xEF, 0x12,
+0x42, 0x4D, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x90,
+0x8A, 0xE3, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x90, 0x8A, 0xDC, 0x12,
+0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0xA3, 0xE0,
+0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xEF, 0xF0, 0x12, 0x29, 0xD9, 0x8D, 0x82, 0x8C, 0x83, 0xA3, 0xF0,
+0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x24, 0xC1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87,
+0x29, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F,
+0x74, 0x01, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12,
+0x43, 0x5F, 0xEE, 0xF0, 0x8F, 0x0F, 0xEF, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89,
+0xAF, 0x82, 0xF5, 0x10, 0x8F, 0x11, 0xE5, 0x0F, 0x75, 0xF0, 0x02, 0xA4, 0x24, 0x81, 0xF9, 0x74,
+0x86, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13, 0x89, 0x14, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x25, 0x12, 0x43, 0x5F, 0xAF, 0x82, 0x85, 0x83, 0x15, 0x8F, 0x16, 0xE5, 0x0F, 0x75, 0xF0,
+0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87, 0x35, 0xF0, 0x75, 0x17, 0x01, 0xF5, 0x18, 0x89, 0x19,
+0x74, 0xC1, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x12, 0x43, 0x94, 0x58,
+0x34, 0x00, 0x58, 0x49, 0x01, 0x58, 0x5E, 0x02, 0x58, 0x73, 0x03, 0x58, 0x9C, 0x04, 0x58, 0xB1,
+0x05, 0x58, 0xC6, 0x06, 0x58, 0xEC, 0x0C, 0x59, 0x19, 0x0D, 0x59, 0x46, 0x0E, 0x59, 0x73, 0x0F,
+0x00, 0x00, 0x59, 0xA7, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x15, 0x80, 0x3C, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x10, 0x80, 0x27, 0xE5, 0x0F,
+0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74,
+0x05, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0x74, 0xF0, 0xF0, 0xA3, 0xE4, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0x8F, 0xF0, 0x21, 0xA7, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0xF5, 0x80,
+0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F,
+0xF0, 0xA3, 0x74, 0xF0, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0x74, 0x0D, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x21, 0xA7, 0x90, 0x04, 0x47, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x46, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x45, 0xE0, 0x85, 0x11, 0x82,
+0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x44, 0x21, 0x9E, 0x90, 0x04, 0x4B, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4A, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x49, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83,
+0xF0, 0x90, 0x04, 0x48, 0x80, 0x58, 0x90, 0x04, 0x4F, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x12, 0x42, 0x4D, 0x90, 0x04, 0x4E, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01,
+0x12, 0x42, 0x5F, 0x90, 0x04, 0x4D, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04,
+0x4C, 0x80, 0x2B, 0x90, 0x04, 0x53, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D,
+0x90, 0x04, 0x52, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F,
+0x90, 0x04, 0x51, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x50, 0xE0, 0x85,
+0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xC0, 0x03, 0xC0,
+0x02, 0xC0, 0x01, 0x12, 0x29, 0xD9, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19, 0x12, 0x29, 0xD9,
+0x5F, 0xD0, 0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0xAB, 0x12, 0xE5, 0x14, 0x24, 0x01,
+0xF9, 0xE4, 0x35, 0x13, 0xFA, 0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x29, 0xD9, 0xFF, 0xAB,
+0x17, 0xAA, 0x18, 0xA9, 0x19, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x5F, 0xD0, 0x01, 0xD0, 0x02,
+0xD0, 0x03, 0x12, 0x42, 0x4D, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xC0, 0x83, 0xC0, 0x82, 0xE0,
+0xFF, 0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0,
+0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xC0, 0x83, 0xC0, 0x82, 0xE0, 0xFF, 0x85, 0x16, 0x82,
+0x85, 0x15, 0x83, 0xA3, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0, 0xE5, 0x0F, 0x25,
+0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60,
+0x4B, 0x90, 0x8A, 0xE6, 0x74, 0x0B, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x50,
+0x02, 0x41, 0xEC, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5,
+0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x0A, 0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10,
+0xA3, 0xF0, 0x80, 0x68, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBB, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x47,
+0x90, 0x8A, 0xE6, 0x74, 0x0F, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x40, 0x3C,
+0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x5E,
+0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0xA3, 0xF0, 0x80, 0x0D, 0x90,
+0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE7, 0xF0, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46,
+0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x40, 0x02, 0x61,
+0xA5, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0,
+0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x06, 0x90, 0x8A, 0xE6, 0xE0, 0x80, 0x63, 0x90, 0x8A,
+0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90,
+0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x0C, 0x50, 0x3C, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08,
+0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08,
+0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10, 0x80, 0x09, 0x90, 0x8A, 0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF,
+0xE4, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xEF, 0xF0, 0x90, 0x8A, 0xE8, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xE5,
+0x0F, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xE5, 0x0F, 0xC3, 0x94, 0x20, 0x50, 0x32,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xD3, 0x9F, 0x40, 0x02,
+0x80, 0x18, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xC3, 0x9E,
+0x50, 0x08, 0x90, 0x8A, 0xE8, 0xE0, 0xA3, 0xF0, 0x80, 0x08, 0x90, 0x8A, 0xE7, 0xE0, 0x90, 0x8A,
+0xE9, 0xF0, 0x90, 0x8A, 0xE9, 0xE0, 0xFD, 0xAF, 0x0F, 0x91, 0x4E, 0x90, 0x8A, 0xE9, 0xE0, 0xFF,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xE7,
+0xE0, 0xFF, 0xD3, 0x94, 0x13, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x03, 0xF0, 0x22, 0xEF, 0xD3,
+0x94, 0x0B, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x02, 0xF0, 0x22, 0xEF, 0xD3, 0x94, 0x03, 0x40,
+0x07, 0x90, 0x87, 0x22, 0x74, 0x01, 0xF0, 0x22, 0xE4, 0x90, 0x87, 0x22, 0xF0, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xED,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAC, 0x07, 0xED, 0x54, 0x1F, 0x90, 0x8A, 0xC7, 0xF0, 0x74,
+0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A,
+0xC8, 0x74, 0x01, 0xF0, 0xEB, 0xC3, 0x94, 0x01, 0x40, 0x02, 0x80, 0x37, 0x90, 0x8A, 0xC5, 0xE0,
+0x25, 0x0D, 0xFF, 0xA3, 0xF0, 0xA3, 0xE0, 0x90, 0x41, 0x9E, 0x93, 0xFE, 0xEF, 0xD3, 0x9E, 0x40,
+0x10, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x04, 0x80,
+0x9D, 0x90, 0x8A, 0xC6, 0xE0, 0xFF, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEF, 0xF0, 0x22, 0xAD, 0x07, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0,
+0xFF, 0x90, 0x8A, 0xCA, 0xF0, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0x54, 0x1F, 0x90, 0x8A, 0xC9, 0xF0, 0xD3, 0x9F, 0x40, 0x06, 0xA3, 0xE0, 0x90, 0x8A, 0xC9, 0xF0,
+0x90, 0x8A, 0xC9, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83,
+0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13,
+0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3,
+0xEF, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xC9, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A, 0xC9, 0xE0, 0xFF,
+0x22, 0xAC, 0x07, 0x74, 0x84, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F,
+0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0x54, 0x1F, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0x75, 0xF0, 0x09, 0xEC,
+0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xE3, 0xF0, 0x75, 0xF0, 0x09, 0xEC, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0x90, 0x8A, 0xE4, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0xE4,
+0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE5, 0xCB, 0xF0,
+0xA3, 0xEB, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0,
+0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE7, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEF, 0xD3, 0x9E, 0x40, 0x0C,
+0x90, 0x8A, 0xE4, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xED, 0x70, 0x02, 0xC1,
+0x93, 0x90, 0x8A, 0xE2, 0xED, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0x30, 0xE6, 0x0E, 0x90, 0x8A, 0xE1,
+0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x14, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x70,
+0x02, 0xC1, 0x93, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0xD3, 0x94, 0x00, 0x50, 0x02, 0xC1, 0x93, 0xE4,
+0x90, 0x8A, 0xE0, 0xF0, 0xEF, 0x14, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xE3, 0xE0, 0xFD, 0x90,
+0x8A, 0xDF, 0xE0, 0xFF, 0xD3, 0x9D, 0x40, 0x6F, 0xEF, 0x94, 0x10, 0x40, 0x21, 0xEF, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE7, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x37, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE5, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0x6F, 0x60, 0x08, 0x90,
+0x8A, 0xDF, 0xE0, 0x14, 0xF0, 0x80, 0x83, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xC3, 0x9F, 0x50, 0x0F, 0x90, 0x8A, 0xDF, 0xE0, 0xB5, 0x05, 0x08, 0x90, 0x8A, 0xE3, 0xE0, 0x90,
+0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xEC, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x90, 0x8A, 0xDE, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A,
+0xDE, 0xE0, 0xFF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8B, 0x1A, 0x8A, 0x1B, 0x89,
+0x1C, 0x90, 0x8B, 0x3F, 0x12, 0x43, 0x8B, 0xAB, 0x1D, 0xAA, 0x1E, 0xA9, 0x1F, 0x90, 0x8B, 0x42,
+0x12, 0x43, 0x8B, 0xAF, 0x20, 0x15, 0x20, 0xEF, 0x60, 0x1E, 0x90, 0x8B, 0x42, 0xE4, 0x75, 0xF0,
+0x01, 0x12, 0x43, 0x74, 0x12, 0x29, 0xD9, 0xFF, 0x90, 0x8B, 0x3F, 0xE4, 0x75, 0xF0, 0x01, 0x12,
+0x43, 0x74, 0xEF, 0x12, 0x42, 0x4D, 0x80, 0xDB, 0xAB, 0x1A, 0xAA, 0x1B, 0xA9, 0x1C, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x8B,
+0x90, 0x8B, 0x53, 0xE0, 0xFF, 0x04, 0xF0, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x7F, 0xAF,
+0x7E, 0x01, 0x12, 0x74, 0x3B, 0xEF, 0x60, 0x47, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x8B, 0x1D,
+0x8A, 0x1E, 0x89, 0x1F, 0x75, 0x20, 0x02, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA0, 0xD1, 0xE4, 0x90,
+0x8B, 0x48, 0x12, 0x43, 0x6B, 0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x90, 0x8B, 0x45, 0x12, 0x43,
+0x6B, 0x12, 0x29, 0xD9, 0xFF, 0xC4, 0x54, 0x0F, 0xF5, 0x20, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA2,
+0xD1, 0xE4, 0x90, 0x01, 0xAF, 0x74, 0xFF, 0xF0, 0x90, 0x01, 0xCB, 0xE0, 0x64, 0x80, 0xF0, 0xD0,
+0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8A, 0xC5, 0xE0, 0x54, 0xF0, 0x44, 0x03, 0xF0, 0x54, 0x0F, 0x44,
+0x80, 0xF0, 0x7B, 0x00, 0x7A, 0x00, 0x79, 0x56, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x8B, 0x0B, 0x7A,
+0x8A, 0x79, 0xC5, 0xE1, 0x33, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xC4, 0x74,
+0xC5, 0xF0, 0x74, 0x5F, 0xA3, 0xF0, 0x90, 0x04, 0x1D, 0xE0, 0x60, 0x1A, 0x90, 0x05, 0x22, 0xE0,
+0x54, 0x90, 0x60, 0x07, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x01, 0xC7, 0xE0, 0x30,
+0xE1, 0xE4, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF,
+0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFB, 0xFA, 0xEF, 0x30, 0xE0, 0x02, 0x7B, 0x80, 0xEF, 0xC3, 0x13,
+0x90, 0xFD, 0x10, 0xF0, 0x90, 0x04, 0x25, 0xEF, 0xF0, 0xED, 0x60, 0x1E, 0xAF, 0x03, 0x74, 0x0F,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x74, 0x10, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0xAF, 0x03, 0x74, 0x08, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x09, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0x21, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83,
+0xE0, 0x54, 0xF7, 0xF0, 0xAE, 0x02, 0xAF, 0x03, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x5F, 0xC5,
+0xBF, 0x01, 0x10, 0x90, 0x02, 0x09, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x90, 0x04, 0x1F,
+0x74, 0x20, 0xF0, 0x22, 0x90, 0x01, 0x02, 0xE0, 0x54, 0x03, 0xFF, 0xE0, 0x54, 0x0C, 0x13, 0x13,
+0x54, 0x3F, 0xFE, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x0E, 0x90, 0x8A, 0xC5, 0x74,
+0x01, 0xF0, 0xA3, 0x74, 0x37, 0xF0, 0x79, 0x01, 0x80, 0x18, 0xEE, 0x64, 0x01, 0x60, 0x07, 0xAF,
+0x06, 0xEE, 0x64, 0x03, 0x70, 0x3B, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0, 0xA3, 0x74, 0x3D, 0xF0,
+0x79, 0x40, 0x90, 0x8A, 0xC5, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0, 0x59,
+0x60, 0x08, 0xE9, 0xF0, 0xE4, 0x90, 0x8A, 0xF6, 0xF0, 0x22, 0x90, 0x8A, 0xF6, 0xE0, 0x04, 0xF0,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x0B, 0xE4, 0xF0, 0x90, 0x04, 0x19, 0xE0, 0x30, 0xE0, 0x02, 0x11,
+0x6D, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0,
+0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90,
+0x01, 0xC4, 0x74, 0xF2, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xE0, 0x55, 0x28, 0xF5,
+0x2C, 0xA3, 0xE0, 0x55, 0x29, 0xF5, 0x2D, 0xA3, 0xE0, 0x55, 0x2A, 0xF5, 0x2E, 0xA3, 0xE0, 0x55,
+0x2B, 0xF5, 0x2F, 0xE5, 0x2C, 0x20, 0xE0, 0x02, 0x41, 0x89, 0x90, 0x01, 0x34, 0x74, 0x01, 0xF0,
+0x85, 0xD1, 0x4D, 0x85, 0xD2, 0x4E, 0x85, 0xD3, 0x4F, 0x85, 0xD4, 0x50, 0x85, 0xD5, 0x51, 0x85,
+0xD6, 0x52, 0x85, 0xD7, 0x53, 0x85, 0xD9, 0x54, 0xE5, 0x54, 0x54, 0x40, 0xC3, 0x13, 0xFF, 0xE5,
+0x53, 0x54, 0x20, 0x6F, 0x70, 0x02, 0x41, 0x46, 0xE5, 0x54, 0x30, 0xE5, 0x02, 0x41, 0x46, 0xE5,
+0x52, 0x54, 0x1F, 0xF5, 0x08, 0xE5, 0x4D, 0x54, 0x3F, 0xF5, 0x09, 0xE5, 0x51, 0x54, 0x1F, 0xFF,
+0xE5, 0x08, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0,
+0x12, 0x42, 0x81, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82,
+0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x09, 0xD3, 0x94, 0x04,
+0x40, 0x03, 0x75, 0x09, 0x04, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43, 0x5F,
+0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xE5, 0x53, 0x54,
+0x1F, 0x2F, 0xFF, 0xE4, 0x3E, 0xFE, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43,
+0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE5, 0x54,
+0x20, 0xE6, 0x24, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x4F, 0x30, 0xE7, 0x36,
+0xAF, 0x08, 0x12, 0x5C, 0xC3, 0x80, 0x2F, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0,
+0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5,
+0x4F, 0x30, 0xE7, 0x12, 0xE5, 0x4F, 0x54, 0x7F, 0xFD, 0xE5, 0x53, 0x54, 0x1F, 0xF5, 0x0D, 0xAB,
+0x09, 0xAF, 0x08, 0x12, 0x5C, 0x66, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x3A, 0x90,
+0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0,
+0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x21, 0x90, 0x8B, 0x3D, 0x12, 0x4B, 0x5C, 0x90, 0x01,
+0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x80, 0x09,
+0x12, 0x4B, 0x34, 0xBF, 0x01, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2C, 0x30, 0xE1, 0x21, 0x90, 0x01,
+0x34, 0x74, 0x02, 0xF0, 0x85, 0xD1, 0x56, 0x85, 0xD2, 0x57, 0x85, 0xD3, 0x58, 0x85, 0xD4, 0x59,
+0x85, 0xD5, 0x5A, 0x85, 0xD6, 0x5B, 0x85, 0xD7, 0x5C, 0x85, 0xD9, 0x5D, 0x12, 0x5F, 0xA4, 0xE5,
+0x2C, 0x30, 0xE3, 0x06, 0x90, 0x01, 0x34, 0x74, 0x08, 0xF0, 0xE5, 0x2C, 0x30, 0xE4, 0x09, 0x90,
+0x01, 0x34, 0x74, 0x10, 0xF0, 0x43, 0x55, 0x10, 0xE5, 0x2C, 0x30, 0xE5, 0x26, 0x90, 0x01, 0xCF,
+0xE0, 0x30, 0xE5, 0x1F, 0xE0, 0x54, 0xDF, 0xF0, 0x90, 0x01, 0x34, 0x74, 0x20, 0xF0, 0x75, 0xA8,
+0x00, 0x75, 0xE8, 0x00, 0x12, 0x51, 0x9D, 0x90, 0x00, 0x03, 0xE0, 0x54, 0xFB, 0xF0, 0x12, 0x52,
+0x0E, 0x80, 0xFE, 0xE5, 0x2C, 0x30, 0xE6, 0x2D, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0x90, 0x8B,
+0x32, 0xE0, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05, 0x90, 0x8B, 0x34, 0xE4,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05,
+0x90, 0x8B, 0x2E, 0xE4, 0xF0, 0xE5, 0x2E, 0x20, 0xE0, 0x02, 0x61, 0xE6, 0x90, 0x8B, 0x08, 0x74,
+0x01, 0xF0, 0x90, 0x01, 0x36, 0xF0, 0x90, 0x8B, 0x06, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05,
+0x53, 0xE0, 0x44, 0x02, 0xF0, 0x90, 0x05, 0xFC, 0xE0, 0x04, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30,
+0xE0, 0x2F, 0x90, 0x8B, 0x37, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54,
+0x3F, 0x30, 0xE0, 0x1D, 0x90, 0x8B, 0x34, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0D, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x7F, 0x04, 0x12, 0x4E,
+0x89, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x55, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x4E,
+0x90, 0x8B, 0x2E, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x3E,
+0xB1, 0x5F, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60,
+0x2D, 0xEF, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF,
+0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x04, 0x7F, 0x01, 0xB1, 0x82, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x43,
+0xE7, 0x90, 0x8B, 0x08, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE1, 0x2F, 0x90, 0x01, 0x36, 0x74, 0x02,
+0xF0, 0x43, 0x55, 0x40, 0x11, 0x84, 0x90, 0x8B, 0x37, 0xE0, 0xB4, 0x01, 0x09, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x37, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x0D, 0xE4, 0xFF, 0x12,
+0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE2, 0x16, 0x90,
+0x01, 0x36, 0x74, 0x04, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x06, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x03, 0x12, 0x46, 0xB3, 0xE5, 0x2E, 0x30, 0xE3, 0x38, 0x90, 0x01, 0x36, 0x74, 0x08, 0xF0,
+0xE5, 0x21, 0x64, 0x01, 0x70, 0x2C, 0xE5, 0x24, 0x60, 0x28, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90,
+0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B,
+0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74,
+0x05, 0xF0, 0xE5, 0x2E, 0x30, 0xE4, 0x2B, 0x90, 0x01, 0x36, 0x74, 0x10, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x20, 0xE5, 0x24, 0x60, 0x1C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x1B, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x03, 0x12,
+0x4A, 0xFC, 0xE5, 0x2E, 0x30, 0xE5, 0x1F, 0x90, 0x01, 0x36, 0x74, 0x20, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x14, 0xE5, 0x24, 0x60, 0x10, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A,
+0x97, 0x80, 0x03, 0x12, 0x49, 0x49, 0xE5, 0x2E, 0x30, 0xE6, 0x1B, 0x90, 0x01, 0x36, 0x74, 0x40,
+0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x10, 0xE5, 0x24, 0x60, 0x0C, 0x53, 0x25, 0xFE, 0xE5, 0x25, 0x54,
+0x07, 0x70, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2F, 0x30, 0xE1, 0x28, 0x90, 0x01, 0x37, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x18, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x08,
+0x12, 0x48, 0xFE, 0x12, 0x7D, 0xC1, 0x80, 0x0B, 0x90, 0x8B, 0x31, 0x74, 0x01, 0xF0, 0x80, 0x03,
+0x12, 0x48, 0xFE, 0x74, 0xF2, 0x04, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0xD0, 0x07,
+0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0,
+0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x05,
+0x58, 0xE0, 0xFF, 0x90, 0x8B, 0x38, 0xE0, 0x2F, 0x24, 0xFE, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB,
+0xFD, 0x7F, 0x50, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x53, 0x74, 0x05, 0xF0, 0x22, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0A, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x04, 0x7F, 0x06, 0xB1, 0x82, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x03, 0x12, 0x78,
+0x35, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0x6F, 0x70,
+0x02, 0xE1, 0x4E, 0xEF, 0x12, 0x43, 0x94, 0x65, 0xB0, 0x00, 0x65, 0xEA, 0x01, 0x66, 0x30, 0x02,
+0x66, 0x6A, 0x03, 0x66, 0xA2, 0x04, 0x66, 0xDB, 0x05, 0x67, 0x16, 0x06, 0x00, 0x00, 0x67, 0x4E,
+0xEE, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0xB4,
+0x05, 0x04, 0xF1, 0x5D, 0xE1, 0x4E, 0xEF, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xA4, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0xE1, 0x4E, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x02, 0x60, 0x02, 0xE1, 0x4E, 0xF1, 0x67, 0xE1, 0x4E,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x08, 0xEE, 0xB4,
+0x03, 0x04, 0x7F, 0x01, 0xF1, 0x53, 0xF1, 0xD0, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x06, 0xEE, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xB9,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13,
+0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0xF1, 0xAF, 0x80, 0x73, 0x90, 0x8B, 0x2D, 0xE0, 0xFE,
+0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x0B, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x04, 0x7F, 0x01,
+0xF1, 0x81, 0xF1, 0xC3, 0x80, 0x38, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1,
+0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0xE4, 0xFF, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xDD, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0x12, 0x4A, 0xB2, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x04,
+0xF0, 0x22, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0,
+0x22, 0x90, 0x8B, 0x56, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x56, 0xE0, 0x60, 0x05, 0x90,
+0x05, 0x22, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12, 0x4A, 0xCC, 0x90, 0x8B, 0x2D,
+0x74, 0x01, 0xF0, 0x22, 0x7F, 0x01, 0x12, 0x4A, 0x7C, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12,
+0x7C, 0x4A, 0x90, 0x8B, 0x2D, 0x74, 0x04, 0xF0, 0x22, 0x12, 0x4A, 0x32, 0x90, 0x8B, 0x2D, 0x74,
+0x03, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x05, 0xF0, 0x22,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0x74, 0x6F, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x06, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0xE4, 0xFD, 0xFC, 0xEF, 0x30, 0xE0, 0x02, 0x7D, 0x80, 0xEF, 0xC3, 0x13, 0x90, 0xFD, 0x10,
+0xF0, 0xAE, 0x04, 0xAF, 0x05, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x75, 0x28, 0x33, 0xE4, 0xF5, 0x29,
+0x75, 0x2A, 0x07, 0xF5, 0x2B, 0x90, 0x01, 0x30, 0xE5, 0x28, 0xF0, 0xA3, 0xE5, 0x29, 0xF0, 0xA3,
+0xE5, 0x2A, 0xF0, 0xA3, 0xE5, 0x2B, 0xF0, 0x22, 0x75, 0x30, 0x1F, 0x75, 0x31, 0x01, 0x43, 0x31,
+0x10, 0xE4, 0xF5, 0x32, 0x90, 0x01, 0x38, 0xE5, 0x30, 0xF0, 0xA3, 0xE5, 0x31, 0xF0, 0xA3, 0xE5,
+0x32, 0xF0, 0x22, 0x22, 0x90, 0x00, 0x02, 0xE0, 0x54, 0xE0, 0x7F, 0x01, 0x60, 0x02, 0x7F, 0x00,
+0x22, 0x90, 0x00, 0xF3, 0xE0, 0x7F, 0x00, 0x30, 0xE3, 0x02, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x09,
+0xE0, 0xB4, 0x01, 0x0C, 0x90, 0x00, 0xF2, 0xE0, 0x30, 0xE7, 0x05, 0x7E, 0xFD, 0x7F, 0x33, 0x22,
+0x7E, 0xFD, 0x7F, 0x2F, 0x22, 0x90, 0x00, 0xF3, 0xE0, 0x30, 0xE2, 0x0D, 0x90, 0x05, 0x41, 0x74,
+0x10, 0xF0, 0x90, 0x05, 0x5A, 0xF0, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x01, 0x64, 0x74, 0xA0, 0xF0,
+0x22, 0xC0, 0xE0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x05, 0xC0, 0x06,
+0xC0, 0x07, 0x7D, 0x91, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0x74, 0x68, 0xFF, 0xA3, 0xF0, 0x53, 0x91,
+0xEF, 0x90, 0x00, 0x51, 0xE0, 0xFE, 0x90, 0x00, 0x55, 0xE0, 0x5E, 0xF5, 0x3D, 0x90, 0x00, 0x52,
+0xE0, 0xFE, 0x90, 0x00, 0x56, 0xE0, 0x5E, 0xF5, 0x3E, 0xE5, 0x3D, 0x30, 0xE4, 0x06, 0x90, 0x00,
+0x55, 0x74, 0x10, 0xF0, 0xE5, 0x3D, 0x30, 0xE5, 0x06, 0x90, 0x00, 0x55, 0x74, 0x20, 0xF0, 0xE5,
+0x3D, 0x30, 0xE6, 0x06, 0x90, 0x00, 0x55, 0x74, 0x40, 0xF0, 0xE5, 0x3D, 0x30, 0xE7, 0x06, 0x90,
+0x00, 0x55, 0x74, 0x80, 0xF0, 0xE5, 0x3E, 0x30, 0xE0, 0x06, 0x90, 0x00, 0x56, 0x74, 0x01, 0xF0,
+0xE5, 0x3E, 0x30, 0xE1, 0x06, 0x90, 0x00, 0x56, 0x74, 0x02, 0xF0, 0xE5, 0x3E, 0x30, 0xE2, 0x06,
+0x90, 0x00, 0x56, 0x74, 0x04, 0xF0, 0xE5, 0x3E, 0x30, 0xE3, 0x06, 0x90, 0x00, 0x56, 0x74, 0x08,
+0xF0, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0xA3, 0xEF, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0,
+0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xE0, 0x32, 0xEF, 0xC3, 0x94, 0x20, 0x50, 0x39, 0xEF, 0x30,
+0xE0, 0x17, 0xED, 0xC4, 0x54, 0xF0, 0xFD, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x0F, 0x80, 0x10, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5,
+0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0xA4, 0x2E, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x4D, 0xF0, 0x22, 0xAD, 0x07, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0xF9, 0x54, 0x1F, 0xA3,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xE1,
+0xF0, 0xED, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFB, 0xA3,
+0xE0, 0x90, 0x8A, 0xE2, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xED, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE4, 0xCB, 0xF0, 0xA3, 0xEB,
+0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5,
+0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4,
+0x34, 0x86, 0xF5, 0x83, 0xEA, 0xF0, 0xA3, 0xEB, 0xF0, 0xEE, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0xB9,
+0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF,
+0xF0, 0xEF, 0x04, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xFE, 0xD3, 0x9F, 0x40, 0x02, 0x41, 0xF3, 0xEE, 0xC3, 0x94, 0x10, 0x40, 0x21, 0xEE, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE2, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xE0, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x59, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x3C, 0x90, 0x8A, 0xE0, 0xE0, 0xB4, 0x11, 0x0D, 0x90, 0x8A, 0xE3, 0xE0,
+0x30, 0xE7, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x17, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0x64, 0x13,
+0x60, 0x04, 0xEF, 0xB4, 0x12, 0x0D, 0x90, 0x8A, 0xE2, 0xE0, 0x30, 0xE0, 0x06, 0x90, 0x8A, 0xE0,
+0x74, 0x18, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0x80,
+0x42, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x41, 0x17, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0x6C, 0x70, 0x71, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83,
+0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x10,
+0xE9, 0x20, 0xE6, 0x0C, 0x90, 0x8A, 0xDF, 0xE0, 0x44, 0x40, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x03,
+0xAF, 0x01, 0x22, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x66, 0x90, 0x8A, 0xDF, 0xE0, 0xD3, 0x9C, 0x40, 0x5E, 0x90,
+0x8A, 0xE1, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xFC, 0xA3, 0xE0, 0xFF, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF,
+0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF,
+0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82,
+0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x22, 0x74, 0x01, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xDE, 0xE0, 0x44,
+0x80, 0xFD, 0x12, 0x5C, 0x4E, 0x90, 0x8A, 0xDE, 0xE0, 0x44, 0x80, 0xFF, 0x22, 0xE4, 0x90, 0x8A,
+0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x03, 0x02, 0x72, 0x54, 0x75,
+0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x72,
+0x4B, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE0, 0xFC, 0xA3, 0xE0, 0xD3, 0x94, 0x00, 0xEC, 0x94, 0x00, 0x50, 0x03, 0x02, 0x72, 0x4B, 0xEF,
+0x75, 0xF0, 0x0A, 0xA4, 0x24, 0x00, 0xF9, 0x74, 0x84, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13,
+0x89, 0x14, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE0, 0xFD, 0xA3, 0xE0, 0x90, 0x8A, 0xD4, 0xCD, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x25, 0xE0,
+0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD6,
+0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0xE0, 0x54, 0x3F, 0x90, 0x8A, 0xD0, 0xF0, 0xE0, 0xFD, 0x54, 0x1F, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xEE, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD9, 0xF0, 0x90,
+0x8A, 0xCF, 0xE0, 0xFB, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xC3, 0x94,
+0x05, 0x40, 0x02, 0xC1, 0x9C, 0x90, 0x8A, 0xD9, 0xE0, 0xFE, 0x90, 0x8A, 0xD1, 0xE0, 0x9E, 0x40,
+0x13, 0x90, 0x8A, 0xD9, 0xE0, 0x90, 0x8A, 0xD1, 0xF0, 0xED, 0x54, 0x40, 0xFD, 0x90, 0x8A, 0xD0,
+0xF0, 0xEE, 0x4D, 0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0x90, 0x41, 0x12, 0x93, 0xFE, 0x74, 0x23,
+0x2B, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xC3, 0x9E, 0x40, 0x06, 0xEF, 0x90, 0x40,
+0xDA, 0x80, 0x07, 0x90, 0x8A, 0xD1, 0xE0, 0x90, 0x40, 0xF6, 0x93, 0x90, 0x8A, 0xD8, 0xF0, 0x90,
+0x8A, 0xD8, 0xE0, 0x75, 0xF0, 0x06, 0xA4, 0x24, 0x50, 0xF9, 0x74, 0x40, 0x35, 0xF0, 0x75, 0x0F,
+0xFF, 0xF5, 0x10, 0x89, 0x11, 0x90, 0x8A, 0xD0, 0xE0, 0x90, 0x41, 0xBA, 0x93, 0xFF, 0xD3, 0x90,
+0x8A, 0xD7, 0xE0, 0x9F, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x0D, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0xE4, 0xFD, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xE1, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24,
+0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD2, 0xCF,
+0xF0, 0xA3, 0xEF, 0xF0, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x12, 0x29, 0xD9, 0xFF, 0x7E, 0x00,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x97, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90,
+0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x02,
+0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12,
+0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x7E,
+0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x04, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0,
+0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10,
+0xA9, 0x11, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9,
+0x14, 0x90, 0x00, 0x06, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2,
+0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x04, 0x12,
+0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x08, 0x12, 0x42,
+0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81,
+0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x05, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0x90,
+0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F,
+0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x0C, 0xA3, 0xE0, 0x9F, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0x9E,
+0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xD3, 0xED, 0x9B,
+0xEC, 0x9A, 0x40, 0x05, 0x31, 0x78, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFE, 0x74, 0x01, 0x93, 0xFF, 0xC3,
+0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x03, 0x02, 0x71, 0xAF, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFC, 0x64, 0x05, 0x60, 0x03,
+0x02, 0x70, 0x7D, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x03, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x19, 0x40, 0x3D, 0x80, 0x2E, 0xEE, 0xB4, 0x02, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94,
+0x11, 0x40, 0x2E, 0x80, 0x1F, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x01, 0x0B, 0x90, 0x8A, 0xD1,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x1B, 0x80, 0x0C, 0xEE, 0x70, 0x11, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x03, 0x40, 0x0D, 0x90, 0x89, 0x43, 0x74, 0x01, 0xF0, 0x80, 0x05, 0xE4, 0x90, 0x89, 0x43,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0,
+0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE,
+0xC3, 0x94, 0x30, 0x50, 0x0B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0x02, 0x70, 0x28,
+0x90, 0x89, 0x43, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x70, 0x1D, 0x90, 0x8A, 0xCF, 0xE0, 0x24,
+0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x64, 0x0A, 0x60, 0x5B, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xEE, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x38,
+0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0xEF, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x23, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x50, 0x16, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0xFF, 0x90, 0x8A, 0xD1, 0xE0, 0x6F, 0x60, 0x56, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x23, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x94, 0x42, 0x40, 0x08, 0x90, 0x8A, 0xDD, 0x74,
+0x05, 0xF0, 0x80, 0x11, 0xEF, 0xD3, 0x94, 0x39, 0x90, 0x8A, 0xDD, 0x40, 0x05, 0x74, 0x03, 0xF0,
+0x80, 0x03, 0x74, 0x01, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0x80, 0x2F, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x44,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x14, 0xE4, 0x90, 0x8A,
+0xDD, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFE, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x84, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFE, 0x74, 0x43, 0x2F, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12, 0x43,
+0x5F, 0xE0, 0xB4, 0x01, 0x11, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x21, 0xAC, 0xEC, 0x64, 0x06,
+0x60, 0x02, 0x21, 0xAF, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x41, 0xDB, 0x93, 0xFF, 0x7E,
+0x00, 0x90, 0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xDB, 0xEE,
+0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE0, 0x90, 0x8A, 0xDD, 0xF0, 0xE4, 0x90, 0x8A, 0xDA, 0xF0, 0x90, 0x8A, 0xDA, 0xE0, 0xFF,
+0xD3, 0x94, 0x04, 0x50, 0x47, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x75, 0xF0, 0x02, 0xEF, 0xA4,
+0xF5, 0x82, 0x85, 0xF0, 0x83, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0xEF, 0x90, 0x41, 0xD6, 0x93,
+0xFF, 0x7E, 0x00, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0x90,
+0x8A, 0xDB, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2,
+0xE0, 0x9E, 0x50, 0x08, 0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0x80, 0xAF, 0x90, 0x8A, 0xDA, 0xE0,
+0xC3, 0x13, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFF, 0xB4, 0x01, 0x0D, 0x90, 0x8A, 0xDA, 0xE0, 0x70,
+0x5D, 0x90, 0x8A, 0xDD, 0x04, 0xF0, 0x80, 0x5B, 0xEF, 0xB4, 0x03, 0x1D, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x03, 0xF0, 0x80, 0x48, 0xEF, 0xB4, 0x01, 0x08, 0x90,
+0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x80, 0x3C, 0x80, 0x35, 0x90, 0x8A, 0xDD, 0xE0, 0x64, 0x05, 0x70,
+0x32, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x0F,
+0xEF, 0x90, 0x8A, 0xDD, 0xB4, 0x01, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0, 0xD3,
+0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90,
+0x8A, 0xDD, 0xF0, 0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00,
+0x40, 0x05, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xED, 0xF0, 0x12, 0x69, 0x38, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xD3, 0x94,
+0x05, 0x50, 0x0F, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0x04, 0xF0,
+0x80, 0x0F, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xE4, 0xF5, 0xF0, 0x12, 0x42, 0xFA, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x02, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x04, 0xE4,
+0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x06, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00,
+0x08, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xC0,
+0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04,
+0xF0, 0x02, 0x6B, 0xC2, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3,
+0x94, 0x10, 0x50, 0x14, 0x74, 0xA4, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE4, 0xF0,
+0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x80, 0xE2, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x02, 0x81, 0x0E, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x00,
+0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x02, 0x12, 0x43,
+0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x04, 0x12, 0x43, 0x5F, 0xE4,
+0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x06, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3,
+0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x08, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x74,
+0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x74, 0x44, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x88,
+0xF5, 0x83, 0xE4, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0,
+0x74, 0x24, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x64, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x41, 0x8C, 0x93, 0xFE, 0x74, 0x01, 0x93,
+0xFF, 0x90, 0x41, 0x54, 0x74, 0x01, 0x93, 0x2F, 0xFF, 0xE4, 0x93, 0x3E, 0xC3, 0x13, 0xFE, 0xEF,
+0x13, 0xFF, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43,
+0x5F, 0x74, 0x01, 0xF0, 0x74, 0xC1, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74, 0x0C,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0x74, 0xFF, 0xF0, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x23, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0x74, 0x0F, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0x74, 0x13, 0xF0, 0x75, 0xF0, 0x09,
+0xED, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x41, 0x7D, 0x22, 0x12,
+0x29, 0xD9, 0xFF, 0xC3, 0x94, 0x20, 0x50, 0x14, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFE, 0x74,
+0x23, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xEE, 0xF0, 0x22, 0xEF, 0xB4, 0x20, 0x0A,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0x90, 0x87, 0x21, 0xF0, 0x22, 0x90, 0x8B, 0x4B, 0xEE, 0xF0,
+0xA3, 0xEF, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x8B, 0x4B, 0xE0, 0xFE, 0xA3, 0xE0, 0xF5,
+0x82, 0x8E, 0x83, 0xE0, 0x60, 0x2C, 0xC3, 0x90, 0x8B, 0x4E, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4D,
+0xE0, 0x94, 0x03, 0x40, 0x0A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x7F, 0x00, 0x22, 0x90,
+0x8B, 0x4D, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54,
+0x80, 0xC6, 0x7F, 0x01, 0x22, 0x12, 0x29, 0xD9, 0xF5, 0x21, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3,
+0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x01, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x0A, 0xF0,
+0x12, 0x47, 0xFA, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x30,
+0xE0, 0x25, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x10, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90,
+0x8B, 0x11, 0xF0, 0xEF, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x0F, 0xF0, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x16, 0xF0, 0x22, 0x90, 0x8B, 0x10, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x11,
+0x74, 0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0x22,
+0x12, 0x29, 0xD9, 0x30, 0xE0, 0x19, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x15, 0xF0, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x0F, 0x90,
+0x8B, 0x15, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B,
+0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x12, 0xF0,
+0x60, 0x07, 0xE4, 0xFD, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x12, 0xE0, 0x90, 0x01, 0xE7,
+0xF0, 0x22, 0x90, 0x02, 0x09, 0xE0, 0xFD, 0x12, 0x29, 0xD9, 0xFE, 0xAF, 0x05, 0xED, 0x2E, 0x90,
+0x8A, 0xF7, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF8, 0xF0,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF9, 0xF0, 0x90, 0x00, 0x03,
+0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xFA, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20,
+0xFF, 0xAE, 0x05, 0xED, 0x2F, 0x90, 0x8A, 0xFB, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x12, 0x29, 0xD9, 0xC3,
+0x13, 0x20, 0xE0, 0x02, 0xC1, 0xED, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF,
+0x54, 0x02, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFD, 0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF,
+0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7,
+0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x10, 0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0,
+0x12, 0x29, 0xD9, 0xFE, 0x54, 0x20, 0xFD, 0xEF, 0x54, 0xDF, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0,
+0xEE, 0x54, 0x40, 0xFE, 0xEF, 0x54, 0xBF, 0x4E, 0xF0, 0x20, 0xE0, 0x02, 0xC1, 0xD9, 0x90, 0x8A,
+0xDD, 0x74, 0x21, 0xF0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x13, 0x13,
+0x54, 0x01, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13, 0x54, 0x01, 0x6E, 0x60, 0x2A, 0xEF,
+0x54, 0x04, 0xFF, 0xED, 0x54, 0xFB, 0x4F, 0xF0, 0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0E,
+0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0xFD, 0xE4, 0xFF, 0x12, 0x36, 0xE6, 0x80, 0x0B, 0xE4, 0x90,
+0x8B, 0x34, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x36, 0x75, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13,
+0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x12, 0xF0, 0xED, 0xC4, 0x54,
+0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x14, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4,
+0x13, 0x54, 0x07, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x8B, 0x32,
+0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x40, 0xF0,
+0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x70, 0x05, 0x7F, 0x01,
+0x12, 0x4E, 0x89, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x04, 0x7F,
+0x03, 0x80, 0x0E, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F,
+0x02, 0x12, 0x4E, 0x89, 0x7F, 0x02, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90,
+0x05, 0x27, 0xF0, 0xE4, 0xFF, 0x12, 0x4E, 0x89, 0x7F, 0x03, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDA,
+0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x54, 0x02, 0xFE, 0x90, 0x8B, 0x2C, 0xE0, 0x54, 0xFD,
+0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x29, 0xD9,
+0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x10,
+0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x40, 0xFD, 0xEF, 0x54,
+0xBF, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x04, 0xFE, 0xEF, 0x54, 0xFB, 0x4E, 0xF0,
+0x20, 0xE0, 0x02, 0xE1, 0xE2, 0x90, 0x8A, 0xDD, 0x74, 0x31, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x13,
+0x13, 0x54, 0x3F, 0x20, 0xE0, 0x0B, 0xE4, 0x90, 0x8B, 0x2E, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x36,
+0x75, 0x90, 0x8B, 0x2C, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A,
+0xDD, 0xE0, 0x44, 0x02, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0,
+0x44, 0x04, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x54, 0x06, 0x60, 0x0C, 0x90, 0x01, 0x3E, 0x74, 0x03,
+0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0D, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x2C, 0x7F, 0x06, 0x12, 0x65, 0x82, 0x80, 0x25, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x1B,
+0x7F, 0x01, 0x12, 0x65, 0x82, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x09, 0x7D, 0x01, 0xAF,
+0x23, 0x12, 0x45, 0xA2, 0x80, 0x05, 0x12, 0x4E, 0x56, 0x80, 0x03, 0x12, 0x7D, 0xC1, 0x7F, 0x01,
+0x80, 0x4C, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27, 0xF0, 0x7D, 0x03, 0x7F, 0x02,
+0x12, 0x36, 0x92, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x02, 0x80, 0x1B, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4,
+0x02, 0x05, 0x7F, 0x01, 0x12, 0x65, 0x82, 0x11, 0x35, 0x12, 0x4A, 0xFC, 0x7F, 0x03, 0x11, 0x42,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8B, 0x31, 0xE0, 0xB4, 0x01, 0x05, 0xE4, 0xF0, 0x12, 0x48,
+0xFE, 0x22, 0xAD, 0x07, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x32,
+0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xED, 0x64, 0x02, 0x60, 0x04, 0xED, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x2C, 0xE0, 0x54,
+0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x38, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8A, 0xFD, 0xE0, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xFE, 0xE0, 0xFF, 0xA3, 0xE0, 0x90,
+0x8A, 0xE9, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE4, 0xE0,
+0xFF, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0x8B, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0xEB, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0xE0, 0xB4,
+0x04, 0xDA, 0x90, 0x8A, 0xE8, 0xE0, 0x12, 0x43, 0x94, 0x78, 0xF8, 0x00, 0x7A, 0x6B, 0x01, 0x79,
+0x01, 0x02, 0x79, 0x01, 0x03, 0x79, 0x01, 0x04, 0x7A, 0x6B, 0x05, 0x7A, 0x35, 0x80, 0x7A, 0x4E,
+0x81, 0x7A, 0x6B, 0x82, 0x00, 0x00, 0x7A, 0x67, 0x90, 0x8A, 0xEE, 0xE0, 0xFF, 0x51, 0x72, 0x41,
+0x6B, 0x90, 0x8A, 0xE8, 0xE0, 0xFF, 0xB4, 0x02, 0x08, 0x90, 0x8A, 0xE5, 0x74, 0x01, 0xF0, 0x80,
+0x0F, 0xEF, 0x90, 0x8A, 0xE5, 0xB4, 0x03, 0x05, 0x74, 0x02, 0xF0, 0x80, 0x03, 0x74, 0x04, 0xF0,
+0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x08, 0x50, 0x78, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A,
+0xE5, 0xE0, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE9,
+0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xC3, 0xEE, 0x94, 0x01, 0x90, 0x8A, 0xE4, 0xE0, 0x50, 0x1F, 0xFE,
+0x2F, 0xFF, 0xEE, 0xFD, 0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D,
+0xF5, 0x82, 0x74, 0x8A, 0x3C, 0xF5, 0x83, 0xE0, 0xFD, 0x12, 0x51, 0x88, 0x80, 0x2B, 0xFF, 0xFD,
+0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A,
+0x3C, 0xF5, 0x83, 0xE0, 0xFE, 0xEF, 0xFD, 0x90, 0x8A, 0xEA, 0xE0, 0x2D, 0xFD, 0x90, 0x8A, 0xE9,
+0xE0, 0x34, 0x00, 0x8D, 0x82, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0x80,
+0x8D, 0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x10, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE8, 0xE0,
+0x64, 0x04, 0x60, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xEC, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78,
+0x10, 0x12, 0x2A, 0x6C, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xEB, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x18, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01,
+0xD0, 0x00, 0x12, 0x43, 0x46, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xED,
+0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x08, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0,
+0x01, 0xD0, 0x00, 0x12, 0x43, 0x46, 0xA8, 0x04, 0xA9, 0x05, 0xAA, 0x06, 0xAB, 0x07, 0xA3, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x12, 0x43, 0x46, 0xA3, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xEF, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF,
+0x12, 0x2F, 0xD9, 0x80, 0x36, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4,
+0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x37, 0x54, 0x80, 0x1D, 0x90, 0x8A,
+0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3,
+0xEF, 0xF0, 0x12, 0x36, 0xCB, 0x80, 0x04, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x8F, 0x0F, 0xE4, 0x90, 0x8A, 0xF3, 0xF0, 0xE5, 0x0F, 0x14, 0xFE, 0x90, 0x8A, 0xF3,
+0xE0, 0xFF, 0xC3, 0x9E, 0x50, 0x0E, 0xEF, 0x04, 0xFD, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE0,
+0x04, 0xF0, 0x80, 0xE5, 0xE5, 0x0F, 0x14, 0xFF, 0x7D, 0xFF, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3,
+0xE5, 0x0F, 0xF0, 0x90, 0x8A, 0xF3, 0xE0, 0xC3, 0x94, 0xFF, 0x50, 0x0F, 0xE0, 0xFF, 0x04, 0xFD,
+0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE8, 0xAD, 0x0F, 0x7F, 0xFF, 0x02,
+0x34, 0xB7, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xA3, 0x74,
+0x04, 0xF0, 0xA3, 0xE4, 0xF0, 0x90, 0x8A, 0xE2, 0xF0, 0xA3, 0xF0, 0x90, 0x02, 0x09, 0xE0, 0x90,
+0x8A, 0xE1, 0xF0, 0x12, 0x29, 0xD9, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0x2F, 0x90, 0x8A, 0xE0, 0xF0,
+0x30, 0xE0, 0x0B, 0x90, 0x8A, 0xDB, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x80, 0x07, 0xE4, 0x90,
+0x8A, 0xDB, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90,
+0x8A, 0xDD, 0xE0, 0x24, 0x20, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFC, 0x2D,
+0xFF, 0x24, 0x01, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xFD, 0xF0, 0x74,
+0x02, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFE, 0xEC, 0x2D, 0x24, 0x03, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0x90, 0x8A, 0xFE, 0xF0,
+0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xDA, 0x74, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFF, 0xA3,
+0xE0, 0x2F, 0xFF, 0x90, 0x8A, 0xDA, 0xE0, 0xFE, 0x2F, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0xFF, 0x74, 0xFC, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0xE0, 0xB4, 0x08, 0xCF, 0x11, 0x89, 0xEF, 0x70, 0x45, 0x90,
+0x01, 0xC3, 0xE0, 0x60, 0x2B, 0xC3, 0x90, 0x8A, 0xE3, 0xE0, 0x94, 0xE8, 0x90, 0x8A, 0xE2, 0xE0,
+0x94, 0x03, 0x40, 0x09, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x80, 0x79, 0x90, 0x8A, 0xE2,
+0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x80, 0xCF,
+0x90, 0x01, 0xC6, 0xE0, 0x90, 0x01, 0xC3, 0x30, 0xE2, 0x05, 0x74, 0xFE, 0xF0, 0x80, 0x57, 0x74,
+0xFF, 0xF0, 0x80, 0x52, 0x90, 0x8A, 0xDD, 0xE0, 0xB4, 0x78, 0x2E, 0xE4, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0x70, 0x04, 0xA3, 0xE0, 0x64, 0x80, 0x90, 0x8A, 0xDB,
+0x70, 0x05, 0xF0, 0xA3, 0xF0, 0x80, 0x06, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x80, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x24, 0x08, 0xF0,
+0x90, 0x8A, 0xDE, 0x74, 0xFF, 0xF5, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDE, 0xE0, 0x70, 0x02,
+0xA3, 0xE0, 0x60, 0x02, 0x61, 0x16, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B,
+0x05, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x06, 0xF0, 0x22, 0xE4, 0xF5, 0x61,
+0x22, 0x91, 0x4A, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0,
+0x7F, 0x78, 0x7E, 0x08, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x1C, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E,
+0x0C, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x20, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x27,
+0xDE, 0x90, 0x8B, 0x24, 0x12, 0x2A, 0x7F, 0x90, 0x8B, 0x09, 0xE0, 0x90, 0x8B, 0x1C, 0xB4, 0x01,
+0x0D, 0x12, 0x43, 0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xED, 0x54, 0xC7, 0xFD, 0x80, 0x07, 0x12, 0x43,
+0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08,
+0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0xEF, 0x54, 0x0F, 0xFF, 0xEC, 0x90, 0x80,
+0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43,
+0x53, 0xEF, 0x44, 0x02, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08,
+0x12, 0x2F, 0xD9, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x28, 0x12, 0x2A, 0x7F,
+0x90, 0x80, 0x85, 0x12, 0x2A, 0x8B, 0x00, 0x1B, 0x25, 0xA0, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F,
+0xD9, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0xE4, 0xFD, 0xFF, 0x12, 0x34,
+0x81, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00,
+0x00, 0x00, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x34, 0x81, 0x90, 0x00, 0x11, 0xE0, 0x54, 0xF6, 0xF0,
+0x02, 0x52, 0x0E, 0x91, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74,
+0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0xB1, 0x42, 0x90, 0x8B, 0x33, 0x74, 0x04,
+0xF0, 0x22, 0x90, 0x00, 0x11, 0xE0, 0x44, 0x09, 0xF0, 0x12, 0x52, 0x0E, 0x90, 0x8B, 0x1C, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2F, 0xD9, 0x90,
+0x8B, 0x20, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12,
+0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x00,
+0x7E, 0x08, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x28, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A,
+0x7F, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F, 0xD9, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x03,
+0x2D, 0x95, 0xE4, 0xFD, 0xFF, 0x12, 0x34, 0x81, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90,
+0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x03, 0x2D, 0x95, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x34, 0x81,
+0x22, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x3C, 0xE5, 0x22, 0x54, 0x0F, 0x14, 0x60, 0x2E,
+0x14, 0x60, 0x1E, 0x24, 0xFE, 0x60, 0x0E, 0x24, 0xF8, 0x70, 0x2A, 0xE4, 0x90, 0x8B, 0x2D, 0xF0,
+0x90, 0x05, 0x22, 0xF0, 0x22, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x22, 0xE4, 0xF0,
+0x22, 0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0x90, 0x01,
+0xC6, 0xE0, 0x44, 0x08, 0xF0, 0x22, 0xAE, 0x07, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x18,
+0x90, 0x8B, 0x2C, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x0C, 0xAF, 0x06, 0x7D, 0x01,
+0x12, 0x45, 0xA2, 0xB1, 0xC1, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0x90, 0x01, 0x57, 0xE0, 0x60,
+0x3C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x1B, 0xE0,
+0x60, 0x07, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0x80, 0x24, 0x90, 0x8B, 0x0C, 0xE0, 0x04, 0xF0, 0x53,
+0x25, 0xEF, 0x90, 0x8B, 0x10, 0xE0, 0xFF, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0x40, 0x0E, 0xE5,
+0x21, 0xB4, 0x01, 0x09, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x03, 0xE0, 0x04, 0xF0, 0x90, 0x01, 0x5B,
+0xE0, 0x60, 0x10, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0xE4, 0x90,
+0x8B, 0x18, 0xF0, 0x90, 0x01, 0x5F, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x17, 0xF0, 0x22, 0xE4, 0x90, 0x8B, 0x4F, 0xF0, 0xA3,
+0xF0, 0x90, 0x05, 0xF8, 0xE0, 0x70, 0x0F, 0xA3, 0xE0, 0x70, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xA3,
+0xE0, 0x70, 0x03, 0x7F, 0x01, 0x22, 0xD3, 0x90, 0x8B, 0x50, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4F,
+0xE0, 0x94, 0x03, 0x40, 0x03, 0x7F, 0x00, 0x22, 0x7F, 0x32, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x90,
+0x8B, 0x4F, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x80, 0xC6, 0x00, 0x92, 0x00};
+
+// =================== v88 UMC A Cut P2PPS with CCX report C2H 2012-12-05 =====================
+u8 Rtl8192CUFwUMCACutImgArray[UMCACutImgArrayLength] = {
+0xC1, 0x88, 0x02, 0x05, 0x58, 0x00, 0x02, 0x00, 0x12, 0x05, 0x17, 0x11, 0xDE, 0x3E, 0x01, 0x00,
+0x94, 0x18, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x02, 0x46, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x60, 0xF2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x68, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x4B, 0x87, 0x00, 0x00,
+0x05, 0x04, 0x03, 0x02, 0x00, 0x03, 0x06, 0x05, 0x04, 0x03, 0x00, 0x04, 0x06, 0x05, 0x04, 0x02,
+0x00, 0x04, 0x08, 0x07, 0x06, 0x04, 0x00, 0x06, 0x0A, 0x09, 0x08, 0x06, 0x00, 0x08, 0x0A, 0x09,
+0x08, 0x04, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x02, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x00, 0x00, 0x08,
+0x12, 0x11, 0x10, 0x08, 0x00, 0x10, 0x1A, 0x19, 0x18, 0x10, 0x00, 0x18, 0x22, 0x21, 0x20, 0x18,
+0x00, 0x20, 0x22, 0x21, 0x20, 0x10, 0x00, 0x20, 0x22, 0x21, 0x20, 0x08, 0x00, 0x20, 0x22, 0x21,
+0x1C, 0x08, 0x00, 0x20, 0x22, 0x21, 0x14, 0x08, 0x00, 0x20, 0x22, 0x20, 0x18, 0x08, 0x00, 0x20,
+0x31, 0x30, 0x20, 0x10, 0x00, 0x30, 0x31, 0x30, 0x18, 0x00, 0x00, 0x30, 0x31, 0x2F, 0x10, 0x10,
+0x00, 0x30, 0x31, 0x2C, 0x10, 0x10, 0x00, 0x30, 0x31, 0x28, 0x10, 0x00, 0x00, 0x30, 0x31, 0x20,
+0x10, 0x00, 0x00, 0x30, 0x31, 0x10, 0x10, 0x00, 0x00, 0x30, 0x04, 0x04, 0x04, 0x05, 0x04, 0x04,
+0x05, 0x07, 0x07, 0x07, 0x08, 0x0A, 0x04, 0x04, 0x04, 0x04, 0x06, 0x0A, 0x0B, 0x0D, 0x05, 0x05,
+0x07, 0x07, 0x08, 0x0B, 0x0D, 0x0F, 0x04, 0x04, 0x04, 0x05, 0x07, 0x07, 0x09, 0x09, 0x0C, 0x0E,
+0x10, 0x12, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0E, 0x11, 0x13, 0x09, 0x09, 0x09, 0x09, 0x0C, 0x0E,
+0x11, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x26, 0x2A, 0x18, 0x1A,
+0x1D, 0x1F, 0x21, 0x27, 0x29, 0x2A, 0x00, 0x00, 0x00, 0x1F, 0x23, 0x28, 0x2A, 0x2C, 0x00, 0x04,
+0x00, 0x04, 0x00, 0x08, 0x00, 0x10, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60,
+0x00, 0x90, 0x00, 0xC0, 0x00, 0xD8, 0x00, 0x50, 0x00, 0x78, 0x00, 0xA0, 0x00, 0xC8, 0x01, 0x40,
+0x01, 0x90, 0x01, 0xE0, 0x02, 0x30, 0x01, 0x2C, 0x01, 0x40, 0x01, 0xE0, 0x02, 0xD0, 0x03, 0xE8,
+0x04, 0xB0, 0x06, 0x40, 0x07, 0xD0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0C,
+0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x28,
+0x00, 0x3C, 0x00, 0x50, 0x00, 0x64, 0x00, 0xA0, 0x00, 0xC8, 0x00, 0xF0, 0x01, 0x18, 0x00, 0x64,
+0x00, 0xA0, 0x00, 0xF0, 0x01, 0x68, 0x01, 0xF4, 0x02, 0x58, 0x03, 0x20, 0x03, 0xE8, 0x02, 0x02,
+0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x04, 0x04, 0x05, 0x07, 0x02, 0x03, 0x04, 0x0A, 0x0C, 0x0E,
+0x10, 0x12, 0x05, 0x07, 0x07, 0x08, 0x0B, 0x12, 0x24, 0x3C, 0x01, 0x01, 0x01, 0x01, 0x01, 0x02,
+0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x05, 0x06,
+0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x20, 0x1E, 0x1C, 0x18, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0xBB, 0x01, 0x0C, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0, 0x22, 0x50,
+0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE6, 0x22, 0xBB, 0xFE, 0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0x22,
+0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0xBB, 0x01, 0x06,
+0x89, 0x82, 0x8A, 0x83, 0xF0, 0x22, 0x50, 0x02, 0xF7, 0x22, 0xBB, 0xFE, 0x01, 0xF3, 0x22, 0xF8,
+0xBB, 0x01, 0x0D, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0x22,
+0x50, 0x06, 0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x22, 0xBB, 0xFE, 0x05, 0xE9, 0x25, 0x82, 0xC8, 0xF2,
+0x22, 0xC5, 0xF0, 0xF8, 0xA3, 0xE0, 0x28, 0xF0, 0xC5, 0xF0, 0xF8, 0xE5, 0x82, 0x15, 0x82, 0x70,
+0x02, 0x15, 0x83, 0xE0, 0x38, 0xF0, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A, 0x83, 0xE0, 0xF5,
+0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x06, 0x87, 0xF0, 0x09, 0xE7, 0x19, 0x22, 0xBB, 0xFE, 0x07, 0xE3,
+0xF5, 0xF0, 0x09, 0xE3, 0x19, 0x22, 0x89, 0x82, 0x8A, 0x83, 0xE4, 0x93, 0xF5, 0xF0, 0x74, 0x01,
+0x93, 0x22, 0xBB, 0x01, 0x10, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0,
+0xF5, 0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x09, 0xE9, 0x25, 0x82, 0xF8, 0x86, 0xF0, 0x08, 0xE6, 0x22,
+0xBB, 0xFE, 0x0A, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0xF5, 0xF0, 0x08, 0xE2, 0x22, 0xE5, 0x83, 0x2A,
+0xF5, 0x83, 0xE9, 0x93, 0xF5, 0xF0, 0xA3, 0xE9, 0x93, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A,
+0x83, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x06, 0xF7, 0x09, 0xA7, 0xF0, 0x19, 0x22, 0xBB,
+0xFE, 0x06, 0xF3, 0xE5, 0xF0, 0x09, 0xF3, 0x19, 0x22, 0xF8, 0xBB, 0x01, 0x11, 0xE5, 0x82, 0x29,
+0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x09,
+0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x08, 0xA6, 0xF0, 0x22, 0xBB, 0xFE, 0x09, 0xE9, 0x25, 0x82, 0xC8,
+0xF2, 0xE5, 0xF0, 0x08, 0xF2, 0x22, 0xEF, 0x4B, 0xFF, 0xEE, 0x4A, 0xFE, 0xED, 0x49, 0xFD, 0xEC,
+0x48, 0xFC, 0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x22, 0xA4,
+0x25, 0x82, 0xF5, 0x82, 0xE5, 0xF0, 0x35, 0x83, 0xF5, 0x83, 0x22, 0xE0, 0xFB, 0xA3, 0xE0, 0xFA,
+0xA3, 0xE0, 0xF9, 0x22, 0xF8, 0xE0, 0xFB, 0xA3, 0xA3, 0xE0, 0xF9, 0x25, 0xF0, 0xF0, 0xE5, 0x82,
+0x15, 0x82, 0x70, 0x02, 0x15, 0x83, 0xE0, 0xFA, 0x38, 0xF0, 0x22, 0xEB, 0xF0, 0xA3, 0xEA, 0xF0,
+0xA3, 0xE9, 0xF0, 0x22, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4, 0x93, 0x70, 0x12, 0x74, 0x01, 0x93,
+0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5, 0x82, 0x88, 0x83, 0xE4, 0x73, 0x74,
+0x02, 0x93, 0x68, 0x60, 0xEF, 0xA3, 0xA3, 0xA3, 0x80, 0xDF, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4,
+0x93, 0x70, 0x12, 0x74, 0x01, 0x93, 0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5,
+0x82, 0x88, 0x83, 0xE4, 0x73, 0x74, 0x02, 0x93, 0xB5, 0xF0, 0x06, 0x74, 0x03, 0x93, 0x68, 0x60,
+0xE9, 0xA3, 0xA3, 0xA3, 0xA3, 0x80, 0xD8, 0xE4, 0x90, 0x8A, 0xC5, 0xF0, 0xE5, 0x24, 0x70, 0x03,
+0x02, 0x44, 0x9D, 0xE5, 0x21, 0x64, 0x01, 0x60, 0x03, 0x02, 0x44, 0x9D, 0xE5, 0x24, 0x14, 0x60,
+0x29, 0x24, 0xFD, 0x60, 0x25, 0x24, 0x02, 0x24, 0xFB, 0x50, 0x02, 0x80, 0x23, 0x90, 0x8B, 0x0B,
+0xE0, 0x14, 0xF0, 0xE0, 0x60, 0x04, 0xA3, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x0A,
+0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B, 0xF0, 0x80, 0x00, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x16, 0xA3, 0xE0, 0xB4, 0x06, 0x05, 0xE4, 0x90, 0x8A, 0xC5,
+0xF0, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x70, 0x04, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A, 0xC5,
+0xE0, 0x60, 0x4A, 0x43, 0x25, 0x10, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0C, 0xE0, 0x75,
+0xF0, 0x03, 0xA4, 0xFF, 0x90, 0x8B, 0x15, 0xE0, 0x2F, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0xE5, 0x22, 0x54,
+0x0F, 0xC3, 0x94, 0x04, 0x50, 0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x2C,
+0xE0, 0x30, 0xE0, 0x09, 0x12, 0x7D, 0xC1, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0xE4, 0xF5,
+0x25, 0xF5, 0x24, 0x75, 0x23, 0x0C, 0x75, 0x22, 0x0C, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x8B, 0x18,
+0xF0, 0x90, 0x8B, 0x17, 0xF0, 0x90, 0x8B, 0x19, 0x04, 0xF0, 0x90, 0x8B, 0x0B, 0xF0, 0xE4, 0x90,
+0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0D, 0xF0, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0xE4, 0x90, 0x8B,
+0x0C, 0xF0, 0x90, 0x8B, 0x13, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x10, 0xF0, 0xA3, 0x74,
+0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0xE4, 0x90,
+0x8B, 0x0E, 0xF0, 0x90, 0x8B, 0x0A, 0xF0, 0x90, 0x8B, 0x08, 0xF0, 0x90, 0x8B, 0x12, 0xF0, 0x22,
+0x7F, 0x00, 0x22, 0x02, 0x45, 0x03, 0x02, 0x45, 0x06, 0x8E, 0x64, 0x8F, 0x65, 0xAD, 0x65, 0xAC,
+0x64, 0xAF, 0x63, 0x12, 0x4A, 0x5B, 0xAF, 0x65, 0xAE, 0x64, 0x90, 0x04, 0x80, 0xE0, 0x54, 0x0F,
+0xFD, 0xAC, 0x07, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x01,
+0xF0, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xFB, 0xF0, 0xAC,
+0x07, 0x74, 0x16, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0xFA, 0xF0, 0x74,
+0x15, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x1F, 0xF0, 0xAC, 0x07, 0x74,
+0x06, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x0F, 0xF0, 0x90, 0x04, 0x53,
+0xE4, 0xF0, 0x90, 0x04, 0x52, 0xF0, 0x90, 0x04, 0x51, 0x74, 0xFF, 0xF0, 0x90, 0x04, 0x50, 0x74,
+0xFD, 0xF0, 0x74, 0x14, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xC0, 0x4D,
+0xFD, 0x74, 0x14, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xED, 0xF0, 0x22, 0x7D, 0x01,
+0x7F, 0x0C, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x67, 0x8D, 0x68, 0xE5, 0x67, 0x54,
+0x0F, 0xFF, 0xE5, 0x22, 0x54, 0x0F, 0x6F, 0x60, 0x72, 0xE5, 0x67, 0x30, 0xE2, 0x30, 0xE5, 0x22,
+0x20, 0xE2, 0x05, 0x7F, 0x01, 0x12, 0x4A, 0xB2, 0xE5, 0x22, 0x30, 0xE3, 0x10, 0xE5, 0x67, 0x20,
+0xE3, 0x0B, 0x12, 0x49, 0xD5, 0xEF, 0x60, 0x53, 0x12, 0x4A, 0xCC, 0x80, 0x4E, 0xE5, 0x22, 0x20,
+0xE3, 0x49, 0xE5, 0x67, 0x30, 0xE3, 0x44, 0xAF, 0x68, 0x12, 0x4A, 0x7C, 0x80, 0x3D, 0xE5, 0x22,
+0x54, 0x0F, 0xFF, 0xBF, 0x0C, 0x0E, 0xE5, 0x67, 0x20, 0xE3, 0x09, 0x12, 0x49, 0xD5, 0xEF, 0x60,
+0x2A, 0x12, 0x4A, 0xCC, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF, 0x04, 0x0E, 0xE5, 0x67, 0x20, 0xE2,
+0x09, 0x12, 0x49, 0x93, 0xEF, 0x60, 0x14, 0x12, 0x4A, 0x32, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF,
+0x02, 0x09, 0x12, 0x45, 0x00, 0xEF, 0x60, 0x03, 0x12, 0x4B, 0x10, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x02, 0x46, 0x6E, 0x02, 0x50, 0xC6, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0x40, 0x03, 0xF6,
+0x80, 0x01, 0xF2, 0x08, 0xDF, 0xF4, 0x80, 0x29, 0xE4, 0x93, 0xA3, 0xF8, 0x54, 0x07, 0x24, 0x0C,
+0xC8, 0xC3, 0x33, 0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40, 0x04, 0xF4, 0x56, 0x80, 0x01,
+0x46, 0xF6, 0xDF, 0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x90, 0x4B,
+0x23, 0xE4, 0x7E, 0x01, 0x93, 0x60, 0xBC, 0xA3, 0xFF, 0x54, 0x3F, 0x30, 0xE5, 0x09, 0x54, 0x1F,
+0xFE, 0xE4, 0x93, 0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25, 0xE0, 0x60, 0xA8, 0x40, 0xB8,
+0xE4, 0x93, 0xA3, 0xFA, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA,
+0xC5, 0x83, 0xCA, 0xF0, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA, 0xC5, 0x83, 0xCA, 0xDF, 0xE9, 0xDE,
+0xE7, 0x80, 0xBE, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x67, 0xE5, 0x24, 0x60, 0x63, 0xE5, 0x24, 0x64,
+0x02, 0x60, 0x06, 0xE5, 0x24, 0x64, 0x05, 0x70, 0x27, 0x90, 0x06, 0xAB, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x90, 0x06, 0xAA, 0xE0, 0x90, 0x8B, 0x19, 0xF0, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x07, 0x90,
+0x8B, 0x19, 0xE0, 0xFF, 0x80, 0x05, 0x90, 0x8B, 0x0B, 0xE0, 0xFF, 0x90, 0x8B, 0x0B, 0xEF, 0xF0,
+0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x02, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x0C, 0xF0, 0x90, 0x05, 0x58,
+0x74, 0x03, 0xF0, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x53, 0x25,
+0xFD, 0x53, 0x25, 0xEF, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x03, 0x12, 0x47, 0x8E,
+0x22, 0xEF, 0x64, 0x01, 0x70, 0x35, 0x7D, 0x78, 0x7F, 0x02, 0x12, 0x31, 0x2C, 0x7D, 0x02, 0x7F,
+0x03, 0x12, 0x31, 0x2C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x12,
+0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12, 0x7D, 0xC1, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0x7F, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x54, 0xF8, 0xF0, 0x22, 0x90, 0x01, 0x36, 0x74, 0x7B,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x7D, 0x7B, 0xFF, 0x12, 0x31, 0x9D, 0x7D, 0x02, 0x7F, 0x03, 0x12,
+0x31, 0x9D, 0x90, 0x06, 0x04, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x44, 0x07, 0xF0,
+0x12, 0x4B, 0x4F, 0xE5, 0x21, 0x20, 0xE0, 0x05, 0xE4, 0x90, 0x8B, 0x0D, 0xF0, 0x22, 0xE4, 0x90,
+0x8A, 0xC5, 0xF0, 0x90, 0x06, 0xA9, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0xE0, 0x54, 0xC0, 0x70, 0x09,
+0x53, 0x25, 0xFE, 0x53, 0x25, 0xFD, 0x12, 0x4A, 0xFC, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE6, 0x15,
+0x43, 0x25, 0x01, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A, 0x97, 0x80, 0x08,
+0x12, 0x49, 0x49, 0x80, 0x03, 0x53, 0x25, 0xFE, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE7, 0x27, 0x43,
+0x25, 0x02, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4,
+0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0x90,
+0x8B, 0x1B, 0x74, 0x01, 0xF0, 0x22, 0x53, 0x25, 0xFD, 0x22, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x8B,
+0x12, 0x4B, 0x43, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xF5, 0x24, 0x14, 0x60,
+0x0E, 0x14, 0x60, 0x1F, 0x14, 0x60, 0x31, 0x24, 0x03, 0x70, 0x44, 0x7F, 0x01, 0x80, 0x3D, 0x90,
+0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD, 0xE4, 0xFF, 0x12, 0x4A,
+0x07, 0x80, 0x29, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD,
+0x7F, 0x01, 0x12, 0x4A, 0x07, 0x1F, 0x80, 0x14, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x02, 0x12, 0x42, 0x20, 0xFD, 0x7F, 0x02, 0x12, 0x4A, 0x07, 0xE4, 0xFF, 0x12, 0x47, 0x21, 0x22,
+0xE4, 0x90, 0x8A, 0xCB, 0xF0, 0xE5, 0x24, 0x60, 0x49, 0x90, 0x8B, 0x1B, 0xE0, 0x60, 0x0D, 0xE4,
+0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x38, 0x80, 0x33, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8A, 0xCB, 0xE0, 0xFF, 0x90, 0x8B, 0x10, 0xE0, 0x2F, 0xFF,
+0xE4, 0x33, 0xFE, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0xEE, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x40, 0x0D, 0xE5, 0x21, 0xB4, 0x01, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xE0, 0x04, 0xF0, 0x22, 0x12,
+0x4A, 0xFC, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x63, 0x90, 0x04, 0x1D, 0xE0,
+0x60, 0x24, 0x90, 0x05, 0x22, 0xE0, 0xF5, 0x66, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xBF, 0x01,
+0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x12, 0x45, 0x09, 0x90, 0x05,
+0x22, 0xE5, 0x66, 0xF0, 0x80, 0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD,
+0x12, 0x45, 0x09, 0x90, 0x04, 0x1F, 0x74, 0x20, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE5, 0x24,
+0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x41, 0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x12, 0x45, 0x9E,
+0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x58, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92,
+0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x22, 0xE5, 0x22, 0x54, 0x0F, 0xC3, 0x94, 0x04, 0x50,
+0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x22, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E,
+0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x5C, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05,
+0xF0, 0x90, 0x06, 0x92, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x17, 0x14, 0xF0, 0xE5, 0x22, 0x54, 0x0F,
+0xC3, 0x94, 0x0C, 0x50, 0x0D, 0x12, 0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12,
+0x7D, 0xC1, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x37, 0xE5, 0x25, 0x54, 0x03, 0x70,
+0x31, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x02, 0x50, 0x28, 0xE5, 0x25, 0x20, 0xE2, 0x23, 0xE5,
+0x25, 0x20, 0xE4, 0x1E, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x18, 0x90, 0x8B, 0x12, 0xE0, 0x70, 0x12,
+0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x04, 0xF0, 0x7F,
+0x01, 0x22, 0x7F, 0x00, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x27, 0x90, 0x8B, 0x18,
+0xE0, 0x70, 0x21, 0x90, 0x8B, 0x17, 0xE0, 0x70, 0x1B, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x04,
+0x50, 0x12, 0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x08,
+0xF0, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xEF, 0x24, 0xFE, 0x60, 0x0B, 0x04, 0x70, 0x22, 0x90,
+0x8B, 0x19, 0x74, 0x01, 0xF0, 0x80, 0x16, 0xED, 0x70, 0x0A, 0x90, 0x8B, 0x16, 0xE0, 0x90, 0x8B,
+0x19, 0xF0, 0x80, 0x05, 0x90, 0x8B, 0x19, 0xED, 0xF0, 0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x22, 0x90, 0x01, 0x37, 0x74, 0x02, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E,
+0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8, 0x74, 0xFD, 0xF0, 0x7D, 0x02, 0x7F, 0x03, 0x12, 0x31,
+0x9D, 0x12, 0x7C, 0x50, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x02, 0x22, 0xEF, 0x60, 0x0F, 0x74, 0x21,
+0x2D, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x10, 0xF0, 0x22, 0x74, 0x21, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xEF, 0xF0, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0xBF, 0xF0, 0xEF, 0x60, 0x0A, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0xE4, 0xFF, 0x12, 0x48, 0xB3,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x0C, 0x22, 0x90, 0x04, 0x1D, 0xE0, 0x70, 0x14, 0x90, 0x8A, 0xF8,
+0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5F, 0xFD, 0x8E, 0x69, 0x8F, 0x6A, 0x90, 0x04, 0x1F, 0x74, 0x20,
+0xF0, 0x22, 0x90, 0x8B, 0x52, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x52, 0xE0, 0x60, 0x05,
+0x90, 0x05, 0x22, 0xE4, 0xF0, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x04, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x44, 0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0x7F, 0x01, 0x12, 0x48, 0xB3, 0x53, 0x22, 0xF0,
+0x43, 0x22, 0x04, 0x22, 0xE5, 0x23, 0x30, 0xE6, 0x12, 0xE5, 0x23, 0x54, 0x0F, 0xFF, 0x90, 0x01,
+0x2F, 0xE0, 0x54, 0x80, 0x4F, 0x64, 0x80, 0xF0, 0x53, 0x23, 0xBF, 0x22, 0x90, 0x8B, 0x2C, 0xE0,
+0x30, 0xE0, 0x05, 0xAF, 0x23, 0x02, 0x7E, 0x06, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x22,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x01, 0x12, 0x4B, 0x5A, 0x12, 0x4B, 0x5B, 0x53, 0x22, 0xF0, 0x43,
+0x22, 0x02, 0x22, 0x41, 0x8A, 0xF6, 0x00, 0x41, 0x8B, 0x05, 0x00, 0x41, 0x8B, 0x51, 0x00, 0x41,
+0x8B, 0x53, 0x00, 0x00, 0x90, 0x04, 0x1B, 0xE0, 0x54, 0x7F, 0x64, 0x7F, 0x7F, 0x01, 0x60, 0x02,
+0x7F, 0x00, 0x22, 0xE4, 0x90, 0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0C, 0xF0, 0xF5, 0x25, 0x22, 0x90,
+0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x22, 0x22, 0xF0, 0x90, 0x8B, 0x0F,
+0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x58, 0x7E, 0x01, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x3D, 0xE0, 0xFB, 0xA3, 0xE0, 0xF5, 0x44, 0xE4, 0xF5, 0x45, 0x12,
+0x30, 0x62, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0,
+0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05,
+0xC0, 0x06, 0xC0, 0x07, 0x75, 0x0E, 0x00, 0x90, 0x01, 0xC4, 0x74, 0x87, 0xF0, 0x74, 0x4B, 0xA3,
+0xF0, 0x53, 0x91, 0xDF, 0x90, 0x01, 0x3C, 0xE0, 0x55, 0x30, 0xF5, 0x34, 0xA3, 0xE0, 0x55, 0x31,
+0xF5, 0x35, 0xA3, 0xE0, 0x55, 0x32, 0xF5, 0x36, 0xA3, 0xE0, 0x55, 0x33, 0xF5, 0x37, 0xE5, 0x34,
+0x30, 0xE0, 0x51, 0x90, 0x01, 0x3C, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x1F,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x34, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x1D, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x16, 0x90, 0x8B,
+0x2E, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF,
+0x70, 0x02, 0xD1, 0x56, 0xE5, 0x34, 0x30, 0xE1, 0x08, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x11,
+0x60, 0xE5, 0x34, 0x30, 0xE2, 0x28, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0x90, 0x06, 0x92, 0xE0,
+0x30, 0xE0, 0x14, 0x90, 0x8B, 0x3D, 0xE4, 0x71, 0x5C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90,
+0x06, 0x92, 0x74, 0x01, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x18, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34,
+0x30, 0xE3, 0x38, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0x90, 0x06, 0x92, 0xE0, 0x30, 0xE1, 0x24,
+0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x5C, 0x7E, 0x01, 0x71, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74,
+0x02, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x17, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34, 0x30, 0xE4, 0x09,
+0x90, 0x01, 0x3C, 0x74, 0x10, 0xF0, 0x12, 0x51, 0xC9, 0xE5, 0x34, 0x30, 0xE5, 0x06, 0x90, 0x01,
+0x3C, 0x74, 0x20, 0xF0, 0xE5, 0x35, 0x30, 0xE0, 0x10, 0x90, 0x01, 0x3D, 0x74, 0x01, 0xF0, 0x90,
+0x00, 0x83, 0xE0, 0xF5, 0x23, 0x51, 0xE4, 0x51, 0xFC, 0xE5, 0x35, 0x30, 0xE2, 0x06, 0x90, 0x01,
+0x3D, 0x74, 0x04, 0xF0, 0xE5, 0x35, 0x30, 0xE4, 0x1B, 0x90, 0x01, 0x3D, 0x74, 0x10, 0xF0, 0x90,
+0x8B, 0x05, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05, 0x53, 0xE0, 0x44, 0x01, 0xF0, 0x90, 0x05,
+0xFD, 0xE0, 0x04, 0xF0, 0xE5, 0x36, 0x30, 0xE0, 0x75, 0x90, 0x01, 0x3E, 0x74, 0x01, 0xF0, 0x90,
+0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x36, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64,
+0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0xD1, 0x89, 0x90, 0x8B,
+0x2C, 0xE0, 0x30, 0xE0, 0x49, 0x90, 0x8B, 0x30, 0xE4, 0xF0, 0xFF, 0xB1, 0xE0, 0xEF, 0x60, 0x3E,
+0x12, 0x65, 0x5F, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60, 0x32, 0xEF, 0xB4, 0x04, 0x02,
+0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F,
+0x01, 0x12, 0x65, 0x82, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x12, 0x7D, 0xC1, 0xE5, 0x36,
+0x30, 0xE1, 0x47, 0x90, 0x01, 0x3E, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x19,
+0x90, 0x8B, 0x36, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01,
+0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x1A,
+0x90, 0x8B, 0x30, 0x74, 0x01, 0xF0, 0x12, 0x7E, 0x2B, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60,
+0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF, 0x70, 0x02, 0xD1, 0x56, 0x74, 0x87, 0x04, 0x90, 0x01, 0xC4,
+0xF0, 0x74, 0x4B, 0xA3, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0,
+0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32,
+0xEF, 0x64, 0x01, 0x70, 0x3D, 0x90, 0x8B, 0x35, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x08, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x34, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22,
+0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0B, 0xEF, 0xC4, 0x13, 0x54,
+0x07, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x36, 0xE0, 0x7F, 0x01, 0x60, 0x36, 0x7F,
+0x00, 0x22, 0x90, 0x8B, 0x2F, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x08, 0xE0, 0x60,
+0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2E, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2C,
+0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x30, 0xE0, 0x7F,
+0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0x7F, 0x05, 0x80, 0x1F, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x01, 0x70, 0x1A, 0x7F, 0x02,
+0x80, 0x13, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0x7F, 0x03, 0x80, 0x08, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x05, 0x7F, 0x04, 0x12, 0x65, 0x82, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x33, 0xE0, 0x90, 0x8B, 0x55, 0xF0, 0x6F, 0x70, 0x02, 0xE1, 0x55, 0xEF, 0x14, 0x60,
+0x3B, 0x14, 0x60, 0x5F, 0x14, 0x70, 0x02, 0xE1, 0x30, 0x24, 0x03, 0x60, 0x02, 0xE1, 0x55, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x04, 0xF1, 0xC2, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x02,
+0x04, 0xF1, 0xAF, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04, 0x04, 0xF1, 0xC6, 0xE1, 0x55,
+0x90, 0x8B, 0x55, 0xE0, 0x64, 0x01, 0x70, 0x7D, 0xF1, 0xB1, 0x80, 0x79, 0x90, 0x8B, 0x55, 0xE0,
+0xFF, 0xB4, 0x03, 0x04, 0xF1, 0xCA, 0x80, 0x6D, 0xEF, 0xB4, 0x02, 0x04, 0xF1, 0xA1, 0x80, 0x65,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0xD5, 0x80, 0x59, 0xEF, 0x70, 0x56, 0xF1,
+0x8E, 0x80, 0x52, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x05, 0x12, 0x7C, 0x41, 0x80, 0x46, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0x72, 0x80, 0x3B, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04,
+0x05, 0x12, 0x7D, 0x23, 0x80, 0x2F, 0x90, 0x8B, 0x55, 0xE0, 0x70, 0x29, 0xF1, 0x70, 0x80, 0x25,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x01, 0x04, 0xF1, 0x5A, 0x80, 0x19, 0xEF, 0xB4, 0x02, 0x04,
+0xF1, 0x6B, 0x80, 0x11, 0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0x5A, 0x80, 0x05,
+0xEF, 0x70, 0x02, 0xF1, 0x67, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x33, 0x74, 0x03, 0xF0, 0x22, 0xF1, 0x8E, 0x80, 0xEF, 0x12, 0x7D, 0x42, 0x80, 0xEA,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01,
+0xC8, 0x74, 0xFD, 0xF0, 0x12, 0x7C, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x01,
+0x3E, 0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x31, 0xB7, 0x90, 0x8B, 0x33, 0x74, 0x01, 0xF0,
+0x22, 0x12, 0x7D, 0x42, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1,
+0xA1, 0x7D, 0x03, 0x7F, 0x02, 0x12, 0x31, 0x49, 0x90, 0x05, 0x27, 0xE4, 0xF0, 0x90, 0x8B, 0x33,
+0xF0, 0x22, 0xF1, 0xCA, 0x80, 0xEB, 0xF1, 0xD5, 0x80, 0xE7, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90,
+0x8B, 0x33, 0x04, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90,
+0x02, 0x84, 0xEF, 0xF0, 0xA3, 0xEE, 0xF0, 0xA3, 0x74, 0x05, 0xF0, 0x22, 0xEF, 0x8E, 0xF0, 0x12,
+0x43, 0xBA, 0x50, 0x1A, 0x00, 0x40, 0x50, 0x42, 0x00, 0x80, 0x50, 0x6D, 0x01, 0x00, 0x50, 0x81,
+0x02, 0x00, 0x50, 0x99, 0x04, 0x00, 0x00, 0x00, 0x50, 0xB6, 0xED, 0x54, 0x3F, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x40, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x06,
+0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78, 0x06, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0x80, 0x26, 0xED, 0x54, 0x7F, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x80, 0xEF,
+0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x07, 0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78,
+0x07, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFD, 0xAC, 0x06, 0x80, 0x49, 0xED, 0x70, 0x04,
+0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x01, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x7D, 0x00, 0xFC, 0x80,
+0x35, 0xEC, 0x54, 0x01, 0x4D, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x02, 0x7F, 0x00, 0xEF,
+0x2D, 0xEE, 0x3C, 0xC3, 0x13, 0x7D, 0x00, 0x80, 0x1A, 0xEC, 0x54, 0x03, 0x4D, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x04, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x13, 0x13, 0x54, 0x3F, 0x7D,
+0x00, 0x25, 0xE0, 0x25, 0xE0, 0xFC, 0xAE, 0x04, 0xAF, 0x05, 0x22, 0x90, 0x01, 0xE4, 0x74, 0x58,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCC, 0xF0, 0xA3, 0xF0, 0x75, 0x8E, 0x02,
+0x91, 0x0E, 0x12, 0x68, 0x44, 0x90, 0x8B, 0x07, 0xEF, 0xF0, 0x12, 0x68, 0x51, 0x90, 0x8B, 0x09,
+0xEF, 0xF0, 0x12, 0x68, 0x5D, 0x90, 0x8A, 0xF4, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0xF5, 0x55,
+0xF5, 0x21, 0x12, 0x72, 0x55, 0x12, 0x44, 0x9E, 0x12, 0x2E, 0x01, 0x7F, 0x03, 0x12, 0x78, 0x42,
+0x12, 0x7C, 0x3D, 0x12, 0x68, 0x0A, 0x12, 0x68, 0x75, 0x12, 0x68, 0x8A, 0x12, 0x68, 0x28, 0x12,
+0x68, 0x43, 0x90, 0x8A, 0xCE, 0xE5, 0xD9, 0xF0, 0x31, 0x5F, 0xC2, 0xAF, 0x90, 0x00, 0x80, 0xE0,
+0x44, 0x40, 0xF0, 0x51, 0x0E, 0x75, 0xE8, 0x03, 0x43, 0xA8, 0x85, 0xD2, 0xAF, 0x11, 0xBB, 0x90,
+0x8A, 0xCC, 0xE0, 0x64, 0x01, 0xF0, 0x24, 0xC6, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x50, 0xA3, 0xF0,
+0xE5, 0x55, 0x30, 0xE4, 0x09, 0xC2, 0xAF, 0x53, 0x55, 0xEF, 0xD2, 0xAF, 0xB1, 0x59, 0xE5, 0x55,
+0x30, 0xE6, 0xDC, 0xC2, 0xAF, 0x53, 0x55, 0xBF, 0xD2, 0xAF, 0x12, 0x6B, 0xBD, 0x80, 0xD0, 0x90,
+0x01, 0x3C, 0x74, 0xFF, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xF0, 0xA3, 0xF0, 0xA3,
+0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x54, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x55, 0x31, 0x88, 0x7D, 0xFF,
+0x7F, 0x56, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x57, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F,
+0x82, 0x75, 0x83, 0x00, 0xED, 0xF0, 0x51, 0x0E, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x01, 0x30,
+0xE4, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x38, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xFD, 0x7F, 0x50, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x51, 0x31, 0x88, 0xE4, 0xFD, 0x7F,
+0x52, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x53, 0x80, 0xBF, 0xE5, 0x5E, 0x64, 0x01, 0x70, 0x3B, 0x71,
+0x4E, 0xBF, 0x01, 0x04, 0x7F, 0x01, 0x71, 0x42, 0x90, 0x00, 0x46, 0xE0, 0x44, 0x04, 0xFD, 0x7F,
+0x46, 0x31, 0x88, 0x90, 0x00, 0x44, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x44, 0x31, 0x88, 0x90, 0x00,
+0x46, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x46, 0x31, 0x88, 0x7F, 0x02, 0x71, 0x6A, 0x8F, 0x62, 0x90,
+0x01, 0xC9, 0xE5, 0x62, 0xF0, 0xB4, 0x01, 0x02, 0x51, 0xE2, 0x22, 0xE0, 0x5F, 0xF0, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x7F, 0x10, 0xDF, 0xFE, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xE0, 0xED, 0xF0, 0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0xD3,
+0x94, 0x07, 0x50, 0x4E, 0xA3, 0xE0, 0x70, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x5F, 0xF0,
+0x80, 0x17, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46,
+0x80, 0x59, 0x90, 0x8A, 0xDF, 0xE0, 0x24, 0xF8, 0xF0, 0xA3, 0xE0, 0x70, 0x1D, 0x90, 0x8A, 0xDF,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0,
+0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x80, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0, 0xFF, 0x90, 0x00,
+0x43, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08,
+0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0x51, 0x0B, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x90, 0x00, 0x49, 0xE0, 0x90, 0x8B, 0x54, 0xF0, 0xE0, 0x54, 0x0F, 0xF0, 0x44, 0xF0,
+0xFD, 0x7F, 0x49, 0x31, 0x88, 0x90, 0x8B, 0x54, 0xE0, 0x44, 0xB0, 0xFD, 0x7F, 0x49, 0x21, 0x88,
+0x90, 0x8A, 0xDD, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0x5E, 0x01, 0x8E, 0x5F, 0xF5, 0x60, 0xE4,
+0xFD, 0x7F, 0x0B, 0x51, 0x1E, 0xE4, 0xFD, 0x7F, 0x02, 0x51, 0x1E, 0x71, 0x4E, 0xE4, 0xFF, 0x71,
+0x42, 0xE4, 0xF5, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0xEC, 0xFB, 0x8D, 0x44, 0xE4, 0xF5, 0x45, 0x7D, 0x01, 0x7F, 0x60, 0x7E, 0x01, 0x02,
+0x30, 0x62, 0x90, 0x01, 0xCA, 0xE5, 0x61, 0xF0, 0xEF, 0x60, 0x02, 0x51, 0xE2, 0x22, 0x7F, 0x0B,
+0x71, 0x6A, 0xEF, 0x65, 0x61, 0x60, 0x10, 0xE5, 0x61, 0xB4, 0x01, 0x05, 0xE4, 0xF5, 0x61, 0x80,
+0x03, 0x75, 0x61, 0x01, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8B, 0x57, 0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x43, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46, 0x51, 0x0B, 0x90,
+0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x44, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05,
+0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0x80, 0x4B, 0x90, 0x8B,
+0x57, 0xE0, 0x24, 0xF8, 0xF0, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x51, 0x0E, 0x90, 0x8B, 0x57, 0xE0,
+0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x00, 0x42, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05, 0x08, 0x80, 0x06,
+0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0x90,
+0x8B, 0x04, 0xF0, 0x90, 0x00, 0x80, 0xE0, 0x44, 0x80, 0xFD, 0x7F, 0x80, 0x21, 0x88, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFA, 0xE5, 0xF0, 0x24, 0x00, 0xFF, 0xE4, 0x3A, 0xFE,
+0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEE, 0x8F, 0xF0, 0x12, 0x43, 0x19, 0x12,
+0x24, 0x62, 0xFF, 0x60, 0x2C, 0xB5, 0x5E, 0x16, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x01, 0x12, 0x42, 0xC2, 0x65, 0x60, 0x70, 0x04, 0xE5, 0x5F, 0x65, 0xF0, 0x60, 0x22, 0x90, 0x8A,
+0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFF, 0xAE, 0xF0, 0x71, 0x00, 0x80,
+0x0F, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0x65, 0x5E, 0x60, 0x02, 0x91, 0x95,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0xF5, 0x5E, 0x7F, 0x60, 0x7E, 0x01, 0x8F, 0x82, 0x8E, 0x83,
+0xA3, 0xA3, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x8B, 0xEF, 0x12, 0x43, 0x94,
+0x54, 0xE7, 0x01, 0x54, 0xDE, 0x02, 0x55, 0x0B, 0x03, 0x55, 0x14, 0x05, 0x55, 0x1D, 0x06, 0x55,
+0x58, 0x07, 0x55, 0x25, 0x08, 0x55, 0x2E, 0x09, 0x55, 0x36, 0x20, 0x55, 0x3F, 0x2C, 0x54, 0xF0,
+0x2D, 0x54, 0xF9, 0x2E, 0x55, 0x02, 0x3B, 0x55, 0x48, 0x4B, 0x00, 0x00, 0x55, 0x51, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x85, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x8B,
+0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0xB8, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02,
+0x75, 0x00, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x39, 0x90, 0x8A, 0xD7, 0x12, 0x43,
+0x6B, 0x02, 0x75, 0x52, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x0F, 0x90, 0x8A, 0xD7,
+0x12, 0x43, 0x6B, 0xC1, 0xA6, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x9A, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x81, 0x1E, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x78, 0x81, 0x90,
+0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7A, 0xC2, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7C,
+0x2B, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x01, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x01, 0xCC, 0xE0, 0x54, 0x0F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x70,
+0x02, 0xC1, 0xA1, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xEF, 0x5D, 0x70, 0x02, 0xC1, 0x9A, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD0, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD0,
+0xF0, 0x75, 0x1D, 0x01, 0x75, 0x1E, 0x8A, 0x75, 0x1F, 0xD0, 0x75, 0x20, 0x01, 0x7B, 0x01, 0x7A,
+0x8A, 0x79, 0xD1, 0x12, 0x5E, 0xE4, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x13, 0x54,
+0x01, 0x90, 0x8B, 0x51, 0x30, 0xE0, 0x59, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x88, 0x12, 0x43,
+0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x89,
+0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90,
+0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0,
+0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD5, 0xF0, 0x90, 0x8B, 0x51, 0xE0,
+0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD6, 0xF0, 0x80, 0x33,
+0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3,
+0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90,
+0x8A, 0xD4, 0xF0, 0xEF, 0x54, 0x7F, 0xFF, 0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD2, 0x91, 0xA6, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x90, 0x8B, 0x51, 0xE0, 0xFE, 0x74, 0x01, 0xA8, 0x06, 0x08, 0x80, 0x02,
+0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0x5F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0x90, 0x01, 0xCC, 0xF0, 0x90, 0x8B,
+0x51, 0xE0, 0x04, 0xF0, 0xE0, 0x54, 0x03, 0xF0, 0xA1, 0x6A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x02,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF, 0x54, 0x1F, 0xFE,
+0xEF, 0x54, 0x20, 0xC4, 0x13, 0x54, 0x07, 0xFD, 0xAF, 0x06, 0x90, 0x8A, 0xDA, 0xEF, 0xF0, 0xA3,
+0xED, 0xF0, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x54, 0xF0, 0xC4, 0x54, 0x0F, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42,
+0x20, 0x54, 0x40, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x75, 0xF0, 0x09, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAD, 0x82, 0xAC, 0x83, 0x90, 0x8A,
+0xE1, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87,
+0x35, 0xF0, 0xFA, 0x7B, 0x01, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90,
+0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0x0F, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43, 0x6B, 0xEF, 0x12,
+0x42, 0x4D, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x90,
+0x8A, 0xE3, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x90, 0x8A, 0xDC, 0x12,
+0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0xA3, 0xE0,
+0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xEF, 0xF0, 0x12, 0x24, 0x62, 0x8D, 0x82, 0x8C, 0x83, 0xA3, 0xF0,
+0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x24, 0xC1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87,
+0x29, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F,
+0x74, 0x01, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12,
+0x43, 0x5F, 0xEE, 0xF0, 0x8F, 0x0F, 0xEF, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89,
+0xAF, 0x82, 0xF5, 0x10, 0x8F, 0x11, 0xE5, 0x0F, 0x75, 0xF0, 0x02, 0xA4, 0x24, 0x81, 0xF9, 0x74,
+0x86, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13, 0x89, 0x14, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x25, 0x12, 0x43, 0x5F, 0xAF, 0x82, 0x85, 0x83, 0x15, 0x8F, 0x16, 0xE5, 0x0F, 0x75, 0xF0,
+0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87, 0x35, 0xF0, 0x75, 0x17, 0x01, 0xF5, 0x18, 0x89, 0x19,
+0x74, 0xC1, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x12, 0x43, 0x94, 0x58,
+0x34, 0x00, 0x58, 0x49, 0x01, 0x58, 0x5E, 0x02, 0x58, 0x73, 0x03, 0x58, 0x9C, 0x04, 0x58, 0xB1,
+0x05, 0x58, 0xC6, 0x06, 0x58, 0xEC, 0x0C, 0x59, 0x19, 0x0D, 0x59, 0x46, 0x0E, 0x59, 0x73, 0x0F,
+0x00, 0x00, 0x59, 0xA7, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x15, 0x80, 0x3C, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x10, 0x80, 0x27, 0xE5, 0x0F,
+0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74,
+0x05, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0x74, 0xF0, 0xF0, 0xA3, 0xE4, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0x8F, 0xF0, 0x21, 0xA7, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0xF5, 0x80,
+0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F,
+0xF0, 0xA3, 0x74, 0xF0, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0x74, 0x0D, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x21, 0xA7, 0x90, 0x04, 0x47, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x46, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x45, 0xE0, 0x85, 0x11, 0x82,
+0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x44, 0x21, 0x9E, 0x90, 0x04, 0x4B, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4A, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x49, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83,
+0xF0, 0x90, 0x04, 0x48, 0x80, 0x58, 0x90, 0x04, 0x4F, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x12, 0x42, 0x4D, 0x90, 0x04, 0x4E, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01,
+0x12, 0x42, 0x5F, 0x90, 0x04, 0x4D, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04,
+0x4C, 0x80, 0x2B, 0x90, 0x04, 0x53, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D,
+0x90, 0x04, 0x52, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F,
+0x90, 0x04, 0x51, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x50, 0xE0, 0x85,
+0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xC0, 0x03, 0xC0,
+0x02, 0xC0, 0x01, 0x12, 0x24, 0x62, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19, 0x12, 0x24, 0x62,
+0x5F, 0xD0, 0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0xAB, 0x12, 0xE5, 0x14, 0x24, 0x01,
+0xF9, 0xE4, 0x35, 0x13, 0xFA, 0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x24, 0x62, 0xFF, 0xAB,
+0x17, 0xAA, 0x18, 0xA9, 0x19, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x5F, 0xD0, 0x01, 0xD0, 0x02,
+0xD0, 0x03, 0x12, 0x42, 0x4D, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xC0, 0x83, 0xC0, 0x82, 0xE0,
+0xFF, 0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0,
+0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xC0, 0x83, 0xC0, 0x82, 0xE0, 0xFF, 0x85, 0x16, 0x82,
+0x85, 0x15, 0x83, 0xA3, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0, 0xE5, 0x0F, 0x25,
+0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60,
+0x4B, 0x90, 0x8A, 0xE6, 0x74, 0x0B, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x50,
+0x02, 0x41, 0xEC, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5,
+0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x0A, 0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10,
+0xA3, 0xF0, 0x80, 0x68, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBB, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x47,
+0x90, 0x8A, 0xE6, 0x74, 0x0F, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x40, 0x3C,
+0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x5E,
+0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0xA3, 0xF0, 0x80, 0x0D, 0x90,
+0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE7, 0xF0, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46,
+0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x40, 0x02, 0x61,
+0xA5, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0,
+0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x06, 0x90, 0x8A, 0xE6, 0xE0, 0x80, 0x63, 0x90, 0x8A,
+0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90,
+0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x0C, 0x50, 0x3C, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08,
+0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08,
+0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10, 0x80, 0x09, 0x90, 0x8A, 0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF,
+0xE4, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xEF, 0xF0, 0x90, 0x8A, 0xE8, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xE5,
+0x0F, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xE5, 0x0F, 0xC3, 0x94, 0x20, 0x50, 0x32,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xD3, 0x9F, 0x40, 0x02,
+0x80, 0x18, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xC3, 0x9E,
+0x50, 0x08, 0x90, 0x8A, 0xE8, 0xE0, 0xA3, 0xF0, 0x80, 0x08, 0x90, 0x8A, 0xE7, 0xE0, 0x90, 0x8A,
+0xE9, 0xF0, 0x90, 0x8A, 0xE9, 0xE0, 0xFD, 0xAF, 0x0F, 0x91, 0x4E, 0x90, 0x8A, 0xE9, 0xE0, 0xFF,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xE7,
+0xE0, 0xFF, 0xD3, 0x94, 0x13, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x03, 0xF0, 0x22, 0xEF, 0xD3,
+0x94, 0x0B, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x02, 0xF0, 0x22, 0xEF, 0xD3, 0x94, 0x03, 0x40,
+0x07, 0x90, 0x87, 0x22, 0x74, 0x01, 0xF0, 0x22, 0xE4, 0x90, 0x87, 0x22, 0xF0, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xED,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAC, 0x07, 0xED, 0x54, 0x1F, 0x90, 0x8A, 0xC7, 0xF0, 0x74,
+0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A,
+0xC8, 0x74, 0x01, 0xF0, 0xEB, 0xC3, 0x94, 0x01, 0x40, 0x02, 0x80, 0x37, 0x90, 0x8A, 0xC5, 0xE0,
+0x25, 0x0D, 0xFF, 0xA3, 0xF0, 0xA3, 0xE0, 0x90, 0x41, 0x9E, 0x93, 0xFE, 0xEF, 0xD3, 0x9E, 0x40,
+0x10, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x04, 0x80,
+0x9D, 0x90, 0x8A, 0xC6, 0xE0, 0xFF, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEF, 0xF0, 0x22, 0xAD, 0x07, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0,
+0xFF, 0x90, 0x8A, 0xCA, 0xF0, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0x54, 0x1F, 0x90, 0x8A, 0xC9, 0xF0, 0xD3, 0x9F, 0x40, 0x06, 0xA3, 0xE0, 0x90, 0x8A, 0xC9, 0xF0,
+0x90, 0x8A, 0xC9, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83,
+0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13,
+0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3,
+0xEF, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xC9, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A, 0xC9, 0xE0, 0xFF,
+0x22, 0xAC, 0x07, 0x74, 0x84, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F,
+0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0x54, 0x1F, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0x75, 0xF0, 0x09, 0xEC,
+0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xE3, 0xF0, 0x75, 0xF0, 0x09, 0xEC, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0x90, 0x8A, 0xE4, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0xE4,
+0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE5, 0xCB, 0xF0,
+0xA3, 0xEB, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0,
+0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE7, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEF, 0xD3, 0x9E, 0x40, 0x0C,
+0x90, 0x8A, 0xE4, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xED, 0x70, 0x02, 0xC1,
+0x93, 0x90, 0x8A, 0xE2, 0xED, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0x30, 0xE6, 0x0E, 0x90, 0x8A, 0xE1,
+0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x14, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x70,
+0x02, 0xC1, 0x93, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0xD3, 0x94, 0x00, 0x50, 0x02, 0xC1, 0x93, 0xE4,
+0x90, 0x8A, 0xE0, 0xF0, 0xEF, 0x14, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xE3, 0xE0, 0xFD, 0x90,
+0x8A, 0xDF, 0xE0, 0xFF, 0xD3, 0x9D, 0x40, 0x6F, 0xEF, 0x94, 0x10, 0x40, 0x21, 0xEF, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE7, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x37, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE5, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0x6F, 0x60, 0x08, 0x90,
+0x8A, 0xDF, 0xE0, 0x14, 0xF0, 0x80, 0x83, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xC3, 0x9F, 0x50, 0x0F, 0x90, 0x8A, 0xDF, 0xE0, 0xB5, 0x05, 0x08, 0x90, 0x8A, 0xE3, 0xE0, 0x90,
+0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xEC, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x90, 0x8A, 0xDE, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A,
+0xDE, 0xE0, 0xFF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8B, 0x1A, 0x8A, 0x1B, 0x89,
+0x1C, 0x90, 0x8B, 0x3F, 0x12, 0x43, 0x8B, 0xAB, 0x1D, 0xAA, 0x1E, 0xA9, 0x1F, 0x90, 0x8B, 0x42,
+0x12, 0x43, 0x8B, 0xAF, 0x20, 0x15, 0x20, 0xEF, 0x60, 0x1E, 0x90, 0x8B, 0x42, 0xE4, 0x75, 0xF0,
+0x01, 0x12, 0x43, 0x74, 0x12, 0x24, 0x62, 0xFF, 0x90, 0x8B, 0x3F, 0xE4, 0x75, 0xF0, 0x01, 0x12,
+0x43, 0x74, 0xEF, 0x12, 0x42, 0x4D, 0x80, 0xDB, 0xAB, 0x1A, 0xAA, 0x1B, 0xA9, 0x1C, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x8B,
+0x90, 0x8B, 0x53, 0xE0, 0xFF, 0x04, 0xF0, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x7F, 0xAF,
+0x7E, 0x01, 0x12, 0x74, 0x3B, 0xEF, 0x60, 0x47, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x8B, 0x1D,
+0x8A, 0x1E, 0x89, 0x1F, 0x75, 0x20, 0x02, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA0, 0xD1, 0xE4, 0x90,
+0x8B, 0x48, 0x12, 0x43, 0x6B, 0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x90, 0x8B, 0x45, 0x12, 0x43,
+0x6B, 0x12, 0x24, 0x62, 0xFF, 0xC4, 0x54, 0x0F, 0xF5, 0x20, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA2,
+0xD1, 0xE4, 0x90, 0x01, 0xAF, 0x74, 0xFF, 0xF0, 0x90, 0x01, 0xCB, 0xE0, 0x64, 0x80, 0xF0, 0xD0,
+0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8A, 0xC5, 0xE0, 0x54, 0xF0, 0x44, 0x03, 0xF0, 0x54, 0x0F, 0x44,
+0x80, 0xF0, 0x7B, 0x00, 0x7A, 0x00, 0x79, 0x56, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x8B, 0x0B, 0x7A,
+0x8A, 0x79, 0xC5, 0xE1, 0x33, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xC4, 0x74,
+0xC5, 0xF0, 0x74, 0x5F, 0xA3, 0xF0, 0x90, 0x04, 0x1D, 0xE0, 0x60, 0x1A, 0x90, 0x05, 0x22, 0xE0,
+0x54, 0x90, 0x60, 0x07, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x01, 0xC7, 0xE0, 0x30,
+0xE1, 0xE4, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF,
+0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFB, 0xFA, 0xEF, 0x30, 0xE0, 0x02, 0x7B, 0x80, 0xEF, 0xC3, 0x13,
+0x90, 0xFD, 0x10, 0xF0, 0x90, 0x04, 0x25, 0xEF, 0xF0, 0xED, 0x60, 0x1E, 0xAF, 0x03, 0x74, 0x0F,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x74, 0x10, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0xAF, 0x03, 0x74, 0x08, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x09, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0x21, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83,
+0xE0, 0x54, 0xF7, 0xF0, 0xAE, 0x02, 0xAF, 0x03, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x5F, 0xC5,
+0xBF, 0x01, 0x10, 0x90, 0x02, 0x09, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x90, 0x04, 0x1F,
+0x74, 0x20, 0xF0, 0x22, 0x90, 0x01, 0x02, 0xE0, 0x54, 0x03, 0xFF, 0xE0, 0x54, 0x0C, 0x13, 0x13,
+0x54, 0x3F, 0xFE, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x0E, 0x90, 0x8A, 0xC5, 0x74,
+0x01, 0xF0, 0xA3, 0x74, 0x37, 0xF0, 0x79, 0x01, 0x80, 0x18, 0xEE, 0x64, 0x01, 0x60, 0x07, 0xAF,
+0x06, 0xEE, 0x64, 0x03, 0x70, 0x3B, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0, 0xA3, 0x74, 0x3D, 0xF0,
+0x79, 0x40, 0x90, 0x8A, 0xC5, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0, 0x59,
+0x60, 0x08, 0xE9, 0xF0, 0xE4, 0x90, 0x8A, 0xF6, 0xF0, 0x22, 0x90, 0x8A, 0xF6, 0xE0, 0x04, 0xF0,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x0B, 0xE4, 0xF0, 0x90, 0x04, 0x19, 0xE0, 0x30, 0xE0, 0x02, 0x11,
+0x6D, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0,
+0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90,
+0x01, 0xC4, 0x74, 0xF2, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xE0, 0x55, 0x28, 0xF5,
+0x2C, 0xA3, 0xE0, 0x55, 0x29, 0xF5, 0x2D, 0xA3, 0xE0, 0x55, 0x2A, 0xF5, 0x2E, 0xA3, 0xE0, 0x55,
+0x2B, 0xF5, 0x2F, 0xE5, 0x2C, 0x20, 0xE0, 0x02, 0x41, 0x89, 0x90, 0x01, 0x34, 0x74, 0x01, 0xF0,
+0x85, 0xD1, 0x4D, 0x85, 0xD2, 0x4E, 0x85, 0xD3, 0x4F, 0x85, 0xD4, 0x50, 0x85, 0xD5, 0x51, 0x85,
+0xD6, 0x52, 0x85, 0xD7, 0x53, 0x85, 0xD9, 0x54, 0xE5, 0x54, 0x54, 0x40, 0xC3, 0x13, 0xFF, 0xE5,
+0x53, 0x54, 0x20, 0x6F, 0x70, 0x02, 0x41, 0x46, 0xE5, 0x54, 0x30, 0xE5, 0x02, 0x41, 0x46, 0xE5,
+0x52, 0x54, 0x1F, 0xF5, 0x08, 0xE5, 0x4D, 0x54, 0x3F, 0xF5, 0x09, 0xE5, 0x51, 0x54, 0x1F, 0xFF,
+0xE5, 0x08, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0,
+0x12, 0x42, 0x81, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82,
+0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x09, 0xD3, 0x94, 0x04,
+0x40, 0x03, 0x75, 0x09, 0x04, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43, 0x5F,
+0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xE5, 0x53, 0x54,
+0x1F, 0x2F, 0xFF, 0xE4, 0x3E, 0xFE, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43,
+0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE5, 0x54,
+0x20, 0xE6, 0x24, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x4F, 0x30, 0xE7, 0x36,
+0xAF, 0x08, 0x12, 0x5C, 0xC3, 0x80, 0x2F, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0,
+0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5,
+0x4F, 0x30, 0xE7, 0x12, 0xE5, 0x4F, 0x54, 0x7F, 0xFD, 0xE5, 0x53, 0x54, 0x1F, 0xF5, 0x0D, 0xAB,
+0x09, 0xAF, 0x08, 0x12, 0x5C, 0x66, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x3A, 0x90,
+0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0,
+0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x21, 0x90, 0x8B, 0x3D, 0x12, 0x4B, 0x5C, 0x90, 0x01,
+0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x80, 0x09,
+0x12, 0x4B, 0x34, 0xBF, 0x01, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2C, 0x30, 0xE1, 0x21, 0x90, 0x01,
+0x34, 0x74, 0x02, 0xF0, 0x85, 0xD1, 0x56, 0x85, 0xD2, 0x57, 0x85, 0xD3, 0x58, 0x85, 0xD4, 0x59,
+0x85, 0xD5, 0x5A, 0x85, 0xD6, 0x5B, 0x85, 0xD7, 0x5C, 0x85, 0xD9, 0x5D, 0x12, 0x5F, 0xA4, 0xE5,
+0x2C, 0x30, 0xE3, 0x06, 0x90, 0x01, 0x34, 0x74, 0x08, 0xF0, 0xE5, 0x2C, 0x30, 0xE4, 0x09, 0x90,
+0x01, 0x34, 0x74, 0x10, 0xF0, 0x43, 0x55, 0x10, 0xE5, 0x2C, 0x30, 0xE5, 0x26, 0x90, 0x01, 0xCF,
+0xE0, 0x30, 0xE5, 0x1F, 0xE0, 0x54, 0xDF, 0xF0, 0x90, 0x01, 0x34, 0x74, 0x20, 0xF0, 0x75, 0xA8,
+0x00, 0x75, 0xE8, 0x00, 0x12, 0x51, 0x9D, 0x90, 0x00, 0x03, 0xE0, 0x54, 0xFB, 0xF0, 0x12, 0x52,
+0x0E, 0x80, 0xFE, 0xE5, 0x2C, 0x30, 0xE6, 0x2D, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0x90, 0x8B,
+0x32, 0xE0, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05, 0x90, 0x8B, 0x34, 0xE4,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05,
+0x90, 0x8B, 0x2E, 0xE4, 0xF0, 0xE5, 0x2E, 0x20, 0xE0, 0x02, 0x61, 0xE6, 0x90, 0x8B, 0x08, 0x74,
+0x01, 0xF0, 0x90, 0x01, 0x36, 0xF0, 0x90, 0x8B, 0x06, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05,
+0x53, 0xE0, 0x44, 0x02, 0xF0, 0x90, 0x05, 0xFC, 0xE0, 0x04, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30,
+0xE0, 0x2F, 0x90, 0x8B, 0x37, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54,
+0x3F, 0x30, 0xE0, 0x1D, 0x90, 0x8B, 0x34, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0D, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x7F, 0x04, 0x12, 0x4E,
+0x89, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x55, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x4E,
+0x90, 0x8B, 0x2E, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x3E,
+0xB1, 0x5F, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60,
+0x2D, 0xEF, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF,
+0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x04, 0x7F, 0x01, 0xB1, 0x82, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x43,
+0xE7, 0x90, 0x8B, 0x08, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE1, 0x2F, 0x90, 0x01, 0x36, 0x74, 0x02,
+0xF0, 0x43, 0x55, 0x40, 0x11, 0x84, 0x90, 0x8B, 0x37, 0xE0, 0xB4, 0x01, 0x09, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x37, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x0D, 0xE4, 0xFF, 0x12,
+0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE2, 0x16, 0x90,
+0x01, 0x36, 0x74, 0x04, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x06, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x03, 0x12, 0x46, 0xB3, 0xE5, 0x2E, 0x30, 0xE3, 0x38, 0x90, 0x01, 0x36, 0x74, 0x08, 0xF0,
+0xE5, 0x21, 0x64, 0x01, 0x70, 0x2C, 0xE5, 0x24, 0x60, 0x28, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90,
+0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B,
+0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74,
+0x05, 0xF0, 0xE5, 0x2E, 0x30, 0xE4, 0x2B, 0x90, 0x01, 0x36, 0x74, 0x10, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x20, 0xE5, 0x24, 0x60, 0x1C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x1B, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x03, 0x12,
+0x4A, 0xFC, 0xE5, 0x2E, 0x30, 0xE5, 0x1F, 0x90, 0x01, 0x36, 0x74, 0x20, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x14, 0xE5, 0x24, 0x60, 0x10, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A,
+0x97, 0x80, 0x03, 0x12, 0x49, 0x49, 0xE5, 0x2E, 0x30, 0xE6, 0x1B, 0x90, 0x01, 0x36, 0x74, 0x40,
+0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x10, 0xE5, 0x24, 0x60, 0x0C, 0x53, 0x25, 0xFE, 0xE5, 0x25, 0x54,
+0x07, 0x70, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2F, 0x30, 0xE1, 0x28, 0x90, 0x01, 0x37, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x18, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x08,
+0x12, 0x48, 0xFE, 0x12, 0x7D, 0xC1, 0x80, 0x0B, 0x90, 0x8B, 0x31, 0x74, 0x01, 0xF0, 0x80, 0x03,
+0x12, 0x48, 0xFE, 0x74, 0xF2, 0x04, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0xD0, 0x07,
+0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0,
+0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x05,
+0x58, 0xE0, 0xFF, 0x90, 0x8B, 0x38, 0xE0, 0x2F, 0x24, 0xFE, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB,
+0xFD, 0x7F, 0x50, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x53, 0x74, 0x05, 0xF0, 0x22, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0A, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x04, 0x7F, 0x06, 0xB1, 0x82, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x03, 0x12, 0x78,
+0x35, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0x6F, 0x70,
+0x02, 0xE1, 0x4E, 0xEF, 0x12, 0x43, 0x94, 0x65, 0xB0, 0x00, 0x65, 0xEA, 0x01, 0x66, 0x30, 0x02,
+0x66, 0x6A, 0x03, 0x66, 0xA2, 0x04, 0x66, 0xDB, 0x05, 0x67, 0x16, 0x06, 0x00, 0x00, 0x67, 0x4E,
+0xEE, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0xB4,
+0x05, 0x04, 0xF1, 0x5D, 0xE1, 0x4E, 0xEF, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xA4, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0xE1, 0x4E, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x02, 0x60, 0x02, 0xE1, 0x4E, 0xF1, 0x67, 0xE1, 0x4E,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x08, 0xEE, 0xB4,
+0x03, 0x04, 0x7F, 0x01, 0xF1, 0x53, 0xF1, 0xD0, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x06, 0xEE, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xB9,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13,
+0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0xF1, 0xAF, 0x80, 0x73, 0x90, 0x8B, 0x2D, 0xE0, 0xFE,
+0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x0B, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x04, 0x7F, 0x01,
+0xF1, 0x81, 0xF1, 0xC3, 0x80, 0x38, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1,
+0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0xE4, 0xFF, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xDD, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0x12, 0x4A, 0xB2, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x04,
+0xF0, 0x22, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0,
+0x22, 0x90, 0x8B, 0x56, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x56, 0xE0, 0x60, 0x05, 0x90,
+0x05, 0x22, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12, 0x4A, 0xCC, 0x90, 0x8B, 0x2D,
+0x74, 0x01, 0xF0, 0x22, 0x7F, 0x01, 0x12, 0x4A, 0x7C, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12,
+0x7C, 0x4A, 0x90, 0x8B, 0x2D, 0x74, 0x04, 0xF0, 0x22, 0x12, 0x4A, 0x32, 0x90, 0x8B, 0x2D, 0x74,
+0x03, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x05, 0xF0, 0x22,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0x74, 0x6F, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x06, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0xE4, 0xFD, 0xFC, 0xEF, 0x30, 0xE0, 0x02, 0x7D, 0x80, 0xEF, 0xC3, 0x13, 0x90, 0xFD, 0x10,
+0xF0, 0xAE, 0x04, 0xAF, 0x05, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x75, 0x28, 0x33, 0xE4, 0xF5, 0x29,
+0x75, 0x2A, 0x07, 0xF5, 0x2B, 0x90, 0x01, 0x30, 0xE5, 0x28, 0xF0, 0xA3, 0xE5, 0x29, 0xF0, 0xA3,
+0xE5, 0x2A, 0xF0, 0xA3, 0xE5, 0x2B, 0xF0, 0x22, 0x75, 0x30, 0x1F, 0x75, 0x31, 0x01, 0x43, 0x31,
+0x10, 0xE4, 0xF5, 0x32, 0x90, 0x01, 0x38, 0xE5, 0x30, 0xF0, 0xA3, 0xE5, 0x31, 0xF0, 0xA3, 0xE5,
+0x32, 0xF0, 0x22, 0x22, 0x90, 0x00, 0x02, 0xE0, 0x54, 0xE0, 0x7F, 0x01, 0x60, 0x02, 0x7F, 0x00,
+0x22, 0x90, 0x00, 0xF3, 0xE0, 0x7F, 0x00, 0x30, 0xE3, 0x02, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x09,
+0xE0, 0xB4, 0x01, 0x0C, 0x90, 0x00, 0xF2, 0xE0, 0x30, 0xE7, 0x05, 0x7E, 0xFD, 0x7F, 0x33, 0x22,
+0x7E, 0xFD, 0x7F, 0x2F, 0x22, 0x90, 0x00, 0xF3, 0xE0, 0x30, 0xE2, 0x0D, 0x90, 0x05, 0x41, 0x74,
+0x10, 0xF0, 0x90, 0x05, 0x5A, 0xF0, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x01, 0x64, 0x74, 0xA0, 0xF0,
+0x22, 0xC0, 0xE0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x05, 0xC0, 0x06,
+0xC0, 0x07, 0x7D, 0x91, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0x74, 0x68, 0xFF, 0xA3, 0xF0, 0x53, 0x91,
+0xEF, 0x90, 0x00, 0x51, 0xE0, 0xFE, 0x90, 0x00, 0x55, 0xE0, 0x5E, 0xF5, 0x3D, 0x90, 0x00, 0x52,
+0xE0, 0xFE, 0x90, 0x00, 0x56, 0xE0, 0x5E, 0xF5, 0x3E, 0xE5, 0x3D, 0x30, 0xE4, 0x06, 0x90, 0x00,
+0x55, 0x74, 0x10, 0xF0, 0xE5, 0x3D, 0x30, 0xE5, 0x06, 0x90, 0x00, 0x55, 0x74, 0x20, 0xF0, 0xE5,
+0x3D, 0x30, 0xE6, 0x06, 0x90, 0x00, 0x55, 0x74, 0x40, 0xF0, 0xE5, 0x3D, 0x30, 0xE7, 0x06, 0x90,
+0x00, 0x55, 0x74, 0x80, 0xF0, 0xE5, 0x3E, 0x30, 0xE0, 0x06, 0x90, 0x00, 0x56, 0x74, 0x01, 0xF0,
+0xE5, 0x3E, 0x30, 0xE1, 0x06, 0x90, 0x00, 0x56, 0x74, 0x02, 0xF0, 0xE5, 0x3E, 0x30, 0xE2, 0x06,
+0x90, 0x00, 0x56, 0x74, 0x04, 0xF0, 0xE5, 0x3E, 0x30, 0xE3, 0x06, 0x90, 0x00, 0x56, 0x74, 0x08,
+0xF0, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0xA3, 0xEF, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0,
+0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xE0, 0x32, 0xEF, 0xC3, 0x94, 0x20, 0x50, 0x39, 0xEF, 0x30,
+0xE0, 0x17, 0xED, 0xC4, 0x54, 0xF0, 0xFD, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x0F, 0x80, 0x10, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5,
+0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0xA4, 0x2E, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x4D, 0xF0, 0x22, 0xAD, 0x07, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0xF9, 0x54, 0x1F, 0xA3,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xE1,
+0xF0, 0xED, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFB, 0xA3,
+0xE0, 0x90, 0x8A, 0xE2, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xED, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE4, 0xCB, 0xF0, 0xA3, 0xEB,
+0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5,
+0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4,
+0x34, 0x86, 0xF5, 0x83, 0xEA, 0xF0, 0xA3, 0xEB, 0xF0, 0xEE, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0xB9,
+0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF,
+0xF0, 0xEF, 0x04, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xFE, 0xD3, 0x9F, 0x40, 0x02, 0x41, 0xF3, 0xEE, 0xC3, 0x94, 0x10, 0x40, 0x21, 0xEE, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE2, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xE0, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x59, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x3C, 0x90, 0x8A, 0xE0, 0xE0, 0xB4, 0x11, 0x0D, 0x90, 0x8A, 0xE3, 0xE0,
+0x30, 0xE7, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x17, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0x64, 0x13,
+0x60, 0x04, 0xEF, 0xB4, 0x12, 0x0D, 0x90, 0x8A, 0xE2, 0xE0, 0x30, 0xE0, 0x06, 0x90, 0x8A, 0xE0,
+0x74, 0x18, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0x80,
+0x42, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x41, 0x17, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0x6C, 0x70, 0x71, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83,
+0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x10,
+0xE9, 0x20, 0xE6, 0x0C, 0x90, 0x8A, 0xDF, 0xE0, 0x44, 0x40, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x03,
+0xAF, 0x01, 0x22, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x66, 0x90, 0x8A, 0xDF, 0xE0, 0xD3, 0x9C, 0x40, 0x5E, 0x90,
+0x8A, 0xE1, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xFC, 0xA3, 0xE0, 0xFF, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF,
+0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF,
+0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82,
+0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x22, 0x74, 0x01, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xDE, 0xE0, 0x44,
+0x80, 0xFD, 0x12, 0x5C, 0x4E, 0x90, 0x8A, 0xDE, 0xE0, 0x44, 0x80, 0xFF, 0x22, 0xE4, 0x90, 0x8A,
+0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x03, 0x02, 0x72, 0x54, 0x75,
+0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x72,
+0x4B, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE0, 0xFC, 0xA3, 0xE0, 0xD3, 0x94, 0x00, 0xEC, 0x94, 0x00, 0x50, 0x03, 0x02, 0x72, 0x4B, 0xEF,
+0x75, 0xF0, 0x0A, 0xA4, 0x24, 0x00, 0xF9, 0x74, 0x84, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13,
+0x89, 0x14, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE0, 0xFD, 0xA3, 0xE0, 0x90, 0x8A, 0xD4, 0xCD, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x25, 0xE0,
+0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD6,
+0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0xE0, 0x54, 0x3F, 0x90, 0x8A, 0xD0, 0xF0, 0xE0, 0xFD, 0x54, 0x1F, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xEE, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD9, 0xF0, 0x90,
+0x8A, 0xCF, 0xE0, 0xFB, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xC3, 0x94,
+0x05, 0x40, 0x02, 0xC1, 0x9C, 0x90, 0x8A, 0xD9, 0xE0, 0xFE, 0x90, 0x8A, 0xD1, 0xE0, 0x9E, 0x40,
+0x13, 0x90, 0x8A, 0xD9, 0xE0, 0x90, 0x8A, 0xD1, 0xF0, 0xED, 0x54, 0x40, 0xFD, 0x90, 0x8A, 0xD0,
+0xF0, 0xEE, 0x4D, 0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0x90, 0x41, 0x12, 0x93, 0xFE, 0x74, 0x23,
+0x2B, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xC3, 0x9E, 0x40, 0x06, 0xEF, 0x90, 0x40,
+0xDA, 0x80, 0x07, 0x90, 0x8A, 0xD1, 0xE0, 0x90, 0x40, 0xF6, 0x93, 0x90, 0x8A, 0xD8, 0xF0, 0x90,
+0x8A, 0xD8, 0xE0, 0x75, 0xF0, 0x06, 0xA4, 0x24, 0x50, 0xF9, 0x74, 0x40, 0x35, 0xF0, 0x75, 0x0F,
+0xFF, 0xF5, 0x10, 0x89, 0x11, 0x90, 0x8A, 0xD0, 0xE0, 0x90, 0x41, 0xBA, 0x93, 0xFF, 0xD3, 0x90,
+0x8A, 0xD7, 0xE0, 0x9F, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x0D, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0xE4, 0xFD, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xE1, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24,
+0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD2, 0xCF,
+0xF0, 0xA3, 0xEF, 0xF0, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x12, 0x24, 0x62, 0xFF, 0x7E, 0x00,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x97, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90,
+0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x02,
+0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12,
+0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x7E,
+0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x04, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0,
+0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10,
+0xA9, 0x11, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9,
+0x14, 0x90, 0x00, 0x06, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2,
+0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x04, 0x12,
+0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x08, 0x12, 0x42,
+0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81,
+0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x05, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0x90,
+0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x24, 0x7B, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F,
+0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x0C, 0xA3, 0xE0, 0x9F, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0x9E,
+0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xD3, 0xED, 0x9B,
+0xEC, 0x9A, 0x40, 0x05, 0x31, 0x78, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFE, 0x74, 0x01, 0x93, 0xFF, 0xC3,
+0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x03, 0x02, 0x71, 0xAF, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFC, 0x64, 0x05, 0x60, 0x03,
+0x02, 0x70, 0x7D, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x03, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x19, 0x40, 0x3D, 0x80, 0x2E, 0xEE, 0xB4, 0x02, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94,
+0x11, 0x40, 0x2E, 0x80, 0x1F, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x01, 0x0B, 0x90, 0x8A, 0xD1,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x1B, 0x80, 0x0C, 0xEE, 0x70, 0x11, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x03, 0x40, 0x0D, 0x90, 0x89, 0x43, 0x74, 0x01, 0xF0, 0x80, 0x05, 0xE4, 0x90, 0x89, 0x43,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0,
+0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE,
+0xC3, 0x94, 0x30, 0x50, 0x0B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0x02, 0x70, 0x28,
+0x90, 0x89, 0x43, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x70, 0x1D, 0x90, 0x8A, 0xCF, 0xE0, 0x24,
+0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x64, 0x0A, 0x60, 0x5B, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xEE, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x38,
+0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0xEF, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x23, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x50, 0x16, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0xFF, 0x90, 0x8A, 0xD1, 0xE0, 0x6F, 0x60, 0x56, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x23, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x94, 0x42, 0x40, 0x08, 0x90, 0x8A, 0xDD, 0x74,
+0x05, 0xF0, 0x80, 0x11, 0xEF, 0xD3, 0x94, 0x39, 0x90, 0x8A, 0xDD, 0x40, 0x05, 0x74, 0x03, 0xF0,
+0x80, 0x03, 0x74, 0x01, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0x80, 0x2F, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x44,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x14, 0xE4, 0x90, 0x8A,
+0xDD, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFE, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x84, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFE, 0x74, 0x43, 0x2F, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12, 0x43,
+0x5F, 0xE0, 0xB4, 0x01, 0x11, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x21, 0xAC, 0xEC, 0x64, 0x06,
+0x60, 0x02, 0x21, 0xAF, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x41, 0xDB, 0x93, 0xFF, 0x7E,
+0x00, 0x90, 0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xDB, 0xEE,
+0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE0, 0x90, 0x8A, 0xDD, 0xF0, 0xE4, 0x90, 0x8A, 0xDA, 0xF0, 0x90, 0x8A, 0xDA, 0xE0, 0xFF,
+0xD3, 0x94, 0x04, 0x50, 0x47, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x75, 0xF0, 0x02, 0xEF, 0xA4,
+0xF5, 0x82, 0x85, 0xF0, 0x83, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0xEF, 0x90, 0x41, 0xD6, 0x93,
+0xFF, 0x7E, 0x00, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0x90,
+0x8A, 0xDB, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2,
+0xE0, 0x9E, 0x50, 0x08, 0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0x80, 0xAF, 0x90, 0x8A, 0xDA, 0xE0,
+0xC3, 0x13, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFF, 0xB4, 0x01, 0x0D, 0x90, 0x8A, 0xDA, 0xE0, 0x70,
+0x5D, 0x90, 0x8A, 0xDD, 0x04, 0xF0, 0x80, 0x5B, 0xEF, 0xB4, 0x03, 0x1D, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x03, 0xF0, 0x80, 0x48, 0xEF, 0xB4, 0x01, 0x08, 0x90,
+0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x80, 0x3C, 0x80, 0x35, 0x90, 0x8A, 0xDD, 0xE0, 0x64, 0x05, 0x70,
+0x32, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x0F,
+0xEF, 0x90, 0x8A, 0xDD, 0xB4, 0x01, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0, 0xD3,
+0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90,
+0x8A, 0xDD, 0xF0, 0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00,
+0x40, 0x05, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xED, 0xF0, 0x12, 0x69, 0x38, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xD3, 0x94,
+0x05, 0x50, 0x0F, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0x04, 0xF0,
+0x80, 0x0F, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xE4, 0xF5, 0xF0, 0x12, 0x42, 0xFA, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x02, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x04, 0xE4,
+0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x06, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00,
+0x08, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xC0,
+0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04,
+0xF0, 0x02, 0x6B, 0xC2, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3,
+0x94, 0x10, 0x50, 0x14, 0x74, 0xA4, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE4, 0xF0,
+0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x80, 0xE2, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x02, 0x81, 0x0E, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x00,
+0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x02, 0x12, 0x43,
+0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x04, 0x12, 0x43, 0x5F, 0xE4,
+0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x06, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3,
+0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x08, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x74,
+0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x74, 0x44, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x88,
+0xF5, 0x83, 0xE4, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0,
+0x74, 0x24, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x64, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x41, 0x8C, 0x93, 0xFE, 0x74, 0x01, 0x93,
+0xFF, 0x90, 0x41, 0x54, 0x74, 0x01, 0x93, 0x2F, 0xFF, 0xE4, 0x93, 0x3E, 0xC3, 0x13, 0xFE, 0xEF,
+0x13, 0xFF, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43,
+0x5F, 0x74, 0x01, 0xF0, 0x74, 0xC1, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74, 0x0C,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0x74, 0xFF, 0xF0, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x23, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0x74, 0x0F, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0x74, 0x13, 0xF0, 0x75, 0xF0, 0x09,
+0xED, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x41, 0x7D, 0x22, 0x12,
+0x24, 0x62, 0xFF, 0xC3, 0x94, 0x20, 0x50, 0x14, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFE, 0x74,
+0x23, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xEE, 0xF0, 0x22, 0xEF, 0xB4, 0x20, 0x0A,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0x90, 0x87, 0x21, 0xF0, 0x22, 0x90, 0x8B, 0x4B, 0xEE, 0xF0,
+0xA3, 0xEF, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x8B, 0x4B, 0xE0, 0xFE, 0xA3, 0xE0, 0xF5,
+0x82, 0x8E, 0x83, 0xE0, 0x60, 0x2C, 0xC3, 0x90, 0x8B, 0x4E, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4D,
+0xE0, 0x94, 0x03, 0x40, 0x0A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x7F, 0x00, 0x22, 0x90,
+0x8B, 0x4D, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x32, 0x15,
+0x80, 0xC6, 0x7F, 0x01, 0x22, 0x12, 0x24, 0x62, 0xF5, 0x21, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3,
+0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x25, 0x14, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x01, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x0A, 0xF0,
+0x12, 0x47, 0xFA, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x30,
+0xE0, 0x25, 0x12, 0x24, 0x62, 0x90, 0x8B, 0x10, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90,
+0x8B, 0x11, 0xF0, 0xEF, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x0F, 0xF0, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x16, 0xF0, 0x22, 0x90, 0x8B, 0x10, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x11,
+0x74, 0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0x22,
+0x12, 0x24, 0x62, 0x30, 0xE0, 0x19, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x15, 0xF0, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x0F, 0x90,
+0x8B, 0x15, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B,
+0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x12, 0x24, 0x62, 0x90, 0x8B, 0x12, 0xF0,
+0x60, 0x07, 0xE4, 0xFD, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x12, 0xE0, 0x90, 0x01, 0xE7,
+0xF0, 0x22, 0x90, 0x02, 0x09, 0xE0, 0xFD, 0x12, 0x24, 0x62, 0xFE, 0xAF, 0x05, 0xED, 0x2E, 0x90,
+0x8A, 0xF7, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF8, 0xF0,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF9, 0xF0, 0x90, 0x00, 0x03,
+0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xFA, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20,
+0xFF, 0xAE, 0x05, 0xED, 0x2F, 0x90, 0x8A, 0xFB, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x12, 0x24, 0x62, 0xC3,
+0x13, 0x20, 0xE0, 0x02, 0xC1, 0xED, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xFF,
+0x54, 0x02, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFD, 0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF,
+0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x24, 0x62, 0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7,
+0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x10, 0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0,
+0x12, 0x24, 0x62, 0xFE, 0x54, 0x20, 0xFD, 0xEF, 0x54, 0xDF, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0,
+0xEE, 0x54, 0x40, 0xFE, 0xEF, 0x54, 0xBF, 0x4E, 0xF0, 0x20, 0xE0, 0x02, 0xC1, 0xD9, 0x90, 0x8A,
+0xDD, 0x74, 0x21, 0xF0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xFF, 0x13, 0x13,
+0x54, 0x01, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13, 0x54, 0x01, 0x6E, 0x60, 0x2A, 0xEF,
+0x54, 0x04, 0xFF, 0xED, 0x54, 0xFB, 0x4F, 0xF0, 0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0E,
+0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0xFD, 0xE4, 0xFF, 0x12, 0x31, 0x9D, 0x80, 0x0B, 0xE4, 0x90,
+0x8B, 0x34, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x31, 0x2C, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13,
+0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x12, 0xF0, 0xED, 0xC4, 0x54,
+0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x14, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4,
+0x13, 0x54, 0x07, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x8B, 0x32,
+0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x40, 0xF0,
+0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x70, 0x05, 0x7F, 0x01,
+0x12, 0x4E, 0x89, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x04, 0x7F,
+0x03, 0x80, 0x0E, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F,
+0x02, 0x12, 0x4E, 0x89, 0x7F, 0x02, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90,
+0x05, 0x27, 0xF0, 0xE4, 0xFF, 0x12, 0x4E, 0x89, 0x7F, 0x03, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDA,
+0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xFF, 0x54, 0x02, 0xFE, 0x90, 0x8B, 0x2C, 0xE0, 0x54, 0xFD,
+0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x24, 0x62,
+0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x10,
+0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x24, 0x62, 0xFE, 0x54, 0x40, 0xFD, 0xEF, 0x54,
+0xBF, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x04, 0xFE, 0xEF, 0x54, 0xFB, 0x4E, 0xF0,
+0x20, 0xE0, 0x02, 0xE1, 0xE2, 0x90, 0x8A, 0xDD, 0x74, 0x31, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x13,
+0x13, 0x54, 0x3F, 0x20, 0xE0, 0x0B, 0xE4, 0x90, 0x8B, 0x2E, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x31,
+0x2C, 0x90, 0x8B, 0x2C, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A,
+0xDD, 0xE0, 0x44, 0x02, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0,
+0x44, 0x04, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x54, 0x06, 0x60, 0x0C, 0x90, 0x01, 0x3E, 0x74, 0x03,
+0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x31, 0xB7, 0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0D, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x2C, 0x7F, 0x06, 0x12, 0x65, 0x82, 0x80, 0x25, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x1B,
+0x7F, 0x01, 0x12, 0x65, 0x82, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x09, 0x7D, 0x01, 0xAF,
+0x23, 0x12, 0x45, 0xA2, 0x80, 0x05, 0x12, 0x4E, 0x56, 0x80, 0x03, 0x12, 0x7D, 0xC1, 0x7F, 0x01,
+0x80, 0x4C, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27, 0xF0, 0x7D, 0x03, 0x7F, 0x02,
+0x12, 0x31, 0x49, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x02, 0x80, 0x1B, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4,
+0x02, 0x05, 0x7F, 0x01, 0x12, 0x65, 0x82, 0x11, 0x35, 0x12, 0x4A, 0xFC, 0x7F, 0x03, 0x11, 0x42,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8B, 0x31, 0xE0, 0xB4, 0x01, 0x05, 0xE4, 0xF0, 0x12, 0x48,
+0xFE, 0x22, 0xAD, 0x07, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x32,
+0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xED, 0x64, 0x02, 0x60, 0x04, 0xED, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x2C, 0xE0, 0x54,
+0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0x22, 0x12, 0x24, 0x62, 0x90, 0x8B, 0x38, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8A, 0xFD, 0xE0, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xFE, 0xE0, 0xFF, 0xA3, 0xE0, 0x90,
+0x8A, 0xE9, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE4, 0xE0,
+0xFF, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0x8B, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0xEB, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0xE0, 0xB4,
+0x04, 0xDA, 0x90, 0x8A, 0xE8, 0xE0, 0x12, 0x43, 0x94, 0x78, 0xF8, 0x00, 0x7A, 0x6B, 0x01, 0x79,
+0x01, 0x02, 0x79, 0x01, 0x03, 0x79, 0x01, 0x04, 0x7A, 0x6B, 0x05, 0x7A, 0x35, 0x80, 0x7A, 0x4E,
+0x81, 0x7A, 0x6B, 0x82, 0x00, 0x00, 0x7A, 0x67, 0x90, 0x8A, 0xEE, 0xE0, 0xFF, 0x51, 0x72, 0x41,
+0x6B, 0x90, 0x8A, 0xE8, 0xE0, 0xFF, 0xB4, 0x02, 0x08, 0x90, 0x8A, 0xE5, 0x74, 0x01, 0xF0, 0x80,
+0x0F, 0xEF, 0x90, 0x8A, 0xE5, 0xB4, 0x03, 0x05, 0x74, 0x02, 0xF0, 0x80, 0x03, 0x74, 0x04, 0xF0,
+0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x08, 0x50, 0x78, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A,
+0xE5, 0xE0, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE9,
+0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xC3, 0xEE, 0x94, 0x01, 0x90, 0x8A, 0xE4, 0xE0, 0x50, 0x1F, 0xFE,
+0x2F, 0xFF, 0xEE, 0xFD, 0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D,
+0xF5, 0x82, 0x74, 0x8A, 0x3C, 0xF5, 0x83, 0xE0, 0xFD, 0x12, 0x51, 0x88, 0x80, 0x2B, 0xFF, 0xFD,
+0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A,
+0x3C, 0xF5, 0x83, 0xE0, 0xFE, 0xEF, 0xFD, 0x90, 0x8A, 0xEA, 0xE0, 0x2D, 0xFD, 0x90, 0x8A, 0xE9,
+0xE0, 0x34, 0x00, 0x8D, 0x82, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0x80,
+0x8D, 0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x10, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE8, 0xE0,
+0x64, 0x04, 0x60, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xEC, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78,
+0x10, 0x12, 0x24, 0xF5, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xEB, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x18, 0x12, 0x24, 0xF5, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01,
+0xD0, 0x00, 0x12, 0x43, 0x46, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xED,
+0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x08, 0x12, 0x24, 0xF5, 0xD0, 0x03, 0xD0, 0x02, 0xD0,
+0x01, 0xD0, 0x00, 0x12, 0x43, 0x46, 0xA8, 0x04, 0xA9, 0x05, 0xAA, 0x06, 0xAB, 0x07, 0xA3, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x12, 0x43, 0x46, 0xA3, 0x12, 0x25, 0x08, 0x90, 0x8A, 0xEF, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF,
+0x12, 0x2B, 0x08, 0x80, 0x36, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4,
+0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x32, 0x15, 0x80, 0x1D, 0x90, 0x8A,
+0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3,
+0xEF, 0xF0, 0x12, 0x31, 0x82, 0x80, 0x04, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x8F, 0x0F, 0xE4, 0x90, 0x8A, 0xF3, 0xF0, 0xE5, 0x0F, 0x14, 0xFE, 0x90, 0x8A, 0xF3,
+0xE0, 0xFF, 0xC3, 0x9E, 0x50, 0x0E, 0xEF, 0x04, 0xFD, 0x12, 0x2D, 0x4D, 0x90, 0x8A, 0xF3, 0xE0,
+0x04, 0xF0, 0x80, 0xE5, 0xE5, 0x0F, 0x14, 0xFF, 0x7D, 0xFF, 0x12, 0x2D, 0x4D, 0x90, 0x8A, 0xF3,
+0xE5, 0x0F, 0xF0, 0x90, 0x8A, 0xF3, 0xE0, 0xC3, 0x94, 0xFF, 0x50, 0x0F, 0xE0, 0xFF, 0x04, 0xFD,
+0x12, 0x2D, 0x4D, 0x90, 0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE8, 0xAD, 0x0F, 0x7F, 0xFF, 0x02,
+0x2D, 0x4D, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xA3, 0x74,
+0x04, 0xF0, 0xA3, 0xE4, 0xF0, 0x90, 0x8A, 0xE2, 0xF0, 0xA3, 0xF0, 0x90, 0x02, 0x09, 0xE0, 0x90,
+0x8A, 0xE1, 0xF0, 0x12, 0x24, 0x62, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0x2F, 0x90, 0x8A, 0xE0, 0xF0,
+0x30, 0xE0, 0x0B, 0x90, 0x8A, 0xDB, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x80, 0x07, 0xE4, 0x90,
+0x8A, 0xDB, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90,
+0x8A, 0xDD, 0xE0, 0x24, 0x20, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFC, 0x2D,
+0xFF, 0x24, 0x01, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xFD, 0xF0, 0x74,
+0x02, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFE, 0xEC, 0x2D, 0x24, 0x03, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0x90, 0x8A, 0xFE, 0xF0,
+0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xDA, 0x74, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFF, 0xA3,
+0xE0, 0x2F, 0xFF, 0x90, 0x8A, 0xDA, 0xE0, 0xFE, 0x2F, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0xFF, 0x74, 0xFC, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0xE0, 0xB4, 0x08, 0xCF, 0x11, 0x89, 0xEF, 0x70, 0x45, 0x90,
+0x01, 0xC3, 0xE0, 0x60, 0x2B, 0xC3, 0x90, 0x8A, 0xE3, 0xE0, 0x94, 0xE8, 0x90, 0x8A, 0xE2, 0xE0,
+0x94, 0x03, 0x40, 0x09, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x80, 0x79, 0x90, 0x8A, 0xE2,
+0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x32, 0x15, 0x80, 0xCF,
+0x90, 0x01, 0xC6, 0xE0, 0x90, 0x01, 0xC3, 0x30, 0xE2, 0x05, 0x74, 0xFE, 0xF0, 0x80, 0x57, 0x74,
+0xFF, 0xF0, 0x80, 0x52, 0x90, 0x8A, 0xDD, 0xE0, 0xB4, 0x78, 0x2E, 0xE4, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0x70, 0x04, 0xA3, 0xE0, 0x64, 0x80, 0x90, 0x8A, 0xDB,
+0x70, 0x05, 0xF0, 0xA3, 0xF0, 0x80, 0x06, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x80, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x24, 0x08, 0xF0,
+0x90, 0x8A, 0xDE, 0x74, 0xFF, 0xF5, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDE, 0xE0, 0x70, 0x02,
+0xA3, 0xE0, 0x60, 0x02, 0x61, 0x16, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x24, 0x62, 0x90, 0x8B,
+0x05, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x06, 0xF0, 0x22, 0xE4, 0xF5, 0x61,
+0x22, 0x91, 0x4A, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0,
+0x7F, 0x78, 0x7E, 0x08, 0x12, 0x22, 0x65, 0x90, 0x8B, 0x1C, 0x12, 0x25, 0x08, 0x7F, 0x04, 0x7E,
+0x0C, 0x12, 0x22, 0x65, 0x90, 0x8B, 0x20, 0x12, 0x25, 0x08, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x22,
+0x65, 0x90, 0x8B, 0x24, 0x12, 0x25, 0x08, 0x90, 0x8B, 0x09, 0xE0, 0x90, 0x8B, 0x1C, 0xB4, 0x01,
+0x0D, 0x12, 0x43, 0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xED, 0x54, 0xC7, 0xFD, 0x80, 0x07, 0x12, 0x43,
+0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xEC, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x78, 0x7E, 0x08,
+0x12, 0x2B, 0x08, 0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0xEF, 0x54, 0x0F, 0xFF, 0xEC, 0x90, 0x80,
+0x96, 0x12, 0x25, 0x08, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x2B, 0x08, 0x90, 0x8B, 0x24, 0x12, 0x43,
+0x53, 0xEF, 0x44, 0x02, 0xFF, 0xEC, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x00, 0x7E, 0x08,
+0x12, 0x2B, 0x08, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x22, 0x65, 0x90, 0x8B, 0x28, 0x12, 0x25, 0x08,
+0x90, 0x80, 0x96, 0x12, 0x25, 0x14, 0x00, 0x1B, 0x25, 0xA0, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2B,
+0x08, 0x90, 0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x00, 0x00, 0x00, 0xE4, 0xFD, 0xFF, 0x12, 0x30,
+0x2C, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90, 0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x00,
+0x00, 0x00, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x30, 0x2C, 0x90, 0x00, 0x11, 0xE0, 0x54, 0xF6, 0xF0,
+0x02, 0x52, 0x0E, 0x91, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74,
+0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0xB1, 0x42, 0x90, 0x8B, 0x33, 0x74, 0x04,
+0xF0, 0x22, 0x90, 0x00, 0x11, 0xE0, 0x44, 0x09, 0xF0, 0x12, 0x52, 0x0E, 0x90, 0x8B, 0x1C, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2B, 0x08, 0x90,
+0x8B, 0x20, 0x12, 0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x04, 0x7E, 0x0C, 0x12,
+0x2B, 0x08, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x00,
+0x7E, 0x08, 0x12, 0x2B, 0x08, 0x90, 0x8B, 0x28, 0x12, 0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25,
+0x08, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2B, 0x08, 0x90, 0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x03,
+0x2D, 0x95, 0xE4, 0xFD, 0xFF, 0x12, 0x30, 0x2C, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90,
+0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x03, 0x2D, 0x95, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x30, 0x2C,
+0x22, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x3C, 0xE5, 0x22, 0x54, 0x0F, 0x14, 0x60, 0x2E,
+0x14, 0x60, 0x1E, 0x24, 0xFE, 0x60, 0x0E, 0x24, 0xF8, 0x70, 0x2A, 0xE4, 0x90, 0x8B, 0x2D, 0xF0,
+0x90, 0x05, 0x22, 0xF0, 0x22, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x22, 0xE4, 0xF0,
+0x22, 0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0x90, 0x01,
+0xC6, 0xE0, 0x44, 0x08, 0xF0, 0x22, 0xAE, 0x07, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x18,
+0x90, 0x8B, 0x2C, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x0C, 0xAF, 0x06, 0x7D, 0x01,
+0x12, 0x45, 0xA2, 0xB1, 0xC1, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0x90, 0x01, 0x57, 0xE0, 0x60,
+0x3C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x1B, 0xE0,
+0x60, 0x07, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0x80, 0x24, 0x90, 0x8B, 0x0C, 0xE0, 0x04, 0xF0, 0x53,
+0x25, 0xEF, 0x90, 0x8B, 0x10, 0xE0, 0xFF, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0x40, 0x0E, 0xE5,
+0x21, 0xB4, 0x01, 0x09, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x03, 0xE0, 0x04, 0xF0, 0x90, 0x01, 0x5B,
+0xE0, 0x60, 0x10, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0xE4, 0x90,
+0x8B, 0x18, 0xF0, 0x90, 0x01, 0x5F, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x17, 0xF0, 0x22, 0xE4, 0x90, 0x8B, 0x4F, 0xF0, 0xA3,
+0xF0, 0x90, 0x05, 0xF8, 0xE0, 0x70, 0x0F, 0xA3, 0xE0, 0x70, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xA3,
+0xE0, 0x70, 0x03, 0x7F, 0x01, 0x22, 0xD3, 0x90, 0x8B, 0x50, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4F,
+0xE0, 0x94, 0x03, 0x40, 0x03, 0x7F, 0x00, 0x22, 0x7F, 0x32, 0x7E, 0x00, 0x12, 0x32, 0x15, 0x90,
+0x8B, 0x4F, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x80, 0xC6, 0x00, 0xFB, 0x98};
+
+// =================== v88 UMC B Cut P2PPS with CCX report C2H 2012-12-05 =====================
+u8 Rtl8192CUFwUMCBCutImgArray[UMCBCutImgArrayLength] = {
+0xC2, 0x88, 0x02, 0x05, 0x58, 0x00, 0x02, 0x00, 0x12, 0x05, 0x17, 0x10, 0xC0, 0x3E, 0x01, 0x00,
+0x94, 0x18, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x02, 0x46, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x60, 0xF3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x67, 0x5B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x4B, 0x87, 0x00, 0x00,
+0x05, 0x04, 0x03, 0x02, 0x00, 0x03, 0x06, 0x05, 0x04, 0x03, 0x00, 0x04, 0x06, 0x05, 0x04, 0x02,
+0x00, 0x04, 0x08, 0x07, 0x06, 0x04, 0x00, 0x06, 0x0A, 0x09, 0x08, 0x06, 0x00, 0x08, 0x0A, 0x09,
+0x08, 0x04, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x02, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x00, 0x00, 0x08,
+0x12, 0x11, 0x10, 0x08, 0x00, 0x10, 0x1A, 0x19, 0x18, 0x10, 0x00, 0x18, 0x22, 0x21, 0x20, 0x18,
+0x00, 0x20, 0x22, 0x21, 0x20, 0x10, 0x00, 0x20, 0x22, 0x21, 0x20, 0x08, 0x00, 0x20, 0x22, 0x21,
+0x1C, 0x08, 0x00, 0x20, 0x22, 0x21, 0x14, 0x08, 0x00, 0x20, 0x22, 0x20, 0x18, 0x08, 0x00, 0x20,
+0x31, 0x30, 0x20, 0x10, 0x00, 0x30, 0x31, 0x30, 0x18, 0x00, 0x00, 0x30, 0x31, 0x2F, 0x10, 0x10,
+0x00, 0x30, 0x31, 0x2C, 0x10, 0x10, 0x00, 0x30, 0x31, 0x28, 0x10, 0x00, 0x00, 0x30, 0x31, 0x20,
+0x10, 0x00, 0x00, 0x30, 0x31, 0x10, 0x10, 0x00, 0x00, 0x30, 0x04, 0x04, 0x04, 0x05, 0x04, 0x04,
+0x05, 0x07, 0x07, 0x07, 0x08, 0x0A, 0x04, 0x04, 0x04, 0x04, 0x06, 0x0A, 0x0B, 0x0D, 0x05, 0x05,
+0x07, 0x07, 0x08, 0x0B, 0x0D, 0x0F, 0x04, 0x04, 0x04, 0x05, 0x07, 0x07, 0x09, 0x09, 0x0C, 0x0E,
+0x10, 0x12, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0E, 0x11, 0x13, 0x09, 0x09, 0x09, 0x09, 0x0C, 0x0E,
+0x11, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x26, 0x2A, 0x18, 0x1A,
+0x1D, 0x1F, 0x21, 0x27, 0x29, 0x2A, 0x00, 0x00, 0x00, 0x1F, 0x23, 0x28, 0x2A, 0x2C, 0x00, 0x04,
+0x00, 0x04, 0x00, 0x08, 0x00, 0x10, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60,
+0x00, 0x90, 0x00, 0xC0, 0x00, 0xD8, 0x00, 0x50, 0x00, 0x78, 0x00, 0xA0, 0x00, 0xC8, 0x01, 0x40,
+0x01, 0x90, 0x01, 0xE0, 0x02, 0x30, 0x01, 0x2C, 0x01, 0x40, 0x01, 0xE0, 0x02, 0xD0, 0x03, 0xE8,
+0x04, 0xB0, 0x06, 0x40, 0x07, 0xD0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0C,
+0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x28,
+0x00, 0x3C, 0x00, 0x50, 0x00, 0x64, 0x00, 0xA0, 0x00, 0xC8, 0x00, 0xF0, 0x01, 0x18, 0x00, 0x64,
+0x00, 0xA0, 0x00, 0xF0, 0x01, 0x68, 0x01, 0xF4, 0x02, 0x58, 0x03, 0x20, 0x03, 0xE8, 0x02, 0x02,
+0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x04, 0x04, 0x05, 0x07, 0x02, 0x03, 0x04, 0x0A, 0x0C, 0x0E,
+0x10, 0x12, 0x05, 0x07, 0x07, 0x08, 0x0B, 0x12, 0x24, 0x3C, 0x01, 0x01, 0x01, 0x01, 0x01, 0x02,
+0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x05, 0x06,
+0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x20, 0x1E, 0x1C, 0x18, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0xBB, 0x01, 0x0C, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0, 0x22, 0x50,
+0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE6, 0x22, 0xBB, 0xFE, 0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0x22,
+0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0xBB, 0x01, 0x06,
+0x89, 0x82, 0x8A, 0x83, 0xF0, 0x22, 0x50, 0x02, 0xF7, 0x22, 0xBB, 0xFE, 0x01, 0xF3, 0x22, 0xF8,
+0xBB, 0x01, 0x0D, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0x22,
+0x50, 0x06, 0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x22, 0xBB, 0xFE, 0x05, 0xE9, 0x25, 0x82, 0xC8, 0xF2,
+0x22, 0xC5, 0xF0, 0xF8, 0xA3, 0xE0, 0x28, 0xF0, 0xC5, 0xF0, 0xF8, 0xE5, 0x82, 0x15, 0x82, 0x70,
+0x02, 0x15, 0x83, 0xE0, 0x38, 0xF0, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A, 0x83, 0xE0, 0xF5,
+0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x06, 0x87, 0xF0, 0x09, 0xE7, 0x19, 0x22, 0xBB, 0xFE, 0x07, 0xE3,
+0xF5, 0xF0, 0x09, 0xE3, 0x19, 0x22, 0x89, 0x82, 0x8A, 0x83, 0xE4, 0x93, 0xF5, 0xF0, 0x74, 0x01,
+0x93, 0x22, 0xBB, 0x01, 0x10, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0,
+0xF5, 0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x09, 0xE9, 0x25, 0x82, 0xF8, 0x86, 0xF0, 0x08, 0xE6, 0x22,
+0xBB, 0xFE, 0x0A, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0xF5, 0xF0, 0x08, 0xE2, 0x22, 0xE5, 0x83, 0x2A,
+0xF5, 0x83, 0xE9, 0x93, 0xF5, 0xF0, 0xA3, 0xE9, 0x93, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A,
+0x83, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x06, 0xF7, 0x09, 0xA7, 0xF0, 0x19, 0x22, 0xBB,
+0xFE, 0x06, 0xF3, 0xE5, 0xF0, 0x09, 0xF3, 0x19, 0x22, 0xF8, 0xBB, 0x01, 0x11, 0xE5, 0x82, 0x29,
+0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x09,
+0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x08, 0xA6, 0xF0, 0x22, 0xBB, 0xFE, 0x09, 0xE9, 0x25, 0x82, 0xC8,
+0xF2, 0xE5, 0xF0, 0x08, 0xF2, 0x22, 0xEF, 0x4B, 0xFF, 0xEE, 0x4A, 0xFE, 0xED, 0x49, 0xFD, 0xEC,
+0x48, 0xFC, 0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x22, 0xA4,
+0x25, 0x82, 0xF5, 0x82, 0xE5, 0xF0, 0x35, 0x83, 0xF5, 0x83, 0x22, 0xE0, 0xFB, 0xA3, 0xE0, 0xFA,
+0xA3, 0xE0, 0xF9, 0x22, 0xF8, 0xE0, 0xFB, 0xA3, 0xA3, 0xE0, 0xF9, 0x25, 0xF0, 0xF0, 0xE5, 0x82,
+0x15, 0x82, 0x70, 0x02, 0x15, 0x83, 0xE0, 0xFA, 0x38, 0xF0, 0x22, 0xEB, 0xF0, 0xA3, 0xEA, 0xF0,
+0xA3, 0xE9, 0xF0, 0x22, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4, 0x93, 0x70, 0x12, 0x74, 0x01, 0x93,
+0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5, 0x82, 0x88, 0x83, 0xE4, 0x73, 0x74,
+0x02, 0x93, 0x68, 0x60, 0xEF, 0xA3, 0xA3, 0xA3, 0x80, 0xDF, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4,
+0x93, 0x70, 0x12, 0x74, 0x01, 0x93, 0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5,
+0x82, 0x88, 0x83, 0xE4, 0x73, 0x74, 0x02, 0x93, 0xB5, 0xF0, 0x06, 0x74, 0x03, 0x93, 0x68, 0x60,
+0xE9, 0xA3, 0xA3, 0xA3, 0xA3, 0x80, 0xD8, 0xE4, 0x90, 0x8A, 0xC5, 0xF0, 0xE5, 0x24, 0x70, 0x03,
+0x02, 0x44, 0x9D, 0xE5, 0x21, 0x64, 0x01, 0x60, 0x03, 0x02, 0x44, 0x9D, 0xE5, 0x24, 0x14, 0x60,
+0x29, 0x24, 0xFD, 0x60, 0x25, 0x24, 0x02, 0x24, 0xFB, 0x50, 0x02, 0x80, 0x23, 0x90, 0x8B, 0x0B,
+0xE0, 0x14, 0xF0, 0xE0, 0x60, 0x04, 0xA3, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x0A,
+0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B, 0xF0, 0x80, 0x00, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x16, 0xA3, 0xE0, 0xB4, 0x06, 0x05, 0xE4, 0x90, 0x8A, 0xC5,
+0xF0, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x70, 0x04, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A, 0xC5,
+0xE0, 0x60, 0x4A, 0x43, 0x25, 0x10, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0C, 0xE0, 0x75,
+0xF0, 0x03, 0xA4, 0xFF, 0x90, 0x8B, 0x15, 0xE0, 0x2F, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0xE5, 0x22, 0x54,
+0x0F, 0xC3, 0x94, 0x04, 0x50, 0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x2C,
+0xE0, 0x30, 0xE0, 0x09, 0x12, 0x66, 0x20, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0xE4, 0xF5,
+0x25, 0xF5, 0x24, 0x75, 0x23, 0x0C, 0x75, 0x22, 0x0C, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x8B, 0x18,
+0xF0, 0x90, 0x8B, 0x17, 0xF0, 0x90, 0x8B, 0x19, 0x04, 0xF0, 0x90, 0x8B, 0x0B, 0xF0, 0xE4, 0x90,
+0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0D, 0xF0, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0xE4, 0x90, 0x8B,
+0x0C, 0xF0, 0x90, 0x8B, 0x13, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x10, 0xF0, 0xA3, 0x74,
+0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0xE4, 0x90,
+0x8B, 0x0E, 0xF0, 0x90, 0x8B, 0x0A, 0xF0, 0x90, 0x8B, 0x08, 0xF0, 0x90, 0x8B, 0x12, 0xF0, 0x22,
+0x7F, 0x00, 0x22, 0x02, 0x45, 0x03, 0x02, 0x45, 0x06, 0x8E, 0x64, 0x8F, 0x65, 0xAD, 0x65, 0xAC,
+0x64, 0xAF, 0x63, 0x12, 0x4A, 0x5B, 0xAF, 0x65, 0xAE, 0x64, 0x90, 0x04, 0x80, 0xE0, 0x54, 0x0F,
+0xFD, 0xAC, 0x07, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x01,
+0xF0, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xFB, 0xF0, 0xAC,
+0x07, 0x74, 0x16, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0xFA, 0xF0, 0x74,
+0x15, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x1F, 0xF0, 0xAC, 0x07, 0x74,
+0x06, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x0F, 0xF0, 0x90, 0x04, 0x53,
+0xE4, 0xF0, 0x90, 0x04, 0x52, 0xF0, 0x90, 0x04, 0x51, 0x74, 0xFF, 0xF0, 0x90, 0x04, 0x50, 0x74,
+0xFD, 0xF0, 0x74, 0x14, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xC0, 0x4D,
+0xFD, 0x74, 0x14, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xED, 0xF0, 0x22, 0x7D, 0x01,
+0x7F, 0x0C, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x67, 0x8D, 0x68, 0xE5, 0x67, 0x54,
+0x0F, 0xFF, 0xE5, 0x22, 0x54, 0x0F, 0x6F, 0x60, 0x72, 0xE5, 0x67, 0x30, 0xE2, 0x30, 0xE5, 0x22,
+0x20, 0xE2, 0x05, 0x7F, 0x01, 0x12, 0x4A, 0xB2, 0xE5, 0x22, 0x30, 0xE3, 0x10, 0xE5, 0x67, 0x20,
+0xE3, 0x0B, 0x12, 0x49, 0xD5, 0xEF, 0x60, 0x53, 0x12, 0x4A, 0xCC, 0x80, 0x4E, 0xE5, 0x22, 0x20,
+0xE3, 0x49, 0xE5, 0x67, 0x30, 0xE3, 0x44, 0xAF, 0x68, 0x12, 0x4A, 0x7C, 0x80, 0x3D, 0xE5, 0x22,
+0x54, 0x0F, 0xFF, 0xBF, 0x0C, 0x0E, 0xE5, 0x67, 0x20, 0xE3, 0x09, 0x12, 0x49, 0xD5, 0xEF, 0x60,
+0x2A, 0x12, 0x4A, 0xCC, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF, 0x04, 0x0E, 0xE5, 0x67, 0x20, 0xE2,
+0x09, 0x12, 0x49, 0x93, 0xEF, 0x60, 0x14, 0x12, 0x4A, 0x32, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF,
+0x02, 0x09, 0x12, 0x45, 0x00, 0xEF, 0x60, 0x03, 0x12, 0x4B, 0x10, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x02, 0x46, 0x6E, 0x02, 0x51, 0x39, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0x40, 0x03, 0xF6,
+0x80, 0x01, 0xF2, 0x08, 0xDF, 0xF4, 0x80, 0x29, 0xE4, 0x93, 0xA3, 0xF8, 0x54, 0x07, 0x24, 0x0C,
+0xC8, 0xC3, 0x33, 0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40, 0x04, 0xF4, 0x56, 0x80, 0x01,
+0x46, 0xF6, 0xDF, 0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x90, 0x4B,
+0x23, 0xE4, 0x7E, 0x01, 0x93, 0x60, 0xBC, 0xA3, 0xFF, 0x54, 0x3F, 0x30, 0xE5, 0x09, 0x54, 0x1F,
+0xFE, 0xE4, 0x93, 0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25, 0xE0, 0x60, 0xA8, 0x40, 0xB8,
+0xE4, 0x93, 0xA3, 0xFA, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA,
+0xC5, 0x83, 0xCA, 0xF0, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA, 0xC5, 0x83, 0xCA, 0xDF, 0xE9, 0xDE,
+0xE7, 0x80, 0xBE, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x67, 0xE5, 0x24, 0x60, 0x63, 0xE5, 0x24, 0x64,
+0x02, 0x60, 0x06, 0xE5, 0x24, 0x64, 0x05, 0x70, 0x27, 0x90, 0x06, 0xAB, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x90, 0x06, 0xAA, 0xE0, 0x90, 0x8B, 0x19, 0xF0, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x07, 0x90,
+0x8B, 0x19, 0xE0, 0xFF, 0x80, 0x05, 0x90, 0x8B, 0x0B, 0xE0, 0xFF, 0x90, 0x8B, 0x0B, 0xEF, 0xF0,
+0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x02, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x0C, 0xF0, 0x90, 0x05, 0x58,
+0x74, 0x03, 0xF0, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x53, 0x25,
+0xFD, 0x53, 0x25, 0xEF, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x03, 0x12, 0x47, 0x8E,
+0x22, 0xEF, 0x64, 0x01, 0x70, 0x35, 0x7D, 0x78, 0x7F, 0x02, 0x12, 0x36, 0x75, 0x7D, 0x02, 0x7F,
+0x03, 0x12, 0x36, 0x75, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x12,
+0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12, 0x66, 0x20, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0x7F, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x54, 0xF8, 0xF0, 0x22, 0x90, 0x01, 0x36, 0x74, 0x7B,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x7D, 0x7B, 0xFF, 0x12, 0x36, 0xE6, 0x7D, 0x02, 0x7F, 0x03, 0x12,
+0x36, 0xE6, 0x90, 0x06, 0x04, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x44, 0x07, 0xF0,
+0x12, 0x4B, 0x4F, 0xE5, 0x21, 0x20, 0xE0, 0x05, 0xE4, 0x90, 0x8B, 0x0D, 0xF0, 0x22, 0xE4, 0x90,
+0x8A, 0xC5, 0xF0, 0x90, 0x06, 0xA9, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0xE0, 0x54, 0xC0, 0x70, 0x09,
+0x53, 0x25, 0xFE, 0x53, 0x25, 0xFD, 0x12, 0x4A, 0xFC, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE6, 0x15,
+0x43, 0x25, 0x01, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A, 0x97, 0x80, 0x08,
+0x12, 0x49, 0x49, 0x80, 0x03, 0x53, 0x25, 0xFE, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE7, 0x27, 0x43,
+0x25, 0x02, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4,
+0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0x90,
+0x8B, 0x1B, 0x74, 0x01, 0xF0, 0x22, 0x53, 0x25, 0xFD, 0x22, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x8B,
+0x12, 0x4B, 0x43, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xF5, 0x24, 0x14, 0x60,
+0x0E, 0x14, 0x60, 0x1F, 0x14, 0x60, 0x31, 0x24, 0x03, 0x70, 0x44, 0x7F, 0x01, 0x80, 0x3D, 0x90,
+0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD, 0xE4, 0xFF, 0x12, 0x4A,
+0x07, 0x80, 0x29, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD,
+0x7F, 0x01, 0x12, 0x4A, 0x07, 0x1F, 0x80, 0x14, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x02, 0x12, 0x42, 0x20, 0xFD, 0x7F, 0x02, 0x12, 0x4A, 0x07, 0xE4, 0xFF, 0x12, 0x47, 0x21, 0x22,
+0xE4, 0x90, 0x8A, 0xCB, 0xF0, 0xE5, 0x24, 0x60, 0x49, 0x90, 0x8B, 0x1B, 0xE0, 0x60, 0x0D, 0xE4,
+0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x38, 0x80, 0x33, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8A, 0xCB, 0xE0, 0xFF, 0x90, 0x8B, 0x10, 0xE0, 0x2F, 0xFF,
+0xE4, 0x33, 0xFE, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0xEE, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x40, 0x0D, 0xE5, 0x21, 0xB4, 0x01, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xE0, 0x04, 0xF0, 0x22, 0x12,
+0x4A, 0xFC, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x63, 0x90, 0x04, 0x1D, 0xE0,
+0x60, 0x24, 0x90, 0x05, 0x22, 0xE0, 0xF5, 0x66, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x2D, 0xBF, 0x01,
+0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xDE, 0x12, 0x45, 0x09, 0x90, 0x05,
+0x22, 0xE5, 0x66, 0xF0, 0x80, 0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xDE,
+0x12, 0x45, 0x09, 0x90, 0x04, 0x1F, 0x74, 0x20, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE5, 0x24,
+0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x41, 0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x12, 0x45, 0x9E,
+0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x58, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92,
+0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x22, 0xE5, 0x22, 0x54, 0x0F, 0xC3, 0x94, 0x04, 0x50,
+0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x22, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E,
+0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x5C, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05,
+0xF0, 0x90, 0x06, 0x92, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x17, 0x14, 0xF0, 0xE5, 0x22, 0x54, 0x0F,
+0xC3, 0x94, 0x0C, 0x50, 0x0D, 0x12, 0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12,
+0x66, 0x20, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x37, 0xE5, 0x25, 0x54, 0x03, 0x70,
+0x31, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x02, 0x50, 0x28, 0xE5, 0x25, 0x20, 0xE2, 0x23, 0xE5,
+0x25, 0x20, 0xE4, 0x1E, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x18, 0x90, 0x8B, 0x12, 0xE0, 0x70, 0x12,
+0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x04, 0xF0, 0x7F,
+0x01, 0x22, 0x7F, 0x00, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x27, 0x90, 0x8B, 0x18,
+0xE0, 0x70, 0x21, 0x90, 0x8B, 0x17, 0xE0, 0x70, 0x1B, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x04,
+0x50, 0x12, 0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x08,
+0xF0, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xEF, 0x24, 0xFE, 0x60, 0x0B, 0x04, 0x70, 0x22, 0x90,
+0x8B, 0x19, 0x74, 0x01, 0xF0, 0x80, 0x16, 0xED, 0x70, 0x0A, 0x90, 0x8B, 0x16, 0xE0, 0x90, 0x8B,
+0x19, 0xF0, 0x80, 0x05, 0x90, 0x8B, 0x19, 0xED, 0xF0, 0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x22, 0x90, 0x01, 0x37, 0x74, 0x02, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E,
+0x2D, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8, 0x74, 0xFD, 0xF0, 0x7D, 0x02, 0x7F, 0x03, 0x12, 0x36,
+0xE6, 0x12, 0x7A, 0x6D, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x02, 0x22, 0xEF, 0x60, 0x0F, 0x74, 0x21,
+0x2D, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x10, 0xF0, 0x22, 0x74, 0x21, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xEF, 0xF0, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0xBF, 0xF0, 0xEF, 0x60, 0x0A, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0xE4, 0xFF, 0x12, 0x48, 0xB3,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x0C, 0x22, 0x90, 0x04, 0x1D, 0xE0, 0x70, 0x14, 0x90, 0x8A, 0xF8,
+0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5F, 0xDE, 0x8E, 0x69, 0x8F, 0x6A, 0x90, 0x04, 0x1F, 0x74, 0x20,
+0xF0, 0x22, 0x90, 0x8B, 0x52, 0xEF, 0xF0, 0x12, 0x4F, 0xED, 0x90, 0x8B, 0x52, 0xE0, 0x60, 0x05,
+0x90, 0x05, 0x22, 0xE4, 0xF0, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x04, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x44, 0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0x7F, 0x01, 0x12, 0x48, 0xB3, 0x53, 0x22, 0xF0,
+0x43, 0x22, 0x04, 0x22, 0xE5, 0x23, 0x30, 0xE6, 0x12, 0xE5, 0x23, 0x54, 0x0F, 0xFF, 0x90, 0x01,
+0x2F, 0xE0, 0x54, 0x80, 0x4F, 0x64, 0x80, 0xF0, 0x53, 0x23, 0xBF, 0x22, 0x90, 0x8B, 0x2C, 0xE0,
+0x30, 0xE0, 0x05, 0xAF, 0x23, 0x02, 0x66, 0x65, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x22,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x01, 0x12, 0x4B, 0x5A, 0x12, 0x4B, 0x5B, 0x53, 0x22, 0xF0, 0x43,
+0x22, 0x02, 0x22, 0x41, 0x8A, 0xF6, 0x00, 0x41, 0x8B, 0x05, 0x00, 0x41, 0x8B, 0x51, 0x00, 0x41,
+0x8B, 0x53, 0x00, 0x00, 0x90, 0x04, 0x1B, 0xE0, 0x54, 0x7F, 0x64, 0x7F, 0x7F, 0x01, 0x60, 0x02,
+0x7F, 0x00, 0x22, 0xE4, 0x90, 0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0C, 0xF0, 0xF5, 0x25, 0x22, 0x90,
+0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x22, 0x22, 0xF0, 0x90, 0x8B, 0x0F,
+0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x58, 0x7E, 0x01, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x3D, 0xE0, 0xFB, 0xA3, 0xE0, 0xF5, 0x44, 0xE4, 0xF5, 0x45, 0x12,
+0x35, 0xAB, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0,
+0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05,
+0xC0, 0x06, 0xC0, 0x07, 0x75, 0x0E, 0x00, 0x90, 0x01, 0xC4, 0x74, 0x87, 0xF0, 0x74, 0x4B, 0xA3,
+0xF0, 0x53, 0x91, 0xDF, 0x90, 0x01, 0x3C, 0xE0, 0x55, 0x30, 0xF5, 0x34, 0xA3, 0xE0, 0x55, 0x31,
+0xF5, 0x35, 0xA3, 0xE0, 0x55, 0x32, 0xF5, 0x36, 0xA3, 0xE0, 0x55, 0x33, 0xF5, 0x37, 0xE5, 0x34,
+0x30, 0xE0, 0x51, 0x90, 0x01, 0x3C, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x1F,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x34, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x1D, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x16, 0x90, 0x8B,
+0x2E, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF,
+0x70, 0x02, 0xD1, 0x56, 0xE5, 0x34, 0x30, 0xE1, 0x08, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x11,
+0x60, 0xE5, 0x34, 0x30, 0xE2, 0x28, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0x90, 0x06, 0x92, 0xE0,
+0x30, 0xE0, 0x14, 0x90, 0x8B, 0x3D, 0xE4, 0x71, 0x5C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90,
+0x06, 0x92, 0x74, 0x01, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x18, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34,
+0x30, 0xE3, 0x38, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0x90, 0x06, 0x92, 0xE0, 0x30, 0xE1, 0x24,
+0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x5C, 0x7E, 0x01, 0x71, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74,
+0x02, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x17, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34, 0x30, 0xE4, 0x09,
+0x90, 0x01, 0x3C, 0x74, 0x10, 0xF0, 0x12, 0x52, 0x3C, 0xE5, 0x34, 0x30, 0xE5, 0x06, 0x90, 0x01,
+0x3C, 0x74, 0x20, 0xF0, 0xE5, 0x35, 0x30, 0xE0, 0x10, 0x90, 0x01, 0x3D, 0x74, 0x01, 0xF0, 0x90,
+0x00, 0x83, 0xE0, 0xF5, 0x23, 0x51, 0xE4, 0x51, 0xFC, 0xE5, 0x35, 0x30, 0xE2, 0x06, 0x90, 0x01,
+0x3D, 0x74, 0x04, 0xF0, 0xE5, 0x35, 0x30, 0xE4, 0x1B, 0x90, 0x01, 0x3D, 0x74, 0x10, 0xF0, 0x90,
+0x8B, 0x05, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05, 0x53, 0xE0, 0x44, 0x01, 0xF0, 0x90, 0x05,
+0xFD, 0xE0, 0x04, 0xF0, 0xE5, 0x36, 0x30, 0xE0, 0x75, 0x90, 0x01, 0x3E, 0x74, 0x01, 0xF0, 0x90,
+0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x36, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64,
+0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0xD1, 0x89, 0x90, 0x8B,
+0x2C, 0xE0, 0x30, 0xE0, 0x49, 0x90, 0x8B, 0x30, 0xE4, 0xF0, 0xFF, 0xB1, 0xE0, 0xEF, 0x60, 0x3E,
+0x12, 0x65, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60, 0x32, 0xEF, 0xB4, 0x04, 0x02,
+0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F,
+0x01, 0x12, 0x7B, 0x49, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x12, 0x66, 0x20, 0xE5, 0x36,
+0x30, 0xE1, 0x47, 0x90, 0x01, 0x3E, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x19,
+0x90, 0x8B, 0x36, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01,
+0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x1A,
+0x90, 0x8B, 0x30, 0x74, 0x01, 0xF0, 0x12, 0x7D, 0xBE, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60,
+0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF, 0x70, 0x02, 0xD1, 0x56, 0x74, 0x87, 0x04, 0x90, 0x01, 0xC4,
+0xF0, 0x74, 0x4B, 0xA3, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0,
+0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32,
+0xEF, 0x64, 0x01, 0x70, 0x3D, 0x90, 0x8B, 0x35, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x08, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x34, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22,
+0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0B, 0xEF, 0xC4, 0x13, 0x54,
+0x07, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x36, 0xE0, 0x7F, 0x01, 0x60, 0x36, 0x7F,
+0x00, 0x22, 0x90, 0x8B, 0x2F, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x08, 0xE0, 0x60,
+0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2E, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2C,
+0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x30, 0xE0, 0x7F,
+0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0x7F, 0x05, 0x80, 0x1F, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x01, 0x70, 0x1A, 0x7F, 0x02,
+0x80, 0x13, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0x7F, 0x03, 0x80, 0x08, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x05, 0x7F, 0x04, 0x12, 0x7B, 0x49, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x33, 0xE0, 0x90, 0x8B, 0x55, 0xF0, 0x6F, 0x70, 0x02, 0xE1, 0x55, 0xEF, 0x14, 0x60,
+0x3B, 0x14, 0x60, 0x5F, 0x14, 0x70, 0x02, 0xE1, 0x30, 0x24, 0x03, 0x60, 0x02, 0xE1, 0x55, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x04, 0xF1, 0xC0, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x02,
+0x04, 0xF1, 0xAD, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04, 0x04, 0xF1, 0xC4, 0xE1, 0x55,
+0x90, 0x8B, 0x55, 0xE0, 0x64, 0x01, 0x70, 0x7D, 0xF1, 0xAF, 0x80, 0x79, 0x90, 0x8B, 0x55, 0xE0,
+0xFF, 0xB4, 0x03, 0x04, 0xF1, 0xC8, 0x80, 0x6D, 0xEF, 0xB4, 0x02, 0x04, 0xF1, 0xA0, 0x80, 0x65,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0xD3, 0x80, 0x59, 0xEF, 0x70, 0x56, 0xF1,
+0x8D, 0x80, 0x52, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x05, 0x12, 0x7A, 0x5E, 0x80, 0x46, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0x71, 0x80, 0x3B, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04,
+0x05, 0x12, 0x7B, 0x37, 0x80, 0x2F, 0x90, 0x8B, 0x55, 0xE0, 0x70, 0x29, 0xF1, 0x6F, 0x80, 0x25,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x01, 0x04, 0xF1, 0x5A, 0x80, 0x19, 0xEF, 0xB4, 0x02, 0x04,
+0xF1, 0x6B, 0x80, 0x11, 0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0x5A, 0x80, 0x05,
+0xEF, 0x70, 0x02, 0xF1, 0x67, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x33, 0x74, 0x03, 0xF0, 0x22, 0xF1, 0x8D, 0x80, 0xEF, 0xF1, 0xED, 0x80, 0xEB, 0xF1,
+0x8D, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x2D, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8,
+0x74, 0xFD, 0xF0, 0x12, 0x7A, 0x6D, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x01, 0x3E,
+0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8B, 0x33, 0x74, 0x01, 0xF0, 0x22,
+0xF1, 0xED, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1, 0xA0, 0x7D,
+0x03, 0x7F, 0x02, 0x12, 0x36, 0x92, 0x90, 0x05, 0x27, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xF0, 0x22,
+0xF1, 0xC8, 0x80, 0xEB, 0xF1, 0xD3, 0x80, 0xE7, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33,
+0x04, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1, 0x8D,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90, 0x8B, 0x1C,
+0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2F, 0xD9,
+0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C,
+0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F,
+0x00, 0x7E, 0x08, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x28, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12,
+0x2A, 0x7F, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F, 0xD9, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00,
+0x03, 0x2D, 0x95, 0xE4, 0xFD, 0xFF, 0x12, 0x34, 0x81, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11,
+0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x03, 0x2D, 0x95, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x34,
+0x81, 0x22, 0x90, 0x02, 0x84, 0xEF, 0xF0, 0xA3, 0xEE, 0xF0, 0xA3, 0x74, 0x05, 0xF0, 0x22, 0xEF,
+0x8E, 0xF0, 0x12, 0x43, 0xBA, 0x50, 0x8D, 0x00, 0x40, 0x50, 0xB5, 0x00, 0x80, 0x50, 0xE0, 0x01,
+0x00, 0x50, 0xF4, 0x02, 0x00, 0x51, 0x0C, 0x04, 0x00, 0x00, 0x00, 0x51, 0x29, 0xED, 0x54, 0x3F,
+0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x40, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE,
+0xEF, 0x78, 0x06, 0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78, 0x06, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0x80, 0x26, 0xED, 0x54, 0x7F, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00,
+0x7F, 0x80, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x07, 0xCE, 0xC3, 0x13, 0xCE, 0x13,
+0xD8, 0xF9, 0x78, 0x07, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFD, 0xAC, 0x06, 0x80, 0x49,
+0xED, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x01, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x7D,
+0x00, 0xFC, 0x80, 0x35, 0xEC, 0x54, 0x01, 0x4D, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x02,
+0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0xC3, 0x13, 0x7D, 0x00, 0x80, 0x1A, 0xEC, 0x54, 0x03, 0x4D,
+0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x04, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x13, 0x13,
+0x54, 0x3F, 0x7D, 0x00, 0x25, 0xE0, 0x25, 0xE0, 0xFC, 0xAE, 0x04, 0xAF, 0x05, 0x22, 0x90, 0x01,
+0xE4, 0x74, 0x58, 0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCC, 0xF0, 0xA3, 0xF0,
+0x75, 0x8E, 0x02, 0x91, 0x81, 0x12, 0x67, 0x0E, 0x90, 0x8B, 0x07, 0xEF, 0xF0, 0x12, 0x67, 0x1B,
+0x90, 0x8B, 0x09, 0xEF, 0xF0, 0x12, 0x67, 0x27, 0x90, 0x8A, 0xF4, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0,
+0xE4, 0xF5, 0x55, 0xF5, 0x21, 0x12, 0x71, 0x16, 0x12, 0x44, 0x9E, 0x12, 0x32, 0x3D, 0x7F, 0x03,
+0x12, 0x76, 0xAB, 0x12, 0x7A, 0x5A, 0x12, 0x66, 0xD4, 0x12, 0x67, 0x3F, 0x12, 0x67, 0x54, 0x12,
+0x66, 0xF2, 0x12, 0x67, 0x0D, 0x90, 0x8A, 0xCE, 0xE5, 0xD9, 0xF0, 0x31, 0xD2, 0xC2, 0xAF, 0x90,
+0x00, 0x80, 0xE0, 0x44, 0x40, 0xF0, 0x51, 0x81, 0x75, 0xE8, 0x03, 0x43, 0xA8, 0x85, 0xD2, 0xAF,
+0x31, 0x2E, 0x90, 0x8A, 0xCC, 0xE0, 0x64, 0x01, 0xF0, 0x24, 0x39, 0x90, 0x01, 0xC4, 0xF0, 0x74,
+0x51, 0xA3, 0xF0, 0xE5, 0x55, 0x30, 0xE4, 0x09, 0xC2, 0xAF, 0x53, 0x55, 0xEF, 0xD2, 0xAF, 0xB1,
+0xCC, 0xE5, 0x55, 0x30, 0xE6, 0xDC, 0xC2, 0xAF, 0x53, 0x55, 0xBF, 0xD2, 0xAF, 0x12, 0x68, 0x42,
+0x80, 0xD0, 0x90, 0x01, 0x3C, 0x74, 0xFF, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xF0,
+0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x54, 0x31, 0xFB, 0x7D, 0xFF, 0x7F, 0x55, 0x31,
+0xFB, 0x7D, 0xFF, 0x7F, 0x56, 0x31, 0xFB, 0x7D, 0xFF, 0x7F, 0x57, 0xD3, 0x10, 0xAF, 0x01, 0xC3,
+0xC0, 0xD0, 0x8F, 0x82, 0x75, 0x83, 0x00, 0xED, 0xF0, 0x51, 0x81, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x90, 0x01, 0x30, 0xE4, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x38, 0xF0, 0xA3,
+0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x50, 0x31, 0xFB, 0xE4, 0xFD, 0x7F, 0x51, 0x31, 0xFB,
+0xE4, 0xFD, 0x7F, 0x52, 0x31, 0xFB, 0xE4, 0xFD, 0x7F, 0x53, 0x80, 0xBF, 0xE5, 0x5E, 0x64, 0x01,
+0x70, 0x3B, 0x71, 0xC1, 0xBF, 0x01, 0x04, 0x7F, 0x01, 0x71, 0xB5, 0x90, 0x00, 0x46, 0xE0, 0x44,
+0x04, 0xFD, 0x7F, 0x46, 0x31, 0xFB, 0x90, 0x00, 0x44, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x44, 0x31,
+0xFB, 0x90, 0x00, 0x46, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x46, 0x31, 0xFB, 0x7F, 0x02, 0x71, 0xDD,
+0x8F, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0xB4, 0x01, 0x02, 0x71, 0x55, 0x22, 0xE0, 0x5F,
+0xF0, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x7F, 0x10, 0xDF, 0xFE, 0xD0, 0xD0, 0x92, 0xAF,
+0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xE0, 0xED, 0xF0, 0x90, 0x8A, 0xDF,
+0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x4E, 0xA3, 0xE0, 0x70, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x47,
+0xE0, 0x5F, 0xF0, 0x80, 0x17, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80,
+0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x4F, 0xF0, 0x51, 0x81, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF,
+0x90, 0x00, 0x46, 0x80, 0x59, 0x90, 0x8A, 0xDF, 0xE0, 0x24, 0xF8, 0xF0, 0xA3, 0xE0, 0x70, 0x1D,
+0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC,
+0xC4, 0x54, 0xF0, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x80, 0x1A, 0x90, 0x8A, 0xDF,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0,
+0xFF, 0x90, 0x00, 0x43, 0xE0, 0x4F, 0xF0, 0x51, 0x81, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01,
+0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0x51, 0x7E,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x49, 0xE0, 0x90, 0x8B, 0x54, 0xF0, 0xE0, 0x54, 0x0F,
+0xF0, 0x44, 0xF0, 0xFD, 0x7F, 0x49, 0x31, 0xFB, 0x90, 0x8B, 0x54, 0xE0, 0x44, 0xB0, 0xFD, 0x7F,
+0x49, 0x21, 0xFB, 0x90, 0x8A, 0xDD, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0x5E, 0x01, 0x8E, 0x5F,
+0xF5, 0x60, 0xE4, 0xFD, 0x7F, 0x0B, 0x51, 0x91, 0xE4, 0xFD, 0x7F, 0x02, 0x51, 0x91, 0x71, 0xC1,
+0xE4, 0xFF, 0x71, 0xB5, 0xE4, 0xF5, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0x90, 0x8A, 0xDD,
+0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xEC, 0xFB, 0x8D, 0x44, 0xE4, 0xF5, 0x45, 0x7D, 0x01, 0x7F, 0x60,
+0x7E, 0x01, 0x02, 0x35, 0xAB, 0x90, 0x01, 0xCA, 0xE5, 0x61, 0xF0, 0xEF, 0x60, 0x02, 0x71, 0x55,
+0x22, 0x7F, 0x0B, 0x71, 0xDD, 0xEF, 0x65, 0x61, 0x60, 0x10, 0xE5, 0x61, 0xB4, 0x01, 0x05, 0xE4,
+0xF5, 0x61, 0x80, 0x03, 0x75, 0x61, 0x01, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xD3, 0x10, 0xAF,
+0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x57, 0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x43, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46,
+0x51, 0x7E, 0x90, 0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05,
+0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x44, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF,
+0x5B, 0xA8, 0x05, 0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0x80,
+0x4B, 0x90, 0x8B, 0x57, 0xE0, 0x24, 0xF8, 0xF0, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80,
+0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x51, 0x81, 0x90,
+0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x42, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05,
+0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0xD0, 0xD0, 0x92, 0xAF,
+0x22, 0xE4, 0x90, 0x8B, 0x04, 0xF0, 0x90, 0x00, 0x80, 0xE0, 0x44, 0x80, 0xFD, 0x7F, 0x80, 0x21,
+0xFB, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0x90, 0x8A,
+0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFA, 0xE5, 0xF0, 0x24, 0x00, 0xFF,
+0xE4, 0x3A, 0xFE, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEE, 0x8F, 0xF0, 0x12,
+0x43, 0x19, 0x12, 0x29, 0xD9, 0xFF, 0x60, 0x2C, 0xB5, 0x5E, 0x16, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0x65, 0x60, 0x70, 0x04, 0xE5, 0x5F, 0x65, 0xF0, 0x60,
+0x22, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFF, 0xAE, 0xF0,
+0x71, 0x73, 0x80, 0x0F, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0x65, 0x5E, 0x60,
+0x02, 0xB1, 0x08, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0xF5, 0x5E, 0x7F, 0x60, 0x7E, 0x01, 0x8F,
+0x82, 0x8E, 0x83, 0xA3, 0xA3, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x8B, 0xEF,
+0x12, 0x43, 0x94, 0x55, 0x5A, 0x01, 0x55, 0x51, 0x02, 0x55, 0x7E, 0x03, 0x55, 0x87, 0x05, 0x55,
+0x90, 0x06, 0x55, 0xCB, 0x07, 0x55, 0x98, 0x08, 0x55, 0xA1, 0x09, 0x55, 0xA9, 0x20, 0x55, 0xB2,
+0x2C, 0x55, 0x63, 0x2D, 0x55, 0x6C, 0x2E, 0x55, 0x75, 0x3B, 0x55, 0xBB, 0x4B, 0x00, 0x00, 0x55,
+0xC4, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x72, 0xFC, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B,
+0x02, 0x73, 0x02, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x73, 0x2F, 0x90, 0x8A, 0xD7, 0x12,
+0x43, 0x6B, 0x02, 0x73, 0x77, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x73, 0xB0, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x02, 0x73, 0xC9, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x72, 0xD0,
+0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0xE1, 0x19, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74,
+0x11, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x81, 0x91, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02,
+0x76, 0xEA, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x78, 0xDE, 0x90, 0x8A, 0xD7, 0x12, 0x43,
+0x6B, 0x02, 0x7A, 0x48, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x01, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xCC, 0xE0, 0x54, 0x0F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0xFD, 0x70, 0x02, 0xE1, 0x14, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8,
+0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xEF, 0x5D, 0x70, 0x02,
+0xE1, 0x0D, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD0, 0x12, 0x43, 0x5F, 0xE0,
+0x90, 0x8A, 0xD0, 0xF0, 0x75, 0x1D, 0x01, 0x75, 0x1E, 0x8A, 0x75, 0x1F, 0xD0, 0x75, 0x20, 0x01,
+0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD1, 0x12, 0x5F, 0x57, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0xC4, 0x13,
+0x13, 0x13, 0x54, 0x01, 0x90, 0x8B, 0x51, 0x30, 0xE0, 0x59, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00,
+0x88, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x02,
+0x90, 0x00, 0x89, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75,
+0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0x90, 0x8B, 0x51,
+0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD5, 0xF0, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD6,
+0xF0, 0x80, 0x33, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A,
+0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0,
+0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43,
+0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0xEF, 0x54, 0x7F, 0xFF, 0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD2,
+0xB1, 0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x90, 0x8B, 0x51, 0xE0, 0xFE, 0x74, 0x01, 0xA8, 0x06,
+0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0x5F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8B, 0x51,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0x90, 0x01, 0xCC,
+0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x04, 0xF0, 0xE0, 0x54, 0x03, 0xF0, 0xA1, 0xDD, 0x90, 0x01, 0xC6,
+0xE0, 0x44, 0x02, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF,
+0x54, 0x1F, 0xFE, 0xEF, 0x54, 0x20, 0xC4, 0x13, 0x54, 0x07, 0xFD, 0xAF, 0x06, 0x90, 0x8A, 0xDA,
+0xEF, 0xF0, 0xA3, 0xED, 0xF0, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90,
+0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0xF0, 0xC4, 0x54, 0x0F, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x00,
+0x04, 0x12, 0x42, 0x20, 0x54, 0x40, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x90, 0x8A, 0xE0, 0xF0, 0x90,
+0x8A, 0xDA, 0xE0, 0xFF, 0x75, 0xF0, 0x09, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAD, 0x82, 0xAC,
+0x83, 0x90, 0x8A, 0xE1, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23,
+0xF9, 0x74, 0x87, 0x35, 0xF0, 0xFA, 0x7B, 0x01, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12,
+0x43, 0x6B, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0x0F, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43,
+0x6B, 0xEF, 0x12, 0x42, 0x4D, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42,
+0x20, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x90,
+0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8A, 0xE1, 0xE0,
+0xFC, 0xA3, 0xE0, 0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xEF, 0xF0, 0x12, 0x29, 0xD9, 0x8D, 0x82, 0x8C,
+0x83, 0xA3, 0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x24, 0xC1, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0x75, 0xF0, 0x09,
+0xEF, 0x90, 0x87, 0x29, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A,
+0x12, 0x43, 0x5F, 0x74, 0x01, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90,
+0x87, 0x2B, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x8F, 0x0F, 0xEF, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xAF, 0x82, 0xF5, 0x10, 0x8F, 0x11, 0xE5, 0x0F, 0x75, 0xF0, 0x02, 0xA4, 0x24,
+0x81, 0xF9, 0x74, 0x86, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13, 0x89, 0x14, 0x75, 0xF0, 0x09,
+0xE5, 0x0F, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAF, 0x82, 0x85, 0x83, 0x15, 0x8F, 0x16, 0xE5,
+0x0F, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87, 0x35, 0xF0, 0x75, 0x17, 0x01, 0xF5,
+0x18, 0x89, 0x19, 0x74, 0xC1, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x12,
+0x43, 0x94, 0x58, 0xA7, 0x00, 0x58, 0xBC, 0x01, 0x58, 0xD1, 0x02, 0x58, 0xE6, 0x03, 0x59, 0x0F,
+0x04, 0x59, 0x24, 0x05, 0x59, 0x39, 0x06, 0x59, 0x5F, 0x0C, 0x59, 0x8C, 0x0D, 0x59, 0xB9, 0x0E,
+0x59, 0xE6, 0x0F, 0x00, 0x00, 0x5A, 0x1A, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4,
+0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x15, 0x80, 0x3C, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x10, 0x80,
+0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0,
+0xF0, 0xA3, 0x74, 0x05, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0xE4, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0x8F, 0xF0, 0x41, 0x1A, 0xE5,
+0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3,
+0x74, 0xF5, 0x80, 0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0xF0, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0x74, 0x0D, 0xF0, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x41, 0x1A, 0x90,
+0x04, 0x47, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x46, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x45, 0xE0,
+0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x44, 0x41, 0x11, 0x90, 0x04, 0x4B, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4A, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x49, 0xE0, 0x85, 0x11, 0x82,
+0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x48, 0x80, 0x58, 0x90, 0x04, 0x4F, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4E, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x4D, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83,
+0xF0, 0x90, 0x04, 0x4C, 0x80, 0x2B, 0x90, 0x04, 0x53, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x12, 0x42, 0x4D, 0x90, 0x04, 0x52, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01,
+0x12, 0x42, 0x5F, 0x90, 0x04, 0x51, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04,
+0x50, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x29, 0xD9, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19,
+0x12, 0x29, 0xD9, 0x5F, 0xD0, 0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0xAB, 0x12, 0xE5,
+0x14, 0x24, 0x01, 0xF9, 0xE4, 0x35, 0x13, 0xFA, 0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x29,
+0xD9, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x5F, 0xD0,
+0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xC0, 0x83,
+0xC0, 0x82, 0xE0, 0xFF, 0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82,
+0xD0, 0x83, 0xF0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xC0, 0x83, 0xC0, 0x82, 0xE0, 0xFF,
+0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xA3, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0,
+0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3,
+0xE0, 0x4E, 0x60, 0x4B, 0x90, 0x8A, 0xE6, 0x74, 0x0B, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3,
+0x94, 0x00, 0x50, 0x02, 0x61, 0x5F, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3,
+0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4,
+0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x0A, 0x90, 0x8A, 0xE6,
+0xE0, 0x24, 0x10, 0xA3, 0xF0, 0x80, 0x68, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBB, 0xE5,
+0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0,
+0x4E, 0x60, 0x47, 0x90, 0x8A, 0xE6, 0x74, 0x0F, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94,
+0x00, 0x40, 0x3C, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0xA3, 0xF0,
+0x80, 0x0D, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE7, 0xF0, 0xE5,
+0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0,
+0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x10,
+0x40, 0x02, 0x81, 0x18, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89,
+0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x06, 0x90, 0x8A, 0xE6, 0xE0, 0x80,
+0x63, 0x90, 0x8A, 0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A,
+0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x0C, 0x50, 0x3C, 0x74, 0x01, 0x7E, 0x00,
+0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25,
+0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F,
+0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10, 0x80, 0x09, 0x90, 0x8A, 0xE6, 0xE0, 0x04,
+0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0x75, 0xF0, 0x09,
+0xE5, 0x0F, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xEF, 0xF0, 0x90, 0x8A, 0xE8, 0xE0, 0xFE, 0x75,
+0xF0, 0x09, 0xE5, 0x0F, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xE5, 0x0F, 0xC3, 0x94,
+0x20, 0x50, 0x32, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xD3,
+0x9F, 0x40, 0x02, 0x80, 0x18, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83,
+0xE0, 0xC3, 0x9E, 0x50, 0x08, 0x90, 0x8A, 0xE8, 0xE0, 0xA3, 0xF0, 0x80, 0x08, 0x90, 0x8A, 0xE7,
+0xE0, 0x90, 0x8A, 0xE9, 0xF0, 0x90, 0x8A, 0xE9, 0xE0, 0xFD, 0xAF, 0x0F, 0x91, 0xC1, 0x90, 0x8A,
+0xE9, 0xE0, 0xFF, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0xD3, 0x94, 0x13, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x03, 0xF0,
+0x22, 0xEF, 0xD3, 0x94, 0x0B, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x02, 0xF0, 0x22, 0xEF, 0xD3,
+0x94, 0x03, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x01, 0xF0, 0x22, 0xE4, 0x90, 0x87, 0x22, 0xF0,
+0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04,
+0xF5, 0x83, 0xED, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAC, 0x07, 0xED, 0x54, 0x1F, 0x90, 0x8A,
+0xC7, 0xF0, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xC5,
+0xF0, 0x90, 0x8A, 0xC8, 0x74, 0x01, 0xF0, 0xEB, 0xC3, 0x94, 0x01, 0x40, 0x02, 0x80, 0x37, 0x90,
+0x8A, 0xC5, 0xE0, 0x25, 0x0D, 0xFF, 0xA3, 0xF0, 0xA3, 0xE0, 0x90, 0x41, 0x9E, 0x93, 0xFE, 0xEF,
+0xD3, 0x9E, 0x40, 0x10, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0,
+0xAF, 0x04, 0x80, 0x9D, 0x90, 0x8A, 0xC6, 0xE0, 0xFF, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEF, 0xF0, 0x22, 0xAD, 0x07, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12,
+0x43, 0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xCA, 0xF0, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A,
+0xF5, 0x83, 0xE0, 0x54, 0x1F, 0x90, 0x8A, 0xC9, 0xF0, 0xD3, 0x9F, 0x40, 0x06, 0xA3, 0xE0, 0x90,
+0x8A, 0xC9, 0xF0, 0x90, 0x8A, 0xC9, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xC9, 0xE0, 0xFD, 0x91, 0xC1, 0x90, 0x8A,
+0xC9, 0xE0, 0xFF, 0x22, 0xAC, 0x07, 0x74, 0x84, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83,
+0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0x54, 0x1F, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0x75,
+0xF0, 0x09, 0xEC, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xE3, 0xF0, 0x75, 0xF0,
+0x09, 0xEC, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0x90, 0x8A, 0xE4, 0xF0, 0xEC, 0x25,
+0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A,
+0xE5, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE7, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEF, 0xD3,
+0x9E, 0x40, 0x0C, 0x90, 0x8A, 0xE4, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xED,
+0x70, 0x02, 0xE1, 0x06, 0x90, 0x8A, 0xE2, 0xED, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0x30, 0xE6, 0x0E,
+0x90, 0x8A, 0xE1, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x14, 0xF0, 0x90, 0x8A,
+0xE2, 0xE0, 0x70, 0x02, 0xE1, 0x06, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0xD3, 0x94, 0x00, 0x50, 0x02,
+0xE1, 0x06, 0xE4, 0x90, 0x8A, 0xE0, 0xF0, 0xEF, 0x14, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xE3,
+0xE0, 0xFD, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0xD3, 0x9D, 0x40, 0x6F, 0xEF, 0x94, 0x10, 0x40, 0x21,
+0xEF, 0x24, 0xF0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE7, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70,
+0x27, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x37, 0x74, 0x01, 0x7E, 0x00, 0xA8,
+0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE5, 0xE0,
+0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0x90, 0x8A, 0xDE, 0xF0,
+0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0x6F,
+0x60, 0x08, 0x90, 0x8A, 0xDF, 0xE0, 0x14, 0xF0, 0x80, 0x83, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90,
+0x8A, 0xE0, 0xE0, 0xC3, 0x9F, 0x50, 0x0F, 0x90, 0x8A, 0xDF, 0xE0, 0xB5, 0x05, 0x08, 0x90, 0x8A,
+0xE3, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0,
+0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93,
+0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xEC, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x90, 0x8A, 0xDE, 0xE0, 0xFD, 0x91,
+0xC1, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8B, 0x1A,
+0x8A, 0x1B, 0x89, 0x1C, 0x90, 0x8B, 0x3F, 0x12, 0x43, 0x8B, 0xAB, 0x1D, 0xAA, 0x1E, 0xA9, 0x1F,
+0x90, 0x8B, 0x42, 0x12, 0x43, 0x8B, 0xAF, 0x20, 0x15, 0x20, 0xEF, 0x60, 0x1E, 0x90, 0x8B, 0x42,
+0xE4, 0x75, 0xF0, 0x01, 0x12, 0x43, 0x74, 0x12, 0x29, 0xD9, 0xFF, 0x90, 0x8B, 0x3F, 0xE4, 0x75,
+0xF0, 0x01, 0x12, 0x43, 0x74, 0xEF, 0x12, 0x42, 0x4D, 0x80, 0xDB, 0xAB, 0x1A, 0xAA, 0x1B, 0xA9,
+0x1C, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xC4,
+0x74, 0xA6, 0xF0, 0x74, 0x5F, 0xA3, 0xF0, 0x90, 0x04, 0x1D, 0xE0, 0x60, 0x1A, 0x90, 0x05, 0x22,
+0xE0, 0x54, 0x90, 0x60, 0x07, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x01, 0xC7, 0xE0,
+0x30, 0xE1, 0xE4, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFB, 0xFA, 0xEF, 0x30, 0xE0, 0x02, 0x7B, 0x80, 0xEF, 0xC3,
+0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90, 0x04, 0x25, 0xEF, 0xF0, 0xED, 0x60, 0x1E, 0xAF, 0x03, 0x74,
+0x0F, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x74, 0x10, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0xAF, 0x03, 0x74, 0x08, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x09, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0x21, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5,
+0x83, 0xE0, 0x54, 0xF7, 0xF0, 0xAE, 0x02, 0xAF, 0x03, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFD, 0xFC, 0xEF, 0x30, 0xE0, 0x02, 0x7D, 0x80, 0xEF, 0xC3,
+0x13, 0x90, 0xFD, 0x10, 0xF0, 0xAE, 0x04, 0xAF, 0x05, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x5F,
+0xA6, 0xBF, 0x01, 0x10, 0x90, 0x02, 0x09, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xDE, 0x90, 0x04,
+0x1F, 0x74, 0x20, 0xF0, 0x22, 0x90, 0x01, 0x02, 0xE0, 0x54, 0x03, 0xFF, 0xE0, 0x54, 0x0C, 0x13,
+0x13, 0x54, 0x3F, 0xFE, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x0E, 0x90, 0x8A, 0xC5,
+0x74, 0x01, 0xF0, 0xA3, 0x74, 0x37, 0xF0, 0x79, 0x01, 0x80, 0x18, 0xEE, 0x64, 0x01, 0x60, 0x07,
+0xAF, 0x06, 0xEE, 0x64, 0x03, 0x70, 0x3B, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0, 0xA3, 0x74, 0x3D,
+0xF0, 0x79, 0x40, 0x90, 0x8A, 0xC5, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0,
+0x59, 0x60, 0x08, 0xE9, 0xF0, 0xE4, 0x90, 0x8A, 0xF6, 0xF0, 0x22, 0x90, 0x8A, 0xF6, 0xE0, 0x04,
+0xF0, 0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x0B, 0xE4, 0xF0, 0x90, 0x04, 0x19, 0xE0, 0x30, 0xE0, 0x02,
+0x11, 0x6E, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00,
+0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07,
+0x90, 0x01, 0xC4, 0x74, 0xF3, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xE0, 0x55, 0x28,
+0xF5, 0x2C, 0xA3, 0xE0, 0x55, 0x29, 0xF5, 0x2D, 0xA3, 0xE0, 0x55, 0x2A, 0xF5, 0x2E, 0xA3, 0xE0,
+0x55, 0x2B, 0xF5, 0x2F, 0xE5, 0x2C, 0x20, 0xE0, 0x02, 0x41, 0x8A, 0x90, 0x01, 0x34, 0x74, 0x01,
+0xF0, 0x85, 0xD1, 0x4D, 0x85, 0xD2, 0x4E, 0x85, 0xD3, 0x4F, 0x85, 0xD4, 0x50, 0x85, 0xD5, 0x51,
+0x85, 0xD6, 0x52, 0x85, 0xD7, 0x53, 0x85, 0xD9, 0x54, 0xE5, 0x54, 0x54, 0x40, 0xC3, 0x13, 0xFF,
+0xE5, 0x53, 0x54, 0x20, 0x6F, 0x70, 0x02, 0x41, 0x47, 0xE5, 0x54, 0x30, 0xE5, 0x02, 0x41, 0x47,
+0xE5, 0x52, 0x54, 0x1F, 0xF5, 0x08, 0xE5, 0x4D, 0x54, 0x3F, 0xF5, 0x09, 0xE5, 0x51, 0x54, 0x1F,
+0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F,
+0xF0, 0x12, 0x42, 0x81, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xC0, 0xF5,
+0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x09, 0xD3, 0x94,
+0x04, 0x40, 0x03, 0x75, 0x09, 0x04, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43,
+0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xE5, 0x53,
+0x54, 0x1F, 0x2F, 0xFF, 0xE4, 0x3E, 0xFE, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12,
+0x43, 0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE5,
+0x54, 0x20, 0xE6, 0x24, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0x63, 0xF5,
+0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x4F, 0x30, 0xE7,
+0x36, 0xAF, 0x08, 0x12, 0x5D, 0x36, 0x80, 0x2F, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25,
+0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81,
+0xE5, 0x4F, 0x30, 0xE7, 0x12, 0xE5, 0x4F, 0x54, 0x7F, 0xFD, 0xE5, 0x53, 0x54, 0x1F, 0xF5, 0x0D,
+0xAB, 0x09, 0xAF, 0x08, 0x12, 0x5C, 0xD9, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x3A,
+0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04,
+0xF0, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x21, 0x90, 0x8B, 0x3D, 0x12, 0x4B, 0x5C, 0x90,
+0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x80,
+0x09, 0x12, 0x4B, 0x34, 0xBF, 0x01, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2C, 0x30, 0xE1, 0x20, 0x90,
+0x01, 0x34, 0x74, 0x02, 0xF0, 0x85, 0xD1, 0x56, 0x85, 0xD2, 0x57, 0x85, 0xD3, 0x58, 0x85, 0xD4,
+0x59, 0x85, 0xD5, 0x5A, 0x85, 0xD6, 0x5B, 0x85, 0xD7, 0x5C, 0x85, 0xD9, 0x5D, 0xB1, 0x5F, 0xE5,
+0x2C, 0x30, 0xE3, 0x06, 0x90, 0x01, 0x34, 0x74, 0x08, 0xF0, 0xE5, 0x2C, 0x30, 0xE4, 0x09, 0x90,
+0x01, 0x34, 0x74, 0x10, 0xF0, 0x43, 0x55, 0x10, 0xE5, 0x2C, 0x30, 0xE5, 0x26, 0x90, 0x01, 0xCF,
+0xE0, 0x30, 0xE5, 0x1F, 0xE0, 0x54, 0xDF, 0xF0, 0x90, 0x01, 0x34, 0x74, 0x20, 0xF0, 0x75, 0xA8,
+0x00, 0x75, 0xE8, 0x00, 0x12, 0x52, 0x10, 0x90, 0x00, 0x03, 0xE0, 0x54, 0xFB, 0xF0, 0x12, 0x52,
+0x81, 0x80, 0xFE, 0xE5, 0x2C, 0x30, 0xE6, 0x2D, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0x90, 0x8B,
+0x32, 0xE0, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05, 0x90, 0x8B, 0x34, 0xE4,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05,
+0x90, 0x8B, 0x2E, 0xE4, 0xF0, 0xE5, 0x2E, 0x20, 0xE0, 0x02, 0x61, 0xE7, 0x90, 0x8B, 0x08, 0x74,
+0x01, 0xF0, 0x90, 0x01, 0x36, 0xF0, 0x90, 0x8B, 0x06, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05,
+0x53, 0xE0, 0x44, 0x02, 0xF0, 0x90, 0x05, 0xFC, 0xE0, 0x04, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30,
+0xE0, 0x2F, 0x90, 0x8B, 0x37, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54,
+0x3F, 0x30, 0xE0, 0x1D, 0x90, 0x8B, 0x34, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0D, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x7F, 0x04, 0x12, 0x4E,
+0x89, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x56, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x4F,
+0x90, 0x8B, 0x2E, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x3F,
+0xB1, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60,
+0x2E, 0xEF, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF,
+0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x05, 0x7F, 0x01, 0x12, 0x7B, 0x49, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12,
+0x43, 0xE7, 0x90, 0x8B, 0x08, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE1, 0x2F, 0x90, 0x01, 0x36, 0x74,
+0x02, 0xF0, 0x43, 0x55, 0x40, 0x11, 0x85, 0x90, 0x8B, 0x37, 0xE0, 0xB4, 0x01, 0x09, 0x90, 0x05,
+0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x37, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x0D, 0xE4, 0xFF,
+0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE2, 0x16,
+0x90, 0x01, 0x36, 0x74, 0x04, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x06, 0xA3, 0xE0, 0x64,
+0x06, 0x60, 0x03, 0x12, 0x46, 0xB3, 0xE5, 0x2E, 0x30, 0xE3, 0x38, 0x90, 0x01, 0x36, 0x74, 0x08,
+0xF0, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x2C, 0xE5, 0x24, 0x60, 0x28, 0x90, 0x01, 0x57, 0xE4, 0xF0,
+0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90,
+0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57,
+0x74, 0x05, 0xF0, 0xE5, 0x2E, 0x30, 0xE4, 0x2B, 0x90, 0x01, 0x36, 0x74, 0x10, 0xF0, 0xE5, 0x21,
+0xB4, 0x01, 0x20, 0xE5, 0x24, 0x60, 0x1C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74,
+0x02, 0xF0, 0x90, 0x8B, 0x1B, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x03,
+0x12, 0x4A, 0xFC, 0xE5, 0x2E, 0x30, 0xE5, 0x1F, 0x90, 0x01, 0x36, 0x74, 0x20, 0xF0, 0xE5, 0x21,
+0xB4, 0x01, 0x14, 0xE5, 0x24, 0x60, 0x10, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12,
+0x4A, 0x97, 0x80, 0x03, 0x12, 0x49, 0x49, 0xE5, 0x2E, 0x30, 0xE6, 0x1B, 0x90, 0x01, 0x36, 0x74,
+0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x10, 0xE5, 0x24, 0x60, 0x0C, 0x53, 0x25, 0xFE, 0xE5, 0x25,
+0x54, 0x07, 0x70, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2F, 0x30, 0xE1, 0x27, 0x90, 0x01, 0x37, 0x74,
+0x02, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x17, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60,
+0x07, 0x12, 0x48, 0xFE, 0xD1, 0x20, 0x80, 0x0B, 0x90, 0x8B, 0x31, 0x74, 0x01, 0xF0, 0x80, 0x03,
+0x12, 0x48, 0xFE, 0x74, 0xF3, 0x04, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0xD0, 0x07,
+0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0,
+0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x05,
+0x58, 0xE0, 0xFF, 0x90, 0x8B, 0x38, 0xE0, 0x2F, 0x24, 0xFE, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB,
+0xFD, 0x7F, 0x50, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x53, 0x74, 0x05, 0xF0, 0x22, 0x90,
+0x8A, 0xC5, 0xE0, 0x54, 0xF0, 0x44, 0x03, 0xF0, 0x54, 0x0F, 0x44, 0x80, 0xF0, 0x7B, 0x00, 0x7A,
+0x00, 0x79, 0x56, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x8B, 0x0B, 0x7A, 0x8A, 0x79, 0xC5, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x8B, 0x90, 0x8B, 0x53, 0xE0, 0xFF,
+0x04, 0xF0, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x7F, 0xAF, 0x7E, 0x01, 0xD1, 0x8A, 0xEF,
+0x60, 0x49, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x75, 0x20,
+0x02, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA0, 0x12, 0x5F, 0x57, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x6B,
+0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF,
+0xC4, 0x54, 0x0F, 0xF5, 0x20, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA2, 0x12, 0x5F, 0x57, 0x90, 0x01,
+0xAF, 0x74, 0xFF, 0xF0, 0x90, 0x01, 0xCB, 0xE0, 0x64, 0x80, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0B, 0xA3, 0xE0, 0x64,
+0x06, 0x60, 0x05, 0x7F, 0x06, 0x12, 0x7B, 0x49, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x02,
+0xD1, 0x13, 0x22, 0x90, 0x8B, 0x31, 0xE0, 0xB4, 0x01, 0x05, 0xE4, 0xF0, 0x12, 0x48, 0xFE, 0x22,
+0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x3C, 0xE5, 0x22, 0x54, 0x0F, 0x14, 0x60, 0x2E, 0x14,
+0x60, 0x1E, 0x24, 0xFE, 0x60, 0x0E, 0x24, 0xF8, 0x70, 0x2A, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x90,
+0x05, 0x22, 0xF0, 0x22, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x22,
+0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0x90, 0x01, 0xC6,
+0xE0, 0x44, 0x08, 0xF0, 0x22, 0xAE, 0x07, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x18, 0x90,
+0x8B, 0x2C, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x0C, 0xAF, 0x06, 0x7D, 0x01, 0x12,
+0x45, 0xA2, 0xD1, 0x20, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x4B, 0xEE, 0xF0, 0xA3,
+0xEF, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x8B, 0x4B, 0xE0, 0xFE, 0xA3, 0xE0, 0xF5, 0x82,
+0x8E, 0x83, 0xE0, 0x60, 0x2C, 0xC3, 0x90, 0x8B, 0x4E, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4D, 0xE0,
+0x94, 0x03, 0x40, 0x0A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x4D, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x80,
+0xC6, 0x7F, 0x01, 0x22, 0x75, 0x28, 0x33, 0xE4, 0xF5, 0x29, 0x75, 0x2A, 0x07, 0xF5, 0x2B, 0x90,
+0x01, 0x30, 0xE5, 0x28, 0xF0, 0xA3, 0xE5, 0x29, 0xF0, 0xA3, 0xE5, 0x2A, 0xF0, 0xA3, 0xE5, 0x2B,
+0xF0, 0x22, 0x75, 0x30, 0x1F, 0x75, 0x31, 0x01, 0x43, 0x31, 0x10, 0xE4, 0xF5, 0x32, 0x90, 0x01,
+0x38, 0xE5, 0x30, 0xF0, 0xA3, 0xE5, 0x31, 0xF0, 0xA3, 0xE5, 0x32, 0xF0, 0x22, 0x22, 0x90, 0x00,
+0x02, 0xE0, 0x54, 0xE0, 0x7F, 0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x00, 0xF3, 0xE0, 0x7F,
+0x00, 0x30, 0xE3, 0x02, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x0C, 0x90, 0x00,
+0xF2, 0xE0, 0x30, 0xE7, 0x05, 0x7E, 0xFD, 0x7F, 0x33, 0x22, 0x7E, 0xFD, 0x7F, 0x2F, 0x22, 0x90,
+0x00, 0xF3, 0xE0, 0x30, 0xE2, 0x0D, 0x90, 0x05, 0x41, 0x74, 0x10, 0xF0, 0x90, 0x05, 0x5A, 0xF0,
+0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x01, 0x64, 0x74, 0xA0, 0xF0, 0x22, 0xC0, 0xE0, 0xC0, 0x83, 0xC0,
+0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x7D, 0x5B, 0x90, 0x01,
+0xC4, 0xED, 0xF0, 0x74, 0x67, 0xFF, 0xA3, 0xF0, 0x53, 0x91, 0xEF, 0x90, 0x00, 0x51, 0xE0, 0xFE,
+0x90, 0x00, 0x55, 0xE0, 0x5E, 0xF5, 0x3D, 0x90, 0x00, 0x52, 0xE0, 0xFE, 0x90, 0x00, 0x56, 0xE0,
+0x5E, 0xF5, 0x3E, 0xE5, 0x3D, 0x30, 0xE4, 0x06, 0x90, 0x00, 0x55, 0x74, 0x10, 0xF0, 0xE5, 0x3D,
+0x30, 0xE5, 0x06, 0x90, 0x00, 0x55, 0x74, 0x20, 0xF0, 0xE5, 0x3D, 0x30, 0xE6, 0x06, 0x90, 0x00,
+0x55, 0x74, 0x40, 0xF0, 0xE5, 0x3D, 0x30, 0xE7, 0x06, 0x90, 0x00, 0x55, 0x74, 0x80, 0xF0, 0xE5,
+0x3E, 0x30, 0xE0, 0x06, 0x90, 0x00, 0x56, 0x74, 0x01, 0xF0, 0xE5, 0x3E, 0x30, 0xE1, 0x06, 0x90,
+0x00, 0x56, 0x74, 0x02, 0xF0, 0xE5, 0x3E, 0x30, 0xE2, 0x06, 0x90, 0x00, 0x56, 0x74, 0x04, 0xF0,
+0xE5, 0x3E, 0x30, 0xE3, 0x06, 0x90, 0x00, 0x56, 0x74, 0x08, 0xF0, 0x90, 0x01, 0xC4, 0xED, 0xF0,
+0xA3, 0xEF, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0,
+0xE0, 0x32, 0xEF, 0xC3, 0x94, 0x20, 0x50, 0x39, 0xEF, 0x30, 0xE0, 0x17, 0xED, 0xC4, 0x54, 0xF0,
+0xFD, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54,
+0x0F, 0x80, 0x10, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83,
+0xE0, 0x54, 0xF0, 0xF0, 0x74, 0xA4, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x4D,
+0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40,
+0x02, 0xC1, 0xCD, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F, 0xE0, 0x64, 0x01,
+0x60, 0x02, 0xC1, 0xC5, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34,
+0x85, 0xF5, 0x83, 0xE0, 0xFC, 0xA3, 0xE0, 0xD3, 0x94, 0x00, 0xEC, 0x94, 0x00, 0x50, 0x02, 0xC1,
+0xC5, 0xEF, 0x75, 0xF0, 0x0A, 0xA4, 0x24, 0x00, 0xF9, 0x74, 0x84, 0x35, 0xF0, 0x75, 0x12, 0x01,
+0xF5, 0x13, 0x89, 0x14, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34,
+0x85, 0xF5, 0x83, 0xE0, 0xFD, 0xA3, 0xE0, 0x90, 0x8A, 0xD4, 0xCD, 0xF0, 0xA3, 0xED, 0xF0, 0xEF,
+0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90,
+0x8A, 0xD6, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x84, 0xF5, 0x82,
+0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x3F, 0x90, 0x8A, 0xD0, 0xF0, 0xE0, 0xFD, 0x54, 0x1F,
+0xA3, 0xF0, 0x75, 0xF0, 0x09, 0xEE, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD9,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFB, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0xC3, 0x94, 0x05, 0x40, 0x02, 0x61, 0x1A, 0x90, 0x8A, 0xD9, 0xE0, 0xFE, 0x90, 0x8A, 0xD1, 0xE0,
+0x9E, 0x40, 0x13, 0x90, 0x8A, 0xD9, 0xE0, 0x90, 0x8A, 0xD1, 0xF0, 0xED, 0x54, 0x40, 0xFD, 0x90,
+0x8A, 0xD0, 0xF0, 0xEE, 0x4D, 0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0x90, 0x41, 0x12, 0x93, 0xFE,
+0x74, 0x23, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xC3, 0x9E, 0x40, 0x06, 0xEF,
+0x90, 0x40, 0xDA, 0x80, 0x07, 0x90, 0x8A, 0xD1, 0xE0, 0x90, 0x40, 0xF6, 0x93, 0x90, 0x8A, 0xD8,
+0xF0, 0x90, 0x8A, 0xD8, 0xE0, 0x75, 0xF0, 0x06, 0xA4, 0x24, 0x50, 0xF9, 0x74, 0x40, 0x35, 0xF0,
+0x75, 0x0F, 0xFF, 0xF5, 0x10, 0x89, 0x11, 0x90, 0x8A, 0xD0, 0xE0, 0x90, 0x41, 0xBA, 0x93, 0xFF,
+0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x9F, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x0C, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5D, 0xB4, 0xC1, 0x5B, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0,
+0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD2,
+0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x12, 0x29, 0xD9, 0xFF, 0x7E,
+0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x97, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2,
+0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90,
+0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00,
+0x02, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0,
+0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF,
+0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x04, 0x12, 0x42, 0xC2, 0xFD, 0xAC,
+0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA,
+0x10, 0xA9, 0x11, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13,
+0xA9, 0x14, 0x90, 0x00, 0x06, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A,
+0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x04,
+0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x08, 0x12,
+0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42,
+0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x05, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00,
+0x90, 0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0xD3, 0x90, 0x8A, 0xD3, 0xE0,
+0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x0C, 0xA3, 0xE0, 0x9F, 0xF0, 0x90, 0x8A, 0xD2, 0xE0,
+0x9E, 0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0xFC,
+0xA3, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24, 0x2E,
+0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xD3, 0xED,
+0x9B, 0xEC, 0x9A, 0x40, 0x04, 0xD1, 0xCE, 0xC1, 0x29, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFE, 0x74, 0x01, 0x93, 0xFF, 0xC3,
+0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x02, 0xC1, 0x29, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5D, 0xB4, 0xC1, 0x29, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24,
+0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFC, 0x64, 0x05, 0x60, 0x02, 0x81, 0xF8,
+0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x03, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94, 0x19, 0x40,
+0x3D, 0x80, 0x2E, 0xEE, 0xB4, 0x02, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94, 0x11, 0x40, 0x2E,
+0x80, 0x1F, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x01, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94,
+0x0A, 0x40, 0x1B, 0x80, 0x0C, 0xEE, 0x70, 0x11, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94, 0x03, 0x40,
+0x0D, 0x90, 0x89, 0x43, 0x74, 0x01, 0xF0, 0x80, 0x05, 0xE4, 0x90, 0x89, 0x43, 0xF0, 0x90, 0x8A,
+0xCF, 0xE0, 0xFE, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xDD,
+0xF0, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xC3, 0x94, 0x30,
+0x50, 0x0A, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0x81, 0xA3, 0x90, 0x89, 0x43, 0xE0,
+0x64, 0x01, 0x60, 0x02, 0x81, 0x98, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0x64, 0x0A, 0x60, 0x5B, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xEE, 0x24, 0x05,
+0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF,
+0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x38, 0x90, 0x8A, 0xCF, 0xE0, 0xFE,
+0xEF, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE0, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x16, 0x90, 0x8A, 0xCF,
+0xE0, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFF, 0x90, 0x8A, 0xD1, 0xE0,
+0x6F, 0x60, 0x56, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE0, 0xFF, 0xD3, 0x94, 0x42, 0x40, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x11, 0xEF,
+0xD3, 0x94, 0x39, 0x90, 0x8A, 0xDD, 0x40, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0,
+0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE,
+0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xCF, 0xE0,
+0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0x80, 0x2F, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x14, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x8A, 0xD1, 0xE0,
+0xFE, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFE, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x11,
+0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0xC1, 0x27, 0xEC, 0x64, 0x06, 0x60, 0x02, 0xC1, 0x29, 0x90,
+0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x41, 0xDB, 0x93, 0xFF, 0x7E, 0x00, 0x90, 0x8A, 0xD4, 0xE0,
+0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xDB, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x90,
+0x8A, 0xCF, 0xE0, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xDD,
+0xF0, 0xE4, 0x90, 0x8A, 0xDA, 0xF0, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0xD3, 0x94, 0x04, 0x50, 0x47,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x75, 0xF0, 0x02, 0xEF, 0xA4, 0xF5, 0x82, 0x85, 0xF0, 0x83,
+0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0xEF, 0x90, 0x41, 0xD6, 0x93, 0xFF, 0x7E, 0x00, 0x12, 0x29,
+0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0xA3,
+0xE0, 0xFF, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x50, 0x08, 0x90,
+0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0x80, 0xAF, 0x90, 0x8A, 0xDA, 0xE0, 0xC3, 0x13, 0xF0, 0x90, 0x8A,
+0xDD, 0xE0, 0xFF, 0xB4, 0x01, 0x0D, 0x90, 0x8A, 0xDA, 0xE0, 0x70, 0x5D, 0x90, 0x8A, 0xDD, 0x04,
+0xF0, 0x80, 0x5B, 0xEF, 0xB4, 0x03, 0x1D, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x70, 0x08, 0x90, 0x8A,
+0xDD, 0x74, 0x03, 0xF0, 0x80, 0x48, 0xEF, 0xB4, 0x01, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0,
+0x80, 0x3C, 0x80, 0x35, 0x90, 0x8A, 0xDD, 0xE0, 0x64, 0x05, 0x70, 0x32, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x0F, 0xEF, 0x90, 0x8A, 0xDD, 0xB4,
+0x01, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0, 0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x94,
+0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xD3, 0x90,
+0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90, 0x8A,
+0xDD, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x43, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xED, 0xF0, 0x11, 0x02, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xD3, 0x94, 0x05, 0x50, 0x0F, 0x74, 0x64, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x0F, 0x90, 0x8A, 0xCF, 0xE0,
+0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9,
+0x14, 0xE4, 0xF5, 0xF0, 0x12, 0x42, 0xFA, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x02,
+0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x04, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90,
+0x00, 0x06, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x08, 0xE4, 0xF5, 0xF0, 0x12, 0x43,
+0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x01, 0x47, 0x22, 0xAD, 0x07,
+0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE,
+0xF0, 0xE0, 0xF9, 0x54, 0x1F, 0xA3, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43,
+0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0xED, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE2, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xED,
+0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90,
+0x8A, 0xE4, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x25, 0xE0, 0x24, 0x2E,
+0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xED, 0x25,
+0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEA, 0xF0, 0xA3, 0xEB, 0xF0, 0xEE,
+0xC3, 0x9F, 0x40, 0x03, 0x02, 0x70, 0x12, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0xEF, 0x04, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A,
+0xE1, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0xD3, 0x9F, 0x40, 0x03, 0x02, 0x70, 0x4C, 0xEE,
+0xC3, 0x94, 0x10, 0x40, 0x21, 0xEE, 0x24, 0xF0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08,
+0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE2, 0xE0, 0x5E, 0xFE,
+0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x59,
+0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x3C, 0x90, 0x8A, 0xE0,
+0xE0, 0xB4, 0x11, 0x0D, 0x90, 0x8A, 0xE3, 0xE0, 0x30, 0xE7, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x17,
+0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0x64, 0x13, 0x60, 0x04, 0xEF, 0xB4, 0x12, 0x0D, 0x90, 0x8A,
+0xE2, 0xE0, 0x30, 0xE0, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x18, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x90,
+0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x43, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x02,
+0x6F, 0x6E, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x6C, 0x70, 0x71, 0x74,
+0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90,
+0x87, 0x29, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x10, 0xE9, 0x20, 0xE6, 0x0C, 0x90, 0x8A, 0xDF,
+0xE0, 0x44, 0x40, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x03, 0xAF, 0x01, 0x22, 0x90, 0x8A, 0xDF, 0xE0,
+0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74,
+0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74,
+0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0,
+0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x66,
+0x90, 0x8A, 0xDF, 0xE0, 0xD3, 0x9C, 0x40, 0x5E, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0x74, 0xA5, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0x90, 0x8A,
+0xDE, 0xF0, 0xFC, 0xA3, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5,
+0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4,
+0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF,
+0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0,
+0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x22, 0x74, 0x01, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xE4, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xDE, 0xE0, 0x44, 0x80, 0xFD, 0x12, 0x5C, 0xC1, 0x90, 0x8A,
+0xDE, 0xE0, 0x44, 0x80, 0xFF, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF,
+0xC3, 0x94, 0x10, 0x50, 0x14, 0x74, 0xA4, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x80, 0xE2, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x02, 0x41, 0xCF, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84,
+0x00, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x02, 0x12,
+0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x04, 0x12, 0x43, 0x5F,
+0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x06, 0x12, 0x43, 0x5F, 0xE4, 0xF0,
+0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x08, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0,
+0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x74, 0x44, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x74, 0x24, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x64, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x41, 0x8C, 0x93, 0xFE, 0x74, 0x01,
+0x93, 0xFF, 0x90, 0x41, 0x54, 0x74, 0x01, 0x93, 0x2F, 0xFF, 0xE4, 0x93, 0x3E, 0xC3, 0x13, 0xFE,
+0xEF, 0x13, 0xFF, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12,
+0x43, 0x5F, 0x74, 0x01, 0xF0, 0x74, 0xC1, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74,
+0x0C, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0x74, 0xFF, 0xF0, 0xA3,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x23, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0x74, 0x0F,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0x74, 0x13, 0xF0, 0x75, 0xF0,
+0x09, 0xED, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x21, 0x3E, 0x22,
+0x12, 0x29, 0xD9, 0xFF, 0xC3, 0x94, 0x20, 0x50, 0x14, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFE,
+0x74, 0x23, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xEE, 0xF0, 0x22, 0xEF, 0xB4, 0x20,
+0x0A, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0x90, 0x87, 0x21, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0xF5,
+0x21, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x2A, 0x8B, 0x00,
+0x00, 0x00, 0x00, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x00, 0x03,
+0x12, 0x42, 0x20, 0x90, 0x8B, 0x0A, 0xF0, 0x12, 0x47, 0xFA, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90,
+0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x30, 0xE0, 0x25, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x10, 0xF0,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x11, 0xF0, 0xEF, 0xC3, 0x13, 0x54, 0x7F, 0x90,
+0x8B, 0x0F, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x16, 0xF0, 0x22, 0x90, 0x8B,
+0x10, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x11, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0,
+0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0x30, 0xE0, 0x19, 0xC3, 0x13, 0x54,
+0x7F, 0x90, 0x8B, 0x15, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8B, 0x13, 0xE4,
+0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x0F, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x13, 0xE4,
+0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22,
+0x12, 0x29, 0xD9, 0x90, 0x8B, 0x12, 0xF0, 0x60, 0x07, 0xE4, 0xFD, 0x7F, 0x04, 0x12, 0x45, 0xA2,
+0x90, 0x8B, 0x12, 0xE0, 0x90, 0x01, 0xE7, 0xF0, 0x22, 0x90, 0x02, 0x09, 0xE0, 0xFD, 0x12, 0x29,
+0xD9, 0xFE, 0xAF, 0x05, 0xED, 0x2E, 0x90, 0x8A, 0xF7, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20,
+0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF8, 0xF0, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F,
+0x90, 0x8A, 0xF9, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xFA,
+0xF0, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF, 0xAE, 0x05, 0xED, 0x2F, 0x90, 0x8A, 0xFB, 0xF0,
+0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0xE4, 0x90,
+0x8A, 0xDD, 0xF0, 0x12, 0x29, 0xD9, 0xC3, 0x13, 0x20, 0xE0, 0x02, 0xA1, 0x62, 0x90, 0x8A, 0xDA,
+0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x54, 0x02, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFD,
+0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x29, 0xD9,
+0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x10,
+0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x20, 0xFD, 0xEF, 0x54,
+0xDF, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x40, 0xFE, 0xEF, 0x54, 0xBF, 0x4E, 0xF0,
+0x20, 0xE0, 0x02, 0xA1, 0x4F, 0x90, 0x8A, 0xDD, 0x74, 0x21, 0xF0, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x13, 0x13, 0x54, 0x01, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13,
+0x13, 0x54, 0x01, 0x6E, 0x60, 0x2A, 0xEF, 0x54, 0x04, 0xFF, 0xED, 0x54, 0xFB, 0x4F, 0xF0, 0xE0,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0E, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0xFD, 0xE4, 0xFF,
+0x12, 0x36, 0xE6, 0x80, 0x0B, 0xE4, 0x90, 0x8B, 0x34, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x36, 0x75,
+0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD,
+0xE0, 0x44, 0x12, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44,
+0x14, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x54, 0x07, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD,
+0xE0, 0x44, 0x80, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x07,
+0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90,
+0x8B, 0x33, 0xE0, 0x70, 0x05, 0x7F, 0x01, 0x12, 0x4E, 0x89, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13,
+0x13, 0x54, 0x03, 0x30, 0xE0, 0x04, 0x7F, 0x03, 0x80, 0x0E, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF,
+0x60, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F, 0x02, 0x12, 0x4E, 0x89, 0x7F, 0x02, 0xC1, 0xA4, 0x90,
+0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27, 0xF0, 0xE4, 0xFF, 0x12, 0x4E, 0x89, 0x7F, 0x03,
+0xC1, 0xA4, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x54, 0x02, 0xFE, 0x90,
+0x8B, 0x2C, 0xE0, 0x54, 0xFD, 0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F,
+0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B,
+0x2C, 0xF0, 0xEE, 0x54, 0x10, 0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE,
+0x54, 0x40, 0xFD, 0xEF, 0x54, 0xBF, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x04, 0xFE,
+0xEF, 0x54, 0xFB, 0x4E, 0xF0, 0x20, 0xE0, 0x02, 0xC1, 0x57, 0x90, 0x8A, 0xDD, 0x74, 0x31, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x13, 0x13, 0x54, 0x3F, 0x20, 0xE0, 0x0B, 0xE4, 0x90, 0x8B, 0x2E, 0xF0,
+0x7D, 0x40, 0xFF, 0x12, 0x36, 0x75, 0x90, 0x8B, 0x2C, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F,
+0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x02, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0,
+0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x04, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x54, 0x06, 0x60, 0x0C,
+0x90, 0x01, 0x3E, 0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8A, 0xDD, 0xE0,
+0x90, 0x05, 0x27, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0,
+0x0D, 0xA3, 0xE0, 0x64, 0x06, 0x60, 0x2C, 0x7F, 0x06, 0x12, 0x7B, 0x49, 0x80, 0x25, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x06, 0x1B, 0x7F, 0x01, 0x12, 0x7B, 0x49, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF,
+0x60, 0x09, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x80, 0x05, 0x12, 0x4E, 0x56, 0x80, 0x03,
+0x12, 0x66, 0x20, 0x7F, 0x01, 0x80, 0x4D, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27,
+0xF0, 0x7D, 0x03, 0x7F, 0x02, 0x12, 0x36, 0x92, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x02, 0x80,
+0x1B, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05,
+0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F, 0x01, 0x12, 0x7B, 0x49, 0x12, 0x66, 0x13, 0x12,
+0x4A, 0xFC, 0x7F, 0x03, 0xD1, 0xAB, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAD, 0x07, 0xEF, 0x64, 0x01,
+0x60, 0x04, 0xEF, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0,
+0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xED, 0x64, 0x02, 0x60, 0x04,
+0xED, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x2C, 0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3,
+0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x38,
+0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xFD, 0xE0, 0x90, 0x8A, 0xE8,
+0xF0, 0x90, 0x8A, 0xFE, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xE9, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0,
+0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0xFF, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34,
+0x8B, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0xEB, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0xE0, 0xB4, 0x04, 0xDA, 0x90, 0x8A, 0xE8, 0xE0, 0x12,
+0x43, 0x94, 0x77, 0x61, 0x00, 0x78, 0xD7, 0x01, 0x77, 0x6C, 0x02, 0x77, 0x6C, 0x03, 0x77, 0x6C,
+0x04, 0x78, 0xD7, 0x05, 0x78, 0xA1, 0x80, 0x78, 0xBA, 0x81, 0x78, 0xD7, 0x82, 0x00, 0x00, 0x78,
+0xD3, 0x90, 0x8A, 0xEE, 0xE0, 0xFF, 0x12, 0x7E, 0x6E, 0x02, 0x78, 0xD7, 0x90, 0x8A, 0xE8, 0xE0,
+0xFF, 0xB4, 0x02, 0x08, 0x90, 0x8A, 0xE5, 0x74, 0x01, 0xF0, 0x80, 0x0F, 0xEF, 0x90, 0x8A, 0xE5,
+0xB4, 0x03, 0x05, 0x74, 0x02, 0xF0, 0x80, 0x03, 0x74, 0x04, 0xF0, 0xC3, 0x90, 0x8A, 0xE9, 0xE0,
+0x94, 0x08, 0x50, 0x79, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE5, 0xE0, 0xFF, 0x90, 0x8A,
+0xE4, 0xE0, 0xC3, 0x9F, 0x40, 0x03, 0x02, 0x78, 0xD7, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0,
+0xFF, 0xC3, 0xEE, 0x94, 0x01, 0x90, 0x8A, 0xE4, 0xE0, 0x50, 0x1F, 0xFE, 0x2F, 0xFF, 0xEE, 0xFD,
+0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A,
+0x3C, 0xF5, 0x83, 0xE0, 0xFD, 0x12, 0x51, 0xFB, 0x80, 0x2B, 0xFF, 0xFD, 0xC3, 0x74, 0x03, 0x9D,
+0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A, 0x3C, 0xF5, 0x83, 0xE0,
+0xFE, 0xEF, 0xFD, 0x90, 0x8A, 0xEA, 0xE0, 0x2D, 0xFD, 0x90, 0x8A, 0xE9, 0xE0, 0x34, 0x00, 0x8D,
+0x82, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0x80, 0x8C, 0xC3, 0x90, 0x8A,
+0xE9, 0xE0, 0x94, 0x10, 0x40, 0x02, 0x01, 0xD7, 0x90, 0x8A, 0xE8, 0xE0, 0x64, 0x04, 0x60, 0x02,
+0x01, 0xD7, 0x90, 0x8A, 0xEC, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x10, 0x12, 0x2A, 0x6C,
+0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xEB, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD,
+0xFE, 0x78, 0x18, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0x12, 0x43,
+0x46, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xED, 0xE0, 0xFF, 0xE4, 0xFC,
+0xFD, 0xFE, 0x78, 0x08, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0x12,
+0x43, 0x46, 0xA8, 0x04, 0xA9, 0x05, 0xAA, 0x06, 0xAB, 0x07, 0xA3, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD,
+0xFE, 0x12, 0x43, 0x46, 0xA3, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xEF, 0x12, 0x43, 0x53, 0x90, 0x80,
+0x85, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x12, 0x2F, 0xD9, 0x80,
+0x36, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A,
+0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x37, 0x54, 0x80, 0x1D, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3,
+0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x36,
+0xCB, 0x80, 0x04, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xA3, 0x74, 0x04, 0xF0, 0xA3, 0xE4,
+0xF0, 0x90, 0x8A, 0xE2, 0xF0, 0xA3, 0xF0, 0x90, 0x02, 0x09, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x12,
+0x29, 0xD9, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0x2F, 0x90, 0x8A, 0xE0, 0xF0, 0x30, 0xE0, 0x0B, 0x90,
+0x8A, 0xDB, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xDB, 0xF0, 0xA3,
+0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x24,
+0x20, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFC, 0x2D, 0xFF, 0x24, 0x01, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xFD, 0xF0, 0x74, 0x02, 0x2F, 0xF5, 0x82,
+0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFE, 0xEC, 0x2D, 0x24, 0x03, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0x90, 0x8A, 0xFE, 0xF0, 0xA3, 0xEF, 0xF0, 0x90,
+0x8A, 0xDA, 0x74, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFF, 0xA3, 0xE0, 0x2F, 0xFF, 0x90,
+0x8A, 0xDA, 0xE0, 0xFE, 0x2F, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFF,
+0x74, 0xFC, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xDA, 0xE0,
+0x04, 0xF0, 0xE0, 0xB4, 0x08, 0xCF, 0x12, 0x76, 0xF2, 0xEF, 0x70, 0x45, 0x90, 0x01, 0xC3, 0xE0,
+0x60, 0x2B, 0xC3, 0x90, 0x8A, 0xE3, 0xE0, 0x94, 0xE8, 0x90, 0x8A, 0xE2, 0xE0, 0x94, 0x03, 0x40,
+0x09, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x80, 0x79, 0x90, 0x8A, 0xE2, 0xE4, 0x75, 0xF0,
+0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x80, 0xCF, 0x90, 0x01, 0xC6,
+0xE0, 0x90, 0x01, 0xC3, 0x30, 0xE2, 0x05, 0x74, 0xFE, 0xF0, 0x80, 0x57, 0x74, 0xFF, 0xF0, 0x80,
+0x52, 0x90, 0x8A, 0xDD, 0xE0, 0xB4, 0x78, 0x2E, 0xE4, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0,
+0x90, 0x8A, 0xDB, 0xE0, 0x70, 0x04, 0xA3, 0xE0, 0x64, 0x80, 0x90, 0x8A, 0xDB, 0x70, 0x05, 0xF0,
+0xA3, 0xF0, 0x80, 0x06, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13,
+0x90, 0xFD, 0x10, 0xF0, 0x80, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x24, 0x08, 0xF0, 0x90, 0x8A, 0xDE,
+0x74, 0xFF, 0xF5, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDE, 0xE0, 0x70, 0x02, 0xA3, 0xE0, 0x60,
+0x02, 0x21, 0x32, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x05, 0xF0, 0x90,
+0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x06, 0xF0, 0x22, 0xE4, 0xF5, 0x61, 0x22, 0x51, 0x67,
+0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x7F, 0x78, 0x7E,
+0x08, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x1C, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x27,
+0xDE, 0x90, 0x8B, 0x20, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x27, 0xDE, 0x90, 0x8B,
+0x24, 0x12, 0x2A, 0x7F, 0x90, 0x8B, 0x09, 0xE0, 0x90, 0x8B, 0x1C, 0xB4, 0x01, 0x0D, 0x12, 0x43,
+0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xED, 0x54, 0xC7, 0xFD, 0x80, 0x07, 0x12, 0x43, 0x53, 0xEF, 0x54,
+0xC7, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2F, 0xD9,
+0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0xEF, 0x54, 0x0F, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A,
+0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0xEF, 0x44,
+0x02, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x2F, 0xD9,
+0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x28, 0x12, 0x2A, 0x7F, 0x90, 0x80, 0x85,
+0x12, 0x2A, 0x8B, 0x00, 0x1B, 0x25, 0xA0, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F, 0xD9, 0x90, 0x80,
+0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0xE4, 0xFD, 0xFF, 0x12, 0x34, 0x81, 0x90, 0x8B,
+0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0xE4,
+0xFD, 0x7F, 0x01, 0x12, 0x34, 0x81, 0x22, 0x51, 0x6D, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22,
+0x51, 0x67, 0x90, 0x8B, 0x2D, 0x74, 0x04, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0x6F, 0x70, 0x02, 0xA1, 0x15, 0xEF, 0x12, 0x43, 0x94, 0x7B, 0x77,
+0x00, 0x7B, 0xB1, 0x01, 0x7B, 0xF7, 0x02, 0x7C, 0x31, 0x03, 0x7C, 0x69, 0x04, 0x7C, 0xA2, 0x05,
+0x7C, 0xDD, 0x06, 0x00, 0x00, 0x7D, 0x15, 0xEE, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0xB4, 0x05, 0x04, 0xB1, 0x24, 0xA1, 0x15, 0xEF, 0xB4, 0x06,
+0x06, 0x7F, 0x01, 0xB1, 0x39, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0x7F, 0x01,
+0xB1, 0x1A, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xB1, 0x2E, 0xB1, 0x6B, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xB1, 0x61, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xB1, 0x39, 0xA1, 0x15, 0xEE,
+0xB4, 0x03, 0x06, 0x7F, 0x01, 0xB1, 0x1A, 0xA1, 0x15, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x02, 0x60,
+0x02, 0xA1, 0x15, 0xB1, 0x2E, 0xA1, 0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01,
+0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x04, 0xB1, 0x61, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F,
+0x01, 0xB1, 0x39, 0x80, 0x08, 0xEE, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0xB1, 0x1A, 0xB1, 0x8D, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xB1, 0x61, 0x80,
+0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xB1, 0x39, 0x80, 0x06, 0xEE,
+0xB4, 0x02, 0x02, 0xB1, 0x2E, 0xB1, 0x76, 0xA1, 0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06,
+0x06, 0xE4, 0xFF, 0xB1, 0x39, 0x80, 0x13, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xB1, 0x1A, 0x80,
+0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xB1, 0x2E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01,
+0x04, 0xB1, 0x6B, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x71, 0x40,
+0x80, 0x73, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xB1, 0x39, 0x80, 0x13,
+0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xB1, 0x1A, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xB1, 0x2E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0xB1, 0x6B, 0x80, 0x0B, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x04, 0x04, 0x7F, 0x01, 0xB1, 0x48, 0xB1, 0x80, 0x80, 0x38, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05,
+0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xB1, 0x61, 0x80, 0x16, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x06, 0xE4, 0xFF, 0xB1, 0x1A, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xB1, 0x2E, 0xB1, 0x9A, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x4A, 0xB2, 0x90, 0x8B, 0x2D,
+0x74, 0x01, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x90, 0x05,
+0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x04, 0xF0, 0x22, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4,
+0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x90, 0x8B, 0x56, 0xEF, 0xF0, 0x12, 0x4F, 0xED,
+0x90, 0x8B, 0x56, 0xE0, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x2D, 0xF0,
+0x22, 0x12, 0x4A, 0xCC, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x7F, 0x01, 0x12, 0x4A, 0x7C,
+0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12, 0x4A, 0x32, 0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x22,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x05, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x2D, 0x74, 0x06, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33,
+0x74, 0x04, 0xF0, 0x22, 0x12, 0x4F, 0xED, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90, 0x01,
+0x57, 0xE0, 0x60, 0x3C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90,
+0x8B, 0x1B, 0xE0, 0x60, 0x07, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0x80, 0x24, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8B, 0x10, 0xE0, 0xFF, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F,
+0x40, 0x0E, 0xE5, 0x21, 0xB4, 0x01, 0x09, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x03, 0xE0, 0x04, 0xF0,
+0x90, 0x01, 0x5B, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04,
+0xF0, 0xE4, 0x90, 0x8B, 0x18, 0xF0, 0x90, 0x01, 0x5F, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5F, 0xE4,
+0xF0, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x17, 0xF0, 0x22, 0xE4, 0x90, 0x8B,
+0x4F, 0xF0, 0xA3, 0xF0, 0x90, 0x05, 0xF8, 0xE0, 0x70, 0x0F, 0xA3, 0xE0, 0x70, 0x0B, 0xA3, 0xE0,
+0x70, 0x07, 0xA3, 0xE0, 0x70, 0x03, 0x7F, 0x01, 0x22, 0xD3, 0x90, 0x8B, 0x50, 0xE0, 0x94, 0xE8,
+0x90, 0x8B, 0x4F, 0xE0, 0x94, 0x03, 0x40, 0x03, 0x7F, 0x00, 0x22, 0x7F, 0x32, 0x7E, 0x00, 0x12,
+0x37, 0x54, 0x90, 0x8B, 0x4F, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x80, 0xC6, 0x8F, 0x0F,
+0xE4, 0x90, 0x8A, 0xF3, 0xF0, 0xE5, 0x0F, 0x14, 0xFE, 0x90, 0x8A, 0xF3, 0xE0, 0xFF, 0xC3, 0x9E,
+0x50, 0x0E, 0xEF, 0x04, 0xFD, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE5,
+0xE5, 0x0F, 0x14, 0xFF, 0x7D, 0xFF, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE5, 0x0F, 0xF0, 0x90,
+0x8A, 0xF3, 0xE0, 0xC3, 0x94, 0xFF, 0x50, 0x0F, 0xE0, 0xFF, 0x04, 0xFD, 0x12, 0x34, 0xB7, 0x90,
+0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE8, 0xAD, 0x0F, 0x7F, 0xFF, 0x02, 0x34, 0xB7, 0xDC, 0xD3,
+};
+#endif
+
+//8188C_Formal_All_PHYforMP_111117	2011-11-23
+//8192C_Formal_92CU_PHYforMP_110817 	2011-11-23
+
+u32 Rtl8192CUPHY_REG_2TArray[PHY_REG_2TArrayLength] = {
+0x024,0x0011800f,
+0x028,0x00ffdb83,
+0x800,0x80040002,
+0x804,0x00000003,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x01000100,
+0x82c,0x00390004,
+0x830,0x27272727,
+0x834,0x27272727,
+0x838,0x27272727,
+0x83c,0x27272727,
+0x840,0x00010000,
+0x844,0x00010000,
+0x848,0x27272727,
+0x84c,0x27272727,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x0c1b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x27272727,
+0x86c,0x2b2b2b27,
+0x870,0x07000700,
+0x874,0x22184000,
+0x878,0x08080808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xcc0000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121313,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05633,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x2186115b,
+0xc78,0x0000001f,
+0xc7c,0x00b99612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0xa0e40000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00080740,
+0xd04,0x00020403,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000010,
+0xe68,0x001b25a4,
+0xe6c,0x63db25a4,
+0xe70,0x63db25a4,
+0xe74,0x0c1b25a4,
+0xe78,0x0c1b25a4,
+0xe7c,0x0c1b25a4,
+0xe80,0x0c1b25a4,
+0xe84,0x63db25a4,
+0xe88,0x0c1b25a4,
+0xe8c,0x63db25a4,
+0xed0,0x63db25a4,
+0xed4,0x63db25a4,
+0xed8,0x63db25a4,
+0xedc,0x001b25a4,
+0xee0,0x001b25a4,
+0xeec,0x6fdb25a4,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_1TArray[PHY_REG_1TArrayLength] = {
+0x024,0x0011800f,
+0x028,0x00ffdb83,
+0x800,0x80040000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x00000000,
+0x82c,0x00000000,
+0x830,0x00000000,
+0x834,0x00000000,
+0x838,0x00000000,
+0x83c,0x00000000,
+0x840,0x00010000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x001b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x00000000,
+0x86c,0x32323200,
+0x870,0x07000700,
+0x874,0x22004000,
+0x878,0x00000808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xccc000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121111,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05611,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x018610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0x20200000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00000740,
+0xd04,0x00020401,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000008,
+0xe68,0x001b25a4,
+0xe6c,0x631b25a0,
+0xe70,0x631b25a0,
+0xe74,0x081b25a0,
+0xe78,0x081b25a0,
+0xe7c,0x081b25a0,
+0xe80,0x081b25a0,
+0xe84,0x631b25a0,
+0xe88,0x081b25a0,
+0xe8c,0x631b25a0,
+0xed0,0x631b25a0,
+0xed4,0x631b25a0,
+0xed8,0x631b25a0,
+0xedc,0x001b25a0,
+0xee0,0x001b25a0,
+0xeec,0x6b1b25a0,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_ChangeTo_1T1RArray[PHY_ChangeTo_1T1RArrayLength] = {
+0x0, };
+
+u32 Rtl8192CUPHY_ChangeTo_1T2RArray[PHY_ChangeTo_1T2RArrayLength] = {
+0x0, };
+
+u32 Rtl8192CUPHY_ChangeTo_2T2RArray[PHY_ChangeTo_2T2RArrayLength] = {
+0x0, };
+
+u32 Rtl8192CUPHY_REG_Array_PG[PHY_REG_Array_PGLength] = {
+0xe00,0xffffffff,0x07090c0c,
+0xe04,0xffffffff,0x01020405,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x0b0c0c0e,
+0xe14,0xffffffff,0x01030506,
+0xe18,0xffffffff,0x0b0c0d0e,
+0xe1c,0xffffffff,0x01030509,
+0x830,0xffffffff,0x07090c0c,
+0x834,0xffffffff,0x01020405,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x0b0c0d0e,
+0x848,0xffffffff,0x01030509,
+0x84c,0xffffffff,0x0b0c0d0e,
+0x868,0xffffffff,0x01030509,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x06060606,
+0xe14,0xffffffff,0x00020406,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x06060606,
+0x848,0xffffffff,0x00020406,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+};
+
+u32  Rtl8192CUPHY_REG_Array_PG_mCard[PHY_REG_Array_PG_mCardLength] = {
+0xe00,0xffffffff,0x0a0c0c0c,
+0xe04,0xffffffff,0x02040608,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x0a0c0d0e,
+0xe14,0xffffffff,0x02040608,
+0xe18,0xffffffff,0x0a0c0d0e,
+0xe1c,0xffffffff,0x02040608,
+0x830,0xffffffff,0x0a0c0c0c,
+0x834,0xffffffff,0x02040608,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x0a0c0d0e,
+0x848,0xffffffff,0x02040608,
+0x84c,0xffffffff,0x0a0c0d0e,
+0x868,0xffffffff,0x02040608,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x06060606,
+0xe14,0xffffffff,0x00020406,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x06060606,
+0x848,0xffffffff,0x00020406,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+};
+
+u32 Rtl8192CUPHY_REG_Array_MP[PHY_REG_Array_MPLength] = {
+0xc30,0x69e9ac4a,
+0xc3c,0x0a979718,
+};
+
+u32 Rtl8192CUPHY_REG_1T_HPArray[PHY_REG_1T_HPArrayLength] = {
+0x024,0x0011800f,
+0x028,0x00ffdb83,
+0x040,0x000c0004,
+0x800,0x80040000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390204,
+0x828,0x00000000,
+0x82c,0x00000000,
+0x830,0x00000000,
+0x834,0x00000000,
+0x838,0x00000000,
+0x83c,0x00000000,
+0x840,0x00010000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x001b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x00000000,
+0x86c,0x20202000,
+0x870,0x03000300,
+0x874,0x22004000,
+0x878,0x00000808,
+0x87c,0x00ffc3f1,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xccc000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121111,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x15160000,
+0xa24,0x070b0f12,
+0xa28,0x00000104,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05611,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x6954342e,
+0xc54,0x43bc0094,
+0xc58,0x6954342f,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c46000d,
+0xc74,0x018610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x24000090,
+0xc84,0x20f60000,
+0xc88,0x24000090,
+0xc8c,0x20200000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00000740,
+0xd04,0x00020401,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x24242424,
+0xe04,0x24242424,
+0xe08,0x03902024,
+0xe10,0x24242424,
+0xe14,0x24242424,
+0xe18,0x24242424,
+0xe1c,0x24242424,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000008,
+0xe68,0x001b25a4,
+0xe6c,0x631b25a0,
+0xe70,0x631b25a0,
+0xe74,0x081b25a0,
+0xe78,0x081b25a0,
+0xe7c,0x081b25a0,
+0xe80,0x081b25a0,
+0xe84,0x631b25a0,
+0xe88,0x081b25a0,
+0xe8c,0x631b25a0,
+0xed0,0x631b25a0,
+0xed4,0x631b25a0,
+0xed8,0x631b25a0,
+0xedc,0x001b25a0,
+0xee0,0x001b25a0,
+0xeec,0x6b1b25a0,
+0xee8,0x31555448,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_1T_mCardArray[PHY_REG_1T_mCardArrayLength] = {
+0x024,0x0011800d,
+0x028,0x00ffdb83,
+0x800,0x80040000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x00000000,
+0x82c,0x00000000,
+0x830,0x00000000,
+0x834,0x00000000,
+0x838,0x00000000,
+0x83c,0x00000000,
+0x840,0x00010000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x001b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x00000000,
+0x86c,0x32323200,
+0x870,0x07000700,
+0x874,0x22004000,
+0x878,0x00000808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xccc000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121111,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05611,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x018610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0x20200000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00000740,
+0xd04,0x00020401,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000008,
+0xe68,0x001b25a4,
+0xe6c,0x631b25a0,
+0xe70,0x631b25a0,
+0xe74,0x081b25a0,
+0xe78,0x081b25a0,
+0xe7c,0x081b25a0,
+0xe80,0x081b25a0,
+0xe84,0x631b25a0,
+0xe88,0x081b25a0,
+0xe8c,0x631b25a0,
+0xed0,0x631b25a0,
+0xed4,0x631b25a0,
+0xed8,0x631b25a0,
+0xedc,0x001b25a0,
+0xee0,0x001b25a0,
+0xeec,0x6b1b25a0,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_2T_mCardArray[PHY_REG_2T_mCardArrayLength] = {
+0x024,0x0011800d,
+0x028,0x00ffdb83,
+0x800,0x80040002,
+0x804,0x00000003,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x01000100,
+0x82c,0x00390004,
+0x830,0x27272727,
+0x834,0x27272727,
+0x838,0x27272727,
+0x83c,0x27272727,
+0x840,0x00010000,
+0x844,0x00010000,
+0x848,0x27272727,
+0x84c,0x27272727,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x0c1b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x27272727,
+0x86c,0x2b2b2b27,
+0x870,0x07000700,
+0x874,0x22184000,
+0x878,0x08080808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xcc0000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121313,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05633,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x218610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0xa0e40000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00080740,
+0xd04,0x00020403,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000010,
+0xe68,0x001b25a4,
+0xe6c,0x63db25a4,
+0xe70,0x63db25a4,
+0xe74,0x0c1b25a4,
+0xe78,0x0c1b25a4,
+0xe7c,0x0c1b25a4,
+0xe80,0x0c1b25a4,
+0xe84,0x63db25a4,
+0xe88,0x0c1b25a4,
+0xe8c,0x63db25a4,
+0xed0,0x63db25a4,
+0xed4,0x63db25a4,
+0xed8,0x63db25a4,
+0xedc,0x001b25a4,
+0xee0,0x001b25a4,
+0xeec,0x6fdb25a4,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_Array_PG_HP[PHY_REG_Array_PG_HPLength] = {
+0xe00,0xffffffff,0x06080808,
+0xe04,0xffffffff,0x00040406,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x04060608,
+0xe14,0xffffffff,0x00020204,
+0xe18,0xffffffff,0x04060608,
+0xe1c,0xffffffff,0x00020204,
+0x830,0xffffffff,0x06080808,
+0x834,0xffffffff,0x00040406,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x04060608,
+0x848,0xffffffff,0x00020204,
+0x84c,0xffffffff,0x04060608,
+0x868,0xffffffff,0x00020204,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+};
+
+u32 Rtl8192CURadioA_2TArray[RadioA_2TArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_2TArray[RadioB_2TArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287af,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x00014297,
+0x013,0x00010295,
+0x013,0x0000c298,
+0x013,0x0000819c,
+0x013,0x000040a8,
+0x013,0x0000001c,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+};
+
+u32 Rtl8192CURadioA_1TArray[RadioA_1TArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f405,
+0x015,0x0004f405,
+0x015,0x0008f405,
+0x015,0x000cf405,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_1TArray[RadioB_1TArrayLength] = {
+0x0, };
+
+
+u32 Rtl8192CURadioA_2T_mCardArray[RadioA_2T_mCardArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_2T_mCardArray[RadioB_2T_mCardArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287af,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x00014297,
+0x013,0x00010295,
+0x013,0x0000c298,
+0x013,0x0000819c,
+0x013,0x000040a8,
+0x013,0x0000001c,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+};
+
+u32 Rtl8192CURadioA_1T_mCardArray[RadioA_1T_mCardArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f200,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_1T_mCardArray[RadioB_1T_mCardArrayLength] = {
+0x0, };
+
+u32 Rtl8192CURadioA_1T_HPArray[RadioA_1T_HPArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb0,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e529,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00000255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x0000083c,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000977c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x000d8000,
+0x012,0x00090000,
+0x012,0x00051000,
+0x012,0x00012000,
+0x013,0x00028fb4,
+0x013,0x00024fa8,
+0x013,0x000207a4,
+0x013,0x0001c3b0,
+0x013,0x000183a4,
+0x013,0x00014398,
+0x013,0x000101a4,
+0x013,0x0000c198,
+0x013,0x000080a4,
+0x013,0x00004098,
+0x013,0x00000000,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f405,
+0x015,0x0004f405,
+0x015,0x0008f405,
+0x015,0x000cf405,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_GM_Array[RadioB_GM_ArrayLength] = {
+0x0, };
+
+// MAC reg V14 - 2011-11-23
+u32 Rtl8192CUMAC_2T_Array[MAC_2T_ArrayLength] = {
+0x420,0x00000080,
+0x423,0x00000000,
+0x430,0x00000000,
+0x431,0x00000000,
+0x432,0x00000000,
+0x433,0x00000001,
+0x434,0x00000004,
+0x435,0x00000005,
+0x436,0x00000006,
+0x437,0x00000007,
+0x438,0x00000000,
+0x439,0x00000000,
+0x43a,0x00000000,
+0x43b,0x00000001,
+0x43c,0x00000004,
+0x43d,0x00000005,
+0x43e,0x00000006,
+0x43f,0x00000007,
+0x440,0x0000005d,
+0x441,0x00000001,
+0x442,0x00000000,
+0x444,0x00000015,
+0x445,0x000000f0,
+0x446,0x0000000f,
+0x447,0x00000000,
+0x458,0x00000041,
+0x459,0x000000a8,
+0x45a,0x00000072,
+0x45b,0x000000b9,
+0x460,0x00000066,
+0x461,0x00000066,
+0x462,0x00000008,
+0x463,0x00000003,
+0x4c8,0x000000ff,
+0x4c9,0x00000008,
+0x4cc,0x000000ff,
+0x4cd,0x000000ff,
+0x4ce,0x00000001,
+0x500,0x00000026,
+0x501,0x000000a2,
+0x502,0x0000002f,
+0x503,0x00000000,
+0x504,0x00000028,
+0x505,0x000000a3,
+0x506,0x0000005e,
+0x507,0x00000000,
+0x508,0x0000002b,
+0x509,0x000000a4,
+0x50a,0x0000005e,
+0x50b,0x00000000,
+0x50c,0x0000004f,
+0x50d,0x000000a4,
+0x50e,0x00000000,
+0x50f,0x00000000,
+0x512,0x0000001c,
+0x514,0x0000000a,
+0x515,0x00000010,
+0x516,0x0000000a,
+0x517,0x00000010,
+0x51a,0x00000016,
+0x524,0x0000000f,
+0x525,0x0000004f,
+0x546,0x00000040,
+0x547,0x00000000,
+0x550,0x00000010,
+0x551,0x00000010,
+0x559,0x00000002,
+0x55a,0x00000002,
+0x55d,0x000000ff,
+0x605,0x00000030,
+0x608,0x0000000e,
+0x609,0x0000002a,
+0x652,0x00000020,
+0x652,0x00000020,
+0x63c,0x00000008,
+0x63d,0x00000008,
+0x63e,0x0000000c,
+0x63f,0x0000000c,
+0x66e,0x00000005,
+0x700,0x00000021,
+0x701,0x00000043,
+0x702,0x00000065,
+0x703,0x00000087,
+0x708,0x00000021,
+0x709,0x00000043,
+0x70a,0x00000065,
+0x70b,0x00000087,
+};
+
+u32 Rtl8192CUMACPHY_Array_PG[MACPHY_Array_PGLength] = {
+0x0, };
+
+u32 Rtl8192CUAGCTAB_2TArray[AGCTAB_2TArrayLength] = {
+0xc78,0x7b000001,
+0xc78,0x7b010001,
+0xc78,0x7b020001,
+0xc78,0x7b030001,
+0xc78,0x7b040001,
+0xc78,0x7b050001,
+0xc78,0x7a060001,
+0xc78,0x79070001,
+0xc78,0x78080001,
+0xc78,0x77090001,
+0xc78,0x760a0001,
+0xc78,0x750b0001,
+0xc78,0x740c0001,
+0xc78,0x730d0001,
+0xc78,0x720e0001,
+0xc78,0x710f0001,
+0xc78,0x70100001,
+0xc78,0x6f110001,
+0xc78,0x6e120001,
+0xc78,0x6d130001,
+0xc78,0x6c140001,
+0xc78,0x6b150001,
+0xc78,0x6a160001,
+0xc78,0x69170001,
+0xc78,0x68180001,
+0xc78,0x67190001,
+0xc78,0x661a0001,
+0xc78,0x651b0001,
+0xc78,0x641c0001,
+0xc78,0x631d0001,
+0xc78,0x621e0001,
+0xc78,0x611f0001,
+0xc78,0x60200001,
+0xc78,0x49210001,
+0xc78,0x48220001,
+0xc78,0x47230001,
+0xc78,0x46240001,
+0xc78,0x45250001,
+0xc78,0x44260001,
+0xc78,0x43270001,
+0xc78,0x42280001,
+0xc78,0x41290001,
+0xc78,0x402a0001,
+0xc78,0x262b0001,
+0xc78,0x252c0001,
+0xc78,0x242d0001,
+0xc78,0x232e0001,
+0xc78,0x222f0001,
+0xc78,0x21300001,
+0xc78,0x20310001,
+0xc78,0x06320001,
+0xc78,0x05330001,
+0xc78,0x04340001,
+0xc78,0x03350001,
+0xc78,0x02360001,
+0xc78,0x01370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7b400001,
+0xc78,0x7b410001,
+0xc78,0x7b420001,
+0xc78,0x7b430001,
+0xc78,0x7b440001,
+0xc78,0x7b450001,
+0xc78,0x7a460001,
+0xc78,0x79470001,
+0xc78,0x78480001,
+0xc78,0x77490001,
+0xc78,0x764a0001,
+0xc78,0x754b0001,
+0xc78,0x744c0001,
+0xc78,0x734d0001,
+0xc78,0x724e0001,
+0xc78,0x714f0001,
+0xc78,0x70500001,
+0xc78,0x6f510001,
+0xc78,0x6e520001,
+0xc78,0x6d530001,
+0xc78,0x6c540001,
+0xc78,0x6b550001,
+0xc78,0x6a560001,
+0xc78,0x69570001,
+0xc78,0x68580001,
+0xc78,0x67590001,
+0xc78,0x665a0001,
+0xc78,0x655b0001,
+0xc78,0x645c0001,
+0xc78,0x635d0001,
+0xc78,0x625e0001,
+0xc78,0x615f0001,
+0xc78,0x60600001,
+0xc78,0x49610001,
+0xc78,0x48620001,
+0xc78,0x47630001,
+0xc78,0x46640001,
+0xc78,0x45650001,
+0xc78,0x44660001,
+0xc78,0x43670001,
+0xc78,0x42680001,
+0xc78,0x41690001,
+0xc78,0x406a0001,
+0xc78,0x266b0001,
+0xc78,0x256c0001,
+0xc78,0x246d0001,
+0xc78,0x236e0001,
+0xc78,0x226f0001,
+0xc78,0x21700001,
+0xc78,0x20710001,
+0xc78,0x06720001,
+0xc78,0x05730001,
+0xc78,0x04740001,
+0xc78,0x03750001,
+0xc78,0x02760001,
+0xc78,0x01770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x3800001e,
+0xc78,0x3801001e,
+0xc78,0x3802001e,
+0xc78,0x3803001e,
+0xc78,0x3804001e,
+0xc78,0x3805001e,
+0xc78,0x3806001e,
+0xc78,0x3807001e,
+0xc78,0x3808001e,
+0xc78,0x3c09001e,
+0xc78,0x3e0a001e,
+0xc78,0x400b001e,
+0xc78,0x440c001e,
+0xc78,0x480d001e,
+0xc78,0x4c0e001e,
+0xc78,0x500f001e,
+0xc78,0x5210001e,
+0xc78,0x5611001e,
+0xc78,0x5a12001e,
+0xc78,0x5e13001e,
+0xc78,0x6014001e,
+0xc78,0x6015001e,
+0xc78,0x6016001e,
+0xc78,0x6217001e,
+0xc78,0x6218001e,
+0xc78,0x6219001e,
+0xc78,0x621a001e,
+0xc78,0x621b001e,
+0xc78,0x621c001e,
+0xc78,0x621d001e,
+0xc78,0x621e001e,
+0xc78,0x621f001e,
+};
+
+u32 Rtl8192CUAGCTAB_1TArray[AGCTAB_1TArrayLength] = {
+0xc78,0x7b000001,
+0xc78,0x7b010001,
+0xc78,0x7b020001,
+0xc78,0x7b030001,
+0xc78,0x7b040001,
+0xc78,0x7b050001,
+0xc78,0x7a060001,
+0xc78,0x79070001,
+0xc78,0x78080001,
+0xc78,0x77090001,
+0xc78,0x760a0001,
+0xc78,0x750b0001,
+0xc78,0x740c0001,
+0xc78,0x730d0001,
+0xc78,0x720e0001,
+0xc78,0x710f0001,
+0xc78,0x70100001,
+0xc78,0x6f110001,
+0xc78,0x6e120001,
+0xc78,0x6d130001,
+0xc78,0x6c140001,
+0xc78,0x6b150001,
+0xc78,0x6a160001,
+0xc78,0x69170001,
+0xc78,0x68180001,
+0xc78,0x67190001,
+0xc78,0x661a0001,
+0xc78,0x651b0001,
+0xc78,0x641c0001,
+0xc78,0x631d0001,
+0xc78,0x621e0001,
+0xc78,0x611f0001,
+0xc78,0x60200001,
+0xc78,0x49210001,
+0xc78,0x48220001,
+0xc78,0x47230001,
+0xc78,0x46240001,
+0xc78,0x45250001,
+0xc78,0x44260001,
+0xc78,0x43270001,
+0xc78,0x42280001,
+0xc78,0x41290001,
+0xc78,0x402a0001,
+0xc78,0x262b0001,
+0xc78,0x252c0001,
+0xc78,0x242d0001,
+0xc78,0x232e0001,
+0xc78,0x222f0001,
+0xc78,0x21300001,
+0xc78,0x20310001,
+0xc78,0x06320001,
+0xc78,0x05330001,
+0xc78,0x04340001,
+0xc78,0x03350001,
+0xc78,0x02360001,
+0xc78,0x01370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7b400001,
+0xc78,0x7b410001,
+0xc78,0x7b420001,
+0xc78,0x7b430001,
+0xc78,0x7b440001,
+0xc78,0x7b450001,
+0xc78,0x7a460001,
+0xc78,0x79470001,
+0xc78,0x78480001,
+0xc78,0x77490001,
+0xc78,0x764a0001,
+0xc78,0x754b0001,
+0xc78,0x744c0001,
+0xc78,0x734d0001,
+0xc78,0x724e0001,
+0xc78,0x714f0001,
+0xc78,0x70500001,
+0xc78,0x6f510001,
+0xc78,0x6e520001,
+0xc78,0x6d530001,
+0xc78,0x6c540001,
+0xc78,0x6b550001,
+0xc78,0x6a560001,
+0xc78,0x69570001,
+0xc78,0x68580001,
+0xc78,0x67590001,
+0xc78,0x665a0001,
+0xc78,0x655b0001,
+0xc78,0x645c0001,
+0xc78,0x635d0001,
+0xc78,0x625e0001,
+0xc78,0x615f0001,
+0xc78,0x60600001,
+0xc78,0x49610001,
+0xc78,0x48620001,
+0xc78,0x47630001,
+0xc78,0x46640001,
+0xc78,0x45650001,
+0xc78,0x44660001,
+0xc78,0x43670001,
+0xc78,0x42680001,
+0xc78,0x41690001,
+0xc78,0x406a0001,
+0xc78,0x266b0001,
+0xc78,0x256c0001,
+0xc78,0x246d0001,
+0xc78,0x236e0001,
+0xc78,0x226f0001,
+0xc78,0x21700001,
+0xc78,0x20710001,
+0xc78,0x06720001,
+0xc78,0x05730001,
+0xc78,0x04740001,
+0xc78,0x03750001,
+0xc78,0x02760001,
+0xc78,0x01770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x3800001e,
+0xc78,0x3801001e,
+0xc78,0x3802001e,
+0xc78,0x3803001e,
+0xc78,0x3804001e,
+0xc78,0x3805001e,
+0xc78,0x3806001e,
+0xc78,0x3807001e,
+0xc78,0x3808001e,
+0xc78,0x3c09001e,
+0xc78,0x3e0a001e,
+0xc78,0x400b001e,
+0xc78,0x440c001e,
+0xc78,0x480d001e,
+0xc78,0x4c0e001e,
+0xc78,0x500f001e,
+0xc78,0x5210001e,
+0xc78,0x5611001e,
+0xc78,0x5a12001e,
+0xc78,0x5e13001e,
+0xc78,0x6014001e,
+0xc78,0x6015001e,
+0xc78,0x6016001e,
+0xc78,0x6217001e,
+0xc78,0x6218001e,
+0xc78,0x6219001e,
+0xc78,0x621a001e,
+0xc78,0x621b001e,
+0xc78,0x621c001e,
+0xc78,0x621d001e,
+0xc78,0x621e001e,
+0xc78,0x621f001e,
+};
+
+u32 Rtl8192CUAGCTAB_1T_HPArray[AGCTAB_1T_HPArrayLength] = {
+0xc78,0x7b000001,
+0xc78,0x7b010001,
+0xc78,0x7b020001,
+0xc78,0x7b030001,
+0xc78,0x7b040001,
+0xc78,0x7b050001,
+0xc78,0x7b060001,
+0xc78,0x7b070001,
+0xc78,0x7b080001,
+0xc78,0x7a090001,
+0xc78,0x790a0001,
+0xc78,0x780b0001,
+0xc78,0x770c0001,
+0xc78,0x760d0001,
+0xc78,0x750e0001,
+0xc78,0x740f0001,
+0xc78,0x73100001,
+0xc78,0x72110001,
+0xc78,0x71120001,
+0xc78,0x70130001,
+0xc78,0x6f140001,
+0xc78,0x6e150001,
+0xc78,0x6d160001,
+0xc78,0x6c170001,
+0xc78,0x6b180001,
+0xc78,0x6a190001,
+0xc78,0x691a0001,
+0xc78,0x681b0001,
+0xc78,0x671c0001,
+0xc78,0x661d0001,
+0xc78,0x651e0001,
+0xc78,0x641f0001,
+0xc78,0x63200001,
+0xc78,0x62210001,
+0xc78,0x61220001,
+0xc78,0x60230001,
+0xc78,0x46240001,
+0xc78,0x45250001,
+0xc78,0x44260001,
+0xc78,0x43270001,
+0xc78,0x42280001,
+0xc78,0x41290001,
+0xc78,0x402a0001,
+0xc78,0x262b0001,
+0xc78,0x252c0001,
+0xc78,0x242d0001,
+0xc78,0x232e0001,
+0xc78,0x222f0001,
+0xc78,0x21300001,
+0xc78,0x20310001,
+0xc78,0x06320001,
+0xc78,0x05330001,
+0xc78,0x04340001,
+0xc78,0x03350001,
+0xc78,0x02360001,
+0xc78,0x01370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7b400001,
+0xc78,0x7b410001,
+0xc78,0x7b420001,
+0xc78,0x7b430001,
+0xc78,0x7b440001,
+0xc78,0x7b450001,
+0xc78,0x7b460001,
+0xc78,0x7b470001,
+0xc78,0x7b480001,
+0xc78,0x7a490001,
+0xc78,0x794a0001,
+0xc78,0x784b0001,
+0xc78,0x774c0001,
+0xc78,0x764d0001,
+0xc78,0x754e0001,
+0xc78,0x744f0001,
+0xc78,0x73500001,
+0xc78,0x72510001,
+0xc78,0x71520001,
+0xc78,0x70530001,
+0xc78,0x6f540001,
+0xc78,0x6e550001,
+0xc78,0x6d560001,
+0xc78,0x6c570001,
+0xc78,0x6b580001,
+0xc78,0x6a590001,
+0xc78,0x695a0001,
+0xc78,0x685b0001,
+0xc78,0x675c0001,
+0xc78,0x665d0001,
+0xc78,0x655e0001,
+0xc78,0x645f0001,
+0xc78,0x63600001,
+0xc78,0x62610001,
+0xc78,0x61620001,
+0xc78,0x60630001,
+0xc78,0x46640001,
+0xc78,0x45650001,
+0xc78,0x44660001,
+0xc78,0x43670001,
+0xc78,0x42680001,
+0xc78,0x41690001,
+0xc78,0x406a0001,
+0xc78,0x266b0001,
+0xc78,0x256c0001,
+0xc78,0x246d0001,
+0xc78,0x236e0001,
+0xc78,0x226f0001,
+0xc78,0x21700001,
+0xc78,0x20710001,
+0xc78,0x06720001,
+0xc78,0x05730001,
+0xc78,0x04740001,
+0xc78,0x03750001,
+0xc78,0x02760001,
+0xc78,0x01770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x3800001e,
+0xc78,0x3801001e,
+0xc78,0x3802001e,
+0xc78,0x3803001e,
+0xc78,0x3804001e,
+0xc78,0x3805001e,
+0xc78,0x3806001e,
+0xc78,0x3807001e,
+0xc78,0x3808001e,
+0xc78,0x3c09001e,
+0xc78,0x3e0a001e,
+0xc78,0x400b001e,
+0xc78,0x440c001e,
+0xc78,0x480d001e,
+0xc78,0x4c0e001e,
+0xc78,0x500f001e,
+0xc78,0x5210001e,
+0xc78,0x5611001e,
+0xc78,0x5a12001e,
+0xc78,0x5e13001e,
+0xc78,0x6014001e,
+0xc78,0x6015001e,
+0xc78,0x6016001e,
+0xc78,0x6217001e,
+0xc78,0x6218001e,
+0xc78,0x6219001e,
+0xc78,0x621a001e,
+0xc78,0x621b001e,
+0xc78,0x621c001e,
+0xc78,0x621d001e,
+0xc78,0x621e001e,
+0xc78,0x621f001e,
+};
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c
new file mode 100755
index 0000000000000..66970f1c07998
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c
@@ -0,0 +1,2564 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*Created on  2011/11/ 8, 14:15*/
+
+#include <basic_types.h>
+#include "Hal8192CUHWImg_wowlan.h"
+
+
+u8 Rtl8192CUFwTSMCWWImgArray[TSMCWWImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x51,0x00,0x00,0x00,0x03,0x23,0x16,0x43,0x72,0x34,0x00,0x00,
+0x58,0x92,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0x9d,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0xcb,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5c,0xb6,0x00,0x00,0x00,0x00,0x00,0x02,0x5d,0x99,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,
+0x83,0x3a,0xf5,0x83,0xe0,0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,
+0x86,0xf0,0x08,0xe6,0x22,0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,
+0xe2,0x22,0xe5,0x83,0x2a,0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xf8,
+0xbb,0x01,0x11,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,
+0xf0,0xa3,0xf0,0x22,0x50,0x09,0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,
+0xfe,0x09,0xe9,0x25,0x82,0xc8,0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,
+0x4a,0xfe,0xed,0x49,0xfd,0xec,0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,
+0xfe,0xa3,0xe0,0xff,0x22,0xa4,0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,
+0x22,0xe0,0xfb,0xa3,0xe0,0xfa,0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,
+0xf9,0x25,0xf0,0xf0,0xe5,0x82,0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,
+0x22,0xeb,0xf0,0xa3,0xea,0xf0,0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,
+0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,
+0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,
+0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,
+0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0xb5,0xf0,
+0x06,0x74,0x03,0x93,0x68,0x60,0xe9,0xa3,0xa3,0xa3,0xa3,0x80,0xd8,0x02,0x43,0xdb,
+0x02,0x50,0x2a,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,
+0x08,0xdf,0xf4,0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,
+0xc4,0x54,0x0f,0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,
+0xe4,0x80,0x0b,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x20,0xe4,0x7e,
+0x01,0x93,0x60,0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,
+0xa3,0x60,0x01,0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,
+0xfa,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,
+0xf0,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,
+0x41,0x91,0x40,0x00,0x41,0x91,0x9c,0x00,0x41,0x91,0x23,0x80,0x41,0x91,0x24,0x80,
+0x41,0x91,0x9e,0x00,0x41,0x91,0x52,0x00,0x41,0x91,0x93,0x00,0x41,0x91,0x91,0x00,
+0x41,0x91,0x90,0x00,0x41,0x91,0x92,0x00,0x00,0xf0,0x90,0x91,0x30,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x65,0xeb,0xf0,0xa3,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,
+0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,
+0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x59,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,
+0x92,0x74,0x02,0xf0,0x90,0x91,0x36,0x14,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x0c,
+0x50,0x02,0xf1,0x23,0x22,0x90,0x02,0x84,0xef,0xf0,0xa3,0xee,0xf0,0xa3,0x74,0x05,
+0xf0,0x22,0x7d,0x01,0xaf,0x6f,0xe1,0x27,0xf1,0xe6,0xbf,0x01,0x10,0x90,0x91,0x42,
+0xe0,0xff,0xe4,0xfd,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x8f,0x82,
+0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x72,0x7f,0x60,0x7e,0x01,0x80,
+0xed,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x54,0xfe,0xf0,0x02,0x50,0xd6,0x22,0xe4,
+0xf5,0x75,0x22,0x02,0x5f,0xe2,0x02,0x5f,0xe9,0xef,0x8e,0xf0,0x71,0x70,0x45,0x26,
+0x00,0x40,0x45,0x4e,0x00,0x80,0x45,0x79,0x01,0x00,0x45,0x8d,0x02,0x00,0x45,0xa5,
+0x04,0x00,0x00,0x00,0x45,0xc2,0xed,0x54,0x3f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x00,0x7f,0x40,0xef,0x2d,0xff,0xee,0x3c,0xfe,0xef,0x78,0x06,0xce,0xc3,0x13,0xce,
+0x13,0xd8,0xf9,0x78,0x06,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0x80,0x26,0xed,0x54,
+0x7f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x00,0x7f,0x80,0xef,0x2d,0xff,0xee,0x3c,
+0xfe,0xef,0x78,0x07,0xce,0xc3,0x13,0xce,0x13,0xd8,0xf9,0x78,0x07,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xfd,0xac,0x06,0x80,0x49,0xed,0x70,0x04,0xfe,0xff,0x80,0x04,
+0x7e,0x01,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x7d,0x00,0xfc,0x80,0x35,0xec,0x54,0x01,
+0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x02,0x7f,0x00,0xef,0x2d,0xee,0x3c,0xc3,
+0x13,0x7d,0x00,0x80,0x1a,0xec,0x54,0x03,0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x04,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x13,0x13,0x54,0x3f,0x7d,0x00,0x25,0xe0,0x25,
+0xe0,0xfc,0xae,0x04,0xaf,0x05,0x22,0x90,0x91,0x09,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x06,0xa9,0xe0,0x90,0x91,0x08,0xf0,0xe0,0x54,0xc0,0x70,0x0a,0x53,0x71,
+0xfe,0x53,0x71,0xfd,0x91,0xc2,0x80,0x47,0x90,0x91,0x26,0xe0,0x60,0x41,0x90,0x91,
+0x38,0xe0,0x70,0x3b,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,
+0xde,0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0xec,0x44,0x02,0xfc,
+0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,
+0x91,0x08,0xe0,0x30,0xe6,0x13,0x43,0x71,0x01,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,
+0x04,0x91,0xc8,0x80,0x07,0x91,0x77,0x80,0x03,0x53,0x71,0xfe,0x90,0x91,0x08,0xe0,
+0x30,0xe7,0x16,0x43,0x71,0x02,0xe4,0x90,0x91,0x66,0x91,0x49,0x90,0x01,0x57,0x74,
+0x05,0xf0,0x90,0x91,0x3c,0x74,0x01,0xf0,0x22,0x53,0x71,0xfd,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x8b,0x60,0x8a,0x61,0x89,0x62,0x90,0x91,0x68,0x71,0x41,0xab,
+0x63,0xaa,0x64,0xa9,0x65,0x90,0x91,0x6b,0x71,0x41,0xaf,0x66,0x15,0x66,0xef,0x60,
+0x1b,0x90,0x91,0x6b,0xe4,0x75,0xf0,0x01,0x71,0x2a,0x12,0x29,0xd9,0xff,0x90,0x91,
+0x68,0xe4,0x75,0xf0,0x01,0x71,0x2a,0xef,0x51,0x4d,0x80,0xde,0xab,0x60,0xaa,0x61,
+0xa9,0x62,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x6e,0x71,0x41,0x90,0x91,0x9e,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x51,0x5f,
+0x7f,0xaf,0x7e,0x01,0x12,0x64,0x1c,0xef,0x60,0x44,0x90,0x91,0x6e,0x71,0x21,0x8b,
+0x63,0x8a,0x64,0x89,0x65,0x75,0x66,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0xd1,0x6d,
+0x90,0x91,0x71,0x71,0x21,0x8b,0x63,0x8a,0x64,0x89,0x65,0x90,0x91,0x6e,0x71,0x21,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x66,0x7b,0x01,0x7a,0x01,0x79,0xa2,0xd1,
+0x6d,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,
+0x92,0xaf,0x22,0x7d,0x01,0x7f,0x0c,0x90,0x91,0x95,0xed,0xf0,0x90,0x91,0x94,0xef,
+0xf0,0x54,0x0f,0xff,0xe5,0x6e,0x54,0x0f,0x6f,0x60,0x76,0x90,0x91,0x94,0xe0,0x30,
+0xe2,0x30,0xe5,0x6e,0x20,0xe2,0x05,0x7f,0x01,0x12,0x62,0x65,0xe5,0x6e,0x30,0xe3,
+0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,0x08,0x12,0x5a,0x3f,0xef,0x60,0x53,0x80,0x52,
+0xe5,0x6e,0x20,0xe3,0x4c,0x90,0x91,0x94,0xe0,0x30,0xe3,0x45,0xa3,0xe0,0xff,0x02,
+0x62,0x4a,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x0c,0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,
+0x08,0x12,0x5a,0x3f,0xef,0x60,0x2a,0xf1,0xb2,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x04,
+0x10,0x90,0x91,0x94,0xe0,0x20,0xe2,0x09,0x12,0x5b,0xb3,0xef,0x60,0x13,0x12,0x48,
+0xce,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x02,0x08,0x91,0xf1,0xef,0x60,0x03,0x12,0x63,
+0x56,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x04,0x7f,0x01,
+0xf1,0xc9,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x8f,0x67,0xf1,0xe6,0xbf,0x01,0x15,
+0x90,0x91,0x43,0x12,0x48,0x1e,0xad,0x07,0xac,0x06,0xaf,0x67,0x12,0x61,0xa3,0x90,
+0x04,0x1f,0x74,0x20,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,
+0x74,0xe6,0xf0,0x74,0x47,0xa3,0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,
+0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,
+0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xe0,0xff,
+0x7d,0x01,0x90,0x91,0x74,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,
+0x70,0x60,0x04,0xe4,0xff,0x11,0xb3,0x90,0x91,0x74,0xe0,0x30,0xe0,0x09,0x90,0x91,
+0x76,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,0x91,0x74,0xe0,0xff,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,0x91,0x75,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,
+0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,
+0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x91,0x76,0xa3,
+0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x91,0x76,0xe0,0xfe,0xa3,
+0xe0,0xff,0x22,0xef,0x60,0x0b,0x90,0x91,0x51,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,
+0x09,0x90,0x91,0x51,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x68,0x87,0x22,0x90,0x01,
+0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x68,0x46,0xef,0x70,0x06,
+0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0xe5,0x70,0x60,
+0x04,0x7f,0x01,0x11,0xb3,0x51,0x0c,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0xef,0x64,
+0x01,0x70,0x42,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,0x36,
+0x75,0x90,0x01,0x36,0x74,0x03,0xf0,0xfd,0x7f,0x02,0x12,0x36,0xe6,0x7d,0x10,0x7f,
+0x03,0x12,0x36,0x92,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x12,
+0x47,0x23,0xe4,0xff,0x11,0xb3,0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,
+0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,
+0x7b,0xff,0x12,0x36,0xe6,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0x7d,0x10,0x7f,0x03,
+0x12,0x36,0x92,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,0x07,
+0xf0,0x12,0x64,0x11,0xe5,0x6d,0x20,0xe0,0x05,0xe4,0x90,0x91,0x29,0xf0,0x22,0x8b,
+0x0e,0x8a,0x0f,0x89,0x10,0x12,0x62,0x3e,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x12,0x29,
+0xd9,0xf5,0x70,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,0x40,
+0x7f,0x01,0x80,0x3a,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,0x12,0x42,0x20,
+0xfd,0xe4,0xff,0x31,0xe1,0x80,0x27,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0xe1,0x1f,0x80,0x13,0xab,0x0e,0xaa,0x0f,0xa9,
+0x10,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0xe1,0xe4,0xff,0x11,0xfe,
+0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x91,0x39,0x74,0x01,0xf0,0x80,
+0x16,0xed,0x70,0x0a,0x90,0x91,0x35,0xe0,0x90,0x91,0x39,0xf0,0x80,0x05,0x90,0x91,
+0x39,0xed,0xf0,0x90,0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x22,0x7f,0x78,0x7e,0x08,
+0x12,0x27,0xde,0x90,0x90,0xd8,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,
+0x90,0x90,0xdc,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0xe0,
+0x12,0x2a,0x7f,0x90,0x91,0x51,0xe0,0x90,0x90,0xd8,0xb4,0x01,0x0d,0x12,0x43,0x09,
+0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x09,0xef,0x54,0xc7,
+0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,
+0x90,0xdc,0x12,0x43,0x09,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xe0,0x12,0x43,0x09,0xef,0x44,0x02,
+0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x7f,
+0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xe4,0x12,0x2a,0x7f,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,
+0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x91,0x51,
+0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,
+0x7f,0x01,0x12,0x34,0x81,0x90,0x00,0x11,0xe0,0x54,0xf6,0xf0,0x80,0x08,0xf4,0xff,
+0x90,0x00,0x43,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,
+0xfe,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x9b,
+0xed,0xf0,0x90,0x91,0x9a,0xef,0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,
+0xf0,0x51,0xe6,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xff,0x90,0x00,0x46,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x9b,0xe0,
+0x60,0x16,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xff,0x90,0x00,0x45,0x80,0x66,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,0x80,0x6b,0x90,
+0x91,0x9a,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xc4,0x54,0xf0,0x51,0xde,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,
+0xe6,0x90,0x91,0x9b,0xe0,0x60,0x1b,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x42,0xe0,0x4f,
+0x80,0x1a,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,0x51,0xe6,0xd0,
+0xd0,0x92,0xaf,0x22,0xf0,0x90,0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,0x00,0xed,0xf0,0x51,0xe6,0xd0,0xd0,
+0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,0x66,0x24,0x02,0x60,0x02,0x81,0xaa,
+0x90,0x90,0xf3,0x74,0x02,0xf0,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,
+0xee,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x45,0xe0,
+0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,0x90,0xf3,0xf0,0x90,0x90,0xef,0x12,
+0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,
+0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x54,0xef,
+0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,
+0x90,0x90,0xf3,0x74,0x01,0xf0,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,
+0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x71,0xee,0x90,
+0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x71,0xee,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0x90,0x90,0xf5,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,
+0x90,0xf4,0xf0,0x12,0x29,0xd9,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf8,0xf0,0x90,0x05,
+0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,
+0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x90,0xf4,0xe0,0xff,0x12,0x6e,0x67,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x90,0x90,0xf5,0xe0,0x70,0x02,0xa1,0xb2,
+0x90,0x90,0xf4,0xe0,0x70,0x02,0xa1,0xb2,0x90,0x90,0xf8,0xe0,0x70,0x02,0xa1,0xb2,
+0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x91,0x07,0x74,0x01,0xf0,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x71,0xe5,0x90,0x00,0x46,0xe0,0x44,0x01,
+0xfd,0x7f,0x46,0x71,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x71,
+0xee,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,
+0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,
+0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,
+0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,0x37,0x00,
+0x80,0x2b,0x90,0x90,0xf5,0xe0,0x70,0x2d,0x90,0x91,0x07,0x71,0xe4,0x90,0x00,0x46,
+0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x71,0xee,0x90,0x05,0x22,0xe4,0xf0,0xa2,0xaf,0x33,
+0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x36,0x92,0x90,0x91,0x1c,
+0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x0e,0x8a,0x0f,0x89,0x10,0x90,0x00,0x02,0x12,
+0x42,0x20,0x90,0x90,0xf6,0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x90,0xed,0x74,0x01,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0xef,0x12,0x2a,0x7f,0xab,0x0e,0xaa,
+0x0f,0xa9,0x10,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,0x78,0x1a,
+0x12,0x2a,0x6c,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x90,0xef,0x12,0x43,
+0x09,0xec,0x54,0x03,0xfc,0x12,0x42,0xfc,0x90,0x90,0xf9,0x12,0x2a,0x7f,0x90,0x05,
+0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x90,0xed,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,
+0xde,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,0x90,0xef,0x12,0x2a,0x7f,0x90,
+0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,
+0x2f,0xd9,0x90,0x90,0xf6,0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0x71,0xee,0x90,
+0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,
+0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x48,
+0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x54,0xef,0xfd,0x7f,
+0x46,0x71,0xee,0xe4,0x90,0x90,0xf3,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,
+0x71,0xee,0x7d,0xff,0x7f,0x55,0x71,0xee,0x7d,0xff,0x7f,0x56,0x71,0xee,0x7d,0xff,
+0x7f,0x57,0x61,0xee,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x71,0xee,0xe4,0xfd,
+0x7f,0x51,0x71,0xee,0xe4,0xfd,0x7f,0x52,0x71,0xee,0xe4,0xfd,0x7f,0x53,0x61,0xee,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x22,0xed,0xf0,0x90,0x91,0x21,0xef,
+0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,
+0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,
+0x5f,0xf0,0x80,0x17,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x46,0x80,0x59,0x90,0x91,0x21,0xe0,0x24,0xf8,0xf0,0xa3,0xe0,0x70,0x1d,0x90,
+0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,
+0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,0x1a,0x90,0x91,0x21,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,
+0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,
+0x51,0xe6,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x91,0x9f,0xf0,0xe0,
+0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x71,0xee,0x90,0x91,0x9f,0xe0,0x44,0xb0,
+0xfd,0x7f,0x49,0x61,0xee,0x12,0x47,0xe6,0xbf,0x01,0x10,0x90,0x02,0x09,0xe0,0xff,
+0x7d,0x01,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x75,0x28,0x33,0xe4,
+0xf5,0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,
+0xf0,0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x91,0x0e,0xf0,0xa3,
+0xf0,0x75,0x8e,0x02,0xf1,0x25,0xd1,0xe8,0x90,0x91,0x4f,0xef,0xf0,0xf1,0x0b,0x90,
+0x91,0x51,0xef,0xf0,0xf1,0x60,0x90,0x91,0x3d,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,
+0x57,0xf1,0x02,0x12,0x61,0xc4,0x12,0x32,0x3d,0x12,0x44,0xff,0x11,0x0c,0xf1,0x36,
+0xd1,0xfb,0xd1,0xd0,0x12,0x44,0xfe,0x31,0x13,0x12,0x44,0xf4,0x12,0x6e,0x09,0x90,
+0x91,0x10,0xe5,0xd9,0xf0,0x12,0x4e,0xb9,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,
+0xf0,0x12,0x4a,0xe6,0x75,0xe8,0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x91,0x0e,0xe0,
+0x64,0x01,0xf0,0x24,0x2a,0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x57,0x30,
+0xe2,0x10,0x12,0x5f,0xf0,0xbf,0x01,0x0a,0xc2,0xaf,0x53,0x57,0xfb,0xd2,0xaf,0x12,
+0x71,0x97,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,0xef,0xd2,0xaf,0x12,0x60,
+0x2d,0x90,0x90,0xf7,0xe0,0x70,0x03,0x12,0x70,0x74,0x11,0xe7,0x90,0x91,0x3f,0xe0,
+0x90,0x01,0xba,0xf0,0x80,0xb6,0xe4,0x90,0x91,0x55,0xf0,0x90,0x91,0x53,0xe0,0x54,
+0x7f,0xf0,0xa3,0x74,0x0a,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x25,0x14,0x70,0x1b,
+0x7b,0x01,0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x12,0x67,0xe4,0xbf,0x01,0x09,
+0x90,0x06,0x35,0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0xe1,0x17,0xe4,0x90,0x06,
+0x34,0xf0,0x22,0x90,0x91,0x56,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x7f,0xf0,0x90,0x01,
+0x17,0xe0,0xfe,0x90,0x01,0x16,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,
+0x5c,0xf0,0xa3,0xef,0xf0,0x90,0x01,0x04,0xe0,0x54,0x0f,0x90,0x91,0x1c,0xf0,0xe0,
+0xff,0x74,0x40,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0x90,0x91,0x5b,0xf0,0xee,0x90,0x91,0x5a,0xf0,0x90,0x91,0x5e,0xe0,0x54,0xfe,
+0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xfb,0xf0,0xe0,0x54,0xf7,0xf0,0xe0,0x54,0xef,
+0xf0,0xe0,0x54,0xdf,0xf0,0xe0,0x54,0xbf,0xf0,0xe0,0x54,0x7f,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xf7,0xf0,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x12,0x29,0xd9,0x54,0x01,0xff,0x90,0x91,0x56,
+0xe0,0x54,0xfe,0x4f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x57,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x58,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x1a,
+0x90,0x06,0x09,0xe0,0x54,0xfe,0xf0,0x90,0x02,0x86,0xe0,0x44,0x04,0xf0,0x43,0x57,
+0x04,0x7d,0x08,0xe4,0xff,0x12,0x36,0xe6,0x80,0x12,0x7d,0x08,0xe4,0xff,0x12,0x36,
+0x75,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x31,0xf1,0x31,0x13,0xd0,0xd0,0x92,0xaf,
+0x22,0x90,0x06,0x90,0xe4,0xf0,0x21,0x5a,0x90,0x91,0x19,0x12,0x43,0x41,0xef,0x12,
+0x43,0x4a,0x52,0x30,0x01,0x52,0x39,0x02,0x52,0x5b,0x03,0x52,0x64,0x09,0x52,0x6c,
+0x0c,0x52,0x75,0x0d,0x52,0x7d,0x0e,0x52,0x8e,0x1a,0x52,0x96,0x2c,0x52,0x41,0x2d,
+0x52,0x4a,0x2e,0x52,0x9e,0x30,0x52,0x53,0x3b,0x52,0x86,0x3c,0x00,0x00,0x52,0xa6,
+0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x64,0x72,0x90,0x91,0x19,0x12,0x43,0x21,0xc1,
+0xf5,0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x65,0x8d,0x90,0x91,0x19,0x12,0x43,0x21,
+0x02,0x65,0xd5,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x4b,0x90,0x91,0x19,0x12,0x43,
+0x21,0x02,0x66,0x0e,0x90,0x91,0x19,0x12,0x43,0x21,0x80,0x42,0x90,0x91,0x19,0x12,
+0x43,0x21,0x02,0x4c,0xab,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x98,0x90,0x91,0x19,
+0x12,0x43,0x21,0x02,0x4d,0xe6,0x90,0x91,0x19,0x12,0x43,0x21,0x21,0x90,0x90,0x91,
+0x19,0x12,0x43,0x21,0xa1,0x9b,0x90,0x91,0x19,0x12,0x43,0x21,0x81,0x7a,0x90,0x91,
+0x19,0x12,0x43,0x21,0xe1,0x78,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1c,0x12,0x43,
+0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x42,0xcf,0x12,
+0x29,0xd9,0xff,0x60,0x2c,0xb5,0x72,0x16,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,
+0x01,0x12,0x42,0x97,0x65,0x74,0x70,0x04,0xe5,0x73,0x65,0xf0,0x60,0x23,0x90,0x91,
+0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xff,0xae,0xf0,0x71,0x26,0x80,
+0x10,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x29,0xd9,0x65,0x72,0x60,0x03,0x12,0x44,
+0xe8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1f,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x72,
+0x01,0x8e,0x73,0xf5,0x74,0xe4,0xfd,0x7f,0x0b,0x12,0x4f,0x10,0xe4,0xfd,0x7f,0x02,
+0x12,0x4f,0x10,0x71,0x6a,0xe4,0xff,0x71,0xcc,0xe4,0xf5,0x76,0x90,0x01,0xc9,0xe5,
+0x76,0xf0,0x90,0x91,0x1f,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,
+0x45,0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0x7f,0x0b,0x71,0xd9,0xef,0x65,
+0x75,0x60,0x10,0xe5,0x75,0xb4,0x01,0x05,0xe4,0xf5,0x75,0x80,0x03,0x75,0x75,0x01,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe5,0x72,0x64,0x01,0x70,0x3f,0x71,0x6a,0xbf,0x01,
+0x04,0x7f,0x01,0x71,0xcc,0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0x12,0x4b,
+0xee,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x12,0x4b,0xee,0x90,0x00,0x46,
+0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x7f,0x02,0x71,0xd9,0x8f,0x76,0x90,
+0x01,0xc9,0xe5,0x76,0xf0,0xb4,0x01,0x03,0x12,0x4f,0xd7,0x22,0x90,0x01,0xca,0xe5,
+0x75,0xf0,0xef,0x60,0x03,0x12,0x4f,0xd7,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0xa0,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,0x12,
+0x4a,0xe6,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,0xef,
+0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,0x80,
+0x44,0x90,0x91,0xa0,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0x12,0x4a,0xde,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,
+0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,
+0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,
+0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0xf5,0x10,0x75,0x11,0x04,0xf5,0x12,0xf5,0x14,0xf5,0x15,0x90,0x02,0x09,
+0xe0,0xff,0x12,0x29,0xd9,0xfe,0xef,0x2e,0xf5,0x13,0x30,0xe0,0x08,0x75,0x0e,0x00,
+0x75,0x0f,0x80,0x80,0x05,0xe4,0xf5,0x0e,0xf5,0x0f,0xe5,0x13,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x74,0x20,0x25,0x10,0xf5,0x10,0xad,0x0f,0xe5,0x10,0x2d,0xff,0x24,0x01,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x91,0x47,0xf0,0x74,0x02,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x10,0x2d,0x24,0x03,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x91,0x48,0xf0,0xa3,0xef,
+0xf0,0x7f,0x04,0xe5,0x10,0x25,0x0f,0x2f,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0xfe,0x74,0x46,0x2f,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xee,0xf0,0x0f,
+0xbf,0x08,0xe0,0x12,0x66,0x56,0xef,0x70,0x3f,0x90,0x01,0xc3,0xe0,0x60,0x25,0xc3,
+0xe5,0x15,0x94,0xe8,0xe5,0x14,0x94,0x03,0x40,0x09,0x90,0x01,0xc6,0xe0,0x44,0x10,
+0xf0,0x80,0x63,0x05,0x15,0xe5,0x15,0x70,0x02,0x05,0x14,0x7f,0x0a,0x7e,0x00,0x12,
+0x37,0x54,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,0xe2,0x05,0x74,0xfe,
+0xf0,0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x10,0xb4,0x78,0x23,0xe4,0xf5,0x10,
+0x05,0x13,0xe5,0x0f,0x64,0x80,0x45,0x0e,0x70,0x06,0xf5,0x0e,0xf5,0x0f,0x80,0x06,
+0x75,0x0e,0x00,0x75,0x0f,0x80,0xe5,0x13,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x80,0x06,
+0x74,0x08,0x25,0x10,0xf5,0x10,0xe5,0x12,0x15,0x12,0x70,0x02,0x15,0x11,0xe5,0x12,
+0x45,0x11,0x60,0x02,0x81,0xb8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1c,0x12,0x43,
+0x41,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xfe,0x4e,0xf0,
+0xef,0x54,0x04,0xff,0xe0,0x54,0xfb,0x4f,0xf0,0x12,0x29,0xd9,0xff,0x54,0x02,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xfd,0x4e,0xf0,0xef,0x54,0x08,0xff,0xe0,0x54,0xf7,0x4f,
+0xf0,0x12,0x29,0xd9,0xff,0x54,0x10,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xef,0x4e,0xf0,
+0xef,0x54,0x20,0xff,0xe0,0x54,0xdf,0x4f,0xf0,0x12,0x29,0xd9,0xff,0x54,0x40,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xbf,0x4e,0xf0,0xef,0x54,0x80,0xff,0xe0,0x54,0x7f,0x4f,
+0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x60,0xf0,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x91,0x5f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x61,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0x54,0x02,0xff,0xe0,0x54,0xfd,0x4f,0xf0,
+0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x04,0xff,0x90,0x91,0x61,0xe0,0x54,0xfb,0x4f,
+0xf0,0x90,0x91,0x5e,0xe0,0x54,0x01,0x90,0x01,0xb8,0xf0,0x90,0x91,0x5e,0xe0,0xff,
+0xc4,0x13,0x54,0x01,0x90,0x01,0xb9,0xf0,0x90,0x91,0x61,0xe0,0x54,0x01,0x90,0x01,
+0xba,0xf0,0xa3,0x74,0xff,0xf0,0x12,0x29,0xd9,0x20,0xe0,0x02,0x21,0xf1,0xe4,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x29,0xd9,0xff,0xc3,
+0x13,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x02,0xf0,0xef,0x13,0x13,0x54,0x3f,
+0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x04,0xf0,0x12,0x29,0xd9,0x13,0x13,0x13,
+0x54,0x1f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x08,0xf0,0x90,0x91,0x61,0xe0,
+0x30,0xe0,0x1c,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,
+0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,
+0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,0xa3,
+0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,0x01,
+0x60,0x02,0x7f,0x00,0x22,0x12,0x29,0xd9,0xf5,0x6d,0x22,0x90,0x01,0x64,0x74,0xa0,
+0xf0,0x22,0x90,0x91,0x51,0xe0,0x90,0x90,0xe8,0xf0,0x22,0x90,0x00,0xf3,0xe0,0x7f,
+0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0xe4,0x90,0x91,0x4e,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,
+0xfd,0x7f,0x80,0x02,0x4b,0xee,0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,
+0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,0xe4,0xf0,0x22,0x12,0x29,0xd9,0x60,0x02,
+0x80,0x01,0xe4,0x90,0x91,0x31,0xf0,0x90,0x91,0x31,0xe0,0x90,0x01,0xe7,0xf0,0x22,
+0x90,0x91,0x51,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x05,0x7e,0xfd,
+0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x53,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0xc3,0x13,0x30,0xe0,0x0a,0x90,0x00,0x01,
+0x12,0x42,0x20,0x90,0x91,0x54,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,
+0xf7,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x0e,0xc2,
+0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4b,0xee,0x7d,0x40,0x7f,
+0x01,0x12,0x36,0xaf,0xe5,0x0e,0x24,0xff,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,
+0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,
+0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xcb,0xf0,0x74,0x57,
+0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,
+0xf5,0x2e,0xa3,0xe0,0x55,0x2b,0xf5,0x2f,0xe5,0x2c,0x30,0xe0,0x5a,0x90,0x01,0x34,
+0x74,0x01,0xf0,0x85,0xd9,0x54,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,
+0x91,0x3b,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,
+0x51,0x30,0xef,0x64,0x01,0x70,0x30,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,
+0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5b,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x91,0x37,0xf0,0x80,0x08,0x51,
+0x30,0xbf,0x01,0x03,0x12,0x44,0xc2,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,
+0x02,0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,
+0x5c,0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0x5c,0xe5,0x2c,0x30,0xe3,
+0x10,0x90,0x01,0x34,0x74,0x08,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x03,0x43,0x57,
+0x04,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,0xf0,0x43,0x57,0x10,0xe5,
+0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,0xe0,0x54,0xdf,0xf0,0x90,
+0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,0x12,0x4e,0xe4,0x90,0x00,
+0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4a,0xe6,0x80,0xfe,0xe5,0x2c,0x30,0xe6,0x06,0x90,
+0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x13,0x90,0x91,0x50,0x74,0x01,0xf0,
+0x90,0x01,0x36,0xf0,0x91,0x23,0x51,0x87,0x90,0x91,0x50,0xe4,0xf0,0xe5,0x2e,0x30,
+0xe1,0x3c,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x90,0x01,0x02,0xe0,0x54,
+0x03,0x64,0x01,0x70,0x29,0x90,0x01,0x37,0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,
+0x91,0x40,0xe4,0xf0,0x80,0x18,0x90,0x91,0x40,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,
+0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x4f,0xf5,0xe5,0x2e,
+0x30,0xe2,0x19,0x90,0x01,0x36,0x74,0x04,0xf0,0x90,0x91,0x3a,0xe4,0xf0,0x90,0x05,
+0x58,0x74,0x03,0xf0,0x51,0xd8,0x90,0x91,0x3f,0xe0,0x04,0xf0,0xe5,0x2e,0x30,0xe3,
+0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x6d,0x64,0x01,0x70,0x1c,0xe5,0x70,0x60,
+0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x66,0xe4,
+0x12,0x44,0x49,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,0x2b,0x90,0x01,
+0x36,0x74,0x10,0xf0,0xe5,0x6d,0xb4,0x01,0x20,0xe5,0x70,0x60,0x1c,0x90,0x01,0x57,
+0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x3c,0xe4,0xf0,0x53,0x71,0xfd,
+0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2e,0x30,0xe5,0x1f,0x90,0x01,
+0x36,0x74,0x20,0xf0,0xe5,0x6d,0xb4,0x01,0x14,0xe5,0x70,0x60,0x10,0x90,0x91,0x3b,
+0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xc8,0x80,0x03,0x12,0x44,0x77,0xe5,0x2e,0x30,
+0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x10,0xe5,0x70,0x60,
+0x0c,0x53,0x71,0xfe,0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2f,0x30,
+0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x71,0x7e,0x74,0xcb,0x04,0x90,0x01,0xc4,
+0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,
+0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,
+0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,0x00,0x22,0x51,
+0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x91,
+0x37,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x91,0x36,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x6f,0x54,0x0f,0xd3,0x94,
+0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,
+0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x30,0xe0,0x49,0xe5,0x6d,
+0x64,0x01,0x70,0x43,0x90,0x91,0x52,0xe0,0x04,0xf0,0xe5,0x70,0x64,0x03,0x60,0x05,
+0xe5,0x70,0xb4,0x06,0x0d,0x90,0x91,0x52,0xe0,0xff,0x74,0x01,0xd3,0x9f,0x50,0x14,
+0x80,0x07,0x90,0x91,0x52,0xe0,0xb4,0x0a,0x0b,0x90,0x91,0x55,0xe0,0x04,0xf0,0xe4,
+0x90,0x91,0x52,0xf0,0x90,0x91,0x55,0xe0,0xff,0x90,0x91,0x54,0xe0,0xb5,0x07,0x07,
+0x71,0x4e,0xe4,0x90,0x91,0x55,0xf0,0x22,0xe5,0x6d,0x64,0x01,0x70,0x63,0xe5,0x70,
+0x60,0x5f,0xe5,0x70,0x64,0x02,0x60,0x06,0xe5,0x70,0x64,0x05,0x70,0x27,0x90,0x06,
+0xab,0xe0,0x90,0x91,0x27,0xf0,0x90,0x06,0xaa,0xe0,0x90,0x91,0x39,0xf0,0x90,0x91,
+0x27,0xe0,0x70,0x07,0x90,0x91,0x39,0xe0,0xff,0x80,0x05,0x90,0x91,0x27,0xe0,0xff,
+0x90,0x91,0x27,0xef,0xf0,0x90,0x91,0x29,0xe0,0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,
+0x91,0x28,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x71,0xfd,
+0x53,0x71,0xef,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0xc7,0x71,
+0x42,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xd0,0xd0,0x92,0xaf,0x22,0xe5,0x6e,
+0x30,0xe3,0x04,0xe4,0xff,0x80,0x02,0x7f,0x01,0x02,0x47,0xc9,0x90,0x91,0x08,0xe0,
+0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x58,
+0x90,0x91,0x71,0x12,0x43,0x41,0x0b,0x7a,0x91,0x79,0x08,0x02,0x46,0xb7,0x90,0x91,
+0x80,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,
+0x21,0x90,0x91,0x3b,0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0d,0xe5,0x6e,0x54,
+0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0xe4,0xff,0x12,
+0x48,0xb3,0x22,0x51,0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,
+0x80,0x58,0xe5,0x71,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,
+0xe5,0x6f,0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,
+0x39,0xe5,0x71,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x71,
+0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x91,0x29,0xe0,0x60,
+0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x91,0x31,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,
+0x7f,0x00,0x22,0xe4,0xfb,0x90,0x91,0x78,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,
+0x70,0x70,0x02,0x81,0xb5,0xe5,0x6d,0x64,0x01,0x70,0x7a,0xe5,0x70,0x14,0x60,0x2b,
+0x24,0xfd,0x60,0x27,0x24,0x02,0x24,0xfb,0x50,0x02,0x80,0x21,0x90,0x91,0x27,0xe0,
+0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,0x60,0x14,0x90,0x91,0x27,0xe0,0x70,0x08,0x90,
+0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x45,
+0x43,0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,
+0xff,0x90,0x91,0x34,0xe0,0x2f,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,
+0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0x90,
+0x91,0x2e,0xe0,0x60,0x10,0x90,0x91,0x2c,0xe0,0x90,0x07,0x78,0x60,0x04,0x74,0x0d,
+0xf0,0x22,0x74,0x09,0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,
+0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0x53,0x91,0xef,
+0x90,0x00,0x51,0xe0,0xff,0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,
+0xff,0x90,0x00,0x56,0xe0,0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,
+0x74,0x10,0xf0,0xe5,0x3d,0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,
+0x30,0xe6,0x1b,0x90,0x00,0x55,0x74,0x40,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x0b,0x90,0x90,0xf3,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4c,0x03,0xe5,0x3d,
+0x30,0xe7,0x15,0x90,0x00,0x55,0x74,0x80,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x05,0x7f,0x02,0x12,0x4c,0x03,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,
+0x74,0x01,0xf0,0xe5,0x3e,0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,
+0x30,0xe2,0x06,0x90,0x00,0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,
+0x56,0x74,0x08,0xf0,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,
+0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,
+0xc0,0x05,0xc0,0x06,0xc0,0x07,0x75,0x0d,0x00,0x90,0x01,0xc4,0x74,0x99,0xf0,0x74,
+0x5d,0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,
+0x55,0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,
+0xe5,0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x08,
+0x90,0x01,0x3c,0x74,0x02,0xf0,0xf1,0x57,0xe5,0x34,0x30,0xe2,0x3a,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,
+0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,
+0x59,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x08,0x90,
+0x91,0x37,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe3,0x3a,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe1,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,
+0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x12,0x44,0x59,
+0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x08,0x90,0x91,
+0x36,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,
+0xf0,0x12,0x53,0x86,0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,
+0x6e,0xb9,0xe5,0x35,0x30,0xe0,0x5a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,
+0xe0,0x44,0x7f,0xf0,0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x0d,0xb4,0x01,0x02,0x80,
+0x1c,0xe5,0x0d,0xb4,0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x0d,0xb4,0x04,0x05,
+0x90,0x00,0x83,0x80,0x08,0xe5,0x0d,0xb4,0x0c,0x08,0x90,0x00,0x83,0xe0,0xf5,0x6f,
+0x80,0x06,0x90,0x01,0xbe,0xe0,0x04,0xf0,0x90,0x01,0xbb,0xe5,0x6f,0xf0,0xe5,0x6f,
+0x30,0xe0,0x03,0xa3,0x80,0x03,0x90,0x01,0xbd,0xe0,0x04,0xf0,0xf1,0x38,0x12,0x44,
+0xc2,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,0x04,0xf0,0xe5,0x36,0x30,0xe0,
+0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,0x74,
+0x02,0xf0,0x74,0x99,0x04,0x90,0x01,0xc4,0xf0,0x74,0x5d,0xa3,0xf0,0xd0,0x07,0xd0,
+0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,
+0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xe5,0x6f,0x30,0xe6,0x19,0xe5,0x6f,0x54,
+0x0f,0xff,0x90,0x91,0x24,0xe0,0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,
+0x91,0x24,0xf0,0x53,0x6f,0xbf,0x22,0xe4,0x90,0x91,0x0d,0xf0,0xe5,0x70,0x70,0x02,
+0xe1,0xe1,0x90,0x91,0x3c,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x71,0xfd,0xe5,0x71,0x54,
+0x07,0x70,0x6e,0x80,0x69,0x90,0x91,0x28,0xe0,0x04,0xf0,0x53,0x71,0xef,0x90,0x91,
+0x3a,0xe0,0x04,0xf0,0x90,0x91,0x0d,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,
+0x33,0xfc,0x90,0x91,0x3a,0xe0,0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,
+0x24,0x02,0xff,0xe4,0x3e,0xfe,0x90,0x91,0x3a,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,
+0x06,0x90,0x05,0x58,0xe0,0x04,0xf0,0xe9,0xff,0x90,0x91,0x2f,0xe0,0x2f,0xff,0xe4,
+0x33,0xfe,0x90,0x91,0x28,0xe0,0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,
+0x0d,0xe5,0x6d,0xb4,0x01,0x0b,0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,
+0xc2,0x22,0x8f,0x20,0x8c,0x21,0x8d,0x22,0x22,0x8f,0x23,0x8c,0x24,0x8d,0x25,0x22,
+0xe4,0x90,0x91,0x11,0xf0,0xa3,0xf0,0x90,0x02,0x86,0xe0,0x20,0xe1,0x2c,0xc3,0x90,
+0x91,0x12,0xe0,0x94,0x20,0x90,0x91,0x11,0xe0,0x94,0x03,0x40,0x0a,0x90,0x01,0xc6,
+0xe0,0x44,0x20,0xf0,0x7f,0x00,0x22,0x90,0x91,0x11,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x7f,0x01,0x7e,0x00,0x12,0x37,0x54,0x80,0xcd,0x7f,0x01,0x22,0x90,0x01,0xcc,
+0xe0,0x54,0x0f,0x90,0x91,0x11,0xf0,0x90,0x91,0x11,0xe0,0xfd,0x70,0x02,0x21,0x6f,
+0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,
+0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0x21,0x68,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x15,0xe0,0x90,0x91,0x12,0xf0,0x75,0x63,
+0x01,0x75,0x64,0x91,0x75,0x65,0x12,0x75,0x66,0x01,0x7b,0x01,0x7a,0x91,0x79,0x13,
+0x12,0x46,0x6d,0x90,0x91,0x13,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x90,0x91,
+0x9c,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,0x15,0xe0,0x90,
+0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,0x12,0x43,0x15,
+0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,
+0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,
+0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x17,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,
+0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x18,0xf0,0x80,0x33,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,
+0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,
+0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x91,0x79,0x14,0x12,0x51,0xf8,0x90,0x91,0x11,
+0xe0,0xff,0x90,0x91,0x9c,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0x5f,0x90,0x91,0x11,0xf0,0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,0x91,0x9c,0xe0,
+0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x37,0x90,0x01,0xc6,0xe0,0x44,0x02,0xf0,0x22,
+0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,
+0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,
+0x54,0xef,0xf0,0x22,0xe4,0xf5,0x6d,0xf5,0x71,0xf5,0x70,0x75,0x6f,0x0c,0x75,0x6e,
+0x0c,0x90,0x91,0x3b,0xf0,0x90,0x91,0x37,0xf0,0x90,0x91,0x36,0xf0,0x90,0x91,0x39,
+0x04,0xf0,0x90,0x91,0x27,0xf0,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,0x29,0xf0,0x90,
+0x91,0x34,0x74,0x07,0xf0,0xe4,0x90,0x91,0x28,0xf0,0x90,0x91,0x32,0xf0,0xa3,0x74,
+0x03,0xf0,0x90,0x91,0x2f,0x74,0x0a,0xf0,0xa3,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,
+0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,0xe4,0x90,0x91,0x2b,0xf0,0x90,0x91,0x25,
+0xf0,0x90,0x91,0x50,0xf0,0x90,0x91,0x31,0xf0,0x90,0x91,0x3a,0xf0,0x90,0x91,0x26,
+0xf0,0x90,0x91,0x38,0xf0,0x90,0x91,0x2e,0xf0,0x90,0x91,0x2c,0xf0,0x22,0xe4,0x90,
+0x91,0x3c,0xf0,0x90,0x91,0x28,0xf0,0xf5,0x71,0x22,0x90,0x06,0x04,0xe0,0x54,0xbf,
+0xf0,0xef,0x60,0x0a,0xe5,0x6d,0xb4,0x01,0x05,0xe4,0xff,0x12,0x47,0xc9,0x53,0x6e,
+0xf0,0x43,0x6e,0x0c,0x22,0x90,0x91,0x9d,0xef,0xf0,0x51,0x7e,0x90,0x91,0x9d,0xe0,
+0x60,0x05,0x90,0x05,0x22,0xe4,0xf0,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x90,0x00,
+0x11,0xe0,0x44,0x09,0xf0,0x12,0x4a,0xe6,0x90,0x90,0xd8,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xdc,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,
+0xe0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,
+0xd9,0x90,0x90,0xe4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,
+0xff,0x12,0x34,0x81,0x90,0x91,0x51,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,
+0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x34,0x81,0x22,0x8f,0x77,0xe4,
+0x90,0x91,0x96,0xf0,0xa3,0xf0,0x90,0x01,0x09,0xe0,0x7f,0x00,0x30,0xe7,0x02,0x7f,
+0x01,0xef,0x65,0x77,0x60,0x3e,0xc3,0x90,0x91,0x97,0xe0,0x94,0x88,0x90,0x91,0x96,
+0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,0x44,0x80,0xf0,0x22,0x90,0x91,0x96,
+0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,0x7e,0x00,0x12,0x37,0x54,0xd3,0x90,
+0x91,0x97,0xe0,0x94,0x32,0x90,0x91,0x96,0xe0,0x94,0x00,0x40,0xb9,0x90,0x01,0xc7,
+0xe0,0x30,0xe0,0xb2,0x22,0x22,0x53,0x6e,0xf0,0x43,0x6e,0x01,0x71,0x55,0x71,0x67,
+0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0x22,0x8f,0x78,0x12,0x47,0xe6,0xef,0x64,0x01,
+0x70,0x2e,0x90,0x91,0x44,0x12,0x48,0x1e,0xe5,0x78,0x60,0x10,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0xe4,0xfb,0x90,0x91,0x7c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x60,
+0x5f,0xe5,0x6d,0x64,0x01,0x70,0x59,0x0b,0x90,0x91,0x27,0xf0,0x04,0x60,0x51,0x43,
+0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,
+0x90,0x91,0x34,0xe0,0x2f,0x90,0x91,0x67,0xf0,0xe4,0x1b,0x12,0x44,0x54,0x90,0x01,
+0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,
+0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x11,0x90,0x91,0x2c,0xe0,0x90,0x07,
+0x78,0x60,0x05,0x74,0x0d,0xf0,0x80,0x03,0x74,0x09,0xf0,0x90,0x05,0x22,0xe4,0xf0,
+0x22,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,
+0xc3,0xc0,0xd0,0x90,0x91,0x84,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,
+0x90,0x91,0x84,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,
+0x91,0x87,0xe0,0x94,0xe8,0x90,0x91,0x86,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,
+0xe0,0x44,0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x91,0x86,0xe4,0x75,0xf0,0x01,0x12,
+0x42,0x81,0x7f,0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,
+0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,
+0x91,0x1f,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,
+0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x3b,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,
+0x91,0x25,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x01,0x90,0x91,0x26,0xf0,
+0xef,0xc3,0x13,0x54,0x01,0x90,0x91,0x2e,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0x13,0x13,0x54,0x01,0x90,0x91,0x2c,0xf0,0x90,0x91,0x2e,0xe0,0x90,0x91,0x1f,0x70,
+0x26,0x12,0x2a,0x8b,0x00,0x00,0x02,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x60,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x1f,0x12,0x2a,
+0x8b,0x00,0x00,0x03,0x10,0x80,0x24,0x12,0x2a,0x8b,0x00,0x00,0x01,0x10,0x90,0x91,
+0x1f,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x60,0x7e,0x08,0x12,0x2f,
+0xd9,0x90,0x91,0x1f,0x12,0x2a,0x8b,0x00,0x00,0x03,0x00,0x90,0x91,0x1f,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,
+0x26,0xe0,0x70,0x3d,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,
+0xde,0x90,0x91,0x1f,0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0xec,0x44,0x02,
+0xfc,0x90,0x91,0x1f,0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,
+0xf0,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x49,0x7f,0x90,0x01,0xe5,0xe5,0x70,0xf0,
+0x90,0x91,0x3b,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,
+0x12,0x42,0x20,0xff,0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x91,0x2f,0xf0,0x90,0x00,
+0x01,0x12,0x42,0x20,0x90,0x91,0x30,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x91,0x2d,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,0x91,0x35,0xf0,0x22,0x90,0x91,0x2f,0x74,
+0x0a,0xf0,0x90,0x91,0x30,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,
+0x35,0x74,0x05,0xf0,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,
+0x91,0x34,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0xef,0xf0,0x80,0x0f,0x90,0x91,0x34,0x74,0x07,0xf0,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0x74,0x03,0xf0,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x02,
+0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x91,0x41,0xf0,0x90,
+0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x42,0xf0,0x90,0x00,0x02,0x12,
+0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x43,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,
+0xed,0x2f,0x90,0x91,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,
+0x2f,0x90,0x91,0x45,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x47,
+0xe0,0x90,0x91,0x1d,0xf0,0x90,0x91,0x48,0xe0,0xf5,0x19,0xa3,0xe0,0xf5,0x1a,0xe4,
+0xf5,0x16,0x74,0x4a,0x25,0x16,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xe0,0xff,0x74,
+0x1b,0x25,0x16,0xf8,0xa6,0x07,0x05,0x16,0xe5,0x16,0xb4,0x04,0xe5,0x90,0x91,0x1d,
+0xe0,0x12,0x43,0x4a,0x66,0xb3,0x00,0x67,0xdc,0x01,0x66,0xba,0x02,0x66,0xba,0x03,
+0x66,0xba,0x04,0x67,0xdc,0x05,0x67,0xac,0x80,0x67,0xc2,0x81,0x67,0xdc,0x82,0x00,
+0x00,0x67,0xd8,0xaf,0x1e,0x12,0x73,0xea,0xe1,0xdc,0x90,0x91,0x1d,0xe0,0xff,0xb4,
+0x02,0x08,0x90,0x91,0x1c,0x74,0x01,0xf0,0x80,0x0f,0xef,0x90,0x91,0x1c,0xb4,0x03,
+0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,0xc3,0xe5,0x19,0x94,0x08,0x50,0x49,
+0xe4,0xf5,0x16,0x90,0x91,0x1c,0xe0,0xff,0xe5,0x16,0xc3,0x9f,0x40,0x02,0xe1,0xdc,
+0xc3,0xe5,0x19,0x94,0x01,0x50,0x14,0xe5,0x16,0x25,0x1a,0xff,0xc3,0x74,0x03,0x95,
+0x16,0x24,0x1b,0xf8,0xe6,0xfd,0x12,0x4b,0xee,0x80,0x1a,0xc3,0x74,0x03,0x95,0x16,
+0x24,0x1b,0xf8,0xe6,0xff,0xe5,0x16,0x7c,0x00,0x25,0x1a,0xfd,0xec,0x35,0x19,0x8d,
+0x82,0xf5,0x83,0xef,0xf0,0x05,0x16,0x80,0xba,0xc3,0xe5,0x19,0x94,0x10,0x40,0x02,
+0xe1,0xdc,0x90,0x91,0x1d,0xe0,0x64,0x04,0x60,0x02,0xe1,0xdc,0xaf,0x1c,0xfc,0xfd,
+0xfe,0x78,0x10,0x12,0x2a,0x6c,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1b,
+0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x2a,0x6c,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,
+0x00,0x12,0x42,0xfc,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1d,0xe4,0xfc,
+0xfd,0xfe,0x78,0x08,0x12,0x2a,0x6c,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,
+0x42,0xfc,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0xaf,0x1e,0xe4,0xfc,0xfd,0xfe,
+0x12,0x42,0xfc,0xa3,0x12,0x2a,0x7f,0x90,0x91,0x1e,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0xaf,0x1a,0xae,0x19,0x12,0x2f,0xd9,0x80,0x30,0xe5,0x1d,0x7f,0x00,
+0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,0xaf,0x18,0xfe,0x12,0x37,0x54,
+0x80,0x1a,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,
+0xaf,0x18,0xfe,0x12,0x36,0xcb,0x80,0x04,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,
+0x92,0xaf,0x22,0x22,0x8e,0x0e,0x8f,0x0f,0x8b,0x10,0x8a,0x11,0x89,0x12,0xe4,0x90,
+0x91,0x11,0xf0,0xef,0x90,0x00,0x31,0xf0,0x12,0x4a,0xe6,0xe5,0x0e,0x54,0x03,0xff,
+0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x54,
+0x7f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x91,0x11,0xe0,
+0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x91,0x11,0xe0,0xc3,0x94,
+0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x10,0xaa,0x11,0xa9,0x12,0x12,0x42,0x4d,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x91,0x98,0xf0,0xa3,0xf0,0x90,0x05,0xf8,
+0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,
+0x01,0x22,0xd3,0x90,0x91,0x99,0xe0,0x94,0xe8,0x90,0x91,0x98,0xe0,0x94,0x03,0x40,
+0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x37,0x54,0x90,0x91,0x98,0xe4,0x75,
+0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0xef,0x70,0x02,0x41,0x3d,0x90,0x90,0xe8,0xe0,
+0x60,0x02,0xc1,0x08,0x90,0x90,0xd4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x80,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x84,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x88,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x90,0x8c,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x90,0x90,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x94,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x98,0x12,0x43,0x09,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x9c,0x12,
+0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x90,0xa0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x90,0xa4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xa8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xac,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xb0,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,
+0xb4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x90,0xb8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x90,0xbc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc0,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc4,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xc8,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,
+0x90,0x90,0xcc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,
+0x12,0x2f,0xd9,0x90,0x90,0xd0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xe8,0x74,0x01,0xf0,0x22,0x90,0x90,0xe8,
+0xe0,0x64,0x01,0x60,0x02,0xc1,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,
+0xd4,0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x80,0x12,0x2a,
+0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x84,0x12,0x2a,0x7f,0x7f,0x6c,
+0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x88,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x90,0x8c,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x90,0x90,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x94,0x12,
+0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x98,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x9c,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x90,0xa0,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x90,0xa4,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xa8,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xac,0x12,0x2a,0x7f,
+0x7f,0xd4,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xb0,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x90,0xb4,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x90,0xb8,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,
+0xbc,0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xc0,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x90,0xc4,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0d,0x12,0x27,0xde,0x90,0x90,0xc8,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x27,0xde,0x90,0x90,0xcc,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x90,0xd0,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,
+0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x44,0xc0,0xfd,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,
+0xd9,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,
+0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,
+0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,
+0x12,0x2f,0xd9,0xe4,0x90,0x90,0xe8,0xf0,0x22,0xe4,0xfd,0x7f,0x45,0x12,0x4b,0xee,
+0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x90,0xf7,0xf0,0x90,0x90,0xfd,0xf0,0x90,
+0x91,0x00,0xf0,0x90,0x90,0xfe,0xf0,0x90,0x91,0x01,0xf0,0x90,0x90,0xff,0xf0,0x90,
+0x91,0x02,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x90,0xee,0xf0,0x90,0x90,0xf3,0xf0,0x90,0x90,0xf5,0xf0,0x90,0x91,0x07,0xf0,0x90,
+0x90,0xf8,0xf0,0x90,0x90,0xf4,0xf0,0x90,0x90,0xed,0xf0,0x90,0x00,0x51,0xe0,0x44,
+0xc0,0xfd,0x7f,0x51,0x02,0x4b,0xee,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,
+0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,
+0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x91,0x04,0xe0,
+0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,
+0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x91,0x06,0x80,0x03,0x90,0x91,0x05,0xe0,0x04,
+0xf0,0x22,0x90,0x91,0x04,0xe0,0x2f,0xf0,0x22,0x90,0x90,0xf5,0xe0,0x64,0x01,0x60,
+0x02,0xe1,0x6e,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x90,
+0x91,0x07,0xe0,0x70,0x32,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x90,0xf4,0xe0,0xff,0xd1,0x67,0x90,0x91,0x07,
+0x74,0x01,0x12,0x4b,0xe4,0x80,0x40,0x90,0x91,0x07,0xe0,0x64,0x01,0x70,0x38,0x90,
+0x90,0xf8,0xe0,0xff,0xd1,0x67,0xe4,0x90,0x91,0x07,0xf0,0x90,0x00,0x45,0xe0,0x44,
+0x01,0xfd,0x7f,0x45,0x12,0x4b,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xef,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,
+0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,
+0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,
+0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,
+0x90,0xee,0xe0,0xc3,0x94,0x14,0x50,0x06,0xe0,0x04,0xf0,0x02,0x70,0x29,0x90,0x90,
+0xee,0xe0,0x64,0x14,0x60,0x03,0x02,0x70,0x29,0x90,0x90,0xfd,0xe0,0x70,0x25,0x90,
+0x91,0x00,0xe0,0x70,0x1f,0x90,0x90,0xfe,0xe0,0x70,0x19,0x90,0x91,0x01,0xe0,0x70,
+0x13,0x90,0x90,0xff,0xe0,0x70,0x0d,0x90,0x91,0x02,0xe0,0x70,0x07,0x90,0x04,0xfd,
+0xe0,0x54,0xfe,0xf0,0x90,0x90,0xfd,0xe0,0x90,0x04,0x44,0xf0,0x90,0x90,0xfe,0xe0,
+0x90,0x04,0x45,0xf0,0x90,0x90,0xff,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,
+0x91,0x00,0xe0,0x90,0x04,0x48,0xf0,0x90,0x91,0x01,0xe0,0x90,0x04,0x49,0xf0,0x90,
+0x91,0x02,0xe0,0x90,0x04,0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x90,0xe9,0xe0,0x90,0x04,
+0x4c,0xf0,0x90,0x90,0xea,0xe0,0x90,0x04,0x4d,0xf0,0x90,0x90,0xeb,0xe0,0x90,0x04,
+0x4e,0xf0,0x90,0x90,0xec,0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x90,0xee,0xf0,0x90,
+0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x90,0xfd,0xf0,0xa3,
+0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x91,0x8c,
+0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x8d,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x8e,
+0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x8f,0xf0,0x90,0x91,0x06,0xe0,0xff,0x90,0x91,
+0x8f,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,0x91,0x06,0xe0,0xc3,0x9e,0xd3,0x94,0x01,
+0x40,0x11,0x90,0x90,0xf4,0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x90,0xf8,0xe0,0xff,
+0x12,0x6e,0x67,0x22,0x90,0x91,0x07,0xe0,0x64,0x01,0x60,0x08,0x90,0x90,0xf5,0xe0,
+0x60,0x02,0x21,0x4b,0x90,0x90,0xe9,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,
+0x80,0x3b,0x90,0x90,0xea,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,
+0x28,0x90,0x90,0xeb,0xe0,0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x90,
+0xea,0xf0,0x80,0x15,0x90,0x90,0xec,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,
+0xe4,0x90,0x90,0xeb,0xf0,0x90,0x90,0xea,0xf0,0x90,0x90,0xe9,0xf0,0x90,0x00,0x44,
+0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,0x32,0x90,0x90,0xfd,0xe0,0xc3,0x94,0xff,
+0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x90,0xfe,0xe0,0xc3,0x94,0xff,0x50,0x06,
+0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x90,0xff,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,
+0x04,0xf0,0xe4,0x90,0x90,0xfe,0xf0,0x90,0x90,0xfd,0xf0,0x90,0x00,0x44,0xe0,0x30,
+0xe3,0x32,0x90,0x91,0x00,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,
+0x90,0x91,0x01,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,
+0x91,0x02,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x91,0x01,0xf0,
+0x90,0x91,0x00,0xf0,0x90,0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,0x90,0x06,0x90,0xe0,
+0x44,0x01,0xf0,0x90,0x91,0x61,0xe0,0x30,0xe0,0x3c,0x90,0x91,0x5f,0xe0,0xff,0x90,
+0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x54,0x01,0xfd,0x12,0x4a,0xf6,0x90,0x91,0x60,0xe0,
+0x75,0xf0,0x20,0xa4,0xff,0xae,0xf0,0x12,0x37,0x54,0x90,0x91,0x5e,0xe0,0xc4,0x13,
+0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,
+0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xe4,0x90,
+0x91,0x19,0xf0,0xa3,0x74,0x08,0xf0,0xa3,0xf0,0xe4,0xa3,0xf0,0x90,0x01,0x1f,0xe0,
+0xfe,0x90,0x01,0x1e,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x02,0x87,0xe0,0x90,0x91,0x18,0xf0,0x90,0x91,0x56,0xe0,0x20,
+0xe0,0x02,0x61,0xc4,0xe4,0x90,0x91,0x17,0xf0,0x90,0x91,0x18,0xe0,0xff,0x90,0x91,
+0x17,0xe0,0xc3,0x9f,0x40,0x02,0x61,0xc4,0x90,0x91,0x11,0xe0,0xfc,0xa3,0xe0,0xfd,
+0xec,0xff,0x90,0xfd,0x11,0xf0,0x90,0x91,0x1c,0xef,0xf0,0x74,0x02,0x2d,0xf5,0x82,
+0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0f,0xfc,0x33,0x33,0x33,0x54,0xf8,0xff,0xed,
+0x24,0x18,0x2f,0x90,0x91,0x15,0xf0,0xe0,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x54,0xfc,0x90,0x91,0x16,0xf0,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0xfb,
+0xf5,0x83,0xe0,0xfe,0x74,0x00,0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x7a,
+0x00,0x24,0x00,0xff,0xea,0x3e,0x54,0x3f,0xab,0x07,0xfa,0x90,0x91,0x13,0xf0,0xa3,
+0xeb,0xf0,0xaf,0x04,0xef,0x75,0xf0,0x08,0xa4,0x24,0x18,0xff,0xe4,0x35,0xf0,0xfe,
+0xef,0x2b,0xfb,0xee,0x3a,0xfa,0x90,0x91,0x5a,0xe0,0xfe,0xa3,0xe0,0xff,0xad,0x03,
+0xac,0x02,0x12,0x45,0x09,0xaa,0x06,0xab,0x07,0x90,0x91,0x15,0xe0,0x24,0x00,0xf5,
+0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x30,0xe7,0x08,0x90,0x91,0x19,0x74,0x02,0xf0,
+0x80,0x05,0xe4,0x90,0x91,0x19,0xf0,0xaf,0x03,0x90,0x91,0x11,0xea,0x8f,0xf0,0x12,
+0x42,0x81,0x90,0x91,0x5c,0xe0,0xfe,0xa3,0xe0,0xff,0x90,0x91,0x11,0xe0,0xfc,0xa3,
+0xe0,0xfd,0xd3,0x9f,0xec,0x9e,0x40,0x1b,0x90,0x91,0x5d,0xe0,0x24,0x01,0xff,0x90,
+0x91,0x5c,0xe0,0x34,0x00,0xfe,0xc3,0xed,0x9f,0xff,0xec,0x9e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x91,0x16,0xe0,0xff,0x24,0x40,0x60,0x04,0x24,0x20,0x70,0x27,
+0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x13,0x13,0x54,0x01,0x20,0xe0,0x02,0x61,0x9c,
+0xef,0x90,0x00,0x81,0xb4,0xa0,0x05,0xe0,0x44,0x04,0x80,0x03,0xe0,0x44,0x08,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x61,0x95,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x13,0x54,0x03,
+0x20,0xe0,0x02,0x61,0x9c,0x90,0x91,0x15,0xe0,0xff,0x24,0x00,0xf5,0x82,0xe4,0x34,
+0xfb,0xf5,0x83,0xe0,0x54,0x0c,0x64,0x08,0x70,0x72,0x90,0x91,0x19,0xe0,0xfe,0xef,
+0x2e,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x1e,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,
+0x64,0x88,0x70,0x58,0x74,0x1f,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x64,
+0x8e,0x70,0x49,0x90,0x91,0x19,0xe0,0xff,0x90,0x91,0x15,0xe0,0x2f,0xff,0x90,0x91,
+0x1a,0xe0,0x2f,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x19,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x64,0x03,0x70,0x26,0x74,0x1e,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,
+0xe0,0x90,0x00,0x81,0x30,0xe3,0x05,0xe0,0x44,0x01,0x80,0x03,0xe0,0x44,0x02,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x56,0xe0,0x44,0x80,0xf0,0x90,0x91,0x56,0xe0,
+0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x02,0x31,0x4c,0x71,0xc9,0xbf,0x01,
+0x13,0x90,0x91,0x11,0xe0,0xfe,0xa3,0xe0,0xff,0x12,0x44,0xb5,0x90,0x91,0x17,0xe0,
+0x04,0xf0,0x21,0xd9,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x56,0xe0,0xc4,0x13,0x13,
+0x13,0x54,0x01,0x30,0xe0,0x11,0xe0,0x44,0x80,0xf0,0x90,0x91,0x5e,0xe0,0xc4,0x54,
+0x0f,0x20,0xe0,0x03,0x7f,0x00,0x22,0x7f,0x01,0x22,0x8f,0x1f,0xe4,0x90,0x91,0x22,
+0xf0,0xe5,0x1f,0x14,0xfe,0x90,0x91,0x22,0xe0,0xff,0xc3,0x9e,0x50,0x0e,0xef,0x04,
+0xfd,0x12,0x34,0xb7,0x90,0x91,0x22,0xe0,0x04,0xf0,0x80,0xe5,0xe5,0x1f,0x14,0xff,
+0x7d,0xff,0x12,0x34,0xb7,0x90,0x91,0x22,0xe5,0x1f,0xf0,0x90,0x91,0x22,0xe0,0xc3,
+0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x34,0xb7,0x90,0x91,0x22,0xe0,0x04,
+0xf0,0x80,0xe8,0xad,0x1f,0x7f,0xff,0x02,0x34,0xb7,0xc3,0xee,0x94,0x01,0x40,0x0a,
+0x0d,0xed,0x13,0x90,0xfd,0x10,0xf0,0xe4,0x2f,0xff,0x22,0xc3,0xee,0x94,0x01,0x40,
+0x1e,0x90,0xfd,0x11,0xe0,0xb5,0x05,0x14,0x90,0x01,0x17,0xe0,0xb5,0x05,0x07,0x90,
+0xfd,0x11,0xe4,0xf0,0x80,0x06,0xed,0x04,0x90,0xfd,0x11,0xf0,0xe4,0x2f,0xff,0x22,
+0x0f,0x75,};
+
+u8 Rtl8192CUFwUMCACutWWImgArray[UMCACutWWImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x51,0x00,0x00,0x00,0x03,0x23,0x16,0x44,0x72,0x34,0x01,0x00,
+0x58,0x92,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0x9d,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0xcb,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5c,0xb6,0x00,0x00,0x00,0x00,0x00,0x02,0x5d,0x99,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,
+0x83,0x3a,0xf5,0x83,0xe0,0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,
+0x86,0xf0,0x08,0xe6,0x22,0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,
+0xe2,0x22,0xe5,0x83,0x2a,0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xf8,
+0xbb,0x01,0x11,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,
+0xf0,0xa3,0xf0,0x22,0x50,0x09,0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,
+0xfe,0x09,0xe9,0x25,0x82,0xc8,0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,
+0x4a,0xfe,0xed,0x49,0xfd,0xec,0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,
+0xfe,0xa3,0xe0,0xff,0x22,0xa4,0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,
+0x22,0xe0,0xfb,0xa3,0xe0,0xfa,0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,
+0xf9,0x25,0xf0,0xf0,0xe5,0x82,0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,
+0x22,0xeb,0xf0,0xa3,0xea,0xf0,0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,
+0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,
+0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,
+0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,
+0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0xb5,0xf0,
+0x06,0x74,0x03,0x93,0x68,0x60,0xe9,0xa3,0xa3,0xa3,0xa3,0x80,0xd8,0x02,0x43,0xdb,
+0x02,0x50,0x2a,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,
+0x08,0xdf,0xf4,0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,
+0xc4,0x54,0x0f,0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,
+0xe4,0x80,0x0b,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x20,0xe4,0x7e,
+0x01,0x93,0x60,0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,
+0xa3,0x60,0x01,0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,
+0xfa,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,
+0xf0,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,
+0x41,0x91,0x40,0x00,0x41,0x91,0x9c,0x00,0x41,0x91,0x23,0x80,0x41,0x91,0x24,0x80,
+0x41,0x91,0x9e,0x00,0x41,0x91,0x52,0x00,0x41,0x91,0x93,0x00,0x41,0x91,0x91,0x00,
+0x41,0x91,0x90,0x00,0x41,0x91,0x92,0x00,0x00,0xf0,0x90,0x91,0x30,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x65,0xeb,0xf0,0xa3,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,
+0x30,0x62,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,
+0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x59,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,
+0x92,0x74,0x02,0xf0,0x90,0x91,0x36,0x14,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x0c,
+0x50,0x02,0xf1,0x23,0x22,0x90,0x02,0x84,0xef,0xf0,0xa3,0xee,0xf0,0xa3,0x74,0x05,
+0xf0,0x22,0x7d,0x01,0xaf,0x6f,0xe1,0x27,0xf1,0xe6,0xbf,0x01,0x10,0x90,0x91,0x42,
+0xe0,0xff,0xe4,0xfd,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x8f,0x82,
+0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x72,0x7f,0x60,0x7e,0x01,0x80,
+0xed,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x54,0xfe,0xf0,0x02,0x50,0xd6,0x22,0xe4,
+0xf5,0x75,0x22,0x02,0x5f,0xe2,0x02,0x5f,0xe9,0xef,0x8e,0xf0,0x71,0x70,0x45,0x26,
+0x00,0x40,0x45,0x4e,0x00,0x80,0x45,0x79,0x01,0x00,0x45,0x8d,0x02,0x00,0x45,0xa5,
+0x04,0x00,0x00,0x00,0x45,0xc2,0xed,0x54,0x3f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x00,0x7f,0x40,0xef,0x2d,0xff,0xee,0x3c,0xfe,0xef,0x78,0x06,0xce,0xc3,0x13,0xce,
+0x13,0xd8,0xf9,0x78,0x06,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0x80,0x26,0xed,0x54,
+0x7f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x00,0x7f,0x80,0xef,0x2d,0xff,0xee,0x3c,
+0xfe,0xef,0x78,0x07,0xce,0xc3,0x13,0xce,0x13,0xd8,0xf9,0x78,0x07,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xfd,0xac,0x06,0x80,0x49,0xed,0x70,0x04,0xfe,0xff,0x80,0x04,
+0x7e,0x01,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x7d,0x00,0xfc,0x80,0x35,0xec,0x54,0x01,
+0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x02,0x7f,0x00,0xef,0x2d,0xee,0x3c,0xc3,
+0x13,0x7d,0x00,0x80,0x1a,0xec,0x54,0x03,0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x04,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x13,0x13,0x54,0x3f,0x7d,0x00,0x25,0xe0,0x25,
+0xe0,0xfc,0xae,0x04,0xaf,0x05,0x22,0x90,0x91,0x09,0x12,0x25,0x14,0x00,0x00,0x00,
+0x00,0x90,0x06,0xa9,0xe0,0x90,0x91,0x08,0xf0,0xe0,0x54,0xc0,0x70,0x0a,0x53,0x71,
+0xfe,0x53,0x71,0xfd,0x91,0xc2,0x80,0x47,0x90,0x91,0x26,0xe0,0x60,0x41,0x90,0x91,
+0x38,0xe0,0x70,0x3b,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x22,
+0x65,0x90,0x91,0x09,0x12,0x25,0x08,0x90,0x91,0x09,0x71,0x09,0xec,0x44,0x02,0xfc,
+0x90,0x91,0x09,0x12,0x25,0x08,0x90,0x91,0x09,0x71,0x09,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,0x08,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,
+0x91,0x08,0xe0,0x30,0xe6,0x13,0x43,0x71,0x01,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,
+0x04,0x91,0xc8,0x80,0x07,0x91,0x77,0x80,0x03,0x53,0x71,0xfe,0x90,0x91,0x08,0xe0,
+0x30,0xe7,0x16,0x43,0x71,0x02,0xe4,0x90,0x91,0x66,0x91,0x49,0x90,0x01,0x57,0x74,
+0x05,0xf0,0x90,0x91,0x3c,0x74,0x01,0xf0,0x22,0x53,0x71,0xfd,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x8b,0x60,0x8a,0x61,0x89,0x62,0x90,0x91,0x68,0x71,0x41,0xab,
+0x63,0xaa,0x64,0xa9,0x65,0x90,0x91,0x6b,0x71,0x41,0xaf,0x66,0x15,0x66,0xef,0x60,
+0x1b,0x90,0x91,0x6b,0xe4,0x75,0xf0,0x01,0x71,0x2a,0x12,0x24,0x62,0xff,0x90,0x91,
+0x68,0xe4,0x75,0xf0,0x01,0x71,0x2a,0xef,0x51,0x4d,0x80,0xde,0xab,0x60,0xaa,0x61,
+0xa9,0x62,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x6e,0x71,0x41,0x90,0x91,0x9e,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x51,0x5f,
+0x7f,0xaf,0x7e,0x01,0x12,0x64,0x1c,0xef,0x60,0x44,0x90,0x91,0x6e,0x71,0x21,0x8b,
+0x63,0x8a,0x64,0x89,0x65,0x75,0x66,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0xd1,0x6d,
+0x90,0x91,0x71,0x71,0x21,0x8b,0x63,0x8a,0x64,0x89,0x65,0x90,0x91,0x6e,0x71,0x21,
+0x12,0x24,0x62,0xff,0xc4,0x54,0x0f,0xf5,0x66,0x7b,0x01,0x7a,0x01,0x79,0xa2,0xd1,
+0x6d,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,
+0x92,0xaf,0x22,0x7d,0x01,0x7f,0x0c,0x90,0x91,0x95,0xed,0xf0,0x90,0x91,0x94,0xef,
+0xf0,0x54,0x0f,0xff,0xe5,0x6e,0x54,0x0f,0x6f,0x60,0x76,0x90,0x91,0x94,0xe0,0x30,
+0xe2,0x30,0xe5,0x6e,0x20,0xe2,0x05,0x7f,0x01,0x12,0x62,0x65,0xe5,0x6e,0x30,0xe3,
+0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,0x08,0x12,0x5a,0x3f,0xef,0x60,0x53,0x80,0x52,
+0xe5,0x6e,0x20,0xe3,0x4c,0x90,0x91,0x94,0xe0,0x30,0xe3,0x45,0xa3,0xe0,0xff,0x02,
+0x62,0x4a,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x0c,0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,
+0x08,0x12,0x5a,0x3f,0xef,0x60,0x2a,0xf1,0xb2,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x04,
+0x10,0x90,0x91,0x94,0xe0,0x20,0xe2,0x09,0x12,0x5b,0xb3,0xef,0x60,0x13,0x12,0x48,
+0xce,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x02,0x08,0x91,0xf1,0xef,0x60,0x03,0x12,0x63,
+0x56,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x04,0x7f,0x01,
+0xf1,0xc9,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x8f,0x67,0xf1,0xe6,0xbf,0x01,0x15,
+0x90,0x91,0x43,0x12,0x48,0x1e,0xad,0x07,0xac,0x06,0xaf,0x67,0x12,0x61,0xa3,0x90,
+0x04,0x1f,0x74,0x20,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,
+0x74,0xe6,0xf0,0x74,0x47,0xa3,0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,
+0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,
+0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xe0,0xff,
+0x7d,0x01,0x90,0x91,0x74,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,
+0x70,0x60,0x04,0xe4,0xff,0x11,0xb3,0x90,0x91,0x74,0xe0,0x30,0xe0,0x09,0x90,0x91,
+0x76,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,0x91,0x74,0xe0,0xff,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,0x91,0x75,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,
+0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,
+0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x91,0x76,0xa3,
+0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x91,0x76,0xe0,0xfe,0xa3,
+0xe0,0xff,0x22,0xef,0x60,0x0b,0x90,0x91,0x51,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,
+0x09,0x90,0x91,0x51,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x68,0x87,0x22,0x90,0x01,
+0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x68,0x46,0xef,0x70,0x06,
+0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x31,0x9d,0xe5,0x70,0x60,
+0x04,0x7f,0x01,0x11,0xb3,0x51,0x0c,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0xef,0x64,
+0x01,0x70,0x42,0x7d,0x78,0x7f,0x02,0x12,0x31,0x2c,0x7d,0x02,0x7f,0x03,0x12,0x31,
+0x2c,0x90,0x01,0x36,0x74,0x03,0xf0,0xfd,0x7f,0x02,0x12,0x31,0x9d,0x7d,0x10,0x7f,
+0x03,0x12,0x31,0x49,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x12,
+0x47,0x23,0xe4,0xff,0x11,0xb3,0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,
+0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,
+0x7b,0xff,0x12,0x31,0x9d,0x7d,0x02,0x7f,0x03,0x12,0x31,0x9d,0x7d,0x10,0x7f,0x03,
+0x12,0x31,0x49,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,0x07,
+0xf0,0x12,0x64,0x11,0xe5,0x6d,0x20,0xe0,0x05,0xe4,0x90,0x91,0x29,0xf0,0x22,0x8b,
+0x0e,0x8a,0x0f,0x89,0x10,0x12,0x62,0x3e,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x12,0x24,
+0x62,0xf5,0x70,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,0x40,
+0x7f,0x01,0x80,0x3a,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,0x12,0x42,0x20,
+0xfd,0xe4,0xff,0x31,0xe1,0x80,0x27,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0xe1,0x1f,0x80,0x13,0xab,0x0e,0xaa,0x0f,0xa9,
+0x10,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0xe1,0xe4,0xff,0x11,0xfe,
+0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x91,0x39,0x74,0x01,0xf0,0x80,
+0x16,0xed,0x70,0x0a,0x90,0x91,0x35,0xe0,0x90,0x91,0x39,0xf0,0x80,0x05,0x90,0x91,
+0x39,0xed,0xf0,0x90,0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x22,0x7f,0x78,0x7e,0x08,
+0x12,0x22,0x65,0x90,0x90,0xd8,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,
+0x90,0x90,0xdc,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0xe0,
+0x12,0x25,0x08,0x90,0x91,0x51,0xe0,0x90,0x90,0xd8,0xb4,0x01,0x0d,0x12,0x43,0x09,
+0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x09,0xef,0x54,0xc7,
+0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,0x2b,0x08,0x90,
+0x90,0xdc,0x12,0x43,0x09,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x90,0xe0,0x12,0x43,0x09,0xef,0x44,0x02,
+0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,0x08,0x7f,
+0x70,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xe4,0x12,0x25,0x08,0x90,0x80,0x96,0x12,
+0x25,0x14,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x68,
+0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x30,0x2c,0x90,0x91,0x51,
+0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe4,0xfd,
+0x7f,0x01,0x12,0x30,0x2c,0x90,0x00,0x11,0xe0,0x54,0xf6,0xf0,0x80,0x08,0xf4,0xff,
+0x90,0x00,0x43,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,
+0xfe,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x9b,
+0xed,0xf0,0x90,0x91,0x9a,0xef,0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,
+0xf0,0x51,0xe6,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xff,0x90,0x00,0x46,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x9b,0xe0,
+0x60,0x16,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xff,0x90,0x00,0x45,0x80,0x66,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,0x80,0x6b,0x90,
+0x91,0x9a,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xc4,0x54,0xf0,0x51,0xde,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,
+0xe6,0x90,0x91,0x9b,0xe0,0x60,0x1b,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x42,0xe0,0x4f,
+0x80,0x1a,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,0x51,0xe6,0xd0,
+0xd0,0x92,0xaf,0x22,0xf0,0x90,0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,0x00,0xed,0xf0,0x51,0xe6,0xd0,0xd0,
+0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,0x66,0x24,0x02,0x60,0x02,0x81,0xaa,
+0x90,0x90,0xf3,0x74,0x02,0xf0,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,
+0xee,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x45,0xe0,
+0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,0x90,0xf3,0xf0,0x90,0x90,0xef,0x12,
+0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x90,
+0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x54,0xef,
+0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,
+0x90,0x90,0xf3,0x74,0x01,0xf0,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,
+0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x71,0xee,0x90,
+0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x71,0xee,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0x90,0x90,0xf5,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,
+0x90,0xf4,0xf0,0x12,0x24,0x62,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf8,0xf0,0x90,0x05,
+0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,
+0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x90,0xf4,0xe0,0xff,0x12,0x6e,0x67,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x90,0x90,0xf5,0xe0,0x70,0x02,0xa1,0xb2,
+0x90,0x90,0xf4,0xe0,0x70,0x02,0xa1,0xb2,0x90,0x90,0xf8,0xe0,0x70,0x02,0xa1,0xb2,
+0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x91,0x07,0x74,0x01,0xf0,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x71,0xe5,0x90,0x00,0x46,0xe0,0x44,0x01,
+0xfd,0x7f,0x46,0x71,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x71,
+0xee,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,
+0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,
+0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,
+0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,0x31,0xb7,
+0x80,0x2b,0x90,0x90,0xf5,0xe0,0x70,0x2d,0x90,0x91,0x07,0x71,0xe4,0x90,0x00,0x46,
+0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x71,0xee,0x90,0x05,0x22,0xe4,0xf0,0xa2,0xaf,0x33,
+0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x31,0x49,0x90,0x91,0x1c,
+0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x0e,0x8a,0x0f,0x89,0x10,0x90,0x00,0x02,0x12,
+0x42,0x20,0x90,0x90,0xf6,0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x90,0xed,0x74,0x01,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0xef,0x12,0x25,0x08,0xab,0x0e,0xaa,
+0x0f,0xa9,0x10,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,0x78,0x1a,
+0x12,0x24,0xf5,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x90,0xef,0x12,0x43,
+0x09,0xec,0x54,0x03,0xfc,0x12,0x42,0xfc,0x90,0x90,0xf9,0x12,0x25,0x08,0x90,0x05,
+0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x90,0xed,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x22,
+0x65,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,0x90,0xef,0x12,0x25,0x08,0x90,
+0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,
+0x2b,0x08,0x90,0x90,0xf6,0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0x71,0xee,0x90,
+0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,
+0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x48,
+0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x54,0xef,0xfd,0x7f,
+0x46,0x71,0xee,0xe4,0x90,0x90,0xf3,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,
+0x71,0xee,0x7d,0xff,0x7f,0x55,0x71,0xee,0x7d,0xff,0x7f,0x56,0x71,0xee,0x7d,0xff,
+0x7f,0x57,0x61,0xee,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x71,0xee,0xe4,0xfd,
+0x7f,0x51,0x71,0xee,0xe4,0xfd,0x7f,0x52,0x71,0xee,0xe4,0xfd,0x7f,0x53,0x61,0xee,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x22,0xed,0xf0,0x90,0x91,0x21,0xef,
+0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,
+0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,
+0x5f,0xf0,0x80,0x17,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x46,0x80,0x59,0x90,0x91,0x21,0xe0,0x24,0xf8,0xf0,0xa3,0xe0,0x70,0x1d,0x90,
+0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,
+0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,0x1a,0x90,0x91,0x21,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,
+0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,
+0x51,0xe6,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x91,0x9f,0xf0,0xe0,
+0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x71,0xee,0x90,0x91,0x9f,0xe0,0x44,0xb0,
+0xfd,0x7f,0x49,0x61,0xee,0x12,0x47,0xe6,0xbf,0x01,0x10,0x90,0x02,0x09,0xe0,0xff,
+0x7d,0x01,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x75,0x28,0x33,0xe4,
+0xf5,0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,
+0xf0,0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x91,0x0e,0xf0,0xa3,
+0xf0,0x75,0x8e,0x02,0xf1,0x25,0xd1,0xe8,0x90,0x91,0x4f,0xef,0xf0,0xf1,0x0b,0x90,
+0x91,0x51,0xef,0xf0,0xf1,0x60,0x90,0x91,0x3d,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,
+0x57,0xf1,0x02,0x12,0x61,0xc4,0x12,0x2e,0x01,0x12,0x44,0xff,0x11,0x0c,0xf1,0x36,
+0xd1,0xfb,0xd1,0xd0,0x12,0x44,0xfe,0x31,0x13,0x12,0x44,0xf4,0x12,0x6e,0x09,0x90,
+0x91,0x10,0xe5,0xd9,0xf0,0x12,0x4e,0xb9,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,
+0xf0,0x12,0x4a,0xe6,0x75,0xe8,0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x91,0x0e,0xe0,
+0x64,0x01,0xf0,0x24,0x2a,0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x57,0x30,
+0xe2,0x10,0x12,0x5f,0xf0,0xbf,0x01,0x0a,0xc2,0xaf,0x53,0x57,0xfb,0xd2,0xaf,0x12,
+0x71,0x97,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,0xef,0xd2,0xaf,0x12,0x60,
+0x2d,0x90,0x90,0xf7,0xe0,0x70,0x03,0x12,0x70,0x74,0x11,0xe7,0x90,0x91,0x3f,0xe0,
+0x90,0x01,0xba,0xf0,0x80,0xb6,0xe4,0x90,0x91,0x55,0xf0,0x90,0x91,0x53,0xe0,0x54,
+0x7f,0xf0,0xa3,0x74,0x0a,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x25,0x14,0x70,0x1b,
+0x7b,0x01,0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x12,0x67,0xe4,0xbf,0x01,0x09,
+0x90,0x06,0x35,0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0xe1,0x17,0xe4,0x90,0x06,
+0x34,0xf0,0x22,0x90,0x91,0x56,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x7f,0xf0,0x90,0x01,
+0x17,0xe0,0xfe,0x90,0x01,0x16,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,
+0x5c,0xf0,0xa3,0xef,0xf0,0x90,0x01,0x04,0xe0,0x54,0x0f,0x90,0x91,0x1c,0xf0,0xe0,
+0xff,0x74,0x40,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0x90,0x91,0x5b,0xf0,0xee,0x90,0x91,0x5a,0xf0,0x90,0x91,0x5e,0xe0,0x54,0xfe,
+0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xfb,0xf0,0xe0,0x54,0xf7,0xf0,0xe0,0x54,0xef,
+0xf0,0xe0,0x54,0xdf,0xf0,0xe0,0x54,0xbf,0xf0,0xe0,0x54,0x7f,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xf7,0xf0,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x12,0x24,0x62,0x54,0x01,0xff,0x90,0x91,0x56,
+0xe0,0x54,0xfe,0x4f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x57,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x58,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x1a,
+0x90,0x06,0x09,0xe0,0x54,0xfe,0xf0,0x90,0x02,0x86,0xe0,0x44,0x04,0xf0,0x43,0x57,
+0x04,0x7d,0x08,0xe4,0xff,0x12,0x31,0x9d,0x80,0x12,0x7d,0x08,0xe4,0xff,0x12,0x31,
+0x2c,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x31,0xf1,0x31,0x13,0xd0,0xd0,0x92,0xaf,
+0x22,0x90,0x06,0x90,0xe4,0xf0,0x21,0x5a,0x90,0x91,0x19,0x12,0x43,0x41,0xef,0x12,
+0x43,0x4a,0x52,0x30,0x01,0x52,0x39,0x02,0x52,0x5b,0x03,0x52,0x64,0x09,0x52,0x6c,
+0x0c,0x52,0x75,0x0d,0x52,0x7d,0x0e,0x52,0x8e,0x1a,0x52,0x96,0x2c,0x52,0x41,0x2d,
+0x52,0x4a,0x2e,0x52,0x9e,0x30,0x52,0x53,0x3b,0x52,0x86,0x3c,0x00,0x00,0x52,0xa6,
+0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x64,0x72,0x90,0x91,0x19,0x12,0x43,0x21,0xc1,
+0xf5,0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x65,0x8d,0x90,0x91,0x19,0x12,0x43,0x21,
+0x02,0x65,0xd5,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x4b,0x90,0x91,0x19,0x12,0x43,
+0x21,0x02,0x66,0x0e,0x90,0x91,0x19,0x12,0x43,0x21,0x80,0x42,0x90,0x91,0x19,0x12,
+0x43,0x21,0x02,0x4c,0xab,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x98,0x90,0x91,0x19,
+0x12,0x43,0x21,0x02,0x4d,0xe6,0x90,0x91,0x19,0x12,0x43,0x21,0x21,0x90,0x90,0x91,
+0x19,0x12,0x43,0x21,0xa1,0x9b,0x90,0x91,0x19,0x12,0x43,0x21,0x81,0x7a,0x90,0x91,
+0x19,0x12,0x43,0x21,0xe1,0x78,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1c,0x12,0x43,
+0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x42,0xcf,0x12,
+0x24,0x62,0xff,0x60,0x2c,0xb5,0x72,0x16,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,
+0x01,0x12,0x42,0x97,0x65,0x74,0x70,0x04,0xe5,0x73,0x65,0xf0,0x60,0x23,0x90,0x91,
+0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xff,0xae,0xf0,0x71,0x26,0x80,
+0x10,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x24,0x62,0x65,0x72,0x60,0x03,0x12,0x44,
+0xe8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1f,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x72,
+0x01,0x8e,0x73,0xf5,0x74,0xe4,0xfd,0x7f,0x0b,0x12,0x4f,0x10,0xe4,0xfd,0x7f,0x02,
+0x12,0x4f,0x10,0x71,0x6a,0xe4,0xff,0x71,0xcc,0xe4,0xf5,0x76,0x90,0x01,0xc9,0xe5,
+0x76,0xf0,0x90,0x91,0x1f,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,
+0x45,0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x30,0x62,0x7f,0x0b,0x71,0xd9,0xef,0x65,
+0x75,0x60,0x10,0xe5,0x75,0xb4,0x01,0x05,0xe4,0xf5,0x75,0x80,0x03,0x75,0x75,0x01,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe5,0x72,0x64,0x01,0x70,0x3f,0x71,0x6a,0xbf,0x01,
+0x04,0x7f,0x01,0x71,0xcc,0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0x12,0x4b,
+0xee,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x12,0x4b,0xee,0x90,0x00,0x46,
+0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x7f,0x02,0x71,0xd9,0x8f,0x76,0x90,
+0x01,0xc9,0xe5,0x76,0xf0,0xb4,0x01,0x03,0x12,0x4f,0xd7,0x22,0x90,0x01,0xca,0xe5,
+0x75,0xf0,0xef,0x60,0x03,0x12,0x4f,0xd7,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0xa0,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,0x12,
+0x4a,0xe6,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,0xef,
+0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,0x80,
+0x44,0x90,0x91,0xa0,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0x12,0x4a,0xde,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,
+0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,
+0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,
+0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0xf5,0x10,0x75,0x11,0x04,0xf5,0x12,0xf5,0x14,0xf5,0x15,0x90,0x02,0x09,
+0xe0,0xff,0x12,0x24,0x62,0xfe,0xef,0x2e,0xf5,0x13,0x30,0xe0,0x08,0x75,0x0e,0x00,
+0x75,0x0f,0x80,0x80,0x05,0xe4,0xf5,0x0e,0xf5,0x0f,0xe5,0x13,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x74,0x20,0x25,0x10,0xf5,0x10,0xad,0x0f,0xe5,0x10,0x2d,0xff,0x24,0x01,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x91,0x47,0xf0,0x74,0x02,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x10,0x2d,0x24,0x03,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x91,0x48,0xf0,0xa3,0xef,
+0xf0,0x7f,0x04,0xe5,0x10,0x25,0x0f,0x2f,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0xfe,0x74,0x46,0x2f,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xee,0xf0,0x0f,
+0xbf,0x08,0xe0,0x12,0x66,0x56,0xef,0x70,0x3f,0x90,0x01,0xc3,0xe0,0x60,0x25,0xc3,
+0xe5,0x15,0x94,0xe8,0xe5,0x14,0x94,0x03,0x40,0x09,0x90,0x01,0xc6,0xe0,0x44,0x10,
+0xf0,0x80,0x63,0x05,0x15,0xe5,0x15,0x70,0x02,0x05,0x14,0x7f,0x0a,0x7e,0x00,0x12,
+0x32,0x15,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,0xe2,0x05,0x74,0xfe,
+0xf0,0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x10,0xb4,0x78,0x23,0xe4,0xf5,0x10,
+0x05,0x13,0xe5,0x0f,0x64,0x80,0x45,0x0e,0x70,0x06,0xf5,0x0e,0xf5,0x0f,0x80,0x06,
+0x75,0x0e,0x00,0x75,0x0f,0x80,0xe5,0x13,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x80,0x06,
+0x74,0x08,0x25,0x10,0xf5,0x10,0xe5,0x12,0x15,0x12,0x70,0x02,0x15,0x11,0xe5,0x12,
+0x45,0x11,0x60,0x02,0x81,0xb8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1c,0x12,0x43,
+0x41,0x12,0x24,0x62,0xff,0x54,0x01,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xfe,0x4e,0xf0,
+0xef,0x54,0x04,0xff,0xe0,0x54,0xfb,0x4f,0xf0,0x12,0x24,0x62,0xff,0x54,0x02,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xfd,0x4e,0xf0,0xef,0x54,0x08,0xff,0xe0,0x54,0xf7,0x4f,
+0xf0,0x12,0x24,0x62,0xff,0x54,0x10,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xef,0x4e,0xf0,
+0xef,0x54,0x20,0xff,0xe0,0x54,0xdf,0x4f,0xf0,0x12,0x24,0x62,0xff,0x54,0x40,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xbf,0x4e,0xf0,0xef,0x54,0x80,0xff,0xe0,0x54,0x7f,0x4f,
+0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x60,0xf0,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x91,0x5f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x61,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0x54,0x02,0xff,0xe0,0x54,0xfd,0x4f,0xf0,
+0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x04,0xff,0x90,0x91,0x61,0xe0,0x54,0xfb,0x4f,
+0xf0,0x90,0x91,0x5e,0xe0,0x54,0x01,0x90,0x01,0xb8,0xf0,0x90,0x91,0x5e,0xe0,0xff,
+0xc4,0x13,0x54,0x01,0x90,0x01,0xb9,0xf0,0x90,0x91,0x61,0xe0,0x54,0x01,0x90,0x01,
+0xba,0xf0,0xa3,0x74,0xff,0xf0,0x12,0x24,0x62,0x20,0xe0,0x02,0x21,0xf1,0xe4,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x24,0x62,0xff,0xc3,
+0x13,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x02,0xf0,0xef,0x13,0x13,0x54,0x3f,
+0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x04,0xf0,0x12,0x24,0x62,0x13,0x13,0x13,
+0x54,0x1f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x08,0xf0,0x90,0x91,0x61,0xe0,
+0x30,0xe0,0x1c,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,
+0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,
+0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,0xa3,
+0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,0x01,
+0x60,0x02,0x7f,0x00,0x22,0x12,0x24,0x62,0xf5,0x6d,0x22,0x90,0x01,0x64,0x74,0xa0,
+0xf0,0x22,0x90,0x91,0x51,0xe0,0x90,0x90,0xe8,0xf0,0x22,0x90,0x00,0xf3,0xe0,0x7f,
+0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0xe4,0x90,0x91,0x4e,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,
+0xfd,0x7f,0x80,0x02,0x4b,0xee,0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,
+0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,0xe4,0xf0,0x22,0x12,0x24,0x62,0x60,0x02,
+0x80,0x01,0xe4,0x90,0x91,0x31,0xf0,0x90,0x91,0x31,0xe0,0x90,0x01,0xe7,0xf0,0x22,
+0x90,0x91,0x51,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x05,0x7e,0xfd,
+0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x12,0x24,0x62,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x53,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0xc3,0x13,0x30,0xe0,0x0a,0x90,0x00,0x01,
+0x12,0x42,0x20,0x90,0x91,0x54,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,
+0xf7,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x0e,0xc2,
+0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4b,0xee,0x7d,0x40,0x7f,
+0x01,0x12,0x31,0x66,0xe5,0x0e,0x24,0xff,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,
+0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,
+0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xcb,0xf0,0x74,0x57,
+0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,
+0xf5,0x2e,0xa3,0xe0,0x55,0x2b,0xf5,0x2f,0xe5,0x2c,0x30,0xe0,0x5a,0x90,0x01,0x34,
+0x74,0x01,0xf0,0x85,0xd9,0x54,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,
+0x91,0x3b,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,
+0x51,0x30,0xef,0x64,0x01,0x70,0x30,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,
+0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5b,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x91,0x37,0xf0,0x80,0x08,0x51,
+0x30,0xbf,0x01,0x03,0x12,0x44,0xc2,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,
+0x02,0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,
+0x5c,0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0x5c,0xe5,0x2c,0x30,0xe3,
+0x10,0x90,0x01,0x34,0x74,0x08,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x03,0x43,0x57,
+0x04,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,0xf0,0x43,0x57,0x10,0xe5,
+0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,0xe0,0x54,0xdf,0xf0,0x90,
+0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,0x12,0x4e,0xe4,0x90,0x00,
+0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4a,0xe6,0x80,0xfe,0xe5,0x2c,0x30,0xe6,0x06,0x90,
+0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x13,0x90,0x91,0x50,0x74,0x01,0xf0,
+0x90,0x01,0x36,0xf0,0x91,0x23,0x51,0x87,0x90,0x91,0x50,0xe4,0xf0,0xe5,0x2e,0x30,
+0xe1,0x3c,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x90,0x01,0x02,0xe0,0x54,
+0x03,0x64,0x01,0x70,0x29,0x90,0x01,0x37,0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,
+0x91,0x40,0xe4,0xf0,0x80,0x18,0x90,0x91,0x40,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,
+0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x4f,0xf5,0xe5,0x2e,
+0x30,0xe2,0x19,0x90,0x01,0x36,0x74,0x04,0xf0,0x90,0x91,0x3a,0xe4,0xf0,0x90,0x05,
+0x58,0x74,0x03,0xf0,0x51,0xd8,0x90,0x91,0x3f,0xe0,0x04,0xf0,0xe5,0x2e,0x30,0xe3,
+0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x6d,0x64,0x01,0x70,0x1c,0xe5,0x70,0x60,
+0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x66,0xe4,
+0x12,0x44,0x49,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,0x2b,0x90,0x01,
+0x36,0x74,0x10,0xf0,0xe5,0x6d,0xb4,0x01,0x20,0xe5,0x70,0x60,0x1c,0x90,0x01,0x57,
+0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x3c,0xe4,0xf0,0x53,0x71,0xfd,
+0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2e,0x30,0xe5,0x1f,0x90,0x01,
+0x36,0x74,0x20,0xf0,0xe5,0x6d,0xb4,0x01,0x14,0xe5,0x70,0x60,0x10,0x90,0x91,0x3b,
+0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xc8,0x80,0x03,0x12,0x44,0x77,0xe5,0x2e,0x30,
+0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x10,0xe5,0x70,0x60,
+0x0c,0x53,0x71,0xfe,0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2f,0x30,
+0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x71,0x7e,0x74,0xcb,0x04,0x90,0x01,0xc4,
+0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,
+0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,
+0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,0x00,0x22,0x51,
+0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x91,
+0x37,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x91,0x36,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x6f,0x54,0x0f,0xd3,0x94,
+0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,
+0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x30,0xe0,0x49,0xe5,0x6d,
+0x64,0x01,0x70,0x43,0x90,0x91,0x52,0xe0,0x04,0xf0,0xe5,0x70,0x64,0x03,0x60,0x05,
+0xe5,0x70,0xb4,0x06,0x0d,0x90,0x91,0x52,0xe0,0xff,0x74,0x01,0xd3,0x9f,0x50,0x14,
+0x80,0x07,0x90,0x91,0x52,0xe0,0xb4,0x0a,0x0b,0x90,0x91,0x55,0xe0,0x04,0xf0,0xe4,
+0x90,0x91,0x52,0xf0,0x90,0x91,0x55,0xe0,0xff,0x90,0x91,0x54,0xe0,0xb5,0x07,0x07,
+0x71,0x4e,0xe4,0x90,0x91,0x55,0xf0,0x22,0xe5,0x6d,0x64,0x01,0x70,0x63,0xe5,0x70,
+0x60,0x5f,0xe5,0x70,0x64,0x02,0x60,0x06,0xe5,0x70,0x64,0x05,0x70,0x27,0x90,0x06,
+0xab,0xe0,0x90,0x91,0x27,0xf0,0x90,0x06,0xaa,0xe0,0x90,0x91,0x39,0xf0,0x90,0x91,
+0x27,0xe0,0x70,0x07,0x90,0x91,0x39,0xe0,0xff,0x80,0x05,0x90,0x91,0x27,0xe0,0xff,
+0x90,0x91,0x27,0xef,0xf0,0x90,0x91,0x29,0xe0,0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,
+0x91,0x28,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x71,0xfd,
+0x53,0x71,0xef,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0xc7,0x71,
+0x42,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xd0,0xd0,0x92,0xaf,0x22,0xe5,0x6e,
+0x30,0xe3,0x04,0xe4,0xff,0x80,0x02,0x7f,0x01,0x02,0x47,0xc9,0x90,0x91,0x08,0xe0,
+0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x58,
+0x90,0x91,0x71,0x12,0x43,0x41,0x0b,0x7a,0x91,0x79,0x08,0x02,0x46,0xb7,0x90,0x91,
+0x80,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,
+0x21,0x90,0x91,0x3b,0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0d,0xe5,0x6e,0x54,
+0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0xe4,0xff,0x12,
+0x48,0xb3,0x22,0x51,0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,
+0x80,0x58,0xe5,0x71,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,
+0xe5,0x6f,0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,
+0x39,0xe5,0x71,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x71,
+0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x91,0x29,0xe0,0x60,
+0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x91,0x31,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,
+0x7f,0x00,0x22,0xe4,0xfb,0x90,0x91,0x78,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe5,
+0x70,0x70,0x02,0x81,0xb5,0xe5,0x6d,0x64,0x01,0x70,0x7a,0xe5,0x70,0x14,0x60,0x2b,
+0x24,0xfd,0x60,0x27,0x24,0x02,0x24,0xfb,0x50,0x02,0x80,0x21,0x90,0x91,0x27,0xe0,
+0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,0x60,0x14,0x90,0x91,0x27,0xe0,0x70,0x08,0x90,
+0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x45,
+0x43,0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,
+0xff,0x90,0x91,0x34,0xe0,0x2f,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,
+0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0x90,
+0x91,0x2e,0xe0,0x60,0x10,0x90,0x91,0x2c,0xe0,0x90,0x07,0x78,0x60,0x04,0x74,0x0d,
+0xf0,0x22,0x74,0x09,0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,
+0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0x53,0x91,0xef,
+0x90,0x00,0x51,0xe0,0xff,0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,
+0xff,0x90,0x00,0x56,0xe0,0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,
+0x74,0x10,0xf0,0xe5,0x3d,0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,
+0x30,0xe6,0x1b,0x90,0x00,0x55,0x74,0x40,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x0b,0x90,0x90,0xf3,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4c,0x03,0xe5,0x3d,
+0x30,0xe7,0x15,0x90,0x00,0x55,0x74,0x80,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x05,0x7f,0x02,0x12,0x4c,0x03,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,
+0x74,0x01,0xf0,0xe5,0x3e,0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,
+0x30,0xe2,0x06,0x90,0x00,0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,
+0x56,0x74,0x08,0xf0,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,
+0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,
+0xc0,0x05,0xc0,0x06,0xc0,0x07,0x75,0x0d,0x00,0x90,0x01,0xc4,0x74,0x99,0xf0,0x74,
+0x5d,0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,
+0x55,0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,
+0xe5,0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x08,
+0x90,0x01,0x3c,0x74,0x02,0xf0,0xf1,0x57,0xe5,0x34,0x30,0xe2,0x3a,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,
+0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,
+0x59,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x08,0x90,
+0x91,0x37,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe3,0x3a,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe1,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,
+0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x12,0x44,0x59,
+0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x08,0x90,0x91,
+0x36,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,
+0xf0,0x12,0x53,0x86,0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,
+0x6e,0xb9,0xe5,0x35,0x30,0xe0,0x5a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,
+0xe0,0x44,0x7f,0xf0,0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x0d,0xb4,0x01,0x02,0x80,
+0x1c,0xe5,0x0d,0xb4,0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x0d,0xb4,0x04,0x05,
+0x90,0x00,0x83,0x80,0x08,0xe5,0x0d,0xb4,0x0c,0x08,0x90,0x00,0x83,0xe0,0xf5,0x6f,
+0x80,0x06,0x90,0x01,0xbe,0xe0,0x04,0xf0,0x90,0x01,0xbb,0xe5,0x6f,0xf0,0xe5,0x6f,
+0x30,0xe0,0x03,0xa3,0x80,0x03,0x90,0x01,0xbd,0xe0,0x04,0xf0,0xf1,0x38,0x12,0x44,
+0xc2,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,0x04,0xf0,0xe5,0x36,0x30,0xe0,
+0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,0x74,
+0x02,0xf0,0x74,0x99,0x04,0x90,0x01,0xc4,0xf0,0x74,0x5d,0xa3,0xf0,0xd0,0x07,0xd0,
+0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,
+0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xe5,0x6f,0x30,0xe6,0x19,0xe5,0x6f,0x54,
+0x0f,0xff,0x90,0x91,0x24,0xe0,0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,
+0x91,0x24,0xf0,0x53,0x6f,0xbf,0x22,0xe4,0x90,0x91,0x0d,0xf0,0xe5,0x70,0x70,0x02,
+0xe1,0xe1,0x90,0x91,0x3c,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x71,0xfd,0xe5,0x71,0x54,
+0x07,0x70,0x6e,0x80,0x69,0x90,0x91,0x28,0xe0,0x04,0xf0,0x53,0x71,0xef,0x90,0x91,
+0x3a,0xe0,0x04,0xf0,0x90,0x91,0x0d,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,
+0x33,0xfc,0x90,0x91,0x3a,0xe0,0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,
+0x24,0x02,0xff,0xe4,0x3e,0xfe,0x90,0x91,0x3a,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,
+0x06,0x90,0x05,0x58,0xe0,0x04,0xf0,0xe9,0xff,0x90,0x91,0x2f,0xe0,0x2f,0xff,0xe4,
+0x33,0xfe,0x90,0x91,0x28,0xe0,0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,
+0x0d,0xe5,0x6d,0xb4,0x01,0x0b,0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,
+0xc2,0x22,0x8f,0x20,0x8c,0x21,0x8d,0x22,0x22,0x8f,0x23,0x8c,0x24,0x8d,0x25,0x22,
+0xe4,0x90,0x91,0x11,0xf0,0xa3,0xf0,0x90,0x02,0x86,0xe0,0x20,0xe1,0x2c,0xc3,0x90,
+0x91,0x12,0xe0,0x94,0x20,0x90,0x91,0x11,0xe0,0x94,0x03,0x40,0x0a,0x90,0x01,0xc6,
+0xe0,0x44,0x20,0xf0,0x7f,0x00,0x22,0x90,0x91,0x11,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x7f,0x01,0x7e,0x00,0x12,0x32,0x15,0x80,0xcd,0x7f,0x01,0x22,0x90,0x01,0xcc,
+0xe0,0x54,0x0f,0x90,0x91,0x11,0xf0,0x90,0x91,0x11,0xe0,0xfd,0x70,0x02,0x21,0x6f,
+0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,
+0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0x21,0x68,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x15,0xe0,0x90,0x91,0x12,0xf0,0x75,0x63,
+0x01,0x75,0x64,0x91,0x75,0x65,0x12,0x75,0x66,0x01,0x7b,0x01,0x7a,0x91,0x79,0x13,
+0x12,0x46,0x6d,0x90,0x91,0x13,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x90,0x91,
+0x9c,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,0x15,0xe0,0x90,
+0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,0x12,0x43,0x15,
+0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,
+0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,
+0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x17,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,
+0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x18,0xf0,0x80,0x33,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,
+0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,
+0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x91,0x79,0x14,0x12,0x51,0xf8,0x90,0x91,0x11,
+0xe0,0xff,0x90,0x91,0x9c,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0x5f,0x90,0x91,0x11,0xf0,0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,0x91,0x9c,0xe0,
+0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x37,0x90,0x01,0xc6,0xe0,0x44,0x02,0xf0,0x22,
+0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,
+0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,
+0x54,0xef,0xf0,0x22,0xe4,0xf5,0x6d,0xf5,0x71,0xf5,0x70,0x75,0x6f,0x0c,0x75,0x6e,
+0x0c,0x90,0x91,0x3b,0xf0,0x90,0x91,0x37,0xf0,0x90,0x91,0x36,0xf0,0x90,0x91,0x39,
+0x04,0xf0,0x90,0x91,0x27,0xf0,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,0x29,0xf0,0x90,
+0x91,0x34,0x74,0x07,0xf0,0xe4,0x90,0x91,0x28,0xf0,0x90,0x91,0x32,0xf0,0xa3,0x74,
+0x03,0xf0,0x90,0x91,0x2f,0x74,0x0a,0xf0,0xa3,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,
+0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,0xe4,0x90,0x91,0x2b,0xf0,0x90,0x91,0x25,
+0xf0,0x90,0x91,0x50,0xf0,0x90,0x91,0x31,0xf0,0x90,0x91,0x3a,0xf0,0x90,0x91,0x26,
+0xf0,0x90,0x91,0x38,0xf0,0x90,0x91,0x2e,0xf0,0x90,0x91,0x2c,0xf0,0x22,0xe4,0x90,
+0x91,0x3c,0xf0,0x90,0x91,0x28,0xf0,0xf5,0x71,0x22,0x90,0x06,0x04,0xe0,0x54,0xbf,
+0xf0,0xef,0x60,0x0a,0xe5,0x6d,0xb4,0x01,0x05,0xe4,0xff,0x12,0x47,0xc9,0x53,0x6e,
+0xf0,0x43,0x6e,0x0c,0x22,0x90,0x91,0x9d,0xef,0xf0,0x51,0x7e,0x90,0x91,0x9d,0xe0,
+0x60,0x05,0x90,0x05,0x22,0xe4,0xf0,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x90,0x00,
+0x11,0xe0,0x44,0x09,0xf0,0x12,0x4a,0xe6,0x90,0x90,0xd8,0x12,0x43,0x09,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0xdc,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x90,
+0xe0,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,
+0x08,0x90,0x90,0xe4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x03,0x2d,0x95,0xe4,0xfd,
+0xff,0x12,0x30,0x2c,0x90,0x91,0x51,0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,0x12,0x25,
+0x14,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x30,0x2c,0x22,0x8f,0x77,0xe4,
+0x90,0x91,0x96,0xf0,0xa3,0xf0,0x90,0x01,0x09,0xe0,0x7f,0x00,0x30,0xe7,0x02,0x7f,
+0x01,0xef,0x65,0x77,0x60,0x3e,0xc3,0x90,0x91,0x97,0xe0,0x94,0x88,0x90,0x91,0x96,
+0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,0x44,0x80,0xf0,0x22,0x90,0x91,0x96,
+0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,0x7e,0x00,0x12,0x32,0x15,0xd3,0x90,
+0x91,0x97,0xe0,0x94,0x32,0x90,0x91,0x96,0xe0,0x94,0x00,0x40,0xb9,0x90,0x01,0xc7,
+0xe0,0x30,0xe0,0xb2,0x22,0x22,0x53,0x6e,0xf0,0x43,0x6e,0x01,0x71,0x55,0x71,0x67,
+0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0x22,0x8f,0x78,0x12,0x47,0xe6,0xef,0x64,0x01,
+0x70,0x2e,0x90,0x91,0x44,0x12,0x48,0x1e,0xe5,0x78,0x60,0x10,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0xe4,0xfb,0x90,0x91,0x7c,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe5,0x70,0x60,
+0x5f,0xe5,0x6d,0x64,0x01,0x70,0x59,0x0b,0x90,0x91,0x27,0xf0,0x04,0x60,0x51,0x43,
+0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,
+0x90,0x91,0x34,0xe0,0x2f,0x90,0x91,0x67,0xf0,0xe4,0x1b,0x12,0x44,0x54,0x90,0x01,
+0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,
+0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x11,0x90,0x91,0x2c,0xe0,0x90,0x07,
+0x78,0x60,0x05,0x74,0x0d,0xf0,0x80,0x03,0x74,0x09,0xf0,0x90,0x05,0x22,0xe4,0xf0,
+0x22,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,
+0xc3,0xc0,0xd0,0x90,0x91,0x84,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,
+0x90,0x91,0x84,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,
+0x91,0x87,0xe0,0x94,0xe8,0x90,0x91,0x86,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,
+0xe0,0x44,0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x91,0x86,0xe4,0x75,0xf0,0x01,0x12,
+0x42,0x81,0x7f,0x0a,0x7e,0x00,0x12,0x32,0x15,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,
+0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,
+0x91,0x1f,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,
+0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x3b,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,
+0x91,0x25,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x01,0x90,0x91,0x26,0xf0,
+0xef,0xc3,0x13,0x54,0x01,0x90,0x91,0x2e,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0x13,0x13,0x54,0x01,0x90,0x91,0x2c,0xf0,0x90,0x91,0x2e,0xe0,0x90,0x91,0x1f,0x70,
+0x26,0x12,0x25,0x14,0x00,0x00,0x02,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0x60,0x7e,0x08,0x12,0x2b,0x08,0x90,0x91,0x1f,0x12,0x25,
+0x14,0x00,0x00,0x03,0x10,0x80,0x24,0x12,0x25,0x14,0x00,0x00,0x01,0x10,0x90,0x91,
+0x1f,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x60,0x7e,0x08,0x12,0x2b,
+0x08,0x90,0x91,0x1f,0x12,0x25,0x14,0x00,0x00,0x03,0x00,0x90,0x91,0x1f,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,0x08,0x12,0x2b,0x08,0x90,0x91,
+0x26,0xe0,0x70,0x3d,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x22,
+0x65,0x90,0x91,0x1f,0x12,0x25,0x08,0x90,0x91,0x1f,0x12,0x43,0x09,0xec,0x44,0x02,
+0xfc,0x90,0x91,0x1f,0x12,0x25,0x08,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,0x08,0x90,0x02,0x86,0xe0,0x54,0xfb,
+0xf0,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x49,0x7f,0x90,0x01,0xe5,0xe5,0x70,0xf0,
+0x90,0x91,0x3b,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,
+0x12,0x42,0x20,0xff,0x30,0xe0,0x25,0x12,0x24,0x62,0x90,0x91,0x2f,0xf0,0x90,0x00,
+0x01,0x12,0x42,0x20,0x90,0x91,0x30,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x91,0x2d,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,0x91,0x35,0xf0,0x22,0x90,0x91,0x2f,0x74,
+0x0a,0xf0,0x90,0x91,0x30,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,
+0x35,0x74,0x05,0xf0,0x22,0x12,0x24,0x62,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,
+0x91,0x34,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0xef,0xf0,0x80,0x0f,0x90,0x91,0x34,0x74,0x07,0xf0,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0x74,0x03,0xf0,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x02,
+0x09,0xe0,0xfd,0x12,0x24,0x62,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x91,0x41,0xf0,0x90,
+0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x42,0xf0,0x90,0x00,0x02,0x12,
+0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x43,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,
+0xed,0x2f,0x90,0x91,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,
+0x2f,0x90,0x91,0x45,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x47,
+0xe0,0x90,0x91,0x1d,0xf0,0x90,0x91,0x48,0xe0,0xf5,0x19,0xa3,0xe0,0xf5,0x1a,0xe4,
+0xf5,0x16,0x74,0x4a,0x25,0x16,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xe0,0xff,0x74,
+0x1b,0x25,0x16,0xf8,0xa6,0x07,0x05,0x16,0xe5,0x16,0xb4,0x04,0xe5,0x90,0x91,0x1d,
+0xe0,0x12,0x43,0x4a,0x66,0xb3,0x00,0x67,0xdc,0x01,0x66,0xba,0x02,0x66,0xba,0x03,
+0x66,0xba,0x04,0x67,0xdc,0x05,0x67,0xac,0x80,0x67,0xc2,0x81,0x67,0xdc,0x82,0x00,
+0x00,0x67,0xd8,0xaf,0x1e,0x12,0x73,0xea,0xe1,0xdc,0x90,0x91,0x1d,0xe0,0xff,0xb4,
+0x02,0x08,0x90,0x91,0x1c,0x74,0x01,0xf0,0x80,0x0f,0xef,0x90,0x91,0x1c,0xb4,0x03,
+0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,0xc3,0xe5,0x19,0x94,0x08,0x50,0x49,
+0xe4,0xf5,0x16,0x90,0x91,0x1c,0xe0,0xff,0xe5,0x16,0xc3,0x9f,0x40,0x02,0xe1,0xdc,
+0xc3,0xe5,0x19,0x94,0x01,0x50,0x14,0xe5,0x16,0x25,0x1a,0xff,0xc3,0x74,0x03,0x95,
+0x16,0x24,0x1b,0xf8,0xe6,0xfd,0x12,0x4b,0xee,0x80,0x1a,0xc3,0x74,0x03,0x95,0x16,
+0x24,0x1b,0xf8,0xe6,0xff,0xe5,0x16,0x7c,0x00,0x25,0x1a,0xfd,0xec,0x35,0x19,0x8d,
+0x82,0xf5,0x83,0xef,0xf0,0x05,0x16,0x80,0xba,0xc3,0xe5,0x19,0x94,0x10,0x40,0x02,
+0xe1,0xdc,0x90,0x91,0x1d,0xe0,0x64,0x04,0x60,0x02,0xe1,0xdc,0xaf,0x1c,0xfc,0xfd,
+0xfe,0x78,0x10,0x12,0x24,0xf5,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1b,
+0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x24,0xf5,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,
+0x00,0x12,0x42,0xfc,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1d,0xe4,0xfc,
+0xfd,0xfe,0x78,0x08,0x12,0x24,0xf5,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,
+0x42,0xfc,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0xaf,0x1e,0xe4,0xfc,0xfd,0xfe,
+0x12,0x42,0xfc,0xa3,0x12,0x25,0x08,0x90,0x91,0x1e,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0xaf,0x1a,0xae,0x19,0x12,0x2b,0x08,0x80,0x30,0xe5,0x1d,0x7f,0x00,
+0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,0xaf,0x18,0xfe,0x12,0x32,0x15,
+0x80,0x1a,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,
+0xaf,0x18,0xfe,0x12,0x31,0x82,0x80,0x04,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,
+0x92,0xaf,0x22,0x22,0x8e,0x0e,0x8f,0x0f,0x8b,0x10,0x8a,0x11,0x89,0x12,0xe4,0x90,
+0x91,0x11,0xf0,0xef,0x90,0x00,0x31,0xf0,0x12,0x4a,0xe6,0xe5,0x0e,0x54,0x03,0xff,
+0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x54,
+0x7f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x91,0x11,0xe0,
+0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x91,0x11,0xe0,0xc3,0x94,
+0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x10,0xaa,0x11,0xa9,0x12,0x12,0x42,0x4d,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x91,0x98,0xf0,0xa3,0xf0,0x90,0x05,0xf8,
+0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,
+0x01,0x22,0xd3,0x90,0x91,0x99,0xe0,0x94,0xe8,0x90,0x91,0x98,0xe0,0x94,0x03,0x40,
+0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x32,0x15,0x90,0x91,0x98,0xe4,0x75,
+0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0xef,0x70,0x02,0x41,0x3d,0x90,0x90,0xe8,0xe0,
+0x60,0x02,0xc1,0x08,0x90,0x90,0xd4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0x80,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0x84,0x12,0x43,0x09,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0x88,
+0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x90,0x8c,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x90,0x90,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0x94,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0x98,0x12,0x43,0x09,0x90,
+0x80,0x96,0x12,0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0x9c,0x12,
+0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x90,0xa0,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x84,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x90,0xa4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x88,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xa8,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xac,0x12,0x43,0x09,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xb0,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd4,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,
+0xb4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd8,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x90,0xb8,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xdc,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x90,0xbc,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xc0,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xc4,0x12,0x43,0x09,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x90,0xc8,
+0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,0x08,
+0x90,0x90,0xcc,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,
+0x12,0x2b,0x08,0x90,0x90,0xd0,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x04,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0xe8,0x74,0x01,0xf0,0x22,0x90,0x90,0xe8,
+0xe0,0x64,0x01,0x60,0x02,0xc1,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,
+0xd4,0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0x80,0x12,0x25,
+0x08,0x7f,0x5c,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0x84,0x12,0x25,0x08,0x7f,0x6c,
+0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x88,0x12,0x25,0x08,0x7f,0x70,0x7e,0x0e,0x12,
+0x22,0x65,0x90,0x90,0x8c,0x12,0x25,0x08,0x7f,0x74,0x7e,0x0e,0x12,0x22,0x65,0x90,
+0x90,0x90,0x12,0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x94,0x12,
+0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x98,0x12,0x25,0x08,0x7f,
+0x80,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x9c,0x12,0x25,0x08,0x7f,0x84,0x7e,0x0e,
+0x12,0x22,0x65,0x90,0x90,0xa0,0x12,0x25,0x08,0x7f,0x88,0x7e,0x0e,0x12,0x22,0x65,
+0x90,0x90,0xa4,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xa8,
+0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xac,0x12,0x25,0x08,
+0x7f,0xd4,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xb0,0x12,0x25,0x08,0x7f,0xd8,0x7e,
+0x0e,0x12,0x22,0x65,0x90,0x90,0xb4,0x12,0x25,0x08,0x7f,0xdc,0x7e,0x0e,0x12,0x22,
+0x65,0x90,0x90,0xb8,0x12,0x25,0x08,0x7f,0xe0,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,
+0xbc,0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xc0,0x12,0x25,
+0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,0x90,0xc4,0x12,0x25,0x08,0x7f,0x04,
+0x7e,0x0d,0x12,0x22,0x65,0x90,0x90,0xc8,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,
+0x22,0x65,0x90,0x90,0xcc,0x12,0x25,0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,0x90,
+0x90,0xd0,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,0x91,0x88,0x12,
+0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x44,0xc0,0xfd,0xec,0x90,0x91,0x88,
+0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,
+0x14,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,
+0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,
+0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,
+0x96,0x12,0x25,0x14,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x80,0x96,0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,0x91,
+0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,0x91,0x88,
+0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,0x90,0x91,
+0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x22,0x65,0x90,0x91,
+0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,0x65,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,
+0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,0x65,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,
+0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x2b,
+0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,
+0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,0x91,0x88,0x12,0x25,0x08,0x90,
+0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,0x90,0x91,0x88,0x12,0x25,0x08,
+0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x08,
+0x12,0x2b,0x08,0xe4,0x90,0x90,0xe8,0xf0,0x22,0xe4,0xfd,0x7f,0x45,0x12,0x4b,0xee,
+0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x90,0xf7,0xf0,0x90,0x90,0xfd,0xf0,0x90,
+0x91,0x00,0xf0,0x90,0x90,0xfe,0xf0,0x90,0x91,0x01,0xf0,0x90,0x90,0xff,0xf0,0x90,
+0x91,0x02,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x90,0xee,0xf0,0x90,0x90,0xf3,0xf0,0x90,0x90,0xf5,0xf0,0x90,0x91,0x07,0xf0,0x90,
+0x90,0xf8,0xf0,0x90,0x90,0xf4,0xf0,0x90,0x90,0xed,0xf0,0x90,0x00,0x51,0xe0,0x44,
+0xc0,0xfd,0x7f,0x51,0x02,0x4b,0xee,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,
+0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,
+0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x91,0x04,0xe0,
+0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,
+0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x91,0x06,0x80,0x03,0x90,0x91,0x05,0xe0,0x04,
+0xf0,0x22,0x90,0x91,0x04,0xe0,0x2f,0xf0,0x22,0x90,0x90,0xf5,0xe0,0x64,0x01,0x60,
+0x02,0xe1,0x6e,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x90,
+0x91,0x07,0xe0,0x70,0x32,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x90,0xf4,0xe0,0xff,0xd1,0x67,0x90,0x91,0x07,
+0x74,0x01,0x12,0x4b,0xe4,0x80,0x40,0x90,0x91,0x07,0xe0,0x64,0x01,0x70,0x38,0x90,
+0x90,0xf8,0xe0,0xff,0xd1,0x67,0xe4,0x90,0x91,0x07,0xf0,0x90,0x00,0x45,0xe0,0x44,
+0x01,0xfd,0x7f,0x45,0x12,0x4b,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xef,
+0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,
+0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,
+0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,
+0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,
+0x90,0xee,0xe0,0xc3,0x94,0x14,0x50,0x06,0xe0,0x04,0xf0,0x02,0x70,0x29,0x90,0x90,
+0xee,0xe0,0x64,0x14,0x60,0x03,0x02,0x70,0x29,0x90,0x90,0xfd,0xe0,0x70,0x25,0x90,
+0x91,0x00,0xe0,0x70,0x1f,0x90,0x90,0xfe,0xe0,0x70,0x19,0x90,0x91,0x01,0xe0,0x70,
+0x13,0x90,0x90,0xff,0xe0,0x70,0x0d,0x90,0x91,0x02,0xe0,0x70,0x07,0x90,0x04,0xfd,
+0xe0,0x54,0xfe,0xf0,0x90,0x90,0xfd,0xe0,0x90,0x04,0x44,0xf0,0x90,0x90,0xfe,0xe0,
+0x90,0x04,0x45,0xf0,0x90,0x90,0xff,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,
+0x91,0x00,0xe0,0x90,0x04,0x48,0xf0,0x90,0x91,0x01,0xe0,0x90,0x04,0x49,0xf0,0x90,
+0x91,0x02,0xe0,0x90,0x04,0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x90,0xe9,0xe0,0x90,0x04,
+0x4c,0xf0,0x90,0x90,0xea,0xe0,0x90,0x04,0x4d,0xf0,0x90,0x90,0xeb,0xe0,0x90,0x04,
+0x4e,0xf0,0x90,0x90,0xec,0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x90,0xee,0xf0,0x90,
+0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x90,0xfd,0xf0,0xa3,
+0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x91,0x8c,
+0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x8d,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x8e,
+0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x8f,0xf0,0x90,0x91,0x06,0xe0,0xff,0x90,0x91,
+0x8f,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,0x91,0x06,0xe0,0xc3,0x9e,0xd3,0x94,0x01,
+0x40,0x11,0x90,0x90,0xf4,0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x90,0xf8,0xe0,0xff,
+0x12,0x6e,0x67,0x22,0x90,0x91,0x07,0xe0,0x64,0x01,0x60,0x08,0x90,0x90,0xf5,0xe0,
+0x60,0x02,0x21,0x4b,0x90,0x90,0xe9,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,
+0x80,0x3b,0x90,0x90,0xea,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,
+0x28,0x90,0x90,0xeb,0xe0,0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x90,
+0xea,0xf0,0x80,0x15,0x90,0x90,0xec,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,
+0xe4,0x90,0x90,0xeb,0xf0,0x90,0x90,0xea,0xf0,0x90,0x90,0xe9,0xf0,0x90,0x00,0x44,
+0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,0x32,0x90,0x90,0xfd,0xe0,0xc3,0x94,0xff,
+0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x90,0xfe,0xe0,0xc3,0x94,0xff,0x50,0x06,
+0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x90,0xff,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,
+0x04,0xf0,0xe4,0x90,0x90,0xfe,0xf0,0x90,0x90,0xfd,0xf0,0x90,0x00,0x44,0xe0,0x30,
+0xe3,0x32,0x90,0x91,0x00,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,
+0x90,0x91,0x01,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,
+0x91,0x02,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x91,0x01,0xf0,
+0x90,0x91,0x00,0xf0,0x90,0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,0x90,0x06,0x90,0xe0,
+0x44,0x01,0xf0,0x90,0x91,0x61,0xe0,0x30,0xe0,0x3c,0x90,0x91,0x5f,0xe0,0xff,0x90,
+0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x54,0x01,0xfd,0x12,0x4a,0xf6,0x90,0x91,0x60,0xe0,
+0x75,0xf0,0x20,0xa4,0xff,0xae,0xf0,0x12,0x32,0x15,0x90,0x91,0x5e,0xe0,0xc4,0x13,
+0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,
+0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xe4,0x90,
+0x91,0x19,0xf0,0xa3,0x74,0x08,0xf0,0xa3,0xf0,0xe4,0xa3,0xf0,0x90,0x01,0x1f,0xe0,
+0xfe,0x90,0x01,0x1e,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x02,0x87,0xe0,0x90,0x91,0x18,0xf0,0x90,0x91,0x56,0xe0,0x20,
+0xe0,0x02,0x61,0xc4,0xe4,0x90,0x91,0x17,0xf0,0x90,0x91,0x18,0xe0,0xff,0x90,0x91,
+0x17,0xe0,0xc3,0x9f,0x40,0x02,0x61,0xc4,0x90,0x91,0x11,0xe0,0xfc,0xa3,0xe0,0xfd,
+0xec,0xff,0x90,0xfd,0x11,0xf0,0x90,0x91,0x1c,0xef,0xf0,0x74,0x02,0x2d,0xf5,0x82,
+0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0f,0xfc,0x33,0x33,0x33,0x54,0xf8,0xff,0xed,
+0x24,0x18,0x2f,0x90,0x91,0x15,0xf0,0xe0,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x54,0xfc,0x90,0x91,0x16,0xf0,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0xfb,
+0xf5,0x83,0xe0,0xfe,0x74,0x00,0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x7a,
+0x00,0x24,0x00,0xff,0xea,0x3e,0x54,0x3f,0xab,0x07,0xfa,0x90,0x91,0x13,0xf0,0xa3,
+0xeb,0xf0,0xaf,0x04,0xef,0x75,0xf0,0x08,0xa4,0x24,0x18,0xff,0xe4,0x35,0xf0,0xfe,
+0xef,0x2b,0xfb,0xee,0x3a,0xfa,0x90,0x91,0x5a,0xe0,0xfe,0xa3,0xe0,0xff,0xad,0x03,
+0xac,0x02,0x12,0x45,0x09,0xaa,0x06,0xab,0x07,0x90,0x91,0x15,0xe0,0x24,0x00,0xf5,
+0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x30,0xe7,0x08,0x90,0x91,0x19,0x74,0x02,0xf0,
+0x80,0x05,0xe4,0x90,0x91,0x19,0xf0,0xaf,0x03,0x90,0x91,0x11,0xea,0x8f,0xf0,0x12,
+0x42,0x81,0x90,0x91,0x5c,0xe0,0xfe,0xa3,0xe0,0xff,0x90,0x91,0x11,0xe0,0xfc,0xa3,
+0xe0,0xfd,0xd3,0x9f,0xec,0x9e,0x40,0x1b,0x90,0x91,0x5d,0xe0,0x24,0x01,0xff,0x90,
+0x91,0x5c,0xe0,0x34,0x00,0xfe,0xc3,0xed,0x9f,0xff,0xec,0x9e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x91,0x16,0xe0,0xff,0x24,0x40,0x60,0x04,0x24,0x20,0x70,0x27,
+0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x13,0x13,0x54,0x01,0x20,0xe0,0x02,0x61,0x9c,
+0xef,0x90,0x00,0x81,0xb4,0xa0,0x05,0xe0,0x44,0x04,0x80,0x03,0xe0,0x44,0x08,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x61,0x95,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x13,0x54,0x03,
+0x20,0xe0,0x02,0x61,0x9c,0x90,0x91,0x15,0xe0,0xff,0x24,0x00,0xf5,0x82,0xe4,0x34,
+0xfb,0xf5,0x83,0xe0,0x54,0x0c,0x64,0x08,0x70,0x72,0x90,0x91,0x19,0xe0,0xfe,0xef,
+0x2e,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x1e,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,
+0x64,0x88,0x70,0x58,0x74,0x1f,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x64,
+0x8e,0x70,0x49,0x90,0x91,0x19,0xe0,0xff,0x90,0x91,0x15,0xe0,0x2f,0xff,0x90,0x91,
+0x1a,0xe0,0x2f,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x19,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x64,0x03,0x70,0x26,0x74,0x1e,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,
+0xe0,0x90,0x00,0x81,0x30,0xe3,0x05,0xe0,0x44,0x01,0x80,0x03,0xe0,0x44,0x02,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x56,0xe0,0x44,0x80,0xf0,0x90,0x91,0x56,0xe0,
+0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x02,0x31,0x4c,0x71,0xc9,0xbf,0x01,
+0x13,0x90,0x91,0x11,0xe0,0xfe,0xa3,0xe0,0xff,0x12,0x44,0xb5,0x90,0x91,0x17,0xe0,
+0x04,0xf0,0x21,0xd9,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x56,0xe0,0xc4,0x13,0x13,
+0x13,0x54,0x01,0x30,0xe0,0x11,0xe0,0x44,0x80,0xf0,0x90,0x91,0x5e,0xe0,0xc4,0x54,
+0x0f,0x20,0xe0,0x03,0x7f,0x00,0x22,0x7f,0x01,0x22,0x8f,0x1f,0xe4,0x90,0x91,0x22,
+0xf0,0xe5,0x1f,0x14,0xfe,0x90,0x91,0x22,0xe0,0xff,0xc3,0x9e,0x50,0x0e,0xef,0x04,
+0xfd,0x12,0x2d,0x4d,0x90,0x91,0x22,0xe0,0x04,0xf0,0x80,0xe5,0xe5,0x1f,0x14,0xff,
+0x7d,0xff,0x12,0x2d,0x4d,0x90,0x91,0x22,0xe5,0x1f,0xf0,0x90,0x91,0x22,0xe0,0xc3,
+0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x2d,0x4d,0x90,0x91,0x22,0xe0,0x04,
+0xf0,0x80,0xe8,0xad,0x1f,0x7f,0xff,0x02,0x2d,0x4d,0xc3,0xee,0x94,0x01,0x40,0x0a,
+0x0d,0xed,0x13,0x90,0xfd,0x10,0xf0,0xe4,0x2f,0xff,0x22,0xc3,0xee,0x94,0x01,0x40,
+0x1e,0x90,0xfd,0x11,0xe0,0xb5,0x05,0x14,0x90,0x01,0x17,0xe0,0xb5,0x05,0x07,0x90,
+0xfd,0x11,0xe4,0xf0,0x80,0x06,0xed,0x04,0x90,0xfd,0x11,0xf0,0xe4,0x2f,0xff,0x22,
+0x14,0x25,};
+
+
+
+u8 Rtl8192CUFwUMCBCutWWImgArray[UMCBCutWWImgArrayLength] = {
+0xc2,0x88,0x02,0x00,0x51,0x00,0x00,0x00,0x03,0x23,0x16,0x45,0x66,0x34,0x01,0x00,
+0x58,0x92,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0x9d,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x4a,0x22,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0xe1,0x00,0x00,0x00,0x00,0x00,0x02,0x58,0xc4,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,
+0x83,0x3a,0xf5,0x83,0xe0,0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,
+0x86,0xf0,0x08,0xe6,0x22,0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,
+0xe2,0x22,0xe5,0x83,0x2a,0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xf8,
+0xbb,0x01,0x11,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,
+0xf0,0xa3,0xf0,0x22,0x50,0x09,0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,
+0xfe,0x09,0xe9,0x25,0x82,0xc8,0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,
+0x4a,0xfe,0xed,0x49,0xfd,0xec,0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,
+0xfe,0xa3,0xe0,0xff,0x22,0xa4,0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,
+0x22,0xe0,0xfb,0xa3,0xe0,0xfa,0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,
+0xf9,0x25,0xf0,0xf0,0xe5,0x82,0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,
+0x22,0xeb,0xf0,0xa3,0xea,0xf0,0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,
+0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,
+0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,
+0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,
+0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0xb5,0xf0,
+0x06,0x74,0x03,0x93,0x68,0x60,0xe9,0xa3,0xa3,0xa3,0xa3,0x80,0xd8,0x02,0x43,0xdb,
+0x02,0x50,0x34,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,
+0x08,0xdf,0xf4,0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,
+0xc4,0x54,0x0f,0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,
+0xe4,0x80,0x0b,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x20,0xe4,0x7e,
+0x01,0x93,0x60,0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,
+0xa3,0x60,0x01,0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,
+0xfa,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,
+0xf0,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,
+0x41,0x91,0x40,0x00,0x41,0x91,0x9c,0x00,0x41,0x91,0x23,0x80,0x41,0x91,0x24,0x80,
+0x41,0x91,0x9e,0x00,0x41,0x91,0x52,0x00,0x41,0x91,0x93,0x00,0x41,0x91,0x91,0x00,
+0x41,0x91,0x90,0x00,0x41,0x91,0x92,0x00,0x00,0xf0,0x90,0x91,0x30,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x65,0xeb,0xf0,0xa3,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,
+0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,
+0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x59,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,
+0x92,0x74,0x02,0xf0,0x90,0x91,0x36,0x14,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x0c,
+0x50,0x02,0xf1,0x23,0x22,0x90,0x02,0x84,0xef,0xf0,0xa3,0xee,0xf0,0xa3,0x74,0x05,
+0xf0,0x22,0x7d,0x01,0xaf,0x6f,0xe1,0x27,0xf1,0xe6,0xbf,0x01,0x10,0x90,0x91,0x42,
+0xe0,0xff,0xe4,0xfd,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x8f,0x82,
+0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x72,0x7f,0x60,0x7e,0x01,0x80,
+0xed,0x7f,0x00,0x22,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x22,
+0x22,0x22,0x22,0x02,0x5e,0x55,0x02,0x5e,0x5c,0xef,0x8e,0xf0,0x71,0x70,0x45,0x26,
+0x00,0x40,0x45,0x4e,0x00,0x80,0x45,0x79,0x01,0x00,0x45,0x8d,0x02,0x00,0x45,0xa5,
+0x04,0x00,0x00,0x00,0x45,0xc2,0xed,0x54,0x3f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x00,0x7f,0x40,0xef,0x2d,0xff,0xee,0x3c,0xfe,0xef,0x78,0x06,0xce,0xc3,0x13,0xce,
+0x13,0xd8,0xf9,0x78,0x06,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0x80,0x26,0xed,0x54,
+0x7f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x00,0x7f,0x80,0xef,0x2d,0xff,0xee,0x3c,
+0xfe,0xef,0x78,0x07,0xce,0xc3,0x13,0xce,0x13,0xd8,0xf9,0x78,0x07,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xfd,0xac,0x06,0x80,0x49,0xed,0x70,0x04,0xfe,0xff,0x80,0x04,
+0x7e,0x01,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x7d,0x00,0xfc,0x80,0x35,0xec,0x54,0x01,
+0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x02,0x7f,0x00,0xef,0x2d,0xee,0x3c,0xc3,
+0x13,0x7d,0x00,0x80,0x1a,0xec,0x54,0x03,0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x04,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x13,0x13,0x54,0x3f,0x7d,0x00,0x25,0xe0,0x25,
+0xe0,0xfc,0xae,0x04,0xaf,0x05,0x22,0x90,0x91,0x09,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x06,0xa9,0xe0,0x90,0x91,0x08,0xf0,0xe0,0x54,0xc0,0x70,0x0a,0x53,0x71,
+0xfe,0x53,0x71,0xfd,0x91,0xc2,0x80,0x47,0x90,0x91,0x26,0xe0,0x60,0x41,0x90,0x91,
+0x38,0xe0,0x70,0x3b,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,
+0xde,0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0xec,0x44,0x02,0xfc,
+0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,
+0x91,0x08,0xe0,0x30,0xe6,0x13,0x43,0x71,0x01,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,
+0x04,0x91,0xc8,0x80,0x07,0x91,0x77,0x80,0x03,0x53,0x71,0xfe,0x90,0x91,0x08,0xe0,
+0x30,0xe7,0x16,0x43,0x71,0x02,0xe4,0x90,0x91,0x66,0x91,0x49,0x90,0x01,0x57,0x74,
+0x05,0xf0,0x90,0x91,0x3c,0x74,0x01,0xf0,0x22,0x53,0x71,0xfd,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x8b,0x60,0x8a,0x61,0x89,0x62,0x90,0x91,0x68,0x71,0x41,0xab,
+0x63,0xaa,0x64,0xa9,0x65,0x90,0x91,0x6b,0x71,0x41,0xaf,0x66,0x15,0x66,0xef,0x60,
+0x1b,0x90,0x91,0x6b,0xe4,0x75,0xf0,0x01,0x71,0x2a,0x12,0x29,0xd9,0xff,0x90,0x91,
+0x68,0xe4,0x75,0xf0,0x01,0x71,0x2a,0xef,0x51,0x4d,0x80,0xde,0xab,0x60,0xaa,0x61,
+0xa9,0x62,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x6e,0x71,0x41,0x90,0x91,0x9e,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x51,0x5f,
+0x7f,0xaf,0x7e,0x01,0x12,0x64,0x88,0xef,0x60,0x44,0x90,0x91,0x6e,0x71,0x21,0x8b,
+0x63,0x8a,0x64,0x89,0x65,0x75,0x66,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0xd1,0x6d,
+0x90,0x91,0x71,0x71,0x21,0x8b,0x63,0x8a,0x64,0x89,0x65,0x90,0x91,0x6e,0x71,0x21,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x66,0x7b,0x01,0x7a,0x01,0x79,0xa2,0xd1,
+0x6d,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,
+0x92,0xaf,0x22,0x7d,0x01,0x7f,0x0c,0x90,0x91,0x95,0xed,0xf0,0x90,0x91,0x94,0xef,
+0xf0,0x54,0x0f,0xff,0xe5,0x6e,0x54,0x0f,0x6f,0x60,0x76,0x90,0x91,0x94,0xe0,0x30,
+0xe2,0x30,0xe5,0x6e,0x20,0xe2,0x05,0x7f,0x01,0x12,0x61,0x86,0xe5,0x6e,0x30,0xe3,
+0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,0x08,0x12,0x60,0xb1,0xef,0x60,0x53,0x80,0x52,
+0xe5,0x6e,0x20,0xe3,0x4c,0x90,0x91,0x94,0xe0,0x30,0xe3,0x45,0xa3,0xe0,0xff,0x02,
+0x61,0x6b,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x0c,0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,
+0x08,0x12,0x60,0xb1,0xef,0x60,0x2a,0xf1,0xb2,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x04,
+0x10,0x90,0x91,0x94,0xe0,0x20,0xe2,0x09,0x12,0x60,0xfa,0xef,0x60,0x13,0x12,0x48,
+0xce,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x02,0x08,0x91,0xf1,0xef,0x60,0x03,0x12,0x62,
+0x6c,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x04,0x7f,0x01,
+0xf1,0xc9,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x8f,0x67,0xf1,0xe6,0xbf,0x01,0x15,
+0x90,0x91,0x43,0x12,0x48,0x1e,0xad,0x07,0xac,0x06,0xaf,0x67,0x12,0x60,0x16,0x90,
+0x04,0x1f,0x74,0x20,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,
+0x74,0xe6,0xf0,0x74,0x47,0xa3,0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,
+0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,
+0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xe0,0xff,
+0x7d,0x01,0x90,0x91,0x74,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,
+0x70,0x60,0x04,0xe4,0xff,0x11,0xb3,0x90,0x91,0x74,0xe0,0x30,0xe0,0x09,0x90,0x91,
+0x76,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,0x91,0x74,0xe0,0xff,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,0x91,0x75,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,
+0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,
+0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x91,0x76,0xa3,
+0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x91,0x76,0xe0,0xfe,0xa3,
+0xe0,0xff,0x22,0xef,0x60,0x0b,0x90,0x91,0x51,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,
+0x09,0x90,0x91,0x51,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x69,0x87,0x22,0x90,0x01,
+0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x68,0x7c,0xef,0x70,0x06,
+0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0xe5,0x70,0x60,
+0x04,0x7f,0x01,0x11,0xb3,0x12,0x68,0xbd,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0xef,
+0x64,0x01,0x70,0x42,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,
+0x36,0x75,0x90,0x01,0x36,0x74,0x03,0xf0,0xfd,0x7f,0x02,0x12,0x36,0xe6,0x7d,0x10,
+0x7f,0x03,0x12,0x36,0x92,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,
+0x12,0x47,0x23,0xe4,0xff,0x11,0xb3,0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,
+0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,
+0x7d,0x7b,0xff,0x12,0x36,0xe6,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0x7d,0x10,0x7f,
+0x03,0x12,0x36,0x92,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,
+0x07,0xf0,0x12,0x44,0xf4,0xe5,0x6d,0x20,0xe0,0x05,0xe4,0x90,0x91,0x29,0xf0,0x22,
+0x8b,0x0e,0x8a,0x0f,0x89,0x10,0xf1,0xf2,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x12,0x29,
+0xd9,0xf5,0x70,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,0x40,
+0x7f,0x01,0x80,0x3a,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,0x12,0x42,0x20,
+0xfd,0xe4,0xff,0x31,0xe1,0x80,0x27,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0xe1,0x1f,0x80,0x13,0xab,0x0e,0xaa,0x0f,0xa9,
+0x10,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0xe1,0xe4,0xff,0x11,0xff,
+0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x91,0x39,0x74,0x01,0xf0,0x80,
+0x16,0xed,0x70,0x0a,0x90,0x91,0x35,0xe0,0x90,0x91,0x39,0xf0,0x80,0x05,0x90,0x91,
+0x39,0xed,0xf0,0x90,0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x22,0x12,0x47,0xe6,0xbf,
+0x01,0x0f,0x90,0x02,0x09,0xe0,0xff,0x7d,0x01,0x11,0x22,0x90,0x04,0x1f,0x74,0x20,
+0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,
+0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,
+0x01,0xc4,0x74,0x22,0xf0,0x74,0x4a,0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,
+0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,0xf5,0x2f,0xe5,
+0x2c,0x30,0xe0,0x5a,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,0xd9,0x54,0xe5,0x70,0x14,
+0x24,0xfd,0x50,0x02,0x80,0x48,0x90,0x91,0x3b,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,
+0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0x91,0x89,0xef,0x64,0x01,0x70,0x30,0x90,0x91,
+0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,
+0x01,0x12,0x44,0x59,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,
+0x90,0x91,0x37,0xf0,0x80,0x08,0x91,0x89,0xbf,0x01,0x03,0x12,0x44,0xc2,0xe5,0x2c,
+0x30,0xe1,0x21,0x90,0x01,0x34,0x74,0x02,0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,
+0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,0x5c,0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,
+0x5f,0x12,0x64,0x66,0xe5,0x2c,0x30,0xe3,0x10,0x90,0x01,0x34,0x74,0x08,0xf0,0x90,
+0x91,0x56,0xe0,0x30,0xe0,0x03,0x43,0x57,0x04,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,
+0x34,0x74,0x10,0xf0,0x43,0x57,0x10,0xe5,0x2c,0x30,0xe5,0x24,0x90,0x01,0xcf,0xe0,
+0x30,0xe5,0x1d,0xe0,0x54,0xdf,0xf0,0x90,0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,
+0x75,0xe8,0x00,0xd1,0x65,0x90,0x00,0x03,0xe0,0x54,0xfb,0xf0,0x91,0xa0,0x80,0xfe,
+0xe5,0x2c,0x30,0xe6,0x06,0x90,0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x15,
+0x90,0x91,0x50,0x74,0x01,0xf0,0x90,0x01,0x36,0xf0,0x12,0x63,0x2e,0x12,0x70,0xee,
+0x90,0x91,0x50,0xe4,0xf0,0xe5,0x2e,0x30,0xe1,0x3b,0x90,0x01,0x36,0x74,0x02,0xf0,
+0x43,0x57,0x40,0x90,0x01,0x02,0xe0,0x54,0x03,0x64,0x01,0x70,0x28,0x90,0x01,0x37,
+0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,0x91,0x40,0xe4,0xf0,0x80,0x17,0x90,0x91,
+0x40,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,0x40,0x0b,0xe4,0xf0,0x90,0x04,0x19,0xe0,
+0x30,0xe0,0x02,0x51,0x0c,0xe5,0x2e,0x30,0xe2,0x1a,0x90,0x01,0x36,0x74,0x04,0xf0,
+0x90,0x91,0x3a,0xe4,0xf0,0x90,0x05,0x58,0x74,0x03,0xf0,0x12,0x62,0xb8,0x90,0x91,
+0x3f,0xe0,0x04,0xf0,0xe5,0x2e,0x30,0xe3,0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,
+0x6d,0x64,0x01,0x70,0x1c,0xe5,0x70,0x60,0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x02,0xf0,0x90,0x91,0x66,0xe4,0x12,0x44,0x49,0x90,0x01,0x57,0x74,0x05,
+0xf0,0xe5,0x2e,0x30,0xe4,0x2b,0x90,0x01,0x36,0x74,0x10,0xf0,0xe5,0x6d,0xb4,0x01,
+0x20,0xe5,0x70,0x60,0x1c,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,
+0x90,0x91,0x3c,0xe4,0xf0,0x53,0x71,0xfd,0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,
+0xc2,0xe5,0x2e,0x30,0xe5,0x1f,0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x6d,0xb4,0x01,
+0x14,0xe5,0x70,0x60,0x10,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xc8,
+0x80,0x03,0x12,0x44,0x77,0xe5,0x2e,0x30,0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,
+0xe5,0x6d,0xb4,0x01,0x10,0xe5,0x70,0x60,0x0c,0x53,0x71,0xfe,0xe5,0x71,0x54,0x07,
+0x70,0x03,0x12,0x44,0xc2,0xe5,0x2f,0x30,0xe1,0x09,0x90,0x01,0x37,0x74,0x02,0xf0,
+0x12,0x64,0x31,0x74,0x22,0x04,0x90,0x01,0xc4,0xf0,0x74,0x4a,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,
+0x7f,0x7f,0x01,0x60,0x02,0x7f,0x00,0x22,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,0xfe,0xd0,0xd0,0x92,0xaf,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x9b,0xed,0xf0,0x90,0x91,0x9a,0xef,
+0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x91,0xa0,0x90,0x91,0x9a,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,
+0x46,0xe0,0x4f,0xf0,0x91,0xa0,0x90,0x91,0x9b,0xe0,0x60,0x16,0x90,0x91,0x9a,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x45,
+0x80,0x66,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,0x80,0x6b,0x90,0x91,0x9a,0xe0,0x24,0xf8,0xf0,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,
+0x91,0x98,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x91,0xa0,0x90,0x91,0x9b,0xe0,0x60,
+0x1b,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x42,0xe0,0x4f,0x80,0x1a,0x90,0x91,0x9a,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,
+0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,0x91,0xa0,0xd0,0xd0,0x92,0xaf,0x22,0xf0,0x90,
+0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,
+0x82,0x75,0x83,0x00,0xed,0xf0,0x91,0xa0,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,
+0x30,0x14,0x60,0x66,0x24,0x02,0x60,0x02,0xc1,0x64,0x90,0x90,0xf3,0x74,0x02,0xf0,
+0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0xb1,0xa8,0x90,0x00,0x47,0xe0,0x44,
+0x08,0xfd,0x7f,0x47,0xb1,0xa8,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,
+0x71,0xe4,0x90,0x90,0xf3,0xf0,0x90,0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,
+0x7f,0x45,0xb1,0xa8,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0xb1,0xa8,0x90,
+0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,0x90,0x90,0xf3,0x74,0x01,0xf0,
+0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,
+0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,0x7f,0x45,0xb1,0xa8,0x90,0x00,
+0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,
+0x7f,0x46,0xb1,0xa8,0x22,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,
+0x90,0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0xb1,0xa8,0xe4,
+0xfd,0x7f,0x51,0xb1,0xa8,0xe4,0xfd,0x7f,0x52,0xb1,0xa8,0xe4,0xfd,0x7f,0x53,0xa1,
+0xa8,0x8b,0x0e,0x8a,0x0f,0x89,0x10,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,0xf6,
+0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x90,0xed,0x74,0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,
+0x27,0xde,0x90,0x90,0xef,0x12,0x2a,0x7f,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,
+0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,0x78,0x1a,0x12,0x2a,0x6c,0xa8,0x04,
+0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x90,0xef,0x12,0x43,0x09,0xec,0x54,0x03,0xfc,
+0x12,0x42,0xfc,0x90,0x90,0xf9,0x12,0x2a,0x7f,0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,
+0xe4,0x90,0x90,0xed,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0xec,0x54,0x03,0xfc,
+0xec,0x44,0xc0,0xfc,0x90,0x90,0xef,0x12,0x2a,0x7f,0x90,0x90,0xef,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xf6,
+0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0xb1,0xa8,0x90,0x00,0x48,0xe0,0x44,0x0c,
+0xfd,0x7f,0x48,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x44,0x10,0x80,0x1c,0x90,0x00,0x47,
+0xe0,0x54,0xf3,0xfd,0x7f,0x47,0xb1,0xa8,0x90,0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,
+0x48,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x54,0xef,0xfd,0x7f,0x46,0xb1,0xa8,0xe4,0x90,
+0x90,0xf3,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,
+0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,0xb1,0xa8,0x7d,0xff,0x7f,
+0x55,0xb1,0xa8,0x7d,0xff,0x7f,0x56,0xb1,0xa8,0x7d,0xff,0x7f,0x57,0xa1,0xa8,0xe5,
+0x72,0x64,0x01,0x70,0x3e,0x12,0x54,0x41,0xbf,0x01,0x05,0x7f,0x01,0x12,0x56,0xe7,
+0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0xb1,0xa8,0x90,0x00,0x44,0xe0,0x54,
+0xfb,0xfd,0x7f,0x44,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,0x46,0xb1,
+0xa8,0x7f,0x02,0x12,0x6f,0x09,0x8f,0x76,0x90,0x01,0xc9,0xe5,0x76,0xf0,0xb4,0x01,
+0x02,0xf1,0xd4,0x22,0x90,0x00,0x49,0xe0,0x90,0x91,0x9f,0xf0,0xe0,0x54,0x0f,0xf0,
+0x44,0xf0,0xfd,0x7f,0x49,0xb1,0xa8,0x90,0x91,0x9f,0xe0,0x44,0xb0,0xfd,0x7f,0x49,
+0xa1,0xa8,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,0x28,0xf0,0xf5,0x71,0x22,0x75,0x28,
+0x33,0xe4,0xf5,0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,
+0xe5,0x29,0xf0,0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0x75,0x30,0x1f,0x75,
+0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,0xa3,0xe5,0x31,0xf0,0xa3,
+0xe5,0x32,0xf0,0x22,0xe4,0x90,0x91,0x0e,0xf0,0xa3,0xf0,0x75,0x8e,0x02,0xf1,0x02,
+0xd1,0xb4,0x90,0x91,0x4f,0xef,0xf0,0xd1,0xdb,0x90,0x91,0x51,0xef,0xf0,0xf1,0x3d,
+0x90,0x91,0x3d,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,0x57,0xd1,0xd2,0x12,0x60,0x37,
+0x12,0x32,0x3d,0xd1,0xc1,0x12,0x4f,0xfe,0xf1,0x13,0xd1,0xcb,0x11,0x1c,0x12,0x44,
+0xff,0x31,0x23,0x11,0xdf,0x12,0x6f,0xaa,0x90,0x91,0x10,0xe5,0xd9,0xf0,0x12,0x4f,
+0x64,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,0xf0,0x12,0x4c,0xa0,0x75,0xe8,0x03,
+0x43,0xa8,0x85,0xd2,0xaf,0x90,0x91,0x0e,0xe0,0x64,0x01,0xf0,0x24,0x34,0x90,0x01,
+0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x57,0x30,0xe2,0x10,0x12,0x5e,0x63,0xbf,0x01,
+0x0a,0xc2,0xaf,0x53,0x57,0xfb,0xd2,0xaf,0x12,0x71,0x8a,0xe5,0x57,0x30,0xe4,0x0a,
+0xc2,0xaf,0x53,0x57,0xef,0xd2,0xaf,0x12,0x5e,0xa0,0x90,0x90,0xf7,0xe0,0x70,0x03,
+0x12,0x70,0x08,0x11,0xf7,0x90,0x91,0x3f,0xe0,0x90,0x01,0xba,0xf0,0x80,0xb6,0x90,
+0x91,0x53,0xe0,0x54,0xfe,0xf0,0xe4,0x90,0x91,0x55,0xf0,0x90,0x91,0x53,0xe0,0x54,
+0x7f,0xf0,0xa3,0x74,0x0a,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x25,0x14,0x70,0x1b,
+0x7b,0x01,0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x12,0x68,0x1a,0xbf,0x01,0x09,
+0x90,0x06,0x35,0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0xc1,0xf4,0xe4,0x90,0x06,
+0x34,0xf0,0x22,0x90,0x91,0x56,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x7f,0xf0,0x90,0x01,
+0x17,0xe0,0xfe,0x90,0x01,0x16,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,
+0x5c,0xf0,0xa3,0xef,0xf0,0x90,0x01,0x04,0xe0,0x54,0x0f,0x90,0x91,0x1c,0xf0,0xe0,
+0xff,0x74,0x40,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0x90,0x91,0x5b,0xf0,0xee,0x90,0x91,0x5a,0xf0,0x90,0x91,0x5e,0xe0,0x54,0xfe,
+0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xfb,0xf0,0xe0,0x54,0xf7,0xf0,0xe0,0x54,0xef,
+0xf0,0xe0,0x54,0xdf,0xf0,0xe0,0x54,0xbf,0xf0,0xe0,0x54,0x7f,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xf7,0xf0,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x12,0x29,0xd9,0x54,0x01,0xff,0x90,0x91,0x56,
+0xe0,0x54,0xfe,0x4f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x57,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x58,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x1a,
+0x90,0x06,0x09,0xe0,0x54,0xfe,0xf0,0x90,0x02,0x86,0xe0,0x44,0x04,0xf0,0x43,0x57,
+0x04,0x7d,0x08,0xe4,0xff,0x12,0x36,0xe6,0x80,0x12,0x7d,0x08,0xe4,0xff,0x12,0x36,
+0x75,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x51,0x01,0x31,0x23,0xd0,0xd0,0x92,0xaf,
+0x22,0x90,0x06,0x90,0xe4,0xf0,0x21,0x6a,0x90,0x91,0x19,0x12,0x43,0x41,0xef,0x12,
+0x43,0x4a,0x52,0x40,0x01,0x52,0x49,0x02,0x52,0x6a,0x03,0x52,0x73,0x09,0x52,0x7b,
+0x0c,0x52,0x84,0x0d,0x52,0x8c,0x0e,0x52,0x9d,0x1a,0x52,0xa5,0x2c,0x52,0x51,0x2d,
+0x52,0x5a,0x2e,0x52,0xad,0x30,0x52,0x62,0x3b,0x52,0x95,0x3c,0x00,0x00,0x52,0xb5,
+0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x64,0xde,0x90,0x91,0x19,0x12,0x43,0x21,0xc1,
+0xc5,0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x65,0xf9,0x90,0x91,0x19,0x12,0x43,0x21,
+0xe1,0xa8,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x28,0x90,0x91,0x19,0x12,0x43,0x21,
+0x02,0x66,0x41,0x90,0x91,0x19,0x12,0x43,0x21,0x80,0x42,0x90,0x91,0x19,0x12,0x43,
+0x21,0x02,0x5d,0x16,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x75,0x90,0x91,0x19,0x12,
+0x43,0x21,0x02,0x4e,0x91,0x90,0x91,0x19,0x12,0x43,0x21,0x21,0xa0,0x90,0x91,0x19,
+0x12,0x43,0x21,0xa1,0x7f,0x90,0x91,0x19,0x12,0x43,0x21,0x81,0x5e,0x90,0x91,0x19,
+0x12,0x43,0x21,0xe1,0x55,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1c,0x12,0x43,0x21,
+0x90,0x00,0x01,0x12,0x42,0x97,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,0x90,
+0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x42,0xcf,0x12,0x29,
+0xd9,0xff,0x60,0x2c,0xb5,0x72,0x16,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,
+0x12,0x42,0x97,0x65,0x74,0x70,0x04,0xe5,0x73,0x65,0xf0,0x60,0x23,0x90,0x91,0x1c,
+0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xff,0xae,0xf0,0x71,0x35,0x80,0x10,
+0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x29,0xd9,0x65,0x72,0x60,0x03,0x12,0x44,0xe8,
+0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1f,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x72,0x01,
+0x8e,0x73,0xf5,0x74,0xe4,0xfd,0x7f,0x0b,0x71,0x77,0xe4,0xfd,0x7f,0x02,0x71,0x77,
+0x91,0x41,0xe4,0xff,0xd1,0xe7,0xe4,0xf5,0x76,0x90,0x01,0xc9,0xe5,0x76,0xf0,0x90,
+0x91,0x1f,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,0x7d,0x01,
+0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x22,0xed,0xf0,0x90,0x91,0x21,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4f,0xa3,0xe0,0x70,
+0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x91,0x21,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,
+0x4f,0xf0,0x12,0x4c,0xa0,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x5a,0x90,0x91,0x21,0xe0,
+0x24,0xf8,0xf0,0xa3,0xe0,0x70,0x1d,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,
+0x5f,0xf0,0x80,0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x12,0x4c,
+0xa0,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x12,0x4c,0xa0,0xd0,0xd0,0x92,0xaf,
+0x22,0x7f,0x0b,0x12,0x6f,0x09,0xef,0x65,0x75,0x60,0x10,0xe5,0x75,0xb4,0x01,0x05,
+0xe4,0xf5,0x75,0x80,0x03,0x75,0x75,0x01,0x7f,0x01,0x22,0x7f,0x00,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0xe4,0xf5,0x10,0x75,0x11,0x04,0xf5,0x12,0xf5,0x14,0xf5,
+0x15,0x90,0x02,0x09,0xe0,0xff,0x12,0x29,0xd9,0xfe,0xef,0x2e,0xf5,0x13,0x30,0xe0,
+0x08,0x75,0x0e,0x00,0x75,0x0f,0x80,0x80,0x05,0xe4,0xf5,0x0e,0xf5,0x0f,0xe5,0x13,
+0xc3,0x13,0x90,0xfd,0x10,0xf0,0x74,0x20,0x25,0x10,0xf5,0x10,0xad,0x0f,0xe5,0x10,
+0x2d,0xff,0x24,0x01,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x91,0x47,0xf0,
+0x74,0x02,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x10,0x2d,0x24,
+0x03,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x91,
+0x48,0xf0,0xa3,0xef,0xf0,0x7f,0x04,0xe5,0x10,0x25,0x0f,0x2f,0x24,0x00,0xf5,0x82,
+0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0x74,0x46,0x2f,0xf5,0x82,0xe4,0x34,0x91,0xf5,
+0x83,0xee,0xf0,0x0f,0xbf,0x08,0xe0,0x12,0x66,0x89,0xef,0x70,0x3f,0x90,0x01,0xc3,
+0xe0,0x60,0x25,0xc3,0xe5,0x15,0x94,0xe8,0xe5,0x14,0x94,0x03,0x40,0x09,0x90,0x01,
+0xc6,0xe0,0x44,0x10,0xf0,0x80,0x63,0x05,0x15,0xe5,0x15,0x70,0x02,0x05,0x14,0x7f,
+0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,
+0xe2,0x05,0x74,0xfe,0xf0,0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x10,0xb4,0x78,
+0x23,0xe4,0xf5,0x10,0x05,0x13,0xe5,0x0f,0x64,0x80,0x45,0x0e,0x70,0x06,0xf5,0x0e,
+0xf5,0x0f,0x80,0x06,0x75,0x0e,0x00,0x75,0x0f,0x80,0xe5,0x13,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x80,0x06,0x74,0x08,0x25,0x10,0xf5,0x10,0xe5,0x12,0x15,0x12,0x70,0x02,
+0x15,0x11,0xe5,0x12,0x45,0x11,0x60,0x02,0x81,0x9c,0xd0,0xd0,0x92,0xaf,0x22,0x90,
+0x91,0x1c,0x12,0x43,0x41,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,0x91,0x5e,0xe0,
+0x54,0xfe,0x4e,0xf0,0xef,0x54,0x04,0xff,0xe0,0x54,0xfb,0x4f,0xf0,0x12,0x29,0xd9,
+0xff,0x54,0x02,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xfd,0x4e,0xf0,0xef,0x54,0x08,0xff,
+0xe0,0x54,0xf7,0x4f,0xf0,0x12,0x29,0xd9,0xff,0x54,0x10,0xfe,0x90,0x91,0x5e,0xe0,
+0x54,0xef,0x4e,0xf0,0xef,0x54,0x20,0xff,0xe0,0x54,0xdf,0x4f,0xf0,0x12,0x29,0xd9,
+0xff,0x54,0x40,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xbf,0x4e,0xf0,0xef,0x54,0x80,0xff,
+0xe0,0x54,0x7f,0x4f,0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x60,0xf0,0x90,
+0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x5f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,
+0x54,0x01,0xfe,0x90,0x91,0x61,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0x54,0x02,0xff,0xe0,
+0x54,0xfd,0x4f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x04,0xff,0x90,0x91,0x61,
+0xe0,0x54,0xfb,0x4f,0xf0,0x90,0x91,0x5e,0xe0,0x54,0x01,0x90,0x01,0xb8,0xf0,0x90,
+0x91,0x5e,0xe0,0xff,0xc4,0x13,0x54,0x01,0x90,0x01,0xb9,0xf0,0x90,0x91,0x61,0xe0,
+0x54,0x01,0x90,0x01,0xba,0xf0,0xa3,0x74,0xff,0xf0,0x12,0x29,0xd9,0x20,0xe0,0x02,
+0x41,0x01,0xe4,0xfd,0x7f,0x81,0x12,0x4d,0xa8,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,
+0x29,0xd9,0xff,0xc3,0x13,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x02,0xf0,0xef,
+0x13,0x13,0x54,0x3f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x04,0xf0,0x12,0x29,
+0xd9,0x13,0x13,0x13,0x54,0x1f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x08,0xf0,
+0x90,0x91,0x61,0xe0,0x30,0xe0,0x1c,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x54,0x07,0x30,
+0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,0xff,0x7d,0x01,
+0x12,0x4c,0xb0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,0x01,0x60,0x02,0x7f,0x00,
+0x22,0xe4,0xf5,0x75,0x22,0x12,0x29,0xd9,0xf5,0x6d,0x22,0x90,0x01,0x64,0x74,0xa0,
+0xf0,0x22,0x90,0x91,0x51,0xe0,0x90,0x90,0xe8,0xf0,0x22,0x90,0x00,0xf3,0xe0,0x7f,
+0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x01,0xca,0xe5,0x75,0xf0,0xef,0x60,0x03,
+0x12,0x4f,0xd4,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0x22,0xe4,0x90,0x91,0x4e,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,
+0x02,0x4d,0xa8,0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,
+0x90,0x05,0x5a,0xf0,0xa3,0xe4,0xf0,0x22,0x12,0x29,0xd9,0x60,0x02,0x80,0x01,0xe4,
+0x90,0x91,0x31,0xf0,0x90,0x91,0x31,0xe0,0x90,0x01,0xe7,0xf0,0x22,0x90,0x91,0x51,
+0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x05,0x7e,0xfd,0x7f,0x33,0x22,
+0x7e,0xfd,0x7f,0x2f,0x22,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,0x91,0x53,0xe0,
+0x54,0xfe,0x4e,0xf0,0xef,0xc3,0x13,0x30,0xe0,0x0a,0x90,0x00,0x01,0x12,0x42,0x20,
+0x90,0x91,0x54,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,0xf7,0xf0,0xe0,
+0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x0e,0xc2,0xaf,0x90,0x00,
+0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4d,0xa8,0x7d,0x40,0x7f,0x01,0x12,0x36,
+0xaf,0xe5,0x0e,0x24,0xff,0x92,0xaf,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,
+0x54,0x7f,0x90,0x91,0x34,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x91,0x32,
+0xe4,0xf0,0xa3,0xef,0xf0,0x80,0x0f,0x90,0x91,0x34,0x74,0x07,0xf0,0x90,0x91,0x32,
+0xe4,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0xe1,0xf0,0x74,0x57,0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,
+0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,0xff,0x90,0x00,0x56,0xe0,
+0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,0x74,0x10,0xf0,0xe5,0x3d,
+0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,0x30,0xe6,0x1b,0x90,0x00,
+0x55,0x74,0x40,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,0xbf,0x03,0x0b,0x90,0x90,
+0xf3,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4d,0xbd,0xe5,0x3d,0x30,0xe7,0x15,0x90,0x00,
+0x55,0x74,0x80,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,0xbf,0x03,0x05,0x7f,0x02,
+0x12,0x4d,0xbd,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,0x74,0x01,0xf0,0xe5,0x3e,
+0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,0x30,0xe2,0x06,0x90,0x00,
+0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,0x56,0x74,0x08,0xf0,0x90,
+0x01,0xc4,0x74,0xe1,0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,
+0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,
+0xf0,0xd0,0xe0,0x32,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,
+0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,
+0x07,0x75,0x0d,0x00,0x90,0x01,0xc4,0x74,0xc4,0xf0,0x74,0x58,0xa3,0xf0,0x53,0x91,
+0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,0x55,0x31,0xf5,0x35,0xa3,
+0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,0xe5,0x34,0x30,0xe0,0x06,
+0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x08,0x90,0x01,0x3c,0x74,0x02,
+0xf0,0x71,0x89,0xe5,0x34,0x30,0xe2,0x3a,0x90,0x01,0x3c,0x74,0x04,0xf0,0x90,0x06,
+0x92,0xe0,0x30,0xe0,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5b,0x74,
+0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x08,0x90,0x91,0x37,0xe4,0xf0,0x12,
+0x44,0xc2,0xe5,0x34,0x30,0xe3,0x3a,0x90,0x01,0x3c,0x74,0x08,0xf0,0x90,0x06,0x92,
+0xe0,0x30,0xe1,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,
+0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5f,0x74,0x05,
+0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x08,0x90,0x91,0x36,0xe4,0xf0,0x12,0x44,
+0xc2,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,0x12,0x4f,0x8f,0xe5,
+0x34,0x30,0xe5,0x08,0x90,0x01,0x3c,0x74,0x20,0xf0,0x51,0x62,0xe5,0x35,0x30,0xe0,
+0x5a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,0x44,0x7f,0xf0,0x90,0x00,
+0x83,0xe0,0x54,0x0f,0xf5,0x0d,0xb4,0x01,0x02,0x80,0x1c,0xe5,0x0d,0xb4,0x02,0x05,
+0x90,0x00,0x83,0x80,0x12,0xe5,0x0d,0xb4,0x04,0x05,0x90,0x00,0x83,0x80,0x08,0xe5,
+0x0d,0xb4,0x0c,0x08,0x90,0x00,0x83,0xe0,0xf5,0x6f,0x80,0x06,0x90,0x01,0xbe,0xe0,
+0x04,0xf0,0x90,0x01,0xbb,0xe5,0x6f,0xf0,0xe5,0x6f,0x30,0xe0,0x03,0xa3,0x80,0x03,
+0x90,0x01,0xbd,0xe0,0x04,0xf0,0x71,0x6a,0x12,0x44,0xc2,0xe5,0x35,0x30,0xe2,0x06,
+0x90,0x01,0x3d,0x74,0x04,0xf0,0xe5,0x36,0x30,0xe0,0x06,0x90,0x01,0x3e,0x74,0x01,
+0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,0x74,0x02,0xf0,0x74,0xc4,0x04,0x90,
+0x01,0xc4,0xf0,0x74,0x58,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,
+0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,
+0xe0,0x32,0x90,0x90,0xf5,0xe0,0x64,0x01,0x60,0x02,0x61,0x17,0x90,0x00,0x46,0xe0,
+0x44,0x01,0xfd,0x7f,0x46,0x12,0x4d,0xa8,0x90,0x91,0x07,0xe0,0x70,0x32,0x90,0x90,
+0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,
+0x90,0xf4,0xe0,0xff,0x71,0x18,0x90,0x91,0x07,0x74,0x01,0x12,0x4d,0x9e,0x80,0x40,
+0x90,0x91,0x07,0xe0,0x64,0x01,0x70,0x38,0x90,0x90,0xf8,0xe0,0xff,0x71,0x18,0xe4,
+0x90,0x91,0x07,0xf0,0x90,0x00,0x45,0xe0,0x44,0x01,0xfd,0x7f,0x45,0x12,0x4d,0xa8,
+0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,
+0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,
+0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,
+0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,0xf0,
+0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,0xf0,
+0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x91,0x04,
+0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,
+0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x91,0x06,0x80,0x03,0x90,0x91,0x05,0xe0,
+0x04,0xf0,0x22,0x90,0x91,0x04,0xe0,0x2f,0xf0,0x22,0xe5,0x6f,0x30,0xe6,0x19,0xe5,
+0x6f,0x54,0x0f,0xff,0x90,0x91,0x24,0xe0,0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,
+0x80,0x90,0x91,0x24,0xf0,0x53,0x6f,0xbf,0x22,0xe4,0x90,0x91,0x0d,0xf0,0xe5,0x70,
+0x70,0x02,0x81,0x13,0x90,0x91,0x3c,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x71,0xfd,0xe5,
+0x71,0x54,0x07,0x70,0x6e,0x80,0x69,0x90,0x91,0x28,0xe0,0x04,0xf0,0x53,0x71,0xef,
+0x90,0x91,0x3a,0xe0,0x04,0xf0,0x90,0x91,0x0d,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,
+0xfd,0xee,0x33,0xfc,0x90,0x91,0x3a,0xe0,0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,
+0x12,0xef,0x24,0x02,0xff,0xe4,0x3e,0xfe,0x90,0x91,0x3a,0xe0,0xb5,0x07,0x0a,0xe4,
+0xb5,0x06,0x06,0x90,0x05,0x58,0xe0,0x04,0xf0,0xe9,0xff,0x90,0x91,0x2f,0xe0,0x2f,
+0xff,0xe4,0x33,0xfe,0x90,0x91,0x28,0xe0,0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,
+0x98,0x40,0x0d,0xe5,0x6d,0xb4,0x01,0x0b,0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,
+0x12,0x44,0xc2,0x22,0x90,0x90,0xee,0xe0,0xc3,0x94,0x14,0x50,0x05,0xe0,0x04,0xf0,
+0x81,0xcc,0x90,0x90,0xee,0xe0,0x64,0x14,0x60,0x02,0x81,0xcc,0x90,0x90,0xfd,0xe0,
+0x70,0x25,0x90,0x91,0x00,0xe0,0x70,0x1f,0x90,0x90,0xfe,0xe0,0x70,0x19,0x90,0x91,
+0x01,0xe0,0x70,0x13,0x90,0x90,0xff,0xe0,0x70,0x0d,0x90,0x91,0x02,0xe0,0x70,0x07,
+0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,0x90,0xfd,0xe0,0x90,0x04,0x44,0xf0,0x90,
+0x90,0xfe,0xe0,0x90,0x04,0x45,0xf0,0x90,0x90,0xff,0xe0,0x90,0x04,0x46,0xf0,0xa3,
+0xe4,0xf0,0x90,0x91,0x00,0xe0,0x90,0x04,0x48,0xf0,0x90,0x91,0x01,0xe0,0x90,0x04,
+0x49,0xf0,0x90,0x91,0x02,0xe0,0x90,0x04,0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x90,0xe9,
+0xe0,0x90,0x04,0x4c,0xf0,0x90,0x90,0xea,0xe0,0x90,0x04,0x4d,0xf0,0x90,0x90,0xeb,
+0xe0,0x90,0x04,0x4e,0xf0,0x90,0x90,0xec,0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x90,
+0xee,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x90,
+0xfd,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,
+0x90,0x91,0x8c,0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x8d,0xf0,0x90,0x05,0x62,0xe0,
+0x90,0x91,0x8e,0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x8f,0xf0,0x90,0x91,0x06,0xe0,
+0xff,0x90,0x91,0x8f,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,0x91,0x06,0xe0,0xc3,0x9e,
+0xd3,0x94,0x01,0x40,0x10,0x90,0x90,0xf4,0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x90,
+0xf8,0xe0,0xff,0x71,0x18,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,0xf5,0xf0,
+0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf4,0xf0,0x12,0x29,
+0xd9,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf8,0xf0,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,
+0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,
+0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,
+0xf0,0xc2,0xaf,0x90,0x90,0xf4,0xe0,0xff,0x71,0x18,0x90,0x91,0x1c,0xe0,0x24,0xff,
+0x92,0xaf,0x90,0x90,0xf5,0xe0,0x70,0x02,0xc1,0x1f,0x90,0x90,0xf4,0xe0,0x70,0x02,
+0xc1,0x1f,0x90,0x90,0xf8,0xe0,0x70,0x02,0xc1,0x1f,0xa2,0xaf,0xe4,0x33,0x90,0x91,
+0x1c,0xf0,0xc2,0xaf,0x90,0x91,0x07,0x74,0x01,0xf0,0x90,0x91,0x1c,0xe0,0x24,0xff,
+0x92,0xaf,0x12,0x4d,0x9f,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x12,0x4d,
+0xa8,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,
+0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x12,0x4d,0xa8,0x90,0x05,
+0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,0x91,0x04,
+0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,0x91,0x06,
+0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,
+0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,0x37,0x00,0x80,0x2d,0x90,
+0x90,0xf5,0xe0,0x70,0x2f,0x90,0x91,0x07,0x12,0x4d,0x9e,0x90,0x00,0x46,0xe0,0x54,
+0xfe,0xfd,0x7f,0x46,0x12,0x4d,0xa8,0x90,0x05,0x22,0xe4,0xf0,0xa2,0xaf,0x33,0x90,
+0x91,0x1c,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x36,0x92,0x90,0x91,0x1c,0xe0,
+0x24,0xff,0x92,0xaf,0x22,0x8f,0x20,0x8c,0x21,0x8d,0x22,0x22,0x8f,0x23,0x8c,0x24,
+0x8d,0x25,0x22,0xe4,0x90,0x91,0x11,0xf0,0xa3,0xf0,0x90,0x02,0x86,0xe0,0x20,0xe1,
+0x2c,0xc3,0x90,0x91,0x12,0xe0,0x94,0x20,0x90,0x91,0x11,0xe0,0x94,0x03,0x40,0x0a,
+0x90,0x01,0xc6,0xe0,0x44,0x20,0xf0,0x7f,0x00,0x22,0x90,0x91,0x11,0xe4,0x75,0xf0,
+0x01,0x12,0x42,0x81,0x7f,0x01,0x7e,0x00,0x12,0x37,0x54,0x80,0xcd,0x7f,0x01,0x22,
+0x90,0x01,0xcc,0xe0,0x54,0x0f,0x90,0x91,0x11,0xf0,0x90,0x91,0x11,0xe0,0xfd,0x70,
+0x02,0xe1,0xe2,0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0xe1,0xdb,0x90,
+0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x15,0xe0,0x90,0x91,0x12,
+0xf0,0x75,0x63,0x01,0x75,0x64,0x91,0x75,0x65,0x12,0x75,0x66,0x01,0x7b,0x01,0x7a,
+0x91,0x79,0x13,0x12,0x46,0x6d,0x90,0x91,0x13,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,
+0x01,0x90,0x91,0x9c,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,
+0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,
+0x12,0x43,0x15,0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,
+0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x17,0xf0,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x18,0xf0,0x80,0x33,
+0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,
+0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x15,
+0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,
+0x91,0x16,0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x91,0x79,0x14,0x12,0x52,0x08,
+0x90,0x91,0x11,0xe0,0xff,0x90,0x91,0x9c,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xf4,0x5f,0x90,0x91,0x11,0xf0,0x90,0x91,0x9c,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,
+0x91,0x9c,0xe0,0x04,0xf0,0xe0,0x54,0x03,0xf0,0xc1,0xaa,0x90,0x01,0xc6,0xe0,0x44,
+0x02,0xf0,0x22,0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,
+0x44,0x01,0xf0,0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,0x2d,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x54,0xef,0xf0,0x22,0xe4,0xf5,0x6d,0xf5,0x71,0xf5,0x70,0x75,0x6f,
+0x0c,0x75,0x6e,0x0c,0x90,0x91,0x3b,0xf0,0x90,0x91,0x37,0xf0,0x90,0x91,0x36,0xf0,
+0x90,0x91,0x39,0x04,0xf0,0x90,0x91,0x27,0xf0,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,
+0x29,0xf0,0x90,0x91,0x34,0x74,0x07,0xf0,0xe4,0x90,0x91,0x28,0xf0,0x90,0x91,0x32,
+0xf0,0xa3,0x74,0x03,0xf0,0x90,0x91,0x2f,0x74,0x0a,0xf0,0xa3,0x74,0x05,0xf0,0x90,
+0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,0xe4,0x90,0x91,0x2b,0xf0,
+0x90,0x91,0x25,0xf0,0x90,0x91,0x50,0xf0,0x90,0x91,0x31,0xf0,0x90,0x91,0x3a,0xf0,
+0x90,0x91,0x26,0xf0,0x90,0x91,0x38,0xf0,0x90,0x91,0x2e,0xf0,0x90,0x91,0x2c,0xf0,
+0x22,0x12,0x4c,0x89,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,
+0x30,0x90,0x91,0x37,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,
+0x91,0x36,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x6f,0x54,
+0x0f,0xd3,0x94,0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,
+0x22,0x90,0x01,0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0x12,0x4c,0x89,0xef,0x64,0x01,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x58,0xe5,0x71,0x54,0x03,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,0xe5,0x6f,0x54,0x0f,0xd3,0x94,0x02,0x40,
+0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x39,0xe5,0x71,0x30,0xe2,0x08,0x90,0x01,
+0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x71,0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,
+0xf0,0x80,0x1f,0x90,0x91,0x29,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,
+0x11,0x90,0x91,0x31,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x80,0xf0,0x80,0x03,0x7f,
+0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,0x22,0x90,0x06,0x04,0xe0,0x54,
+0xbf,0xf0,0xef,0x60,0x0a,0xe5,0x6d,0xb4,0x01,0x05,0xe4,0xff,0x12,0x47,0xc9,0x53,
+0x6e,0xf0,0x43,0x6e,0x0c,0x22,0x90,0x91,0x9d,0xef,0xf0,0x31,0x9f,0x90,0x91,0x9d,
+0xe0,0x60,0x05,0x90,0x05,0x22,0xe4,0xf0,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x90,
+0x90,0xd8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,
+0x2f,0xd9,0x90,0x90,0xdc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xe0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xe4,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,
+0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x91,0x51,0xe0,0xb4,
+0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,
+0x12,0x34,0x81,0x22,0x8f,0x77,0xe4,0x90,0x91,0x96,0xf0,0xa3,0xf0,0x90,0x01,0x09,
+0xe0,0x7f,0x00,0x30,0xe7,0x02,0x7f,0x01,0xef,0x65,0x77,0x60,0x3e,0xc3,0x90,0x91,
+0x97,0xe0,0x94,0x88,0x90,0x91,0x96,0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,
+0x44,0x80,0xf0,0x22,0x90,0x91,0x96,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,
+0x7e,0x00,0x12,0x37,0x54,0xd3,0x90,0x91,0x97,0xe0,0x94,0x32,0x90,0x91,0x96,0xe0,
+0x94,0x00,0x40,0xb9,0x90,0x01,0xc7,0xe0,0x30,0xe0,0xb2,0x22,0x53,0x6e,0xf0,0x43,
+0x6e,0x01,0x12,0x45,0x00,0x12,0x45,0x01,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0x8f,
+0x78,0x12,0x47,0xe6,0xef,0x64,0x01,0x70,0x2e,0x90,0x91,0x44,0x12,0x48,0x1e,0xe5,
+0x78,0x60,0x10,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,
+0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,
+0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xe5,0x6d,0x64,0x01,0x70,0x63,0xe5,0x70,
+0x60,0x5f,0xe5,0x70,0x64,0x02,0x60,0x06,0xe5,0x70,0x64,0x05,0x70,0x27,0x90,0x06,
+0xab,0xe0,0x90,0x91,0x27,0xf0,0x90,0x06,0xaa,0xe0,0x90,0x91,0x39,0xf0,0x90,0x91,
+0x27,0xe0,0x70,0x07,0x90,0x91,0x39,0xe0,0xff,0x80,0x05,0x90,0x91,0x27,0xe0,0xff,
+0x90,0x91,0x27,0xef,0xf0,0x90,0x91,0x29,0xe0,0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,
+0x91,0x28,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x71,0xfd,
+0x53,0x71,0xef,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0xc7,0x71,
+0x22,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfb,
+0x90,0x91,0x78,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x70,0x02,0x61,0xc0,
+0xe5,0x6d,0x64,0x01,0x70,0x7a,0xe5,0x70,0x14,0x60,0x2b,0x24,0xfd,0x60,0x27,0x24,
+0x02,0x24,0xfb,0x50,0x02,0x80,0x21,0x90,0x91,0x27,0xe0,0x14,0xf0,0xe0,0x60,0x04,
+0xa3,0xe0,0x60,0x14,0x90,0x91,0x27,0xe0,0x70,0x08,0x90,0x91,0x39,0xe0,0x90,0x91,
+0x27,0xf0,0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x45,0x43,0x71,0x10,0xe4,0x90,
+0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,0x90,0x91,0x34,0xe0,
+0x2f,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,
+0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x10,
+0x90,0x91,0x2c,0xe0,0x90,0x07,0x78,0x60,0x04,0x74,0x0d,0xf0,0x22,0x74,0x09,0xf0,
+0x22,0xe4,0xfb,0x90,0x91,0x7c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x60,
+0x5f,0xe5,0x6d,0x64,0x01,0x70,0x59,0x0b,0x90,0x91,0x27,0xf0,0x04,0x60,0x51,0x43,
+0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,
+0x90,0x91,0x34,0xe0,0x2f,0x90,0x91,0x67,0xf0,0xe4,0x1b,0x12,0x44,0x54,0x90,0x01,
+0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,
+0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x11,0x90,0x91,0x2c,0xe0,0x90,0x07,
+0x78,0x60,0x05,0x74,0x0d,0xf0,0x80,0x03,0x74,0x09,0xf0,0x90,0x05,0x22,0xe4,0xf0,
+0x22,0x90,0x91,0x80,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x14,0x24,0xfd,
+0x50,0x02,0x80,0x21,0x90,0x91,0x3b,0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0d,
+0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,
+0xe4,0xff,0x12,0x48,0xb3,0x22,0x90,0x91,0x08,0xe0,0x54,0xf0,0x44,0x03,0xf0,0x54,
+0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x58,0x90,0x91,0x71,0x12,0x43,0x41,
+0x0b,0x7a,0x91,0x79,0x08,0x02,0x46,0xb7,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,
+0x91,0x84,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,0x91,0x84,0xe0,
+0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x91,0x87,0xe0,0x94,
+0xe8,0x90,0x91,0x86,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,0x44,0x10,0xf0,
+0x7f,0x00,0x80,0x15,0x90,0x91,0x86,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x0a,
+0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1f,0x12,0x2a,
+0x8b,0x00,0x00,0x00,0x00,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x91,0x3b,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,0x91,0x25,0xf0,0x90,
+0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x01,0x90,0x91,0x26,0xf0,0xef,0xc3,0x13,0x54,
+0x01,0x90,0x91,0x2e,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x13,0x13,0x54,0x01,
+0x90,0x91,0x2c,0xf0,0x90,0x91,0x2e,0xe0,0x90,0x91,0x1f,0x70,0x26,0x12,0x2a,0x8b,
+0x00,0x00,0x02,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x60,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x1f,0x12,0x2a,0x8b,0x00,0x00,0x03,
+0x10,0x80,0x24,0x12,0x2a,0x8b,0x00,0x00,0x01,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x60,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x1f,
+0x12,0x2a,0x8b,0x00,0x00,0x03,0x00,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x26,0xe0,0x70,0x3d,
+0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x1f,
+0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0xec,0x44,0x02,0xfc,0x90,0x91,0x1f,
+0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,0x91,0x1c,
+0x12,0x43,0x21,0x12,0x49,0x80,0x90,0x01,0xe5,0xe5,0x70,0xf0,0x90,0x91,0x3b,0xe0,
+0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0xff,
+0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x91,0x2f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,
+0x90,0x91,0x30,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x91,0x2d,0xf0,0x90,0x00,0x03,
+0x12,0x42,0x20,0x90,0x91,0x35,0xf0,0x22,0x90,0x91,0x2f,0x74,0x0a,0xf0,0x90,0x91,
+0x30,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,
+0x22,0x90,0x02,0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x91,
+0x41,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x42,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x43,0xf0,0x90,0x00,0x03,0x12,
+0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0xae,0x05,0xed,0x2f,0x90,0x91,0x45,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x47,0xe0,0x90,0x91,0x1d,0xf0,0x90,0x91,0x48,0xe0,0xf5,0x19,0xa3,0xe0,
+0xf5,0x1a,0xe4,0xf5,0x16,0x74,0x4a,0x25,0x16,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,
+0xe0,0xff,0x74,0x1b,0x25,0x16,0xf8,0xa6,0x07,0x05,0x16,0xe5,0x16,0xb4,0x04,0xe5,
+0x90,0x91,0x1d,0xe0,0x12,0x43,0x4a,0x66,0xe6,0x00,0x68,0x13,0x01,0x66,0xee,0x02,
+0x66,0xee,0x03,0x66,0xee,0x04,0x68,0x13,0x05,0x67,0xe3,0x80,0x67,0xf9,0x81,0x68,
+0x13,0x82,0x00,0x00,0x68,0x0f,0xaf,0x1e,0x12,0x73,0xdd,0x02,0x68,0x13,0x90,0x91,
+0x1d,0xe0,0xff,0xb4,0x02,0x08,0x90,0x91,0x1c,0x74,0x01,0xf0,0x80,0x0f,0xef,0x90,
+0x91,0x1c,0xb4,0x03,0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,0xc3,0xe5,0x19,
+0x94,0x08,0x50,0x4a,0xe4,0xf5,0x16,0x90,0x91,0x1c,0xe0,0xff,0xe5,0x16,0xc3,0x9f,
+0x40,0x03,0x02,0x68,0x13,0xc3,0xe5,0x19,0x94,0x01,0x50,0x14,0xe5,0x16,0x25,0x1a,
+0xff,0xc3,0x74,0x03,0x95,0x16,0x24,0x1b,0xf8,0xe6,0xfd,0x12,0x4d,0xa8,0x80,0x1a,
+0xc3,0x74,0x03,0x95,0x16,0x24,0x1b,0xf8,0xe6,0xff,0xe5,0x16,0x7c,0x00,0x25,0x1a,
+0xfd,0xec,0x35,0x19,0x8d,0x82,0xf5,0x83,0xef,0xf0,0x05,0x16,0x80,0xb9,0xc3,0xe5,
+0x19,0x94,0x10,0x40,0x03,0x02,0x68,0x13,0x90,0x91,0x1d,0xe0,0x64,0x04,0x60,0x03,
+0x02,0x68,0x13,0xaf,0x1c,0xfc,0xfd,0xfe,0x78,0x10,0x12,0x2a,0x6c,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1b,0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x2a,0x6c,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x42,0xfc,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0xaf,0x1d,0xe4,0xfc,0xfd,0xfe,0x78,0x08,0x12,0x2a,0x6c,0xd0,0x03,
+0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x42,0xfc,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0xaf,0x1e,0xe4,0xfc,0xfd,0xfe,0x12,0x42,0xfc,0xa3,0x12,0x2a,0x7f,0x90,0x91,
+0x1e,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0xaf,0x1a,0xae,0x19,0x12,0x2f,
+0xd9,0x80,0x30,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,
+0x17,0xaf,0x18,0xfe,0x12,0x37,0x54,0x80,0x1a,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,
+0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,0xaf,0x18,0xfe,0x12,0x36,0xcb,0x80,0x04,0x7f,
+0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0x8e,0x0e,0x8f,0x0f,0x8b,0x10,
+0x8a,0x11,0x89,0x12,0xe4,0x90,0x91,0x11,0xf0,0xef,0x90,0x00,0x31,0xf0,0x12,0x4c,
+0xa0,0xe5,0x0e,0x54,0x03,0xff,0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x12,0x4c,
+0xa0,0x90,0x00,0x33,0xe0,0x54,0x7f,0xf0,0x12,0x4c,0xa0,0x90,0x00,0x33,0xe0,0x20,
+0xe7,0x0e,0x90,0x91,0x11,0xe0,0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,
+0x90,0x91,0x11,0xe0,0xc3,0x94,0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x10,0xaa,
+0x11,0xa9,0x12,0x12,0x42,0x4d,0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x91,0x98,
+0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,
+0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,0x91,0x99,0xe0,0x94,0xe8,0x90,
+0x91,0x98,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x37,
+0x54,0x90,0x91,0x98,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0x7f,0x78,0x7e,
+0x08,0x12,0x27,0xde,0x90,0x90,0xd8,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,
+0xde,0x90,0x90,0xdc,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,
+0xe0,0x12,0x2a,0x7f,0x90,0x91,0x51,0xe0,0x90,0x90,0xd8,0xb4,0x01,0x0d,0x12,0x43,
+0x09,0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x09,0xef,0x54,
+0xc7,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x90,0xdc,0x12,0x43,0x09,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xe0,0x12,0x43,0x09,0xef,0x44,
+0x02,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,
+0x7f,0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xe4,0x12,0x2a,0x7f,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x91,
+0x51,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,
+0xfd,0x7f,0x01,0x12,0x34,0x81,0x22,0xef,0x70,0x02,0x61,0x3d,0x90,0x90,0xe8,0xe0,
+0x60,0x02,0xe1,0x08,0x90,0x90,0xd4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x80,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x84,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x88,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x90,0x8c,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x90,0x90,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x94,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x98,0x12,0x43,0x09,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x9c,0x12,
+0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x90,0xa0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x90,0xa4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xa8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xac,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xb0,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,
+0xb4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x90,0xb8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x90,0xbc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc0,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc4,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xc8,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,
+0x90,0x90,0xcc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,
+0x12,0x2f,0xd9,0x90,0x90,0xd0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xe8,0x74,0x01,0xf0,0x22,0x90,0x90,0xe8,
+0xe0,0x64,0x01,0x60,0x02,0xe1,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,
+0xd4,0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x80,0x12,0x2a,
+0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x84,0x12,0x2a,0x7f,0x7f,0x6c,
+0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x88,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x90,0x8c,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x90,0x90,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x94,0x12,
+0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x98,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x9c,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x90,0xa0,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x90,0xa4,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xa8,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xac,0x12,0x2a,0x7f,
+0x7f,0xd4,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xb0,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x90,0xb4,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x90,0xb8,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,
+0xbc,0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xc0,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x90,0xc4,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0d,0x12,0x27,0xde,0x90,0x90,0xc8,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x27,0xde,0x90,0x90,0xcc,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x90,0xd0,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,
+0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x44,0xc0,0xfd,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,
+0xd9,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,
+0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,
+0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,
+0x12,0x2f,0xd9,0xe4,0x90,0x90,0xe8,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0xa0,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,0x12,
+0x4c,0xa0,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,0xef,
+0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,0x80,
+0x44,0x90,0x91,0xa0,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0x12,0x4c,0x98,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,
+0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,
+0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,
+0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfd,0x7f,0x45,0x12,0x4d,
+0xa8,0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x90,0xf7,0xf0,0x90,0x90,0xfd,0xf0,
+0x90,0x91,0x00,0xf0,0x90,0x90,0xfe,0xf0,0x90,0x91,0x01,0xf0,0x90,0x90,0xff,0xf0,
+0x90,0x91,0x02,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,
+0x90,0x90,0xee,0xf0,0x90,0x90,0xf3,0xf0,0x90,0x90,0xf5,0xf0,0x90,0x91,0x07,0xf0,
+0x90,0x90,0xf8,0xf0,0x90,0x90,0xf4,0xf0,0x90,0x90,0xed,0xf0,0x90,0x00,0x51,0xe0,
+0x44,0xc0,0xfd,0x7f,0x51,0x02,0x4d,0xa8,0x90,0x91,0x07,0xe0,0x64,0x01,0x60,0x08,
+0x90,0x90,0xf5,0xe0,0x60,0x02,0x01,0xdf,0x90,0x90,0xe9,0xe0,0xc3,0x94,0xff,0x50,
+0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x90,0xea,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,
+0x04,0xf0,0xe4,0x80,0x28,0x90,0x90,0xeb,0xe0,0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,
+0xf0,0xe4,0x90,0x90,0xea,0xf0,0x80,0x15,0x90,0x90,0xec,0xe0,0xc3,0x94,0xff,0x50,
+0x10,0xe0,0x04,0xf0,0xe4,0x90,0x90,0xeb,0xf0,0x90,0x90,0xea,0xf0,0x90,0x90,0xe9,
+0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,0x32,0x90,0x90,0xfd,
+0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x90,0xfe,0xe0,0xc3,
+0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x90,0xff,0xe0,0xc3,0x94,
+0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x90,0xfe,0xf0,0x90,0x90,0xfd,0xf0,0x90,
+0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x91,0x00,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,
+0x04,0xf0,0x80,0x24,0x90,0x91,0x01,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,
+0xe4,0x80,0x11,0x90,0x91,0x02,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,
+0x90,0x91,0x01,0xf0,0x90,0x91,0x00,0xf0,0x90,0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,
+0xe5,0x6e,0x30,0xe3,0x04,0xe4,0xff,0x80,0x02,0x7f,0x01,0x02,0x47,0xc9,0x90,0x91,
+0x53,0xe0,0x30,0xe0,0x49,0xe5,0x6d,0x64,0x01,0x70,0x43,0x90,0x91,0x52,0xe0,0x04,
+0xf0,0xe5,0x70,0x64,0x03,0x60,0x05,0xe5,0x70,0xb4,0x06,0x0d,0x90,0x91,0x52,0xe0,
+0xff,0x74,0x01,0xd3,0x9f,0x50,0x14,0x80,0x07,0x90,0x91,0x52,0xe0,0xb4,0x0a,0x0b,
+0x90,0x91,0x55,0xe0,0x04,0xf0,0xe4,0x90,0x91,0x52,0xf0,0x90,0x91,0x55,0xe0,0xff,
+0x90,0x91,0x54,0xe0,0xb5,0x07,0x07,0x11,0xe0,0xe4,0x90,0x91,0x55,0xf0,0x22,0x90,
+0x06,0x90,0xe0,0x44,0x01,0xf0,0x90,0x91,0x61,0xe0,0x30,0xe0,0x3c,0x90,0x91,0x5f,
+0xe0,0xff,0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x54,0x01,0xfd,0x12,0x4c,0xb0,0x90,
+0x91,0x60,0xe0,0x75,0xf0,0x20,0xa4,0xff,0xae,0xf0,0x12,0x37,0x54,0x90,0x91,0x5e,
+0xe0,0xc4,0x13,0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,
+0x91,0x5f,0xe0,0xff,0x7d,0x01,0x12,0x4c,0xb0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0x90,0x91,0x19,0xf0,0xa3,0x74,0x08,0xf0,0xa3,0xf0,0xe4,0xa3,0xf0,0x90,
+0x01,0x1f,0xe0,0xfe,0x90,0x01,0x1e,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,
+0x91,0x11,0xf0,0xa3,0xef,0xf0,0x90,0x02,0x87,0xe0,0x90,0x91,0x18,0xf0,0x90,0x91,
+0x56,0xe0,0x20,0xe0,0x02,0x61,0xb7,0xe4,0x90,0x91,0x17,0xf0,0x90,0x91,0x18,0xe0,
+0xff,0x90,0x91,0x17,0xe0,0xc3,0x9f,0x40,0x02,0x61,0xb7,0x90,0x91,0x11,0xe0,0xfc,
+0xa3,0xe0,0xfd,0xec,0xff,0x90,0xfd,0x11,0xf0,0x90,0x91,0x1c,0xef,0xf0,0x74,0x02,
+0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0f,0xfc,0x33,0x33,0x33,0x54,
+0xf8,0xff,0xed,0x24,0x18,0x2f,0x90,0x91,0x15,0xf0,0xe0,0x24,0x00,0xf5,0x82,0xe4,
+0x34,0xfb,0xf5,0x83,0xe0,0x54,0xfc,0x90,0x91,0x16,0xf0,0x74,0x01,0x2d,0xf5,0x82,
+0xe4,0x34,0xfb,0xf5,0x83,0xe0,0xfe,0x74,0x00,0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x7a,0x00,0x24,0x00,0xff,0xea,0x3e,0x54,0x3f,0xab,0x07,0xfa,0x90,0x91,
+0x13,0xf0,0xa3,0xeb,0xf0,0xaf,0x04,0xef,0x75,0xf0,0x08,0xa4,0x24,0x18,0xff,0xe4,
+0x35,0xf0,0xfe,0xef,0x2b,0xfb,0xee,0x3a,0xfa,0x90,0x91,0x5a,0xe0,0xfe,0xa3,0xe0,
+0xff,0xad,0x03,0xac,0x02,0x12,0x45,0x09,0xaa,0x06,0xab,0x07,0x90,0x91,0x15,0xe0,
+0x24,0x00,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x30,0xe7,0x08,0x90,0x91,0x19,
+0x74,0x02,0xf0,0x80,0x05,0xe4,0x90,0x91,0x19,0xf0,0xaf,0x03,0x90,0x91,0x11,0xea,
+0x8f,0xf0,0x12,0x42,0x81,0x90,0x91,0x5c,0xe0,0xfe,0xa3,0xe0,0xff,0x90,0x91,0x11,
+0xe0,0xfc,0xa3,0xe0,0xfd,0xd3,0x9f,0xec,0x9e,0x40,0x1b,0x90,0x91,0x5d,0xe0,0x24,
+0x01,0xff,0x90,0x91,0x5c,0xe0,0x34,0x00,0xfe,0xc3,0xed,0x9f,0xff,0xec,0x9e,0x90,
+0x91,0x11,0xf0,0xa3,0xef,0xf0,0x90,0x91,0x16,0xe0,0xff,0x24,0x40,0x60,0x04,0x24,
+0x20,0x70,0x27,0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x13,0x13,0x54,0x01,0x20,0xe0,
+0x02,0x61,0x8f,0xef,0x90,0x00,0x81,0xb4,0xa0,0x05,0xe0,0x44,0x04,0x80,0x03,0xe0,
+0x44,0x08,0xfd,0x7f,0x81,0x12,0x4d,0xa8,0x61,0x88,0x90,0x91,0x5e,0xe0,0xc4,0x13,
+0x13,0x54,0x03,0x20,0xe0,0x02,0x61,0x8f,0x90,0x91,0x15,0xe0,0xff,0x24,0x00,0xf5,
+0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0c,0x64,0x08,0x70,0x72,0x90,0x91,0x19,
+0xe0,0xfe,0xef,0x2e,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x1e,0xf5,0x82,0xe4,0x34,0xfb,
+0xf5,0x83,0xe0,0x64,0x88,0x70,0x58,0x74,0x1f,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x64,0x8e,0x70,0x49,0x90,0x91,0x19,0xe0,0xff,0x90,0x91,0x15,0xe0,0x2f,
+0xff,0x90,0x91,0x1a,0xe0,0x2f,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x19,0xf5,0x82,0xe4,
+0x34,0xfb,0xf5,0x83,0xe0,0x64,0x03,0x70,0x26,0x74,0x1e,0x2f,0xf5,0x82,0xe4,0x34,
+0xfb,0xf5,0x83,0xe0,0x90,0x00,0x81,0x30,0xe3,0x05,0xe0,0x44,0x01,0x80,0x03,0xe0,
+0x44,0x02,0xfd,0x7f,0x81,0x12,0x4d,0xa8,0x90,0x91,0x56,0xe0,0x44,0x80,0xf0,0x90,
+0x91,0x56,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x02,0x31,0x3f,0x71,
+0xbc,0xbf,0x01,0x13,0x90,0x91,0x11,0xe0,0xfe,0xa3,0xe0,0xff,0x12,0x44,0xb5,0x90,
+0x91,0x17,0xe0,0x04,0xf0,0x21,0xcc,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x56,0xe0,
+0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x11,0xe0,0x44,0x80,0xf0,0x90,0x91,0x5e,
+0xe0,0xc4,0x54,0x0f,0x20,0xe0,0x03,0x7f,0x00,0x22,0x7f,0x01,0x22,0x8f,0x1f,0xe4,
+0x90,0x91,0x22,0xf0,0xe5,0x1f,0x14,0xfe,0x90,0x91,0x22,0xe0,0xff,0xc3,0x9e,0x50,
+0x0e,0xef,0x04,0xfd,0x12,0x34,0xb7,0x90,0x91,0x22,0xe0,0x04,0xf0,0x80,0xe5,0xe5,
+0x1f,0x14,0xff,0x7d,0xff,0x12,0x34,0xb7,0x90,0x91,0x22,0xe5,0x1f,0xf0,0x90,0x91,
+0x22,0xe0,0xc3,0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x34,0xb7,0x90,0x91,
+0x22,0xe0,0x04,0xf0,0x80,0xe8,0xad,0x1f,0x7f,0xff,0x02,0x34,0xb7,0xc3,0xee,0x94,
+0x01,0x40,0x0a,0x0d,0xed,0x13,0x90,0xfd,0x10,0xf0,0xe4,0x2f,0xff,0x22,0xc3,0xee,
+0x94,0x01,0x40,0x1e,0x90,0xfd,0x11,0xe0,0xb5,0x05,0x14,0x90,0x01,0x17,0xe0,0xb5,
+0x05,0x07,0x90,0xfd,0x11,0xe4,0xf0,0x80,0x06,0xed,0x04,0x90,0xfd,0x11,0xf0,0xe4,
+0x2f,0xff,0x22,0x00,0x18,0x58,};
+
+
+
+
+
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c
new file mode 100755
index 0000000000000..4d4a395c12c83
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c
@@ -0,0 +1,2680 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include "drv_types.h"
+#include "rtl8192c_hal.h"
+
+//================================================================================
+//	Constant.
+//================================================================================
+
+//
+// Default LED behavior.
+//
+#define LED_BLINK_NORMAL_INTERVAL	100
+#define LED_BLINK_SLOWLY_INTERVAL	200
+#define LED_BLINK_LONG_INTERVAL	400
+
+#define LED_BLINK_NO_LINK_INTERVAL_ALPHA		1000
+#define LED_BLINK_LINK_INTERVAL_ALPHA			500		//500
+#define LED_BLINK_SCAN_INTERVAL_ALPHA		180 	//150
+#define LED_BLINK_FASTER_INTERVAL_ALPHA		50
+#define LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA	5000
+
+//================================================================================
+// LED object.
+//================================================================================
+
+
+//================================================================================
+//	Prototype of protected function.
+//================================================================================
+
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void BlinkTimerCallback(void *data);
+#else
+void BlinkTimerCallback(struct timer_list *t);
+#endif
+
+static void BlinkWorkItemCallback(struct work_struct *work);
+
+//
+//	Description:
+//		Reset blinking status of LED_871x object.
+//
+static void
+ResetLedStatus(PLED_871x	pLed) {
+	pLed->CurrLedState = RTW_LED_OFF; // Current LED state.
+	pLed->bLedOn = _FALSE; // true if LED is ON, false if LED is OFF.
+	
+	pLed->bLedBlinkInProgress = _FALSE; // true if it is blinking, false o.w..
+	pLed->bLedNoLinkBlinkInProgress = _FALSE;
+	pLed->bLedLinkBlinkInProgress = _FALSE;
+	pLed->bLedStartToLinkBlinkInProgress = _FALSE;
+	pLed->bLedScanBlinkInProgress = _FALSE;
+	pLed->bLedWPSBlinkInProgress = _FALSE;
+	pLed->BlinkTimes = 0; // Number of times to toggle led state for blinking.
+	pLed->BlinkingLedState = LED_UNKNOWN; // Next state for blinking, either RTW_LED_ON or RTW_LED_OFF are.
+}
+
+//================================================================================
+// LED_819xUsb routines. 
+//================================================================================
+
+//
+//	Description:
+//		Initialize an LED_871x object.
+//
+static void
+InitLed871x(
+	_adapter			*padapter,
+	PLED_871x		pLed,
+	LED_PIN_871x	LedPin
+	)
+{
+	pLed->padapter = padapter;
+	pLed->LedPin = LedPin;
+
+	ResetLedStatus(pLed);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _init_timer(&(pLed->BlinkTimer), padapter->pnetdev, BlinkTimerCallback, pLed);
+#else
+        timer_setup(&pLed->BlinkTimer, BlinkTimerCallback, 0);
+#endif
+	_init_workitem(&(pLed->BlinkWorkItem), BlinkWorkItemCallback, pLed);
+}
+
+
+//
+//	Description:
+//		DeInitialize an LED_871x object.
+//
+static void
+DeInitLed871x(
+	PLED_871x			pLed
+	)
+{
+	//call _cancel_workitem_sync(&(pLed->BlinkWorkItem)) 
+    //before _cancel_timer_ex(&(pLed->BlinkTimer)) to 
+    //avoid led timer restarting when driver is removed
+
+	_cancel_workitem_sync(&(pLed->BlinkWorkItem));
+	
+	_cancel_timer_ex(&(pLed->BlinkTimer));
+	
+	// We should reset bLedBlinkInProgress if we cancel the LedControlTimer, 2005.03.10, by rcnjko.
+	ResetLedStatus(pLed);
+}
+
+//
+//	Description:
+//		Turn on LED according to LedPin specified.
+//
+static void
+SwLedOn(
+	_adapter			*padapter, 
+	PLED_871x		pLed
+)
+{
+	u8	LedCfg;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+
+	if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))
+	{
+		return;
+	}
+
+	if( 	(BOARD_MINICARD == pHalData->BoardType )||
+		(BOARD_USB_SOLO == pHalData->BoardType)||
+		(BOARD_USB_COMBO == pHalData->BoardType))
+	{
+		LedCfg = rtw_read8(padapter, REG_LEDCFG2);
+		switch(pLed->LedPin)
+		{	
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+				rtw_write8(padapter, REG_LEDCFG2, (LedCfg&0xf0)|BIT5|BIT6); // SW control led0 on.
+				break;
+
+			case LED_PIN_LED1:
+				rtw_write8(padapter, REG_LEDCFG2, (LedCfg&0x0f)|BIT5); // SW control led1 on.
+				break;
+
+			default:
+				break;
+	
+		}
+	}
+	else
+	{	
+		switch(pLed->LedPin)
+		{
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+				if(pHalData->AntDivCfg)
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG2);
+					rtw_write8(padapter, REG_LEDCFG2, (LedCfg&0xe0)|BIT7|BIT6|BIT5); // SW control led0 on.
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOn LED0 0x%x\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG2)));
+				}
+				else
+#endif
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG0);
+					rtw_write8(padapter,REG_LEDCFG0, LedCfg&0x70); // SW control led0 on.
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOn LED0 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+				}
+				break;
+
+			case LED_PIN_LED1:
+				LedCfg = rtw_read8(padapter,(REG_LEDCFG1));
+				rtw_write8(padapter,(REG_LEDCFG1), LedCfg&0x70); // SW control led1 on.
+				//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOn LED1 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+			
+				break;
+
+			default:
+				break;
+		}
+	}
+	pLed->bLedOn = _TRUE;
+	
+}
+
+
+//
+//	Description:
+//		Turn off LED according to LedPin specified.
+//
+static void
+SwLedOff(
+	_adapter			*padapter, 
+	PLED_871x		pLed
+)
+{
+	u8	LedCfg;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+
+	if((padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))	
+	{
+		goto exit;
+	}
+
+	if( 	(BOARD_MINICARD == pHalData->BoardType )||
+		(BOARD_USB_SOLO == pHalData->BoardType)||
+		(BOARD_USB_COMBO == pHalData->BoardType))
+	{
+		LedCfg = rtw_read8(padapter, REG_LEDCFG2);//0x4E
+
+		switch(pLed->LedPin)
+		{
+
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+				if(BOARD_USB_COMBO == pHalData->BoardType)
+				{
+					LedCfg &= 0x90; // Set to software control.				
+					rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3));				
+					LedCfg = rtw_read8(padapter, REG_MAC_PINMUX_CFG);
+					LedCfg &= 0xFE;
+					rtw_write8(padapter, REG_MAC_PINMUX_CFG, LedCfg);									
+				}
+				else
+				{
+					LedCfg &= 0xf0; // Set to software control.
+					if(pHalData->bLedOpenDrain == _TRUE) // Open-drain arrangement for controlling the LED
+						rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT1|BIT5|BIT6));
+					else
+						rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3|BIT5|BIT6));
+				}
+				break;
+
+			case LED_PIN_LED1:
+				LedCfg &= 0x0f; // Set to software control.
+				rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3));
+				break;
+
+			default:
+				break;
+		}
+	}
+	else
+	{
+		switch(pLed->LedPin)
+		{
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+				if(pHalData->AntDivCfg)
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG2);
+					LedCfg &= 0xe0; // Set to software control. 			
+					rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3|BIT7|BIT6|BIT5));
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOff LED0 0x%x\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG2)));
+				}
+				else
+#endif
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG0);
+					LedCfg &= 0x70; // Set to software control. 			
+					rtw_write8(padapter, REG_LEDCFG0, (LedCfg|BIT3));
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOff LED0 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+				}
+				break;
+
+			case LED_PIN_LED1:
+				LedCfg = rtw_read8(padapter, (REG_LEDCFG1));
+				LedCfg &= 0x70; // Set to software control.
+				rtw_write8(padapter,  (REG_LEDCFG1), (LedCfg|BIT3));
+				//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOff LED1 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+				break;
+
+			default:
+				break;
+		}
+	}
+
+exit:
+	pLed->bLedOn = _FALSE;
+	
+}
+
+//================================================================================
+// Interface to manipulate LED objects.
+//================================================================================
+
+
+//
+//	Description:
+//		Implementation of LED blinking behavior.
+//		It toggle off LED and schedule corresponding timer if necessary.
+//
+static void
+SwLedBlink(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON ) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,( "Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	// Determine if we shall change LED state again.
+	pLed->BlinkTimes--;
+	switch(pLed->CurrLedState)
+	{
+
+	case LED_BLINK_NORMAL: 
+		if(pLed->BlinkTimes == 0)
+		{
+			bStopBlinking = _TRUE;
+		}
+		break;
+		
+	case LED_BLINK_StartToBlink:
+		if( check_fwstate(pmlmepriv, _FW_LINKED) && check_fwstate(pmlmepriv, WIFI_STATION_STATE) )
+		{
+			bStopBlinking = _TRUE;
+		}
+		if( check_fwstate(pmlmepriv, _FW_LINKED) &&
+			(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) )
+		{
+			bStopBlinking = _TRUE;
+		}
+		else if(pLed->BlinkTimes == 0)
+		{
+			bStopBlinking = _TRUE;
+		}
+		break;
+
+	case LED_BLINK_WPS:
+		if( pLed->BlinkTimes == 0 )
+		{
+			bStopBlinking = _TRUE;
+		}
+		break;
+
+
+	default:
+		bStopBlinking = _TRUE;
+		break;
+			
+	}
+	
+	if(bStopBlinking)
+	{
+		//if( padapter->pwrctrlpriv.cpwm >= PS_STATE_S2)
+		if(0)
+		{
+			SwLedOff(padapter, pLed);
+		}
+		else if( (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) && (pLed->bLedOn == _FALSE))
+		{
+			SwLedOn(padapter, pLed);
+		}
+		else if( (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) &&  pLed->bLedOn == _TRUE)
+		{
+			SwLedOff(padapter, pLed);
+		}
+
+		pLed->BlinkTimes = 0;
+		pLed->bLedBlinkInProgress = _FALSE;
+	}
+	else
+	{
+		// Assign LED state to toggle.
+		if( pLed->BlinkingLedState == RTW_LED_ON ) 
+			pLed->BlinkingLedState = RTW_LED_OFF;
+		else 
+			pLed->BlinkingLedState = RTW_LED_ON;
+
+		// Schedule a timer to toggle LED state. 
+		switch( pLed->CurrLedState )
+		{
+		case LED_BLINK_NORMAL:
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			break;
+		
+		case LED_BLINK_SLOWLY:
+		case LED_BLINK_StartToBlink:
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			break;
+
+		case LED_BLINK_WPS:
+			{
+				if( pLed->BlinkingLedState == RTW_LED_ON )
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+				else
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+			}
+			break;
+
+		default:
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			break;
+		}
+	}
+}
+
+
+static void
+SwLedBlink1(
+	PLED_871x			pLed
+	)
+{
+	_adapter				*padapter = pLed->padapter;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct led_priv		*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+	PLED_871x 			pLed1 = &(ledpriv->SwLed1);	
+	u8					bStopBlinking = _FALSE;
+
+	if(pHalData->EEPROMCustomerID == RT_CID_819x_CAMEO)
+		pLed = &(ledpriv->SwLed1);	
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON ) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,( "Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+
+	if(pHalData->EEPROMCustomerID == RT_CID_DEFAULT)
+	{
+		if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+		{
+			if(!pLed1->bSWLedCtrl)
+			{
+				SwLedOn(padapter, pLed1); 	
+				pLed1->bSWLedCtrl = _TRUE;
+			}
+			else if(!pLed1->bLedOn)	
+				SwLedOn(padapter, pLed1);
+			RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (): turn on pLed1\n"));
+		}
+		else 
+		{
+			if(!pLed1->bSWLedCtrl)
+			{
+				SwLedOff(padapter, pLed1);
+				pLed1->bSWLedCtrl = _TRUE;
+			}
+			else if(pLed1->bLedOn)
+				SwLedOff(padapter, pLed1);
+			RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (): turn off pLed1\n"));		
+		}
+	}
+
+
+	if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+	{
+		SwLedOff(padapter, pLed);
+		ResetLedStatus(pLed);
+		return;
+	}
+				
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_BLINK_SLOWLY:			
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_NORMAL:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+			break;
+			
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			
+			if(bStopBlinking)
+			{
+				if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->bLedLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_NORMAL;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+					
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->bLedNoLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->bLedLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_NORMAL;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->bLedNoLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->BlinkTimes = 0;
+				pLed->bLedBlinkInProgress = _FALSE;	
+			}
+			else
+			{
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_BLINK_WPS:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_WPS_STOP:	//WPS success
+			if(pLed->BlinkingLedState == RTW_LED_ON)
+				bStopBlinking = _FALSE;
+			else
+				bStopBlinking = _TRUE;				
+
+			if(bStopBlinking)
+			{
+				pLed->bLedLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_NORMAL;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+				RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+					
+				pLed->bLedWPSBlinkInProgress = _FALSE;	
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+			}
+			break;
+					
+		default:
+			break;
+	}
+
+}
+
+static void
+SwLedBlink2(
+	PLED_871x			pLed
+	)
+{
+	_adapter				*padapter = pLed->padapter;
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+	u8					bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	switch(pLed->CurrLedState)
+	{	
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON; 
+					SwLedOn(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop scan blink CurrLedState %d\n", pLed->CurrLedState));
+					
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+					SwLedOff(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop scan blink CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON; 
+					SwLedOn(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop CurrLedState %d\n", pLed->CurrLedState));
+					
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+					SwLedOff(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+					
+		default:
+			break;
+	}
+
+}
+
+static void
+SwLedBlink3(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON ) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		if(pLed->CurrLedState != LED_BLINK_WPS_STOP)
+			SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}	
+
+	switch(pLed->CurrLedState)
+	{			
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;				
+					if( !pLed->bLedOn )
+						SwLedOn(padapter, pLed);
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;									
+					if( pLed->bLedOn )
+						SwLedOff(padapter, pLed);
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+				 	if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+				
+					if( !pLed->bLedOn )
+						SwLedOn(padapter, pLed);
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;					
+				
+					if( pLed->bLedOn )
+						SwLedOff(padapter, pLed);
+
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->bLedBlinkInProgress = _FALSE;	
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_BLINK_WPS:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_WPS_STOP:	//WPS success
+			if(pLed->BlinkingLedState == RTW_LED_ON)
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+				bStopBlinking = _FALSE;
+			}
+			else
+			{
+				bStopBlinking = _TRUE;				
+			}
+			
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else 
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON; 
+					SwLedOn(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));					
+				}
+				pLed->bLedWPSBlinkInProgress = _FALSE;	
+			}		
+			break;
+			
+					
+		default:
+			break;
+	}
+
+}
+
+
+static void
+SwLedBlink4(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	PLED_871x 		pLed1 = &(ledpriv->SwLed1);	
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON ) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}	
+
+	if(!pLed1->bLedWPSBlinkInProgress && pLed1->BlinkingLedState == LED_UNKNOWN)
+	{
+		pLed1->BlinkingLedState = RTW_LED_OFF;
+		pLed1->CurrLedState = RTW_LED_OFF;
+		SwLedOff(padapter, pLed1);
+	}	
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_BLINK_SLOWLY:			
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_StartToBlink:
+			if( pLed->bLedOn )
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			}
+			break;			
+			
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _FALSE;
+			}
+			
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else 
+				{
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else 
+				{
+					pLed->bLedNoLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+				}
+				pLed->bLedBlinkInProgress = _FALSE;	
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_BLINK_WPS:
+			if( pLed->bLedOn )
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			}
+			break;
+
+		case LED_BLINK_WPS_STOP:	//WPS authentication fail
+			if( pLed->bLedOn )			
+				pLed->BlinkingLedState = RTW_LED_OFF; 			
+			else			
+				pLed->BlinkingLedState = RTW_LED_ON;
+
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			break;
+
+		case LED_BLINK_WPS_STOP_OVERLAP:	//WPS session overlap		
+			pLed->BlinkTimes--;
+			if(pLed->BlinkTimes == 0)
+			{
+				if(pLed->bLedOn)
+				{
+					pLed->BlinkTimes = 1;							
+				}
+				else
+				{
+					bStopBlinking = _TRUE;
+				}
+			}
+
+			if(bStopBlinking)
+			{				
+				pLed->BlinkTimes = 10;			
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+			}
+			else
+			{
+				if( pLed->bLedOn )			
+					pLed->BlinkingLedState = RTW_LED_OFF;			
+				else			
+					pLed->BlinkingLedState = RTW_LED_ON;
+
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			}
+			break;
+
+					
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("SwLedBlink4 CurrLedState %d\n", pLed->CurrLedState));
+
+
+}
+
+static void
+SwLedBlink5(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON ) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF; 									
+					if(pLed->bLedOn)				
+						SwLedOff(padapter, pLed);
+				}
+				else 
+				{		pLed->CurrLedState = RTW_LED_ON;
+						pLed->BlinkingLedState = RTW_LED_ON;					
+						if(!pLed->bLedOn)
+							_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+	
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF; 									
+					if(pLed->bLedOn)
+						SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON; 					
+					if(!pLed->bLedOn)
+						_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+
+				pLed->bLedBlinkInProgress = _FALSE;	
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF; 
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+					
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("SwLedBlink5 CurrLedState %d\n", pLed->CurrLedState));
+
+
+}
+
+static void
+SwLedBlink6(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON ) 
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else 
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("<==== blink6\n"));
+}
+
+
+//
+//	Description:
+//		Callback function of LED BlinkTimer, 
+//		it just schedules to corresponding BlinkWorkItem.
+//
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void BlinkTimerCallback(void * data)
+{
+        PLED_871x         pLed = (PLED_871x)data;
+#else
+void BlinkTimerCallback(struct timer_list *t)
+{
+        PLED_871x         pLed = from_timer(pLed, t, BlinkTimer);
+#endif
+	_adapter		*padapter = pLed->padapter;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))	
+	{
+		//DBG_871X("%s bSurpriseRemoved:%d, bDriverStopped:%d\n", __FUNCTION__, padapter->bSurpriseRemoved, padapter->bDriverStopped);
+		return;
+	}
+
+#ifdef CONFIG_LED_HANDLED_BY_CMD_THREAD
+	rtw_led_blink_cmd(padapter, pLed);
+#else
+	_set_workitem(&(pLed->BlinkWorkItem));
+#endif
+}
+
+//
+//	Description:
+//		Handler function of LED Blinking.
+//		We dispatch acture LED blink action according to LedStrategy.
+//
+void BlinkHandler(PLED_871x	 pLed)
+{
+	struct led_priv	*ledpriv = &(pLed->padapter->ledpriv);
+	_adapter		*padapter = pLed->padapter;
+
+	//DBG_871X("%s (%s:%d)\n",__FUNCTION__, current->comm, current->pid);
+
+	if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))	
+	{
+		//DBG_871X("%s bSurpriseRemoved:%d, bDriverStopped:%d\n", __FUNCTION__, padapter->bSurpriseRemoved, padapter->bDriverStopped);
+		return;
+	}
+
+	switch(ledpriv->LedStrategy)
+	{
+		case SW_LED_MODE0:
+			SwLedBlink(pLed);
+			break;
+		
+		case SW_LED_MODE1:
+			SwLedBlink1(pLed);
+			break;
+		
+		case SW_LED_MODE2:
+			SwLedBlink2(pLed);
+			break;
+			
+		case SW_LED_MODE3:
+			SwLedBlink3(pLed);
+			break;
+
+		case SW_LED_MODE4:
+			SwLedBlink4(pLed);
+			break;			
+
+		case SW_LED_MODE5:
+			SwLedBlink5(pLed);
+			break;
+
+		case SW_LED_MODE6:
+			SwLedBlink6(pLed);
+			break;
+
+		default:
+			//RT_TRACE(COMP_LED, DBG_LOUD, ("BlinkWorkItemCallback 0x%x \n", pHalData->LedStrategy));
+			//SwLedBlink(pLed);
+			break;
+	}
+}
+
+//
+//	Description:
+//		Callback function of LED BlinkWorkItem.
+//		We dispatch acture LED blink action according to LedStrategy.
+//
+static void BlinkWorkItemCallback(struct work_struct *work)
+{
+	PLED_871x	 pLed = container_of(work, LED_871x, BlinkWorkItem);
+	BlinkHandler(pLed);
+}
+
+
+
+//================================================================================
+// Default LED behavior.
+//================================================================================
+
+//
+//	Description:	
+//		Implement each led action for SW_LED_MODE0.
+//		This is default strategy.
+//
+static void
+SwLedControlMode0(
+	_adapter		*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	PLED_871x	pLed = &(ledpriv->SwLed1);
+
+	// Decide led state
+	switch(LedAction)
+	{
+	case LED_CTL_TX:
+	case LED_CTL_RX:
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			pLed->bLedBlinkInProgress = _TRUE;
+
+			pLed->CurrLedState = LED_BLINK_NORMAL;
+			pLed->BlinkTimes = 2;
+
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+		}
+		break;
+
+	case LED_CTL_START_TO_LINK:
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			pLed->bLedBlinkInProgress = _TRUE;
+
+			pLed->CurrLedState = LED_BLINK_StartToBlink;
+			pLed->BlinkTimes = 24;
+
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+		}
+		else
+		{
+			pLed->CurrLedState = LED_BLINK_StartToBlink;
+		}	
+		break;
+		
+	case LED_CTL_LINK:
+		pLed->CurrLedState = RTW_LED_ON;
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			SwLedOn(padapter, pLed);
+		}
+		break;
+
+	case LED_CTL_NO_LINK:
+		pLed->CurrLedState = RTW_LED_OFF;
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			SwLedOff(padapter, pLed);
+		}
+		break;
+	
+	case LED_CTL_POWER_OFF:
+		pLed->CurrLedState = RTW_LED_OFF;
+		if(pLed->bLedBlinkInProgress)
+		{
+			_cancel_timer_ex(&(pLed->BlinkTimer));
+			pLed->bLedBlinkInProgress = _FALSE;
+		}
+		SwLedOff(padapter, pLed);
+		break;
+
+	case LED_CTL_START_WPS:
+		if( pLed->bLedBlinkInProgress == _FALSE || pLed->CurrLedState == RTW_LED_ON)
+		{
+			pLed->bLedBlinkInProgress = _TRUE;
+
+			pLed->CurrLedState = LED_BLINK_WPS;
+			pLed->BlinkTimes = 20;
+
+			if( pLed->bLedOn )
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+			}
+		}
+		break;
+
+	case LED_CTL_STOP_WPS:
+		if(pLed->bLedBlinkInProgress)
+		{
+			pLed->CurrLedState = RTW_LED_OFF;
+			_cancel_timer_ex(&(pLed->BlinkTimer));
+			pLed->bLedBlinkInProgress = _FALSE;
+		}
+		break;
+		
+
+	default:
+		break;
+	}
+	
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+	
+}
+
+ //ALPHA, added by chiyoko, 20090106
+static void
+SwLedControlMode1(
+	_adapter		*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct led_priv		*ledpriv = &(padapter->ledpriv);
+	PLED_871x			pLed = &(ledpriv->SwLed0);
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+
+	if(pHalData->EEPROMCustomerID == RT_CID_819x_CAMEO)
+		pLed = &(ledpriv->SwLed1);
+	
+	switch(LedAction)
+	{		
+		case LED_CTL_POWER_ON:
+		case LED_CTL_START_TO_LINK:	
+		case LED_CTL_NO_LINK:
+			if( pLed->bLedNoLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+	 			if(pLed->bLedBlinkInProgress ==_TRUE)
+				{	
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+	 			}
+				
+				pLed->bLedNoLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_SLOWLY;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			}
+			break;		
+
+		case LED_CTL_LINK:
+			if( pLed->bLedLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{	
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+	 			}
+				pLed->bLedLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_NORMAL;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_SITE_SURVEY:
+			 if((pmlmepriv->LinkDetectInfo.bBusyTraffic) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+			 	;
+			 else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			 {
+			 	if(IS_LED_WPS_BLINKING(pLed))
+					return;
+				
+	  			if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					 pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+	 			if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			 }
+			break;
+		
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+			if(pLed->bLedBlinkInProgress ==_FALSE)
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:
+			 if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			 {
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					 pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}				
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_WPS;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			 }
+			break;
+
+		
+		case LED_CTL_STOP_WPS:
+			if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedNoLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedLinkBlinkInProgress == _TRUE )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				 pLed->bLedLinkBlinkInProgress = _FALSE;
+			}
+			if(pLed->bLedBlinkInProgress ==_TRUE)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if(pLed->bLedScanBlinkInProgress ==_TRUE)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}			
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+			}
+			else
+			{
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+			}
+			
+			pLed->CurrLedState = LED_BLINK_WPS_STOP;
+			if(pLed->bLedOn)
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}					
+			break;		
+
+		case LED_CTL_STOP_WPS_FAIL:			
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;				
+			}			
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			break;				
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF; 
+			if( pLed->bLedNoLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedNoLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}			
+
+			SwLedOff(padapter, pLed);
+			break;
+			
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+}
+
+ //Arcadyan/Sitecom , added by chiyoko, 20090216
+static void
+SwLedControlMode2(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x 		pLed = &(ledpriv->SwLed0);
+	
+	switch(LedAction)
+	{		
+		case LED_CTL_SITE_SURVEY:
+			 if(pmlmepriv->LinkDetectInfo.bBusyTraffic)
+			 	;		 
+			 else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			 {
+			 	if(IS_LED_WPS_BLINKING(pLed))
+					return;
+			 
+	 			if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			 }
+			break;
+		
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+	 		if((pLed->bLedBlinkInProgress ==_FALSE) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+	  		{
+	  		  	if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_LINK:
+			pLed->CurrLedState = RTW_LED_ON;
+			pLed->BlinkingLedState = RTW_LED_ON;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}			
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;			
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:		
+			if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}				
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = RTW_LED_ON;
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			 }			
+			break;
+			
+		case LED_CTL_STOP_WPS:
+			pLed->bLedWPSBlinkInProgress = _FALSE;
+			if(padapter->pwrctrlpriv.rf_pwrstate != rf_on)
+			{
+				SwLedOff(padapter, pLed);
+			}
+			else
+			{
+				pLed->CurrLedState = RTW_LED_ON;
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+				RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+			}
+			break;
+			
+		case LED_CTL_STOP_WPS_FAIL:			
+			pLed->bLedWPSBlinkInProgress = _FALSE;			
+			if(padapter->pwrctrlpriv.rf_pwrstate != rf_on)
+			{
+				SwLedOff(padapter, pLed);
+			}
+			else 
+			{
+				pLed->CurrLedState = RTW_LED_OFF;
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), 0);
+				RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState)); 				
+			}	
+			break;				
+
+		case LED_CTL_START_TO_LINK: 
+		case LED_CTL_NO_LINK:
+			if(!IS_LED_BLINKING(pLed))
+			{
+				pLed->CurrLedState = RTW_LED_OFF;
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}
+			break;
+			
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}			
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+			
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+}
+
+  //COREGA, added by chiyoko, 20090316
+ static void
+ SwLedControlMode3(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x		pLed = &(ledpriv->SwLed0);
+	
+	switch(LedAction)
+	{		
+		case LED_CTL_SITE_SURVEY:
+			if(pmlmepriv->LinkDetectInfo.bBusyTraffic)
+				;		 
+			else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			{
+				if(IS_LED_WPS_BLINKING(pLed))
+					return;
+
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+		
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+	 		if((pLed->bLedBlinkInProgress ==_FALSE) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+	  		{
+	  		  	if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_LINK:
+			if(IS_LED_WPS_BLINKING(pLed))
+				return;
+			
+			pLed->CurrLedState = RTW_LED_ON;
+			pLed->BlinkingLedState = RTW_LED_ON;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}			
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;			
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:		
+			if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}				
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_WPS;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}			
+			break;
+			
+		case LED_CTL_STOP_WPS:			
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;				
+			}						
+			else
+			{
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+			}
+				
+			pLed->CurrLedState = LED_BLINK_WPS_STOP;
+			if(pLed->bLedOn)
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}					
+
+			break;
+			
+		case LED_CTL_STOP_WPS_FAIL:			
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;				
+			}			
+
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;				
+
+		case LED_CTL_START_TO_LINK: 
+		case LED_CTL_NO_LINK:
+			if(!IS_LED_BLINKING(pLed))
+			{
+				pLed->CurrLedState = RTW_LED_OFF;
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}
+			break;
+			
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}			
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+			
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+}
+
+
+ //Edimax-Belkin, added by chiyoko, 20090413
+static void
+SwLedControlMode4(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x		pLed = &(ledpriv->SwLed0);
+	PLED_871x		pLed1 = &(ledpriv->SwLed1);
+	
+	switch(LedAction)
+	{		
+		case LED_CTL_START_TO_LINK:	
+			if(pLed1->bLedWPSBlinkInProgress)
+			{
+				pLed1->bLedWPSBlinkInProgress = _FALSE;
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+		
+				pLed1->BlinkingLedState = RTW_LED_OFF;
+				pLed1->CurrLedState = RTW_LED_OFF;
+
+				if(pLed1->bLedOn)
+					_set_timer(&(pLed->BlinkTimer), 0);
+			}
+				
+			if( pLed->bLedStartToLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+	 			if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+	 			}
+	 			if(pLed->bLedNoLinkBlinkInProgress ==_TRUE)
+				{	
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+	 			}				
+				
+				pLed->bLedStartToLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_StartToBlink;
+				if( pLed->bLedOn )
+				{
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+				}
+				else
+				{
+					pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+				}
+			}
+			break;		
+
+		case LED_CTL_LINK:			
+		case LED_CTL_NO_LINK:
+			//LED1 settings
+			if(LedAction == LED_CTL_LINK)
+			{
+				if(pLed1->bLedWPSBlinkInProgress)
+				{
+					pLed1->bLedWPSBlinkInProgress = _FALSE;
+					_cancel_timer_ex(&(pLed1->BlinkTimer));
+			
+					pLed1->BlinkingLedState = RTW_LED_OFF;
+					pLed1->CurrLedState = RTW_LED_OFF;
+
+					if(pLed1->bLedOn)
+						_set_timer(&(pLed->BlinkTimer), 0);
+				}				
+			}
+			
+			if( pLed->bLedNoLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+	 			if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+	 			}
+				
+				pLed->bLedNoLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_SLOWLY;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			}
+			break;		
+
+		case LED_CTL_SITE_SURVEY:
+			if((pmlmepriv->LinkDetectInfo.bBusyTraffic) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+				;		 
+			else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			{
+				if(IS_LED_WPS_BLINKING(pLed))
+					return;
+
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+		
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+	 		if(pLed->bLedBlinkInProgress ==_FALSE)
+	  		{
+	  		  	if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+	  		  	if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:
+			if(pLed1->bLedWPSBlinkInProgress)
+			{
+				pLed1->bLedWPSBlinkInProgress = _FALSE;
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+			
+				pLed1->BlinkingLedState = RTW_LED_OFF;
+				pLed1->CurrLedState = RTW_LED_OFF;
+
+				if(pLed1->bLedOn)
+					_set_timer(&(pLed->BlinkTimer), 0);
+			}
+				
+			if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}				
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_WPS;
+				if( pLed->bLedOn )
+				{
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+				}
+				else
+				{
+					pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+				}
+			}
+			break;
+		
+		case LED_CTL_STOP_WPS:	//WPS connect success		
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;								
+			}
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+
+			break;		
+
+		case LED_CTL_STOP_WPS_FAIL:		//WPS authentication fail			
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;				
+			}			
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+
+			//LED1 settings
+			if(pLed1->bLedWPSBlinkInProgress)
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+			else	
+				pLed1->bLedWPSBlinkInProgress = _TRUE;				
+
+			pLed1->CurrLedState = LED_BLINK_WPS_STOP;
+			if( pLed1->bLedOn )
+				pLed1->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed1->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+
+			break;				
+
+		case LED_CTL_STOP_WPS_FAIL_OVERLAP:	//WPS session overlap		
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;								
+			}
+			
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+
+			//LED1 settings
+			if(pLed1->bLedWPSBlinkInProgress)
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+			else	
+				pLed1->bLedWPSBlinkInProgress = _TRUE;				
+
+			pLed1->CurrLedState = LED_BLINK_WPS_STOP_OVERLAP;
+			pLed1->BlinkTimes = 10;
+			if( pLed1->bLedOn )
+				pLed1->BlinkingLedState = RTW_LED_OFF; 
+			else
+				pLed1->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			
+			break;
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF; 
+			
+			if( pLed->bLedNoLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedNoLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}	
+			if( pLed->bLedStartToLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedStartToLinkBlinkInProgress = _FALSE;
+			}			
+
+			if( pLed1->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+				pLed1->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed1->BlinkingLedState = LED_UNKNOWN;				
+			SwLedOff(padapter, pLed);
+			SwLedOff(padapter, pLed1);			
+			break;
+			
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+}
+
+
+
+ //Sercomm-Belkin, added by chiyoko, 20090415
+static void
+SwLedControlMode5(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x		pLed = &(ledpriv->SwLed0);
+
+	if(pHalData->EEPROMCustomerID == RT_CID_819x_CAMEO)
+		pLed = &(ledpriv->SwLed1);
+	
+	switch(LedAction)
+	{		
+		case LED_CTL_POWER_ON:
+		case LED_CTL_NO_LINK:
+		case LED_CTL_LINK: 	//solid blue
+			pLed->CurrLedState = RTW_LED_ON;
+			pLed->BlinkingLedState = RTW_LED_ON; 
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_SITE_SURVEY:
+			if((pmlmepriv->LinkDetectInfo.bBusyTraffic) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+				;		 
+			else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			{				
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+		
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+	 		if(pLed->bLedBlinkInProgress ==_FALSE)
+	  		{
+	  		  	if(pLed->CurrLedState == LED_SCAN_BLINK)
+				{
+					return;
+				}			
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF; 
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;				
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF; 
+
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}			
+				
+			SwLedOff(padapter, pLed);
+			break;
+			
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+}
+
+ //WNC-Corega, added by chiyoko, 20090902
+static void
+SwLedControlMode6(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x pLed0 = &(ledpriv->SwLed0);
+	
+	switch(LedAction)
+	{
+		case LED_CTL_POWER_ON:
+		case LED_CTL_LINK:
+		case LED_CTL_NO_LINK:
+			_cancel_timer_ex(&(pLed0->BlinkTimer));
+			pLed0->CurrLedState = RTW_LED_ON;
+			pLed0->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed0->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_POWER_OFF:
+			SwLedOff(padapter, pLed0);
+			break;
+
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("ledcontrol 6 Led %d\n", pLed0->CurrLedState));
+}
+
+
+//
+//	Description:	
+//		Dispatch LED action according to pHalData->LedStrategy. 
+//
+static void
+LedControl871x(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+	)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+
+       if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE) 
+	   	||(padapter->hw_init_completed == _FALSE) )	
+       {
+             return;
+       }
+
+
+	if( ledpriv->bRegUseLed == _FALSE)
+		return;
+
+	//if (!priv->up)
+	//	return;
+
+	//if(priv->bInHctTest)
+	//	return;
+
+	if( (padapter->pwrctrlpriv.rf_pwrstate != rf_on &&
+		padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS) &&
+		(LedAction == LED_CTL_TX || LedAction == LED_CTL_RX || 
+		 LedAction == LED_CTL_SITE_SURVEY || 
+		 LedAction == LED_CTL_LINK || 
+		 LedAction == LED_CTL_NO_LINK ||
+		 LedAction == LED_CTL_POWER_ON) )
+	{
+		return;
+	}
+	
+	switch(ledpriv->LedStrategy)
+	{
+		case SW_LED_MODE0:
+			//SwLedControlMode0(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE1:
+			SwLedControlMode1(padapter, LedAction);
+			break;
+		case SW_LED_MODE2:
+			SwLedControlMode2(padapter, LedAction);
+                	break;
+
+		case SW_LED_MODE3:
+			SwLedControlMode3(padapter, LedAction);
+			break;	
+
+		case SW_LED_MODE4:
+			SwLedControlMode4(padapter, LedAction);
+			break;			
+
+		case SW_LED_MODE5:
+			SwLedControlMode5(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE6:
+			SwLedControlMode6(padapter, LedAction);
+			break;
+
+		default:
+			break;
+	}
+	
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("LedStrategy:%d, LedAction %d\n", ledpriv->LedStrategy,LedAction));
+}
+
+//
+//	Description:
+//		Initialize all LED_871x objects.
+//
+void
+rtl8192cu_InitSwLeds(
+	_adapter	*padapter
+	)
+{
+	struct led_priv *pledpriv = &(padapter->ledpriv);
+
+	pledpriv->LedControlHandler = LedControl871x;
+
+	InitLed871x(padapter, &(pledpriv->SwLed0), LED_PIN_LED0);
+
+	InitLed871x(padapter,&(pledpriv->SwLed1), LED_PIN_LED1);
+}
+
+
+//
+//	Description:
+//		DeInitialize all LED_819xUsb objects.
+//
+void
+rtl8192cu_DeInitSwLeds(
+	_adapter	*padapter
+	)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+
+	DeInitLed871x( &(ledpriv->SwLed0) );
+	DeInitLed871x( &(ledpriv->SwLed1) );
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c
new file mode 100755
index 0000000000000..1119cf81bcdc6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c
@@ -0,0 +1,229 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192CU_RECV_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <mlme_osdep.h>
+#include <ip.h>
+#include <if_ether.h>
+#include <ethernet.h>
+
+#include <usb_ops.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <wifi.h>
+#include <circ_buf.h>
+
+#include <rtl8192c_hal.h>
+
+
+void rtl8192cu_init_recvbuf(_adapter *padapter, struct recv_buf *precvbuf)
+{
+
+	precvbuf->transfer_len = 0;
+
+	precvbuf->len = 0;
+
+	precvbuf->ref_cnt = 0;
+
+	if(precvbuf->pbuf)
+	{
+		precvbuf->pdata = precvbuf->phead = precvbuf->ptail = precvbuf->pbuf;
+		precvbuf->pend = precvbuf->pdata + MAX_RECVBUF_SZ;
+	}
+
+}
+
+int	rtl8192cu_init_recv_priv(_adapter *padapter)
+{
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	int	i, res = _SUCCESS;
+	struct recv_buf *precvbuf;
+
+#ifdef CONFIG_RECV_THREAD_MODE	
+	_rtw_init_sema(&precvpriv->recv_sema, 0);//will be removed
+	_rtw_init_sema(&precvpriv->terminate_recvthread_sema, 0);//will be removed
+#endif
+
+#ifdef PLATFORM_LINUX
+	tasklet_init(&precvpriv->recv_tasklet,
+	     (void(*)(unsigned long))rtl8192cu_recv_tasklet,
+	     (unsigned long)padapter);
+#endif
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+#ifdef PLATFORM_LINUX
+	precvpriv->int_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if(precvpriv->int_in_urb == NULL){
+		DBG_8192C("alloc_urb for interrupt in endpoint fail !!!!\n");
+	}
+#endif
+	precvpriv->int_in_buf = rtw_zmalloc(sizeof(INTERRUPT_MSG_FORMAT_EX));
+	if(precvpriv->int_in_buf == NULL){
+		DBG_8192C("alloc_mem for interrupt in endpoint fail !!!!\n");
+	}
+#endif
+
+	//init recv_buf
+	_rtw_init_queue(&precvpriv->free_recv_buf_queue);
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	_rtw_init_queue(&precvpriv->recv_buf_pending_queue);
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+	precvpriv->pallocated_recv_buf = rtw_zmalloc(NR_RECVBUFF *sizeof(struct recv_buf) + 4);
+	if(precvpriv->pallocated_recv_buf==NULL){
+		res= _FAIL;
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("alloc recv_buf fail!\n"));
+		goto exit;
+	}
+	_rtw_memset(precvpriv->pallocated_recv_buf, 0, NR_RECVBUFF *sizeof(struct recv_buf) + 4);
+
+	precvpriv->precv_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(precvpriv->pallocated_recv_buf), 4);
+	//precvpriv->precv_buf = precvpriv->pallocated_recv_buf + 4 -
+	//						((uint) (precvpriv->pallocated_recv_buf) &(4-1));
+
+
+	precvbuf = (struct recv_buf*)precvpriv->precv_buf;
+
+	for(i=0; i < NR_RECVBUFF ; i++)
+	{
+		_rtw_init_listhead(&precvbuf->list);
+
+		_rtw_spinlock_init(&precvbuf->recvbuf_lock);
+
+		precvbuf->alloc_sz = MAX_RECVBUF_SZ;
+
+		res = rtw_os_recvbuf_resource_alloc(padapter, precvbuf);
+		if(res==_FAIL)
+			break;
+
+		precvbuf->ref_cnt = 0;
+		precvbuf->adapter =padapter;
+
+
+		//rtw_list_insert_tail(&precvbuf->list, &(precvpriv->free_recv_buf_queue.queue));
+
+		precvbuf++;
+
+	}
+
+	precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF;
+
+#ifdef PLATFORM_LINUX
+
+	skb_queue_head_init(&precvpriv->rx_skb_queue);
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+	{
+		int i;
+		SIZE_PTR tmpaddr=0;
+		SIZE_PTR alignment=0;
+		struct sk_buff *pskb=NULL;
+
+		skb_queue_head_init(&precvpriv->free_recv_skb_queue);
+
+		for(i=0; i<NR_PREALLOC_RECV_SKB; i++)
+		{
+			pskb = rtw_skb_alloc(MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ);
+
+			if(pskb)
+			{
+				pskb->dev = padapter->pnetdev;
+
+				tmpaddr = (SIZE_PTR)pskb->data;
+				alignment = tmpaddr & (RECVBUFF_ALIGN_SZ-1);
+				skb_reserve(pskb, (RECVBUFF_ALIGN_SZ - alignment));
+
+				skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
+			}
+
+			pskb=NULL;
+
+		}
+	}
+#endif
+
+#endif
+
+exit:
+
+	return res;
+
+}
+
+void rtl8192cu_free_recv_priv (_adapter *padapter)
+{
+	int	i;
+	struct recv_buf	*precvbuf;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
+
+	for(i=0; i < NR_RECVBUFF ; i++)
+	{
+		rtw_os_recvbuf_resource_free(padapter, precvbuf);
+		precvbuf++;
+	}
+
+	if(precvpriv->pallocated_recv_buf)
+		rtw_mfree(precvpriv->pallocated_recv_buf, NR_RECVBUFF *sizeof(struct recv_buf) + 4);
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+#ifdef PLATFORM_LINUX
+	if(precvpriv->int_in_urb)
+	{
+		usb_free_urb(precvpriv->int_in_urb);
+	}
+#endif
+	if(precvpriv->int_in_buf)
+		rtw_mfree(precvpriv->int_in_buf, sizeof(INTERRUPT_MSG_FORMAT_EX));
+#endif
+
+#ifdef PLATFORM_LINUX
+
+	if (skb_queue_len(&precvpriv->rx_skb_queue)) {
+		DBG_8192C(KERN_WARNING "rx_skb_queue not empty\n");
+	}
+
+	rtw_skb_queue_purge(&precvpriv->rx_skb_queue);
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+
+	if (skb_queue_len(&precvpriv->free_recv_skb_queue)) {
+		DBG_8192C(KERN_WARNING "free_recv_skb_queue not empty, %d\n", skb_queue_len(&precvpriv->free_recv_skb_queue));
+	}
+
+	rtw_skb_queue_purge(&precvpriv->free_recv_skb_queue);
+
+#endif
+
+#endif
+
+}
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c
new file mode 100755
index 0000000000000..3a4137b9ae199
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c
@@ -0,0 +1,1150 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_XMIT_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+#include <wifi.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+#include <usb_ops.h>
+#include <rtl8192c_hal.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+
+s32	rtl8192cu_init_xmit_priv(_adapter *padapter)
+{
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+#ifdef PLATFORM_LINUX
+	tasklet_init(&pxmitpriv->xmit_tasklet,
+	     (void(*)(unsigned long))rtl8192cu_xmit_tasklet,
+	     (unsigned long)padapter);
+#endif
+	return _SUCCESS;
+}
+
+void	rtl8192cu_free_xmit_priv(_adapter *padapter)
+{
+}
+
+u32 rtw_get_ff_hwaddr(struct xmit_frame	*pxmitframe)
+{
+	u32 addr;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;	
+	
+	switch(pattrib->qsel)
+	{
+		case 0:
+		case 3:
+			addr = BE_QUEUE_INX;
+		 	break;
+		case 1:
+		case 2:
+			addr = BK_QUEUE_INX;
+			break;				
+		case 4:
+		case 5:
+			addr = VI_QUEUE_INX;
+			break;		
+		case 6:
+		case 7:
+			addr = VO_QUEUE_INX;
+			break;
+		case 0x10:
+			addr = BCN_QUEUE_INX;
+			break;
+		case 0x11://BC/MC in PS (HIQ)
+			addr = HIGH_QUEUE_INX;
+			break;
+		case 0x12:
+			addr = MGT_QUEUE_INX;
+			break;
+		default:
+			addr = BE_QUEUE_INX;
+			break;		
+			
+	}
+
+	return addr;
+
+}
+
+int urb_zero_packet_chk(_adapter *padapter, int sz)
+{
+	int blnSetTxDescOffset;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(padapter);	
+
+	if ( pdvobj->ishighspeed )
+	{
+		if ( ( (sz + TXDESC_SIZE) % 512 ) == 0 ) {
+			blnSetTxDescOffset = 1;
+		} else {
+			blnSetTxDescOffset = 0;
+		}
+	}
+	else
+	{
+		if ( ( (sz + TXDESC_SIZE) % 64 ) == 0 ) 	{
+			blnSetTxDescOffset = 1;
+		} else {
+			blnSetTxDescOffset = 0;
+		}
+	}
+	
+	return blnSetTxDescOffset;
+	
+}
+
+void rtl8192cu_cal_txdesc_chksum(struct tx_desc	*ptxdesc)
+{
+		u16	*usPtr = (u16*)ptxdesc;
+		u32 count = 16;		// (32 bytes / 2 bytes per XOR) => 16 times
+		u32 index;
+		u16 checksum = 0;
+
+		//Clear first
+		ptxdesc->txdw7 &= cpu_to_le32(0xffff0000);
+	
+		for(index = 0 ; index < count ; index++){
+			checksum = checksum ^ le16_to_cpu(*(usPtr + index));
+		}
+
+		ptxdesc->txdw7 |= cpu_to_le32(0x0000ffff&checksum);	
+
+}
+
+void fill_txdesc_sectype(struct pkt_attrib *pattrib, struct tx_desc *ptxdesc)
+{
+	if ((pattrib->encrypt > 0) && !pattrib->bswenc)
+	{
+		switch (pattrib->encrypt)
+		{	
+			//SEC_TYPE
+			case _WEP40_:
+			case _WEP104_:
+					ptxdesc->txdw1 |= cpu_to_le32((0x01<<22)&0x00c00000);
+					break;				
+			case _TKIP_:
+			case _TKIP_WTMIC_:	
+					//ptxdesc->txdw1 |= cpu_to_le32((0x02<<22)&0x00c00000);
+					ptxdesc->txdw1 |= cpu_to_le32((0x01<<22)&0x00c00000);
+					break;
+			case _AES_:
+					ptxdesc->txdw1 |= cpu_to_le32((0x03<<22)&0x00c00000);
+					break;
+			case _NO_PRIVACY_:
+			default:
+					break;
+		
+		}
+		
+	}
+
+}
+
+static void fill_txdesc_vcs(struct pkt_attrib *pattrib, u32 *pdw)
+{
+	//DBG_8192C("cvs_mode=%d\n", pattrib->vcs_mode);	
+
+	switch(pattrib->vcs_mode)
+	{
+		case RTS_CTS:
+			*pdw |= cpu_to_le32(BIT(12));
+			break;
+		case CTS_TO_SELF:
+			*pdw |= cpu_to_le32(BIT(11));
+			break;
+		case NONE_VCS:
+		default:
+			break;		
+	}
+
+	if(pattrib->vcs_mode) {
+		*pdw |= cpu_to_le32(BIT(13));
+
+		// Set RTS BW
+		if(pattrib->ht_en)
+		{
+			*pdw |= (pattrib->bwmode&HT_CHANNEL_WIDTH_40)?	cpu_to_le32(BIT(27)):0;
+
+			if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+				*pdw |= cpu_to_le32((0x01<<28)&0x30000000);
+			else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_UPPER)
+				*pdw |= cpu_to_le32((0x02<<28)&0x30000000);
+			else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE)
+				*pdw |= 0;
+			else
+				*pdw |= cpu_to_le32((0x03<<28)&0x30000000);
+		}
+	}
+}
+
+static void fill_txdesc_phy(struct pkt_attrib *pattrib, u32 *pdw)
+{
+	//DBG_8192C("bwmode=%d, ch_off=%d\n", pattrib->bwmode, pattrib->ch_offset);
+
+	if(pattrib->ht_en)
+	{
+		*pdw |= (pattrib->bwmode&HT_CHANNEL_WIDTH_40)?	cpu_to_le32(BIT(25)):0;
+
+		if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+			*pdw |= cpu_to_le32((0x01<<20)&0x00300000);
+		else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_UPPER)
+			*pdw |= cpu_to_le32((0x02<<20)&0x00300000);
+		else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE)
+			*pdw |= 0;
+		else
+			*pdw |= cpu_to_le32((0x03<<20)&0x00300000);
+	}
+}
+
+static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz, u8 bagg_pkt)
+{
+	int	pull=0;
+	uint	qsel;
+	_adapter			*padapter = pxmitframe->padapter;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;		
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct tx_desc	*ptxdesc = (struct tx_desc *)pmem;
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	sint	bmcst = IS_MCAST(pattrib->ra);
+#ifdef CONFIG_P2P
+	struct wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+#ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	if((_FALSE == bagg_pkt) && (urb_zero_packet_chk(padapter, sz)==0))
+	{
+		ptxdesc = (struct tx_desc *)(pmem+PACKET_OFFSET_SZ);
+		pull = 1;
+		pxmitframe->pkt_offset --;
+	}
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+	_rtw_memset(ptxdesc, 0, sizeof(struct tx_desc));
+
+	if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG)
+	{
+		//DBG_8192C("pxmitframe->frame_tag == DATA_FRAMETAG\n");			
+
+		//offset 4
+		ptxdesc->txdw1 |= cpu_to_le32(pattrib->mac_id&0x1f);
+
+		qsel = (uint)(pattrib->qsel & 0x0000001f);
+		ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
+
+		ptxdesc->txdw1 |= cpu_to_le32((pattrib->raid<< 16) & 0x000f0000);
+
+		fill_txdesc_sectype(pattrib, ptxdesc);
+
+		if(pattrib->ampdu_en==_TRUE)
+			ptxdesc->txdw1 |= cpu_to_le32(BIT(5));//AGG EN
+		else
+			ptxdesc->txdw1 |= cpu_to_le32(BIT(6));//AGG BK
+		
+		//offset 8
+
+
+		//offset 12
+		ptxdesc->txdw3 |= cpu_to_le32((pattrib->seqnum<<16)&0xffff0000);
+
+
+		//offset 16 , offset 20
+		if (pattrib->qos_en)
+			ptxdesc->txdw4 |= cpu_to_le32(BIT(6));//QoS
+
+		if ((pattrib->ether_type != 0x888e) && (pattrib->ether_type != 0x0806) && (pattrib->dhcp_pkt != 1))
+		{
+              	//Non EAP & ARP & DHCP type data packet
+              	
+			fill_txdesc_vcs(pattrib, &ptxdesc->txdw4);
+			fill_txdesc_phy(pattrib, &ptxdesc->txdw4);
+
+			ptxdesc->txdw4 |= cpu_to_le32(0x00000008);//RTS Rate=24M
+			ptxdesc->txdw5 |= cpu_to_le32(0x0001ff00);//
+			//ptxdesc->txdw5 |= cpu_to_le32(0x0000000b);//DataRate - 54M
+
+			//use REG_INIDATA_RATE_SEL value
+			ptxdesc->txdw5 |= cpu_to_le32(pdmpriv->INIDATA_RATE[pattrib->mac_id]);
+
+              	if(0)//for driver dbg
+			{
+				ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+				
+				if(pattrib->ht_en)
+					ptxdesc->txdw5 |= cpu_to_le32(BIT(6));//SGI
+
+				ptxdesc->txdw5 |= cpu_to_le32(0x00000013);//init rate - mcs7
+			}
+
+		}
+		else
+		{
+			// EAP data packet and ARP packet.
+			// Use the 1M data rate to send the EAP/ARP packet.
+			// This will maybe make the handshake smooth.
+
+			ptxdesc->txdw1 |= cpu_to_le32(BIT(6));//AGG BK
+			
+		   	ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+			if (pmlmeinfo->preamble_mode == PREAMBLE_SHORT)
+				ptxdesc->txdw4 |= cpu_to_le32(BIT(24));// DATA_SHORT
+
+			ptxdesc->txdw5 |= cpu_to_le32(MRateToHwRate(pmlmeext->tx_rate));
+		}
+		
+		//offset 24
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+		if ( pattrib->hw_tcp_csum == 1 ) {
+			// ptxdesc->txdw6 = 0; // clear TCP_CHECKSUM and IP_CHECKSUM. It's zero already!!
+			u8 ip_hdr_offset = 32 + pattrib->hdrlen + pattrib->iv_len + 8;
+			ptxdesc->txdw7 = (1 << 31) | (ip_hdr_offset << 16);
+			DBG_8192C("ptxdesc->txdw7 = %08x\n", ptxdesc->txdw7);
+		}
+#endif
+	}
+	else if((pxmitframe->frame_tag&0x0f)== MGNT_FRAMETAG)
+	{
+		//DBG_8192C("pxmitframe->frame_tag == MGNT_FRAMETAG\n");	
+		
+		//offset 4		
+		ptxdesc->txdw1 |= cpu_to_le32(pattrib->mac_id&0x1f);
+		
+		qsel = (uint)(pattrib->qsel&0x0000001f);
+		ptxdesc->txdw1 |= cpu_to_le32((qsel<<QSEL_SHT)&0x00001f00);
+
+		ptxdesc->txdw1 |= cpu_to_le32((pattrib->raid<< 16) & 0x000f0000);
+		
+		//fill_txdesc_sectype(pattrib, ptxdesc);
+		
+		//offset 8		
+#ifdef CONFIG_XMIT_ACK
+		//CCX-TXRPT ack for xmit mgmt frames.
+		if (pxmitframe->ack_report) {
+			ptxdesc->txdw2 |= cpu_to_le32(BIT(19));
+			#ifdef DBG_CCX
+			DBG_871X("%s set ccx\n", __func__);
+			#endif
+		}
+#endif //CONFIG_XMIT_ACK
+
+		//offset 12
+		ptxdesc->txdw3 |= cpu_to_le32((pattrib->seqnum<<16)&0xffff0000);
+		
+		//offset 16
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+		
+		//offset 20
+		ptxdesc->txdw5 |= cpu_to_le32(BIT(17));//retry limit enable
+		if(pattrib->retry_ctrl == _TRUE)
+		{
+#ifdef CONFIG_P2P
+			if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+#ifdef CONFIG_INTEL_WIDI
+				if(padapter->mlmepriv.widi_enable == _TRUE)
+					ptxdesc->txdw5 |= cpu_to_le32(0x00180000);//retry limit = 6
+				else
+#endif //CONFIG_INTEL_WIDI
+					ptxdesc->txdw5 |= cpu_to_le32(0x00080000);//retry limit = 2
+			}
+			else
+#endif //CONFIG_P2P
+				ptxdesc->txdw5 |= cpu_to_le32(0x00180000);//retry limit = 6			
+		}
+		else
+			ptxdesc->txdw5 |= cpu_to_le32(0x00300000);//retry limit = 12
+
+#ifdef CONFIG_INTEL_PROXIM
+		if((padapter->proximity.proxim_on==_TRUE)&&(pattrib->intel_proxim==_TRUE)){
+			printk("\n %s pattrib->rate=%d\n",__FUNCTION__,pattrib->rate);
+			ptxdesc->txdw5 |= cpu_to_le32( pattrib->rate);
+		}
+		else
+#endif
+		{
+			ptxdesc->txdw5 |= cpu_to_le32(MRateToHwRate(pmlmeext->tx_rate));
+		}
+	}
+	else if((pxmitframe->frame_tag&0x0f) == TXAGG_FRAMETAG)
+	{
+		DBG_8192C("pxmitframe->frame_tag == TXAGG_FRAMETAG\n");
+	}
+#ifdef CONFIG_MP_INCLUDED
+	else if((pxmitframe->frame_tag&0x0f) == MP_FRAMETAG)
+	{
+		fill_txdesc_for_mp(padapter, ptxdesc);
+	}
+#endif
+	else
+	{
+		DBG_8192C("pxmitframe->frame_tag = %d\n", pxmitframe->frame_tag);
+		
+		//offset 4	
+		ptxdesc->txdw1 |= cpu_to_le32((4)&0x1f);//CAM_ID(MAC_ID)
+		
+		ptxdesc->txdw1 |= cpu_to_le32((6<< 16) & 0x000f0000);//raid
+		
+		//offset 8		
+
+		//offset 12
+		ptxdesc->txdw3 |= cpu_to_le32((pattrib->seqnum<<16)&0xffff0000);
+		
+		//offset 16
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+		
+		//offset 20
+		ptxdesc->txdw5 |= cpu_to_le32(MRateToHwRate(pmlmeext->tx_rate));
+	}
+
+	// 2009.11.05. tynli_test. Suggested by SD4 Filen for FW LPS.
+	// (1) The sequence number of each non-Qos frame / broadcast / multicast /
+	// mgnt frame should be controled by Hw because Fw will also send null data
+	// which we cannot control when Fw LPS enable.
+	// --> default enable non-Qos data sequense number. 2010.06.23. by tynli.
+	// (2) Enable HW SEQ control for beacon packet, because we use Hw beacon.
+	// (3) Use HW Qos SEQ to control the seq num of Ext port non-Qos packets.
+	// 2010.06.23. Added by tynli.
+	if(!pattrib->qos_en)
+	{		
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(7)); // Hw set sequence number
+		ptxdesc->txdw3 |= cpu_to_le32((8 <<28)); //set bit3 to 1. Suugested by TimChen. 2009.12.29.
+	}
+
+	//offset 0
+	ptxdesc->txdw0 |= cpu_to_le32(sz&0x0000ffff);
+	ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE+OFFSET_SZ)<<OFFSET_SHT)&0x00ff0000);//32 bytes for TX Desc
+
+	if(bmcst)	
+	{
+		ptxdesc->txdw0 |= cpu_to_le32(BIT(24));
+	}	
+
+	RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("offset0-txdesc=0x%x\n", ptxdesc->txdw0));
+
+	//offset 4
+	// pkt_offset, unit:8 bytes padding
+	if (pxmitframe->pkt_offset > 0)
+		ptxdesc->txdw1 |= cpu_to_le32((pxmitframe->pkt_offset << 26) & 0x7c000000);
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	if (pxmitframe->agg_num > 1)
+		ptxdesc->txdw5 |= cpu_to_le32((pxmitframe->agg_num << 24) & 0xff000000);
+#endif
+
+	rtl8192cu_cal_txdesc_chksum(ptxdesc);
+		
+	return pull;
+		
+}
+
+static s32 rtw_dump_xframe(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	s32 ret = _SUCCESS;
+	s32 inner_ret = _SUCCESS;
+	int t, sz, w_sz, pull=0;
+	u8 *mem_addr;
+	u32 ff_hwaddr;
+	struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	if ((pxmitframe->frame_tag == DATA_FRAMETAG) &&
+	    (pxmitframe->attrib.ether_type != 0x0806) &&
+	    (pxmitframe->attrib.ether_type != 0x888e) &&
+	    (pxmitframe->attrib.dhcp_pkt != 1))
+	{
+		rtw_issue_addbareq_cmd(padapter, pxmitframe);
+	}
+	
+	mem_addr = pxmitframe->buf_addr;
+
+       RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_dump_xframe()\n"));
+	
+	for (t = 0; t < pattrib->nr_frags; t++)
+	{
+		if (inner_ret != _SUCCESS && ret == _SUCCESS)
+			ret = _FAIL;
+
+		if (t != (pattrib->nr_frags - 1))
+		{
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("pattrib->nr_frags=%d\n", pattrib->nr_frags));
+
+			sz = pxmitpriv->frag_len;
+			sz = sz - 4 - (psecuritypriv->sw_encrypt ? 0 : pattrib->icv_len);					
+		}
+		else //no frag
+		{
+			sz = pattrib->last_txcmdsz;
+		}
+
+		pull = update_txdesc(pxmitframe, mem_addr, sz, _FALSE);
+		
+		if(pull)
+		{
+			mem_addr += PACKET_OFFSET_SZ; //pull txdesc head
+			
+			//pxmitbuf ->pbuf = mem_addr;			
+			pxmitframe->buf_addr = mem_addr;
+
+			w_sz = sz + TXDESC_SIZE;
+		}
+		else
+		{
+			w_sz = sz + TXDESC_SIZE + PACKET_OFFSET_SZ;
+		}	
+
+		ff_hwaddr = rtw_get_ff_hwaddr(pxmitframe);
+		
+		inner_ret = rtw_write_port(padapter, ff_hwaddr, w_sz, (unsigned char*)pxmitbuf);
+
+		rtw_count_tx_stats(padapter, pxmitframe, sz);
+
+
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_write_port, w_sz=%d\n", w_sz));
+		//DBG_8192C("rtw_write_port, w_sz=%d, sz=%d, txdesc_sz=%d, tid=%d\n", w_sz, sz, w_sz-sz, pattrib->priority);      
+
+		mem_addr += w_sz;
+
+		mem_addr = (u8 *)RND4(((SIZE_PTR)(mem_addr)));
+
+	}
+	
+	rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+	if  (ret != _SUCCESS)
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_UNKNOWN);
+
+	return ret;
+}
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+static u32 xmitframe_need_length(struct xmit_frame *pxmitframe)
+{
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+
+	u32	len = 0;
+
+	// no consider fragement
+	len = pattrib->hdrlen + pattrib->iv_len +
+		SNAP_SIZE + sizeof(u16) +
+		pattrib->pktlen +
+		((pattrib->bswenc) ? pattrib->icv_len : 0);
+
+	if(pattrib->encrypt ==_TKIP_)
+		len += 8;
+
+	return len;
+}
+
+#define IDEA_CONDITION 1	// check all packets before enqueue
+s32 rtl8192cu_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct xmit_frame *pxmitframe = NULL;
+	struct xmit_frame *pfirstframe = NULL;
+
+	// aggregate variable
+	struct hw_xmit *phwxmit;
+	struct sta_info *psta = NULL;
+	struct tx_servq *ptxservq = NULL;
+
+	_irqL irqL;
+	_list *xmitframe_plist = NULL, *xmitframe_phead = NULL;
+
+	u32	pbuf;	// next pkt address
+	u32	pbuf_tail;	// last pkt tail
+	u32	len;	// packet length, except TXDESC_SIZE and PKT_OFFSET
+
+	u32	bulkSize = pHalData->UsbBulkOutSize;
+	u8	descCount;
+	u32	bulkPtr;
+
+	// dump frame variable
+	u32 ff_hwaddr;
+
+#ifndef IDEA_CONDITION
+	int res = _SUCCESS;
+#endif
+
+	RT_TRACE(_module_rtl8192c_xmit_c_, _drv_info_, ("+xmitframe_complete\n"));
+
+
+	// check xmitbuffer is ok
+	if (pxmitbuf == NULL) {
+		pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+		if (pxmitbuf == NULL) return _FALSE;
+	}
+
+
+	//3 1. pick up first frame
+	do {
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			
+		pxmitframe = rtw_dequeue_xframe(pxmitpriv, pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
+		if (pxmitframe == NULL) {
+			// no more xmit frame, release xmit buffer
+			rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+			return _FALSE;
+		}
+
+
+#ifndef IDEA_CONDITION
+		if (pxmitframe->frame_tag != DATA_FRAMETAG) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: frame tag(%d) is not DATA_FRAMETAG(%d)!\n",
+				  pxmitframe->frame_tag, DATA_FRAMETAG));
+//			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+
+		// TID 0~15
+		if ((pxmitframe->attrib.priority < 0) ||
+		    (pxmitframe->attrib.priority > 15)) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: TID(%d) should be 0~15!\n",
+				  pxmitframe->attrib.priority));
+//			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+#endif
+
+		pxmitframe->pxmitbuf = pxmitbuf;
+		pxmitframe->buf_addr = pxmitbuf->pbuf;
+		pxmitbuf->priv_data = pxmitframe;
+
+		//pxmitframe->agg_num = 1; // alloc xmitframe should assign to 1.
+		pxmitframe->pkt_offset = 1; // first frame of aggregation, reserve offset
+
+
+		if (rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe) == _FALSE) {
+			DBG_871X("%s coalesce 1st xmitframe failed \n",__FUNCTION__);
+			continue;
+		}
+
+
+		// always return ndis_packet after rtw_xmitframe_coalesce
+		rtw_os_xmit_complete(padapter, pxmitframe);
+
+		break;
+	} while (1);
+
+	//3 2. aggregate same priority and same DA(AP or STA) frames
+	pfirstframe = pxmitframe;
+	len = xmitframe_need_length(pfirstframe) + TXDESC_OFFSET;
+	pbuf_tail = len;
+	pbuf = _RND8(pbuf_tail);
+
+	// check pkt amount in one bluk
+	descCount = 0;
+	bulkPtr = bulkSize;
+	if (pbuf < bulkPtr)
+		descCount++;
+	else {
+		descCount = 0;
+		bulkPtr = ((pbuf / bulkSize) + 1) * bulkSize; // round to next bulkSize
+	}
+
+	// dequeue same priority packet from station tx queue
+	psta = pfirstframe->attrib.psta;
+	switch (pfirstframe->attrib.priority) {
+		case 1:
+		case 2:
+			ptxservq = &(psta->sta_xmitpriv.bk_q);
+			phwxmit = pxmitpriv->hwxmits + 3;
+			break;
+
+		case 4:
+		case 5:
+			ptxservq = &(psta->sta_xmitpriv.vi_q);
+			phwxmit = pxmitpriv->hwxmits + 1;
+			break;
+
+		case 6:
+		case 7:
+			ptxservq = &(psta->sta_xmitpriv.vo_q);
+			phwxmit = pxmitpriv->hwxmits;
+			break;
+
+		case 0:
+		case 3:
+		default:
+			ptxservq = &(psta->sta_xmitpriv.be_q);
+			phwxmit = pxmitpriv->hwxmits + 2;
+			break;
+	}
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	xmitframe_phead = get_list_head(&ptxservq->sta_pending);
+	xmitframe_plist = get_next(xmitframe_phead);
+	while (rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+		xmitframe_plist = get_next(xmitframe_plist);
+
+		len = xmitframe_need_length(pxmitframe) + TXDESC_SIZE; // no offset
+		if (pbuf + len > MAX_XMITBUF_SZ) break;
+
+		rtw_list_delete(&pxmitframe->list);
+		ptxservq->qcnt--;
+		phwxmit->accnt--;
+
+#ifndef IDEA_CONDITION
+		// suppose only data frames would be in queue
+		if (pxmitframe->frame_tag != DATA_FRAMETAG) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: frame tag(%d) is not DATA_FRAMETAG(%d)!\n",
+				  pxmitframe->frame_tag, DATA_FRAMETAG));
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+
+		// TID 0~15
+		if ((pxmitframe->attrib.priority < 0) ||
+		    (pxmitframe->attrib.priority > 15)) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: TID(%d) should be 0~15!\n",
+				  pxmitframe->attrib.priority));
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+#endif
+
+//		pxmitframe->pxmitbuf = pxmitbuf;
+		pxmitframe->buf_addr = pxmitbuf->pbuf + pbuf;
+
+		pxmitframe->agg_num = 0; // not first frame of aggregation
+		pxmitframe->pkt_offset = 0; // not first frame of aggregation, no need to reserve offset
+
+		if (rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe) == _FALSE) {
+			DBG_871X("%s coalesce failed \n",__FUNCTION__);
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+
+		// always return ndis_packet after rtw_xmitframe_coalesce
+		rtw_os_xmit_complete(padapter, pxmitframe);
+
+		// (len - TXDESC_SIZE) == pxmitframe->attrib.last_txcmdsz
+		update_txdesc(pxmitframe, pxmitframe->buf_addr, pxmitframe->attrib.last_txcmdsz, _TRUE);
+
+		// don't need xmitframe any more
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		// handle pointer and stop condition
+		pbuf_tail = pbuf + len;
+		pbuf = _RND8(pbuf_tail);
+
+		pfirstframe->agg_num++;
+		if (MAX_TX_AGG_PACKET_NUMBER == pfirstframe->agg_num)
+			break;
+
+		if (pbuf < bulkPtr) {
+			descCount++;
+			if (descCount == pHalData->UsbTxAggDescNum)
+				break;
+		} else {
+			descCount = 0;
+			bulkPtr = ((pbuf / bulkSize) + 1) * bulkSize;
+		}
+	}
+	if (_rtw_queue_empty(&ptxservq->sta_pending) == _TRUE)
+		rtw_list_delete(&ptxservq->tx_pending);
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if ((pfirstframe->attrib.ether_type != 0x0806) &&
+	    (pfirstframe->attrib.ether_type != 0x888e) &&
+	    (pfirstframe->attrib.dhcp_pkt != 1))
+	{
+		rtw_issue_addbareq_cmd(padapter, pfirstframe);
+	}
+
+#ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	//3 3. update first frame txdesc
+	if ((pbuf_tail % bulkSize) == 0) {
+		// remove pkt_offset
+		pbuf_tail -= PACKET_OFFSET_SZ;
+		pfirstframe->buf_addr += PACKET_OFFSET_SZ;
+		pfirstframe->pkt_offset = 0;
+	}
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+	update_txdesc(pfirstframe, pfirstframe->buf_addr, pfirstframe->attrib.last_txcmdsz, _TRUE);
+
+	//3 4. write xmit buffer to USB FIFO
+	ff_hwaddr = rtw_get_ff_hwaddr(pfirstframe);
+
+	// xmit address == ((xmit_frame*)pxmitbuf->priv_data)->buf_addr
+	rtw_write_port(padapter, ff_hwaddr, pbuf_tail, (u8*)pxmitbuf);
+
+
+	//3 5. update statisitc
+	pbuf_tail -= (pfirstframe->agg_num * TXDESC_SIZE);
+	if (pfirstframe->pkt_offset == 1) pbuf_tail -= PACKET_OFFSET_SZ;
+	
+	rtw_count_tx_stats(padapter, pfirstframe, pbuf_tail);
+
+	rtw_free_xmitframe(pxmitpriv, pfirstframe);
+
+	return _TRUE;
+}
+
+#else
+
+s32 rtl8192cu_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{		
+
+	struct hw_xmit *phwxmits;
+	sint hwentry;
+	struct xmit_frame *pxmitframe=NULL;	
+	int res=_SUCCESS, xcnt = 0;
+
+	phwxmits = pxmitpriv->hwxmits;
+	hwentry = pxmitpriv->hwxmit_entry;
+
+	RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("xmitframe_complete()\n"));
+
+	if(pxmitbuf==NULL)
+	{
+		pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);		
+		if(!pxmitbuf)
+		{
+			return _FALSE;
+		}			
+	}	
+
+
+	do
+	{		
+		pxmitframe =  rtw_dequeue_xframe(pxmitpriv, phwxmits, hwentry);
+		
+		if(pxmitframe)
+		{
+			pxmitframe->pxmitbuf = pxmitbuf;				
+
+			pxmitframe->buf_addr = pxmitbuf->pbuf;
+
+			pxmitbuf->priv_data = pxmitframe;	
+
+			if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG)
+			{	
+				if(pxmitframe->attrib.priority<=15)//TID0~15
+				{
+					res = rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
+				}	
+							
+				rtw_os_xmit_complete(padapter, pxmitframe);//always return ndis_packet after rtw_xmitframe_coalesce 			
+			}
+
+				
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("xmitframe_complete(): rtw_dump_xframe\n"));
+
+			
+			if(res == _SUCCESS)
+			{
+				rtw_dump_xframe(padapter, pxmitframe);
+			}
+			else
+			{
+				rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+				rtw_free_xmitframe(pxmitpriv, pxmitframe);	
+			}
+	 			 		
+			xcnt++;
+			
+		}
+		else
+		{			
+			rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+			return _FALSE;
+		}
+
+		break;
+		
+	}while(0/*xcnt < (NR_XMITFRAME >> 3)*/);
+
+	return _TRUE;
+	
+}
+#endif
+
+
+
+static s32 xmitframe_direct(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	s32 res = _SUCCESS;
+
+
+	res = rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
+	if (res == _SUCCESS) {
+		rtw_dump_xframe(padapter, pxmitframe);
+	}
+
+	return res;
+}
+
+/*
+ * Return
+ *	_TRUE	dump packet directly
+ *	_FALSE	enqueue packet
+ */
+static s32 pre_xmitframe(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+        _irqL irqL;
+	s32 res;
+	struct xmit_buf *pxmitbuf = NULL;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	
+	
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+
+	if (rtw_txframes_sta_ac_pending(padapter, pattrib) > 0)
+		goto enqueue;
+
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		goto enqueue;
+
+#ifdef CONFIG_CONCURRENT_MODE	
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		goto enqueue;
+#endif
+
+	pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+	if (pxmitbuf == NULL)
+		goto enqueue;
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	pxmitframe->pxmitbuf = pxmitbuf;
+	pxmitframe->buf_addr = pxmitbuf->pbuf;
+	pxmitbuf->priv_data = pxmitframe;
+
+	if (xmitframe_direct(padapter, pxmitframe) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+	}
+
+	return _TRUE;
+
+enqueue:
+	res = rtw_xmitframe_enqueue(padapter, pxmitframe);
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if (res != _SUCCESS) {
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("pre_xmitframe: enqueue xmitframe fail\n"));
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		// Trick, make the statistics correct
+		pxmitpriv->tx_pkts--;
+		pxmitpriv->tx_drop++;
+		return _TRUE;
+	}
+
+	return _FALSE;
+}
+
+s32 rtl8192cu_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+	return rtw_dump_xframe(padapter, pmgntframe);
+}
+
+/*
+ * Return
+ *	_TRUE	dump packet directly ok
+ *	_FALSE	temporary can't transmit packets to hardware
+ */
+s32 rtl8192cu_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	return pre_xmitframe(padapter, pxmitframe);
+}
+
+s32	 rtl8192cu_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	struct xmit_priv 	*pxmitpriv = &padapter->xmitpriv;
+	s32 err;
+	
+	if ((err=rtw_xmitframe_enqueue(padapter, pxmitframe)) != _SUCCESS) 
+	{
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		// Trick, make the statistics correct
+		pxmitpriv->tx_pkts--;
+		pxmitpriv->tx_drop++;					
+	}
+	else
+	{
+#ifdef PLATFORM_LINUX
+		tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+#endif
+	}
+	
+	return err;
+	
+}
+
+#ifdef  CONFIG_HOSTAPD_MLME
+
+static void rtl8192cu_hostap_mgnt_xmit_cb(struct urb *urb)
+{	
+#ifdef PLATFORM_LINUX
+	struct sk_buff *skb = (struct sk_buff *)urb->context;
+
+	//DBG_8192C("%s\n", __FUNCTION__);
+
+	rtw_skb_free(skb);
+#endif	
+}
+
+s32 rtl8192cu_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt)
+{
+#ifdef PLATFORM_LINUX
+	u16 fc;
+	int rc, len, pipe;	
+	unsigned int bmcst, tid, qsel;
+	struct sk_buff *skb, *pxmit_skb;
+	struct urb *urb;
+	unsigned char *pxmitbuf;
+	struct tx_desc *ptxdesc;
+	struct rtw_ieee80211_hdr *tx_hdr;
+	struct hostapd_priv *phostapdpriv = padapter->phostapdpriv;	
+	struct net_device *pnetdev = padapter->pnetdev;
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter);
+	struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);	
+
+	
+	//DBG_8192C("%s\n", __FUNCTION__);
+
+	skb = pkt;
+	
+	len = skb->len;
+	tx_hdr = (struct rtw_ieee80211_hdr *)(skb->data);
+	fc = le16_to_cpu(tx_hdr->frame_ctl);
+	bmcst = IS_MCAST(tx_hdr->addr1);
+
+	if ((fc & RTW_IEEE80211_FCTL_FTYPE) != RTW_IEEE80211_FTYPE_MGMT)
+		goto _exit;
+
+	pxmit_skb = rtw_skb_alloc(len + TXDESC_SIZE);
+
+	if(!pxmit_skb)
+		goto _exit;
+
+	pxmitbuf = pxmit_skb->data;
+
+	urb = usb_alloc_urb(0, GFP_ATOMIC);
+	if (!urb) {
+		goto _exit;
+	}
+
+	// ----- fill tx desc -----	
+	ptxdesc = (struct tx_desc *)pxmitbuf;	
+	_rtw_memset(ptxdesc, 0, sizeof(*ptxdesc));
+		
+	//offset 0	
+	ptxdesc->txdw0 |= cpu_to_le32(len&0x0000ffff); 
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE+OFFSET_SZ)<<OFFSET_SHT)&0x00ff0000);//default = 32 bytes for TX Desc
+	ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
+
+	if(bmcst)	
+	{
+		ptxdesc->txdw0 |= cpu_to_le32(BIT(24));
+	}	
+
+	//offset 4	
+	ptxdesc->txdw1 |= cpu_to_le32(0x00);//MAC_ID
+
+	ptxdesc->txdw1 |= cpu_to_le32((0x12<<QSEL_SHT)&0x00001f00);
+
+	ptxdesc->txdw1 |= cpu_to_le32((0x06<< 16) & 0x000f0000);//b mode
+
+	//offset 8			
+
+	//offset 12		
+	ptxdesc->txdw3 |= cpu_to_le32((le16_to_cpu(tx_hdr->seq_ctl)<<16)&0xffff0000);
+
+	//offset 16		
+	ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+		
+	//offset 20
+
+
+	//HW append seq
+	ptxdesc->txdw4 |= cpu_to_le32(BIT(7)); // Hw set sequence number
+	ptxdesc->txdw3 |= cpu_to_le32((8 <<28)); //set bit3 to 1. Suugested by TimChen. 2009.12.29.
+	
+
+	rtl8192cu_cal_txdesc_chksum(ptxdesc);
+	// ----- end of fill tx desc -----
+
+	//
+	skb_put(pxmit_skb, len + TXDESC_SIZE);
+	pxmitbuf = pxmitbuf + TXDESC_SIZE;
+	_rtw_memcpy(pxmitbuf, skb->data, len);
+
+	//DBG_8192C("mgnt_xmit, len=%x\n", pxmit_skb->len);
+
+
+	// ----- prepare urb for submit -----
+	
+	//translate DMA FIFO addr to pipehandle
+	//pipe = ffaddr2pipehdl(pdvobj, MGT_QUEUE_INX);
+	pipe = usb_sndbulkpipe(pdvobj->pusbdev, pHalData->Queue2EPNum[(u8)MGT_QUEUE_INX]&0x0f);
+	
+	usb_fill_bulk_urb(urb, pdvobj->pusbdev, pipe,
+			  pxmit_skb->data, pxmit_skb->len, rtl8192cu_hostap_mgnt_xmit_cb, pxmit_skb);
+	
+	urb->transfer_flags |= URB_ZERO_PACKET;
+	usb_anchor_urb(urb, &phostapdpriv->anchored);
+	rc = usb_submit_urb(urb, GFP_ATOMIC);
+	if (rc < 0) {
+		usb_unanchor_urb(urb);
+		kfree_skb(skb);
+	}
+	usb_free_urb(urb);
+
+	
+_exit:	
+	
+	rtw_skb_free(skb);
+
+#endif
+
+	return 0;
+
+}
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c
new file mode 100755
index 0000000000000..ff894732ba900
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c
@@ -0,0 +1,6261 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_HAL_INIT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_efuse.h>
+
+#include <rtl8192c_hal.h>
+#include <rtl8192c_led.h>
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+#include "rtl8192c_sreset.h"
+#endif
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+#endif
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#ifndef CONFIG_USB_HCI
+
+#error "CONFIG_USB_HCI shall be on!\n"
+
+#endif
+
+#include <usb_ops.h>
+#include <usb_hal.h>
+#include <usb_osintf.h>
+
+#if DISABLE_BB_RF
+	#define		HAL_MAC_ENABLE	0
+	#define		HAL_BB_ENABLE		0
+	#define		HAL_RF_ENABLE		0
+#else
+	#define		HAL_MAC_ENABLE	1
+	#define		HAL_BB_ENABLE		1
+	#define		HAL_RF_ENABLE		1
+#endif
+
+//endpoint number 1,2,3,4,5
+// bult in : 1
+// bult out: 2 (High)
+// bult out: 3 (Normal) for 3 out_ep, (Low) for 2 out_ep
+// interrupt in: 4
+// bult out: 5 (Low) for 3 out_ep
+
+
+static VOID
+_OneOutEpMapping(
+	IN	HAL_DATA_TYPE	*pHalData
+	)
+{
+	//only endpoint number 0x02
+
+	pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+	pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[0];//VI
+	pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[0];//BE
+	pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[0];//BK
+	
+	pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+	pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+	pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+	pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+}
+
+
+static VOID
+_TwoOutEpMapping(
+	IN	HAL_DATA_TYPE	*pHalData,
+	IN	BOOLEAN	 		bWIFICfg
+	)
+{
+
+/*
+#define VO_QUEUE_INX		0
+#define VI_QUEUE_INX		1
+#define BE_QUEUE_INX		2
+#define BK_QUEUE_INX		3
+#define BCN_QUEUE_INX	4
+#define MGT_QUEUE_INX	5
+#define HIGH_QUEUE_INX	6
+#define TXCMD_QUEUE_INX	7
+*/
+	if(bWIFICfg){ // Normal chip && wmm
+		
+		//	BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA 
+		//{  0, 	1, 	0, 	1, 	0, 	0, 	0, 	0, 		0	};
+		//0:H(end_number=0x02), 1:L (end_number=0x03)
+
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[1];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[0];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[1];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[0];//BK
+		
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+	else{//typical setting
+		
+		//BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA 
+		//{  1, 	1, 	0, 	0, 	0, 	0, 	0, 	0, 		0	};			
+		//0:H(end_number=0x02), 1:L (end_number=0x03)
+
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[0];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[1];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[1];//BK
+		
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+	
+}
+
+
+static VOID _ThreeOutEpMapping(
+	IN	HAL_DATA_TYPE	*pHalData,
+	IN	BOOLEAN	 		bWIFICfg
+	)
+{
+	if(bWIFICfg){//for WMM
+
+		//	BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA 
+		//{  1, 	2, 	1, 	0, 	0, 	0, 	0, 	0, 		0	};
+		//0:H(end_number=0x02), 1:N(end_number=0x03), 2:L (end_number=0x05)
+
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[1];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[2];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[1];//BK
+		
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+	else{//typical setting
+
+		//	BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA 
+		//{  2, 	2, 	1, 	0, 	0, 	0, 	0, 	0, 		0	};			
+		//0:H(end_number=0x02), 1:N(end_number=0x03), 2:L (end_number=0x05)
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[1];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[2];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[2];//BK
+		
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+
+}
+
+static BOOLEAN
+_MappingOutEP(
+	IN	PADAPTER	pAdapter,
+	IN	u8		NumOutPipe
+	)
+{		
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct registry_priv *pregistrypriv = &pAdapter->registrypriv;
+
+	BOOLEAN	 bWIFICfg = (pregistrypriv->wifi_spec) ?_TRUE:_FALSE;
+	
+	BOOLEAN result = _TRUE;
+
+	switch(NumOutPipe)
+	{
+		case 2:
+			_TwoOutEpMapping(pHalData, bWIFICfg);
+			break;
+		case 3:		
+			_ThreeOutEpMapping(pHalData, bWIFICfg);
+			break;
+		case 1:
+			_OneOutEpMapping(pHalData);
+			break;
+		default:
+			result = _FALSE;
+			break;
+	}
+
+	return result;
+	
+}
+
+static VOID
+_ConfigChipOutEP(
+	IN	PADAPTER	pAdapter,
+	IN	u8		NumOutPipe
+	)
+{
+	u8			value8;
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(pAdapter);
+
+	pHalData->OutEpQueueSel = 0;
+	pHalData->OutEpNumber	= 0;
+		
+	// Normal and High queue
+	value8 = rtw_read8(pAdapter, (REG_NORMAL_SIE_EP + 1));
+	
+	if(value8 & USB_NORMAL_SIE_EP_MASK){
+		pHalData->OutEpQueueSel |= TX_SELE_HQ;
+		pHalData->OutEpNumber++;
+	}
+
+#ifdef CONFIG_USB_ONE_OUT_EP
+		return;
+#endif
+		
+	if((value8 >> USB_NORMAL_SIE_EP_SHIFT) & USB_NORMAL_SIE_EP_MASK){
+		pHalData->OutEpQueueSel |= TX_SELE_NQ;
+		pHalData->OutEpNumber++;
+	}
+	
+	// Low queue
+	value8 = rtw_read8(pAdapter, (REG_NORMAL_SIE_EP + 2));
+	if(value8 & USB_NORMAL_SIE_EP_MASK){
+		pHalData->OutEpQueueSel |= TX_SELE_LQ;
+		pHalData->OutEpNumber++;
+	}
+
+	// TODO: Error recovery for this case
+	//RT_ASSERT((NumOutPipe == pHalData->OutEpNumber), ("Out EP number isn't match! %d(Descriptor) != %d (SIE reg)\n", (u4Byte)NumOutPipe, (u4Byte)pHalData->OutEpNumber));
+
+}
+
+static BOOLEAN HalUsbSetQueuePipeMapping8192CUsb(
+	IN	PADAPTER	pAdapter,
+	IN	u8		NumInPipe,
+	IN	u8		NumOutPipe
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(pAdapter);
+	BOOLEAN			result		= _FALSE;
+
+	_ConfigChipOutEP(pAdapter, NumOutPipe);
+
+	#ifndef CONFIG_USB_ONE_OUT_EP
+	// Normal chip with one IN and one OUT doesn't have interrupt IN EP.
+	if(1 == pHalData->OutEpNumber){
+		if(1 != NumInPipe){
+			return result;
+		}
+	}
+	#endif
+	result = _MappingOutEP(pAdapter, NumOutPipe);
+	
+	return result;
+
+}
+
+void rtl8192cu_interface_configure(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+
+	if (pdvobjpriv->ishighspeed == _TRUE)
+	{
+		pHalData->UsbBulkOutSize = USB_HIGH_SPEED_BULK_SIZE;//512 bytes
+	}
+	else
+	{
+		pHalData->UsbBulkOutSize = USB_FULL_SPEED_BULK_SIZE;//64 bytes
+	}
+
+	pHalData->interfaceIndex = pdvobjpriv->InterfaceNumber;
+	pHalData->RtBulkInPipe = pdvobjpriv->ep_num[0];
+	pHalData->RtBulkOutPipe[0] = pdvobjpriv->ep_num[1];
+	pHalData->RtBulkOutPipe[1] = pdvobjpriv->ep_num[2];
+	pHalData->RtIntInPipe = pdvobjpriv->ep_num[3];
+	pHalData->RtBulkOutPipe[2] = pdvobjpriv->ep_num[4];
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pHalData->UsbTxAggMode		= 1;
+	pHalData->UsbTxAggDescNum	= 0x6;	// only 4 bits
+#endif
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+	pHalData->UsbRxAggMode		= USB_RX_AGG_DMA;// USB_RX_AGG_DMA;
+	pHalData->UsbRxAggBlockCount	= 8; //unit : 512b
+	pHalData->UsbRxAggBlockTimeout	= 0x6;
+	pHalData->UsbRxAggPageCount	= 48; //uint :128 b //0x0A;	// 10 = MAX_RX_DMA_BUFFER_SIZE/2/pHalData->UsbBulkOutSize
+	pHalData->UsbRxAggPageTimeout	= 0x4; //6, absolute time = 34ms/(2^6)
+#endif
+
+	HalUsbSetQueuePipeMapping8192CUsb(padapter, pdvobjpriv->RtNumInPipes,
+		#ifdef CONFIG_USB_ONE_OUT_EP
+		1
+		#else
+		pdvobjpriv->RtNumOutPipes
+		#endif
+		);
+
+}
+
+static u8 _InitPowerOn(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	u8	ret = _SUCCESS;
+	u16	value16=0;
+	u8	value8 = 0;
+	u32  value32 = 0;
+
+	// polling autoload done.
+	u32	pollingCount = 0;
+
+	do
+	{
+		if(rtw_read8(padapter, REG_APS_FSMCO) & PFM_ALDN){
+			//RT_TRACE(COMP_INIT,DBG_LOUD,("Autoload Done!\n"));
+			break;
+		}
+
+		if(pollingCount++ > POLLING_READY_TIMEOUT_COUNT){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling REG_APS_FSMCO[PFM_ALDN] done!\n"));
+			return _FAIL;
+		}
+				
+	}while(_TRUE);
+
+
+//	For hardware power on sequence.
+
+	//0.	RSV_CTRL 0x1C[7:0] = 0x00			// unlock ISO/CLK/Power control register
+	rtw_write8(padapter, REG_RSV_CTRL, 0x0);	
+	// Power on when re-enter from IPS/Radio off/card disable
+	rtw_write8(padapter, REG_SPS0_CTRL, 0x2b);//enable SPS into PWM mode
+/*
+	value16 = PlatformIORead2Byte(Adapter, REG_AFE_XTAL_CTRL);//enable AFE clock
+	value16 &=  (~XTAL_GATE_AFE);
+	PlatformIOWrite2Byte(Adapter,REG_AFE_XTAL_CTRL, value16 );		
+*/
+	
+	rtw_udelay_os(100);//PlatformSleepUs(150);//this is not necessary when initially power on
+
+	value8 = rtw_read8(padapter, REG_LDOV12D_CTRL);	
+	if(0== (value8 & LDV12_EN) ){
+		value8 |= LDV12_EN;
+		rtw_write8(padapter, REG_LDOV12D_CTRL, value8);	
+		//RT_TRACE(COMP_INIT, DBG_LOUD, (" power-on :REG_LDOV12D_CTRL Reg0x21:0x%02x.\n",value8));
+		rtw_udelay_os(100);//PlatformSleepUs(100);//this is not necessary when initially power on
+		value8 = rtw_read8(padapter, REG_SYS_ISO_CTRL);
+		value8 &= ~ISO_MD2PP;
+		rtw_write8(padapter, REG_SYS_ISO_CTRL, value8);			
+	}	
+	
+	// auto enable WLAN
+	pollingCount = 0;
+	value16 = rtw_read16(padapter, REG_APS_FSMCO);
+	value16 |= APFM_ONMAC;
+	rtw_write16(padapter, REG_APS_FSMCO, value16);
+
+	do
+	{
+		if(0 == (rtw_read16(padapter, REG_APS_FSMCO) & APFM_ONMAC)){
+			//RT_TRACE(COMP_INIT,DBG_LOUD,("MAC auto ON okay!\n"));
+			break;
+		}
+
+		if(pollingCount++ > POLLING_READY_TIMEOUT_COUNT){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling REG_APS_FSMCO[APFM_ONMAC] done!\n"));
+			return _FAIL;
+		}
+				
+	}while(_TRUE);
+
+	//Enable Radio ,GPIO ,and LED function
+	rtw_write16(padapter,REG_APS_FSMCO,0x0812);
+
+#ifdef CONFIG_AUTOSUSPEND
+	//for usb Combo card ,BT
+	if((BOARD_USB_COMBO == pHalData->BoardType)&&(padapter->registrypriv.usbss_enable))
+	{
+		value32 =  rtw_read32(padapter, REG_APS_FSMCO);
+		value32 |= (SOP_ABG|SOP_AMB|XOP_BTCK);
+		rtw_write32(padapter, REG_APS_FSMCO, value32);		
+	}
+#endif	
+
+	// release RF digital isolation
+	value16 = rtw_read16(padapter, REG_SYS_ISO_CTRL);
+	value16 &= ~ISO_DIOR;
+	rtw_write16(padapter, REG_SYS_ISO_CTRL, value16);
+
+	// Enable MAC DMA/WMAC/SCHEDULE/SEC block
+	value16 = rtw_read16(padapter, REG_CR);
+	value16 |= (HCI_TXDMA_EN | HCI_RXDMA_EN | TXDMA_EN | RXDMA_EN
+				| PROTOCOL_EN | SCHEDULE_EN | MACTXEN | MACRXEN | ENSEC);
+	rtw_write16(padapter, REG_CR, value16);
+	
+	//tynli_test for suspend mode.
+	{
+		rtw_write8(padapter,  0xfe10, 0x19);
+	}
+
+	// 2010/11/22 MH For slim combo debug mode check.
+	if (pHalData->BoardType == BOARD_USB_COMBO)
+	{
+		if (pHalData->SlimComboDbg == _TRUE)
+		{
+			DBG_8192C("SlimComboDbg == TRUE\n");
+
+			// 1. SIC?Test Mode ��, Debug Ports �|�۰� Enable, �ҥH Driver �W�ӫ�, 
+			//	�n�����г]�w 0x 00[7] -> "1", �N�� Disable.   effect if not: power consumption increase
+			rtw_write8(padapter, REG_SYS_ISO_CTRL, rtw_read8(padapter, REG_SYS_ISO_CTRL)|BIT7);
+
+			// 2. SIC?Test Mode ��, GPIO-8?�| report Power State �ҥH Driver �W�ӫ�, �г]�w? 0x04[6] -> "1" �N�� Disable
+			// effect if not: GPIO-8 could not be GPIO or LED function
+			rtw_write8(padapter, REG_APS_FSMCO, rtw_read8(padapter, REG_APS_FSMCO)|BIT6);
+
+			// 3. SIC Test Mode ��, EESK, EECS �| report?Host Clock status, �ҥH Driver �W�ӫ�, �г]�w? 0x40[4] -> "1" �N������ EEPROM �ϥ� Pin (autoload still from Efuse)
+			//  effect if not:power consumption increase
+			value8 = rtw_read8(padapter, REG_GPIO_MUXCFG)|BIT4 ;
+		#ifdef CONFIG_BT_COEXIST	
+			// 2011/01/26 MH UMB-B cut bug. We need to support the modification.
+			if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID) &&
+				pHalData->bt_coexist.BT_Coexist)
+			{
+				value8 |= (BIT5);	
+			}
+		#endif
+			rtw_write8(padapter, REG_GPIO_MUXCFG,value8 );
+			
+			
+			// 4. SIC Test Mode ��,?SIC Debug ports �|�۰� Enable , �ҥH Driver �W�ӫᰨ�W, �г]�w? 0x40[15:11] -> ��0x00��, �N��Disable
+			//  4.1Two Steps setting for safety: 0x40[15,13,12, 11] -> "0", then ?0x40[14] -> "0"
+			// effect if not: Host could not transfer packets, and GPIO-3,2 will occupied by SIC then Co-exist could not work.
+			rtw_write16(padapter, REG_GPIO_MUXCFG, (rtw_read16(padapter, REG_GPIO_MUXCFG)&0x07FF)|BIT14);
+			rtw_write16(padapter, REG_GPIO_MUXCFG, rtw_read16(padapter, REG_GPIO_MUXCFG)&0x07FF);
+		}
+	}
+
+
+	// 2011/02/18 To Fix RU LNA  power leakage problem. We need to execute below below in
+	// Adapter init and halt sequence. Accordingto EEchou's opinion, we can enable the ability for all
+	// IC. According to Johnny's opinion, only RU will meet the condition.
+	if (IS_HARDWARE_TYPE_8192C(padapter) && (pHalData->BoardType == BOARD_USB_High_PA))
+		rtw_write32(padapter, rFPGA0_XCD_RFParameter, rtw_read32(padapter, rFPGA0_XCD_RFParameter)&(~BIT1));
+	return ret;
+
+}
+
+
+static void _dbg_dump_macreg(_adapter *padapter)
+{
+	u32 offset = 0;
+	u32 val32 = 0;
+	u32 index =0 ;
+	for(index=0;index<64;index++)
+	{
+		offset = index*4;
+		val32 = rtw_read32(padapter,offset);
+		DBG_8192C("offset : 0x%02x ,val:0x%08x\n",offset,val32);
+	}
+}
+
+
+static void _InitPABias(_adapter *padapter)
+{
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(padapter);
+	u8			pa_setting;
+	BOOLEAN		is92C = IS_92C_SERIAL(pHalData->VersionID);
+	
+	//FIXED PA current issue
+	//efuse_one_byte_read(padapter, 0x1FA, &pa_setting);
+	pa_setting = EFUSE_Read1Byte(padapter, 0x1FA);
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("_InitPABias 0x1FA 0x%x \n",pa_setting));
+
+	if(!(pa_setting & BIT0))
+	{
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0x0F406);
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0x4F406);		
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0x8F406);		
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0xCF406);		
+		//RT_TRACE(COMP_INIT, DBG_LOUD, ("PA BIAS path A\n"));
+	}	
+
+	if(!(pa_setting & BIT1) && is92C)
+	{
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0x0F406);
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0x4F406);		
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0x8F406);		
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0xCF406);
+		//RT_TRACE(COMP_INIT, DBG_LOUD, ("PA BIAS path B\n"));	
+	}
+
+	if(!(pa_setting & BIT4))
+	{
+		pa_setting = rtw_read8(padapter, 0x16);
+		pa_setting &= 0x0F;
+		rtw_write8(padapter, 0x16, pa_setting | 0x90);		
+	}
+}
+#ifdef CONFIG_BT_COEXIST
+static void _InitBTCoexist(_adapter *padapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	u8 u1Tmp;
+
+	if(pbtpriv->BT_Coexist && pbtpriv->BT_CoexistType == BT_CSR_BC4)
+	{
+
+#if MP_DRIVER != 1
+		if(pbtpriv->BT_Ant_isolation)
+		{
+			rtw_write8( padapter,REG_GPIO_MUXCFG, 0xa0);
+			DBG_8192C("BT write 0x%x = 0x%x\n", REG_GPIO_MUXCFG, 0xa0);
+		}
+#endif		
+
+		u1Tmp = rtw_read8(padapter, 0x4fd) & BIT0;
+		u1Tmp = u1Tmp | 
+				((pbtpriv->BT_Ant_isolation==1)?0:BIT1) | 
+				((pbtpriv->BT_Service==BT_SCO)?0:BIT2);
+		rtw_write8( padapter, 0x4fd, u1Tmp);
+		DBG_8192C("BT write 0x%x = 0x%x for non-isolation\n", 0x4fd, u1Tmp);
+		
+		
+		rtw_write32(padapter, REG_BT_COEX_TABLE+4, 0xaaaa9aaa);
+		DBG_8192C("BT write 0x%x = 0x%x\n", REG_BT_COEX_TABLE+4, 0xaaaa9aaa);
+		
+		rtw_write32(padapter, REG_BT_COEX_TABLE+8, 0xffbd0040);
+		DBG_8192C("BT write 0x%x = 0x%x\n", REG_BT_COEX_TABLE+8, 0xffbd0040);
+
+		rtw_write32(padapter,  REG_BT_COEX_TABLE+0xc, 0x40000010);
+		DBG_8192C("BT write 0x%x = 0x%x\n", REG_BT_COEX_TABLE+0xc, 0x40000010);
+
+		//Config to 1T1R
+		u1Tmp =  rtw_read8(padapter,rOFDM0_TRxPathEnable);
+		u1Tmp &= ~(BIT1);
+		rtw_write8( padapter, rOFDM0_TRxPathEnable, u1Tmp);
+		DBG_8192C("BT write 0xC04 = 0x%x\n", u1Tmp);
+			
+		u1Tmp = rtw_read8(padapter, rOFDM1_TRxPathEnable);
+		u1Tmp &= ~(BIT1);
+		rtw_write8( padapter, rOFDM1_TRxPathEnable, u1Tmp);
+		DBG_8192C("BT write 0xD04 = 0x%x\n", u1Tmp);
+
+	}
+}
+#endif
+
+//-------------------------------------------------------------------------
+//
+// LLT R/W/Init function
+//
+//-------------------------------------------------------------------------
+static u8 _LLTWrite(
+	IN  PADAPTER	Adapter,
+	IN	u32		address,
+	IN	u32		data
+	)
+{
+	u8	status = _SUCCESS;
+	int 		count = 0;
+	u32 		value = _LLT_INIT_ADDR(address) | _LLT_INIT_DATA(data) | _LLT_OP(_LLT_WRITE_ACCESS);
+
+	rtw_write32(Adapter, REG_LLT_INIT, value);
+	
+	//polling
+	do{
+		
+		value = rtw_read32(Adapter, REG_LLT_INIT);
+		if(_LLT_NO_ACTIVE == _LLT_OP_VALUE(value)){
+			break;
+		}
+		
+		if(count > POLLING_LLT_THRESHOLD){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling write LLT done at address %d!\n", address));
+			status = _FAIL;
+			break;
+		}
+	}while(count++);
+
+	return status;
+	
+}
+
+
+static u8 _LLTRead(
+	IN  PADAPTER	Adapter,
+	IN	u32		address
+	)
+{
+	int		count = 0;
+	u32		value = _LLT_INIT_ADDR(address) | _LLT_OP(_LLT_READ_ACCESS);
+
+	rtw_write32(Adapter, REG_LLT_INIT, value);
+
+	//polling and get value
+	do{
+		
+		value = rtw_read32(Adapter, REG_LLT_INIT);
+		if(_LLT_NO_ACTIVE == _LLT_OP_VALUE(value)){
+			return (u8)value;
+		}
+		
+		if(count > POLLING_LLT_THRESHOLD){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling read LLT done at address %d!\n", address));
+			break;
+		}
+	}while(count++);
+
+	return 0xFF;
+
+}
+
+
+static u8 InitLLTTable(
+	IN  PADAPTER	Adapter,
+	IN	u32		boundary
+	)
+{
+	u8	status = _SUCCESS;
+	u32		i;
+
+#ifdef CONFIG_IOL_LLT
+	if(rtw_IOL_applied(Adapter))
+	{
+		struct xmit_frame	*xmit_frame;
+		if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL)
+			return _FAIL;
+
+		rtw_IOL_append_LLT_cmd(xmit_frame, boundary);
+		status = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+	}
+	else
+#endif
+	{
+		for(i = 0 ; i < (boundary - 1) ; i++){
+			status = _LLTWrite(Adapter, i , i + 1);
+			if(_SUCCESS != status){
+				return status;
+			}
+		}
+
+		// end of list
+		status = _LLTWrite(Adapter, (boundary - 1), 0xFF); 
+		if(_SUCCESS != status){
+			return status;
+		}
+
+		// Make the other pages as ring buffer
+		// This ring buffer is used as beacon buffer if we config this MAC as two MAC transfer.
+		// Otherwise used as local loopback buffer. 
+		for(i = boundary ; i < LAST_ENTRY_OF_TX_PKT_BUFFER ; i++){
+			status = _LLTWrite(Adapter, i, (i + 1)); 
+			if(_SUCCESS != status){
+				return status;
+			}
+		}
+		
+		// Let last entry point to the start entry of ring buffer
+		status = _LLTWrite(Adapter, LAST_ENTRY_OF_TX_PKT_BUFFER, boundary);
+		if(_SUCCESS != status){
+			return status;
+		}
+	}
+
+	return status;
+	
+}
+
+
+//---------------------------------------------------------------
+//
+//	MAC init functions
+//
+//---------------------------------------------------------------
+static VOID
+_SetMacID(
+	IN  PADAPTER Adapter, u8* MacID
+	)
+{
+	u32 i;
+	for(i=0 ; i< MAC_ADDR_LEN ; i++){
+#ifdef  CONFIG_CONCURRENT_MODE		
+		if(Adapter->iface_type == IFACE_PORT1)
+			rtw_write32(Adapter, REG_MACID1+i, MacID[i]);
+		else
+#endif			
+		rtw_write32(Adapter, REG_MACID+i, MacID[i]);
+	}
+}
+
+static VOID
+_SetBSSID(
+	IN  PADAPTER Adapter, u8* BSSID
+	)
+{
+	u32 i;
+	for(i=0 ; i< MAC_ADDR_LEN ; i++){
+#ifdef  CONFIG_CONCURRENT_MODE		
+		if(Adapter->iface_type == IFACE_PORT1)
+			rtw_write32(Adapter, REG_BSSID1+i, BSSID[i]);
+		else
+#endif			
+		rtw_write32(Adapter, REG_BSSID+i, BSSID[i]);
+	}
+}
+
+
+// Shall USB interface init this?
+static VOID
+_InitInterrupt(
+	IN  PADAPTER Adapter
+	)
+{
+	u32	value32;
+
+	// HISR - turn all on
+	value32 = 0xFFFFFFFF;
+	rtw_write32(Adapter, REG_HISR, value32);
+
+	// HIMR - turn all on
+	rtw_write32(Adapter, REG_HIMR, value32);
+}
+
+
+static VOID
+_InitQueueReservedPage(
+	IN  PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	
+	u32			outEPNum	= (u32)pHalData->OutEpNumber;
+	u32			numHQ		= 0;
+	u32			numLQ		= 0;
+	u32			numNQ		= 0;
+	u32			numPubQ;
+	u32			value32;
+	u8			value8;
+	BOOLEAN		bWiFiConfig	= pregistrypriv->wifi_spec;
+	//u32			txQPageNum, txQPageUnit,txQRemainPage;
+
+	{ //for WMM 
+		//RT_ASSERT((outEPNum>=2), ("for WMM ,number of out-ep must more than or equal to 2!\n"));
+
+		if(pHalData->OutEpQueueSel & TX_SELE_HQ){
+			numHQ = (bWiFiConfig)?WMM_NORMAL_PAGE_NUM_HPQ:NORMAL_PAGE_NUM_HPQ;
+		}
+
+		if(pHalData->OutEpQueueSel & TX_SELE_LQ){
+			numLQ = (bWiFiConfig)?WMM_NORMAL_PAGE_NUM_LPQ:NORMAL_PAGE_NUM_LPQ;
+		}
+		// NOTE: This step shall be proceed before writting REG_RQPN.	
+		if(pHalData->OutEpQueueSel & TX_SELE_NQ){
+			numNQ = (bWiFiConfig)?WMM_NORMAL_PAGE_NUM_NPQ:NORMAL_PAGE_NUM_NPQ;
+		}
+		value8 = (u8)_NPQ(numNQ);
+		rtw_write8(Adapter, REG_RQPN_NPQ, value8);
+
+		if (bWiFiConfig)
+			numPubQ = WMM_NORMAL_TX_TOTAL_PAGE_NUMBER - numHQ - numLQ - numNQ;
+		else
+			numPubQ = TX_TOTAL_PAGE_NUMBER - numHQ - numLQ - numNQ;
+	}
+
+	// TX DMA
+	value32 = _HPQ(numHQ) | _LPQ(numLQ) | _PUBQ(numPubQ) | LD_RQPN;	
+	rtw_write32(Adapter, REG_RQPN, value32);	
+}
+
+static VOID
+_InitTxBufferBoundary(
+	IN  PADAPTER Adapter
+	)
+{	
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	u8	txpktbuf_bndy; 
+
+	if(!pregistrypriv->wifi_spec){
+		txpktbuf_bndy = TX_PAGE_BOUNDARY;
+	}
+	else{//for WMM
+		txpktbuf_bndy = WMM_NORMAL_TX_PAGE_BOUNDARY;
+	}
+
+	rtw_write8(Adapter, REG_TXPKTBUF_BCNQ_BDNY, txpktbuf_bndy);
+	rtw_write8(Adapter, REG_TXPKTBUF_MGQ_BDNY, txpktbuf_bndy);
+	rtw_write8(Adapter, REG_TXPKTBUF_WMAC_LBK_BF_HD, txpktbuf_bndy);
+	rtw_write8(Adapter, REG_TRXFF_BNDY, txpktbuf_bndy);	
+#if 1
+	rtw_write8(Adapter, REG_TDECTRL+1, txpktbuf_bndy);
+#else
+	txdmactrl = PlatformIORead2Byte(Adapter, REG_TDECTRL);
+	txdmactrl &= ~BCN_HEAD_MASK;
+	txdmactrl |= BCN_HEAD(txpktbuf_bndy);
+	PlatformIOWrite2Byte(Adapter, REG_TDECTRL, txdmactrl);
+#endif
+}
+
+static VOID
+_InitPageBoundary(
+	IN  PADAPTER Adapter
+	)
+{
+	// RX Page Boundary
+	//srand(static_cast<unsigned int>(time(NULL)) );
+	u16 rxff_bndy = 0x27FF;//(rand() % 1) ? 0x27FF : 0x23FF;
+
+	rtw_write16(Adapter, (REG_TRXFF_BNDY + 2), rxff_bndy);
+
+	// TODO: ?? shall we set tx boundary?
+}
+
+
+static VOID
+_InitNormalChipRegPriority(
+	IN	PADAPTER	Adapter,
+	IN	u16		beQ,
+	IN	u16		bkQ,
+	IN	u16		viQ,
+	IN	u16		voQ,
+	IN	u16		mgtQ,
+	IN	u16		hiQ
+	)
+{
+	u16 value16		= (rtw_read16(Adapter, REG_TRXDMA_CTRL) & 0x7);
+
+	value16 |=	_TXDMA_BEQ_MAP(beQ) 	| _TXDMA_BKQ_MAP(bkQ) |
+				_TXDMA_VIQ_MAP(viQ) 	| _TXDMA_VOQ_MAP(voQ) |
+				_TXDMA_MGQ_MAP(mgtQ)| _TXDMA_HIQ_MAP(hiQ);
+	
+	rtw_write16(Adapter, REG_TRXDMA_CTRL, value16);
+}
+
+static VOID
+_InitNormalChipOneOutEpPriority(
+	IN	PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	u16	value = 0;
+	switch(pHalData->OutEpQueueSel)
+	{
+		case TX_SELE_HQ:
+			value = QUEUE_HIGH;
+			break;
+		case TX_SELE_LQ:
+			value = QUEUE_LOW;
+			break;
+		case TX_SELE_NQ:
+			value = QUEUE_NORMAL;
+			break;
+		default:
+			//RT_ASSERT(FALSE,("Shall not reach here!\n"));
+			break;
+	}
+	
+	_InitNormalChipRegPriority(Adapter,
+								value,
+								value,
+								value,
+								value,
+								value,
+								value
+								);
+
+}
+
+static VOID
+_InitNormalChipTwoOutEpPriority(
+	IN	PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	u16			beQ,bkQ,viQ,voQ,mgtQ,hiQ;
+	
+
+	u16	valueHi = 0;
+	u16	valueLow = 0;
+	
+	switch(pHalData->OutEpQueueSel)
+	{
+		case (TX_SELE_HQ | TX_SELE_LQ):
+			valueHi = QUEUE_HIGH;
+			valueLow = QUEUE_LOW;
+			break;
+		case (TX_SELE_NQ | TX_SELE_LQ):
+			valueHi = QUEUE_NORMAL;
+			valueLow = QUEUE_LOW;
+			break;
+		case (TX_SELE_HQ | TX_SELE_NQ):
+			valueHi = QUEUE_HIGH;
+			valueLow = QUEUE_NORMAL;
+			break;
+		default:
+			//RT_ASSERT(FALSE,("Shall not reach here!\n"));
+			break;
+	}
+
+	if(!pregistrypriv->wifi_spec ){
+		beQ		= valueLow;
+		bkQ		= valueLow;
+		viQ		= valueHi;
+		voQ		= valueHi;
+		mgtQ	= valueHi; 
+		hiQ		= valueHi;								
+	}
+	else{//for WMM ,CONFIG_OUT_EP_WIFI_MODE
+		beQ		= valueLow;
+		bkQ		= valueHi;		
+		viQ		= valueHi;
+		voQ		= valueLow;
+		mgtQ	= valueHi;
+		hiQ		= valueHi;							
+	}
+	
+	_InitNormalChipRegPriority(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ);
+
+}
+
+static VOID
+_InitNormalChipThreeOutEpPriority(
+	IN	PADAPTER Adapter
+	)
+{
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	u16			beQ,bkQ,viQ,voQ,mgtQ,hiQ;
+
+	if(!pregistrypriv->wifi_spec ){// typical setting
+		beQ		= QUEUE_LOW;
+		bkQ 		= QUEUE_LOW;
+		viQ 		= QUEUE_NORMAL;
+		voQ 		= QUEUE_HIGH;
+		mgtQ 	= QUEUE_HIGH;
+		hiQ 		= QUEUE_HIGH;			
+	}
+	else{// for WMM
+		beQ		= QUEUE_LOW;
+		bkQ 		= QUEUE_NORMAL;
+		viQ 		= QUEUE_NORMAL;
+		voQ 		= QUEUE_HIGH;
+		mgtQ 	= QUEUE_HIGH;
+		hiQ 		= QUEUE_HIGH;			
+	}
+	_InitNormalChipRegPriority(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ);
+}
+
+static VOID
+_InitNormalChipQueuePriority(
+	IN	PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	switch(pHalData->OutEpNumber)
+	{
+		case 1:
+			_InitNormalChipOneOutEpPriority(Adapter);
+			break;
+		case 2:
+			_InitNormalChipTwoOutEpPriority(Adapter);
+			break;
+		case 3:
+			_InitNormalChipThreeOutEpPriority(Adapter);
+			break;
+		default:
+			//RT_ASSERT(FALSE,("Shall not reach here!\n"));
+			break;
+	}
+
+
+}
+
+static VOID
+_InitQueuePriority(
+	IN  PADAPTER Adapter
+	)
+{
+	_InitNormalChipQueuePriority(Adapter);
+}
+
+static VOID
+_InitHardwareDropIncorrectBulkOut(
+	IN  PADAPTER Adapter
+	)
+{
+	u32	value32 = rtw_read32(Adapter, REG_TXDMA_OFFSET_CHK);
+	value32 |= DROP_DATA_EN;
+	rtw_write32(Adapter, REG_TXDMA_OFFSET_CHK, value32);
+}
+
+static VOID
+_InitNetworkType(
+	IN  PADAPTER Adapter
+	)
+{
+	u32	value32;
+
+	value32 = rtw_read32(Adapter, REG_CR);
+
+	// TODO: use the other function to set network type
+#if RTL8191C_FPGA_NETWORKTYPE_ADHOC
+	value32 = (value32 & ~MASK_NETTYPE) | _NETTYPE(NT_LINK_AD_HOC);
+#else
+	value32 = (value32 & ~MASK_NETTYPE) | _NETTYPE(NT_LINK_AP);
+#endif
+	rtw_write32(Adapter, REG_CR, value32);
+//	RASSERT(pIoBase->rtw_read8(REG_CR + 2) == 0x2);
+}
+
+static VOID
+_InitTransferPageSize(
+	IN  PADAPTER Adapter
+	)
+{
+	// Tx page size is always 128.
+	
+	u8	value8;
+	value8 = _PSRX(PBP_128) | _PSTX(PBP_128);
+	rtw_write8(Adapter, REG_PBP, value8);
+}
+
+static VOID
+_InitDriverInfoSize(
+	IN  PADAPTER	Adapter,
+	IN	u8		drvInfoSize
+	)
+{
+	rtw_write8(Adapter,REG_RX_DRVINFO_SZ, drvInfoSize);
+}
+
+static VOID
+_InitWMACSetting(
+	IN  PADAPTER Adapter
+	)
+{
+	//u4Byte			value32;
+	//u16			value16;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	//pHalData->ReceiveConfig = AAP | APM | AM | AB | APP_ICV | ADF | AMF | APP_FCS | HTC_LOC_CTRL | APP_MIC | APP_PHYSTS;
+	//pHalData->ReceiveConfig = RCR_AAP | RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYSTS;
+	// don't turn on AAP, it will allow all packets to driver
+	pHalData->ReceiveConfig = RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYSTS;
+	
+#if (0 == RTL8192C_RX_PACKET_NO_INCLUDE_CRC)
+	pHalData->ReceiveConfig |= ACRC32;
+#endif
+
+	// some REG_RCR will be modified later by phy_ConfigMACWithHeaderFile()
+	rtw_write32(Adapter, REG_RCR, pHalData->ReceiveConfig);
+
+	// Accept all multicast address
+	rtw_write32(Adapter, REG_MAR, 0xFFFFFFFF);
+	rtw_write32(Adapter, REG_MAR + 4, 0xFFFFFFFF);
+
+
+	// Accept all data frames
+	//value16 = 0xFFFF;
+	//rtw_write16(Adapter, REG_RXFLTMAP2, value16);
+
+	// 2010.09.08 hpfan
+	// Since ADF is removed from RCR, ps-poll will not be indicate to driver,
+	// RxFilterMap should mask ps-poll to gurantee AP mode can rx ps-poll.
+	//value16 = 0x400;
+	//rtw_write16(Adapter, REG_RXFLTMAP1, value16);
+
+	// Accept all management frames
+	//value16 = 0xFFFF;
+	//rtw_write16(Adapter, REG_RXFLTMAP0, value16);
+
+	//enable RX_SHIFT bits
+	//rtw_write8(Adapter, REG_TRXDMA_CTRL, rtw_read8(Adapter, REG_TRXDMA_CTRL)|BIT(1));	
+
+}
+
+static VOID
+_InitAdaptiveCtrl(
+	IN  PADAPTER Adapter
+	)
+{
+	u16	value16;
+	u32	value32;
+
+	// Response Rate Set
+	value32 = rtw_read32(Adapter, REG_RRSR);
+	value32 &= ~RATE_BITMAP_ALL;
+	value32 |= RATE_RRSR_CCK_ONLY_1M;
+	rtw_write32(Adapter, REG_RRSR, value32);
+
+	// CF-END Threshold
+	//m_spIoBase->rtw_write8(REG_CFEND_TH, 0x1);
+
+	// SIFS (used in NAV)
+	value16 = _SPEC_SIFS_CCK(0x10) | _SPEC_SIFS_OFDM(0x10);
+	rtw_write16(Adapter, REG_SPEC_SIFS, value16);
+
+	// Retry Limit
+	value16 = _LRL(0x30) | _SRL(0x30);
+	rtw_write16(Adapter, REG_RL, value16);
+	
+}
+
+static VOID
+_InitRateFallback(
+	IN  PADAPTER Adapter
+	)
+{
+	// Set Data Auto Rate Fallback Retry Count register.
+	rtw_write32(Adapter, REG_DARFRC, 0x00000000);
+	rtw_write32(Adapter, REG_DARFRC+4, 0x10080404);
+	rtw_write32(Adapter, REG_RARFRC, 0x04030201);
+	rtw_write32(Adapter, REG_RARFRC+4, 0x08070605);
+
+}
+
+
+static VOID
+_InitEDCA(
+	IN  PADAPTER Adapter
+	)
+{
+	// Set Spec SIFS (used in NAV)
+	rtw_write16(Adapter,REG_SPEC_SIFS, 0x100a);
+	rtw_write16(Adapter,REG_MAC_SPEC_SIFS, 0x100a);
+
+    //REG514:SIFS_CCK_CTX
+    //REG515:SIFS_OFDM_CTX
+	//REG516:SIFS_CCK_TRX
+    //REG517:SIFS_OFDM_TRX    
+
+	// Set SIFS for CCK_CTS and OFDM_CTX
+	rtw_write16(Adapter,REG_SIFS_CTX, 0x100a);	
+
+	// Set SIFS for CCK_TRX and OFDM_TRX
+	rtw_write16(Adapter,REG_SIFS_TRX, 0x100a);
+
+	// TXOP
+	rtw_write32(Adapter, REG_EDCA_BE_PARAM, 0x005EA42B);
+	rtw_write32(Adapter, REG_EDCA_BK_PARAM, 0x0000A44F);
+	rtw_write32(Adapter, REG_EDCA_VI_PARAM, 0x005EA324);
+	rtw_write32(Adapter, REG_EDCA_VO_PARAM, 0x002FA226);
+}
+
+
+static VOID
+_InitBeaconMaxError(
+	IN  PADAPTER	Adapter,
+	IN	BOOLEAN		InfraMode
+	)
+{
+#ifdef RTL8192CU_ADHOC_WORKAROUND_SETTING
+	rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF);	
+#else
+	//rtw_write8(Adapter, REG_BCN_MAX_ERR, (InfraMode ? 0xFF : 0x10));	
+#endif
+}
+
+
+#ifdef CONFIG_LED
+static void _InitHWLed(PADAPTER Adapter)
+{
+	struct led_priv *pledpriv = &(Adapter->ledpriv);
+	
+	if( pledpriv->LedStrategy != HW_LED)
+		return;
+	
+// HW led control
+// to do .... 
+//must consider cases of antenna diversity/ commbo card/solo card/mini card
+
+}
+#endif //CONFIG_LED
+
+static VOID
+_InitRDGSetting(
+	IN	PADAPTER Adapter
+	)
+{
+	rtw_write8(Adapter,REG_RD_CTRL,0xFF);
+	rtw_write16(Adapter, REG_RD_NAV_NXT, 0x200);
+	rtw_write8(Adapter,REG_RD_RESP_PKT_TH,0x05);
+}
+
+static VOID
+_InitRxSetting(
+	IN	PADAPTER Adapter
+	)
+{
+	rtw_write32(Adapter, REG_MACID, 0x87654321);
+	rtw_write32(Adapter, 0x0700, 0x87654321);
+}
+
+static VOID
+_InitRetryFunction(
+	IN  PADAPTER Adapter
+	)
+{
+	u8	value8;
+	
+	value8 = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL);
+	value8 |= EN_AMPDU_RTY_NEW;
+	rtw_write8(Adapter, REG_FWHW_TXQ_CTRL, value8);
+
+	// Set ACK timeout
+	rtw_write8(Adapter, REG_ACKTO, 0x40);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	usb_AggSettingTxUpdate()
+ *
+ * Overview:	Seperate TX/RX parameters update independent for TP detection and 
+ *			dynamic TX/RX aggreagtion parameters update.
+ *
+ * Input:			PADAPTER
+ *
+ * Output/Return:	NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	12/10/2010	MHC		Seperate to smaller function.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+usb_AggSettingTxUpdate(
+	IN	PADAPTER			Adapter
+	)
+{
+#ifdef CONFIG_USB_TX_AGGREGATION
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	//PMGNT_INFO		pMgntInfo = &(Adapter->MgntInfo);	
+	u32			value32;
+
+	if(Adapter->registrypriv.wifi_spec)
+		pHalData->UsbTxAggMode = _FALSE;
+
+	if(pHalData->UsbTxAggMode){
+		value32 = rtw_read32(Adapter, REG_TDECTRL);
+		value32 = value32 & ~(BLK_DESC_NUM_MASK << BLK_DESC_NUM_SHIFT);
+		value32 |= ((pHalData->UsbTxAggDescNum & BLK_DESC_NUM_MASK) << BLK_DESC_NUM_SHIFT);
+		
+		rtw_write32(Adapter, REG_TDECTRL, value32);
+	}
+	
+#endif
+}	// usb_AggSettingTxUpdate
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	usb_AggSettingRxUpdate()
+ *
+ * Overview:	Seperate TX/RX parameters update independent for TP detection and 
+ *			dynamic TX/RX aggreagtion parameters update.
+ *
+ * Input:			PADAPTER
+ *
+ * Output/Return:	NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	12/10/2010	MHC		Seperate to smaller function.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+usb_AggSettingRxUpdate(
+	IN	PADAPTER			Adapter
+	)
+{
+#ifdef CONFIG_USB_RX_AGGREGATION
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	//PMGNT_INFO		pMgntInfo = &(Adapter->MgntInfo);
+	u8			valueDMA;
+	u8			valueUSB;
+
+	valueDMA = rtw_read8(Adapter, REG_TRXDMA_CTRL);
+	valueUSB = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION);
+
+	switch(pHalData->UsbRxAggMode)
+	{
+		case USB_RX_AGG_DMA:
+			valueDMA |= RXDMA_AGG_EN;
+			valueUSB &= ~USB_AGG_EN;
+			break;
+		case USB_RX_AGG_USB:
+			valueDMA &= ~RXDMA_AGG_EN;
+			valueUSB |= USB_AGG_EN;
+			break;
+		case USB_RX_AGG_MIX:
+			valueDMA |= RXDMA_AGG_EN;
+			valueUSB |= USB_AGG_EN;
+			break;
+		case USB_RX_AGG_DISABLE:
+		default:
+			valueDMA &= ~RXDMA_AGG_EN;
+			valueUSB &= ~USB_AGG_EN;
+			break;
+	}
+
+	rtw_write8(Adapter, REG_TRXDMA_CTRL, valueDMA);
+	rtw_write8(Adapter, REG_USB_SPECIAL_OPTION, valueUSB);
+
+	switch(pHalData->UsbRxAggMode)
+	{
+		case USB_RX_AGG_DMA:
+			rtw_write8(Adapter, REG_RXDMA_AGG_PG_TH, pHalData->UsbRxAggPageCount);
+			rtw_write8(Adapter, REG_USB_DMA_AGG_TO, pHalData->UsbRxAggPageTimeout);
+			break;
+		case USB_RX_AGG_USB:
+			rtw_write8(Adapter, REG_USB_AGG_TH, pHalData->UsbRxAggBlockCount);
+			rtw_write8(Adapter, REG_USB_AGG_TO, pHalData->UsbRxAggBlockTimeout);
+			break;
+		case USB_RX_AGG_MIX:
+			rtw_write8(Adapter, REG_RXDMA_AGG_PG_TH, pHalData->UsbRxAggPageCount);
+			rtw_write8(Adapter, REG_USB_DMA_AGG_TO, pHalData->UsbRxAggPageTimeout);
+			rtw_write8(Adapter, REG_USB_AGG_TH, pHalData->UsbRxAggBlockCount);
+			rtw_write8(Adapter, REG_USB_AGG_TO, pHalData->UsbRxAggBlockTimeout);
+			break;
+		case USB_RX_AGG_DISABLE:
+		default:
+			// TODO: 
+			break;
+	}
+
+	switch(PBP_128)
+	{
+		case PBP_128:
+			pHalData->HwRxPageSize = 128;
+			break;
+		case PBP_64:
+			pHalData->HwRxPageSize = 64;
+			break;
+		case PBP_256:
+			pHalData->HwRxPageSize = 256;
+			break;
+		case PBP_512:
+			pHalData->HwRxPageSize = 512;
+			break;
+		case PBP_1024:
+			pHalData->HwRxPageSize = 1024;
+			break;
+		default:
+			//RT_ASSERT(FALSE, ("RX_PAGE_SIZE_REG_VALUE definition is incorrect!\n"));
+			break;
+	}
+#endif
+}	// usb_AggSettingRxUpdate
+
+static VOID
+InitUsbAggregationSetting(
+	IN  PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	// Tx aggregation setting
+	usb_AggSettingTxUpdate(Adapter);
+
+	// Rx aggregation setting
+	usb_AggSettingRxUpdate(Adapter);
+
+	// 201/12/10 MH Add for USB agg mode dynamic switch.
+	pHalData->UsbRxHighSpeedMode = _FALSE;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	USB_AggModeSwitch()
+ *
+ * Overview:	When RX traffic is more than 40M, we need to adjust some parameters to increase
+ *			RX speed by increasing batch indication size. This will decrease TCP ACK speed, we
+ *			need to monitor the influence of FTP/network share.
+ *			For TX mode, we are still ubder investigation.
+ *
+ * Input:		PADAPTER
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	12/10/2010	MHC		Create Version 0.  
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+USB_AggModeSwitch(
+	IN	PADAPTER			Adapter
+	)
+{
+#if 0
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+
+	//pHalData->UsbRxHighSpeedMode = FALSE;
+	// How to measure the RX speed? We assume that when traffic is more than 
+	if (pMgntInfo->bRegAggDMEnable == _FALSE)
+	{
+		return;	// Inf not support.
+	}
+	
+	
+	if (pmlmepriv->LinkDetectInfo.bHigherBusyTraffic == _TRUE && 
+		pHalData->UsbRxHighSpeedMode == _FALSE)
+	{
+		pHalData->UsbRxHighSpeedMode = _TRUE;
+		DBG_8192C("UsbAggModeSwitchCheck to HIGH\n");
+	}
+	else if (pmlmepriv->LinkDetectInfo.bHigherBusyTraffic == _FALSE && 
+		pHalData->UsbRxHighSpeedMode == _TRUE)
+	{
+		pHalData->UsbRxHighSpeedMode = _FALSE;
+		DBG_8192C("UsbAggModeSwitchCheck to LOW\n");
+	}
+	else
+	{
+		return; 
+	}
+	
+	// 2010/12/10 MH Add for USB Aggregation judgement we need to 
+	//if( pMgntInfo->LinkDetectInfo.NumRxOkInPeriod > 4000 ||
+		//			pMgntInfo->LinkDetectInfo.NumTxOkInPeriod > 4000 )
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	//usb_AggSettingTxUpdate(Adapter);
+#endif
+		
+#ifdef CONFIG_USB_RX_AGGREGATION
+	if (pHalData->UsbRxHighSpeedMode == _TRUE)	
+	{
+		// 2010/12/10 MH The parameter is tested by SD1 engineer and SD3 channel emulator.
+		// USB mode
+		pHalData->UsbRxAggBlockCount		= 40;
+		pHalData->UsbRxAggBlockTimeout	= 5;
+		// Mix mode
+		pHalData->UsbRxAggPageCount		= 72;
+		pHalData->UsbRxAggPageTimeout	= 6;		
+	}
+	else
+	{
+		// USB mode
+		pHalData->UsbRxAggBlockCount		= pMgntInfo->RegUsbRxAggBlockCount;
+		pHalData->UsbRxAggBlockTimeout	= pMgntInfo->RegUsbRxAggBlockTimeout;	
+		// Mix mode
+		pHalData->UsbRxAggPageCount		= pMgntInfo->RegUsbRxAggPageCount;
+		pHalData->UsbRxAggPageTimeout	= pMgntInfo->RegUsbRxAggPageTimeout;	
+	}	
+#endif
+#endif
+}	// USB_AggModeSwitch
+
+static VOID
+_InitOperationMode(
+	IN	PADAPTER			Adapter
+	)
+{
+#if 0//gtest
+	PHAL_DATA_8192CUSB	pHalData = GetHalData8192CUsb(Adapter);
+	u1Byte				regBwOpMode = 0;
+	u4Byte				regRATR = 0, regRRSR = 0;
+
+
+	//1 This part need to modified according to the rate set we filtered!!
+	//
+	// Set RRSR, RATR, and REG_BWOPMODE registers
+	//
+	switch(Adapter->RegWirelessMode)
+	{
+		case WIRELESS_MODE_B:
+			regBwOpMode = BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_CCK;
+			regRRSR = RATE_ALL_CCK;
+			break;
+		case WIRELESS_MODE_A:
+			ASSERT(FALSE);
+#if 0
+			regBwOpMode = BW_OPMODE_5G |BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_OFDM_AG;
+			regRRSR = RATE_ALL_OFDM_AG;
+#endif
+			break;
+		case WIRELESS_MODE_G:
+			regBwOpMode = BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			break;
+		case WIRELESS_MODE_AUTO:
+			if (Adapter->bInHctTest)
+			{
+			    regBwOpMode = BW_OPMODE_20MHZ;
+			    regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			    regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			}
+			else
+			{
+			    regBwOpMode = BW_OPMODE_20MHZ;
+			    regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+			    regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			}
+			break;
+		case WIRELESS_MODE_N_24G:
+			// It support CCK rate by default.
+			// CCK rate will be filtered out only when associated AP does not support it.
+			regBwOpMode = BW_OPMODE_20MHZ;
+				regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+				regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			break;
+		case WIRELESS_MODE_N_5G:
+			ASSERT(FALSE);
+#if 0
+			regBwOpMode = BW_OPMODE_5G;
+			regRATR = RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+			regRRSR = RATE_ALL_OFDM_AG;
+#endif
+			break;
+	}
+
+	// Ziv ????????
+	//PlatformEFIOWrite4Byte(Adapter, REG_INIRTS_RATE_SEL, regRRSR);
+	PlatformEFIOWrite1Byte(Adapter, REG_BWOPMODE, regBwOpMode);
+
+	// For Min Spacing configuration.
+	switch(pHalData->RF_Type)
+	{
+		case RF_1T2R:
+		case RF_1T1R:
+			RT_TRACE(COMP_INIT, DBG_LOUD, ("Initializeadapter: RF_Type%s\n", (pHalData->RF_Type==RF_1T1R? "(1T1R)":"(1T2R)")));
+			Adapter->MgntInfo.MinSpaceCfg = (MAX_MSS_DENSITY_1T<<3);						
+			break;
+		case RF_2T2R:
+		case RF_2T2R_GREEN:
+			RT_TRACE(COMP_INIT, DBG_LOUD, ("Initializeadapter:RF_Type(2T2R)\n"));
+			Adapter->MgntInfo.MinSpaceCfg = (MAX_MSS_DENSITY_2T<<3);			
+			break;
+	}
+	
+	PlatformEFIOWrite1Byte(Adapter, REG_AMPDU_MIN_SPACE, Adapter->MgntInfo.MinSpaceCfg);
+#endif
+}
+
+
+ static VOID
+_InitBeaconParameters(
+	IN  PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	rtw_write16(Adapter, REG_BCN_CTRL, 0x1010);
+
+	// TODO: Remove these magic number
+	rtw_write16(Adapter, REG_TBTT_PROHIBIT,0x6404);// ms
+
+	rtw_write8(Adapter, REG_DRVERLYINT, DRIVER_EARLY_INT_TIME);// 5ms
+	rtw_write8(Adapter, REG_BCNDMATIM, BCN_DMA_ATIME_INT_TIME); // 2ms
+
+	// Suggested by designer timchen. Change beacon AIFS to the largest number
+	// beacause test chip does not contension before sending beacon. by tynli. 2009.11.03
+	rtw_write16(Adapter, REG_BCNTCFG, 0x660F);
+}
+
+static VOID
+_InitRFType(
+	IN	PADAPTER Adapter
+	)
+{
+	struct registry_priv	 *pregpriv = &Adapter->registrypriv;
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	BOOLEAN			is92CU		= IS_92C_SERIAL(pHalData->VersionID);
+
+#if	DISABLE_BB_RF
+	pHalData->rf_chip	= RF_PSEUDO_11N;
+	return;
+#endif
+
+	pHalData->rf_chip	= RF_6052;
+
+	if(_FALSE == is92CU){
+		pHalData->rf_type = RF_1T1R;
+		DBG_8192C("Set RF Chip ID to RF_6052 and RF type to 1T1R.\n");
+		return;
+	}
+
+	// TODO: Consider that EEPROM set 92CU to 1T1R later.
+	// Force to overwrite setting according to chip version. Ignore EEPROM setting.
+	//pHalData->RF_Type = is92CU ? RF_2T2R : RF_1T1R;
+	MSG_8192C("Set RF Chip ID to RF_6052 and RF type to %d.\n", pHalData->rf_type);
+
+}
+
+static VOID _InitAdhocWorkaroundParams(IN PADAPTER Adapter)
+{
+#if RTL8192CU_ADHOC_WORKAROUND_SETTING
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);	
+	pHalData->RegBcnCtrlVal = rtw_read8(Adapter, REG_BCN_CTRL);
+	pHalData->RegTxPause = rtw_read8(Adapter, REG_TXPAUSE); 
+	pHalData->RegFwHwTxQCtrl = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL+2);
+	pHalData->RegReg542 = rtw_read8(Adapter, REG_TBTT_PROHIBIT+2);
+#endif	
+}
+
+static VOID
+_BeaconFunctionEnable(
+	IN	PADAPTER		Adapter,
+	IN	BOOLEAN			Enable,
+	IN	BOOLEAN			Linked
+	)
+{
+	rtw_write8(Adapter, REG_BCN_CTRL, (BIT4 | BIT3 | BIT1));
+	//SetBcnCtrlReg(Adapter, (BIT4 | BIT3 | BIT1), 0x00);
+	//RT_TRACE(COMP_BEACON, DBG_LOUD, ("_BeaconFunctionEnable 0x550 0x%x\n", PlatformEFIORead1Byte(Adapter, 0x550)));			
+
+	rtw_write8(Adapter, REG_RD_CTRL+1, 0x6F);	
+}
+
+
+// Set CCK and OFDM Block "ON"
+static VOID _BBTurnOnBlock(
+	IN	PADAPTER		Adapter
+	)
+{
+#if (DISABLE_BB_RF)
+	return;
+#endif
+
+	PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bCCKEn, 0x1);
+	PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bOFDMEn, 0x1);
+}
+
+static VOID _RfPowerSave(
+	IN	PADAPTER		Adapter
+	)
+{
+#if 0
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	PMGNT_INFO		pMgntInfo	= &(Adapter->MgntInfo);
+	u1Byte			eRFPath;
+
+#if (DISABLE_BB_RF)
+	return;
+#endif
+
+	if(pMgntInfo->RegRfOff == TRUE){ // User disable RF via registry.
+		RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RegRfOff.\n"));
+		MgntActSet_RF_State(Adapter, eRfOff, RF_CHANGE_BY_SW);
+		// Those action will be discard in MgntActSet_RF_State because off the same state
+		for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+			PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x4, 0xC00, 0x0);
+	}
+	else if(pMgntInfo->RfOffReason > RF_CHANGE_BY_PS){ // H/W or S/W RF OFF before sleep.
+		RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RfOffReason(%ld).\n", pMgntInfo->RfOffReason));
+		MgntActSet_RF_State(Adapter, eRfOff, pMgntInfo->RfOffReason);
+	}
+	else{
+		pHalData->eRFPowerState = eRfOn;
+		pMgntInfo->RfOffReason = 0; 
+		if(Adapter->bInSetPower || Adapter->bResetInProgress)
+			PlatformUsbEnableInPipes(Adapter);
+		RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): RF is on.\n"));
+	}
+#endif
+}
+
+enum {
+	Antenna_Lfet = 1,
+	Antenna_Right = 2,	
+};
+
+static VOID
+_InitAntenna_Selection(IN	PADAPTER Adapter)
+{
+
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	if(pHalData->AntDivCfg==0)
+		return;
+	DBG_8192C("==>  %s ....\n",__FUNCTION__);
+	
+	if((RF_1T1R == pHalData->rf_type))
+	{	
+		rtw_write32(Adapter, REG_LEDCFG0, rtw_read32(Adapter, REG_LEDCFG0)|BIT23);	
+		PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, BIT13, 0x01);
+		
+		if(PHY_QueryBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300) == Antenna_A)
+			pHalData->CurAntenna = Antenna_A;
+		else
+			pHalData->CurAntenna = Antenna_B;
+		DBG_8192C("%s,Cur_ant:(%x)%s\n",__FUNCTION__,pHalData->CurAntenna,(pHalData->CurAntenna == Antenna_A)?"Antenna_A":"Antenna_B");
+			
+}
+
+
+}
+//
+// 2010/08/09 MH Add for power down check.
+//
+static BOOLEAN
+HalDetectPwrDownMode(
+	IN PADAPTER				Adapter
+	)
+{
+	u8	tmpvalue;
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(Adapter);
+	struct pwrctrl_priv		*pwrctrlpriv = &Adapter->pwrctrlpriv;
+	
+	EFUSE_ShadowRead(Adapter, 1, EEPROM_RF_OPT3, (u32 *)&tmpvalue);
+
+	// 2010/08/25 MH INF priority > PDN Efuse value.
+	if(tmpvalue & BIT4 && pwrctrlpriv->reg_pdnmode)
+	{
+		pHalData->pwrdown = _TRUE;
+	}
+	else
+	{
+		pHalData->pwrdown = _FALSE;
+	}
+
+	DBG_8192C("HalDetectPwrDownMode(): PDN=%d\n", pHalData->pwrdown);
+	return pHalData->pwrdown;
+		
+}	// HalDetectPwrDownMode
+
+
+//
+// 2010/08/26 MH Add for selective suspend mode check.
+// If Efuse 0x0e bit1 is not enabled, we can not support selective suspend for Minicard and
+// slim card.
+//
+static VOID
+HalDetectSelectiveSuspendMode(
+	IN PADAPTER				Adapter
+	)
+{
+	u8	tmpvalue;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(Adapter);
+
+	// If support HW radio detect, we need to enable WOL ability, otherwise, we 
+	// can not use FW to notify host the power state switch.
+	
+	EFUSE_ShadowRead(Adapter, 1, EEPROM_USB_OPTIONAL1, (u32 *)&tmpvalue);
+
+	DBG_8192C("HalDetectSelectiveSuspendMode(): SS ");
+	if(tmpvalue & BIT1)
+	{
+		DBG_8192C("Enable\n");
+	}
+	else
+	{
+		DBG_8192C("Disable\n");
+		pdvobjpriv->RegUsbSS = _FALSE;
+	}
+
+	// 2010/09/01 MH According to Dongle Selective Suspend INF. We can switch SS mode.
+	if (pdvobjpriv->RegUsbSS && !SUPPORT_HW_RADIO_DETECT(pHalData))
+	{
+		//PMGNT_INFO				pMgntInfo = &(Adapter->MgntInfo);
+
+		//if (!pMgntInfo->bRegDongleSS)	
+		//{
+		//	RT_TRACE(COMP_INIT, DBG_LOUD, ("Dongle disable SS\n"));
+			pdvobjpriv->RegUsbSS = _FALSE;
+		//}
+	}
+}	// HalDetectSelectiveSuspendMode
+/*-----------------------------------------------------------------------------
+ * Function:	HwSuspendModeEnable92Cu()
+ *
+ * Overview:	HW suspend mode switch.
+ *
+ * Input:		NONE
+ *
+ * Output:	NONE
+ *
+ * Return:	NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	08/23/2010	MHC		HW suspend mode switch test..
+ *---------------------------------------------------------------------------*/
+static VOID 
+HwSuspendModeEnable92Cu(
+	IN	PADAPTER	pAdapter,
+	IN	u8			Type
+	)
+{
+	//PRT_USB_DEVICE 		pDevice = GET_RT_USB_DEVICE(pAdapter);
+	u16	reg = rtw_read16(pAdapter, REG_GPIO_MUXCFG);	
+
+	//if (!pDevice->RegUsbSS)
+	{
+		return;
+	}
+
+	//
+	// 2010/08/23 MH According to Alfred's suggestion, we need to to prevent HW
+	// to enter suspend mode automatically. Otherwise, it will shut down major power 
+	// domain and 8051 will stop. When we try to enter selective suspend mode, we
+	// need to prevent HW to enter D2 mode aumotmatically. Another way, Host will
+	// issue a S10 signal to power domain. Then it will cleat SIC setting(from Yngli).
+	// We need to enable HW suspend mode when enter S3/S4 or disable. We need 
+	// to disable HW suspend mode for IPS/radio_off.
+	//
+	//RT_TRACE(COMP_RF, DBG_LOUD, ("HwSuspendModeEnable92Cu = %d\n", Type));
+	if (Type == _FALSE)
+	{
+		reg |= BIT14;
+		//RT_TRACE(COMP_RF, DBG_LOUD, ("REG_GPIO_MUXCFG = %x\n", reg));
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+		reg |= BIT12;
+		//RT_TRACE(COMP_RF, DBG_LOUD, ("REG_GPIO_MUXCFG = %x\n", reg));
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+	}
+	else
+	{
+		reg &= (~BIT12);
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+		reg &= (~BIT14);
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+	}
+	
+}	// HwSuspendModeEnable92Cu
+rt_rf_power_state RfOnOffDetect(IN	PADAPTER pAdapter )
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(pAdapter);
+	u8	val8;
+	rt_rf_power_state rfpowerstate = rf_off;
+
+	if(pAdapter->pwrctrlpriv.bHWPowerdown)
+	{
+		val8 = rtw_read8(pAdapter, REG_HSISR);
+		DBG_8192C("pwrdown, 0x5c(BIT7)=%02x\n", val8);
+		rfpowerstate = (val8 & BIT7) ? rf_off: rf_on;				
+	}
+	else // rf on/off
+	{
+		rtw_write8(	pAdapter, REG_MAC_PINMUX_CFG,rtw_read8(pAdapter, REG_MAC_PINMUX_CFG)&~(BIT3));
+		val8 = rtw_read8(pAdapter, REG_GPIO_IO_SEL);
+		DBG_8192C("GPIO_IN=%02x\n", val8);
+		rfpowerstate = (val8 & BIT3) ? rf_on : rf_off;	
+	}
+	return rfpowerstate;
+}	// HalDetectPwrDownMode
+
+void _ps_open_RF(_adapter *padapter);
+
+
+u32 rtl8192cu_hal_init(PADAPTER Adapter)
+{
+	u8	val8 = 0;
+	u32	boundary, status = _SUCCESS;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct pwrctrl_priv		*pwrctrlpriv = &Adapter->pwrctrlpriv;
+	struct registry_priv	*pregistrypriv = &Adapter->registrypriv;
+	u8	is92C = IS_92C_SERIAL(pHalData->VersionID);
+	rt_rf_power_state		eRfPowerStateToSet;
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+
+	u32 init_start_time = rtw_get_current_time();
+
+
+#ifdef DBG_HAL_INIT_PROFILING
+
+	enum HAL_INIT_STAGES {
+		HAL_INIT_STAGES_BEGIN = 0,
+		HAL_INIT_STAGES_INIT_PW_ON,
+		HAL_INIT_STAGES_MISC01,
+		HAL_INIT_STAGES_DOWNLOAD_FW,
+		HAL_INIT_STAGES_INIT_LLTT,
+		HAL_INIT_STAGES_MAC,
+		HAL_INIT_STAGES_MISC02,
+		HAL_INIT_STAGES_BB,
+		HAL_INIT_STAGES_RF,
+		HAL_INIT_STAGES_TURN_ON_BLOCK,
+		HAL_INIT_STAGES_INIT_SECURITY,
+		HAL_INIT_STAGES_MISC11,
+		//HAL_INIT_STAGES_RF_PS,
+		HAL_INIT_STAGES_IQK,
+		HAL_INIT_STAGES_PW_TRACK,
+		HAL_INIT_STAGES_LCK,
+		HAL_INIT_STAGES_MISC21,
+		HAL_INIT_STAGES_INIT_PABIAS,
+		HAL_INIT_STAGES_BT_COEXIST,
+		//HAL_INIT_STAGES_ANTENNA_SEL,
+		HAL_INIT_STAGES_INIT_HAL_DM,
+		HAL_INIT_STAGES_MISC31,
+		HAL_INIT_STAGES_END,
+		HAL_INIT_STAGES_NUM
+	};
+
+	char * hal_init_stages_str[] = {
+		"HAL_INIT_STAGES_BEGIN",
+		"HAL_INIT_STAGES_INIT_PW_ON",
+		"HAL_INIT_STAGES_MISC01",
+		"HAL_INIT_STAGES_DOWNLOAD_FW",
+		"HAL_INIT_STAGES_INIT_LLTT",
+		"HAL_INIT_STAGES_MAC",
+		"HAL_INIT_STAGES_MISC02",
+		"HAL_INIT_STAGES_BB",
+		"HAL_INIT_STAGES_RF",
+		"HAL_INIT_STAGES_TURN_ON_BLOCK",
+		"HAL_INIT_STAGES_INIT_SECURITY",
+		"HAL_INIT_STAGES_MISC11",
+		//"HAL_INIT_STAGES_RF_PS",
+		"HAL_INIT_STAGES_IQK",
+		"HAL_INIT_STAGES_PW_TRACK",
+		"HAL_INIT_STAGES_LCK",
+		"HAL_INIT_STAGES_MISC21",
+		"HAL_INIT_STAGES_INIT_PABIAS",
+		"HAL_INIT_STAGES_BT_COEXIST",
+		//"HAL_INIT_STAGES_ANTENNA_SEL",
+		"HAL_INIT_STAGES_INIT_HAL_DM",
+		"HAL_INIT_STAGES_MISC31",
+		"HAL_INIT_STAGES_END",
+	};
+
+	int hal_init_profiling_i;
+	u32 hal_init_stages_timestamp[HAL_INIT_STAGES_NUM]; //used to record the time of each stage's starting point
+
+	for(hal_init_profiling_i=0;hal_init_profiling_i<HAL_INIT_STAGES_NUM;hal_init_profiling_i++)
+		hal_init_stages_timestamp[hal_init_profiling_i]=0;
+
+	#define HAL_INIT_PROFILE_TAG(stage) hal_init_stages_timestamp[(stage)]=rtw_get_current_time();
+#else
+	#define HAL_INIT_PROFILE_TAG(stage) do {} while(0)
+#endif //DBG_HAL_INIT_PROFILING
+
+
+
+_func_enter_;
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN);
+	if(Adapter->pwrctrlpriv.bkeepfwalive)
+	{
+		_ps_open_RF(Adapter);
+
+		if(pHalData->bIQKInitialized ){
+			rtl8192c_PHY_IQCalibrate(Adapter,_TRUE);
+		}
+		else{
+			rtl8192c_PHY_IQCalibrate(Adapter,_FALSE);
+			pHalData->bIQKInitialized = _TRUE;
+		}
+		rtl8192c_dm_CheckTXPowerTracking(Adapter);
+		rtl8192c_PHY_LCCalibrate(Adapter);
+
+		goto exit;
+	}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PW_ON);
+	status = _InitPowerOn(Adapter);
+	if(status == _FAIL){
+		RT_TRACE(_module_hci_hal_init_c_, _drv_err_, ("Failed to init power on!\n"));
+		goto exit;
+	}
+
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC01);
+	_InitQueueReservedPage(Adapter);
+	_InitTxBufferBoundary(Adapter);		
+	_InitQueuePriority(Adapter);
+	_InitPageBoundary(Adapter);	
+	_InitTransferPageSize(Adapter);
+
+
+#if ENABLE_USB_DROP_INCORRECT_OUT
+	_InitHardwareDropIncorrectBulkOut(Adapter);
+#endif
+
+	if(pHalData->bRDGEnable){
+		_InitRDGSetting(Adapter);
+	}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_DOWNLOAD_FW);
+#if (1 == MP_DRIVER)
+	_InitRxSetting(Adapter);
+	// Don't Download Firmware
+	Adapter->bFWReady = _FALSE;
+#elif RTL8192CU_FW_DOWNLOAD_ENABLE
+	status = FirmwareDownload92C(Adapter,_FALSE);
+	if(status != _SUCCESS)
+	{
+		Adapter->bFWReady = _FALSE;
+		pHalData->fw_ractrl = _FALSE;
+		DBG_8192C("fw download fail!\n");
+		goto exit;
+	}	
+	else
+	{
+		Adapter->bFWReady = _TRUE;
+		pHalData->fw_ractrl = _TRUE;
+		DBG_8192C("fw download ok!\n");	
+	}
+#endif
+
+	InitializeFirmwareVars92C(Adapter);
+
+	if(pwrctrlpriv->reg_rfoff == _TRUE){
+		pwrctrlpriv->rf_pwrstate = rf_off;
+	}
+
+	// 2010/08/09 MH We need to check if we need to turnon or off RF after detecting
+	// HW GPIO pin. Before PHY_RFConfig8192C.
+	//HalDetectPwrDownMode(Adapter);
+	// 2010/08/26 MH If Efuse does not support sective suspend then disable the function.
+	//HalDetectSelectiveSuspendMode(Adapter);
+
+	// Set RF type for BB/RF configuration	
+	_InitRFType(Adapter);//->_ReadRFType()
+
+	// Save target channel
+	// <Roger_Notes> Current Channel will be updated again later.
+	pHalData->CurrentChannel = 6;//default set to 6
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_LLTT);
+	if(!pregistrypriv->wifi_spec){
+		boundary = TX_PAGE_BOUNDARY;
+	}
+	else{// for WMM
+		boundary = WMM_NORMAL_TX_PAGE_BOUNDARY;
+	}															
+	status =  InitLLTTable(Adapter, boundary);
+	if(status == _FAIL){
+		RT_TRACE(_module_hci_hal_init_c_, _drv_err_, ("Failed to init LLT table\n"));
+		goto exit;
+	}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MAC);
+#if (HAL_MAC_ENABLE == 1)
+	status = PHY_MACConfig8192C(Adapter);
+	if(status == _FAIL)
+	{
+		goto exit;
+	}
+#endif
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02);
+	// Get Rx PHY status in order to report RSSI and others.
+	_InitDriverInfoSize(Adapter, DRVINFO_SZ);
+
+	_InitInterrupt(Adapter);
+	hal_init_macaddr(Adapter);//set mac_address
+	_InitNetworkType(Adapter);//set msr	
+	_InitWMACSetting(Adapter);
+	_InitAdaptiveCtrl(Adapter);
+	_InitEDCA(Adapter);
+	_InitRateFallback(Adapter);
+	_InitRetryFunction(Adapter);
+	InitUsbAggregationSetting(Adapter);
+	_InitOperationMode(Adapter);//todo
+	_InitBeaconParameters(Adapter);
+	_InitBeaconMaxError(Adapter, _TRUE);
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_TX_MCAST2UNI)
+
+#ifdef CONFIG_CHECK_AC_LIFETIME
+	// Enable lifetime check for the four ACs
+	rtw_write8(Adapter, REG_LIFETIME_EN, 0x0F);
+#endif	// CONFIG_CHECK_AC_LIFETIME
+
+#ifdef CONFIG_TX_MCAST2UNI
+	rtw_write16(Adapter, REG_PKT_VO_VI_LIFE_TIME, 0x0400);	// unit: 256us. 256ms
+	rtw_write16(Adapter, REG_PKT_BE_BK_LIFE_TIME, 0x0400);	// unit: 256us. 256ms
+#else	// CONFIG_TX_MCAST2UNI
+	rtw_write16(Adapter, REG_PKT_VO_VI_LIFE_TIME, 0x3000);	// unit: 256us. 3s
+	rtw_write16(Adapter, REG_PKT_BE_BK_LIFE_TIME, 0x3000);	// unit: 256us. 3s
+#endif	// CONFIG_TX_MCAST2UNI
+#endif	// CONFIG_CONCURRENT_MODE || CONFIG_TX_MCAST2UNI
+	
+
+#ifdef CONFIG_LED
+	_InitHWLed(Adapter);
+#endif //CONFIG_LED
+
+	//
+	//d. Initialize BB related configurations.
+	//
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BB);
+#if (HAL_BB_ENABLE == 1)
+	status = PHY_BBConfig8192C(Adapter);
+	if(status == _FAIL)
+	{
+		goto exit;
+	}
+#endif
+
+	// 92CU use 3-wire to r/w RF
+	//pHalData->Rf_Mode = RF_OP_By_SW_3wire;
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_RF);
+#if (HAL_RF_ENABLE == 1)
+	status = PHY_RFConfig8192C(Adapter);	
+	if(status == _FAIL)
+	{
+		goto exit;
+	}
+
+	if(IS_VENDOR_UMC_A_CUT(pHalData->VersionID) && !IS_92C_SERIAL(pHalData->VersionID))
+	{
+		PHY_SetRFReg(Adapter, RF_PATH_A, RF_RX_G1, bMaskDWord, 0x30255);
+		PHY_SetRFReg(Adapter, RF_PATH_A, RF_RX_G2, bMaskDWord, 0x50a00);		
+	}
+#endif
+
+	//
+	// Joseph Note: Keep RfRegChnlVal for later use.
+	//
+	pHalData->RfRegChnlVal[0] = PHY_QueryRFReg(Adapter, (RF_RADIO_PATH_E)0, RF_CHNLBW, bRFRegOffsetMask);
+	pHalData->RfRegChnlVal[1] = PHY_QueryRFReg(Adapter, (RF_RADIO_PATH_E)1, RF_CHNLBW, bRFRegOffsetMask);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_TURN_ON_BLOCK);
+	_BBTurnOnBlock(Adapter);
+	//NicIFSetMacAddress(padapter, padapter->PermanentAddress);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_SECURITY);
+	invalidate_cam_all(Adapter);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11);
+	// 2010/12/17 MH We need to set TX power according to EFUSE content at first.
+	PHY_SetTxPowerLevel8192C(Adapter, pHalData->CurrentChannel);
+
+// Move by Neo for USB SS to below setp	
+//_RfPowerSave(Adapter);
+
+	if (!IS_92C_SERIAL( pHalData->VersionID) && (pHalData->AntDivCfg!=0))
+	{ //for 88CU ,1T1R
+		_InitAntenna_Selection(Adapter);
+	}
+
+
+	// 
+	// Disable BAR, suggested by Scott
+	// 2010.04.09 add by hpfan
+	//
+	rtw_write32(Adapter, REG_BAR_MODE_CTRL, 0x0201ffff);
+
+	// HW SEQ CTRL
+	//set 0x0 to 0xFF by tynli. Default enable HW SEQ NUM.
+	rtw_write8(Adapter,REG_HWSEQ_CTRL, 0xFF); 
+
+	if(pregistrypriv->wifi_spec)
+		rtw_write16(Adapter,REG_FAST_EDCA_CTRL ,0);
+
+	//Nav limit , suggest by scott
+	rtw_write8(Adapter, 0x652, 0x0);
+
+#if (MP_DRIVER == 1)
+	Adapter->mppriv.channel = pHalData->CurrentChannel;
+	MPT_InitializeAdapter(Adapter, Adapter->mppriv.channel);
+#else
+	//
+	// 2010/08/11 MH Merge from 8192SE for Minicard init. We need to confirm current radio status
+	// and then decide to enable RF or not.!!!??? For Selective suspend mode. We may not 
+	// call init_adapter. May cause some problem??
+	//
+	// Fix the bug that Hw/Sw radio off before S3/S4, the RF off action will not be executed 
+	// in MgntActSet_RF_State() after wake up, because the value of pHalData->eRFPowerState 
+	// is the same as eRfOff, we should change it to eRfOn after we config RF parameters.
+	// Added by tynli. 2010.03.30.
+	pwrctrlpriv->rf_pwrstate = rf_on;
+
+#if 0  //to do
+	RT_CLEAR_PS_LEVEL(pwrctrlpriv, RT_RF_OFF_LEVL_HALT_NIC);
+#if 1 //Todo
+	// 20100326 Joseph: Copy from GPIOChangeRFWorkItemCallBack() function to check HW radio on/off.
+	// 20100329 Joseph: Revise and integrate the HW/SW radio off code in initialization.
+
+	eRfPowerStateToSet = (rt_rf_power_state) RfOnOffDetect(Adapter);
+	pwrctrlpriv->rfoff_reason |= eRfPowerStateToSet==rf_on ? RF_CHANGE_BY_INIT : RF_CHANGE_BY_HW;
+	pwrctrlpriv->rfoff_reason |= (pwrctrlpriv->reg_rfoff) ? RF_CHANGE_BY_SW : 0;
+
+	if(pwrctrlpriv->rfoff_reason&RF_CHANGE_BY_HW)
+		pwrctrlpriv->b_hw_radio_off = _TRUE;
+
+	DBG_8192C("eRfPowerStateToSet=%d\n", eRfPowerStateToSet);
+	
+	if(pwrctrlpriv->reg_rfoff == _TRUE)
+	{	// User disable RF via registry.
+		DBG_8192C("InitializeAdapter8192CU(): Turn off RF for RegRfOff.\n");
+		//MgntActSet_RF_State(Adapter, rf_off, RF_CHANGE_BY_SW, _TRUE);
+		
+		// Those action will be discard in MgntActSet_RF_State because off the same state
+		//for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+			//PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x4, 0xC00, 0x0);
+	}
+	else if(pwrctrlpriv->rfoff_reason > RF_CHANGE_BY_PS)
+	{	// H/W or S/W RF OFF before sleep.
+		DBG_8192C(" Turn off RF for RfOffReason(%x) ----------\n", pwrctrlpriv->rfoff_reason);
+		//pwrctrlpriv->rfoff_reason = RF_CHANGE_BY_INIT;
+		pwrctrlpriv->rf_pwrstate = rf_on;
+		//MgntActSet_RF_State(Adapter, rf_off, pwrctrlpriv->rfoff_reason, _TRUE);
+	}
+	else
+	{
+		// Perform GPIO polling to find out current RF state. added by Roger, 2010.04.09.
+		if(pHalData->BoardType == BOARD_MINICARD /*&& (Adapter->MgntInfo.PowerSaveControl.bGpioRfSw)*/)
+		{
+			DBG_8192C("InitializeAdapter8192CU(): RF=%d \n", eRfPowerStateToSet);
+			if (eRfPowerStateToSet == rf_off)
+			{				
+				//MgntActSet_RF_State(Adapter, rf_off, RF_CHANGE_BY_HW, _TRUE);
+				pwrctrlpriv->b_hw_radio_off = _TRUE;	
+			}
+			else
+			{
+				pwrctrlpriv->rf_pwrstate = rf_off;
+				pwrctrlpriv->rfoff_reason = RF_CHANGE_BY_INIT; 
+				pwrctrlpriv->b_hw_radio_off = _FALSE;					
+				//MgntActSet_RF_State(Adapter, rf_on, pwrctrlpriv->rfoff_reason, _TRUE);
+			}
+		}	
+		else
+		{
+			pwrctrlpriv->rf_pwrstate = rf_off;
+			pwrctrlpriv->rfoff_reason = RF_CHANGE_BY_INIT; 			
+			//MgntActSet_RF_State(Adapter, rf_on, pwrctrlpriv->rfoff_reason, _TRUE);
+		}
+	
+		pwrctrlpriv->rfoff_reason = 0; 
+		pwrctrlpriv->b_hw_radio_off = _FALSE;
+		pwrctrlpriv->rf_pwrstate = rf_on;
+		rtw_led_control(Adapter, LED_CTL_POWER_ON);
+
+	}
+
+	// 2010/-8/09 MH For power down module, we need to enable register block contrl reg at 0x1c.
+	// Then enable power down control bit of register 0x04 BIT4 and BIT15 as 1.
+	if(pHalData->pwrdown && eRfPowerStateToSet == rf_off)
+	{
+		// Enable register area 0x0-0xc.
+		rtw_write8(Adapter, REG_RSV_CTRL, 0x0);
+
+		//
+		// <Roger_Notes> We should configure HW PDn source for WiFi ONLY, and then
+		// our HW will be set in power-down mode if PDn source from all  functions are configured.
+		// 2010.10.06.
+		//
+		//if(IS_HARDWARE_TYPE_8723AU(Adapter))
+		//{			
+		//	u1bTmp = rtw_read8(Adapter, REG_MULTI_FUNC_CTRL);
+		//	rtw_write8(Adapter, REG_MULTI_FUNC_CTRL, (u1bTmp|WL_HWPDN_EN));
+		//}
+		//else
+		//{
+			rtw_write16(Adapter, REG_APS_FSMCO, 0x8812);
+		//}
+	}
+	//DrvIFIndicateCurrentPhyStatus(Adapter); // 2010/08/17 MH Disable to prevent BSOD.
+#endif
+#endif
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_IQK);
+	// 2010/08/26 MH Merge from 8192CE.
+	if(pwrctrlpriv->rf_pwrstate == rf_on)
+	{
+		if(pHalData->bIQKInitialized ){
+			rtl8192c_PHY_IQCalibrate(Adapter,_TRUE);
+		}
+		else
+		{
+			rtl8192c_PHY_IQCalibrate(Adapter,_FALSE);
+			pHalData->bIQKInitialized = _TRUE;
+		}
+		
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_PW_TRACK);
+		rtl8192c_dm_CheckTXPowerTracking(Adapter);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_LCK);
+		rtl8192c_PHY_LCCalibrate(Adapter);
+	}
+#endif /* #if (MP_DRIVER == 1) */
+
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC21);
+#if RTL8192CU_ADHOC_WORKAROUND_SETTING
+	_InitAdhocWorkaroundParams(Adapter);
+#endif
+
+
+#ifdef USB_INTERFERENCE_ISSUE
+ //fixed USB interface interference issue
+	rtw_write8(Adapter, 0xfe40, 0xe0);
+	rtw_write8(Adapter, 0xfe41, 0x8d);
+	rtw_write8(Adapter, 0xfe42, 0x80);
+	rtw_write32(Adapter,0x20c,0xfd0320);
+#if 1
+	//2011/01/07 ,suggest by Johnny,for solved the problem that too many protocol error on USB bus
+	if(!IS_VENDOR_UMC_A_CUT(pHalData->VersionID) )//&& !IS_92C_SERIAL(pHalData->VersionID))// TSMC , 8188
+	{		
+	    	// 0xE6=0x94
+	    	rtw_write8(Adapter, 0xFE40, 0xE6);
+		rtw_write8(Adapter, 0xFE41, 0x94);
+		rtw_write8(Adapter, 0xFE42, 0x80); 
+
+		// 0xE0=0x19
+		rtw_write8(Adapter, 0xFE40, 0xE0);
+		rtw_write8(Adapter, 0xFE41, 0x19);
+		rtw_write8(Adapter, 0xFE42, 0x80);
+
+		// 0xE5=0x91
+		rtw_write8(Adapter, 0xFE40, 0xE5);
+		rtw_write8(Adapter, 0xFE41, 0x91);
+		rtw_write8(Adapter, 0xFE42, 0x80); 
+
+		// 0xE2=0x81
+		rtw_write8(Adapter, 0xFE40, 0xE2);
+		rtw_write8(Adapter, 0xFE41, 0x81);
+		rtw_write8(Adapter, 0xFE42, 0x80);    
+	
+	}
+
+#endif
+#endif //USB_INTERFERENCE_ISSUE
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PABIAS);
+	_InitPABias(Adapter);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BT_COEXIST);
+#ifdef CONFIG_BT_COEXIST
+	_InitBTCoexist(Adapter);
+#endif
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_HAL_DM);
+	rtl8192c_InitHalDm(Adapter);
+
+	// 2010/08/23 MH According to Alfred's suggestion, we need to to prevent HW enter
+	// suspend mode automatically.
+	//HwSuspendModeEnable92Cu(Adapter, _FALSE);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC31);
+	rtw_write8(Adapter, 0x15, 0xe9);//suggest by Johnny for lower temperature
+        
+        rtw_write8(Adapter, 0xc87, 0x50);//suggest by Jackson for CCA  
+
+	//_dbg_dump_macreg(padapter);
+
+	rtw_write16(Adapter, REG_BCN_CTRL, 0x1818);	// For 2 PORT TSF SYNC
+
+
+
+#ifdef CONFIG_XMIT_ACK
+	//ack for xmit mgmt frames.
+	rtw_write32(Adapter, REG_FWHW_TXQ_CTRL, rtw_read32(Adapter, REG_FWHW_TXQ_CTRL)|BIT(12));
+#endif //CONFIG_XMIT_ACK
+
+exit:
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_END);
+
+	DBG_871X("%s in %dms\n", __FUNCTION__, rtw_get_passing_time_ms(init_start_time));
+
+	#ifdef DBG_HAL_INIT_PROFILING
+	hal_init_stages_timestamp[HAL_INIT_STAGES_END]=rtw_get_current_time();
+
+	for(hal_init_profiling_i=0;hal_init_profiling_i<HAL_INIT_STAGES_NUM-1;hal_init_profiling_i++) {
+		DBG_871X("DBG_HAL_INIT_PROFILING: %35s, %u, %5u, %5u\n"
+			, hal_init_stages_str[hal_init_profiling_i]
+			, hal_init_stages_timestamp[hal_init_profiling_i]
+			, (hal_init_stages_timestamp[hal_init_profiling_i+1]-hal_init_stages_timestamp[hal_init_profiling_i])
+			, rtw_get_time_interval_ms(hal_init_stages_timestamp[hal_init_profiling_i], hal_init_stages_timestamp[hal_init_profiling_i+1])
+		);
+	}	
+	#endif
+
+
+_func_exit_;
+
+	return status;
+}
+
+
+#define SYNC_SD7_20110802_phy_SsPwrSwitch92CU
+#ifdef SYNC_SD7_20110802_phy_SsPwrSwitch92CU
+
+VOID
+phy_SsPwrSwitch92CU(
+	IN	PADAPTER			Adapter,
+	IN	rt_rf_power_state	eRFPowerState,
+	IN	int bRegSSPwrLvl
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8				value8;
+	
+	switch( eRFPowerState )
+	{
+		case rf_on:								
+			if (bRegSSPwrLvl == 1)
+			{
+				// 1. Enable MAC Clock. Can not be enabled now.
+				//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) | BIT(3));
+				
+				// 2. Force PWM, Enable SPS18_LDO_Marco_Block
+				rtw_write8(Adapter, REG_SPS0_CTRL, 
+				rtw_read8(Adapter, REG_SPS0_CTRL) | (BIT0|BIT3));
+
+				// 3. restore BB, AFE control register.
+				//RF
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 1);							
+				else								
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 1);							
+				PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 1);
+				PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1, 0);
+
+				//AFE
+				//DbgPrint("0x0e70 = %x\n", Adapter->PS_BBRegBackup[PSBBREG_AFE0]);
+				//PHY_SetBBReg(Adapter, 0x0e70, bMaskDWord ,Adapter->PS_BBRegBackup[PSBBREG_AFE0] );
+				//PHY_SetBBReg(Adapter, 0x0e70, bMaskDWord ,0x631B25A0 );				
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x63DB25A0 );
+				else if (pHalData->rf_type ==  RF_1T1R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x631B25A0 );
+
+				// 4. issue 3-wire command that RF set to Rx idle mode. This is used to re-write the RX idle mode.
+				// We can only prvide a usual value instead and then HW will modify the value by itself.
+				PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0x32D95);
+				if (pHalData->rf_type ==  RF_2T2R)
+				{
+					PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0x32D95);
+				}
+			}	
+			else		// Level 2 or others.
+			{
+				//h.	AFE_PLL_CTRL 0x28[7:0] = 0x80			//disable AFE PLL
+				rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x81);
+				
+				// i.	AFE_XTAL_CTRL 0x24[15:0] = 0x880F		//gated AFE DIG_CLOCK
+				rtw_write16(Adapter, REG_AFE_XTAL_CTRL, 0x800F);
+				rtw_mdelay_os(1);
+				
+				// 1. Enable MAC Clock. Can not be enabled now.
+				//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) | BIT(3));
+				
+				// 2. Force PWM, Enable SPS18_LDO_Marco_Block
+				rtw_write8(Adapter, REG_SPS0_CTRL, 
+				rtw_read8(Adapter, REG_SPS0_CTRL) | (BIT0|BIT3));
+
+				// 3. restore BB, AFE control register.
+				//RF
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 1);							
+				else								
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 1);							
+				PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 1);
+				PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1, 0);
+
+				//AFE
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x63DB25A0 );
+				else if (pHalData->rf_type ==  RF_1T1R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x631B25A0 );
+
+				// 4. issue 3-wire command that RF set to Rx idle mode. This is used to re-write the RX idle mode.
+				// We can only prvide a usual value instead and then HW will modify the value by itself.
+				PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0x32D95);
+				if (pHalData->rf_type ==  RF_2T2R)
+				{
+					PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0x32D95);
+				}
+
+				// 5. gated MAC Clock
+				//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) & ~(BIT(3)));
+				//PlatformEFIOWrite1Byte(Adapter, REG_SYS_CLKR+1, PlatformEFIORead1Byte(Adapter, REG_SYS_CLKR+1)|(BIT3));
+
+				{
+					//u8 			eRFPath = RF_PATH_A,value8 = 0, retry = 0;
+					u8		bytetmp;
+					//PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x0, bMaskByte0, 0x0);
+					// 2010/08/12 MH Add for B path under SS test. 
+					//if (pHalData->RF_Type ==  RF_2T2R)
+						//PHY_SetRFReg(Adapter, RF_PATH_B, 0x0, bMaskByte0, 0x0);
+
+					bytetmp = rtw_read8(Adapter, REG_APSD_CTRL);
+					rtw_write8(Adapter, REG_APSD_CTRL, bytetmp & ~BIT6);
+				
+					rtw_mdelay_os(10);
+
+					// Set BB reset at first
+					rtw_write8(Adapter, REG_SYS_FUNC_EN, 0x17 );//0x16		
+					//undo clock gated
+					rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)&(~BIT31));
+					// Enable TX
+					rtw_write8(Adapter, REG_TXPAUSE, 0x0);
+				}
+				//Adapter->HalFunc.InitializeAdapterHandler(Adapter, Adapter->MgntInfo.dot11CurrentChannelNumber);
+				//CardSelectiveSuspendLeave(Adapter);
+			}
+
+			break;
+	   
+		case rf_sleep:
+		case rf_off:
+				value8 = rtw_read8(Adapter, REG_SPS0_CTRL) ;
+				if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+					value8 &= ~(BIT0);
+				else
+					value8 &= ~(BIT0|BIT3);
+				if (bRegSSPwrLvl == 1)
+				{
+					//RT_TRACE(COMP_POWER, DBG_LOUD, ("SS LVL1\n"));
+					// Disable RF and BB only for SelectSuspend.
+					
+					// 1. Set BB/RF to shutdown.
+					//	(1) Reg878[5:3]= 0 	// RF rx_code for preamble power saving
+					//	(2)Reg878[21:19]= 0	//Turn off RF-B
+					//	(3) RegC04[7:4]= 0 	// turn off all paths for packet detection
+					//	(4) Reg800[1] = 1 		// enable preamble power saving
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF0] = PHY_QueryBBReg(Adapter, rFPGA0_XAB_RFParameter, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF1] = PHY_QueryBBReg(Adapter, rOFDM0_TRxPathEnable, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF2] = PHY_QueryBBReg(Adapter, rFPGA0_RFMOD, bMaskDWord);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 0);							
+					}
+					else if (pHalData->rf_type ==  RF_1T1R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 0);							
+					}
+					PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 0);						
+					PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1,1);
+					
+					// 2 .AFE control register to power down. bit[30:22]
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_AFE0] = PHY_QueryBBReg(Adapter, rRx_Wait_CCA, bMaskDWord);	
+					if (pHalData->rf_type ==  RF_2T2R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x00DB25A0);
+					else if (pHalData->rf_type ==  RF_1T1R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x001B25A0);
+					
+					// 3. issue 3-wire command that RF set to power down.
+					PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0);
+					}
+
+					// 4. Force PFM , disable SPS18_LDO_Marco_Block					
+					rtw_write8(Adapter, REG_SPS0_CTRL, value8);
+
+					// 5. gated MAC Clock
+					//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) & ~(BIT(3)));
+				}
+				else	// Level 2 or others.
+				{
+					//RT_TRACE(COMP_POWER, DBG_LOUD, ("SS LVL2\n"));
+					{
+						u8 			eRFPath = RF_PATH_A,value8 = 0;
+						rtw_write8(Adapter, REG_TXPAUSE, 0xFF);
+						PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x0, bMaskByte0, 0x0);
+						// 2010/08/12 MH Add for B path under SS test. 
+						//if (pHalData->RF_Type ==  RF_2T2R)
+							//PHY_SetRFReg(Adapter, RF_PATH_B, 0x0, bMaskByte0, 0x0);
+
+						value8 |= APSDOFF;
+						rtw_write8(Adapter, REG_APSD_CTRL, value8);//0x40
+
+						// After switch APSD, we need to delay for stability
+						rtw_mdelay_os(10);
+						//before BB reset should do clock gated
+						rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|(BIT31));
+						// Set BB reset at first
+						value8 = 0 ; 
+						value8 |=( FEN_USBD | FEN_USBA | FEN_BB_GLB_RSTn);
+						rtw_write8(Adapter, REG_SYS_FUNC_EN,value8 );//0x16			
+					}
+
+					// Disable RF and BB only for SelectSuspend.
+
+					// 1. Set BB/RF to shutdown.
+					//	(1) Reg878[5:3]= 0 	// RF rx_code for preamble power saving
+					//	(2)Reg878[21:19]= 0	//Turn off RF-B
+					//	(3) RegC04[7:4]= 0 	// turn off all paths for packet detection
+					//	(4) Reg800[1] = 1 		// enable preamble power saving
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF0] = PHY_QueryBBReg(Adapter, rFPGA0_XAB_RFParameter, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF1] = PHY_QueryBBReg(Adapter, rOFDM0_TRxPathEnable, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF2] = PHY_QueryBBReg(Adapter, rFPGA0_RFMOD, bMaskDWord);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 0);							
+					}
+					else if (pHalData->rf_type ==  RF_1T1R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 0);							
+					}
+					PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 0);						
+					PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1,1);
+					
+					// 2 .AFE control register to power down. bit[30:22]
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_AFE0] = PHY_QueryBBReg(Adapter, rRx_Wait_CCA, bMaskDWord);	
+					if (pHalData->rf_type ==  RF_2T2R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x00DB25A0);
+					else if (pHalData->rf_type ==  RF_1T1R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x001B25A0);
+					
+					// 3. issue 3-wire command that RF set to power down.
+					PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0);
+					}
+
+					// 4. Force PFM , disable SPS18_LDO_Marco_Block
+					rtw_write8(Adapter, REG_SPS0_CTRL, value8);
+
+					// 2010/10/13 MH/Isaachsu exchange sequence.
+					//h.	AFE_PLL_CTRL 0x28[7:0] = 0x80			//disable AFE PLL
+					rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x80);
+					rtw_mdelay_os(1);
+
+					// i.	AFE_XTAL_CTRL 0x24[15:0] = 0x880F		//gated AFE DIG_CLOCK
+					rtw_write16(Adapter, REG_AFE_XTAL_CTRL, 0xA80F);
+
+					// 5. gated MAC Clock
+					//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) & ~(BIT(3)));
+					//PlatformEFIOWrite1Byte(Adapter, REG_SYS_CLKR+1, PlatformEFIORead1Byte(Adapter, REG_SYS_CLKR+1)& ~(BIT3))
+					
+					//CardSelectiveSuspendEnter(Adapter);
+				}
+
+			break;
+
+		default:
+			break;
+	} 
+	
+}	// phy_PowerSwitch92CU
+
+void _ps_open_RF(_adapter *padapter) {
+	//here call with bRegSSPwrLvl 1, bRegSSPwrLvl 2 needs to be verified
+	phy_SsPwrSwitch92CU(padapter, rf_on, 1);
+}
+
+void _ps_close_RF(_adapter *padapter){
+	//here call with bRegSSPwrLvl 1, bRegSSPwrLvl 2 needs to be verified
+	phy_SsPwrSwitch92CU(padapter, rf_off, 1);
+}
+#endif //SYNC_SD7_20110802_phy_SsPwrSwitch92CU
+
+
+
+static VOID 
+_DisableGPIO(
+	IN	PADAPTER	Adapter
+	)
+{
+/***************************************
+j. GPIO_PIN_CTRL 0x44[31:0]=0x000		// 
+k. Value = GPIO_PIN_CTRL[7:0]
+l.  GPIO_PIN_CTRL 0x44[31:0] = 0x00FF0000 | (value <<8); //write external PIN level
+m. GPIO_MUXCFG 0x42 [15:0] = 0x0780
+n. LEDCFG 0x4C[15:0] = 0x8080
+***************************************/
+	u8	value8;
+	u16	value16;
+	u32	value32;
+
+	//1. Disable GPIO[7:0]
+	rtw_write16(Adapter, REG_GPIO_PIN_CTRL+2, 0x0000);
+    	value32 = rtw_read32(Adapter, REG_GPIO_PIN_CTRL) & 0xFFFF00FF;  
+	value8 = (u8) (value32&0x000000FF);
+	value32 |= ((value8<<8) | 0x00FF0000);
+	rtw_write32(Adapter, REG_GPIO_PIN_CTRL, value32);
+	      
+	//2. Disable GPIO[10:8]          
+	rtw_write8(Adapter, REG_GPIO_MUXCFG+3, 0x00);
+	    value16 = rtw_read16(Adapter, REG_GPIO_MUXCFG+2) & 0xFF0F;  
+	value8 = (u8) (value16&0x000F);
+	value16 |= ((value8<<4) | 0x0780);
+	rtw_write16(Adapter, REG_GPIO_MUXCFG+2, value16);
+
+	//3. Disable LED0 & 1
+	rtw_write16(Adapter, REG_LEDCFG0, 0x8080);
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Disable GPIO and LED.\n"));
+ 
+} //end of _DisableGPIO()
+
+static VOID
+_ResetFWDownloadRegister(
+	IN PADAPTER			Adapter
+	)
+{
+	u32	value32;
+
+	value32 = rtw_read32(Adapter, REG_MCUFWDL);
+	value32 &= ~(MCUFWDL_EN | MCUFWDL_RDY);
+	rtw_write32(Adapter, REG_MCUFWDL, value32);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Reset FW download register.\n"));
+}
+
+
+static int
+_DisableRF_AFE(
+	IN PADAPTER			Adapter
+	)
+{
+	int		rtStatus = _SUCCESS;
+	u32			pollingCount = 0;
+	u8			value8;
+	
+	//disable RF/ AFE AD/DA
+	value8 = APSDOFF;
+	rtw_write8(Adapter, REG_APSD_CTRL, value8);
+
+
+#if (RTL8192CU_ASIC_VERIFICATION)
+
+	do
+	{
+		if(rtw_read8(Adapter, REG_APSD_CTRL) & APSDOFF_STATUS){
+			//RT_TRACE(COMP_INIT, DBG_LOUD, ("Disable RF, AFE, AD, DA Done!\n"));
+			break;
+		}
+
+		if(pollingCount++ > POLLING_READY_TIMEOUT_COUNT){
+			//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("Failed to polling APSDOFF_STATUS done!\n"));
+			return _FAIL;
+		}
+				
+	}while(_TRUE);
+	
+#endif
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Disable RF, AFE,AD, DA.\n"));
+	return rtStatus;
+
+}
+
+static VOID
+_ResetBB(
+	IN PADAPTER			Adapter
+	)
+{
+	u16	value16;
+	
+	//before BB reset should do clock gated
+	rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|(BIT31));
+	//reset BB
+	value16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+	value16 &= ~(FEN_BBRSTB | FEN_BB_GLB_RSTn);
+	rtw_write16(Adapter, REG_SYS_FUNC_EN, value16);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Reset BB.\n"));
+}
+
+static VOID
+_ResetMCU(
+	IN PADAPTER			Adapter
+	)
+{
+	u16	value16;
+	
+	// reset MCU
+	value16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+	value16 &= ~FEN_CPUEN;
+	rtw_write16(Adapter, REG_SYS_FUNC_EN, value16);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Reset MCU.\n"));
+}
+
+static VOID
+_DisableMAC_AFE_PLL(
+	IN PADAPTER			Adapter
+	)
+{
+	u32	value32;
+	
+	//disable MAC/ AFE PLL
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+	value32 |= APDM_MAC;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+	
+	value32 |= APFM_OFF;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Disable MAC, AFE PLL.\n"));
+}
+
+static VOID
+_AutoPowerDownToHostOff(
+	IN	PADAPTER		Adapter
+	)
+{
+	u32			value32;
+	rtw_write8(Adapter, REG_SPS0_CTRL, 0x22);
+
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);	
+	
+	value32 |= APDM_HOST;//card disable
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Auto Power Down to Host-off state.\n"));
+
+	// set USB suspend
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+	value32 &= ~AFSM_PCIE;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+
+}
+
+static VOID
+_SetUsbSuspend(
+	IN PADAPTER			Adapter
+	)
+{
+	u32			value32;
+
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+	
+	// set USB suspend
+	value32 |= AFSM_HSUS;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+
+	//RT_ASSERT(0 == (rtw_read32(Adapter, REG_APS_FSMCO) & BIT(12)),(""));
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Set USB suspend.\n"));
+	
+}
+
+static VOID
+_DisableRFAFEAndResetBB(
+	IN PADAPTER			Adapter
+	)
+{
+/**************************************
+a.	TXPAUSE 0x522[7:0] = 0xFF             //Pause MAC TX queue
+b.	RF path 0 offset 0x00 = 0x00            // disable RF
+c. 	APSD_CTRL 0x600[7:0] = 0x40
+d.	SYS_FUNC_EN 0x02[7:0] = 0x16		//reset BB state machine
+e.	SYS_FUNC_EN 0x02[7:0] = 0x14		//reset BB state machine
+***************************************/
+	u8 eRFPath = 0,value8 = 0;
+	rtw_write8(Adapter, REG_TXPAUSE, 0xFF);
+	PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x0, bMaskByte0, 0x0);
+
+	value8 |= APSDOFF;
+	rtw_write8(Adapter, REG_APSD_CTRL, value8);//0x40
+	//before BB reset should do clock gated
+	rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|(BIT31));
+	value8 = 0 ; 
+	value8 |=( FEN_USBD | FEN_USBA | FEN_BB_GLB_RSTn);
+	rtw_write8(Adapter, REG_SYS_FUNC_EN,value8 );//0x16		
+	
+	value8 &=( ~FEN_BB_GLB_RSTn );
+	rtw_write8(Adapter, REG_SYS_FUNC_EN, value8); //0x14		
+	
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> RF off and reset BB.\n"));
+}
+
+static VOID
+_ResetDigitalProcedure1(
+	IN 	PADAPTER			Adapter,
+	IN	BOOLEAN				bWithoutHWSM	
+	)
+{
+
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter);
+
+	if(pHalData->FirmwareVersion <=  0x20){
+		#if 0
+		/*****************************
+		f.	SYS_FUNC_EN 0x03[7:0]=0x54		// reset MAC register, DCORE
+		g.	MCUFWDL 0x80[7:0]=0				// reset MCU ready status
+		******************************/
+		u4Byte	value32 = 0;
+		PlatformIOWrite1Byte(Adapter, REG_SYS_FUNC_EN+1, 0x54);
+		PlatformIOWrite1Byte(Adapter, REG_MCUFWDL, 0);	
+		#else
+		/*****************************
+		f.	MCUFWDL 0x80[7:0]=0				// reset MCU ready status
+		g.	SYS_FUNC_EN 0x02[10]= 0			// reset MCU register, (8051 reset)
+		h.	SYS_FUNC_EN 0x02[15-12]= 5		// reset MAC register, DCORE
+		i.     SYS_FUNC_EN 0x02[10]= 1			// enable MCU register, (8051 enable)
+		******************************/
+			u16 valu16 = 0;
+			rtw_write8(Adapter, REG_MCUFWDL, 0);
+
+			valu16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);	
+			rtw_write16(Adapter, REG_SYS_FUNC_EN, (valu16 & (~FEN_CPUEN)));//reset MCU ,8051
+
+			valu16 = rtw_read16(Adapter, REG_SYS_FUNC_EN)&0x0FFF;	
+			rtw_write16(Adapter, REG_SYS_FUNC_EN, (valu16 |(FEN_HWPDN|FEN_ELDR)));//reset MAC
+			
+			#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+			{
+				u8 val;
+				if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+					DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+			}
+			#endif
+
+			
+			valu16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);	
+			rtw_write16(Adapter, REG_SYS_FUNC_EN, (valu16 | FEN_CPUEN));//enable MCU ,8051	
+
+		
+		#endif
+	}
+	else{
+		u8 retry_cnts = 0;	
+		
+		if(rtw_read8(Adapter, REG_MCUFWDL) & BIT1)
+		{ //IF fw in RAM code, do reset 
+
+			rtw_write8(Adapter, REG_MCUFWDL, 0);
+			if(Adapter->bFWReady){
+				// 2010/08/25 MH Accordign to RD alfred's suggestion, we need to disable other
+				// HRCV INT to influence 8051 reset.
+				rtw_write8(Adapter, REG_FWIMR, 0x20);
+				
+				rtw_write8(Adapter, REG_HMETFR+3, 0x20);//8051 reset by self
+
+				while( (retry_cnts++ <100) && (FEN_CPUEN &rtw_read16(Adapter, REG_SYS_FUNC_EN)))
+				{					
+					rtw_udelay_os(50);//PlatformStallExecution(50);//us
+				}
+
+				if(retry_cnts >= 100){
+					DBG_8192C("%s #####=> 8051 reset failed!.........................\n", __FUNCTION__);
+					// if 8051 reset fail we trigger GPIO 0 for LA
+					//PlatformEFIOWrite4Byte(	Adapter, 
+					//						REG_GPIO_PIN_CTRL, 
+					//						0x00010100);
+					// 2010/08/31 MH According to Filen's info, if 8051 reset fail, reset MAC directly.
+					rtw_write8(Adapter, REG_SYS_FUNC_EN+1, 0x50);	//Reset MAC and Enable 8051
+					rtw_mdelay_os(10);
+				}
+				else {
+					//DBG_871X("%s =====> 8051 reset success (%d) .\n", __FUNCTION__, retry_cnts);
+				}
+			}
+			else {
+				DBG_871X("%s =====> 8051 in RAM but !Adapter->bFWReady\n", __FUNCTION__);	
+			}
+		}
+		else{
+			//DBG_871X("%s =====> 8051 in ROM.\n", __FUNCTION__);
+		}	
+		
+		#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+		{
+			u8 val;
+			if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+				DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+		}
+		#endif
+		
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, 0x54);	//Reset MAC and Enable 8051
+	}
+
+	// Clear rpwm value for initial toggle bit trigger.
+	rtw_write8(Adapter, REG_USB_HRPWM, 0x00);
+
+	if(bWithoutHWSM){
+	/*****************************
+		Without HW auto state machine
+	g.	SYS_CLKR 0x08[15:0] = 0x30A3			//disable MAC clock
+	h.	AFE_PLL_CTRL 0x28[7:0] = 0x80			//disable AFE PLL
+	i.	AFE_XTAL_CTRL 0x24[15:0] = 0x880F		//gated AFE DIG_CLOCK
+	j.	SYS_ISO_CTRL 0x00[7:0] = 0xF9			// isolated digital to PON
+	******************************/	
+		//rtw_write16(Adapter, REG_SYS_CLKR, 0x30A3);
+		rtw_write16(Adapter, REG_SYS_CLKR, 0x70A3);//modify to 0x70A3 by Scott.
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x80);		
+		rtw_write16(Adapter, REG_AFE_XTAL_CTRL, 0x880F);
+		rtw_write8(Adapter, REG_SYS_ISO_CTRL, 0xF9);		
+	}
+	else
+	{		
+		// Disable all RF/BB power 
+		rtw_write8(Adapter, REG_RF_CTRL, 0x00);
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Reset Digital.\n"));
+
+}
+
+static VOID
+_ResetDigitalProcedure2(
+	IN 	PADAPTER			Adapter
+)
+{
+/*****************************
+k.	SYS_FUNC_EN 0x03[7:0] = 0x44			// disable ELDR runction
+l.	SYS_CLKR 0x08[15:0] = 0x3083			// disable ELDR clock
+m.	SYS_ISO_CTRL 0x01[7:0] = 0x83			// isolated ELDR to PON
+******************************/
+	//rtw_write8(Adapter, REG_SYS_FUNC_EN+1, 0x44);//marked by Scott.
+	//rtw_write16(Adapter, REG_SYS_CLKR, 0x3083);
+	//rtw_write8(Adapter, REG_SYS_ISO_CTRL+1, 0x83);
+
+ 	rtw_write16(Adapter, REG_SYS_CLKR, 0x70a3); //modify to 0x70a3 by Scott.
+ 	rtw_write8(Adapter, REG_SYS_ISO_CTRL+1, 0x82); //modify to 0x82 by Scott.
+}
+
+static VOID
+_DisableAnalog(
+	IN PADAPTER			Adapter,
+	IN BOOLEAN			bWithoutHWSM	
+	)
+{
+	u16 value16 = 0;
+	u8 value8=0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	
+	if(bWithoutHWSM){
+	/*****************************
+	n.	LDOA15_CTRL 0x20[7:0] = 0x04		// disable A15 power
+	o.	LDOV12D_CTRL 0x21[7:0] = 0x54		// disable digital core power
+	r.	When driver call disable, the ASIC will turn off remaining clock automatically 
+	******************************/
+	
+		rtw_write8(Adapter, REG_LDOA15_CTRL, 0x04);
+		//PlatformIOWrite1Byte(Adapter, REG_LDOV12D_CTRL, 0x54);		
+		
+		value8 = rtw_read8(Adapter, REG_LDOV12D_CTRL);		
+		value8 &= (~LDV12_EN);
+		rtw_write8(Adapter, REG_LDOV12D_CTRL, value8);	
+		//RT_TRACE(COMP_INIT, DBG_LOUD, (" REG_LDOV12D_CTRL Reg0x21:0x%02x.\n",value8));
+	}
+	
+/*****************************
+h.	SPS0_CTRL 0x11[7:0] = 0x23			//enter PFM mode
+i.	APS_FSMCO 0x04[15:0] = 0x4802		// set USB suspend 
+******************************/	
+
+
+	value8 = 0x23;
+	if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+		value8 |= BIT3;
+
+	rtw_write8(Adapter, REG_SPS0_CTRL, value8);
+
+
+	if(bWithoutHWSM)
+	{			
+		//value16 |= (APDM_HOST | /*AFSM_HSUS |*/PFM_ALDN);
+		// 2010/08/31 According to Filen description, we need to use HW to shut down 8051 automatically.
+		// Becasue suspend operatione need the asistance of 8051 to wait for 3ms.
+		value16 |= (APDM_HOST | AFSM_HSUS |PFM_ALDN);
+	}
+	else
+	{			
+		value16 |= (APDM_HOST | AFSM_HSUS |PFM_ALDN);
+	}
+
+	rtw_write16(Adapter, REG_APS_FSMCO,value16 );//0x4802 
+
+	rtw_write8(Adapter, REG_RSV_CTRL, 0x0e);
+
+ #if 0
+ 	//tynli_test for suspend mode.
+	if(!bWithoutHWSM){
+ 		rtw_write8(Adapter, 0xfe10, 0x19);
+	} 
+#endif
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Disable Analog Reg0x04:0x%04x.\n",value16));
+}
+
+static int	
+CardDisableHWSM( // HW Auto state machine
+	IN	PADAPTER		Adapter,
+	IN	BOOLEAN			resetMCU
+	)
+{
+	int		rtStatus = _SUCCESS;
+	if(Adapter->bSurpriseRemoved){
+		return rtStatus;
+	}
+#if 1
+	//==== RF Off Sequence ====
+	_DisableRFAFEAndResetBB(Adapter);
+
+	//  ==== Reset digital sequence   ======
+	_ResetDigitalProcedure1(Adapter, _FALSE);
+	
+	//  ==== Pull GPIO PIN to balance level and LED control ======
+	_DisableGPIO(Adapter);
+
+	//  ==== Disable analog sequence ===
+	_DisableAnalog(Adapter, _FALSE);
+
+	RT_TRACE(_module_hci_hal_init_c_, _drv_info_, ("======> Card disable finished.\n"));
+#else
+	_DisableGPIO(Adapter);
+	
+	//reset FW download register
+	_ResetFWDownloadRegister(Adapter);
+
+
+	//disable RF/ AFE AD/DA
+	rtStatus = _DisableRF_AFE(Adapter);
+	if(RT_STATUS_SUCCESS != rtStatus){
+		RT_TRACE(COMP_INIT, DBG_SERIOUS, ("_DisableRF_AFE failed!\n"));
+		goto Exit;
+	}
+	_ResetBB(Adapter);
+
+	if(resetMCU){
+		_ResetMCU(Adapter);
+	}
+
+	_AutoPowerDownToHostOff(Adapter);
+	//_DisableMAC_AFE_PLL(Adapter);
+	
+	_SetUsbSuspend(Adapter);
+Exit:
+#endif
+	return rtStatus;
+	
+}
+
+static int	
+CardDisableWithoutHWSM( // without HW Auto state machine
+	IN	PADAPTER		Adapter	
+	)
+{
+	int		rtStatus = _SUCCESS;
+
+	if(Adapter->bSurpriseRemoved){
+		return rtStatus;
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Card Disable Without HWSM .\n"));
+	//==== RF Off Sequence ====
+	_DisableRFAFEAndResetBB(Adapter);
+
+	//  ==== Reset digital sequence   ======
+	_ResetDigitalProcedure1(Adapter, _TRUE);
+
+	//  ==== Pull GPIO PIN to balance level and LED control ======
+	_DisableGPIO(Adapter);
+
+	//  ==== Reset digital sequence   ======
+	_ResetDigitalProcedure2(Adapter);
+
+	//  ==== Disable analog sequence ===
+	_DisableAnalog(Adapter, _TRUE);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("<====== Card Disable Without HWSM .\n"));
+	return rtStatus;
+}
+
+static void rtl8192cu_hw_power_down(_adapter *padapter)
+{
+	// 2010/-8/09 MH For power down module, we need to enable register block contrl reg at 0x1c.
+	// Then enable power down control bit of register 0x04 BIT4 and BIT15 as 1.
+		
+	// Enable register area 0x0-0xc.
+	rtw_write8(padapter,REG_RSV_CTRL, 0x0);			
+	rtw_write16(padapter, REG_APS_FSMCO, 0x8812);
+}
+
+u32 rtl8192cu_hal_deinit(PADAPTER Adapter)
+ {
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+   	DBG_8192C("==> %s \n",__FUNCTION__);
+	// 2011/02/18 To Fix RU LNA  power leakage problem. We need to execute below below in
+	// Adapter init and halt sequence. Accordingto EEchou's opinion, we can enable the ability for all
+	// IC. Accord to johnny's opinion, only RU need the support.
+	if (IS_HARDWARE_TYPE_8192C(Adapter)  && (pHalData->BoardType == BOARD_USB_High_PA))
+		rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|BIT1);
+
+ #ifdef SUPPORT_HW_RFOFF_DETECTED
+ 	DBG_8192C("bkeepfwalive(%x)\n",Adapter->pwrctrlpriv.bkeepfwalive);
+ 	if(Adapter->pwrctrlpriv.bkeepfwalive)
+ 	{
+		_ps_close_RF(Adapter);		
+		if((Adapter->pwrctrlpriv.bHWPwrPindetect) && (Adapter->pwrctrlpriv.bHWPowerdown))		
+			rtl8192cu_hw_power_down(Adapter);
+ 	}
+	else
+#endif
+	{
+		if( Adapter->bCardDisableWOHSM == _FALSE)
+		{
+			DBG_8192C("card disble HWSM...........\n");
+			CardDisableHWSM(Adapter, _FALSE);
+		}
+		else
+		{
+			DBG_8192C("card disble without HWSM...........\n");
+			CardDisableWithoutHWSM(Adapter); // without HW Auto state machine		
+
+			if((Adapter->pwrctrlpriv.bHWPwrPindetect ) && (Adapter->pwrctrlpriv.bHWPowerdown))		
+				rtl8192cu_hw_power_down(Adapter);
+		}
+	}
+	
+	return _SUCCESS;
+ }
+
+
+unsigned int rtl8192cu_inirp_init(PADAPTER Adapter)
+{	
+	u8 i;	
+	struct recv_buf *precvbuf;
+	uint	status;
+	struct dvobj_priv *pdev = adapter_to_dvobj(Adapter);
+	struct intf_hdl * pintfhdl=&Adapter->iopriv.intf;
+	struct recv_priv *precvpriv = &(Adapter->recvpriv);
+	u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	u32 (*_read_interrupt)(struct intf_hdl *pintfhdl, u32 addr);
+#endif
+
+_func_enter_;
+
+	_read_port = pintfhdl->io_ops._read_port;
+
+	status = _SUCCESS;
+
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("===> usb_inirp_init \n"));	
+		
+	precvpriv->ff_hwaddr = RECV_BULK_IN_ADDR;
+
+	//issue Rx irp to receive data	
+	precvbuf = (struct recv_buf *)precvpriv->precv_buf;	
+	for(i=0; i<NR_RECVBUFF; i++)
+	{
+		if(_read_port(pintfhdl, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf) == _FALSE )
+		{
+			RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_port error \n"));
+			status = _FAIL;
+			goto exit;
+		}
+		
+		precvbuf++;		
+		precvpriv->free_recv_buf_queue_cnt--;
+	}
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	_read_interrupt = pintfhdl->io_ops._read_interrupt;
+	if(_read_interrupt(pintfhdl, RECV_INT_IN_ADDR) == _FALSE )
+	{
+		RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_interrupt error \n"));
+		status = _FAIL;
+	}
+#endif
+
+exit:
+	
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("<=== usb_inirp_init \n"));
+
+_func_exit_;
+
+	return status;
+
+}
+
+unsigned int rtl8192cu_inirp_deinit(PADAPTER Adapter)
+{	
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n ===> usb_rx_deinit \n"));
+	
+	rtw_read_port_cancel(Adapter);
+
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n <=== usb_rx_deinit \n"));
+
+	return _SUCCESS;
+}
+
+
+//-------------------------------------------------------------------------
+//
+//	EEPROM Power index mapping
+//
+//-------------------------------------------------------------------------
+
+ static VOID
+_ReadPowerValueFromPROM(
+	IN	PTxPowerInfo	pwrInfo,
+	IN	u8*			PROMContent,
+	IN	BOOLEAN			AutoLoadFail
+	)
+{
+	u32 rfPath, eeAddr, group;
+
+	_rtw_memset(pwrInfo, 0, sizeof(TxPowerInfo));
+
+	if(AutoLoadFail){		
+		for(group = 0 ; group < CHANNEL_GROUP_MAX ; group++){
+			for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+				pwrInfo->CCKIndex[rfPath][group]		= EEPROM_Default_TxPowerLevel;	
+				pwrInfo->HT40_1SIndex[rfPath][group]	= EEPROM_Default_TxPowerLevel;
+				pwrInfo->HT40_2SIndexDiff[rfPath][group]= EEPROM_Default_HT40_2SDiff;
+				pwrInfo->HT20IndexDiff[rfPath][group]	= EEPROM_Default_HT20_Diff;
+				pwrInfo->OFDMIndexDiff[rfPath][group]	= EEPROM_Default_LegacyHTTxPowerDiff;
+				pwrInfo->HT40MaxOffset[rfPath][group]	= EEPROM_Default_HT40_PwrMaxOffset;		
+				pwrInfo->HT20MaxOffset[rfPath][group]	= EEPROM_Default_HT20_PwrMaxOffset;
+			}
+		}
+
+		pwrInfo->TSSI_A = EEPROM_Default_TSSI;
+		pwrInfo->TSSI_B = EEPROM_Default_TSSI;
+		
+		return;
+	}
+	
+	for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+		for(group = 0 ; group < CHANNEL_GROUP_MAX ; group++){
+			eeAddr = EEPROM_CCK_TX_PWR_INX + (rfPath * 3) + group;
+			pwrInfo->CCKIndex[rfPath][group] = PROMContent[eeAddr];
+
+			eeAddr = EEPROM_HT40_1S_TX_PWR_INX + (rfPath * 3) + group;
+			pwrInfo->HT40_1SIndex[rfPath][group] = PROMContent[eeAddr];
+		}
+	}
+
+	for(group = 0 ; group < CHANNEL_GROUP_MAX ; group++){
+		for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+			pwrInfo->HT40_2SIndexDiff[rfPath][group] = 
+			(PROMContent[EEPROM_HT40_2S_TX_PWR_INX_DIFF + group] >> (rfPath * 4)) & 0xF;
+
+#if 1
+			pwrInfo->HT20IndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_HT20_TX_PWR_INX_DIFF + group] >> (rfPath * 4)) & 0xF;
+			if(pwrInfo->HT20IndexDiff[rfPath][group] & BIT3)	//4bit sign number to 8 bit sign number
+				pwrInfo->HT20IndexDiff[rfPath][group] |= 0xF0;
+#else
+			pwrInfo->HT20IndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_HT20_TX_PWR_INX_DIFF + group] >> (rfPath * 4)) & 0xF;
+#endif
+
+			pwrInfo->OFDMIndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_OFDM_TX_PWR_INX_DIFF+ group] >> (rfPath * 4)) & 0xF;
+
+			pwrInfo->HT40MaxOffset[rfPath][group] =
+			(PROMContent[EEPROM_HT40_MAX_PWR_OFFSET+ group] >> (rfPath * 4)) & 0xF;
+
+			pwrInfo->HT20MaxOffset[rfPath][group] =
+			(PROMContent[EEPROM_HT20_MAX_PWR_OFFSET+ group] >> (rfPath * 4)) & 0xF;
+		}
+	}
+
+	pwrInfo->TSSI_A = PROMContent[EEPROM_TSSI_A];
+	pwrInfo->TSSI_B = PROMContent[EEPROM_TSSI_B];
+
+}
+
+
+static u32
+_GetChannelGroup(
+	IN	u32	channel
+	)
+{
+	//RT_ASSERT((channel < 14), ("Channel %d no is supported!\n"));
+
+	if(channel < 3){ 	// Channel 1~3
+		return 0;
+	}
+	else if(channel < 9){ // Channel 4~9
+		return 1;
+	}
+
+	return 2;				// Channel 10~14	
+}
+
+
+static VOID
+ReadTxPowerInfo(
+	IN	PADAPTER 		Adapter,
+	IN	u8*			PROMContent,
+	IN	BOOLEAN			AutoLoadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	TxPowerInfo		pwrInfo;
+	u32			rfPath, ch, group;
+	u8			pwr, diff;
+
+	_ReadPowerValueFromPROM(&pwrInfo, PROMContent, AutoLoadFail);
+
+	if(!AutoLoadFail)
+		pHalData->bTXPowerDataReadFromEEPORM = _TRUE;
+
+	for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+		for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+			group = _GetChannelGroup(ch);
+
+			pHalData->TxPwrLevelCck[rfPath][ch]		= pwrInfo.CCKIndex[rfPath][group];
+			pHalData->TxPwrLevelHT40_1S[rfPath][ch]	= pwrInfo.HT40_1SIndex[rfPath][group];
+
+			pHalData->TxPwrHt20Diff[rfPath][ch]		= pwrInfo.HT20IndexDiff[rfPath][group];
+			pHalData->TxPwrLegacyHtDiff[rfPath][ch]	= pwrInfo.OFDMIndexDiff[rfPath][group];
+			pHalData->PwrGroupHT20[rfPath][ch]		= pwrInfo.HT20MaxOffset[rfPath][group];
+			pHalData->PwrGroupHT40[rfPath][ch]		= pwrInfo.HT40MaxOffset[rfPath][group];
+
+			pwr		= pwrInfo.HT40_1SIndex[rfPath][group];
+			diff	= pwrInfo.HT40_2SIndexDiff[rfPath][group];
+
+			pHalData->TxPwrLevelHT40_2S[rfPath][ch]  = (pwr > diff) ? (pwr - diff) : 0;
+		}
+	}
+
+#if DBG
+
+	for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+		for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+			RTPRINT(FINIT, INIT_TxPower, 
+				("RF(%d)-Ch(%d) [CCK / HT40_1S / HT40_2S] = [0x%x / 0x%x / 0x%x]\n", 
+				rfPath, ch, pHalData->TxPwrLevelCck[rfPath][ch], 
+				pHalData->TxPwrLevelHT40_1S[rfPath][ch], 
+				pHalData->TxPwrLevelHT40_2S[rfPath][ch]));
+
+		}
+	}
+
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-A Ht20 to HT40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrHt20Diff[RF_PATH_A][ch]));
+	}
+
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-A Legacy to Ht40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrLegacyHtDiff[RF_PATH_A][ch]));
+	}
+	
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-B Ht20 to HT40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrHt20Diff[RF_PATH_B][ch]));
+	}
+	
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-B Legacy to HT40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrLegacyHtDiff[RF_PATH_B][ch]));
+	}
+	
+#endif
+	// 2010/10/19 MH Add Regulator recognize for CU.
+	if(!AutoLoadFail)
+	{
+		pHalData->EEPROMRegulatory = (PROMContent[RF_OPTION1]&0x7);	//bit0~2
+	}
+	else
+	{
+		pHalData->EEPROMRegulatory = 0;
+	}
+	DBG_8192C("EEPROMRegulatory = 0x%x\n", pHalData->EEPROMRegulatory);
+
+}
+
+
+//-------------------------------------------------------------------
+//
+//	EEPROM/EFUSE Content Parsing
+//
+//-------------------------------------------------------------------
+static void
+_ReadIDs(
+	IN	PADAPTER	Adapter,
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(_FALSE == AutoloadFail){
+		// VID, PID 
+		pHalData->EEPROMVID = le16_to_cpu( *(u16 *)&PROMContent[EEPROM_VID]);
+		pHalData->EEPROMPID = le16_to_cpu( *(u16 *)&PROMContent[EEPROM_PID]);
+		
+		// Customer ID, 0x00 and 0xff are reserved for Realtek. 		
+		pHalData->EEPROMCustomerID = *(u8 *)&PROMContent[EEPROM_CUSTOMER_ID];
+		pHalData->EEPROMSubCustomerID = *(u8 *)&PROMContent[EEPROM_SUBCUSTOMER_ID];
+
+	}
+	else{
+		pHalData->EEPROMVID	 = EEPROM_Default_VID;
+		pHalData->EEPROMPID	 = EEPROM_Default_PID;
+
+		// Customer ID, 0x00 and 0xff are reserved for Realtek. 		
+		pHalData->EEPROMCustomerID	= EEPROM_Default_CustomerID;
+		pHalData->EEPROMSubCustomerID = EEPROM_Default_SubCustomerID;
+
+	}
+
+	// For customized behavior.
+	if((pHalData->EEPROMVID == 0x103C) && (pHalData->EEPROMVID == 0x1629))// HP Lite-On for RTL8188CUS Slim Combo.
+		pHalData->CustomerID = RT_CID_819x_HP;
+
+	//	Decide CustomerID according to VID/DID or EEPROM
+	switch(pHalData->EEPROMCustomerID)
+	{
+		case EEPROM_CID_DEFAULT:
+			if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3308))
+				pHalData->CustomerID = RT_CID_DLINK;
+			else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3309))
+				pHalData->CustomerID = RT_CID_DLINK;
+			else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x330a))
+				pHalData->CustomerID = RT_CID_DLINK;
+			break;
+		case EEPROM_CID_WHQL:
+/*			
+			Adapter->bInHctTest = TRUE;
+
+			pMgntInfo->bSupportTurboMode = FALSE;
+			pMgntInfo->bAutoTurboBy8186 = FALSE;
+
+			pMgntInfo->PowerSaveControl.bInactivePs = FALSE;
+			pMgntInfo->PowerSaveControl.bIPSModeBackup = FALSE;
+			pMgntInfo->PowerSaveControl.bLeisurePs = FALSE;
+				
+			pMgntInfo->keepAliveLevel = 0;
+
+			Adapter->bUnloadDriverwhenS3S4 = FALSE;
+*/				
+			break;
+		default:
+			pHalData->CustomerID = RT_CID_DEFAULT;
+			break;
+			
+	}
+
+	MSG_8192C("EEPROMVID = 0x%04x\n", pHalData->EEPROMVID);
+	MSG_8192C("EEPROMPID = 0x%04x\n", pHalData->EEPROMPID);
+	MSG_8192C("EEPROMCustomerID : 0x%02x\n", pHalData->EEPROMCustomerID);
+	MSG_8192C("EEPROMSubCustomerID: 0x%02x\n", pHalData->EEPROMSubCustomerID);
+
+	MSG_8192C("RT_CustomerID: 0x%02x\n", pHalData->CustomerID);
+
+}
+
+
+static VOID
+_ReadMACAddress(
+	IN	PADAPTER	Adapter,	
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+
+	if(_FALSE == AutoloadFail){
+		//Read Permanent MAC address and set value to hardware
+		_rtw_memcpy(pEEPROM->mac_addr, &PROMContent[EEPROM_MAC_ADDR], ETH_ALEN);		
+	}
+	else{
+		//Random assigh MAC address
+		u8 sMacAddr[MAC_ADDR_LEN] = {0x00, 0xE0, 0x4C, 0x81, 0x92, 0x00};
+		//sMacAddr[5] = (u8)GetRandomNumber(1, 254);		
+		_rtw_memcpy(pEEPROM->mac_addr, sMacAddr, ETH_ALEN);	
+	}
+	DBG_8192C("%s MAC Address from EFUSE = "MAC_FMT"\n",__FUNCTION__, MAC_ARG(pEEPROM->mac_addr));
+	//NicIFSetMacAddress(Adapter, Adapter->PermanentAddress);
+	//RT_PRINT_ADDR(COMP_INIT|COMP_EFUSE, DBG_LOUD, "MAC Addr: %s", Adapter->PermanentAddress);
+
+}
+
+static VOID
+_ReadBoardType(
+	IN	PADAPTER	Adapter,	
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u32			value32;
+	u8			boardType = BOARD_USB_DONGLE;
+
+	if(AutoloadFail){
+		if(IS_8723_SERIES(pHalData->VersionID))
+			pHalData->rf_type = RF_1T1R;
+		else
+		        pHalData->rf_type = RF_2T2R;
+
+		pHalData->BluetoothCoexist = _FALSE;
+		pHalData->BoardType = boardType;
+		return;
+	}
+
+	boardType = PROMContent[EEPROM_NORMAL_BoardType];
+	boardType &= BOARD_TYPE_NORMAL_MASK;//bit[7:5]
+	boardType >>= 5;
+
+	pHalData->BoardType = boardType;
+	MSG_8192C("_ReadBoardType(%x)\n",pHalData->BoardType);
+
+	if (boardType == BOARD_USB_High_PA)
+		pHalData->ExternalPA = 1;
+}
+
+
+static VOID
+_ReadLEDSetting(
+	IN	PADAPTER	Adapter,	
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	struct led_priv *pledpriv = &(Adapter->ledpriv);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+#ifdef CONFIG_SW_LED
+	pledpriv->bRegUseLed = _TRUE;
+
+	//
+	// Led mode
+	//
+	switch(pHalData->CustomerID)
+	{
+		case RT_CID_DEFAULT:
+			pledpriv->LedStrategy = SW_LED_MODE1;
+			pledpriv->bRegUseLed = _TRUE;
+			break;
+
+		case RT_CID_819x_HP:
+			pledpriv->LedStrategy = SW_LED_MODE6;
+			break;
+
+		default:
+			pledpriv->LedStrategy = SW_LED_MODE1;
+			break;
+	}
+
+	if( BOARD_MINICARD == pHalData->BoardType )
+	{
+		pledpriv->LedStrategy = SW_LED_MODE6;
+	}
+	pHalData->bLedOpenDrain = _TRUE;// Support Open-drain arrangement for controlling the LED. Added by Roger, 2009.10.16.
+#else // HW LED
+	pledpriv->LedStrategy = HW_LED;
+#endif //CONFIG_SW_LED
+}
+
+static VOID
+_ReadThermalMeter(
+	IN	PADAPTER	Adapter,	
+	IN	u8* 	PROMContent,
+	IN	BOOLEAN 	AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	tempval;
+
+	//
+	// ThermalMeter from EEPROM
+	//
+	if(!AutoloadFail)	
+		tempval = PROMContent[EEPROM_THERMAL_METER];
+	else
+		tempval = EEPROM_Default_ThermalMeter;
+	
+	pHalData->EEPROMThermalMeter = (tempval&0x1f);	//[4:0]
+
+	if(pHalData->EEPROMThermalMeter == 0x1f || AutoloadFail)
+		pdmpriv->bAPKThermalMeterIgnore = _TRUE;
+
+#if 0
+	if(pHalData->EEPROMThermalMeter < 0x06 || pHalData->EEPROMThermalMeter > 0x1c)
+		pHalData->EEPROMThermalMeter = 0x12;
+#endif
+
+	pdmpriv->ThermalMeter[0] = pHalData->EEPROMThermalMeter;
+	
+	//RTPRINT(FINIT, INIT_TxPower, ("ThermalMeter = 0x%x\n", pHalData->EEPROMThermalMeter));
+	
+}
+
+static VOID
+_ReadRFSetting(
+	IN	PADAPTER	Adapter,	
+	IN	u8* 	PROMContent,
+	IN	BOOLEAN 	AutoloadFail
+	)
+{
+}
+
+static void
+_ReadPROMVersion(
+	IN	PADAPTER	Adapter,	
+	IN	u8* 	PROMContent,
+	IN	BOOLEAN 	AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(AutoloadFail){
+		pHalData->EEPROMVersion = EEPROM_Default_Version;		
+	}
+	else{
+		pHalData->EEPROMVersion = *(u8 *)&PROMContent[EEPROM_VERSION];
+	}
+}
+
+static VOID
+readAntennaDiversity(
+	IN	PADAPTER	pAdapter,
+	IN	u8			*hwinfo,
+	IN	BOOLEAN		AutoLoadFail
+	)
+{
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct registry_priv	*registry_par = &pAdapter->registrypriv;
+
+	if(!AutoLoadFail)
+	{
+		// Antenna Diversity setting. 
+		if(registry_par->antdiv_cfg == 2) // 2: From Efuse
+			pHalData->AntDivCfg = (hwinfo[EEPROM_RF_OPT1]&0x18)>>3;
+		else
+			pHalData->AntDivCfg = registry_par->antdiv_cfg ;  // 0:OFF , 1:ON,
+
+		DBG_8192C("### AntDivCfg(%x)\n",pHalData->AntDivCfg);	
+
+		//if(pHalData->EEPROMBluetoothCoexist!=0 && pHalData->EEPROMBluetoothAntNum==Ant_x1)
+		//	pHalData->AntDivCfg = 0;
+	}
+	else
+	{
+		pHalData->AntDivCfg = 0;
+	}
+
+}
+
+static VOID
+hal_InitPGData(
+	IN	PADAPTER	pAdapter,
+	IN	OUT	u8		*PROMContent
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	u32	i;
+	u16	value16;
+
+	if(_FALSE == pEEPROM->bautoload_fail_flag)
+	{ // autoload OK.
+		if (_TRUE == pEEPROM->EepromOrEfuse)
+		{
+			// Read all Content from EEPROM or EFUSE.
+			for(i = 0; i < HWSET_MAX_SIZE; i += 2)
+			{
+				//value16 = EF2Byte(ReadEEprom(pAdapter, (u2Byte) (i>>1)));
+				//*((u16 *)(&PROMContent[i])) = value16; 				
+			}
+		}
+		else
+		{
+			// Read EFUSE real map to shadow.
+			EFUSE_ShadowMapUpdate(pAdapter, EFUSE_WIFI, _FALSE);
+			_rtw_memcpy((void*)PROMContent, (void*)pEEPROM->efuse_eeprom_data, HWSET_MAX_SIZE);
+		}
+	}
+	else
+	{//autoload fail
+		//RT_TRACE(COMP_INIT, DBG_LOUD, ("AutoLoad Fail reported from CR9346!!\n")); 
+		pEEPROM->bautoload_fail_flag = _TRUE;
+		//update to default value 0xFF
+		if (_FALSE == pEEPROM->EepromOrEfuse)		
+		EFUSE_ShadowMapUpdate(pAdapter, EFUSE_WIFI, _FALSE);	
+	}
+}
+// Read HW power down mode selection 
+static void _ReadPSSetting(IN PADAPTER Adapter,IN u8*PROMContent,IN u8	AutoloadFail)
+{
+	if(AutoloadFail){
+		Adapter->pwrctrlpriv.bHWPowerdown = _FALSE;
+		Adapter->pwrctrlpriv.bSupportRemoteWakeup = _FALSE;
+	}
+	else	{
+		//if(SUPPORT_HW_RADIO_DETECT(Adapter))
+			Adapter->pwrctrlpriv.bHWPwrPindetect = Adapter->registrypriv.hwpwrp_detect;
+		//else
+			//Adapter->pwrctrlpriv.bHWPwrPindetect = _FALSE;//dongle not support new
+			
+			
+		//hw power down mode selection , 0:rf-off / 1:power down
+
+		if(Adapter->registrypriv.hwpdn_mode==2)
+			Adapter->pwrctrlpriv.bHWPowerdown = (PROMContent[EEPROM_RF_OPT3] & BIT4);
+		else
+			Adapter->pwrctrlpriv.bHWPowerdown = Adapter->registrypriv.hwpdn_mode;
+#ifdef CONFIG_WOWLAN			
+		// decide hw if support remote wakeup function
+		// if hw supported, 8051 (SIE) will generate WeakUP signal( D+/D- toggle) when autoresume
+		Adapter->pwrctrlpriv.bSupportRemoteWakeup = (PROMContent[EEPROM_TEST_USB_OPT] & BIT1)?_TRUE :_FALSE;
+#endif //CONFIG_WOWLAN
+
+		//if(SUPPORT_HW_RADIO_DETECT(Adapter))	
+			//Adapter->registrypriv.usbss_enable = Adapter->pwrctrlpriv.bSupportRemoteWakeup ;
+		
+		DBG_8192C("%s...bHWPwrPindetect(%x)-bHWPowerdown(%x) ,bSupportRemoteWakeup(%x)\n",__FUNCTION__,
+		Adapter->pwrctrlpriv.bHWPwrPindetect,Adapter->pwrctrlpriv.bHWPowerdown ,Adapter->pwrctrlpriv.bSupportRemoteWakeup);
+
+		DBG_8192C("### PS params=>  power_mgnt(%x),usbss_enable(%x) ###\n",Adapter->registrypriv.power_mgnt,Adapter->registrypriv.usbss_enable);
+		
+	}
+	
+}
+
+static VOID
+readAdapterInfo_8192CU(
+	IN	PADAPTER	Adapter
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+	PHAL_DATA_TYPE pHalData = GET_HAL_DATA(Adapter);
+	u8	PROMContent[HWSET_MAX_SIZE]={0};
+
+	hal_InitPGData(Adapter, PROMContent);
+	rtl8192c_EfuseParseIDCode(Adapter, PROMContent);
+	
+	_ReadPROMVersion(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadIDs(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadMACAddress(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);	
+	ReadTxPowerInfo(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadBoardType(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+
+#ifdef CONFIG_BT_COEXIST
+	//
+	// Read Bluetooth co-exist and initialize
+	//
+	rtl8192c_ReadBluetoothCoexistInfo(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+#endif
+	
+	rtl8192c_EfuseParseChnlPlan(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadThermalMeter(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadLEDSetting(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);	
+	_ReadRFSetting(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadPSSetting(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	readAntennaDiversity(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+
+	//hal_CustomizedBehavior_8723U(Adapter);
+
+	Adapter->bDongle = (PROMContent[EEPROM_EASY_REPLACEMENT] == 1)? 0: 1;
+	DBG_8192C("%s(): REPLACEMENT = %x\n",__FUNCTION__,Adapter->bDongle);
+#ifdef CONFIG_INTEL_PROXIM	
+		/* for intel proximity */
+	if (pHalData->rf_type== RF_1T1R) {
+		Adapter->proximity.proxim_support = _TRUE;
+	} else if (pHalData->rf_type== RF_2T2R) {
+		if ((pHalData->EEPROMPID == 0x8186) &&
+			(pHalData->EEPROMVID== 0x0bda))
+		Adapter->proximity.proxim_support = _TRUE;
+	} else {
+		Adapter->proximity.proxim_support = _FALSE;
+	}
+#endif //CONFIG_INTEL_PROXIM		
+}
+
+static void _ReadPROMContent(
+	IN PADAPTER 		Adapter
+	)
+{	
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			PROMContent[HWSET_MAX_SIZE]={0};
+	u8			eeValue;
+	u32			i;
+	u16			value16;
+
+	eeValue = rtw_read8(Adapter, REG_9346CR);
+	// To check system boot selection.
+	pEEPROM->EepromOrEfuse		= (eeValue & BOOT_FROM_EEPROM) ? _TRUE : _FALSE;
+	pEEPROM->bautoload_fail_flag	= (eeValue & EEPROM_EN) ? _FALSE : _TRUE;
+
+
+	DBG_8192C("Boot from %s, Autoload %s !\n", (pEEPROM->EepromOrEfuse ? "EEPROM" : "EFUSE"),
+				(pEEPROM->bautoload_fail_flag ? "Fail" : "OK") );
+
+	//pHalData->EEType = IS_BOOT_FROM_EEPROM(Adapter) ? EEPROM_93C46 : EEPROM_BOOT_EFUSE;
+
+	//if(IS_HARDWARE_TYPE_8723A(Adapter))
+	//	readAdapterInfo_8723U(Adapter);
+	//else
+		readAdapterInfo_8192CU(Adapter);
+}
+
+
+static VOID
+_InitOtherVariable(
+	IN PADAPTER 		Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);	
+
+
+	//if(Adapter->bInHctTest){
+	//	pMgntInfo->PowerSaveControl.bInactivePs = FALSE;
+	//	pMgntInfo->PowerSaveControl.bIPSModeBackup = FALSE;
+	//	pMgntInfo->PowerSaveControl.bLeisurePs = FALSE;
+	//	pMgntInfo->keepAliveLevel = 0;
+	//}
+
+	// 2009/06/10 MH For 92S 1*1=1R/ 1*2&2*2 use 2R. We default set 1*1 use radio A
+	// So if you want to use radio B. Please modify RF path enable bit for correct signal
+	// strength calculate.
+	if (pHalData->rf_type == RF_1T1R){
+		pHalData->bRFPathRxEnable[0] = _TRUE;
+	}
+	else{
+		pHalData->bRFPathRxEnable[0] = pHalData->bRFPathRxEnable[1] = _TRUE;
+	}
+
+}
+
+static VOID
+_ReadRFType(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+#if DISABLE_BB_RF
+	pHalData->rf_chip = RF_PSEUDO_11N;
+#else
+	pHalData->rf_chip = RF_6052;
+#endif
+}
+
+void _ReadSilmComboMode(PADAPTER Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	pHalData->SlimComboDbg = _FALSE;	// Default is not debug mode.
+
+	// 2010/11/22 MH We need to enter debug mode for TSMA and UMC A cut
+	if ((Adapter->chip_type == RTL8188C_8192C) && 
+		(pHalData->BoardType == BOARD_USB_COMBO))
+	{			
+		switch (pHalData->VersionID)
+		{
+			case	VERSION_NORMAL_TSMC_CHIP_88C:
+			case	VERSION_NORMAL_TSMC_CHIP_92C:
+			case	VERSION_NORMAL_TSMC_CHIP_92C_1T2R:
+			case	VERSION_NORMAL_UMC_CHIP_88C_A_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_A_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT:
+				if ((rtw_read8(Adapter, REG_SYS_CFG+3) &0xF0) == 0x20)
+					pHalData->SlimComboDbg = _TRUE;
+				
+				break;
+
+			case	VERSION_NORMAL_UMC_CHIP_88C_B_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_B_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT:
+				// 2011/02/15 MH UNC-B cut ECO fail, we need to support slim combo debug mode.
+				if ((rtw_read8(Adapter, REG_SYS_CFG+3) &0xF0) == 0x20)
+					pHalData->SlimComboDbg = _TRUE;
+				break;
+				
+			default:
+				break;
+		}		
+		
+	}
+	
+}
+static int _ReadAdapterInfo8192CU(PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32 start=rtw_get_current_time();
+	
+	MSG_8192C("====> ReadAdapterInfo8192C\n");
+
+	//Efuse_InitSomeVar(Adapter);
+
+	//if(IS_HARDWARE_TYPE_8723A(Adapter))
+	//	_EfuseCellSel(Adapter);
+
+	_ReadRFType(Adapter);//rf_chip -> _InitRFType()
+	_ReadPROMContent(Adapter);
+
+	// 2010/10/25 MH THe function must be called after borad_type & IC-Version recognize.
+	_ReadSilmComboMode(Adapter);
+
+	_InitOtherVariable(Adapter);
+
+	//MSG_8192C("%s()(done), rf_chip=0x%x, rf_type=0x%x\n",  __FUNCTION__, pHalData->rf_chip, pHalData->rf_type);
+
+	MSG_8192C("<==== ReadAdapterInfo8192C in %d ms\n", rtw_get_passing_time_ms(start));
+
+	return _SUCCESS;
+}
+
+
+static void ReadAdapterInfo8192CU(PADAPTER Adapter)
+{
+	// Read EEPROM size before call any EEPROM function
+	//Adapter->EepromAddressSize=Adapter->HalFunc.GetEEPROMSizeHandler(Adapter);
+	Adapter->EepromAddressSize = GetEEPROMSize8192C(Adapter);
+	
+	_ReadAdapterInfo8192CU(Adapter);
+}
+
+
+#define GPIO_DEBUG_PORT_NUM 0
+static void rtl8192cu_trigger_gpio_0(_adapter *padapter)
+{
+
+	u32 gpioctrl;
+	DBG_8192C("==> trigger_gpio_0...\n");
+	rtw_write16_async(padapter,REG_GPIO_PIN_CTRL,0);
+	rtw_write8_async(padapter,REG_GPIO_PIN_CTRL+2,0xFF);
+	gpioctrl = (BIT(GPIO_DEBUG_PORT_NUM)<<24 )|(BIT(GPIO_DEBUG_PORT_NUM)<<16);
+	rtw_write32_async(padapter,REG_GPIO_PIN_CTRL,gpioctrl);
+	gpioctrl |= (BIT(GPIO_DEBUG_PORT_NUM)<<8);
+	rtw_write32_async(padapter,REG_GPIO_PIN_CTRL,gpioctrl);
+	DBG_8192C("<=== trigger_gpio_0...\n");
+
+}
+
+static void ResumeTxBeacon(_adapter *padapter)
+{
+	HAL_DATA_TYPE*	pHalData = GET_HAL_DATA(padapter);	
+
+	// 2010.03.01. Marked by tynli. No need to call workitem beacause we record the value
+	// which should be read from register to a global variable.
+
+	rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) | BIT6);
+	pHalData->RegFwHwTxQCtrl |= BIT6;	 
+}
+
+static void StopTxBeacon(_adapter *padapter)
+{
+	HAL_DATA_TYPE*	pHalData = GET_HAL_DATA(padapter);
+
+	// 2010.03.01. Marked by tynli. No need to call workitem beacause we record the value
+	// which should be read from register to a global variable.
+
+	rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) & (~BIT6));
+	pHalData->RegFwHwTxQCtrl &= (~BIT6);
+
+	 //todo: CheckFwRsvdPageContent(Adapter);  // 2010.06.23. Added by tynli.
+
+}
+
+u16 CRC16(u8 data,u16 CRC)
+{
+	unsigned char shift_in,CRC_BIT15,DataBit,CRC_BIT11,CRC_BIT4 ;
+	int index;
+	unsigned short CRC_Result;
+
+	for(index=0;index<8;index++)
+	{
+		CRC_BIT15=((CRC&BIT15) ? 1:0);
+		DataBit  =(data&(BIT0<<index) ? 1:0);
+		shift_in=CRC_BIT15^DataBit;
+		//printf("CRC_BIT15=%d, DataBit=%d, shift_in=%d \n",CRC_BIT15,DataBit,shift_in);
+		
+		CRC_Result=CRC<<1;
+		//set BIT0 
+		//	printf("CRC =%x\n",CRC_Result);
+		//CRC bit 0 =shift_in,
+		if(shift_in==0)
+		{
+			CRC_Result&=(~BIT0); 
+		}
+		else
+		{
+			CRC_Result|=BIT0;
+		}
+		//printf("CRC =%x\n",CRC_Result);
+
+		CRC_BIT11 = ((CRC&BIT11) ? 1:0)^shift_in;
+		if(CRC_BIT11==0)
+		{
+			CRC_Result&=(~BIT12); 
+		}
+		else
+		{
+			CRC_Result|=BIT12;
+		}
+		//printf("bit12 CRC =%x\n",CRC_Result);
+
+		CRC_BIT4 = ((CRC&BIT4) ? 1:0)^shift_in;
+		if(CRC_BIT4==0)
+		{
+			CRC_Result&=(~BIT5); 
+		}
+		else
+		{
+			CRC_Result|=BIT5;
+		}
+		//printf("bit5 CRC =%x\n",CRC_Result);
+
+		CRC=CRC_Result; //���ƨϥΤW�@�������G
+	}
+
+	return CRC;
+	
+}
+
+
+/////////////////////////////////////////////////
+//
+//function name :calc_crc
+//
+//input         : char* pattern , pattern size
+//
+//////////////////////////////////////////////////
+u16 calc_crc(u8 * pdata,int length)
+{
+//    unsigned char data[2]={0xC6,0xAA};
+	u16 CRC=0xffff;
+	int i;
+	
+	for(i=0;i<length;i++)
+	{
+		CRC=CRC16(pdata[i],CRC);
+	}
+
+	CRC=~CRC;                  //���ɼ�
+	printk("CRC =%x\n",CRC);
+	return CRC;
+}
+
+static void hw_var_set_opmode(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u8	val8;
+	u8	mode = *((u8 *)val);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		// disable Port1 TSF update
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(4));
+		
+		// set net_type
+		val8 = rtw_read8(Adapter, MSR)&0x03;
+		val8 |= (mode<<2);
+		rtw_write8(Adapter, MSR, val8);
+		
+		//reset TSF1	
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1));
+		
+		DBG_871X("%s()-%d mode = %d\n", __FUNCTION__, __LINE__, mode);
+	
+		if((mode == _HW_STATE_STATION_) || (mode == _HW_STATE_NOLINK_))
+		{
+			if(!check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))			
+			{
+				StopTxBeacon(Adapter);
+			}
+			
+			rtw_write8(Adapter,REG_BCN_CTRL_1, 0x19);//disable atim wnd
+			//rtw_write8(Adapter,REG_BCN_CTRL_1, 0x18);
+		}
+		else if((mode == _HW_STATE_ADHOC_) /*|| (mode == _HW_STATE_AP_)*/)
+		{
+			ResumeTxBeacon(Adapter);
+			rtw_write8(Adapter,REG_BCN_CTRL_1, 0x1a);
+		}
+		else if(mode == _HW_STATE_AP_)
+		{
+			ResumeTxBeacon(Adapter);
+					
+			rtw_write8(Adapter, REG_BCN_CTRL_1, 0x12);
+					
+			//Set RCR
+			//rtw_write32(padapter, REG_RCR, 0x70002a8e);//CBSSID_DATA must set to 0
+			rtw_write32(Adapter, REG_RCR, 0x7000228e);//CBSSID_DATA must set to 0
+			//enable to rx data frame				
+			rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF);
+			//enable to rx ps-poll
+			rtw_write16(Adapter, REG_RXFLTMAP1, 0x0400);
+
+			//Beacon Control related register for first time 
+			rtw_write8(Adapter, REG_BCNDMATIM, 0x02); // 2ms		
+			rtw_write8(Adapter, REG_DRVERLYINT, 0x05);// 5ms
+			//rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF);
+			rtw_write8(Adapter, REG_ATIMWND_1, 0x0a); // 10ms for port1
+			rtw_write16(Adapter, REG_BCNTCFG, 0x00);
+			rtw_write16(Adapter, REG_TBTT_PROHIBIT, 0xff04);
+			rtw_write16(Adapter, REG_TSFTR_SYN_OFFSET, 0x7fff);// +32767 (~32ms)
+	
+
+		       	//enable BCN1 Function for if2
+			//don't enable update TSF1 for if2 (due to TSF update when beacon/probe rsp are received)
+			rtw_write8(Adapter, REG_BCN_CTRL_1, (DIS_TSF_UDT0_NORMAL_CHIP|EN_BCN_FUNCTION | EN_TXBCN_RPT|BIT(1)));
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if(check_buddy_fwstate(Adapter, WIFI_FW_NULL_STATE))
+				rtw_write8(Adapter, REG_BCN_CTRL, 
+					rtw_read8(Adapter, REG_BCN_CTRL) & ~EN_BCN_FUNCTION);
+#endif
+
+			DBG_871X("%s()-%d: REG_BCN_CTRL_1 = %02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_BCN_CTRL_1));
+			
+                        //BCN1 TSF will sync to BCN0 TSF with offset(0x518) if if1_sta linked
+			//rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(5));
+			//rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(3));
+					
+			//dis BCN0 ATIM  WND if if1 is station
+			rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(0));
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+			// Reset TSF for STA+AP concurrent mode
+			if ( check_buddy_fwstate(Adapter, (WIFI_STATION_STATE|WIFI_ASOC_STATE)) ) {
+				if (reset_tsf(Adapter, IFACE_PORT1) == _FALSE)
+					DBG_871X("ERROR! %s()-%d: Reset port1 TSF fail\n",
+						__FUNCTION__, __LINE__);
+			}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+		}
+
+	}
+	else	// (Adapter->iface_type == IFACE_PORT1)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		// disable Port0 TSF update
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+		
+		// set net_type
+		val8 = rtw_read8(Adapter, MSR)&0x0c;
+		val8 |= mode;
+		rtw_write8(Adapter, MSR, val8);
+		
+		//reset TSF0	
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(0));
+
+		DBG_871X("%s()-%d mode = %d\n", __FUNCTION__, __LINE__, mode);
+		
+		if((mode == _HW_STATE_STATION_) || (mode == _HW_STATE_NOLINK_))
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if(!check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))		
+#endif //CONFIG_CONCURRENT_MODE
+			{
+				StopTxBeacon(Adapter);
+			}
+			
+			rtw_write8(Adapter,REG_BCN_CTRL, 0x19);//disable atim wnd
+			//rtw_write8(Adapter,REG_BCN_CTRL, 0x18);
+		}		
+		else if((mode == _HW_STATE_ADHOC_) /*|| (mode == _HW_STATE_AP_)*/)
+		{
+			ResumeTxBeacon(Adapter);
+			rtw_write8(Adapter,REG_BCN_CTRL, 0x1a);
+		}
+		else if(mode == _HW_STATE_AP_)
+		{
+			ResumeTxBeacon(Adapter);
+					
+			rtw_write8(Adapter, REG_BCN_CTRL, 0x12);
+					
+			//Set RCR
+			//write32(padapter, REG_RCR, 0x70002a8e);//CBSSID_DATA must set to 0
+			rtw_write32(Adapter, REG_RCR, 0x7000228e);//CBSSID_DATA must set to 0
+			//enable to rx data frame				
+			rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF);
+			//enable to rx ps-poll
+			rtw_write16(Adapter, REG_RXFLTMAP1, 0x0400);
+
+			//Beacon Control related register for first time 
+
+			rtw_write8(Adapter, REG_BCNDMATIM, 0x02); // 2ms		
+			rtw_write8(Adapter, REG_DRVERLYINT, 0x05);// 5ms
+
+			//write8(Adapter, REG_BCN_MAX_ERR, 0xFF);
+			rtw_write8(Adapter, REG_ATIMWND, 0x0a); // 10ms for port0
+			rtw_write16(Adapter, REG_BCNTCFG, 0x00);
+			rtw_write16(Adapter, REG_TBTT_PROHIBIT, 0xff04);
+			rtw_write16(Adapter, REG_TSFTR_SYN_OFFSET, 0x7fff);// +32767 (~32ms)
+	
+		        //enable BCN0 Function for if1
+			//don't enable update TSF0 for if1 (due to TSF update when beacon/probe rsp are received)
+			rtw_write8(Adapter, REG_BCN_CTRL, (DIS_TSF_UDT0_NORMAL_CHIP|EN_BCN_FUNCTION | EN_TXBCN_RPT|BIT(1)));
+					
+#ifdef CONFIG_CONCURRENT_MODE
+			if(check_buddy_fwstate(Adapter, WIFI_FW_NULL_STATE))
+				rtw_write8(Adapter, REG_BCN_CTRL_1, 
+					rtw_read8(Adapter, REG_BCN_CTRL_1) & ~EN_BCN_FUNCTION);
+#endif
+			//BCN1 TSF will sync to BCN0 TSF with offset(0x518) if if1_sta linked
+			//only interface 2 as AP MODE need to sync
+			//rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(5));
+			
+							
+			//dis BCN1 ATIM  WND if if2 is station
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(0));
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+			// Reset TSF for STA+AP concurrent mode
+			if ( check_buddy_fwstate(Adapter, (WIFI_STATION_STATE|WIFI_ASOC_STATE)) ) {
+				if (reset_tsf(Adapter, IFACE_PORT0) == _FALSE)
+					DBG_871X("ERROR! %s()-%d: Reset port0 TSF fail\n",
+						__FUNCTION__, __LINE__);
+			}
+#endif	// CONFIG_TSF_RESET_OFFLOAD			
+					
+		}
+
+
+	}
+
+}
+
+static void hw_var_set_macaddr(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u8 idx = 0;
+	u32 reg_macid;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		reg_macid = REG_MACID1;
+	}
+	else
+#endif
+	{
+		reg_macid = REG_MACID;
+	}
+
+	for(idx = 0 ; idx < 6; idx++)
+	{
+		rtw_write8(Adapter, (reg_macid+idx), val[idx]);
+	}
+	
+}
+
+static void hw_var_set_bssid(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u8	idx = 0;
+	u32 reg_bssid;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		reg_bssid = REG_BSSID1;
+	}
+	else
+#endif
+	{
+		reg_bssid = REG_BSSID;
+	}
+
+	for(idx = 0 ; idx < 6; idx++)
+	{
+		rtw_write8(Adapter, (reg_bssid+idx), val[idx]);
+	}
+
+}
+
+static void hw_var_set_bcn_func(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u32 bcn_ctrl_reg;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		bcn_ctrl_reg = REG_BCN_CTRL_1;
+
+		if(*((u8 *)val))
+		{
+			rtw_write8(Adapter, bcn_ctrl_reg, (EN_BCN_FUNCTION | EN_TXBCN_RPT));
+		}
+		else
+		{
+			rtw_write8(Adapter, bcn_ctrl_reg, rtw_read8(Adapter, bcn_ctrl_reg)&(~(EN_BCN_FUNCTION | EN_TXBCN_RPT)));
+		}
+	}	
+	else
+#endif		
+	{		
+		bcn_ctrl_reg = REG_BCN_CTRL;
+		if(*((u8 *)val))
+		{
+			rtw_write8(Adapter, bcn_ctrl_reg, (EN_BCN_FUNCTION | EN_TXBCN_RPT));
+		}
+		else
+		{
+			//rtw_write8(Adapter, bcn_ctrl_reg, rtw_read8(Adapter, bcn_ctrl_reg)&(~(EN_BCN_FUNCTION | EN_TXBCN_RPT)));
+			rtw_write8(Adapter, bcn_ctrl_reg, (rtw_read8(Adapter, bcn_ctrl_reg)&(~(EN_TXBCN_RPT))) | DIS_TSF_UDT0_NORMAL_CHIP);
+		}
+	}
+	
+
+}
+
+#ifdef CONFIG_WOWLAN
+static int rtw_wowlan_set_pattern(_adapter *padapter ,u8* pbuf){
+	struct pwrctrl_priv *pwrpriv=&padapter->pwrctrlpriv;
+	int res=0,crc_idx;
+	u32 content=0,cmd=0;
+	u32 *pdata;
+	u8 config,crc,mc,bc,uc,idx,pattern_len,packet[200],packet_len,valid;
+	u16 crc_val=0,i;
+
+	config=pbuf[0];
+	bc=config & BIT(3)?1:0;
+	mc=config & BIT(4)?1:0;
+	uc=config & BIT(5)?1:0;
+	idx=config & 0x7;
+	crc=config & BIT(6)?1:0;
+	valid=config & BIT(7)?1:0;
+	pattern_len=pbuf[1];
+	packet_len=pattern_len*8;
+	pdata=(u32 *)pbuf;
+
+	// Write to the Wakeup CAM
+	//offset 0
+	if(pattern_len>=4){
+		content=pdata[1];
+	}
+	else{	
+		content=0;
+	}
+	DBG_8192C("\nrtw_wowlan_set_pattern offset[0]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][0]= __cpu_to_le32(content);
+	//cmd=BIT(31)|BIT(16)|(idx+0);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	//offset 4
+	if(pattern_len>=8){
+		content=pdata[2];
+	}
+	else{	
+		content=0;
+	}
+	DBG_8192C("rtw_wowlan_set_pattern offset[4]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][1]= __cpu_to_le32(content);
+
+	//cmd=BIT(31)|BIT(16)|(idx+1);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	//offset 8
+	if(pattern_len>=12){
+		content=pdata[3];
+	}
+	else{	
+		content=0;
+	}
+	DBG_8192C("rtw_wowlan_set_pattern offset[8]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][2]= __cpu_to_le32(content);
+	//cmd=BIT(31)|BIT(16)|(idx+2);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	//offset 12
+	if(pattern_len>=16){
+		content=pdata[4];
+	}
+	else{	
+		content=0;
+	}
+	DBG_8192C("rtw_wowlan_set_pattern offset[12]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][3]= __cpu_to_le32(content);
+	//cmd=BIT(31)|BIT(16)|(idx+3);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+	if(crc){
+		// Have the CRC value
+		crc_val=*(u16 *)(&pbuf[2]);
+		DBG_8192C("rtw_wowlan_set_pattern crc_val  0x%x  \n", crc_val);
+		crc_val=__cpu_to_le16(crc_val);
+		DBG_8192C("rtw_wowlan_set_pattern crc_val  after 0x%x  \n", crc_val);
+	}
+	else{
+		DBG_8192C("+rtw_wowlan_set_pattern   crc=0[%x]  Should calculate the CRC\n", crc);
+		// calculate the CRC the write to the Wakeup CAM
+		crc_idx=0;
+		for(i=0;i<packet_len;i++){
+			if(pbuf[4+(i/8)]&(0x01<<(i%8)))
+			{
+				packet[crc_idx++]=pbuf[20+i];
+		//		printk("\n i=%d packet[i]=%x pbuf[20+i(%d)]=%x \n",i,packet[i],20+i,pbuf[20+i]);
+			}
+		}
+		crc_val=calc_crc(packet, crc_idx);
+		printk("+rtw_wowlan_set_pattern   crc_val=0x%.8x \n", crc_val);
+
+	}
+
+	//offset 16
+	content=(valid<<31)| (bc<<26)|(mc<<25)|(uc<<24) |crc_val;
+	printk("rtw_wowlan_set_pattern offset[16]  content  0x%x \n", content);
+	rtw_write32(padapter, REG_WKFMCAM_RWD,content);
+	pwrpriv->wowlan_pattern_context[idx][4]= content;
+	//cmd=BIT(31)|BIT(16)|(idx+4);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	pwrpriv->wowlan_pattern_idx|=BIT(idx);
+	
+_rtw_wowlan_set_pattern_exit:
+	return res;
+}
+
+
+
+void rtw_wowlan_reload_pattern(_adapter *padapter){
+	struct pwrctrl_priv *pwrpriv=&padapter->pwrctrlpriv;
+	u32 content=0,cmd=0;
+	u8 idx;
+
+	for (idx=0;idx<8;idx ++){
+		if(pwrpriv->wowlan_pattern_idx & BIT(idx)){
+			//offset 0
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][0]);
+			cmd=BIT(31)|BIT(16)|(idx+0);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 4
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][1]);
+			cmd=BIT(31)|BIT(16)|(idx+1);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 8
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][2]);
+			cmd=BIT(31)|BIT(16)|(idx+2);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 12
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][3]);
+			cmd=BIT(31)|BIT(16)|(idx+3);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 16
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][4]);
+			cmd=BIT(31)|BIT(16)|(idx+4);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+		}
+		printk("print WOWCAM  idx =%d\n",idx);
+		cmd=BIT(31)|(idx+0);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[0]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+1);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[1]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+2);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[2]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+3);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[3]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));		
+		cmd=BIT(31)|(idx+4);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[4]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+
+
+	}
+}
+#endif //CONFIG_WOWLAN
+
+static void hw_var_set_correct_tsf(PADAPTER Adapter, u8 variable, u8* val)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	u64	tsf;
+	struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//tsf = pmlmeext->TSFValue - ((u32)pmlmeext->TSFValue % (pmlmeinfo->bcn_interval*1024)) -1024; //us
+	tsf = pmlmeext->TSFValue - rtw_modular64(pmlmeext->TSFValue, (pmlmeinfo->bcn_interval*1024)) -1024; //us
+
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{				
+		//pHalData->RegTxPause |= STOP_BCNQ;BIT(6)
+		//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)|BIT(6)));
+		StopTxBeacon(Adapter);
+	}
+
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		//disable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(3)));
+							
+		rtw_write32(Adapter, REG_TSFTR1, tsf);
+		rtw_write32(Adapter, REG_TSFTR1+4, tsf>>32);
+
+		//enable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(3));
+
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+		// Update buddy port's TSF(TBTT) if it is SoftAP for beacon TX issue!
+		if ( (pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE
+			&& check_buddy_fwstate(Adapter, WIFI_AP_STATE) ) { 
+			if (reset_tsf(Adapter, IFACE_PORT0) == _FALSE)
+				DBG_871X("ERROR! %s()-%d: Reset port0 TSF fail\n",
+					__FUNCTION__, __LINE__);
+		}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+	}
+	else	// Adapter->iface_type == IFACE_PORT1
+	{
+		//disable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(3)));
+		// disable TSF update instead! May induce burst beacon TX
+		//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+							
+		rtw_write32(Adapter, REG_TSFTR, tsf);
+		rtw_write32(Adapter, REG_TSFTR+4, tsf>>32);
+
+		//enable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(3));
+		//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(4)));		
+		
+		// Update buddy port's TSF if it is SoftAP for beacon TX issue!
+		if ( (pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE
+			&& check_buddy_fwstate(Adapter, WIFI_AP_STATE)
+		) { 
+			//disable related TSF function
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(3)));
+			// disable TSF update instead!
+			//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(4));
+
+			rtw_write32(Adapter, REG_TSFTR1, tsf);
+			rtw_write32(Adapter, REG_TSFTR1+4, tsf>>32);
+
+			//enable related TSF function
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(3));
+			//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(4)));
+		}		
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+		// Update buddy port's TSF if it is SoftAP for beacon TX issue!
+		if ( (pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE
+			&& check_buddy_fwstate(Adapter, WIFI_AP_STATE) ) {
+			if (reset_tsf(Adapter, IFACE_PORT1) == _FALSE)
+				DBG_871X("ERROR! %s()-%d: Reset port1 TSF fail\n",
+					__FUNCTION__, __LINE__);
+		}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+	}
+
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//pHalData->RegTxPause  &= (~STOP_BCNQ);
+		//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)&(~BIT(6))));
+		ResumeTxBeacon(Adapter);
+	}
+#endif	// CONFIG_CONCURRENT_MODE
+}
+
+static void hw_var_set_mlme_disconnect(PADAPTER Adapter, u8 variable, u8* val)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+
+				
+	if(check_buddy_mlmeinfo_state(Adapter, _HW_STATE_NOLINK_))	
+		rtw_write16(Adapter, REG_RXFLTMAP2, 0x00);
+	
+
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		int i;
+		u8 reg_bcn_ctrl_1;
+
+	   	// a.Driver set 0x422 bit 6 =0
+		rtw_write8(Adapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) & (~BIT6));
+		pHalData->RegFwHwTxQCtrl &= (~BIT6);
+
+
+#ifdef CONFIG_BEACON_DISABLE_OFFLOAD
+		u8 reg_bcn_disable_cnt = rtw_read8(Adapter, REG_FW_BCN_DIS_CNT);
+		DBG_871X("%s()-%d: reg_bcn_disable_cnt=%02x\n", __FUNCTION__, __LINE__, reg_bcn_disable_cnt);
+	   	
+		reg_bcn_ctrl_1 = rtw_read8(Adapter, REG_BCN_CTRL_1); 
+		DBG_871X("%s()-%d: reg_bcn_ctrl_1=%02x\n", __FUNCTION__, __LINE__, reg_bcn_ctrl_1);
+
+	   	// b. driver set h2c cmd
+	   	rtl8192c_dis_beacon_fun_cmd(Adapter);	   
+	 
+		/*
+			// FW Job for port 0
+			
+		   c. 8051 set nettype to ap
+		   d. 8051 check dma_int
+		   e. 8051 set nettype to no_link
+		   f.8051 dis_tsf_update   0x550 bit 4
+		   g.8051 reset  beacon function test count   0x553 bit0.
+		   h.8051 disable beacon function   0x550  bit3
+		   i. 8051 sent ready to driver
+
+	 	*/
+	 	
+	 	// The worst case is 100 + 15 ms
+		rtw_msleep_os(120);
+		
+		for (i=0; i< 10; i++) {
+			reg_bcn_ctrl_1 = rtw_read8(Adapter, REG_BCN_CTRL_1); 
+			if ( (reg_bcn_ctrl_1 & BIT(3)) == 0 ) {
+				//DBG_871X("%s()-%d: BEACON_DISABLE_OFFLOAD finished! reg=%02x\n", __FUNCTION__, __LINE__, reg);
+				break;
+			}
+			DBG_871X("%s()-%d: BEACON_DISABLE_OFFLOAD not finished! REG_BCN_CTRL_1=%02x\n", __FUNCTION__, __LINE__, reg_bcn_ctrl_1);
+			DBG_871X("%s()-%d: reg_bcn_disable_cnt=%02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_FW_BCN_DIS_CNT));
+			DBG_871X("%s()-%d: REG_BCN_CTRL=%02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_BCN_CTRL));
+			DBG_871X("%s()-%d: FWISR=%08x\n", __FUNCTION__, __LINE__, rtw_read32(Adapter, REG_FWISR));
+			rtw_msleep_os(100);
+		}
+		DBG_871X("%s()-%d: reg_bcn_disable_cnt=%02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_FW_BCN_DIS_CNT));
+		DBG_871X("%s()-%d: reg_bcn_ctrl_1=%02x\n", __FUNCTION__, __LINE__, reg_bcn_ctrl_1);
+
+#else   // CONFIG_BEACON_DISABLE_OFFLOAD
+
+		//disable update TSF1
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(4));
+
+		//reset TSF1
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1));
+
+		// disable Port1's beacon function
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(3)));
+
+#endif  // CONFIG_BEACON_DISABLE_OFFLOAD
+	 	
+		// j, Driver set 0x422 bit 6 =1
+		rtw_write8(Adapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) | BIT6);
+		pHalData->RegFwHwTxQCtrl |= BIT6;
+
+		// k. re_download beacon pkt 
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))	
+			set_tx_beacon_cmd(pbuddy_adapter);
+		   
+
+	}
+	else	// (Adapter->iface_type == IFACE_PORT1)
+	{
+		//disable update TSF
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+
+		//reset TSF
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(0));
+
+		// Can't disable Port0's beacon function due to it is used by RA
+	}
+#endif
+}
+
+static void hw_var_set_mlme_sitesurvey(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u32	value_rcr, rcr_clear_bit, reg_bcn_ctl;
+	u16	value_rxfltmap2;
+	struct mlme_priv *pmlmepriv=&(Adapter->mlmepriv);
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+		reg_bcn_ctl = REG_BCN_CTRL_1;
+	else
+#endif
+		reg_bcn_ctl = REG_BCN_CTRL;
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+
+	if( (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+#ifdef CONFIG_CONCURRENT_MODE
+		|| (check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE)
+#endif
+#ifdef CONFIG_TDLS
+		// TDLS will clear RCR_CBSSID_DATA bit for connection.
+		|| ( Adapter->tdlsinfo.setup_state & TDLS_LINKED_STATE )
+#endif // CONFIG_TDLS
+		)
+	{
+		rcr_clear_bit = RCR_CBSSID_BCN;
+	}
+	else
+	{
+		rcr_clear_bit = (RCR_CBSSID_BCN | RCR_CBSSID_DATA);
+	}
+
+	// Recieve all data frames
+	value_rxfltmap2 = 0xFFFF;
+
+#else /* CONFIG_FIND_BEST_CHANNEL */
+
+	rcr_clear_bit = RCR_CBSSID_BCN;
+
+	//config RCR to receive different BSSID & not to receive data frame
+	value_rxfltmap2 = 0;
+
+#endif /* CONFIG_FIND_BEST_CHANNEL */
+
+	value_rcr = rtw_read32(Adapter, REG_RCR);
+
+	if(*((u8 *)val))//under sitesurvey
+	{
+		value_rcr &= ~(rcr_clear_bit);
+		rtw_write32(Adapter, REG_RCR, value_rcr);
+
+		rtw_write16(Adapter, REG_RXFLTMAP2, value_rxfltmap2);
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE |WIFI_ADHOC_MASTER_STATE)) {
+			//disable update TSF
+			rtw_write8(Adapter, reg_bcn_ctl, rtw_read8(Adapter, reg_bcn_ctl)|BIT(4));
+		}
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			StopTxBeacon(Adapter);
+		}
+#endif
+	}
+	else//sitesurvey done
+	{
+		if(check_fwstate(pmlmepriv, _FW_LINKED) || check_fwstate(pmlmepriv, WIFI_AP_STATE)
+#ifdef CONFIG_CONCURRENT_MODE
+			|| check_buddy_fwstate(Adapter, _FW_LINKED) || check_buddy_fwstate(Adapter, WIFI_AP_STATE)
+#endif
+			)
+		{
+			//enable to rx data frame
+			rtw_write16(Adapter, REG_RXFLTMAP2,0xFFFF);
+		}
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE |WIFI_ADHOC_MASTER_STATE)) {
+			//enable update TSF
+			rtw_write8(Adapter, reg_bcn_ctl, rtw_read8(Adapter, reg_bcn_ctl)&(~BIT(4)));
+		}
+
+		value_rcr |= rcr_clear_bit;
+		rtw_write32(Adapter, REG_RCR, value_rcr);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			ResumeTxBeacon(Adapter);			
+		}
+#endif
+	}
+}
+
+static void hw_var_set_mlme_join(PADAPTER Adapter, u8 variable, u8* val)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	u8	RetryLimit = 0x30;
+	u8	type = *((u8 *)val);
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+
+	if(type == 0) // prepare to join
+	{		
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))		
+		{
+			StopTxBeacon(Adapter);
+		}
+	
+		//enable to rx data frame.Accept all data frame
+		//rtw_write32(padapter, REG_RCR, rtw_read32(padapter, REG_RCR)|RCR_ADF);
+		rtw_write16(Adapter, REG_RXFLTMAP2,0xFFFF);
+
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_BCN);
+		else
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_DATA|RCR_CBSSID_BCN);
+
+		if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+		{
+			RetryLimit = (pHalData->CustomerID == RT_CID_CCX) ? 7 : 48;
+		}
+		else // Ad-hoc Mode
+		{
+			RetryLimit = 0x7;
+		}
+	}
+	else if(type == 1) //joinbss_event call back when join res < 0
+	{		
+		if(check_buddy_mlmeinfo_state(Adapter, _HW_STATE_NOLINK_))		
+			rtw_write16(Adapter, REG_RXFLTMAP2,0x00);
+
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			ResumeTxBeacon(Adapter);			
+			
+			//reset TSF 1/2 after ResumeTxBeacon
+			//rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1)|BIT(0));	
+			
+		}
+	}
+	else if(type == 2) //sta add event call back
+	{
+	 
+		//enable update TSF
+		if(Adapter->iface_type == IFACE_PORT1)
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(4)));
+		else
+			rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(4)));
+		 
+	
+		if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE))
+		{
+			//fixed beacon issue for 8191su...........
+			rtw_write8(Adapter,0x542 ,0x02);
+			RetryLimit = 0x7;
+		}
+
+
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			ResumeTxBeacon(Adapter);
+			
+			//reset TSF 1/2 after ResumeTxBeacon
+			//rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1)|BIT(0));
+		}
+		
+	}
+
+	rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+	
+#endif
+}
+
+void SetHwReg8192CU(PADAPTER Adapter, u8 variable, u8* val)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+_func_enter_;
+
+	switch(variable)
+	{
+		case HW_VAR_MEDIA_STATUS:
+			{
+				u8 val8;
+
+				val8 = rtw_read8(Adapter, MSR)&0x0c;
+				val8 |= *((u8 *)val);
+				rtw_write8(Adapter, MSR, val8);
+			}
+			break;
+		case HW_VAR_MEDIA_STATUS1:
+			{
+				u8 val8;
+				
+				val8 = rtw_read8(Adapter, MSR)&0x03;
+				val8 |= *((u8 *)val) <<2;
+				rtw_write8(Adapter, MSR, val8);
+			}
+			break;
+		case HW_VAR_SET_OPMODE:
+			hw_var_set_opmode(Adapter, variable, val);
+			break;
+		case HW_VAR_MAC_ADDR:
+			hw_var_set_macaddr(Adapter, variable, val);			
+			break;
+		case HW_VAR_BSSID:
+			hw_var_set_bssid(Adapter, variable, val);
+			break;
+		case HW_VAR_BASIC_RATE:
+			{
+				u16			BrateCfg = 0;
+				u8			RateIndex = 0;
+				
+				// 2007.01.16, by Emily
+				// Select RRSR (in Legacy-OFDM and CCK)
+				// For 8190, we select only 24M, 12M, 6M, 11M, 5.5M, 2M, and 1M from the Basic rate.
+				// We do not use other rates.
+				HalSetBrateCfg( Adapter, val, &BrateCfg );
+
+				//2011.03.30 add by Luke Lee
+				//CCK 2M ACK should be disabled for some BCM and Atheros AP IOT
+				//because CCK 2M has poor TXEVM
+				//CCK 5.5M & 11M ACK should be enabled for better performance
+
+				pHalData->BasicRateSet = BrateCfg = (BrateCfg |0xd) & 0x15d;
+
+				BrateCfg |= 0x01; // default enable 1M ACK rate
+
+				DBG_8192C("HW_VAR_BASIC_RATE: BrateCfg(%#x)\n", BrateCfg);
+				
+				// Set RRSR rate table.
+				rtw_write8(Adapter, REG_RRSR, BrateCfg&0xff);
+				rtw_write8(Adapter, REG_RRSR+1, (BrateCfg>>8)&0xff);
+				rtw_write8(Adapter, REG_RRSR+2, rtw_read8(Adapter, REG_RRSR+2)&0xf0);
+
+				// Set RTS initial rate
+				while(BrateCfg > 0x1)
+				{
+					BrateCfg = (BrateCfg>> 1);
+					RateIndex++;
+				}
+				// Ziv - Check
+				rtw_write8(Adapter, REG_INIRTS_RATE_SEL, RateIndex);
+			}
+			break;
+		case HW_VAR_TXPAUSE:
+			rtw_write8(Adapter, REG_TXPAUSE, *((u8 *)val));	
+			break;
+		case HW_VAR_BCN_FUNC:
+			hw_var_set_bcn_func(Adapter, variable, val);
+			break;
+		case HW_VAR_CORRECT_TSF:
+#ifdef CONFIG_CONCURRENT_MODE
+			hw_var_set_correct_tsf(Adapter, variable, val);
+#else			
+			{
+				u64	tsf;
+				struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+				struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+				//tsf = pmlmeext->TSFValue - ((u32)pmlmeext->TSFValue % (pmlmeinfo->bcn_interval*1024)) -1024; //us
+				tsf = pmlmeext->TSFValue - rtw_modular64(pmlmeext->TSFValue, (pmlmeinfo->bcn_interval*1024)) -1024; //us
+
+				if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+				{				
+					//pHalData->RegTxPause |= STOP_BCNQ;BIT(6)
+					//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)|BIT(6)));
+					StopTxBeacon(Adapter);
+				}
+
+				//disable related TSF function
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(3)));
+							
+				rtw_write32(Adapter, REG_TSFTR, tsf);
+				rtw_write32(Adapter, REG_TSFTR+4, tsf>>32);
+
+				//enable related TSF function
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(3));
+				
+							
+				if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+				{
+					//pHalData->RegTxPause  &= (~STOP_BCNQ);
+					//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)&(~BIT(6))));
+					ResumeTxBeacon(Adapter);
+				}
+			}
+#endif
+			break;
+		case HW_VAR_CHECK_BSSID:
+			if(*((u8 *)val))
+			{
+				rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_DATA|RCR_CBSSID_BCN);
+			}
+			else
+			{
+				u32	val32;
+
+				val32 = rtw_read32(Adapter, REG_RCR);
+				val32 &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+				rtw_write32(Adapter, REG_RCR, val32);
+			}
+			break;
+		case HW_VAR_MLME_DISCONNECT:
+#ifdef CONFIG_CONCURRENT_MODE
+			hw_var_set_mlme_disconnect(Adapter, variable, val);
+#else
+			{
+				//Set RCR to not to receive data frame when NO LINK state
+				//rtw_write32(Adapter, REG_RCR, rtw_read32(padapter, REG_RCR) & ~RCR_ADF);
+				//reject all data frames
+				rtw_write16(Adapter, REG_RXFLTMAP2,0x00);
+
+				//reset TSF
+				rtw_write8(Adapter, REG_DUAL_TSF_RST, (BIT(0)|BIT(1)));
+
+				//disable update TSF
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+			}
+#endif
+			break;
+		case HW_VAR_MLME_SITESURVEY:
+			hw_var_set_mlme_sitesurvey(Adapter, variable,  val);	
+			break;
+		case HW_VAR_MLME_JOIN:
+#ifdef CONFIG_CONCURRENT_MODE
+			hw_var_set_mlme_join(Adapter, variable,  val);
+#else
+			{
+				u8	RetryLimit = 0x30;
+				u8	type = *((u8 *)val);
+				struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+
+				if(type == 0) // prepare to join
+				{
+					//enable to rx data frame.Accept all data frame
+					//rtw_write32(padapter, REG_RCR, rtw_read32(padapter, REG_RCR)|RCR_ADF);
+					rtw_write16(Adapter, REG_RXFLTMAP2,0xFFFF);
+
+					rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_DATA|RCR_CBSSID_BCN);
+
+					if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+					{
+						RetryLimit = (pHalData->CustomerID == RT_CID_CCX) ? 7 : 48;
+					}
+					else // Ad-hoc Mode
+					{
+						RetryLimit = 0x7;
+					}
+				}
+				else if(type == 1) //joinbss_event call back when join res < 0
+				{
+					rtw_write16(Adapter, REG_RXFLTMAP2,0x00);
+				}
+				else if(type == 2) //sta add event call back
+				{
+					//enable update TSF
+					rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(4)));
+
+					if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE))
+					{
+						//fixed beacon issue for 8191su...........
+						rtw_write8(Adapter,0x542 ,0x02);
+						RetryLimit = 0x7;
+					}
+				}
+
+				rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+			}
+#endif
+			break;
+
+		case HW_VAR_ON_RCR_AM:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_AM);
+			DBG_871X("%s, %d, RCR= %x \n", __FUNCTION__,__LINE__, rtw_read32(Adapter, REG_RCR));
+			break;
+		case HW_VAR_OFF_RCR_AM:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)& (~RCR_AM));
+			DBG_871X("%s, %d, RCR= %x \n", __FUNCTION__,__LINE__, rtw_read32(Adapter, REG_RCR));
+			break;
+
+		case HW_VAR_BEACON_INTERVAL:
+			rtw_write16(Adapter, REG_BCN_INTERVAL, *((u16 *)val));
+			break;
+		case HW_VAR_SLOT_TIME:
+			{
+				u8	u1bAIFS, aSifsTime;
+				struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+				struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+				
+				rtw_write8(Adapter, REG_SLOT, val[0]);
+
+				if(pmlmeinfo->WMM_enable == 0)
+				{
+					if( pmlmeext->cur_wireless_mode == WIRELESS_11B)
+						aSifsTime = 10;
+					else
+						aSifsTime = 16;
+					
+					u1bAIFS = aSifsTime + (2 * pmlmeinfo->slotTime);
+					
+					// <Roger_EXP> Temporary removed, 2008.06.20.
+					rtw_write8(Adapter, REG_EDCA_VO_PARAM, u1bAIFS);
+					rtw_write8(Adapter, REG_EDCA_VI_PARAM, u1bAIFS);
+					rtw_write8(Adapter, REG_EDCA_BE_PARAM, u1bAIFS);
+					rtw_write8(Adapter, REG_EDCA_BK_PARAM, u1bAIFS);
+				}
+			}
+			break;
+		case HW_VAR_RESP_SIFS:
+			{
+#if 0			
+				// SIFS for OFDM Data ACK
+				rtw_write8(Adapter, REG_SIFS_CTX+1, val[0]);
+				// SIFS for OFDM consecutive tx like CTS data!
+				rtw_write8(Adapter, REG_SIFS_TRX+1, val[1]);
+				
+				rtw_write8(Adapter,REG_SPEC_SIFS+1, val[0]);
+				rtw_write8(Adapter,REG_MAC_SPEC_SIFS+1, val[0]);
+
+				// 20100719 Joseph: Revise SIFS setting due to Hardware register definition change.
+				rtw_write8(Adapter, REG_R2T_SIFS+1, val[0]); //0x08 - CCK
+				rtw_write8(Adapter, REG_T2T_SIFS+1, val[0]); //0x0e - OFDM
+#else
+				//SIFS_Timer = 0x0a0a0808;
+				//RESP_SIFS for CCK
+				rtw_write8(Adapter, REG_R2T_SIFS, val[0]); // SIFS_T2T_CCK (0x08)
+				rtw_write8(Adapter, REG_R2T_SIFS+1, val[1]); //SIFS_R2T_CCK(0x08)
+				//RESP_SIFS for OFDM
+				rtw_write8(Adapter, REG_T2T_SIFS, val[2]); //SIFS_T2T_OFDM (0x0a)
+				rtw_write8(Adapter, REG_T2T_SIFS+1, val[3]); //SIFS_R2T_OFDM(0x0a)
+#endif
+			}
+			break;
+		case HW_VAR_ACK_PREAMBLE:
+			{
+				u8	regTmp;
+				u8	bShortPreamble = *( (PBOOLEAN)val );
+				// Joseph marked out for Netgear 3500 TKIP channel 7 issue.(Temporarily)
+				regTmp = (pHalData->nCur40MhzPrimeSC)<<5;
+				//regTmp = 0;
+				if(bShortPreamble)
+					regTmp |= 0x80;
+
+				rtw_write8(Adapter, REG_RRSR+2, regTmp);
+			}
+			break;
+		case HW_VAR_SEC_CFG:
+#ifdef CONFIG_CONCURRENT_MODE
+			rtw_write8(Adapter, REG_SECCFG, 0x0c|BIT(5));// enable tx enc and rx dec engine, and no key search for MC/BC				
+#else
+			rtw_write8(Adapter, REG_SECCFG, *((u8 *)val));
+#endif
+			break;
+		case HW_VAR_DM_FLAG:
+			pdmpriv->DMFlag = *((u8 *)val);
+			break;
+		case HW_VAR_DM_FUNC_OP:
+			if(val[0])
+			{// save dm flag
+				pdmpriv->DMFlag_tmp = pdmpriv->DMFlag;
+			}
+			else
+			{// restore dm flag
+				pdmpriv->DMFlag = pdmpriv->DMFlag_tmp;
+			}
+			break;
+		case HW_VAR_DM_FUNC_SET:
+			pdmpriv->DMFlag |= *((u8 *)val);
+			break;
+		case HW_VAR_DM_FUNC_CLR:
+			pdmpriv->DMFlag &= *((u8 *)val);
+			break;
+		case HW_VAR_CAM_EMPTY_ENTRY:
+			{
+				u8	ucIndex = *((u8 *)val);
+				u8	i;
+				u32	ulCommand=0;
+				u32	ulContent=0;
+				u32	ulEncAlgo=CAM_AES;
+
+				for(i=0;i<CAM_CONTENT_COUNT;i++)
+				{
+					// filled id in CAM config 2 byte
+					if( i == 0)
+					{
+						ulContent |=(ucIndex & 0x03) | ((u16)(ulEncAlgo)<<2);
+						//ulContent |= CAM_VALID;
+					}
+					else
+					{
+						ulContent = 0;
+					}
+					// polling bit, and No Write enable, and address
+					ulCommand= CAM_CONTENT_COUNT*ucIndex+i;
+					ulCommand= ulCommand | CAM_POLLINIG|CAM_WRITE;
+					// write content 0 is equall to mark invalid
+					rtw_write32(Adapter, WCAMI, ulContent);  //delay_ms(40);
+					//RT_TRACE(COMP_SEC, DBG_LOUD, ("CAM_empty_entry(): WRITE A4: %lx \n",ulContent));
+					rtw_write32(Adapter, RWCAM, ulCommand);  //delay_ms(40);
+					//RT_TRACE(COMP_SEC, DBG_LOUD, ("CAM_empty_entry(): WRITE A0: %lx \n",ulCommand));
+				}
+			}
+			break;
+		case HW_VAR_CAM_INVALID_ALL:
+			rtw_write32(Adapter, RWCAM, BIT(31)|BIT(30));
+			break;
+		case HW_VAR_CAM_WRITE:
+			{
+				u32	cmd;
+				u32	*cam_val = (u32 *)val;
+				rtw_write32(Adapter, WCAMI, cam_val[0]);
+				
+				cmd = CAM_POLLINIG | CAM_WRITE | cam_val[1];
+				rtw_write32(Adapter, RWCAM, cmd);
+			}
+			break;
+		case HW_VAR_AC_PARAM_VO:
+			rtw_write32(Adapter, REG_EDCA_VO_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_AC_PARAM_VI:
+			rtw_write32(Adapter, REG_EDCA_VI_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_AC_PARAM_BE:
+			pHalData->AcParam_BE = ((u32 *)(val))[0];
+			rtw_write32(Adapter, REG_EDCA_BE_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_AC_PARAM_BK:
+			rtw_write32(Adapter, REG_EDCA_BK_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_ACM_CTRL:
+			{
+				u8	acm_ctrl = *((u8 *)val);
+				u8	AcmCtrl = rtw_read8( Adapter, REG_ACMHWCTRL);
+
+				if(acm_ctrl > 1)
+					AcmCtrl = AcmCtrl | 0x1;
+
+				if(acm_ctrl & BIT(3))
+					AcmCtrl |= AcmHw_VoqEn;
+				else
+					AcmCtrl &= (~AcmHw_VoqEn);
+
+				if(acm_ctrl & BIT(2))
+					AcmCtrl |= AcmHw_ViqEn;
+				else
+					AcmCtrl &= (~AcmHw_ViqEn);
+
+				if(acm_ctrl & BIT(1))
+					AcmCtrl |= AcmHw_BeqEn;
+				else
+					AcmCtrl &= (~AcmHw_BeqEn);
+
+				DBG_871X("[HW_VAR_ACM_CTRL] Write 0x%X\n", AcmCtrl );
+				rtw_write8(Adapter, REG_ACMHWCTRL, AcmCtrl );
+			}
+			break;
+		case HW_VAR_AMPDU_MIN_SPACE:
+			{
+				u8	MinSpacingToSet;
+				u8	SecMinSpace;
+
+				MinSpacingToSet = *((u8 *)val);
+				if(MinSpacingToSet <= 7)
+				{
+					switch(Adapter->securitypriv.dot11PrivacyAlgrthm)
+					{
+						case _NO_PRIVACY_:
+						case _AES_:
+							SecMinSpace = 0;
+							break;
+
+						case _WEP40_:
+						case _WEP104_:
+						case _TKIP_:
+						case _TKIP_WTMIC_:
+							SecMinSpace = 6;
+							break;
+						default:
+							SecMinSpace = 7;
+							break;
+					}
+
+					if(MinSpacingToSet < SecMinSpace){
+						MinSpacingToSet = SecMinSpace;
+					}
+
+					//RT_TRACE(COMP_MLME, DBG_LOUD, ("Set HW_VAR_AMPDU_MIN_SPACE: %#x\n", Adapter->MgntInfo.MinSpaceCfg));
+					rtw_write8(Adapter, REG_AMPDU_MIN_SPACE, (rtw_read8(Adapter, REG_AMPDU_MIN_SPACE) & 0xf8) | MinSpacingToSet);
+				}
+			}
+			break;
+		case HW_VAR_AMPDU_FACTOR:
+			{
+				u8	RegToSet_Normal[4]={0x41,0xa8,0x72, 0xb9};
+				u8	RegToSet_BT[4]={0x31,0x74,0x42, 0x97};
+				u8	FactorToSet;
+				u8	*pRegToSet;
+				u8	index = 0;
+
+#ifdef CONFIG_BT_COEXIST
+				if(	(pHalData->bt_coexist.BT_Coexist) &&
+					(pHalData->bt_coexist.BT_CoexistType == BT_CSR_BC4) )
+					pRegToSet = RegToSet_BT; // 0x97427431;
+				else
+#endif
+					pRegToSet = RegToSet_Normal; // 0xb972a841;
+
+				FactorToSet = *((u8 *)val);
+				if(FactorToSet <= 3)
+				{
+					FactorToSet = (1<<(FactorToSet + 2));
+					if(FactorToSet>0xf)
+						FactorToSet = 0xf;
+
+					for(index=0; index<4; index++)
+					{
+						if((pRegToSet[index] & 0xf0) > (FactorToSet<<4))
+							pRegToSet[index] = (pRegToSet[index] & 0x0f) | (FactorToSet<<4);
+					
+						if((pRegToSet[index] & 0x0f) > FactorToSet)
+							pRegToSet[index] = (pRegToSet[index] & 0xf0) | (FactorToSet);
+						
+						rtw_write8(Adapter, (REG_AGGLEN_LMT+index), pRegToSet[index]);
+					}
+
+					//RT_TRACE(COMP_MLME, DBG_LOUD, ("Set HW_VAR_AMPDU_FACTOR: %#x\n", FactorToSet));
+				}
+			}
+			break;
+		case HW_VAR_RXDMA_AGG_PG_TH:
+			#ifdef CONFIG_USB_RX_AGGREGATION
+			{
+				u8	threshold = *((u8 *)val);
+				if( threshold == 0)
+				{
+					threshold = pHalData->UsbRxAggPageCount;
+				}
+				rtw_write8(Adapter, REG_RXDMA_AGG_PG_TH, threshold);
+			}
+			#endif
+			break;
+		case HW_VAR_SET_RPWM:
+			rtw_write8(Adapter, REG_USB_HRPWM, *((u8 *)val));
+			break;
+		case HW_VAR_H2C_FW_PWRMODE:
+			{
+				u8	psmode = (*(u8 *)val);
+			
+				// Forece leave RF low power mode for 1T1R to prevent conficting setting in Fw power
+				// saving sequence. 2010.06.07. Added by tynli. Suggested by SD3 yschang.
+				if( (psmode != PS_MODE_ACTIVE) && (!IS_92C_SERIAL(pHalData->VersionID)))
+				{
+					rtl8192c_dm_RF_Saving(Adapter, _TRUE);
+				}
+				rtl8192c_set_FwPwrMode_cmd(Adapter, psmode);
+			}
+			break;
+		case HW_VAR_H2C_FW_JOINBSSRPT:
+			{
+				u8	mstatus = (*(u8 *)val);
+				rtl8192c_set_FwJoinBssReport_cmd(Adapter, mstatus);
+			}
+			break;
+#ifdef CONFIG_P2P_PS
+		case HW_VAR_H2C_FW_P2P_PS_OFFLOAD:
+			{
+				u8	p2p_ps_state = (*(u8 *)val);
+				rtl8192c_set_p2p_ps_offload_cmd(Adapter, p2p_ps_state);
+			}
+			break;
+#endif // CONFIG_P2P_PS
+#ifdef CONFIG_TDLS
+		case HW_VAR_TDLS_WRCR:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)&(~ BIT(6) ));
+			break;
+		case HW_VAR_TDLS_INIT_CH_SEN:
+			{
+				rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)&(~ BIT(6) )&(~ BIT(7) ));
+				rtw_write16(Adapter, REG_RXFLTMAP2,0xffff);
+
+				//disable update TSF
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+			}
+			break;
+		case HW_VAR_TDLS_DONE_CH_SEN:
+			{
+				//enable update TSF
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~ BIT(4)));
+				rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|(BIT(7) ));
+			}
+			break;
+		case HW_VAR_TDLS_RS_RCR:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|(BIT(6)));
+			break;
+#endif //CONFIG_TDLS
+		case HW_VAR_INITIAL_GAIN:
+			{
+				DIG_T	*pDigTable = &pdmpriv->DM_DigTable;					
+				u32 		rx_gain = ((u32 *)(val))[0];
+
+				if(rx_gain == 0xff){//restore rx gain
+					pDigTable->CurIGValue = pDigTable->BackupIGValue;
+					PHY_SetBBReg(Adapter, rOFDM0_XAAGCCore1, 0x7f,pDigTable->CurIGValue );
+					PHY_SetBBReg(Adapter, rOFDM0_XBAGCCore1, 0x7f,pDigTable->CurIGValue);
+				}
+				else{
+					pDigTable->BackupIGValue = pDigTable->CurIGValue;
+					PHY_SetBBReg(Adapter, rOFDM0_XAAGCCore1, 0x7f,rx_gain );
+					PHY_SetBBReg(Adapter, rOFDM0_XBAGCCore1, 0x7f,rx_gain);
+					pDigTable->CurIGValue = (u8)rx_gain;
+				}
+
+
+			}
+			break;
+		case HW_VAR_TRIGGER_GPIO_0:
+			rtl8192cu_trigger_gpio_0(Adapter);
+			break;
+#ifdef CONFIG_BT_COEXIST
+		case HW_VAR_BT_SET_COEXIST:
+			{
+				u8	bStart = (*(u8 *)val);
+				rtl8192c_set_dm_bt_coexist(Adapter, bStart);
+			}
+			break;
+		case HW_VAR_BT_ISSUE_DELBA:
+			{
+				u8	dir = (*(u8 *)val);
+				rtl8192c_issue_delete_ba(Adapter, dir);
+			}
+			break;
+#endif
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+
+		case HW_VAR_ANTENNA_DIVERSITY_LINK:
+			SwAntDivRestAfterLink8192C(Adapter);
+			break;
+		case HW_VAR_ANTENNA_DIVERSITY_SELECT:
+			{
+				u8	Optimum_antenna = (*(u8 *)val);
+				//switch antenna to Optimum_antenna
+		//		DBG_8192C("==> HW_VAR_ANTENNA_DIVERSITY_SELECT , Ant_(%s)\n",(Optimum_antenna==2)?"A":"B");
+				if(pHalData->CurAntenna !=  Optimum_antenna)		
+				{
+					PHY_SetBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300, Optimum_antenna);
+					pHalData->CurAntenna = Optimum_antenna ;
+					//DBG_8192C("==> HW_VAR_ANTENNA_DIVERSITY_SELECT , Ant_(%s)\n",(Optimum_antenna==2)?"A":"B");
+				}
+			}
+			break;
+#endif
+		case HW_VAR_EFUSE_BYTES: // To set EFUE total used bytes, added by Roger, 2008.12.22.
+			pHalData->EfuseUsedBytes = *((u16 *)val);			
+			break;
+		case HW_VAR_FIFO_CLEARN_UP:
+			{
+				#define RW_RELEASE_EN		BIT18
+				#define RXDMA_IDLE			BIT17
+				
+				struct pwrctrl_priv *pwrpriv = &Adapter->pwrctrlpriv;
+				u8 trycnt = 100;	
+				
+				//pause tx
+				rtw_write8(Adapter,REG_TXPAUSE,0xff);
+			
+				//keep sn
+				Adapter->xmitpriv.nqos_ssn = rtw_read16(Adapter,REG_NQOS_SEQ);
+
+				if(pwrpriv->bkeepfwalive != _TRUE)
+				{
+					//RX DMA stop
+					rtw_write32(Adapter,REG_RXPKT_NUM,(rtw_read32(Adapter,REG_RXPKT_NUM)|RW_RELEASE_EN));
+					do{
+						if(!(rtw_read32(Adapter,REG_RXPKT_NUM)&RXDMA_IDLE))
+							break;
+					}while(trycnt--);
+					if(trycnt ==0)
+						DBG_8192C("Stop RX DMA failed...... \n");
+
+					//RQPN Load 0
+					rtw_write16(Adapter,REG_RQPN_NPQ,0x0);
+					rtw_write32(Adapter,REG_RQPN,0x80000000);
+					rtw_mdelay_os(10);
+				}
+			}
+			break;
+			case HW_VAR_WOWLAN:
+#ifdef CONFIG_WOWLAN			
+			{
+				struct wowlan_ioctl_param *poidparam;
+
+				int res;
+
+				poidparam = (struct wowlan_ioctl_param *)val;
+				switch (poidparam->subcode){
+					case WOWLAN_PATTERN_MATCH:
+						//Turn on the Pattern Match feature
+						DBG_8192C("\n PATTERN_MATCH poidparam->subcode_value=%d\n",poidparam->subcode_value);
+						if(poidparam->subcode_value==1){
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(1)));
+							Adapter->pwrctrlpriv.wowlan_pattern=_TRUE; 
+							DBG_8192C("%s Adapter->pwrctrlpriv.wowlan_pattern=%x\n",__FUNCTION__,Adapter->pwrctrlpriv.wowlan_pattern); 
+						}
+						else{
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)&~BIT(1)));
+							Adapter->pwrctrlpriv.wowlan_pattern=_FALSE; 
+						}
+						break;
+					case WOWLAN_MAGIC_PACKET:
+						//Turn on the Magic Packet feature
+						DBG_8192C("\n MAGIC_PACKET poidparam->subcode_value=%d\n",poidparam->subcode_value);
+						if(poidparam->subcode_value==1){
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(2)));
+							Adapter->pwrctrlpriv.wowlan_magic=_TRUE; 
+							DBG_8192C("%s Adapter->pwrctrlpriv.wowlan_magic=%x\n",__FUNCTION__,Adapter->pwrctrlpriv.wowlan_magic); 
+						}
+						else{
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)&~BIT(2)));
+							Adapter->pwrctrlpriv.wowlan_magic=_FALSE; 
+						}
+						break;
+					case WOWLAN_UNICAST:
+						//Turn on the Unicast wakeup feature
+						if(poidparam->subcode_value==1){
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(3)));
+							Adapter->pwrctrlpriv.wowlan_unicast=_TRUE; 
+						}
+						else{
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)&~BIT(3)));
+							Adapter->pwrctrlpriv.wowlan_unicast=_FALSE; 
+							DBG_8192C("%s Adapter->pwrctrlpriv.wowlan_unicast=%x\n",__FUNCTION__,Adapter->pwrctrlpriv.wowlan_unicast); 
+						}
+						break;
+					case WOWLAN_SET_PATTERN:
+						//Setting the Pattern for wowlan
+						res=rtw_wowlan_set_pattern(Adapter,poidparam->pattern);
+						if(res)
+							DBG_8192C("rtw_wowlan_set_pattern retern value=0x%x",res);
+						break;
+					case WOWLAN_DUMP_REG:
+						//dump the WKFMCAM and WOW_CTRL register
+						/*DBG_8192C("\n\n\n\n rtw_wowlan_ctrl: WOW_CTRL=0x%x \n",rtw_read8(Adapter, REG_WOW_CTRL));
+						DBG_8192C("print WKFMCAM index =%d ",poidparam->data[0]);
+						{	int cmd=0,offset=0;
+							for(offset=0;offset<5;offset++){
+								cmd=BIT(31)|(poidparam->data[0]+offset);
+								rtw_write32(Adapter, REG_WKFMCAM_CMD, cmd);
+								DBG_8192C("offset[%d]=0x%.8x  ",offset,rtw_read32(Adapter, REG_WKFMCAM_RWD));
+								DBG_8192C("offset[%d]=MSB 0x%x:0x%x:0x%x:0x%x  ",offset,rtw_read8(Adapter, REG_WKFMCAM_RWD+3),rtw_read8(Adapter, REG_WKFMCAM_RWD+2),rtw_read8(Adapter, REG_WKFMCAM_RWD+1),rtw_read8(Adapter, REG_WKFMCAM_RWD));
+							}
+						}*/
+					
+						break;
+					case WOWLAN_ENABLE:
+						SetFwRelatedForWoWLAN8192CU(Adapter, _TRUE);
+						//Set Pattern
+						if(Adapter->pwrctrlpriv.wowlan_pattern==_TRUE)
+							rtw_wowlan_reload_pattern(Adapter);
+						rtl8192c_set_wowlan_cmd(Adapter);
+						rtw_write8(Adapter, 0x6, rtw_read8(Adapter, 0x6)|BIT(3));
+						rtw_msleep_os(10);
+						//DBG_8192C(" \n REG_WOW_CTRL=0x%x \n",rtw_read8(Adapter, REG_WOW_CTRL));
+//						if(rtw_read8(Adapter, REG_WOW_CTRL)==0)
+//							rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(1)|BIT(2)|BIT(3)));
+						//DBG_8192C(" \n REG_WOW_CTRL=0x%x \n",rtw_read8(Adapter, REG_WOW_CTRL));
+						break;
+	
+					case WOWLAN_DISABLE:
+						Adapter->pwrctrlpriv.wowlan_mode=_FALSE;
+						rtl8192c_set_wowlan_cmd(Adapter);
+						rtw_msleep_os(10);
+						break;
+					
+					case WOWLAN_STATUS:
+						poidparam->wakeup_reason = rtw_read8(Adapter, REG_WOWLAN_REASON);
+						DBG_8192C("wake on wlan reason 0x%02x\n", poidparam->wakeup_reason);
+						break;
+	
+					default:
+						break;
+				}
+				if (Adapter->pwrctrlpriv.wowlan_unicast||Adapter->pwrctrlpriv.wowlan_magic || Adapter->pwrctrlpriv.wowlan_pattern)
+					Adapter->pwrctrlpriv.wowlan_mode =_TRUE;
+				else
+					Adapter->pwrctrlpriv.wowlan_mode =_FALSE;
+			}
+
+			break;
+#endif //CONFIG_WOWLAN
+		case HW_VAR_CHECK_TXBUF:
+#ifdef CONFIG_CONCURRENT_MODE				
+			{
+				int i;
+				u8	RetryLimit = 0x01;
+				
+				//rtw_write16(Adapter, REG_RL,0x0101);
+				rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+		
+				for(i=0;i<1000;i++)
+				{
+					if(rtw_read32(Adapter, 0x200) != rtw_read32(Adapter, 0x204))
+					{
+						//DBG_871X("packet in tx packet buffer - 0x204=%x, 0x200=%x (%d)\n", rtw_read32(Adapter, 0x204), rtw_read32(Adapter, 0x200), i);
+						rtw_msleep_os(10);
+					}
+					else
+					{
+						DBG_871X("no packet in tx packet buffer (%d)\n", i);
+						break;
+					}
+				}
+
+				RetryLimit = 0x30;	
+				rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+		
+			}
+#endif
+			break;
+		case HW_VAR_BCN_VALID:
+			//BCN_VALID, BIT16 of REG_TDECTRL = BIT0 of REG_TDECTRL+2, write 1 to clear, Clear by sw
+			rtw_write8(Adapter, REG_TDECTRL+2, rtw_read8(Adapter, REG_TDECTRL+2) | BIT0); 
+			break;
+		case HW_VAR_USB_RXAGG_PAGE_TO:
+			rtw_write8(Adapter, REG_USB_DMA_AGG_TO, *((u8 *)val));
+			break;
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+void GetHwReg8192CU(PADAPTER Adapter, u8 variable, u8* val)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+_func_enter_;
+
+	switch(variable)
+	{
+		case HW_VAR_BASIC_RATE:
+			*((u16 *)(val)) = pHalData->BasicRateSet;
+		case HW_VAR_TXPAUSE:
+			val[0] = rtw_read8(Adapter, REG_TXPAUSE);
+			break;
+		case HW_VAR_BCN_VALID:
+			//BCN_VALID, BIT16 of REG_TDECTRL = BIT0 of REG_TDECTRL+2
+			val[0] = (BIT0 & rtw_read8(Adapter, REG_TDECTRL+2))?_TRUE:_FALSE;
+			break;
+		case HW_VAR_DM_FLAG:
+			val[0] = pHalData->dmpriv.DMFlag;
+			break;
+		case HW_VAR_RF_TYPE:
+			val[0] = pHalData->rf_type;
+			break;
+		case HW_VAR_FWLPS_RF_ON:
+			{
+				//When we halt NIC, we should check if FW LPS is leave.
+				u32	valRCR;
+				
+				if(Adapter->pwrctrlpriv.rf_pwrstate == rf_off)
+				{
+					// If it is in HW/SW Radio OFF or IPS state, we do not check Fw LPS Leave,
+					// because Fw is unload.
+					val[0] = _TRUE;
+				}
+				else
+				{
+					valRCR = rtw_read32(Adapter, REG_RCR);
+					valRCR &= 0x00070000;
+					if(valRCR)
+						val[0] = _FALSE;
+					else
+						val[0] = _TRUE;
+				}
+			}
+			break;
+#ifdef CONFIG_ANTENNA_DIVERSITY
+		case HW_VAR_CURRENT_ANTENNA:
+			val[0] = pHalData->CurAntenna;
+			break;
+#endif
+		case HW_VAR_EFUSE_BYTES: // To get EFUE total used bytes, added by Roger, 2008.12.22.
+			*((u16 *)(val)) = pHalData->EfuseUsedBytes;	
+			break;
+		case HW_VAR_VID:
+			*((u16 *)(val)) = pHalData->EEPROMVID;
+			break;
+		case HW_VAR_PID:
+			*((u16 *)(val)) = pHalData->EEPROMPID;
+			break;
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+//
+//	Description: 
+//		Query setting of specified variable.
+//
+u8
+GetHalDefVar8192CUsb(
+	IN	PADAPTER				Adapter,
+	IN	HAL_DEF_VARIABLE		eVariable,
+	IN	PVOID					pValue
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			bResult = _TRUE;
+
+	switch(eVariable)
+	{
+		case HAL_DEF_UNDERCORATEDSMOOTHEDPWDB:
+#if 0 //trunk
+			{
+				struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
+				struct sta_priv * pstapriv = &Adapter->stapriv;
+				struct sta_info * psta;
+				psta = rtw_get_stainfo(pstapriv, pmlmepriv->cur_network.network.MacAddress);
+				if(psta)
+				{
+					*((int *)pValue) = psta->rssi_stat.UndecoratedSmoothedPWDB;     
+				}
+			}
+#else //v4 branch
+				//if(check_fwstate(&Adapter->mlmepriv, WIFI_STATION_STATE) == _TRUE){
+			*((int *)pValue) = pHalData->dmpriv.UndecoratedSmoothedPWDB;
+				//}
+				//else{
+    
+				//}
+#endif
+			break;
+		case HAL_DEF_IS_SUPPORT_ANT_DIV:
+			#ifdef CONFIG_ANTENNA_DIVERSITY
+			*((u8 *)pValue) = (IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))?_FALSE:_TRUE;
+			#endif
+			break;			
+		case HAL_DEF_CURRENT_ANTENNA:
+			#ifdef CONFIG_ANTENNA_DIVERSITY
+			*(( u8*)pValue) = pHalData->CurAntenna;			
+			#endif
+			break;
+		case HAL_DEF_DRVINFO_SZ:
+			*(( u32*)pValue) = DRVINFO_SZ;
+			break;
+		case HAL_DEF_MAX_RECVBUF_SZ:
+			*(( u32*)pValue) = MAX_RECVBUF_SZ;
+			break;
+		case HAL_DEF_RX_PACKET_OFFSET:
+			*(( u32*)pValue) = RXDESC_SIZE + DRVINFO_SZ;
+			break;
+		case HAL_DEF_DBG_DUMP_RXPKT:
+			*(( u8*)pValue) = pHalData->bDumpRxPkt;
+			break;
+		case HAL_DEF_DBG_DM_FUNC:
+			*(( u8*)pValue) = pHalData->dmpriv.DMFlag;
+			break;
+		default:
+			//RT_TRACE(COMP_INIT, DBG_WARNING, ("GetHalDefVar8192CUsb(): Unkown variable: %d!\n", eVariable));
+			bResult = _FALSE;
+			break;
+	}
+
+	return bResult;
+}
+
+
+
+
+//
+//	Description:
+//		Change default setting of specified variable.
+//
+u8
+SetHalDefVar8192CUsb(
+	IN	PADAPTER				Adapter,
+	IN	HAL_DEF_VARIABLE		eVariable,
+	IN	PVOID					pValue
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			bResult = _TRUE;
+
+	switch(eVariable)
+	{
+		case HAL_DEF_DBG_DUMP_RXPKT:
+			pHalData->bDumpRxPkt = *(( u8*)pValue);
+			break;
+		case HAL_DEF_DBG_DM_FUNC:
+			{
+				u8 dm_func = *(( u8*)pValue);
+				struct dm_priv	*pdmpriv = &pHalData->dmpriv;	
+				
+				if(dm_func == 0){ //disable all dynamic func
+					pdmpriv->DMFlag = DYNAMIC_FUNC_DISABLE;
+					DBG_8192C("==> Disable all dynamic function...\n");
+				}
+				else if(dm_func == 1){//disable DIG
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_DIG);
+					DBG_8192C("==> Disable DIG...\n");
+				}
+				else if(dm_func == 2){//disable High power
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_HP);
+				}
+				else if(dm_func == 3){//disable tx power tracking
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_SS);
+					DBG_8192C("==> Disable tx power tracking...\n");
+				}
+				else if(dm_func == 4){//disable BT coexistence
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_BT);
+				}
+				else if(dm_func == 5){//disable antenna diversity
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_ANT_DIV);
+				}				
+				else if(dm_func == 6){//turn on all dynamic func
+					if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_DIG))
+					{
+						struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+						DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+						pDigTable->PreIGValue = rtw_read8(Adapter,0xc50);	
+					}
+						
+					pdmpriv->DMFlag |= (DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS|
+						DYNAMIC_FUNC_BT|DYNAMIC_FUNC_ANT_DIV) ;
+					DBG_8192C("==> Turn on all dynamic function...\n");
+				}			
+			}
+			break;
+		default:
+			//RT_TRACE(COMP_INIT, DBG_TRACE, ("SetHalDefVar819xUsb(): Unkown variable: %d!\n", eVariable));
+			bResult = _FALSE;
+			break;
+	}
+
+	return bResult;
+}
+
+u32  _update_92cu_basic_rate(_adapter *padapter, unsigned int mask)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+	unsigned int BrateCfg = 0;
+
+#ifdef CONFIG_BT_COEXIST
+	if(	(pbtpriv->BT_Coexist) &&	(pbtpriv->BT_CoexistType == BT_CSR_BC4)	)
+	{
+		BrateCfg = mask  & 0x151;
+		//DBG_8192C("BT temp disable cck 2/5.5/11M, (0x%x = 0x%x)\n", REG_RRSR, BrateCfg & 0x151);
+	}
+	else
+#endif
+	{
+		if(pHalData->VersionID != VERSION_TEST_CHIP_88C)
+			BrateCfg = mask  & 0x15F;
+		else	//for 88CU 46PING setting, Disable CCK 2M, 5.5M, Others must tuning
+			BrateCfg = mask  & 0x159;
+	}
+
+	BrateCfg |= 0x01; // default enable 1M ACK rate					
+
+	return BrateCfg;
+}
+
+void _update_response_rate(_adapter *padapter,unsigned int mask)
+{
+	u8	RateIndex = 0;
+	// Set RRSR rate table.
+	rtw_write8(padapter, REG_RRSR, mask&0xff);
+	rtw_write8(padapter,REG_RRSR+1, (mask>>8)&0xff);
+	
+
+	// Set RTS initial rate
+	while(mask > 0x1)
+	{
+		mask = (mask>> 1);
+		RateIndex++;
+	}
+	rtw_write8(padapter, REG_INIRTS_RATE_SEL, RateIndex);
+}
+
+void UpdateHalRAMask8192CUsb(PADAPTER padapter, u32 mac_id)
+{
+	//volatile unsigned int result;
+	u8	init_rate=0;
+	u8	networkType, raid;	
+	u32	mask;
+	u8	shortGIrate = _FALSE;
+	int	supportRateNum = 0;
+	struct sta_info	*psta;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+
+	if (mac_id >= NUM_STA) //CAM_SIZE
+	{
+		return;
+	}
+
+	psta = pmlmeinfo->FW_sta_info[mac_id].psta;
+	if(psta == NULL)
+	{
+		return;
+	}
+
+	switch (mac_id)
+	{
+		case 0:// for infra mode
+#ifdef CONFIG_CONCURRENT_MODE
+		case 2:// first station uses macid=0, second station uses macid=2
+#endif
+			supportRateNum = rtw_get_rateset_len(cur_network->SupportedRates);
+			networkType = judge_network_type(padapter, cur_network->SupportedRates, supportRateNum) & 0xf;
+			//pmlmeext->cur_wireless_mode = networkType;
+			raid = networktype_to_raid(networkType);
+						
+			mask = update_supported_rate(cur_network->SupportedRates, supportRateNum);
+			mask |= (pmlmeinfo->HT_enable)? update_MSC_rate(&(pmlmeinfo->HT_caps)): 0;
+			mask |= ((raid<<28)&0xf0000000);
+			
+			if (support_short_GI(padapter, &(pmlmeinfo->HT_caps)))
+			{
+				shortGIrate = _TRUE;
+			}
+			
+			break;
+
+		case 1://for broadcast/multicast
+			supportRateNum = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[mac_id].SupportedRates);
+			if(pmlmeext->cur_wireless_mode & WIRELESS_11B)
+				networkType = WIRELESS_11B;
+			else
+				networkType = WIRELESS_11G;
+			raid = networktype_to_raid(networkType);
+
+			mask = update_basic_rate(cur_network->SupportedRates, supportRateNum);
+			mask |= ((raid<<28)&0xf0000000);
+
+			break;
+
+		default: //for each sta in IBSS
+#ifdef CONFIG_TDLS
+			if(psta->tdls_sta_state & TDLS_LINKED_STATE)
+			{
+				shortGIrate = update_sgi_tdls(padapter, psta);
+				mask = update_mask_tdls(padapter, psta);
+				raid = mask>>28;
+				break;
+			}
+			else
+#endif //CONFIG_TDLS
+			{
+				supportRateNum = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[mac_id].SupportedRates);
+				networkType = judge_network_type(padapter, pmlmeinfo->FW_sta_info[mac_id].SupportedRates, supportRateNum) & 0xf;
+				//pmlmeext->cur_wireless_mode = networkType;
+				raid = networktype_to_raid(networkType);
+				
+				mask = update_supported_rate(cur_network->SupportedRates, supportRateNum);
+				mask |= ((raid<<28)&0xf0000000);
+
+				//todo: support HT in IBSS
+				
+				break;
+			}
+	}
+	
+#ifdef CONFIG_BT_COEXIST
+	if( (pbtpriv->BT_Coexist) &&
+		(pbtpriv->BT_CoexistType == BT_CSR_BC4) &&
+		(pbtpriv->BT_CUR_State) &&
+		(pbtpriv->BT_Ant_isolation) &&
+		((pbtpriv->BT_Service==BT_SCO)||
+		(pbtpriv->BT_Service==BT_Busy)) )
+		mask &= 0xffffcfc0;
+	else		
+#endif
+		mask &=0xffffffff;
+	
+	
+	init_rate = get_highest_rate_idx(mask)&0x3f;
+	
+	if(pHalData->fw_ractrl == _TRUE)
+	{
+		u8 arg = 0;
+
+		//arg = (cam_idx-4)&0x1f;//MACID
+		arg = mac_id&0x1f;//MACID
+		
+		arg |= BIT(7);
+		
+		if (shortGIrate==_TRUE)
+			arg |= BIT(5);
+
+		DBG_871X("update raid entry, mask=0x%x, arg=0x%x\n", mask, arg);
+		psta->ra_mask=mask;
+#ifdef CONFIG_INTEL_PROXIM
+		if(padapter->proximity.proxim_on ==_TRUE){
+			arg &= ~BIT(6);
+		}
+		else {
+			arg |= BIT(6);
+		}
+#endif //CONFIG_INTEL_PROXIM
+		rtl8192c_set_raid_cmd(padapter, mask, arg);	
+		
+	}
+	else
+	{
+		if (shortGIrate==_TRUE)
+			init_rate |= BIT(6);
+
+		rtw_write8(padapter, (REG_INIDATA_RATE_SEL+mac_id), init_rate);		
+	}
+
+
+	//set ra_id
+	psta->raid = raid;
+	psta->init_rate = init_rate;
+
+	//set correct initial date rate for each mac_id
+	pdmpriv->INIDATA_RATE[mac_id] = init_rate;
+}
+
+void SetBeaconRelatedRegisters8192CUsb(PADAPTER padapter)
+{
+	u32	value32;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//reset TSF, enable update TSF, correcting TSF On Beacon 
+	
+	//REG_BCN_INTERVAL
+	//REG_BCNDMATIM
+	//REG_ATIMWND
+	//REG_TBTT_PROHIBIT
+	//REG_DRVERLYINT
+	//REG_BCN_MAX_ERR	
+	//REG_BCNTCFG //(0x510)
+	//REG_DUAL_TSF_RST
+	//REG_BCN_CTRL //(0x550) 
+
+	//BCN interval
+	rtw_write16(padapter, REG_BCN_INTERVAL, pmlmeinfo->bcn_interval);
+	rtw_write8(padapter, REG_ATIMWND, 0x02);// 2ms
+
+	_InitBeaconParameters(padapter);
+
+	rtw_write8(padapter, REG_SLOT, 0x09);
+
+	value32 =rtw_read32(padapter, REG_TCR); 
+	value32 &= ~TSFRST;
+	rtw_write32(padapter,  REG_TCR, value32); 
+
+	value32 |= TSFRST;
+	rtw_write32(padapter, REG_TCR, value32); 
+
+	// NOTE: Fix test chip's bug (about contention windows's randomness)
+	rtw_write8(padapter,  REG_RXTSF_OFFSET_CCK, 0x50);
+	rtw_write8(padapter, REG_RXTSF_OFFSET_OFDM, 0x50);
+
+	_BeaconFunctionEnable(padapter, _TRUE, _TRUE);
+
+	ResumeTxBeacon(padapter);
+
+	//rtw_write8(padapter, 0x422, rtw_read8(padapter, 0x422)|BIT(6));
+	
+	//rtw_write8(padapter, 0x541, 0xff);
+
+	//rtw_write8(padapter, 0x542, rtw_read8(padapter, 0x541)|BIT(0));
+
+	rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)|BIT(1));
+
+}
+
+static void rtl8192cu_init_default_value(_adapter * padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	i;
+
+	//init default value
+	pHalData->fw_ractrl = _FALSE;	
+	pHalData->bIQKInitialized = _FALSE;
+	if(!pwrctrlpriv->bkeepfwalive)
+		pHalData->LastHMEBoxNum = 0;
+	
+	pHalData->bIQKInitialized = _FALSE;
+	//init dm default value
+	pdmpriv->TM_Trigger = 0;
+	pdmpriv->binitialized = _FALSE;
+	pdmpriv->prv_traffic_idx = 3;
+	pdmpriv->initialize = 0;
+
+	pdmpriv->ThermalValue_HP_index = 0;
+	for(i = 0; i < HP_THERMAL_NUM; i++)
+		pdmpriv->ThermalValue_HP[i] = 0;
+}
+
+static u8 rtl8192cu_ps_func(PADAPTER Adapter,HAL_INTF_PS_FUNC efunc_id, u8 *val)
+{	
+	u8 bResult = _TRUE;
+	switch(efunc_id){
+
+		#if defined(CONFIG_AUTOSUSPEND) && defined(SUPPORT_HW_RFOFF_DETECTED)
+		case HAL_USB_SELECT_SUSPEND:
+			{
+				u8 bfwpoll = *(( u8*)val);
+				rtl8192c_set_FwSelectSuspend_cmd(Adapter,bfwpoll ,500);//note fw to support hw power down ping detect
+			}
+			break;
+		#endif //CONFIG_AUTOSUSPEND && SUPPORT_HW_RFOFF_DETECTED
+
+		default:
+			break;
+	}
+	return bResult;
+}
+
+void rtl8192cu_set_hal_ops(_adapter * padapter)
+{
+	struct hal_ops	*pHalFunc = &padapter->HalFunc;
+
+_func_enter_;
+
+	padapter->HalData = rtw_zmalloc(sizeof(HAL_DATA_TYPE));
+	if(padapter->HalData == NULL){
+		DBG_8192C("cant not alloc memory for HAL DATA \n");
+	}
+	//_rtw_memset(padapter->HalData, 0, sizeof(HAL_DATA_TYPE));
+	padapter->hal_data_sz = sizeof(HAL_DATA_TYPE);
+
+	pHalFunc->hal_init = &rtl8192cu_hal_init;
+	pHalFunc->hal_deinit = &rtl8192cu_hal_deinit;
+
+	//pHalFunc->free_hal_data = &rtl8192c_free_hal_data;
+
+	pHalFunc->inirp_init = &rtl8192cu_inirp_init;
+	pHalFunc->inirp_deinit = &rtl8192cu_inirp_deinit;
+
+	pHalFunc->init_xmit_priv = &rtl8192cu_init_xmit_priv;
+	pHalFunc->free_xmit_priv = &rtl8192cu_free_xmit_priv;
+
+	pHalFunc->init_recv_priv = &rtl8192cu_init_recv_priv;
+	pHalFunc->free_recv_priv = &rtl8192cu_free_recv_priv;
+#ifdef CONFIG_SW_LED
+	pHalFunc->InitSwLeds = &rtl8192cu_InitSwLeds;
+	pHalFunc->DeInitSwLeds = &rtl8192cu_DeInitSwLeds;
+#else //case of hw led or no led
+	pHalFunc->InitSwLeds = NULL;
+	pHalFunc->DeInitSwLeds = NULL;	
+#endif//CONFIG_SW_LED
+
+	//pHalFunc->dm_init = &rtl8192c_init_dm_priv;
+	//pHalFunc->dm_deinit = &rtl8192c_deinit_dm_priv;
+
+	pHalFunc->init_default_value = &rtl8192cu_init_default_value;
+	pHalFunc->intf_chip_configure = &rtl8192cu_interface_configure;
+	pHalFunc->read_adapter_info = &ReadAdapterInfo8192CU;
+
+	//pHalFunc->set_bwmode_handler = &PHY_SetBWMode8192C;
+	//pHalFunc->set_channel_handler = &PHY_SwChnl8192C;
+
+	//pHalFunc->hal_dm_watchdog = &rtl8192c_HalDmWatchDog;
+
+	pHalFunc->SetHwRegHandler = &SetHwReg8192CU;
+	pHalFunc->GetHwRegHandler = &GetHwReg8192CU;
+  	pHalFunc->GetHalDefVarHandler = &GetHalDefVar8192CUsb;
+ 	pHalFunc->SetHalDefVarHandler = &SetHalDefVar8192CUsb;
+
+	pHalFunc->UpdateRAMaskHandler = &UpdateHalRAMask8192CUsb;
+	pHalFunc->SetBeaconRelatedRegistersHandler = &SetBeaconRelatedRegisters8192CUsb;
+
+	//pHalFunc->Add_RateATid = &rtl8192c_Add_RateATid;
+
+//#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	//pHalFunc->AntDivBeforeLinkHandler = &SwAntDivBeforeLink8192C;
+	//pHalFunc->AntDivCompareHandler = &SwAntDivCompare8192C;
+//#endif
+
+	pHalFunc->hal_xmit = &rtl8192cu_hal_xmit;
+	pHalFunc->mgnt_xmit = &rtl8192cu_mgnt_xmit;
+	pHalFunc->hal_xmitframe_enqueue = &rtl8192cu_hal_xmitframe_enqueue;
+
+	//pHalFunc->read_bbreg = &rtl8192c_PHY_QueryBBReg;
+	//pHalFunc->write_bbreg = &rtl8192c_PHY_SetBBReg;
+	//pHalFunc->read_rfreg = &rtl8192c_PHY_QueryRFReg;
+	//pHalFunc->write_rfreg = &rtl8192c_PHY_SetRFReg;
+
+#ifdef CONFIG_HOSTAPD_MLME
+	pHalFunc->hostap_mgnt_xmit_entry = &rtl8192cu_hostap_mgnt_xmit_entry;
+#endif
+	pHalFunc->interface_ps_func = &rtl8192cu_ps_func;
+
+	rtl8192c_set_hal_ops(pHalFunc);
+_func_exit_;
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c
new file mode 100755
index 0000000000000..9523337622b85
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c
@@ -0,0 +1,1207 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_OPS_OS_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+#ifndef PLATFORM_OS_CE
+    #error "PLATFORM_OS_CE shall be set \n"
+#endif
+
+#ifndef CONFIG_USB_HCI
+	#error "CONFIG_USB_HCI shall be on!\n"
+#endif
+
+#include <usb_ops.h>
+#include <recv_osdep.h>
+
+#include <circ_buf.h>
+
+
+struct zero_bulkout_context
+{
+	void *pbuf;
+	void *purb;
+	void *pirp;
+	void *padapter;
+};
+
+
+
+#define PUSB_ERROR LPDWORD
+#define USBD_HALTED(Status) ((ULONG)(Status) >> 30 == 3)
+
+
+USB_PIPE ffaddr2pipehdl(struct dvobj_priv *pNdisCEDvice, u32 addr);
+
+
+static NTSTATUS usb_async_interrupt_in_complete( LPVOID Context );
+static NTSTATUS usb_async_interrupt_out_complete( LPVOID Context );
+
+DWORD usb_write_port_complete( LPVOID Context );
+DWORD usb_read_port_complete( LPVOID Context );
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+_func_exit_;
+}
+
+
+
+BOOL
+CloseTransferHandle(
+    LPCUSB_FUNCS   pUsbFuncs,
+    USB_TRANSFER   hTransfer
+    )
+{
+    BOOL bRc = TRUE;
+
+    // This assert may fail on suprise remove,
+    // but should pass during normal I/O.
+    // ASSERT( pUsbFuncs->lpIsTransferComplete(hTransfer) ); 
+
+    // CloseTransfer aborts any pending transfers
+    if ( !pUsbFuncs->lpCloseTransfer(hTransfer) ) {
+     
+	RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("*** CloseTransfer ERROR:%d ***\n", GetLastError()));	
+        bRc = FALSE;
+    }
+
+    return bRc;
+}
+
+
+BOOL
+GetTransferStatus(
+    LPCUSB_FUNCS   pUsbFuncs,
+    USB_TRANSFER   hTransfer,
+    LPDWORD        pBytesTransferred , // OPTIONAL returns number of bytes transferred
+    PUSB_ERROR     pUsbError  	 // returns USB error code
+    )
+{
+
+    BOOL bRc = TRUE;
+
+    if ( pUsbFuncs->lpGetTransferStatus(hTransfer, pBytesTransferred, pUsbError) ) {
+        if ( USB_NO_ERROR != *pUsbError ) {
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("*** CloseTransfer ERROR:%d ***\n", GetLastError()));		
+            RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("GetTransferStatus (BytesTransferred:%d, UsbError:0x%x)\n", pBytesTransferred?*pBytesTransferred:-1, pUsbError?*pUsbError:-1 )); 
+        }
+    } else {
+        RT_TRACE( _module_hci_ops_os_c_, _drv_err_,("*** GetTransferStatus ERROR:%d ***\n", GetLastError())); 
+        *pUsbError = USB_CANCELED_ERROR;
+        bRc = FALSE;
+    }
+
+    return bRc;
+}
+
+
+// The driver should never read RxCmd register. We have to set
+// RCR CMDHAT0 (bit6) to append Rx status before the Rx frame.
+//
+// |<--------  pBulkUrb->TransferBufferLength  ------------>|
+// +------------------+-------------------+------------+
+//  | Rx status (16 bytes)  | Rx frame .....             | CRC(4 bytes) |
+// +------------------+-------------------+------------+
+// ^
+// ^pRfd->Buffer.VirtualAddress
+//
+/*! \brief USB RX IRP Complete Routine.
+	@param Context pointer of RT_RFD
+*/
+u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+    struct intf_priv	*pintfpriv		= pintfhdl->pintfpriv;
+    struct dvobj_priv	*pdvobj_priv	= (struct dvobj_priv*)pintfpriv->intf_dev;
+    _adapter			*adapter		= (_adapter *)pdvobj_priv->padapter;
+
+	struct recv_priv	*precvpriv	= &adapter->recvpriv;
+
+	struct recv_buf		*precvbuf	= (struct recv_buf *)rmem;
+	DWORD dwErr = ERROR_SUCCESS ;
+	DWORD dwBytesTransferred = 0 ;
+	USB_TRANSFER hTransfer = NULL;
+	USB_PIPE	hPipe;
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port(%u)\n", __LINE__));
+
+#if (CONFIG_PWRCTRL == 1)
+    if (adapter->pwrctrlpriv.pnp_bstop_trx)
+	{
+        return _FALSE;
+    }
+#endif
+
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved) 
+	{
+		RT_TRACE(_module_hci_ops_os_c_, _drv_info_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved)!!!\n"));
+		return _FALSE;
+	}
+
+	if(precvbuf !=NULL)
+	{
+
+		// get a recv buffer
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+	
+
+
+		_rtw_spinlock(&precvpriv->lock);
+		precvpriv->rx_pending_cnt++;
+		precvbuf->irp_pending = _TRUE;
+		_rtw_spinunlock(&precvpriv->lock);
+
+
+		//translate DMA FIFO addr to pipehandle
+		hPipe = ffaddr2pipehdl(pdvobj_priv, addr);
+		
+
+		RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port(%u)\n", __LINE__));
+
+		precvbuf->usb_transfer_read_port = (*usb_funcs_vp->lpIssueBulkTransfer)(
+			hPipe,
+			usb_read_port_complete,
+			precvbuf,
+			USB_IN_TRANSFER|USB_SHORT_TRANSFER_OK,
+			MAX_RECVBUF_SZ,
+			precvbuf->pbuf,
+			0);
+
+
+		if(precvbuf->usb_transfer_read_port)
+		{
+			
+		//	  GetTransferStatus(usb_funcs_vp, hTransfer, &dwBytesTransferred,&UsbRc);
+
+		//	  CloseTransferHandle(usb_funcs_vp, hTransfer);
+
+		}
+		else
+		{
+
+			dwErr = GetLastError();
+			//RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port ERROR : %d\n", dwErr));		 
+
+		}
+
+//	 	if (  USB_NO_ERROR != UsbRc && ERROR_SUCCESS == dwErr) {
+//	        dwErr = ERROR_GEN_FAILURE;
+//	    }
+
+
+		if ( ERROR_SUCCESS != dwErr ) {
+
+			SetLastError(dwErr);
+			RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port ERROR : %d\n", dwErr));	
+		}
+	
+		RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_read_port(%u)\n", __LINE__));
+
+	}
+	else // if(precvbuf !=NULL)
+	{
+		
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precv_frame ==NULL\n"));
+	}
+
+	return _TRUE;
+
+}
+
+DWORD usb_read_port_complete( PVOID context )
+{
+	struct recv_buf 	*precvbuf	= (struct recv_buf *)context;
+	_adapter			*adapter	= (_adapter *)precvbuf->adapter;
+	struct recv_priv	*precvpriv	= &adapter->recvpriv;
+
+
+	struct intf_hdl		*pintfhdl = &adapter->pio_queue->intf;
+    struct intf_priv	*pintfpriv    = pintfhdl->pintfpriv;
+    struct dvobj_priv	*pdvobj_priv  = (struct dvobj_priv*)pintfpriv->intf_dev;
+
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+    DWORD dwBytesTransferred    = 0;
+    DWORD dwErr                 = USB_CANCELED_ERROR;
+
+	uint isevt, *pbuf;
+	int fComplete =_FALSE;
+
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port_complete(%u)\n", __LINE__));
+
+_func_enter_;
+
+
+	_rtw_spinlock_ex(&precvpriv->lock);
+	precvbuf->irp_pending=_FALSE;
+	precvpriv->rx_pending_cnt --;
+	_rtw_spinunlock_ex(&precvpriv->lock);	
+
+
+#if 1
+		
+	(*usb_funcs_vp->lpGetTransferStatus)(precvbuf->usb_transfer_read_port, &dwBytesTransferred, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(precvbuf->usb_transfer_read_port);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(precvbuf->usb_transfer_read_port);
+	
+	
+#endif
+
+
+	if(USB_NO_ERROR != dwErr)
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port_complete Fail :%d\n",dwErr));
+	
+	{
+
+		if ( dwBytesTransferred > MAX_RECVBUF_SZ || dwBytesTransferred < RXDESC_SIZE )
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,
+				("\n usb_read_port_complete: (pbulkurb->TransferBufferLength > MAX_RECVBUF_SZ) || (pbulkurb->TransferBufferLength < RXDESC_SIZE): %d\n",dwBytesTransferred));
+			rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+
+    	    //usb_read_port(pintfhdl, 0, 0, (unsigned char *)precvframe);
+    	}
+		else
+		{
+			precvbuf->transfer_len = dwBytesTransferred;
+
+			pbuf = (uint*)precvbuf->pbuf;
+
+			if((isevt = *(pbuf+1)&0x1ff) == 0x1ff)
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_info_,
+					("\n usb_read_port_complete: get a event\n"));
+				rxcmd_event_hdl(adapter, pbuf);//rx c2h events
+
+				rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+			}
+			else
+			{
+				if(recvbuf2recvframe(adapter, precvbuf)==_FAIL)//rx packets
+				{
+					//precvbuf->reuse = _TRUE;		
+					rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+				}
+			}
+	    }
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_read_port_complete(%u)\n", __LINE__));
+
+_func_exit_;
+	return ERROR_SUCCESS;
+//	return STATUS_MORE_PROCESSING_REQUIRED;
+}
+
+void usb_read_port_cancel(_adapter *padapter){
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port_cancel(%u)\n",__FUNCTION__, __LINE__));
+}
+
+DWORD usb_write_mem_complete( LPVOID Context )
+{
+	int fComplete =_FALSE;
+	DWORD	dwBytes 	= 0;
+	DWORD	dwErr		= USB_CANCELED_ERROR;
+
+	_irqL irqL;
+	_list	*head;
+	_list *plist;
+	struct io_req	*pio_req;	
+	struct io_queue *pio_q = (struct io_queue *) Context;
+	struct intf_hdl *pintf = &(pio_q->intf);	
+	struct intf_priv *pintfpriv = pintf->pintfpriv;	
+	_adapter *padapter = (_adapter *)pintf->adapter;
+	NTSTATUS status = STATUS_SUCCESS;
+    struct xmit_priv * pxmitpriv	= &padapter->xmitpriv;
+
+	struct dvobj_priv * pdvobj_priv	= (struct dvobj_priv*)pintfpriv->intf_dev;
+
+    USB_HANDLE		usbHandle		= pdvobj_priv->usb_extension._hDevice;
+    LPCUSB_FUNCS	usb_funcs_vp	= pdvobj_priv->usb_extension._lpUsbFuncs;
+
+	// get the head from the processing io_queue
+	head = &(pio_q->processing);
+	
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("+usb_write_mem_complete %p\n", Context));
+
+#if 1
+	_enter_critical_bh(&(pio_q->lock), &irqL);
+	
+
+	//free irp in processing list...	
+	while(rtw_is_list_empty(head) != _TRUE)
+	{
+		plist = get_next(head);	
+		rtw_list_delete(plist);
+		pio_req = LIST_CONTAINOR(plist, struct io_req, list);
+		_rtw_up_sema(&pio_req->sema);
+	}
+
+	_exit_critical_bh(&(pio_q->lock), &irqL);
+#endif
+
+
+#if 1
+		
+	(*usb_funcs_vp->lpGetTransferStatus)(pio_req->usb_transfer_write_mem , &dwBytes, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pio_req->usb_transfer_write_mem);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_mem_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(pio_req->usb_transfer_write_mem );
+	
+#endif
+	
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_write_mem_complete\n"));
+
+_func_exit_;
+
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+
+	NTSTATUS NtStatus = STATUS_SUCCESS;
+    USB_PIPE	hPipe;
+	_irqL	irqL;
+
+	int 	fComplete	= _FALSE;
+	DWORD	dwBytes 	= 0;
+	DWORD	dwErr		= USB_CANCELED_ERROR;
+
+
+	struct io_req 		*pio_req;
+
+	_adapter 			*adapter 	= (_adapter *)pintfhdl->adapter;
+	struct intf_priv 	*pintfpriv	= pintfhdl->pintfpriv;
+	struct dvobj_priv   * pdvobj_priv   = (struct dvobj_priv*)pintfpriv->intf_dev;
+
+	 
+    struct xmit_priv	*pxmitpriv	= &adapter->xmitpriv;
+	struct io_queue 	*pio_queue 	= (struct io_queue *)adapter->pio_queue; 
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_write_mem(%u) pintfhdl %p wmem %p\n", __LINE__, pintfhdl, wmem));
+
+	// fetch a io_request from the io_queue
+	pio_req = alloc_ioreq(pio_queue);
+		
+	if ((pio_req == NULL)||(adapter->bSurpriseRemoved))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("async_irp_write32 : pio_req =0x%x adapter->bSurpriseRemoved=0x%x",pio_req,adapter->bSurpriseRemoved ));
+		goto exit;
+	}	
+
+	_enter_critical_bh(&(pio_queue->lock), &irqL);
+
+
+	// insert the io_request into processing io_queue
+	rtw_list_insert_tail(&(pio_req->list),&(pio_queue->processing));
+	
+	
+	if((adapter->bDriverStopped) || (adapter->bSurpriseRemoved) ||(adapter->pwrctrlpriv.pnp_bstop_trx)) 
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\npadapter->pwrctrlpriv.pnp_bstop_trx==_TRUE\n"));
+		goto exit;
+	}
+	
+	//translate DMA FIFO addr to pipehandle
+	hPipe = ffaddr2pipehdl(pdvobj_priv, addr);	
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_,("usb_write_mem(%u)\n",__LINE__));
+
+	pio_req->usb_transfer_write_mem = (*usb_funcs_vp->lpIssueBulkTransfer)(
+		hPipe,
+		usb_write_mem_complete, 
+		pio_queue,
+		USB_OUT_TRANSFER,
+		cnt,
+		wmem,
+		0);
+
+#if 0
+
+	(*usb_funcs_vp->lpGetTransferStatus)(pio_req->usb_transfer_write_mem , &dwBytes, &dwErr);
+
+	while( fComplete != _TRUE)
+	{
+		fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pio_req->usb_transfer_write_mem);
+		if(fComplete==_TRUE)
+		{
+			(*usb_funcs_vp->lpCloseTransfer)(pio_req->usb_transfer_write_mem );
+			RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_mem finished\n"));
+			break;
+		}
+		else
+		{
+			RT_TRACE( _module_hci_ops_os_c_, _drv_err_, 
+				("usb_write_mem not yet finished %X\n", 
+				pio_req->usb_transfer_write_mem));
+			rtw_msleep_os(10);
+		}
+		
+	}
+
+#endif
+
+
+//	_rtw_down_sema(&pio_req->sema);	
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_write_mem(%X)\n",pio_req->usb_transfer_write_mem));
+
+	_exit_critical_bh(&(pio_queue->lock), &irqL);
+
+	_rtw_down_sema(&pio_req->sema); 
+	free_ioreq(pio_req, pio_queue);
+
+exit:
+_func_exit_;
+	return;
+}
+
+u32 usb_write_cnt=0;
+u32 usb_complete_cnt=0;
+
+USB_PIPE ffaddr2pipehdl(struct dvobj_priv *pNdisCEDvice, u32 addr)
+{
+	USB_PIPE	PipeHandle = NULL;
+	_adapter	*padapter = pNdisCEDvice->padapter;
+
+	
+	if(pNdisCEDvice->nr_endpoint == 11)
+	{		
+		switch(addr)
+		{	    
+	     		case RTL8712_DMA_BEQ:
+		 		PipeHandle= padapter->halpriv.pipehdls_r8712[3] ; 
+				break;
+	     		case RTL8712_DMA_BKQ:
+			 	PipeHandle=  padapter->halpriv.pipehdls_r8712[4]; 
+				break;
+	     		case RTL8712_DMA_VIQ:
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[2]; 
+				break;
+	    		case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1]; 
+				break;					
+                     case RTL8712_DMA_BCNQ:	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[6]; 
+				break;	 	
+			case RTL8712_DMA_BMCQ:	//HI Queue
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[7]; 
+				break;	
+			case RTL8712_DMA_MGTQ:				
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[8]; 
+				break;
+                     case RTL8712_DMA_RX0FF:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0]; 
+				break;	 	
+			case RTL8712_DMA_C2HCMD:		 	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5]; 
+				break;
+			case RTL8712_DMA_H2CCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[9]; 
+				break;	
+				
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 6)
+	{
+		switch(addr)
+		{	    
+			case RTL8712_DMA_BEQ:
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[3]; 
+				break;
+	     	case RTL8712_DMA_BKQ:
+			 	PipeHandle=  padapter->halpriv.pipehdls_r8712[4]; 
+				break;
+	     	case RTL8712_DMA_VIQ:
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[2]; 
+				break;
+	    	case RTL8712_DMA_VOQ:                   		
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[1]; 
+				break;
+			case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:		 	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0]; 
+				break;
+			case RTL8712_DMA_H2CCMD:
+			case RTL8712_DMA_BCNQ:					
+			case RTL8712_DMA_BMCQ:	
+			case RTL8712_DMA_MGTQ:			
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5]; 
+				break;	
+				
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 4)
+	{
+		switch(addr)
+		{	    
+	     	case RTL8712_DMA_BEQ:
+		 	case RTL8712_DMA_BKQ:
+			 	PipeHandle=  padapter->halpriv.pipehdls_r8712[2]; 
+				break;
+     		case RTL8712_DMA_VIQ:
+		 	case RTL8712_DMA_VOQ:					
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[1]; 
+				break;
+			case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:		 	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0]; 
+				break;
+			case RTL8712_DMA_H2CCMD:	
+			case RTL8712_DMA_BCNQ:					
+			case RTL8712_DMA_BMCQ:	
+			case RTL8712_DMA_MGTQ:				
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[3]; 
+				break;	
+		}
+	
+	}
+	else
+	{
+	   RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ffaddr2pipehdl():nr_endpoint=%d error!\n", pNdisCEDvice->nr_endpoint));	   
+	}
+		
+	return PipeHandle;
+
+}
+
+DWORD usb_bulkout_zero_complete( LPVOID pZeroContext )
+{
+	struct zero_bulkout_context *pcontext = (struct zero_bulkout_context *)pZeroContext;
+	_adapter * padapter = pcontext->padapter;
+    struct dvobj_priv *	pdvobj_priv = (struct dvobj_priv *)&padapter->dvobjpriv;
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+	struct xmit_priv  * pxmitpriv	= &padapter->xmitpriv;
+
+	int 	fComplete			=_FALSE;
+	DWORD	dwBytesTransferred	= 0;
+	DWORD	dwErr				= USB_CANCELED_ERROR;
+
+_func_enter_;
+
+#if 1
+				
+	(*usb_funcs_vp->lpGetTransferStatus)(pxmitpriv->usb_transfer_write_port, &dwBytesTransferred, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pxmitpriv->usb_transfer_write_port);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_bulkout_zero_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(pxmitpriv->usb_transfer_write_port);
+	
+#endif
+
+	if(pcontext)
+	{
+		if(pcontext->pbuf)
+		{			
+			rtw_mfree(pcontext->pbuf, sizeof(int));	
+		}	
+
+		rtw_mfree((u8*)pcontext, sizeof(struct zero_bulkout_context));	
+	}	
+
+_func_exit_;
+
+	return ERROR_SUCCESS;
+	
+
+}
+
+u32 usb_bulkout_zero(struct intf_hdl *pintfhdl, u32 addr)
+{	
+	struct zero_bulkout_context *pcontext;
+	unsigned char *pbuf;
+	u8 len = 0 ;
+	_adapter *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv	*pdvobj = (struct dvobj_priv *)&padapter->dvobjpriv;	
+	struct xmit_priv	* pxmitpriv     = &padapter->xmitpriv;
+     
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj->usb_extension._lpUsbFuncs;
+
+	USB_PIPE	hPipe;
+
+_func_enter_;
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{		
+		return _FAIL;
+	}
+
+
+	pcontext = (struct zero_bulkout_context *)rtw_zmalloc(sizeof(struct zero_bulkout_context));
+
+	pbuf = (unsigned char *)rtw_zmalloc(sizeof(int));	
+
+	len = 0;
+	
+	pcontext->pbuf = pbuf;
+	pcontext->purb = NULL;
+	pcontext->pirp = NULL;
+	pcontext->padapter = padapter;
+                    
+
+//translate DMA FIFO addr to pipehandle
+	hPipe = ffaddr2pipehdl(pdvobj, addr);
+
+
+
+
+	pxmitpriv->usb_transfer_write_port = (*usb_funcs_vp->lpIssueBulkTransfer)(
+						        hPipe, usb_bulkout_zero_complete, 
+						        pcontext, USB_OUT_TRANSFER,
+					    	    len, pbuf, 0);
+
+	
+_func_exit_;
+	
+	return _SUCCESS;
+
+}
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+
+    u32	i, bwritezero = _FALSE;
+	u32	ac_tag = addr;
+
+    u8*	ptr;
+
+	struct intf_priv    * pintfpriv     = pintfhdl->pintfpriv;
+	struct dvobj_priv   * pdvobj_priv   = (struct dvobj_priv*)pintfpriv->intf_dev;
+	_adapter            * padapter      = pdvobj_priv->padapter;
+
+    struct xmit_priv	* pxmitpriv     = &padapter->xmitpriv;
+    struct xmit_frame   * pxmitframe    = (struct xmit_frame *)wmem;
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+    USB_PIPE	hPipe;
+
+	u32			bResult = _FALSE;
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("+usb_write_port\n"));
+
+#if (CONFIG_PWRCTRL == 1)
+    if(padapter->pwrctrlpriv.pnp_bstop_trx==_TRUE){
+       	RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("\npadapter->pwrctrlpriv.pnp_bstop_trx==_TRUE\n"));
+
+    }
+#endif
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		bResult = _FALSE;
+		goto exit;
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_write_port(%u)\n", __LINE__));
+
+	for(i=0; i<8; i++)
+	{
+		if(pxmitframe->bpending[i] == _FALSE)
+		{
+			_rtw_spinlock(&pxmitpriv->lock);	
+			pxmitpriv->txirp_cnt++;
+			pxmitframe->bpending[i]  = _TRUE;
+			_rtw_spinunlock(&pxmitpriv->lock);
+			
+			pxmitframe->sz[i] = cnt;
+			pxmitframe->ac_tag[i] = ac_tag;
+
+			break;
+		}
+	}	
+
+
+	//TODO:
+	if (pdvobj_priv->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ishighspeed, cnt=%d\n", cnt));
+		//	cnt=cnt+1;
+			bwritezero = _TRUE;
+
+		}	
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("cnt=%d\n", cnt));
+		//	cnt=cnt+1;
+			bwritezero = _TRUE;
+
+		}	
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_write_port: pipe handle convert\n"));
+
+	//translate DMA FIFO addr to pipehandle
+	hPipe = ffaddr2pipehdl(pdvobj_priv, addr);
+
+
+#if 0
+	// for tx fifo, the maximum payload number is 8,
+	// we workaround this issue here by separate whole fifo into 8 segments.
+	if (cnt <= 500)
+		cnt = 500;
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_,
+		("usb_write_port(%u): pxmitframe %X  pxmitframe->padapter %X\n",__LINE__, pxmitframe, pxmitframe->padapter));
+
+	pxmitpriv->usb_transfer_write_port = (*usb_funcs_vp->lpIssueBulkTransfer)(
+						        hPipe, usb_write_port_complete, 
+						        pxmitframe, USB_OUT_TRANSFER,
+					    	    cnt, pxmitframe->mem_addr, 0);
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+
+	ptr=(u8 *)&pxmitframe->mem;
+
+#if 0
+	if (pdvobj_priv->ishighspeed)
+	{
+		ptr=ptr+512;
+	}
+	else
+	{
+		ptr=ptr+64;
+
+	}
+#endif
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+
+//	if (!pxmitframe->usb_transfer_xmit)
+//	    padapter->bSurpriseRemoved=_TRUE;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	bResult = _SUCCESS;
+
+exit:
+_func_exit_;
+	return bResult;
+}
+
+DWORD usb_write_port_complete( LPVOID Context )
+{
+
+//    u8 *ptr;
+
+    struct xmit_frame *	pxmitframe  = (struct xmit_frame *) Context;
+    _adapter          * padapter    = pxmitframe->padapter;
+    struct dvobj_priv *	pdvobj_priv = (struct dvobj_priv *)&padapter->dvobjpriv;
+	struct xmit_priv  * pxmitpriv   = &padapter->xmitpriv;
+	struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+	int		fComplete			=_FALSE;
+	DWORD	dwBytesTransferred	= 0;
+	DWORD	dwErr				= USB_CANCELED_ERROR;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u), pxmitframe %X\n",__FUNCTION__, __LINE__, Context));
+
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("+usb_write_port_complete\n"));
+
+	_rtw_spinlock_ex(&pxmitpriv->lock);	
+	pxmitpriv->txirp_cnt--;
+	_rtw_spinunlock_ex(&pxmitpriv->lock);
+
+	if(pxmitpriv->txirp_cnt==0){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: txirp_cnt== 0, set allrxreturnevt!\n"));		
+		_rtw_up_sema(&(pxmitpriv->tx_retevt));
+	}
+
+
+	//not to consider tx fragment
+	rtw_free_xmitframe(pxmitpriv, pxmitframe);		
+
+
+#if 1
+			
+	(*usb_funcs_vp->lpGetTransferStatus)(pxmitpriv->usb_transfer_write_port, &dwBytesTransferred, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pxmitpriv->usb_transfer_write_port);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_port_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(pxmitpriv->usb_transfer_write_port);
+
+#else
+
+	if((*usb_funcs_vp->lpIsTransferComplete)(pxmitpriv->usb_transfer_write_port))
+	{
+		(*usb_funcs_vp->lpCloseTransfer)(pxmitpriv->usb_transfer_write_port);
+	}
+
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, 
+		("%s(%u): pxmitpriv %X pxmitpriv->free_xmitframe_cnt %X pxmitframe->padapter %X pxmitframe->padapter %X\n", 
+		__LINE__, pxmitpriv, pxmitpriv->free_xmitframe_cnt, pxmitframe->padapter));
+
+    rtl8192cu_xmitframe_complete(padapter, pxmitpriv, pxmitbuf);
+
+_func_exit_;
+
+    return STATUS_SUCCESS;
+}
+
+DWORD usb_write_scsi_complete(LPVOID pTxContext) 
+{
+#ifndef PLATFORM_OS_CE
+	struct SCSI_BUFFER_ENTRY *psb_entry = (struct SCSI_BUFFER_ENTRY *)pTxContext;
+	_adapter 				 *padapter 	= psb_entry->padapter;
+	struct SCSI_BUFFER 		 *psb 		= padapter->pscsi_buf;
+	struct xmit_priv 		 *pxmitpriv = &(padapter->xmitpriv);
+    struct dvobj_priv 		*pdvobj_priv = (struct dvobj_priv *)&padapter->dvobjpriv;
+	LPCUSB_FUNCS 		  	 lpUsbFuncs = pdvobj_priv->pUsbExtension->_lpUsbFuncs;
+
+	int 	fComplete			=_FALSE;
+	DWORD	dwBytesTransferred	= 0;
+	DWORD	dwErr				= USB_CANCELED_ERROR;
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u): circ_space = %d\n",__FUNCTION__, __LINE__, CIRC_SPACE( psb->head,psb->tail,  SCSI_BUFFER_NUMBER)));
+
+#if 1
+				
+	(*lpUsbFuncs->lpGetTransferStatus)(psb_entry->usb_transfer_scsi_txcmd, &dwBytesTransferred, &dwErr);
+	fComplete = (*lpUsbFuncs->lpIsTransferComplete)(psb_entry->usb_transfer_scsi_txcmd);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_scsi_complete CloseTransfer before complete\n"));
+	}
+	(*lpUsbFuncs->lpCloseTransfer)(psb_entry->usb_transfer_scsi_txcmd);
+	
+#else
+
+	if((*lpUsbFuncs->lpIsTransferComplete)(psb_entry->usb_transfer_scsi_txcmd))
+		(*lpUsbFuncs->lpCloseTransfer)(psb_entry->usb_transfer_scsi_txcmd);
+#endif
+
+	memset(psb_entry->entry_memory, 0, 8);
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	if((psb->tail+1)==SCSI_BUFFER_NUMBER)
+		psb->tail=0;
+	else 
+		psb->tail++;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	if(CIRC_CNT(psb->head,psb->tail,SCSI_BUFFER_NUMBER)==0){
+		RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("write_txcmd_scsififo_callback: up_sema\n"));
+		_rtw_up_sema(&pxmitpriv->xmit_sema);
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	if(padapter->bSurpriseRemoved) {
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+_func_exit_;
+#endif
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	return STATUS_MORE_PROCESSING_REQUIRED;
+}
+
+uint usb_write_scsi(struct intf_hdl *pintfhdl, u32 cnt, u8 *wmem)
+{
+
+#ifndef PLATFORM_OS_CE
+
+	_adapter 		  *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv *pdev 	= (struct dvobj_priv*)&padapter->dvobjpriv;
+
+	struct SCSI_BUFFER       *psb      =padapter->pscsi_buf;
+	struct SCSI_BUFFER_ENTRY *psb_entry=LIST_CONTAINOR(wmem,struct SCSI_BUFFER_ENTRY,entry_memory);
+
+_func_enter_;
+	if(padapter->bSurpriseRemoved||padapter->bDriverStopped)
+		return 0;
+	
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	psb_entry->usb_transfer_scsi_txcmd=pdev->pUsbExtension->_lpUsbFuncs->lpIssueBulkTransfer(
+			pdev->scsi_out_pipehandle,
+			usb_write_scsi_complete,
+			psb_entry,
+			USB_OUT_TRANSFER,
+			cnt,
+			wmem,
+			0);
+	
+_func_exit_;
+#endif
+
+   return _SUCCESS;  
+}
+
+
+/*
+ */
+uint usb_init_intf_priv(struct intf_priv *pintfpriv)
+{
+	// get the dvobj_priv object
+	struct dvobj_priv * pNdisCEDvice = (struct dvobj_priv *) pintfpriv->intf_dev;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	// set init intf_priv init status as _IOREADY
+	pintfpriv->intf_status = _IOREADY;
+
+	//  determine the max io size by dvobj_priv.ishighspeed
+	if(pNdisCEDvice->ishighspeed)
+		pintfpriv->max_iosz =  128;
+	else
+		pintfpriv->max_iosz =  64;
+
+	//  read/write size set as 0
+	pintfpriv->io_wsz = 0;
+	pintfpriv->io_rsz = 0;
+
+	//  init io_rwmem buffer
+	pintfpriv->allocated_io_rwmem = rtw_zmalloc(pintfpriv->max_iosz +4);
+	if (pintfpriv->allocated_io_rwmem == NULL)
+	{
+		rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz +4);
+		return _FAIL;
+	}
+	else
+	{
+		// word align the io_rwmem
+		pintfpriv->io_rwmem = pintfpriv->allocated_io_rwmem + 4 - ( (u32)(pintfpriv->allocated_io_rwmem) & 3);
+	}
+
+#ifndef PLATFORM_OS_CE
+
+	//  init io_r_mem buffer
+	pintfpriv->allocated_io_r_mem = rtw_zmalloc(pintfpriv->max_iosz +4);
+	if (pintfpriv->allocated_io_r_mem == NULL)
+	{
+		rtw_mfree((u8 *)(pintfpriv->allocated_io_r_mem), pintfpriv->max_iosz +4);
+		return _FAIL;
+	}
+	else
+	{
+		// word align the io_rwmem
+		pintfpriv->io_r_mem = pintfpriv->allocated_io_r_mem + 4 - ( (u32)(pintfpriv->allocated_io_r_mem) & 3);
+	}
+#endif
+
+	return _SUCCESS;
+}
+
+void usb_unload_intf_priv(struct intf_priv *pintfpriv)
+{
+#ifndef PLATFORM_OS_CE
+
+	rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz+4);
+	rtw_mfree((u8 *)(pintfpriv->allocated_io_r_mem), pintfpriv->max_iosz+4);
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+}
+
+
+
+void usb_write_port_cancel(_adapter *padapter)
+{
+
+	sint i,j;
+	struct dvobj_priv   *pdev = &padapter->dvobjpriv;
+	struct xmit_priv *pxmitpriv=&padapter->xmitpriv;
+	struct xmit_frame *pxmitframe;
+
+	_rtw_spinlock(&pxmitpriv->lock);
+	pxmitpriv->txirp_cnt--; //decrease 1 for Initialize ++
+	_rtw_spinunlock(&pxmitpriv->lock);
+	
+	if (pxmitpriv->txirp_cnt) 
+	{
+		// Canceling Pending Recv Irp
+		pxmitframe= (struct xmit_frame *)pxmitpriv->pxmit_frame_buf;
+		
+		for( i = 0; i < NR_XMITFRAME; i++ )
+		{
+			for(j=0;j<8;j++)
+			{
+				if (pxmitframe->bpending[j]==_TRUE)
+				{			
+
+					RT_TRACE(_module_hci_ops_os_c_,_drv_err_,(" usb_write_port_cancel() :IoCancelIrp\n"));
+
+				}
+			}
+			
+			pxmitframe++;
+		}
+
+		_rtw_down_sema(&(pxmitpriv->tx_retevt));
+		
+	}
+
+}
+
+DWORD usbctrl_vendorreq_complete(LPVOID lpvNotifyParameter)
+{
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv*)lpvNotifyParameter;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("+usbctrl_vendorreq_complete\n"));
+	
+    return STATUS_SUCCESS;
+}
+
+
+int usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	u8			ret=_TRUE;
+//	NTSTATUS	ntstatus;
+//	int 		fComplete;
+//	LPCUSB_DEVICE		lpDeviceInfo;
+
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfpriv->intf_dev;   
+
+    USB_TRANSFER        usbTrans;
+    USB_DEVICE_REQUEST  usb_device_req;
+    USB_HANDLE      usbHandle   = pdvobjpriv->usb_extension._hDevice;
+    LPCUSB_FUNCS    usbFuncs    = pdvobjpriv->usb_extension._lpUsbFuncs;
+
+	u32	transfer_flags = 0;
+
+	_func_enter_;
+
+    memset( &usb_device_req, 0, sizeof( USB_DEVICE_REQUEST ) );
+
+    if( 0x01 == requesttype )
+	{
+        usb_device_req.bmRequestType = USB_REQUEST_DEVICE_TO_HOST | USB_REQUEST_VENDOR | USB_REQUEST_FOR_DEVICE;
+    }
+	else
+    {
+        usb_device_req.bmRequestType = USB_REQUEST_HOST_TO_DEVICE | USB_REQUEST_VENDOR | USB_REQUEST_FOR_DEVICE;
+    }
+
+	usb_device_req.bRequest 		= request;
+	usb_device_req.wValue 			= value;
+	usb_device_req.wIndex 	    	= index;
+	usb_device_req.wLength 	    	= len;    
+
+	if (requesttype == 0x01)
+	{
+		transfer_flags = USB_IN_TRANSFER;//read_in
+	}
+	else
+	{
+		transfer_flags= USB_OUT_TRANSFER;//write_out
+	}
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("+usbctrl_vendorreq\n",__FUNCTION__,__LINE__));
+
+#if 0
+	// Remember to add callback for sync
+	usbTrans = (*usbFuncs->lpIssueVendorTransfer)(usbHandle, 
+							usbctrl_vendorreq_complete, pdvobjpriv, 
+							transfer_flags, &usb_device_req, pdata, 0);
+#else
+	// Remember to add callback for sync
+	usbTrans = (*usbFuncs->lpIssueVendorTransfer)(usbHandle, 
+							NULL, 0, 
+							transfer_flags, &usb_device_req, pdata, 0);
+#endif
+
+//	rtw_usleep_os(10);
+
+	if ( usbTrans )
+	{
+		DWORD	dwBytes 	= 0;
+		DWORD	dwErr		= USB_CANCELED_ERROR;
+		int 	fComplete;
+
+		(*usbFuncs->lpGetTransferStatus)(usbTrans, &dwBytes, &dwErr);
+
+		fComplete = (*usbFuncs->lpIsTransferComplete)(usbTrans);
+
+		if (fComplete== _TRUE)
+		{
+			(*usbFuncs->lpCloseTransfer)(usbTrans);
+			RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("usbctrl_vendorreq lpCloseTransfer\n"));
+		}
+
+		if ( dwErr != USB_NO_ERROR || fComplete != _TRUE)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq lpCloseTransfer without complete\n"));
+			ret = _FALSE;
+			goto exit;
+		}
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq without usbTrans\n"));
+		ret = _FALSE;
+		goto exit;
+
+	}
+
+exit:
+	RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("-usbctrl_vendorreq\n"));
+_func_exit_;
+	
+	return ret;	
+
+}
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c
new file mode 100755
index 0000000000000..2d627d303122a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c
@@ -0,0 +1,1536 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_OPS_OS_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+#include <usb_ops.h>
+#include <circ_buf.h>
+#include <recv_osdep.h>
+#include <rtl8192c_hal.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u8 request, u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	_adapter *padapter = pintfhdl->padapter;
+	struct dvobj_priv  *pdvobjpriv = adapter_to_dvobj(padapter); 
+	struct usb_device *udev = pdvobjpriv->pusbdev;
+
+	unsigned int pipe;
+	int status = 0;
+	u32 tmp_buflen=0;
+	u8 reqtype;
+	u8 *pIo_buf;
+	int vendorreq_times = 0;
+
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+	u8 *tmp_buf;
+	#else // use stack memory
+	u8 tmp_buf[MAX_USB_IO_CTL_SIZE];
+	#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->adapter_type > PRIMARY_ADAPTER)
+	{
+		padapter = padapter->pbuddy_adapter;
+		pdvobjpriv = adapter_to_dvobj(padapter);
+		udev = pdvobjpriv->pusbdev;
+	}
+#endif
+
+
+	//DBG_871X("%s %s:%d\n",__FUNCTION__, current->comm, current->pid);
+
+	if((padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx)){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq:(padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		status = -EPERM; 
+		goto exit;
+	}	
+
+	if(len>MAX_VENDOR_REQ_CMD_SIZE){
+		DBG_8192C( "[%s] Buffer len error ,vendor request failed\n", __FUNCTION__ );
+		status = -EINVAL;
+		goto exit;
+	}	
+
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_enter_critical_mutex(&pdvobjpriv->usb_vendor_req_mutex, NULL);
+	#endif
+	
+	
+	// Acquire IO memory for vendorreq
+#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	pIo_buf = pdvobjpriv->usb_vendor_req_buf;
+#else
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+	tmp_buf = rtw_malloc( (u32) len + ALIGNMENT_UNIT);
+	tmp_buflen =  (u32)len + ALIGNMENT_UNIT;
+	#else // use stack memory
+	tmp_buflen = MAX_USB_IO_CTL_SIZE;
+	#endif
+
+	// Added by Albert 2010/02/09
+	// For mstar platform, mstar suggests the address for USB IO should be 16 bytes alignment.
+	// Trying to fix it here.
+	pIo_buf = (tmp_buf==NULL)?NULL:tmp_buf + ALIGNMENT_UNIT -((SIZE_PTR)(tmp_buf) & 0x0f );	
+#endif
+
+	if ( pIo_buf== NULL) {
+		DBG_8192C( "[%s] pIo_buf == NULL \n", __FUNCTION__ );
+		status = -ENOMEM;
+		goto release_mutex;
+	}
+	
+	while(++vendorreq_times<= MAX_USBCTRL_VENDORREQ_TIMES)
+	{
+		_rtw_memset(pIo_buf, 0, len);
+		
+		if (requesttype == 0x01)
+		{
+			pipe = usb_rcvctrlpipe(udev, 0);//read_in
+			reqtype =  REALTEK_USB_VENQT_READ;		
+		} 
+		else 
+		{
+			pipe = usb_sndctrlpipe(udev, 0);//write_out
+			reqtype =  REALTEK_USB_VENQT_WRITE;		
+			_rtw_memcpy( pIo_buf, pdata, len);
+		}		
+	
+		#if 0
+		//timeout test for firmware downloading
+		status = rtw_usb_control_msg(udev, pipe, request, reqtype, value, index, pIo_buf, len
+			, ((value >= FW_8192C_START_ADDRESS && value <= FW_8192C_END_ADDRESS) ||value!=0x1000) ?RTW_USB_CONTROL_MSG_TIMEOUT : RTW_USB_CONTROL_MSG_TIMEOUT_TEST
+		);
+		#else
+		status = rtw_usb_control_msg(udev, pipe, request, reqtype, value, index, pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT);
+		#endif
+	
+		if ( status == len)   // Success this control transfer.
+		{
+			rtw_reset_continual_urb_error(pdvobjpriv);
+			if ( requesttype == 0x01 )
+			{   // For Control read transfer, we have to copy the read data from pIo_buf to pdata.
+				_rtw_memcpy( pdata, pIo_buf,  len );
+			}
+		}
+		else { // error cases
+			DBG_8192C("reg 0x%x, usb %s %u fail, status:%d value=0x%x, vendorreq_times:%d\n"
+				, value,(requesttype == 0x01)?"read":"write" , len, status, *(u32*)pdata, vendorreq_times);
+			
+			if (status < 0) {
+				if(status == (-ESHUTDOWN)	|| status == -ENODEV	)
+				{			
+					padapter->bSurpriseRemoved = _TRUE;
+				} else {
+					#ifdef DBG_CONFIG_ERROR_DETECT
+					{
+						HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+						pHalData->srestpriv.Wifi_Error_Status = USB_VEN_REQ_CMD_FAIL;
+					}
+					#endif
+				}
+			}
+			else // status != len && status >= 0
+			{
+				if(status > 0) {
+					if ( requesttype == 0x01 )
+					{   // For Control read transfer, we have to copy the read data from pIo_buf to pdata.
+						_rtw_memcpy( pdata, pIo_buf,  len );
+					}
+				}
+			}
+
+			if(rtw_inc_and_chk_continual_urb_error(pdvobjpriv) == _TRUE ){
+				padapter->bSurpriseRemoved = _TRUE;
+				break;
+			}
+	
+		}
+	
+		// firmware download is checksumed, don't retry
+		if( (value >= FW_8192C_START_ADDRESS && value <= FW_8192C_END_ADDRESS) || status == len )
+			break;
+	
+	}
+	
+	// release IO memory used by vendorreq
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+	rtw_mfree(tmp_buf, tmp_buflen);
+	#endif
+
+release_mutex:
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_exit_critical_mutex(&pdvobjpriv->usb_vendor_req_mutex, NULL);
+	#endif
+exit:
+	return status;
+
+}
+
+static u8 usb_read8(struct intf_hdl *pintfhdl, u32 addr)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data=0; 
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x01;//read_in
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 1;	
+	
+	usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return (u8)(le32_to_cpu(data)&0x0ff);
+		
+}
+
+static u16 usb_read16(struct intf_hdl *pintfhdl, u32 addr)
+{       
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data=0;
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x01;//read_in
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 2;	
+	
+	usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return (u16)(le32_to_cpu(data)&0xffff);
+	
+}
+
+static u32 usb_read32(struct intf_hdl *pintfhdl, u32 addr)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data=0;
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x01;//read_in
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 4;	
+	
+	usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return le32_to_cpu(data);
+	
+}
+
+static int usb_write8(struct intf_hdl *pintfhdl, u32 addr, u8 val)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data;
+	int ret;
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 1;
+	
+	data = val;
+	data = cpu_to_le32(data&0x000000ff);
+	
+	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+static int usb_write16(struct intf_hdl *pintfhdl, u32 addr, u16 val)
+{	
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data;
+	int ret;
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 2;
+	
+	data = val;
+	data = cpu_to_le32(data&0x0000ffff);
+	
+	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+static int usb_write32(struct intf_hdl *pintfhdl, u32 addr, u32 val)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data;
+	int ret;
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 4;
+	data = cpu_to_le32(val);	
+	
+
+	ret =usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+static int usb_writeN(struct intf_hdl *pintfhdl, u32 addr, u32 length, u8 *pdata)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u8 buf[VENDOR_CMD_MAX_DATA_LEN]={0};
+	int ret;
+	
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = length;
+	 _rtw_memcpy(buf, pdata, len );
+	
+	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, buf, len, requesttype);
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+static void usb_read_interrupt_complete(struct urb *purb, struct pt_regs *regs)
+{
+	int	err;
+	_adapter		*padapter = (_adapter	 *)purb->context;
+
+	if(purb->status==0)//SUCCESS
+	{
+		if (purb->actual_length > sizeof(INTERRUPT_MSG_FORMAT_EX))
+		{
+			DBG_8192C("usb_read_interrupt_complete: purb->actual_length > sizeof(INTERRUPT_MSG_FORMAT_EX) \n");
+		}
+
+		err = usb_submit_urb(purb, GFP_ATOMIC);
+		if((err) && (err != (-EPERM)))
+		{
+			DBG_8192C("cannot submit interrupt in-token(err = 0x%08x),urb_status = %d\n",err, purb->status);
+		}
+	}
+	else
+	{
+		DBG_8192C("###=> usb_read_interrupt_complete => urb status(%d)\n", purb->status);
+
+		switch(purb->status) {
+			case -EINVAL:
+			case -EPIPE:			
+			case -ENODEV:
+			case -ESHUTDOWN:
+				//padapter->bSurpriseRemoved=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bSurpriseRemoved=TRUE\n"));
+			case -ENOENT:
+				padapter->bDriverStopped=_TRUE;			
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped=TRUE\n"));
+				break;
+			case -EPROTO:
+				break;
+			case -EINPROGRESS:
+				DBG_8192C("ERROR: URB IS IN PROGRESS!/n");
+				break;
+			default:
+				break;				
+		}
+	}	
+
+}
+
+static u32 usb_read_interrupt(struct intf_hdl *pintfhdl, u32 addr)
+{
+	int	err;
+	unsigned int pipe;
+	u32	ret = _SUCCESS;
+	_adapter			*adapter = pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(adapter);
+	struct recv_priv	*precvpriv = &adapter->recvpriv;
+	struct usb_device	*pusbd = pdvobj->pusbdev;
+
+_func_enter_;
+
+	//translate DMA FIFO addr to pipehandle
+	pipe = ffaddr2pipehdl(pdvobj, addr);
+
+	usb_fill_int_urb(precvpriv->int_in_urb, pusbd, pipe, 
+					precvpriv->int_in_buf,
+            				sizeof(INTERRUPT_MSG_FORMAT_EX),
+            				usb_read_interrupt_complete,
+            				adapter,
+            				1);
+
+	err = usb_submit_urb(precvpriv->int_in_urb, GFP_ATOMIC);
+	if((err) && (err != (-EPERM)))
+	{
+		DBG_8192C("cannot submit interrupt in-token(err = 0x%08x),urb_status = %d\n",err, precvpriv->int_in_urb->status);
+		ret = _FAIL;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+#endif
+
+static s32 pre_recv_entry(union recv_frame *precvframe, struct recv_stat *prxstat, struct phy_stat *pphy_info)
+{	
+	s32 ret=_SUCCESS;
+#ifdef CONFIG_CONCURRENT_MODE	
+	u8 *primary_myid, *secondary_myid, *paddr1;
+	union recv_frame	*precvframe_if2 = NULL;
+	_adapter *primary_padapter = precvframe->u.hdr.adapter;
+	_adapter *secondary_padapter = primary_padapter->pbuddy_adapter;
+	struct recv_priv *precvpriv = &primary_padapter->recvpriv;
+	_queue *pfree_recv_queue = &precvpriv->free_recv_queue;
+	u8	*pbuf = precvframe->u.hdr.rx_data;
+	
+	if(!secondary_padapter)
+		return ret;
+	
+	paddr1 = GetAddr1Ptr(precvframe->u.hdr.rx_data);		
+
+	if(IS_MCAST(paddr1) == _FALSE)//unicast packets
+	{
+		//primary_myid = myid(&primary_padapter->eeprompriv);
+		secondary_myid = myid(&secondary_padapter->eeprompriv);
+
+		if(_rtw_memcmp(paddr1, secondary_myid, ETH_ALEN))
+		{			
+			//change to secondary interface
+			precvframe->u.hdr.adapter = secondary_padapter;
+		}	
+
+		//ret = recv_entry(precvframe);
+
+	}
+	else // Handle BC/MC Packets	
+	{
+		
+		u8 clone = _TRUE;
+#if 0		
+		u8 type, subtype, *paddr2, *paddr3;
+	
+		type =  GetFrameType(pbuf);
+		subtype = GetFrameSubType(pbuf); //bit(7)~bit(2)
+		
+		switch (type)
+		{
+			case WIFI_MGT_TYPE: //Handle BC/MC mgnt Packets
+				if(subtype == WIFI_BEACON)
+				{
+					paddr3 = GetAddr3Ptr(precvframe->u.hdr.rx_data);
+				
+					if (check_fwstate(&secondary_padapter->mlmepriv, _FW_LINKED) &&
+						_rtw_memcmp(paddr3, get_bssid(&secondary_padapter->mlmepriv), ETH_ALEN))
+					{
+						//change to secondary interface
+						precvframe->u.hdr.adapter = secondary_padapter;
+						clone = _FALSE;
+					}
+
+					if(check_fwstate(&primary_padapter->mlmepriv, _FW_LINKED) &&
+						_rtw_memcmp(paddr3, get_bssid(&primary_padapter->mlmepriv), ETH_ALEN))
+					{
+						if(clone==_FALSE)
+						{
+							clone = _TRUE;									
+						}	
+						else
+						{
+							clone = _FALSE;
+						}
+
+						precvframe->u.hdr.adapter = primary_padapter;	
+					}
+
+					if(check_fwstate(&primary_padapter->mlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) ||
+						check_fwstate(&secondary_padapter->mlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING))
+					{
+						clone = _TRUE;
+						precvframe->u.hdr.adapter = primary_padapter;	
+					}
+				
+				}
+				else if(subtype == WIFI_PROBEREQ)
+				{
+					//probe req frame is only for interface2
+					//change to secondary interface
+					precvframe->u.hdr.adapter = secondary_padapter;
+					clone = _FALSE;
+				}			
+				break;
+			case WIFI_CTRL_TYPE: // Handle BC/MC ctrl Packets
+			
+				break;
+			case WIFI_DATA_TYPE: //Handle BC/MC data Packets
+					//Notes: AP MODE never rx BC/MC data packets
+			
+				paddr2 = GetAddr2Ptr(precvframe->u.hdr.rx_data);
+
+				if(_rtw_memcmp(paddr2, get_bssid(&secondary_padapter->mlmepriv), ETH_ALEN))
+				{
+					//change to secondary interface
+					precvframe->u.hdr.adapter = secondary_padapter;
+					clone = _FALSE;
+				}
+
+				break;
+			default:
+			
+				break;			
+		}
+#endif
+
+		if(_TRUE == clone)
+		{
+			//clone/copy to if2
+			u8 shift_sz = 0;
+			u32 alloc_sz, skb_len;
+			_pkt	 *pkt_copy = NULL;
+			struct rx_pkt_attrib *pattrib = NULL;
+		
+			precvframe_if2 = rtw_alloc_recvframe(pfree_recv_queue);
+			if(precvframe_if2)
+			{
+				precvframe_if2->u.hdr.adapter = secondary_padapter;
+		
+				_rtw_init_listhead(&precvframe_if2->u.hdr.list);	
+				precvframe_if2->u.hdr.precvbuf = NULL;	//can't access the precvbuf for new arch.
+				precvframe_if2->u.hdr.len=0;
+
+				_rtw_memcpy(&precvframe_if2->u.hdr.attrib, &precvframe->u.hdr.attrib, sizeof(struct rx_pkt_attrib));
+
+				pattrib = &precvframe_if2->u.hdr.attrib;
+
+				//	Modified by Albert 20101213
+				//	For 8 bytes IP header alignment.
+				if (pattrib->qos)	//	Qos data, wireless lan header length is 26
+				{
+					shift_sz = 6;
+				}
+				else
+				{
+					shift_sz = 0;
+				}
+
+				skb_len = pattrib->pkt_len;
+
+				// for first fragment packet, driver need allocate 1536+drvinfo_sz+RXDESC_SIZE to defrag packet.
+				// modify alloc_sz for recvive crc error packet by thomas 2011-06-02
+				if((pattrib->mfrag == 1)&&(pattrib->frag_num == 0)){
+					//alloc_sz = 1664;	//1664 is 128 alignment.
+					if(skb_len <= 1650)
+						alloc_sz = 1664;
+					else
+						alloc_sz = skb_len + 14;
+				}
+				else {
+					alloc_sz = skb_len;
+					//	6 is for IP header 8 bytes alignment in QoS packet case.
+					//	8 is for skb->data 4 bytes alignment.
+					alloc_sz += 14;
+				}
+
+				pkt_copy = rtw_skb_alloc(alloc_sz);
+
+				if(pkt_copy)
+				{
+					pkt_copy->dev = secondary_padapter->pnetdev;
+					precvframe_if2->u.hdr.pkt = pkt_copy;
+					precvframe_if2->u.hdr.rx_head = pkt_copy->data;
+					precvframe_if2->u.hdr.rx_end = pkt_copy->data + alloc_sz;
+					skb_reserve( pkt_copy, 8 - ((SIZE_PTR)( pkt_copy->data ) & 7 ));//force pkt_copy->data at 8-byte alignment address
+					skb_reserve( pkt_copy, shift_sz );//force ip_hdr at 8-byte alignment address according to shift_sz.
+					_rtw_memcpy(pkt_copy->data, pbuf, skb_len);
+					precvframe_if2->u.hdr.rx_data = precvframe_if2->u.hdr.rx_tail = pkt_copy->data;
+					
+			
+					recvframe_put(precvframe_if2, skb_len);
+					//recvframe_pull(precvframe_if2, drvinfo_sz + RXDESC_SIZE);
+
+					rtl8192c_translate_rx_signal_stuff(precvframe_if2, pphy_info);
+	
+					ret = rtw_recv_entry(precvframe_if2);
+
+				} else {
+					rtw_free_recvframe(precvframe_if2, pfree_recv_queue);
+					DBG_8192C("%s()-%d: alloc_skb() failed!\n", __FUNCTION__, __LINE__);	
+				}
+
+			}
+			
+		}
+		
+	}
+
+	rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+
+	ret = rtw_recv_entry(precvframe);
+
+#endif
+
+	return ret;
+
+}
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+static int recvbuf2recvframe(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	u8	*pbuf;
+	u8	shift_sz = 0;
+	u16	pkt_cnt, drvinfo_sz;
+	u32	pkt_offset, skb_len, alloc_sz;
+	s32	transfer_len;
+	struct recv_stat	*prxstat;
+	struct phy_stat	*pphy_info = NULL;
+	_pkt				*pkt_copy = NULL;
+	union recv_frame	*precvframe = NULL;
+	struct rx_pkt_attrib	*pattrib = NULL;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	_queue			*pfree_recv_queue = &precvpriv->free_recv_queue;
+
+
+	transfer_len = (s32)precvbuf->transfer_len;	
+	pbuf = precvbuf->pbuf;
+
+	prxstat = (struct recv_stat *)pbuf;	
+	pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+	
+#if 0 //temp remove when disable usb rx aggregation
+	if((pkt_cnt > 10) || (pkt_cnt < 1) || (transfer_len<RXDESC_SIZE) ||(pkt_len<=0))
+	{		
+		return _FAIL;
+	}
+#endif
+	
+	do{		
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+			 ("recvbuf2recvframe: rxdesc=offsset 0:0x%08x, 4:0x%08x, 8:0x%08x, C:0x%08x\n",
+			  prxstat->rxdw0, prxstat->rxdw1, prxstat->rxdw2, prxstat->rxdw4));
+
+		prxstat = (struct recv_stat *)pbuf;
+
+		precvframe = rtw_alloc_recvframe(pfree_recv_queue);
+		if(precvframe==NULL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: precvframe==NULL\n"));
+			DBG_8192C("%s()-%d: rtw_alloc_recvframe() failed! RX Drop!\n", __FUNCTION__, __LINE__);	
+			goto _exit_recvbuf2recvframe;
+		}
+
+		_rtw_init_listhead(&precvframe->u.hdr.list);	
+		precvframe->u.hdr.precvbuf = NULL;	//can't access the precvbuf for new arch.
+		precvframe->u.hdr.len=0;
+
+		rtl8192c_query_rx_desc_status(precvframe, prxstat);
+
+		pattrib = &precvframe->u.hdr.attrib;
+		if(pattrib->physt)
+		{
+			pphy_info = (struct phy_stat *)(pbuf + RXDESC_OFFSET);
+		}
+
+		pkt_offset = RXDESC_SIZE + pattrib->drvinfo_sz + pattrib->shift_sz + pattrib->pkt_len;
+
+		if((pattrib->pkt_len<=0) || (pkt_offset>transfer_len))
+		{	
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("recvbuf2recvframe: pkt_len<=0\n"));
+			DBG_8192C("%s()-%d: RX Warning!\n", __FUNCTION__, __LINE__);	
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+			goto _exit_recvbuf2recvframe;
+		}
+
+		//	Modified by Albert 20101213
+		//	For 8 bytes IP header alignment.
+		if (pattrib->qos)	//	Qos data, wireless lan header length is 26
+		{
+			shift_sz = 6;
+		}
+		else
+		{
+			shift_sz = 0;
+		}
+
+		skb_len = pattrib->pkt_len;
+
+		// for first fragment packet, driver need allocate 1536+drvinfo_sz+RXDESC_SIZE to defrag packet.
+		// modify alloc_sz for recvive crc error packet by thomas 2011-06-02
+		if((pattrib->mfrag == 1)&&(pattrib->frag_num == 0)){
+			//alloc_sz = 1664;	//1664 is 128 alignment.
+			if(skb_len <= 1650)
+				alloc_sz = 1664;
+			else
+				alloc_sz = skb_len + 14;
+		}
+		else {
+			alloc_sz = skb_len;
+			//	6 is for IP header 8 bytes alignment in QoS packet case.
+			//	8 is for skb->data 4 bytes alignment.
+			alloc_sz += 14;
+		}
+
+		pkt_copy = rtw_skb_alloc(alloc_sz);
+
+		if(pkt_copy)
+		{
+			pkt_copy->dev = padapter->pnetdev;
+			precvframe->u.hdr.pkt = pkt_copy;
+			precvframe->u.hdr.rx_head = pkt_copy->data;
+			precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
+			skb_reserve( pkt_copy, 8 - ((SIZE_PTR)( pkt_copy->data ) & 7 ));//force pkt_copy->data at 8-byte alignment address
+			skb_reserve( pkt_copy, shift_sz );//force ip_hdr at 8-byte alignment address according to shift_sz.
+			_rtw_memcpy(pkt_copy->data, (pbuf + pattrib->shift_sz + pattrib->drvinfo_sz + RXDESC_SIZE), skb_len);
+			precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pkt_copy->data;
+		}
+		else
+		{
+			DBG_8192C("recvbuf2recvframe:can not allocate memory for skb copy\n");
+			//precvframe->u.hdr.pkt = rtw_skb_clone(pskb);
+			//precvframe->u.hdr.rx_head = precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pbuf;
+			//precvframe->u.hdr.rx_end = pbuf + (pkt_offset>1612?pkt_offset:1612);
+
+			precvframe->u.hdr.pkt = NULL;
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+
+			goto _exit_recvbuf2recvframe;
+		}
+
+		recvframe_put(precvframe, skb_len);
+		//recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);	
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+		switch(pHalData->UsbRxAggMode)
+		{
+			case USB_RX_AGG_DMA:
+			case USB_RX_AGG_MIX:
+				pkt_offset = (u16)_RND128(pkt_offset);
+				break;
+				case USB_RX_AGG_USB:
+				pkt_offset = (u16)_RND4(pkt_offset);
+				break;
+			case USB_RX_AGG_DISABLE:			
+			default:				
+				break;
+		}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(rtw_buddy_adapter_up(padapter))
+		{
+			if(pre_recv_entry(precvframe, prxstat, pphy_info) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+		else
+		{
+			rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+			if(rtw_recv_entry(precvframe) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+	
+#else
+		rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+		if(rtw_recv_entry(precvframe) != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+		}
+#endif
+
+		pkt_cnt--;
+		transfer_len -= pkt_offset;
+		pbuf += pkt_offset;	
+		precvframe = NULL;
+		pkt_copy = NULL;
+
+		if(transfer_len>0 && pkt_cnt==0)
+			pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+	}while((transfer_len>0) && (pkt_cnt>0));
+
+_exit_recvbuf2recvframe:
+
+	return _SUCCESS;
+}
+
+void rtl8192cu_recv_tasklet(void *priv)
+{	
+	struct recv_buf *precvbuf = NULL;
+	_adapter	*padapter = (_adapter*)priv;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	while (NULL != (precvbuf = rtw_dequeue_recvbuf(&precvpriv->recv_buf_pending_queue)))
+	{
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		{
+			DBG_8192C("recv_tasklet => bDriverStopped or bSurpriseRemoved \n");
+			
+			break;
+		}
+		
+
+		recvbuf2recvframe(padapter, precvbuf);
+
+		rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+	}	
+	
+}
+
+static void usb_read_port_complete(struct urb *purb, struct pt_regs *regs)
+{	
+	struct recv_buf	*precvbuf = (struct recv_buf *)purb->context;	
+	_adapter 			*padapter =(_adapter *)precvbuf->adapter;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete!!!\n"));
+	
+	precvpriv->rx_pending_cnt --;
+		
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped||padapter->bReadPortCancel)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)\n", padapter->bDriverStopped, padapter->bSurpriseRemoved));		
+
+		goto exit;
+	}
+
+	if(purb->status==0)//SUCCESS
+	{
+		if ((purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE))
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: (purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE)\n"));
+
+			rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+		}
+		else 
+		{			
+			rtw_reset_continual_urb_error(adapter_to_dvobj(padapter));
+			
+			precvbuf->transfer_len = purb->actual_length;	
+
+			//rtw_enqueue_rx_transfer_buffer(precvpriv, rx_transfer_buf);			
+			rtw_enqueue_recvbuf(precvbuf, &precvpriv->recv_buf_pending_queue);
+
+			tasklet_schedule(&precvpriv->recv_tasklet);			
+		}		
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete : purb->status(%d) != 0 \n", purb->status));
+	
+		DBG_8192C("###=> usb_read_port_complete => urb status(%d)\n", purb->status);
+
+		if(rtw_inc_and_chk_continual_urb_error(adapter_to_dvobj(padapter)) == _TRUE ){
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		switch(purb->status) {
+			case -EINVAL:
+			case -EPIPE:			
+			case -ENODEV:
+			case -ESHUTDOWN:
+				//padapter->bSurpriseRemoved=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bSurpriseRemoved=TRUE\n"));
+			case -ENOENT:
+				padapter->bDriverStopped=_TRUE;			
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped=TRUE\n"));
+				break;
+			case -EPROTO:
+			case -EILSEQ:
+			case -ETIME:
+			case -ECOMM:
+			case -EOVERFLOW:
+				#ifdef DBG_CONFIG_ERROR_DETECT	
+				{	
+					HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+					pHalData->srestpriv.Wifi_Error_Status = USB_READ_PORT_FAIL;			
+				}
+				#endif
+				rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);			
+				break;
+			case -EINPROGRESS:
+				DBG_8192C("ERROR: URB IS IN PROGRESS!/n");
+				break;
+			default:
+				break;				
+		}
+		
+	}	
+
+exit:	
+	
+_func_exit_;
+	
+}
+
+static u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{		
+	int err;
+	unsigned int pipe;
+	u32 ret = _SUCCESS;
+	PURB purb = NULL;
+	struct recv_buf	*precvbuf = (struct recv_buf *)rmem;
+	_adapter *adapter = pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(adapter);
+	struct recv_priv	*precvpriv = &adapter->recvpriv;
+	struct usb_device	*pusbd = pdvobj->pusbdev;
+
+_func_enter_;
+	
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return _FAIL;
+	}
+
+	if(precvbuf !=NULL)
+	{	
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+
+		if(precvbuf->pbuf)
+		{			
+			precvpriv->rx_pending_cnt++;
+		
+			purb = precvbuf->purb;		
+
+			//translate DMA FIFO addr to pipehandle
+			pipe = ffaddr2pipehdl(pdvobj, addr);	
+
+			usb_fill_bulk_urb(purb, pusbd, pipe, 
+						precvbuf->pbuf,
+                				MAX_RECVBUF_SZ,
+                				usb_read_port_complete,
+                				precvbuf);//context is precvbuf
+
+			purb->transfer_dma = precvbuf->dma_transfer_addr;
+			purb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;								
+
+			err = usb_submit_urb(purb, GFP_ATOMIC);	
+			if((err) && (err != (-EPERM)))
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("cannot submit rx in-token(err=0x%.8x), URB_STATUS =0x%.8x", err, purb->status));
+				DBG_8192C("cannot submit rx in-token(err = 0x%08x),urb_status = %d\n",err,purb->status);
+				ret = _FAIL;
+			}
+			
+		}
+			
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precvbuf ==NULL\n"));
+		ret = _FAIL;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+#else	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+static int recvbuf2recvframe(_adapter *padapter, _pkt *pskb)
+{
+	u8	*pbuf;
+	u8	shift_sz = 0;
+	u16	pkt_cnt;
+	u32	pkt_offset, skb_len, alloc_sz;
+	s32	transfer_len;
+	struct recv_stat	*prxstat;
+	struct phy_stat	*pphy_info = NULL;
+	_pkt				*pkt_copy = NULL;
+	union recv_frame	*precvframe = NULL;
+	struct rx_pkt_attrib	*pattrib = NULL;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	_queue			*pfree_recv_queue = &precvpriv->free_recv_queue;
+
+
+	transfer_len = (s32)pskb->len;	
+	pbuf = pskb->data;
+
+	prxstat = (struct recv_stat *)pbuf;	
+	pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+#if 0 //temp remove when disable usb rx aggregation
+	if((pkt_cnt > 10) || (pkt_cnt < 1) || (transfer_len<RXDESC_SIZE) ||(pkt_len<=0))
+	{		
+		return _FAIL;
+	}
+#endif
+
+	do{		
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+			 ("recvbuf2recvframe: rxdesc=offsset 0:0x%08x, 4:0x%08x, 8:0x%08x, C:0x%08x\n",
+			  prxstat->rxdw0, prxstat->rxdw1, prxstat->rxdw2, prxstat->rxdw4));
+
+		prxstat = (struct recv_stat *)pbuf;
+
+		precvframe = rtw_alloc_recvframe(pfree_recv_queue);
+		if(precvframe==NULL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: precvframe==NULL\n"));
+			DBG_8192C("%s()-%d: rtw_alloc_recvframe() failed! RX Drop!\n", __FUNCTION__, __LINE__);	
+			goto _exit_recvbuf2recvframe;
+		}
+
+		_rtw_init_listhead(&precvframe->u.hdr.list);	
+		precvframe->u.hdr.precvbuf = NULL;	//can't access the precvbuf for new arch.
+		precvframe->u.hdr.len=0;
+
+		rtl8192c_query_rx_desc_status(precvframe, prxstat);
+
+		pattrib = &precvframe->u.hdr.attrib;
+		if(pattrib->physt)
+		{
+			pphy_info = (struct phy_stat *)(pbuf + RXDESC_OFFSET);
+		}
+
+		pkt_offset = RXDESC_SIZE + pattrib->drvinfo_sz + pattrib->shift_sz + pattrib->pkt_len;
+
+		if((pattrib->pkt_len<=0) || (pkt_offset>transfer_len))
+		{	
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("recvbuf2recvframe: pkt_len<=0\n"));
+			DBG_8192C("%s()-%d: RX Warning!\n", __FUNCTION__, __LINE__);	
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+			goto _exit_recvbuf2recvframe;
+		}
+
+		//	Modified by Albert 20101213
+		//	For 8 bytes IP header alignment.
+		if (pattrib->qos)	//	Qos data, wireless lan header length is 26
+		{
+			shift_sz = 6;
+		}
+		else
+		{
+			shift_sz = 0;
+		}
+
+		skb_len = pattrib->pkt_len;
+
+		// for first fragment packet, driver need allocate 1536+drvinfo_sz+RXDESC_SIZE to defrag packet.
+		// modify alloc_sz for recvive crc error packet by thomas 2011-06-02
+		if((pattrib->mfrag == 1)&&(pattrib->frag_num == 0)){
+			//alloc_sz = 1664;	//1664 is 128 alignment.
+			if(skb_len <= 1650)
+				alloc_sz = 1664;
+			else
+				alloc_sz = skb_len + 14;
+		}
+		else {
+			alloc_sz = skb_len;
+			//	6 is for IP header 8 bytes alignment in QoS packet case.
+			//	8 is for skb->data 4 bytes alignment.
+			alloc_sz += 14;
+		}
+
+		pkt_copy = rtw_skb_alloc(alloc_sz);
+
+		if(pkt_copy)
+		{
+			pkt_copy->dev = padapter->pnetdev;
+			precvframe->u.hdr.pkt = pkt_copy;
+			precvframe->u.hdr.rx_head = pkt_copy->data;
+			precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
+			skb_reserve( pkt_copy, 8 - ((SIZE_PTR)( pkt_copy->data ) & 7 ));//force pkt_copy->data at 8-byte alignment address
+			skb_reserve( pkt_copy, shift_sz );//force ip_hdr at 8-byte alignment address according to shift_sz.
+			_rtw_memcpy(pkt_copy->data, (pbuf + pattrib->shift_sz + pattrib->drvinfo_sz + RXDESC_SIZE), skb_len);
+			precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pkt_copy->data;
+			
+		}
+		else
+		{
+			precvframe->u.hdr.pkt = rtw_skb_clone(pskb);
+			if(pkt_copy)
+			{
+				precvframe->u.hdr.rx_head = precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pbuf;
+				precvframe->u.hdr.rx_end = pbuf + alloc_sz;
+			}
+			else
+			{
+				DBG_8192C("recvbuf2recvframe: rtw_skb_clone fail\n");
+				rtw_free_recvframe(precvframe, pfree_recv_queue);
+				goto _exit_recvbuf2recvframe;
+			}
+		}
+
+		recvframe_put(precvframe, skb_len);
+		//recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);	
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+		switch(pHalData->UsbRxAggMode)
+		{
+			case USB_RX_AGG_DMA:
+			case USB_RX_AGG_MIX:
+				pkt_offset = (u16)_RND128(pkt_offset);
+				break;
+				case USB_RX_AGG_USB:
+				pkt_offset = (u16)_RND4(pkt_offset);
+				break;
+			case USB_RX_AGG_DISABLE:			
+			default:				
+				break;
+		}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(rtw_buddy_adapter_up(padapter))
+		{
+			if(pre_recv_entry(precvframe, prxstat, pphy_info) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+		else
+		{
+			rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+			if(rtw_recv_entry(precvframe) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+	
+#else
+		rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+		if(rtw_recv_entry(precvframe) != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+		}
+#endif		
+
+		pkt_cnt--;
+		transfer_len -= pkt_offset;
+		pbuf += pkt_offset;	
+		precvframe = NULL;
+		pkt_copy = NULL;
+
+		if(transfer_len>0 && pkt_cnt==0)
+			pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+	}while((transfer_len>0) && (pkt_cnt>0));
+
+_exit_recvbuf2recvframe:
+
+	return _SUCCESS;	
+}
+
+void rtl8192cu_recv_tasklet(void *priv)
+{
+	_pkt			*pskb;
+	_adapter		*padapter = (_adapter*)priv;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	
+	while (NULL != (pskb = skb_dequeue(&precvpriv->rx_skb_queue)))
+	{
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		{
+			DBG_8192C("recv_tasklet => bDriverStopped or bSurpriseRemoved \n");
+			rtw_skb_free(pskb);
+			break;
+		}
+	
+		recvbuf2recvframe(padapter, pskb);
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+
+		skb_reset_tail_pointer(pskb);
+
+		pskb->len = 0;
+		
+		skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
+		
+#else
+		rtw_skb_free(pskb);
+#endif
+				
+	}
+	
+}
+
+
+static void usb_read_port_complete(struct urb *purb, struct pt_regs *regs)
+{
+	_irqL irqL;
+	uint isevt, *pbuf;
+	struct recv_buf	*precvbuf = (struct recv_buf *)purb->context;	
+	_adapter 			*padapter =(_adapter *)precvbuf->adapter;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;	
+	
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete!!!\n"));
+	
+	//_enter_critical(&precvpriv->lock, &irqL);
+	//precvbuf->irp_pending=_FALSE;
+	//precvpriv->rx_pending_cnt --;
+	//_exit_critical(&precvpriv->lock, &irqL);
+		
+	precvpriv->rx_pending_cnt --;
+		
+	//if(precvpriv->rx_pending_cnt== 0)
+	//{		
+	//	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: rx_pending_cnt== 0, set allrxreturnevt!\n"));
+	//	_rtw_up_sema(&precvpriv->allrxreturnevt);	
+	//}
+
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped||padapter->bReadPortCancel)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)\n", padapter->bDriverStopped, padapter->bSurpriseRemoved));		
+		
+	#ifdef CONFIG_PREALLOC_RECV_SKB
+		precvbuf->reuse = _TRUE;
+	#else
+		if(precvbuf->pskb){
+			DBG_8192C("==> free skb(%p)\n",precvbuf->pskb);
+			rtw_skb_free(precvbuf->pskb);
+		}	
+	#endif
+		DBG_8192C("%s()-%d: RX Warning! bDriverStopped(%d) OR bSurpriseRemoved(%d) bReadPortCancel(%d)\n", 
+		__FUNCTION__, __LINE__,padapter->bDriverStopped, padapter->bSurpriseRemoved,padapter->bReadPortCancel);	
+		goto exit;
+	}
+
+	if(purb->status==0)//SUCCESS
+	{
+		if ((purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE))
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: (purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE)\n"));
+			precvbuf->reuse = _TRUE;
+			rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+			DBG_8192C("%s()-%d: RX Warning!\n", __FUNCTION__, __LINE__);	
+		}
+		else 
+		{	
+			rtw_reset_continual_urb_error(adapter_to_dvobj(padapter));
+			
+			precvbuf->transfer_len = purb->actual_length;			
+			skb_put(precvbuf->pskb, purb->actual_length);	
+			skb_queue_tail(&precvpriv->rx_skb_queue, precvbuf->pskb);
+
+			if (skb_queue_len(&precvpriv->rx_skb_queue)<=1)
+				tasklet_schedule(&precvpriv->recv_tasklet);
+
+			precvbuf->pskb = NULL;
+			precvbuf->reuse = _FALSE;
+			rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);			
+		}		
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete : purb->status(%d) != 0 \n", purb->status));
+	
+		DBG_8192C("###=> usb_read_port_complete => urb status(%d)\n", purb->status);
+
+		if(rtw_inc_and_chk_continual_urb_error(adapter_to_dvobj(padapter)) == _TRUE ){
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		switch(purb->status) {
+			case -EINVAL:
+			case -EPIPE:			
+			case -ENODEV:
+			case -ESHUTDOWN:
+				//padapter->bSurpriseRemoved=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bSurpriseRemoved=TRUE\n"));
+			case -ENOENT:
+				padapter->bDriverStopped=_TRUE;			
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped=TRUE\n"));
+				break;
+			case -EPROTO:
+			case -EILSEQ:
+			case -ETIME:
+			case -ECOMM:
+			case -EOVERFLOW:
+				#ifdef DBG_CONFIG_ERROR_DETECT	
+				{	
+					HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+					pHalData->srestpriv.Wifi_Error_Status = USB_READ_PORT_FAIL;			
+				}
+				#endif
+				precvbuf->reuse = _TRUE;
+				rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);			
+				break;
+			case -EINPROGRESS:
+				precvpriv->read_port_complete_EINPROGRESS_cnt++;
+				DBG_8192C("ERROR: URB IS IN PROGRESS!/n");
+				break;
+			default:
+				precvpriv->read_port_complete_other_urb_err_cnt++;
+				break;				
+		}
+		
+	}	
+
+exit:	
+	
+_func_exit_;
+	
+}
+
+static u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{	
+	_irqL irqL;
+	int err;
+	unsigned int pipe;
+	SIZE_PTR tmpaddr=0;
+	SIZE_PTR alignment=0;
+	u32 ret = _SUCCESS;
+	PURB purb = NULL;
+	struct recv_buf	*precvbuf = (struct recv_buf *)rmem;
+	_adapter		*adapter = pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(adapter);
+	struct recv_priv	*precvpriv = &adapter->recvpriv;
+	struct usb_device	*pusbd = pdvobj->pusbdev;
+	
+_func_enter_;
+	
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return _FAIL;
+	}
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+	if((precvbuf->reuse == _FALSE) || (precvbuf->pskb == NULL))
+	{
+		if (NULL != (precvbuf->pskb = skb_dequeue(&precvpriv->free_recv_skb_queue)))
+		{
+			precvbuf->reuse = _TRUE;
+		}
+	}
+#endif
+	
+
+	if(precvbuf !=NULL)
+	{	
+		rtl8192cu_init_recvbuf(adapter, precvbuf);		
+
+		//re-assign for linux based on skb
+		if((precvbuf->reuse == _FALSE) || (precvbuf->pskb == NULL))
+		{
+			precvbuf->pskb = rtw_skb_alloc(MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ);
+
+			if(precvbuf->pskb == NULL)		
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("init_recvbuf(): alloc_skb fail!\n"));
+				precvpriv->recvbuf_skb_alloc_fail_cnt++;
+				return _FAIL;
+			}	
+
+			tmpaddr = (SIZE_PTR)precvbuf->pskb->data;
+	        	alignment = tmpaddr & (RECVBUFF_ALIGN_SZ-1);
+			skb_reserve(precvbuf->pskb, (RECVBUFF_ALIGN_SZ - alignment));
+
+			precvbuf->phead = precvbuf->pskb->head;
+		   	precvbuf->pdata = precvbuf->pskb->data;
+			precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
+			precvbuf->pend = skb_end_pointer(precvbuf->pskb);
+			precvbuf->pbuf = precvbuf->pskb->data;
+		}	
+		else//reuse skb
+		{
+			precvbuf->phead = precvbuf->pskb->head;
+			precvbuf->pdata = precvbuf->pskb->data;
+			precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
+			precvbuf->pend = skb_end_pointer(precvbuf->pskb);
+       		precvbuf->pbuf = precvbuf->pskb->data;
+
+			precvbuf->reuse = _FALSE;
+		}
+
+		//_enter_critical(&precvpriv->lock, &irqL);
+		//precvpriv->rx_pending_cnt++;
+		//precvbuf->irp_pending = _TRUE;
+		//_exit_critical(&precvpriv->lock, &irqL);
+
+		precvpriv->rx_pending_cnt++;
+
+		purb = precvbuf->purb;
+
+		//translate DMA FIFO addr to pipehandle
+		pipe = ffaddr2pipehdl(pdvobj, addr);
+
+		usb_fill_bulk_urb(purb, pusbd, pipe, 
+						precvbuf->pbuf,
+                				MAX_RECVBUF_SZ,
+                				usb_read_port_complete,
+                				precvbuf);//context is precvbuf
+
+		err = usb_submit_urb(purb, GFP_ATOMIC);
+		if((err) && (err != (-EPERM)))
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("cannot submit rx in-token(err=0x%.8x), URB_STATUS =0x%.8x", err, purb->status));
+			DBG_8192C("cannot submit rx in-token(err = 0x%08x),urb_status = %d\n",err,purb->status);
+			ret = _FAIL;
+		}
+	}
+	else
+	{
+		precvpriv->recvbuf_null_cnt++;
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precvbuf ==NULL\n"));
+		ret = _FAIL;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+void rtl8192cu_xmit_tasklet(void *priv)
+{	
+	int ret = _FALSE;
+	_adapter *padapter = (_adapter*)priv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	if(check_fwstate(&padapter->mlmepriv, _FW_UNDER_SURVEY) == _TRUE)
+		return;
+
+	while(1)
+	{
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE) || (padapter->bWritePortCancel == _TRUE))
+		{
+			DBG_8192C("xmit_tasklet => bDriverStopped or bSurpriseRemoved or bWritePortCancel\n");
+			break;
+		}
+
+		ret = rtl8192cu_xmitframe_complete(padapter, pxmitpriv, NULL);
+
+		if(ret==_FALSE)
+			break;
+		
+	}
+	
+}
+
+void rtl8192cu_set_intf_ops(struct _io_ops	*pops)
+{
+	_func_enter_;
+	
+	_rtw_memset((u8 *)pops, 0, sizeof(struct _io_ops));	
+
+	pops->_read8 = &usb_read8;
+	pops->_read16 = &usb_read16;
+	pops->_read32 = &usb_read32;
+	pops->_read_mem = &usb_read_mem;
+	pops->_read_port = &usb_read_port;	
+	
+	pops->_write8 = &usb_write8;
+	pops->_write16 = &usb_write16;
+	pops->_write32 = &usb_write32;
+	pops->_writeN = &usb_writeN;
+	
+#ifdef CONFIG_USB_SUPPORT_ASYNC_VDN_REQ	
+	pops->_write8_async= &usb_async_write8;
+	pops->_write16_async = &usb_async_write16;
+	pops->_write32_async = &usb_async_write32;
+#endif	
+	pops->_write_mem = &usb_write_mem;
+	pops->_write_port = &usb_write_port;
+
+	pops->_read_port_cancel = &usb_read_port_cancel;
+	pops->_write_port_cancel = &usb_write_port_cancel;
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	pops->_read_interrupt = &usb_read_interrupt;
+#endif
+
+	_func_exit_;
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c
new file mode 100755
index 0000000000000..32ff645aecf38
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c
@@ -0,0 +1,1265 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_OPS_OS_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+	#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+#ifndef CONFIG_USB_HCI
+	#error "CONFIG_USB_HCI shall be on!\n"
+#endif
+
+
+#include <usb.h>
+#include <usbdlib.h>
+#include <usbioctl.h>
+
+#include <usb_ops.h>
+#include <recv_osdep.h>
+
+#include <usb_osintf.h>
+
+
+struct zero_bulkout_context
+{
+	void *pbuf;
+	void *purb;
+	void *pirp;
+	void *padapter;
+};
+
+#define usb_write_cmd usb_write_mem 
+#define usb_read_cmd usb_read_mem
+#define usb_write_cmd_complete usb_write_mem_complete
+//#define usb_read_cmd_complete usb_read_mem_complete
+
+
+
+uint usb_init_intf_priv(struct intf_priv *pintfpriv)
+{
+	        
+	PURB	piorw_urb;
+	u8		NextDeviceStackSize;
+	struct dvobj_priv   *pdev = (struct dvobj_priv   *)pintfpriv->intf_dev;
+	_adapter * padapter=pdev->padapter;
+
+_func_enter_;
+	
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("\n +usb_init_intf_priv\n"));
+
+	pintfpriv->intf_status = _IOREADY;
+
+       if(pdev->ishighspeed) pintfpriv->max_iosz =  128;
+	else pintfpriv->max_iosz =  64;	
+
+
+	_init_timer(&pintfpriv->io_timer, padapter->hndis_adapter, io_irp_timeout_handler, pintfpriv);
+
+	
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("usb_init_intf_priv:pintfpriv->max_iosz:%d\n",pintfpriv->max_iosz));
+
+	pintfpriv->io_wsz = 0;
+	pintfpriv->io_rsz = 0;	
+	
+ 	pintfpriv->allocated_io_rwmem = rtw_zmalloc(pintfpriv->max_iosz +4); 
+	
+   	if (pintfpriv->allocated_io_rwmem == NULL){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_init_intf_priv:pintfpriv->allocated_io_rwmem == NULL\n"));
+    		goto usb_init_intf_priv_fail;
+   	}
+
+	pintfpriv->io_rwmem = pintfpriv->allocated_io_rwmem +  4 \
+					-( (u32)(pintfpriv->allocated_io_rwmem) & 3);
+	
+
+     
+     NextDeviceStackSize = (u8)pdev->nextdevstacksz;//pintfpriv->pUsbDevObj->StackSize + 1; 
+
+      piorw_urb = (PURB)ExAllocatePool(NonPagedPool, sizeof(URB) ); 
+      if(piorw_urb == NULL) 
+	  goto usb_init_intf_priv_fail;
+	  
+      pintfpriv->piorw_urb = piorw_urb;
+
+      pintfpriv->piorw_irp = IoAllocateIrp(NextDeviceStackSize , FALSE);	 
+    
+
+      pintfpriv->io_irp_cnt=1;
+      pintfpriv->bio_irp_pending=_FALSE;
+	 
+     _rtw_init_sema(&(pintfpriv->io_retevt), 0);//NdisInitializeEvent(&pintfpriv->io_irp_return_evt);
+
+_func_exit_;
+	return _SUCCESS;
+
+usb_init_intf_priv_fail:
+
+	if (pintfpriv->allocated_io_rwmem)
+		rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz +4);
+	
+	if(piorw_urb)
+		ExFreePool(piorw_urb);	
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("\n -usb_init_intf_priv(usb_init_intf_priv_fail)\n"));
+
+_func_exit_;	
+	return _FAIL;
+		
+}
+
+void usb_unload_intf_priv(struct intf_priv *pintfpriv)
+{
+
+_func_enter_;
+	
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n+usb_unload_intf_priv\n"));
+	
+	rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz+4);
+	
+#ifdef PLATFORM_WINDOWS
+	if(pintfpriv->piorw_urb)
+		ExFreePool(pintfpriv->piorw_urb);	
+
+	if(pintfpriv->piorw_irp)
+		IoFreeIrp(pintfpriv->piorw_irp);
+#endif		
+
+
+#ifdef PLATFORM_LINUX
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\npintfpriv->io_irp_cnt=%d\n",pintfpriv->io_irp_cnt));
+	pintfpriv->io_irp_cnt--;
+	if(pintfpriv->io_irp_cnt){
+		if(pintfpriv->bio_irp_pending==_TRUE){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\nkill iorw_urb\n"));
+		usb_kill_urb(pintfpriv->piorw_urb);
+		}
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n wait io_retevt\n"));
+		_rtw_down_sema(&(pintfpriv->io_retevt));
+	}
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n cancel io_urb ok\n"));
+#endif
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n-usb_unload_intf_priv\n"));
+
+_func_exit_;
+	
+}
+
+void *ffaddr2pipehdl(struct dvobj_priv *pNdisCEDvice, u32 addr)
+{
+	HANDLE PipeHandle = NULL;
+	_adapter	*padapter = pNdisCEDvice->padapter;
+
+	
+	if(pNdisCEDvice->nr_endpoint == 11)
+	{		
+		switch(addr)
+		{	    
+	     		case RTL8712_DMA_BEQ:
+		 		PipeHandle= padapter->halpriv.pipehdls_r8712[3] ; 
+				break;
+	     		case RTL8712_DMA_BKQ:
+			 	PipeHandle=  padapter->halpriv.pipehdls_r8712[4]; 
+				break;
+	     		case RTL8712_DMA_VIQ:
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[2]; 
+				break;
+	    		case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1]; 
+				break;					
+                     case RTL8712_DMA_BCNQ:	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[6]; 
+				break;	 	
+			case RTL8712_DMA_BMCQ:	//HI Queue
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[7]; 
+				break;	
+			case RTL8712_DMA_MGTQ:				
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[8]; 
+				break;
+                     case RTL8712_DMA_RX0FF:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0]; 
+				break;	 	
+			case RTL8712_DMA_C2HCMD:		 	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5]; 
+				break;
+			case RTL8712_DMA_H2CCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[9]; 
+				break;	
+				
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 6)
+	{
+		switch(addr)
+		{	    
+	     		case RTL8712_DMA_BEQ:
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[3]; 
+				break;
+	     		case RTL8712_DMA_BKQ:
+			 	PipeHandle=  padapter->halpriv.pipehdls_r8712[4]; 
+				break;
+	     		case RTL8712_DMA_VIQ:
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[2]; 
+				break;
+	    		case RTL8712_DMA_VOQ:                   		
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[1]; 
+				break;
+                     case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:		 	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0]; 
+				break;
+			case RTL8712_DMA_H2CCMD:
+			case RTL8712_DMA_BCNQ:					
+			case RTL8712_DMA_BMCQ:	
+			case RTL8712_DMA_MGTQ:			
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5]; 
+				break;	
+				
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 4)
+	{
+		switch(addr)
+		{		
+	     		case RTL8712_DMA_BEQ:
+		 	//case RTL8712_DMA_BKQ:
+			 	PipeHandle=  padapter->halpriv.pipehdls_r8712[2]; 
+				break;
+	     		//case RTL8712_DMA_VIQ:
+		 	case RTL8712_DMA_VOQ:					
+		 		PipeHandle=  padapter->halpriv.pipehdls_r8712[1]; 
+				break;
+			case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:		 	
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0]; 
+				break;
+			case RTL8712_DMA_H2CCMD:	
+			case RTL8712_DMA_BCNQ:					
+			case RTL8712_DMA_BMCQ:	
+			case RTL8712_DMA_MGTQ:				
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[3]; 
+				break;	
+		}
+	
+	}
+	else
+	{
+	   RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ffaddr2pipehdl():nr_endpoint=%d error!\n", pNdisCEDvice->nr_endpoint));	   
+	}
+		
+	return PipeHandle;
+
+}
+
+
+NTSTATUS usb_bulkout_zero_complete(
+	PDEVICE_OBJECT	pUsbDevObj, 
+	PIRP		pIrp, void*	pZeroContext)
+{	
+	struct zero_bulkout_context *pcontext = (struct zero_bulkout_context *)pZeroContext;
+			   
+_func_enter_;
+
+	if(pcontext)
+	{
+		if(pcontext->pbuf)
+		{
+			ExFreePool(pcontext->pbuf);	  
+		}	
+
+		if(pcontext->purb)
+		{
+			ExFreePool(pcontext->purb);	
+		}
+
+		if(pcontext->pirp && (pIrp ==pcontext->pirp))
+		{			
+			IoFreeIrp(pIrp);
+		}
+
+		ExFreePool(pcontext);	
+	}	
+
+_func_exit_;
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+	
+
+}
+
+u32 usb_bulkout_zero(struct intf_hdl *pintfhdl, u32 addr)
+{	
+	struct zero_bulkout_context *pcontext;
+	unsigned char *pbuf;
+	char NextDeviceStackSize, len;
+	PIO_STACK_LOCATION	nextStack;
+	USBD_STATUS		usbdstatus;
+	HANDLE				PipeHandle;	
+	PIRP					pirp = NULL;
+	PURB				purb = NULL;	
+	NDIS_STATUS			ndisStatus = NDIS_STATUS_SUCCESS;
+	_adapter *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv	*pdvobj = (struct dvobj_priv *)&padapter->dvobjpriv;	
+
+
+_func_enter_;
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{		
+		return _FAIL;
+	}
+
+	len = 0;
+	NextDeviceStackSize = (char)pdvobj->nextdevstacksz;
+
+	pcontext = (struct zero_bulkout_context *)ExAllocatePool(NonPagedPool, sizeof(struct zero_bulkout_context));
+	pbuf = (unsigned char *)ExAllocatePool(NonPagedPool, sizeof(int));	
+    	purb = (PURB)ExAllocatePool(NonPagedPool, sizeof(URB));
+      	pirp = IoAllocateIrp(NextDeviceStackSize, FALSE);
+
+	pcontext->pbuf = pbuf;
+	pcontext->purb = purb;
+	pcontext->pirp = pirp;
+	pcontext->padapter = padapter;
+                    
+	//translate DMA FIFO addr to pipehandle
+	PipeHandle = ffaddr2pipehdl(pdvobj, addr);	
+
+
+	// Build our URB for USBD
+	UsbBuildInterruptOrBulkTransferRequest(
+				purb,
+				sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER),
+				PipeHandle,
+				pbuf, 
+				NULL, 
+				len, 
+				0, 
+				NULL);
+	
+	//
+	// call the calss driver to perform the operation
+	// pass the URB to the USB driver stack
+	//
+	nextStack = IoGetNextIrpStackLocation(pirp);
+	nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+	nextStack->Parameters.Others.Argument1 = purb;
+	nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+
+	//Set Completion Routine
+	IoSetCompletionRoutine(pirp,					// irp to use
+				               usb_bulkout_zero_complete,	// callback routine
+				               pcontext,				// context 
+				               TRUE,					// call on success
+				               TRUE,					// call on error
+				               TRUE);					// call on cancel
+
+	
+	// Call IoCallDriver to send the irp to the usb bus driver
+	//
+	ndisStatus = IoCallDriver(pdvobj->pnextdevobj, pirp);
+	usbdstatus = URB_STATUS(purb);
+
+	if( USBD_HALTED(usbdstatus) )
+	{		
+		padapter->bDriverStopped=_TRUE;
+		padapter->bSurpriseRemoved=_TRUE;
+	}
+
+	//
+	// The usb bus driver should always return STATUS_PENDING when bulk out irp async
+	//
+	if ( ndisStatus != STATUS_PENDING )
+	{		
+		return _FAIL;
+	} 	
+	
+_func_exit_;
+	
+	return _SUCCESS;
+
+}
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	_func_enter_;
+	
+
+	
+	_func_exit_;
+}
+
+NTSTATUS usb_write_mem_complete(PDEVICE_OBJECT	pUsbDevObj, PIRP piowrite_irp, PVOID pusb_cnxt)
+{
+		
+	_irqL irqL;
+	_list	*head, *plist;
+	struct io_req	*pio_req;	
+	struct io_queue *pio_q = (struct io_queue *) pusb_cnxt;
+	struct intf_hdl *pintf = &(pio_q->intf);	
+	struct intf_priv *pintfpriv = pintf->pintfpriv;	
+	_adapter *padapter = (_adapter *)pintf->adapter;
+	NTSTATUS status = STATUS_SUCCESS;
+
+	head = &(pio_q->processing);
+	
+	_func_enter_;
+	
+	_enter_critical_bh(&(pio_q->lock), &irqL);
+	
+	pintfpriv->io_irp_cnt--;
+	if(pintfpriv->io_irp_cnt ==0){		
+		_rtw_up_sema(&(pintfpriv->io_retevt));
+	}	
+	
+	pintfpriv->bio_irp_pending=_FALSE;
+	
+	switch(piowrite_irp->IoStatus.Status)
+	{		
+		case STATUS_SUCCESS:
+			break;
+			
+		default:
+			padapter->bSurpriseRemoved=_TRUE;
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usbAsynIntOutComplete:pioread_irp->IoStatus.Status !=STATUS_SUCCESS\n"));
+			break;
+	}				
+
+	//free irp in processing list...	
+	while(rtw_is_list_empty(head) != _TRUE)
+	{
+		plist = get_next(head);	
+		rtw_list_delete(plist);
+		pio_req = LIST_CONTAINOR(plist, struct io_req, list);
+		_rtw_up_sema(&pio_req->sema);
+	}	
+						
+	_exit_critical_bh(&(pio_q->lock), &irqL);
+
+	_func_exit_;
+	
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+	u32 bwritezero;
+	_irqL	irqL;
+	USBD_STATUS			usbdstatus;		
+	PIO_STACK_LOCATION		nextStack;
+	HANDLE				PipeHandle;	
+	struct io_req *pio_req;
+	
+	_adapter *adapter = (_adapter *)pintfhdl->adapter;
+	struct intf_priv *pintfpriv = pintfhdl->pintfpriv;
+	struct dvobj_priv   *pdev = (struct dvobj_priv   *)pintfpriv->intf_dev;      
+	PURB	piorw_urb = pintfpriv->piorw_urb;
+	PIRP		piorw_irp  = pintfpriv->piorw_irp; 	
+	struct io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;	
+	NTSTATUS NtStatus = STATUS_SUCCESS;	
+	
+	_func_enter_;	
+
+	pio_req = alloc_ioreq(pio_queue);
+	
+	if ((pio_req == NULL)||(adapter->bSurpriseRemoved)){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("async_irp_write32 : pio_req =0x%x adapter->bSurpriseRemoved=0x%x",pio_req,adapter->bSurpriseRemoved ));
+		goto exit;
+	}	
+	
+	_enter_critical_bh(&(pio_queue->lock), &irqL);
+	
+	rtw_list_insert_tail(&(pio_req->list),&(pio_queue->processing));
+
+
+#ifdef NDIS51_MINIPORT
+	IoReuseIrp(piorw_irp, STATUS_SUCCESS);
+#else
+	piorw_irp->Cancel = _FALSE;
+#endif
+
+	if((adapter->bDriverStopped) || (adapter->bSurpriseRemoved) ||(adapter->pwrctrlpriv.pnp_bstop_trx))	
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\npadapter->pwrctrlpriv.pnp_bstop_trx==_TRUE\n"));
+		_func_exit_;
+		return;
+	}
+
+	//translate DMA FIFO addr to pipehandle
+	PipeHandle = ffaddr2pipehdl(pdev, addr);	
+
+	
+	pintfpriv->io_irp_cnt++;
+	pintfpriv->bio_irp_pending=_TRUE;	
+	// Build our URB for USBD
+	UsbBuildInterruptOrBulkTransferRequest(
+				piorw_urb,
+				sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER),
+				PipeHandle,
+				(PVOID)wmem,
+				NULL, 
+				cnt, 
+				0, 
+				NULL);  
+
+	//
+	// call the calss driver to perform the operation
+	// pass the URB to the USB driver stack
+	//
+	nextStack = IoGetNextIrpStackLocation(piorw_irp);
+	nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+	nextStack->Parameters.Others.Argument1 = (PURB)piorw_urb;
+	nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+
+	IoSetCompletionRoutine(
+				piorw_irp,				// irp to use				
+				usb_write_mem_complete,		// routine to call when irp is done
+				pio_queue,				// context to pass routine
+				TRUE,					// call on success
+				TRUE,					// call on error
+				TRUE);					// call on cancel
+	
+	// 
+	// Call IoCallDriver to send the irp to the usb port
+	//
+	NtStatus	= IoCallDriver(pdev->pnextdevobj, piorw_irp);
+	usbdstatus = URB_STATUS(piorw_urb);
+
+	//
+	// The USB driver should always return STATUS_PENDING when
+	// it receives a write irp
+	//
+	if ((NtStatus != STATUS_PENDING) || USBD_HALTED(usbdstatus) ) {
+
+		if( USBD_HALTED(usbdstatus) ) {
+
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_mem():USBD_HALTED(usbdstatus)=%X!\n",USBD_HALTED(usbdstatus)) );
+		}
+		_func_exit_;
+		return;//STATUS_UNSUCCESSFUL;
+	}
+
+	_exit_critical_bh(&(pio_queue->lock), &irqL);
+	
+	_rtw_down_sema(&pio_req->sema);	
+	free_ioreq(pio_req, pio_queue);
+	
+
+	bwritezero = _FALSE;
+       if (pdev->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+			bwritezero = _TRUE;
+			
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+			bwritezero = _TRUE;		
+	}
+
+	
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+	
+exit:
+	
+	_func_exit_;
+	
+}
+
+NTSTATUS usb_read_port_complete(PDEVICE_OBJECT pUsbDevObj, PIRP pIrp, PVOID context)
+{	
+	uint isevt, *pbuf;
+	struct _URB_BULK_OR_INTERRUPT_TRANSFER	*pbulkurb;
+	USBD_STATUS		usbdstatus;	
+	struct recv_buf		*precvbuf = (struct recv_buf *)context;	
+	_adapter 				*adapter =(_adapter *)precvbuf->adapter;
+	struct recv_priv		*precvpriv = &adapter->recvpriv;
+	struct dvobj_priv   	*dev = (struct dvobj_priv   *)&adapter->dvobjpriv;
+	PURB				purb = precvbuf->purb;
+	struct intf_hdl 		*pintfhdl = &adapter->pio_queue->intf;
+	
+	//RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete!!!\n"));
+
+	usbdstatus = URB_STATUS(purb);
+	
+	_rtw_spinlock_ex(&precvpriv->lock);
+	precvbuf->irp_pending=_FALSE;
+	precvpriv->rx_pending_cnt --;
+	_rtw_spinunlock_ex(&precvpriv->lock);	
+	
+	if(precvpriv->rx_pending_cnt== 0) {		
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: rx_pending_cnt== 0, set allrxreturnevt!\n"));
+		_rtw_up_sema(&precvpriv->allrxreturnevt);	
+	}
+
+
+	if( pIrp->Cancel == _TRUE ) {
+		
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: One IRP has been cancelled succesfully\n"));
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+	if(adapter->bSurpriseRemoved) {
+
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)", adapter->bDriverStopped, adapter->bSurpriseRemoved));
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+	switch(pIrp->IoStatus.Status) 
+	{
+		case STATUS_SUCCESS:
+			
+			pbulkurb = &(precvbuf->purb)->UrbBulkOrInterruptTransfer;
+			if((pbulkurb->TransferBufferLength >(MAX_RECVBUF_SZ)) || (pbulkurb->TransferBufferLength < RXDESC_SIZE) ) 
+			{								
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port_complete: (pbulkurb->TransferBufferLength > MAX_RECVBUF_SZ) || (pbulkurb->TransferBufferLength < RXDESC_SIZE)\n"));
+				rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+			}
+			else 
+			{	
+			       precvbuf->transfer_len = pbulkurb->TransferBufferLength;
+
+				pbuf = (uint*)precvbuf->pbuf;
+
+				if((isevt = *(pbuf+1)&0x1ff) == 0x1ff)
+				{								
+					rxcmd_event_hdl(adapter, pbuf);//rx c2h events
+					
+					rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+				}
+				else
+				{
+					if(recvbuf2recvframe(adapter, precvbuf)==_FAIL)//rx packets
+					{
+						//precvbuf->reuse = _TRUE;		
+						rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+					}
+				}
+				
+			}
+	
+			break;
+			
+		default:
+			
+			if( !USBD_HALTED(usbdstatus) )
+			{				
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port_complete():USBD_HALTED(usbdstatus)=%x  (need to handle ) \n",USBD_HALTED(usbdstatus)));				
+			
+			}
+			else 
+			{				
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port_complete(): USBD_HALTED(usbdstatus)=%x \n\n", USBD_HALTED(usbdstatus)) );
+				adapter->bDriverStopped = _TRUE;
+				adapter->bSurpriseRemoved = _TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete(): USBD_HALTED(usbdstatus)=%x \n\n", USBD_HALTED(usbdstatus))) ;
+			}
+
+		      break;
+			  
+	}
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+	
+}
+
+u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	u8 					*pdata;
+	u16					size;
+	PURB				purb;
+	PIRP					pirp;
+	PIO_STACK_LOCATION	nextStack;
+	NTSTATUS			ntstatus;
+	USBD_STATUS		usbdstatus;
+	HANDLE				PipeHandle;	
+	struct recv_buf		*precvbuf = (struct recv_buf *)rmem;
+	struct intf_priv		*pintfpriv = pintfhdl->pintfpriv;
+	struct dvobj_priv		*pdev = (struct dvobj_priv   *)pintfpriv->intf_dev;
+	_adapter				*adapter = (_adapter *)pdev->padapter;
+	struct recv_priv		*precvpriv = &adapter->recvpriv;
+	u32					bResult = _FALSE;
+
+_func_enter_;
+	
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx) {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return bResult;
+	}
+
+	if(precvbuf !=NULL)
+	{
+
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+	
+		_rtw_spinlock(&precvpriv->lock);
+		precvpriv->rx_pending_cnt++;
+		precvbuf->irp_pending = _TRUE;
+		_rtw_spinunlock(&precvpriv->lock);
+
+	       pdata = (u8*)precvbuf->pbuf;
+
+		size	 = sizeof( struct _URB_BULK_OR_INTERRUPT_TRANSFER );
+		purb = precvbuf->purb;	
+
+		//translate DMA FIFO addr to pipehandle
+		PipeHandle = ffaddr2pipehdl(pdev, addr);	
+		 
+		UsbBuildInterruptOrBulkTransferRequest(
+			purb,
+			(USHORT)size,
+			PipeHandle,
+			pdata,
+			NULL, 
+			MAX_RECVBUF_SZ,
+			USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK, 
+			NULL
+			);
+
+		pirp = precvbuf->pirp;
+
+#if NDIS51_MINIPORT
+		IoReuseIrp(pirp, STATUS_SUCCESS);
+#else
+		pirp->Cancel = _FALSE;
+#endif
+
+		// call the class driver to perform the operation
+		// and pass the URB to the USB driver stack
+		nextStack = IoGetNextIrpStackLocation(pirp);
+		nextStack->Parameters.Others.Argument1 = purb;
+		nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+		nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+
+		IoSetCompletionRoutine(
+			pirp,					// irp to use
+			usb_read_port_complete,	// routine to call when irp is done
+			precvbuf,					// context to pass routine 
+			TRUE,					// call on success
+			TRUE,					// call on error
+			TRUE);					// call on cancel
+
+		//
+		// The IoCallDriver routine  
+		// sends an IRP to the driver associated with a specified device object.
+		//
+		ntstatus = IoCallDriver(pdev->pnextdevobj, pirp);
+		usbdstatus = URB_STATUS(purb);
+
+		if( USBD_HALTED(usbdstatus) ) {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port(): USBD_HALTED(usbdstatus=0x%.8x)=%.8x  \n\n", usbdstatus, USBD_HALTED(usbdstatus)));
+			pdev->padapter->bDriverStopped=_TRUE;
+			pdev->padapter->bSurpriseRemoved=_TRUE;
+		}
+
+		if( ntstatus == STATUS_PENDING )
+		{ 
+			bResult = _TRUE;// The IRP is pended in USBD as we expected.
+		}
+		else {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port(): IoCallDriver failed!!! IRP STATUS: %X\n", ntstatus));
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port(): IoCallDriver failed!!! USB STATUS: %X\n", usbdstatus));
+		}
+
+	}
+	else{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precv_frame ==NULL\n"));
+	}
+
+_func_exit_;
+	
+	return bResult;
+	
+}
+
+void usb_read_port_cancel(_adapter *padapter)
+{	
+	struct recv_buf  *precvbuf;
+	sint i;
+	struct dvobj_priv   *pdev = &padapter->dvobjpriv;
+	struct recv_priv *precvpriv=&padapter->recvpriv;	
+		
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n ==>usb_read_port_cancel\n"));
+
+	_rtw_spinlock(&precvpriv->lock);
+	precvpriv->rx_pending_cnt--; //decrease 1 for Initialize ++ 
+	_rtw_spinunlock(&precvpriv->lock);
+
+	if (precvpriv->rx_pending_cnt)
+	{
+		// Canceling Pending Recv Irp
+		precvbuf = (struct recv_buf  *)precvpriv->precv_buf;
+		
+		for( i = 0; i < NR_RECVBUFF; i++ )
+		{
+			if (precvbuf->irp_pending == _TRUE)
+			{	
+				IoCancelIrp(precvbuf->pirp);
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_cancel() :IoCancelIrp\n"));
+			}
+			
+			precvbuf++;
+		}
+		
+		_rtw_down_sema(&precvpriv->allrxreturnevt);
+		
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_cancel:down sema\n"));
+
+	}
+	
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("<==usb_read_port_cancel\n"));
+	
+}
+
+NTSTATUS usb_write_port_complete(
+	PDEVICE_OBJECT	pUsbDevObj,
+	PIRP				pIrp,
+	PVOID			pTxContext
+) 
+{	
+	u32	i, bIrpSuccess, sz;
+	NTSTATUS	status = STATUS_SUCCESS;
+	u8 *ptr;
+	struct xmit_frame	*pxmitframe = (struct xmit_frame *) pTxContext;
+        struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
+	_adapter			*padapter = pxmitframe->padapter;
+	struct dvobj_priv	*pdev =	(struct dvobj_priv *)&padapter->dvobjpriv;	
+	struct io_queue	*pio_queue = (struct io_queue *)padapter->pio_queue;
+	struct intf_hdl	*pintfhdl = &(pio_queue->intf);
+       struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;		
+	   
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("+usb_write_port_complete\n"));
+
+	_rtw_spinlock_ex(&pxmitpriv->lock);	
+	pxmitpriv->txirp_cnt--;
+	_rtw_spinunlock_ex(&pxmitpriv->lock);
+	
+	if(pxmitpriv->txirp_cnt==0){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: txirp_cnt== 0, set allrxreturnevt!\n"));		
+		_rtw_up_sema(&(pxmitpriv->tx_retevt));
+	}
+	
+	status = pIrp->IoStatus.Status;
+
+	if( status == STATUS_SUCCESS ) 
+		bIrpSuccess = _TRUE;	
+	else	
+		bIrpSuccess = _FALSE;
+	
+	if( pIrp->Cancel == _TRUE )
+	{		
+	    if(pxmitframe !=NULL)
+	    {	       
+	    		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port_complete:pIrp->Cancel == _TRUE,(pxmitframe !=NULL\n"));
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);			
+	    }
+		  	 
+	     return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+	if(padapter->bSurpriseRemoved)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+
+	//
+	// Send 0-byte here if necessary.
+	//
+	// <Note> 
+	// 1. We MUST keep at most one IRP pending in each endpoint, otherwise USB host controler driver will hang.
+	// Besides, even 0-byte IRP shall be count into #IRP sent down, so, we send 0-byte here instead of TxFillDescriptor8187().
+	// 2. If we don't count 0-byte IRP into an #IRP sent down, Tx will stuck when we download files via BT and 
+	// play online video on XP SP1 EHCU.
+	// 2005.12.26, by rcnjko.
+	//
+
+	
+	for(i=0; i< 8; i++)
+	{
+            if(pIrp == pxmitframe->pxmit_irp[i])
+            {
+		    pxmitframe->bpending[i] = _FALSE;//
+		    //ac_tag = pxmitframe->ac_tag[i];
+                  sz = pxmitframe->sz[i];
+		    break;		  
+            }
+	}
+
+#if 0	
+	pxmitframe->fragcnt--;
+	if(pxmitframe->fragcnt == 0)// if((pxmitframe->fragcnt == 0) && (pxmitframe->irpcnt == 8)){
+	{
+		//RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port_complete:pxmitframe->fragcnt == 0\n"));
+		rtw_free_xmitframe(pxmitpriv,pxmitframe);	          
+      	}
+#else	
+
+	//not to consider tx fragment
+	rtw_free_xmitframe(pxmitpriv, pxmitframe);		
+
+#endif	
+
+	rtl8192cu_xmitframe_complete(padapter, pxmitpriv, pxmitbuf);
+
+_func_exit_;
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+       u32 i, bwritezero;      	
+	u8 *ptr;
+	PIO_STACK_LOCATION	nextStack;
+	USBD_STATUS		usbdstatus;
+	HANDLE				PipeHandle;	
+	PIRP					pirp = NULL;
+	PURB				purb = NULL;	
+	NDIS_STATUS			ndisStatus = NDIS_STATUS_SUCCESS;
+	_adapter *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv	*pNdisCEDvice = (struct dvobj_priv   *)&padapter->dvobjpriv;	
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct xmit_frame *pxmitframe = (struct xmit_frame *)wmem;
+
+_func_enter_;
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return _FAIL;
+	}
+	
+
+	for(i=0; i<8; i++)
+       {
+		if(pxmitframe->bpending[i] == _FALSE)
+		{
+			_rtw_spinlock(&pxmitpriv->lock);	
+			pxmitpriv->txirp_cnt++;
+			pxmitframe->bpending[i]  = _TRUE;
+			_rtw_spinunlock(&pxmitpriv->lock);
+			
+			pxmitframe->sz[i] = cnt;
+			purb	= pxmitframe->pxmit_urb[i];
+			pirp	= pxmitframe->pxmit_irp[i];
+			
+			//pxmitframe->ac_tag[i] = ac_tag;
+			
+			break;	 
+		}
+       }	
+
+	bwritezero = _FALSE;
+       if (pNdisCEDvice->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ishighspeed, cnt=%d\n", cnt));
+			//cnt=cnt+1;
+			bwritezero = _TRUE;
+		}	
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("cnt=%d\n", cnt));
+			//cnt=cnt+1;
+			bwritezero = _TRUE;
+		}	
+	}
+	
+
+#ifdef NDIS51_MINIPORT
+	IoReuseIrp(pirp, STATUS_SUCCESS);
+#else
+	pirp->Cancel = _FALSE;
+#endif
+
+
+	//translate DMA FIFO addr to pipehandle
+	PipeHandle = ffaddr2pipehdl(pNdisCEDvice, addr);	
+
+
+	// Build our URB for USBD
+	UsbBuildInterruptOrBulkTransferRequest(
+				purb,
+				sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER),
+				PipeHandle,
+				pxmitframe->mem_addr, 
+				NULL, 
+				cnt, 
+				0, 
+				NULL);
+	
+	//
+	// call the calss driver to perform the operation
+	// pass the URB to the USB driver stack
+	//
+	nextStack = IoGetNextIrpStackLocation(pirp);
+	nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+	nextStack->Parameters.Others.Argument1 = purb;
+	nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+
+	//Set Completion Routine
+	IoSetCompletionRoutine(pirp,					// irp to use
+				               usb_write_port_complete,	// callback routine
+				               pxmitframe,				// context 
+				               TRUE,					// call on success
+				               TRUE,					// call on error
+				               TRUE);					// call on cancel
+
+	
+	// Call IoCallDriver to send the irp to the usb bus driver
+	//
+	ndisStatus = IoCallDriver(pNdisCEDvice->pnextdevobj, pirp);
+	usbdstatus = URB_STATUS(purb);
+
+	if( USBD_HALTED(usbdstatus) )
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port(): USBD_HALTED(usbdstatus)=%x set bDriverStopped TRUE!\n\n",USBD_HALTED(usbdstatus)) );
+		padapter->bDriverStopped=_TRUE;
+		padapter->bSurpriseRemoved=_TRUE;
+	}
+
+	//
+	// The usb bus driver should always return STATUS_PENDING when bulk out irp async
+	//
+	if ( ndisStatus != STATUS_PENDING )
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port(): ndisStatus(%x) != STATUS_PENDING!\n\n", ndisStatus));
+		
+		_func_exit_;
+		
+		return _FAIL;
+	} 	
+	
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+
+	
+_func_exit_;
+	
+	return _SUCCESS;
+
+}
+
+
+void usb_write_port_cancel(_adapter *padapter)
+{
+
+	sint i,j;
+	struct dvobj_priv   *pdev = &padapter->dvobjpriv;
+	struct xmit_priv *pxmitpriv=&padapter->xmitpriv;
+	struct xmit_frame *pxmitframe;
+
+	_rtw_spinlock(&pxmitpriv->lock);
+	pxmitpriv->txirp_cnt--; //decrease 1 for Initialize ++
+	_rtw_spinunlock(&pxmitpriv->lock);
+	
+	if (pxmitpriv->txirp_cnt) 
+	{
+		// Canceling Pending Recv Irp
+		pxmitframe= (struct xmit_frame *)pxmitpriv->pxmit_frame_buf;
+		
+		for( i = 0; i < NR_XMITFRAME; i++ )
+		{
+			for(j=0;j<8;j++)
+			{
+				if (pxmitframe->bpending[j]==_TRUE)
+				{			
+					IoCancelIrp(pxmitframe->pxmit_irp[j]);		
+					RT_TRACE(_module_hci_ops_os_c_,_drv_err_,(" usb_write_port_cancel() :IoCancelIrp\n"));
+
+				}
+			}
+			
+			pxmitframe++;
+		}
+
+		_rtw_down_sema(&(pxmitpriv->tx_retevt));
+		
+	}
+
+}
+
+
+/*! \brief Wrap the pUrb to an IRP and send this IRP to Bus Driver. Then wait for this IRP completion.
+	The Caller shall be at Passive Level.
+*/
+NTSTATUS  sync_callusbd(struct dvobj_priv *pdvobjpriv, PURB purb)
+{
+
+	KEVENT					kevent;
+	PIRP						irp;
+	IO_STATUS_BLOCK		iostatusblock;
+	PIO_STACK_LOCATION		nextstack;
+	USBD_STATUS			usbdstatus;
+	LARGE_INTEGER			waittime;
+	NTSTATUS ntstatus = STATUS_SUCCESS;
+	_adapter *padapter = pdvobjpriv->padapter;
+	
+
+	_func_enter_;
+
+//	if(padapter->bDriverStopped) {
+//		goto exit;
+//	}
+	
+	KeInitializeEvent(&kevent, NotificationEvent, _FALSE);
+	irp = IoBuildDeviceIoControlRequest(
+			IOCTL_INTERNAL_USB_SUBMIT_URB,
+			pdvobjpriv->pphysdevobj,//CEdevice->pUsbDevObj, 
+			NULL, 
+			0, 
+			NULL, 
+			0, 
+			_TRUE, 
+			&kevent, 
+			&iostatusblock);
+
+	if(irp == NULL) {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("SyncCallUSBD: memory alloc for irp failed\n"));
+		ntstatus=STATUS_INSUFFICIENT_RESOURCES;
+		goto exit;
+	}
+	
+	nextstack = IoGetNextIrpStackLocation(irp);
+	if(nextstack == NULL)	
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("IoGetNextIrpStackLocation fail\n"));
+
+	nextstack->Parameters.Others.Argument1 = purb;
+	
+	// Issue an IRP for Sync IO.
+	ntstatus = IoCallDriver(pdvobjpriv->pphysdevobj, irp);
+	usbdstatus = URB_STATUS(purb);
+
+	if(ntstatus == STATUS_PENDING)
+	{		
+		// Method 1
+		waittime.QuadPart = -10000 * 50000;
+		ntstatus = KeWaitForSingleObject(&kevent, Executive, KernelMode, _FALSE, &waittime); //8150 code
+		
+		// Method 2
+		//ntStatus = KeWaitForSingleObject(&Kevent, Executive, KernelMode, FALSE, NULL); //DDK sample
+		
+		usbdstatus = URB_STATUS(purb);
+
+		if(ntstatus == STATUS_TIMEOUT) 
+		{			
+			//usbdevice->nIoStuckCnt++;
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("SyncCallUSBD: TIMEOUT....5000ms\n"));
+
+			// Method 2
+			IoCancelIrp(irp);
+			ntstatus = KeWaitForSingleObject(&kevent, Executive, KernelMode, _FALSE, NULL); //DDK sample
+			usbdstatus = URB_STATUS(purb);
+
+			usbdstatus = USBD_STATUS_SUCCESS;
+		}
+		
+	}
+	
+exit:	
+	
+	_func_exit_;
+	
+	return ntstatus;
+	
+}
+int usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	PURB			purb;
+	u8				ret;
+	unsigned long		transferflags;
+	NTSTATUS		ntstatus;
+
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfpriv->intf_dev;   
+	
+	_func_enter_;
+
+	ret=_TRUE;
+	purb = (PURB)ExAllocatePool(NonPagedPool, sizeof(struct _URB_CONTROL_VENDOR_OR_CLASS_REQUEST) );
+	if(purb == NULL) {
+		
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq(): Failed to allocate urb !!!\n"));
+		ret =_FALSE;
+		goto exit;
+	}
+
+	if (requesttype == 0x01) {
+		transferflags = USBD_TRANSFER_DIRECTION_IN;//read_in
+	} else {
+		transferflags= 0;//write_out
+	}
+
+	UsbBuildVendorRequest(
+			purb, 		//Pointer to an URB that is to be formatted as a vendor or class request. 
+			URB_FUNCTION_VENDOR_DEVICE,	//Indicates the URB is a vendor-defined request for a USB device. 
+			sizeof(struct _URB_CONTROL_VENDOR_OR_CLASS_REQUEST),  //Specifies the length, in bytes, of the URB. 
+			transferflags, 	//TransferFlags 
+			0,			//ReservedBits 
+			request, 	//Request 
+			value, 		//Value 
+			index,		//Index
+			pdata,		//TransferBuffer 
+			NULL,		//TransferBufferMDL 
+			len,			//TransferBufferLength 
+			NULL		//Link 
+	);
+
+	ntstatus = sync_callusbd(pdvobjpriv, purb);
+	if(!NT_SUCCESS(ntstatus))
+	{
+		ExFreePool(purb);
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,(" usbctrl_vendorreq() : SOMETHING WRONG\n") );
+		ret = _FALSE;
+		goto exit;
+	}
+
+	ExFreePool(purb);
+
+exit:	
+	_func_exit_;
+	
+	return ret;	
+
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0 b/drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0
new file mode 100755
index 0000000000000..7ecb7ae62c7fb
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0
@@ -0,0 +1,4 @@
+#DHCP client
+DEVICE=wlan0
+BOOTPROTO=dhcp
+ONBOOT=yes
\ No newline at end of file
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h
new file mode 100755
index 0000000000000..4ae36300d8b7a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h
@@ -0,0 +1,85 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192CE_FW_IMG_H
+#define __INC_HAL8192CE_FW_IMG_H
+
+#include <basic_types.h>
+
+/*Created on  2011/ 6/15,  5:45*/
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define TSMCImgArrayLength 15706 //v84 TSMC COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define TSMCImgArrayLength 16126 //v88 TSMC P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CEFwTSMCImgArray[TSMCImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCACutImgArrayLength 16248 //v79 UMC A Cut COMMON 2011-10-06
+#else //#ifdef CONFIG_P2P
+#define UMCACutImgArrayLength 16126 //v88 UMC A Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CEFwUMCACutImgArray[UMCACutImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCBCutImgArrayLength 15686 //v84 UMC B Cut COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define UMCBCutImgArrayLength 16096 //v88 UMC B Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CEFwUMCBCutImgArray[UMCBCutImgArrayLength];
+
+//8192C_Formal_92CE_PHYforMP_110804 2011-11-23
+//8188C_Formal_88CE_PHYforMP_111117 2011-11-23
+
+#define PHY_REG_2TArrayLength 374
+extern u32 Rtl8192CEPHY_REG_2TArray[PHY_REG_2TArrayLength];
+#define PHY_REG_1TArrayLength 374
+extern u32 Rtl8192CEPHY_REG_1TArray[PHY_REG_1TArrayLength];
+#define PHY_ChangeTo_1T1RArrayLength 1
+extern u32 Rtl8192CEPHY_ChangeTo_1T1RArray[PHY_ChangeTo_1T1RArrayLength];
+#define PHY_ChangeTo_1T2RArrayLength 1
+extern u32 Rtl8192CEPHY_ChangeTo_1T2RArray[PHY_ChangeTo_1T2RArrayLength];
+#define PHY_ChangeTo_2T2RArrayLength 1
+extern u32 Rtl8192CEPHY_ChangeTo_2T2RArray[PHY_ChangeTo_2T2RArrayLength];
+#define PHY_REG_Array_PGLength 336
+extern u32 Rtl8192CEPHY_REG_Array_PG[PHY_REG_Array_PGLength];
+#define PHY_REG_Array_MPLength 4
+extern u32 Rtl8192CEPHY_REG_Array_MP[PHY_REG_Array_MPLength];
+#define RadioA_2TArrayLength 282
+extern u32 Rtl8192CERadioA_2TArray[RadioA_2TArrayLength];
+#define RadioB_2TArrayLength 78
+extern u32 Rtl8192CERadioB_2TArray[RadioB_2TArrayLength];
+#define RadioA_1TArrayLength 282
+extern u32 Rtl8192CERadioA_1TArray[RadioA_1TArrayLength];
+#define RadioB_1TArrayLength 1
+extern u32 Rtl8192CERadioB_1TArray[RadioB_1TArrayLength];
+#define RadioB_GM_ArrayLength 1
+extern u32 Rtl8192CERadioB_GM_Array[RadioB_GM_ArrayLength];
+// MAC reg V14 - 2011-11-23
+#define MAC_2T_ArrayLength 174
+extern u32 Rtl8192CEMAC_2T_Array[MAC_2T_ArrayLength];
+#define MACPHY_Array_PGLength 1
+extern u32 Rtl8192CEMACPHY_Array_PG[MACPHY_Array_PGLength];
+#define AGCTAB_2TArrayLength 320
+extern u32 Rtl8192CEAGCTAB_2TArray[AGCTAB_2TArrayLength];
+#define AGCTAB_1TArrayLength 320
+extern u32 Rtl8192CEAGCTAB_1TArray[AGCTAB_1TArrayLength];
+
+#endif //__INC_HAL8192CE_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h
new file mode 100755
index 0000000000000..3afb292c71a74
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h
@@ -0,0 +1,428 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ * Module:	__INC_HAL8192CPHYCFG_H
+ *
+ *
+ * Note:	
+ *			
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:	
+ *
+ * History:
+ *		Data		Who		Remark 
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ * 
+ *****************************************************************************/
+ /* Check to see if the file has been included already.  */
+#ifndef __INC_HAL8192CPHYCFG_H
+#define __INC_HAL8192CPHYCFG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+#define LOOP_LIMIT				5
+#define MAX_STALL_TIME			50		//us
+#define AntennaDiversityValue	0x80	//(Adapter->bSoftwareAntennaDiversity ? 0x00:0x80)
+#define MAX_TXPWR_IDX_NMODE_92S	63
+#define Reset_Cnt_Limit			3
+
+#define IQK_MAC_REG_NUM		4
+#define IQK_ADDA_REG_NUM		16
+#define IQK_BB_REG_NUM			9
+#define HP_THERMAL_NUM		8
+
+#ifdef CONFIG_PCI_HCI
+#define MAX_AGGR_NUM	0x0A0A
+#else
+#define MAX_AGGR_NUM	0x0909
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#define	SET_RTL8192SE_RF_SLEEP(_pAdapter)							\
+{																	\
+	u1Byte		u1bTmp;												\
+	u1bTmp = PlatformEFIORead1Byte(_pAdapter, REG_LDOV12D_CTRL);		\
+	u1bTmp |= BIT0;													\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_LDOV12D_CTRL, u1bTmp);		\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_SPS_OCP_CFG, 0x0);				\
+	PlatformEFIOWrite1Byte(_pAdapter, TXPAUSE, 0xFF);				\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+	delay_us(100);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	PlatformEFIOWrite1Byte(_pAdapter, PHY_CCA, 0x0);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x37FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+}
+#endif
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/ 
+typedef enum _SwChnlCmdID{
+	CmdID_End,
+	CmdID_SetTxPowerLevel,
+	CmdID_BBRegWrite10,
+	CmdID_WritePortUlong,
+	CmdID_WritePortUshort,
+	CmdID_WritePortUchar,
+	CmdID_RF_WriteReg,
+}SwChnlCmdID;
+
+
+/* 1. Switch channel related */
+typedef struct _SwChnlCmd{
+	SwChnlCmdID	CmdID;
+	u32			Para1;
+	u32			Para2;
+	u32			msDelay;
+}SwChnlCmd;
+
+typedef enum _HW90_BLOCK{
+	HW90_BLOCK_MAC = 0,
+	HW90_BLOCK_PHY0 = 1,
+	HW90_BLOCK_PHY1 = 2,
+	HW90_BLOCK_RF = 3,
+	HW90_BLOCK_MAXIMUM = 4, // Never use this
+}HW90_BLOCK_E, *PHW90_BLOCK_E;
+
+#define	RF_PATH_MAX			2
+
+#define CHANNEL_MAX_NUMBER		14	// 14 is the max channel number
+#define CHANNEL_GROUP_MAX		3	// ch1~3, ch4~9, ch10~14 total three groups
+
+typedef enum _WIRELESS_MODE {
+	WIRELESS_MODE_UNKNOWN = 0x00,
+	WIRELESS_MODE_A = 0x01,
+	WIRELESS_MODE_B = 0x02,
+	WIRELESS_MODE_G = 0x04,
+	WIRELESS_MODE_AUTO = 0x08,
+	WIRELESS_MODE_N_24G = 0x10,
+	WIRELESS_MODE_N_5G = 0x20
+} WIRELESS_MODE;
+
+typedef enum _BaseBand_Config_Type{
+	BaseBand_Config_PHY_REG = 0,			//Radio Path A
+	BaseBand_Config_AGC_TAB = 1,			//Radio Path B
+}BaseBand_Config_Type, *PBaseBand_Config_Type;
+
+
+typedef enum _PHY_Rate_Tx_Power_Offset_Area{
+	RA_OFFSET_LEGACY_OFDM1,
+	RA_OFFSET_LEGACY_OFDM2,
+	RA_OFFSET_HT_OFDM1,
+	RA_OFFSET_HT_OFDM2,
+	RA_OFFSET_HT_OFDM3,
+	RA_OFFSET_HT_OFDM4,
+	RA_OFFSET_HT_CCK,
+}RA_OFFSET_AREA,*PRA_OFFSET_AREA;
+
+
+/* BB/RF related */
+typedef	enum _RF_TYPE_8190P{
+	RF_TYPE_MIN,	// 0
+	RF_8225=1,			// 1 11b/g RF for verification only
+	RF_8256=2,			// 2 11b/g/n 
+	RF_8258=3,			// 3 11a/b/g/n RF
+	RF_6052=4,		// 4 11b/g/n RF
+	//RF_6052=5,		// 4 11b/g/n RF
+	// TODO: We sholud remove this psudo PHY RF after we get new RF.
+	RF_PSEUDO_11N=5,	// 5, It is a temporality RF. 
+}RF_TYPE_8190P_E,*PRF_TYPE_8190P_E;
+
+typedef struct _BB_REGISTER_DEFINITION{
+	u32 rfintfs;			// set software control: 
+							//		0x870~0x877[8 bytes]
+							
+	u32 rfintfi;			// readback data: 
+							//		0x8e0~0x8e7[8 bytes]
+							
+	u32 rfintfo; 		// output data: 
+							//		0x860~0x86f [16 bytes]
+							
+	u32 rfintfe; 		// output enable: 
+							//		0x860~0x86f [16 bytes]
+							
+	u32 rf3wireOffset;	// LSSI data:
+							//		0x840~0x84f [16 bytes]
+							
+	u32 rfLSSI_Select;	// BB Band Select: 
+							//		0x878~0x87f [8 bytes]
+							
+	u32 rfTxGainStage;	// Tx gain stage: 
+							//		0x80c~0x80f [4 bytes]
+							
+	u32 rfHSSIPara1; 	// wire parameter control1 : 
+							//		0x820~0x823,0x828~0x82b, 0x830~0x833, 0x838~0x83b [16 bytes]
+							
+	u32 rfHSSIPara2; 	// wire parameter control2 : 
+							//		0x824~0x827,0x82c~0x82f, 0x834~0x837, 0x83c~0x83f [16 bytes]
+								
+	u32 rfSwitchControl; //Tx Rx antenna control : 
+							//		0x858~0x85f [16 bytes]
+								
+	u32 rfAGCControl1; 	//AGC parameter control1 : 
+							//		0xc50~0xc53,0xc58~0xc5b, 0xc60~0xc63, 0xc68~0xc6b [16 bytes] 
+								
+	u32 rfAGCControl2; 	//AGC parameter control2 : 
+							//		0xc54~0xc57,0xc5c~0xc5f, 0xc64~0xc67, 0xc6c~0xc6f [16 bytes] 
+							
+	u32 rfRxIQImbalance; //OFDM Rx IQ imbalance matrix : 
+							//		0xc14~0xc17,0xc1c~0xc1f, 0xc24~0xc27, 0xc2c~0xc2f [16 bytes]
+							
+	u32 rfRxAFE;  		//Rx IQ DC ofset and Rx digital filter, Rx DC notch filter : 
+							//		0xc10~0xc13,0xc18~0xc1b, 0xc20~0xc23, 0xc28~0xc2b [16 bytes]
+							
+	u32 rfTxIQImbalance; //OFDM Tx IQ imbalance matrix
+							//		0xc80~0xc83,0xc88~0xc8b, 0xc90~0xc93, 0xc98~0xc9b [16 bytes]
+							
+	u32 rfTxAFE; 		//Tx IQ DC Offset and Tx DFIR type
+							//		0xc84~0xc87,0xc8c~0xc8f, 0xc94~0xc97, 0xc9c~0xc9f [16 bytes]
+								
+	u32 rfLSSIReadBack; 	//LSSI RF readback data SI mode
+								//		0x8a0~0x8af [16 bytes]
+
+	u32 rfLSSIReadBackPi; 	//LSSI RF readback data PI mode 0x8b8-8bc for Path A and B
+
+}BB_REGISTER_DEFINITION_T, *PBB_REGISTER_DEFINITION_T;
+
+#ifdef CONFIG_MP_INCLUDED
+typedef enum _ANTENNA_PATH{
+        ANTENNA_NONE 	= 0x00,
+		ANTENNA_D		,
+		ANTENNA_C		,
+		ANTENNA_CD		,
+		ANTENNA_B		,
+		ANTENNA_BD		,
+		ANTENNA_BC		,
+		ANTENNA_BCD		,
+		ANTENNA_A		,
+		ANTENNA_AD		,
+		ANTENNA_AC		,
+		ANTENNA_ACD		,
+		ANTENNA_AB		,
+		ANTENNA_ABD		,
+		ANTENNA_ABC		,
+		ANTENNA_ABCD	
+} ANTENNA_PATH;
+#endif
+
+typedef struct _R_ANTENNA_SELECT_OFDM{	
+	u32			r_tx_antenna:4;	
+	u32			r_ant_l:4;
+	u32			r_ant_non_ht:4;	
+	u32			r_ant_ht1:4;
+	u32			r_ant_ht2:4;
+	u32			r_ant_ht_s1:4;
+	u32			r_ant_non_ht_s1:4;
+	u32			OFDM_TXSC:2;
+	u32			Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK{
+	u8			r_cckrx_enable_2:2;	
+	u8			r_cckrx_enable:2;
+	u8			r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+
+/*------------------------------Define structure----------------------------*/ 
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+
+/*------------------------Export Marco Definition---------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+//
+// BB and RF register read/write
+//
+u32	rtl8192c_PHY_QueryBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask	);
+void	rtl8192c_PHY_SetBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask,
+								IN	u32		Data	);
+u32	rtl8192c_PHY_QueryRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask	);
+void	rtl8192c_PHY_SetRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask,
+								IN	u32				Data	);
+
+//
+// Initialization related function
+//
+/* MAC/BB/RF HAL config */
+int	PHY_MACConfig8192C(	IN	PADAPTER	Adapter	);
+int	PHY_BBConfig8192C(	IN	PADAPTER	Adapter	);
+int	PHY_RFConfig8192C(	IN	PADAPTER	Adapter	);
+/* RF config */
+int	rtl8192c_PHY_ConfigRFWithParaFile(	IN	PADAPTER	Adapter,
+												IN	u8* 	pFileName,
+												IN	RF_RADIO_PATH_E	eRFPath);
+int	rtl8192c_PHY_ConfigRFWithHeaderFile(	IN	PADAPTER			Adapter,
+												IN	RF_RADIO_PATH_E	eRFPath);
+
+/* BB/RF readback check for making sure init OK */
+int	rtl8192c_PHY_CheckBBAndRFOK(	IN	PADAPTER			Adapter,
+										IN	HW90_BLOCK_E		CheckBlock,
+										IN	RF_RADIO_PATH_E	eRFPath	  );
+/* Read initi reg value for tx power setting. */
+void	rtl8192c_PHY_GetHWRegOriginalValue(	IN	PADAPTER		Adapter	);
+
+//
+// RF Power setting
+//
+//extern	BOOLEAN	PHY_SetRFPowerState(IN	PADAPTER			Adapter, 
+//									IN	RT_RF_POWER_STATE	eRFPowerState);
+
+//
+// BB TX Power R/W
+//
+void	PHY_GetTxPowerLevel8192C(	IN	PADAPTER		Adapter,
+											OUT u32*    		powerlevel	);
+void	PHY_SetTxPowerLevel8192C(	IN	PADAPTER		Adapter,
+											IN	u8			channel	);
+BOOLEAN	PHY_UpdateTxPowerDbm8192C(	IN	PADAPTER	Adapter,
+											IN	int		powerInDbm	);
+
+//
+VOID 
+PHY_ScanOperationBackup8192C(IN	PADAPTER	Adapter,
+										IN	u8		Operation	);
+
+//
+// Switch bandwidth for 8192S
+//
+//extern	void	PHY_SetBWModeCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SetBWMode8192C(	IN	PADAPTER			pAdapter,
+									IN	HT_CHANNEL_WIDTH	ChnlWidth,
+									IN	unsigned char	Offset	);
+
+//
+// Set FW CMD IO for 8192S.
+//
+//extern	BOOLEAN HalSetIO8192C(	IN	PADAPTER			Adapter,
+//									IN	IO_TYPE				IOType);
+
+//
+// Set A2 entry to fw for 8192S
+//
+extern	void FillA2Entry8192C(		IN	PADAPTER			Adapter,
+										IN	u8				index,
+										IN	u8*				val);
+
+
+//
+// channel switch related funciton
+//
+//extern	void	PHY_SwChnlCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SwChnl8192C(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+				// Call after initialization
+void	PHY_SwChnlPhy8192C(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+
+void ChkFwCmdIoDone(	IN	PADAPTER	Adapter);
+
+#ifdef USE_WORKITEM	
+//extern 	void SetIOWorkItemCallback( IN PVOID            pContext );
+#else
+//extern	void SetIOTimerCallback( IN PRT_TIMER		pTimer);
+#endif	
+				
+//
+// BB/MAC/RF other monitor API
+//
+void	PHY_SetMonitorMode8192C(IN	PADAPTER	pAdapter,
+										IN	BOOLEAN		bEnableMonitorMode	);
+
+BOOLEAN	PHY_CheckIsLegalRfPath8192C(IN	PADAPTER	pAdapter,
+											IN	u32		eRFPath	);
+
+//
+// IQ calibrate
+//
+VOID rtl8192c_PHY_IQCalibrate( IN PADAPTER pAdapter , IN BOOLEAN bReCovery);
+
+//
+// LC calibrate
+//
+VOID rtl8192c_PHY_LCCalibrate(IN	PADAPTER	pAdapter);
+
+//
+// AP calibrate
+//
+VOID rtl8192c_PHY_APCalibrate(IN	PADAPTER	pAdapter, IN 	char		delta);
+
+VOID rtl8192c_PHY_SetRFPathSwitch(IN	PADAPTER	pAdapter, IN	BOOLEAN		bMain);
+
+//
+// Modify the value of the hw register when beacon interval be changed.
+//
+void	
+rtl8192c_PHY_SetBeaconHwReg(	IN	PADAPTER		Adapter,
+					IN	u16			BeaconInterval	);
+
+
+extern	VOID
+PHY_SwitchEphyParameter(
+	IN	PADAPTER			Adapter
+	);
+
+extern	VOID
+PHY_EnableHostClkReq(
+	IN	PADAPTER			Adapter
+	);
+
+BOOLEAN
+SetAntennaConfig92C(
+	IN	PADAPTER	Adapter,
+	IN	u8		DefaultAnt	
+	);
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+#define PHY_QueryBBReg(Adapter, RegAddr, BitMask) rtl8192c_PHY_QueryBBReg((Adapter), (RegAddr), (BitMask))
+#define PHY_SetBBReg(Adapter, RegAddr, BitMask, Data) rtl8192c_PHY_SetBBReg((Adapter), (RegAddr), (BitMask), (Data))
+#define PHY_QueryRFReg(Adapter, eRFPath, RegAddr, BitMask) rtl8192c_PHY_QueryRFReg((Adapter), (eRFPath), (RegAddr), (BitMask))
+#define PHY_SetRFReg(Adapter, eRFPath, RegAddr, BitMask, Data) rtl8192c_PHY_SetRFReg((Adapter), (eRFPath), (RegAddr), (BitMask), (Data))
+
+#define PHY_SetMacReg	PHY_SetBBReg
+
+#endif	// __INC_HAL8192CPHYCFG_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h
new file mode 100755
index 0000000000000..6364166d68cf4
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h
@@ -0,0 +1,1123 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__INC_HAL8192CPHYREG_H
+ *
+ *
+ * Note:	1. Define PMAC/BB register map
+ *			2. Define RF register map
+ *			3. PMAC/BB register bit mask.
+ *			4. RF reg bit mask.
+ *			5. Other BB/RF relative definition.
+ *			
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:	
+ *
+ * History:
+ *		Data		Who		Remark 
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ *	09/25/2008	MH		1. Add RL6052 register definition
+ * 
+ *****************************************************************************/
+#ifndef __INC_HAL8192CPHYREG_H
+#define __INC_HAL8192CPHYREG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//============================================================
+//       8192S Regsiter offset definition
+//============================================================
+
+//
+// BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
+// 3. RF register 0x00-2E
+// 4. Bit Mask for BB/RF register
+// 5. Other defintion for BB/RF R/W
+//
+
+
+//
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 1. Page1(0x100)
+//
+#define		rPMAC_Reset					0x100
+#define		rPMAC_TxStart					0x104
+#define		rPMAC_TxLegacySIG				0x108
+#define		rPMAC_TxHTSIG1				0x10c
+#define		rPMAC_TxHTSIG2				0x110
+#define		rPMAC_PHYDebug				0x114
+#define		rPMAC_TxPacketNum				0x118
+#define		rPMAC_TxIdle					0x11c
+#define		rPMAC_TxMACHeader0			0x120
+#define		rPMAC_TxMACHeader1			0x124
+#define		rPMAC_TxMACHeader2			0x128
+#define		rPMAC_TxMACHeader3			0x12c
+#define		rPMAC_TxMACHeader4			0x130
+#define		rPMAC_TxMACHeader5			0x134
+#define		rPMAC_TxDataType				0x138
+#define		rPMAC_TxRandomSeed			0x13c
+#define		rPMAC_CCKPLCPPreamble			0x140
+#define		rPMAC_CCKPLCPHeader			0x144
+#define		rPMAC_CCKCRC16				0x148
+#define		rPMAC_OFDMRxCRC32OK			0x170
+#define		rPMAC_OFDMRxCRC32Er			0x174
+#define		rPMAC_OFDMRxParityEr			0x178
+#define		rPMAC_OFDMRxCRC8Er			0x17c
+#define		rPMAC_CCKCRxRC16Er			0x180
+#define		rPMAC_CCKCRxRC32Er			0x184
+#define		rPMAC_CCKCRxRC32OK			0x188
+#define		rPMAC_TxStatus					0x18c
+
+//
+// 2. Page2(0x200)
+//
+// The following two definition are only used for USB interface.
+#define		RF_BB_CMD_ADDR				0x02c0	// RF/BB read/write command address.
+#define		RF_BB_CMD_DATA				0x02c4	// RF/BB read/write command data.
+
+//
+// 3. Page8(0x800)
+//
+#define		rFPGA0_RFMOD				0x800	//RF mode & CCK TxSC // RF BW Setting??
+
+#define		rFPGA0_TxInfo				0x804	// Status report??
+#define		rFPGA0_PSDFunction			0x808
+
+#define		rFPGA0_TxGainStage			0x80c	// Set TX PWR init gain?
+
+#define		rFPGA0_RFTiming1			0x810	// Useless now
+#define		rFPGA0_RFTiming2			0x814
+
+#define		rFPGA0_XA_HSSIParameter1		0x820	// RF 3 wire register
+#define		rFPGA0_XA_HSSIParameter2		0x824
+#define		rFPGA0_XB_HSSIParameter1		0x828
+#define		rFPGA0_XB_HSSIParameter2		0x82c
+#define		rTxAGC_B_Rate18_06				0x830
+#define		rTxAGC_B_Rate54_24				0x834
+#define		rTxAGC_B_CCK1_55_Mcs32		0x838
+#define		rTxAGC_B_Mcs03_Mcs00			0x83c
+
+#define		rTxAGC_B_Mcs07_Mcs04			0x848
+#define		rTxAGC_B_Mcs11_Mcs08			0x84c
+
+#define		rFPGA0_XA_LSSIParameter		0x840
+#define		rFPGA0_XB_LSSIParameter		0x844
+
+#define		rFPGA0_RFWakeUpParameter		0x850	// Useless now
+#define		rFPGA0_RFSleepUpParameter		0x854
+
+#define		rFPGA0_XAB_SwitchControl		0x858	// RF Channel switch
+#define		rFPGA0_XCD_SwitchControl		0x85c
+
+#define		rFPGA0_XA_RFInterfaceOE		0x860	// RF Channel switch
+#define		rFPGA0_XB_RFInterfaceOE		0x864
+
+#define		rTxAGC_B_Mcs15_Mcs12			0x868
+#define		rTxAGC_B_CCK11_A_CCK2_11		0x86c
+
+#define		rFPGA0_XAB_RFInterfaceSW		0x870	// RF Interface Software Control
+#define		rFPGA0_XCD_RFInterfaceSW		0x874
+
+#define		rFPGA0_XAB_RFParameter		0x878	// RF Parameter
+#define		rFPGA0_XCD_RFParameter		0x87c
+
+#define		rFPGA0_AnalogParameter1		0x880	// Crystal cap setting RF-R/W protection for parameter4??
+#define		rFPGA0_AnalogParameter2		0x884
+#define		rFPGA0_AnalogParameter3		0x888	// Useless now
+#define		rFPGA0_AnalogParameter4		0x88c
+
+#define		rFPGA0_XA_LSSIReadBack		0x8a0	// Tranceiver LSSI Readback
+#define		rFPGA0_XB_LSSIReadBack		0x8a4
+#define		rFPGA0_XC_LSSIReadBack		0x8a8
+#define		rFPGA0_XD_LSSIReadBack		0x8ac
+
+#define		rFPGA0_PSDReport				0x8b4	// Useless now
+#define		TransceiverA_HSPI_Readback	0x8b8	// Transceiver A HSPI Readback
+#define		TransceiverB_HSPI_Readback	0x8bc	// Transceiver B HSPI Readback
+#define		rFPGA0_XAB_RFInterfaceRB		0x8e0	// Useless now // RF Interface Readback Value
+#define		rFPGA0_XCD_RFInterfaceRB		0x8e4	// Useless now
+
+//
+// 4. Page9(0x900)
+//
+#define		rFPGA1_RFMOD				0x900	//RF mode & OFDM TxSC // RF BW Setting??
+
+#define		rFPGA1_TxBlock				0x904	// Useless now
+#define		rFPGA1_DebugSelect			0x908	// Useless now
+#define		rFPGA1_TxInfo				0x90c	// Useless now // Status report??
+
+//
+// 5. PageA(0xA00)
+//
+// Set Control channel to upper or lower. These settings are required only for 40MHz
+#define		rCCK0_System				0xa00
+
+#define		rCCK0_AFESetting			0xa04	// Disable init gain now // Select RX path by RSSI
+#define		rCCK0_CCA					0xa08	// Disable init gain now // Init gain
+
+#define		rCCK0_RxAGC1				0xa0c 	//AGC default value, saturation level // Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. Not the same as 90 series
+#define		rCCK0_RxAGC2				0xa10 	//AGC & DAGC
+
+#define		rCCK0_RxHP					0xa14
+
+#define		rCCK0_DSPParameter1		0xa18	//Timing recovery & Channel estimation threshold
+#define		rCCK0_DSPParameter2		0xa1c	//SQ threshold
+
+#define		rCCK0_TxFilter1				0xa20
+#define		rCCK0_TxFilter2				0xa24
+#define		rCCK0_DebugPort			0xa28	//debug port and Tx filter3
+#define		rCCK0_FalseAlarmReport		0xa2c	//0xa2d	useless now 0xa30-a4f channel report
+#define		rCCK0_TRSSIReport         		0xa50
+#define		rCCK0_RxReport            		0xa54  //0xa57
+#define		rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define		rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//
+// PageB(0xB00)
+//
+#define		rPdp_AntA      				0xb00  
+#define		rPdp_AntA_4    				0xb04
+#define		rConfig_Pmpd_AntA 			0xb28
+#define		rConfig_AntA 				0xb68
+#define		rConfig_AntB 				0xb6c
+#define		rPdp_AntB 					0xb70
+#define		rPdp_AntB_4 				0xb74
+#define		rConfig_Pmpd_AntB			0xb98
+#define		rAPK						0xbd8
+
+//
+// 6. PageC(0xC00)
+//
+#define		rOFDM0_LSTF				0xc00
+
+#define		rOFDM0_TRxPathEnable		0xc04
+#define		rOFDM0_TRMuxPar			0xc08
+#define		rOFDM0_TRSWIsolation		0xc0c
+
+#define		rOFDM0_XARxAFE			0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define		rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define		rOFDM0_XBRxAFE            		0xc18
+#define		rOFDM0_XBRxIQImbalance    	0xc1c
+#define		rOFDM0_XCRxAFE            		0xc20
+#define		rOFDM0_XCRxIQImbalance    	0xc24
+#define		rOFDM0_XDRxAFE            		0xc28
+#define		rOFDM0_XDRxIQImbalance    	0xc2c
+
+#define		rOFDM0_RxDetector1			0xc30  //PD,BW & SBD	// DM tune init gain
+#define		rOFDM0_RxDetector2			0xc34  //SBD & Fame Sync. 
+#define		rOFDM0_RxDetector3			0xc38  //Frame Sync.
+#define		rOFDM0_RxDetector4			0xc3c  //PD, SBD, Frame Sync & Short-GI
+
+#define		rOFDM0_RxDSP				0xc40  //Rx Sync Path
+#define		rOFDM0_CFOandDAGC		0xc44  //CFO & DAGC
+#define		rOFDM0_CCADropThreshold	0xc48 //CCA Drop threshold
+#define		rOFDM0_ECCAThreshold		0xc4c // energy CCA
+
+#define		rOFDM0_XAAGCCore1			0xc50	// DIG
+#define		rOFDM0_XAAGCCore2			0xc54
+#define		rOFDM0_XBAGCCore1			0xc58
+#define		rOFDM0_XBAGCCore2			0xc5c
+#define		rOFDM0_XCAGCCore1			0xc60
+#define		rOFDM0_XCAGCCore2			0xc64
+#define		rOFDM0_XDAGCCore1			0xc68
+#define		rOFDM0_XDAGCCore2			0xc6c
+
+#define		rOFDM0_AGCParameter1			0xc70
+#define		rOFDM0_AGCParameter2			0xc74
+#define		rOFDM0_AGCRSSITable			0xc78
+#define		rOFDM0_HTSTFAGC				0xc7c
+
+#define		rOFDM0_XATxIQImbalance		0xc80	// TX PWR TRACK and DIG
+#define		rOFDM0_XATxAFE				0xc84
+#define		rOFDM0_XBTxIQImbalance		0xc88
+#define		rOFDM0_XBTxAFE				0xc8c
+#define		rOFDM0_XCTxIQImbalance		0xc90
+#define		rOFDM0_XCTxAFE            			0xc94
+#define		rOFDM0_XDTxIQImbalance		0xc98
+#define		rOFDM0_XDTxAFE				0xc9c
+
+#define		rOFDM0_RxIQExtAnta			0xca0
+#define		rOFDM0_TxCoeff1				0xca4
+#define		rOFDM0_TxCoeff2				0xca8
+#define		rOFDM0_TxCoeff3				0xcac
+#define		rOFDM0_TxCoeff4				0xcb0
+#define		rOFDM0_TxCoeff5				0xcb4
+#define		rOFDM0_TxCoeff6				0xcb8
+#define		rOFDM0_RxHPParameter			0xce0
+#define		rOFDM0_TxPseudoNoiseWgt		0xce4
+#define		rOFDM0_FrameSync				0xcf0
+#define		rOFDM0_DFSReport				0xcf4
+
+//
+// 7. PageD(0xD00)
+//
+#define		rOFDM1_LSTF					0xd00
+#define		rOFDM1_TRxPathEnable			0xd04
+
+#define		rOFDM1_CFO						0xd08	// No setting now
+#define		rOFDM1_CSI1					0xd10
+#define		rOFDM1_SBD						0xd14
+#define		rOFDM1_CSI2					0xd18
+#define		rOFDM1_CFOTracking			0xd2c
+#define		rOFDM1_TRxMesaure1			0xd34
+#define		rOFDM1_IntfDet					0xd3c
+#define		rOFDM1_PseudoNoiseStateAB		0xd50
+#define		rOFDM1_PseudoNoiseStateCD		0xd54
+#define		rOFDM1_RxPseudoNoiseWgt		0xd58
+
+#define		rOFDM_PHYCounter1				0xda0  //cca, parity fail
+#define		rOFDM_PHYCounter2				0xda4  //rate illegal, crc8 fail
+#define		rOFDM_PHYCounter3				0xda8  //MCS not support
+
+#define		rOFDM_ShortCFOAB				0xdac	// No setting now
+#define		rOFDM_ShortCFOCD				0xdb0
+#define		rOFDM_LongCFOAB				0xdb4
+#define		rOFDM_LongCFOCD				0xdb8
+#define		rOFDM_TailCFOAB				0xdbc
+#define		rOFDM_TailCFOCD				0xdc0
+#define		rOFDM_PWMeasure1          		0xdc4
+#define		rOFDM_PWMeasure2          		0xdc8
+#define		rOFDM_BWReport				0xdcc
+#define		rOFDM_AGCReport				0xdd0
+#define		rOFDM_RxSNR					0xdd4
+#define		rOFDM_RxEVMCSI				0xdd8
+#define		rOFDM_SIGReport				0xddc
+
+
+//
+// 8. PageE(0xE00)
+//
+#define		rTxAGC_A_Rate18_06			0xe00
+#define		rTxAGC_A_Rate54_24			0xe04
+#define		rTxAGC_A_CCK1_Mcs32			0xe08
+#define		rTxAGC_A_Mcs03_Mcs00			0xe10
+#define		rTxAGC_A_Mcs07_Mcs04			0xe14
+#define		rTxAGC_A_Mcs11_Mcs08			0xe18
+#define		rTxAGC_A_Mcs15_Mcs12			0xe1c
+
+#define		rFPGA0_IQK					0xe28
+#define		rTx_IQK_Tone_A				0xe30
+#define		rRx_IQK_Tone_A				0xe34
+#define		rTx_IQK_PI_A					0xe38
+#define		rRx_IQK_PI_A					0xe3c
+
+#define		rTx_IQK 						0xe40
+#define		rRx_IQK						0xe44
+#define		rIQK_AGC_Pts					0xe48
+#define		rIQK_AGC_Rsp					0xe4c
+#define		rTx_IQK_Tone_B				0xe50
+#define		rRx_IQK_Tone_B				0xe54
+#define		rTx_IQK_PI_B					0xe58
+#define		rRx_IQK_PI_B					0xe5c
+#define		rIQK_AGC_Cont				0xe60
+
+#define		rBlue_Tooth					0xe6c
+#define		rRx_Wait_CCA					0xe70
+#define		rTx_CCK_RFON					0xe74
+#define		rTx_CCK_BBON				0xe78
+#define		rTx_OFDM_RFON				0xe7c
+#define		rTx_OFDM_BBON				0xe80
+#define		rTx_To_Rx					0xe84
+#define		rTx_To_Tx					0xe88
+#define		rRx_CCK						0xe8c
+
+#define		rTx_Power_Before_IQK_A		0xe94
+#define		rTx_Power_After_IQK_A			0xe9c
+
+#define		rRx_Power_Before_IQK_A		0xea0
+#define		rRx_Power_Before_IQK_A_2		0xea4
+#define		rRx_Power_After_IQK_A			0xea8
+#define		rRx_Power_After_IQK_A_2		0xeac
+
+#define		rTx_Power_Before_IQK_B		0xeb4
+#define		rTx_Power_After_IQK_B			0xebc
+
+#define		rRx_Power_Before_IQK_B		0xec0
+#define		rRx_Power_Before_IQK_B_2		0xec4
+#define		rRx_Power_After_IQK_B			0xec8
+#define		rRx_Power_After_IQK_B_2		0xecc
+
+#define		rRx_OFDM					0xed0
+#define		rRx_Wait_RIFS 				0xed4
+#define		rRx_TO_Rx 					0xed8
+#define		rStandby 						0xedc
+#define		rSleep 						0xee0
+#define		rPMPD_ANAEN				0xeec
+
+//
+// 7. RF Register 0x00-0x2E (RF 8256)
+//    RF-0222D 0x00-3F
+//
+//Zebra1
+#define		rZebra1_HSSIEnable				0x0	// Useless now
+#define		rZebra1_TRxEnable1				0x1
+#define		rZebra1_TRxEnable2				0x2
+#define		rZebra1_AGC					0x4
+#define		rZebra1_ChargePump			0x5
+#define		rZebra1_Channel				0x7	// RF channel switch
+
+//#endif
+#define		rZebra1_TxGain					0x8	// Useless now
+#define		rZebra1_TxLPF					0x9
+#define		rZebra1_RxLPF					0xb
+#define		rZebra1_RxHPFCorner			0xc
+
+//Zebra4
+#define		rGlobalCtrl						0	// Useless now
+#define		rRTL8256_TxLPF					19
+#define		rRTL8256_RxLPF					11
+
+//RTL8258
+#define		rRTL8258_TxLPF					0x11	// Useless now
+#define		rRTL8258_RxLPF					0x13
+#define		rRTL8258_RSSILPF				0xa
+
+//
+// RL6052 Register definition
+//
+#define		RF_AC						0x00	// 
+
+#define		RF_IQADJ_G1				0x01	// 
+#define		RF_IQADJ_G2				0x02	// 
+#define		RF_BS_PA_APSET_G1_G4		0x03
+#define		RF_BS_PA_APSET_G5_G8		0x04
+#define		RF_POW_TRSW				0x05	// 
+
+#define		RF_GAIN_RX					0x06	// 
+#define		RF_GAIN_TX					0x07	// 
+
+#define		RF_TXM_IDAC				0x08	// 
+#define		RF_IPA_G					0x09	// 
+#define		RF_TXBIAS_G				0x0A
+#define		RF_TXPA_AG					0x0B
+#define		RF_IPA_A					0x0C	// 
+#define		RF_TXBIAS_A				0x0D
+#define		RF_BS_PA_APSET_G9_G11	0x0E
+#define		RF_BS_IQGEN				0x0F	// 
+
+#define		RF_MODE1					0x10	// 
+#define		RF_MODE2					0x11	// 
+
+#define		RF_RX_AGC_HP				0x12	// 
+#define		RF_TX_AGC					0x13	// 
+#define		RF_BIAS						0x14	// 
+#define		RF_IPA						0x15	// 
+#define		RF_POW_ABILITY			0x17	// 
+#define		RF_MODE_AG				0x18	// 
+#define		rRfChannel					0x18	// RF channel and BW switch
+#define		RF_CHNLBW					0x18	// RF channel and BW switch
+#define		RF_TOP						0x19	// 
+
+#define		RF_RX_G1					0x1A	// 
+#define		RF_RX_G2					0x1B	// 
+
+#define		RF_RX_BB2					0x1C	// 
+#define		RF_RX_BB1					0x1D	// 
+
+#define		RF_RCK1					0x1E	// 
+#define		RF_RCK2					0x1F	// 
+
+#define		RF_TX_G1					0x20	// 
+#define		RF_TX_G2					0x21	// 
+#define		RF_TX_G3					0x22	// 
+
+#define		RF_TX_BB1					0x23	// 
+
+#define		RF_T_METER					0x24	// 
+
+#define		RF_SYN_G1					0x25	// RF TX Power control
+#define		RF_SYN_G2					0x26	// RF TX Power control
+#define		RF_SYN_G3					0x27	// RF TX Power control
+#define		RF_SYN_G4					0x28	// RF TX Power control
+#define		RF_SYN_G5					0x29	// RF TX Power control
+#define		RF_SYN_G6					0x2A	// RF TX Power control
+#define		RF_SYN_G7					0x2B	// RF TX Power control
+#define		RF_SYN_G8					0x2C	// RF TX Power control
+
+#define		RF_RCK_OS					0x30	// RF TX PA control
+
+#define		RF_TXPA_G1					0x31	// RF TX PA control
+#define		RF_TXPA_G2					0x32	// RF TX PA control
+#define		RF_TXPA_G3					0x33	// RF TX PA control
+
+//
+//Bit Mask
+//
+// 1. Page1(0x100)
+#define		bBBResetB						0x100	// Useless now?
+#define		bGlobalResetB					0x200
+#define		bOFDMTxStart					0x4
+#define		bCCKTxStart						0x8
+#define		bCRC32Debug					0x100
+#define		bPMACLoopback					0x10
+#define		bTxLSIG							0xffffff
+#define		bOFDMTxRate					0xf
+#define		bOFDMTxReserved				0x10
+#define		bOFDMTxLength					0x1ffe0
+#define		bOFDMTxParity					0x20000
+#define		bTxHTSIG1						0xffffff
+#define		bTxHTMCSRate					0x7f
+#define		bTxHTBW						0x80
+#define		bTxHTLength					0xffff00
+#define		bTxHTSIG2						0xffffff
+#define		bTxHTSmoothing					0x1
+#define		bTxHTSounding					0x2
+#define		bTxHTReserved					0x4
+#define		bTxHTAggreation				0x8
+#define		bTxHTSTBC						0x30
+#define		bTxHTAdvanceCoding			0x40
+#define		bTxHTShortGI					0x80
+#define		bTxHTNumberHT_LTF			0x300
+#define		bTxHTCRC8						0x3fc00
+#define		bCounterReset					0x10000
+#define		bNumOfOFDMTx					0xffff
+#define		bNumOfCCKTx					0xffff0000
+#define		bTxIdleInterval					0xffff
+#define		bOFDMService					0xffff0000
+#define		bTxMACHeader					0xffffffff
+#define		bTxDataInit						0xff
+#define		bTxHTMode						0x100
+#define		bTxDataType					0x30000
+#define		bTxRandomSeed					0xffffffff
+#define		bCCKTxPreamble					0x1
+#define		bCCKTxSFD						0xffff0000
+#define		bCCKTxSIG						0xff
+#define		bCCKTxService					0xff00
+#define		bCCKLengthExt					0x8000
+#define		bCCKTxLength					0xffff0000
+#define		bCCKTxCRC16					0xffff
+#define		bCCKTxStatus					0x1
+#define		bOFDMTxStatus					0x2
+
+#define 		IS_BB_REG_OFFSET_92S(_Offset)		((_Offset >= 0x800) && (_Offset <= 0xfff))
+
+// 2. Page8(0x800)
+#define		bRFMOD							0x1	// Reg 0x800 rFPGA0_RFMOD
+#define		bJapanMode						0x2
+#define		bCCKTxSC						0x30
+#define		bCCKEn							0x1000000
+#define		bOFDMEn						0x2000000
+
+#define		bOFDMRxADCPhase           		0x10000	// Useless now
+#define		bOFDMTxDACPhase           		0x40000
+#define		bXATxAGC                  			0x3f
+
+#define		bAntennaSelect                 		0x0300
+
+#define		bXBTxAGC                  			0xf00	// Reg 80c rFPGA0_TxGainStage
+#define		bXCTxAGC                  			0xf000
+#define		bXDTxAGC                  			0xf0000
+       		
+#define		bPAStart                  			0xf0000000	// Useless now
+#define		bTRStart                  			0x00f00000
+#define		bRFStart                  			0x0000f000
+#define		bBBStart                  			0x000000f0
+#define		bBBCCKStart               		0x0000000f
+#define		bPAEnd                    			0xf          //Reg0x814
+#define		bTREnd                    			0x0f000000
+#define		bRFEnd                    			0x000f0000
+#define		bCCAMask                  			0x000000f0   //T2R
+#define		bR2RCCAMask               		0x00000f00
+#define		bHSSI_R2TDelay            		0xf8000000
+#define		bHSSI_T2RDelay            		0xf80000
+#define		bContTxHSSI               		0x400     //chane gain at continue Tx
+#define		bIGFromCCK                		0x200
+#define		bAGCAddress               		0x3f
+#define		bRxHPTx                   			0x7000
+#define		bRxHPT2R                  			0x38000
+#define		bRxHPCCKIni               		0xc0000
+#define		bAGCTxCode                		0xc00000
+#define		bAGCRxCode                		0x300000
+
+#define		b3WireDataLength          		0x800	// Reg 0x820~84f rFPGA0_XA_HSSIParameter1
+#define		b3WireAddressLength       		0x400
+
+#define		b3WireRFPowerDown         		0x1	// Useless now
+//#define bHWSISelect               		0x8
+#define		b5GPAPEPolarity           		0x40000000
+#define		b2GPAPEPolarity           		0x80000000
+#define		bRFSW_TxDefaultAnt        		0x3
+#define		bRFSW_TxOptionAnt         		0x30
+#define		bRFSW_RxDefaultAnt        		0x300
+#define		bRFSW_RxOptionAnt         		0x3000
+#define		bRFSI_3WireData           		0x1
+#define		bRFSI_3WireClock          		0x2
+#define		bRFSI_3WireLoad           		0x4
+#define		bRFSI_3WireRW             		0x8
+#define		bRFSI_3Wire               			0xf
+
+#define		bRFSI_RFENV               		0x10	// Reg 0x870 rFPGA0_XAB_RFInterfaceSW
+
+#define		bRFSI_TRSW                		0x20	// Useless now
+#define		bRFSI_TRSWB               		0x40
+#define		bRFSI_ANTSW               		0x100
+#define		bRFSI_ANTSWB              		0x200
+#define		bRFSI_PAPE                			0x400
+#define		bRFSI_PAPE5G              		0x800 
+#define		bBandSelect               			0x1
+#define		bHTSIG2_GI                			0x80
+#define		bHTSIG2_Smoothing         		0x01
+#define		bHTSIG2_Sounding          		0x02
+#define		bHTSIG2_Aggreaton         		0x08
+#define		bHTSIG2_STBC              		0x30
+#define		bHTSIG2_AdvCoding         		0x40
+#define		bHTSIG2_NumOfHTLTF        	0x300
+#define		bHTSIG2_CRC8              		0x3fc
+#define		bHTSIG1_MCS               		0x7f
+#define		bHTSIG1_BandWidth         		0x80
+#define		bHTSIG1_HTLength          		0xffff
+#define		bLSIG_Rate                			0xf
+#define		bLSIG_Reserved            		0x10
+#define		bLSIG_Length              		0x1fffe
+#define		bLSIG_Parity              			0x20
+#define		bCCKRxPhase               		0x4
+
+#define		bLSSIReadAddress          		0x7f800000   // T65 RF
+
+#define		bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+
+#define		bLSSIReadBackData         		0xfffff		// T65 RF
+
+#define		bLSSIReadOKFlag           		0x1000	// Useless now
+#define		bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz       		
+#define		bRegulator0Standby        		0x1
+#define		bRegulatorPLLStandby      		0x2
+#define		bRegulator1Standby        		0x4
+#define		bPLLPowerUp               		0x8
+#define		bDPLLPowerUp              		0x10
+#define		bDA10PowerUp              		0x20
+#define		bAD7PowerUp               		0x200
+#define		bDA6PowerUp               		0x2000
+#define		bXtalPowerUp              		0x4000
+#define		b40MDClkPowerUP           		0x8000
+#define		bDA6DebugMode             		0x20000
+#define		bDA6Swing                 			0x380000
+
+#define		bADClkPhase               		0x4000000	// Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ
+
+#define		b80MClkDelay              		0x18000000	// Useless
+#define		bAFEWatchDogEnable        		0x20000000
+
+#define		bXtalCap01                			0xc0000000	// Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap
+#define		bXtalCap23                			0x3
+#define		bXtalCap92x					0x0f000000
+#define 		bXtalCap                			0x0f000000
+
+#define		bIntDifClkEnable          		0x400	// Useless
+#define		bExtSigClkEnable         	 	0x800
+#define		bBandgapMbiasPowerUp      	0x10000
+#define		bAD11SHGain               		0xc0000
+#define		bAD11InputRange           		0x700000
+#define		bAD11OPCurrent            		0x3800000
+#define		bIPathLoopback            		0x4000000
+#define		bQPathLoopback            		0x8000000
+#define		bAFELoopback              		0x10000000
+#define		bDA10Swing                		0x7e0
+#define		bDA10Reverse              		0x800
+#define		bDAClkSource              		0x1000
+#define		bAD7InputRange            		0x6000
+#define		bAD7Gain                  			0x38000
+#define		bAD7OutputCMMode          		0x40000
+#define		bAD7InputCMMode           		0x380000
+#define		bAD7Current               			0xc00000
+#define		bRegulatorAdjust          		0x7000000
+#define		bAD11PowerUpAtTx          		0x1
+#define		bDA10PSAtTx               		0x10
+#define		bAD11PowerUpAtRx          		0x100
+#define		bDA10PSAtRx               		0x1000       		
+#define		bCCKRxAGCFormat           		0x200       		
+#define		bPSDFFTSamplepPoint       		0xc000
+#define		bPSDAverageNum            		0x3000
+#define		bIQPathControl            		0xc00
+#define		bPSDFreq                  			0x3ff
+#define		bPSDAntennaPath           		0x30
+#define		bPSDIQSwitch              		0x40
+#define		bPSDRxTrigger             		0x400000
+#define		bPSDTxTrigger             		0x80000000
+#define		bPSDSineToneScale        		0x7f000000
+#define		bPSDReport                			0xffff
+
+// 3. Page9(0x900)
+#define		bOFDMTxSC                 		0x30000000	// Useless
+#define		bCCKTxOn                  			0x1
+#define		bOFDMTxOn                 		0x2
+#define		bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define		bDebugItem                		0xff   //reset debug page and LWord
+#define		bAntL              	       		0x10
+#define		bAntNonHT           	      			0x100
+#define		bAntHT1               			0x1000
+#define		bAntHT2                   			0x10000
+#define		bAntHT1S1                 			0x100000
+#define		bAntNonHTS1               		0x1000000
+
+// 4. PageA(0xA00)
+#define		bCCKBBMode				0x3	// Useless
+#define		bCCKTxPowerSaving		0x80
+#define		bCCKRxPowerSaving		0x40
+
+#define		bCCKSideBand			0x10	// Reg 0xa00 rCCK0_System 20/40 switch
+
+#define		bCCKScramble			0x8	// Useless
+#define		bCCKAntDiversity		0x8000
+#define		bCCKCarrierRecovery		0x4000
+#define		bCCKTxRate				0x3000
+#define		bCCKDCCancel			0x0800
+#define		bCCKISICancel			0x0400
+#define		bCCKMatchFilter			0x0200
+#define		bCCKEqualizer			0x0100
+#define		bCCKPreambleDetect		0x800000
+#define		bCCKFastFalseCCA		0x400000
+#define		bCCKChEstStart			0x300000
+#define		bCCKCCACount			0x080000
+#define		bCCKcs_lim				0x070000
+#define		bCCKBistMode			0x80000000
+#define		bCCKCCAMask			0x40000000
+#define		bCCKTxDACPhase		0x4
+#define		bCCKRxADCPhase		0x20000000   //r_rx_clk
+#define		bCCKr_cp_mode0		0x0100
+#define		bCCKTxDCOffset			0xf0
+#define		bCCKRxDCOffset			0xf
+#define		bCCKCCAMode			0xc000
+#define		bCCKFalseCS_lim			0x3f00
+#define		bCCKCS_ratio			0xc00000
+#define		bCCKCorgBit_sel			0x300000
+#define		bCCKPD_lim				0x0f0000
+#define		bCCKNewCCA			0x80000000
+#define		bCCKRxHPofIG			0x8000
+#define		bCCKRxIG				0x7f00
+#define		bCCKLNAPolarity			0x800000
+#define		bCCKRx1stGain			0x7f0000
+#define		bCCKRFExtend			0x20000000 //CCK Rx Iinital gain polarity
+#define		bCCKRxAGCSatLevel		0x1f000000
+#define		bCCKRxAGCSatCount		0xe0
+#define		bCCKRxRFSettle			0x1f       //AGCsamp_dly
+#define		bCCKFixedRxAGC			0x8000
+//#define bCCKRxAGCFormat         	 	0x4000   //remove to HSSI register 0x824
+#define		bCCKAntennaPolarity		0x2000
+#define		bCCKTxFilterType		0x0c00
+#define		bCCKRxAGCReportType	0x0300
+#define		bCCKRxDAGCEn			0x80000000
+#define		bCCKRxDAGCPeriod		0x20000000
+#define		bCCKRxDAGCSatLevel		0x1f000000
+#define		bCCKTimingRecovery		0x800000
+#define		bCCKTxC0				0x3f0000
+#define		bCCKTxC1				0x3f000000
+#define		bCCKTxC2				0x3f
+#define		bCCKTxC3				0x3f00
+#define		bCCKTxC4				0x3f0000
+#define		bCCKTxC5				0x3f000000
+#define		bCCKTxC6				0x3f
+#define		bCCKTxC7				0x3f00
+#define		bCCKDebugPort			0xff0000
+#define		bCCKDACDebug			0x0f000000
+#define		bCCKFalseAlarmEnable	0x8000
+#define		bCCKFalseAlarmRead		0x4000
+#define		bCCKTRSSI				0x7f
+#define		bCCKRxAGCReport		0xfe
+#define		bCCKRxReport_AntSel	0x80000000
+#define		bCCKRxReport_MFOff		0x40000000
+#define		bCCKRxRxReport_SQLoss	0x20000000
+#define		bCCKRxReport_Pktloss	0x10000000
+#define		bCCKRxReport_Lockedbit	0x08000000
+#define		bCCKRxReport_RateError	0x04000000
+#define		bCCKRxReport_RxRate	0x03000000
+#define		bCCKRxFACounterLower	0xff
+#define		bCCKRxFACounterUpper	0xff000000
+#define		bCCKRxHPAGCStart		0xe000
+#define		bCCKRxHPAGCFinal		0x1c00       		
+#define		bCCKRxFalseAlarmEnable	0x8000
+#define		bCCKFACounterFreeze	0x4000       		
+#define		bCCKTxPathSel			0x10000000
+#define		bCCKDefaultRxPath		0xc000000
+#define		bCCKOptionRxPath		0x3000000
+
+// 5. PageC(0xC00)
+#define		bNumOfSTF				0x3	// Useless
+#define		bShift_L					0xc0
+#define		bGI_TH					0xc
+#define		bRxPathA				0x1
+#define		bRxPathB				0x2
+#define		bRxPathC				0x4
+#define		bRxPathD				0x8
+#define		bTxPathA				0x1
+#define		bTxPathB				0x2
+#define		bTxPathC				0x4
+#define		bTxPathD				0x8
+#define		bTRSSIFreq				0x200
+#define		bADCBackoff				0x3000
+#define		bDFIRBackoff			0xc000
+#define		bTRSSILatchPhase		0x10000
+#define		bRxIDCOffset			0xff
+#define		bRxQDCOffset			0xff00
+#define		bRxDFIRMode			0x1800000
+#define		bRxDCNFType			0xe000000
+#define		bRXIQImb_A				0x3ff
+#define		bRXIQImb_B				0xfc00
+#define		bRXIQImb_C				0x3f0000
+#define		bRXIQImb_D				0xffc00000
+#define		bDC_dc_Notch			0x60000
+#define		bRxNBINotch			0x1f000000
+#define		bPD_TH					0xf
+#define		bPD_TH_Opt2			0xc000
+#define		bPWED_TH				0x700
+#define		bIfMF_Win_L			0x800
+#define		bPD_Option				0x1000
+#define		bMF_Win_L				0xe000
+#define		bBW_Search_L			0x30000
+#define		bwin_enh_L				0xc0000
+#define		bBW_TH					0x700000
+#define		bED_TH2				0x3800000
+#define		bBW_option				0x4000000
+#define		bRatio_TH				0x18000000
+#define		bWindow_L				0xe0000000
+#define		bSBD_Option				0x1
+#define		bFrame_TH				0x1c
+#define		bFS_Option				0x60
+#define		bDC_Slope_check		0x80
+#define		bFGuard_Counter_DC_L	0xe00
+#define		bFrame_Weight_Short	0x7000
+#define		bSub_Tune				0xe00000
+#define		bFrame_DC_Length		0xe000000
+#define		bSBD_start_offset		0x30000000
+#define		bFrame_TH_2			0x7
+#define		bFrame_GI2_TH			0x38
+#define		bGI2_Sync_en			0x40
+#define		bSarch_Short_Early		0x300
+#define		bSarch_Short_Late		0xc00
+#define		bSarch_GI2_Late		0x70000
+#define		bCFOAntSum				0x1
+#define		bCFOAcc				0x2
+#define		bCFOStartOffset			0xc
+#define		bCFOLookBack			0x70
+#define		bCFOSumWeight			0x80
+#define		bDAGCEnable			0x10000
+#define		bTXIQImb_A				0x3ff
+#define		bTXIQImb_B				0xfc00
+#define		bTXIQImb_C				0x3f0000
+#define		bTXIQImb_D				0xffc00000
+#define		bTxIDCOffset			0xff
+#define		bTxQDCOffset			0xff00
+#define		bTxDFIRMode			0x10000
+#define		bTxPesudoNoiseOn		0x4000000
+#define		bTxPesudoNoise_A		0xff
+#define		bTxPesudoNoise_B		0xff00
+#define		bTxPesudoNoise_C		0xff0000
+#define		bTxPesudoNoise_D		0xff000000
+#define		bCCADropOption			0x20000
+#define		bCCADropThres			0xfff00000
+#define		bEDCCA_H				0xf
+#define		bEDCCA_L				0xf0
+#define		bLambda_ED			0x300
+#define		bRxInitialGain			0x7f
+#define		bRxAntDivEn				0x80
+#define		bRxAGCAddressForLNA	0x7f00
+#define		bRxHighPowerFlow		0x8000
+#define		bRxAGCFreezeThres		0xc0000
+#define		bRxFreezeStep_AGC1	0x300000
+#define		bRxFreezeStep_AGC2	0xc00000
+#define		bRxFreezeStep_AGC3	0x3000000
+#define		bRxFreezeStep_AGC0	0xc000000
+#define		bRxRssi_Cmp_En			0x10000000
+#define		bRxQuickAGCEn			0x20000000
+#define		bRxAGCFreezeThresMode	0x40000000
+#define		bRxOverFlowCheckType	0x80000000
+#define		bRxAGCShift				0x7f
+#define		bTRSW_Tri_Only			0x80
+#define		bPowerThres			0x300
+#define		bRxAGCEn				0x1
+#define		bRxAGCTogetherEn		0x2
+#define		bRxAGCMin				0x4
+#define		bRxHP_Ini				0x7
+#define		bRxHP_TRLNA			0x70
+#define		bRxHP_RSSI				0x700
+#define		bRxHP_BBP1				0x7000
+#define		bRxHP_BBP2				0x70000
+#define		bRxHP_BBP3				0x700000
+#define		bRSSI_H					0x7f0000     //the threshold for high power
+#define		bRSSI_Gen				0x7f000000   //the threshold for ant diversity
+#define		bRxSettle_TRSW			0x7
+#define		bRxSettle_LNA			0x38
+#define		bRxSettle_RSSI			0x1c0
+#define		bRxSettle_BBP			0xe00
+#define		bRxSettle_RxHP			0x7000
+#define		bRxSettle_AntSW_RSSI	0x38000
+#define		bRxSettle_AntSW		0xc0000
+#define		bRxProcessTime_DAGC	0x300000
+#define		bRxSettle_HSSI			0x400000
+#define		bRxProcessTime_BBPPW	0x800000
+#define		bRxAntennaPowerShift	0x3000000
+#define		bRSSITableSelect		0xc000000
+#define		bRxHP_Final				0x7000000
+#define		bRxHTSettle_BBP			0x7
+#define		bRxHTSettle_HSSI		0x8
+#define		bRxHTSettle_RxHP		0x70
+#define		bRxHTSettle_BBPPW		0x80
+#define		bRxHTSettle_Idle		0x300
+#define		bRxHTSettle_Reserved	0x1c00
+#define		bRxHTRxHPEn			0x8000
+#define		bRxHTAGCFreezeThres	0x30000
+#define		bRxHTAGCTogetherEn	0x40000
+#define		bRxHTAGCMin			0x80000
+#define		bRxHTAGCEn				0x100000
+#define		bRxHTDAGCEn			0x200000
+#define		bRxHTRxHP_BBP			0x1c00000
+#define		bRxHTRxHP_Final		0xe0000000
+#define		bRxPWRatioTH			0x3
+#define		bRxPWRatioEn			0x4
+#define		bRxMFHold				0x3800
+#define		bRxPD_Delay_TH1		0x38
+#define		bRxPD_Delay_TH2		0x1c0
+#define		bRxPD_DC_COUNT_MAX	0x600
+//#define bRxMF_Hold               0x3800
+#define		bRxPD_Delay_TH			0x8000
+#define		bRxProcess_Delay		0xf0000
+#define		bRxSearchrange_GI2_Early	0x700000
+#define		bRxFrame_Guard_Counter_L	0x3800000
+#define		bRxSGI_Guard_L			0xc000000
+#define		bRxSGI_Search_L		0x30000000
+#define		bRxSGI_TH				0xc0000000
+#define		bDFSCnt0				0xff
+#define		bDFSCnt1				0xff00
+#define		bDFSFlag				0xf0000       		
+#define		bMFWeightSum			0x300000
+#define		bMinIdxTH				0x7f000000       		
+#define		bDAFormat				0x40000       		
+#define		bTxChEmuEnable		0x01000000       		
+#define		bTRSWIsolation_A		0x7f
+#define		bTRSWIsolation_B		0x7f00
+#define		bTRSWIsolation_C		0x7f0000
+#define		bTRSWIsolation_D		0x7f000000       		
+#define		bExtLNAGain				0x7c00          
+
+// 6. PageE(0xE00)
+#define		bSTBCEn				0x4	// Useless
+#define		bAntennaMapping		0x10
+#define		bNss					0x20
+#define		bCFOAntSumD			0x200
+#define		bPHYCounterReset		0x8000000
+#define		bCFOReportGet			0x4000000
+#define		bOFDMContinueTx		0x10000000
+#define		bOFDMSingleCarrier		0x20000000
+#define		bOFDMSingleTone		0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define		bHTDetect			0x100
+#define		bCFOEn				0x10000
+#define		bCFOValue			0xfff00000
+#define		bSigTone_Re		0x3f
+#define		bSigTone_Im		0x7f00
+#define		bCounter_CCA		0xffff
+#define		bCounter_ParityFail	0xffff0000
+#define		bCounter_RateIllegal		0xffff
+#define		bCounter_CRC8Fail	0xffff0000
+#define		bCounter_MCSNoSupport	0xffff
+#define		bCounter_FastSync	0xffff
+#define		bShortCFO			0xfff
+#define		bShortCFOTLength	12   //total
+#define		bShortCFOFLength	11   //fraction
+#define		bLongCFO			0x7ff
+#define		bLongCFOTLength	11
+#define		bLongCFOFLength	11
+#define		bTailCFO			0x1fff
+#define		bTailCFOTLength		13
+#define		bTailCFOFLength		12       		
+#define		bmax_en_pwdB		0xffff
+#define		bCC_power_dB		0xffff0000
+#define		bnoise_pwdB		0xffff
+#define		bPowerMeasTLength	10
+#define		bPowerMeasFLength	3
+#define		bRx_HT_BW			0x1
+#define		bRxSC				0x6
+#define		bRx_HT				0x8       		
+#define		bNB_intf_det_on		0x1
+#define		bIntf_win_len_cfg	0x30
+#define		bNB_Intf_TH_cfg		0x1c0       		
+#define		bRFGain				0x3f
+#define		bTableSel			0x40
+#define		bTRSW				0x80       		
+#define		bRxSNR_A			0xff
+#define		bRxSNR_B			0xff00
+#define		bRxSNR_C			0xff0000
+#define		bRxSNR_D			0xff000000
+#define		bSNREVMTLength		8
+#define		bSNREVMFLength		1       		
+#define		bCSI1st				0xff
+#define		bCSI2nd				0xff00
+#define		bRxEVM1st			0xff0000
+#define		bRxEVM2nd			0xff000000       		
+#define		bSIGEVM			0xff
+#define		bPWDB				0xff00
+#define		bSGIEN				0x10000
+       		
+#define		bSFactorQAM1		0xf	// Useless
+#define		bSFactorQAM2		0xf0
+#define		bSFactorQAM3		0xf00
+#define		bSFactorQAM4		0xf000
+#define		bSFactorQAM5		0xf0000
+#define		bSFactorQAM6		0xf0000
+#define		bSFactorQAM7		0xf00000
+#define		bSFactorQAM8		0xf000000
+#define		bSFactorQAM9		0xf0000000
+#define		bCSIScheme			0x100000
+       		
+#define		bNoiseLvlTopSet		0x3	// Useless
+#define		bChSmooth			0x4
+#define		bChSmoothCfg1		0x38
+#define		bChSmoothCfg2		0x1c0
+#define		bChSmoothCfg3		0xe00
+#define		bChSmoothCfg4		0x7000
+#define		bMRCMode			0x800000
+#define		bTHEVMCfg			0x7000000
+       		
+#define		bLoopFitType		0x1	// Useless
+#define		bUpdCFO			0x40
+#define		bUpdCFOOffData		0x80
+#define		bAdvUpdCFO			0x100
+#define		bAdvTimeCtrl		0x800
+#define		bUpdClko			0x1000
+#define		bFC					0x6000
+#define		bTrackingMode		0x8000
+#define		bPhCmpEnable		0x10000
+#define		bUpdClkoLTF		0x20000
+#define		bComChCFO			0x40000
+#define		bCSIEstiMode		0x80000
+#define		bAdvUpdEqz			0x100000
+#define		bUChCfg				0x7000000
+#define		bUpdEqz			0x8000000
+
+//Rx Pseduo noise
+#define		bRxPesudoNoiseOn		0x20000000	// Useless
+#define		bRxPesudoNoise_A		0xff
+#define		bRxPesudoNoise_B		0xff00
+#define		bRxPesudoNoise_C		0xff0000
+#define		bRxPesudoNoise_D		0xff000000
+#define		bPesudoNoiseState_A	0xffff
+#define		bPesudoNoiseState_B	0xffff0000
+#define		bPesudoNoiseState_C	0xffff
+#define		bPesudoNoiseState_D	0xffff0000
+
+//7. RF Register
+//Zebra1
+#define		bZebra1_HSSIEnable		0x8		// Useless
+#define		bZebra1_TRxControl		0xc00
+#define		bZebra1_TRxGainSetting	0x07f
+#define		bZebra1_RxCorner		0xc00
+#define		bZebra1_TxChargePump	0x38
+#define		bZebra1_RxChargePump	0x7
+#define		bZebra1_ChannelNum	0xf80
+#define		bZebra1_TxLPFBW		0x400
+#define		bZebra1_RxLPFBW		0x600
+
+//Zebra4
+#define		bRTL8256RegModeCtrl1	0x100	// Useless
+#define		bRTL8256RegModeCtrl0	0x40
+#define		bRTL8256_TxLPFBW		0x18
+#define		bRTL8256_RxLPFBW		0x600
+
+//RTL8258
+#define		bRTL8258_TxLPFBW		0xc	// Useless
+#define		bRTL8258_RxLPFBW		0xc00
+#define		bRTL8258_RSSILPFBW	0xc0
+
+
+//
+// Other Definition
+//
+
+//byte endable for sb_write
+#define		bByte0				0x1	// Useless
+#define		bByte1				0x2
+#define		bByte2				0x4
+#define		bByte3				0x8
+#define		bWord0				0x3
+#define		bWord1				0xc
+#define		bDWord				0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define		bMaskByte0			0xff	// Reg 0xc50 rOFDM0_XAAGCCore~0xC6f
+#define		bMaskByte1			0xff00
+#define		bMaskByte2			0xff0000
+#define		bMaskByte3			0xff000000
+#define		bMaskHWord		0xffff0000
+#define		bMaskLWord			0x0000ffff
+#define		bMaskDWord		0xffffffff
+#define		bMask12Bits			0xfff
+#define		bMaskH4Bits			0xf0000000	
+#define		bMaskOFDM_D		0xffc00000
+#define		bMaskCCK			0x3f3f3f3f
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+//#define		bMask12Bits               0xfffff	// RF Reg mask bits
+//#define		bMask20Bits               0xfffff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask	0xfffff		
+  		
+#define		bEnable			0x1	// Useless
+#define		bDisable		0x0
+       		
+#define		LeftAntenna		0x0	// Useless
+#define		RightAntenna	0x1
+       		
+#define		tCheckTxStatus		500   //500ms // Useless
+#define		tUpdateRxCounter	100   //100ms
+       		
+#define		rateCCK		0	// Useless
+#define		rateOFDM	1
+#define		rateHT		2
+
+//define Register-End
+#define		bPMAC_End			0x1ff	// Useless
+#define		bFPGAPHY0_End		0x8ff
+#define		bFPGAPHY1_End		0x9ff
+#define		bCCKPHY0_End		0xaff
+#define		bOFDMPHY0_End		0xcff
+#define		bOFDMPHY1_End		0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define		bPMACControl		0x0		// Useless
+#define		bWMACControl		0x1
+#define		bWNICControl		0x2
+       		
+#define		PathA			0x0	// Useless
+#define		PathB			0x1
+#define		PathC			0x2
+#define		PathD			0x3
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+#endif	//__INC_HAL8192SPHYREG_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h
new file mode 100755
index 0000000000000..ba3c282f63486
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h
@@ -0,0 +1,105 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192CU_FW_IMG_H
+#define __INC_HAL8192CU_FW_IMG_H
+
+/*Created on  2011/ 6/15,  5:45*/
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define TSMCImgArrayLength 15706 //v84 TSMC COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define TSMCImgArrayLength 16126 //v88 TSMC P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CUFwTSMCImgArray[TSMCImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCACutImgArrayLength 16248 //v79 UMC A Cut COMMON 2011-10-06
+#else //#ifdef CONFIG_P2P
+#define UMCACutImgArrayLength 16126 //v88 UMC A Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CUFwUMCACutImgArray[UMCACutImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCBCutImgArrayLength 15686 //v84 UMC B Cut COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define UMCBCutImgArrayLength 16096 //v88 UMC B Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CUFwUMCBCutImgArray[UMCBCutImgArrayLength];
+
+//8188C_Formal_All_PHYforMP_111117	2011-11-23
+//8192C_Formal_92CU_PHYforMP_110817 	2011-11-23
+#define PHY_REG_2TArrayLength 374
+extern u32  Rtl8192CUPHY_REG_2TArray[PHY_REG_2TArrayLength];
+#define PHY_REG_1TArrayLength 374
+extern u32 Rtl8192CUPHY_REG_1TArray[PHY_REG_1TArrayLength];
+#define PHY_ChangeTo_1T1RArrayLength 1
+extern u32 Rtl8192CUPHY_ChangeTo_1T1RArray[PHY_ChangeTo_1T1RArrayLength];
+#define PHY_ChangeTo_1T2RArrayLength 1
+extern u32 Rtl8192CUPHY_ChangeTo_1T2RArray[PHY_ChangeTo_1T2RArrayLength];
+#define PHY_ChangeTo_2T2RArrayLength 1
+extern u32 Rtl8192CUPHY_ChangeTo_2T2RArray[PHY_ChangeTo_2T2RArrayLength];
+#define PHY_REG_Array_PGLength 336
+extern u32 Rtl8192CUPHY_REG_Array_PG[PHY_REG_Array_PGLength];
+#define PHY_REG_Array_PG_mCardLength 336
+extern u32 Rtl8192CUPHY_REG_Array_PG_mCard[PHY_REG_Array_PG_mCardLength];
+#define PHY_REG_Array_MPLength 4
+extern u32 Rtl8192CUPHY_REG_Array_MP[PHY_REG_Array_MPLength];
+#define PHY_REG_1T_HPArrayLength 378
+extern u32 Rtl8192CUPHY_REG_1T_HPArray[PHY_REG_1T_HPArrayLength];
+#define PHY_REG_1T_mCardArrayLength 374
+extern u32 Rtl8192CUPHY_REG_1T_mCardArray[PHY_REG_1T_mCardArrayLength];
+#define PHY_REG_2T_mCardArrayLength 374
+extern u32 Rtl8192CUPHY_REG_2T_mCardArray[PHY_REG_2T_mCardArrayLength];
+#define PHY_REG_Array_PG_HPLength 336
+extern u32 Rtl8192CUPHY_REG_Array_PG_HP[PHY_REG_Array_PG_HPLength];
+#define RadioA_2TArrayLength 282
+extern u32 Rtl8192CURadioA_2TArray[RadioA_2TArrayLength];
+#define RadioB_2TArrayLength 78
+extern u32 Rtl8192CURadioB_2TArray[RadioB_2TArrayLength];
+#define RadioA_1TArrayLength 282
+extern u32 Rtl8192CURadioA_1TArray[RadioA_1TArrayLength];
+#define RadioB_1TArrayLength 1
+extern u32 Rtl8192CURadioB_1TArray[RadioB_1TArrayLength];
+#define RadioA_2T_mCardArrayLength 282
+extern u32 Rtl8192CURadioA_2T_mCardArray[RadioA_2T_mCardArrayLength];
+#define RadioB_2T_mCardArrayLength 78
+extern u32 Rtl8192CURadioB_2T_mCardArray[RadioB_2T_mCardArrayLength];
+#define RadioA_1T_mCardArrayLength 282
+extern u32 Rtl8192CURadioA_1T_mCardArray[RadioA_1T_mCardArrayLength];
+#define RadioB_1T_mCardArrayLength 1
+extern u32 Rtl8192CURadioB_1T_mCardArray[RadioB_1T_mCardArrayLength];
+#define RadioA_1T_HPArrayLength 282
+extern u32 Rtl8192CURadioA_1T_HPArray[RadioA_1T_HPArrayLength];
+#define RadioB_GM_ArrayLength 1
+extern u32 Rtl8192CURadioB_GM_Array[RadioB_GM_ArrayLength];
+
+// MAC reg V14 - 2011-11-23
+#define MAC_2T_ArrayLength 174
+extern u32 Rtl8192CUMAC_2T_Array[MAC_2T_ArrayLength];
+#define MACPHY_Array_PGLength 1
+extern u32 Rtl8192CUMACPHY_Array_PG[MACPHY_Array_PGLength];
+#define AGCTAB_2TArrayLength 320
+extern u32 Rtl8192CUAGCTAB_2TArray[AGCTAB_2TArrayLength];
+#define AGCTAB_1TArrayLength 320
+extern u32 Rtl8192CUAGCTAB_1TArray[AGCTAB_1TArrayLength];
+#define AGCTAB_1T_HPArrayLength 320
+extern u32 Rtl8192CUAGCTAB_1T_HPArray[AGCTAB_1T_HPArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h
new file mode 100755
index 0000000000000..47d4d2fc42732
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h
@@ -0,0 +1,34 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192CU_FW_IMG_WOWLAN_H
+#define __INC_HAL8192CU_FW_IMG_WOWLAN_H
+
+/*Created on  2011/11/ 8, 14:15*/
+
+
+#define TSMCWWImgArrayLength 13458
+extern u8 Rtl8192CUFwTSMCWWImgArray[TSMCWWImgArrayLength];
+#define UMCACutWWImgArrayLength 13458
+extern u8 Rtl8192CUFwUMCACutWWImgArray[UMCACutWWImgArrayLength];
+#define UMCBCutWWImgArrayLength 13446
+extern u8 Rtl8192CUFwUMCBCutWWImgArray[UMCBCutWWImgArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_WOWLAN_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h
new file mode 100755
index 0000000000000..06397752a28d7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h
@@ -0,0 +1,66 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192DE_FW_IMG_H
+#define __INC_HAL8192DE_FW_IMG_H
+
+#include <basic_types.h>
+
+/*Created on  2011/11/11,  8: 8*/
+
+#define Rtl8192DEImgArrayLength 32296
+extern const u8 Rtl8192DEFwImgArray[Rtl8192DEImgArrayLength];
+#define Rtl8192DEMainArrayLength 1
+extern const u8 Rtl8192DEFwMainArray[Rtl8192DEMainArrayLength];
+#define Rtl8192DEDataArrayLength 1
+extern const u8 Rtl8192DEFwDataArray[Rtl8192DEDataArrayLength];
+#define Rtl8192DEPHY_REG_2TArrayLength 372
+extern const u32 Rtl8192DEPHY_REG_2TArray[Rtl8192DEPHY_REG_2TArrayLength];
+#define Rtl8192DEPHY_REG_1TArrayLength 1
+extern const u32 Rtl8192DEPHY_REG_1TArray[Rtl8192DEPHY_REG_1TArrayLength];
+#define Rtl8192DEPHY_REG_Array_PGLength 624
+extern const u32 Rtl8192DEPHY_REG_Array_PG[Rtl8192DEPHY_REG_Array_PGLength];
+#define Rtl8192DEPHY_REG_Array_MPLength 12
+extern const u32 Rtl8192DEPHY_REG_Array_MP[Rtl8192DEPHY_REG_Array_MPLength];
+#define Rtl8192DERadioA_2TArrayLength 378
+extern const u32 Rtl8192DERadioA_2TArray[Rtl8192DERadioA_2TArrayLength];
+#define Rtl8192DERadioB_2TArrayLength 384
+extern const u32 Rtl8192DERadioB_2TArray[Rtl8192DERadioB_2TArrayLength];
+#define Rtl8192DERadioA_1TArrayLength 1
+extern const u32 Rtl8192DERadioA_1TArray[Rtl8192DERadioA_1TArrayLength];
+#define Rtl8192DERadioB_1TArrayLength 1
+extern const u32 Rtl8192DERadioB_1TArray[Rtl8192DERadioB_1TArrayLength];
+#define Rtl8192DERadioA_2T_intPAArrayLength 378
+extern const u32 Rtl8192DERadioA_2T_intPAArray[Rtl8192DERadioA_2T_intPAArrayLength];
+#define Rtl8192DERadioB_2T_intPAArrayLength 384
+extern const u32 Rtl8192DERadioB_2T_intPAArray[Rtl8192DERadioB_2T_intPAArrayLength];
+#define Rtl8192DEMAC_2T_ArrayLength 192
+extern const u32 Rtl8192DEMAC_2T_Array[Rtl8192DEMAC_2T_ArrayLength];
+#define Rtl8192DEAGCTAB_ArrayLength 386
+extern const u32 Rtl8192DEAGCTAB_Array[Rtl8192DEAGCTAB_ArrayLength];
+#define Rtl8192DEAGCTAB_5GArrayLength 194
+extern const u32 Rtl8192DEAGCTAB_5GArray[Rtl8192DEAGCTAB_5GArrayLength];
+#define Rtl8192DEAGCTAB_2GArrayLength 194
+extern const u32 Rtl8192DEAGCTAB_2GArray[Rtl8192DEAGCTAB_2GArrayLength];
+#define Rtl8192DEAGCTAB_2TArrayLength 1
+extern const u32 Rtl8192DEAGCTAB_2TArray[Rtl8192DEAGCTAB_2TArrayLength];
+#define Rtl8192DEAGCTAB_1TArrayLength 1
+extern const u32 Rtl8192DEAGCTAB_1TArray[Rtl8192DEAGCTAB_1TArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h
new file mode 100755
index 0000000000000..624fbda6d486a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h
@@ -0,0 +1,528 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__INC_HAL8192DPHYCFG_H
+ *
+ *
+ * Note:	
+ *			
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:	
+ *
+ * History:
+ *		Data		Who		Remark 
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ * 
+ *****************************************************************************/
+ /* Check to see if the file has been included already.  */
+#ifndef __INC_HAL8192DPHYCFG_H
+#define __INC_HAL8192DPHYCFG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+#define LOOP_LIMIT				5
+#define MAX_STALL_TIME			50		//us
+#define AntennaDiversityValue	0x80	//(Adapter->bSoftwareAntennaDiversity ? 0x00:0x80)
+#define MAX_TXPWR_IDX_NMODE_92S	63
+#define Reset_Cnt_Limit			3
+
+
+#define IQK_MAC_REG_NUM		4
+#define IQK_ADDA_REG_NUM		16
+#define IQK_BB_REG_NUM			10
+#define IQK_BB_REG_NUM_92C	9
+#define IQK_BB_REG_NUM_92D	10
+#define IQK_BB_REG_NUM_test	6
+#define index_mapping_NUM		13
+#define Rx_index_mapping_NUM	15
+#define AVG_THERMAL_NUM		8
+#define IQK_Matrix_REG_NUM	8
+#define IQK_Matrix_Settings_NUM	1+24+21
+
+#ifdef CONFIG_PCI_HCI
+#define	SET_RTL8192SE_RF_SLEEP(_pAdapter)							\
+{																	\
+	u1Byte		u1bTmp;												\
+	u1bTmp = PlatformEFIORead1Byte(_pAdapter, REG_LDOV12D_CTRL);		\
+	u1bTmp |= BIT0;													\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_LDOV12D_CTRL, u1bTmp);		\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_SPS_OCP_CFG, 0x0);				\
+	PlatformEFIOWrite1Byte(_pAdapter, TXPAUSE, 0xFF);				\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+	delay_us(100);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	PlatformEFIOWrite1Byte(_pAdapter, PHY_CCA, 0x0);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x37FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+}
+#endif
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/ 
+typedef enum _SwChnlCmdID{
+	CmdID_End,
+	CmdID_SetTxPowerLevel,
+	CmdID_BBRegWrite10,
+	CmdID_WritePortUlong,
+	CmdID_WritePortUshort,
+	CmdID_WritePortUchar,
+	CmdID_RF_WriteReg,
+}SwChnlCmdID;
+
+
+/* 1. Switch channel related */
+typedef struct _SwChnlCmd{
+	SwChnlCmdID	CmdID;
+	u32			Para1;
+	u32			Para2;
+	u32			msDelay;
+}SwChnlCmd;
+
+typedef enum _HW90_BLOCK{
+	HW90_BLOCK_MAC = 0,
+	HW90_BLOCK_PHY0 = 1,
+	HW90_BLOCK_PHY1 = 2,
+	HW90_BLOCK_RF = 3,
+	HW90_BLOCK_MAXIMUM = 4, // Never use this
+}HW90_BLOCK_E, *PHW90_BLOCK_E;
+
+//vivi added this for read parameter from header, 20100908
+typedef enum _RF_CONTENT{
+	radioa_txt = 0x1000,
+	radiob_txt = 0x1001,
+	radioc_txt = 0x1002,
+	radiod_txt = 0x1003
+} RF_CONTENT;
+
+#define	RF_PATH_MAX			2
+
+typedef enum _WIRELESS_MODE {
+	WIRELESS_MODE_UNKNOWN = 0x00,
+	WIRELESS_MODE_A = 0x01,
+	WIRELESS_MODE_B = 0x02,
+	WIRELESS_MODE_G = 0x04,
+	WIRELESS_MODE_AUTO = 0x08,
+	WIRELESS_MODE_N_24G = 0x10,
+	WIRELESS_MODE_N_5G = 0x20
+} WIRELESS_MODE;
+
+
+#define CHANNEL_MAX_NUMBER		14+24+21	// 14 is the max channel number
+#define CHANNEL_GROUP_MAX		3+9	// ch1~3, ch4~9, ch10~14 total three groups
+#define MAX_PG_GROUP 13
+
+#define	CHANNEL_GROUP_MAX_2G		3
+#define	CHANNEL_GROUP_IDX_5GL		3
+#define	CHANNEL_GROUP_IDX_5GM		6
+#define	CHANNEL_GROUP_IDX_5GH		9
+#define	CHANNEL_GROUP_MAX_5G		9
+#define	CHANNEL_MAX_NUMBER_2G		14
+
+typedef enum _BaseBand_Config_Type{
+	BaseBand_Config_PHY_REG = 0,			//Radio Path A
+	BaseBand_Config_AGC_TAB = 1,			//Radio Path B
+}BaseBand_Config_Type, *PBaseBand_Config_Type;
+
+typedef enum _MACPHY_MODE_8192D{
+	SINGLEMAC_SINGLEPHY,
+	DUALMAC_DUALPHY,
+	DUALMAC_SINGLEPHY,
+}MACPHY_MODE_8192D,*PMACPHY_MODE_8192D;
+
+typedef enum _MACPHY_MODE_CHANGE_ACTION{
+	DMDP2DMSP = 0,
+	DMSP2DMDP = 1,
+	DMDP2SMSP = 2,
+	SMSP2DMDP = 3,
+	DMSP2SMSP = 4,
+	SMSP2DMSP = 5,
+	MAXACTION
+}MACPHY_MODE_CHANGE_ACTION,*PMACPHY_MODE_CHANGE_ACTION;
+
+typedef enum _BAND_TYPE{
+	BAND_ON_2_4G = 0,
+	BAND_ON_5G,
+	BAND_ON_BOTH,
+	BANDMAX
+}BAND_TYPE,*PBAND_TYPE;
+
+typedef enum _PHY_Rate_Tx_Power_Offset_Area{
+	RA_OFFSET_LEGACY_OFDM1,
+	RA_OFFSET_LEGACY_OFDM2,
+	RA_OFFSET_HT_OFDM1,
+	RA_OFFSET_HT_OFDM2,
+	RA_OFFSET_HT_OFDM3,
+	RA_OFFSET_HT_OFDM4,
+	RA_OFFSET_HT_CCK,
+}RA_OFFSET_AREA,*PRA_OFFSET_AREA;
+
+
+/* BB/RF related */
+typedef	enum _RF_TYPE_8190P{
+	RF_TYPE_MIN,	// 0
+	RF_8225=1,			// 1 11b/g RF for verification only
+	RF_8256=2,			// 2 11b/g/n 
+	RF_8258=3,			// 3 11a/b/g/n RF
+	RF_6052=4,		// 4 11b/g/n RF
+	//RF_6052=5,		// 4 11b/g/n RF
+	// TODO: We sholud remove this psudo PHY RF after we get new RF.
+	RF_PSEUDO_11N=5,	// 5, It is a temporality RF. 
+}RF_TYPE_8190P_E,*PRF_TYPE_8190P_E;
+
+typedef struct _BB_REGISTER_DEFINITION{
+	u32 rfintfs;			// set software control: 
+							//		0x870~0x877[8 bytes]
+							
+	u32 rfintfi;			// readback data: 
+							//		0x8e0~0x8e7[8 bytes]
+							
+	u32 rfintfo; 		// output data: 
+							//		0x860~0x86f [16 bytes]
+							
+	u32 rfintfe; 		// output enable: 
+							//		0x860~0x86f [16 bytes]
+							
+	u32 rf3wireOffset;	// LSSI data:
+							//		0x840~0x84f [16 bytes]
+							
+	u32 rfLSSI_Select;	// BB Band Select: 
+							//		0x878~0x87f [8 bytes]
+							
+	u32 rfTxGainStage;	// Tx gain stage: 
+							//		0x80c~0x80f [4 bytes]
+							
+	u32 rfHSSIPara1; 	// wire parameter control1 : 
+							//		0x820~0x823,0x828~0x82b, 0x830~0x833, 0x838~0x83b [16 bytes]
+							
+	u32 rfHSSIPara2; 	// wire parameter control2 : 
+							//		0x824~0x827,0x82c~0x82f, 0x834~0x837, 0x83c~0x83f [16 bytes]
+								
+	u32 rfSwitchControl; //Tx Rx antenna control : 
+							//		0x858~0x85f [16 bytes]
+								
+	u32 rfAGCControl1; 	//AGC parameter control1 : 
+							//		0xc50~0xc53,0xc58~0xc5b, 0xc60~0xc63, 0xc68~0xc6b [16 bytes] 
+								
+	u32 rfAGCControl2; 	//AGC parameter control2 : 
+							//		0xc54~0xc57,0xc5c~0xc5f, 0xc64~0xc67, 0xc6c~0xc6f [16 bytes] 
+							
+	u32 rfRxIQImbalance; //OFDM Rx IQ imbalance matrix : 
+							//		0xc14~0xc17,0xc1c~0xc1f, 0xc24~0xc27, 0xc2c~0xc2f [16 bytes]
+							
+	u32 rfRxAFE;  		//Rx IQ DC ofset and Rx digital filter, Rx DC notch filter : 
+							//		0xc10~0xc13,0xc18~0xc1b, 0xc20~0xc23, 0xc28~0xc2b [16 bytes]
+							
+	u32 rfTxIQImbalance; //OFDM Tx IQ imbalance matrix
+							//		0xc80~0xc83,0xc88~0xc8b, 0xc90~0xc93, 0xc98~0xc9b [16 bytes]
+							
+	u32 rfTxAFE; 		//Tx IQ DC Offset and Tx DFIR type
+							//		0xc84~0xc87,0xc8c~0xc8f, 0xc94~0xc97, 0xc9c~0xc9f [16 bytes]
+								
+	u32 rfLSSIReadBack; 	//LSSI RF readback data SI mode
+								//		0x8a0~0x8af [16 bytes]
+
+	u32 rfLSSIReadBackPi; 	//LSSI RF readback data PI mode 0x8b8-8bc for Path A and B
+
+}BB_REGISTER_DEFINITION_T, *PBB_REGISTER_DEFINITION_T;
+
+#ifdef CONFIG_MP_INCLUDED
+typedef enum _ANTENNA_PATH{
+        ANTENNA_NONE 	= 0x00,
+		ANTENNA_D		,
+		ANTENNA_C		,
+		ANTENNA_CD		,
+		ANTENNA_B		,
+		ANTENNA_BD		,
+		ANTENNA_BC		,
+		ANTENNA_BCD		,
+		ANTENNA_A		,
+		ANTENNA_AD		,
+		ANTENNA_AC		,
+		ANTENNA_ACD		,
+		ANTENNA_AB		,
+		ANTENNA_ABD		,
+		ANTENNA_ABC		,
+		ANTENNA_ABCD	
+} ANTENNA_PATH;
+#endif
+
+typedef struct _R_ANTENNA_SELECT_OFDM{	
+	u32			r_tx_antenna:4;	
+	u32			r_ant_l:4;
+	u32			r_ant_non_ht:4;	
+	u32			r_ant_ht1:4;
+	u32			r_ant_ht2:4;
+	u32			r_ant_ht_s1:4;
+	u32			r_ant_non_ht_s1:4;
+	u32			OFDM_TXSC:2;
+	u32			Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK{
+	u8			r_cckrx_enable_2:2;	
+	u8			r_cckrx_enable:2;
+	u8			r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+
+/*------------------------------Define structure----------------------------*/ 
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+
+/*------------------------Export Marco Definition---------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+
+//Added for TX Power
+//u8 GetRightChnlPlace(u8 chnl);
+u8 rtl8192d_GetRightChnlPlaceforIQK(u8 chnl);
+u8 rtl8192d_getChnlGroupfromArray(u8 chnl);
+/*--------------------------Exported Function prototype---------------------*/
+//
+// BB and RF register read/write
+//
+void	rtl8192d_PHY_SetBBReg1Byte(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask,
+								IN	u32		Data	);
+u32	rtl8192d_PHY_QueryBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask	);
+void	rtl8192d_PHY_SetBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask,
+								IN	u32		Data	);
+u32	rtl8192d_PHY_QueryRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask	);
+void	rtl8192d_PHY_SetRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask,
+								IN	u32				Data	);
+
+//
+// Initialization related function
+//
+/* MAC/BB/RF HAL config */
+extern	int	PHY_MACConfig8192D(	IN	PADAPTER	Adapter	);
+extern	int	PHY_BBConfig8192D(	IN	PADAPTER	Adapter	);
+extern	int	PHY_RFConfig8192D(	IN	PADAPTER	Adapter	);
+/* RF config */
+int	rtl8192d_PHY_ConfigRFWithParaFile(	IN	PADAPTER	Adapter,
+												IN	u8* 	pFileName,
+												IN	RF_RADIO_PATH_E	eRFPath);
+int	rtl8192d_PHY_ConfigRFWithHeaderFile(	IN	PADAPTER			Adapter,
+												IN	RF_CONTENT			Content,
+												IN	RF_RADIO_PATH_E	eRFPath);
+/* BB/RF readback check for making sure init OK */
+int	rtl8192d_PHY_CheckBBAndRFOK(	IN	PADAPTER			Adapter,
+										IN	HW90_BLOCK_E		CheckBlock,
+										IN	RF_RADIO_PATH_E	eRFPath	  );
+/* Read initi reg value for tx power setting. */
+void	rtl8192d_PHY_GetHWRegOriginalValue(	IN	PADAPTER		Adapter	);
+
+//
+// RF Power setting
+//
+//extern	BOOLEAN	PHY_SetRFPowerState(IN	PADAPTER			Adapter, 
+//									IN	RT_RF_POWER_STATE	eRFPowerState);
+
+//
+// BB TX Power R/W
+//
+void	PHY_GetTxPowerLevel8192D(	IN	PADAPTER		Adapter,
+											OUT u32*    		powerlevel	);
+void	PHY_SetTxPowerLevel8192D(	IN	PADAPTER		Adapter,
+											IN	u8			channel	);
+BOOLEAN	PHY_UpdateTxPowerDbm8192D(	IN	PADAPTER	Adapter,
+											IN	int		powerInDbm	);
+
+//
+VOID 
+PHY_ScanOperationBackup8192D(IN	PADAPTER	Adapter,
+										IN	u8		Operation	);
+
+//
+// Switch bandwidth for 8192S
+//
+//void	PHY_SetBWModeCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SetBWMode8192D(	IN	PADAPTER			pAdapter,
+									IN	HT_CHANNEL_WIDTH	ChnlWidth,
+									IN	unsigned char	Offset	);
+
+//
+// Set FW CMD IO for 8192S.
+//
+//extern	BOOLEAN HalSetIO8192C(	IN	PADAPTER			Adapter,
+//									IN	IO_TYPE				IOType);
+
+//
+// Set A2 entry to fw for 8192S
+//
+extern	void FillA2Entry8192C(		IN	PADAPTER			Adapter,
+										IN	u8				index,
+										IN	u8*				val);
+
+
+//
+// channel switch related funciton
+//
+//extern	void	PHY_SwChnlCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SwChnl8192D(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+				// Call after initialization
+void	PHY_SwChnlPhy8192D(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+
+extern void ChkFwCmdIoDone(	IN	PADAPTER	Adapter);
+
+#ifdef USE_WORKITEM	
+//extern 	void SetIOWorkItemCallback( IN PVOID            pContext );
+#else
+//extern	void SetIOTimerCallback( IN PRT_TIMER		pTimer);
+#endif	
+				
+//
+// BB/MAC/RF other monitor API
+//
+void	PHY_SetMonitorMode8192D(IN	PADAPTER	pAdapter,
+										IN	BOOLEAN		bEnableMonitorMode	);
+
+BOOLEAN	PHY_CheckIsLegalRfPath8192D(IN	PADAPTER	pAdapter,
+											IN	u32		eRFPath	);
+
+//
+// IQ calibrate
+//
+void	rtl8192d_PHY_IQCalibrate(	IN	PADAPTER	pAdapter);
+
+
+//
+// LC calibrate
+//
+void	rtl8192d_PHY_LCCalibrate(IN	PADAPTER	pAdapter);
+
+//
+// AP calibrate
+//
+void	rtl8192d_PHY_APCalibrate(IN	PADAPTER	pAdapter, IN 	char		delta);
+
+
+//
+// Modify the value of the hw register when beacon interval be changed.
+//
+void	
+rtl8192d_PHY_SetBeaconHwReg(	IN	PADAPTER		Adapter,
+					IN	u16			BeaconInterval	);
+
+
+extern	VOID
+PHY_SwitchEphyParameter(
+	IN	PADAPTER			Adapter
+	);
+
+extern	VOID
+PHY_EnableHostClkReq(
+	IN	PADAPTER			Adapter
+	);
+
+BOOLEAN
+SetAntennaConfig92C(
+	IN	PADAPTER	Adapter,
+	IN	u8		DefaultAnt	
+	);
+
+VOID 
+PHY_StopTRXBeforeChangeBand8192D(
+	  PADAPTER		Adapter
+);
+
+VOID
+PHY_UpdateBBRFConfiguration8192D(
+	IN PADAPTER Adapter,
+	IN BOOLEAN bisBandSwitch
+);
+
+VOID PHY_ReadMacPhyMode92D(
+	IN PADAPTER	Adapter,
+	IN BOOLEAN 	AutoloadFail	
+);
+
+VOID PHY_ConfigMacPhyMode92D(
+	IN PADAPTER	Adapter
+);
+
+VOID PHY_ConfigMacPhyModeInfo92D(
+	IN PADAPTER	Adapter
+);
+
+VOID PHY_ConfigMacCoexist_RFPage92D(
+	IN PADAPTER	Adapter
+);
+
+VOID
+rtl8192d_PHY_InitRxSetting(
+	IN	PADAPTER Adapter
+);
+
+VOID
+rtl8192d_PHY_ResetIQKResult(
+	IN	PADAPTER Adapter
+);
+
+
+VOID 
+rtl8192d_PHY_SetRFPathSwitch(IN	PADAPTER	pAdapter, IN	BOOLEAN		bMain);
+
+VOID
+HalChangeCCKStatus8192D(
+	IN	PADAPTER	Adapter,
+	IN	BOOLEAN		bCCKDisable
+);
+
+VOID 
+PHY_InitPABias92D(IN	PADAPTER Adapter);
+
+/*--------------------------Exported Function prototype---------------------*/
+
+#define PHY_SetBBReg1Byte(Adapter, RegAddr, BitMask, Data) rtl8192d_PHY_SetBBReg1Byte((Adapter), (RegAddr), (BitMask), (Data))
+#define PHY_QueryBBReg(Adapter, RegAddr, BitMask) rtl8192d_PHY_QueryBBReg((Adapter), (RegAddr), (BitMask))
+#define PHY_SetBBReg(Adapter, RegAddr, BitMask, Data) rtl8192d_PHY_SetBBReg((Adapter), (RegAddr), (BitMask), (Data))
+#define PHY_QueryRFReg(Adapter, eRFPath, RegAddr, BitMask) rtl8192d_PHY_QueryRFReg((Adapter), (eRFPath), (RegAddr), (BitMask))
+#define PHY_SetRFReg(Adapter, eRFPath, RegAddr, BitMask, Data) rtl8192d_PHY_SetRFReg((Adapter), (eRFPath), (RegAddr), (BitMask), (Data))
+
+#define PHY_SetMacReg	PHY_SetBBReg
+
+#endif	// __INC_HAL8192SPHYCFG_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h
new file mode 100755
index 0000000000000..f28aa033bbe03
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h
@@ -0,0 +1,1171 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__INC_HAL8192DPHYREG_H
+ *
+ *
+ * Note:	1. Define PMAC/BB register map
+ *			2. Define RF register map
+ *			3. PMAC/BB register bit mask.
+ *			4. RF reg bit mask.
+ *			5. Other BB/RF relative definition.
+ *			
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:	
+ *
+ * History:
+ *		Data		Who		Remark 
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ *	09/25/2008	MH		1. Add RL6052 register definition
+ * 
+ *****************************************************************************/
+#ifndef __INC_HAL8192DPHYREG_H
+#define __INC_HAL8192DPHYREG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//============================================================
+//       8192S Regsiter offset definition
+//============================================================
+
+//
+// BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
+// 3. RF register 0x00-2E
+// 4. Bit Mask for BB/RF register
+// 5. Other defintion for BB/RF R/W
+//
+
+
+//
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 1. Page1(0x100)
+//
+#define		rPMAC_Reset					0x100
+#define		rPMAC_TxStart					0x104
+#define		rPMAC_TxLegacySIG				0x108
+#define		rPMAC_TxHTSIG1				0x10c
+#define		rPMAC_TxHTSIG2				0x110
+#define		rPMAC_PHYDebug				0x114
+#define		rPMAC_TxPacketNum				0x118
+#define		rPMAC_TxIdle					0x11c
+#define		rPMAC_TxMACHeader0			0x120
+#define		rPMAC_TxMACHeader1			0x124
+#define		rPMAC_TxMACHeader2			0x128
+#define		rPMAC_TxMACHeader3			0x12c
+#define		rPMAC_TxMACHeader4			0x130
+#define		rPMAC_TxMACHeader5			0x134
+#define		rPMAC_TxDataType				0x138
+#define		rPMAC_TxRandomSeed			0x13c
+#define		rPMAC_CCKPLCPPreamble			0x140
+#define		rPMAC_CCKPLCPHeader			0x144
+#define		rPMAC_CCKCRC16				0x148
+#define		rPMAC_OFDMRxCRC32OK			0x170
+#define		rPMAC_OFDMRxCRC32Er			0x174
+#define		rPMAC_OFDMRxParityEr			0x178
+#define		rPMAC_OFDMRxCRC8Er			0x17c
+#define		rPMAC_CCKCRxRC16Er			0x180
+#define		rPMAC_CCKCRxRC32Er			0x184
+#define		rPMAC_CCKCRxRC32OK			0x188
+#define		rPMAC_TxStatus					0x18c
+
+//
+// 2. Page2(0x200)
+//
+// The following two definition are only used for USB interface.
+#define		RF_BB_CMD_ADDR				0x02c0	// RF/BB read/write command address.
+#define		RF_BB_CMD_DATA				0x02c4	// RF/BB read/write command data.
+
+//
+// 3. Page8(0x800)
+//
+#define		rFPGA0_RFMOD				0x800	//RF mode & CCK TxSC // RF BW Setting??
+
+#define		rFPGA0_TxInfo				0x804	// Status report??
+#define		rFPGA0_PSDFunction			0x808
+
+#define		rFPGA0_TxGainStage			0x80c	// Set TX PWR init gain?
+
+#define		rFPGA0_RFTiming1			0x810	// Useless now
+#define		rFPGA0_RFTiming2			0x814
+
+#define		rFPGA0_XA_HSSIParameter1		0x820	// RF 3 wire register
+#define		rFPGA0_XA_HSSIParameter2		0x824
+#define		rFPGA0_XB_HSSIParameter1		0x828
+#define		rFPGA0_XB_HSSIParameter2		0x82c
+
+#define		rFPGA0_XA_LSSIParameter		0x840
+#define		rFPGA0_XB_LSSIParameter		0x844
+
+#define		rFPGA0_RFWakeUpParameter		0x850	// Useless now
+#define		rFPGA0_RFSleepUpParameter		0x854
+
+#define		rFPGA0_XAB_SwitchControl		0x858	// RF Channel switch
+#define		rFPGA0_XCD_SwitchControl		0x85c
+
+#define		rFPGA0_XA_RFInterfaceOE		0x860	// RF Channel switch
+#define		rFPGA0_XB_RFInterfaceOE		0x864
+
+#define		rFPGA0_XAB_RFInterfaceSW		0x870	// RF Interface Software Control
+#define		rFPGA0_XCD_RFInterfaceSW		0x874
+
+#define		rFPGA0_XAB_RFParameter		0x878	// RF Parameter
+#define		rFPGA0_XCD_RFParameter		0x87c
+
+#define		rFPGA0_AnalogParameter1		0x880	// Crystal cap setting RF-R/W protection for parameter4??
+#define		rFPGA0_AnalogParameter2		0x884
+#define		rFPGA0_AnalogParameter3		0x888
+#define		rFPGA0_AdDaClockEn			0x888	// enable ad/da clock1 for dual-phy
+#define		rFPGA0_AnalogParameter4		0x88c
+
+#define		rFPGA0_XA_LSSIReadBack		0x8a0	// Tranceiver LSSI Readback
+#define		rFPGA0_XB_LSSIReadBack		0x8a4
+#define		rFPGA0_XC_LSSIReadBack		0x8a8
+#define		rFPGA0_XD_LSSIReadBack		0x8ac
+
+#define		rFPGA0_PSDReport				0x8b4	// Useless now
+#define		TransceiverA_HSPI_Readback	0x8b8	// Transceiver A HSPI Readback
+#define		TransceiverB_HSPI_Readback	0x8bc	// Transceiver B HSPI Readback
+#define		rFPGA0_XAB_RFInterfaceRB		0x8e0	// Useless now // RF Interface Readback Value
+#define		rFPGA0_XCD_RFInterfaceRB		0x8e4	// Useless now
+
+//
+// 4. Page9(0x900)
+//
+#define		rFPGA1_RFMOD				0x900	//RF mode & OFDM TxSC // RF BW Setting??
+
+#define		rFPGA1_TxBlock				0x904	// Useless now
+#define		rFPGA1_DebugSelect			0x908	// Useless now
+#define		rFPGA1_TxInfo				0x90c	// Useless now // Status report??
+
+//
+// 5. PageA(0xA00)
+//
+// Set Control channel to upper or lower. These settings are required only for 40MHz
+#define		rCCK0_System				0xa00
+
+#define		rCCK0_AFESetting			0xa04	// Disable init gain now // Select RX path by RSSI
+#define		rCCK0_CCA					0xa08	// Disable init gain now // Init gain
+
+#define		rCCK0_RxAGC1				0xa0c 	//AGC default value, saturation level // Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. Not the same as 90 series
+#define		rCCK0_RxAGC2				0xa10 	//AGC & DAGC
+
+#define		rCCK0_RxHP					0xa14
+
+#define		rCCK0_DSPParameter1		0xa18	//Timing recovery & Channel estimation threshold
+#define		rCCK0_DSPParameter2		0xa1c	//SQ threshold
+
+#define		rCCK0_TxFilter1				0xa20
+#define		rCCK0_TxFilter2				0xa24
+#define		rCCK0_DebugPort			0xa28	//debug port and Tx filter3
+#define		rCCK0_FalseAlarmReport		0xa2c	//0xa2d	useless now 0xa30-a4f channel report
+#define		rCCK0_TRSSIReport         		0xa50
+#define		rCCK0_RxReport            		0xa54  //0xa57
+#define		rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define		rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//
+// PageB(0xB00)
+//
+#define		rPdp_AntA      					0xb00  
+#define		rPdp_AntA_4    				0xb04
+#define		rPdp_AntA_8    				0xb08
+#define		rPdp_AntA_C    				0xb0c
+#define		rPdp_AntA_10    				0xb10
+#define		rPdp_AntA_14    				0xb14
+#define		rPdp_AntA_18    				0xb18
+#define		rPdp_AntA_1C    				0xb1c
+#define		rPdp_AntA_20    				0xb20
+#define		rPdp_AntA_24    				0xb24
+
+#define		rConfig_Pmpd_AntA 			0xb28
+#define		rConfig_ram64x16				0xb2c
+
+#define		rBndA						0xb30
+#define		rHssiPar						0xb34
+
+#define		rConfig_AntA 					0xb68
+#define		rConfig_AntB 					0xb6c
+
+#define		rPdp_AntB 					0xb70
+#define		rPdp_AntB_4 					0xb74
+#define		rPdp_AntB_8 					0xb78
+#define		rPdp_AntB_C 					0xb7c
+#define		rPdp_AntB_10 					0xb80
+#define		rPdp_AntB_14 					0xb84
+#define		rPdp_AntB_18 					0xb88
+#define		rPdp_AntB_1C 					0xb8c
+#define		rPdp_AntB_20 					0xb90
+#define		rPdp_AntB_24 					0xb94
+
+#define		rConfig_Pmpd_AntB			0xb98
+
+#define		rBndB						0xba0
+
+#define		rAPK							0xbd8
+#define		rPm_Rx0_AntA				0xbdc
+#define		rPm_Rx1_AntA				0xbe0
+#define		rPm_Rx2_AntA				0xbe4
+#define		rPm_Rx3_AntA				0xbe8
+#define		rPm_Rx0_AntB				0xbec
+#define		rPm_Rx1_AntB				0xbf0
+#define		rPm_Rx2_AntB				0xbf4
+#define		rPm_Rx3_AntB				0xbf8
+
+//
+// 6. PageC(0xC00)
+//
+#define		rOFDM0_LSTF				0xc00
+
+#define		rOFDM0_TRxPathEnable		0xc04
+#define		rOFDM0_TRMuxPar			0xc08
+#define		rOFDM0_TRSWIsolation		0xc0c
+
+#define		rOFDM0_XARxAFE			0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define		rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define		rOFDM0_XBRxAFE            		0xc18
+#define		rOFDM0_XBRxIQImbalance    	0xc1c
+#define		rOFDM0_XCRxAFE            		0xc20
+#define		rOFDM0_XCRxIQImbalance    	0xc24
+#define		rOFDM0_XDRxAFE            		0xc28
+#define		rOFDM0_XDRxIQImbalance    	0xc2c
+
+#define		rOFDM0_RxDetector1			0xc30  //PD,BW & SBD	// DM tune init gain
+#define		rOFDM0_RxDetector2			0xc34  //SBD & Fame Sync. 
+#define		rOFDM0_RxDetector3			0xc38  //Frame Sync.
+#define		rOFDM0_RxDetector4			0xc3c  //PD, SBD, Frame Sync & Short-GI
+
+#define		rOFDM0_RxDSP				0xc40  //Rx Sync Path
+#define		rOFDM0_CFOandDAGC		0xc44  //CFO & DAGC
+#define		rOFDM0_CCADropThreshold	0xc48 //CCA Drop threshold
+#define		rOFDM0_ECCAThreshold		0xc4c // energy CCA
+
+#define		rOFDM0_XAAGCCore1			0xc50	// DIG
+#define		rOFDM0_XAAGCCore2			0xc54
+#define		rOFDM0_XBAGCCore1			0xc58
+#define		rOFDM0_XBAGCCore2			0xc5c
+#define		rOFDM0_XCAGCCore1			0xc60
+#define		rOFDM0_XCAGCCore2			0xc64
+#define		rOFDM0_XDAGCCore1			0xc68
+#define		rOFDM0_XDAGCCore2			0xc6c
+
+#define		rOFDM0_AGCParameter1			0xc70
+#define		rOFDM0_AGCParameter2			0xc74
+#define		rOFDM0_AGCRSSITable			0xc78
+#define		rOFDM0_HTSTFAGC				0xc7c
+
+#define		rOFDM0_XATxIQImbalance		0xc80	// TX PWR TRACK and DIG
+#define		rOFDM0_XATxAFE				0xc84
+#define		rOFDM0_XBTxIQImbalance		0xc88
+#define		rOFDM0_XBTxAFE				0xc8c
+#define		rOFDM0_XCTxIQImbalance		0xc90
+#define		rOFDM0_XCTxAFE            			0xc94
+#define		rOFDM0_XDTxIQImbalance		0xc98
+#define		rOFDM0_XDTxAFE				0xc9c
+
+#define		rOFDM0_RxIQExtAnta			0xca0
+#define		rOFDM0_TxCoeff1				0xca4
+#define		rOFDM0_TxCoeff2				0xca8
+#define		rOFDM0_TxCoeff3				0xcac
+#define		rOFDM0_TxCoeff4				0xcb0
+#define		rOFDM0_TxCoeff5				0xcb4
+#define		rOFDM0_TxCoeff6				0xcb8
+#define		rOFDM0_RxHPParameter			0xce0
+#define		rOFDM0_TxPseudoNoiseWgt		0xce4
+#define		rOFDM0_FrameSync				0xcf0
+#define		rOFDM0_DFSReport				0xcf4
+
+//
+// 7. PageD(0xD00)
+//
+#define		rOFDM1_LSTF					0xd00
+#define		rOFDM1_TRxPathEnable			0xd04
+
+#define		rOFDM1_CFO						0xd08	// No setting now
+#define		rOFDM1_CSI1					0xd10
+#define		rOFDM1_SBD						0xd14
+#define		rOFDM1_CSI2					0xd18
+#define		rOFDM1_CFOTracking			0xd2c
+#define		rOFDM1_TRxMesaure1			0xd34
+#define		rOFDM1_IntfDet					0xd3c
+#define		rOFDM1_PseudoNoiseStateAB		0xd50
+#define		rOFDM1_PseudoNoiseStateCD		0xd54
+#define		rOFDM1_RxPseudoNoiseWgt		0xd58
+
+#define		rOFDM_PHYCounter1				0xda0  //cca, parity fail
+#define		rOFDM_PHYCounter2				0xda4  //rate illegal, crc8 fail
+#define		rOFDM_PHYCounter3				0xda8  //MCS not support
+
+#define		rOFDM_ShortCFOAB				0xdac	// No setting now
+#define		rOFDM_ShortCFOCD				0xdb0
+#define		rOFDM_LongCFOAB				0xdb4
+#define		rOFDM_LongCFOCD				0xdb8
+#define		rOFDM_TailCFOAB				0xdbc
+#define		rOFDM_TailCFOCD				0xdc0
+#define		rOFDM_PWMeasure1          		0xdc4
+#define		rOFDM_PWMeasure2          		0xdc8
+#define		rOFDM_BWReport				0xdcc
+#define		rOFDM_AGCReport				0xdd0
+#define		rOFDM_RxSNR					0xdd4
+#define		rOFDM_RxEVMCSI				0xdd8
+#define		rOFDM_SIGReport				0xddc
+
+
+//
+// 8. PageE(0xE00)
+//
+#define		rTxAGC_A_Rate18_06			0xe00
+#define		rTxAGC_A_Rate54_24			0xe04
+#define		rTxAGC_A_CCK1_Mcs32			0xe08
+#define		rTxAGC_A_Mcs03_Mcs00			0xe10
+#define		rTxAGC_A_Mcs07_Mcs04			0xe14
+#define		rTxAGC_A_Mcs11_Mcs08			0xe18
+#define		rTxAGC_A_Mcs15_Mcs12			0xe1c
+
+#define		rTxAGC_B_Rate18_06			0x830
+#define		rTxAGC_B_Rate54_24			0x834
+#define		rTxAGC_B_CCK1_55_Mcs32		0x838
+#define		rTxAGC_B_Mcs03_Mcs00			0x83c
+#define		rTxAGC_B_Mcs07_Mcs04			0x848
+#define		rTxAGC_B_Mcs11_Mcs08			0x84c
+#define		rTxAGC_B_Mcs15_Mcs12			0x868
+#define		rTxAGC_B_CCK11_A_CCK2_11		0x86c
+
+#define		rFPGA0_IQK						0xe28
+#define		rTx_IQK_Tone_A					0xe30
+#define		rRx_IQK_Tone_A					0xe34
+#define		rTx_IQK_PI_A					0xe38
+#define		rRx_IQK_PI_A					0xe3c
+
+#define		rTx_IQK 						0xe40
+#define		rRx_IQK							0xe44
+#define		rIQK_AGC_Pts					0xe48
+#define		rIQK_AGC_Rsp					0xe4c
+#define		rTx_IQK_Tone_B					0xe50
+#define		rRx_IQK_Tone_B					0xe54
+#define		rTx_IQK_PI_B					0xe58
+#define		rRx_IQK_PI_B					0xe5c
+#define		rIQK_AGC_Cont					0xe60
+
+#define		rBlue_Tooth						0xe6c
+#define		rRx_Wait_CCA					0xe70
+#define		rTx_CCK_RFON					0xe74
+#define		rTx_CCK_BBON					0xe78
+#define		rTx_OFDM_RFON					0xe7c
+#define		rTx_OFDM_BBON					0xe80
+#define		rTx_To_Rx						0xe84
+#define		rTx_To_Tx						0xe88
+#define		rRx_CCK							0xe8c
+
+#define		rTx_Power_Before_IQK_A		0xe94
+#define		rTx_Power_After_IQK_A			0xe9c
+
+#define		rRx_Power_Before_IQK_A		0xea0
+#define		rRx_Power_Before_IQK_A_2		0xea4
+#define		rRx_Power_After_IQK_A			0xea8
+#define		rRx_Power_After_IQK_A_2		0xeac
+
+#define		rTx_Power_Before_IQK_B		0xeb4
+#define		rTx_Power_After_IQK_B			0xebc
+
+#define		rRx_Power_Before_IQK_B		0xec0
+#define		rRx_Power_Before_IQK_B_2		0xec4
+#define		rRx_Power_After_IQK_B			0xec8
+#define		rRx_Power_After_IQK_B_2		0xecc
+
+#define		rRx_OFDM						0xed0
+#define		rRx_Wait_RIFS 					0xed4
+#define		rRx_TO_Rx 						0xed8
+#define		rStandby 						0xedc
+#define		rSleep 							0xee0
+#define		rPMPD_ANAEN					0xeec
+
+//
+// 7. RF Register 0x00-0x2E (RF 8256)
+//    RF-0222D 0x00-3F
+//
+//Zebra1
+#define		rZebra1_HSSIEnable				0x0	// Useless now
+#define		rZebra1_TRxEnable1				0x1
+#define		rZebra1_TRxEnable2				0x2
+#define		rZebra1_AGC					0x4
+#define		rZebra1_ChargePump			0x5
+#define		rZebra1_Channel				0x7	// RF channel switch
+
+//#endif
+#define		rZebra1_TxGain					0x8	// Useless now
+#define		rZebra1_TxLPF					0x9
+#define		rZebra1_RxLPF					0xb
+#define		rZebra1_RxHPFCorner			0xc
+
+//Zebra4
+#define		rGlobalCtrl						0	// Useless now
+#define		rRTL8256_TxLPF					19
+#define		rRTL8256_RxLPF					11
+
+//RTL8258
+#define		rRTL8258_TxLPF					0x11	// Useless now
+#define		rRTL8258_RxLPF					0x13
+#define		rRTL8258_RSSILPF				0xa
+
+//
+// RL6052 Register definition
+//
+#define		RF_AC						0x00	// 
+
+#define		RF_IQADJ_G1				0x01	// 
+#define		RF_IQADJ_G2				0x02	// 
+#define		RF_BS_PA_APSET_G1_G4		0x03
+#define		RF_BS_PA_APSET_G5_G8		0x04
+#define		RF_POW_TRSW				0x05	// 
+
+#define		RF_GAIN_RX					0x06	// 
+#define		RF_GAIN_TX					0x07	// 
+
+#define		RF_TXM_IDAC				0x08	// 
+#define		RF_IPA_G					0x09	// 
+#define		RF_TXBIAS_G				0x0A
+#define		RF_TXPA_AG					0x0B
+#define		RF_IPA_A					0x0C	// 
+#define		RF_TXBIAS_A				0x0D
+#define		RF_BS_PA_APSET_G9_G11	0x0E
+#define		RF_BS_IQGEN				0x0F	// 
+
+#define		RF_MODE1					0x10	// 
+#define		RF_MODE2					0x11	// 
+
+#define		RF_RX_AGC_HP				0x12	// 
+#define		RF_TX_AGC					0x13	// 
+#define		RF_BIAS						0x14	// 
+#define		RF_IPA						0x15	// 
+#define		RF_POW_ABILITY			0x17	// 
+#define		RF_MODE_AG				0x18	// 
+#define		rRfChannel					0x18	// RF channel and BW switch
+#define		RF_CHNLBW					0x18	// RF channel and BW switch
+#define		RF_TOP						0x19	// 
+
+#define		RF_RX_G1					0x1A	// 
+#define		RF_RX_G2					0x1B	// 
+
+#define		RF_RX_BB2					0x1C	// 
+#define		RF_RX_BB1					0x1D	// 
+
+#define		RF_RCK1					0x1E	// 
+#define		RF_RCK2					0x1F	// 
+
+#define		RF_TX_G1					0x20	// 
+#define		RF_TX_G2					0x21	// 
+#define		RF_TX_G3					0x22	// 
+
+#define		RF_TX_BB1					0x23	// 
+
+#define		RF_T_METER					0x42	// 
+
+#define		RF_SYN_G1					0x25	// RF TX Power control
+#define		RF_SYN_G2					0x26	// RF TX Power control
+#define		RF_SYN_G3					0x27	// RF TX Power control
+#define		RF_SYN_G4					0x28	// RF TX Power control
+#define		RF_SYN_G5					0x29	// RF TX Power control
+#define		RF_SYN_G6					0x2A	// RF TX Power control
+#define		RF_SYN_G7					0x2B	// RF TX Power control
+#define		RF_SYN_G8					0x2C	// RF TX Power control
+
+#define		RF_RCK_OS					0x30	// RF TX PA control
+
+#define		RF_TXPA_G1					0x31	// RF TX PA control
+#define		RF_TXPA_G2					0x32	// RF TX PA control
+#define		RF_TXPA_G3					0x33	// RF TX PA control
+#define		RF_LOBF_9					0x38
+#define		RF_RXRF_A3					0x3C	//
+#define		RF_TRSW					0x3F
+
+#define		RF_TXRF_A2					0x41
+#define		RF_TXPA_G4					0x46
+#define		RF_TXPA_A4					0x4B
+
+//
+//Bit Mask
+//
+// 1. Page1(0x100)
+#define		bBBResetB						0x100	// Useless now?
+#define		bGlobalResetB					0x200
+#define		bOFDMTxStart					0x4
+#define		bCCKTxStart						0x8
+#define		bCRC32Debug					0x100
+#define		bPMACLoopback					0x10
+#define		bTxLSIG							0xffffff
+#define		bOFDMTxRate					0xf
+#define		bOFDMTxReserved				0x10
+#define		bOFDMTxLength					0x1ffe0
+#define		bOFDMTxParity					0x20000
+#define		bTxHTSIG1						0xffffff
+#define		bTxHTMCSRate					0x7f
+#define		bTxHTBW						0x80
+#define		bTxHTLength					0xffff00
+#define		bTxHTSIG2						0xffffff
+#define		bTxHTSmoothing					0x1
+#define		bTxHTSounding					0x2
+#define		bTxHTReserved					0x4
+#define		bTxHTAggreation				0x8
+#define		bTxHTSTBC						0x30
+#define		bTxHTAdvanceCoding			0x40
+#define		bTxHTShortGI					0x80
+#define		bTxHTNumberHT_LTF			0x300
+#define		bTxHTCRC8						0x3fc00
+#define		bCounterReset					0x10000
+#define		bNumOfOFDMTx					0xffff
+#define		bNumOfCCKTx					0xffff0000
+#define		bTxIdleInterval					0xffff
+#define		bOFDMService					0xffff0000
+#define		bTxMACHeader					0xffffffff
+#define		bTxDataInit						0xff
+#define		bTxHTMode						0x100
+#define		bTxDataType					0x30000
+#define		bTxRandomSeed					0xffffffff
+#define		bCCKTxPreamble					0x1
+#define		bCCKTxSFD						0xffff0000
+#define		bCCKTxSIG						0xff
+#define		bCCKTxService					0xff00
+#define		bCCKLengthExt					0x8000
+#define		bCCKTxLength					0xffff0000
+#define		bCCKTxCRC16					0xffff
+#define		bCCKTxStatus					0x1
+#define		bOFDMTxStatus					0x2
+
+#define 		IS_BB_REG_OFFSET_92S(_Offset)		((_Offset >= 0x800) && (_Offset <= 0xfff))
+
+// 2. Page8(0x800)
+#define		bRFMOD							0x1	// Reg 0x800 rFPGA0_RFMOD
+#define		bJapanMode						0x2
+#define		bCCKTxSC						0x30
+#define		bCCKEn							0x1000000
+#define		bOFDMEn						0x2000000
+
+#define		bOFDMRxADCPhase           		0x10000	// Useless now
+#define		bOFDMTxDACPhase           		0x40000
+#define		bXATxAGC                  			0x3f
+
+#define		bAntennaSelect                 		0x0300
+
+#define		bXBTxAGC                  			0xf00	// Reg 80c rFPGA0_TxGainStage
+#define		bXCTxAGC                  			0xf000
+#define		bXDTxAGC                  			0xf0000
+       		
+#define		bPAStart                  			0xf0000000	// Useless now
+#define		bTRStart                  			0x00f00000
+#define		bRFStart                  			0x0000f000
+#define		bBBStart                  			0x000000f0
+#define		bBBCCKStart               		0x0000000f
+#define		bPAEnd                    			0xf          //Reg0x814
+#define		bTREnd                    			0x0f000000
+#define		bRFEnd                    			0x000f0000
+#define		bCCAMask                  			0x000000f0   //T2R
+#define		bR2RCCAMask               		0x00000f00
+#define		bHSSI_R2TDelay            		0xf8000000
+#define		bHSSI_T2RDelay            		0xf80000
+#define		bContTxHSSI               		0x400     //chane gain at continue Tx
+#define		bIGFromCCK                		0x200
+#define		bAGCAddress               		0x3f
+#define		bRxHPTx                   			0x7000
+#define		bRxHPT2R                  			0x38000
+#define		bRxHPCCKIni               		0xc0000
+#define		bAGCTxCode                		0xc00000
+#define		bAGCRxCode                		0x300000
+
+#define		b3WireDataLength          		0x800	// Reg 0x820~84f rFPGA0_XA_HSSIParameter1
+#define		b3WireAddressLength       		0x400
+
+#define		b3WireRFPowerDown         		0x1	// Useless now
+//#define bHWSISelect               		0x8
+#define		b5GPAPEPolarity           		0x40000000
+#define		b2GPAPEPolarity           		0x80000000
+#define		bRFSW_TxDefaultAnt        		0x3
+#define		bRFSW_TxOptionAnt         		0x30
+#define		bRFSW_RxDefaultAnt        		0x300
+#define		bRFSW_RxOptionAnt         		0x3000
+#define		bRFSI_3WireData           		0x1
+#define		bRFSI_3WireClock          		0x2
+#define		bRFSI_3WireLoad           		0x4
+#define		bRFSI_3WireRW             		0x8
+#define		bRFSI_3Wire               			0xf
+
+#define		bRFSI_RFENV               		0x10	// Reg 0x870 rFPGA0_XAB_RFInterfaceSW
+
+#define		bRFSI_TRSW                		0x20	// Useless now
+#define		bRFSI_TRSWB               		0x40
+#define		bRFSI_ANTSW               		0x100
+#define		bRFSI_ANTSWB              		0x200
+#define		bRFSI_PAPE                			0x400
+#define		bRFSI_PAPE5G              		0x800 
+#define		bBandSelect               			0x1
+#define		bHTSIG2_GI                			0x80
+#define		bHTSIG2_Smoothing         		0x01
+#define		bHTSIG2_Sounding          		0x02
+#define		bHTSIG2_Aggreaton         		0x08
+#define		bHTSIG2_STBC              		0x30
+#define		bHTSIG2_AdvCoding         		0x40
+#define		bHTSIG2_NumOfHTLTF        	0x300
+#define		bHTSIG2_CRC8              		0x3fc
+#define		bHTSIG1_MCS               		0x7f
+#define		bHTSIG1_BandWidth         		0x80
+#define		bHTSIG1_HTLength          		0xffff
+#define		bLSIG_Rate                			0xf
+#define		bLSIG_Reserved            		0x10
+#define		bLSIG_Length              		0x1fffe
+#define		bLSIG_Parity              			0x20
+#define		bCCKRxPhase               		0x4
+
+#define		bLSSIReadAddress          		0x7f800000   // T65 RF
+
+#define		bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+
+#define		bLSSIReadBackData         		0xfffff		// T65 RF
+
+#define		bLSSIReadOKFlag           		0x1000	// Useless now
+#define		bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz       		
+#define		bRegulator0Standby        		0x1
+#define		bRegulatorPLLStandby      		0x2
+#define		bRegulator1Standby        		0x4
+#define		bPLLPowerUp               		0x8
+#define		bDPLLPowerUp              		0x10
+#define		bDA10PowerUp              		0x20
+#define		bAD7PowerUp               		0x200
+#define		bDA6PowerUp               		0x2000
+#define		bXtalPowerUp              		0x4000
+#define		b40MDClkPowerUP           		0x8000
+#define		bDA6DebugMode             		0x20000
+#define		bDA6Swing                 			0x380000
+
+#define		bADClkPhase               		0x4000000	// Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ
+
+#define		b80MClkDelay              		0x18000000	// Useless
+#define		bAFEWatchDogEnable        		0x20000000
+
+#define		bXtalCap01                			0xc0000000	// Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap
+#define		bXtalCap23                			0x3
+#define		bXtalCap92x					0x0f000000
+#define 		bXtalCap                			0x0f000000
+
+#define		bIntDifClkEnable          		0x400	// Useless
+#define		bExtSigClkEnable         	 	0x800
+#define		bBandgapMbiasPowerUp      	0x10000
+#define		bAD11SHGain               		0xc0000
+#define		bAD11InputRange           		0x700000
+#define		bAD11OPCurrent            		0x3800000
+#define		bIPathLoopback            		0x4000000
+#define		bQPathLoopback            		0x8000000
+#define		bAFELoopback              		0x10000000
+#define		bDA10Swing                		0x7e0
+#define		bDA10Reverse              		0x800
+#define		bDAClkSource              		0x1000
+#define		bAD7InputRange            		0x6000
+#define		bAD7Gain                  			0x38000
+#define		bAD7OutputCMMode          		0x40000
+#define		bAD7InputCMMode           		0x380000
+#define		bAD7Current               			0xc00000
+#define		bRegulatorAdjust          		0x7000000
+#define		bAD11PowerUpAtTx          		0x1
+#define		bDA10PSAtTx               		0x10
+#define		bAD11PowerUpAtRx          		0x100
+#define		bDA10PSAtRx               		0x1000       		
+#define		bCCKRxAGCFormat           		0x200       		
+#define		bPSDFFTSamplepPoint       		0xc000
+#define		bPSDAverageNum            		0x3000
+#define		bIQPathControl            		0xc00
+#define		bPSDFreq                  			0x3ff
+#define		bPSDAntennaPath           		0x30
+#define		bPSDIQSwitch              		0x40
+#define		bPSDRxTrigger             		0x400000
+#define		bPSDTxTrigger             		0x80000000
+#define		bPSDSineToneScale        		0x7f000000
+#define		bPSDReport                			0xffff
+
+// 3. Page9(0x900)
+#define		bOFDMTxSC                 		0x30000000	// Useless
+#define		bCCKTxOn                  			0x1
+#define		bOFDMTxOn                 		0x2
+#define		bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define		bDebugItem                		0xff   //reset debug page and LWord
+#define		bAntL              	       		0x10
+#define		bAntNonHT           	      			0x100
+#define		bAntHT1               			0x1000
+#define		bAntHT2                   			0x10000
+#define		bAntHT1S1                 			0x100000
+#define		bAntNonHTS1               		0x1000000
+
+// 4. PageA(0xA00)
+#define		bCCKBBMode				0x3	// Useless
+#define		bCCKTxPowerSaving		0x80
+#define		bCCKRxPowerSaving		0x40
+
+#define		bCCKSideBand			0x10	// Reg 0xa00 rCCK0_System 20/40 switch
+
+#define		bCCKScramble			0x8	// Useless
+#define		bCCKAntDiversity		0x8000
+#define		bCCKCarrierRecovery		0x4000
+#define		bCCKTxRate				0x3000
+#define		bCCKDCCancel			0x0800
+#define		bCCKISICancel			0x0400
+#define		bCCKMatchFilter			0x0200
+#define		bCCKEqualizer			0x0100
+#define		bCCKPreambleDetect		0x800000
+#define		bCCKFastFalseCCA		0x400000
+#define		bCCKChEstStart			0x300000
+#define		bCCKCCACount			0x080000
+#define		bCCKcs_lim				0x070000
+#define		bCCKBistMode			0x80000000
+#define		bCCKCCAMask			0x40000000
+#define		bCCKTxDACPhase		0x4
+#define		bCCKRxADCPhase		0x20000000   //r_rx_clk
+#define		bCCKr_cp_mode0		0x0100
+#define		bCCKTxDCOffset			0xf0
+#define		bCCKRxDCOffset			0xf
+#define		bCCKCCAMode			0xc000
+#define		bCCKFalseCS_lim			0x3f00
+#define		bCCKCS_ratio			0xc00000
+#define		bCCKCorgBit_sel			0x300000
+#define		bCCKPD_lim				0x0f0000
+#define		bCCKNewCCA			0x80000000
+#define		bCCKRxHPofIG			0x8000
+#define		bCCKRxIG				0x7f00
+#define		bCCKLNAPolarity			0x800000
+#define		bCCKRx1stGain			0x7f0000
+#define		bCCKRFExtend			0x20000000 //CCK Rx Iinital gain polarity
+#define		bCCKRxAGCSatLevel		0x1f000000
+#define		bCCKRxAGCSatCount		0xe0
+#define		bCCKRxRFSettle			0x1f       //AGCsamp_dly
+#define		bCCKFixedRxAGC			0x8000
+//#define bCCKRxAGCFormat         	 	0x4000   //remove to HSSI register 0x824
+#define		bCCKAntennaPolarity		0x2000
+#define		bCCKTxFilterType		0x0c00
+#define		bCCKRxAGCReportType	0x0300
+#define		bCCKRxDAGCEn			0x80000000
+#define		bCCKRxDAGCPeriod		0x20000000
+#define		bCCKRxDAGCSatLevel		0x1f000000
+#define		bCCKTimingRecovery		0x800000
+#define		bCCKTxC0				0x3f0000
+#define		bCCKTxC1				0x3f000000
+#define		bCCKTxC2				0x3f
+#define		bCCKTxC3				0x3f00
+#define		bCCKTxC4				0x3f0000
+#define		bCCKTxC5				0x3f000000
+#define		bCCKTxC6				0x3f
+#define		bCCKTxC7				0x3f00
+#define		bCCKDebugPort			0xff0000
+#define		bCCKDACDebug			0x0f000000
+#define		bCCKFalseAlarmEnable	0x8000
+#define		bCCKFalseAlarmRead		0x4000
+#define		bCCKTRSSI				0x7f
+#define		bCCKRxAGCReport		0xfe
+#define		bCCKRxReport_AntSel	0x80000000
+#define		bCCKRxReport_MFOff		0x40000000
+#define		bCCKRxRxReport_SQLoss	0x20000000
+#define		bCCKRxReport_Pktloss	0x10000000
+#define		bCCKRxReport_Lockedbit	0x08000000
+#define		bCCKRxReport_RateError	0x04000000
+#define		bCCKRxReport_RxRate	0x03000000
+#define		bCCKRxFACounterLower	0xff
+#define		bCCKRxFACounterUpper	0xff000000
+#define		bCCKRxHPAGCStart		0xe000
+#define		bCCKRxHPAGCFinal		0x1c00       		
+#define		bCCKRxFalseAlarmEnable	0x8000
+#define		bCCKFACounterFreeze	0x4000       		
+#define		bCCKTxPathSel			0x10000000
+#define		bCCKDefaultRxPath		0xc000000
+#define		bCCKOptionRxPath		0x3000000
+
+// 5. PageC(0xC00)
+#define		bNumOfSTF				0x3	// Useless
+#define		bShift_L					0xc0
+#define		bGI_TH					0xc
+#define		bRxPathA				0x1
+#define		bRxPathB				0x2
+#define		bRxPathC				0x4
+#define		bRxPathD				0x8
+#define		bTxPathA				0x1
+#define		bTxPathB				0x2
+#define		bTxPathC				0x4
+#define		bTxPathD				0x8
+#define		bTRSSIFreq				0x200
+#define		bADCBackoff				0x3000
+#define		bDFIRBackoff			0xc000
+#define		bTRSSILatchPhase		0x10000
+#define		bRxIDCOffset			0xff
+#define		bRxQDCOffset			0xff00
+#define		bRxDFIRMode			0x1800000
+#define		bRxDCNFType			0xe000000
+#define		bRXIQImb_A				0x3ff
+#define		bRXIQImb_B				0xfc00
+#define		bRXIQImb_C				0x3f0000
+#define		bRXIQImb_D				0xffc00000
+#define		bDC_dc_Notch			0x60000
+#define		bRxNBINotch			0x1f000000
+#define		bPD_TH					0xf
+#define		bPD_TH_Opt2			0xc000
+#define		bPWED_TH				0x700
+#define		bIfMF_Win_L			0x800
+#define		bPD_Option				0x1000
+#define		bMF_Win_L				0xe000
+#define		bBW_Search_L			0x30000
+#define		bwin_enh_L				0xc0000
+#define		bBW_TH					0x700000
+#define		bED_TH2				0x3800000
+#define		bBW_option				0x4000000
+#define		bRatio_TH				0x18000000
+#define		bWindow_L				0xe0000000
+#define		bSBD_Option				0x1
+#define		bFrame_TH				0x1c
+#define		bFS_Option				0x60
+#define		bDC_Slope_check		0x80
+#define		bFGuard_Counter_DC_L	0xe00
+#define		bFrame_Weight_Short	0x7000
+#define		bSub_Tune				0xe00000
+#define		bFrame_DC_Length		0xe000000
+#define		bSBD_start_offset		0x30000000
+#define		bFrame_TH_2			0x7
+#define		bFrame_GI2_TH			0x38
+#define		bGI2_Sync_en			0x40
+#define		bSarch_Short_Early		0x300
+#define		bSarch_Short_Late		0xc00
+#define		bSarch_GI2_Late		0x70000
+#define		bCFOAntSum				0x1
+#define		bCFOAcc				0x2
+#define		bCFOStartOffset			0xc
+#define		bCFOLookBack			0x70
+#define		bCFOSumWeight			0x80
+#define		bDAGCEnable			0x10000
+#define		bTXIQImb_A				0x3ff
+#define		bTXIQImb_B				0xfc00
+#define		bTXIQImb_C				0x3f0000
+#define		bTXIQImb_D				0xffc00000
+#define		bTxIDCOffset			0xff
+#define		bTxQDCOffset			0xff00
+#define		bTxDFIRMode			0x10000
+#define		bTxPesudoNoiseOn		0x4000000
+#define		bTxPesudoNoise_A		0xff
+#define		bTxPesudoNoise_B		0xff00
+#define		bTxPesudoNoise_C		0xff0000
+#define		bTxPesudoNoise_D		0xff000000
+#define		bCCADropOption			0x20000
+#define		bCCADropThres			0xfff00000
+#define		bEDCCA_H				0xf
+#define		bEDCCA_L				0xf0
+#define		bLambda_ED			0x300
+#define		bRxInitialGain			0x7f
+#define		bRxAntDivEn				0x80
+#define		bRxAGCAddressForLNA	0x7f00
+#define		bRxHighPowerFlow		0x8000
+#define		bRxAGCFreezeThres		0xc0000
+#define		bRxFreezeStep_AGC1	0x300000
+#define		bRxFreezeStep_AGC2	0xc00000
+#define		bRxFreezeStep_AGC3	0x3000000
+#define		bRxFreezeStep_AGC0	0xc000000
+#define		bRxRssi_Cmp_En			0x10000000
+#define		bRxQuickAGCEn			0x20000000
+#define		bRxAGCFreezeThresMode	0x40000000
+#define		bRxOverFlowCheckType	0x80000000
+#define		bRxAGCShift				0x7f
+#define		bTRSW_Tri_Only			0x80
+#define		bPowerThres			0x300
+#define		bRxAGCEn				0x1
+#define		bRxAGCTogetherEn		0x2
+#define		bRxAGCMin				0x4
+#define		bRxHP_Ini				0x7
+#define		bRxHP_TRLNA			0x70
+#define		bRxHP_RSSI				0x700
+#define		bRxHP_BBP1				0x7000
+#define		bRxHP_BBP2				0x70000
+#define		bRxHP_BBP3				0x700000
+#define		bRSSI_H					0x7f0000     //the threshold for high power
+#define		bRSSI_Gen				0x7f000000   //the threshold for ant diversity
+#define		bRxSettle_TRSW			0x7
+#define		bRxSettle_LNA			0x38
+#define		bRxSettle_RSSI			0x1c0
+#define		bRxSettle_BBP			0xe00
+#define		bRxSettle_RxHP			0x7000
+#define		bRxSettle_AntSW_RSSI	0x38000
+#define		bRxSettle_AntSW		0xc0000
+#define		bRxProcessTime_DAGC	0x300000
+#define		bRxSettle_HSSI			0x400000
+#define		bRxProcessTime_BBPPW	0x800000
+#define		bRxAntennaPowerShift	0x3000000
+#define		bRSSITableSelect		0xc000000
+#define		bRxHP_Final				0x7000000
+#define		bRxHTSettle_BBP			0x7
+#define		bRxHTSettle_HSSI		0x8
+#define		bRxHTSettle_RxHP		0x70
+#define		bRxHTSettle_BBPPW		0x80
+#define		bRxHTSettle_Idle		0x300
+#define		bRxHTSettle_Reserved	0x1c00
+#define		bRxHTRxHPEn			0x8000
+#define		bRxHTAGCFreezeThres	0x30000
+#define		bRxHTAGCTogetherEn	0x40000
+#define		bRxHTAGCMin			0x80000
+#define		bRxHTAGCEn				0x100000
+#define		bRxHTDAGCEn			0x200000
+#define		bRxHTRxHP_BBP			0x1c00000
+#define		bRxHTRxHP_Final		0xe0000000
+#define		bRxPWRatioTH			0x3
+#define		bRxPWRatioEn			0x4
+#define		bRxMFHold				0x3800
+#define		bRxPD_Delay_TH1		0x38
+#define		bRxPD_Delay_TH2		0x1c0
+#define		bRxPD_DC_COUNT_MAX	0x600
+//#define bRxMF_Hold               0x3800
+#define		bRxPD_Delay_TH			0x8000
+#define		bRxProcess_Delay		0xf0000
+#define		bRxSearchrange_GI2_Early	0x700000
+#define		bRxFrame_Guard_Counter_L	0x3800000
+#define		bRxSGI_Guard_L			0xc000000
+#define		bRxSGI_Search_L		0x30000000
+#define		bRxSGI_TH				0xc0000000
+#define		bDFSCnt0				0xff
+#define		bDFSCnt1				0xff00
+#define		bDFSFlag				0xf0000       		
+#define		bMFWeightSum			0x300000
+#define		bMinIdxTH				0x7f000000       		
+#define		bDAFormat				0x40000       		
+#define		bTxChEmuEnable		0x01000000       		
+#define		bTRSWIsolation_A		0x7f
+#define		bTRSWIsolation_B		0x7f00
+#define		bTRSWIsolation_C		0x7f0000
+#define		bTRSWIsolation_D		0x7f000000       		
+#define		bExtLNAGain				0x7c00          
+
+// 6. PageE(0xE00)
+#define		bSTBCEn				0x4	// Useless
+#define		bAntennaMapping		0x10
+#define		bNss					0x20
+#define		bCFOAntSumD			0x200
+#define		bPHYCounterReset		0x8000000
+#define		bCFOReportGet			0x4000000
+#define		bOFDMContinueTx		0x10000000
+#define		bOFDMSingleCarrier		0x20000000
+#define		bOFDMSingleTone		0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define		bHTDetect			0x100
+#define		bCFOEn				0x10000
+#define		bCFOValue			0xfff00000
+#define		bSigTone_Re		0x3f
+#define		bSigTone_Im		0x7f00
+#define		bCounter_CCA		0xffff
+#define		bCounter_ParityFail	0xffff0000
+#define		bCounter_RateIllegal		0xffff
+#define		bCounter_CRC8Fail	0xffff0000
+#define		bCounter_MCSNoSupport	0xffff
+#define		bCounter_FastSync	0xffff
+#define		bShortCFO			0xfff
+#define		bShortCFOTLength	12   //total
+#define		bShortCFOFLength	11   //fraction
+#define		bLongCFO			0x7ff
+#define		bLongCFOTLength	11
+#define		bLongCFOFLength	11
+#define		bTailCFO			0x1fff
+#define		bTailCFOTLength		13
+#define		bTailCFOFLength		12       		
+#define		bmax_en_pwdB		0xffff
+#define		bCC_power_dB		0xffff0000
+#define		bnoise_pwdB		0xffff
+#define		bPowerMeasTLength	10
+#define		bPowerMeasFLength	3
+#define		bRx_HT_BW			0x1
+#define		bRxSC				0x6
+#define		bRx_HT				0x8       		
+#define		bNB_intf_det_on		0x1
+#define		bIntf_win_len_cfg	0x30
+#define		bNB_Intf_TH_cfg		0x1c0       		
+#define		bRFGain				0x3f
+#define		bTableSel			0x40
+#define		bTRSW				0x80       		
+#define		bRxSNR_A			0xff
+#define		bRxSNR_B			0xff00
+#define		bRxSNR_C			0xff0000
+#define		bRxSNR_D			0xff000000
+#define		bSNREVMTLength		8
+#define		bSNREVMFLength		1       		
+#define		bCSI1st				0xff
+#define		bCSI2nd				0xff00
+#define		bRxEVM1st			0xff0000
+#define		bRxEVM2nd			0xff000000       		
+#define		bSIGEVM			0xff
+#define		bPWDB				0xff00
+#define		bSGIEN				0x10000
+       		
+#define		bSFactorQAM1		0xf	// Useless
+#define		bSFactorQAM2		0xf0
+#define		bSFactorQAM3		0xf00
+#define		bSFactorQAM4		0xf000
+#define		bSFactorQAM5		0xf0000
+#define		bSFactorQAM6		0xf0000
+#define		bSFactorQAM7		0xf00000
+#define		bSFactorQAM8		0xf000000
+#define		bSFactorQAM9		0xf0000000
+#define		bCSIScheme			0x100000
+       		
+#define		bNoiseLvlTopSet		0x3	// Useless
+#define		bChSmooth			0x4
+#define		bChSmoothCfg1		0x38
+#define		bChSmoothCfg2		0x1c0
+#define		bChSmoothCfg3		0xe00
+#define		bChSmoothCfg4		0x7000
+#define		bMRCMode			0x800000
+#define		bTHEVMCfg			0x7000000
+       		
+#define		bLoopFitType		0x1	// Useless
+#define		bUpdCFO			0x40
+#define		bUpdCFOOffData		0x80
+#define		bAdvUpdCFO			0x100
+#define		bAdvTimeCtrl		0x800
+#define		bUpdClko			0x1000
+#define		bFC					0x6000
+#define		bTrackingMode		0x8000
+#define		bPhCmpEnable		0x10000
+#define		bUpdClkoLTF		0x20000
+#define		bComChCFO			0x40000
+#define		bCSIEstiMode		0x80000
+#define		bAdvUpdEqz			0x100000
+#define		bUChCfg				0x7000000
+#define		bUpdEqz			0x8000000
+
+//Rx Pseduo noise
+#define		bRxPesudoNoiseOn		0x20000000	// Useless
+#define		bRxPesudoNoise_A		0xff
+#define		bRxPesudoNoise_B		0xff00
+#define		bRxPesudoNoise_C		0xff0000
+#define		bRxPesudoNoise_D		0xff000000
+#define		bPesudoNoiseState_A	0xffff
+#define		bPesudoNoiseState_B	0xffff0000
+#define		bPesudoNoiseState_C	0xffff
+#define		bPesudoNoiseState_D	0xffff0000
+
+//7. RF Register
+//Zebra1
+#define		bZebra1_HSSIEnable		0x8		// Useless
+#define		bZebra1_TRxControl		0xc00
+#define		bZebra1_TRxGainSetting	0x07f
+#define		bZebra1_RxCorner		0xc00
+#define		bZebra1_TxChargePump	0x38
+#define		bZebra1_RxChargePump	0x7
+#define		bZebra1_ChannelNum	0xf80
+#define		bZebra1_TxLPFBW		0x400
+#define		bZebra1_RxLPFBW		0x600
+
+//Zebra4
+#define		bRTL8256RegModeCtrl1	0x100	// Useless
+#define		bRTL8256RegModeCtrl0	0x40
+#define		bRTL8256_TxLPFBW		0x18
+#define		bRTL8256_RxLPFBW		0x600
+
+//RTL8258
+#define		bRTL8258_TxLPFBW		0xc	// Useless
+#define		bRTL8258_RxLPFBW		0xc00
+#define		bRTL8258_RSSILPFBW	0xc0
+
+
+//
+// Other Definition
+//
+
+//byte endable for sb_write
+#define		bByte0				0x1	// Useless
+#define		bByte1				0x2
+#define		bByte2				0x4
+#define		bByte3				0x8
+#define		bWord0				0x3
+#define		bWord1				0xc
+#define		bDWord				0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define		bMaskByte0			0xff	// Reg 0xc50 rOFDM0_XAAGCCore~0xC6f
+#define		bMaskByte1			0xff00
+#define		bMaskByte2			0xff0000
+#define		bMaskByte3			0xff000000
+#define		bMaskHWord		0xffff0000
+#define		bMaskLWord			0x0000ffff
+#define		bMaskDWord		0xffffffff
+#define		bMask12Bits			0xfff
+#define		bMaskH4Bits			0xf0000000	
+#define		bMaskOFDM_D		0xffc00000
+#define		bMaskCCK			0x3f3f3f3f
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+//#define		bMask12Bits               	0xfffff	// RF Reg mask bits
+//#define		bMask20Bits               	0xfffff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask		0xfffff
+//#define 		bRFRegOffsetMask		0xfff	
+
+//MAC0 will wirte PHY1
+#define	MAC0_ACCESS_PHY1	0x4000
+//MAC1 will wirte PHY0
+#define	MAC1_ACCESS_PHY0	0x2000
+
+#define		bEnable			0x1	// Useless
+#define		bDisable		0x0
+       		
+#define		LeftAntenna		0x0	// Useless
+#define		RightAntenna	0x1
+       		
+#define		tCheckTxStatus		500   //500ms // Useless
+#define		tUpdateRxCounter	100   //100ms
+       		
+#define		rateCCK		0	// Useless
+#define		rateOFDM	1
+#define		rateHT		2
+
+//define Register-End
+#define		bPMAC_End			0x1ff	// Useless
+#define		bFPGAPHY0_End		0x8ff
+#define		bFPGAPHY1_End		0x9ff
+#define		bCCKPHY0_End		0xaff
+#define		bOFDMPHY0_End		0xcff
+#define		bOFDMPHY1_End		0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define		bPMACControl		0x0		// Useless
+#define		bWMACControl		0x1
+#define		bWNICControl		0x2
+       		
+#define		PathA			0x0	// Useless
+#define		PathB			0x1
+#define		PathC			0x2
+#define		PathD			0x3
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+#endif	//__INC_HAL8192SPHYREG_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h
new file mode 100755
index 0000000000000..d6c66d993b46c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h
@@ -0,0 +1,66 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192DU_FW_IMG_H
+#define __INC_HAL8192DU_FW_IMG_H
+
+#include <basic_types.h>
+
+/*Created on  2011/11/11,  8: 8*/
+
+#define Rtl8192DUImgArrayLength 31452
+extern const u8 Rtl8192DUFwImgArray[Rtl8192DUImgArrayLength];
+#define Rtl8192DUMainArrayLength 1
+extern const u8 Rtl8192DUFwMainArray[Rtl8192DUMainArrayLength];
+#define Rtl8192DUDataArrayLength 1
+extern const u8 Rtl8192DUFwDataArray[Rtl8192DUDataArrayLength];
+#define Rtl8192DUPHY_REG_2TArrayLength 372
+extern const u32 Rtl8192DUPHY_REG_2TArray[Rtl8192DUPHY_REG_2TArrayLength];
+#define Rtl8192DUPHY_REG_1TArrayLength 1
+extern const u32 Rtl8192DUPHY_REG_1TArray[Rtl8192DUPHY_REG_1TArrayLength];
+#define Rtl8192DUPHY_REG_Array_PGLength 624
+extern const u32 Rtl8192DUPHY_REG_Array_PG[Rtl8192DUPHY_REG_Array_PGLength];
+#define Rtl8192DUPHY_REG_Array_MPLength 14
+extern const u32 Rtl8192DUPHY_REG_Array_MP[Rtl8192DUPHY_REG_Array_MPLength];
+#define Rtl8192DURadioA_2TArrayLength 378
+extern const u32 Rtl8192DURadioA_2TArray[Rtl8192DURadioA_2TArrayLength];
+#define Rtl8192DURadioB_2TArrayLength 384
+extern const u32 Rtl8192DURadioB_2TArray[Rtl8192DURadioB_2TArrayLength];
+#define Rtl8192DURadioA_1TArrayLength 1
+extern const u32 Rtl8192DURadioA_1TArray[Rtl8192DURadioA_1TArrayLength];
+#define Rtl8192DURadioB_1TArrayLength 1
+extern const u32 Rtl8192DURadioB_1TArray[Rtl8192DURadioB_1TArrayLength];
+#define Rtl8192DURadioA_2T_intPAArrayLength 378
+extern const u32 Rtl8192DURadioA_2T_intPAArray[Rtl8192DURadioA_2T_intPAArrayLength];
+#define Rtl8192DURadioB_2T_intPAArrayLength 384
+extern const u32 Rtl8192DURadioB_2T_intPAArray[Rtl8192DURadioB_2T_intPAArrayLength];
+#define Rtl8192DUMAC_2T_ArrayLength 192
+extern const u32 Rtl8192DUMAC_2T_Array[Rtl8192DUMAC_2T_ArrayLength];
+#define Rtl8192DUAGCTAB_ArrayLength 386
+extern const u32 Rtl8192DUAGCTAB_Array[Rtl8192DUAGCTAB_ArrayLength];
+#define Rtl8192DUAGCTAB_5GArrayLength 194
+extern const u32 Rtl8192DUAGCTAB_5GArray[Rtl8192DUAGCTAB_5GArrayLength];
+#define Rtl8192DUAGCTAB_2GArrayLength 194
+extern const u32 Rtl8192DUAGCTAB_2GArray[Rtl8192DUAGCTAB_2GArrayLength];
+#define Rtl8192DUAGCTAB_2TArrayLength 1
+extern const u32 Rtl8192DUAGCTAB_2TArray[Rtl8192DUAGCTAB_2TArrayLength];
+#define Rtl8192DUAGCTAB_1TArrayLength 1
+extern const u32 Rtl8192DUAGCTAB_1TArray[Rtl8192DUAGCTAB_1TArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h
new file mode 100755
index 0000000000000..cc27a776ea403
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h
@@ -0,0 +1,30 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192DU_FW_IMG_WOWLAN_H
+#define __INC_HAL8192DU_FW_IMG_WOWLAN_H
+
+/*Created on  2011/11/ 8, 14:15*/
+
+
+#define DUWWImgArrayLength 24818
+extern u8 Rtl8192DUFwWWImgArray[DUWWImgArrayLength];
+
+#endif //__INC_HAL8192DU_FW_IMG_WOWLAN_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h
new file mode 100755
index 0000000000000..e5d151cfdfba6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h
@@ -0,0 +1,137 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __HALPWRSEQCMD_H__
+#define __HALPWRSEQCMD_H__
+
+#include <drv_types.h>
+
+/*---------------------------------------------*/
+//3 The value of cmd: 4 bits
+/*---------------------------------------------*/
+#define PWR_CMD_READ			0x00
+     // offset: the read register offset
+     // msk: the mask of the read value
+     // value: N/A, left by 0
+     // note: dirver shall implement this function by read & msk
+
+#define PWR_CMD_WRITE			0x01
+     // offset: the read register offset
+     // msk: the mask of the write bits
+     // value: write value
+     // note: driver shall implement this cmd by read & msk after write
+
+#define PWR_CMD_POLLING			0x02
+     // offset: the read register offset
+     // msk: the mask of the polled value
+     // value: the value to be polled, masked by the msd field.
+     // note: driver shall implement this cmd by
+     // do{
+     // if( (Read(offset) & msk) == (value & msk) )
+     // break;
+     // } while(not timeout);
+
+#define PWR_CMD_DELAY			0x03
+     // offset: the value to delay
+     // msk: N/A
+     // value: the unit of delay, 0: us, 1: ms
+
+#define PWR_CMD_END				0x04
+     // offset: N/A
+     // msk: N/A
+     // value: N/A
+
+/*---------------------------------------------*/
+//3 The value of base: 4 bits
+/*---------------------------------------------*/
+   // define the base address of each block
+#define PWR_BASEADDR_MAC		0x00
+#define PWR_BASEADDR_USB		0x01
+#define PWR_BASEADDR_PCIE		0x02
+#define PWR_BASEADDR_SDIO		0x03
+
+/*---------------------------------------------*/
+//3 The value of interface_msk: 4 bits
+/*---------------------------------------------*/
+#define	PWR_INTF_SDIO_MSK		BIT(0)
+#define	PWR_INTF_USB_MSK		BIT(1)
+#define	PWR_INTF_PCI_MSK		BIT(2)
+#define	PWR_INTF_ALL_MSK		(BIT(0)|BIT(1)|BIT(2)|BIT(3))
+
+/*---------------------------------------------*/
+//3 The value of fab_msk: 4 bits
+/*---------------------------------------------*/
+#define	PWR_FAB_TSMC_MSK		BIT(0)
+#define	PWR_FAB_UMC_MSK			BIT(1)
+#define	PWR_FAB_ALL_MSK			(BIT(0)|BIT(1)|BIT(2)|BIT(3))
+
+/*---------------------------------------------*/
+//3 The value of cut_msk: 8 bits
+/*---------------------------------------------*/
+#define	PWR_CUT_TESTCHIP_MSK	BIT(0)
+#define	PWR_CUT_A_MSK			BIT(1)
+#define	PWR_CUT_B_MSK			BIT(2)
+#define	PWR_CUT_C_MSK			BIT(3)
+#define	PWR_CUT_D_MSK			BIT(4)
+#define	PWR_CUT_E_MSK			BIT(5)
+#define	PWR_CUT_F_MSK			BIT(6)
+#define	PWR_CUT_G_MSK			BIT(7)
+#define	PWR_CUT_ALL_MSK			0xFF
+
+
+typedef enum _PWRSEQ_CMD_DELAY_UNIT_
+{
+	PWRSEQ_DELAY_US,
+	PWRSEQ_DELAY_MS,
+} PWRSEQ_DELAY_UNIT;
+
+typedef struct _WL_PWR_CFG_
+{
+	u16 offset;
+	u8 cut_msk;
+	u8 fab_msk:4;
+	u8 interface_msk:4;
+	u8 base:4;
+	u8 cmd:4;
+	u8 msk;
+	u8 value;
+} WLAN_PWR_CFG, *PWLAN_PWR_CFG;
+
+
+#define GET_PWR_CFG_OFFSET(__PWR_CMD)		__PWR_CMD.offset
+#define GET_PWR_CFG_CUT_MASK(__PWR_CMD)		__PWR_CMD.cut_msk
+#define GET_PWR_CFG_FAB_MASK(__PWR_CMD)		__PWR_CMD.fab_msk
+#define GET_PWR_CFG_INTF_MASK(__PWR_CMD)	__PWR_CMD.interface_msk
+#define GET_PWR_CFG_BASE(__PWR_CMD)			__PWR_CMD.base
+#define GET_PWR_CFG_CMD(__PWR_CMD)			__PWR_CMD.cmd
+#define GET_PWR_CFG_MASK(__PWR_CMD)			__PWR_CMD.msk
+#define GET_PWR_CFG_VALUE(__PWR_CMD)		__PWR_CMD.value
+
+
+//================================================================================
+//	Prototype of protected function.
+//================================================================================
+u8 HalPwrSeqCmdParsing(
+	PADAPTER		padapter,
+	u8				CutVersion,
+	u8				FabVersion,
+	u8				InterfaceType,
+	WLAN_PWR_CFG	PwrCfgCmd[]);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h b/drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h
new file mode 100755
index 0000000000000..0a77785954f82
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h
@@ -0,0 +1,336 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+/*
+ * Public  General Config
+ */
+#define AUTOCONF_INCLUDED
+#define RTL871X_MODULE_NAME "92CU"
+#define DRV_NAME "rtl8192cu"
+
+#define CONFIG_USB_HCI	1
+
+#define CONFIG_RTL8192C	1
+
+#define PLATFORM_LINUX	1
+
+#define CONFIG_IOCTL_CFG80211 1
+#ifdef CONFIG_IOCTL_CFG80211
+	#define RTW_USE_CFG80211_STA_EVENT /* Indicate new sta asoc through cfg80211_new_sta */
+	//#define CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER
+	//#define CONFIG_DEBUG_CFG80211 1
+	//#define CONFIG_DRV_ISSUE_PROV_REQ // IOT FOR S2
+	#define CONFIG_SET_SCAN_DENY_TIMER
+#endif
+
+/*
+ * Internal  General Config
+ */
+//#define CONFIG_PWRCTRL
+//#define CONFIG_H2CLBK
+
+#define CONFIG_EMBEDDED_FWIMG	1
+//#define CONFIG_FILE_FWIMG
+
+#ifdef CONFIG_WAKE_ON_WLAN
+#define CONFIG_WOWLAN 1
+#endif //CONFIG_WAKE_ON_WLAN
+
+#define CONFIG_R871X_TEST	1
+
+#define CONFIG_XMIT_ACK
+#ifdef CONFIG_XMIT_ACK
+	#define CONFIG_XMIT_ACK_POLLING
+	#define CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#endif
+
+#define CONFIG_80211N_HT	1
+
+#define CONFIG_RECV_REORDERING_CTRL	1
+
+//#define CONFIG_TCP_CSUM_OFFLOAD_RX	1
+
+//#define CONFIG_BEFORE_LINKED_DIG	
+//#define CONFIG_DRVEXT_MODULE	1
+
+#ifndef CONFIG_MP_INCLUDED
+	#define CONFIG_IPS	1
+	#ifdef CONFIG_IPS
+		//#define CONFIG_IPS_LEVEL_2	1 //enable this to set default IPS mode to IPS_LEVEL_2
+	#endif
+	
+	#define SUPPORT_HW_RFOFF_DETECTED	1
+
+	#define CONFIG_LPS	1
+	#define CONFIG_BT_COEXIST	1
+
+	//befor link
+	#define CONFIG_ANTENNA_DIVERSITY
+	
+	//after link
+	#ifdef CONFIG_ANTENNA_DIVERSITY
+		#define CONFIG_SW_ANTENNA_DIVERSITY	 
+		//#define CONFIG_HW_ANTENNA_DIVERSITY	
+	#endif
+
+	#define CONFIG_IOL
+#else 	//#ifndef CONFIG_MP_INCLUDED
+	#define CONFIG_MP_IWPRIV_SUPPORT	1
+#endif 	//#ifndef CONFIG_MP_INCLUDED
+
+#define CONFIG_AP_MODE	1
+#ifdef CONFIG_AP_MODE
+	#define CONFIG_NATIVEAP_MLME	1
+	#ifndef CONFIG_NATIVEAP_MLME
+		#define CONFIG_HOSTAPD_MLME	1
+	#endif			
+	#define CONFIG_FIND_BEST_CHANNEL	1
+	//#define CONFIG_NO_WIRELESS_HANDLERS	1
+#endif
+
+//	Added by Albert 20110314
+#define CONFIG_P2P	1
+#ifdef CONFIG_P2P
+	//Added by Albert 20110812
+	//The CONFIG_WFD is for supporting the Wi-Fi display
+	#define CONFIG_WFD
+	
+	#ifndef CONFIG_WIFI_TEST
+		#define CONFIG_P2P_REMOVE_GROUP_INFO
+	#endif
+	//#define CONFIG_DBG_P2P
+
+	//#define CONFIG_P2P_PS
+	//#define CONFIG_P2P_IPS
+
+	#define P2P_OP_CHECK_SOCIAL_CH
+		// Added comment by Borg 2013/06/21
+		// Issue:  Nexus 4 is hard to do miracast.
+		// Root Cause: After group formation, 
+		//			Nexus 4 is possible to be not at OP channel of Invitation Resp/Nego Confirm but at social channel. 
+		// Patch: While scan OP channel, 
+		//		 not only scan OP channel of Invitation Resp/Nego Confirm, 
+		//		 but also scan social channel(1, 6, 11)
+#endif
+
+//	Added by Kurt 20110511
+//#define CONFIG_TDLS	1
+#ifdef CONFIG_TDLS
+//	#ifndef CONFIG_WFD
+//		#define CONFIG_WFD	1
+//	#endif
+//	#define CONFIG_TDLS_AUTOSETUP			1
+//	#define CONFIG_TDLS_AUTOCHECKALIVE		1
+#endif
+
+#define CONFIG_SKB_COPY	1//for amsdu
+
+#define CONFIG_LED
+#ifdef CONFIG_LED
+	#define CONFIG_SW_LED
+	#ifdef CONFIG_SW_LED
+		//#define CONFIG_LED_HANDLED_BY_CMD_THREAD
+	#endif
+#endif // CONFIG_LED
+
+
+
+#define USB_INTERFERENCE_ISSUE // this should be checked in all usb interface
+#define CONFIG_GLOBAL_UI_PID
+
+#define CONFIG_LAYER2_ROAMING
+#define CONFIG_LAYER2_ROAMING_RESUME
+//#define CONFIG_ADAPTOR_INFO_CACHING_FILE // now just applied on 8192cu only, should make it general...
+//#define CONFIG_RESUME_IN_WORKQUEUE
+//#define CONFIG_SET_SCAN_DENY_TIMER
+#define CONFIG_LONG_DELAY_ISSUE
+#define CONFIG_NEW_SIGNAL_STAT_PROCESS
+//#define CONFIG_SIGNAL_DISPLAY_DBM //display RX signal with dbm
+#define RTW_NOTCH_FILTER 0 /* 0:Disable, 1:Enable */
+#define CONFIG_DEAUTH_BEFORE_CONNECT
+
+#ifdef CONFIG_IOL
+	#define CONFIG_IOL_LLT
+	#define CONFIG_IOL_MAC
+	#define CONFIG_IOL_BB_PHY_REG
+	#define CONFIG_IOL_BB_AGC_TAB
+	#define CONFIG_IOL_RF_RF90_PATH_A
+	#define CONFIG_IOL_RF_RF90_PATH_B
+#endif
+
+#define CONFIG_BR_EXT	1	// Enable NAT2.5 support for STA mode interface with a L2 Bridge
+#ifdef CONFIG_BR_EXT
+#define CONFIG_BR_EXT_BRNAME	"br0"
+#endif	// CONFIG_BR_EXT
+
+#define CONFIG_TX_MCAST2UNI	1	// Support IP multicast->unicast
+//#define CONFIG_DM_ADAPTIVITY
+//#define CONFIG_CHECK_AC_LIFETIME 1	// Check packet lifetime of 4 ACs.
+
+//#define CONFIG_CONCURRENT_MODE 1
+#ifdef CONFIG_CONCURRENT_MODE
+	#define CONFIG_TSF_RESET_OFFLOAD 1			// For 2 PORT TSF SYNC.
+	//#define CONFIG_HWPORT_SWAP				//Port0->Sec , Port1 -> Pri
+	//#define CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+	//#define CONFIG_MULTI_VIR_IFACES //besides primary&secondary interfaces, extend to support more interfaces
+#endif	// CONFIG_CONCURRENT_MODE
+
+#define CONFIG_80211D
+
+/*
+ * Interface  Related Config
+ */
+ 
+//#define CONFIG_USB_ONE_OUT_EP
+//#define CONFIG_USB_INTERRUPT_IN_PIPE	1
+
+#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+	#define CONFIG_USB_TX_AGGREGATION	1
+	#define CONFIG_USB_RX_AGGREGATION	1
+#endif
+
+#define CONFIG_PREALLOC_RECV_SKB	1
+//#define CONFIG_REDUCE_USB_TX_INT	1	// Trade-off: Improve performance, but may cause TX URBs blocked by USB Host/Bus driver on few platforms.
+//#define CONFIG_EASY_REPLACEMENT	1
+
+/* 
+ * CONFIG_USE_USB_BUFFER_ALLOC_XX uses Linux USB Buffer alloc API and is for Linux platform only now!
+ */
+//#define CONFIG_USE_USB_BUFFER_ALLOC_TX 1	// Trade-off: For TX path, improve stability on some platforms, but may cause performance degrade on other platforms.
+//#define CONFIG_USE_USB_BUFFER_ALLOC_RX 1	// For RX path
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+#undef CONFIG_PREALLOC_RECV_SKB
+#endif
+
+/* 
+ * USB VENDOR REQ BUFFER ALLOCATION METHOD
+ * if not set we'll use function local variable (stack memory)
+ */
+//#define CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+#define CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+
+#define CONFIG_USB_VENDOR_REQ_MUTEX
+#define CONFIG_VENDOR_REQ_RETRY
+
+//#define CONFIG_USB_SUPPORT_ASYNC_VDN_REQ 1
+
+
+/*
+ * HAL  Related Config
+ */
+
+#define RTL8192C_RX_PACKET_NO_INCLUDE_CRC	1
+
+#define SUPPORTED_BLOCK_IO
+
+
+
+#define RTL8192CU_FW_DOWNLOAD_ENABLE	1
+
+#define CONFIG_ONLY_ONE_OUT_EP_TO_LOW	0
+
+#define CONFIG_OUT_EP_WIFI_MODE	0
+
+#define ENABLE_USB_DROP_INCORRECT_OUT	0
+
+#define RTL8192CU_ASIC_VERIFICATION	0	// For ASIC verification.
+
+#define RTL8192CU_ADHOC_WORKAROUND_SETTING	1
+
+#define DISABLE_BB_RF	0
+
+#define RTL8191C_FPGA_NETWORKTYPE_ADHOC 0
+
+#ifdef CONFIG_MP_INCLUDED
+	#define MP_DRIVER 1
+	#undef CONFIG_USB_TX_AGGREGATION
+	#undef CONFIG_USB_RX_AGGREGATION
+#else
+	#define MP_DRIVER 0
+#endif
+
+
+/*
+ * Platform  Related Config
+ */
+#ifdef CONFIG_PLATFORM_MN10300
+#define CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+
+#if	defined (CONFIG_SW_ANTENNA_DIVERSITY)
+	#undef CONFIG_SW_ANTENNA_DIVERSITY
+	#define CONFIG_HW_ANTENNA_DIVERSITY
+#endif
+
+#endif
+
+#ifdef CONFIG_WISTRON_PLATFORM
+
+#endif
+
+#ifdef CONFIG_PLATFORM_TI_DM365
+#define CONFIG_USE_USB_BUFFER_ALLOC_RX 1
+#endif
+
+#define CONFIG_ATTEMPT_TO_FIX_AP_BEACON_ERROR
+
+/*
+ * Debug  Related Config
+ */
+//#define CONFIG_DEBUG_RTL871X
+
+#define DBG	0
+//#define CONFIG_DEBUG_RTL819X
+
+//#define CONFIG_PROC_DEBUG	1
+
+//#define DBG_IO
+//#define DBG_DELAY_OS
+//#define DBG_MEM_ALLOC
+//#define DBG_IOCTL
+
+//#define DBG_TX
+//#define DBG_XMIT_BUF
+//#define DBG_TX_DROP_FRAME
+
+//#define DBG_RX_DROP_FRAME
+//#define DBG_RX_SEQ
+//#define DBG_RX_SIGNAL_DISPLAY_PROCESSING
+//#define DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED "jeff-ap"
+
+//#define DBG_EXPIRATION_CHK
+
+
+//#define DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+//#define DBG_ROAMING_TEST
+
+//#define DBG_HAL_INIT_PROFILING
+
+//#define DBG_MEMORY_LEAK	1
+
+//#define DBG_CONFIG_ERROR_DETECT
+//#define DBG_CONFIG_ERROR_RESET
+
+//TX use 1 urb
+//#define CONFIG_SINGLE_XMIT_BUF
+//RX use 1 urb
+//#define CONFIG_SINGLE_RECV_BUF
+
+//turn off power tracking when traffic is busy
+//#define CONFIG_BUSY_TRAFFIC_SKIP_PWR_TRACK
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h b/drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h
new file mode 100755
index 0000000000000..f76e68ffe96a5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h
@@ -0,0 +1,321 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __BASIC_TYPES_H__
+#define __BASIC_TYPES_H__
+
+#include <drv_conf.h>
+
+
+#define SUCCESS	0
+#define FAIL	(-1)
+
+#ifndef TRUE
+	#define _TRUE	1
+#else
+	#define _TRUE	TRUE	
+#endif
+		
+#ifndef FALSE		
+	#define _FALSE	0
+#else
+	#define _FALSE	FALSE	
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	typedef signed char s8;
+	typedef unsigned char u8;
+
+	typedef signed short s16;
+	typedef unsigned short u16;
+
+	typedef signed long s32;
+	typedef unsigned long u32;
+	
+	typedef unsigned int	uint;
+	typedef	signed int		sint;
+
+
+	typedef signed long long s64;
+	typedef unsigned long long u64;
+
+	#ifdef NDIS50_MINIPORT
+	
+		#define NDIS_MAJOR_VERSION       5
+		#define NDIS_MINOR_VERSION       0
+
+	#endif
+
+	#ifdef NDIS51_MINIPORT
+
+		#define NDIS_MAJOR_VERSION       5
+		#define NDIS_MINOR_VERSION       1
+
+	#endif
+
+	typedef NDIS_PROC proc_t;
+
+	typedef LONG atomic_t;
+
+#endif
+
+
+#ifdef PLATFORM_LINUX
+
+	#include <linux/types.h>
+	#define IN
+	#define OUT
+	#define VOID void
+	#define NDIS_OID uint
+	#define NDIS_STATUS uint
+
+	typedef	signed int sint;
+
+	#ifndef	PVOID
+	typedef void * PVOID;
+	//#define PVOID	(void *)
+	#endif
+
+        #define UCHAR u8
+	#define USHORT u16
+	#define UINT u32
+	#define ULONG u32	
+
+	typedef void (*proc_t)(void*);
+
+	typedef 	__kernel_size_t	SIZE_T;	
+	typedef	__kernel_ssize_t	SSIZE_T;
+	#define FIELD_OFFSET(s,field)	((SSIZE_T)&((s*)(0))->field)
+	
+#endif
+
+
+#ifdef PLATFORM_FREEBSD
+
+	typedef signed char s8;
+	typedef unsigned char u8;
+
+	typedef signed short s16;
+	typedef unsigned short u16;
+
+	typedef signed int s32;
+	typedef unsigned int u32;
+	
+	typedef unsigned int	uint;
+	typedef	signed int		sint;
+	typedef long atomic_t;
+
+	typedef signed long long s64;
+	typedef unsigned long long u64;
+	#define IN
+	#define OUT
+	#define VOID void
+	#define NDIS_OID uint
+	#define NDIS_STATUS uint
+	
+	#ifndef	PVOID
+	typedef void * PVOID;
+	//#define PVOID	(void *)
+	#endif
+	typedef u32 dma_addr_t;
+    #define UCHAR u8
+	#define USHORT u16
+	#define UINT u32
+	#define ULONG u32	
+
+	typedef void (*proc_t)(void*);
+  
+  typedef unsigned int __kernel_size_t;
+  typedef int __kernel_ssize_t;
+  
+	typedef 	__kernel_size_t	SIZE_T;	
+	typedef	__kernel_ssize_t	SSIZE_T;
+	#define FIELD_OFFSET(s,field)	((SSIZE_T)&((s*)(0))->field)
+	
+#endif
+
+#define MEM_ALIGNMENT_OFFSET	(sizeof (SIZE_T))
+#define MEM_ALIGNMENT_PADDING	(sizeof(SIZE_T) - 1)
+
+#define SIZE_PTR SIZE_T
+#define SSIZE_PTR SSIZE_T
+
+//port from fw by thomas
+// TODO: Belows are Sync from SD7-Driver. It is necessary to check correctness
+
+/*
+ *	Call endian free function when
+ *		1. Read/write packet content.
+ *		2. Before write integer to IO.
+ *		3. After read integer from IO.
+*/
+
+//
+// Byte Swapping routine.
+//
+#define EF1Byte	
+#define EF2Byte 	le16_to_cpu
+#define EF4Byte	le32_to_cpu
+
+//
+// Read LE format data from memory
+//
+#define ReadEF1Byte(_ptr)		EF1Byte(*((u8 *)(_ptr)))
+#define ReadEF2Byte(_ptr)		EF2Byte(*((u16 *)(_ptr)))
+#define ReadEF4Byte(_ptr)		EF4Byte(*((u32 *)(_ptr)))
+
+//
+// Write LE data to memory
+//
+#define WriteEF1Byte(_ptr, _val)	(*((u8 *)(_ptr)))=EF1Byte(_val)
+#define WriteEF2Byte(_ptr, _val)	(*((u16 *)(_ptr)))=EF2Byte(_val)
+#define WriteEF4Byte(_ptr, _val)	(*((u32 *)(_ptr)))=EF4Byte(_val)									
+
+//
+//	Example:
+//		BIT_LEN_MASK_32(0) => 0x00000000
+//		BIT_LEN_MASK_32(1) => 0x00000001
+//		BIT_LEN_MASK_32(2) => 0x00000003
+//		BIT_LEN_MASK_32(32) => 0xFFFFFFFF
+//
+#define BIT_LEN_MASK_32(__BitLen) \
+	(0xFFFFFFFF >> (32 - (__BitLen)))
+//
+//	Example:
+//		BIT_OFFSET_LEN_MASK_32(0, 2) => 0x00000003
+//		BIT_OFFSET_LEN_MASK_32(16, 2) => 0x00030000
+//
+#define BIT_OFFSET_LEN_MASK_32(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_32(__BitLen) << (__BitOffset)) 
+
+//
+//	Description:
+//		Return 4-byte value in host byte ordering from
+//		4-byte pointer in litten-endian system.
+//
+#define LE_P4BYTE_TO_HOST_4BYTE(__pStart) \
+	(EF4Byte(*((u32 *)(__pStart))))
+
+//
+//	Description:
+//		Translate subfield (continuous bits in little-endian) of 4-byte value in litten byte to
+//		4-byte value in host byte ordering.
+//
+#define LE_BITS_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		( LE_P4BYTE_TO_HOST_4BYTE(__pStart) >> (__BitOffset) ) \
+		& \
+		BIT_LEN_MASK_32(__BitLen) \
+	)
+
+//
+//	Description:
+//		Mask subfield (continuous bits in little-endian) of 4-byte value in litten byte oredering  
+//		and return the result in 4-byte value in host byte ordering.
+//
+#define LE_BITS_CLEARED_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		LE_P4BYTE_TO_HOST_4BYTE(__pStart) \
+		& \
+		( ~BIT_OFFSET_LEN_MASK_32(__BitOffset, __BitLen) ) \
+	)
+
+//
+//	Description:
+//		Set subfield of little-endian 4-byte value to specified value.	
+//
+#define SET_BITS_TO_LE_4BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u32 *)(__pStart)) = \
+		EF4Byte( \
+			LE_BITS_CLEARED_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+			| \
+			( (((u32)__Value) & BIT_LEN_MASK_32(__BitLen)) << (__BitOffset) ) \
+		);
+
+		
+#define BIT_LEN_MASK_16(__BitLen) \
+		(0xFFFF >> (16 - (__BitLen)))
+		
+#define BIT_OFFSET_LEN_MASK_16(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_16(__BitLen) << (__BitOffset))
+	
+#define LE_P2BYTE_TO_HOST_2BYTE(__pStart) \
+	(EF2Byte(*((u16 *)(__pStart))))
+	
+#define LE_BITS_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		( LE_P2BYTE_TO_HOST_2BYTE(__pStart) >> (__BitOffset) ) \
+		& \
+		BIT_LEN_MASK_16(__BitLen) \
+	)
+	
+#define LE_BITS_CLEARED_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		LE_P2BYTE_TO_HOST_2BYTE(__pStart) \
+		& \
+		( ~BIT_OFFSET_LEN_MASK_16(__BitOffset, __BitLen) ) \
+	)
+
+#define SET_BITS_TO_LE_2BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u16 *)(__pStart)) = \
+		EF2Byte( \
+			LE_BITS_CLEARED_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+			| \
+			( (((u16)__Value) & BIT_LEN_MASK_16(__BitLen)) << (__BitOffset) ) \
+		);
+			
+#define BIT_LEN_MASK_8(__BitLen) \
+		(0xFF >> (8 - (__BitLen)))
+
+#define BIT_OFFSET_LEN_MASK_8(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_8(__BitLen) << (__BitOffset))
+
+#define LE_P1BYTE_TO_HOST_1BYTE(__pStart) \
+	(EF1Byte(*((u8 *)(__pStart))))
+
+#define LE_BITS_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		( LE_P1BYTE_TO_HOST_1BYTE(__pStart) >> (__BitOffset) ) \
+		& \
+		BIT_LEN_MASK_8(__BitLen) \
+	)
+
+#define LE_BITS_CLEARED_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		LE_P1BYTE_TO_HOST_1BYTE(__pStart) \
+		& \
+		( ~BIT_OFFSET_LEN_MASK_8(__BitOffset, __BitLen) ) \
+	)
+
+#define SET_BITS_TO_LE_1BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u8 *)(__pStart)) = \
+		EF1Byte( \
+			LE_BITS_CLEARED_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+			| \
+			( (((u8)__Value) & BIT_LEN_MASK_8(__BitLen)) << (__BitOffset) ) \
+		);
+
+// Get the N-bytes aligment offset from the current length
+#define N_BYTE_ALIGMENT(__Value, __Aligment) ((__Aligment == 1) ? (__Value) : (((__Value + __Aligment - 1) / __Aligment) * __Aligment))
+
+typedef unsigned char	BOOLEAN,*PBOOLEAN;
+
+#endif //__BASIC_TYPES_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h
new file mode 100755
index 0000000000000..eca68a6569f69
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h
@@ -0,0 +1,87 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_BIG_ENDIAN_H
+#define _LINUX_BYTEORDER_BIG_ENDIAN_H
+
+#ifndef __BIG_ENDIAN
+#define __BIG_ENDIAN 4321
+#endif
+#ifndef __BIG_ENDIAN_BITFIELD
+#define __BIG_ENDIAN_BITFIELD
+#endif
+
+#include <byteorder/swab.h>
+
+#define __constant_htonl(x) ((__u32)(x))
+#define __constant_ntohl(x) ((__u32)(x))
+#define __constant_htons(x) ((__u16)(x))
+#define __constant_ntohs(x) ((__u16)(x))
+#define __constant_cpu_to_le64(x) ___constant_swab64((x))
+#define __constant_le64_to_cpu(x) ___constant_swab64((x))
+#define __constant_cpu_to_le32(x) ___constant_swab32((x))
+#define __constant_le32_to_cpu(x) ___constant_swab32((x))
+#define __constant_cpu_to_le16(x) ___constant_swab16((x))
+#define __constant_le16_to_cpu(x) ___constant_swab16((x))
+#define __constant_cpu_to_be64(x) ((__u64)(x))
+#define __constant_be64_to_cpu(x) ((__u64)(x))
+#define __constant_cpu_to_be32(x) ((__u32)(x))
+#define __constant_be32_to_cpu(x) ((__u32)(x))
+#define __constant_cpu_to_be16(x) ((__u16)(x))
+#define __constant_be16_to_cpu(x) ((__u16)(x))
+#define __cpu_to_le64(x) __swab64((x))
+#define __le64_to_cpu(x) __swab64((x))
+#define __cpu_to_le32(x) __swab32((x))
+#define __le32_to_cpu(x) __swab32((x))
+#define __cpu_to_le16(x) __swab16((x))
+#define __le16_to_cpu(x) __swab16((x))
+#define __cpu_to_be64(x) ((__u64)(x))
+#define __be64_to_cpu(x) ((__u64)(x))
+#define __cpu_to_be32(x) ((__u32)(x))
+#define __be32_to_cpu(x) ((__u32)(x))
+#define __cpu_to_be16(x) ((__u16)(x))
+#define __be16_to_cpu(x) ((__u16)(x))
+#define __cpu_to_le64p(x) __swab64p((x))
+#define __le64_to_cpup(x) __swab64p((x))
+#define __cpu_to_le32p(x) __swab32p((x))
+#define __le32_to_cpup(x) __swab32p((x))
+#define __cpu_to_le16p(x) __swab16p((x))
+#define __le16_to_cpup(x) __swab16p((x))
+#define __cpu_to_be64p(x) (*(__u64*)(x))
+#define __be64_to_cpup(x) (*(__u64*)(x))
+#define __cpu_to_be32p(x) (*(__u32*)(x))
+#define __be32_to_cpup(x) (*(__u32*)(x))
+#define __cpu_to_be16p(x) (*(__u16*)(x))
+#define __be16_to_cpup(x) (*(__u16*)(x))
+#define __cpu_to_le64s(x) __swab64s((x))
+#define __le64_to_cpus(x) __swab64s((x))
+#define __cpu_to_le32s(x) __swab32s((x))
+#define __le32_to_cpus(x) __swab32s((x))
+#define __cpu_to_le16s(x) __swab16s((x))
+#define __le16_to_cpus(x) __swab16s((x))
+#define __cpu_to_be64s(x) do {} while (0)
+#define __be64_to_cpus(x) do {} while (0)
+#define __cpu_to_be32s(x) do {} while (0)
+#define __be32_to_cpus(x) do {} while (0)
+#define __cpu_to_be16s(x) do {} while (0)
+#define __be16_to_cpus(x) do {} while (0)
+
+#include <byteorder/generic.h>
+
+#endif /* _LINUX_BYTEORDER_BIG_ENDIAN_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h
new file mode 100755
index 0000000000000..7c8d4d7047bc1
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h
@@ -0,0 +1,212 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_GENERIC_H
+#define _LINUX_BYTEORDER_GENERIC_H
+
+/*
+ * linux/byteorder_generic.h
+ * Generic Byte-reordering support
+ *
+ * Francois-Rene Rideau <fare@tunes.org> 19970707
+ *    gathered all the good ideas from all asm-foo/byteorder.h into one file,
+ *    cleaned them up.
+ *    I hope it is compliant with non-GCC compilers.
+ *    I decided to put __BYTEORDER_HAS_U64__ in byteorder.h,
+ *    because I wasn't sure it would be ok to put it in types.h
+ *    Upgraded it to 2.1.43
+ * Francois-Rene Rideau <fare@tunes.org> 19971012
+ *    Upgraded it to 2.1.57
+ *    to please Linus T., replaced huge #ifdef's between little/big endian
+ *    by nestedly #include'd files.
+ * Francois-Rene Rideau <fare@tunes.org> 19971205
+ *    Made it to 2.1.71; now a facelift:
+ *    Put files under include/linux/byteorder/
+ *    Split swab from generic support.
+ *
+ * TODO:
+ *   = Regular kernel maintainers could also replace all these manual
+ *    byteswap macros that remain, disseminated among drivers,
+ *    after some grep or the sources...
+ *   = Linus might want to rename all these macros and files to fit his taste,
+ *    to fit his personal naming scheme.
+ *   = it seems that a few drivers would also appreciate
+ *    nybble swapping support...
+ *   = every architecture could add their byteswap macro in asm/byteorder.h
+ *    see how some architectures already do (i386, alpha, ppc, etc)
+ *   = cpu_to_beXX and beXX_to_cpu might some day need to be well
+ *    distinguished throughout the kernel. This is not the case currently,
+ *    since little endian, big endian, and pdp endian machines needn't it.
+ *    But this might be the case for, say, a port of Linux to 20/21 bit
+ *    architectures (and F21 Linux addict around?).
+ */
+
+/*
+ * The following macros are to be defined by <asm/byteorder.h>:
+ *
+ * Conversion of long and short int between network and host format
+ *	ntohl(__u32 x)
+ *	ntohs(__u16 x)
+ *	htonl(__u32 x)
+ *	htons(__u16 x)
+ * It seems that some programs (which? where? or perhaps a standard? POSIX?)
+ * might like the above to be functions, not macros (why?).
+ * if that's true, then detect them, and take measures.
+ * Anyway, the measure is: define only ___ntohl as a macro instead,
+ * and in a separate file, have
+ * unsigned long inline ntohl(x){return ___ntohl(x);}
+ *
+ * The same for constant arguments
+ *	__constant_ntohl(__u32 x)
+ *	__constant_ntohs(__u16 x)
+ *	__constant_htonl(__u32 x)
+ *	__constant_htons(__u16 x)
+ *
+ * Conversion of XX-bit integers (16- 32- or 64-)
+ * between native CPU format and little/big endian format
+ * 64-bit stuff only defined for proper architectures
+ *	cpu_to_[bl]eXX(__uXX x)
+ *	[bl]eXX_to_cpu(__uXX x)
+ *
+ * The same, but takes a pointer to the value to convert
+ *	cpu_to_[bl]eXXp(__uXX x)
+ *	[bl]eXX_to_cpup(__uXX x)
+ *
+ * The same, but change in situ
+ *	cpu_to_[bl]eXXs(__uXX x)
+ *	[bl]eXX_to_cpus(__uXX x)
+ *
+ * See asm-foo/byteorder.h for examples of how to provide
+ * architecture-optimized versions
+ *
+ */
+
+
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_WINDOWS) || defined(PLATFORM_MPIXEL) || defined(PLATFORM_FREEBSD)
+/*
+ * inside the kernel, we can use nicknames;
+ * outside of it, we must avoid POSIX namespace pollution...
+ */
+#define cpu_to_le64 __cpu_to_le64
+#define le64_to_cpu __le64_to_cpu
+#define cpu_to_le32 __cpu_to_le32
+#define le32_to_cpu __le32_to_cpu
+#define cpu_to_le16 __cpu_to_le16
+#define le16_to_cpu __le16_to_cpu
+#define cpu_to_be64 __cpu_to_be64
+#define be64_to_cpu __be64_to_cpu
+#define cpu_to_be32 __cpu_to_be32
+#define be32_to_cpu __be32_to_cpu
+#define cpu_to_be16 __cpu_to_be16
+#define be16_to_cpu __be16_to_cpu
+#define cpu_to_le64p __cpu_to_le64p
+#define le64_to_cpup __le64_to_cpup
+#define cpu_to_le32p __cpu_to_le32p
+#define le32_to_cpup __le32_to_cpup
+#define cpu_to_le16p __cpu_to_le16p
+#define le16_to_cpup __le16_to_cpup
+#define cpu_to_be64p __cpu_to_be64p
+#define be64_to_cpup __be64_to_cpup
+#define cpu_to_be32p __cpu_to_be32p
+#define be32_to_cpup __be32_to_cpup
+#define cpu_to_be16p __cpu_to_be16p
+#define be16_to_cpup __be16_to_cpup
+#define cpu_to_le64s __cpu_to_le64s
+#define le64_to_cpus __le64_to_cpus
+#define cpu_to_le32s __cpu_to_le32s
+#define le32_to_cpus __le32_to_cpus
+#define cpu_to_le16s __cpu_to_le16s
+#define le16_to_cpus __le16_to_cpus
+#define cpu_to_be64s __cpu_to_be64s
+#define be64_to_cpus __be64_to_cpus
+#define cpu_to_be32s __cpu_to_be32s
+#define be32_to_cpus __be32_to_cpus
+#define cpu_to_be16s __cpu_to_be16s
+#define be16_to_cpus __be16_to_cpus
+#endif
+
+
+/*
+ * Handle ntohl and suches. These have various compatibility
+ * issues - like we want to give the prototype even though we
+ * also have a macro for them in case some strange program
+ * wants to take the address of the thing or something..
+ *
+ * Note that these used to return a "long" in libc5, even though
+ * long is often 64-bit these days.. Thus the casts.
+ *
+ * They have to be macros in order to do the constant folding
+ * correctly - if the argument passed into a inline function
+ * it is no longer constant according to gcc..
+ */
+
+#undef ntohl
+#undef ntohs
+#undef htonl
+#undef htons
+
+/*
+ * Do the prototypes. Somebody might want to take the
+ * address or some such sick thing..
+ */
+#if defined(PLATFORM_LINUX) || (defined (__GLIBC__) && __GLIBC__ >= 2)
+extern __u32			ntohl(__u32);
+extern __u32			htonl(__u32);
+#else //defined(PLATFORM_LINUX) || (defined (__GLIBC__) && __GLIBC__ >= 2)
+#ifndef PLATFORM_FREEBSD
+extern unsigned long int	ntohl(unsigned long int);
+extern unsigned long int	htonl(unsigned long int);
+#endif
+#endif
+#ifndef PLATFORM_FREEBSD
+extern unsigned short int	ntohs(unsigned short int);
+extern unsigned short int	htons(unsigned short int);
+#endif
+
+#if defined(__GNUC__) && (__GNUC__ >= 2) && defined(__OPTIMIZE__) ||  defined(PLATFORM_MPIXEL)
+
+#define ___htonl(x) __cpu_to_be32(x)
+#define ___htons(x) __cpu_to_be16(x)
+#define ___ntohl(x) __be32_to_cpu(x)
+#define ___ntohs(x) __be16_to_cpu(x)
+
+#if defined(PLATFORM_LINUX) || (defined (__GLIBC__) && __GLIBC__ >= 2)
+#define htonl(x) ___htonl(x)
+#define ntohl(x) ___ntohl(x)
+#else
+#define htonl(x) ((unsigned long)___htonl(x))
+#define ntohl(x) ((unsigned long)___ntohl(x))
+#endif
+#define htons(x) ___htons(x)
+#define ntohs(x) ___ntohs(x)
+
+#endif /* OPTIMIZE */
+
+
+#if defined (PLATFORM_WINDOWS)
+
+#define htonl(x) __cpu_to_be32(x)
+#define ntohl(x) __be32_to_cpu(x)
+#define htons(x) __cpu_to_be16(x)
+#define ntohs(x) __be16_to_cpu(x)
+
+
+#endif
+
+#endif /* _LINUX_BYTEORDER_GENERIC_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h
new file mode 100755
index 0000000000000..433045e469390
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h
@@ -0,0 +1,89 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_LITTLE_ENDIAN_H
+#define _LINUX_BYTEORDER_LITTLE_ENDIAN_H
+
+#ifndef __LITTLE_ENDIAN
+#define __LITTLE_ENDIAN 1234
+#endif
+#ifndef __LITTLE_ENDIAN_BITFIELD
+#define __LITTLE_ENDIAN_BITFIELD
+#endif
+
+#include <byteorder/swab.h>
+
+#ifndef __constant_htonl
+#define __constant_htonl(x) ___constant_swab32((x))
+#define __constant_ntohl(x) ___constant_swab32((x))
+#define __constant_htons(x) ___constant_swab16((x))
+#define __constant_ntohs(x) ___constant_swab16((x))
+#define __constant_cpu_to_le64(x) ((__u64)(x))
+#define __constant_le64_to_cpu(x) ((__u64)(x))
+#define __constant_cpu_to_le32(x) ((__u32)(x))
+#define __constant_le32_to_cpu(x) ((__u32)(x))
+#define __constant_cpu_to_le16(x) ((__u16)(x))
+#define __constant_le16_to_cpu(x) ((__u16)(x))
+#define __constant_cpu_to_be64(x) ___constant_swab64((x))
+#define __constant_be64_to_cpu(x) ___constant_swab64((x))
+#define __constant_cpu_to_be32(x) ___constant_swab32((x))
+#define __constant_be32_to_cpu(x) ___constant_swab32((x))
+#define __constant_cpu_to_be16(x) ___constant_swab16((x))
+#define __constant_be16_to_cpu(x) ___constant_swab16((x))
+#define __cpu_to_le64(x) ((__u64)(x))
+#define __le64_to_cpu(x) ((__u64)(x))
+#define __cpu_to_le32(x) ((__u32)(x))
+#define __le32_to_cpu(x) ((__u32)(x))
+#define __cpu_to_le16(x) ((__u16)(x))
+#define __le16_to_cpu(x) ((__u16)(x))
+#define __cpu_to_be64(x) __swab64((x))
+#define __be64_to_cpu(x) __swab64((x))
+#define __cpu_to_be32(x) __swab32((x))
+#define __be32_to_cpu(x) __swab32((x))
+#define __cpu_to_be16(x) __swab16((x))
+#define __be16_to_cpu(x) __swab16((x))
+#define __cpu_to_le64p(x) (*(__u64*)(x))
+#define __le64_to_cpup(x) (*(__u64*)(x))
+#define __cpu_to_le32p(x) (*(__u32*)(x))
+#define __le32_to_cpup(x) (*(__u32*)(x))
+#define __cpu_to_le16p(x) (*(__u16*)(x))
+#define __le16_to_cpup(x) (*(__u16*)(x))
+#define __cpu_to_be64p(x) __swab64p((x))
+#define __be64_to_cpup(x) __swab64p((x))
+#define __cpu_to_be32p(x) __swab32p((x))
+#define __be32_to_cpup(x) __swab32p((x))
+#define __cpu_to_be16p(x) __swab16p((x))
+#define __be16_to_cpup(x) __swab16p((x))
+#define __cpu_to_le64s(x) do {} while (0)
+#define __le64_to_cpus(x) do {} while (0)
+#define __cpu_to_le32s(x) do {} while (0)
+#define __le32_to_cpus(x) do {} while (0)
+#define __cpu_to_le16s(x) do {} while (0)
+#define __le16_to_cpus(x) do {} while (0)
+#define __cpu_to_be64s(x) __swab64s((x))
+#define __be64_to_cpus(x) __swab64s((x))
+#define __cpu_to_be32s(x) __swab32s((x))
+#define __be32_to_cpus(x) __swab32s((x))
+#define __cpu_to_be16s(x) __swab16s((x))
+#define __be16_to_cpus(x) __swab16s((x))
+#endif	// __constant_htonl
+
+#include <byteorder/generic.h>
+
+#endif /* _LINUX_BYTEORDER_LITTLE_ENDIAN_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h
new file mode 100755
index 0000000000000..a3ca9eaecb956
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h
@@ -0,0 +1,140 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_SWAB_H
+#define _LINUX_BYTEORDER_SWAB_H
+
+#if !defined(CONFIG_PLATFORM_MSTAR)
+#ifndef __u16
+typedef unsigned short __u16;
+#endif
+
+#ifndef __u32
+typedef unsigned int	__u32;
+#endif
+
+#ifndef __u8
+typedef unsigned char __u8;
+#endif
+
+#ifndef __u64
+typedef unsigned long long	__u64;	
+#endif
+
+
+__inline static __u16  ___swab16(__u16 x)
+{
+	__u16 __x = x; 
+	return 
+	((__u16)( 
+		(((__u16)(__x) & (__u16)0x00ffU) << 8) |
+		(((__u16)(__x) & (__u16)0xff00U) >> 8) ));
+
+}
+
+__inline static __u32  ___swab32(__u32 x)
+{
+	__u32 __x = (x);
+	return ((__u32)(
+		(((__u32)(__x) & (__u32)0x000000ffUL) << 24) |
+		(((__u32)(__x) & (__u32)0x0000ff00UL) <<  8) |
+		(((__u32)(__x) & (__u32)0x00ff0000UL) >>  8) |
+		(((__u32)(__x) & (__u32)0xff000000UL) >> 24) ));
+}
+
+__inline static __u64  ___swab64(__u64 x)
+{
+	__u64 __x = (x);
+	
+	return 
+	((__u64)( \
+		(__u64)(((__u64)(__x) & (__u64)0x00000000000000ffULL) << 56) | \
+		(__u64)(((__u64)(__x) & (__u64)0x000000000000ff00ULL) << 40) | \
+		(__u64)(((__u64)(__x) & (__u64)0x0000000000ff0000ULL) << 24) | \
+		(__u64)(((__u64)(__x) & (__u64)0x00000000ff000000ULL) <<  8) | \
+	        (__u64)(((__u64)(__x) & (__u64)0x000000ff00000000ULL) >>  8) | \
+		(__u64)(((__u64)(__x) & (__u64)0x0000ff0000000000ULL) >> 24) | \
+		(__u64)(((__u64)(__x) & (__u64)0x00ff000000000000ULL) >> 40) | \
+		(__u64)(((__u64)(__x) & (__u64)0xff00000000000000ULL) >> 56) )); \
+}
+#endif // CONFIG_PLATFORM_MSTAR
+
+#ifndef __arch__swab16
+__inline static __u16 __arch__swab16(__u16 x)
+{
+	return ___swab16(x);
+}
+
+#endif
+
+#ifndef __arch__swab32
+__inline static __u32 __arch__swab32(__u32 x)
+{
+	__u32 __tmp = (x) ; 
+	return ___swab32(__tmp);
+}
+#endif
+
+#ifndef __arch__swab64
+
+__inline static __u64 __arch__swab64(__u64 x)
+{
+	__u64 __tmp = (x) ; 
+	return ___swab64(__tmp);
+}
+
+
+#endif
+
+#ifndef __swab16
+#define __swab16(x) __fswab16(x)
+#define __swab32(x) __fswab32(x)
+#define __swab64(x) __fswab64(x)
+#endif	// __swab16
+
+#ifdef PLATFORM_FREEBSD
+__inline static __u16 __fswab16(__u16 x)
+#else
+__inline static const __u16 __fswab16(__u16 x)
+#endif //PLATFORM_FREEBSD
+{
+	return __arch__swab16(x);
+}
+#ifdef PLATFORM_FREEBSD
+__inline static __u32 __fswab32(__u32 x)
+#else
+__inline static const __u32 __fswab32(__u32 x)
+#endif //PLATFORM_FREEBSD
+{
+	return __arch__swab32(x);
+}
+
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_WINDOWS)
+#define swab16 __swab16
+#define swab32 __swab32
+#define swab64 __swab64
+#define swab16p __swab16p
+#define swab32p __swab32p
+#define swab64p __swab64p
+#define swab16s __swab16s
+#define swab32s __swab32s
+#define swab64s __swab64s
+#endif
+
+#endif /* _LINUX_BYTEORDER_SWAB_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h
new file mode 100755
index 0000000000000..7e2a118c21221
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h
@@ -0,0 +1,156 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_SWABB_H
+#define _LINUX_BYTEORDER_SWABB_H
+
+/*
+ * linux/byteorder/swabb.h
+ * SWAp Bytes Bizarrely
+ *	swaHHXX[ps]?(foo)
+ *
+ * Support for obNUXIous pdp-endian and other bizarre architectures.
+ * Will Linux ever run on such ancient beasts? if not, this file
+ * will be but a programming pearl. Still, it's a reminder that we
+ * shouldn't be making too many assumptions when trying to be portable.
+ *
+ */
+
+/*
+ * Meaning of the names I chose (vaxlinux people feel free to correct them):
+ * swahw32	swap 16-bit half-words in a 32-bit word
+ * swahb32	swap 8-bit halves of each 16-bit half-word in a 32-bit word
+ *
+ * No 64-bit support yet. I don't know NUXI conventions for long longs.
+ * I guarantee it will be a mess when it's there, though :->
+ * It will be even worse if there are conflicting 64-bit conventions.
+ * Hopefully, no one ever used 64-bit objects on NUXI machines.
+ *
+ */
+
+#define ___swahw32(x) \
+({ \
+	__u32 __x = (x); \
+	((__u32)( \
+		(((__u32)(__x) & (__u32)0x0000ffffUL) << 16) | \
+		(((__u32)(__x) & (__u32)0xffff0000UL) >> 16) )); \
+})
+#define ___swahb32(x) \
+({ \
+	__u32 __x = (x); \
+	((__u32)( \
+		(((__u32)(__x) & (__u32)0x00ff00ffUL) << 8) | \
+		(((__u32)(__x) & (__u32)0xff00ff00UL) >> 8) )); \
+})
+
+#define ___constant_swahw32(x) \
+	((__u32)( \
+		(((__u32)(x) & (__u32)0x0000ffffUL) << 16) | \
+		(((__u32)(x) & (__u32)0xffff0000UL) >> 16) ))
+#define ___constant_swahb32(x) \
+	((__u32)( \
+		(((__u32)(x) & (__u32)0x00ff00ffUL) << 8) | \
+		(((__u32)(x) & (__u32)0xff00ff00UL) >> 8) ))
+
+/*
+ * provide defaults when no architecture-specific optimization is detected
+ */
+#ifndef __arch__swahw32
+#  define __arch__swahw32(x) ___swahw32(x)
+#endif
+#ifndef __arch__swahb32
+#  define __arch__swahb32(x) ___swahb32(x)
+#endif
+
+#ifndef __arch__swahw32p
+#  define __arch__swahw32p(x) __swahw32(*(x))
+#endif
+#ifndef __arch__swahb32p
+#  define __arch__swahb32p(x) __swahb32(*(x))
+#endif
+
+#ifndef __arch__swahw32s
+#  define __arch__swahw32s(x) do { *(x) = __swahw32p((x)); } while (0)
+#endif
+#ifndef __arch__swahb32s
+#  define __arch__swahb32s(x) do { *(x) = __swahb32p((x)); } while (0)
+#endif
+
+
+/*
+ * Allow constant folding
+ */
+#if defined(__GNUC__) && (__GNUC__ >= 2) && defined(__OPTIMIZE__)
+#  define __swahw32(x) \
+(__builtin_constant_p((__u32)(x)) ? \
+ ___swahw32((x)) : \
+ __fswahw32((x)))
+#  define __swahb32(x) \
+(__builtin_constant_p((__u32)(x)) ? \
+ ___swahb32((x)) : \
+ __fswahb32((x)))
+#else
+#  define __swahw32(x) __fswahw32(x)
+#  define __swahb32(x) __fswahb32(x)
+#endif /* OPTIMIZE */
+
+
+__inline static__ __const__ __u32 __fswahw32(__u32 x)
+{
+	return __arch__swahw32(x);
+}
+__inline static__ __u32 __swahw32p(__u32 *x)
+{
+	return __arch__swahw32p(x);
+}
+__inline static__ void __swahw32s(__u32 *addr)
+{
+	__arch__swahw32s(addr);
+}
+
+
+__inline static__ __const__ __u32 __fswahb32(__u32 x)
+{
+	return __arch__swahb32(x);
+}
+__inline static__ __u32 __swahb32p(__u32 *x)
+{
+	return __arch__swahb32p(x);
+}
+__inline static__ void __swahb32s(__u32 *addr)
+{
+	__arch__swahb32s(addr);
+}
+
+#ifdef __BYTEORDER_HAS_U64__
+/*
+ * Not supported yet
+ */
+#endif /* __BYTEORDER_HAS_U64__ */
+
+#if defined(PLATFORM_LINUX)
+#define swahw32 __swahw32
+#define swahb32 __swahb32
+#define swahw32p __swahw32p
+#define swahb32p __swahb32p
+#define swahw32s __swahw32s
+#define swahb32s __swahb32s
+#endif
+
+#endif /* _LINUX_BYTEORDER_SWABB_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h b/drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h
new file mode 100755
index 0000000000000..1bd4704a7c33a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h
@@ -0,0 +1,27 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __CIRC_BUF_H_
+#define __CIRC_BUF_H_ 1
+
+#define CIRC_CNT(head,tail,size) (((head) - (tail)) & ((size)-1))
+
+#define CIRC_SPACE(head,tail,size) CIRC_CNT((tail),((head)+1),(size))
+
+#endif //_CIRC_BUF_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h
new file mode 100755
index 0000000000000..077efa731f9a7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h
@@ -0,0 +1,36 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __CMD_OSDEP_H_
+#define __CMD_OSDEP_H_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+extern sint _rtw_init_cmd_priv (struct	cmd_priv *pcmdpriv);
+extern sint _rtw_init_evt_priv(struct evt_priv *pevtpriv);
+extern void _rtw_free_evt_priv (struct	evt_priv *pevtpriv);
+extern void _rtw_free_cmd_priv (struct	cmd_priv *pcmdpriv);
+extern sint _rtw_enqueue_cmd(_queue *queue, struct cmd_obj *obj);
+extern struct	cmd_obj	*_rtw_dequeue_cmd(_queue *queue);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h
new file mode 100755
index 0000000000000..13176879f666b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h
@@ -0,0 +1,78 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_CONF_H__
+#define __DRV_CONF_H__
+#include "autoconf.h"
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+//Older Android kernel doesn't has CONFIG_ANDROID defined,
+//add this to force CONFIG_ANDROID defined
+#ifdef CONFIG_PLATFORM_ANDROID
+#define CONFIG_ANDROID
+#endif
+
+#ifdef CONFIG_ANDROID
+//Some Android build will restart the UI while non-printable ascii is passed
+//between java and c/c++ layer (JNI). We force CONFIG_VALIDATE_SSID
+//for Android here. If you are sure there is no risk on your system about this,
+//mask this macro define to support non-printable ascii ssid.
+//#define CONFIG_VALIDATE_SSID
+
+//Android expect dbm as the rx signal strength unit
+#define CONFIG_SIGNAL_DISPLAY_DBM
+#endif
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined (CONFIG_RESUME_IN_WORKQUEUE)
+	#warning "You have CONFIG_HAS_EARLYSUSPEND enabled in your system, we disable CONFIG_RESUME_IN_WORKQUEUE automatically"
+	#undef CONFIG_RESUME_IN_WORKQUEUE
+#endif
+
+#if defined(CONFIG_ANDROID_POWER) && defined (CONFIG_RESUME_IN_WORKQUEUE)
+	#warning "You have CONFIG_ANDROID_POWER enabled in your system, we disable CONFIG_RESUME_IN_WORKQUEUE automatically"
+	#undef CONFIG_RESUME_IN_WORKQUEUE
+#endif
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE //this can be removed, because there is no case for this...
+	#if !defined( CONFIG_WAKELOCK) && !defined(CONFIG_ANDROID_POWER)
+	#error "enable CONFIG_RESUME_IN_WORKQUEUE without CONFIG_WAKELOCK or CONFIG_ANDROID_POWER will suffer from the danger of wifi's unfunctionality..."
+	#error "If you still want to enable CONFIG_RESUME_IN_WORKQUEUE in this case, mask this preprossor checking and GOOD LUCK..."
+	#endif
+#endif
+
+//About USB VENDOR REQ
+#if defined(CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC) && !defined(CONFIG_USB_VENDOR_REQ_MUTEX) 
+	#warning "define CONFIG_USB_VENDOR_REQ_MUTEX for CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC automatically"
+	#define CONFIG_USB_VENDOR_REQ_MUTEX
+#endif
+#if defined(CONFIG_VENDOR_REQ_RETRY) &&  !defined(CONFIG_USB_VENDOR_REQ_MUTEX)
+	#warning "define CONFIG_USB_VENDOR_REQ_MUTEX for CONFIG_VENDOR_REQ_RETRY automatically"
+	#define CONFIG_USB_VENDOR_REQ_MUTEX
+#endif
+
+
+//#include <rtl871x_byteorder.h>
+
+#endif // __DRV_CONF_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h
new file mode 100755
index 0000000000000..0ac34f21e33ec
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h
@@ -0,0 +1,662 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*-------------------------------------------------------------------------------
+
+	For type defines and data structure defines
+
+--------------------------------------------------------------------------------*/
+
+
+#ifndef __DRV_TYPES_H__
+#define __DRV_TYPES_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <wlan_bssdef.h>
+
+
+#ifdef PLATFORM_OS_XP
+#include <drv_types_xp.h>
+#endif
+
+#ifdef PLATFORM_OS_CE
+#include <drv_types_ce.h>
+#endif
+
+#ifdef PLATFORM_LINUX
+#include <drv_types_linux.h>
+#endif
+
+enum _NIC_VERSION {
+
+	RTL8711_NIC,
+	RTL8712_NIC,
+	RTL8713_NIC,
+	RTL8716_NIC
+
+};
+
+enum{
+	UP_LINK,
+	DOWN_LINK,
+};
+typedef struct _ADAPTER _adapter, ADAPTER,*PADAPTER;
+
+#ifdef CONFIG_80211N_HT
+#include <rtw_ht.h>
+#endif
+
+#include <rtw_cmd.h>
+#include <wlan_bssdef.h>
+#include <rtw_security.h>
+#include <rtw_xmit.h>
+#include <rtw_recv.h>
+#include <hal_intf.h>
+#include <hal_com.h>
+#include <rtw_qos.h>
+#include <rtw_pwrctrl.h>
+#include <rtw_io.h>
+#include <rtw_eeprom.h>
+#include <sta_info.h>
+#include <rtw_mlme.h>
+#include <rtw_debug.h>
+#include <rtw_rf.h>
+#include <rtw_event.h>
+#include <rtw_led.h>
+#include <rtw_mlme_ext.h>
+#include <rtw_p2p.h>
+#include <rtw_tdls.h>
+#include <rtw_ap.h>
+
+#ifdef CONFIG_DRVEXT_MODULE
+#include <drvext_api.h>
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp.h>
+#endif
+
+#ifdef CONFIG_BR_EXT
+#include <rtw_br_ext.h>
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_IOCTL_CFG80211
+	#include "ioctl_cfg80211.h"	
+#endif //CONFIG_IOCTL_CFG80211
+
+#define SPEC_DEV_ID_NONE BIT(0)
+#define SPEC_DEV_ID_DISABLE_HT BIT(1)
+#define SPEC_DEV_ID_ENABLE_PS BIT(2)
+#define SPEC_DEV_ID_RF_CONFIG_1T1R BIT(3)
+#define SPEC_DEV_ID_RF_CONFIG_2T2R BIT(4)
+#define SPEC_DEV_ID_ASSIGN_IFNAME BIT(5)
+
+struct specific_device_id{
+
+	u32		flags;
+
+	u16		idVendor;
+	u16		idProduct;
+
+};
+
+struct registry_priv
+{
+	u8	chip_version;
+	u8	rfintfs;
+	u8	lbkmode;
+	u8	hci;
+	NDIS_802_11_SSID	ssid;
+	u8	network_mode;	//infra, ad-hoc, auto
+	u8	channel;//ad-hoc support requirement
+	u8	wireless_mode;//A, B, G, auto
+	u8 	scan_mode;//active, passive
+	u8	radio_enable;
+	u8	preamble;//long, short, auto
+	u8	vrtl_carrier_sense;//Enable, Disable, Auto
+	u8	vcs_type;//RTS/CTS, CTS-to-self
+	u16	rts_thresh;
+	u16  frag_thresh;
+	u8	adhoc_tx_pwr;
+	u8	soft_ap;
+	u8	power_mgnt;
+	u8	ips_mode;
+	u8	smart_ps;
+	u8	long_retry_lmt;
+	u8	short_retry_lmt;
+	u16	busy_thresh;
+	u8	ack_policy;
+	u8	mp_mode;
+	u8	software_encrypt;
+	u8	software_decrypt;
+
+	u8	acm_method;
+	  //UAPSD
+	u8	wmm_enable;
+	u8	uapsd_enable;
+	u8	uapsd_max_sp;
+	u8	uapsd_acbk_en;
+	u8	uapsd_acbe_en;
+	u8	uapsd_acvi_en;
+	u8	uapsd_acvo_en;
+
+	WLAN_BSSID_EX    dev_network;
+
+#ifdef CONFIG_80211N_HT
+	u8	ht_enable;
+	u8	cbw40_enable;
+	u8	ampdu_enable;//for tx
+	u8 	rx_stbc;
+	u8	ampdu_amsdu;//A-MPDU Supports A-MSDU is permitted
+#endif
+	u8	lowrate_two_xmit;
+
+	u8	rf_config ;
+	u8	low_power ;
+
+	u8	wifi_spec;// !turbo_mode
+
+	u8	channel_plan;
+#ifdef CONFIG_BT_COEXIST
+	u8	bt_iso;
+	u8	bt_sco;
+	u8	bt_ampdu;
+#endif
+	BOOLEAN	bAcceptAddbaReq;
+
+	u8	antdiv_cfg;
+
+	u8	usbss_enable;//0:disable,1:enable
+	u8	hwpdn_mode;//0:disable,1:enable,2:decide by EFUSE config
+	u8	hwpwrp_detect;//0:disable,1:enable
+
+	u8	hw_wps_pbc;//0:disable,1:enable
+
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+	char	adaptor_info_caching_file_path[PATH_LENGTH_MAX];
+#endif
+
+#ifdef CONFIG_LAYER2_ROAMING
+	u8	max_roaming_times; // the max number driver will try to roaming
+#endif
+
+#ifdef CONFIG_IOL
+	bool force_iol; //enable iol without other concern
+#endif
+	u8  special_rf_path; //0: 2T2R ,1: only turn on path A 1T1R, 2: only turn on path B 1T1R
+	u8	mac_phy_mode; //0:by efuse, 1:smsp, 2:dmdp, 3:dmsp.
+
+#ifdef CONFIG_80211D
+	u8 enable80211d;
+#endif
+
+	u8 ifname[16];
+	u8 if2name[16];
+
+	u8 notch_filter;
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+	u8 ext_iface_num;//primary/secondary iface is excluded
+#endif
+};
+
+
+//For registry parameters
+#define RGTRY_OFT(field) ((ULONG)FIELD_OFFSET(struct registry_priv,field))
+#define RGTRY_SZ(field)   sizeof(((struct registry_priv*) 0)->field)
+#define BSSID_OFT(field) ((ULONG)FIELD_OFFSET(WLAN_BSSID_EX,field))
+#define BSSID_SZ(field)   sizeof(((PWLAN_BSSID_EX) 0)->field)
+
+#define MAX_CONTINUAL_URB_ERR 4
+
+#ifdef CONFIG_SDIO_HCI
+#include <drv_types_sdio.h>
+#define INTF_DATA SDIO_DATA
+#endif
+
+#define GET_PRIMARY_ADAPTER(padapter) (((_adapter *)padapter)->dvobj->if1)
+
+#define GET_IFACE_NUMS(padapter) (((_adapter *)padapter)->dvobj->iface_nums)
+#define GET_ADAPTER(padapter, iface_id) (((_adapter *)padapter)->dvobj->padapters[iface_id])
+
+enum _IFACE_ID {
+	IFACE_ID0, //maping to PRIMARY_ADAPTER
+	IFACE_ID1, //maping to SECONDARY_ADAPTER
+	IFACE_ID2, 
+	IFACE_ID3, 
+	IFACE_ID_MAX,
+};
+
+struct dvobj_priv
+{
+	_adapter *if1; //PRIMARY_ADAPTER
+	_adapter *if2; //SECONDARY_ADAPTER
+
+	s32 processing_dev_remove;
+
+	//for local/global synchronization
+	_mutex hw_init_mutex;
+	_mutex h2c_fwcmd_mutex;
+	_mutex setch_mutex;
+	_mutex setbw_mutex;
+
+	unsigned char	oper_channel; //saved channel info when call set_channel_bw
+	unsigned char	oper_bwmode;
+	unsigned char	oper_ch_offset;//PRIME_CHNL_OFFSET
+	u32 on_oper_ch_time;
+
+	//extend to support mulitu interface
+	//padapters[IFACE_ID0] == if1
+	//padapters[IFACE_ID1] == if2	
+	_adapter *padapters[IFACE_ID_MAX];
+	u8 iface_nums; // total number of ifaces used runtime
+
+	//For 92D, DMDP have 2 interface.
+	u8	InterfaceNumber;
+	u8	NumInterfaces;
+	u8	DualMacMode;
+	u8	irq_alloc;
+
+/*-------- below is for SDIO INTERFACE --------*/
+
+#ifdef INTF_DATA
+	INTF_DATA intf_data;
+#endif
+
+/*-------- below is for USB INTERFACE --------*/
+
+#ifdef CONFIG_USB_HCI
+
+	u8	nr_endpoint;
+	u8	ishighspeed;
+	u8	RtNumInPipes;
+	u8	RtNumOutPipes;
+	int	ep_num[5]; //endpoint number
+
+	int	RegUsbSS;
+
+	_sema	usb_suspend_sema;
+
+#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_mutex  usb_vendor_req_mutex;
+#endif
+
+#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	u8 * usb_alloc_vendor_req_buf;
+	u8 * usb_vendor_req_buf;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+	//related device objects
+	PDEVICE_OBJECT	pphysdevobj;//pPhysDevObj;
+	PDEVICE_OBJECT	pfuncdevobj;//pFuncDevObj;
+	PDEVICE_OBJECT	pnextdevobj;//pNextDevObj;
+
+	u8	nextdevstacksz;//unsigned char NextDeviceStackSize;	//= (CHAR)CEdevice->pUsbDevObj->StackSize + 1;
+
+	//urb for control diescriptor request
+
+#ifdef PLATFORM_OS_XP
+	struct _URB_CONTROL_DESCRIPTOR_REQUEST descriptor_urb;
+	PUSB_CONFIGURATION_DESCRIPTOR	pconfig_descriptor;//UsbConfigurationDescriptor;
+#endif
+
+#ifdef PLATFORM_OS_CE
+	WCHAR			active_path[MAX_ACTIVE_REG_PATH];	// adapter regpath
+	USB_EXTENSION	usb_extension;
+
+	_nic_hdl		pipehdls_r8192c[0x10];
+#endif
+
+	u32	config_descriptor_len;//ULONG UsbConfigurationDescriptorLength;
+#endif//PLATFORM_WINDOWS
+
+#ifdef PLATFORM_LINUX
+	struct usb_interface *pusbintf;
+	struct usb_device *pusbdev;
+#endif//PLATFORM_LINUX
+
+#ifdef PLATFORM_FREEBSD
+	struct usb_interface *pusbintf;
+	struct usb_device *pusbdev;
+#endif//PLATFORM_FREEBSD
+	ATOMIC_T continual_urb_error;
+#endif//CONFIG_USB_HCI
+
+/*-------- below is for PCIE INTERFACE --------*/
+
+#ifdef CONFIG_PCI_HCI
+
+#ifdef PLATFORM_LINUX
+	struct pci_dev *ppcidev;
+
+	//PCI MEM map
+	unsigned long	pci_mem_end;	/* shared mem end	*/
+	unsigned long	pci_mem_start;	/* shared mem start	*/
+
+	//PCI IO map
+	unsigned long	pci_base_addr;	/* device I/O address	*/
+
+	//PciBridge
+	struct pci_priv	pcipriv;
+
+	u16	irqline;
+	u8	irq_enabled;
+	RT_ISR_CONTENT	isr_content;
+	_lock	irq_th_lock;
+
+	//ASPM
+	u8	const_pci_aspm;
+	u8	const_amdpci_aspm;
+	u8	const_hwsw_rfoff_d3;
+	u8	const_support_pciaspm;
+	// pci-e bridge */
+	u8 	const_hostpci_aspm_setting;
+	// pci-e device */
+	u8 	const_devicepci_aspm_setting;
+	u8 	b_support_aspm; // If it supports ASPM, Offset[560h] = 0x40, otherwise Offset[560h] = 0x00.
+	u8	b_support_backdoor;
+	u8 bdma64;
+#endif//PLATFORM_LINUX
+
+#endif//CONFIG_PCI_HCI
+};
+
+#ifdef PLATFORM_LINUX
+static struct device *dvobj_to_dev(struct dvobj_priv *dvobj)
+{
+	/* todo: get interface type from dvobj and the return the dev accordingly */
+#ifdef RTW_DVOBJ_CHIP_HW_TYPE
+#endif
+
+#ifdef CONFIG_USB_HCI
+	return &dvobj->pusbintf->dev;
+#endif
+#ifdef CONFIG_SDIO_HCI
+	return &dvobj->intf_data.func->dev;
+#endif
+#ifdef CONFIG_PCI_HCI
+	return &dvobj->ppcidev->dev;
+#endif
+}
+#endif
+
+
+enum _IFACE_TYPE {
+	IFACE_PORT0, //mapping to port0 for C/D series chips
+	IFACE_PORT1, //mapping to port1 for C/D series chip
+	MAX_IFACE_PORT,
+};
+
+enum _ADAPTER_TYPE {
+	PRIMARY_ADAPTER,
+	SECONDARY_ADAPTER,
+	MAX_ADAPTER = 0xFF,	
+};
+
+typedef enum _DRIVER_STATE{
+	DRIVER_NORMAL = 0,
+	DRIVER_DISAPPEAR = 1,
+	DRIVER_REPLACE_DONGLE = 2,
+}DRIVER_STATE;
+
+#ifdef CONFIG_INTEL_PROXIM	
+struct proxim {
+	bool proxim_support;
+	bool proxim_on;
+
+	void *proximity_priv;
+	int (*proxim_rx)(_adapter *padapter,
+		union recv_frame *precv_frame);
+	u8	(*proxim_get_var)(_adapter* padapter, u8 type);
+};
+#endif	//CONFIG_INTEL_PROXIM
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+typedef struct loopbackdata
+{
+	_sema	sema;
+	_thread_hdl_ lbkthread;
+	u8 bstop;
+	u32 cnt;
+	u16 size;
+	u16 txsize;
+	u8 txbuf[0x8000];
+	u16 rxsize;
+	u8 rxbuf[0x8000];
+	u8 msg[100];
+
+}LOOPBACKDATA, *PLOOPBACKDATA;
+#endif
+
+struct _ADAPTER{
+	int	DriverState;// for disable driver using module, use dongle to replace module.
+	int	pid[3];//process id from UI, 0:wps, 1:hostapd, 2:dhcpcd
+	int	bDongle;//build-in module or external dongle
+	u16 	chip_type;
+	u16	HardwareType;
+	u16	interface_type;//USB,SDIO,PCI
+
+	struct dvobj_priv *dvobj;
+	struct	mlme_priv mlmepriv;
+	struct	mlme_ext_priv mlmeextpriv;
+	struct	cmd_priv	cmdpriv;
+	struct	evt_priv	evtpriv;
+	//struct	io_queue	*pio_queue;
+	struct 	io_priv	iopriv;
+	struct	xmit_priv	xmitpriv;
+	struct	recv_priv	recvpriv;
+	struct	sta_priv	stapriv;
+	struct	security_priv	securitypriv;
+	_lock   security_key_mutex; // add for CONFIG_IEEE80211W, none 11w also can use
+	struct	registry_priv	registrypriv;	
+	struct	pwrctrl_priv	pwrctrlpriv;
+	struct 	eeprom_priv eeprompriv;
+	struct	led_priv	ledpriv;
+
+#ifdef CONFIG_MP_INCLUDED
+       struct	mp_priv	mppriv;
+#endif
+
+#ifdef CONFIG_DRVEXT_MODULE
+	struct	drvext_priv	drvextpriv;
+#endif
+
+#ifdef CONFIG_AP_MODE
+	struct	hostapd_priv	*phostapdpriv;
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef CONFIG_P2P
+	struct cfg80211_wifidirect_info	cfg80211_wdinfo;
+#endif //CONFIG_P2P
+#endif //CONFIG_IOCTL_CFG80211
+	u32	setband;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	wdinfo;
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_TDLS
+	struct tdls_info	tdlsinfo;
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info wfd_info;
+#endif //CONFIG_WFD
+
+	PVOID			HalData;
+	u32 hal_data_sz;
+	struct hal_ops	HalFunc;
+
+#ifdef CONFIG_BT_COEXIST
+	//struct	btcoexist_priv	bt_coexist;
+#endif
+	s32	bDriverStopped;
+	s32	bSurpriseRemoved;
+	s32  bCardDisableWOHSM;
+
+	u32	IsrContent;
+	u32	ImrContent;
+
+	u8	EepromAddressSize;
+	u8	hw_init_completed;
+	u8	bDriverIsGoingToUnload;
+	u8	init_adpt_in_progress;
+	u8	bHaltInProgress;
+
+	_thread_hdl_ cmdThread;
+	_thread_hdl_ evtThread;
+	_thread_hdl_ xmitThread;
+	_thread_hdl_ recvThread;
+
+#ifndef PLATFORM_LINUX
+	NDIS_STATUS (*dvobj_init)(struct dvobj_priv	*dvobj);
+	void (*dvobj_deinit)(struct dvobj_priv *dvobj);
+#endif
+
+	void (*intf_start)(_adapter * adapter);
+	void (*intf_stop)(_adapter * adapter);
+
+#ifdef PLATFORM_WINDOWS
+	_nic_hdl		hndis_adapter;//hNdisAdapter(NDISMiniportAdapterHandle);
+	_nic_hdl		hndis_config;//hNdisConfiguration;
+	NDIS_STRING fw_img;
+
+	u32	NdisPacketFilter;
+	u8	MCList[MAX_MCAST_LIST_NUM][6];
+	u32	MCAddrCount;
+#endif //end of PLATFORM_WINDOWS
+
+
+#ifdef PLATFORM_LINUX
+	_nic_hdl pnetdev;
+
+	// used by rtw_rereg_nd_name related function
+	struct rereg_nd_name_data {
+		_nic_hdl old_pnetdev;
+		char old_ifname[IFNAMSIZ];
+		u8 old_ips_mode;
+		u8 old_bRegUseLed;
+	} rereg_nd_name_priv;
+
+	int bup;
+	struct net_device_stats stats;
+	struct iw_statistics iwstats;
+	struct proc_dir_entry *dir_dev;// for proc directory
+
+#ifdef CONFIG_IOCTL_CFG80211
+	struct wireless_dev *rtw_wdev;
+#endif //CONFIG_IOCTL_CFG80211
+
+#endif //end of PLATFORM_LINUX
+
+#ifdef PLATFORM_FREEBSD
+	_nic_hdl pifp;
+	int bup;
+	_lock glock;
+#endif //PLATFORM_FREEBSD
+	int net_closed;
+
+	u8 bFWReady;
+	u8 bReadPortCancel;
+	u8 bWritePortCancel;
+	u8 bRxRSSIDisplay;
+	//	Added by Albert 2012/07/26
+	//	The driver will write the initial gain everytime when running in the DM_Write_DIG function.
+	u8 bForceWriteInitGain;
+	//	Added by Albert 2012/10/26
+	//	The driver will show up the desired channel number when this flag is 1.
+	u8 bNotifyChannelChange;
+#ifdef CONFIG_P2P
+	//	Added by Albert 2012/12/06
+	//	The driver will show the current P2P status when the upper application reads it.
+	u8 bShowGetP2PState;
+#endif
+#ifdef CONFIG_AUTOSUSPEND
+	u8	bDisableAutosuspend;
+#endif
+
+	//pbuddy_adapter is used only in  two inteface case, (iface_nums=2 in struct dvobj_priv)
+	//PRIMARY_ADAPTER's buddy is SECONDARY_ADAPTER
+	//SECONDARY_ADAPTER's buddy is PRIMARY_ADAPTER
+	//for iface_id > SECONDARY_ADAPTER(IFACE_ID1), refer to padapters[iface_id]  in struct dvobj_priv
+	//and their pbuddy_adapter is PRIMARY_ADAPTER.
+	//for PRIMARY_ADAPTER(IFACE_ID0) can directly refer to if1 in struct dvobj_priv
+	_adapter *pbuddy_adapter;
+	
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_DUALMAC_CONCURRENT)
+	u8 isprimary; //is primary adapter or not
+	//notes: 
+	// if isprimary is true, the adapter_type value is 0, iface_id is IFACE_ID0 for PRIMARY_ADAPTER
+	// if isprimary is false, the adapter_type value is 1, iface_id is IFACE_ID1 for SECONDARY_ADAPTER
+	// refer to iface_id if iface_nums>2 and isprimary is false and the adapter_type value is 0xff.
+	u8 adapter_type;//used only in  two inteface case(PRIMARY_ADAPTER and SECONDARY_ADAPTER) . 
+	u8 iface_type; //interface port type, it depends on HW port 
+#endif
+
+	//extend to support multi interface
+       //IFACE_ID0 is equals to PRIMARY_ADAPTER
+       //IFACE_ID1 is equals to SECONDARY_ADAPTER	
+	u8 iface_id;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	u8 DualMacConcurrent; // 1: DMSP 0:DMDP
+#endif
+
+#ifdef CONFIG_BR_EXT
+	_lock					br_ext_lock;
+	//unsigned int			macclone_completed;
+	struct nat25_network_db_entry	*nethash[NAT25_HASH_SIZE];
+	int				pppoe_connection_in_progress;
+	unsigned char			pppoe_addr[MACADDRLEN];
+	unsigned char			scdb_mac[MACADDRLEN];
+	unsigned char			scdb_ip[4];
+	struct nat25_network_db_entry	*scdb_entry;
+	unsigned char			br_mac[MACADDRLEN];
+	unsigned char			br_ip[4];
+
+	struct br_ext_info		ethBrExtInfo;
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_INTEL_PROXIM	
+	/* intel Proximity, should be alloc mem
+	 * in intel Proximity module and can only 
+	 * be used in intel Proximity mode */
+	struct proxim proximity;
+#endif	//CONFIG_INTEL_PROXIM
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+	PLOOPBACKDATA ploopback;
+#endif
+
+};
+
+#define adapter_to_dvobj(adapter) (adapter->dvobj)
+
+int rtw_handle_dualmac(_adapter *adapter, bool init);
+
+__inline static u8 *myid(struct eeprom_priv *peepriv)
+{
+	return (peepriv->mac_addr);
+}
+
+
+#endif //__DRV_TYPES_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h
new file mode 100755
index 0000000000000..be0459dcb2195
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h
@@ -0,0 +1,92 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_CE_H__
+#define __DRV_TYPES_CE_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+#include <Sdcardddk.h>
+
+#define MAX_ACTIVE_REG_PATH 256
+
+#define MAX_MCAST_LIST_NUM					32
+
+
+
+//for ioctl
+#define MAKE_DRIVER_VERSION(_MainVer,_MinorVer)	((((u32)(_MainVer))<<16)+_MinorVer)
+
+#define NIC_HEADER_SIZE				14			//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+#define NIC_MAX_SEND_PACKETS			10		// max number of send packets the MiniportSendPackets function can accept, can be moved to typedef.h
+#define NIC_VENDOR_DRIVER_VERSION       MAKE_DRIVER_VERSION(0,001)	//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+
+typedef struct _MP_REG_ENTRY
+{
+
+	NDIS_STRING		RegName;	// variable name text
+	BOOLEAN			bRequired;	// 1 -> required, 0 -> optional
+
+	u8			Type;		// NdisParameterInteger/NdisParameterHexInteger/NdisParameterStringle/NdisParameterMultiString
+	uint			FieldOffset;	// offset to MP_ADAPTER field
+	uint			FieldSize;	// size (in bytes) of the field
+	
+#ifdef UNDER_AMD64
+	u64			Default;
+#else
+	u32			Default;		// default value to use
+#endif
+
+	u32			Min;			// minimum value allowed
+	u32			Max;		// maximum value allowed
+} MP_REG_ENTRY, *PMP_REG_ENTRY;
+
+#ifdef CONFIG_USB_HCI
+typedef struct _USB_EXTENSION {
+    LPCUSB_FUNCS    _lpUsbFuncs;
+	USB_HANDLE	    _hDevice;
+    PVOID 		    pAdapter;
+
+#if 0
+	USB_ENDPOINT_DESCRIPTOR		_endpACLIn;
+    USB_ENDPOINT_DESCRIPTOR		_endpACLOutHigh;
+	USB_ENDPOINT_DESCRIPTOR		_endpACLOutNormal;
+
+	USB_PIPE        pPipeIn;
+    USB_PIPE        pPipeOutNormal;
+    USB_PIPE        pPipeOutHigh;
+#endif
+
+} USB_EXTENSION, *PUSB_EXTENSION;
+#endif
+
+
+typedef struct _OCTET_STRING{
+	u8      *Octet;
+	u16      Length;
+} OCTET_STRING, *POCTET_STRING;
+
+
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h
new file mode 100755
index 0000000000000..db1c585690ff8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h
@@ -0,0 +1,25 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_LINUX_H__
+#define __DRV_TYPES_LINUX_H__
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h
new file mode 100755
index 0000000000000..fd467ca6ddfda
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h
@@ -0,0 +1,70 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_SDIO_H__
+#define __DRV_TYPES_SDIO_H__
+
+#include <drv_conf.h>
+#include <basic_types.h>
+
+// SDIO Header Files
+#ifdef PLATFORM_LINUX
+#include <linux/mmc/sdio_func.h>
+#endif
+#ifdef PLATFORM_OS_XP
+#include <wdm.h>
+#include <ntddsd.h>
+#endif
+#ifdef PLATFORM_OS_CE
+#include <sdcardddk.h>
+#endif
+
+
+typedef struct sdio_data
+{
+	u8  func_number;
+ 
+	u8  tx_block_mode;
+	u8  rx_block_mode;
+	u32 block_transfer_len;
+
+#ifdef PLATFORM_LINUX
+	struct sdio_func	 *func;
+#endif
+
+#ifdef PLATFORM_OS_XP
+	PDEVICE_OBJECT				pphysdevobj;
+	PDEVICE_OBJECT				pfuncdevobj;
+	PDEVICE_OBJECT				pnextdevobj;
+	SDBUS_INTERFACE_STANDARD	sdbusinft;
+	u8							nextdevstacksz;
+#endif
+
+#ifdef PLATFORM_OS_CE
+	SD_DEVICE_HANDLE			hDevice;
+	SD_CARD_RCA					sd_rca;
+	SD_CARD_INTERFACE			card_intf;
+	BOOLEAN						enableIsarWithStatus;
+	WCHAR						active_path[MAX_ACTIVE_REG_PATH];
+	SD_HOST_BLOCK_CAPABILITY	sd_host_blk_cap;
+#endif
+} SDIO_DATA, *PSDIO_DATA;
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h
new file mode 100755
index 0000000000000..2d51b1db13b09
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h
@@ -0,0 +1,95 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_XP_H__
+#define __DRV_TYPES_XP_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+
+
+#define MAX_MCAST_LIST_NUM					32
+
+
+
+//for ioctl
+#define MAKE_DRIVER_VERSION(_MainVer,_MinorVer)	((((u32)(_MainVer))<<16)+_MinorVer)
+
+#define NIC_HEADER_SIZE				14			//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+#define NIC_MAX_SEND_PACKETS			10		// max number of send packets the MiniportSendPackets function can accept, can be moved to typedef.h
+#define NIC_VENDOR_DRIVER_VERSION       MAKE_DRIVER_VERSION(0,001)	//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+
+
+#undef ON_VISTA
+//added by Jackson
+#ifndef ON_VISTA
+//
+// Bus driver versions
+//
+
+#define SDBUS_DRIVER_VERSION_1          0x100
+#define SDBUS_DRIVER_VERSION_2          0x200
+
+#define    SDP_FUNCTION_TYPE	4
+#define    SDP_BUS_DRIVER_VERSION 5
+#define    SDP_BUS_WIDTH 6
+#define    SDP_BUS_CLOCK 7
+#define    SDP_BUS_INTERFACE_CONTROL 8
+#define    SDP_HOST_BLOCK_LENGTH 9
+#define    SDP_FUNCTION_BLOCK_LENGTH 10
+#define    SDP_FN0_BLOCK_LENGTH 11
+#define    SDP_FUNCTION_INT_ENABLE 12
+#endif
+
+
+typedef struct _MP_REG_ENTRY
+{
+
+	NDIS_STRING		RegName;	// variable name text
+	BOOLEAN			bRequired;	// 1 -> required, 0 -> optional
+
+	u8			Type;		// NdisParameterInteger/NdisParameterHexInteger/NdisParameterStringle/NdisParameterMultiString
+	uint			FieldOffset;	// offset to MP_ADAPTER field
+	uint			FieldSize;	// size (in bytes) of the field
+	
+#ifdef UNDER_AMD64
+	u64			Default;
+#else
+	u32			Default;		// default value to use
+#endif
+
+	u32			Min;			// minimum value allowed
+	u32			Max;		// maximum value allowed
+} MP_REG_ENTRY, *PMP_REG_ENTRY;
+
+
+typedef struct _OCTET_STRING{
+	u8      *Octet;
+	u16      Length;
+} OCTET_STRING, *POCTET_STRING;
+
+
+
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h b/drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h
new file mode 100755
index 0000000000000..36e29c060d3f7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h
@@ -0,0 +1,41 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*! \file */ 
+#ifndef __INC_ETHERNET_H
+#define __INC_ETHERNET_H
+
+#define ETHERNET_ADDRESS_LENGTH				6		//!< Ethernet Address Length
+#define ETHERNET_HEADER_SIZE				14		//!< Ethernet Header Length
+#define LLC_HEADER_SIZE						6		//!< LLC Header Length
+#define TYPE_LENGTH_FIELD_SIZE				2		//!< Type/Length Size
+#define MINIMUM_ETHERNET_PACKET_SIZE		60		//!< Minimum Ethernet Packet Size
+#define MAXIMUM_ETHERNET_PACKET_SIZE		1514	//!< Maximum Ethernet Packet Size
+
+#define RT_ETH_IS_MULTICAST(_pAddr)	((((UCHAR *)(_pAddr))[0]&0x01)!=0)		//!< Is Multicast Address?
+#define RT_ETH_IS_BROADCAST(_pAddr)	(										\
+											((UCHAR *)(_pAddr))[0]==0xff	&& 		\
+											((UCHAR *)(_pAddr))[1]==0xff	&&		\
+											((UCHAR *)(_pAddr))[2]==0xff	&&		\
+											((UCHAR *)(_pAddr))[3]==0xff	&&		\
+											((UCHAR *)(_pAddr))[4]==0xff	&&		\
+											((UCHAR *)(_pAddr))[5]==0xff		)	//!< Is Broadcast Address?
+
+
+#endif // #ifndef __INC_ETHERNET_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h b/drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h
new file mode 100755
index 0000000000000..359c9e7a8f249
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#define _H2CLBK_H_
+
+
+#include <rtl8711_spec.h>
+#include <TypeDef.h>
+
+
+void _lbk_cmd(PADAPTER Adapter);
+
+void _lbk_rsp(PADAPTER Adapter);
+
+void _lbk_evt(IN PADAPTER Adapter);
+
+void h2c_event_callback(unsigned char *dev, unsigned char *pbuf);
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h b/drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h
new file mode 100755
index 0000000000000..42aae0e057b15
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h
@@ -0,0 +1,146 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __HAL_COMMON_H__
+#define __HAL_COMMON_H__
+
+//CCK
+#define RATE_1M						BIT(0)
+#define RATE_2M						BIT(1)
+#define RATE_5_5M					BIT(2)
+#define RATE_11M					BIT(3)
+//OFDM 
+#define RATE_6M						BIT(4)
+#define RATE_9M						BIT(5)
+#define RATE_12M					BIT(6)
+#define RATE_18M					BIT(7)
+#define RATE_24M					BIT(8)
+#define RATE_36M					BIT(9)
+#define RATE_48M					BIT(10)
+#define RATE_54M					BIT(11)
+//MCS 1 Spatial Stream
+#define RATE_MCS0					BIT(12)
+#define RATE_MCS1					BIT(13)
+#define RATE_MCS2					BIT(14)
+#define RATE_MCS3					BIT(15)
+#define RATE_MCS4					BIT(16)
+#define RATE_MCS5					BIT(17)
+#define RATE_MCS6					BIT(18)
+#define RATE_MCS7					BIT(19)
+//MCS 2 Spatial Stream
+#define RATE_MCS8					BIT(20)
+#define RATE_MCS9					BIT(21)
+#define RATE_MCS10					BIT(22)
+#define RATE_MCS11					BIT(23)
+#define RATE_MCS12					BIT(24)
+#define RATE_MCS13					BIT(25)
+#define RATE_MCS14					BIT(26)
+#define RATE_MCS15					BIT(27)
+
+// ALL CCK Rate
+#define	RATE_ALL_CCK				RATR_1M|RATR_2M|RATR_55M|RATR_11M 
+#define	RATE_ALL_OFDM_AG			RATR_6M|RATR_9M|RATR_12M|RATR_18M|RATR_24M|\
+									RATR_36M|RATR_48M|RATR_54M	
+#define	RATE_ALL_OFDM_1SS			RATR_MCS0|RATR_MCS1|RATR_MCS2|RATR_MCS3 |\
+									RATR_MCS4|RATR_MCS5|RATR_MCS6	|RATR_MCS7	
+#define	RATE_ALL_OFDM_2SS			RATR_MCS8|RATR_MCS9	|RATR_MCS10|RATR_MCS11|\
+									RATR_MCS12|RATR_MCS13|RATR_MCS14|RATR_MCS15
+
+/*------------------------------ Tx Desc definition Macro ------------------------*/ 
+//#pragma mark -- Tx Desc related definition. --
+//----------------------------------------------------------------------------
+//-----------------------------------------------------------
+//	Rate
+//-----------------------------------------------------------
+// CCK Rates, TxHT = 0
+#define DESC_RATE1M				0x00
+#define DESC_RATE2M				0x01
+#define DESC_RATE5_5M				0x02
+#define DESC_RATE11M				0x03
+
+// OFDM Rates, TxHT = 0
+#define DESC_RATE6M				0x04
+#define DESC_RATE9M				0x05
+#define DESC_RATE12M				0x06
+#define DESC_RATE18M				0x07
+#define DESC_RATE24M				0x08
+#define DESC_RATE36M				0x09
+#define DESC_RATE48M				0x0a
+#define DESC_RATE54M				0x0b
+
+// MCS Rates, TxHT = 1
+#define DESC_RATEMCS0				0x0c
+#define DESC_RATEMCS1				0x0d
+#define DESC_RATEMCS2				0x0e
+#define DESC_RATEMCS3				0x0f
+#define DESC_RATEMCS4				0x10
+#define DESC_RATEMCS5				0x11
+#define DESC_RATEMCS6				0x12
+#define DESC_RATEMCS7				0x13
+#define DESC_RATEMCS8				0x14
+#define DESC_RATEMCS9				0x15
+#define DESC_RATEMCS10				0x16
+#define DESC_RATEMCS11				0x17
+#define DESC_RATEMCS12				0x18
+#define DESC_RATEMCS13				0x19
+#define DESC_RATEMCS14				0x1a
+#define DESC_RATEMCS15				0x1b
+#define DESC_RATEMCS15_SG			0x1c
+#define DESC_RATEMCS32				0x20
+
+//============================================================
+// Global var
+//============================================================
+#define	OFDM_TABLE_SIZE_92C 	37
+#define	OFDM_TABLE_SIZE_92D 	43
+#define	CCK_TABLE_SIZE		33
+
+extern u32 OFDMSwingTable[OFDM_TABLE_SIZE_92D] ;
+
+extern u8 CCKSwingTable_Ch1_Ch13[CCK_TABLE_SIZE][8];
+
+extern u8 CCKSwingTable_Ch14 [CCK_TABLE_SIZE][8];
+
+#ifdef CONFIG_CHIP_VER_INTEGRATION
+void dump_chip_info(HAL_VERSION	ChipVersion);
+#endif
+
+u8	//return the final channel plan decision
+hal_com_get_channel_plan(
+	IN	PADAPTER	padapter,
+	IN	u8			hw_channel_plan,	//channel plan from HW (efuse/eeprom)
+	IN	u8			sw_channel_plan,	//channel plan from SW (registry/module param)
+	IN	u8			def_channel_plan,	//channel plan used when the former two is invalid
+	IN	BOOLEAN		AutoLoadFail
+	);
+
+void	HalSetBrateCfg(
+	IN PADAPTER		Adapter,
+	IN u8			*mBratesOS,
+	OUT u16			*pBrateCfg);
+
+u8	MRateToHwRate(u8 rate);
+
+void hal_init_macaddr(_adapter *adapter);
+
+void c2h_evt_clear(_adapter *adapter);
+s32 c2h_evt_read(_adapter *adapter, u8 *buf);
+
+#endif //__HAL_COMMON_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h b/drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h
new file mode 100755
index 0000000000000..dd8266229eddb
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h
@@ -0,0 +1,432 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __HAL_INTF_H__
+#define __HAL_INTF_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_hal.h>
+#endif
+
+
+enum RTL871X_HCI_TYPE {
+
+	RTW_SDIO,
+	RTW_USB,
+	RTW_PCIE
+};
+
+enum _CHIP_TYPE {
+
+	NULL_CHIP_TYPE,
+	RTL8712_8188S_8191S_8192S,
+	RTL8188C_8192C,
+	RTL8192D,
+	RTL8723A,
+	RTL8188E,	
+	MAX_CHIP_TYPE
+};
+
+
+typedef enum _HW_VARIABLES{
+	HW_VAR_MEDIA_STATUS,
+	HW_VAR_MEDIA_STATUS1,
+	HW_VAR_SET_OPMODE,
+	HW_VAR_MAC_ADDR,
+	HW_VAR_BSSID,
+	HW_VAR_INIT_RTS_RATE,
+	HW_VAR_INIT_DATA_RATE,
+	HW_VAR_BASIC_RATE,
+	HW_VAR_TXPAUSE,
+	HW_VAR_BCN_FUNC,
+	HW_VAR_CORRECT_TSF,
+	HW_VAR_CHECK_BSSID,
+	HW_VAR_MLME_DISCONNECT,
+	HW_VAR_MLME_SITESURVEY,
+	HW_VAR_MLME_JOIN,
+	HW_VAR_ON_RCR_AM,
+	HW_VAR_OFF_RCR_AM,
+	HW_VAR_BEACON_INTERVAL,
+	HW_VAR_SLOT_TIME,
+	HW_VAR_RESP_SIFS,
+	HW_VAR_ACK_PREAMBLE,
+	HW_VAR_SEC_CFG,
+	HW_VAR_BCN_VALID,
+	HW_VAR_RF_TYPE,
+	HW_VAR_DM_FLAG,
+	HW_VAR_DM_FUNC_OP,
+	HW_VAR_DM_FUNC_SET,
+	HW_VAR_DM_FUNC_CLR,
+	HW_VAR_DM_INIT_PWDB,
+	HW_VAR_CAM_EMPTY_ENTRY,
+	HW_VAR_CAM_INVALID_ALL,
+	HW_VAR_CAM_WRITE,
+	HW_VAR_CAM_READ,
+	HW_VAR_AC_PARAM_VO,
+	HW_VAR_AC_PARAM_VI,
+	HW_VAR_AC_PARAM_BE,
+	HW_VAR_AC_PARAM_BK,
+	HW_VAR_ACM_CTRL,
+	HW_VAR_AMPDU_MIN_SPACE,
+	HW_VAR_AMPDU_FACTOR,
+	HW_VAR_RXDMA_AGG_PG_TH,
+	HW_VAR_SET_RPWM,
+	HW_VAR_H2C_FW_PWRMODE,
+	HW_VAR_H2C_FW_JOINBSSRPT,
+	HW_VAR_FWLPS_RF_ON,
+	HW_VAR_H2C_FW_P2P_PS_OFFLOAD,
+	HW_VAR_TDLS_WRCR,
+	HW_VAR_TDLS_INIT_CH_SEN,
+	HW_VAR_TDLS_RS_RCR,
+	HW_VAR_TDLS_DONE_CH_SEN,	
+	HW_VAR_INITIAL_GAIN,
+	HW_VAR_TRIGGER_GPIO_0,
+	HW_VAR_BT_SET_COEXIST,
+	HW_VAR_BT_ISSUE_DELBA,	
+	HW_VAR_CURRENT_ANTENNA,
+	HW_VAR_ANTENNA_DIVERSITY_LINK,
+	HW_VAR_ANTENNA_DIVERSITY_SELECT,
+	HW_VAR_SWITCH_EPHY_WoWLAN,
+	HW_VAR_EFUSE_BYTES,
+	HW_VAR_FIFO_CLEARN_UP,
+	HW_VAR_CHECK_TXBUF,
+	HW_VAR_APFM_ON_MAC, //Auto FSM to Turn On, include clock, isolation, power control for MAC only
+	HW_VAR_WOWLAN,
+	HW_VAR_VID,
+	HW_VAR_PID,
+	HW_VAR_MBSSID_CAM_WRITE,
+	HW_VAR_MBSSID_CAM_CLEAR,
+	HW_VAR_RCR_MBSSID_EN,
+	HW_VAR_USB_RXAGG_PAGE_TO,
+}HW_VARIABLES;
+
+typedef enum _HAL_DEF_VARIABLE{
+	HAL_DEF_UNDERCORATEDSMOOTHEDPWDB,
+	HAL_DEF_IS_SUPPORT_ANT_DIV,
+	HAL_DEF_CURRENT_ANTENNA,
+	HAL_DEF_DRVINFO_SZ,
+	HAL_DEF_MAX_RECVBUF_SZ,
+	HAL_DEF_RX_PACKET_OFFSET,
+	HAL_DEF_DBG_DUMP_RXPKT,//for dbg
+	HAL_DEF_DBG_DM_FUNC,//for dbg
+	HAL_DEF_DUAL_MAC_MODE,
+}HAL_DEF_VARIABLE;
+
+typedef enum _HAL_INTF_PS_FUNC{
+	HAL_USB_SELECT_SUSPEND,
+	HAL_MAX_ID,
+}HAL_INTF_PS_FUNC;
+
+typedef s32 (*c2h_id_filter)(u8 id);
+
+struct hal_ops {
+	u32	(*hal_init)(PADAPTER Adapter);
+	u32	(*hal_deinit)(PADAPTER Adapter);
+
+	void	(*free_hal_data)(PADAPTER Adapter);
+
+	u32	(*inirp_init)(PADAPTER Adapter);
+	u32	(*inirp_deinit)(PADAPTER Adapter);
+
+	s32	(*init_xmit_priv)(PADAPTER Adapter);
+	void	(*free_xmit_priv)(PADAPTER Adapter);
+
+	s32	(*init_recv_priv)(PADAPTER Adapter);
+	void	(*free_recv_priv)(PADAPTER Adapter);
+
+	void	(*InitSwLeds)(PADAPTER Adapter);
+	void	(*DeInitSwLeds)(PADAPTER Adapter);
+
+	void	(*dm_init)(PADAPTER Adapter);
+	void	(*dm_deinit)(PADAPTER Adapter);
+	void	(*read_chip_version)(PADAPTER Adapter);
+
+	void	(*init_default_value)(PADAPTER Adapter);
+
+	void	(*intf_chip_configure)(PADAPTER Adapter);
+
+	void	(*read_adapter_info)(PADAPTER Adapter);
+
+	void	(*enable_interrupt)(PADAPTER Adapter);
+	void	(*disable_interrupt)(PADAPTER Adapter);
+	s32	(*interrupt_handler)(PADAPTER Adapter);
+
+	void	(*set_bwmode_handler)(PADAPTER Adapter, HT_CHANNEL_WIDTH Bandwidth, u8 Offset);
+	void	(*set_channel_handler)(PADAPTER Adapter, u8 channel);
+
+	void	(*hal_dm_watchdog)(PADAPTER Adapter);
+
+	void	(*SetHwRegHandler)(PADAPTER Adapter, u8	variable,u8* val);
+	void	(*GetHwRegHandler)(PADAPTER Adapter, u8	variable,u8* val);
+
+	u8	(*GetHalDefVarHandler)(PADAPTER Adapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+	u8	(*SetHalDefVarHandler)(PADAPTER Adapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+
+	void	(*UpdateRAMaskHandler)(PADAPTER Adapter, u32 mac_id);
+	void	(*SetBeaconRelatedRegistersHandler)(PADAPTER Adapter);
+
+	void	(*Add_RateATid)(PADAPTER Adapter, u32 bitmap, u8 arg);
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	u8	(*AntDivBeforeLinkHandler)(PADAPTER Adapter);
+	void	(*AntDivCompareHandler)(PADAPTER Adapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src);
+#endif
+	u8	(*interface_ps_func)(PADAPTER Adapter,HAL_INTF_PS_FUNC efunc_id, u8* val);
+
+	s32	(*hal_xmit)(PADAPTER Adapter, struct xmit_frame *pxmitframe);
+	s32	(*mgnt_xmit)(PADAPTER Adapter, struct xmit_frame *pmgntframe);
+        s32	(*hal_xmitframe_enqueue)(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+	u32	(*read_bbreg)(PADAPTER Adapter, u32 RegAddr, u32 BitMask);
+	void	(*write_bbreg)(PADAPTER Adapter, u32 RegAddr, u32 BitMask, u32 Data);
+	u32	(*read_rfreg)(PADAPTER Adapter, u32 eRFPath, u32 RegAddr, u32 BitMask);
+	void	(*write_rfreg)(PADAPTER Adapter, u32 eRFPath, u32 RegAddr, u32 BitMask, u32 Data);
+
+#ifdef CONFIG_HOSTAPD_MLME
+	s32	(*hostap_mgnt_xmit_entry)(PADAPTER Adapter, _pkt *pkt);
+#endif
+	void (*EfusePowerSwitch)(PADAPTER pAdapter, u8 bWrite, u8 PwrState);
+	void (*ReadEFuse)(PADAPTER Adapter, u8 efuseType, u16 _offset, u16 _size_byte, u8 *pbuf, BOOLEAN bPseudoTest);
+	void (*EFUSEGetEfuseDefinition)(PADAPTER pAdapter, u8 efuseType, u8 type, PVOID *pOut, BOOLEAN bPseudoTest);
+	u16	(*EfuseGetCurrentSize)(PADAPTER pAdapter, u8 efuseType, BOOLEAN bPseudoTest);
+	int 	(*Efuse_PgPacketRead)(PADAPTER pAdapter, u8 offset, u8 *data, BOOLEAN bPseudoTest);
+	int 	(*Efuse_PgPacketWrite)(PADAPTER pAdapter, u8 offset, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+	u8	(*Efuse_WordEnableDataWrite)(PADAPTER pAdapter, u16 efuse_addr, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+	
+#ifdef DBG_CONFIG_ERROR_DETECT
+	void (*sreset_init_value)(_adapter *padapter);
+	void (*sreset_reset_value)(_adapter *padapter);		
+	void (*silentreset)(_adapter *padapter);
+	void (*sreset_xmit_status_check)(_adapter *padapter);
+	void (*sreset_linked_status_check) (_adapter *padapter);
+	u8 (*sreset_get_wifi_status)(_adapter *padapter);
+	bool (*sreset_inprogress)(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_IOL
+	int (*IOL_exec_cmds_sync)(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+#endif
+	void (*hal_notch_filter)(_adapter * adapter, bool enable);
+	void (*hal_reset_security_engine)(_adapter * adapter);
+
+	s32 (*c2h_handler)(_adapter *padapter, struct c2h_evt_hdr *c2h_evt);
+	c2h_id_filter c2h_id_filter_ccx;
+};
+
+typedef	enum _RT_EEPROM_TYPE{
+	EEPROM_93C46,
+	EEPROM_93C56,
+	EEPROM_BOOT_EFUSE,
+}RT_EEPROM_TYPE,*PRT_EEPROM_TYPE;
+
+#define USB_HIGH_SPEED_BULK_SIZE	512
+#define USB_FULL_SPEED_BULK_SIZE	64
+
+#define RF_CHANGE_BY_INIT	0
+#define RF_CHANGE_BY_IPS 	BIT28
+#define RF_CHANGE_BY_PS 	BIT29
+#define RF_CHANGE_BY_HW 	BIT30
+#define RF_CHANGE_BY_SW 	BIT31
+
+typedef enum _HARDWARE_TYPE{
+	HARDWARE_TYPE_RTL8180,
+	HARDWARE_TYPE_RTL8185,
+	HARDWARE_TYPE_RTL8187,
+	HARDWARE_TYPE_RTL8188,
+	HARDWARE_TYPE_RTL8190P,
+	HARDWARE_TYPE_RTL8192E,
+	HARDWARE_TYPE_RTL819xU,
+	HARDWARE_TYPE_RTL8192SE,
+	HARDWARE_TYPE_RTL8192SU,
+	HARDWARE_TYPE_RTL8192CE,
+	HARDWARE_TYPE_RTL8192CU,
+	HARDWARE_TYPE_RTL8192DE,
+	HARDWARE_TYPE_RTL8192DU,
+	HARDWARE_TYPE_RTL8723AE,
+	HARDWARE_TYPE_RTL8723AU,
+	HARDWARE_TYPE_RTL8723AS,
+	HARDWARE_TYPE_RTL8188EE,
+	HARDWARE_TYPE_RTL8188EU,
+	HARDWARE_TYPE_RTL8188ES,
+	HARDWARE_TYPE_MAX,
+}HARDWARE_TYPE;
+
+//
+// RTL8192C Series
+//
+#define IS_HARDWARE_TYPE_8192CE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192CE)
+#define IS_HARDWARE_TYPE_8192CU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192CU)
+#define	IS_HARDWARE_TYPE_8192C(_Adapter)			\
+(IS_HARDWARE_TYPE_8192CE(_Adapter) || IS_HARDWARE_TYPE_8192CU(_Adapter))
+
+//
+// RTL8192D Series
+//
+#define IS_HARDWARE_TYPE_8192DE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192DE)
+#define IS_HARDWARE_TYPE_8192DU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192DU)
+#define	IS_HARDWARE_TYPE_8192D(_Adapter)			\
+(IS_HARDWARE_TYPE_8192DE(_Adapter) || IS_HARDWARE_TYPE_8192DU(_Adapter))
+
+//
+// RTL8723A Series
+//
+#define IS_HARDWARE_TYPE_8723AE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8723AE)
+#define IS_HARDWARE_TYPE_8723AU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8723AU)
+#define IS_HARDWARE_TYPE_8723AS(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8723AS)
+#define	IS_HARDWARE_TYPE_8723A(_Adapter)	\
+(IS_HARDWARE_TYPE_8723AE(_Adapter) || IS_HARDWARE_TYPE_8723AU(_Adapter) || IS_HARDWARE_TYPE_8723AS(_Adapter))
+
+//
+// RTL8188E Series
+//
+#define IS_HARDWARE_TYPE_8188EE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8188EE)
+#define IS_HARDWARE_TYPE_8188EU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8188EU)
+#define IS_HARDWARE_TYPE_8188ES(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8188ES)
+#define	IS_HARDWARE_TYPE_8188E(_Adapter)	\
+(IS_HARDWARE_TYPE_8188EE(_Adapter) || IS_HARDWARE_TYPE_8188EU(_Adapter) || IS_HARDWARE_TYPE_8188ES(_Adapter))
+
+
+typedef struct eeprom_priv EEPROM_EFUSE_PRIV, *PEEPROM_EFUSE_PRIV;
+#define GET_EEPROM_EFUSE_PRIV(priv)	(&priv->eeprompriv)
+
+#ifdef CONFIG_WOWLAN
+typedef enum _wowlan_subcode{
+	WOWLAN_PATTERN_MATCH = 1,
+	WOWLAN_MAGIC_PACKET  = 2,
+	WOWLAN_UNICAST       = 3,
+	WOWLAN_SET_PATTERN   = 4,
+	WOWLAN_DUMP_REG      = 5,
+	WOWLAN_ENABLE        = 6,
+	WOWLAN_DISABLE       = 7,
+	WOWLAN_STATUS		= 8,
+	WOWLAN_DEBUG_RELOAD_FW	= 9,
+	WOWLAN_DEBUG_1		=10,
+	WOWLAN_DEBUG_2		=11
+}wowlan_subcode;
+
+struct wowlan_ioctl_param{
+	unsigned int subcode;
+	unsigned int subcode_value;
+	unsigned int wakeup_reason;
+	unsigned int len;
+	unsigned char pattern[0];
+};
+
+#define Rx_Pairwisekey			BIT(0)
+#define Rx_GTK					BIT(1)
+#define Rx_DisAssoc				BIT(2)
+#define Rx_DeAuth				BIT(3)
+#define FWDecisionDisconnect	BIT(4)
+#define Rx_MagicPkt				BIT(5)
+#define FinishBtFwPatch			BIT(7)
+
+#endif // CONFIG_WOWLAN
+
+void rtw_hal_def_value_init(_adapter *padapter);
+void rtw_hal_free_data(_adapter *padapter);
+
+void rtw_hal_dm_init(_adapter *padapter);
+void rtw_hal_dm_deinit(_adapter *padapter);
+void rtw_hal_sw_led_init(_adapter *padapter);
+void rtw_hal_sw_led_deinit(_adapter *padapter);
+
+uint rtw_hal_init(_adapter *padapter);
+uint rtw_hal_deinit(_adapter *padapter);
+void rtw_hal_stop(_adapter *padapter);
+
+void rtw_hal_set_hwreg(PADAPTER padapter, u8 variable, u8 *val);
+void rtw_hal_get_hwreg(PADAPTER padapter, u8 variable, u8 *val);
+
+void rtw_hal_chip_configure(_adapter *padapter);
+void rtw_hal_read_chip_info(_adapter *padapter);
+void rtw_hal_read_chip_version(_adapter *padapter);
+
+u8 rtw_hal_set_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+u8 rtw_hal_get_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+
+void rtw_hal_enable_interrupt(_adapter *padapter);
+void rtw_hal_disable_interrupt(_adapter *padapter);
+
+u32 rtw_hal_inirp_init(_adapter *padapter);
+u32 rtw_hal_inirp_deinit(_adapter *padapter);
+
+u8 rtw_hal_intf_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id, u8* val);
+
+s32	rtw_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+s32 rtw_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+s32 rtw_hal_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32 rtw_hal_init_xmit_priv(_adapter *padapter);
+void rtw_hal_free_xmit_priv(_adapter *padapter);
+
+s32 rtw_hal_init_recv_priv(_adapter *padapter);
+void rtw_hal_free_recv_priv(_adapter *padapter);
+
+void rtw_hal_update_ra_mask(_adapter *padapter, u32 mac_id);
+void rtw_hal_add_ra_tid(_adapter *padapter, u32 bitmap, u8 arg);
+
+void rtw_hal_bcn_related_reg_setting(_adapter *padapter);
+
+u32 rtw_hal_read_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask);
+void rtw_hal_write_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask, u32 Data);
+u32 rtw_hal_read_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask);
+void rtw_hal_write_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask, u32 Data);
+
+s32 rtw_hal_interrupt_handler(_adapter *padapter);
+
+void rtw_hal_set_bwmode(_adapter *padapter, HT_CHANNEL_WIDTH Bandwidth, u8 Offset);
+void rtw_hal_set_chan(_adapter *padapter, u8 channel);
+
+void rtw_hal_dm_watchdog(_adapter *padapter);
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+u8 rtw_hal_antdiv_before_linked(_adapter *padapter);
+void rtw_hal_antdiv_rssi_compared(_adapter *padapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src);
+#endif
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32 rtw_hal_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+void rtw_hal_sreset_init(_adapter *padapter);
+void rtw_hal_sreset_reset(_adapter *padapter);
+void rtw_hal_sreset_reset_value(_adapter *padapter);
+void rtw_hal_sreset_xmit_status_check(_adapter *padapter);
+void rtw_hal_sreset_linked_status_check(_adapter *padapter);
+u8 rtw_hal_sreset_get_wifi_status(_adapter *padapter);
+bool rtw_hal_sreset_inprogress(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_IOL
+int rtw_hal_iol_cmd(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+#endif
+
+void rtw_hal_notch_filter(_adapter * adapter, bool enable);
+void rtw_hal_reset_security_engine(_adapter * adapter);
+
+s32 rtw_hal_c2h_handler(_adapter *adapter, struct c2h_evt_hdr *c2h_evt);
+c2h_id_filter rtw_hal_c2h_id_filter_ccx(_adapter *adapter);
+
+#endif //__HAL_INTF_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h
new file mode 100755
index 0000000000000..e283a5f25d4c9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h
@@ -0,0 +1,1580 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __IEEE80211_H
+#define __IEEE80211_H
+
+
+#ifndef CONFIG_RTL8711FW
+
+	#include <drv_conf.h>
+	#include <osdep_service.h>
+	#include <drv_types.h>
+	#include "wifi.h"
+
+	#if defined PLATFORM_OS_XP
+	#include <ntstrsafe.h>
+	#endif
+	#if defined PLATFORM_LINUX
+	#include <linux/wireless.h>
+	#endif
+#else
+	
+	#include <list.h>
+
+#endif
+
+#define MGMT_QUEUE_NUM 5
+
+#define ETH_ALEN	6
+#define ETH_TYPE_LEN		2
+#define PAYLOAD_TYPE_LEN	1
+
+#ifdef CONFIG_AP_MODE
+
+#define RTL_IOCTL_HOSTAPD (SIOCIWFIRSTPRIV + 28)
+
+/* RTL871X_IOCTL_HOSTAPD ioctl() cmd: */
+enum {
+	RTL871X_HOSTAPD_FLUSH = 1,
+	RTL871X_HOSTAPD_ADD_STA = 2,
+	RTL871X_HOSTAPD_REMOVE_STA = 3,
+	RTL871X_HOSTAPD_GET_INFO_STA = 4,
+	/* REMOVED: PRISM2_HOSTAPD_RESET_TXEXC_STA = 5, */
+	RTL871X_HOSTAPD_GET_WPAIE_STA = 5,
+	RTL871X_SET_ENCRYPTION = 6,
+	RTL871X_GET_ENCRYPTION = 7,
+	RTL871X_HOSTAPD_SET_FLAGS_STA = 8,
+	RTL871X_HOSTAPD_GET_RID = 9,
+	RTL871X_HOSTAPD_SET_RID = 10,
+	RTL871X_HOSTAPD_SET_ASSOC_AP_ADDR = 11,
+	RTL871X_HOSTAPD_SET_GENERIC_ELEMENT = 12,
+	RTL871X_HOSTAPD_MLME = 13,
+	RTL871X_HOSTAPD_SCAN_REQ = 14,
+	RTL871X_HOSTAPD_STA_CLEAR_STATS = 15,
+	RTL871X_HOSTAPD_SET_BEACON=16,
+	RTL871X_HOSTAPD_SET_WPS_BEACON = 17,
+	RTL871X_HOSTAPD_SET_WPS_PROBE_RESP = 18,
+	RTL871X_HOSTAPD_SET_WPS_ASSOC_RESP = 19,
+	RTL871X_HOSTAPD_SET_HIDDEN_SSID = 20,
+	RTL871X_HOSTAPD_SET_MACADDR_ACL = 21,
+	RTL871X_HOSTAPD_ACL_ADD_STA = 22,
+	RTL871X_HOSTAPD_ACL_REMOVE_STA = 23,
+};
+
+/* STA flags */
+#define WLAN_STA_AUTH BIT(0)
+#define WLAN_STA_ASSOC BIT(1)
+#define WLAN_STA_PS BIT(2)
+#define WLAN_STA_TIM BIT(3)
+#define WLAN_STA_PERM BIT(4)
+#define WLAN_STA_AUTHORIZED BIT(5)
+#define WLAN_STA_PENDING_POLL BIT(6) /* pending activity poll not ACKed */
+#define WLAN_STA_SHORT_PREAMBLE BIT(7)
+#define WLAN_STA_PREAUTH BIT(8)
+#define WLAN_STA_WME BIT(9)
+#define WLAN_STA_MFP BIT(10)
+#define WLAN_STA_HT BIT(11)
+#define WLAN_STA_WPS BIT(12)
+#define WLAN_STA_MAYBE_WPS BIT(13)
+#define WLAN_STA_NONERP BIT(31)
+
+#endif
+
+#define IEEE_CMD_SET_WPA_PARAM			1
+#define IEEE_CMD_SET_WPA_IE				2
+#define IEEE_CMD_SET_ENCRYPTION			3
+#define IEEE_CMD_MLME						4
+
+#define IEEE_PARAM_WPA_ENABLED				1
+#define IEEE_PARAM_TKIP_COUNTERMEASURES		2
+#define IEEE_PARAM_DROP_UNENCRYPTED			3
+#define IEEE_PARAM_PRIVACY_INVOKED			4
+#define IEEE_PARAM_AUTH_ALGS					5
+#define IEEE_PARAM_IEEE_802_1X				6
+#define IEEE_PARAM_WPAX_SELECT				7
+
+#define AUTH_ALG_OPEN_SYSTEM			0x1
+#define AUTH_ALG_SHARED_KEY			0x2
+#define AUTH_ALG_LEAP				0x00000004
+
+#define IEEE_MLME_STA_DEAUTH				1
+#define IEEE_MLME_STA_DISASSOC			2
+
+#define IEEE_CRYPT_ERR_UNKNOWN_ALG			2
+#define IEEE_CRYPT_ERR_UNKNOWN_ADDR			3
+#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED		4
+#define IEEE_CRYPT_ERR_KEY_SET_FAILED			5
+#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED		6
+#define IEEE_CRYPT_ERR_CARD_CONF_FAILED		7
+
+
+#define	IEEE_CRYPT_ALG_NAME_LEN			16
+
+#define WPA_CIPHER_NONE 	BIT(0)
+#define WPA_CIPHER_WEP40 	BIT(1)
+#define WPA_CIPHER_WEP104 BIT(2)
+#define WPA_CIPHER_TKIP 	BIT(3)
+#define WPA_CIPHER_CCMP 	BIT(4)
+
+
+
+#define WPA_SELECTOR_LEN 4
+extern u8 RTW_WPA_OUI_TYPE[] ;
+extern u16 RTW_WPA_VERSION ;
+extern u8 WPA_AUTH_KEY_MGMT_NONE[];
+extern u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[];
+extern u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[];
+extern u8 WPA_CIPHER_SUITE_NONE[];
+extern u8 WPA_CIPHER_SUITE_WEP40[];
+extern u8 WPA_CIPHER_SUITE_TKIP[];
+extern u8 WPA_CIPHER_SUITE_WRAP[];
+extern u8 WPA_CIPHER_SUITE_CCMP[];
+extern u8 WPA_CIPHER_SUITE_WEP104[];
+
+
+#define RSN_HEADER_LEN 4
+#define RSN_SELECTOR_LEN 4
+
+extern u16 RSN_VERSION_BSD;
+extern u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[];
+extern u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[];
+extern u8 RSN_CIPHER_SUITE_NONE[];
+extern u8 RSN_CIPHER_SUITE_WEP40[];
+extern u8 RSN_CIPHER_SUITE_TKIP[];
+extern u8 RSN_CIPHER_SUITE_WRAP[];
+extern u8 RSN_CIPHER_SUITE_CCMP[];
+extern u8 RSN_CIPHER_SUITE_WEP104[];
+
+typedef enum _RATR_TABLE_MODE{
+	RATR_INX_WIRELESS_NGB = 0,	// BGN 40 Mhz 2SS 1SS
+	RATR_INX_WIRELESS_NG = 1,		// GN or N
+	RATR_INX_WIRELESS_NB = 2,		// BGN 20 Mhz 2SS 1SS  or BN
+	RATR_INX_WIRELESS_N = 3,
+	RATR_INX_WIRELESS_GB = 4,
+	RATR_INX_WIRELESS_G = 5,
+	RATR_INX_WIRELESS_B = 6,
+	RATR_INX_WIRELESS_MC = 7,
+	RATR_INX_WIRELESS_AC_N = 8,
+}RATR_TABLE_MODE, *PRATR_TABLE_MODE;
+
+enum NETWORK_TYPE
+{
+    WIRELESS_INVALID = 0,
+    //Sub-Element
+    WIRELESS_11B = BIT(0), // tx: cck only , rx: cck only, hw: cck
+    WIRELESS_11G = BIT(1), // tx: ofdm only, rx: ofdm & cck, hw: cck & ofdm
+    WIRELESS_11A = BIT(2), // tx: ofdm only, rx: ofdm only, hw: ofdm only
+    WIRELESS_11_24N = BIT(3), // tx: MCS only, rx: MCS & cck, hw: MCS & cck
+    WIRELESS_11_5N = BIT(4), // tx: MCS only, rx: MCS & ofdm, hw: ofdm only
+	//WIRELESS_AUTO 	= BIT(5), 
+	WIRELESS_AC 		= BIT(6), 
+
+    //Combination
+    WIRELESS_11BG = (WIRELESS_11B|WIRELESS_11G), // tx: cck & ofdm, rx: cck & ofdm & MCS, hw: cck & ofdm
+    WIRELESS_11G_24N = (WIRELESS_11G|WIRELESS_11_24N), // tx: ofdm & MCS, rx: ofdm & cck & MCS, hw: cck & ofdm
+    WIRELESS_11A_5N = (WIRELESS_11A|WIRELESS_11_5N), // tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only
+    WIRELESS_11BG_24N = (WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N), // tx: ofdm & cck & MCS, rx: ofdm & cck & MCS, hw: ofdm & cck
+    WIRELESS_11AGN = (WIRELESS_11A|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N), // tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only
+    WIRELESS_11ABGN = (WIRELESS_11A|WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N),
+};
+
+#define SUPPORTED_24G_NETTYPE_MSK (WIRELESS_11B | WIRELESS_11G | WIRELESS_11_24N)
+#define SUPPORTED_5G_NETTYPE_MSK (WIRELESS_11A | WIRELESS_11_5N)
+
+#define IsSupported24G(NetType) ((NetType) & SUPPORTED_24G_NETTYPE_MSK ? _TRUE : _FALSE)
+#define IsSupported5G(NetType) ((NetType) & SUPPORTED_5G_NETTYPE_MSK ? _TRUE : _FALSE)
+
+#define IsEnableHWCCK(NetType) IsSupported24G(NetType)
+#define IsEnableHWOFDM(NetType) ((NetType) & (WIRELESS_11G|WIRELESS_11_24N|SUPPORTED_5G_NETTYPE_MSK) ? _TRUE : _FALSE)
+
+#define IsSupportedRxCCK(NetType) IsEnableHWCCK(NetType)
+#define IsSupportedRxOFDM(NetType) IsEnableHWOFDM(NetType)
+#define IsSupportedRxMCS(NetType) IsEnableHWOFDM(NetType)
+
+#define IsSupportedTxCCK(NetType) ((NetType) & (WIRELESS_11B) ? _TRUE : _FALSE)
+#define IsSupportedTxOFDM(NetType) ((NetType) & (WIRELESS_11G|WIRELESS_11A) ? _TRUE : _FALSE)
+#define IsSupportedTxMCS(NetType) ((NetType) & (WIRELESS_11_24N|WIRELESS_11_5N) ? _TRUE : _FALSE) 
+
+
+typedef struct ieee_param {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	union {
+		struct {
+			u8 name;
+			u32 value;
+		} wpa_param;
+		struct {
+			u32 len;
+			u8 reserved[32];
+			u8 data[0];
+		} wpa_ie;
+	        struct{
+			int command;
+    			int reason_code;
+		} mlme;
+		struct {
+			u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
+			u8 set_tx;
+			u32 err;
+			u8 idx;
+			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
+			u16 key_len;
+			u8 key[0];
+		} crypt;
+#ifdef CONFIG_AP_MODE
+		struct {
+			u16 aid;
+			u16 capability;
+			int flags;
+			u8 tx_supp_rates[16];		
+			struct rtw_ieee80211_ht_cap ht_cap;
+		} add_sta;
+		struct {
+			u8	reserved[2];//for set max_num_sta
+			u8	buf[0];
+		} bcn_ie;
+#endif
+
+	} u;	   
+}ieee_param;
+
+#ifdef CONFIG_AP_MODE
+typedef struct ieee_param_ex {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	u8 data[0];
+}ieee_param_ex;
+
+struct sta_data{
+	u16 aid;
+	u16 capability;
+	int flags;
+	u32 sta_set;
+	u8 tx_supp_rates[16];	
+	u32 tx_supp_rates_len;
+	struct rtw_ieee80211_ht_cap ht_cap;
+	u64	rx_pkts;
+	u64	rx_bytes;
+	u64	rx_drops;
+	u64	tx_pkts;
+	u64	tx_bytes;
+	u64	tx_drops;
+};
+#endif
+
+
+#if WIRELESS_EXT < 17
+#define IW_QUAL_QUAL_INVALID   0x10
+#define IW_QUAL_LEVEL_INVALID  0x20
+#define IW_QUAL_NOISE_INVALID  0x40
+#define IW_QUAL_QUAL_UPDATED   0x1
+#define IW_QUAL_LEVEL_UPDATED  0x2
+#define IW_QUAL_NOISE_UPDATED  0x4
+#endif
+
+#define IEEE80211_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+
+
+#define IEEE80211_HLEN			30
+#define IEEE80211_FRAME_LEN		(IEEE80211_DATA_LEN + IEEE80211_HLEN)
+
+
+/* this is stolen from ipw2200 driver */
+#define IEEE_IBSS_MAC_HASH_SIZE 31
+
+struct ieee_ibss_seq {
+	u8 mac[ETH_ALEN];
+	u16 seq_num;
+	u16 frag_num;
+	unsigned long packet_time;
+	_list	list;
+};
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)||defined(PLATFORM_FREEBSD) 
+
+struct rtw_ieee80211_hdr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct rtw_ieee80211_hdr_3addr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+} __attribute__ ((packed));
+
+
+struct rtw_ieee80211_hdr_qos {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u16	qc;
+}  __attribute__ ((packed));
+
+struct rtw_ieee80211_hdr_3addr_qos {
+        u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+       u16     qc;
+}  __attribute__ ((packed));
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+} __attribute__ ((packed));
+
+#endif
+
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct rtw_ieee80211_hdr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+};
+
+struct rtw_ieee80211_hdr_3addr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+};
+
+
+struct rtw_ieee80211_hdr_qos {
+	struct rtw_ieee80211_hdr wlan_hdr;
+	u16	qc;
+};
+
+struct rtw_ieee80211_hdr_3addr_qos {
+        struct  rtw_ieee80211_hdr_3addr wlan_hdr;
+        u16     qc;
+};
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+};
+#pragma pack()
+
+#endif
+
+
+
+enum eap_type {
+	EAP_PACKET = 0,
+	EAPOL_START,
+	EAPOL_LOGOFF,
+	EAPOL_KEY,
+	EAPOL_ENCAP_ASF_ALERT
+};
+
+#define IEEE80211_3ADDR_LEN 24
+#define IEEE80211_4ADDR_LEN 30
+#define IEEE80211_FCS_LEN    4
+
+#define MIN_FRAG_THRESHOLD     256U
+#define	MAX_FRAG_THRESHOLD     2346U
+
+/* Frame control field constants */
+#define RTW_IEEE80211_FCTL_VERS		0x0003
+#define RTW_IEEE80211_FCTL_FTYPE		0x000c
+#define RTW_IEEE80211_FCTL_STYPE		0x00f0
+#define RTW_IEEE80211_FCTL_TODS		0x0100
+#define RTW_IEEE80211_FCTL_FROMDS	0x0200
+#define RTW_IEEE80211_FCTL_MOREFRAGS	0x0400
+#define RTW_IEEE80211_FCTL_RETRY		0x0800
+#define RTW_IEEE80211_FCTL_PM		0x1000
+#define RTW_IEEE80211_FCTL_MOREDATA	0x2000
+#define RTW_IEEE80211_FCTL_PROTECTED	0x4000
+#define RTW_IEEE80211_FCTL_ORDER		0x8000
+#define RTW_IEEE80211_FCTL_CTL_EXT	0x0f00
+
+#define RTW_IEEE80211_FTYPE_MGMT		0x0000
+#define RTW_IEEE80211_FTYPE_CTL		0x0004
+#define RTW_IEEE80211_FTYPE_DATA		0x0008
+#define RTW_IEEE80211_FTYPE_EXT		0x000c
+
+/* management */
+#define RTW_IEEE80211_STYPE_ASSOC_REQ	0x0000
+#define RTW_IEEE80211_STYPE_ASSOC_RESP 	0x0010
+#define RTW_IEEE80211_STYPE_REASSOC_REQ	0x0020
+#define RTW_IEEE80211_STYPE_REASSOC_RESP	0x0030
+#define RTW_IEEE80211_STYPE_PROBE_REQ	0x0040
+#define RTW_IEEE80211_STYPE_PROBE_RESP	0x0050
+#define RTW_IEEE80211_STYPE_BEACON		0x0080
+#define RTW_IEEE80211_STYPE_ATIM		0x0090
+#define RTW_IEEE80211_STYPE_DISASSOC	0x00A0
+#define RTW_IEEE80211_STYPE_AUTH		0x00B0
+#define RTW_IEEE80211_STYPE_DEAUTH		0x00C0
+#define RTW_IEEE80211_STYPE_ACTION		0x00D0
+
+/* control */
+#define RTW_IEEE80211_STYPE_CTL_EXT		0x0060
+#define RTW_IEEE80211_STYPE_BACK_REQ		0x0080
+#define RTW_IEEE80211_STYPE_BACK		0x0090
+#define RTW_IEEE80211_STYPE_PSPOLL		0x00A0
+#define RTW_IEEE80211_STYPE_RTS		0x00B0
+#define RTW_IEEE80211_STYPE_CTS		0x00C0
+#define RTW_IEEE80211_STYPE_ACK		0x00D0
+#define RTW_IEEE80211_STYPE_CFEND		0x00E0
+#define RTW_IEEE80211_STYPE_CFENDACK		0x00F0
+
+/* data */
+#define RTW_IEEE80211_STYPE_DATA		0x0000
+#define RTW_IEEE80211_STYPE_DATA_CFACK	0x0010
+#define RTW_IEEE80211_STYPE_DATA_CFPOLL	0x0020
+#define RTW_IEEE80211_STYPE_DATA_CFACKPOLL	0x0030
+#define RTW_IEEE80211_STYPE_NULLFUNC	0x0040
+#define RTW_IEEE80211_STYPE_CFACK		0x0050
+#define RTW_IEEE80211_STYPE_CFPOLL		0x0060
+#define RTW_IEEE80211_STYPE_CFACKPOLL	0x0070
+#define RTW_IEEE80211_STYPE_QOS_DATA		0x0080
+#define RTW_IEEE80211_STYPE_QOS_DATA_CFACK		0x0090
+#define RTW_IEEE80211_STYPE_QOS_DATA_CFPOLL		0x00A0
+#define RTW_IEEE80211_STYPE_QOS_DATA_CFACKPOLL	0x00B0
+#define RTW_IEEE80211_STYPE_QOS_NULLFUNC	0x00C0
+#define RTW_IEEE80211_STYPE_QOS_CFACK		0x00D0
+#define RTW_IEEE80211_STYPE_QOS_CFPOLL		0x00E0
+#define RTW_IEEE80211_STYPE_QOS_CFACKPOLL	0x00F0
+
+/* sequence control field */
+#define RTW_IEEE80211_SCTL_FRAG	0x000F
+#define RTW_IEEE80211_SCTL_SEQ	0xFFF0
+
+
+#define RTW_ERP_INFO_NON_ERP_PRESENT BIT(0)
+#define RTW_ERP_INFO_USE_PROTECTION BIT(1)
+#define RTW_ERP_INFO_BARKER_PREAMBLE_MODE BIT(2)
+
+/* QoS,QOS */
+#define NORMAL_ACK			0
+#define NO_ACK				1
+#define NON_EXPLICIT_ACK	2
+#define BLOCK_ACK			3
+
+#ifndef ETH_P_PAE
+#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
+#endif /* ETH_P_PAE */
+
+#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
+
+#define ETH_P_ECONET	0x0018
+
+#ifndef ETH_P_80211_RAW
+#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
+#endif
+
+/* IEEE 802.11 defines */
+
+#define P80211_OUI_LEN 3
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW) || defined(PLATFORM_FREEBSD)
+
+struct ieee80211_snap_hdr {
+
+        u8    dsap;   /* always 0xAA */
+        u8    ssap;   /* always 0xAA */
+        u8    ctrl;   /* always 0x03 */
+        u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+} __attribute__ ((packed));
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct ieee80211_snap_hdr {
+
+        u8    dsap;   /* always 0xAA */
+        u8    ssap;   /* always 0xAA */
+        u8    ctrl;   /* always 0x03 */
+        u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+};
+#pragma pack()
+
+#endif
+
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+#define WLAN_FC_GET_TYPE(fc) ((fc) & RTW_IEEE80211_FCTL_FTYPE)
+#define WLAN_FC_GET_STYPE(fc) ((fc) & RTW_IEEE80211_FCTL_STYPE)
+
+#define WLAN_QC_GET_TID(qc) ((qc) & 0x0f)
+
+#define WLAN_GET_SEQ_FRAG(seq) ((seq) & RTW_IEEE80211_SCTL_FRAG)
+#define WLAN_GET_SEQ_SEQ(seq)  ((seq) & RTW_IEEE80211_SCTL_SEQ)
+
+/* Authentication algorithms */
+#define WLAN_AUTH_OPEN 0
+#define WLAN_AUTH_SHARED_KEY 1
+
+#define WLAN_AUTH_CHALLENGE_LEN 128
+
+#define WLAN_CAPABILITY_BSS (1<<0)
+#define WLAN_CAPABILITY_IBSS (1<<1)
+#define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
+#define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
+#define WLAN_CAPABILITY_PRIVACY (1<<4)
+#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
+#define WLAN_CAPABILITY_PBCC (1<<6)
+#define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
+#define WLAN_CAPABILITY_SHORT_SLOT (1<<10)
+
+/* Status codes */
+#define WLAN_STATUS_SUCCESS 0
+#define WLAN_STATUS_UNSPECIFIED_FAILURE 1
+#define WLAN_STATUS_CAPS_UNSUPPORTED 10
+#define WLAN_STATUS_REASSOC_NO_ASSOC 11
+#define WLAN_STATUS_ASSOC_DENIED_UNSPEC 12
+#define WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG 13
+#define WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION 14
+#define WLAN_STATUS_CHALLENGE_FAIL 15
+#define WLAN_STATUS_AUTH_TIMEOUT 16
+#define WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA 17
+#define WLAN_STATUS_ASSOC_DENIED_RATES 18
+/* 802.11b */
+#define WLAN_STATUS_ASSOC_DENIED_NOSHORT 19
+#define WLAN_STATUS_ASSOC_DENIED_NOPBCC 20
+#define WLAN_STATUS_ASSOC_DENIED_NOAGILITY 21
+
+/* Reason codes */
+#define WLAN_REASON_UNSPECIFIED 1
+#define WLAN_REASON_PREV_AUTH_NOT_VALID 2
+#define WLAN_REASON_DEAUTH_LEAVING 3
+#define WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4
+#define WLAN_REASON_DISASSOC_AP_BUSY 5
+#define WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 6
+#define WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA 7
+#define WLAN_REASON_DISASSOC_STA_HAS_LEFT 8
+#define WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9
+#define WLAN_REASON_JOIN_WRONG_CHANNEL       65534
+#define WLAN_REASON_EXPIRATION_CHK 65535
+
+/* Information Element IDs */
+#define WLAN_EID_SSID 0
+#define WLAN_EID_SUPP_RATES 1
+#define WLAN_EID_FH_PARAMS 2
+#define WLAN_EID_DS_PARAMS 3
+#define WLAN_EID_CF_PARAMS 4
+#define WLAN_EID_TIM 5
+#define WLAN_EID_IBSS_PARAMS 6
+#define WLAN_EID_CHALLENGE 16
+/* EIDs defined by IEEE 802.11h - START */
+#define WLAN_EID_PWR_CONSTRAINT 32
+#define WLAN_EID_PWR_CAPABILITY 33
+#define WLAN_EID_TPC_REQUEST 34
+#define WLAN_EID_TPC_REPORT 35
+#define WLAN_EID_SUPPORTED_CHANNELS 36
+#define WLAN_EID_CHANNEL_SWITCH 37
+#define WLAN_EID_MEASURE_REQUEST 38
+#define WLAN_EID_MEASURE_REPORT 39
+#define WLAN_EID_QUITE 40
+#define WLAN_EID_IBSS_DFS 41
+/* EIDs defined by IEEE 802.11h - END */
+#define WLAN_EID_ERP_INFO 42
+#define WLAN_EID_HT_CAP 45
+#define WLAN_EID_RSN 48
+#define WLAN_EID_EXT_SUPP_RATES 50
+#define WLAN_EID_MOBILITY_DOMAIN 54
+#define WLAN_EID_FAST_BSS_TRANSITION 55
+#define WLAN_EID_TIMEOUT_INTERVAL 56
+#define WLAN_EID_RIC_DATA 57
+#define WLAN_EID_HT_OPERATION 61
+#define WLAN_EID_SECONDARY_CHANNEL_OFFSET 62
+#define WLAN_EID_20_40_BSS_COEXISTENCE 72
+#define WLAN_EID_20_40_BSS_INTOLERANT 73
+#define WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS 74
+#define WLAN_EID_MMIE 76
+#define WLAN_EID_VENDOR_SPECIFIC 221
+#define WLAN_EID_GENERIC (WLAN_EID_VENDOR_SPECIFIC)
+
+#define IEEE80211_MGMT_HDR_LEN 24
+#define IEEE80211_DATA_HDR3_LEN 24
+#define IEEE80211_DATA_HDR4_LEN 30
+
+
+#define IEEE80211_STATMASK_SIGNAL (1<<0)
+#define IEEE80211_STATMASK_RSSI (1<<1)
+#define IEEE80211_STATMASK_NOISE (1<<2)
+#define IEEE80211_STATMASK_RATE (1<<3)
+#define IEEE80211_STATMASK_WEMASK 0x7
+
+
+#define IEEE80211_CCK_MODULATION    (1<<0)
+#define IEEE80211_OFDM_MODULATION   (1<<1)
+
+#define IEEE80211_24GHZ_BAND     (1<<0)
+#define IEEE80211_52GHZ_BAND     (1<<1)
+
+#define IEEE80211_CCK_RATE_LEN  		4
+#define IEEE80211_NUM_OFDM_RATESLEN	8
+
+
+#define IEEE80211_CCK_RATE_1MB		        0x02
+#define IEEE80211_CCK_RATE_2MB		        0x04
+#define IEEE80211_CCK_RATE_5MB		        0x0B
+#define IEEE80211_CCK_RATE_11MB		        0x16
+#define IEEE80211_OFDM_RATE_LEN 		8
+#define IEEE80211_OFDM_RATE_6MB		        0x0C
+#define IEEE80211_OFDM_RATE_9MB		        0x12
+#define IEEE80211_OFDM_RATE_12MB		0x18
+#define IEEE80211_OFDM_RATE_18MB		0x24
+#define IEEE80211_OFDM_RATE_24MB		0x30
+#define IEEE80211_OFDM_RATE_36MB		0x48
+#define IEEE80211_OFDM_RATE_48MB		0x60
+#define IEEE80211_OFDM_RATE_54MB		0x6C
+#define IEEE80211_BASIC_RATE_MASK		0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK		(1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK		(1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK		(1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK		(1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK		(1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK		(1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK		(1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK		(1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK		(1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK		(1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK		(1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK		(1<<11)
+
+#define IEEE80211_CCK_RATES_MASK	        0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK	(IEEE80211_CCK_RATE_1MB_MASK | \
+	IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK	(IEEE80211_CCK_BASIC_RATES_MASK | \
+        IEEE80211_CCK_RATE_5MB_MASK | \
+        IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK		0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK	(IEEE80211_OFDM_RATE_6MB_MASK | \
+	IEEE80211_OFDM_RATE_12MB_MASK | \
+	IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK	(IEEE80211_OFDM_BASIC_RATES_MASK | \
+	IEEE80211_OFDM_RATE_9MB_MASK  | \
+	IEEE80211_OFDM_RATE_18MB_MASK | \
+	IEEE80211_OFDM_RATE_36MB_MASK | \
+	IEEE80211_OFDM_RATE_48MB_MASK | \
+	IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+                                IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+#define IEEE80211_NUM_OFDM_RATES	    8
+#define IEEE80211_NUM_CCK_RATES	            4
+#define IEEE80211_OFDM_SHIFT_MASK_A         4
+
+
+
+
+/* NOTE: This data is for statistical purposes; not all hardware provides this
+ *       information for frames received.  Not setting these will not cause
+ *       any adverse affects. */
+struct ieee80211_rx_stats {
+	//u32 mac_time[2];
+	s8 rssi;
+	u8 signal;
+	u8 noise;
+	u8 received_channel;
+	u16 rate; /* in 100 kbps */
+	//u8 control;
+	u8 mask;
+	u8 freq;
+	u16 len;
+};
+
+/* IEEE 802.11 requires that STA supports concurrent reception of at least
+ * three fragmented frames. This define can be increased to support more
+ * concurrent frames, but it should be noted that each entry can consume about
+ * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
+#define IEEE80211_FRAG_CACHE_LEN 4
+
+struct ieee80211_frag_entry {
+	u32 first_frag_time;
+	uint seq;
+	uint last_frag;
+	uint qos;   //jackson
+	uint tid;	//jackson
+	struct sk_buff *skb;
+	u8 src_addr[ETH_ALEN];
+	u8 dst_addr[ETH_ALEN];
+};
+
+#ifndef PLATFORM_FREEBSD //Baron BSD has already defined
+struct ieee80211_stats {
+	uint tx_unicast_frames;
+	uint tx_multicast_frames;
+	uint tx_fragments;
+	uint tx_unicast_octets;
+	uint tx_multicast_octets;
+	uint tx_deferred_transmissions;
+	uint tx_single_retry_frames;
+	uint tx_multiple_retry_frames;
+	uint tx_retry_limit_exceeded;
+	uint tx_discards;
+	uint rx_unicast_frames;
+	uint rx_multicast_frames;
+	uint rx_fragments;
+	uint rx_unicast_octets;
+	uint rx_multicast_octets;
+	uint rx_fcs_errors;
+	uint rx_discards_no_buffer;
+	uint tx_discards_wrong_sa;
+	uint rx_discards_undecryptable;
+	uint rx_message_in_msg_fragments;
+	uint rx_message_in_bad_msg_fragments;
+};
+#endif //PLATFORM_FREEBSD
+struct ieee80211_softmac_stats{
+	uint rx_ass_ok;
+	uint rx_ass_err;
+	uint rx_probe_rq;
+	uint tx_probe_rs;
+	uint tx_beacons;
+	uint rx_auth_rq;
+	uint rx_auth_rs_ok;
+	uint rx_auth_rs_err;
+	uint tx_auth_rq;
+	uint no_auth_rs;
+	uint no_ass_rs;
+	uint tx_ass_rq;
+	uint rx_ass_rq;
+	uint tx_probe_rq;
+	uint reassoc;
+	uint swtxstop;
+	uint swtxawake;
+};
+
+#define SEC_KEY_1         (1<<0)
+#define SEC_KEY_2         (1<<1)
+#define SEC_KEY_3         (1<<2)
+#define SEC_KEY_4         (1<<3)
+#define SEC_ACTIVE_KEY    (1<<4)
+#define SEC_AUTH_MODE     (1<<5)
+#define SEC_UNICAST_GROUP (1<<6)
+#define SEC_LEVEL         (1<<7)
+#define SEC_ENABLED       (1<<8)
+
+#define SEC_LEVEL_0      0 /* None */
+#define SEC_LEVEL_1      1 /* WEP 40 and 104 bit */
+#define SEC_LEVEL_2      2 /* Level 1 + TKIP */
+#define SEC_LEVEL_2_CKIP 3 /* Level 1 + CKIP */
+#define SEC_LEVEL_3      4 /* Level 2 + CCMP */
+
+#define WEP_KEYS 4
+#define WEP_KEY_LEN 13
+
+#ifdef CONFIG_IEEE80211W
+#define BIP_MAX_KEYID 5
+#define BIP_AAD_SIZE  20
+#endif //CONFIG_IEEE80211W
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)
+
+struct ieee80211_security {
+	u16 active_key:2,
+            enabled:1,
+	    auth_mode:2,
+            auth_algo:4,
+            unicast_uses_group:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][WEP_KEY_LEN];
+	u8 level;
+	u16 flags;
+} __attribute__ ((packed));
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct ieee80211_security {
+	u16 active_key:2,
+            enabled:1,
+	    auth_mode:2,
+            auth_algo:4,
+            unicast_uses_group:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][WEP_KEY_LEN];
+	u8 level;
+	u16 flags;
+} ;
+#pragma pack()
+
+#endif
+
+/*
+
+ 802.11 data frame from AP
+
+      ,-------------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `-------------------------------------------------------------------'
+
+Total: 28-2340 bytes
+
+*/
+
+struct ieee80211_header_data {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[6];
+	u8 addr2[6];
+	u8 addr3[6];
+	u16 seq_ctrl;
+};
+
+#define BEACON_PROBE_SSID_ID_POSITION 12
+
+/* Management Frame Information Element Types */
+#define MFIE_TYPE_SSID       0
+#define MFIE_TYPE_RATES      1
+#define MFIE_TYPE_FH_SET     2
+#define MFIE_TYPE_DS_SET     3
+#define MFIE_TYPE_CF_SET     4
+#define MFIE_TYPE_TIM        5
+#define MFIE_TYPE_IBSS_SET   6
+#define MFIE_TYPE_CHALLENGE  16
+#define MFIE_TYPE_ERP        42
+#define MFIE_TYPE_RSN	     48
+#define MFIE_TYPE_RATES_EX   50
+#define MFIE_TYPE_GENERIC    221
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)
+
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} __attribute__ ((packed));
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} __attribute__ ((packed));
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} ;
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} ;
+#pragma pack()
+
+#endif
+
+
+/*
+ * These are the data types that can make up management packets
+ *
+	u16 auth_algorithm;
+	u16 auth_sequence;
+	u16 beacon_interval;
+	u16 capability;
+	u8 current_ap[ETH_ALEN];
+	u16 listen_interval;
+	struct {
+		u16 association_id:14, reserved:2;
+	} __attribute__ ((packed));
+	u32 time_stamp[2];
+	u16 reason;
+	u16 status;
+*/
+
+#define IEEE80211_DEFAULT_TX_ESSID "Penguin"
+#define IEEE80211_DEFAULT_BASIC_RATE 10
+
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)
+
+
+struct ieee80211_authentication {
+	struct ieee80211_header_data header;
+	u16 algorithm;
+	u16 transaction;
+	u16 status;
+	//struct ieee80211_info_element_hdr info_element;
+} __attribute__ ((packed));
+
+
+struct ieee80211_probe_response {
+	struct ieee80211_header_data header;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 capability;
+	struct ieee80211_info_element info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_probe_request {
+	struct ieee80211_header_data header;
+	/*struct ieee80211_info_element info_element;*/
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_request_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 listen_interval;
+	//u8 current_ap[ETH_ALEN];
+	struct ieee80211_info_element_hdr info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_response_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 status;
+	u16 aid;
+//	struct ieee80211_info_element info_element; /* supported rates */
+} __attribute__ ((packed));
+#endif
+
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct ieee80211_authentication {
+	struct ieee80211_header_data header;
+	u16 algorithm;
+	u16 transaction;
+	u16 status;
+	//struct ieee80211_info_element_hdr info_element;
+} ;
+
+
+struct ieee80211_probe_response {
+	struct ieee80211_header_data header;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 capability;
+	struct ieee80211_info_element info_element;
+} ;
+
+struct ieee80211_probe_request {
+	struct ieee80211_header_data header;
+	/*struct ieee80211_info_element info_element;*/
+} ;
+
+struct ieee80211_assoc_request_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 listen_interval;
+	//u8 current_ap[ETH_ALEN];
+	struct ieee80211_info_element_hdr info_element;
+} ;
+
+struct ieee80211_assoc_response_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 status;
+	u16 aid;
+//	struct ieee80211_info_element info_element; /* supported rates */
+};
+
+#pragma pack()
+
+#endif
+
+
+
+
+struct ieee80211_txb {
+	u8 nr_frags;
+	u8 encrypted;
+	u16 reserved;
+	u16 frag_size;
+	u16 payload_size;
+	struct sk_buff *fragments[0];
+};
+
+
+/* SWEEP TABLE ENTRIES NUMBER*/
+#define MAX_SWEEP_TAB_ENTRIES		  42
+#define MAX_SWEEP_TAB_ENTRIES_PER_PACKET  7
+/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
+ * only use 8, and then use extended rates for the remaining supported
+ * rates.  Other APs, however, stick all of their supported rates on the
+ * main rates information element... */
+#define MAX_RATES_LENGTH                  ((u8)12)
+#define MAX_RATES_EX_LENGTH               ((u8)16)
+#define MAX_NETWORK_COUNT                  128
+#define MAX_CHANNEL_NUMBER                 161
+#define IEEE80211_SOFTMAC_SCAN_TIME	  400
+//(HZ / 2)
+#define IEEE80211_SOFTMAC_ASSOC_RETRY_TIME (HZ * 2)
+
+#define CRC_LENGTH                 4U
+
+#define MAX_WPA_IE_LEN (256)
+#define MAX_WPS_IE_LEN (512)
+#define MAX_P2P_IE_LEN (256)
+#define MAX_WFD_IE_LEN (128)
+
+#define NETWORK_EMPTY_ESSID (1<<0)
+#define NETWORK_HAS_OFDM    (1<<1)
+#define NETWORK_HAS_CCK     (1<<2)
+
+#define IEEE80211_DTIM_MBCAST 4
+#define IEEE80211_DTIM_UCAST 2
+#define IEEE80211_DTIM_VALID 1
+#define IEEE80211_DTIM_INVALID 0
+
+#define IEEE80211_PS_DISABLED 0
+#define IEEE80211_PS_UNICAST IEEE80211_DTIM_UCAST
+#define IEEE80211_PS_MBCAST IEEE80211_DTIM_MBCAST
+#define IW_ESSID_MAX_SIZE 32
+#if 0
+struct ieee80211_network {
+	/* These entries are used to identify a unique network */
+	u8 bssid[ETH_ALEN];
+	u8 channel;
+	/* Ensure null-terminated for any debug msgs */
+	u8 ssid[IW_ESSID_MAX_SIZE + 1];
+	u8 ssid_len;
+	u8	rssi;	//relative signal strength
+	u8	sq;		//signal quality
+
+	/* These are network statistics */
+	//struct ieee80211_rx_stats stats;
+	u16 capability;
+	u16	aid;
+	u8 rates[MAX_RATES_LENGTH];
+	u8 rates_len;
+	u8 rates_ex[MAX_RATES_EX_LENGTH];
+	u8 rates_ex_len;
+	
+	u8 edca_parmsets[18];
+		
+	u8 mode;
+	u8 flags;
+	u8 time_stamp[8];
+	u16 beacon_interval;
+	u16 listen_interval;
+	u16 atim_window;
+	u8 wpa_ie[MAX_WPA_IE_LEN];
+	size_t wpa_ie_len;
+	u8 rsn_ie[MAX_WPA_IE_LEN];
+	size_t rsn_ie_len;
+	u8 country[6];
+	u8 dtim_period;
+	u8 dtim_data;
+	u8 power_constraint;
+	u8 qosinfo;
+	u8 qbssload[5];
+	u8 network_type;
+	int join_res;
+	unsigned long	last_scanned;	
+};
+#endif
+/*
+join_res:
+-1: authentication fail
+-2: association fail
+> 0: TID
+*/
+
+#ifndef PLATFORM_FREEBSD //Baron BSD has already defined
+
+enum ieee80211_state {
+
+	/* the card is not linked at all */
+	IEEE80211_NOLINK = 0,
+	
+	/* IEEE80211_ASSOCIATING* are for BSS client mode
+	 * the driver shall not perform RX filtering unless
+	 * the state is LINKED.
+	 * The driver shall just check for the state LINKED and
+	 * defaults to NOLINK for ALL the other states (including
+	 * LINKED_SCANNING)
+	 */
+	
+	/* the association procedure will start (wq scheduling)*/
+	IEEE80211_ASSOCIATING,
+	IEEE80211_ASSOCIATING_RETRY,
+	
+	/* the association procedure is sending AUTH request*/
+	IEEE80211_ASSOCIATING_AUTHENTICATING,
+	
+	/* the association procedure has successfully authentcated
+	 * and is sending association request
+	 */
+	IEEE80211_ASSOCIATING_AUTHENTICATED,
+	
+	/* the link is ok. the card associated to a BSS or linked
+	 * to a ibss cell or acting as an AP and creating the bss
+	 */
+	IEEE80211_LINKED,
+	
+	/* same as LINKED, but the driver shall apply RX filter
+	 * rules as we are in NO_LINK mode. As the card is still
+	 * logically linked, but it is doing a syncro site survey
+	 * then it will be back to LINKED state.
+	 */
+	IEEE80211_LINKED_SCANNING,
+	
+};
+#endif //PLATFORM_FREEBSD
+
+#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
+#define DEFAULT_FTS 2346
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
+
+#ifdef PLATFORM_FREEBSD //Baron change func to macro
+#define is_multicast_mac_addr(Addr) ((((Addr[0]) & 0x01) == 0x01) && ((Addr[0]) != 0xff))
+#define is_broadcast_mac_addr(Addr) ((((Addr[0]) & 0xff) == 0xff) && (((Addr[1]) & 0xff) == 0xff) && \
+(((Addr[2]) & 0xff) == 0xff) && (((Addr[3]) & 0xff) == 0xff) && (((Addr[4]) & 0xff) == 0xff) && \
+(((Addr[5]) & 0xff) == 0xff))
+#else
+extern __inline int is_multicast_mac_addr(const u8 *addr)
+{
+        return ((addr[0] != 0xff) && (0x01 & addr[0]));
+}
+
+extern __inline int is_broadcast_mac_addr(const u8 *addr)
+{
+	return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
+		(addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
+}
+
+extern __inline int is_zero_mac_addr(const u8 *addr)
+{
+	return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
+		(addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
+}
+#endif //PLATFORM_FREEBSD
+
+#define CFG_IEEE80211_RESERVE_FCS (1<<0)
+#define CFG_IEEE80211_COMPUTE_FCS (1<<1)
+
+typedef struct tx_pending_t{
+	int frag;
+	struct ieee80211_txb *txb;
+}tx_pending_t;
+
+
+
+#define MAXTID	16
+
+#define IEEE_A            (1<<0)
+#define IEEE_B            (1<<1)
+#define IEEE_G            (1<<2)
+#define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
+
+//Baron move to ieee80211.c
+int ieee80211_is_empty_essid(const char *essid, int essid_len);
+int ieee80211_get_hdrlen(u16 fc);
+
+#if 0
+/* Action frame categories (IEEE 802.11-2007, 7.3.1.11, Table 7-24) */
+#define WLAN_ACTION_SPECTRUM_MGMT 0
+#define WLAN_ACTION_QOS 1
+#define WLAN_ACTION_DLS 2
+#define WLAN_ACTION_BLOCK_ACK 3
+#define WLAN_ACTION_RADIO_MEASUREMENT 5
+#define WLAN_ACTION_FT 6
+#define WLAN_ACTION_SA_QUERY 8
+#define WLAN_ACTION_WMM 17
+#endif
+
+
+/* Action category code */
+enum rtw_ieee80211_category {
+	RTW_WLAN_CATEGORY_SPECTRUM_MGMT = 0,
+	RTW_WLAN_CATEGORY_QOS = 1,
+	RTW_WLAN_CATEGORY_DLS = 2,
+	RTW_WLAN_CATEGORY_BACK = 3,
+	RTW_WLAN_CATEGORY_PUBLIC = 4, //IEEE 802.11 public action frames
+	RTW_WLAN_CATEGORY_RADIO_MEASUREMENT  = 5,
+	RTW_WLAN_CATEGORY_FT = 6,
+	RTW_WLAN_CATEGORY_HT = 7,
+	RTW_WLAN_CATEGORY_SA_QUERY = 8,
+	RTW_WLAN_CATEGORY_UNPROTECTED_WNM = 11, // add for CONFIG_IEEE80211W, none 11w also can use
+	RTW_WLAN_CATEGORY_TDLS = 12,
+	RTW_WLAN_CATEGORY_SELF_PROTECTED = 15, // add for CONFIG_IEEE80211W, none 11w also can use
+	RTW_WLAN_CATEGORY_WMM = 17,
+	RTW_WLAN_CATEGORY_P2P = 0x7f,//P2P action frames
+};
+
+/* SPECTRUM_MGMT action code */
+enum rtw_ieee80211_spectrum_mgmt_actioncode {
+	RTW_WLAN_ACTION_SPCT_MSR_REQ = 0,
+	RTW_WLAN_ACTION_SPCT_MSR_RPRT = 1,
+	RTW_WLAN_ACTION_SPCT_TPC_REQ = 2,
+	RTW_WLAN_ACTION_SPCT_TPC_RPRT = 3,
+	RTW_WLAN_ACTION_SPCT_CHL_SWITCH = 4,
+	RTW_WLAN_ACTION_SPCT_EXT_CHL_SWITCH = 5,
+};
+
+enum _PUBLIC_ACTION{
+	ACT_PUBLIC_BSSCOEXIST = 0, // 20/40 BSS Coexistence
+	ACT_PUBLIC_DSE_ENABLE = 1,
+	ACT_PUBLIC_DSE_DEENABLE = 2,
+	ACT_PUBLIC_DSE_REG_LOCATION = 3,
+	ACT_PUBLIC_EXT_CHL_SWITCH = 4,
+	ACT_PUBLIC_DSE_MSR_REQ = 5,
+	ACT_PUBLIC_DSE_MSR_RPRT = 6,
+	ACT_PUBLIC_MP = 7, // Measurement Pilot
+	ACT_PUBLIC_DSE_PWR_CONSTRAINT = 8,
+	ACT_PUBLIC_VENDOR = 9, // for WIFI_DIRECT
+	ACT_PUBLIC_GAS_INITIAL_REQ = 10,
+	ACT_PUBLIC_GAS_INITIAL_RSP = 11,
+	ACT_PUBLIC_GAS_COMEBACK_REQ = 12,
+	ACT_PUBLIC_GAS_COMEBACK_RSP = 13,
+	ACT_PUBLIC_TDLS_DISCOVERY_RSP = 14,
+	ACT_PUBLIC_LOCATION_TRACK = 15,
+	ACT_PUBLIC_MAX
+};
+
+#ifdef CONFIG_TDLS
+enum TDLS_ACTION_FIELD{
+	TDLS_SETUP_REQUEST = 0,
+	TDLS_SETUP_RESPONSE = 1,
+	TDLS_SETUP_CONFIRM = 2,
+	TDLS_TEARDOWN = 3,
+	TDLS_PEER_TRAFFIC_INDICATION = 4,
+	TDLS_CHANNEL_SWITCH_REQUEST = 5,
+	TDLS_CHANNEL_SWITCH_RESPONSE = 6,
+	TDLS_PEER_PSM_REQUEST = 7,
+	TDLS_PEER_PSM_RESPONSE = 8,
+	TDLS_PEER_TRAFFIC_RESPONSE = 9,
+	TDLS_DISCOVERY_REQUEST = 10,
+	TDLS_DISCOVERY_RESPONSE = 14,	//it's used in public action frame
+};
+
+#define	TUNNELED_PROBE_REQ	15
+#define	TUNNELED_PROBE_RSP	16
+#endif //CONFIG_TDLS
+
+/* BACK action code */
+enum rtw_ieee80211_back_actioncode {
+	RTW_WLAN_ACTION_ADDBA_REQ = 0,
+	RTW_WLAN_ACTION_ADDBA_RESP = 1,
+	RTW_WLAN_ACTION_DELBA = 2,
+};
+
+/* HT features action code */
+enum rtw_ieee80211_ht_actioncode {
+	RTW_WLAN_ACTION_NOTIFY_CH_WIDTH = 0,
+       RTW_WLAN_ACTION_SM_PS = 1,
+       RTW_WLAN_ACTION_PSPM = 2,
+       RTW_WLAN_ACTION_PCO_PHASE = 3,
+       RTW_WLAN_ACTION_MIMO_CSI_MX = 4,
+       RTW_WLAN_ACTION_MIMO_NONCP_BF = 5,
+       RTW_WLAN_ACTION_MIMP_CP_BF = 6,
+       RTW_WLAN_ACTION_ASEL_INDICATES_FB = 7,
+       RTW_WLAN_ACTION_HI_INFO_EXCHG = 8,
+};
+
+/* BACK (block-ack) parties */
+enum rtw_ieee80211_back_parties {
+	RTW_WLAN_BACK_RECIPIENT = 0,
+	RTW_WLAN_BACK_INITIATOR = 1,
+	RTW_WLAN_BACK_TIMER = 2,
+};
+
+
+#define OUI_MICROSOFT 0x0050f2 /* Microsoft (also used in Wi-Fi specs)
+				* 00:50:F2 */
+#ifndef PLATFORM_FREEBSD //Baron BSD has defined
+#define WME_OUI_TYPE 2
+#endif //PLATFORM_FREEBSD
+#define WME_OUI_SUBTYPE_INFORMATION_ELEMENT 0
+#define WME_OUI_SUBTYPE_PARAMETER_ELEMENT 1
+#define WME_OUI_SUBTYPE_TSPEC_ELEMENT 2
+#define WME_VERSION 1
+
+#define WME_ACTION_CODE_SETUP_REQUEST 0
+#define WME_ACTION_CODE_SETUP_RESPONSE 1
+#define WME_ACTION_CODE_TEARDOWN 2
+
+#define WME_SETUP_RESPONSE_STATUS_ADMISSION_ACCEPTED 0
+#define WME_SETUP_RESPONSE_STATUS_INVALID_PARAMETERS 1
+#define WME_SETUP_RESPONSE_STATUS_REFUSED 3
+
+#define WME_TSPEC_DIRECTION_UPLINK 0
+#define WME_TSPEC_DIRECTION_DOWNLINK 1
+#define WME_TSPEC_DIRECTION_BI_DIRECTIONAL 3
+
+
+#define OUI_BROADCOM 0x00904c /* Broadcom (Epigram) */
+
+#define VENDOR_HT_CAPAB_OUI_TYPE 0x33 /* 00-90-4c:0x33 */
+
+/**
+ * enum rtw_ieee80211_channel_flags - channel flags
+ *
+ * Channel flags set by the regulatory control code.
+ *
+ * @RTW_IEEE80211_CHAN_DISABLED: This channel is disabled.
+ * @RTW_IEEE80211_CHAN_PASSIVE_SCAN: Only passive scanning is permitted
+ *      on this channel.
+ * @RTW_IEEE80211_CHAN_NO_IBSS: IBSS is not allowed on this channel.
+ * @RTW_IEEE80211_CHAN_RADAR: Radar detection is required on this channel.
+ * @RTW_IEEE80211_CHAN_NO_HT40PLUS: extension channel above this channel
+ *      is not permitted.
+ * @RTW_IEEE80211_CHAN_NO_HT40MINUS: extension channel below this channel
+ *      is not permitted.
+ */
+  enum rtw_ieee80211_channel_flags {
+          RTW_IEEE80211_CHAN_DISABLED         = 1<<0,
+          RTW_IEEE80211_CHAN_PASSIVE_SCAN     = 1<<1,
+          RTW_IEEE80211_CHAN_NO_IBSS          = 1<<2,
+          RTW_IEEE80211_CHAN_RADAR            = 1<<3,
+          RTW_IEEE80211_CHAN_NO_HT40PLUS      = 1<<4,
+          RTW_IEEE80211_CHAN_NO_HT40MINUS     = 1<<5,
+  };
+  
+  #define RTW_IEEE80211_CHAN_NO_HT40 \
+          (RTW_IEEE80211_CHAN_NO_HT40PLUS | RTW_IEEE80211_CHAN_NO_HT40MINUS)
+
+/* Represent channel details, subset of ieee80211_channel */
+struct rtw_ieee80211_channel {
+	//enum ieee80211_band band;
+	//u16 center_freq;
+	u16 hw_value;
+	u32 flags;
+	//int max_antenna_gain;
+	//int max_power;
+	//int max_reg_power;
+	//bool beacon_found;
+	//u32 orig_flags;
+	//int orig_mag;
+	//int orig_mpwr;
+}; 
+
+#define CHAN_FMT \
+	/*"band:%d, "*/ \
+	/*"center_freq:%u, "*/ \
+	"hw_value:%u, " \
+	"flags:0x%08x" \
+	/*"max_antenna_gain:%d\n"*/ \
+	/*"max_power:%d\n"*/ \
+	/*"max_reg_power:%d\n"*/ \
+	/*"beacon_found:%u\n"*/ \
+	/*"orig_flags:0x%08x\n"*/ \
+	/*"orig_mag:%d\n"*/ \
+	/*"orig_mpwr:%d\n"*/ 
+
+#define CHAN_ARG(channel) \
+	/*(channel)->band*/ \
+	/*, (channel)->center_freq*/ \
+	(channel)->hw_value \
+	, (channel)->flags \
+	/*, (channel)->max_antenna_gain*/ \
+	/*, (channel)->max_power*/ \
+	/*, (channel)->max_reg_power*/ \
+	/*, (channel)->beacon_found*/ \
+	/*, (channel)->orig_flags*/ \
+	/*, (channel)->orig_mag*/ \
+	/*, (channel)->orig_mpwr*/ \
+
+/* Parsed Information Elements */
+struct rtw_ieee802_11_elems {
+	u8 *ssid;
+	u8 ssid_len;
+	u8 *supp_rates;
+	u8 supp_rates_len;
+	u8 *fh_params;
+	u8 fh_params_len;
+	u8 *ds_params;
+	u8 ds_params_len;
+	u8 *cf_params;
+	u8 cf_params_len;
+	u8 *tim;
+	u8 tim_len;
+	u8 *ibss_params;
+	u8 ibss_params_len;
+	u8 *challenge;
+	u8 challenge_len;
+	u8 *erp_info;
+	u8 erp_info_len;
+	u8 *ext_supp_rates;
+	u8 ext_supp_rates_len;
+	u8 *wpa_ie;
+	u8 wpa_ie_len;
+	u8 *rsn_ie;
+	u8 rsn_ie_len;
+	u8 *wme;
+	u8 wme_len;
+	u8 *wme_tspec;
+	u8 wme_tspec_len;
+	u8 *wps_ie;
+	u8 wps_ie_len;
+	u8 *power_cap;
+	u8 power_cap_len;
+	u8 *supp_channels;
+	u8 supp_channels_len;
+	u8 *mdie;
+	u8 mdie_len;
+	u8 *ftie;
+	u8 ftie_len;
+	u8 *timeout_int;
+	u8 timeout_int_len;
+	u8 *ht_capabilities;
+	u8 ht_capabilities_len;
+	u8 *ht_operation;
+	u8 ht_operation_len;
+	u8 *vendor_ht_cap;
+	u8 vendor_ht_cap_len;
+};
+
+typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
+
+ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
+				struct rtw_ieee802_11_elems *elems,
+				int show_errors);
+
+u8 *rtw_set_fixed_ie(unsigned char *pbuf, unsigned int len, unsigned char *source, unsigned int *frlen);
+u8 *rtw_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen);
+
+enum secondary_ch_offset {
+	SCN = 0, /* no secondary channel */
+	SCA = 1, /* secondary channel above */
+	SCB = 3,  /* secondary channel below */
+};
+u8 secondary_ch_offset_to_hal_ch_offset(u8 ch_offset);
+u8 hal_ch_offset_to_secondary_ch_offset(u8 ch_offset);
+u8 *rtw_set_ie_ch_switch(u8 *buf, u32 *buf_len, u8 ch_switch_mode, u8 new_ch, u8 ch_switch_cnt);
+u8 *rtw_set_ie_secondary_ch_offset(u8 *buf, u32 *buf_len, u8 secondary_ch_offset);
+u8 *rtw_set_ie_mesh_ch_switch_parm(u8 *buf, u32 *buf_len, u8 ttl, u8 flags, u16 reason, u16 precedence);
+
+u8 *rtw_get_ie(u8*pbuf, sint index, sint *len, sint limit);
+u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, uint *ielen);
+int rtw_ies_remove_ie(u8 *ies, uint *ies_len, uint offset, u8 eid, u8 *oui, u8 oui_len);
+
+void rtw_set_supported_rate(u8* SupportedRates, uint mode) ;
+
+unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit);
+unsigned char *rtw_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len, int limit);
+int rtw_get_wpa_cipher_suite(u8 *s);
+int rtw_get_wpa2_cipher_suite(u8 *s);
+int rtw_parse_wpa_ie(u8* wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher);
+int rtw_parse_wpa2_ie(u8* wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher);
+
+int rtw_get_sec_ie(u8 *in_ie,uint in_len,u8 *rsn_ie,u16 *rsn_len,u8 *wpa_ie,u16 *wpa_len);
+
+u8 rtw_is_wps_ie(u8 *ie_ptr, uint *wps_ielen);
+u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen);
+u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_attr, u32 *len_attr);
+u8 *rtw_get_wps_attr_content(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_content, uint *len_content);
+
+/**
+ * for_each_ie - iterate over continuous IEs
+ * @ie:
+ * @buf:
+ * @buf_len:
+ */
+#define for_each_ie(ie, buf, buf_len) \
+	for (ie = (void*)buf; (((u8*)ie) - ((u8*)buf) + 1) < buf_len; ie = (void*)(((u8*)ie) + *(((u8*)ie)+1) + 2))
+
+void dump_ies(u8 *buf, u32 buf_len);
+void dump_wps_ie(u8 *ie, u32 ie_len);
+
+#ifdef CONFIG_P2P
+u32 rtw_get_p2p_merged_ies_len(u8 *in_ie, u32 in_len);
+int rtw_p2p_merge_ies(u8 *in_ie, u32 in_len, u8 *merge_ie);
+void dump_p2p_ie(u8 *ie, u32 ie_len);
+u8 *rtw_get_p2p_ie(u8 *in_ie, int in_len, u8 *p2p_ie, uint *p2p_ielen);
+u8 *rtw_get_p2p_attr(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_attr, u32 *len_attr);
+u8 *rtw_get_p2p_attr_content(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_content, uint *len_content);
+u32 rtw_set_p2p_attr_content(u8 *pbuf, u8 attr_id, u16 attr_len, u8 *pdata_attr);
+void rtw_WLAN_BSSID_EX_remove_p2p_attr(WLAN_BSSID_EX *bss_ex, u8 attr_id);
+#endif
+
+#ifdef CONFIG_WFD
+int rtw_get_wfd_ie(u8 *in_ie, int in_len, u8 *wfd_ie, uint *wfd_ielen);
+int rtw_get_wfd_attr_content(u8 *wfd_ie, uint wfd_ielen, u8 target_attr_id ,u8 *attr_content, uint *attr_contentlen);
+#endif // CONFIG_WFD
+
+uint	rtw_get_rateset_len(u8	*rateset);
+
+struct registry_priv;
+int rtw_generate_ie(struct registry_priv *pregistrypriv);
+
+
+int rtw_get_bit_value_from_ieee_value(u8 val);
+
+uint	rtw_is_cckrates_included(u8 *rate);
+
+uint	rtw_is_cckratesonly_included(u8 *rate);
+
+int rtw_check_network_type(unsigned char *rate, int ratelen, int channel);
+
+void rtw_macaddr_cfg(u8 *mac_addr);
+
+u16 rtw_mcs_rate(u8 rf_type, u8 bw_40MHz, u8 short_GI_20, u8 short_GI_40, unsigned char * MCS_rate);
+
+int rtw_action_frame_parse(const u8 *frame, u32 frame_len, u8* category, u8 *action);
+const char *action_public_str(u8 action);
+
+#endif /* IEEE80211_H */
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h
new file mode 100755
index 0000000000000..3e55305e1d981
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h
@@ -0,0 +1,477 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __IEEE80211_EXT_H
+#define __IEEE80211_EXT_H
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#define WMM_OUI_TYPE 2
+#define WMM_OUI_SUBTYPE_INFORMATION_ELEMENT 0
+#define WMM_OUI_SUBTYPE_PARAMETER_ELEMENT 1
+#define WMM_OUI_SUBTYPE_TSPEC_ELEMENT 2
+#define WMM_VERSION 1
+
+#define WPA_PROTO_WPA BIT(0)
+#define WPA_PROTO_RSN BIT(1)
+
+#define WPA_KEY_MGMT_IEEE8021X BIT(0)
+#define WPA_KEY_MGMT_PSK BIT(1)
+#define WPA_KEY_MGMT_NONE BIT(2)
+#define WPA_KEY_MGMT_IEEE8021X_NO_WPA BIT(3)
+#define WPA_KEY_MGMT_WPA_NONE BIT(4)
+
+
+#define WPA_CAPABILITY_PREAUTH BIT(0)
+#define WPA_CAPABILITY_MGMT_FRAME_PROTECTION BIT(6)
+#define WPA_CAPABILITY_PEERKEY_ENABLED BIT(9)
+
+
+#define PMKID_LEN 16
+
+
+#ifdef PLATFORM_LINUX
+struct wpa_ie_hdr {
+	u8 elem_id;
+	u8 len;
+	u8 oui[4]; /* 24-bit OUI followed by 8-bit OUI type */
+	u8 version[2]; /* little endian */
+}__attribute__ ((packed));
+
+struct rsn_ie_hdr {
+	u8 elem_id; /* WLAN_EID_RSN */
+	u8 len;
+	u8 version[2]; /* little endian */
+}__attribute__ ((packed));
+
+struct wme_ac_parameter {
+#if defined(CONFIG_LITTLE_ENDIAN)
+	/* byte 1 */
+	u8 	aifsn:4,
+		acm:1,
+	 	aci:2,
+	 	reserved:1;
+
+	/* byte 2 */
+	u8 	eCWmin:4,
+	 	eCWmax:4;
+#elif defined(CONFIG_BIG_ENDIAN)
+	/* byte 1 */
+	u8 	reserved:1,
+	 	aci:2,
+	 	acm:1,
+	 	aifsn:4;
+
+	/* byte 2 */
+	u8 	eCWmax:4,
+	 	eCWmin:4;
+#else
+#error	"Please fix <endian.h>"
+#endif
+
+	/* bytes 3 & 4 */
+	u16 txopLimit;
+} __attribute__ ((packed));
+
+struct wme_parameter_element {
+	/* required fields for WME version 1 */
+	u8 oui[3];
+	u8 oui_type;
+	u8 oui_subtype;
+	u8 version;
+	u8 acInfo;
+	u8 reserved;
+	struct wme_ac_parameter ac[4];
+
+} __attribute__ ((packed));
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct wpa_ie_hdr {
+	u8 elem_id;
+	u8 len;
+	u8 oui[4]; /* 24-bit OUI followed by 8-bit OUI type */
+	u8 version[2]; /* little endian */
+};
+
+struct rsn_ie_hdr {
+	u8 elem_id; /* WLAN_EID_RSN */
+	u8 len;
+	u8 version[2]; /* little endian */
+};
+
+#pragma pack()
+
+#endif
+
+#define WPA_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((u16) (val)) >> 8;	\
+		(a)[0] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define WPA_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define WPA_PUT_LE32(a, val)					\
+	do {							\
+		(a)[3] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[0] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RSN_SELECTOR_PUT(a, val) WPA_PUT_BE32((u8 *) (a), (val))
+//#define RSN_SELECTOR_PUT(a, val) WPA_PUT_LE32((u8 *) (a), (val))
+
+
+
+/* Action category code */
+enum ieee80211_category {
+	WLAN_CATEGORY_SPECTRUM_MGMT = 0,
+	WLAN_CATEGORY_QOS = 1,
+	WLAN_CATEGORY_DLS = 2,
+	WLAN_CATEGORY_BACK = 3,
+	WLAN_CATEGORY_HT = 7,
+	WLAN_CATEGORY_WMM = 17,
+};
+
+/* SPECTRUM_MGMT action code */
+enum ieee80211_spectrum_mgmt_actioncode {
+	WLAN_ACTION_SPCT_MSR_REQ = 0,
+	WLAN_ACTION_SPCT_MSR_RPRT = 1,
+	WLAN_ACTION_SPCT_TPC_REQ = 2,
+	WLAN_ACTION_SPCT_TPC_RPRT = 3,
+	WLAN_ACTION_SPCT_CHL_SWITCH = 4,
+	WLAN_ACTION_SPCT_EXT_CHL_SWITCH = 5,
+};
+
+/* BACK action code */
+enum ieee80211_back_actioncode {
+	WLAN_ACTION_ADDBA_REQ = 0,
+	WLAN_ACTION_ADDBA_RESP = 1,
+	WLAN_ACTION_DELBA = 2,
+};
+
+/* HT features action code */
+enum ieee80211_ht_actioncode {
+	WLAN_ACTION_NOTIFY_CH_WIDTH = 0,
+       WLAN_ACTION_SM_PS = 1,
+       WLAN_ACTION_PSPM = 2,
+       WLAN_ACTION_PCO_PHASE = 3,
+       WLAN_ACTION_MIMO_CSI_MX = 4,
+       WLAN_ACTION_MIMO_NONCP_BF = 5,
+       WLAN_ACTION_MIMP_CP_BF = 6,
+       WLAN_ACTION_ASEL_INDICATES_FB = 7,
+       WLAN_ACTION_HI_INFO_EXCHG = 8,
+};
+
+/* BACK (block-ack) parties */
+enum ieee80211_back_parties {
+	WLAN_BACK_RECIPIENT = 0,
+	WLAN_BACK_INITIATOR = 1,
+	WLAN_BACK_TIMER = 2,
+};
+
+#ifdef PLATFORM_LINUX
+
+struct ieee80211_mgmt {
+	u16 frame_control;
+	u16 duration;
+	u8 da[6];
+	u8 sa[6];
+	u8 bssid[6];
+	u16 seq_ctrl;
+	union {
+		struct {
+			u16 auth_alg;
+			u16 auth_transaction;
+			u16 status_code;
+			/* possibly followed by Challenge text */
+			u8 variable[0];
+		}  __attribute__ ((packed)) auth;
+		struct {
+			u16 reason_code;
+		}  __attribute__ ((packed)) deauth;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) assoc_req;
+		struct {
+			u16 capab_info;
+			u16 status_code;
+			u16 aid;
+			/* followed by Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) assoc_resp, reassoc_resp;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			u8 current_ap[6];
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) reassoc_req;
+		struct {
+			u16 reason_code;
+		}  __attribute__ ((packed)) disassoc;
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params, TIM */
+			u8 variable[0];
+		}  __attribute__ ((packed)) beacon;
+		struct {
+			/* only variable items: SSID, Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) probe_req;
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params */
+			u8 variable[0];
+		}  __attribute__ ((packed)) probe_resp;
+		struct {
+			u8 category;
+			union {
+				struct {
+					u8 action_code;
+					u8 dialog_token;
+					u8 status_code;
+					u8 variable[0];
+				}  __attribute__ ((packed)) wme_action;
+#if 0
+				struct{
+					u8 action_code;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_channel_sw_ie sw_elem;
+				}  __attribute__ ((packed)) chan_switch;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_msrment_ie msr_elem;
+				}  __attribute__ ((packed)) measurement;
+#endif
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 capab;
+					u16 timeout;
+					u16 start_seq_num;
+				}  __attribute__ ((packed)) addba_req;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 status;
+					u16 capab;
+					u16 timeout;
+				}  __attribute__ ((packed)) addba_resp;
+				struct{
+					u8 action_code;
+					u16 params;
+					u16 reason_code;
+				}  __attribute__ ((packed)) delba;
+				struct{
+					u8 action_code;
+					/* capab_info for open and confirm,
+					 * reason for close
+					 */
+					u16 aux;
+					/* Followed in plink_confirm by status
+					 * code, AID and supported rates,
+					 * and directly by supported rates in
+					 * plink_open and plink_close
+					 */
+					u8 variable[0];
+				}  __attribute__ ((packed)) plink_action;
+				struct{
+					u8 action_code;
+					u8 variable[0];
+				}  __attribute__ ((packed)) mesh_action;
+			} __attribute__ ((packed)) u;
+		}  __attribute__ ((packed)) action;
+	} __attribute__ ((packed)) u;
+}__attribute__ ((packed));
+
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct ieee80211_mgmt {
+	u16 frame_control;
+	u16 duration;
+	u8 da[6];
+	u8 sa[6];
+	u8 bssid[6];
+	u16 seq_ctrl;
+	union {
+		struct {
+			u16 auth_alg;
+			u16 auth_transaction;
+			u16 status_code;
+			/* possibly followed by Challenge text */
+			u8 variable[0];
+		}  auth;
+		struct {
+			u16 reason_code;
+		}  deauth;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  assoc_req;
+		struct {
+			u16 capab_info;
+			u16 status_code;
+			u16 aid;
+			/* followed by Supported rates */
+			u8 variable[0];
+		}  assoc_resp, reassoc_resp;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			u8 current_ap[6];
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  reassoc_req;
+		struct {
+			u16 reason_code;
+		}  disassoc;
+#if 0		
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params, TIM */
+			u8 variable[0];
+		}  beacon;
+		struct {
+			/* only variable items: SSID, Supported rates */
+			u8 variable[0];
+		}  probe_req;
+		
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params */
+			u8 variable[0];
+		}  probe_resp;
+#endif	
+		struct {
+			u8 category;
+			union {
+				struct {
+					u8 action_code;
+					u8 dialog_token;
+					u8 status_code;
+					u8 variable[0];
+				}  wme_action;
+/*				
+				struct{
+					u8 action_code;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_channel_sw_ie sw_elem;
+				}  chan_switch;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_msrment_ie msr_elem;
+				}  measurement;
+*/				
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 capab;
+					u16 timeout;
+					u16 start_seq_num;
+				}  addba_req;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 status;
+					u16 capab;
+					u16 timeout;
+				}  addba_resp;
+				struct{
+					u8 action_code;
+					u16 params;
+					u16 reason_code;
+				}  delba;
+				struct{
+					u8 action_code;
+					/* capab_info for open and confirm,
+					 * reason for close
+					 */
+					u16 aux;
+					/* Followed in plink_confirm by status
+					 * code, AID and supported rates,
+					 * and directly by supported rates in
+					 * plink_open and plink_close
+					 */
+					u8 variable[0];
+				}  plink_action;
+				struct{
+					u8 action_code;
+					u8 variable[0];
+				}  mesh_action;
+			} u;
+		}  action;
+	} u;
+} ;
+
+#pragma pack()
+
+#endif
+
+/* mgmt header + 1 byte category code */
+#define IEEE80211_MIN_ACTION_SIZE FIELD_OFFSET(struct ieee80211_mgmt, u.action.u)
+
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h b/drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h
new file mode 100755
index 0000000000000..9e36d7fadb258
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h
@@ -0,0 +1,112 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+ 
+#ifndef _LINUX_IF_ETHER_H
+#define _LINUX_IF_ETHER_H
+
+/*
+ *	IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
+ *	and FCS/CRC (frame check sequence). 
+ */
+
+#define ETH_ALEN	6		/* Octets in one ethernet addr	 */
+#define ETH_HLEN	14		/* Total octets in header.	 */
+#define ETH_ZLEN	60		/* Min. octets in frame sans FCS */
+#define ETH_DATA_LEN	1500		/* Max. octets in payload	 */
+#define ETH_FRAME_LEN	1514		/* Max. octets in frame sans FCS */
+
+/*
+ *	These are the defined Ethernet Protocol ID's.
+ */
+
+#define ETH_P_LOOP	0x0060		/* Ethernet Loopback packet	*/
+#define ETH_P_PUP	0x0200		/* Xerox PUP packet		*/
+#define ETH_P_PUPAT	0x0201		/* Xerox PUP Addr Trans packet	*/
+#define ETH_P_IP	0x0800		/* Internet Protocol packet	*/
+#define ETH_P_X25	0x0805		/* CCITT X.25			*/
+#define ETH_P_ARP	0x0806		/* Address Resolution packet	*/
+#define	ETH_P_BPQ	0x08FF		/* G8BPQ AX.25 Ethernet Packet	[ NOT AN OFFICIALLY REGISTERED ID ] */
+#define ETH_P_IEEEPUP	0x0a00		/* Xerox IEEE802.3 PUP packet */
+#define ETH_P_IEEEPUPAT	0x0a01		/* Xerox IEEE802.3 PUP Addr Trans packet */
+#define ETH_P_DEC       0x6000          /* DEC Assigned proto           */
+#define ETH_P_DNA_DL    0x6001          /* DEC DNA Dump/Load            */
+#define ETH_P_DNA_RC    0x6002          /* DEC DNA Remote Console       */
+#define ETH_P_DNA_RT    0x6003          /* DEC DNA Routing              */
+#define ETH_P_LAT       0x6004          /* DEC LAT                      */
+#define ETH_P_DIAG      0x6005          /* DEC Diagnostics              */
+#define ETH_P_CUST      0x6006          /* DEC Customer use             */
+#define ETH_P_SCA       0x6007          /* DEC Systems Comms Arch       */
+#define ETH_P_RARP      0x8035		/* Reverse Addr Res packet	*/
+#define ETH_P_ATALK	0x809B		/* Appletalk DDP		*/
+#define ETH_P_AARP	0x80F3		/* Appletalk AARP		*/
+#define ETH_P_8021Q	0x8100          /* 802.1Q VLAN Extended Header  */
+#define ETH_P_IPX	0x8137		/* IPX over DIX			*/
+#define ETH_P_IPV6	0x86DD		/* IPv6 over bluebook		*/
+#define ETH_P_PPP_DISC	0x8863		/* PPPoE discovery messages     */
+#define ETH_P_PPP_SES	0x8864		/* PPPoE session messages	*/
+#define ETH_P_ATMMPOA	0x884c		/* MultiProtocol Over ATM	*/
+#define ETH_P_ATMFATE	0x8884		/* Frame-based ATM Transport
+					 * over Ethernet
+					 */
+
+/*
+ *	Non DIX types. Won't clash for 1500 types.
+ */
+ 
+#define ETH_P_802_3	0x0001		/* Dummy type for 802.3 frames  */
+#define ETH_P_AX25	0x0002		/* Dummy protocol id for AX.25  */
+#define ETH_P_ALL	0x0003		/* Every packet (be careful!!!) */
+#define ETH_P_802_2	0x0004		/* 802.2 frames 		*/
+#define ETH_P_SNAP	0x0005		/* Internal only		*/
+#define ETH_P_DDCMP     0x0006          /* DEC DDCMP: Internal only     */
+#define ETH_P_WAN_PPP   0x0007          /* Dummy type for WAN PPP frames*/
+#define ETH_P_PPP_MP    0x0008          /* Dummy type for PPP MP frames */
+#define ETH_P_LOCALTALK 0x0009		/* Localtalk pseudo type 	*/
+#define ETH_P_PPPTALK	0x0010		/* Dummy type for Atalk over PPP*/
+#define ETH_P_TR_802_2	0x0011		/* 802.2 frames 		*/
+#define ETH_P_MOBITEX	0x0015		/* Mobitex (kaz@cafe.net)	*/
+#define ETH_P_CONTROL	0x0016		/* Card specific control frames */
+#define ETH_P_IRDA	0x0017		/* Linux-IrDA			*/
+#define ETH_P_ECONET	0x0018		/* Acorn Econet			*/
+
+/*
+ *	This is an Ethernet frame header.
+ */
+ 
+struct ethhdr 
+{
+	unsigned char	h_dest[ETH_ALEN];	/* destination eth addr	*/
+	unsigned char	h_source[ETH_ALEN];	/* source ether addr	*/
+	unsigned short	h_proto;		/* packet type ID field	*/
+};
+
+struct _vlan {
+   unsigned short       h_vlan_TCI;                // Encapsulates priority and VLAN ID
+   unsigned short       h_vlan_encapsulated_proto;
+};
+
+
+
+#define get_vlan_id(pvlan) ((ntohs((unsigned short )pvlan->h_vlan_TCI)) & 0xfff)
+#define get_vlan_priority(pvlan) ((ntohs((unsigned short )pvlan->h_vlan_TCI))>>13)
+#define get_vlan_encap_proto(pvlan) (ntohs((unsigned short )pvlan->h_vlan_encapsulated_proto))
+
+
+#endif	/* _LINUX_IF_ETHER_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h b/drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h
new file mode 100755
index 0000000000000..f182fb0f349e4
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h
@@ -0,0 +1,184 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __IOCTL_CFG80211_H__
+#define __IOCTL_CFG80211_H__ 
+
+#if defined(CONFIG_IOCTL_CFG80211) && !defined(CONFIG_CFG80211) && !defined(CONFIG_CFG80211_MODULE)
+	#error "Can't define CONFIG_IOCTL_CFG80211 because neither CONFIG_CFG80211 nor CONFIG_CFG80211_MODULE is defined in kernel"
+#endif
+#if defined(CONFIG_IOCTL_CFG80211) && LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+	#error "We haven't verify our cfg80211 solution below kernel version 2.6.35"
+#endif
+
+#if defined(RTW_USE_CFG80211_STA_EVENT)
+	#undef CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER
+#endif
+
+struct rtw_wdev_invit_info {
+	u8 state; /* 0: req, 1:rep */
+	u8 peer_mac[ETH_ALEN];
+	u8 active;
+	u8 token;
+	u8 flags;
+	u8 status;
+	u8 req_op_ch;
+	u8 rsp_op_ch;
+};
+
+#define rtw_wdev_invit_info_init(invit_info) \
+	do { \
+		(invit_info)->state = 0xff; \
+		_rtw_memset((invit_info)->peer_mac, 0, ETH_ALEN); \
+		(invit_info)->active = 0xff; \
+		(invit_info)->token = 0; \
+		(invit_info)->flags = 0x00; \
+		(invit_info)->status = 0xff; \
+		(invit_info)->req_op_ch = 0; \
+		(invit_info)->rsp_op_ch = 0; \
+	} while (0)
+
+struct rtw_wdev_nego_info {
+	u8 state; /* 0: req, 1:rep, 3:conf */
+	u8 peer_mac[ETH_ALEN];
+	u8 active;
+	u8 token;
+	u8 status;
+	u8 req_intent;
+	u8 req_op_ch;
+	u8 req_listen_ch;
+	u8 rsp_intent;
+	u8 rsp_op_ch;
+	u8 conf_op_ch;
+};
+
+#define rtw_wdev_nego_info_init(nego_info) \
+	do { \
+		(nego_info)->state = 0xff; \
+		_rtw_memset((nego_info)->peer_mac, 0, ETH_ALEN); \
+		(nego_info)->active = 0xff; \
+		(nego_info)->token = 0; \
+		(nego_info)->status = 0xff; \
+		(nego_info)->req_intent = 0xff; \
+		(nego_info)->req_op_ch = 0; \
+		(nego_info)->req_listen_ch = 0; \
+		(nego_info)->rsp_intent = 0xff; \
+		(nego_info)->rsp_op_ch = 0; \
+		(nego_info)->conf_op_ch = 0; \
+	} while (0)
+
+struct rtw_wdev_priv
+{	
+	struct wireless_dev *rtw_wdev;
+	
+	_adapter *padapter;
+
+	struct cfg80211_scan_request *scan_request;
+	_lock scan_req_lock;
+
+	struct net_device *pmon_ndev;//for monitor interface
+	char ifname_mon[IFNAMSIZ + 1]; //interface name for monitor interface
+
+	u8 p2p_enabled;
+
+	u8 provdisc_req_issued;
+
+	struct rtw_wdev_invit_info invit_info;
+	struct rtw_wdev_nego_info nego_info;
+
+	u8 bandroid_scan;
+	bool block;
+	bool power_mgmt;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	ATOMIC_T ro_ch_to;
+	ATOMIC_T switch_ch_to;	
+#endif	
+	
+};
+
+#define wdev_to_priv(w) ((struct rtw_wdev_priv *)(wdev_priv(w)))
+
+#define wiphy_to_adapter(x) (_adapter *)(((struct rtw_wdev_priv*)wiphy_priv(x))->padapter)
+
+#define wiphy_to_wdev(x) (struct wireless_dev *)(((struct rtw_wdev_priv*)wiphy_priv(x))->rtw_wdev)
+
+int rtw_wdev_alloc(_adapter *padapter, struct device *dev);
+void rtw_wdev_free(struct wireless_dev *wdev);
+void rtw_wdev_unregister(struct wireless_dev *wdev);
+
+void rtw_cfg80211_init_wiphy(_adapter *padapter);
+
+void rtw_cfg80211_surveydone_event_callback(_adapter *padapter);
+int rtw_cfg80211_check_bss(_adapter *padapter);
+void rtw_cfg80211_indicate_connect(_adapter *padapter);
+void rtw_cfg80211_indicate_disconnect(_adapter *padapter);
+void rtw_cfg80211_indicate_scan_done(struct rtw_wdev_priv *pwdev_priv, bool aborted);
+
+#ifdef CONFIG_AP_MODE
+void rtw_cfg80211_indicate_sta_assoc(_adapter *padapter, u8 *pmgmt_frame, uint frame_len);
+void rtw_cfg80211_indicate_sta_disassoc(_adapter *padapter, unsigned char *da, unsigned short reason);
+#endif //CONFIG_AP_MODE
+
+void rtw_cfg80211_issue_p2p_provision_request(_adapter *padapter, const u8 *buf, size_t len);
+void rtw_cfg80211_rx_p2p_action_public(_adapter *padapter, u8 *pmgmt_frame, uint frame_len);
+void rtw_cfg80211_rx_action_p2p(_adapter *padapter, u8 *pmgmt_frame, uint frame_len);
+void rtw_cfg80211_rx_action(_adapter *adapter, u8 *frame, uint frame_len, const char*msg);
+
+int rtw_cfg80211_set_mgnt_wpsp2pie(struct net_device *net, char *buf, int len, int type);
+
+bool rtw_cfg80211_pwr_mgmt(_adapter *adapter);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0))  && !defined(COMPAT_KERNEL_RELEASE)
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->pnetdev, freq, buf, len, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->pnetdev, freq, sig_dbm, buf, len, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,12,0))
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->rtw_wdev, freq, sig_dbm, buf, len, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,18,0))
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->rtw_wdev, freq, sig_dbm, buf, len, 0, gfp)
+#else
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->rtw_wdev, freq, sig_dbm, buf, len, 0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0))  && !defined(COMPAT_KERNEL_RELEASE)
+#define rtw_cfg80211_send_rx_assoc(adapter, bss, buf, len) cfg80211_send_rx_assoc((adapter)->pnetdev, buf, len)
+#else
+#define rtw_cfg80211_send_rx_assoc(adapter, bss, buf, len) cfg80211_send_rx_assoc((adapter)->pnetdev, bss, buf, len)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+#define rtw_cfg80211_mgmt_tx_status(adapter, cookie, buf, len, ack, gfp) cfg80211_mgmt_tx_status((adapter)->pnetdev, cookie, buf, len, ack, gfp)
+#else
+#define rtw_cfg80211_mgmt_tx_status(adapter, cookie, buf, len, ack, gfp) cfg80211_mgmt_tx_status((adapter)->rtw_wdev, cookie, buf, len, ack, gfp)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+#define rtw_cfg80211_ready_on_channel(adapter, cookie, chan, channel_type, duration, gfp)  cfg80211_ready_on_channel((adapter)->pnetdev, cookie, chan, channel_type, duration, gfp)
+#define rtw_cfg80211_remain_on_channel_expired(adapter, cookie, chan, chan_type, gfp) cfg80211_remain_on_channel_expired((adapter)->pnetdev, cookie, chan, chan_type, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+#define rtw_cfg80211_ready_on_channel(adapter, cookie, chan, channel_type, duration, gfp)  cfg80211_ready_on_channel((adapter)->rtw_wdev, cookie, chan, channel_type, duration, gfp)
+#define rtw_cfg80211_remain_on_channel_expired(adapter, cookie, chan, chan_type, gfp) cfg80211_remain_on_channel_expired((adapter)->rtw_wdev, cookie, chan, chan_type, gfp)
+#else
+#define rtw_cfg80211_ready_on_channel(adapter, cookie, chan, channel_type, duration, gfp)  cfg80211_ready_on_channel((adapter)->rtw_wdev, cookie, chan, duration, gfp)
+#define rtw_cfg80211_remain_on_channel_expired(adapter, cookie, chan, chan_type, gfp) cfg80211_remain_on_channel_expired((adapter)->rtw_wdev, cookie, chan, gfp)
+#endif
+
+#endif //__IOCTL_CFG80211_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ip.h b/drivers/net/wireless/realtek/rtl8192cu/include/ip.h
new file mode 100755
index 0000000000000..d7f723d265281
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ip.h
@@ -0,0 +1,141 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_IP_H
+#define _LINUX_IP_H
+#include <rtw_byteorder.h>
+
+/* SOL_IP socket options */
+
+#define IPTOS_TOS_MASK		0x1E
+#define IPTOS_TOS(tos)		((tos)&IPTOS_TOS_MASK)
+#define	IPTOS_LOWDELAY		0x10
+#define	IPTOS_THROUGHPUT	0x08
+#define	IPTOS_RELIABILITY	0x04
+#define	IPTOS_MINCOST		0x02
+
+#define IPTOS_PREC_MASK		0xE0
+#define IPTOS_PREC(tos)		((tos)&IPTOS_PREC_MASK)
+#define IPTOS_PREC_NETCONTROL           0xe0
+#define IPTOS_PREC_INTERNETCONTROL      0xc0
+#define IPTOS_PREC_CRITIC_ECP           0xa0
+#define IPTOS_PREC_FLASHOVERRIDE        0x80
+#define IPTOS_PREC_FLASH                0x60
+#define IPTOS_PREC_IMMEDIATE            0x40
+#define IPTOS_PREC_PRIORITY             0x20
+#define IPTOS_PREC_ROUTINE              0x00
+
+
+/* IP options */
+#define IPOPT_COPY		0x80
+#define IPOPT_CLASS_MASK	0x60
+#define IPOPT_NUMBER_MASK	0x1f
+
+#define	IPOPT_COPIED(o)		((o)&IPOPT_COPY)
+#define	IPOPT_CLASS(o)		((o)&IPOPT_CLASS_MASK)
+#define	IPOPT_NUMBER(o)		((o)&IPOPT_NUMBER_MASK)
+
+#define	IPOPT_CONTROL		0x00
+#define	IPOPT_RESERVED1		0x20
+#define	IPOPT_MEASUREMENT	0x40
+#define	IPOPT_RESERVED2		0x60
+
+#define IPOPT_END	(0 |IPOPT_CONTROL)
+#define IPOPT_NOOP	(1 |IPOPT_CONTROL)
+#define IPOPT_SEC	(2 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_LSRR	(3 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_TIMESTAMP	(4 |IPOPT_MEASUREMENT)
+#define IPOPT_RR	(7 |IPOPT_CONTROL)
+#define IPOPT_SID	(8 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_SSRR	(9 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_RA	(20|IPOPT_CONTROL|IPOPT_COPY)
+
+#define IPVERSION	4
+#define MAXTTL		255
+#define IPDEFTTL	64
+
+/* struct timestamp, struct route and MAX_ROUTES are removed.
+
+   REASONS: it is clear that nobody used them because:
+   - MAX_ROUTES value was wrong.
+   - "struct route" was wrong.
+   - "struct timestamp" had fatally misaligned bitfields and was completely unusable.
+ */
+
+#define IPOPT_OPTVAL 0
+#define IPOPT_OLEN   1
+#define IPOPT_OFFSET 2
+#define IPOPT_MINOFF 4
+#define MAX_IPOPTLEN 40
+#define IPOPT_NOP IPOPT_NOOP
+#define IPOPT_EOL IPOPT_END
+#define IPOPT_TS  IPOPT_TIMESTAMP
+
+#define	IPOPT_TS_TSONLY		0		/* timestamps only */
+#define	IPOPT_TS_TSANDADDR	1		/* timestamps and addresses */
+#define	IPOPT_TS_PRESPEC	3		/* specified modules only */
+
+#ifdef PLATFORM_LINUX
+
+struct ip_options {
+  __u32		faddr;				/* Saved first hop address */
+  unsigned char	optlen;
+  unsigned char srr;
+  unsigned char rr;
+  unsigned char ts;
+  unsigned char is_setbyuser:1,			/* Set by setsockopt?			*/
+                is_data:1,			/* Options in __data, rather than skb	*/
+                is_strictroute:1,		/* Strict source route			*/
+                srr_is_hit:1,			/* Packet destination addr was our one	*/
+                is_changed:1,			/* IP checksum more not valid		*/	
+                rr_needaddr:1,			/* Need to record addr of outgoing dev	*/
+                ts_needtime:1,			/* Need to record timestamp		*/
+                ts_needaddr:1;			/* Need to record addr of outgoing dev  */
+  unsigned char router_alert;
+  unsigned char __pad1;
+  unsigned char __pad2;
+  unsigned char __data[0];
+};
+
+#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
+#endif
+
+struct iphdr {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+	__u8	ihl:4,
+		version:4;
+#elif defined (__BIG_ENDIAN_BITFIELD)
+	__u8	version:4,
+  		ihl:4;
+#else
+#error	"Please fix <asm/byteorder.h>"
+#endif
+	__u8	tos;
+	__u16	tot_len;
+	__u16	id;
+	__u16	frag_off;
+	__u8	ttl;
+	__u8	protocol;
+	__u16	check;
+	__u32	saddr;
+	__u32	daddr;
+	/*The options start here. */
+};
+
+#endif	/* _LINUX_IP_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h b/drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h
new file mode 100755
index 0000000000000..24a22d63d696b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h
@@ -0,0 +1,90 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef _LINUX_WIRELESS_H
+#define _LINUX_WIRELESS_H
+
+/***************************** INCLUDES *****************************/
+
+#if 0
+#include <linux/types.h>		/* for __u* and __s* typedefs */
+#include <linux/socket.h>		/* for "struct sockaddr" et al	*/
+#include <linux/if.h>			/* for IFNAMSIZ and co... */
+#else
+#define __user
+//typedef uint16_t	__u16;
+#include <sys/socket.h>			/* for "struct sockaddr" et al	*/
+#include <net/if.h>			/* for IFNAMSIZ and co... */
+#endif
+
+/****************************** TYPES ******************************/
+
+/* --------------------------- SUBTYPES --------------------------- */
+/*
+ *	For all data larger than 16 octets, we need to use a
+ *	pointer to memory allocated in user space.
+ */
+struct	iw_point
+{
+  void __user	*pointer;	/* Pointer to the data  (in user space) */
+  __u16		length;		/* number of fields or size in bytes */
+  __u16		flags;		/* Optional params */
+};
+
+
+/* ------------------------ IOCTL REQUEST ------------------------ */
+/*
+ * This structure defines the payload of an ioctl, and is used 
+ * below.
+ *
+ * Note that this structure should fit on the memory footprint
+ * of iwreq (which is the same as ifreq), which mean a max size of
+ * 16 octets = 128 bits. Warning, pointers might be 64 bits wide...
+ * You should check this when increasing the structures defined
+ * above in this file...
+ */
+union	iwreq_data
+{
+	/* Config - generic */
+	char		name[IFNAMSIZ];
+	/* Name : used to verify the presence of  wireless extensions.
+	 * Name of the protocol/provider... */
+
+	struct iw_point	data;		/* Other large parameters */
+};
+
+/*
+ * The structure to exchange data for ioctl.
+ * This structure is the same as 'struct ifreq', but (re)defined for
+ * convenience...
+ * Do I need to remind you about structure size (32 octets) ?
+ */
+struct	iwreq 
+{
+	union
+	{
+		char	ifrn_name[IFNAMSIZ];	/* if name, e.g. "eth0" */
+	} ifr_ifrn;
+
+	/* Data part (defined just above) */
+	union	iwreq_data	u;
+};
+
+#endif	/* _LINUX_WIRELESS_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h
new file mode 100755
index 0000000000000..75754db1accd6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h
@@ -0,0 +1,40 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__MLME_OSDEP_H_
+#define __MLME_OSDEP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#if defined(PLATFORM_WINDOWS) || defined(PLATFORM_MPIXEL)
+extern int time_after(u32 now, u32 old);
+#endif
+
+extern void rtw_init_mlme_timer(_adapter *padapter);
+extern void rtw_os_indicate_disconnect( _adapter *adapter );
+extern void rtw_os_indicate_connect( _adapter *adapter );
+void rtw_os_indicate_scan_done( _adapter *padapter, bool aborted);
+extern void rtw_report_sec_ie(_adapter *adapter,u8 authmode,u8 *sec_ie);
+
+void rtw_reset_securitypriv( _adapter *adapter );
+
+#endif	//_MLME_OSDEP_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h b/drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h
new file mode 100755
index 0000000000000..5f8673811fb58
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h
@@ -0,0 +1,353 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__CUSTOM_OID_H
+#define __CUSTOM_OID_H
+
+// by Owen
+// 0xFF818000 - 0xFF81802F		RTL8180 Mass Production Kit
+// 0xFF818500 - 0xFF81850F		RTL8185 Setup Utility
+// 0xFF818580 - 0xFF81858F		RTL8185 Phy Status Utility
+
+//
+
+// by Owen for Production Kit
+// For Production Kit with Agilent Equipments
+// in order to make our custom oids hopefully somewhat unique
+// we will use 0xFF (indicating implementation specific OID)
+//               81(first byte of non zero Realtek unique identifier)
+//               80 (second byte of non zero Realtek unique identifier)
+//               XX (the custom OID number - providing 255 possible custom oids)
+
+#define OID_RT_PRO_RESET_DUT				0xFF818000
+#define OID_RT_PRO_SET_DATA_RATE			0xFF818001
+#define OID_RT_PRO_START_TEST				0xFF818002
+#define OID_RT_PRO_STOP_TEST    			0xFF818003
+#define OID_RT_PRO_SET_PREAMBLE				0xFF818004
+#define OID_RT_PRO_SET_SCRAMBLER			0xFF818005
+#define OID_RT_PRO_SET_FILTER_BB			0xFF818006
+#define OID_RT_PRO_SET_MANUAL_DIVERSITY_BB		0xFF818007
+#define OID_RT_PRO_SET_CHANNEL_DIRECT_CALL		0xFF818008
+#define OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL		0xFF818009
+#define OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL		0xFF81800A
+
+#define OID_RT_PRO_SET_TX_ANTENNA_BB			0xFF81800D
+#define OID_RT_PRO_SET_ANTENNA_BB			0xFF81800E
+#define OID_RT_PRO_SET_CR_SCRAMBLER			0xFF81800F
+#define OID_RT_PRO_SET_CR_NEW_FILTER			0xFF818010
+#define OID_RT_PRO_SET_TX_POWER_CONTROL			0xFF818011
+#define OID_RT_PRO_SET_CR_TX_CONFIG			0xFF818012
+#define OID_RT_PRO_GET_TX_POWER_CONTROL			0xFF818013
+#define OID_RT_PRO_GET_CR_SIGNAL_QUALITY		0xFF818014
+#define OID_RT_PRO_SET_CR_SETPOINT			0xFF818015
+#define OID_RT_PRO_SET_INTEGRATOR			0xFF818016
+#define OID_RT_PRO_SET_SIGNAL_QUALITY			0xFF818017
+#define OID_RT_PRO_GET_INTEGRATOR			0xFF818018
+#define OID_RT_PRO_GET_SIGNAL_QUALITY			0xFF818019
+#define OID_RT_PRO_QUERY_EEPROM_TYPE			0xFF81801A
+#define OID_RT_PRO_WRITE_MAC_ADDRESS			0xFF81801B
+#define OID_RT_PRO_READ_MAC_ADDRESS			0xFF81801C
+#define OID_RT_PRO_WRITE_CIS_DATA			0xFF81801D
+#define OID_RT_PRO_READ_CIS_DATA			0xFF81801E
+#define OID_RT_PRO_WRITE_POWER_CONTROL			0xFF81801F
+#define OID_RT_PRO_READ_POWER_CONTROL			0xFF818020
+#define OID_RT_PRO_WRITE_EEPROM				0xFF818021
+#define OID_RT_PRO_READ_EEPROM				0xFF818022
+#define OID_RT_PRO_RESET_TX_PACKET_SENT			0xFF818023
+#define OID_RT_PRO_QUERY_TX_PACKET_SENT			0xFF818024
+#define OID_RT_PRO_RESET_RX_PACKET_RECEIVED		0xFF818025 
+#define OID_RT_PRO_QUERY_RX_PACKET_RECEIVED		0xFF818026
+#define OID_RT_PRO_QUERY_RX_PACKET_CRC32_ERROR		0xFF818027
+#define OID_RT_PRO_QUERY_CURRENT_ADDRESS		0xFF818028
+#define OID_RT_PRO_QUERY_PERMANENT_ADDRESS		0xFF818029
+#define OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS		0xFF81802A
+#define OID_RT_PRO_RECEIVE_PACKET			0xFF81802C
+// added by Owen on 04/08/03 for Cameo's request
+#define OID_RT_PRO_WRITE_EEPROM_BYTE			0xFF81802D
+#define OID_RT_PRO_READ_EEPROM_BYTE			0xFF81802E
+#define OID_RT_PRO_SET_MODULATION			0xFF81802F
+//
+
+//Sean		
+#define OID_RT_DRIVER_OPTION				0xFF818080
+#define OID_RT_RF_OFF					0xFF818081
+#define OID_RT_AUTH_STATUS				0xFF818082
+
+//========================================================================
+#define OID_RT_PRO_SET_CONTINUOUS_TX			0xFF81800B
+#define OID_RT_PRO_SET_SINGLE_CARRIER_TX		0xFF81800C
+#define OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX		0xFF81802B
+#define OID_RT_PRO_SET_SINGLE_TONE_TX			0xFF818043
+//========================================================================
+
+
+// by Owen for RTL8185 Phy Status Report Utility
+#define OID_RT_UTILITY_FALSE_ALARM_COUNTERS				0xFF818580
+#define OID_RT_UTILITY_SELECT_DEBUG_MODE				0xFF818581
+#define OID_RT_UTILITY_SELECT_SUBCARRIER_NUMBER				0xFF818582
+#define OID_RT_UTILITY_GET_RSSI_STATUS					0xFF818583
+#define OID_RT_UTILITY_GET_FRAME_DETECTION_STATUS			0xFF818584
+#define OID_RT_UTILITY_GET_AGC_AND_FREQUENCY_OFFSET_ESTIMATION_STATUS	0xFF818585
+#define OID_RT_UTILITY_GET_CHANNEL_ESTIMATION_STATUS			0xFF818586
+//
+
+// by Owen on 03/09/19-03/09/22 for RTL8185
+#define OID_RT_WIRELESS_MODE				0xFF818500
+#define OID_RT_SUPPORTED_RATES				0xFF818501
+#define OID_RT_DESIRED_RATES				0xFF818502
+#define OID_RT_WIRELESS_MODE_STARTING_ADHOC		0xFF818503
+//
+
+#define OID_RT_GET_CONNECT_STATE                	0xFF030001
+#define OID_RT_RESCAN	                        	0xFF030002
+#define OID_RT_SET_KEY_LENGTH				0xFF030003
+#define OID_RT_SET_DEFAULT_KEY_ID			0xFF030004
+
+#define OID_RT_SET_CHANNEL				0xFF010182
+#define OID_RT_SET_SNIFFER_MODE                 	0xFF010183
+#define OID_RT_GET_SIGNAL_QUALITY               	0xFF010184
+#define OID_RT_GET_SMALL_PACKET_CRC			0xFF010185		
+#define OID_RT_GET_MIDDLE_PACKET_CRC			0xFF010186
+#define OID_RT_GET_LARGE_PACKET_CRC			0xFF010187
+#define OID_RT_GET_TX_RETRY				0xFF010188
+#define OID_RT_GET_RX_RETRY				0xFF010189
+#define OID_RT_PRO_SET_FW_DIG_STATE			0xFF01018A//S
+#define OID_RT_PRO_SET_FW_RA_STATE			0xFF01018B//S
+
+#define OID_RT_GET_RX_TOTAL_PACKET			0xFF010190
+#define OID_RT_GET_TX_BEACON_OK				0xFF010191
+#define OID_RT_GET_TX_BEACON_ERR			0xFF010192
+#define OID_RT_GET_RX_ICV_ERR				0xFF010193
+#define OID_RT_SET_ENCRYPTION_ALGORITHM			0xFF010194
+#define OID_RT_SET_NO_AUTO_RESCAN			0xFF010195
+#define OID_RT_GET_PREAMBLE_MODE			0xFF010196
+#define OID_RT_GET_DRIVER_UP_DELTA_TIME			0xFF010197
+#define OID_RT_GET_AP_IP				0xFF010198
+#define OID_RT_GET_CHANNELPLAN				0xFF010199
+#define OID_RT_SET_PREAMBLE_MODE			0xFF01019A
+#define OID_RT_SET_BCN_INTVL				0xFF01019B
+#define OID_RT_GET_RF_VENDER				0xFF01019C
+#define OID_RT_DEDICATE_PROBE				0xFF01019D
+#define OID_RT_PRO_RX_FILTER_PATTERN			0xFF01019E
+
+#define OID_RT_GET_DCST_CURRENT_THRESHOLD		0xFF01019F
+
+#define OID_RT_GET_CCA_ERR				0xFF0101A0
+#define OID_RT_GET_CCA_UPGRADE_THRESHOLD		0xFF0101A1
+#define OID_RT_GET_CCA_FALLBACK_THRESHOLD		0xFF0101A2
+
+#define OID_RT_GET_CCA_UPGRADE_EVALUATE_TIMES		0xFF0101A3
+#define OID_RT_GET_CCA_FALLBACK_EVALUATE_TIMES		0xFF0101A4
+
+// by Owen on 03/31/03 for Cameo's request
+#define OID_RT_SET_RATE_ADAPTIVE			0xFF0101A5
+//
+#define OID_RT_GET_DCST_EVALUATE_PERIOD			0xFF0101A5
+#define OID_RT_GET_DCST_TIME_UNIT_INDEX			0xFF0101A6
+#define OID_RT_GET_TOTAL_TX_BYTES			0xFF0101A7
+#define OID_RT_GET_TOTAL_RX_BYTES			0xFF0101A8
+#define OID_RT_CURRENT_TX_POWER_LEVEL			0xFF0101A9
+#define OID_RT_GET_ENC_KEY_MISMATCH_COUNT		0xFF0101AA
+#define OID_RT_GET_ENC_KEY_MATCH_COUNT			0xFF0101AB
+#define OID_RT_GET_CHANNEL				0xFF0101AC
+
+#define OID_RT_SET_CHANNELPLAN				0xFF0101AD
+#define OID_RT_GET_HARDWARE_RADIO_OFF			0xFF0101AE
+#define OID_RT_CHANNELPLAN_BY_COUNTRY			0xFF0101AF
+#define OID_RT_SCAN_AVAILABLE_BSSID			0xFF0101B0
+#define OID_RT_GET_HARDWARE_VERSION			0xFF0101B1
+#define OID_RT_GET_IS_ROAMING				0xFF0101B2
+#define OID_RT_GET_IS_PRIVACY				0xFF0101B3
+#define OID_RT_GET_KEY_MISMATCH				0xFF0101B4
+#define OID_RT_SET_RSSI_ROAM_TRAFFIC_TH			0xFF0101B5
+#define OID_RT_SET_RSSI_ROAM_SIGNAL_TH			0xFF0101B6
+#define OID_RT_RESET_LOG				0xFF0101B7
+#define OID_RT_GET_LOG					0xFF0101B8
+#define OID_RT_SET_INDICATE_HIDDEN_AP			0xFF0101B9
+#define OID_RT_GET_HEADER_FAIL				0xFF0101BA
+#define OID_RT_SUPPORTED_WIRELESS_MODE			0xFF0101BB
+#define OID_RT_GET_CHANNEL_LIST				0xFF0101BC
+#define OID_RT_GET_SCAN_IN_PROGRESS			0xFF0101BD
+#define OID_RT_GET_TX_INFO				0xFF0101BE
+#define OID_RT_RF_READ_WRITE_OFFSET			0xFF0101BF
+#define OID_RT_RF_READ_WRITE				0xFF0101C0
+
+// For Netgear request. 2005.01.13, by rcnjko.
+#define OID_RT_FORCED_DATA_RATE				0xFF0101C1
+#define OID_RT_WIRELESS_MODE_FOR_SCAN_LIST		0xFF0101C2
+// For Netgear request. 2005.02.17, by rcnjko.
+#define OID_RT_GET_BSS_WIRELESS_MODE			0xFF0101C3
+// For AZ project. 2005.06.27, by rcnjko.
+#define OID_RT_SCAN_WITH_MAGIC_PACKET			0xFF0101C4
+
+// Vincent 8185MP
+#define OID_RT_PRO_RX_FILTER				0xFF0111C0
+
+//Andy TEST
+//#define OID_RT_PRO_WRITE_REGISTRY			0xFF0111C1
+//#define OID_RT_PRO_READ_REGISTRY			0xFF0111C2
+#define OID_CE_USB_WRITE_REGISTRY			0xFF0111C1
+#define OID_CE_USB_READ_REGISTRY			0xFF0111C2
+
+
+#define OID_RT_PRO_SET_INITIAL_GAIN			0xFF0111C3
+#define OID_RT_PRO_SET_BB_RF_STANDBY_MODE		0xFF0111C4
+#define OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE		0xFF0111C5
+#define OID_RT_PRO_SET_TX_CHARGE_PUMP			0xFF0111C6
+#define OID_RT_PRO_SET_RX_CHARGE_PUMP			0xFF0111C7
+#define OID_RT_PRO_RF_WRITE_REGISTRY			0xFF0111C8
+#define OID_RT_PRO_RF_READ_REGISTRY			0xFF0111C9
+#define OID_RT_PRO_QUERY_RF_TYPE			0xFF0111CA
+
+// AP OID
+#define OID_RT_AP_GET_ASSOCIATED_STATION_LIST		0xFF010300
+#define OID_RT_AP_GET_CURRENT_TIME_STAMP		0xFF010301
+#define OID_RT_AP_SWITCH_INTO_AP_MODE			0xFF010302
+#define OID_RT_AP_SET_DTIM_PERIOD			0xFF010303
+#define OID_RT_AP_SUPPORTED				0xFF010304	// Determine if driver supports AP mode. 2004.08.27, by rcnjko.
+#define OID_RT_AP_SET_PASSPHRASE			0xFF010305	// Set WPA-PSK passphrase into authenticator. 2005.07.08, byrcnjko.
+
+// 8187MP. 2004.09.06, by rcnjko.
+#define OID_RT_PRO8187_WI_POLL				0xFF818780
+#define OID_RT_PRO_WRITE_BB_REG				0xFF818781
+#define OID_RT_PRO_READ_BB_REG				0xFF818782
+#define OID_RT_PRO_WRITE_RF_REG				0xFF818783
+#define OID_RT_PRO_READ_RF_REG				0xFF818784
+
+// Meeting House. added by Annie, 2005-07-20.
+#define OID_RT_MH_VENDER_ID				0xFFEDC100
+
+//8711 MP OID added 20051230.
+#define OID_RT_PRO8711_JOIN_BSS				0xFF871100//S
+
+#define OID_RT_PRO_READ_REGISTER			0xFF871101 //Q
+#define OID_RT_PRO_WRITE_REGISTER			0xFF871102 //S
+
+#define OID_RT_PRO_BURST_READ_REGISTER			0xFF871103 //Q		
+#define OID_RT_PRO_BURST_WRITE_REGISTER 		0xFF871104 //S
+
+#define OID_RT_PRO_WRITE_TXCMD				0xFF871105 //S
+
+#define OID_RT_PRO_READ16_EEPROM			0xFF871106 //Q
+#define OID_RT_PRO_WRITE16_EEPROM			0xFF871107 //S
+
+#define OID_RT_PRO_H2C_SET_COMMAND			0xFF871108 //S
+#define OID_RT_PRO_H2C_QUERY_RESULT			0xFF871109 //Q
+
+#define OID_RT_PRO8711_WI_POLL				0xFF87110A //Q
+#define OID_RT_PRO8711_PKT_LOSS				0xFF87110B //Q
+#define OID_RT_RD_ATTRIB_MEM				0xFF87110C//Q
+#define OID_RT_WR_ATTRIB_MEM				0xFF87110D//S
+
+
+//Method 2 for H2C/C2H
+#define OID_RT_PRO_H2C_CMD_MODE				0xFF871110 //S
+#define OID_RT_PRO_H2C_CMD_RSP_MODE			0xFF871111 //Q
+#define OID_RT_PRO_H2C_CMD_EVENT_MODE			0xFF871112 //S
+#define OID_RT_PRO_WAIT_C2H_EVENT			0xFF871113 //Q
+#define OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST		0xFF871114//Q
+
+#define OID_RT_PRO_SCSI_ACCESS_TEST			0xFF871115 //Q, S
+
+#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT		0xFF871116 //S
+#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN			0xFF871117 //Q,S
+#define OID_RT_RRO_RX_PKT_VIA_IOCTRL			0xFF871118 //Q
+#define OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL		0xFF871119 //Q
+
+#define OID_RT_RPO_SET_PWRMGT_TEST			0xFF87111A //S
+#define OID_RT_PRO_QRY_PWRMGT_TEST			0XFF87111B //Q
+#define OID_RT_RPO_ASYNC_RWIO_TEST			0xFF87111C //S
+#define OID_RT_RPO_ASYNC_RWIO_POLL			0xFF87111D //Q
+#define OID_RT_PRO_SET_RF_INTFS				0xFF87111E //S
+#define OID_RT_POLL_RX_STATUS				0xFF87111F //Q
+
+#define OID_RT_PRO_CFG_DEBUG_MESSAGE			0xFF871120 //Q,S
+#define OID_RT_PRO_SET_DATA_RATE_EX			0xFF871121//S
+#define OID_RT_PRO_SET_BASIC_RATE			0xFF871122//S
+#define OID_RT_PRO_READ_TSSI				0xFF871123//S
+#define OID_RT_PRO_SET_POWER_TRACKING			0xFF871124//S
+
+ 
+#define OID_RT_PRO_QRY_PWRSTATE				0xFF871150 //Q
+#define OID_RT_PRO_SET_PWRSTATE				0xFF871151 //S 
+
+//Method 2 , using workitem
+#define OID_RT_SET_READ_REG				0xFF871181 //S
+#define OID_RT_SET_WRITE_REG				0xFF871182 //S
+#define OID_RT_SET_BURST_READ_REG			0xFF871183 //S
+#define OID_RT_SET_BURST_WRITE_REG			0xFF871184 //S
+#define OID_RT_SET_WRITE_TXCMD				0xFF871185 //S
+#define OID_RT_SET_READ16_EEPROM			0xFF871186 //S
+#define OID_RT_SET_WRITE16_EEPROM			0xFF871187 //S
+#define OID_RT_QRY_POLL_WKITEM				0xFF871188 //Q
+
+//For SDIO INTERFACE only
+#define OID_RT_PRO_SYNCPAGERW_SRAM			0xFF8711A0 //Q, S
+#define OID_RT_PRO_871X_DRV_EXT 			0xFF8711A1
+
+//For USB INTERFACE only
+#define OID_RT_PRO_USB_VENDOR_REQ			0xFF8711B0 //Q, S
+#define OID_RT_PRO_SCSI_AUTO_TEST			0xFF8711B1 //S
+#define OID_RT_PRO_USB_MAC_AC_FIFO_WRITE		0xFF8711B2 //S
+#define OID_RT_PRO_USB_MAC_RX_FIFO_READ			0xFF8711B3 //Q
+#define OID_RT_PRO_USB_MAC_RX_FIFO_POLLING		0xFF8711B4 //Q
+
+#define OID_RT_PRO_H2C_SET_RATE_TABLE			0xFF8711FB //S
+#define OID_RT_PRO_H2C_GET_RATE_TABLE			0xFF8711FC //S
+#define OID_RT_PRO_H2C_C2H_LBK_TEST			0xFF8711FE
+
+#define OID_RT_PRO_ENCRYPTION_CTRL			0xFF871200 //Q, S
+#define OID_RT_PRO_ADD_STA_INFO				0xFF871201 //S
+#define OID_RT_PRO_DELE_STA_INFO    			0xFF871202 //S
+#define OID_RT_PRO_QUERY_DR_VARIABLE   			0xFF871203 //Q
+
+#define OID_RT_PRO_RX_PACKET_TYPE			0xFF871204 //Q, S
+
+#define OID_RT_PRO_READ_EFUSE				0xFF871205 //Q
+#define OID_RT_PRO_WRITE_EFUSE				0xFF871206 //S
+#define OID_RT_PRO_RW_EFUSE_PGPKT			0xFF871207 //Q, S
+#define OID_RT_GET_EFUSE_CURRENT_SIZE			0xFF871208 //Q
+
+#define OID_RT_SET_BANDWIDTH				0xFF871209 //S
+#define OID_RT_SET_CRYSTAL_CAP				0xFF87120A //S
+
+#define OID_RT_SET_RX_PACKET_TYPE    			0xFF87120B //S
+
+#define OID_RT_GET_EFUSE_MAX_SIZE			0xFF87120C //Q
+
+#define OID_RT_PRO_SET_TX_AGC_OFFSET			0xFF87120D //S
+
+#define OID_RT_PRO_SET_PKT_TEST_MODE			0xFF87120E //S
+
+#define OID_RT_PRO_FOR_EVM_TEST_SETTING			0xFF87120F //S
+
+#define OID_RT_PRO_GET_THERMAL_METER			0xFF871210 //Q
+
+#define OID_RT_RESET_PHY_RX_PACKET_COUNT		0xFF871211 //S
+#define OID_RT_GET_PHY_RX_PACKET_RECEIVED		0xFF871212 //Q
+#define OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR		0xFF871213 //Q
+
+#define OID_RT_SET_POWER_DOWN				0xFF871214 //S
+
+#define OID_RT_GET_POWER_MODE				0xFF871215 //Q
+
+#define OID_RT_PRO_EFUSE				0xFF871216 //Q, S
+#define OID_RT_PRO_EFUSE_MAP				0xFF871217 //Q, S
+
+#endif //#ifndef	__CUSTOM_OID_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h b/drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h
new file mode 100755
index 0000000000000..18e7b2c096715
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h
@@ -0,0 +1,47 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/	
+
+
+#ifndef __NIC_SPEC_H__
+#define __NIC_SPEC_H__
+
+#include <drv_conf.h>
+
+#define RTL8711_MCTRL_		(0x20000)
+#define RTL8711_UART_		(0x30000)
+#define RTL8711_TIMER_		(0x40000)
+#define RTL8711_FINT_		(0x50000)
+#define RTL8711_HINT_		(0x50000)
+#define RTL8711_GPIO_		(0x60000)
+#define RTL8711_WLANCTRL_	(0x200000)
+#define RTL8711_WLANFF_		(0xe00000)
+#define RTL8711_HCICTRL_	(0x600000)
+#define RTL8711_SYSCFG_		(0x620000)
+#define RTL8711_SYSCTRL_	(0x620000)
+#define RTL8711_MCCTRL_		(0x020000)
+
+
+#include <rtl8711_regdef.h>
+
+#include <rtl8711_bitdef.h>
+
+
+#endif // __RTL8711_SPEC_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h
new file mode 100755
index 0000000000000..e374077fdb342
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h
@@ -0,0 +1,171 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __OSDEP_CE_SERVICE_H_
+#define __OSDEP_CE_SERVICE_H_
+
+
+#include <ndis.h>
+#include <ntddndis.h>
+
+#ifdef CONFIG_SDIO_HCI
+#include "SDCardDDK.h"
+#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usbdi.h>
+#endif
+
+typedef HANDLE 	_sema;
+typedef	LIST_ENTRY	_list;
+typedef NDIS_STATUS _OS_STATUS;
+
+typedef NDIS_SPIN_LOCK	_lock;
+
+typedef HANDLE 		_rwlock; //Mutex
+
+typedef u32	_irqL;
+
+typedef NDIS_HANDLE  _nic_hdl;
+
+
+typedef NDIS_MINIPORT_TIMER    _timer;
+
+struct	__queue	{
+	LIST_ENTRY	queue;
+	_lock	lock;
+};
+
+typedef	NDIS_PACKET	_pkt;
+typedef NDIS_BUFFER	_buffer;
+typedef struct	__queue	_queue;
+
+typedef HANDLE 	_thread_hdl_;
+typedef DWORD thread_return;
+typedef void*	thread_context;
+typedef NDIS_WORK_ITEM _workitem;
+
+#define thread_exit() ExitThread(STATUS_SUCCESS); return 0;
+
+
+#define SEMA_UPBND	(0x7FFFFFFF)   //8192
+
+__inline static _list *get_prev(_list	*list)
+{
+	return list->Blink;
+}
+	
+__inline static _list *get_next(_list	*list)
+{
+	return list->Flink;
+}
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+#define LIST_CONTAINOR(ptr, type, member) CONTAINING_RECORD(ptr, type, member)
+
+__inline static void _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisAcquireSpinLock(plock);
+}
+
+__inline static void _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisReleaseSpinLock(plock);
+}
+
+__inline static _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprAcquireSpinLock(plock);	
+}
+
+__inline static _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprReleaseSpinLock(plock);	
+}
+
+
+__inline static void _enter_hwio_critical(_rwlock *prwlock, _irqL *pirqL)
+{
+	WaitForSingleObject(*prwlock, INFINITE );
+
+}
+
+__inline static void _exit_hwio_critical(_rwlock *prwlock, _irqL *pirqL)
+{
+	ReleaseMutex(*prwlock);
+}
+
+__inline static void rtw_list_delete(_list *plist)
+{
+	RemoveEntryList(plist);
+	InitializeListHead(plist);
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl nic_hdl,void *pfunc,PVOID cntx)
+{
+	NdisMInitializeTimer(ptimer, nic_hdl, pfunc, cntx);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{
+ 	NdisMSetTimer(ptimer,delay_time);
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	NdisMCancelTimer(ptimer,bcancelled);
+}
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+
+	NdisInitializeWorkItem(pwork, pfunc, cntx);
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	NdisScheduleWorkItem(pwork);
+}
+
+#define ATOMIC_INIT(i)  { (i) }
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    while (NdisInterlockedIncrement((PULONG)&(_MutexCounter)) != 1)\
+    {                                                           \
+        NdisInterlockedDecrement((PULONG)&(_MutexCounter));        \
+        NdisMSleep(10000);                          \
+    }                                                           \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    NdisInterlockedDecrement((PULONG)&(_MutexCounter));              \
+}
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h
new file mode 100755
index 0000000000000..3cd165969f2f7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h
@@ -0,0 +1,155 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __OSDEP_INTF_H_
+#define __OSDEP_INTF_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+struct intf_priv {
+
+	u8 *intf_dev;
+	u32	max_iosz; 	//USB2.0: 128, USB1.1: 64, SDIO:64
+	u32	max_xmitsz; //USB2.0: unlimited, SDIO:512
+	u32	max_recvsz; //USB2.0: unlimited, SDIO:512
+
+	volatile u8 *io_rwmem;
+	volatile u8 *allocated_io_rwmem;
+	u32	io_wsz; //unit: 4bytes
+	u32	io_rsz;//unit: 4bytes
+	u8 intf_status;
+
+	void (*_bus_io)(u8 *priv);
+
+/*
+Under Sync. IRP (SDIO/USB)
+A protection mechanism is necessary for the io_rwmem(read/write protocol)
+
+Under Async. IRP (SDIO/USB)
+The protection mechanism is through the pending queue.
+*/
+
+	_mutex ioctl_mutex;
+
+
+#ifdef PLATFORM_LINUX
+	#ifdef CONFIG_USB_HCI
+	// when in USB, IO is through interrupt in/out endpoints
+	struct usb_device 	*udev;
+	PURB	piorw_urb;
+	u8 io_irp_cnt;
+	u8 bio_irp_pending;
+	_sema io_retevt;
+	_timer	io_timer;
+	u8 bio_irp_timeout;
+	u8 bio_timer_cancel;
+	#endif
+#endif
+
+#ifdef PLATFORM_OS_XP
+	#ifdef CONFIG_SDIO_HCI
+		// below is for io_rwmem...
+		PMDL pmdl;
+		PSDBUS_REQUEST_PACKET  sdrp;
+		PSDBUS_REQUEST_PACKET  recv_sdrp;
+		PSDBUS_REQUEST_PACKET  xmit_sdrp;
+
+			PIRP		piorw_irp;
+
+	#endif
+	#ifdef CONFIG_USB_HCI
+		PURB	piorw_urb;
+		PIRP		piorw_irp;
+		u8 io_irp_cnt;
+		u8 bio_irp_pending;
+		_sema io_retevt;
+	#endif
+#endif
+
+};
+
+
+#ifdef CONFIG_R871X_TEST
+int rtw_start_pseudo_adhoc(_adapter *padapter);
+int rtw_stop_pseudo_adhoc(_adapter *padapter);
+#endif
+
+struct dvobj_priv *devobj_init(void);
+void devobj_deinit(struct dvobj_priv *pdvobj);
+
+u8 rtw_init_drv_sw(_adapter *padapter);
+u8 rtw_free_drv_sw(_adapter *padapter);
+u8 rtw_reset_drv_sw(_adapter *padapter);
+
+u32 rtw_start_drv_threads(_adapter *padapter);
+void rtw_stop_drv_threads (_adapter *padapter);
+void rtw_cancel_all_timer(_adapter *padapter);
+
+#ifdef PLATFORM_LINUX
+int rtw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+
+int rtw_init_netdev_name(struct net_device *pnetdev, const char *ifname);
+struct net_device *rtw_init_netdev(_adapter *padapter);
+void rtw_unregister_netdevs(struct dvobj_priv *dvobj);
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+u16 rtw_recv_select_queue(struct sk_buff *skb);
+#endif //LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35)
+
+#ifdef CONFIG_PROC_DEBUG
+void rtw_proc_init_one(struct net_device *dev);
+void rtw_proc_remove_one(struct net_device *dev);
+#else //!CONFIG_PROC_DEBUG
+static void rtw_proc_init_one(struct net_device *dev){}
+static void rtw_proc_remove_one(struct net_device *dev){}
+#endif //!CONFIG_PROC_DEBUG
+#endif //PLATFORM_LINUX
+
+
+#ifdef PLATFORM_FREEBSD
+extern int rtw_ioctl(struct ifnet * ifp, u_long cmd, caddr_t data);
+#endif
+
+void rtw_ips_dev_unload(_adapter *padapter);
+#ifdef CONFIG_IPS
+int rtw_ips_pwr_up(_adapter *padapter);
+void rtw_ips_pwr_down(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+struct _io_ops;
+_adapter *rtw_drv_if2_init(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops));
+void rtw_drv_if2_free(_adapter *if2);
+void rtw_drv_if2_stop(_adapter *if2);
+#ifdef CONFIG_MULTI_VIR_IFACES
+struct dvobj_priv;
+_adapter *rtw_drv_add_vir_if(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops));
+void rtw_drv_stop_vir_ifaces(struct dvobj_priv *dvobj);
+void rtw_drv_free_vir_ifaces(struct dvobj_priv *dvobj);
+#endif //CONFIG_MULTI_VIR_IFACES
+#endif
+
+int rtw_drv_register_netdev(_adapter *padapter);
+void rtw_ndev_destructor(_nic_hdl ndev);
+
+#endif	//_OSDEP_INTF_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h
new file mode 100755
index 0000000000000..a6dcdff1d1b73
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h
@@ -0,0 +1,1821 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __OSDEP_SERVICE_H_
+#define __OSDEP_SERVICE_H_
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
+#include <linux/sched/signal.h>
+#endif
+#include <drv_conf.h>
+#include <basic_types.h>
+//#include <rtl871x_byteorder.h>
+
+#define _FAIL		0
+#define _SUCCESS	1
+#define RTW_RX_HANDLED 2
+//#define RTW_STATUS_TIMEDOUT -110
+
+#undef _TRUE
+#define _TRUE		1
+
+#undef _FALSE
+#define _FALSE		0
+	
+
+#ifdef PLATFORM_FREEBSD
+#include <sys/cdefs.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/param.h>
+#include <sys/sockio.h>
+#include <sys/sysctl.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/mbuf.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/module.h>
+#include <sys/bus.h>
+#include <sys/endian.h>
+#include <sys/kdb.h>
+#include <sys/kthread.h>
+#include <machine/atomic.h>
+
+#include <machine/bus.h>
+#include <machine/resource.h>
+#include <sys/rman.h>
+
+#include <net/bpf.h>
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_types.h>
+#include <net/route.h>
+
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/if_ether.h>
+
+#include <net80211/ieee80211_var.h>
+#include <net80211/ieee80211_regdomain.h>
+#include <net80211/ieee80211_radiotap.h>
+#include <net80211/ieee80211_ratectl.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+#include "usbdevs.h"
+
+#define	USB_DEBUG_VAR rum_debug
+#include <dev/usb/usb_debug.h>
+
+#if 1 //Baron porting from linux, it's all temp solution, needs to check again
+#include <sys/sema.h>
+#include <sys/pcpu.h> /* XXX for PCPU_GET */
+//	typedef struct 	semaphore _sema;
+	typedef struct 	sema _sema;
+//	typedef	spinlock_t	_lock;
+	typedef	struct mtx	_lock;
+	typedef struct mtx 		_mutex;
+	typedef struct timer_list _timer;
+	struct list_head {
+	struct list_head *next, *prev;
+	};
+	struct	__queue	{
+		struct	list_head	queue;	
+		_lock	lock;
+	};
+
+	//typedef	struct sk_buff	_pkt;
+	typedef	struct mbuf	_pkt;
+	typedef struct mbuf	_buffer;
+	
+	typedef struct	__queue	_queue;
+	typedef struct	list_head	_list;
+	typedef	int	_OS_STATUS;
+	//typedef u32	_irqL;
+	typedef unsigned long _irqL;
+	typedef	struct	ifnet * _nic_hdl;
+	
+	typedef pid_t		_thread_hdl_;
+//	typedef struct thread		_thread_hdl_;
+	typedef void		thread_return;
+	typedef void*	thread_context;
+
+	//#define thread_exit() complete_and_exit(NULL, 0)
+
+	typedef void timer_hdl_return;
+	typedef void* timer_hdl_context;
+	typedef struct work_struct _workitem;
+
+#define   KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
+/* emulate a modern version */
+#define LINUX_VERSION_CODE KERNEL_VERSION(2, 6, 35)
+
+#define WIRELESS_EXT -1
+#define HZ hz
+#define spin_lock_irqsave mtx_lock_irqsave
+#define spin_lock_bh mtx_lock_irqsave
+#define mtx_lock_irqsave(lock, x) mtx_lock(lock)//{local_irq_save((x)); mtx_lock_spin((lock));}
+//#define IFT_RTW	0xf9 //ifnet allocate type for RTW
+#define free_netdev if_free
+#define LIST_CONTAINOR(ptr, type, member) \
+        ((type *)((char *)(ptr)-(SIZE_T)(&((type *)0)->member)))
+#define container_of(p,t,n) (t*)((p)-&(((t*)0)->n))
+/* 
+ * Linux timers are emulated using FreeBSD callout functions
+ * (and taskqueue functionality).
+ *
+ * Currently no timer stats functionality.
+ *
+ * See (linux_compat) processes.c
+ *
+ */
+struct timer_list {
+
+        /* FreeBSD callout related fields */
+        struct callout callout;
+
+ 	//timeout function
+        void (*function)(void*);
+	//argument
+	 void *arg;
+        
+};
+struct workqueue_struct;
+struct work_struct;
+typedef void (*work_func_t)(struct work_struct *work);
+/* Values for the state of an item of work (work_struct) */
+typedef enum work_state {
+        WORK_STATE_UNSET = 0,
+        WORK_STATE_CALLOUT_PENDING = 1,
+        WORK_STATE_TASK_PENDING = 2,
+        WORK_STATE_WORK_CANCELLED = 3        
+} work_state_t;
+
+struct work_struct {
+        struct task task; /* FreeBSD task */
+        work_state_t state; /* the pending or otherwise state of work. */
+        work_func_t func;       
+};
+#define spin_unlock_irqrestore mtx_unlock_irqrestore
+#define spin_unlock_bh mtx_unlock_irqrestore
+#define mtx_unlock_irqrestore(lock,x)    mtx_unlock(lock);
+extern void	_rtw_spinlock_init(_lock *plock);
+
+//modify private structure to match freebsd
+#define BITS_PER_LONG 32
+union ktime {
+	s64	tv64;
+#if BITS_PER_LONG != 64 && !defined(CONFIG_KTIME_SCALAR)
+	struct {
+#ifdef __BIG_ENDIAN
+	s32	sec, nsec;
+#else
+	s32	nsec, sec;
+#endif
+	} tv;
+#endif
+};
+#define kmemcheck_bitfield_begin(name)
+#define kmemcheck_bitfield_end(name)
+#define CHECKSUM_NONE 0
+typedef unsigned char *sk_buff_data_t;
+typedef union ktime ktime_t;		/* Kill this */
+
+void rtw_mtx_lock(_lock *plock);
+	
+void rtw_mtx_unlock(_lock *plock);
+
+/** 
+ *	struct sk_buff - socket buffer
+ *	@next: Next buffer in list
+ *	@prev: Previous buffer in list
+ *	@sk: Socket we are owned by
+ *	@tstamp: Time we arrived
+ *	@dev: Device we arrived on/are leaving by
+ *	@transport_header: Transport layer header
+ *	@network_header: Network layer header
+ *	@mac_header: Link layer header
+ *	@_skb_refdst: destination entry (with norefcount bit)
+ *	@sp: the security path, used for xfrm
+ *	@cb: Control buffer. Free for use by every layer. Put private vars here
+ *	@len: Length of actual data
+ *	@data_len: Data length
+ *	@mac_len: Length of link layer header
+ *	@hdr_len: writable header length of cloned skb
+ *	@csum: Checksum (must include start/offset pair)
+ *	@csum_start: Offset from skb->head where checksumming should start
+ *	@csum_offset: Offset from csum_start where checksum should be stored
+ *	@local_df: allow local fragmentation
+ *	@cloned: Head may be cloned (check refcnt to be sure)
+ *	@nohdr: Payload reference only, must not modify header
+ *	@pkt_type: Packet class
+ *	@fclone: skbuff clone status
+ *	@ip_summed: Driver fed us an IP checksum
+ *	@priority: Packet queueing priority
+ *	@users: User count - see {datagram,tcp}.c
+ *	@protocol: Packet protocol from driver
+ *	@truesize: Buffer size 
+ *	@head: Head of buffer
+ *	@data: Data head pointer
+ *	@tail: Tail pointer
+ *	@end: End pointer
+ *	@destructor: Destruct function
+ *	@mark: Generic packet mark
+ *	@nfct: Associated connection, if any
+ *	@ipvs_property: skbuff is owned by ipvs
+ *	@peeked: this packet has been seen already, so stats have been
+ *		done for it, don't do them again
+ *	@nf_trace: netfilter packet trace flag
+ *	@nfctinfo: Relationship of this skb to the connection
+ *	@nfct_reasm: netfilter conntrack re-assembly pointer
+ *	@nf_bridge: Saved data about a bridged frame - see br_netfilter.c
+ *	@skb_iif: ifindex of device we arrived on
+ *	@rxhash: the packet hash computed on receive
+ *	@queue_mapping: Queue mapping for multiqueue devices
+ *	@tc_index: Traffic control index
+ *	@tc_verd: traffic control verdict
+ *	@ndisc_nodetype: router type (from link layer)
+ *	@dma_cookie: a cookie to one of several possible DMA operations
+ *		done by skb DMA functions
+ *	@secmark: security marking
+ *	@vlan_tci: vlan tag control information
+ */
+
+struct sk_buff {
+	/* These two members must be first. */
+	struct sk_buff		*next;
+	struct sk_buff		*prev;
+
+	ktime_t			tstamp;
+
+	struct sock		*sk;
+	//struct net_device	*dev;
+	struct ifnet *dev;
+
+	/*
+	 * This is the control buffer. It is free to use for every
+	 * layer. Please put your private variables there. If you
+	 * want to keep them across layers you have to do a skb_clone()
+	 * first. This is owned by whoever has the skb queued ATM.
+	 */
+	char			cb[48] __aligned(8);
+
+	unsigned long		_skb_refdst;
+#ifdef CONFIG_XFRM
+	struct	sec_path	*sp;
+#endif
+	unsigned int		len,
+				data_len;
+	u16			mac_len,
+				hdr_len;
+	union {
+		u32		csum;
+		struct {
+			u16	csum_start;
+			u16	csum_offset;
+		}smbol2;
+	}smbol1;
+	u32			priority;
+	kmemcheck_bitfield_begin(flags1);
+	u8			local_df:1,
+				cloned:1,
+				ip_summed:2,
+				nohdr:1,
+				nfctinfo:3;
+	u8			pkt_type:3,
+				fclone:2,
+				ipvs_property:1,
+				peeked:1,
+				nf_trace:1;
+	kmemcheck_bitfield_end(flags1);
+	u16			protocol;
+
+	void			(*destructor)(struct sk_buff *skb);
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+	struct nf_conntrack	*nfct;
+	struct sk_buff		*nfct_reasm;
+#endif
+#ifdef CONFIG_BRIDGE_NETFILTER
+	struct nf_bridge_info	*nf_bridge;
+#endif
+
+	int			skb_iif;
+#ifdef CONFIG_NET_SCHED
+	u16			tc_index;	/* traffic control index */
+#ifdef CONFIG_NET_CLS_ACT
+	u16			tc_verd;	/* traffic control verdict */
+#endif
+#endif
+
+	u32			rxhash;
+
+	kmemcheck_bitfield_begin(flags2);
+	u16			queue_mapping:16;
+#ifdef CONFIG_IPV6_NDISC_NODETYPE
+	u8			ndisc_nodetype:2,
+				deliver_no_wcard:1;
+#else
+	u8			deliver_no_wcard:1;
+#endif
+	kmemcheck_bitfield_end(flags2);
+
+	/* 0/14 bit hole */
+
+#ifdef CONFIG_NET_DMA
+	dma_cookie_t		dma_cookie;
+#endif
+#ifdef CONFIG_NETWORK_SECMARK
+	u32			secmark;
+#endif
+	union {
+		u32		mark;
+		u32		dropcount;
+	}symbol3;
+
+	u16			vlan_tci;
+
+	sk_buff_data_t		transport_header;
+	sk_buff_data_t		network_header;
+	sk_buff_data_t		mac_header;
+	/* These elements must be at the end, see alloc_skb() for details.  */
+	sk_buff_data_t		tail;
+	sk_buff_data_t		end;
+	unsigned char		*head,
+				*data;
+	unsigned int		truesize;
+	atomic_t		users;
+};
+struct sk_buff_head {
+	/* These two members must be first. */
+	struct sk_buff	*next;
+	struct sk_buff	*prev;
+
+	u32		qlen;
+	_lock	lock;
+};
+#define skb_tail_pointer(skb)	skb->tail
+static inline unsigned char *skb_put(struct sk_buff *skb, unsigned int len)
+{
+	unsigned char *tmp = skb_tail_pointer(skb);
+	//SKB_LINEAR_ASSERT(skb);
+	skb->tail += len;
+	skb->len  += len;
+	return tmp;
+}
+
+static inline unsigned char *__skb_pull(struct sk_buff *skb, unsigned int len)
+{
+	skb->len -= len;
+	if(skb->len < skb->data_len)
+		printf("%s(),%d,error!\n",__FUNCTION__,__LINE__);
+	return skb->data += len;
+}
+static inline unsigned char *skb_pull(struct sk_buff *skb, unsigned int len)
+{
+	#ifdef PLATFORM_FREEBSD
+	return __skb_pull(skb, len);
+	#else
+	return unlikely(len > skb->len) ? NULL : __skb_pull(skb, len);
+	#endif //PLATFORM_FREEBSD
+}
+static inline u32 skb_queue_len(const struct sk_buff_head *list_)
+{
+	return list_->qlen;
+}
+static inline void __skb_insert(struct sk_buff *newsk,
+				struct sk_buff *prev, struct sk_buff *next,
+				struct sk_buff_head *list)
+{
+	newsk->next = next;
+	newsk->prev = prev;
+	next->prev  = prev->next = newsk;
+	list->qlen++;
+}
+static inline void __skb_queue_before(struct sk_buff_head *list,
+				      struct sk_buff *next,
+				      struct sk_buff *newsk)
+{
+	__skb_insert(newsk, next->prev, next, list);
+}
+static inline void skb_queue_tail(struct sk_buff_head *list,
+				   struct sk_buff *newsk)
+{
+	mtx_lock(&list->lock);
+	__skb_queue_before(list, (struct sk_buff *)list, newsk);
+	mtx_unlock(&list->lock);
+}
+static inline struct sk_buff *skb_peek(struct sk_buff_head *list_)
+{
+	struct sk_buff *list = ((struct sk_buff *)list_)->next;
+	if (list == (struct sk_buff *)list_)
+		list = NULL;
+	return list;
+}
+static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+{
+	struct sk_buff *next, *prev;
+
+	list->qlen--;
+	next	   = skb->next;
+	prev	   = skb->prev;
+	skb->next  = skb->prev = NULL;
+	next->prev = prev;
+	prev->next = next;
+}
+
+static inline struct sk_buff *skb_dequeue(struct sk_buff_head *list)
+{
+	mtx_lock(&list->lock);
+
+	struct sk_buff *skb = skb_peek(list);
+	if (skb)
+		__skb_unlink(skb, list);
+
+	mtx_unlock(&list->lock);
+
+	return skb;
+}
+static inline void skb_reserve(struct sk_buff *skb, int len)
+{
+	skb->data += len;
+	skb->tail += len;
+}
+static inline void __skb_queue_head_init(struct sk_buff_head *list)
+{
+	list->prev = list->next = (struct sk_buff *)list;
+	list->qlen = 0;
+}
+/*
+ * This function creates a split out lock class for each invocation;
+ * this is needed for now since a whole lot of users of the skb-queue
+ * infrastructure in drivers have different locking usage (in hardirq)
+ * than the networking core (in softirq only). In the long run either the
+ * network layer or drivers should need annotation to consolidate the
+ * main types of usage into 3 classes.
+ */
+static inline void skb_queue_head_init(struct sk_buff_head *list)
+{
+	_rtw_spinlock_init(&list->lock);
+	__skb_queue_head_init(list);
+}
+unsigned long copy_from_user(void *to, const void *from, unsigned long n);
+unsigned long copy_to_user(void *to, const void *from, unsigned long n);
+struct sk_buff * dev_alloc_skb(unsigned int size);
+struct sk_buff *skb_clone(const struct sk_buff *skb);
+void dev_kfree_skb_any(struct sk_buff *skb);
+#endif //Baron porting from linux, it's all temp solution, needs to check again
+
+
+#if 1 // kenny add Linux compatibility code for Linux USB driver
+#include <dev/usb/usb_compat_linux.h>
+
+#define __init		// __attribute ((constructor))
+#define __exit		// __attribute ((destructor))
+
+/*
+ * Definitions for module_init and module_exit macros.
+ *
+ * These macros will use the SYSINIT framework to call a specified
+ * function (with no arguments) on module loading or unloading.
+ * 
+ */
+
+void module_init_exit_wrapper(void *arg);
+
+#define module_init(initfn)                             \
+        SYSINIT(mod_init_ ## initfn,                    \
+                SI_SUB_KLD, SI_ORDER_FIRST,             \
+                module_init_exit_wrapper, initfn)
+
+#define module_exit(exitfn)                             \
+        SYSUNINIT(mod_exit_ ## exitfn,                  \
+                  SI_SUB_KLD, SI_ORDER_ANY,             \
+                  module_init_exit_wrapper, exitfn)
+
+/*
+ * The usb_register and usb_deregister functions are used to register
+ * usb drivers with the usb subsystem. 
+ */
+int usb_register(struct usb_driver *driver);
+int usb_deregister(struct usb_driver *driver);
+
+/*
+ * usb_get_dev and usb_put_dev - increment/decrement the reference count 
+ * of the usb device structure.
+ *
+ * Original body of usb_get_dev:
+ *
+ *       if (dev)
+ *               get_device(&dev->dev);
+ *       return dev;
+ *
+ * Reference counts are not currently used in this compatibility
+ * layer. So these functions will do nothing.
+ */
+static inline struct usb_device *
+usb_get_dev(struct usb_device *dev)
+{
+        return dev;
+}
+
+static inline void 
+usb_put_dev(struct usb_device *dev)
+{
+        return;
+}
+
+
+// rtw_usb_compat_linux
+int rtw_usb_submit_urb(struct urb *urb, uint16_t mem_flags);
+int rtw_usb_unlink_urb(struct urb *urb);
+int rtw_usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe);
+int rtw_usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
+    uint8_t request, uint8_t requesttype,
+    uint16_t value, uint16_t index, void *data,
+    uint16_t size, usb_timeout_t timeout);
+int rtw_usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index);
+int rtw_usb_setup_endpoint(struct usb_device *dev,
+    struct usb_host_endpoint *uhe, usb_size_t bufsize);
+struct urb *rtw_usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags);
+struct usb_host_endpoint *rtw_usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep);
+struct usb_host_interface *rtw_usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index);
+struct usb_interface *rtw_usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no);
+void *rtw_usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint8_t *dma_addr);
+void *rtw_usbd_get_intfdata(struct usb_interface *intf);
+void rtw_usb_linux_register(void *arg);
+void rtw_usb_linux_deregister(void *arg);
+void rtw_usb_linux_free_device(struct usb_device *dev);
+void rtw_usb_buffer_free(struct usb_device *dev, usb_size_t size,
+    void *addr, uint8_t dma_addr);
+void rtw_usb_free_urb(struct urb *urb);
+void rtw_usb_init_urb(struct urb *urb);
+void rtw_usb_kill_urb(struct urb *urb);
+void rtw_usb_set_intfdata(struct usb_interface *intf, void *data);
+void rtw_usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
+    struct usb_host_endpoint *uhe, void *buf,
+    int length, usb_complete_t callback, void *arg);
+int rtw_usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
+    void *data, int len, uint16_t *pactlen, usb_timeout_t timeout);
+void *usb_get_intfdata(struct usb_interface *intf);
+int usb_linux_init_endpoints(struct usb_device *udev);
+
+
+
+typedef struct urb *  PURB;
+
+typedef unsigned gfp_t;
+#define __GFP_WAIT      ((gfp_t)0x10u)  /* Can wait and reschedule? */
+#define __GFP_HIGH      ((gfp_t)0x20u)  /* Should access emergency pools? */
+#define __GFP_IO        ((gfp_t)0x40u)  /* Can start physical IO? */
+#define __GFP_FS        ((gfp_t)0x80u)  /* Can call down to low-level FS? */
+#define __GFP_COLD      ((gfp_t)0x100u) /* Cache-cold page required */
+#define __GFP_NOWARN    ((gfp_t)0x200u) /* Suppress page allocation failure warning */
+#define __GFP_REPEAT    ((gfp_t)0x400u) /* Retry the allocation.  Might fail */
+#define __GFP_NOFAIL    ((gfp_t)0x800u) /* Retry for ever.  Cannot fail */
+#define __GFP_NORETRY   ((gfp_t)0x1000u)/* Do not retry.  Might fail */
+#define __GFP_NO_GROW   ((gfp_t)0x2000u)/* Slab internal usage */
+#define __GFP_COMP      ((gfp_t)0x4000u)/* Add compound page metadata */
+#define __GFP_ZERO      ((gfp_t)0x8000u)/* Return zeroed page on success */
+#define __GFP_NOMEMALLOC ((gfp_t)0x10000u) /* Don't use emergency reserves */
+#define __GFP_HARDWALL   ((gfp_t)0x20000u) /* Enforce hardwall cpuset memory allocs */
+
+/* This equals 0, but use constants in case they ever change */
+#define GFP_NOWAIT      (GFP_ATOMIC & ~__GFP_HIGH)
+/* GFP_ATOMIC means both !wait (__GFP_WAIT not set) and use emergency pool */
+#define GFP_ATOMIC      (__GFP_HIGH)
+#define GFP_NOIO        (__GFP_WAIT)
+#define GFP_NOFS        (__GFP_WAIT | __GFP_IO)
+#define GFP_KERNEL      (__GFP_WAIT | __GFP_IO | __GFP_FS)
+#define GFP_USER        (__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_HARDWALL)
+#define GFP_HIGHUSER    (__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_HARDWALL | \
+                         __GFP_HIGHMEM)
+
+
+#endif // kenny add Linux compatibility code for Linux USB
+
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+	#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+#endif
+
+__inline static _list *get_next(_list	*list)
+{
+	return list->next;
+}	
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+	
+#define LIST_CONTAINOR(ptr, type, member) \
+        ((type *)((char *)(ptr)-(SIZE_T)(&((type *)0)->member)))	
+
+        
+__inline static void _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_bh(plock, *pirqL);
+}
+
+__inline static void _exit_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_bh(plock, *pirqL);
+}
+
+__inline static void _enter_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+
+		mtx_lock(pmutex);
+
+}
+
+
+__inline static void _exit_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+
+		mtx_unlock(pmutex);
+
+}
+static inline void __list_del(struct list_head * prev, struct list_head * next)
+{
+	next->prev = prev;
+	prev->next = next;
+}
+static inline void INIT_LIST_HEAD(struct list_head *list)
+{
+	list->next = list;
+	list->prev = list;
+}
+__inline static void rtw_list_delete(_list *plist)
+{
+	__list_del(plist->prev, plist->next);
+	INIT_LIST_HEAD(plist);
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl padapter,void *pfunc,void* cntx)
+{
+	ptimer->function = pfunc;
+	ptimer->arg = cntx;
+	callout_init(&ptimer->callout, CALLOUT_MPSAFE);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{	
+	//	mod_timer(ptimer , (jiffies+(delay_time*HZ/1000)));
+	if(ptimer->function && ptimer->arg){
+		rtw_mtx_lock(NULL);
+		callout_reset(&ptimer->callout, delay_time,ptimer->function, ptimer->arg);
+		rtw_mtx_unlock(NULL);
+	}
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	//	del_timer_sync(ptimer); 	
+	//	*bcancelled=  _TRUE;//TRUE ==1; FALSE==0	
+	rtw_mtx_lock(NULL);
+	callout_drain(&ptimer->callout);
+	rtw_mtx_unlock(NULL);
+}
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+	printf("%s Not implement yet! \n",__FUNCTION__);
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	printf("%s Not implement yet! \n",__FUNCTION__);
+//	schedule_work(pwork);
+}
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+}
+
+#define ATOMIC_INIT(i)  { (i) }
+
+#endif //PLATFORM_FREEBSD
+
+
+#ifdef PLATFORM_LINUX
+	#include <linux/version.h>
+	#include <linux/spinlock.h>
+	#include <linux/compiler.h>
+	#include <linux/kernel.h>
+	#include <linux/errno.h>
+	#include <linux/init.h>
+	#include <linux/slab.h>
+	#include <linux/module.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,5))
+	#include <linux/kref.h>
+#endif
+	//#include <linux/smp_lock.h>
+	#include <linux/netdevice.h>
+	#include <linux/skbuff.h>
+	#include <linux/circ_buf.h>
+	#include <asm/uaccess.h>
+	#include <asm/byteorder.h>
+	#include <asm/atomic.h>
+	#include <asm/io.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+	#include <asm/semaphore.h>
+#else
+	#include <linux/semaphore.h>
+#endif
+	#include <linux/sem.h>
+	#include <linux/sched.h>
+	#include <linux/etherdevice.h>
+	#include <linux/wireless.h>
+	#include <net/iw_handler.h>
+	#include <linux/if_arp.h>
+	#include <linux/rtnetlink.h>
+	#include <linux/delay.h>
+	#include <linux/proc_fs.h>	// Necessary because we use the proc fs
+	#include <linux/interrupt.h>	// for struct tasklet_struct
+	#include <linux/ip.h>
+	#include <linux/kthread.h>
+
+#ifdef CONFIG_IOCTL_CFG80211	
+//	#include <linux/ieee80211.h>        
+        #include <net/ieee80211_radiotap.h>
+	#include <net/cfg80211.h>	
+#endif //CONFIG_IOCTL_CFG80211
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	#include <linux/in.h>
+	#include <linux/udp.h>
+#endif
+
+#ifdef CONFIG_USB_HCI
+	#include <linux/usb.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21))
+	#include <linux/usb_ch9.h>
+#else
+	#include <linux/usb/ch9.h>
+#endif
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	#include <linux/pci.h>
+#endif
+
+	
+#ifdef CONFIG_USB_HCI
+	typedef struct urb *  PURB;
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22))
+#ifdef CONFIG_USB_SUSPEND
+#define CONFIG_AUTOSUSPEND	1
+#endif
+#endif
+#endif
+
+	typedef struct 	semaphore _sema;
+	typedef	spinlock_t	_lock;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+	typedef struct mutex 		_mutex;
+#else
+	typedef struct semaphore	_mutex;
+#endif
+	typedef struct timer_list _timer;
+
+	struct	__queue	{
+		struct	list_head	queue;	
+		_lock	lock;
+	};
+
+	typedef	struct sk_buff	_pkt;
+	typedef unsigned char	_buffer;
+	
+	typedef struct	__queue	_queue;
+	typedef struct	list_head	_list;
+	typedef	int	_OS_STATUS;
+	//typedef u32	_irqL;
+	typedef unsigned long _irqL;
+	typedef	struct	net_device * _nic_hdl;
+	
+	typedef void*		_thread_hdl_;
+	typedef int		thread_return;
+	typedef void*	thread_context;
+
+	#define thread_exit() complete_and_exit(NULL, 0)
+
+	typedef void timer_hdl_return;
+	typedef void* timer_hdl_context;
+	typedef struct work_struct _workitem;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+	#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22))
+// Porting from linux kernel, for compatible with old kernel.
+static inline unsigned char *skb_tail_pointer(const struct sk_buff *skb)
+{
+	return skb->tail;
+}
+
+static inline void skb_reset_tail_pointer(struct sk_buff *skb)
+{
+	skb->tail = skb->data;
+}
+
+static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset)
+{
+	skb->tail = skb->data + offset;
+}
+
+static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
+{
+	return skb->end;
+}
+#endif
+
+__inline static _list *get_next(_list	*list)
+{
+	return list->next;
+}	
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+	
+#define LIST_CONTAINOR(ptr, type, member) \
+        ((type *)((char *)(ptr)-(SIZE_T)(&((type *)0)->member)))	
+
+        
+__inline static void _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_bh(plock);
+}
+
+__inline static void _exit_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_bh(plock);
+}
+
+__inline static void _enter_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+		mutex_lock(pmutex);
+#else
+		down(pmutex);
+#endif
+}
+
+
+__inline static void _exit_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+		mutex_unlock(pmutex);
+#else
+		up(pmutex);
+#endif
+}
+
+__inline static void rtw_list_delete(_list *plist)
+{
+	list_del_init(plist);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+__inline static void _init_timer(_timer *ptimer,_nic_hdl nic_hdl,void *pfunc,void* cntx)
+{
+	//setup_timer(ptimer, pfunc,(u32)cntx);	
+	ptimer->function = pfunc;
+	ptimer->data = (unsigned long)cntx;
+	init_timer(ptimer);
+}
+#endif
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{	
+	mod_timer(ptimer , (jiffies+(delay_time*HZ/1000)));	
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	del_timer_sync(ptimer); 	
+	*bcancelled=  _TRUE;//TRUE ==1; FALSE==0
+}
+
+#ifdef PLATFORM_LINUX
+#define RTW_TIMER_HDL_ARGS void *FunctionContext
+#elif defined(PLATFORM_OS_CE) || defined(PLATFORM_WINDOWS)
+#define RTW_TIMER_HDL_ARGS IN PVOID SystemSpecific1, IN PVOID FunctionContext, IN PVOID SystemSpecific2, IN PVOID SystemSpecific3
+#endif
+
+#define RTW_TIMER_HDL_NAME(name) rtw_##name##_timer_hdl
+#define RTW_DECLARE_TIMER_HDL(name) void RTW_TIMER_HDL_NAME(name)(RTW_TIMER_HDL_ARGS)
+
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20))
+	INIT_WORK(pwork, pfunc);
+#else
+	INIT_WORK(pwork, pfunc,pwork);
+#endif
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	schedule_work(pwork);
+}
+
+__inline static void _cancel_workitem_sync(_workitem *pwork)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22))
+	cancel_work_sync(pwork);
+#else
+	flush_scheduled_work();
+#endif
+}
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+	while (atomic_inc_return((atomic_t *)&(_MutexCounter)) != 1)\
+	{                                                           \
+		atomic_dec((atomic_t *)&(_MutexCounter));        \
+		msleep(10);                          \
+	}                                                           \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+	atomic_dec((atomic_t *)&(_MutexCounter));        \
+}
+
+static inline int rtw_netif_queue_stopped(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	return (netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 0)) &&
+		netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 1)) &&
+		netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 2)) &&
+		netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 3)) );
+#else
+	return netif_queue_stopped(pnetdev);
+#endif
+}
+
+static inline void rtw_netif_wake_queue(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	netif_tx_wake_all_queues(pnetdev);
+#else
+	netif_wake_queue(pnetdev);
+#endif
+}
+
+static inline void rtw_netif_start_queue(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	netif_tx_start_all_queues(pnetdev);
+#else
+	netif_start_queue(pnetdev);
+#endif
+}
+
+static inline void rtw_netif_stop_queue(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	netif_tx_stop_all_queues(pnetdev);
+#else
+	netif_stop_queue(pnetdev);
+#endif
+}
+
+#endif	// PLATFORM_LINUX
+
+
+#ifdef PLATFORM_OS_XP
+
+	#include <ndis.h>
+	#include <ntddk.h>
+	#include <ntddndis.h>
+	#include <ntdef.h>
+
+#ifdef CONFIG_USB_HCI
+	#include <usb.h>
+	#include <usbioctl.h>
+	#include <usbdlib.h>
+#endif
+
+	typedef KSEMAPHORE 	_sema;
+	typedef	LIST_ENTRY	_list;
+	typedef NDIS_STATUS _OS_STATUS;
+	
+
+	typedef NDIS_SPIN_LOCK	_lock;
+
+	typedef KMUTEX 			_mutex;
+
+	typedef KIRQL	_irqL;
+
+	// USB_PIPE for WINCE , but handle can be use just integer under windows
+	typedef NDIS_HANDLE  _nic_hdl;
+
+
+	typedef NDIS_MINIPORT_TIMER    _timer;
+
+	struct	__queue	{
+		LIST_ENTRY	queue;	
+		_lock	lock;
+	};
+
+	typedef	NDIS_PACKET	_pkt;
+	typedef NDIS_BUFFER	_buffer;
+	typedef struct	__queue	_queue;
+	
+	typedef PKTHREAD _thread_hdl_;
+	typedef void	thread_return;
+	typedef void* thread_context;
+
+	typedef NDIS_WORK_ITEM _workitem;
+
+	#define thread_exit() PsTerminateSystemThread(STATUS_SUCCESS);
+
+	#define HZ			10000000
+	#define SEMA_UPBND	(0x7FFFFFFF)   //8192
+	
+__inline static _list *get_next(_list	*list)
+{
+	return list->Flink;
+}	
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+	
+
+#define LIST_CONTAINOR(ptr, type, member) CONTAINING_RECORD(ptr, type, member)
+     
+
+__inline static _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisAcquireSpinLock(plock);	
+}
+
+__inline static _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisReleaseSpinLock(plock);	
+}
+
+
+__inline static _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprAcquireSpinLock(plock);	
+}
+
+__inline static _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprReleaseSpinLock(plock);	
+}
+
+__inline static void _enter_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	NdisDprAcquireSpinLock(plock);
+}
+
+__inline static void _exit_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	NdisDprReleaseSpinLock(plock);
+}
+
+__inline static _enter_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+	KeWaitForSingleObject(pmutex, Executive, KernelMode, FALSE, NULL);
+}
+
+
+__inline static _exit_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+	KeReleaseMutex(pmutex, FALSE);
+}
+
+
+__inline static void rtw_list_delete(_list *plist)
+{
+	RemoveEntryList(plist);
+	InitializeListHead(plist);	
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl nic_hdl,void *pfunc,PVOID cntx)
+{
+	NdisMInitializeTimer(ptimer, nic_hdl, pfunc, cntx);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{	
+ 	NdisMSetTimer(ptimer,delay_time);	
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	NdisMCancelTimer(ptimer,bcancelled);
+}
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+
+	NdisInitializeWorkItem(pwork, pfunc, cntx);
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	NdisScheduleWorkItem(pwork);
+}
+
+
+#define ATOMIC_INIT(i)  { (i) }
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    while (NdisInterlockedIncrement((PULONG)&(_MutexCounter)) != 1)\
+    {                                                           \
+        NdisInterlockedDecrement((PULONG)&(_MutexCounter));        \
+        NdisMSleep(10000);                          \
+    }                                                           \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    NdisInterlockedDecrement((PULONG)&(_MutexCounter));              \
+}
+
+#endif // PLATFORM_OS_XP
+
+
+#ifdef PLATFORM_OS_CE
+#include <osdep_ce_service.h>
+#endif
+
+#include <rtw_byteorder.h>
+
+#ifndef BIT
+	#define BIT(x)	( 1 << (x))
+#endif
+
+extern int RTW_STATUS_CODE(int error_code);
+
+#define CONFIG_USE_VMALLOC
+
+/* flags used for rtw_mstat_update() */
+enum mstat_f {
+	/* type: 0x00ff */
+	MSTAT_TYPE_VIR = 0x00,
+	MSTAT_TYPE_PHY= 0x01,
+	MSTAT_TYPE_SKB = 0x02,
+	MSTAT_TYPE_USB = 0x03,
+	MSTAT_TYPE_MAX = 0x04,
+
+	/* func: 0xff00 */
+	MSTAT_FUNC_UNSPECIFIED = 0x00<<8,
+	MSTAT_FUNC_IO = 0x01<<8,
+	MSTAT_FUNC_TX_IO = 0x02<<8,
+	MSTAT_FUNC_RX_IO = 0x03<<8,
+	MSTAT_FUNC_TX = 0x04<<8,
+	MSTAT_FUNC_RX = 0x05<<8,
+	MSTAT_FUNC_MAX = 0x06<<8,
+};
+
+#define mstat_tf_idx(flags) ((flags)&0xff)
+#define mstat_ff_idx(flags) (((flags)&0xff00) >> 8)
+
+typedef enum mstat_status{
+	MSTAT_ALLOC_SUCCESS = 0,
+	MSTAT_ALLOC_FAIL,
+	MSTAT_FREE
+} MSTAT_STATUS;
+
+#ifdef DBG_MEM_ALLOC
+void rtw_mstat_update(const enum mstat_f flags, const MSTAT_STATUS status, u32 sz);
+int _rtw_mstat_dump(char *buf, int len);
+void rtw_mstat_dump (void);
+u8* dbg_rtw_vmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+u8* dbg_rtw_zvmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_vmfree(u8 *pbuf, const enum mstat_f flags, u32 sz, const char *func, const int line);
+u8* dbg_rtw_malloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+u8* dbg_rtw_zmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_mfree(u8 *pbuf, const enum mstat_f flags, u32 sz, const char *func, const int line);
+
+struct sk_buff * dbg_rtw_skb_alloc(unsigned int size, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_skb_free(struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line);
+struct sk_buff *dbg_rtw_skb_copy(const struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line);
+struct sk_buff *dbg_rtw_skb_clone(struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line);
+int dbg_rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb, const enum mstat_f flags, const char *func, int line);
+void dbg_rtw_skb_queue_purge(struct sk_buff_head *list, enum mstat_f flags, const char *func, int line);
+
+#ifdef CONFIG_USB_HCI
+void *dbg_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma, const enum mstat_f flags, const char *func, const int line);
+#endif /* CONFIG_USB_HCI */
+
+#ifdef CONFIG_USE_VMALLOC
+#define rtw_vmalloc(sz)			dbg_rtw_vmalloc((sz), MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc(sz)			dbg_rtw_zvmalloc((sz), MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_vmfree(pbuf, sz)		dbg_rtw_vmfree((pbuf), (sz), MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_vmalloc_f(sz, mstat_f)			dbg_rtw_vmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc_f(sz, mstat_f)		dbg_rtw_zvmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	dbg_rtw_vmfree((pbuf), (sz), ((mstat_f)&0xff00)|MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#else /* CONFIG_USE_VMALLOC */
+#define rtw_vmalloc(sz)			dbg_rtw_malloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc(sz)			dbg_rtw_zmalloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_vmfree(pbuf, sz)		dbg_rtw_mfree((pbuf), (sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_vmalloc_f(sz, mstat_f)			dbg_rtw_malloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc_f(sz, mstat_f)		dbg_rtw_zmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	dbg_rtw_mfree((pbuf), (sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#endif /* CONFIG_USE_VMALLOC */
+#define rtw_malloc(sz)			dbg_rtw_malloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zmalloc(sz)			dbg_rtw_zmalloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_mfree(pbuf, sz)		dbg_rtw_mfree((pbuf), (sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_malloc_f(sz, mstat_f)			dbg_rtw_malloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zmalloc_f(sz, mstat_f)			dbg_rtw_zmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_mfree_f(pbuf, sz, mstat_f)		dbg_rtw_mfree((pbuf), (sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+
+#define rtw_skb_alloc(size)	dbg_rtw_skb_alloc((size), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_free(skb)	dbg_rtw_skb_free((skb), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_alloc_f(size, mstat_f)	dbg_rtw_skb_alloc((size), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_free_f(skb, mstat_f)	dbg_rtw_skb_free((skb), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_copy(skb)	dbg_rtw_skb_copy((skb), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_clone(skb)	dbg_rtw_skb_clone((skb), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_copy_f(skb, mstat_f)	dbg_rtw_skb_copy((skb), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_clone_f(skb, mstat_f)	dbg_rtw_skb_clone((skb), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_netif_rx(ndev, skb)	dbg_rtw_netif_rx(ndev, skb, MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_queue_purge(sk_buff_head) dbg_rtw_skb_queue_purge(sk_buff_head, MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#ifdef CONFIG_USB_HCI
+#define rtw_usb_buffer_alloc(dev, size, dma)		dbg_rtw_usb_buffer_alloc((dev), (size), (dma), MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#define rtw_usb_buffer_free(dev, size, addr, dma)	dbg_rtw_usb_buffer_free((dev), (size), (addr), (dma), MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#define rtw_usb_buffer_alloc_f(dev, size, dma, mstat_f)			dbg_rtw_usb_buffer_alloc((dev), (size), (dma), ((mstat_f)&0xff00)|MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#define rtw_usb_buffer_free_f(dev, size, addr, dma, mstat_f)	dbg_rtw_usb_buffer_free((dev), (size), (addr), (dma), ((mstat_f)&0xff00)|MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#endif /* CONFIG_USB_HCI */
+
+#else /* DBG_MEM_ALLOC */
+#define rtw_mstat_update(flag, status, sz) do {} while(0)
+#define rtw_mstat_dump() do {} while(0)
+u8*	_rtw_vmalloc(u32 sz);
+u8*	_rtw_zvmalloc(u32 sz);
+void	_rtw_vmfree(u8 *pbuf, u32 sz);
+u8*	_rtw_zmalloc(u32 sz);
+u8*	_rtw_malloc(u32 sz);
+void	_rtw_mfree(u8 *pbuf, u32 sz);
+
+struct sk_buff *_rtw_skb_alloc(u32 sz);
+void _rtw_skb_free(struct sk_buff *skb);
+struct sk_buff *_rtw_skb_copy(const struct sk_buff *skb);
+struct sk_buff *_rtw_skb_clone(struct sk_buff *skb);
+int _rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb);
+void _rtw_skb_queue_purge(struct sk_buff_head *list);
+
+#ifdef CONFIG_USB_HCI
+void *_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma);
+void _rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma);
+#endif /* CONFIG_USB_HCI */
+
+#ifdef CONFIG_USE_VMALLOC
+#define rtw_vmalloc(sz)			_rtw_vmalloc((sz))
+#define rtw_zvmalloc(sz)			_rtw_zvmalloc((sz))
+#define rtw_vmfree(pbuf, sz)		_rtw_vmfree((pbuf), (sz))
+#define rtw_vmalloc_f(sz, mstat_f)			_rtw_vmalloc((sz))
+#define rtw_zvmalloc_f(sz, mstat_f)		_rtw_zvmalloc((sz))
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	_rtw_vmfree((pbuf), (sz))
+#else /* CONFIG_USE_VMALLOC */
+#define rtw_vmalloc(sz)			_rtw_malloc((sz))
+#define rtw_zvmalloc(sz)			_rtw_zmalloc((sz))
+#define rtw_vmfree(pbuf, sz)		_rtw_mfree((pbuf), (sz))
+#define rtw_vmalloc_f(sz, mstat_f)			_rtw_malloc((sz))
+#define rtw_zvmalloc_f(sz, mstat_f)		_rtw_zmalloc((sz))
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	_rtw_mfree((pbuf), (sz))
+#endif /* CONFIG_USE_VMALLOC */
+#define rtw_malloc(sz)			_rtw_malloc((sz))
+#define rtw_zmalloc(sz)			_rtw_zmalloc((sz))
+#define rtw_mfree(pbuf, sz)		_rtw_mfree((pbuf), (sz))
+#define rtw_malloc_f(sz, mstat_f)			_rtw_malloc((sz))
+#define rtw_zmalloc_f(sz, mstat_f)			_rtw_zmalloc((sz))
+#define rtw_mfree_f(pbuf, sz, mstat_f)		_rtw_mfree((pbuf), (sz))
+
+#define rtw_skb_alloc(size) _rtw_skb_alloc((size))
+#define rtw_skb_free(skb) _rtw_skb_free((skb))
+#define rtw_skb_alloc_f(size, mstat_f)	_rtw_skb_alloc((size))
+#define rtw_skb_free_f(skb, mstat_f)	_rtw_skb_free((skb))
+#define rtw_skb_copy(skb)	_rtw_skb_copy((skb))
+#define rtw_skb_clone(skb)	_rtw_skb_clone((skb))
+#define rtw_skb_copy_f(skb, mstat_f)	_rtw_skb_copy((skb))
+#define rtw_skb_clone_f(skb, mstat_f)	_rtw_skb_clone((skb))
+#define rtw_netif_rx(ndev, skb) _rtw_netif_rx(ndev, skb)
+#define rtw_skb_queue_purge(sk_buff_head) _rtw_skb_queue_purge(sk_buff_head)
+#ifdef CONFIG_USB_HCI
+#define rtw_usb_buffer_alloc(dev, size, dma) _rtw_usb_buffer_alloc((dev), (size), (dma))
+#define rtw_usb_buffer_free(dev, size, addr, dma) _rtw_usb_buffer_free((dev), (size), (addr), (dma))
+#define rtw_usb_buffer_alloc_f(dev, size, dma, mstat_f) _rtw_usb_buffer_alloc((dev), (size), (dma))
+#define rtw_usb_buffer_free_f(dev, size, addr, dma, mstat_f) _rtw_usb_buffer_free((dev), (size), (addr), (dma))
+#endif /* CONFIG_USB_HCI */
+#endif /* DBG_MEM_ALLOC */
+
+extern void*	rtw_malloc2d(int h, int w, int size);
+extern void	rtw_mfree2d(void *pbuf, int h, int w, int size);
+
+extern void	_rtw_memcpy(void *dec, const void *sour, u32 sz);
+extern int	_rtw_memcmp(const void *dst, const void *src, u32 sz);
+extern void	_rtw_memset(void *pbuf, int c, u32 sz);
+
+extern void	_rtw_init_listhead(_list *list);
+extern u32	rtw_is_list_empty(_list *phead);
+extern void	rtw_list_insert_head(_list *plist, _list *phead);
+extern void	rtw_list_insert_tail(_list *plist, _list *phead);
+#ifndef PLATFORM_FREEBSD
+extern void	rtw_list_delete(_list *plist);
+#endif //PLATFORM_FREEBSD
+
+extern void	_rtw_init_sema(_sema *sema, int init_val);
+extern void	_rtw_free_sema(_sema	*sema);
+extern void	_rtw_up_sema(_sema	*sema);
+extern u32	_rtw_down_sema(_sema *sema);
+extern void	_rtw_mutex_init(_mutex *pmutex);
+extern void	_rtw_mutex_free(_mutex *pmutex);
+#ifndef PLATFORM_FREEBSD
+extern void	_rtw_spinlock_init(_lock *plock);
+#endif //PLATFORM_FREEBSD
+extern void	_rtw_spinlock_free(_lock *plock);
+extern void	_rtw_spinlock(_lock	*plock);
+extern void	_rtw_spinunlock(_lock	*plock);
+extern void	_rtw_spinlock_ex(_lock	*plock);
+extern void	_rtw_spinunlock_ex(_lock	*plock);
+
+extern void	_rtw_init_queue(_queue	*pqueue);
+extern u32	_rtw_queue_empty(_queue	*pqueue);
+extern u32	rtw_end_of_queue_search(_list *queue, _list *pelement);
+
+extern u32	rtw_get_current_time(void);
+extern u32	rtw_systime_to_ms(u32 systime);
+extern u32	rtw_ms_to_systime(u32 ms);
+extern s32	rtw_get_passing_time_ms(u32 start);
+extern s32	rtw_get_time_interval_ms(u32 start, u32 end);
+
+extern void	rtw_sleep_schedulable(int ms);
+
+extern void	rtw_msleep_os(int ms);
+extern void	rtw_usleep_os(int us);
+
+extern u32 	rtw_atoi(u8* s);
+
+#ifdef DBG_DELAY_OS
+#define rtw_mdelay_os(ms) _rtw_mdelay_os((ms), __FUNCTION__, __LINE__)
+#define rtw_udelay_os(ms) _rtw_udelay_os((ms), __FUNCTION__, __LINE__)
+extern void _rtw_mdelay_os(int ms, const char *func, const int line);
+extern void _rtw_udelay_os(int us, const char *func, const int line);
+#else
+extern void	rtw_mdelay_os(int ms);
+extern void	rtw_udelay_os(int us);
+#endif
+
+extern void rtw_yield_os(void);
+
+
+__inline static unsigned char _cancel_timer_ex(_timer *ptimer)
+{
+#ifdef PLATFORM_LINUX
+	return del_timer_sync(ptimer);
+#endif
+#ifdef PLATFORM_FREEBSD
+	_cancel_timer(ptimer,0);
+	return 0;
+#endif
+#ifdef PLATFORM_WINDOWS
+	u8 bcancelled;
+	
+	_cancel_timer(ptimer, &bcancelled);
+	
+	return bcancelled;
+#endif
+}
+
+#ifdef PLATFORM_FREEBSD
+static __inline void thread_enter(void *context);
+#endif //PLATFORM_FREEBSD
+static __inline void thread_enter(char *name)
+{
+#ifdef PLATFORM_LINUX
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
+	daemonize("%s", name);
+	#endif
+	allow_signal(SIGTERM);
+#endif
+#ifdef PLATFORM_FREEBSD
+	printf("%s", "RTKTHREAD_enter");
+#endif
+}
+
+#ifdef PLATFORM_FREEBSD
+#define thread_exit() do{printf("%s", "RTKTHREAD_exit");}while(0)
+#endif //PLATFORM_FREEBSD
+__inline static void flush_signals_thread(void) 
+{
+#ifdef PLATFORM_LINUX
+	if (signal_pending (current)) 
+	{
+		flush_signals(current);
+	}
+#endif
+}
+
+__inline static _OS_STATUS res_to_status(sint res)
+{
+
+
+#if defined (PLATFORM_LINUX) || defined (PLATFORM_MPIXEL) || defined (PLATFORM_FREEBSD)
+	return res;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	if (res == _SUCCESS)
+		return NDIS_STATUS_SUCCESS;
+	else
+		return NDIS_STATUS_FAILURE;
+
+#endif	
+	
+}
+
+__inline static void rtw_dump_stack(void)
+{
+#ifdef PLATFORM_LINUX
+	dump_stack();
+#endif
+}
+
+#ifdef PLATFORM_LINUX
+#define rtw_warn_on(condition) WARN_ON(condition)
+#else
+#define rtw_warn_on(condition) do {} while (0)
+#endif
+
+#define _RND(sz, r) ((((sz)+((r)-1))/(r))*(r))
+#define RND4(x)	(((x >> 2) + (((x & 3) == 0) ?  0: 1)) << 2)
+
+__inline static u32 _RND4(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 2) + ((sz & 3) ? 1: 0)) << 2;
+	
+	return val;
+
+}
+
+__inline static u32 _RND8(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 3) + ((sz & 7) ? 1: 0)) << 3;
+	
+	return val;
+
+}
+
+__inline static u32 _RND128(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 7) + ((sz & 127) ? 1: 0)) << 7;
+	
+	return val;
+
+}
+
+__inline static u32 _RND256(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 8) + ((sz & 255) ? 1: 0)) << 8;
+	
+	return val;
+
+}
+
+__inline static u32 _RND512(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 9) + ((sz & 511) ? 1: 0)) << 9;
+	
+	return val;
+
+}
+
+__inline static u32 bitshift(u32 bitmask)
+{
+	u32 i;
+
+	for (i = 0; i <= 31; i++)
+		if (((bitmask>>i) &  0x1) == 1) break;
+
+	return i;
+}
+
+#ifndef MAC_FMT
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#endif
+#ifndef MAC_ARG
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
+#endif
+
+//#ifdef __GNUC__
+#ifdef PLATFORM_LINUX
+#define STRUCT_PACKED __attribute__ ((packed))
+#else
+#define STRUCT_PACKED
+#endif
+
+
+// limitation of path length
+#ifdef PLATFORM_LINUX
+	#define PATH_LENGTH_MAX PATH_MAX
+#elif defined(PLATFORM_WINDOWS)
+	#define PATH_LENGTH_MAX MAX_PATH
+#endif
+
+
+// Suspend lock prevent system from going suspend
+#ifdef CONFIG_WAKELOCK
+#include <linux/wakelock.h>
+#elif defined(CONFIG_ANDROID_POWER)
+#include <linux/android_power.h>
+#endif
+
+extern void rtw_suspend_lock_init(void);
+extern void rtw_suspend_lock_uninit(void);
+extern void rtw_lock_suspend(void);
+extern void rtw_unlock_suspend(void);
+extern void rtw_lock_suspend_timeout(u32 timeout_ms);
+
+
+//Atomic integer operations
+#ifdef PLATFORM_LINUX
+	#define ATOMIC_T atomic_t
+#elif defined(PLATFORM_WINDOWS)
+	#define ATOMIC_T LONG
+#elif defined(PLATFORM_FREEBSD)
+	typedef uint32_t ATOMIC_T ;
+#endif
+
+extern void ATOMIC_SET(ATOMIC_T *v, int i);
+extern int ATOMIC_READ(ATOMIC_T *v);
+extern void ATOMIC_ADD(ATOMIC_T *v, int i);
+extern void ATOMIC_SUB(ATOMIC_T *v, int i);
+extern void ATOMIC_INC(ATOMIC_T *v);
+extern void ATOMIC_DEC(ATOMIC_T *v);
+extern int ATOMIC_ADD_RETURN(ATOMIC_T *v, int i);
+extern int ATOMIC_SUB_RETURN(ATOMIC_T *v, int i);
+extern int ATOMIC_INC_RETURN(ATOMIC_T *v);
+extern int ATOMIC_DEC_RETURN(ATOMIC_T *v);
+
+//File operation APIs, just for linux now
+extern int rtw_is_file_readable(char *path);
+extern int rtw_retrive_from_file(char *path, u8* buf, u32 sz);
+extern int rtw_store_to_file(char *path, u8* buf, u32 sz);
+
+
+#if 1 //#ifdef MEM_ALLOC_REFINE_ADAPTOR
+struct rtw_netdev_priv_indicator {
+	void *priv;
+	u32 sizeof_priv;
+};
+struct net_device *rtw_alloc_etherdev_with_old_priv(int sizeof_priv, void *old_priv);
+extern struct net_device * rtw_alloc_etherdev(int sizeof_priv);
+
+#ifndef PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) ( ((struct rtw_netdev_priv_indicator *)netdev_priv(netdev))->priv )
+#else //PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) (((struct ifnet *)netdev)->if_softc)
+#endif //PLATFORM_FREEBSD
+
+#ifndef PLATFORM_FREEBSD
+extern void rtw_free_netdev(struct net_device * netdev);
+#else //PLATFORM_FREEBSD
+#define rtw_free_netdev(netdev) if_free((netdev))
+#endif //PLATFORM_FREEBSD
+
+#else //MEM_ALLOC_REFINE_ADAPTOR
+
+#define rtw_alloc_etherdev(sizeof_priv) alloc_etherdev((sizeof_priv))
+
+#ifndef PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) netdev_priv((netdev))
+#define rtw_free_netdev(netdev) free_netdev((netdev))
+#else //PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) (((struct ifnet *)netdev)->if_softc)
+#define rtw_free_netdev(netdev) if_free((netdev))
+#endif //PLATFORM_FREEBSD
+#endif
+
+#ifdef PLATFORM_LINUX
+#define NDEV_FMT "%s"
+#define NDEV_ARG(ndev) ndev->name
+#define ADPT_FMT "%s"
+#define ADPT_ARG(adapter) adapter->pnetdev->name
+#define FUNC_NDEV_FMT "%s(%s)"
+#define FUNC_NDEV_ARG(ndev) __func__, ndev->name
+#define FUNC_ADPT_FMT "%s(%s)"
+#define FUNC_ADPT_ARG(adapter) __func__, adapter->pnetdev->name
+#else
+#define NDEV_FMT "%s"
+#define NDEV_ARG(ndev) ""
+#define ADPT_FMT "%s"
+#define ADPT_ARG(adapter) ""
+#define FUNC_NDEV_FMT "%s"
+#define FUNC_NDEV_ARG(ndev) __func__
+#define FUNC_ADPT_FMT "%s"
+#define FUNC_ADPT_ARG(adapter) __func__
+#endif
+
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
+#define rtw_signal_process(pid, sig) kill_pid(find_vpid((pid)),(sig), 1)
+#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
+#define rtw_signal_process(pid, sig) kill_proc((pid), (sig), 1)
+#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
+#endif //PLATFORM_LINUX
+
+extern u64 rtw_modular64(u64 x, u64 y);
+extern u64 rtw_division64(u64 x, u64 y);
+
+
+/* Macros for handling unaligned memory accesses */
+
+#define RTW_GET_BE16(a) ((u16) (((a)[0] << 8) | (a)[1]))
+#define RTW_PUT_BE16(a, val)			\
+	do {					\
+		(a)[0] = ((u16) (val)) >> 8;	\
+		(a)[1] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define RTW_GET_LE16(a) ((u16) (((a)[1] << 8) | (a)[0]))
+#define RTW_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((u16) (val)) >> 8;	\
+		(a)[0] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define RTW_GET_BE24(a) ((((u32) (a)[0]) << 16) | (((u32) (a)[1]) << 8) | \
+			 ((u32) (a)[2]))			 
+#define RTW_PUT_BE24(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[2] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RTW_GET_BE32(a) ((((u32) (a)[0]) << 24) | (((u32) (a)[1]) << 16) | \
+			 (((u32) (a)[2]) << 8) | ((u32) (a)[3]))			 
+#define RTW_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RTW_GET_LE32(a) ((((u32) (a)[3]) << 24) | (((u32) (a)[2]) << 16) | \
+			 (((u32) (a)[1]) << 8) | ((u32) (a)[0]))			 
+#define RTW_PUT_LE32(a, val)					\
+	do {							\
+		(a)[3] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[0] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RTW_GET_BE64(a) ((((u64) (a)[0]) << 56) | (((u64) (a)[1]) << 48) | \
+			 (((u64) (a)[2]) << 40) | (((u64) (a)[3]) << 32) | \
+			 (((u64) (a)[4]) << 24) | (((u64) (a)[5]) << 16) | \
+			 (((u64) (a)[6]) << 8) | ((u64) (a)[7]))			 
+#define RTW_PUT_BE64(a, val)				\
+	do {						\
+		(a)[0] = (u8) (((u64) (val)) >> 56);	\
+		(a)[1] = (u8) (((u64) (val)) >> 48);	\
+		(a)[2] = (u8) (((u64) (val)) >> 40);	\
+		(a)[3] = (u8) (((u64) (val)) >> 32);	\
+		(a)[4] = (u8) (((u64) (val)) >> 24);	\
+		(a)[5] = (u8) (((u64) (val)) >> 16);	\
+		(a)[6] = (u8) (((u64) (val)) >> 8);	\
+		(a)[7] = (u8) (((u64) (val)) & 0xff);	\
+	} while (0)
+
+#define RTW_GET_LE64(a) ((((u64) (a)[7]) << 56) | (((u64) (a)[6]) << 48) | \
+			 (((u64) (a)[5]) << 40) | (((u64) (a)[4]) << 32) | \
+			 (((u64) (a)[3]) << 24) | (((u64) (a)[2]) << 16) | \
+			 (((u64) (a)[1]) << 8) | ((u64) (a)[0]))
+
+void rtw_buf_free(u8 **buf, u32 *buf_len);
+void rtw_buf_update(u8 **buf, u32 *buf_len, u8 *src, u32 src_len);
+
+struct rtw_cbuf {
+	u32 write;
+	u32 read;
+	u32 size;
+	void *bufs[0];
+};
+
+bool rtw_cbuf_full(struct rtw_cbuf *cbuf);
+bool rtw_cbuf_empty(struct rtw_cbuf *cbuf);
+bool rtw_cbuf_push(struct rtw_cbuf *cbuf, void *buf);
+void *rtw_cbuf_pop(struct rtw_cbuf *cbuf);
+struct rtw_cbuf *rtw_cbuf_alloc(u32 size);
+void rtw_cbuf_free(struct rtw_cbuf *cbuf);
+
+#endif
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h
new file mode 100755
index 0000000000000..1ee0ee2c226ba
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h
@@ -0,0 +1,168 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __PCI_HAL_H__
+#define __PCI_HAL_H__
+
+
+#define	INTEL_VENDOR_ID				0x8086
+#define	SIS_VENDOR_ID					0x1039
+#define	ATI_VENDOR_ID					0x1002
+#define	ATI_DEVICE_ID					0x7914
+#define	AMD_VENDOR_ID					0x1022
+
+#define	PCI_MAX_BRIDGE_NUMBER			255
+#define	PCI_MAX_DEVICES				32
+#define	PCI_MAX_FUNCTION				8
+
+#define	PCI_CONF_ADDRESS   				0x0CF8   // PCI Configuration Space Address 
+#define	PCI_CONF_DATA					0x0CFC   // PCI Configuration Space Data 
+
+#define	PCI_CLASS_BRIDGE_DEV			0x06
+#define	PCI_SUBCLASS_BR_PCI_TO_PCI	0x04
+
+#define 	PCI_CAPABILITY_ID_PCI_EXPRESS	0x10
+
+#define	U1DONTCARE 					0xFF	
+#define	U2DONTCARE 					0xFFFF	
+#define	U4DONTCARE 					0xFFFFFFFF
+
+#define PCI_VENDER_ID_REALTEK		0x10ec
+
+#define HAL_HW_PCI_8180_DEVICE_ID           	0x8180
+#define HAL_HW_PCI_8185_DEVICE_ID           	0x8185	//8185 or 8185b
+#define HAL_HW_PCI_8188_DEVICE_ID           	0x8188	//8185b		
+#define HAL_HW_PCI_8198_DEVICE_ID           	0x8198	//8185b		
+#define HAL_HW_PCI_8190_DEVICE_ID           	0x8190	//8190
+#define HAL_HW_PCI_8723E_DEVICE_ID		0x8723	//8723E
+#define HAL_HW_PCI_8192_DEVICE_ID           	0x8192	//8192 PCI-E
+#define HAL_HW_PCI_8192SE_DEVICE_ID		0x8192	//8192 SE
+#define HAL_HW_PCI_8174_DEVICE_ID           	0x8174	//8192 SE 
+#define HAL_HW_PCI_8173_DEVICE_ID           	0x8173	//8191 SE Crab
+#define HAL_HW_PCI_8172_DEVICE_ID           	0x8172	//8191 SE RE
+#define HAL_HW_PCI_8171_DEVICE_ID           	0x8171	//8191 SE Unicron
+#define HAL_HW_PCI_0045_DEVICE_ID			0x0045	//8190 PCI for Ceraga
+#define HAL_HW_PCI_0046_DEVICE_ID			0x0046	//8190 Cardbus for Ceraga
+#define HAL_HW_PCI_0044_DEVICE_ID			0x0044	//8192e PCIE for Ceraga
+#define HAL_HW_PCI_0047_DEVICE_ID			0x0047	//8192e Express Card for Ceraga
+#define HAL_HW_PCI_700F_DEVICE_ID			0x700F
+#define HAL_HW_PCI_701F_DEVICE_ID			0x701F
+#define HAL_HW_PCI_DLINK_DEVICE_ID		0x3304
+#define HAL_HW_PCI_8192CET_DEVICE_ID		0x8191	//8192ce
+#define HAL_HW_PCI_8192CE_DEVICE_ID		0x8178	//8192ce
+#define HAL_HW_PCI_8191CE_DEVICE_ID		0x8177	//8192ce
+#define HAL_HW_PCI_8188CE_DEVICE_ID		0x8176	//8192ce
+#define HAL_HW_PCI_8192CU_DEVICE_ID      	0x8191	//8192ce
+#define HAL_HW_PCI_8192DE_DEVICE_ID		0x8193	//8192de
+#define HAL_HW_PCI_002B_DEVICE_ID			0x002B	//8192de, provided by HW SD
+
+#define HAL_MEMORY_MAPPED_IO_RANGE_8190PCI 		0x1000     //8190 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8190PCI			0x00
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192PCIE	0x4000	//8192 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8192PCIE			0x01
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192SE		0x4000	//8192 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8192SE			0x10
+#define HAL_HW_PCI_REVISION_ID_8192CE			0x1
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192CE		0x4000	//8192 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8192DE			0x0
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192DE		0x4000	//8192 support 16 pages of IO registers
+
+enum pci_bridge_vendor {
+	PCI_BRIDGE_VENDOR_INTEL = 0x0,//0b'0000,0001
+	PCI_BRIDGE_VENDOR_ATI, //= 0x02,//0b'0000,0010
+	PCI_BRIDGE_VENDOR_AMD, //= 0x04,//0b'0000,0100
+	PCI_BRIDGE_VENDOR_SIS ,//= 0x08,//0b'0000,1000
+	PCI_BRIDGE_VENDOR_UNKNOWN, //= 0x40,//0b'0100,0000
+	PCI_BRIDGE_VENDOR_MAX ,//= 0x80
+} ;
+
+struct rt_pci_capabilities_header {
+	u8	capability_id;
+	u8	next;
+};
+
+struct pci_priv{
+	u8	linkctrl_reg;
+	
+	u8	busnumber;
+	u8	devnumber;	
+	u8	funcnumber;	
+
+	u8	pcibridge_busnum;
+	u8	pcibridge_devnum;
+	u8	pcibridge_funcnum;
+	u8	pcibridge_vendor;
+	u16	pcibridge_vendorid;
+	u16	pcibridge_deviceid;
+	u8	pcibridge_pciehdr_offset;
+	u8	pcibridge_linkctrlreg;	
+
+	u8	amd_l1_patch;
+};
+
+typedef struct _RT_ISR_CONTENT
+{
+	union{
+		u32			IntArray[2];
+		u32			IntReg4Byte;
+		u16			IntReg2Byte;
+	};
+}RT_ISR_CONTENT, *PRT_ISR_CONTENT;
+
+//#define RegAddr(addr)           (addr + 0xB2000000UL)
+//some platform macros will def here
+static inline void NdisRawWritePortUlong(u32 port,  u32 val) 		
+{
+	outl(val, port);
+	//writel(val, (u8 *)RegAddr(port));	
+}
+
+static inline void NdisRawWritePortUchar(u32 port,  u8 val)
+{
+	outb(val, port);
+	//writeb(val, (u8 *)RegAddr(port));
+}
+
+static inline void NdisRawReadPortUchar(u32 port, u8 *pval)
+{
+	*pval = inb(port);
+	//*pval = readb((u8 *)RegAddr(port));
+}
+
+static inline void NdisRawReadPortUshort(u32 port, u16 *pval)
+{
+	*pval = inw(port);
+	//*pval = readw((u8 *)RegAddr(port));
+}
+
+static inline void NdisRawReadPortUlong(u32 port, u32 *pval)
+{
+	*pval = inl(port);
+	//*pval = readl((u8 *)RegAddr(port));
+}
+
+#ifdef CONFIG_RTL8192C
+void rtl8192ce_set_hal_ops(_adapter * padapter);
+#endif
+#ifdef CONFIG_RTL8192D
+void rtl8192de_set_hal_ops(_adapter * padapter);
+#endif
+
+#endif //__PCIE_HAL_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h b/drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h
new file mode 100755
index 0000000000000..9404ff44b6286
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __PCI_OPS_H_
+#define __PCI_OPS_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+#ifdef CONFIG_RTL8192C
+u32	rtl8192ce_init_desc_ring(_adapter * padapter);
+u32	rtl8192ce_free_desc_ring(_adapter * padapter);
+void	rtl8192ce_reset_desc_ring(_adapter * padapter);
+#ifdef CONFIG_64BIT_DMA
+u8	PlatformEnable92CEDMA64(PADAPTER Adapter);
+#endif
+int	rtl8192ce_interrupt(PADAPTER Adapter);
+void	rtl8192ce_xmit_tasklet(void *priv);
+void	rtl8192ce_recv_tasklet(void *priv);
+void	rtl8192ce_prepare_bcn_tasklet(void *priv);
+void	rtl8192ce_set_intf_ops(struct _io_ops	*pops);
+#define pci_set_intf_ops	rtl8192ce_set_intf_ops
+#endif
+
+#ifdef CONFIG_RTL8192D
+u32	rtl8192de_init_desc_ring(_adapter * padapter);
+u32	rtl8192de_free_desc_ring(_adapter * padapter);
+void	rtl8192de_reset_desc_ring(_adapter * padapter);
+#ifdef CONFIG_64BIT_DMA
+u8	PlatformEnable92DEDMA64(PADAPTER Adapter);
+#endif
+int	rtl8192de_interrupt(PADAPTER Adapter);
+void	rtl8192de_xmit_tasklet(void *priv);
+void	rtl8192de_recv_tasklet(void *priv);
+void	rtl8192de_prepare_bcn_tasklet(void *priv);
+void	rtl8192de_set_intf_ops(struct _io_ops	*pops);
+#define pci_set_intf_ops	rtl8192de_set_intf_ops
+u32	MpReadPCIDwordDBI8192D(IN PADAPTER Adapter, IN u16 Offset, IN u8 Direct);
+void	MpWritePCIDwordDBI8192D(IN PADAPTER Adapter, IN u16 Offset, IN u32 Value, IN u8 Direct);
+#endif
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h b/drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h
new file mode 100755
index 0000000000000..09715af43781b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h
@@ -0,0 +1,33 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __PCI_OSINTF_H
+#define __PCI_OSINTF_H
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+void rtw_pci_disable_aspm(_adapter *padapter);
+void rtw_pci_enable_aspm(_adapter *padapter);
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h
new file mode 100755
index 0000000000000..536ed3100ae2c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h
@@ -0,0 +1,58 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RECV_OSDEP_H_
+#define __RECV_OSDEP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+extern sint _rtw_init_recv_priv(struct recv_priv *precvpriv, _adapter *padapter);
+extern void _rtw_free_recv_priv (struct recv_priv *precvpriv);
+
+
+extern s32  rtw_recv_entry(union recv_frame *precv_frame);	
+extern int rtw_recv_indicatepkt(_adapter *adapter, union recv_frame *precv_frame);
+extern void rtw_recv_returnpacket(IN _nic_hdl cnxt, IN _pkt *preturnedpkt);
+
+extern void rtw_hostapd_mlme_rx(_adapter *padapter, union recv_frame *precv_frame);
+extern void rtw_handle_tkip_mic_err(_adapter *padapter,u8 bgroup);
+		
+
+int	rtw_init_recv_priv(struct recv_priv *precvpriv, _adapter *padapter);
+void rtw_free_recv_priv (struct recv_priv *precvpriv);
+
+
+int rtw_os_recv_resource_init(struct recv_priv *precvpriv, _adapter *padapter);
+int rtw_os_recv_resource_alloc(_adapter *padapter, union recv_frame *precvframe);
+void rtw_os_recv_resource_free(struct recv_priv *precvpriv);
+
+
+int rtw_os_recvbuf_resource_alloc(_adapter *padapter, struct recv_buf *precvbuf);
+int rtw_os_recvbuf_resource_free(_adapter *padapter, struct recv_buf *precvbuf);
+
+void rtw_os_read_port(_adapter *padapter, struct recv_buf *precvbuf);
+
+void rtw_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl);
+
+
+#endif //
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h
new file mode 100755
index 0000000000000..c54cc31334e3a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h
@@ -0,0 +1,153 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_CMD_H_
+#define __RTL8192C_CMD_H_
+
+
+enum cmd_msg_element_id
+{	
+	NONE_CMDMSG_EID,
+	AP_OFFLOAD_EID=0,
+	SET_PWRMODE_EID=1,
+	JOINBSS_RPT_EID=2,
+	RSVD_PAGE_EID=3,
+	RSSI_4_EID = 4,
+	RSSI_SETTING_EID=5,
+	MACID_CONFIG_EID=6,
+	MACID_PS_MODE_EID=7,
+	P2P_PS_OFFLOAD_EID=8,
+	SELECTIVE_SUSPEND_ROF_CMD=9,
+#ifdef CONFIG_WOWLAN
+	H2C_WO_WLAN_CMD = 26,	// Wake on Wlan.
+	EXT_MACID_PERIOD_EID = 27,	// support macid to 64
+	MACID64_CONFIG_EID = 28,	// support macid to 64
+#endif // CONFIG_WOWLAN
+	P2P_PS_CTW_CMD_EID=32,
+	H2C_92C_IO_OFFLOAD=44,
+#ifdef CONFIG_WOWLAN
+	KEEP_ALIVE_CONTROL_CMD=48,
+	DISCONNECT_DECISION_CTRL_CMD=49,
+	REMOTE_WAKE_CTRL_CMD=60,
+#endif // CONFIG_WOWLAN
+	H2C_92C_TSF_SYNC=67,
+	H2C_92C_DISABLE_BCN_FUNC=68,
+	H2C_92C_RESET_TSF = 75,
+	H2C_92C_CMD_MAX
+};
+
+struct cmd_msg_parm {
+	u8 eid; //element id
+	u8 sz; // sz
+	u8 buf[6];
+};
+
+typedef struct _SETPWRMODE_PARM{
+	u8 	Mode;
+	u8 	SmartPS;
+	u8	BcnPassTime;	// unit: 100ms
+}SETPWRMODE_PARM, *PSETPWRMODE_PARM;
+
+#ifdef CONFIG_WOWLAN
+typedef struct _SETWOWLAN_PARM{
+	u8 	mode;
+	u8 	gpio_index;
+	u8	gpio_duration;	
+	u8  second_mode;
+	u8  reserve;
+}SETWOWLAN_PARM, *PSETWOWLAN_PARM;
+
+#define FW_WOWLAN_FUN_EN			BIT(0)
+#define FW_WOWLAN_PATTERN_MATCH		BIT(1)
+#define FW_WOWLAN_MAGIC_PKT			BIT(2)
+#define FW_WOWLAN_UNICAST			BIT(3)
+#define FW_WOWLAN_ALL_PKT_DROP		BIT(4)
+#define FW_WOWLAN_GPIO_ACTIVE		BIT(5)
+#define FW_WOWLAN_REKEY_WAKEUP		BIT(6)
+#define FW_WOWLAN_DEAUTH_WAKEUP		BIT(7)
+
+#define FW_WOWLAN_GPIO_WAKEUP_EN	BIT(0)
+#define FW_FW_PARSE_MAGIC_PKT		BIT(1)
+#endif // CONFIG_WOWLAN
+
+struct H2C_SS_RFOFF_PARAM{
+	u8 	ROFOn; // 1: on, 0:off
+	u16	gpio_period; // unit: 1024 us
+}__attribute__ ((packed));
+
+
+typedef struct JOINBSSRPT_PARM{
+	u8	OpMode;	// RT_MEDIA_STATUS
+}JOINBSSRPT_PARM, *PJOINBSSRPT_PARM;
+
+typedef struct _RSVDPAGE_LOC{
+	u8 	LocProbeRsp;
+	u8 	LocPsPoll;
+	u8	LocNullData;
+}RSVDPAGE_LOC, *PRSVDPAGE_LOC;
+
+struct P2P_PS_Offload_t {
+ unsigned char Offload_En:1;
+ unsigned char role:1; // 1: Owner, 0: Client
+ unsigned char CTWindow_En:1;
+ unsigned char NoA0_En:1;
+ unsigned char NoA1_En:1;
+ unsigned char AllStaSleep:1; // Only valid in Owner
+ unsigned char discovery:1;
+ unsigned char rsvd:1;
+};
+
+struct P2P_PS_CTWPeriod_t {
+    unsigned char CTWPeriod;	//TU
+};
+
+// host message to firmware cmd
+void	rtl8192c_set_FwPwrMode_cmd(_adapter*padapter, u8 Mode);
+void	rtl8192c_set_FwJoinBssReport_cmd(_adapter* padapter, u8 mstatus);
+u8	rtl8192c_set_rssi_cmd(_adapter*padapter, u8 *param);
+u8	rtl8192c_set_raid_cmd(_adapter*padapter, u32 mask, u8 arg);
+void	rtl8192c_Add_RateATid(PADAPTER pAdapter, u32 bitmap, u8 arg);
+u8	rtl8192c_set_FwSelectSuspend_cmd(_adapter*padapter,u8 bfwpoll, u16 period);
+#ifdef CONFIG_P2P
+void	rtl8192c_set_p2p_ps_offload_cmd(_adapter* padapter, u8 p2p_ps_state);
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_IOL
+typedef struct _IO_OFFLOAD_LOC{
+	u8 	LocCmd;
+}IO_OFFLOAD_LOC, *PIO_OFFLOAD_LOC;
+int rtl8192c_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+#endif //CONFIG_IOL
+
+#ifdef CONFIG_BEACON_DISABLE_OFFLOAD
+u8 rtl8192c_dis_beacon_fun_cmd(_adapter* padapter);
+#endif  // CONFIG_BEACON_DISABLE_OFFLOAD
+
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+int reset_tsf(PADAPTER Adapter, u8 reset_port );
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+#ifdef CONFIG_WOWLAN
+void rtl8192c_set_wowlan_cmd(_adapter* padapter);
+void SetFwRelatedForWoWLAN8192CU(_adapter* 	padapter,u8 bHostIsGoingtoSleep);
+#endif // CONFIG_WOWLAN
+
+#endif	// __RTL8192C_CMD_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h
new file mode 100755
index 0000000000000..9d065405ecbc3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h
@@ -0,0 +1,516 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__RTL8192C_DM_H__
+#define __RTL8192C_DM_H__
+//============================================================
+// Description:
+//
+// This file is for 92CE/92CU dynamic mechanism only
+//
+//
+//============================================================
+
+#define	RSSI_CCK		0
+#define	RSSI_OFDM		1
+#define	RSSI_DEFAULT	2
+
+//============================================================
+// structure and define
+//============================================================
+
+typedef struct _FALSE_ALARM_STATISTICS{
+	u32	Cnt_Parity_Fail;
+	u32	Cnt_Rate_Illegal;
+	u32	Cnt_Crc8_fail;
+	u32	Cnt_Mcs_fail;
+	u32	Cnt_Ofdm_fail;
+	u32	Cnt_Cck_fail;
+	u32	Cnt_all;
+	u32	Cnt_Fast_Fsync;
+	u32	Cnt_SB_Search_fail;
+}FALSE_ALARM_STATISTICS, *PFALSE_ALARM_STATISTICS;
+
+typedef struct _Dynamic_Power_Saving_
+{
+	u8		PreCCAState;
+	u8		CurCCAState;
+
+	u8		PreRFState;
+	u8		CurRFState;
+
+	s32		Rssi_val_min;
+	
+}PS_T;
+
+typedef struct _Dynamic_Initial_Gain_Threshold_
+{
+	u8		Dig_Enable_Flag;
+	u8		Dig_Ext_Port_Stage;
+
+	int		RssiLowThresh;
+	int		RssiHighThresh;
+
+	u32		FALowThresh;
+	u32		FAHighThresh;
+
+	u8		CurSTAConnectState;
+	u8		PreSTAConnectState;
+	u8		CurMultiSTAConnectState;
+
+	u8		PreIGValue;
+	u8		CurIGValue;
+	u8		BackupIGValue;
+
+	char		BackoffVal;
+	char		BackoffVal_range_max;
+	char		BackoffVal_range_min;
+	u8		rx_gain_range_max;
+	u8		rx_gain_range_min;
+	u8		Rssi_val_min;
+
+	u8		PreCCKPDState;
+	u8		CurCCKPDState;
+        u8		PreCCKFAState;
+	u8		CurCCKFAState;
+	u8		PreCCAState;
+	u8		CurCCAState;
+
+	u8		LargeFAHit;
+	u8		ForbiddenIGI;
+	u32		Recover_cnt;
+	u8		rx_gain_range_min_nolink;
+
+}DIG_T;
+
+typedef enum tag_Dynamic_Init_Gain_Operation_Type_Definition
+{
+	DIG_TYPE_THRESH_HIGH	= 0,
+	DIG_TYPE_THRESH_LOW	= 1,
+	DIG_TYPE_BACKOFF		= 2,
+	DIG_TYPE_RX_GAIN_MIN	= 3,
+	DIG_TYPE_RX_GAIN_MAX	= 4,
+	DIG_TYPE_ENABLE 		= 5,
+	DIG_TYPE_DISABLE 		= 6,
+	DIG_OP_TYPE_MAX
+}DM_DIG_OP_E;
+
+typedef enum tag_CCK_Packet_Detection_Threshold_Type_Definition
+{
+	CCK_PD_STAGE_LowRssi = 0,
+	CCK_PD_STAGE_HighRssi = 1,
+	CCK_PD_STAGE_MAX = 3,
+}DM_CCK_PDTH_E;
+
+typedef enum tag_1R_CCA_Type_Definition
+{
+	CCA_1R =0,
+	CCA_2R = 1,
+	CCA_MAX = 2,
+}DM_1R_CCA_E;
+
+typedef enum tag_RF_Type_Definition
+{
+	RF_Save =0,
+	RF_Normal = 1,
+	RF_MAX = 2,
+}DM_RF_E;
+
+typedef enum tag_DIG_EXT_PORT_ALGO_Definition
+{
+	DIG_EXT_PORT_STAGE_0 = 0,
+	DIG_EXT_PORT_STAGE_1 = 1,
+	DIG_EXT_PORT_STAGE_2 = 2,
+	DIG_EXT_PORT_STAGE_3 = 3,
+	DIG_EXT_PORT_STAGE_MAX = 4,
+}DM_DIG_EXT_PORT_ALG_E;
+
+
+typedef enum tag_DIG_Connect_Definition
+{
+	DIG_STA_DISCONNECT = 0,	
+	DIG_STA_CONNECT = 1,
+	DIG_STA_BEFORE_CONNECT = 2,
+	DIG_MultiSTA_DISCONNECT = 3,
+	DIG_MultiSTA_CONNECT = 4,
+	DIG_CONNECT_MAX
+}DM_DIG_CONNECT_E;
+
+
+
+typedef	enum _BT_Ant_NUM{
+	Ant_x2	= 0,		
+	Ant_x1	= 1
+} BT_Ant_NUM, *PBT_Ant_NUM;
+
+typedef	enum _BT_CoType{
+	BT_2Wire		= 0,		
+	BT_ISSC_3Wire	= 1,
+	BT_Accel		= 2,
+	BT_CSR_BC4		= 3,
+	BT_CSR_BC8		= 4,
+	BT_RTL8756		= 5,
+} BT_CoType, *PBT_CoType;
+
+typedef	enum _BT_CurState{
+	BT_OFF		= 0,	
+	BT_ON		= 1,
+} BT_CurState, *PBT_CurState;
+
+typedef	enum _BT_ServiceType{
+	BT_SCO		= 0,	
+	BT_A2DP		= 1,
+	BT_HID		= 2,
+	BT_HID_Idle	= 3,
+	BT_Scan		= 4,
+	BT_Idle		= 5,
+	BT_OtherAction	= 6,
+	BT_Busy			= 7,
+	BT_OtherBusy		= 8,
+	BT_PAN			= 9,
+} BT_ServiceType, *PBT_ServiceType;
+
+typedef	enum _BT_RadioShared{
+	BT_Radio_Shared 	= 0,	
+	BT_Radio_Individual	= 1,
+} BT_RadioShared, *PBT_RadioShared;
+
+struct btcoexist_priv	{
+	u8					BT_Coexist;
+	u8					BT_Ant_Num;
+	u8					BT_CoexistType;
+	u8					BT_State;
+	u8					BT_CUR_State;		//0:on, 1:off
+	u8					BT_Ant_isolation;	//0:good, 1:bad
+	u8					BT_PapeCtrl;		//0:SW, 1:SW/HW dynamic
+	u8					BT_Service;
+	u8					BT_Ampdu;	// 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU.
+	u8					BT_RadioSharedType;
+	u32					Ratio_Tx;
+	u32					Ratio_PRI;
+	u8					BtRfRegOrigin1E;
+	u8					BtRfRegOrigin1F;
+	u8					BtRssiState;
+	u32					BtEdcaUL;
+	u32					BtEdcaDL;
+	u32					BT_EDCA[2];
+	u8					bCOBT;
+
+	u8					bInitSet;
+	u8					bBTBusyTraffic;
+	u8					bBTTrafficModeSet;
+	u8					bBTNonTrafficModeSet;
+	//BTTraffic				BT21TrafficStatistics;
+	u32					CurrentState;
+	u32					PreviousState;
+	u8					BtPreRssiState;
+	u8					bFWCoexistAllOff;
+	u8					bSWCoexistAllOff;
+};
+
+#define		BW_AUTO_SWITCH_HIGH_LOW	25
+#define		BW_AUTO_SWITCH_LOW_HIGH	30
+
+#define		DM_DIG_THRESH_HIGH			40
+#define		DM_DIG_THRESH_LOW			35
+
+#define		DM_FALSEALARM_THRESH_LOW	400
+#define		DM_FALSEALARM_THRESH_HIGH	1000
+
+#define		DM_DIG_MAX					0x3e
+#define		DM_DIG_MIN					0x1e //0x22//0x1c
+
+#define		DM_DIG_FA_UPPER				0x3e
+#define		DM_DIG_FA_LOWER				0x20
+#define		DM_DIG_FA_TH0					0x20
+#define		DM_DIG_FA_TH1					0x100
+#define		DM_DIG_FA_TH2					0x200
+
+#define		DM_DIG_BACKOFF_MAX			12
+#define		DM_DIG_BACKOFF_MIN			(-4)
+#define		DM_DIG_BACKOFF_DEFAULT		10
+
+#define		RxPathSelection_SS_TH_low		30
+#define		RxPathSelection_diff_TH			18
+
+#define		DM_RATR_STA_INIT			0
+#define		DM_RATR_STA_HIGH			1
+#define 		DM_RATR_STA_MIDDLE		2
+#define 		DM_RATR_STA_LOW			3
+
+#define		CTSToSelfTHVal					30
+#define		RegC38_TH						20
+
+#define		WAIotTHVal						25
+
+//Dynamic Tx Power Control Threshold
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL2	74
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL1	67
+
+#define		TxHighPwrLevel_Normal		0	
+#define		TxHighPwrLevel_Level1		1
+#define		TxHighPwrLevel_Level2		2
+#define		TxHighPwrLevel_BT1			3
+#define		TxHighPwrLevel_BT2			4
+#define		TxHighPwrLevel_15			5
+#define		TxHighPwrLevel_35			6
+#define		TxHighPwrLevel_50			7
+#define		TxHighPwrLevel_70			8
+#define		TxHighPwrLevel_100			9
+
+#define		DM_Type_ByFW			0
+#define		DM_Type_ByDriver		1
+
+
+typedef struct _RATE_ADAPTIVE
+{
+	u8				RateAdaptiveDisabled;
+	u8				RATRState;
+	u16				reserve;	
+	
+	u32				HighRSSIThreshForRA;
+	u32				High2LowRSSIThreshForRA;
+	u8				Low2HighRSSIThreshForRA40M;
+	u32				LowRSSIThreshForRA40M;	
+	u8				Low2HighRSSIThreshForRA20M;
+	u32				LowRSSIThreshForRA20M;	
+	u32				UpperRSSIThresholdRATR;
+	u32				MiddleRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR40M;
+	u32				LowRSSIThresholdRATR20M;
+	u8				PingRSSIEnable;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIRATR;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIThreshForRA;//cosa add for Netcore long range ping issue
+	u32				LastRATR;
+	u8				PreRATRState;
+	
+} RATE_ADAPTIVE, *PRATE_ADAPTIVE;
+
+typedef enum tag_SW_Antenna_Switch_Definition
+{
+	Antenna_B = 1,
+	Antenna_A = 2,
+	Antenna_MAX = 3,
+}DM_SWAS_E;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+// This indicates two different the steps. 
+// In SWAW_STEP_PEAK, driver needs to switch antenna and listen to the signal on the air.
+// In SWAW_STEP_DETERMINE, driver just compares the signal captured in SWAW_STEP_PEAK
+// with original RSSI to determine if it is necessary to switch antenna.
+#define SWAW_STEP_PEAK		0
+#define SWAW_STEP_DETERMINE	1
+
+#define	TP_MODE		0
+#define	RSSI_MODE		1
+#define	TRAFFIC_LOW	0
+#define	TRAFFIC_HIGH	1
+
+typedef struct _SW_Antenna_Switch_
+{
+	u8		try_flag;
+	s32		PreRSSI;
+	u8		CurAntenna;
+	u8		PreAntenna;
+	u8		RSSI_Trying;
+	u8		TestMode;
+	u8		bTriggerAntennaSwitch;
+	u8		SelectAntennaMap;
+	// Before link Antenna Switch check
+	u8		SWAS_NoLink_State;
+
+}SWAT_T;
+
+
+#endif
+
+
+struct 	dm_priv	
+{
+	u8	DM_Type;
+	u8	DMFlag, DMFlag_tmp;
+	
+
+	//for DIG
+	u8	bDMInitialGainEnable;
+	u8	binitialized; // for dm_initial_gain_Multi_STA use.
+	DIG_T	DM_DigTable;
+
+	PS_T	DM_PSTable;
+
+	FALSE_ALARM_STATISTICS FalseAlmCnt;
+	
+	//for rate adaptive, in fact,  88c/92c fw will handle this
+	u8 bUseRAMask;
+	RATE_ADAPTIVE RateAdaptive;
+
+	//* Upper and Lower Signal threshold for Rate Adaptive*/
+	int	UndecoratedSmoothedPWDB;
+	int	UndecoratedSmoothedCCK;
+	int	EntryMinUndecoratedSmoothedPWDB;
+	int	EntryMaxUndecoratedSmoothedPWDB;
+
+
+	//for High Power
+	u8 bDynamicTxPowerEnable;
+	u8 LastDTPLvl;
+	u8 DynamicTxHighPowerLvl;//Add by Jacken Tx Power Control for Near/Far Range 2008/03/06
+		
+	//for tx power tracking
+	//u8	bTXPowerTracking;
+	u8	TXPowercount;
+	u8	bTXPowerTrackingInit;	
+	u8	TxPowerTrackControl;	//for mp mode, turn off txpwrtracking as default
+	u8	TM_Trigger;
+
+	u8	ThermalMeter[2];				// ThermalMeter, index 0 for RFIC0, and 1 for RFIC1
+	u8	ThermalValue;
+	u8	ThermalValue_LCK;
+	u8	ThermalValue_IQK;
+	u8	ThermalValue_DPK;
+
+	u8	bRfPiEnable;
+
+	//for APK
+	u32	APKoutput[2][2];	//path A/B; output1_1a/output1_2a
+	u8	bAPKdone;
+	u8	bAPKThermalMeterIgnore;
+	u8	bDPdone;
+	u8	bDPPathAOK;
+	u8	bDPPathBOK;
+
+	//for IQK
+	u32	RegC04;
+	u32	Reg874;
+	u32	RegC08;
+	u32	RegB68;
+	u32	RegB6C;
+	u32	Reg870;
+	u32	Reg860;
+	u32	Reg864;
+	u32	ADDA_backup[IQK_ADDA_REG_NUM];
+	u32	IQK_MAC_backup[IQK_MAC_REG_NUM];
+	u32	IQK_BB_backup_recover[9];
+	u32	IQK_BB_backup[IQK_BB_REG_NUM];
+	u8	PowerIndex_backup[6];
+
+	u8	bCCKinCH14;
+
+	char	CCK_index;
+	char	OFDM_index[2];
+
+	BOOLEAN		bDoneTxpower;
+	char	CCK_index_HP;
+	char	OFDM_index_HP[2];
+	u8	ThermalValue_HP[HP_THERMAL_NUM];
+	u8	ThermalValue_HP_index;
+
+	//for TxPwrTracking
+	int	RegE94;
+	int 	RegE9C;
+	int	RegEB4;
+	int	RegEBC;
+
+	u32	TXPowerTrackingCallbackCnt;	//cosa add for debug
+
+	u32	prv_traffic_idx; // edca turbo
+
+	// for dm_RF_Saving
+	u8	initialize;
+	u32	rf_saving_Reg874;
+	u32	rf_saving_RegC70;
+	u32	rf_saving_Reg85C;
+	u32	rf_saving_RegA74;
+
+	//for Antenna diversity
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	SWAT_T DM_SWAT_Table;
+#endif	
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	_timer SwAntennaSwitchTimer;
+	
+	u64	lastTxOkCnt;
+	u64	lastRxOkCnt;
+	u64	TXByteCnt_A;
+	u64	TXByteCnt_B;
+	u64	RXByteCnt_A;
+	u64	RXByteCnt_B;
+	u8	DoubleComfirm;
+	u8	TrafficLoad;
+#endif
+
+	s32	OFDM_Pkt_Cnt;
+	u8	RSSI_Select;
+	u8 	DIG_Dynamic_MIN ;
+
+	// Add for Reading Initial Data Rate SEL Register 0x484 during watchdog. Using for fill tx desc. 2011.3.21 by Thomas
+	u8	INIDATA_RATE[32];
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	/* Ported from ODM, for ESTI Adaptivity test */
+	s8 TH_L2H_ini;
+	s8 TH_EDCCA_HL_diff;
+	s8 IGI_Base;
+	u8 IGI_target;
+	bool ForceEDCCA;
+	u8 AdapEn_RSSI;
+	s8 Force_TH_H;
+	s8 Force_TH_L;
+	u8 IGI_LowerBound;
+
+	bool	bPreEdccaEnable;
+#endif
+};
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+//#define DM_MultiSTA_InitGainChangeNotify(Event) {DM_DigTable.CurMultiSTAConnectState = Event;}
+
+
+//============================================================
+// function prototype
+//============================================================
+void rtl8192c_init_dm_priv(IN PADAPTER Adapter);
+void rtl8192c_deinit_dm_priv(IN PADAPTER Adapter);
+void rtl8192c_InitHalDm(IN PADAPTER Adapter);
+void rtl8192c_HalDmWatchDog(IN PADAPTER Adapter);
+
+VOID rtl8192c_dm_CheckTXPowerTracking(IN PADAPTER Adapter);
+
+void rtl8192c_dm_RF_Saving(IN PADAPTER pAdapter, IN u8 bForceInNormal);
+
+#ifdef CONFIG_BT_COEXIST
+void rtl8192c_set_dm_bt_coexist(_adapter *padapter, u8 bStart);
+void rtl8192c_issue_delete_ba(_adapter *padapter, u8 dir);
+#endif
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+void SwAntDivRSSICheck8192C(_adapter *padapter ,u32 RxPWDBAll); 
+void SwAntDivRestAfterLink8192C(IN	PADAPTER Adapter);
+#endif
+#ifdef CONFIG_ANTENNA_DIVERSITY
+void	SwAntDivCompare8192C(PADAPTER Adapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src);
+u8 SwAntDivBeforeLink8192C(IN PADAPTER Adapter);
+#endif
+
+#endif	//__HAL8190PCIDM_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h
new file mode 100755
index 0000000000000..1013f74a0be3f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h
@@ -0,0 +1,28 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_EVENT_H_
+#define _RTL8192C_EVENT_H_
+
+
+
+
+#endif
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h
new file mode 100755
index 0000000000000..3348971c8018d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h
@@ -0,0 +1,937 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_HAL_H__
+#define __RTL8192C_HAL_H__
+
+#include "hal_com.h"
+#include "rtl8192c_spec.h"
+#include "Hal8192CPhyReg.h"
+#include "Hal8192CPhyCfg.h"
+#include "rtl8192c_rf.h"
+#include "rtl8192c_dm.h"
+#include "rtl8192c_recv.h"
+#include "rtl8192c_xmit.h"
+#include "rtl8192c_cmd.h"
+#ifdef DBG_CONFIG_ERROR_DETECT
+#include "rtl8192c_sreset.h"
+#endif
+
+#ifdef CONFIG_PCI_HCI
+
+	#include "Hal8192CEHWImg.h"
+
+	#define RTL819X_DEFAULT_RF_TYPE			RF_2T2R
+	//#define RTL819X_DEFAULT_RF_TYPE			RF_1T2R
+	#define RTL819X_TOTAL_RF_PATH				2
+
+	//2TODO:  The following need to check!!
+	#define RTL8192C_FW_TSMC_IMG				"rtl8192CE\\rtl8192cfwT.bin"
+	#define RTL8192C_FW_UMC_IMG				"rtl8192CE\\rtl8192cfwU.bin"
+	#define RTL8192C_FW_UMC_B_IMG				"rtl8192CE\\rtl8192cfwU_B.bin"
+
+	#define RTL8188C_PHY_REG					"rtl8192CE\\PHY_REG_1T.txt"
+	#define RTL8188C_PHY_RADIO_A				"rtl8192CE\\radio_a_1T.txt"
+	#define RTL8188C_PHY_RADIO_B				"rtl8192CE\\radio_b_1T.txt"
+	#define RTL8188C_AGC_TAB					"rtl8192CE\\AGC_TAB_1T.txt"
+	#define RTL8188C_PHY_MACREG				"rtl8192CE\\MACREG_1T.txt"
+
+	#define RTL8192C_PHY_REG					"rtl8192CE\\PHY_REG_2T.txt"
+	#define RTL8192C_PHY_RADIO_A				"rtl8192CE\\radio_a_2T.txt"
+	#define RTL8192C_PHY_RADIO_B				"rtl8192CE\\radio_b_2T.txt"
+	#define RTL8192C_AGC_TAB					"rtl8192CE\\AGC_TAB_2T.txt"
+	#define RTL8192C_PHY_MACREG				"rtl8192CE\\MACREG_2T.txt"
+
+	#define RTL819X_PHY_MACPHY_REG			"rtl8192CE\\MACPHY_reg.txt"
+	#define RTL819X_PHY_MACPHY_REG_PG		"rtl8192CE\\MACPHY_reg_PG.txt"
+	#define RTL819X_PHY_MACREG				"rtl8192CE\\MAC_REG.txt"
+	#define RTL819X_PHY_REG					"rtl8192CE\\PHY_REG.txt"
+	#define RTL819X_PHY_REG_1T2R				"rtl8192CE\\PHY_REG_1T2R.txt"
+	#define RTL819X_PHY_REG_to1T1R				"rtl8192CE\\phy_to1T1R_a.txt"
+	#define RTL819X_PHY_REG_to1T2R				"rtl8192CE\\phy_to1T2R.txt"
+	#define RTL819X_PHY_REG_to2T2R				"rtl8192CE\\phy_to2T2R.txt"
+	#define RTL819X_PHY_REG_PG					"rtl8192CE\\PHY_REG_PG.txt"
+	#define RTL819X_AGC_TAB					"rtl8192CE\\AGC_TAB.txt"
+	#define RTL819X_PHY_RADIO_A				"rtl8192CE\\radio_a.txt"
+	#define RTL819X_PHY_RADIO_A_1T			"rtl8192CE\\radio_a_1t.txt"
+	#define RTL819X_PHY_RADIO_A_2T			"rtl8192CE\\radio_a_2t.txt"
+	#define RTL819X_PHY_RADIO_B				"rtl8192CE\\radio_b.txt"
+	#define RTL819X_PHY_RADIO_B_GM			"rtl8192CE\\radio_b_gm.txt"
+	#define RTL819X_PHY_RADIO_C				"rtl8192CE\\radio_c.txt"
+	#define RTL819X_PHY_RADIO_D				"rtl8192CE\\radio_d.txt"
+	#define RTL819X_EEPROM_MAP				"rtl8192CE\\8192ce.map"
+	#define RTL819X_EFUSE_MAP					"rtl8192CE\\8192ce.map"
+
+//---------------------------------------------------------------------
+//		RTL8723E From file
+//---------------------------------------------------------------------
+	#define RTL8723_FW_UMC_IMG				"rtl8723E\\rtl8723fw.bin"
+	#define RTL8723_PHY_REG					"rtl8723E\\PHY_REG_1T.txt" 
+	#define RTL8723_PHY_RADIO_A				"rtl8723E\\radio_a_1T.txt"
+	#define RTL8723_PHY_RADIO_B				"rtl8723E\\radio_b_1T.txt" 
+	#define RTL8723_AGC_TAB					"rtl8723E\\AGC_TAB_1T.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723E\\MAC_REG.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723E\\MAC_REG.txt"
+	#define RTL8723_PHY_REG_PG					"rtl8723E\\PHY_REG_PG.txt"
+	#define RTL8723_PHY_REG_MP 				"rtl8723E\\PHY_REG_MP.txt" 	
+
+	// The file name "_2T" is for 92CE, "_1T"  is for 88CE. Modified by tynli. 2009.11.24.
+	#define Rtl819XFwTSMCImageArray			Rtl8192CEFwTSMCImgArray
+	#define Rtl819XFwUMCACutImageArray			Rtl8192CEFwUMCACutImgArray
+	#define Rtl819XFwUMCBCutImageArray			Rtl8192CEFwUMCBCutImgArray
+	
+	#define Rtl8723FwUMCImageArray				Rtl8192CEFwUMC8723ImgArray
+	#define Rtl819XMAC_Array					Rtl8192CEMAC_2T_Array
+	#define Rtl819XAGCTAB_2TArray				Rtl8192CEAGCTAB_2TArray
+	#define Rtl819XAGCTAB_1TArray				Rtl8192CEAGCTAB_1TArray
+	#define Rtl819XPHY_REG_2TArray				Rtl8192CEPHY_REG_2TArray
+	#define Rtl819XPHY_REG_1TArray				Rtl8192CEPHY_REG_1TArray
+	#define Rtl819XRadioA_2TArray				Rtl8192CERadioA_2TArray
+	#define Rtl819XRadioA_1TArray				Rtl8192CERadioA_1TArray
+	#define Rtl819XRadioB_2TArray				Rtl8192CERadioB_2TArray
+	#define Rtl819XRadioB_1TArray				Rtl8192CERadioB_1TArray
+	#define Rtl819XPHY_REG_Array_PG 			Rtl8192CEPHY_REG_Array_PG
+	#define Rtl819XPHY_REG_Array_MP 			Rtl8192CEPHY_REG_Array_MP
+
+#elif defined(CONFIG_USB_HCI)
+
+	#include "Hal8192CUHWImg.h"
+#ifdef CONFIG_WOWLAN
+	#include "Hal8192CUHWImg_wowlan.h"
+#endif //CONFIG_WOWLAN
+	//2TODO: We should define 8192S firmware related macro settings here!!
+	#define RTL819X_DEFAULT_RF_TYPE			RF_1T2R
+	#define RTL819X_TOTAL_RF_PATH				2
+
+	//TODO:  The following need to check!!
+	#define RTL8192C_FW_TSMC_IMG				"rtl8192CU\\rtl8192cfwT.bin"
+	#define RTL8192C_FW_UMC_IMG				"rtl8192CU\\rtl8192cfwU.bin"
+	#define RTL8192C_FW_UMC_B_IMG				"rtl8192CU\\rtl8192cfwU_B.bin"
+#ifdef CONFIG_WOWLAN
+	#define 	RTL8192C_FW_TSMC_WW_IMG			"rtl8192CU\\rtl8192cfwTww.bin"
+	#define 	RTL8192C_FW_UMC_WW_IMG			"rtl8192CU\\rtl8192cfwUww.bin"
+	#define 	RTL8192C_FW_UMC_B_WW_IMG		"rtl8192CU\\rtl8192cfwU_Bww.bin"
+#endif // CONFIG_WOWLAN
+	//#define RTL819X_FW_BOOT_IMG   				"rtl8192CU\\boot.img"
+	//#define RTL819X_FW_MAIN_IMG				"rtl8192CU\\main.img"
+	//#define RTL819X_FW_DATA_IMG				"rtl8192CU\\data.img"
+
+	#define RTL8188C_PHY_REG					"rtl8188CU\\PHY_REG.txt"
+	#define RTL8188C_PHY_RADIO_A				"rtl8188CU\\radio_a.txt"
+	#define RTL8188C_PHY_RADIO_B				"rtl8188CU\\radio_b.txt"
+	#define RTL8188C_PHY_RADIO_A_mCard		"rtl8192CU\\radio_a_1T_mCard.txt"
+	#define RTL8188C_PHY_RADIO_B_mCard		"rtl8192CU\\radio_b_1T_mCard.txt" 
+	#define RTL8188C_PHY_RADIO_A_HP			"rtl8192CU\\radio_a_1T_HP.txt"
+	#define RTL8188C_AGC_TAB					"rtl8188CU\\AGC_TAB.txt"
+	#define RTL8188C_PHY_MACREG				"rtl8188CU\\MACREG.txt"
+
+	#define RTL8192C_PHY_REG					"rtl8192CU\\PHY_REG.txt"
+	#define RTL8192C_PHY_RADIO_A				"rtl8192CU\\radio_a.txt"
+	#define RTL8192C_PHY_RADIO_B				"rtl8192CU\\radio_b.txt"
+	#define RTL8192C_AGC_TAB					"rtl8192CU\\AGC_TAB.txt"
+	#define RTL8192C_PHY_MACREG				"rtl8192CU\\MACREG.txt"
+
+	#define RTL819X_PHY_REG_PG					"rtl8192CU\\PHY_REG_PG.txt"
+
+//---------------------------------------------------------------------
+//		RTL8723U From file
+//---------------------------------------------------------------------
+	#define RTL8723_FW_UMC_IMG				"rtl8723U\\rtl8723fw.bin"
+	#define RTL8723_PHY_REG					"rtl8723U\\PHY_REG_1T.txt" 
+	#define RTL8723_PHY_RADIO_A				"rtl8723U\\radio_a_1T.txt"
+	#define RTL8723_PHY_RADIO_B				"rtl8723U\\radio_b_1T.txt" 
+	#define RTL8723_AGC_TAB					"rtl8723U\\AGC_TAB_1T.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723U\\MAC_REG.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723U\\MAC_REG.txt"
+	#define RTL8723_PHY_REG_PG					"rtl8723U\\PHY_REG_PG.txt"
+	#define RTL8723_PHY_REG_MP					"rtl8723U\\PHY_REG_MP.txt"	
+
+	// The file name "_2T" is for 92CU, "_1T"  is for 88CU. Modified by tynli. 2009.11.24.
+	#define Rtl819XFwImageArray					Rtl8192CUFwTSMCImgArray
+	#define Rtl819XFwTSMCImageArray			Rtl8192CUFwTSMCImgArray
+	#define Rtl819XFwUMCACutImageArray			Rtl8192CUFwUMCACutImgArray
+	#define Rtl819XFwUMCBCutImageArray			Rtl8192CUFwUMCBCutImgArray
+#ifdef CONFIG_WOWLAN
+	#define Rtl8192C_FwTSMCWWImageArray		Rtl8192CUFwTSMCWWImgArray
+	#define Rtl8192C_FwUMCWWImageArray		Rtl8192CUFwUMCACutWWImgArray
+	#define Rtl8192C_FwUMCBCutWWImageArray	Rtl8192CUFwUMCBCutWWImgArray		
+#endif //CONFIG_WOWLAN
+	#define Rtl819XMAC_Array					Rtl8192CUMAC_2T_Array
+	#define Rtl819XAGCTAB_2TArray				Rtl8192CUAGCTAB_2TArray
+	#define Rtl819XAGCTAB_1TArray				Rtl8192CUAGCTAB_1TArray
+	#define Rtl819XAGCTAB_1T_HPArray			Rtl8192CUAGCTAB_1T_HPArray
+	#define Rtl819XPHY_REG_2TArray				Rtl8192CUPHY_REG_2TArray
+	#define Rtl819XPHY_REG_1TArray				Rtl8192CUPHY_REG_1TArray
+	#define Rtl819XPHY_REG_1T_mCardArray		Rtl8192CUPHY_REG_1T_mCardArray 					
+	#define Rtl819XPHY_REG_2T_mCardArray		Rtl8192CUPHY_REG_2T_mCardArray	
+	#define Rtl819XPHY_REG_1T_HPArray			Rtl8192CUPHY_REG_1T_HPArray
+	#define Rtl819XRadioA_2TArray				Rtl8192CURadioA_2TArray
+	#define Rtl819XRadioA_1TArray				Rtl8192CURadioA_1TArray
+	#define Rtl819XRadioA_1T_mCardArray		Rtl8192CURadioA_1T_mCardArray			
+	#define Rtl819XRadioB_2TArray				Rtl8192CURadioB_2TArray
+	#define Rtl819XRadioB_1TArray				Rtl8192CURadioB_1TArray	
+	#define Rtl819XRadioB_1T_mCardArray		Rtl8192CURadioB_1T_mCardArray
+	#define Rtl819XRadioA_1T_HPArray			Rtl8192CURadioA_1T_HPArray	
+	#define Rtl819XPHY_REG_Array_PG 			Rtl8192CUPHY_REG_Array_PG
+	#define Rtl819XPHY_REG_Array_PG_mCard 		Rtl8192CUPHY_REG_Array_PG_mCard			
+	#define Rtl819XPHY_REG_Array_PG_HP			Rtl8192CUPHY_REG_Array_PG_HP
+	#define Rtl819XPHY_REG_Array_MP 			Rtl8192CUPHY_REG_Array_MP
+#endif
+
+#define DRVINFO_SZ	4 // unit is 8bytes
+#define PageNum_128(_Len)		(u32)(((_Len)>>7) + ((_Len)&0x7F ? 1:0))
+
+#define FW_8192C_SIZE					16384+32//16k
+#define FW_8192C_START_ADDRESS		0x1000
+//#define FW_8192C_END_ADDRESS		0x3FFF //Filen said this is for test chip
+#define FW_8192C_END_ADDRESS		0x1FFF
+
+#define MAX_PAGE_SIZE			4096	// @ page : 4k bytes
+
+#define IS_FW_HEADER_EXIST(_pFwHdr)	((le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x92C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x88C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x2300)
+
+typedef enum _FIRMWARE_SOURCE{
+	FW_SOURCE_IMG_FILE = 0,
+	FW_SOURCE_HEADER_FILE = 1,		//from header file
+}FIRMWARE_SOURCE, *PFIRMWARE_SOURCE;
+
+typedef struct _RT_FIRMWARE{
+	FIRMWARE_SOURCE	eFWSource;
+	u8*			szFwBuffer;
+	u32			ulFwLength;
+#ifdef CONFIG_WOWLAN
+	u8*			szWoWLANFwBuffer;
+	u32			ulWoWLANFwLength;
+#endif //CONFIG_WOWLAN
+}RT_FIRMWARE, *PRT_FIRMWARE, RT_FIRMWARE_92C, *PRT_FIRMWARE_92C;
+
+//
+// This structure must be cared byte-ordering
+//
+// Added by tynli. 2009.12.04.
+typedef struct _RT_8192C_FIRMWARE_HDR {//8-byte alinment required
+
+	//--- LONG WORD 0 ----
+	u16		Signature;	// 92C0: test chip; 92C, 88C0: test chip; 88C1: MP A-cut; 92C1: MP A-cut
+	u8		Category;	// AP/NIC and USB/PCI
+	u8		Function;	// Reserved for different FW function indcation, for further use when driver needs to download different FW in different conditions
+	u16		Version;		// FW Version
+	u8		Subversion;	// FW Subversion, default 0x00
+	u16		Rsvd1;
+
+
+	//--- LONG WORD 1 ----
+	u8		Month;	// Release time Month field
+	u8		Date;	// Release time Date field
+	u8		Hour;	// Release time Hour field
+	u8		Minute;	// Release time Minute field
+	u16		RamCodeSize;	// The size of RAM code
+	u16		Rsvd2;
+
+	//--- LONG WORD 2 ----
+	u32		SvnIdx;	// The SVN entry index
+	u32		Rsvd3;
+
+	//--- LONG WORD 3 ----
+	u32		Rsvd4;
+	u32		Rsvd5;
+
+}RT_8192C_FIRMWARE_HDR, *PRT_8192C_FIRMWARE_HDR;
+
+#define DRIVER_EARLY_INT_TIME		0x05
+#define BCN_DMA_ATIME_INT_TIME		0x02
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+
+typedef enum _USB_RX_AGG_MODE{
+	USB_RX_AGG_DISABLE,
+	USB_RX_AGG_DMA,
+	USB_RX_AGG_USB,
+	USB_RX_AGG_MIX
+}USB_RX_AGG_MODE;
+
+#define MAX_RX_DMA_BUFFER_SIZE	10240		// 10K for 8192C RX DMA buffer
+
+#endif
+
+
+#define TX_SELE_HQ			BIT(0)		// High Queue
+#define TX_SELE_LQ			BIT(1)		// Low Queue
+#define TX_SELE_NQ			BIT(2)		// Normal Queue
+
+
+// Note: We will divide number of page equally for each queue other than public queue!
+
+#define TX_TOTAL_PAGE_NUMBER		0xF8
+#define TX_PAGE_BOUNDARY		(TX_TOTAL_PAGE_NUMBER + 1)
+
+// For Normal Chip Setting
+// (HPQ + LPQ + NPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define NORMAL_PAGE_NUM_PUBQ			0xE7
+#define NORMAL_PAGE_NUM_HPQ			0x0C
+#define NORMAL_PAGE_NUM_LPQ			0x02
+#define NORMAL_PAGE_NUM_NPQ			0x02
+
+
+// For Test Chip Setting
+// (HPQ + LPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define TEST_PAGE_NUM_PUBQ		0x7E
+
+
+// For Test Chip Setting
+#define WMM_TEST_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_TEST_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_TEST_PAGE_NUM_PUBQ		0xA3
+#define WMM_TEST_PAGE_NUM_HPQ		0x29
+#define WMM_TEST_PAGE_NUM_LPQ		0x29
+
+
+//Note: For Normal Chip Setting ,modify later
+#define WMM_NORMAL_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_NORMAL_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_NORMAL_PAGE_NUM_PUBQ		0x65
+#define WMM_NORMAL_PAGE_NUM_HPQ		0x30
+#define WMM_NORMAL_PAGE_NUM_LPQ			0x30
+#define WMM_NORMAL_PAGE_NUM_NPQ		0x30
+
+//-------------------------------------------------------------------------
+//	Chip specific
+//-------------------------------------------------------------------------
+#define CHIP_BONDING_IDENTIFIER(_value)	(((_value)>>22)&0x3)
+#define CHIP_BONDING_92C_1T2R	0x1
+#define CHIP_BONDING_88C_USB_MCARD	0x2
+#define CHIP_BONDING_88C_USB_HP	0x1
+
+//
+// 2011.01.06. Define new structure of chip version for RTL8723 and so on. Added by tynli.
+//
+/*
+     | BIT15:12           |  BIT11:8        | BIT 7              |  BIT6:4  |      BIT3          | BIT2:0  |
+     |-------------+-----------+-----------+-------+-----------+-------|
+     | IC version(CUT)  | ROM version  | Manufacturer  | RF type  |  Chip type       | IC Type |
+     |                           |                      | TSMC/UMC    |              | TEST/NORMAL|             |
+*/
+// [15:12] IC version(CUT): A-cut=0, B-cut=1, C-cut=2, D-cut=3
+// [7] Manufacturer: TSMC=0, UMC=1
+// [6:4] RF type: 1T1R=0, 1T2R=1, 2T2R=2
+// [3] Chip type: TEST=0, NORMAL=1
+// [2:0] IC type: 81xxC=0, 8723=1, 92D=2
+
+#define CHIP_8723						BIT(0)
+#define CHIP_92D						BIT(1)
+#define NORMAL_CHIP  					BIT(3)
+#define RF_TYPE_1T1R					(~(BIT(4)|BIT(5)|BIT(6)))
+#define RF_TYPE_1T2R					BIT(4)
+#define RF_TYPE_2T2R					BIT(5)
+#define CHIP_VENDOR_UMC				BIT(7)
+#define B_CUT_VERSION					BIT(12)
+#define C_CUT_VERSION					BIT(13)
+#define D_CUT_VERSION					((BIT(13)|BIT(14)))
+
+
+// MASK
+#define IC_TYPE_MASK					(BIT(0)|BIT(1)|BIT(2))
+#define CHIP_TYPE_MASK 				BIT(3)
+#define RF_TYPE_MASK					(BIT(4)|BIT(5)|BIT(6))
+#define MANUFACTUER_MASK			BIT(7)	
+#define ROM_VERSION_MASK				(BIT(11)|BIT(10)|BIT(9)|BIT(8))
+#define CUT_VERSION_MASK				(BIT(15)|BIT(14)|BIT(13)|BIT(12))
+
+// Get element
+#define GET_CVID_IC_TYPE(version)			((version) & IC_TYPE_MASK)
+#define GET_CVID_CHIP_TYPE(version)			((version) & CHIP_TYPE_MASK)
+#define GET_CVID_RF_TYPE(version)			((version) & RF_TYPE_MASK)
+#define GET_CVID_MANUFACTUER(version)		((version) & MANUFACTUER_MASK)
+#define GET_CVID_ROM_VERSION(version)		((version) & ROM_VERSION_MASK)
+#define GET_CVID_CUT_VERSION(version)		((version) & CUT_VERSION_MASK)
+
+#define IS_81XXC(version)					((GET_CVID_IC_TYPE(version) == 0)? _TRUE : _FALSE)
+#define IS_8723_SERIES(version)				((GET_CVID_IC_TYPE(version) == CHIP_8723)? _TRUE : _FALSE)
+#define IS_92D(version)						((GET_CVID_IC_TYPE(version) == CHIP_92D)? _TRUE : _FALSE)
+#define IS_1T1R(version)						((GET_CVID_RF_TYPE(version))? _FALSE : _TRUE)
+#define IS_1T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_1T2R)? _TRUE : _FALSE)
+#define IS_2T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_2T2R)? _TRUE : _FALSE)
+#define IS_NORMAL_CHIP(version)				((GET_CVID_CHIP_TYPE(version))? _TRUE: _FALSE)
+#define IS_CHIP_VENDOR_UMC(version)			((GET_CVID_MANUFACTUER(version))? _TRUE: _FALSE)
+
+#define IS_81XXC_TEST_CHIP(version)			((IS_81XXC(version) && (!IS_NORMAL_CHIP(version)))? _TRUE: _FALSE)
+#define IS_92D_TEST_CHIP(version)				((IS_92D(version) && (!IS_NORMAL_CHIP(version)))? _TRUE: _FALSE)
+#define IS_92C_SERIAL(version)   				((IS_81XXC(version) && IS_2T2R(version)) ? _TRUE : _FALSE)
+#define IS_VENDOR_UMC_A_CUT(version)		((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+#define IS_VENDOR_8723_A_CUT(version)		((IS_8723_SERIES(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+// <tynli_Note> 88/92C UMC B-cut vendor is set to TSMC so we need to check CHIP_VENDOR_UMC bit is not 1. 
+#define IS_81xxC_VENDOR_UMC_B_CUT(version)	((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version) == B_CUT_VERSION) ? _TRUE : _FALSE):_FALSE)
+#define IS_92D_SINGLEPHY(version)     			((IS_92D(version)) ? (IS_2T2R(version) ? _TRUE: _FALSE) : _FALSE)
+#define IS_92D_C_CUT(version)    				((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == 0x2) ? _TRUE : _FALSE) : _FALSE)
+#define IS_92D_D_CUT(version)    				((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == 0x3) ? _TRUE : _FALSE) : _FALSE)
+
+typedef enum _VERSION_8192C{
+	VERSION_TEST_CHIP_88C = 0x0000,
+	VERSION_TEST_CHIP_92C = 0x0020,
+	VERSION_TEST_UMC_CHIP_8723 = 0x0081,
+	VERSION_NORMAL_TSMC_CHIP_88C = 0x0008, 
+	VERSION_NORMAL_TSMC_CHIP_92C = 0x0028,
+	VERSION_NORMAL_TSMC_CHIP_92C_1T2R = 0x0018,
+	VERSION_NORMAL_UMC_CHIP_88C_A_CUT = 0x0088,
+	VERSION_NORMAL_UMC_CHIP_92C_A_CUT = 0x00a8,
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT = 0x0098,		
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_A_CUT = 0x0089,
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_B_CUT = 0x1089,	
+	VERSION_NORMAL_UMC_CHIP_88C_B_CUT = 0x1088, 
+	VERSION_NORMAL_UMC_CHIP_92C_B_CUT = 0x10a8, 
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT = 0x1090, 
+	VERSION_TEST_CHIP_92D_SINGLEPHY= 0x0022,
+	VERSION_TEST_CHIP_92D_DUALPHY = 0x0002,
+	VERSION_NORMAL_CHIP_92D_SINGLEPHY= 0x002a,
+	VERSION_NORMAL_CHIP_92D_DUALPHY = 0x000a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_SINGLEPHY = 0x202a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_DUALPHY = 0x200a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_SINGLEPHY = 0x302a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_DUALPHY = 0x300a,
+}VERSION_8192C,*PVERSION_8192C;
+
+
+
+//-------------------------------------------------------------------------
+//	Channel Plan
+//-------------------------------------------------------------------------
+enum ChannelPlan{
+	CHPL_FCC	= 0,
+	CHPL_IC		= 1,
+	CHPL_ETSI	= 2,
+	CHPL_SPAIN	= 3,
+	CHPL_FRANCE	= 4,
+	CHPL_MKK	= 5,
+	CHPL_MKK1	= 6,
+	CHPL_ISRAEL	= 7,
+	CHPL_TELEC	= 8,
+	CHPL_GLOBAL	= 9,
+	CHPL_WORLD	= 10,
+};
+
+typedef struct _TxPowerInfo{
+	u8 CCKIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_1SIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_2SIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	s8 HT20IndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 OFDMIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT20MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 TSSI_A;
+	u8 TSSI_B;
+}TxPowerInfo, *PTxPowerInfo;
+
+#define		EFUSE_REAL_CONTENT_LEN		512
+#define		EFUSE_MAP_LEN					128
+#define		EFUSE_MAX_SECTION			16
+#define		EFUSE_IC_ID_OFFSET			506	//For some inferiority IC purpose. added by Roger, 2009.09.02.
+#define 		AVAILABLE_EFUSE_ADDR(addr) 	(addr < EFUSE_REAL_CONTENT_LEN)
+//
+// <Roger_Notes> To prevent out of boundary programming case, leave 1byte and program full section
+// 9bytes + 1byt + 5bytes and pre 1byte.
+// For worst case:
+// | 1byte|----8bytes----|1byte|--5bytes--| 
+// |         |            Reserved(14bytes)	      |
+//
+#define		EFUSE_OOB_PROTECT_BYTES 		15	// PG data exclude header, dummy 6 bytes frome CP test and reserved 1byte.
+
+
+#define		EFUSE_MAP_LEN_8723			256
+#define		EFUSE_MAX_SECTION_8723		32
+
+//========================================================
+//			EFUSE for BT definition
+//========================================================
+#define		EFUSE_BT_REAL_CONTENT_LEN		1536	// 512*3
+#define		EFUSE_BT_MAP_LEN					1024	// 1k bytes
+#define		EFUSE_BT_MAX_SECTION				128		// 1024/8
+
+#define		EFUSE_PROTECT_BYTES_BANK			16
+
+//
+// <Roger_Notes> For RTL8723 WiFi/BT/GPS multi-function configuration. 2010.10.06.
+//
+typedef enum _RT_MULTI_FUNC{
+	RT_MULTI_FUNC_NONE = 0x00,
+	RT_MULTI_FUNC_WIFI = 0x01,
+	RT_MULTI_FUNC_BT = 0x02,
+	RT_MULTI_FUNC_GPS = 0x04,
+}RT_MULTI_FUNC,*PRT_MULTI_FUNC;
+
+//
+// <Roger_Notes> For RTL8723 WiFi PDn/GPIO polarity control configuration. 2010.10.08.
+//
+typedef enum _RT_POLARITY_CTL{
+	RT_POLARITY_LOW_ACT = 0,
+	RT_POLARITY_HIGH_ACT = 1,	
+}RT_POLARITY_CTL,*PRT_POLARITY_CTL;
+
+// For RTL8723 regulator mode. by tynli. 2011.01.14.
+typedef enum _RT_REGULATOR_MODE{
+	RT_SWITCHING_REGULATOR = 0,
+	RT_LDO_REGULATOR = 1,	
+}RT_REGULATOR_MODE,*PRT_REGULATOR_MODE;
+
+enum c2h_id_8192c {
+	C2H_DBG = 0,
+	C2H_TSF = 1,
+	C2H_AP_RPT_RSP = 2,
+	C2H_CCX_TX_RPT = 3,
+	C2H_BT_RSSI = 4,
+	C2H_BT_OP_MODE = 5,
+	C2H_EXT_RA_RPT = 6,
+	C2H_HW_INFO_EXCH = 10,
+	C2H_C2H_H2C_TEST = 11,
+	C2H_BT_INFO = 12,
+	C2H_BT_MP_INFO = 15,
+	MAX_C2HEVENT
+};
+
+#ifdef CONFIG_PCI_HCI
+struct hal_data_8192ce
+{
+	VERSION_8192C		VersionID;
+	RT_MULTI_FUNC		MultiFunc; // For multi-function consideration.
+	RT_POLARITY_CTL		PolarityCtl; // For Wifi PDn Polarity control.
+	RT_REGULATOR_MODE	RegulatorMode; // switching regulator or LDO
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	u32	IntrMask[2];
+	u32	IntrMaskToSet[2];
+
+	u32	DisabledFunctions;
+	
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	u32	TransmitConfig;
+	WIRELESS_MODE		CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+
+	u16	BasicRateSet;
+
+	//rf_ctrl
+	_lock	rf_lock;
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	INTERFACE_SELECT_8192CPCIe	InterfaceSel;
+
+	//
+	// EEPROM setting.
+	//
+	u16	EEPROMVID;
+	u16	EEPROMDID;
+	u16	EEPROMSVID;
+	u16	EEPROMSMID;
+	u16	EEPROMChannelPlan;
+	u16	EEPROMVersion;
+
+	u8	EEPROMChnlAreaTxPwrCCK[2][3];	
+	u8	EEPROMChnlAreaTxPwrHT40_1S[2][3];	
+	u8	EEPROMChnlAreaTxPwrHT40_2SDiff[2][3];
+	u8	EEPROMPwrLimitHT20[3];
+	u8	EEPROMPwrLimitHT40[3];
+
+	u8	bTXPowerDataReadFromEEPORM;
+	u8	EEPROMThermalMeter;
+	u8	EEPROMTSSI[2];
+
+	u8	EEPROMCustomerID;
+	u8	EEPROMBoardType;
+	u8	EEPROMRegulatory;
+
+	u8	bDefaultAntenna;
+	u8	bIQKInitialized;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr	
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[7][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	u8	bLedOpenDrain; // Support Open-drain arrangement for controlling the LED. Added by Roger, 2009.10.16.
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	//RDG enable
+	BOOLEAN	 bRDGEnable;
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	u8	RegTxPause;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+	u8	CurAntenna;	
+	u8	AntDivCfg;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	//SW Antenna Switch
+	s32				RSSI_sum_A;
+	s32				RSSI_sum_B;
+	s32				RSSI_cnt_A;
+	s32				RSSI_cnt_B;
+	BOOLEAN		RSSI_test;
+#endif
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	//Hybrid Antenna Diversity
+	u32				CCK_Ant1_Cnt;
+	u32				CCK_Ant2_Cnt;
+	u32				OFDM_Ant1_Cnt;
+	u32				OFDM_Ant2_Cnt;
+#endif
+
+	struct dm_priv	dmpriv;
+	u8	bDumpRxPkt;//for debug
+#ifdef DBG_CONFIG_ERROR_DETECT
+	struct sreset_priv srestpriv;
+#endif
+	u8	bInterruptMigration;
+	u8	bDisableTxInt;
+	u8	bGpioHwWpsPbc;
+
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	u16	EfuseUsedBytes;
+	
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192ce HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+
+//
+// Function disabled.
+//
+#define DF_TX_BIT		BIT0
+#define DF_RX_BIT		BIT1
+#define DF_IO_BIT		BIT2
+#define DF_IO_D3_BIT			BIT3
+
+#define RT_DF_TYPE		u32
+#define RT_DISABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions |= ((RT_DF_TYPE)(__FuncBits)))
+#define RT_ENABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions &= (~((RT_DF_TYPE)(__FuncBits))))
+#define RT_IS_FUNC_DISABLED(__pAdapter, __FuncBits) ( (__pAdapter)->DisabledFunctions & (__FuncBits) )
+#define IS_MULTI_FUNC_CHIP(_Adapter)	(((((PHAL_DATA_TYPE)(_Adapter->HalData))->MultiFunc) & (RT_MULTI_FUNC_BT|RT_MULTI_FUNC_GPS)) ? _TRUE : _FALSE)
+
+void InterruptRecognized8192CE(PADAPTER Adapter, PRT_ISR_CONTENT pIsrContent);
+VOID UpdateInterruptMask8192CE(PADAPTER Adapter, u32 AddMSR, u32 AddMSR1, u32 RemoveMSR, u32 RemoveMSR1);
+#endif
+
+#ifdef CONFIG_USB_HCI
+struct hal_data_8192cu
+{
+	VERSION_8192C		VersionID;
+	RT_MULTI_FUNC		MultiFunc; // For multi-function consideration.
+	RT_POLARITY_CTL		PolarityCtl; // For Wifi PDn Polarity control.
+	RT_REGULATOR_MODE	RegulatorMode; // switching regulator or LDO
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	WIRELESS_MODE		CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+
+	u16	BasicRateSet;
+
+	//rf_ctrl
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	u8	BoardType;
+	//INTERFACE_SELECT_8192CUSB	InterfaceSel;
+
+	//
+	// EEPROM setting.
+	//
+	u16	EEPROMVID;
+	u16	EEPROMPID;
+	u16	EEPROMSVID;
+	u16	EEPROMSDID;
+	u8	EEPROMCustomerID;
+	u8	EEPROMSubCustomerID;
+	u8	EEPROMVersion;
+	u8	EEPROMRegulatory;
+
+	u8	bTXPowerDataReadFromEEPORM;
+	u8	EEPROMThermalMeter;
+
+	u8	bIQKInitialized;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr	
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[7][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+
+	u8	bLedOpenDrain; // Support Open-drain arrangement for controlling the LED. Added by Roger, 2009.10.16.
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	//RDG enable
+	BOOLEAN	 bRDGEnable;
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	u8	RegTxPause;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+
+	struct dm_priv	dmpriv;
+#ifdef DBG_CONFIG_ERROR_DETECT
+	struct sreset_priv srestpriv;
+#endif	
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+	u8	CurAntenna;	
+	u8	AntDivCfg;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	//SW Antenna Switch
+	s32				RSSI_sum_A;
+	s32				RSSI_sum_B;
+	s32				RSSI_cnt_A;
+	s32				RSSI_cnt_B;
+	BOOLEAN		RSSI_test;
+#endif
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	//Hybrid Antenna Diversity
+	u32				CCK_Ant1_Cnt;
+	u32				CCK_Ant2_Cnt;
+	u32				OFDM_Ant1_Cnt;
+	u32				OFDM_Ant2_Cnt;
+#endif
+
+	u8	bDumpRxPkt;//for debug
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	// 2010/08/09 MH Add CU power down mode.
+	BOOLEAN		pwrdown;
+
+	// For 92C USB endpoint setting
+	//
+
+	u32	UsbBulkOutSize;
+
+	int	RtBulkOutPipe[3];
+	int	RtBulkInPipe;
+	int	RtIntInPipe;
+	// Add for dual MAC  0--Mac0 1--Mac1
+	u32	interfaceIndex;
+
+	u8	OutEpQueueSel;
+	u8	OutEpNumber;
+
+	u8	Queue2EPNum[8];//for out endpoint number mapping
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	u8	UsbTxAggMode;
+	u8	UsbTxAggDescNum;
+#endif
+#ifdef CONFIG_USB_RX_AGGREGATION
+	u16	HwRxPageSize;				// Hardware setting
+	u32	MaxUsbRxAggBlock;
+
+	USB_RX_AGG_MODE	UsbRxAggMode;
+	u8	UsbRxAggBlockCount;			// USB Block count. Block size is 512-byte in hight speed and 64-byte in full speed
+	u8	UsbRxAggBlockTimeout;
+	u8	UsbRxAggPageCount;			// 8192C DMA page count
+	u8	UsbRxAggPageTimeout;
+#endif
+
+	// 2010/12/10 MH Add for USB aggreation mode dynamic shceme.
+	BOOLEAN		UsbRxHighSpeedMode;
+
+	// 2010/11/22 MH Add for slim combo debug mode selective.
+	// This is used for fix the drawback of CU TSMC-A/UMC-A cut. HW auto suspend ability. Close BT clock.
+	BOOLEAN		SlimComboDbg;
+
+	u16	EfuseUsedBytes;
+
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192cu HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+#endif
+
+#define GET_HAL_DATA(__pAdapter)	((HAL_DATA_TYPE *)((__pAdapter)->HalData))
+#define GET_RF_TYPE(priv)	(GET_HAL_DATA(priv)->rf_type)
+
+#define INCLUDE_MULTI_FUNC_BT(_Adapter)	(GET_HAL_DATA(_Adapter)->MultiFunc & RT_MULTI_FUNC_BT)
+#define INCLUDE_MULTI_FUNC_GPS(_Adapter)	(GET_HAL_DATA(_Adapter)->MultiFunc & RT_MULTI_FUNC_GPS)
+
+VOID rtl8192c_FirmwareSelfReset(IN PADAPTER Adapter);
+int FirmwareDownload92C(IN PADAPTER Adapter,IN	BOOLEAN			bUsedWoWLANFw);
+VOID InitializeFirmwareVars92C(PADAPTER Adapter);
+u8 GetEEPROMSize8192C(PADAPTER Adapter);
+void rtl8192c_EfuseParseChnlPlan(PADAPTER padapter, u8 *hwinfo, BOOLEAN AutoLoadFail);
+VERSION_8192C rtl8192c_ReadChipVersion(IN PADAPTER Adapter);
+void rtl8192c_ReadBluetoothCoexistInfo(PADAPTER Adapter, u8 *PROMContent, BOOLEAN AutoloadFail);
+//void rtl8192c_free_hal_data(_adapter * padapter);
+VOID rtl8192c_EfuseParseIDCode(PADAPTER pAdapter, u8 *hwinfo);
+void rtl8192c_set_hal_ops(struct hal_ops *pHalFunc);
+
+s32 c2h_id_filter_ccx_8192c(u8 id);
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+
+extern void Hal_SetAntenna(PADAPTER pAdapter);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetTxPower(PADAPTER pAdapter);
+extern void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetSingleToneTx ( PADAPTER pAdapter , u8 bStart );
+extern void Hal_SetSingleCarrierTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetContinuousTx (PADAPTER pAdapter, u8 bStart);
+
+extern void Hal_SetDataRate(PADAPTER pAdapter);
+extern void Hal_SetChannel(PADAPTER pAdapter);
+extern void Hal_SetAntennaPathPower(PADAPTER pAdapter);
+extern s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void Hal_GetPowerTracking(PADAPTER padapter, u8 * enable);
+extern void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value);
+extern void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter);
+extern void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14);
+extern void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven);
+extern void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_TriggerRFThermalMeter(PADAPTER pAdapter);
+extern u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter);
+extern void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart);
+
+#endif
+
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h
new file mode 100755
index 0000000000000..1ccf935968964
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h
@@ -0,0 +1,42 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_LED_H_
+#define __RTL8192C_LED_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+//================================================================================
+// Interface to manipulate LED objects.
+//================================================================================
+#ifdef CONFIG_USB_HCI
+void rtl8192cu_InitSwLeds(_adapter *padapter);
+void rtl8192cu_DeInitSwLeds(_adapter *padapter);
+#endif
+#ifdef CONFIG_PCI_HCI
+void rtl8192ce_gen_RefreshLedState(PADAPTER Adapter);
+void rtl8192ce_InitSwLeds(_adapter *padapter);
+void rtl8192ce_DeInitSwLeds(_adapter *padapter);
+#endif
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h
new file mode 100755
index 0000000000000..d5656f5ebd8f5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h
@@ -0,0 +1,184 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_RECV_H_
+#define _RTL8192C_RECV_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#ifdef PLATFORM_OS_XP
+	#define NR_RECVBUFF (16)
+#elif defined(PLATFORM_OS_CE)
+	#define NR_RECVBUFF (4)
+#else
+#ifdef CONFIG_SINGLE_RECV_BUF
+	#define NR_RECVBUFF (1)
+#else
+	#define NR_RECVBUFF (4)
+#endif //CONFIG_SINGLE_RECV_BUF
+
+	#define NR_PREALLOC_RECV_SKB (8)
+#endif
+
+
+#define RECV_BLK_SZ 512
+#define RECV_BLK_CNT 16
+#define RECV_BLK_TH RECV_BLK_CNT
+
+#if defined(CONFIG_USB_HCI)
+
+#ifdef PLATFORM_OS_CE
+#define MAX_RECVBUF_SZ (8192+1024) // 8K+1k
+#else
+	#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+		//#define MAX_RECVBUF_SZ (32768) // 32k
+		//#define MAX_RECVBUF_SZ (16384) //16K
+		//#define MAX_RECVBUF_SZ (10240) //10K
+		#ifdef CONFIG_PLATFORM_MSTAR
+			#define MAX_RECVBUF_SZ (8192) // 8K
+		#else
+			#define MAX_RECVBUF_SZ (15360) // 15k < 16k
+		#endif
+		//#define MAX_RECVBUF_SZ (8192+1024) // 8K+1k
+	#else
+		#define MAX_RECVBUF_SZ (4000) // about 4K
+	#endif
+#endif
+
+#elif defined(CONFIG_PCI_HCI)
+//#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+//	#define MAX_RECVBUF_SZ (9100)
+//#else
+	#define MAX_RECVBUF_SZ (4000) // about 4K
+//#endif
+
+#define RX_MPDU_QUEUE				0
+#define RX_CMD_QUEUE				1
+#define RX_MAX_QUEUE				2
+#endif
+
+
+#define RECV_BULK_IN_ADDR		0x80
+#define RECV_INT_IN_ADDR		0x81
+
+#define PHY_RSSI_SLID_WIN_MAX				100
+#define PHY_LINKQUALITY_SLID_WIN_MAX		20
+
+
+struct phy_stat
+{
+	unsigned int phydw0;
+
+	unsigned int phydw1;
+
+	unsigned int phydw2;
+
+	unsigned int phydw3;
+
+	unsigned int phydw4;
+
+	unsigned int phydw5;
+
+	unsigned int phydw6;
+
+	unsigned int phydw7;
+};
+
+typedef struct _Phy_OFDM_Rx_Status_Report_8192cd
+{
+	unsigned char	trsw_gain_X[4];
+	unsigned char	pwdb_all;
+	unsigned char	cfosho_X[4];
+	unsigned char	cfotail_X[4];
+	unsigned char	rxevm_X[2];
+	unsigned char	rxsnr_X[4];
+	unsigned char	pdsnr_X[2];
+	unsigned char	csi_current_X[2];
+	unsigned char	csi_target_X[2];
+	unsigned char	sigevm;
+	unsigned char	max_ex_pwr;
+//#ifdef RTL8192SE
+#ifdef CONFIG_LITTLE_ENDIAN
+	unsigned char ex_intf_flg:1;
+	unsigned char sgi_en:1;
+	unsigned char rxsc:2;
+	//unsigned char rsvd:4;
+	unsigned char idle_long:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char ANTSELB:1;
+	unsigned char ANTSEL:1;	
+#else	// _BIG_ENDIAN_
+	//unsigned char rsvd:4;
+	unsigned char ANTSEL:1;	
+	unsigned char ANTSELB:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char idle_long:1;
+	unsigned char rxsc:2;
+	unsigned char sgi_en:1;
+	unsigned char ex_intf_flg:1;
+#endif
+//#else	// RTL8190, RTL8192E
+//	unsigned char	sgi_en;
+//	unsigned char	rxsc_sgien_exflg;
+//#endif
+} __attribute__ ((packed))PHY_STS_OFDM_8192CD_T,PHY_RX_DRIVER_INFO_8192CD;
+
+typedef struct _Phy_CCK_Rx_Status_Report_8192cd
+{
+	/* For CCK rate descriptor. This is a signed 8:1 variable. LSB bit presend
+		0.5. And MSB 7 bts presend a signed value. Range from -64~+63.5. */
+	u8	adc_pwdb_X[4];
+	u8	SQ_rpt;
+	u8	cck_agc_rpt;
+} PHY_STS_CCK_8192CD_T;
+
+
+// Rx smooth factor
+#define	Rx_Smooth_Factor (20)
+
+
+#ifdef CONFIG_USB_HCI
+typedef struct _INTERRUPT_MSG_FORMAT_EX{
+	unsigned int C2H_MSG0;
+	unsigned int C2H_MSG1;
+	unsigned int C2H_MSG2;
+	unsigned int C2H_MSG3;
+	unsigned int HISR; // from HISR Reg0x124, read to clear
+	unsigned int HISRE;// from HISRE Reg0x12c, read to clear
+	unsigned int  MSG_EX;
+}INTERRUPT_MSG_FORMAT_EX,*PINTERRUPT_MSG_FORMAT_EX;
+
+void rtl8192cu_init_recvbuf(_adapter *padapter, struct recv_buf *precvbuf);
+int	rtl8192cu_init_recv_priv(_adapter * padapter);
+void rtl8192cu_free_recv_priv(_adapter * padapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+int	rtl8192ce_init_recv_priv(_adapter * padapter);
+void rtl8192ce_free_recv_priv(_adapter * padapter);
+#endif
+
+void rtl8192c_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_info);
+void rtl8192c_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h
new file mode 100755
index 0000000000000..26c678a8da437
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h
@@ -0,0 +1,92 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+ * 
+ * 
+ * Module:	rtl8192c_rf.h	( Header File)
+ * 
+ * Note:	Collect every HAL RF type exter API or constant.	 
+ *
+ * Function:	
+ * 		 
+ * Export:	
+ * 
+ * Abbrev:	
+ * 
+ * History:
+ * Data			Who		Remark
+ * 
+ * 09/25/2008	MHC		Create initial version.
+ * 
+ * 
+******************************************************************************/
+#ifndef _RTL8192C_RF_H_
+#define _RTL8192C_RF_H_
+/* Check to see if the file has been included already.  */
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//
+// For RF 6052 Series
+//
+#define		RF6052_MAX_TX_PWR			0x3F
+#define		RF6052_MAX_REG				0x3F
+#define		RF6052_MAX_PATH				2
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/ 
+
+/*------------------------------Define structure----------------------------*/ 
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+//
+// RF RL6052 Series API
+//
+void		rtl8192c_RF_ChangeTxPath(	IN	PADAPTER	Adapter, 
+										IN	u16		DataRate);
+void		rtl8192c_PHY_RF6052SetBandwidth(	
+										IN	PADAPTER				Adapter,
+										IN	HT_CHANNEL_WIDTH		Bandwidth);	
+VOID	rtl8192c_PHY_RF6052SetCckTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerlevel);
+VOID	rtl8192c_PHY_RF6052SetOFDMTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerLevel,
+										IN	u8		Channel);
+int	PHY_RF6052_Config8192C(	IN	PADAPTER		Adapter	);
+
+/*--------------------------Exported Function prototype---------------------*/
+
+
+#endif/* End of HalRf.h */
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h
new file mode 100755
index 0000000000000..8ff13a7e12106
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h
@@ -0,0 +1,1865 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_SPEC_H__
+#define __RTL8192C_SPEC_H__
+
+#include <drv_conf.h>
+
+#ifndef BIT
+#define BIT(x)		(1 << (x))
+#endif
+
+#define BIT0		0x00000001
+#define BIT1		0x00000002
+#define BIT2		0x00000004
+#define BIT3		0x00000008
+#define BIT4		0x00000010
+#define BIT5		0x00000020
+#define BIT6		0x00000040
+#define BIT7		0x00000080
+#define BIT8		0x00000100
+#define BIT9		0x00000200
+#define BIT10	0x00000400
+#define BIT11	0x00000800
+#define BIT12	0x00001000
+#define BIT13	0x00002000
+#define BIT14	0x00004000
+#define BIT15	0x00008000
+#define BIT16	0x00010000
+#define BIT17	0x00020000
+#define BIT18	0x00040000
+#define BIT19	0x00080000
+#define BIT20	0x00100000
+#define BIT21	0x00200000
+#define BIT22	0x00400000
+#define BIT23	0x00800000
+#define BIT24	0x01000000
+#define BIT25	0x02000000
+#define BIT26	0x04000000
+#define BIT27	0x08000000
+#define BIT28	0x10000000
+#define BIT29	0x20000000
+#define BIT30	0x40000000
+#define BIT31	0x80000000
+
+
+//============================================================
+//       8192C Regsiter offset definition
+//============================================================
+
+
+//============================================================
+//
+//============================================================
+
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+#define REG_SYS_ISO_CTRL			0x0000
+#define REG_SYS_FUNC_EN			0x0002
+#define REG_APS_FSMCO				0x0004
+#define REG_SYS_CLKR				0x0008
+#define REG_9346CR					0x000A
+#define REG_EE_VPD					0x000C
+#define REG_AFE_MISC				0x0010
+#define REG_SPS0_CTRL				0x0011
+#define REG_SPS_OCP_CFG			0x0018
+#define REG_RSV_CTRL				0x001C
+#define REG_RF_CTRL					0x001F
+#define REG_LDOA15_CTRL			0x0020
+#define REG_LDOV12D_CTRL			0x0021
+#define REG_LDOHCI12_CTRL			0x0022
+#define REG_LPLDO_CTRL				0x0023
+#define REG_AFE_XTAL_CTRL			0x0024
+#define REG_AFE_PLL_CTRL			0x0028
+#define REG_EFUSE_CTRL				0x0030
+#define REG_EFUSE_TEST				0x0034
+#define REG_PWR_DATA				0x0038
+#define REG_CAL_TIMER				0x003C
+#define REG_ACLK_MON				0x003E
+#define REG_GPIO_MUXCFG			0x0040
+#define REG_GPIO_IO_SEL				0x0042
+#define REG_MAC_PINMUX_CFG		0x0043
+#define REG_GPIO_PIN_CTRL			0x0044
+#define REG_GPIO_INTM				0x0048
+#define REG_LEDCFG0					0x004C
+#define REG_LEDCFG1					0x004D
+#define REG_LEDCFG2					0x004E
+#define REG_LEDCFG3					0x004F
+#define REG_LEDCFG					REG_LEDCFG2
+#define REG_FSIMR					0x0050
+#define REG_FSISR					0x0054
+#define REG_HSIMR					0x0058
+#define REG_HSISR					0x005c
+#define REG_GPIO_PIN_CTRL_2		0x0060 // RTL8723 WIFI/BT/GPS Multi-Function GPIO Pin Control.
+#define REG_GPIO_IO_SEL_2			0x0062 // RTL8723 WIFI/BT/GPS Multi-Function GPIO Select.
+#define REG_MULTI_FUNC_CTRL		0x0068 // RTL8723 WIFI/BT/GPS Multi-Function control source.
+#define REG_MCUFWDL				0x0080
+#ifdef CONFIG_WOWLAN
+#define REG_WOWLAN_REASON			0x0081
+#endif //CONFIG_WOWLAN
+#define REG_HMEBOX_EXT_0			0x0088
+#define REG_HMEBOX_EXT_1			0x008A
+#define REG_HMEBOX_EXT_2			0x008C
+#define REG_HMEBOX_EXT_3			0x008E
+#define REG_HOST_SUSP_CNT			0x00BC	// Host suspend counter on FPGA platform
+#define REG_EFUSE_ACCESS			0x00CF	// Efuse access protection for RTL8723
+#define REG_BIST_SCAN				0x00D0
+#define REG_BIST_RPT				0x00D4
+#define REG_BIST_ROM_RPT			0x00D8
+#define REG_USB_SIE_INTF			0x00E0
+#define REG_PCIE_MIO_INTF			0x00E4
+#define REG_PCIE_MIO_INTD			0x00E8
+#define REG_HPON_FSM				0x00EC
+#define REG_SYS_CFG					0x00F0
+#define REG_GPIO_OUTSTS			0x00F4	// For RTL8723 only.
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+#define REG_CR						0x0100
+#define REG_PBP						0x0104
+#define REG_TRXDMA_CTRL			0x010C
+#define REG_TRXFF_BNDY				0x0114
+#define REG_TRXFF_STATUS			0x0118
+#define REG_RXFF_PTR				0x011C
+#define REG_HIMR					0x0120
+#define REG_HISR					0x0124
+#define REG_HIMRE					0x0128
+#define REG_HISRE					0x012C
+#define REG_CPWM					0x012F
+#define REG_FWIMR					0x0130
+#define REG_FWISR					0x0134
+#define REG_PKTBUF_DBG_CTRL		0x0140
+#define REG_PKTBUF_DBG_DATA_L		0x0144
+#define REG_PKTBUF_DBG_DATA_H	0x0148
+
+#define REG_TC0_CTRL				0x0150
+#define REG_TC1_CTRL				0x0154
+#define REG_TC2_CTRL				0x0158
+#define REG_TC3_CTRL				0x015C
+#define REG_TC4_CTRL				0x0160
+#define REG_TCUNIT_BASE			0x0164
+#define REG_MBIST_START			0x0174
+#define REG_MBIST_DONE				0x0178
+#define REG_MBIST_FAIL				0x017C
+#define REG_C2HEVT_MSG_NORMAL	0x01A0
+#define REG_C2HEVT_CLEAR			0x01AF
+#define REG_C2HEVT_MSG_TEST		0x01B8
+#define REG_MCUTST_1				0x01c0
+#define REG_FMETHR					0x01C8
+#define REG_HMETFR					0x01CC
+#define REG_HMEBOX_0				0x01D0
+#define REG_HMEBOX_1				0x01D4
+#define REG_HMEBOX_2				0x01D8
+#define REG_HMEBOX_3				0x01DC
+
+#define REG_LLT_INIT				0x01E0
+#define REG_BB_ACCEESS_CTRL		0x01E8
+#define REG_BB_ACCESS_DATA		0x01EC
+
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RQPN					0x0200
+#define REG_FIFOPAGE				0x0204
+#define REG_TDECTRL					0x0208
+#define REG_TXDMA_OFFSET_CHK		0x020C
+#define REG_TXDMA_STATUS			0x0210
+#define REG_RQPN_NPQ				0x0214
+
+//-----------------------------------------------------
+//
+//	0x0280h ~ 0x02FFh	RXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RXDMA_AGG_PG_TH		0x0280
+#define REG_RXPKT_NUM				0x0284
+#define REG_RXDMA_STATUS			0x0288
+
+
+//-----------------------------------------------------
+//
+//	0x0300h ~ 0x03FFh	PCIe
+//
+//-----------------------------------------------------
+#define	REG_PCIE_CTRL_REG			0x0300
+#define	REG_INT_MIG				0x0304	// Interrupt Migration 
+#define	REG_BCNQ_DESA				0x0308	// TX Beacon Descriptor Address
+#define	REG_HQ_DESA				0x0310	// TX High Queue Descriptor Address
+#define	REG_MGQ_DESA				0x0318	// TX Manage Queue Descriptor Address
+#define	REG_VOQ_DESA				0x0320	// TX VO Queue Descriptor Address
+#define	REG_VIQ_DESA				0x0328	// TX VI Queue Descriptor Address
+#define	REG_BEQ_DESA				0x0330	// TX BE Queue Descriptor Address
+#define	REG_BKQ_DESA				0x0338	// TX BK Queue Descriptor Address
+#define	REG_RX_DESA				0x0340	// RX Queue	Descriptor Address
+#define	REG_DBI					0x0348	// Backdoor REG for Access Configuration
+#define	REG_MDIO					0x0354	// MDIO for Access PCIE PHY
+#define	REG_DBG_SEL				0x0360	// Debug Selection Register
+#define	REG_PCIE_HRPWM			0x0361	//PCIe RPWM
+#define	REG_PCIE_HCPWM			0x0363	//PCIe CPWM
+#define	REG_UART_CTRL				0x0364	// UART	Control
+#define	REG_UART_TX_DESA			0x0370	// UART TX Descriptor Address
+#define	REG_UART_RX_DESA			0x0378	// UART Rx Descriptor Address
+
+
+// spec version 11
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+#define REG_VOQ_INFORMATION			0x0400
+#define REG_VIQ_INFORMATION			0x0404
+#define REG_BEQ_INFORMATION			0x0408
+#define REG_BKQ_INFORMATION			0x040C
+#define REG_MGQ_INFORMATION			0x0410
+#define REG_HGQ_INFORMATION			0x0414
+#define REG_BCNQ_INFORMATION			0x0418
+
+
+#define REG_CPU_MGQ_INFORMATION		0x041C
+#define REG_FWHW_TXQ_CTRL				0x0420
+#define REG_HWSEQ_CTRL					0x0423
+#define REG_TXPKTBUF_BCNQ_BDNY		0x0424
+#define REG_TXPKTBUF_MGQ_BDNY		0x0425
+#define REG_LIFETIME_EN				0x0426
+#define REG_MULTI_BCNQ_OFFSET			0x0427
+#define REG_SPEC_SIFS					0x0428
+#define REG_RL							0x042A
+#define REG_DARFRC						0x0430
+#define REG_RARFRC						0x0438
+#define REG_RRSR						0x0440
+#define REG_ARFR0						0x0444
+#define REG_ARFR1						0x0448
+#define REG_ARFR2						0x044C
+#define REG_ARFR3						0x0450
+#define REG_AGGLEN_LMT					0x0458
+#define REG_AMPDU_MIN_SPACE			0x045C
+#define REG_TXPKTBUF_WMAC_LBK_BF_HD	0x045D
+#define REG_FAST_EDCA_CTRL				0x0460
+#define REG_RD_RESP_PKT_TH				0x0463
+#define REG_INIRTS_RATE_SEL			0x0480
+#define REG_INIDATA_RATE_SEL			0x0484
+
+//#define REG_FW_TSF_SYNC_CNT				0x04A0
+#define REG_FW_RESET_TSF_CNT_1				0x05FC
+#define REG_FW_RESET_TSF_CNT_0				0x05FD
+#define REG_FW_BCN_DIS_CNT				0x05FE
+
+#define REG_POWER_STATUS				0x04A4
+#define REG_POWER_STAGE1				0x04B4
+#define REG_POWER_STAGE2				0x04B8
+#define REG_PKT_VO_VI_LIFE_TIME		0x04C0
+#define REG_PKT_BE_BK_LIFE_TIME		0x04C2
+#define REG_STBC_SETTING				0x04C4
+#define REG_PROT_MODE_CTRL			0x04C8
+#define REG_MAX_AGGR_NUM				0x04CA
+#define REG_RTS_MAX_AGGR_NUM			0x04CB
+#define REG_BAR_MODE_CTRL				0x04CC
+#define REG_RA_TRY_RATE_AGG_LMT		0x04CF
+#define REG_NQOS_SEQ					0x04DC
+#define REG_QOS_SEQ					0x04DE
+#define REG_NEED_CPU_HANDLE			0x04E0
+#define REG_PKT_LOSE_RPT				0x04E1
+#define REG_PTCL_ERR_STATUS			0x04E2
+#define REG_DUMMY						0x04FC
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+#define REG_EDCA_VO_PARAM			0x0500
+#define REG_EDCA_VI_PARAM			0x0504
+#define REG_EDCA_BE_PARAM			0x0508
+#define REG_EDCA_BK_PARAM			0x050C
+#define REG_BCNTCFG					0x0510
+#define REG_PIFS						0x0512
+#define REG_RDG_PIFS				0x0513
+#define REG_SIFS_CCK				0x0514
+#define REG_SIFS_OFDM				0x0516
+#define REG_SIFS_CTX				0x0514
+#define REG_SIFS_TRX				0x0516
+#define REG_TSFTR_SYN_OFFSET		0x0518
+#define REG_AGGR_BREAK_TIME		0x051A
+#define REG_SLOT					0x051B
+#define REG_TX_PTCL_CTRL			0x0520
+#define REG_TXPAUSE					0x0522
+#define REG_DIS_TXREQ_CLR			0x0523
+#define REG_RD_CTRL					0x0524
+#define REG_TBTT_PROHIBIT			0x0540
+#define REG_RD_NAV_NXT				0x0544
+#define REG_NAV_PROT_LEN			0x0546
+#define REG_BCN_CTRL				0x0550
+#define REG_BCN_CTRL_1				0x0551
+#define REG_MBID_NUM				0x0552
+#define REG_DUAL_TSF_RST			0x0553
+#define REG_BCN_INTERVAL			0x0554	// The same as REG_MBSSID_BCN_SPACE
+#define REG_MBSSID_BCN_SPACE		0x0554
+#define REG_DRVERLYINT				0x0558
+#define REG_BCNDMATIM				0x0559
+#define REG_ATIMWND				0x055A
+#define REG_BCN_MAX_ERR			0x055D
+#define REG_RXTSF_OFFSET_CCK		0x055E
+#define REG_RXTSF_OFFSET_OFDM		0x055F	
+#define REG_TSFTR					0x0560
+#define REG_TSFTR1					0x0568
+#define REG_INIT_TSFTR				0x0564
+#define REG_ATIMWND_1				0x0570
+#define REG_PSTIMER					0x0580
+#define REG_TIMER0					0x0584
+#define REG_TIMER1					0x0588
+#define REG_ACMHWCTRL				0x05C0
+#define REG_ACMRSTCTRL				0x05C1
+#define REG_ACMAVG					0x05C2
+#define REG_VO_ADMTIME				0x05C4
+#define REG_VI_ADMTIME				0x05C6
+#define REG_BE_ADMTIME				0x05C8
+#define REG_EDCA_RANDOM_GEN		0x05CC
+#define REG_SCH_TXCMD				0x05D0
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+#define REG_APSD_CTRL				0x0600
+#define REG_BWOPMODE				0x0603
+#define REG_TCR						0x0604
+#define REG_RCR						0x0608
+#define REG_RX_PKT_LIMIT			0x060C
+#define REG_RX_DLK_TIME			0x060D
+#define REG_RX_DRVINFO_SZ			0x060F
+
+#define REG_MACID					0x0610
+#define REG_BSSID					0x0618
+#define REG_MAR						0x0620
+#define REG_MBIDCAMCFG				0x0628
+
+#define REG_USTIME_EDCA			0x0638
+#define REG_MAC_SPEC_SIFS			0x063A
+
+// 20100719 Joseph: Hardware register definition change. (HW datasheet v54)
+#define REG_R2T_SIFS				0x063C	// [15:8]SIFS_R2T_OFDM, [7:0]SIFS_R2T_CCK
+#define REG_T2T_SIFS				0x063E	// [15:8]SIFS_T2T_OFDM, [7:0]SIFS_T2T_CCK
+#define REG_ACKTO					0x0640
+#define REG_CTS2TO					0x0641
+#define REG_EIFS						0x0642
+
+//WMA, BA, CCX
+#define REG_NAV_CTRL				0x0650
+#define REG_BACAMCMD				0x0654
+#define REG_BACAMCONTENT			0x0658
+#define REG_LBDLY					0x0660
+#define REG_FWDLY					0x0661
+#define REG_RXERR_RPT				0x0664
+#define REG_WMAC_TRXPTCL_CTL		0x0668
+
+
+// Security
+#define REG_CAMCMD					0x0670
+#define REG_CAMWRITE				0x0674
+#define REG_CAMREAD				0x0678
+#define REG_CAMDBG					0x067C
+#define REG_SECCFG					0x0680
+
+// Power
+#define REG_WOW_CTRL				0x0690
+#define REG_PSSTATUS				0x0691
+#define REG_PS_RX_INFO				0x0692
+#define REG_LPNAV_CTRL				0x0694
+#define REG_WKFMCAM_CMD			0x0698
+#define REG_WKFMCAM_RWD			0x069C
+#define REG_RXFLTMAP0				0x06A0
+#define REG_RXFLTMAP1				0x06A2
+#define REG_RXFLTMAP2				0x06A4
+#define REG_BCN_PSR_RPT			0x06A8
+#define REG_CALB32K_CTRL			0x06AC
+#define REG_PKT_MON_CTRL			0x06B4
+#define REG_BT_COEX_TABLE			0x06C0
+#define REG_WMAC_RESP_TXINFO		0x06D8
+
+#define REG_MACID1					0x0700
+#define REG_BSSID1					0x0708
+
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+// For test chip
+#define REG_TEST_USB_TXQS			0xFE48
+#define REG_TEST_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_TEST_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_TEST_SIE_OPTIONAL		0xFE64
+#define REG_TEST_SIE_CHIRP_K		0xFE65
+#define REG_TEST_SIE_PHY			0xFE66		// 0xFE66~0xFE6B
+#define REG_TEST_SIE_MAC_ADDR		0xFE70		// 0xFE70~0xFE75
+#define REG_TEST_SIE_STRING		0xFE80		// 0xFE80~0xFEB9
+
+
+// For normal chip
+#define REG_NORMAL_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_NORMAL_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_NORMAL_SIE_OPTIONAL	0xFE64
+#define REG_NORMAL_SIE_EP			0xFE65		// 0xFE65~0xFE67
+#define REG_NORMAL_SIE_PHY		0xFE68		// 0xFE68~0xFE6B
+#define REG_NORMAL_SIE_OPTIONAL2	0xFE6C
+#define REG_NORMAL_SIE_GPS_EP		0xFE6D		// 0xFE6D, for RTL8723 only.
+#define REG_NORMAL_SIE_MAC_ADDR	0xFE70		// 0xFE70~0xFE75
+#define REG_NORMAL_SIE_STRING		0xFE80		// 0xFE80~0xFEDF
+
+
+//-----------------------------------------------------
+//
+//	Redifine 8192C register definition for compatibility
+//
+//-----------------------------------------------------
+
+// TODO: use these definition when using REG_xxx naming rule.
+// NOTE: DO NOT Remove these definition. Use later.
+
+#define	SYS_ISO_CTRL				REG_SYS_ISO_CTRL	// System Isolation Interface Control.
+#define	SYS_FUNC_EN				REG_SYS_FUNC_EN		// System Function Enable.
+#define	SYS_CLK						REG_SYS_CLKR
+#define	CR9346						REG_9346CR			// 93C46/93C56 Command Register.
+#define	EFUSE_CTRL					REG_EFUSE_CTRL		// E-Fuse Control.
+#define	EFUSE_TEST					REG_EFUSE_TEST		// E-Fuse Test.
+#define	MSR							(REG_CR + 2)		// Media Status register
+#define	ISR							REG_HISR
+#define	TSFR						REG_TSFTR			// Timing Sync Function Timer Register.
+
+#define	MACIDR0					REG_MACID			// MAC ID Register, Offset 0x0050-0x0053
+#define	MACIDR4					(REG_MACID + 4)		// MAC ID Register, Offset 0x0054-0x0055
+
+#define	PBP							REG_PBP
+
+// Redifine MACID register, to compatible prior ICs.
+#define	IDR0						MACIDR0
+#define	IDR4						MACIDR4
+
+
+//
+// 9. Security Control Registers	(Offset: )
+//
+#define	RWCAM						REG_CAMCMD		//IN 8190 Data Sheet is called CAMcmd
+#define	WCAMI						REG_CAMWRITE	// Software write CAM input content
+#define	RCAMO						REG_CAMREAD		// Software read/write CAM config
+#define	CAMDBG						REG_CAMDBG
+#define	SECR						REG_SECCFG		//Security Configuration Register
+
+// Unused register
+#define	UnusedRegister				0x1BF
+#define	DCAM						UnusedRegister
+#define	PSR							UnusedRegister
+#define	BBAddr						UnusedRegister
+#define	PhyDataR					UnusedRegister
+
+#define	InvalidBBRFValue			0x12345678
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T 			0x13
+#define	MAX_MSS_DENSITY_1T 			0x0A
+
+//----------------------------------------------------------------------------
+//       8192C Cmd9346CR bits					(Offset 0xA, 16bit)
+//----------------------------------------------------------------------------
+#define	CmdEEPROM_En				BIT5	 // EEPROM enable when set 1
+#define	CmdEERPOMSEL				BIT4 	// System EEPROM select, 0: boot from E-FUSE, 1: The EEPROM used is 9346
+#define	Cmd9346CR_9356SEL			BIT4
+#define	AutoLoadEEPROM			(CmdEEPROM_En|CmdEERPOMSEL)
+#define	AutoLoadEFUSE				CmdEEPROM_En
+
+//----------------------------------------------------------------------------
+//       8192C GPIO MUX Configuration Register (offset 0x40, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIOSEL_GPIO				0
+#define	GPIOSEL_ENBT				BIT5
+
+//----------------------------------------------------------------------------
+//       8192C GPIO PIN Control Register (offset 0x44, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIO_IN						REG_GPIO_PIN_CTRL		// GPIO pins input value
+#define	GPIO_OUT					(REG_GPIO_PIN_CTRL+1)	// GPIO pins output value
+#define	GPIO_IO_SEL				(REG_GPIO_PIN_CTRL+2)	// GPIO pins output enable when a bit is set to "1"; otherwise, input is configured.
+#define	GPIO_MOD					(REG_GPIO_PIN_CTRL+3)
+
+//----------------------------------------------------------------------------
+//       8192C (MSR) Media Status Register	(Offset 0x4C, 8 bits)  
+//----------------------------------------------------------------------------
+/*
+Network Type
+00: No link
+01: Link in ad hoc network
+10: Link in infrastructure network
+11: AP mode
+Default: 00b.
+*/
+#define	MSR_NOLINK					0x00
+#define	MSR_ADHOC					0x01
+#define	MSR_INFRA					0x02
+#define	MSR_AP						0x03
+
+//
+// 6. Adaptive Control Registers  (Offset: 0x0160 - 0x01CF)
+//
+//----------------------------------------------------------------------------
+//       8192C Response Rate Set Register	(offset 0x181, 24bits)
+//----------------------------------------------------------------------------
+#define	RRSR_RSC_OFFSET			21
+#define	RRSR_SHORT_OFFSET			23
+#define	RRSR_RSC_BW_40M			0x600000
+#define	RRSR_RSC_UPSUBCHNL		0x400000
+#define	RRSR_RSC_LOWSUBCHNL		0x200000
+#define	RRSR_SHORT					0x800000
+#define	RRSR_1M					BIT0
+#define	RRSR_2M					BIT1 
+#define	RRSR_5_5M					BIT2 
+#define	RRSR_11M					BIT3 
+#define	RRSR_6M					BIT4 
+#define	RRSR_9M					BIT5 
+#define	RRSR_12M					BIT6 
+#define	RRSR_18M					BIT7 
+#define	RRSR_24M					BIT8 
+#define	RRSR_36M					BIT9 
+#define	RRSR_48M					BIT10 
+#define	RRSR_54M					BIT11
+#define	RRSR_MCS0					BIT12
+#define	RRSR_MCS1					BIT13
+#define	RRSR_MCS2					BIT14
+#define	RRSR_MCS3					BIT15
+#define	RRSR_MCS4					BIT16
+#define	RRSR_MCS5					BIT17
+#define	RRSR_MCS6					BIT18
+#define	RRSR_MCS7					BIT19
+#define	BRSR_AckShortPmb			BIT23	
+// CCK ACK: use Short Preamble or not
+
+
+//----------------------------------------------------------------------------
+//       8192C Rate Definition
+//----------------------------------------------------------------------------
+//CCK
+#define	RATR_1M					0x00000001
+#define	RATR_2M					0x00000002
+#define	RATR_55M					0x00000004
+#define	RATR_11M					0x00000008
+//OFDM 		
+#define	RATR_6M					0x00000010
+#define	RATR_9M					0x00000020
+#define	RATR_12M					0x00000040
+#define	RATR_18M					0x00000080
+#define	RATR_24M					0x00000100
+#define	RATR_36M					0x00000200
+#define	RATR_48M					0x00000400
+#define	RATR_54M					0x00000800
+//MCS 1 Spatial Stream	
+#define	RATR_MCS0					0x00001000
+#define	RATR_MCS1					0x00002000
+#define	RATR_MCS2					0x00004000
+#define	RATR_MCS3					0x00008000
+#define	RATR_MCS4					0x00010000
+#define	RATR_MCS5					0x00020000
+#define	RATR_MCS6					0x00040000
+#define	RATR_MCS7					0x00080000
+//MCS 2 Spatial Stream
+#define	RATR_MCS8					0x00100000
+#define	RATR_MCS9					0x00200000
+#define	RATR_MCS10					0x00400000
+#define	RATR_MCS11					0x00800000
+#define	RATR_MCS12					0x01000000
+#define	RATR_MCS13					0x02000000
+#define	RATR_MCS14					0x04000000
+#define	RATR_MCS15					0x08000000
+
+//----------------------------------------------------------------------------
+//       8192C BW_OPMODE bits					(Offset 0x203, 8bit)
+//----------------------------------------------------------------------------
+#define	BW_OPMODE_20MHZ			BIT2
+#define	BW_OPMODE_5G				BIT1
+#define	BW_OPMODE_11J				BIT0
+
+
+//----------------------------------------------------------------------------
+//       8192C CAM Config Setting (offset 0x250, 1 byte)
+//----------------------------------------------------------------------------
+#define	CAM_VALID					BIT15
+#define	CAM_NOTVALID				0x0000
+#define	CAM_USEDK					BIT5
+
+#define	CAM_CONTENT_COUNT 		8
+       	       		
+#define	CAM_NONE					0x0
+#define	CAM_WEP40					0x01
+#define	CAM_TKIP					0x02
+#define	CAM_AES					0x04
+#define	CAM_WEP104				0x05
+        		
+#define	TOTAL_CAM_ENTRY			32
+#define	HALF_CAM_ENTRY			16	
+       		
+#define	CAM_CONFIG_USEDK			_TRUE
+#define	CAM_CONFIG_NO_USEDK		_FALSE
+       		
+#define	CAM_WRITE					BIT16
+#define	CAM_READ					0x00000000
+#define	CAM_POLLINIG				BIT31
+
+#define	SCR_UseDK					0x01
+#define	SCR_TxSecEnable			0x02
+#define	SCR_RxSecEnable			0x04
+
+
+//
+// 12. Host Interrupt Status Registers	 (Offset: 0x0300 - 0x030F)
+//
+//----------------------------------------------------------------------------
+//       8190 IMR/ISR bits						(offset 0xfd,  8bits)
+//----------------------------------------------------------------------------
+#define	IMR8190_DISABLED				0x0
+// IMR DW0 Bit 0-31
+#define	IMR_BCNDMAINT6				BIT31		// Beacon DMA Interrupt 6
+#define	IMR_BCNDMAINT5				BIT30		// Beacon DMA Interrupt 5
+#define	IMR_BCNDMAINT4				BIT29		// Beacon DMA Interrupt 4
+#define	IMR_BCNDMAINT3				BIT28		// Beacon DMA Interrupt 3
+#define	IMR_BCNDMAINT2				BIT27		// Beacon DMA Interrupt 2
+#define	IMR_BCNDMAINT1				BIT26		// Beacon DMA Interrupt 1
+#define	IMR_BCNDOK8					BIT25		// Beacon Queue DMA OK Interrup 8
+#define	IMR_BCNDOK7					BIT24		// Beacon Queue DMA OK Interrup 7
+#define	IMR_BCNDOK6					BIT23		// Beacon Queue DMA OK Interrup 6
+#define	IMR_BCNDOK5					BIT22		// Beacon Queue DMA OK Interrup 5
+#define	IMR_BCNDOK4					BIT21		// Beacon Queue DMA OK Interrup 4
+#define	IMR_BCNDOK3					BIT20		// Beacon Queue DMA OK Interrup 3
+#define	IMR_BCNDOK2					BIT19		// Beacon Queue DMA OK Interrup 2
+#define	IMR_BCNDOK1					BIT18		// Beacon Queue DMA OK Interrup 1
+#define	IMR_TIMEOUT2					BIT17		// Timeout interrupt 2
+#define	IMR_TIMEOUT1					BIT16		// Timeout interrupt 1
+#define	IMR_TXFOVW					BIT15		// Transmit FIFO Overflow
+#define	IMR_PSTIMEOUT					BIT14		// Power save time out interrupt 
+#define	IMR_BcnInt						BIT13		// Beacon DMA Interrupt 0
+#define	IMR_RXFOVW					BIT12		// Receive FIFO Overflow
+#define	IMR_RDU						BIT11		// Receive Descriptor Unavailable
+#define	IMR_ATIMEND					BIT10		// For 92C,ATIM Window End Interrupt
+#define	IMR_BDOK						BIT9		// Beacon Queue DMA OK Interrup
+#define	IMR_HIGHDOK					BIT8		// High Queue DMA OK Interrupt
+#define	IMR_TBDOK						BIT7		// Transmit Beacon OK interrup
+#define	IMR_MGNTDOK					BIT6		// Management Queue DMA OK Interrupt
+#define	IMR_TBDER						BIT5		// For 92C,Transmit Beacon Error Interrupt
+#define	IMR_BKDOK						BIT4		// AC_BK DMA OK Interrupt
+#define	IMR_BEDOK						BIT3		// AC_BE DMA OK Interrupt
+#define	IMR_VIDOK						BIT2		// AC_VI DMA OK Interrupt
+#define	IMR_VODOK						BIT1		// AC_VO DMA Interrupt
+#define	IMR_ROK						BIT0		// Receive DMA OK Interrupt
+
+#define	IMR_RX_MASK		(IMR_ROK|IMR_RDU|IMR_RXFOVW)
+#define	IMR_TX_MASK		(IMR_VODOK|IMR_VIDOK|IMR_BEDOK|IMR_BKDOK|IMR_MGNTDOK|IMR_HIGHDOK|IMR_BDOK)
+
+// 13. Host Interrupt Status Extension Register	 (Offset: 0x012C-012Eh)
+#define	IMR_BcnInt_E				BIT12
+#define	IMR_TXERR				BIT11
+#define	IMR_RXERR				BIT10
+#define	IMR_C2HCMD			BIT9
+#define	IMR_CPWM				BIT8
+//RSVD [2-7]
+#define	IMR_OCPINT				BIT1
+#define	IMR_WLANOFF			BIT0
+
+
+
+//----------------------------------------------------------------------------
+// 8192C EFUSE
+//----------------------------------------------------------------------------
+#define	HWSET_MAX_SIZE				128
+
+
+//----------------------------------------------------------------------------
+//       8192C EEPROM/EFUSE share register definition.
+//----------------------------------------------------------------------------
+
+//
+// Default Value for EEPROM or EFUSE!!!
+//
+#define EEPROM_Default_TSSI					0x0
+#define EEPROM_Default_TxPowerDiff			0x0
+#define EEPROM_Default_CrystalCap			0x5
+#define EEPROM_Default_BoardType			0x02 // Default: 2X2, RTL8192CE(QFPN68)
+#define EEPROM_Default_TxPower				0x1010
+#define EEPROM_Default_HT2T_TxPwr			0x10
+
+#define EEPROM_Default_LegacyHTTxPowerDiff	0x3
+#define EEPROM_Default_ThermalMeter			0x12
+
+#define EEPROM_Default_AntTxPowerDiff		0x0
+#define EEPROM_Default_TxPwDiff_CrystalCap	0x5
+#define EEPROM_Default_TxPowerLevel		0x22
+#define EEPROM_Default_HT40_2SDiff			0x0
+#define EEPROM_Default_HT20_Diff			2	// HT20<->40 default Tx Power Index Difference
+#define EEPROM_Default_LegacyHTTxPowerDiff	0x3
+#define EEPROM_Default_HT40_PwrMaxOffset	0
+#define EEPROM_Default_HT20_PwrMaxOffset	0
+
+// For debug
+#define EEPROM_Default_PID					0x1234
+#define EEPROM_Default_VID					0x5678
+#define EEPROM_Default_CustomerID			0xAB
+#define EEPROM_Default_SubCustomerID		0xCD
+#define EEPROM_Default_Version				0
+
+#define EEPROM_CHANNEL_PLAN_FCC				0x0
+#define EEPROM_CHANNEL_PLAN_IC				0x1
+#define EEPROM_CHANNEL_PLAN_ETSI				0x2
+#define EEPROM_CHANNEL_PLAN_SPAIN			0x3
+#define EEPROM_CHANNEL_PLAN_FRANCE			0x4
+#define EEPROM_CHANNEL_PLAN_MKK				0x5
+#define EEPROM_CHANNEL_PLAN_MKK1				0x6
+#define EEPROM_CHANNEL_PLAN_ISRAEL			0x7
+#define EEPROM_CHANNEL_PLAN_TELEC			0x8
+#define EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN	0x9
+#define EEPROM_CHANNEL_PLAN_WORLD_WIDE_13	0xA
+#define EEPROM_CHANNEL_PLAN_NCC				0xB
+#define EEPROM_USB_OPTIONAL1					0xE
+#define EEPROM_CHANNEL_PLAN_BY_HW_MASK		0x80
+
+
+#define EEPROM_CID_DEFAULT				0x0
+#define EEPROM_CID_TOSHIBA					0x4
+#define EEPROM_CID_CCX						0x10 // CCX test. By Bruce, 2009-02-25.
+#define EEPROM_CID_QMI						0x0D
+#define EEPROM_CID_WHQL 					0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	RTL_EEPROM_ID						0x8129
+
+
+#ifdef CONFIG_PCI_HCI
+#define RT_IBSS_INT_MASKS				(IMR_BcnInt | IMR_TBDOK | IMR_TBDER)
+#define RT_AC_INT_MASKS				(IMR_VIDOK | IMR_VODOK | IMR_BEDOK|IMR_BKDOK)
+#define RT_BSS_INT_MASKS				(RT_IBSS_INT_MASKS)
+
+//
+// Interface type.
+//
+typedef	enum _INTERFACE_SELECT_8192CPCIe{
+	INTF_SEL0_SOLO_MINICARD			= 0,		// WiFi solo-mCard
+	INTF_SEL1_BT_COMBO_MINICARD		= 1,		// WiFi+BT combo-mCard
+	INTF_SEL2_PCIe					= 2,		// PCIe Card
+} INTERFACE_SELECT_8192CPCIe, *PINTERFACE_SELECT_8192CPCIe;
+
+#define RTL8190_EEPROM_ID					0x8129	// 0-1
+#define EEPROM_HPON						0x02 // LDO settings.2-5
+#define EEPROM_CLK							0x06 // Clock settings.6-7
+#define EEPROM_TESTR						0x08 // SE Test mode.8
+
+#define EEPROM_VID							0x0A // SE Vendor ID.A-B
+#define EEPROM_DID							0x0C // SE Device ID. C-D
+#define EEPROM_SVID							0x0E // SE Vendor ID.E-F
+#define EEPROM_SMID						0x10 // SE PCI Subsystem ID. 10-11
+
+#define EEPROM_MAC_ADDR					0x16 // SEMAC Address. 12-17
+
+//----------------------------------------------------------------
+// Ziv - Let PCIe and USB use the same define. Modify address mapping later.
+#define EEPROM_CCK_TX_PWR_INX					0x5A
+#define EEPROM_HT40_1S_TX_PWR_INX			0x60
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF		0x66
+#define EEPROM_HT20_TX_PWR_INX_DIFF			0x69
+#define EEPROM_OFDM_TX_PWR_INX_DIFF			0x6C
+#define EEPROM_HT40_MAX_PWR_OFFSET			0x6F
+#define EEPROM_HT20_MAX_PWR_OFFSET			0x72
+
+#define EEPROM_CHANNEL_PLAN 				0x75
+#define EEPROM_TSSI_A						0x76
+#define EEPROM_TSSI_B						0x77
+#define EEPROM_THERMAL_METER				0x78
+#define EEPROM_RF_OPT1						0x79
+#define EEPROM_RF_OPT2						0x7A
+#define EEPROM_RF_OPT3						0x7B
+#define EEPROM_RF_OPT4						0x7C
+#define EEPROM_VERSION						0x7E
+#define EEPROM_CUSTOMER_ID				0x7F
+
+#define EEPROM_NORMAL_BoardType			EEPROM_RF_OPT1	//[7:5]
+
+#endif 
+
+#ifdef CONFIG_USB_HCI
+
+//should be renamed and moved to another file
+typedef	enum _BOARD_TYPE_8192CUSB{
+	BOARD_USB_DONGLE 			= 0,		// USB dongle
+	BOARD_USB_High_PA 		= 1,		// USB dongle with high power PA
+	BOARD_MINICARD		  	= 2,		// Minicard
+	BOARD_USB_SOLO 		 	= 3,		// USB solo-Slim module
+	BOARD_USB_COMBO			= 4,		// USB Combo-Slim module
+} BOARD_TYPE_8192CUSB, *PBOARD_TYPE_8192CUSB;
+
+#define	SUPPORT_HW_RADIO_DETECT(pHalData)	(pHalData->BoardType == BOARD_MINICARD||\
+													pHalData->BoardType == BOARD_USB_SOLO||\
+													pHalData->BoardType == BOARD_USB_COMBO)
+
+//---------------------------------------------------------------
+// EEPROM address for Test chip
+//---------------------------------------------------------------
+#define EEPROM_TEST_USB_OPT						0x0E
+#define EEPROM_TEST_CHIRP_K						0x0F
+#define EEPROM_TEST_EP_SETTING					0x0E
+#define EEPROM_TEST_USB_PHY						0x10
+
+
+//---------------------------------------------------------------
+// EEPROM address for Normal chip
+//---------------------------------------------------------------
+#define EEPROM_NORMAL_USB_OPT					0x0E
+#define EEPROM_NORMAL_CHIRP_K						0x0E	// Changed
+#define EEPROM_NORMAL_EP_SETTING					0x0F	// Changed
+#define EEPROM_NORMAL_USB_PHY					0x12	// Changed
+
+
+// Test chip and normal chip common define
+//---------------------------------------------------------------
+// EEPROM address for both
+//---------------------------------------------------------------
+#define EEPROM_ID0								0x00
+#define EEPROM_ID1								0x01
+#define EEPROM_RTK_RSV1						0x02
+#define EEPROM_RTK_RSV2						0x03
+#define EEPROM_RTK_RSV3						0x04
+#define EEPROM_RTK_RSV4						0x05
+#define EEPROM_RTK_RSV5						0x06
+#define EEPROM_DBG_SEL							0x07
+#define EEPROM_RTK_RSV6						0x08
+#define EEPROM_VID								0x0A
+#define EEPROM_PID								0x0C
+
+#define EEPROM_MAC_ADDR						0x16
+#define EEPROM_STRING							0x1C
+#define EEPROM_SUBCUSTOMER_ID					0x59
+#define EEPROM_CCK_TX_PWR_INX					0x5A
+#define EEPROM_HT40_1S_TX_PWR_INX			0x60
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF		0x66
+#define EEPROM_HT20_TX_PWR_INX_DIFF			0x69
+#define EEPROM_OFDM_TX_PWR_INX_DIFF			0x6C
+#define EEPROM_HT40_MAX_PWR_OFFSET			0x6F
+#define EEPROM_HT20_MAX_PWR_OFFSET			0x72
+
+#define EEPROM_CHANNEL_PLAN					0x75
+#define EEPROM_TSSI_A							0x76
+#define EEPROM_TSSI_B							0x77
+#define EEPROM_THERMAL_METER					0x78
+#define EEPROM_RF_OPT1							0x79
+#define EEPROM_RF_OPT2							0x7A
+#define EEPROM_RF_OPT3							0x7B
+#define EEPROM_RF_OPT4							0x7C
+#define EEPROM_VERSION							0x7E
+#define EEPROM_CUSTOMER_ID					0x7F
+
+#define EEPROM_BoardType						0x54 //0x0: RTL8188SU, 0x1: RTL8191SU, 0x2: RTL8192SU, 0x3: RTL8191GU
+#define EEPROM_TxPwIndex						0x5C //0x5C-0x76, Tx Power index.
+#define EEPROM_PwDiff							0x67 // Difference of gain index between legacy and high throughput OFDM.
+
+#define EEPROM_TxPowerCCK						0x5A // CCK Tx Power
+
+// 2009/02/09 Cosa Add for SD3 requirement 
+#define EEPROM_TX_PWR_HT20_DIFF				0x6e// HT20 Tx Power Index Difference
+#define DEFAULT_HT20_TXPWR_DIFF				2	// HT20<->40 default Tx Power Index Difference
+#define EEPROM_TX_PWR_OFDM_DIFF				0x71// OFDM Tx Power Index Difference
+
+#define EEPROM_TxPWRGroup						0x73// Power diff for channel group
+#define EEPROM_Regulatory						0x79// Check if power safety is need
+
+#define EEPROM_BLUETOOTH_COEXIST				0x7E // 92cu, 0x7E[4]
+#define EEPROM_NORMAL_BoardType				EEPROM_RF_OPT1	//[7:5]
+#define BOARD_TYPE_NORMAL_MASK				0xE0
+#define BOARD_TYPE_TEST_MASK					0x0F
+#define EEPROM_EASY_REPLACEMENT				0x50//BIT0 1 for build-in module, 0 for external dongle
+//-------------------------------------------------------------
+//	EEPROM content definitions
+//-------------------------------------------------------------
+#define OS_LINK_SPEED							BIT(5)
+
+#define BOARD_TYPE_MASK						0xF
+
+#define BT_COEXISTENCE							BIT(4)
+#define BT_CO_SHIFT								4
+
+#define EP_NUMBER_MASK							0x30	//bit 4:5 0Eh
+#define EP_NUMBER_SHIFT						4
+
+
+#define USB_PHY_PARA_SIZE						5
+
+
+//-------------------------------------------------------------
+//	EEPROM default value definitions
+//-------------------------------------------------------------
+// Use 0xABCD instead of 0x8192 for debug
+#define EEPROM_DEF_ID_0						0xCD	// Byte 0x00
+#define EEPROM_DEF_ID_1						0xAB	// Byte 0x01
+
+#define EEPROM_DEF_RTK_RSV_A3					0x74	// Byte 0x03
+#define EEPROM_DEF_RTK_RSV_A4					0x6D	// Byte 0x04
+#define EEPROM_DEF_RTK_RSV_A8					0xFF	// Byte 0x08
+
+#define EEPROM_DEF_VID_0						0x0A	// Byte 0x0A
+#define EEPROM_DEF_VID_1						0x0B
+
+#define EEPROM_DEF_PID_0						0x92	// Byte 0x0C
+#define EEPROM_DEF_PID_1						0x81
+
+
+#define EEPROM_TEST_DEF_USB_OPT				0x80	// Byte 0x0E
+#define EEPROM_NORMAL_DEF_USB_OPT			0x00	// Byte 0x0E
+
+#define EEPROM_DEF_CHIRPK						0x15	// Byte 0x0F
+
+#define EEPROM_DEF_USB_PHY_0					0x85	// Byte 0x10
+#define EEPROM_DEF_USB_PHY_1					0x62	// Byte 0x11
+#define EEPROM_DEF_USB_PHY_2					0x9E	// Byte 0x12
+#define EEPROM_DEF_USB_PHY_3					0x06	// Byte 0x13
+
+#define EEPROM_DEF_TSSI_A						0x09	// Byte 0x78
+#define EEPROM_DEF_TSSI_B						0x09	// Byte 0x79
+
+
+#define EEPROM_DEF_THERMAL_METER				0x12	// Byte 0x7A
+
+#define RF_OPTION1					0x79// Check if power safety spec is need
+#define RF_OPTION2					0x7A
+#define RF_OPTION3					0x7B
+#define RF_OPTION4					0x7C
+
+
+#define	EEPROM_USB_SN							BIT(0)
+#define	EEPROM_USB_REMOTE_WAKEUP			BIT(1)
+#define	EEPROM_USB_DEVICE_PWR				BIT(2)
+#define	EEPROM_EP_NUMBER						(BIT(3)|BIT(4))
+
+#if 0
+#define	EEPROM_CHANNEL_PLAN_FCC					0x0
+#define	EEPROM_CHANNEL_PLAN_IC					0x1
+#define	EEPROM_CHANNEL_PLAN_ETSI				0x2
+#define	EEPROM_CHANNEL_PLAN_SPAIN				0x3
+#define	EEPROM_CHANNEL_PLAN_FRANCE				0x4
+#define	EEPROM_CHANNEL_PLAN_MKK					0x5
+#define	EEPROM_CHANNEL_PLAN_MKK1				0x6
+#define	EEPROM_CHANNEL_PLAN_ISRAEL				0x7
+#define	EEPROM_CHANNEL_PLAN_TELEC				0x8
+#define	EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN		0x9
+#define	EEPROM_CHANNEL_PLAN_WORLD_WIDE_13		0xA
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK			0x80
+
+#define	EEPROM_CID_DEFAULT						0x0
+
+#define	EEPROM_CID_WHQL 						0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	EEPROM_CID_CCX							0x10 // CCX test. By Bruce, 2009-02-25.
+#endif
+
+#endif
+
+
+/*===================================================================
+=====================================================================
+Here the register defines are for 92C. When the define is as same with 92C, 
+we will use the 92C's define for the consistency
+So the following defines for 92C is not entire!!!!!!
+=====================================================================
+=====================================================================*/
+/*
+Based on Datasheet V33---090401
+Register Summary
+Current IOREG MAP
+0x0000h ~ 0x00FFh   System Configuration (256 Bytes)
+0x0100h ~ 0x01FFh   MACTOP General Configuration (256 Bytes)
+0x0200h ~ 0x027Fh   TXDMA Configuration (128 Bytes)
+0x0280h ~ 0x02FFh   RXDMA Configuration (128 Bytes)
+0x0300h ~ 0x03FFh   PCIE EMAC Reserved Region (256 Bytes)
+0x0400h ~ 0x04FFh   Protocol Configuration (256 Bytes)
+0x0500h ~ 0x05FFh   EDCA Configuration (256 Bytes)
+0x0600h ~ 0x07FFh   WMAC Configuration (512 Bytes)
+0x2000h ~ 0x3FFFh   8051 FW Download Region (8196 Bytes)
+*/
+
+//----------------------------------------------------------------------------
+//       8192C (RCR) Receive Configuration Register	(Offset 0x608, 32 bits)
+//----------------------------------------------------------------------------
+#define	RCR_APPFCS					BIT31		//WMAC append FCS after pauload
+#define	RCR_APP_MIC				BIT30		//
+#define	RCR_APP_PHYSTS			BIT28//
+#define	RCR_APP_ICV				BIT29       //
+#define	RCR_APP_PHYST_RXFF		BIT28       //
+#define	RCR_APP_BA_SSN			BIT27		//Accept BA SSN
+#define	RCR_ENMBID					BIT24		//Enable Multiple BssId.
+#define	RCR_LSIGEN					BIT23
+#define	RCR_MFBEN					BIT22
+#define	RCR_HTC_LOC_CTRL			BIT14       //MFC<--HTC=1 MFC-->HTC=0
+#define	RCR_AMF					BIT13		//Accept management type frame
+#define	RCR_ACF					BIT12		//Accept control type frame
+#define	RCR_ADF					BIT11		//Accept data type frame
+#define	RCR_AICV					BIT9		//Accept ICV error packet
+#define	RCR_ACRC32					BIT8		//Accept CRC32 error packet 
+#define	RCR_CBSSID_BCN			BIT7		//Accept BSSID match packet (Rx beacon, probe rsp)
+#define	RCR_CBSSID_DATA			BIT6		//Accept BSSID match packet (Data)
+#define	RCR_CBSSID					RCR_CBSSID_DATA		//Accept BSSID match packet
+#define	RCR_APWRMGT				BIT5		//Accept power management packet
+#define	RCR_ADD3					BIT4		//Accept address 3 match packet
+#define	RCR_AB						BIT3		//Accept broadcast packet 
+#define	RCR_AM						BIT2		//Accept multicast packet 
+#define	RCR_APM					BIT1		//Accept physical match packet
+#define	RCR_AAP					BIT0		//Accept all unicast packet 
+#define	RCR_MXDMA_OFFSET			8
+#define	RCR_FIFO_OFFSET			13
+
+
+
+//============================================================================
+//       8192c USB specific Regsiter Offset and Content definition, 
+//       2009.08.18, added by vivi. for merge 92c and 92C into one driver
+//============================================================================
+//#define APS_FSMCO				0x0004  same with 92Ce
+#define RSV_CTRL					0x001C
+#define RD_CTRL					0x0524
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+#define REG_USB_VID					0xFE60
+#define REG_USB_PID					0xFE62
+#define REG_USB_OPTIONAL			0xFE64
+#define REG_USB_CHIRP_K			0xFE65
+#define REG_USB_PHY					0xFE66
+#define REG_USB_MAC_ADDR			0xFE70
+
+#define REG_USB_HRPWM				0xFE58
+#define REG_USB_HCPWM				0xFE57
+
+#define	InvalidBBRFValue			0x12345678
+
+//============================================================================
+//       8192C Regsiter Bit and Content definition 
+//============================================================================
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+
+//2 SPS0_CTRL
+#define SW18_FPWM					BIT(3)
+
+
+//2 SYS_ISO_CTRL
+#define ISO_MD2PP					BIT(0)
+#define ISO_UA2USB					BIT(1)
+#define ISO_UD2CORE					BIT(2)
+#define ISO_PA2PCIE					BIT(3)
+#define ISO_PD2CORE					BIT(4)
+#define ISO_IP2MAC					BIT(5)
+#define ISO_DIOP						BIT(6)
+#define ISO_DIOE						BIT(7)
+#define ISO_EB2CORE					BIT(8)
+#define ISO_DIOR						BIT(9)
+
+#define PWC_EV25V					BIT(14)
+#define PWC_EV12V					BIT(15)
+
+
+//2 SYS_FUNC_EN
+#define FEN_BBRSTB					BIT(0)
+#define FEN_BB_GLB_RSTn			BIT(1)
+#define FEN_USBA					BIT(2)
+#define FEN_UPLL					BIT(3)
+#define FEN_USBD					BIT(4)
+#define FEN_DIO_PCIE				BIT(5)
+#define FEN_PCIEA					BIT(6)
+#define FEN_PPLL						BIT(7)
+#define FEN_PCIED					BIT(8)
+#define FEN_DIOE					BIT(9)
+#define FEN_CPUEN					BIT(10)
+#define FEN_DCORE					BIT(11)
+#define FEN_ELDR					BIT(12)
+#define FEN_DIO_RF					BIT(13)
+#define FEN_HWPDN					BIT(14)
+#define FEN_MREGEN					BIT(15)
+
+//2 APS_FSMCO
+#define PFM_LDALL					BIT(0)
+#define PFM_ALDN					BIT(1)
+#define PFM_LDKP					BIT(2)
+#define PFM_WOWL					BIT(3)
+#define EnPDN						BIT(4)
+#define PDN_PL						BIT(5)
+#define APFM_ONMAC					BIT(8)
+#define APFM_OFF					BIT(9)
+#define APFM_RSM					BIT(10)
+#define AFSM_HSUS					BIT(11)
+#define AFSM_PCIE					BIT(12)
+#define APDM_MAC					BIT(13)
+#define APDM_HOST					BIT(14)
+#define APDM_HPDN					BIT(15)
+#define RDY_MACON					BIT(16)
+#define SUS_HOST					BIT(17)
+#define ROP_ALD						BIT(20)
+#define ROP_PWR						BIT(21)
+#define ROP_SPS						BIT(22)
+#define SOP_MRST					BIT(25)
+#define SOP_FUSE					BIT(26)
+#define SOP_ABG						BIT(27)
+#define SOP_AMB						BIT(28)
+#define SOP_RCK						BIT(29)
+#define SOP_A8M						BIT(30)
+#define XOP_BTCK					BIT(31)
+
+//2 SYS_CLKR
+#define ANAD16V_EN					BIT(0)
+#define ANA8M						BIT(1)
+#define MACSLP						BIT(4)
+#define LOADER_CLK_EN				BIT(5)
+#define _80M_SSC_DIS				BIT(7)
+#define _80M_SSC_EN_HO				BIT(8)
+#define PHY_SSC_RSTB				BIT(9)
+#define SEC_CLK_EN					BIT(10)
+#define MAC_CLK_EN					BIT(11)
+#define SYS_CLK_EN					BIT(12)
+#define RING_CLK_EN					BIT(13)
+
+
+//2 9346CR
+
+
+#define 	EEDO					BIT(0)
+#define 	EEDI					BIT(1)
+#define 	EESK					BIT(2)
+#define 	EECS					BIT(3)
+//#define 	EERPROMSEL			BIT(4)
+//#define 	EEPROM_EN			BIT(5)
+#define		BOOT_FROM_EEPROM		BIT(4)
+#define		EEPROM_EN				BIT(5)
+#define 	EEM0					BIT(6)
+#define 	EEM1					BIT(7)
+
+
+//2 AFE_MISC
+#define AFE_BGEN					BIT(0)
+#define AFE_MBEN					BIT(1)
+#define MAC_ID_EN					BIT(7)
+
+
+//2 SPS0_CTRL
+
+
+//2 SPS_OCP_CFG
+
+
+//2 RSV_CTRL
+#define WLOCK_ALL					BIT(0)
+#define WLOCK_00					BIT(1)
+#define WLOCK_04					BIT(2)
+#define WLOCK_08					BIT(3)
+#define WLOCK_40					BIT(4)
+#define R_DIS_PRST_0				BIT(5)
+#define R_DIS_PRST_1				BIT(6)
+#define LOCK_ALL_EN					BIT(7)
+
+//2 RF_CTRL
+#define RF_EN						BIT(0)
+#define RF_RSTB						BIT(1)
+#define RF_SDMRSTB					BIT(2)
+
+
+
+//2 LDOA15_CTRL
+#define LDA15_EN					BIT(0)
+#define LDA15_STBY					BIT(1)
+#define LDA15_OBUF					BIT(2)
+#define LDA15_REG_VOS				BIT(3)
+#define _LDA15_VOADJ(x)				(((x) & 0x7) << 4)
+
+
+
+//2 LDOV12D_CTRL
+#define LDV12_EN					BIT(0)
+#define LDV12_SDBY					BIT(1)
+#define LPLDO_HSM					BIT(2)
+#define LPLDO_LSM_DIS				BIT(3)
+#define _LDV12_VADJ(x)				(((x) & 0xF) << 4)
+
+
+//2 AFE_XTAL_CTRL
+#define XTAL_EN						BIT(0)
+#define XTAL_BSEL					BIT(1)
+#define _XTAL_BOSC(x)				(((x) & 0x3) << 2)
+#define _XTAL_CADJ(x)				(((x) & 0xF) << 4)
+#define XTAL_GATE_USB				BIT(8)
+#define _XTAL_USB_DRV(x)			(((x) & 0x3) << 9)
+#define XTAL_GATE_AFE				BIT(11)
+#define _XTAL_AFE_DRV(x)			(((x) & 0x3) << 12)
+#define XTAL_RF_GATE				BIT(14)
+#define _XTAL_RF_DRV(x)				(((x) & 0x3) << 15)
+#define XTAL_GATE_DIG				BIT(17)
+#define _XTAL_DIG_DRV(x)			(((x) & 0x3) << 18)
+#define XTAL_BT_GATE				BIT(20)
+#define _XTAL_BT_DRV(x)				(((x) & 0x3) << 21)
+#define _XTAL_GPIO(x)				(((x) & 0x7) << 23)
+
+
+#define CKDLY_AFE					BIT(26)
+#define CKDLY_USB					BIT(27)
+#define CKDLY_DIG					BIT(28)
+#define CKDLY_BT					BIT(29)
+
+
+//2 AFE_PLL_CTRL
+#define APLL_EN						BIT(0)
+#define APLL_320_EN					BIT(1)
+#define APLL_FREF_SEL				BIT(2)
+#define APLL_EDGE_SEL				BIT(3)
+#define APLL_WDOGB					BIT(4)
+#define APLL_LPFEN					BIT(5)
+
+#define APLL_REF_CLK_13MHZ			0x1
+#define APLL_REF_CLK_19_2MHZ		0x2
+#define APLL_REF_CLK_20MHZ			0x3
+#define APLL_REF_CLK_25MHZ			0x4
+#define APLL_REF_CLK_26MHZ			0x5
+#define APLL_REF_CLK_38_4MHZ		0x6
+#define APLL_REF_CLK_40MHZ			0x7
+
+#define APLL_320EN					BIT(14)
+#define APLL_80EN					BIT(15)
+#define APLL_1MEN					BIT(24)
+
+
+//2 EFUSE_CTRL
+#define ALD_EN						BIT(18)
+#define EF_PD						BIT(19)
+#define EF_FLAG						BIT(31)
+
+//2 EFUSE_TEST (For RTL8723 partially)
+#define EF_TRPT						BIT(7)
+#define EF_CELL_SEL					(BIT(8)|BIT(9)) // 00: Wifi Efuse, 01: BT Efuse0, 10: BT Efuse1, 11: BT Efuse2
+#define LDOE25_EN					BIT(31)
+#define EFUSE_SEL(x)					(((x) & 0x3) << 8)
+#define EFUSE_SEL_MASK				0x300
+#define EFUSE_WIFI_SEL_0			0x0
+#define EFUSE_BT_SEL_0				0x1
+#define EFUSE_BT_SEL_1				0x2
+#define EFUSE_BT_SEL_2				0x3
+
+#define EFUSE_ACCESS_ON			0x69	// For RTL8723 only.
+#define EFUSE_ACCESS_OFF			0x00	// For RTL8723 only.
+
+//2 PWR_DATA 
+
+//2 CAL_TIMER
+
+//2 ACLK_MON
+#define RSM_EN						BIT(0)
+#define Timer_EN						BIT(4)
+
+
+//2 GPIO_MUXCFG
+#define TRSW0EN						BIT(2)
+#define TRSW1EN						BIT(3)
+#define EROM_EN						BIT(4)
+#define EnBT							BIT(5)
+#define EnUart						BIT(8)
+#define Uart_910						BIT(9)
+#define EnPMAC						BIT(10)
+#define SIC_SWRST					BIT(11)
+#define EnSIC						BIT(12)
+#define SIC_23						BIT(13)
+#define EnHDP						BIT(14)
+#define SIC_LBK						BIT(15)
+
+//2 GPIO_PIN_CTRL
+
+// GPIO BIT
+#define HAL_8192C_HW_GPIO_WPS_BIT		BIT(2)
+
+//2 GPIO_INTM
+
+//2 LEDCFG
+#define LED0PL 						BIT(4)  
+#define LED0DIS						BIT(7)
+#define LED1DIS						BIT(15)
+#define LED1PL 						BIT(12)
+
+#define  SECCAM_CLR					BIT(30)
+
+
+//2 FSIMR
+
+//2 FSISR
+
+
+//2 8051FWDL
+//2 MCUFWDL
+#define MCUFWDL_EN					BIT(0)
+#define MCUFWDL_RDY				BIT(1)
+#define FWDL_ChkSum_rpt			BIT(2)
+#define MACINI_RDY					BIT(3)
+#define BBINI_RDY					BIT(4)
+#define RFINI_RDY					BIT(5)
+#define WINTINI_RDY					BIT(6)
+#define CPRST						BIT(23)
+
+//2REG_HPON_FSM
+#define BOND92CE_1T2R_CFG			BIT(22)
+
+
+//2 REG_SYS_CFG
+#define XCLK_VLD						BIT(0)
+#define ACLK_VLD					BIT(1)
+#define UCLK_VLD					BIT(2)
+#define PCLK_VLD						BIT(3)
+#define PCIRSTB						BIT(4)
+#define V15_VLD						BIT(5)
+#define TRP_B15V_EN					BIT(7)
+#define SIC_IDLE						BIT(8)
+#define BD_MAC2						BIT(9)
+#define BD_MAC1						BIT(10)
+#define IC_MACPHY_MODE				BIT(11)
+#define CHIP_VER						(BIT(12)|BIT(13)|BIT(14)|BIT(15))
+#define BT_FUNC						BIT(16)
+#define VENDOR_ID					BIT(19)
+#define PAD_HWPD_IDN				BIT(22)
+#define TRP_VAUX_EN					BIT(23)
+#define TRP_BT_EN					BIT(24)
+#define BD_PKG_SEL					BIT(25)
+#define BD_HCI_SEL					BIT(26)
+#define TYPE_ID						BIT(27)
+
+#define CHIP_VER_RTL_MASK			0xF000	//Bit 12 ~ 15
+#define CHIP_VER_RTL_SHIFT			12
+
+//2REG_GPIO_OUTSTS (For RTL8723 only)
+#define	EFS_HCI_SEL				(BIT(0)|BIT(1))
+#define	PAD_HCI_SEL				(BIT(2)|BIT(3))
+#define	HCI_SEL						(BIT(4)|BIT(5)) 
+#define	PKG_SEL_HCI				BIT(6)
+#define	FEN_GPS					BIT(7)
+#define	FEN_BT						BIT(8)
+#define	FEN_WL						BIT(9)
+#define	FEN_PCI						BIT(10)
+#define	FEN_USB					BIT(11)
+#define	BTRF_HWPDN_N				BIT(12)
+#define	WLRF_HWPDN_N				BIT(13)
+#define	PDN_BT_N					BIT(14)
+#define	PDN_GPS_N					BIT(15)
+#define	BT_CTL_HWPDN				BIT(16)
+#define	GPS_CTL_HWPDN				BIT(17)
+#define	PPHY_SUSB					BIT(20)
+#define	UPHY_SUSB					BIT(21)
+#define	PCI_SUSEN					BIT(22)
+#define	USB_SUSEN					BIT(23)
+#define	RF_RL_ID					(BIT(31)|BIT(30)|BIT(29)|BIT(28))
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+
+
+//2 Function Enable Registers
+//2 CR
+
+#define REG_LBMODE					(REG_CR + 3)
+
+
+#define HCI_TXDMA_EN				BIT(0)
+#define HCI_RXDMA_EN				BIT(1)
+#define TXDMA_EN					BIT(2)
+#define RXDMA_EN					BIT(3)
+#define PROTOCOL_EN					BIT(4)
+#define SCHEDULE_EN					BIT(5)
+#define MACTXEN						BIT(6)
+#define MACRXEN						BIT(7)
+#define ENSWBCN						BIT(8)
+#define ENSEC						BIT(9)
+
+// Network type
+#define _NETTYPE(x)					(((x) & 0x3) << 16)
+#define MASK_NETTYPE				0x30000
+#define NT_NO_LINK					0x0
+#define NT_LINK_AD_HOC				0x1
+#define NT_LINK_AP					0x2
+#define NT_AS_AP					0x3
+
+#define _LBMODE(x)					(((x) & 0xF) << 24)
+#define MASK_LBMODE				0xF000000
+#define LOOPBACK_NORMAL			0x0
+#define LOOPBACK_IMMEDIATELY		0xB
+#define LOOPBACK_MAC_DELAY		0x3
+#define LOOPBACK_PHY				0x1
+#define LOOPBACK_DMA				0x7
+
+
+//2 PBP - Page Size Register
+#define GET_RX_PAGE_SIZE(value)		((value) & 0xF)
+#define GET_TX_PAGE_SIZE(value)		(((value) & 0xF0) >> 4)
+#define _PSRX_MASK					0xF
+#define _PSTX_MASK					0xF0
+#define _PSRX(x)						(x)
+#define _PSTX(x)						((x) << 4)
+
+#define PBP_64						0x0
+#define PBP_128						0x1
+#define PBP_256						0x2
+#define PBP_512						0x3
+#define PBP_1024					0x4
+
+
+//2 TX/RXDMA
+#define RXDMA_ARBBW_EN			BIT(0)
+#define RXSHFT_EN					BIT(1)
+#define RXDMA_AGG_EN				BIT(2)
+#define QS_VO_QUEUE				BIT(8)
+#define QS_VI_QUEUE					BIT(9)
+#define QS_BE_QUEUE				BIT(10)
+#define QS_BK_QUEUE				BIT(11)
+#define QS_MANAGER_QUEUE			BIT(12)
+#define QS_HIGH_QUEUE				BIT(13)
+
+#define HQSEL_VOQ					BIT(0)
+#define HQSEL_VIQ					BIT(1)
+#define HQSEL_BEQ					BIT(2)
+#define HQSEL_BKQ					BIT(3)
+#define HQSEL_MGTQ					BIT(4)
+#define HQSEL_HIQ					BIT(5)
+
+// For normal driver, 0x10C
+#define _TXDMA_HIQ_MAP(x) 	 		(((x)&0x3) << 14)
+#define _TXDMA_MGQ_MAP(x) 	 		(((x)&0x3) << 12)
+#define _TXDMA_BKQ_MAP(x) 	 		(((x)&0x3) << 10)		
+#define _TXDMA_BEQ_MAP(x) 	 		(((x)&0x3) << 8 )
+#define _TXDMA_VIQ_MAP(x) 	 		(((x)&0x3) << 6 )
+#define _TXDMA_VOQ_MAP(x) 	 		(((x)&0x3) << 4 )
+
+#define QUEUE_LOW					1
+#define QUEUE_NORMAL				2
+#define QUEUE_HIGH					3
+
+
+
+//2 TRXFF_BNDY
+
+
+//2 LLT_INIT
+#define _LLT_NO_ACTIVE				0x0
+#define _LLT_WRITE_ACCESS			0x1
+#define _LLT_READ_ACCESS			0x2
+
+#define _LLT_INIT_DATA(x)			((x) & 0xFF)
+#define _LLT_INIT_ADDR(x)			(((x) & 0xFF) << 8)
+#define _LLT_OP(x)					(((x) & 0x3) << 30)
+#define _LLT_OP_VALUE(x)			(((x) >> 30) & 0x3)
+
+
+//2 BB_ACCESS_CTRL
+#define BB_WRITE_READ_MASK		(BIT(31) | BIT(30))
+#define BB_WRITE_EN					BIT(30)
+#define BB_READ_EN					BIT(31)
+//#define BB_ADDR_MASK				0xFFF
+//#define _BB_ADDR(x)					((x) & BB_ADDR_MASK)
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+//2 RQPN
+#define _HPQ(x)						((x) & 0xFF)
+#define _LPQ(x)						(((x) & 0xFF) << 8)
+#define _PUBQ(x)						(((x) & 0xFF) << 16)
+#define _NPQ(x)						((x) & 0xFF)			// NOTE: in RQPN_NPQ register
+
+
+#define HPQ_PUBLIC_DIS				BIT(24)
+#define LPQ_PUBLIC_DIS				BIT(25)
+#define LD_RQPN						BIT(31)
+
+
+//2 TDECTRL
+#define BCN_VALID					BIT(16)
+#define BCN_HEAD(x)					(((x) & 0xFF) << 8)
+#define	BCN_HEAD_MASK				0xFF00
+
+//2 TDECTL
+#define BLK_DESC_NUM_SHIFT			4
+#define BLK_DESC_NUM_MASK			0xF
+
+
+//2 TXDMA_OFFSET_CHK
+#define DROP_DATA_EN				BIT(9)
+
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+//2 FWHW_TXQ_CTRL
+#define EN_AMPDU_RTY_NEW			BIT(7)
+
+//2 INIRTSMCS_SEL
+#define _INIRTSMCS_SEL(x)			((x) & 0x3F)
+
+
+//2 SPEC SIFS
+#define _SPEC_SIFS_CCK(x)			((x) & 0xFF)
+#define _SPEC_SIFS_OFDM(x)			(((x) & 0xFF) << 8)
+
+
+//2 RRSR
+
+#define RATE_REG_BITMAP_ALL			0xFFFFF
+
+#define _RRSC_BITMAP(x)					((x) & 0xFFFFF)
+
+#define _RRSR_RSC(x)						(((x) & 0x3) << 21)
+#define RRSR_RSC_RESERVED				0x0
+#define RRSR_RSC_UPPER_SUBCHANNEL	0x1
+#define RRSR_RSC_LOWER_SUBCHANNEL	0x2
+#define RRSR_RSC_DUPLICATE_MODE		0x3
+
+
+//2 ARFR
+#define USE_SHORT_G1				BIT(20)
+
+//2 AGGLEN_LMT_L
+#define _AGGLMT_MCS0(x)				((x) & 0xF)
+#define _AGGLMT_MCS1(x)				(((x) & 0xF) << 4)
+#define _AGGLMT_MCS2(x)				(((x) & 0xF) << 8)
+#define _AGGLMT_MCS3(x)				(((x) & 0xF) << 12)
+#define _AGGLMT_MCS4(x)				(((x) & 0xF) << 16)
+#define _AGGLMT_MCS5(x)				(((x) & 0xF) << 20)
+#define _AGGLMT_MCS6(x)				(((x) & 0xF) << 24)
+#define _AGGLMT_MCS7(x)				(((x) & 0xF) << 28)
+
+
+//2 RL
+#define	RETRY_LIMIT_SHORT_SHIFT		8
+#define	RETRY_LIMIT_LONG_SHIFT		0
+
+
+//2 DARFRC
+#define _DARF_RC1(x)				((x) & 0x1F)
+#define _DARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (DARFRC + 4)
+#define _DARF_RC5(x)				((x) & 0x1F)
+#define _DARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+//2 RARFRC
+#define _RARF_RC1(x)				((x) & 0x1F)
+#define _RARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (RARFRC + 4)
+#define _RARF_RC5(x)				((x) & 0x1F)
+#define _RARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+
+
+
+//2 EDCA setting
+#define AC_PARAM_TXOP_LIMIT_OFFSET	16
+#define AC_PARAM_ECW_MAX_OFFSET		12
+#define AC_PARAM_ECW_MIN_OFFSET		8
+#define AC_PARAM_AIFS_OFFSET			0
+
+
+//2 EDCA_VO_PARAM
+#define _AIFS(x)						(x)
+#define _ECW_MAX_MIN(x)			((x) << 8)
+#define _TXOP_LIMIT(x)				((x) << 16)
+
+
+#define _BCNIFS(x)					((x) & 0xFF)
+#define _BCNECW(x)					(((x) & 0xF))<< 8)
+
+
+#define _LRL(x)						((x) & 0x3F)
+#define _SRL(x)						(((x) & 0x3F) << 8)
+
+
+//2 SIFS_CCK
+#define _SIFS_CCK_CTX(x)			((x) & 0xFF)
+#define _SIFS_CCK_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 SIFS_OFDM
+#define _SIFS_OFDM_CTX(x)			((x) & 0xFF)
+#define _SIFS_OFDM_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 TBTT PROHIBIT
+#define _TBTT_PROHIBIT_HOLD(x)		(((x) & 0xFF) << 8)
+
+
+//2 REG_RD_CTRL
+#define DIS_EDCA_CNT_DWN			BIT(11)
+
+
+//2 BCN_CTRL
+#define EN_MBSSID						BIT(1)
+#define EN_TXBCN_RPT					BIT(2)
+#define	EN_BCN_FUNCTION				BIT(3)
+// The same function but different bit field.
+#define	DIS_TSF_UDT0_NORMAL_CHIP	BIT(4)
+#define	DIS_TSF_UDT0_TEST_CHIP		BIT(5)
+
+//2 ACMHWCTRL
+#define	AcmHw_HwEn					BIT(0)
+#define	AcmHw_BeqEn					BIT(1)
+#define	AcmHw_ViqEn					BIT(2)
+#define	AcmHw_VoqEn					BIT(3)
+#define	AcmHw_BeqStatus				BIT(4)
+#define	AcmHw_ViqStatus				BIT(5)
+#define	AcmHw_VoqStatus				BIT(6)
+
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+
+//2 APSD_CTRL
+#define APSDOFF						BIT(6)
+#define APSDOFF_STATUS				BIT(7)
+
+
+//2 BWOPMODE
+#define BW_20MHZ					BIT(2)
+//#define BW_OPMODE_20MHZ				BIT(2)	// For compability
+
+
+#define RATE_BITMAP_ALL			0xFFFFF
+
+// Only use CCK 1M rate for ACK
+#define RATE_RRSR_CCK_ONLY_1M		0xFFFF1
+
+//2 TCR
+#define TSFRST						BIT(0)
+#define DIS_GCLK						BIT(1)
+#define PAD_SEL						BIT(2)
+#define PWR_ST						BIT(6)
+#define PWRBIT_OW_EN				BIT(7)
+#define ACRC							BIT(8)
+#define CFENDFORM					BIT(9)
+#define ICV							BIT(10)
+
+
+
+//2 RCR
+#define AAP							BIT(0)
+#define APM							BIT(1)
+#define AM							BIT(2)
+#define AB							BIT(3)
+#define ADD3							BIT(4)
+#define APWRMGT					BIT(5)
+#define CBSSID						BIT(6)
+#define CBSSID_BCN					BIT(7)
+#define ACRC32						BIT(8)
+#define AICV							BIT(9)
+#define ADF							BIT(11)
+#define ACF							BIT(12)
+#define AMF							BIT(13)
+#define HTC_LOC_CTRL				BIT(14)
+#define UC_DATA_EN					BIT(16)
+#define BM_DATA_EN					BIT(17)
+#define MFBEN						BIT(22)
+#define LSIGEN						BIT(23)
+#define EnMBID						BIT(24)
+#define APP_BASSN					BIT(27)
+#define APP_PHYSTS					BIT(28)
+#define APP_ICV						BIT(29)
+#define APP_MIC						BIT(30)
+#define APP_FCS						BIT(31)
+
+//2 RX_PKT_LIMIT
+
+//2 RX_DLK_TIME
+
+//2 MBIDCAMCFG
+
+
+
+//2 AMPDU_MIN_SPACE
+#define _MIN_SPACE(x)				((x) & 0x7)
+#define _SHORT_GI_PADDING(x)		(((x) & 0x1F) << 3)
+
+
+//2 RXERR_RPT
+#define RXERR_TYPE_OFDM_PPDU				0
+#define RXERR_TYPE_OFDM_FALSE_ALARM		1
+#define	RXERR_TYPE_OFDM_MPDU_OK			2
+#define RXERR_TYPE_OFDM_MPDU_FAIL		3
+#define RXERR_TYPE_CCK_PPDU				4
+#define RXERR_TYPE_CCK_FALSE_ALARM		5
+#define RXERR_TYPE_CCK_MPDU_OK			6
+#define RXERR_TYPE_CCK_MPDU_FAIL			7
+#define RXERR_TYPE_HT_PPDU					8
+#define RXERR_TYPE_HT_FALSE_ALARM		9
+#define RXERR_TYPE_HT_MPDU_TOTAL			10
+#define RXERR_TYPE_HT_MPDU_OK				11
+#define RXERR_TYPE_HT_MPDU_FAIL			12
+#define RXERR_TYPE_RX_FULL_DROP			15
+
+#define RXERR_COUNTER_MASK				0xFFFFF
+#define RXERR_RPT_RST						BIT(27)
+#define _RXERR_RPT_SEL(type)				((type) << 28)
+
+
+//2 SECCFG
+#define	SCR_TxUseDK						BIT(0)			//Force Tx Use Default Key
+#define	SCR_RxUseDK						BIT(1)			//Force Rx Use Default Key
+#define	SCR_TxEncEnable					BIT(2)			//Enable Tx Encryption
+#define	SCR_RxDecEnable					BIT(3)			//Enable Rx Decryption
+#define	SCR_SKByA2							BIT(4)			//Search kEY BY A2
+#define	SCR_NoSKMC							BIT(5)			//No Key Search Multicast
+
+
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+
+//2 USB Information (0xFE17)
+#define USB_IS_HIGH_SPEED				0
+#define USB_IS_FULL_SPEED				1
+#define USB_SPEED_MASK					BIT(5)
+
+#define USB_NORMAL_SIE_EP_MASK		0xF
+#define USB_NORMAL_SIE_EP_SHIFT		4
+
+#define USB_TEST_EP_MASK				0x30
+#define USB_TEST_EP_SHIFT				4
+
+//2 Special Option
+#define USB_AGG_EN						BIT(3)
+
+
+//2REG_C2HEVT_CLEAR
+#define		C2H_EVT_HOST_CLOSE		0x00	// Set by driver and notify FW that the driver has read the C2H command message
+#define		C2H_EVT_FW_CLOSE		0xFF	// Set by FW indicating that FW had set the C2H command message and it's not yet read by driver.
+
+
+//2REG_MULTI_FUNC_CTRL(For RTL8723 Only)
+#define	WL_HWPDN_EN				BIT0		// Enable GPIO[9] as WiFi HW PDn source
+#define	WL_HWPDN_SL				BIT1		// WiFi HW PDn polarity control
+#define	WL_FUNC_EN				BIT2		// WiFi function enable
+#define	WL_HWROF_EN				BIT3		// Enable GPIO[9] as WiFi RF HW PDn source
+#define	BT_HWPDN_EN				BIT16	// Enable GPIO[11] as BT HW PDn source
+#define	BT_HWPDN_SL				BIT17	// BT HW PDn polarity control
+#define	BT_FUNC_EN					BIT18	// BT function enable
+#define	BT_HWROF_EN				BIT19	// Enable GPIO[11] as BT/GPS RF HW PDn source
+#define	GPS_HWPDN_EN				BIT20	// Enable GPIO[10] as GPS HW PDn source
+#define	GPS_HWPDN_SL				BIT21	// GPS HW PDn polarity control
+#define	GPS_FUNC_EN				BIT22	// GPS function enable
+
+//3 REG_LIFECTRL_CTRL
+#define	HAL92C_EN_PKT_LIFE_TIME_BK		BIT3
+#define	HAL92C_EN_PKT_LIFE_TIME_BE		BIT2
+#define	HAL92C_EN_PKT_LIFE_TIME_VI		BIT1
+#define	HAL92C_EN_PKT_LIFE_TIME_VO		BIT0
+
+#define	HAL92C_MSDU_LIFE_TIME_UNIT		128		// in us, said by Tim.
+
+//========================================================
+// General definitions
+//========================================================
+
+#define MAC_ADDR_LEN					6
+#define LAST_ENTRY_OF_TX_PKT_BUFFER	255
+
+#define POLLING_LLT_THRESHOLD			20
+#define POLLING_READY_TIMEOUT_COUNT	1000
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T				0x13
+#define	MAX_MSS_DENSITY_1T				0x0A
+
+//----------------------------------------------------------------------------
+//       8192C GPIO MUX Configuration Register (offset 0x40, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIOSEL_GPIO				0
+#define	GPIOSEL_ENBT				BIT5
+
+//----------------------------------------------------------------------------
+//       8192C GPIO PIN Control Register (offset 0x44, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIO_IN						REG_GPIO_PIN_CTRL		// GPIO pins input value
+#define	GPIO_OUT					(REG_GPIO_PIN_CTRL+1)	// GPIO pins output value
+#define	GPIO_IO_SEL				(REG_GPIO_PIN_CTRL+2)	// GPIO pins output enable when a bit is set to "1"; otherwise, input is configured.
+#define	GPIO_MOD					(REG_GPIO_PIN_CTRL+3)
+
+
+
+#include "basic_types.h"
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h
new file mode 100755
index 0000000000000..20e88b5017cbf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h
@@ -0,0 +1,32 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_SRESET_C_
+#define _RTL8192C_SRESET_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_sreset.h>
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+extern void rtl8192c_sreset_xmit_status_check(_adapter *padapter);
+extern void rtl8192c_sreset_linked_status_check(_adapter *padapter);
+#endif
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h
new file mode 100755
index 0000000000000..7d2059dfc3ac8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h
@@ -0,0 +1,129 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_XMIT_H_
+#define _RTL8192C_XMIT_H_
+
+//
+// Queue Select Value in TxDesc
+//
+#define QSLT_BK							0x2//0x01
+#define QSLT_BE							0x0
+#define QSLT_VI							0x5//0x4
+#define QSLT_VO							0x7//0x6
+#define QSLT_BEACON						0x10
+#define QSLT_HIGH						0x11
+#define QSLT_MGNT						0x12
+#define QSLT_CMD						0x13
+
+struct txrpt_ccx_8192c {
+	/* offset 0 */
+	u8 retry_cnt:6;
+	u8 rsvd_0:2;
+
+	/* offset 1 */
+	u8 rts_retry_cnt:6;
+	u8 rsvd_1:2;
+
+	/* offset 2 */
+	u8 ccx_qtime0;
+	u8 ccx_qtime1;
+
+	/* offset 4 */
+	u8 missed_pkt_num:5;
+	u8 rsvd_4:3;
+
+	/* offset 5 */
+	u8 mac_id:5;
+	u8 des1_fragssn:3;
+
+	/* offset 6 */
+	u8 rpt_pkt_num:5;
+	u8 pkt_drop:1;
+	u8 lifetime_over:1;
+	u8 retry_over:1;
+
+	/* offset 7*/
+	u8 edca_tx_queue:4;
+	u8 rsvd_7:1;
+	u8 bmc:1;
+	u8 pkt_ok:1;
+	u8 int_ccx:1;
+};
+
+#define txrpt_ccx_qtime_8192c(txrpt_ccx) ((txrpt_ccx)->ccx_qtime0+((txrpt_ccx)->ccx_qtime1<<8))
+
+#ifdef CONFIG_XMIT_ACK
+void dump_txrpt_ccx_8192c(void *buf);
+void handle_txrpt_ccx_8192c(_adapter *adapter, void *buf);
+#else
+#define dump_txrpt_ccx_8192c(buf) do {} while(0)
+#define handle_txrpt_ccx_8192c(adapter, buf) do {} while(0)
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+#define MAX_TX_AGG_PACKET_NUMBER 0xFF
+#endif
+
+s32	rtl8192cu_init_xmit_priv(_adapter * padapter);
+
+void	rtl8192cu_free_xmit_priv(_adapter * padapter);
+
+void rtl8192cu_cal_txdesc_chksum(struct tx_desc	*ptxdesc);
+
+s32 rtl8192cu_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+s32 rtl8192cu_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32 rtl8192cu_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192cu_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32 rtl8192cu_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+#ifdef CONFIG_PCI_HCI
+s32	rtl8192ce_init_xmit_priv(_adapter * padapter);
+void	rtl8192ce_free_xmit_priv(_adapter * padapter);
+
+s32	rtl8192ce_enqueue_xmitbuf(struct rtw_tx_ring *ring, struct xmit_buf *pxmitbuf);
+struct xmit_buf *rtl8192ce_dequeue_xmitbuf(struct rtw_tx_ring *ring);
+
+void	rtl8192ce_xmitframe_resume(_adapter *padapter);
+
+s32	rtl8192ce_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32	rtl8192ce_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192ce_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtl8192ce_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h
new file mode 100755
index 0000000000000..ad7e7838e870b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h
@@ -0,0 +1,142 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192D_CMD_H_
+#define __RTL8192D_CMD_H_
+
+
+//--------------------------------------------
+//3				Host Message Box 
+//--------------------------------------------
+
+// User Define Message [31:8]
+
+//_SETPWRMODE_PARM
+#define SET_H2CCMD_PWRMODE_PARM_MODE(__pH2CCmd, __Value)			SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 8, __Value)
+#define SET_H2CCMD_PWRMODE_PARM_SMART_PS(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE((__pH2CCmd)+1, 0, 8, __Value)
+#define SET_H2CCMD_PWRMODE_PARM_BCN_PASS_TIME(__pH2CCmd, __Value)	SET_BITS_TO_LE_1BYTE((__pH2CCmd)+2, 0, 8, __Value)
+
+//JOINBSSRPT_PARM
+#define SET_H2CCMD_JOINBSSRPT_PARM_OPMODE(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 8, __Value)
+
+//_RSVDPAGE_LOC
+#define SET_H2CCMD_RSVDPAGE_LOC_PROBE_RSP(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 8, __Value)
+#define SET_H2CCMD_RSVDPAGE_LOC_PSPOLL(__pH2CCmd, __Value)			SET_BITS_TO_LE_1BYTE((__pH2CCmd)+1, 0, 8, __Value)
+#define SET_H2CCMD_RSVDPAGE_LOC_NULL_DATA(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE((__pH2CCmd)+2, 0, 8, __Value)
+
+//P2P_PS_OFFLOAD
+
+struct P2P_PS_Offload_t {
+ unsigned char Offload_En:1;
+ unsigned char role:1; // 1: Owner, 0: Client
+ unsigned char CTWindow_En:1;
+ unsigned char NoA0_En:1;
+ unsigned char NoA1_En:1;
+ unsigned char AllStaSleep:1; // Only valid in Owner
+ unsigned char discovery:1;
+ unsigned char rsvd:1;
+};
+
+#define SET_H2CCMD_P2P_PS_OFFLOAD_EN(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_ROLE(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 1, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_CTW(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 2, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_NOA0(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 3, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_NOA1(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 4, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_ALLSTASLEEP(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 5, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_DISCOVERY(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 6, 1, __Value)
+
+// Description: Determine the types of H2C commands that are the same in driver and Fw.
+// Fisrt constructed by tynli. 2009.10.09.
+typedef enum _RTL8192D_H2C_CMD 
+{
+	H2C_AP_OFFLOAD = 0,		/*0*/
+	H2C_SETPWRMODE = 1,		/*1*/
+	H2C_JOINBSSRPT = 2,		/*2*/
+	H2C_RSVDPAGE = 3,
+	H2C_RSSI_REPORT = 5,
+	H2C_RA_MASK = 6,
+	H2C_P2P_PS_OFFLOAD = 8,
+	H2C_MAC_MODE_SEL = 9,
+	H2C_PWRM=15,
+#ifdef CONFIG_WOWLAN
+	H2C_WO_WLAN_CMD = 20,	// Wake on Wlan.
+#endif // CONFIG_WOWLAN
+	H2C_P2P_PS_CTW_CMD = 24,
+	H2C_PathDiv = 26,                  //PathDiv--NeilChen--2011.07.15
+#ifdef CONFIG_WOWLAN
+	KEEP_ALIVE_CONTROL_CMD=31, //keep alive for wake on wlan
+	DISCONNECT_DECISION_CTRL_CMD=32,
+	REMOTE_WAKE_CTRL_CMD=34,
+#endif // CONFIG_WOWLAN
+	H2C_92D_TSF_SYNC=36,
+	H2C_92D_RESET_TSF = 43,
+	H2C_CMD_MAX
+}RTL8192D_H2C_CMD;
+
+struct cmd_msg_parm {
+	u8 eid; //element id
+	u8 sz; // sz
+	u8 buf[6];
+};
+
+
+void	FillH2CCmd92D(_adapter* padapter, u8 ElementID, u32 CmdLen, u8* pCmdBuffer);
+
+// host message to firmware cmd
+void	rtl8192d_set_FwPwrMode_cmd(_adapter*padapter, u8 Mode);
+void	rtl8192d_set_FwJoinBssReport_cmd(_adapter* padapter, u8 mstatus);
+u8	rtl8192d_set_rssi_cmd(_adapter*padapter, u8 *param);
+u8	rtl8192d_set_raid_cmd(_adapter*padapter, u32 mask, u8 arg);
+void	rtl8192d_Add_RateATid(PADAPTER pAdapter, u32 bitmap, u8 arg);
+#ifdef CONFIG_P2P
+void	rtl8192d_set_p2p_ps_offload_cmd(_adapter* padapter, u8 p2p_ps_state);
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+int reset_tsf(PADAPTER Adapter, u8 reset_port );
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+#ifdef CONFIG_WOWLAN
+typedef struct _SETWOWLAN_PARM{
+	u8 	mode;
+	u8 	gpio_index;
+	u8	gpio_duration;	
+	u8  second_mode;
+	u8  reserve;
+}SETWOWLAN_PARM, *PSETWOWLAN_PARM;
+
+#define FW_WOWLAN_FUN_EN			BIT(0)
+#define FW_WOWLAN_PATTERN_MATCH		BIT(1)
+#define FW_WOWLAN_MAGIC_PKT			BIT(2)
+#define FW_WOWLAN_UNICAST			BIT(3)
+#define FW_WOWLAN_ALL_PKT_DROP		BIT(4)
+#define FW_WOWLAN_GPIO_ACTIVE		BIT(5)
+#define FW_WOWLAN_REKEY_WAKEUP		BIT(6)
+#define FW_WOWLAN_DEAUTH_WAKEUP		BIT(7)
+
+#define FW_WOWLAN_GPIO_WAKEUP_EN	BIT(0)
+#define FW_FW_PARSE_MAGIC_PKT		BIT(1)
+
+void rtl8192d_set_wowlan_cmd(_adapter* padapter);
+void SetFwRelatedForWoWLAN8192DU(_adapter* 	padapter,u8 bHostIsGoingtoSleep);
+#endif // CONFIG_WOWLAN
+
+#endif	// __RTL8192D_CMD_H_
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h
new file mode 100755
index 0000000000000..ab5e5f79597d3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h
@@ -0,0 +1,420 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__RTL8192D_DM_H__
+#define __RTL8192D_DM_H__
+//============================================================
+// Description:
+//
+// This file is for 92CE/92CU dynamic mechanism only
+//
+//
+//============================================================
+//============================================================
+// Global var
+//============================================================
+
+extern u32 EDCAParam[maxAP][3] ;
+
+//============================================================
+// structure and define
+//============================================================
+
+typedef struct _FALSE_ALARM_STATISTICS{
+	u32	Cnt_Parity_Fail;
+	u32	Cnt_Rate_Illegal;
+	u32	Cnt_Crc8_fail;
+	u32	Cnt_Mcs_fail;
+	u32	Cnt_Ofdm_fail;
+	u32	Cnt_Cck_fail;
+	u32	Cnt_all;
+	u32	Cnt_Fast_Fsync;
+	u32	Cnt_SB_Search_fail;
+}FALSE_ALARM_STATISTICS, *PFALSE_ALARM_STATISTICS;
+
+typedef struct _Dynamic_Power_Saving_
+{
+	u8		PreCCAState;
+	u8		CurCCAState;
+
+	u8		PreRFState;
+	u8		CurRFState;
+
+	//int		Rssi_val_min;
+	
+}PS_T,*pPS_T;
+
+typedef struct _Dynamic_Initial_Gain_Threshold_
+{
+	u8		Dig_Enable_Flag;
+	u8		Dig_Ext_Port_Stage;
+	
+	int		RssiLowThresh;
+	int		RssiHighThresh;
+
+	u32		FALowThresh;
+	u32		FAHighThresh;
+
+	u8		CurSTAConnectState;
+	u8		PreSTAConnectState;
+	u8		CurMultiSTAConnectState;
+
+	u8		PreIGValue;
+	u8		CurIGValue;
+	u8	       BackupIGValue;
+
+	char		BackoffVal;
+	char		BackoffVal_range_max;
+	char		BackoffVal_range_min;
+	u8		rx_gain_range_max;
+	u8		rx_gain_range_min;
+	u8		Rssi_val_min;
+
+	u8		PreCCKPDState;
+	u8		CurCCKPDState;
+
+	u8		LargeFAHit;
+	u8		ForbiddenIGI;
+	u32		Recover_cnt;
+	u8		rx_gain_range_min_nolink;
+}DIG_T,*pDIG_T;
+
+typedef enum tag_Dynamic_Init_Gain_Operation_Type_Definition
+{
+	DIG_TYPE_THRESH_HIGH	= 0,
+	DIG_TYPE_THRESH_LOW	= 1,
+	DIG_TYPE_BACKOFF		= 2,
+	DIG_TYPE_RX_GAIN_MIN	= 3,
+	DIG_TYPE_RX_GAIN_MAX	= 4,
+	DIG_TYPE_ENABLE 		= 5,
+	DIG_TYPE_DISABLE 		= 6,
+	DIG_OP_TYPE_MAX
+}DM_DIG_OP_E;
+
+typedef enum tag_CCK_Packet_Detection_Threshold_Type_Definition
+{
+	CCK_PD_STAGE_LowRssi = 0,
+	CCK_PD_STAGE_HighRssi = 1,
+	CCK_PD_STAGE_MAX = 3,
+}DM_CCK_PDTH_E;
+
+typedef enum tag_1R_CCA_Type_Definition
+{
+	CCA_MIN = 0,
+	CCA_1R =1,
+	CCA_2R = 2,
+	CCA_MAX = 3,
+}DM_1R_CCA_E;
+
+typedef enum tag_RF_Type_Definition
+{
+	RF_Save =0,
+	RF_Normal = 1,
+	RF_MAX = 2,
+}DM_RF_E;
+
+typedef enum tag_DIG_EXT_PORT_ALGO_Definition
+{
+	DIG_EXT_PORT_STAGE_0 = 0,
+	DIG_EXT_PORT_STAGE_1 = 1,
+	DIG_EXT_PORT_STAGE_2 = 2,
+	DIG_EXT_PORT_STAGE_3 = 3,
+	DIG_EXT_PORT_STAGE_MAX = 4,
+}DM_DIG_EXT_PORT_ALG_E;
+
+
+typedef enum tag_DIG_Connect_Definition
+{
+	DIG_STA_DISCONNECT = 0,	
+	DIG_STA_CONNECT = 1,
+	DIG_STA_BEFORE_CONNECT = 2,
+	DIG_MultiSTA_DISCONNECT = 3,
+	DIG_MultiSTA_CONNECT = 4,
+	DIG_CONNECT_MAX
+}DM_DIG_CONNECT_E;
+
+
+#define		DM_DIG_THRESH_HIGH			40
+#define		DM_DIG_THRESH_LOW			35
+
+#define		DM_FALSEALARM_THRESH_LOW	400
+#define		DM_FALSEALARM_THRESH_HIGH	1000
+
+#define		DM_DIG_MAX					0x3e
+#define		DM_DIG_MIN					0x1e //0x22//0x1c
+
+#define		DM_DIG_FA_UPPER				0x32
+#define		DM_DIG_FA_LOWER				0x20
+
+//vivi 92c&92d has different definition, 20110504
+//this is for 92c
+#define		DM_DIG_FA_TH0				0x200//0x20
+#define		DM_DIG_FA_TH1				0x300//0x100
+#define		DM_DIG_FA_TH2				0x400//0x200
+//this is for 92d
+#define		DM_DIG_FA_TH0_92D			0x100
+#define		DM_DIG_FA_TH1_92D			0x150
+#define		DM_DIG_FA_TH2_92D			0x250
+
+#define		DM_DIG_BACKOFF_MAX			12
+#define		DM_DIG_BACKOFF_MIN			(-4)
+#define		DM_DIG_BACKOFF_DEFAULT		10
+
+#define		RxPathSelection_SS_TH_low		30
+#define		RxPathSelection_diff_TH			18
+
+#define		DM_RATR_STA_INIT			0
+#define		DM_RATR_STA_HIGH			1
+#define 		DM_RATR_STA_MIDDLE		2
+#define 		DM_RATR_STA_LOW			3
+
+#define		CTSToSelfTHVal					30
+#define		RegC38_TH						20
+
+#define		WAIotTHVal						25
+
+//Dynamic Tx Power Control Threshold
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL2	74
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL1	67
+
+#define		TxHighPwrLevel_Normal		0	
+#define		TxHighPwrLevel_Level1		1
+#define		TxHighPwrLevel_Level2		2
+#define		TxHighPwrLevel_BT1			3
+#define		TxHighPwrLevel_BT2			4
+#define		TxHighPwrLevel_15			5
+#define		TxHighPwrLevel_35			6
+#define		TxHighPwrLevel_50			7
+#define		TxHighPwrLevel_70			8
+#define		TxHighPwrLevel_100			9
+
+#define		DM_Type_ByFW			0
+#define		DM_Type_ByDriver		1
+
+typedef struct _RATE_ADAPTIVE
+{
+	u8				RateAdaptiveDisabled;
+	u8				RATRState;
+	u16				reserve;	
+	
+	u32				HighRSSIThreshForRA;
+	u32				High2LowRSSIThreshForRA;
+	u8				Low2HighRSSIThreshForRA40M;
+	u32				LowRSSIThreshForRA40M;	
+	u8				Low2HighRSSIThreshForRA20M;
+	u32				LowRSSIThreshForRA20M;	
+	u32				UpperRSSIThresholdRATR;
+	u32				MiddleRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR40M;
+	u32				LowRSSIThresholdRATR20M;
+	u8				PingRSSIEnable;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIRATR;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIThreshForRA;//cosa add for Netcore long range ping issue
+	u32				LastRATR;
+	u8				PreRATRState;
+	
+} RATE_ADAPTIVE, *PRATE_ADAPTIVE;
+
+typedef enum tag_SW_Antenna_Switch_Definition
+{
+	Antenna_B = 1,
+	Antenna_A = 2,
+	Antenna_MAX = 3,
+}DM_SWAS_E;
+
+// 20100514 Joseph: Add definition for antenna switching test after link.
+// This indicates two different the steps. 
+// In SWAW_STEP_PEAK, driver needs to switch antenna and listen to the signal on the air.
+// In SWAW_STEP_DETERMINE, driver just compares the signal captured in SWAW_STEP_PEAK
+// with original RSSI to determine if it is necessary to switch antenna.
+#define SWAW_STEP_PEAK		0
+#define SWAW_STEP_DETERMINE	1
+
+#define	TP_MODE		0
+#define	RSSI_MODE		1
+#define	TRAFFIC_LOW	0
+#define	TRAFFIC_HIGH	1
+
+//=============================
+//Neil Chen---2011--06--15--
+//==============================
+//3 PathDiv 
+typedef struct _SW_Antenna_Switch_
+{
+	u8		try_flag;
+	s32		PreRSSI;
+	u8		CurAntenna;
+	u8		PreAntenna;
+	u8		RSSI_Trying;
+	u8		TestMode;
+	u8		bTriggerAntennaSwitch;
+	u8		SelectAntennaMap;
+
+	// Before link Antenna Switch check
+	u8		SWAS_NoLink_State;
+	u32		SWAS_NoLink_BK_Reg860;
+}SWAT_T, *pSWAT_T;
+//========================================
+
+struct 	dm_priv	
+{
+	u8	DM_Type;
+	u8	DMFlag, DMFlag_tmp;
+
+	//for DIG
+	u8	bDMInitialGainEnable;
+	//u8	binitialized; // for dm_initial_gain_Multi_STA use.
+	DIG_T	DM_DigTable;
+
+	PS_T	DM_PSTable;
+
+	FALSE_ALARM_STATISTICS	FalseAlmCnt;	
+	
+	//for rate adaptive, in fact,  88c/92c fw will handle this
+	u8	bUseRAMask;
+	RATE_ADAPTIVE	RateAdaptive;
+
+	//* Upper and Lower Signal threshold for Rate Adaptive*/
+	int	UndecoratedSmoothedPWDB;
+	int	EntryMinUndecoratedSmoothedPWDB;
+	int	EntryMaxUndecoratedSmoothedPWDB;
+	int	MinUndecoratedPWDBForDM;
+	int	LastMinUndecoratedPWDBForDM;
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	int	RssiValMinForAnotherMacOfDMSP;
+	u32	CurDigValueForAnotherMacOfDMSP;
+	BOOLEAN		bWriteDigForAnotherMacOfDMSP;
+	BOOLEAN		bChangeCCKPDStateForAnotherMacOfDMSP;
+	u8	CurCCKPDStateForAnotherMacOfDMSP;
+	BOOLEAN		bChangeTxHighPowerLvlForAnotherMacOfDMSP;
+	u8	CurTxHighLvlForAnotherMacOfDMSP;
+#endif
+
+	//for High Power
+	u8	bDynamicTxPowerEnable;
+	u8	LastDTPLvl;
+	u8	DynamicTxHighPowerLvl;//Add by Jacken Tx Power Control for Near/Far Range 2008/03/06
+		
+	//for tx power tracking
+	u8	bTXPowerTracking;
+	u8	TXPowercount;
+	u8	bTXPowerTrackingInit;	
+	u8	TxPowerTrackControl;	//for mp mode, turn off txpwrtracking as default
+	u8	TM_Trigger;
+
+	u8	ThermalMeter[2];	// ThermalMeter, index 0 for RFIC0, and 1 for RFIC1
+	u8	ThermalValue;
+	u8	ThermalValue_LCK;
+	u8	ThermalValue_IQK;
+	u8	ThermalValue_AVG[AVG_THERMAL_NUM];
+	u8	ThermalValue_AVG_index;
+	u8	ThermalValue_RxGain;
+	u8	ThermalValue_Crystal;
+	u8	Delta_IQK;
+	u8	Delta_LCK;
+	u8	bRfPiEnable;
+	u8	bReloadtxpowerindex;
+	u8	bDoneTxpower;
+
+	//for APK
+	u32	APKoutput[2][2];	//path A/B; output1_1a/output1_2a
+	u8	bAPKdone;
+	u8	bAPKThermalMeterIgnore;
+	BOOLEAN		bDPKdone[2];
+	BOOLEAN		bDPKstore;
+	BOOLEAN		bDPKworking;
+	u8	OFDM_min_index_internalPA_DPK[2];
+	u8	TxPowerLevelDPK[2];
+
+	u32	RegA24;
+
+	//for IQK
+	u32	Reg874;
+	u32	RegC08;
+	u32	Reg88C;
+	u8	Reg522;
+	u8	Reg550;
+	u8	Reg551;
+	u32	Reg870;
+	u32	ADDA_backup[IQK_ADDA_REG_NUM];
+	u32	IQK_MAC_backup[IQK_MAC_REG_NUM];
+	u32	IQK_BB_backup[IQK_BB_REG_NUM];
+
+	u8	bCCKinCH14;
+
+	char	CCK_index;
+	//u8 Record_CCK_20Mindex;
+	//u8 Record_CCK_40Mindex;
+	char	OFDM_index[2];
+
+	SWAT_T DM_SWAT_Table;
+
+	//for TxPwrTracking
+	int	RegE94;
+	int 	RegE9C;
+	int	RegEB4;
+	int	RegEBC;
+#if MP_DRIVER == 1
+	u8	RegC04_MP;
+	u32	RegD04_MP;
+#endif
+	u32	TXPowerTrackingCallbackCnt;	//cosa add for debug
+
+	u32	prv_traffic_idx; // edca turbo
+
+	u32	RegRF3C[2];	//pathA / pathB
+
+	// Add for Reading Initial Data Rate SEL Register 0x484 during watchdog. Using for fill tx desc. 2011.3.21 by Thomas
+	u8	INIDATA_RATE[32];
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	/* Ported from ODM, for ESTI Adaptivity test */
+	s8 TH_L2H_ini;
+	s8 TH_EDCCA_HL_diff;
+	s8 IGI_Base;
+	u8 IGI_target;
+	bool ForceEDCCA;
+	u8 AdapEn_RSSI;
+	s8 Force_TH_H;
+	s8 Force_TH_L;
+	u8 IGI_LowerBound;
+
+	bool	bPreEdccaEnable;
+#endif
+};
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+//#define DM_MultiSTA_InitGainChangeNotify(Event) {DM_DigTable.CurMultiSTAConnectState = Event;}
+
+
+//============================================================
+// function prototype
+//============================================================
+void rtl8192d_init_dm_priv(IN PADAPTER Adapter);
+void rtl8192d_deinit_dm_priv(IN PADAPTER Adapter);
+void	rtl8192d_InitHalDm(IN PADAPTER Adapter);
+void	rtl8192d_HalDmWatchDog(IN PADAPTER Adapter);
+
+VOID rtl8192d_dm_CheckTXPowerTracking(IN PADAPTER Adapter);
+
+#endif	//__HAL8190PCIDM_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h
new file mode 100755
index 0000000000000..1ab5f98259159
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h
@@ -0,0 +1,1126 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192D_HAL_H__
+#define __RTL8192D_HAL_H__
+
+#include "hal_com.h"
+#include "rtl8192d_spec.h"
+#include "Hal8192DPhyReg.h"
+#include "Hal8192DPhyCfg.h"
+#include "rtl8192d_rf.h"
+#include "rtl8192d_dm.h"
+#include "rtl8192d_recv.h"
+#include "rtl8192d_xmit.h"
+#include "rtl8192d_cmd.h"
+
+/*---------------------------Define Local Constant---------------------------*/
+/* Channel switch:The size of command tables for switch channel*/
+#define MAX_PRECMD_CNT 16
+#define MAX_RFDEPENDCMD_CNT 16
+#define MAX_POSTCMD_CNT 16
+
+#define MAX_DOZE_WAITING_TIMES_9x 64
+
+#define MAX_RF_IMR_INDEX 12
+#define MAX_RF_IMR_INDEX_NORMAL 13
+#define RF_REG_NUM_for_C_CUT_5G 	6
+#define RF_REG_NUM_for_C_CUT_5G_internalPA	7
+#define RF_REG_NUM_for_C_CUT_2G 	5
+#define RF_CHNL_NUM_5G			19	
+#define RF_CHNL_NUM_5G_40M		17
+#define TARGET_CHNL_NUM_5G	221
+#define TARGET_CHNL_NUM_2G	14
+#define TARGET_CHNL_NUM_2G_5G	59
+#define CV_CURVE_CNT			64
+
+//static u32	 RF_REG_FOR_5G_SWCHNL[MAX_RF_IMR_INDEX]={0,0x2f,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x38,0x39,0x0};
+static u32	   RF_REG_FOR_5G_SWCHNL_NORMAL[MAX_RF_IMR_INDEX_NORMAL]={0,0x2f,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x0};
+
+static u8	RF_REG_for_C_CUT_5G[RF_REG_NUM_for_C_CUT_5G] = 
+			{RF_SYN_G1, RF_SYN_G2,	RF_SYN_G3,	RF_SYN_G4,	RF_SYN_G5,	RF_SYN_G6};
+
+static u8	RF_REG_for_C_CUT_5G_internalPA[RF_REG_NUM_for_C_CUT_5G_internalPA] = 
+			{0x0B,	0x48,	0x49,	0x4B,	0x03,	0x04,	0x0E};
+static u8	RF_REG_for_C_CUT_2G[RF_REG_NUM_for_C_CUT_2G] = 
+			{RF_SYN_G1, RF_SYN_G2,	RF_SYN_G3,	RF_SYN_G7,	RF_SYN_G8};
+
+#if DBG
+static u32	RF_REG_MASK_for_C_CUT_2G[RF_REG_NUM_for_C_CUT_2G] = 
+			{BIT19|BIT18|BIT17|BIT14|BIT1,	BIT10|BIT9, 
+			BIT18|BIT17|BIT16|BIT1, 	BIT2|BIT1,	
+			BIT15|BIT14|BIT13|BIT12|BIT11};
+#endif	//amy, temp remove
+static u8	RF_CHNL_5G[RF_CHNL_NUM_5G] = 
+			{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140};
+static u8	RF_CHNL_5G_40M[RF_CHNL_NUM_5G_40M] = 
+			{38,42,46,50,54,58,62,102,106,110,114,118,122,126,130,134,138};
+
+static u32	RF_REG_Param_for_C_CUT_5G[5][RF_REG_NUM_for_C_CUT_5G] = {
+			{0xE43BE,	0xFC638,	0x77C0A,	0xDE471,	0xd7110,	0x8EB04},
+			{0xE43BE,	0xFC078,	0xF7C1A,	0xE0C71,	0xD7550,	0xAEB04},	
+			{0xE43BF,	0xFF038,	0xF7C0A,	0xDE471,	0xE5550,	0xAEB04},
+			{0xE43BF,	0xFF079,	0xF7C1A,	0xDE471,	0xE5550,	0xAEB04},
+			{0xE43BF,	0xFF038,	0xF7C1A,	0xDE471,	0xd7550,	0xAEB04}};
+
+static u32	RF_REG_Param_for_C_CUT_2G[3][RF_REG_NUM_for_C_CUT_2G] = {
+			{0x643BC,	0xFC038,	0x77C1A,	0x41289,	0x01840},
+			{0x643BC,	0xFC038,	0x07C1A,	0x41289,	0x01840},
+			{0x243BC,	0xFC438,	0x07C1A,	0x4128B,	0x0FC41}};
+
+#if SWLCK == 1
+static u32 RF_REG_SYN_G4_for_C_CUT_2G = 0xD1C31&0x7FF;
+#endif
+
+static u32	RF_REG_Param_for_C_CUT_5G_internalPA[3][RF_REG_NUM_for_C_CUT_5G_internalPA] = {
+			{0x01a00,	0x40443,	0x00eb5,	0x89bec,	0x94a12,	0x94a12,	0x94a12},
+			{0x01800,	0xc0443,	0x00730,	0x896ee,	0x94a52,	0x94a52,	0x94a52},	
+			{0x01800,	0xc0443,	0x00730,	0x896ee,	0x94a12,	0x94a12,	0x94a12}};
+
+
+
+//[mode][patha+b][reg]
+static u32 RF_IMR_Param_Normal[1][3][MAX_RF_IMR_INDEX_NORMAL]={{
+	{0x70000,0x00ff0,0x4400f,0x00ff0,0x0,0x0,0x0,0x0,0x0,0x64888,0xe266c,0x00090,0x22fff},// channel 1-14.
+	{0x70000,0x22880,0x4470f,0x55880,0x00070, 0x88000, 0x0,0x88080,0x70000,0x64a82,0xe466c,0x00090,0x32c9a}, //path 36-64
+	{0x70000,0x44880,0x4477f,0x77880,0x00070, 0x88000, 0x0,0x880b0,0x0,0x64b82,0xe466c,0x00090,0x32c9a} //100 -165
+}
+};
+
+//static u32 CurveIndex_5G[TARGET_CHNL_NUM_5G]={0};
+//static u32 CurveIndex_2G[TARGET_CHNL_NUM_2G]={0};
+static u32 CurveIndex[TARGET_CHNL_NUM_2G_5G]={0};
+
+static u32 TargetChnl_5G[TARGET_CHNL_NUM_5G] = {
+25141,	25116,	25091,	25066,	25041,
+25016,	24991,	24966,	24941,	24917,
+24892,	24867,	24843,	24818,	24794,
+24770,	24765,	24721,	24697,	24672,
+24648,	24624,	24600,	24576,	24552,
+24528,	24504,	24480,	24457,	24433,
+24409,	24385,	24362,	24338,	24315,
+24291,	24268,	24245,	24221,	24198,
+24175,	24151,	24128,	24105,	24082,
+24059,	24036,	24013,	23990,	23967,
+23945,	23922,	23899,	23876,	23854,
+23831,	23809,	23786,	23764,	23741,
+23719,	23697,	23674,	23652,	23630,
+23608,	23586,	23564,	23541,	23519,
+23498,	23476,	23454,	23432,	23410,
+23388,	23367,	23345,	23323,	23302,
+23280,	23259,	23237,	23216,	23194,
+23173,	23152,	23130,	23109,	23088,
+23067,	23046,	23025,	23003,	22982,
+22962,	22941,	22920,	22899,	22878,
+22857,	22837,	22816,	22795,	22775,
+22754,	22733,	22713,	22692,	22672,
+22652,	22631,	22611,	22591,	22570,
+22550,	22530,	22510,	22490,	22469,
+22449,	22429,	22409,	22390,	22370,
+22350,	22336,	22310,	22290,	22271,
+22251,	22231,	22212,	22192,	22173,
+22153,	22134,	22114,	22095,	22075,
+22056,	22037,	22017,	21998,	21979,
+21960,	21941,	21921,	21902,	21883,
+21864,	21845,	21826,	21807,	21789,
+21770,	21751,	21732,	21713,	21695,
+21676,	21657,	21639,	21620,	21602,
+21583,	21565,	21546,	21528,	21509,
+21491,	21473,	21454,	21436,	21418,
+21400,	21381,	21363,	21345,	21327,
+21309,	21291,	21273,	21255,	21237,
+21219,	21201,	21183,	21166,	21148,
+21130,	21112,	21095,	21077,	21059,
+21042,	21024,	21007,	20989,	20972,
+25679,	25653,	25627,	25601,	25575,
+25549,	25523,	25497,	25471,	25446,
+25420,	25394,	25369,	25343,	25318,
+25292,	25267,	25242,	25216,	25191,
+25166	};
+
+static u32 TargetChnl_2G[TARGET_CHNL_NUM_2G] = {	// channel 1~14
+26084, 26030, 25976, 25923, 25869, 25816, 25764,
+25711, 25658, 25606, 25554, 25502, 25451, 25328
+};
+
+
+#ifdef CONFIG_PCI_HCI
+	#include <pci_ops.h>
+	#include "Hal8192DEHWImg.h"
+
+	#define RTL819X_DEFAULT_RF_TYPE			RF_2T2R
+
+//---------------------------------------------------------------------
+//		RTL8192DE From file
+//---------------------------------------------------------------------
+	#define RTL8192D_FW_IMG 					"rtl8192DE\\rtl8192dfw.bin"
+
+	#define RTL8192D_PHY_REG					"rtl8192DE\\PHY_REG.txt"
+	#define RTL8192D_PHY_REG_PG				"rtl8192DE\\PHY_REG_PG.txt"
+	#define RTL8192D_PHY_REG_MP				"rtl8192DE\\PHY_REG_MP.txt"
+	
+	#define RTL8192D_AGC_TAB					"rtl8192DE\\AGC_TAB.txt"
+	#define RTL8192D_AGC_TAB_2G				"rtl8192DE\\AGC_TAB_2G.txt"
+	#define RTL8192D_AGC_TAB_5G				"rtl8192DE\\AGC_TAB_5G.txt"
+	#define RTL8192D_PHY_RADIO_A				"rtl8192DE\\radio_a.txt"
+	#define RTL8192D_PHY_RADIO_B				"rtl8192DE\\radio_b.txt"
+	#define RTL8192D_PHY_RADIO_A_intPA		"rtl8192DE\\radio_a_intPA.txt"
+	#define RTL8192D_PHY_RADIO_B_intPA		"rtl8192DE\\radio_b_intPA.txt"			
+	#define RTL8192D_PHY_MACREG				"rtl8192DE\\MAC_REG.txt"
+
+//---------------------------------------------------------------------
+//		RTL8192DE From header
+//---------------------------------------------------------------------
+
+	// Fw Array
+	#define Rtl8192D_FwImageArray 				Rtl8192DEFwImgArray
+
+	// MAC/BB/PHY Array
+	#define Rtl8192D_MAC_Array					Rtl8192DEMAC_2T_Array
+	#define Rtl8192D_AGCTAB_Array				Rtl8192DEAGCTAB_Array
+	#define Rtl8192D_AGCTAB_5GArray			Rtl8192DEAGCTAB_5GArray
+	#define Rtl8192D_AGCTAB_2GArray			Rtl8192DEAGCTAB_2GArray
+	#define Rtl8192D_AGCTAB_2TArray 			Rtl8192DEAGCTAB_2TArray
+	#define Rtl8192D_AGCTAB_1TArray 			Rtl8192DEAGCTAB_1TArray
+	#define Rtl8192D_PHY_REG_2TArray			Rtl8192DEPHY_REG_2TArray		
+	#define Rtl8192D_PHY_REG_1TArray			Rtl8192DEPHY_REG_1TArray
+	#define Rtl8192D_PHY_REG_Array_PG			Rtl8192DEPHY_REG_Array_PG
+	#define Rtl8192D_PHY_REG_Array_MP			Rtl8192DEPHY_REG_Array_MP
+	#define Rtl8192D_RadioA_2TArray				Rtl8192DERadioA_2TArray
+	#define Rtl8192D_RadioA_1TArray				Rtl8192DERadioA_1TArray
+	#define Rtl8192D_RadioB_2TArray				Rtl8192DERadioB_2TArray
+	#define Rtl8192D_RadioB_1TArray				Rtl8192DERadioB_1TArray
+	#define Rtl8192D_RadioA_2T_intPAArray		Rtl8192DERadioA_2T_intPAArray
+	#define Rtl8192D_RadioB_2T_intPAArray 		Rtl8192DERadioB_2T_intPAArray
+
+	// Array length
+	#define Rtl8192D_FwImageArrayLength				Rtl8192DEImgArrayLength
+	#define Rtl8192D_MAC_ArrayLength				Rtl8192DEMAC_2T_ArrayLength
+	#define Rtl8192D_AGCTAB_5GArrayLength			Rtl8192DEAGCTAB_5GArrayLength
+	#define Rtl8192D_AGCTAB_2GArrayLength			Rtl8192DEAGCTAB_2GArrayLength
+	#define Rtl8192D_AGCTAB_2TArrayLength			Rtl8192DEAGCTAB_2TArrayLength
+	#define Rtl8192D_AGCTAB_1TArrayLength			Rtl8192DEAGCTAB_1TArrayLength
+	#define Rtl8192D_AGCTAB_ArrayLength 			Rtl8192DEAGCTAB_ArrayLength
+	#define Rtl8192D_PHY_REG_2TArrayLength			Rtl8192DEPHY_REG_2TArrayLength
+	#define Rtl8192D_PHY_REG_1TArrayLength			Rtl8192DEPHY_REG_1TArrayLength
+	#define Rtl8192D_PHY_REG_Array_PGLength		Rtl8192DEPHY_REG_Array_PGLength
+	#define Rtl8192D_PHY_REG_Array_MPLength		Rtl8192DEPHY_REG_Array_MPLength
+	#define Rtl8192D_RadioA_2TArrayLength			Rtl8192DERadioA_2TArrayLength
+	#define Rtl8192D_RadioB_2TArrayLength			Rtl8192DERadioB_2TArrayLength
+	#define Rtl8192D_RadioA_2T_intPAArrayLength		Rtl8192DERadioA_2T_intPAArrayLength
+	#define Rtl8192D_RadioB_2T_intPAArrayLength		Rtl8192DERadioB_2T_intPAArrayLength
+
+#elif defined(CONFIG_USB_HCI)
+
+	#include "Hal8192DUHWImg.h"
+#ifdef CONFIG_WOWLAN
+	#include "Hal8192DUHWImg_wowlan.h"
+#endif //CONFIG_WOWLAN
+	#define RTL819X_DEFAULT_RF_TYPE		RF_1T2R
+
+//---------------------------------------------------------------------
+//		RTL8192DU From file
+//---------------------------------------------------------------------
+	#define RTL8192D_FW_IMG					"rtl8192DU\\rtl8192dfw.bin"
+
+	#define RTL8192D_PHY_REG					"rtl8192DU\\PHY_REG.txt"
+	#define RTL8192D_PHY_REG_PG				"rtl8192DU\\PHY_REG_PG.txt"
+	#define RTL8192D_PHY_REG_MP				"rtl8192DU\\PHY_REG_MP.txt"			
+	
+	#define RTL8192D_AGC_TAB					"rtl8192DU\\AGC_TAB.txt"
+	#define RTL8192D_AGC_TAB_2G				"rtl8192DU\\AGC_TAB_2G.txt"
+	#define RTL8192D_AGC_TAB_5G				"rtl8192DU\\AGC_TAB_5G.txt"
+	#define RTL8192D_PHY_RADIO_A				"rtl8192DU\\radio_a.txt"
+	#define RTL8192D_PHY_RADIO_B				"rtl8192DU\\radio_b.txt"
+	#define RTL8192D_PHY_RADIO_A_intPA		"rtl8192DU\\radio_a_intPA.txt"
+	#define RTL8192D_PHY_RADIO_B_intPA		"rtl8192DU\\radio_b_intPA.txt"
+	#define RTL8192D_PHY_MACREG				"rtl8192DU\\MAC_REG.txt"
+
+//---------------------------------------------------------------------
+//		RTL8192DU From header
+//---------------------------------------------------------------------
+		
+	// Fw Array
+	#define Rtl8192D_FwImageArray 					Rtl8192DUFwImgArray
+#ifdef CONFIG_WOWLAN
+	#define Rtl8192D_FwWWImageArray				Rtl8192DUFwWWImgArray
+#endif //CONFIG_WOWLAN
+	// MAC/BB/PHY Array
+	#define Rtl8192D_MAC_Array						Rtl8192DUMAC_2T_Array
+	#define Rtl8192D_AGCTAB_Array					Rtl8192DUAGCTAB_Array
+	#define Rtl8192D_AGCTAB_5GArray				Rtl8192DUAGCTAB_5GArray
+	#define Rtl8192D_AGCTAB_2GArray				Rtl8192DUAGCTAB_2GArray
+	#define Rtl8192D_AGCTAB_2TArray 				Rtl8192DUAGCTAB_2TArray
+	#define Rtl8192D_AGCTAB_1TArray 				Rtl8192DUAGCTAB_1TArray
+	#define Rtl8192D_PHY_REG_2TArray				Rtl8192DUPHY_REG_2TArray			
+	#define Rtl8192D_PHY_REG_1TArray				Rtl8192DUPHY_REG_1TArray
+	#define Rtl8192D_PHY_REG_Array_PG				Rtl8192DUPHY_REG_Array_PG
+	#define Rtl8192D_PHY_REG_Array_MP				Rtl8192DUPHY_REG_Array_MP
+	#define Rtl8192D_RadioA_2TArray					Rtl8192DURadioA_2TArray
+	#define Rtl8192D_RadioA_1TArray					Rtl8192DURadioA_1TArray
+	#define Rtl8192D_RadioB_2TArray					Rtl8192DURadioB_2TArray
+	#define Rtl8192D_RadioB_1TArray					Rtl8192DURadioB_1TArray
+	#define Rtl8192D_RadioA_2T_intPAArray			Rtl8192DURadioA_2T_intPAArray
+	#define Rtl8192D_RadioB_2T_intPAArray 			Rtl8192DURadioB_2T_intPAArray
+	
+	// Array length
+	#define Rtl8192D_FwImageArrayLength			Rtl8192DUImgArrayLength
+	#define Rtl8192D_MAC_ArrayLength				Rtl8192DUMAC_2T_ArrayLength
+	#define Rtl8192D_AGCTAB_5GArrayLength			Rtl8192DUAGCTAB_5GArrayLength
+	#define Rtl8192D_AGCTAB_2GArrayLength			Rtl8192DUAGCTAB_2GArrayLength
+	#define Rtl8192D_AGCTAB_2TArrayLength			Rtl8192DUAGCTAB_2TArrayLength
+	#define Rtl8192D_AGCTAB_1TArrayLength			Rtl8192DUAGCTAB_1TArrayLength
+	#define Rtl8192D_AGCTAB_ArrayLength 			Rtl8192DUAGCTAB_ArrayLength
+	#define Rtl8192D_PHY_REG_2TArrayLength			Rtl8192DUPHY_REG_2TArrayLength
+	#define Rtl8192D_PHY_REG_1TArrayLength			Rtl8192DUPHY_REG_1TArrayLength
+	#define Rtl8192D_PHY_REG_Array_PGLength		Rtl8192DUPHY_REG_Array_PGLength
+	#define Rtl8192D_PHY_REG_Array_MPLength		Rtl8192DUPHY_REG_Array_MPLength
+	#define Rtl8192D_RadioA_2TArrayLength			Rtl8192DURadioA_2TArrayLength
+	#define Rtl8192D_RadioB_2TArrayLength			Rtl8192DURadioB_2TArrayLength
+	#define Rtl8192D_RadioA_2T_intPAArrayLength		Rtl8192DURadioA_2T_intPAArrayLength			
+	#define Rtl8192D_RadioB_2T_intPAArrayLength		Rtl8192DURadioB_2T_intPAArrayLength
+
+	// The file name "_2T" is for 92CU, "_1T"  is for 88CU. Modified by tynli. 2009.11.24.
+/*	#define Rtl819XFwImageArray					Rtl8192DUFwImgArray
+	#define Rtl819XMAC_Array					Rtl8192DUMAC_2TArray
+	#define Rtl819XAGCTAB_Array					Rtl8192DUAGCTAB_Array
+	#define Rtl819XAGCTAB_5GArray				Rtl8192DUAGCTAB_5GArray
+	#define Rtl819XAGCTAB_2GArray				Rtl8192DUAGCTAB_2GArray
+	#define Rtl819XPHY_REG_2TArray				Rtl8192DUPHY_REG_2TArray
+	#define Rtl819XPHY_REG_1TArray				Rtl8192DUPHY_REG_1TArray
+	#define Rtl819XRadioA_2TArray				Rtl8192DURadioA_2TArray
+	#define Rtl819XRadioA_1TArray				Rtl8192DURadioA_1TArray
+	#define Rtl819XRadioA_2T_intPAArray 			Rtl8192DURadioA_2T_intPAArray
+	#define Rtl819XRadioB_2TArray				Rtl8192DURadioB_2TArray
+	#define Rtl819XRadioB_1TArray				Rtl8192DURadioB_1TArray
+	#define Rtl819XRadioB_2T_intPAArray 			Rtl8192DURadioB_2T_intPAArray
+	#define Rtl819XPHY_REG_Array_PG 			Rtl8192DUPHY_REG_Array_PG
+	#define Rtl819XPHY_REG_Array_MP 			Rtl8192DUPHY_REG_Array_MP
+
+	#define Rtl819XAGCTAB_2TArray				Rtl8192DUAGCTAB_2TArray
+	#define Rtl819XAGCTAB_1TArray				Rtl8192DUAGCTAB_1TArray*/
+
+#endif
+
+#define DRVINFO_SZ	4 // unit is 8bytes
+#define PageNum_128(_Len)		(u32)(((_Len)>>7) + ((_Len)&0x7F ? 1:0))
+
+//
+// Check if FW header exists. We do not consider the lower 4 bits in this case. 
+// By tynli. 2009.12.04.
+//
+#define IS_FW_HEADER_EXIST(_pFwHdr)	((le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x92C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x88C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D1 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D2 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D3 )
+
+#define FW_8192D_SIZE				0x8020 // Max FW len = 32k + 32(FW header length).
+#define FW_8192D_START_ADDRESS	0x1000
+#define FW_8192D_END_ADDRESS		0x1FFF
+
+#define MAX_PAGE_SIZE				4096	// @ page : 4k bytes
+
+typedef enum _FIRMWARE_SOURCE{
+	FW_SOURCE_IMG_FILE = 0,
+	FW_SOURCE_HEADER_FILE = 1,		//from header file
+}FIRMWARE_SOURCE, *PFIRMWARE_SOURCE;
+
+typedef struct _RT_FIRMWARE{
+	FIRMWARE_SOURCE	eFWSource;
+	u8*			szFwBuffer;
+	u32			ulFwLength;
+#ifdef CONFIG_WOWLAN
+	u8*			szWoWLANFwBuffer;
+	u32			ulWoWLANFwLength;
+#endif //CONFIG_WOWLAN
+}RT_FIRMWARE, *PRT_FIRMWARE, RT_FIRMWARE_92D, *PRT_FIRMWARE_92D;
+
+//
+// This structure must be cared byte-ordering
+//
+// Added by tynli. 2009.12.04.
+typedef struct _RT_8192D_FIRMWARE_HDR {//8-byte alinment required
+
+	//--- LONG WORD 0 ----
+	u16		Signature;	// 92C0: test chip; 92C, 88C0: test chip; 88C1: MP A-cut; 92C1: MP A-cut
+	u8		Category;	// AP/NIC and USB/PCI
+	u8		Function;	// Reserved for different FW function indcation, for further use when driver needs to download different FW in different conditions
+	u16		Version;		// FW Version
+	u8		Subversion;	// FW Subversion, default 0x00
+	u8		Rsvd1;
+
+
+	//--- LONG WORD 1 ----
+	u8		Month;	// Release time Month field
+	u8		Date;	// Release time Date field
+	u8		Hour;	// Release time Hour field
+	u8		Minute;	// Release time Minute field
+	u16		RamCodeSize;	// The size of RAM code
+	u16		Rsvd2;
+
+	//--- LONG WORD 2 ----
+	u32		SvnIdx;	// The SVN entry index
+	u32		Rsvd3;
+
+	//--- LONG WORD 3 ----
+	u32		Rsvd4;
+	u32		Rsvd5;
+
+}RT_8192D_FIRMWARE_HDR, *PRT_8192D_FIRMWARE_HDR;
+
+#define DRIVER_EARLY_INT_TIME		0x05
+#define BCN_DMA_ATIME_INT_TIME		0x02
+
+typedef	enum _BT_CoType{
+	BT_2Wire			= 0,		
+	BT_ISSC_3Wire	= 1,
+	BT_Accel			= 2,
+	BT_CSR			= 3,
+	BT_CSR_ENHAN	= 4,
+	BT_RTL8756		= 5,
+} BT_CoType, *PBT_CoType;
+
+typedef	enum _BT_CurState{
+	BT_OFF		= 0,	
+	BT_ON		= 1,
+} BT_CurState, *PBT_CurState;
+
+typedef	enum _BT_ServiceType{
+	BT_SCO			= 0,	
+	BT_A2DP			= 1,
+	BT_HID			= 2,
+	BT_HID_Idle		= 3,
+	BT_Scan			= 4,
+	BT_Idle			= 5,
+	BT_OtherAction	= 6,
+	BT_Busy			= 7,
+	BT_OtherBusy		= 8,
+} BT_ServiceType, *PBT_ServiceType;
+
+typedef	enum _BT_RadioShared{
+	BT_Radio_Shared 	= 0,	
+	BT_Radio_Individual	= 1,
+} BT_RadioShared, *PBT_RadioShared;
+
+typedef struct _BT_COEXIST_STR{
+	u8					BluetoothCoexist;
+	u8					BT_Ant_Num;
+	u8					BT_CoexistType;
+	u8					BT_State;
+	u8					BT_CUR_State;		//0:on, 1:off
+	u8					BT_Ant_isolation;	//0:good, 1:bad
+	u8					BT_PapeCtrl;		//0:SW, 1:SW/HW dynamic
+	u8					BT_Service;			
+	u8					BT_RadioSharedType;
+	u8					Ratio_Tx;
+	u8					Ratio_PRI;
+}BT_COEXIST_STR, *PBT_COEXIST_STR;
+
+//Added for 92D IQK setting.
+typedef struct _IQK_MATRIX_REGS_SETTING{
+	BOOLEAN 	bIQKDone;
+#if 1
+	int		Value[1][IQK_Matrix_REG_NUM];
+#else	
+	u32		Mark[IQK_Matrix_REG_NUM];
+	u32		Value[IQK_Matrix_REG_NUM];
+#endif	
+}IQK_MATRIX_REGS_SETTING,*PIQK_MATRIX_REGS_SETTING;
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+
+typedef enum _USB_RX_AGG_MODE{
+	USB_RX_AGG_DISABLE,
+	USB_RX_AGG_DMA,
+	USB_RX_AGG_USB,
+	USB_RX_AGG_DMA_USB
+}USB_RX_AGG_MODE;
+
+#define MAX_RX_DMA_BUFFER_SIZE	10240		// 10K for 8192C RX DMA buffer
+
+#endif
+
+
+#define TX_SELE_HQ			BIT(0)		// High Queue
+#define TX_SELE_LQ			BIT(1)		// Low Queue
+#define TX_SELE_NQ			BIT(2)		// Normal Queue
+
+
+// Note: We will divide number of page equally for each queue other than public queue!
+
+#define TX_TOTAL_PAGE_NUMBER		0xF8
+#define TX_PAGE_BOUNDARY			(TX_TOTAL_PAGE_NUMBER + 1)
+
+// For Normal Chip Setting
+// (HPQ + LPQ + NPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define NORMAL_PAGE_NUM_PUBQ		0x56
+
+
+// For Test Chip Setting
+// (HPQ + LPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define TEST_PAGE_NUM_PUBQ_92DU			0x89
+#define TX_TOTAL_PAGE_NUMBER_92D_DUAL_MAC		0x7A
+#define NORMAL_PAGE_NUM_PUBQ_92D_DUAL_MAC			0x5A
+#define NORMAL_PAGE_NUM_HPQ_92D_DUAL_MAC			0x10
+#define NORMAL_PAGE_NUM_LPQ_92D_DUAL_MAC			0x10
+#define NORMAL_PAGE_NUM_NORMALQ_92D_DUAL_MAC		0
+
+#define TX_PAGE_BOUNDARY_DUAL_MAC			(TX_TOTAL_PAGE_NUMBER_92D_DUAL_MAC + 1)
+
+// For Test Chip Setting
+#define WMM_TEST_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_TEST_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_TEST_PAGE_NUM_PUBQ		0xA3
+#define WMM_TEST_PAGE_NUM_HPQ		0x29
+#define WMM_TEST_PAGE_NUM_LPQ		0x29
+
+
+//Note: For Normal Chip Setting ,modify later
+#define WMM_NORMAL_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_NORMAL_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_NORMAL_PAGE_NUM_PUBQ_92D		0X65//0x82
+#define WMM_NORMAL_PAGE_NUM_HPQ_92D		0X30//0x29
+#define WMM_NORMAL_PAGE_NUM_LPQ_92D		0X30
+#define WMM_NORMAL_PAGE_NUM_NPQ_92D		0X30
+
+#define WMM_NORMAL_PAGE_NUM_PUBQ_92D_DUAL_MAC		0X32
+#define WMM_NORMAL_PAGE_NUM_HPQ_92D_DUAL_MAC		0X18
+#define WMM_NORMAL_PAGE_NUM_LPQ_92D_DUAL_MAC		0X18
+#define WMM_NORMAL_PAGE_NUM_NPQ_92D_DUAL_MAC		0X18
+
+//-------------------------------------------------------------------------
+//	Chip specific
+//-------------------------------------------------------------------------
+
+#define CHIP_BONDING_IDENTIFIER(_value)	(((_value)>>22)&0x3)
+#define CHIP_BONDING_92C_1T2R	0x1
+#define CHIP_BONDING_88C_USB_MCARD	0x2
+#define CHIP_BONDING_88C_USB_HP	0x1
+
+//
+// 2011.01.06. Define new structure of chip version for RTL8723 and so on. Added by tynli.
+//
+/*
+     | BIT15:12           |  BIT11:8        | BIT 7              |  BIT6:4  |      BIT3          | BIT2:0  |
+     |-------------+-----------+-----------+-------+-----------+-------|
+     | IC version(CUT)  | ROM version  | Manufacturer  | RF type  |  Chip type       | IC Type |
+     |                           |                      | TSMC/UMC    |              | TEST/NORMAL|             |
+*/
+// [15:12] IC version(CUT): A-cut=0, B-cut=1, C-cut=2, D-cut=3
+// [7] Manufacturer: TSMC=0, UMC=1
+// [6:4] RF type: 1T1R=0, 1T2R=1, 2T2R=2
+// [3] Chip type: TEST=0, NORMAL=1
+// [2:0] IC type: 81xxC=0, 8723=1, 92D=2
+
+#define CHIP_8723						BIT(0)
+#define CHIP_92D						BIT(1)
+#define NORMAL_CHIP  					BIT(3)
+#define RF_TYPE_1T1R					(~(BIT(4)|BIT(5)|BIT(6)))
+#define RF_TYPE_1T2R					BIT(4)
+#define RF_TYPE_2T2R					BIT(5)
+#define CHIP_VENDOR_UMC				BIT(7)
+#define B_CUT_VERSION					BIT(12)
+#define C_CUT_VERSION					BIT(13)
+#define D_CUT_VERSION					((BIT(12)|BIT(13)))
+#define E_CUT_VERSION					BIT(14)
+
+
+// MASK
+#define IC_TYPE_MASK					(BIT(0)|BIT(1)|BIT(2))
+#define CHIP_TYPE_MASK 				BIT(3)
+#define RF_TYPE_MASK					(BIT(4)|BIT(5)|BIT(6))
+#define MANUFACTUER_MASK			BIT(7)	
+#define ROM_VERSION_MASK				(BIT(11)|BIT(10)|BIT(9)|BIT(8))
+#define CUT_VERSION_MASK				(BIT(15)|BIT(14)|BIT(13)|BIT(12))
+
+// Get element
+#define GET_CVID_IC_TYPE(version)			((version) & IC_TYPE_MASK)
+#define GET_CVID_CHIP_TYPE(version)			((version) & CHIP_TYPE_MASK)
+#define GET_CVID_RF_TYPE(version)			((version) & RF_TYPE_MASK)
+#define GET_CVID_MANUFACTUER(version)		((version) & MANUFACTUER_MASK)
+#define GET_CVID_ROM_VERSION(version)		((version) & ROM_VERSION_MASK)
+#define GET_CVID_CUT_VERSION(version)		((version) & CUT_VERSION_MASK)
+
+#define IS_81XXC(version)					((GET_CVID_IC_TYPE(version) == 0)? _TRUE : _FALSE)
+#define IS_8723_SERIES(version)				((GET_CVID_IC_TYPE(version) == CHIP_8723)? _TRUE : _FALSE)
+#define IS_92D(version)						((GET_CVID_IC_TYPE(version) == CHIP_92D)? _TRUE : _FALSE)
+#define IS_1T1R(version)						((GET_CVID_RF_TYPE(version))? _FALSE : _TRUE)
+#define IS_1T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_1T2R)? _TRUE : _FALSE)
+#define IS_2T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_2T2R)? _TRUE : _FALSE)
+#define IS_CHIP_VENDOR_UMC(version)			((GET_CVID_MANUFACTUER(version))? _TRUE: _FALSE)
+
+#define IS_92C_SERIAL(version)   				((IS_81XXC(version) && IS_2T2R(version)) ? _TRUE : _FALSE)
+#define IS_VENDOR_UMC_A_CUT(version)		((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+#define IS_VENDOR_8723_A_CUT(version)		((IS_8723_SERIES(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+// <tynli_Note> 88/92C UMC B-cut vendor is set to TSMC so we need to check CHIP_VENDOR_UMC bit is not 1. 
+#define IS_81xxC_VENDOR_UMC_B_CUT(version)	((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version) == B_CUT_VERSION) ? _TRUE : _FALSE):_FALSE)
+#define IS_92D_SINGLEPHY(version)     			((IS_92D(version)) ? (IS_2T2R(version) ? _TRUE: _FALSE) : _FALSE)
+
+#define IS_92D_C_CUT(version)    			((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == C_CUT_VERSION) ? _TRUE : _FALSE) : _FALSE)
+#define IS_92D_D_CUT(version)    			((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == D_CUT_VERSION) ? _TRUE : _FALSE) : _FALSE)
+#define IS_92D_E_CUT(version)    			((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == E_CUT_VERSION) ? _TRUE : _FALSE) : _FALSE)
+#define IS_NORMAL_CHIP92D(version)		((GET_CVID_CHIP_TYPE(version))? _TRUE: _FALSE)
+
+typedef enum _VERSION_8192D{
+	VERSION_TEST_CHIP_88C = 0x0000,
+	VERSION_TEST_CHIP_92C = 0x0020,
+	VERSION_TEST_UMC_CHIP_8723 = 0x0081,
+	VERSION_NORMAL_TSMC_CHIP_88C = 0x0008, 
+	VERSION_NORMAL_TSMC_CHIP_92C = 0x0028,
+	VERSION_NORMAL_TSMC_CHIP_92C_1T2R = 0x0018,
+	VERSION_NORMAL_UMC_CHIP_88C_A_CUT = 0x0088,
+	VERSION_NORMAL_UMC_CHIP_92C_A_CUT = 0x00a8,
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT = 0x0098,		
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_A_CUT = 0x0089,
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_B_CUT = 0x1089,	
+	VERSION_NORMAL_UMC_CHIP_88C_B_CUT = 0x1088, 
+	VERSION_NORMAL_UMC_CHIP_92C_B_CUT = 0x10a8, 
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT = 0x1090, 
+	VERSION_TEST_CHIP_92D_SINGLEPHY= 0x0022,
+	VERSION_TEST_CHIP_92D_DUALPHY = 0x0002,
+	VERSION_NORMAL_CHIP_92D_SINGLEPHY= 0x002a,
+	VERSION_NORMAL_CHIP_92D_DUALPHY = 0x000a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_SINGLEPHY = 0x202a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_DUALPHY = 0x200a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_SINGLEPHY = 0x302a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_DUALPHY = 0x300a,
+	VERSION_NORMAL_CHIP_92D_E_CUT_SINGLEPHY = 0x402a,
+	VERSION_NORMAL_CHIP_92D_E_CUT_DUALPHY = 0x400a,
+}VERSION_8192D,*PVERSION_8192D;
+
+
+//-------------------------------------------------------------------------
+//	Channel Plan
+//-------------------------------------------------------------------------
+enum ChannelPlan{
+	CHPL_FCC	= 0,
+	CHPL_IC		= 1,
+	CHPL_ETSI	= 2,
+	CHPL_SPAIN	= 3,
+	CHPL_FRANCE	= 4,
+	CHPL_MKK	= 5,
+	CHPL_MKK1	= 6,
+	CHPL_ISRAEL	= 7,
+	CHPL_TELEC	= 8,
+	CHPL_GLOBAL	= 9,
+	CHPL_WORLD	= 10,
+};
+
+typedef struct _TxPowerInfo{
+	u8 CCKIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_1SIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_2SIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	s8 HT20IndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 OFDMIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT20MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 TSSI_A[3];
+	u8 TSSI_B[3];
+	u8 TSSI_A_5G[3];		//5GL/5GM/5GH
+	u8 TSSI_B_5G[3];
+}TxPowerInfo, *PTxPowerInfo;
+
+#define EFUSE_REAL_CONTENT_LEN	1024
+#define EFUSE_MAP_LEN				256
+#define EFUSE_MAX_SECTION			32
+#define EFUSE_MAX_SECTION_BASE	16
+// <Roger_Notes> To prevent out of boundary programming case, leave 1byte and program full section
+// 9bytes + 1byt + 5bytes and pre 1byte.
+// For worst case:
+// | 2byte|----8bytes----|1byte|--7bytes--| //92D
+#define EFUSE_OOB_PROTECT_BYTES 	18 // PG data exclude header, dummy 7 bytes frome CP test and reserved 1byte.
+
+typedef enum _PA_MODE {
+	PA_MODE_EXTERNAL = 0x00,
+	PA_MODE_INTERNAL_SP3T = 0x01,
+	PA_MODE_INTERNAL_SPDT = 0x02	
+} PA_MODE;
+
+/* Copy from rtl8192c */
+enum c2h_id_8192d {
+	C2H_DBG = 0,
+	C2H_TSF = 1,
+	C2H_AP_RPT_RSP = 2,
+	C2H_CCX_TX_RPT = 3,
+	C2H_BT_RSSI = 4,
+	C2H_BT_OP_MODE = 5,
+	C2H_EXT_RA_RPT = 6,
+	C2H_HW_INFO_EXCH = 10,
+	C2H_C2H_H2C_TEST = 11,
+	C2H_BT_INFO = 12,
+	C2H_BT_MP_INFO = 15,
+	MAX_C2HEVENT
+};
+
+#ifdef CONFIG_PCI_HCI
+struct hal_data_8192de
+{
+	VERSION_8192D	VersionID;
+
+	// add for 92D Phy mode/mac/Band mode 
+	MACPHY_MODE_8192D	MacPhyMode92D;
+	BAND_TYPE	CurrentBandType92D;	//0:2.4G, 1:5G
+	BAND_TYPE	BandSet92D;
+	BOOLEAN		bIsVS;
+	BOOLEAN		bSupportRemoteWakeUp;
+	u8	AutoLoadStatusFor8192D;
+
+	BOOLEAN		bNOPG;
+
+	BOOLEAN       bMasterOfDMSP;
+	BOOLEAN       bSlaveOfDMSP;
+
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	u32	IntrMask[2];
+	u32	IntrMaskToSet[2];
+
+	u32	DisabledFunctions;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	u32	TransmitConfig;
+	WIRELESS_MODE	CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+	u16	BasicRateSet;
+
+	//rf_ctrl
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	//
+	// EEPROM setting.
+	//
+	u16	EEPROMVID;
+	u16	EEPROMDID;
+	u16	EEPROMSVID;
+	u16	EEPROMSMID;
+	u16	EEPROMChannelPlan;
+	u16	EEPROMVersion;
+
+	u8	EEPROMCustomerID;
+	u8	EEPROMBoardType;
+	u8	EEPROMRegulatory;
+
+	u8	EEPROMThermalMeter;
+
+	u8	EEPROMC9;
+	u8	EEPROMCC;
+	u8	PAMode;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER_2G];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr	
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+	u8	CrystalCap;	// CrystalCap.
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[MAX_PG_GROUP][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+	u8	InternalPA5G[2];	//pathA / pathB
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	BOOLEAN		bPhyValueInitReady;
+
+	BOOLEAN		bTXPowerDataReadFromEEPORM;
+
+	BOOLEAN		bInSetPower;
+
+	//RDG enable
+	BOOLEAN		bRDGEnable;
+
+	BOOLEAN		bLoadIMRandIQKSettingFor2G;// True if IMR or IQK  have done  for 2.4G in scan progress
+	BOOLEAN		bNeedIQK;
+
+	BOOLEAN		bLCKInProgress;
+
+	BOOLEAN		bEarlyModeEnable;
+
+#if 1
+	IQK_MATRIX_REGS_SETTING IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];
+#else
+	//regc80��regc94��regc4c��regc88��regc9c��regc14��regca0��regc1c��regc78
+	u4Byte				IQKMatrixReg[IQK_Matrix_REG_NUM];
+	IQK_MATRIX_REGS_SETTING			   IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];	// 1->2G,24->5G 20M channel,21->5G 40M channel.													
+#endif
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegTxPause;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+	u8	RegCR_1;
+
+	struct dm_priv	dmpriv;
+
+	u8	bInterruptMigration;
+
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	// Add for dual MAC  0--Mac0 1--Mac1
+	u32	interfaceIndex;
+
+	u16	RegRRSR;
+
+	u16	EfuseUsedBytes;
+	u8	RTSInitRate;	 // 2010.11.24.by tynli.
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192de HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+
+//
+// Function disabled.
+//
+#define DF_TX_BIT		BIT0
+#define DF_RX_BIT		BIT1
+#define DF_IO_BIT		BIT2
+#define DF_IO_D3_BIT			BIT3
+
+#define RT_DF_TYPE		u32
+#define RT_DISABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions |= ((RT_DF_TYPE)(__FuncBits)))
+#define RT_ENABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions &= (~((RT_DF_TYPE)(__FuncBits))))
+#define RT_IS_FUNC_DISABLED(__pAdapter, __FuncBits) ( (__pAdapter)->DisabledFunctions & (__FuncBits) )
+
+void InterruptRecognized8192DE(PADAPTER Adapter, PRT_ISR_CONTENT pIsrContent);
+VOID UpdateInterruptMask8192DE(PADAPTER Adapter, u32 AddMSR, u32 RemoveMSR);
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+//should be renamed and moved to another file
+typedef	enum _INTERFACE_SELECT_8192DUSB{
+	INTF_SEL0_USB 			= 0,		// USB
+	INTF_SEL1_MINICARD	= 1,		// Minicard
+	INTF_SEL2_EKB_PRO		= 2,		// Eee keyboard proprietary
+	INTF_SEL3_PRO			= 3,		// Customized proprietary
+} INTERFACE_SELECT_8192DUSB, *PINTERFACE_SELECT_8192DUSB;
+
+typedef INTERFACE_SELECT_8192DUSB INTERFACE_SELECT_USB;
+
+struct hal_data_8192du
+{
+	VERSION_8192D	VersionID;
+
+	// add for 92D Phy mode/mac/Band mode 
+	MACPHY_MODE_8192D	MacPhyMode92D;
+	BAND_TYPE	CurrentBandType92D;	//0:2.4G, 1:5G
+	BAND_TYPE	BandSet92D;
+	BOOLEAN		bIsVS;
+
+	BOOLEAN		bNOPG;
+
+	BOOLEAN		bSupportRemoteWakeUp;
+	BOOLEAN		bMasterOfDMSP;
+	BOOLEAN		bSlaveOfDMSP;
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	BOOLEAN		bInModeSwitchProcess;
+#endif
+
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	WIRELESS_MODE	CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+	u16	BasicRateSet;
+
+	INTERFACE_SELECT_8192DUSB	InterfaceSel;
+
+	//rf_ctrl
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	//
+	// EEPROM setting.
+	//
+	u8	EEPROMVersion;
+	u16	EEPROMVID;
+	u16	EEPROMPID;
+	u16	EEPROMSVID;
+	u16	EEPROMSDID;
+	u8	EEPROMCustomerID;
+	u8	EEPROMSubCustomerID;	
+	u8	EEPROMRegulatory;
+
+	u8	EEPROMThermalMeter;
+
+	u8	EEPROMC9;
+	u8	EEPROMCC;
+	u8	PAMode;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER_2G];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr	
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+	u8	CrystalCap;	// CrystalCap.
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[MAX_PG_GROUP][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+	u8	InternalPA5G[2];	//pathA / pathB
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	BOOLEAN		bPhyValueInitReady;
+
+	BOOLEAN		bTXPowerDataReadFromEEPORM;
+
+	BOOLEAN		bInSetPower;
+
+	//RDG enable
+	BOOLEAN		bRDGEnable;
+
+	BOOLEAN		bLoadIMRandIQKSettingFor2G;// True if IMR or IQK  have done  for 2.4G in scan progress
+	BOOLEAN		bNeedIQK;
+
+	BOOLEAN		bLCKInProgress;
+
+	BOOLEAN		bEarlyModeEnable;
+
+#if 1
+	IQK_MATRIX_REGS_SETTING IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];
+#else
+	//regc80��regc94��regc4c��regc88��regc9c��regc14��regca0��regc1c��regc78
+	u4Byte				IQKMatrixReg[IQK_Matrix_REG_NUM];
+	IQK_MATRIX_REGS_SETTING			   IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];	// 1->2G,24->5G 20M channel,21->5G 40M channel.													
+#endif
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegTxPause;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+	u8	RegCR_1;
+
+	struct dm_priv	dmpriv;
+
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	//Query RF by FW
+	BOOLEAN		bReadRFbyFW;
+
+	// For 92C USB endpoint setting
+	//
+
+	u32	UsbBulkOutSize;
+
+	int	RtBulkOutPipe[3];
+	int	RtBulkInPipe;
+	int	RtIntInPipe;
+
+	// Add for dual MAC  0--Mac0 1--Mac1
+	u32	interfaceIndex;
+
+	u8	OutEpQueueSel;
+	u8	OutEpNumber;
+
+	u8	Queue2EPNum[8];//for out endpoint number mapping
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	u8	UsbTxAggMode;
+	u8	UsbTxAggDescNum;
+#endif
+#ifdef CONFIG_USB_RX_AGGREGATION
+	u16	HwRxPageSize;				// Hardware setting
+	u32	MaxUsbRxAggBlock;
+
+	USB_RX_AGG_MODE	UsbRxAggMode;
+	u8	UsbRxAggBlockCount;			// USB Block count. Block size is 512-byte in hight speed and 64-byte in full speed
+	u8	UsbRxAggBlockTimeout;
+	u8	UsbRxAggPageCount;			// 8192C DMA page count
+	u8	UsbRxAggPageTimeout;
+#endif
+
+	u16	RegRRSR;
+
+	u16	EfuseUsedBytes;
+	u8	RTSInitRate;	 // 2010.11.24.by tynli.
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192du HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+#endif
+
+#define GET_HAL_DATA(__pAdapter)	((HAL_DATA_TYPE *)((__pAdapter)->HalData))
+#define GET_RF_TYPE(priv)	(GET_HAL_DATA(priv)->rf_type)
+
+int FirmwareDownload92D(IN	PADAPTER Adapter,IN	BOOLEAN  bUsedWoWLANFw);
+VOID rtl8192d_FirmwareSelfReset(IN PADAPTER Adapter);
+void rtl8192d_ReadChipVersion(IN PADAPTER Adapter);
+VOID rtl8192d_EfuseParseChnlPlan(PADAPTER Adapter, u8 *hwinfo, BOOLEAN AutoLoadFail);
+VOID rtl8192d_ReadTxPowerInfo(PADAPTER Adapter, u8* PROMContent, BOOLEAN AutoLoadFail);
+VOID rtl8192d_ResetDualMacSwitchVariables(IN PADAPTER Adapter);
+u8 GetEEPROMSize8192D(PADAPTER Adapter);
+BOOLEAN PHY_CheckPowerOffFor8192D(PADAPTER Adapter);
+VOID PHY_SetPowerOnFor8192D(PADAPTER Adapter);
+//void PHY_ConfigMacPhyMode92D(PADAPTER Adapter);
+void rtl8192d_free_hal_data(_adapter * padapter);
+void rtl8192d_set_hal_ops(struct hal_ops *pHalFunc);
+
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+
+
+extern void Hal_SetAntenna(PADAPTER pAdapter);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetTxPower(PADAPTER pAdapter);
+extern void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetSingleToneTx ( PADAPTER pAdapter , u8 bStart );
+extern void Hal_SetSingleCarrierTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetContinuousTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetDataRate(PADAPTER pAdapter);
+extern void Hal_SetChannel(PADAPTER pAdapter);
+extern void Hal_SetAntennaPathPower(PADAPTER pAdapter);
+extern s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void Hal_GetPowerTracking(PADAPTER padapter, u8 * enable);
+extern void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value);
+extern void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter);
+extern void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14);
+extern void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven);
+extern void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_TriggerRFThermalMeter(PADAPTER pAdapter);
+extern u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter);
+extern void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart);
+
+
+#endif //end CONFIG_MP_INCLUDED
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h
new file mode 100755
index 0000000000000..d736bda4e9357
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h
@@ -0,0 +1,43 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192D_LED_H_
+#define __RTL8192D_LED_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+//================================================================================
+// Interface to manipulate LED objects.
+//================================================================================
+#ifdef CONFIG_USB_HCI
+void rtl8192du_InitSwLeds(_adapter *padapter);
+void rtl8192du_DeInitSwLeds(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+void rtl8192de_gen_RefreshLedState(PADAPTER Adapter);
+void rtl8192de_InitSwLeds(_adapter *padapter);
+void rtl8192de_DeInitSwLeds(_adapter *padapter);
+#endif
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h
new file mode 100755
index 0000000000000..36cc2322be768
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h
@@ -0,0 +1,187 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192D_RECV_H_
+#define _RTL8192D_RECV_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#ifdef PLATFORM_OS_XP
+	#ifdef CONFIG_SDIO_HCI
+		#define NR_RECVBUFF 1024//512//128
+	#else
+		#define NR_RECVBUFF (16)
+	#endif
+#elif defined(PLATFORM_OS_CE)
+	#ifdef CONFIG_SDIO_HCI
+		#define NR_RECVBUFF (128)
+	#else
+		#define NR_RECVBUFF (4)
+	#endif
+#else
+#ifdef CONFIG_SINGLE_RECV_BUF
+	#define NR_RECVBUFF (1)
+#else
+	#define NR_RECVBUFF (4)
+#endif //CONFIG_SINGLE_RECV_BUF
+	#define NR_PREALLOC_RECV_SKB (8)
+#endif
+
+
+
+#define RECV_BLK_SZ 512
+#define RECV_BLK_CNT 16
+#define RECV_BLK_TH RECV_BLK_CNT
+
+#if defined(CONFIG_USB_HCI)
+
+#ifdef PLATFORM_OS_CE
+#define MAX_RECVBUF_SZ (8192+1024) // 8K+1k
+#else
+	#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+		//#define MAX_RECVBUF_SZ (32768) // 32k
+		//#define MAX_RECVBUF_SZ (16384) //16K
+		//#define MAX_RECVBUF_SZ (10240) //10K
+		#ifdef CONFIG_PLATFORM_MSTAR
+			#define MAX_RECVBUF_SZ (8192) // 8K
+		#else
+			#define MAX_RECVBUF_SZ (15360) // 15k < 16k
+		#endif
+	#else
+		#define MAX_RECVBUF_SZ (4000) // about 4K
+	#endif
+#endif
+
+#elif defined(CONFIG_PCI_HCI)
+//#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+//	#define MAX_RECVBUF_SZ (9100)
+//#else
+	#define MAX_RECVBUF_SZ (4000) // about 4K
+//#endif
+
+#define RX_MPDU_QUEUE				0
+#define RX_CMD_QUEUE				1
+#define RX_MAX_QUEUE				2
+#endif
+
+#define RECV_BULK_IN_ADDR		0x80
+#define RECV_INT_IN_ADDR		0x81
+
+#define PHY_RSSI_SLID_WIN_MAX				100
+#define PHY_LINKQUALITY_SLID_WIN_MAX		20
+
+struct phy_stat
+{
+	unsigned int phydw0;
+
+	unsigned int phydw1;
+
+	unsigned int phydw2;
+
+	unsigned int phydw3;
+
+	unsigned int phydw4;
+
+	unsigned int phydw5;
+
+	unsigned int phydw6;
+
+	unsigned int phydw7;
+};
+
+typedef struct _Phy_OFDM_Rx_Status_Report_8192cd
+{
+	unsigned char	trsw_gain_X[4];
+	unsigned char	pwdb_all;
+	unsigned char	cfosho_X[4];
+	unsigned char	cfotail_X[4];
+	unsigned char	rxevm_X[2];
+	unsigned char	rxsnr_X[4];
+	unsigned char	pdsnr_X[2];
+	unsigned char	csi_current_X[2];
+	unsigned char	csi_target_X[2];
+	unsigned char	sigevm;
+	unsigned char	max_ex_pwr;
+//#ifdef RTL8192SE
+#ifdef CONFIG_LITTLE_ENDIAN
+	unsigned char ex_intf_flg:1;
+	unsigned char sgi_en:1;
+	unsigned char rxsc:2;
+	//unsigned char rsvd:4;
+	unsigned char idle_long:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char ANTSELB:1;
+	unsigned char ANTSEL:1;	
+#else	// _BIG_ENDIAN_
+	//unsigned char rsvd:4;
+	unsigned char ANTSEL:1;	
+	unsigned char ANTSELB:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char idle_long:1;
+	unsigned char rxsc:2;
+	unsigned char sgi_en:1;
+	unsigned char ex_intf_flg:1;
+#endif
+//#else	// RTL8190, RTL8192E
+//	unsigned char	sgi_en;
+//	unsigned char	rxsc_sgien_exflg;
+//#endif
+}__attribute__ ((packed)) PHY_STS_OFDM_8192CD_T,PHY_RX_DRIVER_INFO_8192CD;
+
+typedef struct _Phy_CCK_Rx_Status_Report_8192cd
+{
+	/* For CCK rate descriptor. This is a signed 8:1 variable. LSB bit presend
+		0.5. And MSB 7 bts presend a signed value. Range from -64~+63.5. */
+	u8	adc_pwdb_X[4];
+	u8	SQ_rpt;
+	u8	cck_agc_rpt;
+} PHY_STS_CCK_8192CD_T;
+
+// Rx smooth factor
+#define	Rx_Smooth_Factor (20)
+
+#ifdef CONFIG_USB_HCI
+typedef struct _INTERRUPT_MSG_FORMAT_EX{
+	unsigned int C2H_MSG0;
+	unsigned int C2H_MSG1;
+	unsigned int C2H_MSG2;
+	unsigned int C2H_MSG3;
+	unsigned int HISR; // from HISR Reg0x124, read to clear
+	unsigned int HISRE;// from HISRE Reg0x12c, read to clear
+	unsigned int  MSG_EX;
+}INTERRUPT_MSG_FORMAT_EX,*PINTERRUPT_MSG_FORMAT_EX;
+
+void rtl8192du_init_recvbuf(_adapter *padapter, struct recv_buf *precvbuf);
+int	rtl8192du_init_recv_priv(_adapter * padapter);
+void	rtl8192du_free_recv_priv(_adapter * padapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+int	rtl8192de_init_recv_priv(_adapter * padapter);
+void rtl8192de_free_recv_priv(_adapter * padapter);
+#endif
+
+void rtl8192d_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_info);
+void rtl8192d_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h
new file mode 100755
index 0000000000000..0b439a3f0dd7b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h
@@ -0,0 +1,97 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+ * 
+ * 
+ * Module:	rtl8192d_rf.h	( Header File)
+ * 
+ * Note:	Collect every HAL RF type exter API or constant.	 
+ *
+ * Function:	
+ * 		 
+ * Export:	
+ * 
+ * Abbrev:	
+ * 
+ * History:
+ * Data			Who		Remark
+ * 
+ * 09/25/2008	MHC		Create initial version.
+ * 
+ * 
+******************************************************************************/
+#ifndef _RTL8192D_RF_H_
+#define _RTL8192D_RF_H_
+/* Check to see if the file has been included already.  */
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//
+// For RF 6052 Series
+//
+#define		RF6052_MAX_TX_PWR			0x3F
+#define		RF6052_MAX_REG				0x3F
+#define		RF6052_MAX_PATH				2
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/ 
+
+/*------------------------------Define structure----------------------------*/ 
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+//
+// RF RL6052 Series API
+//
+void		rtl8192d_RF_ChangeTxPath(	IN	PADAPTER	Adapter, 
+										IN	u16		DataRate);
+void		rtl8192d_PHY_RF6052SetBandwidth(	
+										IN	PADAPTER				Adapter,
+										IN	HT_CHANNEL_WIDTH		Bandwidth);	
+VOID	rtl8192d_PHY_RF6052SetCckTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerlevel);
+VOID	rtl8192d_PHY_RF6052SetOFDMTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerLevel,
+										IN	u8		Channel);
+int	PHY_RF6052_Config8192D(	IN	PADAPTER		Adapter	);
+
+BOOLEAN	rtl8192d_PHY_EnableAnotherPHY(IN	PADAPTER Adapter, IN	BOOLEAN	 bMac0);
+
+void	rtl8192d_PHY_PowerDownAnotherPHY(IN PADAPTER Adapter, IN BOOLEAN bMac0);
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+
+#endif/* End of HalRf.h */
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h
new file mode 100755
index 0000000000000..bef7184e27c0f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h
@@ -0,0 +1,1841 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __RTL8192D_SPEC_H__
+#define __RTL8192D_SPEC_H__
+
+#include <drv_conf.h>
+
+#ifndef BIT
+#define BIT(x)		(1 << (x))
+#endif
+
+#define BIT0		0x00000001
+#define BIT1		0x00000002
+#define BIT2		0x00000004
+#define BIT3		0x00000008
+#define BIT4		0x00000010
+#define BIT5		0x00000020
+#define BIT6		0x00000040
+#define BIT7		0x00000080
+#define BIT8		0x00000100
+#define BIT9		0x00000200
+#define BIT10	0x00000400
+#define BIT11	0x00000800
+#define BIT12	0x00001000
+#define BIT13	0x00002000
+#define BIT14	0x00004000
+#define BIT15	0x00008000
+#define BIT16	0x00010000
+#define BIT17	0x00020000
+#define BIT18	0x00040000
+#define BIT19	0x00080000
+#define BIT20	0x00100000
+#define BIT21	0x00200000
+#define BIT22	0x00400000
+#define BIT23	0x00800000
+#define BIT24	0x01000000
+#define BIT25	0x02000000
+#define BIT26	0x04000000
+#define BIT27	0x08000000
+#define BIT28	0x10000000
+#define BIT29	0x20000000
+#define BIT30	0x40000000
+#define BIT31	0x80000000
+
+
+//============================================================
+//       8192D Regsiter offset definition
+//============================================================
+
+
+//============================================================
+//
+//============================================================
+
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+#define REG_SYS_ISO_CTRL			0x0000
+#define REG_SYS_FUNC_EN			0x0002
+#define REG_APS_FSMCO				0x0004
+#define REG_SYS_CLKR				0x0008
+#define REG_9346CR					0x000A
+#define REG_EE_VPD					0x000C
+#define REG_AFE_MISC				0x0010
+#define REG_SPS0_CTRL				0x0011
+#define REG_POWER_OFF_IN_PROCESS 0x0017
+#define REG_SPS_OCP_CFG			0x0018
+#define REG_RSV_CTRL				0x001C
+#define REG_RF_CTRL					0x001F
+#define REG_LDOA15_CTRL			0x0020
+#define REG_LDOV12D_CTRL			0x0021
+#define REG_LDOHCI12_CTRL			0x0022
+#define REG_LPLDO_CTRL				0x0023
+#define REG_AFE_XTAL_CTRL			0x0024
+#define REG_AFE_PLL_CTRL			0x0028
+#define REG_MAC_PHY_CTRL			0x002c //for 92d, DMDP,SMSP,DMSP contrl
+#define REG_EFUSE_CTRL				0x0030
+#define REG_EFUSE_TEST				0x0034
+#define REG_PWR_DATA				0x0038
+#define REG_CAL_TIMER				0x003C
+#define REG_ACLK_MON				0x003E
+#define REG_GPIO_MUXCFG			0x0040
+//#define REG_GPIO_MUXCFG				0x0041
+#define REG_GPIO_IO_SEL				0x0042
+#define REG_MAC_PINMUX_CFG		0x0043
+#define REG_GPIO_PIN_CTRL			0x0044
+#define REG_GPIO_INTM				0x0048
+#define REG_LEDCFG0					0x004C
+#define REG_LEDCFG1					0x004D
+#define REG_LEDCFG2					0x004E
+#define REG_LEDCFG3					0x004F
+#define REG_FSIMR					0x0050
+#define REG_FSISR					0x0054
+
+#define REG_MCUFWDL				0x0080
+#ifdef CONFIG_WOWLAN
+#define REG_WOWLAN_REASON			0x00FC
+#endif // CONFIG_WOWLAN
+#define REG_HMEBOX_EXT_0			0x0088
+#define REG_HMEBOX_EXT_1			0x008A
+#define REG_HMEBOX_EXT_2			0x008C
+#define REG_HMEBOX_EXT_3			0x008E
+
+#define REG_BIST_SCAN				0x00D0
+#define REG_BIST_RPT				0x00D4
+#define REG_BIST_ROM_RPT			0x00D8
+#define REG_USB_SIE_INTF			0x00E0
+#define REG_PCIE_MIO_INTF			0x00E4
+#define REG_PCIE_MIO_INTD			0x00E8
+#define REG_HPON_FSM				0x00EC
+#define REG_SYS_CFG					0x00F0
+#define REG_MAC_PHY_CTRL_NORMAL	0x00f8
+
+#define  REG_MAC0                                	0x0081
+#define  REG_MAC1                                	0x0053
+#define  FW_MAC0_ready                      	0x18
+#define  FW_MAC1_ready                      	0x1A
+#define  MAC0_ON                                  	BIT7
+#define  MAC1_ON                                  	BIT0
+#define  mac0_ready                             	BIT0
+#define  mac1_ready                             	BIT0
+
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+#define REG_CR						0x0100
+#define REG_PBP						0x0104
+#define REG_TRXDMA_CTRL			0x010C
+#define REG_TRXFF_BNDY				0x0114
+#define REG_TRXFF_STATUS			0x0118
+#define REG_RXFF_PTR				0x011C
+#define REG_HIMR					0x0120
+#define REG_HISR					0x0124
+#define REG_HIMRE					0x0128
+#define REG_HISRE					0x012C
+#define REG_CPWM					0x012F
+#define REG_FWIMR					0x0130
+#define REG_FWISR					0x0134
+#define REG_FTIMR					0x0138
+#define REG_PKTBUF_DBG_CTRL		0x0140
+#define REG_PKTBUF_DBG_DATA_L		0x0144
+#define REG_PKTBUF_DBG_DATA_H	0x0148
+
+#define REG_TC0_CTRL				0x0150
+#define REG_TC1_CTRL				0x0154
+#define REG_TC2_CTRL				0x0158
+#define REG_TC3_CTRL				0x015C
+#define REG_TC4_CTRL				0x0160
+#define REG_TCUNIT_BASE			0x0164
+#define REG_MBIST_START			0x0174
+#define REG_MBIST_DONE				0x0178
+#define REG_MBIST_FAIL				0x017C
+#define REG_C2HEVT_MSG_NORMAL	0x01A0
+#define REG_C2HEVT_CLEAR			0x01AF
+#define REG_C2HEVT_MSG_TEST		0x01B8
+#define REG_MCUTST_1				0x01c0
+#define REG_FMETHR					0x01C8
+#define REG_HMETFR					0x01CC
+#define REG_HMEBOX_0				0x01D0
+#define REG_HMEBOX_1				0x01D4
+#define REG_HMEBOX_2				0x01D8
+#define REG_HMEBOX_3				0x01DC
+
+#define REG_LLT_INIT				0x01E0
+#define REG_BB_ACCEESS_CTRL		0x01E8
+#define REG_BB_ACCESS_DATA		0x01EC
+
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RQPN					0x0200
+#define REG_FIFOPAGE				0x0204
+#define REG_TDECTRL					0x0208
+#define REG_TXDMA_OFFSET_CHK		0x020C
+#define REG_TXDMA_STATUS			0x0210
+#define REG_RQPN_NPQ				0x0214
+
+//-----------------------------------------------------
+//
+//	0x0280h ~ 0x02FFh	RXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RXDMA_AGG_PG_TH		0x0280
+#define REG_RXPKT_NUM				0x0284
+#define REG_RXDMA_STATUS			0x0288
+
+
+//-----------------------------------------------------
+//
+//	0x0300h ~ 0x03FFh	PCIe
+//
+//-----------------------------------------------------
+#define	REG_PCIE_CTRL_REG			0x0300
+#define	REG_INT_MIG				0x0304	// Interrupt Migration 
+#define	REG_BCNQ_DESA				0x0308	// TX Beacon Descriptor Address
+#define	REG_HQ_DESA				0x0310	// TX High Queue Descriptor Address
+#define	REG_MGQ_DESA				0x0318	// TX Manage Queue Descriptor Address
+#define	REG_VOQ_DESA				0x0320	// TX VO Queue Descriptor Address
+#define	REG_VIQ_DESA				0x0328	// TX VI Queue Descriptor Address
+#define	REG_BEQ_DESA				0x0330	// TX BE Queue Descriptor Address
+#define	REG_BKQ_DESA				0x0338	// TX BK Queue Descriptor Address
+#define	REG_RX_DESA				0x0340	// RX Queue	Descriptor Address
+#define	REG_DBI					0x0348	// Backdoor REG for Access Configuration
+//sherry added for DBI Read/Write  20091126
+#define	REG_DBI_WDATA				0x0348	// Backdoor REG for Access Configuration
+#define  	REG_DBI_RDATA				0x034C //Backdoor REG for Access Configuration
+#define	REG_DBI_CTRL				0x0350  //Backdoor REG for Access Configuration
+#define	REG_DBI_FLAG				0x0352 //Backdoor REG for Access Configuration#define	REG_MDIO					0x0354	// MDIO for Access PCIE PHY
+#define	REG_MDIO					0x0354	// MDIO for Access PCIE PHY
+#define	REG_DBG_SEL				0x0360	// Debug Selection Register
+#define	REG_PCIE_HRPWM			0x0361	//PCIe RPWM
+#define	REG_PCIE_HCPWM			0x0363	//PCIe CPWM
+#define	REG_UART_CTRL				0x0364	// UART	Control
+#define	REG_UART_TX_DESA			0x0370	// UART TX Descriptor Address
+#define	REG_UART_RX_DESA			0x0378	// UART Rx Descriptor Address
+
+
+// spec version 11
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+#define REG_VOQ_INFORMATION			0x0400
+#define REG_VIQ_INFORMATION			0x0404
+#define REG_BEQ_INFORMATION			0x0408
+#define REG_BKQ_INFORMATION			0x040C
+#define REG_MGQ_INFORMATION			0x0410
+#define REG_HGQ_INFORMATION			0x0414
+#define REG_BCNQ_INFORMATION			0x0418
+
+
+#define REG_CPU_MGQ_INFORMATION		0x041C
+#define REG_FWHW_TXQ_CTRL				0x0420
+#define REG_HWSEQ_CTRL					0x0423
+#define REG_TXPKTBUF_BCNQ_BDNY		0x0424
+#define REG_TXPKTBUF_MGQ_BDNY		0x0425
+#define REG_LIFETIME_EN				0x0426
+#define REG_MULTI_BCNQ_OFFSET			0x0427
+#define REG_SPEC_SIFS					0x0428
+#define REG_RL							0x042A
+#define REG_DARFRC						0x0430
+#define REG_RARFRC						0x0438
+#define REG_RRSR						0x0440
+#define REG_ARFR0						0x0444
+#define REG_ARFR1						0x0448
+#define REG_ARFR2						0x044C
+#define REG_ARFR3						0x0450
+#define REG_AGGLEN_LMT					0x0458
+#define REG_AMPDU_MIN_SPACE			0x045C
+#define REG_TXPKTBUF_WMAC_LBK_BF_HD	0x045D
+#define REG_FAST_EDCA_CTRL				0x0460
+#define REG_RD_RESP_PKT_TH				0x0463
+#define REG_INIRTS_RATE_SEL			0x0480
+#define REG_INIDATA_RATE_SEL			0x0484
+
+//#define REG_FW_TSF_SYNC_CNT				0x04A0
+#define REG_FW_RESET_TSF_CNT_1				0x05FC
+#define REG_FW_RESET_TSF_CNT_0				0x05FD
+#define REG_FW_BCN_DIS_CNT				0x05FE
+
+#define REG_POWER_STATUS				0x04A4
+#define REG_POWER_STAGE1				0x04B4
+#define REG_POWER_STAGE2				0x04B8
+#define REG_PKT_VO_VI_LIFE_TIME			0x04C0
+#define REG_PKT_BE_BK_LIFE_TIME			0x04C2
+#define REG_STBC_SETTING				0x04C4
+#define REG_PROT_MODE_CTRL			0x04C8
+#define REG_MAX_AGGR_NUM				0x04CA
+#define REG_RTS_MAX_AGGR_NUM			0x04CB
+#define REG_BAR_MODE_CTRL				0x04CC
+#define REG_RA_TRY_RATE_AGG_LMT		0x04CF
+#define REG_EARLY_MODE_CONTROL		0x04D0
+#define REG_NQOS_SEQ					0x04DC
+#define REG_QOS_SEQ					0x04DE
+#define REG_NEED_CPU_HANDLE			0x04E0
+#define REG_PKT_LOSE_RPT				0x04E1
+#define REG_PTCL_ERR_STATUS			0x04E2
+#define REG_DUMMY						0x04FC
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+#define REG_EDCA_VO_PARAM			0x0500
+#define REG_EDCA_VI_PARAM			0x0504
+#define REG_EDCA_BE_PARAM			0x0508
+#define REG_EDCA_BK_PARAM			0x050C
+#define REG_BCNTCFG					0x0510
+#define REG_PIFS						0x0512
+#define REG_RDG_PIFS				0x0513
+#define REG_SIFS_CTX				0x0514
+#define REG_SIFS_TRX				0x0516
+#define REG_TSFTR_SYN_OFFSET		0x0518
+#define REG_AGGR_BREAK_TIME		0x051A
+#define REG_SLOT					0x051B
+#define REG_TX_PTCL_CTRL			0x0520
+#define REG_TXPAUSE					0x0522
+#define REG_DIS_TXREQ_CLR			0x0523
+#define REG_RD_CTRL					0x0524
+#define REG_TBTT_PROHIBIT			0x0540
+#define REG_RD_NAV_NXT				0x0544
+#define REG_NAV_PROT_LEN			0x0546
+#define REG_BCN_CTRL				0x0550
+#define REG_BCN_CTRL_1				0x0551
+#define REG_MBID_NUM				0x0552
+#define REG_DUAL_TSF_RST			0x0553
+#define REG_BCN_INTERVAL			0x0554	// The same as REG_MBSSID_BCN_SPACE
+#define REG_MBSSID_BCN_SPACE		0x0554
+#define REG_DRVERLYINT				0x0558
+#define REG_BCNDMATIM				0x0559
+#define REG_ATIMWND				0x055A
+#define REG_USTIME_TSF				0x055C
+#define REG_BCN_MAX_ERR			0x055D
+#define REG_RXTSF_OFFSET_CCK		0x055E
+#define REG_RXTSF_OFFSET_OFDM		0x055F	
+#define REG_TSFTR					0x0560
+#define REG_TSFTR1					0x0568
+#define REG_INIT_TSFTR				0x0564
+#define REG_ATIMWND_1				0x0570
+#define REG_PSTIMER					0x0580
+#define REG_TIMER0					0x0584
+#define REG_TIMER1					0x0588
+#define REG_ACMHWCTRL				0x05C0
+#define REG_ACMRSTCTRL				0x05C1
+#define REG_ACMAVG					0x05C2
+#define REG_VO_ADMTIME				0x05C4
+#define REG_VI_ADMTIME				0x05C6
+#define REG_BE_ADMTIME				0x05C8
+#define REG_EDCA_RANDOM_GEN		0x05CC
+#define REG_SCH_TXCMD				0x05D0
+
+#define REG_DMC						0x05F0	//Dual MAC Co-Existence Register
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+#define REG_APSD_CTRL				0x0600
+#define REG_BWOPMODE				0x0603
+#define REG_TCR						0x0604
+#define REG_RCR						0x0608
+#define REG_RX_PKT_LIMIT			0x060C
+#define REG_RX_DLK_TIME			0x060D
+#define REG_RX_DRVINFO_SZ			0x060F
+
+#define REG_MACID					0x0610
+#define REG_BSSID					0x0618
+#define REG_MAR						0x0620
+#define REG_MBIDCAMCFG				0x0628
+
+#define REG_USTIME_EDCA			0x0638
+#define REG_MAC_SPEC_SIFS			0x063A
+#define REG_RESP_SIFS_CCK			0x063C
+#define REG_RESP_SIFS_OFDM			0x063E
+#define REG_ACKTO					0x0640
+#define REG_CTS2TO					0x0641
+#define REG_EIFS						0x0642
+
+
+//WMA, BA, CCX
+#define REG_NAV_CTRL				0x0650
+#define REG_BACAMCMD				0x0654
+#define REG_BACAMCONTENT			0x0658
+#define REG_LBDLY					0x0660
+#define REG_FWDLY					0x0661
+#define REG_RXERR_RPT				0x0664
+#define REG_WMAC_TRXPTCL_CTL		0x0668
+
+
+// Security
+#define REG_CAMCMD					0x0670
+#define REG_CAMWRITE				0x0674
+#define REG_CAMREAD				0x0678
+#define REG_CAMDBG					0x067C
+#define REG_SECCFG					0x0680
+
+// Power
+#define REG_WOW_CTRL				0x0690
+#define REG_PSSTATUS				0x0691
+#define REG_PS_RX_INFO				0x0692
+#define REG_LPNAV_CTRL				0x0694
+#define REG_WKFMCAM_CMD			0x0698
+#define REG_WKFMCAM_RWD			0x069C
+#define REG_RXFLTMAP0				0x06A0
+#define REG_RXFLTMAP1				0x06A2
+#define REG_RXFLTMAP2				0x06A4
+#define REG_BCN_PSR_RPT			0x06A8
+#define REG_CALB32K_CTRL			0x06AC
+#define REG_PKT_MON_CTRL			0x06B4
+#define REG_BT_COEX_TABLE			0x06C0
+#define REG_WMAC_RESP_TXINFO		0x06D8
+
+#define REG_MACID1					0x0700
+#define REG_BSSID1					0x0708
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+// for 92DU high_Queue low_Queue Normal_Queue select 
+#define REG_USB_High_NORMAL_Queue_Select_MAC0  0xFE44
+//#define REG_USB_LOW_Queue_Select_MAC0       0xFE45
+#define REG_USB_High_NORMAL_Queue_Select_MAC1  0xFE47
+//#define REG_USB_LOW_Queue_Select_MAC1       0xFE48
+
+// For test chip
+#define REG_TEST_USB_TXQS			0xFE48
+#define REG_TEST_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_TEST_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_TEST_SIE_OPTIONAL		0xFE64
+#define REG_TEST_SIE_CHIRP_K		0xFE65
+#define REG_TEST_SIE_PHY			0xFE66		// 0xFE66~0xFE6B
+#define REG_TEST_SIE_MAC_ADDR		0xFE70		// 0xFE70~0xFE75
+#define REG_TEST_SIE_STRING		0xFE80		// 0xFE80~0xFEB9
+
+
+// For normal chip
+#define REG_NORMAL_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_NORMAL_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_NORMAL_SIE_OPTIONAL	0xFE64
+#define REG_NORMAL_SIE_EP			0xFE65		// 0xFE65~0xFE67
+#define REG_NORMAL_SIE_PHY		0xFE68		// 0xFE68~0xFE6B
+#define REG_NORMAL_SIE_MAC_ADDR	0xFE70		// 0xFE70~0xFE75
+#define REG_NORMAL_SIE_STRING		0xFE80		// 0xFE80~0xFEDF
+
+
+//-----------------------------------------------------
+//
+//	Redifine 8192C register definition for compatibility
+//
+//-----------------------------------------------------
+
+// TODO: use these definition when using REG_xxx naming rule.
+// NOTE: DO NOT Remove these definition. Use later.
+
+#define	SYS_ISO_CTRL				REG_SYS_ISO_CTRL	// System Isolation Interface Control.
+#define	SYS_FUNC_EN				REG_SYS_FUNC_EN		// System Function Enable.
+#define	SYS_CLK						REG_SYS_CLKR
+#define	CR9346						REG_9346CR			// 93C46/93C56 Command Register.
+#define	EFUSE_CTRL					REG_EFUSE_CTRL		// E-Fuse Control.
+#define	EFUSE_TEST					REG_EFUSE_TEST		// E-Fuse Test.
+#define	MSR							(REG_CR + 2)		// Media Status register
+#define	ISR							REG_HISR
+#define	TSFR						REG_TSFTR			// Timing Sync Function Timer Register.
+
+#define	MACIDR0					REG_MACID			// MAC ID Register, Offset 0x0050-0x0053
+#define	MACIDR4					(REG_MACID + 4)		// MAC ID Register, Offset 0x0054-0x0055
+
+#define 	PBP							REG_PBP
+
+// Redifine MACID register, to compatible prior ICs.
+#define	IDR0						MACIDR0
+#define	IDR4						MACIDR4
+
+
+//
+// 9. Security Control Registers	(Offset: )
+//
+#define	RWCAM						REG_CAMCMD		//IN 8190 Data Sheet is called CAMcmd
+#define	WCAMI						REG_CAMWRITE	// Software write CAM input content
+#define	RCAMO						REG_CAMREAD		// Software read/write CAM config
+#define	CAMDBG						REG_CAMDBG
+#define	SECR						REG_SECCFG		//Security Configuration Register
+
+// Unused register
+#define	UnusedRegister				0x1BF
+#define	DCAM						UnusedRegister
+#define	PSR							UnusedRegister
+#define 	BBAddr						UnusedRegister
+#define	PhyDataR					UnusedRegister
+
+#define	InvalidBBRFValue			0x12345678
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T 			0x13
+#define	MAX_MSS_DENSITY_1T 			0x0A
+
+//----------------------------------------------------------------------------
+//       8192C Cmd9346CR bits					(Offset 0xA, 16bit)
+//----------------------------------------------------------------------------
+#define	CmdEEPROM_En				BIT5	 // EEPROM enable when set 1
+#define	CmdEERPOMSEL				BIT4 	// System EEPROM select, 0: boot from E-FUSE, 1: The EEPROM used is 9346
+#define	Cmd9346CR_9356SEL			BIT4
+#define	AutoLoadEEPROM			(CmdEEPROM_En|CmdEERPOMSEL)
+#define	AutoLoadEFUSE				CmdEEPROM_En
+
+//       8192C GPIO MUX Configuration Register (offset 0x40, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIOSEL_GPIO				0
+#define	GPIOSEL_ENBT				BIT5
+
+//----------------------------------------------------------------------------
+//       8192C GPIO PIN Control Register (offset 0x44, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIO_IN						REG_GPIO_PIN_CTRL		// GPIO pins input value
+#define	GPIO_OUT					(REG_GPIO_PIN_CTRL+1)	// GPIO pins output value
+#define	GPIO_IO_SEL				(REG_GPIO_PIN_CTRL+2)	// GPIO pins output enable when a bit is set to "1"; otherwise, input is configured.
+#define	GPIO_MOD					(REG_GPIO_PIN_CTRL+3)
+
+
+//----------------------------------------------------------------------------
+//       8192C (MSR) Media Status Register	(Offset 0x4C, 8 bits)  
+//----------------------------------------------------------------------------
+/*
+Network Type
+00: No link
+01: Link in ad hoc network
+10: Link in infrastructure network
+11: AP mode
+Default: 00b.
+*/
+#define	MSR_NOLINK					0x00
+#define	MSR_ADHOC					0x01
+#define	MSR_INFRA					0x02
+#define	MSR_AP						0x03
+
+//
+// 6. Adaptive Control Registers  (Offset: 0x0160 - 0x01CF)
+//
+//----------------------------------------------------------------------------
+//       8192C Response Rate Set Register	(offset 0x181, 24bits)
+//----------------------------------------------------------------------------
+#define	RRSR_RSC_OFFSET			21
+#define	RRSR_SHORT_OFFSET			23
+#define	RRSR_RSC_BW_40M			0x600000
+#define	RRSR_RSC_UPSUBCHNL		0x400000
+#define	RRSR_RSC_LOWSUBCHNL		0x200000
+#define	RRSR_SHORT					0x800000
+#define	RRSR_1M					BIT0
+#define	RRSR_2M					BIT1 
+#define	RRSR_5_5M					BIT2 
+#define	RRSR_11M					BIT3 
+#define	RRSR_6M					BIT4 
+#define	RRSR_9M					BIT5 
+#define	RRSR_12M					BIT6 
+#define	RRSR_18M					BIT7 
+#define	RRSR_24M					BIT8 
+#define	RRSR_36M					BIT9 
+#define	RRSR_48M					BIT10 
+#define	RRSR_54M					BIT11
+#define	RRSR_MCS0					BIT12
+#define	RRSR_MCS1					BIT13
+#define	RRSR_MCS2					BIT14
+#define	RRSR_MCS3					BIT15
+#define	RRSR_MCS4					BIT16
+#define	RRSR_MCS5					BIT17
+#define	RRSR_MCS6					BIT18
+#define	RRSR_MCS7					BIT19
+#define	BRSR_AckShortPmb			BIT23	
+// CCK ACK: use Short Preamble or not
+
+
+//----------------------------------------------------------------------------
+//       8192C Rate Definition
+//----------------------------------------------------------------------------
+//CCK
+#define	RATR_1M					0x00000001
+#define	RATR_2M					0x00000002
+#define	RATR_55M					0x00000004
+#define	RATR_11M					0x00000008
+//OFDM 		
+#define	RATR_6M					0x00000010
+#define	RATR_9M					0x00000020
+#define	RATR_12M					0x00000040
+#define	RATR_18M					0x00000080
+#define	RATR_24M					0x00000100
+#define	RATR_36M					0x00000200
+#define	RATR_48M					0x00000400
+#define	RATR_54M					0x00000800
+//MCS 1 Spatial Stream	
+#define	RATR_MCS0					0x00001000
+#define	RATR_MCS1					0x00002000
+#define	RATR_MCS2					0x00004000
+#define	RATR_MCS3					0x00008000
+#define	RATR_MCS4					0x00010000
+#define	RATR_MCS5					0x00020000
+#define	RATR_MCS6					0x00040000
+#define	RATR_MCS7					0x00080000
+//MCS 2 Spatial Stream
+#define	RATR_MCS8					0x00100000
+#define	RATR_MCS9					0x00200000
+#define	RATR_MCS10					0x00400000
+#define	RATR_MCS11					0x00800000
+#define	RATR_MCS12					0x01000000
+#define	RATR_MCS13					0x02000000
+#define	RATR_MCS14					0x04000000
+#define	RATR_MCS15					0x08000000
+
+//----------------------------------------------------------------------------
+//       8192C BW_OPMODE bits					(Offset 0x203, 8bit)
+//----------------------------------------------------------------------------
+#define	BW_OPMODE_20MHZ			BIT2
+#define	BW_OPMODE_5G				BIT1
+#define	BW_OPMODE_11J				BIT0
+
+
+//----------------------------------------------------------------------------
+//       8192C CAM Config Setting (offset 0x250, 1 byte)
+//----------------------------------------------------------------------------
+#define	CAM_VALID					BIT15
+#define	CAM_NOTVALID				0x0000
+#define	CAM_USEDK					BIT5
+
+#define	CAM_CONTENT_COUNT 		8
+
+#define	CAM_NONE					0x0
+#define	CAM_WEP40					0x01
+#define	CAM_TKIP					0x02
+#define	CAM_AES					0x04
+#define	CAM_WEP104				0x05
+#define	CAM_SMS4					0x6
+
+
+#define	TOTAL_CAM_ENTRY			32
+#define	HALF_CAM_ENTRY			16	
+       		
+#define	CAM_CONFIG_USEDK			_TRUE
+#define	CAM_CONFIG_NO_USEDK		_FALSE
+       		
+#define	CAM_WRITE					BIT16
+#define	CAM_READ					0x00000000
+#define	CAM_POLLINIG				BIT31
+
+#define	SCR_UseDK					0x01
+#define	SCR_TxSecEnable			0x02
+#define	SCR_RxSecEnable			0x04
+
+
+//
+// 12. Host Interrupt Status Registers	 (Offset: 0x0300 - 0x030F)
+//
+//----------------------------------------------------------------------------
+//       8190 IMR/ISR bits						(offset 0xfd,  8bits)
+//----------------------------------------------------------------------------
+#define	IMR8190_DISABLED			0x0
+// IMR DW0 Bit 0-31
+#define	IMR_BCNDMAINT6			BIT31		// Beacon DMA Interrupt 6
+#define	IMR_BCNDMAINT5			BIT30		// Beacon DMA Interrupt 5
+#define	IMR_BCNDMAINT4			BIT29		// Beacon DMA Interrupt 4
+#define	IMR_BCNDMAINT3			BIT28		// Beacon DMA Interrupt 3
+#define	IMR_BCNDMAINT2			BIT27		// Beacon DMA Interrupt 2
+#define	IMR_BCNDMAINT1			BIT26		// Beacon DMA Interrupt 1
+#define	IMR_BCNDOK8				BIT25		// Beacon Queue DMA OK Interrup 8
+#define	IMR_BCNDOK7				BIT24		// Beacon Queue DMA OK Interrup 7
+#define	IMR_BCNDOK6				BIT23		// Beacon Queue DMA OK Interrup 6
+#define	IMR_BCNDOK5				BIT22		// Beacon Queue DMA OK Interrup 5
+#define	IMR_BCNDOK4				BIT21		// Beacon Queue DMA OK Interrup 4
+#define	IMR_BCNDOK3				BIT20		// Beacon Queue DMA OK Interrup 3
+#define	IMR_BCNDOK2				BIT19		// Beacon Queue DMA OK Interrup 2
+#define	IMR_BCNDOK1				BIT18		// Beacon Queue DMA OK Interrup 1
+#define	IMR_TIMEOUT2				BIT17		// Timeout interrupt 2
+#define	IMR_TIMEOUT1				BIT16		// Timeout interrupt 1
+#define	IMR_TXFOVW				BIT15		// Transmit FIFO Overflow
+#define	IMR_PSTIMEOUT				BIT14		// Power save time out interrupt 
+#define	IMR_BcnInt					BIT13		// Beacon DMA Interrupt 0
+#define	IMR_RXFOVW				BIT12		// Receive FIFO Overflow
+#define	IMR_RDU					BIT11		// Receive Descriptor Unavailable
+#define	IMR_ATIMEND				BIT10		// For 92C,ATIM Window End Interrupt
+#define	IMR_BDOK					BIT9		// Beacon Queue DMA OK Interrup
+#define	IMR_HIGHDOK				BIT8		// High Queue DMA OK Interrupt
+#define	IMR_TBDOK					BIT7		// Transmit Beacon OK interrup
+#define	IMR_MGNTDOK				BIT6		// Management Queue DMA OK Interrupt
+#define	IMR_TBDER					BIT5		// For 92C,Transmit Beacon Error Interrupt
+#define	IMR_BKDOK					BIT4		// AC_BK DMA OK Interrupt
+#define	IMR_BEDOK					BIT3		// AC_BE DMA OK Interrupt
+#define	IMR_VIDOK					BIT2		// AC_VI DMA OK Interrupt
+#define	IMR_VODOK					BIT1		// AC_VO DMA Interrupt
+#define	IMR_ROK					BIT0		// Receive DMA OK Interrupt
+
+// 13. Host Interrupt Status Extension Register	 (Offset: 0x012C-012Eh)
+#define	IMR_TXERR					BIT11
+#define	IMR_RXERR					BIT10
+#define	IMR_C2HCMD				BIT9
+#define	IMR_CPWM					BIT8
+//RSVD [2-7]
+#define	IMR_OCPINT					BIT1
+#define	IMR_WLANOFF				BIT0
+
+
+
+//----------------------------------------------------------------------------
+// 8192D EFUSE
+//----------------------------------------------------------------------------
+#define	HWSET_MAX_SIZE				256
+
+//----------------------------------------------------------------------------
+//       8192C EEPROM/EFUSE share register definition.
+//----------------------------------------------------------------------------
+
+//
+// Default Value for EEPROM or EFUSE!!!
+//
+#define	EEPROM_Default_TSSI					0x0
+#define 	EEPROM_Default_TxPowerDiff				0x0
+#define 	EEPROM_Default_CrystalCap				0x0		//92D default 0x0
+#define 	EEPROM_Default_BoardType				0x02 // Default: 2X2, RTL8192CE(QFPN68)
+#define 	EEPROM_Default_TxPower				0x1010
+#define	EEPROM_Default_HT2T_TxPwr				0x10
+
+#define	EEPROM_Default_LegacyHTTxPowerDiff	0x4
+#define	EEPROM_Default_ThermalMeter			0x12
+
+#define	EEPROM_Default_AntTxPowerDiff			0x0
+//#define	EEPROM_Default_TxPwDiff_CrystalCap		0x5
+#define	EEPROM_Default_TxPowerLevel_2G		0x2C
+#define	EEPROM_Default_TxPowerLevel_5G		0x22
+
+#define	EEPROM_Default_HT40_2SDiff				0x0
+#define 	EEPROM_Default_HT20_Diff				2	// HT20<->40 default Tx Power Index Difference
+#define	EEPROM_Default_LegacyHTTxPowerDiff	0x4	//OFDM Tx Power index diff
+#define 	EEPROM_Default_HT40_PwrMaxOffset		0
+#define 	EEPROM_Default_HT20_PwrMaxOffset		0
+
+// For debug
+#define 	EEPROM_Default_PID						0x1234
+#define 	EEPROM_Default_VID						0x5678
+#define 	EEPROM_Default_CustomerID				0xAB
+#define 	EEPROM_Default_SubCustomerID			0xCD
+#define 	EEPROM_Default_Version					0
+
+#define	EEPROM_Default_externalPA_C9		0x00
+#define	EEPROM_Default_externalPA_CC		0xFF
+#define	EEPROM_Default_internalPA_SP3T_C9	0xAA
+#define	EEPROM_Default_internalPA_SP3T_CC	0xAF
+#define	EEPROM_Default_internalPA_SPDT_C9	0xAA
+#ifdef CONFIG_PCI_HCI
+#define	EEPROM_Default_internalPA_SPDT_CC	0xA0
+#else
+#define	EEPROM_Default_internalPA_SPDT_CC	0xFA
+#endif
+
+#define	EEPROM_CHANNEL_PLAN_FCC				0x0
+#define	EEPROM_CHANNEL_PLAN_IC				0x1
+#define	EEPROM_CHANNEL_PLAN_ETSI			0x2
+#define	EEPROM_CHANNEL_PLAN_SPAIN			0x3
+#define	EEPROM_CHANNEL_PLAN_FRANCE			0x4
+#define	EEPROM_CHANNEL_PLAN_MKK				0x5
+#define	EEPROM_CHANNEL_PLAN_MKK1			0x6
+#define	EEPROM_CHANNEL_PLAN_ISRAEL			0x7
+#define	EEPROM_CHANNEL_PLAN_TELEC			0x8
+#define	EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN	0x9
+#define	EEPROM_CHANNEL_PLAN_WORLD_WIDE_13	0xA
+#define	EEPROM_CHANNEL_PLAN_NCC				0xB
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK	0x80
+
+
+#define 	EEPROM_CID_DEFAULT					0x0
+#define 	EEPROM_CID_TOSHIBA					0x4
+#define	EEPROM_CID_CCX						0x10 // CCX test. By Bruce, 2009-02-25.
+#define	EEPROM_CID_QMI						0x0D
+#define 	EEPROM_CID_WHQL 						0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	RTL8192_EEPROM_ID						0x8129
+#define	EEPROM_WAPI_SUPPORT					0x78
+
+
+#ifdef CONFIG_PCI_HCI
+#define RT_IBSS_INT_MASKS				(IMR_BcnInt | IMR_TBDOK | IMR_TBDER)
+#define RT_AC_INT_MASKS				(IMR_VIDOK | IMR_VODOK | IMR_BEDOK|IMR_BKDOK)
+#define RT_BSS_INT_MASKS				(RT_IBSS_INT_MASKS)
+
+#define RTL8190_EEPROM_ID						0x8129	// 0-1
+#define EEPROM_HPON							0x02 // LDO settings.2-5
+#define EEPROM_CLK								0x06 // Clock settings.6-7
+#define EEPROM_MAC_FUNCTION					0x08 // SE Test mode.8
+
+#define EEPROM_VID								0x28 // SE Vendor ID.A-B
+#define EEPROM_DID								0x2A // SE Device ID. C-D
+#define EEPROM_SVID								0x2C // SE Vendor ID.E-F
+#define EEPROM_SMID							0x2E // SE PCI Subsystem ID. 10-11
+
+#define EEPROM_MAC_ADDR						0x16 // SEMAC Address. 12-17
+#define EEPROM_MAC_ADDR_MAC0_92D			0x55
+#define EEPROM_MAC_ADDR_MAC1_92D			0x5B
+//----------------------------------------------------------------
+// 2.4G band Tx power index setting
+#define EEPROM_CCK_TX_PWR_INX_2G				0x61
+#define EEPROM_HT40_1S_TX_PWR_INX_2G		0x67
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_2G	0x6D
+#define EEPROM_HT20_TX_PWR_INX_DIFF_2G		0x70
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_2G		0x73
+#define EEPROM_HT40_MAX_PWR_OFFSET_2G		0x76
+#define EEPROM_HT20_MAX_PWR_OFFSET_2G		0x79
+
+//5GL channel 32-64
+#define EEPROM_HT40_1S_TX_PWR_INX_5GL		0x7C
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GL	0x82
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GL		0x85
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GL		0x88
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GL		0x8B
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GL		0x8E
+
+//5GM channel 100-140
+#define EEPROM_HT40_1S_TX_PWR_INX_5GM		0x91
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GM	0x97
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GM		0x9A
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GM	0x9D
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GM		0xA0
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GM		0xA3
+
+//5GH channel 149-165
+#define EEPROM_HT40_1S_TX_PWR_INX_5GH		0xA6
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GH	0xAC
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GH		0xAF
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GH		0xB2
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GH		0xB5
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GH		0xB8
+
+#define EEPROM_CHANNEL_PLAN					0xBB // Map of supported channels.	
+#define EEPROM_IQK_DELTA						0xBC
+#define EEPROM_LCK_DELTA						0xBC
+#define EEPROM_XTAL_K							0xBD	//[7:5]
+#define EEPROM_TSSI_A_5G						0xBE
+#define EEPROM_TSSI_B_5G						0xBF
+#define EEPROM_TSSI_AB_5G						0xC0
+#define EEPROM_THERMAL_METER					0xC3	//[4:0]
+#define EEPROM_PATHDIV							0xC4
+#define EEPROM_RF_OPT1							0xC4
+#define EEPROM_RF_OPT2							0xC5
+#define EEPROM_RF_OPT3							0xC6
+#define EEPROM_RF_OPT4							0xC7
+#define EEPROM_RF_OPT5							0xC8
+#define EEPROM_RF_OPT6							0xC9
+#define EEPROM_VERSION							0xCA
+#define EEPROM_CUSTOMER_ID					0xCB
+#define EEPROM_RF_OPT7							0xCC
+
+#define EEPROM_WIDIPAIRING_ADDR				0xF0
+#define EEPROM_WIDIPAIRING_KEY				0xF6
+
+#define EEPROM_DEF_PART_NO					0x3FD  //Byte
+#define EEPROME_CHIP_VERSION_L				0x3FF
+#define EEPROME_CHIP_VERSION_H				0x3FE
+#endif 
+
+#ifdef CONFIG_USB_HCI
+#define RTL8190_EEPROM_ID						0x8129	// 0-1
+#define EEPROM_HPON							0x02 // LDO settings.2-5
+#define EEPROM_CLK								0x06 // Clock settings.6-7
+#define EEPROM_MAC_FUNCTION					0x08 // SE Test mode.8
+
+#define EEPROM_VID								0xC // SE Vendor ID.A-B
+#define EEPROM_PID								0xE // SE Device ID. C-D
+#define EEPROM_ENDPOINT_SETTING				0x10
+#ifdef CONFIG_WOWLAN
+#define EEPROM_Option_Setting				0x11
+#endif // CONFIG_WOWLAN
+#define EEPROM_CHIRP_K							0x12	// Changed
+#define EEPROM_USB_PHY							0x13	// Changed
+#define EEPROM_NORMAL_BoardType				EEPROM_RF_OPT1	//[7:5]
+#define EEPROM_MAC_ADDR						0x16 // SEMAC Address. 12-17
+#define EEPROM_STRING							0x1F
+#define EEPROM_SUBCUSTOMER_ID					0x59
+
+#define EEPROM_MAC_ADDR_MAC0_92D			0x19
+#define EEPROM_MAC_ADDR_MAC1_92D			0x5B
+//----------------------------------------------------------------
+// 2.4G band Tx power index setting
+#define EEPROM_CCK_TX_PWR_INX_2G				0x61
+#define EEPROM_HT40_1S_TX_PWR_INX_2G		0x67
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_2G	0x6D
+#define EEPROM_HT20_TX_PWR_INX_DIFF_2G		0x70
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_2G		0x73
+#define EEPROM_HT40_MAX_PWR_OFFSET_2G		0x76
+#define EEPROM_HT20_MAX_PWR_OFFSET_2G		0x79
+
+//5GL channel 32-64
+#define EEPROM_HT40_1S_TX_PWR_INX_5GL		0x7C
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GL	0x82
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GL		0x85
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GL		0x88
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GL		0x8B
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GL		0x8E
+
+//5GM channel 100-140
+#define EEPROM_HT40_1S_TX_PWR_INX_5GM		0x91
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GM	0x97
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GM		0x9A
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GM	0x9D
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GM		0xA0
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GM		0xA3
+
+//5GH channel 149-165
+#define EEPROM_HT40_1S_TX_PWR_INX_5GH		0xA6
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GH	0xAC
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GH		0xAF
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GH		0xB2
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GH		0xB5
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GH		0xB8
+
+#define EEPROM_CHANNEL_PLAN					0xBB // Map of supported channels.	
+#define EEPROM_TEST_CHANNEL_PLAN				0xBB
+#define EEPROM_IQK_DELTA						0xBC
+#define EEPROM_LCK_DELTA						0xBC
+#define EEPROM_XTAL_K							0xBD	//[7:5]
+#define EEPROM_TSSI_A_5G						0xBE
+#define EEPROM_TSSI_B_5G						0xBF
+#define EEPROM_TSSI_AB_5G						0xC0
+#define EEPROM_THERMAL_METER					0xC3	//[4:0]
+#define EEPROM_RF_OPT1							0xC4
+#define EEPROM_RF_OPT2							0xC5
+#define EEPROM_RF_OPT3							0xC6
+#define EEPROM_RF_OPT4							0xC7
+#define EEPROM_RF_OPT5							0xC8
+#define EEPROM_RF_OPT6							0xC9
+#define EEPROM_VERSION							0xCA
+#define EEPROM_CUSTOMER_ID					0xCB
+#define EEPROM_RF_OPT7							0xCC
+
+#define EEPROM_DEF_PART_NO					0x3FD  //Byte
+#define EEPROME_CHIP_VERSION_L				0x3FF
+#define EEPROME_CHIP_VERSION_H				0x3FE
+
+//-------------------------------------------------------------
+//	EEPROM content definitions
+//-------------------------------------------------------------
+#define OS_LINK_SPEED_NORMAL_MASK			BIT3 | BIT2
+#define OS_LINK_SPEED_TEST_MASK				BIT3 | BIT4
+
+#define BOARD_TYPE_NORMAL_MASK				0xE0
+#define BOARD_TYPE_TEST_MASK					0xF
+
+#define BT_COEXISTENCE_TEST					BIT4
+#define BT_COEXISTENCE_NORMAL					BIT5
+
+#define BT_CO_SHIFT_TEST						4
+#define BT_CO_SHIFT_NORMAL					5
+
+#define EP_NUMBER_MASK_TEST					0x30	//bit 4:5 0Eh
+#define EP_NUMBER_SHIFT_TEST					4
+
+#define USB_PHY_PARA_SIZE_TEST				6
+#define USB_PHY_PARA_SIZE_NORMAL				4
+
+//-------------------------------------------------------------
+//	EEPROM default value definitions
+//-------------------------------------------------------------
+// Use 0xABCD instead of 0x8192 for debug
+#define	EEPROM_DEF_ID_0						0xCD	// Byte 0x00
+#define	EEPROM_DEF_ID_1						0xAB	// Byte 0x01
+
+#define EEPROM_DEF_RTK_RSV_A3					0x74	// Byte 0x03
+#define EEPROM_DEF_RTK_RSV_A4					0x6D	// Byte 0x04
+#define EEPROM_DEF_RTK_RSV_A8					0xFF	// Byte 0x08
+
+#define EEPROM_DEF_VID_0						0x0A	// Byte 0x0A
+#define EEPROM_DEF_VID_1						0x0B
+
+#define EEPROM_DEF_PID_0						0x92	// Byte 0x0C
+#define EEPROM_DEF_PID_1						0x81
+
+
+#define EEPROM_TEST_DEF_USB_OPT				0x80	// Byte 0x0E
+#define EEPROM_NORMAL_DEF_USB_OPT			0x00	// Byte 0x0E
+
+#define EEPROM_DEF_CHIRPK						0x15	// Byte 0x0F
+
+#define EEPROM_DEF_USB_PHY_0					0x85	// Byte 0x10
+#define EEPROM_DEF_USB_PHY_1					0x62	// Byte 0x11
+#define EEPROM_DEF_USB_PHY_2					0x9E	// Byte 0x12
+#define EEPROM_DEF_USB_PHY_3					0x06	// Byte 0x13
+
+#define EEPROM_DEF_TSSI_A						0x09	// Byte 0x78
+#define EEPROM_DEF_TSSI_B						0x09	// Byte 0x79
+
+
+#define EEPROM_DEF_THERMAL_METER				0x12	// Byte 0x7A
+
+
+#define	EEPROM_USB_SN							BIT(0)
+#define	EEPROM_USB_REMOTE_WAKEUP			BIT(1)
+#define	EEPROM_USB_DEVICE_PWR				BIT(2)
+#define	EEPROM_EP_NUMBER						(BIT(3)|BIT(4))
+
+#if 0
+#define	EEPROM_CHANNEL_PLAN_FCC					0x0
+#define	EEPROM_CHANNEL_PLAN_IC					0x1
+#define	EEPROM_CHANNEL_PLAN_ETSI				0x2
+#define	EEPROM_CHANNEL_PLAN_SPAIN				0x3
+#define	EEPROM_CHANNEL_PLAN_FRANCE				0x4
+#define	EEPROM_CHANNEL_PLAN_MKK					0x5
+#define	EEPROM_CHANNEL_PLAN_MKK1				0x6
+#define	EEPROM_CHANNEL_PLAN_ISRAEL				0x7
+#define	EEPROM_CHANNEL_PLAN_TELEC				0x8
+#define	EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN		0x9
+#define	EEPROM_CHANNEL_PLAN_WORLD_WIDE_13		0xA
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK			0x80
+
+#define	EEPROM_CID_DEFAULT						0x0
+
+#define	EEPROM_CID_WHQL 						0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	EEPROM_CID_CCX							0x10 // CCX test. By Bruce, 2009-02-25.
+
+#endif
+#endif
+
+
+/*===================================================================
+=====================================================================
+Here the register defines are for 92C. When the define is as same with 92C, 
+we will use the 92C's define for the consistency
+So the following defines for 92C is not entire!!!!!!
+=====================================================================
+=====================================================================*/
+/*
+Based on Datasheet V33---090401
+Register Summary
+Current IOREG MAP
+0x0000h ~ 0x00FFh   System Configuration (256 Bytes)
+0x0100h ~ 0x01FFh   MACTOP General Configuration (256 Bytes)
+0x0200h ~ 0x027Fh   TXDMA Configuration (128 Bytes)
+0x0280h ~ 0x02FFh   RXDMA Configuration (128 Bytes)
+0x0300h ~ 0x03FFh   PCIE EMAC Reserved Region (256 Bytes)
+0x0400h ~ 0x04FFh   Protocol Configuration (256 Bytes)
+0x0500h ~ 0x05FFh   EDCA Configuration (256 Bytes)
+0x0600h ~ 0x07FFh   WMAC Configuration (512 Bytes)
+0x2000h ~ 0x3FFFh   8051 FW Download Region (8196 Bytes)
+*/
+
+//----------------------------------------------------------------------------
+//       8192C (RCR) Receive Configuration Register	(Offset 0x608, 32 bits)
+//----------------------------------------------------------------------------
+#define	RCR_APPFCS					BIT31		//WMAC append FCS after pauload
+#define	RCR_APP_MIC				BIT30		//
+#define	RCR_APP_ICV				BIT29       //
+#define	RCR_APP_PHYST_RXFF		BIT28       //
+#define	RCR_APP_BA_SSN			BIT27		//Accept BA SSN
+#define	RCR_ENMBID					BIT24		//Enable Multiple BssId.
+#define	RCR_LSIGEN					BIT23
+#define	RCR_MFBEN					BIT22
+#define	RCR_HTC_LOC_CTRL			BIT14       //MFC<--HTC=1 MFC-->HTC=0
+#define	RCR_AMF					BIT13		//Accept management type frame
+#define	RCR_ACF					BIT12		//Accept control type frame
+#define	RCR_ADF					BIT11		//Accept data type frame
+#define	RCR_AICV					BIT9		//Accept ICV error packet
+#define	RCR_ACRC32					BIT8		//Accept CRC32 error packet 
+#define	RCR_CBSSID_BCN			BIT7		//Accept BSSID match packet (Rx beacon, probe rsp)
+#define	RCR_CBSSID_DATA			BIT6		//Accept BSSID match packet (Data)
+#define	RCR_CBSSID					RCR_CBSSID_DATA		//Accept BSSID match packet
+#define	RCR_APWRMGT				BIT5		//Accept power management packet
+#define	RCR_ADD3					BIT4		//Accept address 3 match packet
+#define	RCR_AB						BIT3		//Accept broadcast packet 
+#define	RCR_AM						BIT2		//Accept multicast packet 
+#define	RCR_APM					BIT1		//Accept physical match packet
+#define	RCR_AAP					BIT0		//Accept all unicast packet 
+#define	RCR_MXDMA_OFFSET			8
+#define	RCR_FIFO_OFFSET			13
+
+
+
+//============================================================================
+//       8192c USB specific Regsiter Offset and Content definition, 
+//       2009.08.18, added by vivi. for merge 92c and 92C into one driver
+//============================================================================
+//#define APS_FSMCO				0x0004  same with 92Ce
+#define RSV_CTRL					0x001C
+#define RD_CTRL					0x0524
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+#define REG_USB_VID					0xFE60
+#define REG_USB_PID					0xFE62
+#define REG_USB_OPTIONAL			0xFE64
+#define REG_USB_CHIRP_K			0xFE65
+#define REG_USB_PHY					0xFE66
+#define REG_USB_MAC_ADDR			0xFE70
+
+#define REG_USB_HRPWM				0xFE58
+#define REG_USB_HCPWM				0xFE57
+
+#define InvalidBBRFValue			0x12345678
+
+//============================================================================
+//       8192C Regsiter Bit and Content definition 
+//============================================================================
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+
+//2 SPS0_CTRL
+#define SW18_FPWM					BIT(3)
+
+
+//2 SYS_ISO_CTRL
+#define ISO_MD2PP					BIT(0)
+#define ISO_UA2USB					BIT(1)
+#define ISO_UD2CORE					BIT(2)
+#define ISO_PA2PCIE					BIT(3)
+#define ISO_PD2CORE					BIT(4)
+#define ISO_IP2MAC					BIT(5)
+#define ISO_DIOP						BIT(6)
+#define ISO_DIOE						BIT(7)
+#define ISO_EB2CORE					BIT(8)
+#define ISO_DIOR						BIT(9)
+
+#define PWC_EV25V					BIT(14)
+#define PWC_EV12V					BIT(15)
+
+
+//2 SYS_FUNC_EN
+#define FEN_BBRSTB					BIT(0)
+#define FEN_BB_GLB_RSTn			BIT(1)
+#define FEN_USBA					BIT(2)
+#define FEN_UPLL					BIT(3)
+#define FEN_USBD					BIT(4)
+#define FEN_DIO_PCIE				BIT(5)
+#define FEN_PCIEA					BIT(6)
+#define FEN_PPLL						BIT(7)
+#define FEN_PCIED					BIT(8)
+#define FEN_DIOE					BIT(9)
+#define FEN_CPUEN					BIT(10)
+#define FEN_DCORE					BIT(11)
+#define FEN_ELDR					BIT(12)
+#define FEN_DIO_RF					BIT(13)
+#define FEN_HWPDN					BIT(14)
+#define FEN_MREGEN					BIT(15)
+
+//2 APS_FSMCO
+#define PFM_LDALL					BIT(0)
+#define PFM_ALDN					BIT(1)
+#define PFM_LDKP					BIT(2)
+#define PFM_WOWL					BIT(3)
+#define EnPDN						BIT(4)
+#define PDN_PL						BIT(5)
+#define APFM_ONMAC					BIT(8)
+#define APFM_OFF					BIT(9)
+#define APFM_RSM					BIT(10)
+#define AFSM_HSUS					BIT(11)
+#define AFSM_PCIE					BIT(12)
+#define APDM_MAC					BIT(13)
+#define APDM_HOST					BIT(14)
+#define APDM_HPDN					BIT(15)
+#define RDY_MACON					BIT(16)
+#define SUS_HOST					BIT(17)
+#define ROP_ALD						BIT(20)
+#define ROP_PWR						BIT(21)
+#define ROP_SPS						BIT(22)
+#define SOP_MRST					BIT(25)
+#define SOP_FUSE					BIT(26)
+#define SOP_ABG						BIT(27)
+#define SOP_AMB						BIT(28)
+#define SOP_RCK						BIT(29)
+#define SOP_A8M						BIT(30)
+#define XOP_BTCK					BIT(31)
+
+//2 SYS_CLKR
+#define ANAD16V_EN					BIT(0)
+#define ANA8M						BIT(1)
+#define MACSLP						BIT(4)
+#define LOADER_CLK_EN				BIT(5)
+#define _80M_SSC_DIS				BIT(7)
+#define _80M_SSC_EN_HO				BIT(8)
+#define PHY_SSC_RSTB				BIT(9)
+#define SEC_CLK_EN					BIT(10)
+#define MAC_CLK_EN					BIT(11)
+#define SYS_CLK_EN					BIT(12)
+#define RING_CLK_EN					BIT(13)
+
+
+//2 9346CR
+
+#define BOOT_FROM_EEPROM			BIT(4)
+#define EEPROM_EN					BIT(5)
+
+
+//2 AFE_MISC
+#define AFE_BGEN					BIT(0)
+#define AFE_MBEN					BIT(1)
+#define MAC_ID_EN					BIT(7)
+
+
+//2 SPS0_CTRL
+
+
+//2 SPS_OCP_CFG
+
+
+//2 RSV_CTRL
+#define WLOCK_ALL					BIT(0)
+#define WLOCK_00					BIT(1)
+#define WLOCK_04					BIT(2)
+#define WLOCK_08					BIT(3)
+#define WLOCK_40					BIT(4)
+#define R_DIS_PRST_0				BIT(5)
+#define R_DIS_PRST_1				BIT(6)
+#define LOCK_ALL_EN					BIT(7)
+
+//2 RF_CTRL
+#define RF_EN						BIT(0)
+#define RF_RSTB						BIT(1)
+#define RF_SDMRSTB					BIT(2)
+
+
+
+//2 LDOA15_CTRL
+#define LDA15_EN					BIT(0)
+#define LDA15_STBY					BIT(1)
+#define LDA15_OBUF					BIT(2)
+#define LDA15_REG_VOS				BIT(3)
+#define _LDA15_VOADJ(x)				(((x) & 0x7) << 4)
+
+
+
+//2 LDOV12D_CTRL
+#define LDV12_EN					BIT(0)
+#define LDV12_SDBY					BIT(1)
+#define LPLDO_HSM					BIT(2)
+#define LPLDO_LSM_DIS				BIT(3)
+#define _LDV12_VADJ(x)				(((x) & 0xF) << 4)
+
+
+//2 AFE_XTAL_CTRL
+#define XTAL_EN						BIT(0)
+#define XTAL_BSEL					BIT(1)
+#define _XTAL_BOSC(x)				(((x) & 0x3) << 2)
+#define _XTAL_CADJ(x)				(((x) & 0xF) << 4)
+#define XTAL_GATE_USB				BIT(8)
+#define _XTAL_USB_DRV(x)			(((x) & 0x3) << 9)
+#define XTAL_GATE_AFE				BIT(11)
+#define _XTAL_AFE_DRV(x)			(((x) & 0x3) << 12)
+#define XTAL_RF_GATE				BIT(14)
+#define _XTAL_RF_DRV(x)				(((x) & 0x3) << 15)
+#define XTAL_GATE_DIG				BIT(17)
+#define _XTAL_DIG_DRV(x)			(((x) & 0x3) << 18)
+#define XTAL_BT_GATE				BIT(20)
+#define _XTAL_BT_DRV(x)				(((x) & 0x3) << 21)
+#define _XTAL_GPIO(x)				(((x) & 0x7) << 23)
+
+
+#define CKDLY_AFE					BIT(26)
+#define CKDLY_USB					BIT(27)
+#define CKDLY_DIG					BIT(28)
+#define CKDLY_BT					BIT(29)
+
+
+//2 AFE_PLL_CTRL
+#define APLL_EN						BIT(0)
+#define APLL_320_EN					BIT(1)
+#define APLL_FREF_SEL				BIT(2)
+#define APLL_EDGE_SEL				BIT(3)
+#define APLL_WDOGB					BIT(4)
+#define APLL_LPFEN					BIT(5)
+
+#define APLL_REF_CLK_13MHZ			0x1
+#define APLL_REF_CLK_19_2MHZ		0x2
+#define APLL_REF_CLK_20MHZ			0x3
+#define APLL_REF_CLK_25MHZ			0x4
+#define APLL_REF_CLK_26MHZ			0x5
+#define APLL_REF_CLK_38_4MHZ		0x6
+#define APLL_REF_CLK_40MHZ			0x7
+
+#define APLL_320EN					BIT(14)
+#define APLL_80EN					BIT(15)
+#define APLL_1MEN					BIT(24)
+
+
+//2 EFUSE_CTRL
+#define ALD_EN						BIT(18)
+#define EF_PD						BIT(19)
+#define EF_FLAG						BIT(31)
+
+//2 EFUSE_TEST 
+#define EF_TRPT						BIT(7)
+#define LDOE25_EN					BIT(31)
+
+//2 PWR_DATA 
+
+//2 CAL_TIMER
+
+//2 ACLK_MON
+#define RSM_EN						BIT(0)
+#define Timer_EN						BIT(4)
+
+
+//2 GPIO_MUXCFG
+#define TRSW0EN						BIT(2)
+#define TRSW1EN						BIT(3)
+#define EROM_EN						BIT(4)
+#define EnBT							BIT(5)
+#define EnUart						BIT(8)
+#define Uart_910						BIT(9)
+#define EnPMAC						BIT(10)
+#define SIC_SWRST					BIT(11)
+#define EnSIC						BIT(12)
+#define SIC_23						BIT(13)
+#define EnHDP						BIT(14)
+#define SIC_LBK						BIT(15)
+
+//2 GPIO_PIN_CTRL
+
+
+
+//2 GPIO_INTM
+
+//2 LEDCFG
+#define LED0PL 					BIT(4)  
+#define LED1PL 					BIT(12)
+#define LED0DIS					BIT(7)
+
+#define  SECCAM_CLR				BIT(30)
+
+//2 FSIMR
+
+//2 FSISR
+
+
+//2 8051FWDL
+//2 MCUFWDL
+#define MCUFWDL_EN					BIT(0)
+#define MCUFWDL_RDY				BIT(1)
+#define FWDL_ChkSum_rpt			BIT(2)
+#define MACINI_RDY					BIT(3)
+#define BBINI_RDY					BIT(4)
+#define RFINI_RDY					BIT(5)
+#define WINTINI_RDY					BIT(6)
+#define MAC1_WINTINI_RDY			BIT(11)// 0X81 BIT3
+#define CPRST						BIT(23)
+
+
+
+
+//2 REG_SYS_CFG
+#define XCLK_VLD						BIT(0)
+#define ACLK_VLD					BIT(1)
+#define UCLK_VLD					BIT(2)
+#define PCLK_VLD						BIT(3)
+#define PCIRSTB						BIT(4)
+#define V15_VLD						BIT(5)
+#define TRP_B15V_EN					BIT(7)
+#define SIC_IDLE						BIT(8)
+#define BD_MAC2						BIT(9)
+#define BD_MAC1						BIT(10)
+#define IC_MACPHY_MODE				BIT(11)
+#define PAD_HWPD_IDN				BIT(22)
+#define TRP_VAUX_EN					BIT(23)
+#define TRP_BT_EN					BIT(24)
+#define BD_PKG_SEL					BIT(25)
+#define BD_HCI_SEL					BIT(26)
+#define TYPE_ID						BIT(27)
+
+#define CHIP_VER_RTL_MASK			0xF000	//Bit 12 ~ 15
+#define CHIP_VER_RTL_SHIFT			12
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+
+
+//2 Function Enable Registers
+//2 CR
+
+#define REG_LBMODE					(REG_CR + 3)
+
+
+#define HCI_TXDMA_EN				BIT(0)
+#define HCI_RXDMA_EN				BIT(1)
+#define TXDMA_EN					BIT(2)
+#define RXDMA_EN					BIT(3)
+#define PROTOCOL_EN					BIT(4)
+#define SCHEDULE_EN					BIT(5)
+#define MACTXEN						BIT(6)
+#define MACRXEN						BIT(7)
+#define ENSWBCN						BIT(8)
+#define ENSEC						BIT(9)
+
+// Network type
+#define _NETTYPE(x)					(((x) & 0x3) << 16)
+#define MASK_NETTYPE				0x30000
+#define NT_NO_LINK					0x0
+#define NT_LINK_AD_HOC				0x1
+#define NT_LINK_AP					0x2
+#define NT_AS_AP					0x3
+
+#define _LBMODE(x)					(((x) & 0xF) << 24)
+#define MASK_LBMODE				0xF000000
+#define LOOPBACK_NORMAL			0x0
+#define LOOPBACK_IMMEDIATELY		0xB
+#define LOOPBACK_MAC_DELAY		0x3
+#define LOOPBACK_PHY				0x1
+#define LOOPBACK_DMA				0x7
+
+
+//2 PBP - Page Size Register
+#define GET_RX_PAGE_SIZE(value)		((value) & 0xF)
+#define GET_TX_PAGE_SIZE(value)		(((value) & 0xF0) >> 4)
+#define _PSRX_MASK					0xF
+#define _PSTX_MASK					0xF0
+#define _PSRX(x)						(x)
+#define _PSTX(x)						((x) << 4)
+
+#define PBP_64						0x0
+#define PBP_128						0x1
+#define PBP_256						0x2
+#define PBP_512						0x3
+#define PBP_1024					0x4
+
+
+//2 TX/RXDMA
+#define RXDMA_ARBBW_EN			BIT(0)
+#define RXSHFT_EN					BIT(1)
+#define RXDMA_AGG_EN				BIT(2)
+#define QS_VO_QUEUE				BIT(8)
+#define QS_VI_QUEUE					BIT(9)
+#define QS_BE_QUEUE				BIT(10)
+#define QS_BK_QUEUE				BIT(11)
+#define QS_MANAGER_QUEUE			BIT(12)
+#define QS_HIGH_QUEUE				BIT(13)
+
+#define HQSEL_VOQ					BIT(0)
+#define HQSEL_VIQ					BIT(1)
+#define HQSEL_BEQ					BIT(2)
+#define HQSEL_BKQ					BIT(3)
+#define HQSEL_MGTQ					BIT(4)
+#define HQSEL_HIQ					BIT(5)
+
+// For normal driver, 0x10C
+#define _TXDMA_HIQ_MAP(x) 	 		(((x)&0x3) << 14)
+#define _TXDMA_MGQ_MAP(x) 	 		(((x)&0x3) << 12)
+#define _TXDMA_BKQ_MAP(x) 	 		(((x)&0x3) << 10)		
+#define _TXDMA_BEQ_MAP(x) 	 		(((x)&0x3) << 8 )
+#define _TXDMA_VIQ_MAP(x) 	 		(((x)&0x3) << 6 )
+#define _TXDMA_VOQ_MAP(x) 	 		(((x)&0x3) << 4 )
+
+#define QUEUE_LOW					1
+#define QUEUE_NORMAL				2
+#define QUEUE_HIGH					3
+
+
+
+//2 TRXFF_BNDY
+
+
+//2 LLT_INIT
+#define _LLT_NO_ACTIVE				0x0
+#define _LLT_WRITE_ACCESS			0x1
+#define _LLT_READ_ACCESS			0x2
+
+#define _LLT_INIT_DATA(x)			((x) & 0xFF)
+#define _LLT_INIT_ADDR(x)			(((x) & 0xFF) << 8)
+#define _LLT_OP(x)					(((x) & 0x3) << 30)
+#define _LLT_OP_VALUE(x)			(((x) >> 30) & 0x3)
+
+
+//2 BB_ACCESS_CTRL
+#define BB_WRITE_READ_MASK		(BIT(31) | BIT(30))
+#define BB_WRITE_EN					BIT(30)
+#define BB_READ_EN					BIT(31)
+//#define BB_ADDR_MASK				0xFFF
+//#define _BB_ADDR(x)					((x) & BB_ADDR_MASK)
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+//2 RQPN
+#define _HPQ(x)						((x) & 0xFF)
+#define _LPQ(x)						(((x) & 0xFF) << 8)
+#define _PUBQ(x)						(((x) & 0xFF) << 16)
+#define _NPQ(x)						((x) & 0xFF)			// NOTE: in RQPN_NPQ register
+
+
+#define HPQ_PUBLIC_DIS				BIT(24)
+#define LPQ_PUBLIC_DIS				BIT(25)
+#define LD_RQPN						BIT(31)
+
+
+//2 TDECTRL
+#define BCN_VALID					BIT(16)
+#define BCN_HEAD(x)					(((x) & 0xFF) << 8)
+#define	BCN_HEAD_MASK				0xFF00
+
+//2 TDECTL
+#define BLK_DESC_NUM_SHIFT			4
+#define BLK_DESC_NUM_MASK			0xF
+
+
+//2 TXDMA_OFFSET_CHK
+#define DROP_DATA_EN				BIT(9)
+
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+//2 FWHW_TXQ_CTRL
+#define EN_AMPDU_RTY_NEW			BIT(7)
+
+//2 INIRTSMCS_SEL
+#define _INIRTSMCS_SEL(x)			((x) & 0x3F)
+
+
+//2 SPEC SIFS
+#define _SPEC_SIFS_CCK(x)			((x) & 0xFF)
+#define _SPEC_SIFS_OFDM(x)			(((x) & 0xFF) << 8)
+
+
+//2 RRSR
+
+#define RATE_REG_BITMAP_ALL			0xFFFFF
+
+#define _RRSC_BITMAP(x)					((x) & 0xFFFFF)
+
+#define _RRSR_RSC(x)						(((x) & 0x3) << 21)
+#define RRSR_RSC_RESERVED				0x0
+#define RRSR_RSC_UPPER_SUBCHANNEL	0x1
+#define RRSR_RSC_LOWER_SUBCHANNEL	0x2
+#define RRSR_RSC_DUPLICATE_MODE		0x3
+
+
+//2 ARFR
+#define USE_SHORT_G1				BIT(20)
+
+//2 AGGLEN_LMT_L
+#define _AGGLMT_MCS0(x)				((x) & 0xF)
+#define _AGGLMT_MCS1(x)				(((x) & 0xF) << 4)
+#define _AGGLMT_MCS2(x)				(((x) & 0xF) << 8)
+#define _AGGLMT_MCS3(x)				(((x) & 0xF) << 12)
+#define _AGGLMT_MCS4(x)				(((x) & 0xF) << 16)
+#define _AGGLMT_MCS5(x)				(((x) & 0xF) << 20)
+#define _AGGLMT_MCS6(x)				(((x) & 0xF) << 24)
+#define _AGGLMT_MCS7(x)				(((x) & 0xF) << 28)
+
+
+//2 RL
+#define	RETRY_LIMIT_SHORT_SHIFT		8
+#define	RETRY_LIMIT_LONG_SHIFT		0
+
+
+//2 DARFRC
+#define _DARF_RC1(x)				((x) & 0x1F)
+#define _DARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (DARFRC + 4)
+#define _DARF_RC5(x)				((x) & 0x1F)
+#define _DARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+//2 RARFRC
+#define _RARF_RC1(x)				((x) & 0x1F)
+#define _RARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (RARFRC + 4)
+#define _RARF_RC5(x)				((x) & 0x1F)
+#define _RARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+
+
+
+//2 EDCA setting
+#define AC_PARAM_TXOP_LIMIT_OFFSET	16
+#define AC_PARAM_ECW_MAX_OFFSET		12
+#define AC_PARAM_ECW_MIN_OFFSET		8
+#define AC_PARAM_AIFS_OFFSET			0
+
+
+//2 EDCA_VO_PARAM
+#define _AIFS(x)						(x)
+#define _ECW_MAX_MIN(x)			((x) << 8)
+#define _TXOP_LIMIT(x)				((x) << 16)
+
+
+#define _BCNIFS(x)					((x) & 0xFF)
+#define _BCNECW(x)					(((x) & 0xF))<< 8)
+
+
+#define _LRL(x)						((x) & 0x3F)
+#define _SRL(x)						(((x) & 0x3F) << 8)
+
+
+//2 SIFS_CCK
+#define _SIFS_CCK_CTX(x)			((x) & 0xFF)
+#define _SIFS_CCK_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 SIFS_OFDM
+#define _SIFS_OFDM_CTX(x)			((x) & 0xFF)
+#define _SIFS_OFDM_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 TBTT PROHIBIT
+#define _TBTT_PROHIBIT_HOLD(x)		(((x) & 0xFF) << 8)
+
+
+//2 REG_RD_CTRL
+#define DIS_EDCA_CNT_DWN			BIT(11)
+
+
+//2 BCN_CTRL
+#define EN_MBSSID						BIT(1)
+#define EN_TXBCN_RPT					BIT(2)
+#define EN_BCN_FUNCTION				BIT(3)
+// The same function but different bit field.
+#define DIS_TSF_UDT0_NORMAL_CHIP		BIT(4)
+#define DIS_TSF_UDT0_TEST_CHIP		BIT(5)
+
+//2 ACMHWCTRL
+#define	AcmHw_HwEn					BIT(0)
+#define	AcmHw_BeqEn					BIT(1)
+#define	AcmHw_ViqEn					BIT(2)
+#define	AcmHw_VoqEn					BIT(3)
+#define	AcmHw_BeqStatus				BIT(4)
+#define	AcmHw_ViqStatus				BIT(5)
+#define	AcmHw_VoqStatus				BIT(6)
+
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+
+//2 APSD_CTRL
+#define APSDOFF						BIT(6)
+#define APSDOFF_STATUS				BIT(7)
+
+
+//2 BWOPMODE
+#define BW_20MHZ					BIT(2)
+//#define BW_OPMODE_20MHZ				BIT(2)	// For compability
+
+
+#define RATE_BITMAP_ALL			0xFFFFF
+
+// Only use CCK 1M rate for ACK
+#define RATE_RRSR_CCK_ONLY_1M		0xFFFF1
+#define RATE_RRSR_WITHOUT_CCK		0xFFFF0
+
+//2 TCR
+#define TSFRST						BIT(0)
+#define DIS_GCLK						BIT(1)
+#define PAD_SEL						BIT(2)
+#define PWR_ST						BIT(6)
+#define PWRBIT_OW_EN				BIT(7)
+#define ACRC							BIT(8)
+#define CFENDFORM					BIT(9)
+#define ICV							BIT(10)
+
+
+
+//2 RCR
+#define AAP							BIT(0)
+#define APM							BIT(1)
+#define AM							BIT(2)
+#define AB							BIT(3)
+#define ADD3							BIT(4)
+#define APWRMGT					BIT(5)
+#define CBSSID						BIT(6)
+#define CBSSID_BCN					BIT(7)
+#define ACRC32						BIT(8)
+#define AICV							BIT(9)
+#define ADF							BIT(11)
+#define ACF							BIT(12)
+#define AMF							BIT(13)
+#define HTC_LOC_CTRL				BIT(14)
+#define UC_DATA_EN					BIT(16)
+#define BM_DATA_EN					BIT(17)
+#define MFBEN						BIT(22)
+#define LSIGEN						BIT(23)
+#define EnMBID						BIT(24)
+#define APP_BASSN					BIT(27)
+#define APP_PHYSTS					BIT(28)
+#define APP_ICV						BIT(29)
+#define APP_MIC						BIT(30)
+#define APP_FCS						BIT(31)
+
+//2 RX_PKT_LIMIT
+
+//2 RX_DLK_TIME
+
+//2 MBIDCAMCFG
+
+
+
+//2 AMPDU_MIN_SPACE
+#define _MIN_SPACE(x)				((x) & 0x7)
+#define _SHORT_GI_PADDING(x)		(((x) & 0x1F) << 3)
+
+
+//2 RXERR_RPT
+#define RXERR_TYPE_OFDM_PPDU			0
+#define RXERR_TYPE_OFDM_FALSE_ALARM	1
+#define RXERR_TYPE_OFDM_MPDU_OK		2
+#define RXERR_TYPE_OFDM_MPDU_FAIL	3
+#define RXERR_TYPE_CCK_PPDU			4
+#define RXERR_TYPE_CCK_FALSE_ALARM	5
+#define RXERR_TYPE_CCK_MPDU_OK		6
+#define RXERR_TYPE_CCK_MPDU_FAIL		7
+#define RXERR_TYPE_HT_PPDU				8
+#define RXERR_TYPE_HT_FALSE_ALARM	9
+#define RXERR_TYPE_HT_MPDU_TOTAL		10
+#define RXERR_TYPE_HT_MPDU_OK			11
+#define RXERR_TYPE_HT_MPDU_FAIL		12
+#define RXERR_TYPE_RX_FULL_DROP		15
+
+#define RXERR_COUNTER_MASK			0xFFFFF
+#define RXERR_RPT_RST					BIT(27)
+#define _RXERR_RPT_SEL(type)			((type) << 28)
+
+
+//2 SECCFG
+#define	SCR_TxUseDK					BIT(0)			//Force Tx Use Default Key
+#define	SCR_RxUseDK					BIT(1)			//Force Rx Use Default Key
+#define	SCR_TxEncEnable				BIT(2)			//Enable Tx Encryption
+#define	SCR_RxDecEnable				BIT(3)			//Enable Rx Decryption
+#define	SCR_SKByA2						BIT(4)			//Search kEY BY A2
+#define	SCR_NoSKMC						BIT(5)			//No Key Search Multicast
+#define 	SCR_TXBCUSEDK					BIT(6)			// Force Tx Broadcast packets Use Default Key
+#define 	SCR_RXBCUSEDK					BIT(7)			// Force Rx Broadcast packets Use Default Key
+
+//vivi added for new cam search flow, 20091028
+#ifdef HW_EN_DE_CRYPTION_FOR_NEW_CAM_SEARCH_FLOW
+#define	SCR_TxUseBroadcastDK			BIT6			//Force Tx Use Broadcast Default Key
+#define	SCR_RxUseBroadcastDK			BIT7			//Force Rx Use Broadcast Default Key
+#endif
+
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+
+//2 USB Information (0xFE17)
+#define USB_IS_HIGH_SPEED				0
+#define USB_IS_FULL_SPEED				1
+#define USB_SPEED_MASK					BIT(5)
+
+#define USB_NORMAL_SIE_EP_MASK		0xF
+#define USB_NORMAL_SIE_EP_SHIFT		4
+
+#define USB_TEST_EP_MASK				0x30
+#define USB_TEST_EP_SHIFT				4
+
+//2 Special Option
+#define USB_AGG_EN						BIT(3)
+
+
+//2REG_C2HEVT_CLEAR
+#define C2H_EVT_HOST_CLOSE				0x00	// Set by driver and notify FW that the driver has read the C2H command message
+#define C2H_EVT_FW_CLOSE				0xFF	// Set by FW indicating that FW had set the C2H command message and it's not yet read by driver.
+
+//2 8192D PartNo.
+#define		PARTNO_92D_NIC			(BIT7|BIT6)
+#define		PARTNO_92D_NIC_REMARK (BIT5|BIT4)
+#define		PARTNO_SINGLE_BAND_VS  BIT3
+#define		PARTNO_SINGLE_BAND_VS_REMARK BIT1
+#define		PARTNO_CONCURRENT_BAND_VC (BIT3|BIT2)
+#define		PARTNO_CONCURRENT_BAND_VC_REMARK (BIT1|BIT0)
+//========================================================
+// General definitions
+//========================================================
+
+#define MAC_ADDR_LEN						6
+#define LAST_ENTRY_OF_TX_PKT_BUFFER		255
+#define LAST_ENTRY_OF_TX_PKT_BUFFER_DUAL_MAC	127
+
+#define POLLING_LLT_THRESHOLD				20
+#define POLLING_READY_TIMEOUT_COUNT		1000
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T				0x13
+#define	MAX_MSS_DENSITY_1T				0x0A
+// GPIO BIT
+#define	HAL_8192C_HW_GPIO_WPS_BIT		BIT2
+
+
+#include "basic_types.h"
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h
new file mode 100755
index 0000000000000..d01fb4a76caa6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h
@@ -0,0 +1,145 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192D_XMIT_H_
+#define _RTL8192D_XMIT_H_
+
+//
+// Queue Select Value in TxDesc
+//
+#define QSLT_BK							0x2//0x01
+#define QSLT_BE							0x0
+#define QSLT_VI							0x5//0x4
+#define QSLT_VO							0x7//0x6
+#define QSLT_BEACON						0x10
+#define QSLT_HIGH						0x11
+#define QSLT_MGNT						0x12
+#define QSLT_CMD						0x13
+
+//Because we open EM for normal case, we just always insert 2*8 bytes.by wl
+#define USB_92D_DUMMY_OFFSET		2
+#define USB_92D_DUMMY_LENGTH		(USB_92D_DUMMY_OFFSET * PACKET_OFFSET_SZ)
+#define USB_HWDESC_HEADER_LEN	(TXDESC_SIZE + USB_92D_DUMMY_LENGTH)
+
+//For 92D early mode
+#define SET_EARLYMODE_PKTNUM(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 0, 3, __Value)
+#define SET_EARLYMODE_LEN0(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 4, 12, __Value)
+#define SET_EARLYMODE_LEN1(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 16, 12, __Value)
+#define SET_EARLYMODE_LEN2_1(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 28, 4, __Value)
+#define SET_EARLYMODE_LEN2_2(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr+4, 0, 8, __Value)
+#define SET_EARLYMODE_LEN3(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr+4, 8, 12, __Value)
+#define SET_EARLYMODE_LEN4(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr+4, 20, 12, __Value)
+
+/* Copy from rtl8192c */
+struct txrpt_ccx_8192d {
+	/* offset 0 */
+	u8 retry_cnt:6;
+	u8 rsvd_0:2;
+
+	/* offset 1 */
+	u8 rts_retry_cnt:6;
+	u8 rsvd_1:2;
+
+	/* offset 2 */
+	u8 ccx_qtime0;
+	u8 ccx_qtime1;
+
+	/* offset 4 */
+	u8 missed_pkt_num:5;
+	u8 rsvd_4:3;
+
+	/* offset 5 */
+	u8 mac_id:5;
+	u8 des1_fragssn:3;
+
+	/* offset 6 */
+	u8 rpt_pkt_num:5;
+	u8 pkt_drop:1;
+	u8 lifetime_over:1;
+	u8 retry_over:1;
+
+	/* offset 7*/
+	u8 edca_tx_queue:4;
+	u8 rsvd_7:1;
+	u8 bmc:1;
+	u8 pkt_ok:1;
+	u8 int_ccx:1;
+};
+
+#define txrpt_ccx_qtime_8192d(txrpt_ccx) ((txrpt_ccx)->ccx_qtime0+((txrpt_ccx)->ccx_qtime1<<8))
+
+#ifdef CONFIG_XMIT_ACK
+void dump_txrpt_ccx_8192d(void *buf);
+void handle_txrpt_ccx_8192d(_adapter *adapter, void *buf);
+#else
+#define dump_txrpt_ccx_8192d(buf) do {} while(0)
+#define handle_txrpt_ccx_8192d(adapter, buf) do {} while(0)
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+#define MAX_TX_AGG_PACKET_NUMBER 0xFF
+#endif
+
+s32	rtl8192du_init_xmit_priv(_adapter * padapter);
+
+void	rtl8192du_free_xmit_priv(_adapter * padapter);
+
+void rtl8192du_cal_txdesc_chksum(struct tx_desc	*ptxdesc);
+
+s32 rtl8192du_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+s32 rtl8192du_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32 rtl8192du_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192du_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtl8192du_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+#ifdef CONFIG_PCI_HCI
+s32	rtl8192de_init_xmit_priv(_adapter * padapter);
+void	rtl8192de_free_xmit_priv(_adapter * padapter);
+
+s32	rtl8192de_enqueue_xmitbuf(struct rtw_tx_ring *ring, struct xmit_buf *pxmitbuf);
+struct xmit_buf *rtl8192de_dequeue_xmitbuf(struct rtw_tx_ring *ring);
+
+void	rtl8192de_xmitframe_resume(_adapter *padapter);
+
+s32	rtl8192de_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32	rtl8192de_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192de_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtl8192de_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h
new file mode 100755
index 0000000000000..f9214c2d8a050
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h
@@ -0,0 +1,90 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+ 
+#ifndef __RTW_ANDROID_H__
+#define __RTW_ANDROID_H__
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+enum ANDROID_WIFI_CMD {
+	ANDROID_WIFI_CMD_START,				
+	ANDROID_WIFI_CMD_STOP,			
+	ANDROID_WIFI_CMD_SCAN_ACTIVE,
+	ANDROID_WIFI_CMD_SCAN_PASSIVE,		
+	ANDROID_WIFI_CMD_RSSI,	
+	ANDROID_WIFI_CMD_LINKSPEED,
+	ANDROID_WIFI_CMD_RXFILTER_START,
+	ANDROID_WIFI_CMD_RXFILTER_STOP,	
+	ANDROID_WIFI_CMD_RXFILTER_ADD,	
+	ANDROID_WIFI_CMD_RXFILTER_REMOVE,
+	ANDROID_WIFI_CMD_BTCOEXSCAN_START,
+	ANDROID_WIFI_CMD_BTCOEXSCAN_STOP,
+	ANDROID_WIFI_CMD_BTCOEXMODE,
+	ANDROID_WIFI_CMD_SETSUSPENDOPT,
+	ANDROID_WIFI_CMD_P2P_DEV_ADDR,	
+	ANDROID_WIFI_CMD_SETFWPATH,		
+	ANDROID_WIFI_CMD_SETBAND,		
+	ANDROID_WIFI_CMD_GETBAND,			
+	ANDROID_WIFI_CMD_COUNTRY,			
+	ANDROID_WIFI_CMD_P2P_SET_NOA,
+	ANDROID_WIFI_CMD_P2P_GET_NOA,	
+	ANDROID_WIFI_CMD_P2P_SET_PS,	
+	ANDROID_WIFI_CMD_SET_AP_WPS_P2P_IE,
+#ifdef PNO_SUPPORT
+	ANDROID_WIFI_CMD_PNOSSIDCLR_SET,
+	ANDROID_WIFI_CMD_PNOSETUP_SET,
+	ANDROID_WIFI_CMD_PNOENABLE_SET,
+	ANDROID_WIFI_CMD_PNODEBUG_SET,
+#endif
+
+	ANDROID_WIFI_CMD_MACADDR,
+
+	ANDROID_WIFI_CMD_BLOCK,
+
+	ANDROID_WIFI_CMD_WFD_ENABLE,
+	ANDROID_WIFI_CMD_WFD_DISABLE,
+	
+	ANDROID_WIFI_CMD_WFD_SET_TCPPORT,
+	ANDROID_WIFI_CMD_WFD_SET_MAX_TPUT,
+	ANDROID_WIFI_CMD_WFD_SET_DEVTYPE,
+
+	ANDROID_WIFI_CMD_MAX
+};
+
+int rtw_android_cmdstr_to_num(char *cmdstr);
+int rtw_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd);
+
+#if defined(RTW_ENABLE_WIFI_CONTROL_FUNC)
+int rtw_android_wifictrl_func_add(void);
+void rtw_android_wifictrl_func_del(void);
+void* wl_android_prealloc(int section, unsigned long size);
+
+int wifi_get_irq_number(unsigned long *irq_flags_ptr);
+int wifi_set_power(int on, unsigned long msec);
+int wifi_get_mac_addr(unsigned char *buf);
+void *wifi_get_country_code(char *ccode);
+#else
+static int rtw_android_wifictrl_func_add(void) { return 0; }
+static void rtw_android_wifictrl_func_del(void) {}
+#endif /* defined(RTW_ENABLE_WIFI_CONTROL_FUNC) */
+
+#endif //__RTW_ANDROID_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h
new file mode 100755
index 0000000000000..42be4c67b5085
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h
@@ -0,0 +1,64 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_AP_H_
+#define __RTW_AP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#ifdef CONFIG_AP_MODE
+
+//external function
+extern void rtw_indicate_sta_assoc_event(_adapter *padapter, struct sta_info *psta);
+extern void rtw_indicate_sta_disassoc_event(_adapter *padapter, struct sta_info *psta);
+
+
+void init_mlme_ap_info(_adapter *padapter);
+void free_mlme_ap_info(_adapter *padapter);
+//void update_BCNTIM(_adapter *padapter);
+void rtw_add_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index, u8 *data, u8 len);
+void rtw_remove_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index);
+void update_beacon(_adapter *padapter, u8 ie_id, u8 *oui, u8 tx);
+void expire_timeout_chk(_adapter *padapter);	
+void update_sta_info_apmode(_adapter *padapter, struct sta_info *psta);
+int rtw_check_beacon_data(_adapter *padapter, u8 *pbuf,  int len);
+void rtw_ap_restore_network(_adapter *padapter);
+void rtw_set_macaddr_acl(_adapter *padapter, int mode);
+int rtw_acl_add_sta(_adapter *padapter, u8 *addr);
+int rtw_acl_remove_sta(_adapter *padapter, u8 *addr);
+
+#ifdef CONFIG_NATIVEAP_MLME
+void associated_clients_update(_adapter *padapter, u8 updated);
+void bss_cap_update_on_sta_join(_adapter *padapter, struct sta_info *psta);
+u8 bss_cap_update_on_sta_leave(_adapter *padapter, struct sta_info *psta);
+void sta_info_update(_adapter *padapter, struct sta_info *psta);
+void ap_sta_info_defer_update(_adapter *padapter, struct sta_info *psta);
+u8 ap_free_sta(_adapter *padapter, struct sta_info *psta, bool active, u16 reason);
+int rtw_sta_flush(_adapter *padapter);
+int rtw_ap_inform_ch_switch(_adapter *padapter, u8 new_ch, u8 ch_offset);
+void start_ap_mode(_adapter *padapter);
+void stop_ap_mode(_adapter *padapter);
+#endif
+#endif //end of CONFIG_AP_MODE
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h
new file mode 100755
index 0000000000000..9da3fddc4965e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h
@@ -0,0 +1,76 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_BR_EXT_H_
+#define _RTW_BR_EXT_H_
+
+#if 1	// rtw_wifi_driver
+#define CL_IPV6_PASS    	1
+#define MACADDRLEN		6
+#define _DEBUG_ERR		printk
+#define _DEBUG_INFO		//printk
+#define DEBUG_WARN		printk
+#define DEBUG_INFO		//printk
+#define DEBUG_ERR		printk
+//#define GET_MY_HWADDR		((GET_MIB(priv))->dot11OperationEntry.hwaddr)
+#define GET_MY_HWADDR(padapter)		((padapter)->eeprompriv.mac_addr)
+#endif	// rtw_wifi_driver
+
+#define NAT25_HASH_BITS		4
+#define NAT25_HASH_SIZE		(1 << NAT25_HASH_BITS)
+#define NAT25_AGEING_TIME	300
+
+#ifdef CL_IPV6_PASS
+#define MAX_NETWORK_ADDR_LEN	17
+#else
+#define MAX_NETWORK_ADDR_LEN	11
+#endif
+
+struct nat25_network_db_entry
+{
+	struct nat25_network_db_entry	*next_hash;
+	struct nat25_network_db_entry	**pprev_hash;
+	atomic_t						use_count;
+	unsigned char					macAddr[6];
+	unsigned long					ageing_timer;
+	unsigned char    				networkAddr[MAX_NETWORK_ADDR_LEN];
+};
+
+enum NAT25_METHOD {
+	NAT25_MIN,
+	NAT25_CHECK,
+	NAT25_INSERT,
+	NAT25_LOOKUP,
+	NAT25_PARSE,
+	NAT25_MAX
+};
+
+struct br_ext_info {
+	unsigned int	nat25_disable;
+	unsigned int	macclone_enable;
+	unsigned int	dhcp_bcst_disable;
+	int		addPPPoETag;		// 1: Add PPPoE relay-SID, 0: disable
+	unsigned char	nat25_dmzMac[MACADDRLEN];
+	unsigned int	nat25sc_disable;
+};
+
+void nat25_db_cleanup(_adapter *priv);
+
+#endif // _RTW_BR_EXT_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h
new file mode 100755
index 0000000000000..0f06b7acb3aab
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h
@@ -0,0 +1,40 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL871X_BYTEORDER_H_
+#define _RTL871X_BYTEORDER_H_
+
+#include <drv_conf.h>
+
+#if defined (CONFIG_LITTLE_ENDIAN) && defined (CONFIG_BIG_ENDIAN)
+#error "Shall be CONFIG_LITTLE_ENDIAN or CONFIG_BIG_ENDIAN, but not both!\n"
+#endif
+
+#if defined (CONFIG_LITTLE_ENDIAN)
+#ifndef CONFIG_PLATFORM_MSTAR389
+#  include <byteorder/little_endian.h>
+#endif
+#elif defined (CONFIG_BIG_ENDIAN)
+#  include <byteorder/big_endian.h>
+#else
+#  error "Must be LITTLE/BIG Endian Host"
+#endif
+
+#endif /* _RTL871X_BYTEORDER_H_ */
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h
new file mode 100755
index 0000000000000..ab115c5f6a234
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h
@@ -0,0 +1,1167 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_CMD_H_
+#define __RTW_CMD_H_
+
+#include <drv_conf.h>
+#include <wlan_bssdef.h>
+#include <rtw_rf.h>
+#include <rtw_led.h>
+
+#define C2H_MEM_SZ (16*1024)
+
+#ifndef CONFIG_RTL8711FW
+
+	#include <osdep_service.h>
+	#include <ieee80211.h> // <ieee80211/ieee80211.h>
+
+
+	#define FREE_CMDOBJ_SZ	128
+	
+	#define MAX_CMDSZ	1024
+	#define MAX_RSPSZ	512
+	#define MAX_EVTSZ	1024
+
+#ifdef PLATFORM_OS_CE
+	#define CMDBUFF_ALIGN_SZ 4
+#else
+	#define CMDBUFF_ALIGN_SZ 512
+#endif
+
+	struct cmd_obj {
+		_adapter *padapter;
+		u16	cmdcode;
+		u8	res;
+		u8	*parmbuf;
+		u32	cmdsz;
+		u8	*rsp;
+		u32	rspsz;
+		//_sema 	cmd_sem;
+		_list	list;
+	};
+
+	struct cmd_priv {
+		_sema	cmd_queue_sema;
+		//_sema	cmd_done_sema;
+		_sema	terminate_cmdthread_sema;		
+		_queue	cmd_queue;
+		u8	cmd_seq;
+		u8	*cmd_buf;	//shall be non-paged, and 4 bytes aligned
+		u8	*cmd_allocated_buf;
+		u8	*rsp_buf;	//shall be non-paged, and 4 bytes aligned		
+		u8	*rsp_allocated_buf;
+		u32	cmd_issued_cnt;
+		u32	cmd_done_cnt;
+		u32	rsp_cnt;
+		u8 cmdthd_running;
+		u8 stop_req;
+		_adapter *padapter;
+	};
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+	struct evt_obj {
+		u16	evtcode;
+		u8	res;
+		u8	*parmbuf;
+		u32	evtsz;		
+		_list	list;
+	};
+#endif
+
+	struct	evt_priv {
+#ifdef CONFIG_EVENT_THREAD_MODE
+		_sema	evt_notify;
+		_sema	terminate_evtthread_sema;
+		_queue	evt_queue;
+#endif
+
+//#define CONFIG_C2H_WK
+#ifdef CONFIG_C2H_WK
+		_workitem c2h_wk;
+		bool c2h_wk_alive;
+		struct rtw_cbuf *c2h_queue;
+		#define C2H_QUEUE_MAX_LEN 10
+#endif
+		
+#ifdef CONFIG_H2CLBK
+		_sema	lbkevt_done;
+		u8	lbkevt_limit;
+		u8	lbkevt_num;
+		u8	*cmdevt_parm;		
+#endif
+		ATOMIC_T event_seq;
+		u8	*evt_buf;	//shall be non-paged, and 4 bytes aligned		
+		u8	*evt_allocated_buf;
+		u32	evt_done_cnt;
+#ifdef CONFIG_SDIO_HCI
+		u8	*c2h_mem;
+		u8	*allocated_c2h_mem;
+#ifdef PLATFORM_OS_XP
+		PMDL	pc2h_mdl;
+#endif
+#endif
+
+	};
+
+#define init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code) \
+do {\
+	_rtw_init_listhead(&pcmd->list);\
+	pcmd->cmdcode = code;\
+	pcmd->parmbuf = (u8 *)(pparm);\
+	pcmd->cmdsz = sizeof (*pparm);\
+	pcmd->rsp = NULL;\
+	pcmd->rspsz = 0;\
+} while(0)
+
+struct c2h_evt_hdr {
+	u8 id:4;
+	u8 plen:4;
+	u8 seq;
+	u8 payload[0];
+};
+
+#define c2h_evt_exist(c2h_evt) ((c2h_evt)->id || (c2h_evt)->plen)
+
+extern u32 rtw_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj);
+extern struct cmd_obj *rtw_dequeue_cmd(struct cmd_priv *pcmdpriv);
+extern void rtw_free_cmd_obj(struct cmd_obj *pcmd);
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+extern u32 rtw_enqueue_evt(struct evt_priv *pevtpriv, struct evt_obj *obj);
+extern struct evt_obj *rtw_dequeue_evt(_queue *queue);
+extern void rtw_free_evt_obj(struct evt_obj *pcmd);
+#endif
+
+void rtw_stop_cmd_thread(_adapter *adapter);
+thread_return rtw_cmd_thread(thread_context context);
+
+extern u32 rtw_init_cmd_priv (struct cmd_priv *pcmdpriv);
+extern void rtw_free_cmd_priv (struct cmd_priv *pcmdpriv);
+
+extern u32 rtw_init_evt_priv (struct evt_priv *pevtpriv);
+extern void rtw_free_evt_priv (struct evt_priv *pevtpriv);
+extern void rtw_cmd_clr_isr(struct cmd_priv *pcmdpriv);
+extern void rtw_evt_notify_isr(struct evt_priv *pevtpriv);
+#ifdef CONFIG_P2P
+u8 p2p_protocol_wk_cmd(_adapter*padapter, int intCmdType );
+#endif //CONFIG_P2P
+
+#else
+	#include <ieee80211.h>
+#endif	/* CONFIG_RTL8711FW */
+
+enum rtw_drvextra_cmd_id
+{	
+	NONE_WK_CID,
+	DYNAMIC_CHK_WK_CID,
+	DM_CTRL_WK_CID,
+	PBC_POLLING_WK_CID,
+	POWER_SAVING_CTRL_WK_CID,//IPS,AUTOSuspend
+	LPS_CTRL_WK_CID,
+	ANT_SELECT_WK_CID,
+	P2P_PS_WK_CID,
+	P2P_PROTO_WK_CID,
+	CHECK_HIQ_WK_CID,//for softap mode, check hi queue if empty
+	INTEl_WIDI_WK_CID,
+	C2H_WK_CID,
+	RESET_SECURITYPRIV, // add for CONFIG_IEEE80211W, none 11w also can use
+	FREE_ASSOC_RESOURCES, // add for CONFIG_IEEE80211W, none 11w also can use
+	MAX_WK_CID
+};
+
+enum LPS_CTRL_TYPE
+{
+	LPS_CTRL_SCAN=0,
+	LPS_CTRL_JOINBSS=1,
+	LPS_CTRL_CONNECT=2,
+	LPS_CTRL_DISCONNECT=3,
+	LPS_CTRL_SPECIAL_PACKET=4,
+};
+
+enum RFINTFS {
+	SWSI,
+	HWSI,
+	HWPI,
+};
+
+/*
+Caller Mode: Infra, Ad-HoC(C)
+
+Notes: To enter USB suspend mode
+
+Command Mode
+
+*/
+struct usb_suspend_parm {
+	u32 action;// 1: sleep, 0:resume
+};
+
+/*
+Caller Mode: Infra, Ad-HoC
+
+Notes: To join a known BSS.
+
+Command-Event Mode
+
+*/
+
+/*
+Caller Mode: Infra, Ad-Hoc
+
+Notes: To join the specified bss
+
+Command Event Mode
+
+*/
+struct joinbss_parm {
+	WLAN_BSSID_EX network;
+};
+
+/*
+Caller Mode: Infra, Ad-HoC(C)
+
+Notes: To disconnect the current associated BSS
+
+Command Mode
+
+*/
+struct disconnect_parm {
+	u32 deauth_timeout_ms;
+};
+
+/*
+Caller Mode: AP, Ad-HoC(M)
+
+Notes: To create a BSS
+
+Command Mode
+*/
+struct createbss_parm {
+	WLAN_BSSID_EX network;
+};
+
+/*
+Caller Mode: AP, Ad-HoC, Infra
+
+Notes: To set the NIC mode of RTL8711
+
+Command Mode
+
+The definition of mode:
+
+#define IW_MODE_AUTO	0	// Let the driver decides which AP to join
+#define IW_MODE_ADHOC	1	// Single cell network (Ad-Hoc Clients)
+#define IW_MODE_INFRA	2	// Multi cell network, roaming, ..
+#define IW_MODE_MASTER	3	// Synchronisation master or Access Point
+#define IW_MODE_REPEAT	4	// Wireless Repeater (forwarder)
+#define IW_MODE_SECOND	5	// Secondary master/repeater (backup)
+#define IW_MODE_MONITOR	6	// Passive monitor (listen only)
+
+*/
+struct	setopmode_parm {
+	u8	mode;
+	u8	rsvd[3];
+};
+
+/*
+Caller Mode: AP, Ad-HoC, Infra
+
+Notes: To ask RTL8711 performing site-survey
+
+Command-Event Mode 
+
+*/
+
+#define RTW_SSID_SCAN_AMOUNT 9 // for WEXT_CSCAN_AMOUNT 9
+#define RTW_CHANNEL_SCAN_AMOUNT (14+37)
+struct sitesurvey_parm {
+	sint scan_mode;	//active: 1, passive: 0 
+	/* sint bsslimit;	// 1 ~ 48 */
+	u8 ssid_num;
+	u8 ch_num;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	struct rtw_ieee80211_channel ch[RTW_CHANNEL_SCAN_AMOUNT];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To set the auth type of RTL8711. open/shared/802.1x
+
+Command Mode
+
+*/
+struct setauth_parm {
+	u8 mode;  //0: legacy open, 1: legacy shared 2: 802.1x
+	u8 _1x;   //0: PSK, 1: TLS
+	u8 rsvd[2];
+};
+
+/*
+Caller Mode: Infra
+
+a. algorithm: wep40, wep104, tkip & aes
+b. keytype: grp key/unicast key
+c. key contents
+
+when shared key ==> keyid is the camid
+when 802.1x ==> keyid [0:1] ==> grp key
+when 802.1x ==> keyid > 2 ==> unicast key
+
+*/
+struct setkey_parm {
+	u8	algorithm;	// encryption algorithm, could be none, wep40, TKIP, CCMP, wep104
+	u8	keyid;		
+	u8 	grpkey;		// 1: this is the grpkey for 802.1x. 0: this is the unicast key for 802.1x
+	u8 	set_tx;		// 1: main tx key for wep. 0: other key.
+	u8	key[16];	// this could be 40 or 104
+};
+
+/*
+When in AP or Ad-Hoc mode, this is used to 
+allocate an sw/hw entry for a newly associated sta.
+
+Command
+
+when shared key ==> algorithm/keyid 
+
+*/
+struct set_stakey_parm {
+	u8	addr[ETH_ALEN];
+	u8	algorithm;
+	u8 	id;// currently for erasing cam entry if algorithm == _NO_PRIVACY_ 
+	u8	key[16];
+};
+
+struct set_stakey_rsp {
+	u8	addr[ETH_ALEN];
+	u8	keyid;
+	u8	rsvd;
+};
+
+/*
+Caller Ad-Hoc/AP
+
+Command -Rsp(AID == CAMID) mode
+
+This is to force fw to add an sta_data entry per driver's request.
+
+FW will write an cam entry associated with it.
+
+*/
+struct set_assocsta_parm {
+	u8	addr[ETH_ALEN];
+};
+
+struct set_assocsta_rsp {
+	u8	cam_id;
+	u8	rsvd[3];
+};
+
+/*
+	Caller Ad-Hoc/AP
+	
+	Command mode
+	
+	This is to force fw to del an sta_data entry per driver's request
+	
+	FW will invalidate the cam entry associated with it.
+
+*/
+struct del_assocsta_parm {
+	u8  	addr[ETH_ALEN];
+};
+
+/*
+Caller Mode: AP/Ad-HoC(M)
+
+Notes: To notify fw that given staid has changed its power state
+
+Command Mode
+
+*/
+struct setstapwrstate_parm {
+	u8	staid;
+	u8	status;
+	u8	hwaddr[6];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To setup the basic rate of RTL8711
+
+Command Mode
+
+*/
+struct	setbasicrate_parm {
+	u8	basicrates[NumRates];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To read the current basic rate
+
+Command-Rsp Mode
+
+*/
+struct getbasicrate_parm {
+	u32 rsvd;
+};
+
+struct getbasicrate_rsp {
+	u8 basicrates[NumRates];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To setup the data rate of RTL8711
+
+Command Mode
+
+*/
+struct setdatarate_parm {
+#ifdef MP_FIRMWARE_OFFLOAD
+	u32	curr_rateidx;
+#else
+	u8	mac_id;
+	u8	datarates[NumRates];
+#endif
+};
+
+/*
+Caller Mode: Any
+
+Notes: To read the current data rate
+
+Command-Rsp Mode
+
+*/
+struct getdatarate_parm {
+	u32 rsvd;
+	
+};
+struct getdatarate_rsp {
+	u8 datarates[NumRates];
+};
+
+
+/*
+Caller Mode: Any
+AP: AP can use the info for the contents of beacon frame
+Infra: STA can use the info when sitesurveying
+Ad-HoC(M): Like AP
+Ad-HoC(C): Like STA
+
+
+Notes: To set the phy capability of the NIC
+
+Command Mode
+
+*/
+
+struct	setphyinfo_parm {
+	struct regulatory_class class_sets[NUM_REGULATORYS];
+	u8	status;
+};
+
+struct	getphyinfo_parm {
+	u32 rsvd;
+};
+
+struct	getphyinfo_rsp {
+	struct regulatory_class class_sets[NUM_REGULATORYS];
+	u8	status;
+};
+
+/*
+Caller Mode: Any
+
+Notes: To set the channel/modem/band
+This command will be used when channel/modem/band is changed.
+
+Command Mode
+
+*/
+struct	setphy_parm {
+	u8	rfchannel;
+	u8	modem;
+};
+
+/*
+Caller Mode: Any
+
+Notes: To get the current setting of channel/modem/band
+
+Command-Rsp Mode
+
+*/
+struct	getphy_parm {
+	u32 rsvd;
+
+};
+struct	getphy_rsp {
+	u8	rfchannel;
+	u8	modem;
+};
+
+struct readBB_parm {
+	u8	offset;
+};
+struct readBB_rsp {
+	u8	value;
+};
+
+struct readTSSI_parm {
+	u8	offset;
+};
+struct readTSSI_rsp {
+	u8	value;
+};
+
+struct writeBB_parm {
+	u8	offset;
+	u8	value;
+};
+
+struct readRF_parm {
+	u8	offset;
+};
+struct readRF_rsp {
+	u32	value;
+};
+
+struct writeRF_parm {
+	u32	offset;
+	u32	value;
+};
+
+struct getrfintfs_parm {
+	u8	rfintfs;
+};
+
+
+struct Tx_Beacon_param
+{
+	WLAN_BSSID_EX network;
+};
+
+/*
+	Notes: This command is used for H2C/C2H loopback testing
+
+	mac[0] == 0 
+	==> CMD mode, return H2C_SUCCESS.
+	The following condition must be ture under CMD mode
+		mac[1] == mac[4], mac[2] == mac[3], mac[0]=mac[5]= 0;
+		s0 == 0x1234, s1 == 0xabcd, w0 == 0x78563412, w1 == 0x5aa5def7;
+		s2 == (b1 << 8 | b0);
+	
+	mac[0] == 1
+	==> CMD_RSP mode, return H2C_SUCCESS_RSP
+	
+	The rsp layout shall be:
+	rsp: 			parm:
+		mac[0]  =   mac[5];
+		mac[1]  =   mac[4];
+		mac[2]  =   mac[3];
+		mac[3]  =   mac[2];
+		mac[4]  =   mac[1];
+		mac[5]  =   mac[0];
+		s0		=   s1;
+		s1		=   swap16(s0);
+		w0		=  	swap32(w1);
+		b0		= 	b1
+		s2		= 	s0 + s1
+		b1		= 	b0
+		w1		=	w0
+		
+	mac[0] == 	2
+	==> CMD_EVENT mode, return 	H2C_SUCCESS
+	The event layout shall be:
+	event:			parm:
+		mac[0]  =   mac[5];
+		mac[1]  =   mac[4];
+		mac[2]  =   event's sequence number, starting from 1 to parm's marc[3]
+		mac[3]  =   mac[2];
+		mac[4]  =   mac[1];
+		mac[5]  =   mac[0];
+		s0		=   swap16(s0) - event.mac[2];
+		s1		=   s1 + event.mac[2];
+		w0		=  	swap32(w0);
+		b0		= 	b1
+		s2		= 	s0 + event.mac[2]
+		b1		= 	b0 
+		w1		=	swap32(w1) - event.mac[2];	
+	
+		parm->mac[3] is the total event counts that host requested.
+		
+	
+	event will be the same with the cmd's param.
+		
+*/
+
+#ifdef CONFIG_H2CLBK
+
+struct seth2clbk_parm {
+	u8 mac[6];
+	u16	s0;
+	u16	s1;
+	u32	w0;
+	u8	b0;
+	u16  s2;
+	u8	b1;
+	u32	w1;
+};
+
+struct geth2clbk_parm {
+	u32 rsv;	
+};
+
+struct geth2clbk_rsp {
+	u8	mac[6];
+	u16	s0;
+	u16	s1;
+	u32	w0;
+	u8	b0;
+	u16	s2;
+	u8	b1;
+	u32	w1;
+};
+
+#endif	/* CONFIG_H2CLBK */
+
+// CMD param Formart for driver extra cmd handler
+struct drvextra_cmd_parm {
+	int ec_id; //extra cmd id
+	int type_size; // Can use this field as the type id or command size
+	unsigned char *pbuf;
+};
+
+/*------------------- Below are used for RF/BB tunning ---------------------*/
+
+struct	setantenna_parm {
+	u8	tx_antset;		
+	u8	rx_antset;
+	u8	tx_antenna;		
+	u8	rx_antenna;		
+};
+
+struct	enrateadaptive_parm {
+	u32	en;
+};
+
+struct settxagctbl_parm {
+	u32	txagc[MAX_RATES_LENGTH];
+};
+
+struct gettxagctbl_parm {
+	u32 rsvd;
+};
+struct gettxagctbl_rsp {
+	u32	txagc[MAX_RATES_LENGTH];
+};
+
+struct setagcctrl_parm {
+	u32	agcctrl;		// 0: pure hw, 1: fw
+};
+
+
+struct setssup_parm	{
+	u32	ss_ForceUp[MAX_RATES_LENGTH];
+};
+
+struct getssup_parm	{
+	u32 rsvd;
+};
+struct getssup_rsp	{
+	u8	ss_ForceUp[MAX_RATES_LENGTH];
+};
+
+
+struct setssdlevel_parm	{
+	u8	ss_DLevel[MAX_RATES_LENGTH];
+};
+
+struct getssdlevel_parm	{
+	u32 rsvd;
+};
+struct getssdlevel_rsp	{
+	u8	ss_DLevel[MAX_RATES_LENGTH];
+};
+
+struct setssulevel_parm	{
+	u8	ss_ULevel[MAX_RATES_LENGTH];
+};
+
+struct getssulevel_parm	{
+	u32 rsvd;
+};
+struct getssulevel_rsp	{
+	u8	ss_ULevel[MAX_RATES_LENGTH];
+};
+
+
+struct	setcountjudge_parm {
+	u8	count_judge[MAX_RATES_LENGTH];
+};
+
+struct	getcountjudge_parm {
+	u32 rsvd;
+};
+struct	getcountjudge_rsp {
+	u8	count_judge[MAX_RATES_LENGTH];
+};
+
+
+struct setratable_parm {
+	u8 ss_ForceUp[NumRates];
+	u8 ss_ULevel[NumRates];
+	u8 ss_DLevel[NumRates];
+	u8 count_judge[NumRates];
+};
+
+struct getratable_parm {
+                uint rsvd;
+};
+struct getratable_rsp {
+        u8 ss_ForceUp[NumRates];
+        u8 ss_ULevel[NumRates];
+        u8 ss_DLevel[NumRates];
+        u8 count_judge[NumRates];
+};
+
+
+//to get TX,RX retry count
+struct gettxretrycnt_parm{
+	unsigned int rsvd;
+};
+struct gettxretrycnt_rsp{
+	unsigned long tx_retrycnt;
+};
+
+struct getrxretrycnt_parm{
+	unsigned int rsvd;
+};
+struct getrxretrycnt_rsp{
+	unsigned long rx_retrycnt;
+};
+
+//to get BCNOK,BCNERR count
+struct getbcnokcnt_parm{
+	unsigned int rsvd;
+};
+struct getbcnokcnt_rsp{
+	unsigned long  bcnokcnt;
+};
+
+struct getbcnerrcnt_parm{
+	unsigned int rsvd;
+};
+struct getbcnerrcnt_rsp{
+	unsigned long bcnerrcnt;
+};
+
+// to get current TX power level
+struct getcurtxpwrlevel_parm{
+	unsigned int rsvd;
+};
+struct getcurtxpwrlevel_rsp{
+	unsigned short tx_power;
+};
+
+struct setprobereqextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+struct setassocreqextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+struct setproberspextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+struct setassocrspextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+
+struct addBaReq_parm
+{
+ 	unsigned int tid;
+	u8	addr[ETH_ALEN];
+};
+
+/*H2C Handler index: 46 */
+struct set_ch_parm {
+	u8 ch;
+	u8 bw;
+	u8 ch_offset;
+};
+
+#ifdef MP_FIRMWARE_OFFLOAD
+/*H2C Handler index: 47 */
+struct SetTxPower_parm
+{
+	u8 TxPower;
+};
+
+/*H2C Handler index: 48 */
+struct SwitchAntenna_parm
+{
+	u16 antenna_tx;
+	u16 antenna_rx;
+//	R_ANTENNA_SELECT_CCK cck_txrx;
+	u8 cck_txrx;
+};
+
+/*H2C Handler index: 49 */
+struct SetCrystalCap_parm
+{
+	u32 curr_crystalcap;
+};
+
+/*H2C Handler index: 50 */
+struct SetSingleCarrierTx_parm
+{
+	u8 bStart;
+};
+
+/*H2C Handler index: 51 */
+struct SetSingleToneTx_parm
+{
+	u8 bStart;
+	u8 curr_rfpath;
+};
+
+/*H2C Handler index: 52 */
+struct SetCarrierSuppressionTx_parm
+{
+	u8 bStart;
+	u32 curr_rateidx;
+};
+
+/*H2C Handler index: 53 */
+struct SetContinuousTx_parm
+{
+	u8 bStart;
+	u8 CCK_flag; /*1:CCK 2:OFDM*/
+	u32 curr_rateidx;
+};
+
+/*H2C Handler index: 54 */
+struct SwitchBandwidth_parm
+{
+	u8 curr_bandwidth;
+};
+
+#endif	/* MP_FIRMWARE_OFFLOAD */
+
+/*H2C Handler index: 59 */ 
+struct SetChannelPlan_param
+{
+	u8 channel_plan;
+};
+
+/*H2C Handler index: 60 */ 
+struct LedBlink_param
+{
+	PLED_871x	 pLed;
+};
+
+/*H2C Handler index: 61 */ 
+struct SetChannelSwitch_param
+{
+	u8 new_ch_no;
+};
+
+/*H2C Handler index: 62 */ 
+struct TDLSoption_param
+{
+	u8 addr[ETH_ALEN];
+	u8 option;
+};
+
+#define GEN_CMD_CODE(cmd)	cmd ## _CMD_
+
+
+/*
+
+Result: 
+0x00: success
+0x01: sucess, and check Response.
+0x02: cmd ignored due to duplicated sequcne number
+0x03: cmd dropped due to invalid cmd code
+0x04: reserved.
+
+*/
+
+#define H2C_RSP_OFFSET			512
+
+#define H2C_SUCCESS			0x00
+#define H2C_SUCCESS_RSP			0x01
+#define H2C_DUPLICATED			0x02
+#define H2C_DROPPED			0x03
+#define H2C_PARAMETERS_ERROR		0x04
+#define H2C_REJECTED			0x05
+#define H2C_CMD_OVERFLOW		0x06
+#define H2C_RESERVED			0x07
+
+extern u8 rtw_setassocsta_cmd(_adapter  *padapter, u8 *mac_addr);
+extern u8 rtw_setstandby_cmd(_adapter *padapter, uint action);
+u8 rtw_sitesurvey_cmd(_adapter  *padapter, NDIS_802_11_SSID *ssid, int ssid_num, struct rtw_ieee80211_channel *ch, int ch_num);
+extern u8 rtw_createbss_cmd(_adapter  *padapter);
+extern u8 rtw_createbss_cmd_ex(_adapter  *padapter, unsigned char *pbss, unsigned int sz);
+extern u8 rtw_setphy_cmd(_adapter  *padapter, u8 modem, u8 ch);
+extern u8 rtw_setstakey_cmd(_adapter  *padapter, u8 *psta, u8 unicast_key);
+extern u8 rtw_clearstakey_cmd(_adapter *padapter, u8 *psta, u8 entry, u8 enqueue);
+extern u8 rtw_joinbss_cmd(_adapter  *padapter, struct wlan_network* pnetwork);
+u8 rtw_disassoc_cmd(_adapter *padapter, u32 deauth_timeout_ms, bool enqueue);
+extern u8 rtw_setopmode_cmd(_adapter  *padapter, NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
+extern u8 rtw_setdatarate_cmd(_adapter  *padapter, u8 *rateset);
+extern u8 rtw_setbasicrate_cmd(_adapter  *padapter, u8 *rateset);
+extern u8 rtw_setbbreg_cmd(_adapter * padapter, u8 offset, u8 val);
+extern u8 rtw_setrfreg_cmd(_adapter * padapter, u8 offset, u32 val);
+extern u8 rtw_getbbreg_cmd(_adapter * padapter, u8 offset, u8 * pval);
+extern u8 rtw_getrfreg_cmd(_adapter * padapter, u8 offset, u8 * pval);
+extern u8 rtw_setrfintfs_cmd(_adapter  *padapter, u8 mode);
+extern u8 rtw_setrttbl_cmd(_adapter  *padapter, struct setratable_parm *prate_table);
+extern u8 rtw_getrttbl_cmd(_adapter  *padapter, struct getratable_rsp *pval);
+
+extern u8 rtw_gettssi_cmd(_adapter  *padapter, u8 offset,u8 *pval);
+extern u8 rtw_setfwdig_cmd(_adapter*padapter, u8 type);
+extern u8 rtw_setfwra_cmd(_adapter*padapter, u8 type);
+
+extern u8 rtw_addbareq_cmd(_adapter*padapter, u8 tid, u8 *addr);
+// add for CONFIG_IEEE80211W, none 11w also can use
+extern u8 rtw_reset_securitypriv_cmd(_adapter*padapter);
+extern u8 rtw_free_assoc_resources_cmd(_adapter *padapter);
+extern u8 rtw_dynamic_chk_wk_cmd(_adapter *adapter);
+
+u8 rtw_lps_ctrl_wk_cmd(_adapter*padapter, u8 lps_ctrl_type, u8 enqueue);
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+extern  u8 rtw_antenna_select_cmd(_adapter*padapter, u8 antenna,u8 enqueue);
+#endif
+
+extern u8 rtw_ps_cmd(_adapter*padapter);
+
+
+#ifdef CONFIG_AP_MODE
+u8 rtw_chk_hi_queue_cmd(_adapter*padapter);
+#endif
+
+u8 rtw_set_ch_cmd(_adapter*padapter, u8 ch, u8 bw, u8 ch_offset, u8 enqueue);
+extern u8 rtw_set_chplan_cmd(_adapter*padapter, u8 chplan, u8 enqueue);
+extern u8 rtw_led_blink_cmd(_adapter*padapter, PLED_871x pLed);
+extern u8 rtw_set_csa_cmd(_adapter*padapter, u8 new_ch_no);
+extern u8 rtw_tdls_cmd(_adapter*padapter, u8 *addr, u8 option);
+
+extern u8 rtw_c2h_wk_cmd(PADAPTER padapter, u8 *c2h_evt);
+
+u8 rtw_drvextra_cmd_hdl(_adapter *padapter, unsigned char *pbuf);
+
+extern void rtw_survey_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_disassoc_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_joinbss_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);	
+extern void rtw_createbss_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_getbbrfreg_cmdrsp_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_readtssi_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd);
+
+extern void rtw_setstaKey_cmdrsp_callback(_adapter  *padapter,  struct cmd_obj *pcmd);
+extern void rtw_setassocsta_cmdrsp_callback(_adapter  *padapter,  struct cmd_obj *pcmd);
+extern void rtw_getrttbl_cmdrsp_callback(_adapter  *padapter,  struct cmd_obj *pcmd);
+
+
+struct _cmd_callback {
+	u32	cmd_code;
+	void (*callback)(_adapter  *padapter, struct cmd_obj *cmd);
+};
+
+enum rtw_h2c_cmd
+{
+	GEN_CMD_CODE(_Read_MACREG) ,	/*0*/
+ 	GEN_CMD_CODE(_Write_MACREG) ,    
+ 	GEN_CMD_CODE(_Read_BBREG) ,  
+ 	GEN_CMD_CODE(_Write_BBREG) ,  
+ 	GEN_CMD_CODE(_Read_RFREG) ,  
+ 	GEN_CMD_CODE(_Write_RFREG) , /*5*/
+ 	GEN_CMD_CODE(_Read_EEPROM) ,  
+ 	GEN_CMD_CODE(_Write_EEPROM) ,  
+ 	GEN_CMD_CODE(_Read_EFUSE) ,  
+ 	GEN_CMD_CODE(_Write_EFUSE) , 
+ 	
+ 	GEN_CMD_CODE(_Read_CAM) ,	/*10*/
+ 	GEN_CMD_CODE(_Write_CAM) ,   
+ 	GEN_CMD_CODE(_setBCNITV),
+ 	GEN_CMD_CODE(_setMBIDCFG),
+ 	GEN_CMD_CODE(_JoinBss),   /*14*/
+ 	GEN_CMD_CODE(_DisConnect) , /*15*/
+ 	GEN_CMD_CODE(_CreateBss) ,
+	GEN_CMD_CODE(_SetOpMode) , 
+	GEN_CMD_CODE(_SiteSurvey),  /*18*/
+ 	GEN_CMD_CODE(_SetAuth) ,
+ 	
+ 	GEN_CMD_CODE(_SetKey) ,	/*20*/
+ 	GEN_CMD_CODE(_SetStaKey) ,
+ 	GEN_CMD_CODE(_SetAssocSta) ,
+ 	GEN_CMD_CODE(_DelAssocSta) ,
+ 	GEN_CMD_CODE(_SetStaPwrState) , 
+ 	GEN_CMD_CODE(_SetBasicRate) , /*25*/
+ 	GEN_CMD_CODE(_GetBasicRate) ,
+ 	GEN_CMD_CODE(_SetDataRate) ,
+ 	GEN_CMD_CODE(_GetDataRate) ,
+	GEN_CMD_CODE(_SetPhyInfo) ,
+	
+ 	GEN_CMD_CODE(_GetPhyInfo) ,	/*30*/
+	GEN_CMD_CODE(_SetPhy) ,
+ 	GEN_CMD_CODE(_GetPhy) ,
+ 	GEN_CMD_CODE(_readRssi) ,
+ 	GEN_CMD_CODE(_readGain) ,
+ 	GEN_CMD_CODE(_SetAtim) , /*35*/
+ 	GEN_CMD_CODE(_SetPwrMode) , 
+ 	GEN_CMD_CODE(_JoinbssRpt),
+ 	GEN_CMD_CODE(_SetRaTable) ,
+ 	GEN_CMD_CODE(_GetRaTable) ,  	
+ 	
+ 	GEN_CMD_CODE(_GetCCXReport), /*40*/
+ 	GEN_CMD_CODE(_GetDTMReport),
+ 	GEN_CMD_CODE(_GetTXRateStatistics),
+ 	GEN_CMD_CODE(_SetUsbSuspend),
+ 	GEN_CMD_CODE(_SetH2cLbk),
+ 	GEN_CMD_CODE(_AddBAReq) , /*45*/
+	GEN_CMD_CODE(_SetChannel), /*46*/
+	GEN_CMD_CODE(_SetTxPower), 
+	GEN_CMD_CODE(_SwitchAntenna),
+	GEN_CMD_CODE(_SetCrystalCap),
+	GEN_CMD_CODE(_SetSingleCarrierTx), /*50*/
+	
+	GEN_CMD_CODE(_SetSingleToneTx),/*51*/
+	GEN_CMD_CODE(_SetCarrierSuppressionTx),
+	GEN_CMD_CODE(_SetContinuousTx),
+	GEN_CMD_CODE(_SwitchBandwidth), /*54*/
+	GEN_CMD_CODE(_TX_Beacon), /*55*/
+	
+	GEN_CMD_CODE(_Set_MLME_EVT), /*56*/
+	GEN_CMD_CODE(_Set_Drv_Extra), /*57*/
+	GEN_CMD_CODE(_Set_H2C_MSG), /*58*/
+	
+	GEN_CMD_CODE(_SetChannelPlan), /*59*/
+	GEN_CMD_CODE(_LedBlink), /*60*/
+
+	GEN_CMD_CODE(_SetChannelSwitch), /*61*/
+	GEN_CMD_CODE(_TDLS), /*62*/
+	
+	MAX_H2CCMD
+};
+
+#define _GetBBReg_CMD_		_Read_BBREG_CMD_
+#define _SetBBReg_CMD_ 		_Write_BBREG_CMD_
+#define _GetRFReg_CMD_ 		_Read_RFREG_CMD_
+#define _SetRFReg_CMD_ 		_Write_RFREG_CMD_
+
+#ifdef _RTW_CMD_C_
+struct _cmd_callback 	rtw_cmd_callback[] = 
+{
+	{GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/
+	{GEN_CMD_CODE(_Write_MACREG), NULL}, 
+	{GEN_CMD_CODE(_Read_BBREG), &rtw_getbbrfreg_cmdrsp_callback},
+	{GEN_CMD_CODE(_Write_BBREG), NULL},
+	{GEN_CMD_CODE(_Read_RFREG), &rtw_getbbrfreg_cmdrsp_callback},
+	{GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/
+	{GEN_CMD_CODE(_Read_EEPROM), NULL},
+	{GEN_CMD_CODE(_Write_EEPROM), NULL},
+	{GEN_CMD_CODE(_Read_EFUSE), NULL},
+	{GEN_CMD_CODE(_Write_EFUSE), NULL},
+	
+	{GEN_CMD_CODE(_Read_CAM),	NULL},	/*10*/
+	{GEN_CMD_CODE(_Write_CAM),	 NULL},	
+	{GEN_CMD_CODE(_setBCNITV), NULL},
+ 	{GEN_CMD_CODE(_setMBIDCFG), NULL},
+	{GEN_CMD_CODE(_JoinBss), &rtw_joinbss_cmd_callback},  /*14*/
+	{GEN_CMD_CODE(_DisConnect), &rtw_disassoc_cmd_callback}, /*15*/
+	{GEN_CMD_CODE(_CreateBss), &rtw_createbss_cmd_callback},
+	{GEN_CMD_CODE(_SetOpMode), NULL},
+	{GEN_CMD_CODE(_SiteSurvey), &rtw_survey_cmd_callback}, /*18*/
+	{GEN_CMD_CODE(_SetAuth), NULL},
+	
+	{GEN_CMD_CODE(_SetKey), NULL},	/*20*/
+	{GEN_CMD_CODE(_SetStaKey), &rtw_setstaKey_cmdrsp_callback},
+	{GEN_CMD_CODE(_SetAssocSta), &rtw_setassocsta_cmdrsp_callback},
+	{GEN_CMD_CODE(_DelAssocSta), NULL},	
+	{GEN_CMD_CODE(_SetStaPwrState), NULL},	
+	{GEN_CMD_CODE(_SetBasicRate), NULL}, /*25*/
+	{GEN_CMD_CODE(_GetBasicRate), NULL},
+	{GEN_CMD_CODE(_SetDataRate), NULL},
+	{GEN_CMD_CODE(_GetDataRate), NULL},
+	{GEN_CMD_CODE(_SetPhyInfo), NULL},
+	
+	{GEN_CMD_CODE(_GetPhyInfo), NULL}, /*30*/
+	{GEN_CMD_CODE(_SetPhy), NULL},
+	{GEN_CMD_CODE(_GetPhy), NULL},	
+	{GEN_CMD_CODE(_readRssi), NULL},
+	{GEN_CMD_CODE(_readGain), NULL},
+	{GEN_CMD_CODE(_SetAtim), NULL}, /*35*/
+	{GEN_CMD_CODE(_SetPwrMode), NULL},
+	{GEN_CMD_CODE(_JoinbssRpt), NULL},
+	{GEN_CMD_CODE(_SetRaTable), NULL},
+	{GEN_CMD_CODE(_GetRaTable) , NULL},
+ 	
+	{GEN_CMD_CODE(_GetCCXReport), NULL}, /*40*/
+ 	{GEN_CMD_CODE(_GetDTMReport),	NULL},
+ 	{GEN_CMD_CODE(_GetTXRateStatistics), NULL}, 
+ 	{GEN_CMD_CODE(_SetUsbSuspend), NULL}, 
+ 	{GEN_CMD_CODE(_SetH2cLbk), NULL},
+ 	{GEN_CMD_CODE(_AddBAReq), NULL}, /*45*/
+	{GEN_CMD_CODE(_SetChannel), NULL},		/*46*/
+	{GEN_CMD_CODE(_SetTxPower), NULL},
+	{GEN_CMD_CODE(_SwitchAntenna), NULL},
+	{GEN_CMD_CODE(_SetCrystalCap), NULL},
+	{GEN_CMD_CODE(_SetSingleCarrierTx), NULL},	/*50*/
+	
+	{GEN_CMD_CODE(_SetSingleToneTx), NULL}, /*51*/
+	{GEN_CMD_CODE(_SetCarrierSuppressionTx), NULL},
+	{GEN_CMD_CODE(_SetContinuousTx), NULL},
+	{GEN_CMD_CODE(_SwitchBandwidth), NULL},		/*54*/
+	{GEN_CMD_CODE(_TX_Beacon), NULL},/*55*/
+
+	{GEN_CMD_CODE(_Set_MLME_EVT), NULL},/*56*/
+	{GEN_CMD_CODE(_Set_Drv_Extra), NULL},/*57*/
+	{GEN_CMD_CODE(_Set_H2C_MSG), NULL},/*58*/
+	{GEN_CMD_CODE(_SetChannelPlan), NULL},/*59*/
+	{GEN_CMD_CODE(_LedBlink), NULL},/*60*/
+	
+	{GEN_CMD_CODE(_SetChannelSwitch), NULL},/*61*/
+	{GEN_CMD_CODE(_TDLS), NULL},/*62*/
+};
+#endif
+
+#endif // _CMD_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h
new file mode 100755
index 0000000000000..44537363a76bf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h
@@ -0,0 +1,538 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_DEBUG_H__
+#define __RTW_DEBUG_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#define	_no_debug_			0
+#define _drv_emerg_			1
+#define _drv_alert_			2
+#define _drv_crit_			3
+#define _drv_err_			4
+#define	_drv_warning_		5
+#define _drv_notice_			6
+#define _drv_info_			7
+#define _drv_dump_			8
+#define	_drv_debug_		9
+#define _drv_always_ _drv_emerg_
+
+#define _module_rtl871x_xmit_c_		BIT(0)
+#define _module_xmit_osdep_c_		BIT(1)
+#define _module_rtl871x_recv_c_		BIT(2)
+#define _module_recv_osdep_c_		BIT(3)
+#define _module_rtl871x_mlme_c_		BIT(4)
+#define _module_mlme_osdep_c_		BIT(5)
+#define _module_rtl871x_sta_mgt_c_		BIT(6)
+#define _module_rtl871x_cmd_c_			BIT(7)
+#define _module_cmd_osdep_c_		BIT(8)
+#define _module_rtl871x_io_c_				BIT(9)
+#define _module_io_osdep_c_		BIT(10)
+#define _module_os_intfs_c_			BIT(11)
+#define _module_rtl871x_security_c_		BIT(12)
+#define _module_rtl871x_eeprom_c_			BIT(13)
+#define _module_hal_init_c_		BIT(14)
+#define _module_hci_hal_init_c_		BIT(15)
+#define _module_rtl871x_ioctl_c_		BIT(16)
+#define _module_rtl871x_ioctl_set_c_		BIT(17)
+#define _module_rtl871x_ioctl_query_c_	BIT(18)
+#define _module_rtl871x_pwrctrl_c_			BIT(19)
+#define _module_hci_intfs_c_			BIT(20)
+#define _module_hci_ops_c_			BIT(21)
+#define _module_osdep_service_c_			BIT(22)
+#define _module_mp_			BIT(23)
+#define _module_hci_ops_os_c_			BIT(24)
+#define _module_rtl871x_ioctl_os_c		BIT(25)
+#define _module_rtl8712_cmd_c_		BIT(26)
+//#define _module_efuse_			BIT(27)
+#define	_module_rtl8192c_xmit_c_ BIT(28)
+#define _module_hal_xmit_c_	BIT(28)
+#define _module_efuse_			BIT(29)
+#define _module_rtl8712_recv_c_		BIT(30)
+#define _module_rtl8712_led_c_		BIT(31)
+
+#undef _MODULE_DEFINE_
+
+#if defined _RTW_XMIT_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_xmit_c_
+#elif defined _XMIT_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_xmit_osdep_c_
+#elif defined _RTW_RECV_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_recv_c_
+#elif defined _RECV_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_recv_osdep_c_
+#elif defined _RTW_MLME_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_mlme_c_
+#elif defined _MLME_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_mlme_osdep_c_
+#elif defined _RTW_MLME_EXT_C_
+	#define _MODULE_DEFINE_ 1
+#elif defined _RTW_STA_MGT_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_sta_mgt_c_
+#elif defined _RTW_CMD_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_cmd_c_
+#elif defined _CMD_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_cmd_osdep_c_
+#elif defined _RTW_IO_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_io_c_
+#elif defined _IO_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_io_osdep_c_
+#elif defined _OS_INTFS_C_
+	#define	_MODULE_DEFINE_	_module_os_intfs_c_
+#elif defined _RTW_SECURITY_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_security_c_
+#elif defined _RTW_EEPROM_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_eeprom_c_
+#elif defined _HAL_INTF_C_
+	#define	_MODULE_DEFINE_	_module_hal_init_c_
+#elif defined _HCI_HAL_INIT_C_
+	#define	_MODULE_DEFINE_	_module_hci_hal_init_c_
+#elif defined _RTL871X_IOCTL_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_c_
+#elif defined _RTL871X_IOCTL_SET_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_set_c_
+#elif defined _RTL871X_IOCTL_QUERY_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_query_c_
+#elif defined _RTL871X_PWRCTRL_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_pwrctrl_c_
+#elif defined _RTW_PWRCTRL_C_
+	#define	_MODULE_DEFINE_	1
+#elif defined _HCI_INTF_C_
+	#define	_MODULE_DEFINE_	_module_hci_intfs_c_
+#elif defined _HCI_OPS_C_
+	#define	_MODULE_DEFINE_	_module_hci_ops_c_
+#elif defined _SDIO_OPS_C_
+	#define	_MODULE_DEFINE_ 1
+#elif defined _OSDEP_HCI_INTF_C_
+	#define	_MODULE_DEFINE_	_module_hci_intfs_c_
+#elif defined _OSDEP_SERVICE_C_
+	#define	_MODULE_DEFINE_	_module_osdep_service_c_
+#elif defined _HCI_OPS_OS_C_
+	#define	_MODULE_DEFINE_	_module_hci_ops_os_c_
+#elif defined _RTL871X_IOCTL_LINUX_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_os_c
+#elif defined _RTL8712_CMD_C_
+	#define	_MODULE_DEFINE_	_module_rtl8712_cmd_c_
+#elif defined _RTL8192C_XMIT_C_
+	#define	_MODULE_DEFINE_	1
+#elif defined _RTL8723AS_XMIT_C_
+	#define	_MODULE_DEFINE_	1
+#elif defined _RTL8712_RECV_C_
+	#define	_MODULE_DEFINE_	_module_rtl8712_recv_c_
+#elif defined _RTL8192CU_RECV_C_
+	#define	_MODULE_DEFINE_	_module_rtl8712_recv_c_
+#elif defined _RTL871X_MLME_EXT_C_
+	#define _MODULE_DEFINE_	_module_mlme_osdep_c_
+#elif defined _RTW_MP_C_
+	#define	_MODULE_DEFINE_	_module_mp_
+#elif defined _RTW_MP_IOCTL_C_
+	#define	_MODULE_DEFINE_	_module_mp_
+#elif defined _RTW_EFUSE_C_
+	#define	_MODULE_DEFINE_	_module_efuse_
+#endif
+
+#ifdef PLATFORM_OS_CE
+extern void rtl871x_cedbg(const char *fmt, ...);
+#endif
+
+#define RT_TRACE(_Comp, _Level, Fmt) do{}while(0)
+#define _func_enter_ do{}while(0)
+#define _func_exit_ do{}while(0)
+#define RT_PRINT_DATA(_Comp, _Level, _TitleString, _HexData, _HexDataLen) do{}while(0)
+
+#undef	_dbgdump
+
+#ifdef CONFIG_DEBUG_RTL871X
+
+#ifndef _RTL871X_DEBUG_C_
+	extern u32 GlobalDebugLevel;
+	extern u64 GlobalDebugComponents;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	#ifdef PLATFORM_OS_XP
+
+	#define _dbgdump	DbgPrint
+
+	#elif defined PLATFORM_OS_CE
+
+	#define _dbgdump	rtl871x_cedbg
+
+	#endif
+
+#elif defined PLATFORM_LINUX
+
+	#define _dbgdump	printk
+
+#elif defined PLATFORM_FREEBSD
+
+	#define _dbgdump	printf
+
+#endif
+
+#endif /* CONFIG_DEBUG_RTL871X */
+
+
+#if	defined (_dbgdump) && defined (_MODULE_DEFINE_)
+
+		#undef RT_TRACE
+		#define RT_TRACE(_Comp, _Level, Fmt)\
+		do {\
+			if((_Comp & GlobalDebugComponents) && (_Level <= GlobalDebugLevel)) {\
+				_dbgdump("%s [0x%08x,%d]", RTL871X_MODULE_NAME, (unsigned int)_Comp, _Level);\
+				_dbgdump Fmt;\
+			}\
+		}while(0)
+
+#endif
+
+
+#if	defined (_dbgdump)
+
+		#undef  _func_enter_
+		#define _func_enter_ \
+		do {	\
+			if (GlobalDebugLevel >= _drv_debug_) \
+			{																	\
+				_dbgdump("\n %s : %s enters at %d\n", RTL871X_MODULE_NAME, __FUNCTION__, __LINE__);\
+			}		\
+		} while(0)
+
+		#undef  _func_exit_
+		#define _func_exit_ \
+		do {	\
+			if (GlobalDebugLevel >= _drv_debug_) \
+			{																	\
+				_dbgdump("\n %s : %s exits at %d\n", RTL871X_MODULE_NAME, __FUNCTION__, __LINE__); \
+			}	\
+		} while(0)
+
+		#undef RT_PRINT_DATA
+		#define RT_PRINT_DATA(_Comp, _Level, _TitleString, _HexData, _HexDataLen)			\
+			if(((_Comp) & GlobalDebugComponents) && (_Level <= GlobalDebugLevel))	\
+			{									\
+				int __i;								\
+				u8	*ptr = (u8 *)_HexData;				\
+				_dbgdump("Rtl871x: ");						\
+				_dbgdump(_TitleString);						\
+				for( __i=0; __i<(int)_HexDataLen; __i++ )				\
+				{								\
+					_dbgdump("%02X%s", ptr[__i], (((__i + 1) % 4) == 0)?"  ":" ");	\
+					if (((__i + 1) % 16) == 0)	_dbgdump("\n");			\
+				}								\
+				_dbgdump("\n");							\
+			}
+#endif
+
+
+#ifdef CONFIG_DEBUG_RTL819X
+
+#undef	_dbgdump
+
+#ifdef PLATFORM_WINDOWS
+
+	#ifdef PLATFORM_OS_XP
+
+	#define _dbgdump	DbgPrint
+
+	#elif defined PLATFORM_OS_CE
+
+	#define _dbgdump	rtl871x_cedbg
+
+	#endif
+
+#elif defined PLATFORM_LINUX
+
+	#define _dbgdump	printk
+
+#elif defined PLATFORM_FREEBSD
+
+	#define _dbgdump	printf
+
+#endif
+
+#endif /* CONFIG_DEBUG_RTL819X */
+
+
+#ifdef PLATFORM_WINDOWS
+	#define DBG_871X do {} while(0)
+	#define MSG_8192C do {} while(0)
+	#define DBG_8192C do {} while(0)
+	#define WRN_8192C do {} while(0)
+	#define ERR_8192C do {} while(0)
+#endif
+
+#ifdef PLATFORM_LINUX
+	#define DBG_871X(x, ...) do {} while(0)
+	#define MSG_8192C(x, ...) do {} while(0)
+	#define DBG_8192C(x,...) do {} while(0)
+	#define WRN_8192C(x,...) do {} while(0)
+	#define ERR_8192C(x,...) do {} while(0)
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	#define _dbgdump	printf
+	#define DBG_871X(x, ...) do {} while(0)
+	#define MSG_8192C(x, ...) do {} while(0)
+	#define DBG_8192C(x,...) do {} while(0)
+	#define WRN_8192C(x,...) do {} while(0)
+	#define ERR_8192C(x,...) do {} while(0)
+#endif
+
+extern u32 GlobalDebugLevel;
+#define LOG_LEVEL(level, ...)\
+                do {\
+                        if(level <= GlobalDebugLevel) {\
+                                printk(__VA_ARGS__);\
+                        }\
+                }while(0)
+
+#define DBG_871X_LEVEL LOG_LEVEL
+
+#if     defined (_dbgdump)
+        #undef DBG_871X
+//      #define DBG_871X _dbgdump
+        #define DBG_871X(...) LOG_LEVEL(_drv_debug_ , __VA_ARGS__)
+
+        #undef MSG_8192C
+//      #define MSG_8192C _dbgdump
+        #define MSG_8192C(...) LOG_LEVEL(_drv_info_ , __VA_ARGS__)
+
+        #undef DBG_8192C
+//      #define DBG_8192C _dbgdump
+        #define DBG_8192C(...) LOG_LEVEL(_drv_debug_ ,  __VA_ARGS__)
+
+
+	#undef WRN_8192C
+	#define WRN_8192C _dbgdump
+
+	#undef ERR_8192C
+	#define ERR_8192C _dbgdump
+#endif
+
+
+#ifdef CONFIG_PROC_DEBUG
+
+	int proc_get_drv_version(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_log_level(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+			  
+	int proc_set_log_level(struct file *file, const char *buffer,
+			unsigned long count, void *data);
+
+#ifdef DBG_MEM_ALLOC
+	int proc_get_mstat(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+#endif /* DBG_MEM_ALLOC */
+
+	int proc_get_write_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+ 	int proc_set_write_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+	int proc_get_read_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_read_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+
+	int proc_get_fwstate(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_sec_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mlmext_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_qos_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_ht_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_ap_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_adapter_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_trx_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mac_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mac_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mac_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+	
+	int proc_get_bb_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_bb_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+	
+	int proc_get_bb_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+	
+	int proc_get_rf_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump4(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+#ifdef CONFIG_AP_MODE
+
+	int proc_get_all_sta_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+	int proc_get_malloc_cnt(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+#endif
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	int proc_get_best_channel(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+	int proc_set_best_channel(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+#endif
+
+	int proc_get_rx_signal(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_rx_signal(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+		
+	int proc_get_ht_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+			  
+	int proc_set_ht_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+			  
+	int proc_get_cbw40_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_cbw40_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+	
+	int proc_get_ampdu_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+			  
+	int proc_set_ampdu_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+	
+	int proc_get_two_path_rssi(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+	
+	int proc_get_rx_stbc(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+		
+	int proc_set_rx_stbc(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+
+	int proc_get_vid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_pid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rssi_disp(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_rssi_disp(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+int proc_get_sreset(char *page, char **start, off_t offset, int count, int *eof, void *data);
+int proc_set_sreset(struct file *file, const char *buffer, unsigned long count, void *data);
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+int proc_get_dm_adaptivity(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+int proc_set_dm_adaptivity(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+#endif //CONFIG_PROC_DEBUG
+
+#endif	//__RTW_DEBUG_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h
new file mode 100755
index 0000000000000..ce834dd19aef8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h
@@ -0,0 +1,152 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_EEPROM_H__
+#define __RTW_EEPROM_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#define	RTL8712_EEPROM_ID			0x8712
+#define	EEPROM_MAX_SIZE			256
+#define	CLOCK_RATE					50			//100us		
+
+//- EEPROM opcodes
+#define EEPROM_READ_OPCODE		06
+#define EEPROM_WRITE_OPCODE		05
+#define EEPROM_ERASE_OPCODE		07
+#define EEPROM_EWEN_OPCODE		19      // Erase/write enable
+#define EEPROM_EWDS_OPCODE		16      // Erase/write disable
+
+//Country codes
+#define USA							0x555320
+#define EUROPE						0x1 //temp, should be provided later	
+#define JAPAN						0x2 //temp, should be provided later
+
+#ifdef CONFIG_SDIO_HCI
+#define eeprom_cis0_sz	17
+#define eeprom_cis1_sz	50
+#endif
+
+#define	EEPROM_CID_DEFAULT			0x0
+#define	EEPROM_CID_ALPHA				0x1
+#define	EEPROM_CID_Senao				0x3
+#define	EEPROM_CID_NetCore				0x5
+#define	EEPROM_CID_CAMEO				0X8
+#define	EEPROM_CID_SITECOM				0x9
+#define	EEPROM_CID_COREGA				0xB
+#define	EEPROM_CID_EDIMAX_BELKIN		0xC
+#define	EEPROM_CID_SERCOMM_BELKIN		0xE
+#define	EEPROM_CID_CAMEO1				0xF
+#define	EEPROM_CID_WNC_COREGA		0x12
+#define	EEPROM_CID_CLEVO				0x13
+#define	EEPROM_CID_WHQL				0xFE // added by chiyoko for dtm, 20090108
+
+//
+// Customer ID, note that: 
+// This variable is initiailzed through EEPROM or registry, 
+// however, its definition may be different with that in EEPROM for 
+// EEPROM size consideration. So, we have to perform proper translation between them.
+// Besides, CustomerID of registry has precedence of that of EEPROM.
+// defined below. 060703, by rcnjko.
+//
+typedef enum _RT_CUSTOMER_ID
+{
+	RT_CID_DEFAULT = 0,
+	RT_CID_8187_ALPHA0 = 1,
+	RT_CID_8187_SERCOMM_PS = 2,
+	RT_CID_8187_HW_LED = 3,
+	RT_CID_8187_NETGEAR = 4,
+	RT_CID_WHQL = 5,
+	RT_CID_819x_CAMEO  = 6, 
+	RT_CID_819x_RUNTOP = 7,
+	RT_CID_819x_Senao = 8,
+	RT_CID_TOSHIBA = 9,	// Merge by Jacken, 2008/01/31.
+	RT_CID_819x_Netcore = 10,
+	RT_CID_Nettronix = 11,
+	RT_CID_DLINK = 12,
+	RT_CID_PRONET = 13,
+	RT_CID_COREGA = 14,
+	RT_CID_CHINA_MOBILE = 15,
+	RT_CID_819x_ALPHA = 16,
+	RT_CID_819x_Sitecom = 17,
+	RT_CID_CCX = 18, // It's set under CCX logo test and isn't demanded for CCX functions, but for test behavior like retry limit and tx report. By Bruce, 2009-02-17.
+	RT_CID_819x_Lenovo = 19,	
+	RT_CID_819x_QMI = 20,
+	RT_CID_819x_Edimax_Belkin = 21,		
+	RT_CID_819x_Sercomm_Belkin = 22,			
+	RT_CID_819x_CAMEO1 = 23,
+	RT_CID_819x_MSI = 24,
+	RT_CID_819x_Acer = 25,
+	RT_CID_819x_AzWave_ASUS = 26,
+	RT_CID_819x_AzWave = 27, // For AzWave in PCIe, The ID is AzWave use and not only Asus
+	RT_CID_819x_HP = 28,
+	RT_CID_819x_WNC_COREGA = 29,
+	RT_CID_819x_Arcadyan_Belkin = 30,
+	RT_CID_819x_SAMSUNG = 31,
+	RT_CID_819x_CLEVO = 32,
+	RT_CID_819x_DELL = 33,
+	RT_CID_819x_PRONETS = 34,
+	RT_CID_819x_Edimax_ASUS = 35,
+	RT_CID_819x_CAMEO_NETGEAR = 36,
+}RT_CUSTOMER_ID, *PRT_CUSTOMER_ID;
+
+struct eeprom_priv 
+{    
+	u8		bautoload_fail_flag;
+	//u8		bempty;
+	//u8		sys_config;
+	u8		mac_addr[6];	//PermanentAddress
+	//u8		config0;
+	u16		channel_plan;
+	//u8		country_string[3];	
+	//u8		tx_power_b[15];
+	//u8		tx_power_g[15];
+	//u8		tx_power_a[201];
+
+	u8		EepromOrEfuse;
+
+	u8		efuse_eeprom_data[EEPROM_MAX_SIZE];
+
+#ifdef CONFIG_SDIO_HCI
+	u8		sdio_setting;	
+	u32		ocr;
+	u8		cis0[eeprom_cis0_sz];
+	u8		cis1[eeprom_cis1_sz];	
+#endif
+};
+
+
+extern void eeprom_write16(_adapter *padapter, u16 reg, u16 data);
+extern u16 eeprom_read16(_adapter *padapter, u16 reg);
+extern void read_eeprom_content(_adapter *padapter);
+extern void eeprom_read_sz(_adapter * padapter, u16 reg,u8* data, u32 sz); 
+
+extern void read_eeprom_content_by_attrib(_adapter *	padapter	);
+
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+extern int isAdaptorInfoFileValid(void);
+extern int storeAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv);
+extern int retriveAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv);
+#endif //CONFIG_ADAPTOR_INFO_CACHING_FILE
+#endif //PLATFORM_LINUX
+
+#endif  //__RTL871X_EEPROM_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h
new file mode 100755
index 0000000000000..224aa4f92bd77
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h
@@ -0,0 +1,124 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_EFUSE_H__
+#define __RTW_EFUSE_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+#define	EFUSE_ERROE_HANDLE		1
+
+#define	PG_STATE_HEADER 		0x01
+#define	PG_STATE_WORD_0		0x02
+#define	PG_STATE_WORD_1		0x04
+#define	PG_STATE_WORD_2		0x08
+#define	PG_STATE_WORD_3		0x10
+#define	PG_STATE_DATA			0x20
+
+#define	PG_SWBYTE_H			0x01
+#define	PG_SWBYTE_L			0x02
+
+#define	PGPKT_DATA_SIZE		8
+
+#define	EFUSE_WIFI				0
+#define	EFUSE_BT				1
+
+enum _EFUSE_DEF_TYPE {
+	TYPE_EFUSE_MAX_SECTION				= 0,
+	TYPE_EFUSE_REAL_CONTENT_LEN			= 1,
+	TYPE_AVAILABLE_EFUSE_BYTES_BANK		= 2,
+	TYPE_AVAILABLE_EFUSE_BYTES_TOTAL	= 3,
+	TYPE_EFUSE_MAP_LEN					= 4,
+	TYPE_EFUSE_PROTECT_BYTES_BANK		= 5,
+};
+
+#define		EFUSE_MAX_MAP_LEN		256
+#define		EFUSE_MAX_HW_SIZE		512
+#define		EFUSE_MAX_SECTION_BASE	16
+
+#define EXT_HEADER(header) ((header & 0x1F ) == 0x0F)
+#define ALL_WORDS_DISABLED(wde)	((wde & 0x0F) == 0x0F)
+#define GET_HDR_OFFSET_2_0(header) ( (header & 0xE0) >> 5)
+
+#define		EFUSE_REPEAT_THRESHOLD_			3
+
+//=============================================
+//	The following is for BT Efuse definition
+//=============================================
+#define		EFUSE_BT_MAX_MAP_LEN		1024
+#define		EFUSE_MAX_BANK			4
+#define		EFUSE_MAX_BT_BANK		(EFUSE_MAX_BANK-1)
+//=============================================
+/*--------------------------Define Parameters-------------------------------*/
+#define		EFUSE_MAX_WORD_UNIT			4
+
+/*------------------------------Define structure----------------------------*/ 
+typedef struct PG_PKT_STRUCT_A{
+	u8 offset;
+	u8 word_en;
+	u8 data[8];	
+	u8 word_cnts;
+}PGPKT_STRUCT,*PPGPKT_STRUCT;
+/*------------------------------Define structure----------------------------*/ 
+
+
+/*------------------------Export global variable----------------------------*/
+extern u8 fakeEfuseBank;
+extern u32 fakeEfuseUsedBytes;
+extern u8 fakeEfuseContent[];
+extern u8 fakeEfuseInitMap[];
+extern u8 fakeEfuseModifiedMap[];
+
+extern u32 BTEfuseUsedBytes;
+extern u8 BTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+extern u8 BTEfuseInitMap[];
+extern u8 BTEfuseModifiedMap[];
+
+extern u32 fakeBTEfuseUsedBytes;
+extern u8 fakeBTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+extern u8 fakeBTEfuseInitMap[];
+extern u8 fakeBTEfuseModifiedMap[];
+/*------------------------Export global variable----------------------------*/
+
+u8	efuse_GetCurrentSize(PADAPTER padapter, u16 *size);
+u16	efuse_GetMaxSize(PADAPTER padapter);
+u8	rtw_efuse_access(PADAPTER padapter, u8 bRead, u16 start_addr, u16 cnts, u8 *data);
+u8	rtw_efuse_map_read(PADAPTER padapter, u16 addr, u16 cnts, u8 *data);
+u8	rtw_efuse_map_write(PADAPTER padapter, u16 addr, u16 cnts, u8 *data);
+
+u16	Efuse_GetCurrentSize(PADAPTER pAdapter, u8 efuseType, BOOLEAN bPseudoTest);
+u8	Efuse_CalculateWordCnts(u8 word_en);
+void	ReadEFuseByte(PADAPTER Adapter, u16 _offset, u8 *pbuf, BOOLEAN bPseudoTest) ;
+void	EFUSE_GetEfuseDefinition(PADAPTER pAdapter, u8 efuseType, u8 type, void *pOut, BOOLEAN bPseudoTest);
+u8	efuse_OneByteRead(PADAPTER pAdapter, u16 addr, u8 *data, BOOLEAN	 bPseudoTest);
+u8	efuse_OneByteWrite(PADAPTER pAdapter, u16 addr, u8 data, BOOLEAN	 bPseudoTest);
+
+void	Efuse_PowerSwitch(PADAPTER pAdapter,u8	bWrite,u8	 PwrState);
+int 	Efuse_PgPacketRead(PADAPTER pAdapter, u8 offset, u8 *data, BOOLEAN bPseudoTest);
+int 	Efuse_PgPacketWrite(PADAPTER pAdapter, u8 offset, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+void	efuse_WordEnableDataRead(u8 word_en, u8 *sourdata, u8 *targetdata);
+u8	Efuse_WordEnableDataWrite(PADAPTER pAdapter, u16 efuse_addr, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+
+u8	EFUSE_Read1Byte(PADAPTER pAdapter, u16 Address);
+void	EFUSE_ShadowMapUpdate(PADAPTER pAdapter, u8 efuseType, BOOLEAN bPseudoTest);
+void	EFUSE_ShadowRead(PADAPTER pAdapter, u8 Type, u16 Offset, u32 *Value);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h
new file mode 100755
index 0000000000000..4299ddcf9cd0f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h
@@ -0,0 +1,154 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_EVENT_H_
+#define _RTW_EVENT_H_
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+#ifndef CONFIG_RTL8711FW
+#ifdef PLATFORM_LINUX
+#include <wlan_bssdef.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+#include <asm/semaphore.h>
+#else
+#include <linux/semaphore.h>
+#endif
+#include <linux/sem.h>
+#endif
+#else
+#include <wlan_bssdef.h>
+#endif//CONFIG_RTL8711FW
+
+
+
+#ifdef CONFIG_H2CLBK
+#include <h2clbk.h>
+#endif
+
+/*
+Used to report a bss has been scanned
+
+*/
+struct survey_event	{
+	WLAN_BSSID_EX bss;
+};
+
+/*
+Used to report that the requested site survey has been done.
+
+bss_cnt indicates the number of bss that has been reported.
+
+
+*/
+struct surveydone_event {
+	unsigned int	bss_cnt;	
+	
+};
+
+/*
+Used to report the link result of joinning the given bss
+
+
+join_res:
+-1: authentication fail
+-2: association fail
+> 0: TID
+
+*/
+struct joinbss_event {
+	struct	wlan_network	network;
+};
+
+/*
+Used to report a given STA has joinned the created BSS.
+It is used in AP/Ad-HoC(M) mode.
+
+
+*/
+struct stassoc_event {
+	unsigned char macaddr[6];
+	unsigned char rsvd[2];
+	int    cam_id;
+	
+};
+
+struct stadel_event {
+ unsigned char macaddr[6];
+ unsigned char rsvd[2]; //for reason
+ int mac_id;
+};
+
+struct addba_event
+{
+ 	unsigned int tid;
+};
+
+
+#ifdef CONFIG_H2CLBK
+struct c2hlbk_event{
+	unsigned char mac[6];
+	unsigned short	s0;
+	unsigned short	s1;
+	unsigned int	w0;
+	unsigned char	b0;
+	unsigned short  s2;
+	unsigned char	b1;
+	unsigned int	w1;	
+};
+#endif//CONFIG_H2CLBK
+
+#define GEN_EVT_CODE(event)	event ## _EVT_
+
+
+
+struct fwevent {
+	u32	parmsize;
+	void (*event_callback)(_adapter *dev, u8 *pbuf);
+};
+
+
+#define C2HEVENT_SZ			32	
+
+struct event_node{
+	unsigned char *node;
+	unsigned char evt_code;
+	unsigned short evt_sz;
+	volatile int	*caller_ff_tail;
+	int	caller_ff_sz;
+};
+
+struct c2hevent_queue {
+	volatile int	head;
+	volatile int	tail;
+	struct	event_node	nodes[C2HEVENT_SZ];
+	unsigned char	seq;
+};
+
+#define NETWORK_QUEUE_SZ	4
+
+struct network_queue {
+	volatile int	head;
+	volatile int	tail;
+	WLAN_BSSID_EX networks[NETWORK_QUEUE_SZ];	
+};
+
+
+#endif // _WLANEVENT_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h
new file mode 100755
index 0000000000000..3cd904df9c7c3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h
@@ -0,0 +1,50 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_HT_H_
+#define _RTW_HT_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include "wifi.h"
+
+struct ht_priv
+{
+	u32	ht_option;	
+	u32	ampdu_enable;//for enable Tx A-MPDU
+	//u8	baddbareq_issued[16];
+	u32	tx_amsdu_enable;//for enable Tx A-MSDU
+	u32	tx_amdsu_maxlen; // 1: 8k, 0:4k ; default:8k, for tx
+	u32	rx_ampdu_maxlen; //for rx reordering ctrl win_sz, updated when join_callback.
+	
+	u8	bwmode;//
+	u8	ch_offset;//PRIME_CHNL_OFFSET
+	u8	sgi;//short GI
+
+	//for processing Tx A-MPDU
+	u8	agg_enable_bitmap;
+	//u8	ADDBA_retry_count;
+	u8	candidate_tid_bitmap;
+
+	struct rtw_ieee80211_ht_cap ht_cap;
+	
+};
+
+#endif	//_RTL871X_HT_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h
new file mode 100755
index 0000000000000..c66845c86b016
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h
@@ -0,0 +1,504 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef _RTW_IO_H_
+#define _RTW_IO_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <osdep_intf.h>
+
+#ifdef PLATFORM_LINUX
+#include <asm/byteorder.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+#include <asm/semaphore.h>
+#else
+#include <linux/semaphore.h>
+#endif
+#include <linux/list.h>
+//#include <linux/smp_lock.h>
+#include <linux/spinlock.h>
+#include <asm/atomic.h>
+
+#ifdef CONFIG_USB_HCI
+#include <linux/usb.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21))
+#include <linux/usb_ch9.h>
+#else
+#include <linux/usb/ch9.h>
+#endif
+#endif //CONFIG_USB_HCI
+
+#endif //PLATFORM_LINUX
+
+
+#define NUM_IOREQ		8
+
+#ifdef PLATFORM_WINDOWS
+#define MAX_PROT_SZ	64
+#endif
+#ifdef PLATFORM_LINUX
+#define MAX_PROT_SZ	(64-16)
+#endif
+
+#define _IOREADY			0
+#define _IO_WAIT_COMPLETE   1
+#define _IO_WAIT_RSP        2
+
+// IO COMMAND TYPE
+#define _IOSZ_MASK_		(0x7F)
+#define _IO_WRITE_		BIT(7)
+#define _IO_FIXED_		BIT(8)
+#define _IO_BURST_		BIT(9)
+#define _IO_BYTE_		BIT(10)
+#define _IO_HW_			BIT(11)
+#define _IO_WORD_		BIT(12)
+#define _IO_SYNC_		BIT(13)
+#define _IO_CMDMASK_	(0x1F80)
+
+
+/* 
+	For prompt mode accessing, caller shall free io_req
+	Otherwise, io_handler will free io_req
+*/
+
+
+
+// IO STATUS TYPE
+#define _IO_ERR_		BIT(2)
+#define _IO_SUCCESS_	BIT(1)
+#define _IO_DONE_		BIT(0)
+
+
+#define IO_RD32			(_IO_SYNC_ | _IO_WORD_)
+#define IO_RD16			(_IO_SYNC_ | _IO_HW_)
+#define IO_RD8			(_IO_SYNC_ | _IO_BYTE_)
+
+#define IO_RD32_ASYNC	(_IO_WORD_)
+#define IO_RD16_ASYNC	(_IO_HW_)
+#define IO_RD8_ASYNC	(_IO_BYTE_)
+
+#define IO_WR32			(_IO_WRITE_ | _IO_SYNC_ | _IO_WORD_)
+#define IO_WR16			(_IO_WRITE_ | _IO_SYNC_ | _IO_HW_)
+#define IO_WR8			(_IO_WRITE_ | _IO_SYNC_ | _IO_BYTE_)
+
+#define IO_WR32_ASYNC	(_IO_WRITE_ | _IO_WORD_)
+#define IO_WR16_ASYNC	(_IO_WRITE_ | _IO_HW_)
+#define IO_WR8_ASYNC	(_IO_WRITE_ | _IO_BYTE_)
+
+/*
+
+	Only Sync. burst accessing is provided.
+
+*/
+
+#define IO_WR_BURST(x)		(_IO_WRITE_ | _IO_SYNC_ | _IO_BURST_ | ( (x) & _IOSZ_MASK_))
+#define IO_RD_BURST(x)		(_IO_SYNC_ | _IO_BURST_ | ( (x) & _IOSZ_MASK_))
+
+
+
+//below is for the intf_option bit defition...
+
+#define _INTF_ASYNC_	BIT(0)	//support async io
+
+struct intf_priv;
+struct intf_hdl;
+struct io_queue;
+
+struct _io_ops
+{
+		u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
+		u16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr);
+		u32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr);
+
+		int (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+		int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+		int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+		int (*_writeN)(struct intf_hdl *pintfhdl, u32 addr, u32 length, u8 *pdata);
+
+		int (*_write8_async)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+		int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+		int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+
+		void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+		void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+
+		void (*_sync_irp_protocol_rw)(struct io_queue *pio_q);
+
+		u32 (*_read_interrupt)(struct intf_hdl *pintfhdl, u32 addr);
+
+		u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+		u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+
+		u32 (*_write_scsi)(struct intf_hdl *pintfhdl,u32 cnt, u8 *pmem);
+
+		void (*_read_port_cancel)(struct intf_hdl *pintfhdl);
+		void (*_write_port_cancel)(struct intf_hdl *pintfhdl);
+		
+};
+
+struct io_req {	
+	_list	list;
+	u32	addr;	
+	volatile u32	val;
+	u32	command;
+	u32	status;
+	u8	*pbuf;	
+	_sema	sema;
+
+#ifdef PLATFORM_OS_CE
+#ifdef CONFIG_USB_HCI
+	// URB handler for rtw_write_mem
+	USB_TRANSFER usb_transfer_write_mem;
+#endif
+#endif
+	
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt);
+	u8 *cnxt;	
+
+#ifdef PLATFORM_OS_XP	
+	PMDL pmdl;
+	PIRP  pirp; 
+
+#ifdef CONFIG_SDIO_HCI
+	PSDBUS_REQUEST_PACKET sdrp;
+#endif	
+
+#endif	
+
+
+};
+
+struct	intf_hdl {
+
+/*	
+	u32	intf_option;
+	u32	bus_status;
+	u32	do_flush;
+	u8	*adapter;
+	u8	*intf_dev;	
+	struct intf_priv	*pintfpriv;
+	u8	cnt;
+	void (*intf_hdl_init)(u8 *priv);
+	void (*intf_hdl_unload)(u8 *priv);
+	void (*intf_hdl_open)(u8 *priv);
+	void (*intf_hdl_close)(u8 *priv);
+	struct	_io_ops	io_ops;
+	//u8 intf_status;//moved to struct intf_priv
+	u16 len;
+	u16 done_len;	
+*/
+	_adapter *padapter;
+	struct dvobj_priv *pintf_dev;//	pointer to &(padapter->dvobjpriv);
+
+	struct _io_ops	io_ops;
+
+};
+
+struct reg_protocol_rd {
+
+#ifdef CONFIG_LITTLE_ENDIAN	
+
+	//DW1
+	u32		NumOfTrans:4;
+	u32		Reserved1:4;
+	u32		Reserved2:24;
+	//DW2
+	u32		ByteCount:7;
+	u32		WriteEnable:1;		//0:read, 1:write
+	u32		FixOrContinuous:1;	//0:continuous, 1: Fix
+	u32		BurstMode:1;
+	u32		Byte1Access:1;
+	u32		Byte2Access:1;
+	u32		Byte4Access:1;
+	u32		Reserved3:3;
+	u32		Reserved4:16;
+	//DW3
+	u32		BusAddress;
+	//DW4
+	//u32		Value;
+#else
+
+
+//DW1
+	u32 Reserved1  :4;
+	u32 NumOfTrans :4;	
+
+	u32 Reserved2  :24;	
+
+	//DW2
+	u32 WriteEnable : 1;
+	u32 ByteCount :7;	
+
+
+	u32 Reserved3 : 3;
+	u32 Byte4Access : 1;	
+
+	u32 Byte2Access : 1;
+	u32 Byte1Access : 1;	
+	u32 BurstMode :1 ;	
+	u32 FixOrContinuous : 1;	
+
+	u32 Reserved4 : 16;
+
+	//DW3
+	u32		BusAddress;
+
+	//DW4
+	//u32		Value;
+
+#endif
+	
+};
+
+
+struct reg_protocol_wt {
+	
+
+#ifdef CONFIG_LITTLE_ENDIAN
+
+	//DW1
+	u32		NumOfTrans:4;
+	u32		Reserved1:4;
+	u32		Reserved2:24;
+	//DW2
+	u32		ByteCount:7;
+	u32		WriteEnable:1;		//0:read, 1:write
+	u32		FixOrContinuous:1;	//0:continuous, 1: Fix
+	u32		BurstMode:1;
+	u32		Byte1Access:1;
+	u32		Byte2Access:1;
+	u32		Byte4Access:1;
+	u32		Reserved3:3;
+	u32		Reserved4:16;
+	//DW3
+	u32		BusAddress;
+	//DW4
+	u32		Value;
+
+#else
+	//DW1
+	u32 Reserved1  :4;
+	u32 NumOfTrans :4;	
+
+	u32 Reserved2  :24;	
+
+	//DW2
+	u32 WriteEnable : 1;
+	u32 ByteCount :7;	
+		
+	u32 Reserved3 : 3;
+	u32 Byte4Access : 1;	
+
+	u32 Byte2Access : 1;
+	u32 Byte1Access : 1;	
+	u32 BurstMode :1 ;	
+	u32 FixOrContinuous : 1;	
+
+	u32 Reserved4 : 16;
+
+	//DW3
+	u32		BusAddress;
+
+	//DW4
+	u32		Value;
+
+#endif
+
+};
+
+
+
+/*
+Below is the data structure used by _io_handler
+
+*/
+
+struct io_queue {	
+	_lock	lock;	
+	_list  	free_ioreqs;	
+	_list		pending;		//The io_req list that will be served in the single protocol read/write.	
+	_list		processing;
+	u8	*free_ioreqs_buf; // 4-byte aligned
+	u8	*pallocated_free_ioreqs_buf;
+	struct	intf_hdl	intf;
+};
+
+struct io_priv{
+	
+	_adapter *padapter;	
+		
+	struct intf_hdl intf;
+
+};
+
+extern uint ioreq_flush(_adapter *adapter, struct io_queue *ioqueue);
+extern void sync_ioreq_enqueue(struct io_req *preq,struct io_queue *ioqueue);
+extern uint sync_ioreq_flush(_adapter *adapter, struct io_queue *ioqueue);
+
+
+extern uint free_ioreq(struct io_req *preq, struct io_queue *pio_queue);
+extern struct io_req *alloc_ioreq(struct io_queue *pio_q);
+
+extern uint register_intf_hdl(u8 *dev, struct intf_hdl *pintfhdl);
+extern void unregister_intf_hdl(struct intf_hdl *pintfhdl);
+
+extern void _rtw_attrib_read(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void _rtw_attrib_write(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+extern u8 _rtw_read8(_adapter *adapter, u32 addr);
+extern u16 _rtw_read16(_adapter *adapter, u32 addr);
+extern u32 _rtw_read32(_adapter *adapter, u32 addr);
+extern void _rtw_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void _rtw_read_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void _rtw_read_port_cancel(_adapter *adapter);
+
+
+extern int _rtw_write8(_adapter *adapter, u32 addr, u8 val);
+extern int _rtw_write16(_adapter *adapter, u32 addr, u16 val);
+extern int _rtw_write32(_adapter *adapter, u32 addr, u32 val);
+extern int _rtw_writeN(_adapter *adapter, u32 addr, u32 length, u8 *pdata);
+
+extern int _rtw_write8_async(_adapter *adapter, u32 addr, u8 val);
+extern int _rtw_write16_async(_adapter *adapter, u32 addr, u16 val);
+extern int _rtw_write32_async(_adapter *adapter, u32 addr, u32 val);
+
+extern void _rtw_write_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern u32 _rtw_write_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+u32 _rtw_write_port_and_wait(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem, int timeout_ms);
+extern void _rtw_write_port_cancel(_adapter *adapter);
+
+#ifdef DBG_IO
+bool match_read_sniff_ranges(u16 addr, u16 len);
+bool match_write_sniff_ranges(u16 addr, u16 len);
+
+extern u8 dbg_rtw_read8(_adapter *adapter, u32 addr, const char *caller, const int line);
+extern u16 dbg_rtw_read16(_adapter *adapter, u32 addr, const char *caller, const int line);
+extern u32 dbg_rtw_read32(_adapter *adapter, u32 addr, const char *caller, const int line);
+
+extern int dbg_rtw_write8(_adapter *adapter, u32 addr, u8 val, const char *caller, const int line);
+extern int dbg_rtw_write16(_adapter *adapter, u32 addr, u16 val, const char *caller, const int line);
+extern int dbg_rtw_write32(_adapter *adapter, u32 addr, u32 val, const char *caller, const int line);
+extern int dbg_rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *data, const char *caller, const int line);
+
+#define rtw_read8(adapter, addr) dbg_rtw_read8((adapter), (addr), __FUNCTION__, __LINE__)
+#define rtw_read16(adapter, addr) dbg_rtw_read16((adapter), (addr), __FUNCTION__, __LINE__)
+#define rtw_read32(adapter, addr) dbg_rtw_read32((adapter), (addr), __FUNCTION__, __LINE__)
+#define rtw_read_mem(adapter, addr, cnt, mem) _rtw_read_mem((adapter), (addr), (cnt), (mem))
+#define rtw_read_port(adapter, addr, cnt, mem) _rtw_read_port((adapter), (addr), (cnt), (mem))
+#define rtw_read_port_cancel(adapter) _rtw_read_port_cancel((adapter))
+
+#define  rtw_write8(adapter, addr, val) dbg_rtw_write8((adapter), (addr), (val), __FUNCTION__, __LINE__)
+#define  rtw_write16(adapter, addr, val) dbg_rtw_write16((adapter), (addr), (val), __FUNCTION__, __LINE__)
+#define  rtw_write32(adapter, addr, val) dbg_rtw_write32((adapter), (addr), (val), __FUNCTION__, __LINE__)
+#define  rtw_writeN(adapter, addr, length, data) dbg_rtw_writeN((adapter), (addr), (length), (data), __FUNCTION__, __LINE__)
+
+#define rtw_write8_async(adapter, addr, val) _rtw_write8_async((adapter), (addr), (val))
+#define rtw_write16_async(adapter, addr, val) _rtw_write16_async((adapter), (addr), (val))
+#define rtw_write32_async(adapter, addr, val) _rtw_write32_async((adapter), (addr), (val))
+
+#define rtw_write_mem(adapter, addr, cnt, mem) _rtw_write_mem((adapter), addr, cnt, mem)
+#define rtw_write_port(adapter, addr, cnt, mem) _rtw_write_port(adapter, addr, cnt, mem)
+#define rtw_write_port_and_wait(adapter, addr, cnt, mem, timeout_ms) _rtw_write_port_and_wait((adapter), (addr), (cnt), (mem), (timeout_ms))
+#define rtw_write_port_cancel(adapter) _rtw_write_port_cancel(adapter)
+#else //DBG_IO
+#define rtw_read8(adapter, addr) _rtw_read8((adapter), (addr))
+#define rtw_read16(adapter, addr) _rtw_read16((adapter), (addr))
+#define rtw_read32(adapter, addr) _rtw_read32((adapter), (addr))
+#define rtw_read_mem(adapter, addr, cnt, mem) _rtw_read_mem((adapter), (addr), (cnt), (mem))
+#define rtw_read_port(adapter, addr, cnt, mem) _rtw_read_port((adapter), (addr), (cnt), (mem))
+#define rtw_read_port_cancel(adapter) _rtw_read_port_cancel((adapter))
+
+#define  rtw_write8(adapter, addr, val) _rtw_write8((adapter), (addr), (val))
+#define  rtw_write16(adapter, addr, val) _rtw_write16((adapter), (addr), (val))
+#define  rtw_write32(adapter, addr, val) _rtw_write32((adapter), (addr), (val))
+#define  rtw_writeN(adapter, addr, length, data) _rtw_writeN((adapter), (addr), (length), (data))
+
+#define rtw_write8_async(adapter, addr, val) _rtw_write8_async((adapter), (addr), (val))
+#define rtw_write16_async(adapter, addr, val) _rtw_write16_async((adapter), (addr), (val))
+#define rtw_write32_async(adapter, addr, val) _rtw_write32_async((adapter), (addr), (val))
+
+#define rtw_write_mem(adapter, addr, cnt, mem) _rtw_write_mem((adapter), (addr), (cnt), (mem))
+#define rtw_write_port(adapter, addr, cnt, mem) _rtw_write_port((adapter), (addr), (cnt), (mem))
+#define rtw_write_port_and_wait(adapter, addr, cnt, mem, timeout_ms) _rtw_write_port_and_wait((adapter), (addr), (cnt), (mem), (timeout_ms))
+#define rtw_write_port_cancel(adapter) _rtw_write_port_cancel((adapter))
+#endif //DBG_IO
+
+extern void rtw_write_scsi(_adapter *adapter, u32 cnt, u8 *pmem);
+
+//ioreq 
+extern void ioreq_read8(_adapter *adapter, u32 addr, u8 *pval);
+extern void ioreq_read16(_adapter *adapter, u32 addr, u16 *pval);	
+extern void ioreq_read32(_adapter *adapter, u32 addr, u32 *pval);
+extern void ioreq_write8(_adapter *adapter, u32 addr, u8 val);
+extern void ioreq_write16(_adapter *adapter, u32 addr, u16 val);
+extern void ioreq_write32(_adapter *adapter, u32 addr, u32 val);
+
+
+extern uint async_read8(_adapter *adapter, u32 addr, u8 *pbuff,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt); 
+extern uint async_read16(_adapter *adapter, u32 addr,  u8 *pbuff,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt); 
+extern uint async_read32(_adapter *adapter, u32 addr,  u8 *pbuff,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt); 
+
+extern void async_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void async_read_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+extern void async_write8(_adapter *adapter, u32 addr, u8 val,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+extern void async_write16(_adapter *adapter, u32 addr, u16 val,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+extern void async_write32(_adapter *adapter, u32 addr, u32 val,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+
+extern void async_write_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void async_write_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+
+int rtw_init_io_priv(_adapter *padapter, void (*set_intf_ops)(struct _io_ops *pops));
+
+
+extern uint alloc_io_queue(_adapter *adapter);
+extern void free_io_queue(_adapter *adapter);
+extern void async_bus_io(struct io_queue *pio_q);
+extern void bus_sync_io(struct io_queue *pio_q);
+extern u32 _ioreq2rwmem(struct io_queue *pio_q);
+extern void dev_power_down(_adapter * Adapter, u8 bpwrup);
+
+/*
+#define RTL_R8(reg)		rtw_read8(padapter, reg)
+#define RTL_R16(reg)            rtw_read16(padapter, reg)
+#define RTL_R32(reg)            rtw_read32(padapter, reg)
+#define RTL_W8(reg, val8)       rtw_write8(padapter, reg, val8)
+#define RTL_W16(reg, val16)     rtw_write16(padapter, reg, val16)
+#define RTL_W32(reg, val32)     rtw_write32(padapter, reg, val32)
+*/
+
+/*
+#define RTL_W8_ASYNC(reg, val8) rtw_write32_async(padapter, reg, val8)
+#define RTL_W16_ASYNC(reg, val16) rtw_write32_async(padapter, reg, val16)
+#define RTL_W32_ASYNC(reg, val32) rtw_write32_async(padapter, reg, val32)
+
+#define RTL_WRITE_BB(reg, val32)	phy_SetUsbBBReg(padapter, reg, val32)
+#define RTL_READ_BB(reg)	phy_QueryUsbBBReg(padapter, reg)
+*/
+
+#endif	//_RTL8711_IO_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h
new file mode 100755
index 0000000000000..c4da30199b521
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h
@@ -0,0 +1,269 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_IOCTL_H_
+#define _RTW_IOCTL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifndef OID_802_11_CAPABILITY
+	#define OID_802_11_CAPABILITY                   0x0d010122
+#endif
+
+#ifndef OID_802_11_PMKID
+	#define OID_802_11_PMKID                        0x0d010123
+#endif
+
+
+// For DDK-defined OIDs
+#define OID_NDIS_SEG1	0x00010100
+#define OID_NDIS_SEG2	0x00010200
+#define OID_NDIS_SEG3	0x00020100
+#define OID_NDIS_SEG4	0x01010100
+#define OID_NDIS_SEG5	0x01020100
+#define OID_NDIS_SEG6	0x01020200
+#define OID_NDIS_SEG7	0xFD010100
+#define OID_NDIS_SEG8	0x0D010100
+#define OID_NDIS_SEG9	0x0D010200
+#define OID_NDIS_SEG10	0x0D020200
+
+#define SZ_OID_NDIS_SEG1		  23
+#define SZ_OID_NDIS_SEG2		    3
+#define SZ_OID_NDIS_SEG3		    6
+#define SZ_OID_NDIS_SEG4		    6
+#define SZ_OID_NDIS_SEG5		    4
+#define SZ_OID_NDIS_SEG6		    8
+#define SZ_OID_NDIS_SEG7		    7
+#define SZ_OID_NDIS_SEG8		  36
+#define SZ_OID_NDIS_SEG9		  24
+#define SZ_OID_NDIS_SEG10		  19
+
+// For Realtek-defined OIDs
+#define OID_MP_SEG1		0xFF871100
+#define OID_MP_SEG2		0xFF818000
+
+#define OID_MP_SEG3		0xFF818700
+#define OID_MP_SEG4		0xFF011100
+
+#define DEBUG_OID(dbg, str)     		\
+       if((!dbg))				    			\
+      	{					    			\
+	   RT_TRACE(_module_rtl871x_ioctl_c_,_drv_info_,("%s(%d): %s", __FUNCTION__, __LINE__, str));	\
+      	}			
+
+
+enum oid_type
+{
+	QUERY_OID,
+	SET_OID
+};
+
+struct oid_funs_node {
+	unsigned int oid_start; //the starting number for OID
+	unsigned int oid_end; //the ending number for OID
+	struct oid_obj_priv *node_array; 
+	unsigned int array_sz; //the size of node_array
+	int query_counter; //count the number of query hits for this segment  
+	int set_counter; //count the number of set hits for this segment  
+};
+
+struct oid_par_priv
+{
+	void		*adapter_context;
+	NDIS_OID	oid;
+	void		*information_buf;
+	u32		information_buf_len;
+	u32		*bytes_rw;
+	u32		*bytes_needed;
+	enum oid_type	type_of_oid;
+	u32		dbg;
+};
+
+struct oid_obj_priv {
+	unsigned char	dbg; // 0: without OID debug message  1: with OID debug message 
+	NDIS_STATUS (*oidfuns)(struct oid_par_priv *poid_par_priv);	
+};
+
+#if (defined(CONFIG_MP_INCLUDED) && defined(_RTW_MP_IOCTL_C_)) || \
+	(defined(PLATFORM_WINDOWS) && defined(_RTW_IOCTL_RTL_C_))
+static NDIS_STATUS oid_null_function(struct oid_par_priv* poid_par_priv)
+{
+	_func_enter_;
+	_func_exit_;
+	return NDIS_STATUS_SUCCESS;
+}
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+int TranslateNdisPsToRtPs(IN NDIS_802_11_POWER_MODE	ndisPsMode);
+
+//OID Handler for Segment 1
+NDIS_STATUS oid_gen_supported_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_hardware_status_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_media_supported_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_media_in_use_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_lookahead_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_frame_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_link_speed_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_transmit_buffer_space_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_receive_buffer_space_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_transmit_block_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_receive_block_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_vendor_id_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_vendor_description_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_current_packet_filter_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_current_lookahead_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_driver_version_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_total_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_protocol_options_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_mac_options_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_media_connect_status_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_send_packets_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_vendor_driver_version_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 2
+NDIS_STATUS oid_gen_physical_medium_hdl(struct oid_par_priv* poid_par_priv);
+
+//OID Handler for Segment 3
+NDIS_STATUS oid_gen_xmit_ok_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_rcv_ok_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_xmit_error_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_rcv_error_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_rcv_no_buffer_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 4
+NDIS_STATUS oid_802_3_permanent_address_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_current_address_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_multicast_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_maximum_list_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_mac_options_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+//OID Handler for Segment 5
+NDIS_STATUS oid_802_3_rcv_error_alignment_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_one_collision_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_more_collisions_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 6
+NDIS_STATUS oid_802_3_xmit_deferred_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_max_collisions_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_rcv_overrun_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_underrun_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_heartbeat_failure_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_times_crs_lost_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_late_collisions_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+//OID Handler for Segment 7
+NDIS_STATUS oid_pnp_capabilities_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_set_power_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_query_power_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_add_wake_up_pattern_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_remove_wake_up_pattern_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_wake_up_pattern_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_enable_wake_up_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+//OID Handler for Segment 8
+NDIS_STATUS oid_802_11_bssid_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_ssid_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_infrastructure_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_add_wep_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_remove_wep_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_disassociate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_authentication_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_privacy_filter_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_bssid_list_scan_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_encryption_status_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_reload_defaults_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_add_key_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_remove_key_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_association_information_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_test_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_media_stream_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_capability_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_pmkid_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+
+
+//OID Handler for Segment 9
+NDIS_STATUS oid_802_11_network_types_supported_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_network_type_in_use_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_tx_power_level_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rssi_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rssi_trigger_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_fragmentation_threshold_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rts_threshold_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_number_of_antennas_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rx_antenna_selected_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_tx_antenna_selected_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_supported_rates_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_desired_rates_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_configuration_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_power_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_bssid_list_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 10
+NDIS_STATUS oid_802_11_statistics_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment ED 
+NDIS_STATUS oid_rt_mh_vender_id_hdl(struct oid_par_priv* poid_par_priv);
+
+void Set_802_3_MULTICAST_LIST(ADAPTER *pAdapter, UCHAR *MCListbuf, ULONG MCListlen, BOOLEAN bAcceptAllMulticast);
+
+#endif// end of PLATFORM_WINDOWS
+
+
+#if defined(PLATFORM_LINUX) && defined(CONFIG_WIRELESS_EXT)
+extern struct iw_handler_def  rtw_handlers_def;
+#endif
+
+extern	NDIS_STATUS drv_query_info(
+	IN	_nic_hdl		MiniportAdapterContext,
+	IN	NDIS_OID		Oid,
+	IN	void *			InformationBuffer,
+	IN	u32			InformationBufferLength,
+	OUT	u32*			BytesWritten,
+	OUT	u32*			BytesNeeded
+	);
+
+extern	NDIS_STATUS 	drv_set_info(
+	IN	_nic_hdl		MiniportAdapterContext,
+	IN	NDIS_OID		Oid,
+	IN	void *			InformationBuffer,
+	IN	u32			InformationBufferLength,
+	OUT	u32*			BytesRead,
+	OUT	u32*			BytesNeeded
+	);
+
+#endif // #ifndef __INC_CEINFO_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h
new file mode 100755
index 0000000000000..5b6018af5653a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h
@@ -0,0 +1,36 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_IOCTL_QUERY_H_
+#define _RTW_IOCTL_QUERY_H_
+
+#include <drv_conf.h>
+#include <drv_types.h>
+
+
+#ifdef PLATFORM_WINDOWS
+
+u8 query_802_11_capability(_adapter*	padapter,u8*	pucBuf,u32 *	pulOutLen);
+u8 query_802_11_association_information (_adapter * padapter, PNDIS_802_11_ASSOCIATION_INFORMATION pAssocInfo);
+
+#endif
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h
new file mode 100755
index 0000000000000..3bff766513bde
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h
@@ -0,0 +1,83 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_IOCTL_RTL_H_
+#define _RTW_IOCTL_RTL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+//************** oid_rtl_seg_01_01 ************** 
+NDIS_STATUS oid_rt_get_signal_quality_hdl(struct oid_par_priv* poid_par_priv);//84
+NDIS_STATUS oid_rt_get_small_packet_crc_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_large_packet_crc_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_tx_retry_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_rx_retry_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_rx_total_packet_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_set_fw_dig_state_hdl(struct oid_par_priv* poid_par_priv);	//8a
+NDIS_STATUS oid_rt_pro_set_fw_ra_state_hdl(struct oid_par_priv* poid_par_priv);	//8b
+
+NDIS_STATUS oid_rt_get_rx_icv_err_hdl(struct oid_par_priv* poid_par_priv);//93
+NDIS_STATUS oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_preamble_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_ap_ip_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_channelplan_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_channelplan_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_preamble_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_bcn_intvl_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_dedicate_probe_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_current_tx_power_level_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_channel_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_key_mismatch_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_supported_wireless_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_channel_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_scan_in_progress_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_forced_data_rate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv* poid_par_priv);
+
+//**************  oid_rtl_seg_01_03 section start ************** 
+NDIS_STATUS oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_ap_supported_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_ap_set_passphrase_hdl(struct oid_par_priv* poid_par_priv);
+
+// oid_rtl_seg_01_11 
+NDIS_STATUS oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv* poid_par_priv);
+
+//**************  oid_rtl_seg_03_00 section start **************  
+NDIS_STATUS oid_rt_get_connect_state_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_default_key_id_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h
new file mode 100755
index 0000000000000..31d9cf66aee9b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h
@@ -0,0 +1,79 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_IOCTL_SET_H_
+#define __RTW_IOCTL_SET_H_
+
+#include <drv_conf.h>
+#include <drv_types.h>
+
+
+typedef u8 NDIS_802_11_PMKID_VALUE[16];
+
+typedef struct _BSSIDInfo {
+	NDIS_802_11_MAC_ADDRESS  BSSID;
+	NDIS_802_11_PMKID_VALUE  PMKID;
+} BSSIDInfo, *PBSSIDInfo;
+
+
+#ifdef PLATFORM_OS_XP
+typedef struct _NDIS_802_11_PMKID {
+	u32	Length;
+	u32	BSSIDInfoCount;
+	BSSIDInfo BSSIDInfo[1];
+} NDIS_802_11_PMKID, *PNDIS_802_11_PMKID;
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+u8 rtw_set_802_11_reload_defaults(_adapter * padapter, NDIS_802_11_RELOAD_DEFAULTS reloadDefaults);
+u8 rtw_set_802_11_test(_adapter * padapter, NDIS_802_11_TEST * test);
+u8 rtw_set_802_11_pmkid(_adapter *pdapter, NDIS_802_11_PMKID *pmkid);
+
+u8 rtw_pnp_set_power_sleep(_adapter* padapter);
+u8 rtw_pnp_set_power_wakeup(_adapter* padapter);
+
+void rtw_pnp_resume_wk(void *context);
+void rtw_pnp_sleep_wk(void * context);
+
+#endif
+
+u8 rtw_set_802_11_add_key(_adapter * padapter, NDIS_802_11_KEY * key);
+u8 rtw_set_802_11_authentication_mode(_adapter *pdapter, NDIS_802_11_AUTHENTICATION_MODE authmode);
+u8 rtw_set_802_11_bssid(_adapter* padapter, u8 *bssid);
+u8 rtw_set_802_11_add_wep(_adapter * padapter, NDIS_802_11_WEP * wep);
+u8 rtw_set_802_11_disassociate(_adapter * padapter);
+u8 rtw_set_802_11_bssid_list_scan(_adapter* padapter, NDIS_802_11_SSID *pssid, int ssid_max_num);
+u8 rtw_set_802_11_infrastructure_mode(_adapter * padapter, NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
+u8 rtw_set_802_11_remove_wep(_adapter * padapter, u32 keyindex);
+u8 rtw_set_802_11_ssid(_adapter * padapter, NDIS_802_11_SSID * ssid);
+u8 rtw_set_802_11_connect(_adapter *padapter, const u8 *bssid, NDIS_802_11_SSID *ssid);
+u8 rtw_set_802_11_remove_key(_adapter * padapter, NDIS_802_11_REMOVE_KEY * key);
+
+u8 rtw_validate_bssid(const u8 *bssid);
+u8 rtw_validate_ssid(NDIS_802_11_SSID *ssid);
+
+u16 rtw_get_cur_max_rate(_adapter *adapter);
+int rtw_set_scan_mode(_adapter *adapter, RT_SCAN_TYPE scan_mode);
+int rtw_set_channel_plan(_adapter *adapter, u8 channel_plan);
+int rtw_set_country(_adapter *adapter, const char *country_code);
+int rtw_set_band(_adapter *adapter, enum _BAND band);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h
new file mode 100755
index 0000000000000..45fa5a22554ed
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h
@@ -0,0 +1,89 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_IOL_H_
+#define __RTW_IOL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+typedef struct _io_offload_cmd {
+	u8 rsvd0;
+	u8 cmd;
+	u16 address;
+	u32 value;
+} IO_OFFLOAD_CMD, IOL_CMD;
+
+#define IOL_CMD_LLT			0x00
+//#define IOL_CMD_R_EFUSE	0x01
+#define IOL_CMD_WB_REG		0x02
+#define IOL_CMD_WW_REG 	0x03
+#define IOL_CMD_WD_REG		0x04
+//#define IOL_CMD_W_RF		0x05
+#define IOL_CMD_DELAY_US	0x80
+#define IOL_CMD_DELAY_MS	0x81
+//#define IOL_CMD_DELAY_S	0x82
+#define IOL_CMD_END			0x83
+
+/*****************************************************
+CMD					Address			Value
+(B1)					(B2/B3:H/L addr)	(B4:B7 : MSB:LSB)
+******************************************************
+IOL_CMD_LLT			-				B7: PGBNDY
+//IOL_CMD_R_EFUSE	-				-
+IOL_CMD_WB_REG		0x0~0xFFFF		B7
+IOL_CMD_WW_REG	0x0~0xFFFF		B6~B7
+IOL_CMD_WD_REG	0x0~0xFFFF		B4~B7
+//IOL_CMD_W_RF		RF Reg			B5~B7
+IOL_CMD_DELAY_US	-				B6~B7
+IOL_CMD_DELAY_MS	-				B6~B7
+//IOL_CMD_DELAY_S	-				B6~B7
+IOL_CMD_END		-				-
+******************************************************/
+
+struct xmit_frame	*rtw_IOL_accquire_xmit_frame(ADAPTER *adapter);
+int rtw_IOL_append_cmds(struct xmit_frame *xmit_frame, u8 *IOL_cmds, u32 cmd_len);
+int rtw_IOL_append_LLT_cmd(struct xmit_frame *xmit_frame, u8 page_boundary);
+int _rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value);
+int _rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value);
+int _rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value);
+int rtw_IOL_append_DELAY_US_cmd(struct xmit_frame *xmit_frame, u16 us);
+int rtw_IOL_append_DELAY_MS_cmd(struct xmit_frame *xmit_frame, u16 ms);
+int rtw_IOL_append_END_cmd(struct xmit_frame *xmit_frame);
+int rtw_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+int rtw_IOL_exec_cmd_array_sync(PADAPTER adapter, u8 *IOL_cmds, u32 cmd_num, u32 max_wating_ms);
+int rtw_IOL_exec_empty_cmds_sync(ADAPTER *adapter, u32 max_wating_ms);
+
+#ifdef DBG_IO
+int dbg_rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value, const char *caller, const int line);
+int dbg_rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value, const char *caller, const int line);
+int dbg_rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value, const char *caller, const int line);
+#define rtw_IOL_append_WB_cmd(xmit_frame, addr, value) dbg_rtw_IOL_append_WB_cmd((xmit_frame), (addr), (value), __FUNCTION__, __LINE__)
+#define rtw_IOL_append_WW_cmd(xmit_frame, addr, value) dbg_rtw_IOL_append_WW_cmd((xmit_frame), (addr), (value), __FUNCTION__, __LINE__)
+#define rtw_IOL_append_WD_cmd(xmit_frame, addr, value) dbg_rtw_IOL_append_WD_cmd((xmit_frame), (addr), (value), __FUNCTION__, __LINE__)
+#else
+#define rtw_IOL_append_WB_cmd(xmit_frame, addr, value) _rtw_IOL_append_WB_cmd((xmit_frame), (addr), (value))
+#define rtw_IOL_append_WW_cmd(xmit_frame, addr, value) _rtw_IOL_append_WW_cmd((xmit_frame), (addr), (value))
+#define rtw_IOL_append_WD_cmd(xmit_frame, addr, value) _rtw_IOL_append_WD_cmd((xmit_frame), (addr), (value))
+#endif
+
+bool rtw_IOL_applied(ADAPTER *adapter);
+
+#endif //__RTW_IOL_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h
new file mode 100755
index 0000000000000..b5365ba3743d2
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h
@@ -0,0 +1,217 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_LED_H_
+#define __RTW_LED_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#define MSECS(t)        (HZ * ((t) / 1000) + (HZ * ((t) % 1000)) / 1000)
+
+typedef enum _LED_CTL_MODE{
+        LED_CTL_POWER_ON = 1,
+        LED_CTL_LINK = 2,
+        LED_CTL_NO_LINK = 3,
+        LED_CTL_TX = 4,
+        LED_CTL_RX = 5,
+        LED_CTL_SITE_SURVEY = 6,
+        LED_CTL_POWER_OFF = 7,
+        LED_CTL_START_TO_LINK = 8,
+        LED_CTL_START_WPS = 9,
+        LED_CTL_STOP_WPS = 10,
+        LED_CTL_START_WPS_BOTTON = 11, //added for runtop
+        LED_CTL_STOP_WPS_FAIL = 12, //added for ALPHA	
+	 LED_CTL_STOP_WPS_FAIL_OVERLAP = 13, //added for BELKIN
+}LED_CTL_MODE;
+
+
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+//================================================================================
+// LED object.
+//================================================================================
+
+typedef enum _LED_STATE_871x{
+	LED_UNKNOWN = 0,
+	RTW_LED_ON = 1,
+	RTW_LED_OFF = 2,
+	LED_BLINK_NORMAL = 3,
+	LED_BLINK_SLOWLY = 4,
+	LED_POWER_ON_BLINK = 5,
+	LED_SCAN_BLINK = 6, // LED is blinking during scanning period, the # of times to blink is depend on time for scanning.
+	LED_NO_LINK_BLINK = 7, // LED is blinking during no link state.
+	LED_BLINK_StartToBlink = 8,// Customzied for Sercomm Printer Server case
+	LED_BLINK_WPS = 9,	// LED is blinkg during WPS communication	
+	LED_TXRX_BLINK = 10,
+	LED_BLINK_WPS_STOP = 11,	//for ALPHA	
+	LED_BLINK_WPS_STOP_OVERLAP = 12,	//for BELKIN
+}LED_STATE_871x;
+
+#define IS_LED_WPS_BLINKING(_LED_871x)	(((PLED_871x)_LED_871x)->CurrLedState==LED_BLINK_WPS \
+					|| ((PLED_871x)_LED_871x)->CurrLedState==LED_BLINK_WPS_STOP \
+					|| ((PLED_871x)_LED_871x)->bLedWPSBlinkInProgress)
+
+#define IS_LED_BLINKING(_LED_871x) 	(((PLED_871x)_LED_871x)->bLedWPSBlinkInProgress \
+					||((PLED_871x)_LED_871x)->bLedScanBlinkInProgress)
+
+typedef enum _LED_PIN_871x{
+	LED_PIN_GPIO0,
+	LED_PIN_LED0,
+	LED_PIN_LED1
+}LED_PIN_871x;
+
+typedef struct _LED_871x{
+	_adapter				*padapter;
+	LED_PIN_871x		LedPin;	// Identify how to implement this SW led.
+	LED_STATE_871x		CurrLedState; // Current LED state.
+	u8					bLedOn; // true if LED is ON, false if LED is OFF.
+
+	u8					bSWLedCtrl;
+
+	u8					bLedBlinkInProgress; // true if it is blinking, false o.w..
+	// ALPHA, added by chiyoko, 20090106
+	u8					bLedNoLinkBlinkInProgress;
+	u8					bLedLinkBlinkInProgress;
+	u8					bLedStartToLinkBlinkInProgress;
+	u8					bLedScanBlinkInProgress;
+	u8					bLedWPSBlinkInProgress;
+	
+	u32					BlinkTimes; // Number of times to toggle led state for blinking.
+	LED_STATE_871x		BlinkingLedState; // Next state for blinking, either RTW_LED_ON or RTW_LED_OFF are.
+
+	_timer				BlinkTimer; // Timer object for led blinking.
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,5,0)|| defined PLATFORM_FREEBSD
+	_workitem			BlinkWorkItem; // Workitem used by BlinkTimer to manipulate H/W to blink LED.
+#endif
+} LED_871x, *PLED_871x;
+
+
+//================================================================================
+// LED customization.
+//================================================================================
+
+typedef	enum _LED_STRATEGY_871x{
+	SW_LED_MODE0, // SW control 1 LED via GPIO0. It is default option.
+	SW_LED_MODE1, // 2 LEDs, through LED0 and LED1. For ALPHA.
+	SW_LED_MODE2, // SW control 1 LED via GPIO0, customized for AzWave 8187 minicard.
+	SW_LED_MODE3, // SW control 1 LED via GPIO0, customized for Sercomm Printer Server case.
+	SW_LED_MODE4, //for Edimax / Belkin
+	SW_LED_MODE5, //for Sercomm / Belkin
+	SW_LED_MODE6, //for 88CU minicard, porting from ce SW_LED_MODE7
+	HW_LED, // HW control 2 LEDs, LED0 and LED1 (there are 4 different control modes, see MAC.CONFIG1 for details.)
+}LED_STRATEGY_871x, *PLED_STRATEGY_871x;
+#endif //CONFIG_USB_HCI
+
+#ifdef CONFIG_PCI_HCI
+//================================================================================
+// LED object.
+//================================================================================
+
+typedef	enum _LED_STATE_871x{
+	LED_UNKNOWN = 0,
+	RTW_LED_ON = 1,
+	RTW_LED_OFF = 2,
+	LED_BLINK_NORMAL = 3,
+	LED_BLINK_SLOWLY = 4,
+	LED_POWER_ON_BLINK = 5,
+	LED_SCAN_BLINK = 6, // LED is blinking during scanning period, the # of times to blink is depend on time for scanning.
+	LED_NO_LINK_BLINK = 7, // LED is blinking during no link state.
+	LED_BLINK_StartToBlink = 8, 
+	LED_BLINK_TXRX = 9,
+	LED_BLINK_RUNTOP = 10, // Customized for RunTop
+	LED_BLINK_CAMEO = 11,
+}LED_STATE_871x;
+
+typedef enum _LED_PIN_871x{
+	LED_PIN_GPIO0,
+	LED_PIN_LED0,
+	LED_PIN_LED1,
+	LED_PIN_LED2
+}LED_PIN_871x;
+
+typedef struct _LED_871x{
+	_adapter				*padapter;
+
+	LED_PIN_871x		LedPin;	// Identify how to implement this SW led.
+
+	LED_STATE_871x		CurrLedState; // Current LED state.
+	u8					bLedOn; // TRUE if LED is ON, FALSE if LED is OFF.
+
+	u8					bLedBlinkInProgress; // TRUE if it is blinking, FALSE o.w..
+	u8					bLedWPSBlinkInProgress; // TRUE if it is blinking, FALSE o.w..
+
+	u8					bLedSlowBlinkInProgress;//added by vivi, for led new mode
+	u32					BlinkTimes; // Number of times to toggle led state for blinking.
+	LED_STATE_871x		BlinkingLedState; // Next state for blinking, either RTW_LED_ON or RTW_LED_OFF are.
+
+	_timer				BlinkTimer; // Timer object for led blinking.
+	
+	u8					bLedLinkBlinkInProgress;
+	u8					bLedNoLinkBlinkInProgress;
+	u8 					bLedScanBlinkInProgress;
+} LED_871x, *PLED_871x;
+
+
+//================================================================================
+// LED customization.
+//================================================================================
+
+typedef	enum _LED_STRATEGY_871x{
+	SW_LED_MODE0, // SW control 1 LED via GPIO0. It is default option.
+	SW_LED_MODE1, // SW control for PCI Express
+	SW_LED_MODE2, // SW control for Cameo.
+	SW_LED_MODE3, // SW contorl for RunTop.
+	SW_LED_MODE4, // SW control for Netcore
+	SW_LED_MODE5, //added by vivi, for led new mode, DLINK
+	SW_LED_MODE6, //added by vivi, for led new mode, PRONET
+	SW_LED_MODE7, //added by chiyokolin, for Lenovo, PCI Express Minicard Spec Rev.1.2 spec
+	SW_LED_MODE8, //added by chiyokolin, for QMI
+	SW_LED_MODE9, //added by chiyokolin, for BITLAND, PCI Express Minicard Spec Rev.1.1 
+	SW_LED_MODE10, //added by chiyokolin, for Edimax-ASUS
+	HW_LED, // HW control 2 LEDs, LED0 and LED1 (there are 4 different control modes)
+}LED_STRATEGY_871x, *PLED_STRATEGY_871x;
+
+#define LED_CM8_BLINK_INTERVAL		500	//for QMI
+#endif //CONFIG_PCI_HCI
+
+struct led_priv{
+	/* add for led controll */
+	LED_871x			SwLed0;
+	LED_871x			SwLed1;
+	LED_STRATEGY_871x	LedStrategy;
+	u8					bRegUseLed;
+	void (*LedControlHandler)(_adapter *padapter, LED_CTL_MODE LedAction);
+	/* add for led controll */
+};
+
+#ifdef CONFIG_SW_LED
+#define rtw_led_control(adapter, LedAction) \
+	do { \
+		if((adapter)->ledpriv.LedControlHandler) \
+			(adapter)->ledpriv.LedControlHandler((adapter), (LedAction)); \
+	} while(0)
+#else //CONFIG_SW_LED
+#define rtw_led_control(adapter, LedAction)
+#endif //CONFIG_SW_LED
+
+extern void BlinkHandler(PLED_871x	 pLed);
+
+#endif //__RTW_LED_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h
new file mode 100755
index 0000000000000..60e2ad6491682
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h
@@ -0,0 +1,850 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_MLME_H_
+#define __RTW_MLME_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <mlme_osdep.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+
+#ifdef CONFIG_INTEL_WIDI
+#include <rtw_intel_widi.h>
+#endif
+
+#define	MAX_BSS_CNT	128
+//#define   MAX_JOIN_TIMEOUT	2000
+//#define   MAX_JOIN_TIMEOUT	2500
+#define   MAX_JOIN_TIMEOUT	6500
+
+//	Commented by Albert 20101105
+//	Increase the scanning timeout because of increasing the SURVEY_TO value.
+
+#define 	SCANNING_TIMEOUT 	8000
+
+#define	SCAN_INTERVAL	(30) // unit:2sec, 30*2=60sec
+
+#ifdef PALTFORM_OS_WINCE
+#define	SCANQUEUE_LIFETIME 12000000 // unit:us
+#else
+#define	SCANQUEUE_LIFETIME 20 // unit:sec
+#endif
+
+#define 	WIFI_NULL_STATE			0x00000000
+
+#define	WIFI_ASOC_STATE			0x00000001		// Under Linked state...
+#define 	WIFI_REASOC_STATE	       	0x00000002
+#define	WIFI_SLEEP_STATE			0x00000004
+#define	WIFI_STATION_STATE		0x00000008
+
+#define	WIFI_AP_STATE				0x00000010
+#define	WIFI_ADHOC_STATE			0x00000020
+#define   WIFI_ADHOC_MASTER_STATE 0x00000040
+#define   WIFI_UNDER_LINKING		0x00000080
+
+#define	WIFI_UNDER_WPS			0x00000100
+//#define	WIFI_UNDER_CMD			0x00000200
+//#define	WIFI_UNDER_P2P			0x00000400
+#define	WIFI_STA_ALIVE_CHK_STATE	0x00000400
+#define	WIFI_SITE_MONITOR			0x00000800		//to indicate the station is under site surveying
+
+#ifdef WDS
+#define	WIFI_WDS					0x00001000
+#define	WIFI_WDS_RX_BEACON		0x00002000		// already rx WDS AP beacon
+#endif
+#ifdef AUTO_CONFIG
+#define	WIFI_AUTOCONF				0x00004000
+#define	WIFI_AUTOCONF_IND		0x00008000
+#endif
+
+/*
+// ========== P2P Section Start ===============
+#define	WIFI_P2P_LISTEN_STATE		0x00010000
+#define	WIFI_P2P_GROUP_FORMATION_STATE		0x00020000
+// ========== P2P Section End ===============
+*/
+
+//#ifdef UNDER_MPTEST
+#define	WIFI_MP_STATE							0x00010000
+#define	WIFI_MP_CTX_BACKGROUND				0x00020000	// in continous tx background
+#define	WIFI_MP_CTX_ST						0x00040000	// in continous tx with single-tone
+#define	WIFI_MP_CTX_BACKGROUND_PENDING	0x00080000	// pending in continous tx background due to out of skb
+#define	WIFI_MP_CTX_CCK_HW					0x00100000	// in continous tx
+#define	WIFI_MP_CTX_CCK_CS					0x00200000	// in continous tx with carrier suppression
+#define   WIFI_MP_LPBK_STATE					0x00400000
+//#endif
+
+//#define _FW_UNDER_CMD		WIFI_UNDER_CMD
+#define _FW_UNDER_LINKING	WIFI_UNDER_LINKING
+#define _FW_LINKED			WIFI_ASOC_STATE
+#define _FW_UNDER_SURVEY	WIFI_SITE_MONITOR
+
+
+enum dot11AuthAlgrthmNum {
+ dot11AuthAlgrthm_Open = 0,
+ dot11AuthAlgrthm_Shared,
+ dot11AuthAlgrthm_8021X,
+ dot11AuthAlgrthm_Auto,
+ dot11AuthAlgrthm_MaxNum
+};
+
+// Scan type including active and passive scan.
+typedef enum _RT_SCAN_TYPE
+{
+	SCAN_PASSIVE,
+	SCAN_ACTIVE,
+	SCAN_MIX,
+}RT_SCAN_TYPE, *PRT_SCAN_TYPE;
+
+enum DriverInterface {
+	DRIVER_WEXT =  1,
+	DRIVER_CFG80211 = 2
+};
+
+enum  _BAND
+{
+	GHZ24_50 = 0,
+	GHZ_50,
+	GHZ_24,
+	GHZ_MAX,
+};
+
+#define rtw_band_valid(band) ((band) >= GHZ24_50 && (band) < GHZ_MAX)
+
+enum SCAN_RESULT_TYPE
+{
+	SCAN_RESULT_P2P_ONLY = 0,		//	Will return all the P2P devices.
+	SCAN_RESULT_ALL = 1,			//	Will return all the scanned device, include AP.
+	SCAN_RESULT_WFD_TYPE = 2		//	Will just return the correct WFD device.
+									//	If this device is Miracast sink device, it will just return all the Miracast source devices.
+};
+
+/*
+
+there are several "locks" in mlme_priv,
+since mlme_priv is a shared resource between many threads,
+like ISR/Call-Back functions, the OID handlers, and even timer functions.
+
+
+Each _queue has its own locks, already.
+Other items are protected by mlme_priv.lock.
+
+To avoid possible dead lock, any thread trying to modifiying mlme_priv
+SHALL not lock up more than one locks at a time!
+
+*/
+
+
+#define traffic_threshold	10
+#define	traffic_scan_period	500
+
+struct sitesurvey_ctrl {
+	u64	last_tx_pkts;
+	uint	last_rx_pkts;
+	sint	traffic_busy;
+	_timer	sitesurvey_ctrl_timer;
+};
+
+typedef struct _RT_LINK_DETECT_T{
+	u32				NumTxOkInPeriod;
+	u32				NumRxOkInPeriod;
+	u32				NumRxUnicastOkInPeriod;
+	BOOLEAN			bBusyTraffic;
+	BOOLEAN			bTxBusyTraffic;
+	BOOLEAN			bRxBusyTraffic;
+	BOOLEAN			bHigherBusyTraffic; // For interrupt migration purpose.
+	BOOLEAN			bHigherBusyRxTraffic; // We may disable Tx interrupt according as Rx traffic.
+	BOOLEAN			bHigherBusyTxTraffic; // We may disable Tx interrupt according as Tx traffic.
+}RT_LINK_DETECT_T, *PRT_LINK_DETECT_T;
+
+struct profile_info {
+	u8	ssidlen;
+	u8	ssid[ WLAN_SSID_MAXLEN ];
+	u8	peermac[ ETH_ALEN ];
+};
+
+struct tx_invite_req_info{
+	u8					token;
+	u8					benable;
+	u8					go_ssid[ WLAN_SSID_MAXLEN ];
+	u8					ssidlen;
+	u8					go_bssid[ ETH_ALEN ];
+	u8					peer_macaddr[ ETH_ALEN ];
+	u8					operating_ch;	//	This information will be set by using the p2p_set op_ch=x
+	u8					peer_ch;		//	The listen channel for peer P2P device
+
+};
+
+struct tx_invite_resp_info{
+	u8					token;	//	Used to record the dialog token of p2p invitation request frame.
+};
+
+#ifdef CONFIG_WFD
+
+struct wifi_display_info{
+	u16							wfd_enable;			//	Eanble/Disable the WFD function.
+	u16							rtsp_ctrlport;		//	TCP port number at which the this WFD device listens for RTSP messages
+	u16							peer_rtsp_ctrlport;	//	TCP port number at which the peer WFD device listens for RTSP messages
+													//	This filed should be filled when receiving the gropu negotiation request
+
+	u8							peer_session_avail;	//	WFD session is available or not for the peer wfd device.
+													//	This variable will be set when sending the provisioning discovery request to peer WFD device.
+													//	And this variable will be reset when it is read by using the iwpriv p2p_get wfd_sa command.
+
+	u8							ip_address[4];
+	u8							peer_ip_address[4];
+	u8							wfd_pc;				//	WFD preferred connection
+													//	0 -> Prefer to use the P2P for WFD connection on peer side.
+													//	1 -> Prefer to use the TDLS for WFD connection on peer side.
+											
+	u8							wfd_device_type;	//	WFD Device Type
+													//	0 -> WFD Source Device
+													//	1 -> WFD Primary Sink Device
+	enum	SCAN_RESULT_TYPE	scan_result_type;	//	Used when P2P is enable. This parameter will impact the scan result.
+};
+#endif //CONFIG_WFD
+
+struct tx_provdisc_req_info{
+	u16					wps_config_method_request;	//	Used when sending the provisioning request frame
+	u16					peer_channel_num[2];		//	The channel number which the receiver stands.
+	NDIS_802_11_SSID	ssid;
+	u8					peerDevAddr[ ETH_ALEN ];		//	Peer device address
+	u8					peerIFAddr[ ETH_ALEN ];		//	Peer interface address
+	u8					benable;					//	This provision discovery request frame is trigger to send or not
+};
+
+struct rx_provdisc_req_info{	//When peer device issue prov_disc_req first, we should store the following informations
+	u8					peerDevAddr[ ETH_ALEN ];		//	Peer device address
+	u8					strconfig_method_desc_of_prov_disc_req[4];	//	description for the config method located in the provisioning discovery request frame.	
+																	//	The UI must know this information to know which config method the remote p2p device is requiring.
+};
+
+struct tx_nego_req_info{
+	u16					peer_channel_num[2];		//	The channel number which the receiver stands.
+	u8					peerDevAddr[ ETH_ALEN ];		//	Peer device address
+	u8					benable;					//	This negoitation request frame is trigger to send or not
+};
+
+struct group_id_info{
+	u8					go_device_addr[ ETH_ALEN ];	//	The GO's device address of this P2P group
+	u8					ssid[ WLAN_SSID_MAXLEN ];	//	The SSID of this P2P group
+};
+
+struct scan_limit_info{
+	u8					scan_op_ch_only;			//	When this flag is set, the driver should just scan the operation channel
+#ifndef P2P_OP_CHECK_SOCIAL_CH
+	u8					operation_ch[2];				//	Store the operation channel of invitation request frame
+#else
+	u8					operation_ch[5];				//	Store additional channel 1,6,11  for Android 4.2 IOT & Nexus 4
+#endif //P2P_OP_CHECK_SOCIAL_CH
+};
+
+#ifdef CONFIG_IOCTL_CFG80211
+struct cfg80211_wifidirect_info{
+	_timer					remain_on_ch_timer;
+	u8						restore_channel;
+	struct ieee80211_channel	remain_on_ch_channel;
+	enum nl80211_channel_type	remain_on_ch_type;
+	u64						remain_on_ch_cookie;
+	bool is_ro_ch;
+};
+#endif //CONFIG_IOCTL_CFG80211
+
+struct wifidirect_info{
+	_adapter*				padapter;
+	_timer					find_phase_timer;
+	_timer					restore_p2p_state_timer;
+	
+	//	Used to do the scanning. After confirming the peer is availalble, the driver transmits the P2P frame to peer.
+	_timer					pre_tx_scan_timer;
+	_timer					reset_ch_sitesurvey;
+	_timer					reset_ch_sitesurvey2;	//	Just for resetting the scan limit function by using p2p nego
+#ifdef CONFIG_CONCURRENT_MODE
+	//	Used to switch the channel between legacy AP and listen state.
+	_timer					ap_p2p_switch_timer;
+#endif
+	struct tx_provdisc_req_info	tx_prov_disc_info;
+	struct rx_provdisc_req_info rx_prov_disc_info;
+	struct tx_invite_req_info	invitereq_info;
+	struct profile_info			profileinfo[ P2P_MAX_PERSISTENT_GROUP_NUM ];	//	Store the profile information of persistent group
+	struct tx_invite_resp_info	inviteresp_info;
+	struct tx_nego_req_info	nego_req_info;
+	struct group_id_info		groupid_info;	//	Store the group id information when doing the group negotiation handshake.
+	struct scan_limit_info		rx_invitereq_info;	//	Used for get the limit scan channel from the Invitation procedure
+	struct scan_limit_info		p2p_info;		//	Used for get the limit scan channel from the P2P negotiation handshake
+#ifdef CONFIG_WFD
+	struct wifi_display_info		*wfd_info;
+#endif	
+	enum P2P_ROLE			role;
+	enum P2P_STATE			pre_p2p_state;
+	enum P2P_STATE			p2p_state;
+	u8 						device_addr[ETH_ALEN];	//	The device address should be the mac address of this device.
+	u8						interface_addr[ETH_ALEN];
+	u8						social_chan[4];
+	u8						listen_channel;
+	u8						operating_channel;
+	u8						listen_dwell;		//	This value should be between 1 and 3
+	u8						support_rate[8];
+	u8						p2p_wildcard_ssid[P2P_WILDCARD_SSID_LEN];
+	u8						intent;		//	should only include the intent value.
+	u8						p2p_peer_interface_addr[ ETH_ALEN ];
+	u8						p2p_peer_device_addr[ ETH_ALEN ];
+	u8						peer_intent;	//	Included the intent value and tie breaker value.
+	u8						device_name[ WPS_MAX_DEVICE_NAME_LEN ];	//	Device name for displaying on searching device screen
+	u8						device_name_len;
+	u8						profileindex;	//	Used to point to the index of profileinfo array
+	u8						peer_operating_ch;
+	u8						find_phase_state_exchange_cnt;
+	u16						device_password_id_for_nego;	//	The device password ID for group negotation
+	u8						negotiation_dialog_token;
+	u8						nego_ssid[ WLAN_SSID_MAXLEN ];	//	SSID information for group negotitation
+	u8						nego_ssidlen;
+	u8 						p2p_group_ssid[WLAN_SSID_MAXLEN];
+	u8 						p2p_group_ssid_len;
+	u8						persistent_supported;		//	Flag to know the persistent function should be supported or not.
+														//	In the Sigma test, the Sigma will provide this enable from the sta_set_p2p CAPI.
+														//	0: disable
+														//	1: enable
+	u8						session_available;			//	Flag to set the WFD session available to enable or disable "by Sigma"
+														//	In the Sigma test, the Sigma will disable the session available by using the sta_preset CAPI.
+														//	0: disable
+														//	1: enable
+	u8						wfd_tdls_enable;			//	Flag to enable or disable the TDLS by WFD Sigma
+														//	0: disable
+														//	1: enable
+	u8						wfd_tdls_weaksec;			//	Flag to enable or disable the weak security function for TDLS by WFD Sigma
+														//	0: disable
+														//	In this case, the driver can't issue the tdsl setup request frame.
+														//	1: enable
+														//	In this case, the driver can issue the tdls setup request frame
+														//	even the current security is weak security.
+
+	enum	P2P_WPSINFO		ui_got_wps_info;			//	This field will store the WPS value (PIN value or PBC) that UI had got from the user.
+	u16						supported_wps_cm;			//	This field describes the WPS config method which this driver supported.
+														//	The value should be the combination of config method defined in page104 of WPS v2.0 spec.	
+	u8						external_uuid;				//  UUID flag
+	u8						uuid[16];					//  UUID
+	uint						channel_list_attr_len;		//	This field will contain the length of body of P2P Channel List attribute of group negotitation response frame.
+	u8						channel_list_attr[100];		//	This field will contain the body of P2P Channel List attribute of group negotitation response frame.
+														//	We will use the channel_cnt and channel_list fields when constructing the group negotitation confirm frame.
+	u8						driver_interface; 			// Indicate DRIVER_WEXT or DRIVER_CFG80211
+
+#ifdef CONFIG_CONCURRENT_MODE
+	u16						ext_listen_interval;	//	The interval to be available with legacy AP (ms)
+	u16						ext_listen_period;	//	The time period to be available for P2P listen state (ms)
+#endif
+#ifdef CONFIG_P2P_PS
+	enum P2P_PS_MODE		p2p_ps_mode; // indicate p2p ps mode
+	enum P2P_PS_STATE		p2p_ps_state; // indicate p2p ps state
+	u8						noa_index; // Identifies and instance of Notice of Absence timing.
+	u8						ctwindow; // Client traffic window. A period of time in TU after TBTT.
+	u8						opp_ps; // opportunistic power save.
+	u8						noa_num; // number of NoA descriptor in P2P IE.
+	u8						noa_count[P2P_MAX_NOA_NUM]; // Count for owner, Type of client.
+	u32						noa_duration[P2P_MAX_NOA_NUM]; // Max duration for owner, preferred or min acceptable duration for client.
+	u32						noa_interval[P2P_MAX_NOA_NUM]; // Length of interval for owner, preferred or max acceptable interval of client.
+	u32						noa_start_time[P2P_MAX_NOA_NUM]; // schedule expressed in terms of the lower 4 bytes of the TSF timer.
+#endif // CONFIG_P2P_PS
+};
+
+struct tdls_ss_record{	//signal strength record; recording the tdls sta with lowerest ss
+	u8		macaddr[ETH_ALEN];
+	u8		RxPWDBAll;
+	u8		is_tdls_sta;	// _TRUE: direct link sta, _FALSE: else
+};
+
+struct tdls_info{
+	u8					ap_prohibited;
+	uint					setup_state;
+	u8					sta_cnt;
+	u8					sta_maximum;	// 1:tdls sta is equal (NUM_STA-1), reach max direct link number; 0: else;
+	struct tdls_ss_record	ss_record;
+	u8					macid_index;	//macid entry that is ready to write
+	u8					clear_cam;	//cam entry that is trying to clear, using it in direct link teardown
+	u8					ch_sensing;
+	u8					cur_channel;
+	u8					candidate_ch;
+	u8					collect_pkt_num[MAX_CHANNEL_NUM];
+	_lock				cmd_lock;
+	_lock				hdl_lock;
+	u8					watchdog_count;
+	u8					dev_discovered;		//WFD_TDLS: for sigma test
+	u8					enable;
+#ifdef CONFIG_WFD
+	struct wifi_display_info		*wfd_info;
+#endif		
+};
+
+struct mlme_priv {
+
+	_lock	lock;
+	sint	fw_state;	//shall we protect this variable? maybe not necessarily...
+
+	u8	to_join; //flag
+	#ifdef CONFIG_LAYER2_ROAMING
+	u8 to_roaming; // roaming trying times
+	#endif
+
+	u8	*nic_hdl;
+
+	u8	not_indic_disco;
+	_list		*pscanned;
+	_queue	free_bss_pool;
+	_queue	scanned_queue;
+	u8		*free_bss_buf;
+	u32	num_of_scanned;
+
+	NDIS_802_11_SSID	assoc_ssid;
+	u8	assoc_bssid[6];
+
+	struct wlan_network	cur_network;
+
+	//uint wireless_mode; no used, remove it
+
+	u32	scan_interval;
+
+	_timer assoc_timer;
+
+	uint assoc_by_bssid;
+	uint assoc_by_rssi;
+
+	_timer scan_to_timer; // driver itself handles scan_timeout status.
+	u32 scan_start_time; // used to evaluate the time spent in scanning
+
+	#ifdef CONFIG_SET_SCAN_DENY_TIMER
+	_timer set_scan_deny_timer;
+	ATOMIC_T set_scan_deny; //0: allowed, 1: deny
+	#endif
+
+	struct qos_priv qospriv;
+
+#ifdef CONFIG_80211N_HT
+
+	/* Number of non-HT AP/stations */
+	int num_sta_no_ht;
+
+	/* Number of HT AP/stations 20 MHz */
+	//int num_sta_ht_20mhz; 
+
+
+	int num_FortyMHzIntolerant;
+
+	struct ht_priv	htpriv;
+
+#endif
+
+	RT_LINK_DETECT_T	LinkDetectInfo;
+	_timer	dynamic_chk_timer; //dynamic/periodic check timer
+
+	u8	acm_mask; // for wmm acm mask
+	u8	ChannelPlan;
+	RT_SCAN_TYPE 	scan_mode; // active: 1, passive: 0
+
+	//u8 probereq_wpsie[MAX_WPS_IE_LEN];//added in probe req	
+	//int probereq_wpsie_len;
+	u8 *wps_probe_req_ie;
+	u32 wps_probe_req_ie_len;
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	/* Number of associated Non-ERP stations (i.e., stations using 802.11b
+	 * in 802.11g BSS) */
+	int num_sta_non_erp;
+
+	/* Number of associated stations that do not support Short Slot Time */
+	int num_sta_no_short_slot_time;
+
+	/* Number of associated stations that do not support Short Preamble */
+	int num_sta_no_short_preamble;
+
+	int olbc; /* Overlapping Legacy BSS Condition */
+
+	/* Number of HT associated stations that do not support greenfield */
+	int num_sta_ht_no_gf;
+
+	/* Number of associated non-HT stations */
+	//int num_sta_no_ht;
+
+	/* Number of HT associated stations 20 MHz */
+	int num_sta_ht_20mhz;
+
+	/* Overlapping BSS information */
+	int olbc_ht;
+	
+#ifdef CONFIG_80211N_HT
+	u16 ht_op_mode;
+#endif /* CONFIG_80211N_HT */	
+
+	u8 *assoc_req;
+	u32 assoc_req_len;
+	u8 *assoc_rsp;
+	u32 assoc_rsp_len;
+
+	u8 *wps_beacon_ie;	
+	//u8 *wps_probe_req_ie;
+	u8 *wps_probe_resp_ie;
+	u8 *wps_assoc_resp_ie; // for CONFIG_IOCTL_CFG80211, this IE could include p2p ie / wfd ie
+
+	u32 wps_beacon_ie_len;
+	//u32 wps_probe_req_ie_len;
+	u32 wps_probe_resp_ie_len;
+	u32 wps_assoc_resp_ie_len; // for CONFIG_IOCTL_CFG80211, this IE len could include p2p ie / wfd ie
+	
+	u8 *p2p_beacon_ie;
+	u8 *p2p_probe_req_ie;
+	u8 *p2p_probe_resp_ie;	
+	u8 *p2p_go_probe_resp_ie; //for GO	
+	u8 *p2p_assoc_req_ie;
+
+	u32 p2p_beacon_ie_len;
+	u32 p2p_probe_req_ie_len;
+	u32 p2p_probe_resp_ie_len;
+	u32 p2p_go_probe_resp_ie_len; //for GO
+	u32 p2p_assoc_req_ie_len;
+/*
+#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211)
+	//u8 *wps_p2p_beacon_ie;
+	u8 *p2p_beacon_ie;
+	u8 *wps_p2p_probe_resp_ie;
+	u8 *wps_p2p_assoc_resp_ie;
+	//u32 wps_p2p_beacon_ie_len;
+	u32 p2p_beacon_ie_len;
+	u32 wps_p2p_probe_resp_ie_len;
+	u32 wps_p2p_assoc_resp_ie_len;
+#endif
+*/
+	
+	_lock	bcn_update_lock;
+	u8		update_bcn;
+	
+	
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+
+#if defined(CONFIG_WFD) && defined(CONFIG_IOCTL_CFG80211)
+	
+	u8 *wfd_beacon_ie;
+	u8 *wfd_probe_req_ie;
+	u8 *wfd_probe_resp_ie;	
+	u8 *wfd_go_probe_resp_ie; //for GO	
+	u8 *wfd_assoc_req_ie;
+
+	u32 wfd_beacon_ie_len;
+	u32 wfd_probe_req_ie_len;
+	u32 wfd_probe_resp_ie_len;
+	u32 wfd_go_probe_resp_ie_len; //for GO
+	u32 wfd_assoc_req_ie_len;
+
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	// DMP kobject_hotplug function  signal need in passive level
+	_workitem	Linkup_workitem;
+	_workitem	Linkdown_workitem;
+#endif
+
+#ifdef CONFIG_INTEL_WIDI
+	int	widi_state;
+	int	listen_state;
+	_timer	listen_timer;
+	ATOMIC_T	rx_probe_rsp; // 1:receive probe respone from RDS source.
+	u8	*l2sdTaBuffer;
+	u8	channel_idx;
+	s8	group_cnt;	//For WiDi 3.5, they specified another scan algo. for WFD/RDS co-existed
+	u8	sa_ext[L2SDTA_SERVICE_VE_LEN];
+
+	u8	widi_enable;
+	/**
+	 * For WiDi 4; upper layer would set
+	 * p2p_primary_device_type_category_id
+	 * p2p_primary_device_type_sub_category_id
+	 * p2p_secondary_device_type_category_id
+	 * p2p_secondary_device_type_sub_category_id
+	 */
+	u16	p2p_pdt_cid;
+	u16	p2p_pdt_scid;
+	u8	num_p2p_sdt;
+	u16	p2p_sdt_cid[MAX_NUM_P2P_SDT];
+	u16	p2p_sdt_scid[MAX_NUM_P2P_SDT];
+	u8	p2p_reject_disable;	//When starting NL80211 wpa_supplicant/hostapd, it will call netdev_close
+							//such that it will cause p2p disabled. Use this flag to reject.
+#endif // CONFIG_INTEL_WIDI
+
+#ifdef CONFIG_CONCURRENT_MODE
+	u8	scanning_via_buddy_intf;
+#endif
+};
+
+#ifdef CONFIG_AP_MODE
+
+struct hostapd_priv
+{
+	_adapter *padapter;
+
+#ifdef CONFIG_HOSTAPD_MLME
+	struct net_device *pmgnt_netdev;
+	struct usb_anchor anchored;
+#endif	
+	
+};
+
+extern int hostapd_mode_init(_adapter *padapter);
+extern void hostapd_mode_unload(_adapter *padapter);
+#endif
+
+
+extern void rtw_joinbss_event_prehandle(_adapter *adapter, u8 *pbuf);
+extern void rtw_survey_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_surveydone_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_joinbss_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_stassoc_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_stadel_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_atimdone_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_cpwm_event_callback(_adapter *adapter, u8 *pbuf);
+
+#ifdef PLATFORM_WINDOWS
+extern thread_return event_thread(void *context);
+
+extern void rtw_join_timeout_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	);
+
+extern void _rtw_scan_timeout_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	);
+
+#endif
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+extern int event_thread(void *context);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+extern void rtw_join_timeout_handler(void *FunctionContext);
+extern void _rtw_scan_timeout_handler(void* FunctionContext);
+#else
+extern void rtw_join_timeout_handler(struct timer_list *t);
+extern void _rtw_scan_timeout_handler(struct timer_list *t);
+#endif
+#endif
+
+extern void rtw_free_network_queue(_adapter *adapter,u8 isfreeall);
+extern int rtw_init_mlme_priv(_adapter *adapter);// (struct mlme_priv *pmlmepriv);
+
+extern void rtw_free_mlme_priv (struct mlme_priv *pmlmepriv);
+
+
+extern sint rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv);
+extern sint rtw_set_key(_adapter *adapter,struct security_priv *psecuritypriv,sint keyid, u8 set_tx);
+extern sint rtw_set_auth(_adapter *adapter,struct security_priv *psecuritypriv);
+
+__inline static u8 *get_bssid(struct mlme_priv *pmlmepriv)
+{	//if sta_mode:pmlmepriv->cur_network.network.MacAddress=> bssid
+	// if adhoc_mode:pmlmepriv->cur_network.network.MacAddress=> ibss mac address
+	return pmlmepriv->cur_network.network.MacAddress;
+}
+
+__inline static sint check_fwstate(struct mlme_priv *pmlmepriv, sint state)
+{
+	if (pmlmepriv->fw_state & state)
+		return _TRUE;
+
+	return _FALSE;
+}
+
+__inline static sint get_fwstate(struct mlme_priv *pmlmepriv)
+{
+	return pmlmepriv->fw_state;
+}
+
+/*
+ * No Limit on the calling context,
+ * therefore set it to be the critical section...
+ *
+ * ### NOTE:#### (!!!!)
+ * MUST TAKE CARE THAT BEFORE CALLING THIS FUNC, YOU SHOULD HAVE LOCKED pmlmepriv->lock
+ */
+__inline static void set_fwstate(struct mlme_priv *pmlmepriv, sint state)
+{
+	pmlmepriv->fw_state |= state;
+}
+
+__inline static void _clr_fwstate_(struct mlme_priv *pmlmepriv, sint state)
+{
+	pmlmepriv->fw_state &= ~state;
+}
+
+/*
+ * No Limit on the calling context,
+ * therefore set it to be the critical section...
+ */
+__inline static void clr_fwstate(struct mlme_priv *pmlmepriv, sint state)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	if (check_fwstate(pmlmepriv, state) == _TRUE)
+		pmlmepriv->fw_state ^= state;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+__inline static void clr_fwstate_ex(struct mlme_priv *pmlmepriv, sint state)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_clr_fwstate_(pmlmepriv, state);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+__inline static void up_scanned_network(struct mlme_priv *pmlmepriv)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->num_of_scanned++;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+sint rtw_buddy_adapter_up(_adapter *padapter);
+sint check_buddy_fwstate(_adapter *padapter, sint state);
+#endif //CONFIG_CONCURRENT_MODE
+
+__inline static void down_scanned_network(struct mlme_priv *pmlmepriv)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->num_of_scanned--;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+__inline static void set_scanned_network_val(struct mlme_priv *pmlmepriv, sint val)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->num_of_scanned = val;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+extern u16 rtw_get_capability(WLAN_BSSID_EX *bss);
+extern void rtw_update_scanned_network(_adapter *adapter, WLAN_BSSID_EX *target);
+extern void rtw_disconnect_hdl_under_linked(_adapter* adapter, struct sta_info *psta, u8 free_assoc);
+extern void rtw_generate_random_ibss(u8 *pibss);
+extern struct wlan_network* rtw_find_network(_queue *scanned_queue, u8 *addr);
+extern struct wlan_network* rtw_get_oldest_wlan_network(_queue *scanned_queue);
+
+extern void rtw_free_assoc_resources(_adapter* adapter, int lock_scanned_queue);
+extern void rtw_indicate_disconnect(_adapter* adapter);
+extern void rtw_indicate_connect(_adapter* adapter);
+void rtw_indicate_scan_done( _adapter *padapter, bool aborted);
+void rtw_scan_abort(_adapter *adapter);
+
+extern int rtw_restruct_sec_ie(_adapter *adapter,u8 *in_ie,u8 *out_ie,uint in_len);
+extern int rtw_restruct_wmm_ie(_adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_len, uint initial_out_len);
+extern void rtw_init_registrypriv_dev_network(_adapter *adapter);
+
+extern void rtw_update_registrypriv_dev_network(_adapter *adapter);
+
+extern void rtw_get_encrypt_decrypt_from_registrypriv(_adapter *adapter);
+
+extern void _rtw_join_timeout_handler(_adapter *adapter);
+extern void rtw_scan_timeout_handler(_adapter *adapter);
+
+extern void rtw_dynamic_check_timer_handlder(_adapter *adapter);
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+bool rtw_is_scan_deny(_adapter *adapter);
+void rtw_clear_scan_deny(_adapter *adapter);
+void rtw_set_scan_deny_timer_hdl(_adapter *adapter);
+void rtw_set_scan_deny(_adapter *adapter, u32 ms);
+#else
+#define rtw_is_scan_deny(adapter) _FALSE
+#define rtw_clear_scan_deny(adapter) do {} while (0)
+#define rtw_set_scan_deny_timer_hdl(adapter) do {} while (0)
+#define rtw_set_scan_deny(adapter, ms) do {} while (0)
+#endif
+
+
+extern int _rtw_init_mlme_priv(_adapter *padapter);
+
+void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv);
+
+extern void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv);
+
+extern int _rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork);
+
+extern struct wlan_network* _rtw_dequeue_network(_queue *queue);
+
+extern struct wlan_network* _rtw_alloc_network(struct mlme_priv *pmlmepriv);
+
+
+extern void _rtw_free_network(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork, u8 isfreeall);
+extern void _rtw_free_network_nolock(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork);
+
+
+extern struct wlan_network* _rtw_find_network(_queue *scanned_queue, u8 *addr);
+
+extern void _rtw_free_network_queue(_adapter* padapter, u8 isfreeall);
+
+extern sint rtw_if_up(_adapter *padapter);
+
+
+u8 *rtw_get_capability_from_ie(u8 *ie);
+u8 *rtw_get_timestampe_from_ie(u8 *ie);
+u8 *rtw_get_beacon_interval_from_ie(u8 *ie);
+
+
+void rtw_joinbss_reset(_adapter *padapter);
+
+#ifdef CONFIG_80211N_HT
+unsigned int rtw_restructure_ht_ie(_adapter *padapter, u8 *in_ie, u8 *out_ie, uint in_len, uint *pout_len, u8 channel);
+void rtw_update_ht_cap(_adapter *padapter, u8 *pie, uint ie_len, u8 channel);
+void rtw_issue_addbareq_cmd(_adapter *padapter, struct xmit_frame *pxmitframe);
+#endif
+
+int rtw_is_same_ibss(_adapter *adapter, struct wlan_network *pnetwork);
+int is_same_network(WLAN_BSSID_EX *src, WLAN_BSSID_EX *dst);
+
+#ifdef CONFIG_LAYER2_ROAMING
+void _rtw_roaming(_adapter *adapter, struct wlan_network *tgt_network);
+void rtw_roaming(_adapter *adapter, struct wlan_network *tgt_network);
+void rtw_set_roaming(_adapter *adapter, u8 to_roaming);
+u8 rtw_to_roaming(_adapter *adapter);
+#else
+#define _rtw_roaming(adapter, tgt_network) do {} while(0)
+#define rtw_roaming(adapter, tgt_network) do {} while(0)
+#define rtw_set_roaming(adapter, to_roaming) do {} while(0)
+#define rtw_to_roaming(adapter) 0
+#endif
+
+
+#ifdef CONFIG_INTEL_PROXIM
+void rtw_proxim_enable(_adapter *padapter);
+void rtw_proxim_disable(_adapter *padapter);
+void rtw_proxim_send_packet(_adapter *padapter,u8 *pbuf,u16 len,u8 hw_rate);
+#endif //CONFIG_INTEL_PROXIM
+#endif //__RTL871X_MLME_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h
new file mode 100755
index 0000000000000..5cddca4dc7c60
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h
@@ -0,0 +1,963 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_MLME_EXT_H_
+#define __RTW_MLME_EXT_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+
+
+//	Commented by Albert 20101105
+//	Increase the SURVEY_TO value from 100 to 150  ( 100ms to 150ms )
+//	The Realtek 8188CE SoftAP will spend around 100ms to send the probe response after receiving the probe request.
+//	So, this driver tried to extend the dwell time for each scanning channel.
+//	This will increase the chance to receive the probe response from SoftAP.
+
+#define SURVEY_TO		(100)
+#define REAUTH_TO		(300) //(50)
+#define REASSOC_TO		(300) //(50)
+//#define DISCONNECT_TO	(3000)
+#define ADDBA_TO			(2000)
+
+#define LINKED_TO (1) //unit:2 sec, 1x2=2 sec
+
+#define REAUTH_LIMIT	(4)
+#define REASSOC_LIMIT	(4)
+#define READDBA_LIMIT	(2)
+
+//#define	IOCMD_REG0		0x10250370		 	
+//#define	IOCMD_REG1		0x10250374
+//#define	IOCMD_REG2		0x10250378
+
+//#define	FW_DYNAMIC_FUN_SWITCH	0x10250364
+
+//#define	WRITE_BB_CMD		0xF0000001
+//#define	SET_CHANNEL_CMD	0xF3000000
+//#define	UPDATE_RA_CMD	0xFD0000A2
+
+#define	DYNAMIC_FUNC_DISABLE		(0x0)
+#define	DYNAMIC_FUNC_DIG			BIT(0)
+#define	DYNAMIC_FUNC_HP			BIT(1)
+#define	DYNAMIC_FUNC_SS			BIT(2) //Tx Power Tracking
+#define DYNAMIC_FUNC_BT			BIT(3)
+#define DYNAMIC_FUNC_ANT_DIV		BIT(4)
+#define DYNAMIC_FUNC_ADAPTIVITY	BIT(5)
+
+#define _HW_STATE_NOLINK_		0x00
+#define _HW_STATE_ADHOC_		0x01
+#define _HW_STATE_STATION_ 	0x02
+#define _HW_STATE_AP_			0x03
+
+
+#define		_1M_RATE_	0
+#define		_2M_RATE_	1
+#define		_5M_RATE_	2
+#define		_11M_RATE_	3
+#define		_6M_RATE_	4
+#define		_9M_RATE_	5
+#define		_12M_RATE_	6
+#define		_18M_RATE_	7
+#define		_24M_RATE_	8
+#define		_36M_RATE_	9
+#define		_48M_RATE_	10
+#define		_54M_RATE_	11
+
+
+extern unsigned char RTW_WPA_OUI[];
+extern unsigned char WMM_OUI[];
+extern unsigned char WPS_OUI[];
+extern unsigned char WFD_OUI[];
+extern unsigned char P2P_OUI[];
+
+extern unsigned char WMM_INFO_OUI[];
+extern unsigned char WMM_PARA_OUI[];
+
+
+//
+// Channel Plan Type.
+// Note: 
+//	We just add new channel plan when the new channel plan is different from any of the following 
+//	channel plan. 
+//	If you just wnat to customize the acitions(scan period or join actions) about one of the channel plan,
+//	customize them in RT_CHANNEL_INFO in the RT_CHANNEL_LIST.
+// 
+typedef enum _RT_CHANNEL_DOMAIN
+{
+	//===== old channel plan mapping =====//
+	RT_CHANNEL_DOMAIN_FCC = 0x00,
+	RT_CHANNEL_DOMAIN_IC = 0x01,
+	RT_CHANNEL_DOMAIN_ETSI = 0x02,
+	RT_CHANNEL_DOMAIN_SPAIN = 0x03,
+	RT_CHANNEL_DOMAIN_FRANCE = 0x04,
+	RT_CHANNEL_DOMAIN_MKK = 0x05,
+	RT_CHANNEL_DOMAIN_MKK1 = 0x06,
+	RT_CHANNEL_DOMAIN_ISRAEL = 0x07,
+	RT_CHANNEL_DOMAIN_TELEC = 0x08,
+	RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN = 0x09,
+	RT_CHANNEL_DOMAIN_WORLD_WIDE_13 = 0x0A,
+	RT_CHANNEL_DOMAIN_TAIWAN = 0x0B,
+	RT_CHANNEL_DOMAIN_CHINA = 0x0C,
+	RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO = 0x0D,
+	RT_CHANNEL_DOMAIN_KOREA = 0x0E,
+	RT_CHANNEL_DOMAIN_TURKEY = 0x0F,
+	RT_CHANNEL_DOMAIN_JAPAN = 0x10,
+	RT_CHANNEL_DOMAIN_FCC_NO_DFS = 0x11,
+	RT_CHANNEL_DOMAIN_JAPAN_NO_DFS = 0x12,
+	RT_CHANNEL_DOMAIN_WORLD_WIDE_5G = 0x13,
+	RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS = 0x14,	
+
+	//===== new channel plan mapping, (2GDOMAIN_5GDOMAIN) =====//
+	RT_CHANNEL_DOMAIN_WORLD_NULL = 0x20,
+	RT_CHANNEL_DOMAIN_ETSI1_NULL = 0x21,
+	RT_CHANNEL_DOMAIN_FCC1_NULL = 0x22,
+	RT_CHANNEL_DOMAIN_MKK1_NULL = 0x23,
+	RT_CHANNEL_DOMAIN_ETSI2_NULL = 0x24,
+	RT_CHANNEL_DOMAIN_FCC1_FCC1 = 0x25,
+	RT_CHANNEL_DOMAIN_WORLD_ETSI1 = 0x26,
+	RT_CHANNEL_DOMAIN_MKK1_MKK1 = 0x27,
+	RT_CHANNEL_DOMAIN_WORLD_KCC1 = 0x28,
+	RT_CHANNEL_DOMAIN_WORLD_FCC2 = 0x29,
+	RT_CHANNEL_DOMAIN_WORLD_FCC3 = 0x30,
+	RT_CHANNEL_DOMAIN_WORLD_FCC4 = 0x31,
+	RT_CHANNEL_DOMAIN_WORLD_FCC5 = 0x32,
+	RT_CHANNEL_DOMAIN_WORLD_FCC6 = 0x33,
+	RT_CHANNEL_DOMAIN_FCC1_FCC7 = 0x34,
+	RT_CHANNEL_DOMAIN_WORLD_ETSI2 = 0x35,
+	RT_CHANNEL_DOMAIN_WORLD_ETSI3 = 0x36,
+	RT_CHANNEL_DOMAIN_MKK1_MKK2 = 0x37,
+	RT_CHANNEL_DOMAIN_MKK1_MKK3 = 0x38,
+	RT_CHANNEL_DOMAIN_FCC1_NCC1 = 0x39,
+	RT_CHANNEL_DOMAIN_FCC1_NCC2 = 0x40,
+
+	//===== Add new channel plan above this line===============//
+	RT_CHANNEL_DOMAIN_MAX,
+	RT_CHANNEL_DOMAIN_REALTEK_DEFINE = 0x7F,
+}RT_CHANNEL_DOMAIN, *PRT_CHANNEL_DOMAIN;
+
+typedef enum _RT_CHANNEL_DOMAIN_2G
+{
+	RT_CHANNEL_DOMAIN_2G_WORLD = 0x00,		//Worldwird 13
+	RT_CHANNEL_DOMAIN_2G_ETSI1 = 0x01,		//Europe
+	RT_CHANNEL_DOMAIN_2G_FCC1 = 0x02,		//US
+	RT_CHANNEL_DOMAIN_2G_MKK1 = 0x03,		//Japan
+	RT_CHANNEL_DOMAIN_2G_ETSI2 = 0x04,		//France
+	RT_CHANNEL_DOMAIN_2G_NULL = 0x05,
+	//===== Add new channel plan above this line===============//
+	RT_CHANNEL_DOMAIN_2G_MAX,
+}RT_CHANNEL_DOMAIN_2G, *PRT_CHANNEL_DOMAIN_2G;
+
+typedef enum _RT_CHANNEL_DOMAIN_5G
+{
+	RT_CHANNEL_DOMAIN_5G_NULL = 0x00,
+	RT_CHANNEL_DOMAIN_5G_ETSI1 = 0x01,		//Europe
+	RT_CHANNEL_DOMAIN_5G_ETSI2 = 0x02,		//Australia, New Zealand
+	RT_CHANNEL_DOMAIN_5G_ETSI3 = 0x03,		//Russia
+	RT_CHANNEL_DOMAIN_5G_FCC1 = 0x04,		//US
+	RT_CHANNEL_DOMAIN_5G_FCC2 = 0x05,		//FCC o/w DFS Channels
+	RT_CHANNEL_DOMAIN_5G_FCC3 = 0x06,		//India, Mexico
+	RT_CHANNEL_DOMAIN_5G_FCC4 = 0x07,		//Venezuela
+	RT_CHANNEL_DOMAIN_5G_FCC5 = 0x08,		//China
+	RT_CHANNEL_DOMAIN_5G_FCC6 = 0x09,		//Israel
+	RT_CHANNEL_DOMAIN_5G_FCC7_IC1 = 0x0A,	//US, Canada
+	RT_CHANNEL_DOMAIN_5G_KCC1 = 0x0B,		//Korea
+	RT_CHANNEL_DOMAIN_5G_MKK1 = 0x0C,		//Japan
+	RT_CHANNEL_DOMAIN_5G_MKK2 = 0x0D,		//Japan (W52, W53)
+	RT_CHANNEL_DOMAIN_5G_MKK3 = 0x0E,		//Japan (W56)
+	RT_CHANNEL_DOMAIN_5G_NCC1 = 0x0F,		//Taiwan
+	RT_CHANNEL_DOMAIN_5G_NCC2 = 0x10,		//Taiwan o/w DFS
+	//===== Add new channel plan above this line===============//
+	//===== Driver Self Defined =====//
+	RT_CHANNEL_DOMAIN_5G_FCC = 0x11,
+	RT_CHANNEL_DOMAIN_5G_JAPAN_NO_DFS = 0x12,
+	RT_CHANNEL_DOMAIN_5G_FCC4_NO_DFS = 0x13,
+	RT_CHANNEL_DOMAIN_5G_MAX,
+}RT_CHANNEL_DOMAIN_5G, *PRT_CHANNEL_DOMAIN_5G;
+
+#define rtw_is_channel_plan_valid(chplan) (chplan<RT_CHANNEL_DOMAIN_MAX || chplan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
+
+typedef struct _RT_CHANNEL_PLAN
+{
+	unsigned char	Channel[MAX_CHANNEL_NUM];
+	unsigned char	Len;
+}RT_CHANNEL_PLAN, *PRT_CHANNEL_PLAN;
+
+typedef struct _RT_CHANNEL_PLAN_2G
+{
+	unsigned char	Channel[MAX_CHANNEL_NUM_2G];
+	unsigned char	Len;
+}RT_CHANNEL_PLAN_2G, *PRT_CHANNEL_PLAN_2G;
+
+typedef struct _RT_CHANNEL_PLAN_5G
+{
+	unsigned char	Channel[MAX_CHANNEL_NUM_5G];
+	unsigned char	Len;
+}RT_CHANNEL_PLAN_5G, *PRT_CHANNEL_PLAN_5G;
+
+typedef struct _RT_CHANNEL_PLAN_MAP
+{
+	unsigned char	Index2G;
+	unsigned char	Index5G;
+}RT_CHANNEL_PLAN_MAP, *PRT_CHANNEL_PLAN_MAP;
+
+enum Associated_AP
+{
+	atherosAP	= 0,
+	broadcomAP	= 1,
+	ciscoAP		= 2,
+	marvellAP	= 3,
+	ralinkAP	= 4,
+	realtekAP	= 5,
+	airgocapAP 	= 6,
+	unknownAP	= 7,
+	maxAP,
+};
+
+enum SCAN_STATE
+{
+	SCAN_DISABLE = 0,
+	SCAN_START = 1,
+	SCAN_TXNULL = 2,
+	SCAN_PROCESS = 3,
+	SCAN_COMPLETE = 4,
+	SCAN_STATE_MAX,
+};
+
+struct mlme_handler {
+	unsigned int   num;
+	char* str;
+	unsigned int (*func)(_adapter *padapter, union recv_frame *precv_frame);
+};
+
+struct action_handler {
+	unsigned int   num;
+	char* str;
+	unsigned int (*func)(_adapter *padapter, union recv_frame *precv_frame);
+};
+
+struct	ss_res	
+{
+	int	state;
+	int	bss_cnt;
+	int	channel_idx;
+	int	scan_mode;
+	u8 ssid_num;
+	u8 ch_num;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	struct rtw_ieee80211_channel ch[RTW_CHANNEL_SCAN_AMOUNT];
+};
+
+//#define AP_MODE				0x0C
+//#define STATION_MODE	0x08
+//#define AD_HOC_MODE		0x04
+//#define NO_LINK_MODE	0x00
+
+#define 	WIFI_FW_NULL_STATE			_HW_STATE_NOLINK_
+#define	WIFI_FW_STATION_STATE		_HW_STATE_STATION_
+#define	WIFI_FW_AP_STATE				_HW_STATE_AP_
+#define	WIFI_FW_ADHOC_STATE			_HW_STATE_ADHOC_
+
+#define	WIFI_FW_AUTH_NULL			0x00000100
+#define	WIFI_FW_AUTH_STATE			0x00000200
+#define	WIFI_FW_AUTH_SUCCESS			0x00000400
+
+#define	WIFI_FW_ASSOC_STATE			0x00002000
+#define	WIFI_FW_ASSOC_SUCCESS		0x00004000
+
+#define	WIFI_FW_LINKING_STATE		(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE | WIFI_FW_AUTH_SUCCESS |WIFI_FW_ASSOC_STATE)
+
+#ifdef CONFIG_TDLS
+// 1: Write RCR DATA BIT
+// 2: Issue peer traffic indication
+// 3: Go back to the channel linked with AP, terminating channel switch procedure
+// 4: Init channel sensing, receive all data and mgnt frame
+// 5: Channel sensing and report candidate channel
+// 6: First time set channel to off channel
+// 7: Go back tp the channel linked with AP when set base channel as target channel
+// 8: Set channel back to base channel
+// 9: Set channel back to off channel
+// 10: Restore RCR DATA BIT
+// 11: Check alive
+// 12: Check alive
+// 13: Free TDLS sta
+enum TDLS_option
+{
+	TDLS_WRCR			= 	1,
+	TDLS_SD_PTI		= 	2,
+	TDLS_CS_OFF		= 	3,
+	TDLS_INIT_CH_SEN	= 	4,
+	TDLS_DONE_CH_SEN	=	5,
+	TDLS_OFF_CH		=	6,
+	TDLS_BASE_CH 		=	7,
+	TDLS_P_OFF_CH		=	8,
+	TDLS_P_BASE_CH	= 	9,
+	TDLS_RS_RCR		=	10,
+	TDLS_CKALV_PH1	=	11,
+	TDLS_CKALV_PH2	=	12,
+	TDLS_FREE_STA		=	13,
+	maxTDLS,
+};
+
+#endif //CONFIG_TDLS
+
+struct FW_Sta_Info
+{
+	struct sta_info	*psta;
+	u32	status;
+	u32	rx_pkt;
+	u32	retry;
+	NDIS_802_11_RATES_EX  SupportedRates;
+};
+
+/*
+ * Usage:
+ * When one iface acted as AP mode and the other iface is STA mode and scanning, 
+ * it should switch back to AP's operating channel periodically.
+ * Parameters info:
+ * When the driver scanned RTW_SCAN_NUM_OF_CH channels, it would switch back to AP's operating channel for
+ * RTW_STAY_AP_CH_MILLISECOND * SURVEY_TO milliseconds.
+ * Example:
+ * For chip supports 2.4G + 5GHz and AP mode is operating in channel 1, 
+ * RTW_SCAN_NUM_OF_CH is 8, RTW_STAY_AP_CH_MILLISECOND is 3 and SURVEY_TO is 100.
+ * When it's STA mode gets set_scan command, 
+ * it would 
+ * 1. Doing the scan on channel 1.2.3.4.5.6.7.8 
+ * 2. Back to channel 1 for 300 milliseconds
+ * 3. Go through doing site survey on channel 9.10.11.36.40.44.48.52
+ * 4. Back to channel 1 for 300 milliseconds
+ * 5. ... and so on, till survey done.
+ */
+#if defined CONFIG_STA_MODE_SCAN_UNDER_AP_MODE && defined CONFIG_CONCURRENT_MODE
+#define RTW_SCAN_NUM_OF_CH			8
+#define RTW_STAY_AP_CH_MILLISECOND	3	// this value is a multiplier,for example, when this value is 3, it would stay AP's op ch for 
+											// 3 * SURVEY_TO millisecond. 
+#endif //defined CONFIG_STA_MODE_SCAN_UNDER_AP_MODE && defined CONFIG_CONCURRENT_MODE
+
+struct mlme_ext_info
+{
+	u32	state;
+	u32	reauth_count;
+	u32	reassoc_count;
+	u32	link_count;
+	u32	auth_seq;
+	u32	auth_algo;	// 802.11 auth, could be open, shared, auto
+	u32	authModeToggle;
+	u32	enc_algo;//encrypt algorithm;
+	u32	key_index;	// this is only valid for legendary wep, 0~3 for key id.
+	u32	iv;
+	u8	chg_txt[128];
+	u16	aid;
+	u16	bcn_interval;
+	u16	capability;
+	u8	assoc_AP_vendor;
+	u8	slotTime;
+	u8	preamble_mode;
+	u8	WMM_enable;
+	u8	ERP_enable;
+	u8	ERP_IE;
+	u8	HT_enable;
+	u8	HT_caps_enable;	
+	u8	HT_info_enable;
+	u8	HT_protection;
+	u8	turboMode_cts2self;
+	u8	turboMode_rtsen;
+	u8	SM_PS;
+	u8	agg_enable_bitmap;
+	u8	ADDBA_retry_count;
+	u8	candidate_tid_bitmap;
+	u8	dialogToken;
+	// Accept ADDBA Request
+	BOOLEAN bAcceptAddbaReq;
+	u8	bwmode_updated;
+	u8	hidden_ssid_mode;
+
+	struct ADDBA_request		ADDBA_req;
+	struct WMM_para_element	WMM_param;
+	struct HT_caps_element	HT_caps;
+	struct HT_info_element		HT_info;
+	WLAN_BSSID_EX			network;//join network or bss_network, if in ap mode, it is the same to cur_network.network
+	struct FW_Sta_Info		FW_sta_info[NUM_STA];
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+	u8 scan_cnt;
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+};
+
+// The channel information about this channel including joining, scanning, and power constraints.
+typedef struct _RT_CHANNEL_INFO
+{
+	u8				ChannelNum;		// The channel number.
+	RT_SCAN_TYPE	ScanType;		// Scan type such as passive or active scan.
+	//u16				ScanPeriod;		// Listen time in millisecond in this channel.
+	//s32				MaxTxPwrDbm;	// Max allowed tx power.
+	//u32				ExInfo;			// Extended Information for this channel.
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	u32				rx_count;
+#endif
+}RT_CHANNEL_INFO, *PRT_CHANNEL_INFO;
+
+int rtw_ch_set_search_ch(RT_CHANNEL_INFO *ch_set, const u32 ch);
+bool rtw_mlme_band_check(_adapter *adapter, const u32 ch);
+
+// P2P_MAX_REG_CLASSES - Maximum number of regulatory classes
+#define P2P_MAX_REG_CLASSES 10
+
+// P2P_MAX_REG_CLASS_CHANNELS - Maximum number of channels per regulatory class
+#define P2P_MAX_REG_CLASS_CHANNELS 20
+
+//  struct p2p_channels - List of supported channels
+struct p2p_channels {
+	// struct p2p_reg_class - Supported regulatory class
+	struct p2p_reg_class {
+		// reg_class - Regulatory class (IEEE 802.11-2007, Annex J)
+		u8 reg_class;
+
+		// channel - Supported channels
+		u8 channel[P2P_MAX_REG_CLASS_CHANNELS];
+
+		// channels - Number of channel entries in use
+		size_t channels;
+	} reg_class[P2P_MAX_REG_CLASSES];
+
+	// reg_classes - Number of reg_class entries in use
+	size_t reg_classes;
+};
+
+struct p2p_oper_class_map {
+	enum hw_mode {IEEE80211G,IEEE80211A} mode;
+	u8 op_class;
+	u8 min_chan;
+	u8 max_chan;
+	u8 inc;
+	enum { BW20, BW40PLUS, BW40MINUS } bw;
+};
+
+struct mlme_ext_priv
+{
+	_adapter	*padapter;
+	u8	mlmeext_init;
+	ATOMIC_T		event_seq;
+	u16	mgnt_seq;
+#ifdef CONFIG_IEEE80211W
+	u16	sa_query_seq;
+	u64 mgnt_80211w_IPN;
+	u64 mgnt_80211w_IPN_rx;
+#endif //CONFIG_IEEE80211W
+	//struct fw_priv 	fwpriv;
+	
+	unsigned char	cur_channel;
+	unsigned char	cur_bwmode;
+	unsigned char	cur_ch_offset;//PRIME_CHNL_OFFSET
+	unsigned char	cur_wireless_mode;	
+
+	unsigned char	max_chan_nums;
+	RT_CHANNEL_INFO		channel_set[MAX_CHANNEL_NUM];
+	struct p2p_channels channel_list;
+	unsigned char	basicrate[NumRates];
+	unsigned char	datarate[NumRates];
+	
+	struct ss_res		sitesurvey_res;		
+	struct mlme_ext_info	mlmext_info;//for sta/adhoc mode, including current scanning/connecting/connected related info.
+                                                     //for ap mode, network includes ap's cap_info
+	_timer		survey_timer;
+	_timer		link_timer;
+#ifdef CONFIG_IEEE80211W
+	_timer		sa_query_timer;
+#endif //CONFIG_IEEE80211W
+	//_timer		ADDBA_timer;
+	u16			chan_scan_time;
+
+	u8	scan_abort;
+	u8	tx_rate; // TXRATE when USERATE is set.
+
+	u32	retry; //retry for issue probereq
+	
+	u64 TSFValue;
+
+#ifdef CONFIG_AP_MODE	
+	unsigned char bstart_bss;
+#endif
+
+	//recv_decache check for Action_public frame
+        u8 action_public_dialog_token;
+	u16 	 action_public_rxseq;
+
+#ifdef CONFIG_80211D
+	u8 update_channel_plan_by_ap_done;
+#endif
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+	u8 active_keep_alive_check;
+#endif
+	
+};
+
+int init_mlme_ext_priv(_adapter* padapter);
+int init_hw_mlme_ext(_adapter *padapter);
+void free_mlme_ext_priv (struct mlme_ext_priv *pmlmeext);
+extern void init_mlme_ext_timer(_adapter *padapter);
+extern void init_addba_retry_timer(_adapter *padapter, struct sta_info *psta);
+extern struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv);
+struct xmit_frame *alloc_mgtxmitframe_once(struct xmit_priv *pxmitpriv);
+
+//void fill_fwpriv(_adapter * padapter, struct fw_priv *pfwpriv);
+
+unsigned char networktype_to_raid(unsigned char network_type);
+int judge_network_type(_adapter *padapter, unsigned char *rate, int ratelen);
+void get_rate_set(_adapter *padapter, unsigned char *pbssrate, int *bssrate_len);
+void UpdateBrateTbl(_adapter *padapter,u8 *mBratesOS);
+void UpdateBrateTblForSoftAP(u8 *bssrateset, u32 bssratelen);
+void change_band_update_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork);
+
+void Save_DM_Func_Flag(_adapter *padapter);
+void Restore_DM_Func_Flag(_adapter *padapter);
+void Switch_DM_Func(_adapter *padapter, u8 mode, u8 enable);
+
+//void Set_NETYPE1_MSR(_adapter *padapter, u8 type);
+//void Set_NETYPE0_MSR(_adapter *padapter, u8 type);
+void Set_MSR(_adapter *padapter, u8 type);
+
+u8 rtw_get_oper_ch(_adapter *adapter);
+void rtw_set_oper_ch(_adapter *adapter, u8 ch);
+u8 rtw_get_oper_bw(_adapter *adapter);
+void rtw_set_oper_bw(_adapter *adapter, u8 bw);
+u8 rtw_get_oper_choffset(_adapter *adapter);
+void rtw_set_oper_choffset(_adapter *adapter, u8 offset);
+u32 rtw_get_on_oper_ch_time(_adapter *adapter);
+u32 rtw_get_on_cur_ch_time(_adapter *adapter);
+
+void set_channel_bwmode(_adapter *padapter, unsigned char channel, unsigned char channel_offset, unsigned short bwmode);
+void SelectChannel(_adapter *padapter, unsigned char channel);
+void SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset);
+
+unsigned int decide_wait_for_beacon_timeout(unsigned int bcn_interval);
+
+void write_cam(_adapter *padapter, u8 entry, u16 ctrl, u8 *mac, u8 *key);
+void clear_cam_entry(_adapter *padapter, u8 entry);
+
+void invalidate_cam_all(_adapter *padapter);
+void CAM_empty_entry(PADAPTER Adapter, u8 ucIndex);
+
+
+int allocate_fw_sta_entry(_adapter *padapter);
+void flush_all_cam_entry(_adapter *padapter);
+
+BOOLEAN IsLegal5GChannel(PADAPTER Adapter, u8 channel);
+
+void site_survey(_adapter *padapter);
+u8 collect_bss_info(_adapter *padapter, union recv_frame *precv_frame, WLAN_BSSID_EX *bssid);
+
+int get_bsstype(unsigned short capability);
+u8* get_my_bssid(WLAN_BSSID_EX *pnetwork);
+u16 get_beacon_interval(WLAN_BSSID_EX *bss);
+
+int is_client_associated_to_ap(_adapter *padapter);
+int is_client_associated_to_ibss(_adapter *padapter);
+int is_IBSS_empty(_adapter *padapter);
+
+unsigned char check_assoc_AP(u8 *pframe, uint len);
+
+int WMM_param_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE);
+#ifdef CONFIG_WFD
+int WFD_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE);
+#endif
+void WMMOnAssocRsp(_adapter *padapter);
+
+void HT_caps_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE);
+void HT_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE);
+void HTOnAssocRsp(_adapter *padapter);
+
+void ERP_IE_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE);
+void VCS_update(_adapter *padapter, struct sta_info *psta);
+
+void update_beacon_info(_adapter *padapter, u8 *pframe, uint len, struct sta_info *psta);
+#ifdef CONFIG_DFS
+void process_csa_ie(_adapter *padapter, u8 *pframe, uint len);
+#endif //CONFIG_DFS
+void update_IOT_info(_adapter *padapter);
+void update_capinfo(PADAPTER Adapter, u16 updateCap);
+void update_wireless_mode(_adapter * padapter);
+void update_tx_basic_rate(_adapter *padapter, u8 modulation);
+void update_bmc_sta_support_rate(_adapter *padapter, u32 mac_id);
+int update_sta_support_rate(_adapter *padapter, u8* pvar_ie, uint var_ie_len, int cam_idx);
+
+//for sta/adhoc mode
+void update_sta_info(_adapter *padapter, struct sta_info *psta);
+unsigned int update_basic_rate(unsigned char *ptn, unsigned int ptn_sz);
+unsigned int update_supported_rate(unsigned char *ptn, unsigned int ptn_sz);
+unsigned int update_MSC_rate(struct HT_caps_element *pHT_caps);
+void Update_RA_Entry(_adapter *padapter, u32 mac_id);
+void set_sta_rate(_adapter *padapter, struct sta_info *psta);
+
+unsigned int receive_disconnect(_adapter *padapter, unsigned char *MacAddr, unsigned short reason);
+
+unsigned char get_highest_rate_idx(u32 mask);
+int support_short_GI(_adapter *padapter, struct HT_caps_element *pHT_caps);
+unsigned int is_ap_in_tkip(_adapter *padapter);
+
+
+void report_join_res(_adapter *padapter, int res);
+void report_survey_event(_adapter *padapter, union recv_frame *precv_frame);
+void report_surveydone_event(_adapter *padapter);
+void report_del_sta_event(_adapter *padapter, unsigned char* MacAddr, unsigned short reason);
+void report_add_sta_event(_adapter *padapter, unsigned char* MacAddr, int cam_idx);
+
+void beacon_timing_control(_adapter *padapter);
+extern u8 set_tx_beacon_cmd(_adapter*padapter);
+unsigned int setup_beacon_frame(_adapter *padapter, unsigned char *beacon_frame);
+void update_mgnt_tx_rate(_adapter *padapter, u8 rate);
+void update_mgntframe_attrib(_adapter *padapter, struct pkt_attrib *pattrib);
+void dump_mgntframe(_adapter *padapter, struct xmit_frame *pmgntframe);
+s32 dump_mgntframe_and_wait(_adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms);
+s32 dump_mgntframe_and_wait_ack(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+#ifdef CONFIG_P2P
+void issue_probersp_p2p(_adapter *padapter, unsigned char *da);
+void issue_p2p_provision_request( _adapter *padapter, u8* pssid, u8 ussidlen, u8* pdev_raddr);
+void issue_p2p_GO_request(_adapter *padapter, u8* raddr);
+void issue_probereq_p2p(_adapter *padapter, u8 *da);
+int issue_probereq_p2p_ex(_adapter *adapter, u8 *da, int try_cnt, int wait_ms);
+void issue_p2p_invitation_response(_adapter *padapter, u8* raddr, u8 dialogToken, u8 success);
+void issue_p2p_invitation_request(_adapter *padapter, u8* raddr );
+#endif //CONFIG_P2P
+void issue_beacon(_adapter *padapter);
+void issue_probersp(_adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq);
+void issue_assocreq(_adapter *padapter);
+void issue_asocrsp(_adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type);
+void issue_auth(_adapter *padapter, struct sta_info *psta, unsigned short status);
+void issue_probereq(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da);
+s32 issue_probereq_ex(_adapter *padapter, NDIS_802_11_SSID *pssid, u8* da, int try_cnt, int wait_ms);
+int issue_nulldata(_adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms);
+int issue_qos_nulldata(_adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms);
+int issue_deauth(_adapter *padapter, unsigned char *da, unsigned short reason);
+int issue_deauth_ex(_adapter *padapter, u8 *da, unsigned short reason, int try_cnt, int wait_ms);
+void issue_action_spct_ch_switch(_adapter *padapter, u8 *ra, u8 new_ch, u8 ch_offset);
+void issue_action_BA(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status);
+#ifdef CONFIG_IEEE80211W
+void issue_action_SA_Query(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid);
+#endif //CONFIG_IEEE80211W
+unsigned int send_delba(_adapter *padapter, u8 initiator, u8 *addr);
+unsigned int send_beacon(_adapter *padapter);
+
+void start_clnt_assoc(_adapter *padapter);
+void start_clnt_auth(_adapter* padapter);
+void start_clnt_join(_adapter* padapter);
+void start_create_ibss(_adapter* padapter);
+
+unsigned int OnAssocReq(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAssocRsp(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnProbeReq(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnProbeRsp(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int DoReserved(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnBeacon(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAtim(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnDisassoc(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAuth(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAuthClient(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnDeAuth(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction(_adapter *padapter, union recv_frame *precv_frame);
+
+unsigned int on_action_spct(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_qos(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_dls(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_back(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int on_action_public(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_ht(_adapter *padapter, union recv_frame *precv_frame);
+#ifdef CONFIG_IEEE80211W
+unsigned int OnAction_sa_query(_adapter *padapter, union recv_frame *precv_frame);
+#endif //CONFIG_IEEE80211W
+unsigned int OnAction_wmm(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_p2p(_adapter *padapter, union recv_frame *precv_frame);
+
+
+void mlmeext_joinbss_event_callback(_adapter *padapter, int join_res);
+void mlmeext_sta_del_event_callback(_adapter *padapter);
+void mlmeext_sta_add_event_callback(_adapter *padapter, struct sta_info *psta);
+
+void linked_status_chk(_adapter *padapter);
+
+void survey_timer_hdl (_adapter *padapter);
+void link_timer_hdl (_adapter *padapter);
+void addba_timer_hdl(struct sta_info *psta);
+#ifdef CONFIG_IEEE80211W
+void sa_query_timer_hdl(_adapter *padapter);
+#endif //CONFIG_IEEE80211W
+//void reauth_timer_hdl(_adapter *padapter);
+//void reassoc_timer_hdl(_adapter *padapter);
+
+#define set_survey_timer(mlmeext, ms) \
+	do { \
+		/*DBG_871X("%s set_survey_timer(%p, %d)\n", __FUNCTION__, (mlmeext), (ms));*/ \
+		_set_timer(&(mlmeext)->survey_timer, (ms)); \
+	} while(0)
+
+#define set_link_timer(mlmeext, ms) \
+	do { \
+		/*DBG_871X("%s set_link_timer(%p, %d)\n", __FUNCTION__, (mlmeext), (ms));*/ \
+		_set_timer(&(mlmeext)->link_timer, (ms)); \
+	} while(0)
+#ifdef CONFIG_IEEE80211W
+#define set_sa_query_timer(mlmeext, ms) \
+	do { \
+		DBG_871X("%s set_sa_query_timer(%p, %d)\n", __FUNCTION__, (mlmeext), (ms)); \
+		_set_timer(&(mlmeext)->sa_query_timer, (ms)); \
+	} while(0)
+#endif //CONFIG_IEEE80211W
+extern int cckrates_included(unsigned char *rate, int ratelen);
+extern int cckratesonly_included(unsigned char *rate, int ratelen);
+
+extern void process_addba_req(_adapter *padapter, u8 *paddba_req, u8 *addr);
+
+extern void update_TSF(struct mlme_ext_priv *pmlmeext, u8 *pframe, uint len);
+extern void correct_TSF(_adapter *padapter, struct mlme_ext_priv *pmlmeext);
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+ sint check_buddy_mlmeinfo_state(_adapter *padapter, u32 state);
+void concurrent_chk_joinbss_done(_adapter *padapter, int join_res);
+#endif //CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+void	dc_SelectChannel(_adapter *padapter, unsigned char channel);
+void	dc_SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset);
+void	dc_set_channel_bwmode_disconnect(_adapter *padapter);
+u8	dc_handle_join_request(_adapter *padapter);
+void	dc_handle_join_done(_adapter *padapter, u8 join_res);
+sint	dc_check_fwstate(_adapter *padapter, sint fw_state);
+u8	dc_handle_site_survey(_adapter *padapter);
+void	dc_report_survey_event(_adapter *padapter, union recv_frame *precv_frame);
+void	dc_set_channel_bwmode_survey_done(_adapter *padapter);
+void	dc_set_ap_channel_bandwidth(_adapter *padapter, u8 channel, u8 channel_offset, u8 bwmode);
+void	dc_resume_xmit(_adapter *padapter);
+u8	dc_check_xmit(_adapter *padapter);
+#endif
+
+int rtw_chk_start_clnt_join(_adapter *padapter);
+int rtw_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset);
+
+struct cmd_hdl {
+	uint	parmsize;
+	u8 (*h2cfuns)(struct _ADAPTER *padapter, u8 *pbuf);	
+};
+
+
+u8 read_macreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 write_macreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 read_bbreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 write_bbreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 read_rfreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 write_rfreg_hdl(_adapter *padapter, u8 *pbuf);
+
+
+u8 NULL_hdl(_adapter *padapter, u8 *pbuf);
+u8 join_cmd_hdl(_adapter *padapter, u8 *pbuf);
+u8 disconnect_hdl(_adapter *padapter, u8 *pbuf);
+u8 createbss_hdl(_adapter *padapter, u8 *pbuf);
+u8 setopmode_hdl(_adapter *padapter, u8 *pbuf);
+u8 sitesurvey_cmd_hdl(_adapter *padapter, u8 *pbuf);	
+u8 setauth_hdl(_adapter *padapter, u8 *pbuf);
+u8 setkey_hdl(_adapter *padapter, u8 *pbuf);
+u8 set_stakey_hdl(_adapter *padapter, u8 *pbuf);
+u8 set_assocsta_hdl(_adapter *padapter, u8 *pbuf);
+u8 del_assocsta_hdl(_adapter *padapter, u8 *pbuf);
+u8 add_ba_hdl(_adapter *padapter, unsigned char *pbuf);
+
+u8 mlme_evt_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 h2c_msg_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 tx_beacon_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 set_ch_hdl(_adapter *padapter, u8 *pbuf);
+u8 set_chplan_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 led_blink_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 set_csa_hdl(_adapter *padapter, unsigned char *pbuf);	//Kurt: Handling DFS channel switch announcement ie.
+u8 tdls_hdl(_adapter *padapter, unsigned char *pbuf);
+
+
+#define GEN_DRV_CMD_HANDLER(size, cmd)	{size, &cmd ## _hdl},
+#define GEN_MLME_EXT_HANDLER(size, cmd)	{size, cmd},
+
+#ifdef _RTW_CMD_C_
+
+struct cmd_hdl wlancmds[] = 
+{
+	GEN_DRV_CMD_HANDLER(0, NULL) /*0*/
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL) /*10*/
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)		
+	GEN_MLME_EXT_HANDLER(sizeof (struct joinbss_parm), join_cmd_hdl) /*14*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct disconnect_parm), disconnect_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct createbss_parm), createbss_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setopmode_parm), setopmode_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct sitesurvey_parm), sitesurvey_cmd_hdl) /*18*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct setauth_parm), setauth_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setkey_parm), setkey_hdl) /*20*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct set_stakey_parm), set_stakey_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct set_assocsta_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct del_assocsta_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setstapwrstate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setbasicrate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getbasicrate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setdatarate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getdatarate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setphyinfo_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getphyinfo_parm), NULL)  /*30*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct setphy_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getphy_parm), NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)	/*40*/
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(sizeof(struct addBaReq_parm), add_ba_hdl)	
+	GEN_MLME_EXT_HANDLER(sizeof(struct set_ch_parm), set_ch_hdl) /* 46 */
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL) /*50*/
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL) 
+	GEN_MLME_EXT_HANDLER(sizeof(struct Tx_Beacon_param), tx_beacon_hdl) /*55*/
+
+	GEN_MLME_EXT_HANDLER(0, mlme_evt_hdl) /*56*/
+	GEN_MLME_EXT_HANDLER(0, rtw_drvextra_cmd_hdl) /*57*/
+
+	GEN_MLME_EXT_HANDLER(0, h2c_msg_hdl) /*58*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct SetChannelPlan_param), set_chplan_hdl) /*59*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct LedBlink_param), led_blink_hdl) /*60*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct SetChannelSwitch_param), set_csa_hdl) /*61*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct TDLSoption_param), tdls_hdl) /*62*/
+};
+
+#endif
+
+struct C2HEvent_Header
+{
+
+#ifdef CONFIG_LITTLE_ENDIAN
+
+	unsigned int len:16;
+	unsigned int ID:8;
+	unsigned int seq:8;
+	
+#elif defined(CONFIG_BIG_ENDIAN)
+
+	unsigned int seq:8;
+	unsigned int ID:8;
+	unsigned int len:16;
+	
+#else
+
+#  error "Must be LITTLE or BIG Endian"
+
+#endif
+
+	unsigned int rsvd;
+
+};
+
+void rtw_dummy_event_callback(_adapter *adapter , u8 *pbuf);
+void rtw_fwdbg_event_callback(_adapter *adapter , u8 *pbuf);
+
+enum rtw_c2h_event
+{
+	GEN_EVT_CODE(_Read_MACREG)=0, /*0*/
+	GEN_EVT_CODE(_Read_BBREG),
+ 	GEN_EVT_CODE(_Read_RFREG),
+ 	GEN_EVT_CODE(_Read_EEPROM),
+ 	GEN_EVT_CODE(_Read_EFUSE),
+	GEN_EVT_CODE(_Read_CAM),			/*5*/
+ 	GEN_EVT_CODE(_Get_BasicRate),  
+ 	GEN_EVT_CODE(_Get_DataRate),   
+ 	GEN_EVT_CODE(_Survey),	 /*8*/
+ 	GEN_EVT_CODE(_SurveyDone),	 /*9*/
+ 	
+ 	GEN_EVT_CODE(_JoinBss) , /*10*/
+ 	GEN_EVT_CODE(_AddSTA),
+ 	GEN_EVT_CODE(_DelSTA),
+ 	GEN_EVT_CODE(_AtimDone) ,
+ 	GEN_EVT_CODE(_TX_Report),  
+	GEN_EVT_CODE(_CCX_Report),			/*15*/
+ 	GEN_EVT_CODE(_DTM_Report),
+ 	GEN_EVT_CODE(_TX_Rate_Statistics),
+ 	GEN_EVT_CODE(_C2HLBK), 
+ 	GEN_EVT_CODE(_FWDBG),
+	GEN_EVT_CODE(_C2HFEEDBACK),               /*20*/
+	GEN_EVT_CODE(_ADDBA),
+	GEN_EVT_CODE(_C2HBCN),
+	GEN_EVT_CODE(_ReportPwrState),		//filen: only for PCIE, USB	
+	GEN_EVT_CODE(_CloseRF),				//filen: only for PCIE, work around ASPM
+ 	MAX_C2HEVT
+};
+
+
+#ifdef _RTW_MLME_EXT_C_		
+
+static struct fwevent wlanevents[] = 
+{
+	{0, rtw_dummy_event_callback}, 	/*0*/
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, &rtw_survey_event_callback},		/*8*/
+	{sizeof (struct surveydone_event), &rtw_surveydone_event_callback},	/*9*/
+		
+	{0, &rtw_joinbss_event_callback},		/*10*/
+	{sizeof(struct stassoc_event), &rtw_stassoc_event_callback},
+	{sizeof(struct stadel_event), &rtw_stadel_event_callback},	
+	{0, &rtw_atimdone_event_callback},
+	{0, rtw_dummy_event_callback},
+	{0, NULL},	/*15*/
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, rtw_fwdbg_event_callback},
+	{0, NULL},	 /*20*/
+	{0, NULL},
+	{0, NULL},	
+	{0, &rtw_cpwm_event_callback},
+};
+
+#endif//_RTL8192C_CMD_C_
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h
new file mode 100755
index 0000000000000..0ebb1ba62575c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h
@@ -0,0 +1,712 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_MP_H_
+#define _RTW_MP_H_
+
+#ifndef PLATFORM_WINDOWS
+//	00 - Success
+//	11 - Error
+#define STATUS_SUCCESS				(0x00000000L)
+#define STATUS_PENDING				(0x00000103L)
+
+#define STATUS_UNSUCCESSFUL			(0xC0000001L)
+#define STATUS_INSUFFICIENT_RESOURCES		(0xC000009AL)
+#define STATUS_NOT_SUPPORTED			(0xC00000BBL)
+
+#define NDIS_STATUS_SUCCESS			((NDIS_STATUS)STATUS_SUCCESS)
+#define NDIS_STATUS_PENDING			((NDIS_STATUS)STATUS_PENDING)
+#define NDIS_STATUS_NOT_RECOGNIZED		((NDIS_STATUS)0x00010001L)
+#define NDIS_STATUS_NOT_COPIED			((NDIS_STATUS)0x00010002L)
+#define NDIS_STATUS_NOT_ACCEPTED		((NDIS_STATUS)0x00010003L)
+#define NDIS_STATUS_CALL_ACTIVE			((NDIS_STATUS)0x00010007L)
+
+#define NDIS_STATUS_FAILURE			((NDIS_STATUS)STATUS_UNSUCCESSFUL)
+#define NDIS_STATUS_RESOURCES			((NDIS_STATUS)STATUS_INSUFFICIENT_RESOURCES)
+#define NDIS_STATUS_CLOSING			((NDIS_STATUS)0xC0010002L)
+#define NDIS_STATUS_BAD_VERSION			((NDIS_STATUS)0xC0010004L)
+#define NDIS_STATUS_BAD_CHARACTERISTICS		((NDIS_STATUS)0xC0010005L)
+#define NDIS_STATUS_ADAPTER_NOT_FOUND		((NDIS_STATUS)0xC0010006L)
+#define NDIS_STATUS_OPEN_FAILED			((NDIS_STATUS)0xC0010007L)
+#define NDIS_STATUS_DEVICE_FAILED		((NDIS_STATUS)0xC0010008L)
+#define NDIS_STATUS_MULTICAST_FULL		((NDIS_STATUS)0xC0010009L)
+#define NDIS_STATUS_MULTICAST_EXISTS		((NDIS_STATUS)0xC001000AL)
+#define NDIS_STATUS_MULTICAST_NOT_FOUND		((NDIS_STATUS)0xC001000BL)
+#define NDIS_STATUS_REQUEST_ABORTED		((NDIS_STATUS)0xC001000CL)
+#define NDIS_STATUS_RESET_IN_PROGRESS		((NDIS_STATUS)0xC001000DL)
+#define NDIS_STATUS_CLOSING_INDICATING		((NDIS_STATUS)0xC001000EL)
+#define NDIS_STATUS_NOT_SUPPORTED		((NDIS_STATUS)STATUS_NOT_SUPPORTED)
+#define NDIS_STATUS_INVALID_PACKET		((NDIS_STATUS)0xC001000FL)
+#define NDIS_STATUS_OPEN_LIST_FULL		((NDIS_STATUS)0xC0010010L)
+#define NDIS_STATUS_ADAPTER_NOT_READY		((NDIS_STATUS)0xC0010011L)
+#define NDIS_STATUS_ADAPTER_NOT_OPEN		((NDIS_STATUS)0xC0010012L)
+#define NDIS_STATUS_NOT_INDICATING		((NDIS_STATUS)0xC0010013L)
+#define NDIS_STATUS_INVALID_LENGTH		((NDIS_STATUS)0xC0010014L)
+#define NDIS_STATUS_INVALID_DATA		((NDIS_STATUS)0xC0010015L)
+#define NDIS_STATUS_BUFFER_TOO_SHORT		((NDIS_STATUS)0xC0010016L)
+#define NDIS_STATUS_INVALID_OID			((NDIS_STATUS)0xC0010017L)
+#define NDIS_STATUS_ADAPTER_REMOVED		((NDIS_STATUS)0xC0010018L)
+#define NDIS_STATUS_UNSUPPORTED_MEDIA		((NDIS_STATUS)0xC0010019L)
+#define NDIS_STATUS_GROUP_ADDRESS_IN_USE	((NDIS_STATUS)0xC001001AL)
+#define NDIS_STATUS_FILE_NOT_FOUND		((NDIS_STATUS)0xC001001BL)
+#define NDIS_STATUS_ERROR_READING_FILE		((NDIS_STATUS)0xC001001CL)
+#define NDIS_STATUS_ALREADY_MAPPED		((NDIS_STATUS)0xC001001DL)
+#define NDIS_STATUS_RESOURCE_CONFLICT		((NDIS_STATUS)0xC001001EL)
+#define NDIS_STATUS_NO_CABLE			((NDIS_STATUS)0xC001001FL)
+
+#define NDIS_STATUS_INVALID_SAP			((NDIS_STATUS)0xC0010020L)
+#define NDIS_STATUS_SAP_IN_USE			((NDIS_STATUS)0xC0010021L)
+#define NDIS_STATUS_INVALID_ADDRESS		((NDIS_STATUS)0xC0010022L)
+#define NDIS_STATUS_VC_NOT_ACTIVATED		((NDIS_STATUS)0xC0010023L)
+#define NDIS_STATUS_DEST_OUT_OF_ORDER		((NDIS_STATUS)0xC0010024L)  // cause 27
+#define NDIS_STATUS_VC_NOT_AVAILABLE		((NDIS_STATUS)0xC0010025L)  // cause 35,45
+#define NDIS_STATUS_CELLRATE_NOT_AVAILABLE	((NDIS_STATUS)0xC0010026L)  // cause 37
+#define NDIS_STATUS_INCOMPATABLE_QOS		((NDIS_STATUS)0xC0010027L)  // cause 49
+#define NDIS_STATUS_AAL_PARAMS_UNSUPPORTED	((NDIS_STATUS)0xC0010028L)  // cause 93
+#define NDIS_STATUS_NO_ROUTE_TO_DESTINATION	((NDIS_STATUS)0xC0010029L)  // cause 3
+#endif /* #ifndef PLATFORM_WINDOWS */
+
+#if 0
+#define MPT_NOOP			0
+#define MPT_READ_MAC_1BYTE		1
+#define MPT_READ_MAC_2BYTE		2
+#define MPT_READ_MAC_4BYTE		3
+#define MPT_WRITE_MAC_1BYTE		4
+#define MPT_WRITE_MAC_2BYTE		5
+#define MPT_WRITE_MAC_4BYTE		6
+#define MPT_READ_BB_CCK			7
+#define MPT_WRITE_BB_CCK		8
+#define MPT_READ_BB_OFDM		9
+#define MPT_WRITE_BB_OFDM		10
+#define MPT_READ_RF			11
+#define MPT_WRITE_RF			12
+#define MPT_READ_EEPROM_1BYTE		13
+#define MPT_WRITE_EEPROM_1BYTE		14
+#define MPT_READ_EEPROM_2BYTE		15
+#define MPT_WRITE_EEPROM_2BYTE		16
+#define MPT_SET_CSTHRESHOLD		21
+#define MPT_SET_INITGAIN		22
+#define MPT_SWITCH_BAND			23
+#define MPT_SWITCH_CHANNEL		24
+#define MPT_SET_DATARATE		25
+#define MPT_SWITCH_ANTENNA		26
+#define MPT_SET_TX_POWER		27
+#define MPT_SET_CONT_TX			28
+#define MPT_SET_SINGLE_CARRIER		29
+#define MPT_SET_CARRIER_SUPPRESSION	30
+#define MPT_GET_RATE_TABLE		31
+#define MPT_READ_TSSI			32
+#define MPT_GET_THERMAL_METER		33
+#endif
+
+#define MAX_MP_XMITBUF_SZ 	2048
+#define NR_MP_XMITFRAME		8
+
+struct mp_xmit_frame
+{
+	_list	list;
+
+	struct pkt_attrib attrib;
+
+	_pkt *pkt;
+
+	int frame_tag;
+
+	_adapter *padapter;
+
+#ifdef CONFIG_USB_HCI
+
+	//insert urb, irp, and irpcnt info below...
+	//max frag_cnt = 8
+
+	u8 *mem_addr;
+	u32 sz[8];
+
+#if defined(PLATFORM_OS_XP) || defined(PLATFORM_LINUX)
+	PURB pxmit_urb[8];
+#endif
+
+#ifdef PLATFORM_OS_XP
+	PIRP pxmit_irp[8];
+#endif
+
+	u8 bpending[8];
+	sint ac_tag[8];
+	sint last[8];
+	uint irpcnt;
+	uint fragcnt;
+#endif /* CONFIG_USB_HCI */
+
+	uint mem[(MAX_MP_XMITBUF_SZ >> 2)];
+};
+
+struct mp_wiparam
+{
+	u32 bcompleted;
+	u32 act_type;
+	u32 io_offset;
+	u32 io_value;
+};
+
+typedef void(*wi_act_func)(void* padapter);
+
+#ifdef PLATFORM_WINDOWS
+struct mp_wi_cntx
+{
+	u8 bmpdrv_unload;
+
+	// Work Item
+	NDIS_WORK_ITEM mp_wi;
+	NDIS_EVENT mp_wi_evt;
+	_lock mp_wi_lock;
+	u8 bmp_wi_progress;
+	wi_act_func curractfunc;
+	// Variable needed in each implementation of CurrActFunc.
+	struct mp_wiparam param;
+};
+#endif
+
+struct mp_tx
+{
+	u8 stop;
+	u32 count, sended;
+	u8 payload;
+	struct pkt_attrib attrib;
+	struct tx_desc desc;
+	u8 *pallocated_buf;
+	u8 *buf;
+	u32 buf_size, write_size;
+	_thread_hdl_  PktTxThread;
+};
+
+//#if (MP_DRIVER == 1)
+#if defined(CONFIG_RTL8192C) || defined(CONFIG_RTL8192D) || defined(CONFIG_RTL8723A) || defined(CONFIG_RTL8188E)
+#ifdef CONFIG_RTL8192C
+#include <Hal8192CPhyCfg.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <Hal8192DPhyCfg.h>
+#endif
+#ifdef CONFIG_RTL8723A
+#include <Hal8723APhyCfg.h>
+#endif
+#ifdef CONFIG_RTL8188E
+#include <rtl8188e_hal.h>
+#endif
+#define MP_MAX_LINES		1000
+#define MP_MAX_LINES_BYTES	256
+#define u1Byte u8
+#define s1Byte s8
+#define u4Byte u32
+#define s4Byte s32
+typedef VOID (*MPT_WORK_ITEM_HANDLER)(IN PVOID Adapter);
+typedef struct _MPT_CONTEXT
+{
+	// Indicate if we have started Mass Production Test.
+	BOOLEAN			bMassProdTest;
+
+	// Indicate if the driver is unloading or unloaded.
+	BOOLEAN			bMptDrvUnload;
+
+	/* 8190 PCI does not support NDIS_WORK_ITEM. */
+	// Work Item for Mass Production Test.
+	//NDIS_WORK_ITEM	MptWorkItem;
+//	RT_WORK_ITEM		MptWorkItem;
+	// Event used to sync the case unloading driver and MptWorkItem is still in progress.
+//	NDIS_EVENT		MptWorkItemEvent;
+	// To protect the following variables.
+//	NDIS_SPIN_LOCK		MptWorkItemSpinLock;
+	// Indicate a MptWorkItem is scheduled and not yet finished.
+	BOOLEAN			bMptWorkItemInProgress;
+	// An instance which implements function and context of MptWorkItem.
+	MPT_WORK_ITEM_HANDLER	CurrMptAct;
+
+	// 1=Start, 0=Stop from UI.
+	ULONG			MptTestStart;
+	// _TEST_MODE, defined in MPT_Req2.h
+	ULONG			MptTestItem;
+	// Variable needed in each implementation of CurrMptAct.
+	ULONG			MptActType; 	// Type of action performed in CurrMptAct.
+	// The Offset of IO operation is depend of MptActType.
+	ULONG			MptIoOffset;
+	// The Value of IO operation is depend of MptActType.
+	ULONG			MptIoValue;
+	// The RfPath of IO operation is depend of MptActType.
+	ULONG			MptRfPath;
+
+	WIRELESS_MODE		MptWirelessModeToSw;	// Wireless mode to switch.
+	u8			MptChannelToSw; 	// Channel to switch.
+	u8			MptInitGainToSet; 	// Initial gain to set.
+	//ULONG			bMptAntennaA; 		// TRUE if we want to use antenna A.
+	ULONG			MptBandWidth;		// bandwidth to switch.
+	ULONG			MptRateIndex;		// rate index.
+	// Register value kept for Single Carrier Tx test.
+	u8			btMpCckTxPower;
+	// Register value kept for Single Carrier Tx test.
+	u8			btMpOfdmTxPower;
+	// For MP Tx Power index
+	u8			TxPwrLevel[2];	// rf-A, rf-B
+
+	// Content of RCR Regsiter for Mass Production Test.
+	ULONG			MptRCR;
+	// TRUE if we only receive packets with specific pattern.
+	BOOLEAN			bMptFilterPattern;
+ 	// Rx OK count, statistics used in Mass Production Test.
+ 	ULONG			MptRxOkCnt;
+ 	// Rx CRC32 error count, statistics used in Mass Production Test.
+ 	ULONG			MptRxCrcErrCnt;
+
+	BOOLEAN			bCckContTx;	// TRUE if we are in CCK Continuous Tx test.
+ 	BOOLEAN			bOfdmContTx;	// TRUE if we are in OFDM Continuous Tx test.
+	BOOLEAN			bStartContTx; 	// TRUE if we have start Continuous Tx test.
+	// TRUE if we are in Single Carrier Tx test.
+	BOOLEAN			bSingleCarrier;
+	// TRUE if we are in Carrier Suppression Tx Test.
+	BOOLEAN			bCarrierSuppression;
+	//TRUE if we are in Single Tone Tx test.
+	BOOLEAN			bSingleTone;
+
+	// ACK counter asked by K.Y..
+	BOOLEAN			bMptEnableAckCounter;
+	ULONG			MptAckCounter;
+
+	// SD3 Willis For 8192S to save 1T/2T RF table for ACUT	Only fro ACUT delete later ~~~!
+	//s1Byte		BufOfLines[2][MAX_LINES_HWCONFIG_TXT][MAX_BYTES_LINE_HWCONFIG_TXT];
+	//s1Byte			BufOfLines[2][MP_MAX_LINES][MP_MAX_LINES_BYTES];
+	//s4Byte			RfReadLine[2];
+
+	u8		APK_bound[2];	//for APK	path A/path B
+	BOOLEAN		bMptIndexEven;
+
+	u8		backup0xc50;
+	u8		backup0xc58;
+	u8		backup0xc30;
+}MPT_CONTEXT, *PMPT_CONTEXT;
+#endif
+//#endif
+
+/* E-Fuse */
+#ifdef CONFIG_RTL8192D
+#define EFUSE_MAP_SIZE		255
+#endif
+#ifdef CONFIG_RTL8192C
+#define EFUSE_MAP_SIZE		128
+#endif
+#ifdef CONFIG_RTL8723A
+#define EFUSE_MAP_SIZE		256
+#endif
+#ifdef CONFIG_RTL8188E
+#define EFUSE_MAP_SIZE		256
+#endif
+#define EFUSE_MAX_SIZE		512
+
+/* end of E-Fuse */
+
+//#define RTPRIV_IOCTL_MP 					( SIOCIWFIRSTPRIV + 0x17)
+enum {	  
+	WRITE_REG = 1,
+	READ_REG,
+	WRITE_RF,
+	READ_RF,
+	MP_START,
+	MP_STOP,
+	MP_RATE,
+	MP_CHANNEL,
+	MP_BANDWIDTH,
+	MP_TXPOWER,
+	MP_ANT_TX,
+	MP_ANT_RX,
+	MP_CTX,
+	MP_QUERY,
+	MP_ARX,
+	MP_PSD,
+	MP_PWRTRK,
+	MP_THER,
+	MP_IOCTL,
+	EFUSE_GET,
+	EFUSE_SET,
+	MP_RESET_STATS,
+	MP_DUMP,
+	MP_PHYPARA,
+	MP_NULL,
+};
+
+struct mp_priv
+{
+	_adapter *papdater;
+
+	//Testing Flag
+	u32 mode;//0 for normal type packet, 1 for loopback packet (16bytes TXCMD)
+
+	u32 prev_fw_state;
+
+	//OID cmd handler
+	struct mp_wiparam workparam;
+//	u8 act_in_progress;
+
+	//Tx Section
+	u8 TID;
+	u32 tx_pktcount;
+	struct mp_tx tx;
+
+	//Rx Section
+	u32 rx_pktcount;
+	u32 rx_crcerrpktcount;
+	u32 rx_pktloss;
+
+	struct recv_stat rxstat;
+
+	//RF/BB relative
+	u8 channel;
+	u8 bandwidth;
+	u8 prime_channel_offset;
+	u8 txpoweridx;
+	u8 txpoweridx_b;
+	u8 rateidx;
+	u32 preamble;
+//	u8 modem;
+	u32 CrystalCap;
+//	u32 curr_crystalcap;
+
+	u16 antenna_tx;
+	u16 antenna_rx;
+//	u8 curr_rfpath;
+
+	u8 check_mp_pkt;
+
+//	uint ForcedDataRate;
+
+	struct wlan_network mp_network;
+	NDIS_802_11_MAC_ADDRESS network_macaddr;
+
+#ifdef PLATFORM_WINDOWS
+	u32 rx_testcnt;
+	u32 rx_testcnt1;
+	u32 rx_testcnt2;
+	u32 tx_testcnt;
+	u32 tx_testcnt1;
+
+	struct mp_wi_cntx wi_cntx;
+
+	u8 h2c_result;
+	u8 h2c_seqnum;
+	u16 h2c_cmdcode;
+	u8 h2c_resp_parambuf[512];
+	_lock h2c_lock;
+	_lock wkitm_lock;
+	u32 h2c_cmdcnt;
+	NDIS_EVENT h2c_cmd_evt;
+	NDIS_EVENT c2h_set;
+	NDIS_EVENT h2c_clr;
+	NDIS_EVENT cpwm_int;
+
+	NDIS_EVENT scsir_full_evt;
+	NDIS_EVENT scsiw_empty_evt;
+#endif
+
+	u8 *pallocated_mp_xmitframe_buf;
+	u8 *pmp_xmtframe_buf;
+	_queue free_mp_xmitqueue;
+	u32 free_mp_xmitframe_cnt;
+
+	MPT_CONTEXT MptCtx;
+};
+
+typedef struct _IOCMD_STRUCT_ {
+	u8	cmdclass;
+	u16	value;
+	u8	index;
+}IOCMD_STRUCT;
+
+struct rf_reg_param {
+	u32 path;
+	u32 offset;
+	u32 value;
+};
+
+struct bb_reg_param {
+	u32 offset;
+	u32 value;
+};
+//=======================================================================
+
+#define LOWER 	_TRUE
+#define RAISE	_FALSE
+
+/* Hardware Registers */
+#if 0
+#if 0
+#define IOCMD_CTRL_REG			0x102502C0
+#define IOCMD_DATA_REG			0x102502C4
+#else
+#define IOCMD_CTRL_REG			0x10250370
+#define IOCMD_DATA_REG			0x10250374
+#endif
+
+#define IOCMD_GET_THERMAL_METER		0xFD000028
+
+#define IOCMD_CLASS_BB_RF		0xF0
+#define IOCMD_BB_READ_IDX		0x00
+#define IOCMD_BB_WRITE_IDX		0x01
+#define IOCMD_RF_READ_IDX		0x02
+#define IOCMD_RF_WRIT_IDX		0x03
+#endif
+#define BB_REG_BASE_ADDR		0x800
+
+/* MP variables */
+#if 0
+#define _2MAC_MODE_	0
+#define _LOOPBOOK_MODE_	1
+#endif
+typedef enum _MP_MODE_ {
+	MP_OFF,
+	MP_ON,
+	MP_ERR,
+	MP_CONTINUOUS_TX,
+	MP_SINGLE_CARRIER_TX,
+	MP_CARRIER_SUPPRISSION_TX,
+	MP_SINGLE_TONE_TX,
+	MP_PACKET_TX,
+	MP_PACKET_RX
+} MP_MODE;
+
+#ifdef CONFIG_RTL8192C
+#define RF_PATH_A 	RF_PATH_A
+#define RF_PATH_B 	RF_PATH_B
+#define RF_PATH_C 	RF_PATH_C
+#define RF_PATH_D 	RF_PATH_D
+
+#define MAX_RF_PATH_NUMS	RF_PATH_MAX
+#else
+#define RF_PATH_A 	0
+#define RF_PATH_B 	1
+#define RF_PATH_C 	2
+#define RF_PATH_D 	3
+
+#define MAX_RF_PATH_NUMS	2
+#endif
+
+extern u8 mpdatarate[NumRates];
+
+/* MP set force data rate base on the definition. */
+typedef enum _MPT_RATE_INDEX
+{
+	/* CCK rate. */
+	MPT_RATE_1M,	/* 0 */
+	MPT_RATE_2M,
+	MPT_RATE_55M,
+	MPT_RATE_11M,	/* 3 */
+
+	/* OFDM rate. */
+	MPT_RATE_6M,	/* 4 */
+	MPT_RATE_9M,
+	MPT_RATE_12M,
+	MPT_RATE_18M,
+	MPT_RATE_24M,
+	MPT_RATE_36M,
+	MPT_RATE_48M,
+	MPT_RATE_54M,	/* 11 */
+
+	/* HT rate. */
+	MPT_RATE_MCS0,	/* 12 */
+	MPT_RATE_MCS1,
+	MPT_RATE_MCS2,
+	MPT_RATE_MCS3,
+	MPT_RATE_MCS4,
+	MPT_RATE_MCS5,
+	MPT_RATE_MCS6,
+	MPT_RATE_MCS7,	/* 19 */
+	MPT_RATE_MCS8,
+	MPT_RATE_MCS9,
+	MPT_RATE_MCS10,
+	MPT_RATE_MCS11,
+	MPT_RATE_MCS12,
+	MPT_RATE_MCS13,
+	MPT_RATE_MCS14,
+	MPT_RATE_MCS15,	/* 27 */
+	MPT_RATE_LAST
+}MPT_RATE_E, *PMPT_RATE_E;
+
+#if 0
+// Represent Channel Width in HT Capabilities
+typedef enum _HT_CHANNEL_WIDTH {
+	HT_CHANNEL_WIDTH_20 = 0,
+	HT_CHANNEL_WIDTH_40 = 1,
+}HT_CHANNEL_WIDTH, *PHT_CHANNEL_WIDTH;
+#endif
+
+#define MAX_TX_PWR_INDEX_N_MODE 64	// 0x3F
+
+typedef enum _POWER_MODE_ {
+	POWER_LOW = 0,
+	POWER_NORMAL
+}POWER_MODE;
+
+
+#define RX_PKT_BROADCAST	1
+#define RX_PKT_DEST_ADDR	2
+#define RX_PKT_PHY_MATCH	3
+
+#if 0
+#define RPTMaxCount 0x000FFFFF;
+
+// parameter 1 : BitMask
+// 	bit 0  : OFDM PPDU
+//	bit 1  : OFDM False Alarm
+//	bit 2  : OFDM MPDU OK
+//	bit 3  : OFDM MPDU Fail
+//	bit 4  : CCK PPDU
+//	bit 5  : CCK False Alarm
+//	bit 6  : CCK MPDU ok
+//	bit 7  : CCK MPDU fail
+//	bit 8  : HT PPDU counter
+//	bit 9  : HT false alarm
+//	bit 10 : HT MPDU total
+//	bit 11 : HT MPDU OK
+//	bit 12 : HT MPDU fail
+//	bit 15 : RX full drop
+typedef enum _RXPHY_BITMASK_
+{
+	OFDM_PPDU_BIT = 0,
+	OFDM_FALSE_BIT,
+	OFDM_MPDU_OK_BIT,
+	OFDM_MPDU_FAIL_BIT,
+	CCK_PPDU_BIT,
+	CCK_FALSE_BIT,
+	CCK_MPDU_OK_BIT,
+	CCK_MPDU_FAIL_BIT,
+	HT_PPDU_BIT,
+	HT_FALSE_BIT,
+	HT_MPDU_BIT,
+	HT_MPDU_OK_BIT,
+	HT_MPDU_FAIL_BIT,
+} RXPHY_BITMASK;
+#endif
+
+typedef enum _ENCRY_CTRL_STATE_ {
+	HW_CONTROL,		//hw encryption& decryption
+	SW_CONTROL,		//sw encryption& decryption
+	HW_ENCRY_SW_DECRY,	//hw encryption & sw decryption
+	SW_ENCRY_HW_DECRY	//sw encryption & hw decryption
+}ENCRY_CTRL_STATE;
+
+typedef enum _OFDM_TX_MODE {
+	OFDM_ALL_OFF		= 0,	
+	OFDM_ContinuousTx	= 1,
+	OFDM_SingleCarrier	= 2,
+	OFDM_SingleTone 	= 4,
+} OFDM_TX_MODE;
+
+//=======================================================================
+//extern struct mp_xmit_frame *alloc_mp_xmitframe(struct mp_priv *pmp_priv);
+//extern int free_mp_xmitframe(struct xmit_priv *pxmitpriv, struct mp_xmit_frame *pmp_xmitframe);
+
+extern s32 init_mp_priv(PADAPTER padapter);
+extern void free_mp_priv(struct mp_priv *pmp_priv);
+extern s32 MPT_InitializeAdapter(PADAPTER padapter, u8 Channel);
+extern void MPT_DeInitAdapter(PADAPTER padapter);
+extern s32 mp_start_test(PADAPTER padapter);
+extern void mp_stop_test(PADAPTER padapter);
+
+//=======================================================================
+//extern void	IQCalibrateBcut(PADAPTER pAdapter);
+
+//extern u32	bb_reg_read(PADAPTER Adapter, u16 offset);
+//extern u8	bb_reg_write(PADAPTER Adapter, u16 offset, u32 value);
+//extern u32	rf_reg_read(PADAPTER Adapter, u8 path, u8 offset);
+//extern u8	rf_reg_write(PADAPTER Adapter, u8 path, u8 offset, u32 value);
+
+//extern u32	get_bb_reg(PADAPTER Adapter, u16 offset, u32 bitmask);
+//extern u8	set_bb_reg(PADAPTER Adapter, u16 offset, u32 bitmask, u32 value);
+//extern u32	get_rf_reg(PADAPTER Adapter, u8 path, u8 offset, u32 bitmask);
+//extern u8	set_rf_reg(PADAPTER Adapter, u8 path, u8 offset, u32 bitmask, u32 value);
+
+extern u32 _read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask);
+extern void _write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask, u32 val);
+
+extern u32 read_macreg(_adapter *padapter, u32 addr, u32 sz);
+extern void write_macreg(_adapter *padapter, u32 addr, u32 val, u32 sz);
+extern u32 read_bbreg(_adapter *padapter, u32 addr, u32 bitmask);
+extern void write_bbreg(_adapter *padapter, u32 addr, u32 bitmask, u32 val);
+extern u32 read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr);
+extern void write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 val);
+
+extern void	SetChannel(PADAPTER pAdapter);
+extern void	SetBandwidth(PADAPTER pAdapter);
+extern void	SetTxPower(PADAPTER pAdapter);
+extern void	SetAntennaPathPower(PADAPTER pAdapter);
+//extern void	SetTxAGCOffset(PADAPTER pAdapter, u32 ulTxAGCOffset);
+extern void	SetDataRate(PADAPTER pAdapter);
+
+extern void	SetAntenna(PADAPTER pAdapter);
+
+//extern void	SetCrystalCap(PADAPTER pAdapter);
+
+extern s32	SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern void	GetThermalMeter(PADAPTER pAdapter, u8 *value);
+
+extern void	SetContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void	SetSingleCarrierTx(PADAPTER pAdapter, u8 bStart);
+extern void	SetSingleToneTx(PADAPTER pAdapter, u8 bStart);
+extern void	SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+
+extern void	fill_txdesc_for_mp(PADAPTER padapter, struct tx_desc *ptxdesc);
+extern void	SetPacketTx(PADAPTER padapter);
+extern void	SetPacketRx(PADAPTER pAdapter, u8 bStartRx);
+
+extern void	ResetPhyRxPktCount(PADAPTER pAdapter);
+extern u32	GetPhyRxPktReceived(PADAPTER pAdapter);
+extern u32	GetPhyRxPktCRC32Error(PADAPTER pAdapter);
+
+extern s32	SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void	GetPowerTracking(PADAPTER padapter, u8 *enable);
+
+extern u32	mp_query_psd(PADAPTER pAdapter, u8 *data);
+
+
+extern void Hal_SetAntenna(PADAPTER pAdapter);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetTxPower(PADAPTER pAdapter);
+extern void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetSingleToneTx ( PADAPTER pAdapter , u8 bStart );
+extern void Hal_SetSingleCarrierTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetContinuousTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetDataRate(PADAPTER pAdapter);
+extern void Hal_SetChannel(PADAPTER pAdapter);
+extern void Hal_SetAntennaPathPower(PADAPTER pAdapter);
+extern s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void Hal_GetPowerTracking(PADAPTER padapter, u8 * enable);
+extern void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value);
+extern void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter);
+extern void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14);
+extern void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven);
+extern void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_TriggerRFThermalMeter(PADAPTER pAdapter);
+extern u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter);
+extern void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_ProSetCrystalCap (PADAPTER pAdapter , u32 CrystalCapVal);
+
+#endif //_RTW_MP_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h
new file mode 100755
index 0000000000000..962bc38eee7f7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h
@@ -0,0 +1,596 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_MP_IOCTL_H_
+#define _RTW_MP_IOCTL_H_
+
+//#include <drv_conf.h>
+//#include <osdep_service.h>
+#include <drv_types.h>
+#include <mp_custom_oid.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_rtl.h>
+#include <rtw_efuse.h>
+#include <rtw_mp.h>
+
+#if 0
+#define TESTFWCMDNUMBER			1000000
+#define TEST_H2CINT_WAIT_TIME		500
+#define TEST_C2HINT_WAIT_TIME		500
+#define HCI_TEST_SYSCFG_HWMASK		1
+#define _BUSCLK_40M			(4 << 2)
+#endif
+//------------------------------------------------------------------------------
+typedef struct CFG_DBG_MSG_STRUCT {
+	u32 DebugLevel;
+	u32 DebugComponent_H32;
+	u32 DebugComponent_L32;
+}CFG_DBG_MSG_STRUCT,*PCFG_DBG_MSG_STRUCT;
+
+typedef struct _RW_REG {
+	u32 offset;
+	u32 width;
+	u32 value;
+}mp_rw_reg,RW_Reg, *pRW_Reg;
+
+//for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM
+typedef struct _EEPROM_RW_PARAM {
+	u32 offset;
+	u16 value;
+}eeprom_rw_param,EEPROM_RWParam, *pEEPROM_RWParam;
+
+typedef struct _EFUSE_ACCESS_STRUCT_ {
+	u16	start_addr;
+	u16	cnts;
+	u8	data[0];
+}EFUSE_ACCESS_STRUCT, *PEFUSE_ACCESS_STRUCT;
+
+typedef struct _BURST_RW_REG {
+	u32 offset;
+	u32 len;
+	u8 Data[256];
+}burst_rw_reg,Burst_RW_Reg, *pBurst_RW_Reg;
+
+typedef struct _USB_VendorReq{
+	u8	bRequest;
+	u16	wValue;
+	u16	wIndex;
+	u16	wLength;
+	u8	u8Dir;//0:OUT, 1:IN
+	u8	u8InData;
+}usb_vendor_req, USB_VendorReq, *pUSB_VendorReq;
+
+typedef struct _DR_VARIABLE_STRUCT_ {
+	u8 offset;
+	u32 variable;
+}DR_VARIABLE_STRUCT;
+
+//int mp_start_joinbss(_adapter *padapter, NDIS_802_11_SSID *pssid);
+
+//void _irqlevel_changed_(_irqL *irqlevel, /*BOOLEAN*/unsigned char bLower);
+#ifdef PLATFORM_OS_XP
+static void _irqlevel_changed_(_irqL *irqlevel, u8 bLower)
+{
+
+	if (bLower == LOWER) {
+		*irqlevel = KeGetCurrentIrql();
+
+		if (*irqlevel > PASSIVE_LEVEL) {
+			KeLowerIrql(PASSIVE_LEVEL);
+		}
+	} else {
+		if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+			KeRaiseIrql(DISPATCH_LEVEL, irqlevel);
+		}
+	}
+
+}
+#else
+#define _irqlevel_changed_(a,b)
+#endif
+
+//oid_rtl_seg_81_80_00
+NDIS_STATUS oid_rt_pro_set_data_rate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_start_test_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_stop_test_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv* poid_par_priv);
+//oid_rtl_seg_81_80_20
+NDIS_STATUS oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_modulation_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//oid_rtl_seg_81_87
+NDIS_STATUS oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//oid_rtl_seg_81_85
+NDIS_STATUS oid_rt_wireless_mode_hdl(struct oid_par_priv* poid_par_priv);
+
+
+// oid_rtl_seg_87_11_00
+NDIS_STATUS oid_rt_pro8711_join_bss_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_write_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_burst_read_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_burst_write_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_write_txcmd_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read16_eeprom_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_write16_eeprom_hdl (struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro8711_wi_poll_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro8711_pkt_loss_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_rd_attrib_mem_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_wr_attrib_mem_hdl (struct oid_par_priv* poid_par_priv);
+NDIS_STATUS  oid_rt_pro_set_rf_intfs_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_poll_rx_status_hdl(struct oid_par_priv* poid_par_priv);
+// oid_rtl_seg_87_11_20
+NDIS_STATUS oid_rt_pro_cfg_debug_message_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_data_rate_ex_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_basic_rate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_tssi_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_power_tracking_hdl(struct oid_par_priv* poid_par_priv);
+//oid_rtl_seg_87_11_50
+NDIS_STATUS oid_rt_pro_qry_pwrstate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_pwrstate_hdl(struct oid_par_priv* poid_par_priv);
+//oid_rtl_seg_87_11_F0
+NDIS_STATUS oid_rt_pro_h2c_set_rate_table_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_h2c_get_rate_table_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//oid_rtl_seg_87_12_00
+NDIS_STATUS oid_rt_pro_encryption_ctrl_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_add_sta_info_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_dele_sta_info_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_query_dr_variable_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_rx_packet_type_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_rw_efuse_pgpkt_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv);
+
+NDIS_STATUS oid_rt_set_bandwidth_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_crystal_cap_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_rx_packet_type_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_efuse_max_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_tx_agc_offset_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_set_pkt_test_mode_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_get_thermal_meter_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_set_power_down_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_get_power_mode_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_trigger_gpio_hdl(struct oid_par_priv *poid_par_priv);
+
+#ifdef _RTW_MP_IOCTL_C_
+
+const struct oid_obj_priv oid_rtl_seg_81_80_00[] =
+{
+	{1, &oid_null_function},			//0x00	OID_RT_PRO_RESET_DUT
+	{1, &oid_rt_pro_set_data_rate_hdl},		//0x01
+	{1, &oid_rt_pro_start_test_hdl},		//0x02
+	{1, &oid_rt_pro_stop_test_hdl},			//0x03
+	{1, &oid_null_function},			//0x04	OID_RT_PRO_SET_PREAMBLE
+	{1, &oid_null_function},			//0x05	OID_RT_PRO_SET_SCRAMBLER
+	{1, &oid_null_function},			//0x06	OID_RT_PRO_SET_FILTER_BB
+	{1, &oid_null_function},			//0x07	OID_RT_PRO_SET_MANUAL_DIVERSITY_BB
+	{1, &oid_rt_pro_set_channel_direct_call_hdl},	//0x08
+	{1, &oid_null_function},			//0x09	OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL
+	{1, &oid_null_function},			//0x0A	OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL
+	{1, &oid_rt_pro_set_continuous_tx_hdl},		//0x0B	OID_RT_PRO_SET_TX_CONTINUOUS_DIRECT_CALL
+	{1, &oid_rt_pro_set_single_carrier_tx_hdl},	//0x0C	OID_RT_PRO_SET_SINGLE_CARRIER_TX_CONTINUOUS
+	{1, &oid_null_function},			//0x0D	OID_RT_PRO_SET_TX_ANTENNA_BB
+	{1, &oid_rt_pro_set_antenna_bb_hdl},		//0x0E
+	{1, &oid_null_function},			//0x0F	OID_RT_PRO_SET_CR_SCRAMBLER
+	{1, &oid_null_function},			//0x10	OID_RT_PRO_SET_CR_NEW_FILTER
+	{1, &oid_rt_pro_set_tx_power_control_hdl},	//0x11	OID_RT_PRO_SET_TX_POWER_CONTROL
+	{1, &oid_null_function},			//0x12	OID_RT_PRO_SET_CR_TX_CONFIG
+	{1, &oid_null_function},			//0x13	OID_RT_PRO_GET_TX_POWER_CONTROL
+	{1, &oid_null_function},			//0x14	OID_RT_PRO_GET_CR_SIGNAL_QUALITY
+	{1, &oid_null_function},			//0x15	OID_RT_PRO_SET_CR_SETPOINT
+	{1, &oid_null_function},			//0x16	OID_RT_PRO_SET_INTEGRATOR
+	{1, &oid_null_function},			//0x17	OID_RT_PRO_SET_SIGNAL_QUALITY
+	{1, &oid_null_function},			//0x18	OID_RT_PRO_GET_INTEGRATOR
+	{1, &oid_null_function},			//0x19	OID_RT_PRO_GET_SIGNAL_QUALITY
+	{1, &oid_null_function},			//0x1A	OID_RT_PRO_QUERY_EEPROM_TYPE
+	{1, &oid_null_function},			//0x1B	OID_RT_PRO_WRITE_MAC_ADDRESS
+	{1, &oid_null_function},			//0x1C	OID_RT_PRO_READ_MAC_ADDRESS
+	{1, &oid_null_function},			//0x1D	OID_RT_PRO_WRITE_CIS_DATA
+	{1, &oid_null_function},			//0x1E	OID_RT_PRO_READ_CIS_DATA
+	{1, &oid_null_function}				//0x1F	OID_RT_PRO_WRITE_POWER_CONTROL
+
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_80_20[] =
+{
+	{1, &oid_null_function},			//0x20	OID_RT_PRO_READ_POWER_CONTROL
+	{1, &oid_null_function},			//0x21	OID_RT_PRO_WRITE_EEPROM
+	{1, &oid_null_function},			//0x22	OID_RT_PRO_READ_EEPROM
+	{1, &oid_rt_pro_reset_tx_packet_sent_hdl},	//0x23
+	{1, &oid_rt_pro_query_tx_packet_sent_hdl},	//0x24
+	{1, &oid_rt_pro_reset_rx_packet_received_hdl},	//0x25
+	{1, &oid_rt_pro_query_rx_packet_received_hdl},	//0x26
+	{1, &oid_rt_pro_query_rx_packet_crc32_error_hdl},	//0x27
+	{1, &oid_null_function},			//0x28	OID_RT_PRO_QUERY_CURRENT_ADDRESS
+	{1, &oid_null_function},			//0x29	OID_RT_PRO_QUERY_PERMANENT_ADDRESS
+	{1, &oid_null_function},			//0x2A	OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS
+	{1, &oid_rt_pro_set_carrier_suppression_tx_hdl},//0x2B	OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX
+	{1, &oid_null_function},			//0x2C	OID_RT_PRO_RECEIVE_PACKET
+	{1, &oid_null_function},			//0x2D	OID_RT_PRO_WRITE_EEPROM_BYTE
+	{1, &oid_null_function},			//0x2E	OID_RT_PRO_READ_EEPROM_BYTE
+	{1, &oid_rt_pro_set_modulation_hdl}		//0x2F
+
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_80_40[] =
+{
+	{1, &oid_null_function},			//0x40
+	{1, &oid_null_function},			//0x41
+	{1, &oid_null_function},			//0x42
+	{1, &oid_rt_pro_set_single_tone_tx_hdl},	//0x43
+	{1, &oid_null_function},			//0x44
+	{1, &oid_null_function}				//0x45
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_80_80[] =
+{
+	{1, &oid_null_function},			//0x80	OID_RT_DRIVER_OPTION
+	{1, &oid_null_function},			//0x81	OID_RT_RF_OFF
+	{1, &oid_null_function}				//0x82	OID_RT_AUTH_STATUS
+
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_85[] =
+{
+	{1, &oid_rt_wireless_mode_hdl}			//0x00	OID_RT_WIRELESS_MODE
+};
+
+struct oid_obj_priv oid_rtl_seg_81_87[] =
+{
+	{1, &oid_null_function},			//0x80	OID_RT_PRO8187_WI_POLL
+	{1, &oid_rt_pro_write_bb_reg_hdl},		//0x81
+	{1, &oid_rt_pro_read_bb_reg_hdl},		//0x82
+	{1, &oid_rt_pro_write_rf_reg_hdl},		//0x82
+	{1, &oid_rt_pro_read_rf_reg_hdl}		//0x83
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_00[] =
+{
+	{1, &oid_rt_pro8711_join_bss_hdl},		//0x00  //S
+	{1, &oid_rt_pro_read_register_hdl},		//0x01
+	{1, &oid_rt_pro_write_register_hdl},		//0x02
+	{1, &oid_rt_pro_burst_read_register_hdl},	//0x03
+	{1, &oid_rt_pro_burst_write_register_hdl},	//0x04
+	{1, &oid_rt_pro_write_txcmd_hdl},		//0x05
+	{1, &oid_rt_pro_read16_eeprom_hdl},		//0x06
+	{1, &oid_rt_pro_write16_eeprom_hdl},		//0x07
+	{1, &oid_null_function},			//0x08	OID_RT_PRO_H2C_SET_COMMAND
+	{1, &oid_null_function},			//0x09	OID_RT_PRO_H2C_QUERY_RESULT
+	{1, &oid_rt_pro8711_wi_poll_hdl},		//0x0A
+	{1, &oid_rt_pro8711_pkt_loss_hdl},		//0x0B
+	{1, &oid_rt_rd_attrib_mem_hdl},			//0x0C
+	{1, &oid_rt_wr_attrib_mem_hdl},			//0x0D
+	{1, &oid_null_function},			//0x0E
+	{1, &oid_null_function},			//0x0F
+	{1, &oid_null_function},			//0x10	OID_RT_PRO_H2C_CMD_MODE
+	{1, &oid_null_function},			//0x11	OID_RT_PRO_H2C_CMD_RSP_MODE
+	{1, &oid_null_function},			//0X12	OID_RT_PRO_WAIT_C2H_EVENT
+	{1, &oid_null_function},			//0X13	OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST
+	{1, &oid_null_function},			//0X14	OID_RT_PRO_SCSI_ACCESS_TEST
+	{1, &oid_null_function},			//0X15	OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT
+	{1, &oid_null_function},			//0X16	OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN
+	{1, &oid_null_function},			//0X17	OID_RT_RRO_RX_PKT_VIA_IOCTRL
+	{1, &oid_null_function},			//0X18	OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL
+	{1, &oid_null_function},			//0X19	OID_RT_RPO_SET_PWRMGT_TEST
+	{1, &oid_null_function},			//0X1A
+	{1, &oid_null_function},			//0X1B	OID_RT_PRO_QRY_PWRMGT_TEST
+	{1, &oid_null_function},			//0X1C	OID_RT_RPO_ASYNC_RWIO_TEST
+	{1, &oid_null_function},			//0X1D	OID_RT_RPO_ASYNC_RWIO_POLL
+	{1, &oid_rt_pro_set_rf_intfs_hdl},		//0X1E
+	{1, &oid_rt_poll_rx_status_hdl}			//0X1F
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_20[] =
+{
+	{1, &oid_rt_pro_cfg_debug_message_hdl},		//0x20
+	{1, &oid_rt_pro_set_data_rate_ex_hdl},		//0x21
+	{1, &oid_rt_pro_set_basic_rate_hdl},		//0x22
+	{1, &oid_rt_pro_read_tssi_hdl},			//0x23
+	{1, &oid_rt_pro_set_power_tracking_hdl}		//0x24
+};
+
+
+struct oid_obj_priv oid_rtl_seg_87_11_50[] =
+{
+	{1, &oid_rt_pro_qry_pwrstate_hdl},		//0x50
+	{1, &oid_rt_pro_set_pwrstate_hdl}		//0x51
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_80[] =
+{
+	{1, &oid_null_function}				//0x80
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_B0[] =
+{
+	{1, &oid_null_function}				//0xB0
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_F0[] =
+{
+	{1, &oid_null_function},			//0xF0
+	{1, &oid_null_function},			//0xF1
+	{1, &oid_null_function},			//0xF2
+	{1, &oid_null_function},			//0xF3
+	{1, &oid_null_function},			//0xF4
+	{1, &oid_null_function},			//0xF5
+	{1, &oid_null_function},			//0xF6
+	{1, &oid_null_function},			//0xF7
+	{1, &oid_null_function},			//0xF8
+	{1, &oid_null_function},			//0xF9
+	{1, &oid_null_function},			//0xFA
+	{1, &oid_rt_pro_h2c_set_rate_table_hdl},	//0xFB
+	{1, &oid_rt_pro_h2c_get_rate_table_hdl},	//0xFC
+	{1, &oid_null_function},			//0xFD
+	{1, &oid_null_function},			//0xFE	OID_RT_PRO_H2C_C2H_LBK_TEST
+	{1, &oid_null_function}				//0xFF
+
+};
+
+struct oid_obj_priv oid_rtl_seg_87_12_00[]=
+{
+	{1, &oid_rt_pro_encryption_ctrl_hdl},		//0x00	Q&S
+	{1, &oid_rt_pro_add_sta_info_hdl},		//0x01	S
+	{1, &oid_rt_pro_dele_sta_info_hdl},		//0x02	S
+	{1, &oid_rt_pro_query_dr_variable_hdl},		//0x03	Q
+	{1, &oid_rt_pro_rx_packet_type_hdl},		//0x04	Q,S
+	{1, &oid_rt_pro_read_efuse_hdl},		//0x05	Q	OID_RT_PRO_READ_EFUSE
+	{1, &oid_rt_pro_write_efuse_hdl},		//0x06	S	OID_RT_PRO_WRITE_EFUSE
+	{1, &oid_rt_pro_rw_efuse_pgpkt_hdl},		//0x07	Q,S
+	{1, &oid_rt_get_efuse_current_size_hdl},	//0x08 	Q
+	{1, &oid_rt_set_bandwidth_hdl},			//0x09
+	{1, &oid_rt_set_crystal_cap_hdl},		//0x0a
+	{1, &oid_rt_set_rx_packet_type_hdl},		//0x0b	S
+	{1, &oid_rt_get_efuse_max_size_hdl},		//0x0c
+	{1, &oid_rt_pro_set_tx_agc_offset_hdl},		//0x0d
+	{1, &oid_rt_pro_set_pkt_test_mode_hdl},		//0x0e
+	{1, &oid_null_function},			//0x0f		OID_RT_PRO_FOR_EVM_TEST_SETTING
+	{1, &oid_rt_get_thermal_meter_hdl},		//0x10	Q	OID_RT_PRO_GET_THERMAL_METER
+	{1, &oid_rt_reset_phy_rx_packet_count_hdl},	//0x11	S	OID_RT_RESET_PHY_RX_PACKET_COUNT
+	{1, &oid_rt_get_phy_rx_packet_received_hdl},	//0x12	Q	OID_RT_GET_PHY_RX_PACKET_RECEIVED
+	{1, &oid_rt_get_phy_rx_packet_crc32_error_hdl},	//0x13	Q	OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR
+	{1, &oid_rt_set_power_down_hdl},		//0x14	Q	OID_RT_SET_POWER_DOWN
+	{1, &oid_rt_get_power_mode_hdl}			//0x15	Q	OID_RT_GET_POWER_MODE
+};
+
+#else /* _RTL871X_MP_IOCTL_C_ */
+
+extern struct oid_obj_priv oid_rtl_seg_81_80_00[32];
+extern struct oid_obj_priv oid_rtl_seg_81_80_20[16];
+extern struct oid_obj_priv oid_rtl_seg_81_80_40[6];
+extern struct oid_obj_priv oid_rtl_seg_81_80_80[3];
+
+extern struct oid_obj_priv oid_rtl_seg_81_85[1];
+extern struct oid_obj_priv oid_rtl_seg_81_87[5];
+
+extern struct oid_obj_priv oid_rtl_seg_87_11_00[32];
+extern struct oid_obj_priv oid_rtl_seg_87_11_20[5];
+extern struct oid_obj_priv oid_rtl_seg_87_11_50[2];
+extern struct oid_obj_priv oid_rtl_seg_87_11_80[1];
+extern struct oid_obj_priv oid_rtl_seg_87_11_B0[1];
+extern struct oid_obj_priv oid_rtl_seg_87_11_F0[16];
+
+extern struct oid_obj_priv oid_rtl_seg_87_12_00[32];
+
+#endif /* _RTL871X_MP_IOCTL_C_ */
+
+struct rwreg_param{
+	u32 offset;
+	u32 width;
+	u32 value;
+};
+
+struct bbreg_param{
+	u32 offset;
+	u32 phymask;
+	u32 value;
+};
+/*
+struct rfchannel_param{
+	u32 ch;
+	u32 modem;
+};
+*/
+struct txpower_param{
+	u32 pwr_index;
+};
+
+
+struct datarate_param{
+	u32 rate_index;
+};
+
+
+struct rfintfs_parm {
+	u32 rfintfs;
+};
+
+typedef struct _mp_xmit_parm_ {
+	u8 enable;
+	u32 count;
+	u16 length;
+	u8 payload_type;
+	u8 da[ETH_ALEN];
+}MP_XMIT_PARM, *PMP_XMIT_PARM;
+
+struct mp_xmit_packet {
+	u32 len;
+	u32 mem[MAX_MP_XMITBUF_SZ >> 2];
+};
+
+struct psmode_param {
+	u32 ps_mode;
+	u32 smart_ps;
+};
+
+//for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM
+struct eeprom_rw_param {
+	u32 offset;
+	u16 value;
+};
+
+struct mp_ioctl_handler {
+	u32 paramsize;
+	u32 (*handler)(struct oid_par_priv* poid_par_priv);
+	u32 oid;
+};
+
+struct mp_ioctl_param{
+	u32 subcode;
+	u32 len;
+	u8 data[0];
+};
+
+#define GEN_MP_IOCTL_SUBCODE(code) _MP_IOCTL_ ## code ## _CMD_
+
+enum RTL871X_MP_IOCTL_SUBCODE {
+	GEN_MP_IOCTL_SUBCODE(MP_START),			/*0*/
+	GEN_MP_IOCTL_SUBCODE(MP_STOP),
+	GEN_MP_IOCTL_SUBCODE(READ_REG),
+	GEN_MP_IOCTL_SUBCODE(WRITE_REG),
+	GEN_MP_IOCTL_SUBCODE(READ_BB_REG),
+	GEN_MP_IOCTL_SUBCODE(WRITE_BB_REG),		/*5*/
+	GEN_MP_IOCTL_SUBCODE(READ_RF_REG),
+	GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG),
+	GEN_MP_IOCTL_SUBCODE(SET_CHANNEL),
+	GEN_MP_IOCTL_SUBCODE(SET_TXPOWER),
+	GEN_MP_IOCTL_SUBCODE(SET_DATARATE),		/*10*/
+	GEN_MP_IOCTL_SUBCODE(SET_BANDWIDTH),
+	GEN_MP_IOCTL_SUBCODE(SET_ANTENNA),
+	GEN_MP_IOCTL_SUBCODE(CNTU_TX),
+	GEN_MP_IOCTL_SUBCODE(SC_TX),
+	GEN_MP_IOCTL_SUBCODE(CS_TX),			/*15*/
+	GEN_MP_IOCTL_SUBCODE(ST_TX),
+	GEN_MP_IOCTL_SUBCODE(IOCTL_XMIT_PACKET),
+	GEN_MP_IOCTL_SUBCODE(SET_RX_PKT_TYPE),
+	GEN_MP_IOCTL_SUBCODE(RESET_PHY_RX_PKT_CNT),
+	GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_RECV),	/*20*/
+	GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_ERROR),
+	GEN_MP_IOCTL_SUBCODE(READ16_EEPROM),
+	GEN_MP_IOCTL_SUBCODE(WRITE16_EEPROM),
+	GEN_MP_IOCTL_SUBCODE(EFUSE),
+	GEN_MP_IOCTL_SUBCODE(EFUSE_MAP),		/*25*/
+	GEN_MP_IOCTL_SUBCODE(GET_EFUSE_MAX_SIZE),
+	GEN_MP_IOCTL_SUBCODE(GET_EFUSE_CURRENT_SIZE),
+	GEN_MP_IOCTL_SUBCODE(GET_THERMAL_METER),
+	GEN_MP_IOCTL_SUBCODE(SET_PTM),
+	GEN_MP_IOCTL_SUBCODE(SET_POWER_DOWN),		/*30*/
+	GEN_MP_IOCTL_SUBCODE(TRIGGER_GPIO),
+	GEN_MP_IOCTL_SUBCODE(SET_DM_BT),		/*35*/
+	GEN_MP_IOCTL_SUBCODE(DEL_BA),			/*36*/
+	GEN_MP_IOCTL_SUBCODE(GET_WIFI_STATUS),	/*37*/	
+	MAX_MP_IOCTL_SUBCODE,
+};
+
+u32 mp_ioctl_xmit_packet_hdl(struct oid_par_priv* poid_par_priv);
+
+#ifdef _RTW_MP_IOCTL_C_
+
+#define GEN_MP_IOCTL_HANDLER(sz, hdl, oid) {sz, hdl, oid},
+
+#define EXT_MP_IOCTL_HANDLER(sz, subcode, oid) {sz, mp_ioctl_ ## subcode ## _hdl, oid},
+
+
+struct mp_ioctl_handler mp_ioctl_hdl[] = {
+
+/*0*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_start_test_hdl, OID_RT_PRO_START_TEST)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_stop_test_hdl, OID_RT_PRO_STOP_TEST)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rwreg_param), oid_rt_pro_read_register_hdl, OID_RT_PRO_READ_REGISTER)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rwreg_param), oid_rt_pro_write_register_hdl, OID_RT_PRO_WRITE_REGISTER)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct bb_reg_param), oid_rt_pro_read_bb_reg_hdl, OID_RT_PRO_READ_BB_REG)
+/*5*/	GEN_MP_IOCTL_HANDLER(sizeof(struct bb_reg_param), oid_rt_pro_write_bb_reg_hdl, OID_RT_PRO_WRITE_BB_REG)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rf_reg_param), oid_rt_pro_read_rf_reg_hdl, OID_RT_PRO_RF_READ_REGISTRY)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rf_reg_param), oid_rt_pro_write_rf_reg_hdl, OID_RT_PRO_RF_WRITE_REGISTRY)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_channel_direct_call_hdl, OID_RT_PRO_SET_CHANNEL_DIRECT_CALL)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct txpower_param), oid_rt_pro_set_tx_power_control_hdl, OID_RT_PRO_SET_TX_POWER_CONTROL)
+/*10*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_data_rate_hdl, OID_RT_PRO_SET_DATA_RATE)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_set_bandwidth_hdl, OID_RT_SET_BANDWIDTH)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_antenna_bb_hdl, OID_RT_PRO_SET_ANTENNA_BB)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_continuous_tx_hdl, OID_RT_PRO_SET_CONTINUOUS_TX)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_single_carrier_tx_hdl, OID_RT_PRO_SET_SINGLE_CARRIER_TX)
+/*15*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_carrier_suppression_tx_hdl, OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_single_tone_tx_hdl, OID_RT_PRO_SET_SINGLE_TONE_TX)
+
+	EXT_MP_IOCTL_HANDLER(0, xmit_packet, 0)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_set_rx_packet_type_hdl, OID_RT_SET_RX_PACKET_TYPE)
+	GEN_MP_IOCTL_HANDLER(0, oid_rt_reset_phy_rx_packet_count_hdl, OID_RT_RESET_PHY_RX_PACKET_COUNT)
+/*20*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_phy_rx_packet_received_hdl, OID_RT_GET_PHY_RX_PACKET_RECEIVED)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_phy_rx_packet_crc32_error_hdl, OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(struct eeprom_rw_param), NULL, 0)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct eeprom_rw_param), NULL, 0)
+	GEN_MP_IOCTL_HANDLER(sizeof(EFUSE_ACCESS_STRUCT), oid_rt_pro_efuse_hdl, OID_RT_PRO_EFUSE)
+/*25*/	GEN_MP_IOCTL_HANDLER(0, oid_rt_pro_efuse_map_hdl, OID_RT_PRO_EFUSE_MAP)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_efuse_max_size_hdl, OID_RT_GET_EFUSE_MAX_SIZE)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_efuse_current_size_hdl, OID_RT_GET_EFUSE_CURRENT_SIZE)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_thermal_meter_hdl, OID_RT_PRO_GET_THERMAL_METER)
+	GEN_MP_IOCTL_HANDLER(sizeof(u8), oid_rt_pro_set_power_tracking_hdl, OID_RT_PRO_SET_POWER_TRACKING)
+/*30*/	GEN_MP_IOCTL_HANDLER(sizeof(u8), oid_rt_set_power_down_hdl, OID_RT_SET_POWER_DOWN)
+/*31*/	GEN_MP_IOCTL_HANDLER(0, oid_rt_pro_trigger_gpio_hdl, 0)
+
+
+};
+
+#else /* _RTW_MP_IOCTL_C_ */
+
+extern struct mp_ioctl_handler mp_ioctl_hdl[];
+
+#endif /* _RTW_MP_IOCTL_C_ */
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h
new file mode 100755
index 0000000000000..0b47cb5c546f2
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h
@@ -0,0 +1,1097 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__RTW_MP_PHY_REGDEF_H_
+ *
+ *
+ * Note:	1. Define PMAC/BB register map
+ *			2. Define RF register map
+ *			3. PMAC/BB register bit mask.
+ *			4. RF reg bit mask.
+ *			5. Other BB/RF relative definition.
+ *			
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:	
+ *
+ * History:
+ *	Data			Who		Remark 
+ *	08/07/2007	MHC		1. Porting from 9x series PHYCFG.h.
+ *						2. Reorganize code architecture.
+ *	09/25/2008	MH		1. Add RL6052 register definition
+ * 
+ *****************************************************************************/
+#ifndef __RTW_MP_PHY_REGDEF_H_
+#define __RTW_MP_PHY_REGDEF_H_
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//============================================================
+//       8192S Regsiter offset definition
+//============================================================
+
+//
+// BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
+// 3. RF register 0x00-2E
+// 4. Bit Mask for BB/RF register
+// 5. Other defintion for BB/RF R/W
+//
+
+
+//
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 1. Page1(0x100)
+//
+#define		rPMAC_Reset					0x100
+#define		rPMAC_TxStart					0x104
+#define		rPMAC_TxLegacySIG				0x108
+#define		rPMAC_TxHTSIG1				0x10c
+#define		rPMAC_TxHTSIG2				0x110
+#define		rPMAC_PHYDebug				0x114
+#define		rPMAC_TxPacketNum				0x118
+#define		rPMAC_TxIdle					0x11c
+#define		rPMAC_TxMACHeader0			0x120
+#define		rPMAC_TxMACHeader1			0x124
+#define		rPMAC_TxMACHeader2			0x128
+#define		rPMAC_TxMACHeader3			0x12c
+#define		rPMAC_TxMACHeader4			0x130
+#define		rPMAC_TxMACHeader5			0x134
+#define		rPMAC_TxDataType				0x138
+#define		rPMAC_TxRandomSeed			0x13c
+#define		rPMAC_CCKPLCPPreamble			0x140
+#define		rPMAC_CCKPLCPHeader			0x144
+#define		rPMAC_CCKCRC16				0x148
+#define		rPMAC_OFDMRxCRC32OK			0x170
+#define		rPMAC_OFDMRxCRC32Er			0x174
+#define		rPMAC_OFDMRxParityEr			0x178
+#define		rPMAC_OFDMRxCRC8Er			0x17c
+#define		rPMAC_CCKCRxRC16Er			0x180
+#define		rPMAC_CCKCRxRC32Er			0x184
+#define		rPMAC_CCKCRxRC32OK			0x188
+#define		rPMAC_TxStatus					0x18c
+
+//
+// 2. Page2(0x200)
+//
+// The following two definition are only used for USB interface.
+//#define		RF_BB_CMD_ADDR				0x02c0	// RF/BB read/write command address.
+//#define		RF_BB_CMD_DATA				0x02c4	// RF/BB read/write command data.
+
+//
+// 3. Page8(0x800)
+//
+#define		rFPGA0_RFMOD				0x800	//RF mode & CCK TxSC // RF BW Setting??
+
+#define		rFPGA0_TxInfo				0x804	// Status report??
+#define		rFPGA0_PSDFunction			0x808
+
+#define		rFPGA0_TxGainStage			0x80c	// Set TX PWR init gain?
+
+#define		rFPGA0_RFTiming1			0x810	// Useless now
+#define		rFPGA0_RFTiming2			0x814
+//#define rFPGA0_XC_RFTiming        		0x818
+//#define rFPGA0_XD_RFTiming        		0x81c
+
+#define		rFPGA0_XA_HSSIParameter1		0x820	// RF 3 wire register
+#define		rFPGA0_XA_HSSIParameter2		0x824
+#define		rFPGA0_XB_HSSIParameter1		0x828
+#define		rFPGA0_XB_HSSIParameter2		0x82c
+#define		rFPGA0_XC_HSSIParameter1		0x830
+#define		rFPGA0_XC_HSSIParameter2		0x834
+#define		rFPGA0_XD_HSSIParameter1		0x838
+#define		rFPGA0_XD_HSSIParameter2		0x83c
+#define		rFPGA0_XA_LSSIParameter		0x840
+#define		rFPGA0_XB_LSSIParameter		0x844
+#define		rFPGA0_XC_LSSIParameter		0x848
+#define		rFPGA0_XD_LSSIParameter		0x84c
+
+#define		rFPGA0_RFWakeUpParameter		0x850	// Useless now
+#define		rFPGA0_RFSleepUpParameter		0x854
+
+#define		rFPGA0_XAB_SwitchControl		0x858	// RF Channel switch
+#define		rFPGA0_XCD_SwitchControl		0x85c
+
+#define		rFPGA0_XA_RFInterfaceOE		0x860	// RF Channel switch
+#define		rFPGA0_XB_RFInterfaceOE		0x864
+#define		rFPGA0_XC_RFInterfaceOE		0x868
+#define		rFPGA0_XD_RFInterfaceOE		0x86c
+
+#define		rFPGA0_XAB_RFInterfaceSW		0x870	// RF Interface Software Control
+#define		rFPGA0_XCD_RFInterfaceSW		0x874
+
+#define		rFPGA0_XAB_RFParameter		0x878	// RF Parameter
+#define		rFPGA0_XCD_RFParameter		0x87c
+
+#define		rFPGA0_AnalogParameter1		0x880	// Crystal cap setting RF-R/W protection for parameter4??
+#define		rFPGA0_AnalogParameter2		0x884
+#define		rFPGA0_AnalogParameter3		0x888	// Useless now
+#define		rFPGA0_AnalogParameter4		0x88c
+
+#define		rFPGA0_XA_LSSIReadBack		0x8a0	// Tranceiver LSSI Readback
+#define		rFPGA0_XB_LSSIReadBack		0x8a4
+#define		rFPGA0_XC_LSSIReadBack		0x8a8
+#define		rFPGA0_XD_LSSIReadBack		0x8ac
+
+#define		rFPGA0_PSDReport				0x8b4	// Useless now
+#define		rFPGA0_XAB_RFInterfaceRB		0x8e0	// Useless now // RF Interface Readback Value
+#define		rFPGA0_XCD_RFInterfaceRB		0x8e4	// Useless now
+
+//
+// 4. Page9(0x900)
+//
+#define		rFPGA1_RFMOD				0x900	//RF mode & OFDM TxSC // RF BW Setting??
+
+#define		rFPGA1_TxBlock				0x904	// Useless now
+#define		rFPGA1_DebugSelect			0x908	// Useless now
+#define		rFPGA1_TxInfo				0x90c	// Useless now // Status report??
+
+//
+// 5. PageA(0xA00)
+//
+// Set Control channel to upper or lower. These settings are required only for 40MHz
+#define		rCCK0_System				0xa00
+
+#define		rCCK0_AFESetting			0xa04	// Disable init gain now // Select RX path by RSSI
+#define		rCCK0_CCA					0xa08	// Disable init gain now // Init gain
+
+#define		rCCK0_RxAGC1				0xa0c 	//AGC default value, saturation level // Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. Not the same as 90 series
+#define		rCCK0_RxAGC2				0xa10 	//AGC & DAGC
+
+#define		rCCK0_RxHP					0xa14
+
+#define		rCCK0_DSPParameter1		0xa18	//Timing recovery & Channel estimation threshold
+#define		rCCK0_DSPParameter2		0xa1c	//SQ threshold
+
+#define		rCCK0_TxFilter1				0xa20
+#define		rCCK0_TxFilter2				0xa24
+#define		rCCK0_DebugPort			0xa28	//debug port and Tx filter3
+#define		rCCK0_FalseAlarmReport		0xa2c	//0xa2d	useless now 0xa30-a4f channel report
+#define		rCCK0_TRSSIReport         		0xa50
+#define		rCCK0_RxReport            		0xa54  //0xa57
+#define		rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define		rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//
+// 6. PageC(0xC00)
+//
+#define		rOFDM0_LSTF				0xc00
+
+#define		rOFDM0_TRxPathEnable		0xc04
+#define		rOFDM0_TRMuxPar			0xc08
+#define		rOFDM0_TRSWIsolation		0xc0c
+
+#define		rOFDM0_XARxAFE			0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define		rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define		rOFDM0_XBRxAFE            		0xc18
+#define		rOFDM0_XBRxIQImbalance    	0xc1c
+#define		rOFDM0_XCRxAFE            		0xc20
+#define		rOFDM0_XCRxIQImbalance    	0xc24
+#define		rOFDM0_XDRxAFE            		0xc28
+#define		rOFDM0_XDRxIQImbalance    	0xc2c
+
+#define		rOFDM0_RxDetector1			0xc30  //PD,BW & SBD	// DM tune init gain
+#define		rOFDM0_RxDetector2			0xc34  //SBD & Fame Sync. 
+#define		rOFDM0_RxDetector3			0xc38  //Frame Sync.
+#define		rOFDM0_RxDetector4			0xc3c  //PD, SBD, Frame Sync & Short-GI
+
+#define		rOFDM0_RxDSP				0xc40  //Rx Sync Path
+#define		rOFDM0_CFOandDAGC		0xc44  //CFO & DAGC
+#define		rOFDM0_CCADropThreshold	0xc48 //CCA Drop threshold
+#define		rOFDM0_ECCAThreshold		0xc4c // energy CCA
+
+#define		rOFDM0_XAAGCCore1			0xc50	// DIG  
+#define		rOFDM0_XAAGCCore2			0xc54
+#define		rOFDM0_XBAGCCore1			0xc58
+#define		rOFDM0_XBAGCCore2			0xc5c
+#define		rOFDM0_XCAGCCore1			0xc60
+#define		rOFDM0_XCAGCCore2			0xc64
+#define		rOFDM0_XDAGCCore1			0xc68
+#define		rOFDM0_XDAGCCore2			0xc6c
+
+#define		rOFDM0_AGCParameter1			0xc70
+#define		rOFDM0_AGCParameter2			0xc74
+#define		rOFDM0_AGCRSSITable			0xc78
+#define		rOFDM0_HTSTFAGC				0xc7c
+
+#define		rOFDM0_XATxIQImbalance		0xc80	// TX PWR TRACK and DIG
+#define		rOFDM0_XATxAFE				0xc84
+#define		rOFDM0_XBTxIQImbalance		0xc88
+#define		rOFDM0_XBTxAFE				0xc8c
+#define		rOFDM0_XCTxIQImbalance		0xc90
+#define		rOFDM0_XCTxAFE            			0xc94
+#define		rOFDM0_XDTxIQImbalance		0xc98
+#define		rOFDM0_XDTxAFE				0xc9c
+#define		rOFDM0_RxIQExtAnta			0xca0
+
+#define		rOFDM0_RxHPParameter			0xce0
+#define		rOFDM0_TxPseudoNoiseWgt		0xce4
+#define		rOFDM0_FrameSync				0xcf0
+#define		rOFDM0_DFSReport				0xcf4
+#define		rOFDM0_TxCoeff1				0xca4
+#define		rOFDM0_TxCoeff2				0xca8
+#define		rOFDM0_TxCoeff3				0xcac
+#define		rOFDM0_TxCoeff4				0xcb0
+#define		rOFDM0_TxCoeff5				0xcb4
+#define		rOFDM0_TxCoeff6				0xcb8
+
+
+//
+// 7. PageD(0xD00)
+//
+#define		rOFDM1_LSTF					0xd00
+#define		rOFDM1_TRxPathEnable			0xd04
+
+#define		rOFDM1_CFO						0xd08	// No setting now
+#define		rOFDM1_CSI1					0xd10
+#define		rOFDM1_SBD						0xd14
+#define		rOFDM1_CSI2					0xd18
+#define		rOFDM1_CFOTracking			0xd2c
+#define		rOFDM1_TRxMesaure1			0xd34
+#define		rOFDM1_IntfDet					0xd3c
+#define		rOFDM1_PseudoNoiseStateAB		0xd50
+#define		rOFDM1_PseudoNoiseStateCD		0xd54
+#define		rOFDM1_RxPseudoNoiseWgt		0xd58
+
+#define		rOFDM_PHYCounter1				0xda0  //cca, parity fail
+#define		rOFDM_PHYCounter2				0xda4  //rate illegal, crc8 fail
+#define		rOFDM_PHYCounter3				0xda8  //MCS not support
+
+#define		rOFDM_ShortCFOAB				0xdac	// No setting now
+#define		rOFDM_ShortCFOCD				0xdb0
+#define		rOFDM_LongCFOAB				0xdb4
+#define		rOFDM_LongCFOCD				0xdb8
+#define		rOFDM_TailCFOAB				0xdbc
+#define		rOFDM_TailCFOCD				0xdc0
+#define		rOFDM_PWMeasure1          		0xdc4
+#define		rOFDM_PWMeasure2          		0xdc8
+#define		rOFDM_BWReport				0xdcc
+#define		rOFDM_AGCReport				0xdd0
+#define		rOFDM_RxSNR					0xdd4
+#define		rOFDM_RxEVMCSI				0xdd8
+#define		rOFDM_SIGReport				0xddc
+
+
+//
+// 8. PageE(0xE00)
+//
+#define		rTxAGC_Rate18_06				0xe00
+#define		rTxAGC_Rate54_24				0xe04
+#define		rTxAGC_CCK_Mcs32				0xe08
+#define		rTxAGC_Mcs03_Mcs00			0xe10
+#define		rTxAGC_Mcs07_Mcs04			0xe14
+#define		rTxAGC_Mcs11_Mcs08			0xe18
+#define		rTxAGC_Mcs15_Mcs12			0xe1c
+
+// Analog- control in RX_WAIT_CCA : REG: EE0 [Analog- Power & Control Register]
+#define 		rRx_Wait_CCCA					0xe70
+#define		rAnapar_Ctrl_BB					0xee0
+
+//
+// 7. RF Register 0x00-0x2E (RF 8256)
+//    RF-0222D 0x00-3F
+//
+//Zebra1
+#define RTL92SE_FPGA_VERIFY 0
+#define		rZebra1_HSSIEnable				0x0	// Useless now
+#define		rZebra1_TRxEnable1				0x1
+#define		rZebra1_TRxEnable2				0x2
+#define		rZebra1_AGC					0x4
+#define		rZebra1_ChargePump			0x5
+//#if (RTL92SE_FPGA_VERIFY == 1)
+#define		rZebra1_Channel				0x7	// RF channel switch
+//#else
+
+//#endif
+#define		rZebra1_TxGain					0x8	// Useless now
+#define		rZebra1_TxLPF					0x9
+#define		rZebra1_RxLPF					0xb
+#define		rZebra1_RxHPFCorner			0xc
+
+//Zebra4
+#define		rGlobalCtrl						0	// Useless now
+#define		rRTL8256_TxLPF					19
+#define		rRTL8256_RxLPF					11
+
+//RTL8258
+#define		rRTL8258_TxLPF					0x11	// Useless now
+#define		rRTL8258_RxLPF					0x13
+#define		rRTL8258_RSSILPF				0xa
+
+//
+// RL6052 Register definition
+//
+#define		RF_AC						0x00	// 
+
+#define		RF_IQADJ_G1				0x01	// 
+#define		RF_IQADJ_G2				0x02	// 
+#define		RF_POW_TRSW				0x05	// 
+
+#define		RF_GAIN_RX					0x06	// 
+#define		RF_GAIN_TX					0x07	// 
+
+#define		RF_TXM_IDAC				0x08	// 
+#define		RF_BS_IQGEN				0x0F	// 
+
+#define		RF_MODE1					0x10	// 
+#define		RF_MODE2					0x11	// 
+
+#define		RF_RX_AGC_HP				0x12	// 
+#define		RF_TX_AGC					0x13	// 
+#define		RF_BIAS						0x14	// 
+#define		RF_IPA						0x15	// 
+#define		RF_POW_ABILITY			0x17	// 
+#define		RF_MODE_AG				0x18	// 
+#define		rRfChannel					0x18	// RF channel and BW switch
+#define		RF_CHNLBW					0x18	// RF channel and BW switch
+#define		RF_TOP						0x19	// 
+
+#define		RF_RX_G1					0x1A	// 
+#define		RF_RX_G2					0x1B	// 
+
+#define		RF_RX_BB2					0x1C	// 
+#define		RF_RX_BB1					0x1D	// 
+
+#define		RF_RCK1					0x1E	// 
+#define		RF_RCK2					0x1F	// 
+
+#define		RF_TX_G1					0x20	// 
+#define		RF_TX_G2					0x21	// 
+#define		RF_TX_G3					0x22	// 
+
+#define		RF_TX_BB1					0x23	// 
+
+#define		RF_T_METER					0x24	// 
+
+#define		RF_SYN_G1					0x25	// RF TX Power control
+#define		RF_SYN_G2					0x26	// RF TX Power control
+#define		RF_SYN_G3					0x27	// RF TX Power control
+#define		RF_SYN_G4					0x28	// RF TX Power control
+#define		RF_SYN_G5					0x29	// RF TX Power control
+#define		RF_SYN_G6					0x2A	// RF TX Power control
+#define		RF_SYN_G7					0x2B	// RF TX Power control
+#define		RF_SYN_G8					0x2C	// RF TX Power control
+
+#define		RF_RCK_OS					0x30	// RF TX PA control
+
+#define		RF_TXPA_G1					0x31	// RF TX PA control
+#define		RF_TXPA_G2					0x32	// RF TX PA control
+#define		RF_TXPA_G3					0x33	// RF TX PA control
+
+//
+//Bit Mask
+//
+// 1. Page1(0x100)
+#define		bBBResetB						0x100	// Useless now?
+#define		bGlobalResetB					0x200
+#define		bOFDMTxStart					0x4
+#define		bCCKTxStart						0x8
+#define		bCRC32Debug					0x100
+#define		bPMACLoopback					0x10
+#define		bTxLSIG							0xffffff
+#define		bOFDMTxRate					0xf
+#define		bOFDMTxReserved				0x10
+#define		bOFDMTxLength					0x1ffe0
+#define		bOFDMTxParity					0x20000
+#define		bTxHTSIG1						0xffffff
+#define		bTxHTMCSRate					0x7f
+#define		bTxHTBW						0x80
+#define		bTxHTLength					0xffff00
+#define		bTxHTSIG2						0xffffff
+#define		bTxHTSmoothing					0x1
+#define		bTxHTSounding					0x2
+#define		bTxHTReserved					0x4
+#define		bTxHTAggreation				0x8
+#define		bTxHTSTBC						0x30
+#define		bTxHTAdvanceCoding			0x40
+#define		bTxHTShortGI					0x80
+#define		bTxHTNumberHT_LTF			0x300
+#define		bTxHTCRC8						0x3fc00
+#define		bCounterReset					0x10000
+#define		bNumOfOFDMTx					0xffff
+#define		bNumOfCCKTx					0xffff0000
+#define		bTxIdleInterval					0xffff
+#define		bOFDMService					0xffff0000
+#define		bTxMACHeader					0xffffffff
+#define		bTxDataInit						0xff
+#define		bTxHTMode						0x100
+#define		bTxDataType					0x30000
+#define		bTxRandomSeed					0xffffffff
+#define		bCCKTxPreamble					0x1
+#define		bCCKTxSFD						0xffff0000
+#define		bCCKTxSIG						0xff
+#define		bCCKTxService					0xff00
+#define		bCCKLengthExt					0x8000
+#define		bCCKTxLength					0xffff0000
+#define		bCCKTxCRC16					0xffff
+#define		bCCKTxStatus					0x1
+#define		bOFDMTxStatus					0x2
+
+#define 		IS_BB_REG_OFFSET_92S(_Offset)		((_Offset >= 0x800) && (_Offset <= 0xfff))
+
+// 2. Page8(0x800)
+#define		bRFMOD							0x1	// Reg 0x800 rFPGA0_RFMOD
+#define		bJapanMode						0x2
+#define		bCCKTxSC						0x30
+#define		bCCKEn							0x1000000
+#define		bOFDMEn						0x2000000
+
+#define		bOFDMRxADCPhase           		0x10000	// Useless now
+#define		bOFDMTxDACPhase           		0x40000
+#define		bXATxAGC                  			0x3f
+
+#define		bXBTxAGC                  			0xf00	// Reg 80c rFPGA0_TxGainStage
+#define		bXCTxAGC                  			0xf000
+#define		bXDTxAGC                  			0xf0000
+       		
+#define		bPAStart                  			0xf0000000	// Useless now
+#define		bTRStart                  			0x00f00000
+#define		bRFStart                  			0x0000f000
+#define		bBBStart                  			0x000000f0
+#define		bBBCCKStart               		0x0000000f
+#define		bPAEnd                    			0xf          //Reg0x814
+#define		bTREnd                    			0x0f000000
+#define		bRFEnd                    			0x000f0000
+#define		bCCAMask                  			0x000000f0   //T2R
+#define		bR2RCCAMask               		0x00000f00
+#define		bHSSI_R2TDelay            		0xf8000000
+#define		bHSSI_T2RDelay            		0xf80000
+#define		bContTxHSSI               		0x400     //chane gain at continue Tx
+#define		bIGFromCCK                		0x200
+#define		bAGCAddress               		0x3f
+#define		bRxHPTx                   			0x7000
+#define		bRxHPT2R                  			0x38000
+#define		bRxHPCCKIni               		0xc0000
+#define		bAGCTxCode                		0xc00000
+#define		bAGCRxCode                		0x300000
+
+#define		b3WireDataLength          		0x800	// Reg 0x820~84f rFPGA0_XA_HSSIParameter1
+#define		b3WireAddressLength       		0x400
+
+#define		b3WireRFPowerDown         		0x1	// Useless now
+//#define bHWSISelect               		0x8
+#define		b5GPAPEPolarity           		0x40000000
+#define		b2GPAPEPolarity           		0x80000000
+#define		bRFSW_TxDefaultAnt        		0x3
+#define		bRFSW_TxOptionAnt         		0x30
+#define		bRFSW_RxDefaultAnt        		0x300
+#define		bRFSW_RxOptionAnt         		0x3000
+#define		bRFSI_3WireData           		0x1
+#define		bRFSI_3WireClock          		0x2
+#define		bRFSI_3WireLoad           		0x4
+#define		bRFSI_3WireRW             		0x8
+#define		bRFSI_3Wire               			0xf
+
+#define		bRFSI_RFENV               		0x10	// Reg 0x870 rFPGA0_XAB_RFInterfaceSW
+
+#define		bRFSI_TRSW                		0x20	// Useless now
+#define		bRFSI_TRSWB               		0x40
+#define		bRFSI_ANTSW               		0x100
+#define		bRFSI_ANTSWB              		0x200
+#define		bRFSI_PAPE                			0x400
+#define		bRFSI_PAPE5G              		0x800 
+#define		bBandSelect               			0x1
+#define		bHTSIG2_GI                			0x80
+#define		bHTSIG2_Smoothing         		0x01
+#define		bHTSIG2_Sounding          		0x02
+#define		bHTSIG2_Aggreaton         		0x08
+#define		bHTSIG2_STBC              		0x30
+#define		bHTSIG2_AdvCoding         		0x40
+#define		bHTSIG2_NumOfHTLTF        	0x300
+#define		bHTSIG2_CRC8              		0x3fc
+#define		bHTSIG1_MCS               		0x7f
+#define		bHTSIG1_BandWidth         		0x80
+#define		bHTSIG1_HTLength          		0xffff
+#define		bLSIG_Rate                			0xf
+#define		bLSIG_Reserved            		0x10
+#define		bLSIG_Length              		0x1fffe
+#define		bLSIG_Parity              			0x20
+#define		bCCKRxPhase               		0x4
+#if (RTL92SE_FPGA_VERIFY == 1)
+#define		bLSSIReadAddress          		0x3f000000   //LSSI "Read" Address	// Reg 0x824 rFPGA0_XA_HSSIParameter2
+#else
+#define		bLSSIReadAddress          		0x7f800000   // T65 RF
+#endif
+#define		bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+#if (RTL92SE_FPGA_VERIFY == 1)
+#define		bLSSIReadBackData         		0xfff		// Reg 0x8a0 rFPGA0_XA_LSSIReadBack
+#else
+#define		bLSSIReadBackData         		0xfffff		// T65 RF
+#endif
+#define		bLSSIReadOKFlag           		0x1000	// Useless now
+#define		bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz       		
+#define		bRegulator0Standby        		0x1
+#define		bRegulatorPLLStandby      		0x2
+#define		bRegulator1Standby        		0x4
+#define		bPLLPowerUp               		0x8
+#define		bDPLLPowerUp              		0x10
+#define		bDA10PowerUp              		0x20
+#define		bAD7PowerUp               		0x200
+#define		bDA6PowerUp               		0x2000
+#define		bXtalPowerUp              		0x4000
+#define		b40MDClkPowerUP           		0x8000
+#define		bDA6DebugMode             		0x20000
+#define		bDA6Swing                 			0x380000
+
+#define		bADClkPhase               		0x4000000	// Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ
+
+#define		b80MClkDelay              		0x18000000	// Useless
+#define		bAFEWatchDogEnable        		0x20000000
+
+#define		bXtalCap01                			0xc0000000	// Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap
+#define		bXtalCap23                			0x3
+#define		bXtalCap92x					0x0f000000
+#define 		bXtalCap                			0x0f000000
+
+#define		bIntDifClkEnable          		0x400	// Useless
+#define		bExtSigClkEnable         	 	0x800
+#define		bBandgapMbiasPowerUp      	0x10000
+#define		bAD11SHGain               		0xc0000
+#define		bAD11InputRange           		0x700000
+#define		bAD11OPCurrent            		0x3800000
+#define		bIPathLoopback            		0x4000000
+#define		bQPathLoopback            		0x8000000
+#define		bAFELoopback              		0x10000000
+#define		bDA10Swing                		0x7e0
+#define		bDA10Reverse              		0x800
+#define		bDAClkSource              		0x1000
+#define		bAD7InputRange            		0x6000
+#define		bAD7Gain                  			0x38000
+#define		bAD7OutputCMMode          		0x40000
+#define		bAD7InputCMMode           		0x380000
+#define		bAD7Current               			0xc00000
+#define		bRegulatorAdjust          		0x7000000
+#define		bAD11PowerUpAtTx          		0x1
+#define		bDA10PSAtTx               		0x10
+#define		bAD11PowerUpAtRx          		0x100
+#define		bDA10PSAtRx               		0x1000       		
+#define		bCCKRxAGCFormat           		0x200       		
+#define		bPSDFFTSamplepPoint       		0xc000
+#define		bPSDAverageNum            		0x3000
+#define		bIQPathControl            		0xc00
+#define		bPSDFreq                  			0x3ff
+#define		bPSDAntennaPath           		0x30
+#define		bPSDIQSwitch              		0x40
+#define		bPSDRxTrigger             		0x400000
+#define		bPSDTxTrigger             		0x80000000
+#define		bPSDSineToneScale        		0x7f000000
+#define		bPSDReport                			0xffff
+
+// 3. Page9(0x900)
+#define		bOFDMTxSC                 		0x30000000	// Useless
+#define		bCCKTxOn                  			0x1
+#define		bOFDMTxOn                 		0x2
+#define		bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define		bDebugItem                		0xff   //reset debug page and LWord
+#define		bAntL              	       		0x10
+#define		bAntNonHT           	      			0x100
+#define		bAntHT1               			0x1000
+#define		bAntHT2                   			0x10000
+#define		bAntHT1S1                 			0x100000
+#define		bAntNonHTS1               		0x1000000
+
+// 4. PageA(0xA00)
+#define		bCCKBBMode                		0x3	// Useless
+#define		bCCKTxPowerSaving         		0x80
+#define		bCCKRxPowerSaving         		0x40
+
+#define		bCCKSideBand              		0x10	// Reg 0xa00 rCCK0_System 20/40 switch
+
+#define		bCCKScramble              		0x8	// Useless
+#define		bCCKAntDiversity    		      	0x8000
+#define		bCCKCarrierRecovery   	    	0x4000
+#define		bCCKTxRate           		     	0x3000
+#define		bCCKDCCancel             	 	0x0800
+#define		bCCKISICancel             		0x0400
+#define		bCCKMatchFilter           		0x0200
+#define		bCCKEqualizer             		0x0100
+#define		bCCKPreambleDetect       	 	0x800000
+#define		bCCKFastFalseCCA          		0x400000
+#define		bCCKChEstStart            		0x300000
+#define		bCCKCCACount              		0x080000
+#define		bCCKcs_lim                			0x070000
+#define		bCCKBistMode              		0x80000000
+#define		bCCKCCAMask             	  	0x40000000
+#define		bCCKTxDACPhase         	   	0x4
+#define		bCCKRxADCPhase         	   	0x20000000   //r_rx_clk
+#define		bCCKr_cp_mode0         	   	0x0100
+#define		bCCKTxDCOffset           	 	0xf0
+#define		bCCKRxDCOffset           	 	0xf
+#define		bCCKCCAMode              	 	0xc000
+#define		bCCKFalseCS_lim           		0x3f00
+#define		bCCKCS_ratio              		0xc00000
+#define		bCCKCorgBit_sel           		0x300000
+#define		bCCKPD_lim                			0x0f0000
+#define		bCCKNewCCA                		0x80000000
+#define		bCCKRxHPofIG              		0x8000
+#define		bCCKRxIG                  			0x7f00
+#define		bCCKLNAPolarity           		0x800000
+#define		bCCKRx1stGain             		0x7f0000
+#define		bCCKRFExtend              		0x20000000 //CCK Rx Iinital gain polarity
+#define		bCCKRxAGCSatLevel        	 	0x1f000000
+#define		bCCKRxAGCSatCount       	  	0xe0
+#define		bCCKRxRFSettle            		0x1f       //AGCsamp_dly
+#define		bCCKFixedRxAGC           	 	0x8000
+//#define bCCKRxAGCFormat         	 	0x4000   //remove to HSSI register 0x824
+#define		bCCKAntennaPolarity      	 	0x2000
+#define		bCCKTxFilterType          		0x0c00
+#define		bCCKRxAGCReportType   	   	0x0300
+#define		bCCKRxDAGCEn              		0x80000000
+#define		bCCKRxDAGCPeriod        	  	0x20000000
+#define		bCCKRxDAGCSatLevel     	   	0x1f000000
+#define		bCCKTimingRecovery       	 	0x800000
+#define		bCCKTxC0                  			0x3f0000
+#define		bCCKTxC1                  			0x3f000000
+#define		bCCKTxC2                  			0x3f
+#define		bCCKTxC3                  			0x3f00
+#define		bCCKTxC4                  			0x3f0000
+#define		bCCKTxC5                  			0x3f000000
+#define		bCCKTxC6                  			0x3f
+#define		bCCKTxC7                  			0x3f00
+#define		bCCKDebugPort             		0xff0000
+#define		bCCKDACDebug              		0x0f000000
+#define		bCCKFalseAlarmEnable      		0x8000
+#define		bCCKFalseAlarmRead        		0x4000
+#define		bCCKTRSSI                 			0x7f
+#define		bCCKRxAGCReport           		0xfe
+#define		bCCKRxReport_AntSel       		0x80000000
+#define		bCCKRxReport_MFOff        		0x40000000
+#define		bCCKRxRxReport_SQLoss     	0x20000000
+#define		bCCKRxReport_Pktloss      		0x10000000
+#define		bCCKRxReport_Lockedbit    	0x08000000
+#define		bCCKRxReport_RateError    	0x04000000
+#define		bCCKRxReport_RxRate       		0x03000000
+#define		bCCKRxFACounterLower      	0xff
+#define		bCCKRxFACounterUpper      	0xff000000
+#define		bCCKRxHPAGCStart          		0xe000
+#define		bCCKRxHPAGCFinal          		0x1c00       		
+#define		bCCKRxFalseAlarmEnable    	0x8000
+#define		bCCKFACounterFreeze       		0x4000       		
+#define		bCCKTxPathSel             		0x10000000
+#define		bCCKDefaultRxPath         		0xc000000
+#define		bCCKOptionRxPath          		0x3000000
+
+// 5. PageC(0xC00)
+#define		bNumOfSTF                			0x3	// Useless
+#define		bShift_L                 			0xc0
+#define		bGI_TH                   			0xc
+#define		bRxPathA                 			0x1
+#define		bRxPathB                 			0x2
+#define		bRxPathC                 			0x4
+#define		bRxPathD                 			0x8
+#define		bTxPathA                 			0x1
+#define		bTxPathB                 			0x2
+#define		bTxPathC                 			0x4
+#define		bTxPathD                 			0x8
+#define		bTRSSIFreq               			0x200
+#define		bADCBackoff              			0x3000
+#define		bDFIRBackoff             			0xc000
+#define		bTRSSILatchPhase         		0x10000
+#define		bRxIDCOffset             			0xff
+#define		bRxQDCOffset             			0xff00
+#define		bRxDFIRMode              		0x1800000
+#define		bRxDCNFType              		0xe000000
+#define		bRXIQImb_A               			0x3ff
+#define		bRXIQImb_B               			0xfc00
+#define		bRXIQImb_C               			0x3f0000
+#define		bRXIQImb_D               			0xffc00000
+#define		bDC_dc_Notch             		0x60000
+#define		bRxNBINotch              			0x1f000000
+#define		bPD_TH                   			0xf
+#define		bPD_TH_Opt2              		0xc000
+#define		bPWED_TH                 			0x700
+#define		bIfMF_Win_L              			0x800
+#define		bPD_Option               			0x1000
+#define		bMF_Win_L                			0xe000
+#define		bBW_Search_L             		0x30000
+#define		bwin_enh_L               			0xc0000
+#define		bBW_TH                   			0x700000
+#define		bED_TH2                  			0x3800000
+#define		bBW_option               			0x4000000
+#define		bRatio_TH                			0x18000000
+#define		bWindow_L                			0xe0000000
+#define		bSBD_Option              			0x1
+#define		bFrame_TH                			0x1c
+#define		bFS_Option               			0x60
+#define		bDC_Slope_check          		0x80
+#define		bFGuard_Counter_DC_L     		0xe00
+#define		bFrame_Weight_Short      		0x7000
+#define		bSub_Tune                			0xe00000
+#define		bFrame_DC_Length         		0xe000000
+#define		bSBD_start_offset        		0x30000000
+#define		bFrame_TH_2              		0x7
+#define		bFrame_GI2_TH            		0x38
+#define		bGI2_Sync_en             		0x40
+#define		bSarch_Short_Early       		0x300
+#define		bSarch_Short_Late        		0xc00
+#define		bSarch_GI2_Late          		0x70000
+#define		bCFOAntSum               		0x1
+#define		bCFOAcc                  			0x2
+#define		bCFOStartOffset          		0xc
+#define		bCFOLookBack             		0x70
+#define		bCFOSumWeight            		0x80
+#define		bDAGCEnable              			0x10000
+#define		bTXIQImb_A               			0x3ff
+#define		bTXIQImb_B               			0xfc00
+#define		bTXIQImb_C               			0x3f0000
+#define		bTXIQImb_D               			0xffc00000
+#define		bTxIDCOffset             			0xff
+#define		bTxQDCOffset             			0xff00
+#define		bTxDFIRMode              		0x10000
+#define		bTxPesudoNoiseOn         		0x4000000
+#define		bTxPesudoNoise_A         		0xff
+#define		bTxPesudoNoise_B         		0xff00
+#define		bTxPesudoNoise_C         		0xff0000
+#define		bTxPesudoNoise_D         		0xff000000
+#define		bCCADropOption           		0x20000
+#define		bCCADropThres            		0xfff00000
+#define		bEDCCA_H                 			0xf
+#define		bEDCCA_L                 			0xf0
+#define		bLambda_ED               0x300
+#define		bRxInitialGain           0x7f
+#define		bRxAntDivEn              0x80
+#define		bRxAGCAddressForLNA      0x7f00
+#define		bRxHighPowerFlow         0x8000
+#define		bRxAGCFreezeThres        0xc0000
+#define		bRxFreezeStep_AGC1       0x300000
+#define		bRxFreezeStep_AGC2       0xc00000
+#define		bRxFreezeStep_AGC3       0x3000000
+#define		bRxFreezeStep_AGC0       0xc000000
+#define		bRxRssi_Cmp_En           0x10000000
+#define		bRxQuickAGCEn            0x20000000
+#define		bRxAGCFreezeThresMode    0x40000000
+#define		bRxOverFlowCheckType     0x80000000
+#define		bRxAGCShift              0x7f
+#define		bTRSW_Tri_Only           0x80
+#define		bPowerThres              0x300
+#define		bRxAGCEn                 0x1
+#define		bRxAGCTogetherEn         0x2
+#define		bRxAGCMin                0x4
+#define		bRxHP_Ini                0x7
+#define		bRxHP_TRLNA              0x70
+#define		bRxHP_RSSI               0x700
+#define		bRxHP_BBP1               0x7000
+#define		bRxHP_BBP2               0x70000
+#define		bRxHP_BBP3               0x700000
+#define		bRSSI_H                  0x7f0000     //the threshold for high power
+#define		bRSSI_Gen                0x7f000000   //the threshold for ant diversity
+#define		bRxSettle_TRSW           0x7
+#define		bRxSettle_LNA            0x38
+#define		bRxSettle_RSSI           0x1c0
+#define		bRxSettle_BBP            0xe00
+#define		bRxSettle_RxHP           0x7000
+#define		bRxSettle_AntSW_RSSI     0x38000
+#define		bRxSettle_AntSW          0xc0000
+#define		bRxProcessTime_DAGC      0x300000
+#define		bRxSettle_HSSI           0x400000
+#define		bRxProcessTime_BBPPW     0x800000
+#define		bRxAntennaPowerShift     0x3000000
+#define		bRSSITableSelect         0xc000000
+#define		bRxHP_Final              0x7000000
+#define		bRxHTSettle_BBP          0x7
+#define		bRxHTSettle_HSSI         0x8
+#define		bRxHTSettle_RxHP         0x70
+#define		bRxHTSettle_BBPPW        0x80
+#define		bRxHTSettle_Idle         0x300
+#define		bRxHTSettle_Reserved     0x1c00
+#define		bRxHTRxHPEn              0x8000
+#define		bRxHTAGCFreezeThres      0x30000
+#define		bRxHTAGCTogetherEn       0x40000
+#define		bRxHTAGCMin              0x80000
+#define		bRxHTAGCEn               0x100000
+#define		bRxHTDAGCEn              0x200000
+#define		bRxHTRxHP_BBP            0x1c00000
+#define		bRxHTRxHP_Final          0xe0000000
+#define		bRxPWRatioTH             0x3
+#define		bRxPWRatioEn             0x4
+#define		bRxMFHold                0x3800
+#define		bRxPD_Delay_TH1          0x38
+#define		bRxPD_Delay_TH2          0x1c0
+#define		bRxPD_DC_COUNT_MAX       0x600
+//#define bRxMF_Hold               0x3800
+#define		bRxPD_Delay_TH           0x8000
+#define		bRxProcess_Delay         0xf0000
+#define		bRxSearchrange_GI2_Early 0x700000
+#define		bRxFrame_Guard_Counter_L 0x3800000
+#define		bRxSGI_Guard_L           0xc000000
+#define		bRxSGI_Search_L          0x30000000
+#define		bRxSGI_TH                0xc0000000
+#define		bDFSCnt0                 0xff
+#define		bDFSCnt1                 0xff00
+#define		bDFSFlag                 0xf0000       		
+#define		bMFWeightSum             0x300000
+#define		bMinIdxTH                0x7f000000       		
+#define		bDAFormat                0x40000       		
+#define		bTxChEmuEnable           0x01000000       		
+#define		bTRSWIsolation_A         0x7f
+#define		bTRSWIsolation_B         0x7f00
+#define		bTRSWIsolation_C         0x7f0000
+#define		bTRSWIsolation_D         0x7f000000       		
+#define		bExtLNAGain              0x7c00          
+
+// 6. PageE(0xE00)
+#define		bSTBCEn                  0x4	// Useless
+#define		bAntennaMapping          0x10
+#define		bNss                     0x20
+#define		bCFOAntSumD              0x200
+#define		bPHYCounterReset         0x8000000
+#define		bCFOReportGet            0x4000000
+#define		bOFDMContinueTx          0x10000000
+#define		bOFDMSingleCarrier       0x20000000
+#define		bOFDMSingleTone          0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define		bHTDetect                0x100
+#define		bCFOEn                   0x10000
+#define		bCFOValue                0xfff00000
+#define		bSigTone_Re              0x3f
+#define		bSigTone_Im              0x7f00
+#define		bCounter_CCA             0xffff
+#define		bCounter_ParityFail      0xffff0000
+#define		bCounter_RateIllegal     0xffff
+#define		bCounter_CRC8Fail        0xffff0000
+#define		bCounter_MCSNoSupport    0xffff
+#define		bCounter_FastSync        0xffff
+#define		bShortCFO                0xfff
+#define		bShortCFOTLength         12   //total
+#define		bShortCFOFLength         11   //fraction
+#define		bLongCFO                 0x7ff
+#define		bLongCFOTLength          11
+#define		bLongCFOFLength          11
+#define		bTailCFO                 0x1fff
+#define		bTailCFOTLength          13
+#define		bTailCFOFLength          12       		
+#define		bmax_en_pwdB             0xffff
+#define		bCC_power_dB             0xffff0000
+#define		bnoise_pwdB              0xffff
+#define		bPowerMeasTLength        10
+#define		bPowerMeasFLength        3
+#define		bRx_HT_BW                0x1
+#define		bRxSC                    0x6
+#define		bRx_HT                   0x8       		
+#define		bNB_intf_det_on          0x1
+#define		bIntf_win_len_cfg        0x30
+#define		bNB_Intf_TH_cfg          0x1c0       		
+#define		bRFGain                  0x3f
+#define		bTableSel                0x40
+#define		bTRSW                    0x80       		
+#define		bRxSNR_A                 0xff
+#define		bRxSNR_B                 0xff00
+#define		bRxSNR_C                 0xff0000
+#define		bRxSNR_D                 0xff000000
+#define		bSNREVMTLength           8
+#define		bSNREVMFLength           1       		
+#define		bCSI1st                  0xff
+#define		bCSI2nd                  0xff00
+#define		bRxEVM1st                0xff0000
+#define		bRxEVM2nd                0xff000000       		
+#define		bSIGEVM                  0xff
+#define		bPWDB                    0xff00
+#define		bSGIEN                   0x10000
+       		
+#define		bSFactorQAM1             0xf	// Useless
+#define		bSFactorQAM2             0xf0
+#define		bSFactorQAM3             0xf00
+#define		bSFactorQAM4             0xf000
+#define		bSFactorQAM5             0xf0000
+#define		bSFactorQAM6             0xf0000
+#define		bSFactorQAM7             0xf00000
+#define		bSFactorQAM8             0xf000000
+#define		bSFactorQAM9             0xf0000000
+#define		bCSIScheme               0x100000
+       		
+#define		bNoiseLvlTopSet          0x3	// Useless
+#define		bChSmooth                0x4
+#define		bChSmoothCfg1            0x38
+#define		bChSmoothCfg2            0x1c0
+#define		bChSmoothCfg3            0xe00
+#define		bChSmoothCfg4            0x7000
+#define		bMRCMode                 0x800000
+#define		bTHEVMCfg                0x7000000
+       		
+#define		bLoopFitType             0x1	// Useless
+#define		bUpdCFO                  0x40
+#define		bUpdCFOOffData           0x80
+#define		bAdvUpdCFO               0x100
+#define		bAdvTimeCtrl             0x800
+#define		bUpdClko                 0x1000
+#define		bFC                      0x6000
+#define		bTrackingMode            0x8000
+#define		bPhCmpEnable             0x10000
+#define		bUpdClkoLTF              0x20000
+#define		bComChCFO                0x40000
+#define		bCSIEstiMode             0x80000
+#define		bAdvUpdEqz               0x100000
+#define		bUChCfg                  0x7000000
+#define		bUpdEqz                  0x8000000
+
+#define		bTxAGCRate18_06			0x7f7f7f7f	// Useless
+#define		bTxAGCRate54_24			0x7f7f7f7f
+#define		bTxAGCRateMCS32			0x7f
+#define		bTxAGCRateCCK			0x7f00
+#define		bTxAGCRateMCS3_MCS0		0x7f7f7f7f
+#define		bTxAGCRateMCS7_MCS4		0x7f7f7f7f
+#define		bTxAGCRateMCS11_MCS8	0x7f7f7f7f
+#define		bTxAGCRateMCS15_MCS12	0x7f7f7f7f
+
+//Rx Pseduo noise
+#define		bRxPesudoNoiseOn         0x20000000	// Useless
+#define		bRxPesudoNoise_A         0xff
+#define		bRxPesudoNoise_B         0xff00
+#define		bRxPesudoNoise_C         0xff0000
+#define		bRxPesudoNoise_D         0xff000000
+#define		bPesudoNoiseState_A      0xffff
+#define		bPesudoNoiseState_B      0xffff0000
+#define		bPesudoNoiseState_C      0xffff
+#define		bPesudoNoiseState_D      0xffff0000
+
+//7. RF Register
+//Zebra1
+#define		bZebra1_HSSIEnable        0x8		// Useless
+#define		bZebra1_TRxControl        0xc00
+#define		bZebra1_TRxGainSetting    0x07f
+#define		bZebra1_RxCorner          0xc00
+#define		bZebra1_TxChargePump      0x38
+#define		bZebra1_RxChargePump      0x7
+#define		bZebra1_ChannelNum        0xf80
+#define		bZebra1_TxLPFBW           0x400
+#define		bZebra1_RxLPFBW           0x600
+
+//Zebra4
+#define		bRTL8256RegModeCtrl1      0x100	// Useless
+#define		bRTL8256RegModeCtrl0      0x40
+#define		bRTL8256_TxLPFBW          0x18
+#define		bRTL8256_RxLPFBW          0x600
+
+//RTL8258
+#define		bRTL8258_TxLPFBW          0xc	// Useless
+#define		bRTL8258_RxLPFBW          0xc00
+#define		bRTL8258_RSSILPFBW        0xc0
+
+
+//
+// Other Definition
+//
+
+//byte endable for sb_write
+#define		bByte0                    0x1	// Useless
+#define		bByte1                    0x2
+#define		bByte2                    0x4
+#define		bByte3                    0x8
+#define		bWord0                    0x3
+#define		bWord1                    0xc
+#define		bDWord                    0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define		bMaskByte0		0xff	// Reg 0xc50 rOFDM0_XAAGCCore~0xC6f
+#define		bMaskByte1		0xff00
+#define		bMaskByte2		0xff0000
+#define		bMaskByte3		0xff000000
+#define		bMaskHWord		0xffff0000
+#define		bMaskLWord		0x0000ffff
+#define		bMaskDWord		0xffffffff
+#define		bMaskH4Bits		0xf0000000	
+#define 	bMaskOFDM_D		0xffc00000
+#define		bMaskCCK		0x3f3f3f3f
+#define		bMask12Bits		0xfff
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+#if (RTL92SE_FPGA_VERIFY == 1)
+//#define		bMask12Bits               0xfff	// RF Reg mask bits
+//#define		bMask20Bits               0xfff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask	0xfff		
+#else
+//#define		bMask12Bits               0xfffff	// RF Reg mask bits
+//#define		bMask20Bits               0xfffff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask	0xfffff		
+#endif       		
+#define		bEnable                   0x1	// Useless
+#define		bDisable                  0x0
+       		
+#define		LeftAntenna               0x0	// Useless
+#define		RightAntenna              0x1
+       		
+#define		tCheckTxStatus            500   //500ms // Useless
+#define		tUpdateRxCounter          100   //100ms
+       		
+#define		rateCCK     0	// Useless
+#define		rateOFDM    1
+#define		rateHT      2
+
+//define Register-End
+#define		bPMAC_End                 0x1ff	// Useless
+#define		bFPGAPHY0_End             0x8ff
+#define		bFPGAPHY1_End             0x9ff
+#define		bCCKPHY0_End              0xaff
+#define		bOFDMPHY0_End             0xcff
+#define		bOFDMPHY1_End             0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define		bPMACControl	0x0		// Useless
+#define		bWMACControl	0x1
+#define		bWNICControl	0x2
+
+#if 0
+#define		ANTENNA_A	0x1	// Useless
+#define		ANTENNA_B	0x2
+#define		ANTENNA_AB	0x3	// ANTENNA_A|ANTENNA_B
+
+#define		ANTENNA_C	0x4
+#define		ANTENNA_D	0x8
+#endif
+
+#define RCR_AAP			BIT(0)				// accept all physical address
+#define RCR_APM			BIT(1)				// accept physical match
+#define RCR_AM			BIT(2)				// accept multicast
+#define RCR_AB			BIT(3)				// accept broadcast
+#define RCR_ACRC32		BIT(5)				// accept error packet
+#define RCR_9356SEL		BIT(6)
+#define RCR_AICV		BIT(12)				// Accept ICV error packet
+#define RCR_RXFTH0		(BIT(13)|BIT(14)|BIT(15))	// Rx FIFO threshold
+#define RCR_ADF			BIT(18)				// Accept Data(frame type) frame
+#define RCR_ACF			BIT(19)				// Accept control frame
+#define RCR_AMF			BIT(20)				// Accept management frame
+#define RCR_ADD3		BIT(21)
+#define RCR_APWRMGT		BIT(22)				// Accept power management packet
+#define RCR_CBSSID		BIT(23)				// Accept BSSID match packet
+#define RCR_ENMARP		BIT(28)				// enable mac auto reset phy
+#define RCR_EnCS1		BIT(29)				// enable carrier sense method 1
+#define RCR_EnCS2		BIT(30)				// enable carrier sense method 2
+#define RCR_OnlyErlPkt		BIT(31)				// Rx Early mode is performed for packet size greater than 1536
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+#endif	//__INC_HAL8192SPHYREG_H
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h
new file mode 100755
index 0000000000000..4249bc96cda9e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h
@@ -0,0 +1,161 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_P2P_H_
+#define __RTW_P2P_H_
+
+#include <drv_types.h>
+
+u32 build_beacon_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_probe_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_prov_disc_request_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8* pssid, u8 ussidlen, u8* pdev_raddr );
+u32 build_assoc_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 status_code);
+u32 build_deauth_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+#ifdef CONFIG_WFD
+u32 build_probe_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_probe_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 tunneled);
+u32 build_beacon_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_nego_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_nego_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_nego_confirm_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_invitation_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_invitation_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_assoc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_assoc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_provdisc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_provdisc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+#endif //CONFIG_WFD
+
+u32 process_probe_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+u32 process_assoc_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len, struct sta_info *psta);
+u32 process_p2p_devdisc_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+u32 process_p2p_devdisc_resp(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+u8 process_p2p_provdisc_req(struct wifidirect_info *pwdinfo,  u8 *pframe, uint len);
+u8 process_p2p_provdisc_resp(struct wifidirect_info *pwdinfo,  u8 *pframe);
+u8 process_p2p_group_negotation_req( struct wifidirect_info *pwdinfo, u8 *pframe, uint len );
+u8 process_p2p_group_negotation_resp( struct wifidirect_info *pwdinfo, u8 *pframe, uint len );
+u8 process_p2p_group_negotation_confirm( struct wifidirect_info *pwdinfo, u8 *pframe, uint len );
+u8 process_p2p_presence_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+
+void p2p_protocol_wk_hdl(_adapter *padapter, int intCmdType);
+
+#ifdef CONFIG_P2P_PS
+void	process_p2p_ps_ie(PADAPTER padapter, u8 *IEs, u32 IELength);
+void	p2p_ps_wk_hdl(_adapter *padapter, u8 p2p_ps_state);
+u8	p2p_ps_wk_cmd(_adapter*padapter, u8 p2p_ps_state, u8 enqueue);
+#endif // CONFIG_P2P_PS
+
+#ifdef CONFIG_IOCTL_CFG80211
+void rtw_init_cfg80211_wifidirect_info( _adapter*	padapter);
+int rtw_p2p_check_frames(_adapter *padapter, const u8 *buf, u32 len, u8 tx);
+void rtw_append_wfd_ie(_adapter *padapter, u8 *buf, u32 *len);
+#endif //CONFIG_IOCTL_CFG80211
+
+void reset_global_wifidirect_info( _adapter* padapter );
+int rtw_init_wifi_display_info(_adapter* padapter);
+void rtw_init_wifidirect_timers(_adapter* padapter);
+void rtw_init_wifidirect_addrs(_adapter* padapter, u8 *dev_addr, u8 *iface_addr);
+void init_wifidirect_info( _adapter* padapter, enum P2P_ROLE role);
+int rtw_p2p_enable(_adapter *padapter, enum P2P_ROLE role);
+
+static inline void _rtw_p2p_set_state(struct wifidirect_info *wdinfo, enum P2P_STATE state)
+{
+	if(wdinfo->p2p_state != state) {
+		//wdinfo->pre_p2p_state = wdinfo->p2p_state;
+		wdinfo->p2p_state = state;
+	}
+}
+static inline void _rtw_p2p_set_pre_state(struct wifidirect_info *wdinfo, enum P2P_STATE state)
+{
+	if(wdinfo->pre_p2p_state != state) {
+		wdinfo->pre_p2p_state = state;
+	}
+}
+#if 0
+static inline void _rtw_p2p_restore_state(struct wifidirect_info *wdinfo)
+{
+	if(wdinfo->pre_p2p_state != -1) {
+		wdinfo->p2p_state = wdinfo->pre_p2p_state;
+		wdinfo->pre_p2p_state = -1;
+	}
+}
+#endif
+static inline void _rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role)
+{
+	if(wdinfo->role != role) {
+		wdinfo->role = role;
+	}
+}
+static inline int _rtw_p2p_state(struct wifidirect_info *wdinfo)
+{
+	return wdinfo->p2p_state;
+}
+static inline int _rtw_p2p_pre_state(struct wifidirect_info *wdinfo)
+{
+	return wdinfo->pre_p2p_state;
+}
+static inline int _rtw_p2p_role(struct wifidirect_info *wdinfo)
+{
+	return wdinfo->role;
+}
+static inline bool _rtw_p2p_chk_state(struct wifidirect_info *wdinfo, enum P2P_STATE state)
+{
+	return wdinfo->p2p_state == state;
+}
+static inline bool _rtw_p2p_chk_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role)
+{
+	return wdinfo->role == role;
+}
+
+#ifdef CONFIG_DBG_P2P
+void dbg_rtw_p2p_set_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line);
+void dbg_rtw_p2p_set_pre_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line);
+//void dbg_rtw_p2p_restore_state(struct wifidirect_info *wdinfo, const char *caller, int line);
+void dbg_rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role, const char *caller, int line);
+#define rtw_p2p_set_state(wdinfo, state) dbg_rtw_p2p_set_state(wdinfo, state, __FUNCTION__, __LINE__)
+#define rtw_p2p_set_pre_state(wdinfo, state) dbg_rtw_p2p_set_pre_state(wdinfo, state, __FUNCTION__, __LINE__)
+#define rtw_p2p_set_role(wdinfo, role) dbg_rtw_p2p_set_role(wdinfo, role, __FUNCTION__, __LINE__)
+//#define rtw_p2p_restore_state(wdinfo) dbg_rtw_p2p_restore_state(wdinfo, __FUNCTION__, __LINE__)
+#else //CONFIG_DBG_P2P
+#define rtw_p2p_set_state(wdinfo, state) _rtw_p2p_set_state(wdinfo, state)
+#define rtw_p2p_set_pre_state(wdinfo, state) _rtw_p2p_set_pre_state(wdinfo, state)
+#define rtw_p2p_set_role(wdinfo, role) _rtw_p2p_set_role(wdinfo, role)
+//#define rtw_p2p_restore_state(wdinfo) _rtw_p2p_restore_state(wdinfo)
+#endif //CONFIG_DBG_P2P
+
+#define rtw_p2p_state(wdinfo) _rtw_p2p_state(wdinfo)
+#define rtw_p2p_pre_state(wdinfo) _rtw_p2p_pre_state(wdinfo)
+#define rtw_p2p_role(wdinfo) _rtw_p2p_role(wdinfo)
+#define rtw_p2p_chk_state(wdinfo, state) _rtw_p2p_chk_state(wdinfo, state)
+#define rtw_p2p_chk_role(wdinfo, role) _rtw_p2p_chk_role(wdinfo, role)
+
+#define rtw_p2p_findphase_ex_set(wdinfo, value) \
+	(wdinfo)->find_phase_state_exchange_cnt = (value)
+
+//is this find phase exchange for social channel scan?
+#define rtw_p2p_findphase_ex_is_social(wdinfo)   \
+	(wdinfo)->find_phase_state_exchange_cnt >= P2P_FINDPHASE_EX_SOCIAL_FIRST
+
+//should we need find phase exchange anymore?
+#define rtw_p2p_findphase_ex_is_needed(wdinfo) \
+	((wdinfo)->find_phase_state_exchange_cnt < P2P_FINDPHASE_EX_MAX && \
+	(wdinfo)->find_phase_state_exchange_cnt != P2P_FINDPHASE_EX_NONE)
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h
new file mode 100755
index 0000000000000..a4cb292e1aeaf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h
@@ -0,0 +1,362 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_PWRCTRL_H_
+#define __RTW_PWRCTRL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>		
+#include <drv_types.h>
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+#include <linux/earlysuspend.h>
+#endif //CONFIG_HAS_EARLYSUSPEND
+
+
+#define FW_PWR0	0	
+#define FW_PWR1 	1
+#define FW_PWR2 	2
+#define FW_PWR3 	3
+
+
+#define HW_PWR0	7	
+#define HW_PWR1 	6
+#define HW_PWR2 	2
+#define HW_PWR3	0
+#define HW_PWR4	8
+
+#define FW_PWRMSK	0x7
+
+
+#define XMIT_ALIVE	BIT(0)
+#define RECV_ALIVE	BIT(1)
+#define CMD_ALIVE	BIT(2)
+#define EVT_ALIVE	BIT(3)
+
+
+enum Power_Mgnt
+{
+	PS_MODE_ACTIVE	= 0	,
+	PS_MODE_MIN			,
+	PS_MODE_MAX			,
+	PS_MODE_DTIM			,
+	PS_MODE_VOIP			,
+	PS_MODE_UAPSD_WMM	,
+	PS_MODE_UAPSD			,
+	PS_MODE_IBSS			,
+	PS_MODE_WWLAN		,
+	PM_Radio_Off			,
+	PM_Card_Disable		,
+	PS_MODE_NUM
+};
+
+
+/*
+	BIT[2:0] = HW state
+	BIT[3] = Protocol PS state,   0: register active state , 1: register sleep state
+	BIT[4] = sub-state
+*/
+
+#define PS_DPS				BIT(0)
+#define PS_LCLK				(PS_DPS)
+#define PS_RF_OFF			BIT(1)
+#define PS_ALL_ON			BIT(2)
+#define PS_ST_ACTIVE		BIT(3)
+
+#define PS_ISR_ENABLE		BIT(4)
+#define PS_IMR_ENABLE		BIT(5)
+#define PS_ACK				BIT(6)
+#define PS_TOGGLE			BIT(7)
+
+#define PS_STATE_MASK		(0x0F)
+#define PS_STATE_HW_MASK	(0x07)
+#define PS_SEQ_MASK			(0xc0)
+
+#define PS_STATE(x)		(PS_STATE_MASK & (x))
+#define PS_STATE_HW(x)	(PS_STATE_HW_MASK & (x))
+#define PS_SEQ(x)		(PS_SEQ_MASK & (x))
+
+#define PS_STATE_S0		(PS_DPS)
+#define PS_STATE_S1		(PS_LCLK)
+#define PS_STATE_S2		(PS_RF_OFF)
+#define PS_STATE_S3		(PS_ALL_ON)
+#define PS_STATE_S4		((PS_ST_ACTIVE) | (PS_ALL_ON))
+
+
+#define PS_IS_RF_ON(x)	((x) & (PS_ALL_ON))
+#define PS_IS_ACTIVE(x)	((x) & (PS_ST_ACTIVE))
+#define CLR_PS_STATE(x)	((x) = ((x) & (0xF0)))
+
+
+struct reportpwrstate_parm {
+	unsigned char mode;
+	unsigned char state; //the CPWM value
+	unsigned short rsvd;
+}; 
+
+
+typedef _sema _pwrlock;
+
+
+__inline static void _init_pwrlock(_pwrlock *plock)
+{
+	_rtw_init_sema(plock, 1);
+}
+
+__inline static void _free_pwrlock(_pwrlock *plock)
+{
+	_rtw_free_sema(plock);
+}
+
+
+__inline static void _enter_pwrlock(_pwrlock *plock)
+{
+	_rtw_down_sema(plock);
+}
+
+
+__inline static void _exit_pwrlock(_pwrlock *plock)
+{
+	_rtw_up_sema(plock);
+}
+
+#define LPS_DELAY_TIME	1*HZ // 1 sec
+
+#define EXE_PWR_NONE	0x01
+#define EXE_PWR_IPS		0x02
+#define EXE_PWR_LPS		0x04
+
+// RF state.
+typedef enum _rt_rf_power_state
+{
+	rf_on,		// RF is on after RFSleep or RFOff
+	rf_sleep,	// 802.11 Power Save mode
+	rf_off,		// HW/SW Radio OFF or Inactive Power Save
+	//=====Add the new RF state above this line=====//
+	rf_max
+}rt_rf_power_state;
+
+// RF Off Level for IPS or HW/SW radio off
+#define	RT_RF_OFF_LEVL_ASPM			BIT(0)	// PCI ASPM
+#define	RT_RF_OFF_LEVL_CLK_REQ		BIT(1)	// PCI clock request
+#define	RT_RF_OFF_LEVL_PCI_D3			BIT(2)	// PCI D3 mode
+#define	RT_RF_OFF_LEVL_HALT_NIC		BIT(3)	// NIC halt, re-initialize hw parameters
+#define	RT_RF_OFF_LEVL_FREE_FW		BIT(4)	// FW free, re-download the FW
+#define	RT_RF_OFF_LEVL_FW_32K		BIT(5)	// FW in 32k
+#define	RT_RF_PS_LEVEL_ALWAYS_ASPM	BIT(6)	// Always enable ASPM and Clock Req in initialization.
+#define	RT_RF_LPS_DISALBE_2R			BIT(30)	// When LPS is on, disable 2R if no packet is received or transmittd.
+#define	RT_RF_LPS_LEVEL_ASPM			BIT(31)	// LPS with ASPM
+
+#define	RT_IN_PS_LEVEL(ppsc, _PS_FLAG)		((ppsc->cur_ps_level & _PS_FLAG) ? _TRUE : _FALSE)
+#define	RT_CLEAR_PS_LEVEL(ppsc, _PS_FLAG)	(ppsc->cur_ps_level &= (~(_PS_FLAG)))
+#define	RT_SET_PS_LEVEL(ppsc, _PS_FLAG)		(ppsc->cur_ps_level |= _PS_FLAG)
+
+
+enum _PS_BBRegBackup_ {
+	PSBBREG_RF0 = 0,
+	PSBBREG_RF1,
+	PSBBREG_RF2,
+	PSBBREG_AFE0,
+	PSBBREG_TOTALCNT
+};
+
+enum { // for ips_mode
+	IPS_NONE=0,
+	IPS_NORMAL,
+	IPS_LEVEL_2,	
+};
+
+struct pwrctrl_priv
+{
+	_pwrlock	lock;
+	volatile u8 rpwm; // requested power state for fw
+	volatile u8 cpwm; // fw current power state. updated when 1. read from HCPWM 2. driver lowers power level
+	volatile u8 tog; // toggling
+	volatile u8 cpwm_tog; // toggling
+	u8	pwr_mode;
+	u8	smart_ps;
+	u32 alives;
+
+	u8	b_hw_radio_off;
+	u8	reg_rfoff;
+	u8	reg_pdnmode; //powerdown mode
+	u32	rfoff_reason;
+
+	//RF OFF Level
+	u32	cur_ps_level;
+	u32	reg_rfps_level;
+
+
+
+#ifdef CONFIG_PCI_HCI
+	//just for PCIE ASPM
+	u8	b_support_aspm; // If it supports ASPM, Offset[560h] = 0x40, otherwise Offset[560h] = 0x00. 
+	u8	b_support_backdoor;
+
+	//just for PCIE ASPM
+	u8	const_amdpci_aspm;
+#endif
+
+	uint 	ips_enter_cnts;
+	uint 	ips_leave_cnts;
+
+	u8	ips_mode; 
+	u8	ips_mode_req; // used to accept the mode setting request, will update to ipsmode later
+	uint bips_processing;
+	u32 ips_deny_time; /* will deny IPS when system time is smaller than this */
+	u8 ps_processing; /* temporarily used to mark whether in rtw_ps_processor */
+
+	u8	bLeisurePs;
+	u8	LpsIdleCount;
+	u8	power_mgnt;
+	u8	bFwCurrentInPSMode;
+	u32	DelayLPSLastTimeStamp;
+
+	s32		pnp_current_pwr_state;
+	u8		pnp_bstop_trx;
+
+
+	u8		bInternalAutoSuspend;
+	u8		bInSuspend;
+	u8		bSupportRemoteWakeup;	
+#ifdef CONFIG_WOWLAN
+	u8		wowlan_mode;
+	u8		wowlan_pattern;
+	u8		wowlan_magic;
+	u8		wowlan_unicast;
+	u8		wowlan_pattern_idx;
+	u32		wowlan_pattern_context[8][5];
+#endif // CONFIG_WOWLAN
+	_timer 	pwr_state_check_timer;
+	int		pwr_state_check_interval;
+	u8		pwr_state_check_cnts;
+
+	int 		ps_flag;
+	
+	rt_rf_power_state	rf_pwrstate;//cur power state
+	//rt_rf_power_state 	current_rfpwrstate;
+	rt_rf_power_state	change_rfpwrstate;
+
+	u8		bHWPowerdown;//if support hw power down
+	u8		bHWPwrPindetect;
+	u8		bkeepfwalive;		
+	u8		brfoffbyhw;
+	unsigned long PS_BBRegBackup[PSBBREG_TOTALCNT];
+	
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	struct workqueue_struct *rtw_workqueue;
+	_workitem resume_work;
+	#endif
+
+	#ifdef CONFIG_HAS_EARLYSUSPEND
+	struct early_suspend early_suspend;
+	u8 do_late_resume;
+	#endif //CONFIG_HAS_EARLYSUSPEND
+	
+	#ifdef CONFIG_ANDROID_POWER
+	android_early_suspend_t early_suspend;
+	u8 do_late_resume;
+	#endif
+	
+};
+
+#define rtw_get_ips_mode_req(pwrctrlpriv) \
+	(pwrctrlpriv)->ips_mode_req
+
+#define rtw_ips_mode_req(pwrctrlpriv, ips_mode) \
+	(pwrctrlpriv)->ips_mode_req = (ips_mode)
+
+#define RTW_PWR_STATE_CHK_INTERVAL 2000
+
+#define _rtw_set_pwr_state_check_timer(pwrctrlpriv, ms) \
+	do { \
+		/*DBG_871X("%s _rtw_set_pwr_state_check_timer(%p, %d)\n", __FUNCTION__, (pwrctrlpriv), (ms));*/ \
+		_set_timer(&(pwrctrlpriv)->pwr_state_check_timer, (ms)); \
+	} while(0)
+	
+#define rtw_set_pwr_state_check_timer(pwrctrlpriv) \
+	_rtw_set_pwr_state_check_timer((pwrctrlpriv), (pwrctrlpriv)->pwr_state_check_interval)
+
+extern void rtw_init_pwrctrl_priv(_adapter *adapter);
+extern void rtw_free_pwrctrl_priv(_adapter * adapter);
+
+#ifdef CONFIG_LPS_LCLK
+extern s32 rtw_register_tx_alive(PADAPTER padapter);
+extern void rtw_unregister_tx_alive(PADAPTER padapter);
+extern s32 rtw_register_rx_alive(PADAPTER padapter);
+extern void rtw_unregister_rx_alive(PADAPTER padapter);
+extern s32 rtw_register_cmd_alive(PADAPTER padapter);
+extern void rtw_unregister_cmd_alive(PADAPTER padapter);
+extern s32 rtw_register_evt_alive(PADAPTER padapter);
+extern void rtw_unregister_evt_alive(PADAPTER padapter);
+extern void cpwm_int_hdl(PADAPTER padapter, struct reportpwrstate_parm *preportpwrstate);
+#endif
+
+extern void rtw_set_ps_mode(_adapter * padapter, u8 ps_mode, u8 smart_ps);
+extern void rtw_set_rpwm(_adapter * padapter, u8 val8);
+extern void LeaveAllPowerSaveMode(PADAPTER Adapter);
+#ifdef CONFIG_IPS
+void _ips_enter(_adapter * padapter);
+void ips_enter(_adapter * padapter);
+int _ips_leave(_adapter * padapter);
+int ips_leave(_adapter * padapter);
+#endif
+
+void rtw_ps_processor(_adapter*padapter);
+
+#ifdef CONFIG_AUTOSUSPEND
+int autoresume_enter(_adapter* padapter);
+#endif
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+rt_rf_power_state RfOnOffDetect(IN	PADAPTER pAdapter );
+#endif
+
+
+#ifdef CONFIG_LPS
+void LPS_Enter(PADAPTER padapter);
+void LPS_Leave(PADAPTER padapter);
+#endif
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+void rtw_resume_in_workqueue(struct pwrctrl_priv *pwrpriv);
+#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+#if defined(CONFIG_HAS_EARLYSUSPEND ) || defined(CONFIG_ANDROID_POWER)
+bool rtw_is_earlysuspend_registered(struct pwrctrl_priv *pwrpriv);
+bool rtw_is_do_late_resume(struct pwrctrl_priv *pwrpriv);
+void rtw_set_do_late_resume(struct pwrctrl_priv *pwrpriv, bool enable);
+void rtw_register_early_suspend(struct pwrctrl_priv *pwrpriv);
+void rtw_unregister_early_suspend(struct pwrctrl_priv *pwrpriv);
+#else
+#define rtw_is_earlysuspend_registered(pwrpriv) _FALSE
+#define rtw_is_do_late_resume(pwrpriv) _FALSE
+#define rtw_set_do_late_resume(pwrpriv, enable) do {} while (0)
+#define rtw_register_early_suspend(pwrpriv) do {} while (0)
+#define rtw_unregister_early_suspend(pwrpriv) do {} while (0)
+#endif /* CONFIG_HAS_EARLYSUSPEND || CONFIG_ANDROID_POWER */
+
+u8 rtw_interface_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id,u8* val);
+void rtw_set_ips_deny(_adapter *padapter, u32 ms);
+int _rtw_pwr_wakeup(_adapter *padapter, u32 ips_deffer_ms, const char *caller);
+#define rtw_pwr_wakeup(adapter) _rtw_pwr_wakeup(adapter, RTW_PWR_STATE_CHK_INTERVAL, __FUNCTION__)
+#define rtw_pwr_wakeup_ex(adapter, ips_deffer_ms) _rtw_pwr_wakeup(adapter, ips_deffer_ms, __FUNCTION__)
+int rtw_pm_set_ips(_adapter *padapter, u8 mode);
+int rtw_pm_set_lps(_adapter *padapter, u8 mode);
+
+#endif  //__RTL871X_PWRCTRL_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h
new file mode 100755
index 0000000000000..a359c5feb5742
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h
@@ -0,0 +1,40 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#ifndef _RTW_QOS_H_
+#define _RTW_QOS_H_
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+
+
+
+
+
+struct	qos_priv	{
+	
+	unsigned int	  qos_option;	//bit mask option: u-apsd, s-apsd, ts, block ack...		
+
+};
+
+
+#endif	//_RTL871X_QOS_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h
new file mode 100755
index 0000000000000..3a4b14bb91c4f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h
@@ -0,0 +1,731 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_RECV_H_
+#define _RTW_RECV_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#define NR_RECVFRAME 256
+
+#define RXFRAME_ALIGN	8
+#define RXFRAME_ALIGN_SZ	(1<<RXFRAME_ALIGN)
+
+#define MAX_RXFRAME_CNT	512
+#define MAX_RX_NUMBLKS		(32)
+#define RECVFRAME_HDR_ALIGN 128
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+static u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37};
+
+static u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3};
+static u8 SNAP_ETH_TYPE_APPLETALK_DDP[2] = {0x80, 0x9b};
+static u8 SNAP_ETH_TYPE_TDLS[2] = {0x89, 0x0d};
+static u8 SNAP_HDR_APPLETALK_DDP[3] = {0x08, 0x00, 0x07}; // Datagram Delivery Protocol
+
+static u8 oui_8021h[] = {0x00, 0x00, 0xf8};
+static u8 oui_rfc1042[]= {0x00,0x00,0x00};
+
+#define MAX_SUBFRAME_COUNT	64
+static u8 rtw_rfc1042_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
+static u8 rtw_bridge_tunnel_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+
+//for Rx reordering buffer control
+struct recv_reorder_ctrl
+{
+	_adapter	*padapter;
+	u8 enable;
+	u16 indicate_seq;//=wstart_b, init_value=0xffff
+	u16 wend_b;
+	u8 wsize_b;
+	_queue pending_recvframe_queue;
+	_timer reordering_ctrl_timer;
+};
+
+struct	stainfo_rxcache	{
+	u16 	tid_rxseq[16];
+/*
+	unsigned short 	tid0_rxseq;
+	unsigned short 	tid1_rxseq;
+	unsigned short 	tid2_rxseq;
+	unsigned short 	tid3_rxseq;
+	unsigned short 	tid4_rxseq;
+	unsigned short 	tid5_rxseq;
+	unsigned short 	tid6_rxseq;
+	unsigned short 	tid7_rxseq;
+	unsigned short 	tid8_rxseq;
+	unsigned short 	tid9_rxseq;
+	unsigned short 	tid10_rxseq;
+	unsigned short 	tid11_rxseq;
+	unsigned short 	tid12_rxseq;
+	unsigned short 	tid13_rxseq;
+	unsigned short 	tid14_rxseq;
+	unsigned short 	tid15_rxseq;
+*/
+};
+
+
+struct smooth_rssi_data {
+	u32	elements[100];	//array to store values
+	u32	index;			//index to current array to store
+	u32	total_num;		//num of valid elements
+	u32	total_val;		//sum of valid elements
+};
+
+struct signal_stat {
+	u8	update_req;		//used to indicate 
+	u8	avg_val;		//avg of valid elements
+	u32	total_num;		//num of valid elements
+	u32	total_val;		//sum of valid elements	
+};
+
+struct rx_pkt_attrib
+{
+	u16	pkt_len;
+	u8	physt;
+	u8	drvinfo_sz;
+	u8	shift_sz;
+	u8	hdrlen; //the WLAN Header Len
+	u8 	to_fr_ds;
+	u8 	amsdu;
+	u8	qos;
+	u8	priority;
+	u8	pw_save;
+	u8	mdata;
+	u16	seq_num;
+	u8	frag_num;
+	u8	mfrag;
+	u8	order;
+	u8	privacy; //in frame_ctrl field
+	u8	bdecrypted;
+	u8	encrypt; //when 0 indicate no encrypt. when non-zero, indicate the encrypt algorith
+	u8	iv_len;
+	u8	icv_len;
+	u8	crc_err;
+	u8	icv_err;
+
+	u16 eth_type;
+
+	u8 	dst[ETH_ALEN];
+	u8 	src[ETH_ALEN];
+	u8 	ta[ETH_ALEN];
+	u8 	ra[ETH_ALEN];
+	u8 	bssid[ETH_ALEN];
+	
+	u8 ack_policy;
+	
+//#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	u8	tcpchk_valid; // 0: invalid, 1: valid
+	u8	ip_chkrpt; //0: incorrect, 1: correct
+	u8	tcp_chkrpt; //0: incorrect, 1: correct
+//#endif
+	u8 	key_index;
+
+	u8	mcs_rate;
+	u8	rxht;
+	u8 	sgi;
+	u8	signal_qual;
+	s8	rx_mimo_signal_qual[2];
+	u8	signal_strength;
+	u8	rx_rssi[2];  //This value is percentage
+	u8	rx_snr[2];
+	u32	RxPWDBAll;
+	s32	RecvSignalPower;
+};
+
+
+//These definition is used for Rx packet reordering.
+#define SN_LESS(a, b)		(((a-b)&0x800)!=0)
+#define SN_EQUAL(a, b)	(a == b)
+//#define REORDER_WIN_SIZE	128
+//#define REORDER_ENTRY_NUM	128
+#define REORDER_WAIT_TIME	(50) // (ms)
+
+#define RECVBUFF_ALIGN_SZ 8
+
+#define RXDESC_SIZE	24
+#define RXDESC_OFFSET RXDESC_SIZE
+
+struct recv_stat
+{
+	unsigned int rxdw0;
+
+	unsigned int rxdw1;
+
+	unsigned int rxdw2;
+
+	unsigned int rxdw3;
+
+	unsigned int rxdw4;
+
+	unsigned int rxdw5;
+
+#ifdef CONFIG_PCI_HCI
+	unsigned int rxdw6;
+
+	unsigned int rxdw7;
+#endif
+};
+
+#define EOR BIT(30)
+
+#ifdef CONFIG_PCI_HCI
+#define PCI_MAX_RX_QUEUE		1// MSDU packet queue, Rx Command Queue
+#define PCI_MAX_RX_COUNT		128
+
+struct rtw_rx_ring {
+	struct recv_stat	*desc;
+	dma_addr_t		dma;
+	unsigned int		idx;
+	struct sk_buff	*rx_buf[PCI_MAX_RX_COUNT];
+};
+#endif
+
+/*
+accesser of recv_priv: rtw_recv_entry(dispatch / passive level); recv_thread(passive) ; returnpkt(dispatch)
+; halt(passive) ;
+
+using enter_critical section to protect
+*/
+struct recv_priv
+{
+  	  _lock	lock;
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	_sema	recv_sema;
+	_sema	terminate_recvthread_sema;
+#endif
+
+	//_queue	blk_strms[MAX_RX_NUMBLKS];    // keeping the block ack frame until return ack
+	_queue	free_recv_queue;
+	_queue	recv_pending_queue;
+	_queue	uc_swdec_pending_queue;
+
+
+	u8 *pallocated_frame_buf;
+	u8 *precv_frame_buf;
+
+	uint free_recvframe_cnt;
+
+	_adapter	*adapter;
+
+#ifdef PLATFORM_WINDOWS
+	_nic_hdl  RxPktPoolHdl;
+	_nic_hdl  RxBufPoolHdl;
+
+#ifdef PLATFORM_OS_XP
+	PMDL	pbytecnt_mdl;
+#endif
+	uint	counter; //record the number that up-layer will return to drv; only when counter==0 can we  release recv_priv
+	NDIS_EVENT 	recv_resource_evt ;
+#endif
+
+	u32	bIsAnyNonBEPkts;
+	u64	rx_bytes;
+	u64	rx_pkts;
+	u64	rx_drop;
+	u64	last_rx_bytes;
+
+	uint  rx_icv_err;
+	uint  rx_largepacket_crcerr;
+	uint  rx_smallpacket_crcerr;
+	uint  rx_middlepacket_crcerr;
+
+#ifdef CONFIG_USB_HCI
+	//u8 *pallocated_urb_buf;
+	_sema allrxreturnevt;
+	uint	ff_hwaddr;
+	u8	rx_pending_cnt;
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+#ifdef PLATFORM_LINUX
+	PURB	int_in_urb;
+#endif
+
+	u8	*int_in_buf;
+#endif
+
+#endif
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+#ifdef PLATFORM_FREEBSD
+	struct task irq_prepare_beacon_tasklet;
+	struct task recv_tasklet;
+#else //PLATFORM_FREEBSD
+	struct tasklet_struct irq_prepare_beacon_tasklet;
+	struct tasklet_struct recv_tasklet;
+#endif //PLATFORM_FREEBSD
+	struct sk_buff_head free_recv_skb_queue;
+	struct sk_buff_head rx_skb_queue;
+#ifdef CONFIG_RX_INDICATE_QUEUE
+	struct task rx_indicate_tasklet;
+	struct ifqueue rx_indicate_queue;
+#endif	// CONFIG_RX_INDICATE_QUEUE
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	_queue	recv_buf_pending_queue;
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+#endif //defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+
+	u8 *pallocated_recv_buf;
+	u8 *precv_buf;    // 4 alignment
+	_queue	free_recv_buf_queue;
+	u32	free_recv_buf_queue_cnt;
+
+#ifdef CONFIG_SDIO_HCI
+	_queue	recv_buf_pending_queue;
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	// Rx
+	struct rtw_rx_ring	rx_ring[PCI_MAX_RX_QUEUE];
+	int 	rxringcount;
+	u16	rxbuffersize;
+#endif
+
+	//For display the phy informatiom
+	u8 is_signal_dbg;	// for debug
+	u8 signal_strength_dbg;	// for debug
+	s8 rssi;
+	s8 rxpwdb;
+	u8 signal_strength;
+	u8 signal_qual;
+	u8 noise;
+	int RxSNRdB[2];
+	s8 RxRssi[2];
+	int FalseAlmCnt_all;
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	_timer signal_stat_timer;
+	u32 signal_stat_sampling_interval;
+	//u32 signal_stat_converging_constant;
+	struct signal_stat signal_qual_data;
+	struct signal_stat signal_strength_data;
+#else //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	struct smooth_rssi_data signal_qual_data;
+	struct smooth_rssi_data signal_strength_data;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	u32 recvbuf_skb_alloc_fail_cnt;
+	u32 recvbuf_null_cnt;
+	u32 read_port_complete_EINPROGRESS_cnt;
+	u32 read_port_complete_other_urb_err_cnt;
+	
+
+};
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+#define rtw_set_signal_stat_timer(recvpriv) _set_timer(&(recvpriv)->signal_stat_timer, (recvpriv)->signal_stat_sampling_interval)
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+struct sta_recv_priv {
+
+	_lock	lock;
+	sint	option;
+
+	//_queue	blk_strms[MAX_RX_NUMBLKS];
+	_queue defrag_q;	 //keeping the fragment frame until defrag
+
+	struct	stainfo_rxcache rxcache;
+
+	//uint	sta_rx_bytes;
+	//uint	sta_rx_pkts;
+	//uint	sta_rx_fail;
+
+};
+
+
+struct recv_buf
+{
+	_list list;
+
+	_lock recvbuf_lock;
+
+	u32	ref_cnt;
+
+	PADAPTER adapter;
+
+	u8	*pbuf;
+	u8	*pallocated_buf;
+
+	u32	len;
+	u8	*phead;
+	u8	*pdata;
+	u8	*ptail;
+	u8	*pend;
+
+#ifdef CONFIG_USB_HCI
+
+	#if defined(PLATFORM_OS_XP)||defined(PLATFORM_LINUX)||defined(PLATFORM_FREEBSD)
+	PURB	purb;
+	dma_addr_t dma_transfer_addr;	/* (in) dma addr for transfer_buffer */
+	u32 alloc_sz;
+	#endif
+
+	#ifdef PLATFORM_OS_XP
+	PIRP		pirp;
+	#endif
+
+	#ifdef PLATFORM_OS_CE
+	USB_TRANSFER	usb_transfer_read_port;
+	#endif
+
+	u8  irp_pending;
+	int  transfer_len;
+
+#endif
+
+#ifdef PLATFORM_LINUX
+	_pkt *pskb;
+	u8	reuse;
+#endif
+#ifdef PLATFORM_FREEBSD //skb solution
+	struct sk_buff *pskb;
+	u8	reuse;
+#endif //PLATFORM_FREEBSD //skb solution
+};
+
+
+/*
+	head  ----->
+
+		data  ----->
+
+			payload
+
+		tail  ----->
+
+
+	end   ----->
+
+	len = (unsigned int )(tail - data);
+
+*/
+struct recv_frame_hdr
+{
+	_list	list;
+#ifndef CONFIG_BSD_RX_USE_MBUF
+	struct sk_buff	 *pkt;
+	struct sk_buff	 *pkt_newalloc;
+#else // CONFIG_BSD_RX_USE_MBUF
+	_pkt	*pkt;
+	_pkt *pkt_newalloc;
+#endif // CONFIG_BSD_RX_USE_MBUF
+
+	_adapter  *adapter;
+
+	u8 fragcnt;
+
+	int frame_tag;
+
+	struct rx_pkt_attrib attrib;
+
+	uint  len;
+	u8 *rx_head;
+	u8 *rx_data;
+	u8 *rx_tail;
+	u8 *rx_end;
+
+	void *precvbuf;
+
+
+	//
+	struct sta_info *psta;
+
+	//for A-MPDU Rx reordering buffer control
+	struct recv_reorder_ctrl *preorder_ctrl;
+
+};
+
+
+union recv_frame{
+
+	union{
+		_list list;
+		struct recv_frame_hdr hdr;
+		uint mem[RECVFRAME_HDR_ALIGN>>2];
+	}u;
+
+	//uint mem[MAX_RXSZ>>2];
+
+};
+
+
+extern union recv_frame *_rtw_alloc_recvframe (_queue *pfree_recv_queue);  //get a free recv_frame from pfree_recv_queue
+extern union recv_frame *rtw_alloc_recvframe (_queue *pfree_recv_queue);  //get a free recv_frame from pfree_recv_queue
+extern void rtw_init_recvframe(union recv_frame *precvframe ,struct recv_priv *precvpriv);
+extern int	 rtw_free_recvframe(union recv_frame *precvframe, _queue *pfree_recv_queue);
+
+#define rtw_dequeue_recvframe(queue) rtw_alloc_recvframe(queue)
+extern int _rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue);
+extern int rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue);
+
+extern void rtw_free_recvframe_queue(_queue *pframequeue,  _queue *pfree_recv_queue);
+u32 rtw_free_uc_swdec_pending_queue(_adapter *adapter);
+
+sint rtw_enqueue_recvbuf_to_head(struct recv_buf *precvbuf, _queue *queue);
+sint rtw_enqueue_recvbuf(struct recv_buf *precvbuf, _queue *queue);
+struct recv_buf *rtw_dequeue_recvbuf (_queue *queue);
+
+void rtw_reordering_ctrl_timeout_handler(void *pcontext);
+
+__inline static u8 *get_rxmem(union recv_frame *precvframe)
+{
+	//always return rx_head...
+	if(precvframe==NULL)
+		return NULL;
+
+	return precvframe->u.hdr.rx_head;
+}
+
+__inline static u8 *get_rx_status(union recv_frame *precvframe)
+{
+
+	return get_rxmem(precvframe);
+
+}
+
+__inline static u8 *get_recvframe_data(union recv_frame *precvframe)
+{
+
+	//alwasy return rx_data
+	if(precvframe==NULL)
+		return NULL;
+
+	return precvframe->u.hdr.rx_data;
+
+}
+
+__inline static u8 *recvframe_push(union recv_frame *precvframe, sint sz)
+{
+	// append data before rx_data
+
+	/* add data to the start of recv_frame
+ *
+ *      This function extends the used data area of the recv_frame at the buffer
+ *      start. rx_data must be still larger than rx_head, after pushing.
+ */
+
+	if(precvframe==NULL)
+		return NULL;
+
+
+	precvframe->u.hdr.rx_data -= sz ;
+	if( precvframe->u.hdr.rx_data < precvframe->u.hdr.rx_head )
+	{
+		precvframe->u.hdr.rx_data += sz ;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len +=sz;
+
+	return precvframe->u.hdr.rx_data;
+
+}
+
+
+__inline static u8 *recvframe_pull(union recv_frame *precvframe, sint sz)
+{
+	// rx_data += sz; move rx_data sz bytes  hereafter
+
+	//used for extract sz bytes from rx_data, update rx_data and return the updated rx_data to the caller
+
+
+	if(precvframe==NULL)
+		return NULL;
+
+
+	precvframe->u.hdr.rx_data += sz;
+
+	if(precvframe->u.hdr.rx_data > precvframe->u.hdr.rx_tail)
+	{
+		precvframe->u.hdr.rx_data -= sz;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len -=sz;
+
+	return precvframe->u.hdr.rx_data;
+
+}
+
+__inline static u8 *recvframe_put(union recv_frame *precvframe, sint sz)
+{
+	// rx_tai += sz; move rx_tail sz bytes  hereafter
+
+	//used for append sz bytes from ptr to rx_tail, update rx_tail and return the updated rx_tail to the caller
+	//after putting, rx_tail must be still larger than rx_end.
+ 	unsigned char * prev_rx_tail;
+
+	if(precvframe==NULL)
+		return NULL;
+
+	prev_rx_tail = precvframe->u.hdr.rx_tail;
+
+	precvframe->u.hdr.rx_tail += sz;
+
+	if(precvframe->u.hdr.rx_tail > precvframe->u.hdr.rx_end)
+	{
+		precvframe->u.hdr.rx_tail -= sz;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len +=sz;
+
+	return precvframe->u.hdr.rx_tail;
+
+}
+
+
+
+__inline static u8 *recvframe_pull_tail(union recv_frame *precvframe, sint sz)
+{
+	// rmv data from rx_tail (by yitsen)
+
+	//used for extract sz bytes from rx_end, update rx_end and return the updated rx_end to the caller
+	//after pulling, rx_end must be still larger than rx_data.
+
+	if(precvframe==NULL)
+		return NULL;
+
+	precvframe->u.hdr.rx_tail -= sz;
+
+	if(precvframe->u.hdr.rx_tail < precvframe->u.hdr.rx_data)
+	{
+		precvframe->u.hdr.rx_tail += sz;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len -=sz;
+
+	return precvframe->u.hdr.rx_tail;
+
+}
+
+
+
+__inline static _buffer * get_rxbuf_desc(union recv_frame *precvframe)
+{
+	_buffer * buf_desc;
+
+	if(precvframe==NULL)
+		return NULL;
+#ifdef PLATFORM_WINDOWS
+	NdisQueryPacket(precvframe->u.hdr.pkt, NULL, NULL, &buf_desc, NULL);
+#endif
+
+	return buf_desc;
+}
+
+
+__inline static union recv_frame *rxmem_to_recvframe(u8 *rxmem)
+{
+	//due to the design of 2048 bytes alignment of recv_frame, we can reference the union recv_frame
+	//from any given member of recv_frame.
+	// rxmem indicates the any member/address in recv_frame
+
+	return (union recv_frame*)(((SIZE_PTR)rxmem >> RXFRAME_ALIGN) << RXFRAME_ALIGN);
+
+}
+
+__inline static union recv_frame *pkt_to_recvframe(_pkt *pkt)
+{
+
+	u8 * buf_star;
+	union recv_frame * precv_frame;
+#ifdef PLATFORM_WINDOWS
+	_buffer * buf_desc;
+	uint len;
+
+	NdisQueryPacket(pkt, NULL, NULL, &buf_desc, &len);
+	NdisQueryBufferSafe(buf_desc, &buf_star, &len, HighPagePriority);
+#endif
+	precv_frame = rxmem_to_recvframe((unsigned char*)buf_star);
+
+	return precv_frame;
+}
+
+__inline static u8 *pkt_to_recvmem(_pkt *pkt)
+{
+	// return the rx_head
+
+	union recv_frame * precv_frame = pkt_to_recvframe(pkt);
+
+	return 	precv_frame->u.hdr.rx_head;
+
+}
+
+__inline static u8 *pkt_to_recvdata(_pkt *pkt)
+{
+	// return the rx_data
+
+	union recv_frame * precv_frame =pkt_to_recvframe(pkt);
+
+	return 	precv_frame->u.hdr.rx_data;
+
+}
+
+
+__inline static sint get_recvframe_len(union recv_frame *precvframe)
+{
+	return precvframe->u.hdr.len;
+}
+
+__inline static u8 query_rx_pwr_percentage(s8 antpower )
+{
+	if ((antpower <= -100) || (antpower >= 20))
+	{
+		return	0;
+	}
+	else if (antpower >= 0)
+	{
+		return	100;
+	}
+	else
+	{
+		return	(100+antpower);
+	}
+}
+
+__inline static s32 translate_percentage_to_dbm(u32 SignalStrengthIndex)
+{
+	s32	SignalPower; // in dBm.
+
+	// Translate to dBm (x=0.5y-95).
+	SignalPower = (s32)((SignalStrengthIndex + 1) >> 1);
+	SignalPower -= 95;
+
+	return SignalPower;
+}
+
+
+struct sta_info;
+
+extern void _rtw_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv);
+
+extern void  mgt_dispatcher(_adapter *padapter, union recv_frame *precv_frame);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h
new file mode 100755
index 0000000000000..697dd4e5d4630
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h
@@ -0,0 +1,152 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__RTW_RF_H_ 
+#define __RTW_RF_H_
+
+#include <drv_conf.h>
+#include <rtw_cmd.h>
+
+#define OFDM_PHY		1
+#define MIXED_PHY		2
+#define CCK_PHY		3
+
+#define NumRates	(13)
+
+// slot time for 11g
+#define SHORT_SLOT_TIME					9
+#define NON_SHORT_SLOT_TIME				20
+
+#define RTL8711_RF_MAX_SENS 6
+#define RTL8711_RF_DEF_SENS 4
+
+//
+// We now define the following channels as the max channels in each channel plan.
+// 2G, total 14 chnls
+// {1,2,3,4,5,6,7,8,9,10,11,12,13,14}
+// 5G, total 24 chnls
+// {36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165}
+#define	MAX_CHANNEL_NUM_2G				14
+#define	MAX_CHANNEL_NUM_5G				24
+#define	MAX_CHANNEL_NUM					38//14+24
+
+//#define NUM_REGULATORYS	21
+#define NUM_REGULATORYS	1
+
+//Country codes
+#define USA							0x555320
+#define EUROPE						0x1 //temp, should be provided later	
+#define JAPAN						0x2 //temp, should be provided later	
+
+struct	regulatory_class {
+	u32	starting_freq;					//MHz, 
+	u8	channel_set[MAX_CHANNEL_NUM];
+	u8	channel_cck_power[MAX_CHANNEL_NUM];//dbm
+	u8	channel_ofdm_power[MAX_CHANNEL_NUM];//dbm
+	u8	txpower_limit;  				//dbm
+	u8	channel_spacing;				//MHz
+	u8	modem;
+};
+
+typedef enum _CAPABILITY{
+	cESS			= 0x0001,
+	cIBSS			= 0x0002,
+	cPollable		= 0x0004,
+	cPollReq			= 0x0008,
+	cPrivacy		= 0x0010,
+	cShortPreamble	= 0x0020,
+	cPBCC			= 0x0040,
+	cChannelAgility	= 0x0080,
+	cSpectrumMgnt	= 0x0100,
+	cQos			= 0x0200,	// For HCCA, use with CF-Pollable and CF-PollReq
+	cShortSlotTime	= 0x0400,
+	cAPSD			= 0x0800,
+	cRM				= 0x1000,	// RRM (Radio Request Measurement)
+	cDSSS_OFDM	= 0x2000,
+	cDelayedBA		= 0x4000,
+	cImmediateBA	= 0x8000,
+}CAPABILITY, *PCAPABILITY;
+
+enum	_REG_PREAMBLE_MODE{
+	PREAMBLE_LONG	= 1,
+	PREAMBLE_AUTO	= 2,
+	PREAMBLE_SHORT	= 3,
+};
+
+
+enum _RTL8712_RF_MIMO_CONFIG_{
+ RTL8712_RFCONFIG_1T=0x10,
+ RTL8712_RFCONFIG_2T=0x20,
+ RTL8712_RFCONFIG_1R=0x01,
+ RTL8712_RFCONFIG_2R=0x02,
+ RTL8712_RFCONFIG_1T1R=0x11,
+ RTL8712_RFCONFIG_1T2R=0x12,
+ RTL8712_RFCONFIG_TURBO=0x92,
+ RTL8712_RFCONFIG_2T2R=0x22
+};
+
+
+// Bandwidth Offset
+#define HAL_PRIME_CHNL_OFFSET_DONT_CARE	0
+#define HAL_PRIME_CHNL_OFFSET_LOWER	1
+#define HAL_PRIME_CHNL_OFFSET_UPPER	2
+
+// Represent Channel Width in HT Capabilities
+//
+typedef enum _HT_CHANNEL_WIDTH {
+	HT_CHANNEL_WIDTH_20 = 0,
+	HT_CHANNEL_WIDTH_40 = 1,
+}HT_CHANNEL_WIDTH, *PHT_CHANNEL_WIDTH;
+
+//
+// Represent Extention Channel Offset in HT Capabilities
+// This is available only in 40Mhz mode.
+//
+typedef enum _HT_EXTCHNL_OFFSET{
+	HT_EXTCHNL_OFFSET_NO_EXT = 0,
+	HT_EXTCHNL_OFFSET_UPPER = 1,
+	HT_EXTCHNL_OFFSET_NO_DEF = 2,
+	HT_EXTCHNL_OFFSET_LOWER = 3,
+}HT_EXTCHNL_OFFSET, *PHT_EXTCHNL_OFFSET;
+
+/* 2007/11/15 MH Define different RF type. */
+typedef	enum _RT_RF_TYPE_DEFINITION
+{
+	RF_1T2R = 0,
+	RF_2T4R = 1,
+	RF_2T2R = 2,
+	RF_1T1R = 3,
+	RF_2T2R_GREEN = 4,
+	RF_819X_MAX_TYPE = 5,
+}RT_RF_TYPE_DEF_E;
+
+typedef enum _RF_RADIO_PATH{
+	RF_PATH_A = 0,			//Radio Path A
+	RF_PATH_B = 1,			//Radio Path B
+	RF_PATH_C = 2,			//Radio Path C
+	RF_PATH_D = 3,			//Radio Path D
+	//RF_PATH_MAX				//Max RF number 90 support 
+}RF_RADIO_PATH_E, *PRF_RADIO_PATH_E;
+
+u32 rtw_ch2freq(u32 ch);
+u32 rtw_freq2ch(u32 freq);
+
+
+#endif //_RTL8711_RF_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h
new file mode 100755
index 0000000000000..835677c37c488
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h
@@ -0,0 +1,447 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_SECURITY_H_
+#define __RTW_SECURITY_H_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#define _NO_PRIVACY_	0x0
+#define _WEP40_			0x1
+#define _TKIP_			0x2
+#define _TKIP_WTMIC_	0x3
+#define _AES_			0x4
+#define _WEP104_		0x5
+#ifdef CONFIG_IEEE80211W
+#define _BIP_				0x8 
+#endif //CONFIG_IEEE80211W
+#define is_wep_enc(alg) (((alg) == _WEP40_) || ((alg) == _WEP104_))
+
+#define _WPA_IE_ID_	0xdd
+#define _WPA2_IE_ID_	0x30
+
+#define SHA256_MAC_LEN 32
+#define AES_BLOCK_SIZE 16
+#define AES_PRIV_SIZE (4 * 44)
+
+#ifndef Ndis802_11AuthModeWPA2
+#define Ndis802_11AuthModeWPA2 (Ndis802_11AuthModeWPANone + 1)
+#endif
+
+#ifndef Ndis802_11AuthModeWPA2PSK
+#define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2)
+#endif
+
+union pn48	{
+	
+	u64	val;
+	
+#ifdef CONFIG_LITTLE_ENDIAN
+
+struct {
+  u8 TSC0;
+  u8 TSC1;
+  u8 TSC2;
+  u8 TSC3;
+  u8 TSC4;
+  u8 TSC5;
+  u8 TSC6;
+  u8 TSC7;
+} _byte_;
+ 
+#elif defined(CONFIG_BIG_ENDIAN)
+
+struct {
+  u8 TSC7;
+  u8 TSC6;
+  u8 TSC5;
+  u8 TSC4;
+  u8 TSC3;
+  u8 TSC2;
+  u8 TSC1;
+  u8 TSC0;
+} _byte_;
+ 
+#endif
+
+};
+
+union Keytype {
+        u8   skey[16];
+        u32    lkey[4];
+};
+
+
+typedef struct _RT_PMKID_LIST
+{
+	u8						bUsed;
+	u8 						Bssid[6];
+	u8						PMKID[16];
+	u8						SsidBuf[33];
+	u8*						ssid_octet;
+	u16 						ssid_length;
+} RT_PMKID_LIST, *PRT_PMKID_LIST;
+
+
+struct security_priv
+{
+	u32	  dot11AuthAlgrthm;		// 802.11 auth, could be open, shared, 8021x and authswitch 
+	u32	  dot11PrivacyAlgrthm;	// This specify the privacy for shared auth. algorithm.
+
+	/* WEP */
+	u32	  dot11PrivacyKeyIndex;	// this is only valid for legendary wep, 0~3 for key id. (tx key index)
+	union Keytype dot11DefKey[4];			// this is only valid for def. key	
+	u32 	dot11DefKeylen[4];
+	u8 	key_mask; /* use to restore wep key after hal_init */
+
+	u32 dot118021XGrpPrivacy;	// This specify the privacy algthm. used for Grp key 
+	u32	dot118021XGrpKeyid;		// key id used for Grp Key ( tx key index)
+	union Keytype	dot118021XGrpKey[4];	// 802.1x Group Key, for inx0 and inx1	
+	union Keytype	dot118021XGrptxmickey[4];
+	union Keytype	dot118021XGrprxmickey[4];
+	union pn48		dot11Grptxpn;			// PN48 used for Grp Key xmit.
+	union pn48		dot11Grprxpn;			// PN48 used for Grp Key recv.
+#ifdef CONFIG_IEEE80211W
+	u32	dot11wBIPKeyid;						// key id used for BIP Key ( tx key index)
+	union Keytype	dot11wBIPKey[6];		// BIP Key, for index4 and index5
+	union pn48		dot11wBIPtxpn;			// PN48 used for Grp Key xmit.
+	union pn48		dot11wBIPrxpn;			// PN48 used for Grp Key recv.
+#endif //CONFIG_IEEE80211W
+#ifdef CONFIG_AP_MODE
+	//extend security capabilities for AP_MODE 
+	unsigned int dot8021xalg;//0:disable, 1:psk, 2:802.1x
+	unsigned int wpa_psk;//0:disable, bit(0): WPA, bit(1):WPA2
+	unsigned int wpa_group_cipher;
+	unsigned int wpa2_group_cipher;
+	unsigned int wpa_pairwise_cipher;
+	unsigned int wpa2_pairwise_cipher;	
+#endif
+
+	u8 wps_ie[MAX_WPS_IE_LEN];//added in assoc req
+	int wps_ie_len;
+	
+	
+	u8	binstallGrpkey;
+#ifdef CONFIG_IEEE80211W
+	u8	binstallBIPkey;
+#endif //CONFIG_IEEE80211W
+	u8	busetkipkey;
+	//_timer tkip_timer;
+	u8	bcheck_grpkey;
+	u8	bgrpkey_handshake;
+	
+	//u8	packet_cnt;//unused, removed
+	
+	s32	sw_encrypt;//from registry_priv
+	s32	sw_decrypt;//from registry_priv
+	
+	s32 	hw_decrypted;//if the rx packets is hw_decrypted==_FALSE, it means the hw has not been ready.
+
+
+	//keeps the auth_type & enc_status from upper layer ioctl(wpa_supplicant or wzc)
+	u32 ndisauthtype;	// NDIS_802_11_AUTHENTICATION_MODE
+	u32 ndisencryptstatus;	// NDIS_802_11_ENCRYPTION_STATUS
+
+	WLAN_BSSID_EX sec_bss;  //for joinbss (h2c buffer) usage
+
+	NDIS_802_11_WEP ndiswep;
+#ifdef PLATFORM_WINDOWS
+	u8 KeyMaterial[16];// variable length depending on above field.
+#endif
+
+	u8 assoc_info[600];
+	u8 szofcapability[256]; //for wpa2 usage
+	u8 oidassociation[512]; //for wpa/wpa2 usage
+	u8 authenticator_ie[256];  //store ap security information element
+	u8 supplicant_ie[256];  //store sta security information element
+
+
+	//for tkip countermeasure
+	u32 last_mic_err_time;	
+	u8	btkip_countermeasure;
+	u8	btkip_wait_report;
+	u32 btkip_countermeasure_time;
+
+	//---------------------------------------------------------------------------
+	// For WPA2 Pre-Authentication.
+	//---------------------------------------------------------------------------
+	//u8				RegEnablePreAuth;				// Default value: Pre-Authentication enabled or not, from registry "EnablePreAuth". Added by Annie, 2005-11-01.
+	//u8				EnablePreAuthentication;			// Current Value: Pre-Authentication enabled or not.
+	RT_PMKID_LIST		PMKIDList[NUM_PMKID_CACHE];	// Renamed from PreAuthKey[NUM_PRE_AUTH_KEY]. Annie, 2006-10-13.
+	u8				PMKIDIndex;
+	//u32				PMKIDCount;						// Added by Annie, 2006-10-13.
+	//u8				szCapability[256];				// For WPA2-PSK using zero-config, by Annie, 2005-09-20.
+
+	u8 bWepDefaultKeyIdxSet;
+};
+
+struct sha256_state {
+	u64 length;
+	u32 state[8], curlen;
+	u8 buf[64];
+};
+
+#define GET_ENCRY_ALGO(psecuritypriv, psta, encry_algo, bmcst)\
+do{\
+	switch(psecuritypriv->dot11AuthAlgrthm)\
+	{\
+		case dot11AuthAlgrthm_Open:\
+		case dot11AuthAlgrthm_Shared:\
+		case dot11AuthAlgrthm_Auto:\
+			encry_algo = (u8)psecuritypriv->dot11PrivacyAlgrthm;\
+			break;\
+		case dot11AuthAlgrthm_8021X:\
+			if(bmcst)\
+				encry_algo = (u8)psecuritypriv->dot118021XGrpPrivacy;\
+			else\
+				encry_algo =(u8) psta->dot118021XPrivacy;\
+			break;\
+	}\
+}while(0)
+
+
+#define SET_ICE_IV_LEN( iv_len, icv_len, encrypt)\
+do{\
+	switch(encrypt)\
+	{\
+		case _WEP40_:\
+		case _WEP104_:\
+			iv_len = 4;\
+			icv_len = 4;\
+			break;\
+		case _TKIP_:\
+			iv_len = 8;\
+			icv_len = 4;\
+			break;\
+		case _AES_:\
+			iv_len = 8;\
+			icv_len = 8;\
+			break;\
+		default:\
+			iv_len = 0;\
+			icv_len = 0;\
+			break;\
+	}\
+}while(0)
+
+
+#define GET_TKIP_PN(iv,dot11txpn)\
+do{\
+	dot11txpn._byte_.TSC0=iv[2];\
+	dot11txpn._byte_.TSC1=iv[0];\
+	dot11txpn._byte_.TSC2=iv[4];\
+	dot11txpn._byte_.TSC3=iv[5];\
+	dot11txpn._byte_.TSC4=iv[6];\
+	dot11txpn._byte_.TSC5=iv[7];\
+}while(0)
+
+
+#define ROL32( A, n )	( ((A) << (n)) | ( ((A)>>(32-(n)))  & ( (1UL << (n)) - 1 ) ) )
+#define ROR32( A, n ) 	ROL32( (A), 32-(n) )
+
+struct mic_data
+{
+	u32  K0, K1;         // Key
+	u32  L, R;           // Current state
+	u32  M;              // Message accumulator (single word)
+	u32     nBytesInM;      // # bytes in M
+};
+
+extern const u32 Te0[256];
+extern const u32 Te1[256];
+extern const u32 Te2[256];
+extern const u32 Te3[256];
+extern const u32 Te4[256];
+extern const u32 Td0[256];
+extern const u32 Td1[256];
+extern const u32 Td2[256];
+extern const u32 Td3[256];
+extern const u32 Td4[256];
+extern const u32 rcon[10];
+extern const u8 Td4s[256];
+extern const u8 rcons[10];
+
+#define RCON(i) (rcons[(i)] << 24)
+
+static inline u32 rotr(u32 val, int bits)
+{
+	return (val >> bits) | (val << (32 - bits));
+}
+
+#define TE0(i) Te0[((i) >> 24) & 0xff]
+#define TE1(i) rotr(Te0[((i) >> 16) & 0xff], 8)
+#define TE2(i) rotr(Te0[((i) >> 8) & 0xff], 16)
+#define TE3(i) rotr(Te0[(i) & 0xff], 24)
+#define TE41(i) ((Te0[((i) >> 24) & 0xff] << 8) & 0xff000000)
+#define TE42(i) (Te0[((i) >> 16) & 0xff] & 0x00ff0000)
+#define TE43(i) (Te0[((i) >> 8) & 0xff] & 0x0000ff00)
+#define TE44(i) ((Te0[(i) & 0xff] >> 8) & 0x000000ff)
+#define TE421(i) ((Te0[((i) >> 16) & 0xff] << 8) & 0xff000000)
+#define TE432(i) (Te0[((i) >> 8) & 0xff] & 0x00ff0000)
+#define TE443(i) (Te0[(i) & 0xff] & 0x0000ff00)
+#define TE414(i) ((Te0[((i) >> 24) & 0xff] >> 8) & 0x000000ff)
+#define TE4(i) ((Te0[(i)] >> 8) & 0x000000ff)
+
+#define TD0(i) Td0[((i) >> 24) & 0xff]
+#define TD1(i) rotr(Td0[((i) >> 16) & 0xff], 8)
+#define TD2(i) rotr(Td0[((i) >> 8) & 0xff], 16)
+#define TD3(i) rotr(Td0[(i) & 0xff], 24)
+#define TD41(i) (Td4s[((i) >> 24) & 0xff] << 24)
+#define TD42(i) (Td4s[((i) >> 16) & 0xff] << 16)
+#define TD43(i) (Td4s[((i) >> 8) & 0xff] << 8)
+#define TD44(i) (Td4s[(i) & 0xff])
+#define TD0_(i) Td0[(i) & 0xff]
+#define TD1_(i) rotr(Td0[(i) & 0xff], 8)
+#define TD2_(i) rotr(Td0[(i) & 0xff], 16)
+#define TD3_(i) rotr(Td0[(i) & 0xff], 24)
+
+#define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ \
+			((u32)(pt)[2] <<  8) ^ ((u32)(pt)[3]))
+
+#define PUTU32(ct, st) { \
+(ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); \
+(ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
+
+#define WPA_GET_BE32(a) ((((u32) (a)[0]) << 24) | (((u32) (a)[1]) << 16) | \
+			 (((u32) (a)[2]) << 8) | ((u32) (a)[3]))
+
+#define WPA_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((u16) (val)) >> 8;	\
+		(a)[0] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define WPA_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define WPA_PUT_BE64(a, val)				\
+	do {						\
+		(a)[0] = (u8) (((u64) (val)) >> 56);	\
+		(a)[1] = (u8) (((u64) (val)) >> 48);	\
+		(a)[2] = (u8) (((u64) (val)) >> 40);	\
+		(a)[3] = (u8) (((u64) (val)) >> 32);	\
+		(a)[4] = (u8) (((u64) (val)) >> 24);	\
+		(a)[5] = (u8) (((u64) (val)) >> 16);	\
+		(a)[6] = (u8) (((u64) (val)) >> 8);	\
+		(a)[7] = (u8) (((u64) (val)) & 0xff);	\
+	} while (0)
+	
+/* ===== start - public domain SHA256 implementation ===== */
+
+/* This is based on SHA256 implementation in LibTomCrypt that was released into
+ * public domain by Tom St Denis. */
+
+/* the K array */
+static const unsigned long K[64] = {
+	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
+	0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
+	0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
+	0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
+	0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
+	0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
+	0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
+	0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
+	0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
+	0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+};
+
+
+/* Various logical functions */
+#define RORc(x, y) \
+( ((((unsigned long) (x) & 0xFFFFFFFFUL) >> (unsigned long) ((y) & 31)) | \
+   ((unsigned long) (x) << (unsigned long) (32 - ((y) & 31)))) & 0xFFFFFFFFUL)
+#define Ch(x,y,z)       (z ^ (x & (y ^ z)))
+#define Maj(x,y,z)      (((x | y) & z) | (x & y)) 
+#define S(x, n)         RORc((x), (n))
+#define R(x, n)         (((x)&0xFFFFFFFFUL)>>(n))
+#define Sigma0(x)       (S(x, 2) ^ S(x, 13) ^ S(x, 22))
+#define Sigma1(x)       (S(x, 6) ^ S(x, 11) ^ S(x, 25))
+#define Gamma0(x)       (S(x, 7) ^ S(x, 18) ^ R(x, 3))
+#define Gamma1(x)       (S(x, 17) ^ S(x, 19) ^ R(x, 10))
+#ifndef MIN
+#define MIN(x, y) (((x) < (y)) ? (x) : (y))
+#endif
+#ifdef CONFIG_IEEE80211W
+int omac1_aes_128(u8 *key, u8 *data, size_t data_len, u8 *mac);
+#endif //CONFIG_IEEE80211W
+void rtw_secmicsetkey(struct mic_data *pmicdata, u8 * key );
+void rtw_secmicappendbyte(struct mic_data *pmicdata, u8 b );
+void rtw_secmicappend(struct mic_data *pmicdata, u8 * src, u32 nBytes );
+void rtw_secgetmic(struct mic_data *pmicdata, u8 * dst );
+
+void rtw_seccalctkipmic(
+	u8 * key,
+	u8 *header,
+	u8 *data,
+	u32 data_len,
+	u8 *Miccode,
+	u8   priority);
+
+u32 rtw_aes_encrypt(_adapter *padapter, u8 *pxmitframe);
+u32 rtw_tkip_encrypt(_adapter *padapter, u8 *pxmitframe);
+void rtw_wep_encrypt(_adapter *padapter, u8  *pxmitframe);
+
+u32 rtw_aes_decrypt(_adapter *padapter, u8  *precvframe);
+u32 rtw_tkip_decrypt(_adapter *padapter, u8  *precvframe);
+void rtw_wep_decrypt(_adapter *padapter, u8  *precvframe);
+#ifdef CONFIG_IEEE80211W
+u32	rtw_BIP_verify(_adapter *padapter, u8 *precvframe);
+#endif //CONFIG_IEEE80211W
+#ifdef CONFIG_TDLS
+void wpa_tdls_generate_tpk(_adapter *padapter, struct sta_info *psta);
+int wpa_tdls_ftie_mic(u8 *kck, u8 trans_seq, 
+						u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie,
+						u8 *mic);
+int tdls_verify_mic(u8 *kck, u8 trans_seq, 
+						u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie);
+#endif //CONFIG_TDLS
+
+#ifdef PLATFORM_WINDOWS
+void rtw_use_tkipkey_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	);
+#endif
+#ifdef PLATFORM_LINUX
+void rtw_use_tkipkey_handler(void* FunctionContext);
+#endif
+
+#ifdef PLATFORM_FREEBSD
+void rtw_use_tkipkey_handler(void* FunctionContext);
+#endif //PLATFORM_FREEBSD
+
+void rtw_sec_restore_wep_key(_adapter *adapter);
+u8 rtw_handle_tkip_countermeasure(_adapter* adapter, const char *caller);
+
+#endif	//__RTL871X_SECURITY_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h
new file mode 100755
index 0000000000000..45dd2bfbf1e21
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h
@@ -0,0 +1,74 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_SRESET_C_
+#define _RTW_SRESET_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+enum {
+	SRESET_TGP_NULL = 0,
+	SRESET_TGP_XMIT_STATUS = 1,
+	SRESET_TGP_LINK_STATUS = 2,
+};
+
+struct sreset_priv {
+	_mutex 	silentreset_mutex;
+	u8 	silent_reset_inprogress;
+	u8	Wifi_Error_Status;
+	unsigned long last_tx_time;
+	unsigned long last_tx_complete_time;
+
+	s32 dbg_trigger_point;
+};
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+#ifdef CONFIG_RTL8723A
+#include <rtl8723a_hal.h>
+#endif
+#ifdef CONFIG_RTL8188E
+#include <rtl8188e_hal.h>
+#endif
+
+#define	WIFI_STATUS_SUCCESS 		0
+#define	USB_VEN_REQ_CMD_FAIL 	BIT0
+#define	USB_READ_PORT_FAIL 		BIT1
+#define	USB_WRITE_PORT_FAIL		BIT2
+#define	WIFI_MAC_TXDMA_ERROR 	BIT3			
+#define   WIFI_TX_HANG				BIT4
+#define	WIFI_RX_HANG				BIT5
+#define 	WIFI_IF_NOT_EXIST			BIT6
+
+void sreset_init_value(_adapter *padapter);
+void sreset_reset_value(_adapter *padapter);
+u8 sreset_get_wifi_status(_adapter *padapter);
+void sreset_set_wifi_error_status(_adapter *padapter, u32 status);
+void sreset_set_trigger_point(_adapter *padapter, s32 tgp);
+bool sreset_inprogress(_adapter *padapter);
+void sreset_reset(_adapter *padapter);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h
new file mode 100755
index 0000000000000..1005331cc4592
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h
@@ -0,0 +1,143 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_TDLS_H_
+#define __RTW_TDLS_H_
+
+#include <drv_types.h>
+
+#ifdef CONFIG_TDLS
+/* TDLS STA state */
+#define	TDLS_STATE_NONE				0x00000000	//default state
+#define	TDLS_INITIATOR_STATE			0x10000000
+#define	TDLS_RESPONDER_STATE			0x20000000
+#define	TDLS_LINKED_STATE				0x40000000
+#define	TDLS_CH_SWITCH_ON_STATE		0x01000000
+#define	TDLS_PEER_AT_OFF_STATE		0x02000000	//could send pkt on target ch
+#define	TDLS_AT_OFF_CH_STATE			0x04000000
+#define	TDLS_CH_SW_INITIATOR_STATE	0x08000000	//avoiding duplicated or unconditional ch. switch rsp.
+#define	TDLS_APSD_CHSW_STATE		0x00100000	//in APSD and want to setup channel switch
+#define	TDLS_PEER_SLEEP_STATE		0x00200000	//peer sta is sleeping
+#define	TDLS_SW_OFF_STATE			0x00400000	//terminate channel swithcing
+#define	TDLS_ALIVE_STATE				0x00010000	//Check if peer sta is alived.
+
+#define	TPK_RESEND_COUNT				301
+#define 	CH_SWITCH_TIME				10
+#define 	CH_SWITCH_TIMEOUT			30
+#define	TDLS_STAY_TIME				500
+#define	TDLS_SIGNAL_THRESH			0x20
+#define	TDLS_WATCHDOG_PERIOD		10	//Periodically sending tdls discovery request in TDLS_WATCHDOG_PERIOD * 2 sec
+#define	TDLS_ALIVE_TIMER_PH1			5000
+#define	TDLS_ALIVE_TIMER_PH2			2000
+#define	TDLS_STAY_TIME				500
+#define	TDLS_HANDSHAKE_TIME			2000
+#define	TDLS_ALIVE_COUNT				3
+#define	TDLS_INI_MACID_ENTRY			6
+
+/* TDLS */
+#define TDLS_MIC_LEN 16
+#define WPA_NONCE_LEN 32
+#define TDLS_TIMEOUT_LEN 4
+
+struct wpa_tdls_ftie {
+	u8 ie_type; /* FTIE */
+	u8 ie_len;
+	u8 mic_ctrl[2];
+	u8 mic[TDLS_MIC_LEN];
+	u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
+	u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
+	/* followed by optional elements */
+} ;
+
+struct wpa_tdls_lnkid {
+	u8 ie_type; /* Link Identifier IE */
+	u8 ie_len;
+	u8 bssid[ETH_ALEN];
+	u8 init_sta[ETH_ALEN];
+	u8 resp_sta[ETH_ALEN];
+} ;
+
+static u8 TDLS_RSNIE[]={	0x01, 0x00,	//version shall be set to 1
+						0x00, 0x0f, 0xac, 0x07,	//group sipher suite
+						0x01, 0x00,	//pairwise cipher suite count
+						0x00, 0x0f, 0xac, 0x04,	//pairwise cipher suite list; CCMP only
+						0x01, 0x00,	//AKM suite count
+						0x00, 0x0f, 0xac, 0x07,	//TPK Handshake
+						0x00, 0x02,
+						//PMKID shall not be present
+						};
+
+static u8 TDLS_WMMIE[]={0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};	//Qos info all set zero
+
+static u8 TDLS_EXT_CAPIE[] = {0x00, 0x00, 0x00, 0x50, 0x20};	//bit(28), bit(30), bit(37)
+
+//	SRC: Supported Regulatory Classes
+static u8 TDLS_SRC[] = { 0x01, 0x01, 0x02, 0x03, 0x04, 0x0c, 0x16, 0x17, 0x18, 0x19, 0x1b, 0x1c, 0x1d, 0x1e, 0x20, 0x21 };
+
+void rtw_reset_tdls_info(_adapter* padapter);
+int rtw_init_tdls_info(_adapter* padapter);
+void rtw_free_tdls_info(struct tdls_info *ptdlsinfo);
+void issue_nulldata_to_TDLS_peer_STA(_adapter *padapter, struct sta_info *ptdls_sta, unsigned int power_mode);
+void init_TPK_timer(_adapter *padapter, struct sta_info *psta);
+void init_ch_switch_timer(_adapter *padapter, struct sta_info *psta);
+void init_base_ch_timer(_adapter *padapter, struct sta_info *psta);
+void init_off_ch_timer(_adapter *padapter, struct sta_info *psta);
+void init_tdls_alive_timer(_adapter *padapter, struct sta_info *psta);
+void init_handshake_timer(_adapter *padapter, struct sta_info *psta);
+void free_tdls_sta(_adapter *padapter, struct sta_info *ptdls_sta);
+#ifdef CONFIG_WFD
+void issue_tunneled_probe_req(_adapter *padapter);
+void issue_tunneled_probe_rsp(_adapter *padapter, union recv_frame *precv_frame);
+#endif //CONFIG_WFD
+void issue_tdls_dis_req(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_setup_req(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_setup_rsp(_adapter *padapter, union recv_frame *precv_frame);
+void issue_tdls_setup_cfm(_adapter *padapter, union recv_frame *precv_frame);
+void issue_tdls_dis_rsp(_adapter * padapter, union recv_frame * precv_frame, u8 dialog);
+void issue_tdls_teardown(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_peer_traffic_indication(_adapter *padapter, struct sta_info *psta);
+void issue_tdls_ch_switch_req(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_ch_switch_rsp(_adapter *padapter, u8 *mac_addr);
+sint On_TDLS_Dis_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Setup_Req(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Setup_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Setup_Cfm(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Dis_Req(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Teardown(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Peer_Traffic_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Ch_Switch_Req(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Ch_Switch_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+void rtw_build_tdls_setup_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_setup_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_setup_cfm_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_teardown_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_dis_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_dis_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe, u8 dialog);
+void rtw_build_tdls_peer_traffic_indication_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_ch_switch_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_ch_switch_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tunneled_probe_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tunneled_probe_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+
+int update_sgi_tdls(_adapter *padapter, struct sta_info *psta);
+u32 update_mask_tdls(_adapter *padapter, struct sta_info *psta);
+#endif //CONFIG_TDLS
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h
new file mode 100644
index 0000000000000..4fb9dd4371094
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h
@@ -0,0 +1 @@
+#define DRIVERVERSION	"v4.0.2_9000.20130911"
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h
new file mode 100755
index 0000000000000..f7eaf4a68b119
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h
@@ -0,0 +1,754 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_XMIT_H_
+#define _RTW_XMIT_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#ifdef PLATFORM_FREEBSD
+#include <if_ether.h>
+#endif //PLATFORM_FREEBSD
+
+#ifdef CONFIG_SDIO_HCI
+//#define MAX_XMITBUF_SZ (30720)//	(2048)
+#define MAX_XMITBUF_SZ (12288)
+#define NR_XMITBUFF	(16)
+
+#elif defined (CONFIG_USB_HCI)
+#ifdef CONFIG_USB_TX_AGGREGATION
+	#if defined(CONFIG_PLATFORM_ARM_SUNxI) || defined(CONFIG_PLATFORM_ARM_SUN6I)
+		#define MAX_XMITBUF_SZ (12288)  //12k 1536*8
+	#elif defined (CONFIG_PLATFORM_MSTAR)
+		#define MAX_XMITBUF_SZ	7680	// 7.5k
+	#else
+		#define MAX_XMITBUF_SZ	(20480)	// 20k
+	#endif
+#else
+#define MAX_XMITBUF_SZ	(2048)
+#endif //CONFIG_USB_TX_AGGREGATION
+#ifdef CONFIG_SINGLE_XMIT_BUF
+#define NR_XMITBUFF	(1)
+#else
+#define NR_XMITBUFF	(4)
+#endif //CONFIG_SINGLE_XMIT_BUF
+
+#elif defined (CONFIG_PCI_HCI)
+#define MAX_XMITBUF_SZ	(1664)
+#define NR_XMITBUFF	(128)
+#endif
+
+#ifdef PLATFORM_OS_CE
+#define XMITBUF_ALIGN_SZ 4
+#else
+#ifdef CONFIG_PCI_HCI
+#define XMITBUF_ALIGN_SZ 4
+#else
+#define XMITBUF_ALIGN_SZ 512
+#endif
+#endif
+
+// xmit extension buff defination
+#define MAX_XMIT_EXTBUF_SZ	(1536)
+#ifdef CONFIG_SINGLE_XMIT_BUF
+#define NR_XMIT_EXTBUFF	(1)
+#else
+#define NR_XMIT_EXTBUFF	(32)
+#endif //CONFIG_SINGLE_XMIT_BUF
+
+#define MAX_NUMBLKS		(1)
+
+#define XMIT_VO_QUEUE (0)
+#define XMIT_VI_QUEUE (1)
+#define XMIT_BE_QUEUE (2)
+#define XMIT_BK_QUEUE (3)
+
+#define VO_QUEUE_INX		0
+#define VI_QUEUE_INX		1
+#define BE_QUEUE_INX		2
+#define BK_QUEUE_INX		3
+#define BCN_QUEUE_INX		4
+#define MGT_QUEUE_INX		5
+#define HIGH_QUEUE_INX		6
+#define TXCMD_QUEUE_INX	7
+
+#define HW_QUEUE_ENTRY	8
+
+#ifdef CONFIG_PCI_HCI
+//#define TXDESC_NUM						64
+#define TXDESC_NUM						128
+#define TXDESC_NUM_BE_QUEUE			128
+#endif
+
+#define WEP_IV(pattrib_iv, dot11txpn, keyidx)\
+do{\
+	pattrib_iv[0] = dot11txpn._byte_.TSC0;\
+	pattrib_iv[1] = dot11txpn._byte_.TSC1;\
+	pattrib_iv[2] = dot11txpn._byte_.TSC2;\
+	pattrib_iv[3] = ((keyidx & 0x3)<<6);\
+	dot11txpn.val = (dot11txpn.val == 0xffffff) ? 0: (dot11txpn.val+1);\
+}while(0)
+
+
+#define TKIP_IV(pattrib_iv, dot11txpn, keyidx)\
+do{\
+	pattrib_iv[0] = dot11txpn._byte_.TSC1;\
+	pattrib_iv[1] = (dot11txpn._byte_.TSC1 | 0x20) & 0x7f;\
+	pattrib_iv[2] = dot11txpn._byte_.TSC0;\
+	pattrib_iv[3] = BIT(5) | ((keyidx & 0x3)<<6);\
+	pattrib_iv[4] = dot11txpn._byte_.TSC2;\
+	pattrib_iv[5] = dot11txpn._byte_.TSC3;\
+	pattrib_iv[6] = dot11txpn._byte_.TSC4;\
+	pattrib_iv[7] = dot11txpn._byte_.TSC5;\
+	dot11txpn.val = dot11txpn.val == 0xffffffffffffULL ? 0: (dot11txpn.val+1);\
+}while(0)
+
+#define AES_IV(pattrib_iv, dot11txpn, keyidx)\
+do{\
+	pattrib_iv[0] = dot11txpn._byte_.TSC0;\
+	pattrib_iv[1] = dot11txpn._byte_.TSC1;\
+	pattrib_iv[2] = 0;\
+	pattrib_iv[3] = BIT(5) | ((keyidx & 0x3)<<6);\
+	pattrib_iv[4] = dot11txpn._byte_.TSC2;\
+	pattrib_iv[5] = dot11txpn._byte_.TSC3;\
+	pattrib_iv[6] = dot11txpn._byte_.TSC4;\
+	pattrib_iv[7] = dot11txpn._byte_.TSC5;\
+	dot11txpn.val = dot11txpn.val == 0xffffffffffffULL ? 0: (dot11txpn.val+1);\
+}while(0)
+
+
+#define HWXMIT_ENTRY	4
+
+#define TXDESC_SIZE 32
+
+#ifdef CONFIG_SDIO_HCI
+#define TXDESC_OFFSET TXDESC_SIZE
+#endif
+
+#ifdef CONFIG_USB_HCI
+#define PACKET_OFFSET_SZ (8)
+#define TXDESC_OFFSET (TXDESC_SIZE + PACKET_OFFSET_SZ)
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#define TXDESC_OFFSET 0
+#define TX_DESC_NEXT_DESC_OFFSET	40
+#endif
+
+//
+//defined for TX DESC Operation
+//
+
+#define MAX_TID (15)
+
+//OFFSET 0
+#define OFFSET_SZ	0
+#define OFFSET_SHT	16
+#define BMC		BIT(24)
+#define LSG		BIT(26)
+#define FSG		BIT(27)
+#define OWN 		BIT(31)
+
+//OFFSET 4
+#define PKT_OFFSET_SZ	0
+#define BK		BIT(6)
+#define QSEL_SHT	8
+#define Rate_ID_SHT	16
+#define NAVUSEHDR	BIT(20)
+#define PKT_OFFSET_SHT	26
+#define HWPC		BIT(31)
+
+//OFFSET 8
+#define AGG_EN		BIT(29)
+
+//OFFSET 12
+#define SEQ_SHT		16
+
+//OFFSET 16
+#define QoS		BIT(6)
+#define HW_SEQ_EN	BIT(7)
+#define USERATE		BIT(8)
+#define DISDATAFB	BIT(10)
+#define DATA_SHORT	BIT(24)
+#define DATA_BW		BIT(25)
+
+//OFFSET 20
+#define SGI		BIT(6)
+
+struct tx_desc{
+
+	//DWORD 0
+	unsigned int txdw0;
+
+	unsigned int txdw1;
+
+	unsigned int txdw2;
+
+	unsigned int txdw3;
+
+	unsigned int txdw4;
+
+	unsigned int txdw5;
+
+	unsigned int txdw6;
+
+	unsigned int txdw7;
+#ifdef CONFIG_PCI_HCI
+	unsigned int txdw8;
+
+	unsigned int txdw9;
+
+	unsigned int txdw10;
+
+	unsigned int txdw11;
+
+	// 2008/05/15 MH Because PCIE HW memory R/W 4K limit. And now,  our descriptor
+	// size is 40 bytes. If you use more than 102 descriptor( 103*40>4096), HW will execute
+	// memoryR/W CRC error. And then all DMA fetch will fail. We must decrease descriptor
+	// number or enlarge descriptor size as 64 bytes.
+	unsigned int txdw12;
+
+	unsigned int txdw13;
+
+	unsigned int txdw14;
+
+	unsigned int txdw15;
+#endif
+};
+
+
+union txdesc {
+	struct tx_desc txdesc;
+	unsigned int value[TXDESC_SIZE>>2];
+};
+
+#ifdef CONFIG_PCI_HCI
+#define PCI_MAX_TX_QUEUE_COUNT	8
+
+struct rtw_tx_ring {
+	struct tx_desc	*desc;
+	dma_addr_t		dma;
+	unsigned int		idx;
+	unsigned int		entries;
+	_queue			queue;
+	u32				qlen;
+};
+#endif
+
+struct	hw_xmit	{
+	//_lock xmit_lock;
+	//_list	pending;
+	_queue *sta_queue;
+	//struct hw_txqueue *phwtxqueue;
+	//sint	txcmdcnt;
+	int	accnt;
+};
+
+#if 0
+struct pkt_attrib
+{
+	u8	type;
+	u8	subtype;
+	u8	bswenc;
+	u8	dhcp_pkt;
+	u16	ether_type;
+	int	pktlen;		//the original 802.3 pkt raw_data len (not include ether_hdr data)
+	int	pkt_hdrlen;	//the original 802.3 pkt header len
+	int	hdrlen;		//the WLAN Header Len
+	int	nr_frags;
+	int	last_txcmdsz;
+	int	encrypt;	//when 0 indicate no encrypt. when non-zero, indicate the encrypt algorith
+	u8	iv[8];
+	int	iv_len;
+	u8	icv[8];
+	int	icv_len;
+	int	priority;
+	int	ack_policy;
+	int	mac_id;
+	int	vcs_mode;	//virtual carrier sense method
+
+	u8 	dst[ETH_ALEN];
+	u8	src[ETH_ALEN];
+	u8	ta[ETH_ALEN];
+	u8 	ra[ETH_ALEN];
+
+	u8	key_idx;
+
+	u8	qos_en;
+	u8	ht_en;
+	u8	raid;//rate adpative id
+	u8	bwmode;
+	u8	ch_offset;//PRIME_CHNL_OFFSET
+	u8	sgi;//short GI
+	u8	ampdu_en;//tx ampdu enable
+	u8	mdata;//more data bit
+	u8	eosp;
+
+	u8	pctrl;//per packet txdesc control enable
+	u8	triggered;//for ap mode handling Power Saving sta
+
+	u32	qsel;
+	u16	seqnum;
+
+	struct sta_info * psta;
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	u8	hw_tcp_csum;
+#endif
+};
+#else
+//reduce size
+struct pkt_attrib
+{
+	u8	type;
+	u8	subtype;
+	u8	bswenc;
+	u8	dhcp_pkt;
+	u16	ether_type;
+	u16	seqnum;
+	u16	pkt_hdrlen;	//the original 802.3 pkt header len
+	u16	hdrlen;		//the WLAN Header Len
+	u32	pktlen;		//the original 802.3 pkt raw_data len (not include ether_hdr data)
+	u32	last_txcmdsz;
+	u8	nr_frags;
+	u8	encrypt;	//when 0 indicate no encrypt. when non-zero, indicate the encrypt algorith
+	u8	iv_len;
+	u8	icv_len;
+	u8	iv[8];
+	u8	icv[8];
+	u8	priority;
+	u8	ack_policy;
+	u8	mac_id;
+	u8	vcs_mode;	//virtual carrier sense method
+	u8 	dst[ETH_ALEN];
+	u8	src[ETH_ALEN];
+	u8	ta[ETH_ALEN];
+	u8 	ra[ETH_ALEN];
+	u8	key_idx;
+	u8	qos_en;
+	u8	ht_en;
+	u8	raid;//rate adpative id
+	u8	bwmode;
+	u8	ch_offset;//PRIME_CHNL_OFFSET
+	u8	sgi;//short GI
+	u8	ampdu_en;//tx ampdu enable
+	u8	mdata;//more data bit
+	u8	pctrl;//per packet txdesc control enable
+	u8	triggered;//for ap mode handling Power Saving sta
+	u8	qsel;
+	u8	eosp;
+	u8	rate;
+	u8	intel_proxim;
+	u8 	retry_ctrl;
+	struct sta_info * psta;
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	u8	hw_tcp_csum;
+#endif
+	union Keytype	dot11tkiptxmickey;
+	//union Keytype	dot11tkiprxmickey;
+	union Keytype	dot118021x_UncstKey;
+};
+#endif
+
+#ifdef PLATFORM_FREEBSD
+#define ETH_ALEN	6		/* Octets in one ethernet addr	 */
+#define ETH_HLEN	14		/* Total octets in header.	 */
+#define ETH_P_IP	0x0800		/* Internet Protocol packet	*/
+
+/*struct rtw_ieee80211_hdr {
+	uint16_t frame_control;
+	uint16_t duration_id;
+	u8 addr1[6];
+	u8 addr2[6];
+	u8 addr3[6];
+	uint16_t seq_ctrl;
+	u8 addr4[6];
+} ;*/
+#endif //PLATFORM_FREEBSD
+
+#define WLANHDR_OFFSET	64
+
+#define NULL_FRAMETAG		(0x0)
+#define DATA_FRAMETAG		0x01
+#define L2_FRAMETAG		0x02
+#define MGNT_FRAMETAG		0x03
+#define AMSDU_FRAMETAG	0x04
+
+#define EII_FRAMETAG		0x05
+#define IEEE8023_FRAMETAG  0x06
+
+#define MP_FRAMETAG		0x07
+
+#define TXAGG_FRAMETAG 	0x08
+
+struct  submit_ctx{
+	u32 submit_time; /* */
+	u32 timeout_ms; /* <0: not synchronous, 0: wait forever, >0: up to ms waiting */
+	int status; /* status for operation */
+#ifdef PLATFORM_LINUX
+	struct completion done;
+#endif
+};
+
+enum {
+	RTW_SCTX_SUBMITTED = -1,
+	RTW_SCTX_DONE_SUCCESS = 0,
+	RTW_SCTX_DONE_UNKNOWN,
+	RTW_SCTX_DONE_TIMEOUT,
+	RTW_SCTX_DONE_BUF_ALLOC,
+	RTW_SCTX_DONE_BUF_FREE,
+	RTW_SCTX_DONE_WRITE_PORT_ERR,
+	RTW_SCTX_DONE_TX_DESC_NA,
+	RTW_SCTX_DONE_TX_DENY,
+	RTW_SCTX_DONE_CCX_PKT_FAIL,
+	RTW_SCTX_DONE_DRV_STOP,
+	RTW_SCTX_DONE_DEV_REMOVE,
+};
+
+
+void rtw_sctx_init(struct submit_ctx *sctx, int timeout_ms);
+int rtw_sctx_wait(struct submit_ctx *sctx);
+void rtw_sctx_done_err(struct submit_ctx **sctx, int status);
+void rtw_sctx_done(struct submit_ctx **sctx);
+
+struct xmit_buf
+{
+	_list	list;
+
+	_adapter *padapter;
+
+	u8 *pallocated_buf;
+
+	u8 *pbuf;
+
+	void *priv_data;
+
+	u16 ext_tag; // 0: Normal xmitbuf, 1: extension xmitbuf.
+	u16 flags;
+	u32 alloc_sz;
+
+	struct submit_ctx *sctx;
+
+#ifdef CONFIG_USB_HCI
+
+	u32 sz[8];
+
+#if defined(PLATFORM_OS_XP)||defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+	PURB	pxmit_urb[8];
+	dma_addr_t dma_transfer_addr;	/* (in) dma addr for transfer_buffer */
+#endif
+
+#ifdef PLATFORM_OS_XP
+	PIRP		pxmit_irp[8];
+#endif
+
+#ifdef PLATFORM_OS_CE
+	USB_TRANSFER	usb_transfer_write_port;
+#endif
+
+	u8 bpending[8];
+
+	sint last[8];
+
+#endif
+
+#ifdef CONFIG_SDIO_HCI
+	u32  len;
+	u8 *phead;
+	u8 *pdata;
+	u8 *ptail;
+	u8 *pend;
+	u32 ff_hwaddr;
+#ifdef PLATFORM_OS_XP
+	PMDL pxmitbuf_mdl;
+	PIRP  pxmitbuf_irp;
+	PSDBUS_REQUEST_PACKET pxmitbuf_sdrp;
+#endif
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	u32  len;
+#endif
+
+#ifdef DBG_XMIT_BUF
+	u8 no;
+#endif
+
+};
+
+struct xmit_frame
+{
+	_list	list;
+
+	struct pkt_attrib attrib;
+
+	_pkt *pkt;
+
+	int	frame_tag;
+
+	_adapter *padapter;
+
+	u8	*buf_addr;
+
+	struct xmit_buf *pxmitbuf;
+
+#ifdef CONFIG_SDIO_HCI
+	u8	pg_num;
+	u8	agg_num;
+#endif
+
+#ifdef CONFIG_USB_HCI
+#ifdef CONFIG_USB_TX_AGGREGATION
+	u8	agg_num;
+#endif
+	u8	pkt_offset;
+#ifdef CONFIG_RTL8192D
+	u8	EMPktNum;
+	u16	EMPktLen[5];//The max value by HW
+#endif
+#endif
+#ifdef CONFIG_XMIT_ACK
+	u8 ack_report;
+#endif
+
+	u8 *alloc_addr; /* the actual address this xmitframe allocated */
+	u8 ext_tag; /* 0:data, 1:mgmt */
+
+};
+
+struct tx_servq {
+	_list	tx_pending;
+	_queue	sta_pending;
+	int qcnt;
+};
+
+
+
+struct sta_xmit_priv
+{
+	_lock	lock;
+	sint	option;
+	sint	apsd_setting;	//When bit mask is on, the associated edca queue supports APSD.
+
+
+	//struct tx_servq blk_q[MAX_NUMBLKS];
+	struct tx_servq	be_q;			//priority == 0,3
+	struct tx_servq	bk_q;			//priority == 1,2
+	struct tx_servq	vi_q;			//priority == 4,5
+	struct tx_servq	vo_q;			//priority == 6,7
+	_list 	legacy_dz;
+	_list  apsd;
+
+	u16 txseq_tid[16];
+
+	//uint	sta_tx_bytes;
+	//u64	sta_tx_pkts;
+	//uint	sta_tx_fail;
+
+};
+
+
+struct	hw_txqueue	{
+	volatile sint	head;
+	volatile sint	tail;
+	volatile sint 	free_sz;	//in units of 64 bytes
+	volatile sint      free_cmdsz;
+	volatile sint	 txsz[8];
+	uint	ff_hwaddr;
+	uint	cmd_hwaddr;
+	sint	ac_tag;
+};
+
+
+struct	xmit_priv	{
+
+	_lock	lock;
+
+	_sema	xmit_sema;
+	_sema	terminate_xmitthread_sema;
+
+	//_queue	blk_strms[MAX_NUMBLKS];
+	_queue	be_pending;
+	_queue	bk_pending;
+	_queue	vi_pending;
+	_queue	vo_pending;
+	_queue	bm_pending;
+
+	//_queue	legacy_dz_queue;
+	//_queue	apsd_queue;
+
+	u8 *pallocated_frame_buf;
+	u8 *pxmit_frame_buf;
+	uint free_xmitframe_cnt;
+	_queue	free_xmit_queue;
+
+	//uint mapping_addr;
+	//uint pkt_sz;
+
+	u8 *xframe_ext_alloc_addr;
+	u8 *xframe_ext;
+	uint free_xframe_ext_cnt;
+	_queue free_xframe_ext_queue;
+
+	//struct	hw_txqueue	be_txqueue;
+	//struct	hw_txqueue	bk_txqueue;
+	//struct	hw_txqueue	vi_txqueue;
+	//struct	hw_txqueue	vo_txqueue;
+	//struct	hw_txqueue	bmc_txqueue;
+
+	uint	frag_len;
+
+	_adapter	*adapter;
+
+	u8   vcs_setting;
+	u8	vcs;
+	u8	vcs_type;
+	//u16  rts_thresh;
+
+	u64	tx_bytes;
+	u64	tx_pkts;
+	u64	tx_drop;
+	u64	last_tx_bytes;
+	u64	last_tx_pkts;
+
+	struct hw_xmit *hwxmits;
+	u8	hwxmit_entry;
+
+#ifdef CONFIG_USB_HCI
+	_sema	tx_retevt;//all tx return event;
+	u8		txirp_cnt;//
+
+#ifdef PLATFORM_OS_CE
+	USB_TRANSFER	usb_transfer_write_port;
+//	USB_TRANSFER	usb_transfer_write_mem;
+#endif
+#ifdef PLATFORM_LINUX
+	struct tasklet_struct xmit_tasklet;
+#endif
+#ifdef PLATFORM_FREEBSD
+	struct task xmit_tasklet;
+#endif
+	//per AC pending irp
+	int beq_cnt;
+	int bkq_cnt;
+	int viq_cnt;
+	int voq_cnt;
+
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	// Tx
+	struct rtw_tx_ring	tx_ring[PCI_MAX_TX_QUEUE_COUNT];
+	int	txringcount[PCI_MAX_TX_QUEUE_COUNT];
+#ifdef PLATFORM_LINUX
+	struct tasklet_struct xmit_tasklet;
+#endif
+#endif
+
+	_queue free_xmitbuf_queue;
+	_queue pending_xmitbuf_queue;
+	u8 *pallocated_xmitbuf;
+	u8 *pxmitbuf;
+	uint free_xmitbuf_cnt;
+
+	_queue free_xmit_extbuf_queue;
+	u8 *pallocated_xmit_extbuf;
+	u8 *pxmit_extbuf;
+	uint free_xmit_extbuf_cnt;
+
+	u16	nqos_ssn;
+
+#ifdef CONFIG_XMIT_ACK
+	int	ack_tx;
+	_mutex ack_tx_mutex;
+	struct submit_ctx ack_tx_ops;
+#endif
+	_lock lock_sctx;
+};
+
+extern struct xmit_buf *rtw_alloc_xmitbuf_ext(struct xmit_priv *pxmitpriv);
+extern s32 rtw_free_xmitbuf_ext(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+extern struct xmit_buf *rtw_alloc_xmitbuf(struct xmit_priv *pxmitpriv);
+extern s32 rtw_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+void rtw_count_tx_stats(_adapter *padapter, struct xmit_frame *pxmitframe, int sz);
+extern void rtw_update_protection(_adapter *padapter, u8 *ie, uint ie_len);
+extern s32 rtw_make_wlanhdr(_adapter *padapter, u8 *hdr, struct pkt_attrib *pattrib);
+extern s32 rtw_put_snap(u8 *data, u16 h_proto);
+
+extern struct xmit_frame *rtw_alloc_xmitframe(struct xmit_priv *pxmitpriv);
+struct xmit_frame *rtw_alloc_xmitframe_ext(struct xmit_priv *pxmitpriv);
+struct xmit_frame *rtw_alloc_xmitframe_once(struct xmit_priv *pxmitpriv);
+extern s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitframe);
+extern void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, _queue *pframequeue);
+struct tx_servq *rtw_get_sta_pending(_adapter *padapter, struct sta_info *psta, sint up, u8 *ac);
+extern s32 rtw_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+extern struct xmit_frame* rtw_dequeue_xframe(struct xmit_priv *pxmitpriv, struct hw_xmit *phwxmit_i, sint entry);
+
+extern s32 rtw_xmit_classifier(_adapter *padapter, struct xmit_frame *pxmitframe);
+extern thread_return rtw_xmit_thread(thread_context context);
+extern u32 rtw_calculate_wlan_pkt_size_by_attribue(struct pkt_attrib *pattrib);
+#define rtw_wlan_pkt_size(f) rtw_calculate_wlan_pkt_size_by_attribue(&f->attrib)
+extern s32 rtw_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe);
+#ifdef CONFIG_IEEE80211W
+extern s32 rtw_mgmt_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe);
+#endif //CONFIG_IEEE80211W
+#ifdef CONFIG_TDLS
+s32 rtw_xmit_tdls_coalesce(_adapter *padapter, struct xmit_frame *pxmitframe, u8 action);
+#endif //CONFIG_TDLS
+s32 _rtw_init_hw_txqueue(struct hw_txqueue* phw_txqueue, u8 ac_tag);
+void _rtw_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv);
+
+
+s32 rtw_txframes_pending(_adapter *padapter);
+s32 rtw_txframes_sta_ac_pending(_adapter *padapter, struct pkt_attrib *pattrib);
+void rtw_init_hwxmits(struct hw_xmit *phwxmit, sint entry);
+
+
+s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, _adapter *padapter);
+void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
+
+
+void rtw_alloc_hwxmits(_adapter *padapter);
+void rtw_free_hwxmits(_adapter *padapter);
+
+
+s32 rtw_xmit(_adapter *padapter, _pkt **pkt);
+
+#if defined(CONFIG_AP_MODE) || defined(CONFIG_TDLS)
+sint xmitframe_enqueue_for_sleeping_sta(_adapter *padapter, struct xmit_frame *pxmitframe);
+void stop_sta_xmit(_adapter *padapter, struct sta_info *psta);
+void wakeup_sta_to_xmit(_adapter *padapter, struct sta_info *psta);
+void xmit_delivery_enabled_frames(_adapter *padapter, struct sta_info *psta);
+#endif
+
+u8	qos_acm(u8 acm_mask, u8 priority);
+
+#ifdef CONFIG_XMIT_ACK
+int rtw_ack_tx_wait(struct xmit_priv *pxmitpriv, u32 timeout_ms);
+void rtw_ack_tx_done(struct xmit_priv *pxmitpriv, int status);
+#endif //CONFIG_XMIT_ACK
+
+
+//include after declaring struct xmit_buf, in order to avoid warning
+#include <xmit_osdep.h>
+
+#endif	//_RTL871X_XMIT_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h b/drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h
new file mode 100755
index 0000000000000..4f563b558d786
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h
@@ -0,0 +1,432 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __STA_INFO_H_
+#define __STA_INFO_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+
+#define IBSS_START_MAC_ID	2
+#define NUM_STA 32
+#define NUM_ACL 16
+
+
+//if mode ==0, then the sta is allowed once the addr is hit.
+//if mode ==1, then the sta is rejected once the addr is non-hit.
+struct rtw_wlan_acl_node {
+        _list		        list;
+        u8       addr[ETH_ALEN];
+        u8       valid;
+};
+
+//mode=0, disable
+//mode=1, accept unless in deny list
+//mode=2, deny unless in accept list
+struct wlan_acl_pool {
+	int mode;
+	int num;
+	struct rtw_wlan_acl_node aclnode[NUM_ACL];
+	_queue	acl_node_q;
+};
+
+typedef struct _RSSI_STA{
+	s32	UndecoratedSmoothedPWDB;
+	s32	UndecoratedSmoothedCCK;
+	s32	UndecoratedSmoothedOFDM;
+	u64	PacketMap;
+	u8	ValidBit;
+}RSSI_STA, *PRSSI_STA;
+
+struct	stainfo_stats	{
+
+	u64 rx_mgnt_pkts;
+		u64 rx_beacon_pkts;
+		u64 rx_probereq_pkts;
+		u64 rx_probersp_pkts;
+		u64 rx_probersp_bm_pkts;
+		u64 rx_probersp_uo_pkts;
+	u64 rx_ctrl_pkts;
+	u64 rx_data_pkts;
+
+	u64	last_rx_mgnt_pkts;
+		u64 last_rx_beacon_pkts;
+		u64 last_rx_probereq_pkts;
+		u64 last_rx_probersp_pkts;
+		u64 last_rx_probersp_bm_pkts;
+		u64 last_rx_probersp_uo_pkts;
+	u64	last_rx_ctrl_pkts;
+	u64	last_rx_data_pkts;
+	
+	u64	rx_bytes;
+	u64	rx_drops;
+
+	u64	tx_pkts;
+	u64	tx_bytes;
+	u64  tx_drops;
+
+};
+
+#ifdef CONFIG_TDLS
+struct TDLS_PeerKey {
+	u8 kck[16]; /* TPK-KCK */
+	u8 tk[16]; /* TPK-TK; only CCMP will be used */
+} ;
+#endif //CONFIG_TDLS
+
+struct sta_info {
+
+	_lock	lock;
+	_list	list; //free_sta_queue
+	_list	hash_list; //sta_hash
+	//_list asoc_list; //20061114
+	//_list sleep_list;//sleep_q
+	//_list wakeup_list;//wakeup_q
+	
+	struct sta_xmit_priv sta_xmitpriv;
+	struct sta_recv_priv sta_recvpriv;
+	
+	_queue sleep_q;
+	unsigned int sleepq_len;
+	
+	uint state;
+	uint aid;
+	uint mac_id;
+	uint qos_option;
+	u8	hwaddr[ETH_ALEN];
+
+	uint	ieee8021x_blocked;	//0: allowed, 1:blocked 
+	uint	dot118021XPrivacy; //aes, tkip...
+	union Keytype	dot11tkiptxmickey;
+	union Keytype	dot11tkiprxmickey;
+	union Keytype	dot118021x_UncstKey;	
+	union pn48		dot11txpn;			// PN48 used for Unicast xmit.
+#ifdef CONFIG_IEEE80211W
+	union pn48		dot11wtxpn;			// PN48 used for Unicast mgmt xmit.
+#endif //CONFIG_IEEE80211W
+	union pn48		dot11rxpn;			// PN48 used for Unicast recv.
+
+
+	u8	bssrateset[16];
+	u32	bssratelen;
+	s32  rssi;
+	s32	signal_quality;
+	
+	u8	cts2self;
+	u8	rtsen;
+
+	u8	raid;
+	u8 	init_rate;
+	u32	ra_mask;
+	struct stainfo_stats sta_stats;
+
+#ifdef CONFIG_TDLS
+	u32	tdls_sta_state;
+	u8	dialog;
+	u8	SNonce[32];
+	u8	ANonce[32];
+	u32	TDLS_PeerKey_Lifetime;
+	u16	TPK_count;
+	_timer	TPK_timer;
+	struct TDLS_PeerKey	tpk;
+	_adapter *padapter;
+	u16	stat_code;
+	u8	off_ch;
+	u16	ch_switch_time;
+	u16	ch_switch_timeout;
+	u8	option;
+	_timer	option_timer;
+	_timer	base_ch_timer;
+	_timer	off_ch_timer;
+
+	_timer handshake_timer;
+	_timer alive_timer1;
+	_timer alive_timer2;
+	u8 timer_flag;
+	u8 alive_count;
+#endif //CONFIG_TDLS
+
+	//for A-MPDU TX, ADDBA timeout check	
+	_timer addba_retry_timer;
+	
+	//for A-MPDU Rx reordering buffer control 
+	struct recv_reorder_ctrl recvreorder_ctrl[16];
+
+	//for A-MPDU Tx
+	//unsigned char		ampdu_txen_bitmap;
+	u16	BA_starting_seqctrl[16];
+	
+
+#ifdef CONFIG_80211N_HT
+	struct ht_priv	htpriv;	
+#endif
+	
+	//Notes:	
+	//STA_Mode:
+	//curr_network(mlme_priv/security_priv/qos/ht) + sta_info: (STA & AP) CAP/INFO	
+	//scan_q: AP CAP/INFO
+
+	//AP_Mode:
+	//curr_network(mlme_priv/security_priv/qos/ht) : AP CAP/INFO
+	//sta_info: (AP & STA) CAP/INFO
+		
+#ifdef CONFIG_AP_MODE
+
+	_list asoc_list;
+	_list auth_list;
+	 
+	unsigned int expire_to;
+	unsigned int auth_seq;
+	unsigned int authalg;
+	unsigned char chg_txt[128];
+
+	u16 capability;	
+	int flags;	
+
+	int dot8021xalg;//0:disable, 1:psk, 2:802.1x
+	int wpa_psk;//0:disable, bit(0): WPA, bit(1):WPA2
+	int wpa_group_cipher;
+	int wpa2_group_cipher;
+	int wpa_pairwise_cipher;
+	int wpa2_pairwise_cipher;	
+
+	u8 bpairwise_key_installed;
+
+#ifdef CONFIG_NATIVEAP_MLME
+	u8 wpa_ie[32];
+
+	u8 nonerp_set;
+	u8 no_short_slot_time_set;
+	u8 no_short_preamble_set;
+	u8 no_ht_gf_set;
+	u8 no_ht_set;
+	u8 ht_20mhz_set;
+#endif	// CONFIG_NATIVEAP_MLME
+
+	unsigned int tx_ra_bitmap;
+	u8 qos_info;
+
+	u8 max_sp_len;
+	u8 uapsd_bk;//BIT(0): Delivery enabled, BIT(1): Trigger enabled
+	u8 uapsd_be;
+	u8 uapsd_vi;
+	u8 uapsd_vo;	
+
+	u8 has_legacy_ac;
+	unsigned int sleepq_ac_len;
+
+#ifdef CONFIG_P2P
+	//p2p priv data
+	u8 is_p2p_device;
+	u8 p2p_status_code;
+
+	//p2p client info
+	u8 dev_addr[ETH_ALEN];
+	//u8 iface_addr[ETH_ALEN];//= hwaddr[ETH_ALEN]
+	u8 dev_cap;
+	u16 config_methods;
+	u8 primary_dev_type[8];
+	u8 num_of_secdev_type;
+	u8 secdev_types_list[32];// 32/8 == 4;
+	u16 dev_name_len;
+	u8 dev_name[32];	
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_TX_MCAST2UNI
+	u8 under_exist_checking;
+#endif	// CONFIG_TX_MCAST2UNI
+	
+	u8 keep_alive_trycnt;
+
+#endif	// CONFIG_AP_MODE	
+
+#ifdef CONFIG_IOCTL_CFG80211
+	u8 *passoc_req;
+	u32 assoc_req_len;
+#endif
+
+	//for DM
+	RSSI_STA	 rssi_stat;
+	
+        /* To store the sequence number of received management frame */
+	u16 RxMgmtFrameSeqNum;
+};
+
+#define sta_rx_pkts(sta) \
+	(sta->sta_stats.rx_mgnt_pkts \
+	+ sta->sta_stats.rx_ctrl_pkts \
+	+ sta->sta_stats.rx_data_pkts)
+
+#define sta_last_rx_pkts(sta) \
+	(sta->sta_stats.last_rx_mgnt_pkts \
+	+ sta->sta_stats.last_rx_ctrl_pkts \
+	+ sta->sta_stats.last_rx_data_pkts)
+
+#define sta_rx_data_pkts(sta) \
+	(sta->sta_stats.rx_data_pkts)
+
+#define sta_last_rx_data_pkts(sta) \
+	(sta->sta_stats.last_rx_data_pkts)
+
+#define sta_rx_mgnt_pkts(sta) \
+	(sta->sta_stats.rx_mgnt_pkts)
+
+#define sta_last_rx_mgnt_pkts(sta) \
+	(sta->sta_stats.last_rx_mgnt_pkts)
+
+#define sta_rx_beacon_pkts(sta) \
+	(sta->sta_stats.rx_beacon_pkts)
+
+#define sta_last_rx_beacon_pkts(sta) \
+	(sta->sta_stats.last_rx_beacon_pkts)
+
+#define sta_rx_probereq_pkts(sta) \
+	(sta->sta_stats.rx_probereq_pkts)
+
+#define sta_last_rx_probereq_pkts(sta) \
+	(sta->sta_stats.last_rx_probereq_pkts)
+
+#define sta_rx_probersp_pkts(sta) \
+	(sta->sta_stats.rx_probersp_pkts)
+
+#define sta_last_rx_probersp_pkts(sta) \
+	(sta->sta_stats.last_rx_probersp_pkts)
+
+#define sta_rx_probersp_bm_pkts(sta) \
+	(sta->sta_stats.rx_probersp_bm_pkts)
+
+#define sta_last_rx_probersp_bm_pkts(sta) \
+	(sta->sta_stats.last_rx_probersp_bm_pkts)
+
+#define sta_rx_probersp_uo_pkts(sta) \
+	(sta->sta_stats.rx_probersp_uo_pkts)
+
+#define sta_last_rx_probersp_uo_pkts(sta) \
+	(sta->sta_stats.last_rx_probersp_uo_pkts)
+
+#define sta_update_last_rx_pkts(sta) \
+	do { \
+		sta->sta_stats.last_rx_mgnt_pkts = sta->sta_stats.rx_mgnt_pkts; \
+		sta->sta_stats.last_rx_beacon_pkts = sta->sta_stats.rx_beacon_pkts; \
+		sta->sta_stats.last_rx_probereq_pkts = sta->sta_stats.rx_probereq_pkts; \
+		sta->sta_stats.last_rx_probersp_pkts = sta->sta_stats.rx_probersp_pkts; \
+		sta->sta_stats.last_rx_probersp_bm_pkts = sta->sta_stats.rx_probersp_bm_pkts; \
+		sta->sta_stats.last_rx_probersp_uo_pkts = sta->sta_stats.rx_probersp_uo_pkts; \
+		sta->sta_stats.last_rx_ctrl_pkts = sta->sta_stats.rx_ctrl_pkts; \
+		sta->sta_stats.last_rx_data_pkts = sta->sta_stats.rx_data_pkts; \
+	} while(0)
+
+#define STA_RX_PKTS_ARG(sta) \
+	sta->sta_stats.rx_mgnt_pkts \
+	, sta->sta_stats.rx_ctrl_pkts \
+	, sta->sta_stats.rx_data_pkts
+
+#define STA_LAST_RX_PKTS_ARG(sta) \
+	sta->sta_stats.last_rx_mgnt_pkts \
+	, sta->sta_stats.last_rx_ctrl_pkts \
+	, sta->sta_stats.last_rx_data_pkts
+
+#define STA_RX_PKTS_DIFF_ARG(sta) \
+	sta->sta_stats.rx_mgnt_pkts - sta->sta_stats.last_rx_mgnt_pkts \
+	, sta->sta_stats.rx_ctrl_pkts - sta->sta_stats.last_rx_ctrl_pkts \
+	, sta->sta_stats.rx_data_pkts -sta->sta_stats.last_rx_data_pkts
+
+#define STA_PKTS_FMT "(m:%llu, c:%llu, d:%llu)"
+	
+struct	sta_priv {
+	
+	u8 *pallocated_stainfo_buf;
+	u8 *pstainfo_buf;
+	_queue	free_sta_queue;
+	
+	_lock sta_hash_lock;
+	_list   sta_hash[NUM_STA];
+	int asoc_sta_count;
+	_queue sleep_q;
+	_queue wakeup_q;
+	
+	_adapter *padapter;
+	
+
+#ifdef CONFIG_AP_MODE
+	_list asoc_list;
+	_list auth_list;
+	_lock asoc_list_lock;
+	_lock auth_list_lock;
+	u8 asoc_list_cnt;
+	u8 auth_list_cnt;
+
+	unsigned int auth_to;  //sec, time to expire in authenticating.
+	unsigned int assoc_to; //sec, time to expire before associating.
+	unsigned int expire_to; //sec , time to expire after associated.
+	
+	/* pointers to STA info; based on allocated AID or NULL if AID free
+	 * AID is in the range 1-2007, so sta_aid[0] corresponders to AID 1
+	 * and so on
+	 */
+	struct sta_info *sta_aid[NUM_STA];
+
+	u16 sta_dz_bitmap;//only support 15 stations, staion aid bitmap for sleeping sta.
+	u16 tim_bitmap;//only support 15 stations, aid=0~15 mapping bit0~bit15	
+
+	u16 max_num_sta;
+
+	struct wlan_acl_pool acl_list;
+#endif		
+	
+};
+
+
+__inline static u32 wifi_mac_hash(const u8 *mac)
+{
+        u32 x;
+
+        x = mac[0];
+        x = (x << 2) ^ mac[1];
+        x = (x << 2) ^ mac[2];
+        x = (x << 2) ^ mac[3];
+        x = (x << 2) ^ mac[4];
+        x = (x << 2) ^ mac[5];
+
+        x ^= x >> 8;
+        x  = x & (NUM_STA - 1);
+		
+        return x;
+}
+
+
+extern u32	_rtw_init_sta_priv(struct sta_priv *pstapriv);
+extern u32	_rtw_free_sta_priv(struct sta_priv *pstapriv);
+
+#define stainfo_offset_valid(offset) (offset < NUM_STA && offset >= 0)
+int rtw_stainfo_offset(struct sta_priv *stapriv, struct sta_info *sta);
+struct sta_info *rtw_get_stainfo_by_offset(struct sta_priv *stapriv, int offset);
+
+extern struct sta_info *rtw_alloc_stainfo(struct	sta_priv *pstapriv, u8 *hwaddr);
+extern u32	rtw_free_stainfo(_adapter *padapter , struct sta_info *psta);
+extern void rtw_free_all_stainfo(_adapter *padapter);
+extern struct sta_info *rtw_get_stainfo(struct sta_priv *pstapriv, const u8 *hwaddr);
+extern u32 rtw_init_bcmc_stainfo(_adapter* padapter);
+extern struct sta_info* rtw_get_bcmc_stainfo(_adapter* padapter);
+extern u8 rtw_access_ctrl(_adapter *padapter, u8 *mac_addr);
+
+#endif //_STA_INFO_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h
new file mode 100755
index 0000000000000..d765b82076b9a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h
@@ -0,0 +1,37 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_HAL_H__
+#define __USB_HAL_H__
+
+
+void rtl8192cu_set_hal_ops(_adapter * padapter);
+
+void rtl8192du_set_hal_ops(_adapter * padapter);
+#ifdef CONFIG_INTEL_PROXIM	
+extern _adapter  *rtw_usb_get_sw_pointer(void);
+#endif	//CONFIG_INTEL_PROXIM
+#ifdef CONFIG_WOWLAN
+#ifdef CONFIG_WOWLAN_MANUAL
+extern int rtw_suspend_toshiba(PADAPTER Adapter);
+extern int rtw_resume_toshiba(PADAPTER Adapter);
+#endif // CONFIG_WOWLAN_MANUAL
+#endif //CONFIG_WOWLAN
+#endif //__USB_HAL_H__
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h
new file mode 100755
index 0000000000000..8bbec2d8e39c3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h
@@ -0,0 +1,110 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_OPS_H_
+#define __USB_OPS_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+#define REALTEK_USB_VENQT_READ		0xC0
+#define REALTEK_USB_VENQT_WRITE		0x40
+#define REALTEK_USB_VENQT_CMD_REQ	0x05
+#define REALTEK_USB_VENQT_CMD_IDX	0x00
+
+enum{
+	VENDOR_WRITE = 0x00,
+	VENDOR_READ = 0x01,
+};
+#define ALIGNMENT_UNIT				16
+#define MAX_VENDOR_REQ_CMD_SIZE	254		//8188cu SIE Support
+#define MAX_USB_IO_CTL_SIZE		(MAX_VENDOR_REQ_CMD_SIZE +ALIGNMENT_UNIT)
+
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)) 
+#define rtw_usb_control_msg(dev, pipe, request, requesttype, value, index, data, size, timeout_ms) \
+	usb_control_msg((dev), (pipe), (request), (requesttype), (value), (index), (data), (size), (timeout_ms)) 
+#define rtw_usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout_ms) \
+	usb_bulk_msg((usb_dev), (pipe), (data), (len), (actual_length), (timeout_ms))
+#else
+#define rtw_usb_control_msg(dev, pipe, request, requesttype, value, index, data, size,timeout_ms) \
+	usb_control_msg((dev), (pipe), (request), (requesttype), (value), (index), (data), (size), \
+		((timeout_ms) == 0) ||((timeout_ms)*HZ/1000>0)?((timeout_ms)*HZ/1000):1) 
+#define rtw_usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout_ms) \
+	usb_bulk_msg((usb_dev), (pipe), (data), (len), (actual_length), \
+		((timeout_ms) == 0) ||((timeout_ms)*HZ/1000>0)?((timeout_ms)*HZ/1000):1) 
+#endif
+#include <usb_ops_linux.h>
+#endif //PLATFORM_LINUX
+
+#ifdef CONFIG_RTL8192C
+void rtl8192cu_set_intf_ops(struct _io_ops *pops);
+#define usb_set_intf_ops	rtl8192cu_set_intf_ops
+
+void rtl8192cu_recv_tasklet(void *priv);
+
+void rtl8192cu_xmit_tasklet(void *priv);
+#endif
+
+#ifdef CONFIG_RTL8192D
+void rtl8192du_set_intf_ops(struct _io_ops *pops);
+#define usb_set_intf_ops	rtl8192du_set_intf_ops
+
+#ifndef PLATFORM_FREEBSD
+void rtl8192du_recv_tasklet(void *priv);
+#else	// PLATFORM_FREEBSD
+void rtl8192du_recv_tasklet(void *priv, int npending);
+#ifdef CONFIG_RX_INDICATE_QUEUE
+void rtw_rx_indicate_tasklet(void *priv, int npending);
+#endif	// CONFIG_RX_INDICATE_QUEUE
+#endif	// PLATFORM_FREEBSD
+
+void rtl8192du_xmit_tasklet(void *priv);
+#endif
+
+/*
+* Increase and check if the continual_urb_error of this @param dvobjprive is larger than MAX_CONTINUAL_URB_ERR
+* @return _TRUE:
+* @return _FALSE:
+*/
+static inline int rtw_inc_and_chk_continual_urb_error(struct dvobj_priv *dvobj)
+{
+	int ret = _FALSE;
+	int value;
+	if( (value=ATOMIC_INC_RETURN(&dvobj->continual_urb_error)) > MAX_CONTINUAL_URB_ERR) {
+		DBG_871X("[dvobj:%p][ERROR] continual_urb_error:%d > %d\n", dvobj, value, MAX_CONTINUAL_URB_ERR);
+		ret = _TRUE;
+	} else {
+		//DBG_871X("[dvobj:%p] continual_urb_error:%d\n", dvobj, value);
+	}
+	return ret;
+}
+
+/*
+* Set the continual_urb_error of this @param dvobjprive to 0
+*/
+static inline void rtw_reset_continual_urb_error(struct dvobj_priv *dvobj)
+{
+	ATOMIC_SET(&dvobj->continual_urb_error, 0);	
+}
+
+#endif //__USB_OPS_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h
new file mode 100755
index 0000000000000..d418ba26c924a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h
@@ -0,0 +1,63 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_OPS_LINUX_H__
+#define __USB_OPS_LINUX_H__
+
+#define VENDOR_CMD_MAX_DATA_LEN	254
+
+#define RTW_USB_CONTROL_MSG_TIMEOUT_TEST	10//ms
+#define RTW_USB_CONTROL_MSG_TIMEOUT	500//ms
+
+#if defined(CONFIG_VENDOR_REQ_RETRY) && defined(CONFIG_USB_VENDOR_REQ_MUTEX)
+/* vendor req retry should be in the situation when each vendor req is atomically submitted from others */
+#define MAX_USBCTRL_VENDORREQ_TIMES	10
+#else
+#define MAX_USBCTRL_VENDORREQ_TIMES	1
+#endif
+
+#define RTW_USB_BULKOUT_TIMEOUT	5000//ms
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)) || (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18))
+#define _usbctrl_vendorreq_async_callback(urb, regs)	_usbctrl_vendorreq_async_callback(urb)
+#define usb_bulkout_zero_complete(purb, regs)	usb_bulkout_zero_complete(purb)
+#define usb_write_mem_complete(purb, regs)	usb_write_mem_complete(purb)
+#define usb_write_port_complete(purb, regs)	usb_write_port_complete(purb)
+#define usb_read_port_complete(purb, regs)	usb_read_port_complete(purb)
+#define usb_read_interrupt_complete(purb, regs)	usb_read_interrupt_complete(purb)
+#endif
+
+#ifdef CONFIG_USB_SUPPORT_ASYNC_VDN_REQ
+int usb_async_write8(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+int usb_async_write16(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+int usb_async_write32(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+#endif /* CONFIG_USB_SUPPORT_ASYNC_VDN_REQ */
+
+unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr);
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem);
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem);
+
+void usb_read_port_cancel(struct intf_hdl *pintfhdl);
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem);
+void usb_write_port_cancel(struct intf_hdl *pintfhdl);
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h
new file mode 100755
index 0000000000000..753013dd0a544
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h
@@ -0,0 +1,38 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_OSINTF_H
+#define __USB_OSINTF_H
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <usb_vendor_req.h>
+
+#define USBD_HALTED(Status) ((ULONG)(Status) >> 30 == 3)
+
+
+//uint usb_dvobj_init(_adapter * adapter);
+//void usb_dvobj_deinit(_adapter * adapter);
+
+u8 usbvendorrequest(struct dvobj_priv *pdvobjpriv, RT_USB_BREQUEST brequest, RT_USB_WVALUE wvalue, u8 windex, void* data, u8 datalen, u8 isdirectionin);
+
+
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h
new file mode 100755
index 0000000000000..f33e98258385c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h
@@ -0,0 +1,59 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _USB_VENDOR_REQUEST_H_
+#define _USB_VENDOR_REQUEST_H_
+
+//4	Set/Get Register related wIndex/Data
+#define	RT_USB_RESET_MASK_OFF		0
+#define	RT_USB_RESET_MASK_ON		1
+#define	RT_USB_SLEEP_MASK_OFF		0
+#define	RT_USB_SLEEP_MASK_ON		1
+#define	RT_USB_LDO_ON				1
+#define	RT_USB_LDO_OFF				0
+
+//4	Set/Get SYSCLK related	wValue or Data
+#define	RT_USB_SYSCLK_32KHZ		0
+#define	RT_USB_SYSCLK_40MHZ		1
+#define	RT_USB_SYSCLK_60MHZ		2
+
+
+typedef enum _RT_USB_BREQUEST {
+	RT_USB_SET_REGISTER		= 1,
+	RT_USB_SET_SYSCLK		= 2,
+	RT_USB_GET_SYSCLK		= 3,
+	RT_USB_GET_REGISTER		= 4
+} RT_USB_BREQUEST;
+
+
+typedef enum _RT_USB_WVALUE {
+	RT_USB_RESET_MASK	=	1,
+	RT_USB_SLEEP_MASK	=	2,
+	RT_USB_USB_HRCPWM	=	3,
+	RT_USB_LDO			=	4,
+	RT_USB_BOOT_TYPE	=	5
+} RT_USB_WVALUE;
+
+
+//BOOLEAN usbvendorrequest(PCE_USB_DEVICE	CEdevice, RT_USB_BREQUEST bRequest, RT_USB_WVALUE wValue, UCHAR wIndex, PVOID Data, UCHAR DataLength, BOOLEAN isDirectionIn);
+//BOOLEAN CEusbGetStatusRequest(PCE_USB_DEVICE CEdevice, IN USHORT Op, IN USHORT Index, PVOID Data);
+//BOOLEAN CEusbFeatureRequest(PCE_USB_DEVICE CEdevice, IN USHORT Op, IN USHORT FeatureSelector, IN USHORT Index);
+//BOOLEAN CEusbGetDescriptorRequest(PCE_USB_DEVICE CEdevice, IN short urbLength, IN UCHAR DescriptorType, IN UCHAR Index, IN USHORT LanguageId, IN PVOID  TransferBuffer, IN ULONG TransferBufferLength);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/wifi.h b/drivers/net/wireless/realtek/rtl8192cu/include/wifi.h
new file mode 100755
index 0000000000000..c5a5f2f28fbaf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/wifi.h
@@ -0,0 +1,1248 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _WIFI_H_
+#define _WIFI_H_
+
+#include <rtw_byteorder.h>
+
+#ifdef BIT
+//#error	"BIT define occurred earlier elsewhere!\n"
+#undef BIT
+#endif
+#define BIT(x)	(1 << (x))
+
+
+#define WLAN_ETHHDR_LEN		14
+#define WLAN_ETHADDR_LEN	6
+#define WLAN_IEEE_OUI_LEN	3
+#define WLAN_ADDR_LEN		6
+#define WLAN_CRC_LEN		4
+#define WLAN_BSSID_LEN		6
+#define WLAN_BSS_TS_LEN		8
+#define WLAN_HDR_A3_LEN		24
+#define WLAN_HDR_A4_LEN		30
+#define WLAN_HDR_A3_QOS_LEN	26
+#define WLAN_HDR_A4_QOS_LEN	32
+#define WLAN_SSID_MAXLEN	32
+#define WLAN_DATA_MAXLEN	2312
+
+#define WLAN_A3_PN_OFFSET	24
+#define WLAN_A4_PN_OFFSET	30
+
+#define WLAN_MIN_ETHFRM_LEN	60
+#define WLAN_MAX_ETHFRM_LEN	1514
+#define WLAN_ETHHDR_LEN		14
+
+#define P80211CAPTURE_VERSION	0x80211001
+
+#ifdef GREEN_HILL
+#pragma pack(1)
+#endif
+
+enum WIFI_FRAME_TYPE {
+	WIFI_MGT_TYPE  =	(0),
+	WIFI_CTRL_TYPE =	(BIT(2)),
+	WIFI_DATA_TYPE =	(BIT(3)),
+	WIFI_QOS_DATA_TYPE	= (BIT(7)|BIT(3)),	//!< QoS Data	
+};
+
+enum WIFI_FRAME_SUBTYPE {
+
+    // below is for mgt frame
+    WIFI_ASSOCREQ       = (0 | WIFI_MGT_TYPE),
+    WIFI_ASSOCRSP       = (BIT(4) | WIFI_MGT_TYPE),
+    WIFI_REASSOCREQ     = (BIT(5) | WIFI_MGT_TYPE),
+    WIFI_REASSOCRSP     = (BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_PROBEREQ       = (BIT(6) | WIFI_MGT_TYPE),
+    WIFI_PROBERSP       = (BIT(6) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_BEACON         = (BIT(7) | WIFI_MGT_TYPE),
+    WIFI_ATIM           = (BIT(7) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_DISASSOC       = (BIT(7) | BIT(5) | WIFI_MGT_TYPE),
+    WIFI_AUTH           = (BIT(7) | BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_DEAUTH         = (BIT(7) | BIT(6) | WIFI_MGT_TYPE),
+    WIFI_ACTION         = (BIT(7) | BIT(6) | BIT(4) | WIFI_MGT_TYPE),
+
+    // below is for control frame
+    WIFI_PSPOLL         = (BIT(7) | BIT(5) | WIFI_CTRL_TYPE),
+    WIFI_RTS            = (BIT(7) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
+    WIFI_CTS            = (BIT(7) | BIT(6) | WIFI_CTRL_TYPE),
+    WIFI_ACK            = (BIT(7) | BIT(6) | BIT(4) | WIFI_CTRL_TYPE),
+    WIFI_CFEND          = (BIT(7) | BIT(6) | BIT(5) | WIFI_CTRL_TYPE),
+    WIFI_CFEND_CFACK    = (BIT(7) | BIT(6) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
+
+    // below is for data frame
+    WIFI_DATA           = (0 | WIFI_DATA_TYPE),
+    WIFI_DATA_CFACK     = (BIT(4) | WIFI_DATA_TYPE),
+    WIFI_DATA_CFPOLL    = (BIT(5) | WIFI_DATA_TYPE),
+    WIFI_DATA_CFACKPOLL = (BIT(5) | BIT(4) | WIFI_DATA_TYPE),
+    WIFI_DATA_NULL      = (BIT(6) | WIFI_DATA_TYPE),
+    WIFI_CF_ACK         = (BIT(6) | BIT(4) | WIFI_DATA_TYPE),
+    WIFI_CF_POLL        = (BIT(6) | BIT(5) | WIFI_DATA_TYPE),
+    WIFI_CF_ACKPOLL     = (BIT(6) | BIT(5) | BIT(4) | WIFI_DATA_TYPE),
+    WIFI_QOS_DATA_NULL	= (BIT(6) | WIFI_QOS_DATA_TYPE),
+};
+
+enum WIFI_REASON_CODE	{
+	_RSON_RESERVED_					= 0,
+	_RSON_UNSPECIFIED_				= 1,
+	_RSON_AUTH_NO_LONGER_VALID_		= 2,
+	_RSON_DEAUTH_STA_LEAVING_		= 3,
+	_RSON_INACTIVITY_				= 4,
+	_RSON_UNABLE_HANDLE_			= 5,
+	_RSON_CLS2_						= 6,
+	_RSON_CLS3_						= 7,
+	_RSON_DISAOC_STA_LEAVING_		= 8,
+	_RSON_ASOC_NOT_AUTH_			= 9,
+
+	// WPA reason
+	_RSON_INVALID_IE_				= 13,
+	_RSON_MIC_FAILURE_				= 14,
+	_RSON_4WAY_HNDSHK_TIMEOUT_		= 15,
+	_RSON_GROUP_KEY_UPDATE_TIMEOUT_	= 16,
+	_RSON_DIFF_IE_					= 17,
+	_RSON_MLTCST_CIPHER_NOT_VALID_	= 18,
+	_RSON_UNICST_CIPHER_NOT_VALID_	= 19,
+	_RSON_AKMP_NOT_VALID_			= 20,
+	_RSON_UNSUPPORT_RSNE_VER_		= 21,
+	_RSON_INVALID_RSNE_CAP_			= 22,
+	_RSON_IEEE_802DOT1X_AUTH_FAIL_	= 23,
+
+	//belowing are Realtek definition
+	_RSON_PMK_NOT_AVAILABLE_		= 24,
+	_RSON_TDLS_TEAR_TOOFAR_			= 25,
+	_RSON_TDLS_TEAR_UN_RSN_			= 26,
+};
+
+/* Reason codes (IEEE 802.11-2007, 7.3.1.7, Table 7-22) */
+#if 0
+#define WLAN_REASON_UNSPECIFIED 1
+#define WLAN_REASON_PREV_AUTH_NOT_VALID 2
+#define WLAN_REASON_DEAUTH_LEAVING 3
+#define WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4
+#define WLAN_REASON_DISASSOC_AP_BUSY 5
+#define WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 6
+#define WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA 7
+#define WLAN_REASON_DISASSOC_STA_HAS_LEFT 8
+#define WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9
+#endif
+/* IEEE 802.11h */
+#define WLAN_REASON_PWR_CAPABILITY_NOT_VALID 10
+#define WLAN_REASON_SUPPORTED_CHANNEL_NOT_VALID 11
+#if 0
+/* IEEE 802.11i */
+#define WLAN_REASON_INVALID_IE 13
+#define WLAN_REASON_MICHAEL_MIC_FAILURE 14
+#define WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT 15
+#define WLAN_REASON_GROUP_KEY_UPDATE_TIMEOUT 16
+#define WLAN_REASON_IE_IN_4WAY_DIFFERS 17
+#define WLAN_REASON_GROUP_CIPHER_NOT_VALID 18
+#define WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID 19
+#define WLAN_REASON_AKMP_NOT_VALID 20
+#define WLAN_REASON_UNSUPPORTED_RSN_IE_VERSION 21
+#define WLAN_REASON_INVALID_RSN_IE_CAPAB 22
+#define WLAN_REASON_IEEE_802_1X_AUTH_FAILED 23
+#define WLAN_REASON_CIPHER_SUITE_REJECTED 24
+#endif
+
+enum WIFI_STATUS_CODE {
+	_STATS_SUCCESSFUL_			= 0,
+	_STATS_FAILURE_				= 1,
+	_STATS_CAP_FAIL_			= 10,
+	_STATS_NO_ASOC_				= 11,
+	_STATS_OTHER_				= 12,
+	_STATS_NO_SUPP_ALG_			= 13,
+	_STATS_OUT_OF_AUTH_SEQ_		= 14,
+	_STATS_CHALLENGE_FAIL_		= 15,
+	_STATS_AUTH_TIMEOUT_		= 16,
+	_STATS_UNABLE_HANDLE_STA_	= 17,
+	_STATS_RATE_FAIL_			= 18,
+};
+
+/* Status codes (IEEE 802.11-2007, 7.3.1.9, Table 7-23) */
+#if 0
+#define WLAN_STATUS_SUCCESS 0
+#define WLAN_STATUS_UNSPECIFIED_FAILURE 1
+#define WLAN_STATUS_CAPS_UNSUPPORTED 10
+#define WLAN_STATUS_REASSOC_NO_ASSOC 11
+#define WLAN_STATUS_ASSOC_DENIED_UNSPEC 12
+#define WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG 13
+#define WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION 14
+#define WLAN_STATUS_CHALLENGE_FAIL 15
+#define WLAN_STATUS_AUTH_TIMEOUT 16
+#define WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA 17
+#define WLAN_STATUS_ASSOC_DENIED_RATES 18
+#endif
+//entended 
+/* IEEE 802.11b */
+#define WLAN_STATUS_ASSOC_DENIED_NOSHORT 19
+#define WLAN_STATUS_ASSOC_DENIED_NOPBCC 20
+#define WLAN_STATUS_ASSOC_DENIED_NOAGILITY 21
+/* IEEE 802.11h */
+#define WLAN_STATUS_SPEC_MGMT_REQUIRED 22
+#define WLAN_STATUS_PWR_CAPABILITY_NOT_VALID 23
+#define WLAN_STATUS_SUPPORTED_CHANNEL_NOT_VALID 24
+/* IEEE 802.11g */
+#define WLAN_STATUS_ASSOC_DENIED_NO_SHORT_SLOT_TIME 25
+#define WLAN_STATUS_ASSOC_DENIED_NO_ER_PBCC 26
+#define WLAN_STATUS_ASSOC_DENIED_NO_DSSS_OFDM 27
+/* IEEE 802.11w */
+#define WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY 30
+#define WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION 31
+/* IEEE 802.11i */
+#define WLAN_STATUS_INVALID_IE 40
+#define WLAN_STATUS_GROUP_CIPHER_NOT_VALID 41
+#define WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID 42
+#define WLAN_STATUS_AKMP_NOT_VALID 43
+#define WLAN_STATUS_UNSUPPORTED_RSN_IE_VERSION 44
+#define WLAN_STATUS_INVALID_RSN_IE_CAPAB 45
+#define WLAN_STATUS_CIPHER_REJECTED_PER_POLICY 46
+#define WLAN_STATUS_TS_NOT_CREATED 47
+#define WLAN_STATUS_DIRECT_LINK_NOT_ALLOWED 48
+#define WLAN_STATUS_DEST_STA_NOT_PRESENT 49
+#define WLAN_STATUS_DEST_STA_NOT_QOS_STA 50
+#define WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE 51
+/* IEEE 802.11r */
+#define WLAN_STATUS_INVALID_FT_ACTION_FRAME_COUNT 52
+#define WLAN_STATUS_INVALID_PMKID 53
+#define WLAN_STATUS_INVALID_MDIE 54
+#define WLAN_STATUS_INVALID_FTIE 55
+
+
+enum WIFI_REG_DOMAIN {
+	DOMAIN_FCC		= 1,
+	DOMAIN_IC		= 2,
+	DOMAIN_ETSI		= 3,
+	DOMAIN_SPAIN	= 4,
+	DOMAIN_FRANCE	= 5,
+	DOMAIN_MKK		= 6,
+	DOMAIN_ISRAEL	= 7,
+	DOMAIN_MKK1		= 8,
+	DOMAIN_MKK2		= 9,
+	DOMAIN_MKK3		= 10,
+	DOMAIN_MAX
+};
+
+#define _TO_DS_		BIT(8)
+#define _FROM_DS_	BIT(9)
+#define _MORE_FRAG_	BIT(10)
+#define _RETRY_		BIT(11)
+#define _PWRMGT_	BIT(12)
+#define _MORE_DATA_	BIT(13)
+#define _PRIVACY_	BIT(14)
+#define _ORDER_			BIT(15)
+
+#define SetToDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_TO_DS_); \
+	} while(0)
+
+#define GetToDs(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_TO_DS_)) != 0)
+
+#define ClearToDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_TO_DS_)); \
+	} while(0)
+
+#define SetFrDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_FROM_DS_); \
+	} while(0)
+
+#define GetFrDs(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_FROM_DS_)) != 0)
+
+#define ClearFrDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_FROM_DS_)); \
+	} while(0)
+
+#define get_tofr_ds(pframe)	((GetToDs(pframe) << 1) | GetFrDs(pframe))
+
+
+#define SetMFrag(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_MORE_FRAG_); \
+	} while(0)
+
+#define GetMFrag(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_MORE_FRAG_)) != 0)
+
+#define ClearMFrag(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_MORE_FRAG_)); \
+	} while(0)
+
+#define SetRetry(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_RETRY_); \
+	} while(0)
+
+#define GetRetry(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_RETRY_)) != 0)
+
+#define ClearRetry(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_RETRY_)); \
+	} while(0)
+
+#define SetPwrMgt(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_PWRMGT_); \
+	} while(0)
+
+#define GetPwrMgt(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_PWRMGT_)) != 0)
+
+#define ClearPwrMgt(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_PWRMGT_)); \
+	} while(0)
+
+#define SetMData(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_MORE_DATA_); \
+	} while(0)
+
+#define GetMData(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_MORE_DATA_)) != 0)
+
+#define ClearMData(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_MORE_DATA_)); \
+	} while(0)
+
+#define SetPrivacy(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_PRIVACY_); \
+	} while(0)
+
+#define GetPrivacy(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_PRIVACY_)) != 0)
+
+#define ClearPrivacy(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_PRIVACY_)); \
+	} while(0)
+
+
+#define GetOrder(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_ORDER_)) != 0)
+
+#define GetFrameType(pbuf)	(le16_to_cpu(*(unsigned short *)(pbuf)) & (BIT(3) | BIT(2)))
+
+#define SetFrameType(pbuf,type)	\
+	do { 	\
+		*(unsigned short *)(pbuf) &= __constant_cpu_to_le16(~(BIT(3) | BIT(2))); \
+		*(unsigned short *)(pbuf) |= __constant_cpu_to_le16(type); \
+	} while(0)
+
+#define GetFrameSubType(pbuf)	(cpu_to_le16(*(unsigned short *)(pbuf)) & (BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | BIT(2)))
+
+#define SetFrameSubType(pbuf,type) \
+	do {    \
+		*(unsigned short *)(pbuf) &= cpu_to_le16(~(BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | BIT(2))); \
+		*(unsigned short *)(pbuf) |= cpu_to_le16(type); \
+	} while(0)
+
+#define GetSequence(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) >> 4)
+
+#define GetFragNum(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) & 0x0f)
+
+#define GetTupleCache(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 22)))
+
+#define SetFragNum(pbuf, num) \
+	do {    \
+		*(unsigned short *)((SIZE_PTR)(pbuf) + 22) = \
+			((*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) & le16_to_cpu(~(0x000f))) | \
+			cpu_to_le16(0x0f & (num));     \
+	} while(0)
+
+#define SetSeqNum(pbuf, num) \
+	do {    \
+		*(unsigned short *)((SIZE_PTR)(pbuf) + 22) = \
+			((*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) & le16_to_cpu((unsigned short)~0xfff0)) | \
+			le16_to_cpu((unsigned short)(0xfff0 & (num << 4))); \
+	} while(0)
+
+#define SetDuration(pbuf, dur) \
+	do {    \
+		*(unsigned short *)((SIZE_PTR)(pbuf) + 2) = cpu_to_le16(0xffff & (dur)); \
+	} while(0)
+
+
+#define SetPriority(pbuf, tid)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(tid & 0xf); \
+	} while(0)
+
+#define GetPriority(pbuf)	((le16_to_cpu(*(unsigned short *)(pbuf))) & 0xf)
+
+#define SetEOSP(pbuf, eosp)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16( (eosp & 1) << 4); \
+	} while(0)
+
+#define SetAckpolicy(pbuf, ack)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16( (ack & 3) << 5); \
+	} while(0)
+
+#define GetAckpolicy(pbuf) (((le16_to_cpu(*(unsigned short *)pbuf)) >> 5) & 0x3)
+
+#define GetAMsdu(pbuf) (((le16_to_cpu(*(unsigned short *)pbuf)) >> 7) & 0x1)
+
+#define SetAMsdu(pbuf, amsdu)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16( (amsdu & 1) << 7); \
+	} while(0)	
+
+#define GetAid(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 2)) & 0x3fff)
+
+#define GetTid(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + (((GetToDs(pbuf)<<1)|GetFrDs(pbuf))==3?30:24))) & 0x000f)
+
+#define GetAddr1Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 4))
+
+#define GetAddr2Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 10))
+
+#define GetAddr3Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 16))
+
+#define GetAddr4Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 24))
+
+#define MacAddr_isBcst(addr) \
+( \
+	( (addr[0] == 0xff) && (addr[1] == 0xff) && \
+		(addr[2] == 0xff) && (addr[3] == 0xff) && \
+		(addr[4] == 0xff) && (addr[5] == 0xff) )  ? _TRUE : _FALSE \
+)
+
+__inline static int IS_MCAST(const unsigned char *da)
+{
+	if ((*da) & 0x01)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+
+__inline static unsigned char * get_da(unsigned char *pframe)
+{
+	unsigned char 	*da;
+	unsigned int	to_fr_ds	= (GetToDs(pframe) << 1) | GetFrDs(pframe);
+
+	switch (to_fr_ds) {
+		case 0x00:	// ToDs=0, FromDs=0
+			da = GetAddr1Ptr(pframe);
+			break;
+		case 0x01:	// ToDs=0, FromDs=1
+			da = GetAddr1Ptr(pframe);
+			break;
+		case 0x02:	// ToDs=1, FromDs=0
+			da = GetAddr3Ptr(pframe);
+			break;
+		default:	// ToDs=1, FromDs=1
+			da = GetAddr3Ptr(pframe);
+			break;
+	}
+
+	return da;
+}
+
+
+__inline static unsigned char * get_sa(unsigned char *pframe)
+{
+	unsigned char 	*sa;
+	unsigned int	to_fr_ds	= (GetToDs(pframe) << 1) | GetFrDs(pframe);
+
+	switch (to_fr_ds) {
+		case 0x00:	// ToDs=0, FromDs=0
+			sa = GetAddr2Ptr(pframe);
+			break;
+		case 0x01:	// ToDs=0, FromDs=1
+			sa = GetAddr3Ptr(pframe);
+			break;
+		case 0x02:	// ToDs=1, FromDs=0
+			sa = GetAddr2Ptr(pframe);
+			break;
+		default:	// ToDs=1, FromDs=1
+			sa = GetAddr4Ptr(pframe);
+			break;
+	}
+
+	return sa;
+}
+
+__inline static unsigned char * get_hdr_bssid(unsigned char *pframe)
+{
+	unsigned char 	*sa;
+	unsigned int	to_fr_ds	= (GetToDs(pframe) << 1) | GetFrDs(pframe);
+
+	switch (to_fr_ds) {
+		case 0x00:	// ToDs=0, FromDs=0
+			sa = GetAddr3Ptr(pframe);
+			break;
+		case 0x01:	// ToDs=0, FromDs=1
+			sa = GetAddr2Ptr(pframe);
+			break;
+		case 0x02:	// ToDs=1, FromDs=0
+			sa = GetAddr1Ptr(pframe);
+			break;
+		case 0x03:	// ToDs=1, FromDs=1
+			sa = GetAddr1Ptr(pframe);
+			break;
+		default:	
+			sa =NULL; //???????
+			break;
+	}
+
+	return sa;
+}
+
+
+__inline static int IsFrameTypeCtrl(unsigned char *pframe)
+{
+	if(WIFI_CTRL_TYPE == GetFrameType(pframe))
+		return _TRUE;
+	else
+		return _FALSE;
+}
+/*-----------------------------------------------------------------------------
+			Below is for the security related definition
+------------------------------------------------------------------------------*/
+#define _RESERVED_FRAME_TYPE_	0
+#define _SKB_FRAME_TYPE_		2
+#define _PRE_ALLOCMEM_			1
+#define _PRE_ALLOCHDR_			3
+#define _PRE_ALLOCLLCHDR_		4
+#define _PRE_ALLOCICVHDR_		5
+#define _PRE_ALLOCMICHDR_		6
+
+#define _SIFSTIME_				((priv->pmib->dot11BssType.net_work_type&WIRELESS_11A)?16:10)
+#define _ACKCTSLNG_				14	//14 bytes long, including crclng
+#define _CRCLNG_				4
+
+#define _ASOCREQ_IE_OFFSET_		4	// excluding wlan_hdr
+#define	_ASOCRSP_IE_OFFSET_		6
+#define _REASOCREQ_IE_OFFSET_	10
+#define _REASOCRSP_IE_OFFSET_	6
+#define _PROBEREQ_IE_OFFSET_	0
+#define	_PROBERSP_IE_OFFSET_	12
+#define _AUTH_IE_OFFSET_		6
+#define _DEAUTH_IE_OFFSET_		0
+#define _BEACON_IE_OFFSET_		12
+#define _PUBLIC_ACTION_IE_OFFSET_	8
+
+#define _FIXED_IE_LENGTH_			_BEACON_IE_OFFSET_
+
+#define _SSID_IE_				0
+#define _SUPPORTEDRATES_IE_	1
+#define _DSSET_IE_				3
+#define _TIM_IE_					5
+#define _IBSS_PARA_IE_			6
+#define _COUNTRY_IE_			7
+#define _CHLGETXT_IE_			16
+#define _POW_CAP_IE_			33
+#define _SUPPORTED_CH_IE_		36
+#define _CH_SWTICH_ANNOUNCE_	37	//Secondary Channel Offset
+#define _RSN_IE_2_				48
+#define _SSN_IE_1_					221
+#define _ERPINFO_IE_			42
+#define _EXT_SUPPORTEDRATES_IE_	50
+
+#define _HT_CAPABILITY_IE_			45
+#define _FTIE_						55
+#define _TIMEOUT_ITVL_IE_			56
+#define _SRC_IE_				59
+#define _HT_EXTRA_INFO_IE_			61
+#define _HT_ADD_INFO_IE_			61 //_HT_EXTRA_INFO_IE_
+
+#define	EID_BSSCoexistence			72 // 20/40 BSS Coexistence
+#define	EID_BSSIntolerantChlReport	73
+#define _RIC_Descriptor_IE_			75
+
+#ifdef CONFIG_IEEE80211W
+#define _MME_IE_					76 //802.11w Management MIC element
+#endif //CONFIG_IEEE80211W
+#define _LINK_ID_IE_					101
+#define _CH_SWITCH_TIMING_		104
+#define _PTI_BUFFER_STATUS_		106
+#define _EXT_CAP_IE_				127
+#define _VENDOR_SPECIFIC_IE_		221
+
+#define	_RESERVED47_				47
+
+/* ---------------------------------------------------------------------------
+					Below is the fixed elements...
+-----------------------------------------------------------------------------*/
+#define _AUTH_ALGM_NUM_			2
+#define _AUTH_SEQ_NUM_			2
+#define _BEACON_ITERVAL_		2
+#define _CAPABILITY_			2
+#define _CURRENT_APADDR_		6
+#define _LISTEN_INTERVAL_		2
+#define _RSON_CODE_				2
+#define _ASOC_ID_				2
+#define _STATUS_CODE_			2
+#define _TIMESTAMP_				8
+
+#define AUTH_ODD_TO				0
+#define AUTH_EVEN_TO			1
+
+#define WLAN_ETHCONV_ENCAP		1
+#define WLAN_ETHCONV_RFC1042	2
+#define WLAN_ETHCONV_8021h		3
+
+#define cap_ESS BIT(0)
+#define cap_IBSS BIT(1)
+#define cap_CFPollable BIT(2)
+#define cap_CFRequest BIT(3)
+#define cap_Privacy BIT(4)
+#define cap_ShortPremble BIT(5)
+#define cap_PBCC	BIT(6)
+#define cap_ChAgility	BIT(7)
+#define cap_SpecMgmt	BIT(8)
+#define cap_QoS	BIT(9)
+#define cap_ShortSlot	BIT(10)
+
+/*-----------------------------------------------------------------------------
+				Below is the definition for 802.11i / 802.1x
+------------------------------------------------------------------------------*/
+#define _IEEE8021X_MGT_			1		// WPA
+#define _IEEE8021X_PSK_			2		// WPA with pre-shared key
+
+/*
+#define _NO_PRIVACY_			0
+#define _WEP_40_PRIVACY_		1
+#define _TKIP_PRIVACY_			2
+#define _WRAP_PRIVACY_			3
+#define _CCMP_PRIVACY_			4
+#define _WEP_104_PRIVACY_		5
+#define _WEP_WPA_MIXED_PRIVACY_ 6	// WEP + WPA
+*/
+
+#ifdef CONFIG_IEEE80211W
+#define _MME_IE_LENGTH_  18
+#endif //CONFIG_IEEE80211W				
+/*-----------------------------------------------------------------------------
+				Below is the definition for WMM
+------------------------------------------------------------------------------*/
+#define _WMM_IE_Length_				7  // for WMM STA
+#define _WMM_Para_Element_Length_		24
+
+
+/*-----------------------------------------------------------------------------
+				Below is the definition for 802.11n 
+------------------------------------------------------------------------------*/
+
+/* block-ack parameters */
+#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+#define RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+
+//#ifdef CONFIG_80211N_HT
+
+#define SetOrderBit(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_ORDER_); \
+	} while(0)
+
+#define GetOrderBit(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_ORDER_)) != 0)
+
+
+/**
+ * struct rtw_ieee80211_bar - HT Block Ack Request
+ *
+ * This structure refers to "HT BlockAckReq" as
+ * described in 802.11n draft section 7.2.1.7.1
+ */
+ #if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8712FW)
+struct rtw_ieee80211_bar {
+	unsigned short frame_control;
+	unsigned short duration;
+	unsigned char ra[6];
+	unsigned char ta[6];
+	unsigned short control;
+	unsigned short start_seq_num;
+} __attribute__((packed));
+ #endif
+
+/* 802.11 BAR control masks */
+#define IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL     0x0000
+#define IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA  0x0004
+
+
+ #if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8712FW) || defined(PLATFORM_FREEBSD)
+
+
+
+ /**
+ * struct rtw_ieee80211_ht_cap - HT capabilities
+ *
+ * This structure refers to "HT capabilities element" as
+ * described in 802.11n draft section 7.3.2.52
+ */
+ 
+struct rtw_ieee80211_ht_cap {
+	unsigned short 	cap_info;
+	unsigned char 	ampdu_params_info;
+	unsigned char 	supp_mcs_set[16];
+	unsigned short 	extended_ht_cap_info;
+	unsigned int		tx_BF_cap_info;
+	unsigned char	       antenna_selection_info;
+} __attribute__ ((packed));
+
+/**
+ * struct rtw_ieee80211_ht_cap - HT additional information
+ *
+ * This structure refers to "HT information element" as
+ * described in 802.11n draft section 7.3.2.53
+ */
+struct ieee80211_ht_addt_info {
+	unsigned char 	control_chan;
+	unsigned char		ht_param;
+	unsigned short	operation_mode;
+	unsigned short	stbc_param;
+	unsigned char		basic_set[16];
+} __attribute__ ((packed));
+
+
+struct HT_caps_element
+{
+	union
+	{ 
+		struct 
+		{ 	
+			unsigned short	HT_caps_info;
+			unsigned char	AMPDU_para;
+			unsigned char	MCS_rate[16];
+			unsigned short	HT_ext_caps;
+			unsigned int	Beamforming_caps;
+			unsigned char	ASEL_caps;
+		} HT_cap_element;
+		unsigned char HT_cap[26];
+	}u;
+} __attribute__ ((packed));
+
+struct HT_info_element
+{
+	unsigned char	primary_channel;
+	unsigned char	infos[5];
+	unsigned char	MCS_rate[16];
+}  __attribute__ ((packed));
+
+struct AC_param
+{
+	unsigned char		ACI_AIFSN;
+	unsigned char		CW;
+	unsigned short	TXOP_limit;
+}  __attribute__ ((packed));
+
+struct WMM_para_element
+{
+	unsigned char		QoS_info;
+	unsigned char		reserved;
+	struct AC_param	ac_param[4];
+}  __attribute__ ((packed));
+
+struct ADDBA_request
+{
+	unsigned char		dialog_token;
+	unsigned short	BA_para_set;
+	unsigned short	BA_timeout_value;
+	unsigned short	BA_starting_seqctrl;
+}  __attribute__ ((packed));
+
+
+
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct rtw_ieee80211_ht_cap {
+	unsigned short 	cap_info;
+	unsigned char 	ampdu_params_info;
+	unsigned char 	supp_mcs_set[16];
+	unsigned short 	extended_ht_cap_info;
+	unsigned int		tx_BF_cap_info;
+	unsigned char	       antenna_selection_info;
+};
+
+
+struct ieee80211_ht_addt_info {
+	unsigned char 	control_chan;
+	unsigned char		ht_param;
+	unsigned short	operation_mode;
+	unsigned short	stbc_param;
+	unsigned char		basic_set[16];
+};
+
+struct HT_caps_element
+{
+	union
+	{ 
+		struct 
+		{ 	
+			unsigned short	HT_caps_info;
+			unsigned char	AMPDU_para;
+			unsigned char	MCS_rate[16];
+			unsigned short	HT_ext_caps;
+			unsigned int	Beamforming_caps;
+			unsigned char	ASEL_caps;
+		} HT_cap_element;
+		unsigned char HT_cap[26];
+	};
+};
+
+struct HT_info_element
+{
+	unsigned char	primary_channel;
+	unsigned char	infos[5];
+	unsigned char	MCS_rate[16];
+};
+
+struct AC_param
+{
+	unsigned char		ACI_AIFSN;
+	unsigned char		CW;
+	unsigned short	TXOP_limit;
+};
+
+struct WMM_para_element
+{
+	unsigned char		QoS_info;
+	unsigned char		reserved;
+	struct AC_param	ac_param[4];
+};
+
+struct ADDBA_request
+{
+	unsigned char		dialog_token;
+	unsigned short	BA_para_set;
+	unsigned short	BA_timeout_value;
+	unsigned short	BA_starting_seqctrl;
+};
+
+
+#pragma pack()
+
+#endif
+
+
+/* 802.11n HT capabilities masks */
+#define IEEE80211_HT_CAP_SUP_WIDTH		0x0002
+#define IEEE80211_HT_CAP_SM_PS			0x000C
+#define IEEE80211_HT_CAP_GRN_FLD		0x0010
+#define IEEE80211_HT_CAP_SGI_20			0x0020
+#define IEEE80211_HT_CAP_SGI_40			0x0040
+#define IEEE80211_HT_CAP_TX_STBC			0x0080
+#define IEEE80211_HT_CAP_RX_STBC		0x0300
+#define IEEE80211_HT_CAP_DELAY_BA		0x0400
+#define IEEE80211_HT_CAP_MAX_AMSDU		0x0800
+#define IEEE80211_HT_CAP_DSSSCCK40		0x1000
+/* 802.11n HT capability AMPDU settings */
+#define IEEE80211_HT_CAP_AMPDU_FACTOR		0x03
+#define IEEE80211_HT_CAP_AMPDU_DENSITY		0x1C
+/* 802.11n HT capability MSC set */
+#define IEEE80211_SUPP_MCS_SET_UEQM		4
+#define IEEE80211_HT_CAP_MAX_STREAMS		4
+#define IEEE80211_SUPP_MCS_SET_LEN		10
+/* maximum streams the spec allows */
+#define IEEE80211_HT_CAP_MCS_TX_DEFINED		0x01
+#define IEEE80211_HT_CAP_MCS_TX_RX_DIFF		0x02
+#define IEEE80211_HT_CAP_MCS_TX_STREAMS		0x0C
+#define IEEE80211_HT_CAP_MCS_TX_UEQM		0x10
+/* 802.11n HT IE masks */
+#define IEEE80211_HT_IE_CHA_SEC_OFFSET		0x03
+#define IEEE80211_HT_IE_CHA_SEC_NONE	 	0x00
+#define IEEE80211_HT_IE_CHA_SEC_ABOVE 		0x01
+#define IEEE80211_HT_IE_CHA_SEC_BELOW 		0x03
+#define IEEE80211_HT_IE_CHA_WIDTH		0x04
+#define IEEE80211_HT_IE_HT_PROTECTION		0x0003
+#define IEEE80211_HT_IE_NON_GF_STA_PRSNT	0x0004
+#define IEEE80211_HT_IE_NON_HT_STA_PRSNT	0x0010
+
+/* block-ack parameters */
+#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+#define RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+
+/*
+ * A-PMDU buffer sizes
+ * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
+ */
+#define IEEE80211_MIN_AMPDU_BUF 0x8
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,19,0))
+#define IEEE80211_MAX_AMPDU_BUF 0x40
+#endif
+
+
+/* Spatial Multiplexing Power Save Modes */
+#define WLAN_HT_CAP_SM_PS_STATIC		0
+#define WLAN_HT_CAP_SM_PS_DYNAMIC	1
+#define WLAN_HT_CAP_SM_PS_INVALID	2
+#define WLAN_HT_CAP_SM_PS_DISABLED	3
+
+
+#define OP_MODE_PURE                    0
+#define OP_MODE_MAY_BE_LEGACY_STAS      1
+#define OP_MODE_20MHZ_HT_STA_ASSOCED    2
+#define OP_MODE_MIXED                   3
+
+#define HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK	((u8) BIT(0) | BIT(1))
+#define HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE		((u8) BIT(0))
+#define HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW		((u8) BIT(0) | BIT(1))
+#define HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH		((u8) BIT(2))
+#define HT_INFO_HT_PARAM_RIFS_MODE			((u8) BIT(3))
+#define HT_INFO_HT_PARAM_CTRL_ACCESS_ONLY		((u8) BIT(4))
+#define HT_INFO_HT_PARAM_SRV_INTERVAL_GRANULARITY	((u8) BIT(5))
+
+#define HT_INFO_OPERATION_MODE_OP_MODE_MASK	\
+		((u16) (0x0001 | 0x0002))
+#define HT_INFO_OPERATION_MODE_OP_MODE_OFFSET		0
+#define HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT	((u8) BIT(2))
+#define HT_INFO_OPERATION_MODE_TRANSMIT_BURST_LIMIT	((u8) BIT(3))
+#define HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT	((u8) BIT(4))
+
+#define HT_INFO_STBC_PARAM_DUAL_BEACON			((u16) BIT(6))
+#define HT_INFO_STBC_PARAM_DUAL_STBC_PROTECT		((u16) BIT(7))
+#define HT_INFO_STBC_PARAM_SECONDARY_BCN		((u16) BIT(8))
+#define HT_INFO_STBC_PARAM_LSIG_TXOP_PROTECT_ALLOWED	((u16) BIT(9))
+#define HT_INFO_STBC_PARAM_PCO_ACTIVE			((u16) BIT(10))
+#define HT_INFO_STBC_PARAM_PCO_PHASE			((u16) BIT(11))
+
+
+
+//#endif
+
+//	===============WPS Section===============
+//	For WPSv1.0
+#define WPSOUI							0x0050f204
+//	WPS attribute ID
+#define WPS_ATTR_VER1					0x104A
+#define WPS_ATTR_SIMPLE_CONF_STATE	0x1044
+#define WPS_ATTR_RESP_TYPE			0x103B
+#define WPS_ATTR_UUID_E				0x1047
+#define WPS_ATTR_MANUFACTURER		0x1021
+#define WPS_ATTR_MODEL_NAME			0x1023
+#define WPS_ATTR_MODEL_NUMBER		0x1024
+#define WPS_ATTR_SERIAL_NUMBER		0x1042
+#define WPS_ATTR_PRIMARY_DEV_TYPE	0x1054
+#define WPS_ATTR_SEC_DEV_TYPE_LIST	0x1055
+#define WPS_ATTR_DEVICE_NAME			0x1011
+#define WPS_ATTR_CONF_METHOD			0x1008
+#define WPS_ATTR_RF_BANDS				0x103C
+#define WPS_ATTR_DEVICE_PWID			0x1012
+#define WPS_ATTR_REQUEST_TYPE			0x103A
+#define WPS_ATTR_ASSOCIATION_STATE	0x1002
+#define WPS_ATTR_CONFIG_ERROR			0x1009
+#define WPS_ATTR_VENDOR_EXT			0x1049
+#define WPS_ATTR_SELECTED_REGISTRAR	0x1041
+
+//	Value of WPS attribute "WPS_ATTR_DEVICE_NAME
+#define WPS_MAX_DEVICE_NAME_LEN		32
+
+//	Value of WPS Request Type Attribute
+#define WPS_REQ_TYPE_ENROLLEE_INFO_ONLY			0x00
+#define WPS_REQ_TYPE_ENROLLEE_OPEN_8021X		0x01
+#define WPS_REQ_TYPE_REGISTRAR					0x02
+#define WPS_REQ_TYPE_WLAN_MANAGER_REGISTRAR	0x03
+
+//	Value of WPS Response Type Attribute
+#define WPS_RESPONSE_TYPE_INFO_ONLY	0x00
+#define WPS_RESPONSE_TYPE_8021X		0x01
+#define WPS_RESPONSE_TYPE_REGISTRAR	0x02
+#define WPS_RESPONSE_TYPE_AP			0x03
+
+//	Value of WPS WiFi Simple Configuration State Attribute
+#define WPS_WSC_STATE_NOT_CONFIG	0x01
+#define WPS_WSC_STATE_CONFIG			0x02
+
+//	Value of WPS Version Attribute
+#define WPS_VERSION_1					0x10
+
+//	Value of WPS Configuration Method Attribute
+#define WPS_CONFIG_METHOD_FLASH		0x0001
+#define WPS_CONFIG_METHOD_ETHERNET	0x0002
+#define WPS_CONFIG_METHOD_LABEL		0x0004
+#define WPS_CONFIG_METHOD_DISPLAY	0x0008
+#define WPS_CONFIG_METHOD_E_NFC		0x0010
+#define WPS_CONFIG_METHOD_I_NFC		0x0020
+#define WPS_CONFIG_METHOD_NFC		0x0040
+#define WPS_CONFIG_METHOD_PBC		0x0080
+#define WPS_CONFIG_METHOD_KEYPAD	0x0100
+#define WPS_CONFIG_METHOD_VPBC		0x0280
+#define WPS_CONFIG_METHOD_PPBC		0x0480
+#define WPS_CONFIG_METHOD_VDISPLAY	0x2008
+#define WPS_CONFIG_METHOD_PDISPLAY	0x4008
+
+//	Value of Category ID of WPS Primary Device Type Attribute
+#define WPS_PDT_CID_DISPLAYS			0x0007
+#define WPS_PDT_CID_MULIT_MEDIA		0x0008
+#define WPS_PDT_CID_RTK_WIDI			WPS_PDT_CID_MULIT_MEDIA
+
+//	Value of Sub Category ID of WPS Primary Device Type Attribute
+#define WPS_PDT_SCID_MEDIA_SERVER	0x0005
+#define WPS_PDT_SCID_RTK_DMP			WPS_PDT_SCID_MEDIA_SERVER
+
+//	Value of Device Password ID
+#define WPS_DPID_PIN					0x0000
+#define WPS_DPID_USER_SPEC			0x0001
+#define WPS_DPID_MACHINE_SPEC			0x0002
+#define WPS_DPID_REKEY					0x0003
+#define WPS_DPID_PBC					0x0004
+#define WPS_DPID_REGISTRAR_SPEC		0x0005
+
+//	Value of WPS RF Bands Attribute
+#define WPS_RF_BANDS_2_4_GHZ		0x01
+#define WPS_RF_BANDS_5_GHZ		0x02
+
+//	Value of WPS Association State Attribute
+#define WPS_ASSOC_STATE_NOT_ASSOCIATED			0x00
+#define WPS_ASSOC_STATE_CONNECTION_SUCCESS		0x01
+#define WPS_ASSOC_STATE_CONFIGURATION_FAILURE	0x02
+#define WPS_ASSOC_STATE_ASSOCIATION_FAILURE		0x03
+#define WPS_ASSOC_STATE_IP_FAILURE				0x04
+
+//	=====================P2P Section=====================
+//	For P2P
+#define	P2POUI							0x506F9A09
+
+//	P2P Attribute ID
+#define	P2P_ATTR_STATUS					0x00
+#define	P2P_ATTR_MINOR_REASON_CODE		0x01
+#define	P2P_ATTR_CAPABILITY				0x02
+#define	P2P_ATTR_DEVICE_ID				0x03
+#define	P2P_ATTR_GO_INTENT				0x04
+#define	P2P_ATTR_CONF_TIMEOUT			0x05
+#define	P2P_ATTR_LISTEN_CH				0x06
+#define	P2P_ATTR_GROUP_BSSID				0x07
+#define	P2P_ATTR_EX_LISTEN_TIMING		0x08
+#define	P2P_ATTR_INTENTED_IF_ADDR		0x09
+#define	P2P_ATTR_MANAGEABILITY			0x0A
+#define	P2P_ATTR_CH_LIST					0x0B
+#define	P2P_ATTR_NOA						0x0C
+#define	P2P_ATTR_DEVICE_INFO				0x0D
+#define	P2P_ATTR_GROUP_INFO				0x0E
+#define	P2P_ATTR_GROUP_ID					0x0F
+#define	P2P_ATTR_INTERFACE				0x10
+#define	P2P_ATTR_OPERATING_CH			0x11
+#define	P2P_ATTR_INVITATION_FLAGS		0x12
+
+//	Value of Status Attribute
+#define	P2P_STATUS_SUCCESS						0x00
+#define	P2P_STATUS_FAIL_INFO_UNAVAILABLE		0x01
+#define	P2P_STATUS_FAIL_INCOMPATIBLE_PARAM		0x02
+#define	P2P_STATUS_FAIL_LIMIT_REACHED			0x03
+#define	P2P_STATUS_FAIL_INVALID_PARAM			0x04
+#define	P2P_STATUS_FAIL_REQUEST_UNABLE			0x05
+#define	P2P_STATUS_FAIL_PREVOUS_PROTO_ERR		0x06
+#define	P2P_STATUS_FAIL_NO_COMMON_CH			0x07
+#define	P2P_STATUS_FAIL_UNKNOWN_P2PGROUP		0x08
+#define	P2P_STATUS_FAIL_BOTH_GOINTENT_15		0x09
+#define	P2P_STATUS_FAIL_INCOMPATIBLE_PROVSION	0x0A
+#define	P2P_STATUS_FAIL_USER_REJECT				0x0B
+
+//	Value of Inviation Flags Attribute
+#define	P2P_INVITATION_FLAGS_PERSISTENT			BIT(0)
+
+#define	DMP_P2P_DEVCAP_SUPPORT	(P2P_DEVCAP_SERVICE_DISCOVERY | \
+									P2P_DEVCAP_CLIENT_DISCOVERABILITY | \
+									P2P_DEVCAP_CONCURRENT_OPERATION | \
+									P2P_DEVCAP_INVITATION_PROC)
+
+#define	DMP_P2P_GRPCAP_SUPPORT	(P2P_GRPCAP_INTRABSS)
+
+//	Value of Device Capability Bitmap
+#define	P2P_DEVCAP_SERVICE_DISCOVERY		BIT(0)
+#define	P2P_DEVCAP_CLIENT_DISCOVERABILITY	BIT(1)
+#define	P2P_DEVCAP_CONCURRENT_OPERATION	BIT(2)
+#define	P2P_DEVCAP_INFRA_MANAGED			BIT(3)
+#define	P2P_DEVCAP_DEVICE_LIMIT				BIT(4)
+#define	P2P_DEVCAP_INVITATION_PROC			BIT(5)
+
+//	Value of Group Capability Bitmap
+#define	P2P_GRPCAP_GO							BIT(0)
+#define	P2P_GRPCAP_PERSISTENT_GROUP			BIT(1)
+#define	P2P_GRPCAP_GROUP_LIMIT				BIT(2)
+#define	P2P_GRPCAP_INTRABSS					BIT(3)
+#define	P2P_GRPCAP_CROSS_CONN				BIT(4)
+#define	P2P_GRPCAP_PERSISTENT_RECONN		BIT(5)
+#define	P2P_GRPCAP_GROUP_FORMATION			BIT(6)
+
+//	P2P Public Action Frame ( Management Frame )
+#define	P2P_PUB_ACTION_ACTION				0x09
+
+//	P2P Public Action Frame Type
+#define	P2P_GO_NEGO_REQ						0
+#define	P2P_GO_NEGO_RESP						1
+#define	P2P_GO_NEGO_CONF						2
+#define	P2P_INVIT_REQ							3
+#define	P2P_INVIT_RESP							4
+#define	P2P_DEVDISC_REQ						5
+#define	P2P_DEVDISC_RESP						6
+#define	P2P_PROVISION_DISC_REQ				7
+#define	P2P_PROVISION_DISC_RESP				8
+
+//	P2P Action Frame Type
+#define	P2P_NOTICE_OF_ABSENCE	0
+#define	P2P_PRESENCE_REQUEST		1
+#define	P2P_PRESENCE_RESPONSE	2
+#define	P2P_GO_DISC_REQUEST		3
+
+
+#define	P2P_MAX_PERSISTENT_GROUP_NUM		10
+
+#define	P2P_PROVISIONING_SCAN_CNT			3
+
+#define	P2P_WILDCARD_SSID_LEN				7
+
+#define	P2P_FINDPHASE_EX_NONE				0	// default value, used when: (1)p2p disabed or (2)p2p enabled but only do 1 scan phase
+#define	P2P_FINDPHASE_EX_FULL				1	// used when p2p enabled and want to do 1 scan phase and P2P_FINDPHASE_EX_MAX-1 find phase
+#define	P2P_FINDPHASE_EX_SOCIAL_FIRST		(P2P_FINDPHASE_EX_FULL+1) 
+#define	P2P_FINDPHASE_EX_MAX					4
+#define	P2P_FINDPHASE_EX_SOCIAL_LAST		P2P_FINDPHASE_EX_MAX
+
+#define	P2P_PROVISION_TIMEOUT				5000	//	5 seconds timeout for sending the provision discovery request
+#define	P2P_CONCURRENT_PROVISION_TIMEOUT	3000	//	3 seconds timeout for sending the provision discovery request under concurrent mode
+#define	P2P_GO_NEGO_TIMEOUT					5000	//	5 seconds timeout for receiving the group negotation response
+#define	P2P_CONCURRENT_GO_NEGO_TIMEOUT		3000	//	3 seconds timeout for sending the negotiation request under concurrent mode
+#define	P2P_TX_PRESCAN_TIMEOUT				100		//	100ms
+#define	P2P_INVITE_TIMEOUT					5000	//	5 seconds timeout for sending the invitation request
+#define	P2P_CONCURRENT_INVITE_TIMEOUT		3000	//	3 seconds timeout for sending the invitation request under concurrent mode
+#define	P2P_RESET_SCAN_CH						15000	//	15 seconds timeout to reset the scan channel ( based on channel plan )
+#define	P2P_MAX_INTENT						15
+
+#define	P2P_MAX_NOA_NUM						2
+
+//	WPS Configuration Method
+#define	WPS_CM_NONE							0x0000
+#define	WPS_CM_LABEL							0x0004
+#define	WPS_CM_DISPLYA						0x0008
+#define	WPS_CM_EXTERNAL_NFC_TOKEN			0x0010
+#define	WPS_CM_INTEGRATED_NFC_TOKEN		0x0020
+#define	WPS_CM_NFC_INTERFACE					0x0040
+#define	WPS_CM_PUSH_BUTTON					0x0080
+#define	WPS_CM_KEYPAD						0x0100
+#define	WPS_CM_SW_PUHS_BUTTON				0x0280
+#define	WPS_CM_HW_PUHS_BUTTON				0x0480
+#define	WPS_CM_SW_DISPLAY_PIN				0x2008
+#define	WPS_CM_LCD_DISPLAY_PIN				0x4008
+
+enum P2P_ROLE {
+	P2P_ROLE_DISABLE = 0,
+	P2P_ROLE_DEVICE = 1,
+	P2P_ROLE_CLIENT = 2,
+	P2P_ROLE_GO = 3	
+};
+
+enum P2P_STATE {
+	P2P_STATE_NONE = 0,							//	P2P disable
+	P2P_STATE_IDLE = 1,								//	P2P had enabled and do nothing
+	P2P_STATE_LISTEN = 2,							//	In pure listen state
+	P2P_STATE_SCAN = 3,							//	In scan phase
+	P2P_STATE_FIND_PHASE_LISTEN = 4,				//	In the listen state of find phase
+	P2P_STATE_FIND_PHASE_SEARCH = 5,				//	In the search state of find phase
+	P2P_STATE_TX_PROVISION_DIS_REQ = 6,			//	In P2P provisioning discovery
+	P2P_STATE_RX_PROVISION_DIS_RSP = 7,
+	P2P_STATE_RX_PROVISION_DIS_REQ = 8,	
+	P2P_STATE_GONEGO_ING = 9,						//	Doing the group owner negoitation handshake
+	P2P_STATE_GONEGO_OK = 10,						//	finish the group negoitation handshake with success
+	P2P_STATE_GONEGO_FAIL = 11,					//	finish the group negoitation handshake with failure
+	P2P_STATE_RECV_INVITE_REQ_MATCH = 12,		//	receiving the P2P Inviation request and match with the profile.
+	P2P_STATE_PROVISIONING_ING = 13,				//	Doing the P2P WPS
+	P2P_STATE_PROVISIONING_DONE = 14,			//	Finish the P2P WPS
+	P2P_STATE_TX_INVITE_REQ = 15,					//	Transmit the P2P Invitation request
+	P2P_STATE_RX_INVITE_RESP_OK = 16,				//	Receiving the P2P Invitation response with sucess
+	P2P_STATE_RECV_INVITE_REQ_DISMATCH = 17,	//	receiving the P2P Inviation request and dismatch with the profile.
+	P2P_STATE_RECV_INVITE_REQ_GO = 18,			//	receiving the P2P Inviation request and this wifi is GO.
+	P2P_STATE_RECV_INVITE_REQ_JOIN = 19,			//	receiving the P2P Inviation request to join an existing P2P Group.
+	P2P_STATE_RX_INVITE_RESP_FAIL = 20,			//	recveing the P2P Inviation response with failure
+	P2P_STATE_RX_INFOR_NOREADY = 21, 			// receiving p2p negoitation response with information is not available
+	P2P_STATE_TX_INFOR_NOREADY = 22, 			// sending p2p negoitation response with information is not available
+};
+
+enum P2P_WPSINFO {
+	P2P_NO_WPSINFO						= 0,
+	P2P_GOT_WPSINFO_PEER_DISPLAY_PIN	= 1,
+	P2P_GOT_WPSINFO_SELF_DISPLAY_PIN	= 2,
+	P2P_GOT_WPSINFO_PBC					= 3,
+};
+
+#define	P2P_PRIVATE_IOCTL_SET_LEN		64
+
+enum P2P_PROTO_WK_ID
+{
+	P2P_FIND_PHASE_WK = 0,
+	P2P_RESTORE_STATE_WK = 1,
+	P2P_PRE_TX_PROVDISC_PROCESS_WK = 2,
+	P2P_PRE_TX_NEGOREQ_PROCESS_WK = 3,	
+	P2P_PRE_TX_INVITEREQ_PROCESS_WK = 4,
+	P2P_AP_P2P_CH_SWITCH_PROCESS_WK =5,
+	P2P_RO_CH_WK = 6,
+};
+
+#ifdef CONFIG_P2P_PS
+enum P2P_PS_STATE
+{
+	P2P_PS_DISABLE = 0,
+	P2P_PS_ENABLE = 1,
+	P2P_PS_SCAN = 2,
+	P2P_PS_SCAN_DONE = 3,
+	P2P_PS_ALLSTASLEEP = 4, // for P2P GO
+};
+
+enum P2P_PS_MODE
+{
+	P2P_PS_NONE = 0,
+	P2P_PS_CTWINDOW = 1,
+	P2P_PS_NOA	 = 2,
+	P2P_PS_MIX = 3, // CTWindow and NoA
+};
+#endif // CONFIG_P2P_PS
+
+//	=====================WFD Section=====================
+//	For Wi-Fi Display
+#define	WFD_ATTR_DEVICE_INFO			0x00
+#define	WFD_ATTR_ASSOC_BSSID			0x01
+#define	WFD_ATTR_COUPLED_SINK_INFO	0x06
+#define	WFD_ATTR_LOCAL_IP_ADDR		0x08
+#define	WFD_ATTR_SESSION_INFO		0x09
+#define	WFD_ATTR_ALTER_MAC			0x0a
+
+//	For WFD Device Information Attribute
+#define	WFD_DEVINFO_SOURCE					0x0000
+#define	WFD_DEVINFO_PSINK					0x0001
+#define	WFD_DEVINFO_SSINK					0x0002
+#define	WFD_DEVINFO_DUAL 					0x0003
+
+#define	WFD_DEVINFO_SESSION_AVAIL			0x0010
+#define	WFD_DEVINFO_WSD						0x0040
+#define	WFD_DEVINFO_PC_TDLS					0x0080
+#define	WFD_DEVINFO_HDCP_SUPPORT			0x0100
+
+
+#ifdef  CONFIG_TX_MCAST2UNI
+#define IP_MCAST_MAC(mac)		((mac[0]==0x01)&&(mac[1]==0x00)&&(mac[2]==0x5e))
+#define ICMPV6_MCAST_MAC(mac)	((mac[0]==0x33)&&(mac[1]==0x33)&&(mac[2]!=0xff))
+#endif	// CONFIG_TX_MCAST2UNI
+
+
+
+#endif // _WIFI_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h b/drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h
new file mode 100755
index 0000000000000..1cf93dca46a1f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h
@@ -0,0 +1,703 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __WLAN_BSSDEF_H__
+#define __WLAN_BSSDEF_H__
+
+
+#define MAX_IE_SZ	768
+
+
+#ifdef PLATFORM_LINUX
+
+#define NDIS_802_11_LENGTH_SSID         32
+#define NDIS_802_11_LENGTH_RATES        8
+#define NDIS_802_11_LENGTH_RATES_EX     16
+
+typedef unsigned char   NDIS_802_11_MAC_ADDRESS[6];
+typedef long    		NDIS_802_11_RSSI;           // in dBm
+typedef unsigned char   NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];        // Set of 8 data rates
+typedef unsigned char   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];  // Set of 16 data rates
+
+
+typedef  ULONG  NDIS_802_11_KEY_INDEX;
+typedef unsigned long long NDIS_802_11_KEY_RSC;
+
+
+typedef struct _NDIS_802_11_SSID
+{
+  ULONG  SsidLength;
+  UCHAR  Ssid[32];
+} NDIS_802_11_SSID, *PNDIS_802_11_SSID;
+
+typedef enum _NDIS_802_11_NETWORK_TYPE
+{
+    Ndis802_11FH,
+    Ndis802_11DS,
+    Ndis802_11OFDM5,
+    Ndis802_11OFDM24,
+    Ndis802_11NetworkTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_NETWORK_TYPE, *PNDIS_802_11_NETWORK_TYPE;
+
+typedef struct _NDIS_802_11_CONFIGURATION_FH
+{
+    ULONG           Length;             // Length of structure
+    ULONG           HopPattern;         // As defined by 802.11, MSB set
+    ULONG           HopSet;             // to one if non-802.11
+    ULONG           DwellTime;          // units are Kusec
+} NDIS_802_11_CONFIGURATION_FH, *PNDIS_802_11_CONFIGURATION_FH;
+ 
+
+/*
+	FW will only save the channel number in DSConfig.
+	ODI Handler will convert the channel number to freq. number.	
+*/
+typedef struct _NDIS_802_11_CONFIGURATION
+{
+    ULONG           Length;             // Length of structure
+    ULONG           BeaconPeriod;       // units are Kusec
+    ULONG           ATIMWindow;         // units are Kusec
+    ULONG           DSConfig;           // Frequency, units are kHz
+    NDIS_802_11_CONFIGURATION_FH    FHConfig;
+} NDIS_802_11_CONFIGURATION, *PNDIS_802_11_CONFIGURATION;
+
+
+
+typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE
+{
+    Ndis802_11IBSS,
+    Ndis802_11Infrastructure,
+    Ndis802_11AutoUnknown,
+    Ndis802_11InfrastructureMax,     // Not a real value, defined as upper bound
+    Ndis802_11APMode
+} NDIS_802_11_NETWORK_INFRASTRUCTURE, *PNDIS_802_11_NETWORK_INFRASTRUCTURE;
+
+
+
+
+
+typedef struct _NDIS_802_11_FIXED_IEs
+{
+  UCHAR  Timestamp[8];
+  USHORT  BeaconInterval;
+  USHORT  Capabilities;
+} NDIS_802_11_FIXED_IEs, *PNDIS_802_11_FIXED_IEs;
+
+
+
+typedef struct _NDIS_802_11_VARIABLE_IEs
+{
+  UCHAR  ElementID;
+  UCHAR  Length;
+  UCHAR  data[1];
+} NDIS_802_11_VARIABLE_IEs, *PNDIS_802_11_VARIABLE_IEs;
+
+
+
+/*
+
+
+
+Length is the 4 bytes multiples of the sume of
+	sizeof (NDIS_802_11_MAC_ADDRESS) + 2 + sizeof (NDIS_802_11_SSID) + sizeof (ULONG)
++   sizeof (NDIS_802_11_RSSI) + sizeof (NDIS_802_11_NETWORK_TYPE) + sizeof (NDIS_802_11_CONFIGURATION)
++   sizeof (NDIS_802_11_RATES_EX) + IELength
+
+Except the IELength, all other fields are fixed length. Therefore, we can define a marco to present the
+partial sum.
+
+*/
+#if 0
+typedef struct _NDIS_WLAN_BSSID_EX
+{
+  ULONG  Length;
+  NDIS_802_11_MAC_ADDRESS  MacAddress;
+  UCHAR  Reserved[2];//[0]: IS beacon frame, [1]:optimum_antenna=>For antenna diversity;
+  NDIS_802_11_SSID  Ssid;
+  ULONG  Privacy;
+  NDIS_802_11_RSSI  Rssi;
+  NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+  NDIS_802_11_CONFIGURATION  Configuration;
+  NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+  NDIS_802_11_RATES_EX  SupportedRates;
+  ULONG  IELength;
+  UCHAR  IEs[MAX_IE_SZ];	//(timestamp, beacon interval, and capability information)
+} NDIS_WLAN_BSSID_EX, *PNDIS_WLAN_BSSID_EX;
+
+
+typedef struct _NDIS_802_11_BSSID_LIST_EX
+{
+  ULONG  NumberOfItems;
+  NDIS_WLAN_BSSID_EX  Bssid[1];
+} NDIS_802_11_BSSID_LIST_EX, *PNDIS_802_11_BSSID_LIST_EX;
+#endif
+
+typedef enum _NDIS_802_11_AUTHENTICATION_MODE
+{
+    Ndis802_11AuthModeOpen,
+    Ndis802_11AuthModeShared,
+    Ndis802_11AuthModeAutoSwitch,
+    Ndis802_11AuthModeWPA,
+    Ndis802_11AuthModeWPAPSK,
+    Ndis802_11AuthModeWPANone,
+    Ndis802_11AuthModeMax               // Not a real mode, defined as upper bound
+} NDIS_802_11_AUTHENTICATION_MODE, *PNDIS_802_11_AUTHENTICATION_MODE;
+
+typedef enum _NDIS_802_11_WEP_STATUS
+{
+    Ndis802_11WEPEnabled,
+    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+    Ndis802_11WEPDisabled,
+    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+    Ndis802_11WEPKeyAbsent,
+    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+    Ndis802_11WEPNotSupported,
+    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+    Ndis802_11Encryption2Enabled,
+    Ndis802_11Encryption2KeyAbsent,
+    Ndis802_11Encryption3Enabled,
+    Ndis802_11Encryption3KeyAbsent
+} NDIS_802_11_WEP_STATUS, *PNDIS_802_11_WEP_STATUS,
+  NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
+
+
+#define NDIS_802_11_AI_REQFI_CAPABILITIES      1
+#define NDIS_802_11_AI_REQFI_LISTENINTERVAL    2
+#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS  4
+
+#define NDIS_802_11_AI_RESFI_CAPABILITIES      1
+#define NDIS_802_11_AI_RESFI_STATUSCODE        2
+#define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
+
+typedef struct _NDIS_802_11_AI_REQFI
+{
+    USHORT Capabilities;
+    USHORT ListenInterval;
+    NDIS_802_11_MAC_ADDRESS  CurrentAPAddress;
+} NDIS_802_11_AI_REQFI, *PNDIS_802_11_AI_REQFI;
+
+typedef struct _NDIS_802_11_AI_RESFI
+{
+    USHORT Capabilities;
+    USHORT StatusCode;
+    USHORT AssociationId;
+} NDIS_802_11_AI_RESFI, *PNDIS_802_11_AI_RESFI;
+
+typedef struct _NDIS_802_11_ASSOCIATION_INFORMATION
+{
+    ULONG                   Length;
+    USHORT                  AvailableRequestFixedIEs;
+    NDIS_802_11_AI_REQFI    RequestFixedIEs;
+    ULONG                   RequestIELength;
+    ULONG                   OffsetRequestIEs;
+    USHORT                  AvailableResponseFixedIEs;
+    NDIS_802_11_AI_RESFI    ResponseFixedIEs;
+    ULONG                   ResponseIELength;
+    ULONG                   OffsetResponseIEs;
+} NDIS_802_11_ASSOCIATION_INFORMATION, *PNDIS_802_11_ASSOCIATION_INFORMATION;
+
+typedef enum _NDIS_802_11_RELOAD_DEFAULTS
+{
+   Ndis802_11ReloadWEPKeys
+} NDIS_802_11_RELOAD_DEFAULTS, *PNDIS_802_11_RELOAD_DEFAULTS;
+
+
+// Key mapping keys require a BSSID
+typedef struct _NDIS_802_11_KEY
+{
+    ULONG           Length;             // Length of this structure
+    ULONG           KeyIndex;           
+    ULONG           KeyLength;          // length of key in bytes
+    NDIS_802_11_MAC_ADDRESS BSSID;
+    NDIS_802_11_KEY_RSC KeyRSC;
+    UCHAR           KeyMaterial[32];     // variable length depending on above field
+} NDIS_802_11_KEY, *PNDIS_802_11_KEY;
+
+typedef struct _NDIS_802_11_REMOVE_KEY
+{
+    ULONG                   Length;        // Length of this structure
+    ULONG                   KeyIndex;           
+    NDIS_802_11_MAC_ADDRESS BSSID;      
+} NDIS_802_11_REMOVE_KEY, *PNDIS_802_11_REMOVE_KEY;
+
+typedef struct _NDIS_802_11_WEP
+{
+    ULONG     Length;        // Length of this structure
+    ULONG     KeyIndex;      // 0 is the per-client key, 1-N are the global keys
+    ULONG     KeyLength;     // length of key in bytes
+    UCHAR     KeyMaterial[16];// variable length depending on above field
+} NDIS_802_11_WEP, *PNDIS_802_11_WEP;
+
+typedef struct _NDIS_802_11_AUTHENTICATION_REQUEST
+{
+    ULONG Length;            // Length of structure
+    NDIS_802_11_MAC_ADDRESS Bssid;
+    ULONG Flags;
+} NDIS_802_11_AUTHENTICATION_REQUEST, *PNDIS_802_11_AUTHENTICATION_REQUEST;
+
+typedef enum _NDIS_802_11_STATUS_TYPE
+{
+	Ndis802_11StatusType_Authentication,
+	Ndis802_11StatusType_MediaStreamMode,
+	Ndis802_11StatusType_PMKID_CandidateList,		
+	Ndis802_11StatusTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_STATUS_TYPE, *PNDIS_802_11_STATUS_TYPE;
+
+typedef struct _NDIS_802_11_STATUS_INDICATION
+{
+    NDIS_802_11_STATUS_TYPE StatusType;
+} NDIS_802_11_STATUS_INDICATION, *PNDIS_802_11_STATUS_INDICATION;
+
+// mask for authentication/integrity fields
+#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
+#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
+#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
+#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
+#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
+
+// MIC check time, 60 seconds.
+#define MIC_CHECK_TIME	60000000
+
+typedef struct _NDIS_802_11_AUTHENTICATION_EVENT
+{
+    NDIS_802_11_STATUS_INDICATION       Status;
+    NDIS_802_11_AUTHENTICATION_REQUEST  Request[1];
+} NDIS_802_11_AUTHENTICATION_EVENT, *PNDIS_802_11_AUTHENTICATION_EVENT;
+        
+typedef struct _NDIS_802_11_TEST
+{
+    ULONG Length;
+    ULONG Type;
+    union
+    {
+        NDIS_802_11_AUTHENTICATION_EVENT AuthenticationEvent;
+        NDIS_802_11_RSSI RssiTrigger;
+    }tt;
+} NDIS_802_11_TEST, *PNDIS_802_11_TEST;
+
+
+#endif //end of #ifdef PLATFORM_LINUX
+
+#ifdef PLATFORM_FREEBSD
+
+#define NDIS_802_11_LENGTH_SSID         32
+#define NDIS_802_11_LENGTH_RATES        8
+#define NDIS_802_11_LENGTH_RATES_EX     16
+
+typedef unsigned char   NDIS_802_11_MAC_ADDRESS[6];
+typedef long    		NDIS_802_11_RSSI;           // in dBm
+typedef unsigned char   NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];        // Set of 8 data rates
+typedef unsigned char   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];  // Set of 16 data rates
+
+
+typedef  ULONG  NDIS_802_11_KEY_INDEX;
+typedef unsigned long long NDIS_802_11_KEY_RSC;
+
+
+typedef struct _NDIS_802_11_SSID
+{
+  ULONG  SsidLength;
+  UCHAR  Ssid[32];
+} NDIS_802_11_SSID, *PNDIS_802_11_SSID;
+
+typedef enum _NDIS_802_11_NETWORK_TYPE
+{
+    Ndis802_11FH,
+    Ndis802_11DS,
+    Ndis802_11OFDM5,
+    Ndis802_11OFDM24,
+    Ndis802_11NetworkTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_NETWORK_TYPE, *PNDIS_802_11_NETWORK_TYPE;
+
+typedef struct _NDIS_802_11_CONFIGURATION_FH
+{
+    ULONG           Length;             // Length of structure
+    ULONG           HopPattern;         // As defined by 802.11, MSB set
+    ULONG           HopSet;             // to one if non-802.11
+    ULONG           DwellTime;          // units are Kusec
+} NDIS_802_11_CONFIGURATION_FH, *PNDIS_802_11_CONFIGURATION_FH;
+ 
+
+/*
+	FW will only save the channel number in DSConfig.
+	ODI Handler will convert the channel number to freq. number.	
+*/
+typedef struct _NDIS_802_11_CONFIGURATION
+{
+    ULONG           Length;             // Length of structure
+    ULONG           BeaconPeriod;       // units are Kusec
+    ULONG           ATIMWindow;         // units are Kusec
+    ULONG           DSConfig;           // Frequency, units are kHz
+    NDIS_802_11_CONFIGURATION_FH    FHConfig;
+} NDIS_802_11_CONFIGURATION, *PNDIS_802_11_CONFIGURATION;
+
+
+
+typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE
+{
+    Ndis802_11IBSS,
+    Ndis802_11Infrastructure,
+    Ndis802_11AutoUnknown,
+    Ndis802_11InfrastructureMax,     // Not a real value, defined as upper bound
+    Ndis802_11APMode
+} NDIS_802_11_NETWORK_INFRASTRUCTURE, *PNDIS_802_11_NETWORK_INFRASTRUCTURE;
+
+
+
+
+
+typedef struct _NDIS_802_11_FIXED_IEs
+{
+  UCHAR  Timestamp[8];
+  USHORT  BeaconInterval;
+  USHORT  Capabilities;
+} NDIS_802_11_FIXED_IEs, *PNDIS_802_11_FIXED_IEs;
+
+
+
+typedef struct _NDIS_802_11_VARIABLE_IEs
+{
+  UCHAR  ElementID;
+  UCHAR  Length;
+  UCHAR  data[1];
+} NDIS_802_11_VARIABLE_IEs, *PNDIS_802_11_VARIABLE_IEs;
+
+
+
+/*
+
+
+
+Length is the 4 bytes multiples of the sume of
+	sizeof (NDIS_802_11_MAC_ADDRESS) + 2 + sizeof (NDIS_802_11_SSID) + sizeof (ULONG)
++   sizeof (NDIS_802_11_RSSI) + sizeof (NDIS_802_11_NETWORK_TYPE) + sizeof (NDIS_802_11_CONFIGURATION)
++   sizeof (NDIS_802_11_RATES_EX) + IELength
+
+Except the IELength, all other fields are fixed length. Therefore, we can define a marco to present the
+partial sum.
+
+*/
+#if 0
+typedef struct _NDIS_WLAN_BSSID_EX
+{
+  ULONG  Length;
+  NDIS_802_11_MAC_ADDRESS  MacAddress;
+  UCHAR  Reserved[2];//[0]: IS beacon frame, [1]:optimum_antenna=>For antenna diversity;
+  NDIS_802_11_SSID  Ssid;
+  ULONG  Privacy;
+  NDIS_802_11_RSSI  Rssi;
+  NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+  NDIS_802_11_CONFIGURATION  Configuration;
+  NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+  NDIS_802_11_RATES_EX  SupportedRates;
+  ULONG  IELength;
+  UCHAR  IEs[MAX_IE_SZ];	//(timestamp, beacon interval, and capability information)
+} NDIS_WLAN_BSSID_EX, *PNDIS_WLAN_BSSID_EX;
+
+
+typedef struct _NDIS_802_11_BSSID_LIST_EX
+{
+  ULONG  NumberOfItems;
+  NDIS_WLAN_BSSID_EX  Bssid[1];
+} NDIS_802_11_BSSID_LIST_EX, *PNDIS_802_11_BSSID_LIST_EX;
+#endif
+
+typedef enum _NDIS_802_11_AUTHENTICATION_MODE
+{
+    Ndis802_11AuthModeOpen,
+    Ndis802_11AuthModeShared,
+    Ndis802_11AuthModeAutoSwitch,
+    Ndis802_11AuthModeWPA,
+    Ndis802_11AuthModeWPAPSK,
+    Ndis802_11AuthModeWPANone,
+    Ndis802_11AuthModeMax               // Not a real mode, defined as upper bound
+} NDIS_802_11_AUTHENTICATION_MODE, *PNDIS_802_11_AUTHENTICATION_MODE;
+
+typedef enum _NDIS_802_11_WEP_STATUS
+{
+    Ndis802_11WEPEnabled,
+    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+    Ndis802_11WEPDisabled,
+    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+    Ndis802_11WEPKeyAbsent,
+    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+    Ndis802_11WEPNotSupported,
+    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+    Ndis802_11Encryption2Enabled,
+    Ndis802_11Encryption2KeyAbsent,
+    Ndis802_11Encryption3Enabled,
+    Ndis802_11Encryption3KeyAbsent
+} NDIS_802_11_WEP_STATUS, *PNDIS_802_11_WEP_STATUS,
+  NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
+
+
+#define NDIS_802_11_AI_REQFI_CAPABILITIES      1
+#define NDIS_802_11_AI_REQFI_LISTENINTERVAL    2
+#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS  4
+
+#define NDIS_802_11_AI_RESFI_CAPABILITIES      1
+#define NDIS_802_11_AI_RESFI_STATUSCODE        2
+#define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
+
+typedef struct _NDIS_802_11_AI_REQFI
+{
+    USHORT Capabilities;
+    USHORT ListenInterval;
+    NDIS_802_11_MAC_ADDRESS  CurrentAPAddress;
+} NDIS_802_11_AI_REQFI, *PNDIS_802_11_AI_REQFI;
+
+typedef struct _NDIS_802_11_AI_RESFI
+{
+    USHORT Capabilities;
+    USHORT StatusCode;
+    USHORT AssociationId;
+} NDIS_802_11_AI_RESFI, *PNDIS_802_11_AI_RESFI;
+
+typedef struct _NDIS_802_11_ASSOCIATION_INFORMATION
+{
+    ULONG                   Length;
+    USHORT                  AvailableRequestFixedIEs;
+    NDIS_802_11_AI_REQFI    RequestFixedIEs;
+    ULONG                   RequestIELength;
+    ULONG                   OffsetRequestIEs;
+    USHORT                  AvailableResponseFixedIEs;
+    NDIS_802_11_AI_RESFI    ResponseFixedIEs;
+    ULONG                   ResponseIELength;
+    ULONG                   OffsetResponseIEs;
+} NDIS_802_11_ASSOCIATION_INFORMATION, *PNDIS_802_11_ASSOCIATION_INFORMATION;
+
+typedef enum _NDIS_802_11_RELOAD_DEFAULTS
+{
+   Ndis802_11ReloadWEPKeys
+} NDIS_802_11_RELOAD_DEFAULTS, *PNDIS_802_11_RELOAD_DEFAULTS;
+
+
+// Key mapping keys require a BSSID
+typedef struct _NDIS_802_11_KEY
+{
+    ULONG           Length;             // Length of this structure
+    ULONG           KeyIndex;           
+    ULONG           KeyLength;          // length of key in bytes
+    NDIS_802_11_MAC_ADDRESS BSSID;
+    NDIS_802_11_KEY_RSC KeyRSC;
+    UCHAR           KeyMaterial[32];     // variable length depending on above field
+} NDIS_802_11_KEY, *PNDIS_802_11_KEY;
+
+typedef struct _NDIS_802_11_REMOVE_KEY
+{
+    ULONG                   Length;        // Length of this structure
+    ULONG                   KeyIndex;           
+    NDIS_802_11_MAC_ADDRESS BSSID;      
+} NDIS_802_11_REMOVE_KEY, *PNDIS_802_11_REMOVE_KEY;
+
+typedef struct _NDIS_802_11_WEP
+{
+    ULONG     Length;        // Length of this structure
+    ULONG     KeyIndex;      // 0 is the per-client key, 1-N are the global keys
+    ULONG     KeyLength;     // length of key in bytes
+    UCHAR     KeyMaterial[16];// variable length depending on above field
+} NDIS_802_11_WEP, *PNDIS_802_11_WEP;
+
+typedef struct _NDIS_802_11_AUTHENTICATION_REQUEST
+{
+    ULONG Length;            // Length of structure
+    NDIS_802_11_MAC_ADDRESS Bssid;
+    ULONG Flags;
+} NDIS_802_11_AUTHENTICATION_REQUEST, *PNDIS_802_11_AUTHENTICATION_REQUEST;
+
+typedef enum _NDIS_802_11_STATUS_TYPE
+{
+	Ndis802_11StatusType_Authentication,
+	Ndis802_11StatusType_MediaStreamMode,
+	Ndis802_11StatusType_PMKID_CandidateList,		
+	Ndis802_11StatusTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_STATUS_TYPE, *PNDIS_802_11_STATUS_TYPE;
+
+typedef struct _NDIS_802_11_STATUS_INDICATION
+{
+    NDIS_802_11_STATUS_TYPE StatusType;
+} NDIS_802_11_STATUS_INDICATION, *PNDIS_802_11_STATUS_INDICATION;
+
+// mask for authentication/integrity fields
+#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
+#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
+#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
+#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
+#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
+
+// MIC check time, 60 seconds.
+#define MIC_CHECK_TIME	60000000
+
+typedef struct _NDIS_802_11_AUTHENTICATION_EVENT
+{
+    NDIS_802_11_STATUS_INDICATION       Status;
+    NDIS_802_11_AUTHENTICATION_REQUEST  Request[1];
+} NDIS_802_11_AUTHENTICATION_EVENT, *PNDIS_802_11_AUTHENTICATION_EVENT;
+        
+typedef struct _NDIS_802_11_TEST
+{
+    ULONG Length;
+    ULONG Type;
+    union
+    {
+        NDIS_802_11_AUTHENTICATION_EVENT AuthenticationEvent;
+        NDIS_802_11_RSSI RssiTrigger;
+    }tt;
+} NDIS_802_11_TEST, *PNDIS_802_11_TEST;
+
+
+#endif //PLATFORM_FREEBSD
+#ifndef Ndis802_11APMode
+#define Ndis802_11APMode (Ndis802_11InfrastructureMax+1)
+#endif
+
+typedef struct _WLAN_PHY_INFO
+{
+	u8	SignalStrength;//(in percentage)
+  	u8	SignalQuality;//(in percentage)
+  	u8	Optimum_antenna;  //for Antenna diversity
+  	u8  	Reserved_0;
+}WLAN_PHY_INFO,*PWLAN_PHY_INFO;
+
+/* temporally add #pragma pack for structure alignment issue of
+*   WLAN_BSSID_EX and get_WLAN_BSSID_EX_sz()
+*/
+#ifdef PLATFORM_WINDOWS
+#pragma pack(push)
+#pragma pack(1)
+#endif
+typedef struct _WLAN_BSSID_EX
+{
+  ULONG  Length;
+  NDIS_802_11_MAC_ADDRESS  MacAddress;
+  UCHAR  Reserved[2];//[0]: IS beacon frame
+  NDIS_802_11_SSID  Ssid;
+  ULONG  Privacy;
+  NDIS_802_11_RSSI  Rssi;//(in dBM,raw data ,get from PHY)
+  NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+  NDIS_802_11_CONFIGURATION  Configuration;
+  NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+  NDIS_802_11_RATES_EX  SupportedRates;
+  WLAN_PHY_INFO	PhyInfo;
+  ULONG  IELength;
+  UCHAR  IEs[MAX_IE_SZ];	//(timestamp, beacon interval, and capability information)
+} 
+#ifndef PLATFORM_WINDOWS
+__attribute__((packed))
+#endif
+WLAN_BSSID_EX, *PWLAN_BSSID_EX;
+#ifdef PLATFORM_WINDOWS
+#pragma pack(pop)
+#endif
+
+__inline  static uint get_WLAN_BSSID_EX_sz(WLAN_BSSID_EX *bss)
+{
+	return (sizeof(WLAN_BSSID_EX) - MAX_IE_SZ + bss->IELength);
+}
+
+struct	wlan_network {
+	_list	list;	
+	int	network_type;	//refer to ieee80211.h for WIRELESS_11A/B/G
+	int	fixed;			// set to fixed when not to be removed as site-surveying
+	unsigned long	last_scanned; //timestamp for the network
+	int	aid;			//will only be valid when a BSS is joinned.
+	int	join_res;
+	WLAN_BSSID_EX	network; //must be the last item
+#ifdef PLATFORM_WINDOWS	
+	unsigned char  iebuf[MAX_IE_SZ];
+#endif
+
+};
+
+enum VRTL_CARRIER_SENSE
+{
+    DISABLE_VCS,	
+    ENABLE_VCS,	
+    AUTO_VCS
+};
+
+enum VCS_TYPE
+{
+    NONE_VCS,	
+    RTS_CTS,
+    CTS_TO_SELF 
+};
+
+
+
+
+#define PWR_CAM 0
+#define PWR_MINPS 1
+#define PWR_MAXPS 2
+#define PWR_UAPSD 3
+#define PWR_VOIP 4
+
+
+enum UAPSD_MAX_SP
+{
+	NO_LIMIT,
+       TWO_MSDU,
+       FOUR_MSDU,
+       SIX_MSDU
+};
+
+
+//john
+#define NUM_PRE_AUTH_KEY 16
+#define NUM_PMKID_CACHE NUM_PRE_AUTH_KEY
+
+/*
+* 	WPA2
+*/
+
+#ifndef PLATFORM_OS_CE
+typedef struct _PMKID_CANDIDATE {
+    NDIS_802_11_MAC_ADDRESS BSSID;
+    ULONG Flags;
+} PMKID_CANDIDATE, *PPMKID_CANDIDATE;
+
+typedef struct _NDIS_802_11_PMKID_CANDIDATE_LIST
+{
+    ULONG Version;       // Version of the structure
+    ULONG NumCandidates; // No. of pmkid candidates
+    PMKID_CANDIDATE CandidateList[1];
+} NDIS_802_11_PMKID_CANDIDATE_LIST, *PNDIS_802_11_PMKID_CANDIDATE_LIST;
+
+
+typedef struct _NDIS_802_11_AUTHENTICATION_ENCRYPTION
+{
+	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
+	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
+	
+} NDIS_802_11_AUTHENTICATION_ENCRYPTION, *PNDIS_802_11_AUTHENTICATION_ENCRYPTION;
+
+typedef struct _NDIS_802_11_CAPABILITY 
+{
+	ULONG  Length;
+	ULONG  Version;
+	ULONG  NoOfPMKIDs;
+	ULONG  NoOfAuthEncryptPairsSupported;
+	NDIS_802_11_AUTHENTICATION_ENCRYPTION AuthenticationEncryptionSupported[1];
+	
+} NDIS_802_11_CAPABILITY, *PNDIS_802_11_CAPABILITY;
+#endif
+
+
+#endif //#ifndef WLAN_BSSDEF_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h
new file mode 100755
index 0000000000000..e5848ece14d86
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h
@@ -0,0 +1,95 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __XMIT_OSDEP_H_
+#define __XMIT_OSDEP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+struct pkt_file {
+	_pkt *pkt;
+	SIZE_T pkt_len;	 //the remainder length of the open_file
+	_buffer *cur_buffer;
+	u8 *buf_start;
+	u8 *cur_addr;
+	SIZE_T buf_len;
+};
+
+#ifdef PLATFORM_WINDOWS
+
+#ifdef PLATFORM_OS_XP
+#ifdef CONFIG_USB_HCI
+#include <usb.h>
+#include <usbdlib.h>
+#include <usbioctl.h>
+#endif
+#endif
+
+#define NR_XMITFRAME     128
+
+#define ETH_ALEN	6
+
+extern NDIS_STATUS rtw_xmit_entry(
+IN _nic_hdl		cnxt,
+IN NDIS_PACKET		*pkt,
+IN UINT				flags
+);
+
+#endif
+
+#ifdef PLATFORM_FREEBSD
+#define NR_XMITFRAME	256
+extern int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev);
+extern void rtw_xmit_entry_wrap (struct ifnet * pifp);
+#endif //PLATFORM_FREEBSD
+
+#ifdef PLATFORM_LINUX
+
+#define NR_XMITFRAME	256
+
+struct xmit_priv;
+struct pkt_attrib;
+struct sta_xmit_priv;
+struct xmit_frame;
+struct xmit_buf;
+
+extern int _rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev);
+extern int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev);
+
+#endif
+
+void rtw_os_xmit_schedule(_adapter *padapter);
+
+int rtw_os_xmit_resource_alloc(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 alloc_sz);
+void rtw_os_xmit_resource_free(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 free_sz);
+
+extern void rtw_set_tx_chksum_offload(_pkt *pkt, struct pkt_attrib *pattrib);
+
+extern uint rtw_remainder_len(struct pkt_file *pfile);
+extern void _rtw_open_pktfile(_pkt *pkt, struct pkt_file *pfile);
+extern uint _rtw_pktfile_read (struct pkt_file *pfile, u8 *rmem, uint rlen);
+extern sint rtw_endofpktfile (struct pkt_file *pfile);
+
+extern void rtw_os_pkt_complete(_adapter *padapter, _pkt *pkt);
+extern void rtw_os_xmit_complete(_adapter *padapter, struct xmit_frame *pxframe);
+
+#endif //__XMIT_OSDEP_H_
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c
new file mode 100755
index 0000000000000..28807e9148579
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c
@@ -0,0 +1,5589 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _IOCTL_CFG80211_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_set.h>
+#include <rtw_ioctl_query.h>
+#include <xmit_osdep.h>
+
+#ifdef CONFIG_IOCTL_CFG80211
+
+#include "ioctl_cfg80211.h"	
+
+#define RTW_MAX_MGMT_TX_CNT (8)
+
+#define RTW_SCAN_IE_LEN_MAX      2304
+#define RTW_MAX_REMAIN_ON_CHANNEL_DURATION 65535 //ms
+#define RTW_MAX_NUM_PMKIDS 4
+
+#define RTW_CH_MAX_2G_CHANNEL               14      /* Max channel in 2G band */
+
+static const u32 rtw_cipher_suites[] = {
+	WLAN_CIPHER_SUITE_WEP40,
+	WLAN_CIPHER_SUITE_WEP104,
+	WLAN_CIPHER_SUITE_TKIP,
+	WLAN_CIPHER_SUITE_CCMP,
+#ifdef CONFIG_IEEE80211W
+	WLAN_CIPHER_SUITE_AES_CMAC,
+#endif //CONFIG_IEEE80211W
+};
+
+#define RATETAB_ENT(_rate, _rateid, _flags) \
+	{								\
+		.bitrate	= (_rate),				\
+		.hw_value	= (_rateid),				\
+		.flags		= (_flags),				\
+	}
+
+#define CHAN2G(_channel, _freq, _flags) {			\
+	.band			= NL80211_BAND_2GHZ,		\
+	.center_freq		= (_freq),			\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+#define CHAN5G(_channel, _flags) {				\
+	.band			= NL80211_BAND_5GHZ,		\
+	.center_freq		= 5000 + (5 * (_channel)),	\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+static struct ieee80211_rate rtw_rates[] = {
+	RATETAB_ENT(10,  0x1,   0),
+	RATETAB_ENT(20,  0x2,   0),
+	RATETAB_ENT(55,  0x4,   0),
+	RATETAB_ENT(110, 0x8,   0),
+	RATETAB_ENT(60,  0x10,  0),
+	RATETAB_ENT(90,  0x20,  0),
+	RATETAB_ENT(120, 0x40,  0),
+	RATETAB_ENT(180, 0x80,  0),
+	RATETAB_ENT(240, 0x100, 0),
+	RATETAB_ENT(360, 0x200, 0),
+	RATETAB_ENT(480, 0x400, 0),
+	RATETAB_ENT(540, 0x800, 0),
+};
+
+#define rtw_a_rates		(rtw_rates + 4)
+#define RTW_A_RATES_NUM	8
+#define rtw_g_rates		(rtw_rates + 0)
+#define RTW_G_RATES_NUM	12
+
+#define RTW_2G_CHANNELS_NUM 14
+#define RTW_5G_CHANNELS_NUM 37
+
+static struct ieee80211_channel rtw_2ghz_channels[] = {
+	CHAN2G(1, 2412, 0),
+	CHAN2G(2, 2417, 0),
+	CHAN2G(3, 2422, 0),
+	CHAN2G(4, 2427, 0),
+	CHAN2G(5, 2432, 0),
+	CHAN2G(6, 2437, 0),
+	CHAN2G(7, 2442, 0),
+	CHAN2G(8, 2447, 0),
+	CHAN2G(9, 2452, 0),
+	CHAN2G(10, 2457, 0),
+	CHAN2G(11, 2462, 0),
+	CHAN2G(12, 2467, 0),
+	CHAN2G(13, 2472, 0),
+	CHAN2G(14, 2484, 0),
+};
+
+static struct ieee80211_channel rtw_5ghz_a_channels[] = {
+	CHAN5G(34, 0),		CHAN5G(36, 0),
+	CHAN5G(38, 0),		CHAN5G(40, 0),
+	CHAN5G(42, 0),		CHAN5G(44, 0),
+	CHAN5G(46, 0),		CHAN5G(48, 0),
+	CHAN5G(52, 0),		CHAN5G(56, 0),
+	CHAN5G(60, 0),		CHAN5G(64, 0),
+	CHAN5G(100, 0),		CHAN5G(104, 0),
+	CHAN5G(108, 0),		CHAN5G(112, 0),
+	CHAN5G(116, 0),		CHAN5G(120, 0),
+	CHAN5G(124, 0),		CHAN5G(128, 0),
+	CHAN5G(132, 0),		CHAN5G(136, 0),
+	CHAN5G(140, 0),		CHAN5G(149, 0),
+	CHAN5G(153, 0),		CHAN5G(157, 0),
+	CHAN5G(161, 0),		CHAN5G(165, 0),
+	CHAN5G(184, 0),		CHAN5G(188, 0),
+	CHAN5G(192, 0),		CHAN5G(196, 0),
+	CHAN5G(200, 0),		CHAN5G(204, 0),
+	CHAN5G(208, 0),		CHAN5G(212, 0),
+	CHAN5G(216, 0),
+};
+
+
+void rtw_2g_channels_init(struct ieee80211_channel *channels)
+{
+	_rtw_memcpy((void*)channels, (void*)rtw_2ghz_channels,
+		sizeof(struct ieee80211_channel)*RTW_2G_CHANNELS_NUM
+	);
+}
+
+void rtw_5g_channels_init(struct ieee80211_channel *channels)
+{
+	_rtw_memcpy((void*)channels, (void*)rtw_5ghz_a_channels,
+		sizeof(struct ieee80211_channel)*RTW_5G_CHANNELS_NUM
+	);
+}
+
+void rtw_2g_rates_init(struct ieee80211_rate *rates)
+{
+	_rtw_memcpy(rates, rtw_g_rates,
+		sizeof(struct ieee80211_rate)*RTW_G_RATES_NUM
+	);
+}
+
+void rtw_5g_rates_init(struct ieee80211_rate *rates)
+{
+	_rtw_memcpy(rates, rtw_a_rates,
+		sizeof(struct ieee80211_rate)*RTW_A_RATES_NUM
+	);
+}
+
+struct ieee80211_supported_band *rtw_spt_band_alloc(
+	enum nl80211_band band
+	)
+{
+	struct ieee80211_supported_band *spt_band = NULL;
+	int n_channels, n_bitrates;
+
+	if(band == NL80211_BAND_2GHZ)
+	{
+		n_channels = RTW_2G_CHANNELS_NUM;
+		n_bitrates = RTW_G_RATES_NUM;
+	}
+	else if(band == NL80211_BAND_5GHZ)
+	{
+		n_channels = RTW_5G_CHANNELS_NUM;
+		n_bitrates = RTW_A_RATES_NUM;
+	}
+	else
+	{
+		goto exit;
+	}
+
+	spt_band = (struct ieee80211_supported_band *)rtw_zmalloc(
+		sizeof(struct ieee80211_supported_band)
+		+ sizeof(struct ieee80211_channel)*n_channels
+		+ sizeof(struct ieee80211_rate)*n_bitrates
+	);
+	if(!spt_band)
+		goto exit;
+
+	spt_band->channels = (struct ieee80211_channel*)(((u8*)spt_band)+sizeof(struct ieee80211_supported_band));
+	spt_band->bitrates= (struct ieee80211_rate*)(((u8*)spt_band->channels)+sizeof(struct ieee80211_channel)*n_channels);
+	spt_band->band = band;
+	spt_band->n_channels = n_channels;
+	spt_band->n_bitrates = n_bitrates;
+
+	if(band == NL80211_BAND_2GHZ)
+	{
+		rtw_2g_channels_init(spt_band->channels);
+		rtw_2g_rates_init(spt_band->bitrates);
+	}
+	else if(band == NL80211_BAND_5GHZ)
+	{
+		rtw_5g_channels_init(spt_band->channels);
+		rtw_5g_rates_init(spt_band->bitrates);
+	}
+
+	//spt_band.ht_cap
+	
+exit:
+
+	return spt_band;
+}
+
+void rtw_spt_band_free(struct ieee80211_supported_band *spt_band)
+{
+	u32 size = 0;
+
+	if(!spt_band)
+		return;
+	
+	if(spt_band->band == NL80211_BAND_2GHZ)
+	{
+		size = sizeof(struct ieee80211_supported_band)
+			+ sizeof(struct ieee80211_channel)*RTW_2G_CHANNELS_NUM
+			+ sizeof(struct ieee80211_rate)*RTW_G_RATES_NUM;
+	}
+	else if(spt_band->band == NL80211_BAND_5GHZ)
+	{
+		size = sizeof(struct ieee80211_supported_band)
+			+ sizeof(struct ieee80211_channel)*RTW_5G_CHANNELS_NUM
+			+ sizeof(struct ieee80211_rate)*RTW_A_RATES_NUM;		
+	}
+	else
+	{
+		
+	}
+	rtw_mfree((u8*)spt_band, size);
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+static const struct ieee80211_txrx_stypes
+rtw_cfg80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+	[NL80211_IFTYPE_ADHOC] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_STATION] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+	[NL80211_IFTYPE_AP] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_AP_VLAN] = {
+		/* copy AP */
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_P2P_CLIENT] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+	[NL80211_IFTYPE_P2P_GO] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+};
+#endif
+
+static int rtw_ieee80211_channel_to_frequency(int chan, int band)
+{
+	/* see 802.11 17.3.8.3.2 and Annex J
+	* there are overlapping channel numbers in 5GHz and 2GHz bands */
+           
+	if (band == NL80211_BAND_5GHZ) {
+       	if (chan >= 182 && chan <= 196)
+			return 4000 + chan * 5;
+             else
+                    return 5000 + chan * 5;
+       } else { /* NL80211_BAND_2GHZ */
+		if (chan == 14)
+			return 2484;
+             else if (chan < 14)
+			return 2407 + chan * 5;
+             else
+			return 0; /* not supported */
+	}
+}
+
+#define MAX_BSSINFO_LEN 1000
+static int rtw_cfg80211_inform_bss(_adapter *padapter, struct wlan_network *pnetwork)
+{
+	int ret=0;	
+	struct ieee80211_channel *notify_channel;
+	struct cfg80211_bss *bss;
+	//struct ieee80211_supported_band *band;       
+	u16 channel;
+	u32 freq;
+	u64 notify_timestamp;
+	u16 notify_capability;
+	u16 notify_interval;
+	u8 *notify_ie;
+	size_t notify_ielen;
+	s32 notify_signal;
+	u8 *buf, *pbuf;
+	size_t len,bssinf_len=0;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+		
+	struct wireless_dev *wdev = padapter->rtw_wdev;
+	struct wiphy *wiphy = wdev->wiphy;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+
+	//DBG_8192C("%s\n", __func__);
+
+	bssinf_len = pnetwork->network.IELength+sizeof (struct rtw_ieee80211_hdr_3addr);
+	if(bssinf_len > MAX_BSSINFO_LEN){
+		DBG_871X("%s IE Length too long > %d byte \n",__FUNCTION__,MAX_BSSINFO_LEN);
+		goto exit;
+	}
+
+	//To reduce PBC Overlap rate
+	//_enter_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+	if(wdev_to_priv(wdev)->scan_request != NULL)
+	{
+		u8 *psr=NULL, sr = 0;
+		NDIS_802_11_SSID *pssid = &pnetwork->network.Ssid;
+		struct cfg80211_scan_request *request = wdev_to_priv(wdev)->scan_request;
+		struct cfg80211_ssid *ssids = request->ssids;
+		u32 wpsielen=0;
+		u8 *wpsie=NULL;	
+		
+		wpsie = rtw_get_wps_ie(pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_, NULL, &wpsielen);
+		
+		if(wpsie && wpsielen>0)
+			psr = rtw_get_wps_attr_content(wpsie,  wpsielen, WPS_ATTR_SELECTED_REGISTRAR, (u8*)(&sr), NULL);
+		
+		if (sr != 0)
+		{			
+			if(request->n_ssids == 1  && request->n_channels == 1) // it means under processing WPS
+			{
+				DBG_8192C("ssid=%s, len=%d\n", pssid->Ssid, pssid->SsidLength);
+			
+				if(pssid->SsidLength == ssids[0].ssid_len &&
+					_rtw_memcmp(pssid->Ssid, ssids[0].ssid, ssids[0].ssid_len))
+				{
+					DBG_871X("%s, got sr and ssid match!\n", __func__);
+				}
+				else
+				{
+					if(psr !=NULL)
+						*psr = 0; //clear sr
+				
+#if 0			
+					WLAN_BSSID_EX  *pselect_network = &pnetwork->network;
+					struct cfg80211_bss *pselect_bss = NULL;
+					struct ieee80211_channel *notify_channel = NULL;
+					u32 freq;
+
+					DBG_871X("%s, got sr, but ssid mismatch, to remove this bss\n", __func__);
+
+					if (pselect_network->Configuration.DSConfig <= RTW_CH_MAX_2G_CHANNEL)
+						freq = rtw_ieee80211_channel_to_frequency(pselect_network->Configuration.DSConfig, NL80211_BAND_2GHZ);
+					else
+						freq = rtw_ieee80211_channel_to_frequency(pselect_network->Configuration.DSConfig, NL80211_BAND_5GHZ);
+
+					notify_channel = ieee80211_get_channel(wiphy, freq);
+					pselect_bss = cfg80211_get_bss(wiphy, NULL/*notify_channel*/,
+								pselect_network->MacAddress, pselect_network->Ssid.Ssid,
+								pselect_network->Ssid.SsidLength, 0/*WLAN_CAPABILITY_ESS*/, 
+								0/*WLAN_CAPABILITY_ESS*/);
+
+					if(pselect_bss)
+					{
+						DBG_871X("%s, got bss for cfg80211 for unlinking bss\n", __func__);
+
+						cfg80211_unlink_bss(wiphy, pselect_bss);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
+						cfg80211_put_bss(wiphy, pselect_bss);
+#else
+						cfg80211_put_bss(pselect_bss);
+#endif
+						
+					}
+					
+					goto exit;
+#endif 					
+				}			
+			}			
+		}		
+	}
+	//_exit_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+
+	channel = pnetwork->network.Configuration.DSConfig;
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+	
+	notify_channel = ieee80211_get_channel(wiphy, freq);
+
+	//rtw_get_timestampe_from_ie()
+	notify_timestamp = jiffies_to_msecs(jiffies)*1000; /* uSec */
+
+	notify_interval = le16_to_cpu(*(u16*)rtw_get_beacon_interval_from_ie(pnetwork->network.IEs));
+	notify_capability = le16_to_cpu(*(u16*)rtw_get_capability_from_ie(pnetwork->network.IEs));		
+
+	
+	notify_ie = pnetwork->network.IEs+_FIXED_IE_LENGTH_;
+	notify_ielen = pnetwork->network.IELength-_FIXED_IE_LENGTH_;
+
+	//We've set wiphy's signal_type as CFG80211_SIGNAL_TYPE_MBM: signal strength in mBm (100*dBm)
+	if ( check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE &&
+		is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network)) {
+		notify_signal = 100*translate_percentage_to_dbm(padapter->recvpriv.signal_strength);//dbm
+	} else {
+		notify_signal = 100*translate_percentage_to_dbm(pnetwork->network.PhyInfo.SignalStrength);//dbm
+	}
+		
+/*
+	DBG_8192C("bssid: %2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
+                        pnetwork->network.MacAddress[0], pnetwork->network.MacAddress[1], pnetwork->network.MacAddress[2],
+                        pnetwork->network.MacAddress[3], pnetwork->network.MacAddress[4], pnetwork->network.MacAddress[5]);
+	DBG_8192C("Channel: %d(%d)\n", channel, freq);
+	DBG_8192C("Capability: %X\n", notify_capability);
+	DBG_8192C("Beacon interval: %d\n", notify_interval);
+	DBG_8192C("Signal: %d\n", notify_signal);
+	DBG_8192C("notify_timestamp: %#018llx\n", notify_timestamp);
+*/
+
+	buf = rtw_zmalloc(MAX_BSSINFO_LEN);
+	pbuf = buf;
+	
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pbuf;	
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;	
+
+	SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
+	//pmlmeext->mgnt_seq++;
+
+	if (pnetwork->network.Reserved[0] == 1) { // WIFI_BEACON
+		_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);		
+		SetFrameSubType(pbuf, WIFI_BEACON);
+	} else {
+		_rtw_memcpy(pwlanhdr->addr1, myid(&(padapter->eeprompriv)), ETH_ALEN);
+		SetFrameSubType(pbuf, WIFI_PROBERSP);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr2, pnetwork->network.MacAddress, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pnetwork->network.MacAddress, ETH_ALEN);
+
+
+	pbuf += sizeof(struct rtw_ieee80211_hdr_3addr);	
+	len = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	_rtw_memcpy(pbuf, pnetwork->network.IEs, pnetwork->network.IELength);
+	len += pnetwork->network.IELength;
+
+	rtw_mfree(buf, MAX_BSSINFO_LEN);
+
+	//#ifdef CONFIG_P2P
+	//if(rtw_get_p2p_ie(pnetwork->network.IEs+12, pnetwork->network.IELength-12, NULL, NULL))
+	//{
+	//	DBG_8192C("%s, got p2p_ie\n", __func__);
+	//}
+	//#endif
+	
+
+#if 1	
+	bss = cfg80211_inform_bss_frame(wiphy, notify_channel, (struct ieee80211_mgmt *)buf,
+		len, notify_signal, GFP_ATOMIC);
+#else			 
+			
+	bss = cfg80211_inform_bss(wiphy, notify_channel, (const u8 *)pnetwork->network.MacAddress,
+                notify_timestamp, notify_capability, notify_interval, notify_ie,
+                notify_ielen, notify_signal, GFP_ATOMIC/*GFP_KERNEL*/);
+#endif
+
+	if (unlikely(!bss)) {
+		DBG_8192C("rtw_cfg80211_inform_bss error\n");
+		return -EINVAL;
+	}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38))
+#ifndef COMPAT_KERNEL_RELEASE
+	//patch for cfg80211, update beacon ies to information_elements
+	if (pnetwork->network.Reserved[0] == 1) { // WIFI_BEACON
+	
+		 if(bss->len_information_elements != bss->len_beacon_ies)
+		 {
+			bss->information_elements = bss->beacon_ies;			
+			bss->len_information_elements =  bss->len_beacon_ies;
+		 }		
+	}
+#endif //COMPAT_KERNEL_RELEASE
+#endif //LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38)
+
+/*	
+	{
+		if( bss->information_elements == bss->proberesp_ies) 
+		{
+			if( bss->len_information_elements !=  bss->len_proberesp_ies)
+			{
+				DBG_8192C("error!, len_information_elements !=  bss->len_proberesp_ies\n");
+			}
+							
+		}
+		else if(bss->len_information_elements <  bss->len_beacon_ies)
+		{
+			bss->information_elements = bss->beacon_ies;			
+			bss->len_information_elements =  bss->len_beacon_ies;
+		}
+	}
+*/
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
+	cfg80211_put_bss(wiphy, bss);
+#else
+	cfg80211_put_bss(bss);
+#endif
+
+exit:	
+	return ret;
+	
+}
+
+/*
+	Check the given bss is valid by kernel API cfg80211_get_bss()
+	@padapter : the given adapter
+	
+	return _TRUE if bss is valid,  _FALSE for not found.
+*/
+int rtw_cfg80211_check_bss(_adapter *padapter)
+{
+	WLAN_BSSID_EX  *pnetwork = &(padapter->mlmeextpriv.mlmext_info.network);
+	struct cfg80211_bss *bss = NULL;
+	struct ieee80211_channel *notify_channel = NULL;
+	u32 freq;
+
+	if (!(pnetwork) || !(padapter->rtw_wdev))
+		return _FALSE;
+
+	if (pnetwork->Configuration.DSConfig <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(pnetwork->Configuration.DSConfig, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(pnetwork->Configuration.DSConfig, NL80211_BAND_5GHZ);
+
+	notify_channel = ieee80211_get_channel(padapter->rtw_wdev->wiphy, freq);
+	bss = cfg80211_get_bss(padapter->rtw_wdev->wiphy, notify_channel,
+			pnetwork->MacAddress, pnetwork->Ssid.Ssid,
+			pnetwork->Ssid.SsidLength,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)
+			WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+#else
+			IEEE80211_BSS_TYPE_ESS, IEEE80211_PRIVACY_ANY);
+#endif
+
+	return 	(bss!=NULL);
+}
+
+void rtw_cfg80211_indicate_connect(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+	struct cfg80211_bss *bss = NULL;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+	if (pwdev->iftype != NL80211_IFTYPE_STATION
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+		&& pwdev->iftype != NL80211_IFTYPE_P2P_CLIENT
+		#endif
+	) {
+		return;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+		return;
+
+#ifdef CONFIG_P2P
+	if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+			rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+			DBG_8192C("%s, role=%d, p2p_state=%d, pre_p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo), rtw_p2p_pre_state(pwdinfo));
+		}
+	}
+#endif //CONFIG_P2P
+
+	#ifdef CONFIG_LAYER2_ROAMING
+	if (rtw_to_roaming(padapter) > 0) {
+		#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39) || defined(COMPAT_KERNEL_RELEASE)
+		struct wiphy *wiphy = pwdev->wiphy;
+		struct ieee80211_channel *notify_channel;
+		u32 freq;
+		u16 channel = cur_network->network.Configuration.DSConfig;
+
+		if (channel <= RTW_CH_MAX_2G_CHANNEL)
+			freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+		else
+			freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+		notify_channel = ieee80211_get_channel(wiphy, freq);
+		#endif
+
+		DBG_871X("%s call cfg80211_roamed\n", __FUNCTION__);
+		#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
+		{
+			struct cfg80211_roam_info roam_info = {
+				.channel = notify_channel,
+				.bssid = cur_network->network.MacAddress,
+				.req_ie = pmlmepriv->assoc_req+sizeof(struct rtw_ieee80211_hdr_3addr)+2,
+				.req_ie_len = pmlmepriv->assoc_req_len-sizeof(struct rtw_ieee80211_hdr_3addr)-2,
+				.resp_ie = pmlmepriv->assoc_rsp+sizeof(struct rtw_ieee80211_hdr_3addr)+6,
+				.resp_ie_len = pmlmepriv->assoc_rsp_len-sizeof(struct rtw_ieee80211_hdr_3addr)-6,
+			};
+			cfg80211_roamed(padapter->pnetdev, &roam_info, GFP_ATOMIC);
+		}
+		#else
+		cfg80211_roamed(padapter->pnetdev
+			#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)
+			, notify_channel
+			#endif
+			, cur_network->network.MacAddress
+			, pmlmepriv->assoc_req+sizeof(struct rtw_ieee80211_hdr_3addr)+2
+			, pmlmepriv->assoc_req_len-sizeof(struct rtw_ieee80211_hdr_3addr)-2
+			, pmlmepriv->assoc_rsp+sizeof(struct rtw_ieee80211_hdr_3addr)+6
+			, pmlmepriv->assoc_rsp_len-sizeof(struct rtw_ieee80211_hdr_3addr)-6
+			, GFP_ATOMIC);
+		#endif
+	}
+	else 
+	#endif
+	{
+		DBG_8192C("pwdev->sme_state(b)=%d\n", pwdev->sme_state);
+		cfg80211_connect_result(padapter->pnetdev, cur_network->network.MacAddress
+			, pmlmepriv->assoc_req+sizeof(struct rtw_ieee80211_hdr_3addr)+2
+			, pmlmepriv->assoc_req_len-sizeof(struct rtw_ieee80211_hdr_3addr)-2
+			, pmlmepriv->assoc_rsp+sizeof(struct rtw_ieee80211_hdr_3addr)+6
+			, pmlmepriv->assoc_rsp_len-sizeof(struct rtw_ieee80211_hdr_3addr)-6
+			, WLAN_STATUS_SUCCESS, GFP_ATOMIC);
+		DBG_8192C("pwdev->sme_state(a)=%d\n", pwdev->sme_state);
+	}
+}
+
+void rtw_cfg80211_indicate_disconnect(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (pwdev->iftype != NL80211_IFTYPE_STATION 
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+		&& pwdev->iftype != NL80211_IFTYPE_P2P_CLIENT
+		#endif
+	) {
+		return;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+		return;
+
+#ifdef CONFIG_P2P	
+	if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+	
+			rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+			rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+
+			DBG_8192C("%s, role=%d, p2p_state=%d, pre_p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo), rtw_p2p_pre_state(pwdinfo));
+		}
+	}
+#endif //CONFIG_P2P
+
+	if (!padapter->mlmepriv.not_indic_disco) {
+		DBG_8192C("pwdev->sme_state(b)=%d\n", pwdev->sme_state);
+
+		if (check_fwstate(pmlmepriv, WIFI_UNDER_LINKING)) {
+			cfg80211_connect_result(padapter->pnetdev, NULL, NULL, 0, NULL, 0, 
+				WLAN_STATUS_UNSPECIFIED_FAILURE, GFP_ATOMIC/*GFP_KERNEL*/);
+		} else {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,2,0)
+			cfg80211_disconnected(padapter->pnetdev, 0, NULL, 0, GFP_ATOMIC);
+#else
+			cfg80211_disconnected(padapter->pnetdev, 0, NULL, 0, false, GFP_ATOMIC);
+#endif
+        }
+
+		DBG_8192C("pwdev->sme_state(a)=%d\n", pwdev->sme_state);
+	}
+}
+ 	
+
+#ifdef CONFIG_AP_MODE
+static u8 set_pairwise_key(_adapter *padapter, struct sta_info *psta)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;	
+	u8	res=_SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if ( ph2c == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+	if(psetstakey_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+
+
+	psetstakey_para->algorithm = (u8)psta->dot118021XPrivacy;
+
+	_rtw_memcpy(psetstakey_para->addr, psta->hwaddr, ETH_ALEN);	
+	
+	_rtw_memcpy(psetstakey_para->key, &psta->dot118021x_UncstKey, 16);
+
+	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+
+exit:
+
+	return res;
+	
+}
+
+static int set_group_key(_adapter *padapter, u8 *key, u8 alg, int keyid)
+{
+	u8 keylen;
+	struct cmd_obj* pcmd;
+	struct setkey_parm *psetkeyparm;
+	struct cmd_priv	*pcmdpriv=&(padapter->cmdpriv);	
+	int res=_SUCCESS;
+
+	DBG_8192C("%s\n", __FUNCTION__);
+	
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	psetkeyparm=(struct setkey_parm*)rtw_zmalloc(sizeof(struct setkey_parm));
+	if(psetkeyparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));
+		
+	psetkeyparm->keyid=(u8)keyid;
+	if (is_wep_enc(alg))
+		padapter->securitypriv.key_mask |= BIT(psetkeyparm->keyid);
+
+	psetkeyparm->algorithm = alg;
+
+	psetkeyparm->set_tx = 1;
+
+	switch(alg)
+	{
+		case _WEP40_:					
+			keylen = 5;
+			break;
+		case _WEP104_:
+			keylen = 13;			
+			break;
+		case _TKIP_:
+		case _TKIP_WTMIC_:		
+		case _AES_:
+			keylen = 16;		
+			break;
+		default:
+			keylen = 16;		
+	}
+
+	_rtw_memcpy(&(psetkeyparm->key[0]), key, keylen);
+	
+	pcmd->cmdcode = _SetKey_CMD_;
+	pcmd->parmbuf = (u8 *)psetkeyparm;   
+	pcmd->cmdsz =  (sizeof(struct setkey_parm));  
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+	return res;
+	
+
+}
+
+static int set_wep_key(_adapter *padapter, u8 *key, u8 keylen, int keyid)
+{	
+	u8 alg;
+
+	switch(keylen)
+	{
+		case 5:
+			alg =_WEP40_;			
+			break;
+		case 13:
+			alg =_WEP104_;			
+			break;
+		default:
+			alg =_NO_PRIVACY_;			
+	}
+
+	return set_group_key(padapter, key, alg, keyid);
+
+}
+
+static int rtw_cfg80211_ap_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	struct sta_info *psta = NULL, *pbcmc_sta = NULL;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_8192C("%s\n", __FUNCTION__);
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	//sizeof(struct ieee_param) = 64 bytes;
+	//if (param_len !=  (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	if (param_len !=  sizeof(struct ieee_param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		if (param->u.crypt.idx >= WEP_KEYS)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}	
+	}
+	else 
+	{		
+		psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+		if(!psta)
+		{
+			//ret = -EINVAL;
+			DBG_8192C("rtw_set_encryption(), sta has already been removed or never been added\n");
+			goto exit;
+		}			
+	}
+
+	if (strcmp(param->u.crypt.alg, "none") == 0 && (psta==NULL))
+	{
+		//todo:clear default encryption keys
+
+		DBG_8192C("clear default encryption keys, keyid=%d\n", param->u.crypt.idx);
+		
+		goto exit;
+	}
+
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0 && (psta==NULL))
+	{		
+		DBG_8192C("r871x_set_encryption, crypt.alg = WEP\n");
+		
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+					
+		DBG_8192C("r871x_set_encryption, wep_key_idx=%d, len=%d\n", wep_key_idx, wep_key_len);
+
+		if((wep_key_idx >= WEP_KEYS) || (wep_key_len<=0))
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+			
+		if (wep_key_len > 0) 
+		{			
+		 	wep_key_len = wep_key_len <= 5 ? 5 : 13;
+		}
+		
+		if (psecuritypriv->bWepDefaultKeyIdxSet == 0)
+		{
+			//wep default key has not been set, so use this key index as default key.
+
+			psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP40_;
+			psecuritypriv->dot118021XGrpPrivacy=_WEP40_;
+			
+			if(wep_key_len == 13)
+			{
+				psecuritypriv->dot11PrivacyAlgrthm=_WEP104_;
+				psecuritypriv->dot118021XGrpPrivacy=_WEP104_;
+			}
+
+			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
+		}
+			
+		_rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), param->u.crypt.key, wep_key_len);
+					
+		psecuritypriv->dot11DefKeylen[wep_key_idx] = wep_key_len;
+
+		set_wep_key(padapter, param->u.crypt.key, wep_key_len, wep_key_idx);
+
+		goto exit;
+		
+	}
+
+	
+	if(!psta && check_fwstate(pmlmepriv, WIFI_AP_STATE)) // //group key
+	{
+		if(param->u.crypt.set_tx == 0) //group key
+		{
+			if(strcmp(param->u.crypt.alg, "WEP") == 0)
+			{
+				DBG_8192C("%s, set group_key, WEP\n", __FUNCTION__);
+				
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+					
+				psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+				if(param->u.crypt.key_len==13)
+				{						
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+				}
+				
+			}
+			else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+			{						
+				DBG_8192C("%s, set group_key, TKIP\n", __FUNCTION__);
+				
+				psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				
+				//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+				//set mic key
+				_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+				_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+				psecuritypriv->busetkipkey = _TRUE;
+											
+			}
+			else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+			{
+				DBG_8192C("%s, set group_key, CCMP\n", __FUNCTION__);
+			
+				psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+			}
+			else
+			{
+				DBG_8192C("%s, set group_key, none\n", __FUNCTION__);
+				
+				psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+			}
+
+			psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+			psecuritypriv->binstallGrpkey = _TRUE;
+
+			psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+								
+			set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+			
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta)
+			{
+				pbcmc_sta->ieee8021x_blocked = _FALSE;
+				pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy			
+			}	
+						
+		}
+
+		goto exit;
+		
+	}	
+
+	if(psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X && psta) // psk/802_1x
+	{
+		if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+		{
+			if(param->u.crypt.set_tx ==1) //pairwise key
+			{ 
+				_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					DBG_8192C("%s, set pairwise key, WEP\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{						
+						psta->dot118021XPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{						
+					DBG_8192C("%s, set pairwise key, TKIP\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _TKIP_;
+				
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+											
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+
+					DBG_8192C("%s, set pairwise key, CCMP\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _AES_;
+				}
+				else
+				{
+					DBG_8192C("%s, set pairwise key, none\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _NO_PRIVACY_;
+				}
+						
+				set_pairwise_key(padapter, psta);
+					
+				psta->ieee8021x_blocked = _FALSE;
+					
+				psta->bpairwise_key_installed = _TRUE;
+					
+			}			
+			else//group key???
+			{ 
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+					
+					psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{						
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{						
+					psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+											
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				}
+				else
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+				}
+
+				psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+				psecuritypriv->binstallGrpkey = _TRUE;	
+								
+				psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+								
+				set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+			
+				pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+				if(pbcmc_sta)
+				{
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+					pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy			
+				}					
+
+			}
+			
+		}
+				
+	}
+
+exit:
+
+	return ret;
+	
+}
+#endif
+
+static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;		
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info* pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+_func_enter_;
+
+	DBG_8192C("%s\n", __func__);
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;		
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		if (param->u.crypt.idx >= WEP_KEYS
+#ifdef CONFIG_IEEE80211W
+			&& param->u.crypt.idx > BIP_MAX_KEYID
+#endif //CONFIG_IEEE80211W
+		)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	} else {
+		ret = -EINVAL;		
+		goto exit;
+	}
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("wpa_set_encryption, crypt.alg = WEP\n"));
+		DBG_8192C("wpa_set_encryption, crypt.alg = WEP\n");
+
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+
+		if ((wep_key_idx > WEP_KEYS) || (wep_key_len <= 0))
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		if (psecuritypriv->bWepDefaultKeyIdxSet == 0)
+		{
+			//wep default key has not been set, so use this key index as default key.
+
+			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+
+              	psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->dot11PrivacyAlgrthm = _WEP40_;
+			psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+
+			if(wep_key_len==13)
+			{
+				psecuritypriv->dot11PrivacyAlgrthm = _WEP104_;
+				psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+			}
+
+			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
+		}
+			
+		_rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), param->u.crypt.key, wep_key_len);
+			
+		psecuritypriv->dot11DefKeylen[wep_key_idx] = wep_key_len;
+			
+		rtw_set_key(padapter, psecuritypriv, wep_key_idx, 0);
+
+		goto exit;		
+	}
+
+	if(padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) // 802_1x
+	{
+		struct sta_info * psta,*pbcmc_sta;
+		struct sta_priv * pstapriv = &padapter->stapriv;
+
+		//DBG_8192C("%s, : dot11AuthAlgrthm == dot11AuthAlgrthm_8021X \n", __func__);
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_MP_STATE) == _TRUE) //sta mode
+		{
+			psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));				
+			if (psta == NULL) {
+				//DEBUG_ERR( ("Set wpa_set_encryption: Obtain Sta_info fail \n"));
+				DBG_8192C("%s, : Obtain Sta_info fail \n", __func__);
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0) 
+					psta->ieee8021x_blocked = _FALSE;
+
+				
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{
+					psta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}		
+
+				if(param->u.crypt.set_tx ==1)//pairwise key
+				{ 
+
+					DBG_8192C("%s, : param->u.crypt.set_tx ==1 \n", __func__);
+					
+					_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+					
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0)//set mic key
+					{						
+						//DEBUG_ERR(("\nset key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+						_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+						padapter->securitypriv.busetkipkey=_FALSE;
+						//_set_timer(&padapter->securitypriv.tkip_timer, 50);						
+					}
+
+					//DEBUG_ERR((" param->u.crypt.key_len=%d\n",param->u.crypt.key_len));
+					DBG_871X(" ~~~~set sta key:unicastkey\n");
+					
+					rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+				}
+				else//group key
+				{
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0 || strcmp(param->u.crypt.alg, "CCMP") == 0)
+					{
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrptxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[16]),8);
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrprxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[24]),8);
+	                                        padapter->securitypriv.binstallGrpkey = _TRUE;	
+						//DEBUG_ERR((" param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						DBG_871X(" ~~~~set sta key:groupkey\n");
+	
+						padapter->securitypriv.dot118021XGrpKeyid = param->u.crypt.idx;
+	
+						rtw_set_key(padapter,&padapter->securitypriv,param->u.crypt.idx, 1);
+					}
+#ifdef CONFIG_IEEE80211W
+					else if(strcmp(param->u.crypt.alg, "BIP") == 0)
+					{
+						int no;
+						//DBG_871X("BIP key_len=%d , index=%d @@@@@@@@@@@@@@@@@@\n", param->u.crypt.key_len, param->u.crypt.idx);
+						//save the IGTK key, length 16 bytes
+						_rtw_memcpy(padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						/*DBG_871X("IGTK key below:\n");
+						for(no=0;no<16;no++)
+							printk(" %02x ", padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey[no]);
+						DBG_871X("\n");*/
+						padapter->securitypriv.dot11wBIPKeyid = param->u.crypt.idx;
+						padapter->securitypriv.binstallBIPkey = _TRUE;
+						DBG_871X(" ~~~~set sta key:IGKT\n");
+					}
+#endif //CONFIG_IEEE80211W
+					
+#ifdef CONFIG_P2P
+					if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+					{
+						if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+						{
+							rtw_p2p_set_state(pwdinfo, P2P_STATE_PROVISIONING_DONE);
+						}
+					}
+#endif //CONFIG_P2P
+					
+				}						
+			}
+
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta==NULL)
+			{
+				//DEBUG_ERR( ("Set OID_802_11_ADD_KEY: bcmc stainfo is null \n"));
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0) 
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+				
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{							
+					pbcmc_sta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}					
+			}				
+		}
+		else if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) //adhoc mode
+		{		
+		}			
+	}
+
+exit:
+
+	DBG_8192C("%s, ret=%d\n", __func__, ret);
+	
+	_func_exit_;
+	
+	return ret;	
+}
+
+static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+				u8 key_index, bool pairwise, const u8 *mac_addr,
+#else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				u8 key_index, const u8 *mac_addr,
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				struct key_params *params)
+{
+	char *alg_name;
+	u32 param_len;
+	struct ieee_param *param = NULL;	
+	int ret=0;
+	struct wireless_dev *rtw_wdev = wiphy_to_wdev(wiphy);
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	
+	DBG_871X(FUNC_NDEV_FMT" adding key for %pM\n", FUNC_NDEV_ARG(ndev), mac_addr);
+	DBG_871X("cipher=0x%x\n", params->cipher);
+	DBG_871X("key_len=0x%x\n", params->key_len);
+	DBG_871X("seq_len=0x%x\n", params->seq_len);
+	DBG_871X("key_index=%d\n", key_index);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	DBG_871X("pairwise=%d\n", pairwise);
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+
+	param_len = sizeof(struct ieee_param) + params->key_len;
+	param = (struct ieee_param *)rtw_malloc(param_len);
+	if (param == NULL)
+		return -1;
+	
+	_rtw_memset(param, 0, param_len);
+
+	param->cmd = IEEE_CMD_SET_ENCRYPTION;
+	_rtw_memset(param->sta_addr, 0xff, ETH_ALEN);
+
+	switch (params->cipher) {
+	case IW_AUTH_CIPHER_NONE:
+		//todo: remove key 
+		//remove = 1;	
+		alg_name = "none";
+		break;
+	case WLAN_CIPHER_SUITE_WEP40:
+	case WLAN_CIPHER_SUITE_WEP104:
+		alg_name = "WEP";
+		break;
+	case WLAN_CIPHER_SUITE_TKIP:
+		alg_name = "TKIP";
+		break;
+	case WLAN_CIPHER_SUITE_CCMP:
+		alg_name = "CCMP";
+		break;
+#ifdef CONFIG_IEEE80211W
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+		alg_name = "BIP";
+		break;
+#endif //CONFIG_IEEE80211W
+	default:	
+		return -ENOTSUPP;
+	}
+	
+	strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
+	
+
+	if (!mac_addr || is_broadcast_ether_addr(mac_addr))
+	{
+		param->u.crypt.set_tx = 0; //for wpa/wpa2 group key
+	} else {
+		param->u.crypt.set_tx = 1; //for wpa/wpa2 pairwise key
+	}
+	
+	
+	//param->u.crypt.idx = key_index - 1;
+	param->u.crypt.idx = key_index;
+	
+	if (params->seq_len && params->seq) 
+	{	
+		_rtw_memcpy(param->u.crypt.seq, params->seq, params->seq_len);
+	}
+
+	if(params->key_len && params->key)
+	{
+		param->u.crypt.key_len = params->key_len;		
+		_rtw_memcpy(param->u.crypt.key, params->key, params->key_len);
+	}	
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+		ret =  rtw_cfg80211_set_encryption(ndev, param, param_len);	
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+#ifdef CONFIG_AP_MODE
+		if(mac_addr)
+			_rtw_memcpy(param->sta_addr, (void*)mac_addr, ETH_ALEN);
+	
+		ret = rtw_cfg80211_ap_set_encryption(ndev, param, param_len);
+#endif
+	}
+	else
+	{
+		DBG_8192C("error! fw_state=0x%x, iftype=%d\n", pmlmepriv->fw_state, rtw_wdev->iftype);
+		
+	}
+
+	if(param)
+	{
+		rtw_mfree((u8*)param, param_len);
+	}
+
+	return ret;
+
+}
+
+static int cfg80211_rtw_get_key(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+				u8 key_index, bool pairwise, const u8 *mac_addr,
+#else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				u8 key_index, const u8 *mac_addr,
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				void *cookie,
+				void (*callback)(void *cookie,
+						 struct key_params*))
+{
+#if 0
+	struct iwm_priv *iwm = ndev_to_iwm(ndev);
+	struct iwm_key *key = &iwm->keys[key_index];
+	struct key_params params;
+
+	IWM_DBG_WEXT(iwm, DBG, "Getting key %d\n", key_index);
+
+	memset(&params, 0, sizeof(params));
+
+	params.cipher = key->cipher;
+	params.key_len = key->key_len;
+	params.seq_len = key->seq_len;
+	params.seq = key->seq;
+	params.key = key->key;
+
+	callback(cookie, &params);
+
+	return key->key_len ? 0 : -ENOENT;
+#endif
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+static int cfg80211_rtw_del_key(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+				u8 key_index, bool pairwise, const u8 *mac_addr)
+#else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				u8 key_index, const u8 *mac_addr)
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);		
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	DBG_871X(FUNC_NDEV_FMT" key_index=%d\n", FUNC_NDEV_ARG(ndev), key_index);
+
+	if (key_index == psecuritypriv->dot11PrivacyKeyIndex)
+	{
+		//clear the flag of wep default key set.
+		psecuritypriv->bWepDefaultKeyIdxSet = 0;
+	}
+
+	return 0;
+}
+
+static int cfg80211_rtw_set_default_key(struct wiphy *wiphy,
+	struct net_device *ndev, u8 key_index
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	, bool unicast, bool multicast
+	#endif
+	)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);		
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+		DBG_871X(FUNC_NDEV_FMT" key_index=%d"
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+		", unicast=%d, multicast=%d"
+		#endif
+		".\n", FUNC_NDEV_ARG(ndev), key_index
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+		, unicast, multicast
+		#endif
+		);
+
+	if ((key_index < WEP_KEYS) && ((psecuritypriv->dot11PrivacyAlgrthm == _WEP40_) || (psecuritypriv->dot11PrivacyAlgrthm == _WEP104_))) //set wep default key
+	{
+		psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+		psecuritypriv->dot11PrivacyKeyIndex = key_index;
+
+		psecuritypriv->dot11PrivacyAlgrthm = _WEP40_;
+		psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+		if (psecuritypriv->dot11DefKeylen[key_index] == 13)
+		{
+			psecuritypriv->dot11PrivacyAlgrthm = _WEP104_;
+			psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+		}
+
+		psecuritypriv->bWepDefaultKeyIdxSet = 1; //set the flag to represent that wep default key has been set
+	}
+
+	return 0;
+
+}
+
+static int cfg80211_rtw_get_station(struct wiphy *wiphy,
+				    struct net_device *ndev,
+				    const u8 *mac, struct station_info *sinfo)
+{
+	int ret = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct sta_info *psta = NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	sinfo->filled = 0;
+
+	if (!mac) {
+		DBG_871X(FUNC_NDEV_FMT" mac==%p\n", FUNC_NDEV_ARG(ndev), mac);
+		ret = -ENOENT;
+		goto exit;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, mac);
+	if (psta == NULL) {
+		DBG_8192C("%s, sta_info is null\n", __func__);
+		ret = -ENOENT;
+		goto exit;
+	}
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_NDEV_FMT" mac="MAC_FMT"\n", FUNC_NDEV_ARG(ndev), MAC_ARG(mac));
+#endif
+
+	//for infra./P2PClient mode
+	if(	check_fwstate(pmlmepriv, WIFI_STATION_STATE)
+		&& check_fwstate(pmlmepriv, _FW_LINKED)
+	)
+	{
+		struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
+
+		if (_rtw_memcmp(mac, cur_network->network.MacAddress, ETH_ALEN) == _FALSE) {
+			DBG_871X("%s, mismatch bssid="MAC_FMT"\n", __func__, MAC_ARG(cur_network->network.MacAddress));
+			ret = -ENOENT;
+			goto exit;
+		}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+#else
+		sinfo->filled |= STATION_INFO_SIGNAL;
+#endif
+		sinfo->signal = translate_percentage_to_dbm(padapter->recvpriv.signal_strength);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+#else
+		sinfo->filled |= STATION_INFO_TX_BITRATE;
+#endif
+		sinfo->txrate.legacy = rtw_get_cur_max_rate(padapter);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
+#else
+		sinfo->filled |= STATION_INFO_RX_PACKETS;
+#endif
+		sinfo->rx_packets = sta_rx_data_pkts(psta);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
+#else
+		sinfo->filled |= STATION_INFO_TX_PACKETS;
+#endif
+		sinfo->tx_packets = psta->sta_stats.tx_pkts;
+
+	}
+
+	//for Ad-Hoc/AP mode
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)
+			||check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)
+			||check_fwstate(pmlmepriv, WIFI_AP_STATE))
+		&& check_fwstate(pmlmepriv, _FW_LINKED)
+	)
+	{
+		//TODO: should acquire station info...
+	}
+
+exit:
+	return ret;
+}
+
+extern int netdev_open(struct net_device *pnetdev);
+#ifdef CONFIG_CONCURRENT_MODE
+extern int netdev_if2_open(struct net_device *pnetdev);
+#endif
+
+/*
+enum nl80211_iftype {
+	NL80211_IFTYPE_UNSPECIFIED,
+       NL80211_IFTYPE_ADHOC, //1
+       NL80211_IFTYPE_STATION, //2
+       NL80211_IFTYPE_AP, //3
+       NL80211_IFTYPE_AP_VLAN,
+       NL80211_IFTYPE_WDS,
+       NL80211_IFTYPE_MONITOR, //6
+       NL80211_IFTYPE_MESH_POINT,
+       NL80211_IFTYPE_P2P_CLIENT, //8
+	NL80211_IFTYPE_P2P_GO, //9
+       //keep last 
+       NUM_NL80211_IFTYPES,
+       NL80211_IFTYPE_MAX = NUM_NL80211_IFTYPES - 1
+};
+*/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
+static int cfg80211_rtw_change_iface(struct wiphy *wiphy,
+				     struct net_device *ndev,
+				     enum nl80211_iftype type,
+				     struct vif_params *params)
+#else
+static int cfg80211_rtw_change_iface(struct wiphy *wiphy,
+				     struct net_device *ndev,
+				     enum nl80211_iftype type, u32 *flags,
+				     struct vif_params *params)
+#endif
+{
+	enum nl80211_iftype old_type;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networkType ;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct wireless_dev *rtw_wdev = wiphy_to_wdev(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_queue *queue = &pmlmepriv->scanned_queue;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+	int ret = 0;
+	u8 change = _FALSE;
+
+	if (adapter_to_dvobj(padapter)->processing_dev_remove == _TRUE) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->adapter_type == SECONDARY_ADAPTER)
+	{
+		DBG_871X(FUNC_NDEV_FMT" call netdev_if2_open\n", FUNC_NDEV_ARG(ndev));
+		if(netdev_if2_open(ndev) != 0) {
+			ret= -EPERM;
+			goto exit;
+		}
+	}
+	else if(padapter->adapter_type == PRIMARY_ADAPTER)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		DBG_871X(FUNC_NDEV_FMT" call netdev_open\n", FUNC_NDEV_ARG(ndev));
+		if(netdev_open(ndev) != 0) {
+			ret= -EPERM;
+			goto exit;
+		}
+	}
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+	old_type = rtw_wdev->iftype;
+	DBG_871X(FUNC_NDEV_FMT" old_iftype=%d, new_iftype=%d\n",
+		FUNC_NDEV_ARG(ndev), old_type, type);
+
+	if(old_type != type)
+	{
+		change = _TRUE;
+		pmlmeext->action_public_rxseq = 0xffff;
+		pmlmeext->action_public_dialog_token = 0xff;
+	}	
+		
+	switch (type) {
+	case NL80211_IFTYPE_ADHOC:
+		networkType = Ndis802_11IBSS;
+		break;
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+	case NL80211_IFTYPE_P2P_CLIENT:
+#endif
+	case NL80211_IFTYPE_STATION:
+		networkType = Ndis802_11Infrastructure;
+		#ifdef CONFIG_P2P
+		if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			if(change && rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+			{
+				_cancel_timer_ex( &pwdinfo->find_phase_timer );
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+
+				//it means remove GO and change mode from AP(GO) to station(P2P DEVICE)
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+				rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+
+				DBG_8192C("%s, role=%d, p2p_state=%d, pre_p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo), rtw_p2p_pre_state(pwdinfo));
+			}
+		}
+		#endif //CONFIG_P2P
+		break;
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+	case NL80211_IFTYPE_P2P_GO:
+#endif
+	case NL80211_IFTYPE_AP:
+		networkType = Ndis802_11APMode;
+		#ifdef CONFIG_P2P
+		if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			if(change && !rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+				//it means P2P Group created, we will be GO and change mode from  P2P DEVICE to AP(GO)
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+			}
+		}
+		#endif //CONFIG_P2P
+		break;		
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	rtw_wdev->iftype = type;
+	
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+	
+	if (rtw_set_802_11_infrastructure_mode(padapter, networkType) ==_FALSE)
+	{
+		rtw_wdev->iftype = old_type;
+		ret = -EPERM;
+		_exit_critical_bh(&queue->lock, &irqL);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		goto exit;
+	}
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	rtw_setopmode_cmd(padapter, networkType);	
+	
+exit:
+
+	return ret;
+}
+
+void rtw_cfg80211_indicate_scan_done(struct rtw_wdev_priv *pwdev_priv, bool aborted)
+{
+	_irqL	irqL;
+
+	_enter_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+	if(pwdev_priv->scan_request != NULL)
+	{
+		//struct cfg80211_scan_request *scan_request = pwdev_priv->scan_request;
+	
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("%s with scan req\n", __FUNCTION__);	
+		#endif
+
+		//avoid WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+		//if(scan_request == wiphy_to_dev(scan_request->wiphy)->scan_req)
+		if(pwdev_priv->scan_request->wiphy != pwdev_priv->rtw_wdev->wiphy)
+		{
+			DBG_8192C("error wiphy compare\n");
+		}
+		else
+		{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0))
+			cfg80211_scan_done(pwdev_priv->scan_request, aborted);
+#else
+			struct cfg80211_scan_info info = {
+				.aborted = aborted
+			};
+			cfg80211_scan_done(pwdev_priv->scan_request, &info);
+#endif
+		}
+
+		pwdev_priv->scan_request = NULL;
+		
+	} else {
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("%s without scan req\n", __FUNCTION__);
+		#endif
+	}
+	_exit_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+}
+
+void rtw_cfg80211_surveydone_event_callback(_adapter *padapter)
+{
+	_irqL	irqL;
+	_list					*plist, *phead;	
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);	
+	_queue				*queue	= &(pmlmepriv->scanned_queue);	
+	struct	wlan_network	*pnetwork = NULL;
+	u32 cnt=0;
+	u32 wait_for_surveydone;
+	sint wait_status;
+#ifdef CONFIG_P2P
+	struct	wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s\n", __func__);
+#endif
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//report network only if the current channel set contains the channel to which this network belongs
+		if(rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >= 0
+			&& rtw_mlme_band_check(padapter, pnetwork->network.Configuration.DSConfig) == _TRUE
+			&& _TRUE == rtw_validate_ssid(&(pnetwork->network.Ssid))
+		)
+		{		
+			//ev=translate_scan(padapter, a, pnetwork, ev, stop);
+			rtw_cfg80211_inform_bss(padapter, pnetwork);		
+		}
+
+		plist = get_next(plist);
+	
+	}
+	
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	
+	//call this after other things have been done
+	rtw_cfg80211_indicate_scan_done(wdev_to_priv(padapter->rtw_wdev), _FALSE);
+}
+
+static int rtw_cfg80211_set_probe_req_wpsp2pie(_adapter *padapter, char *buf, int len)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u8 *wps_ie;
+	u32	p2p_ielen = 0;	
+	u8 *p2p_ie;
+	u32	wfd_ielen = 0;	
+	u8 *wfd_ie;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+#endif
+	
+	if(len>0)
+	{
+		if((wps_ie = rtw_get_wps_ie(buf, len, NULL, &wps_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_req_wps_ielen=%d\n", wps_ielen);
+			#endif
+			
+			if(pmlmepriv->wps_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->wps_probe_req_ie_len;
+				pmlmepriv->wps_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_probe_req_ie, free_len);
+				pmlmepriv->wps_probe_req_ie = NULL;			
+			}	
+
+			pmlmepriv->wps_probe_req_ie = rtw_malloc(wps_ielen);
+			if ( pmlmepriv->wps_probe_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			_rtw_memcpy(pmlmepriv->wps_probe_req_ie, wps_ie, wps_ielen);
+			pmlmepriv->wps_probe_req_ie_len = wps_ielen;
+		}
+
+		//buf += wps_ielen;
+		//len -= wps_ielen;
+
+		#ifdef CONFIG_P2P
+		if((p2p_ie=rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen))) 
+		{
+			struct wifidirect_info *wdinfo = &padapter->wdinfo;
+			u32 attr_contentlen = 0;
+			u8 listen_ch_attr[5];
+
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_req_p2p_ielen=%d\n", p2p_ielen);
+			#endif
+			
+			if(pmlmepriv->p2p_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->p2p_probe_req_ie_len;
+				pmlmepriv->p2p_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->p2p_probe_req_ie, free_len);
+				pmlmepriv->p2p_probe_req_ie = NULL;
+			}	
+
+			pmlmepriv->p2p_probe_req_ie = rtw_malloc(p2p_ielen);
+			if ( pmlmepriv->p2p_probe_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			_rtw_memcpy(pmlmepriv->p2p_probe_req_ie, p2p_ie, p2p_ielen);
+			pmlmepriv->p2p_probe_req_ie_len = p2p_ielen;
+
+			if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_LISTEN_CH, (u8*)listen_ch_attr, (uint*) &attr_contentlen)
+				&& attr_contentlen == 5)
+			{
+				if (wdinfo->listen_channel !=  listen_ch_attr[4]) {
+					DBG_871X(FUNC_ADPT_FMT" listen channel - country:%c%c%c, class:%u, ch:%u\n",
+						FUNC_ADPT_ARG(padapter), listen_ch_attr[0], listen_ch_attr[1], listen_ch_attr[2],
+						listen_ch_attr[3], listen_ch_attr[4]);
+					wdinfo->listen_channel = listen_ch_attr[4];
+				}
+			}
+		}
+		#endif //CONFIG_P2P
+		
+		//buf += p2p_ielen;
+		//len -= p2p_ielen;
+
+		#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(buf, len, NULL, &wfd_ielen)) 
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_req_wfd_ielen=%d\n", wfd_ielen);
+			#endif
+			
+			if(pmlmepriv->wfd_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_probe_req_ie_len;
+				pmlmepriv->wfd_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_probe_req_ie, free_len);
+				pmlmepriv->wfd_probe_req_ie = NULL;
+			}	
+
+			pmlmepriv->wfd_probe_req_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_probe_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			rtw_get_wfd_ie(buf, len, pmlmepriv->wfd_probe_req_ie, &pmlmepriv->wfd_probe_req_ie_len);			
+		}
+		#endif //CONFIG_WFD
+		
+	}
+
+	return ret;
+	
+}
+
+static int cfg80211_rtw_scan(struct wiphy *wiphy
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+	, struct net_device *ndev
+	#endif
+	, struct cfg80211_scan_request *request)
+{
+	int i;
+	u8 _status = _FALSE;
+	int ret = 0;	
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	struct rtw_ieee80211_channel ch[RTW_CHANNEL_SCAN_AMOUNT];
+	_irqL	irqL;
+	u8 *wps_ie=NULL;
+	uint wps_ielen=0;	
+	u8 *p2p_ie=NULL;
+	uint p2p_ielen=0;
+	u8 survey_times=3;
+	u8 survey_times_for_one_ch=6;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);	
+#endif //CONFIG_P2P
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct cfg80211_ssid *ssids = request->ssids;
+	int social_channel = 0, j = 0;
+	bool need_indicate_scan_done = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE	
+	PADAPTER pbuddy_adapter = NULL;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+#endif //CONFIG_CONCURRENT_MODE
+
+//#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+//#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->pbuddy_adapter) {
+		pbuddy_adapter = padapter->pbuddy_adapter;
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);	
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_MP_INCLUDED
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		ret = -EPERM;
+		goto exit;
+	}
+#endif
+
+	_enter_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+	pwdev_priv->scan_request = request;
+	_exit_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("%s under WIFI_AP_STATE\n", __FUNCTION__);
+#endif
+
+		if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS|_FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		{
+			DBG_8192C("%s, fwstate=0x%x\n", __func__, pmlmepriv->fw_state);
+
+			if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+			{
+				DBG_8192C("AP mode process WPS \n");
+			}
+
+			need_indicate_scan_done = _TRUE;
+			goto check_need_indicate_scan_done;
+		}
+	}
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+
+	#ifdef CONFIG_P2P
+	if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(ssids->ssid != NULL
+			&& _rtw_memcmp(ssids->ssid, "DIRECT-", 7)
+			&& rtw_get_p2p_ie((u8 *)request->ie, request->ie_len, NULL, NULL)
+		)
+		{
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+				u32 initialgain = 0x30;
+				rtw_p2p_enable(padapter, P2P_ROLE_DEVICE);
+				wdev_to_priv(padapter->rtw_wdev)->p2p_enabled = _TRUE;
+				padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_INITIAL_GAIN, (u8 *)&(initialgain));
+				padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_INITIAL_GAIN, (u8 *)&(initialgain));
+			}
+			else
+			{
+				rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+				#ifdef CONFIG_DEBUG_CFG80211
+				DBG_8192C("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+				#endif
+			}
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+		
+			if(request->n_channels == 3 &&
+				request->channels[0]->hw_value == 1 &&
+				request->channels[1]->hw_value == 6 &&
+				request->channels[2]->hw_value == 11
+			)
+			{
+				social_channel = 1;
+			}
+		}
+	}
+	#endif //CONFIG_P2P
+
+	if(request->ie && request->ie_len>0)
+	{
+		rtw_cfg80211_set_probe_req_wpsp2pie(padapter, (u8 *)request->ie, request->ie_len );
+	}
+
+	if (pmlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE)
+	{
+		DBG_8192C("%s, bBusyTraffic == _TRUE\n", __func__);
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+	if (rtw_is_scan_deny(padapter)){
+		DBG_871X(FUNC_ADPT_FMT  ": scan deny\n", FUNC_ADPT_ARG(padapter));
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pbuddy_mlmepriv && (pbuddy_mlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE))	
+	{
+		DBG_8192C("%s, bBusyTraffic == _TRUE at buddy_intf\n", __func__);
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{
+		DBG_8192C("%s, fwstate=0x%x\n", __func__, pmlmepriv->fw_state);
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	} 
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter,
+		_FW_UNDER_SURVEY|_FW_UNDER_LINKING|WIFI_UNDER_WPS) == _TRUE)
+	{		
+		if(check_buddy_fwstate(padapter, _FW_UNDER_SURVEY))
+		{
+			DBG_8192C("scanning_via_buddy_intf\n");
+			pmlmepriv->scanning_via_buddy_intf = _TRUE;
+		}		
+
+		DBG_8192C("buddy_intf's mlme state:0x%x\n", pbuddy_mlmepriv->fw_state);
+		
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+#endif
+
+
+#ifdef CONFIG_P2P
+	if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) && !rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+		{
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+			rtw_free_network_queue(padapter, _TRUE);
+
+			if(social_channel == 0)
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+			else
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_SOCIAL_LAST);
+		}
+	}
+#endif //CONFIG_P2P
+
+
+	_rtw_memset(ssid, 0, sizeof(NDIS_802_11_SSID)*RTW_SSID_SCAN_AMOUNT);
+	//parsing request ssids, n_ssids
+	for (i = 0; i < request->n_ssids && i < RTW_SSID_SCAN_AMOUNT; i++) {
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("ssid=%s, len=%d\n", ssids[i].ssid, ssids[i].ssid_len);
+		#endif
+		_rtw_memcpy(ssid[i].Ssid, ssids[i].ssid, ssids[i].ssid_len);
+		ssid[i].SsidLength = ssids[i].ssid_len;	
+	}
+	
+
+	/* parsing channels, n_channels */
+	_rtw_memset(ch, 0, sizeof(struct rtw_ieee80211_channel)*RTW_CHANNEL_SCAN_AMOUNT);
+	for (i=0;i<request->n_channels && i<RTW_CHANNEL_SCAN_AMOUNT;i++) {
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X(FUNC_ADPT_FMT CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(request->channels[i]));
+		#endif
+		ch[i].hw_value = request->channels[i]->hw_value;
+		ch[i].flags = request->channels[i]->flags;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	if (request->n_channels == 1) {
+		for(i=1;i<survey_times_for_one_ch;i++)
+			_rtw_memcpy(&ch[i], &ch[0], sizeof(struct rtw_ieee80211_channel));
+		_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, ch, survey_times_for_one_ch);
+	} else if (request->n_channels == 2) {
+		_rtw_memcpy(&ch[3], &ch[1], sizeof(struct rtw_ieee80211_channel));
+		for(i=1;i<survey_times;i++) {
+			_rtw_memcpy(&ch[i], &ch[0], sizeof(struct rtw_ieee80211_channel));
+			_rtw_memcpy(&ch[i+3], &ch[3], sizeof(struct rtw_ieee80211_channel));
+		}
+		_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, ch, survey_times * 2);
+	} else {
+		_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, NULL, 0);
+	}
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	if(_status == _FALSE)
+	{
+		ret = -1;
+	}
+
+check_need_indicate_scan_done:
+	if(need_indicate_scan_done)
+		rtw_cfg80211_surveydone_event_callback(padapter);
+
+exit:
+
+	return ret;
+	
+}
+
+static int cfg80211_rtw_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+
+	if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+	    (iwm->conf.rts_threshold != wiphy->rts_threshold)) {
+		int ret;
+
+		iwm->conf.rts_threshold = wiphy->rts_threshold;
+
+		ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+					     CFG_RTS_THRESHOLD,
+					     iwm->conf.rts_threshold);
+		if (ret < 0)
+			return ret;
+	}
+
+	if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+	    (iwm->conf.frag_threshold != wiphy->frag_threshold)) {
+		int ret;
+
+		iwm->conf.frag_threshold = wiphy->frag_threshold;
+
+		ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_FA_CFG_FIX,
+					     CFG_FRAG_THRESHOLD,
+					     iwm->conf.frag_threshold);
+		if (ret < 0)
+			return ret;
+	}
+#endif
+	DBG_8192C("%s\n", __func__);
+	return 0;
+}
+
+static int cfg80211_rtw_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
+				  struct cfg80211_ibss_params *params)
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+	struct ieee80211_channel *chan = params->channel;
+
+	if (!test_bit(IWM_STATUS_READY, &iwm->status))
+		return -EIO;
+
+	/* UMAC doesn't support creating or joining an IBSS network
+	 * with specified bssid. */
+	if (params->bssid)
+		return -EOPNOTSUPP;
+
+	iwm->channel = ieee80211_frequency_to_channel(chan->center_freq);
+	iwm->umac_profile->ibss.band = chan->band;
+	iwm->umac_profile->ibss.channel = iwm->channel;
+	iwm->umac_profile->ssid.ssid_len = params->ssid_len;
+	memcpy(iwm->umac_profile->ssid.ssid, params->ssid, params->ssid_len);
+
+	return iwm_send_mlme_profile(iwm);
+#endif	
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+static int cfg80211_rtw_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+
+	if (iwm->umac_profile_active)
+		return iwm_invalidate_mlme_profile(iwm);
+#endif
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+static int rtw_cfg80211_set_wpa_version(struct security_priv *psecuritypriv, u32 wpa_version)
+{	
+	DBG_8192C("%s, wpa_version=%d\n", __func__, wpa_version);
+	
+	if (!wpa_version) {		
+		psecuritypriv->ndisauthtype = Ndis802_11AuthModeOpen;		
+		return 0;
+	}
+
+
+	if (wpa_version & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
+	{		
+		psecuritypriv->ndisauthtype = Ndis802_11AuthModeWPAPSK;		
+	}
+
+/*
+	if (wpa_version & NL80211_WPA_VERSION_2)
+	{		
+		psecuritypriv->ndisauthtype = Ndis802_11AuthModeWPA2PSK;
+	}
+*/
+
+	return 0;
+
+}
+
+static int rtw_cfg80211_set_auth_type(struct security_priv *psecuritypriv,
+			     enum nl80211_auth_type sme_auth_type)
+{
+	DBG_8192C("%s, nl80211_auth_type=%d\n", __func__, sme_auth_type);
+
+
+	switch (sme_auth_type) {
+	case NL80211_AUTHTYPE_AUTOMATIC:
+
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+
+		break;
+	case NL80211_AUTHTYPE_OPEN_SYSTEM:
+	
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
+
+		if(psecuritypriv->ndisauthtype>Ndis802_11AuthModeWPA)
+			psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
+		
+		break;
+	case NL80211_AUTHTYPE_SHARED_KEY:
+
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Shared;
+
+		psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+
+		break;
+	default:		
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
+		//return -ENOTSUPP;
+	}
+
+	return 0;
+
+}
+
+static int rtw_cfg80211_set_cipher(struct security_priv *psecuritypriv, u32 cipher, bool ucast)
+{
+	u32 ndisencryptstatus = Ndis802_11EncryptionDisabled;
+
+	u32 *profile_cipher = ucast ? &psecuritypriv->dot11PrivacyAlgrthm :
+		&psecuritypriv->dot118021XGrpPrivacy;
+
+	DBG_8192C("%s, ucast=%d, cipher=0x%x\n", __func__, ucast, cipher);
+
+
+	if (!cipher) {
+		*profile_cipher = _NO_PRIVACY_;
+		psecuritypriv->ndisencryptstatus = ndisencryptstatus;
+		return 0;
+	}
+	
+	switch (cipher) {
+	case IW_AUTH_CIPHER_NONE:
+		*profile_cipher = _NO_PRIVACY_;
+		ndisencryptstatus = Ndis802_11EncryptionDisabled;
+		break;
+	case WLAN_CIPHER_SUITE_WEP40:
+		*profile_cipher = _WEP40_;
+		ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		break;
+	case WLAN_CIPHER_SUITE_WEP104:
+		*profile_cipher = _WEP104_;
+		ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		break;
+	case WLAN_CIPHER_SUITE_TKIP:
+		*profile_cipher = _TKIP_;
+		ndisencryptstatus = Ndis802_11Encryption2Enabled;
+		break;
+	case WLAN_CIPHER_SUITE_CCMP:
+		*profile_cipher = _AES_;
+		ndisencryptstatus = Ndis802_11Encryption3Enabled;
+		break;
+	default:
+		DBG_8192C("Unsupported cipher: 0x%x\n", cipher);
+		return -ENOTSUPP;
+	}
+
+	if(ucast)
+	{
+		psecuritypriv->ndisencryptstatus = ndisencryptstatus;
+		
+		//if(psecuritypriv->dot11PrivacyAlgrthm >= _AES_)
+		//	psecuritypriv->ndisauthtype = Ndis802_11AuthModeWPA2PSK;
+	}	
+
+	return 0;
+}
+
+static int rtw_cfg80211_set_key_mgt(struct security_priv *psecuritypriv, u32 key_mgt)
+{
+	DBG_8192C("%s, key_mgt=0x%x\n", __func__, key_mgt);
+
+	if (key_mgt == WLAN_AKM_SUITE_8021X)
+		//*auth_type = UMAC_AUTH_TYPE_8021X;
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
+	else if (key_mgt == WLAN_AKM_SUITE_PSK) {
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
+	} else {
+		DBG_8192C("Invalid key mgt: 0x%x\n", key_mgt);
+		//return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int rtw_cfg80211_set_wpa_ie(_adapter *padapter, const u8 *pie, size_t ielen)
+{
+	u8 *buf=NULL, *pos=NULL;	
+	u32 left; 	
+	int group_cipher = 0, pairwise_cipher = 0;
+	int ret = 0;
+	int wpa_ielen=0;
+	int wpa2_ielen=0;
+	u8 *pwpa, *pwpa2;
+	u8 null_addr[]= {0,0,0,0,0,0};
+
+	if (pie == NULL || !ielen) {
+		/* Treat this as normal case, but need to clear WIFI_UNDER_WPS */
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		goto exit;
+	}
+
+	if (ielen > MAX_WPA_IE_LEN+MAX_WPS_IE_LEN+MAX_P2P_IE_LEN) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	buf = rtw_zmalloc(ielen);
+	if (buf == NULL){
+		ret =  -ENOMEM;
+		goto exit;
+	}
+
+	_rtw_memcpy(buf, pie , ielen);
+
+	//dump
+	{
+		int i;
+		DBG_8192C("set wpa_ie(length:%zu):\n", ielen);
+		for(i=0;i<ielen;i=i+8)
+			DBG_8192C("0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x \n",buf[i],buf[i+1],buf[i+2],buf[i+3],buf[i+4],buf[i+5],buf[i+6],buf[i+7]);
+	}
+
+	pos = buf;
+	if(ielen < RSN_HEADER_LEN){
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("Ie len too short %d\n", ielen));
+		ret  = -1;
+		goto exit;
+	}
+
+	pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen);
+	if(pwpa && wpa_ielen>0)
+	{
+		if(rtw_parse_wpa_ie(pwpa, wpa_ielen+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPAPSK;
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen+2);
+			
+			DBG_8192C("got wpa_ie, wpa_ielen:%u\n", wpa_ielen);
+		}
+	}
+
+	pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen);
+	if(pwpa2 && wpa2_ielen>0)
+	{
+		if(rtw_parse_wpa2_ie(pwpa2, wpa2_ielen+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPA2PSK;	
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &pwpa2[0], wpa2_ielen+2);
+
+			DBG_8192C("got wpa2_ie, wpa2_ielen:%u\n", wpa2_ielen);
+		}
+	}
+
+	if (group_cipher == 0)
+	{
+		group_cipher = WPA_CIPHER_NONE;
+	}
+	if (pairwise_cipher == 0)
+	{
+		pairwise_cipher = WPA_CIPHER_NONE;
+	}
+	
+	switch(group_cipher)
+	{
+		case WPA_CIPHER_NONE:
+			padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+			padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+			break;
+		case WPA_CIPHER_WEP40:
+			padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+		case WPA_CIPHER_TKIP:
+			padapter->securitypriv.dot118021XGrpPrivacy=_TKIP_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+			break;
+		case WPA_CIPHER_CCMP:
+			padapter->securitypriv.dot118021XGrpPrivacy=_AES_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+			break;
+		case WPA_CIPHER_WEP104:	
+			padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+	}
+
+	switch(pairwise_cipher)
+	{
+		case WPA_CIPHER_NONE:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+			padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+			break;
+		case WPA_CIPHER_WEP40:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+		case WPA_CIPHER_TKIP:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_TKIP_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+			break;
+		case WPA_CIPHER_CCMP:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_AES_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+			break;
+		case WPA_CIPHER_WEP104:	
+			padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+	}
+	
+	{/* handle wps_ie */
+		uint wps_ielen;	
+		u8 *wps_ie;
+
+		wps_ie = rtw_get_wps_ie(buf, ielen, NULL, &wps_ielen);
+		if (wps_ie && wps_ielen > 0) {
+			DBG_8192C("got wps_ie, wps_ielen:%u\n", wps_ielen);
+			padapter->securitypriv.wps_ie_len = wps_ielen<MAX_WPS_IE_LEN?wps_ielen:MAX_WPS_IE_LEN;
+			_rtw_memcpy(padapter->securitypriv.wps_ie, wps_ie, padapter->securitypriv.wps_ie_len);
+			set_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		} else {
+			_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		}
+	}
+
+	#ifdef CONFIG_P2P
+	{//check p2p_ie for assoc req; 
+		uint p2p_ielen=0;
+		u8 *p2p_ie;
+		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+		if((p2p_ie=rtw_get_p2p_ie(buf, ielen, NULL, &p2p_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("%s p2p_assoc_req_ielen=%d\n", __FUNCTION__, p2p_ielen);
+			#endif
+
+			if(pmlmepriv->p2p_assoc_req_ie)
+			{
+				u32 free_len = pmlmepriv->p2p_assoc_req_ie_len;
+				pmlmepriv->p2p_assoc_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->p2p_assoc_req_ie, free_len);
+				pmlmepriv->p2p_assoc_req_ie = NULL;
+			}
+
+			pmlmepriv->p2p_assoc_req_ie = rtw_malloc(p2p_ielen);
+			if ( pmlmepriv->p2p_assoc_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				goto exit;
+			}
+			_rtw_memcpy(pmlmepriv->p2p_assoc_req_ie, p2p_ie, p2p_ielen);
+			pmlmepriv->p2p_assoc_req_ie_len = p2p_ielen;
+		}
+	}
+	#endif //CONFIG_P2P
+
+	#ifdef CONFIG_WFD
+	{//check wfd_ie for assoc req; 
+		uint wfd_ielen=0;
+		u8 *wfd_ie;
+		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+		if(rtw_get_wfd_ie(buf, ielen, NULL, &wfd_ielen))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("%s wfd_assoc_req_ielen=%d\n", __FUNCTION__, wfd_ielen);
+			#endif
+
+			if(pmlmepriv->wfd_assoc_req_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_assoc_req_ie_len;
+				pmlmepriv->wfd_assoc_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_assoc_req_ie, free_len);
+				pmlmepriv->wfd_assoc_req_ie = NULL;
+			}
+
+			pmlmepriv->wfd_assoc_req_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_assoc_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				goto exit;
+			}
+			rtw_get_wfd_ie(buf, ielen, pmlmepriv->wfd_assoc_req_ie, &pmlmepriv->wfd_assoc_req_ie_len);			
+		}
+	}
+	#endif //CONFIG_WFD
+
+	//TKIP and AES disallow multicast packets until installing group key
+	if(padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)
+		//WPS open need to enable multicast
+		//|| check_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS) == _TRUE)
+		rtw_hal_set_hwreg(padapter, HW_VAR_OFF_RCR_AM, null_addr);
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		("rtw_set_wpa_ie: pairwise_cipher=0x%08x padapter->securitypriv.ndisencryptstatus=%d padapter->securitypriv.ndisauthtype=%d\n",
+		pairwise_cipher, padapter->securitypriv.ndisencryptstatus, padapter->securitypriv.ndisauthtype));
+
+exit:
+	if (buf)
+		rtw_mfree(buf, ielen);
+	if (ret)
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+	return ret;
+}
+
+static int cfg80211_rtw_connect(struct wiphy *wiphy, struct net_device *ndev,
+				 struct cfg80211_connect_params *sme)
+{
+	int ret=0;
+	_irqL irqL;	
+	_list *phead;	
+	struct wlan_network *pnetwork = NULL;
+	NDIS_802_11_AUTHENTICATION_MODE authmode;	
+	NDIS_802_11_SSID ndis_ssid;	
+	u8 *dst_ssid, *src_ssid;
+	u8 *dst_bssid, *src_bssid;
+	//u8 matched_by_bssid=_FALSE;
+	//u8 matched_by_ssid=_FALSE;
+	u8 matched=_FALSE;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;	
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	_queue *queue = &pmlmepriv->scanned_queue;	
+	
+	DBG_871X("=>"FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	DBG_871X("privacy=%d, key=%p, key_len=%d, key_idx=%d\n",
+		sme->privacy, sme->key, sme->key_len, sme->key_idx);
+
+
+	if(wdev_to_priv(padapter->rtw_wdev)->block == _TRUE)
+	{
+		ret = -EBUSY;
+		DBG_871X("%s wdev_priv.block is set\n", __FUNCTION__);
+		goto exit;
+	}
+
+#ifdef CONFIG_PLATFORM_MSTAR
+	printk("MStar Android!\n");
+	if((wdev_to_priv(padapter->rtw_wdev))->bandroid_scan == _FALSE)
+	{
+#ifdef CONFIG_P2P
+		struct wifidirect_info *pwdinfo= &(padapter->wdinfo);	
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+#endif //CONFIG_P2P
+		{
+			ret = -EBUSY;
+			printk("Android hasn't attached yet!\n");
+			goto exit;
+		}	
+	}
+#endif
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
+		ret = -EPERM;
+		goto exit;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_LINKING) == _TRUE) {
+		DBG_8192C("%s, but buddy_intf is under linking\n", __FUNCTION__);
+		ret = -EINVAL;
+		goto exit;
+	}
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY) == _TRUE) {
+		rtw_scan_abort(padapter->pbuddy_adapter);
+	}
+#endif
+
+	if (!sme->ssid || !sme->ssid_len)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (sme->ssid_len > IW_ESSID_MAX_SIZE){
+
+		ret= -E2BIG;
+		goto exit;
+	}
+	
+	_rtw_memset(&ndis_ssid, 0, sizeof(NDIS_802_11_SSID));			
+	ndis_ssid.SsidLength = sme->ssid_len;
+	_rtw_memcpy(ndis_ssid.Ssid, sme->ssid, sme->ssid_len);
+
+	DBG_8192C("ssid=%s, len=%zu\n", ndis_ssid.Ssid, sme->ssid_len);
+	
+
+	if (sme->bssid)
+		DBG_8192C("bssid="MAC_FMT"\n", MAC_ARG(sme->bssid));
+
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		ret = -EBUSY;
+		DBG_8192C("%s, fw_state=0x%x, goto exit\n", __FUNCTION__, pmlmepriv->fw_state);
+		goto exit;		
+	}
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		rtw_scan_abort(padapter);
+	}
+
+	psecuritypriv->ndisencryptstatus = Ndis802_11EncryptionDisabled;
+	psecuritypriv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
+	psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+	psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open; //open system
+	psecuritypriv->ndisauthtype = Ndis802_11AuthModeOpen;
+
+
+	ret = rtw_cfg80211_set_wpa_version(psecuritypriv, sme->crypto.wpa_versions);
+	if (ret < 0)
+		goto exit;
+
+	ret = rtw_cfg80211_set_auth_type(psecuritypriv, sme->auth_type);
+	if (ret < 0)
+		goto exit;
+
+	DBG_8192C("%s, ie_len=%zu\n", __func__, sme->ie_len);
+			
+	ret = rtw_cfg80211_set_wpa_ie(padapter, sme->ie, sme->ie_len);
+	if (ret < 0)
+		goto exit;
+
+	if (sme->crypto.n_ciphers_pairwise) {		
+		ret = rtw_cfg80211_set_cipher(psecuritypriv, sme->crypto.ciphers_pairwise[0], _TRUE);
+		if (ret < 0)
+			goto exit;
+	}
+
+	//For WEP Shared auth
+	if((psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_Shared
+		|| psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_Auto) && sme->key
+	)
+	{
+		u32 wep_key_idx, wep_key_len,wep_total_len;
+		NDIS_802_11_WEP	 *pwep = NULL;
+		DBG_871X("%s(): Shared/Auto WEP\n",__FUNCTION__);
+
+		wep_key_idx = sme->key_idx;
+		wep_key_len = sme->key_len;
+
+		if (sme->key_idx > WEP_KEYS) {
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		if (wep_key_len > 0) 
+		{
+		 	wep_key_len = wep_key_len <= 5 ? 5 : 13;
+			wep_total_len = wep_key_len + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+		 	pwep =(NDIS_802_11_WEP	 *) rtw_malloc(wep_total_len);
+			if(pwep == NULL){
+				DBG_871X(" wpa_set_encryption: pwep allocate fail !!!\n");
+				ret = -ENOMEM;
+				goto exit;
+			}
+
+		 	_rtw_memset(pwep, 0, wep_total_len);
+
+		 	pwep->KeyLength = wep_key_len;
+			pwep->Length = wep_total_len;
+
+			if(wep_key_len==13)
+			{
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+			}
+		}
+		else {		
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		pwep->KeyIndex = wep_key_idx;
+		pwep->KeyIndex |= 0x80000000;
+
+		_rtw_memcpy(pwep->KeyMaterial,  (void *)sme->key, pwep->KeyLength);
+
+		if(rtw_set_802_11_add_wep(padapter, pwep) == (u8)_FAIL)
+		{
+			ret = -EOPNOTSUPP ;
+		}
+
+		if (pwep) {
+			rtw_mfree((u8 *)pwep,wep_total_len);		
+		}
+
+		if(ret < 0)
+			goto exit;
+	}
+
+	ret = rtw_cfg80211_set_cipher(psecuritypriv, sme->crypto.cipher_group, _FALSE);
+	if (ret < 0)
+		return ret;
+
+	if (sme->crypto.n_akm_suites) {
+		ret = rtw_cfg80211_set_key_mgt(psecuritypriv, sme->crypto.akm_suites[0]);
+		if (ret < 0)
+			goto exit;
+	}
+
+	authmode = psecuritypriv->ndisauthtype;
+	rtw_set_802_11_authentication_mode(padapter, authmode);
+
+	//rtw_set_802_11_encryption_mode(padapter, padapter->securitypriv.ndisencryptstatus);
+
+	if (rtw_set_802_11_connect(padapter, sme->bssid, &ndis_ssid) == _FALSE) {
+		ret = -1;
+		goto exit;
+	}
+
+	DBG_8192C("set ssid:dot11AuthAlgrthm=%d, dot11PrivacyAlgrthm=%d, dot118021XGrpPrivacy=%d\n", psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm, psecuritypriv->dot118021XGrpPrivacy);
+	
+exit:
+
+	DBG_8192C("<=%s, ret %d\n",__FUNCTION__, ret);
+	
+	return ret;
+}
+
+static int cfg80211_rtw_disconnect(struct wiphy *wiphy, struct net_device *ndev,
+				   u16 reason_code)
+{
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	rtw_set_roaming(padapter, 0);
+
+	if(check_fwstate(&padapter->mlmepriv, _FW_LINKED)) 
+	{
+		rtw_scan_abort(padapter);
+		LeaveAllPowerSaveMode(padapter);
+		rtw_disassoc_cmd(padapter, 500, _FALSE);
+		
+		DBG_871X("%s...call rtw_indicate_disconnect\n", __FUNCTION__);
+		
+		padapter->mlmepriv.not_indic_disco = _TRUE;
+		rtw_indicate_disconnect(padapter);
+		padapter->mlmepriv.not_indic_disco = _FALSE;
+		
+		rtw_free_assoc_resources(padapter, 1);
+	}
+	
+	return 0;
+}
+
+static int cfg80211_rtw_set_txpower(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
+	struct wireless_dev *wdev,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,36)) || defined(COMPAT_KERNEL_RELEASE)
+	enum nl80211_tx_power_setting type, int mbm)
+#else
+	enum tx_power_setting type, int dbm)
+#endif
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+	int ret;
+
+	switch (type) {
+	case NL80211_TX_POWER_AUTOMATIC:
+		return 0;
+	case NL80211_TX_POWER_FIXED:
+		if (mbm < 0 || (mbm % 100))
+			return -EOPNOTSUPP;
+
+		if (!test_bit(IWM_STATUS_READY, &iwm->status))
+			return 0;
+
+		ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+					      CFG_TX_PWR_LIMIT_USR,
+					      MBM_TO_DBM(mbm) * 2);
+		if (ret < 0)
+			return ret;
+
+		return iwm_tx_power_trigger(iwm);
+	default:
+		IWM_ERR(iwm, "Unsupported power type: %d\n", type);
+		return -EOPNOTSUPP;
+	}
+#endif
+	DBG_8192C("%s\n", __func__);
+	return 0;
+}
+
+static int cfg80211_rtw_get_txpower(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
+	struct wireless_dev *wdev,
+#endif
+	int *dbm)
+{
+	//_adapter *padapter = wiphy_to_adapter(wiphy);
+
+	DBG_8192C("%s\n", __func__);
+
+	*dbm = (12);
+	
+	return 0;
+}
+
+inline bool rtw_cfg80211_pwr_mgmt(_adapter *adapter)
+{
+	struct rtw_wdev_priv *rtw_wdev_priv = wdev_to_priv(adapter->rtw_wdev);
+	return rtw_wdev_priv->power_mgmt;
+}
+
+static int cfg80211_rtw_set_power_mgmt(struct wiphy *wiphy,
+				       struct net_device *ndev,
+				       bool enabled, int timeout)
+{
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *rtw_wdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	
+	DBG_871X(FUNC_NDEV_FMT" enabled:%u, timeout:%d\n", FUNC_NDEV_ARG(ndev),
+		enabled, timeout);
+
+	rtw_wdev_priv->power_mgmt = enabled;
+
+	#ifdef CONFIG_LPS
+	if (!enabled)
+		LPS_Leave(padapter);
+	#endif
+
+	return 0;
+}
+
+static int cfg80211_rtw_set_pmksa(struct wiphy *wiphy,
+				  struct net_device *netdev,
+				  struct cfg80211_pmksa *pmksa)
+{
+	u8	index,blInserted = _FALSE;
+	_adapter	*padapter = wiphy_to_adapter(wiphy);
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	u8	strZeroMacAddress[ ETH_ALEN ] = { 0x00 };
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(netdev));
+
+	if ( _rtw_memcmp( pmksa->bssid, strZeroMacAddress, ETH_ALEN ) == _TRUE )
+	{
+		return -EINVAL;
+	}
+
+	blInserted = _FALSE;
+	
+	//overwrite PMKID
+	for(index=0 ; index<NUM_PMKID_CACHE; index++)
+	{
+		if( _rtw_memcmp( psecuritypriv->PMKIDList[index].Bssid, pmksa->bssid, ETH_ALEN) ==_TRUE )
+		{ // BSSID is matched, the same AP => rewrite with new PMKID.
+			DBG_871X(FUNC_NDEV_FMT" BSSID exists in the PMKList.\n", FUNC_NDEV_ARG(netdev));
+
+			_rtw_memcpy( psecuritypriv->PMKIDList[index].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
+			psecuritypriv->PMKIDList[index].bUsed = _TRUE;
+			psecuritypriv->PMKIDIndex = index+1;
+			blInserted = _TRUE;
+			break;
+		}	
+	}
+
+	if(!blInserted)
+	{
+		// Find a new entry
+		DBG_871X(FUNC_NDEV_FMT" Use the new entry index = %d for this PMKID.\n",
+			FUNC_NDEV_ARG(netdev), psecuritypriv->PMKIDIndex );
+
+		_rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].Bssid, pmksa->bssid, ETH_ALEN);
+		_rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
+
+		psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].bUsed = _TRUE;
+		psecuritypriv->PMKIDIndex++ ;
+		if(psecuritypriv->PMKIDIndex==16)
+		{
+			psecuritypriv->PMKIDIndex =0;
+		} 
+	} 
+
+	return 0;
+}
+
+static int cfg80211_rtw_del_pmksa(struct wiphy *wiphy,
+				  struct net_device *netdev,
+				  struct cfg80211_pmksa *pmksa)
+{
+	u8	index, bMatched = _FALSE;
+	_adapter	*padapter = wiphy_to_adapter(wiphy);
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(netdev));
+
+	for(index=0 ; index<NUM_PMKID_CACHE; index++)
+	{
+		if( _rtw_memcmp( psecuritypriv->PMKIDList[index].Bssid, pmksa->bssid, ETH_ALEN) ==_TRUE )
+		{ // BSSID is matched, the same AP => Remove this PMKID information and reset it. 
+			_rtw_memset( psecuritypriv->PMKIDList[index].Bssid, 0x00, ETH_ALEN );
+			_rtw_memset( psecuritypriv->PMKIDList[index].PMKID, 0x00, WLAN_PMKID_LEN );
+			psecuritypriv->PMKIDList[index].bUsed = _FALSE;
+			bMatched = _TRUE;
+			break;
+		}	
+	}
+
+	if(_FALSE == bMatched)
+	{
+		DBG_871X(FUNC_NDEV_FMT" do not have matched BSSID\n"
+			, FUNC_NDEV_ARG(netdev));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cfg80211_rtw_flush_pmksa(struct wiphy *wiphy,
+				    struct net_device *netdev)
+{
+	_adapter	*padapter = wiphy_to_adapter(wiphy);
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(netdev));
+
+	_rtw_memset( &psecuritypriv->PMKIDList[ 0 ], 0x00, sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+	psecuritypriv->PMKIDIndex = 0;
+
+	return 0;
+}
+
+#ifdef CONFIG_AP_MODE
+void rtw_cfg80211_indicate_sta_assoc(_adapter *padapter, u8 *pmgmt_frame, uint frame_len)
+{
+	s32 freq;
+	int channel;
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);	
+	struct net_device *ndev = padapter->pnetdev;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+#if defined(RTW_USE_CFG80211_STA_EVENT) || defined(COMPAT_KERNEL_RELEASE)
+	{
+		struct station_info sinfo;
+		u8 ie_offset;
+		if (GetFrameSubType(pmgmt_frame) == WIFI_ASSOCREQ)
+			ie_offset = _ASOCREQ_IE_OFFSET_;
+		else // WIFI_REASSOCREQ
+			ie_offset = _REASOCREQ_IE_OFFSET_;
+	
+		sinfo.filled = 0;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,0,0))
+		sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
+#endif
+		sinfo.assoc_req_ies = pmgmt_frame + WLAN_HDR_A3_LEN + ie_offset;
+		sinfo.assoc_req_ies_len = frame_len - WLAN_HDR_A3_LEN - ie_offset;
+		cfg80211_new_sta(ndev, GetAddr2Ptr(pmgmt_frame), &sinfo, GFP_ATOMIC);
+	}
+#else /* defined(RTW_USE_CFG80211_STA_EVENT) */
+	channel = pmlmeext->cur_channel;
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+	#ifdef COMPAT_KERNEL_RELEASE
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+	#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+	#else //COMPAT_KERNEL_RELEASE
+	{
+		//to avoid WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION)  when calling cfg80211_send_rx_assoc()
+		#ifndef CONFIG_PLATFORM_MSTAR
+		pwdev->iftype = NL80211_IFTYPE_STATION;
+		#endif //CONFIG_PLATFORM_MSTAR
+		DBG_8192C("iftype=%d before call cfg80211_send_rx_assoc()\n", pwdev->iftype);
+		rtw_cfg80211_send_rx_assoc(padapter, NULL, pmgmt_frame, frame_len);
+		DBG_8192C("iftype=%d after call cfg80211_send_rx_assoc()\n", pwdev->iftype);
+		pwdev->iftype = NL80211_IFTYPE_AP;
+		//cfg80211_rx_action(padapter->pnetdev, freq, pmgmt_frame, frame_len, GFP_ATOMIC);
+	}
+	#endif //COMPAT_KERNEL_RELEASE
+#endif /* defined(RTW_USE_CFG80211_STA_EVENT) */
+
+}
+
+void rtw_cfg80211_indicate_sta_disassoc(_adapter *padapter, unsigned char *da, unsigned short reason)
+{
+	s32 freq;
+	int channel;
+	u8 *pmgmt_frame;
+	uint frame_len;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;	
+	u8 mgmt_buf[128] = {0};
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct net_device *ndev = padapter->pnetdev;
+	
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+#if defined(RTW_USE_CFG80211_STA_EVENT) || defined(COMPAT_KERNEL_RELEASE)
+	cfg80211_del_sta(ndev, da, GFP_ATOMIC);
+#else /* defined(RTW_USE_CFG80211_STA_EVENT) */
+	channel = pmlmeext->cur_channel;
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+	pmgmt_frame = mgmt_buf;	
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pmgmt_frame;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	//_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	//_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr1, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, da, ETH_ALEN);	
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pmgmt_frame, WIFI_DEAUTH);
+
+	pmgmt_frame += sizeof(struct rtw_ieee80211_hdr_3addr);
+	frame_len = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	reason = cpu_to_le16(reason);
+	pmgmt_frame = rtw_set_fixed_ie(pmgmt_frame, _RSON_CODE_ , (unsigned char *)&reason, &frame_len);
+
+	#ifdef COMPAT_KERNEL_RELEASE
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, mgmt_buf, frame_len, GFP_ATOMIC);
+	#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, mgmt_buf, frame_len, GFP_ATOMIC);
+	#else //COMPAT_KERNEL_RELEASE
+	cfg80211_send_disassoc(padapter->pnetdev, mgmt_buf, frame_len);	
+	//cfg80211_rx_action(padapter->pnetdev, freq, mgmt_buf, frame_len, GFP_ATOMIC);
+	#endif //COMPAT_KERNEL_RELEASE
+#endif /* defined(RTW_USE_CFG80211_STA_EVENT) */
+}
+
+static int rtw_cfg80211_monitor_if_open(struct net_device *ndev)
+{
+	int ret = 0;
+
+	DBG_8192C("%s\n", __func__);
+	
+	return ret;
+}
+
+static int rtw_cfg80211_monitor_if_close(struct net_device *ndev)
+{
+	int ret = 0;
+
+	DBG_8192C("%s\n", __func__);
+	
+	return ret;
+}
+
+static int rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struct net_device *ndev)
+{	
+	int ret = 0;
+	int rtap_len;
+	int qos_len = 0;
+	int dot11_hdr_len = 24;
+	int snap_len = 6;
+	unsigned char *pdata;
+	u16 frame_ctl;
+	unsigned char src_mac_addr[6];
+	unsigned char dst_mac_addr[6];
+	struct ieee80211_hdr *dot11_hdr;
+	struct ieee80211_radiotap_header *rtap_hdr;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	if (skb)
+		rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, skb->truesize);
+
+	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
+		goto fail;
+
+	rtap_hdr = (struct ieee80211_radiotap_header *)skb->data;
+	if (unlikely(rtap_hdr->it_version))
+		goto fail;
+
+	rtap_len = ieee80211_get_radiotap_len(skb->data);
+	if (unlikely(skb->len < rtap_len))
+		goto fail;
+
+	if(rtap_len != 14)
+	{
+		DBG_8192C("radiotap len (should be 14): %d\n", rtap_len);
+		goto fail;
+	}	
+
+	/* Skip the ratio tap header */
+	skb_pull(skb, rtap_len);
+
+	dot11_hdr = (struct ieee80211_hdr *)skb->data;
+	frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
+	/* Check if the QoS bit is set */
+	if ((frame_ctl & RTW_IEEE80211_FCTL_FTYPE) == RTW_IEEE80211_FTYPE_DATA) {
+		/* Check if this ia a Wireless Distribution System (WDS) frame
+		 * which has 4 MAC addresses
+		 */
+		if (dot11_hdr->frame_control & 0x0080)
+			qos_len = 2;
+		if ((dot11_hdr->frame_control & 0x0300) == 0x0300)
+			dot11_hdr_len += 6;
+
+		memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
+		memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));
+
+		/* Skip the 802.11 header, QoS (if any) and SNAP, but leave spaces for
+		 * for two MAC addresses
+		 */
+		skb_pull(skb, dot11_hdr_len + qos_len + snap_len - sizeof(src_mac_addr) * 2);
+		pdata = (unsigned char*)skb->data;
+		memcpy(pdata, dst_mac_addr, sizeof(dst_mac_addr));
+		memcpy(pdata + sizeof(dst_mac_addr), src_mac_addr, sizeof(src_mac_addr));
+
+		DBG_8192C("should be eapol packet\n");
+
+		/* Use the real net device to transmit the packet */		
+		ret = _rtw_xmit_entry(skb, padapter->pnetdev);
+
+		return ret;
+
+	}
+	else if ((frame_ctl & (RTW_IEEE80211_FCTL_FTYPE|RTW_IEEE80211_FCTL_STYPE))
+		== (RTW_IEEE80211_FTYPE_MGMT|RTW_IEEE80211_STYPE_ACTION)
+	) 
+	{
+		//only for action frames
+		struct xmit_frame		*pmgntframe;
+		struct pkt_attrib	*pattrib;
+		unsigned char	*pframe;	
+		//u8 category, action, OUI_Subtype, dialogToken=0;
+		//unsigned char	*frame_body;
+		struct rtw_ieee80211_hdr *pwlanhdr;	
+		struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+		struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+		u8 *buf = skb->data;
+		u32 len = skb->len;
+		u8 category, action;
+		int type = -1;
+
+		if (rtw_action_frame_parse(buf, len, &category, &action) == _FALSE) {
+			DBG_8192C(FUNC_NDEV_FMT" frame_control:0x%x\n", FUNC_NDEV_ARG(ndev),
+				le16_to_cpu(((struct rtw_ieee80211_hdr_3addr *)buf)->frame_ctl));
+			goto fail;
+		}
+		
+		DBG_8192C("RTW_Tx:da="MAC_FMT" via "FUNC_NDEV_FMT"\n",
+			MAC_ARG(GetAddr1Ptr(buf)), FUNC_NDEV_ARG(ndev));
+		#ifdef CONFIG_P2P
+		if((type = rtw_p2p_check_frames(padapter, buf, len, _TRUE)) >= 0)
+			goto dump;
+		#endif
+		if (category == RTW_WLAN_CATEGORY_PUBLIC)
+			DBG_871X("RTW_Tx:%s\n", action_public_str(action));
+		else
+			DBG_871X("RTW_Tx:category(%u), action(%u)\n", category, action);
+
+dump:
+		//starting alloc mgmt frame to dump it
+		if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+		{			
+			goto fail;
+		}
+
+		//update attribute
+		pattrib = &pmgntframe->attrib;
+		update_mgntframe_attrib(padapter, pattrib);
+		pattrib->retry_ctrl = _FALSE;
+
+		_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+		pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+
+		_rtw_memcpy(pframe, (void*)buf, len);
+		#ifdef CONFIG_WFD
+		if (type >= 0)
+		{
+			struct wifi_display_info		*pwfd_info;
+			
+			pwfd_info = padapter->wdinfo.wfd_info;
+			
+			if ( _TRUE == pwfd_info->wfd_enable )
+			{
+				rtw_append_wfd_ie( padapter, pframe, &len );
+			}
+		}
+		#endif // CONFIG_WFD
+		pattrib->pktlen = len;	
+	
+		pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+		//update seq number
+		pmlmeext->mgnt_seq = GetSequence(pwlanhdr);
+		pattrib->seqnum = pmlmeext->mgnt_seq;
+		pmlmeext->mgnt_seq++;
+
+	
+		pattrib->last_txcmdsz = pattrib->pktlen;
+	
+		dump_mgntframe(padapter, pmgntframe);
+		
+	}
+	else
+	{
+		DBG_8192C("frame_ctl=0x%x\n", frame_ctl & (RTW_IEEE80211_FCTL_FTYPE|RTW_IEEE80211_FCTL_STYPE));
+	}
+
+	
+fail:
+	
+	dev_kfree_skb(skb);
+
+	return 0;
+	
+}
+
+static void rtw_cfg80211_monitor_if_set_multicast_list(struct net_device *ndev)
+{
+	DBG_8192C("%s\n", __func__);
+}
+
+static int rtw_cfg80211_monitor_if_set_mac_address(struct net_device *ndev, void *addr)
+{
+	int ret = 0;
+	
+	DBG_8192C("%s\n", __func__);
+	
+	return ret;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_cfg80211_monitor_if_ops = {
+	.ndo_open = rtw_cfg80211_monitor_if_open,
+       .ndo_stop = rtw_cfg80211_monitor_if_close,
+       .ndo_start_xmit = rtw_cfg80211_monitor_if_xmit_entry,
+       #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0))
+       .ndo_set_multicast_list = rtw_cfg80211_monitor_if_set_multicast_list,
+       #endif
+       .ndo_set_mac_address = rtw_cfg80211_monitor_if_set_mac_address,       
+};
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+static int rtw_cfg80211_add_monitor_if(_adapter *padapter, char *name, unsigned char name_assign_type, struct net_device **ndev)
+#else
+static int rtw_cfg80211_add_monitor_if(_adapter *padapter, char *name, struct net_device **ndev)
+#endif
+{
+	int ret = 0;
+	struct net_device* mon_ndev = NULL;
+	struct wireless_dev* mon_wdev = NULL;
+	struct rtw_netdev_priv_indicator *pnpi;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+		
+	if (!name ) {
+		DBG_871X(FUNC_ADPT_FMT" without specific name\n", FUNC_ADPT_ARG(padapter));
+		ret = -EINVAL;
+		goto out;
+	}
+
+	if (pwdev_priv->pmon_ndev) {
+		DBG_871X(FUNC_ADPT_FMT" monitor interface exist: "NDEV_FMT"\n",
+			FUNC_ADPT_ARG(padapter), NDEV_ARG(pwdev_priv->pmon_ndev));
+		ret = -EBUSY;
+		goto out;
+	}
+
+	mon_ndev = alloc_etherdev(sizeof(struct rtw_netdev_priv_indicator));
+	if (!mon_ndev) {
+		DBG_871X(FUNC_ADPT_FMT" allocate ndev fail\n", FUNC_ADPT_ARG(padapter));
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	mon_ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+	strncpy(mon_ndev->name, name, IFNAMSIZ);
+	mon_ndev->name[IFNAMSIZ - 1] = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+	mon_ndev->name_assign_type = name_assign_type;
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,12,0))
+	mon_ndev->needs_free_netdev = true;
+	mon_ndev->priv_destructor = rtw_ndev_destructor;
+#else
+	mon_ndev->destructor = rtw_ndev_destructor;
+#endif
+	
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	mon_ndev->netdev_ops = &rtw_cfg80211_monitor_if_ops;
+#else
+	mon_ndev->open = rtw_cfg80211_monitor_if_open;
+	mon_ndev->stop = rtw_cfg80211_monitor_if_close;
+	mon_ndev->hard_start_xmit = rtw_cfg80211_monitor_if_xmit_entry;
+	mon_ndev->set_mac_address = rtw_cfg80211_monitor_if_set_mac_address;
+#endif
+
+	pnpi = netdev_priv(mon_ndev);
+	pnpi->priv = padapter;
+	pnpi->sizeof_priv = sizeof(_adapter);
+
+	/*  wdev */
+	mon_wdev = (struct wireless_dev *)rtw_zmalloc(sizeof(struct wireless_dev));
+	if (!mon_wdev) {
+		DBG_871X(FUNC_ADPT_FMT" allocate mon_wdev fail\n", FUNC_ADPT_ARG(padapter));
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	mon_wdev->wiphy = padapter->rtw_wdev->wiphy;
+	mon_wdev->netdev = mon_ndev;
+	mon_wdev->iftype = NL80211_IFTYPE_MONITOR;
+	mon_ndev->ieee80211_ptr = mon_wdev;
+
+	ret = register_netdevice(mon_ndev);
+	if (ret) {
+		goto out;
+	}
+
+	*ndev = pwdev_priv->pmon_ndev = mon_ndev;
+	_rtw_memcpy(pwdev_priv->ifname_mon, name, IFNAMSIZ+1);
+
+out:
+	if (ret && mon_wdev) {
+		rtw_mfree((u8*)mon_wdev, sizeof(struct wireless_dev));
+		mon_wdev = NULL;
+	}
+
+	if (ret && mon_ndev) {
+		free_netdev(mon_ndev);
+		*ndev = mon_ndev = NULL;
+	}
+
+	return ret;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+static struct wireless_dev *
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+static struct net_device *
+#else
+static int
+#endif
+	cfg80211_rtw_add_virtual_intf(
+		struct wiphy *wiphy,
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,7,0))
+		const char *name,
+	#else
+		char *name,
+	#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+		unsigned char name_assign_type,
+#endif
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0))
+		enum nl80211_iftype type, struct vif_params *params)
+	#else
+		enum nl80211_iftype type, u32 *flags, struct vif_params *params)
+	#endif
+{
+	int ret = 0;
+	struct net_device* ndev = NULL;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_ADPT_FMT " wiphy:%s, name:%s, type:%d\n",
+		FUNC_ADPT_ARG(padapter), wiphy_name(wiphy), name, type);
+
+	switch (type) {
+	case NL80211_IFTYPE_ADHOC:
+	case NL80211_IFTYPE_AP_VLAN:
+	case NL80211_IFTYPE_WDS:
+	case NL80211_IFTYPE_MESH_POINT:
+		ret = -ENODEV;
+		break;
+	case NL80211_IFTYPE_MONITOR:
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+		ret = rtw_cfg80211_add_monitor_if(padapter, (char *)name, name_assign_type, &ndev);
+#else
+		ret = rtw_cfg80211_add_monitor_if(padapter, (char *)name, &ndev);
+#endif
+		break;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	case NL80211_IFTYPE_P2P_CLIENT:
+#endif
+	case NL80211_IFTYPE_STATION:
+		ret = -ENODEV;
+		break;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	case NL80211_IFTYPE_P2P_GO:
+#endif
+	case NL80211_IFTYPE_AP:
+		ret = -ENODEV;
+		break;
+	default:
+		ret = -ENODEV;
+		DBG_871X("Unsupported interface type\n");
+		break;
+	}
+
+	DBG_871X(FUNC_ADPT_FMT" ndev:%p, ret:%d\n", FUNC_ADPT_ARG(padapter), ndev, ret);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	return ndev ? ndev->ieee80211_ptr : ERR_PTR(ret);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	return ndev ? ndev : ERR_PTR(ret);
+#else
+	return ret;
+#endif
+}
+
+static int cfg80211_rtw_del_virtual_intf(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev
+#else
+	struct net_device *ndev
+#endif
+)
+{
+	struct rtw_wdev_priv *pwdev_priv = (struct rtw_wdev_priv *)wiphy_priv(wiphy);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct net_device *ndev;
+	ndev = wdev ? wdev->netdev : NULL;
+#endif
+
+	if (!ndev)
+		goto exit;
+
+	unregister_netdevice(ndev);
+
+	if (ndev == pwdev_priv->pmon_ndev) {
+		pwdev_priv->pmon_ndev = NULL;
+		pwdev_priv->ifname_mon[0] = '\0';
+		DBG_871X(FUNC_NDEV_FMT" remove monitor interface\n", FUNC_NDEV_ARG(ndev));
+	}
+
+exit:
+	return 0;
+}
+
+static int rtw_add_beacon(_adapter *adapter, const u8 *head, size_t head_len, const u8 *tail, size_t tail_len)
+{
+	int ret=0;
+	u8 *pbuf = NULL;
+	uint len, wps_ielen=0;	
+	uint p2p_ielen=0;
+	u8 *p2p_ie;
+	u8 got_p2p_ie = _FALSE;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+	//struct sta_priv *pstapriv = &padapter->stapriv;
+	
+
+	DBG_8192C("%s beacon_head_len=%zu, beacon_tail_len=%zu\n", __FUNCTION__, head_len, tail_len);
+
+	
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	if(head_len<24)
+		return -EINVAL;
+	
+
+	pbuf = rtw_zmalloc(head_len+tail_len);
+	if(!pbuf)
+		return -ENOMEM;
+	
+
+	//_rtw_memcpy(&pstapriv->max_num_sta, param->u.bcn_ie.reserved, 2);
+
+	//if((pstapriv->max_num_sta>NUM_STA) || (pstapriv->max_num_sta<=0))
+	//	pstapriv->max_num_sta = NUM_STA;
+
+	
+	_rtw_memcpy(pbuf, (void *)head+24, head_len-24);// 24=beacon header len.
+	_rtw_memcpy(pbuf+head_len-24, (void *)tail, tail_len);
+
+	len = head_len+tail_len-24;
+
+	//check wps ie if inclued
+	if(rtw_get_wps_ie(pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_, NULL, &wps_ielen))
+		DBG_8192C("add bcn, wps_ielen=%d\n", wps_ielen);
+
+#ifdef CONFIG_P2P
+	//check p2p ie if inclued
+	if( adapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+	{
+		//check p2p if enable
+		if(rtw_get_p2p_ie(pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_, NULL, &p2p_ielen))
+		{
+			struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+			struct wifidirect_info *pwdinfo= &(adapter->wdinfo);
+
+			DBG_8192C("got p2p_ie, len=%d\n", p2p_ielen);
+			got_p2p_ie = _TRUE;
+		
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{			
+				DBG_8192C("Enable P2P function for the first time\n");
+				rtw_p2p_enable(adapter, P2P_ROLE_GO);
+				wdev_to_priv(adapter->rtw_wdev)->p2p_enabled = _TRUE;
+			}
+			else
+			{
+				_cancel_timer_ex( &pwdinfo->find_phase_timer );
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);	
+
+				DBG_8192C("enter GO Mode, p2p_ielen=%d\n", p2p_ielen);			
+
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+				pwdinfo->intent = 15;		
+			}
+		}
+	}
+#endif // CONFIG_P2P
+
+	/* pbss_network->IEs will not include p2p_ie, wfd ie */
+	rtw_ies_remove_ie(pbuf, &len, _BEACON_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, P2P_OUI, 4);
+	rtw_ies_remove_ie(pbuf, &len, _BEACON_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, WFD_OUI, 4);
+
+	if (rtw_check_beacon_data(adapter, pbuf,  len) == _SUCCESS)
+	{
+#ifdef  CONFIG_P2P		
+		//check p2p if enable
+		if(got_p2p_ie == _TRUE)
+		{
+			struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+			struct wifidirect_info *pwdinfo= &(adapter->wdinfo);
+			pwdinfo->operating_channel = pmlmeext->cur_channel;
+		}
+#endif //CONFIG_P2P
+		ret = 0;
+	}	
+	else
+	{
+		ret = -EINVAL;
+	}	
+	
+
+	rtw_mfree(pbuf, head_len+tail_len);	
+	
+	return ret;	
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0)) && !defined(COMPAT_KERNEL_RELEASE)
+static int	cfg80211_rtw_add_beacon(struct wiphy *wiphy, struct net_device *ndev,
+			      struct beacon_parameters *info)
+{
+	int ret=0;
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	ret = rtw_add_beacon(adapter, info->head, info->head_len, info->tail, info->tail_len);
+
+	return ret;
+}
+
+static int	cfg80211_rtw_set_beacon(struct wiphy *wiphy, struct net_device *ndev,
+			      struct beacon_parameters *info)
+{
+	_adapter *padapter = wiphy_to_adapter(wiphy);	
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	pmlmeext->bstart_bss = _TRUE;
+
+	cfg80211_rtw_add_beacon(wiphy, ndev, info);
+	
+	return 0;
+}
+
+static int	cfg80211_rtw_del_beacon(struct wiphy *wiphy, struct net_device *ndev)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	
+	return 0;
+}
+#else
+static int cfg80211_rtw_start_ap(struct wiphy *wiphy, struct net_device *ndev,
+								struct cfg80211_ap_settings *settings)
+{
+	int ret = 0;
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+	
+	DBG_871X(FUNC_NDEV_FMT" hidden_ssid:%d, auth_type:%d\n", FUNC_NDEV_ARG(ndev),
+		settings->hidden_ssid, settings->auth_type);
+
+	ret = rtw_add_beacon(adapter, settings->beacon.head, settings->beacon.head_len,
+		settings->beacon.tail, settings->beacon.tail_len);
+
+	adapter->mlmeextpriv.mlmext_info.hidden_ssid_mode = settings->hidden_ssid;
+	
+	if (settings->ssid && settings->ssid_len) {
+		WLAN_BSSID_EX *pbss_network = &adapter->mlmepriv.cur_network.network;
+		WLAN_BSSID_EX *pbss_network_ext = &adapter->mlmeextpriv.mlmext_info.network;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" ssid:(%s,%d), from ie:(%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			settings->ssid, settings->ssid_len,
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength);
+
+		_rtw_memcpy(pbss_network->Ssid.Ssid, (void *)settings->ssid, settings->ssid_len);
+		pbss_network->Ssid.SsidLength = settings->ssid_len;
+		_rtw_memcpy(pbss_network_ext->Ssid.Ssid, (void *)settings->ssid, settings->ssid_len);
+		pbss_network_ext->Ssid.SsidLength = settings->ssid_len;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" after ssid:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
+			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
+	}
+
+	return ret;
+}
+
+static int cfg80211_rtw_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
+                                struct cfg80211_beacon_data *info)
+{
+	int ret = 0;
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	ret = rtw_add_beacon(adapter, info->head, info->head_len, info->tail, info->tail_len);
+
+	return ret;
+}
+
+static int cfg80211_rtw_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+#endif //(LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0))
+
+static int	cfg80211_rtw_add_station(struct wiphy *wiphy, struct net_device *ndev,
+			       const u8 *mac, struct station_parameters *params)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	
+	return 0;
+}
+
+static int	cfg80211_rtw_del_station(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,15,0))
+			       u8 *mac) {
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(4,1,0))
+                   const u8 *mac) {
+#else
+                   struct station_del_parameters *params)
+{
+    const u8 *mac = params->mac;
+#endif
+	int ret=0;	
+	_irqL irqL;
+	_list	*phead, *plist;
+	u8 updated = _FALSE;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("+"FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)		
+	{
+		DBG_8192C("%s, fw_state != FW_LINKED|WIFI_AP_STATE\n", __func__);
+		return -EINVAL;		
+	}
+
+
+	if(!mac)
+	{
+		DBG_8192C("flush all sta, and cam_entry\n");
+
+		flush_all_cam_entry(padapter);	//clear CAM
+
+		ret = rtw_sta_flush(padapter);
+		
+		return ret;
+	}	
+
+
+	DBG_8192C("free sta macaddr =" MAC_FMT "\n", MAC_ARG(mac));
+
+	if (mac[0] == 0xff && mac[1] == 0xff &&
+	    mac[2] == 0xff && mac[3] == 0xff &&
+	    mac[4] == 0xff && mac[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//check asoc_queue
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)	
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		
+		plist = get_next(plist);	
+	
+		if(_rtw_memcmp(mac, psta->hwaddr, ETH_ALEN))		
+		{
+			if(psta->dot8021xalg == 1 && psta->bpairwise_key_installed == _FALSE)
+			{
+				DBG_8192C("%s, sta's dot8021xalg = 1 and key_installed = _FALSE\n", __func__);
+			}
+			else
+			{
+				DBG_8192C("free psta=%p, aid=%d\n", psta, psta->aid);
+
+				rtw_list_delete(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+
+				//_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+				updated = ap_free_sta(padapter, psta, _TRUE, WLAN_REASON_DEAUTH_LEAVING);
+				//_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+				psta = NULL;
+
+				break;
+			}		
+					
+		}
+		
+	}
+
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	associated_clients_update(padapter, updated);
+
+	DBG_871X("-"FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	
+	return ret;	
+
+}
+
+static int	cfg80211_rtw_change_station(struct wiphy *wiphy, struct net_device *ndev,
+				  const u8 *mac, struct station_parameters *params)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	
+	return 0;
+}
+
+static int	cfg80211_rtw_dump_station(struct wiphy *wiphy, struct net_device *ndev,
+			       int idx, u8 *mac, struct station_info *sinfo)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	//TODO: dump scanned queue
+
+	return -ENOENT;
+}
+
+static int	cfg80211_rtw_change_bss(struct wiphy *wiphy, struct net_device *ndev,
+			      struct bss_parameters *params)
+{
+	u8 i;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+/*
+	DBG_8192C("use_cts_prot=%d\n", params->use_cts_prot);
+	DBG_8192C("use_short_preamble=%d\n", params->use_short_preamble);
+	DBG_8192C("use_short_slot_time=%d\n", params->use_short_slot_time);
+	DBG_8192C("ap_isolate=%d\n", params->ap_isolate);
+
+	DBG_8192C("basic_rates_len=%d\n", params->basic_rates_len);
+	for(i=0; i<params->basic_rates_len; i++)
+	{		
+		DBG_8192C("basic_rates=%d\n", params->basic_rates[i]);
+		
+	}	
+*/	
+	return 0;
+	
+}
+
+static int	cfg80211_rtw_set_channel(struct wiphy *wiphy
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	, struct net_device *ndev
+	#endif
+	, struct ieee80211_channel *chan, enum nl80211_channel_type channel_type)
+{
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	#endif
+	
+	return 0;
+}
+
+static int	cfg80211_rtw_auth(struct wiphy *wiphy, struct net_device *ndev,
+			struct cfg80211_auth_request *req)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	
+	return 0;
+}
+
+static int	cfg80211_rtw_assoc(struct wiphy *wiphy, struct net_device *ndev,
+			 struct cfg80211_assoc_request *req)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	
+	return 0;
+}
+#endif //CONFIG_AP_MODE
+
+void rtw_cfg80211_rx_action_p2p(_adapter *padapter, u8 *pmgmt_frame, uint frame_len)
+{
+	int type;
+	s32 freq;
+	int channel;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	u8 category, action;
+
+	channel = rtw_get_oper_ch(padapter);
+
+	DBG_8192C("RTW_Rx:cur_ch=%d\n", channel);
+	#ifdef CONFIG_P2P
+	type = rtw_p2p_check_frames(padapter, pmgmt_frame, frame_len, _FALSE);
+	if (type >= 0)
+		goto indicate;
+	#endif
+	rtw_action_frame_parse(pmgmt_frame, frame_len, &category, &action);
+	DBG_871X("RTW_Rx:category(%u), action(%u)\n", category, action);
+
+indicate:
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+#else
+	cfg80211_rx_action(padapter->pnetdev, freq, pmgmt_frame, frame_len, GFP_ATOMIC);
+#endif
+}
+
+void rtw_cfg80211_rx_p2p_action_public(_adapter *padapter, u8 *pmgmt_frame, uint frame_len)
+{
+	int type;
+	s32 freq;
+	int channel;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	u8 category, action;
+
+	channel = rtw_get_oper_ch(padapter);
+
+	DBG_8192C("RTW_Rx:cur_ch=%d\n", channel);
+	#ifdef CONFIG_P2P
+	type = rtw_p2p_check_frames(padapter, pmgmt_frame, frame_len, _FALSE);
+	if (type >= 0) {
+		switch (type) {
+		case P2P_GO_NEGO_CONF:
+		case P2P_PROVISION_DISC_RESP:
+		case P2P_INVIT_RESP:
+			rtw_set_scan_deny(padapter, 2000);
+			rtw_clear_scan_deny(padapter);
+		}
+		goto indicate;
+	}
+	#endif
+	rtw_action_frame_parse(pmgmt_frame, frame_len, &category, &action);
+	DBG_871X("RTW_Rx:category(%u), action(%u)\n", category, action);
+
+indicate:
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+#else
+	cfg80211_rx_action(padapter->pnetdev, freq, pmgmt_frame, frame_len, GFP_ATOMIC);
+#endif
+}
+
+void rtw_cfg80211_rx_action(_adapter *adapter, u8 *frame, uint frame_len, const char*msg)
+{
+	s32 freq;
+	int channel;
+	struct mlme_ext_priv *pmlmeext = &(adapter->mlmeextpriv);	
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(adapter->rtw_wdev);
+	u8 category, action;
+
+	channel = rtw_get_oper_ch(adapter);
+
+	rtw_action_frame_parse(frame, frame_len, &category, &action);
+
+	DBG_8192C("RTW_Rx:cur_ch=%d\n", channel);
+	if (msg)
+		DBG_871X("RTW_Rx:%s\n", msg);
+	else
+		DBG_871X("RTW_Rx:category(%u), action(%u)\n", category, action);
+
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_rx_mgmt(adapter, freq, 0, frame, frame_len, GFP_ATOMIC);
+#else
+	cfg80211_rx_action(adapter->pnetdev, freq, frame, frame_len, GFP_ATOMIC);
+#endif
+
+}
+
+#ifdef CONFIG_P2P
+void rtw_cfg80211_issue_p2p_provision_request(_adapter *padapter, const u8 *buf, size_t len)
+{
+	u16	wps_devicepassword_id = 0x0000;
+	uint	wps_devicepassword_id_len = 0;
+	u8			wpsie[ 255 ] = { 0x00 }, p2p_ie[ 255 ] = { 0x00 };
+	uint			p2p_ielen = 0;
+	uint			wpsielen = 0;
+	u32	devinfo_contentlen = 0;
+	u8	devinfo_content[64] = { 0x00 };
+	u16	capability = 0;
+	uint capability_len = 0;
+	
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u8			dialogToken = 1;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_PROVISION_DISC_REQ;	
+	u32			p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD		
+	
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	
+	struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
+	u8 *frame_body = (unsigned char *)(buf + sizeof(struct rtw_ieee80211_hdr_3addr));
+	size_t frame_body_len = len - sizeof(struct rtw_ieee80211_hdr_3addr);
+
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+
+	//prepare for building provision_request frame	
+	_rtw_memcpy(pwdinfo->tx_prov_disc_info.peerIFAddr, GetAddr1Ptr(buf), ETH_ALEN);
+	_rtw_memcpy(pwdinfo->tx_prov_disc_info.peerDevAddr, GetAddr1Ptr(buf), ETH_ALEN);
+	
+	pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_PUSH_BUTTON;
+		
+	rtw_get_wps_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, frame_body_len - _PUBLIC_ACTION_IE_OFFSET_, wpsie, &wpsielen);
+	rtw_get_wps_attr_content( wpsie, wpsielen, WPS_ATTR_DEVICE_PWID, (u8*) &wps_devicepassword_id, &wps_devicepassword_id_len);
+	wps_devicepassword_id = be16_to_cpu( wps_devicepassword_id );
+
+	switch(wps_devicepassword_id) 
+	{
+		case WPS_DPID_PIN:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_LABEL;
+			break;
+		case WPS_DPID_USER_SPEC:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_DISPLYA;
+			break;
+		case WPS_DPID_MACHINE_SPEC:
+			break;
+		case WPS_DPID_REKEY:
+			break;
+		case WPS_DPID_PBC:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_PUSH_BUTTON;
+			break;
+		case WPS_DPID_REGISTRAR_SPEC:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_KEYPAD;
+			break;
+		default:
+			break;
+	}
+
+
+	if ( rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, frame_body_len - _PUBLIC_ACTION_IE_OFFSET_, p2p_ie, &p2p_ielen ) )
+	{	
+
+		rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_INFO, devinfo_content, &devinfo_contentlen);					
+		rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&capability, &capability_len);
+						
+	}
+
+
+	//start to build provision_request frame	
+	_rtw_memset(wpsie, 0, sizeof(wpsie));
+	_rtw_memset(p2p_ie, 0, sizeof(p2p_ie));
+	p2p_ielen = 0;	
+	
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, pwdinfo->tx_prov_disc_info.peerDevAddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);	
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->tx_prov_disc_info.peerDevAddr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));	
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));		
+
+
+	//build_prov_disc_request_p2p_ie	
+	//	P2P OUI
+	p2pielen = 0;
+	p2p_ie[ p2pielen++ ] = 0x50;
+	p2p_ie[ p2pielen++ ] = 0x6F;
+	p2p_ie[ p2pielen++ ] = 0x9A;
+	p2p_ie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110301
+	//	According to the P2P Specification, the provision discovery request frame should contain 3 P2P attributes
+	//	1. P2P Capability
+	//	2. Device Info
+	//	3. Group ID ( When joining an operating P2P Group )
+
+	//	P2P Capability ATTR
+	//	Type:	
+	p2p_ie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	RTW_PUT_LE16(p2p_ie + p2pielen, 0x0002);
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	//	Group Capability Bitmap, 1 byte
+	_rtw_memcpy(p2p_ie + p2pielen, &capability, 2);
+	p2pielen += 2;
+	
+
+	//	Device Info ATTR
+	//	Type:
+	p2p_ie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes) 
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	RTW_PUT_LE16(p2p_ie + p2pielen, devinfo_contentlen);
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy(p2p_ie + p2pielen, devinfo_content, devinfo_contentlen);
+	p2pielen += devinfo_contentlen;
+
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2p_ie, &p2p_ielen);			
+	//p2pielen = build_prov_disc_request_p2p_ie( pwdinfo, pframe, NULL, 0, pwdinfo->tx_prov_disc_info.peerDevAddr);
+	//pframe += p2pielen;
+	pattrib->pktlen += p2p_ielen;
+
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Config Method
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->tx_prov_disc_info.wps_config_method_request );
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+#ifdef CONFIG_WFD
+	wfdielen = build_provdisc_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	//dump_mgntframe(padapter, pmgntframe);
+	if (dump_mgntframe_and_wait_ack(padapter, pmgntframe) != _SUCCESS)
+		DBG_8192C("%s, ack to\n", __func__);
+
+	//if(wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC)
+	//{
+	//	DBG_8192C("waiting for p2p peer key-in PIN CODE\n");
+	//	rtw_msleep_os(15000); // 15 sec for key in PIN CODE, workaround for GS2 before issuing Nego Req.
+	//}	
+
+}
+
+static s32 cfg80211_rtw_remain_on_channel(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+	struct ieee80211_channel * channel,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+	enum nl80211_channel_type channel_type,
+#endif
+	unsigned int duration, u64 *cookie)
+{
+	s32 err = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+	u8 remain_ch = (u8) ieee80211_frequency_to_channel(channel->center_freq);
+	u8 ready_on_channel = _FALSE;
+
+	DBG_871X(FUNC_ADPT_FMT" ch:%u duration:%d\n", FUNC_ADPT_ARG(padapter), remain_ch, duration);
+
+	if(pcfg80211_wdinfo->is_ro_ch == _TRUE)
+	{
+		DBG_8192C("%s, cancel ro ch timer\n", __func__);
+		
+		_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+
+#ifdef CONFIG_CONCURRENT_MODE
+                ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);			
+#endif //CONFIG_CONCURRENT_MODE	
+
+		p2p_protocol_wk_hdl(padapter, P2P_RO_CH_WK);
+	}
+
+	pcfg80211_wdinfo->is_ro_ch = _TRUE;
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		err = -EFAULT;
+		goto exit;
+	}
+
+	_rtw_memcpy(&pcfg80211_wdinfo->remain_on_ch_channel, channel, sizeof(struct ieee80211_channel));
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+	pcfg80211_wdinfo->remain_on_ch_type= channel_type;
+	#endif
+	pcfg80211_wdinfo->remain_on_ch_cookie= *cookie;
+
+	rtw_scan_abort(padapter);
+#ifdef CONFIG_CONCURRENT_MODE		
+	if(rtw_buddy_adapter_up(padapter))	
+		rtw_scan_abort(padapter->pbuddy_adapter);			
+#endif //CONFIG_CONCURRENT_MODE
+
+	//if(!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) && !rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		rtw_p2p_enable(padapter, P2P_ROLE_DEVICE);
+		wdev_to_priv(padapter->rtw_wdev)->p2p_enabled = _TRUE;
+	}
+	else
+	{
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+#ifdef CONFIG_DEBUG_CFG80211		
+		DBG_8192C("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+#endif
+	}
+
+
+	rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+	
+	
+	if(duration < 400)
+		duration = duration*3;//extend from exper.
+
+
+#ifdef	CONFIG_CONCURRENT_MODE
+	if(check_buddy_fwstate(padapter, _FW_LINKED) &&
+		(duration<pwdinfo->ext_listen_interval)) 
+	{
+		duration = duration + 	pwdinfo->ext_listen_interval;
+	}
+#endif
+
+	pcfg80211_wdinfo->restore_channel = rtw_get_oper_ch(padapter);
+
+	if(rtw_ch_set_search_ch(pmlmeext->channel_set, remain_ch) >= 0) {
+#ifdef	CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;			
+			struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;	
+
+			if(remain_ch != pbuddy_mlmeext->cur_channel)
+			{	
+				if(ATOMIC_READ(&pwdev_priv->switch_ch_to)==1 ||
+					(remain_ch != pmlmeext->cur_channel))
+				{
+					DBG_8192C("%s, issue nulldata pwrbit=1\n", __func__);		
+					issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+				
+					ATOMIC_SET(&pwdev_priv->switch_ch_to, 0);
+			
+					DBG_8192C("%s, set switch ch timer, duration=%d\n", __func__, duration-pwdinfo->ext_listen_interval);
+					_set_timer(&pwdinfo->ap_p2p_switch_timer, duration-pwdinfo->ext_listen_interval);	
+				}			
+			}
+		
+			ready_on_channel = _TRUE;
+			//pmlmeext->cur_channel = remain_ch;			
+			//set_channel_bwmode(padapter, remain_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}else 
+#endif //CONFIG_CONCURRENT_MODE
+		if(remain_ch != pmlmeext->cur_channel )
+		{
+			ready_on_channel = _TRUE;
+			//pmlmeext->cur_channel = remain_ch;			
+			//set_channel_bwmode(padapter, remain_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+	} else {
+		DBG_871X("%s remain_ch:%u not in channel plan!!!!\n", __FUNCTION__, remain_ch);
+	}
+	
+
+	//call this after other things have been done
+#ifdef	CONFIG_CONCURRENT_MODE	
+	if(ATOMIC_READ(&pwdev_priv->ro_ch_to)==1 ||
+		(remain_ch != pmlmeext->cur_channel))
+	{
+		u8 co_channel = 0xff;
+		ATOMIC_SET(&pwdev_priv->ro_ch_to, 0);
+#endif
+
+		if(ready_on_channel == _TRUE)
+		{			
+			if ( !check_fwstate(&padapter->mlmepriv, _FW_LINKED ) )
+				pmlmeext->cur_channel = remain_ch;
+			
+#ifdef	CONFIG_CONCURRENT_MODE
+			co_channel = rtw_get_oper_ch(padapter);
+
+			if(co_channel !=remain_ch)
+#endif
+			{
+				if (!padapter->mlmepriv.LinkDetectInfo.bBusyTraffic)
+					set_channel_bwmode(padapter, remain_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);			
+			}
+		}
+		DBG_8192C("%s, set ro ch timer, duration=%d\n", __func__, duration);
+		_set_timer( &pcfg80211_wdinfo->remain_on_ch_timer, duration);
+
+#ifdef	CONFIG_CONCURRENT_MODE
+	}
+#endif
+
+	rtw_cfg80211_ready_on_channel(padapter, *cookie, channel, channel_type, duration, GFP_KERNEL);
+
+exit:
+	if (err)
+		pcfg80211_wdinfo->is_ro_ch = _FALSE;
+
+	return err;
+}
+
+static s32 cfg80211_rtw_cancel_remain_on_channel(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+	u64 cookie)
+{
+	s32 err = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (pcfg80211_wdinfo->is_ro_ch == _TRUE) {
+		DBG_8192C("%s, cancel ro ch timer\n", __func__);
+		_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+		#ifdef CONFIG_CONCURRENT_MODE
+		ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);
+		#endif
+		p2p_protocol_wk_hdl(padapter, P2P_RO_CH_WK);
+	}
+
+	#if 0
+	//	Disable P2P Listen State
+	if(!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) && !rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+			
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_NONE);
+			_rtw_memset(pwdinfo, 0x00, sizeof(struct wifidirect_info));
+		}
+	}
+	else
+	#endif
+	{
+		 rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+#ifdef CONFIG_DEBUG_CFG80211		 
+		 DBG_8192C("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+#endif
+	}
+	pcfg80211_wdinfo->is_ro_ch = _FALSE;
+
+	return err;
+}
+
+#endif //CONFIG_P2P
+
+static int _cfg80211_rtw_mgmt_tx(_adapter *padapter, u8 tx_ch, const u8 *buf, size_t len)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	unsigned char	*pframe;
+	int ret = _FAIL;
+	bool ack = _TRUE;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	//struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	rtw_set_scan_deny(padapter, 1000);
+
+	rtw_scan_abort(padapter);
+	#ifdef CONFIG_CONCURRENT_MODE		
+	if(rtw_buddy_adapter_up(padapter))	
+		rtw_scan_abort(padapter->pbuddy_adapter);
+	#endif /* CONFIG_CONCURRENT_MODE */
+
+	if (padapter->cfg80211_wdinfo.is_ro_ch == _TRUE) {
+		//DBG_8192C("%s, cancel ro ch timer\n", __func__);
+		//_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+		//padapter->cfg80211_wdinfo.is_ro_ch = _FALSE;
+		#ifdef CONFIG_CONCURRENT_MODE			
+		if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+		{
+			DBG_8192C("%s, extend ro ch time\n", __func__);
+			_set_timer( &padapter->cfg80211_wdinfo.remain_on_ch_timer, pwdinfo->ext_listen_period);
+		}	
+		#endif //CONFIG_CONCURRENT_MODE			
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_LINKED )) {
+		u8 co_channel=0xff;
+		PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;			
+		struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;	
+
+		co_channel = rtw_get_oper_ch(padapter);
+
+		if (tx_ch != pbuddy_mlmeext->cur_channel) {
+
+			u16 ext_listen_period;
+
+			if (ATOMIC_READ(&pwdev_priv->switch_ch_to)==1) {
+				DBG_8192C("%s, issue nulldata pwrbit=1\n", __func__);
+				issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+
+				ATOMIC_SET(&pwdev_priv->switch_ch_to, 0);
+
+				//DBG_8192C("%s, set switch ch timer, period=%d\n", __func__, pwdinfo->ext_listen_period);
+				//_set_timer(&pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_period);
+			}
+
+			if (check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+			{
+				ext_listen_period = 500;// 500ms
+			}	
+			else
+			{				
+				ext_listen_period = pwdinfo->ext_listen_period;
+			}
+
+			DBG_8192C("%s, set switch ch timer, period=%d\n", __func__, ext_listen_period);
+			_set_timer(&pwdinfo->ap_p2p_switch_timer, ext_listen_period);	
+			
+		}
+
+		if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+			pmlmeext->cur_channel = tx_ch;
+
+		if (tx_ch != co_channel)
+			set_channel_bwmode(padapter, tx_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}else 
+#endif //CONFIG_CONCURRENT_MODE
+	//if (tx_ch != pmlmeext->cur_channel) {
+	if(tx_ch != rtw_get_oper_ch(padapter)) {
+		if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+			pmlmeext->cur_channel = tx_ch;
+		set_channel_bwmode(padapter, tx_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}
+
+	//starting alloc mgmt frame to dump it
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		//ret = -ENOMEM;
+		ret = _FAIL;
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->retry_ctrl = _FALSE;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+
+	_rtw_memcpy(pframe, (void*)buf, len);
+	pattrib->pktlen = len;	
+	
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	//update seq number
+	pmlmeext->mgnt_seq = GetSequence(pwlanhdr);
+	pattrib->seqnum = pmlmeext->mgnt_seq;
+	pmlmeext->mgnt_seq++;
+
+#ifdef CONFIG_WFD
+	{
+		struct wifi_display_info	*pwfd_info;
+			
+		pwfd_info = padapter->wdinfo.wfd_info;
+			
+		if ( _TRUE == pwfd_info->wfd_enable )
+		{
+			rtw_append_wfd_ie( padapter, pframe, &pattrib->pktlen );
+		}
+	}
+#endif // CONFIG_WFD
+	
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	if (dump_mgntframe_and_wait_ack(padapter, pmgntframe) != _SUCCESS) 
+	{
+		ack = _FALSE;
+		ret = _FAIL;
+
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("%s, ack == _FAIL\n", __func__);
+		#endif
+	}
+	else 
+	{
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("%s, ack=%d, ok!\n", __func__, ack);
+		#endif
+		ret = _SUCCESS;
+	}
+	
+exit:
+
+	#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ret=%d\n", __func__, ret);
+	#endif
+	
+	return ret;		
+	
+}
+
+static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+	struct cfg80211_mgmt_tx_params *params,
+#else
+	struct ieee80211_channel *chan,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	bool offchan,
+#endif
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+	enum nl80211_channel_type channel_type,
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	bool channel_type_valid,
+	#endif
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	unsigned int wait,
+#endif
+	const u8 *buf, size_t len,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0))
+	bool no_cck,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,3,0))
+	bool dont_wait_for_ack,
+#endif
+#endif
+	u64 *cookie)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+	struct ieee80211_channel *chan = params->chan;
+	const u8 *buf = params->buf;
+	size_t len = params->len;
+#endif
+
+	_adapter *padapter = (_adapter *)wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	int ret = 0;
+	int tx_ret;
+	u32 dump_limit = RTW_MAX_MGMT_TX_CNT;
+	u32 dump_cnt = 0;
+	bool ack = _TRUE;
+	u8 tx_ch = (u8)ieee80211_frequency_to_channel(chan->center_freq);
+	u8 category, action;
+	int type = (-1);
+	u32 start = rtw_get_current_time();
+
+	/* cookie generation */
+	*cookie = (unsigned long) buf;
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_ADPT_FMT" len=%zu, ch=%d"
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+		", ch_type=%d"
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)	
+		", channel_type_valid=%d"
+		#endif
+	#endif
+		"\n", FUNC_ADPT_ARG(padapter),
+		len, tx_ch
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+		, channel_type
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)	
+		, channel_type_valid
+		#endif
+	#endif
+	);
+#endif /* CONFIG_DEBUG_CFG80211 */
+
+	/* indicate ack before issue frame to avoid racing with rsp frame */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_mgmt_tx_status(padapter, *cookie, buf, len, ack, GFP_KERNEL);
+#elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35))
+	cfg80211_action_tx_status(ndev, *cookie, buf, len, ack, GFP_KERNEL);
+#endif
+
+	if (rtw_action_frame_parse(buf, len, &category, &action) == _FALSE) {
+		DBG_8192C(FUNC_ADPT_FMT" frame_control:0x%x\n", FUNC_ADPT_ARG(padapter),
+			le16_to_cpu(((struct rtw_ieee80211_hdr_3addr *)buf)->frame_ctl));
+		goto exit;
+	}
+
+	DBG_8192C("RTW_Tx:tx_ch=%d, da="MAC_FMT"\n", tx_ch, MAC_ARG(GetAddr1Ptr(buf)));
+	#ifdef CONFIG_P2P
+	if((type = rtw_p2p_check_frames(padapter, buf, len, _TRUE)) >= 0) {
+		goto dump;
+	}
+	#endif
+	if (category == RTW_WLAN_CATEGORY_PUBLIC)
+		DBG_871X("RTW_Tx:%s\n", action_public_str(action));
+	else
+		DBG_871X("RTW_Tx:category(%u), action(%u)\n", category, action);
+
+dump:
+	do {
+		dump_cnt++;
+		tx_ret = _cfg80211_rtw_mgmt_tx(padapter, tx_ch, buf, len);
+	} while (dump_cnt < dump_limit && tx_ret != _SUCCESS);
+
+	if (tx_ret != _SUCCESS || dump_cnt > 1) {
+		DBG_871X(FUNC_ADPT_FMT" %s (%d/%d) in %d ms\n", FUNC_ADPT_ARG(padapter),
+			tx_ret==_SUCCESS?"OK":"FAIL", dump_cnt, dump_limit, rtw_get_passing_time_ms(start));
+	}
+
+	switch (type) {
+	case P2P_GO_NEGO_CONF:
+		rtw_clear_scan_deny(padapter);
+		break;
+	case P2P_INVIT_RESP:
+		if (pwdev_priv->invit_info.flags & BIT(0)
+			&& pwdev_priv->invit_info.status == 0) 
+		{
+			DBG_871X(FUNC_ADPT_FMT" agree with invitation of persistent group\n",
+				FUNC_ADPT_ARG(padapter));
+			rtw_set_scan_deny(padapter, 5000);
+			rtw_pwr_wakeup_ex(padapter, 5000);
+			rtw_clear_scan_deny(padapter);
+		}
+		break;
+	}	
+
+exit:
+	return ret;
+}
+
+static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+	u16 frame_type, bool reg)
+{
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_ADPT_FMT" frame_type:%x, reg:%d\n", FUNC_ADPT_ARG(adapter),
+		frame_type, reg);
+#endif
+
+	if (frame_type != (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ))
+		return;
+
+	return;
+}
+
+static int rtw_cfg80211_set_beacon_wpsp2pie(struct net_device *ndev, char *buf, int len)
+{	
+	int ret = 0;
+	uint wps_ielen = 0;
+	u8 *wps_ie;
+	u32	p2p_ielen = 0;
+	u8 wps_oui[8]={0x0,0x50,0xf2,0x04};	
+	u8 *p2p_ie;
+	u32	wfd_ielen = 0;	
+	u8 *wfd_ie;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+
+	DBG_871X(FUNC_NDEV_FMT" ielen=%d\n", FUNC_NDEV_ARG(ndev), len);
+	
+	if(len>0)
+	{
+		if((wps_ie = rtw_get_wps_ie(buf, len, NULL, &wps_ielen)))
+		{	
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("bcn_wps_ielen=%d\n", wps_ielen);
+			#endif
+		
+			if(pmlmepriv->wps_beacon_ie)
+			{
+				u32 free_len = pmlmepriv->wps_beacon_ie_len;
+				pmlmepriv->wps_beacon_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_beacon_ie, free_len);
+				pmlmepriv->wps_beacon_ie = NULL;			
+			}	
+
+			pmlmepriv->wps_beacon_ie = rtw_malloc(wps_ielen);
+			if ( pmlmepriv->wps_beacon_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			
+			_rtw_memcpy(pmlmepriv->wps_beacon_ie, wps_ie, wps_ielen);
+			pmlmepriv->wps_beacon_ie_len = wps_ielen;
+	
+			update_beacon(padapter, _VENDOR_SPECIFIC_IE_, wps_oui, _TRUE);
+
+		}
+
+		//buf += wps_ielen;
+		//len -= wps_ielen;
+
+		#ifdef CONFIG_P2P
+		if((p2p_ie=rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("bcn_p2p_ielen=%d\n", p2p_ielen);
+			#endif
+		
+			if(pmlmepriv->p2p_beacon_ie)
+			{
+				u32 free_len = pmlmepriv->p2p_beacon_ie_len;
+				pmlmepriv->p2p_beacon_ie_len = 0;
+				rtw_mfree(pmlmepriv->p2p_beacon_ie, free_len);
+				pmlmepriv->p2p_beacon_ie = NULL;			
+			}	
+
+			pmlmepriv->p2p_beacon_ie = rtw_malloc(p2p_ielen);
+			if ( pmlmepriv->p2p_beacon_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			
+			_rtw_memcpy(pmlmepriv->p2p_beacon_ie, p2p_ie, p2p_ielen);
+			pmlmepriv->p2p_beacon_ie_len = p2p_ielen;
+			
+		}
+		#endif //CONFIG_P2P
+		
+		//buf += p2p_ielen;
+		//len -= p2p_ielen;
+
+		#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(buf, len, NULL, &wfd_ielen)) 
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("bcn_wfd_ielen=%d\n", wfd_ielen);
+			#endif
+			
+			if(pmlmepriv->wfd_beacon_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_beacon_ie_len;
+				pmlmepriv->wfd_beacon_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_beacon_ie, free_len);
+				pmlmepriv->wfd_beacon_ie = NULL;
+			}	
+
+			pmlmepriv->wfd_beacon_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_beacon_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			rtw_get_wfd_ie(buf, len, pmlmepriv->wfd_beacon_ie, &pmlmepriv->wfd_beacon_ie_len);			
+		}
+		#endif //CONFIG_WFD
+		
+		pmlmeext->bstart_bss = _TRUE;
+		
+	}
+
+	return ret;
+	
+}
+
+static int rtw_cfg80211_set_probe_resp_wpsp2pie(struct net_device *net, char *buf, int len)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u8 *wps_ie;
+	u32	p2p_ielen = 0;	
+	u8 *p2p_ie;
+	u32	wfd_ielen = 0;	
+	u8 *wfd_ie;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+#endif
+	
+	if(len>0)
+	{
+		if((wps_ie = rtw_get_wps_ie(buf, len, NULL, &wps_ielen)))
+		{	
+			uint	attr_contentlen = 0;
+			u16	uconfig_method, *puconfig_method = NULL;
+
+			#ifdef CONFIG_DEBUG_CFG80211			
+			DBG_8192C("probe_resp_wps_ielen=%d\n", wps_ielen);
+			#endif
+
+			if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+			{
+				u8 sr = 0;
+				rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8*)(&sr), NULL);
+
+				if (sr != 0)
+				{
+					DBG_871X("%s, got sr\n", __func__);
+				}
+				else
+				{
+					DBG_8192C("GO mode process WPS under site-survey,  sr no set\n");
+					return ret;
+				}
+			}
+
+			if(pmlmepriv->wps_probe_resp_ie)
+			{
+				u32 free_len = pmlmepriv->wps_probe_resp_ie_len;
+				pmlmepriv->wps_probe_resp_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_probe_resp_ie, free_len);
+				pmlmepriv->wps_probe_resp_ie = NULL;			
+			}	
+
+			pmlmepriv->wps_probe_resp_ie = rtw_malloc(wps_ielen);
+			if ( pmlmepriv->wps_probe_resp_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			
+			//add PUSH_BUTTON config_method by driver self in wpsie of probe_resp at GO Mode 
+			if ( (puconfig_method = (u16*)rtw_get_wps_attr_content( wps_ie, wps_ielen, WPS_ATTR_CONF_METHOD , NULL, &attr_contentlen)) != NULL )
+			{
+				#ifdef CONFIG_DEBUG_CFG80211		
+				//printk("config_method in wpsie of probe_resp = 0x%x\n", be16_to_cpu(*puconfig_method));
+				#endif
+				
+				uconfig_method = WPS_CM_PUSH_BUTTON;
+				uconfig_method = cpu_to_be16( uconfig_method );
+
+				*puconfig_method |= uconfig_method;			
+			}
+			
+			_rtw_memcpy(pmlmepriv->wps_probe_resp_ie, wps_ie, wps_ielen);
+			pmlmepriv->wps_probe_resp_ie_len = wps_ielen;
+			
+		}
+
+		//buf += wps_ielen;
+		//len -= wps_ielen;
+
+		#ifdef CONFIG_P2P
+		if((p2p_ie=rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen))) 
+		{
+			u8 is_GO = _FALSE;			
+			u32 attr_contentlen = 0;
+			u16 cap_attr=0;
+
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_resp_p2p_ielen=%d\n", p2p_ielen);
+			#endif			
+
+			//Check P2P Capability ATTR
+			if( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*) &attr_contentlen) )
+			{
+				u8 grp_cap=0;
+				//DBG_8192C( "[%s] Got P2P Capability Attr!!\n", __FUNCTION__ );
+				cap_attr = le16_to_cpu(cap_attr);
+				grp_cap = (u8)((cap_attr >> 8)&0xff);
+				
+				is_GO = (grp_cap&BIT(0)) ? _TRUE:_FALSE;
+
+				if(is_GO)
+					DBG_8192C("Got P2P Capability Attr, grp_cap=0x%x, is_GO\n", grp_cap);
+			}
+
+
+			if(is_GO == _FALSE)
+			{
+				if(pmlmepriv->p2p_probe_resp_ie)
+				{
+					u32 free_len = pmlmepriv->p2p_probe_resp_ie_len;
+					pmlmepriv->p2p_probe_resp_ie_len = 0;
+					rtw_mfree(pmlmepriv->p2p_probe_resp_ie, free_len);
+					pmlmepriv->p2p_probe_resp_ie = NULL;		
+				}	
+
+				pmlmepriv->p2p_probe_resp_ie = rtw_malloc(p2p_ielen);
+				if ( pmlmepriv->p2p_probe_resp_ie == NULL) {
+					DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+					return -EINVAL;
+				
+				}
+				_rtw_memcpy(pmlmepriv->p2p_probe_resp_ie, p2p_ie, p2p_ielen);
+				pmlmepriv->p2p_probe_resp_ie_len = p2p_ielen;
+			}		
+			else
+			{
+				if(pmlmepriv->p2p_go_probe_resp_ie)
+				{
+					u32 free_len = pmlmepriv->p2p_go_probe_resp_ie_len;
+					pmlmepriv->p2p_go_probe_resp_ie_len = 0;
+					rtw_mfree(pmlmepriv->p2p_go_probe_resp_ie, free_len);
+					pmlmepriv->p2p_go_probe_resp_ie = NULL;			
+				}	
+
+				pmlmepriv->p2p_go_probe_resp_ie = rtw_malloc(p2p_ielen);
+				if ( pmlmepriv->p2p_go_probe_resp_ie == NULL) {
+					DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+					return -EINVAL;
+			
+				}
+				_rtw_memcpy(pmlmepriv->p2p_go_probe_resp_ie, p2p_ie, p2p_ielen);
+				pmlmepriv->p2p_go_probe_resp_ie_len = p2p_ielen;
+			}
+			
+		}
+		#endif //CONFIG_P2P
+		
+		//buf += p2p_ielen;
+		//len -= p2p_ielen;
+
+		#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(buf, len, NULL, &wfd_ielen)) 
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_resp_wfd_ielen=%d\n", wfd_ielen);
+			#endif
+			
+			if(pmlmepriv->wfd_probe_resp_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_probe_resp_ie_len;
+				pmlmepriv->wfd_probe_resp_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_probe_resp_ie, free_len);
+				pmlmepriv->wfd_probe_resp_ie = NULL;
+			}	
+
+			pmlmepriv->wfd_probe_resp_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_probe_resp_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+			
+			}
+			rtw_get_wfd_ie(buf, len, pmlmepriv->wfd_probe_resp_ie, &pmlmepriv->wfd_probe_resp_ie_len);			
+		}
+		#endif //CONFIG_WFD
+		
+	}
+
+	return ret;
+	
+}
+
+static int rtw_cfg80211_set_assoc_resp_wpsp2pie(struct net_device *net, char *buf, int len)
+{
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+	
+	if(len>0)
+	{
+		if(pmlmepriv->wps_assoc_resp_ie)
+		{
+			u32 free_len = pmlmepriv->wps_assoc_resp_ie_len;
+			pmlmepriv->wps_assoc_resp_ie_len = 0;
+			rtw_mfree(pmlmepriv->wps_assoc_resp_ie, free_len);
+			pmlmepriv->wps_assoc_resp_ie = NULL;
+		}	
+
+		pmlmepriv->wps_assoc_resp_ie = rtw_malloc(len);
+		if ( pmlmepriv->wps_assoc_resp_ie == NULL) {
+			DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+			
+		}
+		_rtw_memcpy(pmlmepriv->wps_assoc_resp_ie, buf, len);
+		pmlmepriv->wps_assoc_resp_ie_len = len;
+	}
+
+	return ret;
+	
+}
+
+int rtw_cfg80211_set_mgnt_wpsp2pie(struct net_device *net, char *buf, int len,
+	int type)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u32	p2p_ielen = 0;
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+#endif
+
+	if(	(rtw_get_wps_ie(buf, len, NULL, &wps_ielen) && (wps_ielen>0))
+		#ifdef CONFIG_P2P
+		|| (rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen) && (p2p_ielen>0))
+		#endif
+	)		
+	{	
+		if (net != NULL) 
+		{
+			switch (type) 
+			{
+				case 0x1: //BEACON
+				ret = rtw_cfg80211_set_beacon_wpsp2pie(net, buf, len);
+				break;
+				case 0x2: //PROBE_RESP
+				ret = rtw_cfg80211_set_probe_resp_wpsp2pie(net, buf, len);
+				break;
+				case 0x4: //ASSOC_RESP
+				ret = rtw_cfg80211_set_assoc_resp_wpsp2pie(net, buf, len);
+				break;
+			}		
+		}
+	}	
+
+	return ret;
+	
+}
+
+static struct cfg80211_ops rtw_cfg80211_ops = {
+	.change_virtual_intf = cfg80211_rtw_change_iface,
+	.add_key = cfg80211_rtw_add_key,
+	.get_key = cfg80211_rtw_get_key,
+	.del_key = cfg80211_rtw_del_key,
+	.set_default_key = cfg80211_rtw_set_default_key,
+	.get_station = cfg80211_rtw_get_station,
+	.scan = cfg80211_rtw_scan,
+	.set_wiphy_params = cfg80211_rtw_set_wiphy_params,
+	.connect = cfg80211_rtw_connect,
+	.disconnect = cfg80211_rtw_disconnect,
+	.join_ibss = cfg80211_rtw_join_ibss,
+	.leave_ibss = cfg80211_rtw_leave_ibss,
+	.set_tx_power = cfg80211_rtw_set_txpower,
+	.get_tx_power = cfg80211_rtw_get_txpower,
+	.set_power_mgmt = cfg80211_rtw_set_power_mgmt,
+	.set_pmksa = cfg80211_rtw_set_pmksa,
+	.del_pmksa = cfg80211_rtw_del_pmksa,
+	.flush_pmksa = cfg80211_rtw_flush_pmksa,
+	
+#ifdef CONFIG_AP_MODE
+	.add_virtual_intf = cfg80211_rtw_add_virtual_intf,
+	.del_virtual_intf = cfg80211_rtw_del_virtual_intf,
+
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) && !defined(COMPAT_KERNEL_RELEASE)
+	.add_beacon = cfg80211_rtw_add_beacon,
+	.set_beacon = cfg80211_rtw_set_beacon,
+	.del_beacon = cfg80211_rtw_del_beacon,
+	#else
+	.start_ap = cfg80211_rtw_start_ap,
+	.change_beacon = cfg80211_rtw_change_beacon,
+	.stop_ap = cfg80211_rtw_stop_ap,
+	#endif
+	
+	.add_station = cfg80211_rtw_add_station,
+	.del_station = cfg80211_rtw_del_station,
+	.change_station = cfg80211_rtw_change_station,
+	.dump_station = cfg80211_rtw_dump_station,
+	.change_bss = cfg80211_rtw_change_bss,
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+	.set_channel = cfg80211_rtw_set_channel,
+	#endif
+	//.auth = cfg80211_rtw_auth,
+	//.assoc = cfg80211_rtw_assoc,	
+#endif //CONFIG_AP_MODE
+
+#ifdef CONFIG_P2P
+	.remain_on_channel = cfg80211_rtw_remain_on_channel,
+	.cancel_remain_on_channel = cfg80211_rtw_cancel_remain_on_channel,
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)	 
+	.mgmt_tx = cfg80211_rtw_mgmt_tx,
+	.mgmt_frame_register = cfg80211_rtw_mgmt_frame_register,
+#elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35))
+	.action = cfg80211_rtw_mgmt_tx,
+#endif
+};
+
+static void rtw_cfg80211_init_ht_capab(struct ieee80211_sta_ht_cap *ht_cap, enum nl80211_band band, u8 rf_type)
+{
+
+#define MAX_BIT_RATE_40MHZ_MCS15 	300	/* Mbps */
+#define MAX_BIT_RATE_40MHZ_MCS7 	150	/* Mbps */
+
+	ht_cap->ht_supported = _TRUE;
+
+	ht_cap->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+	    				IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_SGI_20 |
+	    				IEEE80211_HT_CAP_DSSSCCK40 | IEEE80211_HT_CAP_MAX_AMSDU;
+
+	/*
+	 *Maximum length of AMPDU that the STA can receive.
+	 *Length = 2 ^ (13 + max_ampdu_length_exp) - 1 (octets)
+	 */
+	ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+
+	/*Minimum MPDU start spacing , */
+	ht_cap->ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+
+	ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+
+	/*
+	 *hw->wiphy->bands[NL80211_BAND_2GHZ]
+	 *base on ant_num
+	 *rx_mask: RX mask
+	 *if rx_ant =1 rx_mask[0]=0xff;==>MCS0-MCS7
+	 *if rx_ant =2 rx_mask[1]=0xff;==>MCS8-MCS15
+	 *if rx_ant >=3 rx_mask[2]=0xff;
+	 *if BW_40 rx_mask[4]=0x01;
+	 *highest supported RX rate
+	 */
+	if(rf_type == RF_1T1R)
+	{
+		ht_cap->mcs.rx_mask[0] = 0xFF;
+		ht_cap->mcs.rx_mask[1] = 0x00;
+		ht_cap->mcs.rx_mask[4] = 0x01;
+
+		ht_cap->mcs.rx_highest = MAX_BIT_RATE_40MHZ_MCS7;
+	}
+	else if((rf_type == RF_1T2R) || (rf_type==RF_2T2R))
+	{
+		ht_cap->mcs.rx_mask[0] = 0xFF;
+		ht_cap->mcs.rx_mask[1] = 0xFF;
+		ht_cap->mcs.rx_mask[4] = 0x01;
+
+		ht_cap->mcs.rx_highest = MAX_BIT_RATE_40MHZ_MCS15;
+	}
+	else
+	{
+		DBG_8192C("%s, error rf_type=%d\n", __func__, rf_type);
+	}	
+	
+}
+
+void rtw_cfg80211_init_wiphy(_adapter *padapter)
+{
+	u8 rf_type;
+	struct ieee80211_supported_band *bands;
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+	struct wiphy *wiphy = pwdev->wiphy;
+	
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+	DBG_8192C("%s:rf_type=%d\n", __func__, rf_type);
+
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11G) */
+	{
+		bands = wiphy->bands[NL80211_BAND_2GHZ];
+		if(bands)
+			rtw_cfg80211_init_ht_capab(&bands->ht_cap, NL80211_BAND_2GHZ, rf_type);
+	}
+
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11A) */
+	{
+		bands = wiphy->bands[NL80211_BAND_5GHZ];
+		if(bands)
+			rtw_cfg80211_init_ht_capab(&bands->ht_cap, NL80211_BAND_5GHZ, rf_type);
+	}
+}
+
+/*
+struct ieee80211_iface_limit rtw_limits[] = {
+	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION)
+					| BIT(NL80211_IFTYPE_ADHOC)
+#ifdef CONFIG_AP_MODE
+					| BIT(NL80211_IFTYPE_AP)
+#endif
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+					| BIT(NL80211_IFTYPE_P2P_CLIENT)
+					| BIT(NL80211_IFTYPE_P2P_GO)
+#endif
+	},
+	{.max = 1, .types = BIT(NL80211_IFTYPE_MONITOR)},
+};
+
+struct ieee80211_iface_combination rtw_combinations = {
+	.limits = rtw_limits,
+	.n_limits = ARRAY_SIZE(rtw_limits),
+	.max_interfaces = 2,
+	.num_different_channels = 1,
+};
+*/
+
+static void rtw_cfg80211_preinit_wiphy(_adapter *padapter, struct wiphy *wiphy)
+{
+
+	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+	wiphy->max_scan_ssids = RTW_SSID_SCAN_AMOUNT;
+	wiphy->max_scan_ie_len = RTW_SCAN_IE_LEN_MAX;	
+	wiphy->max_num_pmkids = RTW_MAX_NUM_PMKIDS;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)	 
+	wiphy->max_remain_on_channel_duration = RTW_MAX_REMAIN_ON_CHANNEL_DURATION;
+#endif
+	
+	wiphy->interface_modes =	BIT(NL80211_IFTYPE_STATION)
+								| BIT(NL80211_IFTYPE_ADHOC)
+#ifdef CONFIG_AP_MODE
+								| BIT(NL80211_IFTYPE_AP)
+								| BIT(NL80211_IFTYPE_MONITOR)
+#endif
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+								| BIT(NL80211_IFTYPE_P2P_CLIENT)
+								| BIT(NL80211_IFTYPE_P2P_GO)
+#endif
+								;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)	
+#ifdef CONFIG_AP_MODE
+	wiphy->mgmt_stypes = rtw_cfg80211_default_mgmt_stypes;
+#endif //CONFIG_AP_MODE	
+#endif		
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,0,0))
+	wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);
+#endif
+
+	/*
+	wiphy->iface_combinations = &rtw_combinations;
+	wiphy->n_iface_combinations = 1;
+	*/
+
+	wiphy->cipher_suites = rtw_cipher_suites;
+	wiphy->n_cipher_suites = ARRAY_SIZE(rtw_cipher_suites);
+
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11G) */
+		wiphy->bands[NL80211_BAND_2GHZ] = rtw_spt_band_alloc(NL80211_BAND_2GHZ);
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11A) */
+		wiphy->bands[NL80211_BAND_5GHZ] = rtw_spt_band_alloc(NL80211_BAND_5GHZ);
+	
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38) && LINUX_VERSION_CODE < KERNEL_VERSION(3,0,0))
+	wiphy->flags |= WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,3,0))
+	wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+	wiphy->flags |= WIPHY_FLAG_OFFCHAN_TX | WIPHY_FLAG_HAVE_AP_SME;
+#endif
+
+	if(padapter->registrypriv.power_mgnt != PS_MODE_ACTIVE)
+		wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+	else 
+		wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+}
+
+int rtw_wdev_alloc(_adapter *padapter, struct device *dev)
+{
+	int ret = 0;
+	struct wiphy *wiphy;
+	struct wireless_dev *wdev;
+	struct rtw_wdev_priv *pwdev_priv;
+	struct net_device *pnetdev = padapter->pnetdev;
+	
+	DBG_8192C("%s(padapter=%p)\n", __func__, padapter);
+
+	/* wiphy */
+	wiphy = wiphy_new(&rtw_cfg80211_ops, sizeof(struct rtw_wdev_priv));
+	if (!wiphy) {
+		DBG_8192C("Couldn't allocate wiphy device\n");
+		ret = -ENOMEM;
+		goto exit;
+	}
+	set_wiphy_dev(wiphy, dev);
+	rtw_cfg80211_preinit_wiphy(padapter, wiphy);
+
+	ret = wiphy_register(wiphy);
+	if (ret < 0) {
+		DBG_8192C("Couldn't register wiphy device\n");
+		goto free_wiphy;
+	}
+
+	/*  wdev */
+	wdev = (struct wireless_dev *)rtw_zmalloc(sizeof(struct wireless_dev));
+	if (!wdev) {
+		DBG_8192C("Couldn't allocate wireless device\n");
+		ret = -ENOMEM;
+		goto unregister_wiphy;
+	}
+	wdev->wiphy = wiphy;
+	wdev->netdev = pnetdev;
+
+	wdev->iftype = NL80211_IFTYPE_STATION; // will be init in rtw_hal_init()
+	                                       // Must sync with _rtw_init_mlme_priv()
+	                                       // pmlmepriv->fw_state = WIFI_STATION_STATE
+	//wdev->iftype = NL80211_IFTYPE_MONITOR; // for rtw_setopmode_cmd() in cfg80211_rtw_change_iface()
+	padapter->rtw_wdev = wdev;
+	pnetdev->ieee80211_ptr = wdev;
+
+	//init pwdev_priv
+	pwdev_priv = wdev_to_priv(wdev);
+	pwdev_priv->rtw_wdev = wdev;
+	pwdev_priv->pmon_ndev = NULL;
+	pwdev_priv->ifname_mon[0] = '\0';
+	pwdev_priv->padapter = padapter;
+	pwdev_priv->scan_request = NULL;
+	_rtw_spinlock_init(&pwdev_priv->scan_req_lock);
+		
+	pwdev_priv->p2p_enabled = _FALSE;
+	pwdev_priv->provdisc_req_issued = _FALSE;
+	rtw_wdev_invit_info_init(&pwdev_priv->invit_info);
+	rtw_wdev_nego_info_init(&pwdev_priv->nego_info);
+		
+	pwdev_priv->bandroid_scan = _FALSE;
+
+	if(padapter->registrypriv.power_mgnt != PS_MODE_ACTIVE)
+		pwdev_priv->power_mgmt = _TRUE;
+	else
+		pwdev_priv->power_mgmt = _FALSE;
+	
+#ifdef CONFIG_CONCURRENT_MODE
+	ATOMIC_SET(&pwdev_priv->switch_ch_to, 1);	
+	ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);	
+#endif
+
+	return ret;
+
+	rtw_mfree((u8*)wdev, sizeof(struct wireless_dev));
+unregister_wiphy:
+	wiphy_unregister(wiphy);
+ free_wiphy:
+ 	wiphy_free(wiphy);
+exit:
+	return ret;
+	
+}
+
+void rtw_wdev_free(struct wireless_dev *wdev)
+{
+	struct rtw_wdev_priv *pwdev_priv;
+
+	DBG_8192C("%s(wdev=%p)\n", __func__, wdev);
+
+	if (!wdev)
+		return;
+
+	pwdev_priv = wdev_to_priv(wdev);
+
+	rtw_spt_band_free(wdev->wiphy->bands[NL80211_BAND_2GHZ]);
+	rtw_spt_band_free(wdev->wiphy->bands[NL80211_BAND_5GHZ]);
+	
+	wiphy_free(wdev->wiphy);
+
+	rtw_mfree((u8*)wdev, sizeof(struct wireless_dev));
+}
+
+void rtw_wdev_unregister(struct wireless_dev *wdev)
+{
+	struct rtw_wdev_priv *pwdev_priv;
+
+	DBG_8192C("%s(wdev=%p)\n", __func__, wdev);
+
+	if (!wdev)
+		return;
+
+	pwdev_priv = wdev_to_priv(wdev);
+
+	rtw_cfg80211_indicate_scan_done(pwdev_priv, _TRUE);
+
+	if (pwdev_priv->pmon_ndev) {
+		DBG_8192C("%s, unregister monitor interface\n", __func__);
+		unregister_netdev(pwdev_priv->pmon_ndev);
+	}
+
+	wiphy_unregister(wdev->wiphy);
+}
+
+#endif //CONFIG_IOCTL_CFG80211
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c
new file mode 100755
index 0000000000000..9adbeaf16cf85
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c
@@ -0,0 +1,11909 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _IOCTL_LINUX_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+#include <rtw_debug.h>
+#include <wifi.h>
+#include <rtw_mlme.h>
+#include <rtw_mlme_ext.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_set.h>
+#include <rtw_ioctl_query.h>
+
+//#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp_ioctl.h>
+//#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif //CONFIG_USB_HCI
+#include <rtw_version.h>
+
+#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp.h>
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27))
+#define  iwe_stream_add_event(a, b, c, d, e)  iwe_stream_add_event(b, c, d, e)
+#define  iwe_stream_add_point(a, b, c, d, e)  iwe_stream_add_point(b, c, d, e)
+#endif
+
+
+#define RTL_IOCTL_WPA_SUPPLICANT	SIOCIWFIRSTPRIV+30
+
+#define SCAN_ITEM_SIZE 768
+#define MAX_CUSTOM_LEN 64
+#define RATE_COUNT 4
+
+#ifdef CONFIG_GLOBAL_UI_PID
+extern int ui_pid[3];
+#endif
+
+// combo scan
+#define WEXT_CSCAN_AMOUNT 9
+#define WEXT_CSCAN_BUF_LEN		360
+#define WEXT_CSCAN_HEADER		"CSCAN S\x01\x00\x00S\x00"
+#define WEXT_CSCAN_HEADER_SIZE		12
+#define WEXT_CSCAN_SSID_SECTION		'S'
+#define WEXT_CSCAN_CHANNEL_SECTION	'C'
+#define WEXT_CSCAN_NPROBE_SECTION	'N'
+#define WEXT_CSCAN_ACTV_DWELL_SECTION	'A'
+#define WEXT_CSCAN_PASV_DWELL_SECTION	'P'
+#define WEXT_CSCAN_HOME_DWELL_SECTION	'H'
+#define WEXT_CSCAN_TYPE_SECTION		'T'
+
+
+extern u8 key_2char2num(u8 hch, u8 lch);
+extern u8 str_2char2num(u8 hch, u8 lch);
+extern u8 convert_ip_addr(u8 hch, u8 mch, u8 lch);
+
+u32 rtw_rates[] = {1000000,2000000,5500000,11000000,
+	6000000,9000000,12000000,18000000,24000000,36000000,48000000,54000000};
+
+static const char * const iw_operation_mode[] = 
+{ 
+	"Auto", "Ad-Hoc", "Managed",  "Master", "Repeater", "Secondary", "Monitor" 
+};
+
+static int hex2num_i(char c)
+{
+	if (c >= '0' && c <= '9')
+		return c - '0';
+	if (c >= 'a' && c <= 'f')
+		return c - 'a' + 10;
+	if (c >= 'A' && c <= 'F')
+		return c - 'A' + 10;
+	return -1;
+}
+
+static int hex2byte_i(const char *hex)
+{
+	int a, b;
+	a = hex2num_i(*hex++);
+	if (a < 0)
+		return -1;
+	b = hex2num_i(*hex++);
+	if (b < 0)
+		return -1;
+	return (a << 4) | b;
+}
+
+/**
+ * hwaddr_aton - Convert ASCII string to MAC address
+ * @txt: MAC address as a string (e.g., "00:11:22:33:44:55")
+ * @addr: Buffer for the MAC address (ETH_ALEN = 6 bytes)
+ * Returns: 0 on success, -1 on failure (e.g., string not a MAC address)
+ */
+static int hwaddr_aton_i(const char *txt, u8 *addr)
+{
+	int i;
+
+	for (i = 0; i < 6; i++) {
+		int a, b;
+
+		a = hex2num_i(*txt++);
+		if (a < 0)
+			return -1;
+		b = hex2num_i(*txt++);
+		if (b < 0)
+			return -1;
+		*addr++ = (a << 4) | b;
+		if (i < 5 && *txt++ != ':')
+			return -1;
+	}
+
+	return 0;
+}
+
+static void indicate_wx_custom_event(_adapter *padapter, char *msg)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	u8 *buff, *p;
+	union iwreq_data wrqu;
+
+	if ((u32)strlen(msg) > IW_CUSTOM_MAX) {
+		DBG_871X("%s strlen(msg):%u > IW_CUSTOM_MAX:%u\n", __FUNCTION__ ,(u32)strlen(msg), IW_CUSTOM_MAX);
+		return;
+	}
+
+	buff = rtw_zmalloc(IW_CUSTOM_MAX+1);
+	if(!buff)
+		return;
+
+	_rtw_memcpy(buff, msg, strlen(msg));
+
+	_rtw_memset(&wrqu,0,sizeof(wrqu));
+	wrqu.data.length = strlen(msg);
+
+	DBG_871X("%s %s\n", __FUNCTION__, buff);
+	wireless_send_event(padapter->pnetdev, IWEVCUSTOM, &wrqu, buff);
+
+	rtw_mfree(buff, IW_CUSTOM_MAX+1);
+#endif
+}
+
+
+static void request_wps_pbc_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	u8 *buff, *p;
+	union iwreq_data wrqu;
+
+	buff = rtw_malloc(IW_CUSTOM_MAX);
+	if(!buff)
+		return;
+
+	_rtw_memset(buff, 0, IW_CUSTOM_MAX);
+
+	p=buff;
+
+	p+=sprintf(p, "WPS_PBC_START.request=TRUE");
+
+	_rtw_memset(&wrqu,0,sizeof(wrqu));
+
+	wrqu.data.length = p-buff;
+
+	wrqu.data.length = (wrqu.data.length<IW_CUSTOM_MAX) ? wrqu.data.length:IW_CUSTOM_MAX;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	wireless_send_event(padapter->pnetdev, IWEVCUSTOM, &wrqu, buff);
+
+	if(buff)
+	{
+		rtw_mfree(buff, IW_CUSTOM_MAX);
+	}
+#endif
+}
+
+
+void indicate_wx_scan_complete_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	union iwreq_data wrqu;
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	_rtw_memset(&wrqu, 0, sizeof(union iwreq_data));
+
+	//DBG_871X("+rtw_indicate_wx_scan_complete_event\n");
+	wireless_send_event(padapter->pnetdev, SIOCGIWSCAN, &wrqu, NULL);
+#endif
+}
+
+
+void rtw_indicate_wx_assoc_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	union iwreq_data wrqu;
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	_rtw_memset(&wrqu, 0, sizeof(union iwreq_data));
+
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memcpy(wrqu.ap_addr.sa_data, pmlmepriv->cur_network.network.MacAddress, ETH_ALEN);
+
+	//DBG_871X("+rtw_indicate_wx_assoc_event\n");
+	wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void rtw_indicate_wx_disassoc_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	union iwreq_data wrqu;
+
+	_rtw_memset(&wrqu, 0, sizeof(union iwreq_data));
+
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+	_rtw_memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+
+	//DBG_871X("+rtw_indicate_wx_disassoc_event\n");
+	wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+/*
+uint	rtw_is_cckrates_included(u8 *rate)
+{	
+		u32	i = 0;			
+
+		while(rate[i]!=0)
+		{		
+			if  (  (((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||		
+			(((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22) )		
+			return _TRUE;	
+			i++;
+		}
+		
+		return _FALSE;
+}
+
+uint	rtw_is_cckratesonly_included(u8 *rate)
+{
+	u32 i = 0;
+
+	while(rate[i]!=0)
+	{
+			if  (  (((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+				(((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22) )
+			return _FALSE;		
+			i++;
+	}
+	
+	return _TRUE;
+}
+*/
+
+static char *translate_scan(_adapter *padapter, 
+				struct iw_request_info* info, struct wlan_network *pnetwork,
+				char *start, char *stop)
+{
+	struct iw_event iwe;
+	u16 cap;
+	u32 ht_ielen = 0;
+	char custom[MAX_CUSTOM_LEN];
+	char *p;
+	u16 max_rate=0, rate, ht_cap=_FALSE;
+	u32 i = 0;	
+	char	*current_val;
+	long rssi;
+	u8 bw_40MHz=0, short_GI=0;
+	u16 mcs_rate=0;
+	struct registry_priv *pregpriv = &padapter->registrypriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_P2P
+#ifdef CONFIG_WFD
+	if ( SCAN_RESULT_ALL == pwdinfo->wfd_info->scan_result_type )
+	{
+
+	}
+	else if ( ( SCAN_RESULT_P2P_ONLY == pwdinfo->wfd_info->scan_result_type ) || 
+		      ( SCAN_RESULT_WFD_TYPE == pwdinfo->wfd_info->scan_result_type ) )
+#endif // CONFIG_WFD
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			u32	blnGotP2PIE = _FALSE;
+			
+			//	User is doing the P2P device discovery
+			//	The prefix of SSID should be "DIRECT-" and the IE should contains the P2P IE.
+			//	If not, the driver should ignore this AP and go to the next AP.
+
+			//	Verifying the SSID
+			if ( _rtw_memcmp( pnetwork->network.Ssid.Ssid, pwdinfo->p2p_wildcard_ssid, P2P_WILDCARD_SSID_LEN ) )
+			{
+				u32	p2pielen = 0;
+
+				//	Verifying the P2P IE
+				if ( rtw_get_p2p_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen) )
+				{
+					blnGotP2PIE = _TRUE;
+				}
+			}
+
+			if ( blnGotP2PIE == _FALSE )
+			{
+				return start;
+			}
+			
+		}
+	}
+
+#ifdef CONFIG_WFD
+	if ( SCAN_RESULT_WFD_TYPE == pwdinfo->wfd_info->scan_result_type )
+	{
+		u32	blnGotWFD = _FALSE;
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+		
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+			
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen) )
+			{
+				if ( pwdinfo->wfd_info->wfd_device_type == WFD_DEVINFO_PSINK )
+				{
+					//	the first two bits will indicate the WFD device type
+					if ( ( wfd_devinfo[ 1 ] & 0x03 ) == WFD_DEVINFO_SOURCE )
+					{
+						//	If this device is Miracast PSink device, the scan reuslt should just provide the Miracast source.
+						blnGotWFD = _TRUE;
+					}
+				}
+				else if ( pwdinfo->wfd_info->wfd_device_type == WFD_DEVINFO_SOURCE )
+				{
+					//	the first two bits will indicate the WFD device type
+					if ( ( wfd_devinfo[ 1 ] & 0x03 ) == WFD_DEVINFO_PSINK )
+					{
+						//	If this device is Miracast source device, the scan reuslt should just provide the Miracast PSink.
+						//	Todo: How about the SSink?!
+						blnGotWFD = _TRUE;
+					}
+				}
+			}
+		}
+		
+		if ( blnGotWFD == _FALSE )
+		{
+			return start;
+		}
+	}
+#endif // CONFIG_WFD
+
+#endif //CONFIG_P2P
+	/*  AP MAC address  */
+	iwe.cmd = SIOCGIWAP;
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memcpy(iwe.u.ap_addr.sa_data, pnetwork->network.MacAddress, ETH_ALEN);
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
+
+	/* Add the ESSID */
+	iwe.cmd = SIOCGIWESSID;
+	iwe.u.data.flags = 1;	
+	iwe.u.data.length = min((u16)pnetwork->network.Ssid.SsidLength, (u16)32);
+	start = iwe_stream_add_point(info, start, stop, &iwe, pnetwork->network.Ssid.Ssid);
+
+	//parsing HT_CAP_IE
+		p = rtw_get_ie(&pnetwork->network.IEs[12], _HT_CAPABILITY_IE_, &ht_ielen, pnetwork->network.IELength-12);
+
+	if(p && ht_ielen>0)
+	{
+		struct rtw_ieee80211_ht_cap *pht_capie;
+		ht_cap = _TRUE;			
+		pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);		
+		_rtw_memcpy(&mcs_rate , pht_capie->supp_mcs_set, 2);
+		bw_40MHz = (pht_capie->cap_info&IEEE80211_HT_CAP_SUP_WIDTH) ? 1:0;
+		short_GI = (pht_capie->cap_info&(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40)) ? 1:0;
+	}
+
+	/* Add the protocol name */
+	iwe.cmd = SIOCGIWNAME;
+	if ((rtw_is_cckratesonly_included((u8*)&pnetwork->network.SupportedRates)) == _TRUE)		
+	{
+		if(ht_cap == _TRUE)
+			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bn");
+		else
+		snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b");
+	}	
+	else if ((rtw_is_cckrates_included((u8*)&pnetwork->network.SupportedRates)) == _TRUE)	
+	{
+		if(ht_cap == _TRUE)
+			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bgn");
+		else
+		snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bg");
+	}	
+	else
+	{
+		if(pnetwork->network.Configuration.DSConfig > 14)
+		{
+			if(ht_cap == _TRUE)
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11an");
+			else
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11a");
+		}
+		else
+		{
+			if(ht_cap == _TRUE)
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11gn");
+			else
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g");
+		}
+	}	
+
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
+
+	  /* Add mode */
+        iwe.cmd = SIOCGIWMODE;
+	_rtw_memcpy((u8 *)&cap, rtw_get_capability_from_ie(pnetwork->network.IEs), 2);
+
+
+	cap = le16_to_cpu(cap);
+
+	if(cap & (WLAN_CAPABILITY_IBSS |WLAN_CAPABILITY_BSS)){
+		if (cap & WLAN_CAPABILITY_BSS)
+			iwe.u.mode = IW_MODE_MASTER;
+		else
+			iwe.u.mode = IW_MODE_ADHOC;
+
+		start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_UINT_LEN);
+	}
+
+	if(pnetwork->network.Configuration.DSConfig<1 /*|| pnetwork->network.Configuration.DSConfig>14*/)
+		pnetwork->network.Configuration.DSConfig = 1;
+
+	 /* Add frequency/channel */
+	iwe.cmd = SIOCGIWFREQ;
+	iwe.u.freq.m = rtw_ch2freq(pnetwork->network.Configuration.DSConfig) * 100000;
+	iwe.u.freq.e = 1;
+	iwe.u.freq.i = pnetwork->network.Configuration.DSConfig;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_FREQ_LEN);
+
+	/* Add encryption capability */
+	iwe.cmd = SIOCGIWENCODE;
+	if (cap & WLAN_CAPABILITY_PRIVACY)
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	else
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	iwe.u.data.length = 0;
+	start = iwe_stream_add_point(info, start, stop, &iwe, pnetwork->network.Ssid.Ssid);
+
+	/*Add basic and extended rates */
+	max_rate = 0;
+	p = custom;
+	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
+	while(pnetwork->network.SupportedRates[i]!=0)
+	{
+		rate = pnetwork->network.SupportedRates[i]&0x7F; 
+		if (rate > max_rate)
+			max_rate = rate;
+		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+		i++;
+	}
+	
+	if(ht_cap == _TRUE)
+	{
+		if(mcs_rate&0x8000)//MCS15
+		{
+			max_rate = (bw_40MHz) ? ((short_GI)?300:270):((short_GI)?144:130);
+			
+		}
+		else if(mcs_rate&0x0080)//MCS7
+		{
+			max_rate = (bw_40MHz) ? ((short_GI)?150:135):((short_GI)?72:65);
+		}
+		else//default MCS7
+		{
+			DBG_871X("wx_get_scan, mcs_rate_bitmap=0x%x\n", mcs_rate);
+			max_rate = (bw_40MHz) ? ((short_GI)?150:135):((short_GI)?72:65);
+		}
+
+		max_rate = max_rate*2;//Mbps/2;		
+	}
+
+	iwe.cmd = SIOCGIWRATE;
+	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+	iwe.u.bitrate.value = max_rate * 500000;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_PARAM_LEN);
+
+	//parsing WPA/WPA2 IE
+	{
+		u8 buf[MAX_WPA_IE_LEN];
+		u8 wpa_ie[255],rsn_ie[255];
+		u16 wpa_len=0,rsn_len=0;
+		u8 *p;
+		sint out_len=0;
+		out_len=rtw_get_sec_ie(pnetwork->network.IEs ,pnetwork->network.IELength,rsn_ie,&rsn_len,wpa_ie,&wpa_len);
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_scan: ssid=%s\n",pnetwork->network.Ssid.Ssid));
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_scan: wpa_len=%d rsn_len=%d\n",wpa_len,rsn_len));
+
+		if (wpa_len > 0)
+		{
+			p=buf;
+			_rtw_memset(buf, 0, MAX_WPA_IE_LEN);
+			p += sprintf(p, "wpa_ie=");
+			for (i = 0; i < wpa_len; i++) {
+				p += sprintf(p, "%02x", wpa_ie[i]);
+			}
+	
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd = IWEVCUSTOM;
+			iwe.u.data.length = strlen(buf);
+			start = iwe_stream_add_point(info, start, stop, &iwe,buf);
+			
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd =IWEVGENIE;
+			iwe.u.data.length = wpa_len;
+			start = iwe_stream_add_point(info, start, stop, &iwe, wpa_ie);			
+		}
+		if (rsn_len > 0)
+		{
+			p = buf;
+			_rtw_memset(buf, 0, MAX_WPA_IE_LEN);
+			p += sprintf(p, "rsn_ie=");
+			for (i = 0; i < rsn_len; i++) {
+				p += sprintf(p, "%02x", rsn_ie[i]);
+			}
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd = IWEVCUSTOM;
+			iwe.u.data.length = strlen(buf);
+			start = iwe_stream_add_point(info, start, stop, &iwe,buf);
+		
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd =IWEVGENIE;
+			iwe.u.data.length = rsn_len;
+			start = iwe_stream_add_point(info, start, stop, &iwe, rsn_ie);		
+		}
+	}
+
+	{ //parsing WPS IE
+		uint cnt = 0,total_ielen;	
+		u8 *wpsie_ptr=NULL;
+		uint wps_ielen = 0;		
+
+		u8 *ie_ptr = pnetwork->network.IEs +_FIXED_IE_LENGTH_;
+		total_ielen= pnetwork->network.IELength - _FIXED_IE_LENGTH_;
+
+		while(cnt < total_ielen)
+		{
+			if(rtw_is_wps_ie(&ie_ptr[cnt], &wps_ielen) && (wps_ielen>2))			
+			{
+				wpsie_ptr = &ie_ptr[cnt];
+				iwe.cmd =IWEVGENIE;
+				iwe.u.data.length = (u16)wps_ielen;
+				start = iwe_stream_add_point(info, start, stop, &iwe, wpsie_ptr);						
+			}			
+			cnt+=ie_ptr[cnt+1]+2; //goto next		
+		}
+	}
+
+
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	u8 ss, sq;
+	
+	/* Add quality statistics */
+	iwe.cmd = IWEVQUAL;
+	iwe.u.qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED | IW_QUAL_NOISE_INVALID
+	#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+		| IW_QUAL_DBM
+	#endif
+	;
+
+	if ( check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE &&
+		is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network)) {
+		ss = padapter->recvpriv.signal_strength;
+		sq = padapter->recvpriv.signal_qual;
+	} else {
+		ss = pnetwork->network.PhyInfo.SignalStrength;
+		sq = pnetwork->network.PhyInfo.SignalQuality;
+	}
+	
+	
+	#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+	iwe.u.qual.level = (u8) translate_percentage_to_dbm(ss);//dbm
+	#else
+	iwe.u.qual.level = (u8)ss;//%
+	#endif
+	
+	iwe.u.qual.qual = (u8)sq;   // signal quality
+
+	#ifdef CONFIG_PLATFORM_ROCKCHIPS
+	iwe.u.qual.noise = -100; // noise level suggest by zhf@rockchips
+	#else 
+	iwe.u.qual.noise = 0; // noise level
+	#endif //CONFIG_PLATFORM_ROCKCHIPS
+	
+	//DBG_871X("iqual=%d, ilevel=%d, inoise=%d, iupdated=%d\n", iwe.u.qual.qual, iwe.u.qual.level , iwe.u.qual.noise, iwe.u.qual.updated);
+
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
+}
+	
+	return start;	
+}
+
+static int wpa_set_auth_algs(struct net_device *dev, u32 value)
+{	
+	_adapter *padapter = (_adapter *) rtw_netdev_priv(dev);
+	int ret = 0;
+
+	if ((value & AUTH_ALG_SHARED_KEY)&&(value & AUTH_ALG_OPEN_SYSTEM))
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_SHARED_KEY and  AUTH_ALG_OPEN_SYSTEM [value:0x%x]\n",value);
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+	} 
+	else if (value & AUTH_ALG_SHARED_KEY)
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_SHARED_KEY  [value:0x%x]\n",value);
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+#ifdef CONFIG_PLATFORM_MT53XX
+		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared;
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Shared;
+#endif
+	} 
+	else if(value & AUTH_ALG_OPEN_SYSTEM)
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_OPEN_SYSTEM\n");
+		//padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
+		if(padapter->securitypriv.ndisauthtype < Ndis802_11AuthModeWPAPSK)
+		{
+#ifdef CONFIG_PLATFORM_MT53XX
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
+ 			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
+#endif
+		}
+		
+	}
+	else if(value & AUTH_ALG_LEAP)
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_LEAP\n");
+	}
+	else
+	{
+		DBG_871X("wpa_set_auth_algs, error!\n");
+		ret = -EINVAL;
+	}
+
+	return ret;
+	
+}
+
+static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	NDIS_802_11_WEP	 *pwep = NULL;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;		
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info* pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+_func_enter_;
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+
+		if (param->u.crypt.idx >= WEP_KEYS
+#ifdef CONFIG_IEEE80211W
+			&& param->u.crypt.idx > BIP_MAX_KEYID
+#endif //CONFIG_IEEE80211W
+			)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	} 
+	else 
+	{
+
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("wpa_set_encryption, crypt.alg = WEP\n"));
+		DBG_871X("wpa_set_encryption, crypt.alg = WEP\n");
+
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("(1)wep_key_idx=%d\n", wep_key_idx));
+		DBG_871X("(1)wep_key_idx=%d\n", wep_key_idx);
+
+		if (wep_key_idx > WEP_KEYS)
+			return -EINVAL;
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("(2)wep_key_idx=%d\n", wep_key_idx));
+
+		if (wep_key_len > 0) 
+		{
+		 	wep_key_len = wep_key_len <= 5 ? 5 : 13;
+			wep_total_len = wep_key_len + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+		 	pwep =(NDIS_802_11_WEP	 *) rtw_malloc(wep_total_len);
+			if(pwep == NULL){
+				RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,(" wpa_set_encryption: pwep allocate fail !!!\n"));
+				goto exit;
+			}
+
+		 	_rtw_memset(pwep, 0, wep_total_len);
+
+		 	pwep->KeyLength = wep_key_len;
+			pwep->Length = wep_total_len;
+
+			if(wep_key_len==13)
+			{
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+			}
+		}
+		else {		
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		pwep->KeyIndex = wep_key_idx;
+		pwep->KeyIndex |= 0x80000000;
+
+		_rtw_memcpy(pwep->KeyMaterial,  param->u.crypt.key, pwep->KeyLength);
+
+		if(param->u.crypt.set_tx)
+		{
+			DBG_871X("wep, set_tx=1\n");
+
+			if(rtw_set_802_11_add_wep(padapter, pwep) == (u8)_FAIL)
+			{
+				ret = -EOPNOTSUPP ;
+			}
+		}
+		else
+		{
+			DBG_871X("wep, set_tx=0\n");
+			
+			//don't update "psecuritypriv->dot11PrivacyAlgrthm" and 
+			//"psecuritypriv->dot11PrivacyKeyIndex=keyid", but can rtw_set_key to fw/cam
+			
+			if (wep_key_idx >= WEP_KEYS) {
+				ret = -EOPNOTSUPP ;
+				goto exit;
+			}				
+			
+		      _rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->KeyMaterial, pwep->KeyLength);
+			psecuritypriv->dot11DefKeylen[wep_key_idx]=pwep->KeyLength;	
+			rtw_set_key(padapter, psecuritypriv, wep_key_idx, 0);
+		}
+
+		goto exit;		
+	}
+
+	if(padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) // 802_1x
+	{
+		struct sta_info * psta,*pbcmc_sta;
+		struct sta_priv * pstapriv = &padapter->stapriv;
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_MP_STATE) == _TRUE) //sta mode
+		{
+			psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));				
+			if (psta == NULL) {
+				//DEBUG_ERR( ("Set wpa_set_encryption: Obtain Sta_info fail \n"));
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0) 
+					psta->ieee8021x_blocked = _FALSE;
+				
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{
+					psta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}		
+
+				if(param->u.crypt.set_tx ==1)//pairwise key
+				{ 
+					_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+					
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0)//set mic key
+					{						
+						//DEBUG_ERR(("\nset key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+						_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+						padapter->securitypriv.busetkipkey=_FALSE;
+						//_set_timer(&padapter->securitypriv.tkip_timer, 50);						
+					}
+
+					//DEBUG_ERR(("\n param->u.crypt.key_len=%d\n",param->u.crypt.key_len));
+					//DEBUG_ERR(("\n ~~~~stastakey:unicastkey\n"));
+					DBG_871X("\n ~~~~stastakey:unicastkey\n");
+					
+					rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+				}
+				else//group key
+				{ 					
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0 || strcmp(param->u.crypt.alg, "CCMP") == 0)
+					{
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						//only TKIP group key need to install this
+						if(param->u.crypt.key_len > 16)
+						{
+							_rtw_memcpy(padapter->securitypriv.dot118021XGrptxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[16]),8);
+							_rtw_memcpy(padapter->securitypriv.dot118021XGrprxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[24]),8);
+						}
+						padapter->securitypriv.binstallGrpkey = _TRUE;	
+						//DEBUG_ERR((" param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						DBG_871X(" ~~~~set sta key:groupkey\n");
+	
+						padapter->securitypriv.dot118021XGrpKeyid = param->u.crypt.idx;
+	
+						rtw_set_key(padapter,&padapter->securitypriv,param->u.crypt.idx, 1);
+					}
+#ifdef CONFIG_IEEE80211W
+					else if(strcmp(param->u.crypt.alg, "BIP") == 0)
+					{
+						int no;
+						//printk("BIP key_len=%d , index=%d @@@@@@@@@@@@@@@@@@\n", param->u.crypt.key_len, param->u.crypt.idx);
+						//save the IGTK key, length 16 bytes
+						_rtw_memcpy(padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						/*printk("IGTK key below:\n");
+						for(no=0;no<16;no++)
+							printk(" %02x ", padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey[no]);
+						printk("\n");*/
+						padapter->securitypriv.dot11wBIPKeyid = param->u.crypt.idx;
+						padapter->securitypriv.binstallBIPkey = _TRUE;
+						DBG_871X(" ~~~~set sta key:IGKT\n");
+					}
+#endif //CONFIG_IEEE80211W
+					
+#ifdef CONFIG_P2P
+					if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+					{
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_PROVISIONING_DONE);
+					}
+#endif //CONFIG_P2P
+					
+				}						
+			}
+
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta==NULL)
+			{
+				//DEBUG_ERR( ("Set OID_802_11_ADD_KEY: bcmc stainfo is null \n"));
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0) 
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+				
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{							
+					pbcmc_sta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}					
+			}				
+		}
+		else if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) //adhoc mode
+		{		
+		}			
+	}
+
+exit:
+	
+	if (pwep) {
+		rtw_mfree((u8 *)pwep, wep_total_len);		
+	}	
+	
+	_func_exit_;
+	
+	return ret;	
+}
+
+static int rtw_set_wpa_ie(_adapter *padapter, char *pie, unsigned short ielen)
+{
+	u8 *buf=NULL, *pos=NULL;	
+	u32 left; 	
+	int group_cipher = 0, pairwise_cipher = 0;
+	int ret = 0;
+	u8	null_addr[]= {0,0,0,0,0,0};
+#ifdef CONFIG_P2P
+	struct wifidirect_info* pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+	if((ielen > MAX_WPA_IE_LEN) || (pie == NULL)){
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		if(pie == NULL)	
+			return ret;
+		else
+			return -EINVAL;
+	}
+
+	if(ielen)
+	{		
+		buf = rtw_zmalloc(ielen);
+		if (buf == NULL){
+			ret =  -ENOMEM;
+			goto exit;
+		}
+	
+		_rtw_memcpy(buf, pie , ielen);
+
+		//dump
+		{
+			int i;
+			DBG_871X("\n wpa_ie(length:%d):\n", ielen);
+			for(i=0;i<ielen;i=i+8)
+				DBG_871X("0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x \n",buf[i],buf[i+1],buf[i+2],buf[i+3],buf[i+4],buf[i+5],buf[i+6],buf[i+7]);
+		}
+	
+		pos = buf;
+		if(ielen < RSN_HEADER_LEN){
+			RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("Ie len too short %d\n", ielen));
+			ret  = -1;
+			goto exit;
+		}
+
+#if 0
+		pos += RSN_HEADER_LEN;
+		left  = ielen - RSN_HEADER_LEN;
+		
+		if (left >= RSN_SELECTOR_LEN){
+			pos += RSN_SELECTOR_LEN;
+			left -= RSN_SELECTOR_LEN;
+		}		
+		else if (left > 0){
+			RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("Ie length mismatch, %u too much \n", left));
+			ret =-1;
+			goto exit;
+		}
+#endif		
+		
+		if(rtw_parse_wpa_ie(buf, ielen, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPAPSK;
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &buf[0], ielen);	
+		}
+	
+		if(rtw_parse_wpa2_ie(buf, ielen, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPA2PSK;	
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &buf[0], ielen);	
+		}
+			
+		if (group_cipher == 0)
+		{
+			group_cipher = WPA_CIPHER_NONE;
+		}
+		if (pairwise_cipher == 0)
+		{
+			pairwise_cipher = WPA_CIPHER_NONE;
+		}
+			
+		switch(group_cipher)
+		{
+			case WPA_CIPHER_NONE:
+				padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+				padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+				break;
+			case WPA_CIPHER_WEP40:
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+			case WPA_CIPHER_TKIP:
+				padapter->securitypriv.dot118021XGrpPrivacy=_TKIP_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+				break;
+			case WPA_CIPHER_CCMP:
+				padapter->securitypriv.dot118021XGrpPrivacy=_AES_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+				break;
+			case WPA_CIPHER_WEP104:	
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+		}
+
+		switch(pairwise_cipher)
+		{
+			case WPA_CIPHER_NONE:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+				padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+				break;
+			case WPA_CIPHER_WEP40:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+			case WPA_CIPHER_TKIP:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_TKIP_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+				break;
+			case WPA_CIPHER_CCMP:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_AES_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+				break;
+			case WPA_CIPHER_WEP104:	
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+		}
+		
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		{//set wps_ie	
+			u16 cnt = 0;	
+			u8 eid, wps_oui[4]={0x0,0x50,0xf2,0x04};
+			 
+			while( cnt < ielen )
+			{
+				eid = buf[cnt];
+		
+				if((eid==_VENDOR_SPECIFIC_IE_)&&(_rtw_memcmp(&buf[cnt+2], wps_oui, 4)==_TRUE))
+				{
+					DBG_871X("SET WPS_IE\n");
+
+					padapter->securitypriv.wps_ie_len = ( (buf[cnt+1]+2) < (MAX_WPA_IE_LEN<<2)) ? (buf[cnt+1]+2):(MAX_WPA_IE_LEN<<2);
+					
+					_rtw_memcpy(padapter->securitypriv.wps_ie, &buf[cnt], padapter->securitypriv.wps_ie_len);
+					
+					set_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS);
+					
+#ifdef CONFIG_P2P
+					if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_OK))
+					{
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_PROVISIONING_ING);
+					}
+#endif //CONFIG_P2P
+					cnt += buf[cnt+1]+2;
+					
+					break;
+				} else {
+					cnt += buf[cnt+1]+2; //goto next	
+				}				
+			}			
+		}		
+	}
+
+	//TKIP and AES disallow multicast packets until installing group key
+	if(padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_ 
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_ 
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)
+		//WPS open need to enable multicast
+		//|| check_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS) == _TRUE)
+		rtw_hal_set_hwreg(padapter, HW_VAR_OFF_RCR_AM, null_addr);
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		 ("rtw_set_wpa_ie: pairwise_cipher=0x%08x padapter->securitypriv.ndisencryptstatus=%d padapter->securitypriv.ndisauthtype=%d\n",
+		  pairwise_cipher, padapter->securitypriv.ndisencryptstatus, padapter->securitypriv.ndisauthtype));
+ 	
+exit:
+
+	if (buf) rtw_mfree(buf, ielen);
+	
+	return ret;	
+}
+
+static int rtw_wx_get_name(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u16 cap;
+	u32 ht_ielen = 0;
+	char *p;
+	u8 ht_cap=_FALSE;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+	NDIS_802_11_RATES_EX* prates = NULL;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("cmd_code=%x\n", info->cmd));
+
+	_func_enter_;	
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		//parsing HT_CAP_IE
+		p = rtw_get_ie(&pcur_bss->IEs[12], _HT_CAPABILITY_IE_, &ht_ielen, pcur_bss->IELength-12);
+		if(p && ht_ielen>0)
+		{
+			ht_cap = _TRUE;
+		}
+
+		prates = &pcur_bss->SupportedRates;
+
+		if (rtw_is_cckratesonly_included((u8*)prates) == _TRUE)
+		{
+			if(ht_cap == _TRUE)
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bn");
+			else
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11b");
+		}
+		else if ((rtw_is_cckrates_included((u8*)prates)) == _TRUE)
+		{
+			if(ht_cap == _TRUE)
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bgn");
+			else
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bg");
+		}
+		else
+		{
+			if(pcur_bss->Configuration.DSConfig > 14)
+			{
+				if(ht_cap == _TRUE)
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11an");
+				else
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11a");
+			}
+			else
+			{
+				if(ht_cap == _TRUE)
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11gn");
+				else
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11g");
+			}
+		}
+	}
+	else
+	{
+		//prates = &padapter->registrypriv.dev_network.SupportedRates;
+		//snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11g");
+		snprintf(wrqu->name, IFNAMSIZ, "unassociated");
+	}
+
+	_func_exit_;
+
+	return 0;
+}
+
+static int rtw_wx_set_freq(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{	
+	_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+rtw_wx_set_freq\n"));
+
+	_func_exit_;
+	
+	return 0;
+}
+
+static int rtw_wx_get_freq(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+	
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		//wrqu->freq.m = ieee80211_wlan_frequencies[pcur_bss->Configuration.DSConfig-1] * 100000;
+		wrqu->freq.m = rtw_ch2freq(pcur_bss->Configuration.DSConfig) * 100000;
+		wrqu->freq.e = 1;
+		wrqu->freq.i = pcur_bss->Configuration.DSConfig;
+
+	}
+	else{
+		wrqu->freq.m = rtw_ch2freq(padapter->mlmeextpriv.cur_channel) * 100000;
+		wrqu->freq.e = 1;
+		wrqu->freq.i = padapter->mlmeextpriv.cur_channel;
+	}
+
+	return 0;
+}
+
+static int rtw_wx_set_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networkType ;
+	int ret = 0;
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+	_func_enter_;
+	
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+	if (padapter->hw_init_completed==_FALSE){
+		ret = -EPERM;
+		goto exit;
+	}
+	
+	switch(wrqu->mode)
+	{
+		case IW_MODE_AUTO:
+			networkType = Ndis802_11AutoUnknown;
+			DBG_871X("set_mode = IW_MODE_AUTO\n");	
+			break;				
+		case IW_MODE_ADHOC:		
+			networkType = Ndis802_11IBSS;
+			DBG_871X("set_mode = IW_MODE_ADHOC\n");			
+			break;
+		case IW_MODE_MASTER:		
+			networkType = Ndis802_11APMode;
+			DBG_871X("set_mode = IW_MODE_MASTER\n");
+                        //rtw_setopmode_cmd(padapter, networkType);	
+			break;				
+		case IW_MODE_INFRA:
+			networkType = Ndis802_11Infrastructure;
+			DBG_871X("set_mode = IW_MODE_INFRA\n");			
+			break;
+	
+		default :
+			ret = -EINVAL;;
+			RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("\n Mode: %s is not supported  \n", iw_operation_mode[wrqu->mode]));
+			goto exit;
+	}
+	
+/*	
+	if(Ndis802_11APMode == networkType)
+	{
+		rtw_setopmode_cmd(padapter, networkType);
+	}	
+	else
+	{
+		rtw_setopmode_cmd(padapter, Ndis802_11AutoUnknown);	
+	}
+*/
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+	if (rtw_set_802_11_infrastructure_mode(padapter, networkType) ==_FALSE){
+
+		ret = -EPERM;
+		_exit_critical_bh(&queue->lock, &irqL);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		goto exit;
+
+	}
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	rtw_setopmode_cmd(padapter, networkType);
+
+exit:
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+static int rtw_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,(" rtw_wx_get_mode \n"));
+
+	_func_enter_;
+	
+	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+		wrqu->mode = IW_MODE_INFRA;
+	}
+	else if  ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		       (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))
+		
+	{
+		wrqu->mode = IW_MODE_ADHOC;
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		wrqu->mode = IW_MODE_MASTER;
+	}
+	else
+	{
+		wrqu->mode = IW_MODE_AUTO;
+	}
+
+	_func_exit_;
+	
+	return 0;
+	
+}
+
+
+static int rtw_wx_set_pmkid(struct net_device *dev,
+	                     struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8          j,blInserted = _FALSE;
+	int         intReturn = _FALSE;
+	struct mlme_priv  *pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+        struct iw_pmksa*  pPMK = ( struct iw_pmksa* ) extra;
+        u8     strZeroMacAddress[ ETH_ALEN ] = { 0x00 };
+        u8     strIssueBssid[ ETH_ALEN ] = { 0x00 };
+        
+/*
+        struct iw_pmksa
+        {
+            __u32   cmd;
+            struct sockaddr bssid;
+            __u8    pmkid[IW_PMKID_LEN];   //IW_PMKID_LEN=16
+        }
+        There are the BSSID information in the bssid.sa_data array.
+        If cmd is IW_PMKSA_FLUSH, it means the wpa_suppplicant wants to clear all the PMKID information.
+        If cmd is IW_PMKSA_ADD, it means the wpa_supplicant wants to add a PMKID/BSSID to driver.
+        If cmd is IW_PMKSA_REMOVE, it means the wpa_supplicant wants to remove a PMKID/BSSID from driver.
+        */
+
+	_rtw_memcpy( strIssueBssid, pPMK->bssid.sa_data, ETH_ALEN);
+        if ( pPMK->cmd == IW_PMKSA_ADD )
+        {
+                DBG_871X( "[rtw_wx_set_pmkid] IW_PMKSA_ADD!\n" );
+                if ( _rtw_memcmp( strIssueBssid, strZeroMacAddress, ETH_ALEN ) == _TRUE )
+                {
+                    return( intReturn );
+                }
+                else
+                {
+                    intReturn = _TRUE;
+                }
+		blInserted = _FALSE;
+		
+		//overwrite PMKID
+		for(j=0 ; j<NUM_PMKID_CACHE; j++)
+		{
+			if( _rtw_memcmp( psecuritypriv->PMKIDList[j].Bssid, strIssueBssid, ETH_ALEN) ==_TRUE )
+			{ // BSSID is matched, the same AP => rewrite with new PMKID.
+                                
+                                DBG_871X( "[rtw_wx_set_pmkid] BSSID exists in the PMKList.\n" );
+
+				_rtw_memcpy( psecuritypriv->PMKIDList[j].PMKID, pPMK->pmkid, IW_PMKID_LEN);
+                                psecuritypriv->PMKIDList[ j ].bUsed = _TRUE;
+				psecuritypriv->PMKIDIndex = j+1;
+				blInserted = _TRUE;
+				break;
+			}	
+	        }
+
+	        if(!blInserted)
+                {
+		    // Find a new entry
+                    DBG_871X( "[rtw_wx_set_pmkid] Use the new entry index = %d for this PMKID.\n",
+                            psecuritypriv->PMKIDIndex );
+
+	            _rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].Bssid, strIssueBssid, ETH_ALEN);
+		    _rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].PMKID, pPMK->pmkid, IW_PMKID_LEN);
+
+                    psecuritypriv->PMKIDList[ psecuritypriv->PMKIDIndex ].bUsed = _TRUE;
+		    psecuritypriv->PMKIDIndex++ ;
+		    if(psecuritypriv->PMKIDIndex==16)
+                    {
+		        psecuritypriv->PMKIDIndex =0;
+                    }
+		}
+        }
+        else if ( pPMK->cmd == IW_PMKSA_REMOVE )
+        {
+                DBG_871X( "[rtw_wx_set_pmkid] IW_PMKSA_REMOVE!\n" );
+                intReturn = _TRUE;
+		for(j=0 ; j<NUM_PMKID_CACHE; j++)
+		{
+			if( _rtw_memcmp( psecuritypriv->PMKIDList[j].Bssid, strIssueBssid, ETH_ALEN) ==_TRUE )
+			{ // BSSID is matched, the same AP => Remove this PMKID information and reset it. 
+                                _rtw_memset( psecuritypriv->PMKIDList[ j ].Bssid, 0x00, ETH_ALEN );
+                                psecuritypriv->PMKIDList[ j ].bUsed = _FALSE;
+				break;
+			}	
+	        }
+        }
+        else if ( pPMK->cmd == IW_PMKSA_FLUSH ) 
+        {
+            DBG_871X( "[rtw_wx_set_pmkid] IW_PMKSA_FLUSH!\n" );
+            _rtw_memset( &psecuritypriv->PMKIDList[ 0 ], 0x00, sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+            psecuritypriv->PMKIDIndex = 0;
+            intReturn = _TRUE;
+        }
+    return( intReturn );
+}
+
+static int rtw_wx_get_sens(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	#ifdef CONFIG_PLATFORM_ROCKCHIPS
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv); 
+	
+	/*
+	*  20110311 Commented by Jeff
+	*  For rockchip platform's wpa_driver_wext_get_rssi
+	*/
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		//wrqu->sens.value=-padapter->recvpriv.signal_strength;
+		wrqu->sens.value=-padapter->recvpriv.rssi;
+		//DBG_871X("%s: %d\n", __FUNCTION__, wrqu->sens.value);
+		wrqu->sens.fixed = 0; /* no auto select */ 
+	} else 
+	#endif
+	{
+		wrqu->sens.value = 0;
+		wrqu->sens.fixed = 0;	/* no auto select */
+		wrqu->sens.disabled = 1;
+	}
+	return 0;
+}
+
+static int rtw_wx_get_range(struct net_device *dev, 
+				struct iw_request_info *info, 
+				union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	u16 val;
+	int i;
+	
+	_func_enter_;
+	
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_range. cmd_code=%x\n", info->cmd));
+
+	wrqu->data.length = sizeof(*range);
+	_rtw_memset(range, 0, sizeof(*range));
+
+	/* Let's try to keep this struct in the same order as in
+	 * linux/include/wireless.h
+	 */
+
+	/* TODO: See what values we can set, and remove the ones we can't
+	 * set, or fill them with some default data.
+	 */
+
+	/* ~5 Mb/s real (802.11b) */
+	range->throughput = 5 * 1000 * 1000;     
+
+	// TODO: Not used in 802.11b?
+//	range->min_nwid;	/* Minimal NWID we are able to set */
+	// TODO: Not used in 802.11b?
+//	range->max_nwid;	/* Maximal NWID we are able to set */
+
+        /* Old Frequency (backward compat - moved lower ) */
+//	range->old_num_channels; 
+//	range->old_num_frequency;
+//	range->old_freq[6]; /* Filler to keep "version" at the same offset */
+
+	/* signal level threshold range */
+
+	//percent values between 0 and 100.
+	range->max_qual.qual = 100;	
+	range->max_qual.level = 100;
+	range->max_qual.noise = 100;
+	range->max_qual.updated = 7; /* Updated all three */
+
+
+	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
+	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	range->avg_qual.level = 20 + -98;
+	range->avg_qual.noise = 0;
+	range->avg_qual.updated = 7; /* Updated all three */
+
+	range->num_bitrates = RATE_COUNT;
+
+	for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++) {
+		range->bitrate[i] = rtw_rates[i];
+	}
+
+	range->min_frag = MIN_FRAG_THRESHOLD;
+	range->max_frag = MAX_FRAG_THRESHOLD;
+
+	range->pm_capa = 0;
+
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 16;
+
+//	range->retry_capa;	/* What retry options are supported */
+//	range->retry_flags;	/* How to decode max/min retry limit */
+//	range->r_time_flags;	/* How to decode max/min retry life */
+//	range->min_retry;	/* Minimal number of retries */
+//	range->max_retry;	/* Maximal number of retries */
+//	range->min_r_time;	/* Minimal retry lifetime */
+//	range->max_r_time;	/* Maximal retry lifetime */
+
+	for (i = 0, val = 0; i < MAX_CHANNEL_NUM; i++) {
+
+		// Include only legal frequencies for some countries
+		if(pmlmeext->channel_set[i].ChannelNum != 0)
+		{
+			range->freq[val].i = pmlmeext->channel_set[i].ChannelNum;
+			range->freq[val].m = rtw_ch2freq(pmlmeext->channel_set[i].ChannelNum) * 100000;
+			range->freq[val].e = 1;
+			val++;
+		}
+
+		if (val == IW_MAX_FREQUENCIES)
+			break;
+	}
+
+	range->num_channels = val;
+	range->num_frequency = val;
+
+// Commented by Albert 2009/10/13
+// The following code will proivde the security capability to network manager.
+// If the driver doesn't provide this capability to network manager,
+// the WPA/WPA2 routers can't be choosen in the network manager.
+
+/*
+#define IW_SCAN_CAPA_NONE		0x00
+#define IW_SCAN_CAPA_ESSID		0x01
+#define IW_SCAN_CAPA_BSSID		0x02
+#define IW_SCAN_CAPA_CHANNEL	0x04
+#define IW_SCAN_CAPA_MODE		0x08
+#define IW_SCAN_CAPA_RATE		0x10
+#define IW_SCAN_CAPA_TYPE		0x20
+#define IW_SCAN_CAPA_TIME		0x40
+*/
+
+#if WIRELESS_EXT > 17
+	range->enc_capa = IW_ENC_CAPA_WPA|IW_ENC_CAPA_WPA2|
+			  IW_ENC_CAPA_CIPHER_TKIP|IW_ENC_CAPA_CIPHER_CCMP;
+#endif
+
+#ifdef IW_SCAN_CAPA_ESSID //WIRELESS_EXT > 21
+	range->scan_capa = IW_SCAN_CAPA_ESSID | IW_SCAN_CAPA_TYPE |IW_SCAN_CAPA_BSSID|
+					IW_SCAN_CAPA_CHANNEL|IW_SCAN_CAPA_MODE|IW_SCAN_CAPA_RATE;
+#endif
+
+
+	_func_exit_;
+
+	return 0;
+
+}
+
+//set bssid flow
+//s1. rtw_set_802_11_infrastructure_mode()
+//s2. rtw_set_802_11_authentication_mode()
+//s3. set_802_11_encryption_mode()
+//s4. rtw_set_802_11_bssid()
+static int rtw_wx_set_wap(struct net_device *dev,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra)
+{
+	_irqL	irqL;
+	uint ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct sockaddr *temp = (struct sockaddr *)awrq;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_list	*phead;
+	u8 *dst_bssid, *src_bssid;
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	NDIS_802_11_AUTHENTICATION_MODE	authmode;
+	
+	_func_enter_;
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif	
+*/	
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{		
+		printk("set bssid, but buddy_intf is under scanning or linking\n");
+
+		ret = -EINVAL;
+		
+		goto exit;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if (dc_check_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING)== _TRUE)
+	{
+		printk("set bssid, but buddy_intf is under scanning or linking\n");
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+
+	if(_FAIL == rtw_pwr_wakeup(padapter))
+	{
+		ret= -1;
+		goto exit;
+	}
+	
+	if(!padapter->bup){
+		ret = -1;
+		goto exit;
+	}
+
+	
+	if (temp->sa_family != ARPHRD_ETHER){
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	authmode = padapter->securitypriv.ndisauthtype;
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+       phead = get_list_head(queue);
+       pmlmepriv->pscanned = get_next(phead);
+
+	while (1)
+	 {
+			
+		if ((rtw_end_of_queue_search(phead, pmlmepriv->pscanned)) == _TRUE)
+		{
+#if 0		
+			ret = -EINVAL;
+			goto exit;
+
+			if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+			{
+	            		rtw_set_802_11_bssid(padapter, temp->sa_data);
+	    			goto exit;                    
+			}
+			else
+			{
+				ret = -EINVAL;
+				goto exit;
+			}
+#endif
+
+			break;
+		}
+	
+		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+
+		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+		dst_bssid = pnetwork->network.MacAddress;
+
+		src_bssid = temp->sa_data;
+
+		if ((_rtw_memcmp(dst_bssid, src_bssid, ETH_ALEN)) == _TRUE)
+		{			
+			if(!rtw_set_802_11_infrastructure_mode(padapter, pnetwork->network.InfrastructureMode))
+			{
+				ret = -1;
+				_exit_critical_bh(&queue->lock, &irqL);
+				_exit_critical_bh(&pmlmepriv->lock, &irqL);
+				goto exit;
+			}
+
+				break;			
+		}
+
+	}		
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	rtw_set_802_11_authentication_mode(padapter, authmode);
+	//set_802_11_encryption_mode(padapter, padapter->securitypriv.ndisencryptstatus);
+	if (rtw_set_802_11_bssid(padapter, temp->sa_data) == _FALSE) {
+		ret = -1;
+		goto exit;		
+	}	
+	
+exit:
+	
+	_func_exit_;
+	
+	return ret;	
+}
+
+static int rtw_wx_get_wap(struct net_device *dev, 
+			    struct iw_request_info *info, 
+			    union iwreq_data *wrqu, char *extra)
+{
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;	
+	
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+	
+	_rtw_memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
+	
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_wap\n"));
+
+	_func_enter_;
+
+	if  ( ((check_fwstate(pmlmepriv, _FW_LINKED)) == _TRUE) || 
+			((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) == _TRUE) ||
+			((check_fwstate(pmlmepriv, WIFI_AP_STATE)) == _TRUE) )
+	{
+
+		_rtw_memcpy(wrqu->ap_addr.sa_data, pcur_bss->MacAddress, ETH_ALEN);
+	}
+	else
+	{
+	 	_rtw_memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
+	}		
+
+	_func_exit_;
+	
+	return 0;
+	
+}
+
+static int rtw_wx_set_mlme(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+#if 0
+/* SIOCSIWMLME data */
+struct	iw_mlme
+{
+	__u16		cmd; /* IW_MLME_* */
+	__u16		reason_code;
+	struct sockaddr	addr;
+};
+#endif
+
+	int ret=0;
+	u16 reason;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_mlme *mlme = (struct iw_mlme *) extra;
+	
+
+	if(mlme==NULL)
+		return -1;
+
+	printk("%s\n", __FUNCTION__);
+
+	reason = cpu_to_le16(mlme->reason_code);
+
+
+	printk("%s, cmd=%d, reason=%d\n", __FUNCTION__, mlme->cmd, reason);
+
+	switch (mlme->cmd) 
+	{
+		case IW_MLME_DEAUTH:			
+				if(!rtw_set_802_11_disassociate(padapter))
+				ret = -1;						
+				break;
+				
+		case IW_MLME_DISASSOC:			
+				if(!rtw_set_802_11_disassociate(padapter))
+						ret = -1;		
+				
+				break;
+				
+		default:
+			return -EOPNOTSUPP;
+	}
+	
+	return ret;
+	
+}
+
+static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *extra)
+{
+	u8 _status = _FALSE;
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	_irqL	irqL;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);	
+#endif //CONFIG_P2P
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_set_scan\n"));
+
+_func_enter_;
+
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d\n",__FUNCTION__, __LINE__);
+	#endif
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -1;
+		goto exit;
+	}
+#endif
+*/
+
+#ifdef CONFIG_MP_INCLUDED
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		ret = -1;
+		goto exit;
+	}
+#endif
+
+	if(_FAIL == rtw_pwr_wakeup(padapter))
+	{
+		ret= -1;
+		goto exit;
+	}
+
+	if(padapter->bDriverStopped){
+           DBG_871X("bDriverStopped=%d\n", padapter->bDriverStopped);
+		ret= -1;
+		goto exit;
+	}
+	
+	if(!padapter->bup){
+		ret = -1;
+		goto exit;
+	}
+	
+	if (padapter->hw_init_completed==_FALSE){
+		ret = -1;
+		goto exit;
+	}
+
+	// When Busy Traffic, driver do not site survey. So driver return success.
+	// wpa_supplicant will not issue SIOCSIWSCAN cmd again after scan timeout.
+	// modify by thomas 2011-02-22.
+	if (pmlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE)
+	{
+		indicate_wx_scan_complete_event(padapter);
+		goto exit;
+	} 
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{
+		indicate_wx_scan_complete_event(padapter);
+		goto exit;
+	} 
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter,
+		_FW_UNDER_SURVEY|_FW_UNDER_LINKING|WIFI_UNDER_WPS) == _TRUE)
+	{		
+		if(check_buddy_fwstate(padapter, _FW_UNDER_SURVEY))
+		{
+			printk("scanning_via_buddy_intf\n");
+			pmlmepriv->scanning_via_buddy_intf = _TRUE;
+		}		
+
+		indicate_wx_scan_complete_event(padapter);
+		
+		goto exit;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if (dc_check_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING)== _TRUE)
+	{
+		indicate_wx_scan_complete_event(padapter);
+		goto exit;
+	}
+#endif
+
+//	Mareded by Albert 20101103
+//	For the DMP WiFi Display project, the driver won't to scan because
+//	the pmlmepriv->scan_interval is always equal to 3.
+//	So, the wpa_supplicant won't find out the WPS SoftAP.
+
+/*
+	if(pmlmepriv->scan_interval>10)
+		pmlmepriv->scan_interval = 0;
+
+	if(pmlmepriv->scan_interval > 0)
+	{
+		DBG_871X("scan done\n");
+		ret = 0;
+		goto exit;
+	}
+		
+*/
+#ifdef CONFIG_P2P
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		rtw_p2p_set_pre_state( pwdinfo, rtw_p2p_state( pwdinfo ) );
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+		rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_FULL);
+		rtw_free_network_queue(padapter, _TRUE);
+	}
+#endif //CONFIG_P2P
+
+	_rtw_memset(ssid, 0, sizeof(NDIS_802_11_SSID)*RTW_SSID_SCAN_AMOUNT);
+
+#if WIRELESS_EXT >= 17
+	if (wrqu->data.length == sizeof(struct iw_scan_req)) 
+	{
+		struct iw_scan_req *req = (struct iw_scan_req *)extra;
+	
+		if (wrqu->data.flags & IW_SCAN_THIS_ESSID)
+		{
+			int len = min((int)req->essid_len, IW_ESSID_MAX_SIZE);
+
+			_rtw_memcpy(ssid[0].Ssid, req->essid, len);
+			ssid[0].SsidLength = len;	
+
+			DBG_871X("IW_SCAN_THIS_ESSID, ssid=%s, len=%d\n", req->essid, req->essid_len);
+		
+			_enter_critical_bh(&pmlmepriv->lock, &irqL);				
+		
+			_status = rtw_sitesurvey_cmd(padapter, ssid, 1, NULL, 0);
+		
+			_exit_critical_bh(&pmlmepriv->lock, &irqL);
+			
+		}
+		else if (req->scan_type == IW_SCAN_TYPE_PASSIVE)
+		{
+			DBG_871X("rtw_wx_set_scan, req->scan_type == IW_SCAN_TYPE_PASSIVE\n");
+		}
+		
+	}
+	else
+#endif
+
+	if(	wrqu->data.length >= WEXT_CSCAN_HEADER_SIZE
+		&& _rtw_memcmp(extra, WEXT_CSCAN_HEADER, WEXT_CSCAN_HEADER_SIZE) == _TRUE
+	)
+	{
+		int len = wrqu->data.length -WEXT_CSCAN_HEADER_SIZE;
+		char *pos = extra+WEXT_CSCAN_HEADER_SIZE;
+		char section;
+		char sec_len;
+		int ssid_index = 0;
+
+		//DBG_871X("%s COMBO_SCAN header is recognized\n", __FUNCTION__);
+		
+		while(len >= 1) {
+			section = *(pos++); len-=1;
+
+			switch(section) {
+				case WEXT_CSCAN_SSID_SECTION:
+					//DBG_871X("WEXT_CSCAN_SSID_SECTION\n");
+					if(len < 1) {
+						len = 0;
+						break;
+					}
+					
+					sec_len = *(pos++); len-=1;
+
+					if(sec_len>0 && sec_len<=len) {
+						ssid[ssid_index].SsidLength = sec_len;
+						_rtw_memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						//DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __FUNCTION__
+						//	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength);
+						ssid_index++;
+					}
+					
+					pos+=sec_len; len-=sec_len;
+					break;
+					
+				
+				case WEXT_CSCAN_CHANNEL_SECTION:
+					//DBG_871X("WEXT_CSCAN_CHANNEL_SECTION\n");
+					pos+=1; len-=1;
+					break;
+				case WEXT_CSCAN_ACTV_DWELL_SECTION:
+					//DBG_871X("WEXT_CSCAN_ACTV_DWELL_SECTION\n");
+					pos+=2; len-=2;
+					break;
+				case WEXT_CSCAN_PASV_DWELL_SECTION:
+					//DBG_871X("WEXT_CSCAN_PASV_DWELL_SECTION\n");
+					pos+=2; len-=2;					
+					break;
+				case WEXT_CSCAN_HOME_DWELL_SECTION:
+					//DBG_871X("WEXT_CSCAN_HOME_DWELL_SECTION\n");
+					pos+=2; len-=2;
+					break;
+				case WEXT_CSCAN_TYPE_SECTION:
+					//DBG_871X("WEXT_CSCAN_TYPE_SECTION\n");
+					pos+=1; len-=1;
+					break;
+				#if 0
+				case WEXT_CSCAN_NPROBE_SECTION:
+					DBG_871X("WEXT_CSCAN_NPROBE_SECTION\n");
+					break;
+				#endif
+				
+				default:
+					//DBG_871X("Unknown CSCAN section %c\n", section);
+					len = 0; // stop parsing
+			}
+			//DBG_871X("len:%d\n", len);
+			
+		}
+		
+		//jeff: it has still some scan paramater to parse, we only do this now...
+		_status = rtw_set_802_11_bssid_list_scan(padapter, ssid, RTW_SSID_SCAN_AMOUNT);
+		
+	} else
+	
+	{
+		_status = rtw_set_802_11_bssid_list_scan(padapter, NULL, 0);
+	}
+
+	if(_status == _FALSE)
+		ret = -1;
+
+exit:
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d return %d\n",__FUNCTION__, __LINE__, ret);
+	#endif
+
+_func_exit_;
+
+	return ret;	
+}
+
+static int rtw_wx_get_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_irqL	irqL;
+	_list					*plist, *phead;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_queue				*queue	= &(pmlmepriv->scanned_queue);	
+	struct	wlan_network	*pnetwork = NULL;
+	char *ev = extra;
+	char *stop = ev + wrqu->data.length;
+	u32 ret = 0;	
+	u32 cnt=0;
+	u32 wait_for_surveydone;
+	sint wait_status;
+#ifdef CONFIG_CONCURRENT_MODE	
+	//PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	//struct mlme_priv *pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);	
+#endif	
+#ifdef CONFIG_P2P
+	struct	wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_scan\n"));
+	RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_, (" Start of Query SIOCGIWSCAN .\n"));
+
+	_func_enter_;
+	
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d\n",__FUNCTION__, __LINE__);
+	#endif
+	
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+*/	
+	if(padapter->pwrctrlpriv.brfoffbyhw && padapter->bDriverStopped)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+  
+#ifdef CONFIG_P2P
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		//	P2P is enabled
+		if ( padapter->chip_type == RTL8192D )
+			wait_for_surveydone = 300;	//	Because the 8192du supports more channels.
+		else
+			wait_for_surveydone = 200;
+	}
+	else
+	{
+		//	P2P is disabled
+		wait_for_surveydone = 100;
+	}
+#else
+	{
+		wait_for_surveydone = 100;
+	}
+#endif //CONFIG_P2P
+
+/*
+#ifdef CONFIG_CONCURRENT_MODE	
+	if(pmlmepriv->scanning_via_buddy_intf == _TRUE)
+	{
+		pmlmepriv->scanning_via_buddy_intf = _FALSE;//reset
+
+		// change pointers to buddy interface
+		padapter = pbuddy_adapter;
+		pmlmepriv = pbuddy_mlmepriv;
+		queue = &(pbuddy_mlmepriv->scanned_queue);		
+		
+	}
+#endif // CONFIG_CONCURRENT_MODE			
+*/
+
+	wait_status = _FW_UNDER_SURVEY
+		#ifndef CONFIG_ANDROID
+		|_FW_UNDER_LINKING
+		#endif
+	;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	while(dc_check_fwstate(padapter, wait_status)== _TRUE)
+	{
+		rtw_msleep_os(30);
+		cnt++;
+		if(cnt > wait_for_surveydone )
+			break;
+	}
+#endif // CONFIG_DUALMAC_CONCURRENT
+
+ 	while(check_fwstate(pmlmepriv, wait_status) == _TRUE)
+	{	
+		rtw_msleep_os(30);
+		cnt++;
+		if(cnt > wait_for_surveydone )
+			break;
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		if((stop - ev) < SCAN_ITEM_SIZE) {
+			ret = -E2BIG;
+			break;
+		}
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//report network only if the current channel set contains the channel to which this network belongs
+		if(rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >= 0
+			&& rtw_mlme_band_check(padapter, pnetwork->network.Configuration.DSConfig) == _TRUE
+			&& _TRUE == rtw_validate_ssid(&(pnetwork->network.Ssid))
+		)
+		{
+			ev=translate_scan(padapter, a, pnetwork, ev, stop);
+		}
+
+		plist = get_next(plist);
+	
+	}        
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+       wrqu->data.length = ev-extra;
+	wrqu->data.flags = 0;
+	
+exit:		
+	
+	_func_exit_;	
+	
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d return %d\n",__FUNCTION__, __LINE__, ret);
+	#endif
+	
+	return ret ;
+	
+}
+
+//set ssid flow
+//s1. rtw_set_802_11_infrastructure_mode()
+//s2. set_802_11_authenticaion_mode()
+//s3. set_802_11_encryption_mode()
+//s4. rtw_set_802_11_ssid()
+static int rtw_wx_set_essid(struct net_device *dev, 
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+	_irqL irqL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	_list *phead;
+	s8 status = _TRUE;
+	struct wlan_network *pnetwork = NULL;
+	NDIS_802_11_AUTHENTICATION_MODE authmode;	
+	NDIS_802_11_SSID ndis_ssid;	
+	u8 *dst_ssid, *src_ssid;
+
+	uint ret = 0, len;
+
+	_func_enter_;
+	
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d\n",__FUNCTION__, __LINE__);
+	#endif
+	
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+*/
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{		
+		printk("set ssid, but buddy_intf is under scanning or linking\n");
+		
+		ret = -EINVAL;
+		
+		goto exit;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if (dc_check_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING)== _TRUE)
+	{
+		printk("set bssid, but buddy_intf is under scanning or linking\n");
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		 ("+rtw_wx_set_essid: fw_state=0x%08x\n", get_fwstate(pmlmepriv)));
+	if(_FAIL == rtw_pwr_wakeup(padapter))
+	{		
+		ret = -1;
+		goto exit;
+	}
+
+	if(!padapter->bup){
+		ret = -1;
+		goto exit;
+	}
+
+#if WIRELESS_EXT <= 20
+	if ((wrqu->essid.length-1) > IW_ESSID_MAX_SIZE){
+#else
+	if (wrqu->essid.length > IW_ESSID_MAX_SIZE){
+#endif
+		ret= -E2BIG;
+		goto exit;
+	}
+	
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
+		ret = -1;
+		goto exit;
+	}		
+	
+	authmode = padapter->securitypriv.ndisauthtype;
+	DBG_871X("=>%s\n",__FUNCTION__);
+	if (wrqu->essid.flags && wrqu->essid.length)
+	{
+		// Commented by Albert 20100519
+		// We got the codes in "set_info" function of iwconfig source code.
+		//	=========================================
+		//	wrq.u.essid.length = strlen(essid) + 1;
+	  	//	if(we_kernel_version > 20)
+		//		wrq.u.essid.length--;
+		//	=========================================
+		//	That means, if the WIRELESS_EXT less than or equal to 20, the correct ssid len should subtract 1.
+#if WIRELESS_EXT <= 20
+		len = ((wrqu->essid.length-1) < IW_ESSID_MAX_SIZE) ? (wrqu->essid.length-1) : IW_ESSID_MAX_SIZE;
+#else
+		len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ? wrqu->essid.length : IW_ESSID_MAX_SIZE;
+#endif
+
+		if( wrqu->essid.length != 33 )
+			DBG_871X("ssid=%s, len=%d\n", extra, wrqu->essid.length);
+
+		_rtw_memset(&ndis_ssid, 0, sizeof(NDIS_802_11_SSID));
+		ndis_ssid.SsidLength = len;
+		_rtw_memcpy(ndis_ssid.Ssid, extra, len);		
+		src_ssid = ndis_ssid.Ssid;
+		
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_, ("rtw_wx_set_essid: ssid=[%s]\n", src_ssid));
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+		_enter_critical_bh(&queue->lock, &irqL);
+	       phead = get_list_head(queue);
+              pmlmepriv->pscanned = get_next(phead);
+
+		while (1)
+		{			
+			if (rtw_end_of_queue_search(phead, pmlmepriv->pscanned) == _TRUE)
+			{
+#if 0			
+				if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+				{
+	            			rtw_set_802_11_ssid(padapter, &ndis_ssid);
+
+		    			goto exit;                    
+				}
+				else
+				{
+					RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("rtw_wx_set_ssid(): scanned_queue is empty\n"));
+					ret = -EINVAL;
+					goto exit;
+				}
+#endif			
+			        RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_warning_,
+					 ("rtw_wx_set_essid: scan_q is empty, set ssid to check if scanning again!\n"));
+
+				break;
+			}
+	
+			pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+
+			pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+			dst_ssid = pnetwork->network.Ssid.Ssid;
+
+			RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+				 ("rtw_wx_set_essid: dst_ssid=%s\n",
+				  pnetwork->network.Ssid.Ssid));
+
+			if ((_rtw_memcmp(dst_ssid, src_ssid, ndis_ssid.SsidLength) == _TRUE) &&
+				(pnetwork->network.Ssid.SsidLength==ndis_ssid.SsidLength))
+			{
+				RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+					 ("rtw_wx_set_essid: find match, set infra mode\n"));
+				
+				if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+				{
+					if(pnetwork->network.InfrastructureMode != pmlmepriv->cur_network.network.InfrastructureMode)
+						continue;
+				}	
+					
+				if (rtw_set_802_11_infrastructure_mode(padapter, pnetwork->network.InfrastructureMode) == _FALSE)
+				{
+					ret = -1;
+					_exit_critical_bh(&queue->lock, &irqL);
+					_exit_critical_bh(&pmlmepriv->lock, &irqL);
+					goto exit;
+				}
+
+				break;			
+			}
+		}
+		_exit_critical_bh(&queue->lock, &irqL);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+			 ("set ssid: set_802_11_auth. mode=%d\n", authmode));
+		rtw_set_802_11_authentication_mode(padapter, authmode);
+		//set_802_11_encryption_mode(padapter, padapter->securitypriv.ndisencryptstatus);
+		if (rtw_set_802_11_ssid(padapter, &ndis_ssid) == _FALSE) {
+			ret = -1;
+			goto exit;
+		}	
+	}			
+	
+exit:
+
+	DBG_871X("<=%s, ret %d\n",__FUNCTION__, ret);
+	
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d return %d\n",__FUNCTION__, __LINE__, ret);
+	#endif
+	
+	_func_exit_;
+	
+	return ret;	
+}
+
+static int rtw_wx_get_essid(struct net_device *dev, 
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+	u32 len,ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_essid\n"));
+
+	_func_enter_;
+
+	if ( (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
+	      (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
+	{
+		len = pcur_bss->Ssid.SsidLength;
+
+		wrqu->essid.length = len;
+			
+		_rtw_memcpy(extra, pcur_bss->Ssid.Ssid, len);
+
+		wrqu->essid.flags = 1;
+	}
+	else
+	{
+		ret = -1;
+		goto exit;
+	}
+
+exit:
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+static int rtw_wx_set_rate(struct net_device *dev, 
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+	int	i, ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8	datarates[NumRates];
+	u32	target_rate = wrqu->bitrate.value;
+	u32	fixed = wrqu->bitrate.fixed;
+	u32	ratevalue = 0;
+	 u8 mpdatarate[NumRates]={11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, 0xff};
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,(" rtw_wx_set_rate \n"));
+	RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("target_rate = %d, fixed = %d\n",target_rate,fixed));
+	
+	if(target_rate == -1){
+		ratevalue = 11;
+		goto set_rate;
+	}
+	target_rate = target_rate/100000;
+
+	switch(target_rate){
+		case 10:
+			ratevalue = 0;
+			break;
+		case 20:
+			ratevalue = 1;
+			break;
+		case 55:
+			ratevalue = 2;
+			break;
+		case 60:
+			ratevalue = 3;
+			break;
+		case 90:
+			ratevalue = 4;
+			break;
+		case 110:
+			ratevalue = 5;
+			break;
+		case 120:
+			ratevalue = 6;
+			break;
+		case 180:
+			ratevalue = 7;
+			break;
+		case 240:
+			ratevalue = 8;
+			break;
+		case 360:
+			ratevalue = 9;
+			break;
+		case 480:
+			ratevalue = 10;
+			break;
+		case 540:
+			ratevalue = 11;
+			break;
+		default:
+			ratevalue = 11;
+			break;
+	}
+
+set_rate:
+
+	for(i=0; i<NumRates; i++)
+	{
+		if(ratevalue==mpdatarate[i])
+		{
+			datarates[i] = mpdatarate[i];
+			if(fixed == 0)
+				break;
+		}
+		else{
+			datarates[i] = 0xff;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("datarate_inx=%d\n",datarates[i]));
+	}
+
+	if( rtw_setdatarate_cmd(padapter, datarates) !=_SUCCESS){
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("rtw_wx_set_rate Fail!!!\n"));
+		ret = -1;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+
+static int rtw_wx_get_rate(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{	
+	u16 max_rate = 0;
+
+	max_rate = rtw_get_cur_max_rate((_adapter *)rtw_netdev_priv(dev));
+
+	if(max_rate == 0)
+		return -EPERM;
+	
+	wrqu->bitrate.fixed = 0;	/* no auto select */
+	wrqu->bitrate.value = max_rate * 100000;
+
+	return 0;
+}
+
+static int rtw_wx_set_rts(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	_func_enter_;
+	
+	if (wrqu->rts.disabled)
+		padapter->registrypriv.rts_thresh = 2347;
+	else {
+		if (wrqu->rts.value < 0 ||
+		    wrqu->rts.value > 2347)
+			return -EINVAL;
+		
+		padapter->registrypriv.rts_thresh = wrqu->rts.value;
+	}
+
+	DBG_871X("%s, rts_thresh=%d\n", __func__, padapter->registrypriv.rts_thresh);
+	
+	_func_exit_;
+	
+	return 0;
+
+}
+
+static int rtw_wx_get_rts(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	
+	_func_enter_;
+
+	DBG_871X("%s, rts_thresh=%d\n", __func__, padapter->registrypriv.rts_thresh);	
+	
+	wrqu->rts.value = padapter->registrypriv.rts_thresh;
+	wrqu->rts.fixed = 0;	/* no auto select */
+	//wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
+	
+	_func_exit_;
+	
+	return 0;
+}
+
+static int rtw_wx_set_frag(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	_func_enter_;
+	
+	if (wrqu->frag.disabled)
+		padapter->xmitpriv.frag_len = MAX_FRAG_THRESHOLD;
+	else {
+		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
+		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
+			return -EINVAL;
+		
+		padapter->xmitpriv.frag_len = wrqu->frag.value & ~0x1;
+	}
+
+	DBG_871X("%s, frag_len=%d\n", __func__, padapter->xmitpriv.frag_len);
+	
+	_func_exit_;
+	
+	return 0;
+	
+}
+
+static int rtw_wx_get_frag(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	
+	_func_enter_;
+
+	DBG_871X("%s, frag_len=%d\n", __func__, padapter->xmitpriv.frag_len);
+	
+	wrqu->frag.value = padapter->xmitpriv.frag_len;
+	wrqu->frag.fixed = 0;	/* no auto select */
+	//wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FRAG_THRESHOLD);
+	
+	_func_exit_;
+	
+	return 0;
+}
+
+static int rtw_wx_get_retry(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	
+	wrqu->retry.value = 7;
+	wrqu->retry.fixed = 0;	/* no auto select */
+	wrqu->retry.disabled = 1;
+	
+	return 0;
+
+}	
+
+#if 0
+#define IW_ENCODE_INDEX		0x00FF	/* Token index (if needed) */
+#define IW_ENCODE_FLAGS		0xFF00	/* Flags defined below */
+#define IW_ENCODE_MODE		0xF000	/* Modes defined below */
+#define IW_ENCODE_DISABLED	0x8000	/* Encoding disabled */
+#define IW_ENCODE_ENABLED	0x0000	/* Encoding enabled */
+#define IW_ENCODE_RESTRICTED	0x4000	/* Refuse non-encoded packets */
+#define IW_ENCODE_OPEN		0x2000	/* Accept non-encoded packets */
+#define IW_ENCODE_NOKEY		0x0800  /* Key is write only, so not present */
+#define IW_ENCODE_TEMP		0x0400  /* Temporary key */
+/*
+iwconfig wlan0 key on -> flags = 0x6001 -> maybe it means auto
+iwconfig wlan0 key off -> flags = 0x8800
+iwconfig wlan0 key open -> flags = 0x2800
+iwconfig wlan0 key open 1234567890 -> flags = 0x2000
+iwconfig wlan0 key restricted -> flags = 0x4800
+iwconfig wlan0 key open [3] 1234567890 -> flags = 0x2003
+iwconfig wlan0 key restricted [2] 1234567890 -> flags = 0x4002
+iwconfig wlan0 key open [3] -> flags = 0x2803
+iwconfig wlan0 key restricted [2] -> flags = 0x4802
+*/
+#endif
+
+static int rtw_wx_set_enc(struct net_device *dev, 
+			    struct iw_request_info *info, 
+			    union iwreq_data *wrqu, char *keybuf)
+{	
+	u32 key, ret = 0;
+	u32 keyindex_provided;
+	NDIS_802_11_WEP	 wep;	
+	NDIS_802_11_AUTHENTICATION_MODE authmode;
+
+	struct iw_point *erq = &(wrqu->encoding);
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	DBG_871X("+rtw_wx_set_enc, flags=0x%x\n", erq->flags);
+
+	_rtw_memset(&wep, 0, sizeof(NDIS_802_11_WEP));
+	
+	key = erq->flags & IW_ENCODE_INDEX;
+	
+	_func_enter_;	
+
+	if (erq->flags & IW_ENCODE_DISABLED)
+	{
+		DBG_871X("EncryptionDisabled\n");
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
+		padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open; //open system
+  		authmode = Ndis802_11AuthModeOpen;
+		padapter->securitypriv.ndisauthtype=authmode;
+     		
+		goto exit;
+	}
+
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+		keyindex_provided = 1;
+	} 
+	else
+	{
+		keyindex_provided = 0;
+		key = padapter->securitypriv.dot11PrivacyKeyIndex;
+		DBG_871X("rtw_wx_set_enc, key=%d\n", key);
+	}
+	
+	//set authentication mode	
+	if(erq->flags & IW_ENCODE_OPEN)
+	{
+		DBG_871X("rtw_wx_set_enc():IW_ENCODE_OPEN\n");
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;//Ndis802_11EncryptionDisabled;
+
+#ifdef CONFIG_PLATFORM_MT53XX
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open;
+#endif
+
+		padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+  		authmode = Ndis802_11AuthModeOpen;
+		padapter->securitypriv.ndisauthtype=authmode;
+	}	
+	else if(erq->flags & IW_ENCODE_RESTRICTED)
+	{		
+		DBG_871X("rtw_wx_set_enc():IW_ENCODE_RESTRICTED\n");
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+#ifdef CONFIG_PLATFORM_MT53XX
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Shared;
+#endif
+
+		padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;			
+		authmode = Ndis802_11AuthModeShared;
+		padapter->securitypriv.ndisauthtype=authmode;
+	}
+	else
+	{
+		DBG_871X("rtw_wx_set_enc():erq->flags=0x%x\n", erq->flags);
+
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;//Ndis802_11EncryptionDisabled;
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open; //open system
+		padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+  		authmode = Ndis802_11AuthModeOpen;
+		padapter->securitypriv.ndisauthtype=authmode;
+	}
+	
+	wep.KeyIndex = key;
+	if (erq->length > 0)
+	{
+		wep.KeyLength = erq->length <= 5 ? 5 : 13;
+
+		wep.Length = wep.KeyLength + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+	}
+	else
+	{
+		wep.KeyLength = 0 ;
+		
+		if(keyindex_provided == 1)// set key_id only, no given KeyMaterial(erq->length==0).
+		{
+			padapter->securitypriv.dot11PrivacyKeyIndex = key;
+
+			DBG_871X("(keyindex_provided == 1), keyid=%d, key_len=%d\n", key, padapter->securitypriv.dot11DefKeylen[key]);
+
+			switch(padapter->securitypriv.dot11DefKeylen[key])
+			{
+				case 5:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;					
+					break;
+				case 13:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;					
+					break;
+				default:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;					
+					break;
+			}
+				
+			goto exit;
+			
+		}
+		
+	}
+
+	wep.KeyIndex |= 0x80000000;
+
+	_rtw_memcpy(wep.KeyMaterial, keybuf, wep.KeyLength);
+	
+	if (rtw_set_802_11_add_wep(padapter, &wep) == _FALSE) {
+		if(rf_on == pwrpriv->rf_pwrstate )
+			ret = -EOPNOTSUPP;
+		goto exit;
+	}	
+
+exit:
+	
+	_func_exit_;
+	
+	return ret;
+	
+}
+
+static int rtw_wx_get_enc(struct net_device *dev, 
+			    struct iw_request_info *info, 
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	uint key, ret =0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *erq = &(wrqu->encoding);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	_func_enter_;
+	
+	if(check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE)
+	{
+		 if(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) != _TRUE)
+		 {
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+		return 0;
+	}	
+	}	
+
+	
+	key = erq->flags & IW_ENCODE_INDEX;
+
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+	} else
+	{
+		key = padapter->securitypriv.dot11PrivacyKeyIndex;
+	}	
+
+	erq->flags = key + 1;
+
+	//if(padapter->securitypriv.ndisauthtype == Ndis802_11AuthModeOpen)
+	//{
+	//      erq->flags |= IW_ENCODE_OPEN;
+	//}	  
+	
+	switch(padapter->securitypriv.ndisencryptstatus)
+	{
+		case Ndis802_11EncryptionNotSupported:
+		case Ndis802_11EncryptionDisabled:
+
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+	
+		break;
+		
+		case Ndis802_11Encryption1Enabled:					
+		
+		erq->length = padapter->securitypriv.dot11DefKeylen[key];		
+
+		if(erq->length)
+		{
+			_rtw_memcpy(keybuf, padapter->securitypriv.dot11DefKey[key].skey, padapter->securitypriv.dot11DefKeylen[key]);
+		
+		erq->flags |= IW_ENCODE_ENABLED;
+
+			if(padapter->securitypriv.ndisauthtype == Ndis802_11AuthModeOpen)
+			{
+	     			erq->flags |= IW_ENCODE_OPEN;
+			}
+			else if(padapter->securitypriv.ndisauthtype == Ndis802_11AuthModeShared)
+			{
+		erq->flags |= IW_ENCODE_RESTRICTED;
+			}	
+		}	
+		else
+		{
+			erq->length = 0;
+			erq->flags |= IW_ENCODE_DISABLED;
+		}
+
+		break;
+
+		case Ndis802_11Encryption2Enabled:
+		case Ndis802_11Encryption3Enabled:
+
+		erq->length = 16;
+		erq->flags |= (IW_ENCODE_ENABLED | IW_ENCODE_OPEN | IW_ENCODE_NOKEY);
+
+		break;
+	
+		default:
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+
+		break;
+		
+	}
+	
+	_func_exit_;
+	
+	return ret;
+	
+}				     
+
+static int rtw_wx_get_power(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	
+	wrqu->power.value = 0;
+	wrqu->power.fixed = 0;	/* no auto select */
+	wrqu->power.disabled = 1;
+	
+	return 0;
+
+}
+
+static int rtw_wx_set_gen_ie(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	
+       ret = rtw_set_wpa_ie(padapter, extra, wrqu->data.length);
+	   
+	return ret;
+}	
+
+static int rtw_wx_set_auth(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_param *param = (struct iw_param*)&(wrqu->param);
+	int ret = 0;
+	
+	switch (param->flags & IW_AUTH_INDEX) {
+	case IW_AUTH_WPA_VERSION:
+		break;
+	case IW_AUTH_CIPHER_PAIRWISE:
+		
+		break;
+	case IW_AUTH_CIPHER_GROUP:
+		
+		break;
+	case IW_AUTH_KEY_MGMT:
+		/*
+		 *  ??? does not use these parameters
+		 */
+		break;
+
+	case IW_AUTH_TKIP_COUNTERMEASURES:
+        {
+	    if ( param->value )
+            {  // wpa_supplicant is enabling the tkip countermeasure.
+               padapter->securitypriv.btkip_countermeasure = _TRUE; 
+            }
+            else
+            {  // wpa_supplicant is disabling the tkip countermeasure.
+               padapter->securitypriv.btkip_countermeasure = _FALSE; 
+            }
+		break;
+        }
+	case IW_AUTH_DROP_UNENCRYPTED:
+		{
+			/* HACK:
+			 *
+			 * wpa_supplicant calls set_wpa_enabled when the driver
+			 * is loaded and unloaded, regardless of if WPA is being
+			 * used.  No other calls are made which can be used to
+			 * determine if encryption will be used or not prior to
+			 * association being expected.  If encryption is not being
+			 * used, drop_unencrypted is set to false, else true -- we
+			 * can use this to determine if the CAP_PRIVACY_ON bit should
+			 * be set.
+			 */
+
+			if(padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption1Enabled)
+			{
+				break;//it means init value, or using wep, ndisencryptstatus = Ndis802_11Encryption1Enabled, 
+						// then it needn't reset it;
+			}
+			
+			if(param->value){
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
+				padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+				padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+				padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open; //open system
+				padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeOpen;
+			}
+			
+			break;
+		}
+
+	case IW_AUTH_80211_AUTH_ALG:
+
+		#if defined(CONFIG_ANDROID) || 1
+		/*
+		 *  It's the starting point of a link layer connection using wpa_supplicant
+		*/
+		if(check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
+			LeaveAllPowerSaveMode(padapter);
+			rtw_disassoc_cmd(padapter, 500, _FALSE);
+			DBG_871X("%s...call rtw_indicate_disconnect\n ",__FUNCTION__);
+			rtw_indicate_disconnect(padapter);
+			rtw_free_assoc_resources(padapter, 1);
+		}
+		#endif
+
+
+		ret = wpa_set_auth_algs(dev, (u32)param->value);		
+	
+		break;
+
+	case IW_AUTH_WPA_ENABLED:
+
+		//if(param->value)
+		//	padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; //802.1x
+		//else
+		//	padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Open;//open system
+		
+		//_disassociate(priv);
+		
+		break;
+
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+		//ieee->ieee802_1x = param->value;
+		break;
+
+	case IW_AUTH_PRIVACY_INVOKED:
+		//ieee->privacy_invoked = param->value;
+		break;
+
+	default:
+		return -EOPNOTSUPP;
+		
+	}
+	
+	return ret;
+	
+}
+
+static int rtw_wx_set_enc_ext(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{
+	char *alg_name;
+	u32 param_len;
+	struct ieee_param *param = NULL;
+	struct iw_point *pencoding = &wrqu->encoding;
+ 	struct iw_encode_ext *pext = (struct iw_encode_ext *)extra;
+	int ret=0;
+
+	param_len = sizeof(struct ieee_param) + pext->key_len;
+	param = (struct ieee_param *)rtw_malloc(param_len);
+	if (param == NULL)
+		return -1;
+	
+	_rtw_memset(param, 0, param_len);
+
+	param->cmd = IEEE_CMD_SET_ENCRYPTION;
+	_rtw_memset(param->sta_addr, 0xff, ETH_ALEN);
+
+
+	switch (pext->alg) {
+	case IW_ENCODE_ALG_NONE:
+		//todo: remove key 
+		//remove = 1;	
+		alg_name = "none";
+		break;
+	case IW_ENCODE_ALG_WEP:
+		alg_name = "WEP";
+		break;
+	case IW_ENCODE_ALG_TKIP:
+		alg_name = "TKIP";
+		break;
+	case IW_ENCODE_ALG_CCMP:
+		alg_name = "CCMP";
+		break;
+#ifdef CONFIG_IEEE80211W
+	case IW_ENCODE_ALG_AES_CMAC:
+		alg_name = "BIP";
+		break;
+#endif //CONFIG_IEEE80211W
+	default:	
+		return -1;
+	}
+	
+	strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
+
+	
+	if((pext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)//?
+#ifdef CONFIG_IEEE80211W
+		|| (pext->ext_flags & IW_ENCODE_ALG_AES_CMAC)
+#endif //CONFIG_IEEE80211W
+	)
+	{
+		param->u.crypt.set_tx = 0;
+	}
+
+	if (pext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)//?
+	{
+		param->u.crypt.set_tx = 1;
+	}
+
+	param->u.crypt.idx = (pencoding->flags&0x00FF) -1 ;
+	
+	if (pext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) 
+	{	
+		_rtw_memcpy(param->u.crypt.seq, pext->rx_seq, 8);
+	}
+
+	if(pext->key_len)
+	{
+		param->u.crypt.key_len = pext->key_len;
+		//_rtw_memcpy(param + 1, pext + 1, pext->key_len);
+		_rtw_memcpy(param->u.crypt.key, pext + 1, pext->key_len);
+	}	
+
+	
+	if (pencoding->flags & IW_ENCODE_DISABLED)
+	{		
+		//todo: remove key 
+		//remove = 1;		
+	}	
+	
+	ret =  wpa_set_encryption(dev, param, param_len);	
+	
+
+	if(param)
+	{
+		rtw_mfree((u8*)param, param_len);
+	}
+		
+	
+	return ret;		
+
+}
+
+
+static int rtw_wx_get_nick(struct net_device *dev, 
+			     struct iw_request_info *info, 
+			     union iwreq_data *wrqu, char *extra)
+{	
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	 //struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	 //struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	if(extra)
+	{
+		wrqu->data.length = 14;
+		wrqu->data.flags = 1;
+		_rtw_memcpy(extra, "<WIFI@REALTEK>", 14);
+	}
+
+	//rtw_signal_process(pid, SIGUSR1); //for test
+
+	//dump debug info here	
+/*
+	u32 dot11AuthAlgrthm;		// 802.11 auth, could be open, shared, and 8021x
+	u32 dot11PrivacyAlgrthm;	// This specify the privacy for shared auth. algorithm.
+	u32 dot118021XGrpPrivacy;	// This specify the privacy algthm. used for Grp key 
+	u32 ndisauthtype;
+	u32 ndisencryptstatus;
+*/
+
+	//DBG_871X("auth_alg=0x%x, enc_alg=0x%x, auth_type=0x%x, enc_type=0x%x\n", 
+	//		psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm,
+	//		psecuritypriv->ndisauthtype, psecuritypriv->ndisencryptstatus);
+	
+	//DBG_871X("enc_alg=0x%x\n", psecuritypriv->dot11PrivacyAlgrthm);
+	//DBG_871X("auth_type=0x%x\n", psecuritypriv->ndisauthtype);
+	//DBG_871X("enc_type=0x%x\n", psecuritypriv->ndisencryptstatus);
+
+#if 0
+	DBG_871X("dbg(0x210)=0x%x\n", rtw_read32(padapter, 0x210));
+	DBG_871X("dbg(0x608)=0x%x\n", rtw_read32(padapter, 0x608));
+	DBG_871X("dbg(0x280)=0x%x\n", rtw_read32(padapter, 0x280));
+	DBG_871X("dbg(0x284)=0x%x\n", rtw_read32(padapter, 0x284));
+	DBG_871X("dbg(0x288)=0x%x\n", rtw_read32(padapter, 0x288));
+	
+	DBG_871X("dbg(0x664)=0x%x\n", rtw_read32(padapter, 0x664));
+
+
+	DBG_871X("\n");
+
+	DBG_871X("dbg(0x430)=0x%x\n", rtw_read32(padapter, 0x430));
+	DBG_871X("dbg(0x438)=0x%x\n", rtw_read32(padapter, 0x438));
+
+	DBG_871X("dbg(0x440)=0x%x\n", rtw_read32(padapter, 0x440));
+	
+	DBG_871X("dbg(0x458)=0x%x\n", rtw_read32(padapter, 0x458));
+	
+	DBG_871X("dbg(0x484)=0x%x\n", rtw_read32(padapter, 0x484));
+	DBG_871X("dbg(0x488)=0x%x\n", rtw_read32(padapter, 0x488));
+	
+	DBG_871X("dbg(0x444)=0x%x\n", rtw_read32(padapter, 0x444));
+	DBG_871X("dbg(0x448)=0x%x\n", rtw_read32(padapter, 0x448));
+	DBG_871X("dbg(0x44c)=0x%x\n", rtw_read32(padapter, 0x44c));
+	DBG_871X("dbg(0x450)=0x%x\n", rtw_read32(padapter, 0x450));
+#endif
+	
+	return 0;
+
+}
+
+static int rtw_wx_read32(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	PADAPTER padapter;
+	struct iw_point *p;
+	u16 len;
+	u32 addr;
+	u32 data32;
+	u32 bytes;
+	u8 *ptmp;
+
+
+	padapter = (PADAPTER)rtw_netdev_priv(dev);
+	p = &wrqu->data;
+	len = p->length;
+	ptmp = (u8*)rtw_malloc(len);
+	if (NULL == ptmp)
+		return -ENOMEM;
+
+	if (copy_from_user(ptmp, p->pointer, len)) {
+		rtw_mfree(ptmp, len);
+		return -EFAULT;
+	}
+
+	bytes = 0;
+	addr = 0;
+	sscanf(ptmp, "%d,%x", &bytes, &addr);
+
+	switch (bytes) {
+		case 1:
+			data32 = rtw_read8(padapter, addr);
+			sprintf(extra, "0x%02X", data32);
+			break;
+		case 2:
+			data32 = rtw_read16(padapter, addr);
+			sprintf(extra, "0x%04X", data32);
+			break;
+		case 4:
+			data32 = rtw_read32(padapter, addr);
+			sprintf(extra, "0x%08X", data32);
+			break;
+		default:
+			printk(KERN_INFO "%s: usage> read [bytes],[address(hex)]\n", __func__);
+			return -EINVAL;
+	}
+	printk(KERN_INFO "%s: addr=0x%08X data=%s\n", __func__, addr, extra);
+
+	rtw_mfree(ptmp, len);
+
+	return 0;
+}
+
+static int rtw_wx_write32(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	PADAPTER padapter = (PADAPTER)rtw_netdev_priv(dev);
+
+	u32 addr;
+	u32 data32;
+	u32 bytes;
+
+
+	bytes = 0;
+	addr = 0;
+	data32 = 0;
+	sscanf(extra, "%d,%x,%x", &bytes, &addr, &data32);
+
+	switch (bytes) {
+		case 1:
+			rtw_write8(padapter, addr, (u8)data32);
+			printk(KERN_INFO "%s: addr=0x%08X data=0x%02X\n", __func__, addr, (u8)data32);
+			break;
+		case 2:
+			rtw_write16(padapter, addr, (u16)data32);
+			printk(KERN_INFO "%s: addr=0x%08X data=0x%04X\n", __func__, addr, (u16)data32);
+			break;
+		case 4:
+			rtw_write32(padapter, addr, data32);
+			printk(KERN_INFO "%s: addr=0x%08X data=0x%08X\n", __func__, addr, data32);
+			break;
+		default:
+			printk(KERN_INFO "%s: usage> write [bytes],[address(hex)],[data(hex)]\n", __func__);
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int rtw_wx_read_rf(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u32 path, addr, data32;
+
+
+	path = *(u32*)extra;
+	addr = *((u32*)extra + 1);
+	data32 = rtw_hal_read_rfreg(padapter, path, addr, 0xFFFFF);
+//	DBG_871X("%s: path=%d addr=0x%02x data=0x%05x\n", __func__, path, addr, data32);
+	/*
+	 * IMPORTANT!!
+	 * Only when wireless private ioctl is at odd order,
+	 * "extra" would be copied to user space.
+	 */
+	sprintf(extra, "0x%05x", data32);
+
+	return 0;
+}
+
+static int rtw_wx_write_rf(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u32 path, addr, data32;
+
+
+	path = *(u32*)extra;
+	addr = *((u32*)extra + 1);
+	data32 = *((u32*)extra + 2);
+//	DBG_871X("%s: path=%d addr=0x%02x data=0x%05x\n", __func__, path, addr, data32);
+	rtw_hal_write_rfreg(padapter, path, addr, 0xFFFFF, data32);
+
+	return 0;
+}
+
+static int rtw_wx_priv_null(struct net_device *dev, struct iw_request_info *a,
+		 union iwreq_data *wrqu, char *b)
+{
+	return -1;
+}
+
+static int dummy(struct net_device *dev, struct iw_request_info *a,
+		 union iwreq_data *wrqu, char *b)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	//struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	//DBG_871X("cmd_code=%x, fwstate=0x%x\n", a->cmd, get_fwstate(pmlmepriv));
+	
+	return -1;
+	
+}
+
+static int rtw_wx_set_channel_plan(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	extern int rtw_channel_plan;
+	u8 channel_plan_req = (u8) (*((int *)wrqu));
+
+	#if 0
+	rtw_channel_plan = (int)wrqu->data.pointer;
+	pregistrypriv->channel_plan = rtw_channel_plan;
+	pmlmepriv->ChannelPlan = pregistrypriv->channel_plan;
+	#endif
+
+	if( _SUCCESS == rtw_set_chplan_cmd(padapter, channel_plan_req, 1) ) {
+		DBG_871X("%s set channel_plan = 0x%02X\n", __func__, pmlmepriv->ChannelPlan);
+	} else 
+		return -EPERM;
+
+	return 0;
+}
+
+static int rtw_wx_set_mtk_wps_probe_ie(struct net_device *dev,
+		struct iw_request_info *a,
+		union iwreq_data *wrqu, char *b)
+{
+#ifdef CONFIG_PLATFORM_MT53XX
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_notice_,
+		 ("WLAN IOCTL: cmd_code=%x, fwstate=0x%x\n",
+		  a->cmd, get_fwstate(pmlmepriv)));
+#endif
+	return 0;
+}
+
+static int rtw_wx_get_sensitivity(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *buf)
+{
+#ifdef CONFIG_PLATFORM_MT53XX
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	//	Modified by Albert 20110914
+	//	This is in dbm format for MTK platform.
+	wrqu->qual.level = padapter->recvpriv.rssi;
+	DBG_871X(" level = %u\n",  wrqu->qual.level );
+#endif
+	return 0;
+}
+
+static int rtw_wx_set_mtk_wps_ie(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+#ifdef CONFIG_PLATFORM_MT53XX
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	return rtw_set_wpa_ie(padapter, wrqu->data.pointer, wrqu->data.length);
+#else
+	return 0;
+#endif
+}
+
+/*
+typedef int (*iw_handler)(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra);
+*/
+/*
+ *	For all data larger than 16 octets, we need to use a
+ *	pointer to memory allocated in user space.
+ */
+static  int rtw_drvext_hdl(struct net_device *dev, struct iw_request_info *info,
+						union iwreq_data *wrqu, char *extra)
+{
+
+ #if 0
+struct	iw_point
+{
+  void __user	*pointer;	/* Pointer to the data  (in user space) */
+  __u16		length;		/* number of fields or size in bytes */
+  __u16		flags;		/* Optional params */
+};
+ #endif
+
+#ifdef CONFIG_DRVEXT_MODULE
+	u8 res;
+	struct drvext_handler *phandler;	
+	struct drvext_oidparam *poidparam;		
+	int ret;
+	u16 len;
+	u8 *pparmbuf, bset;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *p = &wrqu->data;
+
+	if( (!p->length) || (!p->pointer)){
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+	
+	
+	bset = (u8)(p->flags&0xFFFF);
+	len = p->length;
+	pparmbuf = (u8*)rtw_malloc(len);
+	if (pparmbuf == NULL){
+		ret = -ENOMEM;
+		goto _rtw_drvext_hdl_exit;
+	}
+	
+	if(bset)//set info
+	{
+		if (copy_from_user(pparmbuf, p->pointer,len)) {
+			rtw_mfree(pparmbuf, len);
+			ret = -EFAULT;
+			goto _rtw_drvext_hdl_exit;
+		}		
+	}
+	else//query info
+	{
+	
+	}
+
+	
+	//
+	poidparam = (struct drvext_oidparam *)pparmbuf;	
+	
+	RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("drvext set oid subcode [%d], len[%d], InformationBufferLength[%d]\r\n",
+        					 poidparam->subcode, poidparam->len, len));
+
+
+	//check subcode	
+	if ( poidparam->subcode >= MAX_DRVEXT_HANDLERS)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("no matching drvext handlers\r\n"));		
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	if ( poidparam->subcode >= MAX_DRVEXT_OID_SUBCODES)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("no matching drvext subcodes\r\n"));		
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	phandler = drvextoidhandlers + poidparam->subcode;
+
+	if (poidparam->len != phandler->parmsize)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("no matching drvext param size %d vs %d\r\n",			
+						poidparam->len , phandler->parmsize));		
+		ret = -EINVAL;		
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	res = phandler->handler(&padapter->drvextpriv, bset, poidparam->data);
+
+	if(res==0)
+	{
+		ret = 0;
+			
+		if (bset == 0x00) {//query info
+			//_rtw_memcpy(p->pointer, pparmbuf, len);
+			if (copy_to_user(p->pointer, pparmbuf, len))
+				ret = -EFAULT;
+		}		
+	}		
+	else
+		ret = -EFAULT;
+
+	
+_rtw_drvext_hdl_exit:	
+	
+	return ret;	
+	
+#endif
+
+	return 0;
+
+}
+
+static void rtw_dbg_mode_hdl(_adapter *padapter, u32 id, u8 *pdata, u32 len)
+{
+	pRW_Reg 	RegRWStruct;
+	struct rf_reg_param *prfreg;
+	u8 path;
+	u8 offset;
+	u32 value;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	switch(id)
+	{
+		case GEN_MP_IOCTL_SUBCODE(MP_START):
+			DBG_871X("871x_driver is only for normal mode, can't enter mp mode\n");
+			break;
+		case GEN_MP_IOCTL_SUBCODE(READ_REG):
+			RegRWStruct = (pRW_Reg)pdata;
+			switch (RegRWStruct->width)
+			{
+				case 1:
+					RegRWStruct->value = rtw_read8(padapter, RegRWStruct->offset);
+					break;
+				case 2:
+					RegRWStruct->value = rtw_read16(padapter, RegRWStruct->offset);
+					break;
+				case 4:
+					RegRWStruct->value = rtw_read32(padapter, RegRWStruct->offset);
+					break;
+				default:
+					break;
+			}
+		
+			break;
+		case GEN_MP_IOCTL_SUBCODE(WRITE_REG):
+			RegRWStruct = (pRW_Reg)pdata;
+			switch (RegRWStruct->width)
+			{
+				case 1:
+					rtw_write8(padapter, RegRWStruct->offset, (u8)RegRWStruct->value);
+					break;
+				case 2:
+					rtw_write16(padapter, RegRWStruct->offset, (u16)RegRWStruct->value);
+					break;
+				case 4:
+					rtw_write32(padapter, RegRWStruct->offset, (u32)RegRWStruct->value);
+					break;
+				default:					
+				break;
+			}
+				
+			break;
+		case GEN_MP_IOCTL_SUBCODE(READ_RF_REG):
+
+			prfreg = (struct rf_reg_param *)pdata;
+
+			path = (u8)prfreg->path;		
+			offset = (u8)prfreg->offset;	
+
+			value = rtw_hal_read_rfreg(padapter, path, offset, 0xffffffff);
+
+			prfreg->value = value;
+
+			break;			
+		case GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG):
+
+			prfreg = (struct rf_reg_param *)pdata;
+
+			path = (u8)prfreg->path;
+			offset = (u8)prfreg->offset;	
+			value = prfreg->value;
+
+			rtw_hal_write_rfreg(padapter, path, offset, 0xffffffff, value);
+			
+			break;			
+                case GEN_MP_IOCTL_SUBCODE(TRIGGER_GPIO):
+			DBG_871X("==> trigger gpio 0\n");
+			rtw_hal_set_hwreg(padapter, HW_VAR_TRIGGER_GPIO_0, 0);
+			break;	
+#ifdef CONFIG_BT_COEXIST
+		case GEN_MP_IOCTL_SUBCODE(SET_DM_BT):			
+			DBG_871X("==> set dm_bt_coexist:%x\n",*(u8 *)pdata);
+			rtw_hal_set_hwreg(padapter, HW_VAR_BT_SET_COEXIST, pdata);
+			break;
+		case GEN_MP_IOCTL_SUBCODE(DEL_BA):
+			DBG_871X("==> delete ba:%x\n",*(u8 *)pdata);
+			rtw_hal_set_hwreg(padapter, HW_VAR_BT_ISSUE_DELBA, pdata);
+			break;
+#endif
+#ifdef DBG_CONFIG_ERROR_DETECT
+		case GEN_MP_IOCTL_SUBCODE(GET_WIFI_STATUS):	
+			*pdata = rtw_hal_sreset_get_wifi_status(padapter);
+			break;
+#endif
+	
+		default:
+			break;
+	}
+	
+}
+
+static int rtw_mp_ioctl_hdl(struct net_device *dev, struct iw_request_info *info,
+						union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	u32 BytesRead, BytesWritten, BytesNeeded;
+	struct oid_par_priv	oid_par;
+	struct mp_ioctl_handler	*phandler;
+	struct mp_ioctl_param	*poidparam;
+	uint status=0;
+	u16 len;
+	u8 *pparmbuf = NULL, bset;
+	PADAPTER padapter = (PADAPTER)rtw_netdev_priv(dev);
+	struct iw_point *p = &wrqu->data;
+
+	//DBG_871X("+rtw_mp_ioctl_hdl\n");
+
+	//mutex_lock(&ioctl_mutex);
+
+	if ((!p->length) || (!p->pointer)) {
+		ret = -EINVAL;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	pparmbuf = NULL;
+	bset = (u8)(p->flags & 0xFFFF);
+	len = p->length;
+	pparmbuf = (u8*)rtw_malloc(len);
+	if (pparmbuf == NULL){
+		ret = -ENOMEM;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	if (copy_from_user(pparmbuf, p->pointer, len)) {
+		ret = -EFAULT;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	poidparam = (struct mp_ioctl_param *)pparmbuf;
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		 ("rtw_mp_ioctl_hdl: subcode [%d], len[%d], buffer_len[%d]\r\n",
+		  poidparam->subcode, poidparam->len, len));
+
+	if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_, ("no matching drvext subcodes\r\n"));
+		ret = -EINVAL;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	//DBG_871X("%s: %d\n", __func__, poidparam->subcode);
+
+#ifdef CONFIG_MP_INCLUDED 
+	phandler = mp_ioctl_hdl + poidparam->subcode;
+
+	if ((phandler->paramsize != 0) && (poidparam->len < phandler->paramsize))
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_,
+			 ("no matching drvext param size %d vs %d\r\n",
+			  poidparam->len, phandler->paramsize));
+		ret = -EINVAL;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	if (phandler->handler)
+	{
+		oid_par.adapter_context = padapter;
+		oid_par.oid = phandler->oid;
+		oid_par.information_buf = poidparam->data;
+		oid_par.information_buf_len = poidparam->len;
+		oid_par.dbg = 0;
+
+		BytesWritten = 0;
+		BytesNeeded = 0;
+
+		if (bset) {
+			oid_par.bytes_rw = &BytesRead;
+			oid_par.bytes_needed = &BytesNeeded;
+			oid_par.type_of_oid = SET_OID;
+		} else {
+			oid_par.bytes_rw = &BytesWritten;
+			oid_par.bytes_needed = &BytesNeeded;
+			oid_par.type_of_oid = QUERY_OID;
+		}
+
+		status = phandler->handler(&oid_par);
+
+		//todo:check status, BytesNeeded, etc.
+	}
+	else {
+		DBG_871X("rtw_mp_ioctl_hdl(): err!, subcode=%d, oid=%d, handler=%p\n", 
+			poidparam->subcode, phandler->oid, phandler->handler);
+		ret = -EFAULT;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+#else
+
+	rtw_dbg_mode_hdl(padapter, poidparam->subcode, poidparam->data, poidparam->len);
+	
+#endif
+
+	if (bset == 0x00) {//query info
+		if (copy_to_user(p->pointer, pparmbuf, len))
+			ret = -EFAULT;
+	}
+
+	if (status) {
+		ret = -EFAULT;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+_rtw_mp_ioctl_hdl_exit:
+
+	if (pparmbuf)
+		rtw_mfree(pparmbuf, len);
+
+	//mutex_unlock(&ioctl_mutex);
+
+	return ret;
+}
+
+static int rtw_get_ap_info(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int bssid_match, ret = 0;
+	u32 cnt=0, wpa_ielen;
+	_irqL	irqL;
+	_list	*plist, *phead;
+	unsigned char *pbuf;
+	u8 bssid[ETH_ALEN];
+	char data[32];
+	struct wlan_network *pnetwork = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct iw_point *pdata = &wrqu->data;	
+
+	DBG_871X("+rtw_get_aplist_info\n");
+
+	if((padapter->bDriverStopped) || (pdata==NULL))
+	{                
+		ret= -EINVAL;
+		goto exit;
+	}		
+  
+ 	while((check_fwstate(pmlmepriv, (_FW_UNDER_SURVEY|_FW_UNDER_LINKING))) == _TRUE)
+	{	
+		rtw_msleep_os(30);
+		cnt++;
+		if(cnt > 100)
+			break;
+	}
+	
+
+	//pdata->length = 0;//?	
+	pdata->flags = 0;
+	if(pdata->length>=32)
+	{
+		if(copy_from_user(data, pdata->pointer, 32))
+		{
+			ret= -EINVAL;
+			goto exit;
+		}
+	}	
+	else
+	{
+		ret= -EINVAL;
+		goto exit;
+	}	
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//if(hwaddr_aton_i(pdata->pointer, bssid)) 
+		if(hwaddr_aton_i(data, bssid)) 
+		{			
+			DBG_871X("Invalid BSSID '%s'.\n", (u8*)data);
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			return -EINVAL;
+		}		
+		
+	
+		if(_rtw_memcmp(bssid, pnetwork->network.MacAddress, ETH_ALEN) == _TRUE)//BSSID match, then check if supporting wpa/wpa2
+		{
+			DBG_871X("BSSID:" MAC_FMT "\n", MAC_ARG(bssid));
+			
+			pbuf = rtw_get_wpa_ie(&pnetwork->network.IEs[12], &wpa_ielen, pnetwork->network.IELength-12);				
+			if(pbuf && (wpa_ielen>0))
+			{
+				pdata->flags = 1;
+				break;
+			}
+
+			pbuf = rtw_get_wpa2_ie(&pnetwork->network.IEs[12], &wpa_ielen, pnetwork->network.IELength-12);
+			if(pbuf && (wpa_ielen>0))
+			{
+				pdata->flags = 2;
+				break;
+			}
+			
+		}
+
+		plist = get_next(plist);		
+	
+	}        
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if(pdata->length>=34)
+	{
+		if(copy_to_user((u8*)pdata->pointer+32, (u8*)&pdata->flags, 1))
+		{
+			ret= -EINVAL;
+			goto exit;
+		}
+	}	
+	
+exit:
+	
+	return ret;
+		
+}
+
+static int rtw_set_pid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = rtw_netdev_priv(dev);	
+	int *pdata = (int *)wrqu;
+	int selector;
+
+	if((padapter->bDriverStopped) || (pdata==NULL))
+	{                
+		ret= -EINVAL;
+		goto exit;
+	}		
+  
+	selector = *pdata;
+	if(selector < 3 && selector >=0) {
+		padapter->pid[selector] = *(pdata+1);
+		#ifdef CONFIG_GLOBAL_UI_PID
+		ui_pid[selector] = *(pdata+1);
+		#endif
+		DBG_871X("%s set pid[%d]=%d\n", __FUNCTION__, selector ,padapter->pid[selector]);
+	}
+	else
+		DBG_871X("%s selector %d error\n", __FUNCTION__, selector);
+
+exit:
+	
+	return ret;
+		
+}
+
+static int rtw_wps_start(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	u32   u32wps_start = 0;
+        unsigned int uintRet = 0;
+
+        uintRet = copy_from_user( ( void* ) &u32wps_start, pdata->pointer, 4 );
+
+	if((padapter->bDriverStopped) || (pdata==NULL))
+	{                
+		ret= -EINVAL;
+		goto exit;
+	}		
+
+	if ( u32wps_start == 0 )
+	{
+		u32wps_start = *extra;
+	}
+
+	DBG_871X( "[%s] wps_start = %d\n", __FUNCTION__, u32wps_start );
+
+	if ( u32wps_start == 1 ) // WPS Start
+	{
+		rtw_led_control(padapter, LED_CTL_START_WPS);
+	}
+	else if ( u32wps_start == 2 ) // WPS Stop because of wps success
+	{
+		rtw_led_control(padapter, LED_CTL_STOP_WPS);
+	}
+	else if ( u32wps_start == 3 ) // WPS Stop because of wps fail
+	{
+		rtw_led_control(padapter, LED_CTL_STOP_WPS_FAIL);
+	}
+
+#ifdef CONFIG_INTEL_WIDI
+	process_intel_widi_wps_status(padapter, u32wps_start);
+#endif //CONFIG_INTEL_WIDI
+	
+exit:
+	
+	return ret;
+		
+}
+
+#ifdef CONFIG_P2P
+static int rtw_wext_p2p_enable(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	enum P2P_ROLE init_role = P2P_ROLE_DISABLE;
+
+	if(*extra == '0' )
+		init_role = P2P_ROLE_DISABLE;
+	else if(*extra == '1')
+		init_role = P2P_ROLE_DEVICE;
+	else if(*extra == '2')
+		init_role = P2P_ROLE_CLIENT;
+	else if(*extra == '3')
+		init_role = P2P_ROLE_GO;
+
+	if(_FAIL == rtw_p2p_enable(padapter, init_role))
+	{
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	//set channel/bandwidth
+	if(init_role != P2P_ROLE_DISABLE) 
+	{	
+		u8 channel, ch_offset;
+		u16 bwmode;
+
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_LISTEN))
+		{
+			//	Stay at the listen state and wait for discovery.
+			channel = pwdinfo->listen_channel;
+			pwdinfo->operating_channel = pwdinfo->listen_channel;
+			ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+			bwmode = HT_CHANNEL_WIDTH_20;
+		}
+#ifdef CONFIG_CONCURRENT_MODE
+		else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+		{
+			_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+			//struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+			struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+			struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+			
+			_set_timer( &pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_interval );
+			if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+			{
+				pwdinfo->operating_channel = pbuddy_mlmeext->cur_channel;
+				//	How about the ch_offset and bwmode ??
+			}
+			else
+			{
+				pwdinfo->operating_channel = pwdinfo->listen_channel;
+			}
+
+			channel = pbuddy_mlmeext->cur_channel;
+			ch_offset = pbuddy_mlmeext->cur_ch_offset;
+			bwmode = pbuddy_mlmeext->cur_bwmode;
+		}
+#endif
+		else
+		{
+			pwdinfo->operating_channel = pmlmeext->cur_channel;
+		
+			channel = pwdinfo->operating_channel;
+			ch_offset = pmlmeext->cur_ch_offset;
+			bwmode = pmlmeext->cur_bwmode;						
+		}
+
+		set_channel_bwmode(padapter, channel, ch_offset, bwmode);
+	}
+
+exit:
+	return ret;
+		
+}
+
+static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	DBG_871X( "[%s] ssid = %s, len = %d\n", __FUNCTION__, extra, (u32)strlen( extra ) );
+	_rtw_memcpy( pwdinfo->nego_ssid, extra, strlen( extra ) );
+	pwdinfo->nego_ssidlen = strlen( extra );
+	
+	return ret;
+		
+}
+
+
+static int rtw_p2p_set_intent(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int 							ret = 0;
+	_adapter 						*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info 			*pwdinfo= &(padapter->wdinfo);
+	u8							intent = pwdinfo->intent;
+
+	extra[ wrqu->data.length ] = 0x00;
+
+	intent = rtw_atoi( extra );
+	
+	if ( intent <= 15 )
+	{
+		pwdinfo->intent= intent;
+	}
+	else
+	{
+		ret = -1;
+	}
+	
+	DBG_871X( "[%s] intent = %d\n", __FUNCTION__, intent);
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_listen_ch(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	u8	listen_ch = pwdinfo->listen_channel;	//	Listen channel number
+
+	extra[ wrqu->data.length ] = 0x00;
+	listen_ch = rtw_atoi( extra );
+
+	if ( ( listen_ch == 1 ) || ( listen_ch == 6 ) || ( listen_ch == 11 ) )
+	{
+		pwdinfo->listen_channel = listen_ch;
+		set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}
+	else
+	{
+		ret = -1;
+	}
+	
+	DBG_871X( "[%s] listen_ch = %d\n", __FUNCTION__, pwdinfo->listen_channel );
+	
+	return ret;
+		
+}
+
+static int rtw_p2p_set_op_ch(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+//	Commented by Albert 20110524
+//	This function is used to set the operating channel if the driver will become the group owner
+
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	u8	op_ch = pwdinfo->operating_channel;	//	Operating channel number
+
+	extra[ wrqu->data.length ] = 0x00;
+
+	op_ch = ( u8 ) rtw_atoi( extra );
+	if ( op_ch > 0 )
+	{
+		pwdinfo->operating_channel = op_ch;
+	}
+	else
+	{
+		ret = -1;
+	}
+	
+	DBG_871X( "[%s] op_ch = %d\n", __FUNCTION__, pwdinfo->operating_channel );
+	
+	return ret;
+
+}
+
+
+static int rtw_p2p_profilefound(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	//	Comment by Albert 2010/10/13
+	//	Input data format:
+	//	Ex:  0
+	//	Ex:  1XX:XX:XX:XX:XX:XXYYSSID
+	//	0 => Reflush the profile record list.
+	//	1 => Add the profile list
+	//	XX:XX:XX:XX:XX:XX => peer's MAC Address ( ex: 00:E0:4C:00:00:01 )
+	//	YY => SSID Length
+	//	SSID => SSID for persistence group
+
+	DBG_871X( "[%s] In value = %s, len = %d \n", __FUNCTION__, extra, wrqu->data.length -1);
+
+	
+	//	The upper application should pass the SSID to driver by using this rtw_p2p_profilefound function.
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		if ( extra[ 0 ] == '0' )
+		{
+			//	Remove all the profile information of wifidirect_info structure.
+			_rtw_memset( &pwdinfo->profileinfo[ 0 ], 0x00, sizeof( struct profile_info ) * P2P_MAX_PERSISTENT_GROUP_NUM );
+			pwdinfo->profileindex = 0;
+		}
+		else
+		{
+			if ( pwdinfo->profileindex >= P2P_MAX_PERSISTENT_GROUP_NUM )
+		{
+				ret = -1;
+		}
+		else
+		{
+				int jj, kk;
+				
+				//	Add this profile information into pwdinfo->profileinfo
+				//	Ex:  1XX:XX:XX:XX:XX:XXYYSSID
+				for( jj = 0, kk = 1; jj < ETH_ALEN; jj++, kk += 3 )
+				{
+					pwdinfo->profileinfo[ pwdinfo->profileindex ].peermac[ jj ] = key_2char2num(extra[ kk ], extra[ kk+ 1 ]);
+				}
+
+				//pwdinfo->profileinfo[ pwdinfo->profileindex ].ssidlen = ( extra[18] - '0' ) * 10 + ( extra[ 19 ] - '0' );
+				//_rtw_memcpy( pwdinfo->profileinfo[ pwdinfo->profileindex ].ssid, &extra[ 20 ], pwdinfo->profileinfo[ pwdinfo->profileindex ].ssidlen );
+				pwdinfo->profileindex++;
+			}
+		}
+	}	
+	
+	return ret;
+		
+}
+
+static int rtw_p2p_setDN(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+
+	DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );
+	_rtw_memcpy( pwdinfo->device_name, extra, wrqu->data.length - 1 );
+	pwdinfo->device_name_len = wrqu->data.length - 1;
+	return ret;
+		
+}
+
+
+static int rtw_p2p_get_status(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	if ( padapter->bShowGetP2PState )
+	{
+		DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+				pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+				pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+	}
+ 
+	//	Commented by Albert 2010/10/12
+	//	Because of the output size limitation, I had removed the "Role" information.
+	//	About the "Role" information, we will use the new private IOCTL to get the "Role" information.
+	sprintf( extra, "\n\nStatus=%.2d\n", rtw_p2p_state(pwdinfo) );
+	wrqu->data.length = strlen( extra );
+
+	return ret;
+		
+}
+
+//	Commented by Albert 20110520
+//	This function will return the config method description 
+//	This config method description will show us which config method the remote P2P device is intented to use
+//	by sending the provisioning discovery request frame.
+
+static int rtw_p2p_get_req_cm(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n\nCM=%s\n", pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req );
+	wrqu->data.length = strlen( extra );
+	return ret;
+		
+}
+
+
+static int rtw_p2p_get_role(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+			pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+
+	sprintf( extra, "\n\nRole=%.2d\n", rtw_p2p_role(pwdinfo) );
+	wrqu->data.length = strlen( extra );
+	return ret;
+		
+}
+
+
+static int rtw_p2p_get_peer_ifaddr(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+			pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+
+	sprintf( extra, "\nMAC %.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+			pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+			pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+	wrqu->data.length = strlen( extra );
+	return ret;
+		
+}
+
+static int rtw_p2p_get_peer_devaddr(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 0 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 1 ], 
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 2 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 3 ],
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 4 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 5 ]);
+	sprintf( extra, "\n%.2X%.2X%.2X%.2X%.2X%.2X",
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 0 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 1 ], 
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 2 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 3 ],
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 4 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 5 ]);
+	wrqu->data.length = strlen( extra );	
+	return ret;
+		
+}
+
+static int rtw_p2p_get_peer_devaddr_by_invitation(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->p2p_peer_device_addr[ 0 ], pwdinfo->p2p_peer_device_addr[ 1 ], 
+			pwdinfo->p2p_peer_device_addr[ 2 ], pwdinfo->p2p_peer_device_addr[ 3 ],
+			pwdinfo->p2p_peer_device_addr[ 4 ], pwdinfo->p2p_peer_device_addr[ 5 ]);
+	sprintf( extra, "\nMAC %.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+			pwdinfo->p2p_peer_device_addr[ 0 ], pwdinfo->p2p_peer_device_addr[ 1 ], 
+			pwdinfo->p2p_peer_device_addr[ 2 ], pwdinfo->p2p_peer_device_addr[ 3 ],
+			pwdinfo->p2p_peer_device_addr[ 4 ], pwdinfo->p2p_peer_device_addr[ 5 ]);
+	wrqu->data.length = strlen( extra );	
+	return ret;
+		
+}
+
+static int rtw_p2p_get_groupid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n%.2X:%.2X:%.2X:%.2X:%.2X:%.2X %s",
+			pwdinfo->groupid_info.go_device_addr[ 0 ], pwdinfo->groupid_info.go_device_addr[ 1 ], 
+			pwdinfo->groupid_info.go_device_addr[ 2 ], pwdinfo->groupid_info.go_device_addr[ 3 ],
+			pwdinfo->groupid_info.go_device_addr[ 4 ], pwdinfo->groupid_info.go_device_addr[ 5 ],
+			pwdinfo->groupid_info.ssid);
+	wrqu->data.length = strlen( extra );	
+	return ret;
+		
+}
+
+static int rtw_p2p_get_op_ch(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	
+	DBG_871X( "[%s] Op_ch = %02x\n", __FUNCTION__, pwdinfo->operating_channel);
+	
+	sprintf( extra, "\n\nOp_ch=%.2d\n", pwdinfo->operating_channel );
+	wrqu->data.length = strlen( extra );
+	return ret;
+		
+}
+
+inline static void macstr2num(u8 *dst, u8 *src)
+{
+	int	jj, kk;
+	for (jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3)
+	{
+		dst[jj] = key_2char2num(src[kk], src[kk + 1]);
+	}
+}
+
+static int rtw_p2p_get_wps_configmethod(struct net_device *dev,
+										struct iw_request_info *info,
+										union iwreq_data *wrqu, char *extra, char *subcmd)
+{ 
+	
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list * plist,*phead;
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u16	attr_content = 0;
+	uint attr_contentlen = 0;
+	u8	attr_content_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Albert 20110727
+	//	The input data is the MAC address which the application wants to know its WPS config method.
+	//	After knowing its WPS config method, the application can decide the config method for provisioning discovery.
+	//	Format: iwpriv wlanx p2p_get_wpsCM 00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			u8 *wpsie;
+			uint	wpsie_len = 0;
+
+			//	The mac address is matched.
+
+			if ((wpsie = rtw_get_wps_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &wpsie_len)))
+			{
+				rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_CONF_METHOD, (u8 *)&attr_content, &attr_contentlen);
+				if (attr_contentlen)
+				{
+					attr_content = be16_to_cpu(attr_content);
+					sprintf(attr_content_str, "\n\nM=%.4d", attr_content);
+					blnMatch = 1;
+				}
+			}
+
+			break;
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(attr_content_str, "\n\nM=0000");
+	}
+
+	wrqu->data.length = strlen(attr_content_str);
+	_rtw_memcpy(extra, attr_content_str, wrqu->data.length);
+
+	return ret; 
+		
+}
+
+#ifdef CONFIG_WFD
+static int rtw_p2p_get_peer_wfd_port(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	DBG_871X( "[%s] p2p_state = %d\n", __FUNCTION__, rtw_p2p_state(pwdinfo) );
+
+	sprintf( extra, "\n\nPort=%d\n", pwdinfo->wfd_info->peer_rtsp_ctrlport );
+	DBG_871X( "[%s] remote port = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+	
+	wrqu->data.length = strlen( extra );
+	return ret;
+		
+}
+
+static int rtw_p2p_get_peer_wfd_preferred_connection(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n\nwfd_pc=%d\n", pwdinfo->wfd_info->wfd_pc );
+	DBG_871X( "[%s] wfd_pc = %d\n", __FUNCTION__, pwdinfo->wfd_info->wfd_pc );
+
+	wrqu->data.length = strlen( extra );
+	pwdinfo->wfd_info->wfd_pc = _FALSE;	//	Reset the WFD preferred connection to P2P
+	return ret;
+		
+}
+
+static int rtw_p2p_get_peer_wfd_session_available(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n\nwfd_sa=%d\n", pwdinfo->wfd_info->peer_session_avail );
+	DBG_871X( "[%s] wfd_sa = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_session_avail );
+
+	wrqu->data.length = strlen( extra );
+	pwdinfo->wfd_info->peer_session_avail = _TRUE;	//	Reset the WFD session available
+	return ret;
+		
+}
+
+#endif // CONFIG_WFD
+
+static int rtw_p2p_get_go_device_address(struct net_device *dev,
+										 struct iw_request_info *info,
+										 union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue	= &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 *p2pie;
+	uint p2pielen = 0, attr_contentlen = 0;
+	u8 attr_content[100] = { 0x00 };
+	u8 go_devadd_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Albert 20121209
+	//	The input data is the GO's interface address which the application wants to know its device address.
+	//	Format: iwpriv wlanx p2p_get2 go_devadd=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			//	Commented by Albert 2011/05/18
+			//	Match the device address located in the P2P IE
+			//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+			if ((p2pie = rtw_get_p2p_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)))
+			{
+				while (p2pie)
+				{
+					//	The P2P Device ID attribute is included in the Beacon frame.
+					//	The P2P Device Info attribute is included in the probe response frame.
+
+					_rtw_memset(attr_content, 0x00, 100);
+					if (rtw_get_p2p_attr_content(p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen))
+					{
+						//	Handle the P2P Device ID attribute of Beacon first
+						blnMatch = 1;
+						break;
+
+					} else if (rtw_get_p2p_attr_content(p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen))
+					{
+						//	Handle the P2P Device Info attribute of probe response
+						blnMatch = 1;
+						break;
+					}
+
+					//Get the next P2P IE
+					p2pie = rtw_get_p2p_ie(p2pie + p2pielen, pnetwork->network.IELength - 12 - (p2pie - &pnetwork->network.IEs[12] + p2pielen), NULL, &p2pielen);
+				}
+			}
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(go_devadd_str, "\n\ndev_add=NULL");
+	} else
+	{
+		sprintf(go_devadd_str, "\n\ndev_add=%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+				attr_content[0], attr_content[1], attr_content[2], attr_content[3], attr_content[4], attr_content[5]);
+	}
+
+	wrqu->data.length = strlen(go_devadd_str);
+	_rtw_memcpy(extra, go_devadd_str, wrqu->data.length);
+
+	return ret; 
+		
+}
+
+static int rtw_p2p_get_device_type(struct net_device *dev,
+								   struct iw_request_info *info,
+								   union iwreq_data *wrqu, char *extra, char *subcmd)
+{ 
+	
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 dev_type[8] = { 0x00 };
+	uint dev_type_len = 0;
+	u8 dev_type_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };    // +9 is for the str "dev_type=", we have to clear it at wrqu->data.pointer
+
+	//	Commented by Albert 20121209
+	//	The input data is the MAC address which the application wants to know its device type.
+	//	Such user interface could know the device type.
+	//	Format: iwpriv wlanx p2p_get2 dev_type=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			u8 *wpsie;
+			uint	wpsie_len = 0;
+
+			//	The mac address is matched.
+
+			if ((wpsie = rtw_get_wps_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &wpsie_len)))
+			{
+				rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_PRIMARY_DEV_TYPE, dev_type, &dev_type_len);
+				if (dev_type_len)
+				{
+					u16	type = 0;
+
+					_rtw_memcpy(&type, dev_type, 2);
+					type = be16_to_cpu(type);
+					sprintf(dev_type_str, "\n\nN=%.2d", type);
+					blnMatch = 1;
+				}
+			}
+			break;
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(dev_type_str, "\n\nN=00");
+	}
+
+	wrqu->data.length = strlen(dev_type_str);
+	_rtw_memcpy(extra, dev_type_str, wrqu->data.length);
+
+	return ret; 
+		
+}
+
+static int rtw_p2p_get_device_name(struct net_device *dev,
+								   struct iw_request_info *info,
+								   union iwreq_data *wrqu, char *extra, char *subcmd)
+{ 
+	
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 dev_name[WPS_MAX_DEVICE_NAME_LEN] = { 0x00 };
+	uint dev_len = 0;
+	u8 dev_name_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Albert 20121225
+	//	The input data is the MAC address which the application wants to know its device name.
+	//	Such user interface could show peer device's device name instead of ssid.
+	//	Format: iwpriv wlanx p2p_get2 devN=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			u8 *wpsie;
+			uint	wpsie_len = 0;
+
+			//	The mac address is matched.
+
+			if ((wpsie = rtw_get_wps_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &wpsie_len)))
+			{
+				rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_DEVICE_NAME, dev_name, &dev_len);
+				if (dev_len)
+				{
+					sprintf(dev_name_str, "\n\nN=%s", dev_name);
+					blnMatch = 1;
+				}
+			}
+			break;
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(dev_name_str, "\n\nN=0000");
+	}
+
+	wrqu->data.length = strlen(dev_name_str);
+	_rtw_memcpy(extra, dev_name_str, wrqu->data.length);
+
+	return ret; 
+		
+}
+
+static int rtw_p2p_get_invitation_procedure(struct net_device *dev,
+											struct iw_request_info *info,
+											union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue	= &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 *p2pie;
+	uint p2pielen = 0, attr_contentlen = 0;
+	u8 attr_content[2] = { 0x00 };
+	u8 inv_proc_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Ouden 20121226
+	//	The application wants to know P2P initation procedure is support or not.
+	//	Format: iwpriv wlanx p2p_get2 InvProc=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			//	Commented by Albert 20121226
+			//	Match the device address located in the P2P IE
+			//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+			if ((p2pie = rtw_get_p2p_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)))
+			{
+				while (p2pie)
+				{
+					//_rtw_memset( attr_content, 0x00, 2);
+					if (rtw_get_p2p_attr_content(p2pie, p2pielen, P2P_ATTR_CAPABILITY, attr_content, &attr_contentlen))
+					{
+						//	Handle the P2P capability attribute
+						blnMatch = 1;
+						break;
+
+					}
+
+					//Get the next P2P IE
+					p2pie = rtw_get_p2p_ie(p2pie + p2pielen, pnetwork->network.IELength - 12 - (p2pie - &pnetwork->network.IEs[12] + p2pielen), NULL, &p2pielen);
+				}
+			}
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(inv_proc_str, "\nIP=-1");
+	} else
+	{
+		if (attr_content[0] && 0x20)
+		{
+			sprintf(inv_proc_str, "\nIP=1");
+		} else
+		{
+			sprintf(inv_proc_str, "\nIP=0");
+		}
+	}
+
+	wrqu->data.length = strlen(inv_proc_str);
+	_rtw_memcpy(extra, inv_proc_str, wrqu->data.length);
+
+	return ret; 
+		
+}
+
+static int rtw_p2p_connect(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8					peerMAC[ ETH_ALEN ] = { 0x00 };
+	int 					jj,kk;
+	u8   					peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	_irqL				irqL;
+	_list					*plist, *phead;
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	uint					uintPeerChannel = 0;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE	
+	
+	
+	//	Commented by Albert 20110304
+	//	The input data contains two informations.
+	//	1. First information is the MAC address which wants to formate with
+	//	2. Second information is the WPS PINCode or "pbc" string for push button method
+	//	Format: 00:E0:4C:00:00:05
+	//	Format: 00:E0:4C:00:00:05
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	
+	if ( pwdinfo->ui_got_wps_info == P2P_NO_WPSINFO )
+	{
+		return -1;
+	}
+	
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		peerMAC[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if ( _rtw_memcmp( pnetwork->network.MacAddress, peerMAC, ETH_ALEN ) )
+		{
+			uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+			break;
+              }
+
+		plist = get_next(plist);
+	
+	}        
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if ( uintPeerChannel )
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+		}
+#endif // CONFIG_CONCURRENT_MODE
+
+		_rtw_memset( &pwdinfo->nego_req_info, 0x00, sizeof( struct tx_nego_req_info ) );
+		_rtw_memset( &pwdinfo->groupid_info, 0x00, sizeof( struct group_id_info ) );
+		
+		pwdinfo->nego_req_info.peer_channel_num[ 0 ] = uintPeerChannel;
+		_rtw_memcpy( pwdinfo->nego_req_info.peerDevAddr, pnetwork->network.MacAddress, ETH_ALEN );
+		pwdinfo->nego_req_info.benable = _TRUE;
+
+		_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+		if ( rtw_p2p_state(pwdinfo) != P2P_STATE_GONEGO_OK )
+		{
+			//	Restore to the listen state if the current p2p state is not nego OK
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN );
+		}
+
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_ING);
+		
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			//	Have to enter the power saving with the AP
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			
+			issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+		}
+#endif // CONFIG_CONCURRENT_MODE
+
+		DBG_871X( "[%s] Start PreTx Procedure!\n", __FUNCTION__ );
+		_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_CONCURRENT_GO_NEGO_TIMEOUT );
+		}
+		else
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_GO_NEGO_TIMEOUT );
+		}
+#else
+		_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_GO_NEGO_TIMEOUT );
+#endif // CONFIG_CONCURRENT_MODE		
+
+	}
+	else
+	{
+		DBG_871X( "[%s] Not Found in Scanning Queue~\n", __FUNCTION__ );
+		ret = -1;
+	}
+exit:	
+	return ret;
+}
+
+static int rtw_p2p_invite_req(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	int 						jj,kk;
+	u8   						peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	_list						*plist, *phead;
+	_queue					*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network		*pnetwork = NULL;
+	uint						uintPeerChannel = 0;
+	u8						attr_content[50] = { 0x00 }, _status = 0;
+	u8 						*p2pie;
+	uint						p2pielen = 0, attr_contentlen = 0;
+	_irqL					irqL;
+	struct tx_invite_req_info*	pinvite_req_info = &pwdinfo->invitereq_info;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter					*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv			*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv		*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+#endif // CONFIG_WFD
+	
+	//	Commented by Albert 20120321
+	//	The input data contains two informations.
+	//	1. First information is the P2P device address which you want to send to.	
+	//	2. Second information is the group id which combines with GO's mac address, space and GO's ssid.
+	//	Command line sample: iwpriv wlan0 p2p_set invite="00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy"
+	//	Format: 00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if ( wrqu->data.length <=  37 )
+	{
+		DBG_871X( "[%s] Wrong format!\n", __FUNCTION__ );
+		return ret;
+	}
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+		//	Reset the content of struct tx_invite_req_info
+		pinvite_req_info->benable = _FALSE;
+		_rtw_memset( pinvite_req_info->go_bssid, 0x00, ETH_ALEN );
+		_rtw_memset( pinvite_req_info->go_ssid, 0x00, WLAN_SSID_MAXLEN );
+		pinvite_req_info->ssidlen = 0x00;
+		pinvite_req_info->operating_ch = pwdinfo->operating_channel;
+		_rtw_memset( pinvite_req_info->peer_macaddr, 0x00, ETH_ALEN );
+		pinvite_req_info->token = 3;
+	}
+	
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		pinvite_req_info->peer_macaddr[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//	Commented by Albert 2011/05/18
+		//	Match the device address located in the P2P IE
+		//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+		if ( (p2pie=rtw_get_p2p_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)) )
+		{
+			//	The P2P Device ID attribute is included in the Beacon frame.
+			//	The P2P Device Info attribute is included in the probe response frame.
+
+			if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device ID attribute of Beacon first
+				if ( _rtw_memcmp( attr_content, pinvite_req_info->peer_macaddr, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+			else if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device Info attribute of probe response
+				if ( _rtw_memcmp( attr_content, pinvite_req_info->peer_macaddr, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}					
+			}
+
+		}
+
+		plist = get_next(plist);
+	
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+#ifdef CONFIG_WFD
+	if ( uintPeerChannel )
+	{
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+		
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			DBG_871X( "[%s] Found WFD IE!\n", __FUNCTION__ );
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen ) )
+			{
+				u16	wfd_devinfo_field = 0;
+				
+				//	Commented by Albert 20120319
+				//	The first two bytes are the WFD device information field of WFD device information subelement.
+				//	In big endian format.
+				wfd_devinfo_field = RTW_GET_BE16(wfd_devinfo);
+				if ( wfd_devinfo_field & WFD_DEVINFO_SESSION_AVAIL )
+				{
+					pwfd_info->peer_session_avail = _TRUE;
+				}
+				else
+				{
+					pwfd_info->peer_session_avail = _FALSE;
+				}
+			}
+		}
+		
+		if ( _FALSE == pwfd_info->peer_session_avail )
+		{
+			DBG_871X( "[%s] WFD Session not avaiable!\n", __FUNCTION__ );
+			goto exit;
+		}
+	}
+#endif // CONFIG_WFD
+
+	if ( uintPeerChannel )
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+		{
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+		}
+#endif // CONFIG_CONCURRENT_MODE
+
+		//	Store the GO's bssid
+		for( jj = 0, kk = 18; jj < ETH_ALEN; jj++, kk += 3 )
+		{
+			pinvite_req_info->go_bssid[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+		}
+
+		//	Store the GO's ssid
+		pinvite_req_info->ssidlen = wrqu->data.length - 36;
+		_rtw_memcpy( pinvite_req_info->go_ssid, &extra[ 36 ], (u32) pinvite_req_info->ssidlen );
+		pinvite_req_info->benable = _TRUE;
+		pinvite_req_info->peer_ch = uintPeerChannel;
+
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_TX_INVITE_REQ);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+		{
+			//	Have to enter the power saving with the AP
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			
+			issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+		}
+		else
+		{
+			set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+#else
+		set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+#endif
+
+		_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_CONCURRENT_INVITE_TIMEOUT );
+		}
+		else
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_INVITE_TIMEOUT );
+		}
+#else
+		_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_INVITE_TIMEOUT );
+#endif // CONFIG_CONCURRENT_MODE		
+
+		
+	}
+	else
+	{
+		DBG_871X( "[%s] NOT Found in the Scanning Queue!\n", __FUNCTION__ );
+	}
+exit:
+	
+	return ret;
+		
+}
+
+static int rtw_p2p_set_persistent(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	int 						jj,kk;
+	u8   						peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	_list						*plist, *phead;
+	_queue					*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network		*pnetwork = NULL;
+	uint						uintPeerChannel = 0;
+	u8						attr_content[50] = { 0x00 }, _status = 0;
+	u8 						*p2pie;
+	uint						p2pielen = 0, attr_contentlen = 0;
+	_irqL					irqL;
+	struct tx_invite_req_info*	pinvite_req_info = &pwdinfo->invitereq_info;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter					*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv			*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv		*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+#endif // CONFIG_WFD
+	
+	//	Commented by Albert 20120328
+	//	The input data is 0 or 1
+	//	0: disable persistent group functionality
+	//	1: enable persistent group founctionality
+	
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+		if ( extra[ 0 ] == '0' )	//	Disable the persistent group function.
+		{
+			pwdinfo->persistent_supported = _FALSE;
+		}
+		else if ( extra[ 0 ] == '1' )	//	Enable the persistent group function.
+		{
+			pwdinfo->persistent_supported = _TRUE;
+		}
+		else
+		{
+			pwdinfo->persistent_supported = _FALSE;
+		}
+	}
+	printk( "[%s] persistent_supported = %d\n", __FUNCTION__, pwdinfo->persistent_supported );
+	
+exit:
+	
+	return ret;
+		
+}
+
+static int hexstr2bin(const char *hex, u8 *buf, size_t len)
+{
+	size_t i;
+	int a;
+	const char *ipos = hex;
+	u8 *opos = buf;
+
+	for (i = 0; i < len; i++) {
+		a = hex2byte_i(ipos);
+		if (a < 0)
+			return -1;
+		*opos++ = a;
+		ipos += 2;
+	}
+	return 0;
+}
+
+static int uuid_str2bin(const char *str, u8 *bin)
+{
+	const char *pos;
+	u8 *opos;
+
+	pos = str;
+	opos = bin;
+
+	if (hexstr2bin(pos, opos, 4))
+		return -1;
+	pos += 8;
+	opos += 4;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 2))
+		return -1;
+	pos += 4;
+	opos += 2;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 2))
+		return -1;
+	pos += 4;
+	opos += 2;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 2))
+		return -1;
+	pos += 4;
+	opos += 2;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 6))
+		return -1;
+
+	return 0;
+}
+
+static int rtw_p2p_set_wps_uuid(struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter				*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info			*pwdinfo = &(padapter->wdinfo);
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, extra);
+
+	if ((36 == strlen(extra)) && (uuid_str2bin(extra, pwdinfo->uuid) == 0)) 
+	{
+		pwdinfo->external_uuid = 1;
+	} else {
+		pwdinfo->external_uuid = 0;
+		ret = -EINVAL;
+	}
+
+	return ret;
+
+}
+#ifdef CONFIG_WFD
+static int rtw_p2p_set_pc(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point 		*pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8					peerMAC[ ETH_ALEN ] = { 0x00 };
+	int 					jj,kk;
+	u8   					peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	_list					*plist, *phead;
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	u8					attr_content[50] = { 0x00 }, _status = 0;
+	u8 *p2pie;
+	uint					p2pielen = 0, attr_contentlen = 0;
+	_irqL				irqL;
+	uint					uintPeerChannel = 0;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE	
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+	
+	//	Commented by Albert 20120512
+	//	1. Input information is the MAC address which wants to know the Preferred Connection bit (PC bit)
+	//	Format: 00:E0:4C:00:00:05
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		peerMAC[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//	Commented by Albert 2011/05/18
+		//	Match the device address located in the P2P IE
+		//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+		if ( (p2pie=rtw_get_p2p_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)) )
+		{
+			//	The P2P Device ID attribute is included in the Beacon frame.
+			//	The P2P Device Info attribute is included in the probe response frame.
+			printk( "[%s] Got P2P IE\n", __FUNCTION__ );
+			if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device ID attribute of Beacon first
+				printk( "[%s] P2P_ATTR_DEVICE_ID \n", __FUNCTION__ );
+				if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+			else if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device Info attribute of probe response
+				printk( "[%s] P2P_ATTR_DEVICE_INFO \n", __FUNCTION__ );
+				if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}					
+			}
+
+		}
+
+		plist = get_next(plist);
+	
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	printk( "[%s] channel = %d\n", __FUNCTION__, uintPeerChannel );
+
+	if ( uintPeerChannel )
+	{
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+		
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			DBG_871X( "[%s] Found WFD IE!\n", __FUNCTION__ );
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen ) )
+			{
+				u16	wfd_devinfo_field = 0;
+				
+				//	Commented by Albert 20120319
+				//	The first two bytes are the WFD device information field of WFD device information subelement.
+				//	In big endian format.
+				wfd_devinfo_field = RTW_GET_BE16(wfd_devinfo);
+				if ( wfd_devinfo_field & WFD_DEVINFO_PC_TDLS )
+				{
+					pwfd_info->wfd_pc = _TRUE;
+				}
+				else
+				{
+					pwfd_info->wfd_pc = _FALSE;
+				}
+			}
+		}
+	}	
+	else
+	{
+		DBG_871X( "[%s] NOT Found in the Scanning Queue!\n", __FUNCTION__ );
+	}
+
+exit:
+	
+	return ret;
+		
+}
+
+static int rtw_p2p_set_wfd_device_type(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	struct wifi_display_info		*pwfd_info = pwdinfo->wfd_info;
+
+	//	Commented by Albert 20120328
+	//	The input data is 0 or 1
+	//	0: specify to Miracast source device
+	//	1 or others: specify to Miracast sink device (display device)
+	
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if ( extra[ 0 ] == '0' )	//	Set to Miracast source device.
+	{
+		pwfd_info->wfd_device_type = WFD_DEVINFO_SOURCE;
+	}
+	else					//	Set to Miracast sink device.
+	{
+		pwfd_info->wfd_device_type = WFD_DEVINFO_PSINK;
+	}
+	
+exit:
+
+	return ret;
+		
+}
+
+static int rtw_p2p_set_scan_result_type(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	struct wifi_display_info		*pwfd_info = pwdinfo->wfd_info;
+	
+	//	Commented by Albert 20120328
+	//	The input data is 0 , 1 , 2
+	//	0: when the P2P is enabled, the scan result will return all the found P2P device.
+	//	1: when the P2P is enabled, the scan result will return all the found P2P device and AP.
+	//	2: when the P2P is enabled, the scan result will show up the found Miracast devices base on...
+	//	It will show up all the Miracast source device if this device is sink.
+	//	It will show up all the Miracast sink device if this device is source.
+	
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if ( extra[ 0 ] == '0' )
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_P2P_ONLY;
+	}
+	else if ( extra[ 0 ] == '1' )
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_ALL;
+	}
+	else if ( extra[ 0 ] == '2' )
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_WFD_TYPE;
+	}
+	else
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_P2P_ONLY;
+	}
+	
+exit:
+	
+	return ret;
+		
+}
+
+static int rtw_p2p_set_wfd_enable(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+//	Commented by Kurt 20121206
+//	This function is used to set wfd enabled
+
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	if(*extra == '0' )
+		pwdinfo->wfd_info->wfd_enable = _FALSE;
+	else if(*extra == '1')
+		pwdinfo->wfd_info->wfd_enable = _TRUE;
+
+	DBG_871X( "[%s] wfd_enable = %d\n", __FUNCTION__, pwdinfo->wfd_info->wfd_enable );
+	
+	return ret;
+		
+}
+
+static int rtw_p2p_set_driver_iface(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+//	Commented by Kurt 20121206
+//	This function is used to set driver iface is WEXT or CFG80211
+	int ret = 0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	if(*extra == '1' )
+	{
+		pwdinfo->driver_interface = DRIVER_WEXT;
+		DBG_871X( "[%s] driver_interface = WEXT\n", __FUNCTION__);
+	}
+	else if(*extra == '2')
+	{
+		pwdinfo->driver_interface = DRIVER_CFG80211;
+		DBG_871X( "[%s] driver_interface = CFG80211\n", __FUNCTION__);
+	}
+	
+	return ret;
+		
+}
+
+//	To set the WFD session available to enable or disable
+static int rtw_p2p_set_sa(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	struct wifi_display_info		*pwfd_info = pwdinfo->wfd_info;
+	
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if( 0 )
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+		if ( extra[ 0 ] == '0' )	//	Disable the session available.
+		{
+			pwdinfo->session_available = _FALSE;
+		}
+		else if ( extra[ 0 ] == '1' )	//	Enable the session available.
+		{
+			pwdinfo->session_available = _TRUE;
+		}
+		else
+		{
+			pwdinfo->session_available = _FALSE;
+		}
+	}
+	printk( "[%s] session available = %d\n", __FUNCTION__, pwdinfo->session_available );
+	
+exit:
+	
+	return ret;
+		
+}
+#endif //CONFIG_WFD
+
+static int rtw_p2p_prov_disc(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{	
+	int ret = 0;	
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8					peerMAC[ ETH_ALEN ] = { 0x00 };
+	int 					jj,kk;
+	u8   					peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	_list					*plist, *phead;
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	uint					uintPeerChannel = 0;
+	u8					attr_content[100] = { 0x00 }, _status = 0;
+	u8 *p2pie;
+	uint					p2pielen = 0, attr_contentlen = 0;
+	_irqL				irqL;
+	u8 					ie_offset;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE	
+	
+#ifdef CONFIG_WFD
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+#endif // CONFIG_WFD
+	
+	//	Commented by Albert 20110301
+	//	The input data contains two informations.
+	//	1. First information is the MAC address which wants to issue the provisioning discovery request frame.
+	//	2. Second information is the WPS configuration method which wants to discovery
+	//	Format: 00:E0:4C:00:00:05_display
+	//	Format: 00:E0:4C:00:00:05_keypad
+	//	Format: 00:E0:4C:00:00:05_pbc
+	//	Format: 00:E0:4C:00:00:05_label
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+#ifdef CONFIG_INTEL_WIDI
+		if(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE){
+			DBG_871X( "[%s] WiFi is under survey!\n", __FUNCTION__ );
+			return ret;
+		}
+#endif //CONFIG_INTEL_WIDI
+
+		//	Reset the content of struct tx_provdisc_req_info excluded the wps_config_method_request.
+		_rtw_memset( pwdinfo->tx_prov_disc_info.peerDevAddr, 0x00, ETH_ALEN );
+		_rtw_memset( pwdinfo->tx_prov_disc_info.peerIFAddr, 0x00, ETH_ALEN );
+		_rtw_memset( &pwdinfo->tx_prov_disc_info.ssid, 0x00, sizeof( NDIS_802_11_SSID ) );		
+		pwdinfo->tx_prov_disc_info.peer_channel_num[ 0 ] = 0;
+		pwdinfo->tx_prov_disc_info.peer_channel_num[ 1 ] = 0;
+		pwdinfo->tx_prov_disc_info.benable = _FALSE;
+	}
+	
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		peerMAC[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	if ( _rtw_memcmp( &extra[ 18 ], "display", 7 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_DISPLYA;
+	}
+	else if ( _rtw_memcmp( &extra[ 18 ], "keypad", 7 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_KEYPAD;
+	}
+	else if ( _rtw_memcmp( &extra[ 18 ], "pbc", 3 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_PUSH_BUTTON;
+	}
+	else if ( _rtw_memcmp( &extra[ 18 ], "label", 5 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_LABEL;
+	}
+	else
+	{
+		DBG_871X( "[%s] Unknown WPS config methodn", __FUNCTION__ );
+		return( ret );
+	}
+
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+       
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		if( uintPeerChannel != 0 )
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//	Commented by Albert 2011/05/18
+		//	Match the device address located in the P2P IE
+		//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+		if (pnetwork->network.Reserved[0] == 2) { // Probe Request
+			ie_offset = 0;
+		} else { // Beacon or Probe Respones
+			ie_offset = 12;
+		}
+		if ( (p2pie=rtw_get_p2p_ie( &pnetwork->network.IEs[ie_offset], pnetwork->network.IELength - ie_offset, NULL, &p2pielen)) )
+		{
+			while ( p2pie )
+			{
+				//	The P2P Device ID attribute is included in the Beacon frame.
+				//	The P2P Device Info attribute is included in the probe response frame.
+
+				if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen) )
+				{
+					//	Handle the P2P Device ID attribute of Beacon first
+					if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+					{
+						uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+						break;
+					}
+				}
+				else if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen) )
+				{
+					//	Handle the P2P Device Info attribute of probe response
+					if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+					{
+						uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+						break;
+					}					
+				}
+
+				//Get the next P2P IE
+				p2pie = rtw_get_p2p_ie(p2pie+p2pielen, pnetwork->network.IELength - ie_offset -(p2pie -&pnetwork->network.IEs[ie_offset] + p2pielen), NULL, &p2pielen);
+			}
+		}
+
+#ifdef CONFIG_INTEL_WIDI
+			// Some Intel WiDi source may not provide P2P IE, 
+			// so we could only compare mac addr by 802.11 Source Address
+			if( pmlmepriv->widi_state == INTEL_WIDI_STATE_WFD_CONNECTION 
+				&& uintPeerChannel == 0 )
+			{
+				if ( _rtw_memcmp( pnetwork->network.MacAddress, peerMAC, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+#endif //CONFIG_INTEL_WIDI
+
+		plist = get_next(plist);
+	
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if ( uintPeerChannel )
+	{
+#ifdef CONFIG_WFD
+	{
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+		
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			DBG_871X( "[%s] Found WFD IE!\n", __FUNCTION__ );
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen ) )
+			{
+				u16	wfd_devinfo_field = 0;
+				
+				//	Commented by Albert 20120319
+				//	The first two bytes are the WFD device information field of WFD device information subelement.
+				//	In big endian format.
+				wfd_devinfo_field = RTW_GET_BE16(wfd_devinfo);
+				if ( wfd_devinfo_field & WFD_DEVINFO_SESSION_AVAIL )
+				{
+					pwfd_info->peer_session_avail = _TRUE;
+				}
+				else
+				{
+					pwfd_info->peer_session_avail = _FALSE;
+				}
+			}
+		}
+		
+		if ( _FALSE == pwfd_info->peer_session_avail )
+		{
+			DBG_871X( "[%s] WFD Session not avaiable!\n", __FUNCTION__ );
+			goto exit;
+		}
+	}	
+#endif // CONFIG_WFD
+
+		DBG_871X( "[%s] peer channel: %d!\n", __FUNCTION__, uintPeerChannel );
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+		}
+#endif // CONFIG_CONCURRENT_MODE
+		_rtw_memcpy( pwdinfo->tx_prov_disc_info.peerIFAddr, pnetwork->network.MacAddress, ETH_ALEN );
+		_rtw_memcpy( pwdinfo->tx_prov_disc_info.peerDevAddr, peerMAC, ETH_ALEN );
+		pwdinfo->tx_prov_disc_info.peer_channel_num[0] = ( u16 ) uintPeerChannel;
+		pwdinfo->tx_prov_disc_info.benable = _TRUE;
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ);
+
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT))
+		{
+			_rtw_memcpy( &pwdinfo->tx_prov_disc_info.ssid, &pnetwork->network.Ssid, sizeof( NDIS_802_11_SSID ) );
+		}
+		else if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) || rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+		{
+			_rtw_memcpy( pwdinfo->tx_prov_disc_info.ssid.Ssid, pwdinfo->p2p_wildcard_ssid, P2P_WILDCARD_SSID_LEN );
+			pwdinfo->tx_prov_disc_info.ssid.SsidLength= P2P_WILDCARD_SSID_LEN;
+		}
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			//	Have to enter the power saving with the AP
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			
+			issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+		}
+		else
+		{
+			set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+#else
+		set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+#endif
+
+		_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_CONCURRENT_PROVISION_TIMEOUT );
+		}
+		else
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+		}
+#else
+		_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+#endif // CONFIG_CONCURRENT_MODE		
+
+		
+	}
+	else
+	{
+		DBG_871X( "[%s] NOT Found in the Scanning Queue!\n", __FUNCTION__ );
+#ifdef CONFIG_INTEL_WIDI
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+		rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+		rtw_free_network_queue(padapter, _TRUE);		
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);				
+		rtw_sitesurvey_cmd(padapter, NULL, 0, NULL, 0);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+#endif //CONFIG_INTEL_WIDI
+	}
+exit:
+	
+	return ret;
+		
+}
+
+//	Added by Albert 20110328
+//	This function is used to inform the driver the user had specified the pin code value or pbc
+//	to application.
+
+static int rtw_p2p_got_wpsinfo(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+	//	Added by Albert 20110328
+	//	if the input data is P2P_NO_WPSINFO -> reset the wpsinfo
+	//	if the input data is P2P_GOT_WPSINFO_PEER_DISPLAY_PIN -> the utility just input the PIN code got from the peer P2P device.
+	//	if the input data is P2P_GOT_WPSINFO_SELF_DISPLAY_PIN -> the utility just got the PIN code from itself.
+	//	if the input data is P2P_GOT_WPSINFO_PBC -> the utility just determine to use the PBC
+	
+	if ( *extra == '0' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_NO_WPSINFO;
+	}
+	else if ( *extra == '1' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_GOT_WPSINFO_PEER_DISPLAY_PIN;
+	}
+	else if ( *extra == '2' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_GOT_WPSINFO_SELF_DISPLAY_PIN;
+	}
+	else if ( *extra == '3' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_GOT_WPSINFO_PBC;
+	}
+	else
+	{
+		pwdinfo->ui_got_wps_info = P2P_NO_WPSINFO;
+	}
+	
+	return ret;
+		
+}
+
+#endif //CONFIG_P2P
+
+static int rtw_p2p_set(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;
+#ifdef CONFIG_P2P
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	DBG_871X( "[%s] extra = %s\n", __FUNCTION__, extra );
+
+	if ( _rtw_memcmp( extra, "enable=", 7 ) )
+	{
+		rtw_wext_p2p_enable( dev, info, wrqu, &extra[7] );
+	}
+	else if ( _rtw_memcmp( extra, "setDN=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_p2p_setDN( dev, info, wrqu, &extra[6] );
+	}
+	else if ( _rtw_memcmp( extra, "profilefound=", 13 ) )
+	{
+		wrqu->data.length -= 13;
+		rtw_p2p_profilefound( dev, info, wrqu, &extra[13] );
+	}
+	else if ( _rtw_memcmp( extra, "prov_disc=", 10 ) )
+	{
+		wrqu->data.length -= 10;
+		rtw_p2p_prov_disc( dev, info, wrqu, &extra[10] );
+	}
+	else if ( _rtw_memcmp( extra, "nego=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_p2p_connect( dev, info, wrqu, &extra[5] );
+	}
+	else if ( _rtw_memcmp( extra, "intent=", 7 ) )
+	{
+		//	Commented by Albert 2011/03/23
+		//	The wrqu->data.length will include the null character
+		//	So, we will decrease 7 + 1
+		wrqu->data.length -= 8;
+		rtw_p2p_set_intent( dev, info, wrqu, &extra[7] );
+	}
+	else if ( _rtw_memcmp( extra, "ssid=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_p2p_set_go_nego_ssid( dev, info, wrqu, &extra[5] );
+	}
+	else if ( _rtw_memcmp( extra, "got_wpsinfo=", 12 ) )
+	{
+		wrqu->data.length -= 12;
+		rtw_p2p_got_wpsinfo( dev, info, wrqu, &extra[12] );
+	}
+	else if ( _rtw_memcmp( extra, "listen_ch=", 10 ) )
+	{
+		//	Commented by Albert 2011/05/24
+		//	The wrqu->data.length will include the null character
+		//	So, we will decrease (10 + 1)	
+		wrqu->data.length -= 11;
+		rtw_p2p_set_listen_ch( dev, info, wrqu, &extra[10] );
+	}
+	else if ( _rtw_memcmp( extra, "op_ch=", 6 ) )
+	{
+		//	Commented by Albert 2011/05/24
+		//	The wrqu->data.length will include the null character
+		//	So, we will decrease (6 + 1)	
+		wrqu->data.length -= 7;
+		rtw_p2p_set_op_ch( dev, info, wrqu, &extra[6] );
+	}
+	else if ( _rtw_memcmp( extra, "invite=", 7 ) )
+	{
+		wrqu->data.length -= 8;
+		rtw_p2p_invite_req( dev, info, wrqu, &extra[7] );
+	}
+	else if ( _rtw_memcmp( extra, "persistent=", 11 ) )
+	{
+		wrqu->data.length -= 11;
+		rtw_p2p_set_persistent( dev, info, wrqu, &extra[11] );
+	}
+	else if ( _rtw_memcmp ( extra, "uuid=", 5) )
+	{
+		wrqu->data.length -= 5;
+		ret = rtw_p2p_set_wps_uuid( dev, info, wrqu, &extra[5] );
+	}
+#ifdef CONFIG_WFD
+	else if ( _rtw_memcmp( extra, "sa=", 3 ) )
+	{
+		//	sa: WFD Session Available information
+		wrqu->data.length -= 3;
+		rtw_p2p_set_sa( dev, info, wrqu, &extra[3] );
+	}
+	else if ( _rtw_memcmp( extra, "pc=", 3 ) )
+	{
+		//	pc: WFD Preferred Connection
+		wrqu->data.length -= 3;
+		rtw_p2p_set_pc( dev, info, wrqu, &extra[3] );
+	}
+	else if ( _rtw_memcmp( extra, "wfd_type=", 9 ) )
+	{
+		//	Specify this device is Mircast source or sink
+		wrqu->data.length -= 9;
+		rtw_p2p_set_wfd_device_type( dev, info, wrqu, &extra[9] );
+	}
+	else if ( _rtw_memcmp( extra, "scan_type=", 10 ) )
+	{
+		wrqu->data.length -= 10;
+		rtw_p2p_set_scan_result_type( dev, info, wrqu, &extra[10] );
+	}
+	else if ( _rtw_memcmp( extra, "wfd_enable=", 11 ) )
+	{
+		wrqu->data.length -= 11;
+		rtw_p2p_set_wfd_enable( dev, info, wrqu, &extra[11] );
+	}
+	else if ( _rtw_memcmp( extra, "driver_iface=", 13 ) )
+	{
+		wrqu->data.length -= 13;
+		rtw_p2p_set_driver_iface( dev, info, wrqu, &extra[13] );
+	}
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	return ret;
+		
+}
+
+static int rtw_p2p_get(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+	
+#ifdef CONFIG_P2P
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	if ( padapter->bShowGetP2PState )
+	{
+		DBG_871X( "[%s] extra = %s\n", __FUNCTION__, (char*) wrqu->data.pointer );
+	}
+	
+	if ( _rtw_memcmp( wrqu->data.pointer, "status", 6 ) )
+	{
+		rtw_p2p_get_status( dev, info, wrqu, extra );
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "role", 4 ) )
+	{
+		rtw_p2p_get_role( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "peer_ifa", 8 ) )
+	{
+		rtw_p2p_get_peer_ifaddr( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "req_cm", 6 ) )
+	{
+		rtw_p2p_get_req_cm( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "peer_deva", 9 ) )
+	{
+		//	Get the P2P device address when receiving the provision discovery request frame.
+		rtw_p2p_get_peer_devaddr( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "group_id", 8 ) )
+	{
+		rtw_p2p_get_groupid( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "inv_peer_deva", 13 ) )
+	{
+		//	Get the P2P device address when receiving the P2P Invitation request frame.
+		rtw_p2p_get_peer_devaddr_by_invitation( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "op_ch", 5 ) )
+	{
+		rtw_p2p_get_op_ch( dev, info, wrqu, extra);
+	}
+#ifdef CONFIG_WFD
+	else if ( _rtw_memcmp( wrqu->data.pointer, "peer_port", 9 ) )
+	{
+		rtw_p2p_get_peer_wfd_port( dev, info, wrqu, extra );
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "wfd_sa", 6 ) )
+	{
+		rtw_p2p_get_peer_wfd_session_available( dev, info, wrqu, extra );
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "wfd_pc", 6 ) )
+	{
+		rtw_p2p_get_peer_wfd_preferred_connection( dev, info, wrqu, extra );
+	}
+#endif // CONFIG_WFD	
+	
+#endif //CONFIG_P2P
+
+	return ret;
+		
+}
+
+static int rtw_p2p_get2(struct net_device *dev,
+						struct iw_request_info *info,
+						union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+
+#ifdef CONFIG_P2P
+
+	int length = wrqu->data.length;
+	char *buffer = (u8 *)rtw_malloc(length);
+
+	if (buffer == NULL)
+	{
+		ret = -ENOMEM;
+		goto bad;
+	}
+
+	if (copy_from_user(buffer, wrqu->data.pointer, wrqu->data.length))
+	{
+		ret - EFAULT;
+		goto bad;
+	}
+
+	DBG_871X("[%s] buffer = %s\n", __FUNCTION__, buffer);
+
+	if (_rtw_memcmp(buffer, "wpsCM=", 6))
+	{
+		ret = rtw_p2p_get_wps_configmethod(dev, info, wrqu, extra, &buffer[6]);
+	} else if (_rtw_memcmp(buffer, "devN=", 5))
+	{
+		ret = rtw_p2p_get_device_name(dev, info, wrqu, extra, &buffer[5]);
+	} else if (_rtw_memcmp(buffer, "dev_type=", 9))
+	{
+		ret = rtw_p2p_get_device_type(dev, info, wrqu, extra, &buffer[9]);
+	} else if (_rtw_memcmp(buffer, "go_devadd=", 10))
+	{
+		ret = rtw_p2p_get_go_device_address(dev, info, wrqu, extra, &buffer[10]);
+	} else if (_rtw_memcmp(buffer, "InvProc=", 8))
+	{
+		ret = rtw_p2p_get_invitation_procedure(dev, info, wrqu, extra, &buffer[8]);
+	} else
+	{
+		snprintf(extra, sizeof("Command not found."), "Command not found.");
+		wrqu->data.length = strlen(extra);
+	}
+
+bad:
+	if (buffer)
+	{
+		rtw_mfree(buffer, length);
+	}
+
+#endif //CONFIG_P2P
+
+	return ret;
+
+}
+
+extern int rtw_change_ifname(_adapter *padapter, const char *ifname);
+static int rtw_rereg_nd_name(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;	
+	_adapter *padapter = rtw_netdev_priv(dev);
+	struct rereg_nd_name_data *rereg_priv = &padapter->rereg_nd_name_priv;
+	char new_ifname[IFNAMSIZ];
+
+	if(rereg_priv->old_ifname[0] == 0) {
+		char *reg_ifname;
+#ifdef CONFIG_CONCURRENT_MODE 
+		if (padapter->isprimary)
+			reg_ifname = padapter->registrypriv.ifname;
+		else
+#endif
+		reg_ifname = padapter->registrypriv.if2name;
+
+		strncpy(rereg_priv->old_ifname, reg_ifname, IFNAMSIZ);
+		rereg_priv->old_ifname[IFNAMSIZ-1] = 0;
+	}
+
+	//DBG_871X("%s wrqu->data.length:%d\n", __FUNCTION__, wrqu->data.length);
+	if(wrqu->data.length > IFNAMSIZ)
+		return -EFAULT;
+
+	if ( copy_from_user(new_ifname, wrqu->data.pointer, IFNAMSIZ) ) {
+		return -EFAULT;
+	}
+
+	if( 0 == strcmp(rereg_priv->old_ifname, new_ifname) ) {
+		return ret;
+	}
+
+	DBG_871X("%s new_ifname:%s\n", __FUNCTION__, new_ifname);
+	if( 0 != (ret = rtw_change_ifname(padapter, new_ifname)) ) {
+		goto exit;
+	}
+
+	if(_rtw_memcmp(rereg_priv->old_ifname, "disable%d", 9) == _TRUE) {
+		padapter->ledpriv.bRegUseLed= rereg_priv->old_bRegUseLed;
+		rtw_hal_sw_led_init(padapter);
+		rtw_ips_mode_req(&padapter->pwrctrlpriv, rereg_priv->old_ips_mode);
+	}
+
+	strncpy(rereg_priv->old_ifname, new_ifname, IFNAMSIZ);
+	rereg_priv->old_ifname[IFNAMSIZ-1] = 0;
+	
+	if(_rtw_memcmp(new_ifname, "disable%d", 9) == _TRUE) {
+
+		DBG_871X("%s disable\n", __FUNCTION__);
+		// free network queue for Android's timming issue
+		rtw_free_network_queue(padapter, _TRUE);
+		
+		// close led
+		rtw_led_control(padapter, LED_CTL_POWER_OFF);
+		rereg_priv->old_bRegUseLed = padapter->ledpriv.bRegUseLed;
+		padapter->ledpriv.bRegUseLed= _FALSE;
+		rtw_hal_sw_led_deinit(padapter);
+		
+		// the interface is being "disabled", we can do deeper IPS
+		rereg_priv->old_ips_mode = rtw_get_ips_mode_req(&padapter->pwrctrlpriv);
+		rtw_ips_mode_req(&padapter->pwrctrlpriv, IPS_NORMAL);
+	}
+exit:
+	return ret;
+
+}
+
+#if 0
+void mac_reg_dump(_adapter *padapter)
+{
+	int i,j=1;		
+	DBG_871X("\n======= MAC REG =======\n");
+	for(i=0x0;i<0x300;i+=4)
+	{	
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	DBG_871X("\n");	
+	}
+	for(i=0x400;i<0x800;i+=4)
+	{	
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	DBG_871X("\n");	
+	}									
+}
+void bb_reg_dump(_adapter *padapter)
+{
+	int i,j=1;		
+	DBG_871X("\n======= BB REG =======\n");
+	for(i=0x800;i<0x1000;i+=4)
+	{
+		if(j%4==1) DBG_871X("0x%02x",i);
+				
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	DBG_871X("\n");	
+	}		
+}
+void rf_reg_dump(_adapter *padapter)
+{	
+	int i,j=1,path;
+	u32 value;			
+	DBG_871X("\n======= RF REG =======\n");
+	for(path=0;path<2;path++)
+	{
+		DBG_871X("\nRF_Path(%x)\n",path);
+		for(i=0;i<0x100;i++)
+		{								
+			value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+			if(j%4==1)	DBG_871X("0x%02x ",i);
+			DBG_871X(" 0x%08x ",value);
+			if((j++)%4==0)	DBG_871X("\n");	
+		}	
+	}
+}
+
+#endif
+
+void mac_reg_dump(_adapter *padapter)
+{
+	int i,j=1;		
+	DBG_871X("\n======= MAC REG =======\n");
+	for(i=0x0;i<0x300;i+=4)
+	{	
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	DBG_871X("\n");	
+	}
+	for(i=0x400;i<0x800;i+=4)
+	{	
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	DBG_871X("\n");	
+	}									
+}
+void bb_reg_dump(_adapter *padapter)
+{
+	int i,j=1;		
+	DBG_871X("\n======= BB REG =======\n");
+	for(i=0x800;i<0x1000;i+=4)
+	{
+		if(j%4==1) DBG_871X("0x%02x",i);
+				
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+		if((j++)%4 == 0)	DBG_871X("\n");	
+	}		
+}
+void rf_reg_dump(_adapter *padapter)
+{	
+	int i,j=1,path;
+	u32 value;	
+	u8 rf_type,path_nums = 0;
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		
+	DBG_871X("\n======= RF REG =======\n");
+	if((RF_1T2R == rf_type) ||(RF_1T1R ==rf_type ))	
+		path_nums = 1;
+	else	
+		path_nums = 2;
+		
+	for(path=0;path<path_nums;path++)
+	{
+		DBG_871X("\nRF_Path(%x)\n",path);
+		for(i=0;i<0x100;i++)
+		{								
+			//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+			value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+			if(j%4==1)	DBG_871X("0x%02x ",i);
+			DBG_871X(" 0x%08x ",value);
+			if((j++)%4==0)	DBG_871X("\n");	
+		}	
+	}
+}
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+#endif
+#ifdef DBG_CONFIG_ERROR_DETECT
+#include <rtw_sreset.h>
+#endif
+static int rtw_dbg_port(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{	
+	_irqL irqL;
+	int ret = 0;
+	u8 major_cmd, minor_cmd;
+	u16 arg;
+	u32 extra_arg, *pdata, val32;
+	struct sta_info *psta;						
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct wlan_network *cur_network = &(pmlmepriv->cur_network);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	
+
+	pdata = (u32*)&wrqu->data;	
+
+	val32 = *pdata;
+	arg = (u16)(val32&0x0000ffff);
+	major_cmd = (u8)(val32>>24);
+	minor_cmd = (u8)((val32>>16)&0x00ff);
+
+	extra_arg = *(pdata+1);
+	
+	switch(major_cmd)
+	{
+		case 0x70://read_reg
+			switch(minor_cmd)
+			{
+				case 1:
+					DBG_871X("rtw_read8(0x%x)=0x%02x\n", arg, rtw_read8(padapter, arg));
+					break;
+				case 2:
+					DBG_871X("rtw_read16(0x%x)=0x%04x\n", arg, rtw_read16(padapter, arg));
+					break;
+				case 4:
+					DBG_871X("rtw_read32(0x%x)=0x%08x\n", arg, rtw_read32(padapter, arg));
+					break;
+			}			
+			break;
+		case 0x71://write_reg
+			switch(minor_cmd)
+			{
+				case 1:
+					rtw_write8(padapter, arg, extra_arg);
+					DBG_871X("rtw_write8(0x%x)=0x%02x\n", arg, rtw_read8(padapter, arg));
+					break;
+				case 2:
+					rtw_write16(padapter, arg, extra_arg);
+					DBG_871X("rtw_write16(0x%x)=0x%04x\n", arg, rtw_read16(padapter, arg));
+					break;
+				case 4:
+					rtw_write32(padapter, arg, extra_arg);
+					DBG_871X("rtw_write32(0x%x)=0x%08x\n", arg, rtw_read32(padapter, arg));
+					break;
+			}			
+			break;
+		case 0x72://read_bb
+			DBG_871X("read_bbreg(0x%x)=0x%x\n", arg, rtw_hal_read_bbreg(padapter, arg, 0xffffffff));
+			break;
+		case 0x73://write_bb
+			rtw_hal_write_bbreg(padapter, arg, 0xffffffff, extra_arg);
+			DBG_871X("write_bbreg(0x%x)=0x%x\n", arg, rtw_hal_read_bbreg(padapter, arg, 0xffffffff));
+			break;
+		case 0x74://read_rf
+			DBG_871X("read RF_reg path(0x%02x),offset(0x%x),value(0x%08x)\n",minor_cmd,arg,rtw_hal_read_rfreg(padapter, minor_cmd, arg, 0xffffffff));	
+			break;
+		case 0x75://write_rf
+			rtw_hal_write_rfreg(padapter, minor_cmd, arg, 0xffffffff, extra_arg);
+			DBG_871X("write RF_reg path(0x%02x),offset(0x%x),value(0x%08x)\n",minor_cmd,arg, rtw_hal_read_rfreg(padapter, minor_cmd, arg, 0xffffffff));
+			break;	
+
+		case 0x76:
+			switch(minor_cmd)
+			{
+				case 0x00: //normal mode, 
+					padapter->recvpriv.is_signal_dbg = 0;
+					break;
+				case 0x01: //dbg mode
+					padapter->recvpriv.is_signal_dbg = 1;
+					extra_arg = extra_arg>100?100:extra_arg;
+					extra_arg = extra_arg<0?0:extra_arg;
+					padapter->recvpriv.signal_strength_dbg=extra_arg;
+					break;
+			}
+			break;
+		case 0x78: //IOL test
+			switch(minor_cmd)
+			{
+				#ifdef CONFIG_IOL
+				case 0x04: //LLT table initialization test
+				{
+					u8 page_boundary = 0xf9;
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;	
+							break;
+						}
+						
+						rtw_IOL_append_LLT_cmd(xmit_frame, page_boundary);
+
+
+						if(_SUCCESS != rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 500) )
+							ret = -EPERM;
+					}
+				}
+					break;
+				case 0x05: //blink LED test
+				{
+					u16 reg = 0x4c;
+					u32 blink_num = 50;
+					u32 blink_delay_ms = 200;
+					int i;
+					
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;	
+							break;
+						}
+
+						for(i=0;i<blink_num;i++){
+							rtw_IOL_append_WB_cmd(xmit_frame, reg, 0x00);
+							rtw_IOL_append_DELAY_MS_cmd(xmit_frame, blink_delay_ms);
+							rtw_IOL_append_WB_cmd(xmit_frame, reg, 0x08);
+							rtw_IOL_append_DELAY_MS_cmd(xmit_frame, blink_delay_ms);
+						}
+						if(_SUCCESS != rtw_IOL_exec_cmds_sync(padapter, xmit_frame, (blink_delay_ms*blink_num*2)+200) )
+							ret = -EPERM;
+					}
+				}
+					break;
+					
+				case 0x06: //continuous wirte byte test
+				{
+					u16 reg = arg;
+					u16 start_value = 0;
+					u32 write_num = extra_arg;
+					int i;
+					u8 final;
+					
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;	
+							break;
+						}
+
+						for(i=0;i<write_num;i++){
+							rtw_IOL_append_WB_cmd(xmit_frame, reg, i+start_value);
+						}
+						if(_SUCCESS != rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 5000))
+							ret = -EPERM;
+					}
+
+					if(start_value+write_num-1 == (final=rtw_read8(padapter, reg)) ) {
+						DBG_871X("continuous IOL_CMD_WB_REG to 0x%x %u times Success, start:%u, final:%u\n", reg, write_num, start_value, final);
+					} else {
+						DBG_871X("continuous IOL_CMD_WB_REG to 0x%x %u times Fail, start:%u, final:%u\n", reg, write_num, start_value, final);
+					}
+				}
+					break;
+					
+				case 0x07: //continuous wirte word test
+				{
+					u16 reg = arg;
+					u16 start_value = 200;
+					u32 write_num = extra_arg;
+				
+					int i;
+					u16 final;
+
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;	
+							break;
+						}
+
+						for(i=0;i<write_num;i++){
+							rtw_IOL_append_WW_cmd(xmit_frame, reg, i+start_value);
+						}
+						if(_SUCCESS !=rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 5000))
+							ret = -EPERM;
+					}
+
+					if(start_value+write_num-1 == (final=rtw_read16(padapter, reg)) ) {
+						DBG_871X("continuous IOL_CMD_WW_REG to 0x%x %u times Success, start:%u, final:%u\n", reg, write_num, start_value, final);
+					} else {
+						DBG_871X("continuous IOL_CMD_WW_REG to 0x%x %u times Fail, start:%u, final:%u\n", reg, write_num, start_value, final);
+					}
+				}
+					break;
+					
+				case 0x08: //continuous wirte dword test
+				{
+					u16 reg = arg;
+					u32 start_value = 0x110000c7;
+					u32 write_num = extra_arg;
+				
+					int i;
+					u32 final;
+
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;	
+							break;
+						}
+
+						for(i=0;i<write_num;i++){
+							rtw_IOL_append_WD_cmd(xmit_frame, reg, i+start_value);
+						}
+						if(_SUCCESS !=rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 5000))
+							ret = -EPERM;
+							
+					}
+
+					if(start_value+write_num-1 == (final=rtw_read32(padapter, reg)) ) {
+						DBG_871X("continuous IOL_CMD_WD_REG to 0x%x %u times Success, start:%u, final:%u\n", reg, write_num, start_value, final);
+					} else {
+						DBG_871X("continuous IOL_CMD_WD_REG to 0x%x %u times Fail, start:%u, final:%u\n", reg, write_num, start_value, final);
+					}
+				}
+					break;
+				#endif //CONFIG_IOL
+			}
+			break;
+		case 0x7a:
+			receive_disconnect(padapter, pmlmeinfo->network.MacAddress
+				, WLAN_REASON_EXPIRATION_CHK);
+			break;
+
+		case 0x7F:
+			switch(minor_cmd)
+			{
+				case 0x0:
+					DBG_871X("fwstate=0x%x\n", get_fwstate(pmlmepriv));
+					break;
+				case 0x01:
+					DBG_871X("auth_alg=0x%x, enc_alg=0x%x, auth_type=0x%x, enc_type=0x%x\n", 
+						psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm,
+						psecuritypriv->ndisauthtype, psecuritypriv->ndisencryptstatus);
+					break;
+				case 0x02:
+					DBG_871X("pmlmeinfo->state=0x%x\n", pmlmeinfo->state);
+					break;
+				case 0x03:
+					DBG_871X("qos_option=%d\n", pmlmepriv->qospriv.qos_option);
+					DBG_871X("ht_option=%d\n", pmlmepriv->htpriv.ht_option);
+					break;
+				case 0x04:
+					DBG_871X("cur_ch=%d\n", pmlmeext->cur_channel);
+					DBG_871X("cur_bw=%d\n", pmlmeext->cur_bwmode);
+					DBG_871X("cur_ch_off=%d\n", pmlmeext->cur_ch_offset);
+					break;
+				case 0x05:
+					psta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
+					if(psta)
+					{
+						int i;
+						struct recv_reorder_ctrl *preorder_ctrl;
+					
+						DBG_871X("SSID=%s\n", cur_network->network.Ssid.Ssid);
+						DBG_871X("sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+						DBG_871X("cur_channel=%d, cur_bwmode=%d, cur_ch_offset=%d\n", pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+						DBG_871X("rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+						DBG_871X("qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);	
+						DBG_871X("state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);	
+						DBG_871X("bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);						
+						DBG_871X("ampdu_enable = %d\n", psta->htpriv.ampdu_enable);	
+						DBG_871X("agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+						
+						for(i=0;i<16;i++)
+						{							
+							preorder_ctrl = &psta->recvreorder_ctrl[i];
+							if(preorder_ctrl->enable)
+							{
+								DBG_871X("tid=%d, indicate_seq=%d\n", i, preorder_ctrl->indicate_seq);
+							}
+						}	
+							
+					}
+					else
+					{							
+						DBG_871X("can't get sta's macaddr, cur_network's macaddr:" MAC_FMT "\n", MAC_ARG(cur_network->network.MacAddress));
+					}					
+					break;
+				case 0x06:
+					{
+						u8	DMFlag;
+						rtw_hal_get_hwreg(padapter, HW_VAR_DM_FLAG, (u8 *)(&DMFlag));
+						DBG_871X("(B)DMFlag=0x%x, arg=0x%x\n", DMFlag, arg);
+						DMFlag = (u8)(0x0f&arg);
+						DBG_871X("(A)DMFlag=0x%x\n", DMFlag);
+						rtw_hal_set_hwreg(padapter, HW_VAR_DM_FLAG, (u8 *)(&DMFlag));
+					}
+					break;
+				case 0x07:
+					DBG_871X("bSurpriseRemoved=%d, bDriverStopped=%d\n", 
+						padapter->bSurpriseRemoved, padapter->bDriverStopped);
+					break;
+                                case 0x08:
+					{
+						struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+						struct recv_priv  *precvpriv = &padapter->recvpriv;
+						
+						DBG_871X("free_xmitbuf_cnt=%d, free_xmitframe_cnt=%d"
+							", free_xmit_extbuf_cnt=%d, free_xframe_ext_cnt=%d"
+							", free_recvframe_cnt=%d\n",
+							pxmitpriv->free_xmitbuf_cnt, pxmitpriv->free_xmitframe_cnt,
+							pxmitpriv->free_xmit_extbuf_cnt, pxmitpriv->free_xframe_ext_cnt,
+							precvpriv->free_recvframe_cnt);
+						#ifdef CONFIG_USB_HCI
+						DBG_871X("rx_urb_pending_cn=%d\n", precvpriv->rx_pending_cnt);
+						#endif
+					}
+					break;	
+				case 0x09:
+					{
+						int i, j;
+						_list	*plist, *phead;
+						struct recv_reorder_ctrl *preorder_ctrl;
+						
+#ifdef CONFIG_AP_MODE
+						DBG_871X("sta_dz_bitmap=0x%x, tim_bitmap=0x%x\n", pstapriv->sta_dz_bitmap, pstapriv->tim_bitmap);
+#endif						
+						_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+						for(i=0; i< NUM_STA; i++)
+						{
+							phead = &(pstapriv->sta_hash[i]);
+							plist = get_next(phead);
+		
+							while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+							{
+								psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+								plist = get_next(plist);
+
+								if(extra_arg == psta->aid)
+								{
+									DBG_871X("sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+									DBG_871X("rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+									DBG_871X("qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);	
+									DBG_871X("state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);	
+									DBG_871X("bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);						
+									DBG_871X("ampdu_enable = %d\n", psta->htpriv.ampdu_enable);									
+									DBG_871X("agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+#ifdef CONFIG_AP_MODE
+									DBG_871X("capability=0x%x\n", psta->capability);
+									DBG_871X("flags=0x%x\n", psta->flags);
+									DBG_871X("wpa_psk=0x%x\n", psta->wpa_psk);
+									DBG_871X("wpa2_group_cipher=0x%x\n", psta->wpa2_group_cipher);
+									DBG_871X("wpa2_pairwise_cipher=0x%x\n", psta->wpa2_pairwise_cipher);
+									DBG_871X("qos_info=0x%x\n", psta->qos_info);
+#endif
+									DBG_871X("dot118021XPrivacy=0x%x\n", psta->dot118021XPrivacy);
+									
+									
+						
+									for(j=0;j<16;j++)
+									{							
+										preorder_ctrl = &psta->recvreorder_ctrl[j];
+										if(preorder_ctrl->enable)
+										{
+											DBG_871X("tid=%d, indicate_seq=%d\n", j, preorder_ctrl->indicate_seq);
+										}
+									}		
+									
+								}							
+			
+							}
+						}
+	
+						_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+					}
+					break;
+
+                                case 0x0c://dump rx packet
+					{
+						DBG_871X("dump rx packet (%d)\n",extra_arg);						
+						//pHalData->bDumpRxPkt =extra_arg;						
+						rtw_hal_set_def_var(padapter, HAL_DEF_DBG_DUMP_RXPKT, &(extra_arg));
+					}
+					break;
+#if 0				
+					case 0x0d://dump cam
+					{
+						//u8 entry = (u8) extra_arg;
+						u8 entry=0;
+						//dump cam
+						for(entry=0;entry<32;entry++)
+							read_cam(padapter,entry);
+					}				
+					break;
+#endif
+		#ifdef DBG_CONFIG_ERROR_DETECT
+				case 0x0f:
+						{
+							if(extra_arg == 0){	
+								DBG_871X("###### silent reset test.......#####\n");
+								rtw_hal_sreset_reset(padapter);
+							} else {
+								sreset_set_trigger_point(padapter, extra_arg);
+							}
+							
+						}
+				break;
+				case 0x15:
+					{
+						struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;	
+						DBG_871X("==>silent resete cnts:%d\n",pwrpriv->ips_enter_cnts);
+					}
+					break;	
+					
+		#endif	
+
+				case 0x10:// driver version display
+					DBG_871X("rtw driver version=%s\n", DRIVERVERSION);
+					break;
+				case 0x11:
+					{
+						DBG_871X("turn %s Rx RSSI display function\n",(extra_arg==1)?"on":"off");
+						padapter->bRxRSSIDisplay = extra_arg ;						
+					}
+					break;
+				case 0x12: //set rx_stbc
+				{
+					struct registry_priv	*pregpriv = &padapter->registrypriv;
+					// 0: disable, bit(0):enable 2.4g, bit(1):enable 5g, 0x3: enable both 2.4g and 5g
+					//default is set to enable 2.4GHZ for IOT issue with bufflao's AP at 5GHZ
+					if( pregpriv && (extra_arg == 0 || extra_arg == 1|| extra_arg == 2 || extra_arg == 3))
+					{
+						pregpriv->rx_stbc= extra_arg;
+						DBG_871X("set rx_stbc=%d\n",pregpriv->rx_stbc);
+					}
+					else
+						DBG_871X("get rx_stbc=%d\n",pregpriv->rx_stbc);
+					
+				}
+				break;
+				case 0x13: //set ampdu_enable
+				{
+					struct registry_priv	*pregpriv = &padapter->registrypriv;
+					// 0: disable, 0x1:enable (but wifi_spec should be 0), 0x2: force enable (don't care wifi_spec)
+					if( pregpriv && extra_arg >= 0 && extra_arg < 3 )
+					{
+						pregpriv->ampdu_enable= extra_arg;
+						DBG_871X("set ampdu_enable=%d\n",pregpriv->ampdu_enable);
+					}
+					else
+						DBG_871X("get ampdu_enable=%d\n",pregpriv->ampdu_enable);
+					
+				}
+				break;
+				case 0x14: //get wifi_spec
+				{
+					struct registry_priv	*pregpriv = &padapter->registrypriv;
+					DBG_871X("get wifi_spec=%d\n",pregpriv->wifi_spec);
+					
+				}
+				break;
+				case 0x22:
+					{
+						DBG_871X("turn %s the ForceWriteInitGain Variable\n",(extra_arg==1)?"on":"off");
+						padapter->bForceWriteInitGain = extra_arg;
+						break;
+					}
+				case 0x23:
+					{
+						DBG_871X("turn %s the bNotifyChannelChange Variable\n",(extra_arg==1)?"on":"off");
+						padapter->bNotifyChannelChange = extra_arg;
+						break;
+					}
+				case 0x24:
+					{
+#ifdef CONFIG_P2P
+						DBG_871X("turn %s the bShowGetP2PState Variable\n",(extra_arg==1)?"on":"off");
+						padapter->bShowGetP2PState = extra_arg;
+#endif // CONFIG_P2P
+						break;						
+					}
+#if 1
+				case 0xdd://registers dump , 0 for mac reg,1 for bb reg, 2 for rf reg
+					{						
+						if(extra_arg==0){
+							mac_reg_dump(padapter);
+						}
+						else if(extra_arg==1){
+							bb_reg_dump(padapter);
+						}
+						else if(extra_arg==2){
+							rf_reg_dump(padapter);
+						}
+																				
+					}
+					break;		
+#endif
+				case 0xee://turn on/off dynamic funcs
+					{
+						u8 dm_flag;
+
+						if(0xf==extra_arg){
+							rtw_hal_get_def_var(padapter, HAL_DEF_DBG_DM_FUNC,&dm_flag);							
+							DBG_871X(" === DMFlag(0x%02x) === \n",dm_flag);
+							DBG_871X("extra_arg = 0  - disable all dynamic func \n");
+							DBG_871X("extra_arg = 1  - disable DIG- BIT(0)\n");
+							DBG_871X("extra_arg = 2  - disable High power - BIT(1)\n");
+							DBG_871X("extra_arg = 3  - disable tx power tracking - BIT(2)\n");
+							DBG_871X("extra_arg = 4  - disable BT coexistence - BIT(3)\n");
+							DBG_871X("extra_arg = 5  - disable antenna diversity - BIT(4)\n");
+							DBG_871X("extra_arg = 6  - enable all dynamic func \n");							
+						}
+						else{
+							/*	extra_arg = 0  - disable all dynamic func
+								extra_arg = 1  - disable DIG
+								extra_arg = 2  - disable tx power tracking
+								extra_arg = 3  - turn on all dynamic func
+							*/			
+							rtw_hal_set_def_var(padapter, HAL_DEF_DBG_DM_FUNC, &(extra_arg));
+							rtw_hal_get_def_var(padapter, HAL_DEF_DBG_DM_FUNC,&dm_flag);							
+							DBG_871X(" === DMFlag(0x%02x) === \n",dm_flag);
+						}
+					}
+					break;
+
+				case 0xfd:
+					rtw_write8(padapter, 0xc50, arg);
+					DBG_871X("wr(0xc50)=0x%x\n", rtw_read8(padapter, 0xc50));
+					rtw_write8(padapter, 0xc58, arg);
+					DBG_871X("wr(0xc58)=0x%x\n", rtw_read8(padapter, 0xc58));
+					break;
+				case 0xfe:
+					DBG_871X("rd(0xc50)=0x%x\n", rtw_read8(padapter, 0xc50));
+					DBG_871X("rd(0xc58)=0x%x\n", rtw_read8(padapter, 0xc58));
+					break;
+				case 0xff:
+					{
+						DBG_871X("dbg(0x210)=0x%x\n", rtw_read32(padapter, 0x210));
+						DBG_871X("dbg(0x608)=0x%x\n", rtw_read32(padapter, 0x608));
+						DBG_871X("dbg(0x280)=0x%x\n", rtw_read32(padapter, 0x280));
+						DBG_871X("dbg(0x284)=0x%x\n", rtw_read32(padapter, 0x284));
+						DBG_871X("dbg(0x288)=0x%x\n", rtw_read32(padapter, 0x288));
+	
+						DBG_871X("dbg(0x664)=0x%x\n", rtw_read32(padapter, 0x664));
+
+
+						DBG_871X("\n");
+		
+						DBG_871X("dbg(0x430)=0x%x\n", rtw_read32(padapter, 0x430));
+						DBG_871X("dbg(0x438)=0x%x\n", rtw_read32(padapter, 0x438));
+
+						DBG_871X("dbg(0x440)=0x%x\n", rtw_read32(padapter, 0x440));
+	
+						DBG_871X("dbg(0x458)=0x%x\n", rtw_read32(padapter, 0x458));
+	
+						DBG_871X("dbg(0x484)=0x%x\n", rtw_read32(padapter, 0x484));
+						DBG_871X("dbg(0x488)=0x%x\n", rtw_read32(padapter, 0x488));
+	
+						DBG_871X("dbg(0x444)=0x%x\n", rtw_read32(padapter, 0x444));
+						DBG_871X("dbg(0x448)=0x%x\n", rtw_read32(padapter, 0x448));
+						DBG_871X("dbg(0x44c)=0x%x\n", rtw_read32(padapter, 0x44c));
+						DBG_871X("dbg(0x450)=0x%x\n", rtw_read32(padapter, 0x450));
+					}
+					break;
+			}			
+			break;
+		default:
+			DBG_871X("error dbg cmd!\n");
+			break;	
+	}
+	
+
+	return ret;
+
+}
+
+static int wpa_set_param(struct net_device *dev, u8 name, u32 value)
+{
+	uint ret=0;
+	u32 flags;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	
+	switch (name){
+	case IEEE_PARAM_WPA_ENABLED:
+
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X; //802.1x
+		
+		//ret = ieee80211_wpa_enable(ieee, value);
+		
+		switch((value)&0xff)
+		{
+			case 1 : //WPA
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; //WPA_PSK
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+				break;
+			case 2: //WPA2
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; //WPA2_PSK
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+				break;
+		}
+		
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("wpa_set_param:padapter->securitypriv.ndisauthtype=%d\n", padapter->securitypriv.ndisauthtype));
+		
+		break;
+
+	case IEEE_PARAM_TKIP_COUNTERMEASURES:
+		//ieee->tkip_countermeasures=value;
+		break;
+
+	case IEEE_PARAM_DROP_UNENCRYPTED: 
+	{
+		/* HACK:
+		 *
+		 * wpa_supplicant calls set_wpa_enabled when the driver
+		 * is loaded and unloaded, regardless of if WPA is being
+		 * used.  No other calls are made which can be used to
+		 * determine if encryption will be used or not prior to
+		 * association being expected.  If encryption is not being
+		 * used, drop_unencrypted is set to false, else true -- we
+		 * can use this to determine if the CAP_PRIVACY_ON bit should
+		 * be set.
+		 */
+		 
+#if 0	 
+		struct ieee80211_security sec = {
+			.flags = SEC_ENABLED,
+			.enabled = value,
+		};
+ 		ieee->drop_unencrypted = value;
+		/* We only change SEC_LEVEL for open mode. Others
+		 * are set by ipw_wpa_set_encryption.
+		 */
+		if (!value) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_0;
+		}
+		else {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		}
+		if (ieee->set_security)
+			ieee->set_security(ieee->dev, &sec);
+#endif		
+		break;
+
+	}
+	case IEEE_PARAM_PRIVACY_INVOKED:	
+		
+		//ieee->privacy_invoked=value;
+		
+		break;
+
+	case IEEE_PARAM_AUTH_ALGS:
+		
+		ret = wpa_set_auth_algs(dev, value);
+		
+		break;
+
+	case IEEE_PARAM_IEEE_802_1X:
+		
+		//ieee->ieee802_1x=value;		
+		
+		break;
+		
+	case IEEE_PARAM_WPAX_SELECT:
+		
+		// added for WPA2 mixed mode
+		//DBG_871X(KERN_WARNING "------------------------>wpax value = %x\n", value);
+		/*
+		spin_lock_irqsave(&ieee->wpax_suitlist_lock,flags);
+		ieee->wpax_type_set = 1;
+		ieee->wpax_type_notify = value;
+		spin_unlock_irqrestore(&ieee->wpax_suitlist_lock,flags);
+		*/
+		
+		break;
+
+	default:		
+
+
+		
+		ret = -EOPNOTSUPP;
+
+		
+		break;
+	
+	}
+
+	return ret;
+	
+}
+
+static int wpa_mlme(struct net_device *dev, u32 command, u32 reason)
+{	
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	switch (command)
+	{
+		case IEEE_MLME_STA_DEAUTH:
+
+			if(!rtw_set_802_11_disassociate(padapter))
+				ret = -1;		
+			
+			break;
+
+		case IEEE_MLME_STA_DISASSOC:
+		
+			if(!rtw_set_802_11_disassociate(padapter))
+				ret = -1;		
+	
+			break;
+
+		default:
+			ret = -EOPNOTSUPP;
+			break;
+	}
+
+	return ret;
+	
+}
+
+static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
+{
+	struct ieee_param *param;
+	uint ret=0;
+
+	//down(&ieee->wx_sem);	
+
+	if (p->length < sizeof(struct ieee_param) || !p->pointer){
+		ret = -EINVAL;
+		goto out;
+	}
+	
+	param = (struct ieee_param *)rtw_malloc(p->length);
+	if (param == NULL)
+	{
+		ret = -ENOMEM;
+		goto out;
+	}
+	
+	if (copy_from_user(param, p->pointer, p->length))
+	{
+		rtw_mfree((u8*)param, p->length);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	switch (param->cmd) {
+
+	case IEEE_CMD_SET_WPA_PARAM:
+		ret = wpa_set_param(dev, param->u.wpa_param.name, param->u.wpa_param.value);
+		break;
+
+	case IEEE_CMD_SET_WPA_IE:
+		//ret = wpa_set_wpa_ie(dev, param, p->length);
+		ret =  rtw_set_wpa_ie((_adapter *)rtw_netdev_priv(dev), (char*)param->u.wpa_ie.data, (u16)param->u.wpa_ie.len);
+		break;
+
+	case IEEE_CMD_SET_ENCRYPTION:
+		ret = wpa_set_encryption(dev, param, p->length);
+		break;
+
+	case IEEE_CMD_MLME:
+		ret = wpa_mlme(dev, param->u.mlme.command, param->u.mlme.reason_code);
+		break;
+
+	default:
+		DBG_871X("Unknown WPA supplicant request: %d\n", param->cmd);
+		ret = -EOPNOTSUPP;
+		break;
+		
+	}
+
+	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+		ret = -EFAULT;
+
+	rtw_mfree((u8 *)param, p->length);
+	
+out:
+	
+	//up(&ieee->wx_sem);
+	
+	return ret;
+	
+}
+
+#ifdef CONFIG_AP_MODE
+static u8 set_pairwise_key(_adapter *padapter, struct sta_info *psta)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;	
+	u8	res=_SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if ( ph2c == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+	if(psetstakey_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+
+
+	psetstakey_para->algorithm = (u8)psta->dot118021XPrivacy;
+
+	_rtw_memcpy(psetstakey_para->addr, psta->hwaddr, ETH_ALEN);	
+	
+	_rtw_memcpy(psetstakey_para->key, &psta->dot118021x_UncstKey, 16);
+
+	
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);	
+
+exit:
+
+	return res;
+	
+}
+
+static int set_group_key(_adapter *padapter, u8 *key, u8 alg, int keyid)
+{
+	u8 keylen;
+	struct cmd_obj* pcmd;
+	struct setkey_parm *psetkeyparm;
+	struct cmd_priv	*pcmdpriv=&(padapter->cmdpriv);	
+	int res=_SUCCESS;
+
+	DBG_871X("%s\n", __FUNCTION__);
+	
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	psetkeyparm=(struct setkey_parm*)rtw_zmalloc(sizeof(struct setkey_parm));
+	if(psetkeyparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));
+		
+	psetkeyparm->keyid=(u8)keyid;
+	if (is_wep_enc(alg))
+		padapter->securitypriv.key_mask |= BIT(psetkeyparm->keyid);
+
+	psetkeyparm->algorithm = alg;
+
+	psetkeyparm->set_tx = 1;
+
+	switch(alg)
+	{
+		case _WEP40_:					
+			keylen = 5;
+			break;
+		case _WEP104_:
+			keylen = 13;			
+			break;
+		case _TKIP_:
+		case _TKIP_WTMIC_:		
+		case _AES_:
+			keylen = 16;		
+		default:
+			keylen = 16;		
+	}
+
+	_rtw_memcpy(&(psetkeyparm->key[0]), key, keylen);
+	
+	pcmd->cmdcode = _SetKey_CMD_;
+	pcmd->parmbuf = (u8 *)psetkeyparm;   
+	pcmd->cmdsz =  (sizeof(struct setkey_parm));  
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+	return res;
+	
+
+}
+
+static int set_wep_key(_adapter *padapter, u8 *key, u8 keylen, int keyid)
+{	
+	u8 alg;
+
+	switch(keylen)
+	{
+		case 5:
+			alg =_WEP40_;			
+			break;
+		case 13:
+			alg =_WEP104_;			
+			break;
+		default:
+			alg =_NO_PRIVACY_;			
+	}
+
+	return set_group_key(padapter, key, alg, keyid);
+
+}
+
+
+static int rtw_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	NDIS_802_11_WEP	 *pwep = NULL;
+	struct sta_info *psta = NULL, *pbcmc_sta = NULL;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	//sizeof(struct ieee_param) = 64 bytes;
+	//if (param_len !=  (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	if (param_len !=  sizeof(struct ieee_param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		if (param->u.crypt.idx >= WEP_KEYS)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}	
+	}
+	else 
+	{		
+		psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+		if(!psta)
+		{
+			//ret = -EINVAL;
+			DBG_871X("rtw_set_encryption(), sta has already been removed or never been added\n");
+			goto exit;
+		}			
+	}
+
+	if (strcmp(param->u.crypt.alg, "none") == 0 && (psta==NULL))
+	{
+		//todo:clear default encryption keys
+
+		DBG_871X("clear default encryption keys, keyid=%d\n", param->u.crypt.idx);
+		
+		goto exit;
+	}
+
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0 && (psta==NULL))
+	{		
+		DBG_871X("r871x_set_encryption, crypt.alg = WEP\n");
+		
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+					
+		DBG_871X("r871x_set_encryption, wep_key_idx=%d, len=%d\n", wep_key_idx, wep_key_len);
+
+		if((wep_key_idx >= WEP_KEYS) || (wep_key_len<=0))
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+			
+
+		if (wep_key_len > 0) 
+		{			
+		 	wep_key_len = wep_key_len <= 5 ? 5 : 13;
+			wep_total_len = wep_key_len + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+		 	pwep =(NDIS_802_11_WEP *)rtw_malloc(wep_total_len);
+			if(pwep == NULL){
+				DBG_871X(" r871x_set_encryption: pwep allocate fail !!!\n");
+				goto exit;
+			}
+			
+		 	_rtw_memset(pwep, 0, wep_total_len);
+		
+		 	pwep->KeyLength = wep_key_len;
+			pwep->Length = wep_total_len;
+			
+		}
+		
+		pwep->KeyIndex = wep_key_idx;
+
+		_rtw_memcpy(pwep->KeyMaterial,  param->u.crypt.key, pwep->KeyLength);
+
+		if(param->u.crypt.set_tx)
+		{
+			DBG_871X("wep, set_tx=1\n");
+
+			psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP40_;
+			psecuritypriv->dot118021XGrpPrivacy=_WEP40_;
+			
+			if(pwep->KeyLength==13)
+			{
+				psecuritypriv->dot11PrivacyAlgrthm=_WEP104_;
+				psecuritypriv->dot118021XGrpPrivacy=_WEP104_;
+			}
+
+		
+			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
+			
+			_rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->KeyMaterial, pwep->KeyLength);
+
+			psecuritypriv->dot11DefKeylen[wep_key_idx]=pwep->KeyLength;
+
+			set_wep_key(padapter, pwep->KeyMaterial, pwep->KeyLength, wep_key_idx);		
+
+			
+		}
+		else
+		{
+			DBG_871X("wep, set_tx=0\n");
+			
+			//don't update "psecuritypriv->dot11PrivacyAlgrthm" and 
+			//"psecuritypriv->dot11PrivacyKeyIndex=keyid", but can rtw_set_key to cam
+					
+		      _rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->KeyMaterial, pwep->KeyLength);
+
+			psecuritypriv->dot11DefKeylen[wep_key_idx] = pwep->KeyLength;			
+
+			set_wep_key(padapter, pwep->KeyMaterial, pwep->KeyLength, wep_key_idx);
+			
+		}
+
+		goto exit;
+		
+	}
+
+	
+	if(!psta && check_fwstate(pmlmepriv, WIFI_AP_STATE)) // //group key
+	{
+		if(param->u.crypt.set_tx ==1)
+		{
+			if(strcmp(param->u.crypt.alg, "WEP") == 0)
+			{
+				DBG_871X("%s, set group_key, WEP\n", __FUNCTION__);
+				
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+					
+				psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+				if(param->u.crypt.key_len==13)
+				{						
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+				}
+				
+			}
+			else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+			{						
+				DBG_871X("%s, set group_key, TKIP\n", __FUNCTION__);
+				
+				psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				
+				//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+				//set mic key
+				_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+				_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+				psecuritypriv->busetkipkey = _TRUE;
+											
+			}
+			else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+			{
+				DBG_871X("%s, set group_key, CCMP\n", __FUNCTION__);
+			
+				psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+			}
+			else
+			{
+				DBG_871X("%s, set group_key, none\n", __FUNCTION__);
+				
+				psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+			}
+
+			psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+			psecuritypriv->binstallGrpkey = _TRUE;
+
+			psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+								
+			set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+			
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta)
+			{
+				pbcmc_sta->ieee8021x_blocked = _FALSE;
+				pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy			
+			}	
+						
+		}
+
+		goto exit;
+		
+	}	
+
+	if(psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X && psta) // psk/802_1x
+	{
+		if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+		{
+			if(param->u.crypt.set_tx ==1)
+			{ 
+				_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					DBG_871X("%s, set pairwise key, WEP\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{						
+						psta->dot118021XPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{						
+					DBG_871X("%s, set pairwise key, TKIP\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _TKIP_;
+				
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+											
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+
+					DBG_871X("%s, set pairwise key, CCMP\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _AES_;
+				}
+				else
+				{
+					DBG_871X("%s, set pairwise key, none\n", __FUNCTION__);
+					
+					psta->dot118021XPrivacy = _NO_PRIVACY_;
+				}
+						
+				set_pairwise_key(padapter, psta);
+					
+				psta->ieee8021x_blocked = _FALSE;
+					
+			}			
+			else//group key???
+			{ 
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+					
+					psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{						
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{						
+					psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+											
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				}
+				else
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+				}
+
+				psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+				psecuritypriv->binstallGrpkey = _TRUE;	
+								
+				psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+								
+				set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+			
+				pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+				if(pbcmc_sta)
+				{
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+					pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy			
+				}					
+
+			}
+			
+		}
+				
+	}
+
+exit:
+
+	if(pwep)
+	{
+		rtw_mfree((u8 *)pwep,wep_total_len);		
+	}	
+	
+	return ret;
+	
+}
+
+static int rtw_set_beacon(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	unsigned char *pbuf = param->u.bcn_ie.buf;
+
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	_rtw_memcpy(&pstapriv->max_num_sta, param->u.bcn_ie.reserved, 2);
+
+	if((pstapriv->max_num_sta>NUM_STA) || (pstapriv->max_num_sta<=0))
+		pstapriv->max_num_sta = NUM_STA;
+
+
+	if(rtw_check_beacon_data(padapter, pbuf,  (len-12-2)) == _SUCCESS)// 12 = param header, 2:no packed
+		ret = 0;
+	else
+		ret = -EINVAL;
+	
+
+	return ret;
+	
+}
+
+static int rtw_hostapd_sta_flush(struct net_device *dev)
+{
+	//_irqL irqL;
+	//_list	*phead, *plist;
+	int ret=0;	
+	//struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	//struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	flush_all_cam_entry(padapter);	//clear CAM
+
+	ret = rtw_sta_flush(padapter);	
+
+	return ret;
+
+}
+
+static int rtw_add_sta(struct net_device *dev, struct ieee_param *param)
+{
+	_irqL irqL;
+	int ret=0;	
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("rtw_add_sta(aid=%d)=" MAC_FMT "\n", param->u.add_sta.aid, MAC_ARG(param->sta_addr));
+	
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)	
+	{
+		return -EINVAL;		
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+/*
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		DBG_871X("rtw_add_sta(), free has been added psta=%p\n", psta);
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);		
+		rtw_free_stainfo(padapter,  psta);		
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+		psta = NULL;
+	}	
+*/
+	//psta = rtw_alloc_stainfo(pstapriv, param->sta_addr);
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		int flags = param->u.add_sta.flags;			
+		
+		//DBG_871X("rtw_add_sta(), init sta's variables, psta=%p\n", psta);
+		
+		psta->aid = param->u.add_sta.aid;//aid=1~2007
+
+		_rtw_memcpy(psta->bssrateset, param->u.add_sta.tx_supp_rates, 16);
+		
+		
+		//check wmm cap.
+		if(WLAN_STA_WME&flags)
+			psta->qos_option = 1;
+		else
+			psta->qos_option = 0;
+
+		if(pmlmepriv->qospriv.qos_option == 0)	
+			psta->qos_option = 0;
+
+		
+#ifdef CONFIG_80211N_HT		
+		//chec 802.11n ht cap.
+		if(WLAN_STA_HT&flags)
+		{
+			psta->htpriv.ht_option = _TRUE;
+			psta->qos_option = 1;
+			_rtw_memcpy((void*)&psta->htpriv.ht_cap, (void*)&param->u.add_sta.ht_cap, sizeof(struct rtw_ieee80211_ht_cap));
+		}
+		else		
+		{
+			psta->htpriv.ht_option = _FALSE;
+		}
+		
+		if(pmlmepriv->htpriv.ht_option == _FALSE)	
+			psta->htpriv.ht_option = _FALSE;
+#endif		
+
+
+		update_sta_info_apmode(padapter, psta);
+		
+		
+	}
+	else
+	{
+		ret = -ENOMEM;
+	}	
+	
+	return ret;
+	
+}
+
+static int rtw_del_sta(struct net_device *dev, struct ieee_param *param)
+{
+	_irqL irqL;
+	int ret=0;	
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("rtw_del_sta=" MAC_FMT "\n", MAC_ARG(param->sta_addr));
+		
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)		
+	{
+		return -EINVAL;		
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		u8 updated=_FALSE;
+	
+		//DBG_871X("free psta=%p, aid=%d\n", psta, psta->aid);
+
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		if(rtw_is_list_empty(&psta->asoc_list)==_FALSE)
+		{			
+			rtw_list_delete(&psta->asoc_list);
+			pstapriv->asoc_list_cnt--;
+			updated = ap_free_sta(padapter, psta, _TRUE, WLAN_REASON_DEAUTH_LEAVING);
+
+		}
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		
+		associated_clients_update(padapter, updated);
+	
+		psta = NULL;
+		
+	}
+	else
+	{
+		DBG_871X("rtw_del_sta(), sta has already been removed or never been added\n");
+		
+		//ret = -1;
+	}
+	
+	
+	return ret;
+	
+}
+
+static int rtw_ioctl_get_sta_data(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;	
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct ieee_param_ex *param_ex = (struct ieee_param_ex *)param;
+	struct sta_data *psta_data = (struct sta_data *)param_ex->data;
+
+	DBG_871X("rtw_ioctl_get_sta_info, sta_addr: " MAC_FMT "\n", MAC_ARG(param_ex->sta_addr));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)		
+	{
+		return -EINVAL;		
+	}
+
+	if (param_ex->sta_addr[0] == 0xff && param_ex->sta_addr[1] == 0xff &&
+	    param_ex->sta_addr[2] == 0xff && param_ex->sta_addr[3] == 0xff &&
+	    param_ex->sta_addr[4] == 0xff && param_ex->sta_addr[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+	psta = rtw_get_stainfo(pstapriv, param_ex->sta_addr);
+	if(psta)
+	{
+#if 0
+		struct {
+			u16 aid;
+			u16 capability;
+			int flags;
+			u32 sta_set;
+			u8 tx_supp_rates[16];	
+			u32 tx_supp_rates_len;
+			struct rtw_ieee80211_ht_cap ht_cap;
+			u64	rx_pkts;
+			u64	rx_bytes;
+			u64	rx_drops;
+			u64	tx_pkts;
+			u64	tx_bytes;
+			u64	tx_drops;
+		} get_sta;		
+#endif
+		psta_data->aid = (u16)psta->aid;
+		psta_data->capability = psta->capability;
+		psta_data->flags = psta->flags;
+
+/*
+		nonerp_set : BIT(0)
+		no_short_slot_time_set : BIT(1)
+		no_short_preamble_set : BIT(2)
+		no_ht_gf_set : BIT(3)
+		no_ht_set : BIT(4)
+		ht_20mhz_set : BIT(5)
+*/
+
+		psta_data->sta_set =((psta->nonerp_set) |
+							(psta->no_short_slot_time_set <<1) |
+							(psta->no_short_preamble_set <<2) |
+							(psta->no_ht_gf_set <<3) |
+							(psta->no_ht_set <<4) |
+							(psta->ht_20mhz_set <<5));
+
+		psta_data->tx_supp_rates_len =  psta->bssratelen;
+		_rtw_memcpy(psta_data->tx_supp_rates, psta->bssrateset, psta->bssratelen);
+
+		_rtw_memcpy(&psta_data->ht_cap, &psta->htpriv.ht_cap, sizeof(struct rtw_ieee80211_ht_cap));
+
+		psta_data->rx_pkts = psta->sta_stats.rx_data_pkts;
+		psta_data->rx_bytes = psta->sta_stats.rx_bytes;
+		psta_data->rx_drops = psta->sta_stats.rx_drops;
+
+		psta_data->tx_pkts = psta->sta_stats.tx_pkts;
+		psta_data->tx_bytes = psta->sta_stats.tx_bytes;
+		psta_data->tx_drops = psta->sta_stats.tx_drops;
+		
+
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	return ret;
+
+}
+
+static int rtw_get_sta_wpaie(struct net_device *dev, struct ieee_param *param)
+{
+	int ret=0;	
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("rtw_get_sta_wpaie, sta_addr: " MAC_FMT "\n", MAC_ARG(param->sta_addr));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)		
+	{
+		return -EINVAL;		
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		if((psta->wpa_ie[0] == WLAN_EID_RSN) || (psta->wpa_ie[0] == WLAN_EID_GENERIC))
+		{
+			int wpa_ie_len;
+			int copy_len;
+
+			wpa_ie_len = psta->wpa_ie[1];
+			
+			copy_len = ((wpa_ie_len+2) > sizeof(psta->wpa_ie)) ? (sizeof(psta->wpa_ie)):(wpa_ie_len+2);
+				
+			param->u.wpa_ie.len = copy_len;
+
+			_rtw_memcpy(param->u.wpa_ie.reserved, psta->wpa_ie, copy_len);
+		}
+		else
+		{
+			//ret = -1;
+			DBG_871X("sta's wpa_ie is NONE\n");
+		}		
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	return ret;
+
+}
+
+static int rtw_set_wps_beacon(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	unsigned char wps_oui[4]={0x0,0x50,0xf2,0x04};
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int ie_len;
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+
+
+	if(pmlmepriv->wps_beacon_ie)
+	{
+		rtw_mfree(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len);
+		pmlmepriv->wps_beacon_ie = NULL;			
+	}	
+
+	if(ie_len>0)
+	{
+		pmlmepriv->wps_beacon_ie = rtw_malloc(ie_len);
+		pmlmepriv->wps_beacon_ie_len = ie_len;
+		if ( pmlmepriv->wps_beacon_ie == NULL) {
+			DBG_871X("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+		}
+
+		_rtw_memcpy(pmlmepriv->wps_beacon_ie, param->u.bcn_ie.buf, ie_len);
+
+		update_beacon(padapter, _VENDOR_SPECIFIC_IE_, wps_oui, _TRUE);
+		
+		pmlmeext->bstart_bss = _TRUE;
+		
+	}
+	
+	
+	return ret;		
+
+}
+
+static int rtw_set_wps_probe_resp(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	int ie_len;
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+
+
+	if(pmlmepriv->wps_probe_resp_ie)
+	{
+		rtw_mfree(pmlmepriv->wps_probe_resp_ie, pmlmepriv->wps_probe_resp_ie_len);
+		pmlmepriv->wps_probe_resp_ie = NULL;			
+	}	
+
+	if(ie_len>0)
+	{
+		pmlmepriv->wps_probe_resp_ie = rtw_malloc(ie_len);
+		pmlmepriv->wps_probe_resp_ie_len = ie_len;
+		if ( pmlmepriv->wps_probe_resp_ie == NULL) {
+			DBG_871X("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+		}
+		_rtw_memcpy(pmlmepriv->wps_probe_resp_ie, param->u.bcn_ie.buf, ie_len);		
+	}
+	
+	
+	return ret;
+
+}
+
+static int rtw_set_wps_assoc_resp(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	int ie_len;
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+
+
+	if(pmlmepriv->wps_assoc_resp_ie)
+	{
+		rtw_mfree(pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
+		pmlmepriv->wps_assoc_resp_ie = NULL;			
+	}	
+
+	if(ie_len>0)
+	{
+		pmlmepriv->wps_assoc_resp_ie = rtw_malloc(ie_len);
+		pmlmepriv->wps_assoc_resp_ie_len = ie_len;
+		if ( pmlmepriv->wps_assoc_resp_ie == NULL) {
+			DBG_871X("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+		}
+		
+		_rtw_memcpy(pmlmepriv->wps_assoc_resp_ie, param->u.bcn_ie.buf, ie_len);		
+	}
+	
+	
+	return ret;
+
+}
+
+static int rtw_set_hidden_ssid(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *mlmepriv = &(adapter->mlmepriv);
+	struct mlme_ext_priv	*mlmeext = &(adapter->mlmeextpriv);
+	struct mlme_ext_info	*mlmeinfo = &(mlmeext->mlmext_info);
+	int ie_len;
+	u8 *ssid_ie;
+	char ssid[NDIS_802_11_LENGTH_SSID + 1];
+	sint ssid_len;
+	u8 ignore_broadcast_ssid;
+
+	if(check_fwstate(mlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EPERM;
+
+	if (param->u.bcn_ie.reserved[0] != 0xea)
+		return -EINVAL;
+
+	mlmeinfo->hidden_ssid_mode = ignore_broadcast_ssid = param->u.bcn_ie.reserved[1];
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+	ssid_ie = rtw_get_ie(param->u.bcn_ie.buf,  WLAN_EID_SSID, &ssid_len, ie_len);
+
+	if (ssid_ie && ssid_len) {
+		WLAN_BSSID_EX *pbss_network = &mlmepriv->cur_network.network;
+		WLAN_BSSID_EX *pbss_network_ext = &mlmeinfo->network;
+
+		_rtw_memcpy(ssid, ssid_ie+2, ssid_len);
+		ssid[ssid_len>NDIS_802_11_LENGTH_SSID?NDIS_802_11_LENGTH_SSID:ssid_len] = 0x0;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" ssid:(%s,%d), from ie:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			ssid, ssid_len,
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
+			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
+
+		_rtw_memcpy(pbss_network->Ssid.Ssid, (void *)ssid, ssid_len);
+		pbss_network->Ssid.SsidLength = ssid_len;
+		_rtw_memcpy(pbss_network_ext->Ssid.Ssid, (void *)ssid, ssid_len);
+		pbss_network_ext->Ssid.SsidLength = ssid_len;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" after ssid:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
+			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
+	}
+
+	DBG_871X(FUNC_ADPT_FMT" ignore_broadcast_ssid:%d, %s,%d\n", FUNC_ADPT_ARG(adapter),
+		ignore_broadcast_ssid, ssid, ssid_len);
+
+	return ret;
+}
+
+static int rtw_ioctl_acl_remove_sta(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);	
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+	ret = rtw_acl_remove_sta(padapter, param->sta_addr);	
+
+	return ret;		
+
+}
+
+static int rtw_ioctl_acl_add_sta(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) 
+	{
+		return -EINVAL;	
+	}
+
+	ret = rtw_acl_add_sta(padapter, param->sta_addr);	
+
+	return ret;		
+
+}
+
+static int rtw_ioctl_set_macaddr_acl(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);	
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;	
+	
+	rtw_set_macaddr_acl(padapter, param->u.mlme.command);	
+
+	return ret;
+}
+
+static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
+{
+	struct ieee_param *param;
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	/*
+	* this function is expect to call in master mode, which allows no power saving
+	* so, we just check hw_init_completed instead of call rfpwrstate_check()
+	*/
+
+	if (padapter->hw_init_completed==_FALSE){
+		ret = -EPERM;
+		goto out;
+	}
+
+
+	//if (p->length < sizeof(struct ieee_param) || !p->pointer){
+	if(!p->pointer){
+		ret = -EINVAL;
+		goto out;
+	}
+	
+	param = (struct ieee_param *)rtw_malloc(p->length);
+	if (param == NULL)
+	{
+		ret = -ENOMEM;
+		goto out;
+	}
+	
+	if (copy_from_user(param, p->pointer, p->length))
+	{
+		rtw_mfree((u8*)param, p->length);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	//DBG_871X("%s, cmd=%d\n", __FUNCTION__, param->cmd);
+
+	switch (param->cmd) 
+	{	
+		case RTL871X_HOSTAPD_FLUSH:
+
+			ret = rtw_hostapd_sta_flush(dev);
+
+			break;
+	
+		case RTL871X_HOSTAPD_ADD_STA:	
+			
+			ret = rtw_add_sta(dev, param);					
+			
+			break;
+
+		case RTL871X_HOSTAPD_REMOVE_STA:
+
+			ret = rtw_del_sta(dev, param);
+
+			break;
+	
+		case RTL871X_HOSTAPD_SET_BEACON:
+
+			ret = rtw_set_beacon(dev, param, p->length);
+
+			break;
+			
+		case RTL871X_SET_ENCRYPTION:
+
+			ret = rtw_set_encryption(dev, param, p->length);
+			
+			break;
+			
+		case RTL871X_HOSTAPD_GET_WPAIE_STA:
+
+			ret = rtw_get_sta_wpaie(dev, param);
+	
+			break;
+			
+		case RTL871X_HOSTAPD_SET_WPS_BEACON:
+
+			ret = rtw_set_wps_beacon(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_WPS_PROBE_RESP:
+
+			ret = rtw_set_wps_probe_resp(dev, param, p->length);
+			
+	 		break;
+			
+		case RTL871X_HOSTAPD_SET_WPS_ASSOC_RESP:
+
+			ret = rtw_set_wps_assoc_resp(dev, param, p->length);
+			
+	 		break;
+
+		case RTL871X_HOSTAPD_SET_HIDDEN_SSID:
+
+			ret = rtw_set_hidden_ssid(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_GET_INFO_STA:
+
+			ret = rtw_ioctl_get_sta_data(dev, param, p->length);
+
+			break;
+			
+		case RTL871X_HOSTAPD_SET_MACADDR_ACL:
+
+			ret = rtw_ioctl_set_macaddr_acl(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_ACL_ADD_STA:
+
+			ret = rtw_ioctl_acl_add_sta(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_ACL_REMOVE_STA:
+
+			ret = rtw_ioctl_acl_remove_sta(dev, param, p->length);
+
+			break;
+			
+		default:
+			DBG_871X("Unknown hostapd request: %d\n", param->cmd);
+			ret = -EOPNOTSUPP;
+			break;
+		
+	}
+
+	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+		ret = -EFAULT;
+
+
+	rtw_mfree((u8 *)param, p->length);
+	
+out:
+		
+	return ret;
+	
+}
+#endif
+
+#include <rtw_android.h>
+static int rtw_wx_set_priv(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *awrq,
+				char *extra)
+{
+
+#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	char *ext_dbg;
+#endif
+
+	int ret = 0;
+	int len = 0;
+	char *ext;
+	int i;
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *dwrq = (struct iw_point*)awrq;
+
+	//RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_notice_, ("+rtw_wx_set_priv\n"));
+	if(dwrq->length == 0)
+		return -EFAULT;
+	len = dwrq->length;
+	if (!(ext = rtw_vmalloc(len)))
+		return -ENOMEM;
+
+	if (copy_from_user(ext, dwrq->pointer, len)) {
+		rtw_vmfree(ext, len);
+		return -EFAULT;
+	}
+
+
+	//RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_notice_,
+	//	 ("rtw_wx_set_priv: %s req=%s\n",
+	//	  dev->name, ext));
+
+	#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV	
+	if (!(ext_dbg = rtw_vmalloc(len)))
+	{
+		rtw_vmfree(ext, len);
+		return -ENOMEM;
+	}	
+	
+	_rtw_memcpy(ext_dbg, ext, len);
+	#endif
+
+	//added for wps2.0 @20110524
+	if(dwrq->flags == 0x8766 && len > 8)
+	{
+		u32 cp_sz;		
+		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+		u8 *probereq_wpsie = ext;
+		int probereq_wpsie_len = len;
+		u8 wps_oui[4]={0x0,0x50,0xf2,0x04};		
+	
+		if((_VENDOR_SPECIFIC_IE_ == probereq_wpsie[0]) &&
+			(_rtw_memcmp(&probereq_wpsie[2], wps_oui, 4) ==_TRUE))
+		{
+			cp_sz = probereq_wpsie_len>MAX_WPS_IE_LEN ? MAX_WPS_IE_LEN:probereq_wpsie_len;
+
+			//_rtw_memcpy(pmlmepriv->probereq_wpsie, probereq_wpsie, cp_sz);
+			//pmlmepriv->probereq_wpsie_len = cp_sz;
+					
+			printk("probe_req_wps_ielen=%d\n", cp_sz);
+						
+			if(pmlmepriv->wps_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->wps_probe_req_ie_len;
+				pmlmepriv->wps_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_probe_req_ie, free_len);
+				pmlmepriv->wps_probe_req_ie = NULL;			
+			}	
+
+			pmlmepriv->wps_probe_req_ie = rtw_malloc(cp_sz);
+			if ( pmlmepriv->wps_probe_req_ie == NULL) {
+				printk("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				ret =  -EINVAL;
+				goto FREE_EXT;
+			
+			}
+			
+			_rtw_memcpy(pmlmepriv->wps_probe_req_ie, probereq_wpsie, cp_sz);
+			pmlmepriv->wps_probe_req_ie_len = cp_sz;					
+			
+		}	
+		
+		goto FREE_EXT;
+		
+	}
+
+	if(	len >= WEXT_CSCAN_HEADER_SIZE
+		&& _rtw_memcmp(ext, WEXT_CSCAN_HEADER, WEXT_CSCAN_HEADER_SIZE) == _TRUE
+	){
+		ret = rtw_wx_set_scan(dev, info, awrq, ext);
+		goto FREE_EXT;
+	}
+	
+#ifdef CONFIG_ANDROID
+	//DBG_871X("rtw_wx_set_priv: %s req=%s\n", dev->name, ext);
+
+	i = rtw_android_cmdstr_to_num(ext);
+
+	switch(i) {
+		case ANDROID_WIFI_CMD_START :
+			indicate_wx_custom_event(padapter, "START");
+			break;
+		case ANDROID_WIFI_CMD_STOP :
+			indicate_wx_custom_event(padapter, "STOP");
+			break;
+		case ANDROID_WIFI_CMD_RSSI :
+			{
+				struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);	
+				struct	wlan_network	*pcur_network = &pmlmepriv->cur_network;
+
+				if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+					sprintf(ext, "%s rssi %d", pcur_network->network.Ssid.Ssid, padapter->recvpriv.rssi);
+				} else {
+					sprintf(ext, "OK");
+				}
+			}
+			break;
+		case ANDROID_WIFI_CMD_LINKSPEED :
+			{
+				u16 mbps = rtw_get_cur_max_rate(padapter)/10;
+				sprintf(ext, "LINKSPEED %d", mbps);
+			}
+			break;
+		case ANDROID_WIFI_CMD_MACADDR :
+			sprintf(ext, "MACADDR = " MAC_FMT, MAC_ARG(dev->dev_addr));
+			break;
+		case ANDROID_WIFI_CMD_SCAN_ACTIVE :
+			{
+				//rtw_set_scan_mode(padapter, SCAN_ACTIVE);
+				sprintf(ext, "OK");
+			}
+			break;
+		case ANDROID_WIFI_CMD_SCAN_PASSIVE :
+			{
+				//rtw_set_scan_mode(padapter, SCAN_PASSIVE);
+				sprintf(ext, "OK");
+			}
+			break;
+
+		case ANDROID_WIFI_CMD_COUNTRY :
+			{
+				char country_code[10];
+				sscanf(ext, "%*s %s", country_code);
+				rtw_set_country(padapter, country_code);
+				sprintf(ext, "OK");
+			}
+			break;
+		default :
+			#ifdef  CONFIG_DEBUG_RTW_WX_SET_PRIV
+			DBG_871X("%s: %s unknowned req=%s\n", __FUNCTION__,
+				dev->name, ext_dbg);
+			#endif
+
+			sprintf(ext, "OK");
+		
+	}
+
+	if (copy_to_user(dwrq->pointer, ext, min(dwrq->length, (u16)(strlen(ext)+1)) ) )
+		ret = -EFAULT;
+
+	#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	DBG_871X("%s: %s req=%s rep=%s dwrq->length=%d, strlen(ext)+1=%d\n", __FUNCTION__,
+		dev->name, ext_dbg ,ext, dwrq->length, (u16)(strlen(ext)+1));
+	#endif
+#endif //end of CONFIG_ANDROID
+
+
+FREE_EXT:
+
+	rtw_vmfree(ext, len);
+	#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	rtw_vmfree(ext_dbg, len);
+	#endif
+
+	//DBG_871X("rtw_wx_set_priv: (SIOCSIWPRIV) %s ret=%d\n", 
+	//		dev->name, ret);
+
+	return ret;
+	
+}
+
+static int rtw_mp_efuse_get(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	struct mp_priv *pmp_priv;	
+	
+	int i,j =0;
+	u8 data[EFUSE_MAP_SIZE];
+	u8 rawdata[EFUSE_MAX_SIZE];
+	u16 mapLen=0;
+	char *pch, *ptmp, *token, *tmp[3]={0x00,0x00,0x00};
+	u16 addr = 0, cnts = 0, max_available_size = 0,raw_cursize = 0 ,raw_maxsize = 0;
+	
+	_rtw_memset(data, '\0', sizeof(data));
+	_rtw_memset(rawdata, '\0', sizeof(rawdata));
+	
+	if (copy_from_user(extra, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	pch = extra;
+	DBG_871X("%s: in=%s\n", __func__, extra);
+	
+	i=0;
+	//mac 16 "00e04c871200" rmap,00,2
+	while ( (token = strsep (&pch,",") )!=NULL )
+	{
+			if(i>2) break;
+			tmp[i] = token; 	  
+			i++;
+	}
+	
+	if ( strcmp(tmp[0],"realmap") == 0 ) {
+		
+		DBG_871X("strcmp OK =	%s \n" ,tmp[0]);
+
+		mapLen = EFUSE_MAP_SIZE;
+		 
+		if (rtw_efuse_map_read(padapter, 0, mapLen, data) == _SUCCESS){
+			DBG_871X("\t  rtw_efuse_map_read \n"); 
+		}else {
+			DBG_871X("\t  rtw_efuse_map_read : Fail \n");
+			return -EFAULT;
+		} 
+		_rtw_memset(extra, '\0', sizeof(extra));
+		DBG_871X("\tOFFSET\tVALUE(hex)\n");
+		sprintf(extra, "%s \n", extra);
+		for ( i = 0; i < EFUSE_MAP_SIZE; i += 16 )
+		{
+			DBG_871X("\t0x%02x\t", i);
+			sprintf(extra, "%s \t0x%02x\t", extra,i);
+			for (j = 0; j < 8; j++)
+			{	  
+				DBG_871X("%02X ", data[i+j]);
+				sprintf(extra, "%s %02X", extra, data[i+j]);
+			}
+			DBG_871X("\t");
+			sprintf(extra,"%s\t",extra);
+			for (; j < 16; j++){
+				DBG_871X("%02X ", data[i+j]);
+				sprintf(extra, "%s %02X", extra, data[i+j]);
+			}
+			DBG_871X("\n");
+			sprintf(extra,"%s\n",extra);	
+		}
+		DBG_871X("\n");
+		wrqu->length = strlen(extra);
+	
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"rmap") == 0 ) {
+		if ( tmp[1]==NULL || tmp[2]==NULL ) return	-EINVAL;
+		// rmap addr cnts
+		addr = simple_strtoul(tmp[1], &ptmp, 16);
+
+		DBG_871X("addr = %x \n" ,addr);
+
+		cnts=simple_strtoul(tmp[2], &ptmp,10);
+		if(cnts==0) return -EINVAL;
+
+		DBG_871X("cnts = %d \n" ,cnts);
+		//_rtw_memset(extra, '\0', wrqu->data.length);
+
+		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		if ((addr + cnts) > max_available_size) {
+			DBG_871X("(addr + cnts parameter error \n");
+			return -EFAULT;
+		}
+				
+		if (rtw_efuse_map_read(padapter, addr, cnts, data) == _FAIL) 
+		{
+			DBG_871X("rtw_efuse_access error \n"); 		
+		}
+		else{
+			DBG_871X("rtw_efuse_access ok \n");
+		}	
+
+		_rtw_memset(extra, '\0', sizeof(extra));	 
+		for ( i = 0; i < cnts; i ++) {
+			DBG_871X("0x%02x", data[i]);
+			sprintf(extra, "%s 0x%02X", extra, data[i]);
+			DBG_871X(" ");
+			sprintf(extra,"%s ",extra);
+		}
+
+		wrqu->length = strlen(extra)+1;
+
+		DBG_871X("extra = %s ", extra);
+
+		return 0;	
+	}
+	else if ( strcmp(tmp[0],"realraw") == 0 ) {
+		addr=0;
+		mapLen = EFUSE_MAX_SIZE;
+
+		if (rtw_efuse_access(padapter, _FALSE, addr, mapLen, rawdata) == _FAIL)
+		{
+			DBG_871X("\t  rtw_efuse_map_read : Fail \n");
+			return -EFAULT;
+		} else
+		{
+			DBG_871X("\t  rtw_efuse_access raw ok \n");	
+		}
+				
+		_rtw_memset(extra, '\0', sizeof(extra));
+		for ( i=0; i<mapLen; i++ ) {
+			DBG_871X(" %02x", rawdata[i]);
+			sprintf(extra, "%s %02x", extra, rawdata[i] );
+
+			if ((i & 0xF) == 0xF){ 
+				DBG_871X("\n\t");
+				sprintf(extra, "%s\n\t", extra);
+			}
+			else if ((i & 0x7) == 0x7){ 
+				DBG_871X("\t");
+				sprintf(extra, "%s\t", extra);
+			}
+		}
+		wrqu->length = strlen(extra);
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"mac") == 0 ) {
+		if ( tmp[1]==NULL || tmp[2]==NULL ) return	-EINVAL;
+		#ifdef CONFIG_RTL8192C
+		addr = 0x16;
+		cnts = 6;
+		#endif
+		#ifdef CONFIG_RTL8192D
+		addr = 0x19;
+		cnts = 6;
+		#endif
+		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		if ((addr + mapLen) > max_available_size) {
+			DBG_871X("(addr + cnts parameter error \n");
+			return -EFAULT;
+		}
+		if (rtw_efuse_map_read(padapter, addr, cnts, data) == _FAIL)
+		{
+			DBG_871X("rtw_efuse_access error \n"); 		
+		}
+		else{
+			DBG_871X("rtw_efuse_access ok \n");
+		}	
+		_rtw_memset(extra, '\0', sizeof(extra));		 
+		for ( i = 0; i < cnts; i ++) {
+			DBG_871X("0x%02x", data[i]);
+			sprintf(extra, "%s 0x%02X", extra, data[i+j]);
+			DBG_871X(" ");
+			sprintf(extra,"%s ",extra);
+		}
+		wrqu->length = strlen(extra);
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"vidpid") == 0 ) {
+		if ( tmp[1]==NULL || tmp[2]==NULL ) return	-EINVAL;
+		#ifdef CONFIG_RTL8192C
+		addr=0x0a;
+		#endif
+		#ifdef CONFIG_RTL8192D
+		addr = 0x0c;
+		#endif
+		cnts = 4;
+		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		if ((addr + mapLen) > max_available_size) {
+			DBG_871X("(addr + cnts parameter error \n");
+			return -EFAULT;
+		}
+		if (rtw_efuse_map_read(padapter, addr, cnts, data) == _FAIL) 
+		{
+			DBG_871X("rtw_efuse_access error \n"); 		
+		}
+		else{
+			DBG_871X("rtw_efuse_access ok \n");
+		}	
+		_rtw_memset(extra, '\0', sizeof(extra));		 
+		for ( i = 0; i < cnts; i ++) {
+			DBG_871X("0x%02x", data[i]);
+			sprintf(extra, "%s 0x%02X", extra, data[i+j]);
+			DBG_871X(" ");
+			sprintf(extra,"%s ",extra);
+		}
+		wrqu->length = strlen(extra);
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"ableraw") == 0 ) {
+		efuse_GetCurrentSize(padapter,&raw_cursize);
+		raw_maxsize = efuse_GetMaxSize(padapter);
+		sprintf(extra, "%s : [ available raw size] = %d",extra,raw_maxsize-raw_cursize);
+		wrqu->length = strlen(extra);
+
+		return 0;
+	}else
+	{
+		 sprintf(extra, "%s : Command not found\n",extra);
+		  wrqu->length = strlen(extra);
+		  return 0;
+	}
+	
+	return 0;
+}
+
+static int rtw_mp_efuse_set(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	
+	u8 buffer[40];
+	u32 i,jj,kk;
+	u8 setdata[EFUSE_MAP_SIZE];
+	u8 setrawdata[EFUSE_MAX_SIZE];
+	char *pch, *ptmp, *token, *edata,*tmp[3]={0x00,0x00,0x00};
+
+	u16 addr = 0, max_available_size = 0;
+	u32  cnts = 0;
+	
+	pch = extra;
+	DBG_871X("%s: in=%s\n", __func__, extra);
+	
+	i=0;
+	while ( (token = strsep (&pch,",") )!=NULL )
+	{
+		if(i>2) break;
+		tmp[i] = token;
+		i++;
+	}
+
+	// tmp[0],[1],[2]
+	// wmap,addr,00e04c871200
+	if ( strcmp(tmp[0],"wmap") == 0 ) {
+		 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+			if ( ! strlen( tmp[2] )/2 > 1 ) return -EFAULT; 			
+				  
+			addr = simple_strtoul( tmp[1], &ptmp, 16 );
+			addr = addr & 0xFF;
+			DBG_871X("addr = %x \n" ,addr);
+					
+			cnts = strlen( tmp[2] )/2;	
+			if ( cnts == 0) return -EFAULT;
+					
+			DBG_871X("cnts = %d \n" ,cnts);
+			DBG_871X("target data = %s \n" ,tmp[2]);
+					
+			for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+			{
+				setdata[jj] = key_2char2num( tmp[2][kk], tmp[2][kk+ 1] );
+			}
+	
+			EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+			
+			if ((addr + cnts) > max_available_size) {
+						DBG_871X("parameter error \n");
+						return -EFAULT;
+			}	
+			if (rtw_efuse_map_write(padapter, addr, cnts, setdata) == _FAIL) {			
+					DBG_871X("rtw_efuse_map_write error \n");
+					return -EFAULT;
+			} else
+			   DBG_871X("rtw_efuse_map_write ok \n");
+		
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"wraw") == 0 ) {
+			 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+			 if ( ! strlen( tmp[2] )/2 > 1 ) return -EFAULT;			 
+			addr = simple_strtoul( tmp[1], &ptmp, 16 );
+			addr = addr & 0xFF;
+			DBG_871X("addr = %x \n" ,addr);
+				
+			cnts=strlen( tmp[2] )/2;
+			if ( cnts == 0) return -EFAULT;
+
+			DBG_871X(" cnts = %d \n" ,cnts );		
+			DBG_871X("target data = %s \n" ,tmp[2] );
+			
+			for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+			{
+					setrawdata[jj] = key_2char2num( tmp[2][kk], tmp[2][kk+ 1] );
+			}
+					
+			if ( rtw_efuse_access( padapter, _TRUE, addr, cnts, setrawdata ) == _FAIL ){
+					DBG_871X("\t  rtw_efuse_map_read : Fail \n");
+						return -EFAULT;
+			} else
+			  DBG_871X("\t  rtw_efuse_access raw ok \n");	
+			
+					return 0;
+		}
+	else if ( strcmp(tmp[0],"mac") == 0 ) { 
+			 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+			//mac,00e04c871200
+			#ifdef CONFIG_RTL8192C
+				addr = 0x16;
+			#endif
+			#ifdef CONFIG_RTL8192D
+				addr = 0x19;
+			#endif
+				cnts = strlen( tmp[1] )/2;
+				if ( cnts == 0) return -EFAULT;
+				if ( cnts > 6 ){
+						DBG_871X("error data for mac addr = %s \n" ,tmp[1]);
+						return -EFAULT;
+				}
+				
+				DBG_871X("target data = %s \n" ,tmp[1]);
+				
+				for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+				{
+					setdata[jj] = key_2char2num(tmp[1][kk], tmp[1][kk+ 1]);
+				}
+				
+				EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		
+				if ((addr + cnts) > max_available_size) {
+						DBG_871X("parameter error \n");
+						return -EFAULT;
+					}	
+				if ( rtw_efuse_map_write(padapter, addr, cnts, setdata) == _FAIL ) {
+					DBG_871X("rtw_efuse_map_write error \n");
+					return -EFAULT;
+				} else
+					DBG_871X("rtw_efuse_map_write ok \n");
+				
+			return 0;
+		}
+		else if ( strcmp(tmp[0],"vidpid") == 0 ) { 
+			 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+				// pidvid,da0b7881
+				#ifdef CONFIG_RTL8192C
+					   addr=0x0a;
+				#endif
+				#ifdef CONFIG_RTL8192D
+					addr = 0x0c;
+				#endif
+				
+				cnts=strlen( tmp[1] )/2;
+				if ( cnts == 0) return -EFAULT;
+				DBG_871X("target data = %s \n" ,tmp[1]);
+				
+				for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+				{
+					setdata[jj] = key_2char2num(tmp[1][kk], tmp[1][kk+ 1]);
+				}
+
+				EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+				
+				if ((addr + cnts) > max_available_size) {
+						DBG_871X("parameter error \n");
+						return -EFAULT;
+					}	
+				
+				if ( rtw_efuse_map_write(padapter, addr, cnts, setdata) == _FAIL ) {
+					DBG_871X("rtw_efuse_map_write error \n");
+					return -EFAULT;
+				} else
+					DBG_871X("rtw_efuse_map_write ok \n");
+			
+				return 0;
+		}
+		else{
+				 DBG_871X("Command not found\n");
+			   return 0;
+		}
+		
+	  return 0;
+}
+
+
+
+#if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+/*
+ * Input Format: %s,%d,%d
+ *	%s is width, could be
+ *		"b" for 1 byte
+ *		"w" for WORD (2 bytes)
+ *		"dw" for DWORD (4 bytes)
+ *	1st %d is address(offset)
+ *	2st %d is data to write
+ */
+static int rtw_mp_write_reg(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	char *pch, *pnext, *ptmp;
+	char *width_str;
+	char width;
+	u32 addr, data;
+	int ret;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	pch = extra;
+	pnext = strpbrk(pch, " ,.-");
+	if (pnext == NULL) return -EINVAL;
+	*pnext = 0;
+	width_str = pch;
+
+	pch = pnext + 1;
+	pnext = strpbrk(pch, " ,.-");
+	if (pnext == NULL) return -EINVAL;
+	*pnext = 0;
+	addr = simple_strtoul(pch, &ptmp, 16);
+	if (addr > 0x3FFF) return -EINVAL;
+
+	pch = pnext + 1;
+	if ((pch - extra) >= wrqu->length) return -EINVAL;
+	data = simple_strtoul(pch, &ptmp, 16);
+
+	ret = 0;
+	width = width_str[0];
+	switch (width) {
+		case 'b':
+			// 1 byte
+			if (data > 0xFF) {
+				ret = -EINVAL;
+				break;
+			}
+			rtw_write8(padapter, addr, data);
+			break;
+		case 'w':
+			// 2 bytes
+			if (data > 0xFFFF) {
+				ret = -EINVAL;
+				break;
+			}
+			rtw_write16(padapter, addr, data);
+			break;
+		case 'd':
+			// 4 bytes
+			rtw_write32(padapter, addr, data);
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+	}
+
+	return ret;
+}
+
+/*
+ * Input Format: %s,%d
+ *	%s is width, could be
+ *		"b" for 1 byte
+ *		"w" for WORD (2 bytes)
+ *		"dw" for DWORD (4 bytes)
+ *	%d is address(offset)
+ *
+ * Return:
+ *	%d for data readed
+ */
+static int rtw_mp_read_reg(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	char input[wrqu->length];
+	char *pch, *pnext, *ptmp;
+	char *width_str;
+	char width;
+	char data[20],tmp[20];
+	u32 addr;
+	//u32 *data = (u32*)extra;
+	u32 ret, i=0, j=0, strtout=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (wrqu->length > 128) return -EFAULT;
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	_rtw_memset(data, 0, 20);
+	_rtw_memset(tmp, 0, 20);
+	_rtw_memset(extra, 0, wrqu->length);
+
+	pch = input;
+	pnext = strpbrk(pch, " ,.-");
+	if (pnext == NULL) return -EINVAL;
+	*pnext = 0;
+	width_str = pch;
+
+	pch = pnext + 1;
+	if ((pch - input) >= wrqu->length) return -EINVAL;
+	
+	addr = simple_strtoul(pch, &ptmp, 16);
+	if (addr > 0x3FFF) return -EINVAL;
+
+	ret = 0;
+	width = width_str[0];
+	switch (width) {
+		case 'b':
+			// 1 byte
+			// *(u8*)data = rtw_read8(padapter, addr);
+			sprintf(extra, "%d\n",  rtw_read8(padapter, addr));
+			wrqu->length = strlen(extra);
+			break;
+		case 'w':
+			// 2 bytes
+			//*(u16*)data = rtw_read16(padapter, addr);
+			sprintf(data, "%04d\n", rtw_read16(padapter, addr));
+			for( i=0 ; i <= strlen(data) ; i++)
+				{
+					  if( i%2==0 )
+					  {
+						   tmp[j]=' ';
+						   j++;
+					  }
+					  if ( data[i] != '\0' )
+					 	 tmp[j] = data[i];
+					 	
+					  	 j++;
+				}
+				pch = tmp;		
+				DBG_871X("pch=%s",pch);
+				
+				while( *pch != '\0' )
+				{
+					pnext = strpbrk(pch, " ");
+					pnext++;
+					if ( *pnext != '\0' )
+					{
+						  strtout = simple_strtoul (pnext , &ptmp, 16);
+						  sprintf( extra, "%s %d" ,extra ,strtout );
+					}
+					else{
+						  break;
+					}
+					pch = pnext;
+				}
+			wrqu->length = 6;
+			break;
+		case 'd':
+			// 4 bytes
+			//*data = rtw_read32(padapter, addr);
+			sprintf(data, "%08x", rtw_read32(padapter, addr));
+				//add read data format blank
+				for( i=0 ; i <= strlen(data) ; i++)
+				{
+					  if( i%2==0 )
+					  {
+						   tmp[j]=' ';
+						   j++;
+					  }
+					  tmp[j] = data[i];
+					  j++;
+				}
+				pch = tmp;		
+				DBG_871X("pch=%s",pch);
+				
+				while( *pch != '\0' )
+				{
+					pnext = strpbrk(pch, " ");
+					pnext++;
+					if ( *pnext != '\0' )
+					{
+						  strtout = simple_strtoul (pnext , &ptmp, 16);
+						  sprintf( extra, "%s %d" ,extra ,strtout );
+					}
+					else{
+			break;
+					}
+					pch = pnext;
+				}
+			wrqu->length = strlen(extra);
+			break;
+			
+		default:
+			wrqu->length = 0;
+			ret = -EINVAL;
+			break;
+			
+	}
+
+	return ret;
+}
+
+/*
+ * Input Format: %d,%x,%x
+ *	%d is RF path, should be smaller than MAX_RF_PATH_NUMS
+ *	1st %x is address(offset)
+ *	2st %x is data to write
+ */
+ static int rtw_mp_write_rf(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{			
+/*static int rtw_mp_write_rf(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+*/
+	u32 path, addr, data;
+	int ret;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	ret = sscanf(extra, "%d,%x,%x", &path, &addr, &data);
+	if (ret < 3) return -EINVAL;
+
+	if (path >= MAX_RF_PATH_NUMS) return -EINVAL;
+	if (addr > 0xFF) return -EINVAL;
+	if (data > 0xFFFFF) return -EINVAL;
+	_rtw_memset(extra, 0, wrqu->length);
+
+	write_rfreg(padapter, path, addr, data);
+
+	sprintf(extra, "write_rf completed \n");
+	
+	return 0;
+}
+
+/*
+ * Input Format: %d,%x
+ *	%d is RF path, should be smaller than MAX_RF_PATH_NUMS
+ *	%x is address(offset)
+ *
+ * Return:
+ *	%d for data readed
+ */
+static int rtw_mp_read_rf(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	char input[wrqu->length];
+	char *pch, *pnext, *ptmp;
+	char data[20],tmp[20];
+	//u32 *data = (u32*)extra;
+	u32 path, addr;
+	u32 ret,i=0 ,j=0,strtou=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	if (wrqu->length > 128) return -EFAULT;
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	ret = sscanf(input, "%d,%x", &path, &addr);
+	if (ret < 2) return -EINVAL;
+
+	if (path >= MAX_RF_PATH_NUMS) return -EINVAL;
+	if (addr > 0xFF) return -EINVAL;
+
+	_rtw_memset(extra, 0, wrqu->length);
+	
+	//*data = read_rfreg(padapter, path, addr);
+	sprintf(data, "%08x", read_rfreg(padapter, path, addr));
+				//add read data format blank
+				for( i=0 ; i <= strlen(data) ; i++)
+				{
+					  if( i%2==0 )
+					  {
+						   tmp[j]=' ';
+						   j++;
+					  }
+					  tmp[j] = data[i];
+					  j++;
+				}
+				pch = tmp;		
+				DBG_871X("pch=%s",pch);
+				
+				while( *pch != '\0' )
+				{
+					pnext = strpbrk(pch, " ");
+					pnext++;
+					if ( *pnext != '\0' )
+					{
+						  strtou = simple_strtoul (pnext , &ptmp, 16);
+						  sprintf( extra, "%s %d" ,extra ,strtou );
+					}
+					else{
+						  break;
+					}
+					pch = pnext;
+				}
+			wrqu->length = strlen(extra);
+
+	return 0;
+}
+
+static int rtw_mp_start(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 val8;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	if (padapter->registrypriv.mp_mode == 0)
+		return -EPERM;
+
+	if (padapter->mppriv.mode == MP_OFF) {
+		if (mp_start_test(padapter) == _FAIL)
+			return -EPERM;
+		padapter->mppriv.mode = MP_ON;
+	}
+
+	return 0;
+}
+
+static int rtw_mp_stop(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	if (padapter->mppriv.mode != MP_OFF) {
+		mp_stop_test(padapter);
+		padapter->mppriv.mode = MP_OFF;
+	}
+
+	return 0;
+}
+
+extern int wifirate2_ratetbl_inx(unsigned char rate);
+
+static int rtw_mp_rate(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 rate = MPT_RATE_1M;
+	u8 		input[wrqu->length];
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+			
+	rate = rtw_atoi(input);
+	sprintf( extra, "Set data rate to %d" , rate );
+		
+	if(rate <= 0x7f)
+		rate = wifirate2_ratetbl_inx( (u8)rate);	
+	else 
+		rate =(rate-0x80+MPT_RATE_MCS0);
+
+	//DBG_871X("%s: rate=%d\n", __func__, rate);
+	
+	if (rate >= MPT_RATE_LAST )	
+	return -EINVAL;
+
+	padapter->mppriv.rateidx = rate;
+	Hal_SetDataRate(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_channel(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+	u32 	channel = 1;
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+	
+	channel = rtw_atoi(input);
+	//DBG_871X("%s: channel=%d\n", __func__, channel);
+	sprintf( extra, "Change channel %d to channel %d", padapter->mppriv.channel , channel );
+
+	padapter->mppriv.channel = channel;
+	Hal_SetChannel(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_bandwidth(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 bandwidth=0, sg=0;
+	//u8 buffer[40];
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	//if (copy_from_user(buffer, (void*)wrqu->data.pointer, wrqu->data.length))
+    //            return -EFAULT;
+                
+	//DBG_871X("%s:iwpriv in=%s\n", __func__, extra);
+	
+	sscanf(extra, "40M=%d,shortGI=%d", &bandwidth, &sg);
+	
+	if (bandwidth != HT_CHANNEL_WIDTH_40)
+		bandwidth = HT_CHANNEL_WIDTH_20;
+
+	//DBG_871X("%s: bw=%d sg=%d \n", __func__, bandwidth , sg);
+	
+	padapter->mppriv.bandwidth = (u8)bandwidth;
+	padapter->mppriv.preamble = sg;
+	
+	SetBandwidth(padapter);
+
+	return 0;
+}
+
+static int rtw_mp_txpower(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32		idx_a=0,idx_b=0;
+	u8 		input[wrqu->length];
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	sscanf(input,"patha=%d,pathb=%d",&idx_a,&idx_b);
+	//DBG_871X("%s: tx_pwr_idx_a=%x b=%x\n", __func__, idx_a, idx_b);
+
+	sprintf( extra, "Set power level path_A:%d path_B:%d", idx_a , idx_b );
+	padapter->mppriv.txpoweridx = (u8)idx_a;
+	padapter->mppriv.txpoweridx_b = (u8)idx_b;
+	
+	Hal_SetAntennaPathPower(padapter);
+	
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_ant_tx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 i;
+	u8 		input[wrqu->length];
+	u16 antenna = 0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+			
+	//DBG_871X("%s: input=%s\n", __func__, input);	
+	
+	sprintf( extra, "switch Tx antenna to %s", input );
+	
+	for (i=0; i < strlen(input); i++)
+	{
+		switch(input[i])
+			{
+				case 'a' :
+								antenna|=ANTENNA_A;
+								break;
+				case 'b':
+								antenna|=ANTENNA_B;
+								break;
+			}
+	}
+	//antenna |= BIT(extra[i]-'a');
+	//DBG_871X("%s: antenna=0x%x\n", __func__, antenna);		
+	padapter->mppriv.antenna_tx = antenna;
+	//DBG_871X("%s:mppriv.antenna_rx=%d\n", __func__, padapter->mppriv.antenna_tx);
+	
+	Hal_SetAntenna(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_ant_rx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 i;
+	u16 antenna = 0;
+	u8 		input[wrqu->length];
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+	//DBG_871X("%s: input=%s\n", __func__, input);
+	_rtw_memset(extra, 0, wrqu->length);
+	
+	sprintf( extra, "switch Rx antenna to %s", input );
+	
+	for (i=0; i < strlen(input); i++) {
+	
+	switch( input[i] )
+			{
+				case 'a' :
+								antenna|=ANTENNA_A;
+								break;
+				case 'b':
+								antenna|=ANTENNA_B;
+								break;
+			}
+	}
+	
+	//DBG_871X("%s: antenna=0x%x\n", __func__, antenna);		
+	padapter->mppriv.antenna_rx = antenna;
+	//DBG_871X("%s:mppriv.antenna_rx=%d\n", __func__, padapter->mppriv.antenna_rx);
+	Hal_SetAntenna(padapter);
+	wrqu->length = strlen(extra);
+	
+	return 0;
+}
+
+static int rtw_mp_ctx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 pkTx = 1, countPkTx = 1, cotuTx = 1, CarrSprTx = 1, scTx = 1, sgleTx = 1, stop = 1;
+	u32 bStartTest = 1;
+	u32 count = 0;
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	pmp_priv = &padapter->mppriv;
+
+	if (copy_from_user(extra, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+			
+	DBG_871X("%s: in=%s\n", __func__, extra);
+
+	countPkTx = strncmp(extra, "count=", 5); // strncmp TRUE is 0
+	cotuTx = strncmp(extra, "background", 20);
+	CarrSprTx = strncmp(extra, "background,cs", 20);
+	scTx = strncmp(extra, "background,sc", 20);
+	sgleTx = strncmp(extra, "background,stone", 20);
+	pkTx = strncmp(extra, "background,pkt", 20);
+	stop = strncmp(extra, "stop", 5);
+	sscanf(extra, "count=%d,pkt", &count);
+	
+	//DBG_871X("%s: count=%d countPkTx=%d cotuTx=%d CarrSprTx=%d scTx=%d sgleTx=%d pkTx=%d stop=%d\n", __func__, count, countPkTx, cotuTx, CarrSprTx, pkTx, sgleTx, scTx, stop);
+	_rtw_memset(extra, '\0', sizeof(extra));
+	
+	if (stop == 0) {
+		bStartTest = 0; // To set Stop
+		pmp_priv->tx.stop = 1;
+		sprintf( extra, "Stop continuous Tx");
+	} else {
+		bStartTest = 1;
+		if (pmp_priv->mode != MP_ON) {
+			if (pmp_priv->tx.stop != 1) {
+				DBG_871X("%s: MP_MODE != ON %d\n", __func__, pmp_priv->mode);
+				return  -EFAULT;
+			}
+		}
+	}
+
+	if (pkTx == 0 || countPkTx == 0)
+		pmp_priv->mode = MP_PACKET_TX;
+	if (sgleTx == 0)
+		pmp_priv->mode = MP_SINGLE_TONE_TX;
+	if (cotuTx == 0)
+		pmp_priv->mode = MP_CONTINUOUS_TX;
+	if (CarrSprTx == 0)
+		pmp_priv->mode = MP_CARRIER_SUPPRISSION_TX;
+	if (scTx == 0)
+		pmp_priv->mode = MP_SINGLE_CARRIER_TX;
+
+	switch (pmp_priv->mode)
+	{
+		case MP_PACKET_TX:
+		
+			//DBG_871X("%s:pkTx %d\n", __func__,bStartTest);
+			if (bStartTest == 0)
+			{
+				pmp_priv->tx.stop = 1;
+				pmp_priv->mode = MP_ON;
+				sprintf( extra, "Stop continuous Tx");
+			}
+			else if (pmp_priv->tx.stop == 1)
+			{
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 count=%u,\n",count);
+				//DBG_871X("%s:countPkTx %d\n", __func__,count);
+				pmp_priv->tx.stop = 0;
+				pmp_priv->tx.count = count;
+				pmp_priv->tx.payload = 2;
+				pattrib = &pmp_priv->tx.attrib;
+				pattrib->pktlen = 1460;
+				_rtw_memset(pattrib->dst, 0xFF, ETH_ALEN);
+				SetPacketTx(padapter);
+			} 
+			else {
+				//DBG_871X("%s: pkTx not stop\n", __func__);
+				return -EFAULT;
+			}
+				wrqu->length = strlen(extra);
+				return 0;
+
+		case MP_SINGLE_TONE_TX:
+			//DBG_871X("%s: sgleTx %d \n", __func__, bStartTest);
+			if (bStartTest != 0){
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+            		
+           		 }
+			Hal_SetSingleToneTx(padapter, (u8)bStartTest);
+			break;
+
+		case MP_CONTINUOUS_TX:
+			DBG_871X("%s: cotuTx %d\n", __func__, bStartTest);
+			if (bStartTest != 0){
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+           		 }
+			 Hal_SetContinuousTx(padapter, (u8)bStartTest);
+			break;
+
+		case MP_CARRIER_SUPPRISSION_TX:
+			//DBG_871X("%s: CarrSprTx %d\n", __func__, bStartTest);
+			if (bStartTest != 0){
+				if( pmp_priv->rateidx <= MPT_RATE_11M ) 
+				{
+					sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+				}else
+					sprintf( extra, "Specify carrier suppression but not CCK rate");
+			}
+			Hal_SetCarrierSuppressionTx(padapter, (u8)bStartTest);
+			break;
+
+		case MP_SINGLE_CARRIER_TX:
+			//DBG_871X("%s: scTx %d\n", __func__, bStartTest);
+			if (bStartTest != 0){
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+			}
+			Hal_SetSingleCarrierTx(padapter, (u8)bStartTest);
+			break;
+
+		default:
+			//DBG_871X("%s:No Match MP_MODE\n", __func__);
+			sprintf( extra, "Error! Continuous-Tx is not on-going.");
+			return -EFAULT;
+	}
+
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &padapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			//DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(padapter);
+	} else {
+		pmp_priv->mode = MP_ON;
+	}
+
+	wrqu->length = strlen(extra);
+	return 0;
+}
+
+static int rtw_mp_arx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 bStartRx=0,bStopRx=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	DBG_871X("%s: %s\n", __func__, input);
+
+	bStartRx = (strncmp(input, "start", 5)==0)?1:0; // strncmp TRUE is 0
+	bStopRx = (strncmp(input, "stop", 5)==0)?1:0; // strncmp TRUE is 0
+	SetPacketRx(padapter, bStartRx);
+
+	if(bStartRx)
+	{
+		sprintf( extra, "start");
+		wrqu->length = strlen(extra) + 1;
+	}
+	else if(bStopRx)
+	{
+		sprintf( extra, "Received packet OK:%d CRC error:%d",padapter->mppriv.rx_pktcount,
+														padapter->mppriv.rx_crcerrpktcount);
+		wrqu->length = strlen(extra) + 1;
+	}
+	
+
+	return 0;
+}
+
+static int rtw_mp_trx_query(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 txok,txfail,rxok,rxfail;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	//if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
+	//	return -EFAULT;
+
+	txok=padapter->mppriv.tx.sended;
+	txfail=0;
+	rxok = padapter->mppriv.rx_pktcount;
+	rxfail = padapter->mppriv.rx_crcerrpktcount;
+
+	_rtw_memset(extra, '\0', 128);
+
+	sprintf(extra, "Tx OK:%d, Tx Fail:%d, Rx OK:%d, CRC error:%d ", txok, txfail,rxok,rxfail);
+
+	wrqu->length=strlen(extra)+1;
+
+	return 0;
+}
+
+static int rtw_mp_pwrtrk(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 enable;
+	u32 thermal;
+	s32 ret;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	_rtw_memset(extra, 0, wrqu->length);
+		
+	enable = 1;
+	if (wrqu->length > 1) { // not empty string
+		if (strncmp(input, "stop", 4) == 0)
+		{	
+			enable = 0;
+			sprintf(extra, "mp tx power tracking stop");
+		}
+		else if (sscanf(input, "ther=%d", &thermal)) {
+				ret = Hal_SetThermalMeter(padapter, (u8)thermal);
+				if (ret == _FAIL) return -EPERM;
+				sprintf(extra, "mp tx power tracking start,target value=%d ok ",thermal);
+		}else	{
+			return -EINVAL;
+		}
+	}
+
+	ret = Hal_SetPowerTracking(padapter, enable);
+	if (ret == _FAIL) return -EPERM;
+	
+	wrqu->length = strlen(extra);
+
+	return 0;
+}
+
+static int rtw_mp_psd(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+	
+	strcpy(extra,input);
+
+	wrqu->length = mp_query_psd(padapter, extra);
+	
+	return 0;
+}
+
+static int rtw_mp_thermal(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 val;
+	u16 bwrite=1;
+	#ifdef CONFIG_RTL8192C
+		u16 addr=0x78;
+	#endif
+	#ifdef CONFIG_RTL8192D
+		u16 addr=0xc3;
+	#endif
+	u16 cnt=1;
+	u16 max_available_size=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);	
+
+	if (copy_from_user(extra, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	//DBG_871X("print extra %s \n",extra); 
+	 
+	 bwrite = strncmp(extra, "write", 6); // strncmp TRUE is 0
+	 
+	 Hal_GetThermalMeter(padapter, &val);
+	 
+	 if( bwrite == 0 )	
+	 {
+		 //DBG_871X("to write val:%d",val);
+			EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+			if( 2 > max_available_size )
+			{			
+				DBG_871X("no available efuse!\n");
+				return -EFAULT;
+			}	
+			if ( rtw_efuse_map_write(padapter, addr, cnt, &val) == _FAIL )
+			{
+				DBG_871X("rtw_efuse_map_write error \n");			
+				return -EFAULT;
+			} 
+			else
+			{
+				 sprintf(extra, " efuse write ok :%d", val);	
+			}
+	  }
+	  else
+	  {
+			 sprintf(extra, "%d", val);
+	  }
+	wrqu->length = strlen(extra);
+	
+	return 0;
+}
+
+static int rtw_mp_reset_stats(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	
+	pmp_priv = &padapter->mppriv;
+	
+	pmp_priv->tx.sended = 0;
+	padapter->mppriv.rx_pktcount = 0;
+	padapter->mppriv.rx_crcerrpktcount = 0;
+
+	return 0;
+}
+
+static int rtw_mp_dump(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+        u32 value;
+	u8 rf_type,path_nums = 0;
+	u32 i,j=1,path;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	
+	pmp_priv = &padapter->mppriv;
+
+	
+	//if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
+	//	return -EFAULT;
+	
+	if ( strncmp(extra, "all", 4)==0 )
+	{
+			DBG_871X("\n======= MAC REG =======\n");
+			for ( i=0x0;i<0x300;i+=4 )
+			{	
+				if(j%4==1)	DBG_871X("0x%02x",i);
+				DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+				if((j++)%4 == 0)	DBG_871X("\n");	
+			}
+			for( i=0x400;i<0x800;i+=4 )
+			{	
+				if(j%4==1)	DBG_871X("0x%02x",i);
+				DBG_871X(" 0x%08x ",rtw_read32(padapter,i));		
+				if((j++)%4 == 0)	DBG_871X("\n");	
+			}
+			
+			i,j=1;
+			rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+				
+			DBG_871X("\n======= RF REG =======\n");
+			if(( RF_1T2R == rf_type ) ||( RF_1T1R ==rf_type ))	
+				path_nums = 1;
+			else	
+				path_nums = 2;
+				
+			for(path=0;path<path_nums;path++)
+			{
+#ifdef CONFIG_RTL8192D
+			  for (i = 0; i < 0x50; i++)
+#else
+	   		 for (i = 0; i < 0x34; i++)
+#endif
+				{								
+					//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+					value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+					if(j%4==1)	DBG_871X("0x%02x ",i);
+					DBG_871X(" 0x%08x ",value);
+					if((j++)%4==0)	DBG_871X("\n");	
+				}	
+			}
+	}
+	return 0;
+}
+
+static int rtw_mp_phypara(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	char 	input[wrqu->length];
+	u32		valxcap;
+	
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+	
+	DBG_871X("%s:iwpriv in=%s\n", __func__, input);
+	
+	sscanf(input, "xcap=%d", &valxcap);
+
+	if (!IS_HARDWARE_TYPE_8192D(padapter))
+			return 0;
+#ifdef CONFIG_RTL8192D
+	Hal_ProSetCrystalCap( padapter , valxcap );
+#endif
+
+	sprintf( extra, "Set xcap=%d",valxcap );
+	wrqu->length = strlen(extra) + 1;
+	
+return 0;
+
+}
+
+
+/* update Tx AGC offset */
+static int rtw_mp_antBdiff(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+
+
+	// MPT_ProSetTxAGCOffset
+	return 0;
+}
+
+
+static int rtw_mp_set(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	u32 subcmd = wrqu->flags;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (padapter == NULL)
+	{
+		return -ENETDOWN;
+	}
+
+	//_rtw_memset(extra, 0x00, IW_PRIV_SIZE_MASK);
+
+	if (extra == NULL)
+	{
+		wrqu->length = 0;
+		return -EIO;
+	}
+
+	switch(subcmd)
+	{
+	case WRITE_REG :
+			rtw_mp_write_reg (dev,info,wrqu,extra);
+			 break;
+			 
+	case WRITE_RF:
+			rtw_mp_write_rf (dev,info,wrqu,extra);
+			 break; 
+			 
+	case MP_START:
+			DBG_871X("set case mp_start \n");
+			rtw_mp_start (dev,info,wrqu,extra);
+			 break; 
+			 
+	case MP_STOP:
+			DBG_871X("set case mp_stop \n");
+			rtw_mp_stop (dev,info,wrqu,extra);
+			 break; 
+			 
+	case MP_BANDWIDTH:
+			DBG_871X("set case mp_bandwidth \n");
+			rtw_mp_bandwidth (dev,info,wrqu,extra);
+			break;
+			
+	case MP_RESET_STATS:
+			DBG_871X("set case MP_RESET_STATS \n");
+			rtw_mp_reset_stats	(dev,info,wrqu,extra);
+			break;
+			
+	case EFUSE_SET:
+			DBG_871X("efuse set \n");
+			rtw_mp_efuse_set (dev,info,wdata,extra);
+			break;	
+		 		
+	}
+
+	  
+	return 0;		
+}
+
+
+static int rtw_mp_get(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	u32 subcmd = wrqu->flags;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	//DBG_871X("in mp_get extra= %s \n",extra);
+
+	if (padapter == NULL)
+	{
+		return -ENETDOWN;
+	}
+	if (extra == NULL)
+	{
+		wrqu->length = 0;
+		return -EIO;
+	}
+	
+	switch(subcmd)
+	{
+	case MP_PHYPARA:
+			DBG_871X("mp_get  MP_PHYPARA \n");
+			rtw_mp_phypara(dev,info,wrqu,extra);	
+			break;
+
+	case MP_CHANNEL:
+			DBG_871X("set case mp_channel \n");
+			rtw_mp_channel (dev,info,wrqu,extra);
+			break;
+			
+	case READ_REG:
+			DBG_871X("mp_get  READ_REG \n");
+			rtw_mp_read_reg (dev,info,wrqu,extra);
+			 break; 
+	case READ_RF:
+			DBG_871X("mp_get  READ_RF \n");
+			rtw_mp_read_rf (dev,info,wrqu,extra);
+			break; 
+			
+	case MP_RATE:
+			DBG_871X("set case mp_rate \n");
+			rtw_mp_rate (dev,info,wrqu,extra);
+			break;
+			
+	case MP_TXPOWER:
+			DBG_871X("set case MP_TXPOWER \n");
+			rtw_mp_txpower (dev,info,wrqu,extra);
+			break;
+			
+	case MP_ANT_TX:
+			DBG_871X("set case MP_ANT_TX \n");
+			rtw_mp_ant_tx (dev,info,wrqu,extra);
+			break;
+			
+	case MP_ANT_RX:
+			DBG_871X("set case MP_ANT_RX \n");
+			rtw_mp_ant_rx (dev,info,wrqu,extra);
+			break;
+			
+	case MP_QUERY:
+			DBG_871X("mp_get mp_query MP_QUERY \n");
+			rtw_mp_trx_query(dev,info,wrqu,extra);
+			break;
+					
+	case MP_CTX:
+			DBG_871X("set case MP_CTX \n");
+			rtw_mp_ctx (dev,info,wrqu,extra);
+			break;
+			
+	case MP_ARX:
+			DBG_871X("set case MP_ARX \n");
+			rtw_mp_arx (dev,info,wrqu,extra);
+			break;
+			
+	case EFUSE_GET:
+			DBG_871X("efuse get EFUSE_GET \n");
+			rtw_mp_efuse_get(dev,info,wdata,extra);
+		 break; 
+		 
+	case MP_DUMP:
+			DBG_871X("set case MP_DUMP \n");
+			rtw_mp_dump (dev,info,wrqu,extra);
+		 break; 
+	case MP_PSD:
+			DBG_871X("set case MP_PSD \n");
+			rtw_mp_psd (dev,info,wrqu,extra);
+		 break;
+		 
+	case MP_THER:
+			DBG_871X("set case MP_THER \n");
+			rtw_mp_thermal (dev,info,wrqu,extra);
+		break;
+		
+	case MP_PWRTRK:
+			DBG_871X("set case MP_PWRTRK \n");
+			rtw_mp_pwrtrk (dev,info,wrqu,extra);
+			break;			 
+	}
+
+return 0;	
+}
+
+#endif //#if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+static int rtw_wfd_tdls_enable(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	if ( extra[ 0 ] == '0' )
+	{
+		padapter->wdinfo.wfd_tdls_enable = 0;
+	}
+	else
+	{
+		padapter->wdinfo.wfd_tdls_enable = 1;
+	}
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+	
+	return ret;
+}
+
+static int rtw_tdls_weaksec(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	u8 i, j;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	if ( extra[ 0 ] == '0' )
+	{
+		padapter->wdinfo.wfd_tdls_weaksec = 0;
+	}
+	else
+	{
+		padapter->wdinfo.wfd_tdls_weaksec = 1;
+	}
+#endif
+	
+	return ret;
+}
+
+
+static int rtw_tdls_enable(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	_irqL	 irqL;
+	_list	*plist, *phead;
+	s32	index;
+	struct sta_info *psta = NULL;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	u8 tdls_sta[NUM_STA][ETH_ALEN];
+	u8 empty_hwaddr[ETH_ALEN] = { 0x00 };
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	_rtw_memset(tdls_sta, 0x00, sizeof(tdls_sta));
+
+	if ( extra[ 0 ] == '0' )
+	{
+		ptdlsinfo->enable = 0;
+
+		if(pstapriv->asoc_sta_count==1)
+			return ret;
+
+		_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+		for(index=0; index< NUM_STA; index++)
+		{
+			phead = &(pstapriv->sta_hash[index]);
+			plist = get_next(phead);
+			
+			while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+			{
+				psta = LIST_CONTAINOR(plist, struct sta_info ,hash_list);
+
+				plist = get_next(plist);
+
+				if(psta->tdls_sta_state != TDLS_STATE_NONE)
+				{
+					_rtw_memcpy(tdls_sta[index], psta->hwaddr, ETH_ALEN);
+				}
+			}
+		}
+		_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+		for(index=0; index< NUM_STA; index++)
+		{
+			if( !_rtw_memcmp(tdls_sta[index], empty_hwaddr, ETH_ALEN) )
+			{
+				printk("issue tear down to "MAC_FMT"\n", MAC_ARG(tdls_sta[index]));
+				issue_tdls_teardown(padapter, tdls_sta[index]);
+			}
+		}
+		rtw_tdls_cmd(padapter, myid(&(padapter->eeprompriv)), TDLS_RS_RCR);
+		rtw_reset_tdls_info(padapter);
+	}
+	else if ( extra[ 0 ] == '1' )
+	{
+		ptdlsinfo->enable = 1;
+	}
+#endif //CONFIG_TDLS
+	
+	return ret;
+}
+
+static int rtw_tdls_setup(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	u8 i, j;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 mac_addr[ETH_ALEN];
+
+#ifdef CONFIG_WFD
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif // CONFIG_WFD
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+#ifdef CONFIG_WFD
+	if ( _AES_ != padapter->securitypriv.dot11PrivacyAlgrthm )
+	{
+		//	Weak Security situation with AP.
+		if ( 0 == pwdinfo->wfd_tdls_weaksec )
+		{
+			//	Can't send the tdls setup request out!!
+			DBG_871X( "[%s] Current link is not AES, SKIP sending the tdls setup request!!\n", __FUNCTION__ );
+		}
+		else
+		{
+			issue_tdls_setup_req(padapter, mac_addr);
+		}
+	}
+	else
+#endif // CONFIG_WFD
+	{
+		issue_tdls_setup_req(padapter, mac_addr);
+	}
+#endif
+	
+	return ret;
+}
+
+static int rtw_tdls_teardown(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	u8 i,j;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct sta_info *ptdls_sta = NULL;
+	u8 mac_addr[ETH_ALEN];
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo( &(padapter->stapriv), mac_addr);
+	
+	if(ptdls_sta != NULL)
+	{
+		ptdls_sta->stat_code = _RSON_TDLS_TEAR_UN_RSN_;
+		issue_tdls_teardown(padapter, mac_addr);
+	}
+
+#endif //CONFIG_TDLS
+	
+	return ret;
+}
+
+static int rtw_tdls_discovery(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	issue_tdls_dis_req(padapter, NULL);
+
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_ch_switch(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+	if( ptdls_sta == NULL )
+		return ret;
+	ptdlsinfo->ch_sensing=1;
+
+	rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_INIT_CH_SEN);
+
+#endif //CONFIG_TDLS
+
+		return ret;
+}
+	
+static int rtw_tdls_pson(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+
+	issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 1);
+	
+#endif //CONFIG_TDLS
+
+		return ret;
+}
+	
+static int rtw_tdls_psoff(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+	
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+
+	issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 0);
+	
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_setip(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+	u8 i=0, j=0, k=0, tag=0, ip[3] = { 0xff }, *ptr = extra;
+	
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1  );
+
+
+	while( i < 4 )
+	{
+		for( j=0; j < 4; j++)
+		{
+			if( *( extra + j + tag ) == '.' || *( extra + j + tag ) == '\0' )
+			{
+				if( j == 1 )
+					pwfd_info->ip_address[i]=convert_ip_addr( '0', '0', *(extra+(j-1)+tag));
+				if( j == 2 )
+					pwfd_info->ip_address[i]=convert_ip_addr( '0', *(extra+(j-2)+tag), *(extra+(j-1)+tag));
+				if( j == 3 )
+					pwfd_info->ip_address[i]=convert_ip_addr( *(extra+(j-3)+tag), *(extra+(j-2)+tag), *(extra+(j-1)+tag));	
+
+				tag += j + 1;
+				break;
+			}
+		}
+		i++;
+	}
+
+	printk( "[%s] Set IP = %u.%u.%u.%u \n", __FUNCTION__, 
+		ptdlsinfo->wfd_info->ip_address[0], ptdlsinfo->wfd_info->ip_address[1],
+		ptdlsinfo->wfd_info->ip_address[2], ptdlsinfo->wfd_info->ip_address[3]
+	);
+
+#endif //CONFIG_WFD	
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_getip(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+	
+	printk( "[%s]\n", __FUNCTION__);
+
+	sprintf( extra, "\n\n%u.%u.%u.%u\n", 
+		pwfd_info->peer_ip_address[0], pwfd_info->peer_ip_address[1], 
+		pwfd_info->peer_ip_address[2], pwfd_info->peer_ip_address[3]
+		);
+
+	printk( "[%s] IP=%u.%u.%u.%u\n", __FUNCTION__,
+		pwfd_info->peer_ip_address[0], pwfd_info->peer_ip_address[1], 
+		pwfd_info->peer_ip_address[2], pwfd_info->peer_ip_address[3]
+		);
+	
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD	
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_getport(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	sprintf( extra, "\n\n%d\n", pwfd_info->peer_rtsp_ctrlport );
+	printk( "[%s] remote port = %d\n", __FUNCTION__, pwfd_info->peer_rtsp_ctrlport );
+	
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+		
+}
+
+//WFDTDLS, for sigma test
+static int rtw_tdls_dis_result(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	if(ptdlsinfo->dev_discovered == 1 )
+	{
+		sprintf( extra, "\n\nDis=1\n" );
+		ptdlsinfo->dev_discovered = 0;
+	}
+	
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+		
+}
+
+//WFDTDLS, for sigma test
+static int rtw_wfd_tdls_status(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	
+	int ret = 0;	
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	if(ptdlsinfo->setup_state == TDLS_LINKED_STATE )
+	{
+		sprintf( extra, "\n\nStatus=1\n" );
+	}
+	else
+	{
+		sprintf( extra, "\n\nStatus=0\n" );
+	}
+	
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+		
+}
+
+static int rtw_tdls_ch_switch_off(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+	
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+
+	ptdls_sta->tdls_sta_state |= TDLS_SW_OFF_STATE;
+/*
+	if((ptdls_sta->tdls_sta_state & TDLS_AT_OFF_CH_STATE) && (ptdls_sta->tdls_sta_state & TDLS_PEER_AT_OFF_STATE)){
+		pmlmeinfo->tdls_candidate_ch= pmlmeext->cur_channel;
+		issue_tdls_ch_switch_req(padapter, mac_addr);
+		DBG_871X("issue tdls ch switch req back to base channel\n");
+	}
+*/
+	
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	printk( "[%s] extra = %s\n", __FUNCTION__, extra );
+	//	WFD Sigma will use the tdls enable command to let the driver know we want to test the tdls now!
+	if ( _rtw_memcmp( extra, "wfdenable=", 10 ) )
+	{
+		wrqu->data.length -=10;
+		rtw_wfd_tdls_enable( dev, info, wrqu, &extra[10] );
+		return ret;
+	}
+	else if ( _rtw_memcmp( extra, "weaksec=", 8 ) )
+	{
+		wrqu->data.length -=8;
+		rtw_tdls_weaksec( dev, info, wrqu, &extra[8] );
+		return ret;
+	}
+	else if ( _rtw_memcmp( extra, "tdlsenable=", 11 ) )
+	{
+		wrqu->data.length -=11;
+		rtw_tdls_enable( dev, info, wrqu, &extra[11] );
+		return ret;
+	}
+
+	if( padapter->tdlsinfo.enable == 0 )
+	{
+		printk("tdls haven't enabled\n");
+		return 0;
+	}
+
+	if ( _rtw_memcmp( extra, "setup=", 6 ) )
+	{
+		wrqu->data.length -=6;
+		rtw_tdls_setup( dev, info, wrqu, &extra[6] );
+	}
+	else if (_rtw_memcmp( extra, "tear=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_tdls_teardown( dev, info, wrqu, &extra[5] );
+	}
+	else if (_rtw_memcmp( extra, "dis=", 4 ) )
+	{
+		wrqu->data.length -= 4;
+		rtw_tdls_discovery( dev, info, wrqu, &extra[4] );
+	}
+	else if (_rtw_memcmp( extra, "sw=", 3 ) )
+	{
+		wrqu->data.length -= 3;
+		rtw_tdls_ch_switch( dev, info, wrqu, &extra[3] );
+	}
+	else if (_rtw_memcmp( extra, "swoff=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_tdls_ch_switch_off( dev, info, wrqu, &extra[6] );
+	}	
+	else if (_rtw_memcmp( extra, "pson=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_tdls_pson( dev, info, wrqu, &extra[5] );
+	}
+	else if (_rtw_memcmp( extra, "psoff=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_tdls_psoff( dev, info, wrqu, &extra[6] );
+	}
+#ifdef CONFIG_WFD
+	else if (_rtw_memcmp( extra, "setip=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_tdls_setip( dev, info, wrqu, &extra[6] );
+	}
+	else if (_rtw_memcmp( extra, "tprobe=", 6 ) )
+	{
+		issue_tunneled_probe_req((_adapter *)rtw_netdev_priv(dev));
+	}
+#endif //CONFIG_WFD
+
+#endif //CONFIG_TDLS
+	
+	return ret;
+}
+
+
+static int rtw_tdls_get(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_WFD
+
+	DBG_871X( "[%s] extra = %s\n", __FUNCTION__, (char*) wrqu->data.pointer );
+
+	if ( _rtw_memcmp( wrqu->data.pointer, "ip", 2 ) )
+	{
+		rtw_tdls_getip( dev, info, wrqu, extra );
+	}
+	if ( _rtw_memcmp( wrqu->data.pointer, "port", 4 ) )
+	{
+		rtw_tdls_getport( dev, info, wrqu, extra );
+	}
+
+	//WFDTDLS, for sigma test
+	if ( _rtw_memcmp( wrqu->data.pointer, "dis", 3 ) )
+	{
+		rtw_tdls_dis_result( dev, info, wrqu, extra );
+	}
+	if ( _rtw_memcmp( wrqu->data.pointer, "status", 6 ) )
+	{
+		rtw_wfd_tdls_status( dev, info, wrqu, extra );
+	}
+
+#endif //CONFIG_WFD
+
+	return ret;
+}
+
+static int rtw_pm_set(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	unsigned	mode = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	DBG_871X( "[%s] extra = %s\n", __FUNCTION__, extra );
+
+	if ( _rtw_memcmp( extra, "lps=", 4 ) )
+	{
+		sscanf(extra+4, "%u", &mode);	
+		ret = rtw_pm_set_lps(padapter,mode);
+	}
+	else if ( _rtw_memcmp( extra, "ips=", 4 ) )
+	{
+		sscanf(extra+4, "%u", &mode);
+		ret = rtw_pm_set_ips(padapter,mode);
+	}
+	else{
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+#ifdef CONFIG_WOWLAN
+static int rtw_wowlan_ctrl(struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	struct oid_par_priv	oid_par;
+	struct wowlan_ioctl_param *poidparam;
+	uint status=0;
+	u16 len;
+	u8 *pparmbuf = NULL, bset;
+	_adapter *padapter =  (_adapter *)rtw_netdev_priv(dev);
+
+	struct iw_point *p = &wrqu->data;
+
+	//DBG_871X("+rtw_wowlan_ctrl\n");
+
+	//mutex_lock(&ioctl_mutex);
+
+	if ((!p->length) || (!p->pointer)) {
+		ret = -EINVAL;
+		goto _rtw_wowlan_ctrl_exit;
+	}
+
+	pparmbuf = NULL;
+	bset = (u8)(p->flags & 0xFFFF);
+	len = p->length;
+	pparmbuf = (u8*)rtw_malloc(len);
+	if (pparmbuf == NULL){
+		ret = -ENOMEM;
+		goto _rtw_wowlan_ctrl_exit;
+	}
+
+	if (copy_from_user(pparmbuf, p->pointer, len)) {
+		ret = -EFAULT;
+		goto _rtw_wowlan_ctrl_exit_free;
+	}
+	poidparam = (struct wowlan_ioctl_param *)pparmbuf;	
+
+	if(padapter->pwrctrlpriv.bSupportRemoteWakeup==_FALSE){
+		ret = -EPERM;
+		DBG_871X("+rtw_wowlan_ctrl: Device didn't support the remote wakeup!!\n");
+		goto _rtw_wowlan_ctrl_exit_free;
+	}
+	rtw_hal_set_hwreg(padapter,HW_VAR_WOWLAN,(u8 *)poidparam);
+	
+	DBG_871X("rtw_wowlan_ctrl: subcode [%d], len[%d], buffer_len[%d]\r\n",
+        	  poidparam->subcode, poidparam->len, len);
+	
+	if (copy_to_user(p->pointer, pparmbuf, len)) {
+		ret = -EFAULT;
+	}
+	
+	
+_rtw_wowlan_ctrl_exit_free:
+	//DBG_871X("-rtw_wowlan_ctrl( subcode = %d)\n", poidparam->subcode);
+	rtw_mfree(pparmbuf, len);
+_rtw_wowlan_ctrl_exit:
+	
+	
+	return ret;
+}
+#endif //CONFIG_WOWLAN
+
+#ifdef CONFIG_INTEL_WIDI
+static int rtw_widi_set(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	process_intel_widi_cmd(padapter, extra);
+
+	return ret;
+}
+
+static int rtw_widi_set_probe_request(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int	ret = 0;
+	u8	*pbuf = NULL;
+	_adapter	*padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	pbuf = rtw_malloc(sizeof(l2_msg_t));
+	if(pbuf)
+	{
+		copy_from_user(pbuf, wrqu->data.pointer, wrqu->data.length);
+		//_rtw_memcpy(pbuf, wrqu->data.pointer, wrqu->data.length);
+
+		if( wrqu->data.flags == 0 )
+		intel_widi_wk_cmd(padapter, INTEL_WIDI_ISSUE_PROB_WK, pbuf);
+		else if( wrqu->data.flags == 1 )
+			rtw_set_wfd_rds_sink_info( padapter, (l2_msg_t *)pbuf );
+	}
+	return ret;
+}
+
+#endif // CONFIG_INTEL_WIDI
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+#include <rtl8723a_hal.h>
+
+static s32 initLoopback(PADAPTER padapter)
+{
+	PLOOPBACKDATA ploopback;
+
+
+	if (padapter->ploopback == NULL) {
+		ploopback = (PLOOPBACKDATA)rtw_zmalloc(sizeof(LOOPBACKDATA));
+		if (ploopback == NULL) return -ENOMEM;
+
+		_rtw_init_sema(&ploopback->sema, 0);
+
+		ploopback->bstop = _TRUE;
+		ploopback->cnt = 0;
+		ploopback->size = 300;
+		_rtw_memset(ploopback->msg, 0, sizeof(ploopback->msg));
+
+		padapter->ploopback = ploopback;
+	}
+
+	return 0;
+}
+
+static void freeLoopback(PADAPTER padapter)
+{
+	PLOOPBACKDATA ploopback;
+
+
+	ploopback = padapter->ploopback;
+	if (ploopback) {
+		rtw_mfree((u8*)ploopback, sizeof(LOOPBACKDATA));
+		padapter->ploopback = NULL;
+	}
+}
+
+static s32 initpseudoadhoc(PADAPTER padapter)
+{
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networkType;
+	s32 err;
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+	
+	networkType = Ndis802_11IBSS;
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);	
+	err = rtw_set_802_11_infrastructure_mode(padapter, networkType);
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	if (err == _FALSE) return _FAIL;
+
+	err = rtw_setopmode_cmd(padapter, networkType);
+	if (err == _FAIL) return _FAIL;
+
+	return _SUCCESS;
+}
+
+static s32 createpseudoadhoc(PADAPTER padapter)
+{
+	NDIS_802_11_AUTHENTICATION_MODE authmode;
+	struct mlme_priv *pmlmepriv;
+	NDIS_802_11_SSID *passoc_ssid;
+	WLAN_BSSID_EX *pdev_network;
+	u8 *pibss;
+	u8 ssid[] = "pseduo_ad-hoc";
+	s32 err;
+	_irqL irqL;
+
+
+	pmlmepriv = &padapter->mlmepriv;
+
+	authmode = Ndis802_11AuthModeOpen;
+	err = rtw_set_802_11_authentication_mode(padapter, authmode);
+	if (err == _FALSE) return _FAIL;
+
+	passoc_ssid = &pmlmepriv->assoc_ssid;
+	_rtw_memset(passoc_ssid, 0, sizeof(NDIS_802_11_SSID));
+	passoc_ssid->SsidLength = sizeof(ssid) - 1;
+	_rtw_memcpy(passoc_ssid->Ssid, ssid, passoc_ssid->SsidLength);
+
+	pdev_network = &padapter->registrypriv.dev_network;
+	pibss = padapter->registrypriv.dev_network.MacAddress;
+	_rtw_memcpy(&pdev_network->Ssid, passoc_ssid, sizeof(NDIS_802_11_SSID));
+
+	rtw_update_registrypriv_dev_network(padapter);
+	rtw_generate_random_ibss(pibss);
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+#if 0
+	err = rtw_createbss_cmd(padapter);
+	if (err == _FAIL) return _FAIL;
+#else
+{
+	struct wlan_network *pcur_network;
+	struct sta_info *psta;
+
+	//3  create a new psta
+	pcur_network = &pmlmepriv->cur_network;
+
+	//clear psta in the cur_network, if any
+	psta = rtw_get_stainfo(&padapter->stapriv, pcur_network->network.MacAddress);
+	if (psta) rtw_free_stainfo(padapter, psta);
+
+	psta = rtw_alloc_stainfo(&padapter->stapriv, pibss);
+	if (psta == NULL) return _FAIL;
+
+	//3  join psudo AdHoc
+	pcur_network->join_res = 1;
+	pcur_network->aid = psta->aid = 1;
+	_rtw_memcpy(&pcur_network->network, pdev_network, get_WLAN_BSSID_EX_sz(pdev_network));
+
+	// set msr to WIFI_FW_ADHOC_STATE
+#if 0
+	Set_NETYPE0_MSR(padapter, WIFI_FW_ADHOC_STATE);
+#else
+	{
+		u8 val8;
+
+		val8 = rtw_read8(padapter, MSR);
+		val8 &= 0xFC; // clear NETYPE0
+		val8 |= WIFI_FW_ADHOC_STATE & 0x3;
+		rtw_write8(padapter, MSR, val8);
+	}
+#endif
+}
+#endif
+
+	return _SUCCESS;
+}
+
+extern void rtl8723a_cal_txdesc_chksum(struct tx_desc *ptxdesc);
+extern void rtl8723a_fill_default_txdesc(struct xmit_frame *pxmitframe, u8 *pbuf);
+
+static struct xmit_frame* createloopbackpkt(PADAPTER padapter, u32 size)
+{
+	struct xmit_priv *pxmitpriv;
+	struct xmit_frame *pframe;
+	struct xmit_buf *pxmitbuf;
+	struct pkt_attrib *pattrib;
+	struct tx_desc *desc;
+	u8 *pkt_start, *pkt_end, *ptr;
+	struct rtw_ieee80211_hdr *hdr;
+	s32 bmcast;
+	_irqL irqL;
+
+
+	if ((TXDESC_SIZE + WLANHDR_OFFSET + size) > MAX_XMITBUF_SZ) return NULL;
+
+	pxmitpriv = &padapter->xmitpriv;
+	pframe = NULL;
+
+	//2 1. allocate xmit frame
+	pframe = rtw_alloc_xmitframe(pxmitpriv);
+	if (pframe == NULL) return NULL;
+	pframe->padapter = padapter;
+
+	//2 2. allocate xmit buffer
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+	pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+	if (pxmitbuf == NULL) {
+		rtw_free_xmitframe(pxmitpriv, pframe);
+		return NULL;
+	}
+
+	pframe->pxmitbuf = pxmitbuf;
+	pframe->buf_addr = pxmitbuf->pbuf;
+	pxmitbuf->priv_data = pframe;
+
+	//2 3. update_attrib()
+	pattrib = &pframe->attrib;
+
+	// init xmitframe attribute
+	_rtw_memset(pattrib, 0, sizeof(struct pkt_attrib));
+
+	pattrib->ether_type = 0x8723;
+	_rtw_memcpy(pattrib->src, padapter->eeprompriv.mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	_rtw_memset(pattrib->dst, 0xFF, ETH_ALEN);
+	_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+//	pattrib->pctrl = 0;
+//	pattrib->dhcp_pkt = 0;
+//	pattrib->pktlen = 0;
+	pattrib->ack_policy = 0;
+//	pattrib->pkt_hdrlen = ETH_HLEN;
+	pattrib->hdrlen = WLAN_HDR_A3_LEN;
+	pattrib->subtype = WIFI_DATA;
+	pattrib->priority = 0;
+	pattrib->qsel = pattrib->priority;
+//	do_queue_select(padapter, pattrib);
+	pattrib->nr_frags = 1;
+	pattrib->encrypt = 0;
+	pattrib->bswenc = _FALSE;
+	pattrib->qos_en = _FALSE;
+
+	bmcast = IS_MCAST(pattrib->ra);
+	if (bmcast) {
+		pattrib->mac_id = 1;
+		pattrib->psta = rtw_get_bcmc_stainfo(padapter);
+	} else {
+		pattrib->mac_id = 0;
+		pattrib->psta = rtw_get_stainfo(&padapter->stapriv, get_bssid(&padapter->mlmepriv));
+	}
+
+	pattrib->pktlen = size;
+	pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->pktlen;
+
+	//2 4. fill TX descriptor
+	desc = (struct tx_desc*)pframe->buf_addr;
+	_rtw_memset(desc, 0, TXDESC_SIZE);
+
+	rtl8723a_fill_default_txdesc(pframe, (u8*)desc);
+
+	// Hw set sequence number
+	((PTXDESC)desc)->hwseq_en = 0; // HWSEQ_EN, 0:disable, 1:enable
+//	((PTXDESC)desc)->hwseq_sel = 0; // HWSEQ_SEL
+
+	((PTXDESC)desc)->disdatafb = 1;
+
+	// convert to little endian
+	desc->txdw0 = cpu_to_le32(desc->txdw0);
+	desc->txdw1 = cpu_to_le32(desc->txdw1);
+	desc->txdw2 = cpu_to_le32(desc->txdw2);
+	desc->txdw3 = cpu_to_le32(desc->txdw3);
+	desc->txdw4 = cpu_to_le32(desc->txdw4);
+	desc->txdw5 = cpu_to_le32(desc->txdw5);
+	desc->txdw6 = cpu_to_le32(desc->txdw6);
+	desc->txdw7 = cpu_to_le32(desc->txdw7);
+#ifdef CONFIG_PCI_HCI
+	desc->txdw8 = cpu_to_le32(desc->txdw8);
+	desc->txdw9 = cpu_to_le32(desc->txdw9);
+	desc->txdw10 = cpu_to_le32(desc->txdw10);
+	desc->txdw11 = cpu_to_le32(desc->txdw11);
+	desc->txdw12 = cpu_to_le32(desc->txdw12);
+	desc->txdw13 = cpu_to_le32(desc->txdw13);
+	desc->txdw14 = cpu_to_le32(desc->txdw14);
+	desc->txdw15 = cpu_to_le32(desc->txdw15);
+#endif
+
+	rtl8723a_cal_txdesc_chksum(desc);
+
+	//2 5. coalesce
+	pkt_start = pframe->buf_addr + TXDESC_SIZE;
+	pkt_end = pkt_start + pattrib->last_txcmdsz;
+
+	//3 5.1. make wlan header, make_wlanhdr()
+	hdr = (struct rtw_ieee80211_hdr *)pkt_start;
+	SetFrameSubType(&hdr->frame_ctl, pattrib->subtype);
+	_rtw_memcpy(hdr->addr1, pattrib->dst, ETH_ALEN); // DA
+	_rtw_memcpy(hdr->addr2, pattrib->src, ETH_ALEN); // SA
+	_rtw_memcpy(hdr->addr3, get_bssid(&padapter->mlmepriv), ETH_ALEN); // RA, BSSID
+
+	//3 5.2. make payload
+	ptr = pkt_start + pattrib->hdrlen;
+	get_random_bytes(ptr, pkt_end - ptr);
+
+	pxmitbuf->len = TXDESC_SIZE + pattrib->last_txcmdsz;
+	pxmitbuf->ptail += pxmitbuf->len;
+
+	return pframe;
+}
+
+static void freeloopbackpkt(PADAPTER padapter, struct xmit_frame *pframe)
+{
+	struct xmit_priv *pxmitpriv;
+	struct xmit_buf *pxmitbuf;
+
+
+	pxmitpriv = &padapter->xmitpriv;
+	pxmitbuf = pframe->pxmitbuf;
+
+	rtw_free_xmitframe(pxmitpriv, pframe);
+	rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+}
+
+extern u32 get_txfifo_hwaddr(struct xmit_frame *pxmitframe);
+
+thread_return lbk_thread(thread_context context)
+{
+	s32 err;
+	PADAPTER padapter;
+	PLOOPBACKDATA ploopback;
+	struct xmit_frame *pxmitframe;
+	u32 cnt, ok, fail, i, headerlen;
+	u32 pktsize;
+	u32 ff_hwaddr;
+
+
+	padapter = (PADAPTER)context;
+	ploopback = padapter->ploopback;
+	if (ploopback == NULL) return -1;
+	cnt = 0;
+	ok = 0;
+	fail = 0;
+
+	daemonize("%s", "RTW_LBK_THREAD");
+	allow_signal(SIGTERM);
+
+	do {
+		if (ploopback->size == 0) {
+			get_random_bytes(&pktsize, 4);
+			pktsize = (pktsize % 1535) + 1; // 1~1535
+		} else
+			pktsize = ploopback->size;
+		
+		pxmitframe = createloopbackpkt(padapter, pktsize);
+		if (pxmitframe == NULL) {
+			sprintf(ploopback->msg, "loopback FAIL! 3. create Packet FAIL!");
+			break;
+		}
+		
+		ploopback->txsize = TXDESC_SIZE + pxmitframe->attrib.last_txcmdsz;
+		_rtw_memcpy(ploopback->txbuf, pxmitframe->buf_addr, ploopback->txsize);
+		
+		ff_hwaddr = get_txfifo_hwaddr(pxmitframe);
+		rtw_write_port(padapter, ff_hwaddr, ploopback->txsize, ploopback->txbuf);
+		cnt++;
+
+		_rtw_down_sema(&ploopback->sema);
+
+{
+		PHAL_DATA_TYPE phal;
+		struct recv_stat *prxstat;
+		struct recv_stat report;
+		PRXREPORT prxreport;
+		u32 drvinfosize;
+		u32 rxpktsize;
+		u8 fcssize;
+
+		prxstat = (struct recv_stat*)ploopback->rxbuf;
+		report.rxdw0 = le32_to_cpu(prxstat->rxdw0);
+		report.rxdw1 = le32_to_cpu(prxstat->rxdw1);
+		report.rxdw2 = le32_to_cpu(prxstat->rxdw2);
+		report.rxdw3 = le32_to_cpu(prxstat->rxdw3);
+		report.rxdw4 = le32_to_cpu(prxstat->rxdw4);
+		report.rxdw5 = le32_to_cpu(prxstat->rxdw5);
+
+		prxreport = (PRXREPORT)&report;
+		drvinfosize = prxreport->drvinfosize << 3;
+		rxpktsize = prxreport->pktlen;
+
+		phal = GET_HAL_DATA(padapter);
+		if (phal->ReceiveConfig & RCR_APPFCS) fcssize = IEEE80211_FCS_LEN;
+		else fcssize = 0;
+
+		if ((ploopback->txsize - TXDESC_SIZE) != (rxpktsize - fcssize)) {
+			printk("%s: cnt=%d, size not match! tx=%d rx=%d\n",
+				__func__, i, ploopback->txsize - TXDESC_SIZE,
+				rxpktsize - fcssize);
+			err = _FALSE;
+		} else {
+			err = _rtw_memcmp(ploopback->txbuf + TXDESC_SIZE,\
+							  ploopback->rxbuf + RXDESC_SIZE + drvinfosize,\
+							  ploopback->txsize - TXDESC_SIZE);
+		}
+}
+
+		if (err == _TRUE)
+			ok++;
+		else
+			fail++;
+
+		ploopback->txsize = 0;
+		_rtw_memset(ploopback->txbuf, 0, 0x8000);
+		ploopback->rxsize = 0;
+		_rtw_memset(ploopback->rxbuf, 0, 0x8000);
+
+		freeloopbackpkt(padapter, pxmitframe);
+		pxmitframe = NULL;
+
+		if (signal_pending(current)) {
+			flush_signals(current);
+		}
+
+		if ((ploopback->bstop == _TRUE) ||
+			((ploopback->cnt != 0) && (ploopback->cnt == cnt)))
+		{
+			u32 ok_rate, fail_rate;
+			ok_rate = (ok*100)/cnt;
+			fail_rate = (fail*100)/cnt;
+			sprintf(ploopback->msg, "loopback result: ok=%d%%(%d/%d),error=%d%%(%d/%d)", ok_rate, ok, cnt, fail_rate, fail, cnt);
+			break;
+		}
+	} while (1);
+
+	ploopback->bstop = _TRUE;
+
+	thread_exit();
+}
+
+static void loopbackTest(PADAPTER padapter, u32 cnt, u32 size, u8* pmsg)
+{
+	PLOOPBACKDATA ploopback;
+	u32 len;
+	s32 err;
+
+
+	ploopback = padapter->ploopback;
+
+	if (ploopback)
+	{
+		ploopback->bstop = _TRUE;
+		len = 0;
+		do {
+			len = strlen(ploopback->msg);
+			if (len) break;
+			rtw_msleep_os(1);
+		} while (1);
+		_rtw_memcpy(pmsg, ploopback->msg, len+1);
+		freeLoopback(padapter);
+		return;
+	}
+	
+	// create pseudo ad-hoc connection
+	err = initpseudoadhoc(padapter);
+	if (err == _FAIL) {
+		sprintf(pmsg, "loopback FAIL! 1.1 init ad-hoc FAIL!");
+		return;
+	}
+
+	err = createpseudoadhoc(padapter);
+	if (err == _FAIL) {
+		sprintf(pmsg, "loopback FAIL! 1.2 create ad-hoc master FAIL!");
+		return;
+	}
+
+	err = initLoopback(padapter);
+	if (err) {
+		sprintf(pmsg, "loopback FAIL! 2. init FAIL! error code=%d", err);
+		return;
+	}
+
+	ploopback = padapter->ploopback;
+
+	ploopback->bstop = _FALSE;
+	ploopback->cnt = cnt;
+	ploopback->size = size;
+	ploopback->lbkthread = kthread_run(lbk_thread, padapter, "RTW_LBK_THREAD");
+	if (IS_ERR(padapter->lbkthread))
+	{
+		freeLoopback(padapter);
+		sprintf(pmsg, "loopback start FAIL! cnt=%d", cnt);
+		return;
+	}
+
+	sprintf(pmsg, "loopback start! cnt=%d", cnt);
+}
+
+extern u8 _InitPowerOn(PADAPTER padapter);
+extern s32 rtl8723a_FirmwareDownload(PADAPTER padapter);
+
+static int rtw_test(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+	u32 len;
+	u8 *pbuf, *pch;
+	char *ptmp;
+	u8 *delim = ",";
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	printk("+%s\n", __func__);
+	len = wrqu->data.length;
+
+	pbuf = (u8*)rtw_zmalloc(len);
+	if (pbuf == NULL) {
+		printk("%s: no memory!\n", __func__);
+		return -ENOMEM;
+	}
+
+	if (copy_from_user(pbuf, wrqu->data.pointer, len)) {
+		rtw_mfree(pbuf, len);
+		printk("%s: copy from user fail!\n", __func__);
+		return -EFAULT;
+	}
+	printk("%s: string=\"%s\"\n", __func__, pbuf);
+
+	ptmp = (char*)pbuf;
+	pch = strsep(&ptmp, delim);
+	if ((pch == NULL) || (strlen(pch) == 0)) {
+		rtw_mfree(pbuf, len);
+		printk("%s: parameter error(level 1)!\n", __func__);
+		return -EFAULT;
+	}
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+	if (strcmp(pch, "loopback") == 0)
+	{
+		s32 cnt = 0;
+		u32 size = 64;
+
+		pch = strsep(&ptmp, delim);
+		if ((pch == NULL) || (strlen(pch) == 0)) {
+			rtw_mfree(pbuf, len);
+			printk("%s: parameter error(level 2)!\n", __func__);
+			return -EFAULT;
+		}
+
+		sscanf(pch, "%d", &cnt);
+		printk("%s: loopback cnt=%d\n", __func__, cnt);
+
+		pch = strsep(&ptmp, delim);
+		if ((pch == NULL) || (strlen(pch) == 0)) {
+			rtw_mfree(pbuf, len);
+			printk("%s: parameter error(level 2)!\n", __func__);
+			return -EFAULT;
+		}
+
+		sscanf(pch, "%d", &size);
+		printk("%s: loopback size=%d\n", __func__, size);
+
+		loopbackTest(padapter, cnt, size, extra);
+		wrqu->data.length = strlen(extra) + 1;
+
+		rtw_mfree(pbuf, len);
+		return 0;
+	}
+#endif
+
+	if (strcmp(pch, "poweron") == 0)
+	{
+		s32 ret;
+
+		ret = _InitPowerOn(padapter);
+		if (_FAIL == ret)
+			printk("%s: power on FAIL!\n", __func__);
+		else
+			printk("%s: power on OK.\n", __func__);
+
+		rtw_mfree(pbuf, len);
+		return 0;
+	}
+
+	if (strcmp(pch, "dlfw") == 0)
+	{
+		s32 ret;
+
+		ret = rtl8723a_FirmwareDownload(padapter);
+		if (_FAIL == ret)
+			printk("%s: download FW FAIL!\n", __func__);
+		else
+			printk("%s: download FW OK.\n", __func__);
+
+		rtw_mfree(pbuf, len);
+		return 0;
+	}
+
+	rtw_mfree(pbuf, len);
+	return 0;
+}
+#else
+static int rtw_test(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+	printk("%s\n", __func__);
+	return 0;
+}
+#endif //RTL8723A_SDIO_LOOPBACK
+
+#include <rtw_android.h>
+int rtw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	struct iwreq *wrq = (struct iwreq *)rq;
+	int ret=0;
+
+	switch (cmd)
+	{
+	    case RTL_IOCTL_WPA_SUPPLICANT:	
+			ret = wpa_supplicant_ioctl(dev, &wrq->u.data);
+			break;
+#ifdef CONFIG_AP_MODE
+		case RTL_IOCTL_HOSTAPD:
+			ret = rtw_hostapd_ioctl(dev, &wrq->u.data);			
+			break;
+#ifdef CONFIG_NO_WIRELESS_HANDLERS			
+		case SIOCSIWMODE:
+			ret = rtw_wx_set_mode(dev, NULL, &wrq->u, NULL);
+			break;
+#endif			
+#endif
+		case (SIOCDEVPRIVATE+1):
+			ret = rtw_android_priv_cmd(dev, rq, cmd);
+			break;
+	    default:
+			ret = -EOPNOTSUPP;
+			break;
+	}
+	
+	return ret;
+}
+
+static iw_handler rtw_handlers[] =
+{
+	NULL,					/* SIOCSIWCOMMIT */
+	rtw_wx_get_name,		/* SIOCGIWNAME */
+	dummy,					/* SIOCSIWNWID */
+	dummy,					/* SIOCGIWNWID */
+	rtw_wx_set_freq,		/* SIOCSIWFREQ */
+	rtw_wx_get_freq,		/* SIOCGIWFREQ */
+	rtw_wx_set_mode,		/* SIOCSIWMODE */
+	rtw_wx_get_mode,		/* SIOCGIWMODE */
+	dummy,					/* SIOCSIWSENS */
+	rtw_wx_get_sens,		/* SIOCGIWSENS */
+	NULL,					/* SIOCSIWRANGE */
+	rtw_wx_get_range,		/* SIOCGIWRANGE */
+	rtw_wx_set_priv,		/* SIOCSIWPRIV */
+	NULL,					/* SIOCGIWPRIV */
+	NULL,					/* SIOCSIWSTATS */
+	NULL,					/* SIOCGIWSTATS */
+	dummy,					/* SIOCSIWSPY */
+	dummy,					/* SIOCGIWSPY */
+	NULL,					/* SIOCGIWTHRSPY */
+	NULL,					/* SIOCWIWTHRSPY */
+	rtw_wx_set_wap,		/* SIOCSIWAP */
+	rtw_wx_get_wap,		/* SIOCGIWAP */
+	rtw_wx_set_mlme,		/* request MLME operation; uses struct iw_mlme */
+	dummy,					/* SIOCGIWAPLIST -- depricated */
+	rtw_wx_set_scan,		/* SIOCSIWSCAN */
+	rtw_wx_get_scan,		/* SIOCGIWSCAN */
+	rtw_wx_set_essid,		/* SIOCSIWESSID */
+	rtw_wx_get_essid,		/* SIOCGIWESSID */
+	dummy,					/* SIOCSIWNICKN */
+	rtw_wx_get_nick,		/* SIOCGIWNICKN */
+	NULL,					/* -- hole -- */
+	NULL,					/* -- hole -- */
+	rtw_wx_set_rate,		/* SIOCSIWRATE */
+	rtw_wx_get_rate,		/* SIOCGIWRATE */
+	rtw_wx_set_rts,			/* SIOCSIWRTS */
+	rtw_wx_get_rts,			/* SIOCGIWRTS */
+	rtw_wx_set_frag,		/* SIOCSIWFRAG */
+	rtw_wx_get_frag,		/* SIOCGIWFRAG */
+	dummy,					/* SIOCSIWTXPOW */
+	dummy,					/* SIOCGIWTXPOW */
+	dummy,					/* SIOCSIWRETRY */
+	rtw_wx_get_retry,		/* SIOCGIWRETRY */
+	rtw_wx_set_enc,			/* SIOCSIWENCODE */
+	rtw_wx_get_enc,			/* SIOCGIWENCODE */
+	dummy,					/* SIOCSIWPOWER */
+	rtw_wx_get_power,		/* SIOCGIWPOWER */
+	NULL,					/*---hole---*/
+	NULL,					/*---hole---*/
+	rtw_wx_set_gen_ie,		/* SIOCSIWGENIE */
+	NULL,					/* SIOCGWGENIE */
+	rtw_wx_set_auth,		/* SIOCSIWAUTH */
+	NULL,					/* SIOCGIWAUTH */
+	rtw_wx_set_enc_ext,		/* SIOCSIWENCODEEXT */
+	NULL,					/* SIOCGIWENCODEEXT */
+	rtw_wx_set_pmkid,		/* SIOCSIWPMKSA */
+	NULL,					/*---hole---*/
+}; 
+
+#if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+static const struct iw_priv_args rtw_private_args[] =
+{	
+	{ SIOCIWFIRSTPRIV + 0x00, IW_PRIV_TYPE_CHAR | 1024, 0 , ""},  //set 
+	{ SIOCIWFIRSTPRIV + 0x01, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , ""},//get
+/* --- sub-ioctls definitions --- */   
+		{ MP_START , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_start" }, //set
+		{ MP_PHYPARA, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_phypara" },//get
+		{ MP_STOP , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_stop" }, //set
+		{ MP_CHANNEL , IW_PRIV_TYPE_CHAR | 1024 , IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_channel" },//get
+		{ MP_BANDWIDTH , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_bandwidth"}, //set
+		{ MP_RATE , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_rate" },//get
+		{ MP_RESET_STATS , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_reset_stats"},
+		{ MP_QUERY , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , "mp_query"}, //get
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ READ_REG , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "read_reg" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_RATE , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_rate" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ READ_RF , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "read_rf" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_PSD , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_psd"}, 
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_DUMP, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_dump" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_TXPOWER , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_txpower"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_ANT_TX , IW_PRIV_TYPE_CHAR | 1024,  IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ant_tx"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_ANT_RX , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ant_rx"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ WRITE_REG , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "write_reg" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ WRITE_RF , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "write_rf" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_CTX , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ctx"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_ARX , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_arx"},
+		{ MP_ANT_RX , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_ant_rx"},
+		{ MP_THER , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ther"},
+		{ EFUSE_SET, IW_PRIV_TYPE_CHAR | 1024, 0, "efuse_set" },
+		{ EFUSE_GET, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "efuse_get" },
+		{ MP_NULL , IW_PRIV_TYPE_CHAR | 1024, 0, "NULL"},
+		{ MP_PWRTRK, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_pwrtrk" },
+		{ MP_IOCTL, IW_PRIV_TYPE_CHAR | 1024, 0, "mp_ioctl"}, // mp_ioctl	
+		
+	
+	{ SIOCIWFIRSTPRIV + 0x02, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , "test"},//set
+};
+
+
+static iw_handler rtw_private_handler[] = 
+{
+	rtw_mp_set,
+	rtw_mp_get,
+};
+
+#else // not inlucde MP
+
+static const struct iw_priv_args rtw_private_args[] = {
+	{
+		SIOCIWFIRSTPRIV + 0x0,
+		IW_PRIV_TYPE_CHAR | 0x7FF, 0, "write"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x1,
+		IW_PRIV_TYPE_CHAR | 0x7FF,
+		IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ, "read"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x2, 0, 0, "driver_ext"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x3, 0, 0, "mp_ioctl"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x4,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "apinfo"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x5,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "setpid"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x6,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_start"
+	},
+//for PLATFORM_MT53XX	
+	{
+		SIOCIWFIRSTPRIV + 0x7,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "get_sensitivity"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x8,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_prob_req_ie"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x9,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_assoc_req_ie"
+	},
+
+//for RTK_DMP_PLATFORM	
+	{
+		SIOCIWFIRSTPRIV + 0xA,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "channel_plan"
+	},
+
+	{
+		SIOCIWFIRSTPRIV + 0xB,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "dbg"
+	},	
+	{
+		SIOCIWFIRSTPRIV + 0xC,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 3, 0, "rfw"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xD,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ, "rfr"
+	},
+#ifdef CONFIG_WOWLAN
+	{
+		SIOCIWFIRSTPRIV + 0xE,0,0, "wowlan_ctrl"
+	},
+#endif // CONFIG_WOWLAN
+	{
+		SIOCIWFIRSTPRIV + 0x10,
+		IW_PRIV_TYPE_CHAR | 1024, 0, "p2p_set"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x11,
+		IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , "p2p_get"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x12, 0, 0, "NULL"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x13,
+		IW_PRIV_TYPE_CHAR | 64, IW_PRIV_TYPE_CHAR | 64 , "p2p_get2"
+	},	
+	{
+		SIOCIWFIRSTPRIV + 0x14,
+		IW_PRIV_TYPE_CHAR  | 64, 0, "tdls"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x15,
+		IW_PRIV_TYPE_CHAR | P2P_PRIVATE_IOCTL_SET_LEN, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | P2P_PRIVATE_IOCTL_SET_LEN , "tdls_get"
+	},	
+	{
+		SIOCIWFIRSTPRIV + 0x16,
+		IW_PRIV_TYPE_CHAR | 64, 0, "pm_set"
+	},
+
+	{SIOCIWFIRSTPRIV + 0x18, IW_PRIV_TYPE_CHAR | IFNAMSIZ , 0 , "rereg_nd_name"},
+
+	{SIOCIWFIRSTPRIV + 0x1A, IW_PRIV_TYPE_CHAR | 128, 0, "efuse_set"},
+	{SIOCIWFIRSTPRIV + 0x1B, IW_PRIV_TYPE_CHAR | 128, IW_PRIV_TYPE_CHAR |IW_PRIV_SIZE_FIXED |0x700 ,"efuse_get"},
+	{
+		SIOCIWFIRSTPRIV + 0x1D,
+		IW_PRIV_TYPE_CHAR | 40, IW_PRIV_TYPE_CHAR | 0x7FF, "test"
+	},
+#ifdef CONFIG_INTEL_WIDI
+	{
+		SIOCIWFIRSTPRIV + 0x1E,
+		IW_PRIV_TYPE_CHAR | 1024, 0, "widi_set"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x1F,
+		IW_PRIV_TYPE_CHAR | 128, 0, "widi_prob_req"
+	},
+#endif // CONFIG_INTEL_WIDI
+};
+
+static iw_handler rtw_private_handler[] = 
+{
+	rtw_wx_write32,					//0x00
+	rtw_wx_read32,					//0x01
+	rtw_drvext_hdl,					//0x02
+	rtw_mp_ioctl_hdl,				//0x03
+
+// for MM DTV platform
+	rtw_get_ap_info,					//0x04
+
+	rtw_set_pid,						//0x05
+	rtw_wps_start,					//0x06
+
+// for PLATFORM_MT53XX
+	rtw_wx_get_sensitivity,			//0x07
+	rtw_wx_set_mtk_wps_probe_ie,	//0x08
+	rtw_wx_set_mtk_wps_ie,			//0x09
+
+// for RTK_DMP_PLATFORM
+// Set Channel depend on the country code
+	rtw_wx_set_channel_plan,		//0x0A
+
+	rtw_dbg_port,					//0x0B
+	rtw_wx_write_rf,					//0x0C
+	rtw_wx_read_rf,					//0x0D
+
+#ifdef CONFIG_WOWLAN
+	rtw_wowlan_ctrl,					//0x0E
+#else
+	rtw_wx_priv_null,				//0x0E
+#endif //CONFIG_WOWLAN
+	rtw_wx_priv_null,				//0x0F
+
+	rtw_p2p_set,					//0x10
+	rtw_p2p_get,					//0x11
+	NULL,							//0x12
+	rtw_p2p_get2,					//0x13
+
+	rtw_tdls,						//0x14
+	rtw_tdls_get,					//0x15
+
+	rtw_pm_set,						//0x16
+	rtw_wx_priv_null,				//0x17
+	rtw_rereg_nd_name,				//0x18
+	rtw_wx_priv_null,				//0x19
+
+	rtw_mp_efuse_set,				//0x1A
+	rtw_mp_efuse_get,				//0x1B
+	NULL,							// 0x1C is reserved for hostapd
+	rtw_test	,						// 0x1D
+#ifdef CONFIG_INTEL_WIDI
+	rtw_widi_set,					//0x1E
+	rtw_widi_set_probe_request,		//0x1F
+#endif // CONFIG_INTEL_WIDI
+};
+
+#endif // #if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+#if WIRELESS_EXT >= 17	
+static struct iw_statistics *rtw_get_wireless_stats(struct net_device *dev)
+{
+       _adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	   struct iw_statistics *piwstats=&padapter->iwstats;
+	int tmp_level = 0;
+	int tmp_qual = 0;
+	int tmp_noise = 0;
+
+	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) != _TRUE)
+	{
+		piwstats->qual.qual = 0;
+		piwstats->qual.level = 0;
+		piwstats->qual.noise = 0;
+		//DBG_871X("No link  level:%d, qual:%d, noise:%d\n", tmp_level, tmp_qual, tmp_noise);
+	}
+	else{
+		#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+		tmp_level = translate_percentage_to_dbm(padapter->recvpriv.signal_strength); 
+		#else
+		tmp_level = padapter->recvpriv.signal_strength;
+		#endif
+		
+		tmp_qual = padapter->recvpriv.signal_qual;
+		tmp_noise =padapter->recvpriv.noise;		
+		//DBG_871X("level:%d, qual:%d, noise:%d, rssi (%d)\n", tmp_level, tmp_qual, tmp_noise,padapter->recvpriv.rssi);
+
+		piwstats->qual.level = tmp_level;
+		piwstats->qual.qual = tmp_qual;
+		piwstats->qual.noise = tmp_noise;
+	}
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,14))
+	piwstats->qual.updated = IW_QUAL_ALL_UPDATED ;//|IW_QUAL_DBM;
+#else
+#ifdef RTK_DMP_PLATFORM
+	//IW_QUAL_DBM= 0x8, if driver use this flag, wireless extension will show value of dbm.
+	//remove this flag for show percentage 0~100
+	piwstats->qual.updated = 0x07;
+#else
+	piwstats->qual.updated = 0x0f;
+#endif
+#endif
+
+	#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+	piwstats->qual.updated = piwstats->qual.updated | IW_QUAL_DBM;
+	#endif
+
+	return &padapter->iwstats;
+}
+#endif
+
+#ifdef CONFIG_WIRELESS_EXT
+struct iw_handler_def rtw_handlers_def =
+{
+	.standard = rtw_handlers,
+	.num_standard = sizeof(rtw_handlers) / sizeof(iw_handler),
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33)) || defined(CONFIG_WEXT_PRIV)
+	.private = rtw_private_handler,
+	.private_args = (struct iw_priv_args *)rtw_private_args,
+	.num_private = sizeof(rtw_private_handler) / sizeof(iw_handler),
+ 	.num_private_args = sizeof(rtw_private_args) / sizeof(struct iw_priv_args),
+#endif
+#if WIRELESS_EXT >= 17
+	.get_wireless_stats = rtw_get_wireless_stats,
+#endif
+};
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c
new file mode 100755
index 0000000000000..0ec8d05958cf3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c
@@ -0,0 +1,653 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#define _MLME_OSDEP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <mlme_osdep.h>
+
+
+#ifdef RTK_DMP_PLATFORM
+void Linkup_workitem_callback(struct work_struct *work)
+{
+	struct mlme_priv *pmlmepriv = container_of(work, struct mlme_priv, Linkup_workitem);
+	_adapter *padapter = container_of(pmlmepriv, _adapter, mlmepriv);
+
+_func_enter_;
+
+	RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("+ Linkup_workitem_callback\n"));
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+	kobject_uevent(&padapter->pnetdev->dev.kobj, KOBJ_LINKUP);
+#else
+	kobject_hotplug(&padapter->pnetdev->class_dev.kobj, KOBJ_LINKUP);
+#endif
+
+_func_exit_;
+}
+
+void Linkdown_workitem_callback(struct work_struct *work)
+{
+	struct mlme_priv *pmlmepriv = container_of(work, struct mlme_priv, Linkdown_workitem);
+	_adapter *padapter = container_of(pmlmepriv, _adapter, mlmepriv);
+
+_func_enter_;
+
+	RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("+ Linkdown_workitem_callback\n"));
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+	kobject_uevent(&padapter->pnetdev->dev.kobj, KOBJ_LINKDOWN);
+#else
+	kobject_hotplug(&padapter->pnetdev->class_dev.kobj, KOBJ_LINKDOWN);
+#endif
+
+_func_exit_;
+}
+#endif
+
+
+/*
+void sitesurvey_ctrl_handler(void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+
+	_sitesurvey_ctrl_handler(adapter);
+
+	_set_timer(&adapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer, 3000);
+}
+*/
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void rtw_join_timeout_handler(void *FunctionContext)
+#else
+void rtw_join_timeout_handler(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, mlmepriv.assoc_timer);
+#endif
+
+        _rtw_join_timeout_handler(adapter);
+}
+
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void _rtw_scan_timeout_handler(void *FunctionContext)
+#else
+void _rtw_scan_timeout_handler(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, mlmepriv.scan_to_timer);
+#endif
+        rtw_scan_timeout_handler(adapter);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void _dynamic_check_timer_handlder(void *FunctionContext)
+#else
+static void _dynamic_check_timer_handlder(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, mlmepriv.dynamic_chk_timer);
+#endif
+	rtw_dynamic_check_timer_handlder(adapter);
+
+	_set_timer(&adapter->mlmepriv.dynamic_chk_timer, 2000);
+}
+
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void _rtw_set_scan_deny_timer_hdl(void *FunctionContext)
+#else
+void _rtw_set_scan_deny_timer_hdl(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *adapter = (_adapter *)FunctionContext;
+#else
+        _adapter *adapter = from_timer(adapter, t, mlmepriv.set_scan_deny_timer);
+#endif
+	rtw_set_scan_deny_timer_hdl(adapter);
+}
+#endif
+
+
+void rtw_init_mlme_timer(_adapter *padapter)
+{
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_init_timer(&(pmlmepriv->assoc_timer), padapter->pnetdev, rtw_join_timeout_handler, padapter);
+	_init_timer(&(pmlmepriv->scan_to_timer), padapter->pnetdev, _rtw_scan_timeout_handler, padapter);
+	_init_timer(&(pmlmepriv->dynamic_chk_timer), padapter->pnetdev, _dynamic_check_timer_handlder, padapter);
+	#ifdef CONFIG_SET_SCAN_DENY_TIMER
+	_init_timer(&(pmlmepriv->set_scan_deny_timer), padapter->pnetdev, _rtw_set_scan_deny_timer_hdl, padapter);
+	#endif
+#else
+        timer_setup(&pmlmepriv->assoc_timer, rtw_join_timeout_handler, 0);
+        timer_setup(&pmlmepriv->scan_to_timer, _rtw_scan_timeout_handler, 0);
+        timer_setup(&pmlmepriv->dynamic_chk_timer, _dynamic_check_timer_handlder, 0);
+        #ifdef CONFIG_SET_SCAN_DENY_TIMER
+        timer_setup(&pmlmepriv->set_scan_deny_timer, _rtw_set_scan_deny_timer_hdl, 0);
+        #endif
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	_init_workitem(&(pmlmepriv->Linkup_workitem), Linkup_workitem_callback, padapter);
+	_init_workitem(&(pmlmepriv->Linkdown_workitem), Linkdown_workitem_callback, padapter);
+#endif
+
+}
+
+extern void rtw_indicate_wx_assoc_event(_adapter *padapter);
+extern void rtw_indicate_wx_disassoc_event(_adapter *padapter);
+
+void rtw_os_indicate_connect(_adapter *adapter)
+{
+
+_func_enter_;	
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_indicate_connect(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_indicate_wx_assoc_event(adapter);
+	netif_carrier_on(adapter->pnetdev);
+
+	if(adapter->pid[2] !=0)
+		rtw_signal_process(adapter->pid[2], SIGALRM);
+
+#ifdef RTK_DMP_PLATFORM
+	_set_workitem(&adapter->mlmepriv.Linkup_workitem);
+#endif
+
+_func_exit_;	
+
+}
+
+extern void indicate_wx_scan_complete_event(_adapter *padapter);
+void rtw_os_indicate_scan_done( _adapter *padapter, bool aborted)
+{
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_indicate_scan_done(wdev_to_priv(padapter->rtw_wdev), aborted);
+#endif
+	indicate_wx_scan_complete_event(padapter);
+}
+
+static RT_PMKID_LIST   backupPMKIDList[ NUM_PMKID_CACHE ];
+void rtw_reset_securitypriv( _adapter *adapter )
+{
+	u8	backupPMKIDIndex = 0;
+	u8	backupTKIPCountermeasure = 0x00;
+	u32	backupTKIPcountermeasure_time = 0;
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_irqL irqL;
+	struct mlme_ext_priv	*pmlmeext = &adapter->mlmeextpriv;
+	
+	_enter_critical_bh(&adapter->security_key_mutex, &irqL);
+	
+	if(adapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X)//802.1x
+	{		 
+		// Added by Albert 2009/02/18
+		// We have to backup the PMK information for WiFi PMK Caching test item.
+		//
+		// Backup the btkip_countermeasure information.
+		// When the countermeasure is trigger, the driver have to disconnect with AP for 60 seconds.
+
+		_rtw_memset( &backupPMKIDList[ 0 ], 0x00, sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+
+		_rtw_memcpy( &backupPMKIDList[ 0 ], &adapter->securitypriv.PMKIDList[ 0 ], sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+		backupPMKIDIndex = adapter->securitypriv.PMKIDIndex;
+		backupTKIPCountermeasure = adapter->securitypriv.btkip_countermeasure;
+		backupTKIPcountermeasure_time = adapter->securitypriv.btkip_countermeasure_time;		
+#ifdef CONFIG_IEEE80211W
+		//reset RX BIP packet number
+		pmlmeext->mgnt_80211w_IPN_rx = 0;
+#endif //CONFIG_IEEE80211W
+		_rtw_memset((unsigned char *)&adapter->securitypriv, 0, sizeof (struct security_priv));
+		//_init_timer(&(adapter->securitypriv.tkip_timer),adapter->pnetdev, rtw_use_tkipkey_handler, adapter);
+
+		// Added by Albert 2009/02/18
+		// Restore the PMK information to securitypriv structure for the following connection.
+		_rtw_memcpy( &adapter->securitypriv.PMKIDList[ 0 ], &backupPMKIDList[ 0 ], sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+		adapter->securitypriv.PMKIDIndex = backupPMKIDIndex;
+		adapter->securitypriv.btkip_countermeasure = backupTKIPCountermeasure;
+		adapter->securitypriv.btkip_countermeasure_time = backupTKIPcountermeasure_time;		
+
+		adapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
+		adapter->securitypriv.ndisencryptstatus = Ndis802_11WEPDisabled;
+
+	}
+	else //reset values in securitypriv 
+	{
+		//if(adapter->mlmepriv.fw_state & WIFI_STATION_STATE)
+		//{
+		struct security_priv *psec_priv=&adapter->securitypriv;
+
+		psec_priv->dot11AuthAlgrthm =dot11AuthAlgrthm_Open;  //open system
+		psec_priv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
+		psec_priv->dot11PrivacyKeyIndex = 0;
+
+		psec_priv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+		psec_priv->dot118021XGrpKeyid = 1;
+
+		psec_priv->ndisauthtype = Ndis802_11AuthModeOpen;
+		psec_priv->ndisencryptstatus = Ndis802_11WEPDisabled;
+		//}
+	}
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_exit_critical_bh(&adapter->security_key_mutex, &irqL);
+}
+
+void rtw_os_indicate_disconnect( _adapter *adapter )
+{
+   //RT_PMKID_LIST   backupPMKIDList[ NUM_PMKID_CACHE ];
+  
+_func_enter_;
+
+	netif_carrier_off(adapter->pnetdev); // Do it first for tx broadcast pkt after disconnection issue!
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_indicate_disconnect(adapter); 	
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_indicate_wx_disassoc_event(adapter);	
+
+#ifdef RTK_DMP_PLATFORM
+	_set_workitem(&adapter->mlmepriv.Linkdown_workitem);
+#endif
+	 //modify for CONFIG_IEEE80211W, none 11w also can use the same command
+	 rtw_reset_securitypriv_cmd(adapter);
+
+_func_exit_;
+
+}
+
+void rtw_report_sec_ie(_adapter *adapter,u8 authmode,u8 *sec_ie)
+{
+	uint	len;
+	u8	*buff,*p,i;
+	union iwreq_data wrqu;
+
+_func_enter_;
+
+	RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("+rtw_report_sec_ie, authmode=%d\n", authmode));
+
+	buff = NULL;
+	if(authmode==_WPA_IE_ID_)
+	{
+		RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("rtw_report_sec_ie, authmode=%d\n", authmode));
+		
+		buff = rtw_malloc(IW_CUSTOM_MAX);
+		
+		_rtw_memset(buff,0,IW_CUSTOM_MAX);
+		
+		p=buff;
+		
+		p+=sprintf(p,"ASSOCINFO(ReqIEs=");
+
+		len = sec_ie[1]+2;
+		len =  (len < IW_CUSTOM_MAX) ? len:IW_CUSTOM_MAX;
+			
+		for(i=0;i<len;i++){
+			p+=sprintf(p,"%02x",sec_ie[i]);
+		}
+
+		p+=sprintf(p,")");
+		
+		_rtw_memset(&wrqu,0,sizeof(wrqu));
+		
+		wrqu.data.length=p-buff;
+		
+		wrqu.data.length = (wrqu.data.length<IW_CUSTOM_MAX) ? wrqu.data.length:IW_CUSTOM_MAX;
+		
+		wireless_send_event(adapter->pnetdev,IWEVCUSTOM,&wrqu,buff);
+
+		if(buff)
+		    rtw_mfree(buff, IW_CUSTOM_MAX);
+		
+	}
+
+_func_exit_;
+
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void _survey_timer_hdl(void *FunctionContext)
+#else
+static void _survey_timer_hdl(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *padapter = (_adapter *)FunctionContext;
+#else
+        _adapter *padapter = from_timer(padapter, t, mlmeextpriv.survey_timer);
+#endif
+	survey_timer_hdl(padapter);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void _link_timer_hdl (void *FunctionContext)
+#else
+static void _link_timer_hdl(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _adapter *padapter = (_adapter *)FunctionContext;
+#else
+        _adapter *padapter = from_timer(padapter, t, mlmeextpriv.link_timer);
+#endif
+	link_timer_hdl(padapter);
+}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+static void _addba_timer_hdl(void *FunctionContext)
+#else
+static void _addba_timer_hdl(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        struct sta_info *psta = (struct sta_info *)FunctionContext;
+#else
+        struct sta_info *psta = from_timer(psta, t, addba_retry_timer);
+#endif
+	addba_timer_hdl(psta);
+}
+
+#ifdef CONFIG_IEEE80211W
+void _sa_query_timer_hdl (void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	sa_query_timer_hdl(padapter);
+}
+#endif //CONFIG_IEEE80211W
+
+void init_addba_retry_timer(_adapter *padapter, struct sta_info *psta)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _init_timer(&psta->addba_retry_timer, padapter->pnetdev, _addba_timer_hdl, psta);
+#else
+        timer_setup(&psta->addba_retry_timer, _addba_timer_hdl, 0);
+#endif
+}
+
+/*
+void _reauth_timer_hdl(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	reauth_timer_hdl(padapter);
+}
+
+void _reassoc_timer_hdl(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	reassoc_timer_hdl(padapter);
+}
+*/
+
+void init_mlme_ext_timer(_adapter *padapter)
+{
+	struct	mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        _init_timer(&pmlmeext->survey_timer, padapter->pnetdev, _survey_timer_hdl, padapter);
+        _init_timer(&pmlmeext->link_timer, padapter->pnetdev, _link_timer_hdl, padapter);
+#else
+        timer_setup(&pmlmeext->survey_timer, _survey_timer_hdl, 0);
+        timer_setup(&pmlmeext->link_timer, _link_timer_hdl, 0);
+#endif
+#ifdef CONFIG_IEEE80211W
+	_init_timer(&pmlmeext->sa_query_timer, padapter->pnetdev, _sa_query_timer_hdl, padapter);
+#endif //CONFIG_IEEE80211W
+	//_init_timer(&pmlmeext->ADDBA_timer, padapter->pnetdev, _addba_timer_hdl, padapter);
+
+	//_init_timer(&pmlmeext->reauth_timer, padapter->pnetdev, _reauth_timer_hdl, padapter);
+	//_init_timer(&pmlmeext->reassoc_timer, padapter->pnetdev, _reassoc_timer_hdl, padapter);
+}
+
+#ifdef CONFIG_AP_MODE
+
+void rtw_indicate_sta_assoc_event(_adapter *padapter, struct sta_info *psta)
+{
+	union iwreq_data wrqu;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	if(psta==NULL)
+		return;
+
+	if(psta->aid > NUM_STA)
+		return;
+
+	if(pstapriv->sta_aid[psta->aid - 1] != psta)
+		return;
+	
+	
+	wrqu.addr.sa_family = ARPHRD_ETHER;	
+	
+	_rtw_memcpy(wrqu.addr.sa_data, psta->hwaddr, ETH_ALEN);
+
+	DBG_871X("+rtw_indicate_sta_assoc_event\n");
+	
+	wireless_send_event(padapter->pnetdev, IWEVREGISTERED, &wrqu, NULL);
+
+}
+
+void rtw_indicate_sta_disassoc_event(_adapter *padapter, struct sta_info *psta)
+{
+	union iwreq_data wrqu;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	if(psta==NULL)
+		return;
+
+	if(psta->aid > NUM_STA)
+		return;
+
+	if(pstapriv->sta_aid[psta->aid - 1] != psta)
+		return;
+	
+	
+	wrqu.addr.sa_family = ARPHRD_ETHER;	
+	
+	_rtw_memcpy(wrqu.addr.sa_data, psta->hwaddr, ETH_ALEN);
+
+	DBG_871X("+rtw_indicate_sta_disassoc_event\n");
+	
+	wireless_send_event(padapter->pnetdev, IWEVEXPIRED, &wrqu, NULL);
+	
+}
+
+
+#ifdef CONFIG_HOSTAPD_MLME
+
+static int mgnt_xmit_entry(struct sk_buff *skb, struct net_device *pnetdev)
+{
+	struct hostapd_priv *phostapdpriv = rtw_netdev_priv(pnetdev);
+	_adapter *padapter = (_adapter *)phostapdpriv->padapter;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	return rtw_hal_hostap_mgnt_xmit_entry(padapter, skb);
+}
+
+static int mgnt_netdev_open(struct net_device *pnetdev)
+{
+	struct hostapd_priv *phostapdpriv = rtw_netdev_priv(pnetdev);
+
+	DBG_871X("mgnt_netdev_open: MAC Address:" MAC_FMT "\n", MAC_ARG(pnetdev->dev_addr));
+
+
+	init_usb_anchor(&phostapdpriv->anchored);
+	
+ 	if(!rtw_netif_queue_stopped(pnetdev))
+      		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+
+	netif_carrier_on(pnetdev);
+		
+	//rtw_write16(phostapdpriv->padapter, 0x0116, 0x0100);//only excluding beacon 
+		
+	return 0;	
+}
+static int mgnt_netdev_close(struct net_device *pnetdev)
+{
+	struct hostapd_priv *phostapdpriv = rtw_netdev_priv(pnetdev);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	usb_kill_anchored_urbs(&phostapdpriv->anchored);
+
+	netif_carrier_off(pnetdev);
+
+	if (!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_stop_queue(pnetdev);
+	
+	//rtw_write16(phostapdpriv->padapter, 0x0116, 0x3f3f);
+	
+	return 0;	
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtl871x_mgnt_netdev_ops = {
+	.ndo_open = mgnt_netdev_open,
+       .ndo_stop = mgnt_netdev_close,
+       .ndo_start_xmit = mgnt_xmit_entry,
+       //.ndo_set_mac_address = r871x_net_set_mac_address,
+       //.ndo_get_stats = r871x_net_get_stats,
+       //.ndo_do_ioctl = r871x_mp_ioctl,
+};
+#endif
+
+int hostapd_mode_init(_adapter *padapter)
+{
+	unsigned char mac[ETH_ALEN];
+	struct hostapd_priv *phostapdpriv;
+	struct net_device *pnetdev;
+	
+	pnetdev = rtw_alloc_etherdev(sizeof(struct hostapd_priv));	
+	if (!pnetdev)
+	   return -ENOMEM;
+
+	//SET_MODULE_OWNER(pnetdev);
+       ether_setup(pnetdev);
+
+	//pnetdev->type = ARPHRD_IEEE80211;
+	
+	phostapdpriv = rtw_netdev_priv(pnetdev);
+	phostapdpriv->pmgnt_netdev = pnetdev;
+	phostapdpriv->padapter= padapter;
+	padapter->phostapdpriv = phostapdpriv;
+	
+	//pnetdev->init = NULL;
+	
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+
+	DBG_871X("register rtl871x_mgnt_netdev_ops to netdev_ops\n");
+
+	pnetdev->netdev_ops = &rtl871x_mgnt_netdev_ops;
+	
+#else
+
+	pnetdev->open = mgnt_netdev_open;
+
+	pnetdev->stop = mgnt_netdev_close;	
+	
+	pnetdev->hard_start_xmit = mgnt_xmit_entry;
+	
+	//pnetdev->set_mac_address = r871x_net_set_mac_address;
+	
+	//pnetdev->get_stats = r871x_net_get_stats;
+
+	//pnetdev->do_ioctl = r871x_mp_ioctl;
+	
+#endif
+
+	pnetdev->watchdog_timeo = HZ; /* 1 second timeout */	
+
+	//pnetdev->wireless_handlers = NULL;
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	pnetdev->features |= NETIF_F_IP_CSUM;
+#endif	
+
+	
+	
+	if(dev_alloc_name(pnetdev,"mgnt.wlan%d") < 0)
+	{
+		DBG_871X("hostapd_mode_init(): dev_alloc_name, fail! \n");		
+	}
+
+
+	//SET_NETDEV_DEV(pnetdev, pintfpriv->udev);
+
+
+	mac[0]=0x00;
+	mac[1]=0xe0;
+	mac[2]=0x4c;
+	mac[3]=0x87;
+	mac[4]=0x11;
+	mac[5]=0x12;
+				
+	_rtw_memcpy(pnetdev->dev_addr, mac, ETH_ALEN);
+	
+
+	netif_carrier_off(pnetdev);
+
+
+	/* Tell the network stack we exist */
+	if (register_netdev(pnetdev) != 0)
+	{
+		DBG_871X("hostapd_mode_init(): register_netdev fail!\n");
+		
+		if(pnetdev)
+      		{	 
+			rtw_free_netdev(pnetdev);
+      		}
+	}
+	
+	return 0;
+	
+}
+
+void hostapd_mode_unload(_adapter *padapter)
+{
+	struct hostapd_priv *phostapdpriv = padapter->phostapdpriv;
+	struct net_device *pnetdev = phostapdpriv->pmgnt_netdev;
+
+	unregister_netdev(pnetdev);
+	rtw_free_netdev(pnetdev);
+	
+}
+
+#endif
+#endif
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c
new file mode 100755
index 0000000000000..a115c5afaecf0
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c
@@ -0,0 +1,2768 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _OS_INTFS_C_
+
+#include <drv_conf.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <xmit_osdep.h>
+#include <recv_osdep.h>
+#include <hal_intf.h>
+#include <rtw_ioctl.h>
+#include <rtw_version.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_osintf.h>
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_osintf.h>
+#endif
+
+#ifdef CONFIG_BR_EXT
+#include <rtw_br_ext.h>
+#endif //CONFIG_BR_EXT
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Realtek Wireless Lan Driver");
+MODULE_AUTHOR("Realtek Semiconductor Corp.");
+MODULE_VERSION(DRIVERVERSION);
+
+/* module param defaults */
+int rtw_chip_version = 0x00;
+int rtw_rfintfs = HWPI;
+int rtw_lbkmode = 0;//RTL8712_AIR_TRX;
+
+
+int rtw_network_mode = Ndis802_11IBSS;//Ndis802_11Infrastructure;//infra, ad-hoc, auto
+//NDIS_802_11_SSID	ssid;
+int rtw_channel = 1;//ad-hoc support requirement
+int rtw_wireless_mode = WIRELESS_11BG_24N;
+int rtw_vrtl_carrier_sense = AUTO_VCS;
+int rtw_vcs_type = RTS_CTS;//*
+int rtw_rts_thresh = 2347;//*
+int rtw_frag_thresh = 2346;//*
+int rtw_preamble = PREAMBLE_LONG;//long, short, auto
+int rtw_scan_mode = 1;//active, passive
+int rtw_adhoc_tx_pwr = 1;
+int rtw_soft_ap = 0;
+//int smart_ps = 1;
+#ifdef CONFIG_POWER_SAVING
+int rtw_power_mgnt = 1;
+#ifdef CONFIG_IPS_LEVEL_2
+int rtw_ips_mode = IPS_LEVEL_2;
+#else
+int rtw_ips_mode = IPS_NORMAL;
+#endif
+#else
+int rtw_power_mgnt = PS_MODE_ACTIVE;
+int rtw_ips_mode = IPS_NONE;
+#endif
+module_param(rtw_ips_mode, int, 0644);
+MODULE_PARM_DESC(rtw_ips_mode,"The default IPS mode");
+
+int rtw_radio_enable = 1;
+int rtw_long_retry_lmt = 7;
+int rtw_short_retry_lmt = 7;
+int rtw_busy_thresh = 40;
+//int qos_enable = 0; //*
+int rtw_ack_policy = NORMAL_ACK;
+#ifdef CONFIG_MP_INCLUDED
+int rtw_mp_mode = 1;
+#else
+int rtw_mp_mode = 0;
+#endif
+int rtw_software_encrypt = 0;
+int rtw_software_decrypt = 0;
+
+int rtw_acm_method = 0;// 0:By SW 1:By HW.
+
+int rtw_wmm_enable = 1;// default is set to enable the wmm.
+int rtw_uapsd_enable = 0;
+int rtw_uapsd_max_sp = NO_LIMIT;
+int rtw_uapsd_acbk_en = 0;
+int rtw_uapsd_acbe_en = 0;
+int rtw_uapsd_acvi_en = 0;
+int rtw_uapsd_acvo_en = 0;
+
+#ifdef CONFIG_80211N_HT
+int rtw_ht_enable = 1;
+int rtw_cbw40_enable = 3; // 0 :diable, bit(0): enable 2.4g, bit(1): enable 5g
+int rtw_ampdu_enable = 1;//for enable tx_ampdu
+int rtw_rx_stbc = 1;// 0: disable, bit(0):enable 2.4g, bit(1):enable 5g, default is set to enable 2.4GHZ for IOT issue with bufflao's AP at 5GHZ
+int rtw_ampdu_amsdu = 0;// 0: disabled, 1:enabled, 2:auto
+#endif
+
+int rtw_lowrate_two_xmit = 1;//Use 2 path Tx to transmit MCS0~7 and legacy mode
+
+//int rf_config = RF_1T2R;  // 1T2R
+int rtw_rf_config = RF_819X_MAX_TYPE;  //auto
+int rtw_low_power = 0;
+#ifdef CONFIG_WIFI_TEST
+int rtw_wifi_spec = 1;//for wifi test
+#else
+int rtw_wifi_spec = 0;
+#endif
+
+int rtw_special_rf_path = 0; //0: 2T2R ,1: only turn on path A 1T1R, 2: only turn on path B 1T1R
+
+int rtw_channel_plan = RT_CHANNEL_DOMAIN_MAX;
+
+#ifdef CONFIG_BT_COEXIST
+int rtw_bt_iso = 2;// 0:Low, 1:High, 2:From Efuse
+int rtw_bt_sco = 3;// 0:Idle, 1:None-SCO, 2:SCO, 3:From Counter, 4.Busy, 5.OtherBusy
+int rtw_bt_ampdu =1 ;// 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU.
+#endif
+int rtw_AcceptAddbaReq = _TRUE;// 0:Reject AP's Add BA req, 1:Accept AP's Add BA req.
+
+int  rtw_antdiv_cfg = 2; // 0:OFF , 1:ON, 2:decide by Efuse config
+
+#ifdef CONFIG_USB_AUTOSUSPEND
+int rtw_enusbss = 1;//0:disable,1:enable
+#else
+int rtw_enusbss = 0;//0:disable,1:enable
+#endif
+
+int rtw_hwpdn_mode=2;//0:disable,1:enable,2: by EFUSE config
+
+#ifdef CONFIG_HW_PWRP_DETECTION
+int rtw_hwpwrp_detect = 1;
+#else
+int rtw_hwpwrp_detect = 0; //HW power  ping detect 0:disable , 1:enable
+#endif
+
+#ifdef CONFIG_USB_HCI
+int rtw_hw_wps_pbc = 1;
+#else
+int rtw_hw_wps_pbc = 0;
+#endif
+
+#ifdef CONFIG_TX_MCAST2UNI
+int rtw_mc2u_disable = 0;
+#endif	// CONFIG_TX_MCAST2UNI
+
+int rtw_mac_phy_mode = 0; //0:by efuse, 1:smsp, 2:dmdp, 3:dmsp.
+
+#ifdef CONFIG_80211D
+int rtw_80211d = 0;
+#endif
+
+char* ifname = "wlan%d";
+module_param(ifname, charp, 0644);
+MODULE_PARM_DESC(ifname, "The default name to allocate for first interface");
+
+char* if2name = "wlan%d";
+module_param(if2name, charp, 0644);
+MODULE_PARM_DESC(if2name, "The default name to allocate for second interface");
+
+char* rtw_initmac = 0;  // temp mac address if users want to use instead of the mac address in Efuse
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+int rtw_ext_iface_num  = 1;//primary/secondary iface is excluded
+module_param(rtw_ext_iface_num, int, 0644);
+#endif //CONFIG_MULTI_VIR_IFACES
+
+module_param(rtw_initmac, charp, 0644);
+module_param(rtw_channel_plan, int, 0644);
+module_param(rtw_chip_version, int, 0644);
+module_param(rtw_rfintfs, int, 0644);
+module_param(rtw_lbkmode, int, 0644);
+module_param(rtw_network_mode, int, 0644);
+module_param(rtw_channel, int, 0644);
+module_param(rtw_mp_mode, int, 0644);
+module_param(rtw_wmm_enable, int, 0644);
+module_param(rtw_vrtl_carrier_sense, int, 0644);
+module_param(rtw_vcs_type, int, 0644);
+module_param(rtw_busy_thresh, int, 0644);
+#ifdef CONFIG_80211N_HT
+module_param(rtw_ht_enable, int, 0644);
+module_param(rtw_cbw40_enable, int, 0644);
+module_param(rtw_ampdu_enable, int, 0644);
+module_param(rtw_rx_stbc, int, 0644);
+module_param(rtw_ampdu_amsdu, int, 0644);
+#endif
+
+module_param(rtw_lowrate_two_xmit, int, 0644);
+
+module_param(rtw_rf_config, int, 0644);
+module_param(rtw_power_mgnt, int, 0644);
+module_param(rtw_low_power, int, 0644);
+module_param(rtw_wifi_spec, int, 0644);
+
+module_param(rtw_special_rf_path, int, 0644);
+
+module_param(rtw_antdiv_cfg, int, 0644);
+
+
+module_param(rtw_enusbss, int, 0644);
+module_param(rtw_hwpdn_mode, int, 0644);
+module_param(rtw_hwpwrp_detect, int, 0644);
+
+module_param(rtw_hw_wps_pbc, int, 0644);
+
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+char *rtw_adaptor_info_caching_file_path= "/data/misc/wifi/rtw_cache";
+module_param(rtw_adaptor_info_caching_file_path, charp, 0644);
+MODULE_PARM_DESC(rtw_adaptor_info_caching_file_path, "The path of adapter info cache file");
+#endif //CONFIG_ADAPTOR_INFO_CACHING_FILE
+
+#ifdef CONFIG_LAYER2_ROAMING
+uint rtw_max_roaming_times=2;
+module_param(rtw_max_roaming_times, uint, 0644);
+MODULE_PARM_DESC(rtw_max_roaming_times,"The max roaming times to try");
+#endif //CONFIG_LAYER2_ROAMING
+
+#ifdef CONFIG_IOL
+bool rtw_force_iol=_FALSE;
+module_param(rtw_force_iol, bool, 0644);
+MODULE_PARM_DESC(rtw_force_iol,"Force to enable IOL");
+#endif //CONFIG_IOL
+
+#ifdef CONFIG_FILE_FWIMG
+char *rtw_fw_file_path= "";
+module_param(rtw_fw_file_path, charp, 0644);
+MODULE_PARM_DESC(rtw_fw_file_path, "The path of fw image");
+#endif //CONFIG_FILE_FWIMG
+
+#ifdef CONFIG_TX_MCAST2UNI
+module_param(rtw_mc2u_disable, int, 0644);
+#endif	// CONFIG_TX_MCAST2UNI
+
+module_param(rtw_mac_phy_mode, int, 0644);
+
+#ifdef CONFIG_80211D
+module_param(rtw_80211d, int, 0644);
+#endif
+
+uint rtw_notch_filter = RTW_NOTCH_FILTER;
+module_param(rtw_notch_filter, uint, 0644);
+MODULE_PARM_DESC(rtw_notch_filter, "0:Disable, 1:Enable, 2:Enable only for P2P");
+
+static uint loadparam( _adapter *padapter,  _nic_hdl	pnetdev);
+int _netdev_open(struct net_device *pnetdev);
+int netdev_open (struct net_device *pnetdev);
+static int netdev_close (struct net_device *pnetdev);
+
+//#ifdef RTK_DMP_PLATFORM
+#ifdef CONFIG_PROC_DEBUG
+#define RTL8192C_PROC_NAME "rtl819xC"
+#define RTL8192D_PROC_NAME "rtl819xD"
+static char rtw_proc_name[IFNAMSIZ];
+static struct proc_dir_entry *rtw_proc = NULL;
+static int	rtw_proc_cnt = 0;
+
+#define RTW_PROC_NAME DRV_NAME
+
+void rtw_proc_init_one(struct net_device *dev)
+{
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(3,10,0))
+	struct proc_dir_entry *dir_dev = NULL;
+	struct proc_dir_entry *entry=NULL;
+	_adapter	*padapter = rtw_netdev_priv(dev);
+	u8 rf_type;
+
+	if(rtw_proc == NULL)
+	{
+		if(padapter->chip_type == RTL8188C_8192C)
+		{
+			_rtw_memcpy(rtw_proc_name, RTL8192C_PROC_NAME, sizeof(RTL8192C_PROC_NAME));
+		}
+		else if(padapter->chip_type == RTL8192D)
+		{
+			_rtw_memcpy(rtw_proc_name, RTL8192D_PROC_NAME, sizeof(RTL8192D_PROC_NAME));
+		}
+		else if(padapter->chip_type == RTL8723A)
+		{
+			_rtw_memcpy(rtw_proc_name, RTW_PROC_NAME, sizeof(RTW_PROC_NAME));
+		}
+		else if(padapter->chip_type == RTL8188E)
+		{
+			_rtw_memcpy(rtw_proc_name, RTW_PROC_NAME, sizeof(RTW_PROC_NAME));
+		}
+		else
+		{
+			_rtw_memcpy(rtw_proc_name, RTW_PROC_NAME, sizeof(RTW_PROC_NAME));
+		}
+
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+		rtw_proc=create_proc_entry(rtw_proc_name, S_IFDIR, proc_net);
+#else
+		rtw_proc=create_proc_entry(rtw_proc_name, S_IFDIR, init_net.proc_net);
+#endif
+		if (rtw_proc == NULL) {
+			DBG_871X(KERN_ERR "Unable to create rtw_proc directory\n");
+			return;
+		}
+
+		entry = create_proc_read_entry("ver_info", S_IFREG | S_IRUGO, rtw_proc, proc_get_drv_version, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+
+		entry = create_proc_read_entry("log_level", S_IFREG | S_IRUGO,
+				   rtw_proc, proc_get_log_level, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+		entry->write_proc = proc_set_log_level;
+
+#ifdef DBG_MEM_ALLOC
+		entry = create_proc_read_entry("mstat", S_IFREG | S_IRUGO,
+				   rtw_proc, proc_get_mstat, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+#endif /* DBG_MEM_ALLOC */
+	}
+
+
+
+	if(padapter->dir_dev == NULL)
+	{
+		padapter->dir_dev = create_proc_entry(dev->name,
+					  S_IFDIR | S_IRUGO | S_IXUGO,
+					  rtw_proc);
+
+		dir_dev = padapter->dir_dev;
+
+		if(dir_dev==NULL)
+		{
+			if(rtw_proc_cnt == 0)
+			{
+				if(rtw_proc){
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+					remove_proc_entry(rtw_proc_name, proc_net);
+#else
+					remove_proc_entry(rtw_proc_name, init_net.proc_net);
+#endif
+					rtw_proc = NULL;
+				}
+			}
+
+			DBG_871X("Unable to create dir_dev directory\n");
+			return;
+		}
+	}
+	else
+	{
+		return;
+	}
+
+	rtw_proc_cnt++;
+
+	entry = create_proc_read_entry("write_reg", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_write_reg, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_write_reg;
+
+	entry = create_proc_read_entry("read_reg", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_read_reg, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_read_reg;
+
+
+	entry = create_proc_read_entry("fwstate", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_fwstate, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+
+	entry = create_proc_read_entry("sec_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_sec_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+
+	entry = create_proc_read_entry("mlmext_state", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mlmext_state, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+
+	entry = create_proc_read_entry("qos_option", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_qos_option, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("ht_option", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ht_option, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rf_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rf_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("ap_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ap_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("adapter_state", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_adapter_state, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("trx_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_trx_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("mac_reg_dump1", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mac_reg_dump1, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("mac_reg_dump2", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mac_reg_dump2, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("mac_reg_dump3", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mac_reg_dump3, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("bb_reg_dump1", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_bb_reg_dump1, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("bb_reg_dump2", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_bb_reg_dump2, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("bb_reg_dump3", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_bb_reg_dump3, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rf_reg_dump1", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rf_reg_dump1, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rf_reg_dump2", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rf_reg_dump2, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+	if((RF_1T2R == rf_type) ||(RF_1T1R ==rf_type ))	{
+		entry = create_proc_read_entry("rf_reg_dump3", S_IFREG | S_IRUGO,
+					   dir_dev, proc_get_rf_reg_dump3, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+
+		entry = create_proc_read_entry("rf_reg_dump4", S_IFREG | S_IRUGO,
+					   dir_dev, proc_get_rf_reg_dump4, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+	}
+
+#ifdef CONFIG_AP_MODE
+
+	entry = create_proc_read_entry("all_sta_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_all_sta_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+	entry = create_proc_read_entry("_malloc_cnt", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_malloc_cnt, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+#endif
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	entry = create_proc_read_entry("best_channel", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_best_channel, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_best_channel;
+#endif
+
+	entry = create_proc_read_entry("rx_signal", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rx_signal, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_rx_signal;
+
+	entry = create_proc_read_entry("ht_enable", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ht_enable, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_ht_enable;
+
+	entry = create_proc_read_entry("cbw40_enable", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_cbw40_enable, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_cbw40_enable;
+
+	entry = create_proc_read_entry("ampdu_enable", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ampdu_enable, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_ampdu_enable;
+
+	entry = create_proc_read_entry("rx_stbc", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rx_stbc, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_rx_stbc;
+
+
+	entry = create_proc_read_entry("path_rssi", S_IFREG | S_IRUGO,
+					dir_dev, proc_get_two_path_rssi, dev);
+
+	entry = create_proc_read_entry("vid", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_vid, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("pid", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_pid, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rssi_disp", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rssi_disp, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_rssi_disp;
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	entry = create_proc_read_entry("sreset", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_sreset, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_sreset;
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	entry = create_proc_read_entry("dm_adaptivity", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_dm_adaptivity, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_dm_adaptivity;
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+#else /* kernel version < 3.10 */
+		DBG_871X(KERN_ERR "Unable to create /proc entry in this kernel version\n");
+#endif
+}
+
+void rtw_proc_remove_one(struct net_device *dev)
+{
+	struct proc_dir_entry *dir_dev = NULL;
+	_adapter	*padapter = rtw_netdev_priv(dev);
+	u8 rf_type;
+
+	dir_dev = padapter->dir_dev;
+	padapter->dir_dev = NULL;
+
+	if (dir_dev) {
+
+		remove_proc_entry("write_reg", dir_dev);
+		remove_proc_entry("read_reg", dir_dev);
+		remove_proc_entry("fwstate", dir_dev);
+		remove_proc_entry("sec_info", dir_dev);
+		remove_proc_entry("mlmext_state", dir_dev);
+		remove_proc_entry("qos_option", dir_dev);
+		remove_proc_entry("ht_option", dir_dev);
+		remove_proc_entry("rf_info", dir_dev);
+		remove_proc_entry("ap_info", dir_dev);
+		remove_proc_entry("adapter_state", dir_dev);
+		remove_proc_entry("trx_info", dir_dev);
+
+		remove_proc_entry("mac_reg_dump1", dir_dev);
+		remove_proc_entry("mac_reg_dump2", dir_dev);
+		remove_proc_entry("mac_reg_dump3", dir_dev);
+		remove_proc_entry("bb_reg_dump1", dir_dev);
+		remove_proc_entry("bb_reg_dump2", dir_dev);
+		remove_proc_entry("bb_reg_dump3", dir_dev);
+		remove_proc_entry("rf_reg_dump1", dir_dev);
+		remove_proc_entry("rf_reg_dump2", dir_dev);
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		if((RF_1T2R == rf_type) ||(RF_1T1R ==rf_type ))	{
+			remove_proc_entry("rf_reg_dump3", dir_dev);
+			remove_proc_entry("rf_reg_dump4", dir_dev);
+		}
+#ifdef CONFIG_AP_MODE
+		remove_proc_entry("all_sta_info", dir_dev);
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+		remove_proc_entry("_malloc_cnt", dir_dev);
+#endif
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+		remove_proc_entry("best_channel", dir_dev);
+#endif
+		remove_proc_entry("rx_signal", dir_dev);
+
+		remove_proc_entry("cbw40_enable", dir_dev);
+
+		remove_proc_entry("ht_enable", dir_dev);
+
+		remove_proc_entry("ampdu_enable", dir_dev);
+
+		remove_proc_entry("rx_stbc", dir_dev);
+
+		remove_proc_entry("path_rssi", dir_dev);
+
+		remove_proc_entry("vid", dir_dev);
+
+		remove_proc_entry("pid", dir_dev);
+
+		remove_proc_entry("rssi_disp", dir_dev);
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+		remove_proc_entry("sreset", dir_dev);
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+		remove_proc_entry("dm_adaptivity", dir_dev);
+#endif
+
+		remove_proc_entry(dev->name, rtw_proc);
+		dir_dev = NULL;
+
+	}
+	else
+	{
+		return;
+	}
+
+	rtw_proc_cnt--;
+
+	if(rtw_proc_cnt == 0)
+	{
+		if(rtw_proc){
+			remove_proc_entry("ver_info", rtw_proc);
+
+			remove_proc_entry("log_level", rtw_proc);
+			#ifdef DBG_MEM_ALLOC
+			remove_proc_entry("mstat", rtw_proc);
+			#endif /* DBG_MEM_ALLOC */
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+			remove_proc_entry(rtw_proc_name, proc_net);
+#else
+			remove_proc_entry(rtw_proc_name, init_net.proc_net);
+#endif
+			rtw_proc = NULL;
+		}
+	}
+}
+#endif
+
+uint loadparam( _adapter *padapter,  _nic_hdl	pnetdev);
+uint loadparam( _adapter *padapter,  _nic_hdl	pnetdev)
+{
+
+	uint status = _SUCCESS;
+	struct registry_priv  *registry_par = &padapter->registrypriv;
+
+_func_enter_;
+
+	registry_par->chip_version = (u8)rtw_chip_version;
+	registry_par->rfintfs = (u8)rtw_rfintfs;
+	registry_par->lbkmode = (u8)rtw_lbkmode;
+	//registry_par->hci = (u8)hci;
+	registry_par->network_mode  = (u8)rtw_network_mode;
+
+	_rtw_memcpy(registry_par->ssid.Ssid, "ANY", 3);
+	registry_par->ssid.SsidLength = 3;
+
+	registry_par->channel = (u8)rtw_channel;
+	registry_par->wireless_mode = (u8)rtw_wireless_mode;
+	registry_par->vrtl_carrier_sense = (u8)rtw_vrtl_carrier_sense ;
+	registry_par->vcs_type = (u8)rtw_vcs_type;
+	registry_par->rts_thresh=(u16)rtw_rts_thresh;
+	registry_par->frag_thresh=(u16)rtw_frag_thresh;
+	registry_par->preamble = (u8)rtw_preamble;
+	registry_par->scan_mode = (u8)rtw_scan_mode;
+	registry_par->adhoc_tx_pwr = (u8)rtw_adhoc_tx_pwr;
+	registry_par->soft_ap=  (u8)rtw_soft_ap;
+	//registry_par->smart_ps =  (u8)rtw_smart_ps;
+	registry_par->power_mgnt = (u8)rtw_power_mgnt;
+	registry_par->ips_mode = (u8)rtw_ips_mode;
+	registry_par->radio_enable = (u8)rtw_radio_enable;
+	registry_par->long_retry_lmt = (u8)rtw_long_retry_lmt;
+	registry_par->short_retry_lmt = (u8)rtw_short_retry_lmt;
+  	registry_par->busy_thresh = (u16)rtw_busy_thresh;
+  	//registry_par->qos_enable = (u8)rtw_qos_enable;
+	registry_par->ack_policy = (u8)rtw_ack_policy;
+	registry_par->mp_mode = (u8)rtw_mp_mode;
+	registry_par->software_encrypt = (u8)rtw_software_encrypt;
+	registry_par->software_decrypt = (u8)rtw_software_decrypt;
+
+	registry_par->acm_method = (u8)rtw_acm_method;
+
+	 //UAPSD
+	registry_par->wmm_enable = (u8)rtw_wmm_enable;
+	registry_par->uapsd_enable = (u8)rtw_uapsd_enable;
+	registry_par->uapsd_max_sp = (u8)rtw_uapsd_max_sp;
+	registry_par->uapsd_acbk_en = (u8)rtw_uapsd_acbk_en;
+	registry_par->uapsd_acbe_en = (u8)rtw_uapsd_acbe_en;
+	registry_par->uapsd_acvi_en = (u8)rtw_uapsd_acvi_en;
+	registry_par->uapsd_acvo_en = (u8)rtw_uapsd_acvo_en;
+
+#ifdef CONFIG_80211N_HT
+	registry_par->ht_enable = (u8)rtw_ht_enable;
+	registry_par->cbw40_enable = (u8)rtw_cbw40_enable;
+	registry_par->ampdu_enable = (u8)rtw_ampdu_enable;
+	registry_par->rx_stbc = (u8)rtw_rx_stbc;
+	registry_par->ampdu_amsdu = (u8)rtw_ampdu_amsdu;
+#endif
+
+	registry_par->lowrate_two_xmit = (u8)rtw_lowrate_two_xmit;
+	registry_par->rf_config = (u8)rtw_rf_config;
+	registry_par->low_power = (u8)rtw_low_power;
+
+
+	registry_par->wifi_spec = (u8)rtw_wifi_spec;
+	registry_par->special_rf_path = (u8)rtw_special_rf_path;
+	registry_par->channel_plan = (u8)rtw_channel_plan;
+
+#ifdef CONFIG_BT_COEXIST
+	registry_par->bt_iso = (u8)rtw_bt_iso;
+	registry_par->bt_sco = (u8)rtw_bt_sco;
+	registry_par->bt_ampdu = (u8)rtw_bt_ampdu;
+#endif
+	registry_par->bAcceptAddbaReq = (u8)rtw_AcceptAddbaReq;
+
+	registry_par->antdiv_cfg = (u8)rtw_antdiv_cfg;
+
+#ifdef CONFIG_AUTOSUSPEND
+	registry_par->usbss_enable = (u8)rtw_enusbss;//0:disable,1:enable
+#endif
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	registry_par->hwpdn_mode = (u8)rtw_hwpdn_mode;//0:disable,1:enable,2:by EFUSE config
+	registry_par->hwpwrp_detect = (u8)rtw_hwpwrp_detect;//0:disable,1:enable
+#endif
+
+	registry_par->hw_wps_pbc = (u8)rtw_hw_wps_pbc;
+
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+	snprintf(registry_par->adaptor_info_caching_file_path, PATH_LENGTH_MAX, "%s", rtw_adaptor_info_caching_file_path);
+	registry_par->adaptor_info_caching_file_path[PATH_LENGTH_MAX-1]=0;
+#endif
+
+#ifdef CONFIG_LAYER2_ROAMING
+	registry_par->max_roaming_times = (u8)rtw_max_roaming_times;
+#ifdef CONFIG_INTEL_WIDI
+	registry_par->max_roaming_times = (u8)rtw_max_roaming_times + 2;
+#endif // CONFIG_INTEL_WIDI
+#endif
+
+#ifdef CONFIG_IOL
+	registry_par->force_iol = rtw_force_iol;
+#endif
+
+	registry_par->mac_phy_mode = rtw_mac_phy_mode;
+
+#ifdef CONFIG_80211D
+	registry_par->enable80211d = (u8)rtw_80211d;
+#endif
+
+	snprintf(registry_par->ifname, 16, "%s", ifname);
+	snprintf(registry_par->if2name, 16, "%s", if2name);
+
+	registry_par->notch_filter = (u8)rtw_notch_filter;
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+	registry_par->ext_iface_num = (u8)rtw_ext_iface_num;
+#endif //CONFIG_MULTI_VIR_IFACES
+
+_func_exit_;
+
+	return status;
+}
+
+static int rtw_net_set_mac_address(struct net_device *pnetdev, void *p)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct sockaddr *addr = p;
+
+	if(padapter->bup == _FALSE)
+	{
+		//DBG_871X("r8711_net_set_mac_address(), MAC=%x:%x:%x:%x:%x:%x\n", addr->sa_data[0], addr->sa_data[1], addr->sa_data[2], addr->sa_data[3],
+		//addr->sa_data[4], addr->sa_data[5]);
+		_rtw_memcpy(padapter->eeprompriv.mac_addr, addr->sa_data, ETH_ALEN);
+		//_rtw_memcpy(pnetdev->dev_addr, addr->sa_data, ETH_ALEN);
+		//padapter->bset_hwaddr = _TRUE;
+	}
+
+	return 0;
+}
+
+static struct net_device_stats *rtw_net_get_stats(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
+	struct recv_priv *precvpriv = &(padapter->recvpriv);
+
+	padapter->stats.tx_packets = pxmitpriv->tx_pkts;//pxmitpriv->tx_pkts++;
+	padapter->stats.rx_packets = precvpriv->rx_pkts;//precvpriv->rx_pkts++;
+	padapter->stats.tx_dropped = pxmitpriv->tx_drop;
+	padapter->stats.rx_dropped = precvpriv->rx_drop;
+	padapter->stats.tx_bytes = pxmitpriv->tx_bytes;
+	padapter->stats.rx_bytes = precvpriv->rx_bytes;
+
+	return &padapter->stats;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+/*
+ * AC to queue mapping
+ *
+ * AC_VO -> queue 0
+ * AC_VI -> queue 1
+ * AC_BE -> queue 2
+ * AC_BK -> queue 3
+ */
+static const u16 rtw_1d_to_queue[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
+
+/* Given a data frame determine the 802.1p/1d tag to use. */
+unsigned int rtw_classify8021d(struct sk_buff *skb)
+{
+	unsigned int dscp;
+
+	/* skb->priority values from 256->263 are magic values to
+	 * directly indicate a specific 802.1d priority.  This is used
+	 * to allow 802.1d priority to be passed directly in from VLAN
+	 * tags, etc.
+	 */
+	if (skb->priority >= 256 && skb->priority <= 263)
+		return skb->priority - 256;
+
+	switch (skb->protocol) {
+	case htons(ETH_P_IP):
+		dscp = ip_hdr(skb)->tos & 0xfc;
+		break;
+	default:
+		return 0;
+	}
+
+	return dscp >> 5;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(4,19,0))
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
+			    struct net_device *sb_dev,
+			    select_queue_fallback_t fallback)
+#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(3,14,0))
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
+			    void *accel_priv,
+			    select_queue_fallback_t fallback)
+#else
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb)
+#endif
+{
+	_adapter	*padapter = rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	skb->priority = rtw_classify8021d(skb);
+
+	if(pmlmepriv->acm_mask != 0)
+	{
+		skb->priority = qos_acm(pmlmepriv->acm_mask, skb->priority);
+	}
+
+	return rtw_1d_to_queue[skb->priority];
+}
+
+u16 rtw_recv_select_queue(struct sk_buff *skb)
+{
+	struct iphdr *piphdr;
+	unsigned int dscp;
+	u16	eth_type;
+	u32 priority;
+	u8 *pdata = skb->data;
+
+	_rtw_memcpy(&eth_type, pdata+(ETH_ALEN<<1), 2);
+
+	switch (eth_type) {
+		case htons(ETH_P_IP):
+
+			piphdr = (struct iphdr *)(pdata+ETH_HLEN);
+
+			dscp = piphdr->tos & 0xfc;
+
+			priority = dscp >> 5;
+
+			break;
+		default:
+			priority = 0;
+	}
+
+	return rtw_1d_to_queue[priority];
+
+}
+
+#endif
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_netdev_ops = {
+	.ndo_open = netdev_open,
+	.ndo_stop = netdev_close,
+	.ndo_start_xmit = rtw_xmit_entry,
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	.ndo_select_queue	= rtw_select_queue,
+#endif
+	.ndo_set_mac_address = rtw_net_set_mac_address,
+	.ndo_get_stats = rtw_net_get_stats,
+	.ndo_do_ioctl = rtw_ioctl,
+};
+#endif
+
+int rtw_init_netdev_name(struct net_device *pnetdev, const char *ifname)
+{
+	_adapter *padapter = rtw_netdev_priv(pnetdev);
+
+#ifdef CONFIG_EASY_REPLACEMENT
+	struct net_device	*TargetNetdev = NULL;
+	_adapter			*TargetAdapter = NULL;
+	struct net 		*devnet = NULL;
+
+	if(padapter->bDongle == 1)
+	{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+		TargetNetdev = dev_get_by_name("wlan0");
+#else
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+		devnet = pnetdev->nd_net;
+	#else
+		devnet = dev_net(pnetdev);
+	#endif
+		TargetNetdev = dev_get_by_name(devnet, "wlan0");
+#endif
+		if(TargetNetdev) {
+			DBG_871X("Force onboard module driver disappear !!!\n");
+			TargetAdapter = rtw_netdev_priv(TargetNetdev);
+			TargetAdapter->DriverState = DRIVER_DISAPPEAR;
+
+			padapter->pid[0] = TargetAdapter->pid[0];
+			padapter->pid[1] = TargetAdapter->pid[1];
+			padapter->pid[2] = TargetAdapter->pid[2];
+
+			dev_put(TargetNetdev);
+			unregister_netdev(TargetNetdev);
+
+			if(TargetAdapter->chip_type == padapter->chip_type)
+				rtw_proc_remove_one(TargetNetdev);
+
+			padapter->DriverState = DRIVER_REPLACE_DONGLE;
+		}
+	}
+#endif //CONFIG_EASY_REPLACEMENT
+
+	if(dev_alloc_name(pnetdev, ifname) < 0)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("dev_alloc_name, fail! \n"));
+	}
+
+	netif_carrier_off(pnetdev);
+	//rtw_netif_stop_queue(pnetdev);
+
+	return 0;
+}
+
+static const struct device_type wlan_type = {
+	.name = "wlan",
+};
+
+struct net_device *rtw_init_netdev(_adapter *old_padapter)
+{
+	_adapter *padapter;
+	struct net_device *pnetdev;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+init_net_dev\n"));
+
+	if(old_padapter != NULL)
+		pnetdev = rtw_alloc_etherdev_with_old_priv(sizeof(_adapter), (void *)old_padapter);
+	else
+		pnetdev = rtw_alloc_etherdev(sizeof(_adapter));
+
+	if (!pnetdev)
+		return NULL;
+
+	pnetdev->dev.type = &wlan_type;
+	padapter = rtw_netdev_priv(pnetdev);
+	padapter->pnetdev = pnetdev;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
+	SET_MODULE_OWNER(pnetdev);
+#endif
+
+	//pnetdev->init = NULL;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	DBG_871X("register rtw_netdev_ops to netdev_ops\n");
+	pnetdev->netdev_ops = &rtw_netdev_ops;
+#else
+	pnetdev->open = netdev_open;
+	pnetdev->stop = netdev_close;
+	pnetdev->hard_start_xmit = rtw_xmit_entry;
+	pnetdev->set_mac_address = rtw_net_set_mac_address;
+	pnetdev->get_stats = rtw_net_get_stats;
+	pnetdev->do_ioctl = rtw_ioctl;
+#endif
+
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	pnetdev->features |= NETIF_F_IP_CSUM;
+#endif
+	//pnetdev->tx_timeout = NULL;
+	pnetdev->watchdog_timeo = HZ*3; /* 3 second timeout */
+#ifdef CONFIG_WIRELESS_EXT
+	pnetdev->wireless_handlers = (struct iw_handler_def *)&rtw_handlers_def;
+#endif
+
+#ifdef WIRELESS_SPY
+	//priv->wireless_data.spy_data = &priv->spy_data;
+	//pnetdev->wireless_data = &priv->wireless_data;
+#endif
+
+	//step 2.
+   	loadparam(padapter, pnetdev);
+
+	return pnetdev;
+
+}
+
+void rtw_unregister_netdevs(struct dvobj_priv *dvobj)
+{
+	int i;
+	_adapter *padapter = NULL;
+
+	for (i=0;i<dvobj->iface_nums;i++) {
+		struct net_device *pnetdev = NULL;
+
+		padapter = dvobj->padapters[i];
+
+		if (padapter == NULL)
+			continue;
+
+		pnetdev = padapter->pnetdev;
+
+		if((padapter->DriverState != DRIVER_DISAPPEAR) && pnetdev) {
+			unregister_netdev(pnetdev); //will call netdev_close()
+			rtw_proc_remove_one(pnetdev);
+		}
+
+		#ifdef CONFIG_IOCTL_CFG80211
+		rtw_wdev_unregister(padapter->rtw_wdev);
+		#endif
+	}
+
+}
+
+u32 rtw_start_drv_threads(_adapter *padapter)
+{
+
+	u32 _status = _SUCCESS;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_start_drv_threads\n"));
+#ifdef CONFIG_XMIT_THREAD_MODE
+	padapter->xmitThread = kthread_run(rtw_xmit_thread, padapter, "RTW_XMIT_THREAD");
+	if(IS_ERR(padapter->xmitThread))
+		_status = _FAIL;
+#endif
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	padapter->recvThread = kthread_run(rtw_recv_thread, padapter, "RTW_RECV_THREAD");
+	if(IS_ERR(padapter->recvThread))
+		_status = _FAIL;
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->isprimary == _TRUE)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		padapter->cmdThread = kthread_run(rtw_cmd_thread, padapter, "RTW_CMD_THREAD");
+		if(IS_ERR(padapter->cmdThread))
+			_status = _FAIL;
+		else
+			_rtw_down_sema(&padapter->cmdpriv.terminate_cmdthread_sema); //wait for cmd_thread to run
+	}
+
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+	padapter->evtThread = kthread_run(event_thread, padapter, "RTW_EVENT_THREAD");
+	if(IS_ERR(padapter->evtThread))
+		_status = _FAIL;
+#endif
+
+	return _status;
+
+}
+
+void rtw_stop_drv_threads (_adapter *padapter)
+{
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_stop_drv_threads\n"));
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->isprimary == _TRUE)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		rtw_stop_cmd_thread(padapter);
+	}
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+        _rtw_up_sema(&padapter->evtpriv.evt_notify);
+	if(padapter->evtThread){
+		_rtw_down_sema(&padapter->evtpriv.terminate_evtthread_sema);
+	}
+#endif
+
+#ifdef CONFIG_XMIT_THREAD_MODE
+	// Below is to termindate tx_thread...
+	_rtw_up_sema(&padapter->xmitpriv.xmit_sema);
+	_rtw_down_sema(&padapter->xmitpriv.terminate_xmitthread_sema);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("\n drv_halt: rtw_xmit_thread can be terminated ! \n"));
+#endif
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	// Below is to termindate rx_thread...
+	_rtw_up_sema(&padapter->recvpriv.recv_sema);
+	_rtw_down_sema(&padapter->recvpriv.terminate_recvthread_sema);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("\n drv_halt:recv_thread can be terminated! \n"));
+#endif
+
+
+}
+
+u8 rtw_init_default_value(_adapter *padapter);
+u8 rtw_init_default_value(_adapter *padapter)
+{
+	u8 ret  = _SUCCESS;
+	struct registry_priv* pregistrypriv = &padapter->registrypriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	//xmit_priv
+	pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense;
+	pxmitpriv->vcs = pregistrypriv->vcs_type;
+	pxmitpriv->vcs_type = pregistrypriv->vcs_type;
+	//pxmitpriv->rts_thresh = pregistrypriv->rts_thresh;
+	pxmitpriv->frag_len = pregistrypriv->frag_thresh;
+
+
+
+	//recv_priv
+
+
+	//mlme_priv
+	pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+	pmlmepriv->scan_mode = SCAN_ACTIVE;
+
+	//qos_priv
+	//pmlmepriv->qospriv.qos_option = pregistrypriv->wmm_enable;
+
+	//ht_priv
+#ifdef CONFIG_80211N_HT
+	pmlmepriv->htpriv.ampdu_enable = _FALSE;//set to disabled
+#endif
+
+	//security_priv
+	//rtw_get_encrypt_decrypt_from_registrypriv(padapter);
+	psecuritypriv->binstallGrpkey = _FAIL;
+	psecuritypriv->sw_encrypt=pregistrypriv->software_encrypt;
+	psecuritypriv->sw_decrypt=pregistrypriv->software_decrypt;
+
+	psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open; //open system
+	psecuritypriv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
+
+	psecuritypriv->dot11PrivacyKeyIndex = 0;
+
+	psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+	psecuritypriv->dot118021XGrpKeyid = 1;
+
+	psecuritypriv->ndisauthtype = Ndis802_11AuthModeOpen;
+	psecuritypriv->ndisencryptstatus = Ndis802_11WEPDisabled;
+
+
+	//pwrctrl_priv
+
+
+	//registry_priv
+	rtw_init_registrypriv_dev_network(padapter);
+	rtw_update_registrypriv_dev_network(padapter);
+
+
+	//hal_priv
+	rtw_hal_def_value_init(padapter);
+
+	//misc.
+	padapter->bReadPortCancel = _FALSE;
+	padapter->bWritePortCancel = _FALSE;
+	padapter->bRxRSSIDisplay = 0;
+	padapter->bForceWriteInitGain = 1;
+	padapter->bNotifyChannelChange = 0;
+#ifdef CONFIG_P2P
+	padapter->bShowGetP2PState = 1;
+#endif
+	return ret;
+}
+
+struct dvobj_priv *devobj_init(void)
+{
+	struct dvobj_priv *pdvobj = NULL;
+
+	if ((pdvobj = (struct dvobj_priv*)rtw_zmalloc(sizeof(*pdvobj))) == NULL)
+		return NULL;
+
+	_rtw_mutex_init(&pdvobj->hw_init_mutex);
+	_rtw_mutex_init(&pdvobj->h2c_fwcmd_mutex);
+	_rtw_mutex_init(&pdvobj->setch_mutex);
+	_rtw_mutex_init(&pdvobj->setbw_mutex);
+
+	pdvobj->processing_dev_remove = _FALSE;
+
+	return pdvobj;
+}
+
+void devobj_deinit(struct dvobj_priv *pdvobj)
+{
+	if(!pdvobj)
+		return;
+
+	_rtw_mutex_free(&pdvobj->hw_init_mutex);
+	_rtw_mutex_free(&pdvobj->h2c_fwcmd_mutex);
+	_rtw_mutex_free(&pdvobj->setch_mutex);
+	_rtw_mutex_free(&pdvobj->setbw_mutex);
+
+	rtw_mfree((u8*)pdvobj, sizeof(*pdvobj));
+}
+
+u8 rtw_reset_drv_sw(_adapter *padapter)
+{
+	u8	ret8=_SUCCESS;
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	//hal_priv
+	rtw_hal_def_value_init(padapter);
+	padapter->bReadPortCancel = _FALSE;
+	padapter->bWritePortCancel = _FALSE;
+	padapter->bRxRSSIDisplay = 0;
+	pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+
+	pwrctrlpriv->bips_processing = _FALSE;
+	pwrctrlpriv->rf_pwrstate = rf_on;
+
+	padapter->xmitpriv.tx_pkts = 0;
+	padapter->recvpriv.rx_pkts = 0;
+
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = _FALSE;
+
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY |_FW_UNDER_LINKING);
+
+#ifdef CONFIG_AUTOSUSPEND
+	#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,34))
+		adapter_to_dvobj(padapter)->pusbdev->autosuspend_disabled = 1;//autosuspend disabled by the user
+	#endif
+#endif
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	rtw_hal_sreset_reset_value(padapter);
+#endif
+	pwrctrlpriv->pwr_state_check_cnts = 0;
+
+	//mlmeextpriv
+	padapter->mlmeextpriv.sitesurvey_res.state= SCAN_DISABLE;
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&padapter->recvpriv);
+#endif
+
+	return ret8;
+}
+
+
+u8 rtw_init_drv_sw(_adapter *padapter)
+{
+
+	u8	ret8=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_init_drv_sw\n"));
+
+	if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init cmd_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+	padapter->cmdpriv.padapter=padapter;
+
+	if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init evt_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+
+	if (rtw_init_mlme_priv(padapter) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init mlme_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+#ifdef CONFIG_P2P
+	rtw_init_wifidirect_timers(padapter);
+	init_wifidirect_info(padapter, P2P_ROLE_DISABLE);
+	reset_global_wifidirect_info(padapter);
+	#ifdef CONFIG_IOCTL_CFG80211
+	rtw_init_cfg80211_wifidirect_info(padapter);
+	#endif
+#ifdef CONFIG_WFD
+	if(rtw_init_wifi_display_info(padapter) == _FAIL)
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init init_wifi_display_info\n"));
+#endif
+#endif /* CONFIG_P2P */
+
+	if(init_mlme_ext_priv(padapter) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init mlme_ext_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+#ifdef CONFIG_TDLS
+	if(rtw_init_tdls_info(padapter) == _FAIL)
+	{
+		DBG_871X("Can't rtw_init_tdls_info\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+#endif //CONFIG_TDLS
+
+	if(_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL)
+	{
+		DBG_871X("Can't _rtw_init_xmit_priv\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+
+	if(_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL)
+	{
+		DBG_871X("Can't _rtw_init_recv_priv\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_rtw_spinlock_init(&padapter->security_key_mutex);
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((unsigned char *)&padapter->securitypriv, 0, sizeof (struct security_priv));
+
+	//_init_timer(&(padapter->securitypriv.tkip_timer), padapter->pifp, rtw_use_tkipkey_handler, padapter);
+
+	if(_rtw_init_sta_priv(&padapter->stapriv) == _FAIL)
+	{
+		DBG_871X("Can't _rtw_init_sta_priv\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+
+	padapter->stapriv.padapter = padapter;
+	padapter->setband = GHZ24_50;
+	rtw_init_bcmc_stainfo(padapter);
+
+	rtw_init_pwrctrl_priv(padapter);
+
+	//_rtw_memset((u8 *)&padapter->qospriv, 0, sizeof (struct qos_priv));//move to mlme_priv
+
+#ifdef CONFIG_MP_INCLUDED
+	if (init_mp_priv(padapter) == _FAIL) {
+		DBG_871X("%s: initialize MP private data Fail!\n", __func__);
+	}
+#endif
+
+	ret8 = rtw_init_default_value(padapter);
+
+	rtw_hal_dm_init(padapter);
+	rtw_hal_sw_led_init(padapter);
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	rtw_hal_sreset_init(padapter);
+#endif
+
+#ifdef CONFIG_INTEL_WIDI
+	if(rtw_init_intel_widi(padapter) == _FAIL)
+	{
+		DBG_871X("Can't rtw_init_intel_widi\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+#endif //CONFIG_INTEL_WIDI
+
+#ifdef CONFIG_BR_EXT
+	_rtw_spinlock_init(&padapter->br_ext_lock);
+#endif	// CONFIG_BR_EXT
+
+exit:
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-rtw_init_drv_sw\n"));
+
+	_func_exit_;
+
+	return ret8;
+
+}
+
+void rtw_cancel_all_timer(_adapter *padapter)
+{
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_cancel_all_timer\n"));
+
+	_cancel_timer_ex(&padapter->mlmepriv.assoc_timer);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel association timer complete! \n"));
+
+	//_cancel_timer_ex(&padapter->securitypriv.tkip_timer);
+	//RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel tkip_timer! \n"));
+
+	_cancel_timer_ex(&padapter->mlmepriv.scan_to_timer);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel scan_to_timer! \n"));
+
+	_cancel_timer_ex(&padapter->mlmepriv.dynamic_chk_timer);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel dynamic_chk_timer! \n"));
+
+	// cancel sw led timer
+	rtw_hal_sw_led_deinit(padapter);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel DeInitSwLeds! \n"));
+
+	_cancel_timer_ex(&padapter->pwrctrlpriv.pwr_state_check_timer);
+
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef CONFIG_P2P
+	_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+#endif //CONFIG_P2P
+#endif //CONFIG_IOCTL_CFG80211
+
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+	_cancel_timer_ex(&padapter->mlmepriv.set_scan_deny_timer);
+	rtw_clear_scan_deny(padapter);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel set_scan_deny_timer! \n"));
+#endif
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	_cancel_timer_ex(&padapter->recvpriv.signal_stat_timer);
+#endif
+
+	// cancel dm  timer
+	rtw_hal_dm_deinit(padapter);
+
+#ifdef CONFIG_PLATFORM_FS_MX61
+	msleep(50);
+#endif
+}
+
+u8 rtw_free_drv_sw(_adapter *padapter)
+{
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("==>rtw_free_drv_sw"));
+
+
+	//we can call rtw_p2p_enable here, but:
+	// 1. rtw_p2p_enable may have IO operation
+	// 2. rtw_p2p_enable is bundled with wext interface
+	#ifdef CONFIG_P2P
+	{
+		struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+#ifdef CONFIG_CONCURRENT_MODE
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+#endif // CONFIG_CONCURRENT_MODE
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_NONE);
+		}
+	}
+	#endif
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_rtw_spinlock_free(&padapter->security_key_mutex);
+
+#ifdef CONFIG_BR_EXT
+	_rtw_spinlock_free(&padapter->br_ext_lock);
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_INTEL_WIDI
+	rtw_free_intel_widi(padapter);
+#endif //CONFIG_INTEL_WIDI
+
+	free_mlme_ext_priv(&padapter->mlmeextpriv);
+
+#ifdef CONFIG_TDLS
+	//rtw_free_tdls_info(&padapter->tdlsinfo);
+#endif //CONFIG_TDLS
+
+	rtw_free_cmd_priv(&padapter->cmdpriv);
+
+	rtw_free_evt_priv(&padapter->evtpriv);
+
+	rtw_free_mlme_priv(&padapter->mlmepriv);
+
+	//free_io_queue(padapter);
+
+	_rtw_free_xmit_priv(&padapter->xmitpriv);
+
+	_rtw_free_sta_priv(&padapter->stapriv); //will free bcmc_stainfo here
+
+	_rtw_free_recv_priv(&padapter->recvpriv);
+
+	rtw_free_pwrctrl_priv(padapter);
+
+	//rtw_mfree((void *)padapter, sizeof (padapter));
+
+#ifdef CONFIG_DRVEXT_MODULE
+	free_drvext(&padapter->drvextpriv);
+#endif
+
+	rtw_hal_free_data(padapter);
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("<==rtw_free_drv_sw\n"));
+
+	//free the old_pnetdev
+	if(padapter->rereg_nd_name_priv.old_pnetdev) {
+		free_netdev(padapter->rereg_nd_name_priv.old_pnetdev);
+		padapter->rereg_nd_name_priv.old_pnetdev = NULL;
+	}
+
+	// clear pbuddy_adapter to avoid access wrong pointer.
+	if(padapter->pbuddy_adapter != NULL)
+	{
+		padapter->pbuddy_adapter->pbuddy_adapter = NULL;
+	}
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-rtw_free_drv_sw\n"));
+
+	return _SUCCESS;
+
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_USB_HCI
+	#include <usb_hal.h>
+#endif
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+int _netdev_vir_if_open(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	_adapter *primary_padapter = GET_PRIMARY_ADAPTER(padapter);
+
+	DBG_871X(FUNC_NDEV_FMT" enter\n", FUNC_NDEV_ARG(pnetdev));
+
+	if(!primary_padapter)
+		goto _netdev_virtual_iface_open_error;
+
+	if(primary_padapter->bup == _FALSE || primary_padapter->hw_init_completed == _FALSE)
+	{
+		_netdev_open(primary_padapter->pnetdev);
+	}
+
+	if(padapter->bup == _FALSE && primary_padapter->bup == _TRUE &&
+		primary_padapter->hw_init_completed == _TRUE)
+	{
+		int i;
+
+		padapter->bDriverStopped = _FALSE;
+	 	padapter->bSurpriseRemoved = _FALSE;
+		padapter->bCardDisableWOHSM = _FALSE;
+
+		_rtw_memcpy(padapter->HalData, primary_padapter->HalData, padapter->hal_data_sz);
+
+		padapter->bFWReady = primary_padapter->bFWReady;
+
+		if(rtw_start_drv_threads(padapter) == _FAIL)
+		{
+			goto _netdev_virtual_iface_open_error;
+		}
+
+		padapter->dir_dev = NULL;
+		rtw_proc_init_one(pnetdev);
+
+#ifdef CONFIG_IOCTL_CFG80211
+		rtw_cfg80211_init_wiphy(padapter);
+#endif
+
+		padapter->bup = _TRUE;
+		padapter->hw_init_completed = _TRUE;
+
+		rtw_start_mbssid_cam(padapter);//start mbssid_cam after bup = _TRUE & hw_init_completed = _TRUE
+
+	}
+
+	padapter->net_closed = _FALSE;
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+
+	DBG_871X(FUNC_NDEV_FMT" exit\n", FUNC_NDEV_ARG(pnetdev));
+	return 0;
+
+_netdev_virtual_iface_open_error:
+
+	padapter->bup = _FALSE;
+
+	netif_carrier_off(pnetdev);
+	rtw_netif_stop_queue(pnetdev);
+
+	return (-1);
+
+}
+
+int netdev_vir_if_open(struct net_device *pnetdev)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	ret = _netdev_vir_if_open(pnetdev);
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	return ret;
+}
+
+static int netdev_vir_if_close(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	padapter->net_closed = _TRUE;
+
+	if(pnetdev)
+	{
+		if (!rtw_netif_queue_stopped(pnetdev))
+			rtw_netif_stop_queue(pnetdev);
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_scan_abort(padapter);
+	wdev_to_priv(padapter->rtw_wdev)->bandroid_scan = _FALSE;
+#endif
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_netdev_vir_if_ops = {
+	 .ndo_open = netdev_vir_if_open,
+        .ndo_stop = netdev_vir_if_close,
+        .ndo_start_xmit = rtw_xmit_entry,
+        .ndo_set_mac_address = rtw_net_set_mac_address,
+        .ndo_get_stats = rtw_net_get_stats,
+        .ndo_do_ioctl = rtw_ioctl,
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	.ndo_select_queue	= rtw_select_queue,
+#endif
+};
+#endif
+
+_adapter *rtw_drv_add_vir_if(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops))
+{
+
+	int res = _FAIL;
+	struct net_device *pnetdev=NULL;
+	_adapter *padapter = NULL;
+	struct dvobj_priv *pdvobjpriv;
+	u8 mac[ETH_ALEN];
+
+/*
+	if((primary_padapter->bup == _FALSE) ||
+		(rtw_buddy_adapter_up(primary_padapter) == _FALSE))
+	{
+		goto error_rtw_drv_add_iface;
+	}
+
+*/
+	/****** init netdev ******/
+	pnetdev = rtw_init_netdev(NULL);
+	if (!pnetdev)
+		goto error_rtw_drv_add_iface;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	DBG_871X("register rtw_netdev_virtual_iface_ops to netdev_ops\n");
+	pnetdev->netdev_ops = &rtw_netdev_vir_if_ops;
+#else
+	pnetdev->open = netdev_vir_if_open;
+	pnetdev->stop = netdev_vir_if_close;
+#endif
+
+#ifdef CONFIG_NO_WIRELESS_HANDLERS
+	pnetdev->wireless_handlers = NULL;
+#endif
+
+	/****** init adapter ******/
+	padapter = rtw_netdev_priv(pnetdev);
+	_rtw_memcpy(padapter, primary_padapter, sizeof(_adapter));
+
+	//
+	padapter->bup = _FALSE;
+	padapter->net_closed = _TRUE;
+	padapter->hw_init_completed = _FALSE;
+
+
+	//set adapter_type/iface type
+	padapter->isprimary = _FALSE;
+	padapter->adapter_type = MAX_ADAPTER;
+	padapter->pbuddy_adapter = primary_padapter;
+#if 0
+#ifndef CONFIG_HWPORT_SWAP	//Port0 -> Pri , Port1 -> Sec
+	padapter->iface_type = IFACE_PORT1;
+#else
+	padapter->iface_type = IFACE_PORT0;
+#endif  //CONFIG_HWPORT_SWAP
+#else
+	//extended virtual interfaces always are set to port0
+	padapter->iface_type = IFACE_PORT0;
+#endif
+	//
+	padapter->pnetdev = pnetdev;
+
+	/****** setup dvobj ******/
+	pdvobjpriv = adapter_to_dvobj(padapter);
+	padapter->iface_id = pdvobjpriv->iface_nums;
+	pdvobjpriv->padapters[pdvobjpriv->iface_nums++] = padapter;
+
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(pdvobjpriv));
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_alloc(padapter, dvobj_to_dev(pdvobjpriv));
+#endif //CONFIG_IOCTL_CFG80211
+
+	//set interface_type/chip_type/HardwareType
+	padapter->interface_type = primary_padapter->interface_type;
+	padapter->chip_type = primary_padapter->chip_type;
+	padapter->HardwareType = primary_padapter->HardwareType;
+
+	//set hal data & hal ops
+#if defined(CONFIG_RTL8192C)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192ce_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192cu_set_hal_ops(padapter);
+	#endif
+#elif defined(CONFIG_RTL8192D)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192de_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192du_set_hal_ops(padapter);
+	#endif
+#endif
+
+	padapter->HalFunc.inirp_init = NULL;
+	padapter->HalFunc.inirp_deinit = NULL;
+	padapter->intf_start = NULL;
+	padapter->intf_stop = NULL;
+
+	//step init_io_priv
+	if ((rtw_init_io_priv(padapter, set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+	}
+
+	//step read_chip_version
+	rtw_hal_read_chip_version(padapter);
+
+	//step usb endpoint mapping
+	rtw_hal_chip_configure(padapter);
+
+
+	//init drv data
+	if(rtw_init_drv_sw(padapter)!= _SUCCESS)
+		goto error_rtw_drv_add_iface;
+
+
+	//get mac address from primary_padapter
+	_rtw_memcpy(mac, primary_padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+	if (((mac[0]==0xff) &&(mac[1]==0xff) && (mac[2]==0xff) &&
+	     (mac[3]==0xff) && (mac[4]==0xff) &&(mac[5]==0xff)) ||
+	    ((mac[0]==0x0) && (mac[1]==0x0) && (mac[2]==0x0) &&
+	     (mac[3]==0x0) && (mac[4]==0x0) &&(mac[5]==0x0)))
+	{
+		mac[0] = 0x00;
+		mac[1] = 0xe0;
+		mac[2] = 0x4c;
+		mac[3] = 0x87;
+		mac[4] = 0x11;
+		mac[5] = 0x22;
+	}
+	else
+	{
+		//If the BIT1 is 0, the address is universally administered.
+		//If it is 1, the address is locally administered
+#if 1 //needs enable MBSSID CAM
+		mac[0] |= BIT(1); // locally administered
+		mac[0] |= (padapter->iface_id-1)<<4;
+#endif
+	}
+
+	_rtw_memcpy(padapter->eeprompriv.mac_addr, mac, ETH_ALEN);
+
+	padapter->dir_dev = NULL;
+
+	res = _SUCCESS;
+
+	return padapter;
+
+
+error_rtw_drv_add_iface:
+
+	if(padapter)
+		rtw_free_drv_sw(padapter);
+
+	if (pnetdev)
+		rtw_free_netdev(pnetdev);
+
+	return NULL;
+
+}
+
+void rtw_drv_stop_vir_if(_adapter *padapter)
+{
+	struct net_device *pnetdev=NULL;
+
+	if (padapter == NULL)
+		return;
+
+	pnetdev = padapter->pnetdev;
+
+	rtw_cancel_all_timer(padapter);
+
+	if(padapter->bup == _TRUE)
+	{
+		padapter->bDriverStopped = _TRUE;
+
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		rtw_stop_drv_threads(padapter);
+
+		padapter->bup = _FALSE;
+	}
+}
+
+void rtw_drv_free_vir_if(_adapter *padapter)
+{
+	struct net_device *pnetdev=NULL;
+
+	if (padapter == NULL)
+		return;
+
+	padapter->pbuddy_adapter = NULL;
+
+	pnetdev = padapter->pnetdev;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_free(padapter->rtw_wdev);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_free_drv_sw(padapter);
+
+	rtw_free_netdev(pnetdev);
+}
+
+void rtw_drv_stop_vir_ifaces(struct dvobj_priv *dvobj)
+{
+	int i;
+	//struct dvobj_priv *dvobj = primary_padapter->dvobj;
+
+	for(i=2;i<dvobj->iface_nums;i++)
+	{
+		rtw_drv_stop_vir_if(dvobj->padapters[i]);
+	}
+}
+
+void rtw_drv_free_vir_ifaces(struct dvobj_priv *dvobj)
+{
+	int i;
+	//struct dvobj_priv *dvobj = primary_padapter->dvobj;
+
+	for(i=2;i<dvobj->iface_nums;i++)
+	{
+		rtw_drv_free_vir_if(dvobj->padapters[i]);
+	}
+}
+
+void rtw_drv_del_vir_if(_adapter *padapter)
+{
+	rtw_drv_stop_vir_if(padapter);
+	rtw_drv_free_vir_if(padapter);
+}
+
+void rtw_drv_del_vir_ifaces(_adapter *primary_padapter)
+{
+	int i;
+	struct dvobj_priv *dvobj = primary_padapter->dvobj;
+
+	for(i=2;i<dvobj->iface_nums;i++)
+	{
+		rtw_drv_del_vir_if(dvobj->padapters[i]);
+	}
+}
+#endif //CONFIG_MULTI_VIR_IFACES
+
+int _netdev_if2_open(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	_adapter *primary_padapter = padapter->pbuddy_adapter;
+
+	DBG_871X("+871x_drv - if2_open, bup=%d\n", padapter->bup);
+
+	if(primary_padapter->bup == _FALSE || primary_padapter->hw_init_completed == _FALSE)
+	{
+		_netdev_open(primary_padapter->pnetdev);
+	}
+
+	if(padapter->bup == _FALSE && primary_padapter->bup == _TRUE &&
+		primary_padapter->hw_init_completed == _TRUE)
+	{
+		int i;
+
+		padapter->bDriverStopped = _FALSE;
+	 	padapter->bSurpriseRemoved = _FALSE;
+		padapter->bCardDisableWOHSM = _FALSE;
+
+		_rtw_memcpy(padapter->HalData, primary_padapter->HalData, padapter->hal_data_sz);
+
+		padapter->bFWReady = primary_padapter->bFWReady;
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_DM_INIT_PWDB, NULL);
+
+		//if (init_mlme_ext_priv(padapter) == _FAIL)
+		//	goto netdev_if2_open_error;
+
+
+		if(rtw_start_drv_threads(padapter) == _FAIL)
+		{
+			goto netdev_if2_open_error;
+		}
+
+
+		if(padapter->intf_start)
+		{
+			padapter->intf_start(padapter);
+		}
+
+
+		padapter->hw_init_completed = _TRUE;
+
+		padapter->dir_dev = NULL;
+		rtw_proc_init_one(pnetdev);
+
+
+#ifdef CONFIG_IOCTL_CFG80211
+		rtw_cfg80211_init_wiphy(padapter);
+#endif
+
+		padapter->bup = _TRUE;
+
+	}
+
+	padapter->net_closed = _FALSE;
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+	DBG_871X("-871x_drv - if2_open, bup=%d\n", padapter->bup);
+	return 0;
+
+netdev_if2_open_error:
+
+	padapter->bup = _FALSE;
+
+	netif_carrier_off(pnetdev);
+	rtw_netif_stop_queue(pnetdev);
+
+	return (-1);
+
+}
+
+int netdev_if2_open(struct net_device *pnetdev)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	ret = _netdev_if2_open(pnetdev);
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	return ret;
+}
+
+static int netdev_if2_close(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	padapter->net_closed = _TRUE;
+
+	if(pnetdev)
+	{
+		if (!rtw_netif_queue_stopped(pnetdev))
+			rtw_netif_stop_queue(pnetdev);
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_scan_abort(padapter);
+	wdev_to_priv(padapter->rtw_wdev)->bandroid_scan = _FALSE;
+#endif
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_netdev_if2_ops = {
+	.ndo_open = netdev_if2_open,
+        .ndo_stop = netdev_if2_close,
+        .ndo_start_xmit = rtw_xmit_entry,
+        .ndo_set_mac_address = rtw_net_set_mac_address,
+        .ndo_get_stats = rtw_net_get_stats,
+        .ndo_do_ioctl = rtw_ioctl,
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	.ndo_select_queue	= rtw_select_queue,
+#endif
+};
+#endif
+
+_adapter *rtw_drv_if2_init(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops))
+{
+	int res = _FAIL;
+	struct net_device *pnetdev =  NULL;
+	_adapter *padapter = NULL;
+	struct dvobj_priv *pdvobjpriv;
+	u8 mac[ETH_ALEN];
+
+	/****** init netdev ******/
+	pnetdev = rtw_init_netdev(NULL);
+	if (!pnetdev)
+		goto error_rtw_drv_if2_init;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	DBG_871X("register rtw_netdev_if2_ops to netdev_ops\n");
+	pnetdev->netdev_ops = &rtw_netdev_if2_ops;
+#else
+	pnetdev->open = netdev_if2_open;
+	pnetdev->stop = netdev_if2_close;
+#endif
+
+#ifdef CONFIG_NO_WIRELESS_HANDLERS
+	pnetdev->wireless_handlers = NULL;
+#endif
+
+	/****** init adapter ******/
+	padapter = rtw_netdev_priv(pnetdev);
+	_rtw_memcpy(padapter, primary_padapter, sizeof(_adapter));
+
+	//
+	padapter->bup = _FALSE;
+	padapter->net_closed = _TRUE;
+	padapter->hw_init_completed = _FALSE;
+
+	//set adapter_type/iface type
+	padapter->isprimary = _FALSE;
+	padapter->adapter_type = SECONDARY_ADAPTER;
+	padapter->pbuddy_adapter = primary_padapter;
+        padapter->iface_id = IFACE_ID1;
+#ifndef CONFIG_HWPORT_SWAP			//Port0 -> Pri , Port1 -> Sec
+	padapter->iface_type = IFACE_PORT1;
+#else
+	padapter->iface_type = IFACE_PORT0;
+#endif  //CONFIG_HWPORT_SWAP
+	//
+	padapter->pnetdev = pnetdev;
+
+	/****** setup dvobj ******/
+	pdvobjpriv = adapter_to_dvobj(padapter);
+	pdvobjpriv->if2 = padapter;
+	pdvobjpriv->padapters[pdvobjpriv->iface_nums++] = padapter;
+
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(pdvobjpriv));
+	#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_alloc(padapter, dvobj_to_dev(pdvobjpriv));
+	#endif //CONFIG_IOCTL_CFG80211
+
+	//set interface_type/chip_type/HardwareType
+	padapter->interface_type = primary_padapter->interface_type;
+	padapter->chip_type = primary_padapter->chip_type;
+	padapter->HardwareType = primary_padapter->HardwareType;
+
+	//set hal data & hal ops
+#if defined(CONFIG_RTL8192C)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192ce_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192cu_set_hal_ops(padapter);
+	#endif
+#elif defined(CONFIG_RTL8192D)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192de_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192du_set_hal_ops(padapter);
+	#endif
+#endif
+
+	padapter->HalFunc.inirp_init = NULL;
+	padapter->HalFunc.inirp_deinit = NULL;
+
+	//
+	padapter->intf_start = primary_padapter->intf_start;
+	padapter->intf_stop = primary_padapter->intf_stop;
+
+	//step init_io_priv
+	if ((rtw_init_io_priv(padapter, set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+	}
+
+	//step read_chip_version
+	rtw_hal_read_chip_version(padapter);
+
+	//step usb endpoint mapping
+	rtw_hal_chip_configure(padapter);
+
+
+	//init drv data
+	if(rtw_init_drv_sw(padapter)!= _SUCCESS)
+		goto error_rtw_drv_if2_init;
+
+	//get mac address from primary_padapter
+	_rtw_memcpy(mac, primary_padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+	if (((mac[0]==0xff) &&(mac[1]==0xff) && (mac[2]==0xff) &&
+	     (mac[3]==0xff) && (mac[4]==0xff) &&(mac[5]==0xff)) ||
+	    ((mac[0]==0x0) && (mac[1]==0x0) && (mac[2]==0x0) &&
+	     (mac[3]==0x0) && (mac[4]==0x0) &&(mac[5]==0x0)))
+	{
+		mac[0] = 0x00;
+		mac[1] = 0xe0;
+		mac[2] = 0x4c;
+		mac[3] = 0x87;
+		mac[4] = 0x11;
+		mac[5] = 0x22;
+	}
+	else
+	{
+		//If the BIT1 is 0, the address is universally administered.
+		//If it is 1, the address is locally administered
+		mac[0] |= BIT(1); // locally administered
+
+	}
+
+	_rtw_memcpy(padapter->eeprompriv.mac_addr, mac, ETH_ALEN);
+	rtw_init_wifidirect_addrs(padapter, padapter->eeprompriv.mac_addr, padapter->eeprompriv.mac_addr);
+
+	primary_padapter->pbuddy_adapter = padapter;
+
+	padapter->dir_dev = NULL;
+
+	res = _SUCCESS;
+
+	return padapter;
+
+
+error_rtw_drv_if2_init:
+
+	if(padapter)
+		rtw_free_drv_sw(padapter);
+
+	if (pnetdev)
+		rtw_free_netdev(pnetdev);
+
+	return NULL;
+
+}
+
+void rtw_drv_if2_free(_adapter *if2)
+{
+	_adapter *padapter = if2;
+	struct net_device *pnetdev = NULL;
+
+	if (padapter == NULL)
+		return;
+
+	pnetdev = padapter->pnetdev;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_free(padapter->rtw_wdev);
+#endif /* CONFIG_IOCTL_CFG80211 */
+
+
+	rtw_free_drv_sw(padapter);
+
+	rtw_free_netdev(pnetdev);
+
+}
+
+void rtw_drv_if2_stop(_adapter *if2)
+{
+	_adapter *padapter = if2;
+
+	if (padapter == NULL)
+		return;
+
+	rtw_cancel_all_timer(padapter);
+
+	if (padapter->bup == _TRUE) {
+		padapter->bDriverStopped = _TRUE;
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		rtw_stop_drv_threads(padapter);
+
+		padapter->bup = _FALSE;
+	}
+}
+#endif //end of CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_BR_EXT
+void netdev_br_init(struct net_device *netdev)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(netdev);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+
+	//if(check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE)
+	{
+		//struct net_bridge	*br = netdev->br_port->br;//->dev->dev_addr;
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		if (netdev->br_port)
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		if (rcu_dereference(adapter->pnetdev->rx_handler_data))
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		{
+			struct net_device *br_netdev;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+			br_netdev = dev_get_by_name(CONFIG_BR_EXT_BRNAME);
+#else	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+			struct net *devnet = NULL;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+			devnet = netdev->nd_net;
+#else	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+			devnet = dev_net(netdev);
+#endif	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+
+			br_netdev = dev_get_by_name(devnet, CONFIG_BR_EXT_BRNAME);
+#endif	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+
+			if (br_netdev) {
+				memcpy(adapter->br_mac, br_netdev->dev_addr, ETH_ALEN);
+				dev_put(br_netdev);
+			} else
+				printk("%s()-%d: dev_get_by_name(%s) failed!", __FUNCTION__, __LINE__, CONFIG_BR_EXT_BRNAME);
+		}
+
+		adapter->ethBrExtInfo.addPPPoETag = 1;
+	}
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_unlock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+}
+#endif //CONFIG_BR_EXT
+
+static int _rtw_drv_register_netdev(_adapter *padapter, char *name)
+{
+	int ret = _SUCCESS;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	/* alloc netdev name */
+	rtw_init_netdev_name(pnetdev, name);
+
+	_rtw_memcpy(pnetdev->dev_addr, padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+	/* Tell the network stack we exist */
+	if (register_netdev(pnetdev) != 0) {
+		DBG_871X(FUNC_NDEV_FMT "Failed!\n", FUNC_NDEV_ARG(pnetdev));
+		ret = _FAIL;
+		goto error_register_netdev;
+	}
+
+	DBG_871X("%s, MAC Address (if%d) = " MAC_FMT "\n", __FUNCTION__, (padapter->iface_id+1), MAC_ARG(pnetdev->dev_addr));
+
+	return ret;
+
+error_register_netdev:
+
+	if(padapter->iface_id > IFACE_ID0)
+	{
+		rtw_free_drv_sw(padapter);
+
+		rtw_free_netdev(pnetdev);
+	}
+
+	return ret;
+}
+
+int rtw_drv_register_netdev(_adapter *if1)
+{
+	int i, status = _SUCCESS;
+	struct dvobj_priv *dvobj = if1->dvobj;
+
+	if(dvobj->iface_nums < IFACE_ID_MAX)
+	{
+		for(i=0; i<dvobj->iface_nums; i++)
+		{
+			_adapter *padapter = dvobj->padapters[i];
+
+			if(padapter)
+			{
+				char *name;
+
+				if(padapter->iface_id == IFACE_ID0)
+					name = if1->registrypriv.ifname;
+				else if(padapter->iface_id == IFACE_ID1)
+					name = if1->registrypriv.if2name;
+				else
+					name = "wlan%d";
+
+				if((status = _rtw_drv_register_netdev(padapter, name)) != _SUCCESS) {
+					break;
+				}
+			}
+		}
+	}
+
+	return status;
+}
+
+int _netdev_open(struct net_device *pnetdev)
+{
+	uint status;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+871x_drv - dev_open\n"));
+	DBG_871X("+871x_drv - drv_open, bup=%d\n", padapter->bup);
+
+	if(pwrctrlpriv->ps_flag == _TRUE){
+		padapter->net_closed = _FALSE;
+		goto netdev_open_normal_process;
+	}
+
+	if(padapter->bup == _FALSE)
+	{
+		padapter->bDriverStopped = _FALSE;
+		padapter->bSurpriseRemoved = _FALSE;
+		padapter->bCardDisableWOHSM = _FALSE;
+
+		status = rtw_hal_init(padapter);
+		if (status ==_FAIL)
+		{
+			RT_TRACE(_module_os_intfs_c_,_drv_err_,("rtl871x_hal_init(): Can't init h/w!\n"));
+			goto netdev_open_error;
+		}
+
+		DBG_871X("MAC Address = "MAC_FMT"\n", MAC_ARG(pnetdev->dev_addr));
+
+
+		status=rtw_start_drv_threads(padapter);
+		if(status ==_FAIL)
+		{
+			RT_TRACE(_module_os_intfs_c_,_drv_err_,("Initialize driver software resource Failed!\n"));
+			goto netdev_open_error;
+		}
+
+#ifdef CONFIG_DRVEXT_MODULE
+		init_drvext(padapter);
+#endif
+
+		if(padapter->intf_start)
+		{
+			padapter->intf_start(padapter);
+		}
+
+#ifndef RTK_DMP_PLATFORM
+		rtw_proc_init_one(pnetdev);
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+		rtw_cfg80211_init_wiphy(padapter);
+#endif
+
+		rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+		padapter->bup = _TRUE;
+	}
+	padapter->net_closed = _FALSE;
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	padapter->pwrctrlpriv.bips_processing = _FALSE;
+	rtw_set_pwr_state_check_timer(&padapter->pwrctrlpriv);
+
+	//netif_carrier_on(pnetdev);//call this func when rtw_joinbss_event_callback return success
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+#ifdef CONFIG_BR_EXT
+	netdev_br_init(pnetdev);
+#endif	// CONFIG_BR_EXT
+
+netdev_open_normal_process:
+
+	#ifdef CONFIG_CONCURRENT_MODE
+	{
+		_adapter *sec_adapter = padapter->pbuddy_adapter;
+		if(sec_adapter && (sec_adapter->bup == _FALSE || sec_adapter->hw_init_completed == _FALSE))
+			_netdev_if2_open(sec_adapter->pnetdev);
+	}
+	#endif
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-871x_drv - dev_open\n"));
+	DBG_871X("-871x_drv - drv_open, bup=%d\n", padapter->bup);
+
+	return 0;
+
+netdev_open_error:
+
+	padapter->bup = _FALSE;
+
+	netif_carrier_off(pnetdev);
+	rtw_netif_stop_queue(pnetdev);
+
+	RT_TRACE(_module_os_intfs_c_,_drv_err_,("-871x_drv - dev_open, fail!\n"));
+	DBG_871X("-871x_drv - drv_open fail, bup=%d\n", padapter->bup);
+
+	return (-1);
+
+}
+
+int netdev_open(struct net_device *pnetdev)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	ret = _netdev_open(pnetdev);
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+
+	return ret;
+}
+
+#ifdef CONFIG_IPS
+int  ips_netdrv_open(_adapter *padapter)
+{
+	int status = _SUCCESS;
+	padapter->net_closed = _FALSE;
+	DBG_871X("===> %s.........\n",__FUNCTION__);
+
+
+	padapter->bDriverStopped = _FALSE;
+	padapter->bCardDisableWOHSM = _FALSE;
+	//padapter->bup = _TRUE;
+
+	status = rtw_hal_init(padapter);
+	if (status ==_FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("ips_netdrv_open(): Can't init h/w!\n"));
+		goto netdev_open_error;
+	}
+
+	if(padapter->intf_start)
+	{
+		padapter->intf_start(padapter);
+	}
+
+	rtw_set_pwr_state_check_timer(&padapter->pwrctrlpriv);
+  	_set_timer(&padapter->mlmepriv.dynamic_chk_timer,5000);
+
+	 return _SUCCESS;
+
+netdev_open_error:
+	//padapter->bup = _FALSE;
+	DBG_871X("-ips_netdrv_open - drv_open failure, bup=%d\n", padapter->bup);
+
+	return _FAIL;
+}
+
+
+int rtw_ips_pwr_up(_adapter *padapter)
+{
+	int result;
+	u32 start_time = rtw_get_current_time();
+	DBG_871X("===>  rtw_ips_pwr_up..............\n");
+	rtw_reset_drv_sw(padapter);
+
+	result = ips_netdrv_open(padapter);
+
+	rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+ 	DBG_871X("<===  rtw_ips_pwr_up.............. in %dms\n", rtw_get_passing_time_ms(start_time));
+	return result;
+
+}
+
+void rtw_ips_pwr_down(_adapter *padapter)
+{
+	u32 start_time = rtw_get_current_time();
+	DBG_871X("===> rtw_ips_pwr_down...................\n");
+
+	padapter->bCardDisableWOHSM = _TRUE;
+	padapter->net_closed = _TRUE;
+
+	rtw_led_control(padapter, LED_CTL_POWER_OFF);
+
+	rtw_ips_dev_unload(padapter);
+	padapter->bCardDisableWOHSM = _FALSE;
+	DBG_871X("<=== rtw_ips_pwr_down..................... in %dms\n", rtw_get_passing_time_ms(start_time));
+}
+#endif
+void rtw_ips_dev_unload(_adapter *padapter)
+{
+	struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+	DBG_871X("====> %s...\n",__FUNCTION__);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_FIFO_CLEARN_UP, 0);
+
+	if(padapter->intf_stop)
+	{
+		padapter->intf_stop(padapter);
+	}
+
+	//s5.
+	if(padapter->bSurpriseRemoved == _FALSE)
+	{
+		rtw_hal_deinit(padapter);
+	}
+
+}
+
+int pm_netdev_open(struct net_device *pnetdev,u8 bnormal)
+{
+	int status;
+	if(bnormal)
+		status = netdev_open(pnetdev);
+#ifdef CONFIG_IPS
+	else
+		status =  (_SUCCESS == ips_netdrv_open((_adapter *)rtw_netdev_priv(pnetdev)))?(0):(-1);
+#endif
+
+	return status;
+}
+
+static int netdev_close(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+871x_drv - drv_close\n"));
+
+	if(padapter->pwrctrlpriv.bInternalAutoSuspend == _TRUE)
+	{
+		//rtw_pwr_wakeup(padapter);
+		if(padapter->pwrctrlpriv.rf_pwrstate == rf_off)
+			padapter->pwrctrlpriv.ps_flag = _TRUE;
+	}
+	padapter->net_closed = _TRUE;
+
+/*	if(!padapter->hw_init_completed)
+	{
+		DBG_871X("(1)871x_drv - drv_close, bup=%d, hw_init_completed=%d\n", padapter->bup, padapter->hw_init_completed);
+
+		padapter->bDriverStopped = _TRUE;
+
+		rtw_dev_unload(padapter);
+	}
+	else*/
+	if(padapter->pwrctrlpriv.rf_pwrstate == rf_on){
+		DBG_871X("(2)871x_drv - drv_close, bup=%d, hw_init_completed=%d\n", padapter->bup, padapter->hw_init_completed);
+
+		//s1.
+		if(pnetdev)
+		{
+			if (!rtw_netif_queue_stopped(pnetdev))
+				rtw_netif_stop_queue(pnetdev);
+		}
+
+#ifndef CONFIG_ANDROID
+		//s2.
+		LeaveAllPowerSaveMode(padapter);
+		rtw_disassoc_cmd(padapter, 500, _FALSE);
+		//s2-2.  indicate disconnect to os
+		rtw_indicate_disconnect(padapter);
+		//s2-3.
+		rtw_free_assoc_resources(padapter, 1);
+		//s2-4.
+		rtw_free_network_queue(padapter,_TRUE);
+#endif
+		// Close LED
+		rtw_led_control(padapter, LED_CTL_POWER_OFF);
+	}
+
+#ifdef CONFIG_BR_EXT
+	//if (OPMODE & (WIFI_STATION_STATE | WIFI_ADHOC_STATE))
+	{
+		//void nat25_db_cleanup(_adapter *priv);
+		nat25_db_cleanup(padapter);
+	}
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_P2P
+#ifdef CONFIG_IOCTL_CFG80211
+	if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+	{
+		if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled == _TRUE)
+			wdev_to_priv(padapter->rtw_wdev)->p2p_enabled = _FALSE;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+	rtw_p2p_enable(padapter, P2P_ROLE_DISABLE);
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_scan_abort(padapter);
+	wdev_to_priv(padapter->rtw_wdev)->bandroid_scan = _FALSE;
+	padapter->rtw_wdev->iftype = NL80211_IFTYPE_MONITOR; //set this at the end
+#endif //CONFIG_IOCTL_CFG80211
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-871x_drv - drv_close\n"));
+	DBG_871X("-871x_drv - drv_close, bup=%d\n", padapter->bup);
+
+	return 0;
+}
+
+void rtw_ndev_destructor(struct net_device *ndev)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (ndev->ieee80211_ptr)
+		rtw_mfree((u8 *)ndev->ieee80211_ptr, sizeof(struct wireless_dev));
+#endif
+	free_netdev(ndev);
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c
new file mode 100755
index 0000000000000..5bf576f1a3e3e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c
@@ -0,0 +1,1997 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_INTF_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <hal_intf.h>
+#include <rtw_version.h>
+
+#ifndef CONFIG_PCI_HCI
+
+#error "CONFIG_PCI_HCI shall be on!\n"
+
+#endif
+
+#include <pci_ops.h>
+#include <pci_osintf.h>
+#include <pci_hal.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#ifdef CONFIG_80211N_HT
+extern int rtw_ht_enable;
+extern int rtw_cbw40_enable;
+extern int rtw_ampdu_enable;//for enable tx_ampdu
+#endif
+
+#ifdef CONFIG_PM
+extern int pm_netdev_open(struct net_device *pnetdev);
+static int rtw_suspend(struct pci_dev *pdev, pm_message_t state);
+static int rtw_resume(struct pci_dev *pdev);
+#endif
+
+
+static int rtw_drv_init(struct pci_dev *pdev, const struct pci_device_id *pdid);
+static void rtw_dev_remove(struct pci_dev *pdev);
+
+static struct specific_device_id specific_device_id_tbl[] = {
+	{.idVendor=0x0b05, .idProduct=0x1791, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor=0x13D3, .idProduct=0x3311, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{}
+};
+
+struct pci_device_id rtw_pci_id_tbl[] = {
+#ifdef CONFIG_RTL8192C
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8191)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8178)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8177)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8176)},
+#endif
+#ifdef CONFIG_RTL8192D
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8193)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x002B)},
+#endif
+	{},
+};
+
+struct pci_drv_priv {
+	struct pci_driver rtw_pci_drv;
+	int drv_registered;
+};
+
+
+static struct pci_drv_priv pci_drvpriv = {
+	.rtw_pci_drv.name = (char*)DRV_NAME,
+	.rtw_pci_drv.probe = rtw_drv_init,
+	.rtw_pci_drv.remove = rtw_dev_remove,
+	.rtw_pci_drv.id_table = rtw_pci_id_tbl,
+#ifdef CONFIG_PM
+	.rtw_pci_drv.suspend = rtw_suspend,
+	.rtw_pci_drv.resume = rtw_resume,
+#else
+	.rtw_pci_drv.suspend = NULL,
+	.rtw_pci_drv.resume = NULL,
+#endif
+};
+
+
+MODULE_DEVICE_TABLE(pci, rtw_pci_id_tbl);
+
+
+static u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
+	INTEL_VENDOR_ID,
+	ATI_VENDOR_ID,
+	AMD_VENDOR_ID,
+	SIS_VENDOR_ID
+};
+
+static u8 rtw_pci_platform_switch_device_pci_aspm(_adapter *padapter, u8 value)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	u8	bresult = _SUCCESS;
+	int	error;
+
+	value |= 0x40;
+
+	error = pci_write_config_byte(pdvobjpriv->ppcidev, 0x80, value);
+
+	if(error != 0)
+	{
+		bresult = _FALSE;
+		DBG_871X("rtw_pci_platform_switch_device_pci_aspm error (%d)\n",error);
+	}
+
+	return bresult;
+}
+
+//
+// When we set 0x01 to enable clk request. Set 0x0 to disable clk req.
+//
+static u8 rtw_pci_switch_clk_req(_adapter *padapter, u8 value)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	u8	buffer, bresult = _SUCCESS;
+	int	error;
+
+	buffer = value;
+
+	if(!padapter->hw_init_completed)
+		return bresult;
+
+	error = pci_write_config_byte(pdvobjpriv->ppcidev, 0x81, value);
+
+	if(error != 0)
+	{
+		bresult = _FALSE;
+		DBG_871X("rtw_pci_switch_clk_req error (%d)\n",error);
+	}
+
+	return bresult;
+}
+
+#if 0
+//Description:
+//Disable RTL8192SE ASPM & Disable Pci Bridge ASPM
+void rtw_pci_disable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u32	pcicfg_addrport = 0;
+	u8	num4bytes;
+	u8	linkctrl_reg;
+	u16	pcibridge_linkctrlreg, aspmlevel = 0;
+
+	// When there exists anyone's busnum, devnum, and funcnum that are set to 0xff,
+	// we do not execute any action and return.
+	// if it is not intel bus then don't enable ASPM.
+	if ((pcipriv->busnumber == 0xff
+		&& pcipriv->devnumber == 0xff
+		&& pcipriv->funcnumber == 0xff)
+		|| (pcipriv->pcibridge_busnum == 0xff
+		&& pcipriv->pcibridge_devnum == 0xff
+		&& pcipriv->pcibridge_funcnum == 0xff))
+	{
+		DBG_871X("PlatformEnableASPM(): Fail to enable ASPM. Cannot find the Bus of PCI(Bridge).\n");
+		return;
+	}
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+		DBG_871X("%s(): Disable ASPM. Recognize the Bus of PCI(Bridge) as UNKNOWN.\n", __func__);
+	}
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		RT_CLEAR_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+		rtw_pci_switch_clk_req(padapter, 0x0);
+	}
+
+	{
+		// Suggested by SD1 for promising device will in L0 state after an I/O.
+		u8 tmp_u1b;
+
+		pci_read_config_byte(pdvobjpriv->ppcidev, 0x80, &tmp_u1b);
+	}
+
+	// Retrieve original configuration settings.
+	linkctrl_reg = pcipriv->linkctrl_reg;
+	pcibridge_linkctrlreg = pcipriv->pcibridge_linkctrlreg;
+
+	// Set corresponding value.
+	aspmlevel |= BIT(0) | BIT(1);
+	linkctrl_reg &= ~aspmlevel;
+	pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1));
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, linkctrl_reg);
+	rtw_udelay_os(50);
+
+	//When there exists anyone's busnum, devnum, and funcnum that are set to 0xff,
+	// we do not execute any action and return.
+	if ((pcipriv->busnumber == 0xff &&
+		pcipriv->devnumber == 0xff &&
+		pcipriv->funcnumber == 0xff) ||
+		(pcipriv->pcibridge_busnum == 0xff &&
+		pcipriv->pcibridge_devnum == 0xff
+		&& pcipriv->pcibridge_funcnum == 0xff))
+	{
+		//Do Nothing!!
+	}
+	else
+	{
+		//4 //Disable Pci Bridge ASPM
+		pcicfg_addrport = (pcipriv->pcibridge_busnum << 16) |
+						(pcipriv->pcibridge_devnum << 11) |
+						(pcipriv->pcibridge_funcnum << 8) | (1 << 31);
+		num4bytes = (pcipriv->pcibridge_pciehdr_offset + 0x10) / 4;
+
+		// set up address port at 0xCF8 offset field= 0 (dev|vend)
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+
+		// now grab data port with device|vendor 4 byte dword
+		NdisRawWritePortUchar(PCI_CONF_DATA, pcibridge_linkctrlreg);
+
+		DBG_871X("rtw_pci_disable_aspm():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+			pcipriv->pcibridge_busnum, pcipriv->pcibridge_devnum,
+			pcipriv->pcibridge_funcnum,
+			(pcipriv->pcibridge_pciehdr_offset+0x10), pcibridge_linkctrlreg);
+
+		rtw_udelay_os(50);
+	}
+}
+
+//[ASPM]
+//Description:
+//              Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for power saving
+//              We should follow the sequence to enable RTL8192SE first then enable Pci Bridge ASPM
+//              or the system will show bluescreen.
+void rtw_pci_enable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u16	aspmlevel = 0;
+	u32	pcicfg_addrport = 0;
+	u8	num4bytes;
+	u8	u_pcibridge_aspmsetting = 0;
+	u8	u_device_aspmsetting = 0;
+
+	// When there exists anyone's busnum, devnum, and funcnum that are set to 0xff,
+	// we do not execute any action and return.
+	// if it is not intel bus then don't enable ASPM.
+
+	if ((pcipriv->busnumber == 0xff
+		&& pcipriv->devnumber == 0xff
+		&& pcipriv->funcnumber == 0xff)
+		|| (pcipriv->pcibridge_busnum == 0xff
+		&& pcipriv->pcibridge_devnum == 0xff
+		&& pcipriv->pcibridge_funcnum == 0xff))
+	{
+		DBG_871X("PlatformEnableASPM(): Fail to enable ASPM. Cannot find the Bus of PCI(Bridge).\n");
+		return;
+	}
+
+	//4 Enable Pci Bridge ASPM
+	pcicfg_addrport = (pcipriv->pcibridge_busnum << 16)
+					| (pcipriv->pcibridge_devnum << 11)
+					| (pcipriv->pcibridge_funcnum << 8) | (1 << 31);
+	num4bytes = (pcipriv->pcibridge_pciehdr_offset + 0x10) / 4;
+	// set up address port at 0xCF8 offset field= 0 (dev|vend)
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+	// now grab data port with device|vendor 4 byte dword
+
+	u_pcibridge_aspmsetting = pcipriv->pcibridge_linkctrlreg | pdvobjpriv->const_hostpci_aspm_setting;
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL ||
+		pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_SIS)
+		u_pcibridge_aspmsetting &= ~BIT(0);
+
+	NdisRawWritePortUchar(PCI_CONF_DATA, u_pcibridge_aspmsetting);
+
+	DBG_871X("PlatformEnableASPM():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+		pcipriv->pcibridge_busnum,
+		pcipriv->pcibridge_devnum,
+		pcipriv->pcibridge_funcnum,
+		(pcipriv->pcibridge_pciehdr_offset+0x10),
+		u_pcibridge_aspmsetting);
+
+	rtw_udelay_os(50);
+
+	// Get ASPM level (with/without Clock Req)
+	aspmlevel |= pdvobjpriv->const_devicepci_aspm_setting;
+	u_device_aspmsetting = pcipriv->linkctrl_reg;
+	u_device_aspmsetting |= aspmlevel;
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, u_device_aspmsetting);	//(priv->linkctrl_reg | ASPMLevel));
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		rtw_pci_switch_clk_req(padapter, (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
+		RT_SET_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+	}
+
+	rtw_udelay_os(50);
+}
+
+//
+//Description:
+//To get link control field by searching from PCIe capability lists.
+//
+static u8
+rtw_get_link_control_field(_adapter *padapter, u8 busnum, u8 devnum,
+				u8 funcnum)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	struct rt_pci_capabilities_header capability_hdr;
+	u8	capability_offset, num4bytes;
+	u32	pcicfg_addrport = 0;
+	u8	linkctrl_reg;
+	u8	status = _FALSE;
+
+	//If busnum, devnum, funcnum are set to 0xff.
+	if (busnum == 0xff && devnum == 0xff && funcnum == 0xff) {
+		DBG_871X("GetLinkControlField(): Fail to find PCIe Capability\n");
+		return _FALSE;
+	}
+
+	pcicfg_addrport = (busnum << 16) | (devnum << 11) | (funcnum << 8) | (1 << 31);
+
+	//2PCIeCap
+
+	// The device supports capability lists. Find the capabilities.
+	num4bytes = 0x34 / 4;
+	//get capability_offset
+	// set up address port at 0xCF8 offset field= 0 (dev|vend)
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+	// now grab data port with device|vendor 4 byte dword
+	NdisRawReadPortUchar(PCI_CONF_DATA, &capability_offset);
+
+	// Loop through the capabilities in search of the power management capability.
+	// The list is NULL-terminated, so the last offset will always be zero.
+
+	while (capability_offset != 0) {
+		// First find the number of 4 Byte.
+		num4bytes = capability_offset / 4;
+
+		// Read the header of the capability at  this offset. If the retrieved capability is not
+		// the power management capability that we are looking for, follow the link to the
+		// next capability and continue looping.
+
+		//4 get capability_hdr
+		// set up address port at 0xCF8 offset field= 0 (dev|vend)
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+		// now grab data port with device|vendor 4 byte dword
+		NdisRawReadPortUshort(PCI_CONF_DATA, (u16 *) & capability_hdr);
+
+		// Found the PCI express capability
+		if (capability_hdr.capability_id == PCI_CAPABILITY_ID_PCI_EXPRESS)
+		{
+			break;
+		}
+		else
+		{
+			// This is some other capability. Keep looking for the PCI express capability.
+			capability_offset = capability_hdr.next;
+		}
+	}
+
+	if (capability_hdr.capability_id == PCI_CAPABILITY_ID_PCI_EXPRESS)	//
+	{
+		num4bytes = (capability_offset + 0x10) / 4;
+
+		//4 Read  Link Control Register
+		// set up address port at 0xCF8 offset field= 0 (dev|vend)
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+		// now grab data port with device|vendor 4 byte dword
+		NdisRawReadPortUchar(PCI_CONF_DATA, &linkctrl_reg);
+
+		pcipriv->pcibridge_pciehdr_offset = capability_offset;
+		pcipriv->pcibridge_linkctrlreg = linkctrl_reg;
+
+		status = _TRUE;
+	}
+	else
+	{
+		// We didn't find a PCIe capability.
+		DBG_871X("GetLinkControlField(): Cannot Find PCIe Capability\n");
+	}
+
+	return status;
+}
+
+//
+//Description:
+//To get PCI bus infomation and return busnum, devnum, and funcnum about
+//the bus(bridge) which the device binds.
+//
+static u8
+rtw_get_pci_bus_info(_adapter *padapter,
+			  u16 vendorid,
+			  u16 deviceid,
+			  u8 irql, u8 basecode, u8 subclass, u8 filed19val,
+			  u8 * busnum, u8 * devnum, u8 * funcnum)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_dev	*pdev = pdvobjpriv->ppcidev;
+	u8	busnum_idx, devicenum_idx, functionnum_idx;
+	u32	pcicfg_addrport = 0;
+	u32	dev_venid = 0, classcode, field19, headertype;
+	u16	venId, devId;
+	u8	basec, subc, irqline;
+	u16	regoffset;
+	u8	b_singlefunc = _FALSE;
+	u8	b_bridgechk = _FALSE;
+
+	*busnum = 0xFF;
+	*devnum = 0xFF;
+	*funcnum = 0xFF;
+
+	//DBG_871X("==============>vendorid:%x,deviceid:%x,irql:%x\n", vendorid,deviceid,irql);
+	if ((basecode == PCI_CLASS_BRIDGE_DEV) &&
+		(subclass == PCI_SUBCLASS_BR_PCI_TO_PCI)
+		&& (filed19val == U1DONTCARE))
+		b_bridgechk = _TRUE;
+
+	// perform a complete pci bus scan operation
+	for (busnum_idx = 0; busnum_idx < PCI_MAX_BRIDGE_NUMBER; busnum_idx++)	//255
+	{
+		for (devicenum_idx = 0; devicenum_idx < PCI_MAX_DEVICES; devicenum_idx++)	//32
+		{
+			b_singlefunc = _FALSE;
+			for (functionnum_idx = 0; functionnum_idx < PCI_MAX_FUNCTION; functionnum_idx++)	//8
+			{
+				//
+				// <Roger_Notes> We have to skip redundant Bus scan to prevent unexpected system hang
+				// if single function is present in this device.
+				// 2009.02.26.
+				//
+				if (functionnum_idx == 0) {
+					//4 get header type (DWORD #3)
+					pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+					NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (3 << 2));
+					NdisRawReadPortUlong(PCI_CONF_DATA, &headertype);
+					headertype = ((headertype >> 16) & 0x0080) >> 7;	// address 0x0e[7].
+					if (headertype == 0)	//Single function
+						b_singlefunc = _TRUE;
+				}
+				else
+				{//By pass the following scan process.
+					if (b_singlefunc == _TRUE)
+						break;
+				}
+
+				// Set access enable control.
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+
+				//4 // Get vendorid/ deviceid
+				// set up address port at 0xCF8 offset field= 0 (dev|vend)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				// now grab data port with device|vendor 4 byte dword
+				NdisRawReadPortUlong(PCI_CONF_DATA, &dev_venid);
+
+				// if data port is full of 1s, no device is present
+				// some broken boards return 0 if a slot is empty:
+				if (dev_venid == 0xFFFFFFFF || dev_venid == 0)
+					continue;	//PCI_INVALID_VENDORID
+
+				// 4 // Get irql
+				regoffset = 0x3C;
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31) | (regoffset & 0xFFFFFFFC);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				NdisRawReadPortUchar((PCI_CONF_DATA +(regoffset & 0x3)), &irqline);
+
+				venId = (u16) (dev_venid >> 0) & 0xFFFF;
+				devId = (u16) (dev_venid >> 16) & 0xFFFF;
+
+				// Check Vendor ID
+				if (!b_bridgechk && (venId != vendorid) && (vendorid != U2DONTCARE))
+					continue;
+
+				// Check Device ID
+				if (!b_bridgechk && (devId != deviceid) && (deviceid != U2DONTCARE))
+					continue;
+
+				// Check irql
+				if (!b_bridgechk && (irqline != irql) && (irql != U1DONTCARE))
+					continue;
+
+				//4 get Class Code
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (2 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &classcode);
+				classcode = classcode >> 8;
+
+				basec = (u8) (classcode >> 16) & 0xFF;
+				subc = (u8) (classcode >> 8) & 0xFF;
+				if (b_bridgechk && (venId != vendorid) && (basec == basecode) && (subc == subclass))
+					return _TRUE;
+
+				// Check Vendor ID
+				if (b_bridgechk && (venId != vendorid) && (vendorid != U2DONTCARE))
+					continue;
+
+				// Check Device ID
+				if (b_bridgechk && (devId != deviceid) && (deviceid != U2DONTCARE))
+					continue;
+
+				// Check irql
+				if (b_bridgechk && (irqline != irql) && (irql != U1DONTCARE))
+					continue;
+
+				//4 get field 0x19 value  (DWORD #6)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (6 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &field19);
+				field19 = (field19 >> 8) & 0xFF;
+
+				//4 Matching Class Code and filed19.
+				if ((basec == basecode) && (subc == subclass) && ((field19 == filed19val) || (filed19val == U1DONTCARE))) {
+					*busnum = busnum_idx;
+					*devnum = devicenum_idx;
+					*funcnum = functionnum_idx;
+
+					DBG_871X("GetPciBusInfo(): Find Device(%X:%X)  bus=%d dev=%d, func=%d\n",
+						vendorid, deviceid, busnum_idx, devicenum_idx, functionnum_idx);
+					return _TRUE;
+				}
+			}
+		}
+	}
+
+	DBG_871X("GetPciBusInfo(): Cannot Find Device(%X:%X:%X)\n", vendorid, deviceid, dev_venid);
+
+	return _FALSE;
+}
+
+static u8
+rtw_get_pci_brideg_info(_adapter *padapter,
+			     u8 basecode,
+			     u8 subclass,
+			     u8 filed19val, u8 * busnum, u8 * devnum,
+			     u8 * funcnum, u16 * vendorid, u16 * deviceid)
+{
+	u8	busnum_idx, devicenum_idx, functionnum_idx;
+	u32	pcicfg_addrport = 0;
+	u32	dev_venid, classcode, field19, headertype;
+	u16	venId, devId;
+	u8	basec, subc, irqline;
+	u16	regoffset;
+	u8	b_singlefunc = _FALSE;
+
+	*busnum = 0xFF;
+	*devnum = 0xFF;
+	*funcnum = 0xFF;
+
+	// perform a complete pci bus scan operation
+	for (busnum_idx = 0; busnum_idx < PCI_MAX_BRIDGE_NUMBER; busnum_idx++)	//255
+	{
+		for (devicenum_idx = 0; devicenum_idx < PCI_MAX_DEVICES; devicenum_idx++)	//32
+		{
+			b_singlefunc = _FALSE;
+			for (functionnum_idx = 0; functionnum_idx < PCI_MAX_FUNCTION; functionnum_idx++)	//8
+			{
+				//
+				// <Roger_Notes> We have to skip redundant Bus scan to prevent unexpected system hang
+				// if single function is present in this device.
+				// 2009.02.26.
+				//
+				if (functionnum_idx == 0)
+				{
+					//4 get header type (DWORD #3)
+					pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+					//NdisRawWritePortUlong((ULONG_PTR)PCI_CONF_ADDRESS ,  pcicfg_addrport + (3 << 2));
+					//NdisRawReadPortUlong((ULONG_PTR)PCI_CONF_DATA, &headertype);
+					NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (3 << 2));
+					NdisRawReadPortUlong(PCI_CONF_DATA, &headertype);
+					headertype = ((headertype >> 16) & 0x0080) >> 7;	// address 0x0e[7].
+					if (headertype == 0)	//Single function
+						b_singlefunc = _TRUE;
+				}
+				else
+				{//By pass the following scan process.
+					if (b_singlefunc == _TRUE)
+						break;
+				}
+
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+
+				//4 // Get vendorid/ deviceid
+				// set up address port at 0xCF8 offset field= 0 (dev|vend)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				// now grab data port with device|vendor 4 byte dword
+				NdisRawReadPortUlong(PCI_CONF_DATA, &dev_venid);
+
+				//4 Get irql
+				regoffset = 0x3C;
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31) | (regoffset & 0xFFFFFFFC);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				NdisRawReadPortUchar((PCI_CONF_DATA + (regoffset & 0x3)), &irqline);
+
+				venId = (u16) (dev_venid >> 0) & 0xFFFF;
+				devId = (u16) (dev_venid >> 16) & 0xFFFF;
+
+				//4 get Class Code
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (2 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &classcode);
+				classcode = classcode >> 8;
+
+				basec = (u8) (classcode >> 16) & 0xFF;
+				subc = (u8) (classcode >> 8) & 0xFF;
+
+				//4 get field 0x19 value  (DWORD #6)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (6 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &field19);
+				field19 = (field19 >> 8) & 0xFF;
+
+				//4 Matching Class Code and filed19.
+				if ((basec == basecode) && (subc == subclass) && ((field19 == filed19val) || (filed19val == U1DONTCARE))) {
+					*busnum = busnum_idx;
+					*devnum = devicenum_idx;
+					*funcnum = functionnum_idx;
+					*vendorid = venId;
+					*deviceid = devId;
+
+					DBG_871X("GetPciBridegInfo : Find Device(%X:%X)  bus=%d dev=%d, func=%d\n",
+						venId, devId, busnum_idx, devicenum_idx, functionnum_idx);
+
+					return _TRUE;
+				}
+			}
+		}
+	}
+
+	DBG_871X("GetPciBridegInfo(): Cannot Find PciBridge for Device\n");
+
+	return _FALSE;
+}				// end of GetPciBridegInfo
+
+//
+//Description:
+//To find specific bridge information.
+//
+static void rtw_find_bridge_info(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u8	pcibridge_busnum = 0xff;
+	u8	pcibridge_devnum = 0xff;
+	u8	pcibridge_funcnum = 0xff;
+	u16	pcibridge_vendorid = 0xff;
+	u16	pcibridge_deviceid = 0xff;
+	u8	tmp = 0;
+
+	rtw_get_pci_brideg_info(padapter,
+				     PCI_CLASS_BRIDGE_DEV,
+				     PCI_SUBCLASS_BR_PCI_TO_PCI,
+				     pcipriv->busnumber,
+				     &pcibridge_busnum,
+				     &pcibridge_devnum, &pcibridge_funcnum,
+				     &pcibridge_vendorid, &pcibridge_deviceid);
+
+	// match the array of vendor id and regonize which chipset is used.
+	pcipriv->pcibridge_vendor = PCI_BRIDGE_VENDOR_UNKNOWN;
+
+	for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+		if (pcibridge_vendorid == pcibridge_vendors[tmp]) {
+			pcipriv->pcibridge_vendor = tmp;
+			DBG_871X("Pci Bridge Vendor is found index: %d\n", tmp);
+			break;
+		}
+	}
+	DBG_871X("Pci Bridge Vendor is %x\n", pcibridge_vendors[tmp]);
+
+	// Update corresponding PCI bus info.
+	pcipriv->pcibridge_busnum = pcibridge_busnum;
+	pcipriv->pcibridge_devnum = pcibridge_devnum;
+	pcipriv->pcibridge_funcnum = pcibridge_funcnum;
+	pcipriv->pcibridge_vendorid = pcibridge_vendorid;
+	pcipriv->pcibridge_deviceid = pcibridge_deviceid;
+
+}
+
+static u8
+rtw_get_amd_l1_patch(_adapter *padapter, u8 busnum, u8 devnum,
+			  u8 funcnum)
+{
+	u8	status = _FALSE;
+	u8	offset_e0;
+	unsigned	offset_e4;
+	u32	pcicfg_addrport = 0;
+
+	pcicfg_addrport = (busnum << 16) | (devnum << 11) | (funcnum << 8) | (1 << 31);
+
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE0);
+	NdisRawWritePortUchar(PCI_CONF_DATA, 0xA0);
+
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE0);
+	NdisRawReadPortUchar(PCI_CONF_DATA, &offset_e0);
+
+	if (offset_e0 == 0xA0)
+	{
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE4);
+		NdisRawReadPortUlong(PCI_CONF_DATA, &offset_e4);
+		//DbgPrint("Offset E4 %x\n", offset_e4);
+		if (offset_e4 & BIT(23))
+			status = _TRUE;
+	}
+
+	return status;
+}
+#else
+/*Disable RTL8192SE ASPM & Disable Pci Bridge ASPM*/
+void rtw_pci_disable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_dev	*pdev = pdvobjpriv->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u8	linkctrl_reg;
+	u16	pcibridge_linkctrlreg;
+	u16	aspmlevel = 0;
+
+	// We do not diable/enable ASPM by driver, in the future, the BIOS will enable host and NIC ASPM.
+	// Advertised by SD1 victorh. Added by tynli. 2009.11.23.
+	if(pdvobjpriv->const_pci_aspm == 0)
+		return;
+
+	if(!padapter->hw_init_completed)
+		return;
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("%s(): PCI(Bridge) UNKNOWN.\n", __FUNCTION__));
+		return;
+	}
+
+	linkctrl_reg = pcipriv->linkctrl_reg;
+	pcibridge_linkctrlreg = pcipriv->pcibridge_linkctrlreg;
+
+	// Set corresponding value.
+	aspmlevel |= BIT(0) | BIT(1);
+	linkctrl_reg &=~aspmlevel;
+	pcibridge_linkctrlreg &=~aspmlevel;
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		RT_CLEAR_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+		rtw_pci_switch_clk_req(padapter, 0x0);
+	}
+
+	{
+		/*for promising device will in L0 state after an I/O.*/
+		u8 tmp_u1b;
+		pci_read_config_byte(pdev, 0x80, &tmp_u1b);
+	}
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, linkctrl_reg);
+	rtw_udelay_os(50);
+
+	//When there exists anyone's BusNum, DevNum, and FuncNum that are set to 0xff,
+	// we do not execute any action and return. Added by tynli.
+	if( (pcipriv->busnumber == 0xff && pcipriv->devnumber == 0xff && pcipriv->funcnumber == 0xff) ||
+		(pcipriv->pcibridge_busnum == 0xff && pcipriv->pcibridge_devnum == 0xff && pcipriv->pcibridge_funcnum == 0xff) )
+	{
+		// Do Nothing!!
+	}
+	else
+	{
+		/*Disable Pci Bridge ASPM*/
+		//NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+		//NdisRawWritePortUchar(PCI_CONF_DATA, pcibridge_linkctrlreg);
+		pci_write_config_byte(bridge_pdev, pcipriv->pcibridge_pciehdr_offset + 0x10, pcibridge_linkctrlreg);
+
+		DBG_871X("rtw_pci_disable_aspm():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+			pcipriv->pcibridge_busnum, pcipriv->pcibridge_devnum,
+			pcipriv->pcibridge_funcnum,
+			(pcipriv->pcibridge_pciehdr_offset+0x10), pcibridge_linkctrlreg);
+
+		rtw_udelay_os(50);
+	}
+
+}
+
+/*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for
+power saving We should follow the sequence to enable
+RTL8192SE first then enable Pci Bridge ASPM
+or the system will show bluescreen.*/
+void rtw_pci_enable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_dev	*pdev = pdvobjpriv->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u16	aspmlevel = 0;
+	u8	u_pcibridge_aspmsetting = 0;
+	u8	u_device_aspmsetting = 0;
+	u32	u_device_aspmsupportsetting = 0;
+
+	// We do not diable/enable ASPM by driver, in the future, the BIOS will enable host and NIC ASPM.
+	// Advertised by SD1 victorh. Added by tynli. 2009.11.23.
+	if(pdvobjpriv->const_pci_aspm == 0)
+		return;
+
+	//When there exists anyone's BusNum, DevNum, and FuncNum that are set to 0xff,
+	// we do not execute any action and return. Added by tynli.
+	if( (pcipriv->busnumber == 0xff && pcipriv->devnumber == 0xff && pcipriv->funcnumber == 0xff) ||
+		(pcipriv->pcibridge_busnum == 0xff && pcipriv->pcibridge_devnum == 0xff && pcipriv->pcibridge_funcnum == 0xff) )
+	{
+		DBG_871X("rtw_pci_enable_aspm(): Fail to enable ASPM. Cannot find the Bus of PCI(Bridge).\n");
+		return;
+	}
+
+//Get Bridge ASPM Support
+//not to enable bridge aspm if bridge does not support
+//Added by sherry 20100803
+	if (IS_HARDWARE_TYPE_8192DE(padapter))
+	{
+		//PciCfgAddrPort = (pcipriv->pcibridge_busnum << 16)|(pcipriv->pcibridge_devnum<< 11)|(pcipriv->pcibridge_funcnum <<  8)|(1 << 31);
+		//Num4Bytes = (pcipriv->pcibridge_pciehdr_offset+0x0C)/4;
+		//NdisRawWritePortUlong((ULONG_PTR)PCI_CONF_ADDRESS , PciCfgAddrPort+(Num4Bytes << 2));
+		//NdisRawReadPortUlong((ULONG_PTR)PCI_CONF_DATA,&uDeviceASPMSupportSetting);
+		pci_read_config_dword(bridge_pdev, (pcipriv->pcibridge_pciehdr_offset+0x0C), &u_device_aspmsupportsetting);
+		DBG_871X("rtw_pci_enable_aspm(): Bridge ASPM support %x \n",u_device_aspmsupportsetting);
+		if(((u_device_aspmsupportsetting & BIT(11)) != BIT(11)) || ((u_device_aspmsupportsetting & BIT(10)) != BIT(10)))
+		{
+			if(pdvobjpriv->const_devicepci_aspm_setting == 3)
+			{
+				DBG_871X("rtw_pci_enable_aspm(): Bridge not support L0S or L1\n");
+				return;
+			}
+			else if(pdvobjpriv->const_devicepci_aspm_setting == 2)
+			{
+				if((u_device_aspmsupportsetting & BIT(11)) != BIT(11))
+				{
+					DBG_871X("rtw_pci_enable_aspm(): Bridge not support L1 \n");
+					return;
+				}
+			}
+			else if(pdvobjpriv->const_devicepci_aspm_setting == 1)
+			{
+				if((u_device_aspmsupportsetting & BIT(10)) != BIT(10))
+				{
+					DBG_871X("rtw_pci_enable_aspm(): Bridge not support L0s \n");
+					return;
+				}
+
+			}
+		}
+		else
+		{
+			DBG_871X("rtw_pci_enable_aspm(): Bridge support L0s and L1 \n");
+		}
+	}
+
+
+	/*Enable Pci Bridge ASPM*/
+	//PciCfgAddrPort = (pcipriv->pcibridge_busnum << 16)|(pcipriv->pcibridge_devnum<< 11) |(pcipriv->pcibridge_funcnum <<  8)|(1 << 31);
+	//Num4Bytes = (pcipriv->pcibridge_pciehdr_offset+0x10)/4;
+	// set up address port at 0xCF8 offset field= 0 (dev|vend)
+	//NdisRawWritePortUlong(PCI_CONF_ADDRESS, PciCfgAddrPort + (Num4Bytes << 2));
+	// now grab data port with device|vendor 4 byte dword
+
+	u_pcibridge_aspmsetting = pcipriv->pcibridge_linkctrlreg;
+	u_pcibridge_aspmsetting |= pdvobjpriv->const_hostpci_aspm_setting;
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL ||
+		pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_SIS )
+		u_pcibridge_aspmsetting &= ~BIT(0); // for intel host 42 device 43
+
+	//NdisRawWritePortUchar(PCI_CONF_DATA, u_pcibridge_aspmsetting);
+	pci_write_config_byte(bridge_pdev, (pcipriv->pcibridge_pciehdr_offset+0x10), u_pcibridge_aspmsetting);
+
+	DBG_871X("PlatformEnableASPM():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+		pcipriv->pcibridge_busnum, pcipriv->pcibridge_devnum, pcipriv->pcibridge_funcnum,
+		(pcipriv->pcibridge_pciehdr_offset+0x10),
+		u_pcibridge_aspmsetting);
+
+	rtw_udelay_os(50);
+
+	/*Get ASPM level (with/without Clock Req)*/
+	aspmlevel |= pdvobjpriv->const_devicepci_aspm_setting;
+	u_device_aspmsetting = pcipriv->linkctrl_reg;
+	u_device_aspmsetting |= aspmlevel; // device 43
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, u_device_aspmsetting);
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		rtw_pci_switch_clk_req(padapter, (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
+		RT_SET_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+	}
+
+	rtw_udelay_os(50);
+}
+
+static u8 rtw_pci_get_amd_l1_patch(struct dvobj_priv *dvobj)
+{
+	struct pci_dev	*pdev = dvobj->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	u8	status = _FALSE;
+	u8	offset_e0;
+	u32	offset_e4;
+
+	//NdisRawWritePortUlong(PCI_CONF_ADDRESS,pcicfg_addrport + 0xE0);
+	//NdisRawWritePortUchar(PCI_CONF_DATA, 0xA0);
+	pci_write_config_byte(bridge_pdev, 0xE0, 0xA0);
+
+	//NdisRawWritePortUlong(PCI_CONF_ADDRESS,pcicfg_addrport + 0xE0);
+	//NdisRawReadPortUchar(PCI_CONF_DATA, &offset_e0);
+	pci_read_config_byte(bridge_pdev, 0xE0, &offset_e0);
+
+	if (offset_e0 == 0xA0) {
+		//NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE4);
+		//NdisRawReadPortUlong(PCI_CONF_DATA, &offset_e4);
+		pci_read_config_dword(bridge_pdev, 0xE4, &offset_e4);
+		if (offset_e4 & BIT(23))
+			status = _TRUE;
+	}
+
+	return status;
+}
+
+static void rtw_pci_get_linkcontrol_field(struct dvobj_priv *dvobj)
+{
+	struct pci_priv	*pcipriv = &(dvobj->pcipriv);
+	struct pci_dev	*pdev = dvobj->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	u8	capabilityoffset = pcipriv->pcibridge_pciehdr_offset;
+	u8	linkctrl_reg;
+
+	/*Read  Link Control Register*/
+	pci_read_config_byte(bridge_pdev, capabilityoffset + PCI_EXP_LNKCTL, &linkctrl_reg);
+
+	pcipriv->pcibridge_linkctrlreg = linkctrl_reg;
+}
+#endif
+
+static void rtw_pci_parse_configuration(struct dvobj_priv *dvobj)
+{
+	struct pci_dev	*pdev = dvobj->ppcidev;
+	struct pci_priv	*pcipriv = &(dvobj->pcipriv);
+	u8 tmp;
+	int pos;
+	u8 linkctrl_reg;
+
+	//Link Control Register
+	pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+	pci_read_config_byte(pdev, pos + PCI_EXP_LNKCTL, &linkctrl_reg);
+	pcipriv->linkctrl_reg = linkctrl_reg;
+
+	//DBG_871X("Link Control Register = %x\n", pcipriv->linkctrl_reg);
+
+	pci_read_config_byte(pdev, 0x98, &tmp);
+	tmp |= BIT(4);
+	pci_write_config_byte(pdev, 0x98, tmp);
+
+	//tmp = 0x17;
+	//pci_write_config_byte(pdev, 0x70f, tmp);
+}
+
+//
+// Update PCI dependent default settings.
+//
+static void rtw_pci_update_default_setting(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+
+	//reset pPSC->reg_rfps_level & priv->b_support_aspm
+	pwrpriv->reg_rfps_level = 0;
+	pwrpriv->b_support_aspm = 0;
+
+	// Dynamic Mechanism,
+	//rtw_hal_set_def_var(pAdapter, HAL_DEF_INIT_GAIN, &(pDevice->InitGainState));
+
+	// Update PCI ASPM setting
+	pwrpriv->const_amdpci_aspm = pdvobjpriv->const_amdpci_aspm;
+	switch (pdvobjpriv->const_pci_aspm) {
+		case 0:		// No ASPM
+			break;
+
+		case 1:		// ASPM dynamically enabled/disable.
+			pwrpriv->reg_rfps_level |= RT_RF_LPS_LEVEL_ASPM;
+			break;
+
+		case 2:		// ASPM with Clock Req dynamically enabled/disable.
+			pwrpriv->reg_rfps_level |= (RT_RF_LPS_LEVEL_ASPM | RT_RF_OFF_LEVL_CLK_REQ);
+			break;
+
+		case 3:		// Always enable ASPM and Clock Req from initialization to halt.
+			pwrpriv->reg_rfps_level &= ~(RT_RF_LPS_LEVEL_ASPM);
+			pwrpriv->reg_rfps_level |= (RT_RF_PS_LEVEL_ALWAYS_ASPM | RT_RF_OFF_LEVL_CLK_REQ);
+			break;
+
+		case 4:		// Always enable ASPM without Clock Req from initialization to halt.
+			pwrpriv->reg_rfps_level &= ~(RT_RF_LPS_LEVEL_ASPM | RT_RF_OFF_LEVL_CLK_REQ);
+			pwrpriv->reg_rfps_level |= RT_RF_PS_LEVEL_ALWAYS_ASPM;
+			break;
+	}
+
+	pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_HALT_NIC;
+
+	// Update Radio OFF setting
+	switch (pdvobjpriv->const_hwsw_rfoff_d3) {
+		case 1:
+			if (pwrpriv->reg_rfps_level & RT_RF_LPS_LEVEL_ASPM)
+				pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_ASPM;
+			break;
+
+		case 2:
+			if (pwrpriv->reg_rfps_level & RT_RF_LPS_LEVEL_ASPM)
+				pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_ASPM;
+			pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_HALT_NIC;
+			break;
+
+		case 3:
+			pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_PCI_D3;
+			break;
+	}
+
+	// Update Rx 2R setting
+	//pPSC->reg_rfps_level |= ((pDevice->RegLPS2RDisable) ? RT_RF_LPS_DISALBE_2R : 0);
+
+	//
+	// Set HW definition to determine if it supports ASPM.
+	//
+	switch (pdvobjpriv->const_support_pciaspm) {
+		case 0:	// Not support ASPM.
+			{
+				u8	b_support_aspm = _FALSE;
+				pwrpriv->b_support_aspm = b_support_aspm;
+			}
+			break;
+
+		case 1:	// Support ASPM.
+			{
+				u8	b_support_aspm = _TRUE;
+				u8	b_support_backdoor = _TRUE;
+
+				pwrpriv->b_support_aspm = b_support_aspm;
+
+				/*if(pAdapter->MgntInfo.CustomerID == RT_CID_TOSHIBA &&
+					pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_AMD &&
+					!pcipriv->amd_l1_patch)
+					b_support_backdoor = _FALSE;*/
+
+				pwrpriv->b_support_backdoor = b_support_backdoor;
+			}
+			break;
+
+		case 2:	// Set by Chipset.
+			// ASPM value set by chipset.
+			if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL) {
+				u8	b_support_aspm = _TRUE;
+				pwrpriv->b_support_aspm = b_support_aspm;
+			}
+			break;
+
+		default:
+			// Do nothing. Set when finding the chipset.
+			break;
+	}
+}
+
+static void rtw_pci_initialize_adapter_common(_adapter *padapter)
+{
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+
+	rtw_pci_update_default_setting(padapter);
+
+	if (pwrpriv->reg_rfps_level & RT_RF_PS_LEVEL_ALWAYS_ASPM) {
+		// Always enable ASPM & Clock Req.
+		rtw_pci_enable_aspm(padapter);
+		RT_SET_PS_LEVEL(pwrpriv, RT_RF_PS_LEVEL_ALWAYS_ASPM);
+	}
+
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)) || (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18))
+#define rtw_pci_interrupt(x,y,z) rtw_pci_interrupt(x,y)
+#endif
+
+static irqreturn_t rtw_pci_interrupt(int irq, void *priv, struct pt_regs *regs)
+{
+	struct dvobj_priv *dvobj = (struct dvobj_priv *)priv;
+	_adapter *adapter = dvobj->if1;
+
+	if (dvobj->irq_enabled == 0) {
+		return IRQ_HANDLED;
+	}
+
+	if(rtw_hal_interrupt_handler(adapter) == _FAIL)
+		return IRQ_HANDLED;
+		//return IRQ_NONE;
+
+	return IRQ_HANDLED;
+}
+
+#ifdef RTK_DMP_PLATFORM
+#define pci_iounmap(x,y) iounmap(y)
+#endif
+
+int pci_alloc_irq(struct dvobj_priv *dvobj)
+{
+	int err;
+	struct pci_dev *pdev = dvobj->ppcidev;
+
+#if defined(IRQF_SHARED)
+	err = request_irq(pdev->irq, &rtw_pci_interrupt, IRQF_SHARED, DRV_NAME, dvobj);
+#else
+	err = request_irq(pdev->irq, &rtw_pci_interrupt, SA_SHIRQ, DRV_NAME, dvobj);
+#endif
+	if (err) {
+		DBG_871X("Error allocating IRQ %d",pdev->irq);
+	} else {
+		dvobj->irq_alloc = 1;
+		DBG_871X("Request_irq OK, IRQ %d\n",pdev->irq);
+	}
+
+	return err?_FAIL:_SUCCESS;
+}
+
+static struct dvobj_priv *pci_dvobj_init(struct pci_dev *pdev)
+{
+	int err;
+	u32	status = _FAIL;
+	struct dvobj_priv *dvobj = NULL;
+	struct pci_priv	*pcipriv = NULL;
+	struct pci_dev *bridge_pdev = pdev->bus->self;
+	unsigned long pmem_start, pmem_len, pmem_flags;
+	u8	tmp;
+
+_func_enter_;
+
+	if ((dvobj = devobj_init()) == NULL) {
+		goto exit;
+	}
+	dvobj->ppcidev = pdev;
+	pcipriv = &(dvobj->pcipriv);
+	pci_set_drvdata(pdev, dvobj);
+
+	if ( (err = pci_enable_device(pdev)) != 0) {
+		DBG_871X(KERN_ERR "%s : Cannot enable new PCI device\n", pci_name(pdev));
+		goto free_dvobj;
+	}
+
+#ifdef CONFIG_64BIT_DMA
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+		DBG_871X("RTL819xCE: Using 64bit DMA\n");
+		if ((err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) != 0) {
+			DBG_871X(KERN_ERR "Unable to obtain 64bit DMA for consistent allocations\n");
+			goto disable_picdev;
+		}
+		dvobj->bdma64 = _TRUE;
+	} else
+#endif
+	{
+		if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
+			if ((err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) != 0) {
+				DBG_871X(KERN_ERR "Unable to obtain 32bit DMA for consistent allocations\n");
+				goto disable_picdev;
+			}
+		}
+	}
+
+	pci_set_master(pdev);
+
+	if ((err = pci_request_regions(pdev, DRV_NAME)) != 0) {
+		DBG_871X(KERN_ERR "Can't obtain PCI resources\n");
+		goto disable_picdev;
+	}
+	//MEM map
+	pmem_start = pci_resource_start(pdev, 2);
+	pmem_len = pci_resource_len(pdev, 2);
+	pmem_flags = pci_resource_flags(pdev, 2);
+
+#ifdef RTK_DMP_PLATFORM
+	dvobj->pci_mem_start = (unsigned long)ioremap_nocache(pmem_start, pmem_len);
+#else
+	dvobj->pci_mem_start = (unsigned long)pci_iomap(pdev, 2, pmem_len); /* shared mem start */
+#endif
+	if (dvobj->pci_mem_start == 0) {
+		DBG_871X(KERN_ERR "Can't map PCI mem\n");
+		goto release_regions;
+	}
+
+	DBG_871X("Memory mapped space start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
+		pmem_start, pmem_len, pmem_flags, dvobj->pci_mem_start);
+
+	// Disable Clk Request */
+	pci_write_config_byte(pdev, 0x81, 0);
+	// leave D3 mode */
+	pci_write_config_byte(pdev, 0x44, 0);
+	pci_write_config_byte(pdev, 0x04, 0x06);
+	pci_write_config_byte(pdev, 0x04, 0x07);
+
+
+#if 1
+	/*find bus info*/
+	pcipriv->busnumber = pdev->bus->number;
+	pcipriv->devnumber = PCI_SLOT(pdev->devfn);
+	pcipriv->funcnumber = PCI_FUNC(pdev->devfn);
+
+	/*find bridge info*/
+	pcipriv->pcibridge_vendor = PCI_BRIDGE_VENDOR_UNKNOWN;
+	if(bridge_pdev){
+		pcipriv->pcibridge_vendorid = bridge_pdev->vendor;
+		for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+			if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+				pcipriv->pcibridge_vendor = tmp;
+				DBG_871X("Pci Bridge Vendor is found index: %d, %x\n", tmp, pcibridge_vendors[tmp]);
+				break;
+			}
+		}
+	}
+
+	//if (pcipriv->pcibridge_vendor != PCI_BRIDGE_VENDOR_UNKNOWN) {
+	if(bridge_pdev){
+		pcipriv->pcibridge_busnum = bridge_pdev->bus->number;
+		pcipriv->pcibridge_devnum = PCI_SLOT(bridge_pdev->devfn);
+		pcipriv->pcibridge_funcnum = PCI_FUNC(bridge_pdev->devfn);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,34))
+		pcipriv->pcibridge_pciehdr_offset = pci_find_capability(bridge_pdev, PCI_CAP_ID_EXP);
+#else
+		pcipriv->pcibridge_pciehdr_offset = bridge_pdev->pcie_cap;
+#endif
+
+		rtw_pci_get_linkcontrol_field(dvobj);
+
+		if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_AMD) {
+			pcipriv->amd_l1_patch = rtw_pci_get_amd_l1_patch(dvobj);
+		}
+	}
+#else
+	//
+	// Find bridge related info.
+	//
+	rtw_get_pci_bus_info(padapter,
+				  pdev->vendor,
+				  pdev->device,
+				  (u8) pdvobjpriv->irqline,
+				  0x02, 0x80, U1DONTCARE,
+				  &pcipriv->busnumber,
+				  &pcipriv->devnumber,
+				  &pcipriv->funcnumber);
+
+	rtw_find_bridge_info(padapter);
+
+	if (pcipriv->pcibridge_vendor != PCI_BRIDGE_VENDOR_UNKNOWN) {
+		rtw_get_link_control_field(padapter,
+						pcipriv->pcibridge_busnum,
+						pcipriv->pcibridge_devnum,
+						pcipriv->pcibridge_funcnum);
+
+		if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_AMD) {
+			pcipriv->amd_l1_patch =
+				rtw_get_amd_l1_patch(padapter,
+							pcipriv->pcibridge_busnum,
+							pcipriv->pcibridge_devnum,
+							pcipriv->pcibridge_funcnum);
+		}
+	}
+#endif
+
+	//
+	// Allow the hardware to look at PCI config information.
+	//
+	rtw_pci_parse_configuration(dvobj);
+
+	DBG_871X("pcidev busnumber:devnumber:funcnumber:"
+		"vendor:link_ctl %d:%d:%d:%x:%x\n",
+		pcipriv->busnumber,
+		pcipriv->devnumber,
+		pcipriv->funcnumber,
+		pdev->vendor,
+		pcipriv->linkctrl_reg);
+
+	DBG_871X("pci_bridge busnumber:devnumber:funcnumber:vendor:"
+		"pcie_cap:link_ctl_reg: %d:%d:%d:%x:%x:%x:%x\n",
+		pcipriv->pcibridge_busnum,
+		pcipriv->pcibridge_devnum,
+		pcipriv->pcibridge_funcnum,
+		pcibridge_vendors[pcipriv->pcibridge_vendor],
+		pcipriv->pcibridge_pciehdr_offset,
+		pcipriv->pcibridge_linkctrlreg,
+		pcipriv->amd_l1_patch);
+
+	status = _SUCCESS;
+
+iounmap:
+	if (status != _SUCCESS && dvobj->pci_mem_start != 0) {
+		pci_iounmap(pdev, (void *)dvobj->pci_mem_start);
+		dvobj->pci_mem_start = 0;
+	}
+release_regions:
+	if (status != _SUCCESS)
+		pci_release_regions(pdev);
+disable_picdev:
+	if (status != _SUCCESS)
+		pci_disable_device(pdev);
+free_dvobj:
+	if (status != _SUCCESS && dvobj) {
+		pci_set_drvdata(pdev, NULL);
+		devobj_deinit(dvobj);
+		dvobj = NULL;
+	}
+exit:
+_func_exit_;
+	return dvobj;
+}
+
+static void pci_dvobj_deinit(struct pci_dev *pdev)
+{
+	struct dvobj_priv *dvobj = pci_get_drvdata(pdev);
+_func_enter_;
+
+	pci_set_drvdata(pdev, NULL);
+	if (dvobj) {
+		if (dvobj->irq_alloc) {
+			free_irq(pdev->irq, dvobj);
+			dvobj->irq_alloc = 0;
+		}
+
+		if (dvobj->pci_mem_start != 0) {
+			pci_iounmap(pdev, (void *)dvobj->pci_mem_start);
+			dvobj->pci_mem_start = 0;
+		}
+
+		devobj_deinit(dvobj);
+	}
+
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+
+_func_exit_;
+}
+
+static void decide_chip_type_by_pci_device_id(_adapter *padapter, struct pci_dev *pdev)
+{
+	u16	venderid, deviceid, irqline;
+	u8	revisionid;
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+
+
+	venderid = pdev->vendor;
+	deviceid = pdev->device;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23))
+	pci_read_config_byte(pdev, PCI_REVISION_ID, &revisionid); // PCI_REVISION_ID 0x08
+#else
+	revisionid = pdev->revision;
+#endif
+	pci_read_config_word(pdev, PCI_INTERRUPT_LINE, &irqline); // PCI_INTERRUPT_LINE 0x3c
+	pdvobjpriv->irqline = irqline;
+
+
+	//
+	// Decide hardware type here.
+	//
+	if( deviceid == HAL_HW_PCI_8185_DEVICE_ID ||
+	    deviceid == HAL_HW_PCI_8188_DEVICE_ID ||
+	    deviceid == HAL_HW_PCI_8198_DEVICE_ID)
+	{
+		DBG_871X("Adapter (8185/8185B) is found- VendorID/DeviceID=%x/%x\n", venderid, deviceid);
+		padapter->HardwareType=HARDWARE_TYPE_RTL8185;
+	}
+	else if (deviceid == HAL_HW_PCI_8190_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0045_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0046_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_DLINK_DEVICE_ID)
+	{
+		DBG_871X("Adapter(8190 PCI) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+		padapter->HardwareType = HARDWARE_TYPE_RTL8190P;
+	}
+	else if (deviceid == HAL_HW_PCI_8192_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0044_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0047_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8192SE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8174_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8173_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8172_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8171_DEVICE_ID)
+	{
+		// 8192e and and 8192se may have the same device ID 8192. However, their Revision
+		// ID is different
+		// Added for 92DE. We deferentiate it from SVID,SDID.
+		if( pdev->subsystem_vendor == 0x10EC && pdev->subsystem_device == 0xE020){
+			padapter->HardwareType = HARDWARE_TYPE_RTL8192DE;
+			DBG_871X("Adapter(8192DE) is found - VendorID/DeviceID/RID=%X/%X/%X\n", venderid, deviceid, revisionid);
+		}else{
+			switch (revisionid) {
+				case HAL_HW_PCI_REVISION_ID_8192PCIE:
+					DBG_871X("Adapter(8192 PCI-E) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+					padapter->HardwareType = HARDWARE_TYPE_RTL8192E;
+					break;
+				case HAL_HW_PCI_REVISION_ID_8192SE:
+					DBG_871X("Adapter(8192SE) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+					padapter->HardwareType = HARDWARE_TYPE_RTL8192SE;
+					break;
+				default:
+					DBG_871X("Err: Unknown device - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+					padapter->HardwareType = HARDWARE_TYPE_RTL8192SE;
+					break;
+			}
+		}
+	}
+	else if(deviceid==HAL_HW_PCI_8723E_DEVICE_ID )
+	{//RTL8723E may have the same device ID with RTL8192CET
+		padapter->HardwareType = HARDWARE_TYPE_RTL8723AE;
+		DBG_871X("Adapter(8723 PCI-E) is found - VendorID/DeviceID=%x/%x\n", venderid, deviceid);
+	}
+	else if (deviceid == HAL_HW_PCI_8192CET_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8192CE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8191CE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8188CE_DEVICE_ID)
+	{
+		DBG_871X("Adapter(8192C PCI-E) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+		padapter->HardwareType = HARDWARE_TYPE_RTL8192CE;
+	}
+	else if (deviceid == HAL_HW_PCI_8192DE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_002B_DEVICE_ID ){
+		padapter->HardwareType = HARDWARE_TYPE_RTL8192DE;
+		DBG_871X("Adapter(8192DE) is found - VendorID/DeviceID/RID=%X/%X/%X\n", venderid, deviceid, revisionid);
+	}
+	else
+	{
+		DBG_871X("Err: Unknown device - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+		//padapter->HardwareType = HAL_DEFAULT_HARDWARE_TYPE;
+	}
+
+
+	padapter->chip_type = NULL_CHIP_TYPE;
+
+	//TODO:
+#ifdef CONFIG_RTL8192C
+	padapter->chip_type = RTL8188C_8192C;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192CE;
+#endif
+#ifdef CONFIG_RTL8192D
+	pdvobjpriv->InterfaceNumber = revisionid;
+
+	padapter->chip_type = RTL8192D;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192DE;
+#endif
+
+}
+
+static void pci_intf_start(_adapter *padapter)
+{
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+pci_intf_start\n"));
+	DBG_871X("+pci_intf_start\n");
+
+#ifdef CONFIG_PCILED_BLINK
+	rtw_led_control(padapter, LED_CTL_NO_LINK);
+#endif
+	//Enable hw interrupt
+	rtw_hal_enable_interrupt(padapter);
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-pci_intf_start\n"));
+	DBG_871X("-pci_intf_start\n");
+}
+
+static void pci_intf_stop(_adapter *padapter)
+{
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+pci_intf_stop\n"));
+
+	//Disable hw interrupt
+	if(padapter->bSurpriseRemoved == _FALSE)
+	{
+		//device still exists, so driver can do i/o operation
+		rtw_hal_disable_interrupt(padapter);
+		tasklet_disable(&(padapter->recvpriv.recv_tasklet));
+		tasklet_disable(&(padapter->recvpriv.irq_prepare_beacon_tasklet));
+		tasklet_disable(&(padapter->xmitpriv.xmit_tasklet));
+
+#ifdef CONFIG_CONCURRENT_MODE
+		/*	This function only be called at driver removing. disable buddy_adapter too
+			don't disable interrupt of buddy_adapter because it is same as primary.
+		*/
+		if (padapter->pbuddy_adapter){
+			tasklet_disable(&(padapter->pbuddy_adapter->recvpriv.recv_tasklet));
+			tasklet_disable(&(padapter->pbuddy_adapter->recvpriv.irq_prepare_beacon_tasklet));
+			tasklet_disable(&(padapter->pbuddy_adapter->xmitpriv.xmit_tasklet));
+		}
+#endif
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("pci_intf_stop: SurpriseRemoved==_FALSE\n"));
+	}
+	else
+	{
+		// Clear irq_enabled to prevent handle interrupt function.
+		adapter_to_dvobj(padapter)->irq_enabled = 0;
+	}
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-pci_intf_stop\n"));
+
+}
+
+
+static void rtw_dev_unload(_adapter *padapter)
+{
+	struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_dev_unload\n"));
+
+	if(padapter->bup == _TRUE)
+	{
+		DBG_871X("+rtw_dev_unload\n");
+
+		padapter->bDriverStopped = _TRUE;
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		//s3.
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		//s4.
+		rtw_stop_drv_threads(padapter);
+
+
+		//s5.
+		if(padapter->bSurpriseRemoved == _FALSE)
+		{
+			DBG_871X("r871x_dev_unload()->rtl871x_hal_deinit()\n");
+			rtw_hal_deinit(padapter);
+
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		padapter->bup = _FALSE;
+
+	}
+	else
+	{
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("r871x_dev_unload():padapter->bup == _FALSE\n" ));
+	}
+
+	DBG_871X("-rtw_dev_unload\n");
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-rtw_dev_unload\n"));
+
+}
+
+static void disable_ht_for_spec_devid(const struct pci_device_id *pdid)
+{
+#ifdef CONFIG_80211N_HT
+	u16 vid, pid;
+	u32 flags;
+	int i;
+	int num = sizeof(specific_device_id_tbl)/sizeof(struct specific_device_id);
+
+	for(i=0; i<num; i++)
+	{
+		vid = specific_device_id_tbl[i].idVendor;
+		pid = specific_device_id_tbl[i].idProduct;
+		flags = specific_device_id_tbl[i].flags;
+
+		if((pdid->vendor==vid) && (pdid->device==pid) && (flags&SPEC_DEV_ID_DISABLE_HT))
+		{
+			 rtw_ht_enable = 0;
+			 rtw_cbw40_enable = 0;
+			 rtw_ampdu_enable = 0;
+		}
+
+	}
+#endif
+}
+
+#ifdef CONFIG_PM
+static int rtw_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	_func_enter_;
+
+
+	_func_exit_;
+	return 0;
+}
+
+static int rtw_resume(struct pci_dev *pdev)
+{
+	_func_enter_;
+
+
+	_func_exit_;
+
+	return 0;
+}
+#endif
+
+_adapter *rtw_pci_if1_init(struct dvobj_priv * dvobj, struct pci_dev *pdev,
+	const struct pci_device_id *pdid)
+{
+	_adapter *padapter = NULL;
+	struct net_device *pnetdev = NULL;
+	int status = _FAIL;
+
+	if ((padapter = (_adapter *)rtw_zvmalloc(sizeof(*padapter))) == NULL) {
+		goto exit;
+	}
+	padapter->dvobj = dvobj;
+	dvobj->if1 = padapter;
+
+	padapter->bDriverStopped=_TRUE;
+
+	dvobj->padapters[dvobj->iface_nums++] = padapter;
+	padapter->iface_id = IFACE_ID0;
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_DUALMAC_CONCURRENT)
+	//set adapter_type/iface type for primary padapter
+	padapter->isprimary = _TRUE;
+	padapter->adapter_type = PRIMARY_ADAPTER;
+	#ifndef CONFIG_HWPORT_SWAP
+	padapter->iface_type = IFACE_PORT0;
+	#else
+	padapter->iface_type = IFACE_PORT1;
+	#endif
+#endif
+
+	//step 1-1., decide the chip_type via vid/pid
+	padapter->interface_type = RTW_PCIE;
+	decide_chip_type_by_pci_device_id(padapter, pdev);
+
+	if((pnetdev = rtw_init_netdev(padapter)) == NULL) {
+		goto free_adapter;
+	}
+	if (dvobj->bdma64)
+		pnetdev->features |= NETIF_F_HIGHDMA;
+	pnetdev->irq = pdev->irq;
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(dvobj));
+	padapter = rtw_netdev_priv(pnetdev);
+
+	//step 2. hook HalFunc, allocate HalData
+	if (padapter->chip_type == RTL8188C_8192C) {
+		#ifdef CONFIG_RTL8192C
+		rtl8192ce_set_hal_ops(padapter);
+		#endif
+	} else if (padapter->chip_type == RTL8192D) {
+		#ifdef CONFIG_RTL8192D
+		rtl8192de_set_hal_ops(padapter);
+		#endif
+	} else {
+		DBG_871X("Detect NULL_CHIP_TYPE\n");
+		goto free_hal_data;
+	}
+
+	//step 3.	initialize the dvobj_priv
+	padapter->intf_start=&pci_intf_start;
+	padapter->intf_stop=&pci_intf_stop;
+
+
+	//.2
+	if ((rtw_init_io_priv(padapter, pci_set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+		goto free_hal_data;
+	}
+
+	//.3
+	rtw_hal_read_chip_version(padapter);
+
+	//.4
+	rtw_hal_chip_configure(padapter);
+
+	//step 4. read efuse/eeprom data and get mac_addr
+	rtw_hal_read_chip_info(padapter);
+
+	if (rtw_handle_dualmac(padapter, 1) != _SUCCESS)
+		goto free_hal_data;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(rtw_wdev_alloc(padapter, dvobj_to_dev(dvobj)) != 0) {
+		goto handle_dualmac;
+	}
+#endif
+
+	//step 5.
+	if (rtw_init_drv_sw(padapter) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("Initialize driver software resource Failed!\n"));
+		goto free_wdev;
+	}
+
+	status = rtw_hal_inirp_init(padapter);
+	if(status ==_FAIL){
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("Initialize PCI desc ring Failed!\n"));
+		goto free_drv_sw;
+	}
+
+	rtw_macaddr_cfg(padapter->eeprompriv.mac_addr);
+	rtw_init_wifidirect_addrs(padapter, padapter->eeprompriv.mac_addr, padapter->eeprompriv.mac_addr);
+
+
+	rtw_hal_disable_interrupt(padapter);
+
+	//step 6. Init pci related configuration
+	rtw_pci_initialize_adapter_common(padapter);
+
+	DBG_871X("bDriverStopped:%d, bSurpriseRemoved:%d, bup:%d, hw_init_completed:%d\n"
+		,padapter->bDriverStopped
+		,padapter->bSurpriseRemoved
+		,padapter->bup
+		,padapter->hw_init_completed
+	);
+
+	status = _SUCCESS;
+
+inirp_deinit:
+	if (status != _SUCCESS)
+		rtw_hal_inirp_deinit(padapter);
+free_drv_sw:
+	if (status != _SUCCESS)
+		rtw_free_drv_sw(padapter);
+free_wdev:
+	if (status != _SUCCESS) {
+		#ifdef CONFIG_IOCTL_CFG80211
+		rtw_wdev_unregister(padapter->rtw_wdev);
+		rtw_wdev_free(padapter->rtw_wdev);
+		#endif
+	}
+handle_dualmac:
+	if (status != _SUCCESS)
+		rtw_handle_dualmac(padapter, 0);
+free_hal_data:
+	if (status != _SUCCESS && padapter->HalData)
+		rtw_mfree(padapter->HalData, sizeof(*(padapter->HalData)));
+free_adapter:
+	if (status != _SUCCESS) {
+		if (pnetdev)
+			rtw_free_netdev(pnetdev);
+		else if (padapter)
+			rtw_vmfree((u8*)padapter, sizeof(*padapter));
+		padapter = NULL;
+	}
+exit:
+	return padapter;
+}
+
+static void rtw_pci_if1_deinit(_adapter *if1)
+{
+	struct net_device *pnetdev = if1->pnetdev;
+	struct mlme_priv *pmlmepriv= &if1->mlmepriv;
+
+	//	padapter->intf_stop(padapter);
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED))
+		rtw_disassoc_cmd(if1, 0, _FALSE);
+
+#ifdef CONFIG_AP_MODE
+	free_mlme_ap_info(if1);
+	#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_unload(if1);
+	#endif
+#endif
+
+	rtw_cancel_all_timer(if1);
+#ifdef CONFIG_WOWLAN
+	if1->pwrctrlpriv.wowlan_mode=_FALSE;
+#endif //CONFIG_WOWLAN
+	rtw_dev_unload(if1);
+
+	DBG_871X("%s, hw_init_completed=%d\n", __func__, if1->hw_init_completed);
+
+	//s6.
+	rtw_handle_dualmac(if1, 0);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (if1->rtw_wdev)
+		rtw_wdev_free(if1->rtw_wdev);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_hal_inirp_deinit(if1);
+	rtw_free_drv_sw(if1);
+
+	if(pnetdev)
+		rtw_free_netdev(pnetdev);
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link down\n");
+	rtd2885_wlan_netlink_sendMsg("linkdown", "8712");
+#endif
+}
+
+/*
+ * drv_init() - a device potentially for us
+ *
+ * notes: drv_init() is called when the bus driver has located a card for us to support.
+ *        We accept the new device by returning 0.
+*/
+static int rtw_drv_init(struct pci_dev *pdev, const struct pci_device_id *did)
+{
+	int i, err = -ENODEV;
+
+	int status;
+	_adapter *if1 = NULL, *if2 = NULL;
+	struct dvobj_priv *dvobj;
+
+	RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("+rtw_drv_init\n"));
+
+	//step 0.
+	disable_ht_for_spec_devid(did);
+
+	/* Initialize dvobj_priv */
+	if ((dvobj = pci_dvobj_init(pdev)) == NULL) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("initialize device object priv Failed!\n"));
+		goto exit;
+	}
+
+	/* Initialize if1 */
+	if ((if1 = rtw_pci_if1_init(dvobj, pdev, did)) == NULL) {
+		DBG_871X("rtw_pci_if1_init Failed!\n");
+		goto free_dvobj;
+	}
+
+	/* Initialize if2 */
+#ifdef CONFIG_CONCURRENT_MODE
+	if((if2 = rtw_drv_if2_init(if1, pci_set_intf_ops)) == NULL) {
+		goto free_if1;
+	}
+#endif
+
+#ifdef CONFIG_GLOBAL_UI_PID
+	if (ui_pid[1]!=0) {
+		DBG_871X("ui_pid[1]:%d\n",ui_pid[1]);
+		rtw_signal_process(ui_pid[1], SIGUSR2);
+	}
+#endif
+
+	//dev_alloc_name && register_netdev
+	if((status = rtw_drv_register_netdev(if1)) != _SUCCESS) {
+		goto free_if1;
+	}
+
+#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_init(if1);
+#endif
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link up\n");
+	rtd2885_wlan_netlink_sendMsg("linkup", "8712");
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	rtw_proc_init_one(if1->pnetdev);
+#endif
+
+
+	/* alloc irq */
+	if (pci_alloc_irq(dvobj) != _SUCCESS)
+		goto free_if2;
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-871x_drv - drv_init, success!\n"));
+	//DBG_871X("-871x_drv - drv_init, success!\n");
+
+	status = _SUCCESS;
+
+free_if2:
+	if(status != _SUCCESS && if2) {
+		#ifdef CONFIG_CONCURRENT_MODE
+		rtw_drv_if2_stop(if2);
+		rtw_drv_if2_free(if2);
+		#endif
+	}
+free_if1:
+	if (status != _SUCCESS && if1) {
+		rtw_pci_if1_deinit(if1);
+	}
+free_dvobj:
+	if (status != _SUCCESS)
+		pci_dvobj_deinit(pdev);
+exit:
+	return status == _SUCCESS?0:-ENODEV;
+}
+
+/*
+ * dev_remove() - our device is being removed
+*/
+//rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove() => how to recognize both
+static void rtw_dev_remove(struct pci_dev *pdev)
+{
+	struct dvobj_priv *pdvobjpriv = pci_get_drvdata(pdev);
+	_adapter *padapter = pdvobjpriv->if1;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+_func_exit_;
+
+	DBG_871X("+rtw_dev_remove\n");
+
+	pdvobjpriv->processing_dev_remove = _TRUE;
+
+	if (unlikely(!padapter)) {
+		return;
+	}
+
+	rtw_unregister_netdevs(pdvobjpriv);
+
+	#if 0
+#ifdef RTK_DMP_PLATFORM
+	padapter->bSurpriseRemoved = _FALSE;	// always trate as device exists
+											// this will let the driver to disable it's interrupt
+#else
+	if(pci_drvpriv.drv_registered == _TRUE)
+	{
+		//DBG_871X("r871xu_dev_remove():padapter->bSurpriseRemoved == _TRUE\n");
+		padapter->bSurpriseRemoved = _TRUE;
+	}
+	/*else
+	{
+		//DBG_871X("r871xu_dev_remove():module removed\n");
+		padapter->hw_init_completed = _FALSE;
+	}*/
+#endif
+	#endif
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	rtw_unregister_early_suspend(&padapter->pwrctrlpriv);
+#endif
+
+	rtw_pm_set_ips(padapter, IPS_NONE);
+	rtw_pm_set_lps(padapter, PS_MODE_ACTIVE);
+
+	LeaveAllPowerSaveMode(padapter);
+
+	rtw_hal_disable_interrupt(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_drv_if2_stop(pdvobjpriv->if2);
+#endif //CONFIG_CONCURRENT_MODE
+
+	rtw_pci_if1_deinit(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_drv_if2_free(pdvobjpriv->if2);
+#endif
+
+	pci_dvobj_deinit(pdev);
+
+	DBG_871X("-r871xu_dev_remove, done\n");
+
+_func_exit_;
+	return;
+}
+
+
+static int __init rtw_drv_entry(void)
+{
+	int ret = 0;
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_entry\n"));
+	DBG_871X("rtw driver version=%s\n", DRIVERVERSION);
+	DBG_871X("Build at: %s %s\n", __DATE__, __TIME__);
+	pci_drvpriv.drv_registered = _TRUE;
+
+	rtw_suspend_lock_init();
+
+	ret = pci_register_driver(&pci_drvpriv.rtw_pci_drv);
+	if (ret) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, (": No device found\n"));
+	}
+
+	return ret;
+}
+
+static void __exit rtw_drv_halt(void)
+{
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_halt\n"));
+	DBG_871X("+rtw_drv_halt\n");
+
+	pci_drvpriv.drv_registered = _FALSE;
+
+	pci_unregister_driver(&pci_drvpriv.rtw_pci_drv);
+
+	rtw_suspend_lock_uninit();
+	DBG_871X("-rtw_drv_halt\n");
+
+	rtw_mstat_dump();
+}
+
+
+module_init(rtw_drv_entry);
+module_exit(rtw_drv_halt);
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c
new file mode 100755
index 0000000000000..7d671df3932c2
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c
@@ -0,0 +1,24 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *******************************************************************************/
+#define _PCI_OPS_LINUX_C_
+
+#include <drv_types.h>
+
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c
new file mode 100755
index 0000000000000..628abdf7832bc
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c
@@ -0,0 +1,461 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RECV_OSDEP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#include <wifi.h>
+#include <recv_osdep.h>
+
+#include <osdep_intf.h>
+#include <ethernet.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+//init os related resource in struct recv_priv
+int rtw_os_recv_resource_init(struct recv_priv *precvpriv, _adapter *padapter)
+{
+	int	res=_SUCCESS;
+
+	return res;
+}
+
+//alloc os related resource in union recv_frame
+int rtw_os_recv_resource_alloc(_adapter *padapter, union recv_frame *precvframe)
+{
+	int	res=_SUCCESS;
+	
+	precvframe->u.hdr.pkt_newalloc = precvframe->u.hdr.pkt = NULL;
+
+	return res;
+
+}
+
+//free os related resource in union recv_frame
+void rtw_os_recv_resource_free(struct recv_priv *precvpriv)
+{
+
+}
+
+
+//alloc os related resource in struct recv_buf
+int rtw_os_recvbuf_resource_alloc(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	int res=_SUCCESS;
+
+#ifdef CONFIG_USB_HCI
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+	precvbuf->irp_pending = _FALSE;
+	precvbuf->purb = usb_alloc_urb(0, GFP_KERNEL);
+	if(precvbuf->purb == NULL){
+		res = _FAIL;
+	}
+
+	precvbuf->pskb = NULL;
+
+	precvbuf->reuse = _FALSE;
+
+	precvbuf->pallocated_buf  = precvbuf->pbuf = NULL;
+
+	precvbuf->pdata = precvbuf->phead = precvbuf->ptail = precvbuf->pend = NULL;
+
+	precvbuf->transfer_len = 0;
+
+	precvbuf->len = 0;
+
+	#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	precvbuf->pallocated_buf = rtw_usb_buffer_alloc(pusbd, (size_t)precvbuf->alloc_sz, &precvbuf->dma_transfer_addr);
+	precvbuf->pbuf = precvbuf->pallocated_buf;
+	if(precvbuf->pallocated_buf == NULL)
+		return _FAIL;
+	#endif //CONFIG_USE_USB_BUFFER_ALLOC_RX
+	
+#endif //CONFIG_USB_HCI
+
+	return res;
+}
+
+//free os related resource in struct recv_buf
+int rtw_os_recvbuf_resource_free(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	int ret = _SUCCESS;
+
+#ifdef CONFIG_USB_HCI
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+	rtw_usb_buffer_free(pusbd, (size_t)precvbuf->alloc_sz, precvbuf->pallocated_buf, precvbuf->dma_transfer_addr);
+	precvbuf->pallocated_buf =  NULL;
+	precvbuf->dma_transfer_addr = 0;
+
+#endif //CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+	if(precvbuf->purb)
+	{
+		//usb_kill_urb(precvbuf->purb);
+		usb_free_urb(precvbuf->purb);
+	}
+
+#endif //CONFIG_USB_HCI
+
+
+	if(precvbuf->pskb)
+		rtw_skb_free(precvbuf->pskb);
+
+
+	return ret;
+
+}
+
+void rtw_handle_tkip_mic_err(_adapter *padapter,u8 bgroup)
+{
+#ifdef CONFIG_IOCTL_CFG80211
+	enum nl80211_key_type key_type = 0;
+#endif
+	union iwreq_data wrqu;
+	struct iw_michaelmicfailure    ev;
+	struct mlme_priv*              pmlmepriv  = &padapter->mlmepriv;
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;	
+	u32 cur_time = 0;
+
+	if( psecuritypriv->last_mic_err_time == 0 )
+	{
+		psecuritypriv->last_mic_err_time = rtw_get_current_time();
+	}
+	else
+	{
+		cur_time = rtw_get_current_time();
+
+		if( cur_time - psecuritypriv->last_mic_err_time < 60*HZ )
+		{
+			psecuritypriv->btkip_countermeasure = _TRUE;
+			psecuritypriv->last_mic_err_time = 0;
+			psecuritypriv->btkip_countermeasure_time = cur_time;
+		}
+		else
+		{
+			psecuritypriv->last_mic_err_time = rtw_get_current_time();
+		}
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( bgroup )
+	{
+		key_type |= NL80211_KEYTYPE_GROUP;
+	}
+	else
+	{
+		key_type |= NL80211_KEYTYPE_PAIRWISE;
+	}
+
+	cfg80211_michael_mic_failure(padapter->pnetdev, (u8 *)&pmlmepriv->assoc_bssid[ 0 ], key_type, -1,
+		NULL, GFP_ATOMIC);
+#endif
+
+	_rtw_memset( &ev, 0x00, sizeof( ev ) );
+	if ( bgroup )
+	{
+	    ev.flags |= IW_MICFAILURE_GROUP;
+	}
+	else
+	{
+	    ev.flags |= IW_MICFAILURE_PAIRWISE;
+	}
+
+	ev.src_addr.sa_family = ARPHRD_ETHER;
+	_rtw_memcpy( ev.src_addr.sa_data, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+
+	_rtw_memset( &wrqu, 0x00, sizeof( wrqu ) );
+	wrqu.data.length = sizeof( ev );
+
+	wireless_send_event( padapter->pnetdev, IWEVMICHAELMICFAILURE, &wrqu, (char*) &ev );
+}
+
+void rtw_hostapd_mlme_rx(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_HOSTAPD_MLME
+	_pkt *skb;
+	struct hostapd_priv *phostapdpriv  = padapter->phostapdpriv;
+	struct net_device *pmgnt_netdev = phostapdpriv->pmgnt_netdev;
+
+	RT_TRACE(_module_recv_osdep_c_, _drv_info_, ("+rtw_hostapd_mlme_rx\n"));
+
+	skb = precv_frame->u.hdr.pkt;
+
+	if (skb == NULL)
+		return;
+
+	skb->data = precv_frame->u.hdr.rx_data;
+	skb->tail = precv_frame->u.hdr.rx_tail;
+	skb->len = precv_frame->u.hdr.len;
+
+	//pskb_copy = rtw_skb_copy(skb);
+//	if(skb == NULL) goto _exit;
+
+	skb->dev = pmgnt_netdev;
+	skb->ip_summed = CHECKSUM_NONE;
+	skb->pkt_type = PACKET_OTHERHOST;
+	//skb->protocol = __constant_htons(0x0019); /*ETH_P_80211_RAW*/
+	skb->protocol = __constant_htons(0x0003); /*ETH_P_80211_RAW*/
+
+	//DBG_871X("(1)data=0x%x, head=0x%x, tail=0x%x, mac_header=0x%x, len=%d\n", skb->data, skb->head, skb->tail, skb->mac_header, skb->len);
+
+	//skb->mac.raw = skb->data;
+	skb_reset_mac_header(skb);
+
+       //skb_pull(skb, 24);
+       _rtw_memset(skb->cb, 0, sizeof(skb->cb));
+
+	rtw_netif_rx(pmgnt_netdev, skb);
+
+	precv_frame->u.hdr.pkt = NULL; // set pointer to NULL before rtw_free_recvframe() if call rtw_netif_rx()
+#endif
+}
+
+int rtw_recv_indicatepkt(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct recv_priv *precvpriv;
+	_queue	*pfree_recv_queue;
+	_pkt *skb;
+	struct mlme_priv*pmlmepriv = &padapter->mlmepriv;
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+#endif
+
+#ifdef CONFIG_BR_EXT
+	void *br_port = NULL;
+#endif
+
+_func_enter_;
+
+	precvpriv = &(padapter->recvpriv);
+	pfree_recv_queue = &(precvpriv->free_recv_queue);
+
+#ifdef CONFIG_DRVEXT_MODULE
+	if (drvext_rx_handler(padapter, precv_frame->u.hdr.rx_data, precv_frame->u.hdr.len) == _SUCCESS)
+	{
+		goto _recv_indicatepkt_drop;
+	}
+#endif
+
+	skb = precv_frame->u.hdr.pkt;
+	if(skb == NULL)
+	{
+		RT_TRACE(_module_recv_osdep_c_,_drv_err_,("rtw_recv_indicatepkt():skb==NULL something wrong!!!!\n"));
+		goto _recv_indicatepkt_drop;
+	}
+
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("rtw_recv_indicatepkt():skb != NULL !!!\n"));		
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("rtw_recv_indicatepkt():precv_frame->u.hdr.rx_head=%p  precv_frame->hdr.rx_data=%p\n", precv_frame->u.hdr.rx_head, precv_frame->u.hdr.rx_data));
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("precv_frame->hdr.rx_tail=%p precv_frame->u.hdr.rx_end=%p precv_frame->hdr.len=%d \n", precv_frame->u.hdr.rx_tail, precv_frame->u.hdr.rx_end, precv_frame->u.hdr.len));
+
+	skb->data = precv_frame->u.hdr.rx_data;
+
+	skb_set_tail_pointer(skb, precv_frame->u.hdr.len);
+
+	skb->len = precv_frame->u.hdr.len;
+
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("\n skb->head=%p skb->data=%p skb->tail=%p skb->end=%p skb->len=%d\n", skb->head, skb->data, skb->tail, skb->end, skb->len));
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+	 	_pkt *pskb2=NULL;
+	 	struct sta_info *psta = NULL;
+	 	struct sta_priv *pstapriv = &padapter->stapriv;
+		struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+		int bmcast = IS_MCAST(pattrib->dst);
+
+		//DBG_871X("bmcast=%d\n", bmcast);
+
+		if(_rtw_memcmp(pattrib->dst, myid(&padapter->eeprompriv), ETH_ALEN)==_FALSE)
+		{
+			//DBG_871X("not ap psta=%p, addr=%pM\n", psta, pattrib->dst);
+
+			if(bmcast)
+			{
+				psta = rtw_get_bcmc_stainfo(padapter);
+				pskb2 = rtw_skb_clone(skb);
+			} else {
+				psta = rtw_get_stainfo(pstapriv, pattrib->dst);
+			}
+
+			if(psta)
+			{
+				struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;			
+
+				//DBG_871X("directly forwarding to the rtw_xmit_entry\n");
+
+				//skb->ip_summed = CHECKSUM_NONE;
+				skb->dev = pnetdev;			
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+				skb_set_queue_mapping(skb, rtw_recv_select_queue(skb));
+#endif //LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35)
+			
+				_rtw_xmit_entry(skb, pnetdev);
+			
+				if(bmcast)
+					skb = pskb2;
+				else
+					goto _recv_indicatepkt_end;
+			}
+
+
+		}
+		else// to APself
+		{
+			//DBG_871X("to APSelf\n");
+		}
+	}
+	
+
+#ifdef CONFIG_BR_EXT
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+	br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+	rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+
+	if( br_port	&& (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE) )	 	
+	{
+		int nat25_handle_frame(_adapter *priv, struct sk_buff *skb);
+		if (nat25_handle_frame(padapter, skb) == -1) {
+			//priv->ext_stats.rx_data_drops++;
+			//DEBUG_ERR("RX DROP: nat25_handle_frame fail!\n");
+			//return FAIL;
+#if 1			
+			// bypass this frame to upper layer!!
+#else
+			goto _recv_indicatepkt_drop;
+#endif
+		}	
+	}
+
+#endif	// CONFIG_BR_EXT
+
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	if ( (pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1) ) {
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
+		//DBG_871X("CHECKSUM_UNNECESSARY \n");
+	} else {
+		skb->ip_summed = CHECKSUM_NONE;
+		//DBG_871X("CHECKSUM_NONE(%d, %d) \n", pattrib->tcpchk_valid, pattrib->tcp_chkrpt);
+	}
+#else /* !CONFIG_TCP_CSUM_OFFLOAD_RX */
+
+	skb->ip_summed = CHECKSUM_NONE;
+
+#endif
+
+	skb->dev = padapter->pnetdev;
+	skb->protocol = eth_type_trans(skb, padapter->pnetdev);
+
+	rtw_netif_rx(padapter->pnetdev, skb);
+
+_recv_indicatepkt_end:
+
+	precv_frame->u.hdr.pkt = NULL; // pointers to NULL before rtw_free_recvframe()
+
+	rtw_free_recvframe(precv_frame, pfree_recv_queue);
+
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("\n rtw_recv_indicatepkt :after rtw_netif_rx!!!!\n"));
+
+_func_exit_;
+
+        return _SUCCESS;
+
+_recv_indicatepkt_drop:
+
+	 //enqueue back to free_recv_queue
+	 if(precv_frame)
+		 rtw_free_recvframe(precv_frame, pfree_recv_queue);
+
+	 return _FAIL;
+
+_func_exit_;
+
+}
+
+void rtw_os_read_port(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+
+#ifdef CONFIG_USB_HCI
+
+	precvbuf->ref_cnt--;
+
+	//free skb in recv_buf
+	rtw_skb_free(precvbuf->pskb);
+
+	precvbuf->pskb = NULL;
+	precvbuf->reuse = _FALSE;
+
+	if(precvbuf->irp_pending == _FALSE)
+	{
+		rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+	}
+
+
+#endif
+#ifdef CONFIG_SDIO_HCI
+		precvbuf->pskb = NULL;
+#endif
+
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+void _rtw_reordering_ctrl_timeout_handler(void *FunctionContext);
+void _rtw_reordering_ctrl_timeout_handler(void *FunctionContext)
+#else
+void _rtw_reordering_ctrl_timeout_handler(struct timer_list *t);
+void _rtw_reordering_ctrl_timeout_handler(struct timer_list *t)
+#endif
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+        struct recv_reorder_ctrl *preorder_ctrl = (struct recv_reorder_ctrl *)FunctionContext;
+#else
+        struct recv_reorder_ctrl *preorder_ctrl = from_timer(preorder_ctrl, t, reordering_ctrl_timer);
+#endif
+	rtw_reordering_ctrl_timeout_handler(preorder_ctrl);
+}
+
+void rtw_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+	_adapter *padapter = preorder_ctrl->padapter;
+
+	_init_timer(&(preorder_ctrl->reordering_ctrl_timer), padapter->pnetdev, _rtw_reordering_ctrl_timeout_handler, preorder_ctrl);
+#else
+	timer_setup(&preorder_ctrl->reordering_ctrl_timer, _rtw_reordering_ctrl_timeout_handler, 0);
+#endif
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c
new file mode 100755
index 0000000000000..d6ac16c582c23
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c
@@ -0,0 +1,839 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <rtw_android.h>
+#include <osdep_service.h>
+#include <rtw_debug.h>
+#include <ioctl_cfg80211.h>
+#include <rtw_ioctl_set.h>
+
+#if defined(RTW_ENABLE_WIFI_CONTROL_FUNC)
+#include <linux/platform_device.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+#include <linux/wlan_plat.h>
+#else
+#include <linux/wifi_tiwlan.h>
+#endif
+#endif /* defined(RTW_ENABLE_WIFI_CONTROL_FUNC) */
+
+const char *android_wifi_cmd_str[ANDROID_WIFI_CMD_MAX] = {
+	"START",
+	"STOP",
+	"SCAN-ACTIVE",
+	"SCAN-PASSIVE",
+	"RSSI",
+	"LINKSPEED",
+	"RXFILTER-START",
+	"RXFILTER-STOP",
+	"RXFILTER-ADD",
+	"RXFILTER-REMOVE",
+	"BTCOEXSCAN-START",
+	"BTCOEXSCAN-STOP",
+	"BTCOEXMODE",
+	"SETSUSPENDOPT",
+	"P2P_DEV_ADDR",
+	"SETFWPATH",
+	"SETBAND",
+	"GETBAND",
+	"COUNTRY",
+	"P2P_SET_NOA",
+	"P2P_GET_NOA",
+	"P2P_SET_PS",
+	"SET_AP_WPS_P2P_IE",
+#ifdef PNO_SUPPORT
+	"PNOSSIDCLR",
+	"PNOSETUP ",
+	"PNOFORCE",
+	"PNODEBUG",
+#endif
+
+	"MACADDR",
+
+	"BLOCK",
+	"WFD-ENABLE",
+	"WFD-DISABLE",
+	"WFD-SET-TCPPORT",
+	"WFD-SET-MAXTPUT",
+	"WFD-SET-DEVTYPE",	
+};
+
+#ifdef PNO_SUPPORT
+#define PNO_TLV_PREFIX			'S'
+#define PNO_TLV_VERSION			'1'
+#define PNO_TLV_SUBVERSION 		'2'
+#define PNO_TLV_RESERVED		'0'
+#define PNO_TLV_TYPE_SSID_IE		'S'
+#define PNO_TLV_TYPE_TIME		'T'
+#define PNO_TLV_FREQ_REPEAT		'R'
+#define PNO_TLV_FREQ_EXPO_MAX		'M'
+
+typedef struct cmd_tlv {
+	char prefix;
+	char version;
+	char subver;
+	char reserved;
+} cmd_tlv_t;
+#endif /* PNO_SUPPORT */
+
+typedef struct android_wifi_priv_cmd {
+
+#ifdef CONFIG_COMPAT
+	compat_uptr_t buf;
+#else
+	char *buf;
+#endif
+
+	int used_len;
+	int total_len;
+} android_wifi_priv_cmd;
+
+/**
+ * Local (static) functions and variables
+ */
+
+/* Initialize g_wifi_on to 1 so dhd_bus_start will be called for the first
+ * time (only) in dhd_open, subsequential wifi on will be handled by
+ * wl_android_wifi_on
+ */
+static int g_wifi_on = _TRUE;
+
+
+#ifdef PNO_SUPPORT
+static int wl_android_set_pno_setup(struct net_device *dev, char *command, int total_len)
+{
+	wlc_ssid_t ssids_local[MAX_PFN_LIST_COUNT];
+	int res = -1;
+	int nssid = 0;
+	cmd_tlv_t *cmd_tlv_temp;
+	char *str_ptr;
+	int tlv_size_left;
+	int pno_time = 0;
+	int pno_repeat = 0;
+	int pno_freq_expo_max = 0;
+
+#ifdef PNO_SET_DEBUG
+	int i;
+	char pno_in_example[] = {
+		'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+		'S', '1', '2', '0',
+		'S',
+		0x05,
+		'd', 'l', 'i', 'n', 'k',
+		'S',
+		0x04,
+		'G', 'O', 'O', 'G',
+		'T',
+		'0', 'B',
+		'R',
+		'2',
+		'M',
+		'2',
+		0x00
+		};
+#endif /* PNO_SET_DEBUG */
+
+	DHD_INFO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+
+	if (total_len < (strlen(CMD_PNOSETUP_SET) + sizeof(cmd_tlv_t))) {
+		DBG_871X("%s argument=%d less min size\n", __FUNCTION__, total_len);
+		goto exit_proc;
+	}
+
+#ifdef PNO_SET_DEBUG
+	memcpy(command, pno_in_example, sizeof(pno_in_example));
+	for (i = 0; i < sizeof(pno_in_example); i++)
+		printf("%02X ", command[i]);
+	printf("\n");
+	total_len = sizeof(pno_in_example);
+#endif
+
+	str_ptr = command + strlen(CMD_PNOSETUP_SET);
+	tlv_size_left = total_len - strlen(CMD_PNOSETUP_SET);
+
+	cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+	memset(ssids_local, 0, sizeof(ssids_local));
+
+	if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+		(cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+		(cmd_tlv_temp->subver == PNO_TLV_SUBVERSION)) {
+
+		str_ptr += sizeof(cmd_tlv_t);
+		tlv_size_left -= sizeof(cmd_tlv_t);
+
+		if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+			MAX_PFN_LIST_COUNT, &tlv_size_left)) <= 0) {
+			DBG_871X("SSID is not presented or corrupted ret=%d\n", nssid);
+			goto exit_proc;
+		} else {
+			if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+				DBG_871X("%s scan duration corrupted field size %d\n",
+					__FUNCTION__, tlv_size_left);
+				goto exit_proc;
+			}
+			str_ptr++;
+			pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+			DHD_INFO(("%s: pno_time=%d\n", __FUNCTION__, pno_time));
+
+			if (str_ptr[0] != 0) {
+				if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+					DBG_871X("%s pno repeat : corrupted field\n",
+						__FUNCTION__);
+					goto exit_proc;
+				}
+				str_ptr++;
+				pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+				DHD_INFO(("%s :got pno_repeat=%d\n", __FUNCTION__, pno_repeat));
+				if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+					DBG_871X("%s FREQ_EXPO_MAX corrupted field size\n",
+						__FUNCTION__);
+					goto exit_proc;
+				}
+				str_ptr++;
+				pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+				DHD_INFO(("%s: pno_freq_expo_max=%d\n",
+					__FUNCTION__, pno_freq_expo_max));
+			}
+		}
+	} else {
+		DBG_871X("%s get wrong TLV command\n", __FUNCTION__);
+		goto exit_proc;
+	}
+
+	res = dhd_dev_pno_set(dev, ssids_local, nssid, pno_time, pno_repeat, pno_freq_expo_max);
+
+exit_proc:
+	return res;
+}
+#endif /* PNO_SUPPORT */
+
+int rtw_android_cmdstr_to_num(char *cmdstr)
+{
+	int cmd_num;
+	for(cmd_num=0 ; cmd_num<ANDROID_WIFI_CMD_MAX; cmd_num++)
+		if(0 == strncasecmp(cmdstr , android_wifi_cmd_str[cmd_num], strlen(android_wifi_cmd_str[cmd_num])) )
+			break;
+		
+	return cmd_num;
+}
+
+int rtw_android_get_rssi(struct net_device *net, char *command, int total_len)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);	
+	struct	wlan_network	*pcur_network = &pmlmepriv->cur_network;
+	int bytes_written = 0;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {	
+		bytes_written += snprintf(&command[bytes_written], total_len, "%s rssi %d", 
+			pcur_network->network.Ssid.Ssid, padapter->recvpriv.rssi);
+	}
+
+	return bytes_written;
+}
+
+int rtw_android_get_link_speed(struct net_device *net, char *command, int total_len)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);	
+	struct	wlan_network	*pcur_network = &pmlmepriv->cur_network;
+	int bytes_written = 0;
+	u16 link_speed = 0;
+
+	link_speed = rtw_get_cur_max_rate(padapter)/10;
+	bytes_written = snprintf(command, total_len, "LinkSpeed %d", link_speed);
+
+	return bytes_written;
+}
+
+int rtw_android_get_macaddr(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	int bytes_written = 0;
+	
+	bytes_written = snprintf(command, total_len, "Macaddr = "MAC_FMT, MAC_ARG(net->dev_addr));
+	return bytes_written;
+}
+
+int rtw_android_set_country(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	char *country_code = command + strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_COUNTRY]) + 1;
+	int ret = _FAIL;
+	
+	ret = rtw_set_country(adapter, country_code);
+
+	return (ret==_SUCCESS)?0:-1;
+}
+
+int rtw_android_get_p2p_dev_addr(struct net_device *net, char *command, int total_len)
+{
+	int bytes_written = 0;
+
+	//We use the same address as our HW MAC address
+	_rtw_memcpy(command, net->dev_addr, ETH_ALEN);
+	
+	bytes_written = ETH_ALEN;
+	return bytes_written;
+}
+
+int rtw_android_set_block(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	char *block_value = command + strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_BLOCK]) + 1;
+
+	#ifdef CONFIG_IOCTL_CFG80211
+	wdev_to_priv(adapter->rtw_wdev)->block = (*block_value=='0')?_FALSE:_TRUE;
+	#endif
+	
+	return 0;
+}
+
+int rtw_android_setband(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	char *arg = command + strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_SETBAND]) + 1;
+	u32 band = GHZ_MAX;
+	int ret = _FAIL;
+
+	sscanf(arg, "%u", &band);
+	ret = rtw_set_band(adapter, band);
+
+	return (ret==_SUCCESS)?0:-1;
+}
+
+int rtw_android_getband(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	int bytes_written = 0;
+
+	bytes_written = snprintf(command, total_len, "%u", adapter->setband);
+
+	return bytes_written;
+}
+
+int get_int_from_command( char* pcmd )
+{
+	int i = 0;
+
+	for( i = 0; i < strlen( pcmd ); i++ )
+	{
+		if ( pcmd[ i ] == '=' )
+		{
+			//	Skip the '=' and space characters.
+			i += 2;
+			break;
+		}
+	}
+	return ( rtw_atoi( pcmd + i ) );
+}
+
+int rtw_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+	int ret = 0;
+	char *command = NULL;
+	int cmd_num;
+	int bytes_written = 0;
+	android_wifi_priv_cmd priv_cmd;
+
+	rtw_lock_suspend();
+
+	if (!ifr->ifr_data) {
+		ret = -EINVAL;
+		goto exit;
+	}
+	if (copy_from_user(&priv_cmd, ifr->ifr_data, sizeof(android_wifi_priv_cmd))) {
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	command = rtw_zmalloc(priv_cmd.total_len);
+	if (!command)
+	{
+		DBG_871X("%s: failed to allocate memory\n", __FUNCTION__);
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	if (!access_ok(VERIFY_READ, priv_cmd.buf, priv_cmd.total_len)){
+	 	DBG_871X("%s: failed to access memory\n", __FUNCTION__);
+		ret = -EFAULT;
+		goto exit;
+	 }
+	if (copy_from_user(command, (void *)priv_cmd.buf, priv_cmd.total_len)) {
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	DBG_871X("%s: Android private cmd \"%s\" on %s\n"
+		, __FUNCTION__, command, ifr->ifr_name);
+
+	cmd_num = rtw_android_cmdstr_to_num(command);
+	
+	switch(cmd_num) {
+	case ANDROID_WIFI_CMD_START:
+		//bytes_written = wl_android_wifi_on(net);
+		goto response;
+	case ANDROID_WIFI_CMD_SETFWPATH:
+		goto response;
+	}
+
+	if (!g_wifi_on) {
+		DBG_871X("%s: Ignore private cmd \"%s\" - iface %s is down\n"
+			,__FUNCTION__, command, ifr->ifr_name);
+		ret = 0;
+		goto exit;
+	}
+
+	switch(cmd_num) {
+
+	case ANDROID_WIFI_CMD_STOP:
+		//bytes_written = wl_android_wifi_off(net);
+		break;
+		
+	case ANDROID_WIFI_CMD_SCAN_ACTIVE:
+		//rtw_set_scan_mode((_adapter *)rtw_netdev_priv(net), SCAN_ACTIVE);
+#ifdef CONFIG_PLATFORM_MSTAR
+#ifdef CONFIG_IOCTL_CFG80211
+		(wdev_to_priv(net->ieee80211_ptr))->bandroid_scan = _TRUE;	
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_PLATFORM_MSTAR
+		break;
+	case ANDROID_WIFI_CMD_SCAN_PASSIVE:
+		//rtw_set_scan_mode((_adapter *)rtw_netdev_priv(net), SCAN_PASSIVE);
+		break;
+		
+	case ANDROID_WIFI_CMD_RSSI:
+		bytes_written = rtw_android_get_rssi(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_LINKSPEED:
+		bytes_written = rtw_android_get_link_speed(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_MACADDR:
+		bytes_written = rtw_android_get_macaddr(net, command, priv_cmd.total_len);
+		break;
+		
+	case ANDROID_WIFI_CMD_BLOCK:
+		bytes_written = rtw_android_set_block(net, command, priv_cmd.total_len);
+		break;
+		
+	case ANDROID_WIFI_CMD_RXFILTER_START:
+		//bytes_written = net_os_set_packet_filter(net, 1);
+		break;
+	case ANDROID_WIFI_CMD_RXFILTER_STOP:
+		//bytes_written = net_os_set_packet_filter(net, 0);
+		break;
+	case ANDROID_WIFI_CMD_RXFILTER_ADD:
+		//int filter_num = *(command + strlen(CMD_RXFILTER_ADD) + 1) - '0';
+		//bytes_written = net_os_rxfilter_add_remove(net, TRUE, filter_num);
+		break;
+	case ANDROID_WIFI_CMD_RXFILTER_REMOVE:
+		//int filter_num = *(command + strlen(CMD_RXFILTER_REMOVE) + 1) - '0';
+		//bytes_written = net_os_rxfilter_add_remove(net, FALSE, filter_num);
+		break;
+		
+	case ANDROID_WIFI_CMD_BTCOEXSCAN_START:
+		/* TBD: BTCOEXSCAN-START */
+		break;
+	case ANDROID_WIFI_CMD_BTCOEXSCAN_STOP:
+		/* TBD: BTCOEXSCAN-STOP */
+		break;
+	case ANDROID_WIFI_CMD_BTCOEXMODE:
+		#if 0
+		uint mode = *(command + strlen(CMD_BTCOEXMODE) + 1) - '0';
+		if (mode == 1)
+			net_os_set_packet_filter(net, 0); /* DHCP starts */
+		else
+			net_os_set_packet_filter(net, 1); /* DHCP ends */
+#ifdef WL_CFG80211
+		bytes_written = wl_cfg80211_set_btcoex_dhcp(net, command);
+#endif
+		#endif
+		break;
+		
+	case ANDROID_WIFI_CMD_SETSUSPENDOPT:
+		//bytes_written = wl_android_set_suspendopt(net, command, priv_cmd.total_len);
+		break;
+		
+	case ANDROID_WIFI_CMD_SETBAND:
+		bytes_written = rtw_android_setband(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_GETBAND:
+		bytes_written = rtw_android_getband(net, command, priv_cmd.total_len);
+		break;
+		
+	case ANDROID_WIFI_CMD_COUNTRY:
+		bytes_written = rtw_android_set_country(net, command, priv_cmd.total_len);
+		break;
+		
+#ifdef PNO_SUPPORT
+	case ANDROID_WIFI_CMD_PNOSSIDCLR_SET:
+		//bytes_written = dhd_dev_pno_reset(net);
+		break;
+	case ANDROID_WIFI_CMD_PNOSETUP_SET:
+		//bytes_written = wl_android_set_pno_setup(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_PNOENABLE_SET:
+		//uint pfn_enabled = *(command + strlen(CMD_PNOENABLE_SET) + 1) - '0';
+		//bytes_written = dhd_dev_pno_enable(net, pfn_enabled);
+		break;
+#endif
+
+	case ANDROID_WIFI_CMD_P2P_DEV_ADDR:
+		bytes_written = rtw_android_get_p2p_dev_addr(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_P2P_SET_NOA:
+		//int skip = strlen(CMD_P2P_SET_NOA) + 1;
+		//bytes_written = wl_cfg80211_set_p2p_noa(net, command + skip, priv_cmd.total_len - skip);
+		break;
+	case ANDROID_WIFI_CMD_P2P_GET_NOA:
+		//bytes_written = wl_cfg80211_get_p2p_noa(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_P2P_SET_PS:
+		//int skip = strlen(CMD_P2P_SET_PS) + 1;
+		//bytes_written = wl_cfg80211_set_p2p_ps(net, command + skip, priv_cmd.total_len - skip);
+		break;
+		
+#ifdef CONFIG_IOCTL_CFG80211
+	case ANDROID_WIFI_CMD_SET_AP_WPS_P2P_IE:
+	{
+		int skip = strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_SET_AP_WPS_P2P_IE]) + 3;
+		bytes_written = rtw_cfg80211_set_mgnt_wpsp2pie(net, command + skip, priv_cmd.total_len - skip, *(command + skip - 2) - '0');
+		break;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+
+#ifdef CONFIG_WFD
+	case ANDROID_WIFI_CMD_WFD_ENABLE:
+	{
+		//	Commented by Albert 2012/07/24
+		//	We can enable the WFD function by using the following command:
+		//	wpa_cli driver wfd-enable
+		
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+	
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+			pwfd_info->wfd_enable = _TRUE;
+		break;
+	}
+
+	case ANDROID_WIFI_CMD_WFD_DISABLE:
+	{
+		//	Commented by Albert 2012/07/24
+		//	We can disable the WFD function by using the following command:
+		//	wpa_cli driver wfd-disable
+				
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+	
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+			pwfd_info->wfd_enable = _FALSE;
+		break;
+	}
+	case ANDROID_WIFI_CMD_WFD_SET_TCPPORT:
+	{
+		//	Commented by Albert 2012/07/24
+		//	We can set the tcp port number by using the following command:
+		//	wpa_cli driver wfd-set-tcpport = 554
+		
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+	
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+			pwfd_info->rtsp_ctrlport = ( u16 ) get_int_from_command( priv_cmd.buf );
+		break;
+	}
+	case ANDROID_WIFI_CMD_WFD_SET_MAX_TPUT:
+	{
+		
+		
+		break;
+	}
+	case ANDROID_WIFI_CMD_WFD_SET_DEVTYPE:
+	{
+		//	Commented by Albert 2012/08/28
+		//	Specify the WFD device type ( WFD source/primary sink )
+		
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+	
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+		{
+			pwfd_info->wfd_device_type = ( u8 ) get_int_from_command( priv_cmd.buf );
+
+			pwfd_info->wfd_device_type &= WFD_DEVINFO_DUAL;
+		}
+		break;
+	}
+#endif
+	default:
+		DBG_871X("Unknown PRIVATE command %s - ignored\n", command);
+		snprintf(command, 3, "OK");
+		bytes_written = strlen("OK");
+	}
+
+response:
+	if (bytes_written >= 0) {
+		if ((bytes_written == 0) && (priv_cmd.total_len > 0))
+			command[0] = '\0';
+		if (bytes_written >= priv_cmd.total_len) {
+			DBG_871X("%s: bytes_written = %d\n", __FUNCTION__, bytes_written);
+			bytes_written = priv_cmd.total_len;
+		} else {
+			bytes_written++;
+		}
+		priv_cmd.used_len = bytes_written;
+		if (copy_to_user((void *)priv_cmd.buf, command, bytes_written)) {
+			DBG_871X("%s: failed to copy data to user buffer\n", __FUNCTION__);
+			ret = -EFAULT;
+		}
+	}
+	else {
+		ret = bytes_written;
+	}
+
+exit:
+	rtw_unlock_suspend();
+	if (command) {
+		rtw_mfree(command, priv_cmd.total_len);
+	}
+
+	return ret;
+}
+
+
+/**
+ * Functions for Android WiFi card detection
+ */
+#if defined(RTW_ENABLE_WIFI_CONTROL_FUNC)
+
+static int g_wifidev_registered = 0;
+static struct semaphore wifi_control_sem;
+static struct wifi_platform_data *wifi_control_data = NULL;
+static struct resource *wifi_irqres = NULL;
+
+static int wifi_add_dev(void);
+static void wifi_del_dev(void);
+
+int rtw_android_wifictrl_func_add(void)
+{
+	int ret = 0;
+	sema_init(&wifi_control_sem, 0);
+
+	ret = wifi_add_dev();
+	if (ret) {
+		DBG_871X("%s: platform_driver_register failed\n", __FUNCTION__);
+		return ret;
+	}
+	g_wifidev_registered = 1;
+
+	/* Waiting callback after platform_driver_register is done or exit with error */
+	if (down_timeout(&wifi_control_sem,  msecs_to_jiffies(1000)) != 0) {
+		ret = -EINVAL;
+		DBG_871X("%s: platform_driver_register timeout\n", __FUNCTION__);
+	}
+
+	return ret;
+}
+
+void rtw_android_wifictrl_func_del(void)
+{
+	if (g_wifidev_registered)
+	{
+		wifi_del_dev();
+		g_wifidev_registered = 0;
+	}
+}
+
+void *wl_android_prealloc(int section, unsigned long size)
+{
+	void *alloc_ptr = NULL;
+	if (wifi_control_data && wifi_control_data->mem_prealloc) {
+		alloc_ptr = wifi_control_data->mem_prealloc(section, size);
+		if (alloc_ptr) {
+			DBG_871X("success alloc section %d\n", section);
+			if (size != 0L)
+				memset(alloc_ptr, 0, size);
+			return alloc_ptr;
+		}
+	}
+
+	DBG_871X("can't alloc section %d\n", section);
+	return NULL;
+}
+
+int wifi_get_irq_number(unsigned long *irq_flags_ptr)
+{
+	if (wifi_irqres) {
+		*irq_flags_ptr = wifi_irqres->flags & IRQF_TRIGGER_MASK;
+		return (int)wifi_irqres->start;
+	}
+#ifdef CUSTOM_OOB_GPIO_NUM
+	return CUSTOM_OOB_GPIO_NUM;
+#else
+	return -1;
+#endif
+}
+
+int wifi_set_power(int on, unsigned long msec)
+{
+	DBG_871X("%s = %d\n", __FUNCTION__, on);
+	if (wifi_control_data && wifi_control_data->set_power) {
+		wifi_control_data->set_power(on);
+	}
+	if (msec)
+		msleep(msec);
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+int wifi_get_mac_addr(unsigned char *buf)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	if (!buf)
+		return -EINVAL;
+	if (wifi_control_data && wifi_control_data->get_mac_addr) {
+		return wifi_control_data->get_mac_addr(buf);
+	}
+	return -EOPNOTSUPP;
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) || defined(COMPAT_KERNEL_RELEASE)
+void *wifi_get_country_code(char *ccode)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	if (!ccode)
+		return NULL;
+	if (wifi_control_data && wifi_control_data->get_country_code) {
+		return wifi_control_data->get_country_code(ccode);
+	}
+	return NULL;
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+
+static int wifi_set_carddetect(int on)
+{
+	DBG_871X("%s = %d\n", __FUNCTION__, on);
+	if (wifi_control_data && wifi_control_data->set_carddetect) {
+		wifi_control_data->set_carddetect(on);
+	}
+	return 0;
+}
+
+static int wifi_probe(struct platform_device *pdev)
+{
+	struct wifi_platform_data *wifi_ctrl =
+		(struct wifi_platform_data *)(pdev->dev.platform_data);
+
+	DBG_871X("## %s\n", __FUNCTION__);
+	wifi_irqres = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcmdhd_wlan_irq");
+	if (wifi_irqres == NULL)
+		wifi_irqres = platform_get_resource_byname(pdev,
+			IORESOURCE_IRQ, "bcm4329_wlan_irq");
+	wifi_control_data = wifi_ctrl;
+
+	wifi_set_power(1, 0);	/* Power On */
+	wifi_set_carddetect(1);	/* CardDetect (0->1) */
+
+	up(&wifi_control_sem);
+	return 0;
+}
+
+static int wifi_remove(struct platform_device *pdev)
+{
+	struct wifi_platform_data *wifi_ctrl =
+		(struct wifi_platform_data *)(pdev->dev.platform_data);
+
+	DBG_871X("## %s\n", __FUNCTION__);
+	wifi_control_data = wifi_ctrl;
+
+	wifi_set_power(0, 0);	/* Power Off */
+	wifi_set_carddetect(0);	/* CardDetect (1->0) */
+
+	up(&wifi_control_sem);
+	return 0;
+}
+
+static int wifi_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	DBG_871X("##> %s\n", __FUNCTION__);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY)
+	bcmsdh_oob_intr_set(0);
+#endif
+	return 0;
+}
+
+static int wifi_resume(struct platform_device *pdev)
+{
+	DBG_871X("##> %s\n", __FUNCTION__);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY)
+	if (dhd_os_check_if_up(bcmsdh_get_drvdata()))
+		bcmsdh_oob_intr_set(1);
+#endif
+	return 0;
+}
+
+/* temporarily use these two */
+static struct platform_driver wifi_device = {
+	.probe          = wifi_probe,
+	.remove         = wifi_remove,
+	.suspend        = wifi_suspend,
+	.resume         = wifi_resume,
+	.driver         = {
+	.name   = "bcmdhd_wlan",
+	}
+};
+
+static struct platform_driver wifi_device_legacy = {
+	.probe          = wifi_probe,
+	.remove         = wifi_remove,
+	.suspend        = wifi_suspend,
+	.resume         = wifi_resume,
+	.driver         = {
+	.name   = "bcm4329_wlan",
+	}
+};
+
+static int wifi_add_dev(void)
+{
+	DBG_871X("## Calling platform_driver_register\n");
+	platform_driver_register(&wifi_device);
+	platform_driver_register(&wifi_device_legacy);
+	return 0;
+}
+
+static void wifi_del_dev(void)
+{
+	DBG_871X("## Unregister platform_driver_register\n");
+	platform_driver_unregister(&wifi_device);
+	platform_driver_unregister(&wifi_device_legacy);
+}
+#endif /* defined(RTW_ENABLE_WIFI_CONTROL_FUNC) */
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c
new file mode 100755
index 0000000000000..de044435d5eca
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c
@@ -0,0 +1,1662 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_INTF_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <hal_intf.h>
+#include <rtw_version.h>
+
+#ifndef CONFIG_USB_HCI
+
+#error "CONFIG_USB_HCI shall be on!\n"
+
+#endif
+
+#include <usb_vendor_req.h>
+#include <usb_ops.h>
+#include <usb_osintf.h>
+#include <usb_hal.h>
+#ifdef CONFIG_PLATFORM_RTK_DMP
+#include <asm/io.h>
+#endif
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#ifdef CONFIG_80211N_HT
+extern int rtw_ht_enable;
+extern int rtw_cbw40_enable;
+extern int rtw_ampdu_enable;//for enable tx_ampdu
+#endif
+
+#ifdef CONFIG_GLOBAL_UI_PID
+int ui_pid[3] = {0, 0, 0};
+#endif
+
+
+extern int pm_netdev_open(struct net_device *pnetdev,u8 bnormal);
+static int rtw_suspend(struct usb_interface *intf, pm_message_t message);
+static int rtw_resume(struct usb_interface *intf);
+int rtw_resume_process(_adapter *padapter);
+
+
+static int rtw_drv_init(struct usb_interface *pusb_intf,const struct usb_device_id *pdid);
+static void rtw_dev_remove(struct usb_interface *pusb_intf);
+
+#define USB_VENDER_ID_REALTEK		0x0BDA
+
+/* DID_USB_v915_20121224 */
+#define RTL8192C_USB_IDS \
+	/*=== Realtek demoboard ===*/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8191)},/* Default ID */ \
+	/****** 8188CUS ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8176)},/* 8188cu 1*1 dongole */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8170)},/* 8188CE-VAU USB minCard */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817E)},/* 8188CE-VAU USB minCard */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817A)},/* 8188cu Slim Solo */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817B)},/* 8188cu Slim Combo */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817D)},/* 8188RU High-power USB Dongle */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754)},/* 8188 Combo for BC4 */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817F)},/* 8188RU */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x818A)},/* RTL8188CUS-VL */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x018A)},/* RTL8188CTV */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x17C0)}, /* RTK demoboard - USB-N10E */ \
+	/****** 8192CUS ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8177)},/* 8191cu 1*2 */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8178)},/* 8192cu 2*2 */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817C)},/* 8192CE-VAU USB minCard */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8191)},/* 8192CU 2*2 */ \
+	{USB_DEVICE(0x1058, 0x0631)},/* Alpha, 8192CU */ \
+	/*=== Customer ID ===*/	 \
+	/****** 8188CUS Dongle ********/ \
+	{USB_DEVICE(0x2019, 0xED17)},/* PCI - Edimax */ \
+	{USB_DEVICE(0x0DF6, 0x0052)},/* Sitecom - Edimax */ \
+	{USB_DEVICE(0x7392, 0x7811)},/* Edimax - Edimax */ \
+	{USB_DEVICE(0x07B8, 0x8188)},/* Abocom - Abocom */ \
+	{USB_DEVICE(0x07B8, 0x8189)},/* Abocom - Abocom */ \
+	{USB_DEVICE(0x0EB0, 0x9071)},/* NO Brand - Etop */ \
+	{USB_DEVICE(0x06F8, 0xE033)},/* Hercules - Edimax */ \
+	{USB_DEVICE(0x103C, 0x1629)},/* HP - Lite-On ,8188CUS Slim Combo */ \
+	{USB_DEVICE(0x2001, 0x3308)},/* D-Link - Alpha */ \
+	{USB_DEVICE(0x050D, 0x1102)},/* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x11F2)},/* ISY - Edimax */ \
+	{USB_DEVICE(0x2019, 0xAB2A)},/* Planex - Abocom */ \
+	{USB_DEVICE(0x20F4, 0x648B)},/* TRENDnet - Cameo */ \
+	{USB_DEVICE(0x4855, 0x0090)},/*  - Feixun */ \
+	{USB_DEVICE(0x13D3, 0x3357)},/*  - AzureWave */ \
+	{USB_DEVICE(0x0DF6, 0x005C)},/* Sitecom - Edimax */ \
+	{USB_DEVICE(0x0BDA, 0x5088)},/* Thinkware - CC&C */ \
+	{USB_DEVICE(0x4856, 0x0091)},/* NetweeN - Feixun */ \
+	{USB_DEVICE(0x0846, 0x9041)}, /* Netgear - Cameo */ \
+	{USB_DEVICE(0x0846, 0x9042)}, /* On Networks - N150MA */ \
+	{USB_DEVICE(0x0846, 0x9043)}, /* Netgear N150 -WNA1000M */ \
+	{USB_DEVICE(0x2019, 0x4902)},/* Planex - Etop */ \
+	{USB_DEVICE(0x2019, 0xAB2E)},/* SW-WF02-AD15 -Abocom */ \
+	{USB_DEVICE(0x2001, 0x330B)}, /* D-LINK - T&W */ \
+	{USB_DEVICE(0xCDAB, 0x8010)}, /* - - compare */ \
+	{USB_DEVICE(0x0B05, 0x17BA)}, /* ASUS - Edimax */ \
+	{USB_DEVICE(0x0BDA, 0x1E1E)}, /* Intel - - */ \
+	{USB_DEVICE(0x04BB, 0x094c)}, /* I-O DATA - Edimax */ \
+	/****** 8188CTV ********/ \
+	{USB_DEVICE(0xCDAB, 0x8011)}, /* - - compare */ \
+	{USB_DEVICE(0x0BDA, 0x0A8A)}, /* Sony - Foxconn */ \
+	/****** 8188 RU ********/ \
+	{USB_DEVICE(0x0BDA, 0x317F)},/* Netcore,Netcore */ \
+	/****** 8188CE-VAU ********/ \
+	{USB_DEVICE(0x13D3, 0x3359)},/*  - Azwave */ \
+	{USB_DEVICE(0x13D3, 0x3358)},/*  - Azwave */ \
+	/****** 8188CUS Slim Solo********/ \
+	{USB_DEVICE(0x04F2, 0xAFF7)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFF9)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFFA)},/* XAVI - XAVI */ \
+	/****** 8188CUS Slim Combo ********/ \
+	{USB_DEVICE(0x04F2, 0xAFF8)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFFB)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFFC)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x2019, 0x1201)},/* Planex - Vencer */ \
+	/****** 8192CUS Dongle ********/ \
+	{USB_DEVICE(0x2001, 0x3307)},/* D-Link - Cameo */ \
+	{USB_DEVICE(0x2001, 0x330A)},/* D-Link - Alpha */ \
+	{USB_DEVICE(0x2001, 0x3309)},/* D-Link - Alpha */ \
+	{USB_DEVICE(0x2001, 0x330D)},/* D-Link DWA-131 (H/W Ver. B1) */ \
+	{USB_DEVICE(0x0586, 0x341F)},/* Zyxel - Abocom */ \
+	{USB_DEVICE(0x7392, 0x7822)},/* Edimax - Edimax */ \
+	{USB_DEVICE(0x2019, 0xAB2B)},/* Planex - Abocom */ \
+	{USB_DEVICE(0x07B8, 0x8178)},/* Abocom - Abocom */ \
+	{USB_DEVICE(0x07AA, 0x0056)},/* ATKK - Gemtek */ \
+	{USB_DEVICE(0x4855, 0x0091)},/*  - Feixun */ \
+	{USB_DEVICE(0x050D, 0x2102)},/* Belkin - Sercomm */ \
+	{USB_DEVICE(0x050D, 0x2103)},/* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x21F2)},/* Belkin - Edimax */ \
+	{USB_DEVICE(0x20F4, 0x624D)},/* TRENDnet */ \
+	{USB_DEVICE(0x0DF6, 0x0061)},/* Sitecom - Edimax */ \
+	{USB_DEVICE(0x0B05, 0x17AB)},/* ASUS - Edimax */ \
+	{USB_DEVICE(0x0846, 0x9021)},/* Netgear - Sercomm */ \
+	{USB_DEVICE(0x0846, 0xF001)}, /* Netgear - Sercomm */ \
+	{USB_DEVICE(0x0E66, 0x0019)},/* Hawking,Edimax */ \
+	{USB_DEVICE(0x0E66, 0x0020)}, /* Hawking  - Edimax */ \
+	{USB_DEVICE(0x050D, 0x1004)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x0BDA, 0x2E2E)}, /* Intel - - */ \
+	{USB_DEVICE(0x2357, 0x0100)}, /* TP-Link - TP-Link */ \
+	{USB_DEVICE(0x06F8, 0xE035)}, /* Hercules - Edimax */ \
+	{USB_DEVICE(0x04BB, 0x0950)}, /* IO-DATA - Edimax */ \
+	{USB_DEVICE(0x0DF6, 0x0070)}, /* Sitecom - Edimax */ \
+	{USB_DEVICE(0x0789, 0x016D)}, /* LOGITEC - Edimax */ \
+	/****** 8192CE-VAU  ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8186)},/* Intel-Xavi( Azwave) */
+
+#define RTL8192D_USB_IDS \
+	/*=== Realtek demoboard ===*/ \
+	/****** 8192DU ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8193)},/* 8192DU-VC */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8194)},/* 8192DU-VS */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8111)},/* Realtek 5G dongle for WiFi Display */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0193)},/* 8192DE-VAU */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8171)},/* 8192DU-VC */ \
+	/*=== Customer ID ===*/ \
+	/****** 8192DU-VC ********/ \
+	{USB_DEVICE(0x2019, 0xAB2C)},/* PCI - Abocm */ \
+	{USB_DEVICE(0x2019, 0x4903)},/* PCI - ETOP */ \
+	{USB_DEVICE(0x2019, 0x4904)},/* PCI - ETOP */ \
+	{USB_DEVICE(0x07B8, 0x8193)},/* Abocom - Abocom */ \
+	/****** 8192DU-VS ********/ \
+	{USB_DEVICE(0x20F4, 0x664B)}, /* TRENDnet - Cameo */ \
+	{USB_DEVICE(0x04DD, 0x954F)},  /* Sharp */ \
+	{USB_DEVICE(0x04DD, 0x96A6)},  /* Sharp */ \
+	{USB_DEVICE(0x050D, 0x110A)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x1105)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x120A)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x1668, 0x8102)}, /*  -  */ \
+	{USB_DEVICE(0x0BDA, 0xE194)}, /*  - Edimax */ \
+	/****** 8192DU-WiFi Display Dongle ********/ \
+	{USB_DEVICE(0x2019, 0xAB2D)},/* Planex - Abocom ,5G dongle for WiFi Display */
+
+#ifndef CONFIG_RTL8192C
+	#undef RTL8192C_USB_IDS
+	#define RTL8192C_USB_IDS
+#endif
+#ifndef CONFIG_RTL8192D
+	#undef RTL8192D_USB_IDS
+	#define RTL8192D_USB_IDS
+#endif
+
+
+static struct usb_device_id rtw_usb_id_tbl[] ={
+	RTL8192C_USB_IDS
+	RTL8192D_USB_IDS
+	{}	/* Terminating entry */
+};
+MODULE_DEVICE_TABLE(usb, rtw_usb_id_tbl);
+
+int const rtw_usb_id_len = sizeof(rtw_usb_id_tbl) / sizeof(struct usb_device_id);
+
+static struct specific_device_id specific_device_id_tbl[] = {
+	{.idVendor=USB_VENDER_ID_REALTEK, .idProduct=0x8177, .flags=SPEC_DEV_ID_DISABLE_HT},//8188cu 1*1 dongole, (b/g mode only)
+	{.idVendor=USB_VENDER_ID_REALTEK, .idProduct=0x817E, .flags=SPEC_DEV_ID_DISABLE_HT},//8188CE-VAU USB minCard (b/g mode only)
+	{.idVendor=0x0b05, .idProduct=0x1791, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor=0x13D3, .idProduct=0x3311, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor=0x13D3, .idProduct=0x3359, .flags=SPEC_DEV_ID_DISABLE_HT},//Russian customer -Azwave (8188CE-VAU  g mode)
+#ifdef RTK_DMP_PLATFORM
+	{.idVendor=USB_VENDER_ID_REALTEK, .idProduct=0x8111, .flags=SPEC_DEV_ID_ASSIGN_IFNAME}, // Realtek 5G dongle for WiFi Display
+	{.idVendor=0x2019, .idProduct=0xAB2D, .flags=SPEC_DEV_ID_ASSIGN_IFNAME}, // PCI-Abocom 5G dongle for WiFi Display
+#endif /* RTK_DMP_PLATFORM */
+	{}
+};
+
+struct rtw_usb_drv {
+	struct usb_driver usbdrv;
+	int drv_registered;
+};
+
+static void rtw_dev_shutdown(struct device *dev)
+{
+	struct usb_interface *usb_intf = container_of(dev, struct usb_interface, dev);
+	struct dvobj_priv *dvobj = usb_get_intfdata(usb_intf);
+	_adapter *adapter = dvobj->if1;
+	int i;
+
+	DBG_871X("%s\n", __func__);
+
+	for (i = 0; i<dvobj->iface_nums; i++) {
+		adapter = dvobj->padapters[i];
+		adapter->bSurpriseRemoved = _TRUE;
+	}
+
+	ATOMIC_SET(&dvobj->continual_urb_error, MAX_CONTINUAL_URB_ERR+1);
+}
+
+#ifdef CONFIG_RTL8192C
+static struct usb_device_id rtl8192c_usb_id_tbl[] ={
+	RTL8192C_USB_IDS
+	{}	/* Terminating entry */
+};
+
+struct rtw_usb_drv rtl8192c_usb_drv = {
+	.usbdrv.name = (char*)"rtl8192cu",
+	.usbdrv.probe = rtw_drv_init,
+	.usbdrv.disconnect = rtw_dev_remove,
+	.usbdrv.id_table = rtl8192c_usb_id_tbl,
+	.usbdrv.suspend =  rtw_suspend,
+	.usbdrv.resume = rtw_resume,
+	#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 22))
+  	.usbdrv.reset_resume   = rtw_resume,
+	#endif
+	#ifdef CONFIG_AUTOSUSPEND
+	.usbdrv.supports_autosuspend = 1,
+	#endif
+
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+	.usbdrv.drvwrap.driver.shutdown = rtw_dev_shutdown,
+	#else
+	.usbdrv.driver.shutdown = rtw_dev_shutdown,
+	#endif
+};
+
+static struct rtw_usb_drv *usb_drv = &rtl8192c_usb_drv;
+#endif /* CONFIG_RTL8192C */
+
+#ifdef CONFIG_RTL8192D
+static struct usb_device_id rtl8192d_usb_id_tbl[] ={
+	RTL8192D_USB_IDS
+	{}	/* Terminating entry */
+};
+
+struct rtw_usb_drv rtl8192d_usb_drv = {
+	.usbdrv.name = (char*)"rtl8192du",
+	.usbdrv.probe = rtw_drv_init,
+	.usbdrv.disconnect = rtw_dev_remove,
+	.usbdrv.id_table = rtl8192d_usb_id_tbl,
+	.usbdrv.suspend =  rtw_suspend,
+	.usbdrv.resume = rtw_resume,
+	#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 22))
+  	.usbdrv.reset_resume   = rtw_resume,
+	#endif
+	#ifdef CONFIG_AUTOSUSPEND
+	.usbdrv.supports_autosuspend = 1,
+	#endif
+
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+	.usbdrv.drvwrap.driver.shutdown = rtw_dev_shutdown,
+	#else
+	.usbdrv.driver.shutdown = rtw_dev_shutdown,
+	#endif
+};
+static struct rtw_usb_drv *usb_drv = &rtl8192d_usb_drv;
+#endif /* CONFIG_RTL8192D */
+
+static inline int RT_usb_endpoint_dir_in(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN);
+}
+
+static inline int RT_usb_endpoint_dir_out(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT);
+}
+
+static inline int RT_usb_endpoint_xfer_int(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_INT);
+}
+
+static inline int RT_usb_endpoint_xfer_bulk(const struct usb_endpoint_descriptor *epd)
+{
+ 	return ((epd->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_BULK);
+}
+
+static inline int RT_usb_endpoint_is_bulk_in(const struct usb_endpoint_descriptor *epd)
+{
+	return (RT_usb_endpoint_xfer_bulk(epd) && RT_usb_endpoint_dir_in(epd));
+}
+
+static inline int RT_usb_endpoint_is_bulk_out(const struct usb_endpoint_descriptor *epd)
+{
+	return (RT_usb_endpoint_xfer_bulk(epd) && RT_usb_endpoint_dir_out(epd));
+}
+
+static inline int RT_usb_endpoint_is_int_in(const struct usb_endpoint_descriptor *epd)
+{
+	return (RT_usb_endpoint_xfer_int(epd) && RT_usb_endpoint_dir_in(epd));
+}
+
+static inline int RT_usb_endpoint_num(const struct usb_endpoint_descriptor *epd)
+{
+	return epd->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+}
+
+static u8 rtw_init_intf_priv(struct dvobj_priv *dvobj)
+{
+	u8 rst = _SUCCESS;
+
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_rtw_mutex_init(&dvobj->usb_vendor_req_mutex);
+	#endif
+
+
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	dvobj->usb_alloc_vendor_req_buf = rtw_zmalloc(MAX_USB_IO_CTL_SIZE);
+	if (dvobj->usb_alloc_vendor_req_buf == NULL) {
+		DBG_871X("alloc usb_vendor_req_buf failed... /n");
+		rst = _FAIL;
+		goto exit;
+	}
+	dvobj->usb_vendor_req_buf  =
+		(u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(dvobj->usb_alloc_vendor_req_buf ), ALIGNMENT_UNIT);
+exit:
+	#endif
+
+	return rst;
+
+}
+
+static u8 rtw_deinit_intf_priv(struct dvobj_priv *dvobj)
+{
+	u8 rst = _SUCCESS;
+
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	if(dvobj->usb_vendor_req_buf)
+		rtw_mfree(dvobj->usb_alloc_vendor_req_buf, MAX_USB_IO_CTL_SIZE);
+	#endif
+
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_rtw_mutex_free(&dvobj->usb_vendor_req_mutex);
+	#endif
+
+	return rst;
+}
+
+static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf)
+{
+	int	i;
+	u8	val8;
+	int	status = _FAIL;
+	struct dvobj_priv *pdvobjpriv = NULL;
+	struct usb_device				*pusbd;
+	struct usb_device_descriptor 	*pdev_desc;
+	struct usb_host_config			*phost_conf;
+	struct usb_config_descriptor		*pconf_desc;
+	struct usb_host_interface		*phost_iface;
+	struct usb_interface_descriptor	*piface_desc;
+	struct usb_host_endpoint		*phost_endp;
+	struct usb_endpoint_descriptor	*pendp_desc;
+
+_func_enter_;
+
+	if((pdvobjpriv = devobj_init()) == NULL) {
+		goto exit;
+	}
+
+	pdvobjpriv->pusbintf = usb_intf ;
+	pusbd = pdvobjpriv->pusbdev = interface_to_usbdev(usb_intf);
+	usb_set_intfdata(usb_intf, pdvobjpriv);
+
+	pdvobjpriv->RtNumInPipes = 0;
+	pdvobjpriv->RtNumOutPipes = 0;
+
+
+	pdev_desc = &pusbd->descriptor;
+#if 0
+	DBG_871X("\n8712_usb_device_descriptor:\n");
+	DBG_871X("bLength=%x\n", pdev_desc->bLength);
+	DBG_871X("bDescriptorType=%x\n", pdev_desc->bDescriptorType);
+	DBG_871X("bcdUSB=%x\n", pdev_desc->bcdUSB);
+	DBG_871X("bDeviceClass=%x\n", pdev_desc->bDeviceClass);
+	DBG_871X("bDeviceSubClass=%x\n", pdev_desc->bDeviceSubClass);
+	DBG_871X("bDeviceProtocol=%x\n", pdev_desc->bDeviceProtocol);
+	DBG_871X("bMaxPacketSize0=%x\n", pdev_desc->bMaxPacketSize0);
+	DBG_871X("idVendor=%x\n", pdev_desc->idVendor);
+	DBG_871X("idProduct=%x\n", pdev_desc->idProduct);
+	DBG_871X("bcdDevice=%x\n", pdev_desc->bcdDevice);
+	DBG_871X("iManufacturer=%x\n", pdev_desc->iManufacturer);
+	DBG_871X("iProduct=%x\n", pdev_desc->iProduct);
+	DBG_871X("iSerialNumber=%x\n", pdev_desc->iSerialNumber);
+	DBG_871X("bNumConfigurations=%x\n", pdev_desc->bNumConfigurations);
+#endif
+
+	phost_conf = pusbd->actconfig;
+	pconf_desc = &phost_conf->desc;
+
+#if 0
+	DBG_871X("\n8712_usb_configuration_descriptor:\n");
+	DBG_871X("bLength=%x\n", pconf_desc->bLength);
+	DBG_871X("bDescriptorType=%x\n", pconf_desc->bDescriptorType);
+	DBG_871X("wTotalLength=%x\n", pconf_desc->wTotalLength);
+	DBG_871X("bNumInterfaces=%x\n", pconf_desc->bNumInterfaces);
+	DBG_871X("bConfigurationValue=%x\n", pconf_desc->bConfigurationValue);
+	DBG_871X("iConfiguration=%x\n", pconf_desc->iConfiguration);
+	DBG_871X("bmAttributes=%x\n", pconf_desc->bmAttributes);
+	DBG_871X("bMaxPower=%x\n", pconf_desc->bMaxPower);
+#endif
+
+	//DBG_871X("\n/****** num of altsetting = (%d) ******/\n", usb_intf->num_altsetting);
+
+	phost_iface = &usb_intf->altsetting[0];
+	piface_desc = &phost_iface->desc;
+
+#if 0
+	DBG_871X("\n8712_usb_interface_descriptor:\n");
+	DBG_871X("bLength=%x\n", piface_desc->bLength);
+	DBG_871X("bDescriptorType=%x\n", piface_desc->bDescriptorType);
+	DBG_871X("bInterfaceNumber=%x\n", piface_desc->bInterfaceNumber);
+	DBG_871X("bAlternateSetting=%x\n", piface_desc->bAlternateSetting);
+	DBG_871X("bNumEndpoints=%x\n", piface_desc->bNumEndpoints);
+	DBG_871X("bInterfaceClass=%x\n", piface_desc->bInterfaceClass);
+	DBG_871X("bInterfaceSubClass=%x\n", piface_desc->bInterfaceSubClass);
+	DBG_871X("bInterfaceProtocol=%x\n", piface_desc->bInterfaceProtocol);
+	DBG_871X("iInterface=%x\n", piface_desc->iInterface);
+#endif
+
+	pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces;
+	pdvobjpriv->InterfaceNumber = piface_desc->bInterfaceNumber;
+	pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints;
+
+	//DBG_871X("\ndump usb_endpoint_descriptor:\n");
+
+	for (i = 0; i < pdvobjpriv->nr_endpoint; i++)
+	{
+		phost_endp = phost_iface->endpoint + i;
+		if (phost_endp)
+		{
+			pendp_desc = &phost_endp->desc;
+
+			DBG_871X("\nusb_endpoint_descriptor(%d):\n", i);
+			DBG_871X("bLength=%x\n",pendp_desc->bLength);
+			DBG_871X("bDescriptorType=%x\n",pendp_desc->bDescriptorType);
+			DBG_871X("bEndpointAddress=%x\n",pendp_desc->bEndpointAddress);
+			//DBG_871X("bmAttributes=%x\n",pendp_desc->bmAttributes);
+			//DBG_871X("wMaxPacketSize=%x\n",pendp_desc->wMaxPacketSize);
+			DBG_871X("wMaxPacketSize=%x\n",le16_to_cpu(pendp_desc->wMaxPacketSize));
+			DBG_871X("bInterval=%x\n",pendp_desc->bInterval);
+			//DBG_871X("bRefresh=%x\n",pendp_desc->bRefresh);
+			//DBG_871X("bSynchAddress=%x\n",pendp_desc->bSynchAddress);
+
+			if (RT_usb_endpoint_is_bulk_in(pendp_desc))
+			{
+				DBG_871X("RT_usb_endpoint_is_bulk_in = %x\n", RT_usb_endpoint_num(pendp_desc));
+				pdvobjpriv->RtNumInPipes++;
+			}
+			else if (RT_usb_endpoint_is_int_in(pendp_desc))
+			{
+				DBG_871X("RT_usb_endpoint_is_int_in = %x, Interval = %x\n", RT_usb_endpoint_num(pendp_desc),pendp_desc->bInterval);
+				pdvobjpriv->RtNumInPipes++;
+			}
+			else if (RT_usb_endpoint_is_bulk_out(pendp_desc))
+			{
+				DBG_871X("RT_usb_endpoint_is_bulk_out = %x\n", RT_usb_endpoint_num(pendp_desc));
+				pdvobjpriv->RtNumOutPipes++;
+			}
+			pdvobjpriv->ep_num[i] = RT_usb_endpoint_num(pendp_desc);
+		}
+	}
+
+	DBG_871X("nr_endpoint=%d, in_num=%d, out_num=%d\n\n", pdvobjpriv->nr_endpoint, pdvobjpriv->RtNumInPipes, pdvobjpriv->RtNumOutPipes);
+
+	if (pusbd->speed == USB_SPEED_HIGH) {
+		pdvobjpriv->ishighspeed = _TRUE;
+		DBG_871X("USB_SPEED_HIGH\n");
+	} else {
+		pdvobjpriv->ishighspeed = _FALSE;
+		DBG_871X("NON USB_SPEED_HIGH\n");
+	}
+
+	if (rtw_init_intf_priv(pdvobjpriv) == _FAIL) {
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't INIT rtw_init_intf_priv\n"));
+		goto free_dvobj;
+	}
+
+	//.3 misc
+	_rtw_init_sema(&(pdvobjpriv->usb_suspend_sema), 0);
+
+	rtw_reset_continual_urb_error(pdvobjpriv);
+
+	usb_get_dev(pusbd);
+
+	//DBG_871X("%s %d\n", __func__, ATOMIC_READ(&usb_intf->dev.kobj.kref.refcount));
+
+	status = _SUCCESS;
+
+free_dvobj:
+	if (status != _SUCCESS && pdvobjpriv) {
+		usb_set_intfdata(usb_intf, NULL);
+		devobj_deinit(pdvobjpriv);
+		pdvobjpriv = NULL;
+	}
+exit:
+_func_exit_;
+	return pdvobjpriv;
+}
+
+static void usb_dvobj_deinit(struct usb_interface *usb_intf)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(usb_intf);
+
+_func_enter_;
+
+	usb_set_intfdata(usb_intf, NULL);
+	if (dvobj) {
+		//Modify condition for 92DU DMDP 2010.11.18, by Thomas
+		/*if ((dvobj->NumInterfaces == 1)
+			|| ((dvobj->InterfaceNumber == 1) && (dvobj->DualMacMode == _TRUE))) {
+			if (interface_to_usbdev(usb_intf)->state != USB_STATE_NOTATTACHED) {
+				//If we didn't unplug usb dongle and remove/insert modlue, driver fails on sitesurvey for the first time when device is up .
+				//Reset usb port for sitesurvey fail issue. 2009.8.13, by Thomas
+				DBG_871X("usb attached..., try to reset usb device\n");
+				usb_reset_device(interface_to_usbdev(usb_intf));
+			}
+		}*/
+		rtw_deinit_intf_priv(dvobj);
+		devobj_deinit(dvobj);
+	}
+
+	//DBG_871X("%s %d\n", __func__, ATOMIC_READ(&usb_intf->dev.kobj.kref.refcount));
+	usb_put_dev(interface_to_usbdev(usb_intf));
+
+_func_exit_;
+}
+
+static void decide_chip_type_by_usb_device_id(_adapter *padapter, const struct usb_device_id *pdid)
+{
+	padapter->chip_type = NULL_CHIP_TYPE;
+#ifdef CONFIG_RTL8192C
+	padapter->chip_type = RTL8188C_8192C;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192CU;
+	DBG_871X("CHIP TYPE: RTL8188C_8192C\n");
+#endif
+
+#ifdef CONFIG_RTL8192D
+	padapter->chip_type = RTL8192D;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192DU;
+	DBG_871X("CHIP TYPE: RTL8192D\n");
+#endif
+}
+
+static void usb_intf_start(_adapter *padapter)
+{
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+usb_intf_start\n"));
+	rtw_hal_inirp_init(padapter);
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-usb_intf_start\n"));
+}
+
+static void usb_intf_stop(_adapter *padapter)
+{
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+usb_intf_stop\n"));
+
+	//disabel_hw_interrupt
+	if(padapter->bSurpriseRemoved == _FALSE)
+	{
+		//device still exists, so driver can do i/o operation
+		//TODO:
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("SurpriseRemoved==_FALSE\n"));
+	}
+
+	//cancel in irp
+	rtw_hal_inirp_deinit(padapter);
+
+	//cancel out irp
+	rtw_write_port_cancel(padapter);
+
+	//todo:cancel other irps
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-usb_intf_stop\n"));
+
+}
+
+static void rtw_dev_unload(_adapter *padapter)
+{
+	struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+	u8 val8;
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_dev_unload\n"));
+
+	if(padapter->bup == _TRUE)
+	{
+		DBG_871X("===> rtw_dev_unload\n");
+
+		padapter->bDriverStopped = _TRUE;
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		//s3.
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		//s4.
+		if(!padapter->pwrctrlpriv.bInternalAutoSuspend )
+		rtw_stop_drv_threads(padapter);
+
+
+		//s5.
+		if(padapter->bSurpriseRemoved == _FALSE)
+		{
+			//DBG_871X("r871x_dev_unload()->rtl871x_hal_deinit()\n");
+#ifdef CONFIG_WOWLAN
+			if((padapter->pwrctrlpriv.bSupportRemoteWakeup==_TRUE)&&(padapter->pwrctrlpriv.wowlan_mode==_TRUE)){
+				DBG_871X("%s bSupportWakeOnWlan==_TRUE  do not run rtw_hal_deinit()\n",__FUNCTION__);
+			}
+			else
+#endif //CONFIG_WOWLAN
+			{
+				rtw_hal_deinit(padapter);
+			}
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		padapter->bup = _FALSE;
+#ifdef CONFIG_WOWLAN
+		padapter->hw_init_completed=_FALSE;
+#endif //CONFIG_WOWLAN
+	}
+	else
+	{
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("r871x_dev_unload():padapter->bup == _FALSE\n" ));
+	}
+
+	DBG_871X("<=== rtw_dev_unload\n");
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-rtw_dev_unload\n"));
+
+}
+
+static void process_spec_devid(const struct usb_device_id *pdid)
+{
+	u16 vid, pid;
+	u32 flags;
+	int i;
+	int num = sizeof(specific_device_id_tbl)/sizeof(struct specific_device_id);
+
+	for(i=0; i<num; i++)
+	{
+		vid = specific_device_id_tbl[i].idVendor;
+		pid = specific_device_id_tbl[i].idProduct;
+		flags = specific_device_id_tbl[i].flags;
+
+#ifdef CONFIG_80211N_HT
+		if((pdid->idVendor==vid) && (pdid->idProduct==pid) && (flags&SPEC_DEV_ID_DISABLE_HT))
+		{
+			 rtw_ht_enable = 0;
+			 rtw_cbw40_enable = 0;
+			 rtw_ampdu_enable = 0;
+		}
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+		// Change the ifname to wlan10 when PC side WFD dongle plugin on DMP platform.
+		// It is used to distinguish between normal and PC-side wifi dongle/module.
+		if((pdid->idVendor==vid) && (pdid->idProduct==pid) && (flags&SPEC_DEV_ID_ASSIGN_IFNAME))
+		{
+			extern char* ifname;
+			strncpy(ifname, "wlan10", 6);
+			//DBG_871X("%s()-%d: ifname=%s, vid=%04X, pid=%04X\n", __FUNCTION__, __LINE__, ifname, vid, pid);
+		}
+#endif /* RTK_DMP_PLATFORM */
+
+	}
+}
+
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+int rtw_hw_suspend(_adapter *padapter )
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct usb_interface *pusb_intf = adapter_to_dvobj(padapter)->pusbintf;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	_func_enter_;
+
+	if((!padapter->bup) || (padapter->bDriverStopped)||(padapter->bSurpriseRemoved))
+	{
+		DBG_871X("padapter->bup=%d bDriverStopped=%d bSurpriseRemoved = %d\n",
+			padapter->bup, padapter->bDriverStopped,padapter->bSurpriseRemoved);
+		goto error_exit;
+	}
+
+	if(padapter)//system suspend
+	{
+		LeaveAllPowerSaveMode(padapter);
+
+		DBG_871X("==> rtw_hw_suspend\n");
+		_enter_pwrlock(&pwrpriv->lock);
+		pwrpriv->bips_processing = _TRUE;
+		//padapter->net_closed = _TRUE;
+		//s1.
+		if(pnetdev)
+		{
+			netif_carrier_off(pnetdev);
+			rtw_netif_stop_queue(pnetdev);
+		}
+
+		//s2.
+		rtw_disassoc_cmd(padapter, 500, _FALSE);
+
+		//s2-2.  indicate disconnect to os
+		//rtw_indicate_disconnect(padapter);
+		{
+			struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+			if(check_fwstate(pmlmepriv, _FW_LINKED))
+			{
+				_clr_fwstate_(pmlmepriv, _FW_LINKED);
+
+				rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+				rtw_os_indicate_disconnect(padapter);
+
+				#ifdef CONFIG_LPS
+				//donnot enqueue cmd
+				rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_DISCONNECT, 0);
+				#endif
+			}
+
+		}
+		//s2-3.
+		rtw_free_assoc_resources(padapter, 1);
+
+		//s2-4.
+		rtw_free_network_queue(padapter,_TRUE);
+		#ifdef CONFIG_IPS
+		rtw_ips_dev_unload(padapter);
+		#endif
+		pwrpriv->rf_pwrstate = rf_off;
+		pwrpriv->bips_processing = _FALSE;
+
+		_exit_pwrlock(&pwrpriv->lock);
+	}
+	else
+		goto error_exit;
+
+	_func_exit_;
+	return 0;
+
+error_exit:
+	DBG_871X("%s, failed \n",__FUNCTION__);
+	return (-1);
+
+}
+
+int rtw_hw_resume(_adapter *padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct usb_interface *pusb_intf = adapter_to_dvobj(padapter)->pusbintf;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	_func_enter_;
+
+	if(padapter)//system resume
+	{
+		DBG_871X("==> rtw_hw_resume\n");
+		_enter_pwrlock(&pwrpriv->lock);
+		pwrpriv->bips_processing = _TRUE;
+		rtw_reset_drv_sw(padapter);
+
+		if(pm_netdev_open(pnetdev,_FALSE) != 0)
+		{
+			_exit_pwrlock(&pwrpriv->lock);
+			goto error_exit;
+		}
+
+		netif_device_attach(pnetdev);
+		netif_carrier_on(pnetdev);
+
+		if(!rtw_netif_queue_stopped(pnetdev))
+      			rtw_netif_start_queue(pnetdev);
+		else
+			rtw_netif_wake_queue(pnetdev);
+
+		pwrpriv->bkeepfwalive = _FALSE;
+		pwrpriv->brfoffbyhw = _FALSE;
+
+		pwrpriv->rf_pwrstate = rf_on;
+		pwrpriv->bips_processing = _FALSE;
+
+		_exit_pwrlock(&pwrpriv->lock);
+	}
+	else
+	{
+		goto error_exit;
+	}
+
+	_func_exit_;
+
+	return 0;
+error_exit:
+	DBG_871X("%s, Open net dev failed \n",__FUNCTION__);
+	return (-1);
+}
+#endif
+
+static int rtw_suspend(struct usb_interface *pusb_intf, pm_message_t message)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(pusb_intf);
+	_adapter *padapter = dvobj->if1;
+	struct net_device *pnetdev = padapter->pnetdev;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct usb_device *usb_dev = interface_to_usbdev(pusb_intf);
+#ifdef CONFIG_WOWLAN
+	struct wowlan_ioctl_param poidparam;
+#endif // CONFIG_WOWLAN
+	int ret = 0;
+	u32 start_time = rtw_get_current_time();
+	_func_enter_;
+
+	DBG_871X("==> %s (%s:%d)\n",__FUNCTION__, current->comm, current->pid);
+
+	if((!padapter->bup) || (padapter->bDriverStopped)||(padapter->bSurpriseRemoved))
+	{
+		DBG_871X("padapter->bup=%d bDriverStopped=%d bSurpriseRemoved = %d\n",
+			padapter->bup, padapter->bDriverStopped,padapter->bSurpriseRemoved);
+		goto exit;
+	}
+
+	if(pwrpriv->bInternalAutoSuspend )
+	{
+	#ifdef CONFIG_AUTOSUSPEND
+	#ifdef SUPPORT_HW_RFOFF_DETECTED
+		// The FW command register update must after MAC and FW init ready.
+		if((padapter->bFWReady) && ( padapter->pwrctrlpriv.bHWPwrPindetect ) && (padapter->registrypriv.usbss_enable ))
+		{
+			u8 bOpen = _TRUE;
+			rtw_interface_ps_func(padapter,HAL_USB_SELECT_SUSPEND,&bOpen);
+			//rtl8192c_set_FwSelectSuspend_cmd(padapter,_TRUE ,500);//note fw to support hw power down ping detect
+		}
+	#endif
+	#endif
+	}
+	pwrpriv->bInSuspend = _TRUE;
+	rtw_cancel_all_timer(padapter);
+	LeaveAllPowerSaveMode(padapter);
+
+	rtw_stop_cmd_thread(padapter);
+
+	_enter_pwrlock(&pwrpriv->lock);
+	//padapter->net_closed = _TRUE;
+	//s1.
+	if(pnetdev)
+	{
+		netif_carrier_off(pnetdev);
+		rtw_netif_stop_queue(pnetdev);
+	}
+#ifdef CONFIG_WOWLAN
+	if(padapter->pwrctrlpriv.bSupportRemoteWakeup==_TRUE&&padapter->pwrctrlpriv.wowlan_mode==_TRUE){
+		u8 ps_mode=PS_MODE_MIN;
+		//set H2C command
+		poidparam.subcode=WOWLAN_ENABLE;
+		rtw_hal_set_hwreg(padapter,HW_VAR_WOWLAN,(u8 *)&poidparam);
+		//rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, &ps_mode);
+		//rtw_set_rpwm(padapter, PS_STATE_S2);
+	}
+	else
+#endif //CONFIG_WOWLAN
+	{
+		//s2.
+		rtw_disassoc_cmd(padapter, 0, _FALSE);
+	}
+
+#ifdef CONFIG_LAYER2_ROAMING_RESUME
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) && check_fwstate(pmlmepriv, _FW_LINKED) )
+	{
+		//printk("%s:%d assoc_ssid:%s\n", __FUNCTION__, __LINE__, pmlmepriv->assoc_ssid.Ssid);
+		DBG_871X("%s:%d %s(" MAC_FMT "), length:%d assoc_ssid.length:%d\n",__FUNCTION__, __LINE__,
+				pmlmepriv->cur_network.network.Ssid.Ssid,
+				MAC_ARG(pmlmepriv->cur_network.network.MacAddress),
+				pmlmepriv->cur_network.network.Ssid.SsidLength,
+				pmlmepriv->assoc_ssid.SsidLength);
+		rtw_set_roaming(padapter, 1);
+		}
+#endif
+	//s2-2.  indicate disconnect to os
+	rtw_indicate_disconnect(padapter);
+	//s2-3.
+	rtw_free_assoc_resources(padapter, 1);
+#ifdef CONFIG_AUTOSUSPEND
+	if(!pwrpriv->bInternalAutoSuspend )
+#endif
+	//s2-4.
+	rtw_free_network_queue(padapter, _TRUE);
+
+	rtw_dev_unload(padapter);
+#ifdef CONFIG_AUTOSUSPEND
+	pwrpriv->rf_pwrstate = rf_off;
+	pwrpriv->bips_processing = _FALSE;
+#endif
+	_exit_pwrlock(&pwrpriv->lock);
+
+	if(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
+		rtw_indicate_scan_done(padapter, 1);
+
+	if(check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
+		rtw_indicate_disconnect(padapter);
+
+exit:
+	DBG_871X("<===  %s return %d.............. in %dms\n", __FUNCTION__
+		, ret, rtw_get_passing_time_ms(start_time));
+
+	_func_exit_;
+	return ret;
+}
+
+static int rtw_resume(struct usb_interface *pusb_intf)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(pusb_intf);
+	_adapter *padapter = dvobj->if1;
+	struct net_device *pnetdev = padapter->pnetdev;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	 int ret = 0;
+
+	if(pwrpriv->bInternalAutoSuspend ){
+ 		ret = rtw_resume_process(padapter);
+	} else {
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+		rtw_resume_in_workqueue(pwrpriv);
+#else
+		if (rtw_is_earlysuspend_registered(pwrpriv)
+			#ifdef CONFIG_WOWLAN
+			&& !padapter->pwrctrlpriv.wowlan_mode
+			#endif /* CONFIG_WOWLAN */
+		) {
+			/* jeff: bypass resume here, do in late_resume */
+			rtw_set_do_late_resume(pwrpriv, _TRUE);
+		} else {
+			ret = rtw_resume_process(padapter);
+		}
+#endif /* CONFIG_RESUME_IN_WORKQUEUE */
+	}
+
+	return ret;
+
+}
+
+int rtw_resume_process(_adapter *padapter)
+{
+	struct net_device *pnetdev;
+	struct pwrctrl_priv *pwrpriv=NULL;
+	int ret = -1;
+	u32 start_time = rtw_get_current_time();
+	_func_enter_;
+
+	DBG_871X("==> %s (%s:%d)\n",__FUNCTION__, current->comm, current->pid);
+
+	if(padapter) {
+		pnetdev= padapter->pnetdev;
+		pwrpriv = &padapter->pwrctrlpriv;
+	} else {
+		goto exit;
+	}
+
+	_enter_pwrlock(&pwrpriv->lock);
+	rtw_reset_drv_sw(padapter);
+	pwrpriv->bkeepfwalive = _FALSE;
+
+	DBG_871X("bkeepfwalive(%x)\n",pwrpriv->bkeepfwalive);
+	if(pm_netdev_open(pnetdev,_TRUE) != 0) {
+		_exit_pwrlock(&pwrpriv->lock);
+		goto exit;
+	}
+
+	netif_device_attach(pnetdev);
+	netif_carrier_on(pnetdev);
+
+#ifdef CONFIG_AUTOSUSPEND
+	if(pwrpriv->bInternalAutoSuspend )
+	{
+		#ifdef CONFIG_AUTOSUSPEND
+		#ifdef SUPPORT_HW_RFOFF_DETECTED
+			// The FW command register update must after MAC and FW init ready.
+		if((padapter->bFWReady) && ( padapter->pwrctrlpriv.bHWPwrPindetect ) && (padapter->registrypriv.usbss_enable ))
+		{
+			//rtl8192c_set_FwSelectSuspend_cmd(padapter,_FALSE ,500);//note fw to support hw power down ping detect
+			u8 bOpen = _FALSE;
+			rtw_interface_ps_func(padapter,HAL_USB_SELECT_SUSPEND,&bOpen);
+		}
+		#endif
+		#endif
+
+		pwrpriv->bInternalAutoSuspend = _FALSE;
+		pwrpriv->brfoffbyhw = _FALSE;
+	}
+#endif
+	_exit_pwrlock(&pwrpriv->lock);
+
+	if( padapter->pid[1]!=0) {
+		DBG_871X("pid[1]:%d\n",padapter->pid[1]);
+		rtw_signal_process(padapter->pid[1], SIGUSR2);
+	}
+
+	#ifdef CONFIG_LAYER2_ROAMING_RESUME
+	rtw_roaming(padapter, NULL);
+	#endif
+
+	ret = 0;
+exit:
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	rtw_unlock_suspend();
+	#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+	if (pwrpriv)
+	pwrpriv->bInSuspend = _FALSE;
+	DBG_871X("<===  %s return %d.............. in %dms\n", __FUNCTION__
+		, ret, rtw_get_passing_time_ms(start_time));
+
+	_func_exit_;
+
+	return ret;
+}
+
+#ifdef CONFIG_AUTOSUSPEND
+void autosuspend_enter(_adapter* padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct dvobj_priv *dvobj = adapter_to_dvobj(padapter);
+
+	pwrpriv->bInternalAutoSuspend = _TRUE;
+	pwrpriv->bips_processing = _TRUE;
+
+	DBG_871X("==>autosuspend_enter...........\n");
+
+	if(rf_off == pwrpriv->change_rfpwrstate )
+	{
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+		usb_enable_autosuspend(dvobj->pusbdev);
+		#else
+		dvobj->pusbdev->autosuspend_disabled = 0;//autosuspend disabled by the user
+		#endif
+
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,33))
+			usb_autopm_put_interface(dvobj->pusbintf);
+		#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,20))
+			usb_autopm_enable(dvobj->pusbintf);
+		#else
+			usb_autosuspend_device(dvobj->pusbdev, 1);
+		#endif
+	}
+	#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,32))
+	DBG_871X("...pm_usage_cnt(%d).....\n", atomic_read(&(dvobj->pusbintf->pm_usage_cnt)));
+	#else
+	DBG_871X("...pm_usage_cnt(%d).....\n", dvobj->pusbintf->pm_usage_cnt);
+	#endif
+
+}
+int autoresume_enter(_adapter* padapter)
+{
+	int result = _SUCCESS;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct dvobj_priv *dvobj = adapter_to_dvobj(padapter);
+
+
+	DBG_871X("====> autoresume_enter \n");
+
+	if(rf_off == pwrpriv->rf_pwrstate )
+	{
+		pwrpriv->ps_flag = _FALSE;
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,33))
+			if (usb_autopm_get_interface(dvobj->pusbintf) < 0)
+			{
+				DBG_871X( "can't get autopm: %d\n", result);
+				result = _FAIL;
+				goto error_exit;
+			}
+		#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,20))
+			usb_autopm_disable(dvobj->pusbintf);
+		#else
+			usb_autoresume_device(dvobj->pusbdev, 1);
+		#endif
+
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,32))
+		DBG_871X("...pm_usage_cnt(%d).....\n", atomic_read(&(dvobj->pusbintf->pm_usage_cnt)));
+		#else
+		DBG_871X("...pm_usage_cnt(%d).....\n", dvobj->pusbintf->pm_usage_cnt);
+		#endif
+	}
+	DBG_871X("<==== autoresume_enter \n");
+error_exit:
+
+	return result;
+}
+#endif
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+extern void rtd2885_wlan_netlink_sendMsg(char *action_string, char *name);
+#endif
+
+#ifdef CONFIG_PLATFORM_ARM_SUNxI
+#include <mach/sys_config.h>
+extern int sw_usb_disable_hcd(__u32 usbc_no);
+extern int sw_usb_enable_hcd(__u32 usbc_no);
+static int usb_wifi_host = 2;
+#endif
+
+#ifdef CONFIG_PLATFORM_ARM_SUN6I
+#include <mach/sys_config.h>
+extern int sw_usb_disable_hcd(__u32 usbc_no);
+extern int sw_usb_enable_hcd(__u32 usbc_no);
+extern void wifi_pm_power(int on);
+static script_item_u item;
+#endif
+
+_adapter *rtw_usb_if1_init(struct dvobj_priv *dvobj,
+	struct usb_interface *pusb_intf, const struct usb_device_id *pdid)
+{
+	_adapter *padapter = NULL;
+	struct net_device *pnetdev = NULL;
+	int status = _FAIL;
+
+	if ((padapter = (_adapter *)rtw_zvmalloc(sizeof(*padapter))) == NULL) {
+		goto exit;
+	}
+	padapter->dvobj = dvobj;
+	dvobj->if1 = padapter;
+
+	padapter->bDriverStopped=_TRUE;
+
+	dvobj->padapters[dvobj->iface_nums++] = padapter;
+	padapter->iface_id = IFACE_ID0;
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_DUALMAC_CONCURRENT)
+	//set adapter_type/iface type for primary padapter
+	padapter->isprimary = _TRUE;
+	padapter->adapter_type = PRIMARY_ADAPTER;
+	#ifndef CONFIG_HWPORT_SWAP
+	padapter->iface_type = IFACE_PORT0;
+	#else
+	padapter->iface_type = IFACE_PORT1;
+	#endif
+#endif
+
+	#ifndef RTW_DVOBJ_CHIP_HW_TYPE
+	//step 1-1., decide the chip_type via vid/pid
+	padapter->interface_type = RTW_USB;
+	decide_chip_type_by_usb_device_id(padapter, pdid);
+	#endif
+
+	if((pnetdev = rtw_init_netdev(padapter)) == NULL) {
+		goto free_adapter;
+	}
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(dvobj));
+	padapter = rtw_netdev_priv(pnetdev);
+
+	//step 2. hook HalFunc, allocate HalData
+	if(padapter->chip_type == RTL8188C_8192C) {
+		#ifdef CONFIG_RTL8192C
+		rtl8192cu_set_hal_ops(padapter);
+		#endif
+	} else if(padapter->chip_type == RTL8192D) {
+		#ifdef CONFIG_RTL8192D
+		rtl8192du_set_hal_ops(padapter);
+		#endif
+	} else {
+		DBG_871X("Detect NULL_CHIP_TYPE\n");
+		goto free_hal_data;
+	}
+
+	//step 3.
+	padapter->intf_start=&usb_intf_start;
+	padapter->intf_stop=&usb_intf_stop;
+
+	//.2
+	if ((rtw_init_io_priv(padapter, usb_set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+		goto free_hal_data;
+	}
+
+	rtw_hal_read_chip_version(padapter);
+
+	//.4 usb endpoint mapping
+	rtw_hal_chip_configure(padapter);
+
+	//step 4. read efuse/eeprom data and get mac_addr
+	rtw_hal_read_chip_info(padapter);
+
+	if (rtw_handle_dualmac(padapter, 1) != _SUCCESS)
+		goto free_hal_data;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(rtw_wdev_alloc(padapter, dvobj_to_dev(dvobj)) != 0) {
+		goto handle_dualmac;
+	}
+#endif
+
+	//step 5.
+	if (rtw_init_drv_sw(padapter) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("Initialize driver software resource Failed!\n"));
+		goto free_wdev;
+	}
+
+#ifdef CONFIG_PM
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18))
+	if(padapter->pwrctrlpriv.bSupportRemoteWakeup)
+	{
+		dvobj->pusbdev->do_remote_wakeup=1;
+		pusb_intf->needs_remote_wakeup = 1;
+		device_init_wakeup(&pusb_intf->dev, 1);
+		DBG_871X("\n  padapter->pwrctrlpriv.bSupportRemoteWakeup~~~~~~\n");
+		DBG_871X("\n  padapter->pwrctrlpriv.bSupportRemoteWakeup~~~[%d]~~~\n",device_may_wakeup(&pusb_intf->dev));
+	}
+#endif
+#endif
+
+#ifdef CONFIG_AUTOSUSPEND
+	if( padapter->registrypriv.power_mgnt != PS_MODE_ACTIVE )
+	{
+		if(padapter->registrypriv.usbss_enable ){ 	/* autosuspend (2s delay) */
+			#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,38))
+			dvobj->pusbdev->dev.power.autosuspend_delay = 0 * HZ;//15 * HZ; idle-delay time
+			#else
+			dvobj->pusbdev->autosuspend_delay = 0 * HZ;//15 * HZ; idle-delay time
+			#endif
+
+			#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+			usb_enable_autosuspend(dvobj->pusbdev);
+			#elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,34))
+			padapter->bDisableAutosuspend = dvobj->pusbdev->autosuspend_disabled ;
+			dvobj->pusbdev->autosuspend_disabled = 0;//autosuspend disabled by the user
+			#endif
+
+			usb_autopm_get_interface(dvobj->pusbintf );//init pm_usage_cnt ,let it start from 1
+
+			#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,32))
+			DBG_871X("%s...pm_usage_cnt(%d).....\n",__FUNCTION__, atomic_read(&(dvobj->pusbintf ->pm_usage_cnt)));
+			#else
+			DBG_871X("%s...pm_usage_cnt(%d).....\n",__FUNCTION__, dvobj->pusbintf ->pm_usage_cnt);
+			#endif
+		}
+	}
+#endif
+
+	// set mac addr
+	rtw_macaddr_cfg(padapter->eeprompriv.mac_addr);
+	rtw_init_wifidirect_addrs(padapter, padapter->eeprompriv.mac_addr, padapter->eeprompriv.mac_addr);
+
+	DBG_871X("bDriverStopped:%d, bSurpriseRemoved:%d, bup:%d, hw_init_completed:%d\n"
+		,padapter->bDriverStopped
+		,padapter->bSurpriseRemoved
+		,padapter->bup
+		,padapter->hw_init_completed
+	);
+
+	status = _SUCCESS;
+
+free_wdev:
+	if(status != _SUCCESS) {
+		#ifdef CONFIG_IOCTL_CFG80211
+		rtw_wdev_unregister(padapter->rtw_wdev);
+		rtw_wdev_free(padapter->rtw_wdev);
+		#endif
+	}
+handle_dualmac:
+	if (status != _SUCCESS)
+		rtw_handle_dualmac(padapter, 0);
+free_hal_data:
+	if(status != _SUCCESS && padapter->HalData)
+		rtw_mfree(padapter->HalData, sizeof(*(padapter->HalData)));
+free_adapter:
+	if (status != _SUCCESS) {
+		if (pnetdev)
+			rtw_free_netdev(pnetdev);
+		else if (padapter)
+			rtw_vmfree((u8*)padapter, sizeof(*padapter));
+		padapter = NULL;
+	}
+exit:
+	return padapter;
+}
+
+static void rtw_usb_if1_deinit(_adapter *if1)
+{
+	struct net_device *pnetdev = if1->pnetdev;
+	struct mlme_priv *pmlmepriv= &if1->mlmepriv;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED))
+		rtw_disassoc_cmd(if1, 0, _FALSE);
+
+#ifdef CONFIG_AP_MODE
+	free_mlme_ap_info(if1);
+	#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_unload(if1);
+	#endif
+#endif
+
+	rtw_cancel_all_timer(if1);
+#ifdef CONFIG_WOWLAN
+	if1->pwrctrlpriv.wowlan_mode=_FALSE;
+#endif //CONFIG_WOWLAN
+	rtw_dev_unload(if1);
+
+	DBG_871X("%s, hw_init_completed=%d\n", __func__, if1->hw_init_completed);
+
+	//s6.
+	rtw_handle_dualmac(if1, 0);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (if1->rtw_wdev)
+		rtw_wdev_free(if1->rtw_wdev);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_free_drv_sw(if1);
+
+	if(pnetdev)
+		rtw_free_netdev(pnetdev);
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link down\n");
+	rtd2885_wlan_netlink_sendMsg("linkdown", "8712");
+#endif
+
+}
+
+/*
+ * drv_init() - a device potentially for us
+ *
+ * notes: drv_init() is called when the bus driver has located a card for us to support.
+ *        We accept the new device by returning 0.
+*/
+
+_adapter  *rtw_sw_export = NULL;
+
+static int rtw_drv_init(struct usb_interface *pusb_intf, const struct usb_device_id *did)
+{
+	int i;
+	uint status = _FAIL;
+	_adapter *if1 = NULL, *if2 = NULL;
+	struct dvobj_priv *dvobj = NULL;
+
+
+	RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("+rtw_drv_init\n"));
+
+
+	//step 0.
+	process_spec_devid(did);
+
+	/* Initialize dvobj_priv */
+	if ((dvobj = usb_dvobj_init(pusb_intf)) == NULL) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("initialize device object priv Failed!\n"));
+		goto exit;
+	}
+
+	/* Initialize if1 */
+	if ((if1 = rtw_usb_if1_init(dvobj, pusb_intf, did)) == NULL) {
+		DBG_871X("rtw_usb_if1_init Failed!\n");
+		goto free_dvobj;
+	}
+
+	/* Initialize if2 */
+#ifdef CONFIG_CONCURRENT_MODE
+	if((if2 = rtw_drv_if2_init(if1, usb_set_intf_ops)) == NULL) {
+		goto free_if1;
+	}
+#ifdef CONFIG_MULTI_VIR_IFACES
+	for(i=0; i<if1->registrypriv.ext_iface_num;i++)
+	{
+		if(rtw_drv_add_vir_if(if1, usb_set_intf_ops) == NULL)
+		{
+			DBG_871X("rtw_drv_add_iface failed! (%d)\n", i);
+			goto free_if1;
+		}
+	}
+#endif //CONFIG_MULTI_VIR_IFACES
+#endif
+
+#ifdef CONFIG_INTEL_PROXIM
+	rtw_sw_export=if1;
+#endif
+
+#ifdef CONFIG_GLOBAL_UI_PID
+	if (ui_pid[1]!=0) {
+		DBG_871X("ui_pid[1]:%d\n",ui_pid[1]);
+		rtw_signal_process(ui_pid[1], SIGUSR2);
+	}
+#endif
+
+	//dev_alloc_name && register_netdev
+	if((status = rtw_drv_register_netdev(if1)) != _SUCCESS) {
+		goto free_if1;
+	}
+
+#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_init(if1);
+#endif
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link up\n");
+	rtd2885_wlan_netlink_sendMsg("linkup", "8712");
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	rtw_proc_init_one(if1->pnetdev);
+#endif
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-871x_drv - drv_init, success!\n"));
+
+	status = _SUCCESS;
+
+free_if1:
+	if (status != _SUCCESS && if1) {
+		rtw_usb_if1_deinit(if1);
+	}
+free_dvobj:
+	if (status != _SUCCESS)
+		usb_dvobj_deinit(pusb_intf);
+exit:
+	return status == _SUCCESS?0:-ENODEV;
+}
+
+/*
+ * dev_remove() - our device is being removed
+*/
+//rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove() => how to recognize both
+static void rtw_dev_remove(struct usb_interface *pusb_intf)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(pusb_intf);
+	_adapter *padapter = dvobj->if1;
+
+_func_exit_;
+
+	DBG_871X("+rtw_dev_remove\n");
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+dev_remove()\n"));
+
+	dvobj->processing_dev_remove = _TRUE;
+
+	rtw_unregister_netdevs(dvobj);
+
+	if(usb_drv->drv_registered == _TRUE)
+	{
+		//DBG_871X("r871xu_dev_remove():padapter->bSurpriseRemoved == _TRUE\n");
+		padapter->bSurpriseRemoved = _TRUE;
+	}
+	/*else
+	{
+		//DBG_871X("r871xu_dev_remove():module removed\n");
+		padapter->hw_init_completed = _FALSE;
+	}*/
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	rtw_unregister_early_suspend(&padapter->pwrctrlpriv);
+#endif
+
+	rtw_pm_set_ips(padapter, IPS_NONE);
+	rtw_pm_set_lps(padapter, PS_MODE_ACTIVE);
+
+	LeaveAllPowerSaveMode(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_MULTI_VIR_IFACES
+	rtw_drv_stop_vir_ifaces(dvobj);
+#endif //CONFIG_MULTI_VIR_IFACES
+	rtw_drv_if2_stop(dvobj->if2);
+#endif	//CONFIG_CONCURRENT_MODE
+
+	rtw_usb_if1_deinit(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_MULTI_VIR_IFACES
+	rtw_drv_free_vir_ifaces(dvobj);
+#endif //CONFIG_MULTI_VIR_IFACES
+	rtw_drv_if2_free(dvobj->if2);
+#endif //CONFIG_CONCURRENT_MODE
+
+	usb_dvobj_deinit(pusb_intf);
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-dev_remove()\n"));
+	DBG_871X("-r871xu_dev_remove, done\n");
+
+
+#ifdef CONFIG_INTEL_PROXIM
+	rtw_sw_export=NULL;
+#endif
+
+_func_exit_;
+
+	return;
+
+}
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+extern int console_suspend_enabled;
+#endif
+
+static int __init rtw_drv_entry(void)
+{
+#ifdef CONFIG_PLATFORM_RTK_DMP
+	u32 tmp;
+	tmp=readl((volatile unsigned int*)0xb801a608);
+	tmp &= 0xffffff00;
+	tmp |= 0x55;
+	writel(tmp,(volatile unsigned int*)0xb801a608);//write dummy register for 1055
+#endif
+#ifdef CONFIG_PLATFORM_ARM_SUNxI
+#ifndef CONFIG_RTL8723A
+	int ret = 0;
+	/* ----------get usb_wifi_usbc_num------------- */
+	ret = script_parser_fetch("usb_wifi_para", "usb_wifi_usbc_num", (int *)&usb_wifi_host, 64);
+	if(ret != 0){
+		printk("ERR: script_parser_fetch usb_wifi_usbc_num failed\n");
+		ret = -ENOMEM;
+		return ret;
+	}
+	printk("sw_usb_enable_hcd: usbc_num = %d\n", usb_wifi_host);
+	sw_usb_enable_hcd(usb_wifi_host);
+#endif //CONFIG_RTL8723A
+#endif //CONFIG_PLATFORM_ARM_SUNxI
+
+#ifdef CONFIG_PLATFORM_ARM_SUN6I
+	script_item_value_type_e type;
+
+	type = script_get_item("wifi_para", "wifi_usbc_id", &item);
+	if(SCIRPT_ITEM_VALUE_TYPE_INT != type){
+		printk("ERR: script_get_item wifi_usbc_id failed\n");
+		return -ENOMEM;
+	}
+
+	printk("sw_usb_enable_hcd: usbc_num = %d\n", item.val);
+	wifi_pm_power(1);
+	mdelay(10);
+	sw_usb_enable_hcd(item.val);
+#endif //CONFIG_PLATFORM_ARM_SUN6I
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_entry\n"));
+
+	DBG_871X(DRV_NAME " driver version=%s\n", DRIVERVERSION);
+	DBG_871X("build time: %s %s\n", __DATE__, __TIME__);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+	//console_suspend_enabled=0;
+#endif
+
+	rtw_suspend_lock_init();
+
+	usb_drv->drv_registered = _TRUE;
+	return usb_register(&usb_drv->usbdrv);
+}
+
+static void __exit rtw_drv_halt(void)
+{
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_halt\n"));
+	DBG_871X("+rtw_drv_halt\n");
+
+	usb_drv->drv_registered = _FALSE;
+	usb_deregister(&usb_drv->usbdrv);
+
+#ifdef CONFIG_PLATFORM_ARM_SUNxI
+#ifndef CONFIG_RTL8723A
+	printk("sw_usb_disable_hcd: usbc_num = %d\n", usb_wifi_host);
+	sw_usb_disable_hcd(usb_wifi_host);
+#endif //ifndef CONFIG_RTL8723A
+#endif	//CONFIG_PLATFORM_ARM_SUNxI
+#ifdef CONFIG_PLATFORM_ARM_SUN6I
+	sw_usb_disable_hcd(item.val);
+	wifi_pm_power(0);
+#endif
+
+	rtw_suspend_lock_uninit();
+	DBG_871X("-rtw_drv_halt\n");
+
+	rtw_mstat_dump();
+}
+
+
+module_init(rtw_drv_entry);
+module_exit(rtw_drv_halt);
+
+#ifdef CONFIG_WOWLAN
+#ifdef CONFIG_WOWLAN_MANUAL
+
+int rtw_resume_toshiba(PADAPTER Adapter)
+{
+	struct dvobj_priv *pdvobjpriv;
+	pdvobjpriv = adapter_to_dvobj(Adapter);
+
+	rtw_resume(pdvobjpriv->pusbintf);
+	return 0;
+}
+
+int rtw_suspend_toshiba(PADAPTER Adapter)
+{
+	pm_message_t msg;
+	struct dvobj_priv *pdvobjpriv;
+	pdvobjpriv = adapter_to_dvobj(Adapter);
+	msg.event=0;
+	//for Toshiba only, they should call rtw_suspend before suspend
+	rtw_suspend(pdvobjpriv->pusbintf, msg);
+	return 0;
+}
+EXPORT_SYMBOL(rtw_suspend_toshiba);
+EXPORT_SYMBOL(rtw_resume_toshiba);
+#endif //CONFIG_WOWLAN_MANUAL
+#endif //CONFIG_WOWLAN
+
+#ifdef CONFIG_INTEL_PROXIM
+_adapter  *rtw_usb_get_sw_pointer(void)
+{
+	return rtw_sw_export;
+}
+EXPORT_SYMBOL(rtw_usb_get_sw_pointer);
+#endif	//CONFIG_INTEL_PROXIM
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c
new file mode 100755
index 0000000000000..f54cfb4283d46
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c
@@ -0,0 +1,649 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *******************************************************************************/
+#define _USB_OPS_LINUX_C_
+
+#include <drv_types.h>
+#include <usb_ops_linux.h>
+#include <rtw_sreset.h>
+
+#ifdef CONFIG_USB_SUPPORT_ASYNC_VDN_REQ
+static void _usbctrl_vendorreq_async_callback(struct urb *urb, struct pt_regs *regs)
+{
+	if (urb) {
+		if (urb->context) {
+			rtw_mfree(urb->context);
+		}
+		usb_free_urb(urb);
+	}
+}
+
+static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request,
+	u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	int rc;
+	unsigned int pipe;
+	u8 reqtype;
+	struct usb_ctrlrequest *dr;
+	struct urb *urb;
+	struct rtl819x_async_write_data {
+		u8 data[VENDOR_CMD_MAX_DATA_LEN];
+		struct usb_ctrlrequest dr;
+	} *buf;
+
+
+	if (requesttype == VENDOR_READ) {
+		pipe = usb_rcvctrlpipe(udev, 0);//read_in
+		reqtype =  REALTEK_USB_VENQT_READ;
+	}
+	else {
+		pipe = usb_sndctrlpipe(udev, 0);//write_out
+		reqtype =  REALTEK_USB_VENQT_WRITE;
+	}
+	
+	buf = (struct rtl819x_async_write_data *)rtw_zmalloc(sizeof(*buf));
+	if (!buf) {
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	urb = usb_alloc_urb(0, GFP_ATOMIC);
+	if (!urb) {
+		rtw_mfree((u8*)buf, sizeof(*buf));
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	dr = &buf->dr;
+
+	dr->bRequestType = reqtype;
+	dr->bRequest = request;
+	dr->wValue = cpu_to_le16(value);
+	dr->wIndex = cpu_to_le16(index);
+	dr->wLength = cpu_to_le16(len);
+
+	_rtw_memcpy(buf, pdata, len);
+
+	usb_fill_control_urb(urb, udev, pipe, (unsigned char *)dr, buf, len,
+		_usbctrl_vendorreq_async_callback, buf);
+
+	rc = usb_submit_urb(urb, GFP_ATOMIC);
+	if (rc < 0) {
+		rtw_mfree((u8*)buf, sizeof(*buf));
+		usb_free_urb(urb);
+	}
+
+exit:
+	return rc;
+}
+
+int usb_write_async(struct usb_device *udev, u32 addr, void *pdata, u16 len)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+
+	int ret;
+
+	requesttype = VENDOR_WRITE;//write_out
+	request = REALTEK_USB_VENQT_CMD_REQ;
+	index = REALTEK_USB_VENQT_CMD_IDX;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+
+	ret = _usbctrl_vendorreq_async_write(udev, request, wvalue, index, pdata, len, requesttype);
+
+	return ret;
+}
+
+int usb_async_write8(struct intf_hdl *pintfhdl, u32 addr, u8 val)
+{
+	u8 data;
+	int ret;
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfhdl->pintf_dev;
+	struct usb_device *udev=pdvobjpriv->pusbdev;
+
+	_func_enter_;
+	data = val;
+	ret = usb_write_async(udev, addr, &data, 1);
+	_func_exit_;
+
+	return ret;
+}
+
+int usb_async_write16(struct intf_hdl *pintfhdl, u32 addr, u16 val)
+{
+	u16 data;
+	int ret;
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfhdl->pintf_dev;
+	struct usb_device *udev=pdvobjpriv->pusbdev;
+
+	_func_enter_;
+	data = val;
+	ret = usb_write_async(udev, addr, &data, 2);
+	_func_exit_;
+
+	return ret;
+}
+
+int usb_async_write32(struct intf_hdl *pintfhdl, u32 addr, u32 val)
+{
+	u32 data;
+	int ret;
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfhdl->pintf_dev;
+	struct usb_device *udev=pdvobjpriv->pusbdev;
+
+	_func_enter_;
+	data = val;
+	ret = usb_write_async(udev, addr, &data, 4);
+	_func_exit_;
+	
+	return ret;
+}
+#endif /* CONFIG_USB_SUPPORT_ASYNC_VDN_REQ */
+
+unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr)
+{
+	unsigned int pipe=0;
+	int ep_num=0;
+	_adapter *padapter = pdvobj->if1;
+	struct usb_device *pusbd = pdvobj->pusbdev;	
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter);
+
+	if (addr == RECV_BULK_IN_ADDR) {	
+		pipe=usb_rcvbulkpipe(pusbd, pHalData->RtBulkInPipe);
+		
+	} else if (addr == RECV_INT_IN_ADDR) {	
+		pipe=usb_rcvbulkpipe(pusbd, pHalData->RtIntInPipe);
+		
+	} else if (addr < HW_QUEUE_ENTRY) {
+		ep_num = pHalData->Queue2EPNum[addr];	
+		pipe = usb_sndbulkpipe(pusbd, ep_num);
+	}
+
+	return pipe;
+}
+
+struct zero_bulkout_context{
+	void *pbuf;
+	void *purb;
+	void *pirp;
+	void *padapter;
+};
+
+static void usb_bulkout_zero_complete(struct urb *purb, struct pt_regs *regs)
+{	
+	struct zero_bulkout_context *pcontext = (struct zero_bulkout_context *)purb->context;
+
+	//DBG_8192C("+usb_bulkout_zero_complete\n");
+	
+	if(pcontext)
+	{
+		if(pcontext->pbuf)
+		{			
+			rtw_mfree(pcontext->pbuf, sizeof(int));	
+		}	
+
+		if(pcontext->purb && (pcontext->purb==purb))
+		{
+			usb_free_urb(pcontext->purb);
+		}
+
+	
+		rtw_mfree((u8*)pcontext, sizeof(struct zero_bulkout_context));	
+	}	
+	
+
+}
+
+static u32 usb_bulkout_zero(struct intf_hdl *pintfhdl, u32 addr)
+{	
+	int pipe, status, len;
+	u32 ret;
+	unsigned char *pbuf;
+	struct zero_bulkout_context *pcontext;
+	PURB	purb = NULL;	
+	_adapter *padapter = (_adapter *)pintfhdl->padapter;
+	struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);	
+	struct usb_device *pusbd = pdvobj->pusbdev;
+
+	//DBG_871X("%s\n", __func__);
+	
+		
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{		
+		return _FAIL;
+	}
+	
+
+	pcontext = (struct zero_bulkout_context *)rtw_zmalloc(sizeof(struct zero_bulkout_context));
+
+	pbuf = (unsigned char *)rtw_zmalloc(sizeof(int));	
+    	purb = usb_alloc_urb(0, GFP_ATOMIC);
+      	
+	len = 0;
+	pcontext->pbuf = pbuf;
+	pcontext->purb = purb;
+	pcontext->pirp = NULL;
+	pcontext->padapter = padapter;
+
+	
+	//translate DMA FIFO addr to pipehandle
+	//pipe = ffaddr2pipehdl(pdvobj, addr);	
+
+	usb_fill_bulk_urb(purb, pusbd, pipe, 
+       				pbuf,
+              			len,
+              			usb_bulkout_zero_complete,
+              			pcontext);//context is pcontext
+
+	status = usb_submit_urb(purb, GFP_ATOMIC);
+
+	if (!status)
+	{		
+		ret= _SUCCESS;
+	}
+	else
+	{
+		ret= _FAIL;
+	}
+	
+	
+	return _SUCCESS;
+
+}
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	
+}
+
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+	
+}
+
+
+void usb_read_port_cancel(struct intf_hdl *pintfhdl)
+{
+	int i;	
+	struct recv_buf *precvbuf;	
+	_adapter	*padapter = pintfhdl->padapter;
+	precvbuf = (struct recv_buf *)padapter->recvpriv.precv_buf;
+
+	DBG_871X("%s\n", __func__);
+
+	padapter->bReadPortCancel = _TRUE;
+
+	for (i=0; i < NR_RECVBUFF ; i++) {
+		
+		precvbuf->reuse = _TRUE;	
+		if (precvbuf->purb)	 {
+			//DBG_8192C("usb_read_port_cancel : usb_kill_urb \n");
+			usb_kill_urb(precvbuf->purb);
+		}		
+		precvbuf++;
+	}
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	usb_kill_urb(padapter->recvpriv.int_in_urb);
+#endif
+}
+
+static void usb_write_port_complete(struct urb *purb, struct pt_regs *regs)
+{
+	_irqL irqL;
+	int i;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)purb->context;
+	//struct xmit_frame *pxmitframe = (struct xmit_frame *)pxmitbuf->priv_data;
+	//_adapter			*padapter = pxmitframe->padapter;
+	_adapter	*padapter = pxmitbuf->padapter;
+       struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;		
+	//struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	   
+_func_enter_;
+
+	switch(pxmitbuf->flags)
+	{
+		case VO_QUEUE_INX:
+			pxmitpriv->voq_cnt--;			
+			break;
+		case VI_QUEUE_INX:
+			pxmitpriv->viq_cnt--;		
+			break;
+		case BE_QUEUE_INX:
+			pxmitpriv->beq_cnt--;			
+			break;
+		case BK_QUEUE_INX:
+			pxmitpriv->bkq_cnt--;			
+			break;
+		case HIGH_QUEUE_INX:
+#ifdef CONFIG_AP_MODE			
+			rtw_chk_hi_queue_cmd(padapter);
+#endif
+			break;
+		default:			
+			break;
+	}
+		
+
+/*
+	_enter_critical(&pxmitpriv->lock, &irqL);
+
+	pxmitpriv->txirp_cnt--;
+	
+	switch(pattrib->priority) 
+	{
+		case 1:				
+		case 2:
+			pxmitpriv->bkq_cnt--;
+			//DBG_8192C("pxmitpriv->bkq_cnt=%d\n", pxmitpriv->bkq_cnt);
+			break;
+		case 4:
+		case 5:
+			pxmitpriv->viq_cnt--;
+			//DBG_8192C("pxmitpriv->viq_cnt=%d\n", pxmitpriv->viq_cnt);
+			break;
+		case 6:
+		case 7:
+			pxmitpriv->voq_cnt--;
+			//DBG_8192C("pxmitpriv->voq_cnt=%d\n", pxmitpriv->voq_cnt);
+			break;
+		case 0:
+		case 3:			
+		default:
+			pxmitpriv->beq_cnt--;
+			//DBG_8192C("pxmitpriv->beq_cnt=%d\n", pxmitpriv->beq_cnt);
+			break;
+			
+	}	
+	
+	_exit_critical(&pxmitpriv->lock, &irqL);
+	
+	
+	if(pxmitpriv->txirp_cnt==0)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: txirp_cnt== 0, set allrxreturnevt!\n"));		
+		_rtw_up_sema(&(pxmitpriv->tx_retevt));
+	}
+*/
+        //rtw_free_xmitframe(pxmitpriv, pxmitframe);
+	
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped ||padapter->bWritePortCancel)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		DBG_8192C("%s(): TX Warning! bDriverStopped(%d) OR bSurpriseRemoved(%d) bWritePortCancel(%d) pxmitbuf->ext_tag(%x) \n", 
+		__FUNCTION__,padapter->bDriverStopped, padapter->bSurpriseRemoved,padapter->bReadPortCancel,pxmitbuf->ext_tag);	
+
+		goto check_completion;
+	}
+
+
+	if (purb->status==0) {
+	
+	} else {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete : purb->status(%d) != 0 \n", purb->status));
+		DBG_871X("###=> urb_write_port_complete status(%d)\n",purb->status);
+		if((purb->status==-EPIPE)||(purb->status==-EPROTO))
+		{
+			//usb_clear_halt(pusbdev, purb->pipe);	
+			//msleep(10);
+			sreset_set_wifi_error_status(padapter, USB_WRITE_PORT_FAIL);
+		} else if (purb->status == -EINPROGRESS) {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: EINPROGESS\n"));
+			goto check_completion;
+
+		} else if (purb->status == -ENOENT) {
+			DBG_871X("%s: -ENOENT\n", __func__);
+			goto check_completion;
+			
+		} else if (purb->status == -ECONNRESET) {
+			DBG_871X("%s: -ECONNRESET\n", __func__);
+			goto check_completion;
+
+		} else if (purb->status == -ESHUTDOWN) {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: ESHUTDOWN\n"));
+			padapter->bDriverStopped=_TRUE;
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bDriverStopped=TRUE\n"));
+
+			goto check_completion;
+		}
+		else
+		{					
+			padapter->bSurpriseRemoved=_TRUE;
+			DBG_8192C("bSurpriseRemoved=TRUE\n");
+			//rtl8192cu_trigger_gpio_0(padapter);
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bSurpriseRemoved=TRUE\n"));
+
+			goto check_completion;
+		}
+	}
+
+	#ifdef DBG_CONFIG_ERROR_DETECT
+	{	
+		HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+		pHalData->srestpriv.last_tx_complete_time = rtw_get_current_time();		
+	}
+	#endif
+
+check_completion:
+	_enter_critical(&pxmitpriv->lock_sctx, &irqL);
+	rtw_sctx_done_err(&pxmitbuf->sctx,
+		purb->status ? RTW_SCTX_DONE_WRITE_PORT_ERR : RTW_SCTX_DONE_SUCCESS);
+	_exit_critical(&pxmitpriv->lock_sctx, &irqL);
+
+	rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+
+	//if(rtw_txframes_pending(padapter))	
+	{
+		tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+	}
+	
+_func_exit_;	
+
+}
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{    
+	_irqL irqL;
+	unsigned int pipe;
+	int status;
+	u32 ret = _FAIL, bwritezero = _FALSE;
+	PURB	purb = NULL;
+	_adapter *padapter = (_adapter *)pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(padapter);	
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)wmem;
+	struct xmit_frame *pxmitframe = (struct xmit_frame *)pxmitbuf->priv_data;
+	struct usb_device *pusbd = pdvobj->pusbdev;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	
+_func_enter_;	
+	
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("+usb_write_port\n"));
+	
+	if ((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx)) {
+		#ifdef DBG_TX
+		DBG_871X(" DBG_TX %s:%d bDriverStopped%d, bSurpriseRemoved:%d, pnp_bstop_trx:%d\n",__FUNCTION__, __LINE__
+			,padapter->bDriverStopped, padapter->bSurpriseRemoved, padapter->pwrctrlpriv.pnp_bstop_trx );
+		#endif
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_TX_DENY);
+		goto exit;
+	}
+	
+	_enter_critical(&pxmitpriv->lock, &irqL);
+
+	switch(addr)
+	{
+		case VO_QUEUE_INX:
+			pxmitpriv->voq_cnt++;
+			pxmitbuf->flags = VO_QUEUE_INX;
+			break;
+		case VI_QUEUE_INX:
+			pxmitpriv->viq_cnt++;
+			pxmitbuf->flags = VI_QUEUE_INX;
+			break;
+		case BE_QUEUE_INX:
+			pxmitpriv->beq_cnt++;
+			pxmitbuf->flags = BE_QUEUE_INX;
+			break;
+		case BK_QUEUE_INX:
+			pxmitpriv->bkq_cnt++;
+			pxmitbuf->flags = BK_QUEUE_INX;
+			break;
+		case HIGH_QUEUE_INX:
+			pxmitbuf->flags = HIGH_QUEUE_INX;
+			break;
+		default:
+			pxmitbuf->flags = MGT_QUEUE_INX;
+			break;
+	}
+		
+	_exit_critical(&pxmitpriv->lock, &irqL);
+		
+	purb	= pxmitbuf->pxmit_urb[0];
+
+#if 0
+	if(pdvobj->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+		{
+			//DBG_8192C("ishighspeed, cnt=%d\n", cnt);
+			bwritezero = _TRUE;			
+		}	
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+		{
+			//DBG_8192C("cnt=%d\n", cnt);
+			bwritezero = _TRUE;			
+		}	
+	}
+#endif
+
+	//translate DMA FIFO addr to pipehandle
+	pipe = ffaddr2pipehdl(pdvobj, addr);	
+
+#ifdef CONFIG_REDUCE_USB_TX_INT	
+	if ( (pxmitpriv->free_xmitbuf_cnt%NR_XMITBUFF == 0)
+		|| (pxmitbuf->ext_tag == _TRUE) )
+	{
+		purb->transfer_flags  &=  (~URB_NO_INTERRUPT);
+	} else {
+		purb->transfer_flags  |=  URB_NO_INTERRUPT;
+		//DBG_8192C("URB_NO_INTERRUPT ");
+	}
+#endif
+
+
+	usb_fill_bulk_urb(purb, pusbd, pipe, 
+       				pxmitframe->buf_addr, //= pxmitbuf->pbuf
+              			cnt,
+              			usb_write_port_complete,
+              			pxmitbuf);//context is pxmitbuf
+              			
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	purb->transfer_dma = pxmitbuf->dma_transfer_addr;
+	purb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+	purb->transfer_flags |= URB_ZERO_PACKET;
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+              			
+#if 0
+	if (bwritezero)
+        {
+            purb->transfer_flags |= URB_ZERO_PACKET;           
+        }			
+#endif
+
+	status = usb_submit_urb(purb, GFP_ATOMIC);
+	if (!status) {
+		#ifdef DBG_CONFIG_ERROR_DETECT	
+		{	
+			HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+			pHalData->srestpriv.last_tx_time = rtw_get_current_time();		
+		}
+		#endif
+	} else {
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_WRITE_PORT_ERR);
+		DBG_871X("usb_write_port, status=%d\n", status);
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port(): usb_submit_urb, status=%x\n", status));
+		
+		switch (status) {
+		case -ENODEV:
+			padapter->bDriverStopped=_TRUE;
+			break;
+		default:
+			break;
+		}
+		goto exit;
+	}
+
+	ret= _SUCCESS;
+
+//   Commented by Albert 2009/10/13
+//   We add the URB_ZERO_PACKET flag to urb so that the host will send the zero packet automatically.
+/*	
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+*/
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("-usb_write_port\n"));
+
+exit:
+	if (ret != _SUCCESS)
+		rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+_func_exit_;
+	return ret;
+
+}
+
+void usb_write_port_cancel(struct intf_hdl *pintfhdl)
+{
+	int i, j;
+	_adapter	*padapter = pintfhdl->padapter;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)padapter->xmitpriv.pxmitbuf;
+
+	DBG_871X("%s \n", __func__);
+	
+	padapter->bWritePortCancel = _TRUE;	
+	
+	for (i=0; i<NR_XMITBUFF; i++) {
+		for (j=0; j<8; j++) {
+			if (pxmitbuf->pxmit_urb[j]) {
+				usb_kill_urb(pxmitbuf->pxmit_urb[j]);
+			}
+		}
+		pxmitbuf++;
+	}
+	
+	pxmitbuf = (struct xmit_buf*)padapter->xmitpriv.pxmit_extbuf;
+	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {	
+		for (j=0; j<8; j++) {
+			if(pxmitbuf->pxmit_urb[j]) {
+				usb_kill_urb(pxmitbuf->pxmit_urb[j]);
+			}
+		}
+		pxmitbuf++;
+	}
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c
new file mode 100755
index 0000000000000..9105e293eb3c8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c
@@ -0,0 +1,421 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _XMIT_OSDEP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#include <if_ether.h>
+#include <ip.h>
+#include <rtw_byteorder.h>
+#include <wifi.h>
+#include <mlme_osdep.h>
+#include <xmit_osdep.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+
+
+uint rtw_remainder_len(struct pkt_file *pfile)
+{
+	return (pfile->buf_len - ((SIZE_PTR)(pfile->cur_addr) - (SIZE_PTR)(pfile->buf_start)));
+}
+
+void _rtw_open_pktfile (_pkt *pktptr, struct pkt_file *pfile)
+{
+_func_enter_;
+
+	pfile->pkt = pktptr;
+	pfile->cur_addr = pfile->buf_start = pktptr->data;
+	pfile->pkt_len = pfile->buf_len = pktptr->len;
+
+	pfile->cur_buffer = pfile->buf_start ;
+	
+_func_exit_;
+}
+
+uint _rtw_pktfile_read (struct pkt_file *pfile, u8 *rmem, uint rlen)
+{	
+	uint	len = 0;
+	
+_func_enter_;
+
+       len =  rtw_remainder_len(pfile);
+      	len = (rlen > len)? len: rlen;
+
+       if(rmem)
+	  skb_copy_bits(pfile->pkt, pfile->buf_len-pfile->pkt_len, rmem, len);
+
+       pfile->cur_addr += len;
+       pfile->pkt_len -= len;
+	   
+_func_exit_;	       		
+
+	return len;	
+}
+
+sint rtw_endofpktfile(struct pkt_file *pfile)
+{
+_func_enter_;
+
+	if (pfile->pkt_len == 0) {
+_func_exit_;
+		return _TRUE;
+	}
+
+_func_exit_;
+
+	return _FALSE;
+}
+
+void rtw_set_tx_chksum_offload(_pkt *pkt, struct pkt_attrib *pattrib)
+{
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	struct sk_buff *skb = (struct sk_buff *)pkt;
+	pattrib->hw_tcp_csum = 0;
+	
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		if (skb_shinfo(skb)->nr_frags == 0)
+		{	
+                        const struct iphdr *ip = ip_hdr(skb);
+                        if (ip->protocol == IPPROTO_TCP) {
+                                // TCP checksum offload by HW
+                                DBG_871X("CHECKSUM_PARTIAL TCP\n");
+                                pattrib->hw_tcp_csum = 1;
+                                //skb_checksum_help(skb);
+                        } else if (ip->protocol == IPPROTO_UDP) {
+                                //DBG_871X("CHECKSUM_PARTIAL UDP\n");
+#if 1                       
+                                skb_checksum_help(skb);
+#else
+                                // Set UDP checksum = 0 to skip checksum check
+                                struct udphdr *udp = skb_transport_header(skb);
+                                udp->check = 0;
+#endif
+                        } else {
+				DBG_871X("%s-%d TCP CSUM offload Error!!\n", __FUNCTION__, __LINE__);
+                                WARN_ON(1);     /* we need a WARN() */
+			    }
+		}
+		else { // IP fragmentation case
+			DBG_871X("%s-%d nr_frags != 0, using skb_checksum_help(skb);!!\n", __FUNCTION__, __LINE__);
+                	skb_checksum_help(skb);
+		}		
+	}
+#endif	
+	
+}
+
+int rtw_os_xmit_resource_alloc(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 alloc_sz)
+{
+#ifdef CONFIG_USB_HCI
+	int i;
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	pxmitbuf->pallocated_buf = rtw_usb_buffer_alloc(pusbd, (size_t)alloc_sz, &pxmitbuf->dma_transfer_addr);
+	pxmitbuf->pbuf = pxmitbuf->pallocated_buf;
+	if(pxmitbuf->pallocated_buf == NULL)
+		return _FAIL;
+#else // CONFIG_USE_USB_BUFFER_ALLOC_TX
+	
+	pxmitbuf->pallocated_buf = rtw_zmalloc(alloc_sz);
+	if (pxmitbuf->pallocated_buf == NULL)
+	{
+		return _FAIL;
+	}
+
+	pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), XMITBUF_ALIGN_SZ);
+	pxmitbuf->dma_transfer_addr = 0;
+
+#endif // CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+	for(i=0; i<8; i++)
+      	{
+      		pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
+             	if(pxmitbuf->pxmit_urb[i] == NULL) 
+             	{
+             		DBG_871X("pxmitbuf->pxmit_urb[i]==NULL");
+	        	return _FAIL;	 
+             	}      		  	
+	
+      	}
+#endif
+#if defined(CONFIG_PCI_HCI) || defined(CONFIG_SDIO_HCI)
+	pxmitbuf->pallocated_buf = rtw_zmalloc(alloc_sz);
+	if (pxmitbuf->pallocated_buf == NULL)
+	{
+		return _FAIL;
+	}
+
+	pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), XMITBUF_ALIGN_SZ);
+#endif
+
+	return _SUCCESS;	
+}
+
+void rtw_os_xmit_resource_free(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 free_sz)
+{
+#ifdef CONFIG_USB_HCI
+	int i;
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+
+	for(i=0; i<8; i++)
+	{
+		if(pxmitbuf->pxmit_urb[i])
+		{
+			//usb_kill_urb(pxmitbuf->pxmit_urb[i]);
+			usb_free_urb(pxmitbuf->pxmit_urb[i]);
+		}
+	}
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	rtw_usb_buffer_free(pusbd, (size_t)free_sz, pxmitbuf->pallocated_buf, pxmitbuf->dma_transfer_addr);
+	pxmitbuf->pallocated_buf =  NULL;
+	pxmitbuf->dma_transfer_addr = 0;
+#else	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+	if(pxmitbuf->pallocated_buf)
+		rtw_mfree(pxmitbuf->pallocated_buf, free_sz);
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+#endif
+#if defined(CONFIG_PCI_HCI) || defined(CONFIG_SDIO_HCI)
+	if(pxmitbuf->pallocated_buf)
+		rtw_mfree(pxmitbuf->pallocated_buf, free_sz);
+#endif
+}
+
+void rtw_os_pkt_complete(_adapter *padapter, _pkt *pkt)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	u16	queue;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	queue = skb_get_queue_mapping(pkt);
+	if(__netif_subqueue_stopped(padapter->pnetdev, queue) &&
+		(pxmitpriv->hwxmits[queue].accnt < NR_XMITFRAME/2))
+	{
+		netif_wake_subqueue(padapter->pnetdev, queue);
+	}
+#else
+	if (netif_queue_stopped(padapter->pnetdev))
+		netif_wake_queue(padapter->pnetdev);
+#endif
+
+	rtw_skb_free(pkt);
+}
+
+void rtw_os_xmit_complete(_adapter *padapter, struct xmit_frame *pxframe)
+{
+	if(pxframe->pkt)
+		rtw_os_pkt_complete(padapter, pxframe->pkt);
+
+	pxframe->pkt = NULL;
+}
+
+void rtw_os_xmit_schedule(_adapter *padapter)
+{
+#ifdef CONFIG_SDIO_HCI
+	if(!padapter)
+		return;
+	
+	if (rtw_txframes_pending(padapter))
+		_rtw_up_sema(&padapter->xmitpriv.xmit_sema);
+#else
+	_irqL  irqL;
+	struct xmit_priv *pxmitpriv;
+
+	if(!padapter)
+		return;
+
+	pxmitpriv = &padapter->xmitpriv;
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if(rtw_txframes_pending(padapter))	
+	{
+		tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+	}
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+#endif
+}
+
+
+
+#ifdef CONFIG_TX_MCAST2UNI
+int rtw_mlcst2unicst(_adapter *padapter, struct sk_buff *skb)
+{
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	_irqL	irqL;
+	_list	*phead, *plist;
+	struct sk_buff *newskb;
+	struct sta_info *psta = NULL;
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	u8 bc_addr[6]={0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	u8 null_addr[6]={0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	int i;
+	s32	res;
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+	
+	//free sta asoc_queue
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE) {
+		int stainfo_offset;
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+		if (stainfo_offset_valid(stainfo_offset)) {
+			chk_alive_list[chk_alive_num++] = stainfo_offset;
+		}
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	for (i = 0; i < chk_alive_num; i++) {
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+
+		/* avoid come from STA1 and send back STA1 */ 
+		if (_rtw_memcmp(psta->hwaddr, &skb->data[6], 6) == _TRUE
+			|| _rtw_memcmp(psta->hwaddr, null_addr, 6) == _TRUE
+			|| _rtw_memcmp(psta->hwaddr, bc_addr, 6) == _TRUE
+		)
+			continue;
+
+		newskb = rtw_skb_copy(skb);
+
+		if (newskb) {
+			_rtw_memcpy(newskb->data, psta->hwaddr, 6);
+			res = rtw_xmit(padapter, &newskb);
+			if (res < 0) {
+				DBG_871X("%s()-%d: rtw_xmit() return error!\n", __FUNCTION__, __LINE__);
+				pxmitpriv->tx_drop++;
+				rtw_skb_free(newskb);
+			} else
+				pxmitpriv->tx_pkts++;
+		} else {
+			DBG_871X("%s-%d: rtw_skb_copy() failed!\n", __FUNCTION__, __LINE__);
+			pxmitpriv->tx_drop++;
+			//rtw_skb_free(skb);
+			return _FALSE;	// Caller shall tx this multicast frame via normal way.
+		}
+	}
+
+	rtw_skb_free(skb);
+	return _TRUE;
+}
+#endif	// CONFIG_TX_MCAST2UNI
+
+
+int _rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+#ifdef CONFIG_TX_MCAST2UNI
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	extern int rtw_mc2u_disable;
+#endif	// CONFIG_TX_MCAST2UNI	
+	s32 res = 0;
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	u16 queue;
+#endif
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("+xmit_enry\n"));
+
+	if (rtw_if_up(padapter) == _FALSE) {
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit_entry: rtw_if_up fail\n"));
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s if_up fail\n", __FUNCTION__);
+		#endif
+		goto drop_packet;
+	}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	queue = skb_get_queue_mapping(pkt);
+	/* No free space for Tx, tx_worker is too slow */
+	if (pxmitpriv->hwxmits[queue].accnt > NR_XMITFRAME/2) {
+		//DBG_871X("%s(): stop netif_subqueue[%d]\n", __FUNCTION__, queue);
+		netif_stop_subqueue(padapter->pnetdev, queue);
+		return NETDEV_TX_BUSY;
+	}
+#endif
+
+#ifdef CONFIG_TX_MCAST2UNI
+	if ( !rtw_mc2u_disable
+		&& check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE
+		&& ( IP_MCAST_MAC(pkt->data)
+			|| ICMPV6_MCAST_MAC(pkt->data) )
+		&& (padapter->registrypriv.wifi_spec == 0)
+		)
+	{
+		if ( pxmitpriv->free_xmitframe_cnt > (NR_XMITFRAME/4) ) {
+			res = rtw_mlcst2unicst(padapter, pkt);
+			if (res == _TRUE) {
+				goto exit;
+			}
+		} else {
+			//DBG_871X("Stop M2U(%d, %d)! ", pxmitpriv->free_xmitframe_cnt, pxmitpriv->free_xmitbuf_cnt);
+			//DBG_871X("!m2u );
+		}
+	}	
+#endif	// CONFIG_TX_MCAST2UNI	
+
+	res = rtw_xmit(padapter, &pkt);
+	if (res < 0) {
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s rtw_xmit fail\n", __FUNCTION__);
+		#endif
+		goto drop_packet;
+	}
+
+	pxmitpriv->tx_pkts++;
+	RT_TRACE(_module_xmit_osdep_c_, _drv_info_, ("rtw_xmit_entry: tx_pkts=%d\n", (u32)pxmitpriv->tx_pkts));
+	goto exit;
+
+drop_packet:
+	pxmitpriv->tx_drop++;
+	rtw_skb_free(pkt);
+	RT_TRACE(_module_xmit_osdep_c_, _drv_notice_, ("rtw_xmit_entry: drop, tx_drop=%d\n", (u32)pxmitpriv->tx_drop));
+
+exit:
+
+_func_exit_;
+
+	return 0;
+}
+
+int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev)
+{
+	if (pkt)
+		rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, pkt->truesize);
+	return _rtw_xmit_entry(pkt, pnetdev);
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c
new file mode 100755
index 0000000000000..6df0433e64253
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c
@@ -0,0 +1,2300 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *                                        
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#define _OSDEP_SERVICE_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#ifdef PLATFORM_LINUX
+#include <linux/vmalloc.h>
+#endif
+#ifdef PLATFORM_FREEBSD
+#include <sys/malloc.h>
+#include <sys/time.h>
+#endif /* PLATFORM_FREEBSD */
+#ifdef RTK_DMP_PLATFORM
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+#include <linux/pageremap.h>
+#endif
+#endif
+
+#define RT_TAG	'1178'
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+#include <asm/atomic.h>
+atomic_t _malloc_cnt = ATOMIC_INIT(0);
+atomic_t _malloc_size = ATOMIC_INIT(0);
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+
+#if defined(PLATFORM_LINUX)
+/*
+* Translate the OS dependent @param error_code to OS independent RTW_STATUS_CODE
+* @return: one of RTW_STATUS_CODE
+*/
+inline int RTW_STATUS_CODE(int error_code){
+	if(error_code >=0)
+		return _SUCCESS;
+
+	switch(error_code) {
+		//case -ETIMEDOUT:
+		//	return RTW_STATUS_TIMEDOUT;
+		default:
+			return _FAIL;
+	}
+}
+#else
+inline int RTW_STATUS_CODE(int error_code){
+	return error_code;
+}
+#endif
+
+u32 rtw_atoi(u8* s)
+{
+
+	int num=0,flag=0;
+	int i;
+	for(i=0;i<=strlen(s);i++)
+	{
+	  if(s[i] >= '0' && s[i] <= '9')
+		 num = num * 10 + s[i] -'0';
+	  else if(s[0] == '-' && i==0) 
+		 flag =1;
+	  else 
+		  break;
+	 }
+
+	if(flag == 1)
+	   num = num * -1;
+
+	 return(num); 
+
+}
+
+inline u8* _rtw_vmalloc(u32 sz)
+{
+	u8 	*pbuf;
+#ifdef PLATFORM_LINUX	
+	pbuf = vmalloc(sz);
+#endif	
+#ifdef PLATFORM_FREEBSD
+	pbuf = malloc(sz,M_DEVBUF,M_NOWAIT);	
+#endif	
+	
+#ifdef PLATFORM_WINDOWS
+	NdisAllocateMemoryWithTag(&pbuf,sz, RT_TAG);	
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	if ( pbuf != NULL) {
+		atomic_inc(&_malloc_cnt);
+		atomic_add(sz, &_malloc_size);
+	}
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+	return pbuf;	
+}
+
+inline u8* _rtw_zvmalloc(u32 sz)
+{
+	u8 	*pbuf;
+#ifdef PLATFORM_LINUX
+	pbuf = _rtw_vmalloc(sz);
+	if (pbuf != NULL)
+		memset(pbuf, 0, sz);
+#endif	
+#ifdef PLATFORM_FREEBSD
+	pbuf = malloc(sz,M_DEVBUF,M_ZERO|M_NOWAIT);	
+#endif	
+#ifdef PLATFORM_WINDOWS
+	NdisAllocateMemoryWithTag(&pbuf,sz, RT_TAG);
+	if (pbuf != NULL)
+		NdisFillMemory(pbuf, sz, 0);
+#endif
+
+	return pbuf;	
+}
+
+inline void _rtw_vmfree(u8 *pbuf, u32 sz)
+{
+#ifdef	PLATFORM_LINUX
+	vfree(pbuf);
+#endif	
+#ifdef PLATFORM_FREEBSD
+	free(pbuf,M_DEVBUF);	
+#endif	
+#ifdef PLATFORM_WINDOWS
+	NdisFreeMemory(pbuf,sz, 0);
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	atomic_dec(&_malloc_cnt);
+	atomic_sub(sz, &_malloc_size);
+#endif
+#endif /* DBG_MEMORY_LEAK */
+}
+
+u8* _rtw_malloc(u32 sz)
+{
+
+	u8 	*pbuf=NULL;
+
+#ifdef PLATFORM_LINUX
+#ifdef RTK_DMP_PLATFORM
+	if(sz > 0x4000)
+		pbuf = (u8 *)dvr_malloc(sz);
+	else
+#endif		
+		pbuf = kmalloc(sz,in_interrupt() ? GFP_ATOMIC : GFP_KERNEL); 		
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	pbuf = malloc(sz,M_DEVBUF,M_NOWAIT);	
+#endif		
+#ifdef PLATFORM_WINDOWS
+
+	NdisAllocateMemoryWithTag(&pbuf,sz, RT_TAG);
+
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	if ( pbuf != NULL) {
+		atomic_inc(&_malloc_cnt);
+		atomic_add(sz, &_malloc_size);
+	}
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+	return pbuf;	
+	
+}
+
+
+u8* _rtw_zmalloc(u32 sz)
+{
+#ifdef PLATFORM_FREEBSD
+	return malloc(sz,M_DEVBUF,M_ZERO|M_NOWAIT);
+#else // PLATFORM_FREEBSD
+	u8 	*pbuf = _rtw_malloc(sz);
+
+	if (pbuf != NULL) {
+
+#ifdef PLATFORM_LINUX
+		memset(pbuf, 0, sz);
+#endif	
+	
+#ifdef PLATFORM_WINDOWS
+		NdisFillMemory(pbuf, sz, 0);
+#endif
+
+	}
+
+	return pbuf;	
+#endif // PLATFORM_FREEBSD
+}
+
+void	_rtw_mfree(u8 *pbuf, u32 sz)
+{
+
+#ifdef	PLATFORM_LINUX
+#ifdef RTK_DMP_PLATFORM
+	if(sz > 0x4000)
+		dvr_free(pbuf);
+	else
+#endif
+		kfree(pbuf);
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	free(pbuf,M_DEVBUF);	
+#endif		
+#ifdef PLATFORM_WINDOWS
+
+	NdisFreeMemory(pbuf,sz, 0);
+
+#endif
+	
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	atomic_dec(&_malloc_cnt);
+	atomic_sub(sz, &_malloc_size);
+#endif
+#endif /* DBG_MEMORY_LEAK */
+	
+}
+
+#ifdef PLATFORM_FREEBSD
+//review again
+struct sk_buff * dev_alloc_skb(unsigned int size)
+{
+	struct sk_buff *skb=NULL;
+    	u8 *data=NULL;
+	
+	//skb = (struct sk_buff *)_rtw_zmalloc(sizeof(struct sk_buff)); // for skb->len, etc.
+	skb = (struct sk_buff *)_rtw_malloc(sizeof(struct sk_buff));
+	if(!skb)
+		goto out;
+	data = _rtw_malloc(size);
+	if(!data)
+		goto nodata;
+
+	skb->head = (unsigned char*)data;
+	skb->data = (unsigned char*)data;
+	skb->tail = (unsigned char*)data;
+	skb->end = (unsigned char*)data + size;
+	skb->len = 0;
+	//printf("%s()-%d: skb=%p, skb->head = %p\n", __FUNCTION__, __LINE__, skb, skb->head);
+
+out:
+	return skb;
+nodata:
+	_rtw_mfree((u8 *)skb, sizeof(struct sk_buff));
+	skb = NULL;
+goto out;
+	
+}
+
+void dev_kfree_skb_any(struct sk_buff *skb)
+{
+	//printf("%s()-%d: skb->head = %p\n", __FUNCTION__, __LINE__, skb->head);
+	if(skb->head)
+		_rtw_mfree(skb->head, 0);
+	//printf("%s()-%d: skb = %p\n", __FUNCTION__, __LINE__, skb);
+	if(skb)
+		_rtw_mfree((u8 *)skb, 0);
+}
+struct sk_buff *skb_clone(const struct sk_buff *skb)
+{
+	return NULL;
+}
+
+#endif /* PLATFORM_FREEBSD */
+
+inline struct sk_buff *_rtw_skb_alloc(u32 sz)
+{
+#ifdef PLATFORM_LINUX
+	return __dev_alloc_skb(sz, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return dev_alloc_skb(sz);
+#endif /* PLATFORM_FREEBSD */
+}
+
+inline void _rtw_skb_free(struct sk_buff *skb)
+{
+	dev_kfree_skb_any(skb);
+}
+
+inline struct sk_buff *_rtw_skb_copy(const struct sk_buff *skb)
+{
+#ifdef PLATFORM_LINUX
+	return skb_copy(skb, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return NULL;
+#endif /* PLATFORM_FREEBSD */
+}
+
+inline struct sk_buff *_rtw_skb_clone(struct sk_buff *skb)
+{
+#ifdef PLATFORM_LINUX
+	return skb_clone(skb, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return skb_clone(skb);
+#endif /* PLATFORM_FREEBSD */
+}
+
+inline int _rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb)
+{
+#ifdef PLATFORM_LINUX
+	skb->dev = ndev;
+	return netif_rx(skb);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return (*ndev->if_input)(ndev, skb);
+#endif /* PLATFORM_FREEBSD */
+}
+
+void _rtw_skb_queue_purge(struct sk_buff_head *list)
+{
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(list)) != NULL)
+		_rtw_skb_free(skb);
+}
+
+#ifdef CONFIG_USB_HCI
+inline void *_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma)
+{
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	return usb_alloc_coherent(dev, size, (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL), dma);
+#else
+	return usb_buffer_alloc(dev, size, (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL), dma);
+#endif
+#endif /* PLATFORM_LINUX */
+	
+#ifdef PLATFORM_FREEBSD
+	return (malloc(size, M_USBDEV, M_NOWAIT | M_ZERO));
+#endif /* PLATFORM_FREEBSD */
+}
+inline void _rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma)
+{
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	usb_free_coherent(dev, size, addr, dma); 
+#else
+	usb_buffer_free(dev, size, addr, dma);
+#endif
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	free(addr, M_USBDEV);
+#endif /* PLATFORM_FREEBSD */
+}
+#endif /* CONFIG_USB_HCI */
+
+#ifdef DBG_MEM_ALLOC
+
+struct rtw_mem_stat {
+	ATOMIC_T alloc; // the memory bytes we allocate currently
+	ATOMIC_T peak; // the peak memory bytes we allocate 
+	ATOMIC_T alloc_cnt; // the alloc count for alloc currently
+	ATOMIC_T alloc_err_cnt; // the error times we fail to allocate memory
+};
+
+struct rtw_mem_stat rtw_mem_type_stat[mstat_tf_idx(MSTAT_TYPE_MAX)];
+struct rtw_mem_stat rtw_mem_func_stat[mstat_ff_idx(MSTAT_FUNC_MAX)];
+
+char *MSTAT_TYPE_str[] = {
+	"VIR",
+	"PHY",
+	"SKB",
+	"USB",
+};
+
+char *MSTAT_FUNC_str[] = {
+	"UNSP",
+	"IO",
+	"TXIO",
+	"RXIO",
+	"TX",
+	"RX",
+};
+
+int _rtw_mstat_dump(char *buf, int len)
+{
+	int cnt = 0;
+	int i;
+	int value_t[4][mstat_tf_idx(MSTAT_TYPE_MAX)];
+	int value_f[4][mstat_ff_idx(MSTAT_FUNC_MAX)];
+	
+	int vir_alloc, vir_peak, vir_alloc_err, phy_alloc, phy_peak, phy_alloc_err;
+	int tx_alloc, tx_peak, tx_alloc_err, rx_alloc, rx_peak, rx_alloc_err;
+
+	for(i=0;i<mstat_tf_idx(MSTAT_TYPE_MAX);i++) {
+		value_t[0][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].alloc));
+		value_t[1][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].peak));
+		value_t[2][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].alloc_cnt));
+		value_t[3][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].alloc_err_cnt));
+	}
+
+	#if 0
+	for(i=0;i<mstat_ff_idx(MSTAT_FUNC_MAX);i++) {
+		value_f[0][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].alloc));
+		value_f[1][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].peak));
+		value_f[2][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].alloc_cnt));
+		value_f[3][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].alloc_err_cnt));
+	}
+	#endif
+
+	cnt += snprintf(buf+cnt, len-cnt, "===================== MSTAT =====================\n");
+	cnt += snprintf(buf+cnt, len-cnt, "%4s %10s %10s %10s %10s\n", "TAG", "alloc", "peak", "aloc_cnt", "err_cnt");
+	cnt += snprintf(buf+cnt, len-cnt, "-------------------------------------------------\n");
+	for(i=0;i<mstat_tf_idx(MSTAT_TYPE_MAX);i++) {
+		cnt += snprintf(buf+cnt, len-cnt, "%4s %10d %10d %10d %10d\n", MSTAT_TYPE_str[i], value_t[0][i], value_t[1][i], value_t[2][i], value_t[3][i]);
+	}
+	#if 0
+	cnt += snprintf(buf+cnt, len-cnt, "-------------------------------------------------\n");
+	for(i=0;i<mstat_ff_idx(MSTAT_FUNC_MAX);i++) {
+		cnt += snprintf(buf+cnt, len-cnt, "%4s %10d %10d %10d %10d\n", MSTAT_FUNC_str[i], value_f[0][i], value_f[1][i], value_f[2][i], value_f[3][i]);
+	}
+	#endif
+
+	return cnt;
+}
+
+void rtw_mstat_dump(void)
+{
+	char buf[768] = {0};
+
+	_rtw_mstat_dump(buf, 768);
+	DBG_871X("\n%s", buf);
+}
+
+void rtw_mstat_update(const enum mstat_f flags, const MSTAT_STATUS status, u32 sz)
+{
+	static u32 update_time = 0;
+	int peak, alloc;
+	int i;
+
+	/* initialization */
+	if(!update_time) {
+		for(i=0;i<mstat_tf_idx(MSTAT_TYPE_MAX);i++) {
+			ATOMIC_SET(&(rtw_mem_type_stat[i].alloc), 0);
+			ATOMIC_SET(&(rtw_mem_type_stat[i].peak), 0);
+			ATOMIC_SET(&(rtw_mem_type_stat[i].alloc_cnt), 0);
+			ATOMIC_SET(&(rtw_mem_type_stat[i].alloc_err_cnt), 0);
+		}
+		for(i=0;i<mstat_ff_idx(MSTAT_FUNC_MAX);i++) {
+			ATOMIC_SET(&(rtw_mem_func_stat[i].alloc), 0);
+			ATOMIC_SET(&(rtw_mem_func_stat[i].peak), 0);
+			ATOMIC_SET(&(rtw_mem_func_stat[i].alloc_cnt), 0);
+			ATOMIC_SET(&(rtw_mem_func_stat[i].alloc_err_cnt), 0);
+		}
+	}
+
+	switch(status) {
+		case MSTAT_ALLOC_SUCCESS:
+			ATOMIC_INC(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc_cnt));
+			alloc = ATOMIC_ADD_RETURN(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc), sz);
+			peak=ATOMIC_READ(&(rtw_mem_type_stat[mstat_tf_idx(flags)].peak));
+			if (peak<alloc)
+				ATOMIC_SET(&(rtw_mem_type_stat[mstat_tf_idx(flags)].peak), alloc);
+
+			ATOMIC_INC(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc_cnt));
+			alloc = ATOMIC_ADD_RETURN(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc), sz);
+			peak=ATOMIC_READ(&(rtw_mem_func_stat[mstat_ff_idx(flags)].peak));
+			if (peak<alloc)
+				ATOMIC_SET(&(rtw_mem_func_stat[mstat_ff_idx(flags)].peak), alloc);
+			break;
+
+		case MSTAT_ALLOC_FAIL:
+			ATOMIC_INC(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc_err_cnt));
+
+			ATOMIC_INC(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc_err_cnt));
+			break;
+
+		case MSTAT_FREE:
+			ATOMIC_DEC(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc_cnt));
+			ATOMIC_SUB(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc), sz);
+
+			ATOMIC_DEC(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc_cnt));
+			ATOMIC_SUB(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc), sz);
+			break;
+	};
+
+	//if (rtw_get_passing_time_ms(update_time) > 5000) {
+	//	rtw_mstat_dump();
+		update_time=rtw_get_current_time();
+	//}
+}
+
+
+
+inline u8* dbg_rtw_vmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8  *p;
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func,  line, __FUNCTION__, (sz));
+	
+	p=_rtw_vmalloc((sz));
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+	
+	return p;
+}
+
+inline u8* dbg_rtw_zvmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8 *p;
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz)); 
+	
+	p=_rtw_zvmalloc((sz)); 
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline void dbg_rtw_vmfree(u8 *pbuf, u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%p,%d)\n",  func, line, __FUNCTION__, (pbuf), (sz));
+	
+	_rtw_vmfree((pbuf), (sz)); 
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, sz
+	);
+}
+
+inline u8* dbg_rtw_malloc(u32 sz, const enum mstat_f flags, const char *func, const int line) 
+{
+	u8 *p;
+
+	//if(sz>=153 && sz<=306) 
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	//if((sz)>4096) 
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz)); 
+
+	p=_rtw_malloc((sz));
+	
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline u8* dbg_rtw_zmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8 *p;
+
+	//if(sz>=153 && sz<=306) 
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	//if((sz)>4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	p = _rtw_zmalloc((sz));
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline void dbg_rtw_mfree(u8 *pbuf, u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	//if(sz>=153 && sz<=306) 
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	//if((sz)>4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%p,%d)\n", func, line, __FUNCTION__, (pbuf), (sz));
+	
+	_rtw_mfree((pbuf), (sz));
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, sz
+	);
+}
+
+inline struct sk_buff * dbg_rtw_skb_alloc(unsigned int size, const enum mstat_f flags, const char *func, int line)
+{
+	struct sk_buff *skb;
+	unsigned int truesize = 0;
+
+	skb = _rtw_skb_alloc(size);
+
+	if(skb)
+		truesize = skb->truesize;
+
+	if(!skb || truesize < size /*|| size > 4096*/)
+		DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d), skb:%p, truesize=%u\n", func, line, __FUNCTION__, size, skb, truesize);
+
+	rtw_mstat_update(
+		flags
+		, skb ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, truesize
+	);
+
+	return skb;
+}
+
+inline void dbg_rtw_skb_free(struct sk_buff *skb, const enum mstat_f flags, const char *func, int line)
+{
+	unsigned int truesize = skb->truesize;
+
+	//if(truesize > 4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s, truesize=%u\n", func, line, __FUNCTION__, truesize);
+
+	_rtw_skb_free(skb);
+	
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, truesize
+	);
+}
+
+inline struct sk_buff *dbg_rtw_skb_copy(const struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line)
+{
+	struct sk_buff *skb_cp;
+	unsigned int truesize = skb->truesize;
+	unsigned int cp_truesize = 0;
+	
+	skb_cp = _rtw_skb_copy(skb);
+	if(skb_cp)
+		cp_truesize = skb_cp->truesize;
+
+	if(!skb_cp || cp_truesize != truesize /*||cp_truesize > 4096*/)
+		DBG_871X("DBG_MEM_ALLOC %s:%d %s(%u), skb_cp:%p, cp_truesize=%u\n", func, line, __FUNCTION__, truesize, skb_cp, cp_truesize);
+
+	rtw_mstat_update(
+		flags
+		, skb_cp ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, truesize
+	);
+
+	return skb_cp;
+}
+
+inline struct sk_buff *dbg_rtw_skb_clone(struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line)
+{
+	struct sk_buff *skb_cl;
+	unsigned int truesize = skb->truesize;
+	unsigned int cl_truesize = 0;
+
+	skb_cl = _rtw_skb_clone(skb);
+	if(skb_cl)
+		cl_truesize = skb_cl->truesize;
+
+	if(!skb_cl || cl_truesize != truesize /*|| cl_truesize > 4096*/)
+		DBG_871X("DBG_MEM_ALLOC %s:%d %s(%u), skb_cl:%p, cl_truesize=%u\n", func, line, __FUNCTION__, truesize, skb_cl, cl_truesize);
+
+	rtw_mstat_update(
+		flags
+		, skb_cl ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, truesize
+	);
+
+	return skb_cl;
+}
+
+inline int dbg_rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb, const enum mstat_f flags, const char *func, int line)
+{
+	int ret;
+	unsigned int truesize = skb->truesize;
+
+	//if(truesize > 4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s, truesize=%u\n", func, line, __FUNCTION__, truesize);
+
+	ret = _rtw_netif_rx(ndev, skb);
+	
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, truesize
+	);
+
+	return ret;
+}
+
+inline void dbg_rtw_skb_queue_purge(struct sk_buff_head *list, enum mstat_f flags, const char *func, int line)
+{
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(list)) != NULL)
+		dbg_rtw_skb_free(skb, flags, func, line);
+}
+
+#ifdef CONFIG_USB_HCI
+inline void *dbg_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma, const enum mstat_f flags, const char *func, int line)
+{
+	void *p;
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, size);
+	
+	p = _rtw_usb_buffer_alloc(dev, size, dma);
+	
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, size
+	);
+
+	return p;
+}
+
+inline void dbg_rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma, const enum mstat_f flags, const char *func, int line)
+{
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, size);
+
+	_rtw_usb_buffer_free(dev, size, addr, dma);
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, size
+	);
+}
+#endif /* CONFIG_USB_HCI */
+#endif /* DBG_MEM_ALLOC */
+
+void* rtw_malloc2d(int h, int w, int size)
+{
+	int j;
+
+	void **a = (void **) rtw_zmalloc( h*sizeof(void *) + h*w*size );
+	if(a == NULL)
+	{
+		DBG_871X("%s: alloc memory fail!\n", __FUNCTION__);
+		return NULL;
+	}
+
+	for( j=0; j<h; j++ )
+		a[j] = ((char *)(a+h)) + j*w*size;
+
+	return a;
+}
+
+void rtw_mfree2d(void *pbuf, int h, int w, int size)
+{
+	rtw_mfree((u8 *)pbuf, h*sizeof(void*) + w*h*size);
+}
+
+void _rtw_memcpy(void* dst, const void* src, u32 sz)
+{
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+
+	memcpy(dst, src, sz);
+
+#endif	
+
+#ifdef PLATFORM_WINDOWS
+
+	NdisMoveMemory(dst, src, sz);
+
+#endif
+
+}
+
+int	_rtw_memcmp(const void *dst, const void *src, u32 sz)
+{
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+//under Linux/GNU/GLibc, the return value of memcmp for two same mem. chunk is 0
+
+	if (!(memcmp(dst, src, sz)))
+		return _TRUE;
+	else
+		return _FALSE;
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+//under Windows, the return value of NdisEqualMemory for two same mem. chunk is 1
+	
+	if (NdisEqualMemory (dst, src, sz))
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif	
+	
+	
+	
+}
+
+void _rtw_memset(void *pbuf, int c, u32 sz)
+{
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+
+        memset(pbuf, c, sz);
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+#if 0
+	NdisZeroMemory(pbuf, sz);
+	if (c != 0) memset(pbuf, c, sz);
+#else
+	NdisFillMemory(pbuf, sz, c);
+#endif
+#endif
+
+}
+
+#ifdef PLATFORM_FREEBSD
+static inline void __list_add(_list *pnew, _list *pprev, _list *pnext)
+ {
+         pnext->prev = pnew;
+         pnew->next = pnext;
+         pnew->prev = pprev;
+         pprev->next = pnew;
+}
+#endif /* PLATFORM_FREEBSD */
+
+void _rtw_init_listhead(_list *list)
+{
+
+#ifdef PLATFORM_LINUX
+
+        INIT_LIST_HEAD(list);
+
+#endif
+
+#ifdef PLATFORM_FREEBSD
+         list->next = list;
+         list->prev = list;
+#endif
+#ifdef PLATFORM_WINDOWS
+
+        NdisInitializeListHead(list);
+
+#endif
+
+}
+
+
+/*
+For the following list_xxx operations, 
+caller must guarantee the atomic context.
+Otherwise, there will be racing condition.
+*/
+u32	rtw_is_list_empty(_list *phead)
+{
+
+#ifdef PLATFORM_LINUX
+
+	if (list_empty(phead))
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+#ifdef PLATFORM_FREEBSD
+
+	if (phead->next == phead)
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+
+	if (IsListEmpty(phead))
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+
+	
+}
+
+void rtw_list_insert_head(_list *plist, _list *phead)
+{
+
+#ifdef PLATFORM_LINUX
+	list_add(plist, phead);
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	__list_add(plist, phead, phead->next);
+#endif
+
+#ifdef PLATFORM_WINDOWS
+	InsertHeadList(phead, plist);
+#endif
+}
+
+void rtw_list_insert_tail(_list *plist, _list *phead)
+{
+
+#ifdef PLATFORM_LINUX	
+	
+	list_add_tail(plist, phead);
+	
+#endif
+#ifdef PLATFORM_FREEBSD
+	
+	__list_add(plist, phead->prev, phead);
+	
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+  InsertTailList(phead, plist);
+
+#endif		
+	
+}
+
+
+/*
+
+Caller must check if the list is empty before calling rtw_list_delete
+
+*/
+
+
+void _rtw_init_sema(_sema	*sema, int init_val)
+{
+
+#ifdef PLATFORM_LINUX
+
+	sema_init(sema, init_val);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	sema_init(sema, init_val, "rtw_drv");
+#endif
+#ifdef PLATFORM_OS_XP
+
+	KeInitializeSemaphore(sema, init_val,  SEMA_UPBND); // count=0;
+
+#endif
+	
+#ifdef PLATFORM_OS_CE
+	if(*sema == NULL)
+		*sema = CreateSemaphore(NULL, init_val, SEMA_UPBND, NULL);
+#endif
+
+}
+
+void _rtw_free_sema(_sema	*sema)
+{
+#ifdef PLATFORM_FREEBSD
+	sema_destroy(sema);
+#endif
+#ifdef PLATFORM_OS_CE
+	CloseHandle(*sema);
+#endif
+
+}
+
+void _rtw_up_sema(_sema	*sema)
+{
+
+#ifdef PLATFORM_LINUX
+
+	up(sema);
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	sema_post(sema);
+#endif
+#ifdef PLATFORM_OS_XP
+
+	KeReleaseSemaphore(sema, IO_NETWORK_INCREMENT, 1,  FALSE );
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+	ReleaseSemaphore(*sema,  1,  NULL );
+#endif
+}
+
+u32 _rtw_down_sema(_sema *sema)
+{
+
+#ifdef PLATFORM_LINUX
+	
+	if (down_interruptible(sema))
+		return _FAIL;
+	else
+		return _SUCCESS;
+
+#endif    	
+#ifdef PLATFORM_FREEBSD
+	sema_wait(sema);
+	return  _SUCCESS;
+#endif
+#ifdef PLATFORM_OS_XP
+
+	if(STATUS_SUCCESS == KeWaitForSingleObject(sema, Executive, KernelMode, TRUE, NULL))
+		return  _SUCCESS;
+	else
+		return _FAIL;
+#endif
+
+#ifdef PLATFORM_OS_CE
+	if(WAIT_OBJECT_0 == WaitForSingleObject(*sema, INFINITE ))
+		return _SUCCESS; 
+	else
+		return _FAIL;
+#endif
+}
+
+
+
+void	_rtw_mutex_init(_mutex *pmutex)
+{
+#ifdef PLATFORM_LINUX
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+	mutex_init(pmutex);
+#else
+	init_MUTEX(pmutex);
+#endif
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_init(pmutex, "", NULL, MTX_DEF|MTX_RECURSE);
+#endif
+#ifdef PLATFORM_OS_XP
+
+	KeInitializeMutex(pmutex, 0);
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+	*pmutex =  CreateMutex( NULL, _FALSE, NULL);
+#endif
+}
+
+void	_rtw_mutex_free(_mutex *pmutex);
+void	_rtw_mutex_free(_mutex *pmutex)
+{
+#ifdef PLATFORM_LINUX
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+	mutex_destroy(pmutex);
+#else	
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	sema_destroy(pmutex);
+#endif
+
+#endif
+
+#ifdef PLATFORM_OS_XP
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+
+#endif
+}
+
+void	_rtw_spinlock_init(_lock *plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_lock_init(plock);
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+		mtx_init(plock, "", NULL, MTX_DEF|MTX_RECURSE);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisAllocateSpinLock(plock);
+
+#endif
+	
+}
+
+void	_rtw_spinlock_free(_lock *plock)
+{
+#ifdef PLATFORM_FREEBSD
+	 mtx_destroy(plock);
+#endif
+	
+#ifdef PLATFORM_WINDOWS
+
+	NdisFreeSpinLock(plock);
+
+#endif
+	
+}
+#ifdef PLATFORM_FREEBSD
+extern PADAPTER prtw_lock;
+
+void rtw_mtx_lock(_lock *plock){
+	if(prtw_lock){
+		mtx_lock(&prtw_lock->glock);
+	}
+	else{
+		printf("%s prtw_lock==NULL",__FUNCTION__);
+	}
+}
+void rtw_mtx_unlock(_lock *plock){
+	if(prtw_lock){
+		mtx_unlock(&prtw_lock->glock);
+	}
+	else{
+		printf("%s prtw_lock==NULL",__FUNCTION__);
+	}
+	
+}
+#endif //PLATFORM_FREEBSD
+
+
+void	_rtw_spinlock(_lock	*plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_lock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_lock(plock);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisAcquireSpinLock(plock);
+
+#endif
+	
+}
+
+void	_rtw_spinunlock(_lock *plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_unlock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_unlock(plock);
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+	NdisReleaseSpinLock(plock);
+
+#endif
+}
+
+
+void	_rtw_spinlock_ex(_lock	*plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_lock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_lock(plock);
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+	NdisDprAcquireSpinLock(plock);
+
+#endif
+	
+}
+
+void	_rtw_spinunlock_ex(_lock *plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_unlock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_unlock(plock);
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+	NdisDprReleaseSpinLock(plock);
+
+#endif
+}
+
+
+
+void	_rtw_init_queue(_queue	*pqueue)
+{
+
+	_rtw_init_listhead(&(pqueue->queue));
+
+	_rtw_spinlock_init(&(pqueue->lock));
+
+}
+
+u32	  _rtw_queue_empty(_queue	*pqueue)
+{
+	return (rtw_is_list_empty(&(pqueue->queue)));
+}
+
+
+u32 rtw_end_of_queue_search(_list *head, _list *plist)
+{
+	if (head == plist)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+
+u32	rtw_get_current_time(void)
+{
+	
+#ifdef PLATFORM_LINUX
+	return jiffies;
+#endif	
+#ifdef PLATFORM_FREEBSD
+	struct timeval tvp;
+	getmicrotime(&tvp);
+	return tvp.tv_sec;
+#endif
+#ifdef PLATFORM_WINDOWS
+	LARGE_INTEGER	SystemTime;
+	NdisGetCurrentSystemTime(&SystemTime);
+	return (u32)(SystemTime.LowPart);// count of 100-nanosecond intervals 
+#endif
+}
+
+inline u32 rtw_systime_to_ms(u32 systime)
+{
+#ifdef PLATFORM_LINUX
+	return systime * 1000 / HZ;
+#endif	
+#ifdef PLATFORM_FREEBSD
+	return systime * 1000;
+#endif	
+#ifdef PLATFORM_WINDOWS
+	return systime / 10000 ; 
+#endif
+}
+
+inline u32 rtw_ms_to_systime(u32 ms)
+{
+#ifdef PLATFORM_LINUX
+	return ms * HZ / 1000;
+#endif	
+#ifdef PLATFORM_FREEBSD
+	return ms /1000;
+#endif	
+#ifdef PLATFORM_WINDOWS
+	return ms * 10000 ; 
+#endif
+}
+
+// the input parameter start use the same unit as returned by rtw_get_current_time
+inline s32 rtw_get_passing_time_ms(u32 start)
+{
+#ifdef PLATFORM_LINUX
+	return rtw_systime_to_ms(jiffies-start);
+#endif
+#ifdef PLATFORM_FREEBSD
+	return rtw_systime_to_ms(rtw_get_current_time());
+#endif	
+#ifdef PLATFORM_WINDOWS
+	LARGE_INTEGER	SystemTime;
+	NdisGetCurrentSystemTime(&SystemTime);
+	return rtw_systime_to_ms((u32)(SystemTime.LowPart) - start) ;
+#endif
+}
+
+inline s32 rtw_get_time_interval_ms(u32 start, u32 end)
+{
+#ifdef PLATFORM_LINUX
+	return rtw_systime_to_ms(end-start);
+#endif
+#ifdef PLATFORM_FREEBSD
+	return rtw_systime_to_ms(rtw_get_current_time());
+#endif	
+#ifdef PLATFORM_WINDOWS
+	return rtw_systime_to_ms(end-start);
+#endif
+}
+	
+
+void rtw_sleep_schedulable(int ms)	
+{
+
+#ifdef PLATFORM_LINUX
+
+    u32 delta;
+    
+    delta = (ms * HZ)/1000;//(ms)
+    if (delta == 0) {
+        delta = 1;// 1 ms
+    }
+    set_current_state(TASK_INTERRUPTIBLE);
+    if (schedule_timeout(delta) != 0) {
+        return ;
+    }
+    return;
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	DELAY(ms*1000);
+	return ;
+#endif	
+	
+#ifdef PLATFORM_WINDOWS
+
+	NdisMSleep(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+}
+
+
+void rtw_msleep_os(int ms)
+{
+
+#ifdef PLATFORM_LINUX
+
+  	msleep((unsigned int)ms);
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+       //Delay for delay microseconds 
+	DELAY(ms*1000);
+	return ;
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+	NdisMSleep(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+
+}
+void rtw_usleep_os(int us)
+{
+
+#ifdef PLATFORM_LINUX
+  	
+      // msleep((unsigned int)us);
+      if ( 1 < (us/1000) )
+                msleep(1);
+      else
+		msleep( (us/1000) + 1);
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	//Delay for delay microseconds 
+	DELAY(us);
+
+	return ;
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+	NdisMSleep(us); //(us)
+
+#endif
+
+
+}
+
+
+#ifdef DBG_DELAY_OS
+void _rtw_mdelay_os(int ms, const char *func, const int line)
+{
+	#if 0
+	if(ms>10)
+		DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, ms);
+		rtw_msleep_os(ms);
+	return;
+	#endif
+
+
+	DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, ms);
+
+#if defined(PLATFORM_LINUX)
+
+   	mdelay((unsigned long)ms); 
+
+#elif defined(PLATFORM_WINDOWS)
+
+	NdisStallExecution(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+
+}
+void _rtw_udelay_os(int us, const char *func, const int line)
+{
+
+	#if 0
+	if(us > 1000) {
+	DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, us);
+		rtw_usleep_os(us);
+		return;
+	}
+	#endif 
+
+
+	DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, us);
+	
+	
+#if defined(PLATFORM_LINUX)
+
+      udelay((unsigned long)us); 
+
+#elif defined(PLATFORM_WINDOWS)
+
+	NdisStallExecution(us); //(us)
+
+#endif
+
+}
+#else
+void rtw_mdelay_os(int ms)
+{
+
+#ifdef PLATFORM_LINUX
+
+   	mdelay((unsigned long)ms); 
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	DELAY(ms*1000);
+	return ;
+#endif	
+#ifdef PLATFORM_WINDOWS
+
+	NdisStallExecution(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+
+}
+void rtw_udelay_os(int us)
+{
+
+#ifdef PLATFORM_LINUX
+
+      udelay((unsigned long)us); 
+
+#endif	
+#ifdef PLATFORM_FREEBSD
+	//Delay for delay microseconds 
+	DELAY(us);
+	return ;
+#endif		
+#ifdef PLATFORM_WINDOWS
+
+	NdisStallExecution(us); //(us)
+
+#endif
+
+}
+#endif
+
+void rtw_yield_os()
+{
+#ifdef PLATFORM_LINUX
+	yield();
+#endif
+#ifdef PLATFORM_FREEBSD
+	yield();
+#endif
+#ifdef PLATFORM_WINDOWS
+	SwitchToThread();
+#endif
+}
+
+#define RTW_SUSPEND_LOCK_NAME "rtw_wifi"
+
+#ifdef CONFIG_WAKELOCK
+static struct wake_lock rtw_suspend_lock;
+#elif defined(CONFIG_ANDROID_POWER)
+static android_suspend_lock_t rtw_suspend_lock ={
+	.name = RTW_SUSPEND_LOCK_NAME
+};
+#endif
+
+inline void rtw_suspend_lock_init()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock_init(&rtw_suspend_lock, WAKE_LOCK_SUSPEND, RTW_SUSPEND_LOCK_NAME);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_init_suspend_lock(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_suspend_lock_uninit()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock_destroy(&rtw_suspend_lock);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_uninit_suspend_lock(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_lock_suspend()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock(&rtw_suspend_lock);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_lock_suspend(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_unlock_suspend()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_unlock(&rtw_suspend_lock);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_unlock_suspend(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_lock_suspend_timeout(u32 timeout_ms)
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock_timeout(&rtw_suspend_lock, rtw_ms_to_systime(timeout_ms));
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_lock_suspend_auto_expire(&rtw_suspend_lock, rtw_ms_to_systime(timeout_ms));
+	#endif
+}
+
+inline void ATOMIC_SET(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_set(v,i);
+	#elif defined(PLATFORM_WINDOWS)
+	*v=i;// other choice????
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_set_int(v,i);
+	#endif
+}
+
+inline int ATOMIC_READ(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_read(v);
+	#elif defined(PLATFORM_WINDOWS)
+	return *v; // other choice????
+	#elif defined(PLATFORM_FREEBSD)
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline void ATOMIC_ADD(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_add(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedAdd(v,i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,i);
+	#endif
+}
+inline void ATOMIC_SUB(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_sub(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedAdd(v,-i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,i);
+	#endif
+}
+
+inline void ATOMIC_INC(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_inc(v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedIncrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,1);
+	#endif
+}
+
+inline void ATOMIC_DEC(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_dec(v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedDecrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,1);
+	#endif
+}
+
+inline int ATOMIC_ADD_RETURN(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_add_return(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedAdd(v,i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,i);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline int ATOMIC_SUB_RETURN(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_sub_return(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedAdd(v,-i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,i);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline int ATOMIC_INC_RETURN(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_inc_return(v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedIncrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,1);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline int ATOMIC_DEC_RETURN(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_dec_return(v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedDecrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,1);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+
+#ifdef PLATFORM_LINUX
+/*
+* Open a file with the specific @param path, @param flag, @param mode
+* @param fpp the pointer of struct file pointer to get struct file pointer while file opening is success
+* @param path the path of the file to open
+* @param flag file operation flags, please refer to linux document
+* @param mode please refer to linux document
+* @return Linux specific error code
+*/
+static int openFile(struct file **fpp, char *path, int flag, int mode) 
+{ 
+	struct file *fp; 
+ 
+	fp=filp_open(path, flag, mode); 
+	if(IS_ERR(fp)) {
+		*fpp=NULL;
+		return PTR_ERR(fp);
+	}
+	else {
+		*fpp=fp; 
+		return 0;
+	}	
+}
+
+/*
+* Close the file with the specific @param fp
+* @param fp the pointer of struct file to close
+* @return always 0
+*/
+static int closeFile(struct file *fp) 
+{ 
+	filp_close(fp,NULL);
+	return 0; 
+}
+
+static int readFile(struct file *fp,char *buf,int len) 
+{ 
+	int rlen=0, sum=0;
+	
+	if (!fp->f_op || !fp->f_op->read) 
+		return -EPERM;
+
+	while(sum<len) {
+		rlen=fp->f_op->read(fp,buf+sum,len-sum, &fp->f_pos);
+		if(rlen>0)
+			sum+=rlen;
+		else if(0 != rlen)
+			return rlen;
+		else
+			break;
+	}
+	
+	return  sum;
+
+}
+
+static int writeFile(struct file *fp,char *buf,int len) 
+{ 
+	int wlen=0, sum=0;
+	
+	if (!fp->f_op || !fp->f_op->write) 
+		return -EPERM; 
+
+	while(sum<len) {
+		wlen=fp->f_op->write(fp,buf+sum,len-sum, &fp->f_pos);
+		if(wlen>0)
+			sum+=wlen;
+		else if(0 != wlen)
+			return wlen;
+		else
+			break;
+	}
+
+	return sum;
+
+}
+
+/*
+* Test if the specifi @param path is a file and readable
+* @param path the path of the file to test
+* @return Linux specific error code
+*/
+static int isFileReadable(char *path)
+{ 
+	struct file *fp;
+	int ret = 0;
+	mm_segment_t oldfs;
+	char buf;
+ 
+	fp=filp_open(path, O_RDONLY, 0); 
+	if(IS_ERR(fp)) {
+		ret = PTR_ERR(fp);
+	}
+	else {
+		oldfs = get_fs(); set_fs(get_ds());
+		
+		if(1!=readFile(fp, &buf, 1))
+			ret = PTR_ERR(fp);
+		
+		set_fs(oldfs);
+		filp_close(fp,NULL);
+	}	
+	return ret;
+}
+
+/*
+* Open the file with @param path and retrive the file content into memory starting from @param buf for @param sz at most
+* @param path the path of the file to open and read
+* @param buf the starting address of the buffer to store file content
+* @param sz how many bytes to read at most
+* @return the byte we've read, or Linux specific error code
+*/
+static int retriveFromFile(char *path, u8* buf, u32 sz)
+{
+	int ret =-1;
+	mm_segment_t oldfs;
+	struct file *fp;
+
+	if(path && buf) {
+		if( 0 == (ret=openFile(&fp,path, O_RDONLY, 0)) ){
+			DBG_871X("%s openFile path:%s fp=%p\n",__FUNCTION__, path ,fp);
+
+			oldfs = get_fs(); set_fs(get_ds());
+			ret=readFile(fp, buf, sz);
+			set_fs(oldfs);
+			closeFile(fp);
+			
+			DBG_871X("%s readFile, ret:%d\n",__FUNCTION__, ret);
+			
+		} else {
+			DBG_871X("%s openFile path:%s Fail, ret:%d\n",__FUNCTION__, path, ret);
+		}
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret =  -EINVAL;
+	}
+	return ret;
+}
+
+/*
+* Open the file with @param path and wirte @param sz byte of data starting from @param buf into the file
+* @param path the path of the file to open and write
+* @param buf the starting address of the data to write into file
+* @param sz how many bytes to write at most
+* @return the byte we've written, or Linux specific error code
+*/
+static int storeToFile(char *path, u8* buf, u32 sz)
+{
+	int ret =0;
+	mm_segment_t oldfs;
+	struct file *fp;
+	
+	if(path && buf) {
+		if( 0 == (ret=openFile(&fp, path, O_CREAT|O_WRONLY, 0666)) ) {
+			DBG_871X("%s openFile path:%s fp=%p\n",__FUNCTION__, path ,fp);
+
+			oldfs = get_fs(); set_fs(get_ds());
+			ret=writeFile(fp, buf, sz);
+			set_fs(oldfs);
+			closeFile(fp);
+
+			DBG_871X("%s writeFile, ret:%d\n",__FUNCTION__, ret);
+			
+		} else {
+			DBG_871X("%s openFile path:%s Fail, ret:%d\n",__FUNCTION__, path, ret);
+		}	
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret =  -EINVAL;
+	}
+	return ret;
+}
+#endif //PLATFORM_LINUX
+
+/*
+* Test if the specifi @param path is a file and readable
+* @param path the path of the file to test
+* @return _TRUE or _FALSE
+*/
+int rtw_is_file_readable(char *path)
+{
+#ifdef PLATFORM_LINUX
+	if(isFileReadable(path) == 0)
+		return _TRUE;
+	else
+		return _FALSE;
+#else
+	//Todo...
+	return _FALSE;
+#endif
+}
+
+/*
+* Open the file with @param path and retrive the file content into memory starting from @param buf for @param sz at most
+* @param path the path of the file to open and read
+* @param buf the starting address of the buffer to store file content
+* @param sz how many bytes to read at most
+* @return the byte we've read
+*/
+int rtw_retrive_from_file(char *path, u8* buf, u32 sz)
+{
+#ifdef PLATFORM_LINUX
+	int ret =retriveFromFile(path, buf, sz);
+	return ret>=0?ret:0;
+#else
+	//Todo...
+	return 0;
+#endif
+}
+
+/*
+* Open the file with @param path and wirte @param sz byte of data starting from @param buf into the file
+* @param path the path of the file to open and write
+* @param buf the starting address of the data to write into file
+* @param sz how many bytes to write at most
+* @return the byte we've written
+*/
+int rtw_store_to_file(char *path, u8* buf, u32 sz)
+{
+#ifdef PLATFORM_LINUX
+	int ret =storeToFile(path, buf, sz);
+	return ret>=0?ret:0;
+#else
+	//Todo...
+	return 0;
+#endif
+}
+
+#if 1 //#ifdef MEM_ALLOC_REFINE_ADAPTOR
+#ifdef PLATFORM_LINUX
+struct net_device *rtw_alloc_etherdev_with_old_priv(int sizeof_priv, void *old_priv)
+{
+	struct net_device *pnetdev;
+	struct rtw_netdev_priv_indicator *pnpi;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	pnetdev = alloc_etherdev_mq(sizeof(struct rtw_netdev_priv_indicator), 4);
+#else
+	pnetdev = alloc_etherdev(sizeof(struct rtw_netdev_priv_indicator));
+#endif
+	if (!pnetdev)
+		goto RETURN;
+	
+	pnpi = netdev_priv(pnetdev);
+	pnpi->priv=old_priv;
+	pnpi->sizeof_priv=sizeof_priv;
+
+RETURN:
+	return pnetdev;
+}
+
+struct net_device *rtw_alloc_etherdev(int sizeof_priv)
+{
+	struct net_device *pnetdev;
+	struct rtw_netdev_priv_indicator *pnpi;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	pnetdev = alloc_etherdev_mq(sizeof(struct rtw_netdev_priv_indicator), 4);
+#else
+	pnetdev = alloc_etherdev(sizeof(struct rtw_netdev_priv_indicator));
+#endif
+	if (!pnetdev)
+		goto RETURN;
+	
+	pnpi = netdev_priv(pnetdev);
+	
+	pnpi->priv = rtw_zvmalloc(sizeof_priv);
+	if (!pnpi->priv) {
+		free_netdev(pnetdev);
+		pnetdev = NULL;
+		goto RETURN;
+	}
+	
+	pnpi->sizeof_priv=sizeof_priv;
+RETURN:
+	return pnetdev;
+}
+
+void rtw_free_netdev(struct net_device * netdev)
+{
+	struct rtw_netdev_priv_indicator *pnpi;
+	
+	if(!netdev)
+		goto RETURN;
+	
+	pnpi = netdev_priv(netdev);
+
+	if(!pnpi->priv)
+		goto RETURN;
+
+	rtw_vmfree(pnpi->priv, pnpi->sizeof_priv);
+	free_netdev(netdev);
+
+RETURN:
+	return;
+}
+
+/*
+* Jeff: this function should be called under ioctl (rtnl_lock is accquired) while 
+* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)
+*/
+int rtw_change_ifname(_adapter *padapter, const char *ifname)
+{
+	struct net_device *pnetdev;
+	struct net_device *cur_pnetdev = padapter->pnetdev;
+	struct rereg_nd_name_data *rereg_priv;
+	int ret;
+
+	if(!padapter)
+		goto error;
+
+	rereg_priv = &padapter->rereg_nd_name_priv;
+	
+	//free the old_pnetdev
+	if(rereg_priv->old_pnetdev) {
+		free_netdev(rereg_priv->old_pnetdev);
+		rereg_priv->old_pnetdev = NULL;
+	}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26))
+	if(!rtnl_is_locked())
+		unregister_netdev(cur_pnetdev);
+	else
+#endif
+		unregister_netdevice(cur_pnetdev);
+
+	rtw_proc_remove_one(cur_pnetdev);
+
+	rereg_priv->old_pnetdev=cur_pnetdev;
+
+	pnetdev = rtw_init_netdev(padapter);
+	if (!pnetdev)  {
+		ret = -1;
+		goto error;
+	}
+
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(adapter_to_dvobj(padapter)));
+
+	rtw_init_netdev_name(pnetdev, ifname);
+
+	_rtw_memcpy(pnetdev->dev_addr, padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26))
+	if(!rtnl_is_locked())
+		ret = register_netdev(pnetdev);
+	else
+#endif
+		ret = register_netdevice(pnetdev);
+
+	if ( ret != 0) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("register_netdev() failed\n"));
+		goto error;
+	}
+
+	rtw_proc_init_one(pnetdev);
+
+	return 0;
+
+error:
+	
+	return -1;
+	
+}
+#endif
+#endif //MEM_ALLOC_REFINE_ADAPTOR
+
+#ifdef PLATFORM_FREEBSD
+/*
+ * Copy a buffer from userspace and write into kernel address 
+ * space.
+ *
+ * This emulation just calls the FreeBSD copyin function (to 
+ * copy data from user space buffer into a kernel space buffer)
+ * and is designed to be used with the above io_write_wrapper.
+ *
+ * This function should return the number of bytes not copied.
+ * I.e. success results in a zero value. 
+ * Negative error values are not returned.
+ */
+unsigned long
+copy_from_user(void *to, const void *from, unsigned long n)
+{      
+        if ( copyin(from, to, n) != 0 ) {
+                /* Any errors will be treated as a failure
+                   to copy any of the requested bytes */
+                return n;
+        }
+
+        return 0;
+}
+
+unsigned long
+copy_to_user(void *to, const void *from, unsigned long n)
+{
+	if ( copyout(from, to, n) != 0 ) {
+		/* Any errors will be treated as a failure
+		   to copy any of the requested bytes */
+		return n;
+	}
+
+	return 0;
+}
+
+
+/*
+ * The usb_register and usb_deregister functions are used to register
+ * usb drivers with the usb subsystem. In this compatibility layer
+ * emulation a list of drivers (struct usb_driver) is maintained
+ * and is used for probing/attaching etc.
+ *
+ * usb_register and usb_deregister simply call these functions.
+ */
+int 
+usb_register(struct usb_driver *driver)
+{
+        rtw_usb_linux_register(driver);
+        return 0;
+}
+
+
+int 
+usb_deregister(struct usb_driver *driver)
+{
+        rtw_usb_linux_deregister(driver);
+        return 0;
+}
+
+void module_init_exit_wrapper(void *arg)
+{
+        int (*func)(void) = arg;
+        func();
+        return;
+}
+
+#endif //PLATFORM_FREEBSD
+u64 rtw_modular64(u64 x, u64 y)
+{
+#ifdef PLATFORM_LINUX
+	return do_div(x, y);
+#elif defined(PLATFORM_WINDOWS)
+	return (x % y);
+#elif defined(PLATFORM_FREEBSD)
+	return (x %y);
+#endif
+}
+
+u64 rtw_division64(u64 x, u64 y)
+{
+#ifdef PLATFORM_LINUX
+	do_div(x, y);
+	return x;
+#elif defined(PLATFORM_WINDOWS)
+	return (x / y);
+#elif defined(PLATFORM_FREEBSD)
+	return (x / y);
+#endif
+}
+
+void rtw_buf_free(u8 **buf, u32 *buf_len)
+{
+	u32 ori_len;
+
+	if (!buf || !buf_len)
+		return;
+
+	ori_len = *buf_len;
+
+	if (*buf) {
+		u32 tmp_buf_len = *buf_len;
+		*buf_len = 0;
+		rtw_mfree(*buf, tmp_buf_len);
+		*buf = NULL;
+	}
+}
+
+void rtw_buf_update(u8 **buf, u32 *buf_len, u8 *src, u32 src_len)
+{
+	u32 ori_len = 0, dup_len = 0;
+	u8 *ori = NULL;
+	u8 *dup = NULL;
+
+	if (!buf || !buf_len)
+		return;
+
+	if (!src || !src_len)
+		goto keep_ori;
+
+	/* duplicate src */
+	dup = rtw_malloc(src_len);
+	if (dup) {
+		dup_len = src_len;
+		_rtw_memcpy(dup, src, dup_len);
+	}
+
+keep_ori:
+	ori = *buf;
+	ori_len = *buf_len;
+
+	/* replace buf with dup */
+	*buf_len = 0;
+	*buf = dup;
+	*buf_len = dup_len;
+
+	/* free ori */
+	if (ori && ori_len > 0)
+		rtw_mfree(ori, ori_len);
+}
+
+
+/**
+ * rtw_cbuf_full - test if cbuf is full
+ * @cbuf: pointer of struct rtw_cbuf
+ *
+ * Returns: _TRUE if cbuf is full
+ */
+inline bool rtw_cbuf_full(struct rtw_cbuf *cbuf)
+{
+	return (cbuf->write == cbuf->read-1)? _TRUE : _FALSE;
+}
+
+/**
+ * rtw_cbuf_empty - test if cbuf is empty
+ * @cbuf: pointer of struct rtw_cbuf
+ *
+ * Returns: _TRUE if cbuf is empty
+ */
+inline bool rtw_cbuf_empty(struct rtw_cbuf *cbuf)
+{
+	return (cbuf->write == cbuf->read)? _TRUE : _FALSE;
+}
+
+/**
+ * rtw_cbuf_push - push a pointer into cbuf
+ * @cbuf: pointer of struct rtw_cbuf
+ * @buf: pointer to push in
+ *
+ * Lock free operation, be careful of the use scheme
+ * Returns: _TRUE push success
+ */
+bool rtw_cbuf_push(struct rtw_cbuf *cbuf, void *buf)
+{
+	if (rtw_cbuf_full(cbuf))
+		return _FAIL;
+
+	if (0)
+		DBG_871X("%s on %u\n", __func__, cbuf->write);
+	cbuf->bufs[cbuf->write] = buf;
+	cbuf->write = (cbuf->write+1)%cbuf->size;
+
+	return _SUCCESS;
+}
+
+/**
+ * rtw_cbuf_pop - pop a pointer from cbuf
+ * @cbuf: pointer of struct rtw_cbuf
+ *
+ * Lock free operation, be careful of the use scheme
+ * Returns: pointer popped out
+ */
+void *rtw_cbuf_pop(struct rtw_cbuf *cbuf)
+{
+	void *buf;
+	if (rtw_cbuf_empty(cbuf))
+		return NULL;
+
+	if (0)
+		DBG_871X("%s on %u\n", __func__, cbuf->read);
+	buf = cbuf->bufs[cbuf->read];
+	cbuf->read = (cbuf->read+1)%cbuf->size;
+
+	return buf;
+}
+
+/**
+ * rtw_cbuf_alloc - allocte a rtw_cbuf with given size and do initialization
+ * @size: size of pointer
+ *
+ * Returns: pointer of srtuct rtw_cbuf, NULL for allocation failure
+ */
+struct rtw_cbuf *rtw_cbuf_alloc(u32 size)
+{
+	struct rtw_cbuf *cbuf;
+
+	cbuf = (struct rtw_cbuf *)rtw_malloc(sizeof(*cbuf) + sizeof(void*)*size);
+
+	if (cbuf) {
+		cbuf->write = cbuf->read = 0;
+		cbuf->size = size;
+	}
+
+	return cbuf;
+}
+
+/**
+ * rtw_cbuf_free - free the given rtw_cbuf
+ * @cbuf: pointer of struct rtw_cbuf to free
+ */
+void rtw_cbuf_free(struct rtw_cbuf *cbuf)
+{
+	rtw_mfree((u8*)cbuf, sizeof(*cbuf) + sizeof(void*)*cbuf->size);
+}
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/runwpa b/drivers/net/wireless/realtek/rtl8192cu/runwpa
new file mode 100755
index 0000000000000..f825e8bdb123a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/runwpa
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+if [ "`which iwconfig`" = "" ] ; then 
+	echo "WARNING:Wireless tool not exist!"
+	echo "        Please install it!"
+	exit
+else
+	if [ `uname -r | cut -d. -f2` -eq 4 ]; then
+		wpa_supplicant -D ipw -c wpa1.conf -i wlan0	
+	else
+	if [ `iwconfig -v |awk '{print $4}' | head -n 1` -lt  18 ] ; then
+		wpa_supplicant -D ipw -c wpa1.conf -i wlan0  
+	else	  
+		wpa_supplicant -D wext -c wpa1.conf -i wlan0 
+	fi
+
+	fi
+fi
+
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp b/drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp
new file mode 100755
index 0000000000000..24ab3720bef62
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+var0=`ps aux|awk '/dhclient wlan0/'|awk '$11!="awk"{print $2}'`
+
+kill $var0
+cp ifcfg-wlan0 /etc/sysconfig/network-scripts/
+
+dhclient wlan0
+
+var1=`ifconfig wlan0 |awk '/inet/{print $2}'|awk -F: '{print $2}'`
+
+
+rm -f /etc/sysconfig/network-scripts/ifcfg-wlan0
+
+echo "get ip: $var1"
-- 
GitLab


From c997ff2f4ced80be724c52e1105f75ece966765b Mon Sep 17 00:00:00 2001
From: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Date: Wed, 3 Dec 2014 13:23:28 +0200
Subject: [PATCH 0092/1835] OF: DT-Overlay configfs interface

This is a port of Pantelis Antoniou's v3 port that makes use of the
new upstreamed configfs support for binary attributes.

Original commit message:

Add a runtime interface to using configfs for generic device tree overlay
usage. With it its possible to use device tree overlays without having
to use a per-platform overlay manager.

Please see Documentation/devicetree/configfs-overlays.txt for more info.

Changes since v2:
- Removed ifdef CONFIG_OF_OVERLAY (since for now it's required)
- Created a documentation entry
- Slight rewording in Kconfig

Changes since v1:
- of_resolve() -> of_resolve_phandles().

Originally-signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Phil Elwell <phil@raspberrypi.org>

DT configfs: Fix build errors on other platforms

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

DT configfs: fix build error

There is an error when compiling rpi-4.6.y branch:
  CC      drivers/of/configfs.o
drivers/of/configfs.c:291:21: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
   .default_groups = of_cfs_def_groups,
                     ^
drivers/of/configfs.c:291:21: note: (near initialization for 'of_cfs_subsys.su_group.default_groups.next')

The .default_groups is linked list since commit
1ae1602de028acaa42a0f6ff18d19756f8e825c6.
This commit uses configfs_add_default_group to fix this problem.

Signed-off-by: Slawomir Stepien <sst@poczta.fm>

configfs: New of_overlay API
---
 .../devicetree/configfs-overlays.txt          |  31 ++
 drivers/of/Kconfig                            |   7 +
 drivers/of/Makefile                           |   1 +
 drivers/of/configfs.c                         | 310 ++++++++++++++++++
 4 files changed, 349 insertions(+)
 create mode 100644 Documentation/devicetree/configfs-overlays.txt
 create mode 100644 drivers/of/configfs.c

diff --git a/Documentation/devicetree/configfs-overlays.txt b/Documentation/devicetree/configfs-overlays.txt
new file mode 100644
index 0000000000000..5fa43e0643072
--- /dev/null
+++ b/Documentation/devicetree/configfs-overlays.txt
@@ -0,0 +1,31 @@
+Howto use the configfs overlay interface.
+
+A device-tree configfs entry is created in /config/device-tree/overlays
+and and it is manipulated using standard file system I/O.
+Note that this is a debug level interface, for use by developers and
+not necessarily something accessed by normal users due to the
+security implications of having direct access to the kernel's device tree.
+
+* To create an overlay you mkdir the directory:
+
+	# mkdir /config/device-tree/overlays/foo
+
+* Either you echo the overlay firmware file to the path property file.
+
+	# echo foo.dtbo >/config/device-tree/overlays/foo/path
+
+* Or you cat the contents of the overlay to the dtbo file
+
+	# cat foo.dtbo >/config/device-tree/overlays/foo/dtbo
+
+The overlay file will be applied, and devices will be created/destroyed
+as required.
+
+To remove it simply rmdir the directory.
+
+	# rmdir /config/device-tree/overlays/foo
+
+The rationalle of the dual interface (firmware & direct copy) is that each is
+better suited to different use patterns. The firmware interface is what's
+intended to be used by hardware managers in the kernel, while the copy interface
+make sense for developers (since it avoids problems with namespaces).
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index ad3fcad4d75b8..3c808e2cd26c6 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -103,4 +103,11 @@ config OF_OVERLAY
 config OF_NUMA
 	bool
 
+config OF_CONFIGFS
+	bool "Device Tree Overlay ConfigFS interface"
+	select CONFIGFS_FS
+	select OF_OVERLAY
+	help
+	  Enable a simple user-space driven DT overlay interface.
+
 endif # OF
diff --git a/drivers/of/Makefile b/drivers/of/Makefile
index 663a4af0cccd5..b00a95adf5199 100644
--- a/drivers/of/Makefile
+++ b/drivers/of/Makefile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y = base.o device.o platform.o property.o
 obj-$(CONFIG_OF_KOBJ) += kobj.o
+obj-$(CONFIG_OF_CONFIGFS) += configfs.o
 obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
 obj-$(CONFIG_OF_FLATTREE) += fdt.o
 obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o
diff --git a/drivers/of/configfs.c b/drivers/of/configfs.c
new file mode 100644
index 0000000000000..178f0629b0f01
--- /dev/null
+++ b/drivers/of/configfs.c
@@ -0,0 +1,310 @@
+/*
+ * Configfs entries for device-tree
+ *
+ * Copyright (C) 2013 - Pantelis Antoniou <panto@antoniou-consulting.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/ctype.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/proc_fs.h>
+#include <linux/configfs.h>
+#include <linux/types.h>
+#include <linux/stat.h>
+#include <linux/limits.h>
+#include <linux/file.h>
+#include <linux/vmalloc.h>
+#include <linux/firmware.h>
+#include <linux/sizes.h>
+
+#include "of_private.h"
+
+struct cfs_overlay_item {
+	struct config_item	item;
+
+	char			path[PATH_MAX];
+
+	const struct firmware	*fw;
+	struct device_node	*overlay;
+	int			ov_id;
+
+	void			*dtbo;
+	int			dtbo_size;
+};
+
+static int create_overlay(struct cfs_overlay_item *overlay, void *blob)
+{
+	int err;
+
+	/* unflatten the tree */
+	of_fdt_unflatten_tree(blob, NULL, &overlay->overlay);
+	if (overlay->overlay == NULL) {
+		pr_err("%s: failed to unflatten tree\n", __func__);
+		err = -EINVAL;
+		goto out_err;
+	}
+	pr_debug("%s: unflattened OK\n", __func__);
+
+	/* mark it as detached */
+	of_node_set_flag(overlay->overlay, OF_DETACHED);
+
+	/* perform resolution */
+	err = of_resolve_phandles(overlay->overlay);
+	if (err != 0) {
+		pr_err("%s: Failed to resolve tree\n", __func__);
+		goto out_err;
+	}
+	pr_debug("%s: resolved OK\n", __func__);
+
+	err = of_overlay_apply(overlay->overlay, &overlay->ov_id);
+	if (err < 0) {
+		pr_err("%s: Failed to create overlay (err=%d)\n",
+				__func__, err);
+		goto out_err;
+	}
+
+out_err:
+	return err;
+}
+
+static inline struct cfs_overlay_item *to_cfs_overlay_item(
+		struct config_item *item)
+{
+	return item ? container_of(item, struct cfs_overlay_item, item) : NULL;
+}
+
+static ssize_t cfs_overlay_item_path_show(struct config_item *item,
+		char *page)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	return sprintf(page, "%s\n", overlay->path);
+}
+
+static ssize_t cfs_overlay_item_path_store(struct config_item *item,
+		const char *page, size_t count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	const char *p = page;
+	char *s;
+	int err;
+
+	/* if it's set do not allow changes */
+	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
+		return -EPERM;
+
+	/* copy to path buffer (and make sure it's always zero terminated */
+	count = snprintf(overlay->path, sizeof(overlay->path) - 1, "%s", p);
+	overlay->path[sizeof(overlay->path) - 1] = '\0';
+
+	/* strip trailing newlines */
+	s = overlay->path + strlen(overlay->path);
+	while (s > overlay->path && *--s == '\n')
+		*s = '\0';
+
+	pr_debug("%s: path is '%s'\n", __func__, overlay->path);
+
+	err = request_firmware(&overlay->fw, overlay->path, NULL);
+	if (err != 0)
+		goto out_err;
+
+	err = create_overlay(overlay, (void *)overlay->fw->data);
+	if (err != 0)
+		goto out_err;
+
+	return count;
+
+out_err:
+
+	release_firmware(overlay->fw);
+	overlay->fw = NULL;
+
+	overlay->path[0] = '\0';
+	return err;
+}
+
+static ssize_t cfs_overlay_item_status_show(struct config_item *item,
+		char *page)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	return sprintf(page, "%s\n",
+			overlay->ov_id >= 0 ? "applied" : "unapplied");
+}
+
+CONFIGFS_ATTR(cfs_overlay_item_, path);
+CONFIGFS_ATTR_RO(cfs_overlay_item_, status);
+
+static struct configfs_attribute *cfs_overlay_attrs[] = {
+	&cfs_overlay_item_attr_path,
+	&cfs_overlay_item_attr_status,
+	NULL,
+};
+
+ssize_t cfs_overlay_item_dtbo_read(struct config_item *item,
+		void *buf, size_t max_count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	pr_debug("%s: buf=%p max_count=%zu\n", __func__,
+			buf, max_count);
+
+	if (overlay->dtbo == NULL)
+		return 0;
+
+	/* copy if buffer provided */
+	if (buf != NULL) {
+		/* the buffer must be large enough */
+		if (overlay->dtbo_size > max_count)
+			return -ENOSPC;
+
+		memcpy(buf, overlay->dtbo, overlay->dtbo_size);
+	}
+
+	return overlay->dtbo_size;
+}
+
+ssize_t cfs_overlay_item_dtbo_write(struct config_item *item,
+		const void *buf, size_t count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	int err;
+
+	/* if it's set do not allow changes */
+	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
+		return -EPERM;
+
+	/* copy the contents */
+	overlay->dtbo = kmemdup(buf, count, GFP_KERNEL);
+	if (overlay->dtbo == NULL)
+		return -ENOMEM;
+
+	overlay->dtbo_size = count;
+
+	err = create_overlay(overlay, overlay->dtbo);
+	if (err != 0)
+		goto out_err;
+
+	return count;
+
+out_err:
+	kfree(overlay->dtbo);
+	overlay->dtbo = NULL;
+	overlay->dtbo_size = 0;
+
+	return err;
+}
+
+CONFIGFS_BIN_ATTR(cfs_overlay_item_, dtbo, NULL, SZ_1M);
+
+static struct configfs_bin_attribute *cfs_overlay_bin_attrs[] = {
+	&cfs_overlay_item_attr_dtbo,
+	NULL,
+};
+
+static void cfs_overlay_release(struct config_item *item)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	if (overlay->ov_id >= 0)
+		of_overlay_remove(&overlay->ov_id);
+	if (overlay->fw)
+		release_firmware(overlay->fw);
+	/* kfree with NULL is safe */
+	kfree(overlay->dtbo);
+	kfree(overlay);
+}
+
+static struct configfs_item_operations cfs_overlay_item_ops = {
+	.release	= cfs_overlay_release,
+};
+
+static struct config_item_type cfs_overlay_type = {
+	.ct_item_ops	= &cfs_overlay_item_ops,
+	.ct_attrs	= cfs_overlay_attrs,
+	.ct_bin_attrs	= cfs_overlay_bin_attrs,
+	.ct_owner	= THIS_MODULE,
+};
+
+static struct config_item *cfs_overlay_group_make_item(
+		struct config_group *group, const char *name)
+{
+	struct cfs_overlay_item *overlay;
+
+	overlay = kzalloc(sizeof(*overlay), GFP_KERNEL);
+	if (!overlay)
+		return ERR_PTR(-ENOMEM);
+	overlay->ov_id = -1;
+
+	config_item_init_type_name(&overlay->item, name, &cfs_overlay_type);
+	return &overlay->item;
+}
+
+static void cfs_overlay_group_drop_item(struct config_group *group,
+		struct config_item *item)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	config_item_put(&overlay->item);
+}
+
+static struct configfs_group_operations overlays_ops = {
+	.make_item	= cfs_overlay_group_make_item,
+	.drop_item	= cfs_overlay_group_drop_item,
+};
+
+static struct config_item_type overlays_type = {
+	.ct_group_ops   = &overlays_ops,
+	.ct_owner       = THIS_MODULE,
+};
+
+static struct configfs_group_operations of_cfs_ops = {
+	/* empty - we don't allow anything to be created */
+};
+
+static struct config_item_type of_cfs_type = {
+	.ct_group_ops   = &of_cfs_ops,
+	.ct_owner       = THIS_MODULE,
+};
+
+struct config_group of_cfs_overlay_group;
+
+static struct configfs_subsystem of_cfs_subsys = {
+	.su_group = {
+		.cg_item = {
+			.ci_namebuf = "device-tree",
+			.ci_type = &of_cfs_type,
+		},
+	},
+	.su_mutex = __MUTEX_INITIALIZER(of_cfs_subsys.su_mutex),
+};
+
+static int __init of_cfs_init(void)
+{
+	int ret;
+
+	pr_info("%s\n", __func__);
+
+	config_group_init(&of_cfs_subsys.su_group);
+	config_group_init_type_name(&of_cfs_overlay_group, "overlays",
+			&overlays_type);
+	configfs_add_default_group(&of_cfs_overlay_group,
+			&of_cfs_subsys.su_group);
+
+	ret = configfs_register_subsystem(&of_cfs_subsys);
+	if (ret != 0) {
+		pr_err("%s: failed to register subsys\n", __func__);
+		goto out;
+	}
+	pr_info("%s: OK\n", __func__);
+out:
+	return ret;
+}
+late_initcall(of_cfs_init);
-- 
GitLab


From c7f28d574764b9f88d7811cbff29c7d87f01c26d Mon Sep 17 00:00:00 2001
From: Cheong2K <cheong@redbear.cc>
Date: Fri, 26 Feb 2016 18:20:10 +0800
Subject: [PATCH 0093/1835] brcm: adds support for BCM43341 wifi

brcmfmac: Disable power management

Disable wireless power saving in the brcmfmac WLAN driver. This is a
temporary measure until the connectivity loss resulting from power
saving is resolved.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

brcmfmac: Use original country code as a fallback

Commit 73345fd212980d2e28a5c6d83801c903bd773680:

    brcmfmac: Configure country code using device specific settings

prevents region codes from working on devices that lack a region code
translation table. In the event of an absent table, preserve the old
behaviour of using the provided code as-is.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

brcmfmac: Plug memory leak in brcmf_fill_bss_param

See: https://github.com/raspberrypi/linux/issues/1471

Signed-off-by: Phil Elwell <phil@raspberrypi.org>

brcmfmac: do not use internal roaming engine by default

Some evidence of curing disconnects with this disabled, so make it a default.
Can be overridden with module parameter roamoff=0
See: http://projectable.me/optimize-my-pi-wi-fi/

brcmfmac: Change stop_ap sequence

Patch from Broadcom/Cypress to resolve a customer error

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 22 ++++++++++++++-----
 .../broadcom/brcm80211/brcmfmac/common.c      |  2 +-
 .../broadcom/brcm80211/brcmfmac/sdio.c        |  3 ++-
 3 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 6f3faaf1b1cbb..72822c828a99e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -2697,6 +2697,8 @@ brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
 	 * preference in cfg struct to apply this to
 	 * FW later while initializing the dongle
 	 */
+	pr_info("power management disabled\n");
+	enabled = false;
 	cfg->pwr_save = enabled;
 	if (!check_vif_up(ifp->vif)) {
 
@@ -6770,12 +6772,18 @@ static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
 	struct brcmfmac_pd_cc *country_codes;
 	struct brcmfmac_pd_cc_entry *cc;
 	s32 found_index;
+	char ccode[BRCMF_COUNTRY_BUF_SZ];
+	int rev;
 	int i;
 
+	memcpy(ccode, alpha2, sizeof(ccode));
+	rev = -1;
+
 	country_codes = drvr->settings->country_codes;
 	if (!country_codes) {
-		brcmf_dbg(TRACE, "No country codes configured for device\n");
-		return -EINVAL;
+		brcmf_dbg(TRACE, "No country codes configured for device"
+				 " - use requested value\n");
+		goto use_input_value;
 	}
 
 	if ((alpha2[0] == ccreq->country_abbrev[0]) &&
@@ -6799,10 +6807,14 @@ static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
 		brcmf_dbg(TRACE, "No country code match found\n");
 		return -EINVAL;
 	}
-	memset(ccreq, 0, sizeof(*ccreq));
-	ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
-	memcpy(ccreq->ccode, country_codes->table[found_index].cc,
+	rev = country_codes->table[found_index].rev;
+	memcpy(ccode, country_codes->table[found_index].cc,
 	       BRCMF_COUNTRY_BUF_SZ);
+
+use_input_value:
+	memset(ccreq, 0, sizeof(*ccreq));
+	ccreq->rev = cpu_to_le32(rev);
+	memcpy(ccreq->ccode, ccode, sizeof(ccode));
 	ccreq->country_abbrev[0] = alpha2[0];
 	ccreq->country_abbrev[1] = alpha2[1];
 	ccreq->country_abbrev[2] = 0;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index 27893af63ebc3..d238d859189af 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -70,7 +70,7 @@ static int brcmf_fcmode;
 module_param_named(fcmode, brcmf_fcmode, int, 0);
 MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
 
-static int brcmf_roamoff;
+static int brcmf_roamoff = 1;
 module_param_named(roamoff, brcmf_roamoff, int, 0400);
 MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index a907d7b065fa8..7efe5df07ad0d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -608,6 +608,7 @@ BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
 BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
 BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
 BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
+BRCMF_FW_DEF(43341, "brcmfmac43341-sdio");
 BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
 BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
 BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
@@ -628,7 +629,7 @@ static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
 	BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
 	BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
 	BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
-	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
+	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43341),
 	BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
 	BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
 	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
-- 
GitLab


From b200fa4258457bcc2e9d97d72cbbd4f6589db459 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 17 Feb 2017 15:26:13 +0000
Subject: [PATCH 0094/1835] brcmfmac: Mute expected startup 'errors'

The brcmfmac WiFi driver always complains about the '00' country code.
Modify the driver to ignore '00' silently.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 72822c828a99e..75c8623468f4d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6838,6 +6838,8 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
 	/* ignore non-ISO3166 country codes */
 	for (i = 0; i < 2; i++)
 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+			if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
+				return;
 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
 				  req->alpha2[0], req->alpha2[1]);
 			return;
-- 
GitLab


From 995725400560bb70f9fba33665e1352e045398d1 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 17 Dec 2015 13:37:07 +0000
Subject: [PATCH 0095/1835] hci_h5: Don't send conf_req when ACTIVE

Without this patch, a modem and kernel can continuously bombard each
other with conf_req and conf_rsp messages, in a demented game of tag.
---
 drivers/bluetooth/hci_h5.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 8eede1197cd2e..20953e5f4b80a 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -352,7 +352,8 @@ static void h5_handle_internal_rx(struct hci_uart *hu)
 		h5_link_control(hu, conf_req, 3);
 	} else if (memcmp(data, conf_req, 2) == 0) {
 		h5_link_control(hu, conf_rsp, 2);
-		h5_link_control(hu, conf_req, 3);
+		if (h5->state != H5_ACTIVE)
+		    h5_link_control(hu, conf_req, 3);
 	} else if (memcmp(data, conf_rsp, 2) == 0) {
 		if (H5_HDR_LEN(hdr) > 2)
 			h5->tx_win = (data[2] & 0x07);
-- 
GitLab


From 3b682a3d92e06498ce0578d770dba5949f58fe87 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 13 Apr 2015 17:16:29 +0100
Subject: [PATCH 0096/1835] config: Add default configs

---
 arch/arm/configs/bcm2709_defconfig | 1360 ++++++++++++++++++++++++++++
 arch/arm/configs/bcmrpi_defconfig  | 1353 +++++++++++++++++++++++++++
 2 files changed, 2713 insertions(+)
 create mode 100644 arch/arm/configs/bcm2709_defconfig
 create mode 100644 arch/arm/configs/bcmrpi_defconfig

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
new file mode 100644
index 0000000000000..89aa10defa925
--- /dev/null
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -0,0 +1,1360 @@
+CONFIG_LOCALVERSION="-v7"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_GENERIC_IRQ_DEBUGFS=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT_VOLUNTARY=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_SMP=y
+CONFIG_VMSPLIT_2G=y
+# CONFIG_CPU_SW_DOMAIN_PAN is not set
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_SECCOMP=y
+# CONFIG_ATAGS is not set
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=m
+CONFIG_CRYPTO_AES_ARM=m
+CONFIG_CRYPTO_AES_ARM_BS=m
+CONFIG_OPROFILE=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_BINFMT_MISC=m
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_NET_SCH_HHF=m
+CONFIG_NET_SCH_PIE=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_SLCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_GS_USB=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_SPI_NOR=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_BRCMDBG=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_PSXPAD_SPI=m
+CONFIG_JOYSTICK_PSXPAD_SPI_FF=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EXC3000=m
+CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM_VC_SM=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX=m
+CONFIG_I2C_MUX_GPMUX=m
+CONFIG_I2C_MUX_PCA954x=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_ROBOTFUZZ_OSIF=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_GPIO=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_SLAVE=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_PINCTRL_MCP23S08=m
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_GAUGE_LTC2941=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_JC42=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHT3x=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_ADS1015=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_SENSORS_TMP102=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=m
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=m
+CONFIG_REGULATOR_ARIZONA_LDO1=m
+CONFIG_REGULATOR_ARIZONA_MICSUPP=m
+CONFIG_RC_CORE=y
+CONFIG_LIRC=y
+CONFIG_RC_DECODERS=y
+CONFIG_IR_NEC_DECODER=m
+CONFIG_IR_RC5_DECODER=m
+CONFIG_IR_RC6_DECODER=m
+CONFIG_IR_JVC_DECODER=m
+CONFIG_IR_SONY_DECODER=m
+CONFIG_IR_SANYO_DECODER=m
+CONFIG_IR_SHARP_DECODER=m
+CONFIG_IR_MCE_KBD_DECODER=m
+CONFIG_IR_XMP_DECODER=m
+CONFIG_IR_IMON_DECODER=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_IR_GPIO_TX=m
+CONFIG_IR_PWM_TX=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=m
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_MI0283QT=m
+CONFIG_TINYDRM_REPAPER=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_USB_HIFACE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS=m
+CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
+CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
+CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_ADAU7002=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_ASUS=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_ETH=m
+CONFIG_USB_GADGETFS=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_G_ACM_MS=m
+CONFIG_USB_G_MULTI=m
+CONFIG_USB_G_HID=m
+CONFIG_USB_G_WEBCAM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=m
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_ST7789V=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_BCM2835_VCHIQ=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HDC100X=m
+CONFIG_HTU21=m
+CONFIG_INV_MPU6050_I2C=m
+CONFIG_TSL4531=m
+CONFIG_VEML6070=m
+CONFIG_BMP280=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_RPI_AXIPERF=m
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_NFS_V4_1=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+# CONFIG_CRYPTO_HW is not set
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_RCU_TRACE is not set
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+# CONFIG_UPROBE_EVENTS is not set
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
new file mode 100644
index 0000000000000..1a883c0efad62
--- /dev/null
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -0,0 +1,1353 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_GENERIC_IRQ_DEBUGFS=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT_VOLUNTARY=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_ARCH_MULTI_V6=y
+# CONFIG_ARCH_MULTI_V7 is not set
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+# CONFIG_CACHE_L2X0 is not set
+# CONFIG_CPU_SW_DOMAIN_PAN is not set
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_SECCOMP=y
+# CONFIG_ATAGS is not set
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_VFP=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM=m
+CONFIG_CRYPTO_AES_ARM=m
+CONFIG_OPROFILE=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_BINFMT_MISC=m
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_NET_SCH_HHF=m
+CONFIG_NET_SCH_PIE=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_SLCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_GS_USB=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_SPI_NOR=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=m
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_BRCMDBG=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_PSXPAD_SPI=m
+CONFIG_JOYSTICK_PSXPAD_SPI_FF=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EXC3000=m
+CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM_VC_SM=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX=m
+CONFIG_I2C_MUX_GPMUX=m
+CONFIG_I2C_MUX_PCA954x=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_ROBOTFUZZ_OSIF=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_GPIO=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_SLAVE=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_PINCTRL_MCP23S08=m
+CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_GAUGE_LTC2941=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_JC42=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHT3x=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_ADS1015=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_SENSORS_TMP102=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=m
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=m
+CONFIG_REGULATOR_ARIZONA_LDO1=m
+CONFIG_REGULATOR_ARIZONA_MICSUPP=m
+CONFIG_RC_CORE=y
+CONFIG_LIRC=y
+CONFIG_RC_DECODERS=y
+CONFIG_IR_NEC_DECODER=m
+CONFIG_IR_RC5_DECODER=m
+CONFIG_IR_RC6_DECODER=m
+CONFIG_IR_JVC_DECODER=m
+CONFIG_IR_SONY_DECODER=m
+CONFIG_IR_SANYO_DECODER=m
+CONFIG_IR_SHARP_DECODER=m
+CONFIG_IR_MCE_KBD_DECODER=m
+CONFIG_IR_XMP_DECODER=m
+CONFIG_IR_IMON_DECODER=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_IR_GPIO_TX=m
+CONFIG_IR_PWM_TX=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=m
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_MI0283QT=m
+CONFIG_TINYDRM_REPAPER=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_USB_HIFACE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS=m
+CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
+CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
+CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_ADAU7002=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_ASUS=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_ETH=m
+CONFIG_USB_GADGETFS=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_G_ACM_MS=m
+CONFIG_USB_G_MULTI=m
+CONFIG_USB_G_HID=m
+CONFIG_USB_G_WEBCAM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=m
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_ST7789V=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_BCM2835_VCHIQ=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HDC100X=m
+CONFIG_HTU21=m
+CONFIG_INV_MPU6050_I2C=m
+CONFIG_TSL4531=m
+CONFIG_VEML6070=m
+CONFIG_BMP280=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_RPI_AXIPERF=m
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_NFS_V4_1=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+# CONFIG_CRYPTO_HW is not set
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+# CONFIG_UPROBE_EVENTS is not set
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
-- 
GitLab


From c239f51b595cfacbb7c58179eed960a61e4dc73a Mon Sep 17 00:00:00 2001
From: Michael Zoran <mzoran@crowfest.net>
Date: Wed, 24 Aug 2016 03:35:56 -0700
Subject: [PATCH 0097/1835] Add arm64 configuration and device tree
 differences. Disable MMC_BCM2835_SDHOST and MMC_BCM2835 since these drivers
 are crashing at the moment.

ARM64: Modify default config to get raspbian to boot (#1686)

1. Enable emulation of deprecated instructions.
2. Enable ARM 8.1 and 8.2 features which are not detected at runtime.
3. Switch the default governer to powersave.
4. Include the watchdog timer driver in the kernel image rather then a module.

Tested with raspbian-jessie 2016-09-23.

ARM64: Make it work again on 4.9 (#1790)

* Invoke the dtc compiler with the same options used in arm mode.
* ARM64 now uses the bcm2835 platform just like ARM32.
* ARM64: Update bcmrpi3_defconfig

Signed-off-by: Michael Zoran <mzoran@crowfest.net>

Update arm64 Makefile to compile bcm2710 dtb file

The line 'dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb' has been copied from previous rpi-4.14.y version into rpi-4.15.y arch/arm64/boot/dts/broadcom/Makefile to restore compilation of bcm2710-rpi-3-b.dtb device tree blob under 'make ARCH=arm64 dtbs' command.

arm64: enable thermal / enable mmc (#2425)

This commit adds support for RP3-B-Plus in in arch arm64 (#2464)

Enable AES, AES bit slice, and AES NEON engines on arm64

Enable bbr module for arm64
---
 arch/arm64/Kconfig.platforms                  |    6 -
 arch/arm64/boot/dts/Makefile                  |    2 +
 arch/arm64/boot/dts/broadcom/Makefile         |    3 +
 .../dts/broadcom/bcm2710-rpi-3-b-plus.dts     |    3 +
 .../boot/dts/broadcom/bcm2710-rpi-3-b.dts     |    3 +
 .../dts/broadcom/bcm283x-rpi-lan7515.dtsi     |    1 +
 arch/arm64/boot/dts/overlays                  |    1 +
 arch/arm64/configs/bcmrpi3_defconfig          | 1289 +++++++++++++++++
 8 files changed, 1302 insertions(+), 6 deletions(-)
 create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
 create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
 create mode 120000 arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
 create mode 120000 arch/arm64/boot/dts/overlays
 create mode 100644 arch/arm64/configs/bcmrpi3_defconfig

diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index 393d2b524284e..e9bdec0ead72f 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -1,11 +1,5 @@
 menu "Platform selection"
 
-config ARCH_ACTIONS
-	bool "Actions Semi Platforms"
-	select OWL_TIMER
-	help
-	  This enables support for the Actions Semiconductor S900 SoC family.
-
 config ARCH_SUNXI
 	bool "Allwinner sunxi 64-bit SoC Family"
 	select ARCH_HAS_RESET_CONTROLLER
diff --git a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
index 4690364d584bf..cd9c79566ebec 100644
--- a/arch/arm64/boot/dts/Makefile
+++ b/arch/arm64/boot/dts/Makefile
@@ -26,3 +26,5 @@ subdir-y += synaptics
 subdir-y += ti
 subdir-y += xilinx
 subdir-y += zte
+
+subdir-y += overlays
diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
index 1193a9e34bbb1..78d23305bc310 100644
--- a/arch/arm64/boot/dts/broadcom/Makefile
+++ b/arch/arm64/boot/dts/broadcom/Makefile
@@ -1,6 +1,9 @@
 # SPDX-License-Identifier: GPL-2.0
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2837-rpi-3-b.dtb \
 			      bcm2837-rpi-3-b-plus.dtb
+dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-3-b.dtb
+dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb
+dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b-plus.dtb
 
 subdir-y	+= northstar2
 subdir-y	+= stingray
diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
new file mode 100644
index 0000000000000..d9242ff77079c
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
@@ -0,0 +1,3 @@
+#define RPI364
+
+#include "../../../../arm/boot/dts/bcm2710-rpi-3-b-plus.dts"
diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
new file mode 100644
index 0000000000000..deb33441da952
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
@@ -0,0 +1,3 @@
+#define RPI364
+
+#include "../../../../arm/boot/dts/bcm2710-rpi-3-b.dts"
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
new file mode 120000
index 0000000000000..fc4c05bbe7fd5
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x-rpi-lan7515.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/overlays b/arch/arm64/boot/dts/overlays
new file mode 120000
index 0000000000000..ded08646b6f66
--- /dev/null
+++ b/arch/arm64/boot/dts/overlays
@@ -0,0 +1 @@
+../../../arm/boot/dts/overlays
\ No newline at end of file
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
new file mode 100644
index 0000000000000..ffd9d4cbb4c1a
--- /dev/null
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -0,0 +1,1289 @@
+CONFIG_LOCALVERSION="-v8"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_ARCH_BCM2835=y
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+CONFIG_SCHED_MC=y
+CONFIG_NR_CPUS=4
+CONFIG_PREEMPT=y
+CONFIG_HZ_1000=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_SECCOMP=y
+CONFIG_ARMV8_DEPRECATED=y
+CONFIG_SWP_EMULATION=y
+CONFIG_CP15_BARRIER_EMULATION=y
+CONFIG_SETEND_EMULATION=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_BINFMT_MISC=y
+CONFIG_COMPAT=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_CPU_IDLE=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_POLLDEV=m
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EKTF2127=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_BCM2835_SMI_DEV is not set
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX_PCA954x=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_SPIDEV=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_BCM_EXP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_LIRC=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_FRIIO=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=y
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=m
+CONFIG_MMC_SPI=m
+CONFIG_MMC_BCM2835=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_IRDA=m
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA_ULTRA=y
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_FAST_RR=y
+CONFIG_IRTTY_SIR=m
+CONFIG_KINGSUN_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+CONFIG_KS959_DONGLE=m
+CONFIG_USB_IRDA=m
+CONFIG_SIGMATEL_FIR=m
+CONFIG_MCS_FIR=m
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_LIRC_STAGING=y
+CONFIG_LIRC_RPI=m
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_SND_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_IIO_KFIFO_BUF=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HTU21=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_AES_ARM64=m
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=m
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_SDHCI_IPROC=m
-- 
GitLab


From 54af6e673c251d01283489b242b149c4f23f418c Mon Sep 17 00:00:00 2001
From: Michael Zoran <mzoran@crowfest.net>
Date: Sat, 14 Jan 2017 21:33:51 -0800
Subject: [PATCH 0098/1835] ARM64/DWC_OTG: Port dwc_otg driver to ARM64

In ARM64, the FIQ mechanism used by this driver is not current
implemented.   As a workaround, reqular IRQ is used instead
of FIQ.

In a separate change, the IRQ-CPU mapping is round robined
on ARM64 to increase concurrency and allow multiple interrupts
to be serviced at a time.  This reduces the need for FIQ.

Tests Run:

This mechanism is most likely to break when multiple USB devices
are attached at the same time.  So the system was tested under
stress.

Devices:

1. USB Speakers playing back a FLAC audio through VLC
   at 96KHz.(Higher then typically, but supported on my speakers).

2. sftp transferring large files through the buildin ethernet
   connection which is connected through USB.

3. Keyboard and mouse attached and being used.

Although I do occasionally hear some glitches, the music seems to
play quite well.

Signed-off-by: Michael Zoran <mzoran@crowfest.net>
---
 drivers/usb/host/dwc_otg/Makefile            |  3 +
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c   | 17 +++++
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h   | 24 +++++++
 drivers/usb/host/dwc_otg/dwc_otg_hcd.c       |  4 ++
 drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h    |  4 ++
 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c  |  3 +-
 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 72 ++++++++++++++++++++
 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h    |  2 +
 8 files changed, 128 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/dwc_otg/Makefile b/drivers/usb/host/dwc_otg/Makefile
index e7bdd12015fee..4872b8113b68b 100644
--- a/drivers/usb/host/dwc_otg/Makefile
+++ b/drivers/usb/host/dwc_otg/Makefile
@@ -37,7 +37,10 @@ dwc_otg-objs	+= dwc_otg_pcd_linux.o dwc_otg_pcd.o dwc_otg_pcd_intr.o
 dwc_otg-objs	+= dwc_otg_hcd.o dwc_otg_hcd_linux.o dwc_otg_hcd_intr.o dwc_otg_hcd_queue.o dwc_otg_hcd_ddma.o
 dwc_otg-objs	+= dwc_otg_adp.o
 dwc_otg-objs	+= dwc_otg_fiq_fsm.o
+ifneq ($(CONFIG_ARM64),y)
 dwc_otg-objs	+= dwc_otg_fiq_stub.o
+endif
+
 ifneq ($(CFI),)
 dwc_otg-objs	+= dwc_otg_cfi.o
 endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
index e4923d7619813..2e644e4e3691b 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
@@ -74,6 +74,21 @@ void notrace _fiq_print(enum fiq_debug_level dbg_lvl, volatile struct fiq_state
 	}
 }
 
+
+#ifdef CONFIG_ARM64
+
+inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
+{
+	spin_lock((spinlock_t *)lock);
+}
+
+inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
+{
+	spin_unlock((spinlock_t *)lock);
+}
+
+#else
+
 /**
  * fiq_fsm_spin_lock() - ARMv6+ bare bones spinlock
  * Must be called with local interrupts and FIQ disabled.
@@ -121,6 +136,8 @@ inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
 inline void fiq_fsm_spin_unlock(fiq_lock_t *lock) { }
 #endif
 
+#endif
+
 /**
  * fiq_fsm_restart_channel() - Poke channel enable bit for a split transaction
  * @channel: channel to re-enable
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
index e9cd3ea562baa..06288ec087630 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
@@ -127,6 +127,12 @@ enum fiq_debug_level {
 	FIQDBG_PORTHUB = (1 << 3),
 };
 
+#ifdef CONFIG_ARM64
+
+typedef spinlock_t fiq_lock_t;
+
+#else
+
 typedef struct {
 	union {
 		uint32_t slock;
@@ -137,6 +143,8 @@ typedef struct {
 	};
 } fiq_lock_t;
 
+#endif
+
 struct fiq_state;
 
 extern void _fiq_print (enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...);
@@ -357,6 +365,22 @@ struct fiq_state {
 	struct fiq_channel_state channel[0];
 };
 
+#ifdef CONFIG_ARM64
+
+#ifdef local_fiq_enable
+#undef local_fiq_enable
+#endif
+
+#ifdef local_fiq_disable
+#undef local_fiq_disable
+#endif
+
+extern void local_fiq_enable(void);
+
+extern void local_fiq_disable(void);
+
+#endif
+
 extern void fiq_fsm_spin_lock(fiq_lock_t *lock);
 
 extern void fiq_fsm_spin_unlock(fiq_lock_t *lock);
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
index 4ceefdded6068..e59747cee7ab9 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -1014,6 +1014,10 @@ int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
 		}
 		DWC_MEMSET(hcd->fiq_state, 0, (sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels)));
 
+#ifdef CONFIG_ARM64
+		spin_lock_init(&hcd->fiq_state->lock);
+#endif
+
 		for (i = 0; i < num_channels; i++) {
 			hcd->fiq_state->channel[i].fsm = FIQ_PASSTHROUGH;
 		}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
index fb57db09378f4..a384db5e7ac21 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
@@ -116,7 +116,11 @@ extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
 /** This function is used to handle the fast interrupt
  *
  */
+#ifdef CONFIG_ARM64
+extern void dwc_otg_hcd_handle_fiq(void);
+#else
 extern void __attribute__ ((naked)) dwc_otg_hcd_handle_fiq(void);
+#endif
 
 /**
  * Returns private data set by
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
index 082159b64b343..6947e98b87adb 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
@@ -36,8 +36,9 @@
 #include "dwc_otg_regs.h"
 
 #include <linux/jiffies.h>
+#ifdef CONFIG_ARM
 #include <asm/fiq.h>
-
+#endif
 
 extern bool microframe_schedule;
 
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
index 660d069dda1d3..c86a19ef8da42 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -51,7 +51,9 @@
 #include <linux/dma-mapping.h>
 #include <linux/version.h>
 #include <asm/io.h>
+#ifdef CONFIG_ARM
 #include <asm/fiq.h>
+#endif
 #include <linux/usb.h>
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
 #include <../drivers/usb/core/hcd.h>
@@ -71,6 +73,13 @@
 #include "dwc_otg_driver.h"
 #include "dwc_otg_hcd.h"
 
+#ifndef __virt_to_bus
+#define __virt_to_bus	__virt_to_phys
+#define __bus_to_virt	__phys_to_virt
+#define __pfn_to_bus(x)	__pfn_to_phys(x)
+#define __bus_to_pfn(x)	__phys_to_pfn(x)
+#endif
+
 extern unsigned char  _dwc_otg_fiq_stub, _dwc_otg_fiq_stub_end;
 
 /**
@@ -395,14 +404,49 @@ static struct dwc_otg_hcd_function_ops hcd_fops = {
 	.get_b_hnp_enable = _get_b_hnp_enable,
 };
 
+#ifdef CONFIG_ARM64
+
+static int simfiq_irq = -1;
+
+void local_fiq_enable(void)
+{
+	if (simfiq_irq >= 0)
+		enable_irq(simfiq_irq);
+}
+
+void local_fiq_disable(void)
+{
+	if (simfiq_irq >= 0)
+		disable_irq(simfiq_irq);
+}
+
+irqreturn_t fiq_irq_handler(int irq, void *dev_id)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *)dev_id;
+
+	if (fiq_fsm_enable)
+		dwc_otg_fiq_fsm(dwc_otg_hcd->fiq_state, dwc_otg_hcd->core_if->core_params->host_channels);
+	else
+		dwc_otg_fiq_nop(dwc_otg_hcd->fiq_state);
+
+	return IRQ_HANDLED;
+}
+
+#else
 static struct fiq_handler fh = {
   .name = "usb_fiq",
 };
 
+#endif
+
 static void hcd_init_fiq(void *cookie)
 {
 	dwc_otg_device_t *otg_dev = cookie;
 	dwc_otg_hcd_t *dwc_otg_hcd = otg_dev->hcd;
+#ifdef CONFIG_ARM64
+	int retval = 0;
+	int irq;
+#else
 	struct pt_regs regs;
 	int irq;
 
@@ -430,6 +474,7 @@ static void hcd_init_fiq(void *cookie)
 
 //		__show_regs(&regs);
 	set_fiq_regs(&regs);
+#endif
 
 	//Set the mphi periph to  the required registers
 	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
@@ -448,6 +493,23 @@ static void hcd_init_fiq(void *cookie)
 		DWC_WARN("MPHI periph has NOT been enabled");
 #endif
 	// Enable FIQ interrupt from USB peripheral
+#ifdef CONFIG_ARM64
+	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
+
+	if (irq < 0) {
+		DWC_ERROR("Can't get SIM-FIQ irq");
+		return;
+	}
+
+	retval = request_irq(irq, fiq_irq_handler, 0, "dwc_otg_sim-fiq", dwc_otg_hcd);
+
+	if (retval < 0) {
+		DWC_ERROR("Unable to request SIM-FIQ irq\n");
+		return;
+	}
+
+	simfiq_irq = irq;
+#else
 #ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
 	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
 #else
@@ -464,6 +526,8 @@ static void hcd_init_fiq(void *cookie)
 	smp_mb();
 	enable_fiq(irq);
 	local_fiq_enable();
+#endif
+
 }
 
 /**
@@ -526,6 +590,13 @@ int hcd_init(dwc_bus_dev_t *_dev)
 	otg_dev->hcd = dwc_otg_hcd;
 	otg_dev->hcd->otg_dev = otg_dev;
 
+#ifdef CONFIG_ARM64
+	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if))
+		goto error2;
+
+	if (fiq_enable)
+		hcd_init_fiq(otg_dev);
+#else
 	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if)) {
 		goto error2;
 	}
@@ -542,6 +613,7 @@ int hcd_init(dwc_bus_dev_t *_dev)
 			smp_call_function_single(0, hcd_init_fiq, otg_dev, 1);
 		}
 	}
+#endif
 
 	hcd->self.otg_port = dwc_otg_hcd_otg_port(dwc_otg_hcd);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,33) //don't support for LM(with 2.6.20.1 kernel)
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
index 6b2c7d0c93f36..d7b700ff17821 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
@@ -76,8 +76,10 @@
 
 #ifdef PLATFORM_INTERFACE
 #include <linux/platform_device.h>
+#ifdef CONFIG_ARM
 #include <asm/mach/map.h>
 #endif
+#endif
 
 /** The OS page size */
 #define DWC_OS_PAGE_SIZE	PAGE_SIZE
-- 
GitLab


From 4ee5b65be31557a6f71dfa2ee071fdfe3fed0ea0 Mon Sep 17 00:00:00 2001
From: Michael Zoran <mzoran@crowfest.net>
Date: Sat, 14 Jan 2017 21:43:57 -0800
Subject: [PATCH 0099/1835] ARM64: Round-Robin dispatch IRQs between CPUs.

IRQ-CPU mapping is round robined on ARM64 to increase
concurrency and allow multiple interrupts to be serviced
at a time.  This reduces the need for FIQ.

Signed-off-by: Michael Zoran <mzoran@crowfest.net>
---
 drivers/irqchip/irq-bcm2835.c | 15 ++++++++++++++-
 drivers/irqchip/irq-bcm2836.c | 21 +++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index 44a1c357f6227..ecb0147289746 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -162,10 +162,23 @@ static void armctrl_unmask_irq(struct irq_data *d)
 	}
 }
 
+#ifdef CONFIG_ARM64
+void bcm2836_arm_irqchip_spin_gpu_irq(void);
+
+static void armctrl_ack_irq(struct irq_data *d)
+{
+	bcm2836_arm_irqchip_spin_gpu_irq();
+}
+
+#endif
+
 static struct irq_chip armctrl_chip = {
 	.name = "ARMCTRL-level",
 	.irq_mask = armctrl_mask_irq,
-	.irq_unmask = armctrl_unmask_irq
+	.irq_unmask = armctrl_unmask_irq,
+#ifdef CONFIG_ARM64
+	.irq_ack    = armctrl_ack_irq
+#endif
 };
 
 static int armctrl_xlate(struct irq_domain *d, struct device_node *ctrlr,
diff --git a/drivers/irqchip/irq-bcm2836.c b/drivers/irqchip/irq-bcm2836.c
index 39d05403835f2..5169f63f9eee8 100644
--- a/drivers/irqchip/irq-bcm2836.c
+++ b/drivers/irqchip/irq-bcm2836.c
@@ -95,6 +95,27 @@ static void bcm2836_arm_irqchip_unmask_gpu_irq(struct irq_data *d)
 {
 }
 
+#ifdef CONFIG_ARM64
+
+void bcm2836_arm_irqchip_spin_gpu_irq(void)
+{
+	u32 i;
+	void __iomem *gpurouting = (intc.base + LOCAL_GPU_ROUTING);
+	u32 routing_val = readl(gpurouting);
+
+	for (i = 1; i <= 3; i++) {
+		u32 new_routing_val = (routing_val + i) & 3;
+
+		if (cpu_active(new_routing_val)) {
+			writel(new_routing_val, gpurouting);
+			return;
+		}
+	}
+}
+EXPORT_SYMBOL(bcm2836_arm_irqchip_spin_gpu_irq);
+
+#endif
+
 static struct irq_chip bcm2836_arm_irqchip_gpu = {
 	.name		= "bcm2836-gpu",
 	.irq_mask	= bcm2836_arm_irqchip_mask_gpu_irq,
-- 
GitLab


From 449887ab98cbe7da11bc965f3fb56b65e13e6394 Mon Sep 17 00:00:00 2001
From: Michael Zoran <mzoran@crowfest.net>
Date: Sat, 11 Feb 2017 01:18:31 -0800
Subject: [PATCH 0100/1835] ARM64: Force hardware emulation of deprecated
 instructions.

---
 arch/arm64/kernel/armv8_deprecated.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 92be1d12d5908..70852e91f388f 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -182,10 +182,15 @@ static void __init register_insn_emulation(struct insn_emulation_ops *ops)
 
 	switch (ops->status) {
 	case INSN_DEPRECATED:
+#if 0
 		insn->current_mode = INSN_EMULATE;
 		/* Disable the HW mode if it was turned on at early boot time */
 		run_all_cpu_set_hw_mode(insn, false);
+#else
+		insn->current_mode = INSN_HW;
+		run_all_cpu_set_hw_mode(insn, true);
 		insn->max = INSN_HW;
+#endif
 		break;
 	case INSN_OBSOLETE:
 		insn->current_mode = INSN_UNDEF;
-- 
GitLab


From 0f0ca2671d56772ce6252961fdd7509b618c3741 Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Fri, 10 Feb 2017 17:57:08 -0800
Subject: [PATCH 0101/1835] build/arm64: Add rules for .dtbo files for dts
 overlays

We now create overlays as .dtbo files.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 arch/arm64/Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 35649ee8ad56b..853e565f89576 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -130,6 +130,9 @@ zinstall install:
 %.dtb: scripts
 	$(Q)$(MAKE) $(build)=$(boot)/dts $(boot)/dts/$@
 
+%.dtbo: | scripts
+	$(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@
+
 PHONY += dtbs dtbs_install
 
 dtbs: prepare scripts
-- 
GitLab


From b8166b8792d6b7d5307d91051f3a674edb1c4433 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Fri, 25 Aug 2017 19:18:13 +0100
Subject: [PATCH 0102/1835] cache: export clean and invalidate

---
 arch/arm/mm/cache-v6.S | 4 ++--
 arch/arm/mm/cache-v7.S | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 24659952c2784..1ee5bc3a10188 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -201,7 +201,7 @@ ENTRY(v6_flush_kern_dcache_area)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v6_dma_inv_range:
+ENTRY(v6_dma_inv_range)
 #ifdef CONFIG_DMA_CACHE_RWFO
 	ldrb	r2, [r0]			@ read for ownership
 	strb	r2, [r0]			@ write for ownership
@@ -246,7 +246,7 @@ v6_dma_inv_range:
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v6_dma_clean_range:
+ENTRY(v6_dma_clean_range)
 	bic	r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
 #ifdef CONFIG_DMA_CACHE_RWFO
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 2149b47a0c5ac..7a4c92ec7d913 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -350,7 +350,7 @@ ENDPROC(v7_flush_kern_dcache_area)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v7_dma_inv_range:
+ENTRY(v7_dma_inv_range)
 	dcache_line_size r2, r3
 	sub	r3, r2, #1
 	tst	r0, r3
@@ -380,7 +380,7 @@ ENDPROC(v7_dma_inv_range)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v7_dma_clean_range:
+ENTRY(v7_dma_clean_range)
 	dcache_line_size r2, r3
 	sub	r3, r2, #1
 	bic	r0, r0, r3
-- 
GitLab


From 83f535bb15217d38856fc956c51f9ce436310cb4 Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Tue, 14 Nov 2017 15:13:15 +0000
Subject: [PATCH 0103/1835] AXI performance monitor driver (#2222)

Uses the debugfs I/F to provide access to the AXI
bus performance monitors.

Requires the new mailbox peripheral access for access
to the VPU performance registers, system bus access
is done using direct register reads.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 drivers/perf/Kconfig                   |   7 +
 drivers/perf/Makefile                  |   1 +
 drivers/perf/raspberrypi_axi_monitor.c | 637 +++++++++++++++++++++++++
 3 files changed, 645 insertions(+)
 create mode 100644 drivers/perf/raspberrypi_axi_monitor.c

diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig
index 08ebaf7cca8ba..108d9054da836 100644
--- a/drivers/perf/Kconfig
+++ b/drivers/perf/Kconfig
@@ -102,4 +102,11 @@ config ARM_SPE_PMU
 	  Extension, which provides periodic sampling of operations in
 	  the CPU pipeline and reports this via the perf AUX interface.
 
+config RPI_AXIPERF
+        depends on ARCH_BCM2835
+        tristate "RaspberryPi AXI Performance monitors"
+        default n
+        help
+          Say y if you want to use Raspberry Pi AXI performance monitors, m if
+          you want to build it as a module.
 endmenu
diff --git a/drivers/perf/Makefile b/drivers/perf/Makefile
index b3902bd37d532..901a5cd26915d 100644
--- a/drivers/perf/Makefile
+++ b/drivers/perf/Makefile
@@ -9,3 +9,4 @@ obj-$(CONFIG_QCOM_L2_PMU)	+= qcom_l2_pmu.o
 obj-$(CONFIG_QCOM_L3_PMU) += qcom_l3_pmu.o
 obj-$(CONFIG_XGENE_PMU) += xgene_pmu.o
 obj-$(CONFIG_ARM_SPE_PMU) += arm_spe_pmu.o
+obj-$(CONFIG_RPI_AXIPERF) += raspberrypi_axi_monitor.o
diff --git a/drivers/perf/raspberrypi_axi_monitor.c b/drivers/perf/raspberrypi_axi_monitor.c
new file mode 100644
index 0000000000000..bafe03b6c0000
--- /dev/null
+++ b/drivers/perf/raspberrypi_axi_monitor.c
@@ -0,0 +1,637 @@
+/*
+ * raspberrypi_axi_monitor.c
+ *
+ * Author: james.hughes@raspberrypi.org
+ *
+ * Raspberry Pi AXI performance counters.
+ *
+ * Copyright (C) 2017 Raspberry Pi Trading Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/devcoredump.h>
+#include <linux/device.h>
+#include <linux/kthread.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define NUM_MONITORS 2
+#define NUM_BUS_WATCHERS_PER_MONITOR 3
+
+#define SYSTEM_MONITOR 0
+#define VPU_MONITOR 1
+
+#define MAX_BUSES 16
+#define DEFAULT_SAMPLE_TIME 100
+
+#define NUM_BUS_WATCHER_RESULTS 9
+
+struct bus_watcher_data {
+	union	{
+		u32 results[NUM_BUS_WATCHER_RESULTS];
+		struct {
+			u32 atrans;
+			u32 atwait;
+			u32 amax;
+			u32 wtrans;
+			u32 wtwait;
+			u32 wmax;
+			u32 rtrans;
+			u32 rtwait;
+			u32 rmax;
+		};
+	};
+};
+
+
+struct rpi_axiperf {
+	struct platform_device *dev;
+	struct dentry *root_folder;
+
+	struct task_struct *monitor_thread;
+	struct mutex lock;
+
+	struct rpi_firmware *firmware;
+
+	/* Sample time spent on for each bus */
+	int sample_time;
+
+	/* Now storage for the per monitor settings and the resulting
+	 * performance figures
+	 */
+	struct {
+		/* Bit field of buses we want to monitor */
+		int bus_enabled;
+		/* Bit field of buses to filter by */
+		int bus_filter;
+		/* The current buses being monitored on this monitor */
+		int current_bus[NUM_BUS_WATCHERS_PER_MONITOR];
+		/* The last bus monitored on this monitor */
+		int last_monitored;
+
+		/* Set true if this mailbox must use the mailbox interface
+		 * rather than access registers directly.
+		 */
+		int use_mailbox_interface;
+
+		/* Current result values */
+		struct bus_watcher_data results[MAX_BUSES];
+
+		struct dentry *debugfs_entry;
+		void __iomem *base_address;
+
+	}  monitor[NUM_MONITORS];
+
+};
+
+static struct rpi_axiperf *state;
+
+/* Two monitors, System and VPU, each with the following register sets.
+ * Each monitor can only monitor one bus at a time, so we time share them,
+ * giving each bus 100ms (default, settable via debugfs) of time on its
+ * associated monitor
+ * Record results from the three Bus watchers per monitor and push to the sysfs
+ */
+
+/* general registers */
+const int GEN_CTRL;
+
+const int GEN_CTL_ENABLE_BIT	= BIT(0);
+const int GEN_CTL_RESET_BIT	= BIT(1);
+
+/* Bus watcher registers */
+const int BW_PITCH		= 0x40;
+
+const int BW0_CTRL		= 0x40;
+const int BW1_CTRL		= 0x80;
+const int BW2_CTRL		= 0xc0;
+
+const int BW_ATRANS_OFFSET	= 0x04;
+const int BW_ATWAIT_OFFSET	= 0x08;
+const int BW_AMAX_OFFSET	= 0x0c;
+const int BW_WTRANS_OFFSET	= 0x10;
+const int BW_WTWAIT_OFFSET	= 0x14;
+const int BW_WMAX_OFFSET	= 0x18;
+const int BW_RTRANS_OFFSET	= 0x1c;
+const int BW_RTWAIT_OFFSET	= 0x20;
+const int BW_RMAX_OFFSET	= 0x24;
+
+const int BW_CTRL_RESET_BIT	= BIT(31);
+const int BW_CTRL_ENABLE_BIT	= BIT(30);
+const int BW_CTRL_ENABLE_ID_FILTER_BIT	= BIT(29);
+const int BW_CTRL_LIMIT_HALT_BIT	= BIT(28);
+
+const int BW_CTRL_SOURCE_SHIFT	= 8;
+const int BW_CTRL_SOURCE_MASK	= GENMASK(12, 8); // 5 bits
+const int BW_CTRL_BUS_WATCH_SHIFT;
+const int BW_CTRL_BUS_WATCH_MASK = GENMASK(5, 0); // 6 bits
+const int BW_CTRL_BUS_FILTER_SHIFT = 8;
+
+const static char *bus_filter_strings[] = {
+	"",
+	"CORE0_V",
+	"ICACHE0",
+	"DCACHE0",
+	"CORE1_V",
+	"ICACHE1",
+	"DCACHE1",
+	"L2_MAIN",
+	"HOST_PORT",
+	"HOST_PORT2",
+	"HVS",
+	"ISP",
+	"VIDEO_DCT",
+	"VIDEO_SD2AXI",
+	"CAM0",
+	"CAM1",
+	"DMA0",
+	"DMA1",
+	"DMA2_VPU",
+	"JPEG",
+	"VIDEO_CME",
+	"TRANSPOSER",
+	"VIDEO_FME",
+	"CCP2TX",
+	"USB",
+	"V3D0",
+	"V3D1",
+	"V3D2",
+	"AVE",
+	"DEBUG",
+	"CPU",
+	"M30"
+};
+
+const int num_bus_filters = ARRAY_SIZE(bus_filter_strings);
+
+const static char *system_bus_string[] = {
+	"DMA_L2",
+	"TRANS",
+	"JPEG",
+	"SYSTEM_UC",
+	"DMA_UC",
+	"SYSTEM_L2",
+	"CCP2TX",
+	"MPHI_RX",
+	"MPHI_TX",
+	"HVS",
+	"H264",
+	"ISP",
+	"V3D",
+	"PERIPHERAL",
+	"CPU_UC",
+	"CPU_L2"
+};
+
+const int num_system_buses = ARRAY_SIZE(system_bus_string);
+
+const static char *vpu_bus_string[] = {
+	"VPU1_D_L2",
+	"VPU0_D_L2",
+	"VPU1_I_L2",
+	"VPU0_I_L2",
+	"SYSTEM_L2",
+	"L2_FLUSH",
+	"DMA_L2",
+	"VPU1_D_UC",
+	"VPU0_D_UC",
+	"VPU1_I_UC",
+	"VPU0_I_UC",
+	"SYSTEM_UC",
+	"L2_OUT",
+	"DMA_UC",
+	"SDRAM",
+	"L2_IN"
+};
+
+const int num_vpu_buses = ARRAY_SIZE(vpu_bus_string);
+
+const static char *monitor_name[] = {
+	"System",
+	"VPU"
+};
+
+static inline void write_reg(int monitor, int reg, u32 value)
+{
+	writel(value, state->monitor[monitor].base_address + reg);
+}
+
+static inline u32 read_reg(int monitor, u32 reg)
+{
+	return readl(state->monitor[monitor].base_address + reg);
+}
+
+static void read_bus_watcher(int monitor, int watcher, u32 *results)
+{
+	if (state->monitor[monitor].use_mailbox_interface) {
+		/* We have 9 results, plus the overheads of start address and
+		 * length So 11 u32 to define
+		 */
+		u32 tmp[11];
+		int err;
+
+		tmp[0] = (u32)(state->monitor[monitor].base_address + watcher
+				+ BW_ATRANS_OFFSET);
+		tmp[1] = NUM_BUS_WATCHER_RESULTS;
+
+		err = rpi_firmware_property(state->firmware,
+					    RPI_FIRMWARE_GET_PERIPH_REG,
+					    tmp, sizeof(tmp));
+
+		if (err < 0 || tmp[1] != NUM_BUS_WATCHER_RESULTS)
+			dev_err_once(&state->dev->dev,
+				     "Failed to read bus watcher");
+		else
+			memcpy(results, &tmp[2],
+			       NUM_BUS_WATCHER_RESULTS * sizeof(u32));
+	} else {
+		int i;
+		void __iomem *addr = state->monitor[monitor].base_address
+				+ watcher + BW_ATRANS_OFFSET;
+		for (i = 0; i < NUM_BUS_WATCHER_RESULTS; i++, addr += 4)
+			*results++ = readl(addr);
+	}
+}
+
+static void set_monitor_control(int monitor, u32 set)
+{
+	if (state->monitor[monitor].use_mailbox_interface) {
+		u32 tmp[3] = {(u32)(state->monitor[monitor].base_address +
+				GEN_CTRL), 1, set};
+		int err = rpi_firmware_property(state->firmware,
+						RPI_FIRMWARE_SET_PERIPH_REG,
+						tmp, sizeof(tmp));
+
+		if (err < 0 || tmp[1] != 1)
+			dev_err_once(&state->dev->dev,
+				"Failed to set monitor control");
+	} else
+		write_reg(monitor, GEN_CTRL, set);
+}
+
+static void set_bus_watcher_control(int monitor, int watcher, u32 set)
+{
+	if (state->monitor[monitor].use_mailbox_interface) {
+		u32 tmp[3] = {(u32)(state->monitor[monitor].base_address +
+				    watcher), 1, set};
+		int err = rpi_firmware_property(state->firmware,
+						RPI_FIRMWARE_SET_PERIPH_REG,
+						tmp, sizeof(tmp));
+		if (err < 0 || tmp[1] != 1)
+			dev_err_once(&state->dev->dev,
+				"Failed to set bus watcher control");
+	} else
+		write_reg(monitor, watcher, set);
+}
+
+static void monitor(struct rpi_axiperf *state)
+{
+	int monitor, num_buses[NUM_MONITORS];
+
+	mutex_lock(&state->lock);
+
+	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
+		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
+
+		/* Anything enabled? */
+		if (mon->bus_enabled == 0) {
+			/* No, disable all monitoring for this monitor */
+			set_monitor_control(monitor, GEN_CTL_RESET_BIT);
+		} else {
+			int i;
+
+			/* Find out how many busses we want to monitor, and
+			 * spread our 3 actual monitors over them
+			 */
+			num_buses[monitor] = hweight32(mon->bus_enabled);
+			num_buses[monitor] = min(num_buses[monitor],
+						 NUM_BUS_WATCHERS_PER_MONITOR);
+
+			for (i = 0; i < num_buses[monitor]; i++) {
+				int bus_control;
+
+				do {
+					mon->last_monitored++;
+					mon->last_monitored &= 0xf;
+				} while ((mon->bus_enabled &
+					 (1 << mon->last_monitored)) == 0);
+
+				mon->current_bus[i] = mon->last_monitored;
+
+				/* Reset the counters */
+				set_bus_watcher_control(monitor,
+							BW0_CTRL +
+							i*BW_PITCH,
+							BW_CTRL_RESET_BIT);
+
+				bus_control = BW_CTRL_ENABLE_BIT |
+						mon->current_bus[i];
+
+				if (mon->bus_filter) {
+					bus_control |=
+						BW_CTRL_ENABLE_ID_FILTER_BIT;
+					bus_control |=
+						((mon->bus_filter & 0x1f)
+						<< BW_CTRL_BUS_FILTER_SHIFT);
+				}
+
+				// Start capture
+				set_bus_watcher_control(monitor,
+							BW0_CTRL + i*BW_PITCH,
+							bus_control);
+			}
+		}
+
+		/* start monitoring */
+		set_monitor_control(monitor, GEN_CTL_ENABLE_BIT);
+	}
+
+	mutex_unlock(&state->lock);
+
+	msleep(state->sample_time);
+
+	/* Now read the results */
+
+	mutex_lock(&state->lock);
+	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
+		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
+
+		/* Anything enabled? */
+		if (mon->bus_enabled == 0) {
+			/* No, disable all monitoring for this monitor */
+			set_monitor_control(monitor, 0);
+		} else {
+			int i;
+
+			for (i = 0; i < num_buses[monitor]; i++) {
+				int bus = mon->current_bus[i];
+
+				read_bus_watcher(monitor,
+					BW0_CTRL + i*BW_PITCH,
+					(u32 *)&mon->results[bus].results);
+			}
+		}
+	}
+	mutex_unlock(&state->lock);
+}
+
+static int monitor_thread(void *data)
+{
+	struct rpi_axiperf *state  = data;
+
+	while (1) {
+		monitor(state);
+
+		if (kthread_should_stop())
+			return 0;
+	}
+	return 0;
+}
+
+static ssize_t myreader(struct file *fp, char __user *user_buffer,
+			size_t count, loff_t *position)
+{
+#define INIT_BUFF_SIZE 2048
+
+	int i;
+	int idx = (int)(fp->private_data);
+	int num_buses, cnt;
+	char *string_buffer;
+	int buff_size = INIT_BUFF_SIZE;
+	char *p;
+	typeof(state->monitor[0]) *mon = &(state->monitor[idx]);
+
+	if (idx < 0 || idx > NUM_MONITORS)
+		idx = 0;
+
+	num_buses = idx == SYSTEM_MONITOR ? num_system_buses : num_vpu_buses;
+
+	string_buffer = kmalloc(buff_size, GFP_KERNEL);
+
+	if (!string_buffer) {
+		dev_err(&state->dev->dev,
+				"Failed temporary string allocation\n");
+		return 0;
+	}
+
+	p = string_buffer;
+
+	mutex_lock(&state->lock);
+
+	if (mon->bus_filter) {
+		int filt = min(mon->bus_filter & 0x1f, num_bus_filters);
+
+		cnt = snprintf(p, buff_size,
+			       "\nMonitoring transactions from %s only\n",
+			       bus_filter_strings[filt]);
+		p += cnt;
+		buff_size -= cnt;
+	}
+
+	cnt = snprintf(p, buff_size, "     Bus   |    Atrans    Atwait      AMax    Wtrans    Wtwait      WMax    Rtrans    Rtwait      RMax\n"
+				     "======================================================================================================\n");
+
+	if (cnt >= buff_size)
+		goto done;
+
+	p += cnt;
+	buff_size -= cnt;
+
+	for (i = 0; i < num_buses; i++) {
+		if (mon->bus_enabled & (1 << i)) {
+#define DIVIDER (1024)
+			typeof(mon->results[0]) *res = &(mon->results[i]);
+
+			cnt = snprintf(p, buff_size,
+					"%10s | %8uK %8uK %8uK %8uK %8uK %8uK %8uK %8uK %8uK\n",
+					idx == SYSTEM_MONITOR ?
+						system_bus_string[i] :
+						vpu_bus_string[i],
+					res->atrans/DIVIDER,
+					res->atwait/DIVIDER,
+					res->amax/DIVIDER,
+					res->wtrans/DIVIDER,
+					res->wtwait/DIVIDER,
+					res->wmax/DIVIDER,
+					res->rtrans/DIVIDER,
+					res->rtwait/DIVIDER,
+					res->rmax/DIVIDER
+					);
+			if (cnt >= buff_size)
+				goto done;
+
+			p += cnt;
+			buff_size -= cnt;
+		}
+	}
+
+	mutex_unlock(&state->lock);
+
+done:
+
+	/* did the last string entry exceeed our buffer size? ie out of string
+	 * buffer space. Null terminate, use what we have.
+	 */
+	if (cnt >= buff_size) {
+		buff_size = 0;
+		string_buffer[INIT_BUFF_SIZE] = 0;
+	}
+
+	cnt = simple_read_from_buffer(user_buffer, count, position,
+				      string_buffer,
+				      INIT_BUFF_SIZE - buff_size);
+
+	kfree(string_buffer);
+
+	return cnt;
+}
+
+static ssize_t mywriter(struct file *fp, const char __user *user_buffer,
+			size_t count, loff_t *position)
+{
+	int idx = (int)(fp->private_data);
+
+	if (idx < 0 || idx > NUM_MONITORS)
+		idx = 0;
+
+	/* At the moment, this does nothing, but in the future it could be
+	 * used to reset counters etc
+	 */
+	return count;
+}
+
+static const struct file_operations fops_debug = {
+	.read = myreader,
+	.write = mywriter,
+	.open = simple_open
+};
+
+static int rpi_axiperf_probe(struct platform_device *pdev)
+{
+	int ret = 0, i;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *fw_node;
+
+	state = kzalloc(sizeof(struct rpi_axiperf), GFP_KERNEL);
+	if (!state)
+		return -ENOMEM;
+
+	/* Get the firmware handle for future rpi-firmware-xxx calls */
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	state->firmware = rpi_firmware_get(fw_node);
+	if (!state->firmware)
+		return -EPROBE_DEFER;
+
+	/* Special case for the VPU monitor, we must use the mailbox interface
+	 * as it is not accessible from the ARM address space.
+	 */
+	state->monitor[VPU_MONITOR].use_mailbox_interface = 1;
+	state->monitor[SYSTEM_MONITOR].use_mailbox_interface = 0;
+
+	for (i = 0; i < NUM_MONITORS; i++) {
+		if (state->monitor[i].use_mailbox_interface) {
+			 of_property_read_u32_index(np, "reg", i*2,
+				(u32 *)(&state->monitor[i].base_address));
+		} else {
+			struct resource *resource =
+				platform_get_resource(pdev, IORESOURCE_MEM, i);
+
+			state->monitor[i].base_address =
+				devm_ioremap_resource(&pdev->dev, resource);
+		}
+
+		if (IS_ERR(state->monitor[i].base_address))
+			return PTR_ERR(state->monitor[i].base_address);
+
+		/* Enable all buses by default */
+		state->monitor[i].bus_enabled = 0xffff;
+	}
+
+	state->dev = pdev;
+	platform_set_drvdata(pdev, state);
+
+	state->sample_time = DEFAULT_SAMPLE_TIME;
+
+	/* Set up all the debugfs stuff */
+	state->root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+	for (i = 0; i < NUM_MONITORS; i++) {
+		state->monitor[i].debugfs_entry =
+			debugfs_create_dir(monitor_name[i], state->root_folder);
+		if (IS_ERR(state->monitor[i].debugfs_entry))
+			state->monitor[i].debugfs_entry = NULL;
+
+		debugfs_create_file("data", 0444,
+				    state->monitor[i].debugfs_entry,
+				    (void *)i, &fops_debug);
+		debugfs_create_u32("enable", 0644,
+				   state->monitor[i].debugfs_entry,
+				   &state->monitor[i].bus_enabled);
+		debugfs_create_u32("filter", 0644,
+				   state->monitor[i].debugfs_entry,
+				   &state->monitor[i].bus_filter);
+		debugfs_create_u32("sample_time", 0644,
+				   state->monitor[i].debugfs_entry,
+				   &state->sample_time);
+	}
+
+	mutex_init(&state->lock);
+
+	state->monitor_thread = kthread_run(monitor_thread, state,
+					    "rpi-axiperfmon");
+
+	return ret;
+
+}
+
+static int rpi_axiperf_remove(struct platform_device *dev)
+{
+	int ret = 0;
+
+	kthread_stop(state->monitor_thread);
+
+	debugfs_remove_recursive(state->root_folder);
+	state->root_folder = NULL;
+
+	return ret;
+}
+
+static const struct of_device_id rpi_axiperf_match[] = {
+	{
+		.compatible = "brcm,bcm2835-axiperf",
+	},
+	{},
+};
+MODULE_DEVICE_TABLE(of, rpi_axiperf_match);
+
+static struct platform_driver rpi_axiperf_driver  = {
+	.probe =	rpi_axiperf_probe,
+	.remove =	rpi_axiperf_remove,
+	.driver = {
+		.name   = "rpi-bcm2835-axiperf",
+		.of_match_table = of_match_ptr(rpi_axiperf_match),
+	},
+};
+
+module_platform_driver(rpi_axiperf_driver);
+
+/* Module information */
+MODULE_AUTHOR("James Hughes <james.hughes@raspberrypi.org>");
+MODULE_DESCRIPTION("RPI AXI Performance monitor driver");
+MODULE_LICENSE("GPL");
+
-- 
GitLab


From 352b3c2609a113570f40ff3bdd228ff637be6fdb Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 14 Nov 2017 11:03:22 +0000
Subject: [PATCH 0104/1835] mcp2515: Use DT-supplied interrupt flags

The MCP2515 datasheet clearly describes a level-triggered interrupt
pin. Therefore the receiving interrupt controller must also be
configured for level-triggered operation otherwise there is a danger
of a missed interrupt condition blocking all subsequent interrupts.
The ONESHOT flag ensures that the interrupt is masked until the
threaded interrupt handler exits.

Rather than change the flags globally (they must have worked for at
least one user), allow the flags to be overridden from Device Tree
in the event that the device has a DT node.

See: https://github.com/raspberrypi/linux/issues/2175
     https://github.com/raspberrypi/linux/issues/2263

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/can/spi/mcp251x.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index e908176086450..663203fbb1b83 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -951,6 +951,9 @@ static int mcp251x_open(struct net_device *net)
 	priv->tx_skb = NULL;
 	priv->tx_len = 0;
 
+	if (spi->dev.of_node)
+	    flags = 0;
+
 	ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
 				   flags | IRQF_ONESHOT, DEVICE_NAME, priv);
 	if (ret) {
-- 
GitLab


From 52e9b16b924a01c5fb3c2034f99c0fe966c87cb9 Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Thu, 16 Nov 2017 15:56:17 +0000
Subject: [PATCH 0105/1835] Tidy up of the ft5406 driver to use DT (#2189)

Driver was using a fixed resolution, this commit
adds touchscreen size, and coordinate flip and swap
features via device tree overlays.

Adds overrides so the VC4 can adjust the DT parameters
appropriately; there is a newer version of the VC4 side
driver that can now set up the appropriate DT values
if required.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 drivers/input/touchscreen/rpi-ft5406.c | 218 ++++++++++++++++---------
 1 file changed, 145 insertions(+), 73 deletions(-)

diff --git a/drivers/input/touchscreen/rpi-ft5406.c b/drivers/input/touchscreen/rpi-ft5406.c
index 9d7d05482355d..40bbde9ce1bc4 100644
--- a/drivers/input/touchscreen/rpi-ft5406.c
+++ b/drivers/input/touchscreen/rpi-ft5406.c
@@ -1,7 +1,7 @@
 /*
  * Driver for memory based ft5406 touchscreen
  *
- * Copyright (C) 2015 Raspberry Pi
+ * Copyright (C) 2015, 2017 Raspberry Pi
  *
  *
  * This program is free software; you can redistribute it and/or modify
@@ -9,7 +9,6 @@
  * published by the Free Software Foundation.
  */
 
-
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/input.h>
@@ -21,11 +20,15 @@
 #include <linux/kthread.h>
 #include <linux/platform_device.h>
 #include <linux/stddef.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/dma-mapping.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define MAXIMUM_SUPPORTED_POINTS 10
+#define FTS_TOUCH_DOWN      0
+#define FTS_TOUCH_UP        1
+#define FTS_TOUCH_CONTACT   2
+
 struct ft5406_regs {
 	uint8_t device_mode;
 	uint8_t gesture_id;
@@ -35,85 +38,125 @@ struct ft5406_regs {
 		uint8_t xl;
 		uint8_t yh;
 		uint8_t yl;
-		uint8_t res1;
-		uint8_t res2;
+		uint8_t pressure; /* Not supported */
+		uint8_t area;     /* Not supported */
 	} point[MAXIMUM_SUPPORTED_POINTS];
 };
 
-#define SCREEN_WIDTH  800
-#define SCREEN_HEIGHT 480
+/* These are defaults if the DT entries are missing */
+#define DEFAULT_SCREEN_WIDTH  800
+#define DEFAULT_SCREEN_HEIGHT 480
 
 struct ft5406 {
-	struct platform_device * pdev;
-	struct input_dev       * input_dev;
-	void __iomem           * ts_base;
-	dma_addr_t		 bus_addr;
-	struct task_struct     * thread;
+	struct platform_device	*pdev;
+	struct input_dev	*input_dev;
+	void __iomem		*ts_base;
+	dma_addr_t		bus_addr;
+	struct task_struct	*thread;
+
+	uint16_t	max_x;
+	uint16_t	max_y;
+	uint8_t		hflip;
+	uint8_t		vflip;
+	uint8_t		xyswap;
 };
 
 /* Thread to poll for touchscreen events
- * 
+ *
  * This thread polls the memory based register copy of the ft5406 registers
  * using the number of points register to know whether the copy has been
- * updated (we write 99 to the memory copy, the GPU will write between 
+ * updated (we write 99 to the memory copy, the GPU will write between
  * 0 - 10 points)
  */
+#define ID_TO_BIT(a) (1 << a)
+
 static int ft5406_thread(void *arg)
 {
 	struct ft5406 *ts = (struct ft5406 *) arg;
 	struct ft5406_regs regs;
 	int known_ids = 0;
-	
-	while(!kthread_should_stop())
-	{
-		// 60fps polling
+
+	while (!kthread_should_stop()) {
+		/* 60fps polling */
 		msleep_interruptible(17);
 		memcpy_fromio(&regs, ts->ts_base, sizeof(struct ft5406_regs));
-		iowrite8(99, ts->ts_base + offsetof(struct ft5406_regs, num_points));
-		// Do not output if theres no new information (num_points is 99)
-		// or we have no touch points and don't need to release any
-		if(!(regs.num_points == 99 || (regs.num_points == 0 && known_ids == 0)))
-		{
+		iowrite8(99,
+			 ts->ts_base +
+			 offsetof(struct ft5406_regs, num_points));
+
+		/*
+		 * Do not output if theres no new information (num_points is 99)
+		 * or we have no touch points and don't need to release any
+		 */
+		if (!(regs.num_points == 99 ||
+		    (regs.num_points == 0 && known_ids == 0))) {
 			int i;
 			int modified_ids = 0, released_ids;
-			for(i = 0; i < regs.num_points; i++)
-			{
-				int x = (((int) regs.point[i].xh & 0xf) << 8) + regs.point[i].xl;
-				int y = (((int) regs.point[i].yh & 0xf) << 8) + regs.point[i].yl;
-				int touchid = (regs.point[i].yh >> 4) & 0xf;
-				
-				modified_ids |= 1 << touchid;
-
-				if(!((1 << touchid) & known_ids))
-					dev_dbg(&ts->pdev->dev, "x = %d, y = %d, touchid = %d\n", x, y, touchid);
-				
-				input_mt_slot(ts->input_dev, touchid);
-				input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, 1);
-
-				input_report_abs(ts->input_dev, ABS_MT_POSITION_X, x);
-				input_report_abs(ts->input_dev, ABS_MT_POSITION_Y, y);
 
+			for (i = 0; i < regs.num_points; i++) {
+				int x = (((int) regs.point[i].xh & 0xf) << 8) +
+					regs.point[i].xl;
+				int y = (((int) regs.point[i].yh & 0xf) << 8) +
+					regs.point[i].yl;
+				int touchid = (regs.point[i].yh >> 4) & 0xf;
+				int event_type = (regs.point[i].xh >> 6) & 0x03;
+
+				modified_ids |= ID_TO_BIT(touchid);
+
+				if (event_type == FTS_TOUCH_DOWN ||
+				    event_type == FTS_TOUCH_CONTACT) {
+					if (ts->hflip)
+						x = ts->max_x - 1 - x;
+
+					if (ts->vflip)
+						y = ts->max_y - 1 - y;
+
+					if (ts->xyswap)
+						swap(x, y);
+
+					if (!((ID_TO_BIT(touchid)) & known_ids))
+						dev_dbg(&ts->pdev->dev,
+							"x = %d, y = %d, press = %d, touchid = %d\n",
+							x, y,
+							regs.point[i].pressure,
+							touchid);
+
+					input_mt_slot(ts->input_dev, touchid);
+					input_mt_report_slot_state(
+							ts->input_dev,
+							MT_TOOL_FINGER,
+							1);
+
+					input_report_abs(ts->input_dev,
+							 ABS_MT_POSITION_X, x);
+					input_report_abs(ts->input_dev,
+							 ABS_MT_POSITION_Y, y);
+				}
 			}
 
 			released_ids = known_ids & ~modified_ids;
-			for(i = 0; released_ids && i < MAXIMUM_SUPPORTED_POINTS; i++)
-			{
-				if(released_ids & (1<<i))
-				{
-					dev_dbg(&ts->pdev->dev, "Released %d, known = %x modified = %x\n", i, known_ids, modified_ids);
+			for (i = 0;
+			     released_ids && i < MAXIMUM_SUPPORTED_POINTS;
+			     i++) {
+				if (released_ids & (1<<i)) {
+					dev_dbg(&ts->pdev->dev,
+						"Released %d, known = %x, modified = %x\n",
+						i, known_ids, modified_ids);
 					input_mt_slot(ts->input_dev, i);
-					input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, 0);
-					modified_ids &= ~(1 << i);
+					input_mt_report_slot_state(
+							ts->input_dev,
+							MT_TOOL_FINGER,
+							0);
+					modified_ids &= ~(ID_TO_BIT(i));
 				}
 			}
 			known_ids = modified_ids;
-			
+
 			input_mt_report_pointer_emulation(ts->input_dev, true);
 			input_sync(ts->input_dev);
 		}
-			
 	}
-	
+
 	return 0;
 }
 
@@ -122,13 +165,14 @@ static int ft5406_probe(struct platform_device *pdev)
 	int err = 0;
 	struct device *dev = &pdev->dev;
 	struct device_node *np = dev->of_node;
-	struct ft5406 * ts;
+	struct ft5406 *ts;
 	struct device_node *fw_node;
 	struct rpi_firmware *fw;
 	u32 touchbuf;
-	
+	u32 val;
+
 	dev_info(dev, "Probing device\n");
-	
+
 	fw_node = of_parse_phandle(np, "firmware", 0);
 	if (!fw_node) {
 		dev_err(dev, "Missing firmware node\n");
@@ -151,7 +195,8 @@ static int ft5406_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
-	ts->ts_base = dma_zalloc_coherent(dev, PAGE_SIZE, &ts->bus_addr, GFP_KERNEL);
+	ts->ts_base = dma_zalloc_coherent(dev, PAGE_SIZE, &ts->bus_addr,
+					  GFP_KERNEL);
 	if (!ts->ts_base) {
 		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
 				__func__, PAGE_SIZE);
@@ -164,17 +209,22 @@ static int ft5406_probe(struct platform_device *pdev)
 				    &touchbuf, sizeof(touchbuf));
 
 	if (err || touchbuf != 0) {
-		dev_warn(dev, "Failed to set touchbuf, trying to get err:%x\n", err);
+		dev_warn(dev, "Failed to set touchbuf, trying to get err:%x\n",
+			 err);
 		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
 		ts->ts_base = 0;
 		ts->bus_addr = 0;
 	}
 
 	if (!ts->ts_base) {
-		dev_warn(dev, "set failed, trying get (err:%d touchbuf:%x virt:%p bus:%x)\n", err, touchbuf, ts->ts_base, ts->bus_addr);
-
-		err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF,
-				    &touchbuf, sizeof(touchbuf));
+		dev_warn(dev,
+		"set failed, trying get (err:%d touchbuf:%x virt:%p bus:%x)\n",
+		err, touchbuf, ts->ts_base, ts->bus_addr);
+
+		err = rpi_firmware_property(
+				fw,
+				RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF,
+				&touchbuf, sizeof(touchbuf));
 		if (err) {
 			dev_err(dev, "Failed to get touch buffer\n");
 			goto out;
@@ -188,11 +238,10 @@ static int ft5406_probe(struct platform_device *pdev)
 
 		dev_dbg(dev, "Got TS buffer 0x%x\n", touchbuf);
 
-		// mmap the physical memory
+		/* mmap the physical memory */
 		touchbuf &= ~0xc0000000;
 		ts->ts_base = ioremap(touchbuf, sizeof(struct ft5406_regs));
-		if (ts->ts_base == NULL)
-		{
+		if (ts->ts_base == NULL) {
 			dev_err(dev, "Failed to map physical address\n");
 			err = -ENOMEM;
 			goto out;
@@ -200,22 +249,46 @@ static int ft5406_probe(struct platform_device *pdev)
 	}
 	platform_set_drvdata(pdev, ts);
 	ts->pdev = pdev;
-	
+
 	ts->input_dev->name = "FT5406 memory based driver";
-	
+
+	if (of_property_read_u32(np, "touchscreen-size-x", &val) >= 0)
+		ts->max_x = val;
+	else
+		ts->max_x = DEFAULT_SCREEN_WIDTH;
+
+	if (of_property_read_u32(np, "touchscreen-size-y", &val) >= 0)
+		ts->max_y = val;
+	else
+		ts->max_y = DEFAULT_SCREEN_HEIGHT;
+
+	if (of_property_read_u32(np, "touchscreen-inverted-x", &val) >= 0)
+		ts->hflip = val;
+
+	if (of_property_read_u32(np, "touchscreen-inverted-y", &val) >= 0)
+		ts->vflip = val;
+
+	if (of_property_read_u32(np, "touchscreen-swapped-x-y", &val) >= 0)
+		ts->xyswap = val;
+
+	dev_dbg(dev,
+		"Touchscreen parameters (%d,%d), hflip=%d, vflip=%d, xyswap=%d",
+		ts->max_x, ts->max_y, ts->hflip, ts->vflip, ts->xyswap);
+
 	__set_bit(EV_KEY, ts->input_dev->evbit);
 	__set_bit(EV_SYN, ts->input_dev->evbit);
 	__set_bit(EV_ABS, ts->input_dev->evbit);
 
 	input_set_abs_params(ts->input_dev, ABS_MT_POSITION_X, 0,
-			     SCREEN_WIDTH, 0, 0);
+			     ts->xyswap ? ts->max_y : ts->max_x, 0, 0);
 	input_set_abs_params(ts->input_dev, ABS_MT_POSITION_Y, 0,
-			     SCREEN_HEIGHT, 0, 0);
+			     ts->xyswap ? ts->max_x : ts->max_y, 0, 0);
 
-	input_mt_init_slots(ts->input_dev, MAXIMUM_SUPPORTED_POINTS, INPUT_MT_DIRECT);
+	input_mt_init_slots(ts->input_dev,
+			    MAXIMUM_SUPPORTED_POINTS, INPUT_MT_DIRECT);
 
 	input_set_drvdata(ts->input_dev, ts);
-	
+
 	err = input_register_device(ts->input_dev);
 	if (err) {
 		dev_err(dev, "could not register input device, %d\n",
@@ -223,10 +296,9 @@ static int ft5406_probe(struct platform_device *pdev)
 		goto out;
 	}
 
-	// create thread to poll the touch events
+	/* create thread that polls the touch events */
 	ts->thread = kthread_run(ft5406_thread, ts, "ft5406");
-	if(ts->thread == NULL)
-	{
+	if (ts->thread == NULL) {
 		dev_err(dev, "Failed to create kernel thread");
 		err = -ENOMEM;
 		goto out;
@@ -254,9 +326,9 @@ static int ft5406_remove(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct ft5406 *ts = (struct ft5406 *) platform_get_drvdata(pdev);
-	
+
 	dev_info(dev, "Removing rpi-ft5406\n");
-	
+
 	kthread_stop(ts->thread);
 
 	if (ts->bus_addr)
@@ -265,7 +337,7 @@ static int ft5406_remove(struct platform_device *pdev)
 		iounmap(ts->ts_base);
 	if (ts->input_dev)
 		input_unregister_device(ts->input_dev);
-	
+
 	return 0;
 }
 
-- 
GitLab


From 30b7033d366a5328ac7d73f07d885486c1f06ca5 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 27 Nov 2017 17:14:54 +0000
Subject: [PATCH 0106/1835] cgroup: Disable cgroup "memory" by default

Some Raspberry Pis have limited RAM and most users won't use the
cgroup memory support so it is disabled by default. Enable with:

    cgroup_enable=memory

See: https://github.com/raspberrypi/linux/issues/1950

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 kernel/cgroup/cgroup.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 63dae7e0ccae7..3beaab75b0810 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5290,6 +5290,8 @@ int __init cgroup_init_early(void)
 }
 
 static u16 cgroup_disable_mask __initdata;
+static u16 cgroup_enable_mask __initdata;
+static int __init cgroup_disable(char *str);
 
 /**
  * cgroup_init - cgroup initialization
@@ -5330,6 +5332,12 @@ int __init cgroup_init(void)
 
 	mutex_unlock(&cgroup_mutex);
 
+	/* Apply an implicit disable... */
+	cgroup_disable("memory");
+
+	/* ...knowing that an explicit enable will override it. */
+	cgroup_disable_mask &= ~cgroup_enable_mask;
+
 	for_each_subsys(ss, ssid) {
 		if (ss->early_init) {
 			struct cgroup_subsys_state *css =
@@ -5713,6 +5721,28 @@ static int __init cgroup_disable(char *str)
 }
 __setup("cgroup_disable=", cgroup_disable);
 
+static int __init cgroup_enable(char *str)
+{
+	struct cgroup_subsys *ss;
+	char *token;
+	int i;
+
+	while ((token = strsep(&str, ",")) != NULL) {
+		if (!*token)
+			continue;
+
+		for_each_subsys(ss, i) {
+			if (strcmp(token, ss->name) &&
+			    strcmp(token, ss->legacy_name))
+				continue;
+
+			cgroup_enable_mask |= 1 << i;
+		}
+	}
+	return 1;
+}
+__setup("cgroup_enable=", cgroup_enable);
+
 /**
  * css_tryget_online_from_dir - get corresponding css from a cgroup dentry
  * @dentry: directory dentry of interest
-- 
GitLab


From c4759ddf62b45753f76687862c736212b71560df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
Date: Wed, 3 Jun 2015 12:26:13 +0200
Subject: [PATCH 0107/1835] ARM: bcm2835: Set Serial number and Revision
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VideoCore bootloader passes in Serial number and
Revision number through Device Tree. Make these available to
userspace through /proc/cpuinfo.

Mainline status:

There is a commit in linux-next that standardize passing the serial
number through Device Tree (string: /serial-number):
ARM: 8355/1: arch: Show the serial number from devicetree in cpuinfo

There was an attempt to do the same with the revision number, but it
didn't get in:
[PATCH v2 1/2] arm: devtree: Set system_rev from DT revision

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 arch/arm/mach-bcm/board_bcm2835.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/arm/mach-bcm/board_bcm2835.c b/arch/arm/mach-bcm/board_bcm2835.c
index 8cff865ace04b..cbd42ad4ba9fe 100644
--- a/arch/arm/mach-bcm/board_bcm2835.c
+++ b/arch/arm/mach-bcm/board_bcm2835.c
@@ -15,12 +15,25 @@
 #include <linux/init.h>
 #include <linux/irqchip.h>
 #include <linux/of_address.h>
+#include <asm/system_info.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 
 #include "platsmp.h"
 
+static void __init bcm2835_init(void)
+{
+	struct device_node *np = of_find_node_by_path("/system");
+	u32 val;
+	u64 val64;
+
+	if (!of_property_read_u32(np, "linux,revision", &val))
+		system_rev = val;
+	if (!of_property_read_u64(np, "linux,serial", &val64))
+		system_serial_low = val64;
+}
+
 static const char * const bcm2835_compat[] = {
 #ifdef CONFIG_ARCH_MULTI_V6
 	"brcm,bcm2835",
@@ -33,6 +46,7 @@ static const char * const bcm2835_compat[] = {
 };
 
 DT_MACHINE_START(BCM2835, "BCM2835")
+	.init_machine = bcm2835_init,
 	.dt_compat = bcm2835_compat,
 	.smp = smp_ops(bcm2836_smp_ops),
 MACHINE_END
-- 
GitLab


From 074674980adc4bf3917e14218d7ea62950a3a5bc Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 11 Dec 2017 09:18:32 +0000
Subject: [PATCH 0108/1835] ARM: Activate FIQs to avoid __irq_startup warnings

There is a new test in __irq_startup that the IRQ is activated, which
hasn't been the case for FIQs since they bypass some of the usual setup.

Augment enable_fiq to include a call to irq_activate to avoid the
warning.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/kernel/fiq.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index cd1234c103fcd..a0f96e3b88981 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -56,6 +56,8 @@
 static unsigned long dfl_fiq_insn;
 static struct pt_regs dfl_fiq_regs;
 
+extern int irq_activate(struct irq_desc *desc);
+
 /* Default reacquire function
  * - we always relinquish FIQ control
  * - we always reacquire FIQ control
@@ -140,6 +142,8 @@ static int fiq_start;
 
 void enable_fiq(int fiq)
 {
+	struct irq_desc *desc = irq_to_desc(fiq + fiq_start);
+	irq_activate(desc);
 	enable_irq(fiq + fiq_start);
 }
 
-- 
GitLab


From f49201072d0adc999c93c2edb1e561a2aebb0323 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 22 Jan 2018 17:26:38 +0000
Subject: [PATCH 0109/1835] serial: 8250: bcm2835aux - suppress EPROBE_DEFER

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/tty/serial/8250/8250_bcm2835aux.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_bcm2835aux.c b/drivers/tty/serial/8250/8250_bcm2835aux.c
index bd53661103eb2..aa7e7eb3019bb 100644
--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
+++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
@@ -50,7 +50,8 @@ static int bcm2835aux_serial_probe(struct platform_device *pdev)
 	data->clk = devm_clk_get(&pdev->dev, NULL);
 	ret = PTR_ERR_OR_ZERO(data->clk);
 	if (ret) {
-		dev_err(&pdev->dev, "could not get clk: %d\n", ret);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "could not get clk: %d\n", ret);
 		return ret;
 	}
 
-- 
GitLab


From cbd263294881cb86cd26100dc75299c05736166c Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 14 Sep 2016 09:16:19 +0100
Subject: [PATCH 0110/1835] raspberrypi-firmware: Export the general
 transaction function.

The vc4-firmware-kms module is going to be doing the MBOX FB call.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/firmware/raspberrypi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index 12da5a6facdee..a05b00cd116a2 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -46,7 +46,7 @@ static void response_callback(struct mbox_client *cl, void *msg)
  * Sends a request to the firmware through the BCM2835 mailbox driver,
  * and synchronously waits for the reply.
  */
-static int
+int
 rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
 {
 	u32 message = MBOX_MSG(chan, data);
@@ -67,6 +67,7 @@ rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(rpi_firmware_transaction);
 
 /**
  * rpi_firmware_property_list - Submit firmware property list
-- 
GitLab


From ef594b80100fa4bbddaf90c9bbd953f44b19eda0 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 14 Sep 2016 08:39:33 +0100
Subject: [PATCH 0111/1835] drm/vc4: Add a mode for using the closed firmware
 for display.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/Makefile           |   1 +
 drivers/gpu/drm/vc4/vc4_crtc.c         |  17 +
 drivers/gpu/drm/vc4/vc4_drv.c          |   1 +
 drivers/gpu/drm/vc4/vc4_drv.h          |   7 +
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 656 +++++++++++++++++++++++++
 5 files changed, 682 insertions(+)
 create mode 100644 drivers/gpu/drm/vc4/vc4_firmware_kms.c

diff --git a/drivers/gpu/drm/vc4/Makefile b/drivers/gpu/drm/vc4/Makefile
index b303703bc7f37..e90c6304775ab 100644
--- a/drivers/gpu/drm/vc4/Makefile
+++ b/drivers/gpu/drm/vc4/Makefile
@@ -9,6 +9,7 @@ vc4-y := \
 	vc4_dpi.o \
 	vc4_dsi.o \
 	vc4_fence.o \
+	vc4_firmware_kms.o \
 	vc4_kms.o \
 	vc4_gem.o \
 	vc4_hdmi.o \
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 5615ceb15708f..f53216955960f 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -133,6 +133,9 @@ bool vc4_crtc_get_scanoutpos(struct drm_device *dev, unsigned int crtc_id,
 	int vblank_lines;
 	bool ret = false;
 
+	if (vc4->firmware_kms)
+		return 0;
+
 	/* preempt_disable_rt() should go right here in PREEMPT_RT patchset. */
 
 	/* Get optional system timestamp before query. */
@@ -761,8 +764,15 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 
 static int vc4_enable_vblank(struct drm_crtc *crtc)
 {
+	struct drm_device *dev = crtc->dev;
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 
+	if (vc4->firmware_kms) {
+		/* XXX: Can we mask the SMI interrupt? */
+		return 0;
+	}
+
 	CRTC_WRITE(PV_INTEN, PV_INT_VFP_START);
 
 	return 0;
@@ -770,8 +780,15 @@ static int vc4_enable_vblank(struct drm_crtc *crtc)
 
 static void vc4_disable_vblank(struct drm_crtc *crtc)
 {
+	struct drm_device *dev = crtc->dev;
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 
+	if (vc4->firmware_kms) {
+		/* XXX: Can we mask the SMI interrupt? */
+		return;
+	}
+
 	CRTC_WRITE(PV_INTEN, 0);
 }
 
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 04270a14fcaaf..5b2f60b0e9048 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -347,6 +347,7 @@ static struct platform_driver *const component_drivers[] = {
 	&vc4_txp_driver,
 	&vc4_hvs_driver,
 	&vc4_crtc_driver,
+	&vc4_firmware_kms_driver,
 	&vc4_v3d_driver,
 };
 
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index bd6ef1f318220..b4c3bc982d32e 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -67,6 +67,9 @@ struct vc4_perfmon {
 struct vc4_dev {
 	struct drm_device *dev;
 
+	bool firmware_kms;
+	struct rpi_firmware *firmware;
+
 	struct vc4_hdmi *hdmi;
 	struct vc4_hvs *hvs;
 	struct vc4_v3d *v3d;
@@ -719,6 +722,10 @@ int vc4_dsi_debugfs_regs(struct seq_file *m, void *unused);
 /* vc4_fence.c */
 extern const struct dma_fence_ops vc4_fence_ops;
 
+/* vc4_firmware_kms.c */
+extern struct platform_driver vc4_firmware_kms_driver;
+void vc4_fkms_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file);
+
 /* vc4_gem.c */
 void vc4_gem_init(struct drm_device *dev);
 void vc4_gem_destroy(struct drm_device *dev);
diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
new file mode 100644
index 0000000000000..78c3430593550
--- /dev/null
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -0,0 +1,656 @@
+/*
+ * Copyright (C) 2016 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/**
+ * DOC: VC4 firmware KMS module.
+ *
+ * As a hack to get us from the current closed source driver world
+ * toward a totally open stack, implement KMS on top of the Raspberry
+ * Pi's firmware display stack.
+ */
+
+#include "drm/drm_atomic_helper.h"
+#include "drm/drm_plane_helper.h"
+#include "drm/drm_crtc_helper.h"
+#include "linux/clk.h"
+#include "linux/debugfs.h"
+#include "drm/drm_fb_cma_helper.h"
+#include "linux/component.h"
+#include "linux/of_device.h"
+#include "vc4_drv.h"
+#include "vc4_regs.h"
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+/* The firmware delivers a vblank interrupt to us through the SMI
+ * hardware, which has only this one register.
+ */
+#define SMICS 0x0
+#define SMICS_INTERRUPTS (BIT(9) | BIT(10) | BIT(11))
+
+struct vc4_crtc {
+	struct drm_crtc base;
+	struct drm_encoder *encoder;
+	struct drm_connector *connector;
+	void __iomem *regs;
+
+	struct drm_pending_vblank_event *event;
+};
+
+static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
+{
+	return container_of(crtc, struct vc4_crtc, base);
+}
+
+struct vc4_fkms_encoder {
+	struct drm_encoder base;
+};
+
+static inline struct vc4_fkms_encoder *
+to_vc4_fkms_encoder(struct drm_encoder *encoder)
+{
+	return container_of(encoder, struct vc4_fkms_encoder, base);
+}
+
+/* VC4 FKMS connector KMS struct */
+struct vc4_fkms_connector {
+	struct drm_connector base;
+
+	/* Since the connector is attached to just the one encoder,
+	 * this is the reference to it so we can do the best_encoder()
+	 * hook.
+	 */
+	struct drm_encoder *encoder;
+};
+
+static inline struct vc4_fkms_connector *
+to_vc4_fkms_connector(struct drm_connector *connector)
+{
+	return container_of(connector, struct vc4_fkms_connector, base);
+}
+
+/* Firmware's structure for making an FB mbox call. */
+struct fbinfo_s {
+	u32 xres, yres, xres_virtual, yres_virtual;
+	u32 pitch, bpp;
+	u32 xoffset, yoffset;
+	u32 base;
+	u32 screen_size;
+	u16 cmap[256];
+};
+
+struct vc4_fkms_plane {
+	struct drm_plane base;
+	struct fbinfo_s *fbinfo;
+	dma_addr_t fbinfo_bus_addr;
+	u32 pitch;
+};
+
+static inline struct vc4_fkms_plane *to_vc4_fkms_plane(struct drm_plane *plane)
+{
+	return (struct vc4_fkms_plane *)plane;
+}
+
+/* Turns the display on/off. */
+static int vc4_plane_set_primary_blank(struct drm_plane *plane, bool blank)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+
+	u32 packet = blank;
+	return rpi_firmware_property(vc4->firmware,
+				     RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+				     &packet, sizeof(packet));
+}
+
+static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
+					    struct drm_plane_state *old_state)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
+	struct drm_plane_state *state = plane->state;
+	struct drm_framebuffer *fb = state->fb;
+	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
+	volatile struct fbinfo_s *fbinfo = vc4_plane->fbinfo;
+	u32 bpp = 32;
+	int ret;
+
+	vc4_plane_set_primary_blank(plane, false);
+
+	fbinfo->xres = state->crtc_w;
+	fbinfo->yres = state->crtc_h;
+	fbinfo->xres_virtual = state->crtc_w;
+	fbinfo->yres_virtual = state->crtc_h;
+	fbinfo->bpp = bpp;
+	fbinfo->xoffset = state->crtc_x;
+	fbinfo->yoffset = state->crtc_y;
+	fbinfo->base = bo->paddr + fb->offsets[0];
+	fbinfo->pitch = fb->pitches[0];
+	/* A bug in the firmware makes it so that if the fb->base is
+	 * set to nonzero, the configured pitch gets overwritten with
+	 * the previous pitch.  So, to get the configured pitch
+	 * recomputed, we have to make it allocate itself a new buffer
+	 * in VC memory, first.
+	 */
+	if (vc4_plane->pitch != fb->pitches[0]) {
+		u32 saved_base = fbinfo->base;
+		fbinfo->base = 0;
+
+		ret = rpi_firmware_transaction(vc4->firmware,
+					       RPI_FIRMWARE_CHAN_FB,
+					       vc4_plane->fbinfo_bus_addr);
+		fbinfo->base = saved_base;
+
+		vc4_plane->pitch = fbinfo->pitch;
+		WARN_ON_ONCE(vc4_plane->pitch != fb->pitches[0]);
+	}
+
+	ret = rpi_firmware_transaction(vc4->firmware,
+				       RPI_FIRMWARE_CHAN_FB,
+				       vc4_plane->fbinfo_bus_addr);
+	WARN_ON_ONCE(fbinfo->pitch != fb->pitches[0]);
+	WARN_ON_ONCE(fbinfo->base != bo->paddr + fb->offsets[0]);
+}
+
+static void vc4_primary_plane_atomic_disable(struct drm_plane *plane,
+					     struct drm_plane_state *old_state)
+{
+	vc4_plane_set_primary_blank(plane, true);
+}
+
+static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
+					   struct drm_plane_state *old_state)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	struct drm_plane_state *state = plane->state;
+	struct drm_framebuffer *fb = state->fb;
+	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
+	int ret;
+	u32 packet_state[] = { true, state->crtc_x, state->crtc_y, 0 };
+	u32 packet_info[] = { state->crtc_w, state->crtc_h,
+			      0, /* unused */
+			      bo->paddr + fb->offsets[0],
+			      0, 0, /* hotx, hoty */};
+	WARN_ON_ONCE(fb->pitches[0] != state->crtc_w * 4);
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_SET_CURSOR_STATE,
+				    &packet_state,
+				    sizeof(packet_state));
+	if (ret || packet_state[0] != 0)
+		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_SET_CURSOR_INFO,
+				    &packet_info,
+				    sizeof(packet_info));
+	if (ret || packet_info[0] != 0)
+		DRM_ERROR("Failed to set cursor info: 0x%08x\n", packet_info[0]);
+}
+
+static void vc4_cursor_plane_atomic_disable(struct drm_plane *plane,
+					    struct drm_plane_state *old_state)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	u32 packet_state[] = { false, 0, 0, 0 };
+	int ret;
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_SET_CURSOR_STATE,
+				    &packet_state,
+				    sizeof(packet_state));
+	if (ret || packet_state[0] != 0)
+		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
+}
+
+static int vc4_plane_atomic_check(struct drm_plane *plane,
+				  struct drm_plane_state *state)
+{
+	return 0;
+}
+
+static void vc4_plane_destroy(struct drm_plane *plane)
+{
+	drm_plane_helper_disable(plane);
+	drm_plane_cleanup(plane);
+}
+
+static const struct drm_plane_funcs vc4_plane_funcs = {
+	.update_plane = drm_atomic_helper_update_plane,
+	.disable_plane = drm_atomic_helper_disable_plane,
+	.destroy = vc4_plane_destroy,
+	.set_property = NULL,
+	.reset = drm_atomic_helper_plane_reset,
+	.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
+};
+
+static const struct drm_plane_helper_funcs vc4_primary_plane_helper_funcs = {
+	.prepare_fb = NULL,
+	.cleanup_fb = NULL,
+	.atomic_check = vc4_plane_atomic_check,
+	.atomic_update = vc4_primary_plane_atomic_update,
+	.atomic_disable = vc4_primary_plane_atomic_disable,
+};
+
+static const struct drm_plane_helper_funcs vc4_cursor_plane_helper_funcs = {
+	.prepare_fb = NULL,
+	.cleanup_fb = NULL,
+	.atomic_check = vc4_plane_atomic_check,
+	.atomic_update = vc4_cursor_plane_atomic_update,
+	.atomic_disable = vc4_cursor_plane_atomic_disable,
+};
+
+static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
+					     enum drm_plane_type type)
+{
+	struct drm_plane *plane = NULL;
+	struct vc4_fkms_plane *vc4_plane;
+	u32 xrgb8888 = DRM_FORMAT_XRGB8888;
+	u32 argb8888 = DRM_FORMAT_ARGB8888;
+	int ret = 0;
+	bool primary = (type == DRM_PLANE_TYPE_PRIMARY);
+
+	vc4_plane = devm_kzalloc(dev->dev, sizeof(*vc4_plane),
+				 GFP_KERNEL);
+	if (!vc4_plane) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	plane = &vc4_plane->base;
+	ret = drm_universal_plane_init(dev, plane, 0xff,
+				       &vc4_plane_funcs,
+				       primary ? &xrgb8888 : &argb8888, 1, NULL,
+				       type, NULL);
+
+	if (type == DRM_PLANE_TYPE_PRIMARY) {
+		vc4_plane->fbinfo =
+			dma_alloc_coherent(dev->dev,
+					   sizeof(*vc4_plane->fbinfo),
+					   &vc4_plane->fbinfo_bus_addr,
+					   GFP_KERNEL);
+		memset(vc4_plane->fbinfo, 0, sizeof(*vc4_plane->fbinfo));
+
+		drm_plane_helper_add(plane, &vc4_primary_plane_helper_funcs);
+	} else {
+		drm_plane_helper_add(plane, &vc4_cursor_plane_helper_funcs);
+	}
+
+	return plane;
+fail:
+	if (plane)
+		vc4_plane_destroy(plane);
+
+	return ERR_PTR(ret);
+}
+
+static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
+{
+	/* Everyting is handled in the planes. */
+}
+
+static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
+{
+}
+
+static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
+{
+}
+
+static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
+				 struct drm_crtc_state *state)
+{
+	return 0;
+}
+
+static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
+				  struct drm_crtc_state *old_state)
+{
+}
+
+static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
+{
+	struct drm_crtc *crtc = &vc4_crtc->base;
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	if (vc4_crtc->event) {
+		drm_crtc_send_vblank_event(crtc, vc4_crtc->event);
+		vc4_crtc->event = NULL;
+		drm_crtc_vblank_put(crtc);
+	}
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
+{
+	struct vc4_crtc *vc4_crtc = data;
+	u32 stat = readl(vc4_crtc->regs + SMICS);
+	irqreturn_t ret = IRQ_NONE;
+
+	if (stat & SMICS_INTERRUPTS) {
+		writel(0, vc4_crtc->regs + SMICS);
+		drm_crtc_handle_vblank(&vc4_crtc->base);
+		vc4_crtc_handle_page_flip(vc4_crtc);
+		ret = IRQ_HANDLED;
+	}
+
+	return ret;
+}
+
+static int vc4_page_flip(struct drm_crtc *crtc,
+			 struct drm_framebuffer *fb,
+			 struct drm_pending_vblank_event *event,
+			 uint32_t flags, struct drm_modeset_acquire_ctx *ctx)
+{
+	if (flags & DRM_MODE_PAGE_FLIP_ASYNC) {
+		DRM_ERROR("Async flips aren't allowed\n");
+		return -EINVAL;
+	}
+
+	return drm_atomic_helper_page_flip(crtc, fb, event, flags, ctx);
+}
+
+static const struct drm_crtc_funcs vc4_crtc_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.destroy = drm_crtc_cleanup,
+	.page_flip = vc4_page_flip,
+	.set_property = NULL,
+	.cursor_set = NULL, /* handled by drm_mode_cursor_universal */
+	.cursor_move = NULL, /* handled by drm_mode_cursor_universal */
+	.reset = drm_atomic_helper_crtc_reset,
+	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+};
+
+static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
+	.mode_set_nofb = vc4_crtc_mode_set_nofb,
+	.atomic_disable = vc4_crtc_disable,
+	.atomic_enable = vc4_crtc_enable,
+	.atomic_check = vc4_crtc_atomic_check,
+	.atomic_flush = vc4_crtc_atomic_flush,
+};
+
+/* Frees the page flip event when the DRM device is closed with the
+ * event still outstanding.
+ */
+void vc4_fkms_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
+{
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+
+	if (vc4_crtc->event && vc4_crtc->event->base.file_priv == file) {
+		kfree(&vc4_crtc->event->base);
+		drm_crtc_vblank_put(crtc);
+		vc4_crtc->event = NULL;
+	}
+
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static const struct of_device_id vc4_firmware_kms_dt_match[] = {
+	{ .compatible = "raspberrypi,rpi-firmware-kms" },
+	{}
+};
+
+static enum drm_connector_status
+vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
+{
+	return connector_status_connected;
+}
+
+static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
+	u32 wh[2] = {0, 0};
+	int ret;
+	struct drm_display_mode *mode;
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT,
+				    &wh, sizeof(wh));
+	if (ret) {
+		DRM_ERROR("Failed to get screen size: %d (0x%08x 0x%08x)\n",
+			  ret, wh[0], wh[1]);
+		return 0;
+	}
+
+	mode = drm_cvt_mode(dev, wh[0], wh[1], 60 /* vrefresh */,
+			    0, 0, false);
+	drm_mode_probed_add(connector, mode);
+
+	return 1;
+}
+
+static struct drm_encoder *
+vc4_fkms_connector_best_encoder(struct drm_connector *connector)
+{
+	struct vc4_fkms_connector *fkms_connector =
+		to_vc4_fkms_connector(connector);
+	return fkms_connector->encoder;
+}
+
+static void vc4_fkms_connector_destroy(struct drm_connector *connector)
+{
+	drm_connector_unregister(connector);
+	drm_connector_cleanup(connector);
+}
+
+static const struct drm_connector_funcs vc4_fkms_connector_funcs = {
+	.detect = vc4_fkms_connector_detect,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.destroy = vc4_fkms_connector_destroy,
+	.reset = drm_atomic_helper_connector_reset,
+	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs = {
+	.get_modes = vc4_fkms_connector_get_modes,
+	.best_encoder = vc4_fkms_connector_best_encoder,
+};
+
+static struct drm_connector *vc4_fkms_connector_init(struct drm_device *dev,
+						     struct drm_encoder *encoder)
+{
+	struct drm_connector *connector = NULL;
+	struct vc4_fkms_connector *fkms_connector;
+	int ret = 0;
+
+	fkms_connector = devm_kzalloc(dev->dev, sizeof(*fkms_connector),
+				      GFP_KERNEL);
+	if (!fkms_connector) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+	connector = &fkms_connector->base;
+
+	fkms_connector->encoder = encoder;
+
+	drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
+			   DRM_MODE_CONNECTOR_HDMIA);
+	drm_connector_helper_add(connector, &vc4_fkms_connector_helper_funcs);
+
+	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
+			     DRM_CONNECTOR_POLL_DISCONNECT);
+
+	connector->interlace_allowed = 0;
+	connector->doublescan_allowed = 0;
+
+	drm_mode_connector_attach_encoder(connector, encoder);
+
+	return connector;
+
+ fail:
+	if (connector)
+		vc4_fkms_connector_destroy(connector);
+
+	return ERR_PTR(ret);
+}
+
+static void vc4_fkms_encoder_destroy(struct drm_encoder *encoder)
+{
+	drm_encoder_cleanup(encoder);
+}
+
+static const struct drm_encoder_funcs vc4_fkms_encoder_funcs = {
+	.destroy = vc4_fkms_encoder_destroy,
+};
+
+static void vc4_fkms_encoder_enable(struct drm_encoder *encoder)
+{
+}
+
+static void vc4_fkms_encoder_disable(struct drm_encoder *encoder)
+{
+}
+
+static const struct drm_encoder_helper_funcs vc4_fkms_encoder_helper_funcs = {
+	.enable = vc4_fkms_encoder_enable,
+	.disable = vc4_fkms_encoder_disable,
+};
+
+static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct drm_device *drm = dev_get_drvdata(master);
+	struct vc4_dev *vc4 = to_vc4_dev(drm);
+	struct vc4_crtc *vc4_crtc;
+	struct vc4_fkms_encoder *vc4_encoder;
+	struct drm_crtc *crtc;
+	struct drm_plane *primary_plane, *cursor_plane, *destroy_plane, *temp;
+	struct device_node *firmware_node;
+	int ret;
+
+	vc4->firmware_kms = true;
+
+	vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
+	if (!vc4_crtc)
+		return -ENOMEM;
+	crtc = &vc4_crtc->base;
+
+	firmware_node = of_parse_phandle(dev->of_node, "brcm,firmware", 0);
+	vc4->firmware = rpi_firmware_get(firmware_node);
+	if (!vc4->firmware) {
+		DRM_DEBUG("Failed to get Raspberry Pi firmware reference.\n");
+		return -EPROBE_DEFER;
+	}
+	of_node_put(firmware_node);
+
+	/* Map the SMI interrupt reg */
+	vc4_crtc->regs = vc4_ioremap_regs(pdev, 0);
+	if (IS_ERR(vc4_crtc->regs))
+		return PTR_ERR(vc4_crtc->regs);
+
+	/* For now, we create just the primary and the legacy cursor
+	 * planes.  We should be able to stack more planes on easily,
+	 * but to do that we would need to compute the bandwidth
+	 * requirement of the plane configuration, and reject ones
+	 * that will take too much.
+	 */
+	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY);
+	if (IS_ERR(primary_plane)) {
+		dev_err(dev, "failed to construct primary plane\n");
+		ret = PTR_ERR(primary_plane);
+		goto err;
+	}
+
+	cursor_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_CURSOR);
+	if (IS_ERR(cursor_plane)) {
+		dev_err(dev, "failed to construct cursor plane\n");
+		ret = PTR_ERR(cursor_plane);
+		goto err;
+	}
+
+	drm_crtc_init_with_planes(drm, crtc, primary_plane, cursor_plane,
+				  &vc4_crtc_funcs, NULL);
+	drm_crtc_helper_add(crtc, &vc4_crtc_helper_funcs);
+	primary_plane->crtc = crtc;
+	cursor_plane->crtc = crtc;
+
+	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
+	if (!vc4_encoder)
+		return -ENOMEM;
+	vc4_crtc->encoder = &vc4_encoder->base;
+	vc4_encoder->base.possible_crtcs |= drm_crtc_mask(crtc) ;
+	drm_encoder_init(drm, &vc4_encoder->base, &vc4_fkms_encoder_funcs,
+			 DRM_MODE_ENCODER_TMDS, NULL);
+	drm_encoder_helper_add(&vc4_encoder->base,
+			       &vc4_fkms_encoder_helper_funcs);
+
+	vc4_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base);
+	if (IS_ERR(vc4_crtc->connector)) {
+		ret = PTR_ERR(vc4_crtc->connector);
+		goto err_destroy_encoder;
+	}
+
+	writel(0, vc4_crtc->regs + SMICS);
+	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+			       vc4_crtc_irq_handler, 0, "vc4 firmware kms",
+			       vc4_crtc);
+	if (ret)
+		goto err_destroy_connector;
+
+	platform_set_drvdata(pdev, vc4_crtc);
+
+	return 0;
+
+err_destroy_connector:
+	vc4_fkms_connector_destroy(vc4_crtc->connector);
+err_destroy_encoder:
+	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
+	list_for_each_entry_safe(destroy_plane, temp,
+				 &drm->mode_config.plane_list, head) {
+		if (destroy_plane->possible_crtcs == 1 << drm_crtc_index(crtc))
+		    destroy_plane->funcs->destroy(destroy_plane);
+	}
+err:
+	return ret;
+}
+
+static void vc4_fkms_unbind(struct device *dev, struct device *master,
+			    void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct vc4_crtc *vc4_crtc = dev_get_drvdata(dev);
+
+	vc4_fkms_connector_destroy(vc4_crtc->connector);
+	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
+	drm_crtc_cleanup(&vc4_crtc->base);
+
+	platform_set_drvdata(pdev, NULL);
+}
+
+static const struct component_ops vc4_fkms_ops = {
+	.bind   = vc4_fkms_bind,
+	.unbind = vc4_fkms_unbind,
+};
+
+static int vc4_fkms_probe(struct platform_device *pdev)
+{
+	return component_add(&pdev->dev, &vc4_fkms_ops);
+}
+
+static int vc4_fkms_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &vc4_fkms_ops);
+	return 0;
+}
+
+struct platform_driver vc4_firmware_kms_driver = {
+	.probe = vc4_fkms_probe,
+	.remove = vc4_fkms_remove,
+	.driver = {
+		.name = "vc4_firmware_kms",
+		.of_match_table = vc4_firmware_kms_dt_match,
+	},
+};
-- 
GitLab


From a4906957780a6ad345dc9385f17757df9b3772d8 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 1 Feb 2017 17:09:18 -0800
Subject: [PATCH 0112/1835] drm/vc4: Name the primary and cursor planes in
 fkms.

This makes debugging nicer, compared to trying to remember what the
IDs are.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 78c3430593550..d9a5551d01a21 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -265,7 +265,7 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	ret = drm_universal_plane_init(dev, plane, 0xff,
 				       &vc4_plane_funcs,
 				       primary ? &xrgb8888 : &argb8888, 1, NULL,
-				       type, NULL);
+				       type, primary ? "primary" : "cursor");
 
 	if (type == DRM_PLANE_TYPE_PRIMARY) {
 		vc4_plane->fbinfo =
-- 
GitLab


From d8954cd52524dd2d37f8ea8454f8fae8ecff7b9b Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 1 Feb 2017 17:10:09 -0800
Subject: [PATCH 0113/1835] drm/vc4: Add DRM_DEBUG_ATOMIC for the insides of
 fkms.

Trying to debug weston on fkms involved figuring out what calls I was
making to the firmware.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index d9a5551d01a21..e372666af0119 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -101,6 +101,11 @@ static int vc4_plane_set_primary_blank(struct drm_plane *plane, bool blank)
 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
 
 	u32 packet = blank;
+
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary plane %s",
+			 plane->base.id, plane->name,
+			 blank ? "blank" : "unblank");
+
 	return rpi_firmware_property(vc4->firmware,
 				     RPI_FIRMWARE_FRAMEBUFFER_BLANK,
 				     &packet, sizeof(packet));
@@ -148,6 +153,16 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 		WARN_ON_ONCE(vc4_plane->pitch != fb->pitches[0]);
 	}
 
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary update %dx%d@%d +%d,%d 0x%08x/%d\n",
+			 plane->base.id, plane->name,
+			 state->crtc_w,
+			 state->crtc_h,
+			 bpp,
+			 state->crtc_x,
+			 state->crtc_y,
+			 bo->paddr + fb->offsets[0],
+			 fb->pitches[0]);
+
 	ret = rpi_firmware_transaction(vc4->firmware,
 				       RPI_FIRMWARE_CHAN_FB,
 				       vc4_plane->fbinfo_bus_addr);
@@ -176,6 +191,15 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 			      0, 0, /* hotx, hoty */};
 	WARN_ON_ONCE(fb->pitches[0] != state->crtc_w * 4);
 
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] update %dx%d cursor at %d,%d (0x%08x/%d)",
+			 plane->base.id, plane->name,
+			 state->crtc_w,
+			 state->crtc_h,
+			 state->crtc_x,
+			 state->crtc_y,
+			 bo->paddr + fb->offsets[0],
+			 fb->pitches[0]);
+
 	ret = rpi_firmware_property(vc4->firmware,
 				    RPI_FIRMWARE_SET_CURSOR_STATE,
 				    &packet_state,
@@ -198,6 +222,8 @@ static void vc4_cursor_plane_atomic_disable(struct drm_plane *plane,
 	u32 packet_state[] = { false, 0, 0, 0 };
 	int ret;
 
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] disabling cursor", plane->base.id, plane->name);
+
 	ret = rpi_firmware_property(vc4->firmware,
 				    RPI_FIRMWARE_SET_CURSOR_STATE,
 				    &packet_state,
-- 
GitLab


From 5fb60153e9fe979ea9abda8203df757d46b16b6d Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 2 Feb 2017 09:42:18 -0800
Subject: [PATCH 0114/1835] drm/vc4: Fix sending of page flip completion events
 in FKMS mode.

In the rewrite of vc4_crtc.c for fkms, I dropped the part of the
CRTC's atomic flush handler that moved the completion event from the
proposed atomic state change to the CRTC's current state.  That meant
that when full screen pageflipping happened (glxgears -fullscreen in
X, compton, por weston), the app would end up blocked firever waiting
to draw its next frame.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index e372666af0119..4d7b7f218cbbc 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -336,6 +336,21 @@ static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
 static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 				  struct drm_crtc_state *old_state)
 {
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+
+	if (crtc->state->event) {
+		unsigned long flags;
+
+		crtc->state->event->pipe = drm_crtc_index(crtc);
+
+		WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
+		spin_lock_irqsave(&dev->event_lock, flags);
+		vc4_crtc->event = crtc->state->event;
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+	}
 }
 
 static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
-- 
GitLab


From dd068d7f1d700795bc34f61547753ecaccbef076 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 6 Jul 2017 11:45:48 -0700
Subject: [PATCH 0115/1835] drm/vc4: Add support for setting DPMS in
 firmwarekms.

This ensures that the screen goes blank during DPMS (screensaver),
including the cursor.  Planes don't necessarily get disabled during
CRTC disable, so we need to be careful to not leave them on or turn
them back on early.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 40 ++++++++++++++++++++++++--
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 4d7b7f218cbbc..809437cf32158 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -36,6 +36,8 @@ struct vc4_crtc {
 	struct drm_crtc base;
 	struct drm_encoder *encoder;
 	struct drm_connector *connector;
+	struct drm_plane *primary;
+	struct drm_plane *cursor;
 	void __iomem *regs;
 
 	struct drm_pending_vblank_event *event;
@@ -123,8 +125,6 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 	u32 bpp = 32;
 	int ret;
 
-	vc4_plane_set_primary_blank(plane, false);
-
 	fbinfo->xres = state->crtc_w;
 	fbinfo->yres = state->crtc_h;
 	fbinfo->xres_virtual = state->crtc_w;
@@ -168,6 +168,12 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 				       vc4_plane->fbinfo_bus_addr);
 	WARN_ON_ONCE(fbinfo->pitch != fb->pitches[0]);
 	WARN_ON_ONCE(fbinfo->base != bo->paddr + fb->offsets[0]);
+
+	/* If the CRTC is on (or going to be on) and we're enabled,
+	 * then unblank.  Otherwise, stay blank until CRTC enable.
+	*/
+	if (state->crtc->state->active)
+		vc4_plane_set_primary_blank(plane, false);
 }
 
 static void vc4_primary_plane_atomic_disable(struct drm_plane *plane,
@@ -184,7 +190,12 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
 	int ret;
-	u32 packet_state[] = { true, state->crtc_x, state->crtc_y, 0 };
+	u32 packet_state[] = {
+		state->crtc->state->active,
+		state->crtc_x,
+		state->crtc_y,
+		0
+	};
 	u32 packet_info[] = { state->crtc_w, state->crtc_h,
 			      0, /* unused */
 			      bo->paddr + fb->offsets[0],
@@ -321,10 +332,30 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+
+	/* Always turn the planes off on CRTC disable. In DRM, planes
+	 * are enabled/disabled through the update/disable hooks
+	 * above, and the CRTC enable/disable independently controls
+	 * whether anything scans out at all, but the firmware doesn't
+	 * give us a CRTC-level control for that.
+	 */
+	vc4_cursor_plane_atomic_disable(vc4_crtc->cursor,
+					vc4_crtc->cursor->state);
+	vc4_plane_set_primary_blank(vc4_crtc->primary, true);
 }
 
 static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+
+	/* Unblank the planes (if they're supposed to be displayed). */
+	if (vc4_crtc->primary->state->fb)
+		vc4_plane_set_primary_blank(vc4_crtc->primary, false);
+	if (vc4_crtc->cursor->state->fb) {
+		vc4_cursor_plane_atomic_update(vc4_crtc->cursor,
+					       vc4_crtc->cursor->state);
+	}
 }
 
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
@@ -618,6 +649,9 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	primary_plane->crtc = crtc;
 	cursor_plane->crtc = crtc;
 
+	vc4_crtc->primary = primary_plane;
+	vc4_crtc->cursor = cursor_plane;
+
 	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
 	if (!vc4_encoder)
 		return -ENOMEM;
-- 
GitLab


From 18c7daac056de2f6aa3301aac92be1b55ab515e6 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 7 Jun 2017 14:39:49 -0700
Subject: [PATCH 0116/1835] drm/vc4: Add FB modifier support to firmwarekms.

Signed-off-by: Eric Anholt <eric@anholt.net>
(cherry picked from commit 11752d73488e08aaeb65fe8289a9c016acde26c2)
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 809437cf32158..d5066f395b621 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -17,6 +17,7 @@
 #include "drm/drm_atomic_helper.h"
 #include "drm/drm_plane_helper.h"
 #include "drm/drm_crtc_helper.h"
+#include "drm/drm_fourcc.h"
 #include "linux/clk.h"
 #include "linux/debugfs.h"
 #include "drm/drm_fb_cma_helper.h"
@@ -134,6 +135,10 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 	fbinfo->yoffset = state->crtc_y;
 	fbinfo->base = bo->paddr + fb->offsets[0];
 	fbinfo->pitch = fb->pitches[0];
+
+	if (fb->modifier == DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED)
+		fbinfo->bpp |= BIT(31);
+
 	/* A bug in the firmware makes it so that if the fb->base is
 	 * set to nonzero, the configured pitch gets overwritten with
 	 * the previous pitch.  So, to get the configured pitch
-- 
GitLab


From dc228c1e6f33f4546ddf61750df5e46bc2b33dd9 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Tue, 30 Jan 2018 14:21:02 -0800
Subject: [PATCH 0117/1835] drm/vc4: Add missing enable/disable vblank handlers
 in fkms.

Fixes hang at boot in 4.14.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_crtc.c         | 14 --------------
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 15 +++++++++++++++
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index f53216955960f..5a286801faa59 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -764,15 +764,8 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 
 static int vc4_enable_vblank(struct drm_crtc *crtc)
 {
-	struct drm_device *dev = crtc->dev;
-	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 
-	if (vc4->firmware_kms) {
-		/* XXX: Can we mask the SMI interrupt? */
-		return 0;
-	}
-
 	CRTC_WRITE(PV_INTEN, PV_INT_VFP_START);
 
 	return 0;
@@ -780,15 +773,8 @@ static int vc4_enable_vblank(struct drm_crtc *crtc)
 
 static void vc4_disable_vblank(struct drm_crtc *crtc)
 {
-	struct drm_device *dev = crtc->dev;
-	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 
-	if (vc4->firmware_kms) {
-		/* XXX: Can we mask the SMI interrupt? */
-		return;
-	}
-
 	CRTC_WRITE(PV_INTEN, 0);
 }
 
diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index d5066f395b621..e3dfc20c404ca 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -433,6 +433,19 @@ static int vc4_page_flip(struct drm_crtc *crtc,
 	return drm_atomic_helper_page_flip(crtc, fb, event, flags, ctx);
 }
 
+static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
+{
+	/* XXX: Need a way to enable/disable the interrupt, to avoid
+	 * DRM warnings at boot time.
+	 */
+
+	return 0;
+}
+
+static void vc4_fkms_disable_vblank(struct drm_crtc *crtc)
+{
+}
+
 static const struct drm_crtc_funcs vc4_crtc_funcs = {
 	.set_config = drm_atomic_helper_set_config,
 	.destroy = drm_crtc_cleanup,
@@ -443,6 +456,8 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = {
 	.reset = drm_atomic_helper_crtc_reset,
 	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+	.enable_vblank = vc4_fkms_enable_vblank,
+	.disable_vblank = vc4_fkms_disable_vblank,
 };
 
 static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
-- 
GitLab


From 75c60dd2a904663e0e606efd0bfb369163e167fe Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 18 Apr 2017 21:43:46 +0100
Subject: [PATCH 0118/1835] vc4_fkms: Apply firmware overscan offset to
 hardware cursor

---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index e3dfc20c404ca..7edb38953a6a2 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -42,6 +42,7 @@ struct vc4_crtc {
 	void __iomem *regs;
 
 	struct drm_pending_vblank_event *event;
+	u32 overscan[4];
 };
 
 static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
@@ -191,6 +192,7 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 					   struct drm_plane_state *old_state)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(plane->crtc);
 	struct drm_plane_state *state = plane->state;
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
@@ -216,6 +218,12 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 			 bo->paddr + fb->offsets[0],
 			 fb->pitches[0]);
 
+	/* add on the top/left offsets when overscan is active */
+	if (vc4_crtc) {
+		packet_state[1] += vc4_crtc->overscan[0];
+		packet_state[2] += vc4_crtc->overscan[1];
+	}
+
 	ret = rpi_firmware_property(vc4->firmware,
 				    RPI_FIRMWARE_SET_CURSOR_STATE,
 				    &packet_state,
@@ -695,6 +703,15 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	if (ret)
 		goto err_destroy_connector;
 
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN,
+				    &vc4_crtc->overscan,
+				    sizeof(vc4_crtc->overscan));
+	if (ret) {
+		DRM_ERROR("Failed to get overscan state: 0x%08x\n", vc4_crtc->overscan[0]);
+		memset(&vc4_crtc->overscan, 0, sizeof(vc4_crtc->overscan));
+	}
+
 	platform_set_drvdata(pdev, vc4_crtc);
 
 	return 0;
-- 
GitLab


From 54151729c25f5e74b98c5b7f3955bf89aa9eec49 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 5 Feb 2018 18:01:02 +0000
Subject: [PATCH 0119/1835] drm/vc4: Fix warning about vblank interrupts before
 DRM core is ready.

The SMICS interrupt fires continuously, but since it's 1/100 the rate
of the USB interrupts, we don't really need a way to turn it off.  We
do need to make sure that we don't tell DRM about it until DRM has
asked for the interrupt at least once, because otherwise it will throw
a warning at boot time.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 7edb38953a6a2..967a0bf5886b7 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -43,6 +43,7 @@ struct vc4_crtc {
 
 	struct drm_pending_vblank_event *event;
 	u32 overscan[4];
+	bool vblank_enabled;
 };
 
 static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
@@ -420,7 +421,8 @@ static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 
 	if (stat & SMICS_INTERRUPTS) {
 		writel(0, vc4_crtc->regs + SMICS);
-		drm_crtc_handle_vblank(&vc4_crtc->base);
+		if (vc4_crtc->vblank_enabled)
+			drm_crtc_handle_vblank(&vc4_crtc->base);
 		vc4_crtc_handle_page_flip(vc4_crtc);
 		ret = IRQ_HANDLED;
 	}
@@ -443,9 +445,9 @@ static int vc4_page_flip(struct drm_crtc *crtc,
 
 static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
 {
-	/* XXX: Need a way to enable/disable the interrupt, to avoid
-	 * DRM warnings at boot time.
-	 */
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+
+	vc4_crtc->vblank_enabled = true;
 
 	return 0;
 }
-- 
GitLab


From cd046951d2563075c13f23970e2f4f98f4c9d161 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 5 Feb 2018 18:02:30 +0000
Subject: [PATCH 0120/1835] drm/vc4: Skip SET_CURSOR_INFO when the cursor
 contents didn't change.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 30 +++++++++++++++++---------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 967a0bf5886b7..462d9084ce53d 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -204,10 +204,6 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 		state->crtc_y,
 		0
 	};
-	u32 packet_info[] = { state->crtc_w, state->crtc_h,
-			      0, /* unused */
-			      bo->paddr + fb->offsets[0],
-			      0, 0, /* hotx, hoty */};
 	WARN_ON_ONCE(fb->pitches[0] != state->crtc_w * 4);
 
 	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] update %dx%d cursor at %d,%d (0x%08x/%d)",
@@ -232,12 +228,26 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 	if (ret || packet_state[0] != 0)
 		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
 
-	ret = rpi_firmware_property(vc4->firmware,
-				    RPI_FIRMWARE_SET_CURSOR_INFO,
-				    &packet_info,
-				    sizeof(packet_info));
-	if (ret || packet_info[0] != 0)
-		DRM_ERROR("Failed to set cursor info: 0x%08x\n", packet_info[0]);
+	/* Note: When the cursor contents change, the modesetting
+	 * driver calls drm_mode_cursor_univeral() with
+	 * DRM_MODE_CURSOR_BO, which means a new fb will be allocated.
+	 */
+	if (!old_state ||
+	    state->crtc_w != old_state->crtc_w ||
+	    state->crtc_h != old_state->crtc_h ||
+	    fb != old_state->fb) {
+		u32 packet_info[] = { state->crtc_w, state->crtc_h,
+				      0, /* unused */
+				      bo->paddr + fb->offsets[0],
+				      0, 0, /* hotx, hoty */};
+
+		ret = rpi_firmware_property(vc4->firmware,
+					    RPI_FIRMWARE_SET_CURSOR_INFO,
+					    &packet_info,
+					    sizeof(packet_info));
+		if (ret || packet_info[0] != 0)
+			DRM_ERROR("Failed to set cursor info: 0x%08x\n", packet_info[0]);
+	}
 }
 
 static void vc4_cursor_plane_atomic_disable(struct drm_plane *plane,
-- 
GitLab


From 25088a3cd850721503be02d1fef183fcd180b9a2 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 5 Feb 2018 18:22:03 +0000
Subject: [PATCH 0121/1835] drm/vc4: Remove duplicate primary/cursor fields
 from FKMS driver.

The CRTC has those fields and we can just use them.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 462d9084ce53d..60e9d8fa55113 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -37,8 +37,6 @@ struct vc4_crtc {
 	struct drm_crtc base;
 	struct drm_encoder *encoder;
 	struct drm_connector *connector;
-	struct drm_plane *primary;
-	struct drm_plane *cursor;
 	void __iomem *regs;
 
 	struct drm_pending_vblank_event *event;
@@ -356,29 +354,24 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
-
 	/* Always turn the planes off on CRTC disable. In DRM, planes
 	 * are enabled/disabled through the update/disable hooks
 	 * above, and the CRTC enable/disable independently controls
 	 * whether anything scans out at all, but the firmware doesn't
 	 * give us a CRTC-level control for that.
 	 */
-	vc4_cursor_plane_atomic_disable(vc4_crtc->cursor,
-					vc4_crtc->cursor->state);
-	vc4_plane_set_primary_blank(vc4_crtc->primary, true);
+	vc4_cursor_plane_atomic_disable(crtc->cursor, crtc->cursor->state);
+	vc4_plane_set_primary_blank(crtc->primary, true);
 }
 
 static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
-
 	/* Unblank the planes (if they're supposed to be displayed). */
-	if (vc4_crtc->primary->state->fb)
-		vc4_plane_set_primary_blank(vc4_crtc->primary, false);
-	if (vc4_crtc->cursor->state->fb) {
-		vc4_cursor_plane_atomic_update(vc4_crtc->cursor,
-					       vc4_crtc->cursor->state);
+	if (crtc->primary->state->fb)
+		vc4_plane_set_primary_blank(crtc->primary, false);
+	if (crtc->cursor->state->fb) {
+		vc4_cursor_plane_atomic_update(crtc->cursor,
+					       crtc->cursor->state);
 	}
 }
 
@@ -689,9 +682,6 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	primary_plane->crtc = crtc;
 	cursor_plane->crtc = crtc;
 
-	vc4_crtc->primary = primary_plane;
-	vc4_crtc->cursor = cursor_plane;
-
 	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
 	if (!vc4_encoder)
 		return -ENOMEM;
-- 
GitLab


From 5141e7fc0a2a36c90be844e72323b4a15b13aad9 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Sun, 17 Jun 2018 13:22:07 +0100
Subject: [PATCH 0122/1835] vc4_firmware_kms: fix build

---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 60e9d8fa55113..4f73f0650d66a 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -33,6 +33,8 @@
 #define SMICS 0x0
 #define SMICS_INTERRUPTS (BIT(9) | BIT(10) | BIT(11))
 
+#define vc4_crtc vc4_kms_crtc
+#define to_vc4_crtc to_vc4_kms_crtc
 struct vc4_crtc {
 	struct drm_crtc base;
 	struct drm_encoder *encoder;
@@ -273,7 +275,7 @@ static int vc4_plane_atomic_check(struct drm_plane *plane,
 
 static void vc4_plane_destroy(struct drm_plane *plane)
 {
-	drm_plane_helper_disable(plane);
+	drm_plane_helper_disable(plane, NULL);
 	drm_plane_cleanup(plane);
 }
 
@@ -591,7 +593,7 @@ static struct drm_connector *vc4_fkms_connector_init(struct drm_device *dev,
 	connector->interlace_allowed = 0;
 	connector->doublescan_allowed = 0;
 
-	drm_mode_connector_attach_encoder(connector, encoder);
+	drm_connector_attach_encoder(connector, encoder);
 
 	return connector;
 
-- 
GitLab


From 389296b97f340a33b0557742e792de43893ebc1a Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 20 Feb 2018 20:53:46 +0000
Subject: [PATCH 0123/1835] hack: cache: Fix linker error

---
 arch/arm/mm/cache-v7.S | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 7a4c92ec7d913..9370d761a04bc 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -350,6 +350,7 @@ ENDPROC(v7_flush_kern_dcache_area)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
+ENTRY(b15_dma_inv_range)
 ENTRY(v7_dma_inv_range)
 	dcache_line_size r2, r3
 	sub	r3, r2, #1
@@ -380,6 +381,7 @@ ENDPROC(v7_dma_inv_range)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
+ENTRY(b15_dma_clean_range)
 ENTRY(v7_dma_clean_range)
 	dcache_line_size r2, r3
 	sub	r3, r2, #1
-- 
GitLab


From 47df3dfb10fea4c2cbd9d4d9115ce0bb3d088456 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 20 Feb 2018 10:07:27 +0000
Subject: [PATCH 0124/1835] i2c-gpio: Also set bus numbers from reg property

I2C busses can be assigned specific bus numbers using aliases in
Device Tree - string properties where the name is the alias and the
value is the path to the node. The current DT parameter mechanism
does not allow property names to be derived from a parameter value
in any way, so it isn't possible to generate unique or matching
aliases for nodes from an overlay that can generate multiple
instances, e.g. i2c-gpio.

Work around this limitation (at least temporarily) by allowing
the i2c adapter number to be initialised from the "reg" property
if present.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/i2c/busses/i2c-gpio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c
index c008d209f0b83..09dc54364eb0f 100644
--- a/drivers/i2c/busses/i2c-gpio.c
+++ b/drivers/i2c/busses/i2c-gpio.c
@@ -350,7 +350,9 @@ static int i2c_gpio_probe(struct platform_device *pdev)
 	adap->dev.parent = dev;
 	adap->dev.of_node = np;
 
-	adap->nr = pdev->id;
+	if (pdev->id != PLATFORM_DEVID_NONE || !pdev->dev.of_node ||
+	    of_property_read_u32(pdev->dev.of_node, "reg", &adap->nr))
+		adap->nr = pdev->id;
 	ret = i2c_bit_add_numbered_bus(adap);
 	if (ret)
 		return ret;
-- 
GitLab


From 31a27c524978e7b900f28805411b3e5d0817fd08 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Sun, 4 Mar 2018 17:20:25 -0700
Subject: [PATCH 0125/1835] sound: bcm: Fix memset dereference warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This warning appears with GCC 6.4.0 from toolchains.bootlin.com:

../sound/soc/bcm/allo-piano-dac-plus.c: In function ‘snd_allo_piano_dac_init’:
../sound/soc/bcm/allo-piano-dac-plus.c:711:30: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess]
  memset(glb_ptr, 0x00, sizeof(glb_ptr));
                              ^

Suggested-by: Phil Elwell <phil@raspberrypi.org>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
---
 sound/soc/bcm/allo-piano-dac-plus.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sound/soc/bcm/allo-piano-dac-plus.c b/sound/soc/bcm/allo-piano-dac-plus.c
index d35e0553a7634..35d77e905fdf3 100644
--- a/sound/soc/bcm/allo-piano-dac-plus.c
+++ b/sound/soc/bcm/allo-piano-dac-plus.c
@@ -706,11 +706,10 @@ static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
 	struct snd_soc_card *card = rtd->card;
 	struct glb_pool *glb_ptr;
 
-	glb_ptr = kmalloc(sizeof(struct glb_pool), GFP_KERNEL);
+	glb_ptr = kzalloc(sizeof(struct glb_pool), GFP_KERNEL);
 	if (!glb_ptr)
 		return -ENOMEM;
 
-	memset(glb_ptr, 0x00, sizeof(glb_ptr));
 	card->drvdata = glb_ptr;
 	glb_ptr->dual_mode = 2;
 	glb_ptr->set_mode = 0;
-- 
GitLab


From 1531bf1c15759ad31c9d0f2fe3e901f379362511 Mon Sep 17 00:00:00 2001
From: hdoverobinson <hdoverobinson@gmail.com>
Date: Tue, 13 Mar 2018 06:58:39 -0400
Subject: [PATCH 0126/1835] added capture_clear option to pps-gpio via
 dtoverlay (#2433)

---
 drivers/pps/clients/pps-gpio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 333ad7d5b45bf..ec9c4de480708 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -119,6 +119,9 @@ static int pps_gpio_probe(struct platform_device *pdev)
 
 		if (of_get_property(np, "assert-falling-edge", NULL))
 			data->assert_falling_edge = true;
+
+                if (of_get_property(np, "capture-clear", NULL))
+                        data->capture_clear = true;
 	}
 
 	/* GPIO setup */
-- 
GitLab


From 32e79e2f0e97a30004e71c032c6f8613a1e1e014 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 9 Mar 2018 12:01:00 +0000
Subject: [PATCH 0127/1835] lan78xx: Read initial EEE status from DT

Add two new DT properties:
* microchip,eee-enabled  - a boolean to enable EEE
* microchip,tx-lpi-timer - time in microseconds to wait before entering
                           low power state

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/usb/lan78xx.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 38f248b2b3b4f..a5f6e53f6e137 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2654,6 +2654,22 @@ static int lan78xx_open(struct net_device *net)
 
 	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
 
+	if (of_property_read_bool(dev->udev->dev.of_node,
+				  "microchip,eee-enabled")) {
+		struct ethtool_eee edata;
+		memset(&edata, 0, sizeof(edata));
+		edata.cmd = ETHTOOL_SEEE;
+		edata.advertised = ADVERTISED_1000baseT_Full |
+				   ADVERTISED_100baseT_Full;
+		edata.eee_enabled = true;
+		edata.tx_lpi_enabled = true;
+		if (of_property_read_u32(dev->udev->dev.of_node,
+					 "microchip,tx-lpi-timer",
+					 &edata.tx_lpi_timer))
+			edata.tx_lpi_timer = 600; /* non-aggressive */
+		(void)lan78xx_set_eee(net, &edata);
+	}
+
 	/* for Link Check */
 	if (dev->urb_intr) {
 		ret = usb_submit_urb(dev->urb_intr, GFP_KERNEL);
-- 
GitLab


From b801e0d0f3bda39128cd3d6a755b5a2a01191604 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 14 Jul 2014 22:02:09 +0100
Subject: [PATCH 0128/1835] hid: Reduce default mouse polling interval to 60Hz

Reduces overhead when using X
---
 drivers/hid/usbhid/hid-core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 11103efebbaa8..0fbdb8291eac3 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -48,7 +48,7 @@
  * Module parameters.
  */
 
-static unsigned int hid_mousepoll_interval;
+static unsigned int hid_mousepoll_interval = ~0;
 module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
 MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
 
@@ -1104,7 +1104,9 @@ static int usbhid_start(struct hid_device *hid)
 		 */
 		switch (hid->collection->usage) {
 		case HID_GD_MOUSE:
-			if (hid_mousepoll_interval > 0)
+			if (hid_mousepoll_interval == ~0 && interval < 16)
+				interval = 16;
+			else if (hid_mousepoll_interval != ~0 && hid_mousepoll_interval != 0)
 				interval = hid_mousepoll_interval;
 			break;
 		case HID_GD_JOYSTICK:
-- 
GitLab


From 6fa2790354d827f2fe4bf4eab315a802b2a1611a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 24 Apr 2018 14:42:27 +0100
Subject: [PATCH 0129/1835] gpiolib: Don't prevent IRQ usage of output GPIOs

Upstream Linux deems using output GPIOs to generate IRQs as a bogus
use case, even though the BCM2835 GPIO controller is capable of doing
so. A number of users would like to make use of this facility, so
disable the checks.

See: https://github.com/raspberrypi/linux/issues/2527

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/gpio/gpiolib.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index fd713326dcfcf..f54b2b7a82c6f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -53,6 +53,8 @@
 #define	extra_checks	0
 #endif
 
+#define dont_test_bit(b,d) (0)
+
 /* Device and char device-related information */
 static DEFINE_IDA(gpio_ida);
 static dev_t gpio_devt;
@@ -2624,7 +2626,7 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
 		value = !!value;
 
 	/* GPIOs used for IRQs shall not be set as output */
-	if (test_bit(FLAG_USED_AS_IRQ, &desc->flags)) {
+	if (dont_test_bit(FLAG_USED_AS_IRQ, &desc->flags)) {
 		gpiod_err(desc,
 			  "%s: tried to set a GPIO tied to an IRQ as output\n",
 			  __func__);
@@ -3311,7 +3313,7 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset)
 		}
 	}
 
-	if (test_bit(FLAG_IS_OUT, &desc->flags)) {
+	if (dont_test_bit(FLAG_IS_OUT, &desc->flags)) {
 		chip_err(chip,
 			 "%s: tried to flag a GPIO set as output for IRQ\n",
 			 __func__);
-- 
GitLab


From 1f3cb4875853dcff6caf80c2822e2f1056da580c Mon Sep 17 00:00:00 2001
From: Nick Bulleid <nedbulleid@fastmail.com>
Date: Thu, 10 May 2018 21:57:02 +0100
Subject: [PATCH 0130/1835] Add ability to export gpio used by gpio-poweroff

Signed-off-by: Nick Bulleid <nedbulleid@fastmail.com>

Added export feature to gpio-poweroff documentation

Signed-off-by: Nick Bulleid <nedbulleid@fastmail.com>
---
 .../devicetree/bindings/power/reset/gpio-poweroff.txt    | 1 +
 drivers/power/reset/gpio-poweroff.c                      | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt b/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
index 6d8980c18c348..561a04e4be29a 100644
--- a/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
+++ b/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
@@ -29,6 +29,7 @@ Optional properties:
   inactive state.
 - timeout-ms: Time to wait before asserting a WARN_ON(1). If nothing is
               specified, 3000 ms is used.
+- export : Export the GPIO line to the sysfs system
 
 Examples:
 
diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c
index cf8cfc83e4a1f..f53b4eb967112 100644
--- a/drivers/power/reset/gpio-poweroff.c
+++ b/drivers/power/reset/gpio-poweroff.c
@@ -52,6 +52,7 @@ static int gpio_poweroff_probe(struct platform_device *pdev)
 	bool input = false;
 	enum gpiod_flags flags;
 	bool force = false;
+	bool export = false;
 
 	/* If a pm_power_off function has already been added, leave it alone */
 	force = of_property_read_bool(pdev->dev.of_node, "force");
@@ -74,6 +75,12 @@ static int gpio_poweroff_probe(struct platform_device *pdev)
 	if (IS_ERR(reset_gpio))
 		return PTR_ERR(reset_gpio);
 
+	export = of_property_read_bool(pdev->dev.of_node, "export");
+	if (export) {
+		gpiod_export(reset_gpio, false);
+		gpiod_export_link(&pdev->dev, "poweroff-gpio", reset_gpio);
+	}
+
 	pm_power_off = &gpio_poweroff_do_poweroff;
 	return 0;
 }
@@ -83,6 +90,8 @@ static int gpio_poweroff_remove(struct platform_device *pdev)
 	if (pm_power_off == &gpio_poweroff_do_poweroff)
 		pm_power_off = NULL;
 
+	gpiod_unexport(reset_gpio);
+
 	return 0;
 }
 
-- 
GitLab


From 98d8c39dadcee8c56233310412ac79f3b55ba501 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Sat, 12 May 2018 21:35:43 +0100
Subject: [PATCH 0131/1835] firmware/raspberrypi: Notify firmware of a reboot

Register for reboot notifications, sending RPI_FIRMWARE_NOTIFY_REBOOT
over the mailbox interface on reception.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/firmware/raspberrypi.c | 40 +++++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index a05b00cd116a2..4575281f5b570 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
+#include <linux/reboot.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
@@ -174,6 +175,26 @@ int rpi_firmware_property(struct rpi_firmware *fw,
 }
 EXPORT_SYMBOL_GPL(rpi_firmware_property);
 
+static int rpi_firmware_notify_reboot(struct notifier_block *nb,
+				      unsigned long action,
+				      void *data)
+{
+	struct rpi_firmware *fw;
+	struct platform_device *pdev = g_pdev;
+
+	if (!pdev)
+		return 0;
+
+	fw = platform_get_drvdata(pdev);
+	if (!fw)
+		return 0;
+
+	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT,
+				    0, 0);
+
+	return 0;
+}
+
 static void
 rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
 {
@@ -284,15 +305,32 @@ static struct platform_driver rpi_firmware_driver = {
 	.remove		= rpi_firmware_remove,
 };
 
+static struct notifier_block rpi_firmware_reboot_notifier = {
+	.notifier_call = rpi_firmware_notify_reboot,
+};
+
 static int __init rpi_firmware_init(void)
 {
-	return platform_driver_register(&rpi_firmware_driver);
+	int ret = register_reboot_notifier(&rpi_firmware_reboot_notifier);
+	if (ret)
+		goto out1;
+	ret = platform_driver_register(&rpi_firmware_driver);
+	if (ret)
+		goto out2;
+
+	return 0;
+
+out2:
+	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
+out1:
+	return ret;
 }
 subsys_initcall(rpi_firmware_init);
 
 static void __init rpi_firmware_exit(void)
 {
 	platform_driver_unregister(&rpi_firmware_driver);
+	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
 }
 module_exit(rpi_firmware_exit);
 
-- 
GitLab


From d88d1b587aefbaee2415d5f8d25652a6c07e6a9d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 14 Jun 2018 11:21:04 +0100
Subject: [PATCH 0132/1835] irqchip: irq-bcm2835: Calc. FIQ_START at boot-time

ad83c7cb2f37 ("irqchip/irq-bcm2836: Add support for DT interrupt polarity")
changed the way that the BCM2836/7 local interrupts are mapped; instead
of being pre-mapped they are now mapped on-demand. A side effect of this
change is that the call to irq_of_parse_and_map from armctrl_of_init
creates a new mapping, forming a gap between the IRQs and the FIQs. This
 gap breaks the FIQ<->IRQ mapping which up to now has been done by assuming:

1) that the value of FIQ_START is the same as the number of normal IRQs
that will be mapped (still true), and

2) that this value is also the offset between an IRQ and its equivalent
FIQ (which is no longer the case).

Remove both assumptions by measuring the interval between the last IRQ
and the last FIQ, passing it as the parameter to init_FIQ().

Fixes: https://github.com/raspberrypi/linux/issues/2432

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/irqchip/irq-bcm2835.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index ecb0147289746..72abca2bac3a5 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -82,8 +82,6 @@
 #define NR_BANKS		3
 #define IRQS_PER_BANK		32
 #define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
-#undef FIQ_START
-#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
 
 static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
 static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
@@ -211,7 +209,7 @@ static int __init armctrl_of_init(struct device_node *node,
 				  bool is_2836)
 {
 	void __iomem *base;
-	int irq, b, i;
+	int irq = 0, last_irq, b, i;
 
 	base = of_iomap(node, 0);
 	if (!base)
@@ -237,6 +235,8 @@ static int __init armctrl_of_init(struct device_node *node,
 		}
 	}
 
+	last_irq = irq;
+
 	if (is_2836) {
 		int parent_irq = irq_of_parse_and_map(node, 0);
 
@@ -267,7 +267,7 @@ static int __init armctrl_of_init(struct device_node *node,
 		}
 	}
 #ifndef CONFIG_ARM64
-	init_FIQ(FIQ_START);
+	init_FIQ(irq - last_irq);
 #endif
 
 	return 0;
-- 
GitLab


From d52d91b920d4b6ae17adc42375649f1ae190006b Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 14 Jun 2018 15:07:26 +0100
Subject: [PATCH 0133/1835] of: configfs: Use of_overlay_fdt_apply API call

The published API to the dynamic overlay application mechanism now
takes a Flattened Device Tree blob as input so that it can manage the
lifetime of the unflattened tree. Conveniently, the new API call -
of_overlay_fdt_apply - is virtually a drop-in replacement for
create_overlay, which can now be deleted.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/of/configfs.c | 47 +++++++------------------------------------
 1 file changed, 7 insertions(+), 40 deletions(-)

diff --git a/drivers/of/configfs.c b/drivers/of/configfs.c
index 178f0629b0f01..ac04301dabe13 100644
--- a/drivers/of/configfs.c
+++ b/drivers/of/configfs.c
@@ -40,41 +40,6 @@ struct cfs_overlay_item {
 	int			dtbo_size;
 };
 
-static int create_overlay(struct cfs_overlay_item *overlay, void *blob)
-{
-	int err;
-
-	/* unflatten the tree */
-	of_fdt_unflatten_tree(blob, NULL, &overlay->overlay);
-	if (overlay->overlay == NULL) {
-		pr_err("%s: failed to unflatten tree\n", __func__);
-		err = -EINVAL;
-		goto out_err;
-	}
-	pr_debug("%s: unflattened OK\n", __func__);
-
-	/* mark it as detached */
-	of_node_set_flag(overlay->overlay, OF_DETACHED);
-
-	/* perform resolution */
-	err = of_resolve_phandles(overlay->overlay);
-	if (err != 0) {
-		pr_err("%s: Failed to resolve tree\n", __func__);
-		goto out_err;
-	}
-	pr_debug("%s: resolved OK\n", __func__);
-
-	err = of_overlay_apply(overlay->overlay, &overlay->ov_id);
-	if (err < 0) {
-		pr_err("%s: Failed to create overlay (err=%d)\n",
-				__func__, err);
-		goto out_err;
-	}
-
-out_err:
-	return err;
-}
-
 static inline struct cfs_overlay_item *to_cfs_overlay_item(
 		struct config_item *item)
 {
@@ -115,7 +80,8 @@ static ssize_t cfs_overlay_item_path_store(struct config_item *item,
 	if (err != 0)
 		goto out_err;
 
-	err = create_overlay(overlay, (void *)overlay->fw->data);
+	err = of_overlay_fdt_apply((void *)overlay->fw->data,
+				   (u32)overlay->fw->size, &overlay->ov_id);
 	if (err != 0)
 		goto out_err;
 
@@ -136,7 +102,7 @@ static ssize_t cfs_overlay_item_status_show(struct config_item *item,
 	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
 
 	return sprintf(page, "%s\n",
-			overlay->ov_id >= 0 ? "applied" : "unapplied");
+			overlay->ov_id > 0 ? "applied" : "unapplied");
 }
 
 CONFIGFS_ATTR(cfs_overlay_item_, path);
@@ -188,7 +154,8 @@ ssize_t cfs_overlay_item_dtbo_write(struct config_item *item,
 
 	overlay->dtbo_size = count;
 
-	err = create_overlay(overlay, overlay->dtbo);
+	err = of_overlay_fdt_apply(overlay->dtbo, overlay->dtbo_size,
+				   &overlay->ov_id);
 	if (err != 0)
 		goto out_err;
 
@@ -198,6 +165,7 @@ out_err:
 	kfree(overlay->dtbo);
 	overlay->dtbo = NULL;
 	overlay->dtbo_size = 0;
+	overlay->ov_id = 0;
 
 	return err;
 }
@@ -213,7 +181,7 @@ static void cfs_overlay_release(struct config_item *item)
 {
 	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
 
-	if (overlay->ov_id >= 0)
+	if (overlay->ov_id > 0)
 		of_overlay_remove(&overlay->ov_id);
 	if (overlay->fw)
 		release_firmware(overlay->fw);
@@ -241,7 +209,6 @@ static struct config_item *cfs_overlay_group_make_item(
 	overlay = kzalloc(sizeof(*overlay), GFP_KERNEL);
 	if (!overlay)
 		return ERR_PTR(-ENOMEM);
-	overlay->ov_id = -1;
 
 	config_item_init_type_name(&overlay->item, name, &cfs_overlay_type);
 	return &overlay->item;
-- 
GitLab


From 13d8526c64d5551c2f55a70a461cd2c4446ad4bd Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 13 Jun 2018 15:21:10 +0100
Subject: [PATCH 0134/1835] net: lan78xx: Disable TCP Segmentation Offload
 (TSO)

TSO seems to be having issues when packets are dropped and the
remote end uses Selective Acknowledge (SACK) to denote that
data is missing. The missing data is never resent, so the
connection eventually stalls.

There is a module parameter of enable_tso added to allow
further debugging without forcing a rebuild of the kernel.

https://github.com/raspberrypi/linux/issues/2449
https://github.com/raspberrypi/linux/issues/2482

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/net/usb/lan78xx.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index a5f6e53f6e137..bae45f643c15b 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -439,6 +439,15 @@ static int msg_level = -1;
 module_param(msg_level, int, 0);
 MODULE_PARM_DESC(msg_level, "Override default message level");
 
+/* TSO seems to be having some issue with Selective Acknowledge (SACK) that
+ * results in lost data never being retransmitted.
+ * Disable it by default now, but adds a module parameter to enable it for
+ * debug purposes (the full cause is not currently understood).
+ */
+static bool enable_tso;
+module_param(enable_tso, bool, 0644);
+MODULE_PARM_DESC(enable_tso, "Enables TCP segmentation offload");
+
 static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
 {
 	u32 *buf = kmalloc(sizeof(u32), GFP_KERNEL);
@@ -3003,8 +3012,14 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
 	if (DEFAULT_RX_CSUM_ENABLE)
 		dev->net->features |= NETIF_F_RXCSUM;
 
-	if (DEFAULT_TSO_CSUM_ENABLE)
-		dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_SG;
+	if (DEFAULT_TSO_CSUM_ENABLE) {
+		dev->net->features |= NETIF_F_SG;
+		/* Use module parameter to control TCP segmentation offload as
+		 * it appears to cause issues.
+		 */
+		if (enable_tso)
+			dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6;
+	}
 
 	if (DEFAULT_VLAN_RX_OFFLOAD)
 		dev->net->features |= NETIF_F_HW_VLAN_CTAG_RX;
-- 
GitLab


From 076415b790388fc05da6c1797f350e02d311db59 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 20 Jun 2018 12:20:01 +0100
Subject: [PATCH 0135/1835] brcmfmac: Re-enable firmware roaming support

As of 4.18, a firmware that implements the update_connect_params
method but doesn't claim to support roaming causes an error. We
disabled firmware roaming in 4.4 [1] because it appeared to
prevent disconnects, but let's try with the current firmware to see
if things have improved.

[1] https://github.com/raspberrypi/linux/commit/dd9188011786fb62a7960922f31e8e086fb2009b

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index d238d859189af..27893af63ebc3 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -70,7 +70,7 @@ static int brcmf_fcmode;
 module_param_named(fcmode, brcmf_fcmode, int, 0);
 MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
 
-static int brcmf_roamoff = 1;
+static int brcmf_roamoff;
 module_param_named(roamoff, brcmf_roamoff, int, 0400);
 MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
 
-- 
GitLab


From 7860eda37b44e298269ca60e32143fae2811ab17 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 5 Apr 2018 14:46:11 +0100
Subject: [PATCH 0136/1835] lan78xx: Move enabling of EEE into PHY init code

Enable EEE mode as soon as possible after connecting to the PHY, and
before phy_start. This avoids a second link negotiation, which speeds
up booting and stops the interface failing to become ready.

See: https://github.com/raspberrypi/linux/issues/2437

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/usb/lan78xx.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index bae45f643c15b..59bda07dc9d74 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2186,6 +2186,22 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
 	mii_adv = (u32)mii_advertise_flowctrl(dev->fc_request_control);
 	phydev->advertising |= mii_adv_to_ethtool_adv_t(mii_adv);
 
+	if (of_property_read_bool(dev->udev->dev.of_node,
+				  "microchip,eee-enabled")) {
+		struct ethtool_eee edata;
+		memset(&edata, 0, sizeof(edata));
+		edata.cmd = ETHTOOL_SEEE;
+		edata.advertised = ADVERTISED_1000baseT_Full |
+				   ADVERTISED_100baseT_Full;
+		edata.eee_enabled = true;
+		edata.tx_lpi_enabled = true;
+		if (of_property_read_u32(dev->udev->dev.of_node,
+					 "microchip,tx-lpi-timer",
+					 &edata.tx_lpi_timer))
+			edata.tx_lpi_timer = 600; /* non-aggressive */
+		(void)lan78xx_set_eee(dev->net, &edata);
+	}
+
 	if (phydev->mdio.dev.of_node) {
 		u32 reg;
 		int len;
@@ -2663,22 +2679,6 @@ static int lan78xx_open(struct net_device *net)
 
 	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
 
-	if (of_property_read_bool(dev->udev->dev.of_node,
-				  "microchip,eee-enabled")) {
-		struct ethtool_eee edata;
-		memset(&edata, 0, sizeof(edata));
-		edata.cmd = ETHTOOL_SEEE;
-		edata.advertised = ADVERTISED_1000baseT_Full |
-				   ADVERTISED_100baseT_Full;
-		edata.eee_enabled = true;
-		edata.tx_lpi_enabled = true;
-		if (of_property_read_u32(dev->udev->dev.of_node,
-					 "microchip,tx-lpi-timer",
-					 &edata.tx_lpi_timer))
-			edata.tx_lpi_timer = 600; /* non-aggressive */
-		(void)lan78xx_set_eee(net, &edata);
-	}
-
 	/* for Link Check */
 	if (dev->urb_intr) {
 		ret = usb_submit_urb(dev->urb_intr, GFP_KERNEL);
-- 
GitLab


From a1fa3652526a74f8b8a63461a55adcdc9ac8e88a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 28 Aug 2018 10:40:40 +0100
Subject: [PATCH 0137/1835] staging/vc04_services: Derive g_cache_line_size

The ARM coprocessor registers include dcache line size, but there is no
function to expose this value. Rather than create a new one, use the
read_cpuid_id function to derive the correct value, which is 32 for
BCM2835 and 64 for BCM2836/7.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../interface/vchiq_arm/vchiq_2835_arm.c      | 24 +++++++++++++++----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index e767209030642..3537f60e565cf 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -42,6 +42,7 @@
 #include <linux/uaccess.h>
 #include <linux/mm.h>
 #include <linux/of.h>
+#include <asm/cputype.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define TOTAL_SLOTS (VCHIQ_SLOT_ZERO_SLOTS + 2 * 32)
@@ -81,13 +82,15 @@ static void __iomem *g_regs;
  * VPU firmware, which determines the required alignment of the
  * offsets/sizes in pagelists.
  *
- * Modern VPU firmware looks for a DT "cache-line-size" property in
- * the VCHIQ node and will overwrite it with the actual L2 cache size,
+ * Previous VPU firmware looked for a DT "cache-line-size" property in
+ * the VCHIQ node and would overwrite it with the actual L2 cache size,
  * which the kernel must then respect.  That property was rejected
- * upstream, so we have to use the VPU firmware's compatibility value
- * of 32.
+ * upstream, so we now rely on both sides to "do the right thing" independently
+ * of the other. To improve backwards compatibility, this new behaviour is
+ * signalled to the firmware by the use of a corrected "reg" property on the
+ * relevant Device Tree node.
  */
-static unsigned int g_cache_line_size = 32;
+static unsigned int g_cache_line_size;
 static unsigned int g_fragments_size;
 static char *g_fragments_base;
 static char *g_free_fragments;
@@ -127,6 +130,17 @@ int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 	if (err < 0)
 		return err;
 
+	/*
+	 * The tempting L1_CACHE_BYTES macro doesn't work in the case of
+	 * a kernel built with bcm2835_defconfig running on a BCM2836/7
+	 * processor, hence the need for a runtime check. The dcache line size
+	 * is encoded in one of the coprocessor registers, but there is no
+	 * convenient way to access it short of embedded assembler, hence
+	 * the use of read_cpuid_id(). The following test evaluates to true
+	 * on a BCM2835 showing that it is ARMv6-ish, whereas
+	 * cpu_architecture() will indicate that it is an ARMv7.
+	 */
+	g_cache_line_size = ((read_cpuid_id() & 0x7f000) == 0x7b000) ? 32 : 64;
 	g_fragments_size = 2 * g_cache_line_size;
 
 	/* Allocate space for the channels in coherent memory */
-- 
GitLab


From 06725c9d914ca2b7e6e57e5462ef67b5b69241c6 Mon Sep 17 00:00:00 2001
From: Serge Schneider <serge@raspberrypi.org>
Date: Mon, 9 Jul 2018 12:54:25 +0100
Subject: [PATCH 0138/1835] Add rpi-poe-fan driver

Signed-off-by: Serge Schneider <serge@raspberrypi.org>

PoE HAT driver cleanup

* Fix undeclared variable in rpi_poe_fan_suspend
* Add SPDX-License-Identifier
* Expand PoE acronym in Kconfig help
* Give clearer error message on of_property_count_u32_elems fail
* Add documentation
* Add vendor to of_device_id compatible string.
* Rename m_data_s struct to fw_data_s
* Fix typos

Fixes: #2665

Signed-off-by: Serge Schneider <serge@raspberrypi.org>
---
 .../devicetree/bindings/hwmon/rpi-poe-fan.txt |  55 +++
 Documentation/hwmon/rpi-poe-fan               |  15 +
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |   6 +
 .../arm/boot/dts/overlays/rpi-poe-overlay.dts |  61 +++
 arch/arm/configs/bcm2709_defconfig            |   1 +
 arch/arm/configs/bcmrpi_defconfig             |   1 +
 drivers/hwmon/Kconfig                         |  11 +
 drivers/hwmon/Makefile                        |   1 +
 drivers/hwmon/rpi-poe-fan.c                   | 436 ++++++++++++++++++
 include/soc/bcm2835/raspberrypi-firmware.h    |   2 +
 11 files changed, 590 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/hwmon/rpi-poe-fan.txt
 create mode 100644 Documentation/hwmon/rpi-poe-fan
 create mode 100644 arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
 create mode 100644 drivers/hwmon/rpi-poe-fan.c

diff --git a/Documentation/devicetree/bindings/hwmon/rpi-poe-fan.txt b/Documentation/devicetree/bindings/hwmon/rpi-poe-fan.txt
new file mode 100644
index 0000000000000..c71f8569a4dc9
--- /dev/null
+++ b/Documentation/devicetree/bindings/hwmon/rpi-poe-fan.txt
@@ -0,0 +1,55 @@
+Bindings for the Raspberry Pi PoE HAT fan
+
+Required properties:
+- compatible	: "raspberrypi,rpi-poe-fan"
+- firmware	: Reference to the RPi firmware device node
+- pwms		: the PWM that is used to control the PWM fan
+- cooling-levels      : PWM duty cycle values in a range from 0 to 255
+			which correspond to thermal cooling states
+
+Example:
+	fan0: rpi-poe-fan@0 {
+		compatible = "raspberrypi,rpi-poe-fan";
+		firmware = <&firmware>;
+		cooling-min-state = <0>;
+		cooling-max-state = <3>;
+		#cooling-cells = <2>;
+		cooling-levels = <0 50 150 255>;
+		status = "okay";
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			trips {
+				threshold: trip-point@0 {
+					temperature = <45000>;
+					hysteresis = <5000>;
+					type = "active";
+				};
+				target: trip-point@1 {
+					temperature = <50000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+				cpu_hot: cpu_hot@0 {
+					temperature = <55000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+			cooling-maps {
+				map0 {
+					trip = <&threshold>;
+					cooling-device = <&fan0 0 1>;
+				};
+				map1 {
+					trip = <&target>;
+					cooling-device = <&fan0 1 2>;
+				};
+				map2 {
+					trip = <&cpu_hot>;
+					cooling-device = <&fan0 2 3>;
+				};
+			};
+		};
+	};
diff --git a/Documentation/hwmon/rpi-poe-fan b/Documentation/hwmon/rpi-poe-fan
new file mode 100644
index 0000000000000..9182ab6339933
--- /dev/null
+++ b/Documentation/hwmon/rpi-poe-fan
@@ -0,0 +1,15 @@
+Kernel driver rpi-poe-fan
+=====================
+
+This driver enables the use of the Raspberry Pi PoE HAT fan.
+
+Author: Serge Schneider <serge@raspberrypi.org>
+
+Description
+-----------
+
+The driver implements a simple interface for driving the Raspberry Pi PoE
+(Power over Ethernet) HAT fan. The driver passes commands to the Raspberry Pi
+firmware through the mailbox property interface. The firmware then forwards
+the commands to the board over I2C on the ID_EEPROM pins. The driver exposes
+the fan to the user space through the hwmon sysfs interface.
diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index d9439370d7eda..80bf98cc72372 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -100,6 +100,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	rpi-dac.dtbo \
 	rpi-display.dtbo \
 	rpi-ft5406.dtbo \
+	rpi-poe.dtbo \
 	rpi-proto.dtbo \
 	rpi-sense.dtbo \
 	rpi-tv.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 61bfe29cfb8f4..a987d3d1bba06 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1515,6 +1515,12 @@ Params: touchscreen-size-x      Touchscreen X resolution (default 800)
         touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
 
 
+Name:   rpi-poe
+Info:   Raspberry Pi POE HAT
+Load:   dtoverlay=rpi-poe
+Params: <None>
+
+
 Name:   rpi-proto
 Info:   Configures the RPi Proto audio card
 Load:   dtoverlay=rpi-proto
diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
new file mode 100644
index 0000000000000..0a32fff036a7c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
@@ -0,0 +1,61 @@
+/*
+ * Overlay for the Raspberry Pi POE HAT.
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			fan0: rpi-poe-fan@0 {
+				compatible = "raspberrypi,rpi-poe-fan";
+				firmware = <&firmware>;
+				cooling-min-state = <0>;
+				cooling-max-state = <3>;
+				#cooling-cells = <2>;
+				cooling-levels = <0 50 150 255>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&cpu_thermal>;
+		__overlay__ {
+			trips {
+				threshold: trip-point@0 {
+					temperature = <45000>;
+					hysteresis = <5000>;
+					type = "active";
+				};
+				target: trip-point@1 {
+					temperature = <50000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+				cpu_hot: cpu_hot@0 {
+					temperature = <55000>;
+					hysteresis = <2000>;
+					type = "active";
+				};
+			};
+			cooling-maps {
+				map0 {
+					trip = <&threshold>;
+					cooling-device = <&fan0 0 1>;
+				};
+				map1 {
+					trip = <&target>;
+					cooling-device = <&fan0 1 2>;
+				};
+				map2 {
+					trip = <&cpu_hot>;
+					cooling-device = <&fan0 2 3>;
+				};
+			};
+		};
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 89aa10defa925..1acb61e65c1ec 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -659,6 +659,7 @@ CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_RPI_POE_FAN=m
 CONFIG_SENSORS_SHT21=m
 CONFIG_SENSORS_SHT3x=m
 CONFIG_SENSORS_SHTC1=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 1a883c0efad62..c2a284cc653b2 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -652,6 +652,7 @@ CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_RPI_POE_FAN=m
 CONFIG_SENSORS_SHT21=m
 CONFIG_SENSORS_SHT3x=m
 CONFIG_SENSORS_SHTC1=m
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index c7adaca2ab013..00655425616db 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1330,6 +1330,17 @@ config SENSORS_RASPBERRYPI_HWMON
 	  This driver can also be built as a module. If so, the module
 	  will be called raspberrypi-hwmon.
 
+config SENSORS_RPI_POE_FAN
+	tristate "Raspberry Pi PoE HAT fan"
+	depends on RASPBERRYPI_FIRMWARE
+	depends on THERMAL || THERMAL=n
+	help
+	  If you say yes here you get support for Raspberry Pi PoE (Power over
+	  Ethernet) HAT fan.
+
+	  This driver can also be built as a module.  If so, the module
+	  will be called rpi-poe-fan.
+
 config SENSORS_SHT15
 	tristate "Sensiron humidity and temperature sensors. SHT15 and compat."
 	depends on GPIOLIB || COMPILE_TEST
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 93f7f41ea4ad5..3e2a504d4dc0e 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -144,6 +144,7 @@ obj-$(CONFIG_SENSORS_PCF8591)	+= pcf8591.o
 obj-$(CONFIG_SENSORS_POWR1220)  += powr1220.o
 obj-$(CONFIG_SENSORS_PWM_FAN)	+= pwm-fan.o
 obj-$(CONFIG_SENSORS_RASPBERRYPI_HWMON)	+= raspberrypi-hwmon.o
+obj-$(CONFIG_SENSORS_RPI_POE_FAN)	+= rpi-poe-fan.o
 obj-$(CONFIG_SENSORS_S3C)	+= s3c-hwmon.o
 obj-$(CONFIG_SENSORS_SCH56XX_COMMON)+= sch56xx-common.o
 obj-$(CONFIG_SENSORS_SCH5627)	+= sch5627.o
diff --git a/drivers/hwmon/rpi-poe-fan.c b/drivers/hwmon/rpi-poe-fan.c
new file mode 100644
index 0000000000000..3effaf2eb86db
--- /dev/null
+++ b/drivers/hwmon/rpi-poe-fan.c
@@ -0,0 +1,436 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * rpi-poe-fan.c - Hwmon driver for Raspberry Pi PoE HAT fan.
+ *
+ * Copyright (C) 2018 Raspberry Pi (Trading) Ltd.
+ * Based on pwm-fan.c by Kamil Debski <k.debski@samsung.com>
+ *
+ * Author: Serge Schneider <serge@raspberrypi.org>
+ */
+
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/notifier.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/sysfs.h>
+#include <linux/thermal.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MAX_PWM 255
+
+#define POE_CUR_PWM 0x0
+#define POE_DEF_PWM 0x1
+
+struct rpi_poe_fan_ctx {
+	struct mutex lock;
+	struct rpi_firmware *fw;
+	unsigned int pwm_value;
+	unsigned int def_pwm_value;
+	unsigned int rpi_poe_fan_state;
+	unsigned int rpi_poe_fan_max_state;
+	unsigned int *rpi_poe_fan_cooling_levels;
+	struct thermal_cooling_device *cdev;
+	struct notifier_block nb;
+};
+
+struct fw_tag_data_s{
+	u32 reg;
+	u32 val;
+	u32 ret;
+};
+
+static int write_reg(struct rpi_firmware *fw, u32 reg, u32 *val){
+	struct fw_tag_data_s fw_tag_data = {
+		.reg = reg,
+		.val = *val
+	};
+	int ret;
+	ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_POE_HAT_VAL,
+				    &fw_tag_data, sizeof(fw_tag_data));
+	if (ret) {
+		return ret;
+	} else if (fw_tag_data.ret) {
+		return -EIO;
+	}
+	return 0;
+}
+
+static int read_reg(struct rpi_firmware *fw, u32 reg, u32 *val){
+	struct fw_tag_data_s fw_tag_data = {
+		.reg = reg,
+	};
+	int ret;
+	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_POE_HAT_VAL,
+				    &fw_tag_data, sizeof(fw_tag_data));
+	if (ret) {
+		return ret;
+	} else if (fw_tag_data.ret) {
+		return -EIO;
+	}
+	*val = fw_tag_data.val;
+	return 0;
+}
+
+static int rpi_poe_reboot(struct notifier_block *nb, unsigned long code,
+			  void *unused)
+{
+	struct rpi_poe_fan_ctx *ctx = container_of(nb, struct rpi_poe_fan_ctx,
+						   nb);
+
+	if (ctx->pwm_value != ctx->def_pwm_value)
+		write_reg(ctx->fw, POE_CUR_PWM, &ctx->def_pwm_value);
+
+	return NOTIFY_DONE;
+}
+
+static int  __set_pwm(struct rpi_poe_fan_ctx *ctx, u32 pwm)
+{
+	int ret = 0;
+
+	mutex_lock(&ctx->lock);
+	if (ctx->pwm_value == pwm)
+		goto exit_set_pwm_err;
+
+	ret = write_reg(ctx->fw, POE_CUR_PWM, &pwm);
+	if (!ret)
+		ctx->pwm_value = pwm;
+exit_set_pwm_err:
+	mutex_unlock(&ctx->lock);
+	return ret;
+}
+
+static int  __set_def_pwm(struct rpi_poe_fan_ctx *ctx, u32 def_pwm)
+{
+	int ret = 0;
+	mutex_lock(&ctx->lock);
+	if (ctx->def_pwm_value == def_pwm)
+		goto exit_set_def_pwm_err;
+
+	ret = write_reg(ctx->fw, POE_CUR_PWM, &def_pwm);
+	if (!ret)
+		ctx->def_pwm_value = def_pwm;
+exit_set_def_pwm_err:
+	mutex_unlock(&ctx->lock);
+	return ret;
+}
+
+static void rpi_poe_fan_update_state(struct rpi_poe_fan_ctx *ctx,
+				     unsigned long pwm)
+{
+	int i;
+
+	for (i = 0; i < ctx->rpi_poe_fan_max_state; ++i)
+		if (pwm < ctx->rpi_poe_fan_cooling_levels[i + 1])
+			break;
+
+	ctx->rpi_poe_fan_state = i;
+}
+
+static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
+		       const char *buf, size_t count)
+{
+	struct rpi_poe_fan_ctx *ctx = dev_get_drvdata(dev);
+	unsigned long pwm;
+	int ret;
+
+	if (kstrtoul(buf, 10, &pwm) || pwm > MAX_PWM)
+		return -EINVAL;
+
+	ret = __set_pwm(ctx, pwm);
+	if (ret)
+		return ret;
+
+	rpi_poe_fan_update_state(ctx, pwm);
+	return count;
+}
+
+static ssize_t set_def_pwm(struct device *dev, struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	struct rpi_poe_fan_ctx *ctx = dev_get_drvdata(dev);
+	unsigned long def_pwm;
+	int ret;
+
+	if (kstrtoul(buf, 10, &def_pwm) || def_pwm > MAX_PWM)
+		return -EINVAL;
+
+	ret = __set_def_pwm(ctx, def_pwm);
+	if (ret)
+		return ret;
+	return count;
+}
+
+static ssize_t show_pwm(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	struct rpi_poe_fan_ctx *ctx = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%u\n", ctx->pwm_value);
+}
+
+static ssize_t show_def_pwm(struct device *dev,
+			struct device_attribute *attr, char *buf)
+{
+	struct rpi_poe_fan_ctx *ctx = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%u\n", ctx->def_pwm_value);
+}
+
+
+static SENSOR_DEVICE_ATTR(pwm1, 0644, show_pwm, set_pwm, 0);
+static SENSOR_DEVICE_ATTR(def_pwm1, 0644, show_def_pwm, set_def_pwm, 1);
+
+static struct attribute *rpi_poe_fan_attrs[] = {
+	&sensor_dev_attr_pwm1.dev_attr.attr,
+	&sensor_dev_attr_def_pwm1.dev_attr.attr,
+	NULL,
+};
+
+ATTRIBUTE_GROUPS(rpi_poe_fan);
+
+/* thermal cooling device callbacks */
+static int rpi_poe_fan_get_max_state(struct thermal_cooling_device *cdev,
+				     unsigned long *state)
+{
+	struct rpi_poe_fan_ctx *ctx = cdev->devdata;
+
+	if (!ctx)
+		return -EINVAL;
+
+	*state = ctx->rpi_poe_fan_max_state;
+
+	return 0;
+}
+
+static int rpi_poe_fan_get_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long *state)
+{
+	struct rpi_poe_fan_ctx *ctx = cdev->devdata;
+
+	if (!ctx)
+		return -EINVAL;
+
+	*state = ctx->rpi_poe_fan_state;
+
+	return 0;
+}
+
+static int rpi_poe_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state)
+{
+	struct rpi_poe_fan_ctx *ctx = cdev->devdata;
+	int ret;
+
+	if (!ctx || (state > ctx->rpi_poe_fan_max_state))
+		return -EINVAL;
+
+	if (state == ctx->rpi_poe_fan_state)
+		return 0;
+
+	ret = __set_pwm(ctx, ctx->rpi_poe_fan_cooling_levels[state]);
+	if (ret) {
+		dev_err(&cdev->device, "Cannot set pwm!\n");
+		return ret;
+	}
+
+	ctx->rpi_poe_fan_state = state;
+
+	return ret;
+}
+
+static const struct thermal_cooling_device_ops rpi_poe_fan_cooling_ops = {
+	.get_max_state = rpi_poe_fan_get_max_state,
+	.get_cur_state = rpi_poe_fan_get_cur_state,
+	.set_cur_state = rpi_poe_fan_set_cur_state,
+};
+
+static int rpi_poe_fan_of_get_cooling_data(struct device *dev,
+				       struct rpi_poe_fan_ctx *ctx)
+{
+	struct device_node *np = dev->of_node;
+	int num, i, ret;
+
+	if (!of_find_property(np, "cooling-levels", NULL))
+		return 0;
+
+	ret = of_property_count_u32_elems(np, "cooling-levels");
+	if (ret <= 0) {
+		dev_err(dev, "cooling-levels property missing or invalid: %d\n",
+			ret);
+		return ret ? : -EINVAL;
+	}
+
+	num = ret;
+	ctx->rpi_poe_fan_cooling_levels = devm_kzalloc(dev, num * sizeof(u32),
+						   GFP_KERNEL);
+	if (!ctx->rpi_poe_fan_cooling_levels)
+		return -ENOMEM;
+
+	ret = of_property_read_u32_array(np, "cooling-levels",
+					 ctx->rpi_poe_fan_cooling_levels, num);
+	if (ret) {
+		dev_err(dev, "Property 'cooling-levels' cannot be read!\n");
+		return ret;
+	}
+
+	for (i = 0; i < num; i++) {
+		if (ctx->rpi_poe_fan_cooling_levels[i] > MAX_PWM) {
+			dev_err(dev, "PWM fan state[%d]:%d > %d\n", i,
+				ctx->rpi_poe_fan_cooling_levels[i], MAX_PWM);
+			return -EINVAL;
+		}
+	}
+
+	ctx->rpi_poe_fan_max_state = num - 1;
+
+	return 0;
+}
+
+static int rpi_poe_fan_probe(struct platform_device *pdev)
+{
+	struct thermal_cooling_device *cdev;
+	struct rpi_poe_fan_ctx *ctx;
+	struct device *hwmon;
+	struct device_node *np = pdev->dev.of_node;
+	struct device_node *fw_node;
+	int ret;
+
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(&pdev->dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	mutex_init(&ctx->lock);
+
+	ctx->fw = rpi_firmware_get(fw_node);
+	if (!ctx->fw)
+		return -EPROBE_DEFER;
+
+	platform_set_drvdata(pdev, ctx);
+
+	ctx->nb.notifier_call = rpi_poe_reboot;
+	ret = register_reboot_notifier(&ctx->nb);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to register reboot notifier: %i\n",
+			ret);
+		return ret;
+	}
+	ret = read_reg(ctx->fw, POE_DEF_PWM, &ctx->def_pwm_value);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to get default PWM value: %i\n",
+			ret);
+		goto err;
+	}
+	ret = read_reg(ctx->fw, POE_CUR_PWM, &ctx->pwm_value);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to get current PWM value: %i\n",
+			ret);
+		goto err;
+	}
+
+	hwmon = devm_hwmon_device_register_with_groups(&pdev->dev, "rpipoefan",
+						       ctx, rpi_poe_fan_groups);
+	if (IS_ERR(hwmon)) {
+		dev_err(&pdev->dev, "Failed to register hwmon device\n");
+		ret = PTR_ERR(hwmon);
+		goto err;
+	}
+
+	ret = rpi_poe_fan_of_get_cooling_data(&pdev->dev, ctx);
+	if (ret)
+		return ret;
+
+	rpi_poe_fan_update_state(ctx, ctx->pwm_value);
+	if (!IS_ENABLED(CONFIG_THERMAL))
+		return 0;
+
+	cdev = thermal_of_cooling_device_register(np,
+						  "rpi-poe-fan", ctx,
+						  &rpi_poe_fan_cooling_ops);
+	if (IS_ERR(cdev)) {
+		dev_err(&pdev->dev,
+			"Failed to register rpi-poe-fan as cooling device");
+		ret = PTR_ERR(cdev);
+		goto err;
+	}
+	ctx->cdev = cdev;
+	thermal_cdev_update(cdev);
+
+	return 0;
+err:
+	unregister_reboot_notifier(&ctx->nb);
+	return ret;
+}
+
+static int rpi_poe_fan_remove(struct platform_device *pdev)
+{
+	struct rpi_poe_fan_ctx *ctx = platform_get_drvdata(pdev);
+	u32 value = ctx->def_pwm_value;
+
+	unregister_reboot_notifier(&ctx->nb);
+	thermal_cooling_device_unregister(ctx->cdev);
+	if (ctx->pwm_value != value) {
+		write_reg(ctx->fw, POE_CUR_PWM, &value);
+	}
+	return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int rpi_poe_fan_suspend(struct device *dev)
+{
+	struct rpi_poe_fan_ctx *ctx = dev_get_drvdata(dev);
+	u32 value = 0;
+	int ret = 0;
+
+	if (ctx->pwm_value != value)
+		ret = write_reg(ctx->fw, POE_CUR_PWM, &value);
+	return ret;
+}
+
+static int rpi_poe_fan_resume(struct device *dev)
+{
+	struct rpi_poe_fan_ctx *ctx = dev_get_drvdata(dev);
+	u32 value = ctx->pwm_value;
+	int ret = 0;
+
+	if (value != 0)
+		ret = write_reg(ctx->fw, POE_CUR_PWM, &value);
+
+	return ret;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(rpi_poe_fan_pm, rpi_poe_fan_suspend,
+			 rpi_poe_fan_resume);
+
+static const struct of_device_id of_rpi_poe_fan_match[] = {
+	{ .compatible = "raspberrypi,rpi-poe-fan", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, of_rpi_poe_fan_match);
+
+static struct platform_driver rpi_poe_fan_driver = {
+	.probe		= rpi_poe_fan_probe,
+	.remove		= rpi_poe_fan_remove,
+	.driver	= {
+		.name		= "rpi-poe-fan",
+		.pm		= &rpi_poe_fan_pm,
+		.of_match_table	= of_rpi_poe_fan_match,
+	},
+};
+
+module_platform_driver(rpi_poe_fan_driver);
+
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_ALIAS("platform:rpi-poe-fan");
+MODULE_DESCRIPTION("Raspberry Pi PoE HAT fan driver");
+MODULE_LICENSE("GPL");
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 5a77cb921cf42..8ab5501c8d292 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -93,6 +93,8 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_SET_GPIO_CONFIG =                        0x00038043,
 	RPI_FIRMWARE_GET_PERIPH_REG =                         0x00030045,
 	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
+	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
+	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
 
 
 	/* Dispmanx TAGS */
-- 
GitLab


From a88c3a3a52578c53cf23c0f80e7e4c0418d2765a Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 17 Sep 2018 17:31:18 +0100
Subject: [PATCH 0139/1835] cxd2880: CXD2880_SPI_DRV should select DVB_CXD2880
 with MEDIA_SUBDRV_AUTOSELECT

---
 drivers/media/spi/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/spi/Kconfig b/drivers/media/spi/Kconfig
index b07ac86fc53c7..f76dea36ab8a3 100644
--- a/drivers/media/spi/Kconfig
+++ b/drivers/media/spi/Kconfig
@@ -19,6 +19,7 @@ menu "Media SPI Adapters"
 config CXD2880_SPI_DRV
 	tristate "Sony CXD2880 SPI support"
 	depends on DVB_CORE && SPI
+	select DVB_CXD2880 if MEDIA_SUBDRV_AUTOSELECT
 	default m if !MEDIA_SUBDRV_AUTOSELECT
 	help
 	  Choose if you would like to have SPI interface support for Sony CXD2880.
-- 
GitLab


From e800c16c1aeff9ae18b65fdf2c4a24600b558497 Mon Sep 17 00:00:00 2001
From: wm4 <wm4@nowhere>
Date: Wed, 13 Jan 2016 19:44:47 +0100
Subject: [PATCH 0140/1835] bcm2835: interpolate audio delay

It appears the GPU only sends us a message all 10ms to update
the playback progress. Other than this, the playback position
(what SNDRV_PCM_IOCTL_DELAY will return) is not updated at all.
Userspace will see jitter up to 10ms in the audio position.

Make this a bit nicer for userspace by interpolating the
position using the CPU clock.

I'm not sure if setting snd_pcm_runtime.delay is the right
approach for this. Or if there is maybe an already existing
mechanism for position interpolation in the ALSA core.

I only set SNDRV_PCM_INFO_BATCH because this appears to remove
at least one situation snd_pcm_runtime.delay is used, so I have
to worry less in which place I have to update this field, or
how it interacts with the rest of ALSA.

In the future, it might be nice to use VC_AUDIO_MSG_TYPE_LATENCY.
One problem is that it requires sending a videocore message, and
waiting for a reply, which could make the implementation much
harder due to locking and synchronization requirements.
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c        | 12 +++++++++++-
 .../staging/vc04_services/bcm2835-audio/bcm2835.h    |  1 +
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 8359cf881bef5..4532a5128560b 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -11,7 +11,7 @@
 /* hardware definition */
 static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 	.info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
-	SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID),
+	SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_BATCH),
 	.formats = SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
 	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min = 8000,
@@ -81,6 +81,8 @@ void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream)
 		alsa_stream->pos %= alsa_stream->buffer_size;
 	}
 
+	alsa_stream->interpolate_start = ktime_get_ns();
+
 	if (alsa_stream->substream) {
 		if (new_period)
 			snd_pcm_period_elapsed(alsa_stream->substream);
@@ -306,6 +308,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	alsa_stream->buffer_size = snd_pcm_lib_buffer_bytes(substream);
 	alsa_stream->period_size = snd_pcm_lib_period_bytes(substream);
 	alsa_stream->pos = 0;
+	alsa_stream->interpolate_start = ktime_get_ns();
 
 	audio_debug("buffer_size=%d, period_size=%d pos=%d frame_bits=%d\n",
 		alsa_stream->buffer_size, alsa_stream->period_size,
@@ -397,12 +400,19 @@ snd_bcm2835_pcm_pointer(struct snd_pcm_substream *substream)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
+	u64 now = ktime_get_ns();
 
 	audio_debug("pcm_pointer... (%d) hwptr=%d appl=%d pos=%d\n", 0,
 		frames_to_bytes(runtime, runtime->status->hw_ptr),
 		frames_to_bytes(runtime, runtime->control->appl_ptr),
 		alsa_stream->pos);
 
+	/* Give userspace better delay reporting by interpolating between GPU
+	 * notifications, assuming audio speed is close enough to the clock
+	 * used for ktime */
+	if (alsa_stream->interpolate_start && alsa_stream->interpolate_start < now)
+		runtime->delay = -(int)div_u64((now - alsa_stream->interpolate_start) * runtime->rate,  1000000000);
+
 	return snd_pcm_indirect_playback_pointer(substream,
 		&alsa_stream->pcm_indirect,
 		alsa_stream->pos);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 5dc427240a1d7..f44b04930a8fe 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -133,6 +133,7 @@ struct bcm2835_alsa_stream {
 	unsigned int pos;
 	unsigned int buffer_size;
 	unsigned int period_size;
+	u64 interpolate_start;
 
 	atomic_t retrieved;
 	struct bcm2835_audio_instance *instance;
-- 
GitLab


From 5a8fbb73b805d50348471fa423ff53b9e1d74140 Mon Sep 17 00:00:00 2001
From: detule <ogjoneski@gmail.com>
Date: Tue, 2 Oct 2018 04:10:08 -0400
Subject: [PATCH 0141/1835] vchiq_2835_arm: Implement a DMA pool for small bulk
 transfers (#2699)

During a bulk transfer we request a DMA allocation to hold the
scatter-gather list.  Most of the time, this allocation is small
(<< PAGE_SIZE), however it can be requested at a high enough frequency
to cause fragmentation and/or stress the CMA allocator (think time
spent in compaction here, or during allocations elsewhere).

Implement a pool to serve up small DMA allocations, falling back
to a coherent allocation if the request is greater than
VCHIQ_DMA_POOL_SIZE.

Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
---
 .../interface/vchiq_arm/vchiq_2835_arm.c      | 40 +++++++++++++++----
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 3537f60e565cf..b26c805c46c07 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -37,6 +37,7 @@
 #include <linux/interrupt.h>
 #include <linux/pagemap.h>
 #include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/uaccess.h>
@@ -60,6 +61,8 @@
 #define BELL0	0x00
 #define BELL2	0x08
 
+#define VCHIQ_DMA_POOL_SIZE PAGE_SIZE
+
 struct vchiq_2835_state {
 	int inited;
 	VCHIQ_ARM_STATE_T arm_state;
@@ -69,6 +72,7 @@ struct vchiq_pagelist_info {
 	PAGELIST_T *pagelist;
 	size_t pagelist_buffer_size;
 	dma_addr_t dma_addr;
+	bool is_from_pool;
 	enum dma_data_direction dma_dir;
 	unsigned int num_pages;
 	unsigned int pages_need_release;
@@ -91,6 +95,7 @@ static void __iomem *g_regs;
  * relevant Device Tree node.
  */
 static unsigned int g_cache_line_size;
+static struct dma_pool *g_dma_pool;
 static unsigned int g_fragments_size;
 static char *g_fragments_base;
 static char *g_free_fragments;
@@ -206,6 +211,14 @@ int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 	}
 
 	g_dev = dev;
+	g_dma_pool = dmam_pool_create("vchiq_scatter_pool", dev,
+				      VCHIQ_DMA_POOL_SIZE, g_cache_line_size,
+				      0);
+	if (!g_dma_pool) {
+		dev_err(dev, "failed to create dma pool");
+		return -ENOMEM;
+	}
+
 	vchiq_log_info(vchiq_arm_log_level,
 		"vchiq_init - done (slots %pK, phys %pad)",
 		vchiq_slot_zero, &slot_phys);
@@ -394,9 +407,14 @@ cleanup_pagelistinfo(struct vchiq_pagelist_info *pagelistinfo)
 		for (i = 0; i < pagelistinfo->num_pages; i++)
 			put_page(pagelistinfo->pages[i]);
 	}
-
-	dma_free_coherent(g_dev, pagelistinfo->pagelist_buffer_size,
-			  pagelistinfo->pagelist, pagelistinfo->dma_addr);
+	if (pagelistinfo->is_from_pool) {
+		dma_pool_free(g_dma_pool, pagelistinfo->pagelist,
+			      pagelistinfo->dma_addr);
+	} else {
+		dma_free_coherent(g_dev, pagelistinfo->pagelist_buffer_size,
+				  pagelistinfo->pagelist,
+				  pagelistinfo->dma_addr);
+	}
 }
 
 /* There is a potential problem with partial cache lines (pages?)
@@ -416,6 +434,7 @@ create_pagelist(char __user *buf, size_t count, unsigned short type)
 	u32 *addrs;
 	unsigned int num_pages, offset, i, k;
 	int actual_pages;
+	bool is_from_pool;
 	size_t pagelist_size;
 	struct scatterlist *scatterlist, *sg;
 	int dma_buffers;
@@ -433,10 +452,16 @@ create_pagelist(char __user *buf, size_t count, unsigned short type)
 	/* Allocate enough storage to hold the page pointers and the page
 	 * list
 	 */
-	pagelist = dma_zalloc_coherent(g_dev,
-				       pagelist_size,
-				       &dma_addr,
-				       GFP_KERNEL);
+	if (pagelist_size > VCHIQ_DMA_POOL_SIZE) {
+		pagelist = dma_zalloc_coherent(g_dev,
+					       pagelist_size,
+					       &dma_addr,
+					       GFP_KERNEL);
+		is_from_pool = false;
+	} else {
+		pagelist = dma_pool_zalloc(g_dma_pool, GFP_KERNEL, &dma_addr);
+		is_from_pool = true;
+	}
 
 	vchiq_log_trace(vchiq_arm_log_level, "%s - %pK", __func__, pagelist);
 
@@ -457,6 +482,7 @@ create_pagelist(char __user *buf, size_t count, unsigned short type)
 	pagelistinfo->pagelist = pagelist;
 	pagelistinfo->pagelist_buffer_size = pagelist_size;
 	pagelistinfo->dma_addr = dma_addr;
+	pagelistinfo->is_from_pool = is_from_pool;
 	pagelistinfo->dma_dir =  (type == PAGELIST_WRITE) ?
 				  DMA_TO_DEVICE : DMA_FROM_DEVICE;
 	pagelistinfo->num_pages = num_pages;
-- 
GitLab


From 4de423e3cb05688f1f5786b3d6bb0f4469ec1f37 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 8 Oct 2018 12:20:36 +0100
Subject: [PATCH 0142/1835] BCM2708_DT: Use upstreamed GPIO expander driver

The upstreamed driver for the GPIO expander has a different compatible
string. Change the relevant Device Tree files to match.

See: https://github.com/raspberrypi/linux/issues/2704

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts | 2 +-
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts      | 2 +-
 arch/arm/boot/dts/bcm2710-rpi-cm3.dts      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
index 7821483f7d505..fa95f4e3653fb 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -84,7 +84,7 @@
 
 &soc {
 	expgpio: expgpio {
-		compatible = "brcm,bcm2835-expgpio";
+		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
 		firmware = <&firmware>;
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index 3f84e2af8c25a..951292d2ad161 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -92,7 +92,7 @@
 	};
 
 	expgpio: expgpio {
-		compatible = "brcm,bcm2835-expgpio";
+		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
 		firmware = <&firmware>;
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
index 2500641c14dc3..1103b5465521d 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -52,7 +52,7 @@
 	};
 
 	expgpio: expgpio {
-		compatible = "brcm,bcm2835-expgpio";
+		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
 		firmware = <&firmware>;
-- 
GitLab


From 2676d98c54802b85410a1efb2daaeff366a51f30 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 8 Oct 2018 17:16:28 +0100
Subject: [PATCH 0143/1835] overlays: Fix a few dtc warnings

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../overlays/pitft28-resistive-overlay.dts    |  2 --
 .../overlays/pitft35-resistive-overlay.dts    |  2 --
 .../arm/boot/dts/overlays/qca7000-overlay.dts | 13 ++++++----
 .../overlays/rpi-cirrus-wm5102-overlay.dts    | 26 ++++++++++++-------
 arch/arm/boot/dts/overlays/rpi-tv-overlay.dts | 11 +++++---
 .../boot/dts/overlays/smi-nand-overlay.dts    |  3 ---
 .../boot/dts/overlays/tinylcd35-overlay.dts   |  2 --
 7 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
index ed2afc2f7fd65..7cfb7effc61f8 100644
--- a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
@@ -64,8 +64,6 @@
 			};
 
 			pitft_ts@1 {
-				#address-cells = <1>;
-				#size-cells = <0>;
 				compatible = "st,stmpe610";
 				reg = <1>;
 
diff --git a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
index 25cb5cc9576da..3271993c9755f 100644
--- a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
@@ -64,8 +64,6 @@
 			};
 
 			pitft_ts@1 {
-				#address-cells = <1>;
-				#size-cells = <0>;
 				compatible = "st,stmpe610";
 				reg = <1>;
 
diff --git a/arch/arm/boot/dts/overlays/qca7000-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
index b4e601396c495..f2cdd991aa961 100644
--- a/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
@@ -8,6 +8,13 @@
 	compatible = "brcm,bcm2708";
 
 	fragment@0 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
 		target = <&spi0>;
 		__overlay__ {
 			/* needed to avoid dtc warning */
@@ -16,10 +23,6 @@
 
 			status = "okay";
 
-			spidev@0 {
-				status = "disabled";
-			};
-
 			eth1: qca7000@0 {
 				compatible = "qca,qca7000";
 				reg = <0>; /* CE0 */
@@ -33,7 +36,7 @@
 		};
 	};
 
-	fragment@1 {
+	fragment@2 {
 		target = <&gpio>;
 		__overlay__ {
 			eth1_pins: eth1_pins {
diff --git a/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
index cf85f0af22406..b4602bd34e1e2 100644
--- a/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
@@ -44,20 +44,26 @@
 	};
 
 	fragment@3 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@4 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@5 {
 		target = <&spi0>;
 		__overlay__ {
 			#address-cells = <1>;
 			#size-cells = <0>;
 			status = "okay";
 
-			spidev@0{
-				status = "disabled";
-			};
-
-			spidev@1{
-				status = "disabled";
-			};
-
 			wm5102@1{
 				compatible = "wlf,wm5102";
 				reg = <1>;
@@ -117,7 +123,7 @@
 		};
 	};
 
-	fragment@4 {
+	fragment@6 {
 		target = <&i2c1>;
 		__overlay__ {
 			status = "okay";
@@ -135,7 +141,7 @@
 		};
 	};
 
-	fragment@5 {
+	fragment@7 {
 		target = <&sound>;
 		__overlay__ {
 			compatible = "wlf,rpi-cirrus";
diff --git a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
index a68f6f793d8ef..eeb1e317cf680 100644
--- a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
@@ -7,6 +7,13 @@
 	compatible = "brcm,bcm2708", "brcm,bcm2709";
 
 	fragment@0 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
 		target = <&spi0>;
 		__overlay__ {
 			/* needed to avoid dtc warning */
@@ -15,10 +22,6 @@
 
 			status = "okay";
 
-			spidev@0 {
-				status = "disabled";
-			};
-
 			cxd2880@0 {
 				compatible = "sony,cxd2880";
 				reg = <0>; /* CE0 */
diff --git a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
index 13ce0b7cfb242..e74226233ba18 100644
--- a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+++ b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
@@ -20,9 +20,6 @@
 	fragment@1 {
 		target = <&soc>;
 		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <1>;
-
 			nand: flash@0 {
 				compatible = "brcm,bcm2835-smi-nand";
 				smi_handle = <&smi>;
diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
index ed2b053aef23e..906b79de86bb7 100644
--- a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
@@ -171,8 +171,6 @@
 		__overlay__ {
 			keypad: keypad {
 				compatible = "gpio-keys";
-				#address-cells = <1>;
-				#size-cells = <0>;
 				pinctrl-names = "default";
 				pinctrl-0 = <&keypad_pins>;
 				status = "disabled";
-- 
GitLab


From fa2f0028b48131634fb20fb60e847591c2a4f7c8 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 17 Oct 2018 16:32:52 +0100
Subject: [PATCH 0144/1835] bcm2708-rpi: Disable txp interrupt unless using
 vc4-kms-v3d overlay

Signed-off-by: popcornmix <popcornmix@gmail.com>
---
 arch/arm/boot/dts/bcm2708-rpi.dtsi                 | 4 ++++
 arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index 00160e0b8ab71..131be649e1469 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -89,6 +89,10 @@
 		sound: sound {
 			status = "disabled";
 		};
+
+		txp: txp@7e004000 {
+			status = "disabled";
+		};
 	};
 
 	__overrides__ {
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
index 4896796373062..f6610c1d70a98 100644
--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
@@ -141,6 +141,13 @@
 		};
 	};
 
+	fragment@17 {
+		target = <&txp>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
 	__overrides__ {
 		cma-256 = <0>,"+0-1-2-3-4";
 		cma-192 = <0>,"-0+1-2-3-4";
-- 
GitLab


From ce712d9f4aa88ac07e28632f54926e09e9397bb9 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 6 Oct 2018 16:45:41 +0200
Subject: [PATCH 0145/1835] config: Enable Raspberry Pi voltage monitor

This enables the Raspberry Pi voltage monitor as a replacement
for the get_trottled sysfs approach in the firmware driver.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 1acb61e65c1ec..b2651f8c611dd 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -659,6 +659,7 @@ CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_SENSORS_RPI_POE_FAN=m
 CONFIG_SENSORS_SHT21=m
 CONFIG_SENSORS_SHT3x=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index c2a284cc653b2..0c44c45f13684 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -652,6 +652,7 @@ CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_SENSORS_RPI_POE_FAN=m
 CONFIG_SENSORS_SHT21=m
 CONFIG_SENSORS_SHT3x=m
-- 
GitLab


From 579941e61fbd83087ee72f123b0ce77dd70b4856 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 6 Oct 2018 16:46:18 +0200
Subject: [PATCH 0146/1835] hwmon: raspberrypi: Prevent voltage low warnings
 from filling log

Although the correct fix for low voltage warnings is to
improve the power supply, the current implementation
of the detection can fill the log if the warning
happens freqently. This replaces the logging with
slightly custom ratelimited logging.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/hwmon/raspberrypi-hwmon.c | 41 ++++++++++++++++++++++++++++---
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
index 0d0457245e7d0..d643928822087 100644
--- a/drivers/hwmon/raspberrypi-hwmon.c
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -15,6 +15,36 @@
 #include <linux/workqueue.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
+/*
+ * This section defines some rate limited logging that prevent
+ * repeated messages at much lower Hz than the default kernel settings.
+ * It's usually 5s, this is 5 minutes.
+ * Burst 3 means you may get three messages 'quickly', before
+ * the ratelimiting kicks in.
+ */
+#define LOCAL_RATELIMIT_INTERVAL (5 * 60 * HZ)
+#define LOCAL_RATELIMIT_BURST 3
+
+#ifdef CONFIG_PRINTK
+#define printk_ratelimited_local(fmt, ...)	\
+({						\
+	static DEFINE_RATELIMIT_STATE(_rs,	\
+		LOCAL_RATELIMIT_INTERVAL,	\
+		LOCAL_RATELIMIT_BURST);		\
+						\
+	if (__ratelimit(&_rs))			\
+		printk(fmt, ##__VA_ARGS__);	\
+})
+#else
+#define printk_ratelimited_local(fmt, ...)	\
+	no_printk(fmt, ##__VA_ARGS__)
+#endif
+
+#define pr_crit_ratelimited_local(fmt, ...)              \
+	printk_ratelimited_local(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_info_ratelimited_local(fmt, ...)              \
+printk_ratelimited_local(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
+
 #define UNDERVOLTAGE_STICKY_BIT	BIT(16)
 
 struct rpi_hwmon_data {
@@ -47,10 +77,13 @@ static void rpi_firmware_get_throttled(struct rpi_hwmon_data *data)
 	if (new_uv == old_uv)
 		return;
 
-	if (new_uv)
-		dev_crit(data->hwmon_dev, "Undervoltage detected!\n");
-	else
-		dev_info(data->hwmon_dev, "Voltage normalised\n");
+	if (new_uv) {
+		pr_crit_ratelimited_local("Under-voltage detected! (0x%08x)\n",
+					  value);
+	} else {
+		pr_info_ratelimited_local("Voltage normalised (0x%08x)\n",
+					  value);
+	}
 
 	sysfs_notify(&data->hwmon_dev->kobj, NULL, "in0_lcrit_alarm");
 }
-- 
GitLab


From fe7f80496fa5ae525f4153c94cedee05f1656ee9 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 13 Oct 2018 13:31:21 +0200
Subject: [PATCH 0147/1835] firmware: raspberrypi: Add backward compatible
 get_throttled

Avoid a hard userspace ABI change by adding a compatible get_throttled
sysfs entry. Its value is now feed by the GET_THROTTLED requests of the
new hwmon driver. The first access to get_throttled will generate
a warning.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/firmware/raspberrypi.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index 4575281f5b570..dc95fa38e5d6a 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -31,6 +31,7 @@ struct rpi_firmware {
 	struct mbox_chan *chan; /* The property channel. */
 	struct completion c;
 	u32 enabled;
+	u32 get_throttled;
 };
 
 static struct platform_device *g_pdev;
@@ -171,6 +172,12 @@ int rpi_firmware_property(struct rpi_firmware *fw,
 	       data + sizeof(struct rpi_firmware_property_tag_header),
 	       buf_size);
 
+	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
+	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
+		memcpy(&fw->get_throttled, tag_data, sizeof(fw->get_throttled));
+		sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
+	}
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(rpi_firmware_property);
@@ -195,6 +202,27 @@ static int rpi_firmware_notify_reboot(struct notifier_block *nb,
 	return 0;
 }
 
+static ssize_t get_throttled_show(struct device *dev,
+				  struct device_attribute *attr, char *buf)
+{
+	struct rpi_firmware *fw = dev_get_drvdata(dev);
+
+	WARN_ONCE(1, "deprecated, use hwmon sysfs instead\n");
+
+	return sprintf(buf, "%x\n", fw->get_throttled);
+}
+
+static DEVICE_ATTR_RO(get_throttled);
+
+static struct attribute *rpi_firmware_dev_attrs[] = {
+	&dev_attr_get_throttled.attr,
+	NULL,
+};
+
+static const struct attribute_group rpi_firmware_dev_group = {
+	.attrs = rpi_firmware_dev_attrs,
+};
+
 static void
 rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
 {
@@ -227,6 +255,11 @@ rpi_register_hwmon_driver(struct device *dev, struct rpi_firmware *fw)
 
 	rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
 						  -1, NULL, 0);
+
+	if (!IS_ERR_OR_NULL(rpi_hwmon)) {
+		if (devm_device_add_group(dev, &rpi_firmware_dev_group))
+			dev_err(dev, "Failed to create get_trottled attr\n");
+	}
 }
 
 static int rpi_firmware_probe(struct platform_device *pdev)
-- 
GitLab


From be7182b5f654566885b09f06c7f80e5457a2fb28 Mon Sep 17 00:00:00 2001
From: James Hughes <james.hughes@raspberrypi.org>
Date: Wed, 31 Oct 2018 13:00:46 +0000
Subject: [PATCH 0148/1835] Increase firmware call buffer size to 48 bytes

An assumption was made in commit a1547e0bc that 32 bytes
would be enough data buffer size for all firmware calls. However,
the axi performance monitor driver uses a call with 44 bytes
(RPI_FIRMWARE_GET_PERIPH_REG) to get the VC registers values.

Increase value to 48 to take this in to account.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 drivers/firmware/raspberrypi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index dc95fa38e5d6a..a4225b74f154c 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -22,7 +22,7 @@
 #define MBOX_DATA28(msg)		((msg) & ~0xf)
 #define MBOX_CHAN_PROPERTY		8
 
-#define MAX_RPI_FW_PROP_BUF_SIZE	32
+#define MAX_RPI_FW_PROP_BUF_SIZE	48
 
 static struct platform_device *rpi_hwmon;
 
-- 
GitLab


From 93a4b924a181ed4feb9b3a3367f1048f969dea1a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 6 Nov 2018 12:57:48 +0000
Subject: [PATCH 0149/1835] sc16is7xx: Don't spin if no data received

See: https://github.com/raspberrypi/linux/issues/2676

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/tty/serial/sc16is7xx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 55b178c1bd65c..7789d35681007 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -678,6 +678,8 @@ static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
 			rxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG);
 			if (rxlen)
 				sc16is7xx_handle_rx(port, rxlen, iir);
+			else
+				return false;
 			break;
 		case SC16IS7XX_IIR_THRI_SRC:
 			sc16is7xx_handle_tx(port);
-- 
GitLab


From 4e74cf178085e1c9501e3b383015cc2a6ea42cc7 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 12 Nov 2018 21:42:00 +0000
Subject: [PATCH 0150/1835] configs: Rebuild bcmrpi3_defconfig to fix warnings

Also disable CONFIG_MMC_BCM2835 to avoid a runtime conflict.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 148 +++++++--------------------
 1 file changed, 37 insertions(+), 111 deletions(-)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index ffd9d4cbb4c1a..58e4d68306a12 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -4,6 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
@@ -25,29 +26,13 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_EMBEDDED=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
-CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_THROTTLING=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
-CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_ARCH_BCM2835=y
 # CONFIG_CAVIUM_ERRATUM_22375 is not set
 # CONFIG_CAVIUM_ERRATUM_23154 is not set
 # CONFIG_CAVIUM_ERRATUM_27456 is not set
 CONFIG_SCHED_MC=y
 CONFIG_NR_CPUS=4
-CONFIG_PREEMPT=y
 CONFIG_HZ_1000=y
-CONFIG_CLEANCACHE=y
-CONFIG_FRONTSWAP=y
-CONFIG_CMA=y
-CONFIG_ZSMALLOC=m
-CONFIG_PGTABLE_MAPPING=y
 CONFIG_SECCOMP=y
 CONFIG_ARMV8_DEPRECATED=y
 CONFIG_SWP_EMULATION=y
@@ -55,7 +40,6 @@ CONFIG_CP15_BARRIER_EMULATION=y
 CONFIG_SETEND_EMULATION=y
 CONFIG_RANDOMIZE_BASE=y
 CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
-CONFIG_BINFMT_MISC=y
 CONFIG_COMPAT=y
 # CONFIG_SUSPEND is not set
 CONFIG_PM=y
@@ -69,6 +53,25 @@ CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_BINFMT_MISC=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -98,6 +101,8 @@ CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
 CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
 CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
@@ -212,7 +217,6 @@ CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
-CONFIG_NF_CONNTRACK_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -232,7 +236,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_CONNTRACK_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -306,11 +309,9 @@ CONFIG_NET_SCH_CHOKE=m
 CONFIG_NET_SCH_QFQ=m
 CONFIG_NET_SCH_CODEL=m
 CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
 CONFIG_NET_SCH_INGRESS=m
 CONFIG_NET_SCH_PLUG=m
-CONFIG_NET_SCH_FQ=m
-CONFIG_TCP_CONG_ADVANCED=y
-CONFIG_TCP_CONG_BBR=m
 CONFIG_NET_CLS_BASIC=m
 CONFIG_NET_CLS_TCINDEX=m
 CONFIG_NET_CLS_ROUTE4=m
@@ -469,7 +470,6 @@ CONFIG_USB_NET_SR9700=m
 CONFIG_USB_NET_SR9800=m
 CONFIG_USB_NET_SMSC75XX=m
 CONFIG_USB_NET_SMSC95XX=y
-CONFIG_USB_LAN78XX=y
 CONFIG_USB_NET_GL620A=m
 CONFIG_USB_NET_NET1080=m
 CONFIG_USB_NET_PLUSB=m
@@ -591,7 +591,6 @@ CONFIG_HW_RANDOM=y
 CONFIG_RAW_DRIVER=y
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=m
-CONFIG_I2C_MUX_PCA954x=m
 CONFIG_I2C_BCM2708=m
 CONFIG_I2C_BCM2835=m
 CONFIG_I2C_GPIO=m
@@ -603,7 +602,6 @@ CONFIG_PPS=m
 CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_GPIO_SYSFS=y
-CONFIG_GPIO_BCM_EXP=y
 CONFIG_GPIO_BCM_VIRT=y
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
@@ -620,7 +618,6 @@ CONFIG_W1_SLAVE_DS2406=m
 CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433=m
-CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
@@ -640,17 +637,6 @@ CONFIG_STMPE_SPI=y
 CONFIG_MFD_ARIZONA_I2C=m
 CONFIG_MFD_ARIZONA_SPI=m
 CONFIG_MFD_WM5102=y
-CONFIG_LIRC=m
-CONFIG_RC_DEVICES=y
-CONFIG_RC_ATI_REMOTE=m
-CONFIG_IR_IMON=m
-CONFIG_IR_MCEUSB=m
-CONFIG_IR_REDRAT3=m
-CONFIG_IR_STREAMZAP=m
-CONFIG_IR_IGUANA=m
-CONFIG_IR_TTUSBIR=m
-CONFIG_RC_LOOPBACK=m
-CONFIG_IR_GPIO_CIR=m
 CONFIG_MEDIA_SUPPORT=m
 CONFIG_MEDIA_CAMERA_SUPPORT=y
 CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
@@ -721,41 +707,7 @@ CONFIG_VIDEO_GO7007=m
 CONFIG_VIDEO_GO7007_USB=m
 CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
 CONFIG_VIDEO_AU0828=m
-CONFIG_VIDEO_AU0828_RC=y
-CONFIG_VIDEO_CX231XX=m
-CONFIG_VIDEO_CX231XX_ALSA=m
-CONFIG_VIDEO_CX231XX_DVB=m
-CONFIG_VIDEO_TM6000=m
-CONFIG_VIDEO_TM6000_ALSA=m
-CONFIG_VIDEO_TM6000_DVB=m
-CONFIG_DVB_USB=m
-CONFIG_DVB_USB_A800=m
-CONFIG_DVB_USB_DIBUSB_MB=m
-CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
-CONFIG_DVB_USB_DIBUSB_MC=m
-CONFIG_DVB_USB_DIB0700=m
-CONFIG_DVB_USB_UMT_010=m
-CONFIG_DVB_USB_CXUSB=m
-CONFIG_DVB_USB_M920X=m
-CONFIG_DVB_USB_DIGITV=m
-CONFIG_DVB_USB_VP7045=m
-CONFIG_DVB_USB_VP702X=m
-CONFIG_DVB_USB_GP8PSK=m
-CONFIG_DVB_USB_NOVA_T_USB2=m
-CONFIG_DVB_USB_TTUSB2=m
-CONFIG_DVB_USB_DTT200U=m
-CONFIG_DVB_USB_OPERA1=m
-CONFIG_DVB_USB_AF9005=m
-CONFIG_DVB_USB_AF9005_REMOTE=m
-CONFIG_DVB_USB_PCTV452E=m
-CONFIG_DVB_USB_DW2102=m
-CONFIG_DVB_USB_CINERGY_T2=m
-CONFIG_DVB_USB_DTV5100=m
-CONFIG_DVB_USB_FRIIO=m
-CONFIG_DVB_USB_AZ6027=m
-CONFIG_DVB_USB_TECHNISAT_USB2=m
 CONFIG_DVB_USB_V2=m
-CONFIG_DVB_USB_AF9015=m
 CONFIG_DVB_USB_AF9035=m
 CONFIG_DVB_USB_ANYSEE=m
 CONFIG_DVB_USB_AU6610=m
@@ -763,9 +715,7 @@ CONFIG_DVB_USB_AZ6007=m
 CONFIG_DVB_USB_CE6230=m
 CONFIG_DVB_USB_EC168=m
 CONFIG_DVB_USB_GL861=m
-CONFIG_DVB_USB_LME2510=m
 CONFIG_DVB_USB_MXL111SF=m
-CONFIG_DVB_USB_RTL28XXU=m
 CONFIG_DVB_USB_DVBSKY=m
 CONFIG_SMS_USB_DRV=m
 CONFIG_DVB_B2C2_FLEXCOP_USB=m
@@ -775,7 +725,7 @@ CONFIG_VIDEO_EM28XX_V4L2=m
 CONFIG_VIDEO_EM28XX_ALSA=m
 CONFIG_VIDEO_EM28XX_DVB=m
 CONFIG_V4L_PLATFORM_DRIVERS=y
-CONFIG_RADIO_SI470X=y
+CONFIG_RADIO_SI470X=m
 CONFIG_USB_SI470X=m
 CONFIG_I2C_SI470X=m
 CONFIG_RADIO_SI4713=m
@@ -1019,7 +969,6 @@ CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_IPROC=m
 CONFIG_MMC_SPI=m
-CONFIG_MMC_BCM2835=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGER_TIMER=y
@@ -1073,20 +1022,6 @@ CONFIG_DMA_BCM2708=y
 CONFIG_UIO=m
 CONFIG_UIO_PDRV_GENIRQ=m
 CONFIG_STAGING=y
-CONFIG_IRDA=m
-CONFIG_IRLAN=m
-CONFIG_IRNET=m
-CONFIG_IRCOMM=m
-CONFIG_IRDA_ULTRA=y
-CONFIG_IRDA_CACHE_LAST_LSAP=y
-CONFIG_IRDA_FAST_RR=y
-CONFIG_IRTTY_SIR=m
-CONFIG_KINGSUN_DONGLE=m
-CONFIG_KSDAZZLE_DONGLE=m
-CONFIG_KS959_DONGLE=m
-CONFIG_USB_IRDA=m
-CONFIG_SIGMATEL_FIR=m
-CONFIG_MCS_FIR=m
 CONFIG_PRISM2_USB=m
 CONFIG_R8712U=m
 CONFIG_R8188EU=m
@@ -1094,8 +1029,6 @@ CONFIG_VT6656=m
 CONFIG_SPEAKUP=m
 CONFIG_SPEAKUP_SYNTH_SOFT=m
 CONFIG_STAGING_MEDIA=y
-CONFIG_LIRC_STAGING=y
-CONFIG_LIRC_RPI=m
 CONFIG_FB_TFT=m
 CONFIG_FB_TFT_AGM1264K_FL=m
 CONFIG_FB_TFT_BD663474=m
@@ -1143,7 +1076,6 @@ CONFIG_DHT11=m
 CONFIG_HTU21=m
 CONFIG_PWM_BCM2835=m
 CONFIG_PWM_PCA9685=m
-CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
@@ -1255,19 +1187,6 @@ CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
 CONFIG_DLM=m
-CONFIG_PRINTK_TIME=y
-CONFIG_BOOT_PRINTK_DELAY=y
-CONFIG_DEBUG_MEMORY_INIT=y
-CONFIG_DETECT_HUNG_TASK=y
-CONFIG_LATENCYTOP=y
-CONFIG_IRQSOFF_TRACER=y
-CONFIG_SCHED_TRACER=y
-CONFIG_STACK_TRACER=y
-CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_FUNCTION_PROFILER=y
-CONFIG_KGDB=y
-CONFIG_KGDB_KDB=y
-CONFIG_KDB_KEYBOARD=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
@@ -1279,11 +1198,18 @@ CONFIG_CRYPTO_CAST5=m
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
-CONFIG_ARM64_CRYPTO=y
-CONFIG_CRYPTO_AES_ARM64=m
-CONFIG_CRYPTO_AES_ARM64_BS=m
-CONFIG_CRYPTO_AES_ARM64_NEON_BLK=m
 CONFIG_CRC_ITU_T=y
 CONFIG_LIBCRC32C=y
-CONFIG_MMC_BCM2835_MMC=y
-CONFIG_MMC_SDHCI_IPROC=m
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
-- 
GitLab


From b8a8e5b6855264e2d7450c1d5ad884cb3b976dfb Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 24 Aug 2017 16:16:16 +0100
Subject: [PATCH 0151/1835] brcmfmac: Disable ARP offloading when promiscuous

This is a test patch for brcmfmac from Franky Lin at Broadcom to disable
ARP offloading when in promiscuous mode, re-enabling the ability to
sniff ARP packets over WiFi.

See: https://github.com/raspberrypi/linux/issues/2171

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 11 ++++++-----
 .../net/wireless/broadcom/brcm80211/brcmfmac/core.h   |  1 +
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 860a4372cb564..6d593dde61cc2 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -88,25 +88,25 @@ void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 	if (err) {
 		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 			  mode, err);
+		err = 0;
 	} else {
 		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 		if (err) {
 			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 				  enable, err);
-		} else {
+			err = 0;
+		} else
 			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 				  enable, mode);
-		}
 	}
 
 	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
-	if (err) {
+	if (err)
 		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 			  enable, err);
-	} else {
+	else
 		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 			  enable, mode);
-	}
 }
 
 static void _brcmf_set_multicast_list(struct work_struct *work)
@@ -172,6 +172,7 @@ static void _brcmf_set_multicast_list(struct work_struct *work)
 	if (err < 0)
 		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
 			  err);
+
 	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
 }
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
index dcf6e27cc16f2..edfb09eae141c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
@@ -210,6 +210,7 @@ char *brcmf_ifname(struct brcmf_if *ifp);
 struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
 void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
 int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
 struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
 			      bool is_p2pdev, const char *name, u8 *mac_addr);
 void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked);
-- 
GitLab


From 73ffe5788c9e933197f4608de9d1338e806b790a Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Tue, 6 Feb 2018 15:37:22 +0100
Subject: [PATCH 0152/1835] config: enable Audio Graph Card module

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index b2651f8c611dd..ab74313c60b4b 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -926,6 +926,7 @@ CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
+CONFIG_SND_AUDIO_GRAPH_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 0c44c45f13684..1e2c6f831e71e 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -919,6 +919,7 @@ CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
+CONFIG_SND_AUDIO_GRAPH_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
-- 
GitLab


From cf512971c4bb085df02824c7236f40e070ce234e Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Thu, 29 Mar 2018 16:05:28 +0100
Subject: [PATCH 0153/1835] config: Add IPVLAN module

---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index ab74313c60b4b..2ccb792e08438 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -350,6 +350,7 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_BATMAN_ADV=m
 CONFIG_OPENVSWITCH=m
+CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_NET_PKTGEN=m
 CONFIG_HAMRADIO=y
 CONFIG_AX25=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 1e2c6f831e71e..a547f27e1d625 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -344,6 +344,7 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_BATMAN_ADV=m
 CONFIG_OPENVSWITCH=m
+CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_NET_PKTGEN=m
 CONFIG_HAMRADIO=y
 CONFIG_AX25=m
-- 
GitLab


From 4245d6db28a95c3e4ab2027b6d8feb952b58726f Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 27 Apr 2018 16:21:33 +0100
Subject: [PATCH 0154/1835] config: Add I2C_TINY_USB=m

Enable the I2C Tiny USB module.

See: https://github.com/raspberrypi/linux/issues/2535

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 1 -
 arch/arm/configs/bcmrpi_defconfig  | 1 -
 2 files changed, 2 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 2ccb792e08438..5474e5b942bed 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -927,7 +927,6 @@ CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
-CONFIG_SND_AUDIO_GRAPH_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index a547f27e1d625..2ec2d31202a0a 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -920,7 +920,6 @@ CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
-CONFIG_SND_AUDIO_GRAPH_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
-- 
GitLab


From 3bd98d89404b96c198fc11a7e8582466e03b89a7 Mon Sep 17 00:00:00 2001
From: Jasper Boomer <jasperboomer@gmail.com>
Date: Sun, 24 Jun 2018 12:20:27 -0400
Subject: [PATCH 0155/1835] Add device tree overlay for HD44780

---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             | 25 ++++++++++
 .../boot/dts/overlays/hd44780-lcd-overlay.dts | 46 +++++++++++++++++++
 3 files changed, 72 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 80bf98cc72372..6e5ac5c3369fd 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -38,6 +38,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	gpio-no-irq.dtbo \
 	gpio-poweroff.dtbo \
 	gpio-shutdown.dtbo \
+	hd44780-lcd.dtbo \
 	hifiberry-amp.dtbo \
 	hifiberry-dac.dtbo \
 	hifiberry-dacplus.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index a987d3d1bba06..53f4a47caa5c3 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -639,6 +639,31 @@ Params: gpio_pin                GPIO pin to trigger on (default 3)
                                 external pullup.
 
 
+Name:   hd44780-lcd
+Info:   Configures an HD44780 compatible LCD display. Uses 4 gpio pins for
+        data, 2 gpio pins for enable and register select and 1 optional pin
+        for enabling/disabling the backlight display.
+Load:   dtoverlay=hd44780-lcd,<param>=<val>
+Params: pin_d4                  GPIO pin for data pin D4 (default 6)
+
+        pin_d5                  GPIO pin for data pin D5 (default 13)
+
+        pin_d6                  GPIO pin for data pin D6 (default 19)
+
+        pin_d7                  GPIO pin for data pin D7 (default 26)
+
+        pin_en                  GPIO pin for "Enable" (default 21)
+
+        pin_rs                  GPIO pin for "Register Select" (default 20)
+
+        pin_bl                  Optional pin for enabling/disabling the
+                                display backlight. (default disabled)
+
+        display_height          Height of the display in characters
+
+        display_width           Width of the display in characters
+
+
 Name:   hifiberry-amp
 Info:   Configures the HifiBerry Amp and Amp+ audio cards
 Load:   dtoverlay=hifiberry-amp
diff --git a/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts b/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
new file mode 100644
index 0000000000000..ee726669ff511
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hd44780-lcd-overlay.dts
@@ -0,0 +1,46 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835";
+
+    fragment@0 {
+        target-path = "/";
+        __overlay__ {
+            lcd_screen: auxdisplay {
+                compatible = "hit,hd44780";
+
+                data-gpios = <&gpio 6 0>,
+                             <&gpio 13 0>,
+                             <&gpio 19 0>,
+                             <&gpio 26 0>;
+                enable-gpios = <&gpio 21 0>;
+                rs-gpios = <&gpio 20 0>;
+
+                display-height-chars = <2>;
+                display-width-chars = <16>;
+            };
+
+        };
+    };
+
+    fragment@1 {
+       target = <&lcd_screen>;
+        __dormant__ {
+            backlight-gpios = <&gpio 12 0>;
+        };
+    };
+
+    __overrides__ {
+        pin_d4 = <&lcd_screen>,"data-gpios:4";
+        pin_d5 = <&lcd_screen>,"data-gpios:16";
+        pin_d6 = <&lcd_screen>,"data-gpios:28";
+        pin_d7 = <&lcd_screen>,"data-gpios:40";
+        pin_en = <&lcd_screen>,"enable-gpios:4";
+        pin_rs = <&lcd_screen>,"rs-gpios:4";
+        pin_bl = <0>,"+1", <&lcd_screen>,"backlight-gpios:4";
+        display_height = <&lcd_screen>,"display-height-chars:0";
+        display_width = <&lcd_screen>,"display-width-chars:0";
+    };
+
+};
-- 
GitLab


From f2898814281663c2e84575522e44847c6cfefd23 Mon Sep 17 00:00:00 2001
From: Jasper Boomer <jasperboomer@gmail.com>
Date: Mon, 2 Jul 2018 13:16:22 -0400
Subject: [PATCH 0156/1835] Add hd44780 module to defconfig

---
 arch/arm/configs/bcm2709_defconfig | 2 ++
 arch/arm/configs/bcmrpi_defconfig  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 5474e5b942bed..96e72f4caaae5 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1155,6 +1155,8 @@ CONFIG_RTC_DRV_RV3029C2=m
 CONFIG_DMADEVICES=y
 CONFIG_DMA_BCM2835=y
 CONFIG_DMA_BCM2708=y
+CONFIG_AUXDISPLAY=y
+CONFIG_HD44780=m
 CONFIG_UIO=m
 CONFIG_UIO_PDRV_GENIRQ=m
 CONFIG_STAGING=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 2ec2d31202a0a..c57a4cde69476 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1148,6 +1148,8 @@ CONFIG_RTC_DRV_RV3029C2=m
 CONFIG_DMADEVICES=y
 CONFIG_DMA_BCM2835=y
 CONFIG_DMA_BCM2708=y
+CONFIG_AUXDISPLAY=y
+CONFIG_HD44780=m
 CONFIG_UIO=m
 CONFIG_UIO_PDRV_GENIRQ=m
 CONFIG_STAGING=y
-- 
GitLab


From 460cadcf003d4f52f61173e769ddffeae3f4c49c Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 9 Jul 2018 21:11:32 +0100
Subject: [PATCH 0157/1835] overlays: Add addr parameter to i2c-rtc (& -gpio)

See: https://github.com/raspberrypi/linux/issues/2611

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README             | 10 +++++++
 .../dts/overlays/i2c-rtc-gpio-overlay.dts     | 28 +++++++++++++++++++
 .../arm/boot/dts/overlays/i2c-rtc-overlay.dts | 11 ++++++++
 3 files changed, 49 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 53f4a47caa5c3..b32f030bd650c 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -817,6 +817,10 @@ Params: abx80x                  Select one of the ABx80x family:
 
         pcf8563                 Select the PCF8563 device
 
+        addr                    Sets the address for the RTC. Note that the
+                                device must be configured to use the specified
+                                address.
+
         trickle-diode-type      Diode type for trickle charge - "standard" or
                                 "schottky" (ABx80x only)
 
@@ -841,6 +845,8 @@ Params: abx80x                  Select one of the ABx80x family:
 
         ds3231                  Select the DS3231 device
 
+        m41t62                  Select the M41T62 device
+
         mcp7940x                Select the MCP7940x device
 
         mcp7941x                Select the MCP7941x device
@@ -851,6 +857,10 @@ Params: abx80x                  Select one of the ABx80x family:
 
         pcf8563                 Select the PCF8563 device
 
+        addr                    Sets the address for the RTC. Note that the
+                                device must be configured to use the specified
+                                address.
+
         trickle-diode-type      Diode type for trickle charge - "standard" or
                                 "schottky" (ABx80x only)
 
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
index 8415e6081428f..4fd47ffa8575f 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
@@ -159,6 +159,21 @@
 		};
 	};
 
+	fragment@10 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			m41t62: m41t62@68 {
+				compatible = "st,m41t62";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
 	__overrides__ {
 		abx80x = <0>,"+1";
 		ds1307 = <0>,"+2";
@@ -169,6 +184,19 @@
 		pcf2127 = <0>,"+7";
 		pcf8523 = <0>,"+8";
 		pcf8563 = <0>,"+9";
+		m41t62 = <0>,"+10";
+
+		addr = <&abx80x>, "reg:0",
+		       <&ds1307>, "reg:0",
+		       <&ds1339>, "reg:0",
+		       <&ds3231>, "reg:0",
+		       <&mcp7940x>, "reg:0",
+		       <&mcp7941x>, "reg:0",
+		       <&pcf2127>, "reg:0",
+		       <&pcf8523>, "reg:0",
+		       <&pcf8563>, "reg:0",
+		       <&m41t62>, "reg:0";
+
 		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
 		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
 					<&abx80x>,"abracon,tc-resistor";
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
index fcb846a50d19c..7f11b7c646383 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -169,6 +169,17 @@
 		pcf8523 = <0>,"+7";
 		pcf8563 = <0>,"+8";
 		m41t62 = <0>,"+9";
+
+		addr = <&abx80x>, "reg:0",
+		       <&ds1307>, "reg:0",
+		       <&ds1339>, "reg:0",
+		       <&ds3231>, "reg:0",
+		       <&mcp7940x>, "reg:0",
+		       <&mcp7941x>, "reg:0",
+		       <&pcf2127>, "reg:0",
+		       <&pcf8523>, "reg:0",
+		       <&pcf8563>, "reg:0",
+		       <&m41t62>, "reg:0";
 		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
 		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
 					<&abx80x>,"abracon,tc-resistor";
-- 
GitLab


From 27f24d2f5ad08de6052cde82e30e4e416939485b Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 9 Mar 2018 14:24:05 -0800
Subject: [PATCH 0158/1835] ARM: BCM270X: Add the 18-bit DPI pinmux to the RPI
 DTs.

This doesn't do anything by default, but trying to put the node in an
overlay failed for me.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 arch/arm/boot/dts/bcm270x.dtsi | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index 145e455a2a146..27f19225245e9 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -19,6 +19,13 @@
 
 		gpio@7e200000 { /* gpio */
 			interrupts = <2 17>, <2 18>;
+
+			dpi_18bit_gpio0: dpi_18bit_gpio0 {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					     12 13 14 15 16 17 18 19
+					     20 21>;
+				brcm,function = <BCM2835_FSEL_ALT2>;
+			};
 		};
 
 		serial@7e201000 { /* uart0 */
-- 
GitLab


From 74ed3ac449e8bdb6a7a5829f254b9a81a8ca959d Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 9 Mar 2018 13:20:21 -0800
Subject: [PATCH 0159/1835] overlays: Add an overlay for the Adafruit Kippah
 with their 7" panel

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  7 +++
 .../overlays/vc4-kms-kippah-7inch-overlay.dts | 43 +++++++++++++++++++
 3 files changed, 51 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 6e5ac5c3369fd..051b0263a564c 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -134,6 +134,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	upstream.dtbo \
 	upstream-aux-interrupt.dtbo \
 	vc4-fkms-v3d.dtbo \
+	vc4-kms-kippah-7inch.dtbo \
 	vc4-kms-v3d.dtbo \
 	vga666.dtbo \
 	w1-gpio.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index b32f030bd650c..a867317e7dc0a 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1920,6 +1920,13 @@ Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
         cma-64                  CMA is 64MB, 64MB-aligned
 
 
+Name:   vc4-kms-kippah-7inch
+Info:   Enable the Adafruit DPI Kippah with the 7" Ontat panel attached.
+        Requires vc4-kms-v3d to be loaded.
+Load:   dtoverlay=vc4-kms-kippah-7inch
+Params: <None>
+
+
 Name:   vc4-kms-v3d
 Info:   Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver. Running startx or
         booting to GUI while this overlay is in use will cause interesting
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
new file mode 100644
index 0000000000000..1e20d7e51115c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
@@ -0,0 +1,43 @@
+/*
+ * vc4-kms-v3d-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/pinctrl/bcm2835.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			panel: panel {
+				compatible = "ontat,yx700wv03", "simple-panel";
+
+				port {
+					panel_in: endpoint {
+						remote-endpoint = <&dpi_out>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&dpi>;
+		__overlay__  {
+			status = "okay";
+
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi_18bit_gpio0>;
+
+			port {
+				dpi_out: endpoint@0 {
+					remote-endpoint = <&panel_in>;
+				};
+			};
+		};
+	};
+};
-- 
GitLab


From 1dfbeb6cf8b81f9e01e2aca727361876c267cdb4 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 9 Mar 2018 13:26:33 -0800
Subject: [PATCH 0160/1835] overlays: Remove stale notes about vc4's CMA
 alignment in the README.

We haven't needed alignment since
553c942f8b2cbc7394b4d4fa2f848b23a8f07451, and the current overlays
don't specify any.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 arch/arm/boot/dts/overlays/README | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index a867317e7dc0a..5c9ede3ea6e27 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1913,11 +1913,11 @@ Name:   vc4-fkms-v3d
 Info:   Enable Eric Anholt's DRM VC4 V3D driver on top of the dispmanx
         display stack.
 Load:   dtoverlay=vc4-fkms-v3d,<param>
-Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
-        cma-192                 CMA is 192MB, 256MB-aligned (needs 1GB)
-        cma-128                 CMA is 128MB, 128MB-aligned
-        cma-96                  CMA is 96MB, 128MB-aligned
-        cma-64                  CMA is 64MB, 64MB-aligned
+Params: cma-256                 CMA is 256MB (needs 1GB)
+        cma-192                 CMA is 192MB (needs 1GB)
+        cma-128                 CMA is 128MB
+        cma-96                  CMA is 96MB
+        cma-64                  CMA is 64MB
 
 
 Name:   vc4-kms-kippah-7inch
@@ -1932,11 +1932,11 @@ Info:   Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver. Running startx or
         booting to GUI while this overlay is in use will cause interesting
         lockups.
 Load:   dtoverlay=vc4-kms-v3d,<param>
-Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
-        cma-192                 CMA is 192MB, 256MB-aligned (needs 1GB)
-        cma-128                 CMA is 128MB, 128MB-aligned
-        cma-96                  CMA is 96MB, 128MB-aligned
-        cma-64                  CMA is 64MB, 64MB-aligned
+Params: cma-256                 CMA is 256MB (needs 1GB)
+        cma-192                 CMA is 192MB (needs 1GB)
+        cma-128                 CMA is 128MB
+        cma-96                  CMA is 96MB
+        cma-64                  CMA is 64MB
 
 
 Name:   vga666
-- 
GitLab


From a6654c93a4dc3c16ab35fb0666891d8126aa8256 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 3 Jul 2018 14:23:47 +0100
Subject: [PATCH 0161/1835] spi: Make GPIO CSs honour the SPI_NO_CS flag

The SPI configuration state includes an SPI_NO_CS flag that disables
all CS line manipulation, for applications that want to manage their
own chip selects. However, this flag is ignored by the GPIO CS code
in the SPI framework.

Correct this omission with a trivial patch.

See: https://github.com/raspberrypi/linux/issues/2169

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/spi/spi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 9da0bc5a036cf..f611024c5e5ee 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -733,7 +733,9 @@ static void spi_set_cs(struct spi_device *spi, bool enable)
 		enable = !enable;
 
 	if (gpio_is_valid(spi->cs_gpio)) {
-		gpio_set_value(spi->cs_gpio, !enable);
+		/* Honour the SPI_NO_CS flag */
+		if (!(spi->mode & SPI_NO_CS))
+			gpio_set_value(spi->cs_gpio, !enable);
 		/* Some SPI masters need both GPIO CS & slave_select */
 		if ((spi->controller->flags & SPI_MASTER_GPIO_SS) &&
 		    spi->controller->set_cs)
-- 
GitLab


From 6ca8ffeaf72c18f29879330a44d300436698e50a Mon Sep 17 00:00:00 2001
From: Steve Pavao <stevep@korgrd.com>
Date: Fri, 10 Aug 2018 17:09:50 -0400
Subject: [PATCH 0162/1835] devicetree: add RPi CM3 dts to arm64; mimic the RPi
 3B arm64 dts implementation, by referring to the actual dts file in the arm
 directory

---
 arch/arm64/boot/dts/broadcom/Makefile            | 2 ++
 arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts | 3 +++
 2 files changed, 5 insertions(+)
 create mode 100644 arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts

diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
index 78d23305bc310..66b0be84e08f1 100644
--- a/arch/arm64/boot/dts/broadcom/Makefile
+++ b/arch/arm64/boot/dts/broadcom/Makefile
@@ -4,6 +4,8 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2837-rpi-3-b.dtb \
 dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-3-b.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b-plus.dtb
+dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-cm3.dtb
+dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-cm3.dtb
 
 subdir-y	+= northstar2
 subdir-y	+= stingray
diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
new file mode 100644
index 0000000000000..1c2560017c02f
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-cm3.dts
@@ -0,0 +1,3 @@
+#define RPI364
+
+#include "../../../../arm/boot/dts/bcm2710-rpi-cm3.dts"
-- 
GitLab


From e1ab9a47227afa294d3127f815d6f178a25f53b2 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Tue, 28 Aug 2018 18:42:13 +1000
Subject: [PATCH 0163/1835] Add support for audioinjector.net ultra soundcard.
 (#2664)

Uses the simple-audio-card ALSA machine driver. Sets up the machine
driver in the device tree overlay file. The overlays/Makefile is
altered to add the audioinjector-ultra.dtbo dtb overlay.

Adds CONFIG_SND_SOC_CS4265 to the defconfig files.

Signed-off-by: Matt Flax <flatmax@flatmax.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  6 ++
 .../overlays/audioinjector-ultra-overlay.dts  | 71 +++++++++++++++++++
 arch/arm/configs/bcm2709_defconfig            |  1 +
 arch/arm/configs/bcmrpi_defconfig             |  1 +
 5 files changed, 80 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 051b0263a564c..a8f213d5cfcb2 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -15,6 +15,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	applepi-dac.dtbo \
 	at86rf233.dtbo \
 	audioinjector-addons.dtbo \
+	audioinjector-ultra.dtbo \
 	audioinjector-wm8731-audio.dtbo \
 	audremap.dtbo \
 	balena-fin.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 5c9ede3ea6e27..35cbe0bf94dba 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -389,6 +389,12 @@ Params: non-stop-clocks         Keeps the clocks running even when the stream
                                 is paused or stopped (default off)
 
 
+Name:   audioinjector-ultra
+Info:   Configures the audioinjector.net ultra soundcard
+Load:   dtoverlay=audioinjector-ultra
+Params: <None>
+
+
 Name:   audioinjector-wm8731-audio
 Info:   Configures the audioinjector.net audio add on soundcard
 Load:   dtoverlay=audioinjector-wm8731-audio
diff --git a/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
new file mode 100644
index 0000000000000..280e983bbf190
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
@@ -0,0 +1,71 @@
+// Definitions for audioinjector.net audio add on soundcard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			cs4265: cs4265@4e {
+				#sound-dai-cells = <0>;
+				compatible = "cirrus,cs4265";
+				reg = <0x4e>;
+				reset-gpios = <&gpio 5 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "simple-audio-card";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			simple-audio-card,name = "audioinjector-ultra";
+
+			simple-audio-card,widgets =
+				"Line", "OUTPUTS",
+				"Line", "INPUTS";
+
+			simple-audio-card,routing =
+				"OUTPUTS","LINEOUTL",
+				"OUTPUTS","LINEOUTR",
+				"OUTPUTS","SPDIFOUT",
+				"LINEINL","INPUTS",
+				"LINEINR","INPUTS",
+				"MICL","INPUTS",
+				"MICR","INPUTS";
+
+			simple-audio-card,format = "i2s";
+
+			simple-audio-card,bitclock-master = <&sound_master>;
+			simple-audio-card,frame-master = <&sound_master>;
+
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+				dai-tdm-slot-num = <2>;
+				dai-tdm-slot-width = <32>;
+			};
+
+			sound_master: simple-audio-card,codec {
+				sound-dai = <&cs4265>;
+				system-clock-frequency = <12288000>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 96e72f4caaae5..3718e6b9535b8 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -926,6 +926,7 @@ CONFIG_SND_SOC_AK4554=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SIMPLE_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index c57a4cde69476..4e891afec1335 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -919,6 +919,7 @@ CONFIG_SND_SOC_AK4554=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SIMPLE_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
-- 
GitLab


From f4e14fe074e722e4d146029790e6420950e7b326 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Thu, 30 Aug 2018 09:38:02 +1000
Subject: [PATCH 0164/1835] ASoC: cs4265: Add a S/PDIF enable switch

commit f853d6b3ba345297974d877d8ed0f4a91eaca739 upstream.

This patch adds a S/PDIF enable switch as a SOC_SINGLE.

Signed-off-by: Matt Flax <flatmax@flatmax.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/cs4265.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
index 407554175282f..c90959d7adf64 100644
--- a/sound/soc/codecs/cs4265.c
+++ b/sound/soc/codecs/cs4265.c
@@ -154,6 +154,7 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = {
 	SOC_SINGLE("E to F Buffer Disable Switch", CS4265_SPDIF_CTL1,
 				6, 1, 0),
 	SOC_ENUM("C Data Access", cam_mode_enum),
+	SOC_SINGLE("SPDIF Switch", CS4265_SPDIF_CTL2, 5, 1, 1),
 	SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2,
 				3, 1, 0),
 	SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum),
-- 
GitLab


From 7aee6caf552fc148d09e37276ef813dd4cc6a284 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Thu, 30 Aug 2018 09:38:01 +1000
Subject: [PATCH 0165/1835] ASoC: cs4265: Add native 32bit I2S transport

commit be47e75eb1419ffc1d9c26230963fd5fa3055097 upstream.

The cs4265 uses 32 bit transport on the I2S bus. This patch enables native
32 bit mode for machine drivers which use this sound card driver.

Signed-off-by: Matt Flax <flatmax@flatmax.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/cs4265.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
index c90959d7adf64..6d0843386948b 100644
--- a/sound/soc/codecs/cs4265.c
+++ b/sound/soc/codecs/cs4265.c
@@ -497,7 +497,8 @@ static int cs4265_set_bias_level(struct snd_soc_component *component,
 			SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000)
 
 #define CS4265_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_U16_LE | \
-			SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_U24_LE)
+			SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_U24_LE | \
+			SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_U32_LE)
 
 static const struct snd_soc_dai_ops cs4265_ops = {
 	.hw_params	= cs4265_pcm_hw_params,
-- 
GitLab


From e45fc405815c75c72b87bcae7671ebf0ac56a35f Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 18 Sep 2018 11:03:20 +0100
Subject: [PATCH 0166/1835] configs: Add SENSOR_GPIO_FAN=m

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 3 ++-
 arch/arm/configs/bcmrpi_defconfig  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 3718e6b9535b8..4eaa666c84973 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -658,6 +658,7 @@ CONFIG_BATTERY_DS2760=m
 CONFIG_BATTERY_GAUGE_LTC2941=m
 CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_GPIO_FAN=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
@@ -923,10 +924,10 @@ CONFIG_SND_PISOUND=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
-CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SIMPLE_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 4e891afec1335..cf4c81f975a89 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -651,6 +651,7 @@ CONFIG_BATTERY_DS2760=m
 CONFIG_BATTERY_GAUGE_LTC2941=m
 CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_GPIO_FAN=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
 CONFIG_SENSORS_RASPBERRYPI_HWMON=m
@@ -916,10 +917,10 @@ CONFIG_SND_PISOUND=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
-CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SIMPLE_CARD=m
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HIDRAW=y
-- 
GitLab


From 784d4fcd8ec12a3e3ad3231b8293278ef9e520e9 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 18 Sep 2018 11:08:07 +0100
Subject: [PATCH 0167/1835] BCM270X_DT: Add gpio-fan overlay

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  8 +++
 .../boot/dts/overlays/gpio-fan-overlay.dts    | 71 +++++++++++++++++++
 3 files changed, 80 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/gpio-fan-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index a8f213d5cfcb2..99338350fc510 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -33,6 +33,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	fe-pi-audio.dtbo \
 	goodix.dtbo \
 	googlevoicehat-soundcard.dtbo \
+	gpio-fan.dtbo \
 	gpio-ir.dtbo \
 	gpio-ir-tx.dtbo \
 	gpio-key.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 35cbe0bf94dba..018dc5dd8f1e6 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -541,6 +541,14 @@ Load:   dtoverlay=googlevoicehat-soundcard
 Params: <None>
 
 
+Name:   gpio-fan
+Info:   Configure a GPIO pin to control a cooling fan.
+Load:   dtoverlay=gpio-fan,<param>=<val>
+Params: gpiopin                 GPIO used to control the fan (default 12)
+        temp                    Temperature at which the fan switches on, in
+                                millicelcius (default 55000)
+
+
 Name:   gpio-ir
 Info:   Use GPIO pin as rc-core style infrared receiver input. The rc-core-
         based gpio_ir_recv driver maps received keys directly to a
diff --git a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
new file mode 100644
index 0000000000000..66fd9950c34be
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
@@ -0,0 +1,71 @@
+/*
+ * Overlay for the Raspberry Pi GPIO Fan @ BCM GPIO12.
+ * Optional parameters:
+ *	- "gpiopin"	- default GPIO12
+ * 	- "temp"	- default 55000
+ * Requires:
+ *	- kernel configurations: CONFIG_SENSORS_GPIO_FAN=m and CONFIG_SENSORS_PWM_FAN=m;
+ *	- kernel rebuid;
+ *	- DC Fan connected to GPIO via a N-MOSFET (2N7002)
+ *
+ *                   ┌─────────────────────┐
+ *                   │Fan negative terminal│
+ *                   └┬────────────────────┘
+ *                    │
+ *                 │──┘
+ * [GPIO12]──────┤ │<─┐  2N7002
+ *                 │──┤
+ *                    │
+ *                   ─┴─
+ *                   GND
+ *
+ * sudo dtc -W no-unit_address_vs_reg -@ -I dts -O dtb -o /boot/overlays/gpio-fan.dtbo gpio-fan.dts
+ * sudo nano /boot/config.txt add "dtoverlay=gpio-fan" or "dtoverlay=gpio-fan,gpiopin=12,temp=45000"
+ * or
+ * sudo sh -c "echo '\n# Enable PI GPIO-Fan\ndtoverlay=gpio-fan\n' >> /boot/config.txt"
+ * sudo sh -c "echo '\n# Enable PI GPIO-Fan\ndtoverlay=gpio-fan,gpiopin=12\n' >> /boot/config.txt"
+ *
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			fan0: gpio-fan@0 {
+				compatible = "gpio-fan";
+				gpios = <&gpio 12 1>;
+				gpio-fan,speed-map = <0    0>,
+									 <5000 1>;
+				#cooling-cells = <2>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&cpu_thermal>;
+		polling-delay = <2000>;	/* milliseconds */
+		__overlay__ {
+			trips {
+				cpu_hot: trip-point@0 {
+					temperature = <55000>;	/* (millicelsius) Fan started at 55°C */
+					hysteresis = <5000>;	/* (millicelsius) Fan stopped at 50°C */
+					type = "active";
+				};
+			};
+			cooling-maps {
+				map0 {
+					trip = <&cpu_hot>;
+					cooling-device = <&fan0 1 1>;
+				};
+			};
+		};
+	};
+	__overrides__ {
+		gpiopin = <&fan0>,"gpios:4", <&fan0>,"brcm,pins:0";
+		temp = <&cpu_hot>,"temperature:0";
+	};
+};
-- 
GitLab


From bba0638f06263b04e5582ed0a5fd5ca3071e54fa Mon Sep 17 00:00:00 2001
From: Hanno Zulla <abos@hanno.de>
Date: Thu, 23 Aug 2018 17:03:38 +0200
Subject: [PATCH 0168/1835] HID: hid-bigbenff: driver for BigBen Interactive
 PS3OFMINIPAD gamepad

commit 256a90ed9e46b270bbc4e15ef05216ff049c3721 upstream.

This is a driver to fix input mapping and add LED & force feedback
support for the "BigBen Interactive Kid-friendly Wired Controller
PS3OFMINIPAD SONY" gamepad with USB id 146b:0902. It was originally
sold as a PS3 accessory and makes a very nice gamepad for Retropie.

Signed-off-by: Hanno Zulla <kontakt@hanno.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
 drivers/hid/Kconfig        |  13 ++
 drivers/hid/Makefile       |   1 +
 drivers/hid/hid-bigbenff.c | 414 +++++++++++++++++++++++++++++++++++++
 drivers/hid/hid-ids.h      |   3 +
 4 files changed, 431 insertions(+)
 create mode 100644 drivers/hid/hid-bigbenff.c

diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 61e1953ff9219..5a163f13663cf 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -182,6 +182,19 @@ config HID_BETOP_FF
 	Currently the following devices are known to be supported:
 	 - BETOP 2185 PC & BFM MODE
 
+config HID_BIGBEN_FF
+	tristate "BigBen Interactive Kids' gamepad support"
+	depends on USB_HID
+	depends on NEW_LEDS
+	depends on LEDS_CLASS
+	select INPUT_FF_MEMLESS
+	default !EXPERT
+	help
+	  Support for the "Kid-friendly Wired Controller" PS3OFMINIPAD
+	  gamepad made by BigBen Interactive, originally sold as a PS3
+	  accessory. This driver fixes input mapping and adds support for
+	  force feedback effects and LEDs on the device.
+
 config HID_CHERRY
 	tristate "Cherry Cymotion keyboard"
 	depends on HID
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index bd7ac53b75c56..896a51ce7ce01 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -31,6 +31,7 @@ obj-$(CONFIG_HID_ASUS)		+= hid-asus.o
 obj-$(CONFIG_HID_AUREAL)	+= hid-aureal.o
 obj-$(CONFIG_HID_BELKIN)	+= hid-belkin.o
 obj-$(CONFIG_HID_BETOP_FF)	+= hid-betopff.o
+obj-$(CONFIG_HID_BIGBEN_FF)	+= hid-bigbenff.o
 obj-$(CONFIG_HID_CHERRY)	+= hid-cherry.o
 obj-$(CONFIG_HID_CHICONY)	+= hid-chicony.o
 obj-$(CONFIG_HID_CMEDIA)	+= hid-cmedia.o
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
new file mode 100644
index 0000000000000..3f6abd190df43
--- /dev/null
+++ b/drivers/hid/hid-bigbenff.c
@@ -0,0 +1,414 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/*
+ *  LED & force feedback support for BigBen Interactive
+ *
+ *  0x146b:0x0902 "Bigben Interactive Bigben Game Pad"
+ *  "Kid-friendly Wired Controller" PS3OFMINIPAD SONY
+ *  sold for use with the PS3
+ *
+ *  Copyright (c) 2018 Hanno Zulla <kontakt@hanno.de>
+ */
+
+#include <linux/input.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/leds.h>
+#include <linux/hid.h>
+
+#include "hid-ids.h"
+
+
+/*
+ * The original descriptor for 0x146b:0x0902
+ *
+ *   0x05, 0x01,        // Usage Page (Generic Desktop Ctrls)
+ *   0x09, 0x05,        // Usage (Game Pad)
+ *   0xA1, 0x01,        // Collection (Application)
+ *   0x15, 0x00,        //   Logical Minimum (0)
+ *   0x25, 0x01,        //   Logical Maximum (1)
+ *   0x35, 0x00,        //   Physical Minimum (0)
+ *   0x45, 0x01,        //   Physical Maximum (1)
+ *   0x75, 0x01,        //   Report Size (1)
+ *   0x95, 0x0D,        //   Report Count (13)
+ *   0x05, 0x09,        //   Usage Page (Button)
+ *   0x19, 0x01,        //   Usage Minimum (0x01)
+ *   0x29, 0x0D,        //   Usage Maximum (0x0D)
+ *   0x81, 0x02,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
+ *   0x95, 0x03,        //   Report Count (3)
+ *   0x81, 0x01,        //   Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
+ *   0x05, 0x01,        //   Usage Page (Generic Desktop Ctrls)
+ *   0x25, 0x07,        //   Logical Maximum (7)
+ *   0x46, 0x3B, 0x01,  //   Physical Maximum (315)
+ *   0x75, 0x04,        //   Report Size (4)
+ *   0x95, 0x01,        //   Report Count (1)
+ *   0x65, 0x14,        //   Unit (System: English Rotation, Length: Centimeter)
+ *   0x09, 0x39,        //   Usage (Hat switch)
+ *   0x81, 0x42,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State)
+ *   0x65, 0x00,        //   Unit (None)
+ *   0x95, 0x01,        //   Report Count (1)
+ *   0x81, 0x01,        //   Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
+ *   0x26, 0xFF, 0x00,  //   Logical Maximum (255)
+ *   0x46, 0xFF, 0x00,  //   Physical Maximum (255)
+ *   0x09, 0x30,        //   Usage (X)
+ *   0x09, 0x31,        //   Usage (Y)
+ *   0x09, 0x32,        //   Usage (Z)
+ *   0x09, 0x35,        //   Usage (Rz)
+ *   0x75, 0x08,        //   Report Size (8)
+ *   0x95, 0x04,        //   Report Count (4)
+ *   0x81, 0x02,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
+ *   0x06, 0x00, 0xFF,  //   Usage Page (Vendor Defined 0xFF00)
+ *   0x09, 0x20,        //   Usage (0x20)
+ *   0x09, 0x21,        //   Usage (0x21)
+ *   0x09, 0x22,        //   Usage (0x22)
+ *   0x09, 0x23,        //   Usage (0x23)
+ *   0x09, 0x24,        //   Usage (0x24)
+ *   0x09, 0x25,        //   Usage (0x25)
+ *   0x09, 0x26,        //   Usage (0x26)
+ *   0x09, 0x27,        //   Usage (0x27)
+ *   0x09, 0x28,        //   Usage (0x28)
+ *   0x09, 0x29,        //   Usage (0x29)
+ *   0x09, 0x2A,        //   Usage (0x2A)
+ *   0x09, 0x2B,        //   Usage (0x2B)
+ *   0x95, 0x0C,        //   Report Count (12)
+ *   0x81, 0x02,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
+ *   0x0A, 0x21, 0x26,  //   Usage (0x2621)
+ *   0x95, 0x08,        //   Report Count (8)
+ *   0xB1, 0x02,        //   Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
+ *   0x0A, 0x21, 0x26,  //   Usage (0x2621)
+ *   0x91, 0x02,        //   Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
+ *   0x26, 0xFF, 0x03,  //   Logical Maximum (1023)
+ *   0x46, 0xFF, 0x03,  //   Physical Maximum (1023)
+ *   0x09, 0x2C,        //   Usage (0x2C)
+ *   0x09, 0x2D,        //   Usage (0x2D)
+ *   0x09, 0x2E,        //   Usage (0x2E)
+ *   0x09, 0x2F,        //   Usage (0x2F)
+ *   0x75, 0x10,        //   Report Size (16)
+ *   0x95, 0x04,        //   Report Count (4)
+ *   0x81, 0x02,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
+ *   0xC0,              // End Collection
+ */
+
+#define PID0902_RDESC_ORIG_SIZE 137
+
+/*
+ * The fixed descriptor for 0x146b:0x0902
+ *
+ * - map buttons according to gamepad.rst
+ * - assign right stick from Z/Rz to Rx/Ry
+ * - map previously unused analog trigger data to Z/RZ
+ * - simplify feature and output descriptor
+ */
+static __u8 pid0902_rdesc_fixed[] = {
+	0x05, 0x01,        /* Usage Page (Generic Desktop Ctrls) */
+	0x09, 0x05,        /* Usage (Game Pad) */
+	0xA1, 0x01,        /* Collection (Application) */
+	0x15, 0x00,        /*   Logical Minimum (0) */
+	0x25, 0x01,        /*   Logical Maximum (1) */
+	0x35, 0x00,        /*   Physical Minimum (0) */
+	0x45, 0x01,        /*   Physical Maximum (1) */
+	0x75, 0x01,        /*   Report Size (1) */
+	0x95, 0x0D,        /*   Report Count (13) */
+	0x05, 0x09,        /*   Usage Page (Button) */
+	0x09, 0x05,        /*   Usage (BTN_WEST) */
+	0x09, 0x01,        /*   Usage (BTN_SOUTH) */
+	0x09, 0x02,        /*   Usage (BTN_EAST) */
+	0x09, 0x04,        /*   Usage (BTN_NORTH) */
+	0x09, 0x07,        /*   Usage (BTN_TL) */
+	0x09, 0x08,        /*   Usage (BTN_TR) */
+	0x09, 0x09,        /*   Usage (BTN_TL2) */
+	0x09, 0x0A,        /*   Usage (BTN_TR2) */
+	0x09, 0x0B,        /*   Usage (BTN_SELECT) */
+	0x09, 0x0C,        /*   Usage (BTN_START) */
+	0x09, 0x0E,        /*   Usage (BTN_THUMBL) */
+	0x09, 0x0F,        /*   Usage (BTN_THUMBR) */
+	0x09, 0x0D,        /*   Usage (BTN_MODE) */
+	0x81, 0x02,        /*   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x75, 0x01,        /*   Report Size (1) */
+	0x95, 0x03,        /*   Report Count (3) */
+	0x81, 0x01,        /*   Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x05, 0x01,        /*   Usage Page (Generic Desktop Ctrls) */
+	0x25, 0x07,        /*   Logical Maximum (7) */
+	0x46, 0x3B, 0x01,  /*   Physical Maximum (315) */
+	0x75, 0x04,        /*   Report Size (4) */
+	0x95, 0x01,        /*   Report Count (1) */
+	0x65, 0x14,        /*   Unit (System: English Rotation, Length: Centimeter) */
+	0x09, 0x39,        /*   Usage (Hat switch) */
+	0x81, 0x42,        /*   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State) */
+	0x65, 0x00,        /*   Unit (None) */
+	0x95, 0x01,        /*   Report Count (1) */
+	0x81, 0x01,        /*   Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x26, 0xFF, 0x00,  /*   Logical Maximum (255) */
+	0x46, 0xFF, 0x00,  /*   Physical Maximum (255) */
+	0x09, 0x30,        /*   Usage (X) */
+	0x09, 0x31,        /*   Usage (Y) */
+	0x09, 0x33,        /*   Usage (Rx) */
+	0x09, 0x34,        /*   Usage (Ry) */
+	0x75, 0x08,        /*   Report Size (8) */
+	0x95, 0x04,        /*   Report Count (4) */
+	0x81, 0x02,        /*   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x95, 0x0A,        /*   Report Count (10) */
+	0x81, 0x01,        /*   Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x05, 0x01,        /*   Usage Page (Generic Desktop Ctrls) */
+	0x26, 0xFF, 0x00,  /*   Logical Maximum (255) */
+	0x46, 0xFF, 0x00,  /*   Physical Maximum (255) */
+	0x09, 0x32,        /*   Usage (Z) */
+	0x09, 0x35,        /*   Usage (Rz) */
+	0x95, 0x02,        /*   Report Count (2) */
+	0x81, 0x02,        /*   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x95, 0x08,        /*   Report Count (8) */
+	0x81, 0x01,        /*   Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0x06, 0x00, 0xFF,  /*   Usage Page (Vendor Defined 0xFF00) */
+	0xB1, 0x02,        /*   Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile) */
+	0x0A, 0x21, 0x26,  /*   Usage (0x2621) */
+	0x95, 0x08,        /*   Report Count (8) */
+	0x91, 0x02,        /*   Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile) */
+	0x0A, 0x21, 0x26,  /*   Usage (0x2621) */
+	0x95, 0x08,        /*   Report Count (8) */
+	0x81, 0x02,        /*   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+	0xC0,              /* End Collection */
+};
+
+#define NUM_LEDS 4
+
+struct bigben_device {
+	struct hid_device *hid;
+	struct hid_report *report;
+	u8 led_state;         /* LED1 = 1 .. LED4 = 8 */
+	u8 right_motor_on;    /* right motor off/on 0/1 */
+	u8 left_motor_force;  /* left motor force 0-255 */
+	struct led_classdev *leds[NUM_LEDS];
+	bool work_led;
+	bool work_ff;
+	struct work_struct worker;
+};
+
+
+static void bigben_worker(struct work_struct *work)
+{
+	struct bigben_device *bigben = container_of(work,
+		struct bigben_device, worker);
+	struct hid_field *report_field = bigben->report->field[0];
+
+	if (bigben->work_led) {
+		bigben->work_led = false;
+		report_field->value[0] = 0x01; /* 1 = led message */
+		report_field->value[1] = 0x08; /* reserved value, always 8 */
+		report_field->value[2] = bigben->led_state;
+		report_field->value[3] = 0x00; /* padding */
+		report_field->value[4] = 0x00; /* padding */
+		report_field->value[5] = 0x00; /* padding */
+		report_field->value[6] = 0x00; /* padding */
+		report_field->value[7] = 0x00; /* padding */
+		hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT);
+	}
+
+	if (bigben->work_ff) {
+		bigben->work_ff = false;
+		report_field->value[0] = 0x02; /* 2 = rumble effect message */
+		report_field->value[1] = 0x08; /* reserved value, always 8 */
+		report_field->value[2] = bigben->right_motor_on;
+		report_field->value[3] = bigben->left_motor_force;
+		report_field->value[4] = 0xff; /* duration 0-254 (255 = nonstop) */
+		report_field->value[5] = 0x00; /* padding */
+		report_field->value[6] = 0x00; /* padding */
+		report_field->value[7] = 0x00; /* padding */
+		hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT);
+	}
+}
+
+static int hid_bigben_play_effect(struct input_dev *dev, void *data,
+			 struct ff_effect *effect)
+{
+	struct bigben_device *bigben = data;
+	u8 right_motor_on;
+	u8 left_motor_force;
+
+	if (effect->type != FF_RUMBLE)
+		return 0;
+
+	right_motor_on   = effect->u.rumble.weak_magnitude ? 1 : 0;
+	left_motor_force = effect->u.rumble.strong_magnitude / 256;
+
+	if (right_motor_on != bigben->right_motor_on ||
+			left_motor_force != bigben->left_motor_force) {
+		bigben->right_motor_on   = right_motor_on;
+		bigben->left_motor_force = left_motor_force;
+		bigben->work_ff = true;
+		schedule_work(&bigben->worker);
+	}
+
+	return 0;
+}
+
+static void bigben_set_led(struct led_classdev *led,
+	enum led_brightness value)
+{
+	struct device *dev = led->dev->parent;
+	struct hid_device *hid = to_hid_device(dev);
+	struct bigben_device *bigben = hid_get_drvdata(hid);
+	int n;
+	bool work;
+
+	if (!bigben) {
+		hid_err(hid, "no device data\n");
+		return;
+	}
+
+	for (n = 0; n < NUM_LEDS; n++) {
+		if (led == bigben->leds[n]) {
+			if (value == LED_OFF) {
+				work = (bigben->led_state & BIT(n));
+				bigben->led_state &= ~BIT(n);
+			} else {
+				work = !(bigben->led_state & BIT(n));
+				bigben->led_state |= BIT(n);
+			}
+
+			if (work) {
+				bigben->work_led = true;
+				schedule_work(&bigben->worker);
+			}
+			return;
+		}
+	}
+}
+
+static enum led_brightness bigben_get_led(struct led_classdev *led)
+{
+	struct device *dev = led->dev->parent;
+	struct hid_device *hid = to_hid_device(dev);
+	struct bigben_device *bigben = hid_get_drvdata(hid);
+	int n;
+
+	if (!bigben) {
+		hid_err(hid, "no device data\n");
+		return LED_OFF;
+	}
+
+	for (n = 0; n < NUM_LEDS; n++) {
+		if (led == bigben->leds[n])
+			return (bigben->led_state & BIT(n)) ? LED_ON : LED_OFF;
+	}
+
+	return LED_OFF;
+}
+
+static void bigben_remove(struct hid_device *hid)
+{
+	struct bigben_device *bigben = hid_get_drvdata(hid);
+
+	cancel_work_sync(&bigben->worker);
+	hid_hw_close(hid);
+	hid_hw_stop(hid);
+}
+
+static int bigben_probe(struct hid_device *hid,
+	const struct hid_device_id *id)
+{
+	struct bigben_device *bigben;
+	struct hid_input *hidinput;
+	struct list_head *report_list;
+	struct led_classdev *led;
+	char *name;
+	size_t name_sz;
+	int n, error;
+
+	bigben = devm_kzalloc(&hid->dev, sizeof(*bigben), GFP_KERNEL);
+	if (!bigben)
+		return -ENOMEM;
+	hid_set_drvdata(hid, bigben);
+	bigben->hid = hid;
+
+	error = hid_parse(hid);
+	if (error) {
+		hid_err(hid, "parse failed\n");
+		return error;
+	}
+
+	error = hid_hw_start(hid, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF);
+	if (error) {
+		hid_err(hid, "hw start failed\n");
+		return error;
+	}
+
+	report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+	bigben->report = list_entry(report_list->next,
+		struct hid_report, list);
+
+	hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+	set_bit(FF_RUMBLE, hidinput->input->ffbit);
+
+	INIT_WORK(&bigben->worker, bigben_worker);
+
+	error = input_ff_create_memless(hidinput->input, bigben,
+		hid_bigben_play_effect);
+	if (error)
+		return error;
+
+	name_sz = strlen(dev_name(&hid->dev)) + strlen(":red:bigben#") + 1;
+
+	for (n = 0; n < NUM_LEDS; n++) {
+		led = devm_kzalloc(
+			&hid->dev,
+			sizeof(struct led_classdev) + name_sz,
+			GFP_KERNEL
+		);
+		if (!led)
+			return -ENOMEM;
+		name = (void *)(&led[1]);
+		snprintf(name, name_sz,
+			"%s:red:bigben%d",
+			dev_name(&hid->dev), n + 1
+		);
+		led->name = name;
+		led->brightness = (n == 0) ? LED_ON : LED_OFF;
+		led->max_brightness = 1;
+		led->brightness_get = bigben_get_led;
+		led->brightness_set = bigben_set_led;
+		bigben->leds[n] = led;
+		error = devm_led_classdev_register(&hid->dev, led);
+		if (error)
+			return error;
+	}
+
+	/* initial state: LED1 is on, no rumble effect */
+	bigben->led_state = BIT(0);
+	bigben->right_motor_on = 0;
+	bigben->left_motor_force = 0;
+	bigben->work_led = true;
+	bigben->work_ff = true;
+	schedule_work(&bigben->worker);
+
+	hid_info(hid, "LED and force feedback support for BigBen gamepad\n");
+
+	return 0;
+}
+
+static __u8 *bigben_report_fixup(struct hid_device *hid, __u8 *rdesc,
+	unsigned int *rsize)
+{
+	if (*rsize == PID0902_RDESC_ORIG_SIZE) {
+		rdesc = pid0902_rdesc_fixed;
+		*rsize = sizeof(pid0902_rdesc_fixed);
+	} else
+		hid_warn(hid, "unexpected rdesc, please submit for review\n");
+	return rdesc;
+}
+
+static const struct hid_device_id bigben_devices[] = {
+	{ HID_USB_DEVICE(USB_VENDOR_ID_BIGBEN, USB_DEVICE_ID_BIGBEN_PS3OFMINIPAD) },
+	{ }
+};
+MODULE_DEVICE_TABLE(hid, bigben_devices);
+
+static struct hid_driver bigben_driver = {
+	.name = "bigben",
+	.id_table = bigben_devices,
+	.probe = bigben_probe,
+	.report_fixup = bigben_report_fixup,
+	.remove = bigben_remove,
+};
+module_hid_driver(bigben_driver);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 97d33b8ed36ca..0a95700a302a3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -232,6 +232,9 @@
 #define USB_VENDOR_ID_BETOP_2185V2PC	0x8380
 #define USB_VENDOR_ID_BETOP_2185V2BFM	0x20bc
 
+#define USB_VENDOR_ID_BIGBEN	0x146b
+#define USB_DEVICE_ID_BIGBEN_PS3OFMINIPAD	0x0902
+
 #define USB_VENDOR_ID_BTC		0x046e
 #define USB_DEVICE_ID_BTC_EMPREX_REMOTE	0x5578
 #define USB_DEVICE_ID_BTC_EMPREX_REMOTE_2	0x5577
-- 
GitLab


From 06518e55552c5a2841ee7b2d0d366e4122c62968 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 24 Sep 2018 14:56:58 +0100
Subject: [PATCH 0169/1835] configs: Add CONFIG_HID_BIGBEN_FF=m

See: https://github.com/raspberrypi/linux/issues/2690

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 4eaa666c84973..2f4d08ac6a05f 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -938,6 +938,7 @@ CONFIG_HID_APPLE=m
 CONFIG_HID_ASUS=m
 CONFIG_HID_BELKIN=m
 CONFIG_HID_BETOP_FF=m
+CONFIG_HID_BIGBEN_FF=m
 CONFIG_HID_CHERRY=m
 CONFIG_HID_CHICONY=m
 CONFIG_HID_CYPRESS=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index cf4c81f975a89..ada667342bfba 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -931,6 +931,7 @@ CONFIG_HID_APPLE=m
 CONFIG_HID_ASUS=m
 CONFIG_HID_BELKIN=m
 CONFIG_HID_BETOP_FF=m
+CONFIG_HID_BIGBEN_FF=m
 CONFIG_HID_CHERRY=m
 CONFIG_HID_CHICONY=m
 CONFIG_HID_CYPRESS=m
-- 
GitLab


From 69fcd053c4a50562692476485626479be4aa3830 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Fri, 28 Sep 2018 15:13:28 +1000
Subject: [PATCH 0170/1835] ASoC: cs4265: Add a MIC pre. route (#2696)

Commit 	b0ef5011b981ece1fde8063243a56d3038b87adb upstream.

The cs4265 driver is missing a microphone preamp enable.
This patch enables/disables the microphone preamp when mic
selection is made using the kcontrol.

Signed-off-by: Matt Flax <flatmax@flatmax.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/cs4265.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
index 6d0843386948b..198ae46ebe9b3 100644
--- a/sound/soc/codecs/cs4265.c
+++ b/sound/soc/codecs/cs4265.c
@@ -222,10 +222,11 @@ static const struct snd_soc_dapm_route cs4265_audio_map[] = {
 	{"LINEOUTR", NULL, "DAC"},
 	{"SPDIFOUT", NULL, "SPDIF"},
 
+	{"Pre-amp MIC", NULL, "MICL"},
+	{"Pre-amp MIC", NULL, "MICR"},
+	{"ADC Mux", "MIC", "Pre-amp MIC"},
 	{"ADC Mux", "LINEIN", "LINEINL"},
 	{"ADC Mux", "LINEIN", "LINEINR"},
-	{"ADC Mux", "MIC", "MICL"},
-	{"ADC Mux", "MIC", "MICR"},
 	{"ADC", NULL, "ADC Mux"},
 	{"DOUT", NULL, "ADC"},
 	{"DAI1 Capture", NULL, "DOUT"},
-- 
GitLab


From 67689145033ecb5afa74bfb525b1b16ec62823a4 Mon Sep 17 00:00:00 2001
From: Paul <paulenuta@users.noreply.github.com>
Date: Thu, 11 Oct 2018 12:17:20 +0300
Subject: [PATCH 0171/1835] Update gpio-fan-overlay.dts (#2711)

Add references, links, clear details, some typo correction.
---
 .../boot/dts/overlays/gpio-fan-overlay.dts    | 36 +++++++++++--------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
index 66fd9950c34be..d9b8b87d9c12d 100644
--- a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
@@ -1,29 +1,37 @@
 /*
  * Overlay for the Raspberry Pi GPIO Fan @ BCM GPIO12.
+ * References: 
+ *	- https://www.raspberrypi.org/forums/viewtopic.php?f=107&p=1367135#p1365084
+ *
  * Optional parameters:
- *	- "gpiopin"	- default GPIO12
- * 	- "temp"	- default 55000
+ *	- "gpiopin"	- BCM number of the pin driving the fan, default 12 (GPIO12);
+ * 	- "temp"	- CPU temperature at which fan is started in millicelsius, default 55000;
+ *
  * Requires:
- *	- kernel configurations: CONFIG_SENSORS_GPIO_FAN=m and CONFIG_SENSORS_PWM_FAN=m;
- *	- kernel rebuid;
- *	- DC Fan connected to GPIO via a N-MOSFET (2N7002)
+ *	- kernel configurations: CONFIG_SENSORS_GPIO_FAN=m;
+ *	- kernel rebuild;
+ *	- N-MOSFET connected to gpiopin, 2N7002-[https://en.wikipedia.org/wiki/2N7000];
+ *	- DC Fan connected to N-MOSFET Drain terminal, a 12V fan is working fine and quite silently;
+ *	  [https://www.tme.eu/en/details/ee40101s1-999-a/dc12v-fans/sunon/ee40101s1-1000u-999/]
  *
  *                   ┌─────────────────────┐
  *                   │Fan negative terminal│
  *                   └┬────────────────────┘
- *                    │
- *                 │──┘
+ *                    │D
+ *             G   │──┘
  * [GPIO12]──────┤ │<─┐  2N7002
  *                 │──┤
- *                    │
+ *                    │S
  *                   ─┴─
  *                   GND
  *
- * sudo dtc -W no-unit_address_vs_reg -@ -I dts -O dtb -o /boot/overlays/gpio-fan.dtbo gpio-fan.dts
- * sudo nano /boot/config.txt add "dtoverlay=gpio-fan" or "dtoverlay=gpio-fan,gpiopin=12,temp=45000"
- * or
- * sudo sh -c "echo '\n# Enable PI GPIO-Fan\ndtoverlay=gpio-fan\n' >> /boot/config.txt"
- * sudo sh -c "echo '\n# Enable PI GPIO-Fan\ndtoverlay=gpio-fan,gpiopin=12\n' >> /boot/config.txt"
+ * Build:
+ * 	- `sudo dtc -W no-unit_address_vs_reg -@ -I dts -O dtb -o /boot/overlays/gpio-fan.dtbo gpio-fan-overlay.dts`
+ * Activate:
+ *	- sudo nano /boot/config.txt add "dtoverlay=gpio-fan" or "dtoverlay=gpio-fan,gpiopin=12,temp=45000"
+ *	 or
+ *	- sudo sh -c 'printf "\n# Enable PI GPIO-Fan Default\ndtoverlay=gpio-fan\n" >> /boot/config.txt'
+ *	- sudo sh -c 'printf "\n# Enable PI GPIO-Fan Custom\ntoverlay=gpio-fan,gpiopin=12,temp=45000\n" >> /boot/config.txt'
  *
  */
 /dts-v1/;
@@ -52,7 +60,7 @@
 			trips {
 				cpu_hot: trip-point@0 {
 					temperature = <55000>;	/* (millicelsius) Fan started at 55°C */
-					hysteresis = <5000>;	/* (millicelsius) Fan stopped at 50°C */
+					hysteresis = <10000>;	/* (millicelsius) Fan stopped at 45°C */
 					type = "active";
 				};
 			};
-- 
GitLab


From c5727e70ef5355115a14cc8a1218e3cf84b8fcc7 Mon Sep 17 00:00:00 2001
From: Ram Chandrasekar <rkumbako@codeaurora.org>
Date: Mon, 7 May 2018 11:54:08 -0600
Subject: [PATCH 0172/1835] drivers: thermal: step_wise: add support for
 hysteresis

From: Ram Chandrasekar <rkumbako@codeaurora.org>

Step wise governor increases the mitigation level when the temperature
goes above a threshold and will decrease the mitigation when the
temperature falls below the threshold. If it were a case, where the
temperature hovers around a threshold, the mitigation will be applied
and removed at every iteration. This reaction to the temperature is
inefficient for performance.

The use of hysteresis temperature could avoid this ping-pong of
mitigation by relaxing the mitigation to happen only when the
temperature goes below this lower hysteresis value.

Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
Signed-off-by: Lina Iyer <ilina@codeaurora.org>
---
 drivers/thermal/step_wise.c | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
index ee047ca43084d..cf07e22692913 100644
--- a/drivers/thermal/step_wise.c
+++ b/drivers/thermal/step_wise.c
@@ -36,7 +36,7 @@
  *       for this trip point
  *    d. if the trend is THERMAL_TREND_DROP_FULL, use lower limit
  *       for this trip point
- * If the temperature is lower than a trip point,
+ * If the temperature is lower than a hysteresis temperature,
  *    a. if the trend is THERMAL_TREND_RAISING, do nothing
  *    b. if the trend is THERMAL_TREND_DROPPING, use lower cooling
  *       state for this trip point, if the cooling state already
@@ -127,7 +127,7 @@ static void update_passive_instance(struct thermal_zone_device *tz,
 
 static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 {
-	int trip_temp;
+	int trip_temp, hyst_temp;
 	enum thermal_trip_type trip_type;
 	enum thermal_trend trend;
 	struct thermal_instance *instance;
@@ -135,22 +135,23 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 	int old_target;
 
 	if (trip == THERMAL_TRIPS_NONE) {
-		trip_temp = tz->forced_passive;
+		hyst_temp = trip_temp = tz->forced_passive;
 		trip_type = THERMAL_TRIPS_NONE;
 	} else {
 		tz->ops->get_trip_temp(tz, trip, &trip_temp);
+		hyst_temp = trip_temp;
+		if (tz->ops->get_trip_hyst) {
+			tz->ops->get_trip_hyst(tz, trip, &hyst_temp);
+			hyst_temp = trip_temp - hyst_temp;
+		}
 		tz->ops->get_trip_type(tz, trip, &trip_type);
 	}
 
 	trend = get_tz_trend(tz, trip);
 
-	if (tz->temperature >= trip_temp) {
-		throttle = true;
-		trace_thermal_zone_trip(tz, trip, trip_type);
-	}
-
-	dev_dbg(&tz->device, "Trip%d[type=%d,temp=%d]:trend=%d,throttle=%d\n",
-				trip, trip_type, trip_temp, trend, throttle);
+	dev_dbg(&tz->device,
+		"Trip%d[type=%d,temp=%d,hyst=%d]:trend=%d,throttle=%d\n",
+		trip, trip_type, trip_temp, hyst_temp, trend, throttle);
 
 	mutex_lock(&tz->lock);
 
@@ -159,6 +160,18 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 			continue;
 
 		old_target = instance->target;
+		throttle = false;
+		/*
+		 * Lower the mitigation only if the temperature
+		 * goes below the hysteresis temperature.
+		 */
+		if (tz->temperature >= trip_temp ||
+		   (tz->temperature >= hyst_temp &&
+		   old_target != THERMAL_NO_TARGET)) {
+			throttle = true;
+			trace_thermal_zone_trip(tz, trip, trip_type);
+		}
+
 		instance->target = get_target_state(instance, trend, throttle);
 		dev_dbg(&instance->cdev->device, "old_target=%d, target=%d\n",
 					old_target, (int)instance->target);
-- 
GitLab


From d610da54acac22080904854ecdd30050f20f4e50 Mon Sep 17 00:00:00 2001
From: Serge Schneider <serge@raspberrypi.org>
Date: Tue, 2 Oct 2018 11:14:15 +0100
Subject: [PATCH 0173/1835] drivers: thermal: step_wise: avoid throttling at
 hysteresis temperature after dropping below it

Signed-off-by: Serge Schneider <serge@raspberrypi.org>
---
 drivers/thermal/step_wise.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
index cf07e22692913..da695d8f29390 100644
--- a/drivers/thermal/step_wise.c
+++ b/drivers/thermal/step_wise.c
@@ -167,7 +167,7 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 		 */
 		if (tz->temperature >= trip_temp ||
 		   (tz->temperature >= hyst_temp &&
-		   old_target != THERMAL_NO_TARGET)) {
+		   old_target == instance->upper)) {
 			throttle = true;
 			trace_thermal_zone_trip(tz, trip, trip_type);
 		}
-- 
GitLab


From c5600f29293d68197ae489547993605020f76811 Mon Sep 17 00:00:00 2001
From: Serge Schneider <serge@raspberrypi.org>
Date: Wed, 26 Sep 2018 19:44:59 +0100
Subject: [PATCH 0174/1835] hwmon: adjust rpi-poe-fan overlay trip points

Signed-off-by: Serge Schneider <serge@raspberrypi.org>
---
 .../arm/boot/dts/overlays/rpi-poe-overlay.dts | 26 +++++++------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
index 0a32fff036a7c..f24af60f1593a 100644
--- a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
@@ -14,9 +14,9 @@
 				compatible = "raspberrypi,rpi-poe-fan";
 				firmware = <&firmware>;
 				cooling-min-state = <0>;
-				cooling-max-state = <3>;
+				cooling-max-state = <2>;
 				#cooling-cells = <2>;
-				cooling-levels = <0 50 150 255>;
+				cooling-levels = <0 150 255>;
 				status = "okay";
 			};
 		};
@@ -26,35 +26,27 @@
 		target = <&cpu_thermal>;
 		__overlay__ {
 			trips {
-				threshold: trip-point@0 {
-					temperature = <45000>;
-					hysteresis = <5000>;
-					type = "active";
-				};
-				target: trip-point@1 {
+				trip0: trip0 {
 					temperature = <50000>;
-					hysteresis = <2000>;
+					hysteresis = <5000>;
 					type = "active";
 				};
-				cpu_hot: cpu_hot@0 {
+				trip1: trip1 {
+
 					temperature = <55000>;
-					hysteresis = <2000>;
+					hysteresis = <5000>;
 					type = "active";
 				};
 			};
 			cooling-maps {
 				map0 {
-					trip = <&threshold>;
+					trip = <&trip0>;
 					cooling-device = <&fan0 0 1>;
 				};
 				map1 {
-					trip = <&target>;
+					trip = <&trip1>;
 					cooling-device = <&fan0 1 2>;
 				};
-				map2 {
-					trip = <&cpu_hot>;
-					cooling-device = <&fan0 2 3>;
-				};
 			};
 		};
 	};
-- 
GitLab


From 7b7341e38d42cb823a20a50072295e5ce528ad93 Mon Sep 17 00:00:00 2001
From: Serge Schneider <serge@raspberrypi.org>
Date: Tue, 2 Oct 2018 17:13:48 +0100
Subject: [PATCH 0175/1835] overlays: add overrides for PoE HAT fan control

Signed-off-by: Serge Schneider <serge@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README              | 13 ++++++++++---
 arch/arm/boot/dts/overlays/rpi-poe-overlay.dts | 10 ++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 018dc5dd8f1e6..ab70c054ac15d 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1565,9 +1565,16 @@ Params: touchscreen-size-x      Touchscreen X resolution (default 800)
 
 
 Name:   rpi-poe
-Info:   Raspberry Pi POE HAT
-Load:   dtoverlay=rpi-poe
-Params: <None>
+Info:   Raspberry Pi PoE HAT fan
+Load:   dtoverlay=rpi-poe,<param>[=<val>]
+Params: poe_fan_temp0           Temperature (in millicelcius) at which the fan
+                                turns on (default 50000)
+        poe_fan_temp0_hyst      Temperature delta (in millicelcius) at which
+                                the fan turns off (default 5000)
+        poe_fan_temp1           Temperature (in millicelcius) at which the fan
+                                speeds up (default 55000)
+        poe_fan_temp1_hyst      Temperature delta (in millicelcius) at which
+                                the fan slows down (default 5000)
 
 
 Name:   rpi-proto
diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
index f24af60f1593a..1dacd3b33085c 100644
--- a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
@@ -50,4 +50,14 @@
 			};
 		};
 	};
+
+	fragment@2 {
+		target-path = "/__overrides__";
+		__overlay__ {
+			poe_fan_temp0 =		<&trip0>,"temperature:0";
+			poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
+			poe_fan_temp1 =		<&trip1>,"temperature:0";
+			poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
+		};
+	};
 };
-- 
GitLab


From 6618707bfbed1e86b82b7985032cbdaaf36652fa Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 18 Jul 2018 17:25:00 +0100
Subject: [PATCH 0176/1835] overlays: Add gpio-no-bank0-irq overlay

See: https://github.com/raspberrypi/linux/issues/2590

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile                |  1 +
 arch/arm/boot/dts/overlays/README                  |  9 +++++++++
 .../dts/overlays/gpio-no-bank0-irq-overlay.dts     | 14 ++++++++++++++
 3 files changed, 24 insertions(+)
 create mode 100755 arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 99338350fc510..bcfde487ea1a8 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -37,6 +37,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	gpio-ir.dtbo \
 	gpio-ir-tx.dtbo \
 	gpio-key.dtbo \
+	gpio-no-bank0-irq.dtbo \
 	gpio-no-irq.dtbo \
 	gpio-poweroff.dtbo \
 	gpio-shutdown.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index ab70c054ac15d..fda97eb4c1dc8 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -597,6 +597,15 @@ Params: gpio                    GPIO pin to trigger on (default 3)
         keycode                 Set the key code for the button
 
 
+Name:   gpio-no-bank0-irq
+Info:   Use this overlay to disable GPIO interrupts for GPIOs in bank 0 (0-27),
+        which can be useful for UIO drivers.
+        N.B. Using this overlay will trigger a kernel WARN during booting, but
+        this can safely be ignored - the system should work as expected.
+Load:   dtoverlay=gpio-no-bank0-irq
+Params: <None>
+
+
 Name:   gpio-no-irq
 Info:   Use this overlay to disable all GPIO interrupts, which can be useful
         for user-space GPIO edge detection systems.
diff --git a/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts b/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
new file mode 100755
index 0000000000000..96cbe80820b72
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-no-bank0-irq-overlay.dts
@@ -0,0 +1,14 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		// Configure the gpio pin controller
+		target = <&gpio>;
+		__overlay__ {
+			    interrupts = <255 255>, <2 18>;
+		};
+	};
+};
-- 
GitLab


From b12553cd3e8b91da6be9b335d96444d7175cd766 Mon Sep 17 00:00:00 2001
From: Hans-Wilhelm Warlo <5417271+hanswilw@users.noreply.github.com>
Date: Tue, 16 Oct 2018 18:20:48 +0200
Subject: [PATCH 0177/1835] Add hy28b 2017 model device tree overlay (#2721)

The 2017 version of the hy28b display requires a different
initialisation sequence.

Signed-off-by: Hans-Wilhelm Warlo <hw@warlo.no>
---
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |  19 +++
 .../boot/dts/overlays/hy28b-2017-overlay.dts  | 152 ++++++++++++++++++
 3 files changed, 172 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index bcfde487ea1a8..3cdea5b072bfc 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -49,6 +49,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	hifiberry-digi-pro.dtbo \
 	hy28a.dtbo \
 	hy28b.dtbo \
+	hy28b-2017.dtbo \
 	i2c-bcm2708.dtbo \
 	i2c-gpio.dtbo \
 	i2c-mux.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index fda97eb4c1dc8..32f100f568dc8 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -770,6 +770,25 @@ Params: speed                   Display SPI bus speed
         ledgpio                 GPIO used to control backlight
 
 
+Name:   hy28b-2017
+Info:   HY28B 2017 version - 2.8" TFT LCD Display Module by HAOYU Electronics
+        Default values match Texy's display shield
+Load:   dtoverlay=hy28b-2017,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+        resetgpio               GPIO used to reset controller
+
+        ledgpio                 GPIO used to control backlight
+
+
 Name:   i2c-bcm2708
 Info:   Fall back to the i2c_bcm2708 driver for the i2c_arm bus.
 Load:   dtoverlay=i2c-bcm2708
diff --git a/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
new file mode 100644
index 0000000000000..b4664aad72533
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
@@ -0,0 +1,152 @@
+/*
+ * Device Tree overlay for HY28b display shield by Texy.
+ * Modified for 2017 version with ILI9325 D chip
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			hy28b_pins: hy28b_pins {
+				brcm,pins = <17 25 18>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hy28b: hy28b@0{
+				compatible = "ilitek,ili9325";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&hy28b_pins>;
+
+				spi-max-frequency = <48000000>;
+				spi-cpol;
+				spi-cpha;
+				rotate = <270>;
+				bgr;
+				fps = <50>;
+				buswidth = <8>;
+				startbyte = <0x70>;
+				reset-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 1>;
+
+				init = <0x10000e5 0x78F0
+					0x1000001 0x0100
+					0x1000002 0x0700
+				        0x1000003 0x1030
+					0x1000004 0x0000
+					0x1000008 0x0207
+					0x1000009 0x0000
+				        0x100000a 0x0000
+					0x100000c 0x0000
+					0x100000d 0x0000
+					0x100000f 0x0000
+				        0x1000010 0x0000
+					0x1000011 0x0007
+					0x1000012 0x0000
+					0x1000013 0x0000
+					0x1000007 0x0001
+				        0x2000032
+				        0x2000032
+				        0x2000032
+				        0x2000032
+					0x1000010 0x1090
+					0x1000011 0x0227
+				        0x2000032
+					0x1000012 0x001f
+				        0x2000032
+				        0x1000013 0x1500
+					0x1000029 0x0027
+					0x100002b 0x000d
+				        0x2000032
+				        0x1000020 0x0000
+					0x1000021 0x0000
+				        0x2000032
+					0x1000030 0x0000
+					0x1000031 0x0707
+					0x1000032 0x0307
+					0x1000035 0x0200
+					0x1000036 0x0008
+					0x1000037 0x0004
+					0x1000038 0x0000
+					0x1000039 0x0707
+					0x100003c 0x0002
+					0x100003d 0x1d04
+					0x1000050 0x0000
+				        0x1000051 0x00ef
+					0x1000052 0x0000
+					0x1000053 0x013f
+					0x1000060 0xa700
+				        0x1000061 0x0001
+					0x100006a 0x0000
+					0x1000080 0x0000
+					0x1000081 0x0000
+				        0x1000082 0x0000
+					0x1000083 0x0000
+					0x1000084 0x0000
+					0x1000085 0x0000
+				        0x1000090 0x0010
+					0x1000092 0x0600
+					0x1000007 0x0133>;
+				debug = <0>;
+			};
+
+			hy28b_ts: hy28b-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed = 	<&hy28b>,"spi-max-frequency:0";
+		rotate = 	<&hy28b>,"rotate:0";
+		fps = 		<&hy28b>,"fps:0";
+		debug = 	<&hy28b>,"debug:0";
+		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
+		resetgpio =	<&hy28b>,"reset-gpios:4",
+				<&hy28b_pins>, "brcm,pins:4";
+		ledgpio =	<&hy28b>,"led-gpios:4",
+				<&hy28b_pins>, "brcm,pins:8";
+	};
+};
-- 
GitLab


From a4a0a8afd6eb32cc422acf03cd023ae526394b52 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Thu, 25 Oct 2018 14:08:43 +0100
Subject: [PATCH 0178/1835] config: Add CONFIG_USBIP_VUDC

See: https://github.com/raspberrypi/firmware/issues/353
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 2f4d08ac6a05f..acb05e74fcf62 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1013,6 +1013,7 @@ CONFIG_USB_MICROTEK=m
 CONFIG_USBIP_CORE=m
 CONFIG_USBIP_VHCI_HCD=m
 CONFIG_USBIP_HOST=m
+CONFIG_USBIP_VUDC=m
 CONFIG_USB_DWC2=m
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index ada667342bfba..9374a682a7669 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1006,6 +1006,7 @@ CONFIG_USB_MICROTEK=m
 CONFIG_USBIP_CORE=m
 CONFIG_USBIP_VHCI_HCD=m
 CONFIG_USBIP_HOST=m
+CONFIG_USBIP_VUDC=m
 CONFIG_USB_DWC2=m
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
-- 
GitLab


From da070cf562fb310c3e5714693ba13cbdde981983 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 26 Oct 2018 17:29:51 +0100
Subject: [PATCH 0179/1835] mmc/bcm2835-sdhost: Recover from MMC_SEND_EXT_CSD

If the user issues an "mmc extcsd read", the SD controller receives
what it thinks is a SEND_IF_COND command with an unexpected data block.
The resulting operations leave the FSM stuck in READWAIT, a state which
persists until the MMC framework resets the controller, by which point
the root filesystem is likely to have been unmounted.

A less heavyweight solution is to detect the condition and nudge the
FSM by asserting the (self-clearing) FORCE_DATA_MODE bit.

N.B. This workaround was essentially discovered by accident and without
a full understanding the inner workings of the controller, so it is
fortunate that the "fix" only modifies error paths.

See: https://github.com/raspberrypi/linux/issues/2728

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/bcm2835-sdhost.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
index 34ae2be3647f7..449194d3c2716 100644
--- a/drivers/mmc/host/bcm2835-sdhost.c
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -1244,6 +1244,8 @@ static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
 				pr_info("%s: ignoring CRC7 error for CMD1\n",
 					mmc_hostname(host->mmc));
 		} else {
+			u32 edm, fsm;
+
 			if (sdhsts & SDHSTS_CMD_TIME_OUT) {
 				if (host->debug)
 					pr_warn("%s: command %d timeout\n",
@@ -1256,6 +1258,13 @@ static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
 				       host->cmd->opcode);
 				host->cmd->error = -EILSEQ;
 			}
+
+			edm = readl(host->ioaddr + SDEDM);
+			fsm = edm & SDEDM_FSM_MASK;
+			if (fsm == SDEDM_FSM_READWAIT ||
+			    fsm == SDEDM_FSM_WRITESTART1)
+				writel(edm | SDEDM_FORCE_DATA_MODE,
+				       host->ioaddr + SDEDM);
 			tasklet_schedule(&host->finish_tasklet);
 			return;
 		}
-- 
GitLab


From 1c0d566d5d602cd2d4f6aa603762576e453b9738 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 29 Oct 2018 10:38:31 +0000
Subject: [PATCH 0180/1835] overlays: pi3-disable-bt: Clear out bt_pins node

The pi3-disable-bt overlay does not (and cannot) delete the bt_pins
node, but emptying its properties (including brcm,pins) is a way of
signalling to the hciuart systemd service that Bluetooth has been
disabled.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
index 87cf345f9641e..975b5ee044bc7 100644
--- a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
@@ -37,6 +37,15 @@
 	};
 
 	fragment@3 {
+		target = <&bt_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@4 {
 		target-path = "/aliases";
 		__overlay__ {
 			serial0 = "/soc/serial@7e201000";
-- 
GitLab


From 3a983df529d6327347fa46e5eef4446f39047ffe Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 29 Oct 2018 14:45:45 +0000
Subject: [PATCH 0181/1835] Revert "rtc: pcf8523: properly handle oscillator
 stop bit"

This reverts commit ede44c908d44b166a5b6bd7caacd105c2ff5a70f.

See: https://github.com/raspberrypi/firmware/issues/1065

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/rtc/rtc-pcf8523.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c
index 453615f8ac9a0..ba2b04d9711e6 100644
--- a/drivers/rtc/rtc-pcf8523.c
+++ b/drivers/rtc/rtc-pcf8523.c
@@ -181,8 +181,28 @@ static int pcf8523_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	if (err < 0)
 		return err;
 
-	if (regs[0] & REG_SECONDS_OS)
-		return -EINVAL;
+	if (regs[0] & REG_SECONDS_OS) {
+		/*
+		 * If the oscillator was stopped, try to clear the flag. Upon
+		 * power-up the flag is always set, but if we cannot clear it
+		 * the oscillator isn't running properly for some reason. The
+		 * sensible thing therefore is to return an error, signalling
+		 * that the clock cannot be assumed to be correct.
+		 */
+
+		regs[0] &= ~REG_SECONDS_OS;
+
+		err = pcf8523_write(client, REG_SECONDS, regs[0]);
+		if (err < 0)
+			return err;
+
+		err = pcf8523_read(client, REG_SECONDS, &regs[0]);
+		if (err < 0)
+			return err;
+
+		if (regs[0] & REG_SECONDS_OS)
+			return -EAGAIN;
+	}
 
 	tm->tm_sec = bcd2bin(regs[0] & 0x7f);
 	tm->tm_min = bcd2bin(regs[1] & 0x7f);
@@ -218,7 +238,6 @@ static int pcf8523_rtc_set_time(struct device *dev, struct rtc_time *tm)
 		return err;
 
 	regs[0] = REG_SECONDS;
-	/* This will purposely overwrite REG_SECONDS_OS */
 	regs[1] = bin2bcd(tm->tm_sec);
 	regs[2] = bin2bcd(tm->tm_min);
 	regs[3] = bin2bcd(tm->tm_hour);
-- 
GitLab


From 11ee860a338c8e8bf154f65e79b699eb7b803540 Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Fri, 2 Nov 2018 11:55:49 +0000
Subject: [PATCH 0182/1835] Update issue templates (#2736)

---
 .github/ISSUE_TEMPLATE/bug_report.md | 34 ++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
new file mode 100644
index 0000000000000..09bdc4a968383
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,34 @@
+---
+name: Bug report
+about: Create a report to help us fix your issue
+
+---
+
+**Is this the right place for my bug report?**
+This repository contains the Linux kernel used on the Raspberry Pi. If you believe that the issue you are seeing is kernel-related, this is the right place. If not, we have other repositories for the GPU firmware at [github.com/raspberrypi/firmware](https://github.com/raspberrypi/firmware) and Raspberry Pi userland applications at [github.com/raspberrypi/userland](https://github.com/raspberrypi/userland). If you have problems with the Raspbian distribution packages, report them in the [github.com/RPi-Distro/repo](https://github.com/RPi-Distro/repo). If you simply have a question, then [the Raspberry Pi forums](https://www.raspberrypi.org/forums) are the best place to ask it.
+
+**Describe the bug**
+Add a clear and concise description of what you think the bug is.
+
+**To reproduce**
+List the steps required to reproduce the issue.
+
+**Expected behaviour**
+Add a clear and concise description of what you expected to happen.
+
+**Actual behaviour**
+Add a clear and concise description of what actually happened.
+
+**System**
+ Copy and paste the results of the raspinfo command in to this section. Alternatively, copy and paste a pastebin link, or add answers to the following questions:
+
+* Which model of Raspberry Pi? e.g. Pi3B+, PiZeroW
+* Which OS and version (`cat /etc/rpi-issue`)?
+* Which firmware version (`vcgencmd version`)?
+* Which kernel version (`uname -a`)?
+
+**Logs**
+If applicable, add the relevant output from `dmesg` or similar.
+
+**Additional context**
+Add any other relevant context for the problem.
-- 
GitLab


From 5bd8276a640bbdfc4c02d53b1193d8badc310457 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 7 Nov 2018 17:43:10 +0000
Subject: [PATCH 0183/1835] overlays: uart0 - return GPIOs 14 and 15 to inputs

In the event that alternate pins are used (only useful on Compute
Modules), return the standard pins to inputs to avoid double-mapping
them.

See: https://www.raspberrypi.org/forums/viewtopic.php?p=1388713#p1316977

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/uart0-overlay.dts | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/uart0-overlay.dts b/arch/arm/boot/dts/overlays/uart0-overlay.dts
index 20b2a609c511b..7df217e6f16df 100755
--- a/arch/arm/boot/dts/overlays/uart0-overlay.dts
+++ b/arch/arm/boot/dts/overlays/uart0-overlay.dts
@@ -17,16 +17,17 @@
 		target = <&gpio>;
 		__overlay__ {
 			uart0_pins: uart0_pins {
-				brcm,pins = <14 15>;
-				brcm,function = <4>; /* alt0 */
-				brcm,pull = <0 2>;
+				brcm,pins = <14 15 14 15>;
+				brcm,function = <0 0 4 4>; /* alt0 */
+				brcm,pull = <0 0 0 2>;
 			};
 		};
 	};
 
 	__overrides__ {
-		txd0_pin = <&uart0_pins>,"brcm,pins:0";
-		rxd0_pin = <&uart0_pins>,"brcm,pins:4";
-		pin_func = <&uart0_pins>,"brcm,function:0";
+		txd0_pin = <&uart0_pins>,"brcm,pins:8";
+		rxd0_pin = <&uart0_pins>,"brcm,pins:12";
+		pin_func = <&uart0_pins>,"brcm,function:8",
+			   <&uart0_pins>,"brcm,function:12";
 	};
 };
-- 
GitLab


From 328c7a754fde7f92f62062982a543ea187d7f452 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 12 Nov 2018 22:54:40 +0000
Subject: [PATCH 0184/1835] mmc: bcm2835-sdhost: Fix warnings on arm64

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/bcm2835-sdhost.c | 56 +++++++++++++++----------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
index 449194d3c2716..e51639a81b2e0 100644
--- a/drivers/mmc/host/bcm2835-sdhost.c
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -247,7 +247,7 @@ static void log_init(struct device *dev, u32 bus_to_phys)
 					     GFP_KERNEL);
 	if (sdhost_log_buf) {
 		pr_info("sdhost: log_buf @ %p (%x)\n",
-			sdhost_log_buf, sdhost_log_addr);
+			sdhost_log_buf, (u32)sdhost_log_addr);
 		timer_base = ioremap_nocache(bus_to_phys + 0x7e003000, SZ_4K);
 		if (!timer_base)
 			pr_err("sdhost: failed to remap timer\n");
@@ -301,7 +301,7 @@ static void log_dump(void)
 	}
 }
 
-#define log_event(event, param1, param2) log_event_impl(event, param1, param2)
+#define log_event(event, param1, param2) log_event_impl(event, (u32)(uintptr_t)param1, (u32)(uintptr_t)param2)
 
 #else
 
@@ -527,7 +527,7 @@ static void bcm2835_sdhost_dma_complete(void *param)
 	unsigned long flags;
 
 	spin_lock_irqsave(&host->lock, flags);
-	log_event("DMA<", (u32)host->data, bcm2835_sdhost_read(host, SDHSTS));
+	log_event("DMA<", host->data, bcm2835_sdhost_read(host, SDHSTS));
 	log_event("DMA ", bcm2835_sdhost_read(host, SDCMD),
 		  bcm2835_sdhost_read(host, SDEDM));
 
@@ -559,7 +559,7 @@ static void bcm2835_sdhost_dma_complete(void *param)
 
 	bcm2835_sdhost_finish_data(host);
 
-	log_event("DMA>", (u32)host->data, 0);
+	log_event("DMA>", host->data, 0);
 	spin_unlock_irqrestore(&host->lock, flags);
 }
 
@@ -748,7 +748,7 @@ static void bcm2835_sdhost_transfer_pio(struct bcm2835_host *host)
 	u32 sdhsts;
 	bool is_read;
 	BUG_ON(!host->data);
-	log_event("XFP<", (u32)host->data, host->blocks);
+	log_event("XFP<", host->data, host->blocks);
 
 	is_read = (host->data->flags & MMC_DATA_READ) != 0;
 	if (is_read)
@@ -773,7 +773,7 @@ static void bcm2835_sdhost_transfer_pio(struct bcm2835_host *host)
 		       sdhsts);
 		host->data->error = -ETIMEDOUT;
 	}
-	log_event("XFP>", (u32)host->data, host->blocks);
+	log_event("XFP>", host->data, host->blocks);
 }
 
 static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
@@ -783,7 +783,7 @@ static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
 	struct dma_async_tx_descriptor *desc = NULL;
 	struct dma_chan *dma_chan;
 
-	log_event("PRD<", (u32)data, 0);
+	log_event("PRD<", data, 0);
 	pr_debug("bcm2835_sdhost_prepare_dma()\n");
 
 	dma_chan = host->dma_chan_rxtx;
@@ -794,7 +794,7 @@ static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
 		dir_data = DMA_TO_DEVICE;
 		dir_slave = DMA_MEM_TO_DEV;
 	}
-	log_event("PRD1", (u32)dma_chan, 0);
+	log_event("PRD1", dma_chan, 0);
 
 	BUG_ON(!dma_chan->device);
 	BUG_ON(!dma_chan->device->dev);
@@ -841,7 +841,7 @@ static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
 		desc = dmaengine_prep_slave_sg(dma_chan, data->sg,
 					       len, dir_slave,
 					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-	log_event("PRD3", (u32)desc, 0);
+	log_event("PRD3", desc, 0);
 
 	if (desc) {
 		desc->callback = bcm2835_sdhost_dma_complete;
@@ -850,12 +850,12 @@ static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
 		host->dma_chan = dma_chan;
 		host->dma_dir = dir_data;
 	}
-	log_event("PDM>", (u32)data, 0);
+	log_event("PDM>", data, 0);
 }
 
 static void bcm2835_sdhost_start_dma(struct bcm2835_host *host)
 {
-	log_event("SDMA", (u32)host->data, (u32)host->dma_chan);
+	log_event("SDMA", host->data, host->dma_chan);
 	dmaengine_submit(host->dma_desc);
 	dma_async_issue_pending(host->dma_chan);
 }
@@ -1079,7 +1079,7 @@ static void bcm2835_sdhost_finish_data(struct bcm2835_host *host)
 	data = host->data;
 	BUG_ON(!data);
 
-	log_event("FDA<", (u32)host->mrq, (u32)host->cmd);
+	log_event("FDA<", host->mrq, host->cmd);
 	pr_debug("finish_data(error %d, stop %d, sbc %d)\n",
 	       data->error, data->stop ? 1 : 0,
 	       host->mrq->sbc ? 1 : 0);
@@ -1102,7 +1102,7 @@ static void bcm2835_sdhost_finish_data(struct bcm2835_host *host)
 	}
 	else
 		bcm2835_sdhost_transfer_complete(host);
-	log_event("FDA>", (u32)host->mrq, (u32)host->cmd);
+	log_event("FDA>", host->mrq, host->cmd);
 }
 
 static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
@@ -1116,7 +1116,7 @@ static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
 	data = host->data;
 	host->data = NULL;
 
-	log_event("TCM<", (u32)data, data->error);
+	log_event("TCM<", data, data->error);
 	pr_debug("transfer_complete(error %d, stop %d)\n",
 	       data->error, data->stop ? 1 : 0);
 
@@ -1138,7 +1138,7 @@ static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
 		bcm2835_sdhost_wait_transfer_complete(host);
 		tasklet_schedule(&host->finish_tasklet);
 	}
-	log_event("TCM>", (u32)data, 0);
+	log_event("TCM>", data, 0);
 }
 
 /* If irq_flags is valid, the caller is in a thread context and is allowed
@@ -1153,7 +1153,7 @@ static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
 	int timediff = 0;
 #endif
 
-	log_event("FCM<", (u32)host->mrq, (u32)host->cmd);
+	log_event("FCM<", host->mrq, host->cmd);
 	pr_debug("finish_command(%x)\n", bcm2835_sdhost_read(host, SDCMD));
 
 	BUG_ON(!host->cmd || !host->mrq);
@@ -1310,7 +1310,7 @@ static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
 		else if (host->data_complete)
 			bcm2835_sdhost_transfer_complete(host);
 	}
-	log_event("FCM>", (u32)host->mrq, (u32)host->cmd);
+	log_event("FCM>", host->mrq, host->cmd);
 }
 
 static void bcm2835_sdhost_timeout(struct timer_list *t)
@@ -1347,7 +1347,7 @@ static void bcm2835_sdhost_timeout(struct timer_list *t)
 
 static void bcm2835_sdhost_busy_irq(struct bcm2835_host *host, u32 intmask)
 {
-	log_event("IRQB", (u32)host->cmd, intmask);
+	log_event("IRQB", host->cmd, intmask);
 	if (!host->cmd) {
 		pr_err("%s: got command busy interrupt 0x%08x even "
 			"though no command operation was in progress.\n",
@@ -1400,7 +1400,7 @@ static void bcm2835_sdhost_data_irq(struct bcm2835_host *host, u32 intmask)
 	   data/space available FIFO status bits. It is therefore not
 	   an error to get here when there is no data transfer in
 	   progress. */
-	log_event("IRQD", (u32)host->data, intmask);
+	log_event("IRQD", host->data, intmask);
 	if (!host->data)
 		return;
 
@@ -1437,7 +1437,7 @@ static void bcm2835_sdhost_data_irq(struct bcm2835_host *host, u32 intmask)
 
 static void bcm2835_sdhost_block_irq(struct bcm2835_host *host, u32 intmask)
 {
-	log_event("IRQK", (u32)host->data, intmask);
+	log_event("IRQK", host->data, intmask);
 	if (!host->data) {
 		pr_err("%s: got block interrupt 0x%08x even "
 			"though no data operation was in progress.\n",
@@ -1695,10 +1695,10 @@ static void bcm2835_sdhost_request(struct mmc_host *mmc, struct mmc_request *mrq
 	edm = bcm2835_sdhost_read(host, SDEDM);
 	fsm = edm & SDEDM_FSM_MASK;
 
-	log_event("REQ<", (u32)mrq, edm);
+	log_event("REQ<", mrq, edm);
 	if ((fsm != SDEDM_FSM_IDENTMODE) &&
 	    (fsm != SDEDM_FSM_DATAMODE)) {
-		log_event("REQ!", (u32)mrq, edm);
+		log_event("REQ!", mrq, edm);
 		if (host->debug) {
 			pr_warn("%s: previous command (%d) not complete (EDM %x)\n",
 			       mmc_hostname(host->mmc),
@@ -1730,11 +1730,11 @@ static void bcm2835_sdhost_request(struct mmc_host *mmc, struct mmc_request *mrq
 			bcm2835_sdhost_finish_command(host, &flags);
 	}
 
-	log_event("CMD ", (u32)mrq->cmd->opcode,
+	log_event("CMD ", mrq->cmd->opcode,
 		   mrq->data ? (u32)mrq->data->blksz : 0);
 	mmiowb();
 
-	log_event("REQ>", (u32)mrq, 0);
+	log_event("REQ>", mrq, 0);
 	spin_unlock_irqrestore(&host->lock, flags);
 }
 
@@ -1790,7 +1790,7 @@ static void bcm2835_sdhost_cmd_wait_work(struct work_struct *work)
 
 	spin_lock_irqsave(&host->lock, flags);
 
-	log_event("CWK<", (u32)host->cmd, (u32)host->mrq);
+	log_event("CWK<", host->cmd, host->mrq);
 
 	/*
 	 * If this tasklet gets rescheduled while running, it will
@@ -1805,7 +1805,7 @@ static void bcm2835_sdhost_cmd_wait_work(struct work_struct *work)
 
 	mmiowb();
 
-	log_event("CWK>", (u32)host->cmd, 0);
+	log_event("CWK>", host->cmd, 0);
 
 	spin_unlock_irqrestore(&host->lock, flags);
 }
@@ -1821,7 +1821,7 @@ static void bcm2835_sdhost_tasklet_finish(unsigned long param)
 
 	spin_lock_irqsave(&host->lock, flags);
 
-	log_event("TSK<", (u32)host->mrq, 0);
+	log_event("TSK<", host->mrq, 0);
 	/*
 	 * If this tasklet gets rescheduled while running, it will
 	 * be run again afterwards but without any active request.
@@ -1889,7 +1889,7 @@ static void bcm2835_sdhost_tasklet_finish(unsigned long param)
 	}
 
 	mmc_request_done(host->mmc, mrq);
-	log_event("TSK>", (u32)mrq, 0);
+	log_event("TSK>", mrq, 0);
 }
 
 int bcm2835_sdhost_add_host(struct bcm2835_host *host)
-- 
GitLab


From 37ecf826e4923b4ab3cd7209165859ff3081f60c Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 12 Nov 2018 22:56:35 +0000
Subject: [PATCH 0185/1835] Fix warning in bcm2835-smi-nand

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mtd/nand/raw/bcm2835_smi_nand.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/bcm2835_smi_nand.c b/drivers/mtd/nand/raw/bcm2835_smi_nand.c
index 78dc4fcc7495b..572c638214fdd 100644
--- a/drivers/mtd/nand/raw/bcm2835_smi_nand.c
+++ b/drivers/mtd/nand/raw/bcm2835_smi_nand.c
@@ -135,10 +135,8 @@ static int bcm2835_smi_nand_probe(struct platform_device *pdev)
 	struct mtd_info *mtd;
 	struct device *dev = &pdev->dev;
 	struct device_node *node = dev->of_node, *smi_node;
-	struct mtd_part_parser_data ppdata;
 	struct smi_settings *smi_settings;
 	struct bcm2835_smi_instance *smi_inst;
-	int ret = -ENXIO;
 
 	if (!node) {
 		dev_err(dev, "No device tree node supplied!");
-- 
GitLab


From 031525b8e40f342f7842bc69f18bc613d659b0fc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:55:37 +0000
Subject: [PATCH 0186/1835] media: ov5647: Add set_fmt and get_fmt calls.

There's no way to query the subdevice for the supported
resolutions.
Add set_fmt and get_fmt implementations.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/ov5647.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index da39c49de503c..06b32d01073e8 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -463,8 +463,30 @@ static int ov5647_enum_mbus_code(struct v4l2_subdev *sd,
 	return 0;
 }
 
+static int ov5647_set_get_fmt(struct v4l2_subdev *sd,
+			      struct v4l2_subdev_pad_config *cfg,
+			      struct v4l2_subdev_format *format)
+{
+	struct v4l2_mbus_framefmt *fmt = &format->format;
+
+	if (format->pad != 0)
+		return -EINVAL;
+
+	/* Only one format is supported, so return that */
+	memset(fmt, 0, sizeof(*fmt));
+	fmt->code = MEDIA_BUS_FMT_SBGGR8_1X8;
+	fmt->colorspace = V4L2_COLORSPACE_SRGB;
+	fmt->field = V4L2_FIELD_NONE;
+	fmt->width = 640;
+	fmt->height = 480;
+
+	return 0;
+}
+
 static const struct v4l2_subdev_pad_ops ov5647_subdev_pad_ops = {
 	.enum_mbus_code = ov5647_enum_mbus_code,
+	.set_fmt =	  ov5647_set_get_fmt,
+	.get_fmt =	  ov5647_set_get_fmt,
 };
 
 static const struct v4l2_subdev_ops ov5647_subdev_ops = {
-- 
GitLab


From be73877166b88fe6e512b6bb9cba301858b1ee00 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:55:59 +0000
Subject: [PATCH 0187/1835] [media] Documentation: DT: add device tree for PWDN
 control

Add optional GPIO pwdn to connect to the PWDN line on the sensor.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 Documentation/devicetree/bindings/media/i2c/ov5647.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/devicetree/bindings/media/i2c/ov5647.txt b/Documentation/devicetree/bindings/media/i2c/ov5647.txt
index 22e44945b6610..70f06c24f4709 100644
--- a/Documentation/devicetree/bindings/media/i2c/ov5647.txt
+++ b/Documentation/devicetree/bindings/media/i2c/ov5647.txt
@@ -10,6 +10,9 @@ Required properties:
 - reg			: I2C slave address of the sensor.
 - clocks		: Reference to the xclk clock.
 
+Optional Properties:
+- pwdn-gpios: reference to the GPIO connected to the pwdn pin, if any.
+
 The common video interfaces bindings (see video-interfaces.txt) should be
 used to specify link to the image data receiver. The OV5647 device
 node should contain one 'port' child node with an 'endpoint' subnode.
@@ -26,6 +29,7 @@ Example:
 			compatible = "ovti,ov5647";
 			reg = <0x36>;
 			clocks = <&camera_clk>;
+			pwdn-gpios = <&pioE 29 GPIO_ACTIVE_HIGH>;
 			port {
 				camera_1: endpoint {
 					remote-endpoint = <&csi1_ep1>;
-- 
GitLab


From e5f5fba380ea3d85de1fdd74f33d65bd0f9c7c68 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:56:33 +0000
Subject: [PATCH 0188/1835] media: ov5647: Add support for PWDN GPIO.

Add support for an optional GPIO connected to PWDN on the sensor.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/ov5647.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index 06b32d01073e8..db2f2923799c6 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -21,6 +21,7 @@
 
 #include <linux/clk.h>
 #include <linux/delay.h>
+#include <linux/gpio/consumer.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
 #include <linux/io.h>
@@ -35,6 +36,13 @@
 
 #define SENSOR_NAME "ov5647"
 
+/*
+ * From the datasheet, "20ms after PWDN goes low or 20ms after RESETB goes
+ * high if reset is inserted after PWDN goes high, host can access sensor's
+ * SCCB to initialize sensor."
+ */
+#define PWDN_ACTIVE_DELAY_MS	20
+
 #define MIPI_CTRL00_CLOCK_LANE_GATE		BIT(5)
 #define MIPI_CTRL00_BUS_IDLE			BIT(2)
 #define MIPI_CTRL00_CLOCK_LANE_DISABLE		BIT(0)
@@ -86,6 +94,7 @@ struct ov5647 {
 	unsigned int			height;
 	int				power_count;
 	struct clk			*xclk;
+	struct gpio_desc		*pwdn;
 };
 
 static inline struct ov5647 *to_state(struct v4l2_subdev *sd)
@@ -355,6 +364,11 @@ static int ov5647_sensor_power(struct v4l2_subdev *sd, int on)
 	if (on && !ov5647->power_count)	{
 		dev_dbg(&client->dev, "OV5647 power on\n");
 
+		if (ov5647->pwdn) {
+			gpiod_set_value(ov5647->pwdn, 0);
+			msleep(PWDN_ACTIVE_DELAY_MS);
+		}
+
 		ret = clk_prepare_enable(ov5647->xclk);
 		if (ret < 0) {
 			dev_err(&client->dev, "clk prepare enable failed\n");
@@ -392,6 +406,8 @@ static int ov5647_sensor_power(struct v4l2_subdev *sd, int on)
 			dev_dbg(&client->dev, "soft stby failed\n");
 
 		clk_disable_unprepare(ov5647->xclk);
+
+		gpiod_set_value(ov5647->pwdn, 1);
 	}
 
 	/* Update the power count. */
@@ -604,6 +620,10 @@ static int ov5647_probe(struct i2c_client *client,
 		return -EINVAL;
 	}
 
+	/* Request the power down GPIO asserted */
+	sensor->pwdn = devm_gpiod_get_optional(&client->dev, "pwdn",
+					       GPIOD_OUT_HIGH);
+
 	mutex_init(&sensor->lock);
 
 	sd = &sensor->sd;
@@ -617,7 +637,15 @@ static int ov5647_probe(struct i2c_client *client,
 	if (ret < 0)
 		goto mutex_remove;
 
+	if (sensor->pwdn) {
+		gpiod_set_value(sensor->pwdn, 0);
+		msleep(PWDN_ACTIVE_DELAY_MS);
+	}
+
 	ret = ov5647_detect(sd);
+
+	gpiod_set_value(sensor->pwdn, 1);
+
 	if (ret < 0)
 		goto error;
 
-- 
GitLab


From a441a01866378f3445f97801c9d8df960ff5b8fc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:56:47 +0000
Subject: [PATCH 0189/1835] media: ov5647: Add support for non-continuous clock
 mode

The driver was only supporting continuous clock mode
although this was not stated anywhere.
Non-continuous clock saves a small amount of power and
on some SoCs is easier to interface with.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/ov5647.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index db2f2923799c6..93e2670066690 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -44,6 +44,7 @@
 #define PWDN_ACTIVE_DELAY_MS	20
 
 #define MIPI_CTRL00_CLOCK_LANE_GATE		BIT(5)
+#define MIPI_CTRL00_LINE_SYNC_ENABLE		BIT(4)
 #define MIPI_CTRL00_BUS_IDLE			BIT(2)
 #define MIPI_CTRL00_CLOCK_LANE_DISABLE		BIT(0)
 
@@ -95,6 +96,7 @@ struct ov5647 {
 	int				power_count;
 	struct clk			*xclk;
 	struct gpio_desc		*pwdn;
+	unsigned int			flags;
 };
 
 static inline struct ov5647 *to_state(struct v4l2_subdev *sd)
@@ -269,9 +271,15 @@ static int ov5647_set_virtual_channel(struct v4l2_subdev *sd, int channel)
 
 static int ov5647_stream_on(struct v4l2_subdev *sd)
 {
+	struct ov5647 *ov5647 = to_state(sd);
+	u8 val = MIPI_CTRL00_BUS_IDLE;
 	int ret;
 
-	ret = ov5647_write(sd, OV5647_REG_MIPI_CTRL00, MIPI_CTRL00_BUS_IDLE);
+	if (ov5647->flags & V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK)
+		val |= MIPI_CTRL00_CLOCK_LANE_GATE |
+		       MIPI_CTRL00_LINE_SYNC_ENABLE;
+
+	ret = ov5647_write(sd, OV5647_REG_MIPI_CTRL00, val);
 	if (ret < 0)
 		return ret;
 
@@ -568,7 +576,7 @@ static const struct v4l2_subdev_internal_ops ov5647_subdev_internal_ops = {
 	.open = ov5647_open,
 };
 
-static int ov5647_parse_dt(struct device_node *np)
+static int ov5647_parse_dt(struct device_node *np, struct ov5647 *sensor)
 {
 	struct v4l2_fwnode_endpoint bus_cfg;
 	struct device_node *ep;
@@ -581,6 +589,9 @@ static int ov5647_parse_dt(struct device_node *np)
 
 	ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep), &bus_cfg);
 
+	if (!ret)
+		sensor->flags = bus_cfg.bus.mipi_csi2.flags;
+
 	of_node_put(ep);
 	return ret;
 }
@@ -600,7 +611,7 @@ static int ov5647_probe(struct i2c_client *client,
 		return -ENOMEM;
 
 	if (IS_ENABLED(CONFIG_OF) && np) {
-		ret = ov5647_parse_dt(np);
+		ret = ov5647_parse_dt(np, sensor);
 		if (ret) {
 			dev_err(dev, "DT parsing error: %d\n", ret);
 			return ret;
-- 
GitLab


From 5a81961cb40456af0cd1fa81e38b762bed3ec5cb Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:56:59 +0000
Subject: [PATCH 0190/1835] media: tc358743: Increase FIFO level to 374.

The existing fixed value of 16 worked for UYVY 720P60 over
2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
1080P60 needs 6 lanes at 594MHz).
It doesn't allow for lower resolutions to work as the FIFO
underflows.

374 is required for 1080P24-30 UYVY over 2 lanes @ 972Mbit/s, but
>374 means that the FIFO underflows on 1080P50 UYVY over 2 lanes
@ 972Mbit/s.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/tc358743.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index 26070fb6ce4eb..3113e56c884b4 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1946,7 +1946,7 @@ static int tc358743_probe_of(struct tc358743_state *state)
 	state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS;
 	state->pdata.enable_hdcp = false;
 	/* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */
-	state->pdata.fifo_level = 16;
+	state->pdata.fifo_level = 374;
 	/*
 	 * The PLL input clock is obtained by dividing refclk by pll_prd.
 	 * It must be between 6 MHz and 40 MHz, lower frequency is better.
-- 
GitLab


From 38d237fb6eff9947bd5199671c0cf033ccebc987 Mon Sep 17 00:00:00 2001
From: Philipp Zabel <p.zabel@pengutronix.de>
Date: Thu, 21 Sep 2017 17:30:24 +0200
Subject: [PATCH 0191/1835] media: tc358743: fix connected/active CSI-2 lane
 reporting

g_mbus_config was supposed to indicate all supported lane numbers, not
only the number of those currently in active use. Since the TC358743
can dynamically reduce the number of active lanes if the required
bandwidth allows for it, report all lane numbers up to the connected
number of lanes as supported in pdata mode.
In device tree mode, do not report lane count and clock mode at all, as
the receiver driver can determine these from the device tree.

To allow communicating the number of currently active lanes, add a new
bitfield to the v4l2_mbus_config flags. This is a temporary fix, to be
used only until a better solution is found.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
---
 drivers/media/i2c/tc358743.c  | 30 ++++++++++++++++--------------
 include/media/v4l2-mediabus.h |  8 ++++++++
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index 3113e56c884b4..04c8855068859 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1606,28 +1606,29 @@ static int tc358743_g_mbus_config(struct v4l2_subdev *sd,
 			     struct v4l2_mbus_config *cfg)
 {
 	struct tc358743_state *state = to_state(sd);
+	const u32 mask = V4L2_MBUS_CSI2_LANE_MASK;
+
+	if (state->csi_lanes_in_use > state->bus.num_data_lanes)
+		return -EINVAL;
 
 	cfg->type = V4L2_MBUS_CSI2;
+	cfg->flags = (state->csi_lanes_in_use << __ffs(mask)) & mask;
 
-	/* Support for non-continuous CSI-2 clock is missing in the driver */
-	cfg->flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK;
+	/* In DT mode, only report the number of active lanes */
+	if (sd->dev->of_node)
+		return 0;
 
-	switch (state->csi_lanes_in_use) {
-	case 1:
+	/* Support for non-continuous CSI-2 clock is missing in pdata mode */
+	cfg->flags |= V4L2_MBUS_CSI2_CONTINUOUS_CLOCK;
+
+	if (state->bus.num_data_lanes > 0)
 		cfg->flags |= V4L2_MBUS_CSI2_1_LANE;
-		break;
-	case 2:
+	if (state->bus.num_data_lanes > 1)
 		cfg->flags |= V4L2_MBUS_CSI2_2_LANE;
-		break;
-	case 3:
+	if (state->bus.num_data_lanes > 2)
 		cfg->flags |= V4L2_MBUS_CSI2_3_LANE;
-		break;
-	case 4:
+	if (state->bus.num_data_lanes > 3)
 		cfg->flags |= V4L2_MBUS_CSI2_4_LANE;
-		break;
-	default:
-		return -EINVAL;
-	}
 
 	return 0;
 }
@@ -2052,6 +2053,7 @@ static int tc358743_probe(struct i2c_client *client,
 	if (pdata) {
 		state->pdata = *pdata;
 		state->bus.flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK;
+		state->bus.num_data_lanes = 4;
 	} else {
 		err = tc358743_probe_of(state);
 		if (err == -ENODEV)
diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h
index 4bbb5f3d2b025..1ec2873902be1 100644
--- a/include/media/v4l2-mediabus.h
+++ b/include/media/v4l2-mediabus.h
@@ -67,6 +67,14 @@
 					 V4L2_MBUS_CSI2_3_LANE | V4L2_MBUS_CSI2_4_LANE)
 #define V4L2_MBUS_CSI2_CHANNELS		(V4L2_MBUS_CSI2_CHANNEL_0 | V4L2_MBUS_CSI2_CHANNEL_1 | \
 					 V4L2_MBUS_CSI2_CHANNEL_2 | V4L2_MBUS_CSI2_CHANNEL_3)
+/*
+ * Number of lanes in use, 0 == use all available lanes (default)
+ *
+ * This is a temporary fix for devices that need to reduce the number of active
+ * lanes for certain modes, until g_mbus_config() can be replaced with a better
+ * solution.
+ */
+#define V4L2_MBUS_CSI2_LANE_MASK                (0xf << 10)
 
 /**
  * enum v4l2_mbus_type - media bus type
-- 
GitLab


From e676070a2a7d8d2b58c1f7caf6e3060a4242a7f9 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:57:21 +0000
Subject: [PATCH 0192/1835] media: tc358743: Add support for 972Mbit/s link
 freq.

Adds register setups for running the CSI lanes at 972Mbit/s,
which allows 1080P50 UYVY down 2 lanes.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/tc358743.c | 47 +++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 14 deletions(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index 04c8855068859..d91c6d595971e 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1967,6 +1967,7 @@ static int tc358743_probe_of(struct tc358743_state *state)
 	/*
 	 * The CSI bps per lane must be between 62.5 Mbps and 1 Gbps.
 	 * The default is 594 Mbps for 4-lane 1080p60 or 2-lane 720p60.
+	 * 972 Mbps allows 1080P50 UYVY over 2-lane.
 	 */
 	bps_pr_lane = 2 * endpoint->link_frequencies[0];
 	if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) {
@@ -1979,23 +1980,41 @@ static int tc358743_probe_of(struct tc358743_state *state)
 			       state->pdata.refclk_hz * state->pdata.pll_prd;
 
 	/*
-	 * FIXME: These timings are from REF_02 for 594 Mbps per lane (297 MHz
-	 * link frequency). In principle it should be possible to calculate
+	 * FIXME: These timings are from REF_02 for 594 or 972 Mbps per lane
+	 * (297 MHz or 486 MHz link frequency).
+	 * In principle it should be possible to calculate
 	 * them based on link frequency and resolution.
 	 */
-	if (bps_pr_lane != 594000000U)
+	switch (bps_pr_lane) {
+	default:
 		dev_warn(dev, "untested bps per lane: %u bps\n", bps_pr_lane);
-	state->pdata.lineinitcnt = 0xe80;
-	state->pdata.lptxtimecnt = 0x003;
-	/* tclk-preparecnt: 3, tclk-zerocnt: 20 */
-	state->pdata.tclk_headercnt = 0x1403;
-	state->pdata.tclk_trailcnt = 0x00;
-	/* ths-preparecnt: 3, ths-zerocnt: 1 */
-	state->pdata.ths_headercnt = 0x0103;
-	state->pdata.twakeup = 0x4882;
-	state->pdata.tclk_postcnt = 0x008;
-	state->pdata.ths_trailcnt = 0x2;
-	state->pdata.hstxvregcnt = 0;
+	case 594000000U:
+		state->pdata.lineinitcnt = 0xe80;
+		state->pdata.lptxtimecnt = 0x003;
+		/* tclk-preparecnt: 3, tclk-zerocnt: 20 */
+		state->pdata.tclk_headercnt = 0x1403;
+		state->pdata.tclk_trailcnt = 0x00;
+		/* ths-preparecnt: 3, ths-zerocnt: 1 */
+		state->pdata.ths_headercnt = 0x0103;
+		state->pdata.twakeup = 0x4882;
+		state->pdata.tclk_postcnt = 0x008;
+		state->pdata.ths_trailcnt = 0x2;
+		state->pdata.hstxvregcnt = 0;
+		break;
+	case 972000000U:
+		state->pdata.lineinitcnt = 0x1b58;
+		state->pdata.lptxtimecnt = 0x007;
+		/* tclk-preparecnt: 6, tclk-zerocnt: 40 */
+		state->pdata.tclk_headercnt = 0x2806;
+		state->pdata.tclk_trailcnt = 0x00;
+		/* ths-preparecnt: 6, ths-zerocnt: 8 */
+		state->pdata.ths_headercnt = 0x0806;
+		state->pdata.twakeup = 0x4268;
+		state->pdata.tclk_postcnt = 0x008;
+		state->pdata.ths_trailcnt = 0x5;
+		state->pdata.hstxvregcnt = 0;
+		break;
+	}
 
 	state->reset_gpio = devm_gpiod_get_optional(dev, "reset",
 						    GPIOD_OUT_LOW);
-- 
GitLab


From 32d41be5c5062898040eff283f07f1b50c595912 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:57:34 +0000
Subject: [PATCH 0193/1835] media: tc358743: Check I2C succeeded during probe.

The probe for the TC358743 reads the CHIPID register from
the device and compares it to the expected value of 0.
If the I2C request fails then that also returns 0, so
the driver loads thinking that the device is there.

Generally I2C communications are reliable so there is
limited need to check the return value on every transfer,
therefore only amend the one read during probe to check
for I2C errors.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/tc358743.c | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index d91c6d595971e..bfb0b81b497b5 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -110,7 +110,7 @@ static inline struct tc358743_state *to_state(struct v4l2_subdev *sd)
 
 /* --------------- I2C --------------- */
 
-static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
 {
 	struct tc358743_state *state = to_state(sd);
 	struct i2c_client *client = state->i2c_client;
@@ -136,6 +136,7 @@ static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
 		v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed\n",
 				__func__, reg, client->addr);
 	}
+	return err != ARRAY_SIZE(msgs);
 }
 
 static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
@@ -192,15 +193,24 @@ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
 	}
 }
 
-static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
+static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n,
+				  int *err)
 {
+	int error;
 	__le32 val = 0;
 
-	i2c_rd(sd, reg, (u8 __force *)&val, n);
+	error = i2c_rd(sd, reg, (u8 __force *)&val, n);
+	if (err)
+		*err = error;
 
 	return le32_to_cpu(val);
 }
 
+static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
+{
+	return i2c_rdreg_err(sd, reg, n, NULL);
+}
+
 static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n)
 {
 	__le32 raw = cpu_to_le32(val);
@@ -229,6 +239,13 @@ static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg)
 	return i2c_rdreg(sd, reg, 2);
 }
 
+static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value)
+{
+	int err;
+	*value = i2c_rdreg_err(sd, reg, 2, &err);
+	return err;
+}
+
 static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val)
 {
 	i2c_wrreg(sd, reg, val, 2);
@@ -2054,6 +2071,7 @@ static int tc358743_probe(struct i2c_client *client,
 	struct tc358743_platform_data *pdata = client->dev.platform_data;
 	struct v4l2_subdev *sd;
 	u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK;
+	u16 chipid;
 	int err;
 
 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
@@ -2086,7 +2104,8 @@ static int tc358743_probe(struct i2c_client *client,
 	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
 
 	/* i2c access */
-	if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) {
+	if (i2c_rd16_err(sd, CHIPID, &chipid) ||
+	    (chipid & MASK_CHIPID) != 0) {
 		v4l2_info(sd, "not a TC358743 on address 0x%x\n",
 			  client->addr << 1);
 		return -ENODEV;
-- 
GitLab


From 0f629f03af51173adf5b6aef5e634e1ad3a8e6db Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:57:46 +0000
Subject: [PATCH 0194/1835] media: adv7180: Default to the first valid input

The hardware default is differential CVBS on AIN1 & 2, which
isn't very useful.

Select the first input that is defined as valid for the
chip variant (typically CVBS_AIN1).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/adv7180.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index de10367d550b4..931c0408b0469 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -1240,6 +1240,7 @@ static const struct adv7180_chip_info adv7282_m_info = {
 static int init_device(struct adv7180_state *state)
 {
 	int ret;
+	int i;
 
 	mutex_lock(&state->mutex);
 
@@ -1286,6 +1287,18 @@ static int init_device(struct adv7180_state *state)
 			goto out_unlock;
 	}
 
+	/* Select first valid input */
+	for (i = 0; i < 32; i++) {
+		if (BIT(i) & state->chip_info->valid_input_mask) {
+			ret = state->chip_info->select_input(state, i);
+
+			if (ret == 0) {
+				state->input = i;
+				break;
+			}
+		}
+	}
+
 out_unlock:
 	mutex_unlock(&state->mutex);
 
-- 
GitLab


From be7bf876bf4c300bed734fcb8d10ecf258cd8ebf Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:57:56 +0000
Subject: [PATCH 0195/1835] media: adv7180: Add YPrPb support for ADV7282M

The ADV7282M can support YPbPr on AIN1-3, but this was
not selectable from the driver. Add it to the list of
supported input modes.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/adv7180.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 931c0408b0469..e0584040eca86 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -1229,6 +1229,7 @@ static const struct adv7180_chip_info adv7282_m_info = {
 		BIT(ADV7182_INPUT_SVIDEO_AIN1_AIN2) |
 		BIT(ADV7182_INPUT_SVIDEO_AIN3_AIN4) |
 		BIT(ADV7182_INPUT_SVIDEO_AIN7_AIN8) |
+		BIT(ADV7182_INPUT_YPRPB_AIN1_AIN2_AIN3) |
 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN1_AIN2) |
 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN3_AIN4) |
 		BIT(ADV7182_INPUT_DIFF_CVBS_AIN7_AIN8),
-- 
GitLab


From c3f4b15fcdca56a4f05eda5419d6d51ffbcb5e8c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:58:08 +0000
Subject: [PATCH 0196/1835] media: videodev2: Add helper defines for printing
 FOURCCs

New helper defines that allow printing of a FOURCC using
printf(V4L2_FOURCC_CONV, V4L2_FOURCC_CONV_ARGS(fourcc));

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 include/uapi/linux/videodev2.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index 1aae2e4b8f102..9a860b2772178 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -82,6 +82,11 @@
 	((__u32)(a) | ((__u32)(b) << 8) | ((__u32)(c) << 16) | ((__u32)(d) << 24))
 #define v4l2_fourcc_be(a, b, c, d)	(v4l2_fourcc(a, b, c, d) | (1 << 31))
 
+#define V4L2_FOURCC_CONV "%c%c%c%c%s"
+#define V4L2_FOURCC_CONV_ARGS(fourcc) \
+	(fourcc) & 0x7f, ((fourcc) >> 8) & 0x7f, ((fourcc) >> 16) & 0x7f, \
+	((fourcc) >> 24) & 0x7f, (fourcc) & BIT(31) ? "-BE" : ""
+
 /*
  *	E N U M S
  */
-- 
GitLab


From 8441d4bbbd17b0c409e24a4ffbd4a3ed38bb2716 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:59:06 +0000
Subject: [PATCH 0197/1835] dt-bindings: Document BCM283x CSI2/CCP2 receiver

Document the DT bindings for the CSI2/CCP2 receiver peripheral
(known as Unicam) on BCM283x SoCs.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Acked-by: Rob Herring <robh@kernel.org>
---
 .../bindings/media/bcm2835-unicam.txt         | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/media/bcm2835-unicam.txt

diff --git a/Documentation/devicetree/bindings/media/bcm2835-unicam.txt b/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
new file mode 100644
index 0000000000000..7714fb374b34d
--- /dev/null
+++ b/Documentation/devicetree/bindings/media/bcm2835-unicam.txt
@@ -0,0 +1,85 @@
+Broadcom BCM283x Camera Interface (Unicam)
+------------------------------------------
+
+The Unicam block on BCM283x SoCs is the receiver for either
+CSI-2 or CCP2 data from image sensors or similar devices.
+
+The main platform using this SoC is the Raspberry Pi family of boards.
+On the Pi the VideoCore firmware can also control this hardware block,
+and driving it from two different processors will cause issues.
+To avoid this, the firmware checks the device tree configuration
+during boot. If it finds device tree nodes called csi0 or csi1 then
+it will stop the firmware accessing the block, and it can then
+safely be used via the device tree binding.
+
+Required properties:
+===================
+- compatible	: must be "brcm,bcm2835-unicam".
+- reg		: physical base address and length of the register sets for the
+		  device.
+- interrupts	: should contain the IRQ line for this Unicam instance.
+- clocks	: list of clock specifiers, corresponding to entries in
+		  clock-names property.
+- clock-names	: must contain an "lp" entry, matching entries in the
+		  clocks property.
+
+Unicam supports a single port node. It should contain one 'port' child node
+with child 'endpoint' node. Please refer to the bindings defined in
+Documentation/devicetree/bindings/media/video-interfaces.txt.
+
+Within the endpoint node the "remote-endpoint" and "data-lanes" properties
+are mandatory.
+Data lane reordering is not supported so the data lanes must be in order,
+starting at 1. The number of data lanes should represent the number of
+usable lanes for the hardware block. That may be limited by either the SoC or
+how the platform presents the interface, and the lower value must be used.
+
+Lane reordering is not supported on the clock lane either, so the optional
+property "clock-lane" will implicitly be <0>.
+Similarly lane inversion is not supported, therefore "lane-polarities" will
+implicitly be <0 0 0 0 0>.
+Neither of these values will be checked.
+
+Example:
+	csi1: csi1@7e801000 {
+		compatible = "brcm,bcm2835-unicam";
+		reg = <0x7e801000 0x800>,
+		      <0x7e802004 0x4>;
+		interrupts = <2 7>;
+		clocks = <&clocks BCM2835_CLOCK_CAM1>;
+		clock-names = "lp";
+
+		port {
+			csi1_ep: endpoint {
+				remote-endpoint = <&tc358743_0>;
+				data-lanes = <1 2>;
+			};
+		};
+	};
+
+	i2c0: i2c@7e205000 {
+		tc358743: csi-hdmi-bridge@0f {
+			compatible = "toshiba,tc358743";
+			reg = <0x0f>;
+
+			clocks = <&tc358743_clk>;
+			clock-names = "refclk";
+
+			tc358743_clk: bridge-clk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <27000000>;
+			};
+
+			port {
+				tc358743_0: endpoint {
+					remote-endpoint = <&csi1_ep>;
+					clock-lanes = <0>;
+					data-lanes = <1 2>;
+					clock-noncontinuous;
+					link-frequencies =
+						/bits/ 64 <297000000>;
+				};
+			};
+		};
+	};
-- 
GitLab


From 0a9e4f12440a75b0dd5b7c199906317289d85d95 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:59:22 +0000
Subject: [PATCH 0198/1835] media: bcm2835-unicam: Driver for CCP2/CSI2 camera
 interface

Add driver for the Unicam camera receiver block on
BCM283x processors.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/platform/Kconfig                |    1 +
 drivers/media/platform/Makefile               |    2 +
 drivers/media/platform/bcm2835/Kconfig        |   14 +
 drivers/media/platform/bcm2835/Makefile       |    3 +
 .../media/platform/bcm2835/bcm2835-unicam.c   | 2101 +++++++++++++++++
 .../media/platform/bcm2835/vc4-regs-unicam.h  |  266 +++
 6 files changed, 2387 insertions(+)
 create mode 100644 drivers/media/platform/bcm2835/Kconfig
 create mode 100644 drivers/media/platform/bcm2835/Makefile
 create mode 100644 drivers/media/platform/bcm2835/bcm2835-unicam.c
 create mode 100644 drivers/media/platform/bcm2835/vc4-regs-unicam.h

diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 54fe90acb5b29..46dd31fa6befb 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -137,6 +137,7 @@ source "drivers/media/platform/am437x/Kconfig"
 source "drivers/media/platform/xilinx/Kconfig"
 source "drivers/media/platform/rcar-vin/Kconfig"
 source "drivers/media/platform/atmel/Kconfig"
+source "drivers/media/platform/bcm2835/Kconfig"
 
 config VIDEO_TI_CAL
 	tristate "TI CAL (Camera Adaptation Layer) driver"
diff --git a/drivers/media/platform/Makefile b/drivers/media/platform/Makefile
index 41322ab658027..6e3b708db11ce 100644
--- a/drivers/media/platform/Makefile
+++ b/drivers/media/platform/Makefile
@@ -96,3 +96,5 @@ obj-$(CONFIG_VIDEO_QCOM_VENUS)		+= qcom/venus/
 obj-y					+= meson/
 
 obj-y					+= cros-ec-cec/
+
+obj-y					+= bcm2835/
diff --git a/drivers/media/platform/bcm2835/Kconfig b/drivers/media/platform/bcm2835/Kconfig
new file mode 100644
index 0000000000000..dac4e92bbbb6d
--- /dev/null
+++ b/drivers/media/platform/bcm2835/Kconfig
@@ -0,0 +1,14 @@
+# Broadcom VideoCore4 V4L2 camera support
+
+config VIDEO_BCM2835_UNICAM
+	tristate "Broadcom BCM2835 Unicam video capture driver"
+	depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+	depends on ARCH_BCM2835 || COMPILE_TEST
+	select VIDEOBUF2_DMA_CONTIG
+	select V4L2_FWNODE
+	help
+	  Say Y here to enable V4L2 subdevice for CSI2 receiver.
+	  This is a V4L2 subdevice that interfaces directly to the VC4 peripheral.
+
+	   To compile this driver as a module, choose M here. The module
+	   will be called bcm2835-unicam.
diff --git a/drivers/media/platform/bcm2835/Makefile b/drivers/media/platform/bcm2835/Makefile
new file mode 100644
index 0000000000000..a98aba03598ab
--- /dev/null
+++ b/drivers/media/platform/bcm2835/Makefile
@@ -0,0 +1,3 @@
+# Makefile for BCM2835 Unicam driver
+
+obj-$(CONFIG_VIDEO_BCM2835_UNICAM) += bcm2835-unicam.o
diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
new file mode 100644
index 0000000000000..29c749a5293bf
--- /dev/null
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -0,0 +1,2101 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * BCM2835 Unicam capture Driver
+ *
+ * Copyright (C) 2017 - Raspberry Pi (Trading) Ltd.
+ *
+ * Dave Stevenson <dave.stevenson@raspberrypi.org>
+ *
+ * Based on TI am437x driver by Benoit Parrot and Lad, Prabhakar and
+ * TI CAL camera interface driver by Benoit Parrot.
+ *
+ *
+ * There are two camera drivers in the kernel for BCM283x - this one
+ * and bcm2835-camera (currently in staging).
+ *
+ * This driver directly controls the Unicam peripheral - there is no
+ * involvement with the VideoCore firmware. Unicam receives CSI-2 or
+ * CCP2 data and writes it into SDRAM. The only potential processing options are
+ * to repack Bayer data into an alternate format, and applying windowing.
+ * The repacking does not shift the data, so could repack V4L2_PIX_FMT_Sxxxx10P
+ * to V4L2_PIX_FMT_Sxxxx10, or V4L2_PIX_FMT_Sxxxx12P to V4L2_PIX_FMT_Sxxxx12,
+ * but not generically up to V4L2_PIX_FMT_Sxxxx16.
+ * Adding support for repacking and windowing may be added later.
+ *
+ * It should be possible to connect this driver to any sensor with a
+ * suitable output interface and V4L2 subdevice driver.
+ *
+ * bcm2835-camera uses the VideoCore firmware to control the sensor,
+ * Unicam, ISP, and all tuner control loops. Fully processed frames are
+ * delivered to the driver by the firmware. It only has sensor drivers
+ * for Omnivision OV5647, and Sony IMX219 sensors.
+ *
+ * The two drivers are mutually exclusive for the same Unicam instance.
+ * The VideoCore firmware checks the device tree configuration during boot.
+ * If it finds device tree nodes called csi0 or csi1 it will block the
+ * firmware from accessing the peripheral, and bcm2835-camera will
+ * not be able to stream data.
+ *
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/of_graph.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/videodev2.h>
+
+#include <media/v4l2-common.h>
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-dev.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-dv-timings.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-fwnode.h>
+#include <media/videobuf2-dma-contig.h>
+
+#include "vc4-regs-unicam.h"
+
+#define UNICAM_MODULE_NAME	"unicam"
+#define UNICAM_VERSION		"0.1.0"
+
+static int debug;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Debug level 0-3");
+
+#define unicam_dbg(level, dev, fmt, arg...)	\
+		v4l2_dbg(level, debug, &(dev)->v4l2_dev, fmt, ##arg)
+#define unicam_info(dev, fmt, arg...)	\
+		v4l2_info(&(dev)->v4l2_dev, fmt, ##arg)
+#define unicam_err(dev, fmt, arg...)	\
+		v4l2_err(&(dev)->v4l2_dev, fmt, ##arg)
+
+/*
+ * Stride is a 16 bit register, but also has to be a multiple of 16.
+ */
+#define BPL_ALIGNMENT		16
+#define MAX_BYTESPERLINE	((1 << 16) - BPL_ALIGNMENT)
+/*
+ * Max width is therefore determined by the max stride divided by
+ * the number of bits per pixel. Take 32bpp as a
+ * worst case.
+ * No imposed limit on the height, so adopt a square image for want
+ * of anything better.
+ */
+#define MAX_WIDTH	(MAX_BYTESPERLINE / 4)
+#define MAX_HEIGHT	MAX_WIDTH
+/* Define a nominal minimum image size */
+#define MIN_WIDTH	16
+#define MIN_HEIGHT	16
+/*
+ * Whilst Unicam doesn't require any additional padding on the image
+ * height, various other parts of the BCM283x frameworks require a multiple
+ * of 16.
+ * Seeing as image buffers are significantly larger than this extra
+ * padding, add it in order to simplify integration.
+ */
+#define HEIGHT_ALIGNMENT	16
+
+/*
+ * struct unicam_fmt - Unicam media bus format information
+ * @pixelformat: V4L2 pixel format FCC identifier.
+ * @code: V4L2 media bus format code.
+ * @depth: Bits per pixel (when stored in memory).
+ * @csi_dt: CSI data type.
+ */
+struct unicam_fmt {
+	u32	fourcc;
+	u32	code;
+	u8	depth;
+	u8	csi_dt;
+};
+
+static const struct unicam_fmt formats[] = {
+	/* YUV Formats */
+	{
+		.fourcc		= V4L2_PIX_FMT_YUYV,
+		.code		= MEDIA_BUS_FMT_YUYV8_2X8,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_UYVY,
+		.code		= MEDIA_BUS_FMT_UYVY8_2X8,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_YVYU,
+		.code		= MEDIA_BUS_FMT_YVYU8_2X8,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_VYUY,
+		.code		= MEDIA_BUS_FMT_VYUY8_2X8,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_YUYV,
+		.code		= MEDIA_BUS_FMT_YUYV8_1X16,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_UYVY,
+		.code		= MEDIA_BUS_FMT_UYVY8_1X16,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_YVYU,
+		.code		= MEDIA_BUS_FMT_YVYU8_1X16,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_VYUY,
+		.code		= MEDIA_BUS_FMT_VYUY8_1X16,
+		.depth		= 16,
+		.csi_dt		= 0x1e,
+	}, {
+	/* RGB Formats */
+		.fourcc		= V4L2_PIX_FMT_RGB565, /* gggbbbbb rrrrrggg */
+		.code		= MEDIA_BUS_FMT_RGB565_2X8_LE,
+		.depth		= 16,
+		.csi_dt		= 0x22,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_RGB565X, /* rrrrrggg gggbbbbb */
+		.code		= MEDIA_BUS_FMT_RGB565_2X8_BE,
+		.depth		= 16,
+		.csi_dt		= 0x22
+	}, {
+		.fourcc		= V4L2_PIX_FMT_RGB555, /* gggbbbbb arrrrrgg */
+		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_LE,
+		.depth		= 16,
+		.csi_dt		= 0x21,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_RGB555X, /* arrrrrgg gggbbbbb */
+		.code		= MEDIA_BUS_FMT_RGB555_2X8_PADHI_BE,
+		.depth		= 16,
+		.csi_dt		= 0x21,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_RGB24, /* rgb */
+		.code		= MEDIA_BUS_FMT_RGB888_1X24,
+		.depth		= 24,
+		.csi_dt		= 0x24,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_BGR24, /* bgr */
+		.code		= MEDIA_BUS_FMT_BGR888_1X24,
+		.depth		= 24,
+		.csi_dt		= 0x24,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_RGB32, /* argb */
+		.code		= MEDIA_BUS_FMT_ARGB8888_1X32,
+		.depth		= 32,
+		.csi_dt		= 0x0,
+	}, {
+	/* Bayer Formats */
+		.fourcc		= V4L2_PIX_FMT_SBGGR8,
+		.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
+		.depth		= 8,
+		.csi_dt		= 0x2a,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SGBRG8,
+		.code		= MEDIA_BUS_FMT_SGBRG8_1X8,
+		.depth		= 8,
+		.csi_dt		= 0x2a,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SGRBG8,
+		.code		= MEDIA_BUS_FMT_SGRBG8_1X8,
+		.depth		= 8,
+		.csi_dt		= 0x2a,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SRGGB8,
+		.code		= MEDIA_BUS_FMT_SRGGB8_1X8,
+		.depth		= 8,
+		.csi_dt		= 0x2a,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SBGGR10P,
+		.code		= MEDIA_BUS_FMT_SBGGR10_1X10,
+		.depth		= 10,
+		.csi_dt		= 0x2b,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SGBRG10P,
+		.code		= MEDIA_BUS_FMT_SGBRG10_1X10,
+		.depth		= 10,
+		.csi_dt		= 0x2b,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SGRBG10P,
+		.code		= MEDIA_BUS_FMT_SGRBG10_1X10,
+		.depth		= 10,
+		.csi_dt		= 0x2b,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SRGGB10P,
+		.code		= MEDIA_BUS_FMT_SRGGB10_1X10,
+		.depth		= 10,
+		.csi_dt		= 0x2b,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SBGGR12P,
+		.code		= MEDIA_BUS_FMT_SBGGR12_1X12,
+		.depth		= 12,
+		.csi_dt		= 0x2c,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SGBRG12P,
+		.code		= MEDIA_BUS_FMT_SGBRG12_1X12,
+		.depth		= 12,
+		.csi_dt		= 0x2c,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SGRBG12P,
+		.code		= MEDIA_BUS_FMT_SGRBG12_1X12,
+		.depth		= 12,
+		.csi_dt		= 0x2c,
+	}, {
+		.fourcc		= V4L2_PIX_FMT_SRGGB12P,
+		.code		= MEDIA_BUS_FMT_SRGGB12_1X12,
+		.depth		= 12,
+		.csi_dt		= 0x2c,
+	},
+	/*
+	 * 14 and 16 bit Bayer formats could be supported, but there are no V4L2
+	 * defines for 14bit packed Bayer, and no CSI2 data_type for raw 16.
+	 */
+};
+
+struct unicam_dmaqueue {
+	struct list_head	active;
+};
+
+struct unicam_buffer {
+	struct vb2_v4l2_buffer vb;
+	struct list_head list;
+};
+
+struct unicam_cfg {
+	/* peripheral base address */
+	void __iomem *base;
+	/* clock gating base address */
+	void __iomem *clk_gate_base;
+};
+
+#define MAX_POSSIBLE_PIX_FMTS (ARRAY_SIZE(formats))
+
+struct unicam_device {
+	/* V4l2 specific parameters */
+	/* Identifies video device for this channel */
+	struct video_device video_dev;
+	struct v4l2_ctrl_handler ctrl_handler;
+
+	struct v4l2_fwnode_endpoint endpoint;
+
+	struct v4l2_async_subdev asd;
+
+	/* unicam cfg */
+	struct unicam_cfg cfg;
+	/* clock handle */
+	struct clk *clock;
+	/* V4l2 device */
+	struct v4l2_device v4l2_dev;
+	/* parent device */
+	struct platform_device *pdev;
+	/* subdevice async Notifier */
+	struct v4l2_async_notifier notifier;
+	unsigned int sequence;
+
+	/* ptr to  sub device */
+	struct v4l2_subdev *sensor;
+	/* Pad config for the sensor */
+	struct v4l2_subdev_pad_config *sensor_config;
+	/* current input at the sub device */
+	int current_input;
+
+	/* Pointer pointing to current v4l2_buffer */
+	struct unicam_buffer *cur_frm;
+	/* Pointer pointing to next v4l2_buffer */
+	struct unicam_buffer *next_frm;
+
+	/* video capture */
+	const struct unicam_fmt	*fmt;
+	/* Used to store current pixel format */
+	struct v4l2_format v_fmt;
+	/* Used to store current mbus frame format */
+	struct v4l2_mbus_framefmt m_fmt;
+
+	struct unicam_fmt active_fmts[MAX_POSSIBLE_PIX_FMTS];
+	int num_active_fmt;
+	unsigned int virtual_channel;
+	enum v4l2_mbus_type bus_type;
+	/*
+	 * Stores bus.mipi_csi2.flags for CSI2 sensors, or
+	 * bus.mipi_csi1.strobe for CCP2.
+	 */
+	unsigned int bus_flags;
+	unsigned int max_data_lanes;
+	unsigned int active_data_lanes;
+
+	struct v4l2_rect crop;
+
+	/* Currently selected input on subdev */
+	int input;
+
+	/* Buffer queue used in video-buf */
+	struct vb2_queue buffer_queue;
+	/* Queue of filled frames */
+	struct unicam_dmaqueue dma_queue;
+	/* IRQ lock for DMA queue */
+	spinlock_t dma_queue_lock;
+	/* lock used to access this structure */
+	struct mutex lock;
+	/* Flag to denote that we are processing buffers */
+	int streaming;
+};
+
+/* Hardware access */
+#define clk_write(dev, val) writel((val) | 0x5a000000, (dev)->clk_gate_base)
+#define clk_read(dev) readl((dev)->clk_gate_base)
+
+#define reg_read(dev, offset) readl((dev)->base + (offset))
+#define reg_write(dev, offset, val) writel(val, (dev)->base + (offset))
+
+#define reg_read_field(dev, offset, mask) get_field(reg_read((dev), (offset), \
+						    mask))
+
+static inline int get_field(u32 value, u32 mask)
+{
+	return (value & mask) >> __ffs(mask);
+}
+
+static inline void set_field(u32 *valp, u32 field, u32 mask)
+{
+	u32 val = *valp;
+
+	val &= ~mask;
+	val |= (field << __ffs(mask)) & mask;
+	*valp = val;
+}
+
+static inline void reg_write_field(struct unicam_cfg *dev, u32 offset,
+				   u32 field, u32 mask)
+{
+	u32 val = reg_read((dev), (offset));
+
+	set_field(&val, field, mask);
+	reg_write((dev), (offset), val);
+}
+
+/* Power management functions */
+static inline int unicam_runtime_get(struct unicam_device *dev)
+{
+	int r;
+
+	r = pm_runtime_get_sync(&dev->pdev->dev);
+
+	return r;
+}
+
+static inline void unicam_runtime_put(struct unicam_device *dev)
+{
+	pm_runtime_put_sync(&dev->pdev->dev);
+}
+
+/* Format setup functions */
+static int find_mbus_depth_by_code(u32 code)
+{
+	const struct unicam_fmt *fmt;
+	unsigned int k;
+
+	for (k = 0; k < ARRAY_SIZE(formats); k++) {
+		fmt = &formats[k];
+		if (fmt->code == code)
+			return fmt->depth;
+	}
+
+	return 0;
+}
+
+static const struct unicam_fmt *find_format_by_code(struct unicam_device *dev,
+						    u32 code)
+{
+	const struct unicam_fmt *fmt;
+	unsigned int k;
+
+	for (k = 0; k < dev->num_active_fmt; k++) {
+		fmt = &dev->active_fmts[k];
+		if (fmt->code == code)
+			return fmt;
+	}
+
+	return NULL;
+}
+
+static const struct unicam_fmt *find_format_by_pix(struct unicam_device *dev,
+						   u32 pixelformat)
+{
+	const struct unicam_fmt *fmt;
+	unsigned int k;
+
+	for (k = 0; k < dev->num_active_fmt; k++) {
+		fmt = &dev->active_fmts[k];
+		if (fmt->fourcc == pixelformat)
+			return fmt;
+	}
+
+	return NULL;
+}
+
+static void dump_active_formats(struct unicam_device *dev)
+{
+	int i;
+
+	for (i = 0; i < dev->num_active_fmt; i++) {
+		unicam_dbg(3, dev, "active_fmt[%d] (%p) is code %04x, fourcc " V4L2_FOURCC_CONV ", depth %d\n",
+			   i, &dev->active_fmts[i], dev->active_fmts[i].code,
+			   V4L2_FOURCC_CONV_ARGS(dev->active_fmts[i].fourcc),
+			   dev->active_fmts[i].depth);
+	}
+}
+
+static inline unsigned int bytes_per_line(u32 width,
+					  const struct unicam_fmt *fmt)
+{
+	return ALIGN((width * fmt->depth) >> 3, BPL_ALIGNMENT);
+}
+
+static int __subdev_get_format(struct unicam_device *dev,
+			       struct v4l2_mbus_framefmt *fmt)
+{
+	struct v4l2_subdev_format sd_fmt = {0};
+	struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
+	int ret;
+
+	sd_fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+	sd_fmt.pad = 0;
+
+	ret = v4l2_subdev_call(dev->sensor, pad, get_fmt, dev->sensor_config,
+			       &sd_fmt);
+	if (ret < 0)
+		return ret;
+
+	*fmt = *mbus_fmt;
+
+	unicam_dbg(1, dev, "%s %dx%d code:%04x\n", __func__,
+		   fmt->width, fmt->height, fmt->code);
+
+	return 0;
+}
+
+static int __subdev_set_format(struct unicam_device *dev,
+			       struct v4l2_mbus_framefmt *fmt)
+{
+	struct v4l2_subdev_format sd_fmt = {
+		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+	};
+	struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
+	int ret;
+
+	*mbus_fmt = *fmt;
+
+	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
+			       &sd_fmt);
+	if (ret < 0)
+		return ret;
+
+	unicam_dbg(1, dev, "%s %dx%d code:%04x\n", __func__,
+		   fmt->width, fmt->height, fmt->code);
+
+	return 0;
+}
+
+static int unicam_calc_format_size_bpl(struct unicam_device *dev,
+				       const struct unicam_fmt *fmt,
+				       struct v4l2_format *f)
+{
+	unsigned int min_bytesperline;
+
+	v4l_bound_align_image(&f->fmt.pix.width, MIN_WIDTH, MAX_WIDTH, 2,
+			      &f->fmt.pix.height, MIN_HEIGHT, MAX_HEIGHT, 0,
+			      0);
+
+	min_bytesperline = bytes_per_line(f->fmt.pix.width, fmt);
+
+	if (f->fmt.pix.bytesperline > min_bytesperline &&
+	    f->fmt.pix.bytesperline <= MAX_BYTESPERLINE)
+		f->fmt.pix.bytesperline = ALIGN(f->fmt.pix.bytesperline,
+						BPL_ALIGNMENT);
+	else
+		f->fmt.pix.bytesperline = min_bytesperline;
+
+	/* Align height up for compatibility with other hardware blocks */
+	f->fmt.pix.sizeimage = ALIGN(f->fmt.pix.height, HEIGHT_ALIGNMENT) *
+			       f->fmt.pix.bytesperline;
+
+	unicam_dbg(3, dev, "%s: fourcc: " V4L2_FOURCC_CONV " size: %dx%d bpl:%d img_size:%d\n",
+		   __func__,
+		   V4L2_FOURCC_CONV_ARGS(f->fmt.pix.pixelformat),
+		   f->fmt.pix.width, f->fmt.pix.height,
+		   f->fmt.pix.bytesperline, f->fmt.pix.sizeimage);
+
+	return 0;
+}
+
+static int unicam_reset_format(struct unicam_device *dev)
+{
+	struct v4l2_mbus_framefmt mbus_fmt;
+	int ret;
+
+	ret = __subdev_get_format(dev, &mbus_fmt);
+	if (ret) {
+		unicam_err(dev, "Failed to get_format - ret %d\n", ret);
+		return ret;
+	}
+
+	if (mbus_fmt.code != dev->fmt->code) {
+		unicam_err(dev, "code mismatch - fmt->code %08x, mbus_fmt.code %08x\n",
+			   dev->fmt->code, mbus_fmt.code);
+		return ret;
+	}
+
+	v4l2_fill_pix_format(&dev->v_fmt.fmt.pix, &mbus_fmt);
+	dev->v_fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+
+	unicam_calc_format_size_bpl(dev, dev->fmt, &dev->v_fmt);
+
+	dev->m_fmt = mbus_fmt;
+
+	return 0;
+}
+
+static void unicam_wr_dma_addr(struct unicam_device *dev, unsigned int dmaaddr)
+{
+	unicam_dbg(1, dev, "wr_dma_addr %08x-%08x\n",
+		   dmaaddr, dmaaddr + dev->v_fmt.fmt.pix.sizeimage);
+	reg_write(&dev->cfg, UNICAM_IBSA0, dmaaddr);
+	reg_write(&dev->cfg, UNICAM_IBEA0,
+		  dmaaddr + dev->v_fmt.fmt.pix.sizeimage);
+}
+
+static inline void unicam_schedule_next_buffer(struct unicam_device *dev)
+{
+	struct unicam_dmaqueue *dma_q = &dev->dma_queue;
+	struct unicam_buffer *buf;
+	dma_addr_t addr;
+
+	buf = list_entry(dma_q->active.next, struct unicam_buffer, list);
+	dev->next_frm = buf;
+	list_del(&buf->list);
+
+	addr = vb2_dma_contig_plane_dma_addr(&buf->vb.vb2_buf, 0);
+	unicam_wr_dma_addr(dev, addr);
+}
+
+static inline void unicam_process_buffer_complete(struct unicam_device *dev)
+{
+	dev->cur_frm->vb.field = dev->m_fmt.field;
+	dev->cur_frm->vb.sequence = dev->sequence++;
+
+	vb2_buffer_done(&dev->cur_frm->vb.vb2_buf, VB2_BUF_STATE_DONE);
+	dev->cur_frm = dev->next_frm;
+}
+
+/*
+ * unicam_isr : ISR handler for unicam capture
+ * @irq: irq number
+ * @dev_id: dev_id ptr
+ *
+ * It changes status of the captured buffer, takes next buffer from the queue
+ * and sets its address in unicam registers
+ */
+static irqreturn_t unicam_isr(int irq, void *dev)
+{
+	struct unicam_device *unicam = (struct unicam_device *)dev;
+	struct unicam_cfg *cfg = &unicam->cfg;
+	struct unicam_dmaqueue *dma_q = &unicam->dma_queue;
+	int ista, sta;
+
+	/*
+	 * Don't service interrupts if not streaming.
+	 * Avoids issues if the VPU should enable the
+	 * peripheral without the kernel knowing (that
+	 * shouldn't happen, but causes issues if it does).
+	 */
+	if (!unicam->streaming)
+		return IRQ_HANDLED;
+
+	sta = reg_read(cfg, UNICAM_STA);
+	/* Write value back to clear the interrupts */
+	reg_write(cfg, UNICAM_STA, sta);
+
+	ista = reg_read(cfg, UNICAM_ISTA);
+	/* Write value back to clear the interrupts */
+	reg_write(cfg, UNICAM_ISTA, ista);
+
+	if (!(sta && (UNICAM_IS | UNICAM_PI0)))
+		return IRQ_HANDLED;
+
+	if (ista & UNICAM_FSI) {
+		/*
+		 * Timestamp is to be when the first data byte was captured,
+		 * aka frame start.
+		 */
+		if (unicam->cur_frm)
+			unicam->cur_frm->vb.vb2_buf.timestamp = ktime_get_ns();
+	}
+	if (ista & UNICAM_FEI || sta & UNICAM_PI0) {
+		/*
+		 * Ensure we have swapped buffers already as we can't
+		 * stop the peripheral. Overwrite the frame we've just
+		 * captured instead.
+		 */
+		if (unicam->cur_frm && unicam->cur_frm != unicam->next_frm)
+			unicam_process_buffer_complete(unicam);
+	}
+
+	if (ista & (UNICAM_FSI | UNICAM_LCI)) {
+		spin_lock(&unicam->dma_queue_lock);
+		if (!list_empty(&dma_q->active) &&
+		    unicam->cur_frm == unicam->next_frm)
+			unicam_schedule_next_buffer(unicam);
+		spin_unlock(&unicam->dma_queue_lock);
+	}
+
+	if (reg_read(&unicam->cfg, UNICAM_ICTL) & UNICAM_FCM) {
+		/* Switch out of trigger mode if selected */
+		reg_write_field(&unicam->cfg, UNICAM_ICTL, 1, UNICAM_TFC);
+		reg_write_field(&unicam->cfg, UNICAM_ICTL, 0, UNICAM_FCM);
+	}
+	return IRQ_HANDLED;
+}
+
+static int unicam_querycap(struct file *file, void *priv,
+			   struct v4l2_capability *cap)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	strlcpy(cap->driver, UNICAM_MODULE_NAME, sizeof(cap->driver));
+	strlcpy(cap->card, UNICAM_MODULE_NAME, sizeof(cap->card));
+
+	snprintf(cap->bus_info, sizeof(cap->bus_info),
+		 "platform:%s", dev->v4l2_dev.name);
+
+	return 0;
+}
+
+static int unicam_enum_fmt_vid_cap(struct file *file, void  *priv,
+				   struct v4l2_fmtdesc *f)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	const struct unicam_fmt *fmt = NULL;
+
+	if (f->index >= dev->num_active_fmt)
+		return -EINVAL;
+
+	fmt = &dev->active_fmts[f->index];
+
+	f->pixelformat = fmt->fourcc;
+
+	return 0;
+}
+
+static int unicam_g_fmt_vid_cap(struct file *file, void *priv,
+				struct v4l2_format *f)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	*f = dev->v_fmt;
+
+	return 0;
+}
+
+static int unicam_try_fmt_vid_cap(struct file *file, void *priv,
+				  struct v4l2_format *f)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	const struct unicam_fmt *fmt;
+	struct v4l2_subdev_format sd_fmt = {
+		.which = V4L2_SUBDEV_FORMAT_TRY,
+	};
+	struct v4l2_mbus_framefmt *mbus_fmt = &sd_fmt.format;
+	int ret;
+
+	fmt = find_format_by_pix(dev, f->fmt.pix.pixelformat);
+	if (!fmt) {
+		unicam_dbg(3, dev, "Fourcc format (0x%08x) not found. Use default of %08X\n",
+			   f->fmt.pix.pixelformat, dev->active_fmts[0].fourcc);
+
+		/* Just get the first one enumerated */
+		fmt = &dev->active_fmts[0];
+		f->fmt.pix.pixelformat = fmt->fourcc;
+	}
+
+	v4l2_fill_mbus_format(mbus_fmt, &f->fmt.pix, fmt->code);
+	/*
+	 * No support for receiving interlaced video, so never
+	 * request it from the sensor subdev.
+	 */
+	mbus_fmt->field = V4L2_FIELD_NONE;
+
+	ret = v4l2_subdev_call(dev->sensor, pad, set_fmt, dev->sensor_config,
+			       &sd_fmt);
+	if (ret && ret != -ENOIOCTLCMD && ret != -ENODEV)
+		return ret;
+
+	if (mbus_fmt->field != V4L2_FIELD_NONE)
+		unicam_info(dev, "Sensor trying to send interlaced video - results may be unpredictable\n");
+
+	v4l2_fill_pix_format(&f->fmt.pix, &sd_fmt.format);
+	/*
+	 * Use current colorspace for now, it will get
+	 * updated properly during s_fmt
+	 */
+	f->fmt.pix.colorspace = dev->v_fmt.fmt.pix.colorspace;
+	return unicam_calc_format_size_bpl(dev, fmt, f);
+}
+
+static int unicam_s_fmt_vid_cap(struct file *file, void *priv,
+				struct v4l2_format *f)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	struct vb2_queue *q = &dev->buffer_queue;
+	const struct unicam_fmt *fmt;
+	struct v4l2_mbus_framefmt mbus_fmt = {0};
+	int ret;
+
+	if (vb2_is_busy(q))
+		return -EBUSY;
+
+	ret = unicam_try_fmt_vid_cap(file, priv, f);
+	if (ret < 0)
+		return ret;
+
+	fmt = find_format_by_pix(dev, f->fmt.pix.pixelformat);
+	if (!fmt) {
+		/* Unknown pixel format - adopt a default */
+		fmt = &dev->active_fmts[0];
+		f->fmt.pix.pixelformat = fmt->fourcc;
+		return -EINVAL;
+	}
+
+	v4l2_fill_mbus_format(&mbus_fmt, &f->fmt.pix, fmt->code);
+
+	ret = __subdev_set_format(dev, &mbus_fmt);
+	if (ret) {
+		unicam_dbg(3, dev, "%s __subdev_set_format failed %d\n",
+			   __func__, ret);
+		return ret;
+	}
+
+	/* Just double check nothing has gone wrong */
+	if (mbus_fmt.code != fmt->code) {
+		unicam_dbg(3, dev,
+			   "%s subdev changed format on us, this should not happen\n",
+			   __func__);
+		return -EINVAL;
+	}
+
+	dev->fmt = fmt;
+	dev->v_fmt.fmt.pix.pixelformat = f->fmt.pix.pixelformat;
+	dev->v_fmt.fmt.pix.bytesperline = f->fmt.pix.bytesperline;
+	unicam_reset_format(dev);
+
+	unicam_dbg(3, dev, "%s %dx%d, mbus_fmt %08X, V4L2 pix " V4L2_FOURCC_CONV ".\n",
+		   __func__, dev->v_fmt.fmt.pix.width,
+		   dev->v_fmt.fmt.pix.height, mbus_fmt.code,
+		   V4L2_FOURCC_CONV_ARGS(dev->v_fmt.fmt.pix.pixelformat));
+
+	*f = dev->v_fmt;
+
+	return 0;
+}
+
+static int unicam_queue_setup(struct vb2_queue *vq,
+			      unsigned int *nbuffers,
+			      unsigned int *nplanes,
+			      unsigned int sizes[],
+			      struct device *alloc_devs[])
+{
+	struct unicam_device *dev = vb2_get_drv_priv(vq);
+	unsigned int size = dev->v_fmt.fmt.pix.sizeimage;
+
+	if (vq->num_buffers + *nbuffers < 3)
+		*nbuffers = 3 - vq->num_buffers;
+
+	if (*nplanes) {
+		if (sizes[0] < size) {
+			unicam_err(dev, "sizes[0] %i < size %u\n", sizes[0],
+				   size);
+			return -EINVAL;
+		}
+		size = sizes[0];
+	}
+
+	*nplanes = 1;
+	sizes[0] = size;
+
+	return 0;
+}
+
+static int unicam_buffer_prepare(struct vb2_buffer *vb)
+{
+	struct unicam_device *dev = vb2_get_drv_priv(vb->vb2_queue);
+	struct unicam_buffer *buf = container_of(vb, struct unicam_buffer,
+					      vb.vb2_buf);
+	unsigned long size;
+
+	if (WARN_ON(!dev->fmt))
+		return -EINVAL;
+
+	size = dev->v_fmt.fmt.pix.sizeimage;
+	if (vb2_plane_size(vb, 0) < size) {
+		unicam_err(dev, "data will not fit into plane (%lu < %lu)\n",
+			   vb2_plane_size(vb, 0), size);
+		return -EINVAL;
+	}
+
+	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, size);
+	return 0;
+}
+
+static void unicam_buffer_queue(struct vb2_buffer *vb)
+{
+	struct unicam_device *dev = vb2_get_drv_priv(vb->vb2_queue);
+	struct unicam_buffer *buf = container_of(vb, struct unicam_buffer,
+					      vb.vb2_buf);
+	struct unicam_dmaqueue *dma_queue = &dev->dma_queue;
+	unsigned long flags = 0;
+
+	/* recheck locking */
+	spin_lock_irqsave(&dev->dma_queue_lock, flags);
+	list_add_tail(&buf->list, &dma_queue->active);
+	spin_unlock_irqrestore(&dev->dma_queue_lock, flags);
+}
+
+static void unicam_wr_dma_config(struct unicam_device *dev,
+				 unsigned int stride)
+{
+	reg_write(&dev->cfg, UNICAM_IBLS, stride);
+}
+
+static void unicam_set_packing_config(struct unicam_device *dev)
+{
+	int mbus_depth = find_mbus_depth_by_code(dev->fmt->code);
+	int v4l2_depth = dev->fmt->depth;
+	int pack, unpack;
+	u32 val;
+
+	if (mbus_depth == v4l2_depth) {
+		unpack = UNICAM_PUM_NONE;
+		pack = UNICAM_PPM_NONE;
+	} else {
+		switch (mbus_depth) {
+		case 8:
+			unpack = UNICAM_PUM_UNPACK8;
+			break;
+		case 10:
+			unpack = UNICAM_PUM_UNPACK10;
+			break;
+		case 12:
+			unpack = UNICAM_PUM_UNPACK12;
+			break;
+		case 14:
+			unpack = UNICAM_PUM_UNPACK14;
+			break;
+		case 16:
+			unpack = UNICAM_PUM_UNPACK16;
+			break;
+		default:
+			unpack = UNICAM_PUM_NONE;
+			break;
+		}
+		switch (v4l2_depth) {
+		case 8:
+			pack = UNICAM_PPM_PACK8;
+			break;
+		case 10:
+			pack = UNICAM_PPM_PACK10;
+			break;
+		case 12:
+			pack = UNICAM_PPM_PACK12;
+			break;
+		case 14:
+			pack = UNICAM_PPM_PACK14;
+			break;
+		case 16:
+			pack = UNICAM_PPM_PACK16;
+			break;
+		default:
+			pack = UNICAM_PPM_NONE;
+			break;
+		}
+	}
+
+	val = 0;
+	set_field(&val, 2, UNICAM_DEBL_MASK);
+	set_field(&val, unpack, UNICAM_PUM_MASK);
+	set_field(&val, pack, UNICAM_PPM_MASK);
+	reg_write(&dev->cfg, UNICAM_IPIPE, val);
+}
+
+static void unicam_cfg_image_id(struct unicam_device *dev)
+{
+	struct unicam_cfg *cfg = &dev->cfg;
+
+	if (dev->bus_type == V4L2_MBUS_CSI2) {
+		/* CSI2 mode */
+		reg_write(cfg, UNICAM_IDI0,
+			  (dev->virtual_channel << 6) | dev->fmt->csi_dt);
+	} else {
+		/* CCP2 mode */
+		reg_write(cfg, UNICAM_IDI0, (0x80 | dev->fmt->csi_dt));
+	}
+}
+
+void unicam_start_rx(struct unicam_device *dev, unsigned long addr)
+{
+	struct unicam_cfg *cfg = &dev->cfg;
+	int line_int_freq = dev->v_fmt.fmt.pix.height >> 2;
+	unsigned int i;
+	u32 val;
+
+	if (line_int_freq < 128)
+		line_int_freq = 128;
+
+	/* Enable lane clocks */
+	val = 1;
+	for (i = 0; i < dev->active_data_lanes; i++)
+		val = val << 2 | 1;
+	clk_write(cfg, val);
+
+	/* Basic init */
+	reg_write(cfg, UNICAM_CTRL, UNICAM_MEM);
+
+	/* Enable analogue control, and leave in reset. */
+	val = UNICAM_AR;
+	set_field(&val, 7, UNICAM_CTATADJ_MASK);
+	set_field(&val, 7, UNICAM_PTATADJ_MASK);
+	reg_write(cfg, UNICAM_ANA, val);
+	usleep_range(1000, 2000);
+
+	/* Come out of reset */
+	reg_write_field(cfg, UNICAM_ANA, 0, UNICAM_AR);
+
+	/* Peripheral reset */
+	reg_write_field(cfg, UNICAM_CTRL, 1, UNICAM_CPR);
+	reg_write_field(cfg, UNICAM_CTRL, 0, UNICAM_CPR);
+
+	reg_write_field(cfg, UNICAM_CTRL, 0, UNICAM_CPE);
+
+	/* Enable Rx control. */
+	val = reg_read(cfg, UNICAM_CTRL);
+	if (dev->bus_type == V4L2_MBUS_CSI2) {
+		set_field(&val, UNICAM_CPM_CSI2, UNICAM_CPM_MASK);
+		set_field(&val, UNICAM_DCM_STROBE, UNICAM_DCM_MASK);
+	} else {
+		set_field(&val, UNICAM_CPM_CCP2, UNICAM_CPM_MASK);
+		set_field(&val, dev->bus_flags, UNICAM_DCM_MASK);
+	}
+	/* Packet framer timeout */
+	set_field(&val, 0xf, UNICAM_PFT_MASK);
+	set_field(&val, 128, UNICAM_OET_MASK);
+	reg_write(cfg, UNICAM_CTRL, val);
+
+	reg_write(cfg, UNICAM_IHWIN, 0);
+	reg_write(cfg, UNICAM_IVWIN, 0);
+
+	/* AXI bus access QoS setup */
+	val = reg_read(&dev->cfg, UNICAM_PRI);
+	set_field(&val, 0, UNICAM_BL_MASK);
+	set_field(&val, 0, UNICAM_BS_MASK);
+	set_field(&val, 0xe, UNICAM_PP_MASK);
+	set_field(&val, 8, UNICAM_NP_MASK);
+	set_field(&val, 2, UNICAM_PT_MASK);
+	set_field(&val, 1, UNICAM_PE);
+	reg_write(cfg, UNICAM_PRI, val);
+
+	reg_write_field(cfg, UNICAM_ANA, 0, UNICAM_DDL);
+
+	/* Always start in trigger frame capture mode (UNICAM_FCM set) */
+	val = UNICAM_FSIE | UNICAM_FEIE | UNICAM_FCM;
+	set_field(&val,  line_int_freq, UNICAM_LCIE_MASK);
+	reg_write(cfg, UNICAM_ICTL, val);
+	reg_write(cfg, UNICAM_STA, UNICAM_STA_MASK_ALL);
+	reg_write(cfg, UNICAM_ISTA, UNICAM_ISTA_MASK_ALL);
+
+	/* tclk_term_en */
+	reg_write_field(cfg, UNICAM_CLT, 2, UNICAM_CLT1_MASK);
+	/* tclk_settle */
+	reg_write_field(cfg, UNICAM_CLT, 6, UNICAM_CLT2_MASK);
+	/* td_term_en */
+	reg_write_field(cfg, UNICAM_DLT, 2, UNICAM_DLT1_MASK);
+	/* ths_settle */
+	reg_write_field(cfg, UNICAM_DLT, 6, UNICAM_DLT2_MASK);
+	/* trx_enable */
+	reg_write_field(cfg, UNICAM_DLT, 0, UNICAM_DLT3_MASK);
+
+	reg_write_field(cfg, UNICAM_CTRL, 0, UNICAM_SOE);
+
+	/* Packet compare setup - required to avoid missing frame ends */
+	val = 0;
+	set_field(&val, 1, UNICAM_PCE);
+	set_field(&val, 1, UNICAM_GI);
+	set_field(&val, 1, UNICAM_CPH);
+	set_field(&val, 0, UNICAM_PCVC_MASK);
+	set_field(&val, 1, UNICAM_PCDT_MASK);
+	reg_write(cfg, UNICAM_CMP0, val);
+
+	/* Enable clock lane and set up terminations */
+	val = 0;
+	if (dev->bus_type == V4L2_MBUS_CSI2) {
+		/* CSI2 */
+		set_field(&val, 1, UNICAM_CLE);
+		set_field(&val, 1, UNICAM_CLLPE);
+		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
+			set_field(&val, 1, UNICAM_CLTRE);
+			set_field(&val, 1, UNICAM_CLHSE);
+		}
+	} else {
+		/* CCP2 */
+		set_field(&val, 1, UNICAM_CLE);
+		set_field(&val, 1, UNICAM_CLHSE);
+		set_field(&val, 1, UNICAM_CLTRE);
+	}
+	reg_write(cfg, UNICAM_CLK, val);
+
+	/*
+	 * Enable required data lanes with appropriate terminations.
+	 * The same value needs to be written to UNICAM_DATn registers for
+	 * the active lanes, and 0 for inactive ones.
+	 */
+	val = 0;
+	if (dev->bus_type == V4L2_MBUS_CSI2) {
+		/* CSI2 */
+		set_field(&val, 1, UNICAM_DLE);
+		set_field(&val, 1, UNICAM_DLLPE);
+		if (dev->bus_flags & V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) {
+			set_field(&val, 1, UNICAM_DLTRE);
+			set_field(&val, 1, UNICAM_DLHSE);
+		}
+	} else {
+		/* CCP2 */
+		set_field(&val, 1, UNICAM_DLE);
+		set_field(&val, 1, UNICAM_DLHSE);
+		set_field(&val, 1, UNICAM_DLTRE);
+	}
+	reg_write(cfg, UNICAM_DAT0, val);
+
+	if (dev->active_data_lanes == 1)
+		val = 0;
+	reg_write(cfg, UNICAM_DAT1, val);
+
+	if (dev->max_data_lanes > 2) {
+		/*
+		 * Registers UNICAM_DAT2 and UNICAM_DAT3 only valid if the
+		 * instance supports more than 2 data lanes.
+		 */
+		if (dev->active_data_lanes == 2)
+			val = 0;
+		reg_write(cfg, UNICAM_DAT2, val);
+
+		if (dev->active_data_lanes == 3)
+			val = 0;
+		reg_write(cfg, UNICAM_DAT3, val);
+	}
+
+	unicam_wr_dma_config(dev, dev->v_fmt.fmt.pix.bytesperline);
+	unicam_wr_dma_addr(dev, addr);
+	unicam_set_packing_config(dev);
+	unicam_cfg_image_id(dev);
+
+	/* Disabled embedded data */
+	val = 0;
+	set_field(&val, 0, UNICAM_EDL_MASK);
+	reg_write(cfg, UNICAM_DCS, val);
+
+	val = reg_read(cfg, UNICAM_MISC);
+	set_field(&val, 1, UNICAM_FL0);
+	set_field(&val, 1, UNICAM_FL1);
+	reg_write(cfg, UNICAM_MISC, val);
+
+	/* Enable peripheral */
+	reg_write_field(cfg, UNICAM_CTRL, 1, UNICAM_CPE);
+
+	/* Load image pointers */
+	reg_write_field(cfg, UNICAM_ICTL, 1, UNICAM_LIP_MASK);
+
+	/*
+	 * Enable trigger only for the first frame to
+	 * sync correctly to the FS from the source.
+	 */
+	reg_write_field(cfg, UNICAM_ICTL, 1, UNICAM_TFC);
+}
+
+static void unicam_disable(struct unicam_device *dev)
+{
+	struct unicam_cfg *cfg = &dev->cfg;
+
+	/* Analogue lane control disable */
+	reg_write_field(cfg, UNICAM_ANA, 1, UNICAM_DDL);
+
+	/* Stop the output engine */
+	reg_write_field(cfg, UNICAM_CTRL, 1, UNICAM_SOE);
+
+	/* Disable the data lanes. */
+	reg_write(cfg, UNICAM_DAT0, 0);
+	reg_write(cfg, UNICAM_DAT1, 0);
+
+	if (dev->max_data_lanes > 2) {
+		reg_write(cfg, UNICAM_DAT2, 0);
+		reg_write(cfg, UNICAM_DAT3, 0);
+	}
+
+	/* Peripheral reset */
+	reg_write_field(cfg, UNICAM_CTRL, 1, UNICAM_CPR);
+	usleep_range(50, 100);
+	reg_write_field(cfg, UNICAM_CTRL, 0, UNICAM_CPR);
+
+	/* Disable peripheral */
+	reg_write_field(cfg, UNICAM_CTRL, 0, UNICAM_CPE);
+
+	/* Disable all lane clocks */
+	clk_write(cfg, 0);
+}
+
+static int unicam_start_streaming(struct vb2_queue *vq, unsigned int count)
+{
+	struct unicam_device *dev = vb2_get_drv_priv(vq);
+	struct unicam_dmaqueue *dma_q = &dev->dma_queue;
+	struct unicam_buffer *buf, *tmp;
+	unsigned long addr = 0;
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&dev->dma_queue_lock, flags);
+	buf = list_entry(dma_q->active.next, struct unicam_buffer, list);
+	dev->cur_frm = buf;
+	dev->next_frm = buf;
+	list_del(&buf->list);
+	spin_unlock_irqrestore(&dev->dma_queue_lock, flags);
+
+	addr = vb2_dma_contig_plane_dma_addr(&dev->cur_frm->vb.vb2_buf, 0);
+	dev->sequence = 0;
+
+	ret = unicam_runtime_get(dev);
+	if (ret < 0) {
+		unicam_dbg(3, dev, "unicam_runtime_get failed\n");
+		goto err_release_buffers;
+	}
+
+	dev->active_data_lanes = dev->max_data_lanes;
+	if (dev->bus_type == V4L2_MBUS_CSI2 &&
+	    v4l2_subdev_has_op(dev->sensor, video, g_mbus_config)) {
+		struct v4l2_mbus_config mbus_config;
+
+		ret = v4l2_subdev_call(dev->sensor, video, g_mbus_config,
+				       &mbus_config);
+		if (ret < 0) {
+			unicam_dbg(3, dev, "g_mbus_config failed\n");
+			goto err_pm_put;
+		}
+
+		dev->active_data_lanes =
+			(mbus_config.flags & V4L2_MBUS_CSI2_LANE_MASK) >>
+					__ffs(V4L2_MBUS_CSI2_LANE_MASK);
+		if (!dev->active_data_lanes)
+			dev->active_data_lanes = dev->max_data_lanes;
+	}
+	if (dev->active_data_lanes > dev->max_data_lanes) {
+		unicam_err(dev, "Device has requested %u data lanes, which is >%u configured in DT\n",
+			   dev->active_data_lanes, dev->max_data_lanes);
+		ret = -EINVAL;
+		goto err_pm_put;
+	}
+
+	unicam_dbg(1, dev, "Running with %u data lanes\n",
+		   dev->active_data_lanes);
+
+	ret = clk_set_rate(dev->clock, 100 * 1000 * 1000);
+	if (ret) {
+		unicam_err(dev, "failed to set up clock\n");
+		goto err_pm_put;
+	}
+
+	ret = clk_prepare_enable(dev->clock);
+	if (ret) {
+		unicam_err(dev, "Failed to enable CSI clock: %d\n", ret);
+		goto err_pm_put;
+	}
+	ret = v4l2_subdev_call(dev->sensor, core, s_power, 1);
+	if (ret < 0 && ret != -ENOIOCTLCMD) {
+		unicam_err(dev, "power on failed in subdev\n");
+		goto err_clock_unprepare;
+	}
+	dev->streaming = 1;
+
+	unicam_start_rx(dev, addr);
+
+	ret = v4l2_subdev_call(dev->sensor, video, s_stream, 1);
+	if (ret < 0) {
+		unicam_err(dev, "stream on failed in subdev\n");
+		goto err_disable_unicam;
+	}
+
+	return 0;
+
+err_disable_unicam:
+	unicam_disable(dev);
+	v4l2_subdev_call(dev->sensor, core, s_power, 0);
+err_clock_unprepare:
+	clk_disable_unprepare(dev->clock);
+err_pm_put:
+	unicam_runtime_put(dev);
+err_release_buffers:
+	list_for_each_entry_safe(buf, tmp, &dma_q->active, list) {
+		list_del(&buf->list);
+		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_QUEUED);
+	}
+	if (dev->cur_frm != dev->next_frm)
+		vb2_buffer_done(&dev->next_frm->vb.vb2_buf,
+				VB2_BUF_STATE_QUEUED);
+	vb2_buffer_done(&dev->cur_frm->vb.vb2_buf, VB2_BUF_STATE_QUEUED);
+	dev->next_frm = NULL;
+	dev->cur_frm = NULL;
+
+	return ret;
+}
+
+static void unicam_stop_streaming(struct vb2_queue *vq)
+{
+	struct unicam_device *dev = vb2_get_drv_priv(vq);
+	struct unicam_dmaqueue *dma_q = &dev->dma_queue;
+	struct unicam_buffer *buf, *tmp;
+	unsigned long flags;
+
+	if (v4l2_subdev_call(dev->sensor, video, s_stream, 0) < 0)
+		unicam_err(dev, "stream off failed in subdev\n");
+
+	unicam_disable(dev);
+
+	/* Release all active buffers */
+	spin_lock_irqsave(&dev->dma_queue_lock, flags);
+	list_for_each_entry_safe(buf, tmp, &dma_q->active, list) {
+		list_del(&buf->list);
+		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+	}
+
+	if (dev->cur_frm == dev->next_frm) {
+		vb2_buffer_done(&dev->cur_frm->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+	} else {
+		vb2_buffer_done(&dev->cur_frm->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+		vb2_buffer_done(&dev->next_frm->vb.vb2_buf,
+				VB2_BUF_STATE_ERROR);
+	}
+	dev->cur_frm = NULL;
+	dev->next_frm = NULL;
+	spin_unlock_irqrestore(&dev->dma_queue_lock, flags);
+
+	if (v4l2_subdev_has_op(dev->sensor, core, s_power)) {
+		if (v4l2_subdev_call(dev->sensor, core, s_power, 0) < 0)
+			unicam_err(dev, "power off failed in subdev\n");
+	}
+
+	clk_disable_unprepare(dev->clock);
+	unicam_runtime_put(dev);
+}
+
+static int unicam_enum_input(struct file *file, void *priv,
+			     struct v4l2_input *inp)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	if (inp->index != 0)
+		return -EINVAL;
+
+	inp->type = V4L2_INPUT_TYPE_CAMERA;
+	if (v4l2_subdev_has_op(dev->sensor, video, s_dv_timings)) {
+		inp->capabilities = V4L2_IN_CAP_DV_TIMINGS;
+		inp->std = 0;
+	} else if (v4l2_subdev_has_op(dev->sensor, video, s_std)) {
+		inp->capabilities = V4L2_IN_CAP_STD;
+		if (v4l2_subdev_call(dev->sensor, video, g_tvnorms, &inp->std)
+					< 0)
+			inp->std = V4L2_STD_ALL;
+	} else {
+		inp->capabilities = 0;
+		inp->std = 0;
+	}
+	sprintf(inp->name, "Camera 0");
+	return 0;
+}
+
+static int unicam_g_input(struct file *file, void *priv, unsigned int *i)
+{
+	*i = 0;
+
+	return 0;
+}
+
+static int unicam_s_input(struct file *file, void *priv, unsigned int i)
+{
+	/*
+	 * FIXME: Ideally we would like to be able to query the source
+	 * subdevice for information over the input connectors it supports,
+	 * and map that through in to a call to video_ops->s_routing.
+	 * There is no infrastructure support for defining that within
+	 * devicetree at present. Until that is implemented we can't
+	 * map a user physical connector number to s_routing input number.
+	 */
+	if (i > 0)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int unicam_querystd(struct file *file, void *priv,
+			   v4l2_std_id *std)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, video, querystd, std);
+}
+
+static int unicam_g_std(struct file *file, void *priv, v4l2_std_id *std)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, video, g_std, std);
+}
+
+static int unicam_s_std(struct file *file, void *priv, v4l2_std_id std)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	int ret;
+	v4l2_std_id current_std;
+
+	ret = v4l2_subdev_call(dev->sensor, video, g_std, &current_std);
+	if (ret)
+		return ret;
+
+	if (std == current_std)
+		return 0;
+
+	if (vb2_is_busy(&dev->buffer_queue))
+		return -EBUSY;
+
+	ret = v4l2_subdev_call(dev->sensor, video, s_std, std);
+
+	/* Force recomputation of bytesperline */
+	dev->v_fmt.fmt.pix.bytesperline = 0;
+
+	unicam_reset_format(dev);
+
+	return ret;
+}
+
+static int unicam_s_edid(struct file *file, void *priv, struct v4l2_edid *edid)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, pad, set_edid, edid);
+}
+
+static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
+}
+
+static int unicam_g_dv_timings(struct file *file, void *priv,
+			       struct v4l2_dv_timings *timings)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, video, g_dv_timings, timings);
+}
+
+static int unicam_s_dv_timings(struct file *file, void *priv,
+			       struct v4l2_dv_timings *timings)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	struct v4l2_dv_timings current_timings;
+	int ret;
+
+	ret = v4l2_subdev_call(dev->sensor, video, g_dv_timings,
+			       &current_timings);
+
+	if (v4l2_match_dv_timings(timings, &current_timings, 0, false))
+		return 0;
+
+	if (vb2_is_busy(&dev->buffer_queue))
+		return -EBUSY;
+
+	ret = v4l2_subdev_call(dev->sensor, video, s_dv_timings, timings);
+
+	/* Force recomputation of bytesperline */
+	dev->v_fmt.fmt.pix.bytesperline = 0;
+
+	unicam_reset_format(dev);
+
+	return ret;
+}
+
+static int unicam_query_dv_timings(struct file *file, void *priv,
+				   struct v4l2_dv_timings *timings)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, video, query_dv_timings, timings);
+}
+
+static int unicam_enum_dv_timings(struct file *file, void *priv,
+				  struct v4l2_enum_dv_timings *timings)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, pad, enum_dv_timings, timings);
+}
+
+static int unicam_dv_timings_cap(struct file *file, void *priv,
+				 struct v4l2_dv_timings_cap *cap)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_subdev_call(dev->sensor, pad, dv_timings_cap, cap);
+}
+
+static int unicam_subscribe_event(struct v4l2_fh *fh,
+				  const struct v4l2_event_subscription *sub)
+{
+	switch (sub->type) {
+	case V4L2_EVENT_SOURCE_CHANGE:
+		return v4l2_event_subscribe(fh, sub, 4, NULL);
+	}
+
+	return v4l2_ctrl_subscribe_event(fh, sub);
+}
+
+static int unicam_log_status(struct file *file, void *fh)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	struct unicam_cfg *cfg = &dev->cfg;
+	u32 reg;
+
+	/* status for sub devices */
+	v4l2_device_call_all(&dev->v4l2_dev, 0, core, log_status);
+
+	unicam_info(dev, "-----Receiver status-----\n");
+	unicam_info(dev, "V4L2 width/height:   %ux%u\n",
+		    dev->v_fmt.fmt.pix.width, dev->v_fmt.fmt.pix.height);
+	unicam_info(dev, "Mediabus format:     %08x\n", dev->fmt->code);
+	unicam_info(dev, "V4L2 format:         " V4L2_FOURCC_CONV "\n",
+		    V4L2_FOURCC_CONV_ARGS(dev->v_fmt.fmt.pix.pixelformat));
+	reg = reg_read(&dev->cfg, UNICAM_IPIPE);
+	unicam_info(dev, "Unpacking/packing:   %u / %u\n",
+		    get_field(reg, UNICAM_PUM_MASK),
+		    get_field(reg, UNICAM_PPM_MASK));
+	unicam_info(dev, "----Live data----\n");
+	unicam_info(dev, "Programmed stride:   %4u\n",
+		    reg_read(cfg, UNICAM_IBLS));
+	unicam_info(dev, "Detected resolution: %ux%u\n",
+		    reg_read(cfg, UNICAM_IHSTA),
+		    reg_read(cfg, UNICAM_IVSTA));
+	unicam_info(dev, "Write pointer:       %08x\n",
+		    reg_read(cfg, UNICAM_IBWP));
+
+	return 0;
+}
+
+static void unicam_notify(struct v4l2_subdev *sd,
+			  unsigned int notification, void *arg)
+{
+	struct unicam_device *dev =
+		container_of(sd->v4l2_dev, struct unicam_device, v4l2_dev);
+
+	switch (notification) {
+	case V4L2_DEVICE_NOTIFY_EVENT:
+		v4l2_event_queue(&dev->video_dev, arg);
+		break;
+	default:
+		break;
+	}
+}
+
+static const struct vb2_ops unicam_video_qops = {
+	.wait_prepare		= vb2_ops_wait_prepare,
+	.wait_finish		= vb2_ops_wait_finish,
+	.queue_setup		= unicam_queue_setup,
+	.buf_prepare		= unicam_buffer_prepare,
+	.buf_queue		= unicam_buffer_queue,
+	.start_streaming	= unicam_start_streaming,
+	.stop_streaming		= unicam_stop_streaming,
+};
+
+/* unicam capture driver file operations */
+static const struct v4l2_file_operations unicam_fops = {
+	.owner		= THIS_MODULE,
+	.open           = v4l2_fh_open,
+	.release        = vb2_fop_release,
+	.read		= vb2_fop_read,
+	.poll		= vb2_fop_poll,
+	.unlocked_ioctl	= video_ioctl2,
+	.mmap		= vb2_fop_mmap,
+};
+
+/* unicam capture ioctl operations */
+static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
+	.vidioc_querycap		= unicam_querycap,
+	.vidioc_enum_fmt_vid_cap	= unicam_enum_fmt_vid_cap,
+	.vidioc_g_fmt_vid_cap		= unicam_g_fmt_vid_cap,
+	.vidioc_s_fmt_vid_cap		= unicam_s_fmt_vid_cap,
+	.vidioc_try_fmt_vid_cap		= unicam_try_fmt_vid_cap,
+
+	.vidioc_enum_input		= unicam_enum_input,
+	.vidioc_g_input			= unicam_g_input,
+	.vidioc_s_input			= unicam_s_input,
+
+	.vidioc_querystd		= unicam_querystd,
+	.vidioc_s_std			= unicam_s_std,
+	.vidioc_g_std			= unicam_g_std,
+
+	.vidioc_g_edid			= unicam_g_edid,
+	.vidioc_s_edid			= unicam_s_edid,
+
+	.vidioc_s_dv_timings		= unicam_s_dv_timings,
+	.vidioc_g_dv_timings		= unicam_g_dv_timings,
+	.vidioc_query_dv_timings	= unicam_query_dv_timings,
+	.vidioc_enum_dv_timings		= unicam_enum_dv_timings,
+	.vidioc_dv_timings_cap		= unicam_dv_timings_cap,
+
+	.vidioc_reqbufs			= vb2_ioctl_reqbufs,
+	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
+	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
+	.vidioc_querybuf		= vb2_ioctl_querybuf,
+	.vidioc_qbuf			= vb2_ioctl_qbuf,
+	.vidioc_dqbuf			= vb2_ioctl_dqbuf,
+	.vidioc_expbuf			= vb2_ioctl_expbuf,
+	.vidioc_streamon		= vb2_ioctl_streamon,
+	.vidioc_streamoff		= vb2_ioctl_streamoff,
+
+	.vidioc_log_status		= unicam_log_status,
+	.vidioc_subscribe_event		= unicam_subscribe_event,
+	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
+};
+
+/*
+ * Adds an entry to the active_fmts array
+ * Returns non-zero if attempting to write off the end of the array.
+ */
+static int unicam_add_active_format(struct unicam_device *unicam,
+				    const struct unicam_fmt *fmt)
+{
+	//Ensure we don't run off the end of the array.
+	if (unicam->num_active_fmt >= MAX_POSSIBLE_PIX_FMTS)
+		return 1;
+
+	unicam->active_fmts[unicam->num_active_fmt] = *fmt;
+	unicam_dbg(2, unicam,
+		   "matched fourcc: " V4L2_FOURCC_CONV ": code: %04x idx: %d\n",
+		   V4L2_FOURCC_CONV_ARGS(fmt->fourcc),
+		   fmt->code, unicam->num_active_fmt);
+	unicam->num_active_fmt++;
+
+	return 0;
+}
+
+static int
+unicam_async_bound(struct v4l2_async_notifier *notifier,
+		   struct v4l2_subdev *subdev,
+		   struct v4l2_async_subdev *asd)
+{
+	struct unicam_device *unicam = container_of(notifier->v4l2_dev,
+					       struct unicam_device, v4l2_dev);
+	struct v4l2_subdev_mbus_code_enum mbus_code;
+	int ret = 0;
+	int j;
+
+	if (unicam->sensor) {
+		unicam_info(unicam, "Rejecting subdev %s (Already set!!)",
+			    subdev->name);
+		return 0;
+	}
+
+	unicam->sensor = subdev;
+	unicam_dbg(1, unicam, "Using sensor %s for capture\n", subdev->name);
+
+	/* Enumerate sub device formats and enable all matching local formats */
+	unicam->num_active_fmt = 0;
+	unicam_dbg(2, unicam, "Get supported formats...\n");
+	for (j = 0; ret != -EINVAL && ret != -ENOIOCTLCMD; ++j) {
+		const struct unicam_fmt *fmt = NULL;
+		int k;
+
+		memset(&mbus_code, 0, sizeof(mbus_code));
+		mbus_code.index = j;
+		ret = v4l2_subdev_call(subdev, pad, enum_mbus_code,
+				       NULL, &mbus_code);
+		if (ret < 0) {
+			unicam_dbg(2, unicam,
+				   "subdev->enum_mbus_code idx %d returned %d - continue\n",
+				   j, ret);
+			continue;
+		}
+
+		unicam_dbg(2, unicam, "subdev %s: code: %04x idx: %d\n",
+			   subdev->name, mbus_code.code, j);
+
+		for (k = 0; k < ARRAY_SIZE(formats); k++) {
+			if (mbus_code.code == formats[k].code) {
+				fmt = &formats[k];
+				break;
+			}
+		}
+		unicam_dbg(2, unicam, "fmt %04x returned as %p, V4L2 FOURCC %04x, csi_dt %02X\n",
+			   mbus_code.code, fmt, fmt ? fmt->fourcc : 0,
+			   fmt ? fmt->csi_dt : 0);
+		if (fmt) {
+			if (unicam_add_active_format(unicam, fmt)) {
+				unicam_dbg(1, unicam, "Active fmt list truncated\n");
+				break;
+			}
+		}
+	}
+	unicam_dbg(2, unicam,
+		   "Done all formats\n");
+	dump_active_formats(unicam);
+
+	return 0;
+}
+
+static int unicam_probe_complete(struct unicam_device *unicam)
+{
+	struct video_device *vdev;
+	struct vb2_queue *q;
+	struct v4l2_mbus_framefmt mbus_fmt = {0};
+	const struct unicam_fmt *fmt;
+	int ret;
+
+	v4l2_set_subdev_hostdata(unicam->sensor, unicam);
+
+	unicam->v4l2_dev.notify = unicam_notify;
+
+	unicam->sensor_config = v4l2_subdev_alloc_pad_config(unicam->sensor);
+	if (!unicam->sensor_config)
+		return -ENOMEM;
+
+	ret = __subdev_get_format(unicam, &mbus_fmt);
+	if (ret) {
+		unicam_err(unicam, "Failed to get_format - ret %d\n", ret);
+		return ret;
+	}
+
+	fmt = find_format_by_code(unicam, mbus_fmt.code);
+	if (!fmt) {
+		/* Default image format not valid. Choose first active fmt. */
+		fmt = &unicam->active_fmts[0];
+		mbus_fmt.code = fmt->code;
+		ret = __subdev_set_format(unicam, &mbus_fmt);
+		if (ret)
+			return -EINVAL;
+	}
+	if (mbus_fmt.field != V4L2_FIELD_NONE) {
+		/* Interlaced not supported - disable it now. */
+		mbus_fmt.field = V4L2_FIELD_NONE;
+		ret = __subdev_set_format(unicam, &mbus_fmt);
+		if (ret)
+			return -EINVAL;
+	}
+
+	unicam->fmt = fmt;
+	unicam->v_fmt.fmt.pix.pixelformat = fmt->fourcc;
+
+	/* Read current subdev format */
+	unicam_reset_format(unicam);
+
+	if (v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+		v4l2_std_id tvnorms;
+
+		if (WARN_ON(!v4l2_subdev_has_op(unicam->sensor, video,
+						g_tvnorms)))
+			/*
+			 * Subdevice should not advertise s_std but not
+			 * g_tvnorms
+			 */
+			return -EINVAL;
+
+		ret = v4l2_subdev_call(unicam->sensor, video,
+				       g_tvnorms, &tvnorms);
+		if (WARN_ON(ret))
+			return -EINVAL;
+		unicam->video_dev.tvnorms |= tvnorms;
+	}
+
+	spin_lock_init(&unicam->dma_queue_lock);
+	mutex_init(&unicam->lock);
+
+	/* Add controls from the subdevice */
+	ret = v4l2_ctrl_add_handler(&unicam->ctrl_handler,
+				    unicam->sensor->ctrl_handler, NULL);
+	if (ret < 0)
+		return ret;
+
+	q = &unicam->buffer_queue;
+	q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	q->io_modes = VB2_MMAP | VB2_DMABUF | VB2_READ;
+	q->drv_priv = unicam;
+	q->ops = &unicam_video_qops;
+	q->mem_ops = &vb2_dma_contig_memops;
+	q->buf_struct_size = sizeof(struct unicam_buffer);
+	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+	q->lock = &unicam->lock;
+	q->min_buffers_needed = 2;
+	q->dev = &unicam->pdev->dev;
+
+	ret = vb2_queue_init(q);
+	if (ret) {
+		unicam_err(unicam, "vb2_queue_init() failed\n");
+		return ret;
+	}
+
+	INIT_LIST_HEAD(&unicam->dma_queue.active);
+
+	vdev = &unicam->video_dev;
+	strlcpy(vdev->name, UNICAM_MODULE_NAME, sizeof(vdev->name));
+	vdev->release = video_device_release_empty;
+	vdev->fops = &unicam_fops;
+	vdev->ioctl_ops = &unicam_ioctl_ops;
+	vdev->v4l2_dev = &unicam->v4l2_dev;
+	vdev->vfl_dir = VFL_DIR_RX;
+	vdev->queue = q;
+	vdev->lock = &unicam->lock;
+	vdev->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING |
+			    V4L2_CAP_READWRITE;
+
+	/* If the source has no controls then remove our ctrl handler. */
+	if (list_empty(&unicam->ctrl_handler.ctrls))
+		unicam->v4l2_dev.ctrl_handler = NULL;
+
+	video_set_drvdata(vdev, unicam);
+	ret = video_register_device(vdev, VFL_TYPE_GRABBER, -1);
+	if (ret) {
+		unicam_err(unicam, "Unable to register video device.\n");
+		return ret;
+	}
+
+	if (!v4l2_subdev_has_op(unicam->sensor, video, s_std)) {
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_S_STD);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_G_STD);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_ENUMSTD);
+	}
+	if (!v4l2_subdev_has_op(unicam->sensor, video, querystd))
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_QUERYSTD);
+	if (!v4l2_subdev_has_op(unicam->sensor, video, s_dv_timings)) {
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_S_EDID);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_G_EDID);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_DV_TIMINGS_CAP);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_G_DV_TIMINGS);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_S_DV_TIMINGS);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_ENUM_DV_TIMINGS);
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_QUERY_DV_TIMINGS);
+	}
+
+	ret = v4l2_device_register_subdev_nodes(&unicam->v4l2_dev);
+	if (ret) {
+		unicam_err(unicam,
+			   "Unable to register subdev nodes.\n");
+		video_unregister_device(&unicam->video_dev);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int unicam_async_complete(struct v4l2_async_notifier *notifier)
+{
+	struct unicam_device *unicam = container_of(notifier->v4l2_dev,
+					struct unicam_device, v4l2_dev);
+
+	return unicam_probe_complete(unicam);
+}
+
+static const struct v4l2_async_notifier_operations unicam_async_ops = {
+	.bound = unicam_async_bound,
+	.complete = unicam_async_complete,
+};
+
+static int of_unicam_connect_subdevs(struct unicam_device *dev)
+{
+	struct platform_device *pdev = dev->pdev;
+	struct device_node *parent, *ep_node = NULL, *remote_ep = NULL,
+			*sensor_node = NULL;
+	struct v4l2_fwnode_endpoint *ep;
+	struct v4l2_async_subdev *asd;
+	struct v4l2_async_subdev **subdevs = NULL;
+	unsigned int peripheral_data_lanes;
+	int ret = -EINVAL;
+	unsigned int lane;
+
+	parent = pdev->dev.of_node;
+
+	asd = &dev->asd;
+	ep = &dev->endpoint;
+
+	ep_node = of_graph_get_next_endpoint(parent, NULL);
+	if (!ep_node) {
+		unicam_dbg(3, dev, "can't get next endpoint\n");
+		goto cleanup_exit;
+	}
+
+	unicam_dbg(3, dev, "ep_node is %s\n", ep_node->name);
+
+	v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), ep);
+
+	for (lane = 0; lane < ep->bus.mipi_csi2.num_data_lanes; lane++) {
+		if (ep->bus.mipi_csi2.data_lanes[lane] != lane + 1) {
+			unicam_err(dev, "Local endpoint - data lane reordering not supported\n");
+			goto cleanup_exit;
+		}
+	}
+
+	peripheral_data_lanes = ep->bus.mipi_csi2.num_data_lanes;
+
+	sensor_node = of_graph_get_remote_port_parent(ep_node);
+	if (!sensor_node) {
+		unicam_dbg(3, dev, "can't get remote parent\n");
+		goto cleanup_exit;
+	}
+	unicam_dbg(3, dev, "sensor_node is %s\n", sensor_node->name);
+	asd->match_type = V4L2_ASYNC_MATCH_FWNODE;
+	asd->match.fwnode = of_fwnode_handle(sensor_node);
+
+	remote_ep = of_graph_get_remote_endpoint(ep_node);
+	if (!remote_ep) {
+		unicam_dbg(3, dev, "can't get remote-endpoint\n");
+		goto cleanup_exit;
+	}
+	unicam_dbg(3, dev, "remote_ep is %s\n", remote_ep->name);
+	v4l2_fwnode_endpoint_parse(of_fwnode_handle(remote_ep), ep);
+	unicam_dbg(3, dev, "parsed remote_ep to endpoint. nr_of_link_frequencies %u, bus_type %u\n",
+		   ep->nr_of_link_frequencies, ep->bus_type);
+
+	switch (ep->bus_type) {
+	case V4L2_MBUS_CSI2:
+		if (ep->bus.mipi_csi2.num_data_lanes >
+				peripheral_data_lanes) {
+			unicam_err(dev, "Subdevice %s wants too many data lanes (%u > %u)\n",
+				   sensor_node->name,
+				   ep->bus.mipi_csi2.num_data_lanes,
+				   peripheral_data_lanes);
+			goto cleanup_exit;
+		}
+		for (lane = 0;
+		     lane < ep->bus.mipi_csi2.num_data_lanes;
+		     lane++) {
+			if (ep->bus.mipi_csi2.data_lanes[lane] != lane + 1) {
+				unicam_err(dev, "Subdevice %s - incompatible data lane config\n",
+					   sensor_node->name);
+				goto cleanup_exit;
+			}
+		}
+		dev->max_data_lanes = ep->bus.mipi_csi2.num_data_lanes;
+		dev->bus_flags = ep->bus.mipi_csi2.flags;
+		break;
+	case V4L2_MBUS_CCP2:
+		if (ep->bus.mipi_csi1.clock_lane != 0 ||
+		    ep->bus.mipi_csi1.data_lane != 1) {
+			unicam_err(dev, "Subdevice %s incompatible lane config\n",
+				   sensor_node->name);
+			goto cleanup_exit;
+		}
+		dev->max_data_lanes = 1;
+		dev->bus_flags = ep->bus.mipi_csi1.strobe;
+		break;
+	default:
+		/* Unsupported bus type */
+		unicam_err(dev, "sub-device %s is not a CSI2 or CCP2 device %d\n",
+			   sensor_node->name, ep->bus_type);
+		goto cleanup_exit;
+	}
+
+	/* Store bus type - CSI2 or CCP2 */
+	dev->bus_type = ep->bus_type;
+	unicam_dbg(3, dev, "bus_type is %d\n", dev->bus_type);
+
+	/* Store Virtual Channel number */
+	dev->virtual_channel = ep->base.id;
+
+	unicam_dbg(3, dev, "v4l2-endpoint: %s\n",
+		   dev->bus_type == V4L2_MBUS_CSI2 ? "CSI2" : "CCP2");
+	unicam_dbg(3, dev, "Virtual Channel=%d\n", dev->virtual_channel);
+	if (dev->bus_type == V4L2_MBUS_CSI2)
+		unicam_dbg(3, dev, "flags=0x%08x\n", ep->bus.mipi_csi2.flags);
+	unicam_dbg(3, dev, "num_data_lanes=%d\n", dev->max_data_lanes);
+
+	unicam_dbg(1, dev, "found sub-device %s\n", sensor_node->name);
+
+	subdevs = devm_kzalloc(&dev->pdev->dev, sizeof(*subdevs), GFP_KERNEL);
+	if (!subdevs) {
+		ret = -ENOMEM;
+		goto cleanup_exit;
+	}
+	subdevs[0] = asd;
+	dev->notifier.subdevs = subdevs;
+	dev->notifier.num_subdevs = 1;
+	dev->notifier.ops = &unicam_async_ops;
+	ret = v4l2_async_notifier_register(&dev->v4l2_dev,
+					   &dev->notifier);
+	if (ret) {
+		unicam_err(dev, "Error registering async notifier - ret %d\n",
+			   ret);
+		ret = -EINVAL;
+	}
+
+cleanup_exit:
+	if (remote_ep)
+		of_node_put(remote_ep);
+	if (sensor_node)
+		of_node_put(sensor_node);
+	if (ep_node)
+		of_node_put(ep_node);
+
+	return ret;
+}
+
+static int unicam_probe(struct platform_device *pdev)
+{
+	struct unicam_cfg *unicam_cfg;
+	struct unicam_device *unicam;
+	struct v4l2_ctrl_handler *hdl;
+	struct resource	*res;
+	int ret;
+
+	unicam = devm_kzalloc(&pdev->dev, sizeof(*unicam), GFP_KERNEL);
+	if (!unicam)
+		return -ENOMEM;
+
+	unicam->pdev = pdev;
+	unicam_cfg = &unicam->cfg;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	unicam_cfg->base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(unicam_cfg->base)) {
+		unicam_err(unicam, "Failed to get main io block\n");
+		return PTR_ERR(unicam_cfg->base);
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	unicam_cfg->clk_gate_base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(unicam_cfg->clk_gate_base)) {
+		unicam_err(unicam, "Failed to get 2nd io block\n");
+		return PTR_ERR(unicam_cfg->clk_gate_base);
+	}
+
+	unicam->clock = devm_clk_get(&pdev->dev, "lp");
+	if (IS_ERR(unicam->clock)) {
+		unicam_err(unicam, "Failed to get clock\n");
+		return PTR_ERR(unicam->clock);
+	}
+
+	ret = platform_get_irq(pdev, 0);
+	if (ret <= 0) {
+		dev_err(&pdev->dev, "No IRQ resource\n");
+		return -ENODEV;
+	}
+
+	ret = devm_request_irq(&pdev->dev, ret, unicam_isr, 0,
+			       "unicam_capture0", unicam);
+	if (ret) {
+		dev_err(&pdev->dev, "Unable to request interrupt\n");
+		return -EINVAL;
+	}
+
+	ret = v4l2_device_register(&pdev->dev, &unicam->v4l2_dev);
+	if (ret) {
+		unicam_err(unicam,
+			   "Unable to register v4l2 device.\n");
+		return ret;
+	}
+
+	/* Reserve space for the controls */
+	hdl = &unicam->ctrl_handler;
+	ret = v4l2_ctrl_handler_init(hdl, 16);
+	if (ret < 0)
+		goto probe_out_v4l2_unregister;
+	unicam->v4l2_dev.ctrl_handler = hdl;
+
+	/* set the driver data in platform device */
+	platform_set_drvdata(pdev, unicam);
+
+	ret = of_unicam_connect_subdevs(unicam);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to connect subdevs\n");
+		goto free_hdl;
+	}
+
+	/* Enable the block power domain */
+	pm_runtime_enable(&pdev->dev);
+
+	return 0;
+
+free_hdl:
+	v4l2_ctrl_handler_free(hdl);
+probe_out_v4l2_unregister:
+	v4l2_device_unregister(&unicam->v4l2_dev);
+	return ret;
+}
+
+static int unicam_remove(struct platform_device *pdev)
+{
+	struct unicam_device *unicam = platform_get_drvdata(pdev);
+
+	unicam_dbg(2, unicam, "%s\n", __func__);
+
+	pm_runtime_disable(&pdev->dev);
+
+	v4l2_async_notifier_unregister(&unicam->notifier);
+	v4l2_ctrl_handler_free(&unicam->ctrl_handler);
+	v4l2_device_unregister(&unicam->v4l2_dev);
+	video_unregister_device(&unicam->video_dev);
+	if (unicam->sensor_config)
+		v4l2_subdev_free_pad_config(unicam->sensor_config);
+
+	return 0;
+}
+
+static const struct of_device_id unicam_of_match[] = {
+	{ .compatible = "brcm,bcm2835-unicam", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, unicam_of_match);
+
+static struct platform_driver unicam_driver = {
+	.probe		= unicam_probe,
+	.remove		= unicam_remove,
+	.driver = {
+		.name	= UNICAM_MODULE_NAME,
+		.of_match_table = of_match_ptr(unicam_of_match),
+	},
+};
+
+module_platform_driver(unicam_driver);
+
+MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.org>");
+MODULE_DESCRIPTION("BCM2835 Unicam driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(UNICAM_VERSION);
diff --git a/drivers/media/platform/bcm2835/vc4-regs-unicam.h b/drivers/media/platform/bcm2835/vc4-regs-unicam.h
new file mode 100644
index 0000000000000..e2cb39c7f2a55
--- /dev/null
+++ b/drivers/media/platform/bcm2835/vc4-regs-unicam.h
@@ -0,0 +1,266 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+/*
+ * Copyright (C) 2017 Raspberry Pi Trading.
+ * Dave Stevenson <dave.stevenson@raspberrypi.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef VC4_REGS_UNICAM_H
+#define VC4_REGS_UNICAM_H
+
+/*
+ * The following values are taken from files found within the code drop
+ * made by Broadcom for the BCM21553 Graphics Driver, predominantly in
+ * brcm_usrlib/dag/vmcsx/vcinclude/hardware_vc4.h.
+ * They have been modified to be only the register offset.
+ */
+#define UNICAM_CTRL	0x000
+#define UNICAM_STA	0x004
+#define UNICAM_ANA	0x008
+#define UNICAM_PRI	0x00c
+#define UNICAM_CLK	0x010
+#define UNICAM_CLT	0x014
+#define UNICAM_DAT0	0x018
+#define UNICAM_DAT1	0x01c
+#define UNICAM_DAT2	0x020
+#define UNICAM_DAT3	0x024
+#define UNICAM_DLT	0x028
+#define UNICAM_CMP0	0x02c
+#define UNICAM_CMP1	0x030
+#define UNICAM_CAP0	0x034
+#define UNICAM_CAP1	0x038
+#define UNICAM_ICTL	0x100
+#define UNICAM_ISTA	0x104
+#define UNICAM_IDI0	0x108
+#define UNICAM_IPIPE	0x10c
+#define UNICAM_IBSA0	0x110
+#define UNICAM_IBEA0	0x114
+#define UNICAM_IBLS	0x118
+#define UNICAM_IBWP	0x11c
+#define UNICAM_IHWIN	0x120
+#define UNICAM_IHSTA	0x124
+#define UNICAM_IVWIN	0x128
+#define UNICAM_IVSTA	0x12c
+#define UNICAM_ICC	0x130
+#define UNICAM_ICS	0x134
+#define UNICAM_IDC	0x138
+#define UNICAM_IDPO	0x13c
+#define UNICAM_IDCA	0x140
+#define UNICAM_IDCD	0x144
+#define UNICAM_IDS	0x148
+#define UNICAM_DCS	0x200
+#define UNICAM_DBSA0	0x204
+#define UNICAM_DBEA0	0x208
+#define UNICAM_DBWP	0x20c
+#define UNICAM_DBCTL	0x300
+#define UNICAM_IBSA1	0x304
+#define UNICAM_IBEA1	0x308
+#define UNICAM_IDI1	0x30c
+#define UNICAM_DBSA1	0x310
+#define UNICAM_DBEA1	0x314
+#define UNICAM_MISC	0x400
+
+/*
+ * The following bitmasks are from the kernel released by Broadcom
+ * for Android - https://android.googlesource.com/kernel/bcm/
+ * The Rhea, Hawaii, and Java chips all contain the same VideoCore4
+ * Unicam block as BCM2835, as defined in eg
+ * arch/arm/mach-rhea/include/mach/rdb_A0/brcm_rdb_cam.h and similar.
+ * Values reworked to use the kernel BIT and GENMASK macros.
+ *
+ * Some of the bit mnenomics have been amended to match the datasheet.
+ */
+/* UNICAM_CTRL Register */
+#define UNICAM_CPE		BIT(0)
+#define UNICAM_MEM		BIT(1)
+#define UNICAM_CPR		BIT(2)
+#define UNICAM_CPM_MASK		GENMASK(3, 3)
+#define UNICAM_CPM_CSI2		0
+#define UNICAM_CPM_CCP2		1
+#define UNICAM_SOE		BIT(4)
+#define UNICAM_DCM_MASK		GENMASK(5, 5)
+#define UNICAM_DCM_STROBE	0
+#define UNICAM_DCM_DATA		1
+#define UNICAM_SLS		BIT(6)
+#define UNICAM_PFT_MASK		GENMASK(11, 8)
+#define UNICAM_OET_MASK		GENMASK(20, 12)
+
+/* UNICAM_STA Register */
+#define UNICAM_SYN		BIT(0)
+#define UNICAM_CS		BIT(1)
+#define UNICAM_SBE		BIT(2)
+#define UNICAM_PBE		BIT(3)
+#define UNICAM_HOE		BIT(4)
+#define UNICAM_PLE		BIT(5)
+#define UNICAM_SSC		BIT(6)
+#define UNICAM_CRCE		BIT(7)
+#define UNICAM_OES		BIT(8)
+#define UNICAM_IFO		BIT(9)
+#define UNICAM_OFO		BIT(10)
+#define UNICAM_BFO		BIT(11)
+#define UNICAM_DL		BIT(12)
+#define UNICAM_PS		BIT(13)
+#define UNICAM_IS		BIT(14)
+#define UNICAM_PI0		BIT(15)
+#define UNICAM_PI1		BIT(16)
+#define UNICAM_FSI_S		BIT(17)
+#define UNICAM_FEI_S		BIT(18)
+#define UNICAM_LCI_S		BIT(19)
+#define UNICAM_BUF0_RDY		BIT(20)
+#define UNICAM_BUF0_NO		BIT(21)
+#define UNICAM_BUF1_RDY		BIT(22)
+#define UNICAM_BUF1_NO		BIT(23)
+#define UNICAM_DI		BIT(24)
+
+#define UNICAM_STA_MASK_ALL \
+		(UNICAM_DL + \
+		UNICAM_SBE + \
+		UNICAM_PBE + \
+		UNICAM_HOE + \
+		UNICAM_PLE + \
+		UNICAM_SSC + \
+		UNICAM_CRCE + \
+		UNICAM_IFO + \
+		UNICAM_OFO + \
+		UNICAM_PS + \
+		UNICAM_PI0 + \
+		UNICAM_PI1)
+
+/* UNICAM_ANA Register */
+#define UNICAM_APD		BIT(0)
+#define UNICAM_BPD		BIT(1)
+#define UNICAM_AR		BIT(2)
+#define UNICAM_DDL		BIT(3)
+#define UNICAM_CTATADJ_MASK	GENMASK(7, 4)
+#define UNICAM_PTATADJ_MASK	GENMASK(11, 8)
+
+/* UNICAM_PRI Register */
+#define UNICAM_PE		BIT(0)
+#define UNICAM_PT_MASK		GENMASK(2, 1)
+#define UNICAM_NP_MASK		GENMASK(7, 4)
+#define UNICAM_PP_MASK		GENMASK(11, 8)
+#define UNICAM_BS_MASK		GENMASK(15, 12)
+#define UNICAM_BL_MASK		GENMASK(17, 16)
+
+/* UNICAM_CLK Register */
+#define UNICAM_CLE		BIT(0)
+#define UNICAM_CLPD		BIT(1)
+#define UNICAM_CLLPE		BIT(2)
+#define UNICAM_CLHSE		BIT(3)
+#define UNICAM_CLTRE		BIT(4)
+#define UNICAM_CLAC_MASK	GENMASK(8, 5)
+#define UNICAM_CLSTE		BIT(29)
+
+/* UNICAM_CLT Register */
+#define UNICAM_CLT1_MASK	GENMASK(7, 0)
+#define UNICAM_CLT2_MASK	GENMASK(15, 8)
+
+/* UNICAM_DATn Registers */
+#define UNICAM_DLE		BIT(0)
+#define UNICAM_DLPD		BIT(1)
+#define UNICAM_DLLPE		BIT(2)
+#define UNICAM_DLHSE		BIT(3)
+#define UNICAM_DLTRE		BIT(4)
+#define UNICAM_DLSM		BIT(5)
+#define UNICAM_DLFO		BIT(28)
+#define UNICAM_DLSTE		BIT(29)
+
+#define UNICAM_DAT_MASK_ALL (UNICAM_DLSTE + UNICAM_DLFO)
+
+/* UNICAM_DLT Register */
+#define UNICAM_DLT1_MASK	GENMASK(7, 0)
+#define UNICAM_DLT2_MASK	GENMASK(15, 8)
+#define UNICAM_DLT3_MASK	GENMASK(23, 16)
+
+/* UNICAM_ICTL Register */
+#define UNICAM_FSIE		BIT(0)
+#define UNICAM_FEIE		BIT(1)
+#define UNICAM_IBOB		BIT(2)
+#define UNICAM_FCM		BIT(3)
+#define UNICAM_TFC		BIT(4)
+#define UNICAM_LIP_MASK		GENMASK(6, 5)
+#define UNICAM_LCIE_MASK	GENMASK(28, 16)
+
+/* UNICAM_IDI0/1 Register */
+#define UNICAM_ID0_MASK		GENMASK(7, 0)
+#define UNICAM_ID1_MASK		GENMASK(15, 8)
+#define UNICAM_ID2_MASK		GENMASK(23, 16)
+#define UNICAM_ID3_MASK		GENMASK(31, 24)
+
+/* UNICAM_ISTA Register */
+#define UNICAM_FSI		BIT(0)
+#define UNICAM_FEI		BIT(1)
+#define UNICAM_LCI		BIT(2)
+
+#define UNICAM_ISTA_MASK_ALL (UNICAM_FSI + UNICAM_FEI + UNICAM_LCI)
+
+/* UNICAM_IPIPE Register */
+#define UNICAM_PUM_MASK		GENMASK(2, 0)
+		/* Unpacking modes */
+		#define UNICAM_PUM_NONE		0
+		#define UNICAM_PUM_UNPACK6	1
+		#define UNICAM_PUM_UNPACK7	2
+		#define UNICAM_PUM_UNPACK8	3
+		#define UNICAM_PUM_UNPACK10	4
+		#define UNICAM_PUM_UNPACK12	5
+		#define UNICAM_PUM_UNPACK14	6
+		#define UNICAM_PUM_UNPACK16	7
+#define UNICAM_DDM_MASK		GENMASK(6, 3)
+#define UNICAM_PPM_MASK		GENMASK(9, 7)
+		/* Packing modes */
+		#define UNICAM_PPM_NONE		0
+		#define UNICAM_PPM_PACK8	1
+		#define UNICAM_PPM_PACK10	2
+		#define UNICAM_PPM_PACK12	3
+		#define UNICAM_PPM_PACK14	4
+		#define UNICAM_PPM_PACK16	5
+#define UNICAM_DEM_MASK		GENMASK(11, 10)
+#define UNICAM_DEBL_MASK	GENMASK(14, 12)
+#define UNICAM_ICM_MASK		GENMASK(16, 15)
+#define UNICAM_IDM_MASK		GENMASK(17, 17)
+
+/* UNICAM_ICC Register */
+#define UNICAM_ICFL_MASK	GENMASK(4, 0)
+#define UNICAM_ICFH_MASK	GENMASK(9, 5)
+#define UNICAM_ICST_MASK	GENMASK(12, 10)
+#define UNICAM_ICLT_MASK	GENMASK(15, 13)
+#define UNICAM_ICLL_MASK	GENMASK(31, 16)
+
+/* UNICAM_DCS Register */
+#define UNICAM_DIE		BIT(0)
+#define UNICAM_DIM		BIT(1)
+#define UNICAM_DBOB		BIT(3)
+#define UNICAM_FDE		BIT(4)
+#define UNICAM_LDP		BIT(5)
+#define UNICAM_EDL_MASK		GENMASK(15, 8)
+
+/* UNICAM_DBCTL Register */
+#define UNICAM_DBEN		BIT(0)
+#define UNICAM_BUF0_IE		BIT(1)
+#define UNICAM_BUF1_IE		BIT(2)
+
+/* UNICAM_CMP[0,1] register */
+#define UNICAM_PCE		BIT(31)
+#define UNICAM_GI		BIT(9)
+#define UNICAM_CPH		BIT(8)
+#define UNICAM_PCVC_MASK	GENMASK(7, 6)
+#define UNICAM_PCDT_MASK	GENMASK(5, 0)
+
+/* UNICAM_MISC register */
+#define UNICAM_FL0		BIT(6)
+#define UNICAM_FL1		BIT(9)
+
+#endif
-- 
GitLab


From a76ad59f8ceba5ffa0d99e7d243645fa8193d26a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:59:40 +0000
Subject: [PATCH 0199/1835] MAINTAINERS: Add entry for BCM2835 Unicam driver

Adds entry for the new BCM2835 Unicam (CSI-2 receiver) driver

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 MAINTAINERS | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 11a59e82d92ee..b78106428c2ec 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2873,6 +2873,13 @@ S:	Maintained
 N:	bcm2835
 F:	drivers/staging/vc04_services
 
+BROADCOM BCM2835 CAMERA DRIVER
+M:	Dave Stevenson <dave.stevenson@raspberrypi.org>
+L:	linux-media@vger.kernel.org
+S:	Maintained
+F:	drivers/media/platform/bcm2835/
+F:	Documentation/devicetree/bindings/media/bcm2835-unicam.txt
+
 BROADCOM BCM47XX MIPS ARCHITECTURE
 M:	Hauke Mehrtens <hauke@hauke-m.de>
 M:	Rafał Miłecki <zajec5@gmail.com>
-- 
GitLab


From 2ccfc01f12b7647ae4b2a6ba50766cb32d19f8e8 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 14:59:51 +0000
Subject: [PATCH 0200/1835] defconfig: Enable Unicam driver and various sources
 on Pi platforms.

Enable:
	VIDEO_V4L2_SUBDEV_API=y
	VIDEO_BCM2835_UNICAM=m
	VIDEO_TC358743=m
	VIDEO_ADV7180=m
	VIDEO_OV5647=m
so that we can receive CSI data from these devices.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 5 +++++
 arch/arm/configs/bcmrpi_defconfig  | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index acb05e74fcf62..f59e104f817c6 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -714,6 +714,7 @@ CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
 CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
 CONFIG_MEDIA_RADIO_SUPPORT=y
 CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
 CONFIG_USB_VIDEO_CLASS=m
 CONFIG_USB_M5602=m
@@ -831,6 +832,7 @@ CONFIG_VIDEO_EM28XX_V4L2=m
 CONFIG_VIDEO_EM28XX_ALSA=m
 CONFIG_VIDEO_EM28XX_DVB=m
 CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VIDEO_BCM2835_UNICAM=m
 CONFIG_RADIO_SI470X=m
 CONFIG_USB_SI470X=m
 CONFIG_I2C_SI470X=m
@@ -850,10 +852,13 @@ CONFIG_RADIO_WL128X=m
 # CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
 CONFIG_VIDEO_UDA1342=m
 CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_ADV7180=m
+CONFIG_VIDEO_TC358743=m
 CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
 CONFIG_DRM=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 9374a682a7669..507aa4685b35b 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -707,6 +707,7 @@ CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
 CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
 CONFIG_MEDIA_RADIO_SUPPORT=y
 CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
 CONFIG_USB_VIDEO_CLASS=m
 CONFIG_USB_M5602=m
@@ -824,6 +825,7 @@ CONFIG_VIDEO_EM28XX_V4L2=m
 CONFIG_VIDEO_EM28XX_ALSA=m
 CONFIG_VIDEO_EM28XX_DVB=m
 CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VIDEO_BCM2835_UNICAM=m
 CONFIG_RADIO_SI470X=m
 CONFIG_USB_SI470X=m
 CONFIG_I2C_SI470X=m
@@ -843,10 +845,13 @@ CONFIG_RADIO_WL128X=m
 # CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
 CONFIG_VIDEO_UDA1342=m
 CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_ADV7180=m
+CONFIG_VIDEO_TC358743=m
 CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
 CONFIG_DRM=m
-- 
GitLab


From 83fe32724e65bc48aa8bc01322b5b8b5bc8315a2 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 15:00:04 +0000
Subject: [PATCH 0201/1835] media: adv7180: Nasty hack to allow input
 selection.

Whilst the adv7180 driver support s_routing, nothing else
does, and there is a missing lump of framework code to
define the mapping from connectors on a board to the inputs
they represent on the ADV7180.

Add a nasty hack to take a module parameter that is passed in
to s_routing on any call to G_STD, or S_STD (or subdev
g_input_status call).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/adv7180.c | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index e0584040eca86..1214cf760bd5b 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -189,6 +189,10 @@
 
 #define V4L2_CID_ADV_FAST_SWITCH	(V4L2_CID_USER_ADV7180_BASE + 0x00)
 
+static int dbg_input;
+module_param(dbg_input, int, 0644);
+MODULE_PARM_DESC(dbg_input, "Input number (0-31)");
+
 struct adv7180_state;
 
 #define ADV7180_FLAG_RESET_POWERED	BIT(0)
@@ -405,10 +409,24 @@ out:
 	return ret;
 }
 
+static void adv7180_check_input(struct v4l2_subdev *sd)
+{
+	struct adv7180_state *state = to_state(sd);
+
+	if (state->input != dbg_input)
+		if (adv7180_s_routing(sd, dbg_input, 0, 0))
+			/* Failed - reset dbg_input */
+			dbg_input = state->input;
+}
+
 static int adv7180_g_input_status(struct v4l2_subdev *sd, u32 *status)
 {
 	struct adv7180_state *state = to_state(sd);
-	int ret = mutex_lock_interruptible(&state->mutex);
+	int ret;
+
+	adv7180_check_input(sd);
+
+	ret = mutex_lock_interruptible(&state->mutex);
 	if (ret)
 		return ret;
 
@@ -434,7 +452,11 @@ static int adv7180_program_std(struct adv7180_state *state)
 static int adv7180_s_std(struct v4l2_subdev *sd, v4l2_std_id std)
 {
 	struct adv7180_state *state = to_state(sd);
-	int ret = mutex_lock_interruptible(&state->mutex);
+	int ret;
+
+	adv7180_check_input(sd);
+
+	ret = mutex_lock_interruptible(&state->mutex);
 
 	if (ret)
 		return ret;
@@ -456,6 +478,8 @@ static int adv7180_g_std(struct v4l2_subdev *sd, v4l2_std_id *norm)
 {
 	struct adv7180_state *state = to_state(sd);
 
+	adv7180_check_input(sd);
+
 	*norm = state->curr_norm;
 
 	return 0;
@@ -810,6 +834,8 @@ static int adv7180_s_stream(struct v4l2_subdev *sd, int enable)
 		return 0;
 	}
 
+	adv7180_check_input(sd);
+
 	/* Must wait until querystd released the lock */
 	ret = mutex_lock_interruptible(&state->mutex);
 	if (ret)
-- 
GitLab


From f288b3a9788e7d3f182af279efda84855ead747f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 15:00:20 +0000
Subject: [PATCH 0202/1835] BCM283x DT: Add CSI nodes to the device tree.

Adds CSI nodes to all the upstream device tree configs

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2835-rpi-a-plus.dts      |  1 +
 arch/arm/boot/dts/bcm2835-rpi-a.dts           |  1 +
 arch/arm/boot/dts/bcm2835-rpi-b-plus.dts      |  1 +
 arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts      |  1 +
 arch/arm/boot/dts/bcm2835-rpi-b.dts           |  1 +
 arch/arm/boot/dts/bcm2835-rpi-zero.dts        |  1 +
 arch/arm/boot/dts/bcm2835-rpi.dtsi            |  8 ++++++
 arch/arm/boot/dts/bcm2836-rpi-2-b.dts         |  1 +
 arch/arm/boot/dts/bcm2837-rpi-3-b.dts         |  1 +
 arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi |  8 ++++++
 arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi |  8 ++++++
 arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi |  8 ++++++
 arch/arm/boot/dts/bcm283x.dtsi                | 26 +++++++++++++++++++
 .../dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi  |  1 +
 14 files changed, 67 insertions(+)
 create mode 100644 arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi
 create mode 100644 arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
 create mode 100644 arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi
 create mode 120000 arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi

diff --git a/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts b/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts
index 2cd9c5e4f8928..d1edd89b45f70 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts
@@ -3,6 +3,7 @@
 #include "bcm2835.dtsi"
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-a-plus", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2835-rpi-a.dts b/arch/arm/boot/dts/bcm2835-rpi-a.dts
index 067d1f07a2d36..1f2b9a1bf44ab 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-a.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-a.dts
@@ -3,6 +3,7 @@
 #include "bcm2835.dtsi"
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-a", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts
index cfbdaacbaeba8..eed015e55aeb8 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts
@@ -4,6 +4,7 @@
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-b-plus", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
index 28e7513ce6171..a94a5b8788860 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
@@ -4,6 +4,7 @@
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-smsc9512.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-b-rev2", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts
index 31ff602e2cd36..a49bf6c96c062 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts
@@ -4,6 +4,7 @@
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-smsc9512.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-b", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero.dts b/arch/arm/boot/dts/bcm2835-rpi-zero.dts
index 70362405c5952..eb5cfefb99b2a 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-zero.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-zero.dts
@@ -13,6 +13,7 @@
 #include "bcm2835.dtsi"
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-usb-otg.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-zero", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index c481eab1bd7c0..55292af820e4d 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -108,3 +108,11 @@
 &dsi1 {
 	power-domains = <&power RPI_POWER_DOMAIN_DSI1>;
 };
+
+&csi0 {
+	power-domains = <&power RPI_POWER_DOMAIN_UNICAM0>;
+};
+
+&csi1 {
+	power-domains = <&power RPI_POWER_DOMAIN_UNICAM1>;
+};
diff --git a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
index 2fef70a099535..3c6d475656eae 100644
--- a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
+++ b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
@@ -4,6 +4,7 @@
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,2-model-b", "brcm,bcm2836";
diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
index 89e6fd547c757..e34e90d46a44d 100644
--- a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
@@ -4,6 +4,7 @@
 #include "bcm2835-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
diff --git a/arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi b/arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi
new file mode 100644
index 0000000000000..952a28eaf6163
--- /dev/null
+++ b/arch/arm/boot/dts/bcm283x-rpi-csi0-2lane.dtsi
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+&csi0 {
+	port {
+		endpoint {
+			data-lanes = <1 2>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi b/arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
new file mode 100644
index 0000000000000..451fb4bb4ab81
--- /dev/null
+++ b/arch/arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+&csi1 {
+	port {
+		endpoint {
+			data-lanes = <1 2>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi b/arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi
new file mode 100644
index 0000000000000..9279d4b0bfae2
--- /dev/null
+++ b/arch/arm/boot/dts/bcm283x-rpi-csi1-4lane.dtsi
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+&csi1 {
+	port {
+		endpoint {
+			data-lanes = <1 2 3 4>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 31b29646b14cf..e99b53b41c295 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -565,6 +565,32 @@
 			status = "disabled";
 		};
 
+		csi0: csi@7e800000 {
+			compatible = "brcm,bcm2835-unicam";
+			reg = <0x7e800000 0x800>,
+			      <0x7e802000 0x4>;
+			interrupts = <2 6>;
+			clocks = <&clocks BCM2835_CLOCK_CAM0>;
+			clock-names = "lp";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#clock-cells = <1>;
+			status = "disabled";
+		};
+
+		csi1: csi@7e801000 {
+			compatible = "brcm,bcm2835-unicam";
+			reg = <0x7e801000 0x800>,
+			      <0x7e802004 0x4>;
+			interrupts = <2 7>;
+			clocks = <&clocks BCM2835_CLOCK_CAM1>;
+			clock-names = "lp";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#clock-cells = <1>;
+			status = "disabled";
+		};
+
 		i2c1: i2c@7e804000 {
 			compatible = "brcm,bcm2835-i2c";
 			reg = <0x7e804000 0x1000>;
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
new file mode 120000
index 0000000000000..e5c400284467a
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-csi1-2lane.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x-rpi-csi1-2lane.dtsi
\ No newline at end of file
-- 
GitLab


From 95b53334705ea2ab291982ed52c82d1eb735527d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 15:00:45 +0000
Subject: [PATCH 0203/1835] BCM270X_DT: Add CSI defines for all the downstream
 Pi platforms

Adds the CSI device includes for the bcm27xx platform DTS files

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2708-rpi-0-w.dts      | 1 +
 arch/arm/boot/dts/bcm2708-rpi-b-plus.dts   | 1 +
 arch/arm/boot/dts/bcm2708-rpi-b.dts        | 1 +
 arch/arm/boot/dts/bcm2708-rpi-cm.dts       | 2 ++
 arch/arm/boot/dts/bcm2708-rpi.dtsi         | 8 ++++++++
 arch/arm/boot/dts/bcm2709-rpi-2-b.dts      | 1 +
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts | 1 +
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts      | 1 +
 arch/arm/boot/dts/bcm2710-rpi-cm3.dts      | 2 ++
 9 files changed, 18 insertions(+)

diff --git a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
index ef0b0f040ca5c..68316404aab22 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2708.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,model-zero-w", "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
index 31db4fd917a40..ef0beea3a3a38 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
@@ -2,6 +2,7 @@
 
 #include "bcm2708.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	model = "Raspberry Pi Model B+";
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b.dts b/arch/arm/boot/dts/bcm2708-rpi-b.dts
index ffe5d14feb9f6..dea70fae90e64 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-b.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
@@ -2,6 +2,7 @@
 
 #include "bcm2708.dtsi"
 #include "bcm283x-rpi-smsc9512.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	model = "Raspberry Pi Model B";
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dts b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
index 0b0d23256edd7..1a3975b356309 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
@@ -1,6 +1,8 @@
 /dts-v1/;
 
 #include "bcm2708-rpi-cm.dtsi"
+#include "bcm283x-rpi-csi0-2lane.dtsi"
+#include "bcm283x-rpi-csi1-4lane.dtsi"
 
 / {
 	model = "Raspberry Pi Compute Module";
diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index 131be649e1469..1b5ab163cd6b1 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -161,3 +161,11 @@ sdhost_pins: &sdhost_gpio48 {
 &vec {
 	status = "disabled";
 };
+
+&csi0 {
+	power-domains = <&power RPI_POWER_DOMAIN_UNICAM0>;
+};
+
+&csi1 {
+	power-domains = <&power RPI_POWER_DOMAIN_UNICAM1>;
+};
diff --git a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
index 442d2ebbdd366..34659505055aa 100644
--- a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
@@ -2,6 +2,7 @@
 
 #include "bcm2709.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,2-model-b", "brcm,bcm2836";
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
index fa95f4e3653fb..fe1e2d2daf62a 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -2,6 +2,7 @@
 
 #include "bcm2710.dtsi"
 #include "bcm283x-rpi-lan7515.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,3-model-b-plus", "brcm,bcm2837";
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index 951292d2ad161..36c5675171860 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -2,6 +2,7 @@
 
 #include "bcm2710.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
index 1103b5465521d..2ed05b73e824e 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -1,6 +1,8 @@
 /dts-v1/;
 
 #include "bcm2710.dtsi"
+#include "bcm283x-rpi-csi0-2lane.dtsi"
+#include "bcm283x-rpi-csi1-4lane.dtsi"
 
 / {
 	model = "Raspberry Pi Compute Module 3";
-- 
GitLab


From 30a072bb4580a0443a5bd4c25aa07722e786c32b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 15:01:59 +0000
Subject: [PATCH 0204/1835] arm: dt: Add DT overlays for ADV7282M, OV5647, and
 TC358743

DT overlays to setup the above devices via i2c_arm and csi1.
(This currently does not use the i2c-mux-pinctrl driver to
dynamically switch the pinctrl)

tc358743 is tc358743 running at a default link frequency
of 972Mbit/s. This allows up to 1080P50 UYVY on 2 lanes.
There is a parameter to allow changing the link frequency,
but the only values supported by the driver are 297000000
for 594Mbit/s, and 486000000 for 972Mbit/s.
There is also a parameter to enable 4 lane mode (only
relevant to Compute Module (1 or 3) csi1).

tc358743-audio overlay enables I2S audio from the TC358743
to the Pi (SD to GPIO20, SCK to GPIO18, WFS to GPIO19).

ADV7282M is the Analog Devices analogue video to CSI bridge
chip.

OV5647 is the Pi V1.3 camera module. Currently the driver only
supports VGA 8bit Bayer and very few controls.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |   4 +
 arch/arm/boot/dts/overlays/README             |  51 ++++++++
 .../boot/dts/overlays/adv7282m-overlay.dts    |  76 ++++++++++++
 arch/arm/boot/dts/overlays/ov5647-overlay.dts |  87 ++++++++++++++
 .../dts/overlays/tc358743-audio-overlay.dts   |  52 ++++++++
 .../boot/dts/overlays/tc358743-overlay.dts    | 112 ++++++++++++++++++
 6 files changed, 382 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/adv7282m-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/ov5647-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/tc358743-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 3cdea5b072bfc..98cacf3250d2d 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -6,6 +6,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	ads1015.dtbo \
 	ads1115.dtbo \
 	ads7846.dtbo \
+	adv7282m.dtbo \
 	akkordion-iqdacplus.dtbo \
 	allo-boss-dac-pcm512x-audio.dtbo \
 	allo-digione.dtbo \
@@ -81,6 +82,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	mmc.dtbo \
 	mpu6050.dtbo \
 	mz61581.dtbo \
+	ov5647.dtbo \
 	papirus.dtbo \
 	pi3-act-led.dtbo \
 	pi3-disable-bt.dtbo \
@@ -132,6 +134,8 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	spi2-3cs.dtbo \
 	superaudioboard.dtbo \
 	sx150x.dtbo \
+	tc358743.dtbo \
+	tc358743-audio.dtbo \
 	tinylcd35.dtbo \
 	uart0.dtbo \
 	uart1.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 32f100f568dc8..07ccd805b105b 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -267,6 +267,15 @@ Params: cs                      SPI bus Chip Select (default 1)
         www.kernel.org/doc/Documentation/devicetree/bindings/input/ads7846.txt
 
 
+Name:   adv7282m
+Info:   Analog Devices ADV7282M analogue video to CSI2 bridge.
+        Uses Unicam1, which is the standard camera connector on most Pi
+        variants.
+Load:   dtoverlay=adv7282m,<param>=<val>
+Params: i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+                                This is required for Pi B+, 2, 0, and 0W.
+
+
 Name:   akkordion-iqdacplus
 Info:   Configures the Digital Dreamtime Akkordion Music Player (based on the
         OEM IQAudIO DAC+ or DAC Zero module).
@@ -1284,6 +1293,23 @@ Params: speed                   Display SPI bus speed
         xohms                   Touchpanel sensitivity (X-plate resistance)
 
 
+Name:   ov5647
+Info:   Omnivision OV5647 camera module.
+        Uses Unicam 1, which is the standard camera connector on most Pi
+        variants.
+Load:   dtoverlay=ov5647,<param>=<val>
+Params: cam0-pwdn               GPIO used to control the sensor powerdown line.
+
+        cam0-led                GPIO used to control the sensor led
+                                Both these fields should be automatically filled
+                                in by the firmware to reflect the default GPIO
+                                configuration of the particular Pi variant in
+                                use.
+
+        i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+                                This is required for Pi B+, 2, 0, and 0W.
+
+
 Name:   papirus
 Info:   PaPiRus ePaper Screen by Pi Supply (both HAT and pHAT)
 Load:   dtoverlay=papirus,<param>=<val>
@@ -1893,6 +1919,31 @@ Params: sx150<x>-<n>-<m>        Enables SX150X device on I2C#<n> with slave
                                 connected.
 
 
+Name:   tc358743
+Info:   Toshiba TC358743 HDMI to CSI-2 bridge chip.
+        Uses Unicam 1, which is the standard camera connector on most Pi
+        variants.
+Load:   dtoverlay=tc358743,<param>=<val>
+Params: 4lane                   Use 4 lanes (only applicable to Compute Modules
+                                CAM1 connector).
+
+        link-frequency          Set the link frequency. Only values of 297000000
+                                (574Mbit/s) and 486000000 (972Mbit/s - default)
+                                are supported by the driver.
+
+        i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+                                This is required for Pi B+, 2, 0, and 0W.
+
+
+Name:   tc358743-audio
+Info:   Used in combination with the tc358743-fast overlay to route the audio
+        from the TC358743 over I2S to the Pi.
+        Wiring is LRCK/WFS to GPIO 19, BCK/SCK to GPIO 18, and DATA/SD to GPIO
+        20.
+Load:   dtoverlay=tc358743-audio,<param>=<val>
+Params: card-name               Override the default, "tc358743", card name.
+
+
 Name:   tinylcd35
 Info:   3.5" Color TFT Display by www.tinylcd.com
         Options: Touch, RTC, keypad
diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
new file mode 100644
index 0000000000000..4530989a8e92c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Definitions for Analog Devices ADV7282-M video to CSI2 bridge on VC I2C bus
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			adv7282: adv7282@21 {
+				compatible = "adi,adv7282-m";
+				reg = <0x21>;
+				status = "okay";
+				clock-frequency = <24000000>;
+				port {
+					adv7282_0: endpoint {
+						remote-endpoint = <&csi1_ep>;
+						clock-lanes = <0>;
+						data-lanes = <1>;
+						link-frequencies =
+							/bits/ 64 <297000000>;
+
+						mclk-frequency = <12000000>;
+					};
+				};
+			};
+		};
+	};
+	fragment@1 {
+		target = <&csi1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			port {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				csi1_ep: endpoint {
+					remote-endpoint = <&adv7282_0>;
+				};
+			};
+		};
+	};
+	fragment@2 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <28 29>;
+			brcm,function = <4>; /* alt0 */
+		};
+
+	};
+	fragment@3 {
+		target = <&i2c0_pins>;
+		__overlay__ {
+			brcm,pins = <44 45>;
+			brcm,function = <5>; /* alt1 */
+		};
+	};
+	fragment@4 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		i2c_pins_28_29 = <0>,"+2-3";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
new file mode 100644
index 0000000000000..ac34c94fa433e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Definitions for OV5647 camera module on VC I2C bus
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ov5647: ov5647@36 {
+				compatible = "ov5647";
+				reg = <0x36>;
+				status = "okay";
+
+				pwdn-gpios = <&gpio 41 1>, <&gpio 32 1>;
+				clocks = <&ov5647_clk>;
+
+				ov5647_clk: camera-clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <25000000>;
+				};
+
+				port {
+					ov5647_0: endpoint {
+						remote-endpoint = <&csi1_ep>;
+						clock-lanes = <0>;
+						data-lanes = <1 2>;
+						clock-noncontinuous;
+						link-frequencies =
+							/bits/ 64 <297000000>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&csi1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			port {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				csi1_ep: endpoint {
+					remote-endpoint = <&ov5647_0>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <28 29>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@3 {
+		target = <&i2c0_pins>;
+		__overlay__ {
+			brcm,pins = <44 45>;
+			brcm,function = <5>; /* alt1 */
+		};
+	};
+	fragment@4 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		i2c_pins_28_29 = <0>,"+4-5";
+		cam0-pwdn = <&ov5647>,"pwdn-gpios:4";
+		cam0-led = <&ov5647>,"pwdn-gpios:16";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
new file mode 100644
index 0000000000000..f4e0eeeea4b66
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Definitions to add I2S audio from the Toshiba TC358743 HDMI to CSI2 bridge.
+// Requires tc358743 overlay to have been loaded to actually function.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			tc358743_codec: tc358743-codec {
+				#sound-dai-cells = <0>;
+				compatible = "linux,spdif-dir";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		sound_overlay: __overlay__ {
+			compatible = "simple-audio-card";
+			simple-audio-card,format = "i2s";
+			simple-audio-card,name = "tc358743";
+			simple-audio-card,bitclock-master = <&dailink0_slave>;
+			simple-audio-card,frame-master = <&dailink0_slave>;
+			status = "okay";
+
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+				dai-tdm-slot-num = <2>;
+				dai-tdm-slot-width = <32>;
+			};
+			dailink0_slave: simple-audio-card,codec {
+				sound-dai = <&tc358743_codec>;
+			};
+		};
+	};
+
+	__overrides__ {
+		card-name = <&sound_overlay>,"simple-audio-card,name";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/tc358743-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
new file mode 100644
index 0000000000000..95fec9ea2c79d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Definitions for Toshiba TC358743 HDMI to CSI2 bridge on VC I2C bus
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tc358743@0f {
+				compatible = "toshiba,tc358743";
+				reg = <0x0f>;
+				status = "okay";
+
+				clocks = <&tc358743_clk>;
+				clock-names = "refclk";
+
+				tc358743_clk: bridge-clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <27000000>;
+				};
+
+				port {
+					tc358743: endpoint {
+						remote-endpoint = <&csi1_ep>;
+						clock-lanes = <0>;
+						clock-noncontinuous;
+						link-frequencies =
+							/bits/ 64 <486000000>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&csi1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			port {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				csi1_ep: endpoint {
+					remote-endpoint = <&tc358743>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			tc358743@0f {
+				port {
+					endpoint {
+						data-lanes = <1 2>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_vc>;
+		__dormant__ {
+			tc358743@0f {
+				port {
+					endpoint {
+						data-lanes = <1 2 3 4>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <28 29>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@5 {
+		target = <&i2c0_pins>;
+		__overlay__ {
+			brcm,pins = <44 45>;
+			brcm,function = <5>; /* alt1 */
+		};
+	};
+	fragment@6 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		i2c_pins_28_29 = <0>,"+4-5";
+		4lane = <0>, "-2+3";
+		link-frequency = <&tc358743>,"link-frequencies#0";
+	};
+};
-- 
GitLab


From 7a1a26f750c03102b4a16f85967f293ee271678c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 31 Oct 2018 15:02:18 +0000
Subject: [PATCH 0205/1835] dtoverlays: Add support for ADV7280-M, ADV7281-M
 and ADV7281-MA chips.

The driver that supports the ADV7282-M also supports the ADV7280-M,
ADV7281-M, and ADV7281-MA.
The 7280-M exposes 8 analogue inputs. The 7281-M doesn't have the
I2P deinterlacing block. The 7281-MA has 8 inputs but no I2P.
Otherwise they are the same as ADV7282-M.

Adds a new overlay "adv728x" that includes the existing adv7282
overlay but adds several parameters to modify the behaviour.

Adds a new addr parameter to allow the I2C address to be changed.
(the chip has an address select pin to change between 0x20 and 0x21).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             | 13 +++++++
 .../boot/dts/overlays/adv7282m-overlay.dts    |  9 +++--
 .../boot/dts/overlays/adv728x-m-overlay.dts   | 37 +++++++++++++++++++
 4 files changed, 56 insertions(+), 4 deletions(-)
 create mode 100644 arch/arm/boot/dts/overlays/adv728x-m-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 98cacf3250d2d..e6313733127bf 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -7,6 +7,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	ads1115.dtbo \
 	ads7846.dtbo \
 	adv7282m.dtbo \
+	adv728x-m.dtbo \
 	akkordion-iqdacplus.dtbo \
 	allo-boss-dac-pcm512x-audio.dtbo \
 	allo-digione.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 07ccd805b105b..d4d8438cfef7c 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -274,6 +274,19 @@ Info:   Analog Devices ADV7282M analogue video to CSI2 bridge.
 Load:   dtoverlay=adv7282m,<param>=<val>
 Params: i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
                                 This is required for Pi B+, 2, 0, and 0W.
+        addr                    Overrides the I2C address (default 0x21)
+
+
+Name:   adv728x-m
+Info:   Analog Devices ADV728[0|1|2]-M analogue video to CSI2 bridges.
+        This is a wrapper for adv7282m, and defaults to ADV7282M.
+Load:   dtoverlay=adv728x-m,<param>=<val>
+Params: i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+                                This is required for Pi B+, 2, 0, and 0W.
+        addr                    Overrides the I2C address (default 0x21)
+        adv7280m                Select ADV7280-M.
+        adv7281m                Select ADV7281-M.
+        adv7281ma               Select ADV7281-MA.
 
 
 Name:   akkordion-iqdacplus
diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
index 4530989a8e92c..1121171221346 100644
--- a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
@@ -13,13 +13,13 @@
 			#size-cells = <0>;
 			status = "okay";
 
-			adv7282: adv7282@21 {
+			adv728x: adv728x@21 {
 				compatible = "adi,adv7282-m";
 				reg = <0x21>;
 				status = "okay";
 				clock-frequency = <24000000>;
 				port {
-					adv7282_0: endpoint {
+					adv728x_0: endpoint {
 						remote-endpoint = <&csi1_ep>;
 						clock-lanes = <0>;
 						data-lanes = <1>;
@@ -43,7 +43,7 @@
 				#address-cells = <1>;
 				#size-cells = <0>;
 				csi1_ep: endpoint {
-					remote-endpoint = <&adv7282_0>;
+					remote-endpoint = <&adv728x_0>;
 				};
 			};
 		};
@@ -71,6 +71,7 @@
 	};
 
 	__overrides__ {
-		i2c_pins_28_29 = <0>,"+2-3";
+		i2c_pins_28_29 =	<0>,"+2-3";
+		addr =			<&adv728x>,"reg:0";
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
new file mode 100644
index 0000000000000..f8882669ebc6f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Definitions for Analog Devices ADV728[0|1|2]-M video to CSI2 bridges on VC
+// I2C bus
+
+#include "adv7282m-overlay.dts"
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// Fragment numbers deliberately high to avoid conflicts with the
+	// included adv7282m overlay file.
+
+	fragment@101 {
+		target = <&adv728x>;
+		__dormant__ {
+			compatible = "adi,adv7280-m";
+		};
+	};
+	fragment@102 {
+		target = <&adv728x>;
+		__dormant__ {
+			compatible = "adi,adv7281-m";
+		};
+	};
+	fragment@103 {
+		target = <&adv728x>;
+		__dormant__ {
+			compatible = "adi,adv7281-ma";
+		};
+	};
+
+	__overrides__ {
+		adv7280m = <0>, "+101";
+		adv7281m = <0>, "+102";
+		adv7281ma = <0>, "+103";
+	};
+};
-- 
GitLab


From cd3c820d8c52bc6246e074196279e31f0b6e175b Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Tue, 13 Nov 2018 17:27:00 +0000
Subject: [PATCH 0206/1835] Mailbox firmware calls now use kmalloc (#2749)

A previous change moved away from variable stack
allocation of a data buffer to a fixed maximum size.
However, some mailbox calls use larger data buffers
than the maximum allowed. This change moves from
stack storage to kmalloc to ensure all sizes are
catered for.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 drivers/firmware/raspberrypi.c | 35 +++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index a4225b74f154c..fbcfd50eb6a3d 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -15,6 +15,7 @@
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
 #include <linux/reboot.h>
+#include <linux/slab.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
@@ -22,8 +23,6 @@
 #define MBOX_DATA28(msg)		((msg) & ~0xf)
 #define MBOX_CHAN_PROPERTY		8
 
-#define MAX_RPI_FW_PROP_BUF_SIZE	48
-
 static struct platform_device *rpi_hwmon;
 
 struct rpi_firmware {
@@ -149,28 +148,28 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_list);
 int rpi_firmware_property(struct rpi_firmware *fw,
 			  u32 tag, void *tag_data, size_t buf_size)
 {
-	/* Single tags are very small (generally 8 bytes), so the
-	 * stack should be safe.
-	 */
-	u8 data[sizeof(struct rpi_firmware_property_tag_header) +
-		MAX_RPI_FW_PROP_BUF_SIZE];
-	struct rpi_firmware_property_tag_header *header =
-		(struct rpi_firmware_property_tag_header *)data;
 	int ret;
+	struct rpi_firmware_property_tag_header *header;
 
-	if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
-		return -EINVAL;
+	/* Some mailboxes can use over 1k bytes. Rather than checking
+	 * size and using stack or kmalloc depending on requirements,
+	 * just use kmalloc. Mailboxes don't get called enough to worry
+	 * too much about the time taken in the allocation.
+	 */
+	void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
 
+	if (!data)
+		return -ENOMEM;
+
+	header = data;
 	header->tag = tag;
 	header->buf_size = buf_size;
 	header->req_resp_size = 0;
-	memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
-	       tag_data, buf_size);
+	memcpy(data + sizeof(*header), tag_data, buf_size);
 
-	ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
-	memcpy(tag_data,
-	       data + sizeof(struct rpi_firmware_property_tag_header),
-	       buf_size);
+	ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
+
+	memcpy(tag_data, data + sizeof(*header), buf_size);
 
 	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
 	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
@@ -178,6 +177,8 @@ int rpi_firmware_property(struct rpi_firmware *fw,
 		sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
 	}
 
+	kfree(data);
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(rpi_firmware_property);
-- 
GitLab


From e867b624297bfb5c5f502f11135ca016668146ba Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 14 Nov 2018 11:54:46 +0000
Subject: [PATCH 0207/1835] vcsm: Fix an NULL dereference in the import_dmabuf
 error path

resource was dereferenced even though it was NULL.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/char/broadcom/vc_sm/vmcs_sm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/broadcom/vc_sm/vmcs_sm.c b/drivers/char/broadcom/vc_sm/vmcs_sm.c
index 1bc37ee882255..56a21658b5383 100644
--- a/drivers/char/broadcom/vc_sm/vmcs_sm.c
+++ b/drivers/char/broadcom/vc_sm/vmcs_sm.c
@@ -2315,8 +2315,8 @@ int vc_sm_ioctl_import_dmabuf(struct sm_priv_data_t *private,
 	return 0;
 
 error:
-	resource->res_stats[IMPORT_FAIL]++;
 	if (resource) {
+		resource->res_stats[IMPORT_FAIL]++;
 		vc_sm_resource_deceased(resource, 1);
 		kfree(resource);
 	}
-- 
GitLab


From edd0e645d5f2c3e6f9490fd3d804952384f7605d Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Tue, 13 Nov 2018 16:51:21 +0000
Subject: [PATCH 0208/1835] Update README (#2750)

Small update to the DT blob docs to include the axiperf option.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index d4d8438cfef7c..b851a32cb65da 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -89,6 +89,11 @@ Params:
         audio                   Set to "on" to enable the onboard ALSA audio
                                 interface (default "off")
 
+        axiperf                 Set to "on" to enable the AXI bus performance
+                                monitors.
+                                See /sys/kernel/debug/raspberrypi_axi_monitor
+                                for the results.
+
         eee                     Enable Energy Efficient Ethernet support for
                                 compatible devices (default "on"). See also
                                 "tx_lpi_timer".
-- 
GitLab


From 08e788e6ae99239d509f49cd0476a4e9b646fe87 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 14 Nov 2018 09:53:25 +0000
Subject: [PATCH 0209/1835] overlays: Remove superfluous #address/size-cells

Newer versions of dtc warn about unnecessary usage of #address-cells
and #size-cells, so remove them.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/adv7282m-overlay.dts | 4 ----
 arch/arm/boot/dts/overlays/ov5647-overlay.dts   | 4 ----
 arch/arm/boot/dts/overlays/tc358743-overlay.dts | 4 ----
 3 files changed, 12 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
index 1121171221346..76a1d3c3a1da6 100644
--- a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
@@ -35,13 +35,9 @@
 	fragment@1 {
 		target = <&csi1>;
 		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <0>;
 			status = "okay";
 
 			port {
-				#address-cells = <1>;
-				#size-cells = <0>;
 				csi1_ep: endpoint {
 					remote-endpoint = <&adv728x_0>;
 				};
diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
index ac34c94fa433e..09867134e5e5f 100644
--- a/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
@@ -44,13 +44,9 @@
 	fragment@1 {
 		target = <&csi1>;
 		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <0>;
 			status = "okay";
 
 			port {
-				#address-cells = <1>;
-				#size-cells = <0>;
 				csi1_ep: endpoint {
 					remote-endpoint = <&ov5647_0>;
 				};
diff --git a/arch/arm/boot/dts/overlays/tc358743-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
index 95fec9ea2c79d..69fdbf4897f61 100644
--- a/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
@@ -43,13 +43,9 @@
 	fragment@1 {
 		target = <&csi1>;
 		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <0>;
 			status = "okay";
 
 			port {
-				#address-cells = <1>;
-				#size-cells = <0>;
 				csi1_ep: endpoint {
 					remote-endpoint = <&tc358743>;
 				};
-- 
GitLab


From 642c08ea18795621d9e029754f6287dc168208b1 Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Sun, 18 Nov 2018 13:21:26 +0100
Subject: [PATCH 0210/1835] Revert "ASoC: wm8804: MCLK configuration options,
 32-bit"

This reverts commit 3b12dcf797f5a4635aecd7f5c090dc507b124ffd.

Despite the commit message being wrong idle_bias changes
were already reverted in the 4.14 tree.

So drop the commit to bring the wm8804 driver back in line with
the rpi-4.14.y and upstream linux trees.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/codecs/wm8804.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c
index 813c47766fb48..89f13249966ea 100644
--- a/sound/soc/codecs/wm8804.c
+++ b/sound/soc/codecs/wm8804.c
@@ -550,7 +550,6 @@ static const struct snd_soc_component_driver soc_component_dev_wm8804 = {
 	.use_pmdown_time	= 1,
 	.endianness		= 1,
 	.non_legacy_dai_naming	= 1,
-	.idle_bias_on		= true,
 };
 
 const struct regmap_config wm8804_regmap_config = {
-- 
GitLab


From 0261f1f6ac024686b726bfef54ad643e21428bf2 Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Sun, 18 Nov 2018 15:24:16 +0100
Subject: [PATCH 0211/1835] rpi-wm8804-soundcard: drop PWRDN register writes

Since kernel 4.0 the PWRDN register bits are under DAPM
control from the wm8804 driver.

Drop code that modifies that register to avoid interfering
with DAPM.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/rpi-wm8804-soundcard.c | 55 ----------------------------
 1 file changed, 55 deletions(-)

diff --git a/sound/soc/bcm/rpi-wm8804-soundcard.c b/sound/soc/bcm/rpi-wm8804-soundcard.c
index 361d4784cbd75..ad42f5d35067b 100644
--- a/sound/soc/bcm/rpi-wm8804-soundcard.c
+++ b/sound/soc/bcm/rpi-wm8804-soundcard.c
@@ -54,8 +54,6 @@ struct snd_rpi_wm8804_drvdata {
 	struct snd_soc_dai_link *dai;
 	/* Required - snd_soc_card name */
 	const char *card_name;
-	/* Optional- Overrides the module paramter */
-	unsigned short auto_shutdown_output;
 	/* Optional DT node names if card info is defined in DT */
 	const char *card_name_dt;
 	const char *dai_name_dt;
@@ -64,51 +62,12 @@ struct snd_rpi_wm8804_drvdata {
 	int (*probe)(struct platform_device *pdev);
 };
 
-static short int auto_shutdown_output;
-module_param(auto_shutdown_output, short, 0660);
-MODULE_PARM_DESC(auto_shutdown_output, "Shutdown SP/DIF output if playback is stopped");
-
 static struct gpio_desc *snd_clk44gpio;
 static struct gpio_desc *snd_clk48gpio;
 
 #define CLK_44EN_RATE 22579200UL
 #define CLK_48EN_RATE 24576000UL
 
-static int snd_rpi_wm8804_init(struct snd_soc_pcm_runtime *rtd)
-{
-	struct snd_soc_component *component = rtd->codec_dai->component;
-	int rc;
-
-	pr_debug("%s\n", __func__);
-
-	rc = snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
-	return rc < 0 ? rc : 0;
-}
-
-static int snd_rpi_wm8804_digi_startup(struct snd_pcm_substream *substream)
-{
-	struct snd_soc_pcm_runtime *rtd = substream->private_data;
-	struct snd_soc_component *component = rtd->codec_dai->component;
-	int rc;
-
-	pr_debug("%s\n", __func__);
-
-	rc = snd_soc_component_update_bits(component, WM8804_PWRDN, 0x3c, 0x00);
-	return rc < 0 ? rc : 0;
-}
-
-static void snd_rpi_wm8804_digi_shutdown(struct snd_pcm_substream *substream)
-{
-	struct snd_soc_pcm_runtime *rtd = substream->private_data;
-	struct snd_soc_component *component = rtd->codec_dai->component;
-
-	pr_debug("%s %d\n", __func__, auto_shutdown_output);
-
-	if (auto_shutdown_output)
-		snd_soc_component_update_bits(component, WM8804_PWRDN,
-				0x3c, 0x3c);
-}
-
 static unsigned int snd_rpi_wm8804_enable_clock(unsigned int samplerate)
 {
 	switch (samplerate) {
@@ -204,12 +163,6 @@ static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
 		return ret;
 	}
 
-	/* Enable TX output */
-	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x4, 0x0);
-
-	/* Power on */
-	snd_soc_component_update_bits(component, WM8804_PWRDN, 0x9, 0);
-
 	/* set sampling frequency status bits */
 	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f,
 			sampling_freq);
@@ -219,8 +172,6 @@ static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
 
 static struct snd_soc_ops snd_rpi_wm8804_ops = {
 	.hw_params = snd_rpi_wm8804_hw_params,
-	.startup   = snd_rpi_wm8804_digi_startup,
-	.shutdown  = snd_rpi_wm8804_digi_shutdown,
 };
 
 static struct snd_soc_dai_link snd_justboom_digi_dai[] = {
@@ -233,7 +184,6 @@ static struct snd_soc_dai_link snd_justboom_digi_dai[] = {
 static struct snd_rpi_wm8804_drvdata drvdata_justboom_digi = {
 	.card_name            = "snd_rpi_justboom_digi",
 	.dai                  = snd_justboom_digi_dai,
-	.auto_shutdown_output = 1,
 };
 
 static struct snd_soc_dai_link snd_iqaudio_digi_dai[] = {
@@ -335,8 +285,6 @@ static int snd_rpi_wm8804_probe(struct platform_device *pdev)
 
 		snd_soc_card_set_drvdata(&snd_rpi_wm8804, drvdata);
 
-		if (!dai->init)
-			dai->init = snd_rpi_wm8804_init;
 		if (!dai->ops)
 			dai->ops = &snd_rpi_wm8804_ops;
 		if (!dai->codec_dai_name)
@@ -348,9 +296,6 @@ static int snd_rpi_wm8804_probe(struct platform_device *pdev)
 				SND_SOC_DAIFMT_NB_NF |
 				SND_SOC_DAIFMT_CBM_CFM;
 
-		if (drvdata->auto_shutdown_output)
-			auto_shutdown_output = 1;
-
 		snd_rpi_wm8804.dai_link = dai;
 		i2s_node = of_parse_phandle(pdev->dev.of_node,
 				"i2s-controller", 0);
-- 
GitLab


From 4b2501f2386ce9edeb882484a1e46b8a357db01e Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Sun, 18 Nov 2018 15:32:28 +0100
Subject: [PATCH 0212/1835] rpi-wm8804-soundcard: configure wm8804 clocks only
 on rate change

This should avoid clicks when stopping and immediately afterwards
starting a stream with the same samplerate as before.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 sound/soc/bcm/rpi-wm8804-soundcard.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sound/soc/bcm/rpi-wm8804-soundcard.c b/sound/soc/bcm/rpi-wm8804-soundcard.c
index ad42f5d35067b..c1bed91e2cdae 100644
--- a/sound/soc/bcm/rpi-wm8804-soundcard.c
+++ b/sound/soc/bcm/rpi-wm8804-soundcard.c
@@ -64,6 +64,7 @@ struct snd_rpi_wm8804_drvdata {
 
 static struct gpio_desc *snd_clk44gpio;
 static struct gpio_desc *snd_clk48gpio;
+static int wm8804_samplerate = 0;
 
 #define CLK_44EN_RATE 22579200UL
 #define CLK_48EN_RATE 24576000UL
@@ -117,6 +118,12 @@ static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
 	struct wm8804_clk_cfg clk_cfg;
 	int samplerate = params_rate(params);
 
+	if (samplerate == wm8804_samplerate)
+		return 0;
+
+	/* clear until all clocks are setup properly */
+	wm8804_samplerate = 0;
+
 	snd_rpi_wm8804_clk_cfg(samplerate, &clk_cfg);
 
 	pr_debug("%s samplerate: %d mclk_freq: %u mclk_div: %u sysclk: %u\n",
@@ -163,6 +170,8 @@ static int snd_rpi_wm8804_hw_params(struct snd_pcm_substream *substream,
 		return ret;
 	}
 
+	wm8804_samplerate = samplerate;
+
 	/* set sampling frequency status bits */
 	snd_soc_component_update_bits(component, WM8804_SPDTX4, 0x0f,
 			sampling_freq);
-- 
GitLab


From 9978416895c97f29df538229ea04497e9bc9f45e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 26 Nov 2018 17:02:15 +0000
Subject: [PATCH 0213/1835] dtoverlays: Add i2c on 0&1 option to TC358743,
 ADV7282 and OV5647

Adds the option of configuring i2c0 to be on GPIOs 0&1 as
this is of use on the Compute Module.

Also fixes the ov5647 overlay where the override enabled the wrong
fragments.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README               | 14 ++++++++++++--
 arch/arm/boot/dts/overlays/adv7282m-overlay.dts | 10 +++++++++-
 arch/arm/boot/dts/overlays/ov5647-overlay.dts   | 10 +++++++++-
 arch/arm/boot/dts/overlays/tc358743-overlay.dts | 10 +++++++++-
 4 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index b851a32cb65da..fb6d0ddbbc761 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -277,7 +277,9 @@ Info:   Analog Devices ADV7282M analogue video to CSI2 bridge.
         Uses Unicam1, which is the standard camera connector on most Pi
         variants.
 Load:   dtoverlay=adv7282m,<param>=<val>
-Params: i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+Params: i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
+                                Useful on Compute Modules.
+        i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
                                 This is required for Pi B+, 2, 0, and 0W.
         addr                    Overrides the I2C address (default 0x21)
 
@@ -286,7 +288,9 @@ Name:   adv728x-m
 Info:   Analog Devices ADV728[0|1|2]-M analogue video to CSI2 bridges.
         This is a wrapper for adv7282m, and defaults to ADV7282M.
 Load:   dtoverlay=adv728x-m,<param>=<val>
-Params: i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+Params: i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
+                                Useful on Compute Modules.
+        i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
                                 This is required for Pi B+, 2, 0, and 0W.
         addr                    Overrides the I2C address (default 0x21)
         adv7280m                Select ADV7280-M.
@@ -1324,6 +1328,9 @@ Params: cam0-pwdn               GPIO used to control the sensor powerdown line.
                                 configuration of the particular Pi variant in
                                 use.
 
+        i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
+                                Useful on Compute Modules.
+
         i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
                                 This is required for Pi B+, 2, 0, and 0W.
 
@@ -1949,6 +1956,9 @@ Params: 4lane                   Use 4 lanes (only applicable to Compute Modules
                                 (574Mbit/s) and 486000000 (972Mbit/s - default)
                                 are supported by the driver.
 
+        i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
+                                Useful on Compute Modules.
+
         i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
                                 This is required for Pi B+, 2, 0, and 0W.
 
diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
index 76a1d3c3a1da6..c30b6e69f3428 100644
--- a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
@@ -60,6 +60,13 @@
 		};
 	};
 	fragment@4 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <0 1>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@5 {
 		target = <&i2c_vc>;
 		__overlay__ {
 			status = "okay";
@@ -67,7 +74,8 @@
 	};
 
 	__overrides__ {
-		i2c_pins_28_29 =	<0>,"+2-3";
+		i2c_pins_0_1 =		<0>,"-2-3+4";
+		i2c_pins_28_29 =	<0>,"+2-3-4";
 		addr =			<&adv728x>,"reg:0";
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
index 09867134e5e5f..88fde695ade45 100644
--- a/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
@@ -69,6 +69,13 @@
 		};
 	};
 	fragment@4 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <0 1>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@5 {
 		target = <&i2c_vc>;
 		__overlay__ {
 			status = "okay";
@@ -76,7 +83,8 @@
 	};
 
 	__overrides__ {
-		i2c_pins_28_29 = <0>,"+4-5";
+		i2c_pins_0_1 = <0>,"-2-3+4";
+		i2c_pins_28_29 = <0>,"+2-3-4";
 		cam0-pwdn = <&ov5647>,"pwdn-gpios:4";
 		cam0-led = <&ov5647>,"pwdn-gpios:16";
 	};
diff --git a/arch/arm/boot/dts/overlays/tc358743-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
index 69fdbf4897f61..73845c532a592 100644
--- a/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
@@ -94,6 +94,13 @@
 		};
 	};
 	fragment@6 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <0 1>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@7 {
 		target = <&i2c_vc>;
 		__overlay__ {
 			status = "okay";
@@ -101,7 +108,8 @@
 	};
 
 	__overrides__ {
-		i2c_pins_28_29 = <0>,"+4-5";
+		i2c_pins_0_1 = <0>,"-4-5+6";
+		i2c_pins_28_29 = <0>,"+4-5-6";
 		4lane = <0>, "-2+3";
 		link-frequency = <&tc358743>,"link-frequencies#0";
 	};
-- 
GitLab


From a95b5cfc5270ed0124713549b48cb24082a01ccd Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 26 Nov 2018 20:15:16 +0000
Subject: [PATCH 0214/1835] overlays: Update upstream overlay

The vc4-kms-v3d overlay gained an extra fragment enabling the txp node,
so rebuild the upstream overlay to match.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/upstream-overlay.dts | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
index ff37a5013de47..b597f863c4a87 100644
--- a/arch/arm/boot/dts/overlays/upstream-overlay.dts
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -116,6 +116,12 @@
 		};
 	};
 	fragment@17 {
+		target = <&txp>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@18 {
 		target = <&usb>;
 		#address-cells = <1>;
 		#size-cells = <1>;
@@ -130,21 +136,21 @@
 			status = "okay";
 		};
 	};
-	fragment@18 {
+	fragment@19 {
 		target = <&uart1>;
 		__overlay__ {
 			interrupt-parent = <&intc>;
 			interrupts = <0x1 0x1d>;
 		};
 	};
-	fragment@19 {
+	fragment@20 {
 		target = <&spi1>;
 		__overlay__ {
 			interrupt-parent = <&intc>;
 			interrupts = <0x1 0x1d>;
 		};
 	};
-	fragment@20 {
+	fragment@21 {
 		target = <&spi2>;
 		__overlay__ {
 			interrupt-parent = <&intc>;
-- 
GitLab


From d2263e5e29fc793fcf95f1cda6625a2ba5e50d4b Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 28 Nov 2018 10:36:01 +0100
Subject: [PATCH 0215/1835] BCM2708_DT: update firmware node binding

The upstreamed version of the firmware node has been updated to present
it as a "simple-bus". We need to get this in order to accomodate other
device bindings, namely RPi's firmware based gpio expander.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
---
 arch/arm/boot/dts/bcm2708-rpi.dtsi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index 1b5ab163cd6b1..9e14921867284 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -50,7 +50,9 @@
 		};
 
 		firmware: firmware {
-			compatible = "raspberrypi,bcm2835-firmware";
+			compatible = "raspberrypi,bcm2835-firmware", "simple-bus";
+			#address-cells = <0>;
+			#size-cells = <0>;
 			mboxes = <&mailbox>;
 		};
 
-- 
GitLab


From abca720e8a2d776fd9ba75920561ac90b466164a Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Tue, 27 Nov 2018 16:59:10 +0100
Subject: [PATCH 0216/1835] BCM2710_DT: fix gpio expander bindings

The upstreamed driver for the GPIO expander expects to be a children of
the "firmware" node.

The patch also removes the "firmware" phandle as it's useless.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
---
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts | 3 +--
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts      | 4 +++-
 arch/arm/boot/dts/bcm2710-rpi-cm3.dts      | 4 +++-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
index fe1e2d2daf62a..898ab48479e32 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -83,12 +83,11 @@
 	brcm,overclock-50 = <0>;
 };
 
-&soc {
+&firmware {
 	expgpio: expgpio {
 		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
-		firmware = <&firmware>;
 		status = "okay";
 	};
 };
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index 36c5675171860..61ecb46b9c060 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -92,11 +92,13 @@
 		status = "okay";
 	};
 
+};
+
+&firmware {
 	expgpio: expgpio {
 		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
-		firmware = <&firmware>;
 		status = "okay";
 	};
 };
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
index 2ed05b73e824e..9490177443a5e 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -53,11 +53,13 @@
 		status = "okay";
 	};
 
+};
+
+&firmware {
 	expgpio: expgpio {
 		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
-		firmware = <&firmware>;
 		status = "okay";
 	};
 };
-- 
GitLab


From d4a3ea4c558d7e3ee9f002f002bd6c705f52e110 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 27 Nov 2018 16:33:31 +0000
Subject: [PATCH 0217/1835] ARM: dts: bcm283x: The lan7515 PHY node has moved

The DT node describing the LAN7800s PHY has now moved inside an "mdio"
node. Update the DT declarations accordingly.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi | 31 ++++++++++++++--------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
index 76039f81f17f3..a925fa107a01f 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
@@ -1,4 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
+#include <dt-bindings/net/microchip-lan78xx.h>
+
 / {
 	aliases {
 		ethernet0 = &ethernet;
@@ -21,13 +23,20 @@
 			ethernet: ethernet@1 {
 				compatible = "usb424,7800";
 				reg = <1>;
-				microchip,eee-enabled;
-				microchip,tx-lpi-timer = <600>; /* non-aggressive*/
-				/*
-				 * led0 = 1:link1000/activity
-				 * led1 = 6:link10/100/activity
-				 */
-				microchip,led-modes = <1 6>;
+
+				mdio {
+					#address-cells = <0x1>;
+					#size-cells = <0x0>;
+					eth_phy: ethernet-phy@1 {
+						reg = <1>;
+						microchip,eee-enabled;
+						microchip,tx-lpi-timer = <600>; /* non-aggressive*/
+						microchip,led-modes = <
+							LAN78XX_LINK_1000_ACTIVITY
+							LAN78XX_LINK_10_100_ACTIVITY
+						>;
+					};
+				};
 			};
 		};
 	};
@@ -36,9 +45,9 @@
 
 / {
 	__overrides__ {
-		eee = <&ethernet>,"microchip,eee-enabled?";
-		tx_lpi_timer = <&ethernet>,"microchip,tx-lpi-timer:0";
-		eth_led0 = <&ethernet>,"microchip,led-modes:0";
-		eth_led1 = <&ethernet>,"microchip,led-modes:4";
+		eee = <&eth_phy>,"microchip,eee-enabled?";
+		tx_lpi_timer = <&eth_phy>,"microchip,tx-lpi-timer:0";
+		eth_led0 = <&eth_phy>,"microchip,led-modes:0";
+		eth_led1 = <&eth_phy>,"microchip,led-modes:4";
 	};
 };
-- 
GitLab


From 795fb798b7b9cf42f9376365897b956e2b24fa28 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 26 Nov 2018 19:46:58 +0000
Subject: [PATCH 0218/1835] net: lan78xx: Support auto-downshift to 100Mb/s

Ethernet cables with faulty or missing pairs (specifically pairs C and
D) allow auto-negotiation to 1000Mbs, but do not support the successful
establishment of a link. Add a DT property, "microchip,downshift-after",
to configure the number of auto-negotiation failures after which it
falls back to 100Mbs. Valid values are 2, 3, 4, 5 and 0, where 0 means
never downshift.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/phy/microchip.c  | 32 ++++++++++++++++++++++++++++++++
 include/linux/microchipphy.h |  8 ++++++++
 2 files changed, 40 insertions(+)

diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
index 2d67937866a35..ecf166ee36da6 100644
--- a/drivers/net/phy/microchip.c
+++ b/drivers/net/phy/microchip.c
@@ -228,6 +228,7 @@ static int lan88xx_probe(struct phy_device *phydev)
 	struct device *dev = &phydev->mdio.dev;
 	struct lan88xx_priv *priv;
 	u32 led_modes[4];
+	u32 downshift_after = 0;
 	int len;
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -257,6 +258,37 @@ static int lan88xx_probe(struct phy_device *phydev)
 		return -EINVAL;
 	}
 
+	if (!of_property_read_u32(dev->of_node,
+				  "microchip,downshift-after",
+				  &downshift_after)) {
+		u32 mask = LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_MASK;
+		u32 val = LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT;
+
+		switch (downshift_after) {
+		case 2:
+			val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_2;
+			break;
+		case 3:
+			val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_3;
+			break;
+		case 4:
+			val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_4;
+			break;
+		case 5:
+			val |= LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_5;
+			break;
+		case 0:
+			/* Disable completely */
+			mask = LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT;
+			val = 0;
+			break;
+		default:
+			return -EINVAL;
+		}
+		(void)phy_modify_paged(phydev, 1, LAN78XX_PHY_CTRL3,
+				       mask, val);
+	}
+
 	/* these values can be used to identify internal PHY */
 	priv->chip_id = phy_read_mmd(phydev, 3, LAN88XX_MMD3_CHIP_ID);
 	priv->chip_rev = phy_read_mmd(phydev, 3, LAN88XX_MMD3_CHIP_REV);
diff --git a/include/linux/microchipphy.h b/include/linux/microchipphy.h
index 8c40128af2402..004e1cd55c2f5 100644
--- a/include/linux/microchipphy.h
+++ b/include/linux/microchipphy.h
@@ -73,6 +73,14 @@
 /* Registers specific to the LAN7800/LAN7850 embedded phy */
 #define LAN78XX_PHY_LED_MODE_SELECT		(0x1D)
 
+#define LAN78XX_PHY_CTRL3			(0x14)
+#define LAN78XX_PHY_CTRL3_AUTO_DOWNSHIFT	(0x0010)
+#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_MASK	(0x000c)
+#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_2	(0x0000)
+#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_3	(0x0004)
+#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_4	(0x0008)
+#define LAN78XX_PHY_CTRL3_DOWNSHIFT_CTRL_5	(0x000c)
+
 /* DSP registers */
 #define PHY_ARDENNES_MMD_DEV_3_PHY_CFG		(0x806A)
 #define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_	(0x2000)
-- 
GitLab


From e1c4324198a4bde2765dfbf188e1bb24eec84ad1 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 28 Nov 2018 15:51:41 +0000
Subject: [PATCH 0219/1835] dt-bindings: Document microchip,downshift-after

Document the optional downshift-after property of the lan78xx's PHY.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 Documentation/devicetree/bindings/net/microchip,lan78xx.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Documentation/devicetree/bindings/net/microchip,lan78xx.txt b/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
index 76786a0f6d3d7..ad1d0136c4dff 100644
--- a/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
+++ b/Documentation/devicetree/bindings/net/microchip,lan78xx.txt
@@ -15,6 +15,9 @@ Optional properties of the embedded PHY:
 - microchip,led-modes: a 0..4 element vector, with each element configuring
   the operating mode of an LED. Omitted LEDs are turned off. Allowed values
   are defined in "include/dt-bindings/net/microchip-lan78xx.h".
+- microchip,downshift-after: sets the number of failed auto-negotiation
+  attempts after which the link is downgraded from 1000BASE-T. Should be one of
+  2, 3, 4, 5 or 0, where 0 means never downshift.
 
 Example:
 
-- 
GitLab


From 599aeba4dc081babb6d5f4de483988ea51d61e54 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 27 Nov 2018 16:55:14 +0000
Subject: [PATCH 0220/1835] ARM: dts: bcm283x: Set downshift-after for Pi 3B+

Enable the auto-downshift feature on Raspberry Pi 3B+ so that a link
can eventually be established using a cable with pairs C and/or D
missing or broken in a 1000Mbps-capable port.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
index a925fa107a01f..69d2c2757e45d 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
@@ -31,6 +31,7 @@
 						reg = <1>;
 						microchip,eee-enabled;
 						microchip,tx-lpi-timer = <600>; /* non-aggressive*/
+						microchip,downshift-after = <2>;
 						microchip,led-modes = <
 							LAN78XX_LINK_1000_ACTIVITY
 							LAN78XX_LINK_10_100_ACTIVITY
-- 
GitLab


From 200609795123b59ae9e43f7c43a23bb5da1813bc Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 27 Nov 2018 16:56:50 +0000
Subject: [PATCH 0221/1835] BCM270X_DT: Add new Ethernet DT parameters

Add "eth_downshift_after" DT parameter to allow the delay before the
downshift to be specified. The default is 2 auto-negotiation cycles,
and legal values are 2, 3, 4, 5 and 0 (disabled).

Add "eth_max_speed" DT parameter as a way of prohibiting 1000Mbps
links. This can be used to avoid the delay until the downshift mechanism
activates. Legal values are 10, 100 and 1000, where the default is
unlimited (effectively 1000Mbps).

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi | 2 ++
 arch/arm/boot/dts/overlays/README          | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
index 69d2c2757e45d..78742d623b6cc 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
@@ -50,5 +50,7 @@
 		tx_lpi_timer = <&eth_phy>,"microchip,tx-lpi-timer:0";
 		eth_led0 = <&eth_phy>,"microchip,led-modes:0";
 		eth_led1 = <&eth_phy>,"microchip,led-modes:4";
+		eth_downshift_after = <&eth_phy>,"microchip,downshift-after";
+		eth_max_speed = <&eth_phy>,"max-speed:0";
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index fb6d0ddbbc761..1e89b61a49069 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -98,6 +98,11 @@ Params:
                                 compatible devices (default "on"). See also
                                 "tx_lpi_timer".
 
+        eth_downshift_after     Set the number of auto-negotiation failures
+                                after which the 1000Mbps modes are disabled.
+                                Legal values are 2, 3, 4, 5 and 0, where
+                                0 means never downshift (default 2).
+
         eth_led0                Set mode of LED0 (usually orange) (default
                                 "1"). The legal values are:
                                 0=link/activity          1=link1000/activity
@@ -108,6 +113,10 @@ Params:
         eth_led1                Set mode of LED1 (usually green) (default
                                 "6"). See eth_led0 for legal values.
 
+        eth_max_speed           Set the maximum speed a link is allowed
+                                to negotiate. Legal values are 10, 100 and
+                                1000 (default 1000).
+
         i2c_arm                 Set to "on" to enable the ARM's i2c interface
                                 (default "off")
 
-- 
GitLab


From dfbd50bd65f34f91bc88e2e7b6a3db6e83e2a842 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 29 Nov 2018 16:00:22 +0000
Subject: [PATCH 0222/1835] BCM270X_DT: Mark eth_downshift_after as an integer

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
index 78742d623b6cc..7c6c054459b72 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
@@ -50,7 +50,7 @@
 		tx_lpi_timer = <&eth_phy>,"microchip,tx-lpi-timer:0";
 		eth_led0 = <&eth_phy>,"microchip,led-modes:0";
 		eth_led1 = <&eth_phy>,"microchip,led-modes:4";
-		eth_downshift_after = <&eth_phy>,"microchip,downshift-after";
+		eth_downshift_after = <&eth_phy>,"microchip,downshift-after:0";
 		eth_max_speed = <&eth_phy>,"max-speed:0";
 	};
 };
-- 
GitLab


From c14672ef2995306785ea25d3fd6de03d1fae0cbf Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 16 Jul 2018 14:40:13 +0100
Subject: [PATCH 0223/1835] dwc-otg: FIQ: Fix "bad mode in data abort handler"

Create a semi-static mapping for the USB registers early in the boot
process, before additional kernel threads are started, so all threads
will have the mappings from the start. This avoids the need for
data aborts to lazily update them.

See: https://github.com/raspberrypi/linux/issues/2450

Signed-off-by: Floris Bos <bos@je-eigen-domein.nl>
---
 arch/arm/mach-bcm/board_bcm2835.c         | 69 +++++++++++++++++++++++
 drivers/usb/host/dwc_otg/dwc_otg_driver.c |  2 +-
 2 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-bcm/board_bcm2835.c b/arch/arm/mach-bcm/board_bcm2835.c
index cbd42ad4ba9fe..28db892e3af4c 100644
--- a/arch/arm/mach-bcm/board_bcm2835.c
+++ b/arch/arm/mach-bcm/board_bcm2835.c
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/irqchip.h>
 #include <linux/of_address.h>
+#include <linux/of_fdt.h>
 #include <asm/system_info.h>
 
 #include <asm/mach/arch.h>
@@ -22,6 +23,9 @@
 
 #include "platsmp.h"
 
+#define BCM2835_USB_VIRT_BASE   0xf0980000
+#define BCM2835_USB_VIRT_MPHI   0xf0006000
+
 static void __init bcm2835_init(void)
 {
 	struct device_node *np = of_find_node_by_path("/system");
@@ -34,6 +38,70 @@ static void __init bcm2835_init(void)
 		system_serial_low = val64;
 }
 
+/*
+ * We need to map registers that are going to be accessed by the FIQ
+ * very early, before any kernel threads are spawned. Because if done
+ * later, the mapping tables are not updated instantly but lazily upon
+ * first access through a data abort handler. While that is fine
+ * when executing regular kernel code, if the first access in a specific
+ * thread happens while running FIQ code this will result in a panic.
+ *
+ * For more background see the following old mailing list thread:
+ * https://www.spinics.net/lists/arm-kernel/msg325250.html
+ */
+static int __init bcm2835_map_usb(unsigned long node, const char *uname,
+					int depth, void *data)
+{
+	struct map_desc map[2];
+	const __be32 *reg;
+	int len;
+	unsigned long p2b_offset = *((unsigned long *) data);
+
+	if (!of_flat_dt_is_compatible(node, "brcm,bcm2708-usb"))
+		return 0;
+	reg = of_get_flat_dt_prop(node, "reg", &len);
+	if (!reg || len != (sizeof(unsigned long) * 4))
+		return 0;
+
+	/* Use information about the physical addresses of the
+	 * registers from the device tree, but use legacy
+	 * iotable_init() static mapping function to map them,
+	 * as ioremap() is not functional at this stage in boot.
+	 */
+	map[0].virtual = (unsigned long) BCM2835_USB_VIRT_BASE;
+	map[0].pfn = __phys_to_pfn(be32_to_cpu(reg[0]) - p2b_offset);
+	map[0].length = be32_to_cpu(reg[1]);
+	map[0].type = MT_DEVICE;
+	map[1].virtual = (unsigned long) BCM2835_USB_VIRT_MPHI;
+	map[1].pfn = __phys_to_pfn(be32_to_cpu(reg[2]) - p2b_offset);
+	map[1].length = be32_to_cpu(reg[3]);
+	map[1].type = MT_DEVICE;
+		iotable_init(map, 2);
+
+	return 1;
+}
+
+static void __init bcm2835_map_io(void)
+{
+	const __be32 *ranges;
+	int soc, len;
+	unsigned long p2b_offset;
+
+	debug_ll_io_init();
+
+	/* Find out how to map bus to physical address first from soc/ranges */
+	soc = of_get_flat_dt_subnode_by_name(of_get_flat_dt_root(), "soc");
+	if (soc < 0)
+		return;
+	ranges = of_get_flat_dt_prop(soc, "ranges", &len);
+	if (!ranges || len < (sizeof(unsigned long) * 3))
+		return;
+	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[1]);
+
+	/* Now search for bcm2708-usb node in device tree */
+	of_scan_flat_dt(bcm2835_map_usb, &p2b_offset);
+}
+
 static const char * const bcm2835_compat[] = {
 #ifdef CONFIG_ARCH_MULTI_V6
 	"brcm,bcm2835",
@@ -46,6 +114,7 @@ static const char * const bcm2835_compat[] = {
 };
 
 DT_MACHINE_START(BCM2835, "BCM2835")
+	.map_io = bcm2835_map_io,
 	.init_machine = bcm2835_init,
 	.dt_compat = bcm2835_compat,
 	.smp = smp_ops(bcm2836_smp_ops),
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.c b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
index e945900c503cb..673231e17351e 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_driver.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
@@ -837,7 +837,7 @@ static int dwc_otg_driver_probe(
 		retval = -ENOMEM;
 		goto fail;
 	}
-	dev_dbg(&_dev->dev, "base=0x%08x\n",
+	dev_info(&_dev->dev, "base=0x%08x\n",
                 (unsigned)dwc_otg_device->os_dep.base);
 #endif
 
-- 
GitLab


From e694bcf36800fbbfb5550dfff14cb211a2dac0ba Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Fri, 30 Nov 2018 18:55:23 +0000
Subject: [PATCH 0224/1835] lirc-rpi: Remove in favour of gpio-ir

---
 arch/arm/boot/dts/overlays/Makefile           |  1 -
 .../boot/dts/overlays/lirc-rpi-overlay.dts    | 57 -------------------
 2 files changed, 58 deletions(-)
 delete mode 100644 arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index e6313733127bf..e31f8af7ce759 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -68,7 +68,6 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	jedec-spi-nor.dtbo \
 	justboom-dac.dtbo \
 	justboom-digi.dtbo \
-	lirc-rpi.dtbo \
 	ltc294x.dtbo \
 	mbed-dac.dtbo \
 	mcp23017.dtbo \
diff --git a/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts b/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
deleted file mode 100644
index 7d5d82bdf4c41..0000000000000
--- a/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
+++ /dev/null
@@ -1,57 +0,0 @@
-// Definitions for lirc-rpi module
-/dts-v1/;
-/plugin/;
-
-/ {
-	compatible = "brcm,bcm2708";
-
-	fragment@0 {
-		target-path = "/";
-		__overlay__ {
-			lirc_rpi: lirc_rpi {
-				compatible = "rpi,lirc-rpi";
-				pinctrl-names = "default";
-				pinctrl-0 = <&lirc_pins>;
-				status = "okay";
-
-				// Override autodetection of IR receiver circuit
-				// (0 = active high, 1 = active low, -1 = no override )
-				rpi,sense = <0xffffffff>;
-
-				// Software carrier
-				// (0 = off, 1 = on)
-				rpi,softcarrier = <1>;
-
-				// Invert output
-				// (0 = off, 1 = on)
-				rpi,invert = <0>;
-
-				// Enable debugging messages
-				// (0 = off, 1 = on)
-				rpi,debug = <0>;
-			};
-		};
-	};
-
-	fragment@1 {
-		target = <&gpio>;
-		__overlay__ {
-			lirc_pins: lirc_pins {
-				brcm,pins = <17 18>;
-				brcm,function = <1 0>; // out in
-				brcm,pull = <0 1>; // off down
-			};
-		};
-	};
-
-	__overrides__ {
-		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
-		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
-		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
-
-		sense =         <&lirc_rpi>,"rpi,sense:0";
-		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
-		invert =        <&lirc_rpi>,"rpi,invert:0";
-		debug =         <&lirc_rpi>,"rpi,debug:0";
-	};
-};
-- 
GitLab


From 8556c79ab523d333cf5894ed2d50a51a048bfb49 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 22 Nov 2018 17:28:02 +0000
Subject: [PATCH 0225/1835] media: bcm2835-unicam: Pass through the colorspace
 on try_fmt

The current colorspace was always returned from try_fmt for no
good reason.
Return what the source subdevice returns instead.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/platform/bcm2835/bcm2835-unicam.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
index 29c749a5293bf..545e729c7f0fe 100644
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -761,11 +761,7 @@ static int unicam_try_fmt_vid_cap(struct file *file, void *priv,
 		unicam_info(dev, "Sensor trying to send interlaced video - results may be unpredictable\n");
 
 	v4l2_fill_pix_format(&f->fmt.pix, &sd_fmt.format);
-	/*
-	 * Use current colorspace for now, it will get
-	 * updated properly during s_fmt
-	 */
-	f->fmt.pix.colorspace = dev->v_fmt.fmt.pix.colorspace;
+
 	return unicam_calc_format_size_bpl(dev, fmt, f);
 }
 
-- 
GitLab


From 597fd239a31503318f9777ba3423e69cc9167839 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 22 Nov 2018 17:31:06 +0000
Subject: [PATCH 0226/1835] media: tc358743: Return an appropriate colorspace
 from tc358743_set_fmt

When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
to choose a valid format. However that sets the colorspace
based on what was read back from the chip. When you set the format,
then the driver would choose and program the colorspace based
on the format code.

The result was that if you called try or set format for UYVY
when the current format was RGB3 then you would get told sRGB,
and try RGB3 when current was UYVY and you would get told
SMPTE170M.

The value programmed into the chip is determined by this driver,
therefore there is no need to read back the value. Return the
colorspace based on the format set/tried instead.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/tc358743.c | 40 +++++++++++++-----------------------
 1 file changed, 14 insertions(+), 26 deletions(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index bfb0b81b497b5..63ee2800fc4e5 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1680,12 +1680,23 @@ static int tc358743_enum_mbus_code(struct v4l2_subdev *sd,
 	return 0;
 }
 
+static u32 tc358743_g_colorspace(u32 code)
+{
+	switch (code) {
+	case MEDIA_BUS_FMT_RGB888_1X24:
+		return V4L2_COLORSPACE_SRGB;
+	case MEDIA_BUS_FMT_UYVY8_1X16:
+		return V4L2_COLORSPACE_SMPTE170M;
+	default:
+		return 0;
+	}
+}
+
 static int tc358743_get_fmt(struct v4l2_subdev *sd,
 		struct v4l2_subdev_pad_config *cfg,
 		struct v4l2_subdev_format *format)
 {
 	struct tc358743_state *state = to_state(sd);
-	u8 vi_rep = i2c_rd8(sd, VI_REP);
 
 	if (format->pad != 0)
 		return -EINVAL;
@@ -1695,23 +1706,7 @@ static int tc358743_get_fmt(struct v4l2_subdev *sd,
 	format->format.height = state->timings.bt.height;
 	format->format.field = V4L2_FIELD_NONE;
 
-	switch (vi_rep & MASK_VOUT_COLOR_SEL) {
-	case MASK_VOUT_COLOR_RGB_FULL:
-	case MASK_VOUT_COLOR_RGB_LIMITED:
-		format->format.colorspace = V4L2_COLORSPACE_SRGB;
-		break;
-	case MASK_VOUT_COLOR_601_YCBCR_LIMITED:
-	case MASK_VOUT_COLOR_601_YCBCR_FULL:
-		format->format.colorspace = V4L2_COLORSPACE_SMPTE170M;
-		break;
-	case MASK_VOUT_COLOR_709_YCBCR_FULL:
-	case MASK_VOUT_COLOR_709_YCBCR_LIMITED:
-		format->format.colorspace = V4L2_COLORSPACE_REC709;
-		break;
-	default:
-		format->format.colorspace = 0;
-		break;
-	}
+	format->format.colorspace = tc358743_g_colorspace(format->format.code);
 
 	return 0;
 }
@@ -1726,18 +1721,11 @@ static int tc358743_set_fmt(struct v4l2_subdev *sd,
 	int ret = tc358743_get_fmt(sd, cfg, format);
 
 	format->format.code = code;
+	format->format.colorspace = tc358743_g_colorspace(code);
 
 	if (ret)
 		return ret;
 
-	switch (code) {
-	case MEDIA_BUS_FMT_RGB888_1X24:
-	case MEDIA_BUS_FMT_UYVY8_1X16:
-		break;
-	default:
-		return -EINVAL;
-	}
-
 	if (format->which == V4L2_SUBDEV_FORMAT_TRY)
 		return 0;
 
-- 
GitLab


From 312d4b99c35e3358db788f8bb319ef6b62c53f29 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 20 Oct 2018 19:26:18 +0200
Subject: [PATCH 0227/1835] staging: bcm2835-camera: fix module autoloading

In order to make the module bcm2835-camera load automatically, we need to
add a module alias.

Fixes: 4bebb0312ea9 ("staging/bcm2835-camera: Set ourselves up as a platform driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index c04bdf070c876..10b55bc8881d8 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -47,6 +47,7 @@ MODULE_DESCRIPTION("Broadcom 2835 MMAL video capture");
 MODULE_AUTHOR("Vincent Sanders");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(BM2835_MMAL_VERSION);
+MODULE_ALIAS("platform:bcm2835-camera");
 
 int bcm2835_v4l2_debug;
 module_param_named(debug, bcm2835_v4l2_debug, int, 0644);
-- 
GitLab


From eda93b3bf789f8a3009112517a27f56fcf15f0f5 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 20 Oct 2018 19:31:00 +0200
Subject: [PATCH 0228/1835] staging: bcm2835-camera: Move module info to the
 end

In order to have this more consistent between the vc04 services move
the module information to the end of the file.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 .../vc04_services/bcm2835-camera/bcm2835-camera.c    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 10b55bc8881d8..0535ec5187e64 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -43,12 +43,6 @@
 
 #define MAX_BCM2835_CAMERAS 2
 
-MODULE_DESCRIPTION("Broadcom 2835 MMAL video capture");
-MODULE_AUTHOR("Vincent Sanders");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(BM2835_MMAL_VERSION);
-MODULE_ALIAS("platform:bcm2835-camera");
-
 int bcm2835_v4l2_debug;
 module_param_named(debug, bcm2835_v4l2_debug, int, 0644);
 MODULE_PARM_DESC(bcm2835_v4l2_debug, "Debug level 0-2");
@@ -1967,3 +1961,9 @@ static struct platform_driver bcm2835_camera_driver = {
 };
 
 module_platform_driver(bcm2835_camera_driver)
+
+MODULE_DESCRIPTION("Broadcom 2835 MMAL video capture");
+MODULE_AUTHOR("Vincent Sanders");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(BM2835_MMAL_VERSION);
+MODULE_ALIAS("platform:bcm2835-camera");
-- 
GitLab


From b253f33df706f3746be815fbc3117f9b3bf8295a Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 13 Oct 2018 20:51:23 +0200
Subject: [PATCH 0229/1835] staging: vchiq_arm: Fix platform device
 unregistration

In error case platform_device_register_data would return an ERR_PTR
instead of NULL. So we better check this before unregistration.

Fixes: 37b7b3087a2f ("staging/vc04_services: Register a platform device for the camera driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index fe431302a030b..7ab3c29c03a50 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -3656,7 +3656,8 @@ failed_platform_init:
 
 static int vchiq_remove(struct platform_device *pdev)
 {
-	platform_device_unregister(bcm2835_camera);
+	if (!IS_ERR(bcm2835_camera))
+		platform_device_unregister(bcm2835_camera);
 	vchiq_debugfs_deinit();
 	device_destroy(vchiq_class, vchiq_devid);
 	class_destroy(vchiq_class);
-- 
GitLab


From be8d3421c37654a5da0bbfd10c3957e9b256e8b6 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Mon, 22 Oct 2018 15:16:51 +0200
Subject: [PATCH 0230/1835] staging: vchiq_arm: Fix camera device registration

Since the camera driver isn't probed via DT, we need to properly setup DMA.

Fixes: 37b7b3087a2f ("staging/vc04_services: Register a platform device for the camera driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 .../interface/vchiq_arm/vchiq_arm.c           | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 7ab3c29c03a50..e622225495233 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -49,6 +49,7 @@
 #include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/compat.h>
+#include <linux/dma-mapping.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #include "vchiq_core.h"
@@ -3578,6 +3579,21 @@ void vchiq_platform_conn_state_changed(VCHIQ_STATE_T *state,
 	}
 }
 
+static struct platform_device *
+vchiq_register_child(struct platform_device *pdev, const char *name)
+{
+	struct platform_device_info pdevinfo;
+
+	memset(&pdevinfo, 0, sizeof(pdevinfo));
+
+	pdevinfo.parent = &pdev->dev;
+	pdevinfo.name = name;
+	pdevinfo.id = PLATFORM_DEVID_NONE;
+	pdevinfo.dma_mask = DMA_BIT_MASK(32);
+
+	return platform_device_register_full(&pdevinfo);
+}
+
 static int vchiq_probe(struct platform_device *pdev)
 {
 	struct device_node *fw_node;
@@ -3637,9 +3653,7 @@ static int vchiq_probe(struct platform_device *pdev)
 		VCHIQ_VERSION, VCHIQ_VERSION_MIN,
 		MAJOR(vchiq_devid), MINOR(vchiq_devid));
 
-	bcm2835_camera = platform_device_register_data(&pdev->dev,
-						       "bcm2835-camera", -1,
-						       NULL, 0);
+	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
 
 	return 0;
 
-- 
GitLab


From eb292c0f50aaaabc97f21d018bf409e9777f769c Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 20 Oct 2018 20:25:41 +0200
Subject: [PATCH 0231/1835] staging: vchiq_arm: Register a platform device for
 the audio driver

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index e622225495233..b8f5d07a1b697 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -170,6 +170,7 @@ static struct class  *vchiq_class;
 static struct device *vchiq_dev;
 static DEFINE_SPINLOCK(msg_queue_spinlock);
 static struct platform_device *bcm2835_camera;
+static struct platform_device *bcm2835_audio;
 
 static const char *const ioctl_names[] = {
 	"CONNECT",
@@ -3654,6 +3655,7 @@ static int vchiq_probe(struct platform_device *pdev)
 		MAJOR(vchiq_devid), MINOR(vchiq_devid));
 
 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
+	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
 
 	return 0;
 
@@ -3670,6 +3672,8 @@ failed_platform_init:
 
 static int vchiq_remove(struct platform_device *pdev)
 {
+	if (!IS_ERR(bcm2835_audio))
+		platform_device_unregister(bcm2835_audio);
 	if (!IS_ERR(bcm2835_camera))
 		platform_device_unregister(bcm2835_camera);
 	vchiq_debugfs_deinit();
-- 
GitLab


From a745eecdaccb79bcbd680e11f29a578470bbbbfd Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 13 Oct 2018 20:19:13 +0200
Subject: [PATCH 0232/1835] staging: bcm2835-audio: Enable compile test

Enable the compilation test for bcm2835-audio.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/bcm2835-audio/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/Kconfig b/drivers/staging/vc04_services/bcm2835-audio/Kconfig
index 9f536533c2576..62c1c8ba4ad44 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/Kconfig
+++ b/drivers/staging/vc04_services/bcm2835-audio/Kconfig
@@ -1,6 +1,6 @@
 config SND_BCM2835
         tristate "BCM2835 Audio"
-        depends on ARCH_BCM2835 && SND
+        depends on (ARCH_BCM2835 || COMPILE_TEST) && SND
         select SND_PCM
         select BCM2835_VCHIQ
         help
-- 
GitLab


From ea8397dc9a7279db241475dc72bb9db9bce46483 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Thu, 18 Oct 2018 19:47:29 +0200
Subject: [PATCH 0233/1835] staging: bcm2835-audio: use
 module_platform_driver() macro

There is not much value behind this boilerplate, so use
module_platform_driver() instead.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 20 +------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index da0fa34501fad..b8e148ade6f64 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -470,25 +470,7 @@ static struct platform_driver bcm2835_alsa0_driver = {
 		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
-
-static int bcm2835_alsa_device_init(void)
-{
-	int retval;
-
-	retval = platform_driver_register(&bcm2835_alsa0_driver);
-	if (retval)
-		pr_err("Error registering bcm2835_audio driver %d .\n", retval);
-
-	return retval;
-}
-
-static void bcm2835_alsa_device_exit(void)
-{
-	platform_driver_unregister(&bcm2835_alsa0_driver);
-}
-
-late_initcall(bcm2835_alsa_device_init);
-module_exit(bcm2835_alsa_device_exit);
+module_platform_driver(bcm2835_alsa0_driver);
 
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
-- 
GitLab


From 2d4599c4973d703ad43acaafd22495d675f1461f Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Thu, 18 Oct 2018 19:54:01 +0200
Subject: [PATCH 0234/1835] staging: bcm2835-audio: Drop DT dependency

Just like the bcm2835-video make this a platform driver which is probed
by vchiq. In order to change the number of channels use a module
parameter instead, but use the maximum as default.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 41 +++++++++----------
 1 file changed, 19 insertions(+), 22 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index b8e148ade6f64..0528266dd17b5 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -4,15 +4,17 @@
 #include <linux/platform_device.h>
 
 #include <linux/init.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/of.h>
 
 #include "bcm2835.h"
 
 static bool enable_hdmi;
 static bool enable_headphones;
 static bool enable_compat_alsa = true;
+static int num_channels = MAX_SUBSTREAMS;
 
 module_param(enable_hdmi, bool, 0444);
 MODULE_PARM_DESC(enable_hdmi, "Enables HDMI virtual audio device");
@@ -21,6 +23,8 @@ MODULE_PARM_DESC(enable_headphones, "Enables Headphones virtual audio device");
 module_param(enable_compat_alsa, bool, 0444);
 MODULE_PARM_DESC(enable_compat_alsa,
 		 "Enables ALSA compatibility virtual audio device");
+module_param(num_channels, int, 0644);
+MODULE_PARM_DESC(num_channels, "Number of audio channels (default: 8)");
 
 static void snd_devm_unregister_child(struct device *dev, void *res)
 {
@@ -407,31 +411,30 @@ static int snd_add_child_devices(struct device *device, u32 numchans)
 	return 0;
 }
 
-static int snd_bcm2835_alsa_probe_dt(struct platform_device *pdev)
+static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	u32 numchans;
 	int err;
 
-	err = of_property_read_u32(dev->of_node, "brcm,pwm-channels",
-				   &numchans);
-	if (err) {
-		dev_err(dev, "Failed to get DT property 'brcm,pwm-channels'");
-		return err;
+	if (num_channels <= 0 || num_channels > MAX_SUBSTREAMS) {
+		num_channels = MAX_SUBSTREAMS;
+		dev_warn(dev, "Illegal num_channels value, will use %u\n",
+			 num_channels);
 	}
 
-	if (numchans == 0 || numchans > MAX_SUBSTREAMS) {
-		numchans = MAX_SUBSTREAMS;
-		dev_warn(dev,
-			 "Illegal 'brcm,pwm-channels' value, will use %u\n",
-			 numchans);
+	dev->coherent_dma_mask = DMA_BIT_MASK(32);
+	dev->dma_mask = &dev->coherent_dma_mask;
+	err = of_dma_configure(dev, NULL, true);
+	if (err) {
+		dev_err(dev, "Unable to setup DMA: %d\n", err);
+		return err;
 	}
 
 	err = bcm2835_devm_add_vchi_ctx(dev);
 	if (err)
 		return err;
 
-	err = snd_add_child_devices(dev, numchans);
+	err = snd_add_child_devices(dev, num_channels);
 	if (err)
 		return err;
 
@@ -453,21 +456,14 @@ static int snd_bcm2835_alsa_resume(struct platform_device *pdev)
 
 #endif
 
-static const struct of_device_id snd_bcm2835_of_match_table[] = {
-	{ .compatible = "brcm,bcm2835-audio",},
-	{},
-};
-MODULE_DEVICE_TABLE(of, snd_bcm2835_of_match_table);
-
 static struct platform_driver bcm2835_alsa0_driver = {
-	.probe = snd_bcm2835_alsa_probe_dt,
+	.probe = snd_bcm2835_alsa_probe,
 #ifdef CONFIG_PM
 	.suspend = snd_bcm2835_alsa_suspend,
 	.resume = snd_bcm2835_alsa_resume,
 #endif
 	.driver = {
 		.name = "bcm2835_audio",
-		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
 module_platform_driver(bcm2835_alsa0_driver);
@@ -475,3 +471,4 @@ module_platform_driver(bcm2835_alsa0_driver);
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:bcm2835_audio");
-- 
GitLab


From b9086fd05d8e85c4b2dff267c21be0d841990c2b Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sun, 21 Oct 2018 18:40:07 +0200
Subject: [PATCH 0235/1835] staging: bcm2835-camera: Provide more specific
 probe error messages

Currently there is only a catch-all info message which print the
relevant error code without any context. So add more specific error
messages in order to narrow down possible issues.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 .../bcm2835-camera/bcm2835-camera.c           | 58 +++++++++++++------
 1 file changed, 39 insertions(+), 19 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 0535ec5187e64..0e6264810ed44 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1539,8 +1539,11 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	struct vchiq_mmal_component  *camera;
 
 	ret = vchiq_mmal_init(&dev->instance);
-	if (ret < 0)
+	if (ret < 0) {
+		v4l2_err(&dev->v4l2_dev, "%s: vchiq mmal init failed %d\n",
+			 __func__, ret);
 		return ret;
+	}
 
 	/* get the camera component ready */
 	ret = vchiq_mmal_component_init(dev->instance, "ril.camera",
@@ -1549,7 +1552,9 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 		goto unreg_mmal;
 
 	camera = dev->component[MMAL_COMPONENT_CAMERA];
-	if (camera->outputs <  MMAL_CAMERA_PORT_COUNT) {
+	if (camera->outputs < MMAL_CAMERA_PORT_COUNT) {
+		v4l2_err(&dev->v4l2_dev, "%s: too few camera outputs %d needed %d\n",
+			 __func__, camera->outputs, MMAL_CAMERA_PORT_COUNT);
 		ret = -EINVAL;
 		goto unreg_camera;
 	}
@@ -1557,8 +1562,11 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	ret = set_camera_parameters(dev->instance,
 				    camera,
 				    dev);
-	if (ret < 0)
+	if (ret < 0) {
+		v4l2_err(&dev->v4l2_dev, "%s: unable to set camera parameters: %d\n",
+			 __func__, ret);
 		goto unreg_camera;
+	}
 
 	/* There was an error in the firmware that meant the camera component
 	 * produced BGR instead of RGB.
@@ -1647,8 +1655,8 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 
 	if (dev->component[MMAL_COMPONENT_PREVIEW]->inputs < 1) {
 		ret = -EINVAL;
-		pr_debug("too few input ports %d needed %d\n",
-			 dev->component[MMAL_COMPONENT_PREVIEW]->inputs, 1);
+		v4l2_err(&dev->v4l2_dev, "%s: too few input ports %d needed %d\n",
+			 __func__, dev->component[MMAL_COMPONENT_PREVIEW]->inputs, 1);
 		goto unreg_preview;
 	}
 
@@ -1661,8 +1669,8 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 
 	if (dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->inputs < 1) {
 		ret = -EINVAL;
-		v4l2_err(&dev->v4l2_dev, "too few input ports %d needed %d\n",
-			 dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->inputs,
+		v4l2_err(&dev->v4l2_dev, "%s: too few input ports %d needed %d\n",
+			 __func__, dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->inputs,
 			 1);
 		goto unreg_image_encoder;
 	}
@@ -1676,8 +1684,8 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 
 	if (dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->inputs < 1) {
 		ret = -EINVAL;
-		v4l2_err(&dev->v4l2_dev, "too few input ports %d needed %d\n",
-			 dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->inputs,
+		v4l2_err(&dev->v4l2_dev, "%s: too few input ports %d needed %d\n",
+			 __func__, dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->inputs,
 			 1);
 		goto unreg_vid_encoder;
 	}
@@ -1706,8 +1714,11 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 					      sizeof(enable));
 	}
 	ret = bm2835_mmal_set_all_camera_controls(dev);
-	if (ret < 0)
+	if (ret < 0) {
+		v4l2_err(&dev->v4l2_dev, "%s: failed to set all camera controls: %d\n",
+			 __func__, ret);
 		goto unreg_vid_encoder;
+	}
 
 	return 0;
 
@@ -1867,21 +1878,29 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 		snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name),
 			 "%s", BM2835_MMAL_MODULE_NAME);
 		ret = v4l2_device_register(NULL, &dev->v4l2_dev);
-		if (ret)
+		if (ret) {
+			dev_err(&pdev->dev, "%s: could not register V4L2 device: %d\n",
+				__func__, ret);
 			goto free_dev;
+		}
 
 		/* setup v4l controls */
 		ret = bm2835_mmal_init_controls(dev, &dev->ctrl_handler);
-		if (ret < 0)
+		if (ret < 0) {
+			v4l2_err(&dev->v4l2_dev, "%s: could not init controls: %d\n",
+				__func__, ret);
 			goto unreg_dev;
+		}
 		dev->v4l2_dev.ctrl_handler = &dev->ctrl_handler;
 
 		/* mmal init */
 		dev->instance = instance;
 		ret = mmal_init(dev);
-		if (ret < 0)
+		if (ret < 0) {
+			v4l2_err(&dev->v4l2_dev, "%s: mmal init failed: %d\n",
+				__func__, ret);
 			goto unreg_dev;
-
+		}
 		/* initialize queue */
 		q = &dev->capture.vb_vidq;
 		memset(q, 0, sizeof(*q));
@@ -1899,16 +1918,19 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 
 		/* initialise video devices */
 		ret = bm2835_mmal_init_device(dev, &dev->vdev);
-		if (ret < 0)
+		if (ret < 0) {
+			v4l2_err(&dev->v4l2_dev, "%s: could not init device: %d\n",
+				__func__, ret);
 			goto unreg_dev;
+		}
 
 		/* Really want to call vidioc_s_fmt_vid_cap with the default
 		 * format, but currently the APIs don't join up.
 		 */
 		ret = mmal_setup_components(dev, &default_v4l2_format);
 		if (ret < 0) {
-			v4l2_err(&dev->v4l2_dev,
-				 "%s: could not setup components\n", __func__);
+			v4l2_err(&dev->v4l2_dev, "%s: could not setup components: %d\n",
+				__func__, ret);
 			goto unreg_dev;
 		}
 
@@ -1932,8 +1954,6 @@ cleanup_gdev:
 		bcm2835_cleanup_instance(gdev[i]);
 		gdev[i] = NULL;
 	}
-	pr_info("%s: error %d while loading driver\n",
-		BM2835_MMAL_MODULE_NAME, ret);
 
 	return ret;
 }
-- 
GitLab


From b7f9131a3e42c12e673d1e9d97a47061f1a74754 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sun, 21 Oct 2018 19:08:29 +0200
Subject: [PATCH 0236/1835] staging: bcm2835-camera: Add hint about possible
 faulty GPU mem config

As per default the GPU memory config of the Raspberry Pi isn't sufficient
for the camera usage. Even worse the bcm2835 camera doesn't provide a
helpful error message in this case. So let's add a hint to point the user
to the likely cause.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 51e5b04ff0f58..1e171b434e457 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -1624,8 +1624,11 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 	component = &instance->component[instance->component_idx];
 
 	ret = create_component(instance, component, name);
-	if (ret < 0)
+	if (ret < 0) {
+		pr_err("%s: failed to create component %d (Not enough GPU mem?)\n",
+		       __func__, ret);
 		goto unlock;
+	}
 
 	/* ports info needs gathering */
 	component->control.type = MMAL_PORT_TYPE_CONTROL;
-- 
GitLab


From 8f1103e1e713f0a6aea2cbf85c51eb9ecc04c913 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Mon, 22 Oct 2018 11:09:18 +0200
Subject: [PATCH 0237/1835] staging: bcm2835: Don't probe if no camera is
 detected

It is a waste of resources to load the camera driver in case there isn't
a camera actually connected to the Raspberry Pi. This solution also
avoids a NULL ptr dereference of mmal instance on driver unload.

Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 .../vc04_services/bcm2835-camera/bcm2835-camera.c        | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 0e6264810ed44..84ca22d7d659a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1847,6 +1847,12 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 	num_cameras = get_num_cameras(instance,
 				      resolutions,
 				      MAX_BCM2835_CAMERAS);
+
+	if (num_cameras < 1) {
+		ret = -ENODEV;
+		goto cleanup_mmal;
+	}
+
 	if (num_cameras > MAX_BCM2835_CAMERAS)
 		num_cameras = MAX_BCM2835_CAMERAS;
 
@@ -1955,6 +1961,9 @@ cleanup_gdev:
 		gdev[i] = NULL;
 	}
 
+cleanup_mmal:
+	vchiq_mmal_finalise(instance);
+
 	return ret;
 }
 
-- 
GitLab


From 83111772d9a6486a4acffe8f389d8bcdf05996d0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 3 Dec 2018 12:50:38 +0000
Subject: [PATCH 0238/1835] staging: vchiq_arm: Improve error handling on
 loading drivers

The handling of loading platform drivers requires checking IS_ERR
for the pointer on unload.
If the driver fails to load, NULL the pointer during probe as
platform_device_unregister already checks for NULL.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/interface/vchiq_arm/vchiq_arm.c    | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index b8f5d07a1b697..d3b5a00d2c53e 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -3655,7 +3655,11 @@ static int vchiq_probe(struct platform_device *pdev)
 		MAJOR(vchiq_devid), MINOR(vchiq_devid));
 
 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
+	if (IS_ERR(bcm2835_camera))
+		bcm2835_camera = NULL;
 	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
+	if (IS_ERR(bcm2835_audio))
+		bcm2835_audio = NULL;
 
 	return 0;
 
@@ -3672,10 +3676,10 @@ failed_platform_init:
 
 static int vchiq_remove(struct platform_device *pdev)
 {
-	if (!IS_ERR(bcm2835_audio))
-		platform_device_unregister(bcm2835_audio);
-	if (!IS_ERR(bcm2835_camera))
-		platform_device_unregister(bcm2835_camera);
+	platform_device_unregister(bcm2835_codec);
+	platform_device_unregister(bcm2835_audio);
+	platform_device_unregister(bcm2835_camera);
+	platform_device_unregister(vcsm_cma);
 	vchiq_debugfs_deinit();
 	device_destroy(vchiq_class, vchiq_devid);
 	class_destroy(vchiq_class);
-- 
GitLab


From 3d7e5f87575f7157c76082980a877ccc18069ec1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 14 Feb 2018 17:04:26 +0000
Subject: [PATCH 0239/1835] staging: bcm2835-camera: Do not bulk receive from
 service thread

vchi_bulk_queue_receive will queue up to a default of 4
bulk receives on a connection before blocking.
If called from the VCHI service_callback thread, then
that thread is unable to service the VCHI_CALLBACK_BULK_RECEIVED
events that would enable the queue call to succeed.

Add a workqueue to schedule the call vchi_bulk_queue_receive
in an alternate context to avoid the lock up.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-camera/mmal-vchiq.c | 101 ++++++++++--------
 1 file changed, 59 insertions(+), 42 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 1e171b434e457..480758541966a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -118,8 +118,10 @@ struct mmal_msg_context {
 
 	union {
 		struct {
-			/* work struct for defered callback - must come first */
+			/* work struct for buffer_cb callback */
 			struct work_struct work;
+			/* work struct for deferred callback */
+			struct work_struct buffer_to_host_work;
 			/* mmal instance */
 			struct vchiq_mmal_instance *instance;
 			/* mmal port */
@@ -167,6 +169,9 @@ struct vchiq_mmal_instance {
 	/* component to use next */
 	int component_idx;
 	struct vchiq_mmal_component component[VCHIQ_MMAL_MAX_COMPONENTS];
+
+	/* ordered workqueue to process all bulk operations */
+	struct workqueue_struct *bulk_wq;
 };
 
 static struct mmal_msg_context *
@@ -248,7 +253,44 @@ static void buffer_work_cb(struct work_struct *work)
 					    msg_context->u.bulk.mmal_flags,
 					    msg_context->u.bulk.dts,
 					    msg_context->u.bulk.pts);
+}
 
+/* workqueue scheduled callback to handle receiving buffers
+ *
+ * VCHI will allow up to 4 bulk receives to be scheduled before blocking.
+ * If we block in the service_callback context then we can't process the
+ * VCHI_CALLBACK_BULK_RECEIVED message that would otherwise allow the blocked
+ * vchi_bulk_queue_receive() call to complete.
+ */
+static void buffer_to_host_work_cb(struct work_struct *work)
+{
+	struct mmal_msg_context *msg_context =
+		container_of(work, struct mmal_msg_context,
+			     u.bulk.buffer_to_host_work);
+	struct vchiq_mmal_instance *instance = msg_context->instance;
+	unsigned long len = msg_context->u.bulk.buffer_used;
+	int ret;
+
+	if (!len)
+		/* Dummy receive to ensure the buffers remain in order */
+		len = 8;
+	/* queue the bulk submission */
+	vchi_service_use(instance->handle);
+	ret = vchi_bulk_queue_receive(instance->handle,
+				      msg_context->u.bulk.buffer->buffer,
+				      /* Actual receive needs to be a multiple
+				       * of 4 bytes
+				       */
+				      (len + 3) & ~3,
+				      VCHI_FLAGS_CALLBACK_WHEN_OP_COMPLETE |
+				      VCHI_FLAGS_BLOCK_UNTIL_QUEUED,
+				      msg_context);
+
+	vchi_service_release(instance->handle);
+
+	if (ret != 0)
+		pr_err("%s: ctx: %p, vchi_bulk_queue_receive failed %d\n",
+		       __func__, msg_context, ret);
 }
 
 /* enqueue a bulk receive for a given message context */
@@ -257,7 +299,6 @@ static int bulk_receive(struct vchiq_mmal_instance *instance,
 			struct mmal_msg_context *msg_context)
 {
 	unsigned long rd_len;
-	int ret;
 
 	rd_len = msg->u.buffer_from_host.buffer_header.length;
 
@@ -293,45 +334,10 @@ static int bulk_receive(struct vchiq_mmal_instance *instance,
 	msg_context->u.bulk.dts = msg->u.buffer_from_host.buffer_header.dts;
 	msg_context->u.bulk.pts = msg->u.buffer_from_host.buffer_header.pts;
 
-	/* queue the bulk submission */
-	vchi_service_use(instance->handle);
-	ret = vchi_bulk_queue_receive(instance->handle,
-				      msg_context->u.bulk.buffer->buffer,
-				      /* Actual receive needs to be a multiple
-				       * of 4 bytes
-				       */
-				      (rd_len + 3) & ~3,
-				      VCHI_FLAGS_CALLBACK_WHEN_OP_COMPLETE |
-				      VCHI_FLAGS_BLOCK_UNTIL_QUEUED,
-				      msg_context);
-
-	vchi_service_release(instance->handle);
+	queue_work(msg_context->instance->bulk_wq,
+		   &msg_context->u.bulk.buffer_to_host_work);
 
-	return ret;
-}
-
-/* enque a dummy bulk receive for a given message context */
-static int dummy_bulk_receive(struct vchiq_mmal_instance *instance,
-			      struct mmal_msg_context *msg_context)
-{
-	int ret;
-
-	/* zero length indicates this was a dummy transfer */
-	msg_context->u.bulk.buffer_used = 0;
-
-	/* queue the bulk submission */
-	vchi_service_use(instance->handle);
-
-	ret = vchi_bulk_queue_receive(instance->handle,
-				      instance->bulk_scratch,
-				      8,
-				      VCHI_FLAGS_CALLBACK_WHEN_OP_COMPLETE |
-				      VCHI_FLAGS_BLOCK_UNTIL_QUEUED,
-				      msg_context);
-
-	vchi_service_release(instance->handle);
-
-	return ret;
+	return 0;
 }
 
 /* data in message, memcpy from packet into output buffer */
@@ -379,6 +385,8 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 
 	/* initialise work structure ready to schedule callback */
 	INIT_WORK(&msg_context->u.bulk.work, buffer_work_cb);
+	INIT_WORK(&msg_context->u.bulk.buffer_to_host_work,
+		  buffer_to_host_work_cb);
 
 	/* prep the buffer from host message */
 	memset(&m, 0xbc, sizeof(m));	/* just to make debug clearer */
@@ -459,7 +467,7 @@ static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
 		if (msg->u.buffer_from_host.buffer_header.flags &
 		    MMAL_BUFFER_HEADER_FLAG_EOS) {
 			msg_context->u.bulk.status =
-			    dummy_bulk_receive(instance, msg_context);
+			    bulk_receive(instance, msg, msg_context);
 			if (msg_context->u.bulk.status == 0)
 				return;	/* successful bulk submission, bulk
 					 * completion will trigger callback
@@ -1793,6 +1801,9 @@ int vchiq_mmal_finalise(struct vchiq_mmal_instance *instance)
 
 	mutex_unlock(&instance->vchiq_mutex);
 
+	flush_workqueue(instance->bulk_wq);
+	destroy_workqueue(instance->bulk_wq);
+
 	vfree(instance->bulk_scratch);
 
 	idr_destroy(&instance->context_map);
@@ -1862,6 +1873,11 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
 
 	params.callback_param = instance;
 
+	instance->bulk_wq = alloc_ordered_workqueue("mmal-vchiq",
+						    WQ_MEM_RECLAIM);
+	if (!instance->bulk_wq)
+		goto err_free;
+
 	status = vchi_service_open(vchi_instance, &params, &instance->handle);
 	if (status) {
 		pr_err("Failed to open VCHI service connection (status=%d)\n",
@@ -1876,8 +1892,9 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
 	return 0;
 
 err_close_services:
-
 	vchi_service_close(instance->handle);
+	destroy_workqueue(instance->bulk_wq);
+err_free:
 	vfree(instance->bulk_scratch);
 	kfree(instance);
 	return -ENODEV;
-- 
GitLab


From d4be0c7818a8ccd5e4650c8024bfdfbb931f06c9 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 14:21:04 +0000
Subject: [PATCH 0240/1835] staging: bcm2835-camera: Ensure H264 header bytes
 get a sensible timestamp

H264 header come from VC with 0 timestamps, which means they get a
strange timestamp when processed with VC/kernel start times,
particularly if used with the inline header option.
Remember the last frame timestamp and use that if set, or otherwise
use the kernel start time.

https://github.com/raspberrypi/linux/issues/1836

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 30 +++++++++++++++++--
 .../bcm2835-camera/bcm2835-camera.h           |  2 ++
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 84ca22d7d659a..bb82f4b040c33 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -360,8 +360,13 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 		}
 	} else {
 		if (dev->capture.frame_count) {
-			if (dev->capture.vc_start_timestamp != -1 &&
-			    pts != 0) {
+			if (dev->capture.vc_start_timestamp == -1) {
+				buf->vb.vb2_buf.timestamp = ktime_get_ns();
+				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+					 "Buffer time set as current time - %lld",
+					 buf->vb.vb2_buf.timestamp);
+
+			} else if (pts != 0) {
 				ktime_t timestamp;
 				s64 runtime_us = pts -
 				    dev->capture.vc_start_timestamp;
@@ -374,10 +379,28 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 					 ktime_to_ns(timestamp));
 				buf->vb.vb2_buf.timestamp = ktime_to_ns(timestamp);
 			} else {
-				buf->vb.vb2_buf.timestamp = ktime_get_ns();
+				if (dev->capture.last_timestamp) {
+					buf->vb.vb2_buf.timestamp =
+						dev->capture.last_timestamp;
+					v4l2_dbg(1, bcm2835_v4l2_debug,
+						 &dev->v4l2_dev,
+						 "Buffer time set as last timestamp - %lld",
+						 buf->vb.vb2_buf.timestamp);
+				} else {
+					buf->vb.vb2_buf.timestamp =
+						ktime_to_ns(dev->capture.kernel_start_ts);
+					v4l2_dbg(1, bcm2835_v4l2_debug,
+						 &dev->v4l2_dev,
+						 "Buffer time set as start timestamp - %lld",
+						 buf->vb.vb2_buf.timestamp);
+				}
 			}
+			dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
 
 			vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
+			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+				 "Buffer has ts %llu",
+				 dev->capture.last_timestamp);
 			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
 
 			if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
@@ -543,6 +566,7 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 			 dev->capture.vc_start_timestamp, parameter_size);
 
 	dev->capture.kernel_start_ts = ktime_get();
+	dev->capture.last_timestamp = 0;
 
 	/* enable the camera port */
 	dev->capture.port->cb_ctx = dev;
diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
index 2b5679eb5b4a7..09273b0b10798 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
@@ -90,6 +90,8 @@ struct bm2835_mmal_dev {
 		s64         vc_start_timestamp;
 		/* Kernel start timestamp for streaming */
 		ktime_t kernel_start_ts;
+		/* Timestamp of last frame */
+		u64		last_timestamp;
 
 		struct vchiq_mmal_port  *port; /* port being used for capture */
 		/* camera port being used for capture */
-- 
GitLab


From 307dae08b479cbf64f5ee3b83c150d5f788776d7 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 13 Feb 2017 13:11:41 +0000
Subject: [PATCH 0241/1835] staging: bcm2835-camera: Correctly denote key
 frames in encoded data

Forward MMAL key frame flags to the V4L2 buffers.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index bb82f4b040c33..d8b43b7677e10 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -398,6 +398,9 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 			dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
 
 			vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
+			if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
+				buf->vb.flags |= V4L2_BUF_FLAG_KEYFRAME;
+
 			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 				 "Buffer has ts %llu",
 				 dev->capture.last_timestamp);
-- 
GitLab


From acdc1b4cb395460b89c71b0cbcdb93b73d6d07b0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 10 Mar 2017 17:27:56 +0000
Subject: [PATCH 0242/1835] staging: bcm2835-camera: Return early on errors

Fix several instances where it is easier to return
early on error conditions than handle it as an else
clause.
As requested by Mauro.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 137 +++++++++---------
 1 file changed, 71 insertions(+), 66 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index d8b43b7677e10..0932969bd6e4b 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -335,7 +335,9 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
 		}
 		return;
-	} else if (length == 0) {
+	}
+
+	if (length == 0) {
 		/* stream ended */
 		if (buf) {
 			/* this should only ever happen if the port is
@@ -358,71 +360,72 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 			/* signal frame completion */
 			complete(&dev->capture.frame_cmplt);
 		}
-	} else {
-		if (dev->capture.frame_count) {
-			if (dev->capture.vc_start_timestamp == -1) {
-				buf->vb.vb2_buf.timestamp = ktime_get_ns();
-				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-					 "Buffer time set as current time - %lld",
-					 buf->vb.vb2_buf.timestamp);
-
-			} else if (pts != 0) {
-				ktime_t timestamp;
-				s64 runtime_us = pts -
-				    dev->capture.vc_start_timestamp;
-				timestamp = ktime_add_us(dev->capture.kernel_start_ts,
-							 runtime_us);
-				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-					 "Convert start time %llu and %llu with offset %llu to %llu\n",
-					 ktime_to_ns(dev->capture.kernel_start_ts),
-					 dev->capture.vc_start_timestamp, pts,
-					 ktime_to_ns(timestamp));
-				buf->vb.vb2_buf.timestamp = ktime_to_ns(timestamp);
-			} else {
-				if (dev->capture.last_timestamp) {
-					buf->vb.vb2_buf.timestamp =
-						dev->capture.last_timestamp;
-					v4l2_dbg(1, bcm2835_v4l2_debug,
-						 &dev->v4l2_dev,
-						 "Buffer time set as last timestamp - %lld",
-						 buf->vb.vb2_buf.timestamp);
-				} else {
-					buf->vb.vb2_buf.timestamp =
-						ktime_to_ns(dev->capture.kernel_start_ts);
-					v4l2_dbg(1, bcm2835_v4l2_debug,
-						 &dev->v4l2_dev,
-						 "Buffer time set as start timestamp - %lld",
-						 buf->vb.vb2_buf.timestamp);
-				}
-			}
-			dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
+		return;
+	}
 
-			vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
-			if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
-				buf->vb.flags |= V4L2_BUF_FLAG_KEYFRAME;
+	if (!dev->capture.frame_count) {
+		/* signal frame completion */
+		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+		complete(&dev->capture.frame_cmplt);
+		return;
+	}
 
+	if (dev->capture.vc_start_timestamp == -1) {
+		/*
+		 * VPU doesn't support MMAL_PARAMETER_SYSTEM_TIME, rely on
+		 * kernel time, and have no latency compensation.
+		 */
+		buf->vb.vb2_buf.timestamp = ktime_get_ns();
+		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+			 "Buffer time set as current time - %lld",
+			 buf->vb.vb2_buf.timestamp);
+	} else if (pts != 0) {
+		ktime_t timestamp;
+		s64 runtime_us = pts -
+		    dev->capture.vc_start_timestamp;
+		timestamp = ktime_add_us(dev->capture.kernel_start_ts,
+					 runtime_us);
+		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+			 "Convert start time %llu and %llu with offset %llu to %llu\n",
+			 ktime_to_ns(dev->capture.kernel_start_ts),
+			 dev->capture.vc_start_timestamp, pts,
+			 ktime_to_ns(timestamp));
+		buf->vb.vb2_buf.timestamp = ktime_to_ns(timestamp);
+	} else {
+		if (dev->capture.last_timestamp) {
+			buf->vb.vb2_buf.timestamp = dev->capture.last_timestamp;
 			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-				 "Buffer has ts %llu",
-				 dev->capture.last_timestamp);
-			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
-
-			if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
-			    is_capturing(dev)) {
-				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-					 "Grab another frame as buffer has EOS");
-				vchiq_mmal_port_parameter_set(
-					instance,
-					dev->capture.camera_port,
-					MMAL_PARAMETER_CAPTURE,
-					&dev->capture.frame_count,
-					sizeof(dev->capture.frame_count));
-			}
+				 "Buffer time set as last timestamp - %lld",
+				 buf->vb.vb2_buf.timestamp);
 		} else {
-			/* signal frame completion */
-			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
-			complete(&dev->capture.frame_cmplt);
+			buf->vb.vb2_buf.timestamp =
+				ktime_to_ns(dev->capture.kernel_start_ts);
+			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+				 "Buffer time set as start timestamp - %lld",
+				 buf->vb.vb2_buf.timestamp);
 		}
 	}
+	dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
+
+	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
+	if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
+		buf->vb.flags |= V4L2_BUF_FLAG_KEYFRAME;
+
+	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+		 "Buffer has ts %llu",
+		 dev->capture.last_timestamp);
+	vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
+
+	if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
+	    is_capturing(dev)) {
+		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+			 "Grab another frame as buffer has EOS");
+		vchiq_mmal_port_parameter_set(instance,
+					      dev->capture.camera_port,
+					      MMAL_PARAMETER_CAPTURE,
+					      &dev->capture.frame_count,
+					      sizeof(dev->capture.frame_count));
+	}
 }
 
 static int enable_camera(struct bm2835_mmal_dev *dev)
@@ -802,27 +805,29 @@ static int vidioc_overlay(struct file *file, void *f, unsigned int on)
 
 	ret = vchiq_mmal_port_set_format(dev->instance, src);
 	if (ret < 0)
-		goto error;
+		return ret;
 
 	ret = set_overlay_params(dev, dst);
 	if (ret < 0)
-		goto error;
+		return ret;
 
-	if (enable_camera(dev) < 0)
-		goto error;
+	if (enable_camera(dev) < 0) {
+		ret = -EINVAL;
+		return ret;
+	}
 
 	ret = vchiq_mmal_component_enable(
 			dev->instance,
 			dev->component[MMAL_COMPONENT_PREVIEW]);
 	if (ret < 0)
-		goto error;
+		return ret;
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "connecting %p to %p\n",
 		 src, dst);
 	ret = vchiq_mmal_port_connect_tunnel(dev->instance, src, dst);
 	if (!ret)
 		ret = vchiq_mmal_port_enable(dev->instance, src, NULL);
-error:
+
 	return ret;
 }
 
-- 
GitLab


From c6c68fda8cecab6eb7d196ec21981da208835db1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 10 Mar 2017 17:35:38 +0000
Subject: [PATCH 0243/1835] staging: bcm2835-camera: Remove dead email
 addresses

None of the listed author email addresses were valid.
Keep list of authors and the companies they represented.
Update my email address.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-camera/bcm2835-camera.c        | 9 +++++----
 .../vc04_services/bcm2835-camera/bcm2835-camera.h        | 9 +++++----
 drivers/staging/vc04_services/bcm2835-camera/controls.c  | 9 +++++----
 .../staging/vc04_services/bcm2835-camera/mmal-common.h   | 9 +++++----
 .../vc04_services/bcm2835-camera/mmal-encodings.h        | 9 +++++----
 .../vc04_services/bcm2835-camera/mmal-msg-common.h       | 9 +++++----
 .../vc04_services/bcm2835-camera/mmal-msg-format.h       | 9 +++++----
 .../staging/vc04_services/bcm2835-camera/mmal-msg-port.h | 9 +++++----
 drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h  | 9 +++++----
 .../vc04_services/bcm2835-camera/mmal-parameters.h       | 9 +++++----
 .../staging/vc04_services/bcm2835-camera/mmal-vchiq.c    | 9 +++++----
 .../staging/vc04_services/bcm2835-camera/mmal-vchiq.h    | 9 +++++----
 12 files changed, 60 insertions(+), 48 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 0932969bd6e4b..91dea308528bd 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 #include <linux/errno.h>
diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
index 09273b0b10798..9833828daf197 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  *
  * core driver device
  */
diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index cff7b1e07153b..9e25c9ae419de 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 #include <linux/errno.h>
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
index a20bf274a4fdf..858bdcde6f3dd 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  *
  * MMAL structures
  *
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-encodings.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-encodings.h
index 129203597f917..2be9941a1f30e 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-encodings.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-encodings.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 #ifndef MMAL_ENCODINGS_H
 #define MMAL_ENCODINGS_H
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-common.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-common.h
index ec8455639d497..342c9b670f7ef 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-common.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-common.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 #ifndef MMAL_MSG_COMMON_H
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
index c9d6fbe25fe48..5ea1a1b785255 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 #ifndef MMAL_MSG_FORMAT_H
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
index 3b3ed79cadd95..fe5768d047333 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 /* MMAL_PORT_TYPE_T */
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
index d1c57edbe2b89..70e935da76650 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 /* all the data structures which serialise the MMAL protocol. note
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
index 184024dfb8b71..96e987d05ca08 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  */
 
 /* common parameters */
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 480758541966a..3cb515bbe9b36 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  *
  * V4L2 driver MMAL vchiq interface code
  */
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
index 22b839ecd5f02..0e5a81bc03e98 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
@@ -4,10 +4,11 @@
  *
  * Copyright © 2013 Raspberry Pi (Trading) Ltd.
  *
- * Authors: Vincent Sanders <vincent.sanders@collabora.co.uk>
- *          Dave Stevenson <dsteve@broadcom.com>
- *          Simon Mellor <simellor@broadcom.com>
- *          Luke Diamand <luked@broadcom.com>
+ * Authors: Vincent Sanders @ Collabora
+ *          Dave Stevenson @ Broadcom
+ *		(now dave.stevenson@raspberrypi.org)
+ *          Simon Mellor @ Broadcom
+ *          Luke Diamand @ Broadcom
  *
  * MMAL interface to VCHIQ message passing
  */
-- 
GitLab


From 9c095a4a11243e58ce4908c32391291b47424e01 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 13:49:32 +0000
Subject: [PATCH 0244/1835] staging: bcm2835-camera: Fix comment style
 violations.

Fix comment style violations in the header files.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/mmal-msg-format.h          |  95 ++++++------
 .../bcm2835-camera/mmal-msg-port.h            | 124 ++++++++--------
 .../vc04_services/bcm2835-camera/mmal-msg.h   | 135 +++++++++---------
 3 files changed, 185 insertions(+), 169 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
index 5ea1a1b785255..a118efd21d98a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
@@ -19,22 +19,23 @@
 /* MMAL_ES_FORMAT_T */
 
 struct mmal_audio_format {
-	u32 channels;           /**< Number of audio channels */
-	u32 sample_rate;        /**< Sample rate */
+	u32 channels;		/* Number of audio channels */
+	u32 sample_rate;	/* Sample rate */
 
-	u32 bits_per_sample;    /**< Bits per sample */
-	u32 block_align;        /**< Size of a block of data */
+	u32 bits_per_sample;	/* Bits per sample */
+	u32 block_align;	/* Size of a block of data */
 };
 
 struct mmal_video_format {
-	u32 width;        /**< Width of frame in pixels */
-	u32 height;       /**< Height of frame in rows of pixels */
-	struct mmal_rect crop;         /**< Visible region of the frame */
-	struct mmal_rational frame_rate;   /**< Frame rate */
-	struct mmal_rational par;          /**< Pixel aspect ratio */
-
-	/* FourCC specifying the color space of the video stream. See the
-	 * \ref MmalColorSpace "pre-defined color spaces" for some examples.
+	u32 width;		/* Width of frame in pixels */
+	u32 height;		/* Height of frame in rows of pixels */
+	struct mmal_rect crop;	/* Visible region of the frame */
+	struct mmal_rational frame_rate;	/* Frame rate */
+	struct mmal_rational par;		/* Pixel aspect ratio */
+
+	/*
+	 * FourCC specifying the color space of the video stream. See the
+	 * MmalColorSpace "pre-defined color spaces" for some examples.
 	 */
 	u32 color_space;
 };
@@ -50,48 +51,56 @@ union mmal_es_specific_format {
 	struct mmal_subpicture_format subpicture;
 };
 
-/** Definition of an elementary stream format (MMAL_ES_FORMAT_T) */
+/* Definition of an elementary stream format (MMAL_ES_FORMAT_T) */
 struct mmal_es_format_local {
-	u32 type;      /* enum mmal_es_type */
-
-	u32 encoding;  /* FourCC specifying encoding of the elementary stream.*/
-	u32 encoding_variant; /* FourCC specifying the specific
-			       * encoding variant of the elementary
-			       * stream.
-			       */
-
-	union mmal_es_specific_format *es;  /* Type specific
-					     * information for the
-					     * elementary stream
-					     */
-
-	u32 bitrate;        /**< Bitrate in bits per second */
-	u32 flags; /**< Flags describing properties of the elementary stream. */
-
-	u32 extradata_size;       /**< Size of the codec specific data */
-	u8  *extradata;           /**< Codec specific data */
+	u32 type;	/* enum mmal_es_type */
+
+	u32 encoding;	/* FourCC specifying encoding of the elementary
+			 * stream.
+			 */
+	u32 encoding_variant;	/* FourCC specifying the specific
+				 * encoding variant of the elementary
+				 * stream.
+				 */
+
+	union mmal_es_specific_format *es;	/* Type specific
+						 * information for the
+						 * elementary stream
+						 */
+
+	u32 bitrate;	/* Bitrate in bits per second */
+	u32 flags;	/* Flags describing properties of the elementary
+			 * stream.
+			 */
+
+	u32 extradata_size;	/* Size of the codec specific data */
+	u8  *extradata;		/* Codec specific data */
 };
 
-/** Remote definition of an elementary stream format (MMAL_ES_FORMAT_T) */
+/* Remote definition of an elementary stream format (MMAL_ES_FORMAT_T) */
 struct mmal_es_format {
-	u32 type;      /* enum mmal_es_type */
+	u32 type;	/* enum mmal_es_type */
 
-	u32 encoding;  /* FourCC specifying encoding of the elementary stream.*/
-	u32 encoding_variant; /* FourCC specifying the specific
-			       * encoding variant of the elementary
-			       * stream.
-			       */
+	u32 encoding;	/* FourCC specifying encoding of the elementary
+			 * stream.
+			 */
+	u32 encoding_variant;	/* FourCC specifying the specific
+				 * encoding variant of the elementary
+				 * stream.
+				 */
 
-	u32 es; /* Type specific
+	u32 es;	/* Type specific
 		 * information for the
 		 * elementary stream
 		 */
 
-	u32 bitrate;        /**< Bitrate in bits per second */
-	u32 flags; /**< Flags describing properties of the elementary stream. */
+	u32 bitrate;	/* Bitrate in bits per second */
+	u32 flags;	/* Flags describing properties of the elementary
+			 * stream.
+			 */
 
-	u32 extradata_size;       /**< Size of the codec specific data */
-	u32 extradata;           /**< Codec specific data */
+	u32 extradata_size;	/* Size of the codec specific data */
+	u32 extradata;		/* Codec specific data */
 };
 
 #endif /* MMAL_MSG_FORMAT_H */
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
index fe5768d047333..3fa3f2a578f06 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
@@ -13,28 +13,31 @@
 
 /* MMAL_PORT_TYPE_T */
 enum mmal_port_type {
-	MMAL_PORT_TYPE_UNKNOWN = 0,  /**< Unknown port type */
-	MMAL_PORT_TYPE_CONTROL,      /**< Control port */
-	MMAL_PORT_TYPE_INPUT,        /**< Input port */
-	MMAL_PORT_TYPE_OUTPUT,       /**< Output port */
-	MMAL_PORT_TYPE_CLOCK,        /**< Clock port */
+	MMAL_PORT_TYPE_UNKNOWN = 0,	/* Unknown port type */
+	MMAL_PORT_TYPE_CONTROL,		/* Control port */
+	MMAL_PORT_TYPE_INPUT,		/* Input port */
+	MMAL_PORT_TYPE_OUTPUT,		/* Output port */
+	MMAL_PORT_TYPE_CLOCK,		/* Clock port */
 };
 
-/** The port is pass-through and doesn't need buffer headers allocated */
+/* The port is pass-through and doesn't need buffer headers allocated */
 #define MMAL_PORT_CAPABILITY_PASSTHROUGH                       0x01
-/** The port wants to allocate the buffer payloads.
+/*
+ *The port wants to allocate the buffer payloads.
  * This signals a preference that payload allocation should be done
  * on this port for efficiency reasons.
  */
 #define MMAL_PORT_CAPABILITY_ALLOCATION                        0x02
-/** The port supports format change events.
+/*
+ * The port supports format change events.
  * This applies to input ports and is used to let the client know
  * whether the port supports being reconfigured via a format
  * change event (i.e. without having to disable the port).
  */
 #define MMAL_PORT_CAPABILITY_SUPPORTS_EVENT_FORMAT_CHANGE      0x04
 
-/* mmal port structure (MMAL_PORT_T)
+/*
+ * mmal port structure (MMAL_PORT_T)
  *
  * most elements are informational only, the pointer values for
  * interogation messages are generally provided as additional
@@ -42,50 +45,50 @@ enum mmal_port_type {
  * buffer_num, buffer_size and userdata parameters are writable.
  */
 struct mmal_port {
-	u32 priv; /* Private member used by the framework */
-	u32 name; /* Port name. Used for debugging purposes (RO) */
-
-	u32 type;      /* Type of the port (RO) enum mmal_port_type */
-	u16 index;     /* Index of the port in its type list (RO) */
-	u16 index_all; /* Index of the port in the list of all ports (RO) */
-
-	u32 is_enabled; /* Indicates whether the port is enabled or not (RO) */
-	u32 format; /* Format of the elementary stream */
-
-	u32 buffer_num_min; /* Minimum number of buffers the port
-			     *   requires (RO).  This is set by the
-			     *   component.
-			     */
-
-	u32 buffer_size_min; /* Minimum size of buffers the port
-			      * requires (RO).  This is set by the
-			      * component.
-			      */
-
-	u32 buffer_alignment_min; /* Minimum alignment requirement for
-				   * the buffers (RO).  A value of
-				   * zero means no special alignment
-				   * requirements.  This is set by the
-				   * component.
-				   */
-
-	u32 buffer_num_recommended;  /* Number of buffers the port
-				      * recommends for optimal
-				      * performance (RO).  A value of
-				      * zero means no special
-				      * recommendation.  This is set
-				      * by the component.
-				      */
-
-	u32 buffer_size_recommended; /* Size of buffers the port
-				      * recommends for optimal
-				      * performance (RO).  A value of
-				      * zero means no special
-				      * recommendation.  This is set
-				      * by the component.
-				      */
-
-	u32 buffer_num; /* Actual number of buffers the port will use.
+	u32 priv;	/* Private member used by the framework */
+	u32 name;	/* Port name. Used for debugging purposes (RO) */
+
+	u32 type;	/* Type of the port (RO) enum mmal_port_type */
+	u16 index;	/* Index of the port in its type list (RO) */
+	u16 index_all;	/* Index of the port in the list of all ports (RO) */
+
+	u32 is_enabled;	/* Indicates whether the port is enabled or not (RO) */
+	u32 format;	/* Format of the elementary stream */
+
+	u32 buffer_num_min;	/* Minimum number of buffers the port
+				 *   requires (RO).  This is set by the
+				 *   component.
+				 */
+
+	u32 buffer_size_min;	/* Minimum size of buffers the port
+				 * requires (RO).  This is set by the
+				 * component.
+				 */
+
+	u32 buffer_alignment_min;/* Minimum alignment requirement for
+				  * the buffers (RO).  A value of
+				  * zero means no special alignment
+				  * requirements.  This is set by the
+				  * component.
+				  */
+
+	u32 buffer_num_recommended;	/* Number of buffers the port
+					 * recommends for optimal
+					 * performance (RO).  A value of
+					 * zero means no special
+					 * recommendation.  This is set
+					 * by the component.
+					 */
+
+	u32 buffer_size_recommended;	/* Size of buffers the port
+					 * recommends for optimal
+					 * performance (RO).  A value of
+					 * zero means no special
+					 * recommendation.  This is set
+					 * by the component.
+					 */
+
+	u32 buffer_num;	/* Actual number of buffers the port will use.
 			 * This is set by the client.
 			 */
 
@@ -94,14 +97,13 @@ struct mmal_port {
 			  * the client.
 			  */
 
-	u32 component; /* Component this port belongs to (Read Only) */
-
-	u32 userdata; /* Field reserved for use by the client */
+	u32 component;	/* Component this port belongs to (Read Only) */
 
-	u32 capabilities; /* Flags describing the capabilities of a
-			   * port (RO).  Bitwise combination of \ref
-			   * portcapabilities "Port capabilities"
-			   * values.
-			   */
+	u32 userdata;	/* Field reserved for use by the client */
 
+	u32 capabilities;	/* Flags describing the capabilities of a
+				 * port (RO).  Bitwise combination of \ref
+				 * portcapabilities "Port capabilities"
+				 * values.
+				 */
 };
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
index 70e935da76650..a0bfbb830fedd 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
@@ -11,7 +11,8 @@
  *          Luke Diamand @ Broadcom
  */
 
-/* all the data structures which serialise the MMAL protocol. note
+/*
+ * all the data structures which serialise the MMAL protocol. note
  * these are directly mapped onto the recived message data.
  *
  * BEWARE: They seem to *assume* pointers are u32 and that there is no
@@ -41,51 +42,51 @@ enum mmal_msg_type {
 	MMAL_MSG_TYPE_SERVICE_CLOSED,
 	MMAL_MSG_TYPE_GET_VERSION,
 	MMAL_MSG_TYPE_COMPONENT_CREATE,
-	MMAL_MSG_TYPE_COMPONENT_DESTROY, /* 5 */
+	MMAL_MSG_TYPE_COMPONENT_DESTROY,	/* 5 */
 	MMAL_MSG_TYPE_COMPONENT_ENABLE,
 	MMAL_MSG_TYPE_COMPONENT_DISABLE,
 	MMAL_MSG_TYPE_PORT_INFO_GET,
 	MMAL_MSG_TYPE_PORT_INFO_SET,
-	MMAL_MSG_TYPE_PORT_ACTION, /* 10 */
+	MMAL_MSG_TYPE_PORT_ACTION,		/* 10 */
 	MMAL_MSG_TYPE_BUFFER_FROM_HOST,
 	MMAL_MSG_TYPE_BUFFER_TO_HOST,
 	MMAL_MSG_TYPE_GET_STATS,
 	MMAL_MSG_TYPE_PORT_PARAMETER_SET,
-	MMAL_MSG_TYPE_PORT_PARAMETER_GET, /* 15 */
+	MMAL_MSG_TYPE_PORT_PARAMETER_GET,	/* 15 */
 	MMAL_MSG_TYPE_EVENT_TO_HOST,
 	MMAL_MSG_TYPE_GET_CORE_STATS_FOR_PORT,
 	MMAL_MSG_TYPE_OPAQUE_ALLOCATOR,
 	MMAL_MSG_TYPE_CONSUME_MEM,
-	MMAL_MSG_TYPE_LMK, /* 20 */
+	MMAL_MSG_TYPE_LMK,			/* 20 */
 	MMAL_MSG_TYPE_OPAQUE_ALLOCATOR_DESC,
 	MMAL_MSG_TYPE_DRM_GET_LHS32,
 	MMAL_MSG_TYPE_DRM_GET_TIME,
 	MMAL_MSG_TYPE_BUFFER_FROM_HOST_ZEROLEN,
-	MMAL_MSG_TYPE_PORT_FLUSH, /* 25 */
+	MMAL_MSG_TYPE_PORT_FLUSH,		/* 25 */
 	MMAL_MSG_TYPE_HOST_LOG,
 	MMAL_MSG_TYPE_MSG_LAST
 };
 
 /* port action request messages differ depending on the action type */
 enum mmal_msg_port_action_type {
-	MMAL_MSG_PORT_ACTION_TYPE_UNKNOWN = 0,      /* Unknown action */
-	MMAL_MSG_PORT_ACTION_TYPE_ENABLE,           /* Enable a port */
-	MMAL_MSG_PORT_ACTION_TYPE_DISABLE,          /* Disable a port */
-	MMAL_MSG_PORT_ACTION_TYPE_FLUSH,            /* Flush a port */
-	MMAL_MSG_PORT_ACTION_TYPE_CONNECT,          /* Connect ports */
-	MMAL_MSG_PORT_ACTION_TYPE_DISCONNECT,       /* Disconnect ports */
+	MMAL_MSG_PORT_ACTION_TYPE_UNKNOWN = 0,	/* Unknown action */
+	MMAL_MSG_PORT_ACTION_TYPE_ENABLE,	/* Enable a port */
+	MMAL_MSG_PORT_ACTION_TYPE_DISABLE,	/* Disable a port */
+	MMAL_MSG_PORT_ACTION_TYPE_FLUSH,	/* Flush a port */
+	MMAL_MSG_PORT_ACTION_TYPE_CONNECT,	/* Connect ports */
+	MMAL_MSG_PORT_ACTION_TYPE_DISCONNECT,	/* Disconnect ports */
 	MMAL_MSG_PORT_ACTION_TYPE_SET_REQUIREMENTS, /* Set buffer requirements*/
 };
 
 struct mmal_msg_header {
 	u32 magic;
-	u32 type; /** enum mmal_msg_type */
+	u32 type;	/* enum mmal_msg_type */
 
 	/* Opaque handle to the control service */
 	u32 control_service;
 
-	u32 context; /** a u32 per message context */
-	u32 status; /** The status of the vchiq operation */
+	u32 context;	/* a u32 per message context */
+	u32 status;	/* The status of the vchiq operation */
 	u32 padding;
 };
 
@@ -99,9 +100,9 @@ struct mmal_msg_version {
 
 /* request to VC to create component */
 struct mmal_msg_component_create {
-	u32 client_component; /* component context */
+	u32 client_component;	/* component context */
 	char name[128];
-	u32 pid;                /* For debug */
+	u32 pid;		/* For debug */
 };
 
 /* reply from VC to component creation request */
@@ -121,7 +122,7 @@ struct mmal_msg_component_destroy {
 };
 
 struct mmal_msg_component_destroy_reply {
-	u32 status; /** The component destruction status */
+	u32 status; /* The component destruction status */
 };
 
 /* request and reply to VC to enable a component */
@@ -130,7 +131,7 @@ struct mmal_msg_component_enable {
 };
 
 struct mmal_msg_component_enable_reply {
-	u32 status; /** The component enable status */
+	u32 status; /* The component enable status */
 };
 
 /* request and reply to VC to disable a component */
@@ -139,7 +140,7 @@ struct mmal_msg_component_disable {
 };
 
 struct mmal_msg_component_disable_reply {
-	u32 status; /** The component disable status */
+	u32 status; /* The component disable status */
 };
 
 /* request to VC to get port information */
@@ -151,12 +152,12 @@ struct mmal_msg_port_info_get {
 
 /* reply from VC to get port info request */
 struct mmal_msg_port_info_get_reply {
-	u32 status; /** enum mmal_msg_status */
-	u32 component_handle;  /* component handle port is associated with */
-	u32 port_type;         /* enum mmal_msg_port_type */
-	u32 port_index;        /* port indexed in query */
-	s32 found;             /* unused */
-	u32 port_handle;               /**< Handle to use for this port */
+	u32 status;		/* enum mmal_msg_status */
+	u32 component_handle;	/* component handle port is associated with */
+	u32 port_type;		/* enum mmal_msg_port_type */
+	u32 port_index;		/* port indexed in query */
+	s32 found;		/* unused */
+	u32 port_handle;	/* Handle to use for this port */
 	struct mmal_port port;
 	struct mmal_es_format format; /* elementary stream format */
 	union mmal_es_specific_format es; /* es type specific data */
@@ -166,8 +167,8 @@ struct mmal_msg_port_info_get_reply {
 /* request to VC to set port information */
 struct mmal_msg_port_info_set {
 	u32 component_handle;
-	u32 port_type;         /* enum mmal_msg_port_type */
-	u32 port_index;           /* port indexed in query */
+	u32 port_type;		/* enum mmal_msg_port_type */
+	u32 port_index;		/* port indexed in query */
 	struct mmal_port port;
 	struct mmal_es_format format;
 	union mmal_es_specific_format es;
@@ -177,11 +178,11 @@ struct mmal_msg_port_info_set {
 /* reply from VC to port info set request */
 struct mmal_msg_port_info_set_reply {
 	u32 status;
-	u32 component_handle;  /* component handle port is associated with */
-	u32 port_type;         /* enum mmal_msg_port_type */
-	u32 index;             /* port indexed in query */
-	s32 found;             /* unused */
-	u32 port_handle;               /**< Handle to use for this port */
+	u32 component_handle;	/* component handle port is associated with */
+	u32 port_type;		/* enum mmal_msg_port_type */
+	u32 index;		/* port indexed in query */
+	s32 found;		/* unused */
+	u32 port_handle;	/* Handle to use for this port */
 	struct mmal_port port;
 	struct mmal_es_format format;
 	union mmal_es_specific_format es;
@@ -192,7 +193,7 @@ struct mmal_msg_port_info_set_reply {
 struct mmal_msg_port_action_port {
 	u32 component_handle;
 	u32 port_handle;
-	u32 action; /* enum mmal_msg_port_action_type */
+	u32 action;		/* enum mmal_msg_port_action_type */
 	struct mmal_port port;
 };
 
@@ -200,50 +201,53 @@ struct mmal_msg_port_action_port {
 struct mmal_msg_port_action_handle {
 	u32 component_handle;
 	u32 port_handle;
-	u32 action; /* enum mmal_msg_port_action_type */
+	u32 action;		/* enum mmal_msg_port_action_type */
 	u32 connect_component_handle;
 	u32 connect_port_handle;
 };
 
 struct mmal_msg_port_action_reply {
-	u32 status; /** The port action operation status */
+	u32 status;	/* The port action operation status */
 };
 
 /* MMAL buffer transfer */
 
-/** Size of space reserved in a buffer message for short messages. */
+/* Size of space reserved in a buffer message for short messages. */
 #define MMAL_VC_SHORT_DATA 128
 
-/** Signals that the current payload is the end of the stream of data */
+/* Signals that the current payload is the end of the stream of data */
 #define MMAL_BUFFER_HEADER_FLAG_EOS                    BIT(0)
-/** Signals that the start of the current payload starts a frame */
+/* Signals that the start of the current payload starts a frame */
 #define MMAL_BUFFER_HEADER_FLAG_FRAME_START            BIT(1)
-/** Signals that the end of the current payload ends a frame */
+/* Signals that the end of the current payload ends a frame */
 #define MMAL_BUFFER_HEADER_FLAG_FRAME_END              BIT(2)
-/** Signals that the current payload contains only complete frames (>1) */
+/* Signals that the current payload contains only complete frames (>1) */
 #define MMAL_BUFFER_HEADER_FLAG_FRAME                  \
 	(MMAL_BUFFER_HEADER_FLAG_FRAME_START|MMAL_BUFFER_HEADER_FLAG_FRAME_END)
-/** Signals that the current payload is a keyframe (i.e. self decodable) */
+/* Signals that the current payload is a keyframe (i.e. self decodable) */
 #define MMAL_BUFFER_HEADER_FLAG_KEYFRAME               BIT(3)
-/** Signals a discontinuity in the stream of data (e.g. after a seek).
+/*
+ * Signals a discontinuity in the stream of data (e.g. after a seek).
  * Can be used for instance by a decoder to reset its state
  */
 #define MMAL_BUFFER_HEADER_FLAG_DISCONTINUITY          BIT(4)
-/** Signals a buffer containing some kind of config data for the component
+/*
+ * Signals a buffer containing some kind of config data for the component
  * (e.g. codec config data)
  */
 #define MMAL_BUFFER_HEADER_FLAG_CONFIG                 BIT(5)
-/** Signals an encrypted payload */
+/* Signals an encrypted payload */
 #define MMAL_BUFFER_HEADER_FLAG_ENCRYPTED              BIT(6)
-/** Signals a buffer containing side information */
+/* Signals a buffer containing side information */
 #define MMAL_BUFFER_HEADER_FLAG_CODECSIDEINFO          BIT(7)
-/** Signals a buffer which is the snapshot/postview image from a stills
+/*
+ * Signals a buffer which is the snapshot/postview image from a stills
  * capture
  */
 #define MMAL_BUFFER_HEADER_FLAGS_SNAPSHOT              BIT(8)
-/** Signals a buffer which contains data known to be corrupted */
+/* Signals a buffer which contains data known to be corrupted */
 #define MMAL_BUFFER_HEADER_FLAG_CORRUPTED              BIT(9)
-/** Signals that a buffer failed to be transmitted */
+/* Signals that a buffer failed to be transmitted */
 #define MMAL_BUFFER_HEADER_FLAG_TRANSMISSION_FAILED    BIT(10)
 
 struct mmal_driver_buffer {
@@ -255,8 +259,8 @@ struct mmal_driver_buffer {
 
 /* buffer header */
 struct mmal_buffer_header {
-	u32 next; /* next header */
-	u32 priv; /* framework private data */
+	u32 next;	/* next header */
+	u32 priv;	/* framework private data */
 	u32 cmd;
 	u32 data;
 	u32 alloc_size;
@@ -281,7 +285,8 @@ struct mmal_buffer_header_type_specific {
 };
 
 struct mmal_msg_buffer_from_host {
-	/* The front 32 bytes of the buffer header are copied
+	/*
+	 *The front 32 bytes of the buffer header are copied
 	 * back to us in the reply to allow for context. This
 	 * area is used to store two mmal_driver_buffer structures to
 	 * allow for multiple concurrent service users.
@@ -296,7 +301,7 @@ struct mmal_msg_buffer_from_host {
 	s32 is_zero_copy;
 	s32 has_reference;
 
-	/** allows short data to be xfered in control message */
+	/* allows short data to be xfered in control message */
 	u32 payload_in_message;
 	u8 short_data[MMAL_VC_SHORT_DATA];
 };
@@ -306,10 +311,10 @@ struct mmal_msg_buffer_from_host {
 #define MMAL_WORKER_PORT_PARAMETER_SPACE      96
 
 struct mmal_msg_port_parameter_set {
-	u32 component_handle; /* component */
-	u32 port_handle;      /* port */
-	u32 id;     /* Parameter ID  */
-	u32 size;      /* Parameter size */
+	u32 component_handle;	/* component */
+	u32 port_handle;	/* port */
+	u32 id;			/* Parameter ID  */
+	u32 size;		/* Parameter size */
 	uint32_t value[MMAL_WORKER_PORT_PARAMETER_SPACE];
 };
 
@@ -322,16 +327,16 @@ struct mmal_msg_port_parameter_set_reply {
 /* port parameter getting */
 
 struct mmal_msg_port_parameter_get {
-	u32 component_handle; /* component */
-	u32 port_handle;      /* port */
-	u32 id;     /* Parameter ID  */
-	u32 size;      /* Parameter size */
+	u32 component_handle;	/* component */
+	u32 port_handle;	/* port */
+	u32 id;			/* Parameter ID  */
+	u32 size;		/* Parameter size */
 };
 
 struct mmal_msg_port_parameter_get_reply {
-	u32 status;           /* Status of mmal_port_parameter_get call */
-	u32 id;     /* Parameter ID  */
-	u32 size;      /* Parameter size */
+	u32 status;		/* Status of mmal_port_parameter_get call */
+	u32 id;			/* Parameter ID  */
+	u32 size;		/* Parameter size */
 	uint32_t value[MMAL_WORKER_PORT_PARAMETER_SPACE];
 };
 
@@ -339,7 +344,7 @@ struct mmal_msg_port_parameter_get_reply {
 #define MMAL_WORKER_EVENT_SPACE 256
 
 struct mmal_msg_event_to_host {
-	u32 client_component; /* component context */
+	u32 client_component;	/* component context */
 
 	u32 port_type;
 	u32 port_num;
-- 
GitLab


From c8811a6090340fd1d1fd001f2757c20897fa14e8 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 14:13:03 +0000
Subject: [PATCH 0245/1835] staging: bcm2835-camera: Fix spacing around
 operators

Fix checkpatch warnings over spaces around operators.
Many were around operations that can be replaced with the
BIT(x) macro, so replace with that where appropriate.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-camera/controls.c   | 32 +++++++++----------
 .../vc04_services/bcm2835-camera/mmal-msg.h   |  3 +-
 .../bcm2835-camera/mmal-parameters.h          | 12 +++----
 3 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 9e25c9ae419de..402c35ec12703 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -1123,10 +1123,10 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	{
 		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
 		MMAL_CONTROL_TYPE_STD_MENU,
-		~((1<<V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
-			(1<<V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
-			(1<<V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
-			(1<<V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
+		~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+		  BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+		  BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+		  BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
 		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
 		V4L2_MPEG_VIDEO_H264_PROFILE_HIGH, 1, NULL,
 		MMAL_PARAMETER_PROFILE,
@@ -1135,18 +1135,18 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	},
 	{
 		V4L2_CID_MPEG_VIDEO_H264_LEVEL, MMAL_CONTROL_TYPE_STD_MENU,
-		~((1<<V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
-			(1<<V4L2_MPEG_VIDEO_H264_LEVEL_4_0)),
+		~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+		  BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0)),
 		V4L2_MPEG_VIDEO_H264_LEVEL_4_0,
 		V4L2_MPEG_VIDEO_H264_LEVEL_4_0, 1, NULL,
 		MMAL_PARAMETER_PROFILE,
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
index a0bfbb830fedd..f7a0b865500e8 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
@@ -223,7 +223,8 @@ struct mmal_msg_port_action_reply {
 #define MMAL_BUFFER_HEADER_FLAG_FRAME_END              BIT(2)
 /* Signals that the current payload contains only complete frames (>1) */
 #define MMAL_BUFFER_HEADER_FLAG_FRAME                  \
-	(MMAL_BUFFER_HEADER_FLAG_FRAME_START|MMAL_BUFFER_HEADER_FLAG_FRAME_END)
+	(MMAL_BUFFER_HEADER_FLAG_FRAME_START | \
+	 MMAL_BUFFER_HEADER_FLAG_FRAME_END)
 /* Signals that the current payload is a keyframe (i.e. self decodable) */
 #define MMAL_BUFFER_HEADER_FLAG_KEYFRAME               BIT(3)
 /*
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
index 96e987d05ca08..6d21594ee384a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
@@ -23,17 +23,17 @@
 #define __MMAL_PARAMETERS_H
 
 /** Common parameter ID group, used with many types of component. */
-#define MMAL_PARAMETER_GROUP_COMMON            (0<<16)
+#define MMAL_PARAMETER_GROUP_COMMON            (0 << 16)
 /** Camera-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_CAMERA            (1<<16)
+#define MMAL_PARAMETER_GROUP_CAMERA            (1 << 16)
 /** Video-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_VIDEO             (2<<16)
+#define MMAL_PARAMETER_GROUP_VIDEO             (2 << 16)
 /** Audio-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_AUDIO             (3<<16)
+#define MMAL_PARAMETER_GROUP_AUDIO             (3 << 16)
 /** Clock-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_CLOCK             (4<<16)
+#define MMAL_PARAMETER_GROUP_CLOCK             (4 << 16)
 /** Miracast-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_MIRACAST       (5<<16)
+#define MMAL_PARAMETER_GROUP_MIRACAST       (5 << 16)
 
 /* Common parameters */
 enum mmal_parameter_common_type {
-- 
GitLab


From a785debcf981e485ec780a3b10417ca4fef53c26 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 15:23:35 +0000
Subject: [PATCH 0246/1835] staging: bcm2835-camera: Reduce length of enum
 names

We have numerous lines over 80 chars, or oddly split. Many
of these are due to using long enum names such as
MMAL_COMPONENT_CAMERA.
Reduce the length of these enum names.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 165 +++++++++---------
 .../bcm2835-camera/bcm2835-camera.h           |  20 +--
 .../vc04_services/bcm2835-camera/controls.c   |  47 +++--
 3 files changed, 114 insertions(+), 118 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 91dea308528bd..39086c6e26b14 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -80,7 +80,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_I420,
 		.depth = 12,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 1,
 		.remove_padding = 1,
 	}, {
@@ -89,7 +89,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_YUYV,
 		.depth = 16,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 2,
 		.remove_padding = 0,
 	}, {
@@ -98,7 +98,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_RGB24,
 		.depth = 24,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 3,
 		.remove_padding = 0,
 	}, {
@@ -107,7 +107,7 @@ static struct mmal_fmt formats[] = {
 		.flags = V4L2_FMT_FLAG_COMPRESSED,
 		.mmal = MMAL_ENCODING_JPEG,
 		.depth = 8,
-		.mmal_component = MMAL_COMPONENT_IMAGE_ENCODE,
+		.mmal_component = COMP_IMAGE_ENCODE,
 		.ybbp = 0,
 		.remove_padding = 0,
 	}, {
@@ -116,7 +116,7 @@ static struct mmal_fmt formats[] = {
 		.flags = V4L2_FMT_FLAG_COMPRESSED,
 		.mmal = MMAL_ENCODING_H264,
 		.depth = 8,
-		.mmal_component = MMAL_COMPONENT_VIDEO_ENCODE,
+		.mmal_component = COMP_VIDEO_ENCODE,
 		.ybbp = 0,
 		.remove_padding = 0,
 	}, {
@@ -125,7 +125,7 @@ static struct mmal_fmt formats[] = {
 		.flags = V4L2_FMT_FLAG_COMPRESSED,
 		.mmal = MMAL_ENCODING_MJPEG,
 		.depth = 8,
-		.mmal_component = MMAL_COMPONENT_VIDEO_ENCODE,
+		.mmal_component = COMP_VIDEO_ENCODE,
 		.ybbp = 0,
 		.remove_padding = 0,
 	}, {
@@ -134,7 +134,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_YVYU,
 		.depth = 16,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 2,
 		.remove_padding = 0,
 	}, {
@@ -143,7 +143,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_VYUY,
 		.depth = 16,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 2,
 		.remove_padding = 0,
 	}, {
@@ -152,7 +152,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_UYVY,
 		.depth = 16,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 2,
 		.remove_padding = 0,
 	}, {
@@ -161,7 +161,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_NV12,
 		.depth = 12,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 1,
 		.remove_padding = 1,
 	}, {
@@ -170,7 +170,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_BGR24,
 		.depth = 24,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 3,
 		.remove_padding = 0,
 	}, {
@@ -179,7 +179,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_YV12,
 		.depth = 12,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 1,
 		.remove_padding = 1,
 	}, {
@@ -188,7 +188,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_NV21,
 		.depth = 12,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 1,
 		.remove_padding = 1,
 	}, {
@@ -197,7 +197,7 @@ static struct mmal_fmt formats[] = {
 		.flags = 0,
 		.mmal = MMAL_ENCODING_BGRA,
 		.depth = 32,
-		.mmal_component = MMAL_COMPONENT_CAMERA,
+		.mmal_component = COMP_CAMERA,
 		.ybbp = 4,
 		.remove_padding = 0,
 	},
@@ -314,7 +314,7 @@ static inline bool is_capturing(struct bm2835_mmal_dev *dev)
 {
 	return dev->capture.camera_port ==
 	    &dev->
-	    component[MMAL_COMPONENT_CAMERA]->output[MMAL_CAMERA_PORT_CAPTURE];
+	    component[COMP_CAMERA]->output[CAM_PORT_CAPTURE];
 }
 
 static void buffer_cb(struct vchiq_mmal_instance *instance,
@@ -436,7 +436,7 @@ static int enable_camera(struct bm2835_mmal_dev *dev)
 	if (!dev->camera_use_count) {
 		ret = vchiq_mmal_port_parameter_set(
 			dev->instance,
-			&dev->component[MMAL_COMPONENT_CAMERA]->control,
+			&dev->component[COMP_CAMERA]->control,
 			MMAL_PARAMETER_CAMERA_NUM, &dev->camera_num,
 			sizeof(dev->camera_num));
 		if (ret < 0) {
@@ -447,7 +447,7 @@ static int enable_camera(struct bm2835_mmal_dev *dev)
 
 		ret = vchiq_mmal_component_enable(
 				dev->instance,
-				dev->component[MMAL_COMPONENT_CAMERA]);
+				dev->component[COMP_CAMERA]);
 		if (ret < 0) {
 			v4l2_err(&dev->v4l2_dev,
 				 "Failed enabling camera, ret %d\n", ret);
@@ -479,7 +479,7 @@ static int disable_camera(struct bm2835_mmal_dev *dev)
 		ret =
 		    vchiq_mmal_component_disable(
 				dev->instance,
-				dev->component[MMAL_COMPONENT_CAMERA]);
+				dev->component[COMP_CAMERA]);
 		if (ret < 0) {
 			v4l2_err(&dev->v4l2_dev,
 				 "Failed disabling camera, ret %d\n", ret);
@@ -487,7 +487,7 @@ static int disable_camera(struct bm2835_mmal_dev *dev)
 		}
 		vchiq_mmal_port_parameter_set(
 			dev->instance,
-			&dev->component[MMAL_COMPONENT_CAMERA]->control,
+			&dev->component[COMP_CAMERA]->control,
 			MMAL_PARAMETER_CAMERA_NUM, &i,
 			sizeof(i));
 	}
@@ -539,7 +539,7 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 	/* if the preview is not already running, wait for a few frames for AGC
 	 * to settle down.
 	 */
-	if (!dev->component[MMAL_COMPONENT_PREVIEW]->enabled)
+	if (!dev->component[COMP_PREVIEW]->enabled)
 		msleep(300);
 
 	/* enable the connection from camera to encoder (if applicable) */
@@ -762,9 +762,9 @@ static int vidioc_s_fmt_vid_overlay(struct file *file, void *priv,
 	vidioc_try_fmt_vid_overlay(file, priv, f);
 
 	dev->overlay = f->fmt.win;
-	if (dev->component[MMAL_COMPONENT_PREVIEW]->enabled) {
+	if (dev->component[COMP_PREVIEW]->enabled) {
 		set_overlay_params(dev,
-				   &dev->component[MMAL_COMPONENT_PREVIEW]->input[0]);
+				   &dev->component[COMP_PREVIEW]->input[0]);
 	}
 
 	return 0;
@@ -777,13 +777,13 @@ static int vidioc_overlay(struct file *file, void *f, unsigned int on)
 	struct vchiq_mmal_port *src;
 	struct vchiq_mmal_port *dst;
 
-	if ((on && dev->component[MMAL_COMPONENT_PREVIEW]->enabled) ||
-	    (!on && !dev->component[MMAL_COMPONENT_PREVIEW]->enabled))
+	if ((on && dev->component[COMP_PREVIEW]->enabled) ||
+	    (!on && !dev->component[COMP_PREVIEW]->enabled))
 		return 0;	/* already in requested state */
 
 	src =
-	    &dev->component[MMAL_COMPONENT_CAMERA]->
-	    output[MMAL_CAMERA_PORT_PREVIEW];
+	    &dev->component[COMP_CAMERA]->
+	    output[CAM_PORT_PREVIEW];
 
 	if (!on) {
 		/* disconnect preview ports and disable component */
@@ -795,14 +795,14 @@ static int vidioc_overlay(struct file *file, void *f, unsigned int on)
 		if (ret >= 0)
 			ret = vchiq_mmal_component_disable(
 					dev->instance,
-					dev->component[MMAL_COMPONENT_PREVIEW]);
+					dev->component[COMP_PREVIEW]);
 
 		disable_camera(dev);
 		return ret;
 	}
 
 	/* set preview port format and connect it to output */
-	dst = &dev->component[MMAL_COMPONENT_PREVIEW]->input[0];
+	dst = &dev->component[COMP_PREVIEW]->input[0];
 
 	ret = vchiq_mmal_port_set_format(dev->instance, src);
 	if (ret < 0)
@@ -819,7 +819,7 @@ static int vidioc_overlay(struct file *file, void *f, unsigned int on)
 
 	ret = vchiq_mmal_component_enable(
 			dev->instance,
-			dev->component[MMAL_COMPONENT_PREVIEW]);
+			dev->component[COMP_PREVIEW]);
 	if (ret < 0)
 		return ret;
 
@@ -840,8 +840,8 @@ static int vidioc_g_fbuf(struct file *file, void *fh,
 	 */
 	struct bm2835_mmal_dev *dev = video_drvdata(file);
 	struct vchiq_mmal_port *preview_port =
-		    &dev->component[MMAL_COMPONENT_CAMERA]->
-		    output[MMAL_CAMERA_PORT_PREVIEW];
+		&dev->component[COMP_CAMERA]->
+		output[CAM_PORT_PREVIEW];
 
 	a->capability = V4L2_FBUF_CAP_EXTERNOVERLAY |
 			V4L2_FBUF_CAP_GLOBAL_ALPHA;
@@ -1044,31 +1044,31 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 	}
 	/* format dependent port setup */
 	switch (mfmt->mmal_component) {
-	case MMAL_COMPONENT_CAMERA:
+	case COMP_CAMERA:
 		/* Make a further decision on port based on resolution */
 		if (f->fmt.pix.width <= max_video_width
 		    && f->fmt.pix.height <= max_video_height)
 			camera_port = port =
-			    &dev->component[MMAL_COMPONENT_CAMERA]->
-			    output[MMAL_CAMERA_PORT_VIDEO];
+			    &dev->component[COMP_CAMERA]->
+			    output[CAM_PORT_VIDEO];
 		else
 			camera_port = port =
-			    &dev->component[MMAL_COMPONENT_CAMERA]->
-			    output[MMAL_CAMERA_PORT_CAPTURE];
+			    &dev->component[COMP_CAMERA]->
+			    output[CAM_PORT_CAPTURE];
 		break;
-	case MMAL_COMPONENT_IMAGE_ENCODE:
-		encode_component = dev->component[MMAL_COMPONENT_IMAGE_ENCODE];
-		port = &dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->output[0];
+	case COMP_IMAGE_ENCODE:
+		encode_component = dev->component[COMP_IMAGE_ENCODE];
+		port = &dev->component[COMP_IMAGE_ENCODE]->output[0];
 		camera_port =
-		    &dev->component[MMAL_COMPONENT_CAMERA]->
-		    output[MMAL_CAMERA_PORT_CAPTURE];
+		    &dev->component[COMP_CAMERA]->
+		    output[CAM_PORT_CAPTURE];
 		break;
-	case MMAL_COMPONENT_VIDEO_ENCODE:
-		encode_component = dev->component[MMAL_COMPONENT_VIDEO_ENCODE];
-		port = &dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->output[0];
+	case COMP_VIDEO_ENCODE:
+		encode_component = dev->component[COMP_VIDEO_ENCODE];
+		port = &dev->component[COMP_VIDEO_ENCODE]->output[0];
 		camera_port =
-		    &dev->component[MMAL_COMPONENT_CAMERA]->
-		    output[MMAL_CAMERA_PORT_VIDEO];
+		    &dev->component[COMP_CAMERA]->
+		    output[CAM_PORT_VIDEO];
 		break;
 	default:
 		break;
@@ -1110,13 +1110,12 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 
 	if (!ret
 	    && camera_port ==
-	    &dev->component[MMAL_COMPONENT_CAMERA]->
-	    output[MMAL_CAMERA_PORT_VIDEO]) {
+	    &dev->component[COMP_CAMERA]->
+	    output[CAM_PORT_VIDEO]) {
 		bool overlay_enabled =
-		    !!dev->component[MMAL_COMPONENT_PREVIEW]->enabled;
+		    !!dev->component[COMP_PREVIEW]->enabled;
 		struct vchiq_mmal_port *preview_port =
-		    &dev->component[MMAL_COMPONENT_CAMERA]->
-		    output[MMAL_CAMERA_PORT_PREVIEW];
+		    &dev->component[COMP_CAMERA]->output[CAM_PORT_PREVIEW];
 		/* Preview and encode ports need to match on resolution */
 		if (overlay_enabled) {
 			/* Need to disable the overlay before we can update
@@ -1147,7 +1146,7 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 			ret = vchiq_mmal_port_connect_tunnel(
 				dev->instance,
 				preview_port,
-				&dev->component[MMAL_COMPONENT_PREVIEW]->input[0]);
+				&dev->component[COMP_PREVIEW]->input[0]);
 			if (!ret)
 				ret = vchiq_mmal_port_enable(dev->instance,
 							     preview_port,
@@ -1201,11 +1200,11 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 				port->format.encoding_variant = 0;
 				/* Set any encoding specific parameters */
 				switch (mfmt->mmal_component) {
-				case MMAL_COMPONENT_VIDEO_ENCODE:
+				case COMP_VIDEO_ENCODE:
 					port->format.bitrate =
 					    dev->capture.encode_bitrate;
 					break;
-				case MMAL_COMPONENT_IMAGE_ENCODE:
+				case COMP_IMAGE_ENCODE:
 					/* Could set EXIF parameters here */
 					break;
 				default:
@@ -1580,14 +1579,14 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 
 	/* get the camera component ready */
 	ret = vchiq_mmal_component_init(dev->instance, "ril.camera",
-					&dev->component[MMAL_COMPONENT_CAMERA]);
+					&dev->component[COMP_CAMERA]);
 	if (ret < 0)
 		goto unreg_mmal;
 
-	camera = dev->component[MMAL_COMPONENT_CAMERA];
-	if (camera->outputs < MMAL_CAMERA_PORT_COUNT) {
+	camera = dev->component[COMP_CAMERA];
+	if (camera->outputs < CAM_PORT_COUNT) {
 		v4l2_err(&dev->v4l2_dev, "%s: too few camera outputs %d needed %d\n",
-			 __func__, camera->outputs, MMAL_CAMERA_PORT_COUNT);
+			 __func__, camera->outputs, CAM_PORT_COUNT);
 		ret = -EINVAL;
 		goto unreg_camera;
 	}
@@ -1609,7 +1608,7 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	dev->rgb_bgr_swapped = true;
 	param_size = sizeof(supported_encodings);
 	ret = vchiq_mmal_port_parameter_get(dev->instance,
-					    &camera->output[MMAL_CAMERA_PORT_CAPTURE],
+					    &camera->output[CAM_PORT_CAPTURE],
 					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
 					    &supported_encodings,
 					    &param_size);
@@ -1630,7 +1629,7 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 			}
 		}
 	}
-	format = &camera->output[MMAL_CAMERA_PORT_PREVIEW].format;
+	format = &camera->output[CAM_PORT_PREVIEW].format;
 
 	format->encoding = MMAL_ENCODING_OPAQUE;
 	format->encoding_variant = MMAL_ENCODING_I420;
@@ -1644,7 +1643,7 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	format->es->video.frame_rate.num = 0; /* Rely on fps_range */
 	format->es->video.frame_rate.den = 1;
 
-	format = &camera->output[MMAL_CAMERA_PORT_VIDEO].format;
+	format = &camera->output[CAM_PORT_VIDEO].format;
 
 	format->encoding = MMAL_ENCODING_OPAQUE;
 	format->encoding_variant = MMAL_ENCODING_I420;
@@ -1658,7 +1657,7 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	format->es->video.frame_rate.num = 0; /* Rely on fps_range */
 	format->es->video.frame_rate.den = 1;
 
-	format = &camera->output[MMAL_CAMERA_PORT_CAPTURE].format;
+	format = &camera->output[CAM_PORT_CAPTURE].format;
 
 	format->encoding = MMAL_ENCODING_OPAQUE;
 
@@ -1682,28 +1681,28 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	/* get the preview component ready */
 	ret = vchiq_mmal_component_init(
 			dev->instance, "ril.video_render",
-			&dev->component[MMAL_COMPONENT_PREVIEW]);
+			&dev->component[COMP_PREVIEW]);
 	if (ret < 0)
 		goto unreg_camera;
 
-	if (dev->component[MMAL_COMPONENT_PREVIEW]->inputs < 1) {
+	if (dev->component[COMP_PREVIEW]->inputs < 1) {
 		ret = -EINVAL;
 		v4l2_err(&dev->v4l2_dev, "%s: too few input ports %d needed %d\n",
-			 __func__, dev->component[MMAL_COMPONENT_PREVIEW]->inputs, 1);
+			 __func__, dev->component[COMP_PREVIEW]->inputs, 1);
 		goto unreg_preview;
 	}
 
 	/* get the image encoder component ready */
 	ret = vchiq_mmal_component_init(
 		dev->instance, "ril.image_encode",
-		&dev->component[MMAL_COMPONENT_IMAGE_ENCODE]);
+		&dev->component[COMP_IMAGE_ENCODE]);
 	if (ret < 0)
 		goto unreg_preview;
 
-	if (dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->inputs < 1) {
+	if (dev->component[COMP_IMAGE_ENCODE]->inputs < 1) {
 		ret = -EINVAL;
 		v4l2_err(&dev->v4l2_dev, "%s: too few input ports %d needed %d\n",
-			 __func__, dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->inputs,
+			 __func__, dev->component[COMP_IMAGE_ENCODE]->inputs,
 			 1);
 		goto unreg_image_encoder;
 	}
@@ -1711,21 +1710,21 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 	/* get the video encoder component ready */
 	ret = vchiq_mmal_component_init(dev->instance, "ril.video_encode",
 					&dev->
-					component[MMAL_COMPONENT_VIDEO_ENCODE]);
+					component[COMP_VIDEO_ENCODE]);
 	if (ret < 0)
 		goto unreg_image_encoder;
 
-	if (dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->inputs < 1) {
+	if (dev->component[COMP_VIDEO_ENCODE]->inputs < 1) {
 		ret = -EINVAL;
 		v4l2_err(&dev->v4l2_dev, "%s: too few input ports %d needed %d\n",
-			 __func__, dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->inputs,
+			 __func__, dev->component[COMP_VIDEO_ENCODE]->inputs,
 			 1);
 		goto unreg_vid_encoder;
 	}
 
 	{
 		struct vchiq_mmal_port *encoder_port =
-			&dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->output[0];
+			&dev->component[COMP_VIDEO_ENCODE]->output[0];
 		encoder_port->format.encoding = MMAL_ENCODING_H264;
 		ret = vchiq_mmal_port_set_format(dev->instance,
 						 encoder_port);
@@ -1736,12 +1735,12 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 
 		vchiq_mmal_port_parameter_set(
 			dev->instance,
-			&dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->control,
+			&dev->component[COMP_VIDEO_ENCODE]->control,
 			MMAL_PARAMETER_VIDEO_IMMUTABLE_INPUT,
 			&enable, sizeof(enable));
 
 		vchiq_mmal_port_parameter_set(dev->instance,
-					      &dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->control,
+					      &dev->component[COMP_VIDEO_ENCODE]->control,
 					      MMAL_PARAMETER_MINIMISE_FRAGMENTATION,
 					      &enable,
 					      sizeof(enable));
@@ -1759,23 +1758,23 @@ unreg_vid_encoder:
 	pr_err("Cleanup: Destroy video encoder\n");
 	vchiq_mmal_component_finalise(
 		dev->instance,
-		dev->component[MMAL_COMPONENT_VIDEO_ENCODE]);
+		dev->component[COMP_VIDEO_ENCODE]);
 
 unreg_image_encoder:
 	pr_err("Cleanup: Destroy image encoder\n");
 	vchiq_mmal_component_finalise(
 		dev->instance,
-		dev->component[MMAL_COMPONENT_IMAGE_ENCODE]);
+		dev->component[COMP_IMAGE_ENCODE]);
 
 unreg_preview:
 	pr_err("Cleanup: Destroy video render\n");
 	vchiq_mmal_component_finalise(dev->instance,
-				      dev->component[MMAL_COMPONENT_PREVIEW]);
+				      dev->component[COMP_PREVIEW]);
 
 unreg_camera:
 	pr_err("Cleanup: Destroy camera\n");
 	vchiq_mmal_component_finalise(dev->instance,
-				      dev->component[MMAL_COMPONENT_CAMERA]);
+				      dev->component[COMP_CAMERA]);
 
 unreg_mmal:
 	vchiq_mmal_finalise(dev->instance);
@@ -1831,21 +1830,21 @@ static void bcm2835_cleanup_instance(struct bm2835_mmal_dev *dev)
 					     dev->capture.encode_component);
 	}
 	vchiq_mmal_component_disable(dev->instance,
-				     dev->component[MMAL_COMPONENT_CAMERA]);
+				     dev->component[COMP_CAMERA]);
 
 	vchiq_mmal_component_finalise(dev->instance,
 				      dev->
-				      component[MMAL_COMPONENT_VIDEO_ENCODE]);
+				      component[COMP_VIDEO_ENCODE]);
 
 	vchiq_mmal_component_finalise(dev->instance,
 				      dev->
-				      component[MMAL_COMPONENT_IMAGE_ENCODE]);
+				      component[COMP_IMAGE_ENCODE]);
 
 	vchiq_mmal_component_finalise(dev->instance,
-				      dev->component[MMAL_COMPONENT_PREVIEW]);
+				      dev->component[COMP_PREVIEW]);
 
 	vchiq_mmal_component_finalise(dev->instance,
-				      dev->component[MMAL_COMPONENT_CAMERA]);
+				      dev->component[COMP_CAMERA]);
 
 	v4l2_ctrl_handler_free(&dev->ctrl_handler);
 
diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
index 9833828daf197..b8a466e24c93b 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
@@ -16,18 +16,18 @@
 #define V4L2_CTRL_COUNT 29 /* number of v4l controls */
 
 enum {
-	MMAL_COMPONENT_CAMERA = 0,
-	MMAL_COMPONENT_PREVIEW,
-	MMAL_COMPONENT_IMAGE_ENCODE,
-	MMAL_COMPONENT_VIDEO_ENCODE,
-	MMAL_COMPONENT_COUNT
+	COMP_CAMERA = 0,
+	COMP_PREVIEW,
+	COMP_IMAGE_ENCODE,
+	COMP_VIDEO_ENCODE,
+	COMP_COUNT
 };
 
 enum {
-	MMAL_CAMERA_PORT_PREVIEW = 0,
-	MMAL_CAMERA_PORT_VIDEO,
-	MMAL_CAMERA_PORT_CAPTURE,
-	MMAL_CAMERA_PORT_COUNT
+	CAM_PORT_PREVIEW = 0,
+	CAM_PORT_VIDEO,
+	CAM_PORT_CAPTURE,
+	CAM_PORT_COUNT
 };
 
 #define PREVIEW_LAYER      2
@@ -61,7 +61,7 @@ struct bm2835_mmal_dev {
 
 	/* allocated mmal instance and components */
 	struct vchiq_mmal_instance   *instance;
-	struct vchiq_mmal_component  *component[MMAL_COMPONENT_COUNT];
+	struct vchiq_mmal_component  *component[COMP_COUNT];
 	int camera_use_count;
 
 	struct v4l2_window overlay;
diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 402c35ec12703..f24a151b15582 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -176,7 +176,7 @@ static int ctrl_set_rational(struct bm2835_mmal_dev *dev,
 	struct mmal_parameter_rational rational_value;
 	struct vchiq_mmal_port *control;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	rational_value.num = ctrl->val;
 	rational_value.den = 100;
@@ -194,7 +194,7 @@ static int ctrl_set_value(struct bm2835_mmal_dev *dev,
 	u32 u32_value;
 	struct vchiq_mmal_port *control;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	u32_value = ctrl->val;
 
@@ -219,7 +219,7 @@ static int ctrl_set_iso(struct bm2835_mmal_dev *dev,
 		dev->manual_iso_enabled =
 				(ctrl->val == V4L2_ISO_SENSITIVITY_MANUAL);
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	if (dev->manual_iso_enabled)
 		u32_value = dev->iso;
@@ -238,7 +238,7 @@ static int ctrl_set_value_ev(struct bm2835_mmal_dev *dev,
 	s32 s32_value;
 	struct vchiq_mmal_port *control;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	s32_value = (ctrl->val - 12) * 2;	/* Convert from index to 1/6ths */
 
@@ -255,7 +255,7 @@ static int ctrl_set_rotate(struct bm2835_mmal_dev *dev,
 	u32 u32_value;
 	struct vchiq_mmal_component *camera;
 
-	camera = dev->component[MMAL_COMPONENT_CAMERA];
+	camera = dev->component[COMP_CAMERA];
 
 	u32_value = ((ctrl->val % 360) / 90) * 90;
 
@@ -291,7 +291,7 @@ static int ctrl_set_flip(struct bm2835_mmal_dev *dev,
 	else
 		dev->vflip = ctrl->val;
 
-	camera = dev->component[MMAL_COMPONENT_CAMERA];
+	camera = dev->component[COMP_CAMERA];
 
 	if (dev->hflip && dev->vflip)
 		u32_value = MMAL_PARAM_MIRROR_BOTH;
@@ -330,7 +330,7 @@ static int ctrl_set_exposure(struct bm2835_mmal_dev *dev,
 	struct vchiq_mmal_port *control;
 	int ret = 0;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	if (mmal_ctrl->mmal_id == MMAL_PARAMETER_SHUTTER_SPEED)	{
 		/* V4L2 is in 100usec increments.
@@ -405,7 +405,7 @@ static int ctrl_set_metering_mode(struct bm2835_mmal_dev *dev,
 		struct vchiq_mmal_port *control;
 		u32 u32_value = dev->metering_mode;
 
-		control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+		control = &dev->component[COMP_CAMERA]->control;
 
 		return vchiq_mmal_port_parameter_set(dev->instance, control,
 					     mmal_ctrl->mmal_id,
@@ -421,7 +421,7 @@ static int ctrl_set_flicker_avoidance(struct bm2835_mmal_dev *dev,
 	u32 u32_value;
 	struct vchiq_mmal_port *control;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	switch (ctrl->val) {
 	case V4L2_CID_POWER_LINE_FREQUENCY_DISABLED:
@@ -450,7 +450,7 @@ static int ctrl_set_awb_mode(struct bm2835_mmal_dev *dev,
 	u32 u32_value;
 	struct vchiq_mmal_port *control;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	switch (ctrl->val) {
 	case V4L2_WHITE_BALANCE_MANUAL:
@@ -506,7 +506,7 @@ static int ctrl_set_awb_gains(struct bm2835_mmal_dev *dev,
 	struct vchiq_mmal_port *control;
 	struct mmal_parameter_awbgains gains;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	if (ctrl->id == V4L2_CID_RED_BALANCE)
 		dev->red_gain = ctrl->val;
@@ -554,7 +554,7 @@ static int ctrl_set_image_effect(struct bm2835_mmal_dev *dev,
 					v4l2_to_mmal_effects_values[i].v;
 			}
 
-			control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+			control = &dev->component[COMP_CAMERA]->control;
 
 			ret = vchiq_mmal_port_parameter_set(
 					dev->instance, control,
@@ -587,7 +587,7 @@ static int ctrl_set_colfx(struct bm2835_mmal_dev *dev,
 	int ret = -EINVAL;
 	struct vchiq_mmal_port *control;
 
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	dev->colourfx.enable = (ctrl->val & 0xff00) >> 8;
 	dev->colourfx.enable = ctrl->val & 0xff;
@@ -613,7 +613,7 @@ static int ctrl_set_bitrate(struct bm2835_mmal_dev *dev,
 
 	dev->capture.encode_bitrate = ctrl->val;
 
-	encoder_out = &dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->output[0];
+	encoder_out = &dev->component[COMP_VIDEO_ENCODE]->output[0];
 
 	ret = vchiq_mmal_port_parameter_set(dev->instance, encoder_out,
 					    mmal_ctrl->mmal_id,
@@ -629,7 +629,7 @@ static int ctrl_set_bitrate_mode(struct bm2835_mmal_dev *dev,
 	u32 bitrate_mode;
 	struct vchiq_mmal_port *encoder_out;
 
-	encoder_out = &dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->output[0];
+	encoder_out = &dev->component[COMP_VIDEO_ENCODE]->output[0];
 
 	dev->capture.encode_bitrate_mode = ctrl->val;
 	switch (ctrl->val) {
@@ -656,7 +656,7 @@ static int ctrl_set_image_encode_output(struct bm2835_mmal_dev *dev,
 	u32 u32_value;
 	struct vchiq_mmal_port *jpeg_out;
 
-	jpeg_out = &dev->component[MMAL_COMPONENT_IMAGE_ENCODE]->output[0];
+	jpeg_out = &dev->component[COMP_IMAGE_ENCODE]->output[0];
 
 	u32_value = ctrl->val;
 
@@ -672,7 +672,7 @@ static int ctrl_set_video_encode_param_output(struct bm2835_mmal_dev *dev,
 	u32 u32_value;
 	struct vchiq_mmal_port *vid_enc_ctl;
 
-	vid_enc_ctl = &dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->output[0];
+	vid_enc_ctl = &dev->component[COMP_VIDEO_ENCODE]->output[0];
 
 	u32_value = ctrl->val;
 
@@ -785,7 +785,7 @@ static int ctrl_set_video_encode_profile_level(struct bm2835_mmal_dev *dev,
 		}
 
 		ret = vchiq_mmal_port_parameter_set(dev->instance,
-						    &dev->component[MMAL_COMPONENT_VIDEO_ENCODE]->output[0],
+						    &dev->component[COMP_VIDEO_ENCODE]->output[0],
 			mmal_ctrl->mmal_id,
 			&param, sizeof(param));
 	}
@@ -803,7 +803,7 @@ static int ctrl_set_scene_mode(struct bm2835_mmal_dev *dev,
 	v4l2_dbg(0, bcm2835_v4l2_debug, &dev->v4l2_dev,
 		 "scene mode selected %d, was %d\n", ctrl->val,
 		 dev->scene_mode);
-	control = &dev->component[MMAL_COMPONENT_CAMERA]->control;
+	control = &dev->component[COMP_CAMERA]->control;
 
 	if (ctrl->val == dev->scene_mode)
 		return 0;
@@ -1221,18 +1221,15 @@ int set_framerate_params(struct bm2835_mmal_dev *dev)
 		 fps_range.fps_high.den);
 
 	ret = vchiq_mmal_port_parameter_set(dev->instance,
-					    &dev->component[MMAL_COMPONENT_CAMERA]->
-					    output[MMAL_CAMERA_PORT_PREVIEW],
+					    &dev->component[COMP_CAMERA]->output[CAM_PORT_PREVIEW],
 					    MMAL_PARAMETER_FPS_RANGE,
 					    &fps_range, sizeof(fps_range));
 	ret += vchiq_mmal_port_parameter_set(dev->instance,
-					     &dev->component[MMAL_COMPONENT_CAMERA]->
-					     output[MMAL_CAMERA_PORT_VIDEO],
+					     &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO],
 					     MMAL_PARAMETER_FPS_RANGE,
 					     &fps_range, sizeof(fps_range));
 	ret += vchiq_mmal_port_parameter_set(dev->instance,
-					     &dev->component[MMAL_COMPONENT_CAMERA]->
-					     output[MMAL_CAMERA_PORT_CAPTURE],
+					     &dev->component[COMP_CAMERA]->output[CAM_PORT_CAPTURE],
 					     MMAL_PARAMETER_FPS_RANGE,
 					     &fps_range, sizeof(fps_range));
 	if (ret)
-- 
GitLab


From 65ab2a7d2b991ec1ccc3fa657980656e900fdf97 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 15:28:07 +0000
Subject: [PATCH 0247/1835] staging: bcm2835-camera: Fix multiple line
 dereference errors

Fix checkpatch errors "Avoid multiple line dereference"

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 41 +++++++------------
 1 file changed, 14 insertions(+), 27 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 39086c6e26b14..05b7201bbd5fe 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -313,8 +313,7 @@ static void buffer_cleanup(struct vb2_buffer *vb)
 static inline bool is_capturing(struct bm2835_mmal_dev *dev)
 {
 	return dev->capture.camera_port ==
-	    &dev->
-	    component[COMP_CAMERA]->output[CAM_PORT_CAPTURE];
+	    &dev->component[COMP_CAMERA]->output[CAM_PORT_CAPTURE];
 }
 
 static void buffer_cb(struct vchiq_mmal_instance *instance,
@@ -782,8 +781,7 @@ static int vidioc_overlay(struct file *file, void *f, unsigned int on)
 		return 0;	/* already in requested state */
 
 	src =
-	    &dev->component[COMP_CAMERA]->
-	    output[CAM_PORT_PREVIEW];
+	    &dev->component[COMP_CAMERA]->output[CAM_PORT_PREVIEW];
 
 	if (!on) {
 		/* disconnect preview ports and disable component */
@@ -840,8 +838,7 @@ static int vidioc_g_fbuf(struct file *file, void *fh,
 	 */
 	struct bm2835_mmal_dev *dev = video_drvdata(file);
 	struct vchiq_mmal_port *preview_port =
-		&dev->component[COMP_CAMERA]->
-		output[CAM_PORT_PREVIEW];
+		&dev->component[COMP_CAMERA]->output[CAM_PORT_PREVIEW];
 
 	a->capability = V4L2_FBUF_CAP_EXTERNOVERLAY |
 			V4L2_FBUF_CAP_GLOBAL_ALPHA;
@@ -1033,8 +1030,7 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 					       dev->capture.camera_port, NULL);
 		dev->capture.camera_port = NULL;
 		ret = vchiq_mmal_component_disable(dev->instance,
-						   dev->capture.
-						   encode_component);
+						   dev->capture.encode_component);
 		if (ret)
 			v4l2_err(&dev->v4l2_dev,
 				 "Failed to disable encode component %d\n",
@@ -1049,26 +1045,22 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 		if (f->fmt.pix.width <= max_video_width
 		    && f->fmt.pix.height <= max_video_height)
 			camera_port = port =
-			    &dev->component[COMP_CAMERA]->
-			    output[CAM_PORT_VIDEO];
+			    &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO];
 		else
 			camera_port = port =
-			    &dev->component[COMP_CAMERA]->
-			    output[CAM_PORT_CAPTURE];
+			    &dev->component[COMP_CAMERA]->output[CAM_PORT_CAPTURE];
 		break;
 	case COMP_IMAGE_ENCODE:
 		encode_component = dev->component[COMP_IMAGE_ENCODE];
 		port = &dev->component[COMP_IMAGE_ENCODE]->output[0];
 		camera_port =
-		    &dev->component[COMP_CAMERA]->
-		    output[CAM_PORT_CAPTURE];
+		    &dev->component[COMP_CAMERA]->output[CAM_PORT_CAPTURE];
 		break;
 	case COMP_VIDEO_ENCODE:
 		encode_component = dev->component[COMP_VIDEO_ENCODE];
 		port = &dev->component[COMP_VIDEO_ENCODE]->output[0];
 		camera_port =
-		    &dev->component[COMP_CAMERA]->
-		    output[CAM_PORT_VIDEO];
+		    &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO];
 		break;
 	default:
 		break;
@@ -1110,8 +1102,7 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 
 	if (!ret
 	    && camera_port ==
-	    &dev->component[COMP_CAMERA]->
-	    output[CAM_PORT_VIDEO]) {
+	    &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO]) {
 		bool overlay_enabled =
 		    !!dev->component[COMP_PREVIEW]->enabled;
 		struct vchiq_mmal_port *preview_port =
@@ -1248,9 +1239,8 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 						 port->current_buffer.size);
 					port->current_buffer.size =
 					    (f->fmt.pix.sizeimage <
-					     (100 << 10))
-					    ? (100 << 10)
-					    : f->fmt.pix.sizeimage;
+					     (100 << 10)) ?
+					    (100 << 10) : f->fmt.pix.sizeimage;
 				}
 				v4l2_dbg(1, bcm2835_v4l2_debug,
 					 &dev->v4l2_dev,
@@ -1709,8 +1699,7 @@ static int mmal_init(struct bm2835_mmal_dev *dev)
 
 	/* get the video encoder component ready */
 	ret = vchiq_mmal_component_init(dev->instance, "ril.video_encode",
-					&dev->
-					component[COMP_VIDEO_ENCODE]);
+					&dev->component[COMP_VIDEO_ENCODE]);
 	if (ret < 0)
 		goto unreg_image_encoder;
 
@@ -1833,12 +1822,10 @@ static void bcm2835_cleanup_instance(struct bm2835_mmal_dev *dev)
 				     dev->component[COMP_CAMERA]);
 
 	vchiq_mmal_component_finalise(dev->instance,
-				      dev->
-				      component[COMP_VIDEO_ENCODE]);
+				      dev->component[COMP_VIDEO_ENCODE]);
 
 	vchiq_mmal_component_finalise(dev->instance,
-				      dev->
-				      component[COMP_IMAGE_ENCODE]);
+				      dev->component[COMP_IMAGE_ENCODE]);
 
 	vchiq_mmal_component_finalise(dev->instance,
 				      dev->component[COMP_PREVIEW]);
-- 
GitLab


From 955113b068eaa7f3d6b628e166a529d4dd37bc72 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 15:37:11 +0000
Subject: [PATCH 0248/1835] staging: bcm2835-camera: Fix brace style issues.

Fix mismatched or missing brace issues flagged by checkpatch.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 3 ++-
 drivers/staging/vc04_services/bcm2835-camera/controls.c       | 3 ++-
 drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c     | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 05b7201bbd5fe..cf14a1718897a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -566,10 +566,11 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 
 		/* Flag to indicate just to rely on kernel timestamps */
 		dev->capture.vc_start_timestamp = -1;
-	} else
+	} else {
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 			 "Start time %lld size %d\n",
 			 dev->capture.vc_start_timestamp, parameter_size);
+	}
 
 	dev->capture.kernel_start_ts = ktime_get();
 	dev->capture.last_timestamp = 0;
diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index f24a151b15582..3fc454ce696e4 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -410,8 +410,9 @@ static int ctrl_set_metering_mode(struct bm2835_mmal_dev *dev,
 		return vchiq_mmal_port_parameter_set(dev->instance, control,
 					     mmal_ctrl->mmal_id,
 					     &u32_value, sizeof(u32_value));
-	} else
+	} else {
 		return 0;
+	}
 }
 
 static int ctrl_set_flicker_avoidance(struct bm2835_mmal_dev *dev,
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 3cb515bbe9b36..d821d2dfb95f5 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -1262,9 +1262,10 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
 		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
 		       *value_size);
 		*value_size = rmsg->u.port_parameter_get_reply.size;
-	} else
+	} else {
 		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
 		       rmsg->u.port_parameter_get_reply.size);
+	}
 
 	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
 		 ret, port->component->handle, port->handle, parameter_id);
-- 
GitLab


From 809c9e9e8bf4be141b57c065c1e3c119f1f9101c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 15:39:26 +0000
Subject: [PATCH 0249/1835] staging: bcm2835-camera: Fix missing lines between
 items

Fix checkpatch errors for missing blank lines after variable
or structure declarations.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h | 1 +
 drivers/staging/vc04_services/bcm2835-camera/controls.c       | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
index b8a466e24c93b..bbfe8fe1e9ce6 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
@@ -130,6 +130,7 @@ int set_framerate_params(struct bm2835_mmal_dev *dev);
 		(pix_fmt)->pixelformat, (pix_fmt)->bytesperline,	\
 		(pix_fmt)->sizeimage, (pix_fmt)->colorspace, (pix_fmt)->priv); \
 }
+
 #define v4l2_dump_win_format(level, debug, dev, win_fmt, desc)	\
 {	\
 	v4l2_dbg(level, debug, dev,	\
diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 3fc454ce696e4..262acc2b27116 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -53,6 +53,7 @@ static const s64 ev_bias_qmenu[] = {
 static const s64 iso_qmenu[] = {
 	0, 100000, 200000, 400000, 800000,
 };
+
 static const uint32_t iso_values[] = {
 	0, 100, 200, 400, 800,
 };
-- 
GitLab


From 99a1776bc32bad69f7ad95359902971ee1c88647 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 15:48:54 +0000
Subject: [PATCH 0250/1835] staging: bcm2835-camera: Fix logical continuation
 splits

Fix checkpatch errors for "Logical continuations should be
on the previous line".

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-camera/bcm2835-camera.c    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index cf14a1718897a..7a587f428f817 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -542,8 +542,8 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 		msleep(300);
 
 	/* enable the connection from camera to encoder (if applicable) */
-	if (dev->capture.camera_port != dev->capture.port
-	    && dev->capture.camera_port) {
+	if (dev->capture.camera_port != dev->capture.port &&
+	    dev->capture.camera_port) {
 		ret = vchiq_mmal_port_enable(dev->instance,
 					     dev->capture.camera_port, NULL);
 		if (ret) {
@@ -1043,8 +1043,8 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 	switch (mfmt->mmal_component) {
 	case COMP_CAMERA:
 		/* Make a further decision on port based on resolution */
-		if (f->fmt.pix.width <= max_video_width
-		    && f->fmt.pix.height <= max_video_height)
+		if (f->fmt.pix.width <= max_video_width &&
+		    f->fmt.pix.height <= max_video_height)
 			camera_port = port =
 			    &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO];
 		else
@@ -1101,8 +1101,8 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 
 	ret = vchiq_mmal_port_set_format(dev->instance, camera_port);
 
-	if (!ret
-	    && camera_port ==
+	if (!ret &&
+	    camera_port ==
 	    &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO]) {
 		bool overlay_enabled =
 		    !!dev->component[COMP_PREVIEW]->enabled;
-- 
GitLab


From 133973f5e6a20eb66433a93fb81f160d90ce653c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 21 Feb 2018 15:53:59 +0000
Subject: [PATCH 0251/1835] staging: bcm2835-camera: Fix open parenthesis
 alignment

Fix checkpatch "Alignment should match open parenthesis"
errors.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 12 ++++-----
 .../vc04_services/bcm2835-camera/controls.c   | 25 ++++++++++++-------
 .../vc04_services/bcm2835-camera/mmal-vchiq.c |  2 +-
 .../vc04_services/bcm2835-camera/mmal-vchiq.h |  6 ++---
 4 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 7a587f428f817..ec803fa43bdfe 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -412,8 +412,7 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 		buf->vb.flags |= V4L2_BUF_FLAG_KEYFRAME;
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-		 "Buffer has ts %llu",
-		 dev->capture.last_timestamp);
+		 "Buffer has ts %llu", dev->capture.last_timestamp);
 	vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
 
 	if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
@@ -581,8 +580,8 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 	    vchiq_mmal_port_enable(dev->instance, dev->capture.port, buffer_cb);
 	if (ret) {
 		v4l2_err(&dev->v4l2_dev,
-			"Failed to enable capture port - error %d. Disabling camera port again\n",
-			ret);
+			 "Failed to enable capture port - error %d. Disabling camera port again\n",
+			 ret);
 
 		vchiq_mmal_port_disable(dev->instance,
 					dev->capture.camera_port);
@@ -978,8 +977,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 		f->fmt.pix.bytesperline =
 			(f->fmt.pix.bytesperline + align_mask) & ~align_mask;
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-			 "Not removing padding, so bytes/line = %d, "
-			 "(align_mask %d)\n",
+			 "Not removing padding, so bytes/line = %d, (align_mask %d)\n",
 			 f->fmt.pix.bytesperline, align_mask);
 	}
 
@@ -1325,7 +1323,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
 }
 
 static int vidioc_enum_framesizes(struct file *file, void *fh,
-			   struct v4l2_frmsizeenum *fsize)
+				  struct v4l2_frmsizeenum *fsize)
 {
 	struct bm2835_mmal_dev *dev = video_drvdata(file);
 	static const struct v4l2_frmsize_stepwise sizes = {
diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 262acc2b27116..8f23a7d3119c9 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -1254,9 +1254,12 @@ int bm2835_mmal_init_controls(struct bm2835_mmal_dev *dev,
 
 		switch (ctrl->type) {
 		case MMAL_CONTROL_TYPE_STD:
-			dev->ctrls[c] = v4l2_ctrl_new_std(hdl,
-				&bm2835_mmal_ctrl_ops, ctrl->id,
-				ctrl->min, ctrl->max, ctrl->step, ctrl->def);
+			dev->ctrls[c] =
+				v4l2_ctrl_new_std(hdl,
+						  &bm2835_mmal_ctrl_ops,
+						  ctrl->id, ctrl->min,
+						  ctrl->max, ctrl->step,
+						  ctrl->def);
 			break;
 
 		case MMAL_CONTROL_TYPE_STD_MENU:
@@ -1280,16 +1283,20 @@ int bm2835_mmal_init_controls(struct bm2835_mmal_dev *dev,
 				mask = ~mask;
 			}
 
-			dev->ctrls[c] = v4l2_ctrl_new_std_menu(hdl,
-			&bm2835_mmal_ctrl_ops, ctrl->id,
-			ctrl->max, mask, ctrl->def);
+			dev->ctrls[c] =
+				v4l2_ctrl_new_std_menu(hdl,
+						       &bm2835_mmal_ctrl_ops,
+						       ctrl->id, ctrl->max,
+						       mask, ctrl->def);
 			break;
 		}
 
 		case MMAL_CONTROL_TYPE_INT_MENU:
-			dev->ctrls[c] = v4l2_ctrl_new_int_menu(hdl,
-				&bm2835_mmal_ctrl_ops, ctrl->id,
-				ctrl->max, ctrl->def, ctrl->imenu);
+			dev->ctrls[c] =
+				v4l2_ctrl_new_int_menu(hdl,
+						       &bm2835_mmal_ctrl_ops,
+						       ctrl->id, ctrl->max,
+						       ctrl->def, ctrl->imenu);
 			break;
 
 		case MMAL_CONTROL_TYPE_CLUSTER:
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index d821d2dfb95f5..8f804cb11a3e5 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -645,7 +645,7 @@ static int send_synchronous_mmal_msg(struct vchiq_mmal_instance *instance,
 	if (payload_len >
 	    (MMAL_MSG_MAX_SIZE - sizeof(struct mmal_msg_header))) {
 		pr_err("payload length %d exceeds max:%d\n", payload_len,
-		      (int)(MMAL_MSG_MAX_SIZE -
+		       (int)(MMAL_MSG_MAX_SIZE -
 			    sizeof(struct mmal_msg_header)));
 		return -EINVAL;
 	}
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
index 0e5a81bc03e98..3498555d5828f 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
@@ -128,7 +128,7 @@ int vchiq_mmal_port_enable(
  * disable a port will dequeue any pending buffers
  */
 int vchiq_mmal_port_disable(struct vchiq_mmal_instance *instance,
-			   struct vchiq_mmal_port *port);
+			    struct vchiq_mmal_port *port);
 
 int vchiq_mmal_port_parameter_set(struct vchiq_mmal_instance *instance,
 				  struct vchiq_mmal_port *port,
@@ -146,8 +146,8 @@ int vchiq_mmal_port_set_format(struct vchiq_mmal_instance *instance,
 			       struct vchiq_mmal_port *port);
 
 int vchiq_mmal_port_connect_tunnel(struct vchiq_mmal_instance *instance,
-			    struct vchiq_mmal_port *src,
-			    struct vchiq_mmal_port *dst);
+				   struct vchiq_mmal_port *src,
+				   struct vchiq_mmal_port *dst);
 
 int vchiq_mmal_version(struct vchiq_mmal_instance *instance,
 		       u32 *major_out,
-- 
GitLab


From e59fc3ed91caecd4f36b67ea681954a513d6127b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 28 Jun 2018 15:57:25 +0100
Subject: [PATCH 0252/1835] staging: bcm2835_camera: Ensure all buffers are
 returned on disable

With the recent change to match MMAL and V4L2 buffers there
is a need to wait for all MMAL buffers to be returned during
stop_streaming.

Fixes: 9384167 "staging: bcm2835-camera: Remove V4L2/MMAL buffer remapping"
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 22 ++++++++++++++-----
 .../vc04_services/bcm2835-camera/mmal-vchiq.c |  4 ++++
 .../vc04_services/bcm2835-camera/mmal-vchiq.h |  3 +++
 3 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index ec803fa43bdfe..555d77e75975d 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -607,6 +607,7 @@ static void stop_streaming(struct vb2_queue *vq)
 	int ret;
 	unsigned long timeout;
 	struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vq);
+	struct vchiq_mmal_port *port = dev->capture.port;
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p\n",
 		 __func__, dev);
@@ -630,12 +631,6 @@ static void stop_streaming(struct vb2_queue *vq)
 				      &dev->capture.frame_count,
 				      sizeof(dev->capture.frame_count));
 
-	/* wait for last frame to complete */
-	timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ);
-	if (timeout == 0)
-		v4l2_err(&dev->v4l2_dev,
-			 "timed out waiting for frame completion\n");
-
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 		 "disabling connection\n");
 
@@ -650,6 +645,21 @@ static void stop_streaming(struct vb2_queue *vq)
 			 ret);
 	}
 
+	/* wait for all buffers to be returned */
+	while (atomic_read(&port->buffers_with_vpu)) {
+		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+			 "%s: Waiting for buffers to be returned - %d outstanding\n",
+			 __func__, atomic_read(&port->buffers_with_vpu));
+		timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt,
+						      HZ);
+		if (timeout == 0) {
+			v4l2_err(&dev->v4l2_dev, "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
+				 __func__,
+				 atomic_read(&port->buffers_with_vpu));
+			break;
+		}
+	}
+
 	if (disable_camera(dev) < 0)
 		v4l2_err(&dev->v4l2_dev, "Failed to disable camera\n");
 }
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 8f804cb11a3e5..6c643cbde0fc3 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -246,6 +246,8 @@ static void buffer_work_cb(struct work_struct *work)
 	struct mmal_msg_context *msg_context =
 		container_of(work, struct mmal_msg_context, u.bulk.work);
 
+	atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
+
 	msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
 					    msg_context->u.bulk.port,
 					    msg_context->u.bulk.status,
@@ -389,6 +391,8 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 	INIT_WORK(&msg_context->u.bulk.buffer_to_host_work,
 		  buffer_to_host_work_cb);
 
+	atomic_inc(&port->buffers_with_vpu);
+
 	/* prep the buffer from host message */
 	memset(&m, 0xbc, sizeof(m));	/* just to make debug clearer */
 
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
index 3498555d5828f..1750ff06164d7 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
@@ -72,6 +72,9 @@ struct vchiq_mmal_port {
 	struct list_head buffers;
 	/* lock to serialise adding and removing buffers from list */
 	spinlock_t slock;
+
+	/* Count of buffers the VPU has yet to return */
+	atomic_t buffers_with_vpu;
 	/* callback on buffer completion */
 	vchiq_mmal_buffer_cb buffer_cb;
 	/* callback context */
-- 
GitLab


From ed3c889ca3676f6d100c88598f337a3601cb893d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 4 Jul 2018 17:01:15 +0100
Subject: [PATCH 0253/1835] staging: bcm2835-camera: Remove check of the number
 of buffers supplied

Before 9384167 there was a need to ensure that there were sufficient
buffers supplied from the user to cover those being sent to the VPU
(always 1).
With 9384167 the buffers are linked 1:1 between MMAL and V4L2,
therefore there is no need for that check, and indeed it is wrong
as there is no need to submit all the buffers before starting streaming.

Fixes: 9384167 "staging: bcm2835-camera: Remove V4L2/MMAL buffer remapping"

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-camera/mmal-vchiq.c  | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 6c643cbde0fc3..9a0c25b68ac2b 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -1338,16 +1338,6 @@ static int port_enable(struct vchiq_mmal_instance *instance,
 	if (port->enabled)
 		return 0;
 
-	/* ensure there are enough buffers queued to cover the buffer headers */
-	if (port->buffer_cb) {
-		hdr_count = 0;
-		list_for_each(buf_head, &port->buffers) {
-			hdr_count++;
-		}
-		if (hdr_count < port->current_buffer.num)
-			return -ENOSPC;
-	}
-
 	ret = port_action_port(instance, port,
 			       MMAL_MSG_PORT_ACTION_TYPE_ENABLE);
 	if (ret)
-- 
GitLab


From 7c5f86c2a87d7d608b4300e8818626ee1323ce4e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 5 Jul 2018 16:17:03 +0100
Subject: [PATCH 0254/1835] staging: bcm2835-camera: Handle empty EOS buffers
 whilst streaming

The change to mapping V4L2 to MMAL buffers 1:1 didn't handle
the condition we get with raw pixel buffers (eg YUV and RGB)
direct from the camera's stills port. That sends the pixel buffer
and then an empty buffer with the EOS flag set. The EOS buffer
wasn't handled and returned an error up the stack.

Handle the condition correctly by returning it to the component
if streaming, or returning with an error if stopping streaming.

Fixes: 9384167 "staging: bcm2835-camera: Remove V4L2/MMAL buffer remapping"

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 21 +++++++++++--------
 .../vc04_services/bcm2835-camera/mmal-vchiq.c |  5 +++--
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 555d77e75975d..d7bbed06c94e6 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -339,16 +339,13 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 
 	if (length == 0) {
 		/* stream ended */
-		if (buf) {
-			/* this should only ever happen if the port is
-			 * disabled and there are buffers still queued
+		if (dev->capture.frame_count) {
+			/* empty buffer whilst capturing - expected to be an
+			 * EOS, so grab another frame
 			 */
-			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
-			pr_debug("Empty buffer");
-		} else if (dev->capture.frame_count) {
-			/* grab another frame */
 			if (is_capturing(dev)) {
-				pr_debug("Grab another frame");
+				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+					 "Grab another frame");
 				vchiq_mmal_port_parameter_set(
 					instance,
 					dev->capture.camera_port,
@@ -356,8 +353,14 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 					&dev->capture.frame_count,
 					sizeof(dev->capture.frame_count));
 			}
+			if (vchiq_mmal_submit_buffer(instance, port, buf))
+				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+					 "Failed to return EOS buffer");
 		} else {
-			/* signal frame completion */
+			/* stopping streaming.
+			 * return buffer, and signal frame completion
+			 */
+			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
 			complete(&dev->capture.frame_cmplt);
 		}
 		return;
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 9a0c25b68ac2b..4c016f93177b9 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -332,8 +332,6 @@ static int bulk_receive(struct vchiq_mmal_instance *instance,
 
 	/* store length */
 	msg_context->u.bulk.buffer_used = rd_len;
-	msg_context->u.bulk.mmal_flags =
-	    msg->u.buffer_from_host.buffer_header.flags;
 	msg_context->u.bulk.dts = msg->u.buffer_from_host.buffer_header.dts;
 	msg_context->u.bulk.pts = msg->u.buffer_from_host.buffer_header.pts;
 
@@ -461,6 +459,9 @@ static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
 		return;
 	}
 
+	msg_context->u.bulk.mmal_flags =
+				msg->u.buffer_from_host.buffer_header.flags;
+
 	if (msg->h.status != MMAL_MSG_STATUS_SUCCESS) {
 		/* message reception had an error */
 		pr_warn("error %d in reply\n", msg->h.status);
-- 
GitLab


From b786a1875b2f21939a91a428b76e12d43c35e56f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 21 Jun 2018 17:02:14 +0100
Subject: [PATCH 0255/1835] staging: bcm2835-camera: Set sequence number
 correctly

Set the sequence number in vb2_v4l2_buffer mainly so the
latest v4l2-ctl reports the frame rate correctly.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 4 ++++
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index d7bbed06c94e6..224291a1e9970 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -409,6 +409,7 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 		}
 	}
 	dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
+	buf->vb.sequence = dev->capture.sequence++;
 
 	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
 	if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
@@ -537,6 +538,9 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 	/* enable frame capture */
 	dev->capture.frame_count = 1;
 
+	/* reset sequence number */
+	dev->capture.sequence = 0;
+
 	/* if the preview is not already running, wait for a few frames for AGC
 	 * to settle down.
 	 */
diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
index bbfe8fe1e9ce6..c821513785dfd 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
@@ -93,6 +93,8 @@ struct bm2835_mmal_dev {
 		ktime_t kernel_start_ts;
 		/* Timestamp of last frame */
 		u64		last_timestamp;
+		/* Sequence number of last buffer */
+		u32		sequence;
 
 		struct vchiq_mmal_port  *port; /* port being used for capture */
 		/* camera port being used for capture */
-- 
GitLab


From 2018f072771eaec4b38fbc4103f08de06d8fb7b6 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 24 Jul 2018 12:08:29 +0100
Subject: [PATCH 0256/1835] staging: bcm2835-camera: Ensure timestamps never go
 backwards.

There is an awkward situation with H264 header bytes. Currently
they are returned with a PTS of 0 because they aren't associated
with a timestamped frame to encode. These are handled by either
returning the timestamp of the last buffer to have been received,
or in the case of the first buffer the timestamp taken at
start_streaming.
This results in a race where the current frame may have started
before we take the start time, which results in the first encoded
frame having an earlier timestamp than the header bytes.

Ensure that we never return a negative delta to the user by checking
against the previous timestamp.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-camera/bcm2835-camera.c    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 224291a1e9970..f1fb11969a618 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -393,6 +393,11 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 			 ktime_to_ns(dev->capture.kernel_start_ts),
 			 dev->capture.vc_start_timestamp, pts,
 			 ktime_to_ns(timestamp));
+		if (timestamp < dev->capture.last_timestamp) {
+			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+				 "Negative delta - using last time\n");
+			timestamp = dev->capture.last_timestamp;
+		}
 		buf->vb.vb2_buf.timestamp = ktime_to_ns(timestamp);
 	} else {
 		if (dev->capture.last_timestamp) {
-- 
GitLab


From 014b0b4113541a0ce0a6277e4a177e3df842fff3 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Thu, 27 Sep 2018 17:50:39 -0700
Subject: [PATCH 0257/1835] staging: bcm2835-camera: Avoid unneeded internal
 declaration warning

Clang warns:

drivers/staging/vc04_services/bcm2835-camera/controls.c:59:18: warning:
variable 'mains_freq_qmenu' is not needed and will not be emitted
[-Wunneeded-internal-declaration]
static const s64 mains_freq_qmenu[] = {
                 ^
1 warning generated.

This is because mains_freq_qmenu is currently only used in an ARRAY_SIZE
macro, which is a compile time evaluation in this case. Avoid this by
adding mains_freq_qmenu as the imenu member of this structure, which
matches all other controls that uses the ARRAY_SIZE macro in v4l2_ctrls.
This turns out to be a no-op because V4L2_CID_MPEG_VIDEO_BITRATE_MODE is
defined as a MMAL_CONTROL_TYPE_STD_MENU, which does not pass the imenu
definition along to v4l2_ctrl_new in bm2835_mmal_init_controls.

Link: https://github.com/ClangBuiltLinux/linux/issues/122
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-camera/controls.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 8f23a7d3119c9..fb86e92faffab 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -1109,7 +1109,7 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	{
 		V4L2_CID_POWER_LINE_FREQUENCY, MMAL_CONTROL_TYPE_STD_MENU,
 		0, ARRAY_SIZE(mains_freq_qmenu) - 1,
-		1, 1, NULL,
+		1, 1, mains_freq_qmenu,
 		MMAL_PARAMETER_FLICKER_AVOID,
 		&ctrl_set_flicker_avoidance,
 		false
-- 
GitLab


From add38b68f8638b051fde40f754660fce2d051eab Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 16:21:06 +0100
Subject: [PATCH 0258/1835] staging: bcm2835-camera: Add multiple inclusion
 protection to headers

mmal-common.h and mmal-msg.h didn't have the normal
ifndef FOO / define FOO / endif protection to stop it being
included multiple times. Add it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/mmal-common.h | 3 +++
 drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h    | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
index 858bdcde6f3dd..6f56c517d850e 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
@@ -13,6 +13,8 @@
  * MMAL structures
  *
  */
+#ifndef MMAL_COMMON_H
+#define MMAL_COMMON_H
 
 #define MMAL_FOURCC(a, b, c, d) ((a) | (b << 8) | (c << 16) | (d << 24))
 #define MMAL_MAGIC MMAL_FOURCC('m', 'm', 'a', 'l')
@@ -56,3 +58,4 @@ struct mmal_colourfx {
 	u32 u;
 	u32 v;
 };
+#endif
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
index f7a0b865500e8..5a3e35f94aed2 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
@@ -23,6 +23,8 @@
  * implementation uses fixed size types and not the enums (though the
  * comments have the actual enum type
  */
+#ifndef MMAL_MSG_H
+#define MMAL_MSG_H
 
 #define VC_MMAL_VER 15
 #define VC_MMAL_MIN_VER 10
@@ -401,3 +403,4 @@ struct mmal_msg {
 		u8 payload[MMAL_MSG_MAX_PAYLOAD];
 	} u;
 };
+#endif
-- 
GitLab


From a744de275218c3dd5d89c16fb3b12df2037f52b7 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 3 Dec 2018 13:15:20 +0000
Subject: [PATCH 0259/1835] staging: bcm2835-camera: Unify header inclusion
 defines

Most of the headers use ifndef FOO_H, whilst mmal-parameters.h
used ifndef __FOO_H.

Revise mmal-parameters.h to drop the underscores and make the
headers all consistent.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-camera/mmal-parameters.h    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
index 6d21594ee384a..da21ec5e320c8 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
@@ -19,8 +19,8 @@
  * @{
  */
 
-#ifndef __MMAL_PARAMETERS_H
-#define __MMAL_PARAMETERS_H
+#ifndef MMAL_PARAMETERS_H
+#define MMAL_PARAMETERS_H
 
 /** Common parameter ID group, used with many types of component. */
 #define MMAL_PARAMETER_GROUP_COMMON            (0 << 16)
-- 
GitLab


From 2839ebc8e110381e92092b7257e0e7f7abfd1645 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 15:50:50 +0000
Subject: [PATCH 0260/1835] ARM: bcm2835_defconfig: Enable bcm2835-camera

Enables the V4L2 camera driver as a module.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2835_defconfig | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig
index e9bc88937b1e4..5a61367bb47c5 100644
--- a/arch/arm/configs/bcm2835_defconfig
+++ b/arch/arm/configs/bcm2835_defconfig
@@ -91,6 +91,8 @@ CONFIG_THERMAL=y
 CONFIG_BCM2835_THERMAL=y
 CONFIG_WATCHDOG=y
 CONFIG_BCM2835_WDT=y
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
 CONFIG_DRM=y
 CONFIG_DRM_VC4=y
 CONFIG_FB_SIMPLE=y
@@ -128,7 +130,8 @@ CONFIG_LEDS_TRIGGER_CAMERA=y
 CONFIG_DMADEVICES=y
 CONFIG_DMA_BCM2835=y
 CONFIG_STAGING=y
-CONFIG_BCM2835_VCHIQ=m
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 32093742224b5418569d6b8db5d34688788a51a2 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 15:55:42 +0000
Subject: [PATCH 0261/1835] staging: bcm2835-camera: Fix alignment should match
 open parenthesis

Fix up checkpatch "Alignment should match open parenthesis" errors

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index f1fb11969a618..44a4c36904aac 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1934,7 +1934,7 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 		ret = bm2835_mmal_init_controls(dev, &dev->ctrl_handler);
 		if (ret < 0) {
 			v4l2_err(&dev->v4l2_dev, "%s: could not init controls: %d\n",
-				__func__, ret);
+				 __func__, ret);
 			goto unreg_dev;
 		}
 		dev->v4l2_dev.ctrl_handler = &dev->ctrl_handler;
@@ -1944,7 +1944,7 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 		ret = mmal_init(dev);
 		if (ret < 0) {
 			v4l2_err(&dev->v4l2_dev, "%s: mmal init failed: %d\n",
-				__func__, ret);
+				 __func__, ret);
 			goto unreg_dev;
 		}
 		/* initialize queue */
@@ -1966,7 +1966,7 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 		ret = bm2835_mmal_init_device(dev, &dev->vdev);
 		if (ret < 0) {
 			v4l2_err(&dev->v4l2_dev, "%s: could not init device: %d\n",
-				__func__, ret);
+				 __func__, ret);
 			goto unreg_dev;
 		}
 
@@ -1976,7 +1976,7 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 		ret = mmal_setup_components(dev, &default_v4l2_format);
 		if (ret < 0) {
 			v4l2_err(&dev->v4l2_dev, "%s: could not setup components: %d\n",
-				__func__, ret);
+				 __func__, ret);
 			goto unreg_dev;
 		}
 
-- 
GitLab


From de3ab6043e08ef1f176458d8cdb7252b660ac01e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 15:58:14 +0000
Subject: [PATCH 0262/1835] staging: bcm2835-camera: Fix multiple assignments
 should be avoided

Clear checkpatch complaints of "multiple assignments should be avoided"

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-camera/bcm2835-camera.c    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 44a4c36904aac..e057d841d0235 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1065,11 +1065,12 @@ static int mmal_setup_components(struct bm2835_mmal_dev *dev,
 		/* Make a further decision on port based on resolution */
 		if (f->fmt.pix.width <= max_video_width &&
 		    f->fmt.pix.height <= max_video_height)
-			camera_port = port =
+			camera_port =
 			    &dev->component[COMP_CAMERA]->output[CAM_PORT_VIDEO];
 		else
-			camera_port = port =
+			camera_port =
 			    &dev->component[COMP_CAMERA]->output[CAM_PORT_CAPTURE];
+		port = camera_port;
 		break;
 	case COMP_IMAGE_ENCODE:
 		encode_component = dev->component[COMP_IMAGE_ENCODE];
-- 
GitLab


From 2bfafa2dcb71330b198ea1ebf8c759b6e4f77eff Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 16:08:41 +0000
Subject: [PATCH 0263/1835] staging: bcm2835-camera: Fix up all formatting in
 mmal-paramters.h

Fixes up all checkpatch errors in mmal-parameters.h

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/mmal-parameters.h          | 273 +++++++++++-------
 1 file changed, 165 insertions(+), 108 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
index da21ec5e320c8..af9b5b5b181dd 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
@@ -23,148 +23,204 @@
 #define MMAL_PARAMETERS_H
 
 /** Common parameter ID group, used with many types of component. */
-#define MMAL_PARAMETER_GROUP_COMMON            (0 << 16)
+#define MMAL_PARAMETER_GROUP_COMMON		(0 << 16)
 /** Camera-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_CAMERA            (1 << 16)
+#define MMAL_PARAMETER_GROUP_CAMERA		(1 << 16)
 /** Video-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_VIDEO             (2 << 16)
+#define MMAL_PARAMETER_GROUP_VIDEO		(2 << 16)
 /** Audio-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_AUDIO             (3 << 16)
+#define MMAL_PARAMETER_GROUP_AUDIO		(3 << 16)
 /** Clock-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_CLOCK             (4 << 16)
+#define MMAL_PARAMETER_GROUP_CLOCK		(4 << 16)
 /** Miracast-specific parameter ID group. */
-#define MMAL_PARAMETER_GROUP_MIRACAST       (5 << 16)
+#define MMAL_PARAMETER_GROUP_MIRACAST		(5 << 16)
 
 /* Common parameters */
 enum mmal_parameter_common_type {
-	MMAL_PARAMETER_UNUSED  /**< Never a valid parameter ID */
-		= MMAL_PARAMETER_GROUP_COMMON,
-	MMAL_PARAMETER_SUPPORTED_ENCODINGS, /**< MMAL_PARAMETER_ENCODING_T */
-	MMAL_PARAMETER_URI, /**< MMAL_PARAMETER_URI_T */
-
-	/** MMAL_PARAMETER_CHANGE_EVENT_REQUEST_T */
+	/**< Never a valid parameter ID */
+	MMAL_PARAMETER_UNUSED = MMAL_PARAMETER_GROUP_COMMON,
+
+		/**< MMAL_PARAMETER_ENCODING_T */
+	MMAL_PARAMETER_SUPPORTED_ENCODINGS,
+		/**< MMAL_PARAMETER_URI_T */
+	MMAL_PARAMETER_URI,
+		/** MMAL_PARAMETER_CHANGE_EVENT_REQUEST_T */
 	MMAL_PARAMETER_CHANGE_EVENT_REQUEST,
-
-	/** MMAL_PARAMETER_BOOLEAN_T */
+		/** MMAL_PARAMETER_BOOLEAN_T */
 	MMAL_PARAMETER_ZERO_COPY,
-
-	/**< MMAL_PARAMETER_BUFFER_REQUIREMENTS_T */
+		/**< MMAL_PARAMETER_BUFFER_REQUIREMENTS_T */
 	MMAL_PARAMETER_BUFFER_REQUIREMENTS,
-
-	MMAL_PARAMETER_STATISTICS, /**< MMAL_PARAMETER_STATISTICS_T */
-	MMAL_PARAMETER_CORE_STATISTICS, /**< MMAL_PARAMETER_CORE_STATISTICS_T */
-	MMAL_PARAMETER_MEM_USAGE, /**< MMAL_PARAMETER_MEM_USAGE_T */
-	MMAL_PARAMETER_BUFFER_FLAG_FILTER, /**< MMAL_PARAMETER_UINT32_T */
-	MMAL_PARAMETER_SEEK, /**< MMAL_PARAMETER_SEEK_T */
-	MMAL_PARAMETER_POWERMON_ENABLE, /**< MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_LOGGING, /**< MMAL_PARAMETER_LOGGING_T */
-	MMAL_PARAMETER_SYSTEM_TIME, /**< MMAL_PARAMETER_UINT64_T */
-	MMAL_PARAMETER_NO_IMAGE_PADDING  /**< MMAL_PARAMETER_BOOLEAN_T */
+		/**< MMAL_PARAMETER_STATISTICS_T */
+	MMAL_PARAMETER_STATISTICS,
+		/**< MMAL_PARAMETER_CORE_STATISTICS_T */
+	MMAL_PARAMETER_CORE_STATISTICS,
+		/**< MMAL_PARAMETER_MEM_USAGE_T */
+	MMAL_PARAMETER_MEM_USAGE,
+		/**< MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_BUFFER_FLAG_FILTER,
+		/**< MMAL_PARAMETER_SEEK_T */
+	MMAL_PARAMETER_SEEK,
+		/**< MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_POWERMON_ENABLE,
+		/**< MMAL_PARAMETER_LOGGING_T */
+	MMAL_PARAMETER_LOGGING,
+		/**< MMAL_PARAMETER_UINT64_T */
+	MMAL_PARAMETER_SYSTEM_TIME,
+		/**< MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_NO_IMAGE_PADDING,
 };
 
 /* camera parameters */
 
 enum mmal_parameter_camera_type {
 	/* 0 */
-	/** @ref MMAL_PARAMETER_THUMBNAIL_CONFIG_T */
-	MMAL_PARAMETER_THUMBNAIL_CONFIGURATION
-		= MMAL_PARAMETER_GROUP_CAMERA,
-	MMAL_PARAMETER_CAPTURE_QUALITY, /**< Unused? */
-	MMAL_PARAMETER_ROTATION, /**< @ref MMAL_PARAMETER_INT32_T */
-	MMAL_PARAMETER_EXIF_DISABLE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_EXIF, /**< @ref MMAL_PARAMETER_EXIF_T */
-	MMAL_PARAMETER_AWB_MODE, /**< @ref MMAL_PARAM_AWBMODE_T */
-	MMAL_PARAMETER_IMAGE_EFFECT, /**< @ref MMAL_PARAMETER_IMAGEFX_T */
-	MMAL_PARAMETER_COLOUR_EFFECT, /**< @ref MMAL_PARAMETER_COLOURFX_T */
-	MMAL_PARAMETER_FLICKER_AVOID, /**< @ref MMAL_PARAMETER_FLICKERAVOID_T */
-	MMAL_PARAMETER_FLASH, /**< @ref MMAL_PARAMETER_FLASH_T */
-	MMAL_PARAMETER_REDEYE, /**< @ref MMAL_PARAMETER_REDEYE_T */
-	MMAL_PARAMETER_FOCUS, /**< @ref MMAL_PARAMETER_FOCUS_T */
-	MMAL_PARAMETER_FOCAL_LENGTHS, /**< Unused? */
-	MMAL_PARAMETER_EXPOSURE_COMP, /**< @ref MMAL_PARAMETER_INT32_T */
-	MMAL_PARAMETER_ZOOM, /**< @ref MMAL_PARAMETER_SCALEFACTOR_T */
-	MMAL_PARAMETER_MIRROR, /**< @ref MMAL_PARAMETER_MIRROR_T */
+		/** @ref MMAL_PARAMETER_THUMBNAIL_CONFIG_T */
+	MMAL_PARAMETER_THUMBNAIL_CONFIGURATION =
+		MMAL_PARAMETER_GROUP_CAMERA,
+		/**< Unused? */
+	MMAL_PARAMETER_CAPTURE_QUALITY,
+		/**< @ref MMAL_PARAMETER_INT32_T */
+	MMAL_PARAMETER_ROTATION,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_EXIF_DISABLE,
+		/**< @ref MMAL_PARAMETER_EXIF_T */
+	MMAL_PARAMETER_EXIF,
+		/**< @ref MMAL_PARAM_AWBMODE_T */
+	MMAL_PARAMETER_AWB_MODE,
+		/**< @ref MMAL_PARAMETER_IMAGEFX_T */
+	MMAL_PARAMETER_IMAGE_EFFECT,
+		/**< @ref MMAL_PARAMETER_COLOURFX_T */
+	MMAL_PARAMETER_COLOUR_EFFECT,
+		/**< @ref MMAL_PARAMETER_FLICKERAVOID_T */
+	MMAL_PARAMETER_FLICKER_AVOID,
+		/**< @ref MMAL_PARAMETER_FLASH_T */
+	MMAL_PARAMETER_FLASH,
+		/**< @ref MMAL_PARAMETER_REDEYE_T */
+	MMAL_PARAMETER_REDEYE,
+		/**< @ref MMAL_PARAMETER_FOCUS_T */
+	MMAL_PARAMETER_FOCUS,
+		/**< Unused? */
+	MMAL_PARAMETER_FOCAL_LENGTHS,
+		/**< @ref MMAL_PARAMETER_INT32_T */
+	MMAL_PARAMETER_EXPOSURE_COMP,
+		/**< @ref MMAL_PARAMETER_SCALEFACTOR_T */
+	MMAL_PARAMETER_ZOOM,
+		/**< @ref MMAL_PARAMETER_MIRROR_T */
+	MMAL_PARAMETER_MIRROR,
 
 	/* 0x10 */
-	MMAL_PARAMETER_CAMERA_NUM, /**< @ref MMAL_PARAMETER_UINT32_T */
-	MMAL_PARAMETER_CAPTURE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_EXPOSURE_MODE, /**< @ref MMAL_PARAMETER_EXPOSUREMODE_T */
-	MMAL_PARAMETER_EXP_METERING_MODE, /**< @ref MMAL_PARAMETER_EXPOSUREMETERINGMODE_T */
-	MMAL_PARAMETER_FOCUS_STATUS, /**< @ref MMAL_PARAMETER_FOCUS_STATUS_T */
-	MMAL_PARAMETER_CAMERA_CONFIG, /**< @ref MMAL_PARAMETER_CAMERA_CONFIG_T */
-	MMAL_PARAMETER_CAPTURE_STATUS, /**< @ref MMAL_PARAMETER_CAPTURE_STATUS_T */
-	MMAL_PARAMETER_FACE_TRACK, /**< @ref MMAL_PARAMETER_FACE_TRACK_T */
-	MMAL_PARAMETER_DRAW_BOX_FACES_AND_FOCUS, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_JPEG_Q_FACTOR, /**< @ref MMAL_PARAMETER_UINT32_T */
-	MMAL_PARAMETER_FRAME_RATE, /**< @ref MMAL_PARAMETER_FRAME_RATE_T */
-	MMAL_PARAMETER_USE_STC, /**< @ref MMAL_PARAMETER_CAMERA_STC_MODE_T */
-	MMAL_PARAMETER_CAMERA_INFO, /**< @ref MMAL_PARAMETER_CAMERA_INFO_T */
-	MMAL_PARAMETER_VIDEO_STABILISATION, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_FACE_TRACK_RESULTS, /**< @ref MMAL_PARAMETER_FACE_TRACK_RESULTS_T */
-	MMAL_PARAMETER_ENABLE_RAW_CAPTURE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
+		/**< @ref MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_CAMERA_NUM,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_CAPTURE,
+		/**< @ref MMAL_PARAMETER_EXPOSUREMODE_T */
+	MMAL_PARAMETER_EXPOSURE_MODE,
+		/**< @ref MMAL_PARAMETER_EXPOSUREMETERINGMODE_T */
+	MMAL_PARAMETER_EXP_METERING_MODE,
+		/**< @ref MMAL_PARAMETER_FOCUS_STATUS_T */
+	MMAL_PARAMETER_FOCUS_STATUS,
+		/**< @ref MMAL_PARAMETER_CAMERA_CONFIG_T */
+	MMAL_PARAMETER_CAMERA_CONFIG,
+		/**< @ref MMAL_PARAMETER_CAPTURE_STATUS_T */
+	MMAL_PARAMETER_CAPTURE_STATUS,
+		/**< @ref MMAL_PARAMETER_FACE_TRACK_T */
+	MMAL_PARAMETER_FACE_TRACK,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_DRAW_BOX_FACES_AND_FOCUS,
+		/**< @ref MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_JPEG_Q_FACTOR,
+		/**< @ref MMAL_PARAMETER_FRAME_RATE_T */
+	MMAL_PARAMETER_FRAME_RATE,
+		/**< @ref MMAL_PARAMETER_CAMERA_STC_MODE_T */
+	MMAL_PARAMETER_USE_STC,
+		/**< @ref MMAL_PARAMETER_CAMERA_INFO_T */
+	MMAL_PARAMETER_CAMERA_INFO,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_VIDEO_STABILISATION,
+		/**< @ref MMAL_PARAMETER_FACE_TRACK_RESULTS_T */
+	MMAL_PARAMETER_FACE_TRACK_RESULTS,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_ENABLE_RAW_CAPTURE,
 
 	/* 0x20 */
-	MMAL_PARAMETER_DPF_FILE, /**< @ref MMAL_PARAMETER_URI_T */
-	MMAL_PARAMETER_ENABLE_DPF_FILE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_DPF_FAIL_IS_FATAL, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_CAPTURE_MODE, /**< @ref MMAL_PARAMETER_CAPTUREMODE_T */
-	MMAL_PARAMETER_FOCUS_REGIONS, /**< @ref MMAL_PARAMETER_FOCUS_REGIONS_T */
-	MMAL_PARAMETER_INPUT_CROP, /**< @ref MMAL_PARAMETER_INPUT_CROP_T */
-	MMAL_PARAMETER_SENSOR_INFORMATION, /**< @ref MMAL_PARAMETER_SENSOR_INFORMATION_T */
-	MMAL_PARAMETER_FLASH_SELECT, /**< @ref MMAL_PARAMETER_FLASH_SELECT_T */
-	MMAL_PARAMETER_FIELD_OF_VIEW, /**< @ref MMAL_PARAMETER_FIELD_OF_VIEW_T */
-	MMAL_PARAMETER_HIGH_DYNAMIC_RANGE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_DYNAMIC_RANGE_COMPRESSION, /**< @ref MMAL_PARAMETER_DRC_T */
-	MMAL_PARAMETER_ALGORITHM_CONTROL, /**< @ref MMAL_PARAMETER_ALGORITHM_CONTROL_T */
-	MMAL_PARAMETER_SHARPNESS, /**< @ref MMAL_PARAMETER_RATIONAL_T */
-	MMAL_PARAMETER_CONTRAST, /**< @ref MMAL_PARAMETER_RATIONAL_T */
-	MMAL_PARAMETER_BRIGHTNESS, /**< @ref MMAL_PARAMETER_RATIONAL_T */
-	MMAL_PARAMETER_SATURATION, /**< @ref MMAL_PARAMETER_RATIONAL_T */
+		/**< @ref MMAL_PARAMETER_URI_T */
+	MMAL_PARAMETER_DPF_FILE,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_ENABLE_DPF_FILE,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_DPF_FAIL_IS_FATAL,
+		/**< @ref MMAL_PARAMETER_CAPTUREMODE_T */
+	MMAL_PARAMETER_CAPTURE_MODE,
+		/**< @ref MMAL_PARAMETER_FOCUS_REGIONS_T */
+	MMAL_PARAMETER_FOCUS_REGIONS,
+		/**< @ref MMAL_PARAMETER_INPUT_CROP_T */
+	MMAL_PARAMETER_INPUT_CROP,
+		/**< @ref MMAL_PARAMETER_SENSOR_INFORMATION_T */
+	MMAL_PARAMETER_SENSOR_INFORMATION,
+		/**< @ref MMAL_PARAMETER_FLASH_SELECT_T */
+	MMAL_PARAMETER_FLASH_SELECT,
+		/**< @ref MMAL_PARAMETER_FIELD_OF_VIEW_T */
+	MMAL_PARAMETER_FIELD_OF_VIEW,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_HIGH_DYNAMIC_RANGE,
+		/**< @ref MMAL_PARAMETER_DRC_T */
+	MMAL_PARAMETER_DYNAMIC_RANGE_COMPRESSION,
+		/**< @ref MMAL_PARAMETER_ALGORITHM_CONTROL_T */
+	MMAL_PARAMETER_ALGORITHM_CONTROL,
+		/**< @ref MMAL_PARAMETER_RATIONAL_T */
+	MMAL_PARAMETER_SHARPNESS,
+		/**< @ref MMAL_PARAMETER_RATIONAL_T */
+	MMAL_PARAMETER_CONTRAST,
+		/**< @ref MMAL_PARAMETER_RATIONAL_T */
+	MMAL_PARAMETER_BRIGHTNESS,
+		/**< @ref MMAL_PARAMETER_RATIONAL_T */
+	MMAL_PARAMETER_SATURATION,
 
 	/* 0x30 */
-	MMAL_PARAMETER_ISO, /**< @ref MMAL_PARAMETER_UINT32_T */
-	MMAL_PARAMETER_ANTISHAKE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-
-	/** @ref MMAL_PARAMETER_IMAGEFX_PARAMETERS_T */
+		/**< @ref MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_ISO,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_ANTISHAKE,
+		/** @ref MMAL_PARAMETER_IMAGEFX_PARAMETERS_T */
 	MMAL_PARAMETER_IMAGE_EFFECT_PARAMETERS,
-
-	/** @ref MMAL_PARAMETER_BOOLEAN_T */
+		/** @ref MMAL_PARAMETER_BOOLEAN_T */
 	MMAL_PARAMETER_CAMERA_BURST_CAPTURE,
-
-	/** @ref MMAL_PARAMETER_UINT32_T */
+		/** @ref MMAL_PARAMETER_UINT32_T */
 	MMAL_PARAMETER_CAMERA_MIN_ISO,
-
-	/** @ref MMAL_PARAMETER_CAMERA_USE_CASE_T */
+		/** @ref MMAL_PARAMETER_CAMERA_USE_CASE_T */
 	MMAL_PARAMETER_CAMERA_USE_CASE,
-
-	/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
 	MMAL_PARAMETER_CAPTURE_STATS_PASS,
-
-	/** @ref MMAL_PARAMETER_UINT32_T */
+		/** @ref MMAL_PARAMETER_UINT32_T */
 	MMAL_PARAMETER_CAMERA_CUSTOM_SENSOR_CONFIG,
-
-	/** @ref MMAL_PARAMETER_BOOLEAN_T */
+		/** @ref MMAL_PARAMETER_BOOLEAN_T */
 	MMAL_PARAMETER_ENABLE_REGISTER_FILE,
-
-	/** @ref MMAL_PARAMETER_BOOLEAN_T */
+		/** @ref MMAL_PARAMETER_BOOLEAN_T */
 	MMAL_PARAMETER_REGISTER_FAIL_IS_FATAL,
-
-	/** @ref MMAL_PARAMETER_CONFIGFILE_T */
+		/** @ref MMAL_PARAMETER_CONFIGFILE_T */
 	MMAL_PARAMETER_CONFIGFILE_REGISTERS,
-
-	/** @ref MMAL_PARAMETER_CONFIGFILE_CHUNK_T */
+		/** @ref MMAL_PARAMETER_CONFIGFILE_CHUNK_T */
 	MMAL_PARAMETER_CONFIGFILE_CHUNK_REGISTERS,
-	MMAL_PARAMETER_JPEG_ATTACH_LOG, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_ZERO_SHUTTER_LAG, /**< @ref MMAL_PARAMETER_ZEROSHUTTERLAG_T */
-	MMAL_PARAMETER_FPS_RANGE, /**< @ref MMAL_PARAMETER_FPS_RANGE_T */
-	MMAL_PARAMETER_CAPTURE_EXPOSURE_COMP, /**< @ref MMAL_PARAMETER_INT32_T */
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_JPEG_ATTACH_LOG,
+		/**< @ref MMAL_PARAMETER_ZEROSHUTTERLAG_T */
+	MMAL_PARAMETER_ZERO_SHUTTER_LAG,
+		/**< @ref MMAL_PARAMETER_FPS_RANGE_T */
+	MMAL_PARAMETER_FPS_RANGE,
+		/**< @ref MMAL_PARAMETER_INT32_T */
+	MMAL_PARAMETER_CAPTURE_EXPOSURE_COMP,
 
 	/* 0x40 */
-	MMAL_PARAMETER_SW_SHARPEN_DISABLE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_FLASH_REQUIRED, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_SW_SATURATION_DISABLE, /**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_SHUTTER_SPEED,             /**< Takes a @ref MMAL_PARAMETER_UINT32_T */
-	MMAL_PARAMETER_CUSTOM_AWB_GAINS,          /**< Takes a @ref MMAL_PARAMETER_AWB_GAINS_T */
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_SW_SHARPEN_DISABLE,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_FLASH_REQUIRED,
+		/**< @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_SW_SATURATION_DISABLE,
+	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_SHUTTER_SPEED,
+		/**< Takes a @ref MMAL_PARAMETER_AWB_GAINS_T */
+	MMAL_PARAMETER_CUSTOM_AWB_GAINS,
 };
 
 struct mmal_parameter_rational {
@@ -411,7 +467,8 @@ enum mmal_parameter_video_type {
 	MMAL_PARAMETER_MINIMISE_FRAGMENTATION,
 
 	/** @ref MMAL_PARAMETER_UINT32_T.
-	 * Setting the value to zero resets to the default (one slice per frame).
+	 * Setting the value to zero resets to the default (one slice per
+	 * frame).
 	 */
 	MMAL_PARAMETER_MB_ROWS_PER_SLICE,
 
-- 
GitLab


From d3533684786a6eec68bcf6e43d719b29b44df976 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 28 Sep 2018 10:17:11 +0100
Subject: [PATCH 0264/1835] staging: bcm2835-camera: Use enums for max value in
 controls

Controls of type MMAL_CONTROL_TYPE_STD_MENU call v4l2_ctrl_new_std_menu
with a max value and a mask. The max value is one of the defined
values for the control, however in the config array there are several
entries where raw numbers have been used instead. Replace these
with the appropriate enum.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-camera/controls.c   | 37 +++++++------------
 1 file changed, 13 insertions(+), 24 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index fb86e92faffab..21409f3729a46 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -58,19 +58,6 @@ static const uint32_t iso_values[] = {
 	0, 100, 200, 400, 800,
 };
 
-static const s64 mains_freq_qmenu[] = {
-	V4L2_CID_POWER_LINE_FREQUENCY_DISABLED,
-	V4L2_CID_POWER_LINE_FREQUENCY_50HZ,
-	V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
-	V4L2_CID_POWER_LINE_FREQUENCY_AUTO
-};
-
-/* Supported video encode modes */
-static const s64 bitrate_mode_qmenu[] = {
-	(s64)V4L2_MPEG_VIDEO_BITRATE_MODE_VBR,
-	(s64)V4L2_MPEG_VIDEO_BITRATE_MODE_CBR,
-};
-
 enum bm2835_mmal_ctrl_type {
 	MMAL_CONTROL_TYPE_STD,
 	MMAL_CONTROL_TYPE_STD_MENU,
@@ -966,8 +953,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	},
 	{
 		V4L2_CID_ISO_SENSITIVITY_AUTO, MMAL_CONTROL_TYPE_STD_MENU,
-		0, 1, V4L2_ISO_SENSITIVITY_AUTO, 1, NULL,
-		MMAL_PARAMETER_ISO,
+		0, V4L2_ISO_SENSITIVITY_AUTO, V4L2_ISO_SENSITIVITY_AUTO, 1,
+		NULL, MMAL_PARAMETER_ISO,
 		&ctrl_set_iso,
 		false
 	},
@@ -984,8 +971,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
  */
 	{
 		V4L2_CID_EXPOSURE_AUTO, MMAL_CONTROL_TYPE_STD_MENU,
-		~0x03, 3, V4L2_EXPOSURE_AUTO, 0, NULL,
-		MMAL_PARAMETER_EXPOSURE_MODE,
+		~0x03, V4L2_EXPOSURE_APERTURE_PRIORITY, V4L2_EXPOSURE_AUTO, 0,
+		NULL, MMAL_PARAMETER_EXPOSURE_MODE,
 		&ctrl_set_exposure,
 		false
 	},
@@ -1021,7 +1008,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	{
 		V4L2_CID_EXPOSURE_METERING,
 		MMAL_CONTROL_TYPE_STD_MENU,
-		~0x7, 2, V4L2_EXPOSURE_METERING_AVERAGE, 0, NULL,
+		~0x7, V4L2_EXPOSURE_METERING_SPOT,
+		V4L2_EXPOSURE_METERING_AVERAGE, 0, NULL,
 		MMAL_PARAMETER_EXP_METERING_MODE,
 		&ctrl_set_metering_mode,
 		false
@@ -1029,7 +1017,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	{
 		V4L2_CID_AUTO_N_PRESET_WHITE_BALANCE,
 		MMAL_CONTROL_TYPE_STD_MENU,
-		~0x3ff, 9, V4L2_WHITE_BALANCE_AUTO, 0, NULL,
+		~0x3ff, V4L2_WHITE_BALANCE_SHADE, V4L2_WHITE_BALANCE_AUTO, 0,
+		NULL,
 		MMAL_PARAMETER_AWB_MODE,
 		&ctrl_set_awb_mode,
 		false
@@ -1050,7 +1039,7 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	},
 	{
 		V4L2_CID_COLORFX, MMAL_CONTROL_TYPE_STD_MENU,
-		0, 15, V4L2_COLORFX_NONE, 0, NULL,
+		0, V4L2_COLORFX_SET_CBCR, V4L2_COLORFX_NONE, 0, NULL,
 		MMAL_PARAMETER_IMAGE_EFFECT,
 		&ctrl_set_image_effect,
 		false
@@ -1085,8 +1074,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	},
 	{
 		V4L2_CID_MPEG_VIDEO_BITRATE_MODE, MMAL_CONTROL_TYPE_STD_MENU,
-		0, ARRAY_SIZE(bitrate_mode_qmenu) - 1,
-		0, 0, bitrate_mode_qmenu,
+		0, V4L2_MPEG_VIDEO_BITRATE_MODE_CBR,
+		0, 0, NULL,
 		MMAL_PARAMETER_RATECONTROL,
 		&ctrl_set_bitrate_mode,
 		false
@@ -1108,8 +1097,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	},
 	{
 		V4L2_CID_POWER_LINE_FREQUENCY, MMAL_CONTROL_TYPE_STD_MENU,
-		0, ARRAY_SIZE(mains_freq_qmenu) - 1,
-		1, 1, mains_freq_qmenu,
+		0, V4L2_CID_POWER_LINE_FREQUENCY_AUTO,
+		1, 1, NULL,
 		MMAL_PARAMETER_FLICKER_AVOID,
 		&ctrl_set_flicker_avoidance,
 		false
-- 
GitLab


From cdf0ee428483b2774a19e2d63d6d64c9ebaf2570 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 8 Oct 2018 18:26:15 +0100
Subject: [PATCH 0265/1835] staging: bcm2835-camera: Correct
 V4L2_CID_COLORFX_CBCR behaviour

With V4L2_CID_COLORFX_CBCR calling ctrl_set_colfx it was incorrectly
assigning the colour values to the enable field of dev->colourfx
instead of the u and v fields.

Correct the assignments.

Reported as a Coverity issue
Detected by CoverityScan CID#1419711 ("Unused value")

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/controls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 21409f3729a46..c4c1c191bce8c 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -578,8 +578,8 @@ static int ctrl_set_colfx(struct bm2835_mmal_dev *dev,
 
 	control = &dev->component[COMP_CAMERA]->control;
 
-	dev->colourfx.enable = (ctrl->val & 0xff00) >> 8;
-	dev->colourfx.enable = ctrl->val & 0xff;
+	dev->colourfx.u = (ctrl->val & 0xff00) >> 8;
+	dev->colourfx.v = ctrl->val & 0xff;
 
 	ret = vchiq_mmal_port_parameter_set(dev->instance, control,
 					    MMAL_PARAMETER_COLOUR_EFFECT,
-- 
GitLab


From 7e0483e7ccf2a2f6364a48b11a7a7544989706c8 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 28 Sep 2018 10:22:26 +0100
Subject: [PATCH 0266/1835] staging: bcm2835-camera: Remove/amend some obsolete
 comments

Remove a todo which has been done.
Remove a template line that was redundant.
Make a comment clearer as to the non-obvious meaning of a field.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-camera/controls.c   | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index c4c1c191bce8c..17b6960fc151c 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -965,10 +965,6 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 		&ctrl_set_value,
 		false
 	},
-/*	{
- *		0, MMAL_CONTROL_TYPE_CLUSTER, 3, 1, 0, NULL, 0, NULL
- *	},
- */
 	{
 		V4L2_CID_EXPOSURE_AUTO, MMAL_CONTROL_TYPE_STD_MENU,
 		~0x03, V4L2_EXPOSURE_APERTURE_PRIORITY, V4L2_EXPOSURE_AUTO, 0,
@@ -976,11 +972,6 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 		&ctrl_set_exposure,
 		false
 	},
-/* todo this needs mixing in with set exposure
- *	{
- *		V4L2_CID_SCENE_MODE, MMAL_CONTROL_TYPE_STD_MENU,
- *	},
- */
 	{
 		V4L2_CID_EXPOSURE_ABSOLUTE, MMAL_CONTROL_TYPE_STD,
 		/* Units of 100usecs */
@@ -1146,7 +1137,7 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	},
 	{
 		V4L2_CID_SCENE_MODE, MMAL_CONTROL_TYPE_STD_MENU,
-		-1,	/* Min is computed at runtime */
+		-1,	/* Min (mask) is computed at runtime */
 		V4L2_SCENE_MODE_TEXT,
 		V4L2_SCENE_MODE_NONE, 1, NULL,
 		MMAL_PARAMETER_PROFILE,
-- 
GitLab


From 312007298fa8229ba37ffd18a68cf43c8bb926f5 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 16:30:37 +0100
Subject: [PATCH 0267/1835] staging: vc04_services: Split vchiq-mmal into a
 module

In preparation for adding a video codec V4L2 module which also
wants to use vchiq-mmal functions, split it out into an
independent module.
The minimum number of changes have been made to achieve this
(eg straight moves where possible) so existing checkpatch
errors will still be present.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/Kconfig         |  1 +
 drivers/staging/vc04_services/Makefile        |  1 +
 .../vc04_services/bcm2835-camera/Kconfig      |  2 +-
 .../vc04_services/bcm2835-camera/Makefile     |  4 ++--
 .../staging/vc04_services/vchiq-mmal/Kconfig  |  7 ++++++
 .../staging/vc04_services/vchiq-mmal/Makefile |  8 +++++++
 .../mmal-common.h                             |  0
 .../mmal-encodings.h                          |  0
 .../mmal-msg-common.h                         |  0
 .../mmal-msg-format.h                         |  0
 .../mmal-msg-port.h                           |  0
 .../{bcm2835-camera => vchiq-mmal}/mmal-msg.h |  0
 .../mmal-parameters.h                         |  0
 .../mmal-vchiq.c                              | 22 +++++++++++++++++++
 .../mmal-vchiq.h                              |  0
 15 files changed, 42 insertions(+), 3 deletions(-)
 create mode 100644 drivers/staging/vc04_services/vchiq-mmal/Kconfig
 create mode 100644 drivers/staging/vc04_services/vchiq-mmal/Makefile
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-common.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-encodings.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-msg-common.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-msg-format.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-msg-port.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-msg.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-parameters.h (100%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-vchiq.c (98%)
 rename drivers/staging/vc04_services/{bcm2835-camera => vchiq-mmal}/mmal-vchiq.h (100%)

diff --git a/drivers/staging/vc04_services/Kconfig b/drivers/staging/vc04_services/Kconfig
index 98064ce2c2b47..9898764c07dda 100644
--- a/drivers/staging/vc04_services/Kconfig
+++ b/drivers/staging/vc04_services/Kconfig
@@ -21,6 +21,7 @@ config BCM2835_VCHIQ
 source "drivers/staging/vc04_services/bcm2835-audio/Kconfig"
 
 source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
+source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
 
 endif
 
diff --git a/drivers/staging/vc04_services/Makefile b/drivers/staging/vc04_services/Makefile
index afe43fa5a6d7c..91fa00347eb79 100644
--- a/drivers/staging/vc04_services/Makefile
+++ b/drivers/staging/vc04_services/Makefile
@@ -12,6 +12,7 @@ vchiq-objs := \
 
 obj-$(CONFIG_SND_BCM2835)	+= bcm2835-audio/
 obj-$(CONFIG_VIDEO_BCM2835)	+= bcm2835-camera/
+obj-$(CONFIG_BCM2835_VCHIQ_MMAL) += vchiq-mmal/
 
 ccflags-y += -Idrivers/staging/vc04_services -D__VCCOREVER__=0x04000000
 
diff --git a/drivers/staging/vc04_services/bcm2835-camera/Kconfig b/drivers/staging/vc04_services/bcm2835-camera/Kconfig
index b8b01aa4e4267..c2e422a9def4e 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/Kconfig
+++ b/drivers/staging/vc04_services/bcm2835-camera/Kconfig
@@ -2,7 +2,7 @@ config VIDEO_BCM2835
 	tristate "BCM2835 Camera"
 	depends on MEDIA_SUPPORT
 	depends on VIDEO_V4L2 && (ARCH_BCM2835 || COMPILE_TEST)
-	select BCM2835_VCHIQ
+	select BCM2835_VCHIQ_MMAL
 	select VIDEOBUF2_VMALLOC
 	select BTREE
 	help
diff --git a/drivers/staging/vc04_services/bcm2835-camera/Makefile b/drivers/staging/vc04_services/bcm2835-camera/Makefile
index 2a4565e682d8c..35fe06bf8a9d7 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/Makefile
+++ b/drivers/staging/vc04_services/bcm2835-camera/Makefile
@@ -1,11 +1,11 @@
 # SPDX-License-Identifier: GPL-2.0
 bcm2835-v4l2-$(CONFIG_VIDEO_BCM2835) := \
 	bcm2835-camera.o \
-	controls.o \
-	mmal-vchiq.o
+	controls.o
 
 obj-$(CONFIG_VIDEO_BCM2835) += bcm2835-v4l2.o
 
 ccflags-y += \
 	-Idrivers/staging/vc04_services \
+	-Idrivers/staging/vc04_services/vchiq-mmal \
 	-D__VCCOREVER__=0x04000000
diff --git a/drivers/staging/vc04_services/vchiq-mmal/Kconfig b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
new file mode 100644
index 0000000000000..2288a95273e27
--- /dev/null
+++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
@@ -0,0 +1,7 @@
+config BCM2835_VCHIQ_MMAL
+	tristate "BCM2835 MMAL VCHIQ service"
+	depends on (ARCH_BCM2835 || COMPILE_TEST)
+	select BCM2835_VCHIQ
+	help
+	  Enables the MMAL API over VCHIQ as used for the
+	  majority of the multimedia services on VideoCore.
diff --git a/drivers/staging/vc04_services/vchiq-mmal/Makefile b/drivers/staging/vc04_services/vchiq-mmal/Makefile
new file mode 100644
index 0000000000000..f1647fc72afaa
--- /dev/null
+++ b/drivers/staging/vc04_services/vchiq-mmal/Makefile
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0
+bcm2835-mmal-vchiq-objs := mmal-vchiq.o
+
+obj-$(CONFIG_BCM2835_VCHIQ_MMAL) += bcm2835-mmal-vchiq.o
+
+ccflags-y += \
+	-Idrivers/staging/vc04_services \
+	-D__VCCOREVER__=0x04000000
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-common.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-common.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-encodings.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-encodings.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-common.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-common.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-msg-common.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-msg-common.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-format.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-msg-format.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-msg-format.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg-port.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-msg-port.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-msg-port.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-msg.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-parameters.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
similarity index 98%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 4c016f93177b9..fc2e983f6774a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -17,6 +17,7 @@
 
 #include <linux/errno.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
@@ -32,6 +33,11 @@
 #define USE_VCHIQ_ARM
 #include "interface/vchi/vchi.h"
 
+MODULE_DESCRIPTION("BCM2835 MMAL VCHIQ interface");
+MODULE_AUTHOR("Dave Stevenson, <dave.stevenson@raspberrypi.org>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("0.0.1");
+
 /* maximum number of components supported */
 #define VCHIQ_MMAL_MAX_COMPONENTS 4
 
@@ -1396,6 +1402,7 @@ release_unlock:
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_port_set_format);
 
 int vchiq_mmal_port_parameter_set(struct vchiq_mmal_instance *instance,
 				  struct vchiq_mmal_port *port,
@@ -1412,6 +1419,7 @@ int vchiq_mmal_port_parameter_set(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_port_parameter_set);
 
 int vchiq_mmal_port_parameter_get(struct vchiq_mmal_instance *instance,
 				  struct vchiq_mmal_port *port,
@@ -1428,6 +1436,7 @@ int vchiq_mmal_port_parameter_get(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_port_parameter_get);
 
 /* enable a port
  *
@@ -1458,6 +1467,7 @@ unlock:
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_port_enable);
 
 int vchiq_mmal_port_disable(struct vchiq_mmal_instance *instance,
 			    struct vchiq_mmal_port *port)
@@ -1478,6 +1488,7 @@ int vchiq_mmal_port_disable(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_port_disable);
 
 /* ports will be connected in a tunneled manner so data buffers
  * are not handled by client.
@@ -1565,6 +1576,7 @@ release_unlock:
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_port_connect_tunnel);
 
 int vchiq_mmal_submit_buffer(struct vchiq_mmal_instance *instance,
 			     struct vchiq_mmal_port *port,
@@ -1583,6 +1595,7 @@ int vchiq_mmal_submit_buffer(struct vchiq_mmal_instance *instance,
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_submit_buffer);
 
 int mmal_vchi_buffer_init(struct vchiq_mmal_instance *instance,
 			  struct mmal_buffer *buf)
@@ -1595,6 +1608,7 @@ int mmal_vchi_buffer_init(struct vchiq_mmal_instance *instance,
 	buf->msg_context = msg_context;
 	return 0;
 }
+EXPORT_SYMBOL_GPL(mmal_vchi_buffer_init);
 
 int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
 {
@@ -1606,6 +1620,7 @@ int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
 
 /* Initialise a mmal component and its ports
  *
@@ -1693,6 +1708,7 @@ unlock:
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_component_init);
 
 /*
  * cause a mmal component to be destroyed
@@ -1714,6 +1730,7 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_component_finalise);
 
 /*
  * cause a mmal component to be enabled
@@ -1739,6 +1756,7 @@ int vchiq_mmal_component_enable(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_component_enable);
 
 /*
  * cause a mmal component to be enabled
@@ -1764,6 +1782,7 @@ int vchiq_mmal_component_disable(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_component_disable);
 
 int vchiq_mmal_version(struct vchiq_mmal_instance *instance,
 		       u32 *major_out, u32 *minor_out)
@@ -1779,6 +1798,7 @@ int vchiq_mmal_version(struct vchiq_mmal_instance *instance,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_version);
 
 int vchiq_mmal_finalise(struct vchiq_mmal_instance *instance)
 {
@@ -1809,6 +1829,7 @@ int vchiq_mmal_finalise(struct vchiq_mmal_instance *instance)
 
 	return status;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_finalise);
 
 int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
 {
@@ -1896,3 +1917,4 @@ err_free:
 	kfree(instance);
 	return -ENODEV;
 }
+EXPORT_SYMBOL_GPL(vchiq_mmal_init);
diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
similarity index 100%
rename from drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
rename to drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
-- 
GitLab


From ed8842078b4e258d2b7c8686bc1c1ef0ac1ba4a5 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 16:51:13 +0100
Subject: [PATCH 0268/1835] staging: mmal-vchiq: Allocate and free components
 as required

The existing code assumed that there would only ever be 4 components,
and never freed the entries once used.
Allow arbitrary creation and destruction of components.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 29 ++++++++++++-------
 .../vc04_services/vchiq-mmal/mmal-vchiq.h     |  1 +
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index fc2e983f6774a..365d5cc4313c2 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -38,8 +38,11 @@ MODULE_AUTHOR("Dave Stevenson, <dave.stevenson@raspberrypi.org>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("0.0.1");
 
-/* maximum number of components supported */
-#define VCHIQ_MMAL_MAX_COMPONENTS 4
+/*
+ * maximum number of components supported.
+ * This matches the maximum permitted by default on the VPU
+ */
+#define VCHIQ_MMAL_MAX_COMPONENTS 64
 
 /*#define FULL_MSG_DUMP 1*/
 
@@ -173,8 +176,6 @@ struct vchiq_mmal_instance {
 	struct idr context_map;
 	spinlock_t context_map_lock;
 
-	/* component to use next */
-	int component_idx;
 	struct vchiq_mmal_component component[VCHIQ_MMAL_MAX_COMPONENTS];
 
 	/* ordered workqueue to process all bulk operations */
@@ -1631,18 +1632,24 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 {
 	int ret;
 	int idx;		/* port index */
-	struct vchiq_mmal_component *component;
+	struct vchiq_mmal_component *component = NULL;
 
 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
 		return -EINTR;
 
-	if (instance->component_idx == VCHIQ_MMAL_MAX_COMPONENTS) {
+	for (idx = 0; idx < VCHIQ_MMAL_MAX_COMPONENTS; idx++) {
+		if (!instance->component[idx].in_use) {
+			component = &instance->component[idx];
+			component->in_use = 1;
+			break;
+		}
+	}
+
+	if (!component) {
 		ret = -EINVAL;	/* todo is this correct error? */
 		goto unlock;
 	}
 
-	component = &instance->component[instance->component_idx];
-
 	ret = create_component(instance, component, name);
 	if (ret < 0) {
 		pr_err("%s: failed to create component %d (Not enough GPU mem?)\n",
@@ -1693,8 +1700,6 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 			goto release_component;
 	}
 
-	instance->component_idx++;
-
 	*component_out = component;
 
 	mutex_unlock(&instance->vchiq_mutex);
@@ -1704,6 +1709,8 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 release_component:
 	destroy_component(instance, component);
 unlock:
+	if (component)
+		component->in_use = 0;
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
@@ -1726,6 +1733,8 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 
 	ret = destroy_component(instance, component);
 
+	component->in_use = 0;
+
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index 1750ff06164d7..ffa4555e0b2bb 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -82,6 +82,7 @@ struct vchiq_mmal_port {
 };
 
 struct vchiq_mmal_component {
+	u32 in_use:1;
 	bool enabled;
 	u32 handle;  /* VideoCore handle for component */
 	u32 inputs;  /* Number of input ports */
-- 
GitLab


From 35edf61122e235cf21735992a96c7142442855e2 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 16:20:46 +0000
Subject: [PATCH 0269/1835] staging: mmal-vchiq: Avoid use of bool in
 structures

Fixes up a checkpatch error "Avoid using bool structure members
because of possible alignment issues".

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vchiq-mmal/mmal-vchiq.c  | 14 +++++++-------
 .../staging/vc04_services/vchiq-mmal/mmal-vchiq.h  |  4 ++--
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 365d5cc4313c2..4bc6b87881a22 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -860,9 +860,9 @@ static int port_info_get(struct vchiq_mmal_instance *instance,
 		goto release_msg;
 
 	if (rmsg->u.port_info_get_reply.port.is_enabled == 0)
-		port->enabled = false;
+		port->enabled = 0;
 	else
-		port->enabled = true;
+		port->enabled = 1;
 
 	/* copy the values out of the message */
 	port->handle = rmsg->u.port_info_get_reply.port_handle;
@@ -1299,7 +1299,7 @@ static int port_disable(struct vchiq_mmal_instance *instance,
 	if (!port->enabled)
 		return 0;
 
-	port->enabled = false;
+	port->enabled = 0;
 
 	ret = port_action_port(instance, port,
 			       MMAL_MSG_PORT_ACTION_TYPE_DISABLE);
@@ -1351,7 +1351,7 @@ static int port_enable(struct vchiq_mmal_instance *instance,
 	if (ret)
 		goto done;
 
-	port->enabled = true;
+	port->enabled = 1;
 
 	if (port->buffer_cb) {
 		/* send buffer headers to videocore */
@@ -1523,7 +1523,7 @@ int vchiq_mmal_port_connect_tunnel(struct vchiq_mmal_instance *instance,
 			pr_err("failed disconnecting src port\n");
 			goto release_unlock;
 		}
-		src->connected->enabled = false;
+		src->connected->enabled = 0;
 		src->connected = NULL;
 	}
 
@@ -1759,7 +1759,7 @@ int vchiq_mmal_component_enable(struct vchiq_mmal_instance *instance,
 
 	ret = enable_component(instance, component);
 	if (ret == 0)
-		component->enabled = true;
+		component->enabled = 1;
 
 	mutex_unlock(&instance->vchiq_mutex);
 
@@ -1785,7 +1785,7 @@ int vchiq_mmal_component_disable(struct vchiq_mmal_instance *instance,
 
 	ret = disable_component(instance, component);
 	if (ret == 0)
-		component->enabled = false;
+		component->enabled = 0;
 
 	mutex_unlock(&instance->vchiq_mutex);
 
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index ffa4555e0b2bb..edc5d910f3a34 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -48,7 +48,7 @@ typedef void (*vchiq_mmal_buffer_cb)(
 		unsigned long length, u32 mmal_flags, s64 dts, s64 pts);
 
 struct vchiq_mmal_port {
-	bool enabled;
+	u32 enabled:1;
 	u32 handle;
 	u32 type; /* port type, cached to use on port info set */
 	u32 index; /* port index, cached to use on port info set */
@@ -83,7 +83,7 @@ struct vchiq_mmal_port {
 
 struct vchiq_mmal_component {
 	u32 in_use:1;
-	bool enabled;
+	u32 enabled:1;
 	u32 handle;  /* VideoCore handle for component */
 	u32 inputs;  /* Number of input ports */
 	u32 outputs; /* Number of output ports */
-- 
GitLab


From 9b22338bd8e3ec70227575c02a0b0f0b681b880c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 16:57:09 +0100
Subject: [PATCH 0270/1835] staging: mmal-vchiq: Make timeout a defined
 parameter

The timeout period for VPU communications is a useful thing
to extend when debugging.
Set it via a define, rather than a magic number buried in the code.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 4bc6b87881a22..efed0b68bbe04 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -44,6 +44,12 @@ MODULE_VERSION("0.0.1");
  */
 #define VCHIQ_MMAL_MAX_COMPONENTS 64
 
+/*
+ * Timeout for synchronous msg responses in seconds.
+ * Helpful to increase this if stopping in the VPU debugger.
+ */
+#define SYNC_MSG_TIMEOUT	3
+
 /*#define FULL_MSG_DUMP 1*/
 
 #ifdef DEBUG
@@ -691,7 +697,7 @@ static int send_synchronous_mmal_msg(struct vchiq_mmal_instance *instance,
 	}
 
 	timeout = wait_for_completion_timeout(&msg_context->u.sync.cmplt,
-					      3 * HZ);
+					      SYNC_MSG_TIMEOUT * HZ);
 	if (timeout == 0) {
 		pr_err("timed out waiting for sync completion\n");
 		ret = -ETIME;
-- 
GitLab


From 2e8b14660012475b087b977e419f8d4667751333 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 17:33:37 +0100
Subject: [PATCH 0271/1835] staging: mmal-vchiq: Make a mmal_buf struct for
 passing parameters

The callback from vchi_mmal to the client was growing lots of extra
parameters. Consolidate them into a single struct instead of
growing the list further.
The struct is associated with the client buffer, therefore there
are various changes to setup various containers for the struct,
and pass the appropriate members.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 62 ++++++++++++-------
 .../vc04_services/vchiq-mmal/mmal-common.h    |  5 ++
 .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 29 ++++++---
 .../vc04_services/vchiq-mmal/mmal-vchiq.h     |  3 +-
 4 files changed, 64 insertions(+), 35 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index e057d841d0235..19880b6d3b6be 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -72,6 +72,12 @@ static const struct v4l2_fract
 	tpf_max     = {.numerator = 1,	        .denominator = FPS_MIN},
 	tpf_default = {.numerator = 1000,	.denominator = 30000};
 
+/* Container for MMAL and VB2 buffers*/
+struct vb2_mmal_buffer {
+	struct vb2_v4l2_buffer	vb;
+	struct mmal_buffer	mmal;
+};
+
 /* video formats */
 static struct mmal_fmt formats[] = {
 	{
@@ -267,14 +273,15 @@ static int buffer_init(struct vb2_buffer *vb)
 {
 	struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vb->vb2_queue);
 	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
-	struct mmal_buffer *buf = container_of(vb2, struct mmal_buffer, vb);
+	struct vb2_mmal_buffer *buf =
+				container_of(vb2, struct vb2_mmal_buffer, vb);
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p, vb %p\n",
 		 __func__, dev, vb);
-	buf->buffer = vb2_plane_vaddr(&buf->vb.vb2_buf, 0);
-	buf->buffer_size = vb2_plane_size(&buf->vb.vb2_buf, 0);
+	buf->mmal.buffer = vb2_plane_vaddr(&buf->vb.vb2_buf, 0);
+	buf->mmal.buffer_size = vb2_plane_size(&buf->vb.vb2_buf, 0);
 
-	return mmal_vchi_buffer_init(dev->instance, buf);
+	return mmal_vchi_buffer_init(dev->instance, &buf->mmal);
 }
 
 static int buffer_prepare(struct vb2_buffer *vb)
@@ -303,11 +310,13 @@ static void buffer_cleanup(struct vb2_buffer *vb)
 {
 	struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vb->vb2_queue);
 	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
-	struct mmal_buffer *buf = container_of(vb2, struct mmal_buffer, vb);
+	struct vb2_mmal_buffer *buf =
+				container_of(vb2, struct vb2_mmal_buffer, vb);
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p, vb %p\n",
 		 __func__, dev, vb);
-	mmal_vchi_buffer_cleanup(buf);
+
+	mmal_vchi_buffer_cleanup(&buf->mmal);
 }
 
 static inline bool is_capturing(struct bm2835_mmal_dev *dev)
@@ -319,14 +328,16 @@ static inline bool is_capturing(struct bm2835_mmal_dev *dev)
 static void buffer_cb(struct vchiq_mmal_instance *instance,
 		      struct vchiq_mmal_port *port,
 		      int status,
-		      struct mmal_buffer *buf,
-		      unsigned long length, u32 mmal_flags, s64 dts, s64 pts)
+		      struct mmal_buffer *mmal_buf)
 {
 	struct bm2835_mmal_dev *dev = port->cb_ctx;
+	struct vb2_mmal_buffer *buf =
+			container_of(mmal_buf, struct vb2_mmal_buffer, mmal);
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 		 "%s: status:%d, buf:%p, length:%lu, flags %u, pts %lld\n",
-		 __func__, status, buf, length, mmal_flags, pts);
+		 __func__, status, buf, mmal_buf->length, mmal_buf->mmal_flags,
+		 mmal_buf->pts);
 
 	if (status != 0) {
 		/* error in transfer */
@@ -337,7 +348,7 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 		return;
 	}
 
-	if (length == 0) {
+	if (mmal_buf->length == 0) {
 		/* stream ended */
 		if (dev->capture.frame_count) {
 			/* empty buffer whilst capturing - expected to be an
@@ -353,7 +364,8 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 					&dev->capture.frame_count,
 					sizeof(dev->capture.frame_count));
 			}
-			if (vchiq_mmal_submit_buffer(instance, port, buf))
+			if (vchiq_mmal_submit_buffer(instance, port,
+						     &buf->mmal))
 				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 					 "Failed to return EOS buffer");
 		} else {
@@ -382,16 +394,16 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 			 "Buffer time set as current time - %lld",
 			 buf->vb.vb2_buf.timestamp);
-	} else if (pts != 0) {
+	} else if (mmal_buf->pts != 0) {
 		ktime_t timestamp;
-		s64 runtime_us = pts -
+		s64 runtime_us = mmal_buf->pts -
 		    dev->capture.vc_start_timestamp;
 		timestamp = ktime_add_us(dev->capture.kernel_start_ts,
 					 runtime_us);
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 			 "Convert start time %llu and %llu with offset %llu to %llu\n",
 			 ktime_to_ns(dev->capture.kernel_start_ts),
-			 dev->capture.vc_start_timestamp, pts,
+			 dev->capture.vc_start_timestamp, mmal_buf->pts,
 			 ktime_to_ns(timestamp));
 		if (timestamp < dev->capture.last_timestamp) {
 			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
@@ -416,15 +428,15 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 	dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
 	buf->vb.sequence = dev->capture.sequence++;
 
-	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
-	if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
+	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, mmal_buf->length);
+	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
 		buf->vb.flags |= V4L2_BUF_FLAG_KEYFRAME;
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 		 "Buffer has ts %llu", dev->capture.last_timestamp);
 	vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
 
-	if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
+	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
 	    is_capturing(dev)) {
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 			 "Grab another frame as buffer has EOS");
@@ -507,14 +519,16 @@ static void buffer_queue(struct vb2_buffer *vb)
 {
 	struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vb->vb2_queue);
 	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
-	struct mmal_buffer *buf = container_of(vb2, struct mmal_buffer, vb);
+	struct vb2_mmal_buffer *buf =
+				container_of(vb2, struct vb2_mmal_buffer, vb);
 	int ret;
 
 	v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 		 "%s: dev:%p buf:%p, idx %u\n",
 		 __func__, dev, buf, vb2->vb2_buf.index);
 
-	ret = vchiq_mmal_submit_buffer(dev->instance, dev->capture.port, buf);
+	ret = vchiq_mmal_submit_buffer(dev->instance, dev->capture.port,
+				       &buf->mmal);
 	if (ret < 0)
 		v4l2_err(&dev->v4l2_dev, "%s: error submitting buffer\n",
 			 __func__);
@@ -628,7 +642,7 @@ static void stop_streaming(struct vb2_queue *vq)
 	dev->capture.frame_count = 0;
 
 	/* ensure a format has actually been set */
-	if (!dev->capture.port) {
+	if (!port) {
 		v4l2_err(&dev->v4l2_dev,
 			 "no capture port - stream not started?\n");
 		return;
@@ -648,11 +662,11 @@ static void stop_streaming(struct vb2_queue *vq)
 
 	/* disable the connection from camera to encoder */
 	ret = vchiq_mmal_port_disable(dev->instance, dev->capture.camera_port);
-	if (!ret && dev->capture.camera_port != dev->capture.port) {
+	if (!ret && dev->capture.camera_port != port) {
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
 			 "disabling port\n");
-		ret = vchiq_mmal_port_disable(dev->instance, dev->capture.port);
-	} else if (dev->capture.camera_port != dev->capture.port) {
+		ret = vchiq_mmal_port_disable(dev->instance, port);
+	} else if (dev->capture.camera_port != port) {
 		v4l2_err(&dev->v4l2_dev, "port_disable failed, error %d\n",
 			 ret);
 	}
@@ -1954,7 +1968,7 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 		q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 		q->io_modes = VB2_MMAP | VB2_USERPTR | VB2_READ;
 		q->drv_priv = dev;
-		q->buf_struct_size = sizeof(struct mmal_buffer);
+		q->buf_struct_size = sizeof(struct vb2_mmal_buffer);
 		q->ops = &bm2835_mmal_video_qops;
 		q->mem_ops = &vb2_vmalloc_memops;
 		q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
index 6f56c517d850e..bce74e5bab75c 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
@@ -50,6 +50,11 @@ struct mmal_buffer {
 	unsigned long buffer_size; /* size of allocated buffer */
 
 	struct mmal_msg_context *msg_context;
+
+	unsigned long length;
+	u32 mmal_flags;
+	s64 dts;
+	s64 pts;
 };
 
 /* */
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index efed0b68bbe04..e2d229839a193 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -258,17 +258,25 @@ static void buffer_work_cb(struct work_struct *work)
 {
 	struct mmal_msg_context *msg_context =
 		container_of(work, struct mmal_msg_context, u.bulk.work);
+	struct mmal_buffer *buffer = msg_context->u.bulk.buffer;
+
+	if (!buffer) {
+		pr_err("%s: ctx: %p, No mmal buffer to pass details\n",
+		       __func__, msg_context);
+		return;
+	}
+
+	buffer->length = msg_context->u.bulk.buffer_used;
+	buffer->mmal_flags = msg_context->u.bulk.mmal_flags;
+	buffer->dts = msg_context->u.bulk.dts;
+	buffer->pts = msg_context->u.bulk.pts;
 
 	atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
 
 	msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
 					    msg_context->u.bulk.port,
 					    msg_context->u.bulk.status,
-					    msg_context->u.bulk.buffer,
-					    msg_context->u.bulk.buffer_used,
-					    msg_context->u.bulk.mmal_flags,
-					    msg_context->u.bulk.dts,
-					    msg_context->u.bulk.pts);
+					    msg_context->u.bulk.buffer);
 }
 
 /* workqueue scheduled callback to handle receiving buffers
@@ -1326,11 +1334,14 @@ static int port_disable(struct vchiq_mmal_instance *instance,
 			mmalbuf = list_entry(buf_head, struct mmal_buffer,
 					     list);
 			list_del(buf_head);
-			if (port->buffer_cb)
+			if (port->buffer_cb) {
+				mmalbuf->length = 0;
+				mmalbuf->mmal_flags = 0;
+				mmalbuf->dts = MMAL_TIME_UNKNOWN;
+				mmalbuf->pts = MMAL_TIME_UNKNOWN;
 				port->buffer_cb(instance,
-						port, 0, mmalbuf, 0, 0,
-						MMAL_TIME_UNKNOWN,
-						MMAL_TIME_UNKNOWN);
+						port, 0, mmalbuf);
+			}
 		}
 
 		spin_unlock_irqrestore(&port->slock, flags);
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index edc5d910f3a34..71631a2d76d99 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -44,8 +44,7 @@ struct vchiq_mmal_port;
 typedef void (*vchiq_mmal_buffer_cb)(
 		struct vchiq_mmal_instance  *instance,
 		struct vchiq_mmal_port *port,
-		int status, struct mmal_buffer *buffer,
-		unsigned long length, u32 mmal_flags, s64 dts, s64 pts);
+		int status, struct mmal_buffer *buffer);
 
 struct vchiq_mmal_port {
 	u32 enabled:1;
-- 
GitLab


From dd6c143d37ab8632345aa7ee6eceb8a1426f6b6f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 18:15:38 +0100
Subject: [PATCH 0272/1835] staging: mmal-vchiq: Add support for event
 callbacks.

(Preparation for the codec driver).
The codec uses the event mechanism to report things such as
resolution changes. It is signalled by the cmd field of the buffer
being non-zero.

Add support for passing this information out to the client.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/vchiq-mmal/mmal-common.h    |   1 +
 .../vc04_services/vchiq-mmal/mmal-msg.h       |  35 ++++
 .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 170 ++++++++++++++++--
 .../vc04_services/vchiq-mmal/mmal-vchiq.h     |   4 +
 4 files changed, 196 insertions(+), 14 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
index bce74e5bab75c..9cf4662c821e9 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
@@ -51,6 +51,7 @@ struct mmal_buffer {
 
 	struct mmal_msg_context *msg_context;
 
+	u32 cmd;		/* MMAL command. 0=data. */
 	unsigned long length;
 	u32 mmal_flags;
 	s64 dts;
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
index 5a3e35f94aed2..f39bbdd66e3ce 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
@@ -346,6 +346,41 @@ struct mmal_msg_port_parameter_get_reply {
 /* event messages */
 #define MMAL_WORKER_EVENT_SPACE 256
 
+/* Four CC's for events */
+#define MMAL_FOURCC(a, b, c, d) ((a) | (b << 8) | (c << 16) | (d << 24))
+
+#define MMAL_EVENT_ERROR		MMAL_FOURCC('E', 'R', 'R', 'O')
+#define MMAL_EVENT_EOS			MMAL_FOURCC('E', 'E', 'O', 'S')
+#define MMAL_EVENT_FORMAT_CHANGED	MMAL_FOURCC('E', 'F', 'C', 'H')
+#define MMAL_EVENT_PARAMETER_CHANGED	MMAL_FOURCC('E', 'P', 'C', 'H')
+
+/* Structs for each of the event message payloads */
+struct mmal_msg_event_eos {
+	u32 port_type;	/**< Type of port that received the end of stream */
+	u32 port_index;	/**< Index of port that received the end of stream */
+};
+
+/** Format changed event data. */
+struct mmal_msg_event_format_changed {
+	/* Minimum size of buffers the port requires */
+	u32 buffer_size_min;
+	/* Minimum number of buffers the port requires */
+	u32 buffer_num_min;
+	/* Size of buffers the port recommends for optimal performance.
+	 * A value of zero means no special recommendation.
+	 */
+	u32 buffer_size_recommended;
+	/* Number of buffers the port recommends for optimal
+	 * performance. A value of zero means no special recommendation.
+	 */
+	u32 buffer_num_recommended;
+
+	u32 es_ptr;
+	struct mmal_es_format format;
+	union mmal_es_specific_format es;
+	u8 extradata[MMAL_FORMAT_EXTRADATA_MAX_SIZE];
+};
+
 struct mmal_msg_event_to_host {
 	u32 client_component;	/* component context */
 
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index e2d229839a193..505b0867dd767 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -151,6 +151,8 @@ struct mmal_msg_context {
 			/* Presentation and Decode timestamps */
 			s64 pts;
 			s64 dts;
+			/* MMAL buffer command flag */
+			u32 cmd;
 
 			int status;	/* context status */
 
@@ -237,18 +239,6 @@ release_msg_context(struct mmal_msg_context *msg_context)
 	kfree(msg_context);
 }
 
-/* deals with receipt of event to host message */
-static void event_to_host_cb(struct vchiq_mmal_instance *instance,
-			     struct mmal_msg *msg, u32 msg_len)
-{
-	pr_debug("unhandled event\n");
-	pr_debug("component:%u port type:%d num:%d cmd:0x%x length:%d\n",
-		 msg->u.event_to_host.client_component,
-		 msg->u.event_to_host.port_type,
-		 msg->u.event_to_host.port_num,
-		 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
-}
-
 /* workqueue scheduled callback
  *
  * we do this because it is important we do not call any other vchiq
@@ -270,13 +260,18 @@ static void buffer_work_cb(struct work_struct *work)
 	buffer->mmal_flags = msg_context->u.bulk.mmal_flags;
 	buffer->dts = msg_context->u.bulk.dts;
 	buffer->pts = msg_context->u.bulk.pts;
+	buffer->cmd = msg_context->u.bulk.cmd;
 
-	atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
+	if (!buffer->cmd)
+		atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
 
 	msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
 					    msg_context->u.bulk.port,
 					    msg_context->u.bulk.status,
 					    msg_context->u.bulk.buffer);
+
+	if (buffer->cmd)
+		mutex_unlock(&msg_context->u.bulk.port->event_context_mutex);
 }
 
 /* workqueue scheduled callback to handle receiving buffers
@@ -355,6 +350,7 @@ static int bulk_receive(struct vchiq_mmal_instance *instance,
 	msg_context->u.bulk.buffer_used = rd_len;
 	msg_context->u.bulk.dts = msg->u.buffer_from_host.buffer_header.dts;
 	msg_context->u.bulk.pts = msg->u.buffer_from_host.buffer_header.pts;
+	msg_context->u.bulk.cmd = msg->u.buffer_from_host.buffer_header.cmd;
 
 	queue_work(msg_context->instance->bulk_wq,
 		   &msg_context->u.bulk.buffer_to_host_work);
@@ -456,6 +452,103 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 	return ret;
 }
 
+/* deals with receipt of event to host message */
+static void event_to_host_cb(struct vchiq_mmal_instance *instance,
+			     struct mmal_msg *msg, u32 msg_len)
+{
+	/* FIXME: Not going to work on 64 bit */
+	struct vchiq_mmal_component *component =
+		(struct vchiq_mmal_component *)msg->u.event_to_host.client_component;
+	struct vchiq_mmal_port *port = NULL;
+	struct mmal_msg_context *msg_context;
+	u32 port_num = msg->u.event_to_host.port_num;
+
+	if (msg->u.buffer_from_host.drvbuf.magic == MMAL_MAGIC) {
+		pr_err("%s: MMAL_MSG_TYPE_BUFFER_TO_HOST with bad magic\n",
+		       __func__);
+		return;
+	}
+
+	switch (msg->u.event_to_host.port_type) {
+	case MMAL_PORT_TYPE_CONTROL:
+		if (port_num) {
+			pr_err("%s: port_num of %u >= number of ports 1",
+			       __func__, port_num);
+			return;
+		}
+		port = &component->control;
+		break;
+	case MMAL_PORT_TYPE_INPUT:
+		if (port_num >= component->inputs) {
+			pr_err("%s: port_num of %u >= number of ports %u",
+			       __func__, port_num,
+			       port_num >= component->inputs);
+			return;
+		}
+		port = &component->input[port_num];
+		break;
+	case MMAL_PORT_TYPE_OUTPUT:
+		if (port_num >= component->outputs) {
+			pr_err("%s: port_num of %u >= number of ports %u",
+			       __func__, port_num,
+			       port_num >= component->outputs);
+			return;
+		}
+		port = &component->output[port_num];
+		break;
+	case MMAL_PORT_TYPE_CLOCK:
+		if (port_num >= component->clocks) {
+			pr_err("%s: port_num of %u >= number of ports %u",
+			       __func__, port_num,
+			       port_num >= component->clocks);
+			return;
+		}
+		port = &component->clock[port_num];
+		break;
+	default:
+		break;
+	}
+
+	if (!mutex_trylock(&port->event_context_mutex)) {
+		pr_err("dropping event 0x%x\n", msg->u.event_to_host.cmd);
+		return;
+	}
+	msg_context = port->event_context;
+
+	if (msg->h.status != MMAL_MSG_STATUS_SUCCESS) {
+		/* message reception had an error */
+		//pr_warn
+		pr_err("%s: error %d in reply\n", __func__, msg->h.status);
+
+		msg_context->u.bulk.status = msg->h.status;
+	} else if (msg->u.event_to_host.length > MMAL_WORKER_EVENT_SPACE) {
+		/* data is not in message, queue a bulk receive */
+		pr_err("%s: payload not in message - bulk receive??! NOT SUPPORTED\n",
+		       __func__);
+		msg_context->u.bulk.status = -1;
+	} else {
+		memcpy(msg_context->u.bulk.buffer->buffer,
+		       msg->u.event_to_host.data,
+		       msg->u.event_to_host.length);
+
+		msg_context->u.bulk.buffer_used =
+		    msg->u.event_to_host.length;
+
+		msg_context->u.bulk.mmal_flags = 0;
+		msg_context->u.bulk.dts = MMAL_TIME_UNKNOWN;
+		msg_context->u.bulk.pts = MMAL_TIME_UNKNOWN;
+		msg_context->u.bulk.cmd = msg->u.event_to_host.cmd;
+
+		pr_debug("event component:%u port type:%d num:%d cmd:0x%x length:%d\n",
+			 msg->u.event_to_host.client_component,
+			 msg->u.event_to_host.port_type,
+			 msg->u.event_to_host.port_num,
+			 msg->u.event_to_host.cmd, msg->u.event_to_host.length);
+	}
+
+	schedule_work(&msg_context->u.bulk.work);
+}
+
 /* deals with receipt of buffer to host message */
 static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
 			      struct mmal_msg *msg, u32 msg_len)
@@ -1339,6 +1432,7 @@ static int port_disable(struct vchiq_mmal_instance *instance,
 				mmalbuf->mmal_flags = 0;
 				mmalbuf->dts = MMAL_TIME_UNKNOWN;
 				mmalbuf->pts = MMAL_TIME_UNKNOWN;
+				mmalbuf->cmd = 0;
 				port->buffer_cb(instance,
 						port, 0, mmalbuf);
 			}
@@ -1640,6 +1734,43 @@ int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
 }
 EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
 
+static void init_event_context(struct vchiq_mmal_instance *instance,
+			       struct vchiq_mmal_port *port)
+{
+	struct mmal_msg_context *ctx = get_msg_context(instance);
+
+	mutex_init(&port->event_context_mutex);
+
+	port->event_context = ctx;
+	ctx->u.bulk.instance = instance;
+	ctx->u.bulk.port = port;
+	ctx->u.bulk.buffer =
+		kzalloc(sizeof(*ctx->u.bulk.buffer), GFP_KERNEL);
+	if (!ctx->u.bulk.buffer)
+		goto release_msg_context;
+	ctx->u.bulk.buffer->buffer = kzalloc(MMAL_WORKER_EVENT_SPACE,
+					     GFP_KERNEL);
+	if (!ctx->u.bulk.buffer->buffer)
+		goto release_buffer;
+
+	INIT_WORK(&ctx->u.bulk.work, buffer_work_cb);
+	return;
+
+release_buffer:
+	kfree(ctx->u.bulk.buffer);
+release_msg_context:
+	release_msg_context(ctx);
+}
+
+static void free_event_context(struct vchiq_mmal_port *port)
+{
+	struct mmal_msg_context *ctx = port->event_context;
+
+	kfree(ctx->u.bulk.buffer->buffer);
+	kfree(ctx->u.bulk.buffer);
+	release_msg_context(ctx);
+}
+
 /* Initialise a mmal component and its ports
  *
  */
@@ -1683,6 +1814,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 	ret = port_info_get(instance, &component->control);
 	if (ret < 0)
 		goto release_component;
+	init_event_context(instance, &component->control);
 
 	for (idx = 0; idx < component->inputs; idx++) {
 		component->input[idx].type = MMAL_PORT_TYPE_INPUT;
@@ -1693,6 +1825,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 		ret = port_info_get(instance, &component->input[idx]);
 		if (ret < 0)
 			goto release_component;
+		init_event_context(instance, &component->input[idx]);
 	}
 
 	for (idx = 0; idx < component->outputs; idx++) {
@@ -1704,6 +1837,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 		ret = port_info_get(instance, &component->output[idx]);
 		if (ret < 0)
 			goto release_component;
+		init_event_context(instance, &component->output[idx]);
 	}
 
 	for (idx = 0; idx < component->clocks; idx++) {
@@ -1715,6 +1849,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 		ret = port_info_get(instance, &component->clock[idx]);
 		if (ret < 0)
 			goto release_component;
+		init_event_context(instance, &component->clock[idx]);
 	}
 
 	*component_out = component;
@@ -1740,7 +1875,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_init);
 int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 				  struct vchiq_mmal_component *component)
 {
-	int ret;
+	int ret, idx;
 
 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
 		return -EINTR;
@@ -1752,6 +1887,13 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 
 	component->in_use = 0;
 
+	for (idx = 0; idx < component->inputs; idx++)
+		free_event_context(&component->input[idx]);
+	for (idx = 0; idx < component->outputs; idx++)
+		free_event_context(&component->output[idx]);
+	for (idx = 0; idx < component->clocks; idx++)
+		free_event_context(&component->clock[idx]);
+
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index 71631a2d76d99..e54e7bf73712f 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -78,6 +78,10 @@ struct vchiq_mmal_port {
 	vchiq_mmal_buffer_cb buffer_cb;
 	/* callback context */
 	void *cb_ctx;
+
+	/* ensure serialised use of the one event context structure */
+	struct mutex event_context_mutex;
+	struct mmal_msg_context *event_context;
 };
 
 struct vchiq_mmal_component {
-- 
GitLab


From 1a26493664d11fddcde830e98c21aff7b12d1259 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Sep 2018 18:26:02 +0100
Subject: [PATCH 0273/1835] staging: vc04_services: Support sending data to
 MMAL ports

Add the ability to send data to ports. This only supports
zero copy mode as the required bulk transfer setup calls
are not done.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/vchiq-mmal/mmal-vchiq.c      | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 505b0867dd767..7644e2367ec90 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -427,11 +427,19 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 	m.u.buffer_from_host.buffer_header.data =
 		(u32)(unsigned long)buf->buffer;
 	m.u.buffer_from_host.buffer_header.alloc_size = buf->buffer_size;
-	m.u.buffer_from_host.buffer_header.length = 0;	/* nothing used yet */
-	m.u.buffer_from_host.buffer_header.offset = 0;	/* no offset */
-	m.u.buffer_from_host.buffer_header.flags = 0;	/* no flags */
-	m.u.buffer_from_host.buffer_header.pts = MMAL_TIME_UNKNOWN;
-	m.u.buffer_from_host.buffer_header.dts = MMAL_TIME_UNKNOWN;
+	if (port->type == MMAL_PORT_TYPE_OUTPUT) {
+		m.u.buffer_from_host.buffer_header.length = 0;
+		m.u.buffer_from_host.buffer_header.offset = 0;
+		m.u.buffer_from_host.buffer_header.flags = 0;
+		m.u.buffer_from_host.buffer_header.pts = MMAL_TIME_UNKNOWN;
+		m.u.buffer_from_host.buffer_header.dts = MMAL_TIME_UNKNOWN;
+	} else {
+		m.u.buffer_from_host.buffer_header.length = buf->length;
+		m.u.buffer_from_host.buffer_header.offset = 0;
+		m.u.buffer_from_host.buffer_header.flags = buf->mmal_flags;
+		m.u.buffer_from_host.buffer_header.pts = buf->pts;
+		m.u.buffer_from_host.buffer_header.dts = buf->dts;
+	}
 
 	/* clear buffer type sepecific data */
 	memset(&m.u.buffer_from_host.buffer_header_type_specific, 0,
-- 
GitLab


From b2980458964cd6864c95222c078c572ab00624f9 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 25 Sep 2018 16:57:40 +0100
Subject: [PATCH 0274/1835] staging: vc04_services: Fixup vchiq-mmal include
 ordering

There were dependencies on including the headers in the correct
order. Fix up the headers so that they include the other
headers that they depend on themselves.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h   | 1 +
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
index f39bbdd66e3ce..0a9a6b771d0d5 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-msg.h
@@ -38,6 +38,7 @@
 #include "mmal-msg-common.h"
 #include "mmal-msg-format.h"
 #include "mmal-msg-port.h"
+#include "mmal-vchiq.h"
 
 enum mmal_msg_type {
 	MMAL_MSG_TYPE_QUIT = 1,
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index e54e7bf73712f..476cff6d60e6c 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -16,6 +16,7 @@
 #ifndef MMAL_VCHIQ_H
 #define MMAL_VCHIQ_H
 
+#include "mmal-common.h"
 #include "mmal-msg-format.h"
 
 #define MAX_PORT_COUNT 4
-- 
GitLab


From 49c6695c58a7f55015a880ac2550a2f10317a555 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 25 Sep 2018 10:27:11 +0100
Subject: [PATCH 0275/1835] staging: vc04_services: Add new vc-sm-cma driver

This new driver allows contiguous memory blocks to be imported
into the VideoCore VPU memory map, and manages the lifetime of
those objects, only releasing the source dmabuf once the VPU has
confirmed it has finished with it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/Kconfig         |   1 +
 drivers/staging/vc04_services/Makefile        |   1 +
 .../staging/vc04_services/vc-sm-cma/Kconfig   |  10 +
 .../staging/vc04_services/vc-sm-cma/Makefile  |   8 +
 drivers/staging/vc04_services/vc-sm-cma/TODO  |   2 +
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 838 ++++++++++++++++++
 .../staging/vc04_services/vc-sm-cma/vc_sm.h   |  59 ++
 .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  | 498 +++++++++++
 .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.h  |  59 ++
 .../vc04_services/vc-sm-cma/vc_sm_defs.h      | 298 +++++++
 .../vc04_services/vc-sm-cma/vc_sm_knl.h       |  28 +
 11 files changed, 1802 insertions(+)
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/Kconfig
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/Makefile
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/TODO
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h

diff --git a/drivers/staging/vc04_services/Kconfig b/drivers/staging/vc04_services/Kconfig
index 9898764c07dda..05f69070c6578 100644
--- a/drivers/staging/vc04_services/Kconfig
+++ b/drivers/staging/vc04_services/Kconfig
@@ -22,6 +22,7 @@ source "drivers/staging/vc04_services/bcm2835-audio/Kconfig"
 
 source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
 source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
+source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
 
 endif
 
diff --git a/drivers/staging/vc04_services/Makefile b/drivers/staging/vc04_services/Makefile
index 91fa00347eb79..c90ad85db4fb9 100644
--- a/drivers/staging/vc04_services/Makefile
+++ b/drivers/staging/vc04_services/Makefile
@@ -13,6 +13,7 @@ vchiq-objs := \
 obj-$(CONFIG_SND_BCM2835)	+= bcm2835-audio/
 obj-$(CONFIG_VIDEO_BCM2835)	+= bcm2835-camera/
 obj-$(CONFIG_BCM2835_VCHIQ_MMAL) += vchiq-mmal/
+obj-$(CONFIG_BCM_VC_SM_CMA) 	+= vc-sm-cma/
 
 ccflags-y += -Idrivers/staging/vc04_services -D__VCCOREVER__=0x04000000
 
diff --git a/drivers/staging/vc04_services/vc-sm-cma/Kconfig b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
new file mode 100644
index 0000000000000..bbd296f5826b4
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
@@ -0,0 +1,10 @@
+config BCM_VC_SM_CMA
+	tristate "VideoCore Shared Memory (CMA) driver"
+	depends on BCM2835_VCHIQ
+	select RBTREE
+	select DMA_SHARED_BUFFER
+	help
+	  Say Y here to enable the shared memory interface that
+	  supports sharing dmabufs with VideoCore.
+	  This operates over the VCHIQ interface to a service
+	  running on VideoCore.
diff --git a/drivers/staging/vc04_services/vc-sm-cma/Makefile b/drivers/staging/vc04_services/vc-sm-cma/Makefile
new file mode 100644
index 0000000000000..9697e116b7651
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/Makefile
@@ -0,0 +1,8 @@
+ccflags-y += -Idrivers/staging/vc04_services -Idrivers/staging/vc04_services/interface/vchi -Idrivers/staging/vc04_services/interface/vchiq_arm
+# -I"drivers/staging/android/ion/" -I"$(srctree)/fs/"
+ccflags-y += -D__VCCOREVER__=0
+
+vc-sm-cma-$(CONFIG_BCM_VC_SM_CMA) := \
+	vc_sm.o vc_sm_cma_vchi.o
+
+obj-$(CONFIG_BCM_VC_SM_CMA) += vc-sm-cma.o
diff --git a/drivers/staging/vc04_services/vc-sm-cma/TODO b/drivers/staging/vc04_services/vc-sm-cma/TODO
new file mode 100644
index 0000000000000..683c6aab40f41
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/TODO
@@ -0,0 +1,2 @@
+1) Convert to a platform driver.
+
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
new file mode 100644
index 0000000000000..b63285ff3b1fc
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -0,0 +1,838 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * VideoCore Shared Memory driver using CMA.
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ * Dave Stevenson <dave.stevenson@raspberrypi.org>
+ *
+ * Based on vmcs_sm driver from Broadcom Corporation for some API,
+ * and taking some code for CMA/dmabuf handling from the Android Ion
+ * driver (Google/Linaro).
+ *
+ * This is cut down version to only support import of dma_bufs from
+ * other kernel drivers. A more complete implementation of the old
+ * vmcs_sm functionality can follow later.
+ *
+ */
+
+/* ---- Include Files ----------------------------------------------------- */
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include <linux/proc_fs.h>
+#include <linux/slab.h>
+#include <linux/seq_file.h>
+#include <linux/syscalls.h>
+#include <linux/types.h>
+
+#include "vchiq_connected.h"
+#include "vc_sm_cma_vchi.h"
+
+#include "vc_sm.h"
+#include "vc_sm_knl.h"
+
+/* ---- Private Constants and Types --------------------------------------- */
+
+#define DEVICE_NAME		"vcsm-cma"
+#define DEVICE_MINOR		0
+
+#define VC_SM_RESOURCE_NAME_DEFAULT       "sm-host-resource"
+
+#define VC_SM_DIR_ROOT_NAME	"vcsm-cma"
+#define VC_SM_STATE		"state"
+
+/* Private file data associated with each opened device. */
+struct vc_sm_privdata_t {
+	pid_t pid;                      /* PID of creator. */
+
+	int restart_sys;		/* Tracks restart on interrupt. */
+	enum vc_sm_msg_type int_action;	/* Interrupted action. */
+	u32 int_trans_id;		/* Interrupted transaction. */
+};
+
+typedef int (*VC_SM_SHOW) (struct seq_file *s, void *v);
+struct sm_pde_t {
+	VC_SM_SHOW show;          /* Debug fs function hookup. */
+	struct dentry *dir_entry; /* Debug fs directory entry. */
+	void *priv_data;          /* Private data */
+};
+
+/* Global state information. */
+struct sm_state_t {
+	struct platform_device *pdev;
+
+	struct miscdevice dev;
+	struct sm_instance *sm_handle;	/* Handle for videocore service. */
+
+	struct mutex map_lock;          /* Global map lock. */
+	struct list_head buffer_list;	/* List of buffer. */
+
+	struct vc_sm_privdata_t *data_knl;  /* Kernel internal data tracking. */
+	struct dentry *dir_root;	/* Debug fs entries root. */
+	struct sm_pde_t dir_state;	/* Debug fs entries state sub-tree. */
+
+	bool require_released_callback;	/* VPU will send a released msg when it
+					 * has finished with a resource.
+					 */
+	u32 int_trans_id;		/* Interrupted transaction. */
+};
+
+/* ---- Private Variables ----------------------------------------------- */
+
+static struct sm_state_t *sm_state;
+static int sm_inited;
+
+/* ---- Private Function Prototypes -------------------------------------- */
+
+/* ---- Private Functions ------------------------------------------------ */
+
+static int vc_sm_cma_seq_file_show(struct seq_file *s, void *v)
+{
+	struct sm_pde_t *sm_pde;
+
+	sm_pde = (struct sm_pde_t *)(s->private);
+
+	if (sm_pde && sm_pde->show)
+		sm_pde->show(s, v);
+
+	return 0;
+}
+
+static int vc_sm_cma_single_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, vc_sm_cma_seq_file_show, inode->i_private);
+}
+
+static const struct file_operations vc_sm_cma_debug_fs_fops = {
+	.open = vc_sm_cma_single_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+
+static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
+{
+	struct vc_sm_buffer *resource = NULL;
+	int resource_count = 0;
+
+	if (!sm_state)
+		return 0;
+
+	seq_printf(s, "\nVC-ServiceHandle     0x%x\n",
+		   (unsigned int)sm_state->sm_handle);
+
+	/* Log all applicable mapping(s). */
+
+	mutex_lock(&sm_state->map_lock);
+	seq_puts(s, "\nResources\n");
+	if (!list_empty(&sm_state->buffer_list)) {
+		list_for_each_entry(resource, &sm_state->buffer_list,
+				    global_buffer_list) {
+			resource_count++;
+
+			seq_printf(s, "\nResource                %p\n",
+				   resource);
+			seq_printf(s, "           NAME         %s\n",
+				   resource->name);
+			seq_printf(s, "           SIZE         %d\n",
+				   resource->size);
+			seq_printf(s, "           DMABUF       %p\n",
+				   resource->dma_buf);
+			seq_printf(s, "           ATTACH       %p\n",
+				   resource->attach);
+			seq_printf(s, "           SG_TABLE     %p\n",
+				   resource->sg_table);
+			seq_printf(s, "           SGT          %p\n",
+				   resource->sgt);
+			seq_printf(s, "           DMA_ADDR     %pad\n",
+				   &resource->dma_addr);
+			seq_printf(s, "           VC_HANDLE     %08x\n",
+				   resource->vc_handle);
+			seq_printf(s, "           VC_MAPPING    %d\n",
+				   resource->vpu_state);
+		}
+	}
+	seq_printf(s, "\n\nTotal resource count:   %d\n\n", resource_count);
+
+	mutex_unlock(&sm_state->map_lock);
+
+	return 0;
+}
+
+/*
+ * Adds a buffer to the private data list which tracks all the allocated
+ * data.
+ */
+static void vc_sm_add_resource(struct vc_sm_privdata_t *privdata,
+			       struct vc_sm_buffer *buffer)
+{
+	mutex_lock(&sm_state->map_lock);
+	list_add(&buffer->global_buffer_list, &sm_state->buffer_list);
+	mutex_unlock(&sm_state->map_lock);
+
+	pr_debug("[%s]: added buffer %p (name %s, size %d)\n",
+		 __func__, buffer, buffer->name, buffer->size);
+}
+
+/*
+ * Release an allocation.
+ * All refcounting is done via the dma buf object.
+ */
+static void vc_sm_release_resource(struct vc_sm_buffer *buffer, int force)
+{
+	mutex_lock(&sm_state->map_lock);
+	mutex_lock(&buffer->lock);
+
+	pr_debug("[%s]: buffer %p (name %s, size %d)\n",
+		 __func__, buffer, buffer->name, buffer->size);
+
+	if (buffer->vc_handle && buffer->vpu_state == VPU_MAPPED) {
+		struct vc_sm_free_t free = { buffer->vc_handle, 0 };
+		int status = vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
+					     &sm_state->int_trans_id);
+		if (status != 0 && status != -EINTR) {
+			pr_err("[%s]: failed to free memory on videocore (status: %u, trans_id: %u)\n",
+			       __func__, status, sm_state->int_trans_id);
+		}
+
+		if (sm_state->require_released_callback) {
+			/* Need to wait for the VPU to confirm the free */
+
+			/* Retain a reference on this until the VPU has
+			 * released it
+			 */
+			buffer->vpu_state = VPU_UNMAPPING;
+			goto defer;
+		}
+		buffer->vpu_state = VPU_NOT_MAPPED;
+		buffer->vc_handle = 0;
+	}
+	if (buffer->vc_handle) {
+		/* We've sent the unmap request but not had the response. */
+		pr_err("[%s]: Waiting for VPU unmap response on %p\n",
+		       __func__, buffer);
+		goto defer;
+	}
+	if (buffer->in_use) {
+		/* Don't release dmabuf here - we await the release */
+		pr_err("[%s]: buffer %p is still in use\n",
+		       __func__, buffer);
+		goto defer;
+	}
+
+	/* Handle cleaning up imported dmabufs */
+	if (buffer->sgt) {
+		dma_buf_unmap_attachment(buffer->attach, buffer->sgt,
+					 DMA_BIDIRECTIONAL);
+		buffer->sgt = NULL;
+	}
+	if (buffer->attach) {
+		dma_buf_detach(buffer->dma_buf, buffer->attach);
+		buffer->attach = NULL;
+	}
+
+	/* Release the dma_buf (whether ours or imported) */
+	if (buffer->import_dma_buf) {
+		dma_buf_put(buffer->import_dma_buf);
+		buffer->import_dma_buf = NULL;
+		buffer->dma_buf = NULL;
+	} else if (buffer->dma_buf) {
+		dma_buf_put(buffer->dma_buf);
+		buffer->dma_buf = NULL;
+	}
+
+	if (buffer->sg_table && !buffer->import_dma_buf) {
+		/* Our own allocation that we need to dma_unmap_sg */
+		dma_unmap_sg(&sm_state->pdev->dev, buffer->sg_table->sgl,
+			     buffer->sg_table->nents, DMA_BIDIRECTIONAL);
+	}
+
+	/* Free the local resource. Start by removing it from the list */
+	buffer->private = NULL;
+	list_del(&buffer->global_buffer_list);
+
+	mutex_unlock(&buffer->lock);
+	mutex_unlock(&sm_state->map_lock);
+
+	mutex_destroy(&buffer->lock);
+
+	kfree(buffer);
+	return;
+
+defer:
+	mutex_unlock(&buffer->lock);
+	mutex_unlock(&sm_state->map_lock);
+}
+
+/* Create support for private data tracking. */
+static struct vc_sm_privdata_t *vc_sm_cma_create_priv_data(pid_t id)
+{
+	char alloc_name[32];
+	struct vc_sm_privdata_t *file_data = NULL;
+
+	/* Allocate private structure. */
+	file_data = kzalloc(sizeof(*file_data), GFP_KERNEL);
+
+	if (!file_data)
+		return NULL;
+
+	snprintf(alloc_name, sizeof(alloc_name), "%d", id);
+
+	file_data->pid = id;
+
+	return file_data;
+}
+
+/* Dma_buf operations for chaining through to an imported dma_buf */
+static
+int vc_sm_import_dma_buf_attach(struct dma_buf *dmabuf,
+				struct dma_buf_attachment *attachment)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return -EINVAL;
+	return res->import_dma_buf->ops->attach(res->import_dma_buf,
+						attachment);
+}
+
+static
+void vc_sm_import_dma_buf_detatch(struct dma_buf *dmabuf,
+				  struct dma_buf_attachment *attachment)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return;
+	res->import_dma_buf->ops->detach(res->import_dma_buf, attachment);
+}
+
+static
+struct sg_table *vc_sm_import_map_dma_buf(struct dma_buf_attachment *attachment,
+					  enum dma_data_direction direction)
+{
+	struct vc_sm_buffer *res = attachment->dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return NULL;
+	return res->import_dma_buf->ops->map_dma_buf(attachment, direction);
+}
+
+static
+void vc_sm_import_unmap_dma_buf(struct dma_buf_attachment *attachment,
+				struct sg_table *table,
+				enum dma_data_direction direction)
+{
+	struct vc_sm_buffer *res = attachment->dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return;
+	res->import_dma_buf->ops->unmap_dma_buf(attachment, table, direction);
+}
+
+static
+int vc_sm_import_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	pr_debug("%s: mmap dma_buf %p, res %p, imported db %p\n", __func__,
+		 dmabuf, res, res->import_dma_buf);
+	if (!res->import_dma_buf) {
+		pr_err("%s: mmap dma_buf %p- not an imported buffer\n",
+		       __func__, dmabuf);
+		return -EINVAL;
+	}
+	return res->import_dma_buf->ops->mmap(res->import_dma_buf, vma);
+}
+
+static
+void vc_sm_import_dma_buf_release(struct dma_buf *dmabuf)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	pr_debug("%s: Relasing dma_buf %p\n", __func__, dmabuf);
+	if (!res->import_dma_buf)
+		return;
+
+	res->in_use = 0;
+
+	vc_sm_release_resource(res, 0);
+}
+
+static
+void *vc_sm_import_dma_buf_kmap(struct dma_buf *dmabuf,
+				unsigned long offset)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return NULL;
+	return res->import_dma_buf->ops->map(res->import_dma_buf,
+						      offset);
+}
+
+static
+void vc_sm_import_dma_buf_kunmap(struct dma_buf *dmabuf,
+				 unsigned long offset, void *ptr)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return;
+	res->import_dma_buf->ops->unmap(res->import_dma_buf,
+					       offset, ptr);
+}
+
+static
+int vc_sm_import_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
+					  enum dma_data_direction direction)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return -EINVAL;
+	return res->import_dma_buf->ops->begin_cpu_access(res->import_dma_buf,
+							    direction);
+}
+
+static
+int vc_sm_import_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
+					enum dma_data_direction direction)
+{
+	struct vc_sm_buffer *res = dmabuf->priv;
+
+	if (!res->import_dma_buf)
+		return -EINVAL;
+	return res->import_dma_buf->ops->end_cpu_access(res->import_dma_buf,
+							  direction);
+}
+
+static const struct dma_buf_ops dma_buf_import_ops = {
+	.map_dma_buf = vc_sm_import_map_dma_buf,
+	.unmap_dma_buf = vc_sm_import_unmap_dma_buf,
+	.mmap = vc_sm_import_dmabuf_mmap,
+	.release = vc_sm_import_dma_buf_release,
+	.attach = vc_sm_import_dma_buf_attach,
+	.detach = vc_sm_import_dma_buf_detatch,
+	.begin_cpu_access = vc_sm_import_dma_buf_begin_cpu_access,
+	.end_cpu_access = vc_sm_import_dma_buf_end_cpu_access,
+	.map = vc_sm_import_dma_buf_kmap,
+	.unmap = vc_sm_import_dma_buf_kunmap,
+};
+
+/* Import a dma_buf to be shared with VC. */
+int
+vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
+				 struct dma_buf *dma_buf,
+				 struct dma_buf **imported_buf)
+{
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct vc_sm_buffer *buffer = NULL;
+	struct vc_sm_import import = { };
+	struct vc_sm_import_result result = { };
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *sgt = NULL;
+	int ret = 0;
+	int status;
+
+	/* Setup our allocation parameters */
+	pr_debug("%s: importing dma_buf %p\n", __func__, dma_buf);
+
+	get_dma_buf(dma_buf);
+	dma_buf = dma_buf;
+
+	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
+	if (IS_ERR(attach)) {
+		ret = PTR_ERR(attach);
+		goto error;
+	}
+
+	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+	if (IS_ERR(sgt)) {
+		ret = PTR_ERR(sgt);
+		goto error;
+	}
+
+	/* Verify that the address block is contiguous */
+	if (sgt->nents != 1) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	/* Allocate local buffer to track this allocation. */
+	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+	if (!buffer) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	import.type = VC_SM_ALLOC_NON_CACHED;
+	import.addr = (uint32_t)sg_dma_address(sgt->sgl);
+	if ((import.addr & 0xC0000000) != 0xC0000000) {
+		pr_err("%s: Expecting an uncached alias for dma_addr %08x\n",
+		       __func__, import.addr);
+		import.addr |= 0xC0000000;
+	}
+	import.size = sg_dma_len(sgt->sgl);
+	import.allocator = current->tgid;
+	import.kernel_id = (uint32_t)buffer;	//FIXME: 64 bit support needed.
+
+	memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
+	       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
+
+	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %p, size %u\n",
+		 __func__, import.name, import.type, (void *)import.addr,
+		 import.size);
+
+	/* Allocate the videocore buffer. */
+	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
+				       &sm_state->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
+			 __func__, sm_state->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_IMPORT;
+		goto error;
+	} else if (status || !result.res_handle) {
+		pr_debug("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
+			 __func__, status, sm_state->int_trans_id);
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	mutex_init(&buffer->lock);
+	INIT_LIST_HEAD(&buffer->attachments);
+	memcpy(buffer->name, import.name,
+	       min(sizeof(buffer->name), sizeof(import.name) - 1));
+
+	/* Keep track of the buffer we created. */
+	buffer->private = private;
+	buffer->vc_handle = result.res_handle;
+	buffer->size = import.size;
+	buffer->vpu_state = VPU_MAPPED;
+
+	buffer->import_dma_buf = dma_buf;
+
+	buffer->attach = attach;
+	buffer->sgt = sgt;
+	buffer->dma_addr = sg_dma_address(sgt->sgl);
+	buffer->in_use = 1;
+
+	/*
+	 * We're done - we need to export a new dmabuf chaining through most
+	 * functions, but enabling us to release our own internal references
+	 * here.
+	 */
+	exp_info.ops = &dma_buf_import_ops;
+	exp_info.size = import.size;
+	exp_info.flags = O_RDWR;
+	exp_info.priv = buffer;
+
+	buffer->dma_buf = dma_buf_export(&exp_info);
+	if (IS_ERR(buffer->dma_buf)) {
+		ret = PTR_ERR(buffer->dma_buf);
+		goto error;
+	}
+
+	vc_sm_add_resource(private, buffer);
+
+	*imported_buf = buffer->dma_buf;
+
+	return 0;
+
+error:
+	if (result.res_handle) {
+		struct vc_sm_free_t free = { result.res_handle, 0 };
+
+		vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
+				    &sm_state->int_trans_id);
+	}
+	kfree(buffer);
+	if (sgt)
+		dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
+	if (attach)
+		dma_buf_detach(dma_buf, attach);
+	dma_buf_put(dma_buf);
+	return ret;
+}
+
+/* FIXME: Pass a function pointer to this into vc_vchi_sm.c */
+void
+vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
+		int reply_len)
+{
+	switch (reply->trans_id & ~0x80000000) {
+	case VC_SM_MSG_TYPE_CLIENT_VERSION:
+	{
+		/* Acknowledge that the firmware supports the version command */
+		pr_debug("%s: firmware acked version msg. Require release cb\n",
+			 __func__);
+		sm_state->require_released_callback = true;
+	}
+	break;
+	case VC_SM_MSG_TYPE_RELEASED:
+	{
+		struct vc_sm_released *release = (struct vc_sm_released *)reply;
+		struct vc_sm_buffer *buffer =
+				(struct vc_sm_buffer *)release->kernel_id;
+
+		/*
+		 * FIXME: Need to check buffer is still valid and allocated
+		 * before continuing
+		 */
+		pr_debug("%s: Released addr %08x, size %u, id %08x, mem_handle %08x\n",
+			 __func__, release->addr, release->size,
+			 release->kernel_id, release->vc_handle);
+		mutex_lock(&buffer->lock);
+		buffer->vc_handle = 0;
+		buffer->vpu_state = VPU_NOT_MAPPED;
+		mutex_unlock(&buffer->lock);
+
+		vc_sm_release_resource(buffer, 0);
+	}
+	break;
+	default:
+		pr_err("%s: Unknown vpu cmd %x\n", __func__, reply->trans_id);
+		break;
+	}
+}
+
+/* Videocore connected.  */
+static void vc_sm_connected_init(void)
+{
+	int ret;
+	VCHI_INSTANCE_T vchi_instance;
+	struct vc_sm_version version;
+	struct vc_sm_result_t version_result;
+
+	pr_info("[%s]: start\n", __func__);
+
+	/*
+	 * Initialize and create a VCHI connection for the shared memory service
+	 * running on videocore.
+	 */
+	ret = vchi_initialise(&vchi_instance);
+	if (ret) {
+		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
+		       __func__, ret);
+
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
+	ret = vchi_connect(vchi_instance);
+	if (ret) {
+		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
+		       __func__, ret);
+
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
+	/* Initialize an instance of the shared memory service. */
+	sm_state->sm_handle = vc_sm_cma_vchi_init(vchi_instance, 1,
+						  vc_sm_vpu_event);
+	if (!sm_state->sm_handle) {
+		pr_err("[%s]: failed to initialize shared memory service\n",
+		       __func__);
+
+		ret = -EPERM;
+		goto err_free_mem;
+	}
+
+	/* Create a debug fs directory entry (root). */
+	sm_state->dir_root = debugfs_create_dir(VC_SM_DIR_ROOT_NAME, NULL);
+	if (!sm_state->dir_root) {
+		pr_err("[%s]: failed to create \'%s\' directory entry\n",
+		       __func__, VC_SM_DIR_ROOT_NAME);
+
+		ret = -EPERM;
+		goto err_stop_sm_service;
+	}
+
+	sm_state->dir_state.show = &vc_sm_cma_global_state_show;
+	sm_state->dir_state.dir_entry =
+		debugfs_create_file(VC_SM_STATE, 0444, sm_state->dir_root,
+				    &sm_state->dir_state,
+				    &vc_sm_cma_debug_fs_fops);
+
+	INIT_LIST_HEAD(&sm_state->buffer_list);
+
+	sm_state->data_knl = vc_sm_cma_create_priv_data(0);
+	if (!sm_state->data_knl) {
+		pr_err("[%s]: failed to create kernel private data tracker\n",
+		       __func__);
+		goto err_remove_shared_memory;
+	}
+
+	version.version = 1;
+	ret = vc_sm_cma_vchi_client_version(sm_state->sm_handle, &version,
+					    &version_result,
+					    &sm_state->int_trans_id);
+	if (ret) {
+		pr_err("[%s]: Failed to send version request %d\n", __func__,
+		       ret);
+	}
+
+	/* Done! */
+	sm_inited = 1;
+	pr_info("[%s]: installed successfully\n", __func__);
+	return;
+
+err_remove_shared_memory:
+	debugfs_remove_recursive(sm_state->dir_root);
+err_stop_sm_service:
+	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
+err_free_mem:
+	kfree(sm_state);
+	pr_info("[%s]: failed, ret %d\n", __func__, ret);
+}
+
+/* Driver loading. */
+static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	int err;
+
+	pr_info("%s: Videocore shared memory driver\n", __func__);
+
+	sm_state = kzalloc(sizeof(*sm_state), GFP_KERNEL);
+	if (!sm_state)
+		return -ENOMEM;
+	sm_state->pdev = pdev;
+	mutex_init(&sm_state->map_lock);
+
+	dev->coherent_dma_mask = DMA_BIT_MASK(32);
+	dev->dma_mask = &dev->coherent_dma_mask;
+	err = of_dma_configure(dev, NULL, true);
+	if (err) {
+		dev_err(dev, "Unable to setup DMA: %d\n", err);
+		return err;
+	}
+
+	vchiq_add_connected_callback(vc_sm_connected_init);
+	return 0;
+}
+
+/* Driver unloading. */
+static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
+{
+	pr_debug("[%s]: start\n", __func__);
+	if (sm_inited) {
+		/* Remove shared memory device. */
+		misc_deregister(&sm_state->dev);
+
+		/* Remove all proc entries. */
+		//debugfs_remove_recursive(sm_state->dir_root);
+
+		/* Stop the videocore shared memory service. */
+		vc_sm_cma_vchi_stop(&sm_state->sm_handle);
+
+		/* Free the memory for the state structure. */
+		mutex_destroy(&sm_state->map_lock);
+		kfree(sm_state);
+	}
+
+	pr_debug("[%s]: end\n", __func__);
+	return 0;
+}
+
+/* Get an internal resource handle mapped from the external one. */
+int vc_sm_cma_int_handle(int handle)
+{
+	struct dma_buf *dma_buf = (struct dma_buf *)handle;
+	struct vc_sm_buffer *res;
+
+	/* Validate we can work with this device. */
+	if (!sm_state || !handle) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return 0;
+	}
+
+	res = (struct vc_sm_buffer *)dma_buf->priv;
+	return res->vc_handle;
+}
+EXPORT_SYMBOL_GPL(vc_sm_cma_int_handle);
+
+/* Free a previously allocated shared memory handle and block. */
+int vc_sm_cma_free(int handle)
+{
+	struct dma_buf *dma_buf = (struct dma_buf *)handle;
+
+	/* Validate we can work with this device. */
+	if (!sm_state || !handle) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	pr_debug("%s: handle %08x/dmabuf %p\n", __func__, handle, dma_buf);
+
+	dma_buf_put(dma_buf);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(vc_sm_cma_free);
+
+/* Import a dmabuf to be shared with VC. */
+int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, int *handle)
+{
+	struct dma_buf *new_dma_buf;
+	struct vc_sm_buffer *res;
+	int ret;
+
+	/* Validate we can work with this device. */
+	if (!sm_state || !src_dmabuf || !handle) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ret = vc_sm_cma_import_dmabuf_internal(sm_state->data_knl, src_dmabuf,
+					       &new_dma_buf);
+
+	if (!ret) {
+		pr_debug("%s: imported to ptr %p\n", __func__, new_dma_buf);
+		res = (struct vc_sm_buffer *)new_dma_buf->priv;
+
+		/* Assign valid handle at this time.*/
+		*handle = (int)new_dma_buf;
+	} else {
+		/*
+		 * succeeded in importing the dma_buf, but then
+		 * failed to look it up again. How?
+		 * Release the fd again.
+		 */
+		pr_err("%s: imported vc_sm_cma_get_buffer failed %d\n",
+		       __func__, ret);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_cma_import_dmabuf);
+
+static struct platform_driver bcm2835_vcsm_cma_driver = {
+	.probe = bcm2835_vc_sm_cma_probe,
+	.remove = bcm2835_vc_sm_cma_remove,
+	.driver = {
+		   .name = DEVICE_NAME,
+		   .owner = THIS_MODULE,
+		   },
+};
+
+module_platform_driver(bcm2835_vcsm_cma_driver);
+
+MODULE_AUTHOR("Dave Stevenson");
+MODULE_DESCRIPTION("VideoCore CMA Shared Memory Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:vcsm-cma");
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
new file mode 100644
index 0000000000000..2ea105abf9278
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * VideoCore Shared Memory driver using CMA.
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ *
+ */
+
+#ifndef VC_SM_H
+#define VC_SM_H
+
+#include <linux/device.h>
+#include <linux/dma-direction.h>
+#include <linux/kref.h>
+#include <linux/mm_types.h>
+#include <linux/mutex.h>
+#include <linux/rbtree.h>
+#include <linux/sched.h>
+#include <linux/shrinker.h>
+#include <linux/types.h>
+#include <linux/miscdevice.h>
+
+#define VC_SM_MAX_NAME_LEN 32
+
+enum vc_sm_vpu_mapping_state {
+	VPU_NOT_MAPPED,
+	VPU_MAPPED,
+	VPU_UNMAPPING
+};
+
+struct vc_sm_buffer {
+	struct list_head global_buffer_list;	/* Global list of buffers. */
+
+	size_t size;
+
+	/* Lock over all the following state for this buffer */
+	struct mutex lock;
+	struct sg_table *sg_table;
+	struct list_head attachments;
+
+	char name[VC_SM_MAX_NAME_LEN];
+
+	int in_use:1;	/* Kernel is still using this resource */
+
+	enum vc_sm_vpu_mapping_state vpu_state;
+	u32 vc_handle;	/* VideoCore handle for this buffer */
+
+	/* DMABUF related fields */
+	struct dma_buf *import_dma_buf;
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *sgt;
+	dma_addr_t dma_addr;
+
+	struct vc_sm_privdata_t *private;
+};
+
+#endif
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
new file mode 100644
index 0000000000000..7a5c2fd76c45f
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
@@ -0,0 +1,498 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * VideoCore Shared Memory CMA allocator
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
+ *
+ * Based on vmcs_sm driver from Broadcom Corporation.
+ *
+ */
+
+/* ---- Include Files ----------------------------------------------------- */
+#include <linux/completion.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/semaphore.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include "vc_sm_cma_vchi.h"
+
+#define VC_SM_VER  1
+#define VC_SM_MIN_VER 0
+
+/* ---- Private Constants and Types -------------------------------------- */
+
+/* Command blocks come from a pool */
+#define SM_MAX_NUM_CMD_RSP_BLKS 32
+
+struct sm_cmd_rsp_blk {
+	struct list_head head;	/* To create lists */
+	/* To be signaled when the response is there */
+	struct completion cmplt;
+
+	u16 id;
+	u16 length;
+
+	u8 msg[VC_SM_MAX_MSG_LEN];
+
+	uint32_t wait:1;
+	uint32_t sent:1;
+	uint32_t alloc:1;
+
+};
+
+struct sm_instance {
+	u32 num_connections;
+	VCHI_SERVICE_HANDLE_T vchi_handle[VCHI_MAX_NUM_CONNECTIONS];
+	struct task_struct *io_thread;
+	struct completion io_cmplt;
+
+	vpu_event_cb vpu_event;
+
+	/* Mutex over the following lists */
+	struct mutex lock;
+	u32 trans_id;
+	struct list_head cmd_list;
+	struct list_head rsp_list;
+	struct list_head dead_list;
+
+	struct sm_cmd_rsp_blk free_blk[SM_MAX_NUM_CMD_RSP_BLKS];
+
+	/* Mutex over the free_list */
+	struct mutex free_lock;
+	struct list_head free_list;
+
+	struct semaphore free_sema;
+
+};
+
+/* ---- Private Variables ------------------------------------------------ */
+
+/* ---- Private Function Prototypes -------------------------------------- */
+
+/* ---- Private Functions ------------------------------------------------ */
+static int
+bcm2835_vchi_msg_queue(VCHI_SERVICE_HANDLE_T handle,
+		       void *data,
+		       unsigned int size)
+{
+	return vchi_queue_kernel_message(handle,
+					 data,
+					 size);
+}
+
+static struct
+sm_cmd_rsp_blk *vc_vchi_cmd_create(struct sm_instance *instance,
+				   enum vc_sm_msg_type id, void *msg,
+				   u32 size, int wait)
+{
+	struct sm_cmd_rsp_blk *blk;
+	struct vc_sm_msg_hdr_t *hdr;
+
+	if (down_interruptible(&instance->free_sema)) {
+		blk = kmalloc(sizeof(*blk), GFP_KERNEL);
+		if (!blk)
+			return NULL;
+
+		blk->alloc = 1;
+		init_completion(&blk->cmplt);
+	} else {
+		mutex_lock(&instance->free_lock);
+		blk =
+		    list_first_entry(&instance->free_list,
+				     struct sm_cmd_rsp_blk, head);
+		list_del(&blk->head);
+		mutex_unlock(&instance->free_lock);
+	}
+
+	blk->sent = 0;
+	blk->wait = wait;
+	blk->length = sizeof(*hdr) + size;
+
+	hdr = (struct vc_sm_msg_hdr_t *)blk->msg;
+	hdr->type = id;
+	mutex_lock(&instance->lock);
+	instance->trans_id++;
+	/*
+	 * Retain the top bit for identifying asynchronous events, or VPU cmds.
+	 */
+	instance->trans_id &= ~0x80000000;
+	hdr->trans_id = instance->trans_id;
+	blk->id = instance->trans_id;
+	mutex_unlock(&instance->lock);
+
+	if (size)
+		memcpy(hdr->body, msg, size);
+
+	return blk;
+}
+
+static void
+vc_vchi_cmd_delete(struct sm_instance *instance, struct sm_cmd_rsp_blk *blk)
+{
+	if (blk->alloc) {
+		kfree(blk);
+		return;
+	}
+
+	mutex_lock(&instance->free_lock);
+	list_add(&blk->head, &instance->free_list);
+	mutex_unlock(&instance->free_lock);
+	up(&instance->free_sema);
+}
+
+static void vc_sm_cma_vchi_rx_ack(struct sm_instance *instance,
+				  struct sm_cmd_rsp_blk *cmd,
+				  struct vc_sm_result_t *reply,
+				  u32 reply_len)
+{
+	mutex_lock(&instance->lock);
+	list_for_each_entry(cmd,
+			    &instance->rsp_list,
+			    head) {
+		if (cmd->id == reply->trans_id)
+			break;
+	}
+	mutex_unlock(&instance->lock);
+
+	if (&cmd->head == &instance->rsp_list) {
+		//pr_debug("%s: received response %u, throw away...",
+		pr_err("%s: received response %u, throw away...",
+		       __func__,
+		       reply->trans_id);
+	} else if (reply_len > sizeof(cmd->msg)) {
+		pr_err("%s: reply too big (%u) %u, throw away...",
+		       __func__, reply_len,
+		     reply->trans_id);
+	} else {
+		memcpy(cmd->msg, reply,
+		       reply_len);
+		complete(&cmd->cmplt);
+	}
+}
+
+static int vc_sm_cma_vchi_videocore_io(void *arg)
+{
+	struct sm_instance *instance = arg;
+	struct sm_cmd_rsp_blk *cmd = NULL, *cmd_tmp;
+	struct vc_sm_result_t *reply;
+	u32 reply_len;
+	s32 status;
+	int svc_use = 1;
+
+	while (1) {
+		if (svc_use)
+			vchi_service_release(instance->vchi_handle[0]);
+		svc_use = 0;
+		if (!wait_for_completion_interruptible(&instance->io_cmplt)) {
+			vchi_service_use(instance->vchi_handle[0]);
+			svc_use = 1;
+
+			do {
+				/*
+				 * Get new command and move it to response list
+				 */
+				mutex_lock(&instance->lock);
+				if (list_empty(&instance->cmd_list)) {
+					/* no more commands to process */
+					mutex_unlock(&instance->lock);
+					break;
+				}
+				cmd =
+				    list_first_entry(&instance->cmd_list,
+						     struct sm_cmd_rsp_blk,
+						     head);
+				list_move(&cmd->head, &instance->rsp_list);
+				cmd->sent = 1;
+				mutex_unlock(&instance->lock);
+
+				/* Send the command */
+				status = bcm2835_vchi_msg_queue(
+						instance->vchi_handle[0],
+						cmd->msg, cmd->length);
+				if (status) {
+					pr_err("%s: failed to queue message (%d)",
+					       __func__, status);
+				}
+
+				/* If no reply is needed then we're done */
+				if (!cmd->wait) {
+					mutex_lock(&instance->lock);
+					list_del(&cmd->head);
+					mutex_unlock(&instance->lock);
+					vc_vchi_cmd_delete(instance, cmd);
+					continue;
+				}
+
+				if (status) {
+					complete(&cmd->cmplt);
+					continue;
+				}
+
+			} while (1);
+
+			while (!vchi_msg_peek(instance->vchi_handle[0],
+					      (void **)&reply, &reply_len,
+					      VCHI_FLAGS_NONE)) {
+				if (reply->trans_id & 0x80000000) {
+					/* Async event or cmd from the VPU */
+					if (instance->vpu_event)
+						instance->vpu_event(
+							instance, reply,
+							reply_len);
+				} else {
+					vc_sm_cma_vchi_rx_ack(instance, cmd,
+							      reply, reply_len);
+				}
+
+				vchi_msg_remove(instance->vchi_handle[0]);
+			}
+
+			/* Go through the dead list and free them */
+			mutex_lock(&instance->lock);
+			list_for_each_entry_safe(cmd, cmd_tmp,
+						 &instance->dead_list, head) {
+				list_del(&cmd->head);
+				vc_vchi_cmd_delete(instance, cmd);
+			}
+			mutex_unlock(&instance->lock);
+		}
+	}
+
+	return 0;
+}
+
+static void vc_sm_cma_vchi_callback(void *param,
+				    const VCHI_CALLBACK_REASON_T reason,
+				    void *msg_handle)
+{
+	struct sm_instance *instance = param;
+
+	(void)msg_handle;
+
+	switch (reason) {
+	case VCHI_CALLBACK_MSG_AVAILABLE:
+		complete(&instance->io_cmplt);
+		break;
+
+	case VCHI_CALLBACK_SERVICE_CLOSED:
+		pr_info("%s: service CLOSED!!", __func__);
+	default:
+		break;
+	}
+}
+
+struct sm_instance *vc_sm_cma_vchi_init(VCHI_INSTANCE_T vchi_instance,
+					unsigned int num_connections,
+					vpu_event_cb vpu_event)
+{
+	u32 i;
+	struct sm_instance *instance;
+	int status;
+
+	pr_debug("%s: start", __func__);
+
+	if (num_connections > VCHI_MAX_NUM_CONNECTIONS) {
+		pr_err("%s: unsupported number of connections %u (max=%u)",
+		       __func__, num_connections, VCHI_MAX_NUM_CONNECTIONS);
+
+		goto err_null;
+	}
+	/* Allocate memory for this instance */
+	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
+
+	/* Misc initialisations */
+	mutex_init(&instance->lock);
+	init_completion(&instance->io_cmplt);
+	INIT_LIST_HEAD(&instance->cmd_list);
+	INIT_LIST_HEAD(&instance->rsp_list);
+	INIT_LIST_HEAD(&instance->dead_list);
+	INIT_LIST_HEAD(&instance->free_list);
+	sema_init(&instance->free_sema, SM_MAX_NUM_CMD_RSP_BLKS);
+	mutex_init(&instance->free_lock);
+	for (i = 0; i < SM_MAX_NUM_CMD_RSP_BLKS; i++) {
+		init_completion(&instance->free_blk[i].cmplt);
+		list_add(&instance->free_blk[i].head, &instance->free_list);
+	}
+
+	/* Open the VCHI service connections */
+	instance->num_connections = num_connections;
+	for (i = 0; i < num_connections; i++) {
+		SERVICE_CREATION_T params = {
+			.version = VCHI_VERSION_EX(VC_SM_VER, VC_SM_MIN_VER),
+			.service_id = VC_SM_SERVER_NAME,
+			.callback = vc_sm_cma_vchi_callback,
+			.callback_param = instance,
+		};
+
+		status = vchi_service_open(vchi_instance,
+					   &params, &instance->vchi_handle[i]);
+		if (status) {
+			pr_err("%s: failed to open VCHI service (%d)",
+			       __func__, status);
+
+			goto err_close_services;
+		}
+	}
+
+	/* Create the thread which takes care of all io to/from videoocore. */
+	instance->io_thread = kthread_create(&vc_sm_cma_vchi_videocore_io,
+					     (void *)instance, "SMIO");
+	if (!instance->io_thread) {
+		pr_err("%s: failed to create SMIO thread", __func__);
+
+		goto err_close_services;
+	}
+	instance->vpu_event = vpu_event;
+	set_user_nice(instance->io_thread, -10);
+	wake_up_process(instance->io_thread);
+
+	pr_debug("%s: success - instance 0x%x", __func__,
+		 (unsigned int)instance);
+	return instance;
+
+err_close_services:
+	for (i = 0; i < instance->num_connections; i++) {
+		if (instance->vchi_handle[i])
+			vchi_service_close(instance->vchi_handle[i]);
+	}
+	kfree(instance);
+err_null:
+	pr_debug("%s: FAILED", __func__);
+	return NULL;
+}
+
+int vc_sm_cma_vchi_stop(struct sm_instance **handle)
+{
+	struct sm_instance *instance;
+	u32 i;
+
+	if (!handle) {
+		pr_err("%s: invalid pointer to handle %p", __func__, handle);
+		goto lock;
+	}
+
+	if (!*handle) {
+		pr_err("%s: invalid handle %p", __func__, *handle);
+		goto lock;
+	}
+
+	instance = *handle;
+
+	/* Close all VCHI service connections */
+	for (i = 0; i < instance->num_connections; i++) {
+		s32 success;
+
+		vchi_service_use(instance->vchi_handle[i]);
+
+		success = vchi_service_close(instance->vchi_handle[i]);
+	}
+
+	kfree(instance);
+
+	*handle = NULL;
+	return 0;
+
+lock:
+	return -EINVAL;
+}
+
+static int vc_sm_cma_vchi_send_msg(struct sm_instance *handle,
+				   enum vc_sm_msg_type msg_id, void *msg,
+				   u32 msg_size, void *result, u32 result_size,
+				   u32 *cur_trans_id, u8 wait_reply)
+{
+	int status = 0;
+	struct sm_instance *instance = handle;
+	struct sm_cmd_rsp_blk *cmd_blk;
+
+	if (!handle) {
+		pr_err("%s: invalid handle", __func__);
+		return -EINVAL;
+	}
+	if (!msg) {
+		pr_err("%s: invalid msg pointer", __func__);
+		return -EINVAL;
+	}
+
+	cmd_blk =
+	    vc_vchi_cmd_create(instance, msg_id, msg, msg_size, wait_reply);
+	if (!cmd_blk) {
+		pr_err("[%s]: failed to allocate global tracking resource",
+		       __func__);
+		return -ENOMEM;
+	}
+
+	if (cur_trans_id)
+		*cur_trans_id = cmd_blk->id;
+
+	mutex_lock(&instance->lock);
+	list_add_tail(&cmd_blk->head, &instance->cmd_list);
+	mutex_unlock(&instance->lock);
+	complete(&instance->io_cmplt);
+
+	if (!wait_reply)
+		/* We're done */
+		return 0;
+
+	/* Wait for the response */
+	if (wait_for_completion_interruptible(&cmd_blk->cmplt)) {
+		mutex_lock(&instance->lock);
+		if (!cmd_blk->sent) {
+			list_del(&cmd_blk->head);
+			mutex_unlock(&instance->lock);
+			vc_vchi_cmd_delete(instance, cmd_blk);
+			return -ENXIO;
+		}
+
+		list_move(&cmd_blk->head, &instance->dead_list);
+		mutex_unlock(&instance->lock);
+		complete(&instance->io_cmplt);
+		return -EINTR;	/* We're done */
+	}
+
+	if (result && result_size) {
+		memcpy(result, cmd_blk->msg, result_size);
+	} else {
+		struct vc_sm_result_t *res =
+			(struct vc_sm_result_t *)cmd_blk->msg;
+		status = (res->success == 0) ? 0 : -ENXIO;
+	}
+
+	mutex_lock(&instance->lock);
+	list_del(&cmd_blk->head);
+	mutex_unlock(&instance->lock);
+	vc_vchi_cmd_delete(instance, cmd_blk);
+	return status;
+}
+
+int vc_sm_cma_vchi_free(struct sm_instance *handle, struct vc_sm_free_t *msg,
+			u32 *cur_trans_id)
+{
+	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_FREE,
+				   msg, sizeof(*msg), 0, 0, cur_trans_id, 0);
+}
+
+int vc_sm_cma_vchi_import(struct sm_instance *handle, struct vc_sm_import *msg,
+			  struct vc_sm_import_result *result, u32 *cur_trans_id)
+{
+	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_IMPORT,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
+
+int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
+				  struct vc_sm_version *msg,
+				  struct vc_sm_result_t *result,
+				  u32 *cur_trans_id)
+{
+	return vc_sm_cma_vchi_send_msg(handle, VC_SM_MSG_TYPE_CLIENT_VERSION,
+				   //msg, sizeof(*msg), result, sizeof(*result),
+				   //cur_trans_id, 1);
+				   msg, sizeof(*msg), NULL, 0,
+				   cur_trans_id, 0);
+}
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
new file mode 100644
index 0000000000000..17dbb2c071612
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * VideoCore Shared Memory CMA allocator
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
+ *
+ * Based on vmcs_sm driver from Broadcom Corporation.
+ *
+ */
+
+#ifndef __VC_SM_CMA_VCHI_H__INCLUDED__
+#define __VC_SM_CMA_VCHI_H__INCLUDED__
+
+#include "interface/vchi/vchi.h"
+
+#include "vc_sm_defs.h"
+
+/*
+ * Forward declare.
+ */
+struct sm_instance;
+
+typedef void (*vpu_event_cb)(struct sm_instance *instance,
+			     struct vc_sm_result_t *reply, int reply_len);
+
+/*
+ * Initialize the shared memory service, opens up vchi connection to talk to it.
+ */
+struct sm_instance *vc_sm_cma_vchi_init(VCHI_INSTANCE_T vchi_instance,
+					unsigned int num_connections,
+					vpu_event_cb vpu_event);
+
+/*
+ * Terminates the shared memory service.
+ */
+int vc_sm_cma_vchi_stop(struct sm_instance **handle);
+
+/*
+ * Ask the shared memory service to free up some memory that was previously
+ * allocated by the vc_sm_cma_vchi_alloc function call.
+ */
+int vc_sm_cma_vchi_free(struct sm_instance *handle, struct vc_sm_free_t *msg,
+			u32 *cur_trans_id);
+
+/*
+ * Import a contiguous block of memory and wrap it in a GPU MEM_HANDLE_T.
+ */
+int vc_sm_cma_vchi_import(struct sm_instance *handle, struct vc_sm_import *msg,
+			  struct vc_sm_import_result *result,
+			  u32 *cur_trans_id);
+
+int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
+				  struct vc_sm_version *msg,
+				  struct vc_sm_result_t *result,
+				  u32 *cur_trans_id);
+
+#endif /* __VC_SM_CMA_VCHI_H__INCLUDED__ */
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
new file mode 100644
index 0000000000000..e38d67eeafd61
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
@@ -0,0 +1,298 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * VideoCore Shared Memory CMA allocator
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ *
+ * Based on vc_sm_defs.h from the vmcs_sm driver Copyright Broadcom Corporation.
+ * All IPC messages are copied across to this file, even if the vc-sm-cma
+ * driver is not currently using them.
+ *
+ ****************************************************************************
+ */
+
+#ifndef __VC_SM_DEFS_H__INCLUDED__
+#define __VC_SM_DEFS_H__INCLUDED__
+
+/* FourCC code used for VCHI connection */
+#define VC_SM_SERVER_NAME MAKE_FOURCC("SMEM")
+
+/* Maximum message length */
+#define VC_SM_MAX_MSG_LEN (sizeof(union vc_sm_msg_union_t) + \
+	sizeof(struct vc_sm_msg_hdr_t))
+#define VC_SM_MAX_RSP_LEN (sizeof(union vc_sm_msg_union_t))
+
+/* Resource name maximum size */
+#define VC_SM_RESOURCE_NAME 32
+
+/*
+ * Version to be reported to the VPU
+ * VPU assumes 0 (aka 1) which does not require the released callback, nor
+ * expect the client to handle VC_MEM_REQUESTS.
+ * Version 2 requires the released callback, and must support VC_MEM_REQUESTS.
+ */
+#define VC_SM_PROTOCOL_VERSION	2
+
+enum vc_sm_msg_type {
+	/* Message types supported for HOST->VC direction */
+
+	/* Allocate shared memory block */
+	VC_SM_MSG_TYPE_ALLOC,
+	/* Lock allocated shared memory block */
+	VC_SM_MSG_TYPE_LOCK,
+	/* Unlock allocated shared memory block */
+	VC_SM_MSG_TYPE_UNLOCK,
+	/* Unlock allocated shared memory block, do not answer command */
+	VC_SM_MSG_TYPE_UNLOCK_NOANS,
+	/* Free shared memory block */
+	VC_SM_MSG_TYPE_FREE,
+	/* Resize a shared memory block */
+	VC_SM_MSG_TYPE_RESIZE,
+	/* Walk the allocated shared memory block(s) */
+	VC_SM_MSG_TYPE_WALK_ALLOC,
+
+	/* A previously applied action will need to be reverted */
+	VC_SM_MSG_TYPE_ACTION_CLEAN,
+
+	/*
+	 * Import a physical address and wrap into a MEM_HANDLE_T.
+	 * Release with VC_SM_MSG_TYPE_FREE.
+	 */
+	VC_SM_MSG_TYPE_IMPORT,
+	/*
+	 *Tells VC the protocol version supported by this client.
+	 * 2 supports the async/cmd messages from the VPU for final release
+	 * of memory, and for VC allocations.
+	 */
+	VC_SM_MSG_TYPE_CLIENT_VERSION,
+	/* Response to VC request for memory */
+	VC_SM_MSG_TYPE_VC_MEM_REQUEST_REPLY,
+
+	/*
+	 * Asynchronous/cmd messages supported for VC->HOST direction.
+	 * Signalled by setting the top bit in vc_sm_result_t trans_id.
+	 */
+
+	/*
+	 * VC has finished with an imported memory allocation.
+	 * Release any Linux reference counts on the underlying block.
+	 */
+	VC_SM_MSG_TYPE_RELEASED,
+	/* VC request for memory */
+	VC_SM_MSG_TYPE_VC_MEM_REQUEST,
+
+	VC_SM_MSG_TYPE_MAX
+};
+
+/* Type of memory to be allocated */
+enum vc_sm_alloc_type_t {
+	VC_SM_ALLOC_CACHED,
+	VC_SM_ALLOC_NON_CACHED,
+};
+
+/* Message header for all messages in HOST->VC direction */
+struct vc_sm_msg_hdr_t {
+	u32 type;
+	u32 trans_id;
+	u8 body[0];
+
+};
+
+/* Request to allocate memory (HOST->VC) */
+struct vc_sm_alloc_t {
+	/* type of memory to allocate */
+	enum vc_sm_alloc_type_t type;
+	/* byte amount of data to allocate per unit */
+	u32 base_unit;
+	/* number of unit to allocate */
+	u32 num_unit;
+	/* alignment to be applied on allocation */
+	u32 alignment;
+	/* identity of who allocated this block */
+	u32 allocator;
+	/* resource name (for easier tracking on vc side) */
+	char name[VC_SM_RESOURCE_NAME];
+
+};
+
+/* Result of a requested memory allocation (VC->HOST) */
+struct vc_sm_alloc_result_t {
+	/* Transaction identifier */
+	u32 trans_id;
+
+	/* Resource handle */
+	u32 res_handle;
+	/* Pointer to resource buffer */
+	u32 res_mem;
+	/* Resource base size (bytes) */
+	u32 res_base_size;
+	/* Resource number */
+	u32 res_num;
+
+};
+
+/* Request to free a previously allocated memory (HOST->VC) */
+struct vc_sm_free_t {
+	/* Resource handle (returned from alloc) */
+	u32 res_handle;
+	/* Resource buffer (returned from alloc) */
+	u32 res_mem;
+
+};
+
+/* Request to lock a previously allocated memory (HOST->VC) */
+struct vc_sm_lock_unlock_t {
+	/* Resource handle (returned from alloc) */
+	u32 res_handle;
+	/* Resource buffer (returned from alloc) */
+	u32 res_mem;
+
+};
+
+/* Request to resize a previously allocated memory (HOST->VC) */
+struct vc_sm_resize_t {
+	/* Resource handle (returned from alloc) */
+	u32 res_handle;
+	/* Resource buffer (returned from alloc) */
+	u32 res_mem;
+	/* Resource *new* size requested (bytes) */
+	u32 res_new_size;
+
+};
+
+/* Result of a requested memory lock (VC->HOST) */
+struct vc_sm_lock_result_t {
+	/* Transaction identifier */
+	u32 trans_id;
+
+	/* Resource handle */
+	u32 res_handle;
+	/* Pointer to resource buffer */
+	u32 res_mem;
+	/*
+	 * Pointer to former resource buffer if the memory
+	 * was reallocated
+	 */
+	u32 res_old_mem;
+
+};
+
+/* Generic result for a request (VC->HOST) */
+struct vc_sm_result_t {
+	/* Transaction identifier */
+	u32 trans_id;
+
+	s32 success;
+
+};
+
+/* Request to revert a previously applied action (HOST->VC) */
+struct vc_sm_action_clean_t {
+	/* Action of interest */
+	enum vc_sm_msg_type res_action;
+	/* Transaction identifier for the action of interest */
+	u32 action_trans_id;
+
+};
+
+/* Request to remove all data associated with a given allocator (HOST->VC) */
+struct vc_sm_free_all_t {
+	/* Allocator identifier */
+	u32 allocator;
+};
+
+/* Request to import memory (HOST->VC) */
+struct vc_sm_import {
+	/* type of memory to allocate */
+	enum vc_sm_alloc_type_t type;
+	/* pointer to the VC (ie physical) address of the allocated memory */
+	u32 addr;
+	/* size of buffer */
+	u32 size;
+	/* opaque handle returned in RELEASED messages */
+	u32 kernel_id;
+	/* Allocator identifier */
+	u32 allocator;
+	/* resource name (for easier tracking on vc side) */
+	char     name[VC_SM_RESOURCE_NAME];
+};
+
+/* Result of a requested memory import (VC->HOST) */
+struct vc_sm_import_result {
+	/* Transaction identifier */
+	u32 trans_id;
+
+	/* Resource handle */
+	u32 res_handle;
+};
+
+/* Notification that VC has finished with an allocation (VC->HOST) */
+struct vc_sm_released {
+	/* cmd type / trans_id */
+	u32 cmd;
+
+	/* pointer to the VC (ie physical) address of the allocated memory */
+	u32 addr;
+	/* size of buffer */
+	u32 size;
+	/* opaque handle returned in RELEASED messages */
+	u32 kernel_id;
+	u32 vc_handle;
+};
+
+/*
+ * Client informing VC as to the protocol version it supports.
+ * >=2 requires the released callback, and supports VC asking for memory.
+ * Failure means that the firmware doesn't support this call, and therefore the
+ * client should either fail, or NOT rely on getting the released callback.
+ */
+struct vc_sm_version {
+	u32 version;
+};
+
+/* Request FROM VideoCore for some memory */
+struct vc_sm_vc_mem_request {
+	/* cmd type */
+	u32 cmd;
+
+	/* trans_id (from VPU) */
+	u32 trans_id;
+	/* size of buffer */
+	u32 size;
+	/* alignment of buffer */
+	u32 align;
+	/* resource name (for easier tracking) */
+	char     name[VC_SM_RESOURCE_NAME];
+};
+
+/* Response from the kernel to provide the VPU with some memory */
+struct vc_sm_vc_mem_request_result {
+	/* Transaction identifier for the VPU */
+	u32 trans_id;
+	/* pointer to the physical address of the allocated memory */
+	u32 addr;
+	/* opaque handle returned in RELEASED messages */
+	u32 kernel_id;
+};
+
+/* Union of ALL messages */
+union vc_sm_msg_union_t {
+	struct vc_sm_alloc_t alloc;
+	struct vc_sm_alloc_result_t alloc_result;
+	struct vc_sm_free_t free;
+	struct vc_sm_lock_unlock_t lock_unlock;
+	struct vc_sm_action_clean_t action_clean;
+	struct vc_sm_resize_t resize;
+	struct vc_sm_lock_result_t lock_result;
+	struct vc_sm_result_t result;
+	struct vc_sm_free_all_t free_all;
+	struct vc_sm_import import;
+	struct vc_sm_import_result import_result;
+	struct vc_sm_version version;
+	struct vc_sm_released released;
+	struct vc_sm_vc_mem_request vc_request;
+	struct vc_sm_vc_mem_request_result vc_request_result;
+};
+
+#endif /* __VC_SM_DEFS_H__INCLUDED__ */
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
new file mode 100644
index 0000000000000..182450b6196b6
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * VideoCore Shared Memory CMA allocator
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ *
+ * Based on vc_sm_defs.h from the vmcs_sm driver Copyright Broadcom Corporation.
+ *
+ */
+
+#ifndef __VC_SM_KNL_H__INCLUDED__
+#define __VC_SM_KNL_H__INCLUDED__
+
+#if !defined(__KERNEL__)
+#error "This interface is for kernel use only..."
+#endif
+
+/* Free a previously allocated or imported shared memory handle and block. */
+int vc_sm_cma_free(int handle);
+
+/* Get an internal resource handle mapped from the external one. */
+int vc_sm_cma_int_handle(int handle);
+
+/* Import a block of memory into the GPU space. */
+int vc_sm_cma_import_dmabuf(struct dma_buf *dmabuf, int *handle);
+
+#endif /* __VC_SM_KNL_H__INCLUDED__ */
-- 
GitLab


From efbec16980bd573236e787101fb82469f347c136 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 30 Oct 2018 11:42:48 +0000
Subject: [PATCH 0276/1835] staging: vc-sm-cma: Fixup driver for older VCHI
 APIs

Original patch was based off staging which included some cleanups
of the VCHI APIs. Those aren't present here, so switch back to
the older API.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c          | 2 +-
 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index b63285ff3b1fc..a8758ab8c87f1 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -632,7 +632,7 @@ static void vc_sm_connected_init(void)
 		goto err_free_mem;
 	}
 
-	ret = vchi_connect(vchi_instance);
+	ret = vchi_connect(NULL, 0, vchi_instance);
 	if (ret) {
 		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
 		       __func__, ret);
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
index 7a5c2fd76c45f..cc5b31a54cdac 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
@@ -325,8 +325,13 @@ struct sm_instance *vc_sm_cma_vchi_init(VCHI_INSTANCE_T vchi_instance,
 		SERVICE_CREATION_T params = {
 			.version = VCHI_VERSION_EX(VC_SM_VER, VC_SM_MIN_VER),
 			.service_id = VC_SM_SERVER_NAME,
+			.rx_fifo_size = 0,
+			.tx_fifo_size = 0,
 			.callback = vc_sm_cma_vchi_callback,
 			.callback_param = instance,
+			.want_unaligned_bulk_rx = 0,
+			.want_unaligned_bulk_tx = 0,
+			.want_crc = 0
 		};
 
 		status = vchi_service_open(vchi_instance,
-- 
GitLab


From 33586072677b58c3838dbf9f30021f6d11f862c9 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 25 Sep 2018 16:07:55 +0100
Subject: [PATCH 0277/1835] staging: vc04_services: Use vc-sm-cma to support
 zero copy

With the vc-sm-cma driver we can support zero copy of buffers between
the kernel and VPU. Add this support to vchiq-mmal.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vchiq-mmal/Kconfig  |  1 +
 .../vc04_services/vchiq-mmal/mmal-common.h    |  4 ++
 .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 66 ++++++++++++++++++-
 .../vc04_services/vchiq-mmal/mmal-vchiq.h     |  1 +
 4 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/Kconfig b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
index 2288a95273e27..ff4d34eb45cc2 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
@@ -2,6 +2,7 @@ config BCM2835_VCHIQ_MMAL
 	tristate "BCM2835 MMAL VCHIQ service"
 	depends on (ARCH_BCM2835 || COMPILE_TEST)
 	select BCM2835_VCHIQ
+	select BCM_VC_SM_CMA
 	help
 	  Enables the MMAL API over VCHIQ as used for the
 	  majority of the multimedia services on VideoCore.
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
index 9cf4662c821e9..fd27626245c9f 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
@@ -51,6 +51,10 @@ struct mmal_buffer {
 
 	struct mmal_msg_context *msg_context;
 
+	struct dma_buf *dma_buf;/* Exported dmabuf fd from videobuf2 */
+	int vcsm_handle;	/* VCSM handle having imported the dmabuf */
+	u32 vc_handle;		/* VC handle to that dmabuf */
+
 	u32 cmd;		/* MMAL command. 0=data. */
 	unsigned long length;
 	u32 mmal_flags;
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 7644e2367ec90..dd644e44b71c6 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -27,9 +27,12 @@
 #include <media/videobuf2-vmalloc.h>
 
 #include "mmal-common.h"
+#include "mmal-parameters.h"
 #include "mmal-vchiq.h"
 #include "mmal-msg.h"
 
+#include "vc-sm-cma/vc_sm_knl.h"
+
 #define USE_VCHIQ_ARM
 #include "interface/vchi/vchi.h"
 
@@ -424,8 +427,13 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 
 	/* buffer header */
 	m.u.buffer_from_host.buffer_header.cmd = 0;
-	m.u.buffer_from_host.buffer_header.data =
-		(u32)(unsigned long)buf->buffer;
+	if (port->zero_copy) {
+		m.u.buffer_from_host.buffer_header.data = buf->vc_handle;
+	} else {
+		m.u.buffer_from_host.buffer_header.data =
+			(u32)(unsigned long)buf->buffer;
+	}
+
 	m.u.buffer_from_host.buffer_header.alloc_size = buf->buffer_size;
 	if (port->type == MMAL_PORT_TYPE_OUTPUT) {
 		m.u.buffer_from_host.buffer_header.length = 0;
@@ -590,6 +598,22 @@ static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
 
 		msg_context->u.bulk.status = msg->h.status;
 
+	} else if (msg->u.buffer_from_host.is_zero_copy) {
+		/*
+		 * Zero copy buffer, so nothing to do.
+		 * Copy buffer info and make callback.
+		 */
+		msg_context->u.bulk.buffer_used =
+				msg->u.buffer_from_host.buffer_header.length;
+		msg_context->u.bulk.mmal_flags =
+				msg->u.buffer_from_host.buffer_header.flags;
+		msg_context->u.bulk.dts =
+				msg->u.buffer_from_host.buffer_header.dts;
+		msg_context->u.bulk.pts =
+				msg->u.buffer_from_host.buffer_header.pts;
+		msg_context->u.bulk.cmd =
+				msg->u.buffer_from_host.buffer_header.cmd;
+
 	} else if (msg->u.buffer_from_host.buffer_header.length == 0) {
 		/* empty buffer */
 		if (msg->u.buffer_from_host.buffer_header.flags &
@@ -1537,6 +1561,9 @@ int vchiq_mmal_port_parameter_set(struct vchiq_mmal_instance *instance,
 
 	mutex_unlock(&instance->vchiq_mutex);
 
+	if (parameter == MMAL_PARAMETER_ZERO_COPY && !ret)
+		port->zero_copy = !!(*(bool *)value);
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(vchiq_mmal_port_parameter_set);
@@ -1705,6 +1732,31 @@ int vchiq_mmal_submit_buffer(struct vchiq_mmal_instance *instance,
 	unsigned long flags = 0;
 	int ret;
 
+	/*
+	 * We really want to do this in mmal_vchi_buffer_init but can't as
+	 * videobuf2 won't let us have the dmabuf there.
+	 */
+	if (port->zero_copy && buffer->dma_buf && !buffer->vcsm_handle) {
+		pr_debug("%s: import dmabuf %p\n", __func__, buffer->dma_buf);
+		ret = vc_sm_cma_import_dmabuf(buffer->dma_buf,
+					      &buffer->vcsm_handle);
+		if (ret) {
+			pr_err("%s: vc_sm_import_dmabuf_fd failed, ret %d\n",
+			       __func__, ret);
+			return ret;
+		}
+
+		buffer->vc_handle = vc_sm_cma_int_handle(buffer->vcsm_handle);
+		if (!buffer->vc_handle) {
+			pr_err("%s: vc_sm_int_handle failed %d\n",
+			       __func__, ret);
+			vc_sm_cma_free(buffer->vcsm_handle);
+			return ret;
+		}
+		pr_debug("%s: import dmabuf %p - got vc handle %08X\n",
+			 __func__, buffer->dma_buf, buffer->vc_handle);
+	}
+
 	ret = buffer_from_host(instance, port, buffer);
 	if (ret == -EINVAL) {
 		/* Port is disabled. Queue for when it is enabled. */
@@ -1738,6 +1790,16 @@ int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
 		release_msg_context(msg_context);
 	buf->msg_context = NULL;
 
+	if (buf->vcsm_handle) {
+		int ret;
+
+		pr_debug("%s: vc_sm_cma_free on handle %08X\n", __func__,
+			 buf->vcsm_handle);
+		ret = vc_sm_cma_free(buf->vcsm_handle);
+		if (ret)
+			pr_err("%s: vcsm_free failed, ret %d\n", __func__, ret);
+		buf->vcsm_handle = 0;
+	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index 476cff6d60e6c..13d37c5add8d1 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -49,6 +49,7 @@ typedef void (*vchiq_mmal_buffer_cb)(
 
 struct vchiq_mmal_port {
 	u32 enabled:1;
+	u32 zero_copy:1;
 	u32 handle;
 	u32 type; /* port type, cached to use on port info set */
 	u32 index; /* port index, cached to use on port info set */
-- 
GitLab


From f4d2776ad0df52ee5b7030898395dd5354bf4d31 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 17:57:45 +0000
Subject: [PATCH 0278/1835] media: videobuf2: Allow exporting of a struct
 dmabuf

videobuf2 only allowed exporting a dmabuf as a file descriptor,
but there are instances where having the struct dma_buf is
useful within the kernel.

Split the current implementation into two, one step which
exports a struct dma_buf, and the second which converts that
into an fd.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../media/common/videobuf2/videobuf2-core.c   | 21 ++++++++++++++++---
 include/media/videobuf2-core.h                | 15 +++++++++++++
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 6889c25c62cbd..627478997f96a 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -1831,12 +1831,12 @@ static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off,
 	return -EINVAL;
 }
 
-int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
-		unsigned int index, unsigned int plane, unsigned int flags)
+int vb2_core_expbuf_dmabuf(struct vb2_queue *q, unsigned int type,
+			   unsigned int index, unsigned int plane,
+			   unsigned int flags, struct dma_buf **dmabuf)
 {
 	struct vb2_buffer *vb = NULL;
 	struct vb2_plane *vb_plane;
-	int ret;
 	struct dma_buf *dbuf;
 
 	if (q->memory != VB2_MEMORY_MMAP) {
@@ -1886,6 +1886,21 @@ int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
 		return -EINVAL;
 	}
 
+	*dmabuf = dbuf;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(vb2_core_expbuf_dmabuf);
+
+int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
+		    unsigned int index, unsigned int plane, unsigned int flags)
+{
+	struct dma_buf *dbuf;
+	int ret;
+
+	ret = vb2_core_expbuf_dmabuf(q, type, index, plane, flags, &dbuf);
+	if (ret)
+		return ret;
+
 	ret = dma_buf_fd(dbuf, flags & ~O_ACCMODE);
 	if (ret < 0) {
 		dprintk(3, "buffer %d, plane %d failed to export (%d)\n",
diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
index f6818f732f347..14bb15a6fbf40 100644
--- a/include/media/videobuf2-core.h
+++ b/include/media/videobuf2-core.h
@@ -823,6 +823,21 @@ int vb2_core_streamon(struct vb2_queue *q, unsigned int type);
  */
 int vb2_core_streamoff(struct vb2_queue *q, unsigned int type);
 
+/**
+ * vb2_core_expbuf_dmabuf() - Export a buffer as a dma_buf structure
+ * @q:         videobuf2 queue
+ * @type:      buffer type
+ * @index:     id number of the buffer
+ * @plane:     index of the plane to be exported, 0 for single plane queues
+ * @flags:     flags for newly created file, currently only O_CLOEXEC is
+ *             supported, refer to manual of open syscall for more details
+ * @dmabuf:    Returns the dmabuf pointer
+ *
+ */
+int vb2_core_expbuf_dmabuf(struct vb2_queue *q, unsigned int type,
+			   unsigned int index, unsigned int plane,
+			   unsigned int flags, struct dma_buf **dmabuf);
+
 /**
  * vb2_core_expbuf() - Export a buffer as a file descriptor.
  * @q:		pointer to &struct vb2_queue with videobuf2 queue.
-- 
GitLab


From f9e8250274e5065c87964b5f8d60897abc873178 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 25 Sep 2018 14:53:49 +0100
Subject: [PATCH 0279/1835] staging: vc04_services: Add a V4L2 M2M codec driver

This adds a V4L2 memory to memory device that wraps the MMAL
video decode and video_encode components for H264 and MJPEG encode
and decode, MPEG4, H263, and VP8 decode (and MPEG2 decode
if the appropriate licence has been purchased).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/Kconfig         |    1 +
 drivers/staging/vc04_services/Makefile        |    9 +-
 .../vc04_services/bcm2835-codec/Kconfig       |   11 +
 .../vc04_services/bcm2835-codec/Makefile      |    8 +
 .../staging/vc04_services/bcm2835-codec/TODO  |   24 +
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 2359 +++++++++++++++++
 6 files changed, 2408 insertions(+), 4 deletions(-)
 create mode 100644 drivers/staging/vc04_services/bcm2835-codec/Kconfig
 create mode 100644 drivers/staging/vc04_services/bcm2835-codec/Makefile
 create mode 100644 drivers/staging/vc04_services/bcm2835-codec/TODO
 create mode 100644 drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c

diff --git a/drivers/staging/vc04_services/Kconfig b/drivers/staging/vc04_services/Kconfig
index 05f69070c6578..b171f2e7d105a 100644
--- a/drivers/staging/vc04_services/Kconfig
+++ b/drivers/staging/vc04_services/Kconfig
@@ -23,6 +23,7 @@ source "drivers/staging/vc04_services/bcm2835-audio/Kconfig"
 source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"
 source "drivers/staging/vc04_services/vchiq-mmal/Kconfig"
 source "drivers/staging/vc04_services/vc-sm-cma/Kconfig"
+source "drivers/staging/vc04_services/bcm2835-codec/Kconfig"
 
 endif
 
diff --git a/drivers/staging/vc04_services/Makefile b/drivers/staging/vc04_services/Makefile
index c90ad85db4fb9..709185d002e11 100644
--- a/drivers/staging/vc04_services/Makefile
+++ b/drivers/staging/vc04_services/Makefile
@@ -10,10 +10,11 @@ vchiq-objs := \
    interface/vchiq_arm/vchiq_util.o \
    interface/vchiq_arm/vchiq_connected.o \
 
-obj-$(CONFIG_SND_BCM2835)	+= bcm2835-audio/
-obj-$(CONFIG_VIDEO_BCM2835)	+= bcm2835-camera/
-obj-$(CONFIG_BCM2835_VCHIQ_MMAL) += vchiq-mmal/
-obj-$(CONFIG_BCM_VC_SM_CMA) 	+= vc-sm-cma/
+obj-$(CONFIG_SND_BCM2835)		+= bcm2835-audio/
+obj-$(CONFIG_VIDEO_BCM2835)		+= bcm2835-camera/
+obj-$(CONFIG_BCM2835_VCHIQ_MMAL)	+= vchiq-mmal/
+obj-$(CONFIG_BCM_VC_SM_CMA) 		+= vc-sm-cma/
+obj-$(CONFIG_VIDEO_CODEC_BCM2835)	+= bcm2835-codec/
 
 ccflags-y += -Idrivers/staging/vc04_services -D__VCCOREVER__=0x04000000
 
diff --git a/drivers/staging/vc04_services/bcm2835-codec/Kconfig b/drivers/staging/vc04_services/bcm2835-codec/Kconfig
new file mode 100644
index 0000000000000..951971b39ce0e
--- /dev/null
+++ b/drivers/staging/vc04_services/bcm2835-codec/Kconfig
@@ -0,0 +1,11 @@
+config VIDEO_CODEC_BCM2835
+	tristate "BCM2835 Video codec support"
+	depends on MEDIA_SUPPORT
+	depends on VIDEO_V4L2 && (ARCH_BCM2835 || COMPILE_TEST)
+	select BCM2835_VCHIQ_MMAL
+	select VIDEOBUF2_DMA_CONTIG
+	select V4L2_MEM2MEM_DEV
+	help
+	  Say Y here to enable the V4L2 video codecs for
+	  Broadcom BCM2835 SoC. This operates over the VCHIQ interface
+	  to a service running on VideoCore.
diff --git a/drivers/staging/vc04_services/bcm2835-codec/Makefile b/drivers/staging/vc04_services/bcm2835-codec/Makefile
new file mode 100644
index 0000000000000..5820ec1f89ece
--- /dev/null
+++ b/drivers/staging/vc04_services/bcm2835-codec/Makefile
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0
+bcm2835-codec-objs := bcm2835-v4l2-codec.o
+
+obj-$(CONFIG_VIDEO_CODEC_BCM2835) += bcm2835-codec.o
+
+ccflags-y += \
+	-Idrivers/staging/vc04_services \
+	-D__VCCOREVER__=0x04000000
diff --git a/drivers/staging/vc04_services/bcm2835-codec/TODO b/drivers/staging/vc04_services/bcm2835-codec/TODO
new file mode 100644
index 0000000000000..ea9a7b7a88e2f
--- /dev/null
+++ b/drivers/staging/vc04_services/bcm2835-codec/TODO
@@ -0,0 +1,24 @@
+1) Convert to be a platform driver.
+
+Right now when the module probes, it tries to initialize VCHI and
+errors out if it wasn't ready yet.  If bcm2835-v4l2 was built in, then
+VCHI generally isn't ready because it depends on both the firmware and
+mailbox drivers having already loaded.
+
+We should have VCHI create a platform device once it's initialized,
+and have this driver bind to it, so that we automatically load the
+v4l2 module after VCHI loads.
+
+2) Support SELECTION API to define crop region on the image for encode.
+
+Particularly for resolutions that aren't a multiple of the macroblock
+size, the codec will report a resolution that is a multiple of the macroblock
+size (it has to have the memory to decode into), and then a different crop
+region within that buffer.
+The most common example is 1080P, where the buffer will be 1920x1088 with a
+crop region of 1920x1080.
+
+3) Refactor so that the component creation is only on queue_setup, not open.
+
+Fixes v4l2-compliance failure on trying to open 100 instances of the
+device.
\ No newline at end of file
diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
new file mode 100644
index 0000000000000..4e4e4fb69ade1
--- /dev/null
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -0,0 +1,2359 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * A v4l2-mem2mem device that wraps the video codec MMAL component.
+ *
+ * Copyright 2018 Raspberry Pi (Trading) Ltd.
+ * Author: Dave Stevenson (dave.stevenson@raspberrypi.org)
+ *
+ * Loosely based on the vim2m virtual driver by Pawel Osciak
+ * Copyright (c) 2009-2010 Samsung Electronics Co., Ltd.
+ * Pawel Osciak, <pawel@osciak.com>
+ * Marek Szyprowski, <m.szyprowski@samsung.com>
+ *
+ * Whilst this driver uses the v4l2_mem2mem framework, it does not need the
+ * scheduling aspects, so will always take the buffers, pass them to the VPU,
+ * and then signal the job as complete.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version
+ */
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/fs.h>
+#include <linux/timer.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/syscalls.h>
+
+#include <media/v4l2-mem2mem.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-event.h>
+#include <media/videobuf2-dma-contig.h>
+
+#include "vchiq-mmal/mmal-encodings.h"
+#include "vchiq-mmal/mmal-msg.h"
+#include "vchiq-mmal/mmal-parameters.h"
+#include "vchiq-mmal/mmal-vchiq.h"
+
+/*
+ * Default /dev/videoN node numbers for decode and encode.
+ * Deliberately avoid the very low numbers as these are often taken by webcams
+ * etc, and simple apps tend to only go for /dev/video0.
+ */
+static int decode_video_nr = 10;
+module_param(decode_video_nr, int, 0644);
+MODULE_PARM_DESC(decode_video_nr, "decoder video device number");
+
+static int encode_video_nr = 11;
+module_param(encode_video_nr, int, 0644);
+MODULE_PARM_DESC(encode_video_nr, "encoder video device number");
+
+static unsigned int debug;
+module_param(debug, uint, 0644);
+MODULE_PARM_DESC(debug, "activates debug info (0-3)");
+
+#define MIN_W		32
+#define MIN_H		32
+#define MAX_W		1920
+#define MAX_H		1088
+#define BPL_ALIGN	32
+#define DEFAULT_WIDTH	640
+#define DEFAULT_HEIGHT	480
+/*
+ * The unanswered question - what is the maximum size of a compressed frame?
+ * V4L2 mandates that the encoded frame must fit in a single buffer. Sizing
+ * that buffer is a compromise between wasting memory and risking not fitting.
+ * The 1080P version of Big Buck Bunny has some frames that exceed 512kB.
+ * Adopt a moderately arbitrary split at 720P for switching between 512 and
+ * 768kB buffers.
+ */
+#define DEF_COMP_BUF_SIZE_GREATER_720P	(768 << 10)
+#define DEF_COMP_BUF_SIZE_720P_OR_LESS	(512 << 10)
+
+/* Flags that indicate a format can be used for capture/output */
+#define MEM2MEM_CAPTURE		BIT(0)
+#define MEM2MEM_OUTPUT		BIT(1)
+
+#define MEM2MEM_NAME		"bcm2835-codec"
+
+struct bcm2835_codec_fmt {
+	u32	fourcc;
+	int	depth;
+	int	bytesperline_align;
+	u32	flags;
+	u32	mmal_fmt;
+	bool	decode_only;
+	bool	encode_only;
+	int	size_multiplier_x2;
+};
+
+/* Supported raw pixel formats. Those supported for both encode and decode
+ * must come first, with those only supported for decode coming after (there
+ * are no formats supported for encode only).
+ */
+static struct bcm2835_codec_fmt raw_formats[] = {
+	{
+		.fourcc			= V4L2_PIX_FMT_YUV420,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_I420,
+		.size_multiplier_x2	= 3,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_YVU420,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_YV12,
+		.size_multiplier_x2	= 3,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_NV12,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_NV12,
+		.size_multiplier_x2	= 3,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_NV21,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_NV21,
+		.size_multiplier_x2	= 3,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_RGB565,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_RGB16,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_YUYV,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_YUYV,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_UYVY,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_UYVY,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_YVYU,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_YVYU,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_VYUY,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_VYUY,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_RGB24,
+		.depth			= 24,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_RGB24,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_BGR24,
+		.depth			= 24,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BGR24,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_BGR32,
+		.depth			= 32,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BGRA,
+		.encode_only		= true,
+		.size_multiplier_x2	= 2,
+	},
+};
+
+/* Supported encoded formats. Those supported for both encode and decode
+ * must come first, with those only supported for decode coming after (there
+ * are no formats supported for encode only).
+ */
+static struct bcm2835_codec_fmt encoded_formats[] = {
+	{
+		.fourcc			= V4L2_PIX_FMT_H264,
+		.depth			= 0,
+		.flags			= V4L2_FMT_FLAG_COMPRESSED,
+		.mmal_fmt		= MMAL_ENCODING_H264,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_MJPEG,
+		.depth			= 0,
+		.flags			= V4L2_FMT_FLAG_COMPRESSED,
+		.mmal_fmt		= MMAL_ENCODING_MJPEG,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_MPEG4,
+		.depth			= 0,
+		.flags			= V4L2_FMT_FLAG_COMPRESSED,
+		.mmal_fmt		= MMAL_ENCODING_MP4V,
+		.decode_only		= true,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_H263,
+		.depth			= 0,
+		.flags			= V4L2_FMT_FLAG_COMPRESSED,
+		.mmal_fmt		= MMAL_ENCODING_H263,
+		.decode_only		= true,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_MPEG2,
+		.depth			= 0,
+		.flags			= V4L2_FMT_FLAG_COMPRESSED,
+		.mmal_fmt		= MMAL_ENCODING_MP2V,
+		.decode_only		= true,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_VP8,
+		.depth			= 0,
+		.flags			= V4L2_FMT_FLAG_COMPRESSED,
+		.mmal_fmt		= MMAL_ENCODING_VP8,
+		.decode_only		= true,
+	},
+	/*
+	 * This list couold include VP6 and Theorafor decode, but V4L2 doesn't
+	 * support them.
+	 */
+};
+
+struct bcm2835_codec_fmt_list {
+	struct bcm2835_codec_fmt *list;
+	unsigned int num_entries;
+};
+
+#define RAW_LIST	0
+#define ENCODED_LIST	1
+
+struct bcm2835_codec_fmt_list formats[] = {
+	{
+		.list = raw_formats,
+		.num_entries = ARRAY_SIZE(raw_formats),
+	}, {
+		.list = encoded_formats,
+		.num_entries = ARRAY_SIZE(encoded_formats),
+	},
+};
+
+struct m2m_mmal_buffer {
+	struct v4l2_m2m_buffer	m2m;
+	struct mmal_buffer	mmal;
+};
+
+/* Per-queue, driver-specific private data */
+struct bcm2835_codec_q_data {
+	/*
+	 * These parameters should be treated as gospel, with everything else
+	 * being determined from them.
+	 */
+	/* Buffer width/height */
+	unsigned int		bytesperline;
+	unsigned int		height;
+	/* Crop size used for selection handling */
+	unsigned int		crop_width;
+	unsigned int		crop_height;
+	bool			selection_set;
+
+	unsigned int		sizeimage;
+	unsigned int		sequence;
+	struct bcm2835_codec_fmt	*fmt;
+
+	/* One extra buffer header so we can send an EOS. */
+	struct m2m_mmal_buffer	eos_buffer;
+	bool			eos_buffer_in_use;	/* debug only */
+};
+
+enum {
+	V4L2_M2M_SRC = 0,
+	V4L2_M2M_DST = 1,
+};
+
+static inline struct bcm2835_codec_fmt_list *get_format_list(bool decode,
+							     bool capture)
+{
+	return decode ^ capture ? &formats[ENCODED_LIST] : &formats[RAW_LIST];
+}
+
+static struct bcm2835_codec_fmt *get_default_format(bool decode, bool capture)
+{
+	return &get_format_list(decode, capture)->list[0];
+}
+
+static struct bcm2835_codec_fmt *find_format(struct v4l2_format *f, bool decode,
+					     bool capture)
+{
+	struct bcm2835_codec_fmt *fmt;
+	unsigned int k;
+	struct bcm2835_codec_fmt_list *fmts = get_format_list(decode, capture);
+
+	for (k = 0; k < fmts->num_entries; k++) {
+		fmt = &fmts->list[k];
+		if (fmt->fourcc == f->fmt.pix.pixelformat)
+			break;
+	}
+
+	/*
+	 * Some compressed formats are only supported for decoding, not
+	 * encoding.
+	 */
+	if (!decode && fmts->list[k].decode_only)
+		return NULL;
+
+	/* Some pixel formats are only supported for encoding, not decoding. */
+	if (decode && fmts->list[k].encode_only)
+		return NULL;
+
+	if (k == fmts->num_entries)
+		return NULL;
+
+	return &fmts->list[k];
+}
+
+struct bcm2835_codec_dev {
+	struct platform_device *pdev;
+
+	/* v4l2 devices */
+	struct v4l2_device	v4l2_dev;
+	struct video_device	vfd;
+	/* mutex for the v4l2 device */
+	struct mutex		dev_mutex;
+	atomic_t		num_inst;
+
+	/* allocated mmal instance and components */
+	bool			decode;	 /* Is this instance a decoder? */
+	struct vchiq_mmal_instance	*instance;
+
+	struct v4l2_m2m_dev	*m2m_dev;
+};
+
+struct bcm2835_codec_ctx {
+	struct v4l2_fh		fh;
+	struct bcm2835_codec_dev	*dev;
+
+	struct v4l2_ctrl_handler hdl;
+
+	struct vchiq_mmal_component  *component;
+	bool component_enabled;
+
+	enum v4l2_colorspace	colorspace;
+	enum v4l2_ycbcr_encoding ycbcr_enc;
+	enum v4l2_xfer_func	xfer_func;
+	enum v4l2_quantization	quant;
+
+	/* Source and destination queue data */
+	struct bcm2835_codec_q_data   q_data[2];
+	s32  bitrate;
+
+	bool aborting;
+	int num_ip_buffers;
+	int num_op_buffers;
+	struct completion frame_cmplt;
+};
+
+struct bcm2835_codec_driver {
+	struct bcm2835_codec_dev *encode;
+	struct bcm2835_codec_dev *decode;
+};
+
+static inline struct bcm2835_codec_ctx *file2ctx(struct file *file)
+{
+	return container_of(file->private_data, struct bcm2835_codec_ctx, fh);
+}
+
+static struct bcm2835_codec_q_data *get_q_data(struct bcm2835_codec_ctx *ctx,
+					       enum v4l2_buf_type type)
+{
+	switch (type) {
+	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+		return &ctx->q_data[V4L2_M2M_SRC];
+	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+		return &ctx->q_data[V4L2_M2M_DST];
+	default:
+		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
+			 __func__, type);
+		break;
+	}
+	return NULL;
+}
+
+static struct vchiq_mmal_port *get_port_data(struct bcm2835_codec_ctx *ctx,
+					     enum v4l2_buf_type type)
+{
+	if (!ctx->component)
+		return NULL;
+
+	switch (type) {
+	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+		return &ctx->component->input[0];
+	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+		return &ctx->component->output[0];
+	default:
+		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
+			 __func__, type);
+		break;
+	}
+	return NULL;
+}
+
+/*
+ * mem2mem callbacks
+ */
+
+/**
+ * job_ready() - check whether an instance is ready to be scheduled to run
+ */
+static int job_ready(void *priv)
+{
+	struct bcm2835_codec_ctx *ctx = priv;
+
+	if (!v4l2_m2m_num_src_bufs_ready(ctx->fh.m2m_ctx) &&
+	    !v4l2_m2m_num_dst_bufs_ready(ctx->fh.m2m_ctx))
+		return 0;
+
+	return 1;
+}
+
+static void job_abort(void *priv)
+{
+	struct bcm2835_codec_ctx *ctx = priv;
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s\n", __func__);
+	/* Will cancel the transaction in the next interrupt handler */
+	ctx->aborting = 1;
+}
+
+static inline unsigned int get_sizeimage(int bpl, int height,
+					 struct bcm2835_codec_fmt *fmt)
+{
+	return (bpl * height * fmt->size_multiplier_x2) >> 1;
+}
+
+static inline unsigned int get_bytesperline(int width,
+					    struct bcm2835_codec_fmt *fmt)
+{
+	return ALIGN((width * fmt->depth) >> 3, fmt->bytesperline_align);
+}
+
+static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
+				   bool decode,
+				   struct bcm2835_codec_q_data *q_data,
+				   struct vchiq_mmal_port *port)
+{
+	port->format.encoding = q_data->fmt->mmal_fmt;
+
+	if (!(q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
+		/* Raw image format - set width/height */
+		port->es.video.width = q_data->bytesperline /
+						(q_data->fmt->depth >> 3);
+		port->es.video.height = q_data->height;
+		port->es.video.crop.width = q_data->crop_width;
+		port->es.video.crop.height = q_data->crop_height;
+		port->es.video.frame_rate.num = 0;
+		port->es.video.frame_rate.den = 1;
+	} else {
+		/* Compressed format - leave resolution as 0 for decode */
+		if (decode) {
+			port->es.video.width = 0;
+			port->es.video.height = 0;
+			port->es.video.crop.width = 0;
+			port->es.video.crop.height = 0;
+		} else {
+			port->es.video.width = q_data->crop_width;
+			port->es.video.height = q_data->height;
+			port->es.video.crop.width = q_data->crop_width;
+			port->es.video.crop.height = q_data->crop_height;
+			port->format.bitrate = ctx->bitrate;
+		}
+		port->es.video.frame_rate.num = 0;
+		port->es.video.frame_rate.den = 1;
+	}
+	port->es.video.crop.x = 0;
+	port->es.video.crop.y = 0;
+
+	port->current_buffer.size = q_data->sizeimage;
+};
+
+static void ip_buffer_cb(struct vchiq_mmal_instance *instance,
+			 struct vchiq_mmal_port *port, int status,
+			 struct mmal_buffer *mmal_buf)
+{
+	struct bcm2835_codec_ctx *ctx = port->cb_ctx/*, *curr_ctx*/;
+	struct m2m_mmal_buffer *buf =
+			container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: port %p buf %p length %lu, flags %x\n",
+		 __func__, port, mmal_buf, mmal_buf->length,
+		 mmal_buf->mmal_flags);
+
+	if (buf == &ctx->q_data[V4L2_M2M_SRC].eos_buffer) {
+		/* Do we need to add lcoking to prevent multiple submission of
+		 * the EOS, and therefore handle mutliple return here?
+		 */
+		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: eos buffer returned.\n",
+			 __func__);
+		ctx->q_data[V4L2_M2M_SRC].eos_buffer_in_use = false;
+		return;
+	}
+
+	if (status) {
+		/* error in transfer */
+		if (buf)
+			/* there was a buffer with the error so return it */
+			vb2_buffer_done(&buf->m2m.vb.vb2_buf,
+					VB2_BUF_STATE_ERROR);
+		return;
+	}
+	if (mmal_buf->cmd) {
+		v4l2_err(&ctx->dev->v4l2_dev, "%s: Not expecting cmd msgs on ip callback - %08x\n",
+			 __func__, mmal_buf->cmd);
+		/*
+		 * CHECKME: Should we return here. The buffer shouldn't have a
+		 * message context or vb2 buf associated.
+		 */
+	}
+
+	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: no error. Return buffer %p\n",
+		 __func__, &buf->m2m.vb.vb2_buf);
+	vb2_buffer_done(&buf->m2m.vb.vb2_buf, VB2_BUF_STATE_DONE);
+
+	ctx->num_ip_buffers++;
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: done %d input buffers\n",
+		 __func__, ctx->num_ip_buffers);
+
+	if (!port->enabled)
+		complete(&ctx->frame_cmplt);
+}
+
+static void queue_res_chg_event(struct bcm2835_codec_ctx *ctx)
+{
+	static const struct v4l2_event ev_src_ch = {
+		.type = V4L2_EVENT_SOURCE_CHANGE,
+		.u.src_change.changes =
+		V4L2_EVENT_SRC_CH_RESOLUTION,
+	};
+
+	v4l2_event_queue_fh(&ctx->fh, &ev_src_ch);
+}
+
+static void send_eos_event(struct bcm2835_codec_ctx *ctx)
+{
+	static const struct v4l2_event ev = {
+		.type = V4L2_EVENT_EOS,
+	};
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "Sending EOS event\n");
+
+	v4l2_event_queue_fh(&ctx->fh, &ev);
+}
+
+static void color_mmal2v4l(struct bcm2835_codec_ctx *ctx, u32 mmal_color_space)
+{
+	switch (mmal_color_space) {
+	case MMAL_COLOR_SPACE_ITUR_BT601:
+		ctx->colorspace = V4L2_COLORSPACE_REC709;
+		ctx->xfer_func = V4L2_XFER_FUNC_709;
+		ctx->ycbcr_enc = V4L2_YCBCR_ENC_601;
+		ctx->quant = V4L2_QUANTIZATION_LIM_RANGE;
+		break;
+
+	case MMAL_COLOR_SPACE_ITUR_BT709:
+		ctx->colorspace = V4L2_COLORSPACE_REC709;
+		ctx->xfer_func = V4L2_XFER_FUNC_709;
+		ctx->ycbcr_enc = V4L2_YCBCR_ENC_709;
+		ctx->quant = V4L2_QUANTIZATION_LIM_RANGE;
+		break;
+	}
+}
+
+static void handle_fmt_changed(struct bcm2835_codec_ctx *ctx,
+			       struct mmal_buffer *mmal_buf)
+{
+	struct bcm2835_codec_q_data *q_data;
+	struct mmal_msg_event_format_changed *format =
+		(struct mmal_msg_event_format_changed *)mmal_buf->buffer;
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed: buff size min %u, rec %u, buff num min %u, rec %u\n",
+		 __func__,
+		 format->buffer_size_min,
+		 format->buffer_size_recommended,
+		 format->buffer_num_min,
+		 format->buffer_num_recommended
+		);
+	if (format->format.type != MMAL_ES_TYPE_VIDEO) {
+		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed but not video %u\n",
+			 __func__, format->format.type);
+		return;
+	}
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format changed to %ux%u, crop %ux%u, colourspace %08X\n",
+		 __func__, format->es.video.width, format->es.video.height,
+		 format->es.video.crop.width, format->es.video.crop.height,
+		 format->es.video.color_space);
+
+	q_data = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
+	q_data->crop_width = format->es.video.crop.width;
+	q_data->crop_height = format->es.video.crop.height;
+	q_data->bytesperline = format->es.video.crop.width;
+	q_data->height = format->es.video.height;
+	q_data->sizeimage = format->buffer_size_min;
+	if (format->es.video.color_space)
+		color_mmal2v4l(ctx, format->es.video.color_space);
+
+	queue_res_chg_event(ctx);
+}
+
+static void op_buffer_cb(struct vchiq_mmal_instance *instance,
+			 struct vchiq_mmal_port *port, int status,
+			 struct mmal_buffer *mmal_buf)
+{
+	struct bcm2835_codec_ctx *ctx = port->cb_ctx;
+	struct m2m_mmal_buffer *buf;
+	struct vb2_v4l2_buffer *vb2;
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev,
+		 "%s: status:%d, buf:%p, length:%lu, flags %u, pts %lld\n",
+		 __func__, status, mmal_buf, mmal_buf->length,
+		 mmal_buf->mmal_flags, mmal_buf->pts);
+
+	if (status) {
+		/* error in transfer */
+		if (vb2) {
+			/* there was a buffer with the error so return it */
+			vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_ERROR);
+		}
+		return;
+	}
+
+	if (mmal_buf->cmd) {
+		switch (mmal_buf->cmd) {
+		case MMAL_EVENT_FORMAT_CHANGED:
+		{
+			handle_fmt_changed(ctx, mmal_buf);
+			break;
+		}
+		default:
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Unexpected event on output callback - %08x\n",
+				 __func__, mmal_buf->cmd);
+			break;
+		}
+		return;
+	}
+
+	buf = container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
+	vb2 = &buf->m2m.vb;
+
+	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: length %lu, flags %x, idx %u\n",
+		 __func__, mmal_buf->length, mmal_buf->mmal_flags,
+		 vb2->vb2_buf.index);
+
+	if (mmal_buf->length == 0) {
+		/* stream ended, or buffer being returned during disable. */
+		v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: Empty buffer - flags %04x",
+			 __func__, mmal_buf->mmal_flags);
+		if (!mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS) {
+			vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_ERROR);
+			if (!port->enabled)
+				complete(&ctx->frame_cmplt);
+			return;
+		}
+	}
+	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS) {
+		/* EOS packet from the VPU */
+		send_eos_event(ctx);
+		vb2->flags |= V4L2_BUF_FLAG_LAST;
+	}
+
+	vb2->vb2_buf.timestamp = mmal_buf->pts;
+
+	vb2_set_plane_payload(&vb2->vb2_buf, 0, mmal_buf->length);
+	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
+		vb2->flags |= V4L2_BUF_FLAG_KEYFRAME;
+
+	vb2_buffer_done(&vb2->vb2_buf, VB2_BUF_STATE_DONE);
+	ctx->num_op_buffers++;
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: done %d output buffers\n",
+		 __func__, ctx->num_op_buffers);
+
+	if (!port->enabled)
+		complete(&ctx->frame_cmplt);
+}
+
+/* vb2_to_mmal_buffer() - converts vb2 buffer header to MMAL
+ *
+ * Copies all the required fields from a VB2 buffer to the MMAL buffer header,
+ * ready for sending to the VPU.
+ */
+static void vb2_to_mmal_buffer(struct m2m_mmal_buffer *buf,
+			       struct vb2_v4l2_buffer *vb2)
+{
+	buf->mmal.mmal_flags = 0;
+	if (vb2->flags & V4L2_BUF_FLAG_KEYFRAME)
+		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_KEYFRAME;
+
+	/*
+	 * Adding this means that the data must be framed correctly as one frame
+	 * per buffer. The underlying decoder has no such requirement, but it
+	 * will reduce latency as the bistream parser will be kicked immediately
+	 * to parse the frame, rather than relying on its own heuristics for
+	 * when to wake up.
+	 */
+	buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_FRAME_END;
+
+	buf->mmal.length = vb2->vb2_buf.planes[0].bytesused;
+	/*
+	 * Minor ambiguity in the V4L2 spec as to whether passing in a 0 length
+	 * buffer, or one with V4L2_BUF_FLAG_LAST set denotes end of stream.
+	 * Handle either.
+	 */
+	if (!buf->mmal.length || vb2->flags & V4L2_BUF_FLAG_LAST)
+		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_EOS;
+
+	buf->mmal.pts = vb2->vb2_buf.timestamp;
+	buf->mmal.dts = MMAL_TIME_UNKNOWN;
+}
+
+/* device_run() - prepares and starts the device
+ *
+ * This simulates all the immediate preparations required before starting
+ * a device. This will be called by the framework when it decides to schedule
+ * a particular instance.
+ */
+static void device_run(void *priv)
+{
+	struct bcm2835_codec_ctx *ctx = priv;
+	struct bcm2835_codec_dev *dev = ctx->dev;
+	struct vb2_v4l2_buffer *src_buf, *dst_buf;
+	struct m2m_mmal_buffer *src_m2m_buf, *dst_m2m_buf;
+	struct v4l2_m2m_buffer *m2m;
+	int ret;
+
+	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: off we go\n", __func__);
+
+	src_buf = v4l2_m2m_buf_remove(&ctx->fh.m2m_ctx->out_q_ctx);
+	if (src_buf) {
+		m2m = container_of(src_buf, struct v4l2_m2m_buffer, vb);
+		src_m2m_buf = container_of(m2m, struct m2m_mmal_buffer, m2m);
+		vb2_to_mmal_buffer(src_m2m_buf, src_buf);
+
+		ret = vchiq_mmal_submit_buffer(dev->instance,
+					       &ctx->component->input[0],
+					       &src_m2m_buf->mmal);
+		v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: Submitted ip buffer len %lu, pts %llu, flags %04x\n",
+			 __func__, src_m2m_buf->mmal.length,
+			 src_m2m_buf->mmal.pts, src_m2m_buf->mmal.mmal_flags);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed submitting ip buffer\n",
+				 __func__);
+	}
+
+	dst_buf = v4l2_m2m_buf_remove(&ctx->fh.m2m_ctx->cap_q_ctx);
+	if (dst_buf) {
+		m2m = container_of(dst_buf, struct v4l2_m2m_buffer, vb);
+		dst_m2m_buf = container_of(m2m, struct m2m_mmal_buffer, m2m);
+		vb2_to_mmal_buffer(dst_m2m_buf, dst_buf);
+
+		ret = vchiq_mmal_submit_buffer(dev->instance,
+					       &ctx->component->output[0],
+					       &dst_m2m_buf->mmal);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed submitting op buffer\n",
+				 __func__);
+	}
+
+	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: Submitted src %p, dst %p\n",
+		 __func__, src_m2m_buf, dst_m2m_buf);
+
+	/* Complete the job here. */
+	v4l2_m2m_job_finish(ctx->dev->m2m_dev, ctx->fh.m2m_ctx);
+}
+
+/*
+ * video ioctls
+ */
+static int vidioc_querycap(struct file *file, void *priv,
+			   struct v4l2_capability *cap)
+{
+	strncpy(cap->driver, MEM2MEM_NAME, sizeof(cap->driver) - 1);
+	strncpy(cap->card, MEM2MEM_NAME, sizeof(cap->card) - 1);
+	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
+		 MEM2MEM_NAME);
+	cap->device_caps = V4L2_CAP_VIDEO_M2M | V4L2_CAP_STREAMING;
+	cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
+	return 0;
+}
+
+static int enum_fmt(struct v4l2_fmtdesc *f, bool decode, bool capture)
+{
+	struct bcm2835_codec_fmt *fmt;
+	struct bcm2835_codec_fmt_list *fmts = get_format_list(decode, capture);
+
+	if (f->index < fmts->num_entries) {
+		/* Format found */
+		/* Check format isn't a decode only format when encoding */
+		if (!decode &&
+		    fmts->list[f->index].decode_only)
+			return -EINVAL;
+		/* Check format isn't a decode only format when encoding */
+		if (decode &&
+		    fmts->list[f->index].encode_only)
+			return -EINVAL;
+
+		fmt = &fmts->list[f->index];
+		f->pixelformat = fmt->fourcc;
+		f->flags = fmt->flags;
+		return 0;
+	}
+
+	/* Format not found */
+	return -EINVAL;
+}
+
+static int vidioc_enum_fmt_vid_cap(struct file *file, void *priv,
+				   struct v4l2_fmtdesc *f)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	return enum_fmt(f, ctx->dev->decode, true);
+}
+
+static int vidioc_enum_fmt_vid_out(struct file *file, void *priv,
+				   struct v4l2_fmtdesc *f)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	return enum_fmt(f, ctx->dev->decode, false);
+}
+
+static int vidioc_g_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f)
+{
+	struct vb2_queue *vq;
+	struct bcm2835_codec_q_data *q_data;
+
+	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
+	if (!vq)
+		return -EINVAL;
+
+	q_data = get_q_data(ctx, f->type);
+
+	f->fmt.pix.width	= q_data->crop_width;
+	f->fmt.pix.height	= q_data->height;
+	f->fmt.pix.field	= V4L2_FIELD_NONE;
+	f->fmt.pix.pixelformat	= q_data->fmt->fourcc;
+	f->fmt.pix.bytesperline	= q_data->bytesperline;
+	f->fmt.pix.sizeimage	= q_data->sizeimage;
+	f->fmt.pix.colorspace	= ctx->colorspace;
+	f->fmt.pix.xfer_func	= ctx->xfer_func;
+	f->fmt.pix.ycbcr_enc	= ctx->ycbcr_enc;
+	f->fmt.pix.quantization	= ctx->quant;
+
+	return 0;
+}
+
+static int vidioc_g_fmt_vid_out(struct file *file, void *priv,
+				struct v4l2_format *f)
+{
+	return vidioc_g_fmt(file2ctx(file), f);
+}
+
+static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
+				struct v4l2_format *f)
+{
+	return vidioc_g_fmt(file2ctx(file), f);
+}
+
+static int vidioc_try_fmt(struct v4l2_format *f, struct bcm2835_codec_fmt *fmt)
+{
+	/*
+	 * The V4L2 specification requires the driver to correct the format
+	 * struct if any of the dimensions is unsupported
+	 */
+	if (f->fmt.pix.width > MAX_W)
+		f->fmt.pix.width = MAX_W;
+	if (f->fmt.pix.height > MAX_H)
+		f->fmt.pix.height = MAX_H;
+
+	if (!fmt->flags & V4L2_FMT_FLAG_COMPRESSED) {
+		/* Only clip min w/h on capture. Treat 0x0 as unknown. */
+		if (f->fmt.pix.width < MIN_W)
+			f->fmt.pix.width = MIN_W;
+		if (f->fmt.pix.height < MIN_H)
+			f->fmt.pix.height = MIN_H;
+
+		/*
+		 * Buffer must have a vertical alignment of 16 lines.
+		 * The selection will reflect any cropping rectangle when only
+		 * some of the pixels are active.
+		 */
+		f->fmt.pix.height = ALIGN(f->fmt.pix.height, 16);
+
+		f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
+							   fmt);
+		f->fmt.pix.sizeimage = get_sizeimage(f->fmt.pix.bytesperline,
+						     f->fmt.pix.height,
+						     fmt);
+	} else {
+		u32 min_size = f->fmt.pix.width > 1280 ||
+			       f->fmt.pix.height > 720 ?
+			       DEF_COMP_BUF_SIZE_GREATER_720P :
+			       DEF_COMP_BUF_SIZE_720P_OR_LESS;
+
+		f->fmt.pix.bytesperline = 0;
+		if (f->fmt.pix.sizeimage < min_size)
+			f->fmt.pix.sizeimage = min_size;
+	}
+
+	f->fmt.pix.field = V4L2_FIELD_NONE;
+
+	return 0;
+}
+
+static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+				  struct v4l2_format *f)
+{
+	struct bcm2835_codec_fmt *fmt;
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	fmt = find_format(f, ctx->dev->decode, true);
+	if (!fmt) {
+		f->fmt.pix.pixelformat = get_default_format(ctx->dev->decode,
+							    true)->fourcc;
+		fmt = find_format(f, ctx->dev->decode, true);
+	}
+
+	return vidioc_try_fmt(f, fmt);
+}
+
+static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
+				  struct v4l2_format *f)
+{
+	struct bcm2835_codec_fmt *fmt;
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	fmt = find_format(f, ctx->dev->decode, false);
+	if (!fmt) {
+		f->fmt.pix.pixelformat = get_default_format(ctx->dev->decode,
+							    false)->fourcc;
+		fmt = find_format(f, ctx->dev->decode, false);
+	}
+
+	if (!f->fmt.pix.colorspace)
+		f->fmt.pix.colorspace = ctx->colorspace;
+
+	return vidioc_try_fmt(f, fmt);
+}
+
+static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
+			unsigned int requested_height)
+{
+	struct bcm2835_codec_q_data *q_data;
+	struct vb2_queue *vq;
+	struct vchiq_mmal_port *port;
+	bool update_capture_port = false;
+	int ret;
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Setting format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
+		 f->type, f->fmt.pix.width, f->fmt.pix.height,
+		 f->fmt.pix.pixelformat, f->fmt.pix.sizeimage);
+
+	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
+	if (!vq)
+		return -EINVAL;
+
+	q_data = get_q_data(ctx, f->type);
+	if (!q_data)
+		return -EINVAL;
+
+	if (vb2_is_busy(vq)) {
+		v4l2_err(&ctx->dev->v4l2_dev, "%s queue busy\n", __func__);
+		return -EBUSY;
+	}
+
+	q_data->fmt = find_format(f, ctx->dev->decode,
+				  f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE);
+	q_data->crop_width = f->fmt.pix.width;
+	q_data->height = f->fmt.pix.height;
+	if (!q_data->selection_set)
+		q_data->crop_height = requested_height;
+
+	/*
+	 * Copying the behaviour of vicodec which retains a single set of
+	 * colorspace parameters for both input and output.
+	 */
+	ctx->colorspace = f->fmt.pix.colorspace;
+	ctx->xfer_func = f->fmt.pix.xfer_func;
+	ctx->ycbcr_enc = f->fmt.pix.ycbcr_enc;
+	ctx->quant = f->fmt.pix.quantization;
+
+	/* All parameters should have been set correctly by try_fmt */
+	q_data->bytesperline = f->fmt.pix.bytesperline;
+	q_data->sizeimage = f->fmt.pix.sizeimage;
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Calulated bpl as %u, size %u\n",
+		 q_data->bytesperline, q_data->sizeimage);
+
+	if (ctx->dev->decode && q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED &&
+	    f->fmt.pix.width && f->fmt.pix.height) {
+		/*
+		 * On the decoder, if provided with a resolution on the input
+		 * side, then replicate that to the output side.
+		 * GStreamer appears not to support V4L2_EVENT_SOURCE_CHANGE,
+		 * nor set up a resolution on the output side, therefore
+		 * we can't decode anything at a resolution other than the
+		 * default one.
+		 */
+		struct bcm2835_codec_q_data *q_data_dst =
+						&ctx->q_data[V4L2_M2M_DST];
+
+		q_data_dst->crop_width = q_data->crop_width;
+		q_data_dst->crop_height = q_data->crop_height;
+		q_data_dst->height = ALIGN(q_data->crop_height, 16);
+
+		q_data_dst->bytesperline =
+			get_bytesperline(f->fmt.pix.width, q_data_dst->fmt);
+		q_data_dst->sizeimage = get_sizeimage(q_data_dst->bytesperline,
+						      q_data_dst->height,
+						      q_data_dst->fmt);
+		update_capture_port = true;
+	}
+
+	/* If we have a component then setup the port as well */
+	port = get_port_data(ctx, vq->type);
+	if (!port)
+		return 0;
+
+	setup_mmal_port_format(ctx, ctx->dev->decode, q_data, port);
+	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
+	if (ret) {
+		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
+			 __func__, ret);
+		ret = -EINVAL;
+	}
+
+	if (q_data->sizeimage < port->minimum_buffer.size) {
+		v4l2_err(&ctx->dev->v4l2_dev, "%s: Current buffer size of %u < min buf size %u - driver mismatch to MMAL\n",
+			 __func__, q_data->sizeimage,
+			 port->minimum_buffer.size);
+	}
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Set format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
+		 f->type, q_data->crop_width, q_data->height,
+		 q_data->fmt->fourcc, q_data->sizeimage);
+
+	if (update_capture_port) {
+		struct vchiq_mmal_port *port_dst = &ctx->component->output[0];
+		struct bcm2835_codec_q_data *q_data_dst =
+						&ctx->q_data[V4L2_M2M_DST];
+
+		setup_mmal_port_format(ctx, ctx->dev->decode, q_data_dst,
+				       port_dst);
+		ret = vchiq_mmal_port_set_format(ctx->dev->instance, port_dst);
+		if (ret) {
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on output port, ret %d\n",
+				 __func__, ret);
+			ret = -EINVAL;
+		}
+	}
+	return ret;
+}
+
+static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
+				struct v4l2_format *f)
+{
+	unsigned int height = f->fmt.pix.height;
+	int ret;
+
+	ret = vidioc_try_fmt_vid_cap(file, priv, f);
+	if (ret)
+		return ret;
+
+	return vidioc_s_fmt(file2ctx(file), f, height);
+}
+
+static int vidioc_s_fmt_vid_out(struct file *file, void *priv,
+				struct v4l2_format *f)
+{
+	unsigned int height = f->fmt.pix.height;
+	int ret;
+
+	ret = vidioc_try_fmt_vid_out(file, priv, f);
+	if (ret)
+		return ret;
+
+	ret = vidioc_s_fmt(file2ctx(file), f, height);
+	return ret;
+}
+
+static int vidioc_g_selection(struct file *file, void *priv,
+			      struct v4l2_selection *s)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+	struct bcm2835_codec_q_data *q_data;
+	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ?
+								true : false;
+
+	if (capture_queue ^ ctx->dev->decode)
+		/* OUTPUT on decoder and CAPTURE on encoder are not valid. */
+		return -EINVAL;
+
+	q_data = get_q_data(ctx, s->type);
+	if (!q_data)
+		return -EINVAL;
+
+	if (ctx->dev->decode) {
+		switch (s->target) {
+		case V4L2_SEL_TGT_COMPOSE_DEFAULT:
+		case V4L2_SEL_TGT_COMPOSE:
+			s->r.left = 0;
+			s->r.top = 0;
+			s->r.width = q_data->crop_width;
+			s->r.height = q_data->crop_height;
+			break;
+		case V4L2_SEL_TGT_COMPOSE_BOUNDS:
+			s->r.left = 0;
+			s->r.top = 0;
+			s->r.width = q_data->crop_width;
+			s->r.height = q_data->crop_height;
+			break;
+		default:
+			return -EINVAL;
+		}
+	} else {
+		switch (s->target) {
+		case V4L2_SEL_TGT_CROP_DEFAULT:
+		case V4L2_SEL_TGT_CROP_BOUNDS:
+			s->r.top = 0;
+			s->r.left = 0;
+			s->r.width = q_data->bytesperline;
+			s->r.height = q_data->height;
+			break;
+		case V4L2_SEL_TGT_CROP:
+			s->r.top = 0;
+			s->r.left = 0;
+			s->r.width = q_data->crop_width;
+			s->r.height = q_data->crop_height;
+			break;
+		default:
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int vidioc_s_selection(struct file *file, void *priv,
+			      struct v4l2_selection *s)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+	struct bcm2835_codec_q_data *q_data = NULL;
+	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ?
+								true : false;
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: ctx %p, type %d, q_data %p, target %d, rect x/y %d/%d, w/h %ux%u\n",
+		 __func__, ctx, s->type, q_data, s->target, s->r.left, s->r.top,
+		 s->r.width, s->r.height);
+
+	if (capture_queue ^ ctx->dev->decode)
+		/* OUTPUT on decoder and CAPTURE on encoder are not valid. */
+		return -EINVAL;
+
+	q_data = get_q_data(ctx, s->type);
+	if (!q_data)
+		return -EINVAL;
+
+	if (ctx->dev->decode) {
+		switch (s->target) {
+		case V4L2_SEL_TGT_COMPOSE:
+			/* Accept cropped image */
+			s->r.left = 0;
+			s->r.top = 0;
+			s->r.width = min(s->r.width, q_data->crop_width);
+			s->r.height = min(s->r.height, q_data->height);
+			q_data->crop_width = s->r.width;
+			q_data->crop_height = s->r.height;
+			q_data->selection_set = true;
+			break;
+		default:
+			return -EINVAL;
+		}
+	} else {
+		switch (s->target) {
+		case V4L2_SEL_TGT_CROP:
+			/* Only support crop from (0,0) */
+			s->r.top = 0;
+			s->r.left = 0;
+			s->r.width = min(s->r.width, q_data->crop_width);
+			s->r.height = min(s->r.height, q_data->crop_height);
+			q_data->crop_width = s->r.width;
+			q_data->crop_height = s->r.height;
+			q_data->selection_set = true;
+			break;
+		default:
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int vidioc_subscribe_evt(struct v4l2_fh *fh,
+				const struct v4l2_event_subscription *sub)
+{
+	switch (sub->type) {
+	case V4L2_EVENT_EOS:
+		return v4l2_event_subscribe(fh, sub, 2, NULL);
+	case V4L2_EVENT_SOURCE_CHANGE:
+		return v4l2_src_change_event_subscribe(fh, sub);
+	default:
+		return v4l2_ctrl_subscribe_event(fh, sub);
+	}
+}
+
+static int bcm2835_codec_set_level_profile(struct bcm2835_codec_ctx *ctx,
+					   struct v4l2_ctrl *ctrl)
+{
+	struct mmal_parameter_video_profile param;
+	int param_size = sizeof(param);
+	int ret;
+
+	/*
+	 * Level and Profile are set via the same MMAL parameter.
+	 * Retrieve the current settings and amend the one that has changed.
+	 */
+	ret = vchiq_mmal_port_parameter_get(ctx->dev->instance,
+					    &ctx->component->output[0],
+					    MMAL_PARAMETER_PROFILE,
+					    &param,
+					    &param_size);
+	if (ret)
+		return ret;
+
+	switch (ctrl->id) {
+	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+		switch (ctrl->val) {
+		case V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE:
+			param.profile = MMAL_VIDEO_PROFILE_H264_BASELINE;
+			break;
+		case V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE:
+			param.profile =
+				MMAL_VIDEO_PROFILE_H264_CONSTRAINED_BASELINE;
+			break;
+		case V4L2_MPEG_VIDEO_H264_PROFILE_MAIN:
+			param.profile = MMAL_VIDEO_PROFILE_H264_MAIN;
+			break;
+		case V4L2_MPEG_VIDEO_H264_PROFILE_HIGH:
+			param.profile = MMAL_VIDEO_PROFILE_H264_HIGH;
+			break;
+		default:
+			/* Should never get here */
+			break;
+		}
+		break;
+
+	case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
+		switch (ctrl->val) {
+		case V4L2_MPEG_VIDEO_H264_LEVEL_1_0:
+			param.level = MMAL_VIDEO_LEVEL_H264_1;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_1B:
+			param.level = MMAL_VIDEO_LEVEL_H264_1b;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_1_1:
+			param.level = MMAL_VIDEO_LEVEL_H264_11;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_1_2:
+			param.level = MMAL_VIDEO_LEVEL_H264_12;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_1_3:
+			param.level = MMAL_VIDEO_LEVEL_H264_13;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_2_0:
+			param.level = MMAL_VIDEO_LEVEL_H264_2;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_2_1:
+			param.level = MMAL_VIDEO_LEVEL_H264_21;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_2_2:
+			param.level = MMAL_VIDEO_LEVEL_H264_22;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_3_0:
+			param.level = MMAL_VIDEO_LEVEL_H264_3;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_3_1:
+			param.level = MMAL_VIDEO_LEVEL_H264_31;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_3_2:
+			param.level = MMAL_VIDEO_LEVEL_H264_32;
+			break;
+		case V4L2_MPEG_VIDEO_H264_LEVEL_4_0:
+			param.level = MMAL_VIDEO_LEVEL_H264_4;
+			break;
+		default:
+			/* Should never get here */
+			break;
+		}
+	}
+	ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
+					    &ctx->component->output[0],
+					    MMAL_PARAMETER_PROFILE,
+					    &param,
+					    param_size);
+
+	return ret;
+}
+
+static int bcm2835_codec_s_ctrl(struct v4l2_ctrl *ctrl)
+{
+	struct bcm2835_codec_ctx *ctx =
+		container_of(ctrl->handler, struct bcm2835_codec_ctx, hdl);
+	int ret = 0;
+
+	switch (ctrl->id) {
+	case V4L2_CID_MPEG_VIDEO_BITRATE:
+		ctx->bitrate = ctrl->val;
+		if (!ctx->component)
+			break;
+
+		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
+						    &ctx->component->output[0],
+						    MMAL_PARAMETER_VIDEO_BIT_RATE,
+						    &ctrl->val,
+						    sizeof(ctrl->val));
+		break;
+
+	case V4L2_CID_MPEG_VIDEO_BITRATE_MODE: {
+		u32 bitrate_mode;
+
+		if (!ctx->component)
+			break;
+
+		switch (ctrl->val) {
+		default:
+		case V4L2_MPEG_VIDEO_BITRATE_MODE_VBR:
+			bitrate_mode = MMAL_VIDEO_RATECONTROL_VARIABLE;
+			break;
+		case V4L2_MPEG_VIDEO_BITRATE_MODE_CBR:
+			bitrate_mode = MMAL_VIDEO_RATECONTROL_CONSTANT;
+			break;
+		}
+
+		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
+						    &ctx->component->output[0],
+						    MMAL_PARAMETER_RATECONTROL,
+						    &bitrate_mode,
+						    sizeof(bitrate_mode));
+		break;
+	}
+	case V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER:
+		if (!ctx->component)
+			break;
+
+		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
+						    &ctx->component->output[0],
+						    MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
+						    &ctrl->val,
+						    sizeof(ctrl->val));
+		break;
+
+	case V4L2_CID_MPEG_VIDEO_H264_I_PERIOD:
+		if (!ctx->component)
+			break;
+
+		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
+						    &ctx->component->output[0],
+						    MMAL_PARAMETER_INTRAPERIOD,
+						    &ctrl->val,
+						    sizeof(ctrl->val));
+		break;
+
+	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+	case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
+		if (!ctx->component)
+			break;
+
+		ret = bcm2835_codec_set_level_profile(ctx, ctrl);
+		break;
+
+	default:
+		v4l2_err(&ctx->dev->v4l2_dev, "Invalid control\n");
+		return -EINVAL;
+	}
+
+	if (ret)
+		v4l2_err(&ctx->dev->v4l2_dev, "Failed setting ctrl %08x, ret %d\n",
+			 ctrl->id, ret);
+	return ret ? -EINVAL : 0;
+}
+
+static const struct v4l2_ctrl_ops bcm2835_codec_ctrl_ops = {
+	.s_ctrl = bcm2835_codec_s_ctrl,
+};
+
+static int vidioc_try_decoder_cmd(struct file *file, void *priv,
+				  struct v4l2_decoder_cmd *cmd)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	if (!ctx->dev->decode)
+		return -EINVAL;
+
+	switch (cmd->cmd) {
+	case V4L2_DEC_CMD_STOP:
+		if (cmd->flags & V4L2_DEC_CMD_STOP_TO_BLACK) {
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: DEC cmd->flags=%u stop to black not supported",
+				 __func__, cmd->flags);
+			return -EINVAL;
+		}
+		break;
+	case V4L2_DEC_CMD_START:
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int vidioc_decoder_cmd(struct file *file, void *priv,
+			      struct v4l2_decoder_cmd *cmd)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_SRC];
+	int ret;
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s, cmd %u", __func__,
+		 cmd->cmd);
+	ret = vidioc_try_decoder_cmd(file, priv, cmd);
+	if (ret)
+		return ret;
+
+	switch (cmd->cmd) {
+	case V4L2_DEC_CMD_STOP:
+		if (q_data->eos_buffer_in_use)
+			v4l2_err(&ctx->dev->v4l2_dev, "EOS buffers already in use\n");
+		q_data->eos_buffer_in_use = true;
+
+		q_data->eos_buffer.mmal.buffer_size = 0;
+		q_data->eos_buffer.mmal.length = 0;
+		q_data->eos_buffer.mmal.mmal_flags =
+						MMAL_BUFFER_HEADER_FLAG_EOS;
+		q_data->eos_buffer.mmal.pts = 0;
+		q_data->eos_buffer.mmal.dts = 0;
+
+		if (!ctx->component)
+			break;
+
+		ret = vchiq_mmal_submit_buffer(ctx->dev->instance,
+					       &ctx->component->input[0],
+					       &q_data->eos_buffer.mmal);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev,
+				 "%s: EOS buffer submit failed %d\n",
+				 __func__, ret);
+
+		break;
+
+	case V4L2_DEC_CMD_START:
+		/* Do we need to do anything here? */
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int vidioc_try_encoder_cmd(struct file *file, void *priv,
+				  struct v4l2_encoder_cmd *cmd)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	if (ctx->dev->decode)
+		return -EINVAL;
+
+	switch (cmd->cmd) {
+	case V4L2_ENC_CMD_STOP:
+		break;
+
+	case V4L2_ENC_CMD_START:
+		/* Do we need to do anything here? */
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int vidioc_encoder_cmd(struct file *file, void *priv,
+			      struct v4l2_encoder_cmd *cmd)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+	struct bcm2835_codec_q_data *q_data = &ctx->q_data[V4L2_M2M_SRC];
+	int ret;
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s, cmd %u", __func__,
+		 cmd->cmd);
+	ret = vidioc_try_encoder_cmd(file, priv, cmd);
+	if (ret)
+		return ret;
+
+	switch (cmd->cmd) {
+	case V4L2_ENC_CMD_STOP:
+		if (q_data->eos_buffer_in_use)
+			v4l2_err(&ctx->dev->v4l2_dev, "EOS buffers already in use\n");
+		q_data->eos_buffer_in_use = true;
+
+		q_data->eos_buffer.mmal.buffer_size = 0;
+		q_data->eos_buffer.mmal.length = 0;
+		q_data->eos_buffer.mmal.mmal_flags =
+						MMAL_BUFFER_HEADER_FLAG_EOS;
+		q_data->eos_buffer.mmal.pts = 0;
+		q_data->eos_buffer.mmal.dts = 0;
+
+		if (!ctx->component)
+			break;
+
+		ret = vchiq_mmal_submit_buffer(ctx->dev->instance,
+					       &ctx->component->input[0],
+					       &q_data->eos_buffer.mmal);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev,
+				 "%s: EOS buffer submit failed %d\n",
+				 __func__, ret);
+
+		break;
+	case V4L2_ENC_CMD_START:
+		/* Do we need to do anything here? */
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static const struct v4l2_ioctl_ops bcm2835_codec_ioctl_ops = {
+	.vidioc_querycap	= vidioc_querycap,
+
+	.vidioc_enum_fmt_vid_cap = vidioc_enum_fmt_vid_cap,
+	.vidioc_g_fmt_vid_cap	= vidioc_g_fmt_vid_cap,
+	.vidioc_try_fmt_vid_cap	= vidioc_try_fmt_vid_cap,
+	.vidioc_s_fmt_vid_cap	= vidioc_s_fmt_vid_cap,
+
+	.vidioc_enum_fmt_vid_out = vidioc_enum_fmt_vid_out,
+	.vidioc_g_fmt_vid_out	= vidioc_g_fmt_vid_out,
+	.vidioc_try_fmt_vid_out	= vidioc_try_fmt_vid_out,
+	.vidioc_s_fmt_vid_out	= vidioc_s_fmt_vid_out,
+
+	.vidioc_reqbufs		= v4l2_m2m_ioctl_reqbufs,
+	.vidioc_querybuf	= v4l2_m2m_ioctl_querybuf,
+	.vidioc_qbuf		= v4l2_m2m_ioctl_qbuf,
+	.vidioc_dqbuf		= v4l2_m2m_ioctl_dqbuf,
+	.vidioc_prepare_buf	= v4l2_m2m_ioctl_prepare_buf,
+	.vidioc_create_bufs	= v4l2_m2m_ioctl_create_bufs,
+	.vidioc_expbuf		= v4l2_m2m_ioctl_expbuf,
+
+	.vidioc_streamon	= v4l2_m2m_ioctl_streamon,
+	.vidioc_streamoff	= v4l2_m2m_ioctl_streamoff,
+
+	.vidioc_g_selection	= vidioc_g_selection,
+	.vidioc_s_selection	= vidioc_s_selection,
+
+	.vidioc_subscribe_event = vidioc_subscribe_evt,
+	.vidioc_unsubscribe_event = v4l2_event_unsubscribe,
+
+	.vidioc_decoder_cmd = vidioc_decoder_cmd,
+	.vidioc_try_decoder_cmd = vidioc_try_decoder_cmd,
+	.vidioc_encoder_cmd = vidioc_encoder_cmd,
+	.vidioc_try_encoder_cmd = vidioc_try_encoder_cmd,
+};
+
+static int bcm2835_codec_set_ctrls(struct bcm2835_codec_ctx *ctx)
+{
+	/*
+	 * Query the control handler for the value of the various controls and
+	 * set them.
+	 */
+	const u32 control_ids[] = {
+		V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+		V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER,
+		V4L2_CID_MPEG_VIDEO_H264_I_PERIOD,
+		V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+	};
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(control_ids); i++) {
+		struct v4l2_ctrl *ctrl;
+
+		ctrl = v4l2_ctrl_find(&ctx->hdl, control_ids[i]);
+		if (ctrl)
+			bcm2835_codec_s_ctrl(ctrl);
+	}
+
+	return 0;
+}
+
+static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
+{
+	struct bcm2835_codec_dev *dev = ctx->dev;
+	unsigned int enable = 1;
+	int ret;
+
+	ret = vchiq_mmal_component_init(dev->instance, dev->decode ?
+					"ril.video_decode" : "ril.video_encode",
+					&ctx->component);
+	if (ret < 0) {
+		v4l2_err(&dev->v4l2_dev, "%s: failed to create component for %s\n",
+			 __func__, dev->decode ? "decode" : "encode");
+		return -ENOMEM;
+	}
+
+	vchiq_mmal_port_parameter_set(dev->instance, &ctx->component->input[0],
+				      MMAL_PARAMETER_ZERO_COPY, &enable,
+				      sizeof(enable));
+	vchiq_mmal_port_parameter_set(dev->instance, &ctx->component->output[0],
+				      MMAL_PARAMETER_ZERO_COPY, &enable,
+				      sizeof(enable));
+
+	setup_mmal_port_format(ctx, dev->decode, &ctx->q_data[V4L2_M2M_SRC],
+			       &ctx->component->input[0]);
+
+	setup_mmal_port_format(ctx, dev->decode, &ctx->q_data[V4L2_M2M_DST],
+			       &ctx->component->output[0]);
+
+	ret = vchiq_mmal_port_set_format(dev->instance,
+					 &ctx->component->input[0]);
+	if (ret < 0)
+		goto destroy_component;
+
+	ret = vchiq_mmal_port_set_format(dev->instance,
+					 &ctx->component->output[0]);
+	if (ret < 0)
+		goto destroy_component;
+
+	if (dev->decode) {
+		if (ctx->q_data[V4L2_M2M_DST].sizeimage <
+			ctx->component->output[0].minimum_buffer.size)
+			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
+				 ctx->q_data[V4L2_M2M_DST].sizeimage,
+				 ctx->component->output[0].minimum_buffer.size);
+	} else {
+		if (ctx->q_data[V4L2_M2M_SRC].sizeimage <
+			ctx->component->output[0].minimum_buffer.size)
+			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
+				 ctx->q_data[V4L2_M2M_SRC].sizeimage,
+				 ctx->component->output[0].minimum_buffer.size);
+
+		/* Now we have a component we can set all the ctrls */
+		bcm2835_codec_set_ctrls(ctx);
+	}
+
+	return 0;
+
+destroy_component:
+	vchiq_mmal_component_finalise(ctx->dev->instance, ctx->component);
+
+	return ret;
+}
+
+/*
+ * Queue operations
+ */
+
+static int bcm2835_codec_queue_setup(struct vb2_queue *vq,
+				     unsigned int *nbuffers,
+				     unsigned int *nplanes,
+				     unsigned int sizes[],
+				     struct device *alloc_devs[])
+{
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vq);
+	struct bcm2835_codec_q_data *q_data;
+	struct vchiq_mmal_port *port;
+	unsigned int size;
+
+	q_data = get_q_data(ctx, vq->type);
+	if (!q_data)
+		return -EINVAL;
+
+	if (!ctx->component)
+		if (bcm2835_codec_create_component(ctx))
+			return -EINVAL;
+
+	port = get_port_data(ctx, vq->type);
+
+	size = q_data->sizeimage;
+
+	if (*nplanes)
+		return sizes[0] < size ? -EINVAL : 0;
+
+	*nplanes = 1;
+
+	sizes[0] = size;
+	port->current_buffer.size = size;
+
+	if (*nbuffers < port->minimum_buffer.num)
+		*nbuffers = port->minimum_buffer.num;
+	/* Add one buffer to take an EOS */
+	port->current_buffer.num = *nbuffers + 1;
+
+	return 0;
+}
+
+static int bcm2835_codec_buf_init(struct vb2_buffer *vb)
+{
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
+	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
+	struct v4l2_m2m_buffer *m2m = container_of(vb2, struct v4l2_m2m_buffer,
+						   vb);
+	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
+						   m2m);
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
+		 __func__, ctx, vb);
+	buf->mmal.buffer = vb2_plane_vaddr(&buf->m2m.vb.vb2_buf, 0);
+	buf->mmal.buffer_size = vb2_plane_size(&buf->m2m.vb.vb2_buf, 0);
+
+	mmal_vchi_buffer_init(ctx->dev->instance, &buf->mmal);
+
+	return 0;
+}
+
+static int bcm2835_codec_buf_prepare(struct vb2_buffer *vb)
+{
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
+	struct bcm2835_codec_q_data *q_data;
+	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
+	struct v4l2_m2m_buffer *m2m = container_of(vbuf, struct v4l2_m2m_buffer,
+						   vb);
+	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
+						   m2m);
+	int ret;
+
+	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p\n",
+		 __func__, vb->vb2_queue->type, vb);
+
+	q_data = get_q_data(ctx, vb->vb2_queue->type);
+	if (V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type)) {
+		if (vbuf->field == V4L2_FIELD_ANY)
+			vbuf->field = V4L2_FIELD_NONE;
+		if (vbuf->field != V4L2_FIELD_NONE) {
+			v4l2_err(&ctx->dev->v4l2_dev, "%s field isn't supported\n",
+				 __func__);
+			return -EINVAL;
+		}
+	}
+
+	if (vb2_plane_size(vb, 0) < q_data->sizeimage) {
+		v4l2_err(&ctx->dev->v4l2_dev, "%s data will not fit into plane (%lu < %lu)\n",
+			 __func__, vb2_plane_size(vb, 0),
+			 (long)q_data->sizeimage);
+		return -EINVAL;
+	}
+
+	if (!V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type))
+		vb2_set_plane_payload(vb, 0, q_data->sizeimage);
+
+	/*
+	 * We want to do this at init, but vb2_core_expbuf checks that the
+	 * index < q->num_buffers, and q->num_buffers only gets updated once
+	 * all the buffers are allocated.
+	 */
+	if (!buf->mmal.dma_buf) {
+		ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
+					     vb->vb2_queue->type, vb->index, 0,
+					     O_CLOEXEC, &buf->mmal.dma_buf);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed to expbuf idx %d, ret %d\n",
+				 __func__, vb->index, ret);
+	} else {
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static void bcm2835_codec_buf_queue(struct vb2_buffer *vb)
+{
+	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
+
+	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p vbuf->flags %u, seq %u, bytesused %u\n",
+		 __func__, vb->vb2_queue->type, vb, vbuf->flags, vbuf->sequence,
+		 vb->planes[0].bytesused);
+	v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, vbuf);
+}
+
+static void bcm2835_codec_buffer_cleanup(struct vb2_buffer *vb)
+{
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
+	struct vb2_v4l2_buffer *vb2 = to_vb2_v4l2_buffer(vb);
+	struct v4l2_m2m_buffer *m2m = container_of(vb2, struct v4l2_m2m_buffer,
+						   vb);
+	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
+						   m2m);
+
+	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
+		 __func__, ctx, vb);
+
+	mmal_vchi_buffer_cleanup(&buf->mmal);
+
+	if (buf->mmal.dma_buf) {
+		dma_buf_put(buf->mmal.dma_buf);
+		buf->mmal.dma_buf = NULL;
+	}
+}
+
+static int bcm2835_codec_start_streaming(struct vb2_queue *q,
+					 unsigned int count)
+{
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(q);
+	struct bcm2835_codec_dev *dev = ctx->dev;
+	struct bcm2835_codec_q_data *q_data = get_q_data(ctx, q->type);
+	int ret;
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: type: %d count %d\n",
+		 __func__, q->type, count);
+	q_data->sequence = 0;
+
+	if (!ctx->component_enabled) {
+		ret = vchiq_mmal_component_enable(dev->instance,
+						  ctx->component);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
+				 __func__, ret);
+		ctx->component_enabled = true;
+	}
+
+	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
+		/*
+		 * Create the EOS buffer.
+		 * We only need the MMAL part, and want to NOT attach a memory
+		 * buffer to it as it should only take flags.
+		 */
+		memset(&q_data->eos_buffer, 0, sizeof(q_data->eos_buffer));
+		mmal_vchi_buffer_init(dev->instance,
+				      &q_data->eos_buffer.mmal);
+		q_data->eos_buffer_in_use = false;
+
+		ctx->component->input[0].cb_ctx = ctx;
+		ret = vchiq_mmal_port_enable(dev->instance,
+					     &ctx->component->input[0],
+					     ip_buffer_cb);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling i/p port, ret %d\n",
+				 __func__, ret);
+	} else {
+		ctx->component->output[0].cb_ctx = ctx;
+		ret = vchiq_mmal_port_enable(dev->instance,
+					     &ctx->component->output[0],
+					     op_buffer_cb);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling o/p port, ret %d\n",
+				 __func__, ret);
+	}
+	return ret;
+}
+
+static void bcm2835_codec_stop_streaming(struct vb2_queue *q)
+{
+	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(q);
+	struct bcm2835_codec_dev *dev = ctx->dev;
+	struct bcm2835_codec_q_data *q_data = get_q_data(ctx, q->type);
+	struct vchiq_mmal_port *port = get_port_data(ctx, q->type);
+	struct vb2_v4l2_buffer *vbuf;
+	struct vb2_v4l2_buffer *vb2;
+	struct v4l2_m2m_buffer *m2m;
+	struct m2m_mmal_buffer *buf;
+	int ret, i;
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: type: %d - return buffers\n",
+		 __func__, q->type);
+
+	init_completion(&ctx->frame_cmplt);
+
+	/* Clear out all buffers held by m2m framework */
+	for (;;) {
+		if (V4L2_TYPE_IS_OUTPUT(q->type))
+			vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+		else
+			vbuf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+		if (!vbuf)
+			break;
+		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: return buffer %p\n",
+			 __func__, vbuf);
+
+		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
+	}
+
+	/* Disable MMAL port - this will flush buffers back */
+	ret = vchiq_mmal_port_disable(dev->instance, port);
+	if (ret)
+		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed disabling %s port, ret %d\n",
+			 __func__, V4L2_TYPE_IS_OUTPUT(q->type) ? "i/p" : "o/p",
+			 ret);
+
+	while (atomic_read(&port->buffers_with_vpu)) {
+		v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Waiting for buffers to be returned - %d outstanding\n",
+			 __func__, atomic_read(&port->buffers_with_vpu));
+		ret = wait_for_completion_timeout(&ctx->frame_cmplt, HZ);
+		if (ret <= 0) {
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
+				 __func__,
+				 atomic_read(&port->buffers_with_vpu));
+			break;
+		}
+	}
+
+	/*
+	 * Release the VCSM handle here as otherwise REQBUFS(0) aborts because
+	 * someone is using the dmabuf before giving the driver a chance to do
+	 * anything about it.
+	 */
+	for (i = 0; i < q->num_buffers; i++) {
+		vb2 = to_vb2_v4l2_buffer(q->bufs[i]);
+		m2m = container_of(vb2, struct v4l2_m2m_buffer, vb);
+		buf = container_of(m2m, struct m2m_mmal_buffer, m2m);
+
+		mmal_vchi_buffer_cleanup(&buf->mmal);
+		if (buf->mmal.dma_buf) {
+			dma_buf_put(buf->mmal.dma_buf);
+			buf->mmal.dma_buf = NULL;
+		}
+	}
+
+	/* If both ports disabled, then disable the component */
+	if (!ctx->component->input[0].enabled &&
+	    !ctx->component->output[0].enabled) {
+		ret = vchiq_mmal_component_disable(dev->instance,
+						   ctx->component);
+		if (ret)
+			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed enabling component, ret %d\n",
+				 __func__, ret);
+	}
+
+	if (V4L2_TYPE_IS_OUTPUT(q->type))
+		mmal_vchi_buffer_cleanup(&q_data->eos_buffer.mmal);
+
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: done\n", __func__);
+}
+
+static const struct vb2_ops bcm2835_codec_qops = {
+	.queue_setup	 = bcm2835_codec_queue_setup,
+	.buf_init	 = bcm2835_codec_buf_init,
+	.buf_prepare	 = bcm2835_codec_buf_prepare,
+	.buf_queue	 = bcm2835_codec_buf_queue,
+	.buf_cleanup	 = bcm2835_codec_buffer_cleanup,
+	.start_streaming = bcm2835_codec_start_streaming,
+	.stop_streaming  = bcm2835_codec_stop_streaming,
+	.wait_prepare	 = vb2_ops_wait_prepare,
+	.wait_finish	 = vb2_ops_wait_finish,
+};
+
+static int queue_init(void *priv, struct vb2_queue *src_vq,
+		      struct vb2_queue *dst_vq)
+{
+	struct bcm2835_codec_ctx *ctx = priv;
+	int ret;
+
+	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+	src_vq->io_modes = VB2_MMAP | VB2_DMABUF;
+	src_vq->drv_priv = ctx;
+	src_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
+	src_vq->ops = &bcm2835_codec_qops;
+	src_vq->mem_ops = &vb2_dma_contig_memops;
+	src_vq->dev = &ctx->dev->pdev->dev;
+	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	src_vq->lock = &ctx->dev->dev_mutex;
+
+	ret = vb2_queue_init(src_vq);
+	if (ret)
+		return ret;
+
+	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	dst_vq->io_modes = VB2_MMAP | VB2_DMABUF;
+	dst_vq->drv_priv = ctx;
+	dst_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
+	dst_vq->ops = &bcm2835_codec_qops;
+	dst_vq->mem_ops = &vb2_dma_contig_memops;
+	dst_vq->dev = &ctx->dev->pdev->dev;
+	dst_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	dst_vq->lock = &ctx->dev->dev_mutex;
+
+	return vb2_queue_init(dst_vq);
+}
+
+/*
+ * File operations
+ */
+static int bcm2835_codec_open(struct file *file)
+{
+	struct bcm2835_codec_dev *dev = video_drvdata(file);
+	struct bcm2835_codec_ctx *ctx = NULL;
+	struct v4l2_ctrl_handler *hdl;
+	int rc = 0;
+
+	v4l2_dbg(1, debug, &dev->v4l2_dev, "Creating instance for %s\n",
+		 dev->decode ? "decode" : "encode");
+	if (mutex_lock_interruptible(&dev->dev_mutex)) {
+		v4l2_err(&dev->v4l2_dev, "Mutex fail\n");
+		return -ERESTARTSYS;
+	}
+	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+	if (!ctx) {
+		rc = -ENOMEM;
+		goto open_unlock;
+	}
+
+	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev->decode, false);
+	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev->decode, true);
+	if (dev->decode) {
+		/*
+		 * Input width and height are irrelevant as they will be defined
+		 * by the bitstream not the format. Required by V4L2 though.
+		 */
+		ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
+		ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_SRC].bytesperline = 0;
+		ctx->q_data[V4L2_M2M_SRC].sizeimage =
+						DEF_COMP_BUF_SIZE_720P_OR_LESS;
+
+		ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
+		ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_DST].bytesperline =
+				get_bytesperline(DEFAULT_WIDTH,
+						 ctx->q_data[V4L2_M2M_DST].fmt);
+		ctx->q_data[V4L2_M2M_DST].sizeimage =
+			get_sizeimage(ctx->q_data[V4L2_M2M_DST].bytesperline,
+				      ctx->q_data[V4L2_M2M_DST].height,
+				      ctx->q_data[V4L2_M2M_DST].fmt);
+	} else {
+		ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
+		ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_SRC].bytesperline =
+				get_bytesperline(DEFAULT_WIDTH,
+						 ctx->q_data[V4L2_M2M_SRC].fmt);
+		ctx->q_data[V4L2_M2M_SRC].sizeimage =
+			get_sizeimage(ctx->q_data[V4L2_M2M_SRC].bytesperline,
+				      ctx->q_data[V4L2_M2M_SRC].height,
+				      ctx->q_data[V4L2_M2M_SRC].fmt);
+
+		ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
+		ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_DST].bytesperline = 0;
+		ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
+		ctx->q_data[V4L2_M2M_DST].sizeimage =
+						DEF_COMP_BUF_SIZE_720P_OR_LESS;
+	}
+
+	ctx->colorspace = V4L2_COLORSPACE_REC709;
+	ctx->bitrate = 10 * 1000 * 1000;
+
+	/* Initialise V4L2 contexts */
+	v4l2_fh_init(&ctx->fh, video_devdata(file));
+	file->private_data = &ctx->fh;
+	ctx->dev = dev;
+	hdl = &ctx->hdl;
+	if (!dev->decode) {
+		/* Encode controls */
+		v4l2_ctrl_handler_init(hdl, 6);
+
+		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+				       V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
+				       V4L2_MPEG_VIDEO_BITRATE_MODE_CBR, 0,
+				       V4L2_MPEG_VIDEO_BITRATE_MODE_VBR);
+		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+				  V4L2_CID_MPEG_VIDEO_BITRATE,
+				  25 * 1000, 25 * 1000 * 1000,
+				  25 * 1000, 10 * 1000 * 1000);
+		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+				  V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER,
+				  0, 1,
+				  1, 0);
+		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+				  V4L2_CID_MPEG_VIDEO_H264_I_PERIOD,
+				  0, 0x7FFFFFFF,
+				  1, 60);
+		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+				       V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+				       V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
+				       ~(BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1B) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_1) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_2) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_1_3) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_1) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_2_2) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
+					 BIT(V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
+				       V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
+		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
+				       V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+				       V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+				       ~(BIT(V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
+					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
+					V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
+		if (hdl->error) {
+			rc = hdl->error;
+			goto free_ctrl_handler;
+		}
+		ctx->fh.ctrl_handler = hdl;
+		v4l2_ctrl_handler_setup(hdl);
+	}
+
+	ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, ctx, &queue_init);
+
+	if (IS_ERR(ctx->fh.m2m_ctx)) {
+		rc = PTR_ERR(ctx->fh.m2m_ctx);
+
+		goto free_ctrl_handler;
+	}
+
+	/* Set both queues as buffered as we have buffering in the VPU. That
+	 * means that we will be scheduled whenever either an input or output
+	 * buffer is available (otherwise one of each are required).
+	 */
+	v4l2_m2m_set_src_buffered(ctx->fh.m2m_ctx, true);
+	v4l2_m2m_set_dst_buffered(ctx->fh.m2m_ctx, true);
+
+	v4l2_fh_add(&ctx->fh);
+	atomic_inc(&dev->num_inst);
+
+	mutex_unlock(&dev->dev_mutex);
+	return 0;
+
+free_ctrl_handler:
+	v4l2_ctrl_handler_free(hdl);
+	kfree(ctx);
+open_unlock:
+	mutex_unlock(&dev->dev_mutex);
+	return rc;
+}
+
+static int bcm2835_codec_release(struct file *file)
+{
+	struct bcm2835_codec_dev *dev = video_drvdata(file);
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: Releasing instance %p\n",
+		 __func__, ctx);
+
+	v4l2_fh_del(&ctx->fh);
+	v4l2_fh_exit(&ctx->fh);
+	v4l2_ctrl_handler_free(&ctx->hdl);
+	mutex_lock(&dev->dev_mutex);
+	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+
+	if (ctx->component)
+		vchiq_mmal_component_finalise(dev->instance, ctx->component);
+
+	mutex_unlock(&dev->dev_mutex);
+	kfree(ctx);
+
+	atomic_dec(&dev->num_inst);
+
+	return 0;
+}
+
+static const struct v4l2_file_operations bcm2835_codec_fops = {
+	.owner		= THIS_MODULE,
+	.open		= bcm2835_codec_open,
+	.release	= bcm2835_codec_release,
+	.poll		= v4l2_m2m_fop_poll,
+	.unlocked_ioctl	= video_ioctl2,
+	.mmap		= v4l2_m2m_fop_mmap,
+};
+
+static const struct video_device bcm2835_codec_videodev = {
+	.name		= MEM2MEM_NAME,
+	.vfl_dir	= VFL_DIR_M2M,
+	.fops		= &bcm2835_codec_fops,
+	.ioctl_ops	= &bcm2835_codec_ioctl_ops,
+	.minor		= -1,
+	.release	= video_device_release_empty,
+};
+
+static const struct v4l2_m2m_ops m2m_ops = {
+	.device_run	= device_run,
+	.job_ready	= job_ready,
+	.job_abort	= job_abort,
+};
+
+static int bcm2835_codec_create(struct platform_device *pdev,
+				struct bcm2835_codec_dev **new_dev,
+				bool decode)
+{
+	struct bcm2835_codec_dev *dev;
+	struct video_device *vfd;
+	struct vchiq_mmal_instance *instance = NULL;
+	int video_nr;
+	int ret;
+
+	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
+	if (!dev)
+		return -ENOMEM;
+
+	dev->pdev = pdev;
+
+	dev->decode = decode;
+
+	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
+	if (ret)
+		return ret;
+
+	atomic_set(&dev->num_inst, 0);
+	mutex_init(&dev->dev_mutex);
+
+	dev->vfd = bcm2835_codec_videodev;
+	vfd = &dev->vfd;
+	vfd->lock = &dev->dev_mutex;
+	vfd->v4l2_dev = &dev->v4l2_dev;
+
+	if (dev->decode) {
+		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+		video_nr = decode_video_nr;
+	} else {
+		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
+		video_nr = encode_video_nr;
+	}
+
+	ret = video_register_device(vfd, VFL_TYPE_GRABBER, video_nr);
+	if (ret) {
+		v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
+		goto unreg_dev;
+	}
+
+	video_set_drvdata(vfd, dev);
+	snprintf(vfd->name, sizeof(vfd->name), "%s",
+		 bcm2835_codec_videodev.name);
+	v4l2_info(&dev->v4l2_dev, "Device registered as /dev/video%d\n",
+		  vfd->num);
+
+	*new_dev = dev;
+
+	dev->m2m_dev = v4l2_m2m_init(&m2m_ops);
+	if (IS_ERR(dev->m2m_dev)) {
+		v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n");
+		ret = PTR_ERR(dev->m2m_dev);
+		goto err_m2m;
+	}
+
+	ret = vchiq_mmal_init(&instance);
+	if (ret < 0)
+		goto err_m2m;
+	dev->instance = instance;
+
+	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s codec\n",
+		  dev->decode ? "decode" : "encode");
+	return 0;
+
+err_m2m:
+	v4l2_m2m_release(dev->m2m_dev);
+	video_unregister_device(&dev->vfd);
+unreg_dev:
+	v4l2_device_unregister(&dev->v4l2_dev);
+
+	return ret;
+}
+
+static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
+{
+	if (!dev)
+		return -ENODEV;
+
+	v4l2_info(&dev->v4l2_dev, "Removing " MEM2MEM_NAME);
+	v4l2_m2m_release(dev->m2m_dev);
+	video_unregister_device(&dev->vfd);
+	v4l2_device_unregister(&dev->v4l2_dev);
+
+	return 0;
+}
+
+static int bcm2835_codec_probe(struct platform_device *pdev)
+{
+	struct bcm2835_codec_driver *drv;
+	int ret = 0;
+
+	drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
+	if (!drv)
+		return -ENOMEM;
+
+	ret = bcm2835_codec_create(pdev, &drv->encode, false);
+	if (ret)
+		goto out;
+
+	ret = bcm2835_codec_create(pdev, &drv->decode, true);
+	if (ret)
+		goto out;
+
+	platform_set_drvdata(pdev, drv);
+
+	return 0;
+
+out:
+	if (drv->encode) {
+		bcm2835_codec_destroy(drv->encode);
+		drv->encode = NULL;
+	}
+	return ret;
+}
+
+static int bcm2835_codec_remove(struct platform_device *pdev)
+{
+	struct bcm2835_codec_driver *drv = platform_get_drvdata(pdev);
+
+	bcm2835_codec_destroy(drv->encode);
+
+	bcm2835_codec_destroy(drv->decode);
+
+	return 0;
+}
+
+static struct platform_driver bcm2835_v4l2_codec_driver = {
+	.probe = bcm2835_codec_probe,
+	.remove = bcm2835_codec_remove,
+	.driver = {
+		   .name = "bcm2835-codec",
+		   .owner = THIS_MODULE,
+		   },
+};
+
+module_platform_driver(bcm2835_v4l2_codec_driver);
+
+MODULE_DESCRIPTION("BCM2835 codec V4L2 driver");
+MODULE_AUTHOR("Dave Stevenson, <dave.stevenson@raspberrypi.org>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("0.0.1");
+MODULE_ALIAS("platform:bcm2835-codec");
-- 
GitLab


From 8bd824b36f7ef6cc31e93bb515e9f075b86ce7b3 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 26 Oct 2018 15:14:16 +0100
Subject: [PATCH 0280/1835] staging: vchiq_arm: Register bcm2835-codec as a
 platform driver

Following the same pattern as bcm2835-camera and bcm2835-audio,
register the V4L2 codec driver as a platform driver

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index d3b5a00d2c53e..7b07d6e147f18 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -171,6 +171,7 @@ static struct device *vchiq_dev;
 static DEFINE_SPINLOCK(msg_queue_spinlock);
 static struct platform_device *bcm2835_camera;
 static struct platform_device *bcm2835_audio;
+static struct platform_device *bcm2835_codec;
 
 static const char *const ioctl_names[] = {
 	"CONNECT",
@@ -3660,6 +3661,9 @@ static int vchiq_probe(struct platform_device *pdev)
 	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
 	if (IS_ERR(bcm2835_audio))
 		bcm2835_audio = NULL;
+	bcm2835_codec = vchiq_register_child(pdev, "bcm2835-codec");
+	if (IS_ERR(bcm2835_codec))
+		bcm2835_codec = NULL;
 
 	return 0;
 
-- 
GitLab


From c50f05f5bed2309b12572caea2de6860fe05d793 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 26 Oct 2018 15:19:40 +0100
Subject: [PATCH 0281/1835] staging: vchiq_arm: Register vcsm-cma as a platform
 driver

Following the same pattern as bcm2835-camera and bcm2835-audio,
register the vcsm-cma driver as a platform driver

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 7b07d6e147f18..9b751a57c6529 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -172,6 +172,7 @@ static DEFINE_SPINLOCK(msg_queue_spinlock);
 static struct platform_device *bcm2835_camera;
 static struct platform_device *bcm2835_audio;
 static struct platform_device *bcm2835_codec;
+static struct platform_device *vcsm_cma;
 
 static const char *const ioctl_names[] = {
 	"CONNECT",
@@ -3655,6 +3656,9 @@ static int vchiq_probe(struct platform_device *pdev)
 		VCHIQ_VERSION, VCHIQ_VERSION_MIN,
 		MAJOR(vchiq_devid), MINOR(vchiq_devid));
 
+	vcsm_cma = vchiq_register_child(pdev, "vcsm-cma");
+	if (IS_ERR(vcsm_cma))
+		vcsm_cma = NULL;
 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
 	if (IS_ERR(bcm2835_camera))
 		bcm2835_camera = NULL;
-- 
GitLab


From c819bb4c81913e4b6e299b8d447566c68384a430 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Oct 2018 17:49:04 +0000
Subject: [PATCH 0282/1835] ARM: bcm2835_defconfig: Enable bcm2835-codec

Enables the V4L2 M2M codec driver as a module.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2835_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig
index 5a61367bb47c5..75675420f28a6 100644
--- a/arch/arm/configs/bcm2835_defconfig
+++ b/arch/arm/configs/bcm2835_defconfig
@@ -132,6 +132,7 @@ CONFIG_DMA_BCM2835=y
 CONFIG_STAGING=y
 CONFIG_SND_BCM2835=m
 CONFIG_VIDEO_BCM2835=m
+CONFIG_VIDEO_CODEC_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 000a647682a9bcff7cff1d396e1d37bed99ec6d5 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 30 Oct 2018 12:23:26 +0000
Subject: [PATCH 0283/1835] config: Add bcm2835-codec to Pi defconfigs.

Adds the V4L2 M2M codec driver to the config.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index f59e104f817c6..556cb0fcaec7e 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1210,6 +1210,7 @@ CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_BCM2835_VCHIQ=y
 CONFIG_SND_BCM2835=m
 CONFIG_VIDEO_BCM2835=m
+CONFIG_VIDEO_CODEC_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 507aa4685b35b..c58c3a5fb1a97 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1203,6 +1203,7 @@ CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_BCM2835_VCHIQ=y
 CONFIG_SND_BCM2835=m
 CONFIG_VIDEO_BCM2835=m
+CONFIG_VIDEO_CODEC_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 589d7598d813499700cb23876668294ca39883ce Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 30 Nov 2018 16:00:54 +0000
Subject: [PATCH 0284/1835] staging: bcm2835-camera: Fix stride on RGB3/BGR3
 formats

RGB3/BGR3 end up being 3 bytes per pixel, which meant that
the alignment code ended up trying to align using bitmasking
with a mask of 96.
That doesn't work, so switch to an arithmetic alignment for
those formats.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c           | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 19880b6d3b6be..b8984dcfbfa7a 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1008,13 +1008,27 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 			      1, 0);
 	f->fmt.pix.bytesperline = f->fmt.pix.width * mfmt->ybbp;
 	if (!mfmt->remove_padding) {
-		int align_mask = ((32 * mfmt->depth) >> 3) - 1;
-		/* GPU isn't removing padding, so stride is aligned to 32 */
-		f->fmt.pix.bytesperline =
-			(f->fmt.pix.bytesperline + align_mask) & ~align_mask;
+		if (mfmt->depth == 24) {
+			/*
+			 * 24bpp is a pain as we can't use simple masking.
+			 * Min stride is width aligned to 16, times 24bpp.
+			 */
+			f->fmt.pix.bytesperline =
+				((f->fmt.pix.width + 15) & ~15) * 3;
+		} else {
+			/*
+			 * GPU isn't removing padding, so stride is aligned to
+			 * 32
+			 */
+			int align_mask = ((32 * mfmt->depth) >> 3) - 1;
+
+			f->fmt.pix.bytesperline =
+				(f->fmt.pix.bytesperline + align_mask) &
+							~align_mask;
+		}
 		v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-			 "Not removing padding, so bytes/line = %d, (align_mask %d)\n",
-			 f->fmt.pix.bytesperline, align_mask);
+			 "Not removing padding, so bytes/line = %d\n",
+			 f->fmt.pix.bytesperline);
 	}
 
 	/* Image buffer has to be padded to allow for alignment, even though
-- 
GitLab


From a2c73e18c1f657de6d654f51effa0a94863abbd8 Mon Sep 17 00:00:00 2001
From: John Sheu <sheu@chromium.org>
Date: Thu, 15 Oct 2015 18:05:25 +0900
Subject: [PATCH 0285/1835] media: vb2: Allow reqbufs(0) with "in use" MMAP
 buffers

Videobuf2 presently does not allow VIDIOC_REQBUFS to destroy outstanding
buffers if the queue is of type V4L2_MEMORY_MMAP, and if the buffers are
considered "in use".  This is different behavior than for other memory
types and prevents us from deallocating buffers in following two cases:

1) There are outstanding mmap()ed views on the buffer. However even if
   we put the buffer in reqbufs(0), there will be remaining references,
   due to vma .open/close() adjusting vb2 buffer refcount appropriately.
   This means that the buffer will be in fact freed only when the last
   mmap()ed view is unmapped.

2) Buffer has been exported as a DMABUF. Refcount of the vb2 buffer
   is managed properly by VB2 DMABUF ops, i.e. incremented on DMABUF
   get and decremented on DMABUF release. This means that the buffer
   will be alive until all importers release it.

Considering both cases above, there does not seem to be any need to
prevent reqbufs(0) operation, because buffer lifetime is already
properly managed by both mmap() and DMABUF code paths. Let's remove it
and allow userspace freeing the queue (and potentially allocating a new
one) even though old buffers might be still in processing.

Signed-off-by: John Sheu <sheu@chromium.org>
Reviewed-by: Pawel Osciak <posciak@chromium.org>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
---
 .../media/common/videobuf2/videobuf2-core.c   | 23 -------------------
 1 file changed, 23 deletions(-)

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 627478997f96a..cb6588e66f2ba 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -550,20 +550,6 @@ bool vb2_buffer_in_use(struct vb2_queue *q, struct vb2_buffer *vb)
 }
 EXPORT_SYMBOL(vb2_buffer_in_use);
 
-/*
- * __buffers_in_use() - return true if any buffers on the queue are in use and
- * the queue cannot be freed (by the means of REQBUFS(0)) call
- */
-static bool __buffers_in_use(struct vb2_queue *q)
-{
-	unsigned int buffer;
-	for (buffer = 0; buffer < q->num_buffers; ++buffer) {
-		if (vb2_buffer_in_use(q, q->bufs[buffer]))
-			return true;
-	}
-	return false;
-}
-
 void vb2_core_querybuf(struct vb2_queue *q, unsigned int index, void *pb)
 {
 	call_void_bufop(q, fill_user_buffer, q->bufs[index], pb);
@@ -670,16 +656,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
 
 	if (*count == 0 || q->num_buffers != 0 ||
 	    (q->memory != VB2_MEMORY_UNKNOWN && q->memory != memory)) {
-		/*
-		 * We already have buffers allocated, so first check if they
-		 * are not in use and can be freed.
-		 */
 		mutex_lock(&q->mmap_lock);
-		if (q->memory == VB2_MEMORY_MMAP && __buffers_in_use(q)) {
-			mutex_unlock(&q->mmap_lock);
-			dprintk(1, "memory in use, cannot free\n");
-			return -EBUSY;
-		}
 
 		/*
 		 * Call queue_cancel to clean up any buffers in the PREPARED or
-- 
GitLab


From 4387191b22a0330151de8d89168e9d5fe74d87ce Mon Sep 17 00:00:00 2001
From: Peter Huewe <peterhuewe@gmx.de>
Date: Mon, 3 Sep 2018 21:51:51 +0200
Subject: [PATCH 0286/1835] tpm: Make SECURITYFS a weak dependency

commit 2f7d8dbb11287cbe9da6380ca14ed5d38c9ed91f upstream.

While having SECURITYFS enabled for the tpm subsystem is beneficial in
most cases, it is not strictly necessary to have it enabled at all.
Especially on platforms without any boot firmware integration of the TPM
(e.g. raspberry pi) it does not add any value for the tpm subsystem,
as there is no eventlog present.

By turning it from 'select' to 'imply' it still gets selected per
default, but enables users who want to save some kb of ram by turning
SECURITYFS off.

Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 drivers/char/tpm/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 18c81cbe4704c..536e55d3919fd 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -5,7 +5,7 @@
 menuconfig TCG_TPM
 	tristate "TPM Hardware Support"
 	depends on HAS_IOMEM
-	select SECURITYFS
+	imply SECURITYFS
 	select CRYPTO
 	select CRYPTO_HASH_INFO
 	---help---
-- 
GitLab


From 6e86964ade3f2dc375f4e40a94de3dbe0cf77bcb Mon Sep 17 00:00:00 2001
From: Peter Huewe <peterhuewe@gmx.de>
Date: Thu, 14 Jun 2018 22:42:18 +0200
Subject: [PATCH 0287/1835] Enable TPM TIS SPI support for TPM1.2 and TPM2.0
 chips

This patch enables the support for SPI TPMs which follow the TCG TIS
FIFO/PTP specification like the SLB9670.
In order to decrease ram usage the weak dependency on CONFIG_SECURITFS
is explictly set to 'n'.

Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
---
 arch/arm/configs/bcm2709_defconfig   | 5 +++--
 arch/arm/configs/bcmrpi_defconfig    | 5 +++--
 arch/arm64/configs/bcmrpi3_defconfig | 3 +++
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 556cb0fcaec7e..46acc533607f7 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -350,7 +350,6 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_BATMAN_ADV=m
 CONFIG_OPENVSWITCH=m
-CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_NET_PKTGEN=m
 CONFIG_HAMRADIO=y
 CONFIG_AX25=m
@@ -610,6 +609,8 @@ CONFIG_SERIAL_DEV_BUS=m
 CONFIG_TTY_PRINTK=y
 CONFIG_HW_RANDOM=y
 CONFIG_RAW_DRIVER=y
+CONFIG_TCG_TPM=m
+CONFIG_TCG_TIS_SPI=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=m
 CONFIG_I2C_MUX=m
@@ -1343,12 +1344,12 @@ CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
 CONFIG_DLM=m
+# CONFIG_SECURITYFS is not set
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
 CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_CAST5=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index c58c3a5fb1a97..19fdf2b322a42 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -344,7 +344,6 @@ CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_BATMAN_ADV=m
 CONFIG_OPENVSWITCH=m
-CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_NET_PKTGEN=m
 CONFIG_HAMRADIO=y
 CONFIG_AX25=m
@@ -604,6 +603,8 @@ CONFIG_SERIAL_DEV_BUS=m
 CONFIG_TTY_PRINTK=y
 CONFIG_HW_RANDOM=y
 CONFIG_RAW_DRIVER=y
+CONFIG_TCG_TPM=m
+CONFIG_TCG_TIS_SPI=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=m
 CONFIG_I2C_MUX=m
@@ -1336,13 +1337,13 @@ CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
 CONFIG_DLM=m
+# CONFIG_SECURITYFS is not set
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
 CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_CAST5=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 58e4d68306a12..26e19b5f98cea 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -589,6 +589,8 @@ CONFIG_SERIAL_DEV_BUS=m
 CONFIG_TTY_PRINTK=y
 CONFIG_HW_RANDOM=y
 CONFIG_RAW_DRIVER=y
+CONFIG_TCG_TPM=m
+CONFIG_TCG_TIS_SPI=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=m
 CONFIG_I2C_BCM2708=m
@@ -1187,6 +1189,7 @@ CONFIG_NLS_ISO8859_15=m
 CONFIG_NLS_KOI8_R=m
 CONFIG_NLS_KOI8_U=m
 CONFIG_DLM=m
+# CONFIG_SECURITYFS is not set
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
-- 
GitLab


From ea9ad364393033274276e35a3432534c50f5cdf8 Mon Sep 17 00:00:00 2001
From: Peter Huewe <peterhuewe@gmx.de>
Date: Thu, 14 Jun 2018 22:51:24 +0200
Subject: [PATCH 0288/1835] Add overlay for SLB9760 Iridium /LetsTrust TPM

Device Tree overlay for the Infineon SLB9670 Trusted Platform Module add-on
boards, which can be used as a secure key storage and hwrng.
available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by
pi3g.

Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  8 ++++
 .../boot/dts/overlays/tpm-slb9670-overlay.dts | 44 +++++++++++++++++++
 3 files changed, 53 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index e31f8af7ce759..31f834d0459dd 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -137,6 +137,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	tc358743.dtbo \
 	tc358743-audio.dtbo \
 	tinylcd35.dtbo \
+	tpm-slb9670.dtbo \
 	uart0.dtbo \
 	uart1.dtbo \
 	upstream.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 1e89b61a49069..87e193e262aa3 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -2012,6 +2012,14 @@ Params: speed                   Display SPI bus speed
                 dtoverlay=tinylcd35,touch,touchgpio=3
 
 
+Name:   tpm-slb9670
+Info:   Enables support for Infineon SLB9670 Trusted Platform Module add-on
+        boards, which can be used as a secure key storage and hwrng,
+        available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by pi3g.
+Load:   dtoverlay=tpm-slb9670
+Params: <None>
+
+
 Name:   uart0
 Info:   Change the pin usage of uart0
 Load:   dtoverlay=uart0,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
new file mode 100644
index 0000000000000..eac4511050de1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
@@ -0,0 +1,44 @@
+/*
+ * Device Tree overlay for the Infineon SLB9670 Trusted Platform Module add-on
+ * boards, which can be used as a secure key storage and hwrng.
+ * available as "Iridium SLB9670" by Infineon and "LetsTrust TPM" by pi3g.
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			slb9670: slb9670@1 {
+				compatible = "infineon,slb9670";
+				reg = <1>;	/* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <32000000>;
+				status = "okay";
+			};
+
+		};
+	};
+};
-- 
GitLab


From 883424daea26eb009e013f58718a80e49415d46d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 4 Dec 2018 19:40:12 +0000
Subject: [PATCH 0289/1835] Revert "staging: vchiq_arm: Register a platform
 device for the audio driver"

This reverts commit ab59590ed562b89db51fe46cee5db96b9bc5abd8.

Issues have been observed in LibreElec as this was unconditionally
loading the audio driver instead of having the DT parameter to
enable it.

Includes a partial revert of 2147700eb7a1b9e55e0684f0749114ce35d61571
which fixed up the error handling.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c    | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 9b751a57c6529..40e8e041b7810 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -170,7 +170,6 @@ static struct class  *vchiq_class;
 static struct device *vchiq_dev;
 static DEFINE_SPINLOCK(msg_queue_spinlock);
 static struct platform_device *bcm2835_camera;
-static struct platform_device *bcm2835_audio;
 static struct platform_device *bcm2835_codec;
 static struct platform_device *vcsm_cma;
 
@@ -3662,9 +3661,6 @@ static int vchiq_probe(struct platform_device *pdev)
 	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
 	if (IS_ERR(bcm2835_camera))
 		bcm2835_camera = NULL;
-	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
-	if (IS_ERR(bcm2835_audio))
-		bcm2835_audio = NULL;
 	bcm2835_codec = vchiq_register_child(pdev, "bcm2835-codec");
 	if (IS_ERR(bcm2835_codec))
 		bcm2835_codec = NULL;
@@ -3685,7 +3681,6 @@ failed_platform_init:
 static int vchiq_remove(struct platform_device *pdev)
 {
 	platform_device_unregister(bcm2835_codec);
-	platform_device_unregister(bcm2835_audio);
 	platform_device_unregister(bcm2835_camera);
 	platform_device_unregister(vcsm_cma);
 	vchiq_debugfs_deinit();
-- 
GitLab


From 9ef0b1af5ebd00e6a439dee590952a67553bfb56 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 4 Dec 2018 20:41:19 +0000
Subject: [PATCH 0290/1835] Revert "staging: bcm2835-audio: Drop DT dependency"

This reverts commit 933bc853bb764e476b0b0f633588f46d20f1f76a.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 41 ++++++++++---------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 0528266dd17b5..b8e148ade6f64 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -4,17 +4,15 @@
 #include <linux/platform_device.h>
 
 #include <linux/init.h>
-#include <linux/dma-mapping.h>
-#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/of.h>
 
 #include "bcm2835.h"
 
 static bool enable_hdmi;
 static bool enable_headphones;
 static bool enable_compat_alsa = true;
-static int num_channels = MAX_SUBSTREAMS;
 
 module_param(enable_hdmi, bool, 0444);
 MODULE_PARM_DESC(enable_hdmi, "Enables HDMI virtual audio device");
@@ -23,8 +21,6 @@ MODULE_PARM_DESC(enable_headphones, "Enables Headphones virtual audio device");
 module_param(enable_compat_alsa, bool, 0444);
 MODULE_PARM_DESC(enable_compat_alsa,
 		 "Enables ALSA compatibility virtual audio device");
-module_param(num_channels, int, 0644);
-MODULE_PARM_DESC(num_channels, "Number of audio channels (default: 8)");
 
 static void snd_devm_unregister_child(struct device *dev, void *res)
 {
@@ -411,30 +407,31 @@ static int snd_add_child_devices(struct device *device, u32 numchans)
 	return 0;
 }
 
-static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
+static int snd_bcm2835_alsa_probe_dt(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
+	u32 numchans;
 	int err;
 
-	if (num_channels <= 0 || num_channels > MAX_SUBSTREAMS) {
-		num_channels = MAX_SUBSTREAMS;
-		dev_warn(dev, "Illegal num_channels value, will use %u\n",
-			 num_channels);
-	}
-
-	dev->coherent_dma_mask = DMA_BIT_MASK(32);
-	dev->dma_mask = &dev->coherent_dma_mask;
-	err = of_dma_configure(dev, NULL, true);
+	err = of_property_read_u32(dev->of_node, "brcm,pwm-channels",
+				   &numchans);
 	if (err) {
-		dev_err(dev, "Unable to setup DMA: %d\n", err);
+		dev_err(dev, "Failed to get DT property 'brcm,pwm-channels'");
 		return err;
 	}
 
+	if (numchans == 0 || numchans > MAX_SUBSTREAMS) {
+		numchans = MAX_SUBSTREAMS;
+		dev_warn(dev,
+			 "Illegal 'brcm,pwm-channels' value, will use %u\n",
+			 numchans);
+	}
+
 	err = bcm2835_devm_add_vchi_ctx(dev);
 	if (err)
 		return err;
 
-	err = snd_add_child_devices(dev, num_channels);
+	err = snd_add_child_devices(dev, numchans);
 	if (err)
 		return err;
 
@@ -456,14 +453,21 @@ static int snd_bcm2835_alsa_resume(struct platform_device *pdev)
 
 #endif
 
+static const struct of_device_id snd_bcm2835_of_match_table[] = {
+	{ .compatible = "brcm,bcm2835-audio",},
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_bcm2835_of_match_table);
+
 static struct platform_driver bcm2835_alsa0_driver = {
-	.probe = snd_bcm2835_alsa_probe,
+	.probe = snd_bcm2835_alsa_probe_dt,
 #ifdef CONFIG_PM
 	.suspend = snd_bcm2835_alsa_suspend,
 	.resume = snd_bcm2835_alsa_resume,
 #endif
 	.driver = {
 		.name = "bcm2835_audio",
+		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
 module_platform_driver(bcm2835_alsa0_driver);
@@ -471,4 +475,3 @@ module_platform_driver(bcm2835_alsa0_driver);
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:bcm2835_audio");
-- 
GitLab


From c14d022277ea9971cc442ea491988b73d58f7990 Mon Sep 17 00:00:00 2001
From: dev-3Dlab <45081440+dev-3Dlab@users.noreply.github.com>
Date: Wed, 5 Dec 2018 10:59:11 +0100
Subject: [PATCH 0291/1835] ASoC: add driver for 3Dlab Nano soundcard (#2758)

Signed-off-by: GT <dev@3d-lab-av.com>
---
 .../overlays/3dlab-nano-player-overlay.dts    |  32 ++
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |   6 +
 arch/arm/configs/bcm2709_defconfig            |   1 +
 arch/arm/configs/bcmrpi_defconfig             |   1 +
 sound/soc/bcm/3dlab-nano-player.c             | 370 ++++++++++++++++++
 sound/soc/bcm/Kconfig                         |   6 +
 sound/soc/bcm/Makefile                        |   2 +
 8 files changed, 419 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts
 create mode 100644 sound/soc/bcm/3dlab-nano-player.c

diff --git a/arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts b/arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts
new file mode 100644
index 0000000000000..38f7bb2c9de32
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts
@@ -0,0 +1,32 @@
+// Definitions for 3Dlab Nano Player
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			nano-player@41 {
+				compatible = "3dlab,nano-player";
+				reg = <0x41>;
+				i2s-controller = <&i2s>;
+				status = "okay";
+			};
+		};
+	};
+};
+
+// EOF
diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 31f834d0459dd..01189088e62c6 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -1,6 +1,7 @@
 # Overlays for the Raspberry Pi platform
 
 dtbo-$(CONFIG_ARCH_BCM2835) += \
+	3dlab-nano-player.dtbo \
 	adau1977-adc.dtbo \
 	adau7002-simple.dtbo \
 	ads1015.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 87e193e262aa3..f5e5d6f378f7d 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -199,6 +199,12 @@ Params:
         and the other i2c baudrate parameters.
 
 
+Name:   3dlab-nano-player
+Info:   Configures the 3Dlab Nano Player
+Load:   dtoverlay=3dlab-nano-player
+Params: <None>
+
+
 Name:   adau1977-adc
 Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
         and I2S for data.
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 46acc533607f7..07cf0b16f8f4d 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -902,6 +902,7 @@ CONFIG_SND_USB_6FIRE=m
 CONFIG_SND_USB_HIFACE=m
 CONFIG_SND_SOC=m
 CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 19fdf2b322a42..fca4d449e0e2b 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -895,6 +895,7 @@ CONFIG_SND_USB_6FIRE=m
 CONFIG_SND_USB_HIFACE=m
 CONFIG_SND_SOC=m
 CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
diff --git a/sound/soc/bcm/3dlab-nano-player.c b/sound/soc/bcm/3dlab-nano-player.c
new file mode 100644
index 0000000000000..7d4a63f40d607
--- /dev/null
+++ b/sound/soc/bcm/3dlab-nano-player.c
@@ -0,0 +1,370 @@
+/*
+ * 3Dlab Nano Player ALSA SoC Audio driver.
+ *
+ * Copyright (C) 2018 3Dlab.
+ *
+ * Author: GT <dev@3d-lab-av.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <sound/soc.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/control.h>
+
+#define NANO_ID		0x00
+#define NANO_VER	0x01
+#define NANO_CFG	0x02
+#define NANO_STATUS	0x03
+#define NANO_SPI_ADDR	0x04
+#define NANO_SPI_DATA	0x05
+
+#define NANO_ID_VAL	0x3D
+#define NANO_CFG_OFF	0x00
+#define NANO_CFG_MULT1	0
+#define NANO_CFG_MULT2	1
+#define NANO_CFG_MULT4	2
+#define NANO_CFG_MULT8	3
+#define NANO_CFG_MULT16	4
+#define NANO_CFG_CLK22	0
+#define NANO_CFG_CLK24	BIT(3)
+#define NANO_CFG_DSD	BIT(4)
+#define NANO_CFG_ENA	BIT(5)
+#define NANO_CFG_BLINK	BIT(6)
+#define NANO_STATUS_P1  BIT(0)
+#define NANO_STATUS_P2  BIT(1)
+#define NANO_STATUS_FLG BIT(2)
+#define NANO_STATUS_CLK BIT(3)
+#define NANO_SPI_READ	0
+#define NANO_SPI_WRITE	BIT(5)
+
+#define NANO_DAC_CTRL1	0x00
+#define NANO_DAC_CTRL2	0x01
+#define NANO_DAC_CTRL3	0x02
+#define NANO_DAC_LATT	0x03
+#define NANO_DAC_RATT	0x04
+
+#define NANO_CTRL2_VAL	0x22
+
+static int nano_player_spi_write(struct regmap *map,
+				 unsigned int reg, unsigned int val)
+{
+	/* indirect register access */
+	regmap_write(map, NANO_SPI_DATA, val);
+	regmap_write(map, NANO_SPI_ADDR, reg | NANO_SPI_WRITE);
+	return 0;
+}
+
+static int nano_player_ctrl_info(struct snd_kcontrol *kcontrol,
+				 struct snd_ctl_elem_info *uinfo)
+{
+	/* describe control element */
+	if (strstr(kcontrol->id.name, "Volume")) {
+		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+		uinfo->count = 1;
+		uinfo->value.integer.min = 0;
+		uinfo->value.integer.max = 100;
+	} else {
+		uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
+		uinfo->count = 1;
+		uinfo->value.integer.min = 0;
+		uinfo->value.integer.max = 1;
+	}
+
+	return 0;
+}
+
+static int nano_player_ctrl_put(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	/* program control value to hardware */
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct regmap *regmap = snd_soc_card_get_drvdata(card);
+
+	if (strstr(kcontrol->id.name, "Volume")) {
+		unsigned int vol = ucontrol->value.integer.value[0];
+		unsigned int att = 255 - (2 * (100 - vol));
+
+		nano_player_spi_write(regmap, NANO_DAC_LATT, att);
+		nano_player_spi_write(regmap, NANO_DAC_RATT, att);
+		kcontrol->private_value = vol;
+	} else {
+		unsigned int mute = ucontrol->value.integer.value[0];
+		unsigned int reg = NANO_CTRL2_VAL | mute;
+
+		nano_player_spi_write(regmap, NANO_DAC_CTRL2, reg);
+		kcontrol->private_value = mute;
+	}
+	return 0;
+}
+
+static int nano_player_ctrl_get(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	/* return last programmed value */
+	ucontrol->value.integer.value[0] = kcontrol->private_value;
+	return 0;
+}
+
+#define SOC_NANO_PLAYER_CTRL(xname) \
+{	.iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = (xname), \
+	.access = SNDRV_CTL_ELEM_ACCESS_READWRITE, \
+	.info = nano_player_ctrl_info, \
+	.put = nano_player_ctrl_put, \
+	.get = nano_player_ctrl_get }
+
+static const struct snd_kcontrol_new nano_player_controls[] = {
+	SOC_NANO_PLAYER_CTRL("Master Playback Volume"),
+	SOC_NANO_PLAYER_CTRL("Master Playback Switch"),
+};
+
+static const unsigned int nano_player_rates[] = {
+	44100, 48000, 88200, 96000, 176400, 192000, 352800, 384000,
+	705600, 768000 /* only possible with fast clocks */
+};
+
+static struct snd_pcm_hw_constraint_list nano_player_constraint_rates = {
+	.list	= nano_player_rates,
+	.count	= ARRAY_SIZE(nano_player_rates),
+};
+
+static int nano_player_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct regmap *regmap = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_stream *cpu = &rtd->cpu_dai->driver->playback;
+	struct snd_soc_pcm_stream *codec = &rtd->codec_dai->driver->playback;
+	unsigned int sample_bits = 32;
+	unsigned int val;
+
+	/* configure cpu dai */
+	cpu->formats |= SNDRV_PCM_FMTBIT_DSD_U32_LE;
+	cpu->rate_max = 768000;
+
+	/* configure dummy codec dai */
+	codec->rate_min = 44100;
+	codec->rates = SNDRV_PCM_RATE_KNOT;
+	codec->formats = SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_DSD_U32_LE;
+
+	/* configure max supported rate */
+	regmap_read(regmap, NANO_STATUS, &val);
+	if (val & NANO_STATUS_CLK) {
+		dev_notice(card->dev, "Board with fast clocks installed\n");
+		codec->rate_max = 768000;
+	} else {
+		dev_notice(card->dev, "Board with normal clocks installed\n");
+		codec->rate_max = 384000;
+	}
+
+	/* frame length enforced by hardware */
+	return snd_soc_dai_set_bclk_ratio(rtd->cpu_dai, sample_bits * 2);
+}
+
+static int nano_player_startup(struct snd_pcm_substream *substream)
+{
+	return snd_pcm_hw_constraint_list(substream->runtime, 0,
+					  SNDRV_PCM_HW_PARAM_RATE,
+					  &nano_player_constraint_rates);
+}
+
+static int nano_player_hw_params(struct snd_pcm_substream *substream,
+				 struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct regmap *regmap = snd_soc_card_get_drvdata(card);
+	unsigned int config = NANO_CFG_ENA;
+	struct snd_mask *fmt;
+
+	/* configure PCM or DSD */
+	fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+	if (snd_mask_test(fmt, SNDRV_PCM_FORMAT_DSD_U32_LE)) {
+		/* embed DSD in PCM data */
+		snd_mask_none(fmt);
+		snd_mask_set(fmt, SNDRV_PCM_FORMAT_S32_LE);
+		/* enable DSD mode */
+		config |= NANO_CFG_DSD;
+	}
+
+	/* configure clocks */
+	switch (params_rate(params)) {
+	case 44100:
+		config |= NANO_CFG_MULT1 | NANO_CFG_CLK22;
+		break;
+	case 88200:
+		config |= NANO_CFG_MULT2 | NANO_CFG_CLK22;
+		break;
+	case 176400:
+		config |= NANO_CFG_MULT4 | NANO_CFG_CLK22;
+		break;
+	case 352800:
+		config |= NANO_CFG_MULT8 | NANO_CFG_CLK22;
+		break;
+	case 705600:
+		config |= NANO_CFG_MULT16 | NANO_CFG_CLK22;
+		break;
+	case 48000:
+		config |= NANO_CFG_MULT1 | NANO_CFG_CLK24;
+		break;
+	case 96000:
+		config |= NANO_CFG_MULT2 | NANO_CFG_CLK24;
+		break;
+	case 192000:
+		config |= NANO_CFG_MULT4 | NANO_CFG_CLK24;
+		break;
+	case 384000:
+		config |= NANO_CFG_MULT8 | NANO_CFG_CLK24;
+		break;
+	case 768000:
+		config |= NANO_CFG_MULT16 | NANO_CFG_CLK24;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	dev_dbg(card->dev, "Send CFG register 0x%02X\n", config);
+	return regmap_write(regmap, NANO_CFG, config);
+}
+
+static struct snd_soc_ops nano_player_ops = {
+	.startup	= nano_player_startup,
+	.hw_params	= nano_player_hw_params,
+};
+
+static struct snd_soc_dai_link nano_player_link = {
+	.name		= "3Dlab Nano Player",
+	.stream_name	= "3Dlab Nano Player HiFi",
+	.platform_name	= "bcm2708-i2s.0",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_name	= "snd-soc-dummy",
+	.codec_dai_name	= "snd-soc-dummy-dai",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_CONT |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBM_CFM,
+	.init		= nano_player_init,
+	.ops		= &nano_player_ops,
+};
+
+static const struct regmap_config nano_player_regmap = {
+	.reg_bits	= 8,
+	.val_bits	= 8,
+	.max_register	= 128,
+	.cache_type	= REGCACHE_RBTREE,
+};
+
+static int nano_player_card_probe(struct snd_soc_card *card)
+{
+	struct regmap *regmap = snd_soc_card_get_drvdata(card);
+	unsigned int val;
+
+	/* check hardware integrity */
+	regmap_read(regmap, NANO_ID, &val);
+	if (val != NANO_ID_VAL) {
+		dev_err(card->dev, "Invalid ID register 0x%02X\n", val);
+		return -ENODEV;
+	}
+
+	/* report version to the user */
+	regmap_read(regmap, NANO_VER, &val);
+	dev_notice(card->dev, "Started 3Dlab Nano Player driver (v%d)\n", val);
+
+	/* enable internal audio bus and blink status LED */
+	return regmap_write(regmap, NANO_CFG, NANO_CFG_ENA | NANO_CFG_BLINK);
+}
+
+static int nano_player_card_remove(struct snd_soc_card *card)
+{
+	/* disable internal audio bus */
+	struct regmap *regmap = snd_soc_card_get_drvdata(card);
+
+	return regmap_write(regmap, NANO_CFG, NANO_CFG_OFF);
+}
+
+static struct snd_soc_card nano_player_card = {
+	.name		= "3Dlab_Nano_Player",
+	.owner		= THIS_MODULE,
+	.dai_link	= &nano_player_link,
+	.num_links	= 1,
+	.controls	= nano_player_controls,
+	.num_controls	= ARRAY_SIZE(nano_player_controls),
+	.probe		= nano_player_card_probe,
+	.remove		= nano_player_card_remove,
+};
+
+static int nano_player_i2c_probe(struct i2c_client *i2c,
+				 const struct i2c_device_id *id)
+{
+	struct regmap *regmap;
+	int ret;
+
+	regmap = devm_regmap_init_i2c(i2c, &nano_player_regmap);
+	if (IS_ERR(regmap)) {
+		ret = PTR_ERR(regmap);
+		dev_err(&i2c->dev, "Failed to init regmap %d\n", ret);
+		return ret;
+	}
+
+	if (i2c->dev.of_node) {
+		struct snd_soc_dai_link *dai = &nano_player_link;
+		struct device_node *node;
+
+		/* cpu handle configured by device tree */
+		node = of_parse_phandle(i2c->dev.of_node, "i2s-controller", 0);
+		if (node) {
+			dai->platform_name = NULL;
+			dai->platform_of_node = node;
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = node;
+		}
+	}
+
+	nano_player_card.dev = &i2c->dev;
+	snd_soc_card_set_drvdata(&nano_player_card, regmap);
+	ret = devm_snd_soc_register_card(&i2c->dev, &nano_player_card);
+
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&i2c->dev, "Failed to register card %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id nano_player_of_match[] = {
+	{ .compatible = "3dlab,nano-player", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, nano_player_of_match);
+
+static const struct i2c_device_id nano_player_i2c_id[] = {
+	{ "nano-player", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, nano_player_i2c_id);
+
+static struct i2c_driver nano_player_i2c_driver = {
+	.probe		= nano_player_i2c_probe,
+	.id_table	= nano_player_i2c_id,
+	.driver		= {
+		.name		= "nano-player",
+		.owner		= THIS_MODULE,
+		.of_match_table	= nano_player_of_match,
+	},
+};
+
+module_i2c_driver(nano_player_i2c_driver);
+
+MODULE_DESCRIPTION("ASoC 3Dlab Nano Player driver");
+MODULE_AUTHOR("GT <dev@3d-lab-av.com>");
+MODULE_LICENSE("GPL v2");
+
+/* EOF */
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 6f04346347aa5..bb4903bcae18c 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -17,6 +17,12 @@ config SND_SOC_CYGNUS
 
 	  If you don't know what to do here, say N.
 
+config SND_BCM2708_SOC_3DLAB_NANO_PLAYER
+	tristate "Support for 3Dlab Nano Player"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	help
+	  Say Y or M if you want to add support for 3Dlab Nano Player.
+
 config SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD
 	tristate "Support for Google voiceHAT soundcard"
 	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index 4e33ca87ec7e8..94ec208fed82d 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_SND_SOC_CYGNUS) += snd-soc-cygnus.o
 snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
 
 # BCM2708 Machine Support
+snd-soc-3dlab-nano-player-objs := 3dlab-nano-player.o
 snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
 snd-soc-justboom-dac-objs := justboom-dac.o
 snd-soc-rpi-cirrus-objs := rpi-cirrus.o
@@ -31,6 +32,7 @@ snd-soc-fe-pi-audio-objs := fe-pi-audio.o
 snd-soc-rpi-simple-soundcard-objs := rpi-simple-soundcard.o
 snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
 
+obj-$(CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER) += snd-soc-3dlab-nano-player.o
 obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
 obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
-- 
GitLab


From 16e5bb3d7a8b27ccdc42466b2a5c06ceabd1370c Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 5 Dec 2018 11:56:40 +0000
Subject: [PATCH 0292/1835] overlays: Update README with removal of lirc-rpi

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README | 57 ++++++++++++-------------------
 1 file changed, 21 insertions(+), 36 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index f5e5d6f378f7d..049b50535656a 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -56,23 +56,29 @@ have its contents deleted (or commented out).
 Using Overlays
 ==============
 
-Overlays are loaded using the "dtoverlay" directive. As an example, consider
-the popular lirc-rpi module, the Linux Infrared Remote Control driver. In the
-pre-DT world this would be loaded from /etc/modules, with an explicit
-"modprobe lirc-rpi" command, or programmatically by lircd. With DT enabled,
-this becomes a line in config.txt:
+Overlays are loaded using the "dtoverlay" config.txt setting. As an example,
+consider I2C Real Time Clock drivers. In the pre-DT world these would be loaded
+by writing a magic string comprising a device identifier and an I2C address to
+a special file in /sys/class/i2c-adapter, having first loaded the driver for
+the I2C interface and the RTC device - something like this:
 
-    dtoverlay=lirc-rpi
+    modprobe i2c-bcm2835
+    modprobe rtc-ds1307
+    echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-1/new_device
 
-This causes the file /boot/overlays/lirc-rpi.dtbo to be loaded. By
-default it will use GPIOs 17 (out) and 18 (in), but this can be modified using
-DT parameters:
+With DT enabled, this becomes a line in config.txt:
 
-    dtoverlay=lirc-rpi,gpio_out_pin=17,gpio_in_pin=13
+    dtoverlay=i2c-rtc,ds1307
 
-Parameters always have default values, although in some cases (e.g. "w1-gpio")
-it is necessary to provided multiple overlays in order to get the desired
-behaviour. See the list of overlays below for a description of the parameters
+This causes the file /boot/overlays/i2c-rtc.dtbo to be loaded and a "node"
+describing the DS1307 I2C device to be added to the Device Tree for the Pi. By
+default it usees address 0x68, but this can be modified with an additional DT
+parameter:
+
+    dtoverlay=i2c-rtc,ds1307,addr=0x68
+
+Parameters usually have default values, although certain parameters are
+mandatory. See the list of overlays below for a description of the parameters
 and their defaults.
 
 The Overlay and Parameter Reference
@@ -1135,29 +1141,8 @@ Params: <None>
 
 
 Name:   lirc-rpi
-Info:   Configures lirc-rpi (Linux Infrared Remote Control for Raspberry Pi)
-        Consult the module documentation for more details.
-Load:   dtoverlay=lirc-rpi,<param>=<val>
-Params: gpio_out_pin            GPIO for output (default "17")
-
-        gpio_in_pin             GPIO for input (default "18")
-
-        gpio_in_pull            Pull up/down/off on the input pin
-                                (default "down")
-
-        sense                   Override the IR receive auto-detection logic:
-                                 "0" = force active-high
-                                 "1" = force active-low
-                                 "-1" = use auto-detection
-                                (default "-1")
-
-        softcarrier             Turn the software carrier "on" or "off"
-                                (default "on")
-
-        invert                  "on" = invert the output pin (default "off")
-
-        debug                   "on" = enable additional debug messages
-                                (default "off")
+Info:   This overlay has been deprecated and removed - see gpio-ir
+Load:   <Deprecated>
 
 
 Name:   ltc294x
-- 
GitLab


From 6e2165b72836b60b89cb34ebb05289a5218b9cb2 Mon Sep 17 00:00:00 2001
From: 6by9 <6by9@users.noreply.github.com>
Date: Tue, 11 Dec 2018 15:18:02 +0000
Subject: [PATCH 0293/1835] staging: bcm2835-camera: Check the error for
 REPEAT_SEQ_HEADER (#2782)

When handling for V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER was added
the firmware would reject the setting if H264 hadn't already been
selected. This was fixed in the firmware at that point, but to
enable backwards compatibility the returned error was ignored.

That was Dec 2013, so the chances of having a firmware that still
has that issue is so close to zero that the workaround can be
removed.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/controls.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 17b6960fc151c..e7c3c68e40f60 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -1100,7 +1100,7 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 		0, 1, NULL,
 		MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
 		&ctrl_set_video_encode_param_output,
-		true	/* Errors ignored as requires latest firmware to work */
+		false
 	},
 	{
 		V4L2_CID_MPEG_VIDEO_H264_PROFILE,
-- 
GitLab


From fed25f13899f199263a2a3416e1793837ea115f6 Mon Sep 17 00:00:00 2001
From: Matthias Reichl <hias@horus.com>
Date: Wed, 9 Jan 2019 14:51:01 +0100
Subject: [PATCH 0294/1835] gpio-ir: change default pull configuration to up

IR receivers like the TSOP series from Vishay and compatible ones
have active-low open collector outputs with an internal pull up of
about 30k (according to the TSOP datasheets).

Activating a pull-down resistor on the GPIO will make it work against
the pull-up in the IR receiver and brings the idle input voltage down
to about 1.9V (measured on a RPi3B+ with a TSOP4438). While that's
usually enough to make the RPi see a high signal it's certainly not
optimal and may even fail when using an IR receiver with a weaker pull-up.

Switching the default GPIO pull to "up" results in an input voltage
level of about 3.3V and ensures that an idle state (high signal) will
be detected if no IR receiver is attached.

Signed-off-by: Matthias Reichl <hias@horus.com>
---
 arch/arm/boot/dts/overlays/README              | 2 +-
 arch/arm/boot/dts/overlays/gpio-ir-overlay.dts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 049b50535656a..2872a00e1bcb1 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -611,7 +611,7 @@ Load:   dtoverlay=gpio-ir,<param>=<val>
 Params: gpio_pin                Input pin number. Default is 18.
 
         gpio_pull               Desired pull-up/down state (off, down, up)
-                                Default is "down".
+                                Default is "up".
 
         rc-map-name             Default rc keymap (can also be changed by
                                 ir-keytable), defaults to "rc-rc6-mce"
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
index 1bd9bb950efae..bd181236fcf2b 100644
--- a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
@@ -30,7 +30,7 @@
                         gpio_ir_pins: gpio_ir_pins@12 {
                                 brcm,pins = <18>;                       // pin 18
                                 brcm,function = <0>;                    // in
-                                brcm,pull = <1>;                        // down
+                                brcm,pull = <2>;                        // up
                         };
                 };
         };
-- 
GitLab


From 97405e23ec248fc3564893488b69749d70ec912e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 10 Jan 2019 17:58:06 +0000
Subject: [PATCH 0295/1835] firmware: raspberrypi: Report the fw variant during
 probe

The driver already reported the firmware build date during probe.
The mailbox calls have been extended to also report the variant
 1 = standard start.elf
 2 = start_x.elf (includes camera stack)
 3 = start_db.elf (includes assert logging)
 4 = start_cd.elf (cutdown version for smallest memory footprint).
Log the variant during probe.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/firmware/raspberrypi.c             | 32 +++++++++++++++++-----
 include/soc/bcm2835/raspberrypi-firmware.h |  1 +
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index fbcfd50eb6a3d..f020855f315bf 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -227,21 +227,39 @@ static const struct attribute_group rpi_firmware_dev_group = {
 static void
 rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
 {
+	static const char * const variant_strs[] = {
+		"unknown",
+		"start",
+		"start_x",
+		"start_db",
+		"start_cd",
+	};
+	const char *variant_str = "cmd unsupported";
 	u32 packet;
+	u32 variant;
+	struct tm tm;
 	int ret = rpi_firmware_property(fw,
 					RPI_FIRMWARE_GET_FIRMWARE_REVISION,
 					&packet, sizeof(packet));
 
-	if (ret == 0) {
-		struct tm tm;
+	if (ret)
+		return;
 
-		time64_to_tm(packet, 0, &tm);
+	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_FIRMWARE_VARIANT,
+				    &variant, sizeof(variant));
 
-		dev_info(fw->cl.dev,
-			 "Attached to firmware from %04ld-%02d-%02d %02d:%02d\n",
-			 tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
-			 tm.tm_hour, tm.tm_min);
+	if (!ret) {
+		if (variant >= ARRAY_SIZE(variant_strs))
+			variant = 0;
+		variant_str = variant_strs[variant];
 	}
+
+	time64_to_tm(packet, 0, &tm);
+
+	dev_info(fw->cl.dev,
+		 "Attached to firmware from %04ld-%02d-%02d %02d:%02d, variant %s\n",
+		 tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday, tm.tm_hour,
+		 tm.tm_min, variant_str);
 }
 
 static void
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 8ab5501c8d292..17f8fe3b5d2ca 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -41,6 +41,7 @@ struct rpi_firmware_property_tag_header {
 enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_PROPERTY_END =                           0,
 	RPI_FIRMWARE_GET_FIRMWARE_REVISION =                  0x00000001,
+	RPI_FIRMWARE_GET_FIRMWARE_VARIANT =                   0x00000002,
 
 	RPI_FIRMWARE_SET_CURSOR_INFO =                        0x00008010,
 	RPI_FIRMWARE_SET_CURSOR_STATE =                       0x00008011,
-- 
GitLab


From fb7d3e2b70736c5a302928df80bc789cc35fece4 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 10 Jan 2019 18:48:54 +0000
Subject: [PATCH 0296/1835] firmware: raspberrypi: Report the fw git hash
 during probe

The firmware can now report the git hash from which it was built
via the mailbox, so report it during probe.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/firmware/raspberrypi.c             | 17 +++++++++++++++++
 include/soc/bcm2835/raspberrypi-firmware.h |  1 +
 2 files changed, 18 insertions(+)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index f020855f315bf..fcbfe5d0015e5 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -262,6 +262,22 @@ rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
 		 tm.tm_min, variant_str);
 }
 
+static void
+rpi_firmware_print_firmware_hash(struct rpi_firmware *fw)
+{
+	u32 hash[5];
+	int ret = rpi_firmware_property(fw,
+					RPI_FIRMWARE_GET_FIRMWARE_HASH,
+					hash, sizeof(hash));
+
+	if (ret)
+		return;
+
+	dev_info(fw->cl.dev,
+		 "Firmware hash is %08x%08x%08x%08x%08x\n",
+		 hash[0], hash[1], hash[2], hash[3], hash[4]);
+}
+
 static void
 rpi_register_hwmon_driver(struct device *dev, struct rpi_firmware *fw)
 {
@@ -308,6 +324,7 @@ static int rpi_firmware_probe(struct platform_device *pdev)
 	g_pdev = pdev;
 
 	rpi_firmware_print_firmware_revision(fw);
+	rpi_firmware_print_firmware_hash(fw);
 	rpi_register_hwmon_driver(dev, fw);
 
 	return 0;
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 17f8fe3b5d2ca..23b9d356537f3 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -42,6 +42,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_PROPERTY_END =                           0,
 	RPI_FIRMWARE_GET_FIRMWARE_REVISION =                  0x00000001,
 	RPI_FIRMWARE_GET_FIRMWARE_VARIANT =                   0x00000002,
+	RPI_FIRMWARE_GET_FIRMWARE_HASH =                      0x00000003,
 
 	RPI_FIRMWARE_SET_CURSOR_INFO =                        0x00008010,
 	RPI_FIRMWARE_SET_CURSOR_STATE =                       0x00008011,
-- 
GitLab


From 1ac28e3bb67525ec8613aaad4de6dfb66cc16c1e Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 15 Jan 2019 09:56:41 +0000
Subject: [PATCH 0297/1835] arm64: dts: broadcom: Enable fixups for overlays

See: https://github.com/raspberrypi/linux/pull/2733

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm64/boot/dts/broadcom/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
index 66b0be84e08f1..c8aae4a79102d 100644
--- a/arch/arm64/boot/dts/broadcom/Makefile
+++ b/arch/arm64/boot/dts/broadcom/Makefile
@@ -9,3 +9,8 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-cm3.dtb
 
 subdir-y	+= northstar2
 subdir-y	+= stingray
+
+# Enable fixups to support overlays on BCM2835 platforms
+ifeq ($(CONFIG_ARCH_BCM2835),y)
+	DTC_FLAGS ?= -@
+endif
-- 
GitLab


From d90e1aae7990c7649b9d2e583d1adaa64a5f1118 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 18 May 2018 10:26:59 +0100
Subject: [PATCH 0298/1835] sc16is7xx: Fix for "Unexpected interrupt: 8"

The SC16IS752 has an Enhanced Feature Register which is aliased at the
same address as the Interrupt Identification Register; accessing it
requires that a magic value is written to the Line Configuration
Register. If an interrupt is raised while the EFR is mapped in then
the ISR won't be able to access the IIR, leading to the "Unexpected
interrupt" error messages.

Avoid the problem by claiming a mutex around accesses to the EFR
register, also claiming the mutex in the interrupt handler work
item (this is equivalent to disabling interrupts to interlock against
a non-threaded interrupt handler).

See: https://github.com/raspberrypi/linux/issues/2529

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/tty/serial/sc16is7xx.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 7789d35681007..eac0efb8e836e 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -328,6 +328,7 @@ struct sc16is7xx_port {
 	struct kthread_worker		kworker;
 	struct task_struct		*kworker_task;
 	struct kthread_work		irq_work;
+	struct mutex			efr_lock;
 	struct sc16is7xx_one		p[0];
 };
 
@@ -499,6 +500,21 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
 		div /= 4;
 	}
 
+	/* In an amazing feat of design, the Enhanced Features Register shares
+	 * the address of the Interrupt Identification Register, and is
+	 * switched in by writing a magic value (0xbf) to the Line Control
+	 * Register. Any interrupt firing during this time will see the EFR
+	 * where it expects the IIR to be, leading to "Unexpected interrupt"
+	 * messages.
+	 *
+	 * Prevent this possibility by claiming a mutex while accessing the
+	 * EFR, and claiming the same mutex from within the interrupt handler.
+	 * This is similar to disabling the interrupt, but that doesn't work
+	 * because the bulk of the interrupt processing is run as a workqueue
+	 * job in thread context.
+	 */
+	mutex_lock(&s->efr_lock);
+
 	lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
 
 	/* Open the LCR divisors for configuration */
@@ -514,6 +530,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
 	/* Put LCR back to the normal mode */
 	sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
 
+	mutex_unlock(&s->efr_lock);
+
 	sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
 			      SC16IS7XX_MCR_CLKSEL_BIT,
 			      prescaler);
@@ -698,6 +716,8 @@ static void sc16is7xx_ist(struct kthread_work *ws)
 {
 	struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work);
 
+	mutex_lock(&s->efr_lock);
+
 	while (1) {
 		bool keep_polling = false;
 		int i;
@@ -707,6 +727,8 @@ static void sc16is7xx_ist(struct kthread_work *ws)
 		if (!keep_polling)
 			break;
 	}
+
+	mutex_unlock(&s->efr_lock);
 }
 
 static irqreturn_t sc16is7xx_irq(int irq, void *dev_id)
@@ -901,6 +923,9 @@ static void sc16is7xx_set_termios(struct uart_port *port,
 	if (!(termios->c_cflag & CREAD))
 		port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK;
 
+	/* As above, claim the mutex while accessing the EFR. */
+	mutex_lock(&s->efr_lock);
+
 	sc16is7xx_port_write(port, SC16IS7XX_LCR_REG,
 			     SC16IS7XX_LCR_CONF_MODE_B);
 
@@ -922,6 +947,8 @@ static void sc16is7xx_set_termios(struct uart_port *port,
 	/* Update LCR register */
 	sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
 
+	mutex_unlock(&s->efr_lock);
+
 	/* Get baud rate generator configuration */
 	baud = uart_get_baud_rate(port, termios, old,
 				  port->uartclk / 16 / 4 / 0xffff,
@@ -1187,6 +1214,7 @@ static int sc16is7xx_probe(struct device *dev,
 	s->regmap = regmap;
 	s->devtype = devtype;
 	dev_set_drvdata(dev, s);
+	mutex_init(&s->efr_lock);
 
 	kthread_init_worker(&s->kworker);
 	kthread_init_work(&s->irq_work, sc16is7xx_ist);
-- 
GitLab


From f6cc5893c46f73e9e278abe96acf6c4e05b6d3e9 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <benwolsieffer@gmail.com>
Date: Sun, 9 Dec 2018 16:46:00 -0500
Subject: [PATCH 0299/1835] dtoverlays: fe-pi-audio: fix sgtl5000 compatible
 string

The compatible string was set to "fepi,sgtl5000", which worked for some
reason in 4.14, but does not work in 4.19, presumably due to some
change in the kernel matching logic. The correct string is
"fsl,sgtl5000".

Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
---
 arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
index 81a07ed5a8c75..81dfa5aabe55b 100644
--- a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
@@ -39,7 +39,7 @@
 
 			sgtl5000@0a {
 				#sound-dai-cells = <0>;
-				compatible = "fepi,sgtl5000";
+				compatible = "fsl,sgtl5000";
 				reg = <0x0a>;
 				clocks = <&sgtl5000_mclk>;
 				micbias-resistor-k-ohms = <2>;
-- 
GitLab


From 3c6d8afeb227a3aeb0ae101176c511db578aa131 Mon Sep 17 00:00:00 2001
From: Ezekiel Bethel <zek@9net.org>
Date: Wed, 12 Dec 2018 19:11:13 +0000
Subject: [PATCH 0300/1835] bcm2835_smi: re-add dereference to fix DMA
 transfers

---
 drivers/misc/bcm2835_smi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/bcm2835_smi.c b/drivers/misc/bcm2835_smi.c
index 1261540703127..f1a7f6a3e966b 100644
--- a/drivers/misc/bcm2835_smi.c
+++ b/drivers/misc/bcm2835_smi.c
@@ -879,7 +879,7 @@ static int bcm2835_smi_probe(struct platform_device *pdev)
 		goto err;
 	}
 	addr = of_get_address(node, 0, NULL, NULL);
-	inst->smi_regs_busaddr = be32_to_cpu(addr);
+	inst->smi_regs_busaddr = be32_to_cpu(*addr);
 
 	err = bcm2835_smi_dma_setup(inst);
 	if (err)
-- 
GitLab


From 1f9942d019d7e166696d1e23f733239c1250f051 Mon Sep 17 00:00:00 2001
From: Joshua Emele <jemele@acm.org>
Date: Wed, 7 Nov 2018 16:07:40 -0800
Subject: [PATCH 0301/1835] lan78xx: Debounce link events to minimize poll
 storm

The bInterval is set to 4 (i.e. 8 microframes => 1ms) and the only bit
that the driver pays attention to is "link was reset". If there's a
flapping status bit in that endpoint data, (such as if PHY negotiation
needs a few tries to get a stable link) then polling at a slower rate
would act as a de-bounce.

See: https://github.com/raspberrypi/linux/issues/2447
---
 drivers/net/usb/lan78xx.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 59bda07dc9d74..86d2f1d4c7586 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -448,6 +448,11 @@ static bool enable_tso;
 module_param(enable_tso, bool, 0644);
 MODULE_PARM_DESC(enable_tso, "Enables TCP segmentation offload");
 
+#define INT_URB_MICROFRAMES_PER_MS	8
+static int int_urb_interval_ms = 8;
+module_param(int_urb_interval_ms, int, 0);
+MODULE_PARM_DESC(int_urb_interval_ms, "Override usb interrupt urb interval");
+
 static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
 {
 	u32 *buf = kmalloc(sizeof(u32), GFP_KERNEL);
@@ -3816,7 +3821,12 @@ static int lan78xx_probe(struct usb_interface *intf,
 	dev->pipe_intr = usb_rcvintpipe(dev->udev,
 					dev->ep_intr->desc.bEndpointAddress &
 					USB_ENDPOINT_NUMBER_MASK);
-	period = dev->ep_intr->desc.bInterval;
+	if (int_urb_interval_ms <= 0)
+		period = dev->ep_intr->desc.bInterval;
+	else
+		period = int_urb_interval_ms * INT_URB_MICROFRAMES_PER_MS;
+
+	netif_notice(dev, probe, netdev, "int urb period %d\n", period);
 
 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0);
 	buf = kmalloc(maxp, GFP_KERNEL);
-- 
GitLab


From d32db848ae27983a5c1b22058bccb6cbd574ae0a Mon Sep 17 00:00:00 2001
From: b-ak <anur.bhargav@gmail.com>
Date: Thu, 3 Jan 2019 00:01:08 +0530
Subject: [PATCH 0302/1835] ASoC: Add support for AudioSense-Pi add-on
 soundcard

AudioSense-Pi is a RPi HAT based on a TI's TLV320AIC32x4 stereo codec

This hardware provides multiple audio I/O capabilities to the RPi.
The codec connects to the RPi's SoC through the I2S Bus.

The following devices can be connected through a 3.5mm jack
	1. Line-In: Plain old audio in from mobile phones, PCs, etc.,
	2. Mic-In: Connect a microphone
	3. Line-Out: Connect the output to a speaker
	4. Headphones: Connect a Headphone w or w/o microphones

Multiple Inputs:
	It supports the following combinations
	1. Two stereo Line-Inputs and a microphone
	2. One stereo Line-Input and two microphones
	3. Two stereo Line-Inputs, a microphone and
		one mono line-input (with h/w hack)
	4. One stereo Line-Input, two microphones and
		one mono line-input (with h/w hack)

Multiple Outputs:
	Audio output can be routed to the headphones or
		speakers (with additional hardware)

Signed-off-by: b-ak <anur.bhargav@gmail.com>
---
 sound/soc/bcm/Kconfig         |   7 +
 sound/soc/bcm/Makefile        |   2 +
 sound/soc/bcm/audiosense-pi.c | 246 ++++++++++++++++++++++++++++++++++
 3 files changed, 255 insertions(+)
 create mode 100644 sound/soc/bcm/audiosense-pi.c

diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index bb4903bcae18c..30ae8da135f6c 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -137,6 +137,13 @@ config SND_AUDIOINJECTOR_OCTO_SOUNDCARD
 	help
 	  Say Y or M if you want to add support for audioinjector.net octo add on
 
+config SND_AUDIOSENSE_PI
+	tristate "Support for AudioSense Add-On Soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_TLV320AIC32X4_I2C
+	help
+	  Say Y or M if you want to add support for tlv320aic32x4 add-on
+
 config SND_DIGIDAC1_SOUNDCARD
         tristate "Support for Red Rocks Audio DigiDAC1"
         depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index 94ec208fed82d..c254848b8dbd5 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -20,6 +20,7 @@ snd-soc-rpi-proto-objs := rpi-proto.o
 snd-soc-iqaudio-dac-objs := iqaudio-dac.o
 snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
 snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
+snd-soc-audiosense-pi-objs := audiosense-pi.o
 snd-soc-digidac1-soundcard-objs := digidac1-soundcard.o
 snd-soc-dionaudio-loco-objs := dionaudio_loco.o
 snd-soc-dionaudio-loco-v2-objs := dionaudio_loco-v2.o
@@ -41,6 +42,7 @@ obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
 obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
+obj-$(CONFIG_SND_AUDIOSENSE_PI) += snd-soc-audiosense-pi.o
 obj-$(CONFIG_SND_DIGIDAC1_SOUNDCARD) += snd-soc-digidac1-soundcard.o
 obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO) += snd-soc-dionaudio-loco.o
 obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2) += snd-soc-dionaudio-loco-v2.o
diff --git a/sound/soc/bcm/audiosense-pi.c b/sound/soc/bcm/audiosense-pi.c
new file mode 100644
index 0000000000000..0360fdc24566f
--- /dev/null
+++ b/sound/soc/bcm/audiosense-pi.c
@@ -0,0 +1,246 @@
+/*
+ * ASoC Driver for AudioSense add on soundcard
+ * Author:
+ *	Bhargav A K <anur.bhargav@gmail.com>
+ *	Copyright 2017
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/i2c.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <sound/control.h>
+
+#include <sound/tlv320aic32x4.h>
+#include "../codecs/tlv320aic32x4.h"
+
+#define AIC32X4_SYSCLK_XTAL	0x00
+
+/*
+ * Setup Codec Sample Rates and Channels
+ * Supported Rates:
+ *	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000, 88200, 96000,
+ */
+static const unsigned int audiosense_pi_rate[] = {
+	48000,
+};
+
+static struct snd_pcm_hw_constraint_list audiosense_constraints_rates = {
+	.list = audiosense_pi_rate,
+	.count = ARRAY_SIZE(audiosense_pi_rate),
+};
+
+static const unsigned int audiosense_pi_channels[] = {
+	2,
+};
+
+static struct snd_pcm_hw_constraint_list audiosense_constraints_ch = {
+	.count = ARRAY_SIZE(audiosense_pi_channels),
+	.list = audiosense_pi_channels,
+	.mask = 0,
+};
+
+/* Setup DAPM widgets and paths */
+static const struct snd_soc_dapm_widget audiosense_pi_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_LINE("Line Out", NULL),
+	SND_SOC_DAPM_LINE("Line In", NULL),
+	SND_SOC_DAPM_INPUT("CM_L"),
+	SND_SOC_DAPM_INPUT("CM_R"),
+};
+
+static const struct snd_soc_dapm_route audiosense_pi_audio_map[] = {
+	/* Line Inputs are connected to
+	 * (IN1_L | IN1_R)
+	 * (IN2_L | IN2_R)
+	 * (IN3_L | IN3_R)
+	 */
+	{"IN1_L", NULL, "Line In"},
+	{"IN1_R", NULL, "Line In"},
+	{"IN2_L", NULL, "Line In"},
+	{"IN2_R", NULL, "Line In"},
+	{"IN3_L", NULL, "Line In"},
+	{"IN3_R", NULL, "Line In"},
+
+	/* Mic is connected to IN2_L and IN2_R */
+	{"Left ADC", NULL, "Mic Bias"},
+	{"Right ADC", NULL, "Mic Bias"},
+
+	/* Headphone connected to HPL, HPR */
+	{"Headphone Jack", NULL, "HPL"},
+	{"Headphone Jack", NULL, "HPR"},
+
+	/* Speakers connected to LOL and LOR */
+	{"Line Out", NULL, "LOL"},
+	{"Line Out", NULL, "LOR"},
+};
+
+static int audiosense_pi_card_init(struct snd_soc_pcm_runtime *rtd)
+{
+	/* TODO: init of the codec specific dapm data, ignore suspend/resume */
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_component_update_bits(component, AIC32X4_MICBIAS, 0x78,
+				      AIC32X4_MICBIAS_LDOIN |
+				      AIC32X4_MICBIAS_2075V);
+	snd_soc_component_update_bits(component, AIC32X4_PWRCFG, 0x08,
+				      AIC32X4_AVDDWEAKDISABLE);
+	snd_soc_component_update_bits(component, AIC32X4_LDOCTL, 0x01,
+				      AIC32X4_LDOCTLEN);
+
+	return 0;
+}
+
+static int audiosense_pi_card_hw_params(
+		struct snd_pcm_substream *substream,
+		struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+
+	/* Set the codec system clock, there is a 12 MHz XTAL on the board */
+	ret = snd_soc_dai_set_sysclk(codec_dai, AIC32X4_SYSCLK_XTAL,
+				     12000000, SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(rtd->card->dev,
+			"could not set codec driver clock params\n");
+		return ret;
+	}
+	return 0;
+}
+
+static int audiosense_pi_card_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_pcm_runtime *runtime = substream->runtime;
+
+	/*
+	 * Set codec to 48Khz Sampling, Stereo I/O and 16 bit audio
+	 */
+	runtime->hw.channels_max = 2;
+	snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+				   &audiosense_constraints_ch);
+
+	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+	snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
+
+
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				   SNDRV_PCM_HW_PARAM_RATE,
+				   &audiosense_constraints_rates);
+	return 0;
+}
+
+static struct snd_soc_ops audiosense_pi_card_ops = {
+	.startup = audiosense_pi_card_startup,
+	.hw_params = audiosense_pi_card_hw_params,
+};
+
+static struct snd_soc_dai_link audiosense_pi_card_dai[] = {
+	{
+		.name           = "TLV320AIC3204 Audio",
+		.stream_name    = "TLV320AIC3204 Hifi Audio",
+		.cpu_dai_name   = "bcm2708-i2s.0",
+		.codec_dai_name = "tlv320aic32x4-hifi",
+		.platform_name  = "bcm2708-i2s.0",
+		.codec_name     = "tlv320aic32x4.1-0018",
+		.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+			SND_SOC_DAIFMT_CBM_CFM,
+		.ops            = &audiosense_pi_card_ops,
+		.init           = audiosense_pi_card_init,
+	},
+};
+
+static struct snd_soc_card audiosense_pi_card = {
+	.name		= "audiosense-pi",
+	.driver_name	= "audiosense-pi",
+	.dai_link	= audiosense_pi_card_dai,
+	.owner		= THIS_MODULE,
+	.num_links	= ARRAY_SIZE(audiosense_pi_card_dai),
+	.dapm_widgets	= audiosense_pi_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(audiosense_pi_dapm_widgets),
+	.dapm_routes	= audiosense_pi_audio_map,
+	.num_dapm_routes = ARRAY_SIZE(audiosense_pi_audio_map),
+};
+
+static int audiosense_pi_card_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct snd_soc_card *card = &audiosense_pi_card;
+	struct snd_soc_dai_link *dai = &audiosense_pi_card_dai[0];
+	struct device_node *i2s_node = pdev->dev.of_node;
+
+	card->dev = &pdev->dev;
+
+	if (!dai) {
+		dev_err(&pdev->dev, "DAI not found. Missing or Invalid\n");
+		return -EINVAL;
+	}
+
+	i2s_node = of_parse_phandle(pdev->dev.of_node, "i2s-controller", 0);
+	if (!i2s_node) {
+		dev_err(&pdev->dev,
+			"Property 'i2s-controller' missing or invalid\n");
+		return -EINVAL;
+	}
+
+	dai->cpu_dai_name = NULL;
+	dai->cpu_of_node = i2s_node;
+	dai->platform_name = NULL;
+	dai->platform_of_node = i2s_node;
+
+	of_node_put(i2s_node);
+
+	ret = snd_soc_register_card(card);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int audiosense_pi_card_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	return snd_soc_unregister_card(card);
+
+}
+
+static const struct of_device_id audiosense_pi_card_of_match[] = {
+	{ .compatible = "as,audiosense-pi", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, audiosense_pi_card_of_match);
+
+static struct platform_driver audiosense_pi_card_driver = {
+	.driver = {
+		.name = "audiosense-snd-card",
+		.owner = THIS_MODULE,
+		.of_match_table = audiosense_pi_card_of_match,
+	},
+	.probe = audiosense_pi_card_probe,
+	.remove = audiosense_pi_card_remove,
+};
+
+module_platform_driver(audiosense_pi_card_driver);
+
+MODULE_AUTHOR("Bhargav AK <anur.bhargav@gmail.com>");
+MODULE_DESCRIPTION("ASoC Driver for TLV320AIC3204 Audio");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:audiosense-pi");
+
-- 
GitLab


From 0a33f9efc992c09c6d41205e75eb6c9ce1020b6a Mon Sep 17 00:00:00 2001
From: b-ak <anur.bhargav@gmail.com>
Date: Thu, 3 Jan 2019 00:29:14 +0530
Subject: [PATCH 0303/1835] BCM270X: Adding device tree support for
 AudioSense-Pi add-on soundcard

Device tree overlay for AudioSense-Pi card.

To enable support for the hardware add the following
line to the RPi /boot/config.txt:

	dtoverlay=audiosense-pi

More documentation @ arch/arm/boot/dts/overlays/README

Signed-off-by: b-ak <anur.bhargav@gmail.com>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  8 ++
 .../dts/overlays/audiosense-pi-overlay.dts    | 82 +++++++++++++++++++
 3 files changed, 91 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 01189088e62c6..a372dad355068 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -20,6 +20,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	audioinjector-addons.dtbo \
 	audioinjector-ultra.dtbo \
 	audioinjector-wm8731-audio.dtbo \
+	audiosense-pi.dtbo \
 	audremap.dtbo \
 	balena-fin.dtbo \
 	bmp085_i2c-sensor.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 2872a00e1bcb1..b5bd1e3974254 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -453,6 +453,14 @@ Load:   dtoverlay=audioinjector-wm8731-audio
 Params: <None>
 
 
+Name:   audiosense-pi
+Info:   Configures the audiosense-pi add on soundcard
+        For more information refer to
+        https://gitlab.com/kakar0t/audiosense-pi
+Load:   dtoverlay=audiosense-pi
+Params: <None>
+
+
 Name:   audremap
 Info:   Switches PWM sound output to pins 12 (Right) & 13 (Left)
 Load:   dtoverlay=audremap,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
new file mode 100644
index 0000000000000..a31762c11cb4a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
@@ -0,0 +1,82 @@
+// Definitions for audiosense add on soundcard
+/dts-v1/;
+/plugin/;
+#include <dt-bindings/pinctrl/bcm2835.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "brcm,bcm2837", "brcm,bcm2836", "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			codec_reg_1v8: codec-reg-1v8 {
+				compatible = "regulator-fixed";
+				regulator-name = "tlv320aic3204_1v8";
+				regulator-min-microvolt = <1800000>;
+				regulator-max-microvolt = <1800000>;
+				regulator-always-on;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			codec_rst: codec-rst {
+				brcm,pins = <26>;
+				brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			/* audio external oscillator */
+			codec_osc: codec_osc {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <12000000>;	/* 12 MHz */
+			};
+
+			codec: tlv320aic32x4@18 {
+				#sound-dai-cells = <0>;
+				compatible = "ti,tlv320aic32x4";
+				reg = <0x18>;
+
+				clocks = <&codec_osc>;
+				clock-names = "mclk";
+
+				iov-supply = <&vdd_3v3_reg>;
+				ldoin-supply = <&vdd_3v3_reg>;
+
+				gpio-controller;
+				#gpio-cells = <2>;
+				reset-gpios = <&gpio 26 GPIO_ACTIVE_HIGH>;
+
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "as,audiosense-pi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
-- 
GitLab


From 3225e1c6daf371fbd7872d21365180ac1e7df850 Mon Sep 17 00:00:00 2001
From: b-ak <anur.bhargav@gmail.com>
Date: Fri, 4 Jan 2019 00:12:51 +0530
Subject: [PATCH 0304/1835] configs: Add CONFIG_SND_AUDIOSENSE_PI=m

AudioSense-Pi add on soundcard configuration definitions

Signed-off-by: b-ak <anur.bhargav@gmail.com>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 07cf0b16f8f4d..18f2ae3a0dfc4 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -918,6 +918,7 @@ CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
 CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_AUDIOSENSE_PI=m
 CONFIG_SND_DIGIDAC1_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index fca4d449e0e2b..db077d958d119 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -911,6 +911,7 @@ CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
 CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_AUDIOSENSE_PI=m
 CONFIG_SND_DIGIDAC1_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 26e19b5f98cea..92ba6a7e4afee 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -800,6 +800,7 @@ CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOSENSE_PI=m
 CONFIG_SND_DIGIDAC1_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
 CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
-- 
GitLab


From a92d19bc7ceffbff24934506d089791ea1ab88c1 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 14 Jan 2019 08:50:55 +0000
Subject: [PATCH 0305/1835] configs: Add CONFIG_USB_TMC=m

Enable the Test & Measurement Class USB driver module.

See: https://github.com/raspberrypi/linux/firmware/issues/929

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 2 +-
 arch/arm/configs/bcmrpi_defconfig    | 2 +-
 arch/arm64/configs/bcmrpi3_defconfig | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 18f2ae3a0dfc4..df30bed099801 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1002,6 +1002,7 @@ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=m
 CONFIG_USB_DWCOTG=y
 CONFIG_USB_PRINTER=m
+CONFIG_USB_TMC=m
 CONFIG_USB_STORAGE=y
 CONFIG_USB_STORAGE_REALTEK=m
 CONFIG_USB_STORAGE_DATAFAB=m
@@ -1301,7 +1302,6 @@ CONFIG_CIFS=m
 CONFIG_CIFS_WEAK_PW_HASH=y
 CONFIG_CIFS_UPCALL=y
 CONFIG_CIFS_XATTR=y
-CONFIG_CIFS_POSIX=y
 CONFIG_CIFS_ACL=y
 CONFIG_CIFS_DFS_UPCALL=y
 CONFIG_CIFS_FSCACHE=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index db077d958d119..71c829cdfcefa 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -995,6 +995,7 @@ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=m
 CONFIG_USB_DWCOTG=y
 CONFIG_USB_PRINTER=m
+CONFIG_USB_TMC=m
 CONFIG_USB_STORAGE=y
 CONFIG_USB_STORAGE_REALTEK=m
 CONFIG_USB_STORAGE_DATAFAB=m
@@ -1294,7 +1295,6 @@ CONFIG_CIFS=m
 CONFIG_CIFS_WEAK_PW_HASH=y
 CONFIG_CIFS_UPCALL=y
 CONFIG_CIFS_XATTR=y
-CONFIG_CIFS_POSIX=y
 CONFIG_CIFS_ACL=y
 CONFIG_CIFS_DFS_UPCALL=y
 CONFIG_CIFS_FSCACHE=y
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 92ba6a7e4afee..6d4482f0aa5a5 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -871,6 +871,7 @@ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=m
 CONFIG_USB_DWCOTG=y
 CONFIG_USB_PRINTER=m
+CONFIG_USB_TMC=m
 CONFIG_USB_STORAGE=y
 CONFIG_USB_STORAGE_REALTEK=m
 CONFIG_USB_STORAGE_DATAFAB=m
@@ -1145,7 +1146,6 @@ CONFIG_CIFS=m
 CONFIG_CIFS_WEAK_PW_HASH=y
 CONFIG_CIFS_UPCALL=y
 CONFIG_CIFS_XATTR=y
-CONFIG_CIFS_POSIX=y
 CONFIG_CIFS_ACL=y
 CONFIG_CIFS_DFS_UPCALL=y
 CONFIG_CIFS_FSCACHE=y
-- 
GitLab


From 21cefbbac6b23c257e6dd56977186a360326237e Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 10 Jan 2019 15:27:56 +0000
Subject: [PATCH 0306/1835] overlays: sdio: Add enhanced 1-bit support

"dtoverlay=sdio,bus_width=1,gpios_22_25" is equivalent to the sdio-1bit
overlay, which is now deprecated.

"dtoverlay=sdio,bus_width=1,gpios_34_37" enables 1-bit mode on GPIOs 34-37.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README           | 24 +++++++++++----------
 arch/arm/boot/dts/overlays/sdio-overlay.dts | 20 ++++++++++++++++-
 2 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index b5bd1e3974254..efec8fad5c0ee 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -479,8 +479,7 @@ Params: <None>
 
 Name:   bmp085_i2c-sensor
 Info:   This overlay is now deprecated - see i2c-sensor
-Load:   dtoverlay=bmp085_i2c-sensor
-Params: <None>
+Load:   <Deprecated>
 
 
 Name:   dht11
@@ -1737,7 +1736,8 @@ Params: overclock_50            Clock (in MHz) to use when the MMC framework
 
 Name:   sdio
 Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
-        and enables SDIO via GPIOs 22-27.
+        and enables SDIO via GPIOs 22-27. An example of use in 1-bit mode is
+        "dtoverlay=sdio,bus_width=1,gpios_22_25"
 Load:   dtoverlay=sdio,<param>=<val>
 Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
                                 framework requests 50MHz
@@ -1747,16 +1747,18 @@ Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
 
         bus_width               Set the SDIO host bus width (default 4 bits)
 
+        gpios_22_25             Select GPIOs 22-25 for 1-bit mode. Must be used
+                                with bus_width=1. This replaces the sdio-1bit
+                                overlay, which is now deprecated.
 
-Name:   sdio-1bit
-Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
-        and enables 1-bit SDIO via GPIOs 22-25.
-Load:   dtoverlay=sdio-1bit,<param>=<val>
-Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
-                                framework requests 50MHz
+        gpios_34_37             Select GPIOs 34-37 for 1-bit mode. Must be used
+                                with bus_width=1.
 
-        poll_once               Disable SDIO-device polling every second
-                                (default on: polling once at boot-time)
+
+Name:   sdio-1bit
+Info:   This overlay is now deprecated. Use
+        "dtoverlay=sdio,bus_width=1,gpios_22_25" instead.
+Load:   <Deprecated>
 
 
 Name:   sdtweak
diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
index 685b65a858e89..06dce154a058c 100644
--- a/arch/arm/boot/dts/overlays/sdio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
@@ -32,7 +32,7 @@
 				pinctrl-names = "default";
 				pinctrl-0 = <&sdio_ovl_pins>;
 				non-removable;
-				bus-width = <1>;
+				bus-width = <4>;
 			};
 		};
 	};
@@ -49,6 +49,22 @@
 	};
 
 	fragment@3 {
+		target = <&sdio_ovl_pins>;
+		__dormant__ {
+			brcm,pins = <22 23 24 25>;
+			brcm,pull = <0 2 2 2>;
+		};
+	};
+
+	fragment@4 {
+		target = <&sdio_ovl_pins>;
+		__dormant__ {
+			brcm,pins = <34 35 36 37>;
+			brcm,pull = <0 2 2 2>;
+		};
+	};
+
+	fragment@6 {
 		target-path = "/aliases";
 		__overlay__ {
 			mmc1 = "/soc/sdio@7e300000";
@@ -59,5 +75,7 @@
 		poll_once = <&sdio_ovl>,"non-removable?";
 		bus_width = <&sdio_ovl>,"bus-width:0";
 		sdio_overclock = <&sdio_ovl>,"brcm,overclock-50:0";
+		gpios_22_25 = <0>,"=3";
+		gpios_34_37 = <0>,"=4";
 	};
 };
-- 
GitLab


From 5ee4c8368e70c65db0a91f7dddb7f2b46de31c87 Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Wed, 16 Jan 2019 10:17:52 +0000
Subject: [PATCH 0307/1835] dwc_otg: fix bug with port_addr assignment for
 single-TT hubs

See https://github.com/raspberrypi/linux/issues/2734

The "Hub Port" field in the split transaction packet was always set
to 1 for single-TT hubs. The majority of single-TT hub products
apparently ignore this field and broadcast to all downstream enabled
ports, which masked the issue. A subset of hub devices apparently
need the port number to be exact or split transactions will fail.
---
 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
index c86a19ef8da42..23a9291b26141 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -232,7 +232,7 @@ static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
 		else
 			*hub_addr = urb->dev->tt->hub->devnum;
 	}
-	*port_addr = urb->dev->tt->multi ? urb->dev->ttport : 1;
+	*port_addr = urb->dev->ttport;
    } else {
         *hub_addr = 0;
 	*port_addr = urb->dev->ttport;
-- 
GitLab


From b2d7677b20a00fb558f85286b1b91f4d4e379570 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 16 Jan 2019 21:26:13 +0000
Subject: [PATCH 0308/1835] configs: Add CONFIG_USB_UAS=m

Enable support for USB-attached-SCSI devicess.

See: https://github.com/raspberrypi/linux/issues/2813

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index df30bed099801..7bba3ce016359 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1017,6 +1017,7 @@ CONFIG_USB_STORAGE_ONETOUCH=m
 CONFIG_USB_STORAGE_KARMA=m
 CONFIG_USB_STORAGE_CYPRESS_ATACB=m
 CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_UAS=m
 CONFIG_USB_MDC800=m
 CONFIG_USB_MICROTEK=m
 CONFIG_USBIP_CORE=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 71c829cdfcefa..981cc987f5db0 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1010,6 +1010,7 @@ CONFIG_USB_STORAGE_ONETOUCH=m
 CONFIG_USB_STORAGE_KARMA=m
 CONFIG_USB_STORAGE_CYPRESS_ATACB=m
 CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_UAS=m
 CONFIG_USB_MDC800=m
 CONFIG_USB_MICROTEK=m
 CONFIG_USBIP_CORE=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 6d4482f0aa5a5..07048117fde1b 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -886,6 +886,7 @@ CONFIG_USB_STORAGE_ONETOUCH=m
 CONFIG_USB_STORAGE_KARMA=m
 CONFIG_USB_STORAGE_CYPRESS_ATACB=m
 CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_UAS=m
 CONFIG_USB_MDC800=m
 CONFIG_USB_MICROTEK=m
 CONFIG_USBIP_CORE=m
-- 
GitLab


From 9fad60cf9d89bc47f90547063e6f370483b5ff5a Mon Sep 17 00:00:00 2001
From: HiFiBerry <info@hifiberry.com>
Date: Mon, 8 Oct 2018 18:10:12 +0200
Subject: [PATCH 0309/1835] Added driver for the HiFiBerry DAC+ ADC (#2694)

Signed-off-by: Daniel Matuschek <daniel@hifiberry.com>
---
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |  21 +
 .../overlays/hifiberry-dacplusadc-overlay.dts |  71 +++
 arch/arm/configs/bcm2709_defconfig            |   1 +
 arch/arm/configs/bcmrpi_defconfig             |   1 +
 sound/soc/bcm/Kconfig                         |   8 +
 sound/soc/bcm/Makefile                        |   2 +
 sound/soc/bcm/hifiberry_dacplusadc.c          | 407 ++++++++++++++++++
 8 files changed, 512 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
 create mode 100644 sound/soc/bcm/hifiberry_dacplusadc.c

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index a372dad355068..38046efd5fdd8 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -49,6 +49,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	hifiberry-amp.dtbo \
 	hifiberry-dac.dtbo \
 	hifiberry-dacplus.dtbo \
+	hifiberry-dacplusadc.dtbo \
 	hifiberry-digi.dtbo \
 	hifiberry-digi-pro.dtbo \
 	hy28a.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index efec8fad5c0ee..ed582bc373750 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -779,6 +779,27 @@ Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
                                 master for bit clock and frame clock.
 
 
+Name:   hifiberry-dacplusadc
+Info:   Configures the HifiBerry DAC+ADC audio card
+Load:   dtoverlay=hifiberry-dacplusadc,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        slave                   Force DAC+ Pro into slave mode, using Pi as
+                                master for bit clock and frame clock.
+
+
 Name:   hifiberry-digi
 Info:   Configures the HifiBerry Digi and Digi+ audio card
 Load:   dtoverlay=hifiberry-digi
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
new file mode 100644
index 0000000000000..9610ceefbbd5d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
@@ -0,0 +1,71 @@
+// Definitions for HiFiBerry DAC+ADC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			dacpro_osc: dacpro_osc {
+				compatible = "hifiberry,dacpro-clk";
+				#clock-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm_codec: pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				clocks = <&dacpro_osc>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/";
+		__overlay__ {
+			dmic {
+				#sound-dai-cells = <0>;
+				compatible = "dmic-codec";
+				num-channels = <2>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&sound>;
+		hifiberry_dacplusadc: __overlay__ {
+			compatible = "hifiberry,hifiberry-dacplusadc";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&hifiberry_dacplusadc>,"hifiberry,24db_digital_gain?";
+		slave = <&hifiberry_dacplusadc>,"hifiberry-dacplusadc,slave?";
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 7bba3ce016359..b8f47b630eaa8 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -905,6 +905,7 @@ CONFIG_SND_BCM2835_SOC_I2S=m
 CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 981cc987f5db0..268f64bdb9bdf 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -898,6 +898,7 @@ CONFIG_SND_BCM2835_SOC_I2S=m
 CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 30ae8da135f6c..966387574fe32 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -46,6 +46,14 @@ config SND_BCM2708_SOC_HIFIBERRY_DACPLUS
         help
          Say Y or M if you want to add support for HifiBerry DAC+.
 
+config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC
+        tristate "Support for HifiBerry DAC+ADC"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM512x_I2C
+	select SND_SOC_DMIC
+        help
+         Say Y or M if you want to add support for HifiBerry DAC+ADC.
+
 config SND_BCM2708_SOC_HIFIBERRY_DIGI
         tristate "Support for HifiBerry Digi"
         depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index c254848b8dbd5..d8bf332e5cdbb 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -14,6 +14,7 @@ snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
 # BCM2708 Machine Support
 snd-soc-3dlab-nano-player-objs := 3dlab-nano-player.o
 snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
+snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
 snd-soc-justboom-dac-objs := justboom-dac.o
 snd-soc-rpi-cirrus-objs := rpi-cirrus.o
 snd-soc-rpi-proto-objs := rpi-proto.o
@@ -36,6 +37,7 @@ snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
 obj-$(CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER) += snd-soc-3dlab-nano-player.o
 obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusadc.o
 obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
diff --git a/sound/soc/bcm/hifiberry_dacplusadc.c b/sound/soc/bcm/hifiberry_dacplusadc.c
new file mode 100644
index 0000000000000..8a0bf9f13f529
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_dacplusadc.c
@@ -0,0 +1,407 @@
+/*
+ * ASoC Driver for HiFiBerry DAC+ / DAC Pro with ADC
+ *
+ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
+ *		Copyright 2014-2015
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *		ADC added by Joerg Schambacher <joscha@schambacher.com>
+ *		Copyright 2018
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/pcm512x.h"
+
+#define HIFIBERRY_DACPRO_NOCLOCK 0
+#define HIFIBERRY_DACPRO_CLK44EN 1
+#define HIFIBERRY_DACPRO_CLK48EN 2
+
+struct platform_device *dmic_codec_dev;
+
+struct pcm512x_priv {
+	struct regmap *regmap;
+	struct clk *sclk;
+};
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 22579200UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 24576000UL
+
+static bool slave;
+static bool snd_rpi_hifiberry_is_dacpro;
+static bool digital_gain_0db_limit = true;
+
+static void snd_rpi_hifiberry_dacplusadc_select_clk(struct snd_soc_component *component,
+	int clk_id)
+{
+	switch (clk_id) {
+	case HIFIBERRY_DACPRO_NOCLOCK:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
+		break;
+	case HIFIBERRY_DACPRO_CLK44EN:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
+		break;
+	case HIFIBERRY_DACPRO_CLK48EN:
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
+		break;
+	}
+}
+
+static void snd_rpi_hifiberry_dacplusadc_clk_gpio(struct snd_soc_component *component)
+{
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
+}
+
+static bool snd_rpi_hifiberry_dacplusadc_is_sclk(struct snd_soc_component *component)
+{
+	unsigned int sck;
+
+	snd_soc_component_read(component, PCM512x_RATE_DET_4, &sck);
+	return (!(sck & 0x40));
+}
+
+static bool snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(
+	struct snd_soc_component *component)
+{
+	msleep(2);
+	return snd_rpi_hifiberry_dacplusadc_is_sclk(component);
+}
+
+static bool snd_rpi_hifiberry_dacplusadc_is_pro_card(struct snd_soc_component *component)
+{
+	bool isClk44EN, isClk48En, isNoClk;
+
+	snd_rpi_hifiberry_dacplusadc_clk_gpio(component);
+
+	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
+	isClk44EN = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
+
+	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
+	isNoClk = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
+
+	snd_rpi_hifiberry_dacplusadc_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
+	isClk48En = snd_rpi_hifiberry_dacplusadc_is_sclk_sleep(component);
+
+	return (isClk44EN && isClk48En && !isNoClk);
+}
+
+static int snd_rpi_hifiberry_dacplusadc_clk_for_rate(int sample_rate)
+{
+	int type;
+
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+	case 352800:
+		type = HIFIBERRY_DACPRO_CLK44EN;
+		break;
+	default:
+		type = HIFIBERRY_DACPRO_CLK48EN;
+		break;
+	}
+	return type;
+}
+
+static void snd_rpi_hifiberry_dacplusadc_set_sclk(struct snd_soc_component *component,
+	int sample_rate)
+{
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+
+	if (!IS_ERR(pcm512x->sclk)) {
+		int ctype;
+
+		ctype = snd_rpi_hifiberry_dacplusadc_clk_for_rate(sample_rate);
+		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
+			? CLK_44EN_RATE : CLK_48EN_RATE);
+		snd_rpi_hifiberry_dacplusadc_select_clk(component, ctype);
+	}
+}
+
+static int snd_rpi_hifiberry_dacplusadc_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct pcm512x_priv *priv;
+
+	if (slave)
+		snd_rpi_hifiberry_is_dacpro = false;
+	else
+		snd_rpi_hifiberry_is_dacpro =
+				snd_rpi_hifiberry_dacplusadc_is_pro_card(component);
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "HiFiBerry ADCDAC+ Pro";
+		dai->stream_name = "HiFiBerry ADCDAC+ Pro HiFi";
+		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBM_CFM;
+
+		snd_soc_component_update_bits(component, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
+		snd_soc_component_update_bits(component, PCM512x_MASTER_MODE, 0x03, 0x03);
+		snd_soc_component_update_bits(component, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
+	} else {
+		priv = snd_soc_component_get_drvdata(component);
+		priv->sclk = ERR_PTR(-ENOENT);
+	}
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplusadc_update_rate_den(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+	struct snd_ratnum *rats_no_pll;
+	unsigned int num = 0, den = 0;
+	int err;
+
+	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
+	if (!rats_no_pll)
+		return -ENOMEM;
+
+	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
+	rats_no_pll->den_min = 1;
+	rats_no_pll->den_max = 128;
+	rats_no_pll->den_step = 1;
+
+	err = snd_interval_ratnum(hw_param_interval(params,
+		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
+	if (err >= 0 && den) {
+		params->rate_num = num;
+		params->rate_den = den;
+	}
+
+	devm_kfree(rtd->dev, rats_no_pll);
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplusadc_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	int channels = params_channels(params);
+	int width = 32;
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_component *component = rtd->codec_dai->component;
+
+		width = snd_pcm_format_physical_width(params_format(params));
+
+		snd_rpi_hifiberry_dacplusadc_set_sclk(component,
+			params_rate(params));
+
+		ret = snd_rpi_hifiberry_dacplusadc_update_rate_den(
+			substream, params);
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03,
+		channels, width);
+	return ret;
+}
+
+static int hifiberry_dacplusadc_LED_cnt;
+
+static int snd_rpi_hifiberry_dacplusadc_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1,
+					 0x08, 0x08);
+	hifiberry_dacplusadc_LED_cnt++;
+	return 0;
+}
+
+static void snd_rpi_hifiberry_dacplusadc_shutdown(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dai->component;
+
+	hifiberry_dacplusadc_LED_cnt--;
+	if (!hifiberry_dacplusadc_LED_cnt)
+		snd_soc_component_update_bits(component, PCM512x_GPIO_CONTROL_1,
+						 0x08, 0x00);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_hifiberry_dacplusadc_ops = {
+	.hw_params = snd_rpi_hifiberry_dacplusadc_hw_params,
+	.startup = snd_rpi_hifiberry_dacplusadc_startup,
+	.shutdown = snd_rpi_hifiberry_dacplusadc_shutdown,
+};
+
+static struct snd_soc_dai_link_component snd_rpi_hifiberry_dacplusadc_codecs[] = {
+	{
+		.name = "pcm512x.1-004d",
+		.dai_name = "pcm512x-hifi",
+	},
+	{
+		.name = "dmic-codec",
+		.dai_name = "dmic-hifi",
+	},
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_dacplusadc_dai[] = {
+{
+	.name		= "HiFiBerry DAC+ADC",
+	.stream_name	= "HiFiBerry DAC+ADC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.platform_name	= "bcm2708-i2s.0",
+	.codecs		= snd_rpi_hifiberry_dacplusadc_codecs,
+	.num_codecs	= 2,
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_hifiberry_dacplusadc_ops,
+	.init		= snd_rpi_hifiberry_dacplusadc_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_hifiberry_dacplusadc = {
+	.name         = "snd_rpi_hifiberry_dacplusadc",
+	.driver_name  = "HifiberryDacpAdc",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_dacplusadc_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplusadc_dai),
+};
+
+
+static int snd_rpi_hifiberry_dacplusadc_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_hifiberry_dacplusadc.dev = &pdev->dev;
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_rpi_hifiberry_dacplusadc_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+			"i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_of_node = i2s_node;
+			dai->platform_of_node = i2s_node;
+			dai->cpu_dai_name = NULL;
+			dai->platform_name = NULL;
+		}
+		dai = &snd_rpi_hifiberry_dacplusadc_dai[1];
+		i2s_node = of_parse_phandle(pdev->dev.of_node, "dmic", 0);
+		if (i2s_node) {
+			dai->cpu_of_node = i2s_node;
+			dai->platform_of_node = i2s_node;
+		}
+
+	}
+	digital_gain_0db_limit = !of_property_read_bool(
+		pdev->dev.of_node, "hifiberry,24db_digital_gain");
+	slave = of_property_read_bool(pdev->dev.of_node,
+					"hifiberry-dacplusadc,slave");
+
+	ret = devm_snd_soc_register_card(&pdev->dev,
+						 &snd_rpi_hifiberry_dacplusadc);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_rpi_hifiberry_dacplusadc_of_match[] = {
+	{ .compatible = "hifiberry,hifiberry-dacplusadc", },
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplusadc_of_match);
+
+static struct platform_driver snd_rpi_hifiberry_dacplusadc_driver = {
+	.driver = {
+		.name   = "snd-rpi-hifiberry-dacplusadc",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_dacplusadc_of_match,
+	},
+	.probe          = snd_rpi_hifiberry_dacplusadc_probe,
+};
+
+static int __init hifiberry_dacplusadc_init(void)
+{
+	int ret;
+
+	dmic_codec_dev = platform_device_register_simple("dmic-codec", -1, NULL,
+							 0);
+	if (IS_ERR(dmic_codec_dev)) {
+		pr_err("%s: dmic-codec device registration failed\n", __func__);
+		return PTR_ERR(dmic_codec_dev);
+	}
+
+	ret = platform_driver_register(&snd_rpi_hifiberry_dacplusadc_driver);
+	if (ret) {
+		pr_err("%s: platform driver registration failed\n", __func__);
+		platform_device_unregister(dmic_codec_dev);
+	}
+
+	return ret;
+}
+module_init(hifiberry_dacplusadc_init);
+
+static void __exit hifiberry_dacplusadc_exit(void)
+{
+	platform_driver_unregister(&snd_rpi_hifiberry_dacplusadc_driver);
+	platform_device_unregister(dmic_codec_dev);
+}
+module_exit(hifiberry_dacplusadc_exit);
+
+MODULE_AUTHOR("Joerg Schambacher <joscha@schambacher.com>");
+MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
+MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ADC");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From e60f6ba54a0cb6ee18eeb9f0ff2f239625934863 Mon Sep 17 00:00:00 2001
From: Fabrice Gasnier <fabrice.gasnier@st.com>
Date: Mon, 1 Oct 2018 15:23:56 +0200
Subject: [PATCH 0310/1835] Revert "pwm: Set class for exported channels in
 sysfs"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c289d6625237aa785b484b4e94c23b3b91ea7e60 upstream.

This reverts commit 7e5d1fd75c3dde9fc10c4472b9368089d1b81d00 ("pwm: Set
class for exported channels in sysfs") as it causes regression with
multiple pwm chip[1], when exporting a pwm channel (echo X > export):

- ABI (Documentation/ABI/testing/sysfs-class-pwm) states pwmX should be
  created in /sys/class/pwm/pwmchipN/pwmX
- Reverted patch causes new entry to be also created directly in
  /sys/class/pwm/pwmX
- 1st time, exporting pwmX will create an entry in /sys/class/pwm/pwmX
- class attributes are added under pwmX folder, such as export, unexport
  npwm, symlinks. This is wrong as it belongs to pwmchipN. It may cause
  bad behavior and report wrong values.
- when another export happens on another pwmchip, it can't be created
  (e.g. -EEXIST). This is causing the issue with multiple pwmchip.

Example on stm32 (stm32429i-eval) platform:
$ ls /sys/class/pwm
pwmchip0 pwmchip4

$ cd /sys/class/pwm/pwmchip0/
$ echo 0 > export
$ ls /sys/class/pwm
pwm0 pwmchip0 pwmchip4

$ cd /sys/class/pwm/pwmchip4/
$ echo 0 > export
sysfs: cannot create duplicate filename '/class/pwm/pwm0'
...Exception stack follows...

This is also seen on other platform [2]

[1] https://lkml.org/lkml/2018/9/25/713
[2] https://lkml.org/lkml/2018/9/25/447

Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Tested-by: Gottfried Haider <gottfried.haider@gmail.com>
Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
---
 drivers/pwm/sysfs.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index 7c71cdb8a9d8f..4726d43aaa0cb 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -263,7 +263,6 @@ static int pwm_export_child(struct device *parent, struct pwm_device *pwm)
 	export->pwm = pwm;
 	mutex_init(&export->lock);
 
-	export->child.class = parent->class;
 	export->child.release = pwm_export_release;
 	export->child.parent = parent;
 	export->child.devt = MKDEV(0, 0);
-- 
GitLab


From eafa122a48ddf892818a3666082afd716b1e5311 Mon Sep 17 00:00:00 2001
From: Fabrice Gasnier <fabrice.gasnier@st.com>
Date: Mon, 1 Oct 2018 15:23:57 +0200
Subject: [PATCH 0311/1835] pwm: Send a uevent on the pwmchip device upon
 channel sysfs (un)export
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 552c02e3e7cfe2744b59de285aaea70021ae95c9 upstream.

This patch sends a uevent (KOBJ_CHANGE) on the pwmchipN device,
everytime a pwmX channel has been exported/unexported via sysfs. This
allows udev to implement rules on such events, like:

SUBSYSTEM=="pwm*", PROGRAM="/bin/sh -c '\
        chown -R root:gpio /sys/class/pwm && chmod -R 770 /sys/class/pwm;\
        chown -R root:gpio
/sys/devices/platform/soc/*.pwm/pwm/pwmchip* && chmod -R 770
/sys/devices/platform/soc/*.pwm/pwm/pwmchip*\
'"

This is a replacement patch for commit 7e5d1fd75c3d ("pwm: Set class for
exported channels in sysfs"), see [1].

basic testing:
$ udevadm monitor --environment &
$ echo 0 > /sys/class/pwm/pwmchip0/export
KERNEL[197.321736] change   /devices/.../pwm/pwmchip0 (pwm)
ACTION=change
DEVPATH=/devices/.../pwm/pwmchip0
EXPORT=pwm0
SEQNUM=2045
SUBSYSTEM=pwm

[1] https://lkml.org/lkml/2018/9/25/713

Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Tested-by: Gottfried Haider <gottfried.haider@gmail.com>
Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
---
 drivers/pwm/sysfs.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index 4726d43aaa0cb..ceb233dd60484 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -249,6 +249,7 @@ static void pwm_export_release(struct device *child)
 static int pwm_export_child(struct device *parent, struct pwm_device *pwm)
 {
 	struct pwm_export *export;
+	char *pwm_prop[2];
 	int ret;
 
 	if (test_and_set_bit(PWMF_EXPORTED, &pwm->flags))
@@ -276,6 +277,10 @@ static int pwm_export_child(struct device *parent, struct pwm_device *pwm)
 		export = NULL;
 		return ret;
 	}
+	pwm_prop[0] = kasprintf(GFP_KERNEL, "EXPORT=pwm%u", pwm->hwpwm);
+	pwm_prop[1] = NULL;
+	kobject_uevent_env(&parent->kobj, KOBJ_CHANGE, pwm_prop);
+	kfree(pwm_prop[0]);
 
 	return 0;
 }
@@ -288,6 +293,7 @@ static int pwm_unexport_match(struct device *child, void *data)
 static int pwm_unexport_child(struct device *parent, struct pwm_device *pwm)
 {
 	struct device *child;
+	char *pwm_prop[2];
 
 	if (!test_and_clear_bit(PWMF_EXPORTED, &pwm->flags))
 		return -ENODEV;
@@ -296,6 +302,11 @@ static int pwm_unexport_child(struct device *parent, struct pwm_device *pwm)
 	if (!child)
 		return -ENODEV;
 
+	pwm_prop[0] = kasprintf(GFP_KERNEL, "UNEXPORT=pwm%u", pwm->hwpwm);
+	pwm_prop[1] = NULL;
+	kobject_uevent_env(&parent->kobj, KOBJ_CHANGE, pwm_prop);
+	kfree(pwm_prop[0]);
+
 	/* for device_find_child() */
 	put_device(child);
 	device_unregister(child);
-- 
GitLab


From 97b900a31693e6aeccc8b5c6bd1665ebed808eb5 Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Date: Wed, 19 Sep 2018 18:13:52 +0400
Subject: [PATCH 0312/1835] usb: dwc2: Disable all EP's on disconnect

commit dccf1bad4be7eaa096c1f3697bd37883f9a08ecb upstream.

Disabling all EP's allow to reset EP's to initial state.
On disconnect disable all EP's instead of just killing
all requests. Because of some platform didn't catch
disconnect event, same stuff added to
dwc2_hsotg_core_init_disconnected() function when USB
reset detected on the bus.

Changed from version 1:
Changed lock acquire flow in dwc2_hsotg_ep_disable()
function.

Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
---
 drivers/usb/dwc2/gadget.c | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 220c0f9b89b0b..79189db4bf175 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3109,6 +3109,8 @@ static void kill_all_requests(struct dwc2_hsotg *hsotg,
 		dwc2_hsotg_txfifo_flush(hsotg, ep->fifo_index);
 }
 
+static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
+
 /**
  * dwc2_hsotg_disconnect - disconnect service
  * @hsotg: The device state.
@@ -3127,13 +3129,12 @@ void dwc2_hsotg_disconnect(struct dwc2_hsotg *hsotg)
 	hsotg->connected = 0;
 	hsotg->test_mode = 0;
 
+	/* all endpoints should be shutdown */
 	for (ep = 0; ep < hsotg->num_of_eps; ep++) {
 		if (hsotg->eps_in[ep])
-			kill_all_requests(hsotg, hsotg->eps_in[ep],
-					  -ESHUTDOWN);
+			dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
 		if (hsotg->eps_out[ep])
-			kill_all_requests(hsotg, hsotg->eps_out[ep],
-					  -ESHUTDOWN);
+			dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
 	}
 
 	call_gadget(hsotg, disconnect);
@@ -3191,13 +3192,23 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
 	u32 val;
 	u32 usbcfg;
 	u32 dcfg = 0;
+	int ep;
 
 	/* Kill any ep0 requests as controller will be reinitialized */
 	kill_all_requests(hsotg, hsotg->eps_out[0], -ECONNRESET);
 
-	if (!is_usb_reset)
+	if (!is_usb_reset) {
 		if (dwc2_core_reset(hsotg, true))
 			return;
+	} else {
+		/* all endpoints should be shutdown */
+		for (ep = 1; ep < hsotg->num_of_eps; ep++) {
+			if (hsotg->eps_in[ep])
+				dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+			if (hsotg->eps_out[ep])
+				dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+		}
+	}
 
 	/*
 	 * we must now enable ep0 ready for host detection and then
@@ -3993,6 +4004,7 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	unsigned long flags;
 	u32 epctrl_reg;
 	u32 ctrl;
+	int locked;
 
 	dev_dbg(hsotg->dev, "%s(ep %p)\n", __func__, ep);
 
@@ -4008,7 +4020,9 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 
 	epctrl_reg = dir_in ? DIEPCTL(index) : DOEPCTL(index);
 
-	spin_lock_irqsave(&hsotg->lock, flags);
+	locked = spin_is_locked(&hsotg->lock);
+	if (!locked)
+		spin_lock_irqsave(&hsotg->lock, flags);
 
 	ctrl = dwc2_readl(hsotg, epctrl_reg);
 
@@ -4032,7 +4046,9 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	hs_ep->fifo_index = 0;
 	hs_ep->fifo_size = 0;
 
-	spin_unlock_irqrestore(&hsotg->lock, flags);
+	if (!locked)
+		spin_unlock_irqrestore(&hsotg->lock, flags);
+
 	return 0;
 }
 
-- 
GitLab


From a5cc06de045d7d4ab719df17536d6bf996a711d7 Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
Date: Mon, 10 Dec 2018 18:09:32 +0400
Subject: [PATCH 0313/1835] usb: dwc2: Fix disable all EP's on disconnect
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 4fe4f9fecc36956fd53c8edf96dd0c691ef98ff9 upstream.

Disabling all EP's allow to reset EP's to initial state.
Introduced new function dwc2_hsotg_ep_disable_lock() which
before calling dwc2_hsotg_ep_disable() function acquire
hsotg->lock and release on exiting.
From dwc2_hsotg_ep_disable() function removed acquiring
hsotg->lock.
In dwc2_hsotg_core_init_disconnected() function when USB
reset interrupt asserted disabling all ep’s by
dwc2_hsotg_ep_disable() function.
This updates eliminating sparse imbalance warnings.

Reverted changes in dwc2_hostg_disconnect() function.
Introduced new function dwc2_hsotg_ep_disable_lock().
Changed dwc2_hsotg_ep_ops. Now disable point to
dwc2_hsotg_ep_disable_lock() function.
In functions dwc2_hsotg_udc_stop() and dwc2_hsotg_suspend()
dwc2_hsotg_ep_disable() function replaced by
dwc2_hsotg_ep_disable_lock() function.
In dwc2_hsotg_ep_disable() function removed acquiring
of hsotg->lock.

Fixes: dccf1bad4be7 ("usb: dwc2: Disable all EP's on disconnect")
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
---
 drivers/usb/dwc2/gadget.c | 41 ++++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 79189db4bf175..138261efe744b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3109,8 +3109,6 @@ static void kill_all_requests(struct dwc2_hsotg *hsotg,
 		dwc2_hsotg_txfifo_flush(hsotg, ep->fifo_index);
 }
 
-static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
-
 /**
  * dwc2_hsotg_disconnect - disconnect service
  * @hsotg: The device state.
@@ -3132,9 +3130,11 @@ void dwc2_hsotg_disconnect(struct dwc2_hsotg *hsotg)
 	/* all endpoints should be shutdown */
 	for (ep = 0; ep < hsotg->num_of_eps; ep++) {
 		if (hsotg->eps_in[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+			kill_all_requests(hsotg, hsotg->eps_in[ep],
+					  -ESHUTDOWN);
 		if (hsotg->eps_out[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+			kill_all_requests(hsotg, hsotg->eps_out[ep],
+					  -ESHUTDOWN);
 	}
 
 	call_gadget(hsotg, disconnect);
@@ -3178,6 +3178,7 @@ static void dwc2_hsotg_irq_fifoempty(struct dwc2_hsotg *hsotg, bool periodic)
 			GINTSTS_PTXFEMP |  \
 			GINTSTS_RXFLVL)
 
+static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
 /**
  * dwc2_hsotg_core_init - issue softreset to the core
  * @hsotg: The device state
@@ -4001,10 +4002,8 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	struct dwc2_hsotg *hsotg = hs_ep->parent;
 	int dir_in = hs_ep->dir_in;
 	int index = hs_ep->index;
-	unsigned long flags;
 	u32 epctrl_reg;
 	u32 ctrl;
-	int locked;
 
 	dev_dbg(hsotg->dev, "%s(ep %p)\n", __func__, ep);
 
@@ -4020,10 +4019,6 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 
 	epctrl_reg = dir_in ? DIEPCTL(index) : DOEPCTL(index);
 
-	locked = spin_is_locked(&hsotg->lock);
-	if (!locked)
-		spin_lock_irqsave(&hsotg->lock, flags);
-
 	ctrl = dwc2_readl(hsotg, epctrl_reg);
 
 	if (ctrl & DXEPCTL_EPENA)
@@ -4046,12 +4041,22 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	hs_ep->fifo_index = 0;
 	hs_ep->fifo_size = 0;
 
-	if (!locked)
-		spin_unlock_irqrestore(&hsotg->lock, flags);
-
 	return 0;
 }
 
+static int dwc2_hsotg_ep_disable_lock(struct usb_ep *ep)
+{
+	struct dwc2_hsotg_ep *hs_ep = our_ep(ep);
+	struct dwc2_hsotg *hsotg = hs_ep->parent;
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&hsotg->lock, flags);
+	ret = dwc2_hsotg_ep_disable(ep);
+	spin_unlock_irqrestore(&hsotg->lock, flags);
+	return ret;
+}
+
 /**
  * on_list - check request is on the given endpoint
  * @ep: The endpoint to check.
@@ -4199,7 +4204,7 @@ static int dwc2_hsotg_ep_sethalt_lock(struct usb_ep *ep, int value)
 
 static const struct usb_ep_ops dwc2_hsotg_ep_ops = {
 	.enable		= dwc2_hsotg_ep_enable,
-	.disable	= dwc2_hsotg_ep_disable,
+	.disable	= dwc2_hsotg_ep_disable_lock,
 	.alloc_request	= dwc2_hsotg_ep_alloc_request,
 	.free_request	= dwc2_hsotg_ep_free_request,
 	.queue		= dwc2_hsotg_ep_queue_lock,
@@ -4339,9 +4344,9 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget)
 	/* all endpoints should be shutdown */
 	for (ep = 1; ep < hsotg->num_of_eps; ep++) {
 		if (hsotg->eps_in[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+			dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
 		if (hsotg->eps_out[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+			dwc2_hsotg_ep_disable_lock(&hsotg->eps_out[ep]->ep);
 	}
 
 	spin_lock_irqsave(&hsotg->lock, flags);
@@ -4789,9 +4794,9 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
 
 		for (ep = 0; ep < hsotg->num_of_eps; ep++) {
 			if (hsotg->eps_in[ep])
-				dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+				dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
 			if (hsotg->eps_out[ep])
-				dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+				dwc2_hsotg_ep_disable_lock(&hsotg->eps_out[ep]->ep);
 		}
 	}
 
-- 
GitLab


From c98abceacfa627d6cdfad98283298efae938b314 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 21 Jan 2019 21:17:27 +0000
Subject: [PATCH 0314/1835] overlays: Add ssd1306 overlay for OLED display

See: https://github.com/raspberrypi/firmware/issues/1098

Signed-off-by: mincepi <mincepi@gmail.com>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             | 31 ++++++++++++++++
 .../arm/boot/dts/overlays/ssd1306-overlay.dts | 36 +++++++++++++++++++
 3 files changed, 68 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/ssd1306-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 38046efd5fdd8..5c07ff08e1417 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -135,6 +135,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	spi2-1cs.dtbo \
 	spi2-2cs.dtbo \
 	spi2-3cs.dtbo \
+	ssd1306.dtbo \
 	superaudioboard.dtbo \
 	sx150x.dtbo \
 	tc358743.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index ed582bc373750..707ea49cb6b31 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1950,6 +1950,37 @@ Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
                                 is 'okay' or enabled).
 
 
+Name:   ssd1306
+Info:   Overlay for activation of SSD1306 over I2C OLED display framebuffer.
+Load:   dtoverlay=ssd1306,<param>=<val>
+Params: address                 Location in display memory of first character.
+                                (default=0)
+        width                   Width of display. (default=128)
+        height                  Height of display. (default=64)
+        offset                  virtual channel a. (default=0)
+        normal                  Has no effect on displays tested. (default=not
+                                set)
+        sequential              Set this if every other scan line is missing.
+                                (default=not set)
+        remapped                Set this if display is garbled. (default=not
+                                set)
+        inverted                Set this if display is inverted and mirrored.
+                                (default=not set)
+
+        Examples:
+        Typical usage for 128x64 display: dtoverlay=ssd1306,inverted
+
+        Typical usage for 128x32 display: dtoverlay=ssd1306,inverted,sequential
+
+        i2c_baudrate=400000 will speed up the display.
+
+        i2c_baudrate=1000000 seems to work even though it's not officially
+        supported by the hardware, and is faster still.
+
+        For more information refer to the device datasheet at:
+        https://cdn-shop.adafruit.com/datasheets/SSD1306.pdf
+
+
 Name:   superaudioboard
 Info:   Configures the SuperAudioBoard sound card
 Load:   dtoverlay=superaudioboard,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/ssd1306-overlay.dts b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
new file mode 100644
index 0000000000000..2cf677d59a7f9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
@@ -0,0 +1,36 @@
+// Overlay for SSD1306 128x64 and 128x32 OLED displays
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2718";
+
+    fragment@0 {
+	target = <&i2c1>;
+	__overlay__ {
+	    status = "okay";
+
+	    #address-cells = <1>;
+	    #size-cells = <0>;
+
+	    ssd1306: oled@3c{
+		compatible = "solomon,ssd1306fb-i2c";
+		reg = <0x3c>;
+		solomon,width = <128>;
+		solomon,height = <64>;
+		solomon,page-offset = <0>;
+	    };
+	};
+    };
+
+    __overrides__ {
+	address = <&ssd1306>,"reg:0";
+	width = <&ssd1306>,"solomon,width:0";
+	height = <&ssd1306>,"solomon,height:0";
+	offset = <&ssd1306>,"solomon,page-offset:0";
+	normal = <&ssd1306>,"solomon,segment-no-remap?";
+	sequential = <&ssd1306>,"solomon,com-seq?";
+	remapped = <&ssd1306>,"solomon,com-lrremap?";
+	inverted = <&ssd1306>,"solomon,com-invdir?";
+    };
+};
-- 
GitLab


From e1791c1406c3157deec2c82b2be895d804b53e64 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 21 Jan 2019 12:19:57 +0000
Subject: [PATCH 0315/1835] overlays: mcp23017: Support the MCP23008

Add an 'mcp23008' parameter to enable support for the MCP23008 device.

See: https://github.com/raspberrypi/linux/issues/2818

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README               |  2 ++
 arch/arm/boot/dts/overlays/mcp23017-overlay.dts | 10 +++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 707ea49cb6b31..6aa0059e3c6e0 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1212,6 +1212,8 @@ Params: gpiopin                 Gpio pin connected to the INTA output of the
 
         addr                    I2C address of the MCP23017 (default: 0x20)
 
+        mcp23008                Configure an MCP23008 instead.
+
 
 Name:   mcp23s17
 Info:   Configures the MCP23S08/17 SPI GPIO expanders.
diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
index 412f966a3cc0a..42f2d0f4ea668 100644
--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
@@ -44,11 +44,19 @@
 			};
 		};
 	};
-	
+
+	fragment@3 {
+		target = <&mcp23017>;
+		__dormant__ {
+			compatible = "microchip,mcp23008";
+		};
+	};
+
 	__overrides__ {
 		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
 				<&mcp23017>,"interrupts:0";
 		addr = <&mcp23017>,"reg:0";
+		mcp23008 = <0>,"=3";
 	};
 };
 
-- 
GitLab


From 8fb274fa6387086c60b51f092cdb8e27f45b4c9f Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 21 Jan 2019 12:23:55 +0000
Subject: [PATCH 0316/1835] overlays: Add mcp342x overlay

Support the MCP342x family of ADCs from Microchip.

See: https://github.com/raspberrypi/linux/issues/2819

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             | 16 ++++
 .../arm/boot/dts/overlays/mcp342x-overlay.dts | 93 +++++++++++++++++++
 3 files changed, 110 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/mcp342x-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 5c07ff08e1417..3acbd74f7d371 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -79,6 +79,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	mcp2515-can1.dtbo \
 	mcp3008.dtbo \
 	mcp3202.dtbo \
+	mcp342x.dtbo \
 	media-center.dtbo \
 	midi-uart0.dtbo \
 	midi-uart1.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 6aa0059e3c6e0..107c033ac2c27 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1277,6 +1277,22 @@ Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
         spi<n>-<m>-speed        integer, set the spi bus speed for this device
 
 
+Name:   mcp342x
+Info:   Overlay for activation of Microchip MCP3421-3428 ADCs over I2C
+Load:   dtoverlay=mcp342x,<param>=<val>
+Params: addr                    I2C bus address of device, for devices with
+                                addresses that are configurable, e.g. by
+                                hardware links (default=0x68)
+        mcp3421                 The device is an MCP3421
+        mcp3422                 The device is an MCP3422
+        mcp3423                 The device is an MCP3423
+        mcp3424                 The device is an MCP3424
+        mcp3425                 The device is an MCP3425
+        mcp3426                 The device is an MCP3426
+        mcp3427                 The device is an MCP3427
+        mcp3428                 The device is an MCP3428
+
+
 Name:   media-center
 Info:   Media Center HAT - 2.83" Touch Display + extras by Pi Supply
 Load:   dtoverlay=media-center,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/mcp342x-overlay.dts b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
new file mode 100644
index 0000000000000..6ddd292d689a6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
@@ -0,0 +1,93 @@
+// Overlay for MCP3421-8 ADCs from Microchip Semiconductor
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			mcp342x: mcp@68 {
+				reg = <0x68>;
+
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3421";
+		};
+	};
+
+	fragment@2 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3422";
+		};
+	};
+
+	fragment@3 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3423";
+		};
+	};
+
+	fragment@4 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3424";
+		};
+	};
+
+	fragment@5 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3425";
+		};
+	};
+
+	fragment@6 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3426";
+		};
+	};
+
+	fragment@7 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3427";
+		};
+	};
+
+	fragment@8 {
+		target = <&mcp342x>;
+		__dormant__ {
+			compatible = "microchip,mcp3428";
+		};
+	};
+
+	__overrides__ {
+		addr = <&mcp342x>,"reg:0";
+		mcp3421 = <0>,"=1";
+		mcp3422 = <0>,"=2";
+		mcp3423 = <0>,"=3";
+		mcp3424 = <0>,"=4";
+		mcp3425 = <0>,"=5";
+		mcp3426 = <0>,"=6";
+		mcp3427 = <0>,"=7";
+		mcp3428 = <0>,"=8";
+	};
+};
+
-- 
GitLab


From 78d31d94f1421c8e62d4a0420878fc3e147d4c71 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 24 Jan 2019 13:56:30 +0000
Subject: [PATCH 0317/1835] char: vcio: Add compat ioctl handling

There was no compat ioctl handler, so 32 bit userspace on a
64 bit kernel failed as IOCTL_MBOX_PROPERTY used the size
of char*.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/char/broadcom/vcio.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/drivers/char/broadcom/vcio.c b/drivers/char/broadcom/vcio.c
index c19bc2075c778..72b133e274e06 100644
--- a/drivers/char/broadcom/vcio.c
+++ b/drivers/char/broadcom/vcio.c
@@ -24,6 +24,9 @@
 
 #define VCIO_IOC_MAGIC 100
 #define IOCTL_MBOX_PROPERTY _IOWR(VCIO_IOC_MAGIC, 0, char *)
+#ifdef CONFIG_COMPAT
+#define IOCTL_MBOX_PROPERTY32 _IOWR(VCIO_IOC_MAGIC, 0, compat_uptr_t)
+#endif
 
 static struct {
 	dev_t devt;
@@ -87,13 +90,30 @@ static long vcio_device_ioctl(struct file *file, unsigned int ioctl_num,
 	case IOCTL_MBOX_PROPERTY:
 		return vcio_user_property_list((void *)ioctl_param);
 	default:
-		pr_err("unknown ioctl: %d\n", ioctl_num);
+		pr_err("unknown ioctl: %x\n", ioctl_num);
 		return -EINVAL;
 	}
 }
 
+#ifdef CONFIG_COMPAT
+static long vcio_device_compat_ioctl(struct file *file, unsigned int ioctl_num,
+				     unsigned long ioctl_param)
+{
+	switch (ioctl_num) {
+	case IOCTL_MBOX_PROPERTY32:
+		return vcio_user_property_list(compat_ptr(ioctl_param));
+	default:
+		pr_err("unknown ioctl: %x\n", ioctl_num);
+		return -EINVAL;
+	}
+}
+#endif
+
 const struct file_operations vcio_fops = {
 	.unlocked_ioctl = vcio_device_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = vcio_device_compat_ioctl,
+#endif
 	.open = vcio_device_open,
 	.release = vcio_device_release,
 };
-- 
GitLab


From aed987bd066a205309759e4f85a2cee4c93958bc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 24 Jan 2019 14:03:28 +0000
Subject: [PATCH 0318/1835] char: vcio: Fail probe if rpi_firmware is not
 found.

Device Tree is now the only supported config mechanism, therefore
uncomment the block of code that fails the probe if the
firmware node can't be found.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/char/broadcom/vcio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/char/broadcom/vcio.c b/drivers/char/broadcom/vcio.c
index 72b133e274e06..d2598663a2b5d 100644
--- a/drivers/char/broadcom/vcio.c
+++ b/drivers/char/broadcom/vcio.c
@@ -126,10 +126,9 @@ static int __init vcio_init(void)
 
 	np = of_find_compatible_node(NULL, NULL,
 				     "raspberrypi,bcm2835-firmware");
-/* Uncomment this when we only boot with Device Tree
 	if (!of_device_is_available(np))
 		return -ENODEV;
-*/
+
 	vcio.fw = rpi_firmware_get(np);
 	if (!vcio.fw)
 		return -ENODEV;
-- 
GitLab


From c1cafdc9f75a372027a84a913c6b786d52628665 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 22 Jan 2019 12:04:09 +0000
Subject: [PATCH 0319/1835] staging: mmal-vchiq: Fix client_component for 64
 bit kernel

The MMAL client_component field is used with the event
mechanism to allow the client to identify the component for
which the event is generated.
The field is only 32bits in size, therefore we can't use a
pointer to the component in a 64 bit kernel.

Component handles are already held in an array per VCHI
instance, so use the array index as the client_component handle
to avoid having to create a new IDR for this purpose.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vchiq-mmal/mmal-vchiq.c    | 12 +++++++++---
 .../staging/vc04_services/vchiq-mmal/mmal-vchiq.h    |  1 +
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index dd644e44b71c6..062b80dcce0df 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -472,9 +472,9 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 static void event_to_host_cb(struct vchiq_mmal_instance *instance,
 			     struct mmal_msg *msg, u32 msg_len)
 {
-	/* FIXME: Not going to work on 64 bit */
+	int comp_idx = msg->u.event_to_host.client_component;
 	struct vchiq_mmal_component *component =
-		(struct vchiq_mmal_component *)msg->u.event_to_host.client_component;
+					&instance->component[comp_idx];
 	struct vchiq_mmal_port *port = NULL;
 	struct mmal_msg_context *msg_context;
 	u32 port_num = msg->u.event_to_host.port_num;
@@ -1073,7 +1073,7 @@ static int create_component(struct vchiq_mmal_instance *instance,
 
 	/* build component create message */
 	m.h.type = MMAL_MSG_TYPE_COMPONENT_CREATE;
-	m.u.component_create.client_component = (u32)(unsigned long)component;
+	m.u.component_create.client_component = component->client_component;
 	strncpy(m.u.component_create.name, name,
 		sizeof(m.u.component_create.name));
 
@@ -1868,6 +1868,12 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 		goto unlock;
 	}
 
+	/* We need a handle to reference back to our component structure.
+	 * Use the array index in instance->component rather than rolling
+	 * another IDR.
+	 */
+	component->client_component = idx;
+
 	ret = create_component(instance, component, name);
 	if (ret < 0) {
 		pr_err("%s: failed to create component %d (Not enough GPU mem?)\n",
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index 13d37c5add8d1..be2efbccc2002 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -97,6 +97,7 @@ struct vchiq_mmal_component {
 	struct vchiq_mmal_port input[MAX_PORT_COUNT]; /* input ports */
 	struct vchiq_mmal_port output[MAX_PORT_COUNT]; /* output ports */
 	struct vchiq_mmal_port clock[MAX_PORT_COUNT]; /* clock ports */
+	u32 client_component;	/* Used to ref back to client struct */
 };
 
 int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance);
-- 
GitLab


From 87bd42a8795c1023a64cd7d3ea4965aebfe43209 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 15 Jan 2019 15:35:24 +0000
Subject: [PATCH 0320/1835] staging: bcm2835-camera: Add sanity checks for
 queue_setup/CREATE_BUFS

Fixes a v4l2-compliance failure when passed a buffer that is
too small.
queue_setup wasn't handling the case where !(*nplanes), as
used from CREATE_BUFS and requiring the driver to sanity
check the provided buffer parameters. It was assuming that
it was always being used in the REQBUFS case where it provides
the buffer properties.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-camera/bcm2835-camera.c              | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index b8984dcfbfa7a..dbdc4e84f3b12 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -242,6 +242,22 @@ static int queue_setup(struct vb2_queue *vq,
 		return -EINVAL;
 	}
 
+	/* Handle CREATE_BUFS situation - *nplanes != 0 */
+	if (*nplanes) {
+		if (*nplanes != 1 ||
+		    sizes[0] < dev->capture.port->current_buffer.size) {
+			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+				 "%s: dev:%p Invalid buffer request from CREATE_BUFS, size %u < %u, nplanes %u != 1\n",
+				 __func__, dev, sizes[0],
+				 dev->capture.port->current_buffer.size,
+				 *nplanes);
+			return -EINVAL;
+		} else {
+			return 0;
+		}
+	}
+
+	/* Handle REQBUFS situation */
 	size = dev->capture.port->current_buffer.size;
 	if (size == 0) {
 		v4l2_err(&dev->v4l2_dev,
-- 
GitLab


From ab76bf505b3a924eb3391e88ee431addc130506d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 15 Jan 2019 16:32:33 +0000
Subject: [PATCH 0321/1835] staging: bcm2835-camera: Set the field value within
 each buffer

Fixes a v4l2-compliance failure
v4l2-test-buffers.cpp(415): g_field() == V4L2_FIELD_ANY

The driver only ever produces progresive frames, so field should
always be set to V4L2_FIELD_NONE.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index dbdc4e84f3b12..a8f3ce5afb51f 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -443,6 +443,7 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 	}
 	dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
 	buf->vb.sequence = dev->capture.sequence++;
+	buf->vb.field = V4L2_FIELD_NONE;
 
 	vb2_set_plane_payload(&buf->vb.vb2_buf, 0, mmal_buf->length);
 	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
-- 
GitLab


From e0aa6c559fc0833785e62f2a4b66e638867ce176 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 23 Jan 2019 18:25:50 +0000
Subject: [PATCH 0322/1835] char: vc_mem: Fix up compat ioctls for 64bit kernel

compat_ioctl wasn't defined, so 32bit user/64bit kernel
always failed.
VC_MEM_IOC_MEM_PHYS_ADDR was defined with parameter size
unsigned long, so the ioctl cmd changes between sizes.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/char/broadcom/vc_mem.c  | 40 +++++++++++++++++++++++++++++----
 include/linux/broadcom/vc_mem.h |  4 ++++
 2 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/drivers/char/broadcom/vc_mem.c b/drivers/char/broadcom/vc_mem.c
index d063c106de2f9..ddedbafdf3364 100644
--- a/drivers/char/broadcom/vc_mem.c
+++ b/drivers/char/broadcom/vc_mem.c
@@ -148,7 +148,7 @@ vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	(void) cmd;
 	(void) arg;
 
-	pr_debug("%s: called file = 0x%p\n", __func__, file);
+	pr_debug("%s: called file = 0x%p, cmd %08x\n", __func__, file, cmd);
 
 	switch (cmd) {
 	case VC_MEM_IOC_MEM_PHYS_ADDR:
@@ -167,7 +167,7 @@ vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			// Get the videocore memory size first
 			vc_mem_get_size();
 
-			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%u\n", __func__,
+			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%x\n", __func__,
 				mm_vc_mem_size);
 
 			if (copy_to_user((void *) arg, &mm_vc_mem_size,
@@ -181,7 +181,7 @@ vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			// Get the videocore memory base
 			vc_mem_get_base();
 
-			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%u\n", __func__,
+			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%x\n", __func__,
 				mm_vc_mem_base);
 
 			if (copy_to_user((void *) arg, &mm_vc_mem_base,
@@ -195,7 +195,7 @@ vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			// Get the videocore memory base
 			vc_mem_get_base();
 
-			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%u\n", __func__,
+			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%x\n", __func__,
 				mm_vc_mem_base);
 
 			if (copy_to_user((void *) arg, &mm_vc_mem_base,
@@ -214,6 +214,35 @@ vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	return rc;
 }
 
+#ifdef CONFIG_COMPAT
+static long
+vc_mem_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	int rc = 0;
+
+	switch (cmd) {
+	case VC_MEM_IOC_MEM_PHYS_ADDR32:
+		pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR32=0x%p\n",
+			 __func__, (void *)mm_vc_mem_phys_addr);
+
+		/* This isn't correct, but will cover us for now as
+		 * VideoCore is 32bit only.
+		 */
+		if (copy_to_user((void *)arg, &mm_vc_mem_phys_addr,
+				 sizeof(compat_ulong_t)))
+			rc = -EFAULT;
+
+		break;
+
+	default:
+		rc = vc_mem_ioctl(file, cmd, arg);
+		break;
+	}
+
+	return rc;
+}
+#endif
+
 /****************************************************************************
 *
 *   vc_mem_mmap
@@ -259,6 +288,9 @@ static const struct file_operations vc_mem_fops = {
 	.open = vc_mem_open,
 	.release = vc_mem_release,
 	.unlocked_ioctl = vc_mem_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = vc_mem_compat_ioctl,
+#endif
 	.mmap = vc_mem_mmap,
 };
 
diff --git a/include/linux/broadcom/vc_mem.h b/include/linux/broadcom/vc_mem.h
index 20a475377eb30..c43477ca40ad7 100644
--- a/include/linux/broadcom/vc_mem.h
+++ b/include/linux/broadcom/vc_mem.h
@@ -32,4 +32,8 @@ extern unsigned int  mm_vc_mem_size;
 extern int vc_mem_get_current_size( void );
 #endif
 
+#ifdef CONFIG_COMPAT
+#define VC_MEM_IOC_MEM_PHYS_ADDR32  _IOR(VC_MEM_IOC_MAGIC, 0, compat_ulong_t)
+#endif
+
 #endif  /* _VC_MEM_H */
-- 
GitLab


From f9a2eff49ba07dc9bd57a8f12211e69b895ea054 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 23 Jan 2019 18:37:29 +0000
Subject: [PATCH 0323/1835] char: vc_mem: Fix all coding style issues.

Cleans up all checkpatch errors in vc_mem.c and vc_mem.h
No functional change to the code.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/char/broadcom/vc_mem.c  | 177 +++++++++++---------------------
 include/linux/broadcom/vc_mem.h |  38 +++----
 2 files changed, 77 insertions(+), 138 deletions(-)

diff --git a/drivers/char/broadcom/vc_mem.c b/drivers/char/broadcom/vc_mem.c
index ddedbafdf3364..230692e84a58c 100644
--- a/drivers/char/broadcom/vc_mem.c
+++ b/drivers/char/broadcom/vc_mem.c
@@ -1,16 +1,16 @@
-/*****************************************************************************
-* Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
-*
-* Unless you and Broadcom execute a separate written software license
-* agreement governing use of this software, this software is licensed to you
-* under the terms of the GNU General Public License version 2, available at
-* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
-*
-* Notwithstanding the above, under no circumstances may you combine this
-* software in any way with any other Broadcom software provided under a
-* license other than the GPL, without Broadcom's express prior written
-* consent.
-*****************************************************************************/
+/*
+ * Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ */
 
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -26,11 +26,11 @@
 
 #define DRIVER_NAME  "vc-mem"
 
-// Device (/dev) related variables
-static dev_t vc_mem_devnum = 0;
-static struct class *vc_mem_class = NULL;
+/* Device (/dev) related variables */
+static dev_t vc_mem_devnum;
+static struct class *vc_mem_class;
 static struct cdev vc_mem_cdev;
-static int vc_mem_inited = 0;
+static int vc_mem_inited;
 
 #ifdef CONFIG_DEBUG_FS
 static struct dentry *vc_mem_debugfs_entry;
@@ -50,96 +50,55 @@ static struct dentry *vc_mem_debugfs_entry;
  * bootloader (and/or kernel). When that happens, the values of these variables
  * would be calculated and assigned in the init function.
  */
-// in the 2835 VC in mapped above ARM, but ARM has full access to VC space
-unsigned long mm_vc_mem_phys_addr = 0x00000000;
-unsigned int mm_vc_mem_size = 0;
-unsigned int mm_vc_mem_base = 0;
-
+/* In the 2835 VC in mapped above ARM, but ARM has full access to VC space */
+unsigned long mm_vc_mem_phys_addr;
 EXPORT_SYMBOL(mm_vc_mem_phys_addr);
+unsigned int mm_vc_mem_size;
 EXPORT_SYMBOL(mm_vc_mem_size);
+unsigned int mm_vc_mem_base;
 EXPORT_SYMBOL(mm_vc_mem_base);
 
-static uint phys_addr = 0;
-static uint mem_size = 0;
-static uint mem_base = 0;
-
-
-/****************************************************************************
-*
-*   vc_mem_open
-*
-***************************************************************************/
+static uint phys_addr;
+static uint mem_size;
+static uint mem_base;
 
 static int
 vc_mem_open(struct inode *inode, struct file *file)
 {
-	(void) inode;
-	(void) file;
+	(void)inode;
 
 	pr_debug("%s: called file = 0x%p\n", __func__, file);
 
 	return 0;
 }
 
-/****************************************************************************
-*
-*   vc_mem_release
-*
-***************************************************************************/
-
 static int
 vc_mem_release(struct inode *inode, struct file *file)
 {
-	(void) inode;
-	(void) file;
+	(void)inode;
 
 	pr_debug("%s: called file = 0x%p\n", __func__, file);
 
 	return 0;
 }
 
-/****************************************************************************
-*
-*   vc_mem_get_size
-*
-***************************************************************************/
-
 static void
 vc_mem_get_size(void)
 {
 }
 
-/****************************************************************************
-*
-*   vc_mem_get_base
-*
-***************************************************************************/
-
 static void
 vc_mem_get_base(void)
 {
 }
 
-/****************************************************************************
-*
-*   vc_mem_get_current_size
-*
-***************************************************************************/
-
 int
 vc_mem_get_current_size(void)
 {
 	return mm_vc_mem_size;
 }
-
 EXPORT_SYMBOL_GPL(vc_mem_get_current_size);
 
-/****************************************************************************
-*
-*   vc_mem_ioctl
-*
-***************************************************************************/
-
 static long
 vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
@@ -154,52 +113,52 @@ vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case VC_MEM_IOC_MEM_PHYS_ADDR:
 		{
 			pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR=0x%p\n",
-				__func__, (void *) mm_vc_mem_phys_addr);
+				__func__, (void *)mm_vc_mem_phys_addr);
 
-			if (copy_to_user((void *) arg, &mm_vc_mem_phys_addr,
-					 sizeof (mm_vc_mem_phys_addr)) != 0) {
+			if (copy_to_user((void *)arg, &mm_vc_mem_phys_addr,
+					 sizeof(mm_vc_mem_phys_addr))) {
 				rc = -EFAULT;
 			}
 			break;
 		}
 	case VC_MEM_IOC_MEM_SIZE:
 		{
-			// Get the videocore memory size first
+			/* Get the videocore memory size first */
 			vc_mem_get_size();
 
 			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%x\n", __func__,
-				mm_vc_mem_size);
+				 mm_vc_mem_size);
 
-			if (copy_to_user((void *) arg, &mm_vc_mem_size,
-					 sizeof (mm_vc_mem_size)) != 0) {
+			if (copy_to_user((void *)arg, &mm_vc_mem_size,
+					 sizeof(mm_vc_mem_size))) {
 				rc = -EFAULT;
 			}
 			break;
 		}
 	case VC_MEM_IOC_MEM_BASE:
 		{
-			// Get the videocore memory base
+			/* Get the videocore memory base */
 			vc_mem_get_base();
 
 			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%x\n", __func__,
-				mm_vc_mem_base);
+				 mm_vc_mem_base);
 
-			if (copy_to_user((void *) arg, &mm_vc_mem_base,
-					 sizeof (mm_vc_mem_base)) != 0) {
+			if (copy_to_user((void *)arg, &mm_vc_mem_base,
+					 sizeof(mm_vc_mem_base))) {
 				rc = -EFAULT;
 			}
 			break;
 		}
 	case VC_MEM_IOC_MEM_LOAD:
 		{
-			// Get the videocore memory base
+			/* Get the videocore memory base */
 			vc_mem_get_base();
 
 			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%x\n", __func__,
 				mm_vc_mem_base);
 
-			if (copy_to_user((void *) arg, &mm_vc_mem_base,
-					 sizeof (mm_vc_mem_base)) != 0) {
+			if (copy_to_user((void *)arg, &mm_vc_mem_base,
+					 sizeof(mm_vc_mem_base))) {
 				rc = -EFAULT;
 			}
 			break;
@@ -243,12 +202,6 @@ vc_mem_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 }
 #endif
 
-/****************************************************************************
-*
-*   vc_mem_mmap
-*
-***************************************************************************/
-
 static int
 vc_mem_mmap(struct file *filp, struct vm_area_struct *vma)
 {
@@ -257,32 +210,26 @@ vc_mem_mmap(struct file *filp, struct vm_area_struct *vma)
 	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
 
 	pr_debug("%s: vm_start = 0x%08lx vm_end = 0x%08lx vm_pgoff = 0x%08lx\n",
-		__func__, (long) vma->vm_start, (long) vma->vm_end,
-		(long) vma->vm_pgoff);
+		 __func__, (long)vma->vm_start, (long)vma->vm_end,
+		 (long)vma->vm_pgoff);
 
 	if (offset + length > mm_vc_mem_size) {
 		pr_err("%s: length %ld is too big\n", __func__, length);
 		return -EINVAL;
 	}
-	// Do not cache the memory map
+	/* Do not cache the memory map */
 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 
 	rc = remap_pfn_range(vma, vma->vm_start,
 			     (mm_vc_mem_phys_addr >> PAGE_SHIFT) +
 			     vma->vm_pgoff, length, vma->vm_page_prot);
-	if (rc != 0) {
+	if (rc)
 		pr_err("%s: remap_pfn_range failed (rc=%d)\n", __func__, rc);
-	}
 
 	return rc;
 }
 
-/****************************************************************************
-*
-*   File Operations for the driver.
-*
-***************************************************************************/
-
+/* File Operations for the driver. */
 static const struct file_operations vc_mem_fops = {
 	.owner = THIS_MODULE,
 	.open = vc_mem_open,
@@ -316,7 +263,7 @@ static int vc_mem_debugfs_init(
 				vc_mem_debugfs_entry,
 				(u32 *)&mm_vc_mem_phys_addr)) {
 		dev_warn(dev, "%s:could not create vc_mem_phys entry\n",
-			__func__);
+			 __func__);
 		goto fail;
 	}
 
@@ -325,7 +272,7 @@ static int vc_mem_debugfs_init(
 				vc_mem_debugfs_entry,
 				(u32 *)&mm_vc_mem_size)) {
 		dev_warn(dev, "%s:could not create vc_mem_size entry\n",
-			__func__);
+			 __func__);
 		goto fail;
 	}
 
@@ -347,12 +294,7 @@ fail:
 
 #endif /* CONFIG_DEBUG_FS */
 
-
-/****************************************************************************
-*
-*   vc_mem_init
-*
-***************************************************************************/
+/* Module load/unload functions */
 
 static int __init
 vc_mem_init(void)
@@ -369,16 +311,19 @@ vc_mem_init(void)
 	vc_mem_get_size();
 
 	pr_info("vc-mem: phys_addr:0x%08lx mem_base=0x%08x mem_size:0x%08x(%u MiB)\n",
-		mm_vc_mem_phys_addr, mm_vc_mem_base, mm_vc_mem_size, mm_vc_mem_size / (1024 * 1024));
+		mm_vc_mem_phys_addr, mm_vc_mem_base, mm_vc_mem_size,
+		mm_vc_mem_size / (1024 * 1024));
 
-	if ((rc = alloc_chrdev_region(&vc_mem_devnum, 0, 1, DRIVER_NAME)) < 0) {
+	rc = alloc_chrdev_region(&vc_mem_devnum, 0, 1, DRIVER_NAME);
+	if (rc < 0) {
 		pr_err("%s: alloc_chrdev_region failed (rc=%d)\n",
 		       __func__, rc);
 		goto out_err;
 	}
 
 	cdev_init(&vc_mem_cdev, &vc_mem_fops);
-	if ((rc = cdev_add(&vc_mem_cdev, vc_mem_devnum, 1)) != 0) {
+	rc = cdev_add(&vc_mem_cdev, vc_mem_devnum, 1);
+	if (rc) {
 		pr_err("%s: cdev_add failed (rc=%d)\n", __func__, rc);
 		goto out_unregister;
 	}
@@ -408,26 +353,20 @@ vc_mem_init(void)
 
 	device_destroy(vc_mem_class, vc_mem_devnum);
 
-      out_class_destroy:
+out_class_destroy:
 	class_destroy(vc_mem_class);
 	vc_mem_class = NULL;
 
-      out_cdev_del:
+out_cdev_del:
 	cdev_del(&vc_mem_cdev);
 
-      out_unregister:
+out_unregister:
 	unregister_chrdev_region(vc_mem_devnum, 1);
 
-      out_err:
+out_err:
 	return -1;
 }
 
-/****************************************************************************
-*
-*   vc_mem_exit
-*
-***************************************************************************/
-
 static void __exit
 vc_mem_exit(void)
 {
diff --git a/include/linux/broadcom/vc_mem.h b/include/linux/broadcom/vc_mem.h
index c43477ca40ad7..3c70792374964 100644
--- a/include/linux/broadcom/vc_mem.h
+++ b/include/linux/broadcom/vc_mem.h
@@ -1,16 +1,16 @@
-/*****************************************************************************
-* Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
-*
-* Unless you and Broadcom execute a separate written software license
-* agreement governing use of this software, this software is licensed to you
-* under the terms of the GNU General Public License version 2, available at
-* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
-*
-* Notwithstanding the above, under no circumstances may you combine this
-* software in any way with any other Broadcom software provided under a
-* license other than the GPL, without Broadcom's express prior written
-* consent.
-*****************************************************************************/
+/*
+ * Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ */
 
 #ifndef _VC_MEM_H
 #define _VC_MEM_H
@@ -19,17 +19,17 @@
 
 #define VC_MEM_IOC_MAGIC  'v'
 
-#define VC_MEM_IOC_MEM_PHYS_ADDR    _IOR( VC_MEM_IOC_MAGIC, 0, unsigned long )
-#define VC_MEM_IOC_MEM_SIZE         _IOR( VC_MEM_IOC_MAGIC, 1, unsigned int )
-#define VC_MEM_IOC_MEM_BASE         _IOR( VC_MEM_IOC_MAGIC, 2, unsigned int )
-#define VC_MEM_IOC_MEM_LOAD         _IOR( VC_MEM_IOC_MAGIC, 3, unsigned int )
+#define VC_MEM_IOC_MEM_PHYS_ADDR    _IOR(VC_MEM_IOC_MAGIC, 0, unsigned long)
+#define VC_MEM_IOC_MEM_SIZE         _IOR(VC_MEM_IOC_MAGIC, 1, unsigned int)
+#define VC_MEM_IOC_MEM_BASE         _IOR(VC_MEM_IOC_MAGIC, 2, unsigned int)
+#define VC_MEM_IOC_MEM_LOAD         _IOR(VC_MEM_IOC_MAGIC, 3, unsigned int)
 
-#if defined( __KERNEL__ )
+#ifdef __KERNEL__
 #define VC_MEM_TO_ARM_ADDR_MASK 0x3FFFFFFF
 
 extern unsigned long mm_vc_mem_phys_addr;
 extern unsigned int  mm_vc_mem_size;
-extern int vc_mem_get_current_size( void );
+extern int vc_mem_get_current_size(void);
 #endif
 
 #ifdef CONFIG_COMPAT
-- 
GitLab


From bd03b167073641d21abd73ea2702fe9a6e3c6efc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 24 Jan 2019 15:09:28 +0000
Subject: [PATCH 0324/1835] clk: clk-bcm2835: Use %zd when printing size_t

The debug text for how many clocks have been registered
uses "%d" with a size_t. Correct it to "%zd".

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/clk/bcm/clk-bcm2835.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index a142253afdffe..3e001a7467a00 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -2271,7 +2271,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 		return ret;
 
 	/* note that we have registered all the clocks */
-	dev_dbg(dev, "registered %d clocks\n", asize);
+	dev_dbg(dev, "registered %zd clocks\n", asize);
 
 	return 0;
 }
-- 
GitLab


From f916f07f8409736b31db3b7d767f40436313d02a Mon Sep 17 00:00:00 2001
From: Serge Schneider <serge@raspberrypi.org>
Date: Tue, 29 Jan 2019 12:05:49 +0000
Subject: [PATCH 0325/1835] mfd: Add rpi_sense_core of compatible string

---
 drivers/mfd/rpisense-core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/mfd/rpisense-core.c b/drivers/mfd/rpisense-core.c
index eea9312dc96a4..6cfd63e5e8b8d 100644
--- a/drivers/mfd/rpisense-core.c
+++ b/drivers/mfd/rpisense-core.c
@@ -138,6 +138,14 @@ static const struct i2c_device_id rpisense_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, rpisense_i2c_id);
 
+#ifdef CONFIG_OF
+static const struct of_device_id rpisense_core_id[] = {
+	{ .compatible = "rpi,rpi-sense" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, rpisense_core_id);
+#endif
+
 
 static struct i2c_driver rpisense_driver = {
 	.driver = {
-- 
GitLab


From 02cc495281c268b17f5ae2d566220c88991de911 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 28 Jan 2019 14:40:16 +0000
Subject: [PATCH 0326/1835] gpu: vc4_firmware_kms: Fix up 64 bit compile
 warnings.

Resolve two build warnings with regard using incorrectly
sized parameters in logging messages on 64 bit builds.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 4f73f0650d66a..e760b569c54d6 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -160,14 +160,14 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 		WARN_ON_ONCE(vc4_plane->pitch != fb->pitches[0]);
 	}
 
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary update %dx%d@%d +%d,%d 0x%08x/%d\n",
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary update %dx%d@%d +%d,%d 0x%pad/%d\n",
 			 plane->base.id, plane->name,
 			 state->crtc_w,
 			 state->crtc_h,
 			 bpp,
 			 state->crtc_x,
 			 state->crtc_y,
-			 bo->paddr + fb->offsets[0],
+			 &fbinfo->base,
 			 fb->pitches[0]);
 
 	ret = rpi_firmware_transaction(vc4->firmware,
@@ -197,6 +197,7 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 	struct drm_plane_state *state = plane->state;
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
+	dma_addr_t addr = bo->paddr + fb->offsets[0];
 	int ret;
 	u32 packet_state[] = {
 		state->crtc->state->active,
@@ -206,13 +207,13 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 	};
 	WARN_ON_ONCE(fb->pitches[0] != state->crtc_w * 4);
 
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] update %dx%d cursor at %d,%d (0x%08x/%d)",
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] update %dx%d cursor at %d,%d (0x%pad/%d)",
 			 plane->base.id, plane->name,
 			 state->crtc_w,
 			 state->crtc_h,
 			 state->crtc_x,
 			 state->crtc_y,
-			 bo->paddr + fb->offsets[0],
+			 &addr,
 			 fb->pitches[0]);
 
 	/* add on the top/left offsets when overscan is active */
@@ -238,7 +239,7 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 	    fb != old_state->fb) {
 		u32 packet_info[] = { state->crtc_w, state->crtc_h,
 				      0, /* unused */
-				      bo->paddr + fb->offsets[0],
+				      addr,
 				      0, 0, /* hotx, hoty */};
 
 		ret = rpi_firmware_property(vc4->firmware,
-- 
GitLab


From a4209a0350fcac7f99a2dff7d3ee090277c56195 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 28 Jan 2019 14:42:34 +0000
Subject: [PATCH 0327/1835] input: rpi-ft5406: Clear build warning on 64 bit
 builds.

Resolve 64 bit build warning over using %x with a dma_addr_t.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/input/touchscreen/rpi-ft5406.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/rpi-ft5406.c b/drivers/input/touchscreen/rpi-ft5406.c
index 40bbde9ce1bc4..4115b46662116 100644
--- a/drivers/input/touchscreen/rpi-ft5406.c
+++ b/drivers/input/touchscreen/rpi-ft5406.c
@@ -218,8 +218,8 @@ static int ft5406_probe(struct platform_device *pdev)
 
 	if (!ts->ts_base) {
 		dev_warn(dev,
-		"set failed, trying get (err:%d touchbuf:%x virt:%p bus:%x)\n",
-		err, touchbuf, ts->ts_base, ts->bus_addr);
+		"set failed, trying get (err:%d touchbuf:%x virt:%p bus:%pad)\n",
+		err, touchbuf, ts->ts_base, &ts->bus_addr);
 
 		err = rpi_firmware_property(
 				fw,
-- 
GitLab


From cf2c6accdded904a4283e4c35b368200c232ca41 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 18 Sep 2018 10:47:38 +0100
Subject: [PATCH 0328/1835] dtoverlays: Correct DT handling camera GPIOs

The firmware has support for updating overrides with the correct
GPIO settings for the camera GPIOs, but the wrong device tree
setup ended up being merged.
Correct the DT configuration so that the firmware does set it
up correctly.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/bcm270x.dtsi                |  7 +++++++
 arch/arm/boot/dts/overlays/README             | 10 +---------
 arch/arm/boot/dts/overlays/ov5647-overlay.dts | 14 +++++++++++---
 3 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index 27f19225245e9..55a03c0d5e1c5 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -152,6 +152,13 @@
 		regulator-max-microvolt = <3300000>;
 		regulator-always-on;
 	};
+
+	__overrides__ {
+		cam0-pwdn-ctrl;
+		cam0-pwdn;
+		cam0-led-ctrl;
+		cam0-led;
+	};
 };
 
 &vc4 {
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 107c033ac2c27..d91917ec8d761 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1366,15 +1366,7 @@ Info:   Omnivision OV5647 camera module.
         Uses Unicam 1, which is the standard camera connector on most Pi
         variants.
 Load:   dtoverlay=ov5647,<param>=<val>
-Params: cam0-pwdn               GPIO used to control the sensor powerdown line.
-
-        cam0-led                GPIO used to control the sensor led
-                                Both these fields should be automatically filled
-                                in by the firmware to reflect the default GPIO
-                                configuration of the particular Pi variant in
-                                use.
-
-        i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
+Params: i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
                                 Useful on Compute Modules.
 
         i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
index 88fde695ade45..0b7f4f99ba2a4 100644
--- a/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
@@ -14,7 +14,7 @@
 			status = "okay";
 
 			ov5647: ov5647@36 {
-				compatible = "ov5647";
+				compatible = "ovti,ov5647";
 				reg = <0x36>;
 				status = "okay";
 
@@ -82,10 +82,18 @@
 		};
 	};
 
+	fragment@6 {
+		target-path="/__overrides__";
+		__overlay__ {
+			cam0-pwdn-ctrl = <&ov5647>,"pwdn-gpios:0";
+			cam0-pwdn      = <&ov5647>,"pwdn-gpios:4";
+			cam0-led-ctrl  = <&ov5647>,"pwdn-gpios:12";
+			cam0-led       = <&ov5647>,"pwdn-gpios:16";
+		};
+	};
+
 	__overrides__ {
 		i2c_pins_0_1 = <0>,"-2-3+4";
 		i2c_pins_28_29 = <0>,"+2-3-4";
-		cam0-pwdn = <&ov5647>,"pwdn-gpios:4";
-		cam0-led = <&ov5647>,"pwdn-gpios:16";
 	};
 };
-- 
GitLab


From 89bb36f3124451d499ce8b33350d2dfcd38b4359 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 18 Sep 2018 11:08:51 +0100
Subject: [PATCH 0329/1835] media: ov5647: Use gpiod_set_value_cansleep

All calls to the gpio library are in contexts that can sleep,
therefore there is no issue with having those GPIOs controlled
by controllers which require sleeping (eg I2C GPIO expanders).

Switch to using gpiod_set_value_cansleep instead of gpiod_set_value
to avoid triggering the warning in gpiolib should the GPIO
controller need to sleep.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/i2c/ov5647.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index 93e2670066690..bb5f73805ab46 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -373,7 +373,7 @@ static int ov5647_sensor_power(struct v4l2_subdev *sd, int on)
 		dev_dbg(&client->dev, "OV5647 power on\n");
 
 		if (ov5647->pwdn) {
-			gpiod_set_value(ov5647->pwdn, 0);
+			gpiod_set_value_cansleep(ov5647->pwdn, 0);
 			msleep(PWDN_ACTIVE_DELAY_MS);
 		}
 
@@ -415,7 +415,7 @@ static int ov5647_sensor_power(struct v4l2_subdev *sd, int on)
 
 		clk_disable_unprepare(ov5647->xclk);
 
-		gpiod_set_value(ov5647->pwdn, 1);
+		gpiod_set_value_cansleep(ov5647->pwdn, 1);
 	}
 
 	/* Update the power count. */
@@ -649,13 +649,13 @@ static int ov5647_probe(struct i2c_client *client,
 		goto mutex_remove;
 
 	if (sensor->pwdn) {
-		gpiod_set_value(sensor->pwdn, 0);
+		gpiod_set_value_cansleep(sensor->pwdn, 0);
 		msleep(PWDN_ACTIVE_DELAY_MS);
 	}
 
 	ret = ov5647_detect(sd);
 
-	gpiod_set_value(sensor->pwdn, 1);
+	gpiod_set_value_cansleep(sensor->pwdn, 1);
 
 	if (ret < 0)
 		goto error;
-- 
GitLab


From c1a4bba66b198640df5d1bf0a1821385969b34ff Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 29 Jan 2019 15:56:10 +0000
Subject: [PATCH 0330/1835] media:bcm2835-unicam: Power on subdev on
 open/release, not streaming

The driver was powering on the source subdevice as part of STREAMON,
and powering it off in STREAMOFF. This isn't so great if there is a
significant amount of setup required for your device.

Copy the approach taken in the Atmel ISC driver where s_power(1) is called
on first file handle open, and s_power(0) is called on the last release.

See https://www.raspberrypi.org/forums/viewtopic.php?f=43&t=232437

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../media/platform/bcm2835/bcm2835-unicam.c   | 68 +++++++++++++++----
 1 file changed, 54 insertions(+), 14 deletions(-)

diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
index 545e729c7f0fe..176c2d3d7ee78 100644
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -1237,11 +1237,6 @@ static int unicam_start_streaming(struct vb2_queue *vq, unsigned int count)
 		unicam_err(dev, "Failed to enable CSI clock: %d\n", ret);
 		goto err_pm_put;
 	}
-	ret = v4l2_subdev_call(dev->sensor, core, s_power, 1);
-	if (ret < 0 && ret != -ENOIOCTLCMD) {
-		unicam_err(dev, "power on failed in subdev\n");
-		goto err_clock_unprepare;
-	}
 	dev->streaming = 1;
 
 	unicam_start_rx(dev, addr);
@@ -1256,8 +1251,6 @@ static int unicam_start_streaming(struct vb2_queue *vq, unsigned int count)
 
 err_disable_unicam:
 	unicam_disable(dev);
-	v4l2_subdev_call(dev->sensor, core, s_power, 0);
-err_clock_unprepare:
 	clk_disable_unprepare(dev->clock);
 err_pm_put:
 	unicam_runtime_put(dev);
@@ -1306,11 +1299,6 @@ static void unicam_stop_streaming(struct vb2_queue *vq)
 	dev->next_frm = NULL;
 	spin_unlock_irqrestore(&dev->dma_queue_lock, flags);
 
-	if (v4l2_subdev_has_op(dev->sensor, core, s_power)) {
-		if (v4l2_subdev_call(dev->sensor, core, s_power, 0) < 0)
-			unicam_err(dev, "power off failed in subdev\n");
-	}
-
 	clk_disable_unprepare(dev->clock);
 	unicam_runtime_put(dev);
 }
@@ -1543,11 +1531,63 @@ static const struct vb2_ops unicam_video_qops = {
 	.stop_streaming		= unicam_stop_streaming,
 };
 
+/*
+ * unicam_open : This function is based on the v4l2_fh_open helper function.
+ * It has been augmented to handle sensor subdevice power management,
+ */
+static int unicam_open(struct file *file)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	int ret;
+
+	mutex_lock(&dev->lock);
+
+	ret = v4l2_fh_open(file);
+	if (ret) {
+		unicam_err(dev, "v4l2_fh_open failed\n");
+		goto unlock;
+	}
+
+	if (!v4l2_fh_is_singular_file(file))
+		goto unlock;
+
+	ret = v4l2_subdev_call(dev->sensor, core, s_power, 1);
+	if (ret < 0 && ret != -ENOIOCTLCMD) {
+		v4l2_fh_release(file);
+		goto unlock;
+	}
+
+unlock:
+	mutex_unlock(&dev->lock);
+	return ret;
+}
+
+static int unicam_release(struct file *file)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	struct v4l2_subdev *sd = dev->sensor;
+	bool fh_singular;
+	int ret;
+
+	mutex_lock(&dev->lock);
+
+	fh_singular = v4l2_fh_is_singular_file(file);
+
+	ret = _vb2_fop_release(file, NULL);
+
+	if (fh_singular)
+		v4l2_subdev_call(sd, core, s_power, 0);
+
+	mutex_unlock(&dev->lock);
+
+	return ret;
+}
+
 /* unicam capture driver file operations */
 static const struct v4l2_file_operations unicam_fops = {
 	.owner		= THIS_MODULE,
-	.open           = v4l2_fh_open,
-	.release        = vb2_fop_release,
+	.open           = unicam_open,
+	.release        = unicam_release,
 	.read		= vb2_fop_read,
 	.poll		= vb2_fop_poll,
 	.unlocked_ioctl	= video_ioctl2,
-- 
GitLab


From ce42bc578cd46ebd7bab5f2aa695563fd1803702 Mon Sep 17 00:00:00 2001
From: Matt Flax <flatmax@flatmax.org>
Date: Tue, 29 Jan 2019 14:56:03 +1100
Subject: [PATCH 0331/1835] audioinjector-octo: revert to dummy supplies

The Audio Injector Octo has had a lot of reports of not coming up on power cycles. By reverting to dummy supplies, the card comes up reliably.
---
 arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
index 60b2e94f2c9a6..cedbf5ecdbcd0 100644
--- a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
@@ -25,10 +25,6 @@
 				reg = <0x48>;
 				clocks = <&cs42448_mclk>;
 				clock-names = "mclk";
-				VA-supply = <&vdd_5v0_reg>;
-				VD-supply = <&vdd_3v3_reg>;
-				VLS-supply = <&vdd_3v3_reg>;
-				VLC-supply = <&vdd_3v3_reg>;
 				status = "okay";
 			};
 
-- 
GitLab


From a4961e053875eb19c9c9d4a88d58ea763027a991 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 24 Jan 2019 16:20:38 +0000
Subject: [PATCH 0332/1835] staging: bcm2835-camera: Correct ctrl
 min/max/step/def to 64bit

The V4L2 control API was expanded to take 64 bit values in commit
0ba2aeb6dab (Apr 16 2014), but as this driver wasn't in the mainline
kernel at that point this was overlooked.

Update to use 64 bit values. This also fixes a couple of warnings
in 64 bit builds.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-camera/controls.c        | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index e7c3c68e40f60..465e6d20b6b50 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -78,10 +78,10 @@ struct bm2835_mmal_v4l2_ctrl {
 	/* control minimum value or
 	 * mask for MMAL_CONTROL_TYPE_STD_MENU
 	 */
-	s32 min;
-	s32 max; /* maximum value of control */
-	s32 def;  /* default value of control */
-	s32 step; /* step size of the control */
+	s64 min;
+	s64 max; /* maximum value of control */
+	s64 def;  /* default value of control */
+	u64 step; /* step size of the control */
 	const s64 *imenu; /* integer menu array */
 	u32 mmal_id; /* mmal parameter id */
 	bm2835_mmal_v4l2_ctrl_cb *setter;
@@ -1244,7 +1244,7 @@ int bm2835_mmal_init_controls(struct bm2835_mmal_dev *dev,
 
 		case MMAL_CONTROL_TYPE_STD_MENU:
 		{
-			int mask = ctrl->min;
+			u64 mask = ctrl->min;
 
 			if (ctrl->id == V4L2_CID_SCENE_MODE) {
 				/* Special handling to work out the mask
@@ -1254,11 +1254,11 @@ int bm2835_mmal_init_controls(struct bm2835_mmal_dev *dev,
 				 */
 				int i;
 
-				mask = 1 << V4L2_SCENE_MODE_NONE;
+				mask = BIT(V4L2_SCENE_MODE_NONE);
 				for (i = 0;
 				     i < ARRAY_SIZE(scene_configs);
 				     i++) {
-					mask |= 1 << scene_configs[i].v4l2_scene;
+					mask |= BIT(scene_configs[i].v4l2_scene);
 				}
 				mask = ~mask;
 			}
-- 
GitLab


From 946e34d4f6bf18b525c3d4f2059dafbfe7e55e9a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 24 Jan 2019 16:40:01 +0000
Subject: [PATCH 0333/1835] staging: bcm2835-codec: variable vb2 may be used
 uninitialised

In op_buffer_cb, the failure path checked whether there was
an associated vb2 buffer before the variable vb2 had been
assigned.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 4e4e4fb69ade1..4ef16379f2161 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -634,6 +634,9 @@ static void op_buffer_cb(struct vchiq_mmal_instance *instance,
 		 __func__, status, mmal_buf, mmal_buf->length,
 		 mmal_buf->mmal_flags, mmal_buf->pts);
 
+	buf = container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
+	vb2 = &buf->m2m.vb;
+
 	if (status) {
 		/* error in transfer */
 		if (vb2) {
@@ -658,9 +661,6 @@ static void op_buffer_cb(struct vchiq_mmal_instance *instance,
 		return;
 	}
 
-	buf = container_of(mmal_buf, struct m2m_mmal_buffer, mmal);
-	vb2 = &buf->m2m.vb;
-
 	v4l2_dbg(3, debug, &ctx->dev->v4l2_dev, "%s: length %lu, flags %x, idx %u\n",
 		 __func__, mmal_buf->length, mmal_buf->mmal_flags,
 		 vb2->vb2_buf.index);
-- 
GitLab


From fdc50378d547ba153d7179322c9f65aca759c88f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 24 Jan 2019 16:36:19 +0000
Subject: [PATCH 0334/1835] staging: bcm2835-codec: Fix potentially
 uninitialised vars

src_m2m_buf and dst_m2m_buf were printed in log messages
when there are code paths that don't initialise them.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 4ef16379f2161..c26760faae2d6 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -743,7 +743,7 @@ static void device_run(void *priv)
 	struct bcm2835_codec_ctx *ctx = priv;
 	struct bcm2835_codec_dev *dev = ctx->dev;
 	struct vb2_v4l2_buffer *src_buf, *dst_buf;
-	struct m2m_mmal_buffer *src_m2m_buf, *dst_m2m_buf;
+	struct m2m_mmal_buffer *src_m2m_buf = NULL, *dst_m2m_buf = NULL;
 	struct v4l2_m2m_buffer *m2m;
 	int ret;
 
-- 
GitLab


From 51d79a357f8062b6fab696fb3a2bbdb497ec07f7 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 25 Jan 2019 17:12:54 +0000
Subject: [PATCH 0335/1835] video: bcm2708_fb: Add compat_ioctl support.

When using a 64 bit kernel with 32 bit userspace we need
compat ioctl handling for FBIODMACOPY as one of the
parameters is a pointer.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/video/fbdev/bcm2708_fb.c | 87 ++++++++++++++++++++++++--------
 1 file changed, 66 insertions(+), 21 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 6c9ee9ca8ee2d..929c75afd6295 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -482,9 +482,8 @@ static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
 /* cache coherent but non-allocating in L1 and L2 */
 #define INTALIAS_L1L2_NONALLOCATING(x) (((x)&~0xc0000000)|0x80000000)
 
-static long vc_mem_copy(struct bcm2708_fb *fb, unsigned long arg)
+static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
 {
-	struct fb_dmacopy ioparam;
 	size_t size = PAGE_SIZE;
 	u32 *buf = NULL;
 	dma_addr_t bus_addr;
@@ -497,26 +496,16 @@ static long vc_mem_copy(struct bcm2708_fb *fb, unsigned long arg)
 		goto out;
 	}
 
-	/* Get the parameter data.
-	 */
-	if (copy_from_user
-	    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
-		pr_err("[%s]: failed to copy-from-user\n",
-				__func__);
-		rc = -EFAULT;
-		goto out;
-	}
-
-	if (fb->gpu.base == 0 || fb->gpu.length == 0) {
+	if (!fb->gpu.base || !fb->gpu.length) {
 		pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
 			__func__, fb->gpu.base, fb->gpu.length);
 		return -EFAULT;
 	}
 
-	if (INTALIAS_NORMAL(ioparam.src) < fb->gpu.base ||
-		INTALIAS_NORMAL(ioparam.src) >= fb->gpu.base + fb->gpu.length) {
+	if (INTALIAS_NORMAL(ioparam->src) < fb->gpu.base ||
+	    INTALIAS_NORMAL(ioparam->src) >= fb->gpu.base + fb->gpu.length) {
 		pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
-			INTALIAS_NORMAL(ioparam.src), fb->gpu.base,
+			INTALIAS_NORMAL(ioparam->src), fb->gpu.base,
 			fb->gpu.base + fb->gpu.length);
 		return -EFAULT;
 	}
@@ -530,11 +519,11 @@ static long vc_mem_copy(struct bcm2708_fb *fb, unsigned long arg)
 		goto out;
 	}
 
-	for (offset = 0; offset < ioparam.length; offset += size) {
-		size_t remaining = ioparam.length - offset;
+	for (offset = 0; offset < ioparam->length; offset += size) {
+		size_t remaining = ioparam->length - offset;
 		size_t s = min(size, remaining);
-		unsigned char *p = (unsigned char *)ioparam.src + offset;
-		unsigned char *q = (unsigned char *)ioparam.dst + offset;
+		u8 *p = (u8 *)((uintptr_t)ioparam->src + offset);
+		u8 *q = (u8 *)ioparam->dst + offset;
 
 		dma_memcpy(fb, bus_addr,
 			   INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
@@ -566,8 +555,19 @@ static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
 					    &dummy, sizeof(dummy));
 		break;
 	case FBIODMACOPY:
-		ret = vc_mem_copy(fb, arg);
+	{
+		struct fb_dmacopy ioparam;
+		/* Get the parameter data.
+		 */
+		if (copy_from_user
+		    (&ioparam, (void *)arg, sizeof(ioparam))) {
+			pr_err("[%s]: failed to copy-from-user\n", __func__);
+			ret = -EFAULT;
+			break;
+		}
+		ret = vc_mem_copy(fb, &ioparam);
 		break;
+	}
 	default:
 		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
 		return -ENOTTY;
@@ -578,6 +578,48 @@ static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
 
 	return ret;
 }
+
+#ifdef CONFIG_COMPAT
+struct fb_dmacopy32 {
+	compat_uptr_t dst;
+	__u32 src;
+	__u32 length;
+};
+
+#define FBIODMACOPY32		_IOW('z', 0x22, struct fb_dmacopy32)
+
+static int bcm2708_compat_ioctl(struct fb_info *info, unsigned int cmd,
+				unsigned long arg)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	int ret;
+
+	switch (cmd) {
+	case FBIODMACOPY32:
+	{
+		struct fb_dmacopy32 param32;
+		struct fb_dmacopy param;
+		/* Get the parameter data.
+		 */
+		if (copy_from_user(&param32, (void *)arg, sizeof(param32))) {
+			pr_err("[%s]: failed to copy-from-user\n", __func__);
+			ret = -EFAULT;
+			break;
+		}
+		param.dst = compat_ptr(param32.dst);
+		param.src = param32.src;
+		param.length = param32.length;
+		ret = vc_mem_copy(fb, &param);
+		break;
+	}
+	default:
+		ret = bcm2708_ioctl(info, cmd, arg);
+		break;
+	}
+	return ret;
+}
+#endif
+
 static void bcm2708_fb_fillrect(struct fb_info *info,
 				const struct fb_fillrect *rect)
 {
@@ -768,6 +810,9 @@ static struct fb_ops bcm2708_fb_ops = {
 	.fb_imageblit = bcm2708_fb_imageblit,
 	.fb_pan_display = bcm2708_fb_pan_display,
 	.fb_ioctl = bcm2708_ioctl,
+#ifdef CONFIG_COMPAT
+	.fb_compat_ioctl = bcm2708_compat_ioctl,
+#endif
 };
 
 static int bcm2708_fb_register(struct bcm2708_fb *fb)
-- 
GitLab


From 9dd9c536c3c9f6a33728a5e68023f235e1975400 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 25 Jan 2019 17:11:39 +0000
Subject: [PATCH 0336/1835] video: bcm2708_fb: Fix warnings on 64 bit builds

Fix up logging lines where the wrong format specifiers were
being used.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/video/fbdev/bcm2708_fb.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 929c75afd6295..d6585a0815233 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -513,8 +513,8 @@ static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
 	buf = dma_alloc_coherent(fb->fb.device, PAGE_ALIGN(size), &bus_addr,
 				 GFP_ATOMIC);
 	if (!buf) {
-		pr_err("[%s]: failed to dma_alloc_coherent(%d)\n",
-				__func__, size);
+		pr_err("[%s]: failed to dma_alloc_coherent(%zd)\n", __func__,
+		       size);
 		rc = -ENOMEM;
 		goto out;
 	}
@@ -910,8 +910,7 @@ static int bcm2708_fb_probe(struct platform_device *dev)
 		goto free_fb;
 	}
 
-	pr_info("BCM2708FB: allocated DMA memory %08x\n",
-	       fb->cb_handle);
+	pr_info("BCM2708FB: allocated DMA memory %pad\n", &fb->cb_handle);
 
 	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
 				 &fb->dma_chan_base, &fb->dma_irq);
@@ -929,8 +928,7 @@ static int bcm2708_fb_probe(struct platform_device *dev)
 	}
 
 
-	pr_info("BCM2708FB: allocated DMA channel %d @ %p\n",
-	       fb->dma_chan, fb->dma_chan_base);
+	pr_info("BCM2708FB: allocated DMA channel %d\n", fb->dma_chan);
 
 	fb->dev = dev;
 	fb->fb.device = &dev->dev;
-- 
GitLab


From efefa527c9912fe879c8461fed75299f18841e3c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 25 Jan 2019 17:32:54 +0000
Subject: [PATCH 0337/1835] video: bcm2708_fb: Clean up coding style issues

Now checkpatch clean except for 2 long lines, missing
SPDX header, and no DT documentation.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/video/fbdev/bcm2708_fb.c | 96 ++++++++++++++------------------
 1 file changed, 42 insertions(+), 54 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index d6585a0815233..209a1504a1608 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -41,7 +41,7 @@
 #define MODULE_NAME "bcm2708_fb"
 
 #ifdef BCM2708_FB_DEBUG
-#define print_debug(fmt, ...) pr_debug("%s:%s:%d: "fmt, \
+#define print_debug(fmt, ...) pr_debug("%s:%s:%d: " fmt, \
 			MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
 #else
 #define print_debug(fmt, ...)
@@ -57,7 +57,7 @@ static int fbheight = 480;	/* module parameter */
 static int fbdepth = 32;	/* module parameter */
 static int fbswap;		/* module parameter */
 
-static u32 dma_busy_wait_threshold = 1<<15;
+static u32 dma_busy_wait_threshold = 1 << 15;
 module_param(dma_busy_wait_threshold, int, 0644);
 MODULE_PARM_DESC(dma_busy_wait_threshold, "Busy-wait for DMA completion below this area");
 
@@ -132,8 +132,8 @@ static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
 	fb->stats.regset.nregs = ARRAY_SIZE(stats_registers);
 	fb->stats.regset.base = &fb->stats;
 
-	if (!debugfs_create_regset32(
-		"stats", 0444, fb->debugfs_dir, &fb->stats.regset)) {
+	if (!debugfs_create_regset32("stats", 0444, fb->debugfs_dir,
+				     &fb->stats.regset)) {
 		pr_warn("%s: could not create statistics registers\n",
 			__func__);
 		goto fail;
@@ -223,25 +223,22 @@ static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
 {
 	/* info input, var output */
 	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n",
-		__func__,
-		info,
-		info->var.xres, info->var.yres, info->var.xres_virtual,
-		info->var.yres_virtual, (int)info->screen_size,
-		info->var.bits_per_pixel);
-	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var,
-		var->xres, var->yres, var->xres_virtual, var->yres_virtual,
-		var->bits_per_pixel);
+		    __func__, info, info->var.xres, info->var.yres,
+		    info->var.xres_virtual, info->var.yres_virtual,
+		    (int)info->screen_size, info->var.bits_per_pixel);
+	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var, var->xres,
+		    var->yres, var->xres_virtual, var->yres_virtual,
+		    var->bits_per_pixel);
 
 	if (!var->bits_per_pixel)
 		var->bits_per_pixel = 16;
 
 	if (bcm2708_fb_set_bitfields(var) != 0) {
 		pr_err("%s: invalid bits_per_pixel %d\n", __func__,
-		     var->bits_per_pixel);
+		       var->bits_per_pixel);
 		return -EINVAL;
 	}
 
-
 	if (var->xres_virtual < var->xres)
 		var->xres_virtual = var->xres;
 	/* use highest possible virtual resolution */
@@ -249,7 +246,7 @@ static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
 		var->yres_virtual = 480;
 
 		pr_err("%s: virtual resolution set to maximum of %dx%d\n",
-		     __func__, var->xres_virtual, var->yres_virtual);
+		       __func__, var->xres_virtual, var->yres_virtual);
 	}
 	if (var->yres_virtual < var->yres)
 		var->yres_virtual = var->yres;
@@ -294,9 +291,9 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 	int ret;
 
 	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
-		info->var.xres, info->var.yres, info->var.xres_virtual,
-		info->var.yres_virtual, (int)info->screen_size,
-		info->var.bits_per_pixel);
+		    info->var.xres, info->var.yres, info->var.xres_virtual,
+		    info->var.yres_virtual, (int)info->screen_size,
+		    info->var.bits_per_pixel);
 
 	ret = rpi_firmware_property_list(fb->fw, &fbinfo, sizeof(fbinfo));
 	if (ret) {
@@ -328,12 +325,10 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 		return -ENOMEM;
 	}
 
-	print_debug(
-	  "%s: start = %p,%p width=%d, height=%d, bpp=%d, pitch=%d size=%d\n",
-	  __func__,
-	  (void *)fb->fb.screen_base, (void *)fb->fb_bus_address,
-	  fbinfo.xres, fbinfo.yres, fbinfo.bpp,
-	  fbinfo.pitch, (int)fb->fb.screen_size);
+	print_debug("%s: start = %p,%p width=%d, height=%d, bpp=%d, pitch=%d size=%d\n",
+		    __func__, (void *)fb->fb.screen_base,
+		    (void *)fb->fb_bus_address, fbinfo.xres, fbinfo.yres,
+		    fbinfo.bpp, fbinfo.pitch, (int)fb->fb.screen_size);
 
 	return 0;
 }
@@ -345,7 +340,6 @@ static inline u32 convert_bitfield(int val, struct fb_bitfield *bf)
 	return (val >> (16 - bf->length) & mask) << bf->offset;
 }
 
-
 static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
 				unsigned int green, unsigned int blue,
 				unsigned int transp, struct fb_info *info)
@@ -379,11 +373,11 @@ static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
 			packet->offset = 0;
 			packet->length = regno + 1;
 			memcpy(packet->cmap, fb->gpu_cmap,
-				sizeof(packet->cmap));
+			       sizeof(packet->cmap));
 			ret = rpi_firmware_property(fb->fw,
-					RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
-					packet,
-					(2 + packet->length) * sizeof(u32));
+						    RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
+						    packet,
+						    (2 + packet->length) * sizeof(u32));
 			if (ret || packet->offset)
 				dev_err(info->device,
 					"Failed to set palette (%d,%u)\n",
@@ -392,9 +386,9 @@ static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
 		}
 	} else if (regno < 16) {
 		fb->cmap[regno] = convert_bitfield(transp, &fb->fb.var.transp) |
-		convert_bitfield(blue, &fb->fb.var.blue) |
-		convert_bitfield(green, &fb->fb.var.green) |
-		convert_bitfield(red, &fb->fb.var.red);
+				  convert_bitfield(blue, &fb->fb.var.blue) |
+				  convert_bitfield(green, &fb->fb.var.green) |
+				  convert_bitfield(red, &fb->fb.var.red);
 	}
 	return regno > 255;
 }
@@ -437,8 +431,8 @@ static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
 	info->var.yoffset = var->yoffset;
 	result = bcm2708_fb_set_par(info);
 	if (result != 0)
-		pr_err("%s(%d,%d) returns=%d\n", __func__,
-			var->xoffset, var->yoffset, result);
+		pr_err("%s(%d,%d) returns=%d\n", __func__, var->xoffset,
+		       var->yoffset, result);
 	return result;
 }
 
@@ -468,9 +462,8 @@ static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
 		cb->info |= BCM2708_DMA_INT_EN;
 		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
 		while (bcm_dma_is_busy(dma_chan)) {
-			wait_event_interruptible(
-				fb->dma_waitq,
-				!bcm_dma_is_busy(dma_chan));
+			wait_event_interruptible(fb->dma_waitq,
+						 !bcm_dma_is_busy(dma_chan));
 		}
 		fb->stats.dma_irqs++;
 	}
@@ -478,9 +471,9 @@ static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
 }
 
 /* address with no aliases */
-#define INTALIAS_NORMAL(x) ((x)&~0xc0000000)
+#define INTALIAS_NORMAL(x) ((x) & ~0xc0000000)
 /* cache coherent but non-allocating in L1 and L2 */
-#define INTALIAS_L1L2_NONALLOCATING(x) (((x)&~0xc0000000)|0x80000000)
+#define INTALIAS_L1L2_NONALLOCATING(x) (((x) & ~0xc0000000) | 0x80000000)
 
 static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
 {
@@ -498,15 +491,15 @@ static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
 
 	if (!fb->gpu.base || !fb->gpu.length) {
 		pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
-			__func__, fb->gpu.base, fb->gpu.length);
+		       __func__, fb->gpu.base, fb->gpu.length);
 		return -EFAULT;
 	}
 
 	if (INTALIAS_NORMAL(ioparam->src) < fb->gpu.base ||
 	    INTALIAS_NORMAL(ioparam->src) >= fb->gpu.base + fb->gpu.length) {
 		pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
-			INTALIAS_NORMAL(ioparam->src), fb->gpu.base,
-			fb->gpu.base + fb->gpu.length);
+		       INTALIAS_NORMAL(ioparam->src), fb->gpu.base,
+		       fb->gpu.base + fb->gpu.length);
 		return -EFAULT;
 	}
 
@@ -528,8 +521,7 @@ static long vc_mem_copy(struct bcm2708_fb *fb, struct fb_dmacopy *ioparam)
 		dma_memcpy(fb, bus_addr,
 			   INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
 		if (copy_to_user(q, buf, s) != 0) {
-			pr_err("[%s]: failed to copy-to-user\n",
-					__func__);
+			pr_err("[%s]: failed to copy-to-user\n", __func__);
 			rc = -EFAULT;
 			goto out;
 		}
@@ -755,7 +747,6 @@ static void bcm2708_fb_copyarea(struct fb_info *info,
 	/* end of dma control blocks chain */
 	cb->next = 0;
 
-
 	if (pixels < dma_busy_wait_threshold) {
 		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
 		bcm_dma_wait_idle(fb->dma_chan_base);
@@ -765,9 +756,8 @@ static void bcm2708_fb_copyarea(struct fb_info *info,
 		cb->info |= BCM2708_DMA_INT_EN;
 		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
 		while (bcm_dma_is_busy(dma_chan)) {
-			wait_event_interruptible(
-				fb->dma_waitq,
-				!bcm_dma_is_busy(dma_chan));
+			wait_event_interruptible(fb->dma_waitq,
+						 !bcm_dma_is_busy(dma_chan));
 		}
 		fb->stats.dma_irqs++;
 	}
@@ -863,7 +853,7 @@ static int bcm2708_fb_register(struct bcm2708_fb *fb)
 		return ret;
 
 	print_debug("BCM2708FB: registering framebuffer (%dx%d@%d) (%d)\n",
-		fbwidth, fbheight, fbdepth, fbswap);
+		    fbwidth, fbheight, fbdepth, fbswap);
 
 	ret = register_framebuffer(&fb->fb);
 	print_debug("BCM2708FB: register framebuffer (%d)\n", ret);
@@ -893,7 +883,7 @@ static int bcm2708_fb_probe(struct platform_device *dev)
 	if (!fw)
 		return -EPROBE_DEFER;
 
-	fb = kzalloc(sizeof(struct bcm2708_fb), GFP_KERNEL);
+	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
 	if (!fb) {
 		ret = -ENOMEM;
 		goto free_region;
@@ -927,7 +917,6 @@ static int bcm2708_fb_probe(struct platform_device *dev)
 		goto free_dma_chan;
 	}
 
-
 	pr_info("BCM2708FB: allocated DMA channel %d\n", fb->dma_chan);
 
 	fb->dev = dev;
@@ -936,9 +925,8 @@ static int bcm2708_fb_probe(struct platform_device *dev)
 	/* failure here isn't fatal, but we'll fail in vc_mem_copy if
 	 * fb->gpu is not valid
 	 */
-	rpi_firmware_property(fb->fw,
-				    RPI_FIRMWARE_GET_VC_MEMORY,
-				    &fb->gpu, sizeof(fb->gpu));
+	rpi_firmware_property(fb->fw, RPI_FIRMWARE_GET_VC_MEMORY, &fb->gpu,
+			      sizeof(fb->gpu));
 
 	ret = bcm2708_fb_register(fb);
 	if (ret == 0) {
-- 
GitLab


From e8aa4d2e2bcfc89cf65b08c64300e03b2880b015 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 20 Jul 2018 22:03:41 +0100
Subject: [PATCH 0338/1835] bcm2835-dma: Add support for per-channel flags

Add the ability to interpret the high bits of the dreq specifier as
flags to be included in the DMA_CS register. The motivation for this
change is the ability to set the DISDEBUG flag for SD card transfers
to avoid corruption when using the VPU debugger.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/dma/bcm2835-dma.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index b676908ef5fa2..9c9d4e6275dd7 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -146,6 +146,10 @@ struct bcm2835_desc {
 #define BCM2835_DMA_S_DREQ	BIT(10) /* enable SREQ for source */
 #define BCM2835_DMA_S_IGNORE	BIT(11) /* ignore source reads - read 0 */
 #define BCM2835_DMA_BURST_LENGTH(x) ((x & 15) << 12)
+#define BCM2835_DMA_CS_FLAGS(x) (x & (BCM2835_DMA_PRIORITY(15) | \
+				      BCM2835_DMA_PANIC_PRIORITY(15) | \
+				      BCM2835_DMA_WAIT_FOR_WRITES | \
+				      BCM2835_DMA_DIS_DEBUG))
 #define BCM2835_DMA_PER_MAP(x)	((x & 31) << 16) /* REQ source */
 #define BCM2835_DMA_WAIT(x)	((x & 31) << 21) /* add DMA-wait cycles */
 #define BCM2835_DMA_NO_WIDE_BURSTS BIT(26) /* no 2 beat write bursts */
@@ -461,7 +465,8 @@ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
 	c->desc = d = to_bcm2835_dma_desc(&vd->tx);
 
 	writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
-	writel(BCM2835_DMA_ACTIVE, c->chan_base + BCM2835_DMA_CS);
+	writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+	       c->chan_base + BCM2835_DMA_CS);
 }
 
 static irqreturn_t bcm2835_dma_callback(int irq, void *data)
@@ -488,7 +493,8 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 	 * if this IRQ handler is threaded.) If the channel is finished, it
 	 * will remain idle despite the ACTIVE flag being set.
 	 */
-	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE |
+	       BCM2835_DMA_CS_FLAGS(c->dreq),
 	       c->chan_base + BCM2835_DMA_CS);
 
 	d = c->desc;
-- 
GitLab


From 0c7dd5c57f32ecd5e4b74d5441a1bc85ea3d8008 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 20 Jul 2018 22:08:05 +0100
Subject: [PATCH 0339/1835] bcm283x: Set the DISDEBUG flag for SD transfers

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm283x.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index e99b53b41c295..1b53339a1c57d 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -400,7 +400,7 @@
 			reg = <0x7e202000 0x100>;
 			interrupts = <2 24>;
 			clocks = <&clocks BCM2835_CLOCK_VPU>;
-			dmas = <&dma 13>;
+			dmas = <&dma (13|(1<<29))>;
 			dma-names = "rx-tx";
 			status = "disabled";
 		};
-- 
GitLab


From a9f347f26afa4f244bbce16ed19f26ed57516919 Mon Sep 17 00:00:00 2001
From: Dimitris Papavasiliou <dpapavas@gmail.com>
Date: Sat, 24 Nov 2018 22:05:42 +0200
Subject: [PATCH 0340/1835] ASoC: pcm512x: Implement the digital_mute interface

[ Upstream commit 3500f1c589e92e0b6b1f8d31b4084fbde08d49cb ]

Clicks and pops of various volumes can be produced while the device is
opened, closed, put into and taken out of standby, or reconfigured.
Fix this, by implementing the digital_mute interface, so that the
output is muted during such operations.

Signed-off-by: Dimitris Papavasiliou <dpapavas@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/pcm512x.c | 121 ++++++++++++++++++++++++++++++++++++-
 sound/soc/codecs/pcm512x.h |   2 +
 2 files changed, 121 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 9a6a6e3a0eb96..47cf3013ead50 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -53,6 +53,8 @@ struct pcm512x_priv {
 	unsigned long overclock_pll;
 	unsigned long overclock_dac;
 	unsigned long overclock_dsp;
+	int mute;
+	struct mutex mutex;
 	int lrclk_div;
 };
 
@@ -385,6 +387,61 @@ static const struct soc_enum pcm512x_veds =
 	SOC_ENUM_SINGLE(PCM512x_DIGITAL_MUTE_2, PCM512x_VEDS_SHIFT, 4,
 			pcm512x_ramp_step_text);
 
+static int pcm512x_update_mute(struct pcm512x_priv *pcm512x)
+{
+	return regmap_update_bits(
+		pcm512x->regmap, PCM512x_MUTE, PCM512x_RQML | PCM512x_RQMR,
+		(!!(pcm512x->mute & 0x5) << PCM512x_RQML_SHIFT)
+		| (!!(pcm512x->mute & 0x3) << PCM512x_RQMR_SHIFT));
+}
+
+static int pcm512x_digital_playback_switch_get(struct snd_kcontrol *kcontrol,
+					       struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+
+	mutex_lock(&pcm512x->mutex);
+	ucontrol->value.integer.value[0] = !(pcm512x->mute & 0x4);
+	ucontrol->value.integer.value[1] = !(pcm512x->mute & 0x2);
+	mutex_unlock(&pcm512x->mutex);
+
+	return 0;
+}
+
+static int pcm512x_digital_playback_switch_put(struct snd_kcontrol *kcontrol,
+					       struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+	int ret, changed = 0;
+
+	mutex_lock(&pcm512x->mutex);
+
+	if ((pcm512x->mute & 0x4) == (ucontrol->value.integer.value[0] << 2)) {
+		pcm512x->mute ^= 0x4;
+		changed = 1;
+	}
+	if ((pcm512x->mute & 0x2) == (ucontrol->value.integer.value[1] << 1)) {
+		pcm512x->mute ^= 0x2;
+		changed = 1;
+	}
+
+	if (changed) {
+		ret = pcm512x_update_mute(pcm512x);
+		if (ret != 0) {
+			dev_err(component->dev,
+				"Failed to update digital mute: %d\n", ret);
+			mutex_unlock(&pcm512x->mutex);
+			return ret;
+		}
+	}
+
+	mutex_unlock(&pcm512x->mutex);
+
+	return changed;
+}
+
 static const struct snd_kcontrol_new pcm512x_controls[] = {
 SOC_DOUBLE_R_TLV("Digital Playback Volume", PCM512x_DIGITAL_VOLUME_2,
 		 PCM512x_DIGITAL_VOLUME_3, 0, 255, 1, digital_tlv),
@@ -392,8 +449,15 @@ SOC_DOUBLE_TLV("Analogue Playback Volume", PCM512x_ANALOG_GAIN_CTRL,
 	       PCM512x_LAGN_SHIFT, PCM512x_RAGN_SHIFT, 1, 1, analog_tlv),
 SOC_DOUBLE_TLV("Analogue Playback Boost Volume", PCM512x_ANALOG_GAIN_BOOST,
 	       PCM512x_AGBL_SHIFT, PCM512x_AGBR_SHIFT, 1, 0, boost_tlv),
-SOC_DOUBLE("Digital Playback Switch", PCM512x_MUTE, PCM512x_RQML_SHIFT,
-	   PCM512x_RQMR_SHIFT, 1, 1),
+{
+	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+	.name = "Digital Playback Switch",
+	.index = 0,
+	.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
+	.info = snd_ctl_boolean_stereo_info,
+	.get = pcm512x_digital_playback_switch_get,
+	.put = pcm512x_digital_playback_switch_put
+},
 
 SOC_SINGLE("Deemphasis Switch", PCM512x_DSP, PCM512x_DEMP_SHIFT, 1, 1),
 SOC_ENUM("DSP Program", pcm512x_dsp_program),
@@ -1323,6 +1387,56 @@ static int pcm512x_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 	return 0;
 }
 
+static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
+{
+	struct snd_soc_component *component = dai->component;
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+	int ret;
+	unsigned int mute_det;
+
+	mutex_lock(&pcm512x->mutex);
+
+	if (mute) {
+		pcm512x->mute |= 0x1;
+		ret = regmap_update_bits(pcm512x->regmap, PCM512x_MUTE,
+					 PCM512x_RQML | PCM512x_RQMR,
+					 PCM512x_RQML | PCM512x_RQMR);
+		if (ret != 0) {
+			dev_err(component->dev,
+				"Failed to set digital mute: %d\n", ret);
+			mutex_unlock(&pcm512x->mutex);
+			return ret;
+		}
+
+		regmap_read_poll_timeout(pcm512x->regmap,
+					 PCM512x_ANALOG_MUTE_DET,
+					 mute_det, (mute_det & 0x3) == 0,
+					 200, 10000);
+
+		mutex_unlock(&pcm512x->mutex);
+	} else {
+		pcm512x->mute &= ~0x1;
+		ret = pcm512x_update_mute(pcm512x);
+		if (ret != 0) {
+			dev_err(component->dev,
+				"Failed to update digital mute: %d\n", ret);
+			mutex_unlock(&pcm512x->mutex);
+			return ret;
+		}
+
+		regmap_read_poll_timeout(pcm512x->regmap,
+					 PCM512x_ANALOG_MUTE_DET,
+					 mute_det,
+					 (mute_det & 0x3)
+					 == ((~pcm512x->mute >> 1) & 0x3),
+					 200, 10000);
+	}
+
+	mutex_unlock(&pcm512x->mutex);
+
+	return 0;
+}
+
 static int pcm512x_set_tdm_slot(struct snd_soc_dai *dai,
 	unsigned int tx_mask, unsigned int rx_mask,
 	int slots, int width)
@@ -1348,6 +1462,7 @@ static const struct snd_soc_dai_ops pcm512x_dai_ops = {
 	.startup = pcm512x_dai_startup,
 	.hw_params = pcm512x_hw_params,
 	.set_fmt = pcm512x_set_fmt,
+	.digital_mute = pcm512x_digital_mute,
 	.set_tdm_slot = pcm512x_set_tdm_slot,
 };
 
@@ -1414,6 +1529,8 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap)
 	if (!pcm512x)
 		return -ENOMEM;
 
+	mutex_init(&pcm512x->mutex);
+
 	dev_set_drvdata(dev, pcm512x);
 	pcm512x->regmap = regmap;
 
diff --git a/sound/soc/codecs/pcm512x.h b/sound/soc/codecs/pcm512x.h
index d70d9c0c2088c..9dda8693498ef 100644
--- a/sound/soc/codecs/pcm512x.h
+++ b/sound/soc/codecs/pcm512x.h
@@ -112,7 +112,9 @@
 #define PCM512x_RQST_SHIFT 4
 
 /* Page 0, Register 3 - mute */
+#define PCM512x_RQMR (1 << 0)
 #define PCM512x_RQMR_SHIFT 0
+#define PCM512x_RQML (1 << 4)
 #define PCM512x_RQML_SHIFT 4
 
 /* Page 0, Register 4 - PLL */
-- 
GitLab


From 3c105ab92a48ba1d2e3e4cc60cb020531519f5f4 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 21 Dec 2018 12:11:20 +0300
Subject: [PATCH 0341/1835] ASoC: pcm512x: Fix a double unlock in
 pcm512x_digital_mute()

[ Upstream commit 28b698b7342c7d5300cfe217cd77ff7d2a55e03d ]

We accidentally call mutex_unlock(&pcm512x->mutex); twice in a row.

I re-wrote the error handling to use "goto unlock;" instead of returning
directly.  Hopefully, it makes the code a little simpler.

Fixes: 3500f1c589e9 ("ASoC: pcm512x: Implement the digital_mute interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviwed-by: Dimitris Papavasiliou <dpapavas@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/pcm512x.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 47cf3013ead50..e6523e74fdd9f 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -1404,24 +1404,20 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
 		if (ret != 0) {
 			dev_err(component->dev,
 				"Failed to set digital mute: %d\n", ret);
-			mutex_unlock(&pcm512x->mutex);
-			return ret;
+			goto unlock;
 		}
 
 		regmap_read_poll_timeout(pcm512x->regmap,
 					 PCM512x_ANALOG_MUTE_DET,
 					 mute_det, (mute_det & 0x3) == 0,
 					 200, 10000);
-
-		mutex_unlock(&pcm512x->mutex);
 	} else {
 		pcm512x->mute &= ~0x1;
 		ret = pcm512x_update_mute(pcm512x);
 		if (ret != 0) {
 			dev_err(component->dev,
 				"Failed to update digital mute: %d\n", ret);
-			mutex_unlock(&pcm512x->mutex);
-			return ret;
+			goto unlock;
 		}
 
 		regmap_read_poll_timeout(pcm512x->regmap,
@@ -1432,9 +1428,10 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
 					 200, 10000);
 	}
 
+unlock:
 	mutex_unlock(&pcm512x->mutex);
 
-	return 0;
+	return ret;
 }
 
 static int pcm512x_set_tdm_slot(struct snd_soc_dai *dai,
-- 
GitLab


From 4e11f2bf0ee11da7d58bf357e88ea241246b8b53 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 25 Jan 2019 16:03:31 +0000
Subject: [PATCH 0342/1835] usb: dwc_otg: Clean up build warnings on 64bit
 kernels

No functional changes. Almost all are changes to logging lines.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/usb/host/dwc_otg/dwc_otg_driver.c    |  3 +--
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c   |  2 +-
 drivers/usb/host/dwc_otg/dwc_otg_hcd.c       | 19 ++++++++++++++-----
 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 10 ++++------
 4 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.c b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
index 673231e17351e..04535c3eff4a3 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_driver.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
@@ -837,8 +837,7 @@ static int dwc_otg_driver_probe(
 		retval = -ENOMEM;
 		goto fail;
 	}
-	dev_info(&_dev->dev, "base=0x%08x\n",
-                (unsigned)dwc_otg_device->os_dep.base);
+	dev_info(&_dev->dev, "base=%p\n", dwc_otg_device->os_dep.base);
 #endif
 
 	/*
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
index 2e644e4e3691b..624bb79e22bc4 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
@@ -301,7 +301,7 @@ static int notrace fiq_iso_out_advance(struct fiq_state *st, int num_channels, i
 		last = 1;
 
 	/* New DMA address - address of bounce buffer referred to in index */
-	hcdma.d32 = (uint32_t) &blob->channel[n].index[i].buf[0];
+	hcdma.d32 = (dma_addr_t) blob->channel[n].index[i].buf;
 	//hcdma.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA);
 	//hcdma.d32 += st->channel[n].dma_info.slot_len[i];
 	fiq_print(FIQDBG_INT, st, "LAST: %01d ", last);
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
index e59747cee7ab9..5051008217227 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -1041,8 +1041,8 @@ int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
 		 * moderately readable array casts.
 		 */
 		hcd->fiq_dmab = DWC_DMA_ALLOC(dev, (sizeof(struct fiq_dma_channel) * num_channels), &hcd->fiq_state->dma_base);
-		DWC_WARN("FIQ DMA bounce buffers: virt = 0x%08x dma = 0x%08x len=%d",
-				(unsigned int)hcd->fiq_dmab, (unsigned int)hcd->fiq_state->dma_base,
+		DWC_WARN("FIQ DMA bounce buffers: virt = %px dma = %pad len=%zu",
+				hcd->fiq_dmab, &hcd->fiq_state->dma_base,
 				sizeof(struct fiq_dma_channel) * num_channels);
 
 		DWC_MEMSET(hcd->fiq_dmab, 0x6b, 9024);
@@ -1522,9 +1522,12 @@ int fiq_fsm_setup_periodic_dma(dwc_otg_hcd_t *hcd, struct fiq_channel_state *st,
 		/*
 		 * Set dma_regs to bounce buffer. FIQ will update the
 		 * state depending on transaction progress.
+		 * Pointer arithmetic on hcd->fiq_state->dma_base (a dma_addr_t)
+		 * to point it to the correct offset in the allocated buffers.
 		 */
 		blob = (struct fiq_dma_blob *) hcd->fiq_state->dma_base;
-		st->hcdma_copy.d32 = (uint32_t) &blob->channel[hc->hc_num].index[0].buf[0];
+		st->hcdma_copy.d32 = (dma_addr_t) blob->channel[hc->hc_num].index[0].buf;
+
 		/* Calculate the max number of CSPLITS such that the FIQ can time out
 		 * a transaction if it fails.
 		 */
@@ -1571,9 +1574,15 @@ int fiq_fsm_setup_periodic_dma(dwc_otg_hcd_t *hcd, struct fiq_channel_state *st,
 				st->nrpackets = i;
 			}
 			ptr = qtd->urb->buf + frame_desc->offset;
-			/* Point the HC at the DMA address of the bounce buffers */
+			/*
+			 * Point the HC at the DMA address of the bounce buffers
+			 *
+			 * Pointer arithmetic on hcd->fiq_state->dma_base (a
+			 * dma_addr_t) to point it to the correct offset in the
+			 * allocated buffers.
+			 */
 			blob = (struct fiq_dma_blob *) hcd->fiq_state->dma_base;
-			st->hcdma_copy.d32 = (uint32_t) &blob->channel[hc->hc_num].index[0].buf[0];
+			st->hcdma_copy.d32 = (dma_addr_t) blob->channel[hc->hc_num].index[0].buf;
 
 			/* fixup xfersize to the actual packet size */
 			st->hctsiz_copy.b.pid = 0;
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
index 23a9291b26141..028f7fd22ba9e 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -454,11 +454,9 @@ static void hcd_init_fiq(void *cookie)
 		DWC_ERROR("Can't claim FIQ");
 		BUG();
 	}
-	DWC_WARN("FIQ on core %d at 0x%08x",
-				smp_processor_id(),
-				(fiq_fsm_enable ? (int)&dwc_otg_fiq_fsm : (int)&dwc_otg_fiq_nop));
-	DWC_WARN("FIQ ASM at 0x%08x length %d", (int)&_dwc_otg_fiq_stub, (int)(&_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub));
-		set_fiq_handler((void *) &_dwc_otg_fiq_stub, &_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub);
+	DWC_WARN("FIQ on core %d", smp_processor_id());
+	DWC_WARN("FIQ ASM at %px length %d", &_dwc_otg_fiq_stub, (int)(&_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub));
+	set_fiq_handler((void *) &_dwc_otg_fiq_stub, &_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub);
 	memset(&regs,0,sizeof(regs));
 
 	regs.ARM_r8 = (long) dwc_otg_hcd->fiq_state;
@@ -483,7 +481,7 @@ static void hcd_init_fiq(void *cookie)
 	dwc_otg_hcd->fiq_state->mphi_regs.outddb  = otg_dev->os_dep.mphi_base + 0x2c;
 	dwc_otg_hcd->fiq_state->mphi_regs.intstat = otg_dev->os_dep.mphi_base + 0x50;
 	dwc_otg_hcd->fiq_state->dwc_regs_base = otg_dev->os_dep.base;
-	DWC_WARN("MPHI regs_base at 0x%08x", (int)dwc_otg_hcd->fiq_state->mphi_regs.base);
+	DWC_WARN("MPHI regs_base at %px", dwc_otg_hcd->fiq_state->mphi_regs.base);
 	//Enable mphi peripheral
 	writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
 #ifdef DEBUG
-- 
GitLab


From 395eb197e8d2040f84e9a33757e2232505b8e3ad Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 30 Jan 2019 17:47:51 +0000
Subject: [PATCH 0343/1835] usb: dwc_otg: Use dma allocation for mphi
 dummy_send buffer

The FIQ driver used a kzalloc'ed buffer for dummy_send,
passing a kernel virtual address to the hardware block.
The buffer is only ever used for a dummy read, so it
should be harmless, but there is the chance that it will
cause exceptions.

Use a dma allocation so that we have a genuine bus address,
and read from that.
Free the allocation when done for good measure.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c | 4 ++--
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h | 1 +
 drivers/usb/host/dwc_otg/dwc_otg_hcd.c     | 5 ++++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
index 624bb79e22bc4..3ac4c7984ce56 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
@@ -1347,7 +1347,7 @@ void notrace dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels)
 	/* We got an interrupt, didn't handle it. */
 	if (kick_irq) {
 		state->mphi_int_count++;
-		FIQ_WRITE(state->mphi_regs.outdda, (int) state->dummy_send);
+		FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
 		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
 
 	}
@@ -1408,7 +1408,7 @@ void notrace dwc_otg_fiq_nop(struct fiq_state *state)
 		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
 		/* Force a clear before another dummy send */
 		FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
-		FIQ_WRITE(state->mphi_regs.outdda, (int) state->dummy_send);
+		FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
 		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
 
 	}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
index 06288ec087630..f517371421884 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
@@ -352,6 +352,7 @@ struct fiq_state {
 	dma_addr_t dma_base;
 	struct fiq_dma_blob *fiq_dmab;
 	void *dummy_send;
+	dma_addr_t dummy_send_dma;
 	gintmsk_data_t gintmsk_saved;
 	haintmsk_data_t haintmsk_saved;
 	int mphi_int_count;
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
index 5051008217227..855afd2e93956 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -929,6 +929,8 @@ static void dwc_otg_hcd_free(dwc_otg_hcd_t * dwc_otg_hcd)
 	DWC_TIMER_FREE(dwc_otg_hcd->conn_timer);
 	DWC_TASK_FREE(dwc_otg_hcd->reset_tasklet);
 	DWC_TASK_FREE(dwc_otg_hcd->completion_tasklet);
+	DWC_DMA_FREE(dev, 16, dwc_otg_hcd->fiq_state->dummy_send,
+		     dwc_otg_hcd->fiq_state->dummy_send_dma);
 	DWC_FREE(dwc_otg_hcd->fiq_state);
 
 #ifdef DWC_DEV_SRPCAP
@@ -1021,7 +1023,8 @@ int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
 		for (i = 0; i < num_channels; i++) {
 			hcd->fiq_state->channel[i].fsm = FIQ_PASSTHROUGH;
 		}
-		hcd->fiq_state->dummy_send = DWC_ALLOC_ATOMIC(16);
+		hcd->fiq_state->dummy_send = DWC_DMA_ALLOC_ATOMIC(dev, 16,
+							 &hcd->fiq_state->dummy_send_dma);
 
 		hcd->fiq_stack = DWC_ALLOC(sizeof(struct fiq_stack));
 		if (!hcd->fiq_stack) {
-- 
GitLab


From fe3d48724cf1c1ae1e8bb496556bf9b0c902010d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 29 Jan 2019 16:13:25 +0000
Subject: [PATCH 0344/1835] staging: vchiq_arm: Set up dma ranges on child
 devices

The VCHIQ driver now loads the audio, camera, codec, and vc-sm
drivers as platform drivers. However they were not being given
the correct DMA configuration.

Call of_dma_configure with the parent (VCHIQ) parameters to be
inherited by the child.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/interface/vchiq_arm/vchiq_arm.c   | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 40e8e041b7810..b955fe7915a81 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -3585,6 +3585,7 @@ static struct platform_device *
 vchiq_register_child(struct platform_device *pdev, const char *name)
 {
 	struct platform_device_info pdevinfo;
+	struct platform_device *new_dev;
 
 	memset(&pdevinfo, 0, sizeof(pdevinfo));
 
@@ -3593,7 +3594,17 @@ vchiq_register_child(struct platform_device *pdev, const char *name)
 	pdevinfo.id = PLATFORM_DEVID_NONE;
 	pdevinfo.dma_mask = DMA_BIT_MASK(32);
 
-	return platform_device_register_full(&pdevinfo);
+	new_dev = platform_device_register_full(&pdevinfo);
+	if (!new_dev)
+		return NULL;
+
+	/*
+	 * We want the dma-ranges etc to be copied from the parent VCHIQ device
+	 * to be passed on to the children too.
+	 */
+	of_dma_configure(&new_dev->dev, pdev->dev.of_node, true);
+
+	return new_dev;
 }
 
 static int vchiq_probe(struct platform_device *pdev)
-- 
GitLab


From 87bb353ae3cec2cf15f95c405eb9e924a7f688ce Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 29 Jan 2019 16:24:41 +0000
Subject: [PATCH 0345/1835] staging: vc-sm-cma: Correct DMA configuration.

Now that VCHIQ is setting up the DMA configuration as our
parent device, don't try to configure it during probe.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index a8758ab8c87f1..7b3ce1c205d66 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -703,9 +703,6 @@ err_free_mem:
 /* Driver loading. */
 static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
 {
-	struct device *dev = &pdev->dev;
-	int err;
-
 	pr_info("%s: Videocore shared memory driver\n", __func__);
 
 	sm_state = kzalloc(sizeof(*sm_state), GFP_KERNEL);
@@ -714,13 +711,11 @@ static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
 	sm_state->pdev = pdev;
 	mutex_init(&sm_state->map_lock);
 
-	dev->coherent_dma_mask = DMA_BIT_MASK(32);
-	dev->dma_mask = &dev->coherent_dma_mask;
-	err = of_dma_configure(dev, NULL, true);
-	if (err) {
-		dev_err(dev, "Unable to setup DMA: %d\n", err);
-		return err;
-	}
+	pdev->dev.dma_parms = devm_kzalloc(&pdev->dev,
+					   sizeof(*pdev->dev.dma_parms),
+					   GFP_KERNEL);
+	/* dma_set_max_seg_size checks if dma_parms is NULL. */
+	dma_set_max_seg_size(&pdev->dev, 0x3FFFFFFF);
 
 	vchiq_add_connected_callback(vc_sm_connected_init);
 	return 0;
-- 
GitLab


From 47c05091f4f76150b6eeccef66172e496ba3a68b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 29 Jan 2019 16:29:00 +0000
Subject: [PATCH 0346/1835] staging: vc-sm-cma: Use a void* pointer as the
 handle within the kernel

The driver was using an unsigned int as the handle to the outside world,
and doing a nasty cast to the struct dmabuf when handed it back.
This breaks badly with a 64 bit kernel where the pointer doesn't fit
in an unsigned int.

Switch to using a void* within the kernel. Reality is that it is
a struct dma_buf*, but advertising it as such to other drivers seems
to encourage the use of it as such, and I'm not sure on the implications
of that.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c        | 10 +++++-----
 drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h    |  6 +++---
 drivers/staging/vc04_services/vchiq-mmal/mmal-common.h |  2 +-
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c  |  2 +-
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 7b3ce1c205d66..84cab85ba2c7a 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -745,7 +745,7 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 }
 
 /* Get an internal resource handle mapped from the external one. */
-int vc_sm_cma_int_handle(int handle)
+int vc_sm_cma_int_handle(void *handle)
 {
 	struct dma_buf *dma_buf = (struct dma_buf *)handle;
 	struct vc_sm_buffer *res;
@@ -762,7 +762,7 @@ int vc_sm_cma_int_handle(int handle)
 EXPORT_SYMBOL_GPL(vc_sm_cma_int_handle);
 
 /* Free a previously allocated shared memory handle and block. */
-int vc_sm_cma_free(int handle)
+int vc_sm_cma_free(void *handle)
 {
 	struct dma_buf *dma_buf = (struct dma_buf *)handle;
 
@@ -772,7 +772,7 @@ int vc_sm_cma_free(int handle)
 		return -EPERM;
 	}
 
-	pr_debug("%s: handle %08x/dmabuf %p\n", __func__, handle, dma_buf);
+	pr_debug("%s: handle %p/dmabuf %p\n", __func__, handle, dma_buf);
 
 	dma_buf_put(dma_buf);
 
@@ -781,7 +781,7 @@ int vc_sm_cma_free(int handle)
 EXPORT_SYMBOL_GPL(vc_sm_cma_free);
 
 /* Import a dmabuf to be shared with VC. */
-int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, int *handle)
+int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, void **handle)
 {
 	struct dma_buf *new_dma_buf;
 	struct vc_sm_buffer *res;
@@ -801,7 +801,7 @@ int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, int *handle)
 		res = (struct vc_sm_buffer *)new_dma_buf->priv;
 
 		/* Assign valid handle at this time.*/
-		*handle = (int)new_dma_buf;
+		*handle = new_dma_buf;
 	} else {
 		/*
 		 * succeeded in importing the dma_buf, but then
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
index 182450b6196b6..988fdd967922b 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_knl.h
@@ -17,12 +17,12 @@
 #endif
 
 /* Free a previously allocated or imported shared memory handle and block. */
-int vc_sm_cma_free(int handle);
+int vc_sm_cma_free(void *handle);
 
 /* Get an internal resource handle mapped from the external one. */
-int vc_sm_cma_int_handle(int handle);
+int vc_sm_cma_int_handle(void *handle);
 
 /* Import a block of memory into the GPU space. */
-int vc_sm_cma_import_dmabuf(struct dma_buf *dmabuf, int *handle);
+int vc_sm_cma_import_dmabuf(struct dma_buf *dmabuf, void **handle);
 
 #endif /* __VC_SM_KNL_H__INCLUDED__ */
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
index fd27626245c9f..2fdbc8dd4eb42 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-common.h
@@ -52,7 +52,7 @@ struct mmal_buffer {
 	struct mmal_msg_context *msg_context;
 
 	struct dma_buf *dma_buf;/* Exported dmabuf fd from videobuf2 */
-	int vcsm_handle;	/* VCSM handle having imported the dmabuf */
+	void *vcsm_handle;	/* VCSM handle having imported the dmabuf */
 	u32 vc_handle;		/* VC handle to that dmabuf */
 
 	u32 cmd;		/* MMAL command. 0=data. */
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 062b80dcce0df..167644137ec75 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1793,7 +1793,7 @@ int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
 	if (buf->vcsm_handle) {
 		int ret;
 
-		pr_debug("%s: vc_sm_cma_free on handle %08X\n", __func__,
+		pr_debug("%s: vc_sm_cma_free on handle %p\n", __func__,
 			 buf->vcsm_handle);
 		ret = vc_sm_cma_free(buf->vcsm_handle);
 		if (ret)
-- 
GitLab


From 858346bdf1e9809c2468788381795222a41ccfe4 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 29 Jan 2019 16:32:57 +0000
Subject: [PATCH 0347/1835] staging: vc-sm-cma: Fix up for 64bit builds

There were a number of logging lines that were using
inappropriate formatting under 64bit kernels.

The kernel_id field passed to/from the VPU was being
abused for storing the struct vc_sm_buffer *.
This breaks with 64bit kernels, so change to using an IDR.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 60 +++++++++++++++----
 .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  |  3 +-
 2 files changed, 48 insertions(+), 15 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 84cab85ba2c7a..7ac6b806b862a 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -75,6 +75,9 @@ struct sm_state_t {
 	struct miscdevice dev;
 	struct sm_instance *sm_handle;	/* Handle for videocore service. */
 
+	spinlock_t kernelid_map_lock;	/* Spinlock protecting kernelid_map */
+	struct idr kernelid_map;
+
 	struct mutex map_lock;          /* Global map lock. */
 	struct list_head buffer_list;	/* List of buffer. */
 
@@ -97,6 +100,29 @@ static int sm_inited;
 
 /* ---- Private Functions ------------------------------------------------ */
 
+static int get_kernel_id(struct vc_sm_buffer *buffer)
+{
+	int handle;
+
+	spin_lock(&sm_state->kernelid_map_lock);
+	handle = idr_alloc(&sm_state->kernelid_map, buffer, 0, 0, GFP_KERNEL);
+	spin_unlock(&sm_state->kernelid_map_lock);
+
+	return handle;
+}
+
+static struct vc_sm_buffer *lookup_kernel_id(int handle)
+{
+	return idr_find(&sm_state->kernelid_map, handle);
+}
+
+static void free_kernel_id(int handle)
+{
+	spin_lock(&sm_state->kernelid_map_lock);
+	idr_remove(&sm_state->kernelid_map, handle);
+	spin_unlock(&sm_state->kernelid_map_lock);
+}
+
 static int vc_sm_cma_seq_file_show(struct seq_file *s, void *v)
 {
 	struct sm_pde_t *sm_pde;
@@ -129,8 +155,7 @@ static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
 	if (!sm_state)
 		return 0;
 
-	seq_printf(s, "\nVC-ServiceHandle     0x%x\n",
-		   (unsigned int)sm_state->sm_handle);
+	seq_printf(s, "\nVC-ServiceHandle     %p\n", sm_state->sm_handle);
 
 	/* Log all applicable mapping(s). */
 
@@ -145,7 +170,7 @@ static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
 				   resource);
 			seq_printf(s, "           NAME         %s\n",
 				   resource->name);
-			seq_printf(s, "           SIZE         %d\n",
+			seq_printf(s, "           SIZE         %zu\n",
 				   resource->size);
 			seq_printf(s, "           DMABUF       %p\n",
 				   resource->dma_buf);
@@ -181,7 +206,7 @@ static void vc_sm_add_resource(struct vc_sm_privdata_t *privdata,
 	list_add(&buffer->global_buffer_list, &sm_state->buffer_list);
 	mutex_unlock(&sm_state->map_lock);
 
-	pr_debug("[%s]: added buffer %p (name %s, size %d)\n",
+	pr_debug("[%s]: added buffer %p (name %s, size %zu)\n",
 		 __func__, buffer, buffer->name, buffer->size);
 }
 
@@ -194,7 +219,7 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer, int force)
 	mutex_lock(&sm_state->map_lock);
 	mutex_lock(&buffer->lock);
 
-	pr_debug("[%s]: buffer %p (name %s, size %d)\n",
+	pr_debug("[%s]: buffer %p (name %s, size %zu)\n",
 		 __func__, buffer, buffer->name, buffer->size);
 
 	if (buffer->vc_handle && buffer->vpu_state == VPU_MAPPED) {
@@ -443,6 +468,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 	struct vc_sm_import_result result = { };
 	struct dma_buf_attachment *attach = NULL;
 	struct sg_table *sgt = NULL;
+	dma_addr_t dma_addr;
 	int ret = 0;
 	int status;
 
@@ -478,21 +504,22 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 	}
 
 	import.type = VC_SM_ALLOC_NON_CACHED;
-	import.addr = (uint32_t)sg_dma_address(sgt->sgl);
+	dma_addr = sg_dma_address(sgt->sgl);
+	import.addr = (uint32_t)dma_addr;
 	if ((import.addr & 0xC0000000) != 0xC0000000) {
-		pr_err("%s: Expecting an uncached alias for dma_addr %08x\n",
-		       __func__, import.addr);
+		pr_err("%s: Expecting an uncached alias for dma_addr %pad\n",
+		       __func__, &dma_addr);
 		import.addr |= 0xC0000000;
 	}
 	import.size = sg_dma_len(sgt->sgl);
 	import.allocator = current->tgid;
-	import.kernel_id = (uint32_t)buffer;	//FIXME: 64 bit support needed.
+	import.kernel_id = get_kernel_id(buffer);
 
 	memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
 	       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
 
-	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %p, size %u\n",
-		 __func__, import.name, import.type, (void *)import.addr,
+	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %pad, size %u\n",
+		 __func__, import.name, import.type, &dma_addr,
 		 import.size);
 
 	/* Allocate the videocore buffer. */
@@ -527,7 +554,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 
 	buffer->attach = attach;
 	buffer->sgt = sgt;
-	buffer->dma_addr = sg_dma_address(sgt->sgl);
+	buffer->dma_addr = dma_addr;
 	buffer->in_use = 1;
 
 	/*
@@ -559,6 +586,7 @@ error:
 		vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
 				    &sm_state->int_trans_id);
 	}
+	free_kernel_id(import.kernel_id);
 	kfree(buffer);
 	if (sgt)
 		dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
@@ -586,7 +614,7 @@ vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
 	{
 		struct vc_sm_released *release = (struct vc_sm_released *)reply;
 		struct vc_sm_buffer *buffer =
-				(struct vc_sm_buffer *)release->kernel_id;
+					lookup_kernel_id(release->kernel_id);
 
 		/*
 		 * FIXME: Need to check buffer is still valid and allocated
@@ -599,6 +627,7 @@ vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
 		buffer->vc_handle = 0;
 		buffer->vpu_state = VPU_NOT_MAPPED;
 		mutex_unlock(&buffer->lock);
+		free_kernel_id(release->kernel_id);
 
 		vc_sm_release_resource(buffer, 0);
 	}
@@ -711,6 +740,9 @@ static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
 	sm_state->pdev = pdev;
 	mutex_init(&sm_state->map_lock);
 
+	spin_lock_init(&sm_state->kernelid_map_lock);
+	idr_init_base(&sm_state->kernelid_map, 1);
+
 	pdev->dev.dma_parms = devm_kzalloc(&pdev->dev,
 					   sizeof(*pdev->dev.dma_parms),
 					   GFP_KERNEL);
@@ -735,6 +767,8 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 		/* Stop the videocore shared memory service. */
 		vc_sm_cma_vchi_stop(&sm_state->sm_handle);
 
+		idr_destroy(&sm_state->kernelid_map);
+
 		/* Free the memory for the state structure. */
 		mutex_destroy(&sm_state->map_lock);
 		kfree(sm_state);
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
index cc5b31a54cdac..711f2a346bbf0 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
@@ -356,8 +356,7 @@ struct sm_instance *vc_sm_cma_vchi_init(VCHI_INSTANCE_T vchi_instance,
 	set_user_nice(instance->io_thread, -10);
 	wake_up_process(instance->io_thread);
 
-	pr_debug("%s: success - instance 0x%x", __func__,
-		 (unsigned int)instance);
+	pr_debug("%s: success - instance %p", __func__, instance);
 	return instance;
 
 err_close_services:
-- 
GitLab


From 1141403c4ca58cb38504072fe71b62409025d4bc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 4 Feb 2019 12:35:06 +0000
Subject: [PATCH 0348/1835] configs: Add Unicam and subdevices to
 bcmrpi3_defconfig

The bcm2835-unicam, tc358743, adv7180 (for adv7282m) and ov5647
have been tested on a 64bit kernel and shown to work.
Add them to the config.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 07048117fde1b..0fca7f9ef0afd 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -645,6 +645,7 @@ CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
 CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
 CONFIG_MEDIA_RADIO_SUPPORT=y
 CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
 CONFIG_USB_VIDEO_CLASS=m
 CONFIG_USB_M5602=m
@@ -727,6 +728,7 @@ CONFIG_VIDEO_EM28XX_V4L2=m
 CONFIG_VIDEO_EM28XX_ALSA=m
 CONFIG_VIDEO_EM28XX_DVB=m
 CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VIDEO_BCM2835_UNICAM=m
 CONFIG_RADIO_SI470X=m
 CONFIG_USB_SI470X=m
 CONFIG_I2C_SI470X=m
@@ -746,10 +748,13 @@ CONFIG_RADIO_WL128X=m
 # CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
 CONFIG_VIDEO_UDA1342=m
 CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_ADV7180=m
+CONFIG_VIDEO_TC358743=m
 CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
 CONFIG_DRM=m
-- 
GitLab


From e5d26f8777cbb4f8b37503db5402a9ef129fb7c7 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 4 Feb 2019 12:45:25 +0000
Subject: [PATCH 0349/1835] configs: Add VIDEO_BCM2835 to bcmrpi3_defconfig

This is now shown to work with 64 bit kernels, so add it to
the defconfig.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 0fca7f9ef0afd..80691b1048ada 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1070,6 +1070,7 @@ CONFIG_FB_TFT_WATTEROTT=m
 CONFIG_FB_FLEX=m
 CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 9d76615c970e229fb966a35eb5c299696f8ac94c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 4 Feb 2019 13:42:51 +0000
Subject: [PATCH 0350/1835] configs: Add V4L2 codec driver to bcmrpi3_defconfig

As this is now fixed to work with 64bit kernels, add it to the
defconfig.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 80691b1048ada..474d5c56a8816 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1071,6 +1071,7 @@ CONFIG_FB_FLEX=m
 CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_SND_BCM2835=m
 CONFIG_VIDEO_BCM2835=m
+CONFIG_VIDEO_CODEC_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From a799ccfef48117c41804e71b5dc64024c9a77542 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 5 Feb 2019 12:31:23 +0000
Subject: [PATCH 0351/1835] config: Add IPVLAN module to bcmrpi3_defconfig

It's built for the 32bit kernels, but not for the 64bit ones.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 474d5c56a8816..f6df43298ef5c 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -430,6 +430,7 @@ CONFIG_BONDING=m
 CONFIG_DUMMY=m
 CONFIG_IFB=m
 CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_NETCONSOLE=m
 CONFIG_TUN=m
-- 
GitLab


From 724a2307f8257a84bd05776ec462dec9b4c30c66 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 7 Feb 2019 18:16:25 +0000
Subject: [PATCH 0352/1835] configs: Enable the AD193x codecs

See: https://github.com/raspberrypi/linux/issues/2850

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 2 ++
 arch/arm/configs/bcmrpi_defconfig    | 2 ++
 arch/arm64/configs/bcmrpi3_defconfig | 2 ++
 sound/soc/codecs/Kconfig             | 4 ++--
 4 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index b8f47b630eaa8..0bb8d60c3bd4f 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -930,6 +930,8 @@ CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
 CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
 CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
 CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_AD193X_SPI=m
+CONFIG_SND_SOC_AD193X_I2C=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 268f64bdb9bdf..cc92a2dacb716 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -923,6 +923,8 @@ CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
 CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
 CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
 CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_AD193X_SPI=m
+CONFIG_SND_SOC_AD193X_I2C=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index f6df43298ef5c..8b74e42c22735 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -811,6 +811,8 @@ CONFIG_SND_DIGIDAC1_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
 CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
 CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_AD193X_SPI=m
+CONFIG_SND_SOC_AD193X_I2C=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_AK4554=m
 CONFIG_SND_SOC_CS4271_I2C=m
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 5d4a0445f3d25..985cfa2c61e68 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -295,11 +295,11 @@ config SND_SOC_AD193X
 	tristate
 
 config SND_SOC_AD193X_SPI
-	tristate
+	tristate "Analog Devices AU193X CODEC - SPI"
 	select SND_SOC_AD193X
 
 config SND_SOC_AD193X_I2C
-	tristate
+	tristate "Analog Devices AU193X CODEC - I2C"
 	select SND_SOC_AD193X
 
 config SND_SOC_AD1980
-- 
GitLab


From 20f243e305ea6fde1567ee6715f49350cf27d79c Mon Sep 17 00:00:00 2001
From: Zahari Petkov <zahari@balena.io>
Date: Fri, 8 Feb 2019 13:03:38 +0200
Subject: [PATCH 0353/1835] overlays: balenaFin v1.1.0 carrier board update

A backward compatible update for the balenaFin carrier board for the
Raspberry Pi Compute Module 3/3+ Lite.

The updated overlay includes:
  * support for the newly introduced RGB LEDs
  * i2c-gpio and SDIO improvements
  * DT based Marvell 88W8887 configuration

Signed-off-by: Zahari Petkov <zahari@balena.io>
---
 arch/arm/boot/dts/overlays/README             |  2 +-
 .../boot/dts/overlays/balena-fin-overlay.dts  | 46 ++++++++++++++++++-
 2 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index d91917ec8d761..622eb1a6c34f7 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -472,7 +472,7 @@ Params: swap_lr                 Reverse the channel allocation, which will also
 
 Name:   balena-fin
 Info:   Overlay that enables WiFi, Bluetooth and the GPIO expander on the
-        Balena Fin board.
+        balenaFin carrier board for the Raspberry Pi Compute Module 3/3+ Lite.
 Load:   dtoverlay=balena-fin
 Params: <None>
 
diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
index 269ab7d729382..575909642de02 100644
--- a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
@@ -11,6 +11,7 @@
 			pinctrl-0 = <&sdio_pins>;
 			bus-width = <4>;
 			brcm,overclock-50 = <35>;
+			non-removable;
 			status = "okay";
 		};
 	};
@@ -34,7 +35,8 @@
 	fragment@2 {
 		target-path = "/";
 		__overlay__ {
-			// We should investigate how to switch to mmc-pwrseq-sd8787
+			// We should switch to mmc-pwrseq-sd8787 after making it
+			// compatible with sd8887
 			// Currently that module requires two GPIOs to function since it
 			// targets a slightly different chip
 			power_ctrl: power_ctrl {
@@ -46,10 +48,21 @@
 			i2c_soft: i2c@0 {
 				compatible = "i2c-gpio";
 				gpios = <&gpio 43 0 /* sda */ &gpio 42 0 /* scl */>;
-				i2c-gpio,delay-us = <2>; /* ~100 kHz */
+				i2c-gpio,delay-us = <5>;
+				i2c-gpio,scl-open-drain;
+				i2c-gpio,sda-open-drain;
 				#address-cells = <1>;
 				#size-cells = <0>;
 			};
+
+			sd8xxx-wlan {
+				drvdbg = <0x6>;
+				drv_mode = <0x1>;
+				cfg80211_wext = <0xf>;
+				sta_name = "wlan";
+				wfd_name = "p2p";
+				cal_data_cfg = "none";
+			};
 		};
 	};
 
@@ -74,6 +87,35 @@
 				reg = <0x68>;
 				status = "okay";
 			};
+
+			// RGB LEDs (>= v1.1.0)
+			pca9633: pca9633@62 {
+				compatible = "nxp,pca9633";
+				reg = <0x62>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				red@0 {
+					label = "red";
+					reg = <0>;
+					linux,default-trigger = "none";
+				};
+				green@1 {
+					label = "green";
+					reg = <1>;
+					linux,default-trigger = "none";
+				};
+				blue@2 {
+					label = "blue";
+					reg = <2>;
+					linux,default-trigger = "none";
+				};
+				unused@3 {
+					label = "unused";
+					reg = <3>;
+					linux,default-trigger = "none";
+				};
+			};
 		};
 	};
 };
-- 
GitLab


From 1dd6eb54603701f737a4632db17cf79349501c87 Mon Sep 17 00:00:00 2001
From: Zahari Petkov <zahari@balena.io>
Date: Fri, 8 Feb 2019 13:33:47 +0200
Subject: [PATCH 0354/1835] configs: Add CONFIG_LEDS_PCA963X=m

Enable support for PCA963x I2C chip.

Needed for the balenaFin v1.1.0 carrier board for the
Raspberry Pi Compute Module 3/3+ Lite.

Signed-off-by: Zahari Petkov <zahari@balena.io>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 0bb8d60c3bd4f..eb19afcc8249b 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1124,6 +1124,7 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index cc92a2dacb716..66c67de30264d 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1117,6 +1117,7 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 8b74e42c22735..2926a32f96971 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -984,6 +984,7 @@ CONFIG_MMC_SDHCI_IPROC=m
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-- 
GitLab


From a48ede2b35bdf96d40758701cc48b3762d52031c Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 18 Feb 2019 15:43:30 +0000
Subject: [PATCH 0355/1835] Revert "brcmfmac: Mute expected startup 'errors'"

This reverts commit 34eba9138ccf8d84552ab9dae37d8f348640e663.

Upstream patch 26e537884a ("brcmfmac: Do not complain about country code "00")
fixes the same issue, so drop this downstream patch.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 75c8623468f4d..72822c828a99e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6838,8 +6838,6 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
 	/* ignore non-ISO3166 country codes */
 	for (i = 0; i < 2; i++)
 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
-			if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
-				return;
 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
 				  req->alpha2[0], req->alpha2[1]);
 			return;
-- 
GitLab


From 1cb82fd7d0917c18b02a73ff2c13405316c95a32 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 19 Feb 2019 15:06:31 +0000
Subject: [PATCH 0356/1835] gpu:vc4-fkms: Update driver to not use plane->crtc.

Following on from
commit 2f958af7fc248 ("drm/vc4: Stop updating plane->fb/crtc")
do the same in the firmwarekms driver and look at plane_state->crtc
instead.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index e760b569c54d6..4701f68505510 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -193,8 +193,8 @@ static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
 					   struct drm_plane_state *old_state)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(plane->crtc);
 	struct drm_plane_state *state = plane->state;
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(state->crtc);
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
 	dma_addr_t addr = bo->paddr + fb->offsets[0];
@@ -682,8 +682,6 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	drm_crtc_init_with_planes(drm, crtc, primary_plane, cursor_plane,
 				  &vc4_crtc_funcs, NULL);
 	drm_crtc_helper_add(crtc, &vc4_crtc_helper_funcs);
-	primary_plane->crtc = crtc;
-	cursor_plane->crtc = crtc;
 
 	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
 	if (!vc4_encoder)
-- 
GitLab


From 474459c6d674644cebae14741b00fc173701a5f1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 19 Feb 2019 15:18:25 +0000
Subject: [PATCH 0357/1835] drm: vc4: Programming the CTM is conditional on
 running full KMS

vc4_ctm_commit writes to HVS registers, so this is only applicable
when in full KMS mode, not in firmware KMS mode. Add this conditional.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index f4d8a730e821b..baf9bd7931ac9 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -147,7 +147,8 @@ vc4_atomic_complete_commit(struct drm_atomic_state *state)
 
 	drm_atomic_helper_commit_modeset_disables(dev, state);
 
-	vc4_ctm_commit(vc4, state);
+	if (!vc4->firmware_kms)
+		vc4_ctm_commit(vc4, state);
 
 	drm_atomic_helper_commit_planes(dev, state, 0);
 
-- 
GitLab


From 61ac8e91118ce417f0074af2c700f0a0c21fb3d1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 13 Feb 2019 12:33:29 +0000
Subject: [PATCH 0358/1835] staging: mmal_vchiq: Add in the Bayer encoding
 formats

The list of formats was copied before Bayer support was added.
The ISP supports Bayer and is being supported by the bcm2835_codec
driver, so add in the encodings for them.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/vchiq-mmal/mmal-encodings.h | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
index 2be9941a1f30e..44ba91aa6d479 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-encodings.h
@@ -69,6 +69,33 @@
  */
 #define MMAL_ENCODING_OPAQUE           MMAL_FOURCC('O', 'P', 'Q', 'V')
 
+/* Bayer formats
+ * FourCC values copied from V4L2 where defined.
+ */
+/* 8 bit per pixel Bayer formats. */
+#define MMAL_ENCODING_BAYER_SBGGR8     MMAL_FOURCC('B', 'A', '8', '1')
+#define MMAL_ENCODING_BAYER_SGBRG8     MMAL_FOURCC('G', 'B', 'R', 'G')
+#define MMAL_ENCODING_BAYER_SGRBG8     MMAL_FOURCC('G', 'R', 'B', 'G')
+#define MMAL_ENCODING_BAYER_SRGGB8     MMAL_FOURCC('R', 'G', 'G', 'B')
+
+/* 10 bit per pixel packed Bayer formats. */
+#define MMAL_ENCODING_BAYER_SBGGR10P   MMAL_FOURCC('p', 'B', 'A', 'A')
+#define MMAL_ENCODING_BAYER_SGRBG10P   MMAL_FOURCC('p', 'g', 'A', 'A')
+#define MMAL_ENCODING_BAYER_SGBRG10P   MMAL_FOURCC('p', 'G', 'A', 'A')
+#define MMAL_ENCODING_BAYER_SRGGB10P   MMAL_FOURCC('p', 'R', 'A', 'A')
+
+/* 12 bit per pixel packed Bayer formats. */
+#define MMAL_ENCODING_BAYER_SBGGR12P   MMAL_FOURCC('p', 'B', '1', '2')
+#define MMAL_ENCODING_BAYER_SGRBG12P   MMAL_FOURCC('p', 'g', '1', '2')
+#define MMAL_ENCODING_BAYER_SGBRG12P   MMAL_FOURCC('p', 'G', '1', '2')
+#define MMAL_ENCODING_BAYER_SRGGB12P   MMAL_FOURCC('p', 'R', '1', '2')
+
+/* 16 bit per pixel Bayer formats. */
+#define MMAL_ENCODING_BAYER_SBGGR16    MMAL_FOURCC('B', 'G', '1', '6')
+#define MMAL_ENCODING_BAYER_SGBRG16    MMAL_FOURCC('G', 'B', '1', '6')
+#define MMAL_ENCODING_BAYER_SGRBG16    MMAL_FOURCC('G', 'R', '1', '6')
+#define MMAL_ENCODING_BAYER_SRGGB16    MMAL_FOURCC('R', 'G', '1', '6')
+
 /** An EGL image handle
  */
 #define MMAL_ENCODING_EGL_IMAGE        MMAL_FOURCC('E', 'G', 'L', 'I')
-- 
GitLab


From a00177eaa6d5c274664b6c8c86318734657d657e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 13 Feb 2019 12:36:56 +0000
Subject: [PATCH 0359/1835] staging: mmal-vchiq: Always return the param size
 from param_get

mmal-vchiq is a reimplementation of the userland library for MMAL.
When getting a parameter, the client provides the storage and
the size of the storage. The VPU then returns the size of the
parameter that it wished to return, and as much as possible of
that parameter is returned to the client.

The implementation previously only returned the size provided
by the VPU should it exceed the buffer size. So for parameters
such as the supported encodings list the client had no idea
how much of the provided storage had been populated.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 167644137ec75..3ef173f2d18b0 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1412,11 +1412,12 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
 		 */
 		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
 		       *value_size);
-		*value_size = rmsg->u.port_parameter_get_reply.size;
 	} else {
 		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
 		       rmsg->u.port_parameter_get_reply.size);
 	}
+	/* Always report the size of the returned parameter to the caller */
+	*value_size = rmsg->u.port_parameter_get_reply.size;
 
 	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
 		 ret, port->component->handle, port->handle, parameter_id);
-- 
GitLab


From 1d88d96e61249e86284b399cbf40469e4e4f5c13 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 13 Feb 2019 12:51:03 +0000
Subject: [PATCH 0360/1835] staging: mmal-vchiq: If the VPU returns an error,
 don't negate it

There is an enum for the errors that the VPU can return.
port_parameter_get was negating that value, but also using -EINVAL
from the Linux error codes.
Pass the VPU error code as positive values. Should the function
need to pass a Linux failure, then return that as negative.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 3ef173f2d18b0..108df9b7f8344 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1400,7 +1400,8 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
 		goto release_msg;
 	}
 
-	ret = -rmsg->u.port_parameter_get_reply.status;
+	ret = rmsg->u.port_parameter_get_reply.status;
+
 	/* port_parameter_get_reply.size includes the header,
 	 * whilst *value_size doesn't.
 	 */
-- 
GitLab


From 5eb70b12e3239aa18b4970ef80c91571f024b8f0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 13 Feb 2019 13:44:00 +0000
Subject: [PATCH 0361/1835] staging: bcm2835_codec: Query supported formats
 from the component

The driver was previously working with hard coded tables of
which video formats were supported by each component.
The components advertise this information via a MMAL parameter,
so retrieve the information from there during probe, and store
in the state structure for that device.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 455 +++++++++++++-----
 1 file changed, 327 insertions(+), 128 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index c26760faae2d6..7b8de26ca43b5 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -88,17 +88,12 @@ struct bcm2835_codec_fmt {
 	int	bytesperline_align;
 	u32	flags;
 	u32	mmal_fmt;
-	bool	decode_only;
-	bool	encode_only;
 	int	size_multiplier_x2;
 };
 
-/* Supported raw pixel formats. Those supported for both encode and decode
- * must come first, with those only supported for decode coming after (there
- * are no formats supported for encode only).
- */
-static struct bcm2835_codec_fmt raw_formats[] = {
+static const struct bcm2835_codec_fmt supported_formats[] = {
 	{
+		/* YUV formats */
 		.fourcc			= V4L2_PIX_FMT_YUV420,
 		.depth			= 8,
 		.bytesperline_align	= 32,
@@ -139,7 +134,6 @@ static struct bcm2835_codec_fmt raw_formats[] = {
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_YUYV,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_UYVY,
@@ -147,7 +141,6 @@ static struct bcm2835_codec_fmt raw_formats[] = {
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_UYVY,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_YVYU,
@@ -155,7 +148,6 @@ static struct bcm2835_codec_fmt raw_formats[] = {
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_YVYU,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_VYUY,
@@ -163,15 +155,14 @@ static struct bcm2835_codec_fmt raw_formats[] = {
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_VYUY,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
 	}, {
+		/* RGB formats */
 		.fourcc			= V4L2_PIX_FMT_RGB24,
 		.depth			= 24,
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_RGB24,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_BGR24,
@@ -179,7 +170,6 @@ static struct bcm2835_codec_fmt raw_formats[] = {
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BGR24,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_BGR32,
@@ -187,17 +177,126 @@ static struct bcm2835_codec_fmt raw_formats[] = {
 		.bytesperline_align	= 32,
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BGRA,
-		.encode_only		= true,
 		.size_multiplier_x2	= 2,
-	},
-};
-
-/* Supported encoded formats. Those supported for both encode and decode
- * must come first, with those only supported for decode coming after (there
- * are no formats supported for encode only).
- */
-static struct bcm2835_codec_fmt encoded_formats[] = {
-	{
+	}, {
+		/* Bayer formats */
+		/* 8 bit */
+		.fourcc			= V4L2_PIX_FMT_SRGGB8,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB8,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SBGGR8,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR8,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGRBG8,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG8,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGBRG8,
+		.depth			= 8,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG8,
+		.size_multiplier_x2	= 2,
+	}, {
+		/* 10 bit */
+		.fourcc			= V4L2_PIX_FMT_SRGGB10P,
+		.depth			= 10,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB10P,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SBGGR10P,
+		.depth			= 10,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR10P,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGRBG10P,
+		.depth			= 10,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG10P,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGBRG10P,
+		.depth			= 10,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG10P,
+		.size_multiplier_x2	= 2,
+	}, {
+		/* 12 bit */
+		.fourcc			= V4L2_PIX_FMT_SRGGB12P,
+		.depth			= 12,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB12P,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SBGGR12P,
+		.depth			= 12,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR12P,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGRBG12P,
+		.depth			= 12,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG12P,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGBRG12P,
+		.depth			= 12,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG12P,
+		.size_multiplier_x2	= 2,
+	}, {
+		/* 16 bit */
+		.fourcc			= V4L2_PIX_FMT_SRGGB16,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB16,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SBGGR16,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR16,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGRBG16,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG16,
+		.size_multiplier_x2	= 2,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_SGBRG16,
+		.depth			= 16,
+		.bytesperline_align	= 32,
+		.flags			= 0,
+		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG16,
+		.size_multiplier_x2	= 2,
+	}, {
+		/* Compressed formats */
 		.fourcc			= V4L2_PIX_FMT_H264,
 		.depth			= 0,
 		.flags			= V4L2_FMT_FLAG_COMPRESSED,
@@ -212,30 +311,22 @@ static struct bcm2835_codec_fmt encoded_formats[] = {
 		.depth			= 0,
 		.flags			= V4L2_FMT_FLAG_COMPRESSED,
 		.mmal_fmt		= MMAL_ENCODING_MP4V,
-		.decode_only		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_H263,
 		.depth			= 0,
 		.flags			= V4L2_FMT_FLAG_COMPRESSED,
 		.mmal_fmt		= MMAL_ENCODING_H263,
-		.decode_only		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_MPEG2,
 		.depth			= 0,
 		.flags			= V4L2_FMT_FLAG_COMPRESSED,
 		.mmal_fmt		= MMAL_ENCODING_MP2V,
-		.decode_only		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_VP8,
 		.depth			= 0,
 		.flags			= V4L2_FMT_FLAG_COMPRESSED,
 		.mmal_fmt		= MMAL_ENCODING_VP8,
-		.decode_only		= true,
 	},
-	/*
-	 * This list couold include VP6 and Theorafor decode, but V4L2 doesn't
-	 * support them.
-	 */
 };
 
 struct bcm2835_codec_fmt_list {
@@ -243,19 +334,6 @@ struct bcm2835_codec_fmt_list {
 	unsigned int num_entries;
 };
 
-#define RAW_LIST	0
-#define ENCODED_LIST	1
-
-struct bcm2835_codec_fmt_list formats[] = {
-	{
-		.list = raw_formats,
-		.num_entries = ARRAY_SIZE(raw_formats),
-	}, {
-		.list = encoded_formats,
-		.num_entries = ARRAY_SIZE(encoded_formats),
-	},
-};
-
 struct m2m_mmal_buffer {
 	struct v4l2_m2m_buffer	m2m;
 	struct mmal_buffer	mmal;
@@ -284,52 +362,6 @@ struct bcm2835_codec_q_data {
 	bool			eos_buffer_in_use;	/* debug only */
 };
 
-enum {
-	V4L2_M2M_SRC = 0,
-	V4L2_M2M_DST = 1,
-};
-
-static inline struct bcm2835_codec_fmt_list *get_format_list(bool decode,
-							     bool capture)
-{
-	return decode ^ capture ? &formats[ENCODED_LIST] : &formats[RAW_LIST];
-}
-
-static struct bcm2835_codec_fmt *get_default_format(bool decode, bool capture)
-{
-	return &get_format_list(decode, capture)->list[0];
-}
-
-static struct bcm2835_codec_fmt *find_format(struct v4l2_format *f, bool decode,
-					     bool capture)
-{
-	struct bcm2835_codec_fmt *fmt;
-	unsigned int k;
-	struct bcm2835_codec_fmt_list *fmts = get_format_list(decode, capture);
-
-	for (k = 0; k < fmts->num_entries; k++) {
-		fmt = &fmts->list[k];
-		if (fmt->fourcc == f->fmt.pix.pixelformat)
-			break;
-	}
-
-	/*
-	 * Some compressed formats are only supported for decoding, not
-	 * encoding.
-	 */
-	if (!decode && fmts->list[k].decode_only)
-		return NULL;
-
-	/* Some pixel formats are only supported for encoding, not decoding. */
-	if (decode && fmts->list[k].encode_only)
-		return NULL;
-
-	if (k == fmts->num_entries)
-		return NULL;
-
-	return &fmts->list[k];
-}
-
 struct bcm2835_codec_dev {
 	struct platform_device *pdev;
 
@@ -342,6 +374,9 @@ struct bcm2835_codec_dev {
 
 	/* allocated mmal instance and components */
 	bool			decode;	 /* Is this instance a decoder? */
+	/* The list of formats supported on input and output queues. */
+	struct bcm2835_codec_fmt_list	supported_fmts[2];
+
 	struct vchiq_mmal_instance	*instance;
 
 	struct v4l2_m2m_dev	*m2m_dev;
@@ -374,8 +409,59 @@ struct bcm2835_codec_ctx {
 struct bcm2835_codec_driver {
 	struct bcm2835_codec_dev *encode;
 	struct bcm2835_codec_dev *decode;
+	struct bcm2835_codec_dev *isp;
+};
+
+enum {
+	V4L2_M2M_SRC = 0,
+	V4L2_M2M_DST = 1,
 };
 
+static const struct bcm2835_codec_fmt *get_fmt(u32 mmal_fmt)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(supported_formats); i++) {
+		if (supported_formats[i].mmal_fmt == mmal_fmt)
+			return &supported_formats[i];
+	}
+	return NULL;
+}
+
+static inline
+struct bcm2835_codec_fmt_list *get_format_list(struct bcm2835_codec_dev *dev,
+					       bool capture)
+{
+	return &dev->supported_fmts[capture ? 1 : 0];
+}
+
+static
+struct bcm2835_codec_fmt *get_default_format(struct bcm2835_codec_dev *dev,
+					     bool capture)
+{
+	return &dev->supported_fmts[capture ? 1 : 0].list[0];
+}
+
+static struct bcm2835_codec_fmt *find_format(struct v4l2_format *f,
+					     struct bcm2835_codec_dev *dev,
+					     bool capture)
+{
+	struct bcm2835_codec_fmt *fmt;
+	unsigned int k;
+	struct bcm2835_codec_fmt_list *fmts =
+					&dev->supported_fmts[capture ? 1 : 0];
+
+	for (k = 0; k < fmts->num_entries; k++) {
+		fmt = &fmts->list[k];
+		if (fmt->fourcc == f->fmt.pix.pixelformat)
+			break;
+	}
+	if (k == fmts->num_entries)
+		return NULL;
+
+	return &fmts->list[k];
+}
+
 static inline struct bcm2835_codec_ctx *file2ctx(struct file *file)
 {
 	return container_of(file->private_data, struct bcm2835_codec_ctx, fh);
@@ -456,7 +542,6 @@ static inline unsigned int get_bytesperline(int width,
 }
 
 static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
-				   bool decode,
 				   struct bcm2835_codec_q_data *q_data,
 				   struct vchiq_mmal_port *port)
 {
@@ -473,7 +558,7 @@ static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
 		port->es.video.frame_rate.den = 1;
 	} else {
 		/* Compressed format - leave resolution as 0 for decode */
-		if (decode) {
+		if (ctx->dev->decode) {
 			port->es.video.width = 0;
 			port->es.video.height = 0;
 			port->es.video.crop.width = 0;
@@ -802,22 +887,15 @@ static int vidioc_querycap(struct file *file, void *priv,
 	return 0;
 }
 
-static int enum_fmt(struct v4l2_fmtdesc *f, bool decode, bool capture)
+static int enum_fmt(struct v4l2_fmtdesc *f, struct bcm2835_codec_ctx *ctx,
+		    bool capture)
 {
 	struct bcm2835_codec_fmt *fmt;
-	struct bcm2835_codec_fmt_list *fmts = get_format_list(decode, capture);
+	struct bcm2835_codec_fmt_list *fmts =
+					get_format_list(ctx->dev, capture);
 
 	if (f->index < fmts->num_entries) {
 		/* Format found */
-		/* Check format isn't a decode only format when encoding */
-		if (!decode &&
-		    fmts->list[f->index].decode_only)
-			return -EINVAL;
-		/* Check format isn't a decode only format when encoding */
-		if (decode &&
-		    fmts->list[f->index].encode_only)
-			return -EINVAL;
-
 		fmt = &fmts->list[f->index];
 		f->pixelformat = fmt->fourcc;
 		f->flags = fmt->flags;
@@ -833,7 +911,7 @@ static int vidioc_enum_fmt_vid_cap(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	return enum_fmt(f, ctx->dev->decode, true);
+	return enum_fmt(f, ctx, true);
 }
 
 static int vidioc_enum_fmt_vid_out(struct file *file, void *priv,
@@ -841,7 +919,7 @@ static int vidioc_enum_fmt_vid_out(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	return enum_fmt(f, ctx->dev->decode, false);
+	return enum_fmt(f, ctx, false);
 }
 
 static int vidioc_g_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f)
@@ -933,11 +1011,11 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 	struct bcm2835_codec_fmt *fmt;
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	fmt = find_format(f, ctx->dev->decode, true);
+	fmt = find_format(f, ctx->dev, true);
 	if (!fmt) {
-		f->fmt.pix.pixelformat = get_default_format(ctx->dev->decode,
+		f->fmt.pix.pixelformat = get_default_format(ctx->dev,
 							    true)->fourcc;
-		fmt = find_format(f, ctx->dev->decode, true);
+		fmt = find_format(f, ctx->dev, true);
 	}
 
 	return vidioc_try_fmt(f, fmt);
@@ -949,11 +1027,11 @@ static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
 	struct bcm2835_codec_fmt *fmt;
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	fmt = find_format(f, ctx->dev->decode, false);
+	fmt = find_format(f, ctx->dev, false);
 	if (!fmt) {
-		f->fmt.pix.pixelformat = get_default_format(ctx->dev->decode,
+		f->fmt.pix.pixelformat = get_default_format(ctx->dev,
 							    false)->fourcc;
-		fmt = find_format(f, ctx->dev->decode, false);
+		fmt = find_format(f, ctx->dev, false);
 	}
 
 	if (!f->fmt.pix.colorspace)
@@ -988,7 +1066,7 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 		return -EBUSY;
 	}
 
-	q_data->fmt = find_format(f, ctx->dev->decode,
+	q_data->fmt = find_format(f, ctx->dev,
 				  f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE);
 	q_data->crop_width = f->fmt.pix.width;
 	q_data->height = f->fmt.pix.height;
@@ -1041,7 +1119,7 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	if (!port)
 		return 0;
 
-	setup_mmal_port_format(ctx, ctx->dev->decode, q_data, port);
+	setup_mmal_port_format(ctx, q_data, port);
 	ret = vchiq_mmal_port_set_format(ctx->dev->instance, port);
 	if (ret) {
 		v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on port, ret %d\n",
@@ -1064,8 +1142,7 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 		struct bcm2835_codec_q_data *q_data_dst =
 						&ctx->q_data[V4L2_M2M_DST];
 
-		setup_mmal_port_format(ctx, ctx->dev->decode, q_data_dst,
-				       port_dst);
+		setup_mmal_port_format(ctx, q_data_dst, port_dst);
 		ret = vchiq_mmal_port_set_format(ctx->dev->instance, port_dst);
 		if (ret) {
 			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed vchiq_mmal_port_set_format on output port, ret %d\n",
@@ -1636,10 +1713,10 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 				      MMAL_PARAMETER_ZERO_COPY, &enable,
 				      sizeof(enable));
 
-	setup_mmal_port_format(ctx, dev->decode, &ctx->q_data[V4L2_M2M_SRC],
+	setup_mmal_port_format(ctx, &ctx->q_data[V4L2_M2M_SRC],
 			       &ctx->component->input[0]);
 
-	setup_mmal_port_format(ctx, dev->decode, &ctx->q_data[V4L2_M2M_DST],
+	setup_mmal_port_format(ctx, &ctx->q_data[V4L2_M2M_DST],
 			       &ctx->component->output[0]);
 
 	ret = vchiq_mmal_port_set_format(dev->instance,
@@ -2025,8 +2102,8 @@ static int bcm2835_codec_open(struct file *file)
 		goto open_unlock;
 	}
 
-	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev->decode, false);
-	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev->decode, true);
+	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev, false);
+	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev, true);
 	if (dev->decode) {
 		/*
 		 * Input width and height are irrelevant as they will be defined
@@ -2209,13 +2286,130 @@ static const struct v4l2_m2m_ops m2m_ops = {
 	.job_abort	= job_abort,
 };
 
+/* Size of the array to provide to the VPU when asking for the list of supported
+ * formats.
+ * The ISP component currently advertises 33 input formats, so add a small
+ * overhead on that.
+ */
+#define MAX_SUPPORTED_ENCODINGS 40
+
+/* Populate dev->supported_fmts with the formats supported by those ports. */
+static int bcm2835_codec_get_supported_fmts(struct bcm2835_codec_dev *dev)
+{
+	struct bcm2835_codec_fmt *list;
+	struct vchiq_mmal_component *component;
+	u32 fourccs[MAX_SUPPORTED_ENCODINGS];
+	u32 param_size = sizeof(fourccs);
+	unsigned int i, j, num_encodings;
+	int ret;
+
+	ret = vchiq_mmal_component_init(dev->instance,
+					dev->decode ?
+						"ril.video_decode" :
+						"ril.video_encode",
+					&component);
+	if (ret < 0) {
+		v4l2_err(&dev->v4l2_dev, "%s: failed to create component\n",
+			 __func__);
+		return -ENOMEM;
+	}
+
+	ret = vchiq_mmal_port_parameter_get(dev->instance,
+					    &component->input[0],
+					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
+					    &fourccs,
+					    &param_size);
+
+	if (ret) {
+		if (ret == MMAL_MSG_STATUS_ENOSPC) {
+			v4l2_err(&dev->v4l2_dev, "%s: port has more encoding than we provided space for. Some are dropped.\n",
+				 __func__);
+			num_encodings = MAX_SUPPORTED_ENCODINGS;
+		} else {
+			v4l2_err(&dev->v4l2_dev, "%s: get_param ret %u.\n",
+				 __func__, ret);
+			ret = -EINVAL;
+			goto destroy_component;
+		}
+	} else {
+		num_encodings = param_size / sizeof(u32);
+	}
+
+	/* Assume at this stage that all encodings will be supported in V4L2.
+	 * Any that aren't supported will waste a very small amount of memory.
+	 */
+	list = devm_kzalloc(&dev->pdev->dev,
+			    sizeof(struct bcm2835_codec_fmt) * num_encodings,
+			    GFP_KERNEL);
+	if (!list) {
+		ret = -ENOMEM;
+		goto destroy_component;
+	}
+	dev->supported_fmts[0].list = list;
+
+	for (i = 0, j = 0; i < num_encodings; i++) {
+		const struct bcm2835_codec_fmt *fmt = get_fmt(fourccs[i]);
+
+		if (fmt) {
+			list[j] = *fmt;
+			j++;
+		}
+	}
+	dev->supported_fmts[0].num_entries = j;
+
+	param_size = sizeof(fourccs);
+	ret = vchiq_mmal_port_parameter_get(dev->instance,
+					    &component->output[0],
+					    MMAL_PARAMETER_SUPPORTED_ENCODINGS,
+					    &fourccs,
+					    &param_size);
+
+	if (ret) {
+		if (ret == MMAL_MSG_STATUS_ENOSPC) {
+			v4l2_err(&dev->v4l2_dev, "%s: port has more encoding than we provided space for. Some are dropped.\n",
+				 __func__);
+			num_encodings = MAX_SUPPORTED_ENCODINGS;
+		} else {
+			ret = -EINVAL;
+			goto destroy_component;
+		}
+	} else {
+		num_encodings = param_size / sizeof(u32);
+	}
+	/* Assume at this stage that all encodings will be supported in V4L2. */
+	list = devm_kzalloc(&dev->pdev->dev,
+			    sizeof(struct bcm2835_codec_fmt) * num_encodings,
+			    GFP_KERNEL);
+	if (!list) {
+		ret = -ENOMEM;
+		goto destroy_component;
+	}
+	dev->supported_fmts[1].list = list;
+
+	for (i = 0, j = 0; i < num_encodings; i++) {
+		const struct bcm2835_codec_fmt *fmt = get_fmt(fourccs[i]);
+
+		if (fmt) {
+			list[j] = *fmt;
+			j++;
+		}
+	}
+	dev->supported_fmts[1].num_entries = j;
+
+	ret = 0;
+
+destroy_component:
+	vchiq_mmal_component_finalise(dev->instance, component);
+
+	return ret;
+}
+
 static int bcm2835_codec_create(struct platform_device *pdev,
 				struct bcm2835_codec_dev **new_dev,
 				bool decode)
 {
 	struct bcm2835_codec_dev *dev;
 	struct video_device *vfd;
-	struct vchiq_mmal_instance *instance = NULL;
 	int video_nr;
 	int ret;
 
@@ -2227,10 +2421,18 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 
 	dev->decode = decode;
 
-	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
+	ret = vchiq_mmal_init(&dev->instance);
 	if (ret)
 		return ret;
 
+	ret = bcm2835_codec_get_supported_fmts(dev);
+	if (ret)
+		goto vchiq_finalise;
+
+	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
+	if (ret)
+		goto vchiq_finalise;
+
 	atomic_set(&dev->num_inst, 0);
 	mutex_init(&dev->dev_mutex);
 
@@ -2270,12 +2472,7 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 		goto err_m2m;
 	}
 
-	ret = vchiq_mmal_init(&instance);
-	if (ret < 0)
-		goto err_m2m;
-	dev->instance = instance;
-
-	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s codec\n",
+	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n",
 		  dev->decode ? "decode" : "encode");
 	return 0;
 
@@ -2284,7 +2481,8 @@ err_m2m:
 	video_unregister_device(&dev->vfd);
 unreg_dev:
 	v4l2_device_unregister(&dev->v4l2_dev);
-
+vchiq_finalise:
+	vchiq_mmal_finalise(dev->instance);
 	return ret;
 }
 
@@ -2297,6 +2495,7 @@ static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
 	v4l2_m2m_release(dev->m2m_dev);
 	video_unregister_device(&dev->vfd);
 	v4l2_device_unregister(&dev->v4l2_dev);
+	vchiq_mmal_finalise(dev->instance);
 
 	return 0;
 }
-- 
GitLab


From f06f2971bedf29e06a735b10bd629a8ca136b90b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 13 Feb 2019 14:07:52 +0000
Subject: [PATCH 0362/1835] staging: bcm2835_codec: Add support for the ISP as
 an M2M device

The MMAL ISP component can also use this same V4L2 wrapper to
provide a M2M format conversion and resizer.
Instantiate 3 V4L2 devices now, one for each of decode, encode,
and isp.
The ISP currently doesn't expose any controls via V4L2, but this
can be extended in the future.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 132 ++++++++++++------
 1 file changed, 92 insertions(+), 40 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 7b8de26ca43b5..f9fd5e8ac9141 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -54,10 +54,26 @@ static int encode_video_nr = 11;
 module_param(encode_video_nr, int, 0644);
 MODULE_PARM_DESC(encode_video_nr, "encoder video device number");
 
+static int isp_video_nr = 12;
+module_param(isp_video_nr, int, 0644);
+MODULE_PARM_DESC(isp_video_nr, "isp video device number");
+
 static unsigned int debug;
 module_param(debug, uint, 0644);
 MODULE_PARM_DESC(debug, "activates debug info (0-3)");
 
+enum bcm2835_codec_role {
+	DECODE,
+	ENCODE,
+	ISP,
+};
+
+static const char * const components[] = {
+	"ril.video_decode",
+	"ril.video_encode",
+	"ril.isp",
+};
+
 #define MIN_W		32
 #define MIN_H		32
 #define MAX_W		1920
@@ -373,7 +389,7 @@ struct bcm2835_codec_dev {
 	atomic_t		num_inst;
 
 	/* allocated mmal instance and components */
-	bool			decode;	 /* Is this instance a decoder? */
+	enum bcm2835_codec_role	role;
 	/* The list of formats supported on input and output queues. */
 	struct bcm2835_codec_fmt_list	supported_fmts[2];
 
@@ -558,7 +574,7 @@ static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
 		port->es.video.frame_rate.den = 1;
 	} else {
 		/* Compressed format - leave resolution as 0 for decode */
-		if (ctx->dev->decode) {
+		if (ctx->dev->role == DECODE) {
 			port->es.video.width = 0;
 			port->es.video.height = 0;
 			port->es.video.crop.width = 0;
@@ -1089,7 +1105,8 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Calulated bpl as %u, size %u\n",
 		 q_data->bytesperline, q_data->sizeimage);
 
-	if (ctx->dev->decode && q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED &&
+	if (ctx->dev->role == DECODE &&
+	    q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED &&
 	    f->fmt.pix.width && f->fmt.pix.height) {
 		/*
 		 * On the decoder, if provided with a resolution on the input
@@ -1188,7 +1205,8 @@ static int vidioc_g_selection(struct file *file, void *priv,
 	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ?
 								true : false;
 
-	if (capture_queue ^ ctx->dev->decode)
+	if ((ctx->dev->role == DECODE && !capture_queue) ||
+	    (ctx->dev->role == ENCODE && capture_queue))
 		/* OUTPUT on decoder and CAPTURE on encoder are not valid. */
 		return -EINVAL;
 
@@ -1196,7 +1214,8 @@ static int vidioc_g_selection(struct file *file, void *priv,
 	if (!q_data)
 		return -EINVAL;
 
-	if (ctx->dev->decode) {
+	switch (ctx->dev->role) {
+	case DECODE:
 		switch (s->target) {
 		case V4L2_SEL_TGT_COMPOSE_DEFAULT:
 		case V4L2_SEL_TGT_COMPOSE:
@@ -1214,7 +1233,8 @@ static int vidioc_g_selection(struct file *file, void *priv,
 		default:
 			return -EINVAL;
 		}
-	} else {
+		break;
+	case ENCODE:
 		switch (s->target) {
 		case V4L2_SEL_TGT_CROP_DEFAULT:
 		case V4L2_SEL_TGT_CROP_BOUNDS:
@@ -1232,6 +1252,9 @@ static int vidioc_g_selection(struct file *file, void *priv,
 		default:
 			return -EINVAL;
 		}
+		break;
+	case ISP:
+		break;
 	}
 
 	return 0;
@@ -1249,7 +1272,8 @@ static int vidioc_s_selection(struct file *file, void *priv,
 		 __func__, ctx, s->type, q_data, s->target, s->r.left, s->r.top,
 		 s->r.width, s->r.height);
 
-	if (capture_queue ^ ctx->dev->decode)
+	if ((ctx->dev->role == DECODE && !capture_queue) ||
+	    (ctx->dev->role == ENCODE && capture_queue))
 		/* OUTPUT on decoder and CAPTURE on encoder are not valid. */
 		return -EINVAL;
 
@@ -1257,7 +1281,8 @@ static int vidioc_s_selection(struct file *file, void *priv,
 	if (!q_data)
 		return -EINVAL;
 
-	if (ctx->dev->decode) {
+	switch (ctx->dev->role) {
+	case DECODE:
 		switch (s->target) {
 		case V4L2_SEL_TGT_COMPOSE:
 			/* Accept cropped image */
@@ -1272,7 +1297,8 @@ static int vidioc_s_selection(struct file *file, void *priv,
 		default:
 			return -EINVAL;
 		}
-	} else {
+		break;
+	case ENCODE:
 		switch (s->target) {
 		case V4L2_SEL_TGT_CROP:
 			/* Only support crop from (0,0) */
@@ -1287,6 +1313,9 @@ static int vidioc_s_selection(struct file *file, void *priv,
 		default:
 			return -EINVAL;
 		}
+		break;
+	case ISP:
+		break;
 	}
 
 	return 0;
@@ -1490,7 +1519,7 @@ static int vidioc_try_decoder_cmd(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	if (!ctx->dev->decode)
+	if (ctx->dev->role != DECODE)
 		return -EINVAL;
 
 	switch (cmd->cmd) {
@@ -1564,7 +1593,7 @@ static int vidioc_try_encoder_cmd(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	if (ctx->dev->decode)
+	if (ctx->dev->role != ENCODE)
 		return -EINVAL;
 
 	switch (cmd->cmd) {
@@ -1697,12 +1726,11 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 	unsigned int enable = 1;
 	int ret;
 
-	ret = vchiq_mmal_component_init(dev->instance, dev->decode ?
-					"ril.video_decode" : "ril.video_encode",
+	ret = vchiq_mmal_component_init(dev->instance, components[dev->role],
 					&ctx->component);
 	if (ret < 0) {
-		v4l2_err(&dev->v4l2_dev, "%s: failed to create component for %s\n",
-			 __func__, dev->decode ? "decode" : "encode");
+		v4l2_err(&dev->v4l2_dev, "%s: failed to create component %s\n",
+			 __func__, components[dev->role]);
 		return -ENOMEM;
 	}
 
@@ -1729,13 +1757,7 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 	if (ret < 0)
 		goto destroy_component;
 
-	if (dev->decode) {
-		if (ctx->q_data[V4L2_M2M_DST].sizeimage <
-			ctx->component->output[0].minimum_buffer.size)
-			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
-				 ctx->q_data[V4L2_M2M_DST].sizeimage,
-				 ctx->component->output[0].minimum_buffer.size);
-	} else {
+	if (dev->role == ENCODE) {
 		if (ctx->q_data[V4L2_M2M_SRC].sizeimage <
 			ctx->component->output[0].minimum_buffer.size)
 			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
@@ -1744,6 +1766,12 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 
 		/* Now we have a component we can set all the ctrls */
 		bcm2835_codec_set_ctrls(ctx);
+	} else {
+		if (ctx->q_data[V4L2_M2M_DST].sizeimage <
+			ctx->component->output[0].minimum_buffer.size)
+			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
+				 ctx->q_data[V4L2_M2M_DST].sizeimage,
+				 ctx->component->output[0].minimum_buffer.size);
 	}
 
 	return 0;
@@ -2090,8 +2118,6 @@ static int bcm2835_codec_open(struct file *file)
 	struct v4l2_ctrl_handler *hdl;
 	int rc = 0;
 
-	v4l2_dbg(1, debug, &dev->v4l2_dev, "Creating instance for %s\n",
-		 dev->decode ? "decode" : "encode");
 	if (mutex_lock_interruptible(&dev->dev_mutex)) {
 		v4l2_err(&dev->v4l2_dev, "Mutex fail\n");
 		return -ERESTARTSYS;
@@ -2104,7 +2130,8 @@ static int bcm2835_codec_open(struct file *file)
 
 	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev, false);
 	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev, true);
-	if (dev->decode) {
+	switch (dev->role) {
+	case DECODE:
 		/*
 		 * Input width and height are irrelevant as they will be defined
 		 * by the bitstream not the format. Required by V4L2 though.
@@ -2126,7 +2153,8 @@ static int bcm2835_codec_open(struct file *file)
 			get_sizeimage(ctx->q_data[V4L2_M2M_DST].bytesperline,
 				      ctx->q_data[V4L2_M2M_DST].height,
 				      ctx->q_data[V4L2_M2M_DST].fmt);
-	} else {
+		break;
+	case ENCODE:
 		ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
 		ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
 		ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
@@ -2144,6 +2172,9 @@ static int bcm2835_codec_open(struct file *file)
 		ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
 		ctx->q_data[V4L2_M2M_DST].sizeimage =
 						DEF_COMP_BUF_SIZE_720P_OR_LESS;
+		break;
+	case ISP:
+		break;
 	}
 
 	ctx->colorspace = V4L2_COLORSPACE_REC709;
@@ -2154,7 +2185,7 @@ static int bcm2835_codec_open(struct file *file)
 	file->private_data = &ctx->fh;
 	ctx->dev = dev;
 	hdl = &ctx->hdl;
-	if (!dev->decode) {
+	if (dev->role == ENCODE) {
 		/* Encode controls */
 		v4l2_ctrl_handler_init(hdl, 6);
 
@@ -2303,14 +2334,11 @@ static int bcm2835_codec_get_supported_fmts(struct bcm2835_codec_dev *dev)
 	unsigned int i, j, num_encodings;
 	int ret;
 
-	ret = vchiq_mmal_component_init(dev->instance,
-					dev->decode ?
-						"ril.video_decode" :
-						"ril.video_encode",
+	ret = vchiq_mmal_component_init(dev->instance, components[dev->role],
 					&component);
 	if (ret < 0) {
-		v4l2_err(&dev->v4l2_dev, "%s: failed to create component\n",
-			 __func__);
+		v4l2_err(&dev->v4l2_dev, "%s: failed to create component %s\n",
+			 __func__, components[dev->role]);
 		return -ENOMEM;
 	}
 
@@ -2406,12 +2434,13 @@ destroy_component:
 
 static int bcm2835_codec_create(struct platform_device *pdev,
 				struct bcm2835_codec_dev **new_dev,
-				bool decode)
+				enum bcm2835_codec_role role)
 {
 	struct bcm2835_codec_dev *dev;
 	struct video_device *vfd;
 	int video_nr;
 	int ret;
+	const static char *roles[] = {"decode", "encode", "isp"};
 
 	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
 	if (!dev)
@@ -2419,7 +2448,7 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 
 	dev->pdev = pdev;
 
-	dev->decode = decode;
+	dev->role = role;
 
 	ret = vchiq_mmal_init(&dev->instance);
 	if (ret)
@@ -2441,14 +2470,27 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 	vfd->lock = &dev->dev_mutex;
 	vfd->v4l2_dev = &dev->v4l2_dev;
 
-	if (dev->decode) {
+	switch (role) {
+	case DECODE:
 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
 		video_nr = decode_video_nr;
-	} else {
+		break;
+	case ENCODE:
 		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
 		video_nr = encode_video_nr;
+		break;
+	case ISP:
+		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
+		video_nr = isp_video_nr;
+		break;
+	default:
+		ret = -EINVAL;
+		goto unreg_dev;
 	}
 
 	ret = video_register_device(vfd, VFL_TYPE_GRABBER, video_nr);
@@ -2473,7 +2515,7 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 	}
 
 	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n",
-		  dev->decode ? "decode" : "encode");
+		  roles[role]);
 	return 0;
 
 err_m2m:
@@ -2509,11 +2551,15 @@ static int bcm2835_codec_probe(struct platform_device *pdev)
 	if (!drv)
 		return -ENOMEM;
 
-	ret = bcm2835_codec_create(pdev, &drv->encode, false);
+	ret = bcm2835_codec_create(pdev, &drv->decode, DECODE);
 	if (ret)
 		goto out;
 
-	ret = bcm2835_codec_create(pdev, &drv->decode, true);
+	ret = bcm2835_codec_create(pdev, &drv->encode, ENCODE);
+	if (ret)
+		goto out;
+
+	ret = bcm2835_codec_create(pdev, &drv->isp, ISP);
 	if (ret)
 		goto out;
 
@@ -2526,6 +2572,10 @@ out:
 		bcm2835_codec_destroy(drv->encode);
 		drv->encode = NULL;
 	}
+	if (drv->decode) {
+		bcm2835_codec_destroy(drv->decode);
+		drv->decode = NULL;
+	}
 	return ret;
 }
 
@@ -2533,6 +2583,8 @@ static int bcm2835_codec_remove(struct platform_device *pdev)
 {
 	struct bcm2835_codec_driver *drv = platform_get_drvdata(pdev);
 
+	bcm2835_codec_destroy(drv->isp);
+
 	bcm2835_codec_destroy(drv->encode);
 
 	bcm2835_codec_destroy(drv->decode);
-- 
GitLab


From a898c9ff1349af849e9e1c7fe0507bd73efbe893 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 15 Feb 2019 11:36:14 +0000
Subject: [PATCH 0363/1835] staging: bcm2835_codec: Add an option for ignoring
 Bayer formats.

This is a workaround for GStreamer currently not identifying Bayer
as a raw format, therefore any device that supports it does not
match the criteria for v4l2convert.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 29 ++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index f9fd5e8ac9141..5141034835ca9 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -58,6 +58,15 @@ static int isp_video_nr = 12;
 module_param(isp_video_nr, int, 0644);
 MODULE_PARM_DESC(isp_video_nr, "isp video device number");
 
+/*
+ * Workaround for GStreamer v4l2convert component not considering Bayer formats
+ * as raw, and therefore not considering a V4L2 device that supports them as
+ * as a suitable candidate.
+ */
+static bool disable_bayer;
+module_param(disable_bayer, bool, 0644);
+MODULE_PARM_DESC(disable_bayer, "Disable support for Bayer formats");
+
 static unsigned int debug;
 module_param(debug, uint, 0644);
 MODULE_PARM_DESC(debug, "activates debug info (0-3)");
@@ -105,6 +114,7 @@ struct bcm2835_codec_fmt {
 	u32	flags;
 	u32	mmal_fmt;
 	int	size_multiplier_x2;
+	bool	is_bayer;
 };
 
 static const struct bcm2835_codec_fmt supported_formats[] = {
@@ -203,6 +213,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB8,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SBGGR8,
 		.depth			= 8,
@@ -210,6 +221,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR8,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGRBG8,
 		.depth			= 8,
@@ -217,6 +229,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG8,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGBRG8,
 		.depth			= 8,
@@ -224,6 +237,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG8,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		/* 10 bit */
 		.fourcc			= V4L2_PIX_FMT_SRGGB10P,
@@ -232,6 +246,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB10P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SBGGR10P,
 		.depth			= 10,
@@ -239,6 +254,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR10P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGRBG10P,
 		.depth			= 10,
@@ -246,6 +262,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG10P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGBRG10P,
 		.depth			= 10,
@@ -253,6 +270,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG10P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		/* 12 bit */
 		.fourcc			= V4L2_PIX_FMT_SRGGB12P,
@@ -261,6 +279,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB12P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SBGGR12P,
 		.depth			= 12,
@@ -268,6 +287,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR12P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGRBG12P,
 		.depth			= 12,
@@ -275,6 +295,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG12P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGBRG12P,
 		.depth			= 12,
@@ -282,6 +303,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG12P,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		/* 16 bit */
 		.fourcc			= V4L2_PIX_FMT_SRGGB16,
@@ -290,6 +312,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SRGGB16,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SBGGR16,
 		.depth			= 16,
@@ -297,6 +320,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SBGGR16,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGRBG16,
 		.depth			= 16,
@@ -304,6 +328,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGRBG16,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		.fourcc			= V4L2_PIX_FMT_SGBRG16,
 		.depth			= 16,
@@ -311,6 +336,7 @@ static const struct bcm2835_codec_fmt supported_formats[] = {
 		.flags			= 0,
 		.mmal_fmt		= MMAL_ENCODING_BAYER_SGBRG16,
 		.size_multiplier_x2	= 2,
+		.is_bayer		= true,
 	}, {
 		/* Compressed formats */
 		.fourcc			= V4L2_PIX_FMT_H264,
@@ -438,7 +464,8 @@ static const struct bcm2835_codec_fmt *get_fmt(u32 mmal_fmt)
 	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(supported_formats); i++) {
-		if (supported_formats[i].mmal_fmt == mmal_fmt)
+		if (supported_formats[i].mmal_fmt == mmal_fmt &&
+		    (!disable_bayer || !supported_formats[i].is_bayer))
 			return &supported_formats[i];
 	}
 	return NULL;
-- 
GitLab


From ad36e6200d5c25c3a7abcef2c8ff131063f59aa8 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 15 Feb 2019 11:38:45 +0000
Subject: [PATCH 0364/1835] staging: bcm2835_codec: Fix handling of
 VB2_MEMORY_DMABUF buffers

If the queue is configured as VB2_MEMORY_DMABUF then vb2_core_expbuf
fails as it ensures the queue is defined as VB2_MEMORY_MMAP.

Correct the handling so that we unmap the buffer from vcsm and the
VPU on cleanup, and then correctly get the dma buf of the new buffer.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 80 +++++++++++++------
 .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 21 +++--
 .../vc04_services/vchiq-mmal/mmal-vchiq.h     |  2 +
 3 files changed, 73 insertions(+), 30 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 5141034835ca9..67d42bf6251b1 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -1852,6 +1852,18 @@ static int bcm2835_codec_queue_setup(struct vb2_queue *vq,
 	return 0;
 }
 
+static int bcm2835_codec_mmal_buf_cleanup(struct mmal_buffer *mmal_buf)
+{
+	mmal_vchi_buffer_cleanup(mmal_buf);
+
+	if (mmal_buf->dma_buf) {
+		dma_buf_put(mmal_buf->dma_buf);
+		mmal_buf->dma_buf = NULL;
+	}
+
+	return 0;
+}
+
 static int bcm2835_codec_buf_init(struct vb2_buffer *vb)
 {
 	struct bcm2835_codec_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
@@ -1880,6 +1892,7 @@ static int bcm2835_codec_buf_prepare(struct vb2_buffer *vb)
 						   vb);
 	struct m2m_mmal_buffer *buf = container_of(m2m, struct m2m_mmal_buffer,
 						   m2m);
+	struct dma_buf *dma_buf;
 	int ret;
 
 	v4l2_dbg(4, debug, &ctx->dev->v4l2_dev, "%s: type: %d ptr %p\n",
@@ -1906,20 +1919,48 @@ static int bcm2835_codec_buf_prepare(struct vb2_buffer *vb)
 	if (!V4L2_TYPE_IS_OUTPUT(vb->vb2_queue->type))
 		vb2_set_plane_payload(vb, 0, q_data->sizeimage);
 
-	/*
-	 * We want to do this at init, but vb2_core_expbuf checks that the
-	 * index < q->num_buffers, and q->num_buffers only gets updated once
-	 * all the buffers are allocated.
-	 */
-	if (!buf->mmal.dma_buf) {
-		ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
-					     vb->vb2_queue->type, vb->index, 0,
-					     O_CLOEXEC, &buf->mmal.dma_buf);
-		if (ret)
-			v4l2_err(&ctx->dev->v4l2_dev, "%s: Failed to expbuf idx %d, ret %d\n",
-				 __func__, vb->index, ret);
-	} else {
+	switch (vb->memory) {
+	case VB2_MEMORY_DMABUF:
+		dma_buf = dma_buf_get(vb->planes[0].m.fd);
+
+		if (dma_buf != buf->mmal.dma_buf) {
+			/* dmabuf either hasn't already been mapped, or it has
+			 * changed.
+			 */
+			if (buf->mmal.dma_buf) {
+				v4l2_err(&ctx->dev->v4l2_dev,
+					 "%s Buffer changed - why did the core not call cleanup?\n",
+					 __func__);
+				bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
+			}
+
+			buf->mmal.dma_buf = dma_buf;
+		}
 		ret = 0;
+		break;
+	case VB2_MEMORY_MMAP:
+		/*
+		 * We want to do this at init, but vb2_core_expbuf checks that
+		 * the index < q->num_buffers, and q->num_buffers only gets
+		 * updated once all the buffers are allocated.
+		 */
+		if (!buf->mmal.dma_buf) {
+			ret = vb2_core_expbuf_dmabuf(vb->vb2_queue,
+						     vb->vb2_queue->type,
+						     vb->index, 0,
+						     O_CLOEXEC,
+						     &buf->mmal.dma_buf);
+			if (ret)
+				v4l2_err(&ctx->dev->v4l2_dev,
+					 "%s: Failed to expbuf idx %d, ret %d\n",
+					 __func__, vb->index, ret);
+		} else {
+			ret = 0;
+		}
+		break;
+	default:
+		ret = -EINVAL;
+		break;
 	}
 
 	return ret;
@@ -1948,12 +1989,7 @@ static void bcm2835_codec_buffer_cleanup(struct vb2_buffer *vb)
 	v4l2_dbg(2, debug, &ctx->dev->v4l2_dev, "%s: ctx:%p, vb %p\n",
 		 __func__, ctx, vb);
 
-	mmal_vchi_buffer_cleanup(&buf->mmal);
-
-	if (buf->mmal.dma_buf) {
-		dma_buf_put(buf->mmal.dma_buf);
-		buf->mmal.dma_buf = NULL;
-	}
+	bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
 }
 
 static int bcm2835_codec_start_streaming(struct vb2_queue *q,
@@ -2067,11 +2103,7 @@ static void bcm2835_codec_stop_streaming(struct vb2_queue *q)
 		m2m = container_of(vb2, struct v4l2_m2m_buffer, vb);
 		buf = container_of(m2m, struct m2m_mmal_buffer, m2m);
 
-		mmal_vchi_buffer_cleanup(&buf->mmal);
-		if (buf->mmal.dma_buf) {
-			dma_buf_put(buf->mmal.dma_buf);
-			buf->mmal.dma_buf = NULL;
-		}
+		bcm2835_codec_mmal_buf_cleanup(&buf->mmal);
 	}
 
 	/* If both ports disabled, then disable the component */
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 108df9b7f8344..7a48877ffff5a 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1784,13 +1784,9 @@ int mmal_vchi_buffer_init(struct vchiq_mmal_instance *instance,
 }
 EXPORT_SYMBOL_GPL(mmal_vchi_buffer_init);
 
-int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
+int mmal_vchi_buffer_unmap(struct mmal_buffer *buf)
 {
-	struct mmal_msg_context *msg_context = buf->msg_context;
-
-	if (msg_context)
-		release_msg_context(msg_context);
-	buf->msg_context = NULL;
+	int ret = 0;
 
 	if (buf->vcsm_handle) {
 		int ret;
@@ -1802,6 +1798,19 @@ int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
 			pr_err("%s: vcsm_free failed, ret %d\n", __func__, ret);
 		buf->vcsm_handle = 0;
 	}
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mmal_vchi_buffer_unmap);
+
+int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf)
+{
+	struct mmal_msg_context *msg_context = buf->msg_context;
+
+	if (msg_context)
+		release_msg_context(msg_context);
+	buf->msg_context = NULL;
+
+	mmal_vchi_buffer_unmap(buf);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(mmal_vchi_buffer_cleanup);
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
index be2efbccc2002..a76e6e72cde51 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.h
@@ -167,6 +167,8 @@ int vchiq_mmal_submit_buffer(struct vchiq_mmal_instance *instance,
 			     struct vchiq_mmal_port *port,
 			     struct mmal_buffer *buf);
 
+int mmal_vchi_buffer_unmap(struct mmal_buffer *buf);
+
 int mmal_vchi_buffer_init(struct vchiq_mmal_instance *instance,
 			  struct mmal_buffer *buf);
 int mmal_vchi_buffer_cleanup(struct mmal_buffer *buf);
-- 
GitLab


From 56f14961fbe66470553af6c5b4356c2335df1e52 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 18 Feb 2019 15:52:29 +0000
Subject: [PATCH 0365/1835] staging: mmal-vchiq: Update mmal_parameters.h with
 recently defined params

mmal_parameters.h hasn't been updated to reflect additions made
over the last few years. Update it to reflect the currently
supported parameters.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vchiq-mmal/mmal-parameters.h              | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
index af9b5b5b181dd..416b4e1f0bb82 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
@@ -580,7 +580,37 @@ enum mmal_parameter_video_type {
 	MMAL_PARAMETER_VIDEO_ENCODE_H264_LOW_DELAY_HRD_FLAG,
 
 	/**< @ref MMAL_PARAMETER_BOOLEAN_T */
-	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER
+	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_HEADER,
+
+	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T. */
+	MMAL_PARAMETER_VIDEO_ENCODE_SEI_ENABLE,
+
+	/**< Take a @ref MMAL_PARAMETER_BOOLEAN_T. */
+	MMAL_PARAMETER_VIDEO_ENCODE_INLINE_VECTORS,
+
+	/**< Take a @ref MMAL_PARAMETER_VIDEO_RENDER_STATS_T. */
+	MMAL_PARAMETER_VIDEO_RENDER_STATS,
+
+	/**< Take a @ref MMAL_PARAMETER_VIDEO_INTERLACE_TYPE_T. */
+	MMAL_PARAMETER_VIDEO_INTERLACE_TYPE,
+
+	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_VIDEO_INTERPOLATE_TIMESTAMPS,
+
+	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_VIDEO_ENCODE_SPS_TIMING,
+
+	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_VIDEO_MAX_NUM_CALLBACKS,
+
+	/**< Takes a @ref MMAL_PARAMETER_SOURCE_PATTERN_T */
+	MMAL_PARAMETER_VIDEO_SOURCE_PATTERN,
+
+	/**< Takes a @ref MMAL_PARAMETER_BOOLEAN_T */
+	MMAL_PARAMETER_VIDEO_ENCODE_SEPARATE_NAL_BUFS,
+
+	/**< Takes a @ref MMAL_PARAMETER_UINT32_T */
+	MMAL_PARAMETER_VIDEO_DROPPABLE_PFRAME_LENGTH,
 };
 
 /** Valid mirror modes */
-- 
GitLab


From 50af417692f6ee6010b153e7ddab2a2e9ab3e9cc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 18 Feb 2019 15:56:42 +0000
Subject: [PATCH 0366/1835] staging: bcm2835_codec: Include timing info in SPS
 headers

Inserting timing information into the VUI block of the SPS is
optional with the VPU encoder.
GStreamer appears to require them when using V4L2 M2M, therefore
set the option to enable them from the encoder.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 67d42bf6251b1..eb5c07bc73d06 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -1785,6 +1785,8 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 		goto destroy_component;
 
 	if (dev->role == ENCODE) {
+		u32 param = 1;
+
 		if (ctx->q_data[V4L2_M2M_SRC].sizeimage <
 			ctx->component->output[0].minimum_buffer.size)
 			v4l2_err(&dev->v4l2_dev, "buffer size mismatch sizeimage %u < min size %u\n",
@@ -1793,6 +1795,16 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 
 		/* Now we have a component we can set all the ctrls */
 		bcm2835_codec_set_ctrls(ctx);
+
+		/* Enable SPS Timing header so framerate information is encoded
+		 * in the H264 header.
+		 */
+		vchiq_mmal_port_parameter_set(
+					ctx->dev->instance,
+					&ctx->component->output[0],
+					MMAL_PARAMETER_VIDEO_ENCODE_SPS_TIMING,
+					&param, sizeof(param));
+
 	} else {
 		if (ctx->q_data[V4L2_M2M_DST].sizeimage <
 			ctx->component->output[0].minimum_buffer.size)
-- 
GitLab


From 1af224678deb0542cd902e7d4fcd4f0ee38c56b1 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 5 Feb 2018 18:53:18 +0000
Subject: [PATCH 0367/1835] drm/vc4: Don't wait for vblank on fkms cursor
 updates.

We don't use the same async update path between fkms and normal kms,
and the normal kms workaround ended up making us wait.  This became a
larger problem in rpi-4.14.y, as the USB HID update rate throttling
got (accidentally?) dropped.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index baf9bd7931ac9..f8c6cafff14a0 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -222,7 +222,8 @@ static int vc4_atomic_commit(struct drm_device *dev,
 	 * drm_atomic_helper_setup_commit() from auto-completing
 	 * commit->flip_done.
 	 */
-	state->legacy_cursor_update = false;
+	if (!vc4->firmware_kms)
+		state->legacy_cursor_update = false;
 	ret = drm_atomic_helper_setup_commit(state, nonblock);
 	if (ret)
 		return ret;
-- 
GitLab


From 0b9d83dcf3881234df03686cb8e66e26d27e0518 Mon Sep 17 00:00:00 2001
From: Giedrius <giedrius@blokas.io>
Date: Wed, 27 Feb 2019 14:27:28 +0000
Subject: [PATCH 0368/1835] Fix for Pisound kernel module in Real Time kernel
 configuration.

When handler of data_available interrupt is fired, queue_work ends up
getting called and it can block on a spin lock which is not allowed in
interrupt context. The fix was to run the handler from a thread context
instead.
---
 sound/soc/bcm/pisound.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/bcm/pisound.c b/sound/soc/bcm/pisound.c
index ab9ea1f32931a..1c5100bfd8bc0 100644
--- a/sound/soc/bcm/pisound.c
+++ b/sound/soc/bcm/pisound.c
@@ -1,6 +1,6 @@
 /*
  * Pisound Linux kernel module.
- * Copyright (C) 2016-2017  Vilniaus Blokas UAB, https://blokas.io/pisound
+ * Copyright (C) 2016-2019  Vilniaus Blokas UAB, https://blokas.io/pisound
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -532,10 +532,10 @@ static void pisnd_spi_gpio_uninit(void)
 
 static int pisnd_spi_gpio_irq_init(struct device *dev)
 {
-	return request_irq(
-		gpiod_to_irq(data_available),
+	return request_threaded_irq(
+		gpiod_to_irq(data_available), NULL,
 		data_available_interrupt_handler,
-		IRQF_TIMER | IRQF_TRIGGER_RISING,
+		IRQF_TIMER | IRQF_TRIGGER_RISING | IRQF_ONESHOT,
 		"data_available_int",
 		NULL
 		);
-- 
GitLab


From 03ce33b0dd4baae60435b50d3c205bdc0921a1cb Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 27 Feb 2019 20:08:48 +0000
Subject: [PATCH 0369/1835] config: Add CONFIG_FB_TFT_SH1106=m

See: https://github.com/raspberrypi/linux/issues/2876

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 3 ++-
 arch/arm/configs/bcmrpi_defconfig    | 3 ++-
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index eb19afcc8249b..2a172664a8203 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -905,8 +905,8 @@ CONFIG_SND_BCM2835_SOC_I2S=m
 CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
-CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
@@ -1203,6 +1203,7 @@ CONFIG_FB_TFT_PCD8544=m
 CONFIG_FB_TFT_RA8875=m
 CONFIG_FB_TFT_S6D02A1=m
 CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SH1106=m
 CONFIG_FB_TFT_SSD1289=m
 CONFIG_FB_TFT_SSD1306=m
 CONFIG_FB_TFT_SSD1331=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 66c67de30264d..edce2eb181297 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -898,8 +898,8 @@ CONFIG_SND_BCM2835_SOC_I2S=m
 CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
-CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
@@ -1196,6 +1196,7 @@ CONFIG_FB_TFT_PCD8544=m
 CONFIG_FB_TFT_RA8875=m
 CONFIG_FB_TFT_S6D02A1=m
 CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SH1106=m
 CONFIG_FB_TFT_SSD1289=m
 CONFIG_FB_TFT_SSD1306=m
 CONFIG_FB_TFT_SSD1331=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 2926a32f96971..2f7d6e37aea2f 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1061,6 +1061,7 @@ CONFIG_FB_TFT_PCD8544=m
 CONFIG_FB_TFT_RA8875=m
 CONFIG_FB_TFT_S6D02A1=m
 CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SH1106=m
 CONFIG_FB_TFT_SSD1289=m
 CONFIG_FB_TFT_SSD1306=m
 CONFIG_FB_TFT_SSD1331=m
-- 
GitLab


From 3f89d98c2b8cc8036a06c09361e6cf5f3aa74a2b Mon Sep 17 00:00:00 2001
From: Jaikumar <jaikumar@cem-solutions.net>
Date: Thu, 7 Jun 2018 21:22:45 +0530
Subject: [PATCH 0370/1835] Added mute stream func

Signed-off-by: Jaikumar <jaikumar@cem-solutions.net>
---
 sound/soc/bcm/allo-katana-codec.c | 60 ++++++++++++++++++++++---------
 1 file changed, 44 insertions(+), 16 deletions(-)

diff --git a/sound/soc/bcm/allo-katana-codec.c b/sound/soc/bcm/allo-katana-codec.c
index 99d80767fac5b..228531dd785ee 100644
--- a/sound/soc/bcm/allo-katana-codec.c
+++ b/sound/soc/bcm/allo-katana-codec.c
@@ -31,21 +31,23 @@
 
 #define KATANA_CODEC_CHIP_ID		0x30
 #define KATANA_CODEC_VIRT_BASE		0x100
-#define KATANA_CODEC_PAGE			0
+#define KATANA_CODEC_PAGE		0
 
 #define KATANA_CODEC_CHIP_ID_REG	(KATANA_CODEC_VIRT_BASE + 0)
-#define KATANA_CODEC_RESET			(KATANA_CODEC_VIRT_BASE + 1)
+#define KATANA_CODEC_RESET		(KATANA_CODEC_VIRT_BASE + 1)
 #define KATANA_CODEC_VOLUME_1		(KATANA_CODEC_VIRT_BASE + 2)
 #define KATANA_CODEC_VOLUME_2		(KATANA_CODEC_VIRT_BASE + 3)
-#define KATANA_CODEC_MUTE			(KATANA_CODEC_VIRT_BASE + 4)
+#define KATANA_CODEC_MUTE		(KATANA_CODEC_VIRT_BASE + 4)
 #define KATANA_CODEC_DSP_PROGRAM	(KATANA_CODEC_VIRT_BASE + 5)
 #define KATANA_CODEC_DEEMPHASIS		(KATANA_CODEC_VIRT_BASE + 6)
-#define KATANA_CODEC_DOP			(KATANA_CODEC_VIRT_BASE + 7)
-#define KATANA_CODEC_FORMAT			(KATANA_CODEC_VIRT_BASE + 8)
+#define KATANA_CODEC_DOP		(KATANA_CODEC_VIRT_BASE + 7)
+#define KATANA_CODEC_FORMAT		(KATANA_CODEC_VIRT_BASE + 8)
 #define KATANA_CODEC_COMMAND		(KATANA_CODEC_VIRT_BASE + 9)
-#define KATANA_CODEC_MAX_REGISTER	(KATANA_CODEC_VIRT_BASE + 9)
+#define KATANA_CODEC_MUTE_STREAM	(KATANA_CODEC_VIRT_BASE + 10)
 
-#define KATANA_CODEC_FMT			0xff
+#define KATANA_CODEC_MAX_REGISTER	(KATANA_CODEC_VIRT_BASE + 10)
+
+#define KATANA_CODEC_FMT		0xff
 #define KATANA_CODEC_CHAN_MONO		0x00
 #define KATANA_CODEC_CHAN_STEREO	0x80
 #define KATANA_CODEC_ALEN_16		0x10
@@ -135,7 +137,8 @@ static const struct snd_kcontrol_new katana_codec_controls[] = {
 	SOC_SINGLE("DoP Playback Switch", KATANA_CODEC_DOP, 0, 1, 1)
 };
 
-static bool katana_codec_readable_register(struct device *dev, unsigned int reg)
+static bool katana_codec_readable_register(struct device *dev,
+				unsigned int reg)
 {
 	switch (reg) {
 	case KATANA_CODEC_CHIP_ID_REG:
@@ -150,13 +153,15 @@ static int katana_codec_hw_params(struct snd_pcm_substream *substream,
 			     struct snd_soc_dai *dai)
 {
 	struct snd_soc_component *component = dai->component;
-	struct katana_codec_priv *katana_codec = snd_soc_component_get_drvdata(component);
+	struct katana_codec_priv *katana_codec =
+		snd_soc_component_get_drvdata(component);
 	int fmt = 0;
 	int ret;
 
-	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels\n",
+	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels, %u bits\n",
 			params_rate(params),
-			params_channels(params));
+			params_channels(params),
+			params_width(params));
 
 	switch (katana_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
 	case SND_SOC_DAIFMT_CBM_CFM: // master
@@ -212,13 +217,17 @@ static int katana_codec_hw_params(struct snd_pcm_substream *substream,
 			return -EINVAL;
 		}
 
-		ret = regmap_write(katana_codec->regmap, KATANA_CODEC_FORMAT, fmt);
+		ret = regmap_write(katana_codec->regmap, KATANA_CODEC_FORMAT,
+					fmt);
 		if (ret != 0) {
 			dev_err(component->card->dev, "Failed to set format: %d\n", ret);
 			return ret;
 		}
 		break;
 
+	case SND_SOC_DAIFMT_CBS_CFS:
+		break;
+
 	default:
 		return -EINVAL;
 	}
@@ -229,14 +238,33 @@ static int katana_codec_hw_params(struct snd_pcm_substream *substream,
 static int katana_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 {
 	struct snd_soc_component *component = dai->component;
-	struct katana_codec_priv *katana_codec = snd_soc_component_get_drvdata(component);
+	struct katana_codec_priv *katana_codec =
+		snd_soc_component_get_drvdata(component);
 
 	katana_codec->fmt = fmt;
 
 	return 0;
 }
 
+int katana_codec_dai_mute_stream(struct snd_soc_dai *dai, int mute,
+						int stream)
+{
+	struct snd_soc_component *component = dai->component;
+	struct katana_codec_priv *katana_codec =
+		snd_soc_component_get_drvdata(component);
+	int ret = 0;
+
+	ret = regmap_write(katana_codec->regmap, KATANA_CODEC_MUTE_STREAM,
+				mute);
+	if (ret != 0) {
+		dev_err(component->card->dev, "Failed to set mute: %d\n", ret);
+		return ret;
+	}
+	return ret;
+}
+
 static const struct snd_soc_dai_ops katana_codec_dai_ops = {
+	.mute_stream = katana_codec_dai_mute_stream,
 	.hw_params = katana_codec_hw_params,
 	.set_fmt = katana_codec_set_fmt,
 };
@@ -300,7 +328,7 @@ static int allo_katana_component_probe(struct i2c_client *i2c,
 		return PTR_ERR(regmap);
 
 	katana_codec = devm_kzalloc(dev, sizeof(struct katana_codec_priv),
-								GFP_KERNEL);
+					GFP_KERNEL);
 	if (!katana_codec)
 		return -ENOMEM;
 
@@ -348,8 +376,8 @@ static struct i2c_driver allo_katana_component_driver = {
 	.remove		= allo_katana_component_remove,
 	.id_table	= allo_katana_component_id,
 	.driver		= {
-		.name	= "allo-katana-codec",
-		.of_match_table = allo_katana_codec_of_match,
+	.name		= "allo-katana-codec",
+	.of_match_table = allo_katana_codec_of_match,
 	},
 };
 
-- 
GitLab


From b8a8e5729e2df23d436ff904add6ea3b88f96a18 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 5 Mar 2019 09:51:22 +0000
Subject: [PATCH 0371/1835] lan78xx: EEE support is now a PHY property

Now that EEE support is a property of the PHY, use the PHY's DT node
when querying the EEE-related properties.

See: https://github.com/raspberrypi/linux/issues/2882

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/usb/lan78xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 86d2f1d4c7586..3387f44b132fe 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2191,7 +2191,7 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
 	mii_adv = (u32)mii_advertise_flowctrl(dev->fc_request_control);
 	phydev->advertising |= mii_adv_to_ethtool_adv_t(mii_adv);
 
-	if (of_property_read_bool(dev->udev->dev.of_node,
+	if (of_property_read_bool(phydev->mdio.dev.of_node,
 				  "microchip,eee-enabled")) {
 		struct ethtool_eee edata;
 		memset(&edata, 0, sizeof(edata));
-- 
GitLab


From 402c183b75ca5f886c8721e0b2a80ddc33718c18 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 27 Feb 2019 17:30:33 +0000
Subject: [PATCH 0372/1835] video: bcm2708_fb: Try allocating on the ARM and
 passing to VPU

Currently the VPU allocates the contiguous buffer for the
framebuffer.
Try an alternate path first where we use dma_alloc_coherent
and pass the buffer to the VPU. Should the VPU firmware not
support that path, then free the buffer and revert to the
old behaviour of using the VPU allocation.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/video/fbdev/bcm2708_fb.c           | 102 ++++++++++++++++++---
 include/soc/bcm2835/raspberrypi-firmware.h |   1 +
 2 files changed, 91 insertions(+), 12 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 209a1504a1608..0cdec747d5e35 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -98,6 +98,11 @@ struct bcm2708_fb {
 	struct bcm2708_fb_stats stats;
 	unsigned long fb_bus_address;
 	struct { u32 base, length; } gpu;
+
+	bool disable_arm_alloc;
+	unsigned int image_size;
+	dma_addr_t dma_addr;
+	void *cpuaddr;
 };
 
 #define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
@@ -283,23 +288,88 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 			.xoffset = info->var.xoffset,
 			.yoffset = info->var.yoffset,
 		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
-			.base = 0,
-			.screen_size = 0,
-		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH, 4, 0 },
-			.pitch = 0,
+			/* base and screen_size will be initialised later */
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
+			/* pitch will be initialised later */
 	};
-	int ret;
+	int ret, image_size;
+
 
 	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
 		    info->var.xres, info->var.yres, info->var.xres_virtual,
 		    info->var.yres_virtual, (int)info->screen_size,
 		    info->var.bits_per_pixel);
 
-	ret = rpi_firmware_property_list(fb->fw, &fbinfo, sizeof(fbinfo));
+	/* Try allocating our own buffer. We can specify all the parameters */
+	image_size = ((info->var.xres * info->var.yres) *
+		      info->var.bits_per_pixel) >> 3;
+
+	if (!fb->disable_arm_alloc &&
+	    (image_size != fb->image_size || !fb->dma_addr)) {
+		if (fb->dma_addr) {
+			dma_free_coherent(info->device, fb->image_size,
+					  fb->cpuaddr, fb->dma_addr);
+			fb->image_size = 0;
+			fb->cpuaddr = NULL;
+			fb->dma_addr = 0;
+		}
+
+		fb->cpuaddr = dma_alloc_coherent(info->device, image_size,
+						 &fb->dma_addr, GFP_KERNEL);
+
+		if (!fb->cpuaddr) {
+			fb->dma_addr = 0;
+			fb->disable_arm_alloc = true;
+		} else {
+			fb->image_size = image_size;
+		}
+	}
+
+	if (fb->cpuaddr) {
+		fbinfo.base = fb->dma_addr;
+		fbinfo.screen_size = image_size;
+		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
+
+		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
+						 sizeof(fbinfo));
+		if (ret || fbinfo.base != fb->dma_addr) {
+			/* Firmware either failed, or assigned a different base
+			 * address (ie it doesn't support being passed an FB
+			 * allocation).
+			 * Destroy the allocation, and don't try again.
+			 */
+			dma_free_coherent(info->device, fb->image_size,
+					  fb->cpuaddr, fb->dma_addr);
+			fb->image_size = 0;
+			fb->cpuaddr = NULL;
+			fb->dma_addr = 0;
+			fb->disable_arm_alloc = true;
+		}
+	} else {
+		/* Our allocation failed - drop into the old scheme of
+		 * allocation by the VPU.
+		 */
+		ret = -ENOMEM;
+	}
+
 	if (ret) {
-		dev_err(info->device,
-			"Failed to allocate GPU framebuffer (%d)\n", ret);
-		return ret;
+		/* Old scheme:
+		 * - FRAMEBUFFER_ALLOCATE passes 0 for base and screen_size.
+		 * - GET_PITCH instead of SET_PITCH.
+		 */
+		fbinfo.base = 0;
+		fbinfo.screen_size = 0;
+		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
+		fbinfo.pitch = 0;
+
+		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
+						 sizeof(fbinfo));
+		if (ret) {
+			dev_err(info->device,
+				"Failed to allocate GPU framebuffer (%d)\n",
+				ret);
+			return ret;
+		}
 	}
 
 	if (info->var.bits_per_pixel <= 8)
@@ -314,9 +384,17 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 	fb->fb.fix.smem_start = fbinfo.base;
 	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
 	fb->fb.screen_size = fbinfo.screen_size;
-	if (fb->fb.screen_base)
-		iounmap(fb->fb.screen_base);
-	fb->fb.screen_base = ioremap_wc(fbinfo.base, fb->fb.screen_size);
+
+	if (!fb->dma_addr) {
+		if (fb->fb.screen_base)
+			iounmap(fb->fb.screen_base);
+
+		fb->fb.screen_base = ioremap_wc(fbinfo.base,
+						fb->fb.screen_size);
+	} else {
+		fb->fb.screen_base = fb->cpuaddr;
+	}
+
 	if (!fb->fb.screen_base) {
 		/* the console may currently be locked */
 		console_trylock();
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 23b9d356537f3..e35a89eeee265 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -128,6 +128,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PIXEL_ORDER =            0x00048006,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE =             0x00048007,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH =                  0x00048008,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
-- 
GitLab


From 1759549b7c16e0bc47b821ca788a1462448db495 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 8 Mar 2019 10:38:59 +0000
Subject: [PATCH 0373/1835] staging: vc_sm_cma: Remove erroneous
 misc_deregister

Code from the misc /dev node was still present in
bcm2835_vc_sm_cma_remove, which caused a NULL deref.
Remove it.

See #2885.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 7ac6b806b862a..4bc738a2abf34 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -25,7 +25,6 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
-#include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/of_device.h>
@@ -72,7 +71,6 @@ struct sm_pde_t {
 struct sm_state_t {
 	struct platform_device *pdev;
 
-	struct miscdevice dev;
 	struct sm_instance *sm_handle;	/* Handle for videocore service. */
 
 	spinlock_t kernelid_map_lock;	/* Spinlock protecting kernelid_map */
@@ -758,9 +756,6 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 {
 	pr_debug("[%s]: start\n", __func__);
 	if (sm_inited) {
-		/* Remove shared memory device. */
-		misc_deregister(&sm_state->dev);
-
 		/* Remove all proc entries. */
 		//debugfs_remove_recursive(sm_state->dir_root);
 
-- 
GitLab


From f415f6d9a61b6caadcd09d3816179ee31e43e835 Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Mon, 18 Mar 2019 17:14:51 +0000
Subject: [PATCH 0374/1835] vcsm: Fix makefile include on out-of-tree builds

The vc_sm module tries to include the 'fs' directory from the
$(srctree). $(srctree) is already provided by the build system, and
causes the include path to be duplicated.

With -Werror this fails to compile.

Remove the unnecessary variable.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 drivers/char/broadcom/vc_sm/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/broadcom/vc_sm/Makefile b/drivers/char/broadcom/vc_sm/Makefile
index 19ce263bc273d..20b7646fe4b64 100644
--- a/drivers/char/broadcom/vc_sm/Makefile
+++ b/drivers/char/broadcom/vc_sm/Makefile
@@ -1,5 +1,5 @@
 ccflags-$(CONFIG_BCM_VC_SM) += -Werror -Wall -Wstrict-prototypes -Wno-trigraphs -O2
-ccflags-$(CONFIG_BCM_VC_SM) += -I"drivers/staging/vc04_services" -I"drivers/staging/vc04_services/interface/vchi" -I"drivers/staging/vc04_services/interface/vchiq_arm" -I"$(srctree)/fs/"
+ccflags-$(CONFIG_BCM_VC_SM) += -I"drivers/staging/vc04_services" -I"drivers/staging/vc04_services/interface/vchi" -I"drivers/staging/vc04_services/interface/vchiq_arm" -I"fs"
 ccflags-$(CONFIG_BCM_VC_SM) += -DOS_ASSERT_FAILURE -D__STDC_VERSION=199901L -D__STDC_VERSION__=199901L -D__VCCOREVER__=0 -D__KERNEL__ -D__linux__
 
 obj-$(CONFIG_BCM_VC_SM) := vc-sm.o
-- 
GitLab


From e3b0f52c6f00f76ec8dfb28c5e086303943f29eb Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Mon, 18 Mar 2019 17:16:41 +0000
Subject: [PATCH 0375/1835] vcsm: Remove set but unused variable

The 'success' variable is set by the call to vchi_service_close() but never checked.
Remove it, keeping the call in place.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 drivers/char/broadcom/vc_sm/vc_vchi_sm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/char/broadcom/vc_sm/vc_vchi_sm.c b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
index f8b909a09adb0..ca4ec40bb5fb2 100644
--- a/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
+++ b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
@@ -361,11 +361,9 @@ int vc_vchi_sm_stop(struct sm_instance **handle)
 
 	/* Close all VCHI service connections */
 	for (i = 0; i < instance->num_connections; i++) {
-		int32_t success;
-
 		vchi_service_use(instance->vchi_handle[i]);
 
-		success = vchi_service_close(instance->vchi_handle[i]);
+		vchi_service_close(instance->vchi_handle[i]);
 	}
 
 	kfree(instance);
-- 
GitLab


From ee047646b9300c8260268cdf5d64d735a6594483 Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Mon, 18 Mar 2019 17:17:40 +0000
Subject: [PATCH 0376/1835] vcsm: Reduce scope of local functions

The functions:

  vc_vchi_sm_send_msg
  vc_sm_ioctl_alloc
  vc_sm_ioctl_alloc_share
  vc_sm_ioctl_import_dmabuf

Are declared without a prototype. They are not used outside of this
module, thus - convert them to static functions.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 drivers/char/broadcom/vc_sm/vc_vchi_sm.c |  2 +-
 drivers/char/broadcom/vc_sm/vmcs_sm.c    | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/char/broadcom/vc_sm/vc_vchi_sm.c b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
index ca4ec40bb5fb2..c3742e1656ae4 100644
--- a/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
+++ b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
@@ -375,7 +375,7 @@ lock:
 	return -EINVAL;
 }
 
-int vc_vchi_sm_send_msg(struct sm_instance *handle,
+static int vc_vchi_sm_send_msg(struct sm_instance *handle,
 			enum vc_sm_msg_type msg_id,
 			void *msg, uint32_t msg_size,
 			void *result, uint32_t result_size,
diff --git a/drivers/char/broadcom/vc_sm/vmcs_sm.c b/drivers/char/broadcom/vc_sm/vmcs_sm.c
index 56a21658b5383..1bbe11dc1e334 100644
--- a/drivers/char/broadcom/vc_sm/vmcs_sm.c
+++ b/drivers/char/broadcom/vc_sm/vmcs_sm.c
@@ -1574,8 +1574,8 @@ error:
 }
 
 /* Allocate a shared memory handle and block. */
-int vc_sm_ioctl_alloc(struct sm_priv_data_t *private,
-		      struct vmcs_sm_ioctl_alloc *ioparam)
+static int vc_sm_ioctl_alloc(struct sm_priv_data_t *private,
+			     struct vmcs_sm_ioctl_alloc *ioparam)
 {
 	int ret = 0;
 	int status;
@@ -1685,8 +1685,8 @@ error:
 }
 
 /* Share an allocate memory handle and block.*/
-int vc_sm_ioctl_alloc_share(struct sm_priv_data_t *private,
-			    struct vmcs_sm_ioctl_alloc_share *ioparam)
+static int vc_sm_ioctl_alloc_share(struct sm_priv_data_t *private,
+				   struct vmcs_sm_ioctl_alloc_share *ioparam)
 {
 	struct sm_resource_t *resource, *shared_resource;
 	int ret = 0;
@@ -2200,9 +2200,9 @@ error:
 }
 
 /* Import a contiguous block of memory to be shared with VC. */
-int vc_sm_ioctl_import_dmabuf(struct sm_priv_data_t *private,
-			      struct vmcs_sm_ioctl_import_dmabuf *ioparam,
-			      struct dma_buf *src_dma_buf)
+static int vc_sm_ioctl_import_dmabuf(struct sm_priv_data_t *private,
+				     struct vmcs_sm_ioctl_import_dmabuf *ioparam,
+				     struct dma_buf *src_dma_buf)
 {
 	int ret = 0;
 	int status;
-- 
GitLab


From 577caecb26a35e33d682b5f8fa5bc6189a3ee2f1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 19 Mar 2019 17:55:09 +0000
Subject: [PATCH 0377/1835] staging: bcm2835-codec: NULL component handle on
 queue_setup failure

queue_setup tries creating the relevant MMAL component and configures
the input and output ports as we're expecting to start streaming.
If the port configuration failed then it destroyed the component,
but failed to clear the component handle, therefore release tried
destroying the component again.
Adds some logging should the port config fail as well.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c            | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index eb5c07bc73d06..ad555ceb8f63e 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -1776,13 +1776,21 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 
 	ret = vchiq_mmal_port_set_format(dev->instance,
 					 &ctx->component->input[0]);
-	if (ret < 0)
+	if (ret < 0) {
+		v4l2_dbg(1, debug, &dev->v4l2_dev,
+			 "%s: vchiq_mmal_port_set_format ip port failed\n",
+			 __func__);
 		goto destroy_component;
+	}
 
 	ret = vchiq_mmal_port_set_format(dev->instance,
 					 &ctx->component->output[0]);
-	if (ret < 0)
+	if (ret < 0) {
+		v4l2_dbg(1, debug, &dev->v4l2_dev,
+			 "%s: vchiq_mmal_port_set_format op port failed\n",
+			 __func__);
 		goto destroy_component;
+	}
 
 	if (dev->role == ENCODE) {
 		u32 param = 1;
@@ -1812,11 +1820,14 @@ static int bcm2835_codec_create_component(struct bcm2835_codec_ctx *ctx)
 				 ctx->q_data[V4L2_M2M_DST].sizeimage,
 				 ctx->component->output[0].minimum_buffer.size);
 	}
+	v4l2_dbg(2, debug, &dev->v4l2_dev, "%s: component created as %s\n",
+		 __func__, components[dev->role]);
 
 	return 0;
 
 destroy_component:
 	vchiq_mmal_component_finalise(ctx->dev->instance, ctx->component);
+	ctx->component = NULL;
 
 	return ret;
 }
-- 
GitLab


From 900c34800fd740ae0b4b216f9a17a4f92076fe72 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 8 Mar 2019 10:49:17 +0000
Subject: [PATCH 0378/1835] staging: vc-sm-cma: Remove the debugfs directory on
 remove

Without removing that, reloading the driver fails.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 4bc738a2abf34..f70e3e7aedb35 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -757,7 +757,7 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 	pr_debug("[%s]: start\n", __func__);
 	if (sm_inited) {
 		/* Remove all proc entries. */
-		//debugfs_remove_recursive(sm_state->dir_root);
+		debugfs_remove_recursive(sm_state->dir_root);
 
 		/* Stop the videocore shared memory service. */
 		vc_sm_cma_vchi_stop(&sm_state->sm_handle);
-- 
GitLab


From 3b4510a0443332bedeaf2a0dd3a9e7ff53d66680 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 8 Mar 2019 11:06:41 +0000
Subject: [PATCH 0379/1835] staging: vc-sm-cma: Use devm_ allocs for sm_state.

Use managed allocations for sm_state, removing reliance on
manual management.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index f70e3e7aedb35..c77d2088b2f5d 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -656,7 +656,7 @@ static void vc_sm_connected_init(void)
 		       __func__, ret);
 
 		ret = -EIO;
-		goto err_free_mem;
+		goto err_failed;
 	}
 
 	ret = vchi_connect(NULL, 0, vchi_instance);
@@ -665,7 +665,7 @@ static void vc_sm_connected_init(void)
 		       __func__, ret);
 
 		ret = -EIO;
-		goto err_free_mem;
+		goto err_failed;
 	}
 
 	/* Initialize an instance of the shared memory service. */
@@ -676,7 +676,7 @@ static void vc_sm_connected_init(void)
 		       __func__);
 
 		ret = -EPERM;
-		goto err_free_mem;
+		goto err_failed;
 	}
 
 	/* Create a debug fs directory entry (root). */
@@ -722,8 +722,7 @@ err_remove_shared_memory:
 	debugfs_remove_recursive(sm_state->dir_root);
 err_stop_sm_service:
 	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
-err_free_mem:
-	kfree(sm_state);
+err_failed:
 	pr_info("[%s]: failed, ret %d\n", __func__, ret);
 }
 
@@ -732,7 +731,7 @@ static int bcm2835_vc_sm_cma_probe(struct platform_device *pdev)
 {
 	pr_info("%s: Videocore shared memory driver\n", __func__);
 
-	sm_state = kzalloc(sizeof(*sm_state), GFP_KERNEL);
+	sm_state = devm_kzalloc(&pdev->dev, sizeof(*sm_state), GFP_KERNEL);
 	if (!sm_state)
 		return -ENOMEM;
 	sm_state->pdev = pdev;
@@ -766,7 +765,6 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 
 		/* Free the memory for the state structure. */
 		mutex_destroy(&sm_state->map_lock);
-		kfree(sm_state);
 	}
 
 	pr_debug("[%s]: end\n", __func__);
-- 
GitLab


From 1e4705d61120b57590694b01ec70ed53e4158a3c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 8 Mar 2019 11:09:49 +0000
Subject: [PATCH 0380/1835] staging: vc-sm-cma: Don't fail if debugfs calls
 fail.

Return codes from debugfs calls should never alter the
flow of the main code.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index c77d2088b2f5d..8ae7810f1f9ad 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -681,13 +681,6 @@ static void vc_sm_connected_init(void)
 
 	/* Create a debug fs directory entry (root). */
 	sm_state->dir_root = debugfs_create_dir(VC_SM_DIR_ROOT_NAME, NULL);
-	if (!sm_state->dir_root) {
-		pr_err("[%s]: failed to create \'%s\' directory entry\n",
-		       __func__, VC_SM_DIR_ROOT_NAME);
-
-		ret = -EPERM;
-		goto err_stop_sm_service;
-	}
 
 	sm_state->dir_state.show = &vc_sm_cma_global_state_show;
 	sm_state->dir_state.dir_entry =
@@ -720,7 +713,6 @@ static void vc_sm_connected_init(void)
 
 err_remove_shared_memory:
 	debugfs_remove_recursive(sm_state->dir_root);
-err_stop_sm_service:
 	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
 err_failed:
 	pr_info("[%s]: failed, ret %d\n", __func__, ret);
-- 
GitLab


From 3e2f7ebfb74aab4d2b415bfe0dbe0e1c35b27c44 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 8 Mar 2019 11:11:46 +0000
Subject: [PATCH 0381/1835] staging: vc-sm-cma: Ensure mutex and idr are
 destroyed

map_lock and kernelid_map are created in probe, but not released
in release should the vcsm service not connect (eg running the
cutdown firmware).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 8ae7810f1f9ad..888040e22d329 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -752,7 +752,9 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 
 		/* Stop the videocore shared memory service. */
 		vc_sm_cma_vchi_stop(&sm_state->sm_handle);
+	}
 
+	if (sm_state) {
 		idr_destroy(&sm_state->kernelid_map);
 
 		/* Free the memory for the state structure. */
-- 
GitLab


From ab617529d7c1145f8c74db614b1fb4540367c063 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 8 Mar 2019 11:26:00 +0000
Subject: [PATCH 0382/1835] staging: bcm2835_codec: Clean up logging on
 unloading the driver

The log line was missing a closing \n, so wasn't added to the
log immediately.
Adds the function of the V4L2 device that is being unregistered
too.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c   | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index ad555ceb8f63e..837fbec5ab4f8 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -77,6 +77,12 @@ enum bcm2835_codec_role {
 	ISP,
 };
 
+const static char *roles[] = {
+	"decode",
+	"encode",
+	"isp"
+};
+
 static const char * const components[] = {
 	"ril.video_decode",
 	"ril.video_encode",
@@ -2522,7 +2528,6 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 	struct video_device *vfd;
 	int video_nr;
 	int ret;
-	const static char *roles[] = {"decode", "encode", "isp"};
 
 	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
 	if (!dev)
@@ -2615,7 +2620,8 @@ static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
 	if (!dev)
 		return -ENODEV;
 
-	v4l2_info(&dev->v4l2_dev, "Removing " MEM2MEM_NAME);
+	v4l2_info(&dev->v4l2_dev, "Removing " MEM2MEM_NAME ", %s\n",
+		  roles[dev->role]);
 	v4l2_m2m_release(dev->m2m_dev);
 	video_unregister_device(&dev->vfd);
 	v4l2_device_unregister(&dev->v4l2_dev);
-- 
GitLab


From 0382a87f667ccb5f3565bc9b220273f300979f72 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Thu, 7 Mar 2019 19:27:05 +0100
Subject: [PATCH 0383/1835] configs: Enable MT76 USB wifi

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 arch/arm/configs/bcm2709_defconfig   | 2 ++
 arch/arm/configs/bcmrpi_defconfig    | 2 ++
 arch/arm64/configs/bcmrpi3_defconfig | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 2a172664a8203..171bf378969bc 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -526,6 +526,8 @@ CONFIG_LIBERTAS_THINFIRM_USB=m
 CONFIG_MWIFIEX=m
 CONFIG_MWIFIEX_SDIO=m
 CONFIG_MT7601U=m
+CONFIG_MT76x0U=m
+CONFIG_MT76x2U=m
 CONFIG_RT2X00=m
 CONFIG_RT2500USB=m
 CONFIG_RT73USB=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index edce2eb181297..e408bef908e7b 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -520,6 +520,8 @@ CONFIG_LIBERTAS_THINFIRM_USB=m
 CONFIG_MWIFIEX=m
 CONFIG_MWIFIEX_SDIO=m
 CONFIG_MT7601U=m
+CONFIG_MT76x0U=m
+CONFIG_MT76x2U=m
 CONFIG_RT2X00=m
 CONFIG_RT2500USB=m
 CONFIG_RT73USB=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 2f7d6e37aea2f..54b859d7149d3 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -512,6 +512,8 @@ CONFIG_LIBERTAS_THINFIRM_USB=m
 CONFIG_MWIFIEX=m
 CONFIG_MWIFIEX_SDIO=m
 CONFIG_MT7601U=m
+CONFIG_MT76x0U=m
+CONFIG_MT76x2U=m
 CONFIG_RT2X00=m
 CONFIG_RT2500USB=m
 CONFIG_RT73USB=m
-- 
GitLab


From 3e35b1bac12eea970308788aacf2c4db2e8414ea Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 13 Mar 2019 14:19:11 +0000
Subject: [PATCH 0384/1835] bcm2835-sdhost: Allow for sg entries that cross
 pages

The dma_complete handling code calculates a virtual address for a page
then adds an offset, but if the offset is more than a page and HIGHMEM
is in use then the summed address could be in an unmapped (or just
incorrect) page.

The upstream SDHOST driver allows for this possibility - copy the code
that does so.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/bcm2835-sdhost.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
index e51639a81b2e0..d43af85135d30 100644
--- a/drivers/mmc/host/bcm2835-sdhost.c
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -543,6 +543,11 @@ static void bcm2835_sdhost_dma_complete(void *param)
 		void *page;
 		u32 *buf;
 
+		if (host->drain_offset & PAGE_MASK) {
+			host->drain_page += host->drain_offset >> PAGE_SHIFT;
+			host->drain_offset &= ~PAGE_MASK;
+		}
+
 		page = kmap_atomic(host->drain_page);
 		buf = page + host->drain_offset;
 
-- 
GitLab


From 761c53b12d352791a6cacbf00d90d8eb042b3b6f Mon Sep 17 00:00:00 2001
From: Adrien RICCIARDI <RICCIARDI-Adrien@users.noreply.github.com>
Date: Fri, 22 Mar 2019 11:35:30 +0100
Subject: [PATCH 0385/1835] overlays: sdio: Added 4-bit support on GPIOs 34-39.
 (#2903)

---
 arch/arm/boot/dts/overlays/README           | 3 +++
 arch/arm/boot/dts/overlays/sdio-overlay.dts | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 622eb1a6c34f7..3b7ec47ecf399 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1785,6 +1785,9 @@ Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
         gpios_34_37             Select GPIOs 34-37 for 1-bit mode. Must be used
                                 with bus_width=1.
 
+        gpios_34_39             Select GPIOs 34-39 for 4-bit mode. Must be used
+                                with bus_width=4 (the default).
+
 
 Name:   sdio-1bit
 Info:   This overlay is now deprecated. Use
diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
index 06dce154a058c..f7bc0815f53a9 100644
--- a/arch/arm/boot/dts/overlays/sdio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
@@ -64,6 +64,14 @@
 		};
 	};
 
+	fragment@5 {
+		target = <&sdio_ovl_pins>;
+		__dormant__ {
+			brcm,pins = <34 35 36 37 38 39>;
+			brcm,pull = <0 2 2 2 2 2>;
+		};
+	};
+
 	fragment@6 {
 		target-path = "/aliases";
 		__overlay__ {
@@ -77,5 +85,6 @@
 		sdio_overclock = <&sdio_ovl>,"brcm,overclock-50:0";
 		gpios_22_25 = <0>,"=3";
 		gpios_34_37 = <0>,"=4";
+		gpios_34_39 = <0>,"=5";
 	};
 };
-- 
GitLab


From 956561d7b963601536d30715ff9baa7874e16023 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 22 Mar 2019 16:44:47 +0000
Subject: [PATCH 0386/1835] overlays: Fix multiple-instantiation of sc16is7xx*

The registration of the fixed clocks uses the node name as the clock
name, causing a clash if two clock nodes have the same name, regardless
of the path to the node. Fix the issue by overwriting the clock node
names using the value of the "addr" parameter, providing a crude
disambiguation. (A bit of string pasting to form "sc16is752_clk_<addr>"
would have been nice, but that is outside the abilities of the overlay
parameter mechanism.)

Also give the sc16is750-i2c overlay the xtal parameter for symmetry.

See: https://www.raspberrypi.org/forums/viewtopic.php?f=107&t=235650

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README                    | 1 +
 arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts | 3 ++-
 arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 3b7ec47ecf399..74362f95f173c 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1725,6 +1725,7 @@ Info:   Overlay for the NXP SC16IS750 UART with I2C Interface
 Load:   dtoverlay=sc16is750-i2c,<param>=<val>
 Params: int_pin                 GPIO used for IRQ (default 24)
         addr                    Address (default 0x48)
+        xtal                    On-board crystal frequency (default 14745600)
 
 
 Name:   sc16is752-i2c
diff --git a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
index 339d0d17c01ff..8c5d008a34252 100644
--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
@@ -31,7 +31,8 @@
 
 	__overrides__ {
 		int_pin = <&sc16is750>,"interrupts:0";
-		addr = <&sc16is750>,"reg:0";
+		addr = <&sc16is750>,"reg:0",<&sc16is750_clk>,"name";
+		xtal = <&sc16is750>,"clock-frequency:0";
 	};
 
 };
diff --git a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
index e43e81d5a28f9..355eaac656c8c 100644
--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
@@ -34,7 +34,7 @@
 
 	__overrides__ {
 		int_pin = <&sc16is752>,"interrupts:0";
-		addr = <&sc16is752>,"reg:0";
+		addr = <&sc16is752>,"reg:0",<&sc16is752_clk>,"name";
 		xtal = <&sc16is752>,"clock-frequency:0";
 	};
 };
-- 
GitLab


From 09fd81d1d65f21fe0e887d6da370230b6c05d909 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Sun, 24 Mar 2019 20:54:25 +0000
Subject: [PATCH 0387/1835] configs: Re-enable CONFIG_NETFILTER_XT_MATCH_SOCKET

A Kconfig change in 4.10 caused the xt_socket module to no-longer be
included in Raspbian builds. Fix the defconfigs to re-enable it.

See: https://github.com/raspberrypi/linux/issues/2905

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 171bf378969bc..5b1e8c5abf128 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -186,6 +186,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index e408bef908e7b..fc5d77dccf8de 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -180,6 +180,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 54b859d7149d3..bbbdc7a632ee0 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -181,6 +181,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
-- 
GitLab


From 98048595e04c161fdb9ef63b7b11900bd9cbe2a6 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Wed, 16 Jan 2019 12:22:32 +0100
Subject: [PATCH 0388/1835] bcm2835-mmc: Fix DMA channel leak

The BCM2835 MMC host driver requests a DMA channel on probe but neglects
to release the channel in the probe error path and on driver unbind.

I'm seeing this happen on every boot of the Compute Module 3: On first
driver probe, DMA channel 2 is allocated and then leaked with a "could
not get clk, deferring probe" message. On second driver probe, channel 4
is allocated.

Fix it.

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
---
 drivers/mmc/host/bcm2835-mmc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index 905075c94232c..fd2225a388c42 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -1503,6 +1503,8 @@ static int bcm2835_mmc_probe(struct platform_device *pdev)
 
 	return 0;
 err:
+	if (host->dma_chan_rxtx)
+		dma_release_channel(host->dma_chan_rxtx);
 	mmc_free_host(mmc);
 
 	return ret;
@@ -1548,6 +1550,9 @@ static int bcm2835_mmc_remove(struct platform_device *pdev)
 
 	tasklet_kill(&host->finish_tasklet);
 
+	if (host->dma_chan_rxtx)
+		dma_release_channel(host->dma_chan_rxtx);
+
 	mmc_free_host(host->mmc);
 	platform_set_drvdata(pdev, NULL);
 
-- 
GitLab


From 00b48062daca8149c0f41f7ba051e0bd9022a406 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Sat, 19 Jan 2019 08:06:48 +0100
Subject: [PATCH 0389/1835] bcm2835-mmc: Fix struct mmc_host leak on probe

The BCM2835 MMC host driver requests the bus address of the host's
register map on probe.  If that fails, the driver leaks the struct
mmc_host allocated earlier.

Fix it.

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
---
 drivers/mmc/host/bcm2835-mmc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index fd2225a388c42..c4ca979995f99 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -1439,7 +1439,8 @@ static int bcm2835_mmc_probe(struct platform_device *pdev)
 	addr = of_get_address(node, 0, NULL, NULL);
 	if (!addr) {
 		dev_err(dev, "could not get DMA-register address\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err;
 	}
 	host->bus_addr = be32_to_cpup(addr);
 	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
-- 
GitLab


From ad66078a7eeb11b276c83ee0f9f4346b69879b4a Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Sat, 19 Jan 2019 09:00:26 +0100
Subject: [PATCH 0390/1835] bcm2835-mmc: Fix duplicate free_irq() on remove

The BCM2835 MMC host driver requests its interrupt as a device-managed
resource, so the interrupt is automatically freed after the driver is
unbound.

However on driver unbind, bcm2835_mmc_remove() frees the interrupt
explicitly to avoid invocation of the interrupt handler after driver
structures have been torn down.

The interrupt is thus freed twice, leading to a WARN splat in
__free_irq().  Fix by not requesting the interrupt as a device-managed
resource.

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
---
 drivers/mmc/host/bcm2835-mmc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index c4ca979995f99..4f215a47fdd75 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -1389,9 +1389,9 @@ static int bcm2835_mmc_add_host(struct bcm2835_host *host)
 	init_waitqueue_head(&host->buf_ready_int);
 
 	bcm2835_mmc_init(host, 0);
-	ret = devm_request_threaded_irq(dev, host->irq, bcm2835_mmc_irq,
-					bcm2835_mmc_thread_irq, IRQF_SHARED,
-					mmc_hostname(mmc), host);
+	ret = request_threaded_irq(host->irq, bcm2835_mmc_irq,
+				   bcm2835_mmc_thread_irq, IRQF_SHARED,
+				   mmc_hostname(mmc), host);
 	if (ret) {
 		dev_err(dev, "Failed to request IRQ %d: %d\n", host->irq, ret);
 		goto untasklet;
-- 
GitLab


From f1f91d34c515d9dd0e21a4d24c7da97468f5017c Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Tue, 22 Jan 2019 12:29:45 +0100
Subject: [PATCH 0391/1835] bcm2835-mmc: Handle mmc_add_host() errors

The BCM2835 MMC host driver calls mmc_add_host() but doesn't check its
return value.  Errors occurring in that function are therefore not
handled.  Fix it.

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
---
 drivers/mmc/host/bcm2835-mmc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index 4f215a47fdd75..46ea11d5ed2ef 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -1398,10 +1398,16 @@ static int bcm2835_mmc_add_host(struct bcm2835_host *host)
 	}
 
 	mmiowb();
-	mmc_add_host(mmc);
+	ret = mmc_add_host(mmc);
+	if (ret) {
+		dev_err(dev, "could not add MMC host\n");
+		goto free_irq;
+	}
 
 	return 0;
 
+free_irq:
+	free_irq(host->irq, host);
 untasklet:
 	tasklet_kill(&host->finish_tasklet);
 
-- 
GitLab


From cb6f32d4b507e88617226aee92f4cd1aa3c4504c Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Sat, 19 Jan 2019 08:42:40 +0100
Subject: [PATCH 0392/1835] bcm2835-mmc: Deduplicate reset of driver data on
 remove

The BCM2835 MMC host driver sets the device's driver data pointer to
NULL on ->remove() even though the driver core subsequently does the
same in __device_release_driver().  Drop the duplicate assignment.

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Frank Pavlic <f.pavlic@kunbus.de>
---
 drivers/mmc/host/bcm2835-mmc.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index 46ea11d5ed2ef..68daa59d313b4 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -1561,7 +1561,6 @@ static int bcm2835_mmc_remove(struct platform_device *pdev)
 		dma_release_channel(host->dma_chan_rxtx);
 
 	mmc_free_host(host->mmc);
-	platform_set_drvdata(pdev, NULL);
 
 	return 0;
 }
-- 
GitLab


From cfe7407c7ff6f03228231d14e89dc660f4e988fd Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 25 Mar 2019 17:54:05 +0000
Subject: [PATCH 0393/1835] configs: Add CONFIG_BATTERY_MAX17040

See: https://github.com/raspberrypi/linux/issues/2906

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 5b1e8c5abf128..252c784d0fe1b 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -659,6 +659,7 @@ CONFIG_W1_SLAVE_DS28E04=m
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_MAX17040=m
 CONFIG_BATTERY_GAUGE_LTC2941=m
 CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index fc5d77dccf8de..75eec605cb14c 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -652,6 +652,7 @@ CONFIG_W1_SLAVE_DS28E04=m
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_MAX17040=m
 CONFIG_BATTERY_GAUGE_LTC2941=m
 CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index bbbdc7a632ee0..6c42e3090b6bc 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -629,6 +629,7 @@ CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_MAX17040=m
 CONFIG_HWMON=m
 CONFIG_SENSORS_LM75=m
 CONFIG_SENSORS_SHT21=m
-- 
GitLab


From 3a0911047526c5060616a51595b893f49f682351 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 25 Mar 2019 18:03:48 +0000
Subject: [PATCH 0394/1835] overlays: Add max17040 support to i2c-sensor

See: https://github.com/raspberrypi/linux/issues/2906

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README                |  3 +++
 .../arm/boot/dts/overlays/i2c-sensor-overlay.dts | 16 ++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 74362f95f173c..b6fa4fa3388ba 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1030,6 +1030,9 @@ Params: addr                    Set the address for the BME280, BMP280, DS1621,
 
         lm75addr                Deprecated - use addr parameter instead
 
+        max17040                Select the Maxim Integrated MAX17040 battery
+                                monitor
+
         sht3x                   Select the Sensiron SHT3x temperature and
                                 humidity sensor. Valid addresses 0x44-0x45,
                                 default 0x44
diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
index 4b5be8676d112..0e2efa6ac8eaa 100644
--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
@@ -201,6 +201,21 @@
 		};
 	};
 
+	fragment@13 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			max17040: max17040@36 {
+				compatible = "maxim,max17040";
+				reg = <0x36>;
+				status = "okay";
+			};
+		};
+	};
+
 	__overrides__ {
 		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
@@ -219,5 +234,6 @@
 		veml6070 = <0>,"+10";
 		sht3x = <0>,"+11";
 		ds1621 = <0>,"+12";
+		max17040 = <0>,"+13";
 	};
 };
-- 
GitLab


From 540b055b12375e82470d33dab00e1fcfcdd7fefe Mon Sep 17 00:00:00 2001
From: P33M <P33M@users.noreply.github.com>
Date: Tue, 26 Mar 2019 09:48:25 +0000
Subject: [PATCH 0395/1835] defconfigs: disable memory and IO cgroups (#2908)

Due to an upstream bug, memory is leaked in the inode cache when cgroups
are enabled. Disable as this is causing crashes.

See: https://github.com/raspberrypi/linux/issues/2829
---
 arch/arm/configs/bcm2709_defconfig   | 4 ----
 arch/arm/configs/bcmrpi_defconfig    | 4 ----
 arch/arm64/configs/bcmrpi3_defconfig | 4 ----
 3 files changed, 12 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 252c784d0fe1b..90e267acbf5b5 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -14,8 +14,6 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
-CONFIG_MEMCG=y
-CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
@@ -64,10 +62,8 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
-CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=m
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 75eec605cb14c..46c121c892931 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -13,8 +13,6 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
-CONFIG_MEMCG=y
-CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
@@ -58,10 +56,8 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
-CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=m
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 6c42e3090b6bc..2aef655ae9fb8 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -13,8 +13,6 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
-CONFIG_MEMCG=y
-CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
@@ -62,10 +60,8 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
-CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=y
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
-- 
GitLab


From 11afe451f376773578496065d3eda9f15a9aa55e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 5 Mar 2019 15:43:27 +0000
Subject: [PATCH 0396/1835] media: bcm2835-unicam: Add support for enum
 framesizes and frameintervals

vidioc_enum_framesizes and vidioc_enum_frameintervals weren't implemented,
therefore clients couldn't enumerate the supported resolutions.

Implement them by forwarding on to the sensor driver.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../media/platform/bcm2835/bcm2835-unicam.c   | 94 +++++++++++++++++++
 1 file changed, 94 insertions(+)

diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
index 176c2d3d7ee78..5f9375add5207 100644
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -1406,6 +1406,84 @@ static int unicam_g_edid(struct file *file, void *priv, struct v4l2_edid *edid)
 	return v4l2_subdev_call(dev->sensor, pad, get_edid, edid);
 }
 
+static int unicam_enum_framesizes(struct file *file, void *priv,
+				  struct v4l2_frmsizeenum *fsize)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	const struct unicam_fmt *fmt;
+	struct v4l2_subdev_frame_size_enum fse;
+	int ret;
+
+	/* check for valid format */
+	fmt = find_format_by_pix(dev, fsize->pixel_format);
+	if (!fmt) {
+		unicam_dbg(3, dev, "Invalid pixel code: %x\n",
+			   fsize->pixel_format);
+		return -EINVAL;
+	}
+
+	fse.index = fsize->index;
+	fse.pad = 0;
+	fse.code = fmt->code;
+
+	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_size, NULL, &fse);
+	if (ret)
+		return ret;
+
+	unicam_dbg(1, dev, "%s: index: %d code: %x W:[%d,%d] H:[%d,%d]\n",
+		   __func__, fse.index, fse.code, fse.min_width, fse.max_width,
+		   fse.min_height, fse.max_height);
+
+	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
+	fsize->discrete.width = fse.max_width;
+	fsize->discrete.height = fse.max_height;
+
+	return 0;
+}
+
+static int unicam_enum_frameintervals(struct file *file, void *priv,
+				      struct v4l2_frmivalenum *fival)
+{
+	struct unicam_device *dev = video_drvdata(file);
+	const struct unicam_fmt *fmt;
+	struct v4l2_subdev_frame_interval_enum fie = {
+		.index = fival->index,
+		.width = fival->width,
+		.height = fival->height,
+		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+	};
+	int ret;
+
+	fmt = find_format_by_pix(dev, fival->pixel_format);
+	if (!fmt)
+		return -EINVAL;
+
+	fie.code = fmt->code;
+	ret = v4l2_subdev_call(dev->sensor, pad, enum_frame_interval,
+			       NULL, &fie);
+	if (ret)
+		return ret;
+
+	fival->type = V4L2_FRMIVAL_TYPE_DISCRETE;
+	fival->discrete = fie.interval;
+
+	return 0;
+}
+
+static int unicam_g_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_g_parm_cap(video_devdata(file), dev->sensor, a);
+}
+
+static int unicam_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
+{
+	struct unicam_device *dev = video_drvdata(file);
+
+	return v4l2_s_parm_cap(video_devdata(file), dev->sensor, a);
+}
+
 static int unicam_g_dv_timings(struct file *file, void *priv,
 			       struct v4l2_dv_timings *timings)
 {
@@ -1613,6 +1691,12 @@ static const struct v4l2_ioctl_ops unicam_ioctl_ops = {
 	.vidioc_g_edid			= unicam_g_edid,
 	.vidioc_s_edid			= unicam_s_edid,
 
+	.vidioc_enum_framesizes		= unicam_enum_framesizes,
+	.vidioc_enum_frameintervals	= unicam_enum_frameintervals,
+
+	.vidioc_g_parm			= unicam_g_parm,
+	.vidioc_s_parm			= unicam_s_parm,
+
 	.vidioc_s_dv_timings		= unicam_s_dv_timings,
 	.vidioc_g_dv_timings		= unicam_g_dv_timings,
 	.vidioc_query_dv_timings	= unicam_query_dv_timings,
@@ -1850,6 +1934,16 @@ static int unicam_probe_complete(struct unicam_device *unicam)
 		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_ENUM_DV_TIMINGS);
 		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_QUERY_DV_TIMINGS);
 	}
+	if (!v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_interval))
+		v4l2_disable_ioctl(&unicam->video_dev,
+				   VIDIOC_ENUM_FRAMEINTERVALS);
+	if (!v4l2_subdev_has_op(unicam->sensor, video, g_frame_interval))
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_G_PARM);
+	if (!v4l2_subdev_has_op(unicam->sensor, video, s_frame_interval))
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_S_PARM);
+
+	if (!v4l2_subdev_has_op(unicam->sensor, pad, enum_frame_size))
+		v4l2_disable_ioctl(&unicam->video_dev, VIDIOC_ENUM_FRAMESIZES);
 
 	ret = v4l2_device_register_subdev_nodes(&unicam->v4l2_dev);
 	if (ret) {
-- 
GitLab


From 1c7c832928e7bc1d7247bc1c4ff202ad59ed697a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 20 Mar 2019 10:06:51 +0000
Subject: [PATCH 0397/1835] staging: bcm2835-codec: Refactor default resolution
 code

The default resolution code was different for each role
as compressed formats need to pass bytesperline as 0 and
set up customised buffer sizes.
This is common setup, therefore amend get_sizeimage and
get_bytesperline to do the correct thing whether compressed
or uncompressed.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 103 +++++++-----------
 1 file changed, 40 insertions(+), 63 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 837fbec5ab4f8..4b67c9ea73e13 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -578,10 +578,17 @@ static void job_abort(void *priv)
 	ctx->aborting = 1;
 }
 
-static inline unsigned int get_sizeimage(int bpl, int height,
+static inline unsigned int get_sizeimage(int bpl, int width, int height,
 					 struct bcm2835_codec_fmt *fmt)
 {
-	return (bpl * height * fmt->size_multiplier_x2) >> 1;
+	if (fmt->flags & V4L2_FMT_FLAG_COMPRESSED) {
+		if (width * height > 1280 * 720)
+			return DEF_COMP_BUF_SIZE_GREATER_720P;
+		else
+			return DEF_COMP_BUF_SIZE_720P_OR_LESS;
+	} else {
+		return (bpl * height * fmt->size_multiplier_x2) >> 1;
+	}
 }
 
 static inline unsigned int get_bytesperline(int width,
@@ -1032,22 +1039,13 @@ static int vidioc_try_fmt(struct v4l2_format *f, struct bcm2835_codec_fmt *fmt)
 		 * some of the pixels are active.
 		 */
 		f->fmt.pix.height = ALIGN(f->fmt.pix.height, 16);
-
-		f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
-							   fmt);
-		f->fmt.pix.sizeimage = get_sizeimage(f->fmt.pix.bytesperline,
-						     f->fmt.pix.height,
-						     fmt);
-	} else {
-		u32 min_size = f->fmt.pix.width > 1280 ||
-			       f->fmt.pix.height > 720 ?
-			       DEF_COMP_BUF_SIZE_GREATER_720P :
-			       DEF_COMP_BUF_SIZE_720P_OR_LESS;
-
-		f->fmt.pix.bytesperline = 0;
-		if (f->fmt.pix.sizeimage < min_size)
-			f->fmt.pix.sizeimage = min_size;
 	}
+	f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
+						   fmt);
+	f->fmt.pix.sizeimage = get_sizeimage(f->fmt.pix.bytesperline,
+					     f->fmt.pix.width,
+					     f->fmt.pix.height,
+					     fmt);
 
 	f->fmt.pix.field = V4L2_FIELD_NONE;
 
@@ -1159,6 +1157,7 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 		q_data_dst->bytesperline =
 			get_bytesperline(f->fmt.pix.width, q_data_dst->fmt);
 		q_data_dst->sizeimage = get_sizeimage(q_data_dst->bytesperline,
+						      q_data_dst->crop_width,
 						      q_data_dst->height,
 						      q_data_dst->fmt);
 		update_capture_port = true;
@@ -2218,52 +2217,30 @@ static int bcm2835_codec_open(struct file *file)
 
 	ctx->q_data[V4L2_M2M_SRC].fmt = get_default_format(dev, false);
 	ctx->q_data[V4L2_M2M_DST].fmt = get_default_format(dev, true);
-	switch (dev->role) {
-	case DECODE:
-		/*
-		 * Input width and height are irrelevant as they will be defined
-		 * by the bitstream not the format. Required by V4L2 though.
-		 */
-		ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
-		ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_SRC].bytesperline = 0;
-		ctx->q_data[V4L2_M2M_SRC].sizeimage =
-						DEF_COMP_BUF_SIZE_720P_OR_LESS;
-
-		ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
-		ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_DST].bytesperline =
-				get_bytesperline(DEFAULT_WIDTH,
-						 ctx->q_data[V4L2_M2M_DST].fmt);
-		ctx->q_data[V4L2_M2M_DST].sizeimage =
-			get_sizeimage(ctx->q_data[V4L2_M2M_DST].bytesperline,
-				      ctx->q_data[V4L2_M2M_DST].height,
-				      ctx->q_data[V4L2_M2M_DST].fmt);
-		break;
-	case ENCODE:
-		ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
-		ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_SRC].bytesperline =
-				get_bytesperline(DEFAULT_WIDTH,
-						 ctx->q_data[V4L2_M2M_SRC].fmt);
-		ctx->q_data[V4L2_M2M_SRC].sizeimage =
-			get_sizeimage(ctx->q_data[V4L2_M2M_SRC].bytesperline,
-				      ctx->q_data[V4L2_M2M_SRC].height,
-				      ctx->q_data[V4L2_M2M_SRC].fmt);
-
-		ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
-		ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_DST].bytesperline = 0;
-		ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
-		ctx->q_data[V4L2_M2M_DST].sizeimage =
-						DEF_COMP_BUF_SIZE_720P_OR_LESS;
-		break;
-	case ISP:
-		break;
-	}
+
+	ctx->q_data[V4L2_M2M_SRC].crop_width = DEFAULT_WIDTH;
+	ctx->q_data[V4L2_M2M_SRC].crop_height = DEFAULT_HEIGHT;
+	ctx->q_data[V4L2_M2M_SRC].height = DEFAULT_HEIGHT;
+	ctx->q_data[V4L2_M2M_SRC].bytesperline =
+			get_bytesperline(DEFAULT_WIDTH,
+					 ctx->q_data[V4L2_M2M_SRC].fmt);
+	ctx->q_data[V4L2_M2M_SRC].sizeimage =
+		get_sizeimage(ctx->q_data[V4L2_M2M_SRC].bytesperline,
+			      ctx->q_data[V4L2_M2M_SRC].crop_width,
+			      ctx->q_data[V4L2_M2M_SRC].height,
+			      ctx->q_data[V4L2_M2M_SRC].fmt);
+
+	ctx->q_data[V4L2_M2M_DST].crop_width = DEFAULT_WIDTH;
+	ctx->q_data[V4L2_M2M_DST].crop_height = DEFAULT_HEIGHT;
+	ctx->q_data[V4L2_M2M_DST].height = DEFAULT_HEIGHT;
+	ctx->q_data[V4L2_M2M_DST].bytesperline =
+			get_bytesperline(DEFAULT_WIDTH,
+					 ctx->q_data[V4L2_M2M_DST].fmt);
+	ctx->q_data[V4L2_M2M_DST].sizeimage =
+		get_sizeimage(ctx->q_data[V4L2_M2M_DST].bytesperline,
+			      ctx->q_data[V4L2_M2M_DST].crop_width,
+			      ctx->q_data[V4L2_M2M_DST].height,
+			      ctx->q_data[V4L2_M2M_DST].fmt);
 
 	ctx->colorspace = V4L2_COLORSPACE_REC709;
 	ctx->bitrate = 10 * 1000 * 1000;
-- 
GitLab


From 47bf88399298f59b7c5d7f0588021758c9f024a5 Mon Sep 17 00:00:00 2001
From: Alexandre Belloni <alexandre.belloni@bootlin.com>
Date: Fri, 30 Nov 2018 11:53:20 +0000
Subject: [PATCH 0398/1835] nvmem: add type attribute

commit 16688453661b6d5159be558a1f8c1f54463a420f upstream.

Add a type attribute so userspace is able to know how the data is stored as
this can help taking the correct decision when selecting which device to
use. This will also help program display the proper warnings when burning
fuses for example.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/core.c           | 21 +++++++++++++++++++++
 include/linux/nvmem-provider.h | 16 ++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 7c530c88b3fbb..7b6b756848e3c 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -36,6 +36,7 @@ struct nvmem_device {
 	size_t			size;
 	bool			read_only;
 	int			flags;
+	enum nvmem_type		type;
 	struct bin_attribute	eeprom;
 	struct device		*base_dev;
 	nvmem_reg_read_t	reg_read;
@@ -84,6 +85,21 @@ static int nvmem_reg_write(struct nvmem_device *nvmem, unsigned int offset,
 	return -EINVAL;
 }
 
+static ssize_t type_show(struct device *dev,
+			 struct device_attribute *attr, char *buf)
+{
+	struct nvmem_device *nvmem = to_nvmem_device(dev);
+
+	return sprintf(buf, "%s\n", nvmem_type_str[nvmem->type]);
+}
+
+static DEVICE_ATTR_RO(type);
+
+static struct attribute *nvmem_attrs[] = {
+	&dev_attr_type.attr,
+	NULL,
+};
+
 static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
 				    struct bin_attribute *attr,
 				    char *buf, loff_t pos, size_t count)
@@ -169,6 +185,7 @@ static struct bin_attribute *nvmem_bin_rw_attributes[] = {
 
 static const struct attribute_group nvmem_bin_rw_group = {
 	.bin_attrs	= nvmem_bin_rw_attributes,
+	.attrs		= nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_rw_dev_groups[] = {
@@ -192,6 +209,7 @@ static struct bin_attribute *nvmem_bin_ro_attributes[] = {
 
 static const struct attribute_group nvmem_bin_ro_group = {
 	.bin_attrs	= nvmem_bin_ro_attributes,
+	.attrs		= nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_ro_dev_groups[] = {
@@ -216,6 +234,7 @@ static struct bin_attribute *nvmem_bin_rw_root_attributes[] = {
 
 static const struct attribute_group nvmem_bin_rw_root_group = {
 	.bin_attrs	= nvmem_bin_rw_root_attributes,
+	.attrs		= nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_rw_root_dev_groups[] = {
@@ -239,6 +258,7 @@ static struct bin_attribute *nvmem_bin_ro_root_attributes[] = {
 
 static const struct attribute_group nvmem_bin_ro_root_group = {
 	.bin_attrs	= nvmem_bin_ro_root_attributes,
+	.attrs		= nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_ro_root_dev_groups[] = {
@@ -478,6 +498,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
 	nvmem->dev.bus = &nvmem_bus_type;
 	nvmem->dev.parent = config->dev;
 	nvmem->priv = config->priv;
+	nvmem->type = config->type;
 	nvmem->reg_read = config->reg_read;
 	nvmem->reg_write = config->reg_write;
 	nvmem->dev.of_node = config->dev->of_node;
diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h
index 24def6ad09bb0..8eea726c59efb 100644
--- a/include/linux/nvmem-provider.h
+++ b/include/linux/nvmem-provider.h
@@ -22,6 +22,20 @@ typedef int (*nvmem_reg_read_t)(void *priv, unsigned int offset,
 typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
 				 void *val, size_t bytes);
 
+enum nvmem_type {
+	NVMEM_TYPE_UNKNOWN = 0,
+	NVMEM_TYPE_EEPROM,
+	NVMEM_TYPE_OTP,
+	NVMEM_TYPE_BATTERY_BACKED,
+};
+
+static const char * const nvmem_type_str[] = {
+	[NVMEM_TYPE_UNKNOWN] = "Unknown",
+	[NVMEM_TYPE_EEPROM] = "EEPROM",
+	[NVMEM_TYPE_OTP] = "OTP",
+	[NVMEM_TYPE_BATTERY_BACKED] = "Battery backed",
+};
+
 /**
  * struct nvmem_config - NVMEM device configuration
  *
@@ -31,6 +45,7 @@ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
  * @owner:	Pointer to exporter module. Used for refcounting.
  * @cells:	Optional array of pre-defined NVMEM cells.
  * @ncells:	Number of elements in cells.
+ * @type:	Type of the nvmem storage
  * @read_only:	Device is read-only.
  * @root_only:	Device is accessibly to root only.
  * @reg_read:	Callback to read data.
@@ -54,6 +69,7 @@ struct nvmem_config {
 	struct module		*owner;
 	const struct nvmem_cell_info	*cells;
 	int			ncells;
+	enum nvmem_type		type;
 	bool			read_only;
 	bool			root_only;
 	nvmem_reg_read_t	reg_read;
-- 
GitLab


From bef7641d326a3a0bec5da9f72fc6814ced1207a7 Mon Sep 17 00:00:00 2001
From: Alexandre Belloni <alexandre.belloni@bootlin.com>
Date: Wed, 13 Feb 2019 00:21:36 +0100
Subject: [PATCH 0399/1835] rtc: rv3028: add new driver

upstream commit e6e7376cfd7b3f9b63de3a22792f64d9bfb2ab53.

Add a driver for the MicroCrystal RV-3028. It is a SMT Real-Time Clock
Module that incorporates an integrated CMOS circuit together with an XTAL.
It has an i2c interface.

The driver handles date/time, alarms, trickle charging, timestamping,
frequency offset correction, EEPROM and NVRAM.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
---
 Documentation/devicetree/bindings/rtc/rtc.txt |  69 ++
 drivers/rtc/Kconfig                           |   9 +
 drivers/rtc/Makefile                          |   1 +
 drivers/rtc/rtc-rv3028.c                      | 733 ++++++++++++++++++
 4 files changed, 812 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/rtc/rtc.txt
 create mode 100644 drivers/rtc/rtc-rv3028.c

diff --git a/Documentation/devicetree/bindings/rtc/rtc.txt b/Documentation/devicetree/bindings/rtc/rtc.txt
new file mode 100644
index 0000000000000..3e6a215e7304b
--- /dev/null
+++ b/Documentation/devicetree/bindings/rtc/rtc.txt
@@ -0,0 +1,69 @@
+Generic device tree bindings for Real Time Clock devices
+========================================================
+
+This document describes generic bindings which can be used to describe Real Time
+Clock devices in a device tree.
+
+Required properties
+-------------------
+
+- compatible : name of RTC device following generic names recommended practice.
+
+For other required properties e.g. to describe register sets,
+clocks, etc. check the binding documentation of the specific driver.
+
+Optional properties
+-------------------
+
+- start-year : if provided, the default hardware range supported by the RTC is
+               shifted so the first usable year is the specified one.
+
+The following properties may not be supported by all drivers. However, if a
+driver wants to support one of the below features, it should adapt the bindings
+below.
+- trickle-resistor-ohms :   Selected resistor for trickle charger. Should be given
+                            if trickle charger should be enabled
+- trickle-diode-disable :   Do not use internal trickle charger diode Should be
+                            given if internal trickle charger diode should be
+                            disabled
+- wakeup-source :           Enables wake up of host system on alarm
+- quartz-load-femtofarads : The capacitive load of the quartz(x-tal),
+                            expressed in femto Farad (fF).
+                            The default value shall be listed (if optional),
+                            and likewise all valid values.
+
+Trivial RTCs
+------------
+
+This is a list of trivial RTC devices that have simple device tree
+bindings, consisting only of a compatible field, an address and
+possibly an interrupt line.
+
+
+Compatible		Vendor / Chip
+==========		=============
+abracon,abb5zes3	AB-RTCMC-32.768kHz-B5ZE-S3: Real Time Clock/Calendar Module with I2C Interface
+dallas,ds1374		I2C, 32-Bit Binary Counter Watchdog RTC with Trickle Charger and Reset Input/Output
+dallas,ds1672		Dallas DS1672 Real-time Clock
+dallas,ds3232		Extremely Accurate I²C RTC with Integrated Crystal and SRAM
+epson,rx8010		I2C-BUS INTERFACE REAL TIME CLOCK MODULE
+epson,rx8581		I2C-BUS INTERFACE REAL TIME CLOCK MODULE
+emmicro,em3027		EM Microelectronic EM3027 Real-time Clock
+isil,isl1208		Intersil ISL1208 Low Power RTC with Battery Backed SRAM
+isil,isl1218		Intersil ISL1218 Low Power RTC with Battery Backed SRAM
+isil,isl12022		Intersil ISL12022 Real-time Clock
+microcrystal,rv3028	Real Time Clock Module with I2C-Bus
+microcrystal,rv3029	Real Time Clock Module with I2C-Bus
+microcrystal,rv8523	Real Time Clock
+nxp,pcf2127		Real-time clock
+nxp,pcf2129		Real-time clock
+nxp,pcf8563		Real-time clock/calendar
+pericom,pt7c4338	Real-time Clock Module
+ricoh,r2025sd		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
+ricoh,r2221tl		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
+ricoh,rs5c372a		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
+ricoh,rs5c372b		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
+ricoh,rv5c386		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
+ricoh,rv5c387a		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
+sii,s35390a		2-wire CMOS real-time clock
+whwave,sd3078		I2C bus SERIAL INTERFACE REAL-TIME CLOCK IC
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 7d7be60a2413f..73b6e782baf2d 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -625,6 +625,15 @@ config RTC_DRV_EM3027
 	  This driver can also be built as a module. If so, the module
 	  will be called rtc-em3027.
 
+config RTC_DRV_RV3028
+	tristate "Micro Crystal RV3028"
+	help
+	  If you say yes here you get support for the Micro Crystal
+	  RV3028.
+
+	  This driver can also be built as a module. If so, the module
+	  will be called rtc-rv3028.
+
 config RTC_DRV_RV8803
 	tristate "Micro Crystal RV8803, Epson RX8900"
 	help
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 5ff2fc0c361a8..7c1ec1c087c22 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -136,6 +136,7 @@ obj-$(CONFIG_RTC_DRV_RS5C313)	+= rtc-rs5c313.o
 obj-$(CONFIG_RTC_DRV_RS5C348)	+= rtc-rs5c348.o
 obj-$(CONFIG_RTC_DRV_RS5C372)	+= rtc-rs5c372.o
 obj-$(CONFIG_RTC_DRV_RTD119X)	+= rtc-rtd119x.o
+obj-$(CONFIG_RTC_DRV_RV3028)	+= rtc-rv3028.o
 obj-$(CONFIG_RTC_DRV_RV3029C2)	+= rtc-rv3029c2.o
 obj-$(CONFIG_RTC_DRV_RV8803)	+= rtc-rv8803.o
 obj-$(CONFIG_RTC_DRV_RX4581)	+= rtc-rx4581.o
diff --git a/drivers/rtc/rtc-rv3028.c b/drivers/rtc/rtc-rv3028.c
new file mode 100644
index 0000000000000..d04c2d4816555
--- /dev/null
+++ b/drivers/rtc/rtc-rv3028.c
@@ -0,0 +1,733 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * RTC driver for the Micro Crystal RV3028
+ *
+ * Copyright (C) 2019 Micro Crystal SA
+ *
+ * Alexandre Belloni <alexandre.belloni@bootlin.com>
+ *
+ */
+
+#include <linux/bcd.h>
+#include <linux/bitops.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/log2.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/regmap.h>
+#include <linux/rtc.h>
+#include "rtc-core.h"
+
+#define RV3028_SEC			0x00
+#define RV3028_MIN			0x01
+#define RV3028_HOUR			0x02
+#define RV3028_WDAY			0x03
+#define RV3028_DAY			0x04
+#define RV3028_MONTH			0x05
+#define RV3028_YEAR			0x06
+#define RV3028_ALARM_MIN		0x07
+#define RV3028_ALARM_HOUR		0x08
+#define RV3028_ALARM_DAY		0x09
+#define RV3028_STATUS			0x0E
+#define RV3028_CTRL1			0x0F
+#define RV3028_CTRL2			0x10
+#define RV3028_EVT_CTRL			0x13
+#define RV3028_TS_COUNT			0x14
+#define RV3028_TS_SEC			0x15
+#define RV3028_RAM1			0x1F
+#define RV3028_EEPROM_ADDR		0x25
+#define RV3028_EEPROM_DATA		0x26
+#define RV3028_EEPROM_CMD		0x27
+#define RV3028_CLKOUT			0x35
+#define RV3028_OFFSET			0x36
+#define RV3028_BACKUP			0x37
+
+#define RV3028_STATUS_PORF		BIT(0)
+#define RV3028_STATUS_EVF		BIT(1)
+#define RV3028_STATUS_AF		BIT(2)
+#define RV3028_STATUS_TF		BIT(3)
+#define RV3028_STATUS_UF		BIT(4)
+#define RV3028_STATUS_BSF		BIT(5)
+#define RV3028_STATUS_CLKF		BIT(6)
+#define RV3028_STATUS_EEBUSY		BIT(7)
+
+#define RV3028_CTRL1_EERD		BIT(3)
+#define RV3028_CTRL1_WADA		BIT(5)
+
+#define RV3028_CTRL2_RESET		BIT(0)
+#define RV3028_CTRL2_12_24		BIT(1)
+#define RV3028_CTRL2_EIE		BIT(2)
+#define RV3028_CTRL2_AIE		BIT(3)
+#define RV3028_CTRL2_TIE		BIT(4)
+#define RV3028_CTRL2_UIE		BIT(5)
+#define RV3028_CTRL2_TSE		BIT(7)
+
+#define RV3028_EVT_CTRL_TSR		BIT(2)
+
+#define RV3028_EEPROM_CMD_WRITE		0x21
+#define RV3028_EEPROM_CMD_READ		0x22
+
+#define RV3028_EEBUSY_POLL		10000
+#define RV3028_EEBUSY_TIMEOUT		100000
+
+#define RV3028_BACKUP_TCE		BIT(5)
+#define RV3028_BACKUP_TCR_MASK		GENMASK(1,0)
+
+#define OFFSET_STEP_PPT			953674
+
+enum rv3028_type {
+	rv_3028,
+};
+
+struct rv3028_data {
+	struct regmap *regmap;
+	struct rtc_device *rtc;
+	enum rv3028_type type;
+};
+
+static u16 rv3028_trickle_resistors[] = {1000, 3000, 6000, 11000};
+
+static ssize_t timestamp0_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev->parent);
+
+	regmap_update_bits(rv3028->regmap, RV3028_EVT_CTRL, RV3028_EVT_CTRL_TSR,
+			   RV3028_EVT_CTRL_TSR);
+
+	return count;
+};
+
+static ssize_t timestamp0_show(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev->parent);
+	struct rtc_time tm;
+	int ret, count;
+	u8 date[6];
+
+	ret = regmap_read(rv3028->regmap, RV3028_TS_COUNT, &count);
+	if (ret)
+		return ret;
+
+	if (!count)
+		return 0;
+
+	ret = regmap_bulk_read(rv3028->regmap, RV3028_TS_SEC, date,
+			       sizeof(date));
+	if (ret)
+		return ret;
+
+	tm.tm_sec = bcd2bin(date[0]);
+	tm.tm_min = bcd2bin(date[1]);
+	tm.tm_hour = bcd2bin(date[2]);
+	tm.tm_mday = bcd2bin(date[3]);
+	tm.tm_mon = bcd2bin(date[4]) - 1;
+	tm.tm_year = bcd2bin(date[5]) + 100;
+
+	ret = rtc_valid_tm(&tm);
+	if (ret)
+		return ret;
+
+	return sprintf(buf, "%llu\n",
+		       (unsigned long long)rtc_tm_to_time64(&tm));
+};
+
+static DEVICE_ATTR_RW(timestamp0);
+
+static ssize_t timestamp0_count_show(struct device *dev,
+				     struct device_attribute *attr, char *buf)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev->parent);
+	int ret, count;
+
+	ret = regmap_read(rv3028->regmap, RV3028_TS_COUNT, &count);
+	if (ret)
+		return ret;
+
+	return sprintf(buf, "%u\n", count);
+};
+
+static DEVICE_ATTR_RO(timestamp0_count);
+
+static struct attribute *rv3028_attrs[] = {
+	&dev_attr_timestamp0.attr,
+	&dev_attr_timestamp0_count.attr,
+	NULL
+};
+
+static const struct attribute_group rv3028_attr_group = {
+	.attrs	= rv3028_attrs,
+};
+
+static irqreturn_t rv3028_handle_irq(int irq, void *dev_id)
+{
+	struct rv3028_data *rv3028 = dev_id;
+	unsigned long events = 0;
+	u32 status = 0, ctrl = 0;
+
+	if (regmap_read(rv3028->regmap, RV3028_STATUS, &status) < 0 ||
+	   status == 0) {
+		return IRQ_NONE;
+	}
+
+	if (status & RV3028_STATUS_PORF)
+		dev_warn(&rv3028->rtc->dev, "Voltage low, data loss detected.\n");
+
+	if (status & RV3028_STATUS_TF) {
+		status |= RV3028_STATUS_TF;
+		ctrl |= RV3028_CTRL2_TIE;
+		events |= RTC_PF;
+	}
+
+	if (status & RV3028_STATUS_AF) {
+		status |= RV3028_STATUS_AF;
+		ctrl |= RV3028_CTRL2_AIE;
+		events |= RTC_AF;
+	}
+
+	if (status & RV3028_STATUS_UF) {
+		status |= RV3028_STATUS_UF;
+		ctrl |= RV3028_CTRL2_UIE;
+		events |= RTC_UF;
+	}
+
+	if (events) {
+		rtc_update_irq(rv3028->rtc, 1, events);
+		regmap_update_bits(rv3028->regmap, RV3028_STATUS, status, 0);
+		regmap_update_bits(rv3028->regmap, RV3028_CTRL2, ctrl, 0);
+	}
+
+	if (status & RV3028_STATUS_EVF) {
+		sysfs_notify(&rv3028->rtc->dev.kobj, NULL,
+			     dev_attr_timestamp0.attr.name);
+		dev_warn(&rv3028->rtc->dev, "event detected");
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int rv3028_get_time(struct device *dev, struct rtc_time *tm)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	u8 date[7];
+	int ret, status;
+
+	ret = regmap_read(rv3028->regmap, RV3028_STATUS, &status);
+	if (ret < 0)
+		return ret;
+
+	if (status & RV3028_STATUS_PORF) {
+		dev_warn(dev, "Voltage low, data is invalid.\n");
+		return -EINVAL;
+	}
+
+	ret = regmap_bulk_read(rv3028->regmap, RV3028_SEC, date, sizeof(date));
+	if (ret)
+		return ret;
+
+	tm->tm_sec  = bcd2bin(date[RV3028_SEC] & 0x7f);
+	tm->tm_min  = bcd2bin(date[RV3028_MIN] & 0x7f);
+	tm->tm_hour = bcd2bin(date[RV3028_HOUR] & 0x3f);
+	tm->tm_wday = ilog2(date[RV3028_WDAY] & 0x7f);
+	tm->tm_mday = bcd2bin(date[RV3028_DAY] & 0x3f);
+	tm->tm_mon  = bcd2bin(date[RV3028_MONTH] & 0x1f) - 1;
+	tm->tm_year = bcd2bin(date[RV3028_YEAR]) + 100;
+
+	return 0;
+}
+
+static int rv3028_set_time(struct device *dev, struct rtc_time *tm)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	u8 date[7];
+	int ret;
+
+	date[RV3028_SEC]   = bin2bcd(tm->tm_sec);
+	date[RV3028_MIN]   = bin2bcd(tm->tm_min);
+	date[RV3028_HOUR]  = bin2bcd(tm->tm_hour);
+	date[RV3028_WDAY]  = 1 << (tm->tm_wday);
+	date[RV3028_DAY]   = bin2bcd(tm->tm_mday);
+	date[RV3028_MONTH] = bin2bcd(tm->tm_mon + 1);
+	date[RV3028_YEAR]  = bin2bcd(tm->tm_year - 100);
+
+	/*
+	 * Writing to the Seconds register has the same effect as setting RESET
+	 * bit to 1
+	 */
+	ret = regmap_bulk_write(rv3028->regmap, RV3028_SEC, date,
+				sizeof(date));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_STATUS,
+				 RV3028_STATUS_PORF, 0);
+
+	return ret;
+}
+
+static int rv3028_get_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	u8 alarmvals[3];
+	int status, ctrl, ret;
+
+	ret = regmap_bulk_read(rv3028->regmap, RV3028_ALARM_MIN, alarmvals,
+			       sizeof(alarmvals));
+	if (ret)
+		return ret;
+
+	ret = regmap_read(rv3028->regmap, RV3028_STATUS, &status);
+	if (ret < 0)
+		return ret;
+
+	ret = regmap_read(rv3028->regmap, RV3028_CTRL2, &ctrl);
+	if (ret < 0)
+		return ret;
+
+	alrm->time.tm_sec  = 0;
+	alrm->time.tm_min  = bcd2bin(alarmvals[0] & 0x7f);
+	alrm->time.tm_hour = bcd2bin(alarmvals[1] & 0x3f);
+	alrm->time.tm_mday = bcd2bin(alarmvals[2] & 0x3f);
+
+	alrm->enabled = !!(ctrl & RV3028_CTRL2_AIE);
+	alrm->pending = (status & RV3028_STATUS_AF) && alrm->enabled;
+
+	return 0;
+}
+
+static int rv3028_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	u8 alarmvals[3];
+	u8 ctrl = 0;
+	int ret;
+
+	/* The alarm has no seconds, round up to nearest minute */
+	if (alrm->time.tm_sec) {
+		time64_t alarm_time = rtc_tm_to_time64(&alrm->time);
+
+		alarm_time += 60 - alrm->time.tm_sec;
+		rtc_time64_to_tm(alarm_time, &alrm->time);
+	}
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_CTRL2,
+				 RV3028_CTRL2_AIE | RV3028_CTRL2_UIE, 0);
+	if (ret)
+		return ret;
+
+	alarmvals[0] = bin2bcd(alrm->time.tm_min);
+	alarmvals[1] = bin2bcd(alrm->time.tm_hour);
+	alarmvals[2] = bin2bcd(alrm->time.tm_mday);
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_STATUS,
+				 RV3028_STATUS_AF, 0);
+	if (ret)
+		return ret;
+
+	ret = regmap_bulk_write(rv3028->regmap, RV3028_ALARM_MIN, alarmvals,
+				sizeof(alarmvals));
+	if (ret)
+		return ret;
+
+	if (alrm->enabled) {
+		if (rv3028->rtc->uie_rtctimer.enabled)
+			ctrl |= RV3028_CTRL2_UIE;
+		if (rv3028->rtc->aie_timer.enabled)
+			ctrl |= RV3028_CTRL2_AIE;
+	}
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_CTRL2,
+				 RV3028_CTRL2_UIE | RV3028_CTRL2_AIE, ctrl);
+
+	return ret;
+}
+
+static int rv3028_alarm_irq_enable(struct device *dev, unsigned int enabled)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	int ctrl = 0, ret;
+
+	if (enabled) {
+		if (rv3028->rtc->uie_rtctimer.enabled)
+			ctrl |= RV3028_CTRL2_UIE;
+		if (rv3028->rtc->aie_timer.enabled)
+			ctrl |= RV3028_CTRL2_AIE;
+	}
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_STATUS,
+				 RV3028_STATUS_AF | RV3028_STATUS_UF, 0);
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_CTRL2,
+				 RV3028_CTRL2_UIE | RV3028_CTRL2_AIE, ctrl);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int rv3028_read_offset(struct device *dev, long *offset)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	int ret, value, steps;
+
+	ret = regmap_read(rv3028->regmap, RV3028_OFFSET, &value);
+	if (ret < 0)
+		return ret;
+
+	steps = sign_extend32(value << 1, 8);
+
+	ret = regmap_read(rv3028->regmap, RV3028_BACKUP, &value);
+	if (ret < 0)
+		return ret;
+
+	steps += value >> 7;
+
+	*offset = DIV_ROUND_CLOSEST(steps * OFFSET_STEP_PPT, 1000);
+
+	return 0;
+}
+
+static int rv3028_set_offset(struct device *dev, long offset)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	int ret;
+
+	offset = clamp(offset, -244141L, 243187L) * 1000;
+	offset = DIV_ROUND_CLOSEST(offset, OFFSET_STEP_PPT);
+
+	ret = regmap_write(rv3028->regmap, RV3028_OFFSET, offset >> 1);
+	if (ret < 0)
+		return ret;
+
+	return regmap_update_bits(rv3028->regmap, RV3028_BACKUP, BIT(7),
+				  offset << 7);
+}
+
+static int rv3028_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+{
+	struct rv3028_data *rv3028 = dev_get_drvdata(dev);
+	int status, ret = 0;
+
+	switch (cmd) {
+	case RTC_VL_READ:
+		ret = regmap_read(rv3028->regmap, RV3028_STATUS, &status);
+		if (ret < 0)
+			return ret;
+
+		if (status & RV3028_STATUS_PORF)
+			dev_warn(&rv3028->rtc->dev, "Voltage low, data loss detected.\n");
+
+		status &= RV3028_STATUS_PORF;
+
+		if (copy_to_user((void __user *)arg, &status, sizeof(int)))
+			return -EFAULT;
+
+		return 0;
+
+	case RTC_VL_CLR:
+		ret = regmap_update_bits(rv3028->regmap, RV3028_STATUS,
+					 RV3028_STATUS_PORF, 0);
+
+		return ret;
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+}
+
+static int rv3028_nvram_write(void *priv, unsigned int offset, void *val,
+			      size_t bytes)
+{
+	return regmap_bulk_write(priv, RV3028_RAM1 + offset, val, bytes);
+}
+
+static int rv3028_nvram_read(void *priv, unsigned int offset, void *val,
+			     size_t bytes)
+{
+	return regmap_bulk_read(priv, RV3028_RAM1 + offset, val, bytes);
+}
+
+static int rv3028_eeprom_write(void *priv, unsigned int offset, void *val,
+			       size_t bytes)
+{
+	u32 status, ctrl1;
+	int i, ret, err;
+	u8 *buf = val;
+
+	ret = regmap_read(priv, RV3028_CTRL1, &ctrl1);
+	if (ret)
+		return ret;
+
+	if (!(ctrl1 & RV3028_CTRL1_EERD)) {
+		ret = regmap_update_bits(priv, RV3028_CTRL1,
+					 RV3028_CTRL1_EERD, RV3028_CTRL1_EERD);
+		if (ret)
+			return ret;
+
+		ret = regmap_read_poll_timeout(priv, RV3028_STATUS, status,
+					       !(status & RV3028_STATUS_EEBUSY),
+					       RV3028_EEBUSY_POLL,
+					       RV3028_EEBUSY_TIMEOUT);
+		if (ret)
+			goto restore_eerd;
+	}
+
+	for (i = 0; i < bytes; i++) {
+		ret = regmap_write(priv, RV3028_EEPROM_ADDR, offset + i);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_write(priv, RV3028_EEPROM_DATA, buf[i]);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_write(priv, RV3028_EEPROM_CMD, 0x0);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_write(priv, RV3028_EEPROM_CMD,
+				   RV3028_EEPROM_CMD_WRITE);
+		if (ret)
+			goto restore_eerd;
+
+		usleep_range(RV3028_EEBUSY_POLL, RV3028_EEBUSY_TIMEOUT);
+
+		ret = regmap_read_poll_timeout(priv, RV3028_STATUS, status,
+					       !(status & RV3028_STATUS_EEBUSY),
+					       RV3028_EEBUSY_POLL,
+					       RV3028_EEBUSY_TIMEOUT);
+		if (ret)
+			goto restore_eerd;
+	}
+
+restore_eerd:
+	if (!(ctrl1 & RV3028_CTRL1_EERD))
+	{
+		err = regmap_update_bits(priv, RV3028_CTRL1, RV3028_CTRL1_EERD,
+					 0);
+		if (err && !ret)
+			ret = err;
+	}
+
+	return ret;
+}
+
+static int rv3028_eeprom_read(void *priv, unsigned int offset, void *val,
+			      size_t bytes)
+{
+	u32 status, ctrl1, data;
+	int i, ret, err;
+	u8 *buf = val;
+
+	ret = regmap_read(priv, RV3028_CTRL1, &ctrl1);
+	if (ret)
+		return ret;
+
+	if (!(ctrl1 & RV3028_CTRL1_EERD)) {
+		ret = regmap_update_bits(priv, RV3028_CTRL1,
+					 RV3028_CTRL1_EERD, RV3028_CTRL1_EERD);
+		if (ret)
+			return ret;
+
+		ret = regmap_read_poll_timeout(priv, RV3028_STATUS, status,
+					       !(status & RV3028_STATUS_EEBUSY),
+					       RV3028_EEBUSY_POLL,
+					       RV3028_EEBUSY_TIMEOUT);
+		if (ret)
+			goto restore_eerd;
+	}
+
+	for (i = 0; i < bytes; i++) {
+		ret = regmap_write(priv, RV3028_EEPROM_ADDR, offset + i);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_write(priv, RV3028_EEPROM_CMD, 0x0);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_write(priv, RV3028_EEPROM_CMD,
+				   RV3028_EEPROM_CMD_READ);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_read_poll_timeout(priv, RV3028_STATUS, status,
+					       !(status & RV3028_STATUS_EEBUSY),
+					       RV3028_EEBUSY_POLL,
+					       RV3028_EEBUSY_TIMEOUT);
+		if (ret)
+			goto restore_eerd;
+
+		ret = regmap_read(priv, RV3028_EEPROM_DATA, &data);
+		if (ret)
+			goto restore_eerd;
+		buf[i] = data;
+	}
+
+restore_eerd:
+	if (!(ctrl1 & RV3028_CTRL1_EERD))
+	{
+		err = regmap_update_bits(priv, RV3028_CTRL1, RV3028_CTRL1_EERD,
+					 0);
+		if (err && !ret)
+			ret = err;
+	}
+
+	return ret;
+}
+
+static struct rtc_class_ops rv3028_rtc_ops = {
+	.read_time = rv3028_get_time,
+	.set_time = rv3028_set_time,
+	.read_offset = rv3028_read_offset,
+	.set_offset = rv3028_set_offset,
+	.ioctl = rv3028_ioctl,
+};
+
+static const struct regmap_config regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+        .max_register = 0x37,
+};
+
+static int rv3028_probe(struct i2c_client *client)
+{
+	struct rv3028_data *rv3028;
+	int ret, status;
+	u32 ohms;
+	struct nvmem_config nvmem_cfg = {
+		.name = "rv3028_nvram",
+		.word_size = 1,
+		.stride = 1,
+		.size = 2,
+		.type = NVMEM_TYPE_BATTERY_BACKED,
+		.reg_read = rv3028_nvram_read,
+		.reg_write = rv3028_nvram_write,
+	};
+	struct nvmem_config eeprom_cfg = {
+		.name = "rv3028_eeprom",
+		.word_size = 1,
+		.stride = 1,
+		.size = 43,
+		.type = NVMEM_TYPE_EEPROM,
+		.reg_read = rv3028_eeprom_read,
+		.reg_write = rv3028_eeprom_write,
+	};
+
+	rv3028 = devm_kzalloc(&client->dev, sizeof(struct rv3028_data),
+			      GFP_KERNEL);
+	if (!rv3028)
+		return -ENOMEM;
+
+	rv3028->regmap = devm_regmap_init_i2c(client, &regmap_config);
+
+	i2c_set_clientdata(client, rv3028);
+
+	ret = regmap_read(rv3028->regmap, RV3028_STATUS, &status);
+	if (ret < 0)
+		return ret;
+
+	if (status & RV3028_STATUS_PORF)
+		dev_warn(&client->dev, "Voltage low, data loss detected.\n");
+
+	if (status & RV3028_STATUS_AF)
+		dev_warn(&client->dev, "An alarm may have been missed.\n");
+
+	rv3028->rtc = devm_rtc_allocate_device(&client->dev);
+	if (IS_ERR(rv3028->rtc)) {
+		return PTR_ERR(rv3028->rtc);
+	}
+
+	if (client->irq > 0) {
+		ret = devm_request_threaded_irq(&client->dev, client->irq,
+						NULL, rv3028_handle_irq,
+						IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+						"rv3028", rv3028);
+		if (ret) {
+			dev_warn(&client->dev, "unable to request IRQ, alarms disabled\n");
+			client->irq = 0;
+		} else {
+			rv3028_rtc_ops.read_alarm = rv3028_get_alarm;
+			rv3028_rtc_ops.set_alarm = rv3028_set_alarm;
+			rv3028_rtc_ops.alarm_irq_enable = rv3028_alarm_irq_enable;
+		}
+	}
+
+	ret = regmap_update_bits(rv3028->regmap, RV3028_CTRL1,
+				 RV3028_CTRL1_WADA, RV3028_CTRL1_WADA);
+	if (ret)
+		return ret;
+
+	/* setup timestamping */
+	ret = regmap_update_bits(rv3028->regmap, RV3028_CTRL2,
+				 RV3028_CTRL2_EIE | RV3028_CTRL2_TSE,
+				 RV3028_CTRL2_EIE | RV3028_CTRL2_TSE);
+	if (ret)
+		return ret;
+
+	/* setup trickle charger */
+	if (!device_property_read_u32(&client->dev, "trickle-resistor-ohms",
+				      &ohms)) {
+		int i;
+
+		for (i = 0; i < ARRAY_SIZE(rv3028_trickle_resistors); i++)
+			if (ohms == rv3028_trickle_resistors[i])
+				break;
+
+		if (i < ARRAY_SIZE(rv3028_trickle_resistors)) {
+			ret = regmap_update_bits(rv3028->regmap, RV3028_BACKUP,
+						 RV3028_BACKUP_TCE |
+						 RV3028_BACKUP_TCR_MASK,
+						 RV3028_BACKUP_TCE | i);
+			if (ret)
+				return ret;
+		} else {
+			dev_warn(&client->dev, "invalid trickle resistor value\n");
+		}
+	}
+
+	ret = rtc_add_group(rv3028->rtc, &rv3028_attr_group);
+	if (ret)
+		return ret;
+
+	rv3028->rtc->range_min = RTC_TIMESTAMP_BEGIN_2000;
+	rv3028->rtc->range_max = RTC_TIMESTAMP_END_2099;
+	rv3028->rtc->ops = &rv3028_rtc_ops;
+	ret = rtc_register_device(rv3028->rtc);
+	if (ret)
+		return ret;
+
+	nvmem_cfg.priv = rv3028->regmap;
+	rtc_nvmem_register(rv3028->rtc, &nvmem_cfg);
+	eeprom_cfg.priv = rv3028->regmap;
+	rtc_nvmem_register(rv3028->rtc, &eeprom_cfg);
+
+	rv3028->rtc->max_user_freq = 1;
+
+	return 0;
+}
+
+static const struct of_device_id rv3028_of_match[] = {
+	{ .compatible = "microcrystal,rv3028", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, rv3028_of_match);
+
+static struct i2c_driver rv3028_driver = {
+	.driver = {
+		.name = "rtc-rv3028",
+		.of_match_table = of_match_ptr(rv3028_of_match),
+	},
+	.probe_new	= rv3028_probe,
+};
+module_i2c_driver(rv3028_driver);
+
+MODULE_AUTHOR("Alexandre Belloni <alexandre.belloni@bootlin.com>");
+MODULE_DESCRIPTION("Micro Crystal RV3028 RTC driver");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 0e9589b427810439c0e361848256f67719bf2076 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 28 Mar 2019 13:13:52 +0000
Subject: [PATCH 0400/1835] configs: Add RTC_DRV_RV3028=m

See: https://github.com/raspberrypi/linux/issues/2912

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 90e267acbf5b5..0d3c9ea31423b 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1157,6 +1157,7 @@ CONFIG_RTC_DRV_FM3130=m
 CONFIG_RTC_DRV_RX8581=m
 CONFIG_RTC_DRV_RX8025=m
 CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_RV3028=m
 CONFIG_RTC_DRV_M41T93=m
 CONFIG_RTC_DRV_M41T94=m
 CONFIG_RTC_DRV_DS1302=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 46c121c892931..fc364176e7c7a 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1150,6 +1150,7 @@ CONFIG_RTC_DRV_FM3130=m
 CONFIG_RTC_DRV_RX8581=m
 CONFIG_RTC_DRV_RX8025=m
 CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_RV3028=m
 CONFIG_RTC_DRV_M41T93=m
 CONFIG_RTC_DRV_M41T94=m
 CONFIG_RTC_DRV_DS1302=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 2aef655ae9fb8..799e8a8cd282c 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1017,6 +1017,7 @@ CONFIG_RTC_DRV_FM3130=m
 CONFIG_RTC_DRV_RX8581=m
 CONFIG_RTC_DRV_RX8025=m
 CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_RV3028=m
 CONFIG_RTC_DRV_M41T93=m
 CONFIG_RTC_DRV_M41T94=m
 CONFIG_RTC_DRV_DS1302=m
-- 
GitLab


From c91dabaeb0cfcea6e0164aca5f396ed092fb23dc Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 28 Mar 2019 13:26:59 +0000
Subject: [PATCH 0401/1835] overlays: Add rv3028 to i2c-rtc

See: https://github.com/raspberrypi/linux/issues/2912

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README             |  4 +++-
 .../arm/boot/dts/overlays/i2c-rtc-overlay.dts | 19 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index b6fa4fa3388ba..8b6a53ba64c4f 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -939,6 +939,8 @@ Params: abx80x                  Select one of the ABx80x family:
 
         pcf8563                 Select the PCF8563 device
 
+        rv3028                  Select the Micro Crystal RV3028 device
+
         addr                    Sets the address for the RTC. Note that the
                                 device must be configured to use the specified
                                 address.
@@ -947,7 +949,7 @@ Params: abx80x                  Select one of the ABx80x family:
                                 "schottky" (ABx80x only)
 
         trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
-                                ABx80x)
+                                ABx80x, RV3028)
 
         wakeup-source           Specify that the RTC can be used as a wakeup
                                 source
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
index 7f11b7c646383..55f443d23aee3 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -158,6 +158,21 @@
 		};
 	};
 
+	fragment@10 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			rv3028: rv3028@52 {
+				compatible = "microcrystal,rv3028";
+				reg = <0x52>;
+				status = "okay";
+			};
+		};
+	};
+
 	__overrides__ {
 		abx80x = <0>,"+0";
 		ds1307 = <0>,"+1";
@@ -169,6 +184,7 @@
 		pcf8523 = <0>,"+7";
 		pcf8563 = <0>,"+8";
 		m41t62 = <0>,"+9";
+		rv3028 = <0>,"+10";
 
 		addr = <&abx80x>, "reg:0",
 		       <&ds1307>, "reg:0",
@@ -182,7 +198,8 @@
 		       <&m41t62>, "reg:0";
 		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
 		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
-					<&abx80x>,"abracon,tc-resistor";
+					<&abx80x>,"abracon,tc-resistor",
+					<&rv3028>,"trickle-resistor-ohms:0";
 		wakeup-source = <&ds1339>,"wakeup-source?",
 				<&ds3231>,"wakeup-source?",
 				<&mcp7940x>,"wakeup-source?",
-- 
GitLab


From cad72d31fb6222b86b2777cb1ba1970940a2ca13 Mon Sep 17 00:00:00 2001
From: b-ak <anur.bhargav@gmail.com>
Date: Wed, 9 Jan 2019 22:41:21 +0530
Subject: [PATCH 0402/1835] ASoC: tlv320aic32x4: SND_SOC_DAPM_MICBIAS is
 deprecated

commit 04d979d7a7bac2f645cd827ea37e5ffa5b4e1f97 upstream.

SND_SOC_DAPM_MICBIAS is deprecated, replace it with SND_SOC_DAPM_SUPPLY.

MICBIAS voltage wasn't supplied to the microphone with the older
SND_SOC_DAPM_MICBIAS widget, hence the microphone wouldn't work.

This patch fixes the problem.

Signed-off-by: b-ak <anur.bhargav@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 30 +++++++++++++++++++++++++++++-
 sound/soc/codecs/tlv320aic32x4.h |  1 +
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 45d9f4a090441..263fc2d88c7d1 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -79,6 +79,32 @@ struct aic32x4_priv {
 	struct device *dev;
 };
 
+static int mic_bias_event(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+
+	switch (event) {
+	case SND_SOC_DAPM_POST_PMU:
+		/* Change Mic Bias Registor */
+		snd_soc_component_update_bits(component, AIC32X4_MICBIAS,
+				AIC32x4_MICBIAS_MASK,
+				AIC32X4_MICBIAS_LDOIN |
+				AIC32X4_MICBIAS_2075V);
+		printk(KERN_DEBUG "%s: Mic Bias will be turned ON\n", __func__);
+		break;
+	case SND_SOC_DAPM_PRE_PMD:
+		snd_soc_component_update_bits(component, AIC32X4_MICBIAS,
+				AIC32x4_MICBIAS_MASK, 0);
+		printk(KERN_DEBUG "%s: Mic Bias will be turned OFF\n",
+				__func__);
+		break;
+	}
+
+	return 0;
+}
+
+
 static int aic32x4_get_mfp1_gpio(struct snd_kcontrol *kcontrol,
 	struct snd_ctl_elem_value *ucontrol)
 {
@@ -450,7 +476,9 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
 	SND_SOC_DAPM_MUX("IN3_R to Left Mixer Negative Resistor", SND_SOC_NOPM, 0, 0,
 			in3r_to_lmixer_controls),
 
-	SND_SOC_DAPM_MICBIAS("Mic Bias", AIC32X4_MICBIAS, 6, 0),
+	SND_SOC_DAPM_SUPPLY("Mic Bias", AIC32X4_MICBIAS, 6, 0, mic_bias_event,
+			SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+
 
 	SND_SOC_DAPM_OUTPUT("HPL"),
 	SND_SOC_DAPM_OUTPUT("HPR"),
diff --git a/sound/soc/codecs/tlv320aic32x4.h b/sound/soc/codecs/tlv320aic32x4.h
index e9df49edbf19d..c2d74025bf4b9 100644
--- a/sound/soc/codecs/tlv320aic32x4.h
+++ b/sound/soc/codecs/tlv320aic32x4.h
@@ -195,6 +195,7 @@ int aic32x4_remove(struct device *dev);
 /* AIC32X4_MICBIAS */
 #define AIC32X4_MICBIAS_LDOIN		BIT(3)
 #define AIC32X4_MICBIAS_2075V		0x60
+#define AIC32x4_MICBIAS_MASK            GENMASK(6, 3)
 
 /* AIC32X4_LMICPGANIN */
 #define AIC32X4_LMICPGANIN_IN2R_10K	0x10
-- 
GitLab


From 23c6f75595afd850ca49506cfcd0217edb929cd4 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Mon, 18 Mar 2019 20:37:44 -0700
Subject: [PATCH 0403/1835] ASoC: tlv320aic32x4: Break out clock setting into
 separate function

commit bf31cbfbe25001036e1e096b1c260bf871766ea5 upstream.

Break the clock setting logic out from the main hw_params.  It's
rather large and unweildy and makes for a large function.  This
also better enables some of the following changes to the clock
tree access in the driver.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 263fc2d88c7d1..b569e1e999e46 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -698,17 +698,13 @@ static int aic32x4_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
 	return 0;
 }
 
-static int aic32x4_hw_params(struct snd_pcm_substream *substream,
-			     struct snd_pcm_hw_params *params,
-			     struct snd_soc_dai *dai)
+static int aic32x4_setup_clocks(struct snd_soc_component *component,
+				unsigned int sample_rate,
+				unsigned int parent_rate)
 {
-	struct snd_soc_component *component = dai->component;
-	struct aic32x4_priv *aic32x4 = snd_soc_component_get_drvdata(component);
-	u8 iface1_reg = 0;
-	u8 dacsetup_reg = 0;
 	int i;
 
-	i = aic32x4_get_divs(aic32x4->sysclk, params_rate(params));
+	i = aic32x4_get_divs(parent_rate, sample_rate);
 	if (i < 0) {
 		printk(KERN_ERR "aic32x4: sampling rate not supported\n");
 		return i;
@@ -765,6 +761,20 @@ static int aic32x4_hw_params(struct snd_pcm_substream *substream,
 	snd_soc_component_update_bits(component, AIC32X4_BCLKN,
 			    AIC32X4_BCLK_MASK, aic32x4_divs[i].blck_N);
 
+	return 0;
+}
+
+static int aic32x4_hw_params(struct snd_pcm_substream *substream,
+			     struct snd_pcm_hw_params *params,
+			     struct snd_soc_dai *dai)
+{
+	struct snd_soc_component *component = dai->component;
+	struct aic32x4_priv *aic32x4 = snd_soc_component_get_drvdata(component);
+	u8 iface1_reg = 0;
+	u8 dacsetup_reg = 0;
+
+	aic32x4_setup_clocks(component, params_rate(params), aic32x4->sysclk);
+
 	switch (params_width(params)) {
 	case 16:
 		iface1_reg |= (AIC32X4_WORD_LEN_16BITS <<
-- 
GitLab


From 1846f10a4a7ee76fec0900c9e6033bee18a012f7 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Wed, 20 Mar 2019 19:38:44 -0700
Subject: [PATCH 0404/1835] ASoC: tlv320aic32x4: Properly Set Processing Blocks

commit c95e3a4b96293403a427b5185e60fad28af51fdd upstream.

Different processing blocks are required for different sampling
rates and power parameters.  Set the processing blocks based
on this information.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 56 ++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 20 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index b569e1e999e46..2dc43968505fa 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -59,6 +59,8 @@ struct aic32x4_rate_divs {
 	u8 nadc;
 	u8 madc;
 	u8 blck_N;
+	u8 r_block;
+	u8 p_block;
 };
 
 struct aic32x4_priv {
@@ -307,34 +309,34 @@ static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 
 static const struct aic32x4_rate_divs aic32x4_divs[] = {
 	/* 8k rate */
-	{12000000, 8000, 1, 7, 6800, 768, 5, 3, 128, 5, 18, 24},
-	{24000000, 8000, 2, 7, 6800, 768, 15, 1, 64, 45, 4, 24},
-	{25000000, 8000, 2, 7, 3728, 768, 15, 1, 64, 45, 4, 24},
+	{12000000, 8000, 1, 7, 6800, 768, 5, 3, 128, 5, 18, 24, 1, 1},
+	{24000000, 8000, 2, 7, 6800, 768, 15, 1, 64, 45, 4, 24, 1, 1},
+	{25000000, 8000, 2, 7, 3728, 768, 15, 1, 64, 45, 4, 24, 1, 1},
 	/* 11.025k rate */
-	{12000000, 11025, 1, 7, 5264, 512, 8, 2, 128, 8, 8, 16},
-	{24000000, 11025, 2, 7, 5264, 512, 16, 1, 64, 32, 4, 16},
+	{12000000, 11025, 1, 7, 5264, 512, 8, 2, 128, 8, 8, 16, 1, 1},
+	{24000000, 11025, 2, 7, 5264, 512, 16, 1, 64, 32, 4, 16, 1, 1},
 	/* 16k rate */
-	{12000000, 16000, 1, 7, 6800, 384, 5, 3, 128, 5, 9, 12},
-	{24000000, 16000, 2, 7, 6800, 384, 15, 1, 64, 18, 5, 12},
-	{25000000, 16000, 2, 7, 3728, 384, 15, 1, 64, 18, 5, 12},
+	{12000000, 16000, 1, 7, 6800, 384, 5, 3, 128, 5, 9, 12, 1, 1},
+	{24000000, 16000, 2, 7, 6800, 384, 15, 1, 64, 18, 5, 12, 1, 1},
+	{25000000, 16000, 2, 7, 3728, 384, 15, 1, 64, 18, 5, 12, 1, 1},
 	/* 22.05k rate */
-	{12000000, 22050, 1, 7, 5264, 256, 4, 4, 128, 4, 8, 8},
-	{24000000, 22050, 2, 7, 5264, 256, 16, 1, 64, 16, 4, 8},
-	{25000000, 22050, 2, 7, 2253, 256, 16, 1, 64, 16, 4, 8},
+	{12000000, 22050, 1, 7, 5264, 256, 4, 4, 128, 4, 8, 8, 1, 1},
+	{24000000, 22050, 2, 7, 5264, 256, 16, 1, 64, 16, 4, 8, 1, 1},
+	{25000000, 22050, 2, 7, 2253, 256, 16, 1, 64, 16, 4, 8, 1, 1},
 	/* 32k rate */
-	{12000000, 32000, 1, 7, 1680, 192, 2, 7, 64, 2, 21, 6},
-	{24000000, 32000, 2, 7, 1680, 192, 7, 2, 64, 7, 6, 6},
+	{12000000, 32000, 1, 7, 1680, 192, 2, 7, 64, 2, 21, 6, 1, 1},
+	{24000000, 32000, 2, 7, 1680, 192, 7, 2, 64, 7, 6, 6, 1, 1},
 	/* 44.1k rate */
-	{12000000, 44100, 1, 7, 5264, 128, 2, 8, 128, 2, 8, 4},
-	{24000000, 44100, 2, 7, 5264, 128, 8, 2, 64, 8, 4, 4},
-	{25000000, 44100, 2, 7, 2253, 128, 8, 2, 64, 8, 4, 4},
+	{12000000, 44100, 1, 7, 5264, 128, 2, 8, 128, 2, 8, 4, 1, 1},
+	{24000000, 44100, 2, 7, 5264, 128, 8, 2, 64, 8, 4, 4, 1, 1},
+	{25000000, 44100, 2, 7, 2253, 128, 8, 2, 64, 8, 4, 4, 1, 1},
 	/* 48k rate */
-	{12000000, 48000, 1, 8, 1920, 128, 2, 8, 128, 2, 8, 4},
-	{24000000, 48000, 2, 8, 1920, 128, 8, 2, 64, 8, 4, 4},
-	{25000000, 48000, 2, 7, 8643, 128, 8, 2, 64, 8, 4, 4},
+	{12000000, 48000, 1, 8, 1920, 128, 2, 8, 128, 2, 8, 4, 1, 1},
+	{24000000, 48000, 2, 8, 1920, 128, 8, 2, 64, 8, 4, 4, 1, 1},
+	{25000000, 48000, 2, 7, 8643, 128, 8, 2, 64, 8, 4, 4, 1, 1},
 
 	/* 96k rate */
-	{25000000, 96000, 2, 7, 8643, 64, 4, 4, 64, 4, 4, 1},
+	{25000000, 96000, 2, 7, 8643, 64, 4, 4, 64, 4, 4, 1, 1, 9},
 };
 
 static const struct snd_kcontrol_new hpl_output_mixer_controls[] = {
@@ -698,6 +700,18 @@ static int aic32x4_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
 	return 0;
 }
 
+static int aic32x4_set_processing_blocks(struct snd_soc_component *component,
+						u8 r_block, u8 p_block)
+{
+	if (r_block > 18 || p_block > 25)
+		return -EINVAL;
+
+	snd_soc_component_write(component, AIC32X4_ADCSPB, r_block);
+	snd_soc_component_write(component, AIC32X4_DACSPB, p_block);
+
+	return 0;
+}
+
 static int aic32x4_setup_clocks(struct snd_soc_component *component,
 				unsigned int sample_rate,
 				unsigned int parent_rate)
@@ -710,6 +724,8 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 		return i;
 	}
 
+	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
+
 	/* MCLK as PLL_CLKIN */
 	snd_soc_component_update_bits(component, AIC32X4_CLKMUX, AIC32X4_PLL_CLKIN_MASK,
 			    AIC32X4_PLL_CLKIN_MCLK << AIC32X4_PLL_CLKIN_SHIFT);
-- 
GitLab


From 838c8e51474e40660325aed383366ffc310976eb Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:45 -0700
Subject: [PATCH 0405/1835] ASoC: tlv320aic32x4: Model PLL in CCF

commit 514b044cba667e4b7c383ec79b42b997e624b91d upstream.

Model and manage the on-board PLL as a component in the Core
Clock Framework.  This should allow us to do some more complex
clock management and power control.  Also, some of the
on-board chip clocks can be exposed to the outside, and this
change will make those clocks easier to consume by other
parts of the kernel.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/Kconfig             |   1 +
 sound/soc/codecs/Makefile            |   2 +-
 sound/soc/codecs/tlv320aic32x4-clk.c | 323 +++++++++++++++++++++++++++
 sound/soc/codecs/tlv320aic32x4.c     | 195 ++++++++--------
 sound/soc/codecs/tlv320aic32x4.h     |   5 +
 5 files changed, 431 insertions(+), 95 deletions(-)
 create mode 100644 sound/soc/codecs/tlv320aic32x4-clk.c

diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 985cfa2c61e68..9d283a12b1547 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -1025,6 +1025,7 @@ config SND_SOC_TLV320AIC31XX
 
 config SND_SOC_TLV320AIC32X4
 	tristate
+	depends on COMMON_CLK
 
 config SND_SOC_TLV320AIC32X4_I2C
 	tristate "Texas Instruments TLV320AIC32x4 audio CODECs - I2C"
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 166f169ca06a9..d4e310bce30ce 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -182,7 +182,7 @@ snd-soc-tlv320aic23-i2c-objs := tlv320aic23-i2c.o
 snd-soc-tlv320aic23-spi-objs := tlv320aic23-spi.o
 snd-soc-tlv320aic26-objs := tlv320aic26.o
 snd-soc-tlv320aic31xx-objs := tlv320aic31xx.o
-snd-soc-tlv320aic32x4-objs := tlv320aic32x4.o
+snd-soc-tlv320aic32x4-objs := tlv320aic32x4.o tlv320aic32x4-clk.o
 snd-soc-tlv320aic32x4-i2c-objs := tlv320aic32x4-i2c.o
 snd-soc-tlv320aic32x4-spi-objs := tlv320aic32x4-spi.o
 snd-soc-tlv320aic3x-objs := tlv320aic3x.o
diff --git a/sound/soc/codecs/tlv320aic32x4-clk.c b/sound/soc/codecs/tlv320aic32x4-clk.c
new file mode 100644
index 0000000000000..5e495fc8d9316
--- /dev/null
+++ b/sound/soc/codecs/tlv320aic32x4-clk.c
@@ -0,0 +1,323 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Clock Tree for the Texas Instruments TLV320AIC32x4
+ *
+ * Copyright 2019 Annaliese McDermond
+ *
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/regmap.h>
+#include <linux/device.h>
+
+#include "tlv320aic32x4.h"
+
+#define to_clk_aic32x4(_hw) container_of(_hw, struct clk_aic32x4, hw)
+struct clk_aic32x4 {
+	struct clk_hw hw;
+	struct device *dev;
+	struct regmap *regmap;
+	unsigned int reg;
+};
+
+/*
+ * struct clk_aic32x4_pll_muldiv - Multiplier/divider settings
+ * @p:		Divider
+ * @r:		first multiplier
+ * @j:		integer part of second multiplier
+ * @d:		decimal part of second multiplier
+ */
+struct clk_aic32x4_pll_muldiv {
+	u8 p;
+	u16 r;
+	u8 j;
+	u16 d;
+};
+
+struct aic32x4_clkdesc {
+	const char *name;
+	const char * const *parent_names;
+	unsigned int num_parents;
+	const struct clk_ops *ops;
+	unsigned int reg;
+};
+
+static int clk_aic32x4_pll_prepare(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+
+	return regmap_update_bits(pll->regmap, AIC32X4_PLLPR,
+				AIC32X4_PLLEN, AIC32X4_PLLEN);
+}
+
+static void clk_aic32x4_pll_unprepare(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+
+	regmap_update_bits(pll->regmap, AIC32X4_PLLPR,
+				AIC32X4_PLLEN, 0);
+}
+
+static int clk_aic32x4_pll_is_prepared(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+
+	unsigned int val;
+	int ret;
+
+	ret = regmap_read(pll->regmap, AIC32X4_PLLPR, &val);
+	if (ret < 0)
+		return ret;
+
+	return !!(val & AIC32X4_PLLEN);
+}
+
+static int clk_aic32x4_pll_get_muldiv(struct clk_aic32x4 *pll,
+			struct clk_aic32x4_pll_muldiv *settings)
+{
+	/*	Change to use regmap_bulk_read? */
+	unsigned int val;
+	int ret;
+
+	ret = regmap_read(pll->regmap, AIC32X4_PLLPR, &val);
+	if (ret)
+		return ret;
+	settings->r = val & AIC32X4_PLL_R_MASK;
+	settings->p = (val & AIC32X4_PLL_P_MASK) >> AIC32X4_PLL_P_SHIFT;
+
+	ret = regmap_read(pll->regmap, AIC32X4_PLLJ, &val);
+	if (ret < 0)
+		return ret;
+	settings->j = val;
+
+	ret = regmap_read(pll->regmap, AIC32X4_PLLDMSB, &val);
+	if (ret < 0)
+		return ret;
+	settings->d = val << 8;
+
+	ret = regmap_read(pll->regmap, AIC32X4_PLLDLSB,	 &val);
+	if (ret < 0)
+		return ret;
+	settings->d |= val;
+
+	return 0;
+}
+
+static int clk_aic32x4_pll_set_muldiv(struct clk_aic32x4 *pll,
+			struct clk_aic32x4_pll_muldiv *settings)
+{
+	int ret;
+	/*	Change to use regmap_bulk_write for some if not all? */
+
+	ret = regmap_update_bits(pll->regmap, AIC32X4_PLLPR,
+				AIC32X4_PLL_R_MASK, settings->r);
+	if (ret < 0)
+		return ret;
+
+	ret = regmap_update_bits(pll->regmap, AIC32X4_PLLPR,
+				AIC32X4_PLL_P_MASK,
+				settings->p << AIC32X4_PLL_P_SHIFT);
+	if (ret < 0)
+		return ret;
+
+	ret = regmap_write(pll->regmap, AIC32X4_PLLJ, settings->j);
+	if (ret < 0)
+		return ret;
+
+	ret = regmap_write(pll->regmap, AIC32X4_PLLDMSB, (settings->d >> 8));
+	if (ret < 0)
+		return ret;
+	ret = regmap_write(pll->regmap, AIC32X4_PLLDLSB, (settings->d & 0xff));
+	if (ret < 0)
+		return ret;
+
+	return 0;
+}
+
+static unsigned long clk_aic32x4_pll_calc_rate(
+			struct clk_aic32x4_pll_muldiv *settings,
+			unsigned long parent_rate)
+{
+	u64 rate;
+	/*
+	 * We scale j by 10000 to account for the decimal part of P and divide
+	 * it back out later.
+	 */
+	rate = (u64) parent_rate * settings->r *
+				((settings->j * 10000) + settings->d);
+
+	return (unsigned long) DIV_ROUND_UP_ULL(rate, settings->p * 10000);
+}
+
+static int clk_aic32x4_pll_calc_muldiv(struct clk_aic32x4_pll_muldiv *settings,
+			unsigned long rate, unsigned long parent_rate)
+{
+	u64 multiplier;
+
+	settings->p = parent_rate / AIC32X4_MAX_PLL_CLKIN + 1;
+	if (settings->p > 8)
+		return -1;
+
+	/*
+	 * We scale this figure by 10000 so that we can get the decimal part
+	 * of the multiplier.	This is because we can't do floating point
+	 * math in the kernel.
+	 */
+	 multiplier = (u64) rate * settings->p * 10000;
+	 do_div(multiplier, parent_rate);
+
+	/*
+	 * J can't be over 64, so R can scale this.
+	 * R can't be greater than 4.
+	 */
+	settings->r = ((u32) multiplier / 640000) + 1;
+	if (settings->r > 4)
+		return -1;
+	do_div(multiplier, settings->r);
+
+	/*
+	 * J can't be < 1.
+	 */
+	if (multiplier < 10000)
+		return -1;
+
+	/* Figure out the integer part, J, and the fractional part, D. */
+	settings->j = (u32) multiplier / 10000;
+	settings->d = (u32) multiplier % 10000;
+
+	return 0;
+}
+
+static unsigned long clk_aic32x4_pll_recalc_rate(struct clk_hw *hw,
+			unsigned long parent_rate)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+	struct clk_aic32x4_pll_muldiv settings;
+	int ret;
+
+	ret =  clk_aic32x4_pll_get_muldiv(pll, &settings);
+	if (ret < 0)
+		return 0;
+
+	return clk_aic32x4_pll_calc_rate(&settings, parent_rate);
+}
+
+static long clk_aic32x4_pll_round_rate(struct clk_hw *hw,
+			unsigned long rate,
+			unsigned long *parent_rate)
+{
+	struct clk_aic32x4_pll_muldiv settings;
+	int ret;
+
+	ret = clk_aic32x4_pll_calc_muldiv(&settings, rate, *parent_rate);
+	if (ret < 0)
+		return 0;
+
+	return clk_aic32x4_pll_calc_rate(&settings, *parent_rate);
+}
+
+static int clk_aic32x4_pll_set_rate(struct clk_hw *hw,
+			unsigned long rate,
+			unsigned long parent_rate)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+	struct clk_aic32x4_pll_muldiv settings;
+	int ret;
+
+	ret = clk_aic32x4_pll_calc_muldiv(&settings, rate, parent_rate);
+	if (ret < 0)
+		return -EINVAL;
+
+	return clk_aic32x4_pll_set_muldiv(pll, &settings);
+}
+
+static int clk_aic32x4_pll_set_parent(struct clk_hw *hw, u8 index)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+
+	return regmap_update_bits(pll->regmap,
+				AIC32X4_CLKMUX,
+				AIC32X4_PLL_CLKIN_MASK,
+				index << AIC32X4_PLL_CLKIN_SHIFT);
+}
+
+static u8 clk_aic32x4_pll_get_parent(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *pll = to_clk_aic32x4(hw);
+	unsigned int val;
+
+	regmap_read(pll->regmap, AIC32X4_PLLPR, &val);
+
+	return (val & AIC32X4_PLL_CLKIN_MASK) >> AIC32X4_PLL_CLKIN_SHIFT;
+}
+
+
+static const struct clk_ops aic32x4_pll_ops = {
+	.prepare = clk_aic32x4_pll_prepare,
+	.unprepare = clk_aic32x4_pll_unprepare,
+	.is_prepared = clk_aic32x4_pll_is_prepared,
+	.recalc_rate = clk_aic32x4_pll_recalc_rate,
+	.round_rate = clk_aic32x4_pll_round_rate,
+	.set_rate = clk_aic32x4_pll_set_rate,
+	.set_parent = clk_aic32x4_pll_set_parent,
+	.get_parent = clk_aic32x4_pll_get_parent,
+};
+
+static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
+	{
+		.name = "pll",
+		.parent_names =
+			(const char* []) { "mclk", "bclk", "gpio", "din" },
+		.num_parents = 4,
+		.ops = &aic32x4_pll_ops,
+		.reg = 0,
+	},
+};
+
+static struct clk *aic32x4_register_clk(struct device *dev,
+			struct aic32x4_clkdesc *desc)
+{
+	struct clk_init_data init;
+	struct clk_aic32x4 *priv;
+	const char *devname = dev_name(dev);
+
+	init.ops = desc->ops;
+	init.name = desc->name;
+	init.parent_names = desc->parent_names;
+	init.num_parents = desc->num_parents;
+	init.flags = 0;
+
+	priv = devm_kzalloc(dev, sizeof(struct clk_aic32x4), GFP_KERNEL);
+	if (priv == NULL)
+		return (struct clk *) -ENOMEM;
+
+	priv->dev = dev;
+	priv->hw.init = &init;
+	priv->regmap = dev_get_regmap(dev, NULL);
+	priv->reg = desc->reg;
+
+	clk_hw_register_clkdev(&priv->hw, desc->name, devname);
+	return devm_clk_register(dev, &priv->hw);
+}
+
+int aic32x4_register_clocks(struct device *dev, const char *mclk_name)
+{
+	int i;
+
+	/*
+	 * These lines are here to preserve the current functionality of
+	 * the driver with regard to the DT.  These should eventually be set
+	 * by DT nodes so that the connections can be set up in configuration
+	 * rather than code.
+	 */
+	aic32x4_clkdesc_array[0].parent_names =
+			(const char* []) { mclk_name, "bclk", "gpio", "din" };
+
+	for (i = 0; i < ARRAY_SIZE(aic32x4_clkdesc_array); ++i)
+		aic32x4_register_clk(dev, &aic32x4_clkdesc_array[i]);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(aic32x4_register_clocks);
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 2dc43968505fa..19472ef37e89c 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -14,7 +14,7 @@
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
@@ -33,6 +33,7 @@
 #include <linux/cdev.h>
 #include <linux/slab.h>
 #include <linux/clk.h>
+#include <linux/of_clk.h>
 #include <linux/regulator/consumer.h>
 
 #include <sound/tlv320aic32x4.h>
@@ -49,9 +50,7 @@
 struct aic32x4_rate_divs {
 	u32 mclk;
 	u32 rate;
-	u8 p_val;
-	u8 pll_j;
-	u16 pll_d;
+	unsigned long pll_rate;
 	u16 dosr;
 	u8 ndac;
 	u8 mdac;
@@ -71,6 +70,7 @@ struct aic32x4_priv {
 	bool swapdacs;
 	int rstn_gpio;
 	struct clk *mclk;
+	const char *mclk_name;
 
 	struct regulator *supply_ldo;
 	struct regulator *supply_iov;
@@ -309,34 +309,34 @@ static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 
 static const struct aic32x4_rate_divs aic32x4_divs[] = {
 	/* 8k rate */
-	{12000000, 8000, 1, 7, 6800, 768, 5, 3, 128, 5, 18, 24, 1, 1},
-	{24000000, 8000, 2, 7, 6800, 768, 15, 1, 64, 45, 4, 24, 1, 1},
-	{25000000, 8000, 2, 7, 3728, 768, 15, 1, 64, 45, 4, 24, 1, 1},
+	{ 12000000, 8000, 57120000, 768, 5, 3, 128, 5, 18, 24, 1, 1 },
+	{ 24000000, 8000, 57120000, 768, 15, 1, 64, 45, 4, 24, 1, 1 },
+	{ 25000000, 8000, 32620000, 768, 15, 1, 64, 45, 4, 24, 1, 1 },
 	/* 11.025k rate */
-	{12000000, 11025, 1, 7, 5264, 512, 8, 2, 128, 8, 8, 16, 1, 1},
-	{24000000, 11025, 2, 7, 5264, 512, 16, 1, 64, 32, 4, 16, 1, 1},
+	{ 12000000, 11025, 44217600, 512, 8, 2, 128, 8, 8, 16, 1, 1 },
+	{ 24000000, 11025, 44217600, 512, 16, 1, 64, 32, 4, 16, 1, 1 },
 	/* 16k rate */
-	{12000000, 16000, 1, 7, 6800, 384, 5, 3, 128, 5, 9, 12, 1, 1},
-	{24000000, 16000, 2, 7, 6800, 384, 15, 1, 64, 18, 5, 12, 1, 1},
-	{25000000, 16000, 2, 7, 3728, 384, 15, 1, 64, 18, 5, 12, 1, 1},
+	{ 12000000, 16000, 57120000, 384, 5, 3, 128, 5, 9, 12, 1, 1 },
+	{ 24000000, 16000, 57120000, 384, 15, 1, 64, 18, 5, 12, 1, 1 },
+	{ 25000000, 16000, 32620000, 384, 15, 1, 64, 18, 5, 12, 1, 1 },
 	/* 22.05k rate */
-	{12000000, 22050, 1, 7, 5264, 256, 4, 4, 128, 4, 8, 8, 1, 1},
-	{24000000, 22050, 2, 7, 5264, 256, 16, 1, 64, 16, 4, 8, 1, 1},
-	{25000000, 22050, 2, 7, 2253, 256, 16, 1, 64, 16, 4, 8, 1, 1},
+	{ 12000000, 22050, 44217600, 256, 4, 4, 128, 4, 8, 8, 1, 1 },
+	{ 24000000, 22050, 44217600, 256, 16, 1, 64, 16, 4, 8, 1, 1 },
+	{ 25000000, 22050, 19713750, 256, 16, 1, 64, 16, 4, 8, 1, 1 },
 	/* 32k rate */
-	{12000000, 32000, 1, 7, 1680, 192, 2, 7, 64, 2, 21, 6, 1, 1},
-	{24000000, 32000, 2, 7, 1680, 192, 7, 2, 64, 7, 6, 6, 1, 1},
+	{ 12000000, 32000, 14112000, 192, 2, 7, 64, 2, 21, 6, 1, 1 },
+	{ 24000000, 32000, 14112000, 192, 7, 2, 64, 7, 6, 6, 1, 1 },
 	/* 44.1k rate */
-	{12000000, 44100, 1, 7, 5264, 128, 2, 8, 128, 2, 8, 4, 1, 1},
-	{24000000, 44100, 2, 7, 5264, 128, 8, 2, 64, 8, 4, 4, 1, 1},
-	{25000000, 44100, 2, 7, 2253, 128, 8, 2, 64, 8, 4, 4, 1, 1},
+	{ 12000000, 44100, 44217600, 128, 2, 8, 128, 2, 8, 4, 1, 1 },
+	{ 24000000, 44100, 44217600, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
+	{ 25000000, 44100, 19713750, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
 	/* 48k rate */
-	{12000000, 48000, 1, 8, 1920, 128, 2, 8, 128, 2, 8, 4, 1, 1},
-	{24000000, 48000, 2, 8, 1920, 128, 8, 2, 64, 8, 4, 4, 1, 1},
-	{25000000, 48000, 2, 7, 8643, 128, 8, 2, 64, 8, 4, 4, 1, 1},
+	{ 12000000, 48000, 18432000, 128, 2, 8, 128, 2, 8, 4, 1, 1 },
+	{ 24000000, 48000, 18432000, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
+	{ 25000000, 48000, 75626250, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
 
 	/* 96k rate */
-	{25000000, 96000, 2, 7, 8643, 64, 4, 4, 64, 4, 4, 1, 1, 9},
+	{ 25000000, 96000, 75626250, 64, 4, 4, 64, 4, 4, 1, 1, 9 },
 };
 
 static const struct snd_kcontrol_new hpl_output_mixer_controls[] = {
@@ -393,7 +393,7 @@ static const struct snd_kcontrol_new in3r_to_lmixer_controls[] = {
 	SOC_DAPM_ENUM("IN3_R L- Switch", in3r_lpga_n_enum),
 };
 
-/*  Right mixer pins */
+/*	Right mixer pins */
 static SOC_ENUM_SINGLE_DECL(in1r_rpga_p_enum, AIC32X4_RMICPGAPIN, 6, resistor_text);
 static SOC_ENUM_SINGLE_DECL(in2r_rpga_p_enum, AIC32X4_RMICPGAPIN, 4, resistor_text);
 static SOC_ENUM_SINGLE_DECL(in3r_rpga_p_enum, AIC32X4_RMICPGAPIN, 2, resistor_text);
@@ -597,7 +597,7 @@ static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
 static const struct regmap_range_cfg aic32x4_regmap_pages[] = {
 	{
 		.selector_reg = 0,
-		.selector_mask  = 0xff,
+		.selector_mask	= 0xff,
 		.window_start = 0,
 		.window_len = 128,
 		.range_min = 0,
@@ -618,7 +618,7 @@ static inline int aic32x4_get_divs(int mclk, int rate)
 
 	for (i = 0; i < ARRAY_SIZE(aic32x4_divs); i++) {
 		if ((aic32x4_divs[i].rate == rate)
-		    && (aic32x4_divs[i].mclk == mclk)) {
+			&& (aic32x4_divs[i].mclk == mclk)) {
 			return i;
 		}
 	}
@@ -690,12 +690,12 @@ static int aic32x4_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
 	}
 
 	snd_soc_component_update_bits(component, AIC32X4_IFACE1,
-			    AIC32X4_IFACE1_DATATYPE_MASK |
-			    AIC32X4_IFACE1_MASTER_MASK, iface_reg_1);
+				AIC32X4_IFACE1_DATATYPE_MASK |
+				AIC32X4_IFACE1_MASTER_MASK, iface_reg_1);
 	snd_soc_component_update_bits(component, AIC32X4_IFACE2,
-			    AIC32X4_DATA_OFFSET_MASK, iface_reg_2);
+				AIC32X4_DATA_OFFSET_MASK, iface_reg_2);
 	snd_soc_component_update_bits(component, AIC32X4_IFACE3,
-			    AIC32X4_BCLKINV_MASK, iface_reg_3);
+				AIC32X4_BCLKINV_MASK, iface_reg_3);
 
 	return 0;
 }
@@ -717,6 +717,11 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 				unsigned int parent_rate)
 {
 	int i;
+	int ret;
+
+	struct clk_bulk_data clocks[] = {
+		{ .id = "pll" },
+	};
 
 	i = aic32x4_get_divs(parent_rate, sample_rate);
 	if (i < 0) {
@@ -724,39 +729,29 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 		return i;
 	}
 
+	ret = devm_clk_bulk_get(component->dev, ARRAY_SIZE(clocks), clocks);
+	if (ret)
+		return ret;
+
+	clk_set_rate(clocks[0].clk, sample_rate);
+
 	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
 
-	/* MCLK as PLL_CLKIN */
-	snd_soc_component_update_bits(component, AIC32X4_CLKMUX, AIC32X4_PLL_CLKIN_MASK,
-			    AIC32X4_PLL_CLKIN_MCLK << AIC32X4_PLL_CLKIN_SHIFT);
 	/* PLL as CODEC_CLKIN */
-	snd_soc_component_update_bits(component, AIC32X4_CLKMUX, AIC32X4_CODEC_CLKIN_MASK,
-			    AIC32X4_CODEC_CLKIN_PLL << AIC32X4_CODEC_CLKIN_SHIFT);
+	snd_soc_component_update_bits(component, AIC32X4_CLKMUX,
+			AIC32X4_CODEC_CLKIN_MASK,
+			AIC32X4_CODEC_CLKIN_PLL << AIC32X4_CODEC_CLKIN_SHIFT);
 	/* DAC_MOD_CLK as BDIV_CLKIN */
 	snd_soc_component_update_bits(component, AIC32X4_IFACE3, AIC32X4_BDIVCLK_MASK,
-			    AIC32X4_DACMOD2BCLK << AIC32X4_BDIVCLK_SHIFT);
-
-	/* We will fix R value to 1 and will make P & J=K.D as variable */
-	snd_soc_component_update_bits(component, AIC32X4_PLLPR, AIC32X4_PLL_R_MASK, 0x01);
-
-	/* PLL P value */
-	snd_soc_component_update_bits(component, AIC32X4_PLLPR, AIC32X4_PLL_P_MASK,
-			    aic32x4_divs[i].p_val << AIC32X4_PLL_P_SHIFT);
-
-	/* PLL J value */
-	snd_soc_component_write(component, AIC32X4_PLLJ, aic32x4_divs[i].pll_j);
-
-	/* PLL D value */
-	snd_soc_component_write(component, AIC32X4_PLLDMSB, (aic32x4_divs[i].pll_d >> 8));
-	snd_soc_component_write(component, AIC32X4_PLLDLSB, (aic32x4_divs[i].pll_d & 0xff));
+				AIC32X4_DACMOD2BCLK << AIC32X4_BDIVCLK_SHIFT);
 
 	/* NDAC divider value */
 	snd_soc_component_update_bits(component, AIC32X4_NDAC,
-			    AIC32X4_NDAC_MASK, aic32x4_divs[i].ndac);
+				AIC32X4_NDAC_MASK, aic32x4_divs[i].ndac);
 
 	/* MDAC divider value */
 	snd_soc_component_update_bits(component, AIC32X4_MDAC,
-			    AIC32X4_MDAC_MASK, aic32x4_divs[i].mdac);
+				AIC32X4_MDAC_MASK, aic32x4_divs[i].mdac);
 
 	/* DOSR MSB & LSB values */
 	snd_soc_component_write(component, AIC32X4_DOSRMSB, aic32x4_divs[i].dosr >> 8);
@@ -764,18 +759,18 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 
 	/* NADC divider value */
 	snd_soc_component_update_bits(component, AIC32X4_NADC,
-			    AIC32X4_NADC_MASK, aic32x4_divs[i].nadc);
+				AIC32X4_NADC_MASK, aic32x4_divs[i].nadc);
 
 	/* MADC divider value */
 	snd_soc_component_update_bits(component, AIC32X4_MADC,
-			    AIC32X4_MADC_MASK, aic32x4_divs[i].madc);
+				AIC32X4_MADC_MASK, aic32x4_divs[i].madc);
 
 	/* AOSR value */
 	snd_soc_component_write(component, AIC32X4_AOSR, aic32x4_divs[i].aosr);
 
 	/* BCLK N divider */
 	snd_soc_component_update_bits(component, AIC32X4_BCLKN,
-			    AIC32X4_BCLK_MASK, aic32x4_divs[i].blck_N);
+				AIC32X4_BCLK_MASK, aic32x4_divs[i].blck_N);
 
 	return 0;
 }
@@ -794,23 +789,23 @@ static int aic32x4_hw_params(struct snd_pcm_substream *substream,
 	switch (params_width(params)) {
 	case 16:
 		iface1_reg |= (AIC32X4_WORD_LEN_16BITS <<
-			       AIC32X4_IFACE1_DATALEN_SHIFT);
+				   AIC32X4_IFACE1_DATALEN_SHIFT);
 		break;
 	case 20:
 		iface1_reg |= (AIC32X4_WORD_LEN_20BITS <<
-			       AIC32X4_IFACE1_DATALEN_SHIFT);
+				   AIC32X4_IFACE1_DATALEN_SHIFT);
 		break;
 	case 24:
 		iface1_reg |= (AIC32X4_WORD_LEN_24BITS <<
-			       AIC32X4_IFACE1_DATALEN_SHIFT);
+				   AIC32X4_IFACE1_DATALEN_SHIFT);
 		break;
 	case 32:
 		iface1_reg |= (AIC32X4_WORD_LEN_32BITS <<
-			       AIC32X4_IFACE1_DATALEN_SHIFT);
+				   AIC32X4_IFACE1_DATALEN_SHIFT);
 		break;
 	}
 	snd_soc_component_update_bits(component, AIC32X4_IFACE1,
-			    AIC32X4_IFACE1_DATALEN_MASK, iface1_reg);
+				AIC32X4_IFACE1_DATALEN_MASK, iface1_reg);
 
 	if (params_channels(params) == 1) {
 		dacsetup_reg = AIC32X4_RDAC2LCHN | AIC32X4_LDAC2LCHN;
@@ -821,7 +816,7 @@ static int aic32x4_hw_params(struct snd_pcm_substream *substream,
 			dacsetup_reg = AIC32X4_LDAC2LCHN | AIC32X4_RDAC2RCHN;
 	}
 	snd_soc_component_update_bits(component, AIC32X4_DACSETUP,
-			    AIC32X4_DAC_CHAN_MASK, dacsetup_reg);
+				AIC32X4_DAC_CHAN_MASK, dacsetup_reg);
 
 	return 0;
 }
@@ -831,7 +826,7 @@ static int aic32x4_mute(struct snd_soc_dai *dai, int mute)
 	struct snd_soc_component *component = dai->component;
 
 	snd_soc_component_update_bits(component, AIC32X4_DACMUTE,
-			    AIC32X4_MUTEON, mute ? AIC32X4_MUTEON : 0);
+				AIC32X4_MUTEON, mute ? AIC32X4_MUTEON : 0);
 
 	return 0;
 }
@@ -853,27 +848,27 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
 
 		/* Switch on PLL */
 		snd_soc_component_update_bits(component, AIC32X4_PLLPR,
-				    AIC32X4_PLLEN, AIC32X4_PLLEN);
+					AIC32X4_PLLEN, AIC32X4_PLLEN);
 
 		/* Switch on NDAC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_NDAC,
-				    AIC32X4_NDACEN, AIC32X4_NDACEN);
+					AIC32X4_NDACEN, AIC32X4_NDACEN);
 
 		/* Switch on MDAC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_MDAC,
-				    AIC32X4_MDACEN, AIC32X4_MDACEN);
+					AIC32X4_MDACEN, AIC32X4_MDACEN);
 
 		/* Switch on NADC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_NADC,
-				    AIC32X4_NADCEN, AIC32X4_NADCEN);
+					AIC32X4_NADCEN, AIC32X4_NADCEN);
 
 		/* Switch on MADC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_MADC,
-				    AIC32X4_MADCEN, AIC32X4_MADCEN);
+					AIC32X4_MADCEN, AIC32X4_MADCEN);
 
 		/* Switch on BCLK_N Divider */
 		snd_soc_component_update_bits(component, AIC32X4_BCLKN,
-				    AIC32X4_BCLKEN, AIC32X4_BCLKEN);
+					AIC32X4_BCLKEN, AIC32X4_BCLKEN);
 		break;
 	case SND_SOC_BIAS_PREPARE:
 		break;
@@ -884,27 +879,27 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
 
 		/* Switch off BCLK_N Divider */
 		snd_soc_component_update_bits(component, AIC32X4_BCLKN,
-				    AIC32X4_BCLKEN, 0);
+					AIC32X4_BCLKEN, 0);
 
 		/* Switch off MADC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_MADC,
-				    AIC32X4_MADCEN, 0);
+					AIC32X4_MADCEN, 0);
 
 		/* Switch off NADC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_NADC,
-				    AIC32X4_NADCEN, 0);
+					AIC32X4_NADCEN, 0);
 
 		/* Switch off MDAC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_MDAC,
-				    AIC32X4_MDACEN, 0);
+					AIC32X4_MDACEN, 0);
 
 		/* Switch off NDAC Divider */
 		snd_soc_component_update_bits(component, AIC32X4_NDAC,
-				    AIC32X4_NDACEN, 0);
+					AIC32X4_NDACEN, 0);
 
 		/* Switch off PLL */
 		snd_soc_component_update_bits(component, AIC32X4_PLLPR,
-				    AIC32X4_PLLEN, 0);
+					AIC32X4_PLLEN, 0);
 
 		/* Switch off master clock */
 		clk_disable_unprepare(aic32x4->mclk);
@@ -916,7 +911,7 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
 }
 
 #define AIC32X4_RATES	SNDRV_PCM_RATE_8000_96000
-#define AIC32X4_FORMATS	(SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
+#define AIC32X4_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
 			 | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
 
 static const struct snd_soc_dai_ops aic32x4_ops = {
@@ -929,17 +924,17 @@ static const struct snd_soc_dai_ops aic32x4_ops = {
 static struct snd_soc_dai_driver aic32x4_dai = {
 	.name = "tlv320aic32x4-hifi",
 	.playback = {
-		     .stream_name = "Playback",
-		     .channels_min = 1,
-		     .channels_max = 2,
-		     .rates = AIC32X4_RATES,
-		     .formats = AIC32X4_FORMATS,},
+			 .stream_name = "Playback",
+			 .channels_min = 1,
+			 .channels_max = 2,
+			 .rates = AIC32X4_RATES,
+			 .formats = AIC32X4_FORMATS,},
 	.capture = {
-		    .stream_name = "Capture",
-		    .channels_min = 1,
-		    .channels_max = 2,
-		    .rates = AIC32X4_RATES,
-		    .formats = AIC32X4_FORMATS,},
+			.stream_name = "Capture",
+			.channels_min = 1,
+			.channels_max = 2,
+			.rates = AIC32X4_RATES,
+			.formats = AIC32X4_FORMATS,},
 	.ops = &aic32x4_ops,
 	.symmetric_rates = 1,
 };
@@ -952,7 +947,7 @@ static void aic32x4_setup_gpios(struct snd_soc_component *component)
 	/* MFP1 */
 	if (aic32x4->setup->gpio_func[0] != AIC32X4_MFPX_DEFAULT_VALUE) {
 		snd_soc_component_write(component, AIC32X4_DINCTL,
-		      aic32x4->setup->gpio_func[0]);
+			  aic32x4->setup->gpio_func[0]);
 		snd_soc_add_component_controls(component, aic32x4_mfp1,
 			ARRAY_SIZE(aic32x4_mfp1));
 	}
@@ -960,7 +955,7 @@ static void aic32x4_setup_gpios(struct snd_soc_component *component)
 	/* MFP2 */
 	if (aic32x4->setup->gpio_func[1] != AIC32X4_MFPX_DEFAULT_VALUE) {
 		snd_soc_component_write(component, AIC32X4_DOUTCTL,
-		      aic32x4->setup->gpio_func[1]);
+			  aic32x4->setup->gpio_func[1]);
 		snd_soc_add_component_controls(component, aic32x4_mfp2,
 			ARRAY_SIZE(aic32x4_mfp2));
 	}
@@ -968,7 +963,7 @@ static void aic32x4_setup_gpios(struct snd_soc_component *component)
 	/* MFP3 */
 	if (aic32x4->setup->gpio_func[2] != AIC32X4_MFPX_DEFAULT_VALUE) {
 		snd_soc_component_write(component, AIC32X4_SCLKCTL,
-		      aic32x4->setup->gpio_func[2]);
+			  aic32x4->setup->gpio_func[2]);
 		snd_soc_add_component_controls(component, aic32x4_mfp3,
 			ARRAY_SIZE(aic32x4_mfp3));
 	}
@@ -976,7 +971,7 @@ static void aic32x4_setup_gpios(struct snd_soc_component *component)
 	/* MFP4 */
 	if (aic32x4->setup->gpio_func[3] != AIC32X4_MFPX_DEFAULT_VALUE) {
 		snd_soc_component_write(component, AIC32X4_MISOCTL,
-		      aic32x4->setup->gpio_func[3]);
+			  aic32x4->setup->gpio_func[3]);
 		snd_soc_add_component_controls(component, aic32x4_mfp4,
 			ARRAY_SIZE(aic32x4_mfp4));
 	}
@@ -984,7 +979,7 @@ static void aic32x4_setup_gpios(struct snd_soc_component *component)
 	/* MFP5 */
 	if (aic32x4->setup->gpio_func[4] != AIC32X4_MFPX_DEFAULT_VALUE) {
 		snd_soc_component_write(component, AIC32X4_GPIOCTL,
-		      aic32x4->setup->gpio_func[4]);
+			  aic32x4->setup->gpio_func[4]);
 		snd_soc_add_component_controls(component, aic32x4_mfp5,
 			ARRAY_SIZE(aic32x4_mfp5));
 	}
@@ -1007,8 +1002,8 @@ static int aic32x4_component_probe(struct snd_soc_component *component)
 
 	/* Power platform configuration */
 	if (aic32x4->power_cfg & AIC32X4_PWR_MICBIAS_2075_LDOIN) {
-		snd_soc_component_write(component, AIC32X4_MICBIAS, AIC32X4_MICBIAS_LDOIN |
-						      AIC32X4_MICBIAS_2075V);
+		snd_soc_component_write(component, AIC32X4_MICBIAS,
+				AIC32X4_MICBIAS_LDOIN | AIC32X4_MICBIAS_2075V);
 	}
 	if (aic32x4->power_cfg & AIC32X4_PWR_AVDD_DVDD_WEAK_DISABLE)
 		snd_soc_component_write(component, AIC32X4_PWRCFG, AIC32X4_AVDDWEAKDISABLE);
@@ -1071,12 +1066,18 @@ static int aic32x4_parse_dt(struct aic32x4_priv *aic32x4,
 		struct device_node *np)
 {
 	struct aic32x4_setup_data *aic32x4_setup;
+	int ret;
 
 	aic32x4_setup = devm_kzalloc(aic32x4->dev, sizeof(*aic32x4_setup),
 							GFP_KERNEL);
 	if (!aic32x4_setup)
 		return -ENOMEM;
 
+	ret = of_property_match_string(np, "clock-names", "mclk");
+	if (ret < 0)
+		return -EINVAL;
+	aic32x4->mclk_name = of_clk_get_parent_name(np, ret);
+
 	aic32x4->swapdacs = false;
 	aic32x4->micpga_routing = 0;
 	aic32x4->rstn_gpio = of_get_named_gpio(np, "reset-gpios", 0);
@@ -1198,7 +1199,7 @@ int aic32x4_probe(struct device *dev, struct regmap *regmap)
 		return PTR_ERR(regmap);
 
 	aic32x4 = devm_kzalloc(dev, sizeof(struct aic32x4_priv),
-			       GFP_KERNEL);
+				   GFP_KERNEL);
 	if (aic32x4 == NULL)
 		return -ENOMEM;
 
@@ -1210,6 +1211,7 @@ int aic32x4_probe(struct device *dev, struct regmap *regmap)
 		aic32x4->swapdacs = pdata->swapdacs;
 		aic32x4->micpga_routing = pdata->micpga_routing;
 		aic32x4->rstn_gpio = pdata->rstn_gpio;
+		aic32x4->mclk_name = "mclk";
 	} else if (np) {
 		ret = aic32x4_parse_dt(aic32x4, np);
 		if (ret) {
@@ -1221,6 +1223,7 @@ int aic32x4_probe(struct device *dev, struct regmap *regmap)
 		aic32x4->swapdacs = false;
 		aic32x4->micpga_routing = 0;
 		aic32x4->rstn_gpio = -1;
+		aic32x4->mclk_name = "mclk";
 	}
 
 	aic32x4->mclk = devm_clk_get(dev, "mclk");
@@ -1229,6 +1232,10 @@ int aic32x4_probe(struct device *dev, struct regmap *regmap)
 		return PTR_ERR(aic32x4->mclk);
 	}
 
+	ret = aic32x4_register_clocks(dev, aic32x4->mclk_name);
+	if (ret)
+		return ret;
+
 	if (gpio_is_valid(aic32x4->rstn_gpio)) {
 		ret = devm_gpio_request_one(dev, aic32x4->rstn_gpio,
 				GPIOF_OUT_INIT_LOW, "tlv320aic32x4 rstn");
diff --git a/sound/soc/codecs/tlv320aic32x4.h b/sound/soc/codecs/tlv320aic32x4.h
index c2d74025bf4b9..e2b65bbba7c2d 100644
--- a/sound/soc/codecs/tlv320aic32x4.h
+++ b/sound/soc/codecs/tlv320aic32x4.h
@@ -16,6 +16,7 @@ struct regmap_config;
 extern const struct regmap_config aic32x4_regmap_config;
 int aic32x4_probe(struct device *dev, struct regmap *regmap);
 int aic32x4_remove(struct device *dev);
+int aic32x4_register_clocks(struct device *dev, const char *mclk_name);
 
 /* tlv320aic32x4 register space (in decimal to match datasheet) */
 
@@ -205,4 +206,8 @@ int aic32x4_remove(struct device *dev);
 #define AIC32X4_RMICPGANIN_IN1L_10K	0x10
 #define AIC32X4_RMICPGANIN_CM1R_10K	0x40
 
+/* Clock Limits */
+#define AIC32X4_MAX_PLL_CLKIN		20000000
+
+
 #endif				/* _TLV320AIC32X4_H */
-- 
GitLab


From 2f193d74f775576ce0b3f178df2dc57d734d9dfe Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:46 -0700
Subject: [PATCH 0406/1835] ASoC: tlv320aic32x4: Model CODEC_CLKIN in CCF

commit fd2df3aeafa4b4cc468d58e147e0822967034b71 upstream.

Model and manage codec clock input as a component in the Core
Clock Framework.  This should allow us to do some more complex
clock management and power control.  Also, some of the
on-board chip clocks can be exposed to the outside, and this
change will make those clocks easier to consume by other
parts of the kernel.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4-clk.c | 34 ++++++++++++++++++++++++++++
 sound/soc/codecs/tlv320aic32x4.c     | 18 +++++++++++----
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4-clk.c b/sound/soc/codecs/tlv320aic32x4-clk.c
index 5e495fc8d9316..cded85009c8c8 100644
--- a/sound/soc/codecs/tlv320aic32x4-clk.c
+++ b/sound/soc/codecs/tlv320aic32x4-clk.c
@@ -265,6 +265,30 @@ static const struct clk_ops aic32x4_pll_ops = {
 	.get_parent = clk_aic32x4_pll_get_parent,
 };
 
+static int clk_aic32x4_codec_clkin_set_parent(struct clk_hw *hw, u8 index)
+{
+	struct clk_aic32x4 *mux = to_clk_aic32x4(hw);
+
+	return regmap_update_bits(mux->regmap,
+		AIC32X4_CLKMUX,
+		AIC32X4_CODEC_CLKIN_MASK, index << AIC32X4_CODEC_CLKIN_SHIFT);
+}
+
+static u8 clk_aic32x4_codec_clkin_get_parent(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *mux = to_clk_aic32x4(hw);
+	unsigned int val;
+
+	regmap_read(mux->regmap, AIC32X4_CLKMUX, &val);
+
+	return (val & AIC32X4_CODEC_CLKIN_MASK) >> AIC32X4_CODEC_CLKIN_SHIFT;
+}
+
+static const struct clk_ops aic32x4_codec_clkin_ops = {
+	.set_parent = clk_aic32x4_codec_clkin_set_parent,
+	.get_parent = clk_aic32x4_codec_clkin_get_parent,
+};
+
 static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
 	{
 		.name = "pll",
@@ -274,6 +298,14 @@ static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
 		.ops = &aic32x4_pll_ops,
 		.reg = 0,
 	},
+	{
+		.name = "codec_clkin",
+		.parent_names =
+			(const char *[]) { "mclk", "bclk", "gpio", "pll" },
+		.num_parents = 4,
+		.ops = &aic32x4_codec_clkin_ops,
+		.reg = 0,
+	},
 };
 
 static struct clk *aic32x4_register_clk(struct device *dev,
@@ -314,6 +346,8 @@ int aic32x4_register_clocks(struct device *dev, const char *mclk_name)
 	 */
 	aic32x4_clkdesc_array[0].parent_names =
 			(const char* []) { mclk_name, "bclk", "gpio", "din" };
+	aic32x4_clkdesc_array[1].parent_names =
+			(const char *[]) { mclk_name, "bclk", "gpio", "pll" };
 
 	for (i = 0; i < ARRAY_SIZE(aic32x4_clkdesc_array); ++i)
 		aic32x4_register_clk(dev, &aic32x4_clkdesc_array[i]);
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 19472ef37e89c..62d6ee4f50826 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -737,12 +737,9 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 
 	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
 
-	/* PLL as CODEC_CLKIN */
-	snd_soc_component_update_bits(component, AIC32X4_CLKMUX,
-			AIC32X4_CODEC_CLKIN_MASK,
-			AIC32X4_CODEC_CLKIN_PLL << AIC32X4_CODEC_CLKIN_SHIFT);
 	/* DAC_MOD_CLK as BDIV_CLKIN */
-	snd_soc_component_update_bits(component, AIC32X4_IFACE3, AIC32X4_BDIVCLK_MASK,
+	snd_soc_component_update_bits(component, AIC32X4_IFACE3,
+				AIC32X4_BDIVCLK_MASK,
 				AIC32X4_DACMOD2BCLK << AIC32X4_BDIVCLK_SHIFT);
 
 	/* NDAC divider value */
@@ -989,6 +986,15 @@ static int aic32x4_component_probe(struct snd_soc_component *component)
 {
 	struct aic32x4_priv *aic32x4 = snd_soc_component_get_drvdata(component);
 	u32 tmp_reg;
+	int ret;
+
+	struct clk_bulk_data clocks[] = {
+	    { .id = "codec_clkin" },
+	};
+
+	ret = devm_clk_bulk_get(component->dev, ARRAY_SIZE(clocks), clocks);
+	if (ret)
+		return ret;
 
 	if (gpio_is_valid(aic32x4->rstn_gpio)) {
 		ndelay(10);
@@ -1000,6 +1006,8 @@ static int aic32x4_component_probe(struct snd_soc_component *component)
 	if (aic32x4->setup)
 		aic32x4_setup_gpios(component);
 
+	clk_set_parent(clocks[0].clk, clocks[1].clk);
+
 	/* Power platform configuration */
 	if (aic32x4->power_cfg & AIC32X4_PWR_MICBIAS_2075_LDOIN) {
 		snd_soc_component_write(component, AIC32X4_MICBIAS,
-- 
GitLab


From cb6bce75419a6ed895b0f76a1a90f550c37271b5 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:47 -0700
Subject: [PATCH 0407/1835] ASoC: tlv320aic32x4: Model DAC/ADC dividers in CCF

commit a51b50062091619915c5155085bbe13a7aca6903 upstream.

Model and manage DAC/ADC dividers as components in the Core
Clock Framework.  This should allow us to do some more complex
clock management and power control.  Also, some of the
on-board chip clocks can be exposed to the outside, and this
change will make those clocks easier to consume by other
parts of the kernel.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4-clk.c |  90 ++++++++++++++++++++++++
 sound/soc/codecs/tlv320aic32x4.c     | 101 +++++++++++++++------------
 sound/soc/codecs/tlv320aic32x4.h     |   4 ++
 3 files changed, 151 insertions(+), 44 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4-clk.c b/sound/soc/codecs/tlv320aic32x4-clk.c
index cded85009c8c8..daf14924e3243 100644
--- a/sound/soc/codecs/tlv320aic32x4-clk.c
+++ b/sound/soc/codecs/tlv320aic32x4-clk.c
@@ -289,6 +289,68 @@ static const struct clk_ops aic32x4_codec_clkin_ops = {
 	.get_parent = clk_aic32x4_codec_clkin_get_parent,
 };
 
+static int clk_aic32x4_div_prepare(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *div = to_clk_aic32x4(hw);
+
+	return regmap_update_bits(div->regmap, div->reg,
+				AIC32X4_DIVEN, AIC32X4_DIVEN);
+}
+
+static void clk_aic32x4_div_unprepare(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *div = to_clk_aic32x4(hw);
+
+	regmap_update_bits(div->regmap, div->reg,
+			AIC32X4_DIVEN, 0);
+}
+
+static int clk_aic32x4_div_set_rate(struct clk_hw *hw, unsigned long rate,
+				unsigned long parent_rate)
+{
+	struct clk_aic32x4 *div = to_clk_aic32x4(hw);
+	u8 divisor;
+
+	divisor = DIV_ROUND_UP(parent_rate, rate);
+	if (divisor > 128)
+		return -EINVAL;
+
+	return regmap_update_bits(div->regmap, div->reg,
+				AIC32X4_DIV_MASK, divisor);
+}
+
+static long clk_aic32x4_div_round_rate(struct clk_hw *hw, unsigned long rate,
+				unsigned long *parent_rate)
+{
+	unsigned long divisor;
+
+	divisor = DIV_ROUND_UP(*parent_rate, rate);
+	if (divisor > 128)
+		return -EINVAL;
+
+	return DIV_ROUND_UP(*parent_rate, divisor);
+}
+
+static unsigned long clk_aic32x4_div_recalc_rate(struct clk_hw *hw,
+						unsigned long parent_rate)
+{
+	struct clk_aic32x4 *div = to_clk_aic32x4(hw);
+
+	unsigned int val;
+
+	regmap_read(div->regmap, div->reg, &val);
+
+	return DIV_ROUND_UP(parent_rate, val & AIC32X4_DIV_MASK);
+}
+
+static const struct clk_ops aic32x4_div_ops = {
+	.prepare = clk_aic32x4_div_prepare,
+	.unprepare = clk_aic32x4_div_unprepare,
+	.set_rate = clk_aic32x4_div_set_rate,
+	.round_rate = clk_aic32x4_div_round_rate,
+	.recalc_rate = clk_aic32x4_div_recalc_rate,
+};
+
 static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
 	{
 		.name = "pll",
@@ -306,6 +368,34 @@ static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
 		.ops = &aic32x4_codec_clkin_ops,
 		.reg = 0,
 	},
+	{
+		.name = "ndac",
+		.parent_names = (const char * []) { "codec_clkin" },
+		.num_parents = 1,
+		.ops = &aic32x4_div_ops,
+		.reg = AIC32X4_NDAC,
+	},
+	{
+		.name = "mdac",
+		.parent_names = (const char * []) { "ndac" },
+		.num_parents = 1,
+		.ops = &aic32x4_div_ops,
+		.reg = AIC32X4_MDAC,
+	},
+	{
+		.name = "nadc",
+		.parent_names = (const char * []) { "codec_clkin" },
+		.num_parents = 1,
+		.ops = &aic32x4_div_ops,
+		.reg = AIC32X4_NADC,
+	},
+	{
+		.name = "madc",
+		.parent_names = (const char * []) { "nadc" },
+		.num_parents = 1,
+		.ops = &aic32x4_div_ops,
+		.reg = AIC32X4_MADC,
+	},
 };
 
 static struct clk *aic32x4_register_clk(struct device *dev,
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 62d6ee4f50826..df4b62564ff95 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -52,11 +52,11 @@ struct aic32x4_rate_divs {
 	u32 rate;
 	unsigned long pll_rate;
 	u16 dosr;
-	u8 ndac;
-	u8 mdac;
+	unsigned long ndac_rate;
+	unsigned long mdac_rate;
 	u8 aosr;
-	u8 nadc;
-	u8 madc;
+	unsigned long nadc_rate;
+	unsigned long madc_rate;
 	u8 blck_N;
 	u8 r_block;
 	u8 p_block;
@@ -309,34 +309,54 @@ static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 
 static const struct aic32x4_rate_divs aic32x4_divs[] = {
 	/* 8k rate */
-	{ 12000000, 8000, 57120000, 768, 5, 3, 128, 5, 18, 24, 1, 1 },
-	{ 24000000, 8000, 57120000, 768, 15, 1, 64, 45, 4, 24, 1, 1 },
-	{ 25000000, 8000, 32620000, 768, 15, 1, 64, 45, 4, 24, 1, 1 },
+	{ 12000000, 8000, 57120000, 768, 18432000, 6144000, 128, 18432000,
+		1024000, 24, 1, 1 },
+	{ 24000000, 8000, 57120000, 768, 6144000, 6144000, 64, 2048000,
+		512000, 24, 1, 1 },
+	{ 25000000, 8000, 32620000, 768, 6144000, 6144000, 64, 2048000,
+		512000, 24, 1, 1 },
 	/* 11.025k rate */
-	{ 12000000, 11025, 44217600, 512, 8, 2, 128, 8, 8, 16, 1, 1 },
-	{ 24000000, 11025, 44217600, 512, 16, 1, 64, 32, 4, 16, 1, 1 },
+	{ 12000000, 11025, 44217600, 512, 11289600, 5644800, 128, 11289600,
+		1411200, 16, 1, 1 },
+	{ 24000000, 11025, 44217600, 512, 5644800, 5644800, 64, 2822400,
+		705600, 16, 1, 1 },
 	/* 16k rate */
-	{ 12000000, 16000, 57120000, 384, 5, 3, 128, 5, 9, 12, 1, 1 },
-	{ 24000000, 16000, 57120000, 384, 15, 1, 64, 18, 5, 12, 1, 1 },
-	{ 25000000, 16000, 32620000, 384, 15, 1, 64, 18, 5, 12, 1, 1 },
+	{ 12000000, 16000, 57120000, 384, 18432000, 6144000, 128, 18432000,
+		2048000, 12, 1, 1 },
+	{ 24000000, 16000, 57120000, 384, 6144000, 6144000, 64, 5120000,
+		1024000, 12, 1, 1 },
+	{ 25000000, 16000, 32620000, 384, 6144000, 6144000, 64, 5120000,
+		1024000, 12, 1, 1 },
 	/* 22.05k rate */
-	{ 12000000, 22050, 44217600, 256, 4, 4, 128, 4, 8, 8, 1, 1 },
-	{ 24000000, 22050, 44217600, 256, 16, 1, 64, 16, 4, 8, 1, 1 },
-	{ 25000000, 22050, 19713750, 256, 16, 1, 64, 16, 4, 8, 1, 1 },
+	{ 12000000, 22050, 44217600, 256, 22579200, 5644800, 128, 22579200,
+		2822400, 8, 1, 1 },
+	{ 24000000, 22050, 44217600, 256, 5644800, 5644800, 64, 5644800,
+		1411200, 8, 1, 1 },
+	{ 25000000, 22050, 19713750, 256, 5644800, 5644800, 64, 5644800,
+		1411200, 8, 1, 1 },
 	/* 32k rate */
-	{ 12000000, 32000, 14112000, 192, 2, 7, 64, 2, 21, 6, 1, 1 },
-	{ 24000000, 32000, 14112000, 192, 7, 2, 64, 7, 6, 6, 1, 1 },
+	{ 12000000, 32000, 14112000, 192, 43008000, 6144000, 64, 43008000,
+		2048000, 6, 1, 1 },
+	{ 24000000, 32000, 14112000, 192, 12288000, 6144000, 64, 12288000,
+		2048000, 6, 1, 1 },
 	/* 44.1k rate */
-	{ 12000000, 44100, 44217600, 128, 2, 8, 128, 2, 8, 4, 1, 1 },
-	{ 24000000, 44100, 44217600, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
-	{ 25000000, 44100, 19713750, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
+	{ 12000000, 44100, 44217600, 128, 45158400, 5644800, 128, 45158400,
+		5644800, 4, 1, 1 },
+	{ 24000000, 44100, 44217600, 128, 11289600, 5644800, 64, 11289600,
+		2822400, 4, 1, 1 },
+	{ 25000000, 44100, 19713750, 128, 11289600, 5644800, 64, 11289600,
+		2822400, 4, 1, 1 },
 	/* 48k rate */
-	{ 12000000, 48000, 18432000, 128, 2, 8, 128, 2, 8, 4, 1, 1 },
-	{ 24000000, 48000, 18432000, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
-	{ 25000000, 48000, 75626250, 128, 8, 2, 64, 8, 4, 4, 1, 1 },
+	{ 12000000, 48000, 18432000, 128, 49152000, 6144000, 128, 49152000,
+		6144000, 4, 1, 1 },
+	{ 24000000, 48000, 18432000, 128, 12288000, 6144000, 64, 12288000,
+		3072000, 4, 1, 1 },
+	{ 25000000, 48000, 75626250, 128, 12288000, 6144000, 64, 12288000,
+		3072000, 4, 1, 1 },
 
 	/* 96k rate */
-	{ 25000000, 96000, 75626250, 64, 4, 4, 64, 4, 4, 1, 1, 9 },
+	{ 25000000, 96000, 75626250, 64, 24576000, 6144000, 64, 24576000,
+		6144000, 1, 1, 9 },
 };
 
 static const struct snd_kcontrol_new hpl_output_mixer_controls[] = {
@@ -721,6 +741,10 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 
 	struct clk_bulk_data clocks[] = {
 		{ .id = "pll" },
+		{ .id = "nadc" },
+		{ .id = "madc" },
+		{ .id = "ndac" },
+		{ .id = "mdac" },
 	};
 
 	i = aic32x4_get_divs(parent_rate, sample_rate);
@@ -733,7 +757,11 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 	if (ret)
 		return ret;
 
-	clk_set_rate(clocks[0].clk, sample_rate);
+	clk_set_rate(clocks[0].clk, aic32x4_divs[i].pll_rate);
+	clk_set_rate(clocks[1].clk, aic32x4_divs[i].nadc_rate);
+	clk_set_rate(clocks[2].clk, aic32x4_divs[i].madc_rate);
+	clk_set_rate(clocks[3].clk, aic32x4_divs[i].ndac_rate);
+	clk_set_rate(clocks[4].clk, aic32x4_divs[i].mdac_rate);
 
 	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
 
@@ -742,26 +770,10 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 				AIC32X4_BDIVCLK_MASK,
 				AIC32X4_DACMOD2BCLK << AIC32X4_BDIVCLK_SHIFT);
 
-	/* NDAC divider value */
-	snd_soc_component_update_bits(component, AIC32X4_NDAC,
-				AIC32X4_NDAC_MASK, aic32x4_divs[i].ndac);
-
-	/* MDAC divider value */
-	snd_soc_component_update_bits(component, AIC32X4_MDAC,
-				AIC32X4_MDAC_MASK, aic32x4_divs[i].mdac);
-
 	/* DOSR MSB & LSB values */
 	snd_soc_component_write(component, AIC32X4_DOSRMSB, aic32x4_divs[i].dosr >> 8);
 	snd_soc_component_write(component, AIC32X4_DOSRLSB, (aic32x4_divs[i].dosr & 0xff));
 
-	/* NADC divider value */
-	snd_soc_component_update_bits(component, AIC32X4_NADC,
-				AIC32X4_NADC_MASK, aic32x4_divs[i].nadc);
-
-	/* MADC divider value */
-	snd_soc_component_update_bits(component, AIC32X4_MADC,
-				AIC32X4_MADC_MASK, aic32x4_divs[i].madc);
-
 	/* AOSR value */
 	snd_soc_component_write(component, AIC32X4_AOSR, aic32x4_divs[i].aosr);
 
@@ -773,8 +785,8 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 }
 
 static int aic32x4_hw_params(struct snd_pcm_substream *substream,
-			     struct snd_pcm_hw_params *params,
-			     struct snd_soc_dai *dai)
+				 struct snd_pcm_hw_params *params,
+				 struct snd_soc_dai *dai)
 {
 	struct snd_soc_component *component = dai->component;
 	struct aic32x4_priv *aic32x4 = snd_soc_component_get_drvdata(component);
@@ -989,7 +1001,8 @@ static int aic32x4_component_probe(struct snd_soc_component *component)
 	int ret;
 
 	struct clk_bulk_data clocks[] = {
-	    { .id = "codec_clkin" },
+		{ .id = "codec_clkin" },
+		{ .id = "pll" },
 	};
 
 	ret = devm_clk_bulk_get(component->dev, ARRAY_SIZE(clocks), clocks);
diff --git a/sound/soc/codecs/tlv320aic32x4.h b/sound/soc/codecs/tlv320aic32x4.h
index e2b65bbba7c2d..6ede877b00a00 100644
--- a/sound/soc/codecs/tlv320aic32x4.h
+++ b/sound/soc/codecs/tlv320aic32x4.h
@@ -206,6 +206,10 @@ int aic32x4_register_clocks(struct device *dev, const char *mclk_name);
 #define AIC32X4_RMICPGANIN_IN1L_10K	0x10
 #define AIC32X4_RMICPGANIN_CM1R_10K	0x40
 
+/* Common mask and enable for all of the dividers */
+#define AIC32X4_DIVEN           BIT(7)
+#define AIC32X4_DIV_MASK        GENMASK(6, 0)
+
 /* Clock Limits */
 #define AIC32X4_MAX_PLL_CLKIN		20000000
 
-- 
GitLab


From 3a4625a4ed81215162486be3890b09105da0388a Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:48 -0700
Subject: [PATCH 0408/1835] ASoC: tlv320aic32x4: Model BDIV divider in CCF

commit 9b484124ebd906c4d6bc826cc0d417e80cc1105c upstream.

Model and manage BDIV divider as components in the Core
Clock Framework.  This should allow us to do some more complex
clock management and power control.  Also, some of the
on-board chip clocks can be exposed to the outside, and this
change will make those clocks easier to consume by other
parts of the kernel.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4-clk.c | 36 ++++++++++++++++++
 sound/soc/codecs/tlv320aic32x4.c     | 56 +++++++++++++---------------
 2 files changed, 62 insertions(+), 30 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4-clk.c b/sound/soc/codecs/tlv320aic32x4-clk.c
index daf14924e3243..667ec2c03508b 100644
--- a/sound/soc/codecs/tlv320aic32x4-clk.c
+++ b/sound/soc/codecs/tlv320aic32x4-clk.c
@@ -351,6 +351,34 @@ static const struct clk_ops aic32x4_div_ops = {
 	.recalc_rate = clk_aic32x4_div_recalc_rate,
 };
 
+static int clk_aic32x4_bdiv_set_parent(struct clk_hw *hw, u8 index)
+{
+	struct clk_aic32x4 *mux = to_clk_aic32x4(hw);
+
+	return regmap_update_bits(mux->regmap, AIC32X4_IFACE3,
+				AIC32X4_BDIVCLK_MASK, index);
+}
+
+static u8 clk_aic32x4_bdiv_get_parent(struct clk_hw *hw)
+{
+	struct clk_aic32x4 *mux = to_clk_aic32x4(hw);
+	unsigned int val;
+
+	regmap_read(mux->regmap, AIC32X4_IFACE3, &val);
+
+	return val & AIC32X4_BDIVCLK_MASK;
+}
+
+static const struct clk_ops aic32x4_bdiv_ops = {
+	.prepare = clk_aic32x4_div_prepare,
+	.unprepare = clk_aic32x4_div_unprepare,
+	.set_parent = clk_aic32x4_bdiv_set_parent,
+	.get_parent = clk_aic32x4_bdiv_get_parent,
+	.set_rate = clk_aic32x4_div_set_rate,
+	.round_rate = clk_aic32x4_div_round_rate,
+	.recalc_rate = clk_aic32x4_div_recalc_rate,
+};
+
 static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
 	{
 		.name = "pll",
@@ -396,6 +424,14 @@ static struct aic32x4_clkdesc aic32x4_clkdesc_array[] = {
 		.ops = &aic32x4_div_ops,
 		.reg = AIC32X4_MADC,
 	},
+	{
+		.name = "bdiv",
+		.parent_names =
+			(const char *[]) { "ndac", "mdac", "nadc", "madc" },
+		.num_parents = 4,
+		.ops = &aic32x4_bdiv_ops,
+		.reg = AIC32X4_BCLKN,
+	},
 };
 
 static struct clk *aic32x4_register_clk(struct device *dev,
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index df4b62564ff95..f173de6169d0f 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -57,7 +57,7 @@ struct aic32x4_rate_divs {
 	u8 aosr;
 	unsigned long nadc_rate;
 	unsigned long madc_rate;
-	u8 blck_N;
+	unsigned long bdiv_rate;
 	u8 r_block;
 	u8 p_block;
 };
@@ -310,53 +310,53 @@ static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 static const struct aic32x4_rate_divs aic32x4_divs[] = {
 	/* 8k rate */
 	{ 12000000, 8000, 57120000, 768, 18432000, 6144000, 128, 18432000,
-		1024000, 24, 1, 1 },
+		1024000, 256000, 1, 1 },
 	{ 24000000, 8000, 57120000, 768, 6144000, 6144000, 64, 2048000,
-		512000, 24, 1, 1 },
+		512000, 256000, 1, 1 },
 	{ 25000000, 8000, 32620000, 768, 6144000, 6144000, 64, 2048000,
-		512000, 24, 1, 1 },
+		512000, 256000, 1, 1 },
 	/* 11.025k rate */
 	{ 12000000, 11025, 44217600, 512, 11289600, 5644800, 128, 11289600,
-		1411200, 16, 1, 1 },
+		1411200, 352800, 1, 1 },
 	{ 24000000, 11025, 44217600, 512, 5644800, 5644800, 64, 2822400,
-		705600, 16, 1, 1 },
+		705600, 352800, 1, 1 },
 	/* 16k rate */
 	{ 12000000, 16000, 57120000, 384, 18432000, 6144000, 128, 18432000,
-		2048000, 12, 1, 1 },
+		2048000, 512000, 1, 1 },
 	{ 24000000, 16000, 57120000, 384, 6144000, 6144000, 64, 5120000,
-		1024000, 12, 1, 1 },
+		1024000, 512000, 1, 1 },
 	{ 25000000, 16000, 32620000, 384, 6144000, 6144000, 64, 5120000,
-		1024000, 12, 1, 1 },
+		1024000, 512000, 1, 1 },
 	/* 22.05k rate */
 	{ 12000000, 22050, 44217600, 256, 22579200, 5644800, 128, 22579200,
-		2822400, 8, 1, 1 },
+		2822400, 705600, 1, 1 },
 	{ 24000000, 22050, 44217600, 256, 5644800, 5644800, 64, 5644800,
-		1411200, 8, 1, 1 },
+		1411200, 705600, 1, 1 },
 	{ 25000000, 22050, 19713750, 256, 5644800, 5644800, 64, 5644800,
-		1411200, 8, 1, 1 },
+		1411200, 705600, 1, 1 },
 	/* 32k rate */
 	{ 12000000, 32000, 14112000, 192, 43008000, 6144000, 64, 43008000,
-		2048000, 6, 1, 1 },
+		2048000, 1024000, 1, 1 },
 	{ 24000000, 32000, 14112000, 192, 12288000, 6144000, 64, 12288000,
-		2048000, 6, 1, 1 },
+		2048000, 1024000, 1, 1 },
 	/* 44.1k rate */
 	{ 12000000, 44100, 44217600, 128, 45158400, 5644800, 128, 45158400,
-		5644800, 4, 1, 1 },
+		5644800, 1411200, 1, 1 },
 	{ 24000000, 44100, 44217600, 128, 11289600, 5644800, 64, 11289600,
-		2822400, 4, 1, 1 },
+		2822400, 1411200, 1, 1 },
 	{ 25000000, 44100, 19713750, 128, 11289600, 5644800, 64, 11289600,
-		2822400, 4, 1, 1 },
+		2822400, 1411200, 1, 1 },
 	/* 48k rate */
 	{ 12000000, 48000, 18432000, 128, 49152000, 6144000, 128, 49152000,
-		6144000, 4, 1, 1 },
+		6144000, 1536000, 1, 1 },
 	{ 24000000, 48000, 18432000, 128, 12288000, 6144000, 64, 12288000,
-		3072000, 4, 1, 1 },
+		3072000, 1536000, 1, 1 },
 	{ 25000000, 48000, 75626250, 128, 12288000, 6144000, 64, 12288000,
-		3072000, 4, 1, 1 },
+		3072000, 1536000, 1, 1 },
 
 	/* 96k rate */
 	{ 25000000, 96000, 75626250, 64, 24576000, 6144000, 64, 24576000,
-		6144000, 1, 1, 9 },
+		6144000, 3072000, 1, 9 },
 };
 
 static const struct snd_kcontrol_new hpl_output_mixer_controls[] = {
@@ -745,6 +745,7 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 		{ .id = "madc" },
 		{ .id = "ndac" },
 		{ .id = "mdac" },
+		{ .id = "bdiv" },
 	};
 
 	i = aic32x4_get_divs(parent_rate, sample_rate);
@@ -762,14 +763,10 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 	clk_set_rate(clocks[2].clk, aic32x4_divs[i].madc_rate);
 	clk_set_rate(clocks[3].clk, aic32x4_divs[i].ndac_rate);
 	clk_set_rate(clocks[4].clk, aic32x4_divs[i].mdac_rate);
+	clk_set_rate(clocks[5].clk, aic32x4_divs[i].bdiv_rate);
 
 	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
 
-	/* DAC_MOD_CLK as BDIV_CLKIN */
-	snd_soc_component_update_bits(component, AIC32X4_IFACE3,
-				AIC32X4_BDIVCLK_MASK,
-				AIC32X4_DACMOD2BCLK << AIC32X4_BDIVCLK_SHIFT);
-
 	/* DOSR MSB & LSB values */
 	snd_soc_component_write(component, AIC32X4_DOSRMSB, aic32x4_divs[i].dosr >> 8);
 	snd_soc_component_write(component, AIC32X4_DOSRLSB, (aic32x4_divs[i].dosr & 0xff));
@@ -777,10 +774,6 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 	/* AOSR value */
 	snd_soc_component_write(component, AIC32X4_AOSR, aic32x4_divs[i].aosr);
 
-	/* BCLK N divider */
-	snd_soc_component_update_bits(component, AIC32X4_BCLKN,
-				AIC32X4_BCLK_MASK, aic32x4_divs[i].blck_N);
-
 	return 0;
 }
 
@@ -1003,6 +996,8 @@ static int aic32x4_component_probe(struct snd_soc_component *component)
 	struct clk_bulk_data clocks[] = {
 		{ .id = "codec_clkin" },
 		{ .id = "pll" },
+		{ .id = "bdiv" },
+		{ .id = "mdac" },
 	};
 
 	ret = devm_clk_bulk_get(component->dev, ARRAY_SIZE(clocks), clocks);
@@ -1020,6 +1015,7 @@ static int aic32x4_component_probe(struct snd_soc_component *component)
 		aic32x4_setup_gpios(component);
 
 	clk_set_parent(clocks[0].clk, clocks[1].clk);
+	clk_set_parent(clocks[2].clk, clocks[3].clk);
 
 	/* Power platform configuration */
 	if (aic32x4->power_cfg & AIC32X4_PWR_MICBIAS_2075_LDOIN) {
-- 
GitLab


From c30d6b86ea806dd44c62b6616ee12df46a359686 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:49 -0700
Subject: [PATCH 0409/1835] ASoC: tlv320aic32x4: Control clock gating with CCF

commit d25970b5fd51e9fcf0afbe190908ea4049454da4 upstream.

Control the clock gating to the various clock components to use
the CCF.  This allows us to prepare_enalbe only 3 clocks and the
relationships assigned to them will cause upstream clockss to
enable automatically.  Additionally we can do this in a single
call to the CCF.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 67 +++++++-------------------------
 1 file changed, 13 insertions(+), 54 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index f173de6169d0f..306328892c591 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -836,41 +836,25 @@ static int aic32x4_mute(struct snd_soc_dai *dai, int mute)
 static int aic32x4_set_bias_level(struct snd_soc_component *component,
 				  enum snd_soc_bias_level level)
 {
-	struct aic32x4_priv *aic32x4 = snd_soc_component_get_drvdata(component);
 	int ret;
 
+	struct clk_bulk_data clocks[] = {
+		{ .id = "madc" },
+		{ .id = "mdac" },
+		{ .id = "bdiv" },
+	};
+
+	ret = devm_clk_bulk_get(component->dev, ARRAY_SIZE(clocks), clocks);
+	if (ret)
+		return ret;
+
 	switch (level) {
 	case SND_SOC_BIAS_ON:
-		/* Switch on master clock */
-		ret = clk_prepare_enable(aic32x4->mclk);
+		ret = clk_bulk_prepare_enable(ARRAY_SIZE(clocks), clocks);
 		if (ret) {
-			dev_err(component->dev, "Failed to enable master clock\n");
+			dev_err(component->dev, "Failed to enable clocks\n");
 			return ret;
 		}
-
-		/* Switch on PLL */
-		snd_soc_component_update_bits(component, AIC32X4_PLLPR,
-					AIC32X4_PLLEN, AIC32X4_PLLEN);
-
-		/* Switch on NDAC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_NDAC,
-					AIC32X4_NDACEN, AIC32X4_NDACEN);
-
-		/* Switch on MDAC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_MDAC,
-					AIC32X4_MDACEN, AIC32X4_MDACEN);
-
-		/* Switch on NADC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_NADC,
-					AIC32X4_NADCEN, AIC32X4_NADCEN);
-
-		/* Switch on MADC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_MADC,
-					AIC32X4_MADCEN, AIC32X4_MADCEN);
-
-		/* Switch on BCLK_N Divider */
-		snd_soc_component_update_bits(component, AIC32X4_BCLKN,
-					AIC32X4_BCLKEN, AIC32X4_BCLKEN);
 		break;
 	case SND_SOC_BIAS_PREPARE:
 		break;
@@ -879,32 +863,7 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
 		if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF)
 			break;
 
-		/* Switch off BCLK_N Divider */
-		snd_soc_component_update_bits(component, AIC32X4_BCLKN,
-					AIC32X4_BCLKEN, 0);
-
-		/* Switch off MADC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_MADC,
-					AIC32X4_MADCEN, 0);
-
-		/* Switch off NADC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_NADC,
-					AIC32X4_NADCEN, 0);
-
-		/* Switch off MDAC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_MDAC,
-					AIC32X4_MDACEN, 0);
-
-		/* Switch off NDAC Divider */
-		snd_soc_component_update_bits(component, AIC32X4_NDAC,
-					AIC32X4_NDACEN, 0);
-
-		/* Switch off PLL */
-		snd_soc_component_update_bits(component, AIC32X4_PLLPR,
-					AIC32X4_PLLEN, 0);
-
-		/* Switch off master clock */
-		clk_disable_unprepare(aic32x4->mclk);
+		clk_bulk_disable_unprepare(ARRAY_SIZE(clocks), clocks);
 		break;
 	case SND_SOC_BIAS_OFF:
 		break;
-- 
GitLab


From 0b96acf14991c023a3727742a6648df16007a3a6 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:50 -0700
Subject: [PATCH 0410/1835] ASoC: tlv320aic32x4: Move aosr and dosr setting to
 separate functions

commit fbafbf6517274a797e6e6508c18dd8dba5920c89 upstream.

Move these to separate helper functions.  This looks cleaner and fits
better with the new clock setting in CCF.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 306328892c591..a6cbe6d58f87b 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -720,6 +720,20 @@ static int aic32x4_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
 	return 0;
 }
 
+static int aic32x4_set_aosr(struct snd_soc_component *component, u8 aosr)
+{
+	return snd_soc_component_write(component, AIC32X4_AOSR, aosr);
+}
+
+static int aic32x4_set_dosr(struct snd_soc_component *component, u16 dosr)
+{
+	snd_soc_component_write(component, AIC32X4_DOSRMSB, dosr >> 8);
+	snd_soc_component_write(component, AIC32X4_DOSRLSB,
+		      (dosr & 0xff));
+
+	return 0;
+}
+
 static int aic32x4_set_processing_blocks(struct snd_soc_component *component,
 						u8 r_block, u8 p_block)
 {
@@ -765,14 +779,10 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 	clk_set_rate(clocks[4].clk, aic32x4_divs[i].mdac_rate);
 	clk_set_rate(clocks[5].clk, aic32x4_divs[i].bdiv_rate);
 
-	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
+	aic32x4_set_aosr(component, aic32x4_divs[i].aosr);
+	aic32x4_set_dosr(component, aic32x4_divs[i].dosr);
 
-	/* DOSR MSB & LSB values */
-	snd_soc_component_write(component, AIC32X4_DOSRMSB, aic32x4_divs[i].dosr >> 8);
-	snd_soc_component_write(component, AIC32X4_DOSRLSB, (aic32x4_divs[i].dosr & 0xff));
-
-	/* AOSR value */
-	snd_soc_component_write(component, AIC32X4_AOSR, aic32x4_divs[i].aosr);
+	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
 
 	return 0;
 }
-- 
GitLab


From 78ed8865a4c6c615d19e856c1149cec1cc89d22d Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:51 -0700
Subject: [PATCH 0411/1835] ASoC: tlv320aic32x4: Dynamically Determine Clocking

commit 96c3bb00239de4fb5f4ddca42c1f90d6d9b3c697 upstream.

The existing code uses a static lookup table to determine the
settings of the various clock devices on board the chip.  This is
limiting in a couple of ways.  First, this doesn't allow for any
master clock rates other than the three that have been
precalculated.  Additionally, new sample rates are difficult to
add to the table.  Witness that the chip is capable of 192000 Hz
sampling, but it is not provided by this driver.  Last, if the
driver is clocked by something that isn't a crystal, the
upstream clock may not be able to achieve exactly the rate
requested in the driver.  This will mean that clocking will be
slightly off for the sampling clock or that it won't work at all.

This patch determines the settings for all of the clocks at
runtime considering the real conditions of the clocks in the
system.  The rules for the clocks are in TI's SLAA557 application
guide on pages 37, 51 and 77.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 190 ++++++++++++++-----------------
 sound/soc/codecs/tlv320aic32x4.h |   4 +-
 2 files changed, 90 insertions(+), 104 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index a6cbe6d58f87b..0bdff9d871bdb 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -47,21 +47,6 @@
 
 #include "tlv320aic32x4.h"
 
-struct aic32x4_rate_divs {
-	u32 mclk;
-	u32 rate;
-	unsigned long pll_rate;
-	u16 dosr;
-	unsigned long ndac_rate;
-	unsigned long mdac_rate;
-	u8 aosr;
-	unsigned long nadc_rate;
-	unsigned long madc_rate;
-	unsigned long bdiv_rate;
-	u8 r_block;
-	u8 p_block;
-};
-
 struct aic32x4_priv {
 	struct regmap *regmap;
 	u32 sysclk;
@@ -307,58 +292,6 @@ static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 			0, 0x0F, 0),
 };
 
-static const struct aic32x4_rate_divs aic32x4_divs[] = {
-	/* 8k rate */
-	{ 12000000, 8000, 57120000, 768, 18432000, 6144000, 128, 18432000,
-		1024000, 256000, 1, 1 },
-	{ 24000000, 8000, 57120000, 768, 6144000, 6144000, 64, 2048000,
-		512000, 256000, 1, 1 },
-	{ 25000000, 8000, 32620000, 768, 6144000, 6144000, 64, 2048000,
-		512000, 256000, 1, 1 },
-	/* 11.025k rate */
-	{ 12000000, 11025, 44217600, 512, 11289600, 5644800, 128, 11289600,
-		1411200, 352800, 1, 1 },
-	{ 24000000, 11025, 44217600, 512, 5644800, 5644800, 64, 2822400,
-		705600, 352800, 1, 1 },
-	/* 16k rate */
-	{ 12000000, 16000, 57120000, 384, 18432000, 6144000, 128, 18432000,
-		2048000, 512000, 1, 1 },
-	{ 24000000, 16000, 57120000, 384, 6144000, 6144000, 64, 5120000,
-		1024000, 512000, 1, 1 },
-	{ 25000000, 16000, 32620000, 384, 6144000, 6144000, 64, 5120000,
-		1024000, 512000, 1, 1 },
-	/* 22.05k rate */
-	{ 12000000, 22050, 44217600, 256, 22579200, 5644800, 128, 22579200,
-		2822400, 705600, 1, 1 },
-	{ 24000000, 22050, 44217600, 256, 5644800, 5644800, 64, 5644800,
-		1411200, 705600, 1, 1 },
-	{ 25000000, 22050, 19713750, 256, 5644800, 5644800, 64, 5644800,
-		1411200, 705600, 1, 1 },
-	/* 32k rate */
-	{ 12000000, 32000, 14112000, 192, 43008000, 6144000, 64, 43008000,
-		2048000, 1024000, 1, 1 },
-	{ 24000000, 32000, 14112000, 192, 12288000, 6144000, 64, 12288000,
-		2048000, 1024000, 1, 1 },
-	/* 44.1k rate */
-	{ 12000000, 44100, 44217600, 128, 45158400, 5644800, 128, 45158400,
-		5644800, 1411200, 1, 1 },
-	{ 24000000, 44100, 44217600, 128, 11289600, 5644800, 64, 11289600,
-		2822400, 1411200, 1, 1 },
-	{ 25000000, 44100, 19713750, 128, 11289600, 5644800, 64, 11289600,
-		2822400, 1411200, 1, 1 },
-	/* 48k rate */
-	{ 12000000, 48000, 18432000, 128, 49152000, 6144000, 128, 49152000,
-		6144000, 1536000, 1, 1 },
-	{ 24000000, 48000, 18432000, 128, 12288000, 6144000, 64, 12288000,
-		3072000, 1536000, 1, 1 },
-	{ 25000000, 48000, 75626250, 128, 12288000, 6144000, 64, 12288000,
-		3072000, 1536000, 1, 1 },
-
-	/* 96k rate */
-	{ 25000000, 96000, 75626250, 64, 24576000, 6144000, 64, 24576000,
-		6144000, 3072000, 1, 9 },
-};
-
 static const struct snd_kcontrol_new hpl_output_mixer_controls[] = {
 	SOC_DAPM_SINGLE("L_DAC Switch", AIC32X4_HPLROUTE, 3, 1, 0),
 	SOC_DAPM_SINGLE("IN1_L Switch", AIC32X4_HPLROUTE, 2, 1, 0),
@@ -632,20 +565,6 @@ const struct regmap_config aic32x4_regmap_config = {
 };
 EXPORT_SYMBOL(aic32x4_regmap_config);
 
-static inline int aic32x4_get_divs(int mclk, int rate)
-{
-	int i;
-
-	for (i = 0; i < ARRAY_SIZE(aic32x4_divs); i++) {
-		if ((aic32x4_divs[i].rate == rate)
-			&& (aic32x4_divs[i].mclk == mclk)) {
-			return i;
-		}
-	}
-	printk(KERN_ERR "aic32x4: master clock and sample rate is not supported\n");
-	return -EINVAL;
-}
-
 static int aic32x4_set_dai_sysclk(struct snd_soc_dai *codec_dai,
 				  int clk_id, unsigned int freq, int dir)
 {
@@ -747,11 +666,17 @@ static int aic32x4_set_processing_blocks(struct snd_soc_component *component,
 }
 
 static int aic32x4_setup_clocks(struct snd_soc_component *component,
-				unsigned int sample_rate,
-				unsigned int parent_rate)
+				unsigned int sample_rate)
 {
-	int i;
+	u8 aosr;
+	u16 dosr;
+	u8 adc_resource_class, dac_resource_class;
+	u8 madc, nadc, mdac, ndac, max_nadc, min_mdac, max_ndac;
+	u8 dosr_increment;
+	u16 max_dosr, min_dosr;
+	unsigned long mclk_rate, adc_clock_rate, dac_clock_rate;
 	int ret;
+	struct clk *mclk;
 
 	struct clk_bulk_data clocks[] = {
 		{ .id = "pll" },
@@ -761,30 +686,89 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component,
 		{ .id = "mdac" },
 		{ .id = "bdiv" },
 	};
-
-	i = aic32x4_get_divs(parent_rate, sample_rate);
-	if (i < 0) {
-		printk(KERN_ERR "aic32x4: sampling rate not supported\n");
-		return i;
-	}
-
 	ret = devm_clk_bulk_get(component->dev, ARRAY_SIZE(clocks), clocks);
 	if (ret)
 		return ret;
 
-	clk_set_rate(clocks[0].clk, aic32x4_divs[i].pll_rate);
-	clk_set_rate(clocks[1].clk, aic32x4_divs[i].nadc_rate);
-	clk_set_rate(clocks[2].clk, aic32x4_divs[i].madc_rate);
-	clk_set_rate(clocks[3].clk, aic32x4_divs[i].ndac_rate);
-	clk_set_rate(clocks[4].clk, aic32x4_divs[i].mdac_rate);
-	clk_set_rate(clocks[5].clk, aic32x4_divs[i].bdiv_rate);
-
-	aic32x4_set_aosr(component, aic32x4_divs[i].aosr);
-	aic32x4_set_dosr(component, aic32x4_divs[i].dosr);
+	mclk = clk_get_parent(clocks[1].clk);
+	mclk_rate = clk_get_rate(mclk);
+
+	if (sample_rate <= 48000) {
+		aosr = 128;
+		adc_resource_class = 6;
+		dac_resource_class = 8;
+		dosr_increment = 8;
+		aic32x4_set_processing_blocks(component, 1, 1);
+	} else if (sample_rate <= 96000) {
+		aosr = 64;
+		adc_resource_class = 6;
+		dac_resource_class = 8;
+		dosr_increment = 4;
+		aic32x4_set_processing_blocks(component, 1, 9);
+	} else if (sample_rate == 192000) {
+		aosr = 32;
+		adc_resource_class = 3;
+		dac_resource_class = 4;
+		dosr_increment = 2;
+		aic32x4_set_processing_blocks(component, 13, 19);
+	} else {
+		dev_err(component->dev, "Sampling rate not supported\n");
+		return -EINVAL;
+	}
 
-	aic32x4_set_processing_blocks(component, aic32x4_divs[i].r_block, aic32x4_divs[i].p_block);
+	madc = DIV_ROUND_UP((32 * adc_resource_class), aosr);
+	max_dosr = (AIC32X4_MAX_DOSR_FREQ / sample_rate / dosr_increment) *
+			dosr_increment;
+	min_dosr = (AIC32X4_MIN_DOSR_FREQ / sample_rate / dosr_increment) *
+			dosr_increment;
+	max_nadc = AIC32X4_MAX_CODEC_CLKIN_FREQ / (madc * aosr * sample_rate);
+
+	for (nadc = max_nadc; nadc > 0; --nadc) {
+		adc_clock_rate = nadc * madc * aosr * sample_rate;
+		for (dosr = max_dosr; dosr >= min_dosr;
+				dosr -= dosr_increment) {
+			min_mdac = DIV_ROUND_UP((32 * dac_resource_class), dosr);
+			max_ndac = AIC32X4_MAX_CODEC_CLKIN_FREQ /
+					(min_mdac * dosr * sample_rate);
+			for (mdac = min_mdac; mdac <= 128; ++mdac) {
+				for (ndac = max_ndac; ndac > 0; --ndac) {
+					dac_clock_rate = ndac * mdac * dosr *
+							sample_rate;
+					if (dac_clock_rate == adc_clock_rate) {
+						if (clk_round_rate(clocks[0].clk, dac_clock_rate) == 0)
+							continue;
+
+						clk_set_rate(clocks[0].clk,
+							dac_clock_rate);
+
+						clk_set_rate(clocks[1].clk,
+							sample_rate * aosr *
+							madc);
+						clk_set_rate(clocks[2].clk,
+							sample_rate * aosr);
+						aic32x4_set_aosr(component,
+							aosr);
+
+						clk_set_rate(clocks[3].clk,
+							sample_rate * dosr *
+							mdac);
+						clk_set_rate(clocks[4].clk,
+							sample_rate * dosr);
+						aic32x4_set_dosr(component,
+							dosr);
+
+						clk_set_rate(clocks[5].clk,
+							sample_rate * 32);
+						return 0;
+					}
+				}
+			}
+		}
+	}
 
-	return 0;
+	dev_err(component->dev,
+		"Could not set clocks to support sample rate.\n");
+	return -EINVAL;
 }
 
 static int aic32x4_hw_params(struct snd_pcm_substream *substream,
@@ -796,7 +780,7 @@ static int aic32x4_hw_params(struct snd_pcm_substream *substream,
 	u8 iface1_reg = 0;
 	u8 dacsetup_reg = 0;
 
-	aic32x4_setup_clocks(component, params_rate(params), aic32x4->sysclk);
+	aic32x4_setup_clocks(component, params_rate(params));
 
 	switch (params_width(params)) {
 	case 16:
diff --git a/sound/soc/codecs/tlv320aic32x4.h b/sound/soc/codecs/tlv320aic32x4.h
index 6ede877b00a00..88205bc971980 100644
--- a/sound/soc/codecs/tlv320aic32x4.h
+++ b/sound/soc/codecs/tlv320aic32x4.h
@@ -211,7 +211,9 @@ int aic32x4_register_clocks(struct device *dev, const char *mclk_name);
 #define AIC32X4_DIV_MASK        GENMASK(6, 0)
 
 /* Clock Limits */
+#define AIC32X4_MAX_DOSR_FREQ		6200000
+#define AIC32X4_MIN_DOSR_FREQ		2800000
+#define AIC32X4_MAX_CODEC_CLKIN_FREQ    110000000
 #define AIC32X4_MAX_PLL_CLKIN		20000000
 
-
 #endif				/* _TLV320AIC32X4_H */
-- 
GitLab


From 66584274f2435ffbe324f78829348814766023a9 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:52 -0700
Subject: [PATCH 0412/1835] ASoC: tlv320aic32x4: Restructure set_dai_sysclk

commit aa6a60f7be925210d5156f0e8025f3afe1f4f54d upstream.

The sysclk is now managed by the CCF.  Change this function
to merely find the system clock and set it using
clk_set_rate.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 0bdff9d871bdb..1f66b037d5306 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -49,7 +49,6 @@
 
 struct aic32x4_priv {
 	struct regmap *regmap;
-	u32 sysclk;
 	u32 power_cfg;
 	u32 micpga_routing;
 	bool swapdacs;
@@ -569,17 +568,13 @@ static int aic32x4_set_dai_sysclk(struct snd_soc_dai *codec_dai,
 				  int clk_id, unsigned int freq, int dir)
 {
 	struct snd_soc_component *component = codec_dai->component;
-	struct aic32x4_priv *aic32x4 = snd_soc_component_get_drvdata(component);
+	struct clk *mclk;
+	struct clk *pll;
 
-	switch (freq) {
-	case 12000000:
-	case 24000000:
-	case 25000000:
-		aic32x4->sysclk = freq;
-		return 0;
-	}
-	printk(KERN_ERR "aic32x4: invalid frequency to set DAI system clock\n");
-	return -EINVAL;
+	pll = devm_clk_get(component->dev, "pll");
+	mclk = clk_get_parent(pll);
+
+	return clk_set_rate(mclk, freq);
 }
 
 static int aic32x4_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
-- 
GitLab


From afe2958e0f54e15183685d858ae1439825a82150 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:53 -0700
Subject: [PATCH 0413/1835] ASoC: tlv320aic32x4: Remove mclk references

commit 78f2d58a289302e56a7def96a783a7686ebf27e2 upstream.

mclk is not used by anything anymore.  Remove support for it.
All that information now comes from the clock tree.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 1f66b037d5306..06988ef4f6720 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -53,7 +53,6 @@ struct aic32x4_priv {
 	u32 micpga_routing;
 	bool swapdacs;
 	int rstn_gpio;
-	struct clk *mclk;
 	const char *mclk_name;
 
 	struct regulator *supply_ldo;
@@ -1191,12 +1190,6 @@ int aic32x4_probe(struct device *dev, struct regmap *regmap)
 		aic32x4->mclk_name = "mclk";
 	}
 
-	aic32x4->mclk = devm_clk_get(dev, "mclk");
-	if (IS_ERR(aic32x4->mclk)) {
-		dev_err(dev, "Failed getting the mclk. The current implementation does not support the usage of this codec without mclk\n");
-		return PTR_ERR(aic32x4->mclk);
-	}
-
 	ret = aic32x4_register_clocks(dev, aic32x4->mclk_name);
 	if (ret)
 		return ret;
-- 
GitLab


From 9f628f5da8e8190697cab815afed22d058425674 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Thu, 21 Mar 2019 17:58:54 -0700
Subject: [PATCH 0414/1835] ASoC: tlv320aic32x4: Allow 192000 Sample Rate

commit 6d56ee1550b8a81bc63c80051ff78d8d704b09ba upstream.

The clocking and processing blocks are now properly set up to
support 192000 sample rates.  Allow drivers to ask for that.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 06988ef4f6720..707ca49517a1d 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -859,7 +859,7 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
 	return 0;
 }
 
-#define AIC32X4_RATES	SNDRV_PCM_RATE_8000_96000
+#define AIC32X4_RATES	SNDRV_PCM_RATE_8000_192000
 #define AIC32X4_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
 			 | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
 
-- 
GitLab


From 3d88199c2acde28f6b12d5e9a688a3c003c5e0e0 Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Tue, 26 Mar 2019 13:10:13 +0000
Subject: [PATCH 0415/1835] ASoC: tlv320aic32x4: Only enable with common clock

commit 64f01d2b5ccc621c3aa66b82daf9154f5581f36a upstream.

Some architectures do not yet support the common clock API at all but
the tlv320aic32x4 driver now requires it.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/Kconfig | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 9d283a12b1547..6fc3d190864da 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -170,8 +170,8 @@ config SND_SOC_ALL_CODECS
 	select SND_SOC_TAS5713 if I2C
 	select SND_SOC_TLV320AIC26 if SPI_MASTER
 	select SND_SOC_TLV320AIC31XX if I2C
-	select SND_SOC_TLV320AIC32X4_I2C if I2C
-	select SND_SOC_TLV320AIC32X4_SPI if SPI_MASTER
+	select SND_SOC_TLV320AIC32X4_I2C if I2C && COMMON_CLK
+	select SND_SOC_TLV320AIC32X4_SPI if SPI_MASTER && COMMON_CLK
 	select SND_SOC_TLV320AIC3X if I2C
 	select SND_SOC_TPA6130A2 if I2C
 	select SND_SOC_TLV320DAC33 if I2C
@@ -1030,11 +1030,13 @@ config SND_SOC_TLV320AIC32X4
 config SND_SOC_TLV320AIC32X4_I2C
 	tristate "Texas Instruments TLV320AIC32x4 audio CODECs - I2C"
 	depends on I2C
+	depends on COMMON_CLK
 	select SND_SOC_TLV320AIC32X4
 
 config SND_SOC_TLV320AIC32X4_SPI
 	tristate "Texas Instruments TLV320AIC32x4 audio CODECs - SPI"
 	depends on SPI_MASTER
+	depends on COMMON_CLK
 	select SND_SOC_TLV320AIC32X4
 
 config SND_SOC_TLV320AIC3X
-- 
GitLab


From ec7128a10673c88edb5487be5f35c9bf8cb90965 Mon Sep 17 00:00:00 2001
From: FERHAT Nicolas <contact@audiophonics.fr>
Date: Fri, 5 Apr 2019 13:06:42 +0100
Subject: [PATCH 0416/1835] Audiophonics I-Sabre 9038Q2M DAC driver

Signed-off-by: Audiophonics <contact@audiophonics.fr>
---
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |   6 +
 .../boot/dts/overlays/i-sabre-q2m-overlay.dts |  39 ++
 arch/arm/configs/bcm2709_defconfig            |   1 +
 arch/arm/configs/bcmrpi_defconfig             |   1 +
 arch/arm64/configs/bcmrpi3_defconfig          |   1 +
 sound/soc/bcm/Kconfig                         |   7 +
 sound/soc/bcm/Makefile                        |   2 +
 sound/soc/bcm/i-sabre-q2m.c                   | 157 +++++++
 sound/soc/codecs/Kconfig                      |   5 +
 sound/soc/codecs/Makefile                     |   2 +
 sound/soc/codecs/i-sabre-codec.c              | 392 ++++++++++++++++++
 sound/soc/codecs/i-sabre-codec.h              |  42 ++
 13 files changed, 656 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
 create mode 100644 sound/soc/bcm/i-sabre-q2m.c
 create mode 100644 sound/soc/codecs/i-sabre-codec.c
 create mode 100644 sound/soc/codecs/i-sabre-codec.h

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 3acbd74f7d371..f06a5e924b82b 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -55,6 +55,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	hy28a.dtbo \
 	hy28b.dtbo \
 	hy28b-2017.dtbo \
+	i-sabre-q2m.dtbo \
 	i2c-bcm2708.dtbo \
 	i2c-gpio.dtbo \
 	i2c-mux.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 8b6a53ba64c4f..0f9f9e52b37c7 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -869,6 +869,12 @@ Params: speed                   Display SPI bus speed
         ledgpio                 GPIO used to control backlight
 
 
+Name:   i-sabre-q2m
+Info:   Configures the Audiophonics I-SABRE Q2M DAC
+Load:   dtoverlay=i-sabre-q2m
+Params: <None>
+
+
 Name:   i2c-bcm2708
 Info:   Fall back to the i2c_bcm2708 driver for the i2c_arm bus.
 Load:   dtoverlay=i2c-bcm2708
diff --git a/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
new file mode 100644
index 0000000000000..17119f82b942d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for I-Sabre Q2M
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sound>;
+		frag0: __overlay__ {
+			compatible = "audiophonics,i-sabre-q2m";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			i-sabre-codec@48 {
+				#sound-dai-cells = <0>;
+				compatible = "audiophonics,i-sabre-codec";
+				reg = <0x48>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 0d3c9ea31423b..a3ac6106858c5 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -916,6 +916,7 @@ CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
 CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index fc364176e7c7a..e30ea316c52a0 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -909,6 +909,7 @@ CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
 CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 799e8a8cd282c..c1ca03862d224 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -804,6 +804,7 @@ CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
 CONFIG_SND_AUDIOSENSE_PI=m
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 966387574fe32..85ba814935068 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -123,6 +123,13 @@ config SND_BCM2708_SOC_IQAUDIO_DIGI
 	help
 	  Say Y or M if you want to add support for IQAudIO Digital IO board.
 
+config SND_BCM2708_SOC_I_SABRE_Q2M
+        tristate "Support for Audiophonics I-Sabre Q2M DAC"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_I_SABRE_CODEC
+        help
+        Say Y or M if you want to add support for Audiophonics I-SABRE Q2M DAC
+
 config SND_BCM2708_SOC_ADAU1977_ADC
 	tristate "Support for ADAU1977 ADC"
 	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index d8bf332e5cdbb..8f8fb92b6436e 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -19,6 +19,7 @@ snd-soc-justboom-dac-objs := justboom-dac.o
 snd-soc-rpi-cirrus-objs := rpi-cirrus.o
 snd-soc-rpi-proto-objs := rpi-proto.o
 snd-soc-iqaudio-dac-objs := iqaudio-dac.o
+ snd-soc-i-sabre-q2m-objs := i-sabre-q2m.o
 snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
 snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
 snd-soc-audiosense-pi-objs := audiosense-pi.o
@@ -42,6 +43,7 @@ obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
 obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
+ obj-$(CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M) += snd-soc-i-sabre-q2m.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
 obj-$(CONFIG_SND_AUDIOSENSE_PI) += snd-soc-audiosense-pi.o
diff --git a/sound/soc/bcm/i-sabre-q2m.c b/sound/soc/bcm/i-sabre-q2m.c
new file mode 100644
index 0000000000000..a95b0f1b484e8
--- /dev/null
+++ b/sound/soc/bcm/i-sabre-q2m.c
@@ -0,0 +1,157 @@
+/*
+ * ASoC Driver for I-Sabre Q2M
+ *
+ * Author: Satoru Kawase
+ * Modified by: Xiao Qingyong
+ * Update kernel v4.18+ by : Audiophonics
+ * 		Copyright 2018 Audiophonics
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/fs.h>
+#include <asm/uaccess.h>
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+
+#include "../codecs/i-sabre-codec.h"
+
+
+static int snd_rpi_i_sabre_q2m_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *component = rtd->codec_dai->component;
+	unsigned int value;
+
+	/* Device ID */
+	value = snd_soc_component_read32(component, ISABRECODEC_REG_01);
+	dev_info(component->card->dev, "Audiophonics Device ID : %02X\n", value);
+
+	/* API revision */
+	value = snd_soc_component_read32(component, ISABRECODEC_REG_02);
+	dev_info(component->card->dev, "Audiophonics API revision : %02X\n", value);
+
+	return 0;
+}
+
+static int snd_rpi_i_sabre_q2m_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd     = substream->private_data;
+	struct snd_soc_dai         *cpu_dai = rtd->cpu_dai;
+	int bclk_ratio;
+
+	bclk_ratio = snd_pcm_format_physical_width(
+			params_format(params)) * params_channels(params);
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, bclk_ratio);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_i_sabre_q2m_ops = {
+	.hw_params = snd_rpi_i_sabre_q2m_hw_params,
+};
+
+
+static struct snd_soc_dai_link snd_rpi_i_sabre_q2m_dai[] = {
+	{
+		.name           = "I-Sabre Q2M",
+		.stream_name    = "I-Sabre Q2M DAC",
+		.cpu_dai_name   = "bcm2708-i2s.0",
+		.codec_dai_name = "i-sabre-codec-dai",
+		.platform_name  = "bcm2708-i2s.0",
+		.codec_name     = "i-sabre-codec-i2c.1-0048",
+		.dai_fmt        = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+						| SND_SOC_DAIFMT_CBS_CFS,
+		.init           = snd_rpi_i_sabre_q2m_init,
+		.ops            = &snd_rpi_i_sabre_q2m_ops,
+	}
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_i_sabre_q2m = {
+	.name      = "I-Sabre Q2M DAC",
+	.owner     = THIS_MODULE,
+	.dai_link  = snd_rpi_i_sabre_q2m_dai,
+	.num_links = ARRAY_SIZE(snd_rpi_i_sabre_q2m_dai)
+};
+
+
+static int snd_rpi_i_sabre_q2m_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_i_sabre_q2m.dev = &pdev->dev;
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_rpi_i_sabre_q2m_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+							"i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name     = NULL;
+			dai->cpu_of_node      = i2s_node;
+			dai->platform_name    = NULL;
+			dai->platform_of_node = i2s_node;
+		} else {
+			dev_err(&pdev->dev,
+			    "Property 'i2s-controller' missing or invalid\n");
+			return (-EINVAL);
+		}
+
+		dai->name        = "I-Sabre Q2M";
+		dai->stream_name = "I-Sabre Q2M DAC";
+		dai->dai_fmt     = SND_SOC_DAIFMT_I2S
+					| SND_SOC_DAIFMT_NB_NF
+					| SND_SOC_DAIFMT_CBS_CFS;
+	}
+
+	/* Wait for registering codec driver */
+	mdelay(50);
+
+	ret = snd_soc_register_card(&snd_rpi_i_sabre_q2m);
+	if (ret) {
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+	}
+
+	return ret;
+}
+
+static int snd_rpi_i_sabre_q2m_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_i_sabre_q2m);
+}
+
+static const struct of_device_id snd_rpi_i_sabre_q2m_of_match[] = {
+	{ .compatible = "audiophonics,i-sabre-q2m", },
+	{}
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_i_sabre_q2m_of_match);
+
+static struct platform_driver snd_rpi_i_sabre_q2m_driver = {
+	.driver = {
+		.name           = "snd-rpi-i-sabre-q2m",
+		.owner          = THIS_MODULE,
+		.of_match_table = snd_rpi_i_sabre_q2m_of_match,
+	},
+	.probe  = snd_rpi_i_sabre_q2m_probe,
+	.remove = snd_rpi_i_sabre_q2m_remove,
+};
+module_platform_driver(snd_rpi_i_sabre_q2m_driver);
+
+MODULE_DESCRIPTION("ASoC Driver for I-Sabre Q2M");
+MODULE_AUTHOR("Audiophonics <http://www.audiophonics.fr>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 6fc3d190864da..56bb858eadcf4 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -85,6 +85,7 @@ config SND_SOC_ALL_CODECS
 	select SND_SOC_ICS43432
 	select SND_SOC_INNO_RK3036
 	select SND_SOC_ISABELLE if I2C
+	select SND_SOC_I_SABRE_CODEC if I2C
 	select SND_SOC_JZ4740_CODEC
 	select SND_SOC_LM4857 if I2C
 	select SND_SOC_LM49453 if I2C
@@ -1322,4 +1323,8 @@ config SND_SOC_TPA6130A2
 	tristate "Texas Instruments TPA6130A2 headphone amplifier"
 	depends on I2C
 
+config SND_SOC_I_SABRE_CODEC
+	tristate "Audiophonics I-SABRE Codec"
+	depends on I2C
+
 endmenu
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index d4e310bce30ce..6127bc7b388e8 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -81,6 +81,7 @@ snd-soc-hdac-hdmi-objs := hdac_hdmi.o
 snd-soc-ics43432-objs := ics43432.o
 snd-soc-inno-rk3036-objs := inno_rk3036.o
 snd-soc-isabelle-objs := isabelle.o
+snd-soc-i-sabre-codec-objs := i-sabre-codec.o
 snd-soc-jz4740-codec-objs := jz4740.o
 snd-soc-l3-objs := l3.o
 snd-soc-lm4857-objs := lm4857.o
@@ -343,6 +344,7 @@ obj-$(CONFIG_SND_SOC_HDAC_HDMI) += snd-soc-hdac-hdmi.o
 obj-$(CONFIG_SND_SOC_ICS43432)	+= snd-soc-ics43432.o
 obj-$(CONFIG_SND_SOC_INNO_RK3036)	+= snd-soc-inno-rk3036.o
 obj-$(CONFIG_SND_SOC_ISABELLE)	+= snd-soc-isabelle.o
+obj-$(CONFIG_SND_SOC_I_SABRE_CODEC)	+= snd-soc-i-sabre-codec.o
 obj-$(CONFIG_SND_SOC_JZ4740_CODEC)	+= snd-soc-jz4740-codec.o
 obj-$(CONFIG_SND_SOC_L3)	+= snd-soc-l3.o
 obj-$(CONFIG_SND_SOC_LM4857)	+= snd-soc-lm4857.o
diff --git a/sound/soc/codecs/i-sabre-codec.c b/sound/soc/codecs/i-sabre-codec.c
new file mode 100644
index 0000000000000..f6e5b68eb8f1f
--- /dev/null
+++ b/sound/soc/codecs/i-sabre-codec.c
@@ -0,0 +1,392 @@
+/*
+ * Driver for I-Sabre Q2M
+ *
+ * Author: Satoru Kawase
+ * Modified by: Xiao Qingyong
+ * Modified by: JC BARBAUD (Mute)
+ * Update kernel v4.18+ by : Audiophonics
+ * 		Copyright 2018 Audiophonics
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/regmap.h>
+#include <linux/i2c.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include <sound/tlv.h>
+
+#include "i-sabre-codec.h"
+
+
+/* I-Sabre Q2M Codec Private Data */
+struct i_sabre_codec_priv {
+	struct regmap *regmap;
+	unsigned int fmt;
+};
+
+
+/* I-Sabre Q2M Codec Default Register Value */
+static const struct reg_default i_sabre_codec_reg_defaults[] = {
+	{ ISABRECODEC_REG_10, 0x00 },
+	{ ISABRECODEC_REG_20, 0x00 },
+	{ ISABRECODEC_REG_21, 0x00 },
+	{ ISABRECODEC_REG_22, 0x00 },
+	{ ISABRECODEC_REG_24, 0x00 },
+};
+
+
+static bool i_sabre_codec_writeable(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case ISABRECODEC_REG_10:
+	case ISABRECODEC_REG_20:
+	case ISABRECODEC_REG_21:
+	case ISABRECODEC_REG_22:
+	case ISABRECODEC_REG_24:
+		return true;
+
+	default:
+		return false;
+	}
+}
+
+static bool i_sabre_codec_readable(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case ISABRECODEC_REG_01:
+	case ISABRECODEC_REG_02:
+	case ISABRECODEC_REG_10:
+	case ISABRECODEC_REG_20:
+	case ISABRECODEC_REG_21:
+	case ISABRECODEC_REG_22:
+	case ISABRECODEC_REG_24:
+		return true;
+
+	default:
+		return false;
+	}
+}
+
+static bool i_sabre_codec_volatile(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case ISABRECODEC_REG_01:
+	case ISABRECODEC_REG_02:
+		return true;
+
+	default:
+		return false;
+	}
+}
+
+
+/* Volume Scale */
+static const DECLARE_TLV_DB_SCALE(volume_tlv, -10000, 100, 0);
+
+
+/* Filter Type */
+static const char * const fir_filter_type_texts[] = {
+	"brick wall",
+	"corrected minimum phase fast",
+	"minimum phase slow",
+	"minimum phase fast",
+	"linear phase slow",
+	"linear phase fast",
+	"apodizing fast",
+};
+
+static SOC_ENUM_SINGLE_DECL(i_sabre_fir_filter_type_enum,
+				ISABRECODEC_REG_22, 0, fir_filter_type_texts);
+
+
+/* I2S / SPDIF Select */
+static const char * const iis_spdif_sel_texts[] = {
+	"I2S",
+	"SPDIF",
+};
+
+static SOC_ENUM_SINGLE_DECL(i_sabre_iis_spdif_sel_enum,
+				ISABRECODEC_REG_24, 0, iis_spdif_sel_texts);
+
+
+/* Control */
+static const struct snd_kcontrol_new i_sabre_codec_controls[] = {
+SOC_SINGLE_RANGE_TLV("Digital Playback Volume", ISABRECODEC_REG_20, 0, 0, 100, 1, volume_tlv),
+SOC_SINGLE("Digital Playback Switch", ISABRECODEC_REG_21, 0, 1, 1),
+SOC_ENUM("FIR Filter Type", i_sabre_fir_filter_type_enum),
+SOC_ENUM("I2S/SPDIF Select", i_sabre_iis_spdif_sel_enum),
+};
+
+
+static const u32 i_sabre_codec_dai_rates_slave[] = {
+	8000, 11025, 16000, 22050, 32000,
+	44100, 48000, 64000, 88200, 96000,
+	176400, 192000, 352800, 384000,
+	705600, 768000, 1411200, 1536000
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_slave = {
+	.list  = i_sabre_codec_dai_rates_slave,
+	.count = ARRAY_SIZE(i_sabre_codec_dai_rates_slave),
+};
+
+static int i_sabre_codec_dai_startup_slave(
+		struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
+{
+	struct snd_soc_component *component = dai->component;
+	int ret;
+
+	ret = snd_pcm_hw_constraint_list(substream->runtime,
+			0, SNDRV_PCM_HW_PARAM_RATE, &constraints_slave);
+	if (ret != 0) {
+		dev_err(component->card->dev, "Failed to setup rates constraints: %d\n", ret);
+	}
+
+	return ret;
+}
+
+static int i_sabre_codec_dai_startup(
+		struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
+{
+	struct snd_soc_component      *component = dai->component;
+	struct i_sabre_codec_priv *i_sabre_codec
+					= snd_soc_component_get_drvdata(component);
+
+	switch (i_sabre_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+	case SND_SOC_DAIFMT_CBS_CFS:
+		return i_sabre_codec_dai_startup_slave(substream, dai);
+
+	default:
+		return (-EINVAL);
+	}
+}
+
+static int i_sabre_codec_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params,
+	struct snd_soc_dai *dai)
+{
+	struct snd_soc_component      *component = dai->component;
+	struct i_sabre_codec_priv *i_sabre_codec
+					= snd_soc_component_get_drvdata(component);
+	unsigned int daifmt;
+	int format_width;
+
+	dev_dbg(component->card->dev, "hw_params %u Hz, %u channels\n",
+			params_rate(params), params_channels(params));
+
+	/* Check I2S Format (Bit Size) */
+	format_width = snd_pcm_format_width(params_format(params));
+	if ((format_width != 32) && (format_width != 16)) {
+		dev_err(component->card->dev, "Bad frame size: %d\n",
+				snd_pcm_format_width(params_format(params)));
+		return (-EINVAL);
+	}
+
+	/* Check Slave Mode */
+	daifmt = i_sabre_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK;
+	if (daifmt != SND_SOC_DAIFMT_CBS_CFS) {
+		return (-EINVAL);
+	}
+
+	/* Notify Sampling Frequency  */
+	switch (params_rate(params))
+	{
+	case 44100:
+	case 48000:
+	case 88200:
+	case 96000:
+	case 176400:
+	case 192000:
+		snd_soc_component_update_bits(component, ISABRECODEC_REG_10, 0x01, 0x00);
+		break;
+
+	case 352800:
+	case 384000:
+	case 705600:
+	case 768000:
+	case 1411200:
+	case 1536000:
+		snd_soc_component_update_bits(component, ISABRECODEC_REG_10, 0x01, 0x01);
+		break;
+	}
+
+	return 0;
+}
+
+static int i_sabre_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+	struct snd_soc_component      *component = dai->component;
+	struct i_sabre_codec_priv *i_sabre_codec
+					= snd_soc_component_get_drvdata(component);
+
+	/* interface format */
+	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+	case SND_SOC_DAIFMT_I2S:
+		break;
+
+	case SND_SOC_DAIFMT_RIGHT_J:
+	case SND_SOC_DAIFMT_LEFT_J:
+	default:
+		return (-EINVAL);
+	}
+
+	/* clock inversion */
+	if ((fmt & SND_SOC_DAIFMT_INV_MASK) != SND_SOC_DAIFMT_NB_NF) {
+		return (-EINVAL);
+	}
+
+	/* Set Audio Data Format */
+	i_sabre_codec->fmt = fmt;
+
+	return 0;
+}
+
+static int i_sabre_codec_dac_mute(struct snd_soc_dai *dai, int mute)
+{
+	struct snd_soc_component *component = dai->component;
+
+	if (mute) {
+		snd_soc_component_update_bits(component, ISABRECODEC_REG_21, 0x01, 0x01);
+	} else {
+		snd_soc_component_update_bits(component, ISABRECODEC_REG_21, 0x01, 0x00);
+	}
+
+	return 0;
+}
+
+
+static const struct snd_soc_dai_ops i_sabre_codec_dai_ops = {
+	.startup      = i_sabre_codec_dai_startup,
+	.hw_params    = i_sabre_codec_hw_params,
+	.set_fmt      = i_sabre_codec_set_fmt,
+	.digital_mute = i_sabre_codec_dac_mute,
+};
+
+static struct snd_soc_dai_driver i_sabre_codec_dai = {
+	.name = "i-sabre-codec-dai",
+	.playback = {
+		.stream_name  = "Playback",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_CONTINUOUS,
+		.rate_min = 8000,
+		.rate_max = 1536000,
+		.formats      = SNDRV_PCM_FMTBIT_S16_LE
+				| SNDRV_PCM_FMTBIT_S32_LE,
+	},
+	.ops = &i_sabre_codec_dai_ops,
+};
+
+static struct snd_soc_component_driver i_sabre_codec_codec_driver = {
+		.controls         = i_sabre_codec_controls,
+		.num_controls     = ARRAY_SIZE(i_sabre_codec_controls),
+};
+
+
+static const struct regmap_config i_sabre_codec_regmap = {
+	.reg_bits         = 8,
+	.val_bits         = 8,
+	.max_register     = ISABRECODEC_MAX_REG,
+
+	.reg_defaults     = i_sabre_codec_reg_defaults,
+	.num_reg_defaults = ARRAY_SIZE(i_sabre_codec_reg_defaults),
+
+	.writeable_reg    = i_sabre_codec_writeable,
+	.readable_reg     = i_sabre_codec_readable,
+	.volatile_reg     = i_sabre_codec_volatile,
+
+	.cache_type       = REGCACHE_RBTREE,
+};
+
+
+static int i_sabre_codec_probe(struct device *dev, struct regmap *regmap)
+{
+	struct i_sabre_codec_priv *i_sabre_codec;
+	int ret;
+
+	i_sabre_codec = devm_kzalloc(dev, sizeof(*i_sabre_codec), GFP_KERNEL);
+	if (!i_sabre_codec) {
+		dev_err(dev, "devm_kzalloc");
+		return (-ENOMEM);
+	}
+
+	i_sabre_codec->regmap = regmap;
+
+	dev_set_drvdata(dev, i_sabre_codec);
+
+	ret = snd_soc_register_component(dev,
+			&i_sabre_codec_codec_driver, &i_sabre_codec_dai, 1);
+	if (ret != 0) {
+		dev_err(dev, "Failed to register CODEC: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void i_sabre_codec_remove(struct device *dev)
+{
+	snd_soc_unregister_component(dev);
+}
+
+
+static int i_sabre_codec_i2c_probe(
+		struct i2c_client *i2c, const struct i2c_device_id *id)
+{
+	struct regmap *regmap;
+
+	regmap = devm_regmap_init_i2c(i2c, &i_sabre_codec_regmap);
+	if (IS_ERR(regmap)) {
+		return PTR_ERR(regmap);
+	}
+
+	return i_sabre_codec_probe(&i2c->dev, regmap);
+}
+
+static int i_sabre_codec_i2c_remove(struct i2c_client *i2c)
+{
+	i_sabre_codec_remove(&i2c->dev);
+
+	return 0;
+}
+
+
+static const struct i2c_device_id i_sabre_codec_i2c_id[] = {
+	{ "i-sabre-codec", },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, i_sabre_codec_i2c_id);
+
+static const struct of_device_id i_sabre_codec_of_match[] = {
+	{ .compatible = "audiophonics,i-sabre-codec", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, i_sabre_codec_of_match);
+
+static struct i2c_driver i_sabre_codec_i2c_driver = {
+	.driver = {
+		.name           = "i-sabre-codec-i2c",
+		.owner          = THIS_MODULE,
+		.of_match_table = of_match_ptr(i_sabre_codec_of_match),
+	},
+	.probe    = i_sabre_codec_i2c_probe,
+	.remove   = i_sabre_codec_i2c_remove,
+	.id_table = i_sabre_codec_i2c_id,
+};
+module_i2c_driver(i_sabre_codec_i2c_driver);
+
+
+MODULE_DESCRIPTION("ASoC I-Sabre Q2M codec driver");
+MODULE_AUTHOR("Audiophonics <http://www.audiophonics.fr>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/i-sabre-codec.h b/sound/soc/codecs/i-sabre-codec.h
new file mode 100644
index 0000000000000..9cac5a2446b9e
--- /dev/null
+++ b/sound/soc/codecs/i-sabre-codec.h
@@ -0,0 +1,42 @@
+/*
+ * Driver for I-Sabre Q2M
+ *
+ * Author: Satoru Kawase
+ * Modified by: Xiao Qingyong
+ *      Copyright 2018 Audiophonics
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef _SND_SOC_ISABRECODEC
+#define _SND_SOC_ISABRECODEC
+
+
+/* ISABRECODEC Register Address */
+#define ISABRECODEC_REG_01	0x01	/* Virtual Device ID  :  0x01 = es9038q2m */
+#define ISABRECODEC_REG_02	0x02	/* API revision       :  0x01 = Revision 01 */
+#define ISABRECODEC_REG_10	0x10	/* 0x01 = above 192kHz, 0x00 = otherwise */
+#define ISABRECODEC_REG_20	0x20	/* 0 - 100 (decimal value, 0 = min., 100 = max.) */
+#define ISABRECODEC_REG_21	0x21	/* 0x00 = Mute OFF, 0x01 = Mute ON */
+#define ISABRECODEC_REG_22	0x22	
+/*
+   0x00 = brick wall,
+   0x01 = corrected minimum phase fast,
+   0x02 = minimum phase slow,
+   0x03 = minimum phase fast,
+   0x04 = linear phase slow,
+   0x05 = linear phase fast,
+   0x06 = apodizing fast,
+*/
+//#define ISABRECODEC_REG_23	0x23	/* reserved */
+#define ISABRECODEC_REG_24	0x24	/* 0x00 = I2S, 0x01 = SPDIF */
+#define ISABRECODEC_MAX_REG	0x24	/* Maximum Register Number */
+
+#endif /* _SND_SOC_ISABRECODEC */
-- 
GitLab


From c21ed98c71fc339e9d890663706a991b3e2a1e05 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Wed, 3 Apr 2019 21:17:15 -0700
Subject: [PATCH 0417/1835] ASoC: tlv320aic32x4: Change author's name

commit 7297ba6c74c5b9e78d8e936af82eecfcf7d32dfb upstream.

The author of these files has changed her name.  Update
instances in the code of her dead name to current legal
name.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4-i2c.c | 4 ++--
 sound/soc/codecs/tlv320aic32x4-spi.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4-i2c.c b/sound/soc/codecs/tlv320aic32x4-i2c.c
index 385fa2e9525ab..22c3a6bc0b6c4 100644
--- a/sound/soc/codecs/tlv320aic32x4-i2c.c
+++ b/sound/soc/codecs/tlv320aic32x4-i2c.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2011 NW Digital Radio
  *
- * Author: Jeremy McDermond <nh6z@nh6z.net>
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
@@ -72,5 +72,5 @@ static struct i2c_driver aic32x4_i2c_driver = {
 module_i2c_driver(aic32x4_i2c_driver);
 
 MODULE_DESCRIPTION("ASoC TLV320AIC32x4 codec driver I2C");
-MODULE_AUTHOR("Jeremy McDermond <nh6z@nh6z.net>");
+MODULE_AUTHOR("Annaliese McDermond <nh6z@nh6z.net>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/tlv320aic32x4-spi.c b/sound/soc/codecs/tlv320aic32x4-spi.c
index 07d78ae51e05c..aa5b7ba0254bc 100644
--- a/sound/soc/codecs/tlv320aic32x4-spi.c
+++ b/sound/soc/codecs/tlv320aic32x4-spi.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2011 NW Digital Radio
  *
- * Author: Jeremy McDermond <nh6z@nh6z.net>
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
@@ -74,5 +74,5 @@ static struct spi_driver aic32x4_spi_driver = {
 module_spi_driver(aic32x4_spi_driver);
 
 MODULE_DESCRIPTION("ASoC TLV320AIC32x4 codec driver SPI");
-MODULE_AUTHOR("Jeremy McDermond <nh6z@nh6z.net>");
+MODULE_AUTHOR("Annaliese McDermond <nh6z@nh6z.net>");
 MODULE_LICENSE("GPL");
-- 
GitLab


From de16d1afd006aef5faf38888080d056399dff570 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Wed, 3 Apr 2019 21:17:16 -0700
Subject: [PATCH 0418/1835] ASoC: tlv320aic32x4: Update copyright and use SPDX
 identifier

commit 8a1d95c393d971e624fc28f11516b0bc3a7fa706 upstream.

Update the copyright dates and use the SPDX identifier instead
of reciting the license.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4-i2c.c | 14 ++------------
 sound/soc/codecs/tlv320aic32x4-spi.c | 14 ++------------
 2 files changed, 4 insertions(+), 24 deletions(-)

diff --git a/sound/soc/codecs/tlv320aic32x4-i2c.c b/sound/soc/codecs/tlv320aic32x4-i2c.c
index 22c3a6bc0b6c4..6d54cbf70a0bf 100644
--- a/sound/soc/codecs/tlv320aic32x4-i2c.c
+++ b/sound/soc/codecs/tlv320aic32x4-i2c.c
@@ -1,21 +1,11 @@
-/*
- * linux/sound/soc/codecs/tlv320aic32x4-i2c.c
+/* SPDX-License-Identifier: GPL-2.0
  *
- * Copyright 2011 NW Digital Radio
+ * Copyright 2011-2019 NW Digital Radio
  *
  * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/i2c.h>
diff --git a/sound/soc/codecs/tlv320aic32x4-spi.c b/sound/soc/codecs/tlv320aic32x4-spi.c
index aa5b7ba0254bc..a22e7700bfc8a 100644
--- a/sound/soc/codecs/tlv320aic32x4-spi.c
+++ b/sound/soc/codecs/tlv320aic32x4-spi.c
@@ -1,21 +1,11 @@
-/*
- * linux/sound/soc/codecs/tlv320aic32x4-spi.c
+/* SPDX-License-Identifier: GPL-2.0
  *
- * Copyright 2011 NW Digital Radio
+ * Copyright 2011-2019 NW Digital Radio
  *
  * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/spi/spi.h>
-- 
GitLab


From c44399f93f54514bf593af3d491be37a808f76db Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Wed, 3 Apr 2019 21:01:54 -0700
Subject: [PATCH 0419/1835] ASoC: tlv320aic32x4: Add Switch for Setting Common
 Mode Voltage

commit 44ceee847e27c828f2f1ef4e400e6bc0c8d04de3 upstream.

Add a switch for setting common mode voltage.  This can allow
for higher drive levels on the amplifier outputs.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 707ca49517a1d..5da0a6edbf61b 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -242,6 +242,12 @@ static DECLARE_TLV_DB_SCALE(tlv_driver_gain, -600, 100, 0);
 /* -12dB min, 0.5dB steps */
 static DECLARE_TLV_DB_SCALE(tlv_adc_vol, -1200, 50, 0);
 
+static const char * const lo_cm_text[] = {
+	"Full Chip", "1.65V",
+};
+
+static SOC_ENUM_SINGLE_DECL(lo_cm_enum, AIC32X4_CMMODE, 3, lo_cm_text);
+
 static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 	SOC_DOUBLE_R_S_TLV("PCM Playback Volume", AIC32X4_LDACVOL,
 			AIC32X4_RDACVOL, 0, -0x7f, 0x30, 7, 0, tlv_pcm),
@@ -255,6 +261,7 @@ static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 			AIC32X4_HPRGAIN, 6, 0x01, 1),
 	SOC_DOUBLE_R("LO DAC Playback Switch", AIC32X4_LOLGAIN,
 			AIC32X4_LORGAIN, 6, 0x01, 1),
+	SOC_ENUM("LO Playback Common Mode Switch", lo_cm_enum),
 	SOC_DOUBLE_R("Mic PGA Switch", AIC32X4_LMICPGAVOL,
 			AIC32X4_RMICPGAVOL, 7, 0x01, 1),
 
-- 
GitLab


From 5683aef54e75059de8e357a19c502501b7aca34b Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Wed, 3 Apr 2019 21:01:55 -0700
Subject: [PATCH 0420/1835] ASoC: tlv320aic32x4: Add Playback PowerTune
 Controls

commit d3e6e374566e1154820a9a3dc82f7eef646fcf95 upstream.

PowerTune controls the power level of the chip.  On playback this
indirectly controls things like the gain of the various output
amplifiers.  This can allow for the decrease of output levels
from the codec.  This adds controls for those power levels to
the driver.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 9 +++++++++
 sound/soc/codecs/tlv320aic32x4.h | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 5da0a6edbf61b..3f59d103c0ae8 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -248,9 +248,18 @@ static const char * const lo_cm_text[] = {
 
 static SOC_ENUM_SINGLE_DECL(lo_cm_enum, AIC32X4_CMMODE, 3, lo_cm_text);
 
+static const char * const ptm_text[] = {
+	"P3", "P2", "P1",
+};
+
+static SOC_ENUM_SINGLE_DECL(l_ptm_enum, AIC32X4_LPLAYBACK, 2, ptm_text);
+static SOC_ENUM_SINGLE_DECL(r_ptm_enum, AIC32X4_RPLAYBACK, 2, ptm_text);
+
 static const struct snd_kcontrol_new aic32x4_snd_controls[] = {
 	SOC_DOUBLE_R_S_TLV("PCM Playback Volume", AIC32X4_LDACVOL,
 			AIC32X4_RDACVOL, 0, -0x7f, 0x30, 7, 0, tlv_pcm),
+	SOC_ENUM("DAC Left Playback PowerTune Switch", l_ptm_enum),
+	SOC_ENUM("DAC Right Playback PowerTune Switch", r_ptm_enum),
 	SOC_DOUBLE_R_S_TLV("HP Driver Gain Volume", AIC32X4_HPLGAIN,
 			AIC32X4_HPRGAIN, 0, -0x6, 0x1d, 5, 0,
 			tlv_driver_gain),
diff --git a/sound/soc/codecs/tlv320aic32x4.h b/sound/soc/codecs/tlv320aic32x4.h
index 88205bc971980..40734211bc0ed 100644
--- a/sound/soc/codecs/tlv320aic32x4.h
+++ b/sound/soc/codecs/tlv320aic32x4.h
@@ -78,6 +78,8 @@ int aic32x4_register_clocks(struct device *dev, const char *mclk_name);
 
 #define AIC32X4_PWRCFG		AIC32X4_REG(1, 1)
 #define AIC32X4_LDOCTL		AIC32X4_REG(1, 2)
+#define AIC32X4_LPLAYBACK	AIC32X4_REG(1, 3)
+#define AIC32X4_RPLAYBACK	AIC32X4_REG(1, 4)
 #define AIC32X4_OUTPWRCTL	AIC32X4_REG(1, 9)
 #define AIC32X4_CMMODE		AIC32X4_REG(1, 10)
 #define AIC32X4_HPLROUTE	AIC32X4_REG(1, 12)
-- 
GitLab


From 56c0ecca543dc8250f14452d7cdaba52e52a3f83 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Sun, 17 Mar 2019 16:48:36 -0700
Subject: [PATCH 0421/1835] dtoverlays: Add Support for the UDRC/DRAWS

Adds a new overlay to support the Northwest Digital Radio
DRAWS and UDRC HATs.  See http://nwdigitalradio.com.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
---
 arch/arm/boot/dts/overlays/Makefile          |   2 +
 arch/arm/boot/dts/overlays/README            |  59 ++++++
 arch/arm/boot/dts/overlays/draws-overlay.dts | 200 +++++++++++++++++++
 arch/arm/boot/dts/overlays/udrc-overlay.dts  | 128 ++++++++++++
 4 files changed, 389 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/draws-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/udrc-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index f06a5e924b82b..036d49b7a52b3 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -29,6 +29,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	dionaudio-loco-v2.dtbo \
 	dpi18.dtbo \
 	dpi24.dtbo \
+	draws.dtbo \
 	dwc-otg.dtbo \
 	dwc2.dtbo \
 	enc28j60.dtbo \
@@ -146,6 +147,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	tpm-slb9670.dtbo \
 	uart0.dtbo \
 	uart1.dtbo \
+	udrc.dtbo \
 	upstream.dtbo \
 	upstream-aux-interrupt.dtbo \
 	vc4-fkms-v3d.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 0f9f9e52b37c7..089e12255eb7e 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -531,6 +531,59 @@ Load:   dtoverlay=dpi24
 Params: <None>
 
 
+Name:   draws
+Info:   Configures the NW Digital Radio DRAWS Hat
+
+        The board includes an ADC to measure various board values and also
+        provides two analog user inputs on the expansion header.  The ADC
+        can be configured for various sample rates and gain values to adjust
+        the input range.  Tables describing the two parameters follow.
+
+        ADC Gain Values:
+            0 = +/- 6.144V
+            1 = +/- 4.096V
+            2 = +/- 2.048V
+            3 = +/- 1.024V
+            4 = +/- 0.512V
+            5 = +/- 0.256V
+            6 = +/- 0.256V
+            7 = +/- 0.256V
+
+        ADC Datarate Values:
+            0 = 128sps
+            1 = 250sps
+            2 = 490sps
+            3 = 920sps
+            4 = 1600sps (default)
+            5 = 2400sps
+            6 = 3300sps
+            7 = 3300sps
+Load:   dtoverlay=draws,<param>=<val>
+Params: draws_adc_ch4_gain      Sets the full scale resolution of the ADCs
+                                input voltage sensor (default 1)
+
+        draws_adc_ch4_datarate  Sets the datarate of the ADCs input voltage
+                                sensor
+
+        draws_adc_ch5_gain      Sets the full scale resolution of the ADCs
+                                5V rail voltage sensor (default 1)
+
+        draws_adc_ch5_datarate  Sets the datarate of the ADCs 4V rail voltage
+                                sensor
+
+        draws_adc_ch6_gain      Sets the full scale resolution of the ADCs
+                                AIN2 input (default 2)
+
+        draws_adc_ch6_datarate  Sets the datarate of the ADCs AIN2 input
+
+        draws_adc_ch7_gain      Sets the full scale resolution of the ADCs
+                                AIN3 input (default 2)
+
+        draws_adc_ch7_datarate  Sets the datarate of the ADCs AIN3 input
+
+        alsaname                Name of the ALSA audio device (default "draws")
+
+
 Name:   dwc-otg
 Info:   Selects the dwc_otg USB controller driver which has fiq support. This
         is the default on all except the Pi Zero which defaults to dwc2.
@@ -2117,6 +2170,12 @@ Params: txd1_pin                GPIO pin for TXD1 (14, 32 or 40 - default 14)
         rxd1_pin                GPIO pin for RXD1 (15, 33 or 41 - default 15)
 
 
+Name:   udrc
+Info:   Configures the NW Digital Radio UDRC Hat
+Load:   dtoverlay=udrc,<param>=<val>
+Params: alsaname                Name of the ALSA audio device (default "udrc")
+
+
 Name:   upstream
 Info:   Allow usage of downstream .dtb with upstream kernel. Comprises
         vc4-kms-v3d, dwc2 and upstream-aux-interrupt overlays.
diff --git a/arch/arm/boot/dts/overlays/draws-overlay.dts b/arch/arm/boot/dts/overlays/draws-overlay.dts
new file mode 100644
index 0000000000000..5c16baaf0c52a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/draws-overlay.dts
@@ -0,0 +1,200 @@
+#include <dt-bindings/clock/bcm2835.h>
+/*
+ * Device tree overlay for the DRAWS Hardware
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    fragment@0 {
+        target = <&i2s>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+        target-path = "/";
+        __overlay__ {
+            regulators {
+                compatible = "simple-bus";
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                udrc0_ldoin: udrc0_ldoin {
+                    compatible = "regulator-fixed";
+                    regulator-name = "ldoin";
+                    regulator-min-microvolt = <3300000>;
+                    regulator-max-microvolt = <3300000>;
+                    regulator-always-on;
+                };
+            };
+
+            pps: pps {
+                compatible = "pps-gpio";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pps_pins>;
+                gpios = <&gpio 7 0>;
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@2 {
+        target = <&i2c_arm>;
+        __overlay__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            status = "okay";
+
+            tlv320aic32x4: tlv320aic32x4@18 {
+                compatible = "ti,tlv320aic32x4";
+                reg = <0x18>;
+                #sound-dai-cells = <0>;
+                status = "okay";
+
+                clocks = <&clocks BCM2835_CLOCK_GP0>;
+                clock-names = "mclk";
+                assigned-clocks = <&clocks BCM2835_CLOCK_GP0>;
+                assigned-clock-rates = <25000000>;
+
+                pinctrl-names = "default";
+                pinctrl-0 = <&gpclk0_pin &aic3204_reset>;
+
+                reset-gpios = <&gpio 13 0>;
+
+                iov-supply = <&udrc0_ldoin>;
+                ldoin-supply = <&udrc0_ldoin>;
+            };
+
+            sc16is752: sc16is752@50 {
+                compatible = "nxp,sc16is752";
+                reg = <0x50>;
+                clocks = <&sc16is752_clk>;
+                interrupt-parent = <&gpio>;
+                interrupts = <17 2>; /* IRQ_TYPE_EDGE_FALLING */
+
+                pinctrl-names = "default";
+                pinctrl-0 = <&sc16is752_irq>;
+
+                sc16is752_clk: sc16is752_clk {
+                    compatible = "fixed-clock";
+                    #clock-cells = <0>;
+                    clock-frequency = <1843200>;
+                };
+            };
+
+            tla2024: tla2024@48 {
+                compatible = "ti,ads1015";
+                reg = <0x48>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                adc_ch4: channel@4 {
+                    reg = <4>;
+                    ti,gain = <1>;
+                    ti,datarate = <4>;
+                };
+
+                adc_ch5: channel@5 {
+                    reg = <5>;
+                    ti,gain = <1>;
+                    ti,datarate = <4>;
+                };
+
+                adc_ch6: channel@6 {
+                    reg = <6>;
+                    ti,gain = <2>;
+                    ti,datarate = <4>;
+                };
+
+                adc_ch7: channel@7 {
+                    reg = <7>;
+                    ti,gain = <2>;
+                    ti,datarate = <4>;
+                };
+            };
+        };
+    };
+
+    fragment@3 {
+        target = <&sound>;
+        snd: __overlay__ {
+            compatible = "simple-audio-card";
+            i2s-controller = <&i2s>;
+            status = "okay";
+
+            simple-audio-card,name = "draws";
+            simple-audio-card,format = "i2s";
+
+            simple-audio-card,bitclock-master = <&dailink0_master>;
+            simple-audio-card,frame-master = <&dailink0_master>;
+
+            simple-audio-card,widgets =
+                "Line", "Line In",
+                "Line", "Line Out";
+
+            simple-audio-card,routing =
+                "IN1_R", "Line In",
+                "IN1_L", "Line In",
+                "CM_L", "Line In",
+                "CM_R", "Line In",
+                "Line Out", "LOR",
+                "Line Out", "LOL";
+
+            dailink0_master: simple-audio-card,cpu {
+                sound-dai = <&i2s>;
+            };
+
+            simple-audio-card,codec {
+                sound-dai = <&tlv320aic32x4>;
+            };
+        };
+    };
+
+    fragment@4 {
+        target = <&gpio>;
+        __overlay__ {
+            gpclk0_pin: gpclk0_pin {
+                brcm,pins = <4>;
+                brcm,function = <4>;
+            };
+
+            aic3204_reset: aic3204_reset {
+                brcm,pins = <13>;
+                brcm,function = <1>;
+                brcm,pull = <1>;
+            };
+
+            aic3204_gpio: aic3204_gpio {
+                brcm,pins = <26>;
+            };
+
+            sc16is752_irq: sc16is752_irq {
+                brcm,pins = <17>;
+                brcm,function = <0>;
+                brcm,pull = <2>;
+            };
+
+            pps_pins: pps_pins {
+                brcm,pins = <7>;
+                brcm,function = <0>;
+                brcm,pull = <0>;
+            };
+        };
+    };
+
+    __overrides__ {
+        draws_adc_ch4_gain = <&adc_ch4>,"ti,gain:0";
+        draws_adc_ch4_datarate = <&adc_ch4>,"ti,datarate:0";
+        draws_adc_ch5_gain = <&adc_ch5>,"ti,gain:0";
+        draws_adc_ch5_datarate = <&adc_ch5>,"ti,datarate:0";
+        draws_adc_ch6_gain = <&adc_ch6>,"ti,gain:0";
+        draws_adc_ch6_datarate = <&adc_ch6>,"ti,datarate:0";
+        draws_adc_ch7_gain = <&adc_ch7>,"ti,gain:0";
+        draws_adc_ch7_datarate = <&adc_ch7>,"ti,datarate:0";
+        alsaname = <&snd>, "simple-audio-card,name";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/udrc-overlay.dts b/arch/arm/boot/dts/overlays/udrc-overlay.dts
new file mode 100644
index 0000000000000..f6c235a341a2b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/udrc-overlay.dts
@@ -0,0 +1,128 @@
+#include <dt-bindings/clock/bcm2835.h>
+/*
+ * Device tree overlay for the Universal Digital Radio Controller
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    fragment@0 {
+        target = <&i2s>;
+        __overlay__ {
+            clocks = <&clocks BCM2835_CLOCK_PCM>;
+            clock-names = "pcm";
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+        target-path = "/";
+        __overlay__ {
+            regulators {
+                compatible = "simple-bus";
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                udrc0_ldoin: udrc0_ldoin {
+                    compatible = "regulator-fixed";
+                    regulator-name = "ldoin";
+                    regulator-min-microvolt = <3300000>;
+                    regulator-max-microvolt = <3300000>;
+                    regulator-always-on;
+                };
+            };
+        };
+    };
+
+    fragment@2 {
+        target = <&i2c1>;
+        __overlay__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            status = "okay";
+            clocks = <&clocks BCM2835_CLOCK_VPU>;
+            clock-frequency = <400000>;
+
+            tlv320aic32x4: tlv320aic32x4@18 {
+                compatible = "ti,tlv320aic32x4";
+                #sound-dai-cells = <0>;
+                reg = <0x18>;
+                status = "okay";
+
+                clocks = <&clocks BCM2835_CLOCK_GP0>;
+                clock-names = "mclk";
+                assigned-clocks = <&clocks BCM2835_CLOCK_GP0>;
+                assigned-clock-rates = <25000000>;
+
+                pinctrl-names = "default";
+                pinctrl-0 = <&gpclk0_pin &aic3204_reset>;
+
+                reset-gpios = <&gpio 13 0>;
+
+                iov-supply = <&udrc0_ldoin>;
+                ldoin-supply = <&udrc0_ldoin>;
+            };
+        };
+    };
+
+    fragment@3 {
+        target = <&sound>;
+        snd: __overlay__ {
+            compatible = "simple-audio-card";
+            i2s-controller = <&i2s>;
+            status = "okay";
+
+            simple-audio-card,name = "udrc";
+            simple-audio-card,format = "i2s";
+
+            simple-audio-card,bitclock-master = <&dailink0_master>;
+            simple-audio-card,frame-master = <&dailink0_master>;
+
+            simple-audio-card,widgets =
+                "Line", "Line In",
+                "Line", "Line Out";
+
+            simple-audio-card,routing =
+                "IN1_R", "Line In",
+                "IN1_L", "Line In",
+                "CM_L", "Line In",
+                "CM_R", "Line In",
+                "Line Out", "LOR",
+                "Line Out", "LOL";
+
+            dailink0_master: simple-audio-card,cpu {
+                sound-dai = <&i2s>;
+            };
+
+            simple-audio-card,codec {
+                sound-dai = <&tlv320aic32x4>;
+            };
+        };
+    };
+
+    fragment@4 {
+        target = <&gpio>;
+        __overlay__ {
+            gpclk0_pin: gpclk0_pin {
+                brcm,pins = <4>;
+                brcm,function = <4>;
+            };
+
+            aic3204_reset: aic3204_reset {
+                brcm,pins = <13>;
+                brcm,function = <1>;
+                brcm,pull = <1>;
+            };
+
+            aic3204_gpio: aic3204_gpio {
+                brcm,pins = <26>;
+            };
+        };
+    };
+
+    __overrides__ {
+        alsaname = <&snd>, "simple-audio-card,name";
+    };
+};
-- 
GitLab


From 9ff817185106d566751633e72e8df49b38d53939 Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Mon, 8 Apr 2019 12:45:23 +0100
Subject: [PATCH 0422/1835] dwc_otg: only do_split when we actually need to do
 a split

The previous test would fail if the root port was in fullspeed mode
and there was a hub between the FS device and the root port. While
the transfer worked, the schedule mangling performed for high-speed
split transfers would break leading to an 8ms polling interval.
---
 drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
index fe8e8f841f036..2823dc9af63f1 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
@@ -167,8 +167,10 @@ void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
 	char *speed, *type;
 	int dev_speed;
 	uint32_t hub_addr, hub_port;
+	hprt0_data_t hprt;
 
 	dwc_memset(qh, 0, sizeof(dwc_otg_qh_t));
+	hprt.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
 
 	/* Initialize QH */
 	qh->ep_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
@@ -191,9 +193,8 @@ void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
 
 	qh->nak_frame = 0xffff;
 
-	if (((dev_speed == USB_SPEED_LOW) ||
-	     (dev_speed == USB_SPEED_FULL)) &&
-	    (hub_addr != 0 && hub_addr != 1)) {
+	if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED &&
+			dev_speed != USB_SPEED_HIGH) {
 		DWC_DEBUGPL(DBG_HCD,
 			    "QH init: EP %d: TT found at hub addr %d, for port %d\n",
 			    dwc_otg_hcd_get_ep_num(&urb->pipe_info), hub_addr,
@@ -204,7 +205,6 @@ void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
 
 	if (qh->ep_type == UE_INTERRUPT || qh->ep_type == UE_ISOCHRONOUS) {
 		/* Compute scheduling parameters once and save them. */
-		hprt0_data_t hprt;
 
 		/** @todo Account for split transfers in the bus time. */
 		int bytecount =
@@ -219,7 +219,6 @@ void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
 						    SCHEDULE_SLOP);
 		qh->interval = urb->interval;
 
-		hprt.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
 		if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED) {
 			if (dev_speed == USB_SPEED_LOW ||
 					dev_speed == USB_SPEED_FULL) {
-- 
GitLab


From 55ce80d3c36f642578834ace06ba9dbe42e6272a Mon Sep 17 00:00:00 2001
From: Samuel Hsu <hsu@distec.de>
Date: Mon, 8 Apr 2019 16:42:17 +0200
Subject: [PATCH 0423/1835] Input: ili210x - fetch touchscreen geometry from DT

commit f67cc3e927d8414ad3872e046764534ea1f5db0d upstream

Fetching the geometry from the ILI251x registers seems unreliable and
sometimes returns all zeroes. Add support for fetching the geometry and
axis inversion from DT instead.

Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/touchscreen/ili210x.c | 321 +++++++++++++++++-----------
 1 file changed, 194 insertions(+), 127 deletions(-)

diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index 6f76eeedf4652..9169aa03958ad 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -4,11 +4,15 @@
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/input/mt.h>
+#include <linux/input/touchscreen.h>
 #include <linux/delay.h>
 #include <linux/workqueue.h>
-#include <linux/input/ili210x.h>
+#include <linux/gpio/consumer.h>
+#include <linux/of_device.h>
+#include <asm/unaligned.h>
 
-#define MAX_TOUCHES		2
+#define ILI210X_TOUCHES		2
+#define ILI251X_TOUCHES		10
 #define DEFAULT_POLL_PERIOD	20
 
 /* Touchscreen commands */
@@ -17,41 +21,32 @@
 #define REG_FIRMWARE_VERSION	0x40
 #define REG_CALIBRATE		0xcc
 
-struct finger {
-	u8 x_low;
-	u8 x_high;
-	u8 y_low;
-	u8 y_high;
-} __packed;
-
-struct touchdata {
-	u8 status;
-	struct finger finger[MAX_TOUCHES];
-} __packed;
-
-struct panel_info {
-	struct finger finger_max;
-	u8 xchannel_num;
-	u8 ychannel_num;
-} __packed;
-
 struct firmware_version {
 	u8 id;
 	u8 major;
 	u8 minor;
 } __packed;
 
+enum ili2xxx_model {
+	MODEL_ILI210X,
+	MODEL_ILI251X,
+};
+
 struct ili210x {
 	struct i2c_client *client;
 	struct input_dev *input;
-	bool (*get_pendown_state)(void);
 	unsigned int poll_period;
 	struct delayed_work dwork;
+	struct gpio_desc *reset_gpio;
+	struct touchscreen_properties prop;
+	enum ili2xxx_model model;
+	unsigned int max_touches;
 };
 
 static int ili210x_read_reg(struct i2c_client *client, u8 reg, void *buf,
 			    size_t len)
 {
+	struct ili210x *priv = i2c_get_clientdata(client);
 	struct i2c_msg msg[2] = {
 		{
 			.addr	= client->addr,
@@ -67,7 +62,38 @@ static int ili210x_read_reg(struct i2c_client *client, u8 reg, void *buf,
 		}
 	};
 
-	if (i2c_transfer(client->adapter, msg, 2) != 2) {
+	if (priv->model == MODEL_ILI251X) {
+		if (i2c_transfer(client->adapter, msg, 1) != 1) {
+			dev_err(&client->dev, "i2c transfer failed\n");
+			return -EIO;
+		}
+
+		usleep_range(5000, 5500);
+
+		if (i2c_transfer(client->adapter, msg + 1, 1) != 1) {
+			dev_err(&client->dev, "i2c transfer failed\n");
+			return -EIO;
+		}
+	} else {
+		if (i2c_transfer(client->adapter, msg, 2) != 2) {
+			dev_err(&client->dev, "i2c transfer failed\n");
+			return -EIO;
+		}
+	}
+
+	return 0;
+}
+
+static int ili210x_read(struct i2c_client *client, void *buf, size_t len)
+{
+	struct i2c_msg msg = {
+		.addr	= client->addr,
+		.flags	= I2C_M_RD,
+		.len	= len,
+		.buf	= buf,
+	};
+
+	if (i2c_transfer(client->adapter, &msg, 1) != 1) {
 		dev_err(&client->dev, "i2c transfer failed\n");
 		return -EIO;
 	}
@@ -75,42 +101,72 @@ static int ili210x_read_reg(struct i2c_client *client, u8 reg, void *buf,
 	return 0;
 }
 
-static void ili210x_report_events(struct input_dev *input,
-				  const struct touchdata *touchdata)
+static bool ili210x_touchdata_to_coords(struct ili210x *priv, u8 *touchdata,
+					unsigned int finger,
+					unsigned int *x, unsigned int *y)
 {
-	int i;
-	bool touch;
-	unsigned int x, y;
-	const struct finger *finger;
+	if (finger >= ILI210X_TOUCHES)
+		return false;
 
-	for (i = 0; i < MAX_TOUCHES; i++) {
-		input_mt_slot(input, i);
+	if (touchdata[0] & BIT(finger))
+		return false;
 
-		finger = &touchdata->finger[i];
+	*x = get_unaligned_be16(touchdata + 1 + (finger * 4) + 0);
+	*y = get_unaligned_be16(touchdata + 1 + (finger * 4) + 2);
 
-		touch = touchdata->status & (1 << i);
-		input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
-		if (touch) {
-			x = finger->x_low | (finger->x_high << 8);
-			y = finger->y_low | (finger->y_high << 8);
+	return true;
+}
+
+static bool ili251x_touchdata_to_coords(struct ili210x *priv, u8 *touchdata,
+					unsigned int finger,
+					unsigned int *x, unsigned int *y)
+{
+	if (finger >= ILI251X_TOUCHES)
+		return false;
+
+	*x = get_unaligned_be16(touchdata + 1 + (finger * 5) + 0);
+	if (!(*x & BIT(15)))	/* Touch indication */
+		return false;
 
-			input_report_abs(input, ABS_MT_POSITION_X, x);
-			input_report_abs(input, ABS_MT_POSITION_Y, y);
+	*x &= 0x3fff;
+	*y = get_unaligned_be16(touchdata + 1 + (finger * 5) + 2);
+
+	return true;
+}
+
+static bool ili210x_report_events(struct ili210x *priv, u8 *touchdata)
+{
+	struct input_dev *input = priv->input;
+	int i;
+	bool contact = false, touch = false;
+	unsigned int x = 0, y = 0;
+
+	for (i = 0; i < priv->max_touches; i++) {
+		if (priv->model == MODEL_ILI210X) {
+			touch = ili210x_touchdata_to_coords(priv, touchdata,
+							    i, &x, &y);
+		} else if (priv->model == MODEL_ILI251X) {
+			touch = ili251x_touchdata_to_coords(priv, touchdata,
+							    i, &x, &y);
+			if (touch)
+				contact = true;
 		}
+
+		input_mt_slot(input, i);
+		input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
+		if (!touch)
+			continue;
+		touchscreen_report_pos(input, &priv->prop, x, y,
+				       true);
 	}
 
 	input_mt_report_pointer_emulation(input, false);
 	input_sync(input);
-}
 
-static bool get_pendown_state(const struct ili210x *priv)
-{
-	bool state = false;
-
-	if (priv->get_pendown_state)
-		state = priv->get_pendown_state();
+	if (priv->model == MODEL_ILI210X)
+		contact = touchdata[0] & 0xf3;
 
-	return state;
+	return contact;
 }
 
 static void ili210x_work(struct work_struct *work)
@@ -118,20 +174,29 @@ static void ili210x_work(struct work_struct *work)
 	struct ili210x *priv = container_of(work, struct ili210x,
 					    dwork.work);
 	struct i2c_client *client = priv->client;
-	struct touchdata touchdata;
-	int error;
+	u8 touchdata[64] = { 0 };
+	bool touch;
+	int error = -EINVAL;
+
+	if (priv->model == MODEL_ILI210X) {
+		error = ili210x_read_reg(client, REG_TOUCHDATA,
+					 touchdata, sizeof(touchdata));
+	} else if (priv->model == MODEL_ILI251X) {
+		error = ili210x_read_reg(client, REG_TOUCHDATA,
+					 touchdata, 31);
+		if (!error && touchdata[0] == 2)
+			error = ili210x_read(client, &touchdata[31], 20);
+	}
 
-	error = ili210x_read_reg(client, REG_TOUCHDATA,
-				 &touchdata, sizeof(touchdata));
 	if (error) {
 		dev_err(&client->dev,
 			"Unable to get touchdata, err = %d\n", error);
 		return;
 	}
 
-	ili210x_report_events(priv->input, &touchdata);
+	touch = ili210x_report_events(priv, touchdata);
 
-	if ((touchdata.status & 0xf3) || get_pendown_state(priv))
+	if (touch)
 		schedule_delayed_work(&priv->dwork,
 				      msecs_to_jiffies(priv->poll_period));
 }
@@ -180,103 +245,119 @@ static const struct attribute_group ili210x_attr_group = {
 	.attrs = ili210x_attributes,
 };
 
+static void ili210x_power_down(void *data)
+{
+	struct gpio_desc *reset_gpio = data;
+
+	gpiod_set_value_cansleep(reset_gpio, 1);
+}
+
+static void ili210x_cancel_work(void *data)
+{
+	struct ili210x *priv = data;
+
+	cancel_delayed_work_sync(&priv->dwork);
+}
+
 static int ili210x_i2c_probe(struct i2c_client *client,
 				       const struct i2c_device_id *id)
 {
 	struct device *dev = &client->dev;
-	const struct ili210x_platform_data *pdata = dev_get_platdata(dev);
 	struct ili210x *priv;
+	struct gpio_desc *reset_gpio;
 	struct input_dev *input;
-	struct panel_info panel;
 	struct firmware_version firmware;
-	int xmax, ymax;
+	enum ili2xxx_model model;
 	int error;
 
-	dev_dbg(dev, "Probing for ILI210X I2C Touschreen driver");
+	model = (enum ili2xxx_model)id->driver_data;
 
-	if (!pdata) {
-		dev_err(dev, "No platform data!\n");
-		return -EINVAL;
-	}
+	dev_dbg(dev, "Probing for ILI210X I2C Touschreen driver");
 
 	if (client->irq <= 0) {
 		dev_err(dev, "No IRQ!\n");
 		return -EINVAL;
 	}
 
-	/* Get firmware version */
-	error = ili210x_read_reg(client, REG_FIRMWARE_VERSION,
-				 &firmware, sizeof(firmware));
-	if (error) {
-		dev_err(dev, "Failed to get firmware version, err: %d\n",
-			error);
-		return error;
-	}
+	reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+	if (IS_ERR(reset_gpio))
+		return PTR_ERR(reset_gpio);
 
-	/* get panel info */
-	error = ili210x_read_reg(client, REG_PANEL_INFO, &panel, sizeof(panel));
-	if (error) {
-		dev_err(dev, "Failed to get panel information, err: %d\n",
-			error);
-		return error;
+	if (reset_gpio) {
+		error = devm_add_action_or_reset(dev, ili210x_power_down,
+						 reset_gpio);
+		if (error)
+			return error;
+
+		usleep_range(50, 100);
+		gpiod_set_value_cansleep(reset_gpio, 0);
+		msleep(100);
 	}
 
-	xmax = panel.finger_max.x_low | (panel.finger_max.x_high << 8);
-	ymax = panel.finger_max.y_low | (panel.finger_max.y_high << 8);
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
 
-	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-	input = input_allocate_device();
-	if (!priv || !input) {
-		error = -ENOMEM;
-		goto err_free_mem;
-	}
+	input = devm_input_allocate_device(dev);
+	if (!input)
+		return -ENOMEM;
 
 	priv->client = client;
 	priv->input = input;
-	priv->get_pendown_state = pdata->get_pendown_state;
-	priv->poll_period = pdata->poll_period ? : DEFAULT_POLL_PERIOD;
+	priv->poll_period = DEFAULT_POLL_PERIOD;
 	INIT_DELAYED_WORK(&priv->dwork, ili210x_work);
+	priv->reset_gpio = reset_gpio;
+	priv->model = model;
+	if (model == MODEL_ILI210X)
+		priv->max_touches = ILI210X_TOUCHES;
+	if (model == MODEL_ILI251X)
+		priv->max_touches = ILI251X_TOUCHES;
+
+	i2c_set_clientdata(client, priv);
+
+	/* Get firmware version */
+	error = ili210x_read_reg(client, REG_FIRMWARE_VERSION,
+				 &firmware, sizeof(firmware));
+	if (error) {
+		dev_err(dev, "Failed to get firmware version, err: %d\n",
+			error);
+		return error;
+	}
 
 	/* Setup input device */
 	input->name = "ILI210x Touchscreen";
 	input->id.bustype = BUS_I2C;
 	input->dev.parent = dev;
 
-	__set_bit(EV_SYN, input->evbit);
-	__set_bit(EV_KEY, input->evbit);
-	__set_bit(EV_ABS, input->evbit);
-	__set_bit(BTN_TOUCH, input->keybit);
-
-	/* Single touch */
-	input_set_abs_params(input, ABS_X, 0, xmax, 0, 0);
-	input_set_abs_params(input, ABS_Y, 0, ymax, 0, 0);
-
 	/* Multi touch */
-	input_mt_init_slots(input, MAX_TOUCHES, 0);
-	input_set_abs_params(input, ABS_MT_POSITION_X, 0, xmax, 0, 0);
-	input_set_abs_params(input, ABS_MT_POSITION_Y, 0, ymax, 0, 0);
+	input_set_abs_params(input, ABS_MT_POSITION_X, 0, 0xffff, 0, 0);
+	input_set_abs_params(input, ABS_MT_POSITION_Y, 0, 0xffff, 0, 0);
+	touchscreen_parse_properties(input, true, &priv->prop);
+	input_mt_init_slots(input, priv->max_touches, INPUT_MT_DIRECT);
 
-	i2c_set_clientdata(client, priv);
+	error = devm_add_action(dev, ili210x_cancel_work, priv);
+	if (error)
+		return error;
 
-	error = request_irq(client->irq, ili210x_irq, pdata->irq_flags,
-			    client->name, priv);
+	error = devm_request_irq(dev, client->irq, ili210x_irq, 0,
+				 client->name, priv);
 	if (error) {
 		dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
 			error);
-		goto err_free_mem;
+		return error;
 	}
 
-	error = sysfs_create_group(&dev->kobj, &ili210x_attr_group);
+	error = devm_device_add_group(dev, &ili210x_attr_group);
 	if (error) {
 		dev_err(dev, "Unable to create sysfs attributes, err: %d\n",
 			error);
-		goto err_free_irq;
+		return error;
 	}
 
 	error = input_register_device(priv->input);
 	if (error) {
 		dev_err(dev, "Cannot register input device, err: %d\n", error);
-		goto err_remove_sysfs;
+		return error;
 	}
 
 	device_init_wakeup(dev, 1);
@@ -286,28 +367,6 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 		client->irq, firmware.id, firmware.major, firmware.minor);
 
 	return 0;
-
-err_remove_sysfs:
-	sysfs_remove_group(&dev->kobj, &ili210x_attr_group);
-err_free_irq:
-	free_irq(client->irq, priv);
-err_free_mem:
-	input_free_device(input);
-	kfree(priv);
-	return error;
-}
-
-static int ili210x_i2c_remove(struct i2c_client *client)
-{
-	struct ili210x *priv = i2c_get_clientdata(client);
-
-	sysfs_remove_group(&client->dev.kobj, &ili210x_attr_group);
-	free_irq(priv->client->irq, priv);
-	cancel_delayed_work_sync(&priv->dwork);
-	input_unregister_device(priv->input);
-	kfree(priv);
-
-	return 0;
 }
 
 static int __maybe_unused ili210x_i2c_suspend(struct device *dev)
@@ -334,19 +393,27 @@ static SIMPLE_DEV_PM_OPS(ili210x_i2c_pm,
 			 ili210x_i2c_suspend, ili210x_i2c_resume);
 
 static const struct i2c_device_id ili210x_i2c_id[] = {
-	{ "ili210x", 0 },
+	{ "ili210x", MODEL_ILI210X },
+	{ "ili251x", MODEL_ILI251X },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, ili210x_i2c_id);
 
+static const struct of_device_id ili210x_dt_ids[] = {
+	{ .compatible = "ilitek,ili210x", .data = (void *)MODEL_ILI210X },
+	{ .compatible = "ilitek,ili251x", .data = (void *)MODEL_ILI251X },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, ili210x_dt_ids);
+
 static struct i2c_driver ili210x_ts_driver = {
 	.driver = {
 		.name = "ili210x_i2c",
 		.pm = &ili210x_i2c_pm,
+		.of_match_table = ili210x_dt_ids,
 	},
 	.id_table = ili210x_i2c_id,
 	.probe = ili210x_i2c_probe,
-	.remove = ili210x_i2c_remove,
 };
 
 module_i2c_driver(ili210x_ts_driver);
-- 
GitLab


From ae791c9f0dacd5bb0616c3a02c99f60bbc95f025 Mon Sep 17 00:00:00 2001
From: Samuel Hsu <hsu@distec.de>
Date: Mon, 8 Apr 2019 16:49:51 +0200
Subject: [PATCH 0424/1835] Input: ili210x - add DT binding document

commit 41a852e002e65ab7a1e6841b485d72d022e95df2 upstream

Add DT binding document for the Ilitek ILI210x and ILI251x
touchscreen controllers.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 .../bindings/input/ilitek,ili2xxx.txt         | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/input/ilitek,ili2xxx.txt

diff --git a/Documentation/devicetree/bindings/input/ilitek,ili2xxx.txt b/Documentation/devicetree/bindings/input/ilitek,ili2xxx.txt
new file mode 100644
index 0000000000000..c9b1eacd34d55
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/ilitek,ili2xxx.txt
@@ -0,0 +1,26 @@
+Ilitek ILI210x/ILI251x touchscreen controller
+
+Required properties:
+- compatible:
+    ilitek,ili210x for ILI210x
+    ilitek,ili251x for ILI251x
+
+- reg: The I2C address of the device
+
+- interrupts: The sink for the touchscreen's IRQ output
+    See ../interrupt-controller/interrupts.txt
+
+Optional properties for main touchpad device:
+
+- reset-gpios: GPIO specifier for the touchscreen's reset pin (active low)
+
+Example:
+
+	touchscreen@41 {
+		compatible = "ilitek,ili251x";
+		reg = <0x41>;
+		interrupt-parent = <&gpio4>;
+		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&gpio5 21 GPIO_ACTIVE_LOW>;
+	};
+
-- 
GitLab


From a11ee65c5642f9cc3d3e819378b8229464ff3666 Mon Sep 17 00:00:00 2001
From: Samuel Hsu <hsu@distec.de>
Date: Mon, 8 Apr 2019 16:54:34 +0200
Subject: [PATCH 0425/1835] configs: Add TOUCHSCREEN_ILI210X=m

Signed-off-by: Samuel Hsu <hsu@distec.de>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index a3ac6106858c5..a35e772c588ba 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -565,6 +565,7 @@ CONFIG_TOUCHSCREEN_ADS7846=m
 CONFIG_TOUCHSCREEN_EGALAX=m
 CONFIG_TOUCHSCREEN_EXC3000=m
 CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_ILI210X=m
 CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 CONFIG_TOUCHSCREEN_RPI_FT5406=m
 CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index e30ea316c52a0..6327e983fb5ce 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -559,6 +559,7 @@ CONFIG_TOUCHSCREEN_ADS7846=m
 CONFIG_TOUCHSCREEN_EGALAX=m
 CONFIG_TOUCHSCREEN_EXC3000=m
 CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_ILI210X=m
 CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 CONFIG_TOUCHSCREEN_RPI_FT5406=m
 CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index c1ca03862d224..3f9e05c01a6b8 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -547,6 +547,7 @@ CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_TOUCHSCREEN_ADS7846=m
 CONFIG_TOUCHSCREEN_EGALAX=m
 CONFIG_TOUCHSCREEN_EKTF2127=m
+CONFIG_TOUCHSCREEN_ILI210X=m
 CONFIG_TOUCHSCREEN_RPI_FT5406=m
 CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
 CONFIG_TOUCHSCREEN_STMPE=m
-- 
GitLab


From 772d6108baa1599beb5d67cf50ea129ae20128b8 Mon Sep 17 00:00:00 2001
From: Samuel Hsu <hsu@distec.de>
Date: Mon, 8 Apr 2019 17:06:44 +0200
Subject: [PATCH 0426/1835] BCM2708: Add core Device Tree support, ilitek251x

Signed-off-by: Samuel Hsu <hsu@distec.de>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             | 11 +++++
 .../boot/dts/overlays/ilitek251x-overlay.dts  | 45 +++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/ilitek251x-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 036d49b7a52b3..c5b615401ddf3 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -67,6 +67,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	i2c0-bcm2708.dtbo \
 	i2c1-bcm2708.dtbo \
 	i2s-gpio28-31.dtbo \
+	ilitek251x.dtbo \
 	iqaudio-dac.dtbo \
 	iqaudio-dacplus.dtbo \
 	iqaudio-digi-wm8804-audio.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 089e12255eb7e..1f1fb9a3645e0 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1146,6 +1146,17 @@ Load:   dtoverlay=i2s-gpio28-31
 Params: <None>
 
 
+Name:   ilitek251x
+Info:   Enables I2C connected Ilitek 251x multiple touch controller using
+        GPIO 4 (pin 7 on GPIO header) for interrupt.
+Load:   dtoverlay=ilitek251x,<param>=<val>
+Params: interrupt               GPIO used for interrupt (default 4)
+        sizex                   Touchscreen size x, horizontal resolution of
+                                touchscreen (in pixels)
+        sizey                   Touchscreen size y, vertical resolution of
+                                touchscreen (in pixels)
+
+
 Name:   iqaudio-dac
 Info:   Configures the IQaudio DAC audio card
 Load:   dtoverlay=iqaudio-dac,<param>
diff --git a/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
new file mode 100644
index 0000000000000..fb1ccc314a290
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
@@ -0,0 +1,45 @@
+// Device tree overlay for I2C connected Ilitek multiple touch controller
+/dts-v1/;
+/plugin/;
+
+ / {
+	compatible = "brcm,bcm2708";
+
+ 	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {		
+			ili251x_pins: ili251x_pins {
+				brcm,pins = <4>; // interrupt
+				brcm,function = <0>; // in
+				brcm,pull = <2>; // pull-up //
+			};
+		};
+	};
+
+ 	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+ 			ili251x: ili251x@41 {
+				compatible = "ilitek,ili251x";
+				reg = <0x41>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&ili251x_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 8>; // high-to-low edge triggered
+				touchscreen-size-x = <16384>;
+				touchscreen-size-y = <9600>;
+			};
+		};
+	};
+
+ 	__overrides__ {
+		interrupt = <&ili251x_pins>,"brcm,pins:0",
+			<&ili251x>,"interrupts:0";
+		sizex = <&ili251x>,"touchscreen-size-x:0";
+		sizey = <&ili251x>,"touchscreen-size-y:0";
+	};
+};
-- 
GitLab


From 3ea9af8bc4eaac0cca72d603ed081973bce91bcf Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Tue, 9 Apr 2019 16:40:48 +0100
Subject: [PATCH 0427/1835] dwc_otg: fix locking around dequeueing and killing
 URBs

kill_urbs_in_qh_list() is practically only ever called with the fiq lock
already held, so don't spinlock twice in the case where we need to cancel
an isochronous transfer.

Also fix up a case where the global interrupt register could be read with
the fiq lock not held.

Fixes the deadlock seen in https://github.com/raspberrypi/linux/issues/2907
---
 drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c | 9 +++++++--
 drivers/usb/host/dwc_otg/dwc_otg_hcd.c      | 4 ----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
index 9fb7229f43ae4..799ab14b9edad 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
@@ -1344,16 +1344,21 @@ static inline uint32_t dwc_otg_read_common_intr(dwc_otg_core_if_t * core_if, gin
 		 */
 		gintmsk_common.b.portintr = 1;
 	}
-	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
-	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
 	if(fiq_enable) {
 		local_fiq_disable();
+		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+		gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
 		/* Pull in the interrupts that the FIQ has masked */
 		gintmsk.d32 |= ~(hcd->fiq_state->gintmsk_saved.d32);
 		gintmsk.d32 |= gintmsk_common.d32;
 		/* for the upstairs function to reenable - have to read it here in case FIQ triggers again */
 		reenable_gintmsk->d32 = gintmsk.d32;
+		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
 		local_fiq_enable();
+	} else {
+		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+		gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
 	}
 
 	gahbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
index 855afd2e93956..cdfb9a6b7c597 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -195,15 +195,11 @@ static void kill_urbs_in_qh_list(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
 			 * but not yet been through the IRQ handler.
 			 */
 			if (fiq_fsm_enable && (hcd->fiq_state->channel[qh->channel->hc_num].fsm != FIQ_PASSTHROUGH)) {
-				local_fiq_disable();
-				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
 				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
 				qh->channel->halt_pending = 1;
 				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
 					hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
 					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
-				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
-				local_fiq_enable();
 			} else {
 				dwc_otg_hc_halt(hcd->core_if, qh->channel,
 						DWC_OTG_HC_XFER_URB_DEQUEUE);
-- 
GitLab


From e0ebe930e2c7d90503ce2544e416471c1de000df Mon Sep 17 00:00:00 2001
From: Phil Howard <phil@gadgetoid.com>
Date: Fri, 29 Mar 2019 10:53:14 +0000
Subject: [PATCH 0428/1835] rtc: rv3028: Add backup switchover mode support

Signed-off-by: Phil Howard <phil@pimoroni.com>
---
 drivers/rtc/rtc-rv3028.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/rtc/rtc-rv3028.c b/drivers/rtc/rtc-rv3028.c
index d04c2d4816555..b69d8e6408aae 100644
--- a/drivers/rtc/rtc-rv3028.c
+++ b/drivers/rtc/rtc-rv3028.c
@@ -74,6 +74,7 @@
 
 #define RV3028_BACKUP_TCE		BIT(5)
 #define RV3028_BACKUP_TCR_MASK		GENMASK(1,0)
+#define RV3028_BACKUP_BSM_MASK		0x0C
 
 #define OFFSET_STEP_PPT			953674
 
@@ -601,6 +602,7 @@ static int rv3028_probe(struct i2c_client *client)
 	struct rv3028_data *rv3028;
 	int ret, status;
 	u32 ohms;
+	u8 bsm;
 	struct nvmem_config nvmem_cfg = {
 		.name = "rv3028_nvram",
 		.word_size = 1,
@@ -671,6 +673,21 @@ static int rv3028_probe(struct i2c_client *client)
 	if (ret)
 		return ret;
 
+	/* setup backup switchover mode */
+	if (!device_property_read_u8(&client->dev, "backup-switchover-mode",
+				     &bsm))  {
+		if (bsm <= 3) {
+			ret = regmap_update_bits(rv3028->regmap, RV3028_BACKUP,
+				RV3028_BACKUP_BSM_MASK,
+				(bsm & 0x03) << 2);
+
+			if (ret)
+				return ret;
+		} else {
+			dev_warn(&client->dev, "invalid backup switchover mode value\n");
+		}
+	}
+
 	/* setup trickle charger */
 	if (!device_property_read_u32(&client->dev, "trickle-resistor-ohms",
 				      &ohms)) {
-- 
GitLab


From 8a904eb702ff400dd50f06961bfc5a7e386a7288 Mon Sep 17 00:00:00 2001
From: Phil Howard <phil@gadgetoid.com>
Date: Fri, 29 Mar 2019 10:57:07 +0000
Subject: [PATCH 0429/1835] dt-bindings: rv3028 backup switchover support

Signed-off-by: Phil Howard <phil@pimoroni.com>
---
 Documentation/devicetree/bindings/rtc/rtc.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/rtc/rtc.txt b/Documentation/devicetree/bindings/rtc/rtc.txt
index 3e6a215e7304b..33fcad8754ec2 100644
--- a/Documentation/devicetree/bindings/rtc/rtc.txt
+++ b/Documentation/devicetree/bindings/rtc/rtc.txt
@@ -26,6 +26,7 @@ below.
 - trickle-diode-disable :   Do not use internal trickle charger diode Should be
                             given if internal trickle charger diode should be
                             disabled
+- backup-switchover-mode :  Configure RTC backup power supply switch behaviour
 - wakeup-source :           Enables wake up of host system on alarm
 - quartz-load-femtofarads : The capacitive load of the quartz(x-tal),
                             expressed in femto Farad (fF).
-- 
GitLab


From fcc44ff9f8fe3cab2c6e707b01a2f2e38186ddd7 Mon Sep 17 00:00:00 2001
From: Phil Howard <phil@gadgetoid.com>
Date: Fri, 29 Mar 2019 10:59:55 +0000
Subject: [PATCH 0430/1835] overlays: Add rv3028 backup switchover support to
 i2c-rtc

Signed-off-by: Phil Howard <phil@pimoroni.com>
---
 arch/arm/boot/dts/overlays/README              | 3 +++
 arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts | 1 +
 2 files changed, 4 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 1f1fb9a3645e0..2e5094b2cd96b 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1013,6 +1013,9 @@ Params: abx80x                  Select one of the ABx80x family:
         wakeup-source           Specify that the RTC can be used as a wakeup
                                 source
 
+        backup-switchover-mode  Backup power supply switch mode. Must be 0 for
+                                off or 1 for Vdd < VBackup (RV3028 only)
+
 
 Name:   i2c-rtc-gpio
 Info:   Adds support for a number of I2C Real Time Clock devices
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
index 55f443d23aee3..ad09fe122ad2a 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -200,6 +200,7 @@
 		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
 					<&abx80x>,"abracon,tc-resistor",
 					<&rv3028>,"trickle-resistor-ohms:0";
+		backup-switchover-mode = <&rv3028>,"backup-switchover-mode:0";
 		wakeup-source = <&ds1339>,"wakeup-source?",
 				<&ds3231>,"wakeup-source?",
 				<&mcp7940x>,"wakeup-source?",
-- 
GitLab


From 5e61f7b8af3052ff4d95734aa25fa659ec1fa29a Mon Sep 17 00:00:00 2001
From: wavelet2 <20504977+wavelet2@users.noreply.github.com>
Date: Mon, 15 Apr 2019 10:00:20 +0100
Subject: [PATCH 0431/1835] Maxim MAX98357A I2S DAC overlay (#2935)

Add overlay for Maxim MAX98357A I2S DAC.

Signed-off-by: Richard Steedman <richard.steedman@gmail.com>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  9 ++
 .../boot/dts/overlays/max98357a-overlay.dts   | 84 +++++++++++++++++++
 3 files changed, 94 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/max98357a-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index c5b615401ddf3..36c588baddb22 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -75,6 +75,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	justboom-dac.dtbo \
 	justboom-digi.dtbo \
 	ltc294x.dtbo \
+	max98357a.dtbo \
 	mbed-dac.dtbo \
 	mcp23017.dtbo \
 	mcp23s17.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 2e5094b2cd96b..8962dd0d93431 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1276,6 +1276,15 @@ Params: ltc2941                 Select the ltc2941 device
                                 See the datasheet for more information.
 
 
+Name:   max98357a
+Info:   Configures the Maxim MAX98357A I2S DAC
+Load:   dtoverlay=max98357a,<param>=<val>
+Params: no-sdmode               Driver does not manage the state of the DAC's
+                                SD_MODE pin (i.e. chip is always on).
+        sdmode-pin              integer, GPIO pin connected to the SD_MODE input
+                                of the DAC (default GPIO4 if parameter omitted).
+
+
 Name:   mbed-dac
 Info:   Configures the mbed AudioCODEC (TLV320AIC23B)
 Load:   dtoverlay=mbed-dac
diff --git a/arch/arm/boot/dts/overlays/max98357a-overlay.dts b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
new file mode 100644
index 0000000000000..ed3960fb83429
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
@@ -0,0 +1,84 @@
+// Overlay for Maxim MAX98357A audio DAC
+
+// dtparams:
+//     no-sdmode  - SD_MODE pin not managed by driver.
+//     sdmode-pin - Specify GPIO pin to which SD_MODE is connected (default 4).
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	/* Enable I2S */
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	/* DAC whose SD_MODE pin is managed by driver (via GPIO pin) */
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			max98357a_dac: max98357a {
+				compatible = "maxim,max98357a";
+				#sound-dai-cells = <0>;
+				sdmode-gpios = <&gpio 4 0>;   /* 2nd word overwritten by sdmode-pin parameter */
+				status = "okay";
+			};
+		};
+	};
+
+	/* DAC whose SD_MODE pin is not managed by driver */
+	fragment@2 {
+		target-path = "/";
+		__dormant__ {
+			max98357a_nsd: max98357a {
+				compatible = "maxim,max98357a";
+				#sound-dai-cells = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	/* Soundcard connecting I2S to DAC with SD_MODE */
+	fragment@3 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "simple-audio-card";
+			simple-audio-card,format = "i2s";
+			simple-audio-card,name = "MAX98357A";
+			status = "okay";
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+			};
+			simple-audio-card,codec {
+				sound-dai = <&max98357a_dac>;
+			};
+		};
+	};
+
+	/* Soundcard connecting I2S to DAC without SD_MODE */
+	fragment@4 {
+		target = <&sound>;
+		__dormant__ {
+			compatible = "simple-audio-card";
+			simple-audio-card,format = "i2s";
+			simple-audio-card,name = "MAX98357A";
+			status = "okay";
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+			};
+			simple-audio-card,codec {
+				sound-dai = <&max98357a_nsd>;
+			};
+		};
+	};
+
+	__overrides__ {
+		no-sdmode  = <0>,"-1+2-3+4";
+		sdmode-pin = <&max98357a_dac>,"sdmode-gpios:4";
+	};
+};
-- 
GitLab


From 734611369e69837b76af90380b027455a8bb771f Mon Sep 17 00:00:00 2001
From: James Hutchinson <jahutchinson99@googlemail.com>
Date: Sun, 13 Jan 2019 16:13:47 -0500
Subject: [PATCH 0432/1835] media: m88ds3103: serialize reset messages in
 m88ds3103_set_frontend

commit 981fbe3da20a6f35f17977453bce7dfc1664d74f upstream.

Ref: https://bugzilla.kernel.org/show_bug.cgi?id=199323

Users are experiencing problems with the DVBSky S960/S960C USB devices
since the following commit:

9d659ae: ("locking/mutex: Add lock handoff to avoid starvation")

The device malfunctions after running for an indeterminable period of
time, and the problem can only be cleared by rebooting the machine.

It is possible to encourage the problem to surface by blocking the
signal to the LNB.

Further debugging revealed the cause of the problem.

In the following capture:
- thread #1325 is running m88ds3103_set_frontend
- thread #42 is running ts2020_stat_work

a> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 80
   [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 08
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 68 3f
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 08 ff
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 3d
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff
b> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 00
   [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 21
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07
   [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 66
   [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff
   [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
   [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07
   [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 60 02 10 0b
   [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07

Two i2c messages are sent to perform a reset in m88ds3103_set_frontend:

  a. 0x07, 0x80
  b. 0x07, 0x00

However, as shown in the capture, the regmap mutex is being handed over
to another thread (ts2020_stat_work) in between these two messages.

>From here, the device responds to every i2c message with an 07 message,
and will only return to normal operation following a power cycle.

Use regmap_multi_reg_write to group the two reset messages, ensuring
both are processed before the regmap mutex is unlocked.

Signed-off-by: James Hutchinson <jahutchinson99@googlemail.com>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
---
 drivers/media/dvb-frontends/m88ds3103.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
index dffd2d4bf1c8b..c25c927974089 100644
--- a/drivers/media/dvb-frontends/m88ds3103.c
+++ b/drivers/media/dvb-frontends/m88ds3103.c
@@ -309,6 +309,9 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
 	u16 u16tmp;
 	u32 tuner_frequency_khz, target_mclk;
 	s32 s32tmp;
+	static const struct reg_sequence reset_buf[] = {
+		{0x07, 0x80}, {0x07, 0x00}
+	};
 
 	dev_dbg(&client->dev,
 		"delivery_system=%d modulation=%d frequency=%u symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n",
@@ -321,11 +324,7 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
 	}
 
 	/* reset */
-	ret = regmap_write(dev->regmap, 0x07, 0x80);
-	if (ret)
-		goto err;
-
-	ret = regmap_write(dev->regmap, 0x07, 0x00);
+	ret = regmap_multi_reg_write(dev->regmap, reset_buf, 2);
 	if (ret)
 		goto err;
 
-- 
GitLab


From 784c57315226e117147ed32951d23a70532ea72a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 21 Mar 2019 11:19:46 +0000
Subject: [PATCH 0433/1835] sound: Fixes for audioinjector-octo under 4.19

1. Move the DT alias declaration to the I2C shim in the cases
where the shim is enabled. This works around a problem caused by a
4.19 commit [1] that generates DT/OF uevents for I2C drivers.

2. Fix the diagnostics in an error path of the soundcard driver to
correctly identify the reason for the failure to load.

3. Move the declaration of the clock node in the overlay outside
the I2C node to avoid warnings.

4. Sort the overlay nodes so that dependencies are only to earlier
fragments, in an attempt to get runtime dtoverlay application to
work (it still doesn't...)

See: https://github.com/Audio-Injector/Octo/issues/14
Signed-off-by: Phil Elwell <phil@raspberrypi.org>

[1] af503716ac14 ("i2c: core: report OF style module alias for devices registered via OF")
---
 .../overlays/audioinjector-addons-overlay.dts | 19 ++++++++++++-------
 sound/soc/bcm/audioinjector-octo-soundcard.c  |  2 +-
 sound/soc/codecs/cs42xx8-i2c.c                |  7 +++++++
 sound/soc/codecs/cs42xx8.c                    |  2 ++
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
index cedbf5ecdbcd0..6d192af10da9c 100644
--- a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
@@ -13,6 +13,17 @@
 	};
 
 	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			cs42448_mclk: codec-mclk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <49152000>;
+			};
+		};
+	};
+
+	fragment@2 {
 		target = <&i2c1>;
 		__overlay__ {
 			#address-cells = <1>;
@@ -27,16 +38,10 @@
 				clock-names = "mclk";
 				status = "okay";
 			};
-
-			cs42448_mclk: codec-mclk {
-				compatible = "fixed-clock";
-				#clock-cells = <0>;
-				clock-frequency = <49152000>;
-			};
 		};
 	};
 
-	fragment@2 {
+	fragment@3 {
 		target = <&sound>;
 		snd: __overlay__ {
 			compatible = "ai,audioinjector-octo-soundcard";
diff --git a/sound/soc/bcm/audioinjector-octo-soundcard.c b/sound/soc/bcm/audioinjector-octo-soundcard.c
index 6029a12d77cc0..550ef25eed104 100644
--- a/sound/soc/bcm/audioinjector-octo-soundcard.c
+++ b/sound/soc/bcm/audioinjector-octo-soundcard.c
@@ -297,7 +297,7 @@ static int audioinjector_octo_probe(struct platform_device *pdev)
 			dai->codec_name = NULL;
 			dai->codec_of_node = codec_node;
 		} else
-			if (!dai->cpu_of_node) {
+			if (!i2s_node) {
 				dev_err(&pdev->dev,
 				"i2s-controller missing or invalid in DT\n");
 				return -EINVAL;
diff --git a/sound/soc/codecs/cs42xx8-i2c.c b/sound/soc/codecs/cs42xx8-i2c.c
index 0214e3ab9da00..a4586ea4acf6e 100644
--- a/sound/soc/codecs/cs42xx8-i2c.c
+++ b/sound/soc/codecs/cs42xx8-i2c.c
@@ -45,6 +45,13 @@ static struct i2c_device_id cs42xx8_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, cs42xx8_i2c_id);
 
+const struct of_device_id cs42xx8_of_match[] = {
+	{ .compatible = "cirrus,cs42448", .data = &cs42448_data, },
+	{ .compatible = "cirrus,cs42888", .data = &cs42888_data, },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, cs42xx8_of_match);
+
 static struct i2c_driver cs42xx8_i2c_driver = {
 	.driver = {
 		.name = "cs42xx8",
diff --git a/sound/soc/codecs/cs42xx8.c b/sound/soc/codecs/cs42xx8.c
index ebb9e0cf83647..42677c630f23c 100644
--- a/sound/soc/codecs/cs42xx8.c
+++ b/sound/soc/codecs/cs42xx8.c
@@ -436,8 +436,10 @@ const struct of_device_id cs42xx8_of_match[] = {
 	{ .compatible = "cirrus,cs42888", .data = &cs42888_data, },
 	{ /* sentinel */ }
 };
+#if !IS_ENABLED(CONFIG_SND_SOC_CS42XX8_I2C)
 MODULE_DEVICE_TABLE(of, cs42xx8_of_match);
 EXPORT_SYMBOL_GPL(cs42xx8_of_match);
+#endif
 
 int cs42xx8_probe(struct device *dev, struct regmap *regmap)
 {
-- 
GitLab


From 290b3f98e43fc77c40f49bb7e28b7fc06417a616 Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Wed, 24 Apr 2019 14:25:09 +0100
Subject: [PATCH 0434/1835] Revert "cgroup: Disable cgroup "memory" by default"

This reverts commit cd6ce4d0ded13c94ff5208c679ed5e030263149b.
---
 kernel/cgroup/cgroup.c | 30 ------------------------------
 1 file changed, 30 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 3beaab75b0810..63dae7e0ccae7 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5290,8 +5290,6 @@ int __init cgroup_init_early(void)
 }
 
 static u16 cgroup_disable_mask __initdata;
-static u16 cgroup_enable_mask __initdata;
-static int __init cgroup_disable(char *str);
 
 /**
  * cgroup_init - cgroup initialization
@@ -5332,12 +5330,6 @@ int __init cgroup_init(void)
 
 	mutex_unlock(&cgroup_mutex);
 
-	/* Apply an implicit disable... */
-	cgroup_disable("memory");
-
-	/* ...knowing that an explicit enable will override it. */
-	cgroup_disable_mask &= ~cgroup_enable_mask;
-
 	for_each_subsys(ss, ssid) {
 		if (ss->early_init) {
 			struct cgroup_subsys_state *css =
@@ -5721,28 +5713,6 @@ static int __init cgroup_disable(char *str)
 }
 __setup("cgroup_disable=", cgroup_disable);
 
-static int __init cgroup_enable(char *str)
-{
-	struct cgroup_subsys *ss;
-	char *token;
-	int i;
-
-	while ((token = strsep(&str, ",")) != NULL) {
-		if (!*token)
-			continue;
-
-		for_each_subsys(ss, i) {
-			if (strcmp(token, ss->name) &&
-			    strcmp(token, ss->legacy_name))
-				continue;
-
-			cgroup_enable_mask |= 1 << i;
-		}
-	}
-	return 1;
-}
-__setup("cgroup_enable=", cgroup_enable);
-
 /**
  * css_tryget_online_from_dir - get corresponding css from a cgroup dentry
  * @dentry: directory dentry of interest
-- 
GitLab


From c063f868f983fbf95c388e762b4f46e012912f8b Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Wed, 24 Apr 2019 14:25:41 +0100
Subject: [PATCH 0435/1835] Revert "defconfigs: disable memory and IO cgroups
 (#2908)"

This reverts commit 9881cdbf446081f71c62f39f4c56a21001baea73.
---
 arch/arm/configs/bcm2709_defconfig   | 4 ++++
 arch/arm/configs/bcmrpi_defconfig    | 4 ++++
 arch/arm64/configs/bcmrpi3_defconfig | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index a35e772c588ba..2c44bc558742e 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -14,6 +14,8 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
@@ -62,8 +64,10 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=m
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 6327e983fb5ce..9d8f5d6bafdb2 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -13,6 +13,8 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
@@ -56,8 +58,10 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=m
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 3f9e05c01a6b8..8f42fb499f2dc 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -13,6 +13,8 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
@@ -60,8 +62,10 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=y
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
-- 
GitLab


From 03cd93cb6b3a43b964e97bdfc99477a784324c85 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Mon, 29 Apr 2019 19:35:33 +0200
Subject: [PATCH 0436/1835] overlays: Add PiGlow overlay

The PiGlow is a small add-on board for the Raspberry Pi that provides
18 individually controllable LEDs (SN3218) and uses the following pins:

P1 & P17 (3V3)
P2 (5V)
P3 (SDA)
P5 (SCL)
P14 (GND)

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  6 ++
 arch/arm/boot/dts/overlays/piglow-overlay.dts | 97 +++++++++++++++++++
 3 files changed, 104 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/piglow-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 36c588baddb22..87fd56756b1e7 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -97,6 +97,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	pi3-disable-wifi.dtbo \
 	pi3-miniuart-bt.dtbo \
 	pibell.dtbo \
+	piglow.dtbo \
 	piscreen.dtbo \
 	piscreen2r.dtbo \
 	pisound.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 8962dd0d93431..e5e219d6190c9 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1532,6 +1532,12 @@ Params: alsaname                Set the name as it appears in ALSA (default
                                 "PiBell")
 
 
+Name:   piglow
+Info:   Configures the PiGlow by pimoroni.com
+Load:   dtoverlay=piglow
+Params: <None>
+
+
 Name:   piscreen
 Info:   PiScreen display by OzzMaker.com
 Load:   dtoverlay=piscreen,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/piglow-overlay.dts b/arch/arm/boot/dts/overlays/piglow-overlay.dts
new file mode 100644
index 0000000000000..e66e47ae83b20
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/piglow-overlay.dts
@@ -0,0 +1,97 @@
+// Definitions for SN3218 LED driver from Si-En Technology on PiGlow
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sn3218@54 {
+				compatible = "si-en,sn3218";
+				reg = <0x54>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				status = "okay";
+
+				led@1 {
+					reg = <1>;
+					label = "piglow:red:led1";
+				};
+				led@2 {
+					reg = <2>;
+					label = "piglow:orange:led2";
+				};
+				led@3 {
+					reg = <3>;
+					label = "piglow:yellow:led3";
+				};
+				led@4 {
+					reg = <4>;
+					label = "piglow:green:led4";
+				};
+				led@5 {
+					reg = <5>;
+					label = "piglow:blue:led5";
+				};
+				led@6 {
+					reg = <6>;
+					label = "piglow:green:led6";
+				};
+				led@7 {
+					reg = <7>;
+					label = "piglow:red:led7";
+				};
+				led@8 {
+					reg = <8>;
+					label = "piglow:orange:led8";
+				};
+				led@9 {
+					reg = <9>;
+					label = "piglow:yellow:led9";
+				};
+				led@10 {
+					reg = <10>;
+					label = "piglow:white:led10";
+				};
+				led@11 {
+					reg = <11>;
+					label = "piglow:white:led11";
+				};
+				led@12 {
+					reg = <12>;
+					label = "piglow:blue:led12";
+				};
+				led@13 {
+					reg = <13>;
+					label = "piglow:white:led13";
+				};
+				led@14 {
+					reg = <14>;
+					label = "piglow:green:led14";
+				};
+				led@15 {
+					reg = <15>;
+					label = "piglow:blue:led15";
+				};
+				led@16 {
+					reg = <16>;
+					label = "piglow:yellow:led16";
+				};
+				led@17 {
+					reg = <17>;
+					label = "piglow:orange:led17";
+				};
+				led@18 {
+					reg = <18>;
+					label = "piglow:red:led18";
+				};
+			};
+		};
+	};
+};
-- 
GitLab


From 20fdf29a031536dffa5a6ad9c6e76fc73ced342a Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Mon, 29 Apr 2019 19:28:51 +0200
Subject: [PATCH 0437/1835] configs: enable LED driver for PiGlow

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 3 ++-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 2c44bc558742e..efb4c947293a0 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1131,6 +1131,7 @@ CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PCA963X=m
+CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 9d8f5d6bafdb2..af54579699ecf 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1124,6 +1124,7 @@ CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PCA963X=m
+CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 8f42fb499f2dc..fca85f7f75894 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -550,8 +550,8 @@ CONFIG_JOYSTICK_RPISENSE=m
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_TOUCHSCREEN_ADS7846=m
 CONFIG_TOUCHSCREEN_EGALAX=m
-CONFIG_TOUCHSCREEN_EKTF2127=m
 CONFIG_TOUCHSCREEN_ILI210X=m
+CONFIG_TOUCHSCREEN_EKTF2127=m
 CONFIG_TOUCHSCREEN_RPI_FT5406=m
 CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
 CONFIG_TOUCHSCREEN_STMPE=m
@@ -991,6 +991,7 @@ CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PCA963X=m
+CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-- 
GitLab


From 73e6143970ef4fd235a74fa7535ad8b028f69d2e Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 29 Apr 2019 19:16:14 +0100
Subject: [PATCH 0438/1835] Revert "bcm2835: interpolate audio delay"

commit fb4b9f02986fcb5ae751106ef9b027806b5dd750 upstream.

This reverts commit fb8cc99f05687ca5565dc53a7ee0dd86aefad952.
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c        | 12 +-----------
 .../staging/vc04_services/bcm2835-audio/bcm2835.h    |  1 -
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 4532a5128560b..8359cf881bef5 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -11,7 +11,7 @@
 /* hardware definition */
 static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 	.info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
-	SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_BATCH),
+	SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID),
 	.formats = SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
 	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min = 8000,
@@ -81,8 +81,6 @@ void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream)
 		alsa_stream->pos %= alsa_stream->buffer_size;
 	}
 
-	alsa_stream->interpolate_start = ktime_get_ns();
-
 	if (alsa_stream->substream) {
 		if (new_period)
 			snd_pcm_period_elapsed(alsa_stream->substream);
@@ -308,7 +306,6 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	alsa_stream->buffer_size = snd_pcm_lib_buffer_bytes(substream);
 	alsa_stream->period_size = snd_pcm_lib_period_bytes(substream);
 	alsa_stream->pos = 0;
-	alsa_stream->interpolate_start = ktime_get_ns();
 
 	audio_debug("buffer_size=%d, period_size=%d pos=%d frame_bits=%d\n",
 		alsa_stream->buffer_size, alsa_stream->period_size,
@@ -400,19 +397,12 @@ snd_bcm2835_pcm_pointer(struct snd_pcm_substream *substream)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
-	u64 now = ktime_get_ns();
 
 	audio_debug("pcm_pointer... (%d) hwptr=%d appl=%d pos=%d\n", 0,
 		frames_to_bytes(runtime, runtime->status->hw_ptr),
 		frames_to_bytes(runtime, runtime->control->appl_ptr),
 		alsa_stream->pos);
 
-	/* Give userspace better delay reporting by interpolating between GPU
-	 * notifications, assuming audio speed is close enough to the clock
-	 * used for ktime */
-	if (alsa_stream->interpolate_start && alsa_stream->interpolate_start < now)
-		runtime->delay = -(int)div_u64((now - alsa_stream->interpolate_start) * runtime->rate,  1000000000);
-
 	return snd_pcm_indirect_playback_pointer(substream,
 		&alsa_stream->pcm_indirect,
 		alsa_stream->pos);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index f44b04930a8fe..5dc427240a1d7 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -133,7 +133,6 @@ struct bcm2835_alsa_stream {
 	unsigned int pos;
 	unsigned int buffer_size;
 	unsigned int period_size;
-	u64 interpolate_start;
 
 	atomic_t retrieved;
 	struct bcm2835_audio_instance *instance;
-- 
GitLab


From 660ca561929ab25168c7f7562130436fa06e947d Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 29 Apr 2019 19:16:15 +0100
Subject: [PATCH 0439/1835] Revert "staging: bcm2835-audio: Enable compile
 test"

commit 4eae66777a262ac9707980ea0cfe902afadfb577 upstream.

This reverts commit 02d205a57c4c943fc2a5b1ac7c912ce01944f700.
---
 drivers/staging/vc04_services/bcm2835-audio/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/Kconfig b/drivers/staging/vc04_services/bcm2835-audio/Kconfig
index 62c1c8ba4ad44..9f536533c2576 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/Kconfig
+++ b/drivers/staging/vc04_services/bcm2835-audio/Kconfig
@@ -1,6 +1,6 @@
 config SND_BCM2835
         tristate "BCM2835 Audio"
-        depends on (ARCH_BCM2835 || COMPILE_TEST) && SND
+        depends on ARCH_BCM2835 && SND
         select SND_PCM
         select BCM2835_VCHIQ
         help
-- 
GitLab


From ede222d35f812245e29967c37754421bddcd44e5 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 29 Apr 2019 19:16:16 +0100
Subject: [PATCH 0440/1835] Revert "staging: bcm2835-audio: use
 module_platform_driver() macro"

commit ed4c2e5dc4216d5dded502bfcf594d3984e6bccd upstream.

This reverts commit 786ced30fec053b27248ed5b24dcde61ed3f47f6.
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index b8e148ade6f64..da0fa34501fad 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -470,7 +470,25 @@ static struct platform_driver bcm2835_alsa0_driver = {
 		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
-module_platform_driver(bcm2835_alsa0_driver);
+
+static int bcm2835_alsa_device_init(void)
+{
+	int retval;
+
+	retval = platform_driver_register(&bcm2835_alsa0_driver);
+	if (retval)
+		pr_err("Error registering bcm2835_audio driver %d .\n", retval);
+
+	return retval;
+}
+
+static void bcm2835_alsa_device_exit(void)
+{
+	platform_driver_unregister(&bcm2835_alsa0_driver);
+}
+
+late_initcall(bcm2835_alsa_device_init);
+module_exit(bcm2835_alsa_device_exit);
 
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
-- 
GitLab


From bd2855573c333041c9ba7a94b378504c82e8e916 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:30 +0200
Subject: [PATCH 0441/1835] staging: bcm2835-audio: Clean up mutex locks

commit ce4bb1aa271a97047b80ac917a5d91b54925913b upstream.

snd-bcm2835 driver takes the lock with mutex_lock_interruptible() in
all places, which don't make sense.  Replace them with the simple
mutex_lock().

Also taking a mutex lock right after creating it for each PCM object
is nonsense, too.  It cannot be racy at that point.  We can get rid of
it.

Last but not least, initializing chip->audio_mutex at each place is
error-prone.  Initialize properly at creating the chip object in
snd_bcm2835_create() instead.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-ctl.c | 18 +++----
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c | 33 ++-----------
 .../bcm2835-audio/bcm2835-vchiq.c             | 47 ++++---------------
 .../vc04_services/bcm2835-audio/bcm2835.c     |  1 +
 4 files changed, 20 insertions(+), 79 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
index ec468d5719b11..04ea3ec7f64fd 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
@@ -77,8 +77,7 @@ static int snd_bcm2835_ctl_get(struct snd_kcontrol *kcontrol,
 {
 	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	BUG_ON(!chip && !(chip->avail_substreams & AVAIL_SUBSTREAMS_MASK));
 
@@ -99,8 +98,7 @@ static int snd_bcm2835_ctl_put(struct snd_kcontrol *kcontrol,
 	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
 	int changed = 0;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	if (kcontrol->private_value == PCM_PLAYBACK_VOLUME) {
 		audio_info("Volume change attempted.. volume = %d new_volume = %d\n", chip->volume, (int)ucontrol->value.integer.value[0]);
@@ -187,8 +185,7 @@ static int snd_bcm2835_spdif_default_get(struct snd_kcontrol *kcontrol,
 	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
 	int i;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	for (i = 0; i < 4; i++)
 		ucontrol->value.iec958.status[i] =
@@ -205,8 +202,7 @@ static int snd_bcm2835_spdif_default_put(struct snd_kcontrol *kcontrol,
 	unsigned int val = 0;
 	int i, change;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	for (i = 0; i < 4; i++)
 		val |= (unsigned int)ucontrol->value.iec958.status[i] << (i * 8);
@@ -251,8 +247,7 @@ static int snd_bcm2835_spdif_stream_get(struct snd_kcontrol *kcontrol,
 	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
 	int i;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	for (i = 0; i < 4; i++)
 		ucontrol->value.iec958.status[i] =
@@ -269,8 +264,7 @@ static int snd_bcm2835_spdif_stream_put(struct snd_kcontrol *kcontrol,
 	unsigned int val = 0;
 	int i, change;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	for (i = 0; i < 4; i++)
 		val |= (unsigned int)ucontrol->value.iec958.status[i] << (i * 8);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 8359cf881bef5..f2d8b17d0cfe0 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -99,10 +99,7 @@ static int snd_bcm2835_playback_open_generic(
 	int idx;
 	int err;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex)) {
-		audio_error("Interrupted whilst waiting for lock\n");
-		return -EINTR;
-	}
+	mutex_lock(&chip->audio_mutex);
 	audio_info("Alsa open (%d)\n", substream->number);
 	idx = substream->number;
 
@@ -194,10 +191,7 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 	struct bcm2835_alsa_stream *alsa_stream;
 
 	chip = snd_pcm_substream_chip(substream);
-	if (mutex_lock_interruptible(&chip->audio_mutex)) {
-		audio_error("Interrupted whilst waiting for lock\n");
-		return -EINTR;
-	}
+	mutex_lock(&chip->audio_mutex);
 	runtime = substream->runtime;
 	alsa_stream = runtime->private_data;
 
@@ -274,8 +268,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	int channels;
 	int err;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex))
-		return -EINTR;
+	mutex_lock(&chip->audio_mutex);
 
 	/* notify the vchiq that it should enter spdif passthrough mode by
 	 * setting channels=0 (see
@@ -449,14 +442,9 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels)
 	struct snd_pcm *pcm;
 	int err;
 
-	mutex_init(&chip->audio_mutex);
-	if (mutex_lock_interruptible(&chip->audio_mutex)) {
-		audio_error("Interrupted whilst waiting for lock\n");
-		return -EINTR;
-	}
 	err = snd_pcm_new(chip->card, "bcm2835 ALSA", 0, numchannels, 0, &pcm);
 	if (err < 0)
-		goto out;
+		return err;
 	pcm->private_data = chip;
 	strcpy(pcm->name, "bcm2835 ALSA");
 	chip->pcm = pcm;
@@ -474,9 +462,6 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels)
 					      snd_bcm2835_playback_hw.buffer_bytes_max,
 					      snd_bcm2835_playback_hw.buffer_bytes_max);
 
-out:
-	mutex_unlock(&chip->audio_mutex);
-
 	return 0;
 }
 
@@ -485,13 +470,9 @@ int snd_bcm2835_new_spdif_pcm(struct bcm2835_chip *chip)
 	struct snd_pcm *pcm;
 	int err;
 
-	if (mutex_lock_interruptible(&chip->audio_mutex)) {
-		audio_error("Interrupted whilst waiting for lock\n");
-		return -EINTR;
-	}
 	err = snd_pcm_new(chip->card, "bcm2835 ALSA", 1, 1, 0, &pcm);
 	if (err < 0)
-		goto out;
+		return err;
 
 	pcm->private_data = chip;
 	strcpy(pcm->name, "bcm2835 IEC958/HDMI");
@@ -504,8 +485,6 @@ int snd_bcm2835_new_spdif_pcm(struct bcm2835_chip *chip)
 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_CONTINUOUS,
 		snd_dma_continuous_data(GFP_KERNEL),
 		snd_bcm2835_playback_spdif_hw.buffer_bytes_max, snd_bcm2835_playback_spdif_hw.buffer_bytes_max);
-out:
-	mutex_unlock(&chip->audio_mutex);
 
 	return 0;
 }
@@ -518,8 +497,6 @@ int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
 	struct snd_pcm *pcm;
 	int err;
 
-	mutex_init(&chip->audio_mutex);
-
 	err = snd_pcm_new(chip->card, name, 0, numchannels,
 			  0, &pcm);
 	if (err)
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 868e2d6aaf1bc..bec361aff4fe8 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -319,11 +319,7 @@ static int vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
 	}
 
 	LOG_DBG(" .. about to lock (%d)\n", instance->num_connections);
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n",
-			instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 
 	/* Close all VCHI service connections */
 	for (i = 0; i < instance->num_connections; i++) {
@@ -434,11 +430,7 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 	instance = alsa_stream->instance;
 	LOG_DBG(" instance (%p)\n", instance);
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n", instance->num_connections);
-		ret = -EINTR;
-		goto free_wq;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	m.type = VC_AUDIO_MSG_TYPE_OPEN;
@@ -479,11 +471,7 @@ static int bcm2835_audio_set_ctls_chan(struct bcm2835_alsa_stream *alsa_stream,
 	LOG_INFO(" Setting ALSA dest(%d), volume(%d)\n",
 		 chip->dest, chip->volume);
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n",
-			instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	instance->result = -1;
@@ -569,10 +557,7 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 		return -EINVAL;
 	}
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n", instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	instance->result = -1;
@@ -629,11 +614,7 @@ static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream)
 	int status;
 	int ret;
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n",
-			instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	m.type = VC_AUDIO_MSG_TYPE_START;
@@ -665,11 +646,7 @@ static int bcm2835_audio_stop_worker(struct bcm2835_alsa_stream *alsa_stream)
 	int status;
 	int ret;
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n",
-			instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	m.type = VC_AUDIO_MSG_TYPE_STOP;
@@ -704,11 +681,7 @@ int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream)
 
 	my_workqueue_quit(alsa_stream);
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n",
-			instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	m.type = VC_AUDIO_MSG_TYPE_CLOSE;
@@ -761,11 +734,7 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 
 	LOG_INFO(" Writing %d bytes from %p\n", count, src);
 
-	if (mutex_lock_interruptible(&instance->vchi_mutex)) {
-		LOG_DBG("Interrupted whilst waiting for lock on (%d)\n",
-			instance->num_connections);
-		return -EINTR;
-	}
+	mutex_lock(&instance->vchi_mutex);
 	vchi_service_use(instance->vchi_handle[0]);
 
 	if (instance->peer_version == 0 &&
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index da0fa34501fad..fa04f6bc9858d 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -149,6 +149,7 @@ static int snd_bcm2835_create(struct snd_card *card,
 		return -ENOMEM;
 
 	chip->card = card;
+	mutex_init(&chip->audio_mutex);
 
 	chip->vchi_ctx = devres_find(card->dev->parent,
 				     bcm2835_devm_free_vchi_ctx, NULL, NULL);
-- 
GitLab


From f81083bee2188cf5b302bfb11fc3651e125b5aa8 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:31 +0200
Subject: [PATCH 0442/1835] staging: bcm2835-audio: Remove redundant spdif
 stream ctls

commit ab91e26229eaca2832df51e13c1285aea3be33ab upstream.

The "IEC958 Playback Stream" control does basically the very same
thing as "IEC958 Playback Default" redundantly.  The former should
have been stream-specific and restored after closing the stream, but
we don't do in that way.

Since it's nothing but confusion, remove this fake.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-ctl.c | 51 -------------------
 1 file changed, 51 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
index 04ea3ec7f64fd..9020887e1ada0 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
@@ -233,48 +233,6 @@ static int snd_bcm2835_spdif_mask_get(struct snd_kcontrol *kcontrol,
 	return 0;
 }
 
-static int snd_bcm2835_spdif_stream_info(struct snd_kcontrol *kcontrol,
-	struct snd_ctl_elem_info *uinfo)
-{
-	uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
-	uinfo->count = 1;
-	return 0;
-}
-
-static int snd_bcm2835_spdif_stream_get(struct snd_kcontrol *kcontrol,
-	struct snd_ctl_elem_value *ucontrol)
-{
-	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
-	int i;
-
-	mutex_lock(&chip->audio_mutex);
-
-	for (i = 0; i < 4; i++)
-		ucontrol->value.iec958.status[i] =
-		(chip->spdif_status >> (i * 8)) & 0xff;
-
-	mutex_unlock(&chip->audio_mutex);
-	return 0;
-}
-
-static int snd_bcm2835_spdif_stream_put(struct snd_kcontrol *kcontrol,
-	struct snd_ctl_elem_value *ucontrol)
-{
-	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
-	unsigned int val = 0;
-	int i, change;
-
-	mutex_lock(&chip->audio_mutex);
-
-	for (i = 0; i < 4; i++)
-		val |= (unsigned int)ucontrol->value.iec958.status[i] << (i * 8);
-	change = val != chip->spdif_status;
-	chip->spdif_status = val;
-
-	mutex_unlock(&chip->audio_mutex);
-	return change;
-}
-
 static struct snd_kcontrol_new snd_bcm2835_spdif[] = {
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_PCM,
@@ -290,15 +248,6 @@ static struct snd_kcontrol_new snd_bcm2835_spdif[] = {
 		.info = snd_bcm2835_spdif_mask_info,
 		.get = snd_bcm2835_spdif_mask_get,
 	},
-	{
-		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE |
-		SNDRV_CTL_ELEM_ACCESS_INACTIVE,
-		.iface = SNDRV_CTL_ELEM_IFACE_PCM,
-		.name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, PCM_STREAM),
-		.info = snd_bcm2835_spdif_stream_info,
-		.get = snd_bcm2835_spdif_stream_get,
-		.put = snd_bcm2835_spdif_stream_put,
-	},
 };
 
 int snd_bcm2835_new_ctl(struct bcm2835_chip *chip)
-- 
GitLab


From 13500e099904dbaeaf8ccecfba3dc1d08782bb4d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:32 +0200
Subject: [PATCH 0443/1835] staging: bcm2835-audio: Clean up include files in
 bcm2835-ctl.c

commit 821950d3da4bf97bcfedcb812176a0f26b833db0 upstream.

Only a few of them are really needed.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-ctl.c     | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
index 9020887e1ada0..1c5a87580978a 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
@@ -1,23 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright 2011 Broadcom Corporation.  All rights reserved. */
 
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/io.h>
-#include <linux/jiffies.h>
-#include <linux/slab.h>
-#include <linux/time.h>
-#include <linux/wait.h>
-#include <linux/delay.h>
-#include <linux/moduleparam.h>
-#include <linux/sched.h>
-
 #include <sound/core.h>
 #include <sound/control.h>
-#include <sound/pcm.h>
-#include <sound/pcm_params.h>
-#include <sound/rawmidi.h>
-#include <sound/initval.h>
 #include <sound/tlv.h>
 #include <sound/asoundef.h>
 
-- 
GitLab


From 7e9c2c6afb812d10444a8a1f1bd3f9150217998a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:33 +0200
Subject: [PATCH 0444/1835] staging: bcm2835-audio: Remove redundant substream
 mask checks

commit 14b1f4cba853a11c7b381ad919622f38eb194bd7 upstream.

The avail_substreams bit mask is checked for the possible racy
accesses, but this cannot happen in practice; i.e. the assignment and
the check are superfluous.

Let's rip them off.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-ctl.c   |  2 --
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c   |  8 --------
 .../vc04_services/bcm2835-audio/bcm2835-vchiq.c | 17 +++++++----------
 .../vc04_services/bcm2835-audio/bcm2835.c       |  5 +----
 .../vc04_services/bcm2835-audio/bcm2835.h       |  2 --
 5 files changed, 8 insertions(+), 26 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
index 1c5a87580978a..d2f0f609f7373 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
@@ -64,8 +64,6 @@ static int snd_bcm2835_ctl_get(struct snd_kcontrol *kcontrol,
 
 	mutex_lock(&chip->audio_mutex);
 
-	BUG_ON(!chip && !(chip->avail_substreams & AVAIL_SUBSTREAMS_MASK));
-
 	if (kcontrol->private_value == PCM_PLAYBACK_VOLUME)
 		ucontrol->value.integer.value[0] = chip2alsa(chip->volume);
 	else if (kcontrol->private_value == PCM_PLAYBACK_MUTE)
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index f2d8b17d0cfe0..0be185350f337 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -118,14 +118,6 @@ static int snd_bcm2835_playback_open_generic(
 		goto out;
 	}
 
-	/* Check if we are ready */
-	if (!(chip->avail_substreams & (1 << idx))) {
-		/* We are not ready yet */
-		audio_error("substream(%d) device is not ready yet\n", idx);
-		err = -EAGAIN;
-		goto out;
-	}
-
 	alsa_stream = kzalloc(sizeof(*alsa_stream), GFP_KERNEL);
 	if (!alsa_stream) {
 		err = -ENOMEM;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index bec361aff4fe8..942a38942c296 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -523,16 +523,13 @@ int bcm2835_audio_set_ctls(struct bcm2835_chip *chip)
 
 	/* change ctls for all substreams */
 	for (i = 0; i < MAX_SUBSTREAMS; i++) {
-		if (chip->avail_substreams & (1 << i)) {
-			if (!chip->alsa_stream[i]) {
-				LOG_DBG(" No ALSA stream available?! %i:%p (%x)\n", i, chip->alsa_stream[i], chip->avail_substreams);
-				ret = 0;
-			} else if (bcm2835_audio_set_ctls_chan(chip->alsa_stream[i], chip) != 0) {
-				LOG_ERR("Couldn't set the controls for stream %d\n", i);
-				ret = -1;
-			} else {
-				LOG_DBG(" Controls set for stream %d\n", i);
-			}
+		if (!chip->alsa_stream[i])
+			continue;
+		if (bcm2835_audio_set_ctls_chan(chip->alsa_stream[i], chip) != 0) {
+			LOG_ERR("Couldn't set the controls for stream %d\n", i);
+			ret = -1;
+		} else {
+			LOG_DBG(" Controls set for stream %d\n", i);
 		}
 	}
 	return ret;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index fa04f6bc9858d..6876a5eadc07f 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -280,7 +280,7 @@ static int snd_add_child_device(struct device *device,
 	struct snd_card *card;
 	struct device *child;
 	struct bcm2835_chip *chip;
-	int err, i;
+	int err;
 
 	child = snd_create_device(device, &audio_driver->driver,
 				  audio_driver->driver.name);
@@ -325,9 +325,6 @@ static int snd_add_child_device(struct device *device,
 		return err;
 	}
 
-	for (i = 0; i < numchans; i++)
-		chip->avail_substreams |= (1 << i);
-
 	err = snd_card_register(card);
 	if (err) {
 		dev_err(child, "Failed to register card, error %d\n", err);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 5dc427240a1d7..c0e7df4914ed0 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -98,8 +98,6 @@ struct bcm2835_chip {
 	struct snd_card *card;
 	struct snd_pcm *pcm;
 	struct snd_pcm *pcm_spdif;
-	/* Bitmat for valid reg_base and irq numbers */
-	unsigned int avail_substreams;
 	struct device *dev;
 	struct bcm2835_alsa_stream *alsa_stream[MAX_SUBSTREAMS];
 
-- 
GitLab


From c59fc50182c15939ef319d0ba68e1aef07c8d477 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:34 +0200
Subject: [PATCH 0445/1835] staging: bcm2835-audio: Fix mute controls, volume
 handling cleanup

commit 495e5a0d83d3902c741771f267a702ae19da8ab6 upstream.

In the current code, the mute control is dealt in a special manner,
modifying the current volume and saving the old volume, etc.  This is
inconsistent (e.g. change the volume while muted, then unmute), and
way too complex.

Also, the whole volume handling code has conversion between ALSA
volume and raw volume values, which can lead to another
inconsistency and complexity.

This patch simplifies these points:
- The ALSA volume value is saved in chip->volume
- volume->mute saves the mute state
- The mute state is evaluated only when the actual volume is passed to
  the hardware, bcm2835_audio_set_ctls()

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-ctl.c | 84 +++++++------------
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c |  6 +-
 .../bcm2835-audio/bcm2835-vchiq.c             | 32 ++-----
 .../vc04_services/bcm2835-audio/bcm2835.h     |  5 +-
 4 files changed, 45 insertions(+), 82 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
index d2f0f609f7373..e17b72f21a9d3 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
@@ -12,6 +12,21 @@
 #define CTRL_VOL_MAX 400
 #define CTRL_VOL_MIN -10239 /* originally -10240 */
 
+static int bcm2835_audio_set_chip_ctls(struct bcm2835_chip *chip)
+{
+	int i, err = 0;
+
+	/* change ctls for all substreams */
+	for (i = 0; i < MAX_SUBSTREAMS; i++) {
+		if (chip->alsa_stream[i]) {
+			err = bcm2835_audio_set_ctls(chip->alsa_stream[i]);
+			if (err < 0)
+				break;
+		}
+	}
+	return err;
+}
+
 static int snd_bcm2835_ctl_info(struct snd_kcontrol *kcontrol,
 				struct snd_ctl_elem_info *uinfo)
 {
@@ -34,29 +49,6 @@ static int snd_bcm2835_ctl_info(struct snd_kcontrol *kcontrol,
 	return 0;
 }
 
-/* toggles mute on or off depending on the value of nmute, and returns
- * 1 if the mute value was changed, otherwise 0
- */
-static int toggle_mute(struct bcm2835_chip *chip, int nmute)
-{
-	/* if settings are ok, just return 0 */
-	if (chip->mute == nmute)
-		return 0;
-
-	/* if the sound is muted then we need to unmute */
-	if (chip->mute == CTRL_VOL_MUTE) {
-		chip->volume = chip->old_volume; /* copy the old volume back */
-		audio_info("Unmuting, old_volume = %d, volume = %d ...\n", chip->old_volume, chip->volume);
-	} else /* otherwise we mute */ {
-		chip->old_volume = chip->volume;
-		chip->volume = 26214; /* set volume to minimum level AKA mute */
-		audio_info("Muting, old_volume = %d, volume = %d ...\n", chip->old_volume, chip->volume);
-	}
-
-	chip->mute = nmute;
-	return 1;
-}
-
 static int snd_bcm2835_ctl_get(struct snd_kcontrol *kcontrol,
 			       struct snd_ctl_elem_value *ucontrol)
 {
@@ -65,7 +57,7 @@ static int snd_bcm2835_ctl_get(struct snd_kcontrol *kcontrol,
 	mutex_lock(&chip->audio_mutex);
 
 	if (kcontrol->private_value == PCM_PLAYBACK_VOLUME)
-		ucontrol->value.integer.value[0] = chip2alsa(chip->volume);
+		ucontrol->value.integer.value[0] = chip->volume;
 	else if (kcontrol->private_value == PCM_PLAYBACK_MUTE)
 		ucontrol->value.integer.value[0] = chip->mute;
 	else if (kcontrol->private_value == PCM_PLAYBACK_DEVICE)
@@ -79,38 +71,26 @@ static int snd_bcm2835_ctl_put(struct snd_kcontrol *kcontrol,
 				struct snd_ctl_elem_value *ucontrol)
 {
 	struct bcm2835_chip *chip = snd_kcontrol_chip(kcontrol);
+	int val, *valp;
 	int changed = 0;
 
-	mutex_lock(&chip->audio_mutex);
-
-	if (kcontrol->private_value == PCM_PLAYBACK_VOLUME) {
-		audio_info("Volume change attempted.. volume = %d new_volume = %d\n", chip->volume, (int)ucontrol->value.integer.value[0]);
-		if (chip->mute == CTRL_VOL_MUTE) {
-			/* changed = toggle_mute(chip, CTRL_VOL_UNMUTE); */
-			changed = 1; /* should return 0 to signify no change but the mixer takes this as the opposite sign (no idea why) */
-			goto unlock;
-		}
-		if (changed || (ucontrol->value.integer.value[0] != chip2alsa(chip->volume))) {
-			chip->volume = alsa2chip(ucontrol->value.integer.value[0]);
-			changed = 1;
-		}
-
-	} else if (kcontrol->private_value == PCM_PLAYBACK_MUTE) {
-		/* Now implemented */
-		audio_info(" Mute attempted\n");
-		changed = toggle_mute(chip, ucontrol->value.integer.value[0]);
+	if (kcontrol->private_value == PCM_PLAYBACK_VOLUME)
+		valp = &chip->volume;
+	else if (kcontrol->private_value == PCM_PLAYBACK_MUTE)
+		valp = &chip->mute;
+	else if (kcontrol->private_value == PCM_PLAYBACK_DEVICE)
+		valp = &chip->dest;
+	else
+		return -EINVAL;
 
-	} else if (kcontrol->private_value == PCM_PLAYBACK_DEVICE) {
-		if (ucontrol->value.integer.value[0] != chip->dest) {
-			chip->dest = ucontrol->value.integer.value[0];
-			changed = 1;
-		}
+	val = ucontrol->value.integer.value[0];
+	mutex_lock(&chip->audio_mutex);
+	if (val != *valp) {
+		*valp = val;
+		changed = 1;
+		if (bcm2835_audio_set_chip_ctls(chip))
+			dev_err(chip->card->dev, "Failed to set ALSA controls..\n");
 	}
-
-	if (changed && bcm2835_audio_set_ctls(chip))
-		dev_err(chip->card->dev, "Failed to set ALSA controls..\n");
-
-unlock:
 	mutex_unlock(&chip->audio_mutex);
 	return changed;
 }
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 0be185350f337..9a79d2267df44 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -280,7 +280,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	bcm2835_audio_setup(alsa_stream);
 
 	/* in preparation of the stream, set the controls (volume level) of the stream */
-	bcm2835_audio_set_ctls(alsa_stream->chip);
+	bcm2835_audio_set_ctls(alsa_stream);
 
 	memset(&alsa_stream->pcm_indirect, 0, sizeof(alsa_stream->pcm_indirect));
 
@@ -441,7 +441,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels)
 	strcpy(pcm->name, "bcm2835 ALSA");
 	chip->pcm = pcm;
 	chip->dest = AUDIO_DEST_AUTO;
-	chip->volume = alsa2chip(0);
+	chip->volume = 0;
 	chip->mute = CTRL_VOL_UNMUTE; /*disable mute on startup */
 	/* set operators */
 	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
@@ -498,7 +498,7 @@ int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
 	strcpy(pcm->name, name);
 	chip->pcm = pcm;
 	chip->dest = route;
-	chip->volume = alsa2chip(0);
+	chip->volume = 0;
 	chip->mute = CTRL_VOL_UNMUTE;
 
 	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 942a38942c296..8684dc1d0b411 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -460,11 +460,11 @@ free_wq:
 	return ret;
 }
 
-static int bcm2835_audio_set_ctls_chan(struct bcm2835_alsa_stream *alsa_stream,
-				       struct bcm2835_chip *chip)
+int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 {
 	struct vc_audio_msg m;
 	struct bcm2835_audio_instance *instance = alsa_stream->instance;
+	struct bcm2835_chip *chip = alsa_stream->chip;
 	int status;
 	int ret;
 
@@ -478,7 +478,10 @@ static int bcm2835_audio_set_ctls_chan(struct bcm2835_alsa_stream *alsa_stream,
 
 	m.type = VC_AUDIO_MSG_TYPE_CONTROL;
 	m.u.control.dest = chip->dest;
-	m.u.control.volume = chip->volume;
+	if (!chip->mute)
+		m.u.control.volume = CHIP_MIN_VOLUME;
+	else
+		m.u.control.volume = alsa2chip(chip->volume);
 
 	/* Create the message available completion */
 	init_completion(&instance->msg_avail_comp);
@@ -514,27 +517,6 @@ unlock:
 	return ret;
 }
 
-int bcm2835_audio_set_ctls(struct bcm2835_chip *chip)
-{
-	int i;
-	int ret = 0;
-
-	LOG_DBG(" Setting ALSA dest(%d), volume(%d)\n", chip->dest, chip->volume);
-
-	/* change ctls for all substreams */
-	for (i = 0; i < MAX_SUBSTREAMS; i++) {
-		if (!chip->alsa_stream[i])
-			continue;
-		if (bcm2835_audio_set_ctls_chan(chip->alsa_stream[i], chip) != 0) {
-			LOG_ERR("Couldn't set the controls for stream %d\n", i);
-			ret = -1;
-		} else {
-			LOG_DBG(" Controls set for stream %d\n", i);
-		}
-	}
-	return ret;
-}
-
 int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 			     unsigned int channels, unsigned int samplerate,
 			     unsigned int bps)
@@ -548,7 +530,7 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 		 channels, samplerate, bps);
 
 	/* resend ctls - alsa_stream may not have been open when first send */
-	ret = bcm2835_audio_set_ctls_chan(alsa_stream, alsa_stream->chip);
+	ret = bcm2835_audio_set_ctls(alsa_stream);
 	if (ret) {
 		LOG_ERR(" Alsa controls not supported\n");
 		return -EINVAL;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index c0e7df4914ed0..8ee25a837b084 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -74,6 +74,8 @@ enum {
 // convert chip to alsa volume
 #define chip2alsa(vol) -(((vol) * 100) >> 8)
 
+#define CHIP_MIN_VOLUME		26214 /* minimum level aka mute */
+
 /* Some constants for values .. */
 enum snd_bcm2835_route {
 	AUDIO_DEST_AUTO = 0,
@@ -102,7 +104,6 @@ struct bcm2835_chip {
 	struct bcm2835_alsa_stream *alsa_stream[MAX_SUBSTREAMS];
 
 	int volume;
-	int old_volume; /* stores the volume value whist muted */
 	int dest;
 	int mute;
 
@@ -160,7 +161,7 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 int bcm2835_audio_setup(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream);
-int bcm2835_audio_set_ctls(struct bcm2835_chip *chip);
+int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 			unsigned int count,
 			void *src);
-- 
GitLab


From 6ca820d751d64289e5ac6be9abb6df115b10222e Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:35 +0200
Subject: [PATCH 0446/1835] staging: bcm2835-audio: Remove redundant function
 calls

commit 124950ebe9fa8547c59e8d4acc8d6c59e6278ed6 upstream.

bcm2835_audio_setup(), bcm2835_audio_flush_buffers() and
bcm2835_audio_flush_playback_buffers() functions do implement
nothing.

Also, bcm2835_audio_set_ctls() is already called inside
bcm2835_audio_set_params(), so the later call is superfluous.

This patch removes these superfluous implementations.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c |  5 -----
 .../bcm2835-audio/bcm2835-vchiq.c             | 21 -------------------
 .../vc04_services/bcm2835-audio/bcm2835.h     |  3 ---
 3 files changed, 29 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 9a79d2267df44..a3ab5bfea08a8 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -277,11 +277,6 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	if (err < 0)
 		audio_error(" error setting hw params\n");
 
-	bcm2835_audio_setup(alsa_stream);
-
-	/* in preparation of the stream, set the controls (volume level) of the stream */
-	bcm2835_audio_set_ctls(alsa_stream);
-
 	memset(&alsa_stream->pcm_indirect, 0, sizeof(alsa_stream->pcm_indirect));
 
 	alsa_stream->pcm_indirect.hw_buffer_size =
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 8684dc1d0b411..488e676e25e16 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -580,12 +580,6 @@ unlock:
 	return ret;
 }
 
-int bcm2835_audio_setup(struct bcm2835_alsa_stream *alsa_stream)
-{
-
-	return 0;
-}
-
 static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream)
 {
 	struct vc_audio_msg m;
@@ -774,21 +768,6 @@ unlock:
 	return ret;
 }
 
-/**
- * Returns all buffers from arm->vc
- */
-void bcm2835_audio_flush_buffers(struct bcm2835_alsa_stream *alsa_stream)
-{
-}
-
-/**
- * Forces VC to flush(drop) its filled playback buffers and
- * return them the us. (VC->ARM)
- */
-void bcm2835_audio_flush_playback_buffers(struct bcm2835_alsa_stream *alsa_stream)
-{
-}
-
 unsigned int bcm2835_audio_retrieve_buffers(struct bcm2835_alsa_stream *alsa_stream)
 {
 	unsigned int count = atomic_read(&alsa_stream->retrieved);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 8ee25a837b084..d2441916960d2 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -158,7 +158,6 @@ int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 			     unsigned int channels, unsigned int samplerate,
 			     unsigned int bps);
-int bcm2835_audio_setup(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream);
@@ -167,7 +166,5 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 			void *src);
 void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream);
 unsigned int bcm2835_audio_retrieve_buffers(struct bcm2835_alsa_stream *alsa_stream);
-void bcm2835_audio_flush_buffers(struct bcm2835_alsa_stream *alsa_stream);
-void bcm2835_audio_flush_playback_buffers(struct bcm2835_alsa_stream *alsa_stream);
 
 #endif /* __SOUND_ARM_BCM2835_H */
-- 
GitLab


From 6f59286710d8cd5c8e50cda2ddfeb5ca9d0ba7f4 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:36 +0200
Subject: [PATCH 0447/1835] staging: bcm2835-audio: Remove superfluous open
 flag

commit ad13924de6b07cb52714ea1809c57b2e72a24504 upstream.

All the alsa_stream->open flag checks in the current code are
redundant, and they cannot be racy.  For the code simplification,
let's remove the flag and its check.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../staging/vc04_services/bcm2835-audio/bcm2835-pcm.c    | 9 ++-------
 drivers/staging/vc04_services/bcm2835-audio/bcm2835.h    | 1 -
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index a3ab5bfea08a8..2c2b6b70df63b 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -57,8 +57,7 @@ void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream)
 	audio_info("alsa_stream=%p substream=%p\n", alsa_stream,
 		alsa_stream ? alsa_stream->substream : 0);
 
-	if (alsa_stream->open)
-		consumed = bcm2835_audio_retrieve_buffers(alsa_stream);
+	consumed = bcm2835_audio_retrieve_buffers(alsa_stream);
 
 	/* We get called only if playback was triggered, So, the number of buffers we retrieve in
 	 * each iteration are the buffers that have been played out already
@@ -154,7 +153,6 @@ static int snd_bcm2835_playback_open_generic(
 	chip->alsa_stream[idx] = alsa_stream;
 
 	chip->opened |= (1 << idx);
-	alsa_stream->open = 1;
 	alsa_stream->draining = 1;
 
 out:
@@ -205,10 +203,7 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 	alsa_stream->period_size = 0;
 	alsa_stream->buffer_size = 0;
 
-	if (alsa_stream->open) {
-		alsa_stream->open = 0;
-		bcm2835_audio_close(alsa_stream);
-	}
+	bcm2835_audio_close(alsa_stream);
 	if (alsa_stream->chip)
 		alsa_stream->chip->alsa_stream[alsa_stream->idx] = NULL;
 	/*
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index d2441916960d2..79363260ae34d 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -121,7 +121,6 @@ struct bcm2835_alsa_stream {
 
 	spinlock_t lock;
 
-	int open;
 	int running;
 	int draining;
 
-- 
GitLab


From edba987463afbd2eecb3957028613d1c7d262099 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:37 +0200
Subject: [PATCH 0448/1835] staging: bcm2835-audio: Drop useless running flag
 and check

commit 02f2376321d75e78117f39ff81f215254ee6b4ef upstream.

The running flag of alsa_stream is basically useless.  The running
state is strictly controlled in ALSA PCM core side, hence the check in
PCM trigger and close callbacks are superfluous.

Also, the prefill ack at trigger start became superfluous nowadays
with the ALSA PCM core update.

Let's rip them off.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c | 46 ++++---------------
 .../vc04_services/bcm2835-audio/bcm2835.h     |  1 -
 2 files changed, 8 insertions(+), 39 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 2c2b6b70df63b..b4b9e90131bf7 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -187,19 +187,6 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 
 	audio_info("Alsa close\n");
 
-	/*
-	 * Call stop if it's still running. This happens when app
-	 * is force killed and we don't get a stop trigger.
-	 */
-	if (alsa_stream->running) {
-		int err;
-
-		err = bcm2835_audio_stop(alsa_stream);
-		alsa_stream->running = 0;
-		if (err)
-			audio_error(" Failed to STOP alsa device\n");
-	}
-
 	alsa_stream->period_size = 0;
 	alsa_stream->buffer_size = 0;
 
@@ -324,27 +311,13 @@ static int snd_bcm2835_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-		audio_debug("bcm2835_AUDIO_TRIGGER_START running=%d\n",
-			alsa_stream->running);
-		if (!alsa_stream->running) {
-			err = bcm2835_audio_start(alsa_stream);
-			if (!err) {
-				alsa_stream->pcm_indirect.hw_io =
-					alsa_stream->pcm_indirect.hw_data =
-					bytes_to_frames(runtime,
-					alsa_stream->pos);
-				substream->ops->ack(substream);
-				alsa_stream->running = 1;
-				alsa_stream->draining = 1;
-			} else {
-				audio_error(" Failed to START alsa device (%d)\n", err);
-			}
-		}
+		err = bcm2835_audio_start(alsa_stream);
+		if (!err)
+			alsa_stream->draining = 1;
+		else
+			audio_error(" Failed to START alsa device (%d)\n", err);
 		break;
 	case SNDRV_PCM_TRIGGER_STOP:
-		audio_debug
-			("bcm2835_AUDIO_TRIGGER_STOP running=%d draining=%d\n",
-			alsa_stream->running, runtime->status->state == SNDRV_PCM_STATE_DRAINING);
 		if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
 			audio_info("DRAINING\n");
 			alsa_stream->draining = 1;
@@ -352,12 +325,9 @@ static int snd_bcm2835_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 			audio_info("DROPPING\n");
 			alsa_stream->draining = 0;
 		}
-		if (alsa_stream->running) {
-			err = bcm2835_audio_stop(alsa_stream);
-			if (err != 0)
-				audio_error(" Failed to STOP alsa device (%d)\n", err);
-			alsa_stream->running = 0;
-		}
+		err = bcm2835_audio_stop(alsa_stream);
+		if (err != 0)
+			audio_error(" Failed to STOP alsa device (%d)\n", err);
 		break;
 	default:
 		err = -EINVAL;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 79363260ae34d..2a9f3d6c10dcb 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -121,7 +121,6 @@ struct bcm2835_alsa_stream {
 
 	spinlock_t lock;
 
-	int running;
 	int draining;
 
 	int channels;
-- 
GitLab


From 8c26574818550fe90818afac951111156260ad75 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:38 +0200
Subject: [PATCH 0449/1835] staging: bcm2835-audio: Fix incorrect draining
 handling

commit 7d2a91f5f1bcf08ca257bcf1ed9721fcd341f834 upstream.

The handling of SNDRV_PCM_TRIGGER_STOP at the trigger callback is
incorrect: when the STOP is issued, the driver is supposed to drop the
stream immediately.  Meanwhile bcm2835 driver checks the DRAINING
state and tries to issue some different command.

This patch straightens things a bit, dropping the incorrect state
checks.  The draining behavior would be still not perfect at this
point, but will be improved in a later patch.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c  | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index b4b9e90131bf7..00c2abab4bba7 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -153,7 +153,6 @@ static int snd_bcm2835_playback_open_generic(
 	chip->alsa_stream[idx] = alsa_stream;
 
 	chip->opened |= (1 << idx);
-	alsa_stream->draining = 1;
 
 out:
 	mutex_unlock(&chip->audio_mutex);
@@ -268,6 +267,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	alsa_stream->buffer_size = snd_pcm_lib_buffer_bytes(substream);
 	alsa_stream->period_size = snd_pcm_lib_period_bytes(substream);
 	alsa_stream->pos = 0;
+	alsa_stream->draining = false;
 
 	audio_debug("buffer_size=%d, period_size=%d pos=%d frame_bits=%d\n",
 		alsa_stream->buffer_size, alsa_stream->period_size,
@@ -312,21 +312,15 @@ static int snd_bcm2835_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
 		err = bcm2835_audio_start(alsa_stream);
-		if (!err)
-			alsa_stream->draining = 1;
-		else
+		if (err)
 			audio_error(" Failed to START alsa device (%d)\n", err);
 		break;
+	case SNDRV_PCM_TRIGGER_DRAIN:
+		alsa_stream->draining = true;
+		break;
 	case SNDRV_PCM_TRIGGER_STOP:
-		if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
-			audio_info("DRAINING\n");
-			alsa_stream->draining = 1;
-		} else {
-			audio_info("DROPPING\n");
-			alsa_stream->draining = 0;
-		}
 		err = bcm2835_audio_stop(alsa_stream);
-		if (err != 0)
+		if (err)
 			audio_error(" Failed to STOP alsa device (%d)\n", err);
 		break;
 	default:
-- 
GitLab


From 3f4e7a94ddc039eab203f337dcc1590287aaa1b7 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:39 +0200
Subject: [PATCH 0450/1835] staging: bcm2835-audio: Kill unused spinlock

commit 5332f6f012c0bf3a45c77dbc0f79814443a884d4 upstream.

The alsa_stream->lock is never used.  Kill it.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 2 --
 drivers/staging/vc04_services/bcm2835-audio/bcm2835.h     | 2 --
 2 files changed, 4 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 00c2abab4bba7..fc1b345d206cd 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -128,8 +128,6 @@ static int snd_bcm2835_playback_open_generic(
 	alsa_stream->substream = substream;
 	alsa_stream->idx = idx;
 
-	spin_lock_init(&alsa_stream->lock);
-
 	err = bcm2835_audio_open(alsa_stream);
 	if (err) {
 		kfree(alsa_stream);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 2a9f3d6c10dcb..20f5ff1649e6b 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -119,8 +119,6 @@ struct bcm2835_alsa_stream {
 	struct snd_pcm_substream *substream;
 	struct snd_pcm_indirect pcm_indirect;
 
-	spinlock_t lock;
-
 	int draining;
 
 	int channels;
-- 
GitLab


From 695e8df4992965e1fa5fc0d4a6df69d0eec8c6e6 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:40 +0200
Subject: [PATCH 0451/1835] staging: bcm2835-audio: Use PCM runtime values
 instead

commit b8f7fdd50890b848e085c0519469aed4ff4d9b54 upstream.

Some fields in alsa_stream are the values we keep already in PCM
runtime object, hence they are redundant.  Use the standard PCM
runtime values instead of the private copies.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c | 23 ++++---------------
 .../vc04_services/bcm2835-audio/bcm2835.h     |  4 ----
 2 files changed, 4 insertions(+), 23 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index fc1b345d206cd..a3605505cc20b 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -206,22 +206,7 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 static int snd_bcm2835_pcm_hw_params(struct snd_pcm_substream *substream,
 	struct snd_pcm_hw_params *params)
 {
-	struct snd_pcm_runtime *runtime = substream->runtime;
-	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
-	int err;
-
-	err = snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
-	if (err < 0) {
-		audio_error
-			(" pcm_lib_malloc failed to allocated pages for buffers\n");
-		return err;
-	}
-
-	alsa_stream->channels = params_channels(params);
-	alsa_stream->params_rate = params_rate(params);
-	alsa_stream->pcm_format_width = snd_pcm_format_width(params_format(params));
-
-	return err;
+	return snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
 }
 
 /* hw_free callback */
@@ -248,11 +233,11 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	if (chip->spdif_status & IEC958_AES0_NONAUDIO)
 		channels = 0;
 	else
-		channels = alsa_stream->channels;
+		channels = runtime->channels;
 
 	err = bcm2835_audio_set_params(alsa_stream, channels,
-		alsa_stream->params_rate,
-		alsa_stream->pcm_format_width);
+				       runtime->rate,
+				       snd_pcm_format_width(runtime->format));
 	if (err < 0)
 		audio_error(" error setting hw params\n");
 
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 20f5ff1649e6b..3bf128422a6fd 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -121,10 +121,6 @@ struct bcm2835_alsa_stream {
 
 	int draining;
 
-	int channels;
-	int params_rate;
-	int pcm_format_width;
-
 	unsigned int pos;
 	unsigned int buffer_size;
 	unsigned int period_size;
-- 
GitLab


From 78b9b328df942d3348ffe53356c75a256c0b2dda Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:41 +0200
Subject: [PATCH 0452/1835] staging: bcm2835-audio: Drop unnecessary pcm
 indirect setup

commit 7318ec896f4856fae2bb013858e422fa078201e1 upstream.

The hw_queue_size of PCM indirect helper doesn't need to be set up if
you use the whole given buffer size.  Drop the useless
initialization, which just confuses readers.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index a3605505cc20b..c935c6e99633c 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -280,7 +280,6 @@ static int snd_bcm2835_pcm_ack(struct snd_pcm_substream *substream)
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
 	struct snd_pcm_indirect *pcm_indirect = &alsa_stream->pcm_indirect;
 
-	pcm_indirect->hw_queue_size = runtime->hw.buffer_bytes_max;
 	return snd_pcm_indirect_playback_transfer(substream, pcm_indirect,
 						  snd_bcm2835_pcm_transfer);
 }
-- 
GitLab


From 9b06a390b0cff4e3a4b638c9ed4e6346615425f9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:42 +0200
Subject: [PATCH 0453/1835] staging: bcm2835-audio: Drop useless NULL check

commit 8bcf9f252c29c2d5bcce3db605c0ebf1ef230f9c upstream.

alsa_stream->chip can be never NULL.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index c935c6e99633c..13c61af4e723a 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -188,8 +188,7 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 	alsa_stream->buffer_size = 0;
 
 	bcm2835_audio_close(alsa_stream);
-	if (alsa_stream->chip)
-		alsa_stream->chip->alsa_stream[alsa_stream->idx] = NULL;
+	alsa_stream->chip->alsa_stream[alsa_stream->idx] = NULL;
 	/*
 	 * Do not free up alsa_stream here, it will be freed up by
 	 * runtime->private_free callback we registered in *_open above
-- 
GitLab


From 18583f7aad797800de863be5d2238d0c2aad952a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:43 +0200
Subject: [PATCH 0454/1835] staging: bcm2835-audio: Propagate parameter setup
 error

commit fee5638fe552ff8222c3a5bdcc4a34255e248d8c upstream.

When the parameter setup fails, the driver should propagate the error
code instead of silently ignoring it.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 13c61af4e723a..41bcaff6358bc 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -238,7 +238,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 				       runtime->rate,
 				       snd_pcm_format_width(runtime->format));
 	if (err < 0)
-		audio_error(" error setting hw params\n");
+		goto out;
 
 	memset(&alsa_stream->pcm_indirect, 0, sizeof(alsa_stream->pcm_indirect));
 
@@ -255,8 +255,9 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 		alsa_stream->buffer_size, alsa_stream->period_size,
 		alsa_stream->pos, runtime->frame_bits);
 
+ out:
 	mutex_unlock(&chip->audio_mutex);
-	return 0;
+	return err;
 }
 
 static void snd_bcm2835_pcm_transfer(struct snd_pcm_substream *substream,
-- 
GitLab


From 5c905cb6af7480a6044f9e2c78144a8742cd69d2 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:44 +0200
Subject: [PATCH 0455/1835] staging: bcm2835-audio: Drop debug messages in
 bcm2835-pcm.c

commit 055e1c330d04df87d4730a5db837161c11ddaafc upstream.

These debug messages worsen the code readability a lot while they give
little debuggability (which we already have via tracing, in anyway).

Let's clean them up.  This allows us to reduce the
snd_bcm2835_pcm_lib_ioctl() function to be a direct call of the
snd_pcm_lib_ioctl callback (like most other drivers do), too.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c | 51 +++----------------
 1 file changed, 7 insertions(+), 44 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 41bcaff6358bc..1f9c940f1cc33 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -44,9 +44,7 @@ static const struct snd_pcm_hardware snd_bcm2835_playback_spdif_hw = {
 
 static void snd_bcm2835_playback_free(struct snd_pcm_runtime *runtime)
 {
-	audio_info("Freeing up alsa stream here ..\n");
 	kfree(runtime->private_data);
-	runtime->private_data = NULL;
 }
 
 void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream)
@@ -99,7 +97,6 @@ static int snd_bcm2835_playback_open_generic(
 	int err;
 
 	mutex_lock(&chip->audio_mutex);
-	audio_info("Alsa open (%d)\n", substream->number);
 	idx = substream->number;
 
 	if (spdif && chip->opened) {
@@ -182,8 +179,6 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 	runtime = substream->runtime;
 	alsa_stream = runtime->private_data;
 
-	audio_info("Alsa close\n");
-
 	alsa_stream->period_size = 0;
 	alsa_stream->buffer_size = 0;
 
@@ -251,10 +246,6 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	alsa_stream->pos = 0;
 	alsa_stream->draining = false;
 
-	audio_debug("buffer_size=%d, period_size=%d pos=%d frame_bits=%d\n",
-		alsa_stream->buffer_size, alsa_stream->period_size,
-		alsa_stream->pos, runtime->frame_bits);
-
  out:
 	mutex_unlock(&chip->audio_mutex);
 	return err;
@@ -266,12 +257,8 @@ static void snd_bcm2835_pcm_transfer(struct snd_pcm_substream *substream,
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
 	void *src = (void *) (substream->runtime->dma_area + rec->sw_data);
-	int err;
-
-	err = bcm2835_audio_write(alsa_stream, bytes, src);
-	if (err)
-		audio_error(" Failed to transfer to alsa device (%d)\n", err);
 
+	bcm2835_audio_write(alsa_stream, bytes, src);
 }
 
 static int snd_bcm2835_pcm_ack(struct snd_pcm_substream *substream)
@@ -289,27 +276,18 @@ static int snd_bcm2835_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
-	int err = 0;
 
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-		err = bcm2835_audio_start(alsa_stream);
-		if (err)
-			audio_error(" Failed to START alsa device (%d)\n", err);
-		break;
+		return bcm2835_audio_start(alsa_stream);
 	case SNDRV_PCM_TRIGGER_DRAIN:
 		alsa_stream->draining = true;
-		break;
+		return 0;
 	case SNDRV_PCM_TRIGGER_STOP:
-		err = bcm2835_audio_stop(alsa_stream);
-		if (err)
-			audio_error(" Failed to STOP alsa device (%d)\n", err);
-		break;
+		return bcm2835_audio_stop(alsa_stream);
 	default:
-		err = -EINVAL;
+		return -EINVAL;
 	}
-
-	return err;
 }
 
 /* pointer callback */
@@ -319,31 +297,16 @@ snd_bcm2835_pcm_pointer(struct snd_pcm_substream *substream)
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
 
-	audio_debug("pcm_pointer... (%d) hwptr=%d appl=%d pos=%d\n", 0,
-		frames_to_bytes(runtime, runtime->status->hw_ptr),
-		frames_to_bytes(runtime, runtime->control->appl_ptr),
-		alsa_stream->pos);
-
 	return snd_pcm_indirect_playback_pointer(substream,
 		&alsa_stream->pcm_indirect,
 		alsa_stream->pos);
 }
 
-static int snd_bcm2835_pcm_lib_ioctl(struct snd_pcm_substream *substream,
-	unsigned int cmd, void *arg)
-{
-	int ret = snd_pcm_lib_ioctl(substream, cmd, arg);
-
-	audio_info(" .. substream=%p, cmd=%d, arg=%p (%x) ret=%d\n", substream,
-		cmd, arg, arg ? *(unsigned int *)arg : 0, ret);
-	return ret;
-}
-
 /* operators */
 static const struct snd_pcm_ops snd_bcm2835_playback_ops = {
 	.open = snd_bcm2835_playback_open,
 	.close = snd_bcm2835_playback_close,
-	.ioctl = snd_bcm2835_pcm_lib_ioctl,
+	.ioctl = snd_pcm_lib_ioctl,
 	.hw_params = snd_bcm2835_pcm_hw_params,
 	.hw_free = snd_bcm2835_pcm_hw_free,
 	.prepare = snd_bcm2835_pcm_prepare,
@@ -355,7 +318,7 @@ static const struct snd_pcm_ops snd_bcm2835_playback_ops = {
 static const struct snd_pcm_ops snd_bcm2835_playback_spdif_ops = {
 	.open = snd_bcm2835_playback_spdif_open,
 	.close = snd_bcm2835_playback_close,
-	.ioctl = snd_bcm2835_pcm_lib_ioctl,
+	.ioctl = snd_pcm_lib_ioctl,
 	.hw_params = snd_bcm2835_pcm_hw_params,
 	.hw_free = snd_bcm2835_pcm_hw_free,
 	.prepare = snd_bcm2835_pcm_prepare,
-- 
GitLab


From 922fe5c7ab59e1e78f19c17f6446740715274a09 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:45 +0200
Subject: [PATCH 0456/1835] staging: bcm2835-audio: Drop superfluous mutex lock
 during prepare

commit f0eb15d055380ff127e5f12c8fad2b36bdb3c006 upstream.

The chip->audio_mutex is used basically for protecting the opened
stream assignment, and the prepare callback is irrelevant with it.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 1f9c940f1cc33..9659c25b9f9dd 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -218,8 +218,6 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	int channels;
 	int err;
 
-	mutex_lock(&chip->audio_mutex);
-
 	/* notify the vchiq that it should enter spdif passthrough mode by
 	 * setting channels=0 (see
 	 * https://github.com/raspberrypi/linux/issues/528)
@@ -233,7 +231,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 				       runtime->rate,
 				       snd_pcm_format_width(runtime->format));
 	if (err < 0)
-		goto out;
+		return err;
 
 	memset(&alsa_stream->pcm_indirect, 0, sizeof(alsa_stream->pcm_indirect));
 
@@ -246,9 +244,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	alsa_stream->pos = 0;
 	alsa_stream->draining = false;
 
- out:
-	mutex_unlock(&chip->audio_mutex);
-	return err;
+	return 0;
 }
 
 static void snd_bcm2835_pcm_transfer(struct snd_pcm_substream *substream,
-- 
GitLab


From c6795103b632d6cdfdc0bcb2aef43bee1d566b52 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:46 +0200
Subject: [PATCH 0457/1835] staging: bcm2835-audio: Add 10ms period constraint

commit 93c66acaf68b5247c3121a46a71ff6a70fc1d492 upstream.

It seems that the resolution of vc04 callback is in 10 msec; i.e. the
minimal period size is also 10 msec.

This patch adds the corresponding hw constraint.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 9659c25b9f9dd..6d89db6e14e4a 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -145,6 +145,11 @@ static int snd_bcm2835_playback_open_generic(
 				   SNDRV_PCM_HW_PARAM_PERIOD_BYTES,
 				   16);
 
+	/* position update is in 10ms order */
+	snd_pcm_hw_constraint_minmax(runtime,
+				     SNDRV_PCM_HW_PARAM_PERIOD_TIME,
+				     10 * 1000, UINT_MAX);
+
 	chip->alsa_stream[idx] = alsa_stream;
 
 	chip->opened |= (1 << idx);
-- 
GitLab


From 97756b9ba014bb8aad14f6dc33a26b32763fb39d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:47 +0200
Subject: [PATCH 0458/1835] staging: bcm2835-audio: Make single vchi handle

commit 326a6edcb2ada56375bd7d3fc24c83f58e8da7f3 upstream.

The bcm2835_audio_instance object contains the array of
VCHI_SERVICE_HANDLE_T, while the code assumes and uses only the first
element explicitly.  Let's reduce to a single vchi handle for
simplifying the code.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../bcm2835-audio/bcm2835-vchiq.c             | 170 ++++++------------
 1 file changed, 58 insertions(+), 112 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 488e676e25e16..be76f97705f4e 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -44,8 +44,7 @@
 #endif
 
 struct bcm2835_audio_instance {
-	unsigned int num_connections;
-	VCHI_SERVICE_HANDLE_T vchi_handle[VCHI_MAX_NUM_CONNECTIONS];
+	VCHI_SERVICE_HANDLE_T vchi_handle;
 	struct completion msg_avail_comp;
 	struct mutex vchi_mutex;
 	struct bcm2835_alsa_stream *alsa_stream;
@@ -202,12 +201,12 @@ static void audio_vchi_callback(void *param,
 		BUG();
 		return;
 	}
-	if (!instance->vchi_handle[0]) {
-		LOG_ERR(" .. instance->vchi_handle[0] is null\n");
+	if (!instance->vchi_handle) {
+		LOG_ERR(" .. instance->vchi_handle is null\n");
 		BUG();
 		return;
 	}
-	status = vchi_msg_dequeue(instance->vchi_handle[0],
+	status = vchi_msg_dequeue(instance->vchi_handle,
 				  &m, sizeof(m), &msg_len, VCHI_FLAGS_NONE);
 	if (m.type == VC_AUDIO_MSG_TYPE_RESULT) {
 		LOG_DBG(" .. instance=%p, m.type=VC_AUDIO_MSG_TYPE_RESULT, success=%d\n",
@@ -237,102 +236,61 @@ static void audio_vchi_callback(void *param,
 
 static struct bcm2835_audio_instance *
 vc_vchi_audio_init(VCHI_INSTANCE_T vchi_instance,
-		   VCHI_CONNECTION_T **vchi_connections,
-		   unsigned int num_connections)
+		   VCHI_CONNECTION_T *vchi_connection)
 {
-	unsigned int i;
+	SERVICE_CREATION_T params = {
+		.version		= VCHI_VERSION_EX(VC_AUDIOSERV_VER, VC_AUDIOSERV_MIN_VER),
+		.service_id		= VC_AUDIO_SERVER_NAME,
+		.connection		= vchi_connection,
+		.rx_fifo_size		= 0,
+		.tx_fifo_size		= 0,
+		.callback		= audio_vchi_callback,
+		.want_unaligned_bulk_rx = 1, //TODO: remove VCOS_FALSE
+		.want_unaligned_bulk_tx = 1, //TODO: remove VCOS_FALSE
+		.want_crc		= 0
+	};
 	struct bcm2835_audio_instance *instance;
 	int status;
-	int ret;
-
-	LOG_DBG("%s: start", __func__);
 
-	if (num_connections > VCHI_MAX_NUM_CONNECTIONS) {
-		LOG_ERR("%s: unsupported number of connections %u (max=%u)\n",
-			__func__, num_connections, VCHI_MAX_NUM_CONNECTIONS);
-
-		return ERR_PTR(-EINVAL);
-	}
 	/* Allocate memory for this instance */
 	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
 	if (!instance)
 		return ERR_PTR(-ENOMEM);
 
-	instance->num_connections = num_connections;
-
 	/* Create a lock for exclusive, serialized VCHI connection access */
 	mutex_init(&instance->vchi_mutex);
 	/* Open the VCHI service connections */
-	for (i = 0; i < num_connections; i++) {
-		SERVICE_CREATION_T params = {
-			.version		= VCHI_VERSION_EX(VC_AUDIOSERV_VER, VC_AUDIOSERV_MIN_VER),
-			.service_id		= VC_AUDIO_SERVER_NAME,
-			.connection		= vchi_connections[i],
-			.rx_fifo_size		= 0,
-			.tx_fifo_size		= 0,
-			.callback		= audio_vchi_callback,
-			.callback_param		= instance,
-			.want_unaligned_bulk_rx = 1, //TODO: remove VCOS_FALSE
-			.want_unaligned_bulk_tx = 1, //TODO: remove VCOS_FALSE
-			.want_crc		= 0
-		};
-
-		LOG_DBG("%s: about to open %i\n", __func__, i);
-		status = vchi_service_open(vchi_instance, &params,
-					   &instance->vchi_handle[i]);
-
-		LOG_DBG("%s: opened %i: %p=%d\n", __func__, i, instance->vchi_handle[i], status);
-		if (status) {
-			LOG_ERR("%s: failed to open VCHI service connection (status=%d)\n",
-				__func__, status);
-			ret = -EPERM;
-			goto err_close_services;
-		}
-		/* Finished with the service for now */
-		vchi_service_release(instance->vchi_handle[i]);
-	}
+	params.callback_param = instance,
 
-	LOG_DBG("%s: okay\n", __func__);
-	return instance;
+	status = vchi_service_open(vchi_instance, &params,
+				   &instance->vchi_handle);
 
-err_close_services:
-	for (i = 0; i < instance->num_connections; i++) {
-		LOG_ERR("%s: closing %i: %p\n", __func__, i, instance->vchi_handle[i]);
-		if (instance->vchi_handle[i])
-			vchi_service_close(instance->vchi_handle[i]);
+	if (status) {
+		LOG_ERR("%s: failed to open VCHI service connection (status=%d)\n",
+			__func__, status);
+		kfree(instance);
+		return ERR_PTR(-EPERM);
 	}
 
-	kfree(instance);
-	LOG_ERR("%s: error\n", __func__);
+	/* Finished with the service for now */
+	vchi_service_release(instance->vchi_handle);
 
-	return ERR_PTR(ret);
+	return instance;
 }
 
 static int vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
 {
-	unsigned int i;
-
-	if (!instance) {
-		LOG_ERR("%s: invalid handle %p\n", __func__, instance);
-
-		return -1;
-	}
+	int status;
 
-	LOG_DBG(" .. about to lock (%d)\n", instance->num_connections);
 	mutex_lock(&instance->vchi_mutex);
 
 	/* Close all VCHI service connections */
-	for (i = 0; i < instance->num_connections; i++) {
-		int status;
-
-		LOG_DBG(" .. %i:closing %p\n", i, instance->vchi_handle[i]);
-		vchi_service_use(instance->vchi_handle[i]);
+	vchi_service_use(instance->vchi_handle);
 
-		status = vchi_service_close(instance->vchi_handle[i]);
-		if (status) {
-			LOG_DBG("%s: failed to close VCHI service connection (status=%d)\n",
-				__func__, status);
-		}
+	status = vchi_service_close(instance->vchi_handle);
+	if (status) {
+		LOG_DBG("%s: failed to close VCHI service connection (status=%d)\n",
+			__func__, status);
 	}
 
 	mutex_unlock(&instance->vchi_mutex);
@@ -383,19 +341,9 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
 		(struct bcm2835_audio_instance *)alsa_stream->instance;
 	struct bcm2835_vchi_ctx *vhci_ctx = alsa_stream->chip->vchi_ctx;
 
-	LOG_INFO("%s: start\n", __func__);
-	BUG_ON(instance);
-	if (instance) {
-		LOG_ERR("%s: VCHI instance already open (%p)\n",
-			__func__, instance);
-		instance->alsa_stream = alsa_stream;
-		alsa_stream->instance = instance;
-		return 0;
-	}
-
 	/* Initialize an instance of the audio service */
 	instance = vc_vchi_audio_init(vhci_ctx->vchi_instance,
-				      &vhci_ctx->vchi_connection, 1);
+				      vhci_ctx->vchi_connection);
 
 	if (IS_ERR(instance)) {
 		LOG_ERR("%s: failed to initialize audio service\n", __func__);
@@ -407,8 +355,6 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
 	instance->alsa_stream = alsa_stream;
 	alsa_stream->instance = instance;
 
-	LOG_DBG(" success !\n");
-
 	return 0;
 }
 
@@ -431,12 +377,12 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 	LOG_DBG(" instance (%p)\n", instance);
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	m.type = VC_AUDIO_MSG_TYPE_OPEN;
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -450,7 +396,7 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 
 free_wq:
@@ -472,7 +418,7 @@ int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 		 chip->dest, chip->volume);
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	instance->result = -1;
 
@@ -487,7 +433,7 @@ int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 	init_completion(&instance->msg_avail_comp);
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -511,7 +457,7 @@ int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 
 	return ret;
@@ -537,7 +483,7 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 	}
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	instance->result = -1;
 
@@ -550,7 +496,7 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 	init_completion(&instance->msg_avail_comp);
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -574,7 +520,7 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 
 	return ret;
@@ -588,12 +534,12 @@ static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream)
 	int ret;
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	m.type = VC_AUDIO_MSG_TYPE_START;
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -607,7 +553,7 @@ static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream)
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 	return ret;
 }
@@ -620,13 +566,13 @@ static int bcm2835_audio_stop_worker(struct bcm2835_alsa_stream *alsa_stream)
 	int ret;
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	m.type = VC_AUDIO_MSG_TYPE_STOP;
 	m.u.stop.draining = alsa_stream->draining;
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -640,7 +586,7 @@ static int bcm2835_audio_stop_worker(struct bcm2835_alsa_stream *alsa_stream)
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 	return ret;
 }
@@ -655,7 +601,7 @@ int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream)
 	my_workqueue_quit(alsa_stream);
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	m.type = VC_AUDIO_MSG_TYPE_CLOSE;
 
@@ -663,7 +609,7 @@ int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream)
 	init_completion(&instance->msg_avail_comp);
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -687,7 +633,7 @@ int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream)
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 
 	/* Stop the audio service */
@@ -708,10 +654,10 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 	LOG_INFO(" Writing %d bytes from %p\n", count, src);
 
 	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle[0]);
+	vchi_service_use(instance->vchi_handle);
 
 	if (instance->peer_version == 0 &&
-	    vchi_get_peer_version(instance->vchi_handle[0], &instance->peer_version) == 0)
+	    vchi_get_peer_version(instance->vchi_handle, &instance->peer_version) == 0)
 		LOG_DBG("%s: client version %d connected\n", __func__, instance->peer_version);
 
 	m.type = VC_AUDIO_MSG_TYPE_WRITE;
@@ -723,7 +669,7 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 	m.u.write.silence = src == NULL;
 
 	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 					&m, sizeof(m));
 
 	if (status) {
@@ -736,7 +682,7 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 	if (!m.u.write.silence) {
 		if (!m.u.write.max_packet) {
 			/* Send the message to the videocore */
-			status = vchi_bulk_queue_transmit(instance->vchi_handle[0],
+			status = vchi_bulk_queue_transmit(instance->vchi_handle,
 							  src, count,
 							  0 * VCHI_FLAGS_BLOCK_UNTIL_QUEUED
 							  +
@@ -746,7 +692,7 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 			while (count > 0) {
 				int bytes = min_t(int, m.u.write.max_packet, count);
 
-				status = bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+				status = bcm2835_vchi_msg_queue(instance->vchi_handle,
 								src, bytes);
 				src = (char *)src + bytes;
 				count -= bytes;
@@ -763,7 +709,7 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 	ret = 0;
 
 unlock:
-	vchi_service_release(instance->vchi_handle[0]);
+	vchi_service_release(instance->vchi_handle);
 	mutex_unlock(&instance->vchi_mutex);
 	return ret;
 }
-- 
GitLab


From 8901c568c574328414de4c8a852d35707e50b044 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:48 +0200
Subject: [PATCH 0459/1835] staging: bcm2835-audio: Code refactoring of vchiq
 accessor codes

commit 769a8e9bf5cf39813f52962fdafdf7e4d52ad585 upstream.

This is a cleanup and code refactoring in bcm2835-vchiq.c.

The major code changes are to provide local helpers for easier use of
lock / unlock, and message passing with/without response wait.  This
allows us to reduce lots of open codes.

Also, the max packet is set at opening the stream, not at each time
when the write gets called.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../bcm2835-audio/bcm2835-vchiq.c             | 440 ++++++------------
 1 file changed, 142 insertions(+), 298 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index be76f97705f4e..96d3083e8add4 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -49,6 +49,7 @@ struct bcm2835_audio_instance {
 	struct mutex vchi_mutex;
 	struct bcm2835_alsa_stream *alsa_stream;
 	int result;
+	unsigned int max_packet;
 	short peer_version;
 };
 
@@ -65,16 +66,68 @@ static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream);
 static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 				      unsigned int count, void *src);
 
-// Routine to send a message across a service
+static void bcm2835_audio_lock(struct bcm2835_audio_instance *instance)
+{
+	mutex_lock(&instance->vchi_mutex);
+	vchi_service_use(instance->vchi_handle);
+}
+
+static void bcm2835_audio_unlock(struct bcm2835_audio_instance *instance)
+{
+	vchi_service_release(instance->vchi_handle);
+	mutex_unlock(&instance->vchi_mutex);
+}
+
+static int bcm2835_audio_send_msg_locked(struct bcm2835_audio_instance *instance,
+					 struct vc_audio_msg *m, bool wait)
+{
+	int status;
+
+	if (wait) {
+		instance->result = -1;
+		init_completion(&instance->msg_avail_comp);
+	}
+
+	status = vchi_queue_kernel_message(instance->vchi_handle,
+					   m, sizeof(*m));
+	if (status) {
+		LOG_ERR("vchi message queue failed: %d, msg=%d\n",
+			status, m->type);
+		return -EIO;
+	}
+
+	if (wait) {
+		if (!wait_for_completion_timeout(&instance->msg_avail_comp,
+						 msecs_to_jiffies(10 * 1000))) {
+			LOG_ERR("vchi message timeout, msg=%d\n", m->type);
+			return -ETIMEDOUT;
+		} else if (instance->result) {
+			LOG_ERR("vchi message response error:%d, msg=%d\n",
+				instance->result, m->type);
+			return -EIO;
+		}
+	}
+
+	return 0;
+}
 
-static int
-bcm2835_vchi_msg_queue(VCHI_SERVICE_HANDLE_T handle,
-		       void *data,
-		       unsigned int size)
+static int bcm2835_audio_send_msg(struct bcm2835_audio_instance *instance,
+				  struct vc_audio_msg *m, bool wait)
 {
-	return vchi_queue_kernel_message(handle,
-					 data,
-					 size);
+	int err;
+
+	bcm2835_audio_lock(instance);
+	err = bcm2835_audio_send_msg_locked(instance, m, wait);
+	bcm2835_audio_unlock(instance);
+	return err;
+}
+
+static int bcm2835_audio_send_simple(struct bcm2835_audio_instance *instance,
+				     int type, bool wait)
+{
+	struct vc_audio_msg m = { .type = type };
+
+	return bcm2835_audio_send_msg(instance, &m, wait);
 }
 
 static const u32 BCM2835_AUDIO_WRITE_COOKIE1 = ('B' << 24 | 'C' << 16 |
@@ -283,10 +336,9 @@ static int vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
 	int status;
 
 	mutex_lock(&instance->vchi_mutex);
-
-	/* Close all VCHI service connections */
 	vchi_service_use(instance->vchi_handle);
 
+	/* Close all VCHI service connections */
 	status = vchi_service_close(instance->vchi_handle);
 	if (status) {
 		LOG_DBG("%s: failed to close VCHI service connection (status=%d)\n",
@@ -345,12 +397,8 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
 	instance = vc_vchi_audio_init(vhci_ctx->vchi_instance,
 				      vhci_ctx->vchi_connection);
 
-	if (IS_ERR(instance)) {
-		LOG_ERR("%s: failed to initialize audio service\n", __func__);
-
-		/* vchi_instance is retained for use the next time. */
+	if (IS_ERR(instance))
 		return PTR_ERR(instance);
-	}
 
 	instance->alsa_stream = alsa_stream;
 	alsa_stream->instance = instance;
@@ -361,66 +409,44 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
 int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 {
 	struct bcm2835_audio_instance *instance;
-	struct vc_audio_msg m;
-	int status;
-	int ret;
+	int err;
 
 	alsa_stream->my_wq = alloc_workqueue("my_queue", WQ_HIGHPRI, 1);
 	if (!alsa_stream->my_wq)
 		return -ENOMEM;
 
-	ret = bcm2835_audio_open_connection(alsa_stream);
-	if (ret)
+	err = bcm2835_audio_open_connection(alsa_stream);
+	if (err < 0)
 		goto free_wq;
 
 	instance = alsa_stream->instance;
-	LOG_DBG(" instance (%p)\n", instance);
-
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	m.type = VC_AUDIO_MSG_TYPE_OPEN;
-
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
-
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
-
-		ret = -1;
-		goto unlock;
-	}
 
-	ret = 0;
+	err = bcm2835_audio_send_simple(instance, VC_AUDIO_MSG_TYPE_OPEN,
+					false);
+	if (err < 0)
+		goto deinit;
 
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
+	bcm2835_audio_lock(instance);
+	vchi_get_peer_version(instance->vchi_handle, &instance->peer_version);
+	bcm2835_audio_unlock(instance);
+	if (instance->peer_version < 2 || force_bulk)
+		instance->max_packet = 0; /* bulk transfer */
+	else
+		instance->max_packet = 4000;
 
-free_wq:
-	if (ret)
-		destroy_workqueue(alsa_stream->my_wq);
+	return 0;
 
-	return ret;
+ deinit:
+	vc_vchi_audio_deinit(instance);
+ free_wq:
+	destroy_workqueue(alsa_stream->my_wq);
+	return err;
 }
 
 int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 {
-	struct vc_audio_msg m;
-	struct bcm2835_audio_instance *instance = alsa_stream->instance;
 	struct bcm2835_chip *chip = alsa_stream->chip;
-	int status;
-	int ret;
-
-	LOG_INFO(" Setting ALSA dest(%d), volume(%d)\n",
-		 chip->dest, chip->volume);
-
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	instance->result = -1;
+	struct vc_audio_msg m = {};
 
 	m.type = VC_AUDIO_MSG_TYPE_CONTROL;
 	m.u.control.dest = chip->dest;
@@ -429,289 +455,107 @@ int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 	else
 		m.u.control.volume = alsa2chip(chip->volume);
 
-	/* Create the message available completion */
-	init_completion(&instance->msg_avail_comp);
-
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
-
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	/* We are expecting a reply from the videocore */
-	wait_for_completion(&instance->msg_avail_comp);
-
-	if (instance->result) {
-		LOG_ERR("%s: result=%d\n", __func__, instance->result);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	ret = 0;
-
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
-
-	return ret;
+	return bcm2835_audio_send_msg(alsa_stream->instance, &m, true);
 }
 
 int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 			     unsigned int channels, unsigned int samplerate,
 			     unsigned int bps)
 {
-	struct vc_audio_msg m;
-	struct bcm2835_audio_instance *instance = alsa_stream->instance;
-	int status;
-	int ret;
-
-	LOG_INFO(" Setting ALSA channels(%d), samplerate(%d), bits-per-sample(%d)\n",
-		 channels, samplerate, bps);
+	struct vc_audio_msg m = {
+		 .type = VC_AUDIO_MSG_TYPE_CONFIG,
+		 .u.config.channels = channels,
+		 .u.config.samplerate = samplerate,
+		 .u.config.bps = bps,
+	};
+	int err;
 
 	/* resend ctls - alsa_stream may not have been open when first send */
-	ret = bcm2835_audio_set_ctls(alsa_stream);
-	if (ret) {
-		LOG_ERR(" Alsa controls not supported\n");
-		return -EINVAL;
-	}
-
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	instance->result = -1;
-
-	m.type = VC_AUDIO_MSG_TYPE_CONFIG;
-	m.u.config.channels = channels;
-	m.u.config.samplerate = samplerate;
-	m.u.config.bps = bps;
-
-	/* Create the message available completion */
-	init_completion(&instance->msg_avail_comp);
-
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
-
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	/* We are expecting a reply from the videocore */
-	wait_for_completion(&instance->msg_avail_comp);
-
-	if (instance->result) {
-		LOG_ERR("%s: result=%d", __func__, instance->result);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	ret = 0;
-
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
+	err = bcm2835_audio_set_ctls(alsa_stream);
+	if (err)
+		return err;
 
-	return ret;
+	return bcm2835_audio_send_msg(alsa_stream->instance, &m, true);
 }
 
 static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream)
 {
-	struct vc_audio_msg m;
-	struct bcm2835_audio_instance *instance = alsa_stream->instance;
-	int status;
-	int ret;
-
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	m.type = VC_AUDIO_MSG_TYPE_START;
-
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
-
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	ret = 0;
-
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
-	return ret;
+	return bcm2835_audio_send_simple(alsa_stream->instance,
+					 VC_AUDIO_MSG_TYPE_START, false);
 }
 
 static int bcm2835_audio_stop_worker(struct bcm2835_alsa_stream *alsa_stream)
 {
-	struct vc_audio_msg m;
-	struct bcm2835_audio_instance *instance = alsa_stream->instance;
-	int status;
-	int ret;
-
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	m.type = VC_AUDIO_MSG_TYPE_STOP;
-	m.u.stop.draining = alsa_stream->draining;
-
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
-
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	ret = 0;
-
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
-	return ret;
+	return bcm2835_audio_send_simple(alsa_stream->instance,
+					 VC_AUDIO_MSG_TYPE_STOP, false);
 }
 
 int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream)
 {
-	struct vc_audio_msg m;
 	struct bcm2835_audio_instance *instance = alsa_stream->instance;
-	int status;
-	int ret;
+	int err;
 
 	my_workqueue_quit(alsa_stream);
 
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	m.type = VC_AUDIO_MSG_TYPE_CLOSE;
-
-	/* Create the message available completion */
-	init_completion(&instance->msg_avail_comp);
-
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
-
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
-		ret = -1;
-		goto unlock;
-	}
-
-	/* We are expecting a reply from the videocore */
-	wait_for_completion(&instance->msg_avail_comp);
-
-	if (instance->result) {
-		LOG_ERR("%s: failed result (result=%d)\n",
-			__func__, instance->result);
-
-		ret = -1;
-		goto unlock;
-	}
-
-	ret = 0;
-
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
+	err = bcm2835_audio_send_simple(alsa_stream->instance,
+					VC_AUDIO_MSG_TYPE_CLOSE, true);
 
 	/* Stop the audio service */
 	vc_vchi_audio_deinit(instance);
 	alsa_stream->instance = NULL;
 
-	return ret;
+	return err;
 }
 
 static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
-				      unsigned int count, void *src)
+				      unsigned int size, void *src)
 {
-	struct vc_audio_msg m;
 	struct bcm2835_audio_instance *instance = alsa_stream->instance;
-	int status;
-	int ret;
-
-	LOG_INFO(" Writing %d bytes from %p\n", count, src);
-
-	mutex_lock(&instance->vchi_mutex);
-	vchi_service_use(instance->vchi_handle);
-
-	if (instance->peer_version == 0 &&
-	    vchi_get_peer_version(instance->vchi_handle, &instance->peer_version) == 0)
-		LOG_DBG("%s: client version %d connected\n", __func__, instance->peer_version);
+	struct vc_audio_msg m = {
+		.type = VC_AUDIO_MSG_TYPE_WRITE,
+		.u.write.count = size,
+		.u.write.max_packet = instance->max_packet,
+		.u.write.cookie1 = BCM2835_AUDIO_WRITE_COOKIE1,
+		.u.write.cookie2 = BCM2835_AUDIO_WRITE_COOKIE2,
+	};
+	unsigned int count;
+	int err, status;
 
-	m.type = VC_AUDIO_MSG_TYPE_WRITE;
-	m.u.write.count = count;
-	// old version uses bulk, new version uses control
-	m.u.write.max_packet = instance->peer_version < 2 || force_bulk ? 0 : 4000;
-	m.u.write.cookie1 = BCM2835_AUDIO_WRITE_COOKIE1;
-	m.u.write.cookie2 = BCM2835_AUDIO_WRITE_COOKIE2;
-	m.u.write.silence = src == NULL;
+	if (!size)
+		return 0;
 
-	/* Send the message to the videocore */
-	status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-					&m, sizeof(m));
+	bcm2835_audio_lock(instance);
+	err = bcm2835_audio_send_msg_locked(instance, &m, false);
+	if (err < 0)
+		goto unlock;
 
-	if (status) {
-		LOG_ERR("%s: failed on vchi_msg_queue (status=%d)\n",
-			__func__, status);
+	count = size;
+	if (!instance->max_packet) {
+		/* Send the message to the videocore */
+		status = vchi_bulk_queue_transmit(instance->vchi_handle,
+						  src, count,
+						  VCHI_FLAGS_BLOCK_UNTIL_DATA_READ,
+						  NULL);
+	} else {
+		while (count > 0) {
+			int bytes = min(instance->max_packet, count);
 
-		ret = -1;
-		goto unlock;
-	}
-	if (!m.u.write.silence) {
-		if (!m.u.write.max_packet) {
-			/* Send the message to the videocore */
-			status = vchi_bulk_queue_transmit(instance->vchi_handle,
-							  src, count,
-							  0 * VCHI_FLAGS_BLOCK_UNTIL_QUEUED
-							  +
-							  1 * VCHI_FLAGS_BLOCK_UNTIL_DATA_READ,
-							  NULL);
-		} else {
-			while (count > 0) {
-				int bytes = min_t(int, m.u.write.max_packet, count);
-
-				status = bcm2835_vchi_msg_queue(instance->vchi_handle,
-								src, bytes);
-				src = (char *)src + bytes;
-				count -= bytes;
-			}
+			status = vchi_queue_kernel_message(instance->vchi_handle,
+							   src, bytes);
+			src += bytes;
+			count -= bytes;
 		}
-		if (status) {
-			LOG_ERR("%s: failed on vchi_bulk_queue_transmit (status=%d)\n",
-				__func__, status);
+	}
 
-			ret = -1;
-			goto unlock;
-		}
+	if (status) {
+		LOG_ERR("failed on %d bytes transfer (status=%d)\n",
+			size, status);
+		err = -EIO;
 	}
-	ret = 0;
 
-unlock:
-	vchi_service_release(instance->vchi_handle);
-	mutex_unlock(&instance->vchi_mutex);
-	return ret;
+ unlock:
+	bcm2835_audio_unlock(instance);
+	return err;
 }
 
 unsigned int bcm2835_audio_retrieve_buffers(struct bcm2835_alsa_stream *alsa_stream)
-- 
GitLab


From bcc5def6f0e80412edc624649c11e6f4dcf6643c Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:49 +0200
Subject: [PATCH 0460/1835] staging: bcm2835-audio: Operate non-atomic PCM ops

commit 5c7883e5f27e829f3f3a2ba174d4a724bfd5f026 upstream.

This is the most significant part in the patch series.

The bcm2835-audio driver used to queue the commands to vc04 core via
workqueue, but basically the whole accesses to vc04 core are done in
the sleepable context, including the callback calls.  In such a case,
rewriting the code using non-atomic PCM ops will simplify the logic a
lot.

This patch does it: all workqueue are gone and each former-work
implementation is now directly called from PCM ops like trigger and
write transfer.

Along with it, the DMA position updater, bcm2835_playback_fifo(), was
also rewritten to use a simpler logic.  Now it handles the XRUN and
draining properly by calling snd_pcm_stop() conditionally.

The current position is kept in atomic_t value so that it can be read
concurrently from the pointer callback.

Also, the bcm2835_audio_instance object is allocated at the beginning
of bcm2835_audio_open().  This makes the resource management clearer.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c |  74 +++---
 .../bcm2835-audio/bcm2835-vchiq.c             | 244 +++---------------
 .../vc04_services/bcm2835-audio/bcm2835.h     |   9 +-
 3 files changed, 82 insertions(+), 245 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 6d89db6e14e4a..38969b5dfb579 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -11,7 +11,8 @@
 /* hardware definition */
 static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 	.info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
-	SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID),
+		 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
+		 SNDRV_PCM_INFO_DRAIN_TRIGGER),
 	.formats = SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
 	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min = 8000,
@@ -27,7 +28,8 @@ static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 
 static const struct snd_pcm_hardware snd_bcm2835_playback_spdif_hw = {
 	.info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
-	SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID),
+		 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
+		 SNDRV_PCM_INFO_DRAIN_TRIGGER),
 	.formats = SNDRV_PCM_FMTBIT_S16_LE,
 	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_44100 |
 	SNDRV_PCM_RATE_48000,
@@ -47,42 +49,34 @@ static void snd_bcm2835_playback_free(struct snd_pcm_runtime *runtime)
 	kfree(runtime->private_data);
 }
 
-void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream)
+void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream,
+			   unsigned int bytes)
 {
-	unsigned int consumed = 0;
-	int new_period = 0;
-
-	audio_info("alsa_stream=%p substream=%p\n", alsa_stream,
-		alsa_stream ? alsa_stream->substream : 0);
-
-	consumed = bcm2835_audio_retrieve_buffers(alsa_stream);
-
-	/* We get called only if playback was triggered, So, the number of buffers we retrieve in
-	 * each iteration are the buffers that have been played out already
-	 */
-
-	if (alsa_stream->period_size) {
-		if ((alsa_stream->pos / alsa_stream->period_size) !=
-			((alsa_stream->pos + consumed) / alsa_stream->period_size))
-			new_period = 1;
-	}
-	audio_debug("updating pos cur: %d + %d max:%d period_bytes:%d, hw_ptr: %d new_period:%d\n",
-		alsa_stream->pos,
-		consumed,
-		alsa_stream->buffer_size,
-		(int) (alsa_stream->period_size * alsa_stream->substream->runtime->periods),
-		frames_to_bytes(alsa_stream->substream->runtime, alsa_stream->substream->runtime->status->hw_ptr),
-		new_period);
-	if (alsa_stream->buffer_size) {
-		alsa_stream->pos += consumed & ~(1 << 30);
-		alsa_stream->pos %= alsa_stream->buffer_size;
+	struct snd_pcm_substream *substream = alsa_stream->substream;
+	unsigned int pos;
+
+	if (!alsa_stream->period_size)
+		return;
+
+	if (bytes >= alsa_stream->buffer_size) {
+		snd_pcm_stream_lock(substream);
+		snd_pcm_stop(substream,
+			     alsa_stream->draining ?
+			     SNDRV_PCM_STATE_SETUP :
+			     SNDRV_PCM_STATE_XRUN);
+		snd_pcm_stream_unlock(substream);
+		return;
 	}
 
-	if (alsa_stream->substream) {
-		if (new_period)
-			snd_pcm_period_elapsed(alsa_stream->substream);
-	} else {
-		audio_warning(" unexpected NULL substream\n");
+	pos = atomic_read(&alsa_stream->pos);
+	pos += bytes;
+	pos %= alsa_stream->buffer_size;
+	atomic_set(&alsa_stream->pos, pos);
+
+	alsa_stream->period_offset += bytes;
+	if (alsa_stream->period_offset >= alsa_stream->period_size) {
+		alsa_stream->period_offset %= alsa_stream->period_size;
+		snd_pcm_period_elapsed(substream);
 	}
 }
 
@@ -246,7 +240,8 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 
 	alsa_stream->buffer_size = snd_pcm_lib_buffer_bytes(substream);
 	alsa_stream->period_size = snd_pcm_lib_period_bytes(substream);
-	alsa_stream->pos = 0;
+	atomic_set(&alsa_stream->pos, 0);
+	alsa_stream->period_offset = 0;
 	alsa_stream->draining = false;
 
 	return 0;
@@ -283,7 +278,7 @@ static int snd_bcm2835_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 		return bcm2835_audio_start(alsa_stream);
 	case SNDRV_PCM_TRIGGER_DRAIN:
 		alsa_stream->draining = true;
-		return 0;
+		return bcm2835_audio_drain(alsa_stream);
 	case SNDRV_PCM_TRIGGER_STOP:
 		return bcm2835_audio_stop(alsa_stream);
 	default:
@@ -300,7 +295,7 @@ snd_bcm2835_pcm_pointer(struct snd_pcm_substream *substream)
 
 	return snd_pcm_indirect_playback_pointer(substream,
 		&alsa_stream->pcm_indirect,
-		alsa_stream->pos);
+		atomic_read(&alsa_stream->pos));
 }
 
 /* operators */
@@ -338,6 +333,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels)
 	if (err < 0)
 		return err;
 	pcm->private_data = chip;
+	pcm->nonatomic = true;
 	strcpy(pcm->name, "bcm2835 ALSA");
 	chip->pcm = pcm;
 	chip->dest = AUDIO_DEST_AUTO;
@@ -367,6 +363,7 @@ int snd_bcm2835_new_spdif_pcm(struct bcm2835_chip *chip)
 		return err;
 
 	pcm->private_data = chip;
+	pcm->nonatomic = true;
 	strcpy(pcm->name, "bcm2835 IEC958/HDMI");
 	chip->pcm_spdif = pcm;
 	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
@@ -395,6 +392,7 @@ int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
 		return err;
 
 	pcm->private_data = chip;
+	pcm->nonatomic = true;
 	strcpy(pcm->name, name);
 	chip->pcm = pcm;
 	chip->dest = route;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 96d3083e8add4..d7e2718e050f9 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -26,10 +26,6 @@
 
 /* ---- Private Constants and Types ------------------------------------------ */
 
-#define BCM2835_AUDIO_STOP           0
-#define BCM2835_AUDIO_START          1
-#define BCM2835_AUDIO_WRITE          2
-
 /* Logging macros (for remapping to other logging mechanisms, i.e., printf) */
 #ifdef AUDIO_DEBUG_ENABLE
 #define LOG_ERR(fmt, arg...)   pr_err("%s:%d " fmt, __func__, __LINE__, ##arg)
@@ -55,17 +51,6 @@ struct bcm2835_audio_instance {
 
 static bool force_bulk;
 
-/* ---- Private Variables ---------------------------------------------------- */
-
-/* ---- Private Function Prototypes ------------------------------------------ */
-
-/* ---- Private Functions ---------------------------------------------------- */
-
-static int bcm2835_audio_stop_worker(struct bcm2835_alsa_stream *alsa_stream);
-static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream);
-static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
-				      unsigned int count, void *src);
-
 static void bcm2835_audio_lock(struct bcm2835_audio_instance *instance)
 {
 	mutex_lock(&instance->vchi_mutex);
@@ -135,108 +120,6 @@ static const u32 BCM2835_AUDIO_WRITE_COOKIE1 = ('B' << 24 | 'C' << 16 |
 static const u32 BCM2835_AUDIO_WRITE_COOKIE2 = ('D' << 24 | 'A' << 16 |
 						'T' << 8  | 'A');
 
-struct bcm2835_audio_work {
-	struct work_struct my_work;
-	struct bcm2835_alsa_stream *alsa_stream;
-	int cmd;
-	void *src;
-	unsigned int count;
-};
-
-static void my_wq_function(struct work_struct *work)
-{
-	struct bcm2835_audio_work *w =
-		container_of(work, struct bcm2835_audio_work, my_work);
-	int ret = -9;
-
-	switch (w->cmd) {
-	case BCM2835_AUDIO_START:
-		ret = bcm2835_audio_start_worker(w->alsa_stream);
-		break;
-	case BCM2835_AUDIO_STOP:
-		ret = bcm2835_audio_stop_worker(w->alsa_stream);
-		break;
-	case BCM2835_AUDIO_WRITE:
-		ret = bcm2835_audio_write_worker(w->alsa_stream, w->count,
-						 w->src);
-		break;
-	default:
-		LOG_ERR(" Unexpected work: %p:%d\n", w->alsa_stream, w->cmd);
-		break;
-	}
-	kfree((void *)work);
-}
-
-int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream)
-{
-	struct bcm2835_audio_work *work;
-
-	work = kmalloc(sizeof(*work), GFP_ATOMIC);
-	/*--- Queue some work (item 1) ---*/
-	if (!work) {
-		LOG_ERR(" .. Error: NULL work kmalloc\n");
-		return -ENOMEM;
-	}
-	INIT_WORK(&work->my_work, my_wq_function);
-	work->alsa_stream = alsa_stream;
-	work->cmd = BCM2835_AUDIO_START;
-	if (!queue_work(alsa_stream->my_wq, &work->my_work)) {
-		kfree(work);
-		return -EBUSY;
-	}
-	return 0;
-}
-
-int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream)
-{
-	struct bcm2835_audio_work *work;
-
-	work = kmalloc(sizeof(*work), GFP_ATOMIC);
-	/*--- Queue some work (item 1) ---*/
-	if (!work) {
-		LOG_ERR(" .. Error: NULL work kmalloc\n");
-		return -ENOMEM;
-	}
-	INIT_WORK(&work->my_work, my_wq_function);
-	work->alsa_stream = alsa_stream;
-	work->cmd = BCM2835_AUDIO_STOP;
-	if (!queue_work(alsa_stream->my_wq, &work->my_work)) {
-		kfree(work);
-		return -EBUSY;
-	}
-	return 0;
-}
-
-int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
-			unsigned int count, void *src)
-{
-	struct bcm2835_audio_work *work;
-
-	work = kmalloc(sizeof(*work), GFP_ATOMIC);
-	/*--- Queue some work (item 1) ---*/
-	if (!work) {
-		LOG_ERR(" .. Error: NULL work kmalloc\n");
-		return -ENOMEM;
-	}
-	INIT_WORK(&work->my_work, my_wq_function);
-	work->alsa_stream = alsa_stream;
-	work->cmd = BCM2835_AUDIO_WRITE;
-	work->src = src;
-	work->count = count;
-	if (!queue_work(alsa_stream->my_wq, &work->my_work)) {
-		kfree(work);
-		return -EBUSY;
-	}
-	return 0;
-}
-
-static void my_workqueue_quit(struct bcm2835_alsa_stream *alsa_stream)
-{
-	flush_workqueue(alsa_stream->my_wq);
-	destroy_workqueue(alsa_stream->my_wq);
-	alsa_stream->my_wq = NULL;
-}
-
 static void audio_vchi_callback(void *param,
 				const VCHI_CALLBACK_REASON_T reason,
 				void *msg_handle)
@@ -249,47 +132,27 @@ static void audio_vchi_callback(void *param,
 	if (reason != VCHI_CALLBACK_MSG_AVAILABLE)
 		return;
 
-	if (!instance) {
-		LOG_ERR(" .. instance is null\n");
-		BUG();
-		return;
-	}
-	if (!instance->vchi_handle) {
-		LOG_ERR(" .. instance->vchi_handle is null\n");
-		BUG();
-		return;
-	}
 	status = vchi_msg_dequeue(instance->vchi_handle,
 				  &m, sizeof(m), &msg_len, VCHI_FLAGS_NONE);
 	if (m.type == VC_AUDIO_MSG_TYPE_RESULT) {
-		LOG_DBG(" .. instance=%p, m.type=VC_AUDIO_MSG_TYPE_RESULT, success=%d\n",
-			instance, m.u.result.success);
 		instance->result = m.u.result.success;
 		complete(&instance->msg_avail_comp);
 	} else if (m.type == VC_AUDIO_MSG_TYPE_COMPLETE) {
-		struct bcm2835_alsa_stream *alsa_stream = instance->alsa_stream;
-
-		LOG_DBG(" .. instance=%p, m.type=VC_AUDIO_MSG_TYPE_COMPLETE, complete=%d\n",
-			instance, m.u.complete.count);
 		if (m.u.complete.cookie1 != BCM2835_AUDIO_WRITE_COOKIE1 ||
 		    m.u.complete.cookie2 != BCM2835_AUDIO_WRITE_COOKIE2)
-			LOG_ERR(" .. response is corrupt\n");
-		else if (alsa_stream) {
-			atomic_add(m.u.complete.count,
-				   &alsa_stream->retrieved);
-			bcm2835_playback_fifo(alsa_stream);
-		} else {
-			LOG_ERR(" .. unexpected alsa_stream=%p\n",
-				alsa_stream);
-		}
+			LOG_ERR("invalid cookie\n");
+		else
+			bcm2835_playback_fifo(instance->alsa_stream,
+					      m.u.complete.count);
 	} else {
-		LOG_ERR(" .. unexpected m.type=%d\n", m.type);
+		LOG_ERR("unexpected callback type=%d\n", m.type);
 	}
 }
 
-static struct bcm2835_audio_instance *
+static int
 vc_vchi_audio_init(VCHI_INSTANCE_T vchi_instance,
-		   VCHI_CONNECTION_T *vchi_connection)
+		   VCHI_CONNECTION_T *vchi_connection,
+		   struct bcm2835_audio_instance *instance)
 {
 	SERVICE_CREATION_T params = {
 		.version		= VCHI_VERSION_EX(VC_AUDIOSERV_VER, VC_AUDIOSERV_MIN_VER),
@@ -298,23 +161,14 @@ vc_vchi_audio_init(VCHI_INSTANCE_T vchi_instance,
 		.rx_fifo_size		= 0,
 		.tx_fifo_size		= 0,
 		.callback		= audio_vchi_callback,
+		.callback_param		= instance,
 		.want_unaligned_bulk_rx = 1, //TODO: remove VCOS_FALSE
 		.want_unaligned_bulk_tx = 1, //TODO: remove VCOS_FALSE
 		.want_crc		= 0
 	};
-	struct bcm2835_audio_instance *instance;
 	int status;
 
-	/* Allocate memory for this instance */
-	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
-	if (!instance)
-		return ERR_PTR(-ENOMEM);
-
-	/* Create a lock for exclusive, serialized VCHI connection access */
-	mutex_init(&instance->vchi_mutex);
 	/* Open the VCHI service connections */
-	params.callback_param = instance,
-
 	status = vchi_service_open(vchi_instance, &params,
 				   &instance->vchi_handle);
 
@@ -322,16 +176,16 @@ vc_vchi_audio_init(VCHI_INSTANCE_T vchi_instance,
 		LOG_ERR("%s: failed to open VCHI service connection (status=%d)\n",
 			__func__, status);
 		kfree(instance);
-		return ERR_PTR(-EPERM);
+		return -EPERM;
 	}
 
 	/* Finished with the service for now */
 	vchi_service_release(instance->vchi_handle);
 
-	return instance;
+	return 0;
 }
 
-static int vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
+static void vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
 {
 	int status;
 
@@ -346,10 +200,6 @@ static int vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
 	}
 
 	mutex_unlock(&instance->vchi_mutex);
-
-	kfree(instance);
-
-	return 0;
 }
 
 int bcm2835_new_vchi_ctx(struct bcm2835_vchi_ctx *vchi_ctx)
@@ -387,39 +237,25 @@ void bcm2835_free_vchi_ctx(struct bcm2835_vchi_ctx *vchi_ctx)
 	vchi_ctx->vchi_instance = NULL;
 }
 
-static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream)
-{
-	struct bcm2835_audio_instance *instance =
-		(struct bcm2835_audio_instance *)alsa_stream->instance;
-	struct bcm2835_vchi_ctx *vhci_ctx = alsa_stream->chip->vchi_ctx;
-
-	/* Initialize an instance of the audio service */
-	instance = vc_vchi_audio_init(vhci_ctx->vchi_instance,
-				      vhci_ctx->vchi_connection);
-
-	if (IS_ERR(instance))
-		return PTR_ERR(instance);
-
-	instance->alsa_stream = alsa_stream;
-	alsa_stream->instance = instance;
-
-	return 0;
-}
-
 int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 {
+	struct bcm2835_vchi_ctx *vchi_ctx = alsa_stream->chip->vchi_ctx;
 	struct bcm2835_audio_instance *instance;
 	int err;
 
-	alsa_stream->my_wq = alloc_workqueue("my_queue", WQ_HIGHPRI, 1);
-	if (!alsa_stream->my_wq)
+	/* Allocate memory for this instance */
+	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
+	if (!instance)
 		return -ENOMEM;
+	mutex_init(&instance->vchi_mutex);
+	instance->alsa_stream = alsa_stream;
+	alsa_stream->instance = instance;
 
-	err = bcm2835_audio_open_connection(alsa_stream);
+	err = vc_vchi_audio_init(vchi_ctx->vchi_instance,
+				 vchi_ctx->vchi_connection,
+				 instance);
 	if (err < 0)
-		goto free_wq;
-
-	instance = alsa_stream->instance;
+		goto free_instance;
 
 	err = bcm2835_audio_send_simple(instance, VC_AUDIO_MSG_TYPE_OPEN,
 					false);
@@ -438,8 +274,9 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 
  deinit:
 	vc_vchi_audio_deinit(instance);
- free_wq:
-	destroy_workqueue(alsa_stream->my_wq);
+ free_instance:
+	alsa_stream->instance = NULL;
+	kfree(instance);
 	return err;
 }
 
@@ -478,37 +315,46 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 	return bcm2835_audio_send_msg(alsa_stream->instance, &m, true);
 }
 
-static int bcm2835_audio_start_worker(struct bcm2835_alsa_stream *alsa_stream)
+int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream)
 {
 	return bcm2835_audio_send_simple(alsa_stream->instance,
 					 VC_AUDIO_MSG_TYPE_START, false);
 }
 
-static int bcm2835_audio_stop_worker(struct bcm2835_alsa_stream *alsa_stream)
+int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream)
 {
 	return bcm2835_audio_send_simple(alsa_stream->instance,
 					 VC_AUDIO_MSG_TYPE_STOP, false);
 }
 
+int bcm2835_audio_drain(struct bcm2835_alsa_stream *alsa_stream)
+{
+	struct vc_audio_msg m = {
+		.type = VC_AUDIO_MSG_TYPE_STOP,
+		.u.stop.draining = 1,
+	};
+
+	return bcm2835_audio_send_msg(alsa_stream->instance, &m, false);
+}
+
 int bcm2835_audio_close(struct bcm2835_alsa_stream *alsa_stream)
 {
 	struct bcm2835_audio_instance *instance = alsa_stream->instance;
 	int err;
 
-	my_workqueue_quit(alsa_stream);
-
 	err = bcm2835_audio_send_simple(alsa_stream->instance,
 					VC_AUDIO_MSG_TYPE_CLOSE, true);
 
 	/* Stop the audio service */
 	vc_vchi_audio_deinit(instance);
 	alsa_stream->instance = NULL;
+	kfree(instance);
 
 	return err;
 }
 
-static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
-				      unsigned int size, void *src)
+int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
+			unsigned int size, void *src)
 {
 	struct bcm2835_audio_instance *instance = alsa_stream->instance;
 	struct vc_audio_msg m = {
@@ -558,13 +404,5 @@ static int bcm2835_audio_write_worker(struct bcm2835_alsa_stream *alsa_stream,
 	return err;
 }
 
-unsigned int bcm2835_audio_retrieve_buffers(struct bcm2835_alsa_stream *alsa_stream)
-{
-	unsigned int count = atomic_read(&alsa_stream->retrieved);
-
-	atomic_sub(count, &alsa_stream->retrieved);
-	return count;
-}
-
 module_param(force_bulk, bool, 0444);
 MODULE_PARM_DESC(force_bulk, "Force use of vchiq bulk for audio");
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 3bf128422a6fd..a3c181613374a 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -121,13 +121,12 @@ struct bcm2835_alsa_stream {
 
 	int draining;
 
-	unsigned int pos;
+	atomic_t pos;
+	unsigned int period_offset;
 	unsigned int buffer_size;
 	unsigned int period_size;
 
-	atomic_t retrieved;
 	struct bcm2835_audio_instance *instance;
-	struct workqueue_struct *my_wq;
 	int idx;
 };
 
@@ -152,11 +151,13 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 			     unsigned int bps);
 int bcm2835_audio_start(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_stop(struct bcm2835_alsa_stream *alsa_stream);
+int bcm2835_audio_drain(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream);
 int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 			unsigned int count,
 			void *src);
-void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream);
+void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream,
+			   unsigned int size);
 unsigned int bcm2835_audio_retrieve_buffers(struct bcm2835_alsa_stream *alsa_stream);
 
 #endif /* __SOUND_ARM_BCM2835_H */
-- 
GitLab


From a87c9b82349b530d4b9fa303fd11f3dab1048735 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:50 +0200
Subject: [PATCH 0461/1835] staging: bcm2835-audio: Use card->private_data

commit 898001a0c845cefe5d47d133485712412853f0a8 upstream.

Instead of allocating a separate snd_device object, let snd_card_new()
allocate the private resource.  This simplifies the code.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 91 +++----------------
 1 file changed, 13 insertions(+), 78 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 6876a5eadc07f..55e7fbc3ec44d 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -86,9 +86,6 @@ static int bcm2835_devm_add_vchi_ctx(struct device *dev)
 
 static void snd_bcm2835_release(struct device *dev)
 {
-	struct bcm2835_chip *chip = dev_get_drvdata(dev);
-
-	kfree(chip);
 }
 
 static struct device *
@@ -117,69 +114,6 @@ snd_create_device(struct device *parent,
 	return device;
 }
 
-/* component-destructor
- * (see "Management of Cards and Components")
- */
-static int snd_bcm2835_dev_free(struct snd_device *device)
-{
-	struct bcm2835_chip *chip = device->device_data;
-	struct snd_card *card = chip->card;
-
-	snd_device_free(card, chip);
-
-	return 0;
-}
-
-/* chip-specific constructor
- * (see "Management of Cards and Components")
- */
-static int snd_bcm2835_create(struct snd_card *card,
-			      struct bcm2835_chip **rchip)
-{
-	struct bcm2835_chip *chip;
-	int err;
-	static struct snd_device_ops ops = {
-		.dev_free = snd_bcm2835_dev_free,
-	};
-
-	*rchip = NULL;
-
-	chip = kzalloc(sizeof(*chip), GFP_KERNEL);
-	if (!chip)
-		return -ENOMEM;
-
-	chip->card = card;
-	mutex_init(&chip->audio_mutex);
-
-	chip->vchi_ctx = devres_find(card->dev->parent,
-				     bcm2835_devm_free_vchi_ctx, NULL, NULL);
-	if (!chip->vchi_ctx) {
-		kfree(chip);
-		return -ENODEV;
-	}
-
-	err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
-	if (err) {
-		kfree(chip);
-		return err;
-	}
-
-	*rchip = chip;
-	return 0;
-}
-
-static struct snd_card *snd_bcm2835_card_new(struct device *dev)
-{
-	struct snd_card *card;
-	int ret;
-
-	ret = snd_card_new(dev, -1, NULL, THIS_MODULE, 0, &card);
-	if (ret)
-		return ERR_PTR(ret);
-
-	return card;
-}
-
 typedef int (*bcm2835_audio_newpcm_func)(struct bcm2835_chip *chip,
 					 const char *name,
 					 enum snd_bcm2835_route route,
@@ -292,25 +226,26 @@ static int snd_add_child_device(struct device *device,
 		return PTR_ERR(child);
 	}
 
-	card = snd_bcm2835_card_new(child);
-	if (IS_ERR(card)) {
+	err = snd_card_new(child, -1, NULL, THIS_MODULE, sizeof(*chip), &card);
+	if (err < 0) {
 		dev_err(child, "Failed to create card");
-		return PTR_ERR(card);
+		return err;
 	}
 
-	snd_card_set_dev(card, child);
+	chip = card->private_data;
+	chip->card = card;
+	chip->dev = child;
+	mutex_init(&chip->audio_mutex);
+
+	chip->vchi_ctx = devres_find(device,
+				     bcm2835_devm_free_vchi_ctx, NULL, NULL);
+	if (!chip->vchi_ctx)
+		return -ENODEV;
+
 	strcpy(card->driver, audio_driver->driver.name);
 	strcpy(card->shortname, audio_driver->shortname);
 	strcpy(card->longname, audio_driver->longname);
 
-	err = snd_bcm2835_create(card, &chip);
-	if (err) {
-		dev_err(child, "Failed to create chip, error %d\n", err);
-		return err;
-	}
-
-	chip->dev = child;
-
 	err = audio_driver->newpcm(chip, audio_driver->shortname,
 		audio_driver->route,
 		numchans);
-- 
GitLab


From db3aae93fc0b425fea1903ee4a4308754f911444 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:51 +0200
Subject: [PATCH 0462/1835] staging: bcm2835-audio: Use standard error print
 helpers

commit b7584b64168208ebc14160770c0966b8b12fc16b upstream.

For making the whole code more consistent, replace the home-made debug
print macros with the standard dev_err() & co.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c |  4 +-
 .../bcm2835-audio/bcm2835-vchiq.c             | 52 ++++++++-----------
 .../vc04_services/bcm2835-audio/bcm2835.c     |  2 +-
 .../vc04_services/bcm2835-audio/bcm2835.h     | 43 +--------------
 4 files changed, 27 insertions(+), 74 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 38969b5dfb579..d2373e4a4d535 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -101,8 +101,8 @@ static int snd_bcm2835_playback_open_generic(
 		goto out;
 	}
 	if (idx >= MAX_SUBSTREAMS) {
-		audio_error
-			("substream(%d) device doesn't exist max(%d) substreams allowed\n",
+		dev_err(chip->dev,
+			"substream(%d) device doesn't exist max(%d) substreams allowed\n",
 			idx, MAX_SUBSTREAMS);
 		err = -ENODEV;
 		goto out;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index d7e2718e050f9..7fff5c63e33f7 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -26,20 +26,8 @@
 
 /* ---- Private Constants and Types ------------------------------------------ */
 
-/* Logging macros (for remapping to other logging mechanisms, i.e., printf) */
-#ifdef AUDIO_DEBUG_ENABLE
-#define LOG_ERR(fmt, arg...)   pr_err("%s:%d " fmt, __func__, __LINE__, ##arg)
-#define LOG_WARN(fmt, arg...)  pr_info("%s:%d " fmt, __func__, __LINE__, ##arg)
-#define LOG_INFO(fmt, arg...)  pr_info("%s:%d " fmt, __func__, __LINE__, ##arg)
-#define LOG_DBG(fmt, arg...)   pr_info("%s:%d " fmt, __func__, __LINE__, ##arg)
-#else
-#define LOG_ERR(fmt, arg...)   pr_err("%s:%d " fmt, __func__, __LINE__, ##arg)
-#define LOG_WARN(fmt, arg...)	 no_printk(fmt, ##arg)
-#define LOG_INFO(fmt, arg...)	 no_printk(fmt, ##arg)
-#define LOG_DBG(fmt, arg...)	 no_printk(fmt, ##arg)
-#endif
-
 struct bcm2835_audio_instance {
+	struct device *dev;
 	VCHI_SERVICE_HANDLE_T vchi_handle;
 	struct completion msg_avail_comp;
 	struct mutex vchi_mutex;
@@ -76,7 +64,8 @@ static int bcm2835_audio_send_msg_locked(struct bcm2835_audio_instance *instance
 	status = vchi_queue_kernel_message(instance->vchi_handle,
 					   m, sizeof(*m));
 	if (status) {
-		LOG_ERR("vchi message queue failed: %d, msg=%d\n",
+		dev_err(instance->dev,
+			"vchi message queue failed: %d, msg=%d\n",
 			status, m->type);
 		return -EIO;
 	}
@@ -84,10 +73,12 @@ static int bcm2835_audio_send_msg_locked(struct bcm2835_audio_instance *instance
 	if (wait) {
 		if (!wait_for_completion_timeout(&instance->msg_avail_comp,
 						 msecs_to_jiffies(10 * 1000))) {
-			LOG_ERR("vchi message timeout, msg=%d\n", m->type);
+			dev_err(instance->dev,
+				"vchi message timeout, msg=%d\n", m->type);
 			return -ETIMEDOUT;
 		} else if (instance->result) {
-			LOG_ERR("vchi message response error:%d, msg=%d\n",
+			dev_err(instance->dev,
+				"vchi message response error:%d, msg=%d\n",
 				instance->result, m->type);
 			return -EIO;
 		}
@@ -140,12 +131,12 @@ static void audio_vchi_callback(void *param,
 	} else if (m.type == VC_AUDIO_MSG_TYPE_COMPLETE) {
 		if (m.u.complete.cookie1 != BCM2835_AUDIO_WRITE_COOKIE1 ||
 		    m.u.complete.cookie2 != BCM2835_AUDIO_WRITE_COOKIE2)
-			LOG_ERR("invalid cookie\n");
+			dev_err(instance->dev, "invalid cookie\n");
 		else
 			bcm2835_playback_fifo(instance->alsa_stream,
 					      m.u.complete.count);
 	} else {
-		LOG_ERR("unexpected callback type=%d\n", m.type);
+		dev_err(instance->dev, "unexpected callback type=%d\n", m.type);
 	}
 }
 
@@ -173,8 +164,9 @@ vc_vchi_audio_init(VCHI_INSTANCE_T vchi_instance,
 				   &instance->vchi_handle);
 
 	if (status) {
-		LOG_ERR("%s: failed to open VCHI service connection (status=%d)\n",
-			__func__, status);
+		dev_err(instance->dev,
+			"failed to open VCHI service connection (status=%d)\n",
+			status);
 		kfree(instance);
 		return -EPERM;
 	}
@@ -195,30 +187,30 @@ static void vc_vchi_audio_deinit(struct bcm2835_audio_instance *instance)
 	/* Close all VCHI service connections */
 	status = vchi_service_close(instance->vchi_handle);
 	if (status) {
-		LOG_DBG("%s: failed to close VCHI service connection (status=%d)\n",
-			__func__, status);
+		dev_err(instance->dev,
+			"failed to close VCHI service connection (status=%d)\n",
+			status);
 	}
 
 	mutex_unlock(&instance->vchi_mutex);
 }
 
-int bcm2835_new_vchi_ctx(struct bcm2835_vchi_ctx *vchi_ctx)
+int bcm2835_new_vchi_ctx(struct device *dev, struct bcm2835_vchi_ctx *vchi_ctx)
 {
 	int ret;
 
 	/* Initialize and create a VCHI connection */
 	ret = vchi_initialise(&vchi_ctx->vchi_instance);
 	if (ret) {
-		LOG_ERR("%s: failed to initialise VCHI instance (ret=%d)\n",
-			__func__, ret);
-
+		dev_err(dev, "failed to initialise VCHI instance (ret=%d)\n",
+			ret);
 		return -EIO;
 	}
 
 	ret = vchi_connect(NULL, 0, vchi_ctx->vchi_instance);
 	if (ret) {
-		LOG_ERR("%s: failed to connect VCHI instance (ret=%d)\n",
-			__func__, ret);
+		dev_dbg(dev, "failed to connect VCHI instance (ret=%d)\n",
+			ret);
 
 		kfree(vchi_ctx->vchi_instance);
 		vchi_ctx->vchi_instance = NULL;
@@ -248,6 +240,7 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
 	if (!instance)
 		return -ENOMEM;
 	mutex_init(&instance->vchi_mutex);
+	instance->dev = alsa_stream->chip->dev;
 	instance->alsa_stream = alsa_stream;
 	alsa_stream->instance = instance;
 
@@ -394,7 +387,8 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 	}
 
 	if (status) {
-		LOG_ERR("failed on %d bytes transfer (status=%d)\n",
+		dev_err(instance->dev,
+			"failed on %d bytes transfer (status=%d)\n",
 			size, status);
 		err = -EIO;
 	}
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 55e7fbc3ec44d..8a87c33b1ea9c 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -73,7 +73,7 @@ static int bcm2835_devm_add_vchi_ctx(struct device *dev)
 
 	memset(vchi_ctx, 0, sizeof(*vchi_ctx));
 
-	ret = bcm2835_new_vchi_ctx(vchi_ctx);
+	ret = bcm2835_new_vchi_ctx(dev, vchi_ctx);
 	if (ret) {
 		devres_free(vchi_ctx);
 		return ret;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index a3c181613374a..319c3e5dfbe42 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -17,47 +17,6 @@
 
 #include "interface/vchi/vchi.h"
 
-/*
- * #define AUDIO_DEBUG_ENABLE
- * #define AUDIO_VERBOSE_DEBUG_ENABLE
- */
-
-/* Debug macros */
-
-#ifdef AUDIO_DEBUG_ENABLE
-#ifdef AUDIO_VERBOSE_DEBUG_ENABLE
-
-#define audio_debug(fmt, arg...) \
-	pr_info("%s:%d " fmt, __func__, __LINE__, ##arg)
-
-#define audio_info(fmt, arg...) \
-	pr_info("%s:%d " fmt, __func__, __LINE__, ##arg)
-
-#else
-
-#define audio_debug(fmt, arg...)
-
-#define audio_info(fmt, arg...)
-
-#endif /* AUDIO_VERBOSE_DEBUG_ENABLE */
-
-#else
-
-#define audio_debug(fmt, arg...)
-
-#define audio_info(fmt, arg...)
-
-#endif /* AUDIO_DEBUG_ENABLE */
-
-#define audio_error(fmt, arg...) \
-	pr_err("%s:%d " fmt, __func__, __LINE__, ##arg)
-
-#define audio_warning(fmt, arg...) \
-	pr_warn("%s:%d " fmt, __func__, __LINE__, ##arg)
-
-#define audio_alert(fmt, arg...) \
-	pr_alert("%s:%d " fmt, __func__, __LINE__, ##arg)
-
 #define MAX_SUBSTREAMS   (8)
 #define AVAIL_SUBSTREAMS_MASK  (0xff)
 
@@ -141,7 +100,7 @@ int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
 int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip);
 int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip);
 
-int bcm2835_new_vchi_ctx(struct bcm2835_vchi_ctx *vchi_ctx);
+int bcm2835_new_vchi_ctx(struct device *dev, struct bcm2835_vchi_ctx *vchi_ctx);
 void bcm2835_free_vchi_ctx(struct bcm2835_vchi_ctx *vchi_ctx);
 
 int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream);
-- 
GitLab


From 87fe7bcbbe748c8e0ebaf5fdefff8b233a65f576 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:52 +0200
Subject: [PATCH 0463/1835] staging: bcm2835-audio: Remove unnecessary header
 file includes

commit 7e46fff5f19ce2b8a9891e4c08631c64d06e9e17 upstream.

Yet a few header files are included unnecessarily.  Drop them.

Also remove trivial comments.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../bcm2835-audio/bcm2835-vchiq.c             | 19 -------------------
 .../vc04_services/bcm2835-audio/bcm2835.h     |  6 ------
 2 files changed, 25 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 7fff5c63e33f7..1d756f467eb89 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -1,31 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright 2011 Broadcom Corporation.  All rights reserved. */
 
-#include <linux/device.h>
-#include <sound/core.h>
-#include <sound/initval.h>
-#include <sound/pcm.h>
-#include <linux/io.h>
-#include <linux/interrupt.h>
-#include <linux/fs.h>
-#include <linux/file.h>
-#include <linux/mm.h>
-#include <linux/syscalls.h>
-#include <linux/uaccess.h>
 #include <linux/slab.h>
-#include <linux/delay.h>
-#include <linux/atomic.h>
 #include <linux/module.h>
 #include <linux/completion.h>
-
 #include "bcm2835.h"
-
-/* ---- Include Files -------------------------------------------------------- */
-
 #include "vc_vchi_audioserv_defs.h"
 
-/* ---- Private Constants and Types ------------------------------------------ */
-
 struct bcm2835_audio_instance {
 	struct device *dev;
 	VCHI_SERVICE_HANDLE_T vchi_handle;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 319c3e5dfbe42..4e41069dc22ad 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -5,16 +5,10 @@
 #define __SOUND_ARM_BCM2835_H
 
 #include <linux/device.h>
-#include <linux/list.h>
-#include <linux/interrupt.h>
 #include <linux/wait.h>
 #include <sound/core.h>
-#include <sound/initval.h>
 #include <sound/pcm.h>
-#include <sound/pcm_params.h>
 #include <sound/pcm-indirect.h>
-#include <linux/workqueue.h>
-
 #include "interface/vchi/vchi.h"
 
 #define MAX_SUBSTREAMS   (8)
-- 
GitLab


From 96f9726eeec7fd9c1ce8985161e69c5a3f3cf87c Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:53 +0200
Subject: [PATCH 0464/1835] staging: bcm2835-audio: Move module parameter
 description

commit b876f2075808e95e244053caa53fa7e86e929a99 upstream.

For more consistency, move the module parameter description right
after its variable definition.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 1d756f467eb89..0bdaea1fdd777 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -19,6 +19,8 @@ struct bcm2835_audio_instance {
 };
 
 static bool force_bulk;
+module_param(force_bulk, bool, 0444);
+MODULE_PARM_DESC(force_bulk, "Force use of vchiq bulk for audio");
 
 static void bcm2835_audio_lock(struct bcm2835_audio_instance *instance)
 {
@@ -378,6 +380,3 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 	bcm2835_audio_unlock(instance);
 	return err;
 }
-
-module_param(force_bulk, bool, 0444);
-MODULE_PARM_DESC(force_bulk, "Force use of vchiq bulk for audio");
-- 
GitLab


From 411bad968c2aa7548a60482616d97bf9861800f9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:54 +0200
Subject: [PATCH 0465/1835] staging: bcm2835-audio: Use coherent device buffers

commit ad29c6e6cbf6f2af7362b043adad51a3be3d39c7 upstream.

The memory access to the pages allocated with
SNDRV_DMA_TYPE_CONTINUOUS are basically non-coherent, and it becomes a
problem when a process accesses via mmap.

For the more consistent access, use the device coherent memory, just
by replacing the call pattern in the allocator helpers.

The only point we need to be careful for is the device object passed
there; since bcm2835-audio driver creates fake devices and each card
is created on top of that, we need to pass its parent device as the
real device object.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c        | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index d2373e4a4d535..8b8e286587cbf 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -345,8 +345,8 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels)
 
 	/* pre-allocation of buffers */
 	/* NOTE: this may fail */
-	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_CONTINUOUS,
-					      snd_dma_continuous_data(GFP_KERNEL),
+	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
+					      chip->card->dev->parent,
 					      snd_bcm2835_playback_hw.buffer_bytes_max,
 					      snd_bcm2835_playback_hw.buffer_bytes_max);
 
@@ -371,8 +371,8 @@ int snd_bcm2835_new_spdif_pcm(struct bcm2835_chip *chip)
 
 	/* pre-allocation of buffers */
 	/* NOTE: this may fail */
-	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_CONTINUOUS,
-		snd_dma_continuous_data(GFP_KERNEL),
+	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
+		chip->card->dev->parent,
 		snd_bcm2835_playback_spdif_hw.buffer_bytes_max, snd_bcm2835_playback_spdif_hw.buffer_bytes_max);
 
 	return 0;
@@ -404,8 +404,8 @@ int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
 
 	snd_pcm_lib_preallocate_pages_for_all(
 		pcm,
-		SNDRV_DMA_TYPE_CONTINUOUS,
-		snd_dma_continuous_data(GFP_KERNEL),
+		SNDRV_DMA_TYPE_DEV,
+		chip->card->dev->parent,
 		snd_bcm2835_playback_hw.buffer_bytes_max,
 		snd_bcm2835_playback_hw.buffer_bytes_max);
 
-- 
GitLab


From 6258d4a33b57664543d8d36086ae42230447d4f1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:55 +0200
Subject: [PATCH 0466/1835] staging: bcm2835-audio: Set
 SNDRV_PCM_INFO_SYNC_APPLPTR

commit b59d6a5f73501f74848d6700101e7736afe3d54a upstream.

The recent ALSA PCM core supports the SNDRV_PCM_INFO_SYNC_APPLPTR flag
indicating that the driver needs the ack call at each appl_ptr
update.  This is requirement for the indirect PCM implementations like
bcm2835-audio driver, too.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 8b8e286587cbf..5ddb8ee93cb29 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -12,7 +12,7 @@
 static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 	.info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
 		 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
-		 SNDRV_PCM_INFO_DRAIN_TRIGGER),
+		 SNDRV_PCM_INFO_DRAIN_TRIGGER | SNDRV_PCM_INFO_SYNC_APPLPTR),
 	.formats = SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
 	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min = 8000,
@@ -29,7 +29,7 @@ static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 static const struct snd_pcm_hardware snd_bcm2835_playback_spdif_hw = {
 	.info = (SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER |
 		 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
-		 SNDRV_PCM_INFO_DRAIN_TRIGGER),
+		 SNDRV_PCM_INFO_DRAIN_TRIGGER | SNDRV_PCM_INFO_SYNC_APPLPTR),
 	.formats = SNDRV_PCM_FMTBIT_S16_LE,
 	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_44100 |
 	SNDRV_PCM_RATE_48000,
-- 
GitLab


From 5c8ccd1603c8ed81e65260c27be87c723dc431dc Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:56 +0200
Subject: [PATCH 0467/1835] staging: bcm2835-audio: Simplify PCM creation
 helpers

commit 74470ffeb9aed5548654cfca881bf1d7469fe9c4 upstream.

All three functions to create PCM objects are fairly resemble, and can
be unified to a single common helper.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c | 87 ++++---------------
 .../vc04_services/bcm2835-audio/bcm2835.c     | 17 +++-
 .../vc04_services/bcm2835-audio/bcm2835.h     |  9 +-
 3 files changed, 32 insertions(+), 81 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 5ddb8ee93cb29..98480d97cc2e7 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -324,91 +324,36 @@ static const struct snd_pcm_ops snd_bcm2835_playback_spdif_ops = {
 };
 
 /* create a pcm device */
-int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels)
+int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+			int idx, enum snd_bcm2835_route route,
+			u32 numchannels, bool spdif)
 {
 	struct snd_pcm *pcm;
 	int err;
 
-	err = snd_pcm_new(chip->card, "bcm2835 ALSA", 0, numchannels, 0, &pcm);
-	if (err < 0)
-		return err;
-	pcm->private_data = chip;
-	pcm->nonatomic = true;
-	strcpy(pcm->name, "bcm2835 ALSA");
-	chip->pcm = pcm;
-	chip->dest = AUDIO_DEST_AUTO;
-	chip->volume = 0;
-	chip->mute = CTRL_VOL_UNMUTE; /*disable mute on startup */
-	/* set operators */
-	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
-			&snd_bcm2835_playback_ops);
-
-	/* pre-allocation of buffers */
-	/* NOTE: this may fail */
-	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
-					      chip->card->dev->parent,
-					      snd_bcm2835_playback_hw.buffer_bytes_max,
-					      snd_bcm2835_playback_hw.buffer_bytes_max);
-
-	return 0;
-}
-
-int snd_bcm2835_new_spdif_pcm(struct bcm2835_chip *chip)
-{
-	struct snd_pcm *pcm;
-	int err;
-
-	err = snd_pcm_new(chip->card, "bcm2835 ALSA", 1, 1, 0, &pcm);
-	if (err < 0)
-		return err;
-
-	pcm->private_data = chip;
-	pcm->nonatomic = true;
-	strcpy(pcm->name, "bcm2835 IEC958/HDMI");
-	chip->pcm_spdif = pcm;
-	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
-			&snd_bcm2835_playback_spdif_ops);
-
-	/* pre-allocation of buffers */
-	/* NOTE: this may fail */
-	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
-		chip->card->dev->parent,
-		snd_bcm2835_playback_spdif_hw.buffer_bytes_max, snd_bcm2835_playback_spdif_hw.buffer_bytes_max);
-
-	return 0;
-}
-
-int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
-			       const char *name,
-			       enum snd_bcm2835_route route,
-			       u32 numchannels)
-{
-	struct snd_pcm *pcm;
-	int err;
-
-	err = snd_pcm_new(chip->card, name, 0, numchannels,
-			  0, &pcm);
+	err = snd_pcm_new(chip->card, name, idx, numchannels, 0, &pcm);
 	if (err)
 		return err;
 
 	pcm->private_data = chip;
 	pcm->nonatomic = true;
 	strcpy(pcm->name, name);
-	chip->pcm = pcm;
-	chip->dest = route;
-	chip->volume = 0;
-	chip->mute = CTRL_VOL_UNMUTE;
+	if (!spdif) {
+		chip->dest = route;
+		chip->volume = 0;
+		chip->mute = CTRL_VOL_UNMUTE;
+	}
 
 	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
+			spdif ? &snd_bcm2835_playback_spdif_ops :
 			&snd_bcm2835_playback_ops);
 
-	snd_pcm_lib_preallocate_pages_for_all(
-		pcm,
-		SNDRV_DMA_TYPE_DEV,
-		chip->card->dev->parent,
-		snd_bcm2835_playback_hw.buffer_bytes_max,
-		snd_bcm2835_playback_hw.buffer_bytes_max);
+	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
+		chip->card->dev->parent, 128 * 1024, 128 * 1024);
 
+	if (spdif)
+		chip->pcm_spdif = pcm;
+	else
+		chip->pcm = pcm;
 	return 0;
 }
-
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 8a87c33b1ea9c..2869f310086fc 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -138,17 +138,26 @@ static int bcm2835_audio_alsa_newpcm(struct bcm2835_chip *chip,
 {
 	int err;
 
-	err = snd_bcm2835_new_pcm(chip, numchannels - 1);
+	err = snd_bcm2835_new_pcm(chip, "bcm2835 ALSA", 0, AUDIO_DEST_AUTO,
+				  numchannels - 1, false);
 	if (err)
 		return err;
 
-	err = snd_bcm2835_new_spdif_pcm(chip);
+	err = snd_bcm2835_new_pcm(chip, "bcm2835 IEC958/HDMI", 1, 0, 1, true);
 	if (err)
 		return err;
 
 	return 0;
 }
 
+static int bcm2835_audio_simple_newpcm(struct bcm2835_chip *chip,
+				       const char *name,
+				       enum snd_bcm2835_route route,
+				       u32 numchannels)
+{
+	return snd_bcm2835_new_pcm(chip, name, 0, route, numchannels, false);
+}
+
 static struct bcm2835_audio_driver bcm2835_audio_alsa = {
 	.driver = {
 		.name = "bcm2835_alsa",
@@ -169,7 +178,7 @@ static struct bcm2835_audio_driver bcm2835_audio_hdmi = {
 	.shortname = "bcm2835 HDMI",
 	.longname  = "bcm2835 HDMI",
 	.minchannels = 1,
-	.newpcm = snd_bcm2835_new_simple_pcm,
+	.newpcm = bcm2835_audio_simple_newpcm,
 	.newctl = snd_bcm2835_new_hdmi_ctl,
 	.route = AUDIO_DEST_HDMI
 };
@@ -182,7 +191,7 @@ static struct bcm2835_audio_driver bcm2835_audio_headphones = {
 	.shortname = "bcm2835 Headphones",
 	.longname  = "bcm2835 Headphones",
 	.minchannels = 1,
-	.newpcm = snd_bcm2835_new_simple_pcm,
+	.newpcm = bcm2835_audio_simple_newpcm,
 	.newctl = snd_bcm2835_new_headphones_ctl,
 	.route = AUDIO_DEST_HEADPHONES
 };
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 4e41069dc22ad..e13435d1c2051 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -84,12 +84,9 @@ struct bcm2835_alsa_stream {
 };
 
 int snd_bcm2835_new_ctl(struct bcm2835_chip *chip);
-int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, u32 numchannels);
-int snd_bcm2835_new_spdif_pcm(struct bcm2835_chip *chip);
-int snd_bcm2835_new_simple_pcm(struct bcm2835_chip *chip,
-			       const char *name,
-			       enum snd_bcm2835_route route,
-			       u32 numchannels);
+int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+			int idx, enum snd_bcm2835_route route,
+			u32 numchannels, bool spdif);
 
 int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip);
 int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip);
-- 
GitLab


From 7cf1ddf5a2281dfdf27f196e70c72206f9a93a55 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:57 +0200
Subject: [PATCH 0468/1835] staging: bcm2835-audio: Simplify kctl creation
 helpers

commit dc5c0eb1e8601206dffbfc302cbd190f89dcd040 upstream.

Just a minor code refactoring and adding some const prefix.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-ctl.c | 69 +++++++------------
 1 file changed, 25 insertions(+), 44 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
index e17b72f21a9d3..a6ec72a5f0bec 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
@@ -97,40 +97,34 @@ static int snd_bcm2835_ctl_put(struct snd_kcontrol *kcontrol,
 
 static DECLARE_TLV_DB_SCALE(snd_bcm2835_db_scale, CTRL_VOL_MIN, 1, 1);
 
-static struct snd_kcontrol_new snd_bcm2835_ctl[] = {
+static const struct snd_kcontrol_new snd_bcm2835_ctl[] = {
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name = "PCM Playback Volume",
-		.index = 0,
 		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_TLV_READ,
 		.private_value = PCM_PLAYBACK_VOLUME,
 		.info = snd_bcm2835_ctl_info,
 		.get = snd_bcm2835_ctl_get,
 		.put = snd_bcm2835_ctl_put,
-		.count = 1,
 		.tlv = {.p = snd_bcm2835_db_scale}
 	},
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name = "PCM Playback Switch",
-		.index = 0,
 		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
 		.private_value = PCM_PLAYBACK_MUTE,
 		.info = snd_bcm2835_ctl_info,
 		.get = snd_bcm2835_ctl_get,
 		.put = snd_bcm2835_ctl_put,
-		.count = 1,
 	},
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name = "PCM Playback Route",
-		.index = 0,
 		.access = SNDRV_CTL_ELEM_ACCESS_READWRITE,
 		.private_value = PCM_PLAYBACK_DEVICE,
 		.info = snd_bcm2835_ctl_info,
 		.get = snd_bcm2835_ctl_get,
 		.put = snd_bcm2835_ctl_put,
-		.count = 1,
 	},
 };
 
@@ -196,7 +190,7 @@ static int snd_bcm2835_spdif_mask_get(struct snd_kcontrol *kcontrol,
 	return 0;
 }
 
-static struct snd_kcontrol_new snd_bcm2835_spdif[] = {
+static const struct snd_kcontrol_new snd_bcm2835_spdif[] = {
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_PCM,
 		.name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
@@ -213,28 +207,32 @@ static struct snd_kcontrol_new snd_bcm2835_spdif[] = {
 	},
 };
 
-int snd_bcm2835_new_ctl(struct bcm2835_chip *chip)
+static int create_ctls(struct bcm2835_chip *chip, size_t size,
+		       const struct snd_kcontrol_new *kctls)
 {
-	int err;
-	unsigned int idx;
+	int i, err;
 
-	strcpy(chip->card->mixername, "Broadcom Mixer");
-	for (idx = 0; idx < ARRAY_SIZE(snd_bcm2835_ctl); idx++) {
-		err = snd_ctl_add(chip->card,
-				  snd_ctl_new1(&snd_bcm2835_ctl[idx], chip));
-		if (err < 0)
-			return err;
-	}
-	for (idx = 0; idx < ARRAY_SIZE(snd_bcm2835_spdif); idx++) {
-		err = snd_ctl_add(chip->card,
-				  snd_ctl_new1(&snd_bcm2835_spdif[idx], chip));
+	for (i = 0; i < size; i++) {
+		err = snd_ctl_add(chip->card, snd_ctl_new1(&kctls[i], chip));
 		if (err < 0)
 			return err;
 	}
 	return 0;
 }
 
-static struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = {
+int snd_bcm2835_new_ctl(struct bcm2835_chip *chip)
+{
+	int err;
+
+	strcpy(chip->card->mixername, "Broadcom Mixer");
+	err = create_ctls(chip, ARRAY_SIZE(snd_bcm2835_ctl), snd_bcm2835_ctl);
+	if (err < 0)
+		return err;
+	return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_spdif),
+			   snd_bcm2835_spdif);
+}
+
+static const struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = {
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name = "Headphone Playback Volume",
@@ -263,21 +261,12 @@ static struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = {
 
 int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip)
 {
-	int err;
-	unsigned int idx;
-
 	strcpy(chip->card->mixername, "Broadcom Mixer");
-	for (idx = 0; idx < ARRAY_SIZE(snd_bcm2835_headphones_ctl); idx++) {
-		err = snd_ctl_add(chip->card,
-				  snd_ctl_new1(&snd_bcm2835_headphones_ctl[idx],
-					       chip));
-		if (err)
-			return err;
-	}
-	return 0;
+	return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_headphones_ctl),
+			   snd_bcm2835_headphones_ctl);
 }
 
-static struct snd_kcontrol_new snd_bcm2835_hdmi[] = {
+static const struct snd_kcontrol_new snd_bcm2835_hdmi[] = {
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name = "HDMI Playback Volume",
@@ -306,16 +295,8 @@ static struct snd_kcontrol_new snd_bcm2835_hdmi[] = {
 
 int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip)
 {
-	int err;
-	unsigned int idx;
-
 	strcpy(chip->card->mixername, "Broadcom Mixer");
-	for (idx = 0; idx < ARRAY_SIZE(snd_bcm2835_hdmi); idx++) {
-		err = snd_ctl_add(chip->card,
-				  snd_ctl_new1(&snd_bcm2835_hdmi[idx], chip));
-		if (err)
-			return err;
-	}
-	return 0;
+	return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_hdmi),
+			   snd_bcm2835_hdmi);
 }
 
-- 
GitLab


From 73d5cb9b8326f904a781233e9e50419811c1920c Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Sep 2018 17:58:58 +0200
Subject: [PATCH 0469/1835] staging: bcm2835-audio: Simplify card object
 management

commit 872ae2d63d516a2a3b9c833d8685afcfa7814542 upstream.

Instead of creating a dummy child device to manage the card object,
just use devm stuff directly for releasing with snd_card_free().
This results in a lot of code reduction.

Since the dummy child devices are gone, the device object to be passed
to the memory allocator needs to be adjusted as well.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c |   2 +-
 .../vc04_services/bcm2835-audio/bcm2835.c     | 120 +++++-------------
 2 files changed, 33 insertions(+), 89 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 98480d97cc2e7..e66da11af5cf5 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -349,7 +349,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
 			&snd_bcm2835_playback_ops);
 
 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
-		chip->card->dev->parent, 128 * 1024, 128 * 1024);
+		chip->card->dev, 128 * 1024, 128 * 1024);
 
 	if (spdif)
 		chip->pcm_spdif = pcm;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 2869f310086fc..87d56ab1ffa0c 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -22,38 +22,6 @@ module_param(enable_compat_alsa, bool, 0444);
 MODULE_PARM_DESC(enable_compat_alsa,
 		 "Enables ALSA compatibility virtual audio device");
 
-static void snd_devm_unregister_child(struct device *dev, void *res)
-{
-	struct device *childdev = *(struct device **)res;
-	struct bcm2835_chip *chip = dev_get_drvdata(childdev);
-	struct snd_card *card = chip->card;
-
-	snd_card_free(card);
-
-	device_unregister(childdev);
-}
-
-static int snd_devm_add_child(struct device *dev, struct device *child)
-{
-	struct device **dr;
-	int ret;
-
-	dr = devres_alloc(snd_devm_unregister_child, sizeof(*dr), GFP_KERNEL);
-	if (!dr)
-		return -ENOMEM;
-
-	ret = device_add(child);
-	if (ret) {
-		devres_free(dr);
-		return ret;
-	}
-
-	*dr = child;
-	devres_add(dev, dr);
-
-	return 0;
-}
-
 static void bcm2835_devm_free_vchi_ctx(struct device *dev, void *res)
 {
 	struct bcm2835_vchi_ctx *vchi_ctx = res;
@@ -84,36 +52,6 @@ static int bcm2835_devm_add_vchi_ctx(struct device *dev)
 	return 0;
 }
 
-static void snd_bcm2835_release(struct device *dev)
-{
-}
-
-static struct device *
-snd_create_device(struct device *parent,
-		  struct device_driver *driver,
-		  const char *name)
-{
-	struct device *device;
-	int ret;
-
-	device = devm_kzalloc(parent, sizeof(*device), GFP_KERNEL);
-	if (!device)
-		return ERR_PTR(-ENOMEM);
-
-	device_initialize(device);
-	device->parent = parent;
-	device->driver = driver;
-	device->release = snd_bcm2835_release;
-
-	dev_set_name(device, "%s", name);
-
-	ret = snd_devm_add_child(parent, device);
-	if (ret)
-		return ERR_PTR(ret);
-
-	return device;
-}
-
 typedef int (*bcm2835_audio_newpcm_func)(struct bcm2835_chip *chip,
 					 const char *name,
 					 enum snd_bcm2835_route route,
@@ -216,40 +154,36 @@ static struct bcm2835_audio_drivers children_devices[] = {
 	},
 };
 
-static int snd_add_child_device(struct device *device,
+static void bcm2835_card_free(void *data)
+{
+	snd_card_free(data);
+}
+
+static int snd_add_child_device(struct device *dev,
 				struct bcm2835_audio_driver *audio_driver,
 				u32 numchans)
 {
 	struct snd_card *card;
-	struct device *child;
 	struct bcm2835_chip *chip;
 	int err;
 
-	child = snd_create_device(device, &audio_driver->driver,
-				  audio_driver->driver.name);
-	if (IS_ERR(child)) {
-		dev_err(device,
-			"Unable to create child device %p, error %ld",
-			audio_driver->driver.name,
-			PTR_ERR(child));
-		return PTR_ERR(child);
-	}
-
-	err = snd_card_new(child, -1, NULL, THIS_MODULE, sizeof(*chip), &card);
+	err = snd_card_new(dev, -1, NULL, THIS_MODULE, sizeof(*chip), &card);
 	if (err < 0) {
-		dev_err(child, "Failed to create card");
+		dev_err(dev, "Failed to create card");
 		return err;
 	}
 
 	chip = card->private_data;
 	chip->card = card;
-	chip->dev = child;
+	chip->dev = dev;
 	mutex_init(&chip->audio_mutex);
 
-	chip->vchi_ctx = devres_find(device,
+	chip->vchi_ctx = devres_find(dev,
 				     bcm2835_devm_free_vchi_ctx, NULL, NULL);
-	if (!chip->vchi_ctx)
-		return -ENODEV;
+	if (!chip->vchi_ctx) {
+		err = -ENODEV;
+		goto error;
+	}
 
 	strcpy(card->driver, audio_driver->driver.name);
 	strcpy(card->shortname, audio_driver->shortname);
@@ -259,26 +193,36 @@ static int snd_add_child_device(struct device *device,
 		audio_driver->route,
 		numchans);
 	if (err) {
-		dev_err(child, "Failed to create pcm, error %d\n", err);
-		return err;
+		dev_err(dev, "Failed to create pcm, error %d\n", err);
+		goto error;
 	}
 
 	err = audio_driver->newctl(chip);
 	if (err) {
-		dev_err(child, "Failed to create controls, error %d\n", err);
-		return err;
+		dev_err(dev, "Failed to create controls, error %d\n", err);
+		goto error;
 	}
 
 	err = snd_card_register(card);
 	if (err) {
-		dev_err(child, "Failed to register card, error %d\n", err);
-		return err;
+		dev_err(dev, "Failed to register card, error %d\n", err);
+		goto error;
 	}
 
-	dev_set_drvdata(child, chip);
-	dev_info(child, "card created with %d channels\n", numchans);
+	dev_set_drvdata(dev, chip);
 
+	err = devm_add_action(dev, bcm2835_card_free, card);
+	if (err < 0) {
+		dev_err(dev, "Failed to add devm action, err %d\n", err);
+		goto error;
+	}
+
+	dev_info(dev, "card created with %d channels\n", numchans);
 	return 0;
+
+ error:
+	snd_card_free(card);
+	return err;
 }
 
 static int snd_add_child_devices(struct device *device, u32 numchans)
-- 
GitLab


From 2117f2d82138e7b3e647940097a1cbad9dc8aab2 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:50 +0200
Subject: [PATCH 0470/1835] staging: bcm2835-audio: unify FOURCC command
 definitions

commit a90d8f49cc7fd7220aa24b85fc74ef3cfd62b96f upstream.

The device communicates with the audio core using FOURCC codes. The
driver was generating them using different macros/expressions. We now
use the same macro to create them and centralize all the definitions.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-vchiq.c     | 13 ++++---------
 .../bcm2835-audio/vc_vchi_audioserv_defs.h          |  4 +++-
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 0bdaea1fdd777..e44bc6e94684c 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -89,11 +89,6 @@ static int bcm2835_audio_send_simple(struct bcm2835_audio_instance *instance,
 	return bcm2835_audio_send_msg(instance, &m, wait);
 }
 
-static const u32 BCM2835_AUDIO_WRITE_COOKIE1 = ('B' << 24 | 'C' << 16 |
-						'M' << 8  | 'A');
-static const u32 BCM2835_AUDIO_WRITE_COOKIE2 = ('D' << 24 | 'A' << 16 |
-						'T' << 8  | 'A');
-
 static void audio_vchi_callback(void *param,
 				const VCHI_CALLBACK_REASON_T reason,
 				void *msg_handle)
@@ -112,8 +107,8 @@ static void audio_vchi_callback(void *param,
 		instance->result = m.u.result.success;
 		complete(&instance->msg_avail_comp);
 	} else if (m.type == VC_AUDIO_MSG_TYPE_COMPLETE) {
-		if (m.u.complete.cookie1 != BCM2835_AUDIO_WRITE_COOKIE1 ||
-		    m.u.complete.cookie2 != BCM2835_AUDIO_WRITE_COOKIE2)
+		if (m.u.complete.cookie1 != VC_AUDIO_WRITE_COOKIE1 ||
+		    m.u.complete.cookie2 != VC_AUDIO_WRITE_COOKIE2)
 			dev_err(instance->dev, "invalid cookie\n");
 		else
 			bcm2835_playback_fifo(instance->alsa_stream,
@@ -337,8 +332,8 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 		.type = VC_AUDIO_MSG_TYPE_WRITE,
 		.u.write.count = size,
 		.u.write.max_packet = instance->max_packet,
-		.u.write.cookie1 = BCM2835_AUDIO_WRITE_COOKIE1,
-		.u.write.cookie2 = BCM2835_AUDIO_WRITE_COOKIE2,
+		.u.write.cookie1 = VC_AUDIO_WRITE_COOKIE1,
+		.u.write.cookie2 = VC_AUDIO_WRITE_COOKIE2,
 	};
 	unsigned int count;
 	int err, status;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h b/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h
index 1a7f0884ac9ce..dc62875cfdcab 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h
@@ -7,8 +7,10 @@
 #define VC_AUDIOSERV_MIN_VER 1
 #define VC_AUDIOSERV_VER 2
 
-/* FourCC code used for VCHI connection */
+/* FourCC codes used for VCHI communication */
 #define VC_AUDIO_SERVER_NAME  MAKE_FOURCC("AUDS")
+#define VC_AUDIO_WRITE_COOKIE1 MAKE_FOURCC("BCMA")
+#define VC_AUDIO_WRITE_COOKIE2 MAKE_FOURCC("DATA")
 
 /*
  *  List of screens that are currently supported
-- 
GitLab


From 58f8dd6cd26f634b012fe524e7a3ba6f94616028 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:51 +0200
Subject: [PATCH 0471/1835] staging: bcm2835-audio: don't initialize memory
 twice

commit 2e5f59fb77397cab3bc3d156e8be4164a67d32ef upstream.

The memory is being allocated with devres_alloc(), wich ultimately uses
__GFP_ZERO to call kmalloc. We don't need to zero the memory area again
in bcm2835-audio.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 87d56ab1ffa0c..0efae7068fefd 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -39,8 +39,6 @@ static int bcm2835_devm_add_vchi_ctx(struct device *dev)
 	if (!vchi_ctx)
 		return -ENOMEM;
 
-	memset(vchi_ctx, 0, sizeof(*vchi_ctx));
-
 	ret = bcm2835_new_vchi_ctx(dev, vchi_ctx);
 	if (ret) {
 		devres_free(vchi_ctx);
-- 
GitLab


From a46e54ff6cff679ca7f9a5c407d1b89f7ffb3fb0 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:52 +0200
Subject: [PATCH 0472/1835] staging: bcm2835-audio: reorder variable
 declarations & remove trivial comments

commit d048385a070552ae819f99f05bd03ec41072783d upstream.

When it comes to declaring variables it's preferred, when possible, to
use an inverted tree organization scheme.

Also, removes some comments that were useless.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c      | 10 ++--------
 .../vc04_services/bcm2835-audio/bcm2835-vchiq.c    |  4 ++--
 .../staging/vc04_services/bcm2835-audio/bcm2835.c  | 14 +++++++-------
 3 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index e66da11af5cf5..98b6977bdce70 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -164,14 +164,11 @@ static int snd_bcm2835_playback_spdif_open(struct snd_pcm_substream *substream)
 	return snd_bcm2835_playback_open_generic(substream, 1);
 }
 
-/* close callback */
 static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 {
-	/* the hardware-specific codes will be here */
-
-	struct bcm2835_chip *chip;
-	struct snd_pcm_runtime *runtime;
 	struct bcm2835_alsa_stream *alsa_stream;
+	struct snd_pcm_runtime *runtime;
+	struct bcm2835_chip *chip;
 
 	chip = snd_pcm_substream_chip(substream);
 	mutex_lock(&chip->audio_mutex);
@@ -195,20 +192,17 @@ static int snd_bcm2835_playback_close(struct snd_pcm_substream *substream)
 	return 0;
 }
 
-/* hw_params callback */
 static int snd_bcm2835_pcm_hw_params(struct snd_pcm_substream *substream,
 	struct snd_pcm_hw_params *params)
 {
 	return snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
 }
 
-/* hw_free callback */
 static int snd_bcm2835_pcm_hw_free(struct snd_pcm_substream *substream)
 {
 	return snd_pcm_lib_free_pages(substream);
 }
 
-/* prepare callback */
 static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 {
 	struct bcm2835_chip *chip = snd_pcm_substream_chip(substream);
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index e44bc6e94684c..b45759de6397a 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -94,9 +94,9 @@ static void audio_vchi_callback(void *param,
 				void *msg_handle)
 {
 	struct bcm2835_audio_instance *instance = param;
-	int status;
-	int msg_len;
 	struct vc_audio_msg m;
+	int msg_len;
+	int status;
 
 	if (reason != VCHI_CALLBACK_MSG_AVAILABLE)
 		return;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 0efae7068fefd..6ee8334dfc810 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -161,8 +161,8 @@ static int snd_add_child_device(struct device *dev,
 				struct bcm2835_audio_driver *audio_driver,
 				u32 numchans)
 {
-	struct snd_card *card;
 	struct bcm2835_chip *chip;
+	struct snd_card *card;
 	int err;
 
 	err = snd_card_new(dev, -1, NULL, THIS_MODULE, sizeof(*chip), &card);
@@ -225,12 +225,12 @@ static int snd_add_child_device(struct device *dev,
 
 static int snd_add_child_devices(struct device *device, u32 numchans)
 {
-	int i;
-	int count_devices = 0;
-	int minchannels = 0;
-	int extrachannels = 0;
 	int extrachannels_per_driver = 0;
 	int extrachannels_remainder = 0;
+	int count_devices = 0;
+	int extrachannels = 0;
+	int minchannels = 0;
+	int i;
 
 	for (i = 0; i < ARRAY_SIZE(children_devices); i++)
 		if (*children_devices[i].is_enabled)
@@ -258,9 +258,9 @@ static int snd_add_child_devices(struct device *device, u32 numchans)
 		extrachannels_remainder);
 
 	for (i = 0; i < ARRAY_SIZE(children_devices); i++) {
-		int err;
-		int numchannels_this_device;
 		struct bcm2835_audio_driver *audio_driver;
+		int numchannels_this_device;
+		int err;
 
 		if (!*children_devices[i].is_enabled)
 			continue;
-- 
GitLab


From 832a83bebabfdcf19edd5377f39b2e489e58a6de Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:53 +0200
Subject: [PATCH 0473/1835] staging: bcm2835-audio: use anonymous union in
 struct vc_audio_msg

commit 9c2eaf7da855d314a369d48b9cbf8ac80717a1d0 upstream.

In this case explicitly naming the union doesn't help overall code
comprehension and clutters it.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../bcm2835-audio/bcm2835-vchiq.c             | 30 +++++++++----------
 .../bcm2835-audio/vc_vchi_audioserv_defs.h    |  2 +-
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index b45759de6397a..cf5ae1a28f52f 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -104,15 +104,15 @@ static void audio_vchi_callback(void *param,
 	status = vchi_msg_dequeue(instance->vchi_handle,
 				  &m, sizeof(m), &msg_len, VCHI_FLAGS_NONE);
 	if (m.type == VC_AUDIO_MSG_TYPE_RESULT) {
-		instance->result = m.u.result.success;
+		instance->result = m.result.success;
 		complete(&instance->msg_avail_comp);
 	} else if (m.type == VC_AUDIO_MSG_TYPE_COMPLETE) {
-		if (m.u.complete.cookie1 != VC_AUDIO_WRITE_COOKIE1 ||
-		    m.u.complete.cookie2 != VC_AUDIO_WRITE_COOKIE2)
+		if (m.complete.cookie1 != VC_AUDIO_WRITE_COOKIE1 ||
+		    m.complete.cookie2 != VC_AUDIO_WRITE_COOKIE2)
 			dev_err(instance->dev, "invalid cookie\n");
 		else
 			bcm2835_playback_fifo(instance->alsa_stream,
-					      m.u.complete.count);
+					      m.complete.count);
 	} else {
 		dev_err(instance->dev, "unexpected callback type=%d\n", m.type);
 	}
@@ -257,11 +257,11 @@ int bcm2835_audio_set_ctls(struct bcm2835_alsa_stream *alsa_stream)
 	struct vc_audio_msg m = {};
 
 	m.type = VC_AUDIO_MSG_TYPE_CONTROL;
-	m.u.control.dest = chip->dest;
+	m.control.dest = chip->dest;
 	if (!chip->mute)
-		m.u.control.volume = CHIP_MIN_VOLUME;
+		m.control.volume = CHIP_MIN_VOLUME;
 	else
-		m.u.control.volume = alsa2chip(chip->volume);
+		m.control.volume = alsa2chip(chip->volume);
 
 	return bcm2835_audio_send_msg(alsa_stream->instance, &m, true);
 }
@@ -272,9 +272,9 @@ int bcm2835_audio_set_params(struct bcm2835_alsa_stream *alsa_stream,
 {
 	struct vc_audio_msg m = {
 		 .type = VC_AUDIO_MSG_TYPE_CONFIG,
-		 .u.config.channels = channels,
-		 .u.config.samplerate = samplerate,
-		 .u.config.bps = bps,
+		 .config.channels = channels,
+		 .config.samplerate = samplerate,
+		 .config.bps = bps,
 	};
 	int err;
 
@@ -302,7 +302,7 @@ int bcm2835_audio_drain(struct bcm2835_alsa_stream *alsa_stream)
 {
 	struct vc_audio_msg m = {
 		.type = VC_AUDIO_MSG_TYPE_STOP,
-		.u.stop.draining = 1,
+		.stop.draining = 1,
 	};
 
 	return bcm2835_audio_send_msg(alsa_stream->instance, &m, false);
@@ -330,10 +330,10 @@ int bcm2835_audio_write(struct bcm2835_alsa_stream *alsa_stream,
 	struct bcm2835_audio_instance *instance = alsa_stream->instance;
 	struct vc_audio_msg m = {
 		.type = VC_AUDIO_MSG_TYPE_WRITE,
-		.u.write.count = size,
-		.u.write.max_packet = instance->max_packet,
-		.u.write.cookie1 = VC_AUDIO_WRITE_COOKIE1,
-		.u.write.cookie2 = VC_AUDIO_WRITE_COOKIE2,
+		.write.count = size,
+		.write.max_packet = instance->max_packet,
+		.write.cookie1 = VC_AUDIO_WRITE_COOKIE1,
+		.write.cookie2 = VC_AUDIO_WRITE_COOKIE2,
 	};
 	unsigned int count;
 	int err, status;
diff --git a/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h b/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h
index dc62875cfdcab..d6401e914ac9f 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/vc_vchi_audioserv_defs.h
@@ -93,7 +93,7 @@ struct vc_audio_msg {
 		struct vc_audio_write write;
 		struct vc_audio_result result;
 		struct vc_audio_complete complete;
-	} u;
+	};
 };
 
 #endif /* _VC_AUDIO_DEFS_H_ */
-- 
GitLab


From d061dc817c346f8d0784f80c6abe056c632710cc Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:54 +0200
Subject: [PATCH 0474/1835] staging: bcm2835-audio: more generic probe function
 name

commit 96f3bd8ae6516898c7b411ecb87064bb0dd25415 upstream.

There will only be one probe function, there is no use for appendig
"_dt" the end of the name.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 6ee8334dfc810..039565311d107 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -291,7 +291,7 @@ static int snd_add_child_devices(struct device *device, u32 numchans)
 	return 0;
 }
 
-static int snd_bcm2835_alsa_probe_dt(struct platform_device *pdev)
+static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	u32 numchans;
@@ -344,7 +344,7 @@ static const struct of_device_id snd_bcm2835_of_match_table[] = {
 MODULE_DEVICE_TABLE(of, snd_bcm2835_of_match_table);
 
 static struct platform_driver bcm2835_alsa0_driver = {
-	.probe = snd_bcm2835_alsa_probe_dt,
+	.probe = snd_bcm2835_alsa_probe,
 #ifdef CONFIG_PM
 	.suspend = snd_bcm2835_alsa_suspend,
 	.resume = snd_bcm2835_alsa_resume,
-- 
GitLab


From 3bb9497c41e3f93d7b12f78e77d21b679442383f Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:55 +0200
Subject: [PATCH 0475/1835] staging: bcm2835-audio: rename platform_driver
 structure

commit 82cdc0c6b6faf877e2aecb957cffa9cb578cc572 upstream.

It was called bcm2835_alsa0_driver, that "0" didn't mean much.

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 039565311d107..e14b7c5aa07c9 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -343,7 +343,7 @@ static const struct of_device_id snd_bcm2835_of_match_table[] = {
 };
 MODULE_DEVICE_TABLE(of, snd_bcm2835_of_match_table);
 
-static struct platform_driver bcm2835_alsa0_driver = {
+static struct platform_driver bcm2835_alsa_driver = {
 	.probe = snd_bcm2835_alsa_probe,
 #ifdef CONFIG_PM
 	.suspend = snd_bcm2835_alsa_suspend,
@@ -359,7 +359,7 @@ static int bcm2835_alsa_device_init(void)
 {
 	int retval;
 
-	retval = platform_driver_register(&bcm2835_alsa0_driver);
+	retval = platform_driver_register(&bcm2835_alsa_driver);
 	if (retval)
 		pr_err("Error registering bcm2835_audio driver %d .\n", retval);
 
@@ -368,7 +368,7 @@ static int bcm2835_alsa_device_init(void)
 
 static void bcm2835_alsa_device_exit(void)
 {
-	platform_driver_unregister(&bcm2835_alsa0_driver);
+	platform_driver_unregister(&bcm2835_alsa_driver);
 }
 
 late_initcall(bcm2835_alsa_device_init);
-- 
GitLab


From 68501bea14600f3c3ad1f1d44439f90cbb5e8246 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Wed, 17 Oct 2018 21:01:56 +0200
Subject: [PATCH 0476/1835] staging: bcm2835-audio: update TODO

commit 01ec7398c56e8f1b903ecb3c5c75400e263eef43 upstream.

The following tasks were completed or not the right solution:

1/2- Not the proper solution, we should register a platform device in
vchiq the same way it's done with bcm2835-camera as commented here:
https://lkml.org/lkml/2018/10/16/1131

2/3- Fixed by Takashi Iwai here: https://lkml.org/lkml/2018/9/4/587

Also, adds a new task as per mailing list conversation.

Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../staging/vc04_services/bcm2835-audio/TODO  | 25 +++----------------
 1 file changed, 3 insertions(+), 22 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/TODO b/drivers/staging/vc04_services/bcm2835-audio/TODO
index 73d41fa631acf..cb8ead3e91087 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/TODO
+++ b/drivers/staging/vc04_services/bcm2835-audio/TODO
@@ -4,26 +4,7 @@
 *                                                                           *
 *****************************************************************************
 
+1) Revisit multi-cards options and PCM route mixer control (as per comment
+https://lkml.org/lkml/2018/9/8/200)
 
-1) Document the device tree node
-
-The downstream tree(the tree that the driver was imported from) at
-http://www.github.com/raspberrypi/linux uses this node:
-
-audio: audio {
-	compatible = "brcm,bcm2835-audio";
-	brcm,pwm-channels = <8>;
-};
-
-Since the driver requires the use of VCHIQ, it may be useful to have a link
-in the device tree to the VCHIQ driver.
-
-2) Gracefully handle the case where VCHIQ is missing from the device tree or
-it has not been initialized yet.
-
-3) Review error handling and remove duplicate code.
-
-4) Cleanup the logging mechanism.  The driver should probably be using the
-standard kernel logging mechanisms such as dev_info, dev_dbg, and friends.
-
-5) Fix the remaining checkpatch.pl errors and warnings.
+2) Fix the remaining checkpatch.pl errors and warnings.
-- 
GitLab


From 69531ea10b12a4ce5b6072f4212b135e9eafc579 Mon Sep 17 00:00:00 2001
From: Mike Brady <mikebrady@eircom.net>
Date: Mon, 22 Oct 2018 20:17:08 +0100
Subject: [PATCH 0477/1835] staging: bcm2835-audio: interpolate audio delay

commit a105a3a72824e0ac685a0711a67e4dbe29de62d0 upstream.

When the BCM2835 audio output is used, userspace sees a jitter up to 10ms
in the audio position, aka "delay" -- the number of frames that must
be output before a new frame would be played.
Make this a bit nicer for userspace by interpolating the position
using the CPU clock.
The overhead is small -- an extra ktime_get() every time a GPU message
is sent -- and another call and a few calculations whenever the delay
is sought from userland.
At 48,000 frames per second, i.e. approximately 20 microseconds per
frame, it would take a clock inaccuracy of
20 microseconds in 10 milliseconds -- 2,000 parts per million --
to result in an inaccurate estimate, whereas
crystal- or resonator-based clocks typically have an
inaccuracy of 10s to 100s of parts per million.

Signed-off-by: Mike Brady <mikebrady@eircom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c | 20 +++++++++++++++++++
 .../vc04_services/bcm2835-audio/bcm2835.h     |  1 +
 2 files changed, 21 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index 98b6977bdce70..bc1eaa3a07731 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -74,6 +74,7 @@ void bcm2835_playback_fifo(struct bcm2835_alsa_stream *alsa_stream,
 	atomic_set(&alsa_stream->pos, pos);
 
 	alsa_stream->period_offset += bytes;
+	alsa_stream->interpolate_start = ktime_get();
 	if (alsa_stream->period_offset >= alsa_stream->period_size) {
 		alsa_stream->period_offset %= alsa_stream->period_size;
 		snd_pcm_period_elapsed(substream);
@@ -237,6 +238,7 @@ static int snd_bcm2835_pcm_prepare(struct snd_pcm_substream *substream)
 	atomic_set(&alsa_stream->pos, 0);
 	alsa_stream->period_offset = 0;
 	alsa_stream->draining = false;
+	alsa_stream->interpolate_start = ktime_get();
 
 	return 0;
 }
@@ -286,6 +288,24 @@ snd_bcm2835_pcm_pointer(struct snd_pcm_substream *substream)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct bcm2835_alsa_stream *alsa_stream = runtime->private_data;
+	ktime_t now = ktime_get();
+
+	/* Give userspace better delay reporting by interpolating between GPU
+	 * notifications, assuming audio speed is close enough to the clock
+	 * used for ktime
+	 */
+
+	if ((ktime_to_ns(alsa_stream->interpolate_start)) &&
+	    (ktime_compare(alsa_stream->interpolate_start, now) < 0)) {
+		u64 interval =
+			(ktime_to_ns(ktime_sub(now,
+				alsa_stream->interpolate_start)));
+		u64 frames_output_in_interval =
+			div_u64((interval * runtime->rate), 1000000000);
+		snd_pcm_sframes_t frames_output_in_interval_sized =
+			-frames_output_in_interval;
+		runtime->delay = frames_output_in_interval_sized;
+	}
 
 	return snd_pcm_indirect_playback_pointer(substream,
 		&alsa_stream->pcm_indirect,
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index e13435d1c2051..595ad584243f6 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -78,6 +78,7 @@ struct bcm2835_alsa_stream {
 	unsigned int period_offset;
 	unsigned int buffer_size;
 	unsigned int period_size;
+	ktime_t interpolate_start;
 
 	struct bcm2835_audio_instance *instance;
 	int idx;
-- 
GitLab


From 853262cff0f8dfc2df68655596107ba3fb24bedf Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Thu, 6 Dec 2018 19:28:56 +0100
Subject: [PATCH 0478/1835] staging: bcm2835-audio: Enable compile test

commit 458d4866a34d0c129ffc3bd56345b2166ba46d77 upstream.

Enable the compilation test for bcm2835-audio to gain more build coverage.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/Kconfig b/drivers/staging/vc04_services/bcm2835-audio/Kconfig
index 9f536533c2576..62c1c8ba4ad44 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/Kconfig
+++ b/drivers/staging/vc04_services/bcm2835-audio/Kconfig
@@ -1,6 +1,6 @@
 config SND_BCM2835
         tristate "BCM2835 Audio"
-        depends on ARCH_BCM2835 && SND
+        depends on (ARCH_BCM2835 || COMPILE_TEST) && SND
         select SND_PCM
         select BCM2835_VCHIQ
         help
-- 
GitLab


From e133ef2ea1c0371d7455583383d2a5de1914a132 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Thu, 6 Dec 2018 19:28:57 +0100
Subject: [PATCH 0479/1835] staging: bcm2835-audio: use
 module_platform_driver() macro

commit 1e55d56344b0777d6cee9b9e4a813d53728ee798 upstream.

There is not much value behind this boilerplate, so use
module_platform_driver() instead.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 20 +------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index e14b7c5aa07c9..86b921030db7b 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -354,25 +354,7 @@ static struct platform_driver bcm2835_alsa_driver = {
 		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
-
-static int bcm2835_alsa_device_init(void)
-{
-	int retval;
-
-	retval = platform_driver_register(&bcm2835_alsa_driver);
-	if (retval)
-		pr_err("Error registering bcm2835_audio driver %d .\n", retval);
-
-	return retval;
-}
-
-static void bcm2835_alsa_device_exit(void)
-{
-	platform_driver_unregister(&bcm2835_alsa_driver);
-}
-
-late_initcall(bcm2835_alsa_device_init);
-module_exit(bcm2835_alsa_device_exit);
+module_platform_driver(bcm2835_alsa_driver);
 
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
-- 
GitLab


From 80ec8e12daee498aba2d1c47d4815f6826d3400e Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Thu, 6 Dec 2018 19:28:58 +0100
Subject: [PATCH 0480/1835] staging: bcm2835-audio: Drop DT dependency

commit 438fc48260a0afc4cee733e5bc20234ff2bbef56 upstream.

Just like the bcm2835-video make this a platform driver which is probed
by vchiq. In order to change the number of channels use a module
parameter instead, but use the maximum as default.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 31 ++++++-------------
 1 file changed, 9 insertions(+), 22 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 86b921030db7b..cf5f80f5ca6b0 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -6,13 +6,13 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/of.h>
 
 #include "bcm2835.h"
 
 static bool enable_hdmi;
 static bool enable_headphones;
 static bool enable_compat_alsa = true;
+static int num_channels = MAX_SUBSTREAMS;
 
 module_param(enable_hdmi, bool, 0444);
 MODULE_PARM_DESC(enable_hdmi, "Enables HDMI virtual audio device");
@@ -21,6 +21,8 @@ MODULE_PARM_DESC(enable_headphones, "Enables Headphones virtual audio device");
 module_param(enable_compat_alsa, bool, 0444);
 MODULE_PARM_DESC(enable_compat_alsa,
 		 "Enables ALSA compatibility virtual audio device");
+module_param(num_channels, int, 0644);
+MODULE_PARM_DESC(num_channels, "Number of audio channels (default: 8)");
 
 static void bcm2835_devm_free_vchi_ctx(struct device *dev, void *res)
 {
@@ -294,28 +296,19 @@ static int snd_add_child_devices(struct device *device, u32 numchans)
 static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	u32 numchans;
 	int err;
 
-	err = of_property_read_u32(dev->of_node, "brcm,pwm-channels",
-				   &numchans);
-	if (err) {
-		dev_err(dev, "Failed to get DT property 'brcm,pwm-channels'");
-		return err;
-	}
-
-	if (numchans == 0 || numchans > MAX_SUBSTREAMS) {
-		numchans = MAX_SUBSTREAMS;
-		dev_warn(dev,
-			 "Illegal 'brcm,pwm-channels' value, will use %u\n",
-			 numchans);
+	if (num_channels <= 0 || num_channels > MAX_SUBSTREAMS) {
+		num_channels = MAX_SUBSTREAMS;
+		dev_warn(dev, "Illegal num_channels value, will use %u\n",
+			 num_channels);
 	}
 
 	err = bcm2835_devm_add_vchi_ctx(dev);
 	if (err)
 		return err;
 
-	err = snd_add_child_devices(dev, numchans);
+	err = snd_add_child_devices(dev, num_channels);
 	if (err)
 		return err;
 
@@ -337,12 +330,6 @@ static int snd_bcm2835_alsa_resume(struct platform_device *pdev)
 
 #endif
 
-static const struct of_device_id snd_bcm2835_of_match_table[] = {
-	{ .compatible = "brcm,bcm2835-audio",},
-	{},
-};
-MODULE_DEVICE_TABLE(of, snd_bcm2835_of_match_table);
-
 static struct platform_driver bcm2835_alsa_driver = {
 	.probe = snd_bcm2835_alsa_probe,
 #ifdef CONFIG_PM
@@ -351,7 +338,6 @@ static struct platform_driver bcm2835_alsa_driver = {
 #endif
 	.driver = {
 		.name = "bcm2835_audio",
-		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
 module_platform_driver(bcm2835_alsa_driver);
@@ -359,3 +345,4 @@ module_platform_driver(bcm2835_alsa_driver);
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:bcm2835_audio");
-- 
GitLab


From e5b24439ee51039de5798f43520e4fe88e0f817c Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 17 Dec 2018 10:08:54 +0300
Subject: [PATCH 0481/1835] staging: bcm2835-audio: double free in init error
 path

commit 136ff5e49271c4c8fceeca5491c48e66b961564b upstream.

We free instance here and in the caller.  It should be only the caller
which handles it.

Fixes: d7ca3a71545b ("staging: bcm2835-audio: Operate non-atomic PCM ops")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index cf5ae1a28f52f..ea78e6aade7f7 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -145,7 +145,6 @@ vc_vchi_audio_init(VCHI_INSTANCE_T vchi_instance,
 		dev_err(instance->dev,
 			"failed to open VCHI service connection (status=%d)\n",
 			status);
-		kfree(instance);
 		return -EPERM;
 	}
 
-- 
GitLab


From ec56ce88dd11e901e4d75242e7c8488c31c0de7e Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Wed, 1 May 2019 15:00:05 +0100
Subject: [PATCH 0482/1835] dts: Increase default coherent pool size

dwc_otg allocates DMA-coherent buffers in atomic context for misaligned
transfer buffers. The pool that these allocations come from is set up
at boot-time but can be overridden by a commandline parameter -
increase this for now to prevent failures seen on 4.19 with multiple
USB Ethernet devices.

see: https://github.com/raspberrypi/linux/issues/2924
---
 arch/arm/boot/dts/bcm270x.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index 55a03c0d5e1c5..ecdb36e69c873 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -3,7 +3,7 @@
 
 / {
 	chosen {
-		bootargs = "";
+		bootargs = "coherent_pool=1M";
 		/delete-property/ stdout-path;
 	};
 
-- 
GitLab


From 4598a1ec6b36ca1495749ac255adbe88a6e5d60d Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Wed, 1 May 2019 14:23:39 +0100
Subject: [PATCH 0483/1835] Revert "staging: bcm2835-audio: Drop DT dependency"

This reverts commit 60a2e557a4f81480216066f22b84c3dda31b3470.
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 31 +++++++++++++------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index cf5f80f5ca6b0..86b921030db7b 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -6,13 +6,13 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/of.h>
 
 #include "bcm2835.h"
 
 static bool enable_hdmi;
 static bool enable_headphones;
 static bool enable_compat_alsa = true;
-static int num_channels = MAX_SUBSTREAMS;
 
 module_param(enable_hdmi, bool, 0444);
 MODULE_PARM_DESC(enable_hdmi, "Enables HDMI virtual audio device");
@@ -21,8 +21,6 @@ MODULE_PARM_DESC(enable_headphones, "Enables Headphones virtual audio device");
 module_param(enable_compat_alsa, bool, 0444);
 MODULE_PARM_DESC(enable_compat_alsa,
 		 "Enables ALSA compatibility virtual audio device");
-module_param(num_channels, int, 0644);
-MODULE_PARM_DESC(num_channels, "Number of audio channels (default: 8)");
 
 static void bcm2835_devm_free_vchi_ctx(struct device *dev, void *res)
 {
@@ -296,19 +294,28 @@ static int snd_add_child_devices(struct device *device, u32 numchans)
 static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
+	u32 numchans;
 	int err;
 
-	if (num_channels <= 0 || num_channels > MAX_SUBSTREAMS) {
-		num_channels = MAX_SUBSTREAMS;
-		dev_warn(dev, "Illegal num_channels value, will use %u\n",
-			 num_channels);
+	err = of_property_read_u32(dev->of_node, "brcm,pwm-channels",
+				   &numchans);
+	if (err) {
+		dev_err(dev, "Failed to get DT property 'brcm,pwm-channels'");
+		return err;
+	}
+
+	if (numchans == 0 || numchans > MAX_SUBSTREAMS) {
+		numchans = MAX_SUBSTREAMS;
+		dev_warn(dev,
+			 "Illegal 'brcm,pwm-channels' value, will use %u\n",
+			 numchans);
 	}
 
 	err = bcm2835_devm_add_vchi_ctx(dev);
 	if (err)
 		return err;
 
-	err = snd_add_child_devices(dev, num_channels);
+	err = snd_add_child_devices(dev, numchans);
 	if (err)
 		return err;
 
@@ -330,6 +337,12 @@ static int snd_bcm2835_alsa_resume(struct platform_device *pdev)
 
 #endif
 
+static const struct of_device_id snd_bcm2835_of_match_table[] = {
+	{ .compatible = "brcm,bcm2835-audio",},
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_bcm2835_of_match_table);
+
 static struct platform_driver bcm2835_alsa_driver = {
 	.probe = snd_bcm2835_alsa_probe,
 #ifdef CONFIG_PM
@@ -338,6 +351,7 @@ static struct platform_driver bcm2835_alsa_driver = {
 #endif
 	.driver = {
 		.name = "bcm2835_audio",
+		.of_match_table = snd_bcm2835_of_match_table,
 	},
 };
 module_platform_driver(bcm2835_alsa_driver);
@@ -345,4 +359,3 @@ module_platform_driver(bcm2835_alsa_driver);
 MODULE_AUTHOR("Dom Cobley");
 MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:bcm2835_audio");
-- 
GitLab


From 3f96ff60b1ca7a294c894f0185685f111b3aeaec Mon Sep 17 00:00:00 2001
From: Russell Joyce <russell.joyce@york.ac.uk>
Date: Wed, 1 May 2019 16:43:27 +0100
Subject: [PATCH 0484/1835] configs: Enable netdev LED trigger

Signed-off-by: Russell Joyce <russell.joyce@york.ac.uk>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index efb4c947293a0..0e58b45a9ae03 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1143,6 +1143,7 @@ CONFIG_LEDS_TRIGGER_TRANSIENT=m
 CONFIG_LEDS_TRIGGER_CAMERA=m
 CONFIG_LEDS_TRIGGER_INPUT=y
 CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_NETDEV=m
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
 CONFIG_RTC_DRV_ABX80X=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index af54579699ecf..72a587059dfa1 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1136,6 +1136,7 @@ CONFIG_LEDS_TRIGGER_TRANSIENT=m
 CONFIG_LEDS_TRIGGER_CAMERA=m
 CONFIG_LEDS_TRIGGER_INPUT=y
 CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_NETDEV=m
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
 CONFIG_RTC_DRV_ABX80X=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index fca85f7f75894..ef11079351f02 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1003,6 +1003,7 @@ CONFIG_LEDS_TRIGGER_TRANSIENT=m
 CONFIG_LEDS_TRIGGER_CAMERA=m
 CONFIG_LEDS_TRIGGER_INPUT=y
 CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_NETDEV=m
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
 CONFIG_RTC_DRV_ABX80X=m
-- 
GitLab


From 96b972dc736d943f371a16ccca452a053d83c65b Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Wed, 1 May 2019 17:04:32 +0100
Subject: [PATCH 0485/1835] smsc95xx: dynamically fix up TX buffer alignment
 with padding bytes

dwc_otg requires a 32-bit aligned buffer start address, otherwise
expensive bounce buffers are used. The LAN951x hardware can skip up to
3 bytes between the TX header and the start of frame data, which can
be used to force alignment of the URB passed to dwc_otg.

As found in https://github.com/raspberrypi/linux/issues/2924
---
 drivers/net/usb/smsc95xx.c | 12 +++++++-----
 drivers/net/usb/smsc95xx.h |  2 +-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index a5bbec75f22dc..c087b6d75753e 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -2082,7 +2082,9 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
 					 struct sk_buff *skb, gfp_t flags)
 {
 	bool csum = skb->ip_summed == CHECKSUM_PARTIAL;
-	int overhead = csum ? SMSC95XX_TX_OVERHEAD_CSUM : SMSC95XX_TX_OVERHEAD;
+	unsigned int align_bytes = -((uintptr_t)skb->data) & 0x3;
+	int overhead = csum ? SMSC95XX_TX_OVERHEAD_CSUM + align_bytes
+				: SMSC95XX_TX_OVERHEAD + align_bytes;
 	u32 tx_cmd_a, tx_cmd_b;
 
 	/* We do not advertise SG, so skbs should be already linearized */
@@ -2116,16 +2118,16 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
 		}
 	}
 
-	skb_push(skb, 4);
-	tx_cmd_b = (u32)(skb->len - 4);
+	skb_push(skb, 4 + align_bytes);
+	tx_cmd_b = (u32)(skb->len - 4 - align_bytes);
 	if (csum)
 		tx_cmd_b |= TX_CMD_B_CSUM_ENABLE;
 	cpu_to_le32s(&tx_cmd_b);
 	memcpy(skb->data, &tx_cmd_b, 4);
 
 	skb_push(skb, 4);
-	tx_cmd_a = (u32)(skb->len - 8) | TX_CMD_A_FIRST_SEG_ |
-		TX_CMD_A_LAST_SEG_;
+	tx_cmd_a = (u32)(skb->len - 8 - align_bytes) | TX_CMD_A_FIRST_SEG_ |
+		(align_bytes << 16) | TX_CMD_A_LAST_SEG_;
 	cpu_to_le32s(&tx_cmd_a);
 	memcpy(skb->data, &tx_cmd_a, 4);
 
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index cfc704f3a4608..55f9f03e1a0c9 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -21,7 +21,7 @@
 #define _SMSC95XX_H
 
 /* Tx command words */
-#define TX_CMD_A_DATA_OFFSET_	(0x001F0000)	/* Data Start Offset */
+#define TX_CMD_A_DATA_OFFSET_	(0x00030000)	/* Data Start Offset */
 #define TX_CMD_A_FIRST_SEG_	(0x00002000)	/* First Segment */
 #define TX_CMD_A_LAST_SEG_	(0x00001000)	/* Last Segment */
 #define TX_CMD_A_BUF_SIZE_	(0x000007FF)	/* Buffer Size */
-- 
GitLab


From a53877cb73849efee751683bbb2820681143deee Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Thu, 2 May 2019 11:53:45 +0100
Subject: [PATCH 0486/1835] lan78xx: use default alignment for rx buffers

The lan78xx uses a 12-byte hardware rx header, so there is no need
to allocate SKBs with NET_IP_ALIGN set. Removes alignment faults
in both dwc_otg and in ipv6 processing.
---
 drivers/net/usb/lan78xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 3387f44b132fe..14f206a56187c 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3250,7 +3250,7 @@ static int rx_submit(struct lan78xx_net *dev, struct urb *urb, gfp_t flags)
 	size_t size = dev->rx_urb_size;
 	int ret = 0;
 
-	skb = netdev_alloc_skb_ip_align(dev->net, size);
+	skb = netdev_alloc_skb(dev->net, size);
 	if (!skb) {
 		usb_free_urb(urb);
 		return -ENOMEM;
-- 
GitLab


From a2fb1161ed28dcf41a69a4f9e3dec312ea544097 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 2 May 2019 14:30:24 +0100
Subject: [PATCH 0487/1835] staging: bcm2835-codec: Correct port width calc for
 truncation

The calculation converting from V4L2 bytesperline to MMAL
width had an operator ordering issue that lead to Bayer raw 10
(and 12 and 14) setting an incorrect stride for the buffer.
Correct this operation ordering issue.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 4b67c9ea73e13..97b1f2b953eca 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -605,8 +605,8 @@ static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
 
 	if (!(q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED)) {
 		/* Raw image format - set width/height */
-		port->es.video.width = q_data->bytesperline /
-						(q_data->fmt->depth >> 3);
+		port->es.video.width = (q_data->bytesperline << 3) /
+						q_data->fmt->depth;
 		port->es.video.height = q_data->height;
 		port->es.video.crop.width = q_data->crop_width;
 		port->es.video.crop.height = q_data->crop_height;
-- 
GitLab


From 3123a749e2eb9bf6e1cb58593ed3ff60cb9bd718 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 2 May 2019 14:32:21 +0100
Subject: [PATCH 0488/1835] staging: bcm2835-codec: Remove height padding for
 ISP role

The ISP has no need for heights to be a multiple of macroblock
sizes, therefore doesn't require the align on the height.
Remove it for the ISP role. (It is required for the codecs).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c              | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 97b1f2b953eca..22588f78287e5 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -1015,7 +1015,8 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
 	return vidioc_g_fmt(file2ctx(file), f);
 }
 
-static int vidioc_try_fmt(struct v4l2_format *f, struct bcm2835_codec_fmt *fmt)
+static int vidioc_try_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
+			  struct bcm2835_codec_fmt *fmt)
 {
 	/*
 	 * The V4L2 specification requires the driver to correct the format
@@ -1034,11 +1035,13 @@ static int vidioc_try_fmt(struct v4l2_format *f, struct bcm2835_codec_fmt *fmt)
 			f->fmt.pix.height = MIN_H;
 
 		/*
-		 * Buffer must have a vertical alignment of 16 lines.
+		 * For codecs the buffer must have a vertical alignment of 16
+		 * lines.
 		 * The selection will reflect any cropping rectangle when only
 		 * some of the pixels are active.
 		 */
-		f->fmt.pix.height = ALIGN(f->fmt.pix.height, 16);
+		if (ctx->dev->role != ISP)
+			f->fmt.pix.height = ALIGN(f->fmt.pix.height, 16);
 	}
 	f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
 						   fmt);
@@ -1065,7 +1068,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 		fmt = find_format(f, ctx->dev, true);
 	}
 
-	return vidioc_try_fmt(f, fmt);
+	return vidioc_try_fmt(ctx, f, fmt);
 }
 
 static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
@@ -1084,7 +1087,7 @@ static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
 	if (!f->fmt.pix.colorspace)
 		f->fmt.pix.colorspace = ctx->colorspace;
 
-	return vidioc_try_fmt(f, fmt);
+	return vidioc_try_fmt(ctx, f, fmt);
 }
 
 static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
-- 
GitLab


From 06e48eb965dff55f5c2c3b55095704690f9cebe8 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 1 May 2019 13:27:23 +0100
Subject: [PATCH 0489/1835] staging: mmal-vchiq: Free the event context for
 control ports

vchiq_mmal_component_init calls init_event_context for the
control port, but vchiq_mmal_component_finalise didn't free
it, causing a memory leak..

Add the free call.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 7a48877ffff5a..68c5881f3bf6b 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1981,6 +1981,8 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 	for (idx = 0; idx < component->clocks; idx++)
 		free_event_context(&component->clock[idx]);
 
+	free_event_context(&component->control);
+
 	mutex_unlock(&instance->vchiq_mutex);
 
 	return ret;
-- 
GitLab


From d5f6ac9ec315560a4097af0801dd79b5ee00cb4b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 1 May 2019 15:17:00 +0100
Subject: [PATCH 0490/1835] staging: mmal-vchiq: Replace spinlock protecting
 context_map with mutex

950fd86 staging: bcm2835-camera: Replace open-coded idr with a struct idr.
replaced an internal implementation of an idr with the standard functions
and a spinlock.
idr_alloc(GFP_KERNEL) can sleep whilst calling kmem_cache_alloc to allocate
the new node, but this is not valid whilst in an atomic context due to the
spinlock.

There is no need for this to be a spinlock as a standard mutex is
sufficient.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vchiq-mmal/mmal-vchiq.c   | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 68c5881f3bf6b..bce42b652e57d 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -185,7 +185,8 @@ struct vchiq_mmal_instance {
 	void *bulk_scratch;
 
 	struct idr context_map;
-	spinlock_t context_map_lock;
+	/* protect accesses to context_map */
+	struct mutex context_map_lock;
 
 	struct vchiq_mmal_component component[VCHIQ_MMAL_MAX_COMPONENTS];
 
@@ -209,10 +210,10 @@ get_msg_context(struct vchiq_mmal_instance *instance)
 	 * that when we service the VCHI reply, we can look up what
 	 * message is being replied to.
 	 */
-	spin_lock(&instance->context_map_lock);
+	mutex_lock(&instance->context_map_lock);
 	handle = idr_alloc(&instance->context_map, msg_context,
 			   0, 0, GFP_KERNEL);
-	spin_unlock(&instance->context_map_lock);
+	mutex_unlock(&instance->context_map_lock);
 
 	if (handle < 0) {
 		kfree(msg_context);
@@ -236,9 +237,9 @@ release_msg_context(struct mmal_msg_context *msg_context)
 {
 	struct vchiq_mmal_instance *instance = msg_context->instance;
 
-	spin_lock(&instance->context_map_lock);
+	mutex_lock(&instance->context_map_lock);
 	idr_remove(&instance->context_map, msg_context->handle);
-	spin_unlock(&instance->context_map_lock);
+	mutex_unlock(&instance->context_map_lock);
 	kfree(msg_context);
 }
 
@@ -2143,7 +2144,7 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
 
 	instance->bulk_scratch = vmalloc(PAGE_SIZE);
 
-	spin_lock_init(&instance->context_map_lock);
+	mutex_init(&instance->context_map_lock);
 	idr_init_base(&instance->context_map, 1);
 
 	params.callback_param = instance;
-- 
GitLab


From 1c2f59f01b7189e1fb71d1109dbe7fac459b88a3 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 2 May 2019 22:14:34 +0100
Subject: [PATCH 0491/1835] BCM270X_DT: Also set coherent_pool=1M for BT Pis

See: https://github.com/raspberrypi/linux/issues/2924

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2708-rpi-0-w.dts      | 2 +-
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts | 2 +-
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
index 68316404aab22..aa33646fcf531 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
@@ -8,7 +8,7 @@
 	model = "Raspberry Pi Zero W";
 
 	chosen {
-		bootargs = "8250.nr_uarts=1";
+		bootargs = "coherent_pool=1M 8250.nr_uarts=1";
 	};
 
 	aliases {
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
index 898ab48479e32..b5f125296e1e9 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -9,7 +9,7 @@
 	model = "Raspberry Pi 3 Model B+";
 
 	chosen {
-		bootargs = "8250.nr_uarts=1";
+		bootargs = "coherent_pool=1M 8250.nr_uarts=1";
 	};
 
 	aliases {
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index 61ecb46b9c060..d9d9505c66932 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -9,7 +9,7 @@
 	model = "Raspberry Pi 3 Model B";
 
 	chosen {
-		bootargs = "8250.nr_uarts=1";
+		bootargs = "coherent_pool=1M 8250.nr_uarts=1";
 	};
 
 	aliases {
-- 
GitLab


From 90e639568df0a25694a9cb7a3a1d1a23b3308733 Mon Sep 17 00:00:00 2001
From: Russell Joyce <russell.joyce@york.ac.uk>
Date: Thu, 2 May 2019 15:18:36 +0100
Subject: [PATCH 0492/1835] configs: Enable ICS-43432 I2S microphone module

Signed-off-by: Russell Joyce <russell.joyce@york.ac.uk>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 0e58b45a9ae03..596977b76e0a8 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -943,6 +943,7 @@ CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
 CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_ICS43432=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 72a587059dfa1..261e66caf5773 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -936,6 +936,7 @@ CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
 CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_ICS43432=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index ef11079351f02..1a5f860700c44 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -822,6 +822,7 @@ CONFIG_SND_SOC_AD193X_I2C=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_AK4554=m
 CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_ICS43432=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
 CONFIG_HIDRAW=y
-- 
GitLab


From 365ab793942c71df7615392f13cda736f12dceed Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@gmail.com>
Date: Sun, 5 May 2019 21:07:12 +0100
Subject: [PATCH 0493/1835] arm: dts: overlays: rpi-sense: add upstream
 humidity compatible

The upstream humidiity driver uses "st,hts221" for the compatible
string so add that in as well so it will work with an unmodified
upstream kernel driver. We leave the downstream as the priority.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
---
 arch/arm/boot/dts/overlays/rpi-sense-overlay.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
index 27153240e1be5..6eba2a10bfa5c 100644
--- a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
@@ -38,7 +38,7 @@
 			};
 
 			hts221-humid@5f {
-				compatible = "st,hts221-humid";
+				compatible = "st,hts221-humid", "st,hts221";
 				reg = <0x5f>;
 				status = "okay";
 			};
-- 
GitLab


From ebfca1b4585632188f1e1a57b53b414523daa5c0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 2 May 2019 15:50:01 +0100
Subject: [PATCH 0494/1835] staging: mmal-vchiq: Fix memory leak in error path

On error, vchiq_mmal_component_init could leave the
event context allocated for ports.
Clean them up in the error path.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/vchiq-mmal/mmal-vchiq.c     | 27 +++++++++++++------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index bce42b652e57d..c82fb0fad9d44 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -1848,9 +1848,26 @@ static void free_event_context(struct vchiq_mmal_port *port)
 {
 	struct mmal_msg_context *ctx = port->event_context;
 
+	if (!ctx)
+		return;
+
 	kfree(ctx->u.bulk.buffer->buffer);
 	kfree(ctx->u.bulk.buffer);
 	release_msg_context(ctx);
+	port->event_context = NULL;
+}
+
+static void release_all_event_contexts(struct vchiq_mmal_component *component)
+{
+	int idx;
+
+	for (idx = 0; idx < component->inputs; idx++)
+		free_event_context(&component->input[idx]);
+	for (idx = 0; idx < component->outputs; idx++)
+		free_event_context(&component->output[idx]);
+	for (idx = 0; idx < component->clocks; idx++)
+		free_event_context(&component->clock[idx]);
+	free_event_context(&component->control);
 }
 
 /* Initialise a mmal component and its ports
@@ -1948,6 +1965,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 
 release_component:
 	destroy_component(instance, component);
+	release_all_event_contexts(component);
 unlock:
 	if (component)
 		component->in_use = 0;
@@ -1975,14 +1993,7 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 
 	component->in_use = 0;
 
-	for (idx = 0; idx < component->inputs; idx++)
-		free_event_context(&component->input[idx]);
-	for (idx = 0; idx < component->outputs; idx++)
-		free_event_context(&component->output[idx]);
-	for (idx = 0; idx < component->clocks; idx++)
-		free_event_context(&component->clock[idx]);
-
-	free_event_context(&component->control);
+	release_all_event_contexts(component);
 
 	mutex_unlock(&instance->vchiq_mutex);
 
-- 
GitLab


From ed98ed3ae5aa7d2a13b7606373fc2b788edd1b4e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 3 May 2019 13:27:51 +0100
Subject: [PATCH 0495/1835] staging: vchiq-mmal: Fix memory leak of vchiq
 instance

The vchiq instance was allocated from vchiq_mmal_init via
vchi_initialise, but was never released with vchi_disconnect.

Retain the handle and release it from vchiq_mmal_finalise.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index c82fb0fad9d44..5bfba5b5b08f1 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -176,6 +176,7 @@ struct mmal_msg_context {
 };
 
 struct vchiq_mmal_instance {
+	VCHI_INSTANCE_T vchi_instance;
 	VCHI_SERVICE_HANDLE_T handle;
 
 	/* ensure serialised access to service */
@@ -1981,7 +1982,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_init);
 int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 				  struct vchiq_mmal_component *component)
 {
-	int ret, idx;
+	int ret;
 
 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
 		return -EINTR;
@@ -2094,6 +2095,8 @@ int vchiq_mmal_finalise(struct vchiq_mmal_instance *instance)
 
 	idr_destroy(&instance->context_map);
 
+	vchi_disconnect(instance->vchi_instance);
+
 	kfree(instance);
 
 	return status;
@@ -2105,7 +2108,7 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
 	int status;
 	struct vchiq_mmal_instance *instance;
 	static VCHI_CONNECTION_T *vchi_connection;
-	static VCHI_INSTANCE_T vchi_instance;
+	VCHI_INSTANCE_T vchi_instance;
 	SERVICE_CREATION_T params = {
 		.version		= VCHI_VERSION_EX(VC_MMAL_VER, VC_MMAL_MIN_VER),
 		.service_id		= VC_MMAL_SERVER_NAME,
@@ -2151,6 +2154,8 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
 	if (!instance)
 		return -ENOMEM;
 
+	instance->vchi_instance = vchi_instance;
+
 	mutex_init(&instance->vchiq_mutex);
 
 	instance->bulk_scratch = vmalloc(PAGE_SIZE);
-- 
GitLab


From 8a61a0791ab90cd7d2c1ef270ebc056580940b0e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 13 May 2019 17:34:29 +0100
Subject: [PATCH 0496/1835] Revert "video: bcm2708_fb: Try allocating on the
 ARM and passing to VPU"

This reverts commit ca36c709fce57e8023d2b8b354376bf161601a49.

The driver tries a cma_alloc to avoid using gpu_mem, but should
that fail the core code is logging an error with no easy way to
test whether it will succeed or fail first.

Revert until we either totally give up on gpu_mem and increase
CMA always, or find a way to try an allocation.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/video/fbdev/bcm2708_fb.c           | 102 +++------------------
 include/soc/bcm2835/raspberrypi-firmware.h |   1 -
 2 files changed, 12 insertions(+), 91 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 0cdec747d5e35..209a1504a1608 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -98,11 +98,6 @@ struct bcm2708_fb {
 	struct bcm2708_fb_stats stats;
 	unsigned long fb_bus_address;
 	struct { u32 base, length; } gpu;
-
-	bool disable_arm_alloc;
-	unsigned int image_size;
-	dma_addr_t dma_addr;
-	void *cpuaddr;
 };
 
 #define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
@@ -288,88 +283,23 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 			.xoffset = info->var.xoffset,
 			.yoffset = info->var.yoffset,
 		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
-			/* base and screen_size will be initialised later */
-		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
-			/* pitch will be initialised later */
+			.base = 0,
+			.screen_size = 0,
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH, 4, 0 },
+			.pitch = 0,
 	};
-	int ret, image_size;
-
+	int ret;
 
 	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
 		    info->var.xres, info->var.yres, info->var.xres_virtual,
 		    info->var.yres_virtual, (int)info->screen_size,
 		    info->var.bits_per_pixel);
 
-	/* Try allocating our own buffer. We can specify all the parameters */
-	image_size = ((info->var.xres * info->var.yres) *
-		      info->var.bits_per_pixel) >> 3;
-
-	if (!fb->disable_arm_alloc &&
-	    (image_size != fb->image_size || !fb->dma_addr)) {
-		if (fb->dma_addr) {
-			dma_free_coherent(info->device, fb->image_size,
-					  fb->cpuaddr, fb->dma_addr);
-			fb->image_size = 0;
-			fb->cpuaddr = NULL;
-			fb->dma_addr = 0;
-		}
-
-		fb->cpuaddr = dma_alloc_coherent(info->device, image_size,
-						 &fb->dma_addr, GFP_KERNEL);
-
-		if (!fb->cpuaddr) {
-			fb->dma_addr = 0;
-			fb->disable_arm_alloc = true;
-		} else {
-			fb->image_size = image_size;
-		}
-	}
-
-	if (fb->cpuaddr) {
-		fbinfo.base = fb->dma_addr;
-		fbinfo.screen_size = image_size;
-		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
-
-		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
-						 sizeof(fbinfo));
-		if (ret || fbinfo.base != fb->dma_addr) {
-			/* Firmware either failed, or assigned a different base
-			 * address (ie it doesn't support being passed an FB
-			 * allocation).
-			 * Destroy the allocation, and don't try again.
-			 */
-			dma_free_coherent(info->device, fb->image_size,
-					  fb->cpuaddr, fb->dma_addr);
-			fb->image_size = 0;
-			fb->cpuaddr = NULL;
-			fb->dma_addr = 0;
-			fb->disable_arm_alloc = true;
-		}
-	} else {
-		/* Our allocation failed - drop into the old scheme of
-		 * allocation by the VPU.
-		 */
-		ret = -ENOMEM;
-	}
-
+	ret = rpi_firmware_property_list(fb->fw, &fbinfo, sizeof(fbinfo));
 	if (ret) {
-		/* Old scheme:
-		 * - FRAMEBUFFER_ALLOCATE passes 0 for base and screen_size.
-		 * - GET_PITCH instead of SET_PITCH.
-		 */
-		fbinfo.base = 0;
-		fbinfo.screen_size = 0;
-		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
-		fbinfo.pitch = 0;
-
-		ret = rpi_firmware_property_list(fb->fw, &fbinfo,
-						 sizeof(fbinfo));
-		if (ret) {
-			dev_err(info->device,
-				"Failed to allocate GPU framebuffer (%d)\n",
-				ret);
-			return ret;
-		}
+		dev_err(info->device,
+			"Failed to allocate GPU framebuffer (%d)\n", ret);
+		return ret;
 	}
 
 	if (info->var.bits_per_pixel <= 8)
@@ -384,17 +314,9 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 	fb->fb.fix.smem_start = fbinfo.base;
 	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
 	fb->fb.screen_size = fbinfo.screen_size;
-
-	if (!fb->dma_addr) {
-		if (fb->fb.screen_base)
-			iounmap(fb->fb.screen_base);
-
-		fb->fb.screen_base = ioremap_wc(fbinfo.base,
-						fb->fb.screen_size);
-	} else {
-		fb->fb.screen_base = fb->cpuaddr;
-	}
-
+	if (fb->fb.screen_base)
+		iounmap(fb->fb.screen_base);
+	fb->fb.screen_base = ioremap_wc(fbinfo.base, fb->fb.screen_size);
 	if (!fb->fb.screen_base) {
 		/* the console may currently be locked */
 		console_trylock();
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index e35a89eeee265..23b9d356537f3 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -128,7 +128,6 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PIXEL_ORDER =            0x00048006,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE =             0x00048007,
-	RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH =                  0x00048008,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
-- 
GitLab


From 43f2cb3b638557821e2f924e403795d1227ce9bf Mon Sep 17 00:00:00 2001
From: IQaudIO <gordon@iqaudio.com>
Date: Mon, 13 May 2019 21:53:05 +0100
Subject: [PATCH 0497/1835] Added IQaudIO Pi-Codec board support (#2969)

Add support for the IQaudIO Pi-Codec board.

Signed-off-by: Gordon <gordon@iqaudio.com>
---
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |   6 +
 .../dts/overlays/iqaudio-codec-overlay.dts    |  42 +++
 arch/arm/configs/bcm2709_defconfig            |   1 +
 arch/arm/configs/bcmrpi_defconfig             |   1 +
 arch/arm64/configs/bcmrpi3_defconfig          |   1 +
 sound/soc/bcm/Kconfig                         |   7 +
 sound/soc/bcm/Makefile                        |   2 +
 sound/soc/bcm/iqaudio-codec.c                 | 250 ++++++++++++++++++
 9 files changed, 311 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
 create mode 100644 sound/soc/bcm/iqaudio-codec.c

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 87fd56756b1e7..5d92308c80eaf 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -68,6 +68,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	i2c1-bcm2708.dtbo \
 	i2s-gpio28-31.dtbo \
 	ilitek251x.dtbo \
+	iqaudio-codec.dtbo \
 	iqaudio-dac.dtbo \
 	iqaudio-dacplus.dtbo \
 	iqaudio-digi-wm8804-audio.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index e5e219d6190c9..f81fe9693885a 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1160,6 +1160,12 @@ Params: interrupt               GPIO used for interrupt (default 4)
                                 touchscreen (in pixels)
 
 
+Name:   iqaudio-codec
+Info:   Configures the IQaudio Codec audio card
+Load:   dtoverlay=iqaudio-codec
+Params: <None>
+
+
 Name:   iqaudio-dac
 Info:   Configures the IQaudio DAC audio card
 Load:   dtoverlay=iqaudio-dac,<param>
diff --git a/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
new file mode 100644
index 0000000000000..ff3ef3942c6c0
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-codec-overlay.dts
@@ -0,0 +1,42 @@
+// Definitions for IQaudIO CODEC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			da2713@1a {
+				#sound-dai-cells = <0>;
+				compatible = "dlg,da7213";
+				reg = <0x1a>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		iqaudio_dac: __overlay__ {
+			compatible = "iqaudio,iqaudio-codec";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 596977b76e0a8..f09baa6b7c967 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -919,6 +919,7 @@ CONFIG_SND_BCM2708_SOC_RPI_DAC=m
 CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
 CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 261e66caf5773..71beff61a95c6 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -912,6 +912,7 @@ CONFIG_SND_BCM2708_SOC_RPI_DAC=m
 CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
 CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 1a5f860700c44..904163e4266dd 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -807,6 +807,7 @@ CONFIG_SND_BCM2708_SOC_RPI_DAC=m
 CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
 CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
 CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 85ba814935068..9cfe86ef58617 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -108,6 +108,13 @@ config SND_BCM2708_SOC_JUSTBOOM_DIGI
 	help
 	  Say Y or M if you want to add support for JustBoom Digi.
 
+config SND_BCM2708_SOC_IQAUDIO_CODEC
+	tristate "Support for IQaudIO-CODEC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_DA7213
+	help
+	  Say Y or M if you want to add support for IQaudIO-CODEC.
+
 config SND_BCM2708_SOC_IQAUDIO_DAC
 	tristate "Support for IQaudIO-DAC"
 	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index 8f8fb92b6436e..356bd229e48c2 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -18,6 +18,7 @@ snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
 snd-soc-justboom-dac-objs := justboom-dac.o
 snd-soc-rpi-cirrus-objs := rpi-cirrus.o
 snd-soc-rpi-proto-objs := rpi-proto.o
+snd-soc-iqaudio-codec-objs := iqaudio-codec.o
 snd-soc-iqaudio-dac-objs := iqaudio-dac.o
  snd-soc-i-sabre-q2m-objs := i-sabre-q2m.o
 snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
@@ -42,6 +43,7 @@ obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusa
 obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
+obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC) += snd-soc-iqaudio-codec.o
 obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
  obj-$(CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M) += snd-soc-i-sabre-q2m.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
diff --git a/sound/soc/bcm/iqaudio-codec.c b/sound/soc/bcm/iqaudio-codec.c
new file mode 100644
index 0000000000000..4051a5f4269d9
--- /dev/null
+++ b/sound/soc/bcm/iqaudio-codec.c
@@ -0,0 +1,250 @@
+/*
+ * ASoC Driver for IQaudIO Raspberry Pi Codec board
+ *
+ * Author:	Gordon Garrity <gordon@iqaudio.com>
+ *		(C) Copyright IQaudio Limited, 2017-2019
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include <linux/acpi.h>
+#include <linux/slab.h>
+#include "../codecs/da7213.h"
+
+static int pll_out = DA7213_PLL_FREQ_OUT_90316800;
+
+static int snd_rpi_iqaudio_pll_control(struct snd_soc_dapm_widget *w,
+				       struct snd_kcontrol *k, int  event)
+{
+	int ret = 0;
+	struct snd_soc_dapm_context *dapm = w->dapm;
+	struct snd_soc_card *card = dapm->card;
+	struct snd_soc_pcm_runtime *rtd =
+		snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+
+	if (SND_SOC_DAPM_EVENT_OFF(event)) {
+		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_MCLK, 0,
+					  0);
+		if (ret)
+			dev_err(card->dev, "Failed to bypass PLL: %d\n", ret);
+	} else if (SND_SOC_DAPM_EVENT_ON(event)) {
+		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_PLL, 0,
+					  pll_out);
+		if (ret)
+			dev_err(card->dev, "Failed to enable PLL: %d\n", ret);
+	}
+
+	return ret;
+}
+
+static int snd_rpi_iqaudio_post_dapm_event(struct snd_soc_dapm_widget *w,
+                              struct snd_kcontrol *kcontrol,
+                              int event)
+{
+     switch (event) {
+     case SND_SOC_DAPM_POST_PMU:
+           /* Delay for mic bias ramp */
+           msleep(1000);
+           break;
+     default:
+           break;
+     }
+
+     return 0;
+}
+
+static const struct snd_soc_dapm_widget dapm_widgets[] = {
+	SND_SOC_DAPM_HP("HP Jack", NULL),
+	SND_SOC_DAPM_MIC("MIC Jack", NULL),
+	SND_SOC_DAPM_MIC("Onboard MIC", NULL),
+	SND_SOC_DAPM_LINE("AUX Jack", NULL),
+	SND_SOC_DAPM_SUPPLY("PLL Control", SND_SOC_NOPM, 0, 0,
+			    snd_rpi_iqaudio_pll_control,
+			    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_POST("Post Power Up Event", snd_rpi_iqaudio_post_dapm_event),
+};
+
+static const struct snd_soc_dapm_route audio_map[] = {
+	{"HP Jack", NULL, "HPL"},
+	{"HP Jack", NULL, "HPR"},
+	{"HP Jack", NULL, "PLL Control"},
+
+	{"AUX Jack", NULL, "AUXR"},
+	{"AUX Jack", NULL, "AUXL"},
+	{"AUX Jack", NULL, "PLL Control"},
+
+	/* Assume Mic1 is linked to Headset and Mic2 to on-board mic */
+	{"MIC Jack", NULL, "MIC1"},
+	{"MIC Jack", NULL, "PLL Control"},
+	{"Onboard MIC", NULL, "MIC2"},
+	{"Onboard MIC", NULL, "PLL Control"},
+};
+
+/* machine stream operations */
+
+static int snd_rpi_iqaudio_codec_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	int ret;
+
+	/* Set bclk ratio to align with codec's BCLK rate */
+	ret = snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+	if (ret) {
+		dev_err(rtd->dev, "Failed to set CPU BLCK ratio\n");
+		return ret;
+	}
+
+	/* Set MCLK frequency to codec, onboard 11.2896MHz clock */
+	return snd_soc_dai_set_sysclk(codec_dai, DA7213_CLKSRC_MCLK, 11289600,
+				      SND_SOC_CLOCK_OUT);
+}
+
+static int snd_rpi_iqaudio_codec_hw_params(struct snd_pcm_substream *substream,
+					   struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	unsigned int samplerate = params_rate(params);
+
+	switch (samplerate) {
+	case  8000:
+	case 16000:
+	case 32000:
+	case 48000:
+	case 96000:
+		pll_out = DA7213_PLL_FREQ_OUT_98304000;
+		return 0;
+	case 44100:
+	case 88200:
+		pll_out = DA7213_PLL_FREQ_OUT_90316800;
+		return 0;
+	default:
+		dev_err(rtd->dev,"Unsupported samplerate %d\n", samplerate);
+		return -EINVAL;
+	}
+}
+
+static const struct snd_soc_ops snd_rpi_iqaudio_codec_ops = {
+	.hw_params = snd_rpi_iqaudio_codec_hw_params,
+};
+
+
+static struct snd_soc_dai_link snd_rpi_iqaudio_codec_dai[] = {
+{
+	.cpu_dai_name 		= "bcm2708-i2s.0",
+	.codec_dai_name 	= "da7213-hifi",
+	.platform_name 		= "bmc2708-i2s.0",
+	.codec_name 		= "da7213.1-001a",
+	.dai_fmt 		= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				  SND_SOC_DAIFMT_CBM_CFM,
+	.init			= snd_rpi_iqaudio_codec_init,
+	.ops			= &snd_rpi_iqaudio_codec_ops,
+	.symmetric_rates	= 1,
+	.symmetric_channels	= 1,
+	.symmetric_samplebits	= 1,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_iqaudio_codec = {
+	.owner			= THIS_MODULE,
+	.dai_link		= snd_rpi_iqaudio_codec_dai,
+	.num_links		= ARRAY_SIZE(snd_rpi_iqaudio_codec_dai),
+	.dapm_widgets		= dapm_widgets,
+	.num_dapm_widgets	= ARRAY_SIZE(dapm_widgets),
+	.dapm_routes		= audio_map,
+	.num_dapm_routes	= ARRAY_SIZE(audio_map),
+};
+
+static int snd_rpi_iqaudio_codec_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_iqaudio_codec.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_card *card = &snd_rpi_iqaudio_codec;
+		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_codec_dai[0];
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		if (of_property_read_string(pdev->dev.of_node, "card_name",
+					    &card->name))
+			card->name = "IQaudIOCODEC";
+
+		if (of_property_read_string(pdev->dev.of_node, "dai_name",
+					    &dai->name))
+			dai->name = "IQaudIO CODEC";
+
+		if (of_property_read_string(pdev->dev.of_node,
+					"dai_stream_name", &dai->stream_name))
+			dai->stream_name = "IQaudIO CODEC HiFi v1.1";
+
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_iqaudio_codec);
+	if (ret) {
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int snd_rpi_iqaudio_codec_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_iqaudio_codec);
+}
+
+static const struct of_device_id iqaudio_of_match[] = {
+	{ .compatible = "iqaudio,iqaudio-codec", },
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, iqaudio_of_match);
+
+static struct platform_driver snd_rpi_iqaudio_codec_driver = {
+	.driver = {
+		.name   = "snd-rpi-iqaudio-codec",
+		.owner  = THIS_MODULE,
+		.of_match_table = iqaudio_of_match,
+	},
+	.probe          = snd_rpi_iqaudio_codec_probe,
+	.remove         = snd_rpi_iqaudio_codec_remove,
+};
+
+
+
+module_platform_driver(snd_rpi_iqaudio_codec_driver);
+
+MODULE_AUTHOR("Gordon Garrity <gordon@iqaudio.com>");
+MODULE_DESCRIPTION("ASoC Driver for IQaudIO CODEC");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From f35a1df812cdfc093fdf3f352650e19905e41c48 Mon Sep 17 00:00:00 2001
From: P33M <p33m@github.com>
Date: Tue, 14 May 2019 14:55:19 +0100
Subject: [PATCH 0498/1835] Revert "smsc95xx: dynamically fix up TX buffer
 alignment with padding bytes"

As reported in https://github.com/raspberrypi/linux/issues/2964 this
commit causes a regression corrupting non-option TCP ack packets.

This reverts commit 96b972dc736d943f371a16ccca452a053d83c65b.
---
 drivers/net/usb/smsc95xx.c | 12 +++++-------
 drivers/net/usb/smsc95xx.h |  2 +-
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index c087b6d75753e..a5bbec75f22dc 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -2082,9 +2082,7 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
 					 struct sk_buff *skb, gfp_t flags)
 {
 	bool csum = skb->ip_summed == CHECKSUM_PARTIAL;
-	unsigned int align_bytes = -((uintptr_t)skb->data) & 0x3;
-	int overhead = csum ? SMSC95XX_TX_OVERHEAD_CSUM + align_bytes
-				: SMSC95XX_TX_OVERHEAD + align_bytes;
+	int overhead = csum ? SMSC95XX_TX_OVERHEAD_CSUM : SMSC95XX_TX_OVERHEAD;
 	u32 tx_cmd_a, tx_cmd_b;
 
 	/* We do not advertise SG, so skbs should be already linearized */
@@ -2118,16 +2116,16 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
 		}
 	}
 
-	skb_push(skb, 4 + align_bytes);
-	tx_cmd_b = (u32)(skb->len - 4 - align_bytes);
+	skb_push(skb, 4);
+	tx_cmd_b = (u32)(skb->len - 4);
 	if (csum)
 		tx_cmd_b |= TX_CMD_B_CSUM_ENABLE;
 	cpu_to_le32s(&tx_cmd_b);
 	memcpy(skb->data, &tx_cmd_b, 4);
 
 	skb_push(skb, 4);
-	tx_cmd_a = (u32)(skb->len - 8 - align_bytes) | TX_CMD_A_FIRST_SEG_ |
-		(align_bytes << 16) | TX_CMD_A_LAST_SEG_;
+	tx_cmd_a = (u32)(skb->len - 8) | TX_CMD_A_FIRST_SEG_ |
+		TX_CMD_A_LAST_SEG_;
 	cpu_to_le32s(&tx_cmd_a);
 	memcpy(skb->data, &tx_cmd_a, 4);
 
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index 55f9f03e1a0c9..cfc704f3a4608 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -21,7 +21,7 @@
 #define _SMSC95XX_H
 
 /* Tx command words */
-#define TX_CMD_A_DATA_OFFSET_	(0x00030000)	/* Data Start Offset */
+#define TX_CMD_A_DATA_OFFSET_	(0x001F0000)	/* Data Start Offset */
 #define TX_CMD_A_FIRST_SEG_	(0x00002000)	/* First Segment */
 #define TX_CMD_A_LAST_SEG_	(0x00001000)	/* Last Segment */
 #define TX_CMD_A_BUF_SIZE_	(0x000007FF)	/* Buffer Size */
-- 
GitLab


From ac0945c841b352614d21429afcf0b953423aa99e Mon Sep 17 00:00:00 2001
From: Henrique Gontijo <hgontijo@guidewire.com>
Date: Sun, 12 May 2019 17:11:02 -0700
Subject: [PATCH 0499/1835] configs: Enable PIDs cgroup

My use case to is to allow Kubernetes master to run on Raspberry Pi 3.
Kubernetes introduced [Pid limiting](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190129-pid-limiting.md),
on v.1.14.0 which includes [Pod Pids Limit](https://github.com/kubernetes/kubernetes/commit/bce9d5f2043bd86964c9fec80d466e47776071bc)
and [Node Pids Limit](https://github.com/kubernetes/kubernetes/commit/2597a1d97ef4d8f54b1ca661453e32794b756909#diff-fa76bb6ae2d9b4bb3d023737fe5e6029R333)
that requires pids cgroup.

See: https://github.com/raspberrypi/linux/pull/2968
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index f09baa6b7c967..a9aa06f0fc6e2 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -20,6 +20,7 @@ CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PIDS=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
-- 
GitLab


From 646f633466ac539a329dd3694c3ec74d55297855 Mon Sep 17 00:00:00 2001
From: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
Date: Thu, 28 Mar 2019 12:41:11 -0400
Subject: [PATCH 0500/1835] w1: ds2408: reset on output_write retry with
 readback

commit 49695ac46861180baf2b2b92c62da8619b6bf28f upstream.

When we have success in 'Channel Access Write' but reading back latch
states fails, a write is retried without doing a proper slave reset.
This leads to protocol errors as the slave treats the next 'Channel
Access Write' as the continuation of previous command.

This commit is fixing this by making sure if the retry loop re-runs, a
reset is performed, whatever the failure (CONFIRM_BYTE or the read
back).

The loop was quite due for a cleanup and this change mandated it. By
isolating the CONFIG_W1_SLAVE_DS2408_READBACK case into it's own
function, we vastly reduce the visual and branching(runtime and
compile-time) noise.

Reported-by: Mariusz Bialonczyk <manio@skyboo.net>
Tested-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2408.c | 76 ++++++++++++++++++-----------------
 1 file changed, 39 insertions(+), 37 deletions(-)

diff --git a/drivers/w1/slaves/w1_ds2408.c b/drivers/w1/slaves/w1_ds2408.c
index b535d5ec35b6a..92e8f0755b9a9 100644
--- a/drivers/w1/slaves/w1_ds2408.c
+++ b/drivers/w1/slaves/w1_ds2408.c
@@ -138,14 +138,37 @@ static ssize_t status_control_read(struct file *filp, struct kobject *kobj,
 		W1_F29_REG_CONTROL_AND_STATUS, buf);
 }
 
+#ifdef fCONFIG_W1_SLAVE_DS2408_READBACK
+static bool optional_read_back_valid(struct w1_slave *sl, u8 expected)
+{
+	u8 w1_buf[3];
+
+	if (w1_reset_resume_command(sl->master))
+		return false;
+
+	w1_buf[0] = W1_F29_FUNC_READ_PIO_REGS;
+	w1_buf[1] = W1_F29_REG_OUTPUT_LATCH_STATE;
+	w1_buf[2] = 0;
+
+	w1_write_block(sl->master, w1_buf, 3);
+
+	return (w1_read_8(sl->master) == expected);
+}
+#else
+static bool optional_read_back_valid(struct w1_slave *sl, u8 expected)
+{
+	return true;
+}
+#endif
+
 static ssize_t output_write(struct file *filp, struct kobject *kobj,
 			    struct bin_attribute *bin_attr, char *buf,
 			    loff_t off, size_t count)
 {
 	struct w1_slave *sl = kobj_to_w1_slave(kobj);
 	u8 w1_buf[3];
-	u8 readBack;
 	unsigned int retries = W1_F29_RETRIES;
+	ssize_t bytes_written = -EIO;
 
 	if (count != 1 || off != 0)
 		return -EFAULT;
@@ -155,54 +178,33 @@ static ssize_t output_write(struct file *filp, struct kobject *kobj,
 	dev_dbg(&sl->dev, "mutex locked");
 
 	if (w1_reset_select_slave(sl))
-		goto error;
+		goto out;
 
-	while (retries--) {
+	do {
 		w1_buf[0] = W1_F29_FUNC_CHANN_ACCESS_WRITE;
 		w1_buf[1] = *buf;
 		w1_buf[2] = ~(*buf);
-		w1_write_block(sl->master, w1_buf, 3);
 
-		readBack = w1_read_8(sl->master);
+		w1_write_block(sl->master, w1_buf, 3);
 
-		if (readBack != W1_F29_SUCCESS_CONFIRM_BYTE) {
-			if (w1_reset_resume_command(sl->master))
-				goto error;
-			/* try again, the slave is ready for a command */
-			continue;
+		if (w1_read_8(sl->master) == W1_F29_SUCCESS_CONFIRM_BYTE &&
+		    optional_read_back_valid(sl, *buf)) {
+			bytes_written = 1;
+			goto out;
 		}
 
-#ifdef CONFIG_W1_SLAVE_DS2408_READBACK
-		/* here the master could read another byte which
-		   would be the PIO reg (the actual pin logic state)
-		   since in this driver we don't know which pins are
-		   in and outs, there's no value to read the state and
-		   compare. with (*buf) so end this command abruptly: */
 		if (w1_reset_resume_command(sl->master))
-			goto error;
+			goto out; /* unrecoverable error */
+		/* try again, the slave is ready for a command */
+	} while (--retries);
 
-		/* go read back the output latches */
-		/* (the direct effect of the write above) */
-		w1_buf[0] = W1_F29_FUNC_READ_PIO_REGS;
-		w1_buf[1] = W1_F29_REG_OUTPUT_LATCH_STATE;
-		w1_buf[2] = 0;
-		w1_write_block(sl->master, w1_buf, 3);
-		/* read the result of the READ_PIO_REGS command */
-		if (w1_read_8(sl->master) == *buf)
-#endif
-		{
-			/* success! */
-			mutex_unlock(&sl->master->bus_mutex);
-			dev_dbg(&sl->dev,
-				"mutex unlocked, retries:%d", retries);
-			return 1;
-		}
-	}
-error:
+out:
 	mutex_unlock(&sl->master->bus_mutex);
-	dev_dbg(&sl->dev, "mutex unlocked in error, retries:%d", retries);
 
-	return -EIO;
+	dev_dbg(&sl->dev, "%s, mutex unlocked retries:%d\n",
+		(bytes_written > 0) ? "succeeded" : "error", retries);
+
+	return bytes_written;
 }
 
 
-- 
GitLab


From afb1d05657278c16cca2a9fa96ef9a6c7170d07d Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Thu, 21 Mar 2019 11:52:55 +0100
Subject: [PATCH 0501/1835] w1: fix the resume command API

commit 62909da8aca048ecf9fbd7e484e5100608f40a63 upstream.

>From the DS2408 datasheet [1]:
"Resume Command function checks the status of the RC flag and, if it is set,
 directly transfers control to the control functions, similar to a Skip ROM
 command. The only way to set the RC flag is through successfully executing
 the Match ROM, Search ROM, Conditional Search ROM, or Overdrive-Match ROM
 command"

The function currently works perfectly fine in a multidrop bus, but when we
have only a single slave connected, then only a Skip ROM is used and Match
ROM is not called at all. This is leading to problems e.g. with single one
DS2408 connected, as the Resume Command is not working properly and the
device is responding with failing results after the Resume Command.

This commit is fixing this by using a Skip ROM instead in those cases.
The bandwidth / performance advantage is exactly the same.

Refs:
[1] https://datasheets.maximintegrated.com/en/ds/DS2408.pdf

Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Reviewed-by: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/w1_io.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/w1/w1_io.c b/drivers/w1/w1_io.c
index 0364d3329c526..3516ce6718d94 100644
--- a/drivers/w1/w1_io.c
+++ b/drivers/w1/w1_io.c
@@ -432,8 +432,7 @@ int w1_reset_resume_command(struct w1_master *dev)
 	if (w1_reset_bus(dev))
 		return -1;
 
-	/* This will make only the last matched slave perform a skip ROM. */
-	w1_write_8(dev, W1_RESUME_CMD);
+	w1_write_8(dev, dev->slave_count > 1 ? W1_RESUME_CMD : W1_SKIP_ROM);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(w1_reset_resume_command);
-- 
GitLab


From 3f647927237babee492cbb6ce0ab29417af55ea0 Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Mon, 4 Mar 2019 12:23:36 +0100
Subject: [PATCH 0502/1835] w1: ds2482: cosmetic fixes after 54865314f5a1

commit 5cb27d30fc3a281e830a2099d520b469e2b82008 upstream.

We have a helper function ds2482_calculate_config() which is calculating
the config value, so just use it instead of passing the same variable
in all calls to this function.

Also fixes the placement of module parameters to match with:
50fa2951bd74 (w1: Organize driver source to natural/common order)
by Andrew F. Davis

Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Cc: Andrew Worsley <amworsley@gmail.com>
Cc: Andrew F. Davis <afd@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/masters/ds2482.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c
index 8b5e598ffdb3c..8f2b25f1614c8 100644
--- a/drivers/w1/masters/ds2482.c
+++ b/drivers/w1/masters/ds2482.c
@@ -37,6 +37,11 @@ module_param_named(active_pullup, ds2482_active_pullup, int, 0644);
 MODULE_PARM_DESC(active_pullup, "Active pullup (apply to all buses): " \
 				"0-disable, 1-enable (default)");
 
+/* extra configurations - e.g. 1WS */
+static int extra_config;
+module_param(extra_config, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(extra_config, "Extra Configuration settings 1=APU,2=PPM,3=SPU,8=1WS");
+
 /**
  * The DS2482 registers - there are 3 registers that are addressed by a read
  * pointer. The read pointer is set by the last command executed.
@@ -70,8 +75,6 @@ MODULE_PARM_DESC(active_pullup, "Active pullup (apply to all buses): " \
 #define DS2482_REG_CFG_PPM		0x02	/* presence pulse masking */
 #define DS2482_REG_CFG_APU		0x01	/* active pull-up */
 
-/* extra configurations - e.g. 1WS */
-static int extra_config;
 
 /**
  * Write and verify codes for the CHANNEL_SELECT command (DS2482-800 only).
@@ -130,6 +133,8 @@ struct ds2482_data {
  */
 static inline u8 ds2482_calculate_config(u8 conf)
 {
+	conf |= extra_config;
+
 	if (ds2482_active_pullup)
 		conf |= DS2482_REG_CFG_APU;
 
@@ -405,7 +410,7 @@ static u8 ds2482_w1_reset_bus(void *data)
 		/* If the chip did reset since detect, re-config it */
 		if (err & DS2482_REG_STS_RST)
 			ds2482_send_cmd_data(pdev, DS2482_CMD_WRITE_CONFIG,
-					ds2482_calculate_config(extra_config));
+					     ds2482_calculate_config(0x00));
 	}
 
 	mutex_unlock(&pdev->access_lock);
@@ -431,7 +436,8 @@ static u8 ds2482_w1_set_pullup(void *data, int delay)
 		ds2482_wait_1wire_idle(pdev);
 		/* note: it seems like both SPU and APU have to be set! */
 		retval = ds2482_send_cmd_data(pdev, DS2482_CMD_WRITE_CONFIG,
-			ds2482_calculate_config(extra_config|DS2482_REG_CFG_SPU|DS2482_REG_CFG_APU));
+			ds2482_calculate_config(DS2482_REG_CFG_SPU |
+						DS2482_REG_CFG_APU));
 		ds2482_wait_1wire_idle(pdev);
 	}
 
@@ -484,7 +490,7 @@ static int ds2482_probe(struct i2c_client *client,
 
 	/* Set all config items to 0 (off) */
 	ds2482_send_cmd_data(data, DS2482_CMD_WRITE_CONFIG,
-		ds2482_calculate_config(extra_config));
+		ds2482_calculate_config(0x00));
 
 	mutex_init(&data->access_lock);
 
@@ -559,7 +565,5 @@ module_i2c_driver(ds2482_driver);
 
 MODULE_AUTHOR("Ben Gardner <bgardner@wabtec.com>");
 MODULE_DESCRIPTION("DS2482 driver");
-module_param(extra_config, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(extra_config, "Extra Configuration settings 1=APU,2=PPM,3=SPU,8=1WS");
 
 MODULE_LICENSE("GPL");
-- 
GitLab


From 4ed0f310669e324505b2125619349312497d4a08 Mon Sep 17 00:00:00 2001
From: Klaus Schulz <klsschlz@gmail.com>
Date: Thu, 16 May 2019 13:35:32 +0200
Subject: [PATCH 0503/1835] sound: pcm512x-codec: Adding 352.8kHz samplerate
 support

---
 sound/soc/codecs/pcm512x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index e6523e74fdd9f..45f9644e53af8 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -542,7 +542,7 @@ static unsigned long pcm512x_ncp_target(struct pcm512x_priv *pcm512x,
 
 static const u32 pcm512x_dai_rates[] = {
 	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
-	88200, 96000, 176400, 192000, 384000,
+	88200, 96000, 176400, 192000, 352800, 384000,
 };
 
 static const struct snd_pcm_hw_constraint_list constraints_slave = {
-- 
GitLab


From 33b883a459e2cf59f0d84a9148b269ab6a07bbf3 Mon Sep 17 00:00:00 2001
From: GT <dev@3d-lab-av.com>
Date: Sat, 6 Apr 2019 21:16:39 +0100
Subject: [PATCH 0504/1835] ASoC: decommissioning driver for 3Dlab Nano
 soundcard

---
 .../overlays/3dlab-nano-player-overlay.dts    |  32 --
 arch/arm/boot/dts/overlays/Makefile           |   1 -
 arch/arm/boot/dts/overlays/README             |   6 -
 arch/arm/configs/bcm2709_defconfig            |   1 -
 arch/arm/configs/bcmrpi_defconfig             |   1 -
 sound/soc/bcm/3dlab-nano-player.c             | 370 ------------------
 sound/soc/bcm/Kconfig                         |   6 -
 sound/soc/bcm/Makefile                        |   6 +-
 8 files changed, 2 insertions(+), 421 deletions(-)
 delete mode 100644 arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts
 delete mode 100644 sound/soc/bcm/3dlab-nano-player.c

diff --git a/arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts b/arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts
deleted file mode 100644
index 38f7bb2c9de32..0000000000000
--- a/arch/arm/boot/dts/overlays/3dlab-nano-player-overlay.dts
+++ /dev/null
@@ -1,32 +0,0 @@
-// Definitions for 3Dlab Nano Player
-/dts-v1/;
-/plugin/;
-
-/ {
-	compatible = "brcm,bcm2708";
-
-	fragment@0 {
-		target = <&i2s>;
-		__overlay__ {
-			status = "okay";
-		};
-	};
-
-	fragment@1 {
-		target = <&i2c>;
-		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <0>;
-			status = "okay";
-
-			nano-player@41 {
-				compatible = "3dlab,nano-player";
-				reg = <0x41>;
-				i2s-controller = <&i2s>;
-				status = "okay";
-			};
-		};
-	};
-};
-
-// EOF
diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 5d92308c80eaf..cc70cf5c8579a 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -1,7 +1,6 @@
 # Overlays for the Raspberry Pi platform
 
 dtbo-$(CONFIG_ARCH_BCM2835) += \
-	3dlab-nano-player.dtbo \
 	adau1977-adc.dtbo \
 	adau7002-simple.dtbo \
 	ads1015.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index f81fe9693885a..fc71a917f4952 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -205,12 +205,6 @@ Params:
         and the other i2c baudrate parameters.
 
 
-Name:   3dlab-nano-player
-Info:   Configures the 3Dlab Nano Player
-Load:   dtoverlay=3dlab-nano-player
-Params: <None>
-
-
 Name:   adau1977-adc
 Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
         and I2S for data.
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index a9aa06f0fc6e2..3ab42ebe443dc 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -908,7 +908,6 @@ CONFIG_SND_USB_6FIRE=m
 CONFIG_SND_USB_HIFACE=m
 CONFIG_SND_SOC=m
 CONFIG_SND_BCM2835_SOC_I2S=m
-CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 71beff61a95c6..f5e5c0b8fe2d2 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -900,7 +900,6 @@ CONFIG_SND_USB_6FIRE=m
 CONFIG_SND_USB_HIFACE=m
 CONFIG_SND_SOC=m
 CONFIG_SND_BCM2835_SOC_I2S=m
-CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER=m
 CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
diff --git a/sound/soc/bcm/3dlab-nano-player.c b/sound/soc/bcm/3dlab-nano-player.c
deleted file mode 100644
index 7d4a63f40d607..0000000000000
--- a/sound/soc/bcm/3dlab-nano-player.c
+++ /dev/null
@@ -1,370 +0,0 @@
-/*
- * 3Dlab Nano Player ALSA SoC Audio driver.
- *
- * Copyright (C) 2018 3Dlab.
- *
- * Author: GT <dev@3d-lab-av.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- */
-
-#include <linux/module.h>
-#include <linux/i2c.h>
-#include <sound/soc.h>
-#include <sound/pcm.h>
-#include <sound/pcm_params.h>
-#include <sound/control.h>
-
-#define NANO_ID		0x00
-#define NANO_VER	0x01
-#define NANO_CFG	0x02
-#define NANO_STATUS	0x03
-#define NANO_SPI_ADDR	0x04
-#define NANO_SPI_DATA	0x05
-
-#define NANO_ID_VAL	0x3D
-#define NANO_CFG_OFF	0x00
-#define NANO_CFG_MULT1	0
-#define NANO_CFG_MULT2	1
-#define NANO_CFG_MULT4	2
-#define NANO_CFG_MULT8	3
-#define NANO_CFG_MULT16	4
-#define NANO_CFG_CLK22	0
-#define NANO_CFG_CLK24	BIT(3)
-#define NANO_CFG_DSD	BIT(4)
-#define NANO_CFG_ENA	BIT(5)
-#define NANO_CFG_BLINK	BIT(6)
-#define NANO_STATUS_P1  BIT(0)
-#define NANO_STATUS_P2  BIT(1)
-#define NANO_STATUS_FLG BIT(2)
-#define NANO_STATUS_CLK BIT(3)
-#define NANO_SPI_READ	0
-#define NANO_SPI_WRITE	BIT(5)
-
-#define NANO_DAC_CTRL1	0x00
-#define NANO_DAC_CTRL2	0x01
-#define NANO_DAC_CTRL3	0x02
-#define NANO_DAC_LATT	0x03
-#define NANO_DAC_RATT	0x04
-
-#define NANO_CTRL2_VAL	0x22
-
-static int nano_player_spi_write(struct regmap *map,
-				 unsigned int reg, unsigned int val)
-{
-	/* indirect register access */
-	regmap_write(map, NANO_SPI_DATA, val);
-	regmap_write(map, NANO_SPI_ADDR, reg | NANO_SPI_WRITE);
-	return 0;
-}
-
-static int nano_player_ctrl_info(struct snd_kcontrol *kcontrol,
-				 struct snd_ctl_elem_info *uinfo)
-{
-	/* describe control element */
-	if (strstr(kcontrol->id.name, "Volume")) {
-		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
-		uinfo->count = 1;
-		uinfo->value.integer.min = 0;
-		uinfo->value.integer.max = 100;
-	} else {
-		uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
-		uinfo->count = 1;
-		uinfo->value.integer.min = 0;
-		uinfo->value.integer.max = 1;
-	}
-
-	return 0;
-}
-
-static int nano_player_ctrl_put(struct snd_kcontrol *kcontrol,
-				struct snd_ctl_elem_value *ucontrol)
-{
-	/* program control value to hardware */
-	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
-	struct regmap *regmap = snd_soc_card_get_drvdata(card);
-
-	if (strstr(kcontrol->id.name, "Volume")) {
-		unsigned int vol = ucontrol->value.integer.value[0];
-		unsigned int att = 255 - (2 * (100 - vol));
-
-		nano_player_spi_write(regmap, NANO_DAC_LATT, att);
-		nano_player_spi_write(regmap, NANO_DAC_RATT, att);
-		kcontrol->private_value = vol;
-	} else {
-		unsigned int mute = ucontrol->value.integer.value[0];
-		unsigned int reg = NANO_CTRL2_VAL | mute;
-
-		nano_player_spi_write(regmap, NANO_DAC_CTRL2, reg);
-		kcontrol->private_value = mute;
-	}
-	return 0;
-}
-
-static int nano_player_ctrl_get(struct snd_kcontrol *kcontrol,
-				struct snd_ctl_elem_value *ucontrol)
-{
-	/* return last programmed value */
-	ucontrol->value.integer.value[0] = kcontrol->private_value;
-	return 0;
-}
-
-#define SOC_NANO_PLAYER_CTRL(xname) \
-{	.iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = (xname), \
-	.access = SNDRV_CTL_ELEM_ACCESS_READWRITE, \
-	.info = nano_player_ctrl_info, \
-	.put = nano_player_ctrl_put, \
-	.get = nano_player_ctrl_get }
-
-static const struct snd_kcontrol_new nano_player_controls[] = {
-	SOC_NANO_PLAYER_CTRL("Master Playback Volume"),
-	SOC_NANO_PLAYER_CTRL("Master Playback Switch"),
-};
-
-static const unsigned int nano_player_rates[] = {
-	44100, 48000, 88200, 96000, 176400, 192000, 352800, 384000,
-	705600, 768000 /* only possible with fast clocks */
-};
-
-static struct snd_pcm_hw_constraint_list nano_player_constraint_rates = {
-	.list	= nano_player_rates,
-	.count	= ARRAY_SIZE(nano_player_rates),
-};
-
-static int nano_player_init(struct snd_soc_pcm_runtime *rtd)
-{
-	struct snd_soc_card *card = rtd->card;
-	struct regmap *regmap = snd_soc_card_get_drvdata(card);
-	struct snd_soc_pcm_stream *cpu = &rtd->cpu_dai->driver->playback;
-	struct snd_soc_pcm_stream *codec = &rtd->codec_dai->driver->playback;
-	unsigned int sample_bits = 32;
-	unsigned int val;
-
-	/* configure cpu dai */
-	cpu->formats |= SNDRV_PCM_FMTBIT_DSD_U32_LE;
-	cpu->rate_max = 768000;
-
-	/* configure dummy codec dai */
-	codec->rate_min = 44100;
-	codec->rates = SNDRV_PCM_RATE_KNOT;
-	codec->formats = SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_DSD_U32_LE;
-
-	/* configure max supported rate */
-	regmap_read(regmap, NANO_STATUS, &val);
-	if (val & NANO_STATUS_CLK) {
-		dev_notice(card->dev, "Board with fast clocks installed\n");
-		codec->rate_max = 768000;
-	} else {
-		dev_notice(card->dev, "Board with normal clocks installed\n");
-		codec->rate_max = 384000;
-	}
-
-	/* frame length enforced by hardware */
-	return snd_soc_dai_set_bclk_ratio(rtd->cpu_dai, sample_bits * 2);
-}
-
-static int nano_player_startup(struct snd_pcm_substream *substream)
-{
-	return snd_pcm_hw_constraint_list(substream->runtime, 0,
-					  SNDRV_PCM_HW_PARAM_RATE,
-					  &nano_player_constraint_rates);
-}
-
-static int nano_player_hw_params(struct snd_pcm_substream *substream,
-				 struct snd_pcm_hw_params *params)
-{
-	struct snd_soc_pcm_runtime *rtd = substream->private_data;
-	struct snd_soc_card *card = rtd->card;
-	struct regmap *regmap = snd_soc_card_get_drvdata(card);
-	unsigned int config = NANO_CFG_ENA;
-	struct snd_mask *fmt;
-
-	/* configure PCM or DSD */
-	fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
-	if (snd_mask_test(fmt, SNDRV_PCM_FORMAT_DSD_U32_LE)) {
-		/* embed DSD in PCM data */
-		snd_mask_none(fmt);
-		snd_mask_set(fmt, SNDRV_PCM_FORMAT_S32_LE);
-		/* enable DSD mode */
-		config |= NANO_CFG_DSD;
-	}
-
-	/* configure clocks */
-	switch (params_rate(params)) {
-	case 44100:
-		config |= NANO_CFG_MULT1 | NANO_CFG_CLK22;
-		break;
-	case 88200:
-		config |= NANO_CFG_MULT2 | NANO_CFG_CLK22;
-		break;
-	case 176400:
-		config |= NANO_CFG_MULT4 | NANO_CFG_CLK22;
-		break;
-	case 352800:
-		config |= NANO_CFG_MULT8 | NANO_CFG_CLK22;
-		break;
-	case 705600:
-		config |= NANO_CFG_MULT16 | NANO_CFG_CLK22;
-		break;
-	case 48000:
-		config |= NANO_CFG_MULT1 | NANO_CFG_CLK24;
-		break;
-	case 96000:
-		config |= NANO_CFG_MULT2 | NANO_CFG_CLK24;
-		break;
-	case 192000:
-		config |= NANO_CFG_MULT4 | NANO_CFG_CLK24;
-		break;
-	case 384000:
-		config |= NANO_CFG_MULT8 | NANO_CFG_CLK24;
-		break;
-	case 768000:
-		config |= NANO_CFG_MULT16 | NANO_CFG_CLK24;
-		break;
-	default:
-		return -EINVAL;
-	}
-
-	dev_dbg(card->dev, "Send CFG register 0x%02X\n", config);
-	return regmap_write(regmap, NANO_CFG, config);
-}
-
-static struct snd_soc_ops nano_player_ops = {
-	.startup	= nano_player_startup,
-	.hw_params	= nano_player_hw_params,
-};
-
-static struct snd_soc_dai_link nano_player_link = {
-	.name		= "3Dlab Nano Player",
-	.stream_name	= "3Dlab Nano Player HiFi",
-	.platform_name	= "bcm2708-i2s.0",
-	.cpu_dai_name	= "bcm2708-i2s.0",
-	.codec_name	= "snd-soc-dummy",
-	.codec_dai_name	= "snd-soc-dummy-dai",
-	.dai_fmt	= SND_SOC_DAIFMT_I2S |
-			  SND_SOC_DAIFMT_CONT |
-			  SND_SOC_DAIFMT_NB_NF |
-			  SND_SOC_DAIFMT_CBM_CFM,
-	.init		= nano_player_init,
-	.ops		= &nano_player_ops,
-};
-
-static const struct regmap_config nano_player_regmap = {
-	.reg_bits	= 8,
-	.val_bits	= 8,
-	.max_register	= 128,
-	.cache_type	= REGCACHE_RBTREE,
-};
-
-static int nano_player_card_probe(struct snd_soc_card *card)
-{
-	struct regmap *regmap = snd_soc_card_get_drvdata(card);
-	unsigned int val;
-
-	/* check hardware integrity */
-	regmap_read(regmap, NANO_ID, &val);
-	if (val != NANO_ID_VAL) {
-		dev_err(card->dev, "Invalid ID register 0x%02X\n", val);
-		return -ENODEV;
-	}
-
-	/* report version to the user */
-	regmap_read(regmap, NANO_VER, &val);
-	dev_notice(card->dev, "Started 3Dlab Nano Player driver (v%d)\n", val);
-
-	/* enable internal audio bus and blink status LED */
-	return regmap_write(regmap, NANO_CFG, NANO_CFG_ENA | NANO_CFG_BLINK);
-}
-
-static int nano_player_card_remove(struct snd_soc_card *card)
-{
-	/* disable internal audio bus */
-	struct regmap *regmap = snd_soc_card_get_drvdata(card);
-
-	return regmap_write(regmap, NANO_CFG, NANO_CFG_OFF);
-}
-
-static struct snd_soc_card nano_player_card = {
-	.name		= "3Dlab_Nano_Player",
-	.owner		= THIS_MODULE,
-	.dai_link	= &nano_player_link,
-	.num_links	= 1,
-	.controls	= nano_player_controls,
-	.num_controls	= ARRAY_SIZE(nano_player_controls),
-	.probe		= nano_player_card_probe,
-	.remove		= nano_player_card_remove,
-};
-
-static int nano_player_i2c_probe(struct i2c_client *i2c,
-				 const struct i2c_device_id *id)
-{
-	struct regmap *regmap;
-	int ret;
-
-	regmap = devm_regmap_init_i2c(i2c, &nano_player_regmap);
-	if (IS_ERR(regmap)) {
-		ret = PTR_ERR(regmap);
-		dev_err(&i2c->dev, "Failed to init regmap %d\n", ret);
-		return ret;
-	}
-
-	if (i2c->dev.of_node) {
-		struct snd_soc_dai_link *dai = &nano_player_link;
-		struct device_node *node;
-
-		/* cpu handle configured by device tree */
-		node = of_parse_phandle(i2c->dev.of_node, "i2s-controller", 0);
-		if (node) {
-			dai->platform_name = NULL;
-			dai->platform_of_node = node;
-			dai->cpu_dai_name = NULL;
-			dai->cpu_of_node = node;
-		}
-	}
-
-	nano_player_card.dev = &i2c->dev;
-	snd_soc_card_set_drvdata(&nano_player_card, regmap);
-	ret = devm_snd_soc_register_card(&i2c->dev, &nano_player_card);
-
-	if (ret && ret != -EPROBE_DEFER)
-		dev_err(&i2c->dev, "Failed to register card %d\n", ret);
-
-	return ret;
-}
-
-static const struct of_device_id nano_player_of_match[] = {
-	{ .compatible = "3dlab,nano-player", },
-	{ }
-};
-MODULE_DEVICE_TABLE(of, nano_player_of_match);
-
-static const struct i2c_device_id nano_player_i2c_id[] = {
-	{ "nano-player", 0 },
-	{ }
-};
-MODULE_DEVICE_TABLE(i2c, nano_player_i2c_id);
-
-static struct i2c_driver nano_player_i2c_driver = {
-	.probe		= nano_player_i2c_probe,
-	.id_table	= nano_player_i2c_id,
-	.driver		= {
-		.name		= "nano-player",
-		.owner		= THIS_MODULE,
-		.of_match_table	= nano_player_of_match,
-	},
-};
-
-module_i2c_driver(nano_player_i2c_driver);
-
-MODULE_DESCRIPTION("ASoC 3Dlab Nano Player driver");
-MODULE_AUTHOR("GT <dev@3d-lab-av.com>");
-MODULE_LICENSE("GPL v2");
-
-/* EOF */
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 9cfe86ef58617..75786ab06a53b 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -17,12 +17,6 @@ config SND_SOC_CYGNUS
 
 	  If you don't know what to do here, say N.
 
-config SND_BCM2708_SOC_3DLAB_NANO_PLAYER
-	tristate "Support for 3Dlab Nano Player"
-	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
-	help
-	  Say Y or M if you want to add support for 3Dlab Nano Player.
-
 config SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD
 	tristate "Support for Google voiceHAT soundcard"
 	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index 356bd229e48c2..4f588a29d8253 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_SND_SOC_CYGNUS) += snd-soc-cygnus.o
 snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
 
 # BCM2708 Machine Support
-snd-soc-3dlab-nano-player-objs := 3dlab-nano-player.o
 snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
 snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
 snd-soc-justboom-dac-objs := justboom-dac.o
@@ -20,7 +19,7 @@ snd-soc-rpi-cirrus-objs := rpi-cirrus.o
 snd-soc-rpi-proto-objs := rpi-proto.o
 snd-soc-iqaudio-codec-objs := iqaudio-codec.o
 snd-soc-iqaudio-dac-objs := iqaudio-dac.o
- snd-soc-i-sabre-q2m-objs := i-sabre-q2m.o
+snd-soc-i-sabre-q2m-objs := i-sabre-q2m.o
 snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
 snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
 snd-soc-audiosense-pi-objs := audiosense-pi.o
@@ -36,7 +35,6 @@ snd-soc-fe-pi-audio-objs := fe-pi-audio.o
 snd-soc-rpi-simple-soundcard-objs := rpi-simple-soundcard.o
 snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
 
-obj-$(CONFIG_SND_BCM2708_SOC_3DLAB_NANO_PLAYER) += snd-soc-3dlab-nano-player.o
 obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusadc.o
@@ -45,7 +43,7 @@ obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
 obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC) += snd-soc-iqaudio-codec.o
 obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
- obj-$(CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M) += snd-soc-i-sabre-q2m.o
+obj-$(CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M) += snd-soc-i-sabre-q2m.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
 obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
 obj-$(CONFIG_SND_AUDIOSENSE_PI) += snd-soc-audiosense-pi.o
-- 
GitLab


From b45a32b47b76cb64225d19841c20ee85ea97874d Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 21 May 2019 15:17:33 +0100
Subject: [PATCH 0505/1835] .gitignore: Add *.dtbo explicitly

Signed-off-by: popcornmix <popcornmix@gmail.com>
---
 .gitignore | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index d99301c57cffd..b79ed5149002e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,7 +15,8 @@
 *.bin
 *.bz2
 *.c.[012]*.*
-*.dtb*
+*.dtb
+*.dtbo
 *.dtb.S
 *.dwo
 *.elf
-- 
GitLab


From 00de9e45fe619d9fd3e810d10d99ac328ee5190c Mon Sep 17 00:00:00 2001
From: Marcel Holtmann <marcel@holtmann.org>
Date: Wed, 22 May 2019 09:05:40 +0200
Subject: [PATCH 0506/1835] Bluetooth: Check key sizes only when Secure Simple
 Pairing is enabled

The encryption is only mandatory to be enforced when both sides are using
Secure Simple Pairing and this means the key size check makes only sense
in that case.

On legacy Bluetooth 2.0 and earlier devices like mice the encryption was
optional and thus causing an issue if the key size check is not bound to
using Secure Simple Pairing.

Fixes: d5bb334a8e17 ("Bluetooth: Align minimum encryption key size for LE and BR/EDR connections")
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
---
 net/bluetooth/hci_conn.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3cf0764d5793f..7516cdde33735 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1272,8 +1272,13 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
 			return 0;
 	}
 
-	if (hci_conn_ssp_enabled(conn) &&
-	    !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+	/* If Secure Simple Pairing is not enabled, then legacy connection
+	 * setup is used and no encryption or key sizes can be enforced.
+	 */
+	if (!hci_conn_ssp_enabled(conn))
+		return 1;
+
+	if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 		return 0;
 
 	/* The minimum encryption key size needs to be enforced by the
-- 
GitLab


From d903e18191d372cf917b0db788b5cd43bcd16025 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 7 May 2019 17:23:41 +0100
Subject: [PATCH 0507/1835] usb: dwc_otg: Clean up interrupt claiming code

The FIQ/IRQ interrupt number identification code is scattered through
the dwc_otg driver. Rationalise it, simplifying the code and solving
an existing issue.

See: https://github.com/raspberrypi/linux/issues/2612

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/usb/host/dwc_otg/dwc_otg_driver.c    | 18 +++++++++-----
 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 10 +++-----
 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h    |  6 +++++
 drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c | 26 +++-----------------
 4 files changed, 25 insertions(+), 35 deletions(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.c b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
index 04535c3eff4a3..3fd21c7ba3607 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_driver.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
@@ -624,11 +624,7 @@ static int dwc_otg_driver_remove(        struct platform_device *_dev )
 	 * Free the IRQ
 	 */
 	if (otg_dev->common_irq_installed) {
-#ifdef PLATFORM_INTERFACE
-		free_irq(platform_get_irq(_dev, 0), otg_dev);
-#else
-		free_irq(_dev->irq, otg_dev);
-#endif
+		free_irq(otg_dev->os_dep.irq_num, otg_dev);
         } else {
 		DWC_DEBUGPL(DBG_ANY, "%s: There is no installed irq!\n", __func__);
 		return REM_RETVAL(-ENXIO);
@@ -905,7 +901,9 @@ static int dwc_otg_driver_probe(
 	 */
 
 #if defined(PLATFORM_INTERFACE)
-	devirq = platform_get_irq(_dev, fiq_enable ? 0 : 1);
+	devirq = platform_get_irq_byname(_dev, fiq_enable ? "soft" : "usb");
+	if (devirq < 0)
+	    devirq = platform_get_irq(_dev, fiq_enable ? 0 : 1);
 #else
 	devirq = _dev->irq;
 #endif
@@ -922,6 +920,14 @@ static int dwc_otg_driver_probe(
 	} else {
 		dwc_otg_device->common_irq_installed = 1;
 	}
+	dwc_otg_device->os_dep.irq_num = devirq;
+	dwc_otg_device->os_dep.fiq_num = -EINVAL;
+	if (fiq_enable) {
+		int devfiq = platform_get_irq_byname(_dev, "usb");
+		if (devfiq < 0)
+			devfiq = platform_get_irq(_dev, 1);
+		dwc_otg_device->os_dep.fiq_num = devfiq;
+	}
 
 #ifndef IRQF_TRIGGER_LOW
 #if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
index 028f7fd22ba9e..fc43f2a66d6ab 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -492,7 +492,7 @@ static void hcd_init_fiq(void *cookie)
 #endif
 	// Enable FIQ interrupt from USB peripheral
 #ifdef CONFIG_ARM64
-	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
+	irq = otg_dev->os_dep.fiq_num;
 
 	if (irq < 0) {
 		DWC_ERROR("Can't get SIM-FIQ irq");
@@ -509,7 +509,7 @@ static void hcd_init_fiq(void *cookie)
 	simfiq_irq = irq;
 #else
 #ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
-	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
+	irq = otg_dev->os_dep.fiq_num;
 #else
 	irq = INTERRUPT_VC_USB;
 #endif
@@ -626,11 +626,7 @@ int hcd_init(dwc_bus_dev_t *_dev)
 	 * allocates the DMA buffer pool, registers the USB bus, requests the
 	 * IRQ line, and calls hcd_start method.
 	 */
-#ifdef PLATFORM_INTERFACE
-	retval = usb_add_hcd(hcd, platform_get_irq(_dev, fiq_enable ? 0 : 1), IRQF_SHARED);
-#else
-	retval = usb_add_hcd(hcd, _dev->irq, IRQF_SHARED);
-#endif
+	retval = usb_add_hcd(hcd, otg_dev->os_dep.irq_num, IRQF_SHARED);
 	if (retval < 0) {
 		goto error2;
 	}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
index d7b700ff17821..3da96b2531559 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
@@ -102,6 +102,12 @@ typedef struct os_dependent {
 	/** Base address for MPHI peripheral */
 	void *mphi_base;
 
+	/** IRQ number (<0 if not valid) */
+	int irq_num;
+
+	/** FIQ number (<0 if not valid) */
+	int fiq_num;
+
 #ifdef LM_INTERFACE
 	struct lm_device *lmdev;
 #elif  defined(PCI_INTERFACE)
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
index e799f15f29470..a5ed8e83711db 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
@@ -1224,30 +1224,16 @@ int pcd_init(dwc_bus_dev_t *_dev)
 	/*
 	 * Setup interupt handler
 	 */
-#ifdef PLATFORM_INTERFACE
 	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
-                    platform_get_irq(_dev, fiq_enable ? 0 : 1));
-	retval = request_irq(platform_get_irq(_dev, fiq_enable ? 0 : 1), dwc_otg_pcd_irq,
+                    otg_dev->os_dep.irq_num);
+	retval = request_irq(otg_dev->os_dep.irq_num, dwc_otg_pcd_irq,
 			     IRQF_SHARED, gadget_wrapper->gadget.name,
 			     otg_dev->pcd);
 	if (retval != 0) {
-		DWC_ERROR("request of irq%d failed\n",
-                          platform_get_irq(_dev, fiq_enable ? 0 : 1));
+		DWC_ERROR("request of irq%d failed\n", otg_dev->os_dep.irq_num);
 		free_wrapper(gadget_wrapper);
 		return -EBUSY;
 	}
-#else
-	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
-                    _dev->irq);
-	retval = request_irq(_dev->irq, dwc_otg_pcd_irq,
-			     IRQF_SHARED | IRQF_DISABLED,
-			     gadget_wrapper->gadget.name, otg_dev->pcd);
-	if (retval != 0) {
-		DWC_ERROR("request of irq%d failed\n", _dev->irq);
-		free_wrapper(gadget_wrapper);
-		return -EBUSY;
-	}
-#endif
 
 	dwc_otg_pcd_start(gadget_wrapper->pcd, &fops);
 
@@ -1267,11 +1253,7 @@ void pcd_remove(dwc_bus_dev_t *_dev)
 	/*
 	 * Free the IRQ
 	 */
-#ifdef PLATFORM_INTERFACE
-	free_irq(platform_get_irq(_dev, 0), pcd);
-#else
-	free_irq(_dev->irq, pcd);
-#endif
+	free_irq(otg_dev->os_dep.irq_num, pcd);
 	dwc_otg_pcd_remove(otg_dev->pcd);
 	free_wrapper(gadget_wrapper);
 	otg_dev->pcd = 0;
-- 
GitLab


From 5efe78e312cef1b0eb699e54c680a59105967fec Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 7 May 2019 14:27:35 +0100
Subject: [PATCH 0508/1835] overlays: Delete the deprecated sdio-1bit overlay

Use dtoverlay=sdio,bus_width=1,gpios_22_25 instead.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 -
 .../boot/dts/overlays/sdio-1bit-overlay.dts   | 63 -------------------
 2 files changed, 64 deletions(-)
 delete mode 100644 arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index cc70cf5c8579a..ae7ba0bc3945b 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -126,7 +126,6 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	sc16is752-spi1.dtbo \
 	sdhost.dtbo \
 	sdio.dtbo \
-	sdio-1bit.dtbo \
 	sdtweak.dtbo \
 	smi.dtbo \
 	smi-dev.dtbo \
diff --git a/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts b/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
deleted file mode 100644
index 297daae8faf9f..0000000000000
--- a/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
+++ /dev/null
@@ -1,63 +0,0 @@
-/dts-v1/;
-/plugin/;
-
-/* Enable 1-bit SDIO from MMC interface via GPIOs 22-25. Includes sdhost overlay. */
-
-/{
-	compatible = "brcm,bcm2708";
-
-	fragment@0 {
-		target = <&mmc>;
-		__overlay__ {
-			status = "disabled";
-		};
-	};
-
-	fragment@1 {
-		target = <&soc>;
-		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			sdio_1bit: sdio@7e300000 {
-				compatible = "brcm,bcm2835-mmc",
-					     "brcm,bcm2835-sdhci";
-				reg = <0x7e300000 0x100>;
-				interrupts = <2 30>;
-				clocks = <&clocks 28/*BCM2835_CLOCK_EMMC*/>;
-				dmas = <&dma 11>;
-				dma-names = "rx-tx";
-				brcm,overclock-50 = <0>;
-				status = "okay";
-				pinctrl-names = "default";
-				pinctrl-0 = <&sdio_1bit_pins>;
-				non-removable;
-				bus-width = <1>;
-			};
-		};
-	};
-
-	fragment@2 {
-		target = <&gpio>;
-		__overlay__ {
-			sdio_1bit_pins: sdio_1bit_pins {
-				brcm,pins = <22 23 24 25>;
-				brcm,function = <7>; /* ALT3 = SD1 */
-				brcm,pull = <0 2 2 2>;
-			};
-		};
-	};
-
-	fragment@3 {
-		target-path = "/aliases";
-		__overlay__ {
-			mmc1 = "/soc/sdio@7e300000";
-		};
-	};
-
-
-	__overrides__ {
-		poll_once = <&sdio_1bit>,"non-removable?";
-		sdio_overclock = <&sdio_1bit>,"brcm,overclock-50:0";
-	};
-};
-- 
GitLab


From 02c3ae26d1a5789b9b32de87f2e887807e74a200 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 7 May 2019 10:06:04 +0100
Subject: [PATCH 0509/1835] overlays: Remove upstream-aux-interrupt overlay

We no longer have a downstream-specific auxilliary interrupt
driver, so the overlay to disable it is no longer needed.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 -
 arch/arm/boot/dts/overlays/README             | 12 +++----
 .../upstream-aux-interrupt-overlay.dts        | 33 -------------------
 .../boot/dts/overlays/upstream-overlay.dts    |  2 +-
 4 files changed, 6 insertions(+), 42 deletions(-)
 delete mode 100644 arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index ae7ba0bc3945b..9aea64b0d325f 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -151,7 +151,6 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	uart1.dtbo \
 	udrc.dtbo \
 	upstream.dtbo \
-	upstream-aux-interrupt.dtbo \
 	vc4-fkms-v3d.dtbo \
 	vc4-kms-kippah-7inch.dtbo \
 	vc4-kms-v3d.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index fc71a917f4952..42265637df370 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -2206,18 +2206,16 @@ Params: alsaname                Name of the ALSA audio device (default "udrc")
 
 
 Name:   upstream
-Info:   Allow usage of downstream .dtb with upstream kernel. Comprises
-        vc4-kms-v3d, dwc2 and upstream-aux-interrupt overlays.
+Info:   Allow usage of downstream .dtb with upstream kernel. Comprises the
+        vc4-kms-v3d and dwc2 overlays.
 Load:   dtoverlay=upstream
 Params: <None>
 
 
 Name:   upstream-aux-interrupt
-Info:   Allow usage of downstream .dtb with upstream kernel by binding AUX
-        devices directly to the shared AUX interrupt line. One of the parts
-        of the 'upstream' overlay
-Load:   dtoverlay=upstream-aux-interrupt
-Params: <None>
+Info:   This overlay has been deprecated and removed because it is no longer
+        necessary.
+Load:   <Deprecated>
 
 
 Name:   vc4-fkms-v3d
diff --git a/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts b/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
deleted file mode 100644
index 04e271b72a3aa..0000000000000
--- a/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
+++ /dev/null
@@ -1,33 +0,0 @@
-// Overlay for missing AUX interrupt controller
-// Instead we bind all AUX devices to the generic AUX interrupt line
-/dts-v1/;
-/plugin/;
-
-/ {
-    compatible = "brcm,bcm2708";
-
-    fragment@0 {
-        target = <&uart1>;
-        __overlay__ {
-            interrupt-parent = <&intc>;
-            interrupts = <0x1 0x1d>;
-        };
-    };
-
-    fragment@1 {
-        target = <&spi1>;
-        __overlay__ {
-            interrupt-parent = <&intc>;
-            interrupts = <0x1 0x1d>;
-        };
-    };
-
-    fragment@2 {
-        target = <&spi2>;
-        __overlay__ {
-            interrupt-parent = <&intc>;
-            interrupts = <0x1 0x1d>;
-        };
-    };
-};
-
diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
index b597f863c4a87..5ddc95b6d8fc2 100644
--- a/arch/arm/boot/dts/overlays/upstream-overlay.dts
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -1,4 +1,4 @@
-// redo: ovmerge -c vc4-kms-v3d-overlay.dts,cma-96 dwc2-overlay.dts,dr_mode=otg upstream-aux-interrupt-overlay.dts,
+// redo: ovmerge -c vc4-kms-v3d-overlay.dts,cma-96 dwc2-overlay.dts,dr_mode=otg
 
 /dts-v1/;
 /plugin/;
-- 
GitLab


From 34ae8ccc3d4c72b95aae68f2bd150246e44d6a5d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 14 May 2019 13:33:05 +0100
Subject: [PATCH 0510/1835] overlays: Standardise on compatible="brcm,bcm2835"

Curb the proliferation of compatible string combinations by
standardising on "brcm,bcm2835" to denote BCM2835 and its descendants.

As nothing in the firmware or kernel is checking overlay compatible
strings, this should be a purely cosmetic change.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts          | 2 +-
 arch/arm/boot/dts/overlays/ads1015-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/ads1115-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/ads7846-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/adv7282m-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/adv728x-m-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts      | 2 +-
 .../boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts   | 2 +-
 arch/arm/boot/dts/overlays/allo-digione-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts    | 2 +-
 .../boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts  | 2 +-
 .../dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts  | 2 +-
 arch/arm/boot/dts/overlays/applepi-dac-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/at86rf233-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts     | 2 +-
 arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts      | 2 +-
 .../boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts    | 2 +-
 arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/audremap-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/balena-fin-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts        | 2 +-
 arch/arm/boot/dts/overlays/dht11-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts        | 2 +-
 arch/arm/boot/dts/overlays/dpi18-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/dpi24-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/draws-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/dwc-otg-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/dwc2-overlay.dts                     | 2 +-
 arch/arm/boot/dts/overlays/enc28j60-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/exc3000-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/goodix-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts | 2 +-
 arch/arm/boot/dts/overlays/gpio-fan-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/gpio-ir-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/gpio-key-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts        | 2 +-
 arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts     | 2 +-
 arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts       | 2 +-
 arch/arm/boot/dts/overlays/hy28a-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/hy28b-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/i2c-mux-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts         | 2 +-
 arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/ilitek251x-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts          | 2 +-
 .../arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts | 2 +-
 arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/justboom-dac-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/justboom-digi-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/max98357a-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/mbed-dac-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/mcp23017-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/mcp23s17-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/mcp3008-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/mcp3202-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/mcp342x-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/media-center-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/mmc-overlay.dts                      | 2 +-
 arch/arm/boot/dts/overlays/mpu6050-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/mz61581-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/ov5647-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/papirus-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts         | 2 +-
 arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts          | 2 +-
 arch/arm/boot/dts/overlays/pibell-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/piglow-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/piscreen-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/piscreen2r-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/pisound-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/pitft22-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts       | 2 +-
 arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts        | 2 +-
 arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts        | 2 +-
 arch/arm/boot/dts/overlays/pps-gpio-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/qca7000-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts        | 2 +-
 arch/arm/boot/dts/overlays/rpi-dac-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/rpi-display-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/rpi-poe-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/rpi-proto-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/rpi-sense-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/rpi-tv-overlay.dts                   | 2 +-
 .../arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts | 2 +-
 arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/sdhost-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/sdio-overlay.dts                     | 2 +-
 arch/arm/boot/dts/overlays/sdtweak-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/smi-nand-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/smi-overlay.dts                      | 2 +-
 arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts            | 2 +-
 arch/arm/boot/dts/overlays/spi-rtc-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/spi0-cs-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts               | 2 +-
 arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/ssd1306-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/superaudioboard-overlay.dts          | 2 +-
 arch/arm/boot/dts/overlays/sx150x-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/tc358743-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/tinylcd35-overlay.dts                | 2 +-
 arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/uart0-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/uart1-overlay.dts                    | 2 +-
 arch/arm/boot/dts/overlays/udrc-overlay.dts                     | 2 +-
 arch/arm/boot/dts/overlays/upstream-overlay.dts                 | 2 +-
 arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts             | 2 +-
 arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts     | 2 +-
 arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts              | 2 +-
 arch/arm/boot/dts/overlays/vga666-overlay.dts                   | 2 +-
 arch/arm/boot/dts/overlays/w1-gpio-overlay.dts                  | 2 +-
 arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts           | 2 +-
 arch/arm/boot/dts/overlays/wittypi-overlay.dts                  | 2 +-
 146 files changed, 146 insertions(+), 146 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
index 1aaca71c1b677..298488e191565 100644
--- a/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
     
 	fragment@0 {
         	target = <&i2c>;
diff --git a/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
index e67e6625d7967..5fed769d25260 100644
--- a/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2708";
+    compatible = "brcm,bcm2835";
 
     fragment@0 {
         target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/ads1015-overlay.dts b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
index 02b9de46299ba..26d68fccc6a85 100644
--- a/arch/arm/boot/dts/overlays/ads1015-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
@@ -5,7 +5,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2708";
+    compatible = "brcm,bcm2835";
     /* ----------- ADS1015 ------------ */
     fragment@0 {
         target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/ads1115-overlay.dts b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
index 7c16a1af3172d..b380d925f0a51 100644
--- a/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/ads7846-overlay.dts b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
index edf2dc9d5d5f6..1c5c9b6bb6ffd 100644
--- a/arch/arm/boot/dts/overlays/ads7846-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
index c30b6e69f3428..197c8f41a2658 100644
--- a/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adv7282m-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_vc>;
diff --git a/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
index f8882669ebc6f..ea392e886984b 100644
--- a/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
+++ b/arch/arm/boot/dts/overlays/adv728x-m-overlay.dts
@@ -5,7 +5,7 @@
 #include "adv7282m-overlay.dts"
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	// Fragment numbers deliberately high to avoid conflicts with the
 	// included adv7282m overlay file.
diff --git a/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
index 241d03b9b79ef..82f9b3734fb12 100644
--- a/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
+++ b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
index ac1cfe093d9aa..dd69916fcb3c1 100644
--- a/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/clocks";
diff --git a/arch/arm/boot/dts/overlays/allo-digione-overlay.dts b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
index 101277a11a24e..ea018ace34d4f 100644
--- a/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
+++ b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
index 6dc4acf1f80c1..b25fd681f09f3 100644
--- a/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
index a5468d850a911..bfc66da6295a8 100644
--- a/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
@@ -13,7 +13,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
index 5c1c81c427a8b..374c553db062e 100644
--- a/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
index fc02b295470ef..4769296ec9d6f 100644
--- a/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
+++ b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2708";
+    compatible = "brcm,bcm2835";
 
     fragment@0 {
         target = <&sound>;
diff --git a/arch/arm/boot/dts/overlays/at86rf233-overlay.dts b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
index 880c7539d496f..5a3f4571ee789 100644
--- a/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
+++ b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
@@ -4,7 +4,7 @@
 /* Overlay for Atmel AT86RF233 IEEE 802.15.4 WPAN transceiver on spi0.0 */
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
index 6d192af10da9c..57a66eac8e9b2 100644
--- a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
index 280e983bbf190..fb4a4678a17ab 100644
--- a/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audioinjector-ultra-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
index 4ed66577fa1d5..68f4427d86c35 100644
--- a/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
index a31762c11cb4a..4b96a3a8a14a2 100644
--- a/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audiosense-pi-overlay.dts
@@ -5,7 +5,7 @@
 #include <dt-bindings/gpio/gpio.h>
 
 / {
-	compatible = "brcm,bcm2837", "brcm,bcm2836", "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/audremap-overlay.dts b/arch/arm/boot/dts/overlays/audremap-overlay.dts
index 9582d6ab31218..4a818206a8912 100644
--- a/arch/arm/boot/dts/overlays/audremap-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-        compatible = "brcm,bcm2708";
+        compatible = "brcm,bcm2835";
 
         fragment@0 {
                 target = <&audio_pins>;
diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
index 575909642de02..b10675c02757a 100644
--- a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&mmc>;
diff --git a/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
index 782b1715467e9..26dbbdd03ce5a 100644
--- a/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
+++ b/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-        compatible = "brcm,bcm2708";
+        compatible = "brcm,bcm2835";
 
         fragment@0 {
                 target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/dht11-overlay.dts b/arch/arm/boot/dts/overlays/dht11-overlay.dts
index 9bf67fd57bada..8de67527e3179 100644
--- a/arch/arm/boot/dts/overlays/dht11-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dht11-overlay.dts
@@ -5,7 +5,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
index 3930f412bca44..d863e5c167cc9 100644
--- a/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
@@ -8,7 +8,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
index a1af93de30119..dfb8922a654bb 100644
--- a/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
@@ -9,7 +9,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&sound>;
diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
index 8098d5e28a71f..64dc2dd42150a 100644
--- a/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	// There is no DPI driver module, but we need a platform device
 	// node (that doesn't already use pinctrl) to hang the pinctrl
diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
index e4dbe40218a00..6021bc33b5af0 100644
--- a/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	// There is no DPI driver module, but we need a platform device
 	// node (that doesn't already use pinctrl) to hang the pinctrl
diff --git a/arch/arm/boot/dts/overlays/draws-overlay.dts b/arch/arm/boot/dts/overlays/draws-overlay.dts
index 5c16baaf0c52a..32b665c3934b7 100644
--- a/arch/arm/boot/dts/overlays/draws-overlay.dts
+++ b/arch/arm/boot/dts/overlays/draws-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    compatible = "brcm,bcm2835";
     fragment@0 {
         target = <&i2s>;
         __overlay__ {
diff --git a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
index fc48bd1eac605..15dd7750813e8 100644
--- a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&usb>;
diff --git a/arch/arm/boot/dts/overlays/dwc2-overlay.dts b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
index d6c223bc559ab..7f04b2ab37625 100644
--- a/arch/arm/boot/dts/overlays/dwc2-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&usb>;
diff --git a/arch/arm/boot/dts/overlays/enc28j60-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
index db8a8feed94c0..7af5c2e607ea0 100644
--- a/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
+++ b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
index 946c9d2107a83..17cb5b8fa4852 100644
--- a/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
+++ b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi2>;
diff --git a/arch/arm/boot/dts/overlays/exc3000-overlay.dts b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
index c5694033d03f3..6f087fb206618 100644
--- a/arch/arm/boot/dts/overlays/exc3000-overlay.dts
+++ b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
index 81dfa5aabe55b..1c3ec3e21a184 100644
--- a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&clocks>;
diff --git a/arch/arm/boot/dts/overlays/goodix-overlay.dts b/arch/arm/boot/dts/overlays/goodix-overlay.dts
index 084f74042ed63..8571527de49a6 100644
--- a/arch/arm/boot/dts/overlays/goodix-overlay.dts
+++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
index 9a9e9a0ca28cf..e443be1f9a0e7 100644
--- a/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
+++ b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
index d9b8b87d9c12d..1a5e52c646656 100644
--- a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
@@ -38,7 +38,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
index bd181236fcf2b..58f588498d68e 100644
--- a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-        compatible = "brcm,bcm2708";
+        compatible = "brcm,bcm2835";
 
         fragment@0 {
                 target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
index e054ba319398e..3625431b75604 100644
--- a/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/gpio-key-overlay.dts b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
index 333d016d6f029..2e7253d1d0abf 100644
--- a/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		// Configure the gpio pin controller
diff --git a/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
index b9c8349605567..bb8cd3bf264d1 100644
--- a/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
index 863fb395c8539..af80a6c1ef452 100644
--- a/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
@@ -10,7 +10,7 @@
 // note that GPIO3 has an external pullup on at least some boards).
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		// Configure the gpio pin controller
diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
index 5f5785534fd3d..142518ab348b1 100644
--- a/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
index 0b74fdc6e0f64..ea8a6c8f36c0a 100644
--- a/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
index b4dc99633b9d4..5cd14aac3e45f 100644
--- a/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/clocks";
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
index 9610ceefbbd5d..09adcea8fd377 100644
--- a/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadc-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/clocks";
diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
index 64cb1e00343b5..a2309a50e8d86 100644
--- a/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
index d02479ca4a25c..83de602e76ba1 100644
--- a/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/hy28a-overlay.dts b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
index d7625a6372f51..aa6463e6e7497 100644
--- a/arch/arm/boot/dts/overlays/hy28a-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
index b4664aad72533..42b68b684bd0a 100644
--- a/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hy28b-2017-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/hy28b-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
index 70c1118064b64..2e5e20f327a3c 100644
--- a/arch/arm/boot/dts/overlays/hy28b-overlay.dts
+++ b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
index 17119f82b942d..0c4cff354674b 100644
--- a/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i-sabre-q2m-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&sound>;
diff --git a/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
index 0afc6b405414c..8204b6b3aef83 100644
--- a/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
index 3f692c1a8958c..74b1911a949f9 100644
--- a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
index 976d38e781539..112aed91ecb24 100644
--- a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
index d1ffd2326669e..108165df165ef 100644
--- a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
index 4fd47ffa8575f..3b19993bcbe9a 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
index ad09fe122ad2a..1672e7d2f282c 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
index 0e2efa6ac8eaa..777e4a68190a4 100644
--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
index 9b5776f1bf6a9..393244d14ec45 100644
--- a/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
@@ -9,7 +9,7 @@
 /plugin/;
 
 /{
-   compatible = "brcm,bcm2708";
+   compatible = "brcm,bcm2835";
 
    fragment@0 {
       target = <&i2c0>;
diff --git a/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
index c9da3eea00122..825854dab6818 100644
--- a/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
@@ -9,7 +9,7 @@
 /plugin/;
 
 /{
-   compatible = "brcm,bcm2708";
+   compatible = "brcm,bcm2835";
 
    fragment@0 {
       target = <&i2c1>;
diff --git a/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
index 30c356d6070cc..cf43094c6ff45 100644
--- a/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s_pins>;
diff --git a/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
index fb1ccc314a290..551aba591d263 100644
--- a/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
  / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
  	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
index f16586f05971f..24073cadd0eff 100644
--- a/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
+++ b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
index 4dcf17515f955..7c70b25e58d75 100644
--- a/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
+++ b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
index b86e1e5edc89f..ee54095c869be 100644
--- a/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
index 279e22efc0137..585c7dbcdf7f5 100644
--- a/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
+++ b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
@@ -13,7 +13,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	// disable spi-dev on spi0.0
 	fragment@0 {
diff --git a/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
index 2b8dba0c231b2..d00515dca4193 100644
--- a/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
+++ b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
index 1212e3ff591b6..e73336029c544 100644
--- a/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/max98357a-overlay.dts b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
index ed3960fb83429..9e2afb05b7cb5 100644
--- a/arch/arm/boot/dts/overlays/max98357a-overlay.dts
+++ b/arch/arm/boot/dts/overlays/max98357a-overlay.dts
@@ -8,7 +8,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	/* Enable I2S */
 	fragment@0 {
diff --git a/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
index 313563d6ed47f..840dd9b31db41 100644
--- a/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
index 42f2d0f4ea668..f6421bd476f9c 100644
--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c1>;
diff --git a/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
index 7dcbacb3cd007..484d64b225fb8 100644
--- a/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
@@ -20,7 +20,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	// disable spi-dev on spi0.0
 	fragment@0 {
diff --git a/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
index 03eb5486fa9c4..0dae8053a9a91 100755
--- a/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    compatible = "brcm,bcm2835";
     /* disable spi-dev for spi0.0 */
     fragment@0 {
         target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
index dc773fa3b50ce..c70dc3d05ebfe 100644
--- a/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    compatible = "brcm,bcm2835";
     /* disable spi-dev for spi0.1 */
     fragment@0 {
         target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/mcp3008-overlay.dts b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
index 06bf4264959c3..0b7d9f75546ef 100755
--- a/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spidev0>;
diff --git a/arch/arm/boot/dts/overlays/mcp3202-overlay.dts b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
index 9902c4614ea1f..8e4e9f60f285f 100755
--- a/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spidev0>;
diff --git a/arch/arm/boot/dts/overlays/mcp342x-overlay.dts b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
index 6ddd292d689a6..7bbb528f804f5 100644
--- a/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp342x-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c1>;
diff --git a/arch/arm/boot/dts/overlays/media-center-overlay.dts b/arch/arm/boot/dts/overlays/media-center-overlay.dts
index ce4db35228e9f..0fcdcfa18eb3b 100644
--- a/arch/arm/boot/dts/overlays/media-center-overlay.dts
+++ b/arch/arm/boot/dts/overlays/media-center-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/mmc-overlay.dts b/arch/arm/boot/dts/overlays/mmc-overlay.dts
index 88251ad653917..85994b099bc00 100644
--- a/arch/arm/boot/dts/overlays/mmc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mmc-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&mmc>;
diff --git a/arch/arm/boot/dts/overlays/mpu6050-overlay.dts b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
index 06037969c3abb..3109d90562aee 100644
--- a/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-        compatible = "brcm,bcm2708";
+        compatible = "brcm,bcm2835";
 
         fragment@0 {
                 target = <&i2c1>;
diff --git a/arch/arm/boot/dts/overlays/mz61581-overlay.dts b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
index 2c29aaed44c59..32686968c0d65 100644
--- a/arch/arm/boot/dts/overlays/mz61581-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/ov5647-overlay.dts b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
index 0b7f4f99ba2a4..5266d4b8758d3 100644
--- a/arch/arm/boot/dts/overlays/ov5647-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ov5647-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_vc>;
diff --git a/arch/arm/boot/dts/overlays/papirus-overlay.dts b/arch/arm/boot/dts/overlays/papirus-overlay.dts
index 58eb8847f9ed8..7b6bcfd49c86e 100644
--- a/arch/arm/boot/dts/overlays/papirus-overlay.dts
+++ b/arch/arm/boot/dts/overlays/papirus-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
index 14a59dcf13ca6..2f4bbb407f896 100644
--- a/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
@@ -11,7 +11,7 @@
 */
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&act_led>;
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
index 975b5ee044bc7..2f1b655a133c3 100644
--- a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
@@ -9,7 +9,7 @@
 */
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&uart1>;
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
index 017199554bf2f..1d061bdd40f3a 100644
--- a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&mmc>;
diff --git a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
index 98381656945f5..30d3d8549da0a 100644
--- a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
@@ -16,7 +16,7 @@
 */
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&uart0>;
diff --git a/arch/arm/boot/dts/overlays/pibell-overlay.dts b/arch/arm/boot/dts/overlays/pibell-overlay.dts
index 6e71c159357ad..9333a9b09772f 100644
--- a/arch/arm/boot/dts/overlays/pibell-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pibell-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2708";
+    compatible = "brcm,bcm2835";
 
     fragment@0 {
         target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/piglow-overlay.dts b/arch/arm/boot/dts/overlays/piglow-overlay.dts
index e66e47ae83b20..075bceef158c8 100644
--- a/arch/arm/boot/dts/overlays/piglow-overlay.dts
+++ b/arch/arm/boot/dts/overlays/piglow-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/piscreen-overlay.dts b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
index 40a1f295346e3..ae1af76d3923f 100644
--- a/arch/arm/boot/dts/overlays/piscreen-overlay.dts
+++ b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
index 9c0bed893057b..93b85be3f7c15 100644
--- a/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
+++ b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/pisound-overlay.dts b/arch/arm/boot/dts/overlays/pisound-overlay.dts
index 0893717af4e01..49efb2b768fbc 100644
--- a/arch/arm/boot/dts/overlays/pisound-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pisound-overlay.dts
@@ -23,7 +23,7 @@
 #include <dt-bindings/gpio/gpio.h>
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/pitft22-overlay.dts b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
index 894ba2292f6be..589ad13795b18 100644
--- a/arch/arm/boot/dts/overlays/pitft22-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-        compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+        compatible = "brcm,bcm2835";
 
         fragment@0 {
                 target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
index 5c0752655c706..33901ee1db7a7 100644
--- a/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-        compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+        compatible = "brcm,bcm2835";
 
         fragment@0 {
                 target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
index 7cfb7effc61f8..4a4a3f44c29d5 100644
--- a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
index 3271993c9755f..a69b6c2c76081 100644
--- a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
index af29b870f1a18..524a1c1d36700 100644
--- a/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 	fragment@0 {
 		target-path = "/";
 		__overlay__ {
diff --git a/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
index 141c126fe33b9..119caf746b3b3 100644
--- a/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/qca7000-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
index f2cdd991aa961..9a451202a2eb7 100644
--- a/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
@@ -5,7 +5,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spidev0>;
diff --git a/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
index 819f400a90546..ea1d952734e9f 100644
--- a/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
index c021d02bb75ff..cac5e44c6ec54 100644
--- a/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
index b4602bd34e1e2..e2c25a0535e68 100644
--- a/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
@@ -6,7 +6,7 @@
 #include <dt-bindings/mfd/arizona.h>
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
index a442c8f0ec01b..07a915342702f 100644
--- a/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/rpi-display-overlay.dts b/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
index 533b5c140b544..a5eed07d6a4b4 100644
--- a/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
index 1915ce188bf30..fd81a086a21b2 100644
--- a/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
index 1dacd3b33085c..75e2f2ed5a470 100644
--- a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
@@ -5,7 +5,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts b/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
index 8332d0159a45b..9cda044a0f62a 100644
--- a/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
index 6eba2a10bfa5c..89d8d2ea6b2e7 100644
--- a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c1>;
diff --git a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
index eeb1e317cf680..3c97a545d8207 100644
--- a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spidev0>;
diff --git a/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
index f8d48233e28c7..87e9a326eff1f 100644
--- a/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
index 8c5d008a34252..5fbff2e6c02df 100644
--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_arm>;
diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
index d0a9e82dbea14..4e33b14afc784 100644
--- a/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/sdhost-overlay.dts b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
index de3d1b0a5e403..ae6c6ad83076f 100644
--- a/arch/arm/boot/dts/overlays/sdhost-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
@@ -4,7 +4,7 @@
 /* Provide backwards compatible aliases for the old sdhost dtparams. */
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&sdhost>;
diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
index f7bc0815f53a9..d63df20afdf76 100644
--- a/arch/arm/boot/dts/overlays/sdio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
@@ -4,7 +4,7 @@
 /* Enable SDIO from MMC interface via GPIOs 22-27. Includes sdhost overlay. */
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&mmc>;
diff --git a/arch/arm/boot/dts/overlays/sdtweak-overlay.dts b/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
index 5880e7cd5d1c3..38157d2f9bf3b 100644
--- a/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
@@ -4,7 +4,7 @@
 /* Provide backwards compatible aliases for the old sdhost dtparams. */
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&sdhost>;
diff --git a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
index e74226233ba18..ae1e50329d660 100644
--- a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
+++ b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&smi>;
diff --git a/arch/arm/boot/dts/overlays/smi-overlay.dts b/arch/arm/boot/dts/overlays/smi-overlay.dts
index 095f52c355fd6..70104c11627cf 100644
--- a/arch/arm/boot/dts/overlays/smi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/smi-overlay.dts
@@ -5,7 +5,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&smi>;
diff --git a/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
index 49803b309f864..a132b8637c313 100644
--- a/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
index 88d1800d63c9f..9664afc9845c9 100644
--- a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spidev0>;
diff --git a/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
index 7f79029d043c0..ff41439a483af 100644
--- a/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0_cs_pins>;
diff --git a/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
index ef9845f7184ee..168a0dc80ad1a 100644
--- a/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
index c3d4f96b7aa92..ea2794bc5fd5d 100644
--- a/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
index 2ad62497dc895..dab34ee79ae28 100644
--- a/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
index ef82890453bfe..bc7e7d04324bd 100644
--- a/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
index 761b6be4ff9b5..2a29750462af8 100644
--- a/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
index e533aba113ded..642678fc9ddd5 100644
--- a/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
index a62e107dc98fa..28d40c6c3c379 100644
--- a/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
+++ b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
@@ -3,7 +3,7 @@
 
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&gpio>;
diff --git a/arch/arm/boot/dts/overlays/ssd1306-overlay.dts b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
index 2cf677d59a7f9..84cf10e489d3c 100644
--- a/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
+++ b/arch/arm/boot/dts/overlays/ssd1306-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2718";
+    compatible = "brcm,bcm2835";
 
     fragment@0 {
 	target = <&i2c1>;
diff --git a/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
index e625faeed7fbc..bad61535981e9 100755
--- a/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
+++ b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&sound>;
diff --git a/arch/arm/boot/dts/overlays/sx150x-overlay.dts b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
index 0321b292c133b..1d1069345da21 100644
--- a/arch/arm/boot/dts/overlays/sx150x-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
@@ -22,7 +22,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	// Enable I2C#0 interface
 	fragment@0 {
diff --git a/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
index f4e0eeeea4b66..047695bb0c715 100644
--- a/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tc358743-audio-overlay.dts
@@ -5,7 +5,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2s>;
diff --git a/arch/arm/boot/dts/overlays/tc358743-overlay.dts b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
index 73845c532a592..2a1a3a80de493 100644
--- a/arch/arm/boot/dts/overlays/tc358743-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tc358743-overlay.dts
@@ -4,7 +4,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&i2c_vc>;
diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
index 906b79de86bb7..5ed6982d02391 100644
--- a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
@@ -24,7 +24,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
index eac4511050de1..e69188503ca33 100644
--- a/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tpm-slb9670-overlay.dts
@@ -8,7 +8,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&spi0>;
diff --git a/arch/arm/boot/dts/overlays/uart0-overlay.dts b/arch/arm/boot/dts/overlays/uart0-overlay.dts
index 7df217e6f16df..57ba7745d0233 100755
--- a/arch/arm/boot/dts/overlays/uart0-overlay.dts
+++ b/arch/arm/boot/dts/overlays/uart0-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&uart0>;
diff --git a/arch/arm/boot/dts/overlays/uart1-overlay.dts b/arch/arm/boot/dts/overlays/uart1-overlay.dts
index fa73e1feaeb1b..986d725a26529 100644
--- a/arch/arm/boot/dts/overlays/uart1-overlay.dts
+++ b/arch/arm/boot/dts/overlays/uart1-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&uart1>;
diff --git a/arch/arm/boot/dts/overlays/udrc-overlay.dts b/arch/arm/boot/dts/overlays/udrc-overlay.dts
index f6c235a341a2b..ae7c37996894a 100644
--- a/arch/arm/boot/dts/overlays/udrc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/udrc-overlay.dts
@@ -7,7 +7,7 @@
 /plugin/;
 
 / {
-    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    compatible = "brcm,bcm2835";
     fragment@0 {
         target = <&i2s>;
         __overlay__ {
diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
index 5ddc95b6d8fc2..2b91dc143945c 100644
--- a/arch/arm/boot/dts/overlays/upstream-overlay.dts
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -6,7 +6,7 @@
 #include <dt-bindings/clock/bcm2835.h>
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 	fragment@0 {
 		target-path = "/chosen";
 		__dormant__ {
diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
index 14f7687172c3a..aae52ac6f3edf 100644
--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
@@ -6,7 +6,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/chosen";
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
index 1e20d7e51115c..b03394844abd9 100644
--- a/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-kms-kippah-7inch-overlay.dts
@@ -8,7 +8,7 @@
 #include <dt-bindings/pinctrl/bcm2835.h>
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
index f6610c1d70a98..62ed673404e03 100644
--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
@@ -8,7 +8,7 @@
 #include <dt-bindings/clock/bcm2835.h>
 
 / {
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/chosen";
diff --git a/arch/arm/boot/dts/overlays/vga666-overlay.dts b/arch/arm/boot/dts/overlays/vga666-overlay.dts
index 7fcab963eb4ae..a4968d180a5d0 100644
--- a/arch/arm/boot/dts/overlays/vga666-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vga666-overlay.dts
@@ -2,7 +2,7 @@
 /plugin/;
 
 /{
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	// There is no VGA driver module, but we need a platform device
 	// node (that doesn't already use pinctrl) to hang the pinctrl
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
index f7f8747512653..59543d69217ea 100644
--- a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
index ef8bfbcabdb31..000cf0150e43b 100644
--- a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
@@ -3,7 +3,7 @@
 /plugin/;
 
 / {
-	compatible = "brcm,bcm2708";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target-path = "/";
diff --git a/arch/arm/boot/dts/overlays/wittypi-overlay.dts b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
index 8498134fdbb39..71ce806186deb 100644
--- a/arch/arm/boot/dts/overlays/wittypi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
@@ -8,7 +8,7 @@
 
 / {
 
-	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	compatible = "brcm,bcm2835";
 
 	fragment@0 {
 		target = <&leds>;
-- 
GitLab


From b21d708869b4c87533d621cce93667c07261d88d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 22 May 2019 12:58:47 +0100
Subject: [PATCH 0511/1835] vc4: Remove interrupt and DMA trampling

As part of the effort to clean up the overlays, remove the interrupt
and DMA mask declarations from the vc4 overlays which just duplicate
that which is in the base DTBs.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../boot/dts/overlays/vc4-fkms-v3d-overlay.dts |  8 --------
 .../boot/dts/overlays/vc4-kms-v3d-overlay.dts  | 18 ++----------------
 2 files changed, 2 insertions(+), 24 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
index aae52ac6f3edf..d9af97c8414f0 100644
--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
@@ -60,7 +60,6 @@
 	fragment@7 {
 		target = <&v3d>;
 		__overlay__  {
-			interrupts = <1 10>;
 			status = "okay";
 		};
 	};
@@ -72,13 +71,6 @@
 		};
 	};
 
-	fragment@9 {
-		target-path = "/soc/dma";
-		__overlay__ {
-			brcm,dma-channel-mask = <0x7f35>;
-		};
-	};
-
 	__overrides__ {
 		cma-256 = <0>,"+0-1-2-3-4";
 		cma-192 = <0>,"-0+1-2-3-4";
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
index 62ed673404e03..19e1d2548e7bb 100644
--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
@@ -62,7 +62,6 @@
 	fragment@7 {
 		target = <&pixelvalve0>;
 		__overlay__  {
-			interrupts = <2 13>; /* pwa0 */
 			status = "okay";
 		};
 	};
@@ -70,7 +69,6 @@
 	fragment@8 {
 		target = <&pixelvalve1>;
 		__overlay__  {
-			interrupts = <2 14>; /* pwa1 */
 			status = "okay";
 		};
 	};
@@ -78,7 +76,6 @@
 	fragment@9 {
 		target = <&pixelvalve2>;
 		__overlay__  {
-			interrupts = <2 10>; /* pixelvalve */
 			status = "okay";
 		};
 	};
@@ -86,7 +83,6 @@
 	fragment@10 {
 		target = <&hvs>;
 		__overlay__  {
-			interrupts = <2 1>;
 			status = "okay";
 		};
 	};
@@ -94,7 +90,6 @@
 	fragment@11 {
 		target = <&hdmi>;
 		__overlay__  {
-			interrupts = <2 8>, <2 9>;
 			status = "okay";
 		};
 	};
@@ -102,7 +97,6 @@
 	fragment@12 {
 		target = <&v3d>;
 		__overlay__  {
-			interrupts = <1 10>;
 			status = "okay";
 		};
 	};
@@ -115,14 +109,6 @@
 	};
 
 	fragment@14 {
-		target-path = "/soc/dma";
-		__overlay__ {
-			brcm,dma-channel-mask = <0x7f35>;
-		};
-	};
-
-
-	fragment@15 {
 		target = <&clocks>;
 		__overlay__  {
 			claim-clocks = <
@@ -134,14 +120,14 @@
 		};
 	};
 
-	fragment@16 {
+	fragment@15 {
 		target = <&vec>;
 		__overlay__  {
 			status = "okay";
 		};
 	};
 
-	fragment@17 {
+	fragment@16 {
 		target = <&txp>;
 		__overlay__  {
 			status = "okay";
-- 
GitLab


From e1272fcce7564b066995ebe92da132cec8e77656 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 7 May 2019 14:29:38 +0100
Subject: [PATCH 0512/1835] BCM270X_DT: Add non-removable clone of mmc node

non-removable is a boolean property, and as such can't be unset by an
overlay if it is set in a base DTB. Until now the workaround for this
problem has been for overlays to clone non-removable nodes without
the offending property, but this involves a lot of unnecessary
replication. Instead, add a clone of the mmc node with non-removable
already set to the base DTB, selecting the required version using
the status properties.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2708-rpi-0-w.dts       |  4 +--
 arch/arm/boot/dts/bcm2708-rpi.dtsi          |  3 +-
 arch/arm/boot/dts/bcm270x.dtsi              | 13 ++++++++
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts  |  5 ++--
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts       |  5 ++--
 arch/arm/boot/dts/overlays/mmc-overlay.dts  |  7 +++++
 arch/arm/boot/dts/overlays/sdio-overlay.dts | 33 +++++++--------------
 7 files changed, 38 insertions(+), 32 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
index aa33646fcf531..23ff3e4970aea 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
@@ -14,6 +14,7 @@
 	aliases {
 		serial0 = &uart1;
 		serial1 = &uart0;
+		mmc1 = &mmcnr;
 	};
 };
 
@@ -73,10 +74,9 @@
 	};
 };
 
-&mmc {
+&mmcnr {
 	pinctrl-names = "default";
 	pinctrl-0 = <&sdio_pins>;
-	non-removable;
 	bus-width = <4>;
 	status = "okay";
 };
diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index 9e14921867284..0cce7d1b99d32 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -118,7 +118,8 @@
 		sd_force_pio = <&sdhost>,"brcm,force-pio?";
 		sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
 		sd_debug     = <&sdhost>,"brcm,debug";
-		sdio_overclock = <&mmc>,"brcm,overclock-50:0";
+		sdio_overclock = <&mmc>,"brcm,overclock-50:0",
+				 <&mmcnr>,"brcm,overclock-50:0";
 		axiperf      = <&axiperf>,"status";
 	};
 };
diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index ecdb36e69c873..6d2563b25a424 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -79,6 +79,19 @@
 			status = "disabled";
 		};
 
+		/* A clone of mmc but with non-removable set */
+		mmcnr: mmcnr@7e300000 {
+			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
+			reg = <0x7e300000 0x100>;
+			interrupts = <2 30>;
+			clocks = <&clocks BCM2835_CLOCK_EMMC>;
+			dmas = <&dma 11>;
+			dma-names = "rx-tx";
+			brcm,overclock-50 = <0>;
+			non-removable;
+			status = "disabled";
+		};
+
 		hvs: hvs@7e400000 {
 			/* Add alias */
 			status = "disabled";
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
index b5f125296e1e9..6e526d7e49893 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -15,6 +15,7 @@
 	aliases {
 		serial0 = &uart1;
 		serial1 = &uart0;
+		mmc1 = &mmcnr;
 	};
 };
 
@@ -74,13 +75,11 @@
 	};
 };
 
-&mmc {
+&mmcnr {
 	pinctrl-names = "default";
 	pinctrl-0 = <&sdio_pins>;
-	non-removable;
 	bus-width = <4>;
 	status = "okay";
-	brcm,overclock-50 = <0>;
 };
 
 &firmware {
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index d9d9505c66932..9d77cb1e9b0b8 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -15,6 +15,7 @@
 	aliases {
 		serial0 = &uart1;
 		serial1 = &uart0;
+		mmc1 = &mmcnr;
 	};
 };
 
@@ -74,13 +75,11 @@
 	};
 };
 
-&mmc {
+&mmcnr {
 	pinctrl-names = "default";
 	pinctrl-0 = <&sdio_pins>;
-	non-removable;
 	bus-width = <4>;
 	status = "okay";
-	brcm,overclock-50 = <0>;
 };
 
 &soc {
diff --git a/arch/arm/boot/dts/overlays/mmc-overlay.dts b/arch/arm/boot/dts/overlays/mmc-overlay.dts
index 85994b099bc00..c1a2f691aa1e7 100644
--- a/arch/arm/boot/dts/overlays/mmc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mmc-overlay.dts
@@ -33,6 +33,13 @@
 		};
 	};
 
+	fragment@3 {
+		target = <&mmcnr>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
 	__overrides__ {
 		overclock_50     = <&frag0>,"brcm,overclock-50:0";
 	};
diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
index d63df20afdf76..873e490563797 100644
--- a/arch/arm/boot/dts/overlays/sdio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
@@ -1,39 +1,26 @@
 /dts-v1/;
 /plugin/;
 
-/* Enable SDIO from MMC interface via GPIOs 22-27. Includes sdhost overlay. */
+/* Enable SDIO from MMC interface via various GPIO groups */
 
 /{
 	compatible = "brcm,bcm2835";
 
 	fragment@0 {
-		target = <&mmc>;
+		target = <&mmcnr>;
 		__overlay__ {
 			status = "disabled";
 		};
 	};
 
 	fragment@1 {
-		target = <&soc>;
-		__overlay__ {
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			sdio_ovl: sdio@7e300000 {
-				compatible = "brcm,bcm2835-mmc",
-					     "brcm,bcm2835-sdhci";
-				reg = <0x7e300000 0x100>;
-				interrupts = <2 30>;
-				clocks = <&clocks 28/*BCM2835_CLOCK_EMMC*/>;
-				dmas = <&dma 11>;
-				dma-names = "rx-tx";
-				brcm,overclock-50 = <0>;
-				status = "okay";
-				pinctrl-names = "default";
-				pinctrl-0 = <&sdio_ovl_pins>;
-				non-removable;
-				bus-width = <4>;
-			};
+		target = <&mmc>;
+		sdio_ovl: __overlay__ {
+			pinctrl-0 = <&sdio_ovl_pins>;
+			pinctrl-names = "default";
+			non-removable;
+			bus-width = <4>;
+			status = "okay";
 		};
 	};
 
@@ -75,7 +62,7 @@
 	fragment@6 {
 		target-path = "/aliases";
 		__overlay__ {
-			mmc1 = "/soc/sdio@7e300000";
+			mmc1 = "/soc/mmc@7e300000";
 		};
 	};
 
-- 
GitLab


From 1e86eb066dfc16b23f397fb433fc9294ea06a99f Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 8 May 2019 10:08:31 +0100
Subject: [PATCH 0513/1835] BCM270X_DT: usb: Refactor DTS and overlays

Move the IRQ interrupt declaration in the usb node before the FIQ
declaration, so that the dwc2 driver will find it. Name the
interrupts appropriately so that the dwc_otg driver can still find
them. Then remove the interrupt rewriting from the overlays.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm270x.dtsi                 | 6 ++++--
 arch/arm/boot/dts/overlays/dwc-otg-overlay.dts | 6 ------
 arch/arm/boot/dts/overlays/dwc2-overlay.dts    | 2 --
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index 6d2563b25a424..86f3eb2d3f48d 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -131,8 +131,10 @@
 			compatible = "brcm,bcm2708-usb";
 			reg = <0x7e980000 0x10000>,
 			      <0x7e006000 0x1000>;
-			interrupts = <2 0>,
-				     <1 9>;
+			interrupt-names = "usb",
+					  "soft";
+			interrupts = <1 9>,
+				     <2 0>;
 		};
 
 		v3d@7ec00000 { /* vd3 */
diff --git a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
index 15dd7750813e8..78c5e9f850484 100644
--- a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
@@ -6,14 +6,8 @@
 
 	fragment@0 {
 		target = <&usb>;
-		#address-cells = <1>;
-		#size-cells = <1>;
 		__overlay__ {
 			compatible = "brcm,bcm2708-usb";
-			reg = <0x7e980000 0x10000>,
-			      <0x7e006000 0x1000>;
-			interrupts = <2 0>,
-				     <1 9>;
 			status = "okay";
 		};
 	};
diff --git a/arch/arm/boot/dts/overlays/dwc2-overlay.dts b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
index 7f04b2ab37625..732adbe3faaf9 100644
--- a/arch/arm/boot/dts/overlays/dwc2-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
@@ -10,8 +10,6 @@
 		#size-cells = <1>;
 		dwc2_usb: __overlay__ {
 			compatible = "brcm,bcm2835-usb";
-			reg = <0x7e980000 0x10000>;
-			interrupts = <1 9>;
 			dr_mode = "otg";
 			g-np-tx-fifo-size = <32>;
 			g-rx-fifo-size = <256>;
-- 
GitLab


From d2b14d32d3e417e5ef9434bb8ec9f1229035ee2e Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 22 May 2019 13:29:56 +0100
Subject: [PATCH 0514/1835] overlays: Update upstream overlay

The recent DT/overlay changes have had a corresponding effect on the
upstream overlay, which is a composite of the vc4-kms-v3d and dwc2
overlays.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../boot/dts/overlays/upstream-overlay.dts    | 41 ++-----------------
 1 file changed, 3 insertions(+), 38 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
index 2b91dc143945c..1e069f3672f4a 100644
--- a/arch/arm/boot/dts/overlays/upstream-overlay.dts
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -52,42 +52,36 @@
 	fragment@7 {
 		target = <&pixelvalve0>;
 		__overlay__ {
-			interrupts = <2 13>;
 			status = "okay";
 		};
 	};
 	fragment@8 {
 		target = <&pixelvalve1>;
 		__overlay__ {
-			interrupts = <2 14>;
 			status = "okay";
 		};
 	};
 	fragment@9 {
 		target = <&pixelvalve2>;
 		__overlay__ {
-			interrupts = <2 10>;
 			status = "okay";
 		};
 	};
 	fragment@10 {
 		target = <&hvs>;
 		__overlay__ {
-			interrupts = <2 1>;
 			status = "okay";
 		};
 	};
 	fragment@11 {
 		target = <&hdmi>;
 		__overlay__ {
-			interrupts = <2 8>, <2 9>;
 			status = "okay";
 		};
 	};
 	fragment@12 {
 		target = <&v3d>;
 		__overlay__ {
-			interrupts = <1 10>;
 			status = "okay";
 		};
 	};
@@ -98,37 +92,29 @@
 		};
 	};
 	fragment@14 {
-		target-path = "/soc/dma";
-		__overlay__ {
-			brcm,dma-channel-mask = <0x7f35>;
-		};
-	};
-	fragment@15 {
 		target = <&clocks>;
 		__overlay__ {
 			claim-clocks = <BCM2835_PLLD_DSI0 BCM2835_PLLD_DSI1 BCM2835_PLLH_AUX BCM2835_PLLH_PIX>;
 		};
 	};
-	fragment@16 {
+	fragment@15 {
 		target = <&vec>;
 		__overlay__ {
 			status = "okay";
 		};
 	};
-	fragment@17 {
+	fragment@16 {
 		target = <&txp>;
 		__overlay__ {
 			status = "okay";
 		};
 	};
-	fragment@18 {
+	fragment@17 {
 		target = <&usb>;
 		#address-cells = <1>;
 		#size-cells = <1>;
 		dwc2_usb: __overlay__ {
 			compatible = "brcm,bcm2835-usb";
-			reg = <0x7e980000 0x10000>;
-			interrupts = <1 9>;
 			dr_mode = "otg";
 			g-np-tx-fifo-size = <32>;
 			g-rx-fifo-size = <256>;
@@ -136,25 +122,4 @@
 			status = "okay";
 		};
 	};
-	fragment@19 {
-		target = <&uart1>;
-		__overlay__ {
-			interrupt-parent = <&intc>;
-			interrupts = <0x1 0x1d>;
-		};
-	};
-	fragment@20 {
-		target = <&spi1>;
-		__overlay__ {
-			interrupt-parent = <&intc>;
-			interrupts = <0x1 0x1d>;
-		};
-	};
-	fragment@21 {
-		target = <&spi2>;
-		__overlay__ {
-			interrupt-parent = <&intc>;
-			interrupts = <0x1 0x1d>;
-		};
-	};
 };
-- 
GitLab


From 1694cf065778a8508b6dd8ce8ce270ca0e643788 Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Thu, 16 May 2019 14:39:21 +0200
Subject: [PATCH 0515/1835] w1: ds2408: Fix typo after 49695ac46861 (reset on
 output_write retry with readback)

commit 6660a04feb7ef648e50c792e19084d675fa6f3a2 upstream.

Fix a typo in commit:
49695ac46861 w1: ds2408: reset on output_write retry with readback

Fixes: 49695ac46861 ("w1: ds2408: reset on output_write retry with readback")
Reported-by: Phil Elwell <phil@raspberrypi.org>
Cc: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2408.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/w1/slaves/w1_ds2408.c b/drivers/w1/slaves/w1_ds2408.c
index 92e8f0755b9a9..edf0bc98012cb 100644
--- a/drivers/w1/slaves/w1_ds2408.c
+++ b/drivers/w1/slaves/w1_ds2408.c
@@ -138,7 +138,7 @@ static ssize_t status_control_read(struct file *filp, struct kobject *kobj,
 		W1_F29_REG_CONTROL_AND_STATUS, buf);
 }
 
-#ifdef fCONFIG_W1_SLAVE_DS2408_READBACK
+#ifdef CONFIG_W1_SLAVE_DS2408_READBACK
 static bool optional_read_back_valid(struct w1_slave *sl, u8 expected)
 {
 	u8 w1_buf[3];
-- 
GitLab


From 6f91b5dbfdb62a434571a73f2dc15181963e3bea Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 28 May 2019 16:36:04 +0100
Subject: [PATCH 0516/1835] BCM270X_DT: Rename Pi Zero W DT files

The downtream Pi Zero W dts file uses the digit 0, whereas upstream
chose to spell it out - "zero-w". The firmware has, for a long time,
looked for bcm2708-rpi-zero-w.dtb first before falling back to the
numerical version. Therefore it is better to follow upstream and
make the switch to "bcm2708-rpi-zero-w".

At the same time, remove some overrides that duplicate values
inherited from the shared .dtsi files.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/Makefile                                   | 2 +-
 .../boot/dts/{bcm2708-rpi-0-w.dts => bcm2708-rpi-zero-w.dts} | 5 -----
 2 files changed, 1 insertion(+), 6 deletions(-)
 rename arch/arm/boot/dts/{bcm2708-rpi-0-w.dts => bcm2708-rpi-zero-w.dts} (97%)

diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index ffd515b94cb8c..8ba7c562ccfc7 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -4,7 +4,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
 	bcm2708-rpi-b.dtb \
 	bcm2708-rpi-b-plus.dtb \
 	bcm2708-rpi-cm.dtb \
-	bcm2708-rpi-0-w.dtb \
+	bcm2708-rpi-zero-w.dtb \
 	bcm2709-rpi-2-b.dtb \
 	bcm2710-rpi-3-b.dtb \
 	bcm2710-rpi-3-b-plus.dtb \
diff --git a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
similarity index 97%
rename from arch/arm/boot/dts/bcm2708-rpi-0-w.dts
rename to arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
index 23ff3e4970aea..087f39106bef0 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
@@ -132,15 +132,10 @@
 };
 
 &i2s {
-	#sound-dai-cells = <0>;
 	pinctrl-names = "default";
 	pinctrl-0 = <&i2s_pins>;
 };
 
-&random {
-	status = "okay";
-};
-
 &leds {
 	act_led: act {
 		label = "led0";
-- 
GitLab


From bd1336d8b6544ce5c7ddb197c3d8c539082dac66 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 28 May 2019 16:23:51 +0100
Subject: [PATCH 0517/1835] BCM270X_DT: Create bcm2708-rpi-zero.dts

The Pi Zero deserves a dedicated .dtb file - sharing the b-plus .dtb
has been observed to cause an issue with the MAC address of some
Ethernet dongles.

See: https://github.com/raspberrypi/linux/issues/2990

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/Makefile             |   1 +
 arch/arm/boot/dts/bcm2708-rpi-zero.dts | 117 +++++++++++++++++++++++++
 2 files changed, 118 insertions(+)
 create mode 100644 arch/arm/boot/dts/bcm2708-rpi-zero.dts

diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 8ba7c562ccfc7..232f95f8fef40 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -4,6 +4,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
 	bcm2708-rpi-b.dtb \
 	bcm2708-rpi-b-plus.dtb \
 	bcm2708-rpi-cm.dtb \
+	bcm2708-rpi-zero.dtb \
 	bcm2708-rpi-zero-w.dtb \
 	bcm2709-rpi-2-b.dtb \
 	bcm2710-rpi-3-b.dtb \
diff --git a/arch/arm/boot/dts/bcm2708-rpi-zero.dts b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
new file mode 100644
index 0000000000000..dba3ece8eac5b
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
@@ -0,0 +1,117 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
+
+/ {
+	compatible = "raspberrypi,model-zero", "brcm,bcm2835";
+	model = "Raspberry Pi Zero";
+
+	chosen {
+		bootargs = "coherent_pool=1M";
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <>;
+		brcm,function = <>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
-- 
GitLab


From 55e0334cf5a43948b65788980cd8ab729427230e Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 30 May 2019 12:25:29 +0100
Subject: [PATCH 0518/1835] overlays: Fix mmc-related overlays after refactor

The addition of the mmcnr node to the base dtbs caused some overlays to
not work as they should. Patch up pi3-disable-wifi, balena-fin and
sdhost.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/balena-fin-overlay.dts       | 7 ++++---
 arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts | 7 +++++++
 arch/arm/boot/dts/overlays/sdhost-overlay.dts           | 7 +++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
index b10675c02757a..8c1cba99fc8f5 100644
--- a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
@@ -5,13 +5,12 @@
 	compatible = "brcm,bcm2835";
 
 	fragment@0 {
-		target = <&mmc>;
-		sdio_wifi: __overlay__ {
+		target = <&mmcnr>;
+		__overlay__ {
 			pinctrl-names = "default";
 			pinctrl-0 = <&sdio_pins>;
 			bus-width = <4>;
 			brcm,overclock-50 = <35>;
-			non-removable;
 			status = "okay";
 		};
 	};
@@ -43,6 +42,8 @@
 				compatible = "gpio-poweroff";
 				gpios = <&gpio 40 1>;
 				force;
+				pinctrl-names = "default";
+				pinctrl-0 = <&power_ctrl_pins>;
 			};
 
 			i2c_soft: i2c@0 {
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
index 1d061bdd40f3a..75e0464639000 100644
--- a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
@@ -10,4 +10,11 @@
 			status = "disabled";
 		};
 	};
+
+	fragment@1 {
+		target = <&mmcnr>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
 };
diff --git a/arch/arm/boot/dts/overlays/sdhost-overlay.dts b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
index ae6c6ad83076f..0b72b4eeac887 100644
--- a/arch/arm/boot/dts/overlays/sdhost-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
@@ -22,6 +22,13 @@
 		};
 	};
 
+	fragment@2 {
+		target = <&mmcnr>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
 	__overrides__ {
 		overclock_50     = <&frag0>,"brcm,overclock-50:0";
 		force_pio        = <&frag0>,"brcm,force-pio?";
-- 
GitLab


From 8bff48328aff10c1e9c134a55337620929e449c2 Mon Sep 17 00:00:00 2001
From: Frank Rowand <frank.rowand@sony.com>
Date: Fri, 12 Oct 2018 19:21:16 -0700
Subject: [PATCH 0519/1835] of: overlay: set node fields from properties when
 add new overlay node

commit f96278810150fc39085d1872e5b39ea06366d03e upstream.
See: https://github.com/raspberrypi/linux/issues/2995

Overlay nodes added by add_changeset_node() do not have the node
fields name, phandle, and type set.

The node passed to __of_attach_node() when the add node changeset
entry is processed does not contain any properties.  The node's
properties are located in add property changeset entries that will
be processed after the add node changeset is applied.

Set the node's fields in the node contained in the add node
changeset entry and do not set them to incorrect values in
add_changeset_node().

A visible symptom that is fixed by this patch is the names of nodes
added by overlays that have an entry in /sys/bus/platform/drivers/*/
will contain the unit-address but the node-name will be <NULL>,  for
example, "fc4ab000.<NULL>".  After applying the patch the name, in
this example, for node restart@fc4ab000 is "fc4ab000.restart".

Tested-by: Alan Tull <atull@kernel.org>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
---
 drivers/of/dynamic.c | 27 ++++++++++++++++++---------
 drivers/of/overlay.c | 34 +++++++++++++++++++++++++++-------
 2 files changed, 45 insertions(+), 16 deletions(-)

diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index 45c0b1f4cb69f..a09c1c3cf831e 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -205,15 +205,24 @@ static void __of_attach_node(struct device_node *np)
 	const __be32 *phandle;
 	int sz;
 
-	np->name = __of_get_property(np, "name", NULL) ? : "<NULL>";
-	np->type = __of_get_property(np, "device_type", NULL) ? : "<NULL>";
-
-	phandle = __of_get_property(np, "phandle", &sz);
-	if (!phandle)
-		phandle = __of_get_property(np, "linux,phandle", &sz);
-	if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
-		phandle = __of_get_property(np, "ibm,phandle", &sz);
-	np->phandle = (phandle && (sz >= 4)) ? be32_to_cpup(phandle) : 0;
+	if (!of_node_check_flag(np, OF_OVERLAY)) {
+		np->name = __of_get_property(np, "name", NULL);
+		np->type = __of_get_property(np, "device_type", NULL);
+		if (!np->name)
+			np->name = "<NULL>";
+		if (!np->type)
+			np->type = "<NULL>";
+
+		phandle = __of_get_property(np, "phandle", &sz);
+		if (!phandle)
+			phandle = __of_get_property(np, "linux,phandle", &sz);
+		if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
+			phandle = __of_get_property(np, "ibm,phandle", &sz);
+		if (phandle && (sz >= 4))
+			np->phandle = be32_to_cpup(phandle);
+		else
+			np->phandle = 0;
+	}
 
 	np->child = NULL;
 	np->sibling = np->parent->child;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 9808aae4621ad..b2704badd987e 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -301,10 +301,11 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
 	struct property *new_prop = NULL, *prop;
 	int ret = 0;
 
-	if (!of_prop_cmp(overlay_prop->name, "name") ||
-	    !of_prop_cmp(overlay_prop->name, "phandle") ||
-	    !of_prop_cmp(overlay_prop->name, "linux,phandle"))
-		return 0;
+	if (target->in_livetree)
+		if (!of_prop_cmp(overlay_prop->name, "name") ||
+		    !of_prop_cmp(overlay_prop->name, "phandle") ||
+		    !of_prop_cmp(overlay_prop->name, "linux,phandle"))
+			return 0;
 
 	if (target->in_livetree)
 		prop = of_find_property(target->np, overlay_prop->name, NULL);
@@ -322,12 +323,17 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
 	if (!new_prop)
 		return -ENOMEM;
 
-	if (!prop)
+	if (!prop) {
+		if (!target->in_livetree) {
+			new_prop->next = target->np->deadprops;
+			target->np->deadprops = new_prop;
+		}
 		ret = of_changeset_add_property(&ovcs->cset, target->np,
 						new_prop);
-	else
+	} else {
 		ret = of_changeset_update_property(&ovcs->cset, target->np,
 						   new_prop);
+	}
 
 	if (ret) {
 		kfree(new_prop->name);
@@ -382,9 +388,10 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
 		struct target *target, struct device_node *node)
 {
 	const char *node_kbasename;
+	const __be32 *phandle;
 	struct device_node *tchild;
 	struct target target_child;
-	int ret = 0;
+	int ret = 0, size;
 
 	node_kbasename = kbasename(node->full_name);
 
@@ -398,6 +405,19 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
 			return -ENOMEM;
 
 		tchild->parent = target->np;
+		tchild->name = __of_get_property(node, "name", NULL);
+		tchild->type = __of_get_property(node, "device_type", NULL);
+
+		if (!tchild->name)
+			tchild->name = "<NULL>";
+		if (!tchild->type)
+			tchild->type = "<NULL>";
+
+		/* ignore obsolete "linux,phandle" */
+		phandle = __of_get_property(node, "phandle", &size);
+		if (phandle && (size == 4))
+			tchild->phandle = be32_to_cpup(phandle);
+
 		of_node_set_flag(tchild, OF_OVERLAY);
 
 		ret = of_changeset_attach_node(&ovcs->cset, tchild);
-- 
GitLab


From be0a940de66666c10c9071cddafce6284c400734 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 3 Jun 2019 14:57:56 +0100
Subject: [PATCH 0520/1835] config: Add NF_TABLES support

---
 arch/arm/configs/bcm2709_defconfig | 48 ++++++++++++++++++++++++++++++
 arch/arm/configs/bcmrpi_defconfig  | 48 ++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 3ab42ebe443dc..c1dda5092433f 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -136,6 +136,36 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_CT_NETLINK=m
+CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_OBJREF=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=m
+CONFIG_NF_FLOW_TABLE=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -224,6 +254,14 @@ CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_DUP_IPV4=m
+CONFIG_NFT_FIB_IPV4=m
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_FLOW_TABLE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NFT_MASQ_IPV4=m
+CONFIG_NFT_REDIR_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -243,6 +281,13 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_NFT_MASQ_IPV6=m
+CONFIG_NFT_REDIR_IPV6=m
+CONFIG_NFT_DUP_IPV6=m
+CONFIG_NFT_FIB_IPV6=m
+CONFIG_NF_FLOW_TABLE_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -261,6 +306,9 @@ CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NFT_BRIDGE_REJECT=m
+CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
 CONFIG_BRIDGE_EBT_BROUTE=m
 CONFIG_BRIDGE_EBT_T_FILTER=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index f5e5c0b8fe2d2..9a69e8b0a8ae1 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -129,6 +129,36 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_CT_NETLINK=m
+CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_OBJREF=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=m
+CONFIG_NF_FLOW_TABLE=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -217,6 +247,14 @@ CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_DUP_IPV4=m
+CONFIG_NFT_FIB_IPV4=m
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_FLOW_TABLE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NFT_MASQ_IPV4=m
+CONFIG_NFT_REDIR_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -236,6 +274,13 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_NFT_MASQ_IPV6=m
+CONFIG_NFT_REDIR_IPV6=m
+CONFIG_NFT_DUP_IPV6=m
+CONFIG_NFT_FIB_IPV6=m
+CONFIG_NF_FLOW_TABLE_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -254,6 +299,9 @@ CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NFT_BRIDGE_REJECT=m
+CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
 CONFIG_BRIDGE_EBT_BROUTE=m
 CONFIG_BRIDGE_EBT_T_FILTER=m
-- 
GitLab


From 6b45ec4c1518201aed352f9c9a852613adfd6efb Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 10 Jun 2019 15:07:26 +0100
Subject: [PATCH 0521/1835] Revert "of: overlay: set node fields from
 properties when add new overlay node"

This reverts commit 8bff48328aff10c1e9c134a55337620929e449c2.
---
 drivers/of/dynamic.c | 27 +++++++++------------------
 drivers/of/overlay.c | 34 +++++++---------------------------
 2 files changed, 16 insertions(+), 45 deletions(-)

diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index a09c1c3cf831e..45c0b1f4cb69f 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -205,24 +205,15 @@ static void __of_attach_node(struct device_node *np)
 	const __be32 *phandle;
 	int sz;
 
-	if (!of_node_check_flag(np, OF_OVERLAY)) {
-		np->name = __of_get_property(np, "name", NULL);
-		np->type = __of_get_property(np, "device_type", NULL);
-		if (!np->name)
-			np->name = "<NULL>";
-		if (!np->type)
-			np->type = "<NULL>";
-
-		phandle = __of_get_property(np, "phandle", &sz);
-		if (!phandle)
-			phandle = __of_get_property(np, "linux,phandle", &sz);
-		if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
-			phandle = __of_get_property(np, "ibm,phandle", &sz);
-		if (phandle && (sz >= 4))
-			np->phandle = be32_to_cpup(phandle);
-		else
-			np->phandle = 0;
-	}
+	np->name = __of_get_property(np, "name", NULL) ? : "<NULL>";
+	np->type = __of_get_property(np, "device_type", NULL) ? : "<NULL>";
+
+	phandle = __of_get_property(np, "phandle", &sz);
+	if (!phandle)
+		phandle = __of_get_property(np, "linux,phandle", &sz);
+	if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
+		phandle = __of_get_property(np, "ibm,phandle", &sz);
+	np->phandle = (phandle && (sz >= 4)) ? be32_to_cpup(phandle) : 0;
 
 	np->child = NULL;
 	np->sibling = np->parent->child;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index b2704badd987e..9808aae4621ad 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -301,11 +301,10 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
 	struct property *new_prop = NULL, *prop;
 	int ret = 0;
 
-	if (target->in_livetree)
-		if (!of_prop_cmp(overlay_prop->name, "name") ||
-		    !of_prop_cmp(overlay_prop->name, "phandle") ||
-		    !of_prop_cmp(overlay_prop->name, "linux,phandle"))
-			return 0;
+	if (!of_prop_cmp(overlay_prop->name, "name") ||
+	    !of_prop_cmp(overlay_prop->name, "phandle") ||
+	    !of_prop_cmp(overlay_prop->name, "linux,phandle"))
+		return 0;
 
 	if (target->in_livetree)
 		prop = of_find_property(target->np, overlay_prop->name, NULL);
@@ -323,17 +322,12 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
 	if (!new_prop)
 		return -ENOMEM;
 
-	if (!prop) {
-		if (!target->in_livetree) {
-			new_prop->next = target->np->deadprops;
-			target->np->deadprops = new_prop;
-		}
+	if (!prop)
 		ret = of_changeset_add_property(&ovcs->cset, target->np,
 						new_prop);
-	} else {
+	else
 		ret = of_changeset_update_property(&ovcs->cset, target->np,
 						   new_prop);
-	}
 
 	if (ret) {
 		kfree(new_prop->name);
@@ -388,10 +382,9 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
 		struct target *target, struct device_node *node)
 {
 	const char *node_kbasename;
-	const __be32 *phandle;
 	struct device_node *tchild;
 	struct target target_child;
-	int ret = 0, size;
+	int ret = 0;
 
 	node_kbasename = kbasename(node->full_name);
 
@@ -405,19 +398,6 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
 			return -ENOMEM;
 
 		tchild->parent = target->np;
-		tchild->name = __of_get_property(node, "name", NULL);
-		tchild->type = __of_get_property(node, "device_type", NULL);
-
-		if (!tchild->name)
-			tchild->name = "<NULL>";
-		if (!tchild->type)
-			tchild->type = "<NULL>";
-
-		/* ignore obsolete "linux,phandle" */
-		phandle = __of_get_property(node, "phandle", &size);
-		if (phandle && (size == 4))
-			tchild->phandle = be32_to_cpup(phandle);
-
 		of_node_set_flag(tchild, OF_OVERLAY);
 
 		ret = of_changeset_attach_node(&ovcs->cset, tchild);
-- 
GitLab


From 2a64d238e2d6163acd47e531d8431cc2e7fa91e2 Mon Sep 17 00:00:00 2001
From: IQaudIO <gordon@iqaudio.com>
Date: Thu, 6 Jun 2019 10:20:55 +0100
Subject: [PATCH 0522/1835] Fixed 48k timing issue

---
 sound/soc/bcm/iqaudio-codec.c | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/sound/soc/bcm/iqaudio-codec.c b/sound/soc/bcm/iqaudio-codec.c
index 4051a5f4269d9..61341d7c9db68 100644
--- a/sound/soc/bcm/iqaudio-codec.c
+++ b/sound/soc/bcm/iqaudio-codec.c
@@ -45,11 +45,15 @@ static int snd_rpi_iqaudio_pll_control(struct snd_soc_dapm_widget *w,
 					  0);
 		if (ret)
 			dev_err(card->dev, "Failed to bypass PLL: %d\n", ret);
+		/* Allow PLL time to bypass */
+		msleep(100);
 	} else if (SND_SOC_DAPM_EVENT_ON(event)) {
 		ret = snd_soc_dai_set_pll(codec_dai, 0, DA7213_SYSCLK_PLL, 0,
 					  pll_out);
 		if (ret)
 			dev_err(card->dev, "Failed to enable PLL: %d\n", ret);
+		/* Allow PLL time to lock */
+		msleep(100);
 	}
 
 	return ret;
@@ -71,6 +75,13 @@ static int snd_rpi_iqaudio_post_dapm_event(struct snd_soc_dapm_widget *w,
      return 0;
 }
 
+static const struct snd_kcontrol_new dapm_controls[] = {
+	SOC_DAPM_PIN_SWITCH("HP Jack"),
+	SOC_DAPM_PIN_SWITCH("MIC Jack"),
+	SOC_DAPM_PIN_SWITCH("Onboard MIC"),
+	SOC_DAPM_PIN_SWITCH("AUX Jack"),
+};
+
 static const struct snd_soc_dapm_widget dapm_widgets[] = {
 	SND_SOC_DAPM_HP("HP Jack", NULL),
 	SND_SOC_DAPM_MIC("MIC Jack", NULL),
@@ -87,14 +98,14 @@ static const struct snd_soc_dapm_route audio_map[] = {
 	{"HP Jack", NULL, "HPR"},
 	{"HP Jack", NULL, "PLL Control"},
 
-	{"AUX Jack", NULL, "AUXR"},
-	{"AUX Jack", NULL, "AUXL"},
+	{"AUXR", NULL, "AUX Jack"},
+	{"AUXL", NULL, "AUX Jack"},
 	{"AUX Jack", NULL, "PLL Control"},
 
 	/* Assume Mic1 is linked to Headset and Mic2 to on-board mic */
-	{"MIC Jack", NULL, "MIC1"},
+	{"MIC1", NULL, "MIC Jack"},
 	{"MIC Jack", NULL, "PLL Control"},
-	{"Onboard MIC", NULL, "MIC2"},
+	{"MIC2", NULL, "Onboard MIC"},
 	{"Onboard MIC", NULL, "PLL Control"},
 };
 
@@ -106,6 +117,16 @@ static int snd_rpi_iqaudio_codec_init(struct snd_soc_pcm_runtime *rtd)
 	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
 	int ret;
 
+	/*
+	 * Disable AUX Jack Pin by default to prevent PLL being enabled at
+	 * startup. This avoids holding the PLL to a fixed SR config for
+	 * subsequent streams.
+	 *
+	 * This pin can still be enabled later, as required by user-space.
+	 */
+	snd_soc_dapm_disable_pin(&rtd->card->dapm, "AUX Jack");
+	snd_soc_dapm_sync(&rtd->card->dapm);
+
 	/* Set bclk ratio to align with codec's BCLK rate */
 	ret = snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
 	if (ret) {
@@ -168,6 +189,8 @@ static struct snd_soc_card snd_rpi_iqaudio_codec = {
 	.owner			= THIS_MODULE,
 	.dai_link		= snd_rpi_iqaudio_codec_dai,
 	.num_links		= ARRAY_SIZE(snd_rpi_iqaudio_codec_dai),
+	.controls		= dapm_controls,
+	.num_controls		= ARRAY_SIZE(dapm_controls),
 	.dapm_widgets		= dapm_widgets,
 	.num_dapm_widgets	= ARRAY_SIZE(dapm_widgets),
 	.dapm_routes		= audio_map,
@@ -204,7 +227,7 @@ static int snd_rpi_iqaudio_codec_probe(struct platform_device *pdev)
 
 		if (of_property_read_string(pdev->dev.of_node,
 					"dai_stream_name", &dai->stream_name))
-			dai->stream_name = "IQaudIO CODEC HiFi v1.1";
+			dai->stream_name = "IQaudIO CODEC HiFi v1.2";
 
 	}
 
-- 
GitLab


From f41f870c3cf38e766961131e3a79bcb7845a8d55 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 10 May 2019 14:11:58 +0100
Subject: [PATCH 0523/1835] staging: bcm2835-codec: Convert V4L2 nsec
 timestamps to MMAL usec

V4L2 uses nsecs, whilst MMAL uses usecs, but the code wasn't converting
between them. This upsets video encode rate control.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c     | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 22588f78287e5..5c7fc39cd9218 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -823,7 +823,8 @@ static void op_buffer_cb(struct vchiq_mmal_instance *instance,
 		vb2->flags |= V4L2_BUF_FLAG_LAST;
 	}
 
-	vb2->vb2_buf.timestamp = mmal_buf->pts;
+	/* vb2 timestamps in nsecs, mmal in usecs */
+	vb2->vb2_buf.timestamp = mmal_buf->pts * 1000;
 
 	vb2_set_plane_payload(&vb2->vb2_buf, 0, mmal_buf->length);
 	if (mmal_buf->mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
@@ -847,6 +848,7 @@ static void op_buffer_cb(struct vchiq_mmal_instance *instance,
 static void vb2_to_mmal_buffer(struct m2m_mmal_buffer *buf,
 			       struct vb2_v4l2_buffer *vb2)
 {
+	u64 pts;
 	buf->mmal.mmal_flags = 0;
 	if (vb2->flags & V4L2_BUF_FLAG_KEYFRAME)
 		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_KEYFRAME;
@@ -869,7 +871,10 @@ static void vb2_to_mmal_buffer(struct m2m_mmal_buffer *buf,
 	if (!buf->mmal.length || vb2->flags & V4L2_BUF_FLAG_LAST)
 		buf->mmal.mmal_flags |= MMAL_BUFFER_HEADER_FLAG_EOS;
 
-	buf->mmal.pts = vb2->vb2_buf.timestamp;
+	/* vb2 timestamps in nsecs, mmal in usecs */
+	pts = vb2->vb2_buf.timestamp;
+	do_div(pts, 1000);
+	buf->mmal.pts = pts;
 	buf->mmal.dts = MMAL_TIME_UNKNOWN;
 }
 
-- 
GitLab


From 16a9ad722bd6dce2e90db11b3cc4d8306d698706 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 10 May 2019 14:13:11 +0100
Subject: [PATCH 0524/1835] staging: bcm2835-codec: Add support for setting
 S_PARM and G_PARM

Video encode can use the frame rate for rate control calculations,
therefore plumb it through from V4L2's [S|G]_PARM ioctl.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 52 +++++++++++++++++--
 1 file changed, 48 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 5c7fc39cd9218..708f76b7aa92b 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -447,6 +447,8 @@ struct bcm2835_codec_ctx {
 	/* Source and destination queue data */
 	struct bcm2835_codec_q_data   q_data[2];
 	s32  bitrate;
+	unsigned int	framerate_num;
+	unsigned int	framerate_denom;
 
 	bool aborting;
 	int num_ip_buffers;
@@ -610,8 +612,8 @@ static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
 		port->es.video.height = q_data->height;
 		port->es.video.crop.width = q_data->crop_width;
 		port->es.video.crop.height = q_data->crop_height;
-		port->es.video.frame_rate.num = 0;
-		port->es.video.frame_rate.den = 1;
+		port->es.video.frame_rate.num = ctx->framerate_num;
+		port->es.video.frame_rate.den = ctx->framerate_denom;
 	} else {
 		/* Compressed format - leave resolution as 0 for decode */
 		if (ctx->dev->role == DECODE) {
@@ -625,9 +627,9 @@ static void setup_mmal_port_format(struct bcm2835_codec_ctx *ctx,
 			port->es.video.crop.width = q_data->crop_width;
 			port->es.video.crop.height = q_data->crop_height;
 			port->format.bitrate = ctx->bitrate;
+			port->es.video.frame_rate.num = ctx->framerate_num;
+			port->es.video.frame_rate.den = ctx->framerate_denom;
 		}
-		port->es.video.frame_rate.num = 0;
-		port->es.video.frame_rate.den = 1;
 	}
 	port->es.video.crop.x = 0;
 	port->es.video.crop.y = 0;
@@ -1361,6 +1363,41 @@ static int vidioc_s_selection(struct file *file, void *priv,
 	return 0;
 }
 
+static int vidioc_s_parm(struct file *file, void *priv,
+			 struct v4l2_streamparm *parm)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+		return -EINVAL;
+
+	ctx->framerate_num =
+			parm->parm.output.timeperframe.denominator;
+	ctx->framerate_denom =
+			parm->parm.output.timeperframe.numerator;
+
+	parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+
+	return 0;
+}
+
+static int vidioc_g_parm(struct file *file, void *priv,
+			 struct v4l2_streamparm *parm)
+{
+	struct bcm2835_codec_ctx *ctx = file2ctx(file);
+
+	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+		return -EINVAL;
+
+	parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+	parm->parm.output.timeperframe.denominator =
+			ctx->framerate_num;
+	parm->parm.output.timeperframe.numerator =
+			ctx->framerate_denom;
+
+	return 0;
+}
+
 static int vidioc_subscribe_evt(struct v4l2_fh *fh,
 				const struct v4l2_event_subscription *sub)
 {
@@ -1725,6 +1762,9 @@ static const struct v4l2_ioctl_ops bcm2835_codec_ioctl_ops = {
 	.vidioc_g_selection	= vidioc_g_selection,
 	.vidioc_s_selection	= vidioc_s_selection,
 
+	.vidioc_g_parm		= vidioc_g_parm,
+	.vidioc_s_parm		= vidioc_s_parm,
+
 	.vidioc_subscribe_event = vidioc_subscribe_evt,
 	.vidioc_unsubscribe_event = v4l2_event_unsubscribe,
 
@@ -2546,6 +2586,8 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 	case DECODE:
 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
+		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
 		video_nr = decode_video_nr;
 		break;
 	case ENCODE:
@@ -2558,6 +2600,8 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
+		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
+		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
 		video_nr = isp_video_nr;
 		break;
 	default:
-- 
GitLab


From 9e064a15633a1e07b959e09af4d9d2df3dd0d450 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 12 Jun 2019 17:15:05 +0100
Subject: [PATCH 0525/1835] w1: w1-gpio: Make GPIO an output for strong pullup

The logic to drive the data line high to implement a strong pullup
assumed that the pin was already an output - setting a value does
not change an input.

See: https://github.com/raspberrypi/firmware/issues/1143

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/w1/masters/w1-gpio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
index 55e11bf8ebaf3..6327c88cfcc3b 100644
--- a/drivers/w1/masters/w1-gpio.c
+++ b/drivers/w1/masters/w1-gpio.c
@@ -33,7 +33,7 @@ static u8 w1_gpio_set_pullup(void *data, int delay)
 			 * This will OVERRIDE open drain emulation and force-pull
 			 * the line high for some time.
 			 */
-			gpiod_set_raw_value(pdata->gpiod, 1);
+			gpiod_direction_output_raw(pdata->gpiod, 1);
 			msleep(pdata->pullup_duration);
 			/*
 			 * This will simply set the line as input since we are doing
-- 
GitLab


From f5645ab99474f9800e41544113333d5a7970b9d7 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 12 Jun 2019 17:32:11 +0100
Subject: [PATCH 0526/1835] overlays: Update w1-gpio and w1-gpio-pullup

The parasitic power (power on data) feature is now enabled by
default in the w1-gpio driver, so update the README and make the
"pullup" parameter a no-op.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README                     | 9 ++-------
 arch/arm/boot/dts/overlays/w1-gpio-overlay.dts        | 3 +--
 arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts | 3 +--
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 42265637df370..c1863277cafbd 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -2261,9 +2261,7 @@ Info:   Configures the w1-gpio Onewire interface module.
         Use this overlay if you *don't* need a GPIO to drive an external pullup.
 Load:   dtoverlay=w1-gpio,<param>=<val>
 Params: gpiopin                 GPIO for I/O (default "4")
-
-        pullup                  Non-zero, "on", or "y" to enable the parasitic
-                                power (2-wire, power-on-data) feature
+        pullup                  Now enabled by default (ignored)
 
 
 Name:   w1-gpio-pullup
@@ -2271,11 +2269,8 @@ Info:   Configures the w1-gpio Onewire interface module.
         Use this overlay if you *do* need a GPIO to drive an external pullup.
 Load:   dtoverlay=w1-gpio-pullup,<param>=<val>
 Params: gpiopin                 GPIO for I/O (default "4")
-
-        pullup                  Non-zero, "on", or "y" to enable the parasitic
-                                power (2-wire, power-on-data) feature
-
         extpullup               GPIO for external pullup (default "5")
+        pullup                  Now enabled by default (ignored)
 
 
 Name:   wittypi
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
index 59543d69217ea..f44e325bc1f2e 100644
--- a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
@@ -14,7 +14,6 @@
 				pinctrl-names = "default";
 				pinctrl-0 = <&w1_pins>;
 				gpios = <&gpio 4 0>;
-				rpi,parasitic-power = <0>;
 				status = "okay";
 			};
 		};
@@ -36,6 +35,6 @@
 				<&w1>,"reg:0",
 				<&w1_pins>,"brcm,pins:0",
 				<&w1_pins>,"reg:0";
-		pullup =        <&w1>,"rpi,parasitic-power:0";
+		pullup;		// Silently ignore unneeded parameter
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
index 000cf0150e43b..953c6a1aeab97 100644
--- a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
+++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
@@ -14,7 +14,6 @@
 				pinctrl-names = "default";
 				pinctrl-0 = <&w1_pins>;
 				gpios = <&gpio 4 0>, <&gpio 5 1>;
-				rpi,parasitic-power = <0>;
 				status = "okay";
 			};
 		};
@@ -38,6 +37,6 @@
 				<&w1_pins>,"reg:0";
 		extpullup =     <&w1>,"gpios:16",
 				<&w1_pins>,"brcm,pins:4";
-		pullup =        <&w1>,"rpi,parasitic-power:0";
+		pullup;		// Silently ignore unneeded parameter
 	};
 };
-- 
GitLab


From 5040b4b78e4cb74a6364d9a7c6cca0385e2dffd8 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 12 Jun 2019 20:45:17 +0100
Subject: [PATCH 0527/1835] bcm2835-sdhost: Fix DMA channel leak on
 error/remove

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/bcm2835-sdhost.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
index d43af85135d30..844bed552baec 100644
--- a/drivers/mmc/host/bcm2835-sdhost.c
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -2154,6 +2154,8 @@ static int bcm2835_sdhost_probe(struct platform_device *pdev)
 
 err:
 	pr_debug("bcm2835_sdhost_probe -> err %d\n", ret);
+	if (host->dma_chan_rxtx)
+		dma_release_channel(host->dma_chan_rxtx);
 	mmc_free_host(mmc);
 
 	return ret;
@@ -2174,7 +2176,8 @@ static int bcm2835_sdhost_remove(struct platform_device *pdev)
 	del_timer_sync(&host->timer);
 
 	tasklet_kill(&host->finish_tasklet);
-
+	if (host->dma_chan_rxtx)
+		dma_release_channel(host->dma_chan_rxtx);
 	mmc_free_host(host->mmc);
 	platform_set_drvdata(pdev, NULL);
 
-- 
GitLab


From 2f8d963db206ce596f9a9e951ec425e9c3e1b4d9 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Sat, 8 Jun 2019 10:14:43 -0700
Subject: [PATCH 0528/1835] i2c: bcm2835: Model Divider in CCF

Commit bebff81fb8b9216eb4fba22cf910553621ae3477 upstream.

Model the I2C bus clock divider as a part of the Core Clock Framework.
Primarily this removes the clk_get_rate() call from each transfer.
This call causes problems for slave drivers that themselves have
internal clock components that are controlled by an I2C interface.
When the slave's internal clock component is prepared, the prepare
lock is obtained, and it makes calls to the I2C subsystem to
command the hardware to activate the clock.  In order to perform
the I2C transfer, this driver sets the divider, which requires
it to get the parent clock rate, which it does with clk_get_rate().
Unfortunately, this function will try to take the clock prepare
lock, which is already held by the slave's internal clock calls
creating a deadlock.

Modeling the divider in the CCF natively removes this dependency
and the divider value is only set upon changing the bus clock
frequency or changes in the parent clock that cascade down to this
divisor.  This obviates the need to set the divider with every
transfer and avoids the deadlock described above.  It also should
provide better clock debugging and save a few cycles on each
transfer due to not having to recalcuate the divider value.

Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
---
 drivers/i2c/busses/i2c-bcm2835.c | 145 ++++++++++++++++++++++++-------
 1 file changed, 114 insertions(+), 31 deletions(-)

diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index 1426dab2670bf..108d2ae4632c8 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -12,6 +12,8 @@
  */
 
 #include <linux/clk.h>
+#include <linux/clkdev.h>
+#include <linux/clk-provider.h>
 #include <linux/completion.h>
 #include <linux/err.h>
 #include <linux/i2c.h>
@@ -71,9 +73,7 @@ struct bcm2835_debug {
 struct bcm2835_i2c_dev {
 	struct device *dev;
 	void __iomem *regs;
-	struct clk *clk;
 	int irq;
-	u32 bus_clk_rate;
 	struct i2c_adapter adapter;
 	struct completion completion;
 	struct i2c_msg *curr_msg;
@@ -164,12 +164,17 @@ static inline u32 bcm2835_i2c_readl(struct bcm2835_i2c_dev *i2c_dev, u32 reg)
 	return readl(i2c_dev->regs + reg);
 }
 
-static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
+#define to_clk_bcm2835_i2c(_hw) container_of(_hw, struct clk_bcm2835_i2c, hw)
+struct clk_bcm2835_i2c {
+	struct clk_hw hw;
+	struct bcm2835_i2c_dev *i2c_dev;
+};
+
+static int clk_bcm2835_i2c_calc_divider(unsigned long rate,
+				unsigned long parent_rate)
 {
-	u32 divider, redl, fedl;
+	u32 divider = DIV_ROUND_UP(parent_rate, rate);
 
-	divider = DIV_ROUND_UP(clk_get_rate(i2c_dev->clk),
-			       i2c_dev->bus_clk_rate);
 	/*
 	 * Per the datasheet, the register is always interpreted as an even
 	 * number, by rounding down. In other words, the LSB is ignored. So,
@@ -178,12 +183,23 @@ static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
 	if (divider & 1)
 		divider++;
 	if ((divider < BCM2835_I2C_CDIV_MIN) ||
-	    (divider > BCM2835_I2C_CDIV_MAX)) {
-		dev_err_ratelimited(i2c_dev->dev, "Invalid clock-frequency\n");
+	    (divider > BCM2835_I2C_CDIV_MAX))
 		return -EINVAL;
-	}
 
-	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DIV, divider);
+	return divider;
+}
+
+static int clk_bcm2835_i2c_set_rate(struct clk_hw *hw, unsigned long rate,
+				unsigned long parent_rate)
+{
+	struct clk_bcm2835_i2c *div = to_clk_bcm2835_i2c(hw);
+	u32 redl, fedl;
+	u32 divider = clk_bcm2835_i2c_calc_divider(rate, parent_rate);
+
+	if (divider == -EINVAL)
+		return -EINVAL;
+
+	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_DIV, divider);
 
 	/*
 	 * Number of core clocks to wait after falling edge before
@@ -198,12 +214,62 @@ static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
 	 */
 	redl = max(divider / 4, 1u);
 
-	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DEL,
+	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_DEL,
 			   (fedl << BCM2835_I2C_FEDL_SHIFT) |
 			   (redl << BCM2835_I2C_REDL_SHIFT));
 	return 0;
 }
 
+static long clk_bcm2835_i2c_round_rate(struct clk_hw *hw, unsigned long rate,
+				unsigned long *parent_rate)
+{
+	u32 divider = clk_bcm2835_i2c_calc_divider(rate, *parent_rate);
+
+	return DIV_ROUND_UP(*parent_rate, divider);
+}
+
+static unsigned long clk_bcm2835_i2c_recalc_rate(struct clk_hw *hw,
+						unsigned long parent_rate)
+{
+	struct clk_bcm2835_i2c *div = to_clk_bcm2835_i2c(hw);
+	u32 divider = bcm2835_i2c_readl(div->i2c_dev, BCM2835_I2C_DIV);
+
+	return DIV_ROUND_UP(parent_rate, divider);
+}
+
+static const struct clk_ops clk_bcm2835_i2c_ops = {
+	.set_rate = clk_bcm2835_i2c_set_rate,
+	.round_rate = clk_bcm2835_i2c_round_rate,
+	.recalc_rate = clk_bcm2835_i2c_recalc_rate,
+};
+
+static struct clk *bcm2835_i2c_register_div(struct device *dev,
+					const char *mclk_name,
+					struct bcm2835_i2c_dev *i2c_dev)
+{
+	struct clk_init_data init;
+	struct clk_bcm2835_i2c *priv;
+	char name[32];
+
+	snprintf(name, sizeof(name), "%s_div", dev_name(dev));
+
+	init.ops = &clk_bcm2835_i2c_ops;
+	init.name = name;
+	init.parent_names = (const char* []) { mclk_name };
+	init.num_parents = 1;
+	init.flags = 0;
+
+	priv = devm_kzalloc(dev, sizeof(struct clk_bcm2835_i2c), GFP_KERNEL);
+	if (priv == NULL)
+		return ERR_PTR(-ENOMEM);
+
+	priv->hw.init = &init;
+	priv->i2c_dev = i2c_dev;
+
+	clk_hw_register_clkdev(&priv->hw, "div", dev_name(dev));
+	return devm_clk_register(dev, &priv->hw);
+}
+
 static void bcm2835_fill_txfifo(struct bcm2835_i2c_dev *i2c_dev)
 {
 	u32 val;
@@ -363,7 +429,7 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 {
 	struct bcm2835_i2c_dev *i2c_dev = i2c_get_adapdata(adap);
 	unsigned long time_left;
-	int i, ret;
+	int i;
 
 	if (debug)
 		i2c_dev->debug_num_msgs = num;
@@ -379,10 +445,6 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 			return -EOPNOTSUPP;
 		}
 
-	ret = bcm2835_i2c_set_divider(i2c_dev);
-	if (ret)
-		return ret;
-
 	i2c_dev->curr_msg = msgs;
 	i2c_dev->num_msgs = num;
 	reinit_completion(&i2c_dev->completion);
@@ -443,6 +505,9 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 	struct resource *mem, *irq;
 	int ret;
 	struct i2c_adapter *adap;
+	const char *mclk_name;
+	struct clk *bus_clk;
+	u32 bus_clk_rate;
 
 	i2c_dev = devm_kzalloc(&pdev->dev, sizeof(*i2c_dev), GFP_KERNEL);
 	if (!i2c_dev)
@@ -456,21 +521,6 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 	if (IS_ERR(i2c_dev->regs))
 		return PTR_ERR(i2c_dev->regs);
 
-	i2c_dev->clk = devm_clk_get(&pdev->dev, NULL);
-	if (IS_ERR(i2c_dev->clk)) {
-		if (PTR_ERR(i2c_dev->clk) != -EPROBE_DEFER)
-			dev_err(&pdev->dev, "Could not get clock\n");
-		return PTR_ERR(i2c_dev->clk);
-	}
-
-	ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",
-				   &i2c_dev->bus_clk_rate);
-	if (ret < 0) {
-		dev_warn(&pdev->dev,
-			 "Could not read clock-frequency property\n");
-		i2c_dev->bus_clk_rate = 100000;
-	}
-
 	irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
 	if (!irq) {
 		dev_err(&pdev->dev, "No IRQ resource\n");
@@ -485,6 +535,35 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
+	mclk_name = of_clk_get_parent_name(pdev->dev.of_node, 0);
+
+	bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk_name, i2c_dev);
+
+	if (IS_ERR(bus_clk)) {
+		dev_err(&pdev->dev, "Could not register clock\n");
+		return PTR_ERR(bus_clk);
+	}
+
+	ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",
+				   &bus_clk_rate);
+	if (ret < 0) {
+		dev_warn(&pdev->dev,
+			 "Could not read clock-frequency property\n");
+		bus_clk_rate = 100000;
+	}
+
+	ret = clk_set_rate_exclusive(bus_clk, bus_clk_rate);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Could not set clock frequency\n");
+		return ret;
+	}
+
+	ret = clk_prepare_enable(bus_clk);
+	if (ret) {
+		dev_err(&pdev->dev, "Couldn't prepare clock");
+		return ret;
+	}
+
 	adap = &i2c_dev->adapter;
 	i2c_set_adapdata(adap, i2c_dev);
 	adap->owner = THIS_MODULE;
@@ -507,6 +586,10 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 static int bcm2835_i2c_remove(struct platform_device *pdev)
 {
 	struct bcm2835_i2c_dev *i2c_dev = platform_get_drvdata(pdev);
+	struct clk *bus_clk = devm_clk_get(i2c_dev->dev, "div");
+
+	clk_rate_exclusive_put(bus_clk);
+	clk_disable_unprepare(bus_clk);
 
 	free_irq(i2c_dev->irq, i2c_dev);
 	i2c_del_adapter(&i2c_dev->adapter);
-- 
GitLab


From 277acd3db0cf7adebacd13c965a92f9d9ed86713 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 17 Sep 2018 09:22:21 +0100
Subject: [PATCH 0529/1835] staging/vc04_services: Use correct cache line size

Use the compatible string in the DTB to select the correct cache line
size for the SoC - 32 for BCM2835, and 64 for BCM2836 and BCM2837.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../interface/vchiq_arm/vchiq_2835_arm.c      | 15 ++------
 .../interface/vchiq_arm/vchiq_arm.c           | 35 +++++++++++++------
 .../interface/vchiq_arm/vchiq_arm.h           |  5 +++
 3 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 85e881e454b41..7694a4fc7cac9 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -117,7 +117,8 @@ free_pagelist(struct vchiq_pagelist_info *pagelistinfo,
 int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 {
 	struct device *dev = &pdev->dev;
-	struct rpi_firmware *fw = platform_get_drvdata(pdev);
+	struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
+	struct rpi_firmware *fw = drvdata->fw;
 	VCHIQ_SLOT_ZERO_T *vchiq_slot_zero;
 	struct resource *res;
 	void *slot_mem;
@@ -135,17 +136,7 @@ int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 	if (err < 0)
 		return err;
 
-	/*
-	 * The tempting L1_CACHE_BYTES macro doesn't work in the case of
-	 * a kernel built with bcm2835_defconfig running on a BCM2836/7
-	 * processor, hence the need for a runtime check. The dcache line size
-	 * is encoded in one of the coprocessor registers, but there is no
-	 * convenient way to access it short of embedded assembler, hence
-	 * the use of read_cpuid_id(). The following test evaluates to true
-	 * on a BCM2835 showing that it is ARMv6-ish, whereas
-	 * cpu_architecture() will indicate that it is an ARMv7.
-	 */
-	g_cache_line_size = ((read_cpuid_id() & 0x7f000) == 0x7b000) ? 32 : 64;
+	g_cache_line_size = drvdata->cache_line_size;
 	g_fragments_size = 2 * g_cache_line_size;
 
 	/* Allocate space for the channels in coherent memory */
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index b955fe7915a81..a38b4a8b14c6d 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -173,6 +173,14 @@ static struct platform_device *bcm2835_camera;
 static struct platform_device *bcm2835_codec;
 static struct platform_device *vcsm_cma;
 
+static struct vchiq_drvdata bcm2835_drvdata = {
+	.cache_line_size = 32,
+};
+
+static struct vchiq_drvdata bcm2836_drvdata = {
+	.cache_line_size = 64,
+};
+
 static const char *const ioctl_names[] = {
 	"CONNECT",
 	"SHUTDOWN",
@@ -3607,12 +3615,25 @@ vchiq_register_child(struct platform_device *pdev, const char *name)
 	return new_dev;
 }
 
+static const struct of_device_id vchiq_of_match[] = {
+	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_drvdata },
+	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_drvdata },
+	{},
+};
+MODULE_DEVICE_TABLE(of, vchiq_of_match);
+
 static int vchiq_probe(struct platform_device *pdev)
 {
 	struct device_node *fw_node;
-	struct rpi_firmware *fw;
+	const struct of_device_id *of_id;
+	struct vchiq_drvdata *drvdata;
 	int err;
 
+	of_id = of_match_node(vchiq_of_match, pdev->dev.of_node);
+	drvdata = (struct vchiq_drvdata *)of_id->data;
+	if (!drvdata)
+		return -EINVAL;
+
 	fw_node = of_find_compatible_node(NULL, NULL,
 					  "raspberrypi,bcm2835-firmware");
 	if (!fw_node) {
@@ -3620,12 +3641,12 @@ static int vchiq_probe(struct platform_device *pdev)
 		return -ENOENT;
 	}
 
-	fw = rpi_firmware_get(fw_node);
+	drvdata->fw = rpi_firmware_get(fw_node);
 	of_node_put(fw_node);
-	if (!fw)
+	if (!drvdata->fw)
 		return -EPROBE_DEFER;
 
-	platform_set_drvdata(pdev, fw);
+	platform_set_drvdata(pdev, drvdata);
 
 	err = vchiq_platform_init(pdev, &g_state);
 	if (err != 0)
@@ -3703,12 +3724,6 @@ static int vchiq_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static const struct of_device_id vchiq_of_match[] = {
-	{ .compatible = "brcm,bcm2835-vchiq", },
-	{},
-};
-MODULE_DEVICE_TABLE(of, vchiq_of_match);
-
 static struct platform_driver vchiq_driver = {
 	.driver = {
 		.name = "bcm2835_vchiq",
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
index 40bb0c63b1a9d..2f3ebc99cbcfd 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
@@ -123,6 +123,11 @@ typedef struct vchiq_arm_state_struct {
 
 } VCHIQ_ARM_STATE_T;
 
+struct vchiq_drvdata {
+	const unsigned int cache_line_size;
+	struct rpi_firmware *fw;
+};
+
 extern int vchiq_arm_log_level;
 extern int vchiq_susp_log_level;
 
-- 
GitLab


From f86ed460ad9827b247298e2cf1d271027fcba0a0 Mon Sep 17 00:00:00 2001
From: Doug Berger <opendmb@gmail.com>
Date: Mon, 13 May 2019 20:59:45 +0200
Subject: [PATCH 0530/1835] tty: amba-pl011: allow shared interrupt

The PL011 register space includes all necessary status bits to
determine whether a device instance requires handling in response
to an interrupt. Therefore, multiple instances of the device could
be serviced by a single shared interrupt, which is the case on BCM7211.

Signed-off-by: Doug Berger <opendmb@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
 drivers/tty/serial/amba-pl011.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 6f15f32fa1942..1121df572ca6d 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1735,7 +1735,8 @@ static int pl011_allocate_irq(struct uart_amba_port *uap)
 {
 	pl011_write(uap->im, uap, REG_IMSC);
 
-	return request_irq(uap->port.irq, pl011_int, 0, "uart-pl011", uap);
+	return request_irq(uap->port.irq, pl011_int, IRQF_SHARED, "uart-pl011",
+			   uap);
 }
 
 /*
-- 
GitLab


From a29a9c8067beb1cb7dbed5f25ac81458e62142f4 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Sun, 19 May 2019 12:20:00 +0200
Subject: [PATCH 0531/1835] ARM: bcm283x: Reduce register ranges for UART, SPI
 and I2C

The assigned register ranges for UART, SPI and I2C were too wasteful.
In order to avoid overlapping with the new functions on BCM2838
reduce the ranges.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 arch/arm/boot/dts/bcm283x.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 1b53339a1c57d..ded463cec30c7 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -387,7 +387,7 @@
 
 		uart0: serial@7e201000 {
 			compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell";
-			reg = <0x7e201000 0x1000>;
+			reg = <0x7e201000 0x200>;
 			interrupts = <2 25>;
 			clocks = <&clocks BCM2835_CLOCK_UART>,
 				 <&clocks BCM2835_CLOCK_VPU>;
@@ -418,7 +418,7 @@
 
 		spi: spi@7e204000 {
 			compatible = "brcm,bcm2835-spi";
-			reg = <0x7e204000 0x1000>;
+			reg = <0x7e204000 0x200>;
 			interrupts = <2 22>;
 			clocks = <&clocks BCM2835_CLOCK_VPU>;
 			#address-cells = <1>;
@@ -428,7 +428,7 @@
 
 		i2c0: i2c@7e205000 {
 			compatible = "brcm,bcm2835-i2c";
-			reg = <0x7e205000 0x1000>;
+			reg = <0x7e205000 0x200>;
 			interrupts = <2 21>;
 			clocks = <&clocks BCM2835_CLOCK_VPU>;
 			#address-cells = <1>;
-- 
GitLab


From c373e88e0a64ce7de6ca250c3d32c0850d0b016c Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 12 Dec 2018 15:51:49 -0800
Subject: [PATCH 0532/1835] ARM: bcm283x: Extend the WDT DT node out to cover
 the whole PM block. (v4)

It was covering part of the PM block's range, up to the WDT regs.  To
support the rest of the PM block's functionality, we need the full
register range plus the AXI Async Bridge regs for PM sequencing.

This doesn't convert any of the consumers over to the new binding yet,
since we will need to be careful in coordinating our usage of firmware
services that might power domains on and off versus the bcm2835-pm
driver's access of those same domains.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
(cherry picked from commit 29abc92c1d93e28a8f4d55e6343eec4faf44025a)
---
 arch/arm/boot/dts/bcm283x.dtsi | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index ded463cec30c7..334c0dffc450e 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -121,8 +121,17 @@
 		};
 
 		watchdog@7e100000 {
-			compatible = "brcm,bcm2835-pm-wdt";
-			reg = <0x7e100000 0x28>;
+			compatible = "brcm,bcm2835-pm", "brcm,bcm2835-pm-wdt";
+			#power-domain-cells = <1>;
+			#reset-cells = <1>;
+			reg = <0x7e100000 0x114>,
+			      <0x7e00a000 0x24>;
+			clocks = <&clocks BCM2835_CLOCK_V3D>,
+				 <&clocks BCM2835_CLOCK_PERI_IMAGE>,
+				 <&clocks BCM2835_CLOCK_H264>,
+				 <&clocks BCM2835_CLOCK_ISP>;
+			clock-names = "v3d", "peri_image", "h264", "isp";
+			system-power-controller;
 		};
 
 		clocks: cprman@7e101000 {
-- 
GitLab


From 76313dda813c29e6f185b63338a499b63401ffbc Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Sat, 4 May 2019 17:06:54 +0200
Subject: [PATCH 0533/1835] ARM: dts: Add label to bcm2835 RNG

---
 arch/arm/boot/dts/bcm283x.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 334c0dffc450e..65f666e41fa7a 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -148,7 +148,7 @@
 				<&dsi1 0>, <&dsi1 1>, <&dsi1 2>;
 		};
 
-		rng@7e104000 {
+		rng: rng@7e104000 {
 			compatible = "brcm,bcm2835-rng";
 			reg = <0x7e104000 0x10>;
 			interrupts = <2 29>;
-- 
GitLab


From ac938a20520a9e80899c13c695660c7fdf50cfaa Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Thu, 12 Oct 2017 18:11:32 +0100
Subject: [PATCH 0534/1835] dts: Use fb rather than leds for dpi overlay

---
 arch/arm/boot/dts/overlays/dpi18-overlay.dts | 2 +-
 arch/arm/boot/dts/overlays/dpi24-overlay.dts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
index 64dc2dd42150a..4bf5ef8327476 100644
--- a/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
@@ -9,7 +9,7 @@
 	// reference on - leds will do
 
 	fragment@0 {
-		target = <&leds>;
+		target = <&fb>;
 		__overlay__ {
 			pinctrl-names = "default";
 			pinctrl-0 = <&dpi18_pins>;
diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
index 6021bc33b5af0..d5f7c3f58890b 100644
--- a/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
@@ -9,7 +9,7 @@
 	// reference on - leds will do
 
 	fragment@0 {
-		target = <&leds>;
+		target = <&fb>;
 		__overlay__ {
 			pinctrl-names = "default";
 			pinctrl-0 = <&dpi24_pins>;
-- 
GitLab


From 711cca4250649d13fd805fa9025c3377f957b0bc Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 29 May 2019 15:19:21 +0100
Subject: [PATCH 0535/1835] BCM270X_DT: Minor tidy up

Move arm_pmu out of soc on bcm2710, and labels aren't aliases.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm270x.dtsi | 14 +++++++-------
 arch/arm/boot/dts/bcm2710.dtsi | 13 +++++--------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index 86f3eb2d3f48d..3b6c101dcd916 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -10,11 +10,11 @@
 	soc: soc {
 
 		watchdog: watchdog@7e100000 {
-			/* Add alias */
+			/* Add label */
 		};
 
 		random: rng@7e104000 {
-			/* Add alias */
+			/* Add label */
 		};
 
 		gpio@7e200000 { /* gpio */
@@ -40,18 +40,18 @@
 		};
 
 		spi0: spi@7e204000 {
-			/* Add alias */
+			/* Add label */
 			dmas = <&dma 6>, <&dma 7>;
 			dma-names = "tx", "rx";
 		};
 
 		pixelvalve0: pixelvalve@7e206000 {
-			/* Add alias */
+			/* Add label */
 			status = "disabled";
 		};
 
 		pixelvalve1: pixelvalve@7e207000 {
-			/* Add alias */
+			/* Add label */
 			status = "disabled";
 		};
 
@@ -93,7 +93,7 @@
 		};
 
 		hvs: hvs@7e400000 {
-			/* Add alias */
+			/* Add label */
 			status = "disabled";
 		};
 
@@ -119,7 +119,7 @@
 		};
 
 		pixelvalve2: pixelvalve@7e807000 {
-			/* Add alias */
+			/* Add label */
 			status = "disabled";
 		};
 
diff --git a/arch/arm/boot/dts/bcm2710.dtsi b/arch/arm/boot/dts/bcm2710.dtsi
index 56d58f588203c..7628ca59f0286 100644
--- a/arch/arm/boot/dts/bcm2710.dtsi
+++ b/arch/arm/boot/dts/bcm2710.dtsi
@@ -5,18 +5,15 @@
 / {
 	compatible = "brcm,bcm2837", "brcm,bcm2836";
 
-	soc {
-
-		arm-pmu {
+	arm-pmu {
 #ifdef RPI364
-			compatible = "arm,armv8-pmuv3", "arm,cortex-a7-pmu";
+		compatible = "arm,armv8-pmuv3", "arm,cortex-a7-pmu";
 #else
-			compatible = "arm,cortex-a7-pmu";
+		compatible = "arm,cortex-a7-pmu";
 #endif
-			interrupt-parent = <&local_intc>;
-			interrupts = <9 IRQ_TYPE_LEVEL_HIGH>;
-		};
+	};
 
+	soc {
 		/delete-node/ timer@7e003000;
 	};
 
-- 
GitLab


From c528b0bc35cbf689c72bcb1386ab84a853d02957 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 20 Feb 2019 08:49:39 +0000
Subject: [PATCH 0536/1835] arm: bcm2835: Fix FIQ early ioremap

The ioremapping creates mappings within the vmalloc area. The
equivalent early function, create_mapping, now checks that the
requested explicit virtual address is between VMALLOC_START and
VMALLOC_END. As there is no reason to have any correlation between
the physical and virtual addresses, put the required mappings at
VMALLOC_START and above.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/mach-bcm/board_bcm2835.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/arch/arm/mach-bcm/board_bcm2835.c b/arch/arm/mach-bcm/board_bcm2835.c
index 28db892e3af4c..db426d73d9632 100644
--- a/arch/arm/mach-bcm/board_bcm2835.c
+++ b/arch/arm/mach-bcm/board_bcm2835.c
@@ -14,17 +14,20 @@
 
 #include <linux/init.h>
 #include <linux/irqchip.h>
+#include <linux/mm.h>
 #include <linux/of_address.h>
 #include <linux/of_fdt.h>
 #include <asm/system_info.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
+#include <asm/memory.h>
+#include <asm/pgtable.h>
 
 #include "platsmp.h"
 
-#define BCM2835_USB_VIRT_BASE   0xf0980000
-#define BCM2835_USB_VIRT_MPHI   0xf0006000
+#define BCM2835_USB_VIRT_BASE   (VMALLOC_START)
+#define BCM2835_USB_VIRT_MPHI   (VMALLOC_START + 0x10000)
 
 static void __init bcm2835_init(void)
 {
@@ -83,20 +86,26 @@ static int __init bcm2835_map_usb(unsigned long node, const char *uname,
 
 static void __init bcm2835_map_io(void)
 {
-	const __be32 *ranges;
+	const __be32 *ranges, *address_cells;
+	unsigned long root, addr_cells;
 	int soc, len;
 	unsigned long p2b_offset;
 
 	debug_ll_io_init();
 
+	root = of_get_flat_dt_root();
 	/* Find out how to map bus to physical address first from soc/ranges */
-	soc = of_get_flat_dt_subnode_by_name(of_get_flat_dt_root(), "soc");
+	soc = of_get_flat_dt_subnode_by_name(root, "soc");
 	if (soc < 0)
 		return;
+	address_cells = of_get_flat_dt_prop(root, "#address-cells", &len);
+	if (!address_cells || len < (sizeof(unsigned long)))
+		return;
+	addr_cells = be32_to_cpu(address_cells[0]);
 	ranges = of_get_flat_dt_prop(soc, "ranges", &len);
-	if (!ranges || len < (sizeof(unsigned long) * 3))
+	if (!ranges || len < (sizeof(unsigned long) * (2 + addr_cells)))
 		return;
-	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[1]);
+	p2b_offset = be32_to_cpu(ranges[0]) - be32_to_cpu(ranges[addr_cells]);
 
 	/* Now search for bcm2708-usb node in device tree */
 	of_scan_flat_dt(bcm2835_map_usb, &p2b_offset);
-- 
GitLab


From 2e10dde86defb0fdb0126440199b365b7c6ea03f Mon Sep 17 00:00:00 2001
From: Tim Gover <tim.gover@raspberrypi.org>
Date: Thu, 14 Mar 2019 10:16:02 +0000
Subject: [PATCH 0537/1835] Fix copy_from_user if BCM2835_FAST_MEMCPY=n

The change which introduced CONFIG_BCM2835_FAST_MEMCPY unconditionally
changed the behaviour of arm_copy_from_user. The page pinning code
is not safe on ARMv7 if LPAE & high memory is enabled and causes
crashes which look like PTE corruption.

Make __copy_from_user_memcpy conditional on CONFIG_2835_FAST_MEMCPY=y
which is really an ARMv6 / Pi1 optimization and not necessary on newer
ARM processors.
---
 arch/arm/lib/uaccess_with_memcpy.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
index 1ea66521768dd..d4b04afc64115 100644
--- a/arch/arm/lib/uaccess_with_memcpy.c
+++ b/arch/arm/lib/uaccess_with_memcpy.c
@@ -257,6 +257,7 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 unsigned long __must_check
 arm_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+#ifdef CONFIG_BCM2835_FAST_MEMCPY
 	/*
 	 * This test is stubbed out of the main function above to keep
 	 * the overhead for small copies low by avoiding a large
@@ -271,6 +272,11 @@ arm_copy_from_user(void *to, const void __user *from, unsigned long n)
 	} else {
 		n = __copy_from_user_memcpy(to, from, n);
 	}
+#else
+	unsigned long ua_flags = uaccess_save_and_enable();
+	n = __copy_from_user_std(to, from, n);
+	uaccess_restore(ua_flags);
+#endif
 	return n;
 }
 	
-- 
GitLab


From 6e2d13a1a5a0376830b0eec8fab0578d7e9c2058 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 19 Feb 2019 22:06:59 +0000
Subject: [PATCH 0538/1835] PCI: brcmstb: Add Broadcom STB PCIe host controller
 driver

This commit adds the basic Broadcom STB PCIe controller.  Missing is
the ability to process MSI and also handle dma-ranges for inbound
memory accesses.  These two functionalities are added in subsequent
commits.

The PCIe block contains an MDIO interface.  This is a local interface
only accessible by the PCIe controller.  It cannot be used or shared
by any other HW.  As such, the small amount of code for this
controller is included in this driver as there is little upside to put
it elsewhere.

Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
---
 drivers/pci/controller/Kconfig        |    9 +
 drivers/pci/controller/Makefile       |    2 +-
 drivers/pci/controller/pcie-brcmstb.c | 1097 +++++++++++++++++++++++++
 include/soc/brcmstb/memory_api.h      |   25 +
 4 files changed, 1132 insertions(+), 1 deletion(-)
 create mode 100644 drivers/pci/controller/pcie-brcmstb.c
 create mode 100644 include/soc/brcmstb/memory_api.h

diff --git a/drivers/pci/controller/Kconfig b/drivers/pci/controller/Kconfig
index 028b287466fbf..9c47c5be22719 100644
--- a/drivers/pci/controller/Kconfig
+++ b/drivers/pci/controller/Kconfig
@@ -278,5 +278,14 @@ config VMD
 	  To compile this driver as a module, choose M here: the
 	  module will be called vmd.
 
+config PCIE_BRCMSTB
+	tristate "Broadcom Brcmstb PCIe platform host driver"
+	depends on ARCH_BRCMSTB || BMIPS_GENERIC
+	depends on OF
+	depends on SOC_BRCMSTB
+	default ARCH_BRCMSTB || BMIPS_GENERIC
+	help
+	  Adds support for Broadcom Settop Box PCIe host controller.
+
 source "drivers/pci/controller/dwc/Kconfig"
 endmenu
diff --git a/drivers/pci/controller/Makefile b/drivers/pci/controller/Makefile
index d56a507495c5e..582d052a49fb8 100644
--- a/drivers/pci/controller/Makefile
+++ b/drivers/pci/controller/Makefile
@@ -28,11 +28,11 @@ obj-$(CONFIG_PCIE_ROCKCHIP_HOST) += pcie-rockchip-host.o
 obj-$(CONFIG_PCIE_MEDIATEK) += pcie-mediatek.o
 obj-$(CONFIG_PCIE_MOBIVEIL) += pcie-mobiveil.o
 obj-$(CONFIG_PCIE_TANGO_SMP8759) += pcie-tango.o
+obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb.o
 obj-$(CONFIG_VMD) += vmd.o
 # pcie-hisi.o quirks are needed even without CONFIG_PCIE_DW
 obj-y				+= dwc/
 
-
 # The following drivers are for devices that use the generic ACPI
 # pci_root.c driver but don't support standard ECAM config access.
 # They contain MCFG quirks to replace the generic ECAM accessors with
diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
new file mode 100644
index 0000000000000..babef9191e88c
--- /dev/null
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -0,0 +1,1097 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (C) 2009 - 2017 Broadcom */
+
+#include <linux/clk.h>
+#include <linux/compiler.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/irqdomain.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/log2.h>
+#include <linux/module.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/of_pci.h>
+#include <linux/of_platform.h>
+#include <linux/pci.h>
+#include <linux/printk.h>
+#include <linux/sizes.h>
+#include <linux/slab.h>
+#include <soc/brcmstb/memory_api.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include "../pci.h"
+
+/* BRCM_PCIE_CAP_REGS - Offset for the mandatory capability config regs */
+#define BRCM_PCIE_CAP_REGS				0x00ac
+
+/*
+ * Broadcom Settop Box PCIe Register Offsets. The names are from
+ * the chip's RDB and we use them here so that a script can correlate
+ * this code and the RDB to prevent discrepancies.
+ */
+#define PCIE_RC_CFG_VENDOR_VENDOR_SPECIFIC_REG1		0x0188
+#define PCIE_RC_CFG_PRIV1_ID_VAL3			0x043c
+#define PCIE_RC_DL_MDIO_ADDR				0x1100
+#define PCIE_RC_DL_MDIO_WR_DATA				0x1104
+#define PCIE_RC_DL_MDIO_RD_DATA				0x1108
+#define PCIE_MISC_MISC_CTRL				0x4008
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LO		0x400c
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_HI		0x4010
+#define PCIE_MISC_RC_BAR1_CONFIG_LO			0x402c
+#define PCIE_MISC_RC_BAR2_CONFIG_LO			0x4034
+#define PCIE_MISC_RC_BAR2_CONFIG_HI			0x4038
+#define PCIE_MISC_RC_BAR3_CONFIG_LO			0x403c
+#define PCIE_MISC_PCIE_CTRL				0x4064
+#define PCIE_MISC_PCIE_STATUS				0x4068
+#define PCIE_MISC_REVISION				0x406c
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT	0x4070
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_HI		0x4080
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI		0x4084
+#define PCIE_MISC_HARD_PCIE_HARD_DEBUG			0x4204
+#define PCIE_INTR2_CPU_BASE				0x4300
+
+/*
+ * Broadcom Settop Box PCIe Register Field shift and mask info. The
+ * names are from the chip's RDB and we use them here so that a script
+ * can correlate this code and the RDB to prevent discrepancies.
+ */
+#define PCIE_RC_CFG_VENDOR_VENDOR_SPECIFIC_REG1_ENDIAN_MODE_BAR2_MASK	0xc
+#define PCIE_RC_CFG_VENDOR_VENDOR_SPECIFIC_REG1_ENDIAN_MODE_BAR2_SHIFT	0x2
+#define PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK		0xffffff
+#define PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_SHIFT		0x0
+#define PCIE_MISC_MISC_CTRL_SCB_ACCESS_EN_MASK			0x1000
+#define PCIE_MISC_MISC_CTRL_SCB_ACCESS_EN_SHIFT			0xc
+#define PCIE_MISC_MISC_CTRL_CFG_READ_UR_MODE_MASK		0x2000
+#define PCIE_MISC_MISC_CTRL_CFG_READ_UR_MODE_SHIFT		0xd
+#define PCIE_MISC_MISC_CTRL_MAX_BURST_SIZE_MASK			0x300000
+#define PCIE_MISC_MISC_CTRL_MAX_BURST_SIZE_SHIFT		0x14
+#define PCIE_MISC_MISC_CTRL_SCB0_SIZE_MASK			0xf8000000
+#define PCIE_MISC_MISC_CTRL_SCB0_SIZE_SHIFT			0x1b
+#define PCIE_MISC_MISC_CTRL_SCB1_SIZE_MASK			0x7c00000
+#define PCIE_MISC_MISC_CTRL_SCB1_SIZE_SHIFT			0x16
+#define PCIE_MISC_MISC_CTRL_SCB2_SIZE_MASK			0x1f
+#define PCIE_MISC_MISC_CTRL_SCB2_SIZE_SHIFT			0x0
+#define PCIE_MISC_RC_BAR1_CONFIG_LO_SIZE_MASK			0x1f
+#define PCIE_MISC_RC_BAR1_CONFIG_LO_SIZE_SHIFT			0x0
+#define PCIE_MISC_RC_BAR2_CONFIG_LO_SIZE_MASK			0x1f
+#define PCIE_MISC_RC_BAR2_CONFIG_LO_SIZE_SHIFT			0x0
+#define PCIE_MISC_RC_BAR3_CONFIG_LO_SIZE_MASK			0x1f
+#define PCIE_MISC_RC_BAR3_CONFIG_LO_SIZE_SHIFT			0x0
+#define PCIE_MISC_PCIE_CTRL_PCIE_PERSTB_MASK			0x4
+#define PCIE_MISC_PCIE_CTRL_PCIE_PERSTB_SHIFT			0x2
+#define PCIE_MISC_PCIE_CTRL_PCIE_L23_REQUEST_MASK		0x1
+#define PCIE_MISC_PCIE_CTRL_PCIE_L23_REQUEST_SHIFT		0x0
+#define PCIE_MISC_PCIE_STATUS_PCIE_PORT_MASK			0x80
+#define PCIE_MISC_PCIE_STATUS_PCIE_PORT_SHIFT			0x7
+#define PCIE_MISC_PCIE_STATUS_PCIE_DL_ACTIVE_MASK		0x20
+#define PCIE_MISC_PCIE_STATUS_PCIE_DL_ACTIVE_SHIFT		0x5
+#define PCIE_MISC_PCIE_STATUS_PCIE_PHYLINKUP_MASK		0x10
+#define PCIE_MISC_PCIE_STATUS_PCIE_PHYLINKUP_SHIFT		0x4
+#define PCIE_MISC_PCIE_STATUS_PCIE_LINK_IN_L23_MASK		0x40
+#define PCIE_MISC_PCIE_STATUS_PCIE_LINK_IN_L23_SHIFT		0x6
+#define PCIE_MISC_REVISION_MAJMIN_MASK				0xffff
+#define PCIE_MISC_REVISION_MAJMIN_SHIFT				0
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_LIMIT_MASK	0xfff00000
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_LIMIT_SHIFT	0x14
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_BASE_MASK	0xfff0
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_BASE_SHIFT	0x4
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_NUM_MASK_BITS	0xc
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_HI_BASE_MASK		0xff
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_HI_BASE_SHIFT	0x0
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI_LIMIT_MASK	0xff
+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI_LIMIT_SHIFT	0x0
+#define PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK	0x2
+#define PCIE_MISC_HARD_PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_SHIFT 0x1
+#define PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x08000000
+#define PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_SHIFT	0x1b
+#define PCIE_RGR1_SW_INIT_1_PERST_MASK				0x1
+#define PCIE_RGR1_SW_INIT_1_PERST_SHIFT				0x0
+
+#define BRCM_NUM_PCIE_OUT_WINS		0x4
+#define BRCM_MAX_SCB			0x4
+
+#define BRCM_MSI_TARGET_ADDR_LT_4GB	0x0fffffffcULL
+#define BRCM_MSI_TARGET_ADDR_GT_4GB	0xffffffffcULL
+
+#define BURST_SIZE_128			0
+#define BURST_SIZE_256			1
+#define BURST_SIZE_512			2
+
+/* Offsets from PCIE_INTR2_CPU_BASE */
+#define STATUS				0x0
+#define SET				0x4
+#define CLR				0x8
+#define MASK_STATUS			0xc
+#define MASK_SET			0x10
+#define MASK_CLR			0x14
+
+#define PCIE_BUSNUM_SHIFT		20
+#define PCIE_SLOT_SHIFT			15
+#define PCIE_FUNC_SHIFT			12
+
+#if defined(__BIG_ENDIAN)
+#define	DATA_ENDIAN			2	/* PCIe->DDR inbound traffic */
+#define MMIO_ENDIAN			2	/* CPU->PCIe outbound traffic */
+#else
+#define	DATA_ENDIAN			0
+#define MMIO_ENDIAN			0
+#endif
+
+#define MDIO_PORT0			0x0
+#define MDIO_DATA_MASK			0x7fffffff
+#define MDIO_DATA_SHIFT			0x0
+#define MDIO_PORT_MASK			0xf0000
+#define MDIO_PORT_SHIFT			0x16
+#define MDIO_REGAD_MASK			0xffff
+#define MDIO_REGAD_SHIFT		0x0
+#define MDIO_CMD_MASK			0xfff00000
+#define MDIO_CMD_SHIFT			0x14
+#define MDIO_CMD_READ			0x1
+#define MDIO_CMD_WRITE			0x0
+#define MDIO_DATA_DONE_MASK		0x80000000
+#define MDIO_RD_DONE(x)			(((x) & MDIO_DATA_DONE_MASK) ? 1 : 0)
+#define MDIO_WT_DONE(x)			(((x) & MDIO_DATA_DONE_MASK) ? 0 : 1)
+#define SSC_REGS_ADDR			0x1100
+#define SET_ADDR_OFFSET			0x1f
+#define SSC_CNTL_OFFSET			0x2
+#define SSC_CNTL_OVRD_EN_MASK		0x8000
+#define SSC_CNTL_OVRD_EN_SHIFT		0xf
+#define SSC_CNTL_OVRD_VAL_MASK		0x4000
+#define SSC_CNTL_OVRD_VAL_SHIFT		0xe
+#define SSC_STATUS_OFFSET		0x1
+#define SSC_STATUS_SSC_MASK		0x400
+#define SSC_STATUS_SSC_SHIFT		0xa
+#define SSC_STATUS_PLL_LOCK_MASK	0x800
+#define SSC_STATUS_PLL_LOCK_SHIFT	0xb
+
+#define IDX_ADDR(pcie)	\
+	((pcie)->reg_offsets[EXT_CFG_INDEX])
+#define DATA_ADDR(pcie)	\
+	((pcie)->reg_offsets[EXT_CFG_DATA])
+#define PCIE_RGR1_SW_INIT_1(pcie) \
+	((pcie)->reg_offsets[RGR1_SW_INIT_1])
+
+enum {
+	RGR1_SW_INIT_1,
+	EXT_CFG_INDEX,
+	EXT_CFG_DATA,
+};
+
+enum {
+	RGR1_SW_INIT_1_INIT_MASK,
+	RGR1_SW_INIT_1_INIT_SHIFT,
+	RGR1_SW_INIT_1_PERST_MASK,
+	RGR1_SW_INIT_1_PERST_SHIFT,
+};
+
+enum pcie_type {
+	BCM7425,
+	BCM7435,
+	GENERIC,
+	BCM7278,
+};
+
+struct brcm_window {
+	dma_addr_t pcie_addr;
+	phys_addr_t cpu_addr;
+	dma_addr_t size;
+};
+
+/* Internal PCIe Host Controller Information.*/
+struct brcm_pcie {
+	struct device		*dev;
+	void __iomem		*base;
+	struct list_head	resources;
+	int			irq;
+	struct clk		*clk;
+	struct pci_bus		*root_bus;
+	struct device_node	*dn;
+	int			id;
+	bool			suspended;
+	int			num_out_wins;
+	bool			ssc;
+	int			gen;
+	struct brcm_window	out_wins[BRCM_NUM_PCIE_OUT_WINS];
+	unsigned int		rev;
+	const int		*reg_offsets;
+	const int		*reg_field_info;
+	enum pcie_type		type;
+};
+
+struct pcie_cfg_data {
+	const int *reg_field_info;
+	const int *offsets;
+	const enum pcie_type type;
+};
+
+static const int pcie_reg_field_info[] = {
+	[RGR1_SW_INIT_1_INIT_MASK] = 0x2,
+	[RGR1_SW_INIT_1_INIT_SHIFT] = 0x1,
+};
+
+static const int pcie_reg_field_info_bcm7278[] = {
+	[RGR1_SW_INIT_1_INIT_MASK] = 0x1,
+	[RGR1_SW_INIT_1_INIT_SHIFT] = 0x0,
+};
+
+static const int pcie_offset_bcm7425[] = {
+	[RGR1_SW_INIT_1] = 0x8010,
+	[EXT_CFG_INDEX]  = 0x8300,
+	[EXT_CFG_DATA]   = 0x8304,
+};
+
+static const struct pcie_cfg_data bcm7425_cfg = {
+	.reg_field_info	= pcie_reg_field_info,
+	.offsets	= pcie_offset_bcm7425,
+	.type		= BCM7425,
+};
+
+static const int pcie_offsets[] = {
+	[RGR1_SW_INIT_1] = 0x9210,
+	[EXT_CFG_INDEX]  = 0x9000,
+	[EXT_CFG_DATA]   = 0x9004,
+};
+
+static const struct pcie_cfg_data bcm7435_cfg = {
+	.reg_field_info	= pcie_reg_field_info,
+	.offsets	= pcie_offsets,
+	.type		= BCM7435,
+};
+
+static const struct pcie_cfg_data generic_cfg = {
+	.reg_field_info	= pcie_reg_field_info,
+	.offsets	= pcie_offsets,
+	.type		= GENERIC,
+};
+
+static const int pcie_offset_bcm7278[] = {
+	[RGR1_SW_INIT_1] = 0xc010,
+	[EXT_CFG_INDEX] = 0x9000,
+	[EXT_CFG_DATA] = 0x9004,
+};
+
+static const struct pcie_cfg_data bcm7278_cfg = {
+	.reg_field_info = pcie_reg_field_info_bcm7278,
+	.offsets	= pcie_offset_bcm7278,
+	.type		= BCM7278,
+};
+
+static void __iomem *brcm_pcie_map_conf(struct pci_bus *bus, unsigned int devfn,
+					int where);
+
+static struct pci_ops brcm_pcie_ops = {
+	.map_bus = brcm_pcie_map_conf,
+	.read = pci_generic_config_read,
+	.write = pci_generic_config_write,
+};
+
+#if defined(CONFIG_MIPS)
+/* Broadcom MIPs HW implicitly does the swapping if necessary */
+#define bcm_readl(a)		__raw_readl(a)
+#define bcm_writel(d, a)	__raw_writel(d, a)
+#define bcm_readw(a)		__raw_readw(a)
+#define bcm_writew(d, a)	__raw_writew(d, a)
+#else
+#define bcm_readl(a)		readl(a)
+#define bcm_writel(d, a)	writel(d, a)
+#define bcm_readw(a)		readw(a)
+#define bcm_writew(d, a)	writew(d, a)
+#endif
+
+/* These macros extract/insert fields to host controller's register set. */
+#define RD_FLD(base, reg, field) \
+	rd_fld(base + reg, reg##_##field##_MASK, reg##_##field##_SHIFT)
+#define WR_FLD(base, reg, field, val) \
+	wr_fld(base + reg, reg##_##field##_MASK, reg##_##field##_SHIFT, val)
+#define WR_FLD_RB(base, reg, field, val) \
+	wr_fld_rb(base + reg, reg##_##field##_MASK, reg##_##field##_SHIFT, val)
+#define WR_FLD_WITH_OFFSET(base, off, reg, field, val) \
+	wr_fld(base + reg + off, reg##_##field##_MASK, \
+	       reg##_##field##_SHIFT, val)
+#define EXTRACT_FIELD(val, reg, field) \
+	((val & reg##_##field##_MASK) >> reg##_##field##_SHIFT)
+#define INSERT_FIELD(val, reg, field, field_val) \
+	((val & ~reg##_##field##_MASK) | \
+	 (reg##_##field##_MASK & (field_val << reg##_##field##_SHIFT)))
+
+static phys_addr_t scb_size[BRCM_MAX_SCB];
+static int num_memc;
+static int num_pcie;
+static DEFINE_MUTEX(brcm_pcie_lock);
+
+static u32 rd_fld(void __iomem *p, u32 mask, int shift)
+{
+	return (bcm_readl(p) & mask) >> shift;
+}
+
+static void wr_fld(void __iomem *p, u32 mask, int shift, u32 val)
+{
+	u32 reg = bcm_readl(p);
+
+	reg = (reg & ~mask) | ((val << shift) & mask);
+	bcm_writel(reg, p);
+}
+
+static void wr_fld_rb(void __iomem *p, u32 mask, int shift, u32 val)
+{
+	wr_fld(p, mask, shift, val);
+	(void)bcm_readl(p);
+}
+
+static const char *link_speed_to_str(int s)
+{
+	switch (s) {
+	case 1:
+		return "2.5";
+	case 2:
+		return "5.0";
+	case 3:
+		return "8.0";
+	default:
+		break;
+	}
+	return "???";
+}
+
+/*
+ * The roundup_pow_of_two() from log2.h invokes
+ * __roundup_pow_of_two(unsigned long), but we really need a
+ * such a function to take a native u64 since unsigned long
+ * is 32 bits on some configurations.  So we provide this helper
+ * function below.
+ */
+static u64 roundup_pow_of_two_64(u64 n)
+{
+	return 1ULL << fls64(n - 1);
+}
+
+/*
+ * This is to convert the size of the inbound "BAR" region to the
+ * non-linear values of PCIE_X_MISC_RC_BAR[123]_CONFIG_LO.SIZE
+ */
+int encode_ibar_size(u64 size)
+{
+	int log2_in = ilog2(size);
+
+	if (log2_in >= 12 && log2_in <= 15)
+		/* Covers 4KB to 32KB (inclusive) */
+		return (log2_in - 12) + 0x1c;
+	else if (log2_in >= 16 && log2_in <= 37)
+		/* Covers 64KB to 32GB, (inclusive) */
+		return log2_in - 15;
+	/* Something is awry so disable */
+	return 0;
+}
+
+static u32 mdio_form_pkt(int port, int regad, int cmd)
+{
+	u32 pkt = 0;
+
+	pkt |= (port << MDIO_PORT_SHIFT) & MDIO_PORT_MASK;
+	pkt |= (regad << MDIO_REGAD_SHIFT) & MDIO_REGAD_MASK;
+	pkt |= (cmd << MDIO_CMD_SHIFT) & MDIO_CMD_MASK;
+
+	return pkt;
+}
+
+/* negative return value indicates error */
+static int mdio_read(void __iomem *base, u8 port, u8 regad)
+{
+	int tries;
+	u32 data;
+
+	bcm_writel(mdio_form_pkt(port, regad, MDIO_CMD_READ),
+		   base + PCIE_RC_DL_MDIO_ADDR);
+	bcm_readl(base + PCIE_RC_DL_MDIO_ADDR);
+
+	data = bcm_readl(base + PCIE_RC_DL_MDIO_RD_DATA);
+	for (tries = 0; !MDIO_RD_DONE(data) && tries < 10; tries++) {
+		udelay(10);
+		data = bcm_readl(base + PCIE_RC_DL_MDIO_RD_DATA);
+	}
+
+	return MDIO_RD_DONE(data)
+		? (data & MDIO_DATA_MASK) >> MDIO_DATA_SHIFT
+		: -EIO;
+}
+
+/* negative return value indicates error */
+static int mdio_write(void __iomem *base, u8 port, u8 regad, u16 wrdata)
+{
+	int tries;
+	u32 data;
+
+	bcm_writel(mdio_form_pkt(port, regad, MDIO_CMD_WRITE),
+		   base + PCIE_RC_DL_MDIO_ADDR);
+	bcm_readl(base + PCIE_RC_DL_MDIO_ADDR);
+	bcm_writel(MDIO_DATA_DONE_MASK | wrdata,
+		   base + PCIE_RC_DL_MDIO_WR_DATA);
+
+	data = bcm_readl(base + PCIE_RC_DL_MDIO_WR_DATA);
+	for (tries = 0; !MDIO_WT_DONE(data) && tries < 10; tries++) {
+		udelay(10);
+		data = bcm_readl(base + PCIE_RC_DL_MDIO_WR_DATA);
+	}
+
+	return MDIO_WT_DONE(data) ? 0 : -EIO;
+}
+
+/*
+ * Configures device for Spread Spectrum Clocking (SSC) mode; a negative
+ * return value indicates error.
+ */
+static int set_ssc(void __iomem *base)
+{
+	int tmp;
+	u16 wrdata;
+	int pll, ssc;
+
+	tmp = mdio_write(base, MDIO_PORT0, SET_ADDR_OFFSET, SSC_REGS_ADDR);
+	if (tmp < 0)
+		return tmp;
+
+	tmp = mdio_read(base, MDIO_PORT0, SSC_CNTL_OFFSET);
+	if (tmp < 0)
+		return tmp;
+
+	wrdata = INSERT_FIELD(tmp, SSC_CNTL_OVRD, EN, 1);
+	wrdata = INSERT_FIELD(wrdata, SSC_CNTL_OVRD, VAL, 1);
+	tmp = mdio_write(base, MDIO_PORT0, SSC_CNTL_OFFSET, wrdata);
+	if (tmp < 0)
+		return tmp;
+
+	usleep_range(1000, 2000);
+	tmp = mdio_read(base, MDIO_PORT0, SSC_STATUS_OFFSET);
+	if (tmp < 0)
+		return tmp;
+
+	ssc = EXTRACT_FIELD(tmp, SSC_STATUS, SSC);
+	pll = EXTRACT_FIELD(tmp, SSC_STATUS, PLL_LOCK);
+
+	return (ssc && pll) ? 0 : -EIO;
+}
+
+/* Limits operation to a specific generation (1, 2, or 3) */
+static void set_gen(void __iomem *base, int gen)
+{
+	u32 lnkcap = bcm_readl(base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP);
+	u16 lnkctl2 = bcm_readw(base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2);
+
+	lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS) | gen;
+	bcm_writel(lnkcap, base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP);
+
+	lnkctl2 = (lnkctl2 & ~0xf) | gen;
+	bcm_writew(lnkctl2, base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2);
+}
+
+static void brcm_pcie_set_outbound_win(struct brcm_pcie *pcie,
+				       unsigned int win, phys_addr_t cpu_addr,
+				       dma_addr_t  pcie_addr, dma_addr_t size)
+{
+	void __iomem *base = pcie->base;
+	phys_addr_t cpu_addr_mb, limit_addr_mb;
+	u32 tmp;
+
+	/* Set the base of the pcie_addr window */
+	bcm_writel(lower_32_bits(pcie_addr) + MMIO_ENDIAN,
+		   base + PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LO + (win * 8));
+	bcm_writel(upper_32_bits(pcie_addr),
+		   base + PCIE_MISC_CPU_2_PCIE_MEM_WIN0_HI + (win * 8));
+
+	cpu_addr_mb = cpu_addr >> 20;
+	limit_addr_mb = (cpu_addr + size - 1) >> 20;
+
+	/* Write the addr base low register */
+	WR_FLD_WITH_OFFSET(base, (win * 4),
+			   PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT,
+			   BASE, cpu_addr_mb);
+	/* Write the addr limit low register */
+	WR_FLD_WITH_OFFSET(base, (win * 4),
+			   PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT,
+			   LIMIT, limit_addr_mb);
+
+	if (pcie->type != BCM7435 && pcie->type != BCM7425) {
+		/* Write the cpu addr high register */
+		tmp = (u32)(cpu_addr_mb >>
+			PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_NUM_MASK_BITS);
+		WR_FLD_WITH_OFFSET(base, (win * 8),
+				   PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_HI,
+				   BASE, tmp);
+		/* Write the cpu limit high register */
+		tmp = (u32)(limit_addr_mb >>
+			PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT_NUM_MASK_BITS);
+		WR_FLD_WITH_OFFSET(base, (win * 8),
+				   PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI,
+				   LIMIT, tmp);
+	}
+}
+
+/* Configuration space read/write support */
+static int cfg_index(int busnr, int devfn, int reg)
+{
+	return ((PCI_SLOT(devfn) & 0x1f) << PCIE_SLOT_SHIFT)
+		| ((PCI_FUNC(devfn) & 0x07) << PCIE_FUNC_SHIFT)
+		| (busnr << PCIE_BUSNUM_SHIFT)
+		| (reg & ~3);
+}
+
+/* The controller is capable of serving in both RC and EP roles */
+static bool brcm_pcie_rc_mode(struct brcm_pcie *pcie)
+{
+	void __iomem *base = pcie->base;
+	u32 val = bcm_readl(base + PCIE_MISC_PCIE_STATUS);
+
+	return !!EXTRACT_FIELD(val, PCIE_MISC_PCIE_STATUS, PCIE_PORT);
+}
+
+static bool brcm_pcie_link_up(struct brcm_pcie *pcie)
+{
+	void __iomem *base = pcie->base;
+	u32 val = bcm_readl(base + PCIE_MISC_PCIE_STATUS);
+	u32 dla = EXTRACT_FIELD(val, PCIE_MISC_PCIE_STATUS, PCIE_DL_ACTIVE);
+	u32 plu = EXTRACT_FIELD(val, PCIE_MISC_PCIE_STATUS, PCIE_PHYLINKUP);
+
+	return  (dla && plu) ? true : false;
+}
+
+static void __iomem *brcm_pcie_map_conf(struct pci_bus *bus, unsigned int devfn,
+					int where)
+{
+	struct brcm_pcie *pcie = bus->sysdata;
+	void __iomem *base = pcie->base;
+	int idx;
+
+	/* Accesses to the RC go right to the RC registers if slot==0 */
+	if (pci_is_root_bus(bus))
+		return PCI_SLOT(devfn) ? NULL : base + where;
+
+	/* For devices, write to the config space index register */
+	idx = cfg_index(bus->number, devfn, where);
+	bcm_writel(idx, pcie->base + IDX_ADDR(pcie));
+	return base + DATA_ADDR(pcie) + (where & 0x3);
+}
+
+static inline void brcm_pcie_bridge_sw_init_set(struct brcm_pcie *pcie,
+						unsigned int val)
+{
+	unsigned int shift = pcie->reg_field_info[RGR1_SW_INIT_1_INIT_SHIFT];
+	u32 mask =  pcie->reg_field_info[RGR1_SW_INIT_1_INIT_MASK];
+
+	wr_fld_rb(pcie->base + PCIE_RGR1_SW_INIT_1(pcie), mask, shift, val);
+}
+
+static inline void brcm_pcie_perst_set(struct brcm_pcie *pcie,
+				       unsigned int val)
+{
+	if (pcie->type != BCM7278)
+		wr_fld_rb(pcie->base + PCIE_RGR1_SW_INIT_1(pcie),
+			  PCIE_RGR1_SW_INIT_1_PERST_MASK,
+			  PCIE_RGR1_SW_INIT_1_PERST_SHIFT, val);
+	else
+		/* Assert = 0, de-assert = 1 on 7278 */
+		WR_FLD_RB(pcie->base, PCIE_MISC_PCIE_CTRL, PCIE_PERSTB, !val);
+}
+
+static int brcm_pcie_add_controller(struct brcm_pcie *pcie)
+{
+	int i, ret = 0;
+
+	mutex_lock(&brcm_pcie_lock);
+	if (num_pcie > 0) {
+		num_pcie++;
+		goto done;
+	}
+
+	/* Determine num_memc and their sizes */
+	for (i = 0, num_memc = 0; i < BRCM_MAX_SCB; i++) {
+		u64 size = brcmstb_memory_memc_size(i);
+
+		if (size == (u64)-1) {
+			dev_err(pcie->dev, "cannot get memc%d size\n", i);
+			ret = -EINVAL;
+			goto done;
+		} else if (size) {
+			scb_size[i] = roundup_pow_of_two_64(size);
+			num_memc++;
+		} else {
+			break;
+		}
+	}
+	if (!ret && num_memc == 0) {
+		ret = -EINVAL;
+		goto done;
+	}
+
+	num_pcie++;
+done:
+	mutex_unlock(&brcm_pcie_lock);
+	return ret;
+}
+
+static void brcm_pcie_remove_controller(struct brcm_pcie *pcie)
+{
+	mutex_lock(&brcm_pcie_lock);
+	if (--num_pcie == 0)
+		num_memc = 0;
+	mutex_unlock(&brcm_pcie_lock);
+}
+
+static int brcm_pcie_parse_request_of_pci_ranges(struct brcm_pcie *pcie)
+{
+	struct resource_entry *win;
+	int ret;
+
+	ret = devm_of_pci_get_host_bridge_resources(pcie->dev, 0, 0xff,
+						    &pcie->resources, NULL);
+	if (ret) {
+		dev_err(pcie->dev, "failed to get host resources\n");
+		return ret;
+	}
+
+	resource_list_for_each_entry(win, &pcie->resources) {
+		struct resource *parent, *res = win->res;
+		dma_addr_t offset = (dma_addr_t)win->offset;
+
+		if (resource_type(res) == IORESOURCE_IO) {
+			parent = &ioport_resource;
+		} else if (resource_type(res) == IORESOURCE_MEM) {
+			if (pcie->num_out_wins >= BRCM_NUM_PCIE_OUT_WINS) {
+				dev_err(pcie->dev, "too many outbound wins\n");
+				return -EINVAL;
+			}
+			pcie->out_wins[pcie->num_out_wins].cpu_addr
+				= (phys_addr_t)res->start;
+			pcie->out_wins[pcie->num_out_wins].pcie_addr
+				= (dma_addr_t)(res->start
+					       - (phys_addr_t)offset);
+			pcie->out_wins[pcie->num_out_wins].size
+				= (dma_addr_t)(res->end - res->start + 1);
+			pcie->num_out_wins++;
+			parent = &iomem_resource;
+		} else {
+			continue;
+		}
+
+		ret = devm_request_resource(pcie->dev, parent, res);
+		if (ret) {
+			dev_err(pcie->dev, "failed to get res %pR\n", res);
+			return ret;
+		}
+	}
+	return 0;
+}
+
+static int brcm_pcie_setup(struct brcm_pcie *pcie)
+{
+	void __iomem *base = pcie->base;
+	unsigned int scb_size_val;
+	u64 rc_bar2_offset, rc_bar2_size, total_mem_size = 0;
+	u32 tmp, burst;
+	int i, j, ret, limit;
+	u16 nlw, cls, lnksta;
+	bool ssc_good = false;
+	struct device *dev = pcie->dev;
+
+	/* Reset the bridge */
+	brcm_pcie_bridge_sw_init_set(pcie, 1);
+
+	/*
+	 * Ensure that the fundamental reset is asserted, except for 7278,
+	 * which fails if we do this.
+	 */
+	if (pcie->type != BCM7278)
+		brcm_pcie_perst_set(pcie, 1);
+
+	usleep_range(100, 200);
+
+	/* Take the bridge out of reset */
+	brcm_pcie_bridge_sw_init_set(pcie, 0);
+
+	WR_FLD_RB(base, PCIE_MISC_HARD_PCIE_HARD_DEBUG, SERDES_IDDQ, 0);
+	/* Wait for SerDes to be stable */
+	usleep_range(100, 200);
+
+	/* Grab the PCIe hw revision number */
+	tmp = bcm_readl(base + PCIE_MISC_REVISION);
+	pcie->rev = EXTRACT_FIELD(tmp, PCIE_MISC_REVISION, MAJMIN);
+
+	/* Set SCB_MAX_BURST_SIZE, CFG_READ_UR_MODE, SCB_ACCESS_EN */
+	tmp = INSERT_FIELD(0, PCIE_MISC_MISC_CTRL, SCB_ACCESS_EN, 1);
+	tmp = INSERT_FIELD(tmp, PCIE_MISC_MISC_CTRL, CFG_READ_UR_MODE, 1);
+	burst = (pcie->type == GENERIC || pcie->type == BCM7278)
+		? BURST_SIZE_512 : BURST_SIZE_256;
+	tmp = INSERT_FIELD(tmp, PCIE_MISC_MISC_CTRL, MAX_BURST_SIZE, burst);
+	bcm_writel(tmp, base + PCIE_MISC_MISC_CTRL);
+
+	/*
+	 * Set up inbound memory view for the EP (called RC_BAR2,
+	 * not to be confused with the BARs that are advertised by
+	 * the EP).
+	 */
+	for (i = 0; i < num_memc; i++)
+		total_mem_size += scb_size[i];
+
+	/*
+	 * The PCIe host controller by design must set the inbound
+	 * viewport to be a contiguous arrangement of all of the
+	 * system's memory.  In addition, its size mut be a power of
+	 * two.  To further complicate matters, the viewport must
+	 * start on a pcie-address that is aligned on a multiple of its
+	 * size.  If a portion of the viewport does not represent
+	 * system memory -- e.g. 3GB of memory requires a 4GB viewport
+	 * -- we can map the outbound memory in or after 3GB and even
+	 * though the viewport will overlap the outbound memory the
+	 * controller will know to send outbound memory downstream and
+	 * everything else upstream.
+	 */
+	rc_bar2_size = roundup_pow_of_two_64(total_mem_size);
+
+	/*
+	 * Set simple configuration based on memory sizes
+	 * only.  We always start the viewport at address 0.
+	 */
+	rc_bar2_offset = 0;
+
+	tmp = lower_32_bits(rc_bar2_offset);
+	tmp = INSERT_FIELD(tmp, PCIE_MISC_RC_BAR2_CONFIG_LO, SIZE,
+			   encode_ibar_size(rc_bar2_size));
+	bcm_writel(tmp, base + PCIE_MISC_RC_BAR2_CONFIG_LO);
+	bcm_writel(upper_32_bits(rc_bar2_offset),
+		   base + PCIE_MISC_RC_BAR2_CONFIG_HI);
+
+	scb_size_val = scb_size[0]
+		? ilog2(scb_size[0]) - 15 : 0xf; /* 0xf is 1GB */
+	WR_FLD(base, PCIE_MISC_MISC_CTRL, SCB0_SIZE, scb_size_val);
+
+	if (num_memc > 1) {
+		scb_size_val = scb_size[1]
+			? ilog2(scb_size[1]) - 15 : 0xf; /* 0xf is 1GB */
+		WR_FLD(base, PCIE_MISC_MISC_CTRL, SCB1_SIZE, scb_size_val);
+	}
+
+	if (num_memc > 2) {
+		scb_size_val = scb_size[2]
+			? ilog2(scb_size[2]) - 15 : 0xf; /* 0xf is 1GB */
+		WR_FLD(base, PCIE_MISC_MISC_CTRL, SCB2_SIZE, scb_size_val);
+	}
+
+	/* disable the PCIe->GISB memory window (RC_BAR1) */
+	WR_FLD(base, PCIE_MISC_RC_BAR1_CONFIG_LO, SIZE, 0);
+
+	/* disable the PCIe->SCB memory window (RC_BAR3) */
+	WR_FLD(base, PCIE_MISC_RC_BAR3_CONFIG_LO, SIZE, 0);
+
+	if (!pcie->suspended) {
+		/* clear any interrupts we find on boot */
+		bcm_writel(0xffffffff, base + PCIE_INTR2_CPU_BASE + CLR);
+		(void)bcm_readl(base + PCIE_INTR2_CPU_BASE + CLR);
+	}
+
+	/* Mask all interrupts since we are not handling any yet */
+	bcm_writel(0xffffffff, base + PCIE_INTR2_CPU_BASE + MASK_SET);
+	(void)bcm_readl(base + PCIE_INTR2_CPU_BASE + MASK_SET);
+
+	if (pcie->gen)
+		set_gen(base, pcie->gen);
+
+	/* Unassert the fundamental reset */
+	brcm_pcie_perst_set(pcie, 0);
+
+	/*
+	 * Give the RC/EP time to wake up, before trying to configure RC.
+	 * Intermittently check status for link-up, up to a total of 100ms
+	 * when we don't know if the device is there, and up to 1000ms if
+	 * we do know the device is there.
+	 */
+	limit = pcie->suspended ? 1000 : 100;
+	for (i = 1, j = 0; j < limit && !brcm_pcie_link_up(pcie);
+	     j += i, i = i * 2)
+		msleep(i + j > limit ? limit - j : i);
+
+	if (!brcm_pcie_link_up(pcie)) {
+		dev_info(dev, "link down\n");
+		return -ENODEV;
+	}
+
+	if (!brcm_pcie_rc_mode(pcie)) {
+		dev_err(dev, "PCIe misconfigured; is in EP mode\n");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < pcie->num_out_wins; i++)
+		brcm_pcie_set_outbound_win(pcie, i, pcie->out_wins[i].cpu_addr,
+					   pcie->out_wins[i].pcie_addr,
+					   pcie->out_wins[i].size);
+
+	/*
+	 * For config space accesses on the RC, show the right class for
+	 * a PCIe-PCIe bridge (the default setting is to be EP mode).
+	 */
+	WR_FLD_RB(base, PCIE_RC_CFG_PRIV1_ID_VAL3, CLASS_CODE, 0x060400);
+
+	if (pcie->ssc) {
+		ret = set_ssc(base);
+		if (ret == 0)
+			ssc_good = true;
+		else
+			dev_err(dev, "failed attempt to enter ssc mode\n");
+	}
+
+	lnksta = bcm_readw(base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKSTA);
+	cls = lnksta & PCI_EXP_LNKSTA_CLS;
+	nlw = (lnksta & PCI_EXP_LNKSTA_NLW) >> PCI_EXP_LNKSTA_NLW_SHIFT;
+	dev_info(dev, "link up, %s Gbps x%u %s\n", link_speed_to_str(cls),
+		 nlw, ssc_good ? "(SSC)" : "(!SSC)");
+
+	/* PCIe->SCB endian mode for BAR */
+	/* field ENDIAN_MODE_BAR2 = DATA_ENDIAN */
+	WR_FLD_RB(base, PCIE_RC_CFG_VENDOR_VENDOR_SPECIFIC_REG1,
+		  ENDIAN_MODE_BAR2, DATA_ENDIAN);
+
+	/*
+	 * Refclk from RC should be gated with CLKREQ# input when ASPM L0s,L1
+	 * is enabled =>  setting the CLKREQ_DEBUG_ENABLE field to 1.
+	 */
+	WR_FLD_RB(base, PCIE_MISC_HARD_PCIE_HARD_DEBUG, CLKREQ_DEBUG_ENABLE, 1);
+
+	return 0;
+}
+
+/* L23 is a low-power PCIe link state */
+static void enter_l23(struct brcm_pcie *pcie)
+{
+	void __iomem *base = pcie->base;
+	int tries, l23;
+
+	/* assert request for L23 */
+	WR_FLD_RB(base, PCIE_MISC_PCIE_CTRL, PCIE_L23_REQUEST, 1);
+	/* poll L23 status */
+	for (tries = 0, l23 = 0; tries < 1000 && !l23; tries++)
+		l23 = RD_FLD(base, PCIE_MISC_PCIE_STATUS, PCIE_LINK_IN_L23);
+	if (!l23)
+		dev_err(pcie->dev, "failed to enter L23\n");
+}
+
+static void turn_off(struct brcm_pcie *pcie)
+{
+	void __iomem *base = pcie->base;
+
+	if (brcm_pcie_link_up(pcie))
+		enter_l23(pcie);
+	/* Assert fundamental reset */
+	brcm_pcie_perst_set(pcie, 1);
+	/* Deassert request for L23 in case it was asserted */
+	WR_FLD_RB(base, PCIE_MISC_PCIE_CTRL, PCIE_L23_REQUEST, 0);
+	/* Turn off SerDes */
+	WR_FLD_RB(base, PCIE_MISC_HARD_PCIE_HARD_DEBUG, SERDES_IDDQ, 1);
+	/* Shutdown PCIe bridge */
+	brcm_pcie_bridge_sw_init_set(pcie, 1);
+}
+
+static int brcm_pcie_suspend(struct device *dev)
+{
+	struct brcm_pcie *pcie = dev_get_drvdata(dev);
+
+	turn_off(pcie);
+	clk_disable_unprepare(pcie->clk);
+	pcie->suspended = true;
+
+	return 0;
+}
+
+static int brcm_pcie_resume(struct device *dev)
+{
+	struct brcm_pcie *pcie = dev_get_drvdata(dev);
+	void __iomem *base;
+	int ret;
+
+	base = pcie->base;
+	clk_prepare_enable(pcie->clk);
+
+	/* Take bridge out of reset so we can access the SerDes reg */
+	brcm_pcie_bridge_sw_init_set(pcie, 0);
+
+	/* Turn on SerDes */
+	WR_FLD_RB(base, PCIE_MISC_HARD_PCIE_HARD_DEBUG, SERDES_IDDQ, 0);
+	/* Wait for SerDes to be stable */
+	usleep_range(100, 200);
+
+	ret = brcm_pcie_setup(pcie);
+	if (ret)
+		return ret;
+
+	pcie->suspended = false;
+
+	return 0;
+}
+
+static void _brcm_pcie_remove(struct brcm_pcie *pcie)
+{
+	turn_off(pcie);
+	clk_disable_unprepare(pcie->clk);
+	clk_put(pcie->clk);
+	brcm_pcie_remove_controller(pcie);
+}
+
+static int brcm_pcie_remove(struct platform_device *pdev)
+{
+	struct brcm_pcie *pcie = platform_get_drvdata(pdev);
+
+	pci_stop_root_bus(pcie->root_bus);
+	pci_remove_root_bus(pcie->root_bus);
+	_brcm_pcie_remove(pcie);
+
+	return 0;
+}
+
+static const struct of_device_id brcm_pcie_match[] = {
+	{ .compatible = "brcm,bcm7425-pcie", .data = &bcm7425_cfg },
+	{ .compatible = "brcm,bcm7435-pcie", .data = &bcm7435_cfg },
+	{ .compatible = "brcm,bcm7278-pcie", .data = &bcm7278_cfg },
+	{ .compatible = "brcm,bcm7445-pcie", .data = &generic_cfg },
+	{},
+};
+MODULE_DEVICE_TABLE(of, brcm_pcie_match);
+
+static int brcm_pcie_probe(struct platform_device *pdev)
+{
+	struct device_node *dn = pdev->dev.of_node;
+	const struct of_device_id *of_id;
+	const struct pcie_cfg_data *data;
+	int ret;
+	struct brcm_pcie *pcie;
+	struct resource *res;
+	void __iomem *base;
+	u32 tmp;
+	struct pci_host_bridge *bridge;
+	struct pci_bus *child;
+
+	bridge = devm_pci_alloc_host_bridge(&pdev->dev, sizeof(*pcie));
+	if (!bridge)
+		return -ENOMEM;
+
+	pcie = pci_host_bridge_priv(bridge);
+	INIT_LIST_HEAD(&pcie->resources);
+
+	of_id = of_match_node(brcm_pcie_match, dn);
+	if (!of_id) {
+		dev_err(&pdev->dev, "failed to look up compatible string\n");
+		return -EINVAL;
+	}
+
+	if (of_property_read_u32(dn, "dma-ranges", &tmp) == 0) {
+		dev_err(&pdev->dev, "cannot yet handle dma-ranges\n");
+		return -EINVAL;
+	}
+
+	data = of_id->data;
+	pcie->reg_offsets = data->offsets;
+	pcie->reg_field_info = data->reg_field_info;
+	pcie->type = data->type;
+	pcie->dn = dn;
+	pcie->dev = &pdev->dev;
+
+	/* We use the domain number as our controller number */
+	pcie->id = of_get_pci_domain_nr(dn);
+	if (pcie->id < 0)
+		return pcie->id;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return -EINVAL;
+
+	base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(base))
+		return PTR_ERR(base);
+
+	pcie->clk = of_clk_get_by_name(dn, "sw_pcie");
+	if (IS_ERR(pcie->clk)) {
+		dev_err(&pdev->dev, "could not get clock\n");
+		pcie->clk = NULL;
+	}
+	pcie->base = base;
+
+	ret = of_pci_get_max_link_speed(dn);
+	pcie->gen = (ret < 0) ? 0 : ret;
+
+	pcie->ssc = of_property_read_bool(dn, "brcm,enable-ssc");
+
+	ret = irq_of_parse_and_map(pdev->dev.of_node, 0);
+	if (ret == 0)
+		/* keep going, as we don't use this intr yet */
+		dev_warn(pcie->dev, "cannot get PCIe interrupt\n");
+	else
+		pcie->irq = ret;
+
+	ret = brcm_pcie_parse_request_of_pci_ranges(pcie);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(pcie->clk);
+	if (ret) {
+		dev_err(&pdev->dev, "could not enable clock\n");
+		return ret;
+	}
+
+	ret = brcm_pcie_add_controller(pcie);
+	if (ret)
+		return ret;
+
+	ret = brcm_pcie_setup(pcie);
+	if (ret)
+		goto fail;
+
+	list_splice_init(&pcie->resources, &bridge->windows);
+	bridge->dev.parent = &pdev->dev;
+	bridge->busnr = 0;
+	bridge->ops = &brcm_pcie_ops;
+	bridge->sysdata = pcie;
+	bridge->map_irq = of_irq_parse_and_map_pci;
+	bridge->swizzle_irq = pci_common_swizzle;
+
+	ret = pci_scan_root_bus_bridge(bridge);
+	if (ret < 0) {
+		dev_err(pcie->dev, "Scanning root bridge failed\n");
+		goto fail;
+	}
+
+	pci_assign_unassigned_bus_resources(bridge->bus);
+	list_for_each_entry(child, &bridge->bus->children, node)
+		pcie_bus_configure_settings(child);
+	pci_bus_add_devices(bridge->bus);
+	platform_set_drvdata(pdev, pcie);
+	pcie->root_bus = bridge->bus;
+
+	return 0;
+
+fail:
+	_brcm_pcie_remove(pcie);
+	return ret;
+}
+
+static const struct dev_pm_ops brcm_pcie_pm_ops = {
+	.suspend_noirq = brcm_pcie_suspend,
+	.resume_noirq = brcm_pcie_resume,
+};
+
+static struct platform_driver brcm_pcie_driver = {
+	.probe = brcm_pcie_probe,
+	.remove = brcm_pcie_remove,
+	.driver = {
+		.name = "brcm-pcie",
+		.owner = THIS_MODULE,
+		.of_match_table = brcm_pcie_match,
+		.pm = &brcm_pcie_pm_ops,
+	},
+};
+
+module_platform_driver(brcm_pcie_driver);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Broadcom STB PCIe RC driver");
+MODULE_AUTHOR("Broadcom");
diff --git a/include/soc/brcmstb/memory_api.h b/include/soc/brcmstb/memory_api.h
new file mode 100644
index 0000000000000..d922906790671
--- /dev/null
+++ b/include/soc/brcmstb/memory_api.h
@@ -0,0 +1,25 @@
+#ifndef __MEMORY_API_H
+#define __MEMORY_API_H
+
+/*
+ * Bus Interface Unit control register setup, must happen early during boot,
+ * before SMP is brought up, called by machine entry point.
+ */
+void brcmstb_biuctrl_init(void);
+
+#ifdef CONFIG_SOC_BRCMSTB
+int brcmstb_memory_phys_addr_to_memc(phys_addr_t pa);
+u64 brcmstb_memory_memc_size(int memc);
+#else
+static inline int brcmstb_memory_phys_addr_to_memc(phys_addr_t pa)
+{
+	return -EINVAL;
+}
+
+static inline u64 brcmstb_memory_memc_size(int memc)
+{
+	return -1;
+}
+#endif
+
+#endif /* __MEMORY_API_H */
-- 
GitLab


From 6bfa7e5836f3f94b73c82136b9eef54ef9318dde Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 19 Feb 2019 22:06:59 +0000
Subject: [PATCH 0539/1835] PCI: brcmstb: Add dma-range mapping for inbound
 traffic

The Broadcom STB PCIe host controller is intimately related to the
memory subsystem.  This close relationship adds complexity to how cpu
system memory is mapped to PCIe memory.  Ideally, this mapping is an
identity mapping, or an identity mapping off by a constant.  Not so in
this case.

Consider the Broadcom reference board BCM97445LCC_4X8 which has 6 GB
of system memory.  Here is how the PCIe controller maps the
system memory to PCIe memory:

  memc0-a@[        0....3fffffff] <=> pci@[        0....3fffffff]
  memc0-b@[100000000...13fffffff] <=> pci@[ 40000000....7fffffff]
  memc1-a@[ 40000000....7fffffff] <=> pci@[ 80000000....bfffffff]
  memc1-b@[300000000...33fffffff] <=> pci@[ c0000000....ffffffff]
  memc2-a@[ 80000000....bfffffff] <=> pci@[100000000...13fffffff]
  memc2-b@[c00000000...c3fffffff] <=> pci@[140000000...17fffffff]

Although there are some "gaps" that can be added between the
individual mappings by software, the permutation of memory regions for
the most part is fixed by HW.  The solution of having something close
to an identity mapping is not possible.

The idea behind this HW design is that the same PCIe module can
act as an RC or EP, and if it acts as an EP it concatenates all
of system memory into a BAR so anything can be accessed.  Unfortunately,
when the PCIe block is in the role of an RC it also presents this
"BAR" to downstream PCIe devices, rather than offering an identity map
between its system memory and PCIe space.

Suppose that an endpoint driver allocs some DMA memory.  Suppose this
memory is located at 0x6000_0000, which is in the middle of memc1-a.
The driver wants a dma_addr_t value that it can pass on to the EP to
use.  Without doing any custom mapping, the EP will use this value for
DMA: the driver will get a dma_addr_t equal to 0x6000_0000.  But this
won't work; the device needs a dma_addr_t that reflects the PCIe space
address, namely 0xa000_0000.

So, essentially the solution to this problem must modify the
dma_addr_t returned by the DMA routines routines.  There are two
ways (I know of) of doing this:

(a) overriding/redefining the dma_to_phys() and phys_to_dma() calls
that are used by the dma_ops routines.  This is the approach of

	arch/mips/cavium-octeon/dma-octeon.c

In ARM and ARM64 these two routines are defiend in asm/dma-mapping.h
as static inline functions.

(b) Subscribe to a notifier that notifies when a device is added to a
bus.  When this happens, set_dma_ops() can be called for the device.
This method is mentioned in:

    http://lxr.free-electrons.com/source/drivers/of/platform.c?v=3.16#L152

where it says as a comment

    "In case if platform code need to use own special DMA
    configuration, it can use Platform bus notifier and
    handle BUS_NOTIFY_ADD_DEVICE event to fix up DMA
    configuration."

Solution (b) is what this commit does.  It uses its own set of
dma_ops which are wrappers around the arch_dma_ops.  The
wrappers translate the dma addresses before/after invoking
the arch_dma_ops, as appropriate.

Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
---
 drivers/pci/controller/pcie-brcmstb.c | 420 +++++++++++++++++++++++++-
 1 file changed, 411 insertions(+), 9 deletions(-)

diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index babef9191e88c..27bcf83c99d7e 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -4,6 +4,7 @@
 #include <linux/clk.h>
 #include <linux/compiler.h>
 #include <linux/delay.h>
+#include <linux/dma-mapping.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
@@ -319,11 +320,307 @@ static struct pci_ops brcm_pcie_ops = {
 	((val & ~reg##_##field##_MASK) | \
 	 (reg##_##field##_MASK & (field_val << reg##_##field##_SHIFT)))
 
+static const struct dma_map_ops *arch_dma_ops;
+static const struct dma_map_ops *brcm_dma_ops_ptr;
+static struct of_pci_range *dma_ranges;
+static int num_dma_ranges;
+
 static phys_addr_t scb_size[BRCM_MAX_SCB];
 static int num_memc;
 static int num_pcie;
 static DEFINE_MUTEX(brcm_pcie_lock);
 
+static dma_addr_t brcm_to_pci(dma_addr_t addr)
+{
+	struct of_pci_range *p;
+
+	if (!num_dma_ranges)
+		return addr;
+
+	for (p = dma_ranges; p < &dma_ranges[num_dma_ranges]; p++)
+		if (addr >= p->cpu_addr && addr < (p->cpu_addr + p->size))
+			return addr - p->cpu_addr + p->pci_addr;
+
+	return addr;
+}
+
+static dma_addr_t brcm_to_cpu(dma_addr_t addr)
+{
+	struct of_pci_range *p;
+
+	if (!num_dma_ranges)
+		return addr;
+
+	for (p = dma_ranges; p < &dma_ranges[num_dma_ranges]; p++)
+		if (addr >= p->pci_addr && addr < (p->pci_addr + p->size))
+			return addr - p->pci_addr + p->cpu_addr;
+
+	return addr;
+}
+
+static void *brcm_alloc(struct device *dev, size_t size, dma_addr_t *handle,
+			gfp_t gfp, unsigned long attrs)
+{
+	void *ret;
+
+	ret = arch_dma_ops->alloc(dev, size, handle, gfp, attrs);
+	if (ret)
+		*handle = brcm_to_pci(*handle);
+	return ret;
+}
+
+static void brcm_free(struct device *dev, size_t size, void *cpu_addr,
+		      dma_addr_t handle, unsigned long attrs)
+{
+	handle = brcm_to_cpu(handle);
+	arch_dma_ops->free(dev, size, cpu_addr, handle, attrs);
+}
+
+static int brcm_mmap(struct device *dev, struct vm_area_struct *vma,
+		     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+		     unsigned long attrs)
+{
+	dma_addr = brcm_to_cpu(dma_addr);
+	return arch_dma_ops->mmap(dev, vma, cpu_addr, dma_addr, size, attrs);
+}
+
+static int brcm_get_sgtable(struct device *dev, struct sg_table *sgt,
+			    void *cpu_addr, dma_addr_t handle, size_t size,
+			    unsigned long attrs)
+{
+	handle = brcm_to_cpu(handle);
+	return arch_dma_ops->get_sgtable(dev, sgt, cpu_addr, handle, size,
+				       attrs);
+}
+
+static dma_addr_t brcm_map_page(struct device *dev, struct page *page,
+				unsigned long offset, size_t size,
+				enum dma_data_direction dir,
+				unsigned long attrs)
+{
+	return brcm_to_pci(arch_dma_ops->map_page(dev, page, offset, size,
+						  dir, attrs));
+}
+
+static void brcm_unmap_page(struct device *dev, dma_addr_t handle,
+			    size_t size, enum dma_data_direction dir,
+			    unsigned long attrs)
+{
+	handle = brcm_to_cpu(handle);
+	arch_dma_ops->unmap_page(dev, handle, size, dir, attrs);
+}
+
+static int brcm_map_sg(struct device *dev, struct scatterlist *sgl,
+		       int nents, enum dma_data_direction dir,
+		       unsigned long attrs)
+{
+	int i, j;
+	struct scatterlist *sg;
+
+	for_each_sg(sgl, sg, nents, i) {
+#ifdef CONFIG_NEED_SG_DMA_LENGTH
+		sg->dma_length = sg->length;
+#endif
+		sg->dma_address =
+			brcm_dma_ops_ptr->map_page(dev, sg_page(sg), sg->offset,
+						   sg->length, dir, attrs);
+		if (dma_mapping_error(dev, sg->dma_address))
+			goto bad_mapping;
+	}
+	return nents;
+
+bad_mapping:
+	for_each_sg(sgl, sg, i, j)
+		brcm_dma_ops_ptr->unmap_page(dev, sg_dma_address(sg),
+					     sg_dma_len(sg), dir, attrs);
+	return 0;
+}
+
+static void brcm_unmap_sg(struct device *dev,
+			  struct scatterlist *sgl, int nents,
+			  enum dma_data_direction dir,
+			  unsigned long attrs)
+{
+	int i;
+	struct scatterlist *sg;
+
+	for_each_sg(sgl, sg, nents, i)
+		brcm_dma_ops_ptr->unmap_page(dev, sg_dma_address(sg),
+					     sg_dma_len(sg), dir, attrs);
+}
+
+static void brcm_sync_single_for_cpu(struct device *dev,
+				     dma_addr_t handle, size_t size,
+				     enum dma_data_direction dir)
+{
+	handle = brcm_to_cpu(handle);
+	arch_dma_ops->sync_single_for_cpu(dev, handle, size, dir);
+}
+
+static void brcm_sync_single_for_device(struct device *dev,
+					dma_addr_t handle, size_t size,
+					enum dma_data_direction dir)
+{
+	handle = brcm_to_cpu(handle);
+	arch_dma_ops->sync_single_for_device(dev, handle, size, dir);
+}
+
+static dma_addr_t brcm_map_resource(struct device *dev, phys_addr_t phys,
+				    size_t size,
+				    enum dma_data_direction dir,
+				    unsigned long attrs)
+{
+	if (arch_dma_ops->map_resource)
+		return brcm_to_pci(arch_dma_ops->map_resource
+				   (dev, phys, size, dir, attrs));
+	return brcm_to_pci((dma_addr_t)phys);
+}
+
+static void brcm_unmap_resource(struct device *dev, dma_addr_t handle,
+				size_t size, enum dma_data_direction dir,
+				unsigned long attrs)
+{
+	if (arch_dma_ops->unmap_resource)
+		arch_dma_ops->unmap_resource(dev, brcm_to_cpu(handle), size,
+					     dir, attrs);
+}
+
+void brcm_sync_sg_for_cpu(struct device *dev, struct scatterlist *sgl,
+			  int nents, enum dma_data_direction dir)
+{
+	struct scatterlist *sg;
+	int i;
+
+	for_each_sg(sgl, sg, nents, i)
+		brcm_dma_ops_ptr->sync_single_for_cpu(dev, sg_dma_address(sg),
+						      sg->length, dir);
+}
+
+void brcm_sync_sg_for_device(struct device *dev, struct scatterlist *sgl,
+			     int nents, enum dma_data_direction dir)
+{
+	struct scatterlist *sg;
+	int i;
+
+	for_each_sg(sgl, sg, nents, i)
+		brcm_dma_ops_ptr->sync_single_for_device(dev,
+							 sg_dma_address(sg),
+							 sg->length, dir);
+}
+
+static int brcm_mapping_error(struct device *dev, dma_addr_t dma_addr)
+{
+	return arch_dma_ops->mapping_error(dev, dma_addr);
+}
+
+static int brcm_dma_supported(struct device *dev, u64 mask)
+{
+	if (num_dma_ranges) {
+		/*
+		 * It is our translated addresses that the EP will "see", so
+		 * we check all of the ranges for the largest possible value.
+		 */
+		int i;
+
+		for (i = 0; i < num_dma_ranges; i++)
+			if (dma_ranges[i].pci_addr + dma_ranges[i].size - 1
+			    > mask)
+				return 0;
+		return 1;
+	}
+
+	return arch_dma_ops->dma_supported(dev, mask);
+}
+
+#ifdef ARCH_HAS_DMA_GET_REQUIRED_MASK
+u64 brcm_get_required_mask)(struct device *dev)
+{
+	return arch_dma_ops->get_required_mask(dev);
+}
+#endif
+
+static const struct dma_map_ops brcm_dma_ops = {
+	.alloc			= brcm_alloc,
+	.free			= brcm_free,
+	.mmap			= brcm_mmap,
+	.get_sgtable		= brcm_get_sgtable,
+	.map_page		= brcm_map_page,
+	.unmap_page		= brcm_unmap_page,
+	.map_sg			= brcm_map_sg,
+	.unmap_sg		= brcm_unmap_sg,
+	.map_resource		= brcm_map_resource,
+	.unmap_resource		= brcm_unmap_resource,
+	.sync_single_for_cpu	= brcm_sync_single_for_cpu,
+	.sync_single_for_device	= brcm_sync_single_for_device,
+	.sync_sg_for_cpu	= brcm_sync_sg_for_cpu,
+	.sync_sg_for_device	= brcm_sync_sg_for_device,
+	.mapping_error		= brcm_mapping_error,
+	.dma_supported		= brcm_dma_supported,
+#ifdef ARCH_HAS_DMA_GET_REQUIRED_MASK
+	.get_required_mask	= brcm_get_required_mask,
+#endif
+};
+
+static void brcm_set_dma_ops(struct device *dev)
+{
+	int ret;
+
+	if (IS_ENABLED(CONFIG_ARM64)) {
+		/*
+		 * We are going to invoke get_dma_ops().  That
+		 * function, at this point in time, invokes
+		 * get_arch_dma_ops(), and for ARM64 that function
+		 * returns a pointer to dummy_dma_ops.  So then we'd
+		 * like to call arch_setup_dma_ops(), but that isn't
+		 * exported.  Instead, we call of_dma_configure(),
+		 * which is exported, and this calls
+		 * arch_setup_dma_ops().  Once we do this the call to
+		 * get_dma_ops() will work properly because
+		 * dev->dma_ops will be set.
+		 */
+		ret = of_dma_configure(dev, dev->of_node, true);
+		if (ret) {
+			dev_err(dev, "of_dma_configure() failed: %d\n", ret);
+			return;
+		}
+	}
+
+	arch_dma_ops = get_dma_ops(dev);
+	if (!arch_dma_ops) {
+		dev_err(dev, "failed to get arch_dma_ops\n");
+		return;
+	}
+
+	set_dma_ops(dev, &brcm_dma_ops);
+}
+
+static int brcmstb_platform_notifier(struct notifier_block *nb,
+				     unsigned long event, void *__dev)
+{
+	struct device *dev = __dev;
+
+	brcm_dma_ops_ptr = &brcm_dma_ops;
+	if (event != BUS_NOTIFY_ADD_DEVICE)
+		return NOTIFY_DONE;
+
+	brcm_set_dma_ops(dev);
+	return NOTIFY_OK;
+}
+
+static struct notifier_block brcmstb_platform_nb = {
+	.notifier_call = brcmstb_platform_notifier,
+};
+
+static int brcm_register_notifier(void)
+{
+	return bus_register_notifier(&pci_bus_type, &brcmstb_platform_nb);
+}
+
+static int brcm_unregister_notifier(void)
+{
+	return bus_unregister_notifier(&pci_bus_type, &brcmstb_platform_nb);
+}
+
 static u32 rd_fld(void __iomem *p, u32 mask, int shift)
 {
 	return (bcm_readl(p) & mask) >> shift;
@@ -597,9 +894,71 @@ static inline void brcm_pcie_perst_set(struct brcm_pcie *pcie,
 		WR_FLD_RB(pcie->base, PCIE_MISC_PCIE_CTRL, PCIE_PERSTB, !val);
 }
 
+static int pci_dma_range_parser_init(struct of_pci_range_parser *parser,
+				     struct device_node *node)
+{
+	const int na = 3, ns = 2;
+	int rlen;
+
+	parser->node = node;
+	parser->pna = of_n_addr_cells(node);
+	parser->np = parser->pna + na + ns;
+
+	parser->range = of_get_property(node, "dma-ranges", &rlen);
+	if (!parser->range)
+		return -ENOENT;
+
+	parser->end = parser->range + rlen / sizeof(__be32);
+
+	return 0;
+}
+
+static int brcm_pcie_parse_map_dma_ranges(struct brcm_pcie *pcie)
+{
+	int i;
+	struct of_pci_range_parser parser;
+	struct device_node *dn = pcie->dn;
+
+	/*
+	 * Parse dma-ranges property if present.  If there are multiple
+	 * PCIe controllers, we only have to parse from one of them since
+	 * the others will have an identical mapping.
+	 */
+	if (!pci_dma_range_parser_init(&parser, dn)) {
+		unsigned int max_ranges
+			= (parser.end - parser.range) / parser.np;
+
+		dma_ranges = kcalloc(max_ranges, sizeof(struct of_pci_range),
+				     GFP_KERNEL);
+		if (!dma_ranges)
+			return -ENOMEM;
+
+		for (i = 0; of_pci_range_parser_one(&parser, dma_ranges + i);
+		     i++)
+			num_dma_ranges++;
+	}
+
+	for (i = 0, num_memc = 0; i < BRCM_MAX_SCB; i++) {
+		u64 size = brcmstb_memory_memc_size(i);
+
+		if (size == (u64)-1) {
+			dev_err(pcie->dev, "cannot get memc%d size", i);
+			return -EINVAL;
+		} else if (size) {
+			scb_size[i] = roundup_pow_of_two_64(size);
+			num_memc++;
+		} else {
+			break;
+		}
+	}
+
+	return 0;
+}
+
 static int brcm_pcie_add_controller(struct brcm_pcie *pcie)
 {
 	int i, ret = 0;
+	struct device *dev = pcie->dev;
 
 	mutex_lock(&brcm_pcie_lock);
 	if (num_pcie > 0) {
@@ -607,12 +966,21 @@ static int brcm_pcie_add_controller(struct brcm_pcie *pcie)
 		goto done;
 	}
 
+	ret = brcm_register_notifier();
+	if (ret) {
+		dev_err(dev, "failed to register pci bus notifier\n");
+		goto done;
+	}
+	ret = brcm_pcie_parse_map_dma_ranges(pcie);
+	if (ret)
+		goto done;
+
 	/* Determine num_memc and their sizes */
 	for (i = 0, num_memc = 0; i < BRCM_MAX_SCB; i++) {
 		u64 size = brcmstb_memory_memc_size(i);
 
 		if (size == (u64)-1) {
-			dev_err(pcie->dev, "cannot get memc%d size\n", i);
+			dev_err(dev, "cannot get memc%d size\n", i);
 			ret = -EINVAL;
 			goto done;
 		} else if (size) {
@@ -636,8 +1004,16 @@ done:
 static void brcm_pcie_remove_controller(struct brcm_pcie *pcie)
 {
 	mutex_lock(&brcm_pcie_lock);
-	if (--num_pcie == 0)
-		num_memc = 0;
+	if (--num_pcie > 0)
+		goto out;
+
+	if (brcm_unregister_notifier())
+		dev_err(pcie->dev, "failed to unregister pci bus notifier\n");
+	kfree(dma_ranges);
+	dma_ranges = NULL;
+	num_dma_ranges = 0;
+	num_memc = 0;
+out:
 	mutex_unlock(&brcm_pcie_lock);
 }
 
@@ -757,6 +1133,38 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 	 */
 	rc_bar2_offset = 0;
 
+	if (dma_ranges) {
+		/*
+		 * The best-case scenario is to place the inbound
+		 * region in the first 4GB of pci-space, as some
+		 * legacy devices can only address 32bits.
+		 * We would also like to put the MSI under 4GB
+		 * as well, since some devices require a 32bit
+		 * MSI target address.
+		 */
+		if (total_mem_size <= 0xc0000000ULL &&
+		    rc_bar2_size <= 0x100000000ULL) {
+			rc_bar2_offset = 0;
+		} else {
+			/*
+			 * The system memory is 4GB or larger so we
+			 * cannot start the inbound region at location
+			 * 0 (since we have to allow some space for
+			 * outbound memory @ 3GB).  So instead we
+			 * start it at the 1x multiple of its size
+			 */
+			rc_bar2_offset = rc_bar2_size;
+		}
+
+	} else {
+		/*
+		 * Set simple configuration based on memory sizes
+		 * only.  We always start the viewport at address 0,
+		 * and set the MSI target address accordingly.
+		 */
+		rc_bar2_offset = 0;
+	}
+
 	tmp = lower_32_bits(rc_bar2_offset);
 	tmp = INSERT_FIELD(tmp, PCIE_MISC_RC_BAR2_CONFIG_LO, SIZE,
 			   encode_ibar_size(rc_bar2_size));
@@ -967,7 +1375,6 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 	struct brcm_pcie *pcie;
 	struct resource *res;
 	void __iomem *base;
-	u32 tmp;
 	struct pci_host_bridge *bridge;
 	struct pci_bus *child;
 
@@ -984,11 +1391,6 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
-	if (of_property_read_u32(dn, "dma-ranges", &tmp) == 0) {
-		dev_err(&pdev->dev, "cannot yet handle dma-ranges\n");
-		return -EINVAL;
-	}
-
 	data = of_id->data;
 	pcie->reg_offsets = data->offsets;
 	pcie->reg_field_info = data->reg_field_info;
-- 
GitLab


From 6fbefe88547929eff37b094b0704203f5bbfdc80 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 19 Feb 2019 22:06:59 +0000
Subject: [PATCH 0540/1835] PCI: brcmstb: Add MSI capability

This commit adds MSI to the Broadcom STB PCIe host controller. It does
not add MSIX since that functionality is not in the HW.  The MSI
controller is physically located within the PCIe block, however, there
is no reason why the MSI controller could not be moved elsewhere in
the future.

Since the internal Brcmstb MSI controller is intertwined with the PCIe
controller, it is not its own platform device but rather part of the
PCIe platform device.

Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
---
 drivers/pci/controller/pcie-brcmstb.c | 374 ++++++++++++++++++++++++--
 1 file changed, 353 insertions(+), 21 deletions(-)

diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index 27bcf83c99d7e..b028d4be81a23 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright (C) 2009 - 2017 Broadcom */
 
+#include <linux/bitops.h>
 #include <linux/clk.h>
 #include <linux/compiler.h>
 #include <linux/delay.h>
@@ -9,11 +10,13 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/irqdomain.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/log2.h>
 #include <linux/module.h>
+#include <linux/msi.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/of_pci.h>
@@ -47,6 +50,9 @@
 #define PCIE_MISC_RC_BAR2_CONFIG_LO			0x4034
 #define PCIE_MISC_RC_BAR2_CONFIG_HI			0x4038
 #define PCIE_MISC_RC_BAR3_CONFIG_LO			0x403c
+#define PCIE_MISC_MSI_BAR_CONFIG_LO			0x4044
+#define PCIE_MISC_MSI_BAR_CONFIG_HI			0x4048
+#define PCIE_MISC_MSI_DATA_CONFIG			0x404c
 #define PCIE_MISC_PCIE_CTRL				0x4064
 #define PCIE_MISC_PCIE_STATUS				0x4068
 #define PCIE_MISC_REVISION				0x406c
@@ -55,6 +61,7 @@
 #define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI		0x4084
 #define PCIE_MISC_HARD_PCIE_HARD_DEBUG			0x4204
 #define PCIE_INTR2_CPU_BASE				0x4300
+#define PCIE_MSI_INTR2_BASE				0x4500
 
 /*
  * Broadcom Settop Box PCIe Register Field shift and mask info. The
@@ -115,6 +122,8 @@
 
 #define BRCM_NUM_PCIE_OUT_WINS		0x4
 #define BRCM_MAX_SCB			0x4
+#define BRCM_INT_PCI_MSI_NR		32
+#define BRCM_PCIE_HW_REV_33		0x0303
 
 #define BRCM_MSI_TARGET_ADDR_LT_4GB	0x0fffffffcULL
 #define BRCM_MSI_TARGET_ADDR_GT_4GB	0xffffffffcULL
@@ -203,6 +212,33 @@ struct brcm_window {
 	dma_addr_t size;
 };
 
+struct brcm_msi {
+	struct device		*dev;
+	void __iomem		*base;
+	struct device_node	*dn;
+	struct irq_domain	*msi_domain;
+	struct irq_domain	*inner_domain;
+	struct mutex		lock; /* guards the alloc/free operations */
+	u64			target_addr;
+	int			irq;
+
+	/* intr_base is the base pointer for interrupt status/set/clr regs */
+	void __iomem		*intr_base;
+
+	/* intr_legacy_mask indicates how many bits are MSI interrupts */
+	u32			intr_legacy_mask;
+
+	/*
+	 * intr_legacy_offset indicates bit position of MSI_01. It is
+	 * to map the register bit position to a hwirq that starts at 0.
+	 */
+	u32			intr_legacy_offset;
+
+	/* used indicates which MSI interrupts have been alloc'd */
+	unsigned long		used;
+	unsigned int		rev;
+};
+
 /* Internal PCIe Host Controller Information.*/
 struct brcm_pcie {
 	struct device		*dev;
@@ -217,7 +253,10 @@ struct brcm_pcie {
 	int			num_out_wins;
 	bool			ssc;
 	int			gen;
+	u64			msi_target_addr;
 	struct brcm_window	out_wins[BRCM_NUM_PCIE_OUT_WINS];
+	struct brcm_msi		*msi;
+	bool			msi_internal;
 	unsigned int		rev;
 	const int		*reg_offsets;
 	const int		*reg_field_info;
@@ -225,9 +264,9 @@ struct brcm_pcie {
 };
 
 struct pcie_cfg_data {
-	const int *reg_field_info;
-	const int *offsets;
-	const enum pcie_type type;
+	const int		*reg_field_info;
+	const int		*offsets;
+	const enum pcie_type	type;
 };
 
 static const int pcie_reg_field_info[] = {
@@ -828,6 +867,267 @@ static void brcm_pcie_set_outbound_win(struct brcm_pcie *pcie,
 	}
 }
 
+static struct irq_chip brcm_msi_irq_chip = {
+	.name = "Brcm_MSI",
+	.irq_mask = pci_msi_mask_irq,
+	.irq_unmask = pci_msi_unmask_irq,
+};
+
+static struct msi_domain_info brcm_msi_domain_info = {
+	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
+		   MSI_FLAG_PCI_MSIX),
+	.chip	= &brcm_msi_irq_chip,
+};
+
+static void brcm_pcie_msi_isr(struct irq_desc *desc)
+{
+	struct irq_chip *chip = irq_desc_get_chip(desc);
+	struct brcm_msi *msi;
+	unsigned long status, virq;
+	u32 mask, bit, hwirq;
+	struct device *dev;
+
+	chained_irq_enter(chip, desc);
+	msi = irq_desc_get_handler_data(desc);
+	mask = msi->intr_legacy_mask;
+	dev = msi->dev;
+
+	while ((status = bcm_readl(msi->intr_base + STATUS) & mask)) {
+		for_each_set_bit(bit, &status, BRCM_INT_PCI_MSI_NR) {
+			/* clear the interrupt */
+			bcm_writel(1 << bit, msi->intr_base + CLR);
+
+			/* Account for legacy interrupt offset */
+			hwirq = bit - msi->intr_legacy_offset;
+
+			virq = irq_find_mapping(msi->inner_domain, hwirq);
+			if (virq) {
+				if (msi->used & (1 << hwirq))
+					generic_handle_irq(virq);
+				else
+					dev_info(dev, "unhandled MSI %d\n",
+						 hwirq);
+			} else {
+				/* Unknown MSI, just clear it */
+				dev_dbg(dev, "unexpected MSI\n");
+			}
+		}
+	}
+	chained_irq_exit(chip, desc);
+}
+
+static void brcm_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+{
+	struct brcm_msi *msi = irq_data_get_irq_chip_data(data);
+	u32 temp;
+
+	msg->address_lo = lower_32_bits(msi->target_addr);
+	msg->address_hi = upper_32_bits(msi->target_addr);
+	temp = bcm_readl(msi->base + PCIE_MISC_MSI_DATA_CONFIG);
+	msg->data = ((temp >> 16) & (temp & 0xffff)) | data->hwirq;
+}
+
+static int brcm_msi_set_affinity(struct irq_data *irq_data,
+				 const struct cpumask *mask, bool force)
+{
+	return -EINVAL;
+}
+
+static struct irq_chip brcm_msi_bottom_irq_chip = {
+	.name			= "Brcm_MSI",
+	.irq_compose_msi_msg	= brcm_compose_msi_msg,
+	.irq_set_affinity	= brcm_msi_set_affinity,
+};
+
+static int brcm_msi_alloc(struct brcm_msi *msi)
+{
+	int bit, hwirq;
+
+	mutex_lock(&msi->lock);
+	bit = ~msi->used ? ffz(msi->used) : -1;
+
+	if (bit >= 0 && bit < BRCM_INT_PCI_MSI_NR) {
+		msi->used |= (1 << bit);
+		hwirq = bit - msi->intr_legacy_offset;
+	} else {
+		hwirq = -ENOSPC;
+	}
+
+	mutex_unlock(&msi->lock);
+	return hwirq;
+}
+
+static void brcm_msi_free(struct brcm_msi *msi, unsigned long hwirq)
+{
+	mutex_lock(&msi->lock);
+	msi->used &= ~(1 << (hwirq + msi->intr_legacy_offset));
+	mutex_unlock(&msi->lock);
+}
+
+static int brcm_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+				 unsigned int nr_irqs, void *args)
+{
+	struct brcm_msi *msi = domain->host_data;
+	int hwirq;
+
+	hwirq = brcm_msi_alloc(msi);
+
+	if (hwirq < 0)
+		return hwirq;
+
+	irq_domain_set_info(domain, virq, (irq_hw_number_t)hwirq,
+			    &brcm_msi_bottom_irq_chip, domain->host_data,
+			    handle_simple_irq, NULL, NULL);
+	return 0;
+}
+
+static void brcm_irq_domain_free(struct irq_domain *domain,
+				 unsigned int virq, unsigned int nr_irqs)
+{
+	struct irq_data *d = irq_domain_get_irq_data(domain, virq);
+	struct brcm_msi *msi = irq_data_get_irq_chip_data(d);
+
+	brcm_msi_free(msi, d->hwirq);
+}
+
+static void brcm_msi_set_regs(struct brcm_msi *msi)
+{
+	u32 data_val, msi_lo, msi_hi;
+
+	if (msi->rev >= BRCM_PCIE_HW_REV_33) {
+		/*
+		 * ffe0 -- least sig 5 bits are 0 indicating 32 msgs
+		 * 6540 -- this is our arbitrary unique data value
+		 */
+		data_val = 0xffe06540;
+	} else {
+		/*
+		 * fff8 -- least sig 3 bits are 0 indicating 8 msgs
+		 * 6540 -- this is our arbitrary unique data value
+		 */
+		data_val = 0xfff86540;
+	}
+
+	/*
+	 * Make sure we are not masking MSIs.  Note that MSIs can be masked,
+	 * but that occurs on the PCIe EP device
+	 */
+	bcm_writel(0xffffffff & msi->intr_legacy_mask,
+		   msi->intr_base + MASK_CLR);
+
+	msi_lo = lower_32_bits(msi->target_addr);
+	msi_hi = upper_32_bits(msi->target_addr);
+	/*
+	 * The 0 bit of PCIE_MISC_MSI_BAR_CONFIG_LO is repurposed to MSI
+	 * enable, which we set to 1.
+	 */
+	bcm_writel(msi_lo | 1, msi->base + PCIE_MISC_MSI_BAR_CONFIG_LO);
+	bcm_writel(msi_hi, msi->base + PCIE_MISC_MSI_BAR_CONFIG_HI);
+	bcm_writel(data_val, msi->base + PCIE_MISC_MSI_DATA_CONFIG);
+}
+
+static const struct irq_domain_ops msi_domain_ops = {
+	.alloc	= brcm_irq_domain_alloc,
+	.free	= brcm_irq_domain_free,
+};
+
+static int brcm_allocate_domains(struct brcm_msi *msi)
+{
+	struct fwnode_handle *fwnode = of_node_to_fwnode(msi->dn);
+	struct device *dev = msi->dev;
+
+	msi->inner_domain = irq_domain_add_linear(NULL, BRCM_INT_PCI_MSI_NR,
+						  &msi_domain_ops, msi);
+	if (!msi->inner_domain) {
+		dev_err(dev, "failed to create IRQ domain\n");
+		return -ENOMEM;
+	}
+
+	msi->msi_domain = pci_msi_create_irq_domain(fwnode,
+						    &brcm_msi_domain_info,
+						    msi->inner_domain);
+	if (!msi->msi_domain) {
+		dev_err(dev, "failed to create MSI domain\n");
+		irq_domain_remove(msi->inner_domain);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static void brcm_free_domains(struct brcm_msi *msi)
+{
+	irq_domain_remove(msi->msi_domain);
+	irq_domain_remove(msi->inner_domain);
+}
+
+static void brcm_msi_remove(struct brcm_pcie *pcie)
+{
+	struct brcm_msi *msi = pcie->msi;
+
+	if (!msi)
+		return;
+	irq_set_chained_handler(msi->irq, NULL);
+	irq_set_handler_data(msi->irq, NULL);
+	brcm_free_domains(msi);
+}
+
+static int brcm_pcie_enable_msi(struct brcm_pcie *pcie)
+{
+	struct brcm_msi *msi;
+	int irq, ret;
+	struct device *dev = pcie->dev;
+
+	irq = irq_of_parse_and_map(dev->of_node, 1);
+	if (irq <= 0) {
+		dev_err(dev, "cannot map msi intr\n");
+		return -ENODEV;
+	}
+
+	msi = devm_kzalloc(dev, sizeof(struct brcm_msi), GFP_KERNEL);
+	if (!msi)
+		return -ENOMEM;
+
+	msi->dev = dev;
+	msi->base = pcie->base;
+	msi->rev =  pcie->rev;
+	msi->dn = pcie->dn;
+	msi->target_addr = pcie->msi_target_addr;
+	msi->irq = irq;
+
+	ret = brcm_allocate_domains(msi);
+	if (ret)
+		return ret;
+
+	irq_set_chained_handler_and_data(msi->irq, brcm_pcie_msi_isr, msi);
+
+	if (msi->rev >= BRCM_PCIE_HW_REV_33) {
+		msi->intr_base = msi->base + PCIE_MSI_INTR2_BASE;
+		/*
+		 * This version of PCIe hw has only 32 intr bits
+		 * starting at bit position 0.
+		 */
+		msi->intr_legacy_mask = 0xffffffff;
+		msi->intr_legacy_offset = 0x0;
+		msi->used = 0x0;
+
+	} else {
+		msi->intr_base = msi->base + PCIE_INTR2_CPU_BASE;
+		/*
+		 * This version of PCIe hw has only 8 intr bits starting
+		 * at bit position 24.
+		 */
+		msi->intr_legacy_mask = 0xff000000;
+		msi->intr_legacy_offset = 24;
+		msi->used = 0x00ffffff;
+	}
+
+	brcm_msi_set_regs(msi);
+	pcie->msi = msi;
+
+	return 0;
+}
+
 /* Configuration space read/write support */
 static int cfg_index(int busnr, int devfn, int reg)
 {
@@ -1072,6 +1372,7 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 	u16 nlw, cls, lnksta;
 	bool ssc_good = false;
 	struct device *dev = pcie->dev;
+	u64 msi_target_addr;
 
 	/* Reset the bridge */
 	brcm_pcie_bridge_sw_init_set(pcie, 1);
@@ -1116,27 +1417,24 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 	 * The PCIe host controller by design must set the inbound
 	 * viewport to be a contiguous arrangement of all of the
 	 * system's memory.  In addition, its size mut be a power of
-	 * two.  To further complicate matters, the viewport must
-	 * start on a pcie-address that is aligned on a multiple of its
-	 * size.  If a portion of the viewport does not represent
-	 * system memory -- e.g. 3GB of memory requires a 4GB viewport
-	 * -- we can map the outbound memory in or after 3GB and even
-	 * though the viewport will overlap the outbound memory the
-	 * controller will know to send outbound memory downstream and
-	 * everything else upstream.
+	 * two.  Further, the MSI target address must NOT be placed
+	 * inside this region, as the decoding logic will consider its
+	 * address to be inbound memory traffic.  To further
+	 * complicate matters, the viewport must start on a
+	 * pcie-address that is aligned on a multiple of its size.
+	 * If a portion of the viewport does not represent system
+	 * memory -- e.g. 3GB of memory requires a 4GB viewport --
+	 * we can map the outbound memory in or after 3GB and even
+	 * though the viewport will overlap the outbound memory
+	 * the controller will know to send outbound memory downstream
+	 * and everything else upstream.
 	 */
 	rc_bar2_size = roundup_pow_of_two_64(total_mem_size);
 
-	/*
-	 * Set simple configuration based on memory sizes
-	 * only.  We always start the viewport at address 0.
-	 */
-	rc_bar2_offset = 0;
-
 	if (dma_ranges) {
 		/*
 		 * The best-case scenario is to place the inbound
-		 * region in the first 4GB of pci-space, as some
+		 * region in the first 4GB of pcie-space, as some
 		 * legacy devices can only address 32bits.
 		 * We would also like to put the MSI under 4GB
 		 * as well, since some devices require a 32bit
@@ -1145,6 +1443,14 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 		if (total_mem_size <= 0xc0000000ULL &&
 		    rc_bar2_size <= 0x100000000ULL) {
 			rc_bar2_offset = 0;
+			/* If the viewport is less then 4GB we can fit
+			 * the MSI target address under 4GB. Otherwise
+			 * put it right below 64GB.
+			 */
+			msi_target_addr =
+				(rc_bar2_size == 0x100000000ULL)
+				? BRCM_MSI_TARGET_ADDR_GT_4GB
+				: BRCM_MSI_TARGET_ADDR_LT_4GB;
 		} else {
 			/*
 			 * The system memory is 4GB or larger so we
@@ -1154,8 +1460,12 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 			 * start it at the 1x multiple of its size
 			 */
 			rc_bar2_offset = rc_bar2_size;
-		}
 
+			/* Since we are starting the viewport at 4GB or
+			 * higher, put the MSI target address below 4GB
+			 */
+			msi_target_addr = BRCM_MSI_TARGET_ADDR_LT_4GB;
+		}
 	} else {
 		/*
 		 * Set simple configuration based on memory sizes
@@ -1163,7 +1473,12 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 		 * and set the MSI target address accordingly.
 		 */
 		rc_bar2_offset = 0;
+
+		msi_target_addr = (rc_bar2_size >= 0x100000000ULL)
+			? BRCM_MSI_TARGET_ADDR_GT_4GB
+			: BRCM_MSI_TARGET_ADDR_LT_4GB;
 	}
+	pcie->msi_target_addr = msi_target_addr;
 
 	tmp = lower_32_bits(rc_bar2_offset);
 	tmp = INSERT_FIELD(tmp, PCIE_MISC_RC_BAR2_CONFIG_LO, SIZE,
@@ -1333,6 +1648,9 @@ static int brcm_pcie_resume(struct device *dev)
 	if (ret)
 		return ret;
 
+	if (pcie->msi && pcie->msi_internal)
+		brcm_msi_set_regs(pcie->msi);
+
 	pcie->suspended = false;
 
 	return 0;
@@ -1340,6 +1658,7 @@ static int brcm_pcie_resume(struct device *dev)
 
 static void _brcm_pcie_remove(struct brcm_pcie *pcie)
 {
+	brcm_msi_remove(pcie);
 	turn_off(pcie);
 	clk_disable_unprepare(pcie->clk);
 	clk_put(pcie->clk);
@@ -1368,7 +1687,7 @@ MODULE_DEVICE_TABLE(of, brcm_pcie_match);
 
 static int brcm_pcie_probe(struct platform_device *pdev)
 {
-	struct device_node *dn = pdev->dev.of_node;
+	struct device_node *dn = pdev->dev.of_node, *msi_dn;
 	const struct of_device_id *of_id;
 	const struct pcie_cfg_data *data;
 	int ret;
@@ -1448,6 +1767,20 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 	if (ret)
 		goto fail;
 
+	msi_dn = of_parse_phandle(pcie->dn, "msi-parent", 0);
+	/* Use the internal MSI if no msi-parent property */
+	if (!msi_dn)
+		msi_dn = pcie->dn;
+
+	if (pci_msi_enabled() && msi_dn == pcie->dn) {
+		ret = brcm_pcie_enable_msi(pcie);
+		if (ret)
+			dev_err(pcie->dev,
+				"probe of internal MSI failed: %d)", ret);
+		else
+			pcie->msi_internal = true;
+	}
+
 	list_splice_init(&pcie->resources, &bridge->windows);
 	bridge->dev.parent = &pdev->dev;
 	bridge->busnr = 0;
@@ -1470,7 +1803,6 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 	pcie->root_bus = bridge->bus;
 
 	return 0;
-
 fail:
 	_brcm_pcie_remove(pcie);
 	return ret;
-- 
GitLab


From e3b54a0b302e3314bf06bf64bb0726280c5504d5 Mon Sep 17 00:00:00 2001
From: Jim Quinlan <jim2101024@gmail.com>
Date: Mon, 15 Jan 2018 18:28:39 -0500
Subject: [PATCH 0541/1835] dt-bindings: pci: Add DT docs for Brcmstb PCIe
 device

The DT bindings description of the Brcmstb PCIe device is described.  This
node can be used by almost all Broadcom settop box chips, using
ARM, ARM64, or MIPS CPU architectures.

Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
---
 .../devicetree/bindings/pci/brcmstb-pcie.txt  | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/pci/brcmstb-pcie.txt

diff --git a/Documentation/devicetree/bindings/pci/brcmstb-pcie.txt b/Documentation/devicetree/bindings/pci/brcmstb-pcie.txt
new file mode 100644
index 0000000000000..a1a9ad5e70cab
--- /dev/null
+++ b/Documentation/devicetree/bindings/pci/brcmstb-pcie.txt
@@ -0,0 +1,59 @@
+Brcmstb PCIe Host Controller Device Tree Bindings
+
+Required Properties:
+- compatible
+  "brcm,bcm7425-pcie" -- for 7425 family MIPS-based SOCs.
+  "brcm,bcm7435-pcie" -- for 7435 family MIPS-based SOCs.
+  "brcm,bcm7445-pcie" -- for 7445 and later ARM based SOCs (not including
+      the 7278).
+  "brcm,bcm7278-pcie"  -- for 7278 family ARM-based SOCs.
+
+- reg -- the register start address and length for the PCIe reg block.
+- interrupts -- two interrupts are specified; the first interrupt is for
+     the PCI host controller and the second is for MSI if the built-in
+     MSI controller is to be used.
+- interrupt-names -- names of the interrupts (above): "pcie" and "msi".
+- #address-cells -- set to <3>.
+- #size-cells -- set to <2>.
+- #interrupt-cells: set to <1>.
+- interrupt-map-mask and interrupt-map, standard PCI properties to define the
+     mapping of the PCIe interface to interrupt numbers.
+- ranges: ranges for the PCI memory and I/O regions.
+- linux,pci-domain -- should be unique per host controller.
+
+Optional Properties:
+- clocks -- phandle of pcie clock.
+- clock-names -- set to "sw_pcie" if clocks is used.
+- dma-ranges -- Specifies the inbound memory mapping regions when
+     an "identity map" is not possible.
+- msi-controller -- this property is typically specified to have the
+     PCIe controller use its internal MSI controller.
+- msi-parent -- set to use an external MSI interrupt controller.
+- brcm,enable-ssc -- (boolean) indicates usage of spread-spectrum clocking.
+- max-link-speed --  (integer) indicates desired generation of link:
+     1 => 2.5 Gbps (gen1), 2 => 5.0 Gbps (gen2), 3 => 8.0 Gbps (gen3).
+
+Example Node:
+
+pcie0: pcie@f0460000 {
+		reg = <0x0 0xf0460000 0x0 0x9310>;
+		interrupts = <0x0 0x0 0x4>;
+		compatible = "brcm,bcm7445-pcie";
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges = <0x02000000 0x00000000 0x00000000 0x00000000 0xc0000000 0x00000000 0x08000000
+			  0x02000000 0x00000000 0x08000000 0x00000000 0xc8000000 0x00000000 0x08000000>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0 0 0 7>;
+		interrupt-map = <0 0 0 1 &intc 0 47 3
+				 0 0 0 2 &intc 0 48 3
+				 0 0 0 3 &intc 0 49 3
+				 0 0 0 4 &intc 0 50 3>;
+		clocks = <&sw_pcie0>;
+		clock-names = "sw_pcie";
+		msi-parent = <&pcie0>;  /* use PCIe's internal MSI controller */
+		msi-controller;         /* use PCIe's internal MSI controller */
+		brcm,ssc;
+		max-link-speed = <1>;
+		linux,pci-domain = <0>;
+	};
-- 
GitLab


From 394bee8a25be0a7da404839decdd0865b6873ea3 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 19 Feb 2019 22:06:59 +0000
Subject: [PATCH 0542/1835] pcie-brcmstb: Changes for BCM2711

The initial brcmstb PCIe driver - originally taken from the V3(?)
patch set - has been modified significantly for the BCM2711.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/dma/bcm2835-dma.c                    | 107 ++++
 drivers/pci/controller/Makefile              |   4 +
 drivers/pci/controller/pcie-brcmstb-bounce.c | 564 +++++++++++++++++++
 drivers/pci/controller/pcie-brcmstb-bounce.h |  32 ++
 drivers/pci/controller/pcie-brcmstb.c        | 237 ++++----
 drivers/soc/bcm/brcmstb/Makefile             |   2 +-
 drivers/soc/bcm/brcmstb/memory.c             | 158 ++++++
 7 files changed, 996 insertions(+), 108 deletions(-)
 create mode 100644 drivers/pci/controller/pcie-brcmstb-bounce.c
 create mode 100644 drivers/pci/controller/pcie-brcmstb-bounce.h
 create mode 100644 drivers/soc/bcm/brcmstb/memory.c

diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 9c9d4e6275dd7..2514e9f3ffaeb 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -68,6 +68,17 @@ struct bcm2835_dma_cb {
 	uint32_t pad[2];
 };
 
+struct bcm2838_dma40_scb {
+	uint32_t ti;
+	uint32_t src;
+	uint32_t srci;
+	uint32_t dst;
+	uint32_t dsti;
+	uint32_t len;
+	uint32_t next_cb;
+	uint32_t rsvd;
+};
+
 struct bcm2835_cb_entry {
 	struct bcm2835_dma_cb *cb;
 	dma_addr_t paddr;
@@ -185,6 +196,45 @@ struct bcm2835_desc {
 #define MAX_DMA_LEN SZ_1G
 #define MAX_LITE_DMA_LEN (SZ_64K - 4)
 
+/* 40-bit DMA support */
+#define BCM2838_DMA40_CS	0x00
+#define BCM2838_DMA40_CB	0x04
+#define BCM2838_DMA40_DEBUG	0x0c
+#define BCM2858_DMA40_TI	0x10
+#define BCM2838_DMA40_SRC	0x14
+#define BCM2838_DMA40_SRCI	0x18
+#define BCM2838_DMA40_DEST	0x1c
+#define BCM2838_DMA40_DESTI	0x20
+#define BCM2838_DMA40_LEN	0x24
+#define BCM2838_DMA40_NEXT_CB	0x28
+#define BCM2838_DMA40_DEBUG2	0x2c
+
+#define BCM2838_DMA40_CS_ACTIVE	BIT(0)
+#define BCM2838_DMA40_CS_END	BIT(1)
+
+#define BCM2838_DMA40_CS_QOS(x)	(((x) & 0x1f) << 16)
+#define BCM2838_DMA40_CS_PANIC_QOS(x)	(((x) & 0x1f) << 20)
+#define BCM2838_DMA40_CS_WRITE_WAIT	BIT(28)
+
+#define BCM2838_DMA40_BURST_LEN(x)	((((x) - 1) & 0xf) << 8)
+#define BCM2838_DMA40_INC		BIT(12)
+#define BCM2838_DMA40_SIZE_128	(2 << 13)
+
+#define BCM2838_DMA40_MEMCPY_QOS \
+	(BCM2838_DMA40_CS_QOS(0x0) | \
+	 BCM2838_DMA40_CS_PANIC_QOS(0x0) | \
+	 BCM2838_DMA40_CS_WRITE_WAIT)
+
+#define BCM2838_DMA40_MEMCPY_XFER_INFO \
+	(BCM2838_DMA40_SIZE_128 | \
+	 BCM2838_DMA40_INC | \
+	 BCM2838_DMA40_BURST_LEN(16))
+
+static void __iomem *memcpy_chan;
+static struct bcm2838_dma40_scb *memcpy_scb;
+static dma_addr_t memcpy_scb_dma;
+DEFINE_SPINLOCK(memcpy_lock);
+
 static inline size_t bcm2835_dma_max_frame_length(struct bcm2835_chan *c)
 {
 	/* lite and normal channels have different max frame length */
@@ -868,6 +918,56 @@ static void bcm2835_dma_free(struct bcm2835_dmadev *od)
 	}
 }
 
+int bcm2838_dma40_memcpy_init(struct device *dev)
+{
+	if (memcpy_scb)
+		return 0;
+
+	memcpy_scb = dma_alloc_coherent(dev, sizeof(*memcpy_scb),
+					&memcpy_scb_dma, GFP_KERNEL);
+
+	if (!memcpy_scb) {
+		pr_err("bcm2838_dma40_memcpy_init failed!\n");
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL(bcm2838_dma40_memcpy_init);
+
+void bcm2838_dma40_memcpy(dma_addr_t dst, dma_addr_t src, size_t size)
+{
+	struct bcm2838_dma40_scb *scb = memcpy_scb;
+	unsigned long flags;
+
+	if (!scb) {
+		pr_err("bcm2838_dma40_memcpy not initialised!\n");
+		return;
+	}
+
+	spin_lock_irqsave(&memcpy_lock, flags);
+
+	scb->ti = 0;
+	scb->src = lower_32_bits(src);
+	scb->srci = upper_32_bits(src) | BCM2838_DMA40_MEMCPY_XFER_INFO;
+	scb->dst = lower_32_bits(dst);
+	scb->dsti = upper_32_bits(dst) | BCM2838_DMA40_MEMCPY_XFER_INFO;
+	scb->len = size;
+	scb->next_cb = 0;
+
+	writel((u32)(memcpy_scb_dma >> 5), memcpy_chan + BCM2838_DMA40_CB);
+	writel(BCM2838_DMA40_MEMCPY_QOS + BCM2838_DMA40_CS_ACTIVE,
+	       memcpy_chan + BCM2838_DMA40_CS);
+	/* Poll for completion */
+	while (!(readl(memcpy_chan + BCM2838_DMA40_CS) & BCM2838_DMA40_CS_END))
+		cpu_relax();
+
+	writel(BCM2838_DMA40_CS_END, memcpy_chan + BCM2838_DMA40_CS);
+
+	spin_unlock_irqrestore(&memcpy_lock, flags);
+}
+EXPORT_SYMBOL(bcm2838_dma40_memcpy);
+
 static const struct of_device_id bcm2835_dma_of_match[] = {
 	{ .compatible = "brcm,bcm2835-dma", },
 	{},
@@ -964,6 +1064,13 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 	/* Channel 0 is used by the legacy API */
 	chans_available &= ~BCM2835_DMA_BULK_MASK;
 
+	/* We can't use channels 11-13 yet */
+	chans_available &= ~(BIT(11) | BIT(12) | BIT(13));
+
+	/* Grab channel 14 for the 40-bit DMA memcpy */
+	chans_available &= ~BIT(14);
+	memcpy_chan = BCM2835_DMA_CHANIO(base, 14);
+
 	/* get irqs for each channel that we support */
 	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
 		/* skip masked out channels */
diff --git a/drivers/pci/controller/Makefile b/drivers/pci/controller/Makefile
index 582d052a49fb8..c40b7b982ea48 100644
--- a/drivers/pci/controller/Makefile
+++ b/drivers/pci/controller/Makefile
@@ -29,6 +29,10 @@ obj-$(CONFIG_PCIE_MEDIATEK) += pcie-mediatek.o
 obj-$(CONFIG_PCIE_MOBIVEIL) += pcie-mobiveil.o
 obj-$(CONFIG_PCIE_TANGO_SMP8759) += pcie-tango.o
 obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb.o
+ifdef CONFIG_ARM
+obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb-bounce.o
+endif
+
 obj-$(CONFIG_VMD) += vmd.o
 # pcie-hisi.o quirks are needed even without CONFIG_PCIE_DW
 obj-y				+= dwc/
diff --git a/drivers/pci/controller/pcie-brcmstb-bounce.c b/drivers/pci/controller/pcie-brcmstb-bounce.c
new file mode 100644
index 0000000000000..2f59459308d60
--- /dev/null
+++ b/drivers/pci/controller/pcie-brcmstb-bounce.c
@@ -0,0 +1,564 @@
+/*
+ *  This code started out as a version of arch/arm/common/dmabounce.c,
+ *  modified to cope with highmem pages. Now it has been changed heavily -
+ *  it now preallocates a large block (currently 4MB) and carves it up
+ *  sequentially in ring fashion, and DMA is used to copy the data - to the
+ *  point where very little of the original remains.
+ *
+ *  Copyright (C) 2019 Raspberry Pi (Trading) Ltd.
+ *
+ *  Original version by Brad Parker (brad@heeltoe.com)
+ *  Re-written by Christopher Hoover <ch@murgatroid.com>
+ *  Made generic by Deepak Saxena <dsaxena@plexity.net>
+ *
+ *  Copyright (C) 2002 Hewlett Packard Company.
+ *  Copyright (C) 2004 MontaVista Software, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  version 2 as published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/page-flags.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
+#include <linux/list.h>
+#include <linux/scatterlist.h>
+#include <linux/bitmap.h>
+
+#include <asm/cacheflush.h>
+#include <asm/dma-iommu.h>
+
+#define STATS
+
+#ifdef STATS
+#define DO_STATS(X) do { X ; } while (0)
+#else
+#define DO_STATS(X) do { } while (0)
+#endif
+
+/* ************************************************** */
+
+struct safe_buffer {
+	struct list_head node;
+
+	/* original request */
+	size_t		size;
+	int		direction;
+
+	struct dmabounce_pool *pool;
+	void		*safe;
+	dma_addr_t	unsafe_dma_addr;
+	dma_addr_t	safe_dma_addr;
+};
+
+struct dmabounce_pool {
+	unsigned long	pages;
+	void		*virt_addr;
+	dma_addr_t	dma_addr;
+	unsigned long	*alloc_map;
+	unsigned long	alloc_pos;
+	spinlock_t	lock;
+	struct device	*dev;
+	unsigned long   num_pages;
+#ifdef STATS
+	size_t		max_size;
+	unsigned long	num_bufs;
+	unsigned long   max_bufs;
+	unsigned long   max_pages;
+#endif
+};
+
+struct dmabounce_device_info {
+	struct device *dev;
+	dma_addr_t threshold;
+	struct list_head safe_buffers;
+	struct dmabounce_pool pool;
+	rwlock_t lock;
+#ifdef STATS
+	unsigned long map_count;
+	unsigned long unmap_count;
+	unsigned long sync_dev_count;
+	unsigned long sync_cpu_count;
+	unsigned long fail_count;
+	int attr_res;
+#endif
+};
+
+static struct dmabounce_device_info *g_dmabounce_device_info;
+
+extern int bcm2838_dma40_memcpy_init(struct device *dev);
+extern void bcm2838_dma40_memcpy(dma_addr_t dst, dma_addr_t src, size_t size);
+
+#ifdef STATS
+static ssize_t
+bounce_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
+	return sprintf(buf, "m:%lu/%lu s:%lu/%lu f:%lu s:%zu b:%lu/%lu a:%lu/%lu\n",
+		device_info->map_count,
+		device_info->unmap_count,
+		device_info->sync_dev_count,
+		device_info->sync_cpu_count,
+		device_info->fail_count,
+		device_info->pool.max_size,
+		device_info->pool.num_bufs,
+		device_info->pool.max_bufs,
+		device_info->pool.num_pages * PAGE_SIZE,
+		device_info->pool.max_pages * PAGE_SIZE);
+}
+
+static DEVICE_ATTR(dmabounce_stats, 0444, bounce_show, NULL);
+#endif
+
+static int bounce_create(struct dmabounce_pool *pool, struct device *dev,
+			 unsigned long buffer_size)
+{
+	int ret = -ENOMEM;
+	pool->pages = (buffer_size + PAGE_SIZE - 1)/PAGE_SIZE;
+	pool->alloc_map = bitmap_zalloc(pool->pages, GFP_KERNEL);
+	if (!pool->alloc_map)
+		goto err_bitmap;
+	pool->virt_addr = dma_alloc_coherent(dev, pool->pages * PAGE_SIZE,
+					     &pool->dma_addr, GFP_KERNEL);
+	if (!pool->virt_addr)
+		goto err_dmabuf;
+
+	pool->alloc_pos = 0;
+	spin_lock_init(&pool->lock);
+	pool->dev = dev;
+	pool->num_pages = 0;
+
+	DO_STATS(pool->max_size = 0);
+	DO_STATS(pool->num_bufs = 0);
+	DO_STATS(pool->max_bufs = 0);
+	DO_STATS(pool->max_pages = 0);
+
+	return  0;
+
+err_dmabuf:
+	bitmap_free(pool->alloc_map);
+err_bitmap:
+	return ret;
+}
+
+static void bounce_destroy(struct dmabounce_pool *pool)
+{
+	dma_free_coherent(pool->dev, pool->pages * PAGE_SIZE, pool->virt_addr,
+			  pool->dma_addr);
+
+	bitmap_free(pool->alloc_map);
+}
+
+static void *bounce_alloc(struct dmabounce_pool *pool, size_t size,
+			  dma_addr_t *dmaaddrp)
+{
+	unsigned long pages;
+	unsigned long flags;
+	unsigned long pos;
+
+	pages = (size + PAGE_SIZE - 1)/PAGE_SIZE;
+
+	DO_STATS(pool->max_size = max(size, pool->max_size));
+
+	spin_lock_irqsave(&pool->lock, flags);
+	pos = bitmap_find_next_zero_area(pool->alloc_map, pool->pages,
+					 pool->alloc_pos, pages, 0);
+	/* If not found, try from the start */
+	if (pos >= pool->pages && pool->alloc_pos)
+		pos = bitmap_find_next_zero_area(pool->alloc_map, pool->pages,
+						 0, pages, 0);
+
+	if (pos >= pool->pages) {
+		spin_unlock_irqrestore(&pool->lock, flags);
+		return NULL;
+	}
+
+	bitmap_set(pool->alloc_map, pos, pages);
+	pool->alloc_pos = (pos + pages) % pool->pages;
+	pool->num_pages += pages;
+
+	DO_STATS(pool->num_bufs++);
+	DO_STATS(pool->max_bufs = max(pool->num_bufs, pool->max_bufs));
+	DO_STATS(pool->max_pages = max(pool->num_pages, pool->max_pages));
+
+	spin_unlock_irqrestore(&pool->lock, flags);
+
+	*dmaaddrp = pool->dma_addr + pos * PAGE_SIZE;
+
+	return pool->virt_addr + pos * PAGE_SIZE;
+}
+
+static void
+bounce_free(struct dmabounce_pool *pool, void *buf, size_t size)
+{
+	unsigned long pages;
+	unsigned long flags;
+	unsigned long pos;
+
+	pages = (size + PAGE_SIZE - 1)/PAGE_SIZE;
+	pos = (buf - pool->virt_addr)/PAGE_SIZE;
+
+	BUG_ON((buf - pool->virt_addr) & (PAGE_SIZE - 1));
+
+	spin_lock_irqsave(&pool->lock, flags);
+	bitmap_clear(pool->alloc_map, pos, pages);
+	pool->num_pages -= pages;
+	if (pool->num_pages == 0)
+		pool->alloc_pos = 0;
+	DO_STATS(pool->num_bufs--);
+	spin_unlock_irqrestore(&pool->lock, flags);
+}
+
+/* allocate a 'safe' buffer and keep track of it */
+static struct safe_buffer *
+alloc_safe_buffer(struct dmabounce_device_info *device_info,
+		  dma_addr_t dma_addr, size_t size, enum dma_data_direction dir)
+{
+	struct safe_buffer *buf;
+	struct dmabounce_pool *pool = &device_info->pool;
+	struct device *dev = device_info->dev;
+	unsigned long flags;
+
+	/*
+	 * Although one might expect this to be called in thread context,
+	 * using GFP_KERNEL here leads to hard-to-debug lockups. in_atomic()
+	 * was previously used to select the appropriate allocation mode,
+	 * but this is unsafe.
+	 */
+	buf = kmalloc(sizeof(struct safe_buffer), GFP_ATOMIC);
+	if (!buf) {
+		dev_warn(dev, "%s: kmalloc failed\n", __func__);
+		return NULL;
+	}
+
+	buf->unsafe_dma_addr = dma_addr;
+	buf->size = size;
+	buf->direction = dir;
+	buf->pool = pool;
+
+	buf->safe = bounce_alloc(pool, size, &buf->safe_dma_addr);
+
+	if (!buf->safe) {
+		dev_warn(dev,
+			 "%s: could not alloc dma memory (size=%d)\n",
+			 __func__, size);
+		kfree(buf);
+		return NULL;
+	}
+
+	write_lock_irqsave(&device_info->lock, flags);
+	list_add(&buf->node, &device_info->safe_buffers);
+	write_unlock_irqrestore(&device_info->lock, flags);
+
+	return buf;
+}
+
+/* determine if a buffer is from our "safe" pool */
+static struct safe_buffer *
+find_safe_buffer(struct dmabounce_device_info *device_info,
+		 dma_addr_t safe_dma_addr)
+{
+	struct safe_buffer *b, *rb = NULL;
+	unsigned long flags;
+
+	read_lock_irqsave(&device_info->lock, flags);
+
+	list_for_each_entry(b, &device_info->safe_buffers, node)
+		if (b->safe_dma_addr <= safe_dma_addr &&
+		    b->safe_dma_addr + b->size > safe_dma_addr) {
+			rb = b;
+			break;
+		}
+
+	read_unlock_irqrestore(&device_info->lock, flags);
+	return rb;
+}
+
+static void
+free_safe_buffer(struct dmabounce_device_info *device_info,
+		 struct safe_buffer *buf)
+{
+	unsigned long flags;
+
+	write_lock_irqsave(&device_info->lock, flags);
+	list_del(&buf->node);
+	write_unlock_irqrestore(&device_info->lock, flags);
+
+	bounce_free(buf->pool, buf->safe, buf->size);
+
+	kfree(buf);
+}
+
+/* ************************************************** */
+
+static struct safe_buffer *
+find_safe_buffer_dev(struct device *dev, dma_addr_t dma_addr, const char *where)
+{
+	if (!dev || !g_dmabounce_device_info)
+		return NULL;
+	if (dma_mapping_error(dev, dma_addr)) {
+		dev_err(dev, "Trying to %s invalid mapping\n", where);
+		return NULL;
+	}
+	return find_safe_buffer(g_dmabounce_device_info, dma_addr);
+}
+
+static dma_addr_t
+map_single(struct device *dev, struct safe_buffer *buf, size_t size,
+	   enum dma_data_direction dir, unsigned long attrs)
+{
+	BUG_ON(buf->size != size);
+	BUG_ON(buf->direction != dir);
+
+	dev_dbg(dev, "map: %llx->%llx\n", (u64)buf->unsafe_dma_addr,
+		(u64)buf->safe_dma_addr);
+
+	if ((dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL) &&
+	    !(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+		bcm2838_dma40_memcpy(buf->safe_dma_addr, buf->unsafe_dma_addr,
+				     size);
+
+	return buf->safe_dma_addr;
+}
+
+static dma_addr_t
+unmap_single(struct device *dev, struct safe_buffer *buf, size_t size,
+	     enum dma_data_direction dir, unsigned long attrs)
+{
+	BUG_ON(buf->size != size);
+	BUG_ON(buf->direction != dir);
+
+	if ((dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL) &&
+	    !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) {
+		dev_dbg(dev, "unmap: %llx->%llx\n", (u64)buf->safe_dma_addr,
+			(u64)buf->unsafe_dma_addr);
+
+		bcm2838_dma40_memcpy(buf->unsafe_dma_addr, buf->safe_dma_addr,
+				     size);
+	}
+	return buf->unsafe_dma_addr;
+}
+
+/* ************************************************** */
+
+/*
+ * see if a buffer address is in an 'unsafe' range.  if it is
+ * allocate a 'safe' buffer and copy the unsafe buffer into it.
+ * substitute the safe buffer for the unsafe one.
+ * (basically move the buffer from an unsafe area to a safe one)
+ */
+static dma_addr_t
+dmabounce_map_page(struct device *dev, struct page *page, unsigned long offset,
+		   size_t size, enum dma_data_direction dir,
+		   unsigned long attrs)
+{
+	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
+	dma_addr_t dma_addr;
+
+	dma_addr = pfn_to_dma(dev, page_to_pfn(page)) + offset;
+
+	arm_dma_ops.sync_single_for_device(dev, dma_addr, size, dir);
+
+	if (device_info && (dma_addr + size) > device_info->threshold) {
+		struct safe_buffer *buf;
+
+		buf = alloc_safe_buffer(device_info, dma_addr, size, dir);
+		if (!buf) {
+			DO_STATS(device_info->fail_count++);
+			return ARM_MAPPING_ERROR;
+		}
+
+		DO_STATS(device_info->map_count++);
+
+		dma_addr = map_single(dev, buf, size, dir, attrs);
+	}
+
+	return dma_addr;
+}
+
+/*
+ * see if a mapped address was really a "safe" buffer and if so, copy
+ * the data from the safe buffer back to the unsafe buffer and free up
+ * the safe buffer.  (basically return things back to the way they
+ * should be)
+ */
+static void
+dmabounce_unmap_page(struct device *dev, dma_addr_t dma_addr, size_t size,
+		     enum dma_data_direction dir, unsigned long attrs)
+{
+	struct safe_buffer *buf;
+
+	buf = find_safe_buffer_dev(dev, dma_addr, __func__);
+	if (buf) {
+		DO_STATS(g_dmabounce_device_info->unmap_count++);
+		dma_addr = unmap_single(dev, buf, size, dir, attrs);
+		free_safe_buffer(g_dmabounce_device_info, buf);
+	}
+
+	arm_dma_ops.sync_single_for_cpu(dev, dma_addr, size, dir);
+}
+
+/*
+ * A version of dmabounce_map_page that assumes the mapping has already
+ * been created - intended for streaming operation.
+ */
+static void
+dmabounce_sync_for_device(struct device *dev, dma_addr_t dma_addr, size_t size,
+			  enum dma_data_direction dir)
+{
+	struct safe_buffer *buf;
+
+	arm_dma_ops.sync_single_for_device(dev, dma_addr, size, dir);
+
+	buf = find_safe_buffer_dev(dev, dma_addr, __func__);
+	if (buf) {
+		DO_STATS(g_dmabounce_device_info->sync_dev_count++);
+		map_single(dev, buf, size, dir, 0);
+	}
+}
+
+/*
+ * A version of dmabounce_unmap_page that doesn't destroy the mapping -
+ * intended for streaming operation.
+ */
+static void
+dmabounce_sync_for_cpu(struct device *dev, dma_addr_t dma_addr,
+		       size_t size, enum dma_data_direction dir)
+{
+	struct safe_buffer *buf;
+
+	buf = find_safe_buffer_dev(dev, dma_addr, __func__);
+	if (buf) {
+		DO_STATS(g_dmabounce_device_info->sync_cpu_count++);
+		dma_addr = unmap_single(dev, buf, size, dir, 0);
+	}
+
+	arm_dma_ops.sync_single_for_cpu(dev, dma_addr, size, dir);
+}
+
+static int dmabounce_dma_supported(struct device *dev, u64 dma_mask)
+{
+	if (g_dmabounce_device_info)
+		return 0;
+
+	return arm_dma_ops.dma_supported(dev, dma_mask);
+}
+
+static int dmabounce_mapping_error(struct device *dev, dma_addr_t dma_addr)
+{
+	return arm_dma_ops.mapping_error(dev, dma_addr);
+}
+
+static const struct dma_map_ops dmabounce_ops = {
+	.alloc			= arm_dma_alloc,
+	.free			= arm_dma_free,
+	.mmap			= arm_dma_mmap,
+	.get_sgtable		= arm_dma_get_sgtable,
+	.map_page		= dmabounce_map_page,
+	.unmap_page		= dmabounce_unmap_page,
+	.sync_single_for_cpu	= dmabounce_sync_for_cpu,
+	.sync_single_for_device	= dmabounce_sync_for_device,
+	.map_sg			= arm_dma_map_sg,
+	.unmap_sg		= arm_dma_unmap_sg,
+	.sync_sg_for_cpu	= arm_dma_sync_sg_for_cpu,
+	.sync_sg_for_device	= arm_dma_sync_sg_for_device,
+	.dma_supported		= dmabounce_dma_supported,
+	.mapping_error		= dmabounce_mapping_error,
+};
+
+int brcm_pcie_bounce_register_dev(struct device *dev,
+				  unsigned long buffer_size,
+				  dma_addr_t threshold)
+{
+	struct dmabounce_device_info *device_info;
+	int ret;
+
+	/* Only support a single client */
+	if (g_dmabounce_device_info)
+		return -EBUSY;
+
+	ret = bcm2838_dma40_memcpy_init(dev);
+	if (ret)
+	    return ret;
+
+	device_info = kmalloc(sizeof(struct dmabounce_device_info), GFP_ATOMIC);
+	if (!device_info) {
+		dev_err(dev,
+			"Could not allocated dmabounce_device_info\n");
+		return -ENOMEM;
+	}
+
+	ret = bounce_create(&device_info->pool, dev, buffer_size);
+	if (ret) {
+		dev_err(dev,
+			"dmabounce: could not allocate %ld byte DMA pool\n",
+			buffer_size);
+		goto err_bounce;
+	}
+
+	device_info->dev = dev;
+	device_info->threshold = threshold;
+	INIT_LIST_HEAD(&device_info->safe_buffers);
+	rwlock_init(&device_info->lock);
+
+	DO_STATS(device_info->map_count = 0);
+	DO_STATS(device_info->unmap_count = 0);
+	DO_STATS(device_info->sync_dev_count = 0);
+	DO_STATS(device_info->sync_cpu_count = 0);
+	DO_STATS(device_info->fail_count = 0);
+	DO_STATS(device_info->attr_res =
+		 device_create_file(dev, &dev_attr_dmabounce_stats));
+
+	g_dmabounce_device_info = device_info;
+	set_dma_ops(dev, &dmabounce_ops);
+
+	dev_info(dev, "dmabounce: registered device - %ld kB, threshold %pad\n",
+		 buffer_size / 1024, &threshold);
+
+	return 0;
+
+ err_bounce:
+	kfree(device_info);
+	return ret;
+}
+EXPORT_SYMBOL(brcm_pcie_bounce_register_dev);
+
+void brcm_pcie_bounce_unregister_dev(struct device *dev)
+{
+	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
+
+	g_dmabounce_device_info = NULL;
+	set_dma_ops(dev, NULL);
+
+	if (!device_info) {
+		dev_warn(dev,
+			 "Never registered with dmabounce but attempting"
+			 "to unregister!\n");
+		return;
+	}
+
+	if (!list_empty(&device_info->safe_buffers)) {
+		dev_err(dev,
+			"Removing from dmabounce with pending buffers!\n");
+		BUG();
+	}
+
+	bounce_destroy(&device_info->pool);
+
+	DO_STATS(if (device_info->attr_res == 0)
+			 device_remove_file(dev, &dev_attr_dmabounce_stats));
+
+	kfree(device_info);
+
+	dev_info(dev, "dmabounce: device unregistered\n");
+}
+EXPORT_SYMBOL(brcm_pcie_bounce_unregister_dev);
+
+MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
+MODULE_DESCRIPTION("Dedicate DMA bounce support for pcie-brcmstb");
+MODULE_LICENSE("GPL");
diff --git a/drivers/pci/controller/pcie-brcmstb-bounce.h b/drivers/pci/controller/pcie-brcmstb-bounce.h
new file mode 100644
index 0000000000000..5d07f679dc71b
--- /dev/null
+++ b/drivers/pci/controller/pcie-brcmstb-bounce.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ *  Copyright (C) 2019 Raspberry Pi (Trading) Ltd.
+ */
+
+#ifndef _PCIE_BRCMSTB_BOUNCE_H
+#define _PCIE_BRCMSTB_BOUNCE_H
+
+#ifdef CONFIG_ARM
+
+int brcm_pcie_bounce_register_dev(struct device *dev, unsigned long buffer_size,
+				  dma_addr_t threshold);
+
+int brcm_pcie_bounce_unregister_dev(struct device *dev);
+
+#else
+
+static inline int brcm_pcie_bounce_register_dev(struct device *dev,
+						unsigned long buffer_size,
+						dma_addr_t threshold)
+{
+	return 0;
+}
+
+static inline int brcm_pcie_bounce_unregister_dev(struct device *dev)
+{
+	return 0;
+}
+
+#endif
+
+#endif /* _PCIE_BRCMSTB_BOUNCE_H */
diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index b028d4be81a23..c988013a2c269 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -29,6 +29,7 @@
 #include <linux/string.h>
 #include <linux/types.h>
 #include "../pci.h"
+#include "pcie-brcmstb-bounce.h"
 
 /* BRCM_PCIE_CAP_REGS - Offset for the mandatory capability config regs */
 #define BRCM_PCIE_CAP_REGS				0x00ac
@@ -53,6 +54,7 @@
 #define PCIE_MISC_MSI_BAR_CONFIG_LO			0x4044
 #define PCIE_MISC_MSI_BAR_CONFIG_HI			0x4048
 #define PCIE_MISC_MSI_DATA_CONFIG			0x404c
+#define PCIE_MISC_EOI_CTRL				0x4060
 #define PCIE_MISC_PCIE_CTRL				0x4064
 #define PCIE_MISC_PCIE_STATUS				0x4068
 #define PCIE_MISC_REVISION				0x406c
@@ -260,12 +262,14 @@ struct brcm_pcie {
 	unsigned int		rev;
 	const int		*reg_offsets;
 	const int		*reg_field_info;
+	u32			max_burst_size;
 	enum pcie_type		type;
 };
 
 struct pcie_cfg_data {
 	const int		*reg_field_info;
 	const int		*offsets;
+	const u32		max_burst_size;
 	const enum pcie_type	type;
 };
 
@@ -288,24 +292,27 @@ static const int pcie_offset_bcm7425[] = {
 static const struct pcie_cfg_data bcm7425_cfg = {
 	.reg_field_info	= pcie_reg_field_info,
 	.offsets	= pcie_offset_bcm7425,
+	.max_burst_size	= BURST_SIZE_256,
 	.type		= BCM7425,
 };
 
 static const int pcie_offsets[] = {
 	[RGR1_SW_INIT_1] = 0x9210,
 	[EXT_CFG_INDEX]  = 0x9000,
-	[EXT_CFG_DATA]   = 0x9004,
+	[EXT_CFG_DATA]   = 0x8000,
 };
 
 static const struct pcie_cfg_data bcm7435_cfg = {
 	.reg_field_info	= pcie_reg_field_info,
 	.offsets	= pcie_offsets,
+	.max_burst_size	= BURST_SIZE_256,
 	.type		= BCM7435,
 };
 
 static const struct pcie_cfg_data generic_cfg = {
 	.reg_field_info	= pcie_reg_field_info,
 	.offsets	= pcie_offsets,
+	.max_burst_size	= BURST_SIZE_128, // before BURST_SIZE_512
 	.type		= GENERIC,
 };
 
@@ -318,6 +325,7 @@ static const int pcie_offset_bcm7278[] = {
 static const struct pcie_cfg_data bcm7278_cfg = {
 	.reg_field_info = pcie_reg_field_info_bcm7278,
 	.offsets	= pcie_offset_bcm7278,
+	.max_burst_size	= BURST_SIZE_512,
 	.type		= BCM7278,
 };
 
@@ -360,7 +368,6 @@ static struct pci_ops brcm_pcie_ops = {
 	 (reg##_##field##_MASK & (field_val << reg##_##field##_SHIFT)))
 
 static const struct dma_map_ops *arch_dma_ops;
-static const struct dma_map_ops *brcm_dma_ops_ptr;
 static struct of_pci_range *dma_ranges;
 static int num_dma_ranges;
 
@@ -369,6 +376,16 @@ static int num_memc;
 static int num_pcie;
 static DEFINE_MUTEX(brcm_pcie_lock);
 
+static unsigned int bounce_buffer = 32*1024*1024;
+module_param(bounce_buffer, uint, 0644);
+MODULE_PARM_DESC(bounce_buffer, "Size of bounce buffer");
+
+static unsigned int bounce_threshold = 0xc0000000;
+module_param(bounce_threshold, uint, 0644);
+MODULE_PARM_DESC(bounce_threshold, "Bounce threshold");
+
+static struct brcm_pcie *g_pcie;
+
 static dma_addr_t brcm_to_pci(dma_addr_t addr)
 {
 	struct of_pci_range *p;
@@ -457,12 +474,10 @@ static int brcm_map_sg(struct device *dev, struct scatterlist *sgl,
 	struct scatterlist *sg;
 
 	for_each_sg(sgl, sg, nents, i) {
-#ifdef CONFIG_NEED_SG_DMA_LENGTH
-		sg->dma_length = sg->length;
-#endif
+		sg_dma_len(sg) = sg->length;
 		sg->dma_address =
-			brcm_dma_ops_ptr->map_page(dev, sg_page(sg), sg->offset,
-						   sg->length, dir, attrs);
+			brcm_map_page(dev, sg_page(sg), sg->offset,
+				      sg->length, dir, attrs);
 		if (dma_mapping_error(dev, sg->dma_address))
 			goto bad_mapping;
 	}
@@ -470,8 +485,8 @@ static int brcm_map_sg(struct device *dev, struct scatterlist *sgl,
 
 bad_mapping:
 	for_each_sg(sgl, sg, i, j)
-		brcm_dma_ops_ptr->unmap_page(dev, sg_dma_address(sg),
-					     sg_dma_len(sg), dir, attrs);
+		brcm_unmap_page(dev, sg_dma_address(sg),
+				sg_dma_len(sg), dir, attrs);
 	return 0;
 }
 
@@ -484,8 +499,8 @@ static void brcm_unmap_sg(struct device *dev,
 	struct scatterlist *sg;
 
 	for_each_sg(sgl, sg, nents, i)
-		brcm_dma_ops_ptr->unmap_page(dev, sg_dma_address(sg),
-					     sg_dma_len(sg), dir, attrs);
+		brcm_unmap_page(dev, sg_dma_address(sg),
+				sg_dma_len(sg), dir, attrs);
 }
 
 static void brcm_sync_single_for_cpu(struct device *dev,
@@ -531,8 +546,8 @@ void brcm_sync_sg_for_cpu(struct device *dev, struct scatterlist *sgl,
 	int i;
 
 	for_each_sg(sgl, sg, nents, i)
-		brcm_dma_ops_ptr->sync_single_for_cpu(dev, sg_dma_address(sg),
-						      sg->length, dir);
+		brcm_sync_single_for_cpu(dev, sg_dma_address(sg),
+					 sg->length, dir);
 }
 
 void brcm_sync_sg_for_device(struct device *dev, struct scatterlist *sgl,
@@ -542,9 +557,9 @@ void brcm_sync_sg_for_device(struct device *dev, struct scatterlist *sgl,
 	int i;
 
 	for_each_sg(sgl, sg, nents, i)
-		brcm_dma_ops_ptr->sync_single_for_device(dev,
-							 sg_dma_address(sg),
-							 sg->length, dir);
+		brcm_sync_single_for_device(dev,
+					    sg_dma_address(sg),
+					    sg->length, dir);
 }
 
 static int brcm_mapping_error(struct device *dev, dma_addr_t dma_addr)
@@ -633,17 +648,47 @@ static void brcm_set_dma_ops(struct device *dev)
 	set_dma_ops(dev, &brcm_dma_ops);
 }
 
+static inline void brcm_pcie_perst_set(struct brcm_pcie *pcie,
+				       unsigned int val);
 static int brcmstb_platform_notifier(struct notifier_block *nb,
 				     unsigned long event, void *__dev)
 {
+	extern unsigned long max_pfn;
 	struct device *dev = __dev;
+	const char *rc_name = "0000:00:00.0";
+
+	switch (event) {
+	case BUS_NOTIFY_ADD_DEVICE:
+		if (max_pfn > (bounce_threshold/PAGE_SIZE) &&
+		    strcmp(dev->kobj.name, rc_name)) {
+			int ret;
+
+			ret = brcm_pcie_bounce_register_dev(dev, bounce_buffer,
+							    (dma_addr_t)bounce_threshold);
+			if (ret) {
+				dev_err(dev,
+					"brcm_pcie_bounce_register_dev() failed: %d\n",
+				ret);
+				return ret;
+			}
+		}
+		brcm_set_dma_ops(dev);
+		return NOTIFY_OK;
+
+	case BUS_NOTIFY_DEL_DEVICE:
+		if (!strcmp(dev->kobj.name, rc_name) && g_pcie) {
+			/* Force a bus reset */
+			brcm_pcie_perst_set(g_pcie, 1);
+			msleep(100);
+			brcm_pcie_perst_set(g_pcie, 0);
+		} else if (max_pfn > (bounce_threshold/PAGE_SIZE)) {
+			brcm_pcie_bounce_unregister_dev(dev);
+		}
+		return NOTIFY_OK;
 
-	brcm_dma_ops_ptr = &brcm_dma_ops;
-	if (event != BUS_NOTIFY_ADD_DEVICE)
+	default:
 		return NOTIFY_DONE;
-
-	brcm_set_dma_ops(dev);
-	return NOTIFY_OK;
+	}
 }
 
 static struct notifier_block brcmstb_platform_nb = {
@@ -914,6 +959,7 @@ static void brcm_pcie_msi_isr(struct irq_desc *desc)
 		}
 	}
 	chained_irq_exit(chip, desc);
+	bcm_writel(1, msi->base + PCIE_MISC_EOI_CTRL);
 }
 
 static void brcm_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
@@ -930,7 +976,8 @@ static void brcm_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
 static int brcm_msi_set_affinity(struct irq_data *irq_data,
 				 const struct cpumask *mask, bool force)
 {
-	return -EINVAL;
+	struct brcm_msi *msi = irq_data_get_irq_chip_data(irq_data);
+	return __irq_set_affinity(msi->irq, mask, force);
 }
 
 static struct irq_chip brcm_msi_bottom_irq_chip = {
@@ -1168,9 +1215,9 @@ static void __iomem *brcm_pcie_map_conf(struct pci_bus *bus, unsigned int devfn,
 		return PCI_SLOT(devfn) ? NULL : base + where;
 
 	/* For devices, write to the config space index register */
-	idx = cfg_index(bus->number, devfn, where);
+	idx = cfg_index(bus->number, devfn, 0);
 	bcm_writel(idx, pcie->base + IDX_ADDR(pcie));
-	return base + DATA_ADDR(pcie) + (where & 0x3);
+	return base + DATA_ADDR(pcie) + where;
 }
 
 static inline void brcm_pcie_bridge_sw_init_set(struct brcm_pcie *pcie,
@@ -1238,20 +1285,6 @@ static int brcm_pcie_parse_map_dma_ranges(struct brcm_pcie *pcie)
 			num_dma_ranges++;
 	}
 
-	for (i = 0, num_memc = 0; i < BRCM_MAX_SCB; i++) {
-		u64 size = brcmstb_memory_memc_size(i);
-
-		if (size == (u64)-1) {
-			dev_err(pcie->dev, "cannot get memc%d size", i);
-			return -EINVAL;
-		} else if (size) {
-			scb_size[i] = roundup_pow_of_two_64(size);
-			num_memc++;
-		} else {
-			break;
-		}
-	}
-
 	return 0;
 }
 
@@ -1275,26 +1308,25 @@ static int brcm_pcie_add_controller(struct brcm_pcie *pcie)
 	if (ret)
 		goto done;
 
-	/* Determine num_memc and their sizes */
-	for (i = 0, num_memc = 0; i < BRCM_MAX_SCB; i++) {
-		u64 size = brcmstb_memory_memc_size(i);
-
-		if (size == (u64)-1) {
-			dev_err(dev, "cannot get memc%d size\n", i);
-			ret = -EINVAL;
-			goto done;
-		} else if (size) {
-			scb_size[i] = roundup_pow_of_two_64(size);
-			num_memc++;
-		} else {
-			break;
+	if (!num_dma_ranges) {
+		/* Determine num_memc and their sizes by other means */
+		for (i = 0, num_memc = 0; i < BRCM_MAX_SCB; i++) {
+			u64 size = brcmstb_memory_memc_size(i);
+
+			if (size == (u64)-1) {
+				dev_err(dev, "cannot get memc%d size\n", i);
+				ret = -EINVAL;
+				goto done;
+			} else if (size) {
+				scb_size[i] = roundup_pow_of_two_64(size);
+			} else {
+				break;
+			}
 		}
-	}
-	if (!ret && num_memc == 0) {
-		ret = -EINVAL;
-		goto done;
+		num_memc = i;
 	}
 
+	g_pcie = pcie;
 	num_pcie++;
 done:
 	mutex_unlock(&brcm_pcie_lock);
@@ -1307,6 +1339,7 @@ static void brcm_pcie_remove_controller(struct brcm_pcie *pcie)
 	if (--num_pcie > 0)
 		goto out;
 
+	g_pcie = NULL;
 	if (brcm_unregister_notifier())
 		dev_err(pcie->dev, "failed to unregister pci bus notifier\n");
 	kfree(dma_ranges);
@@ -1367,7 +1400,7 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 	void __iomem *base = pcie->base;
 	unsigned int scb_size_val;
 	u64 rc_bar2_offset, rc_bar2_size, total_mem_size = 0;
-	u32 tmp, burst;
+	u32 tmp;
 	int i, j, ret, limit;
 	u16 nlw, cls, lnksta;
 	bool ssc_good = false;
@@ -1400,20 +1433,15 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 	/* Set SCB_MAX_BURST_SIZE, CFG_READ_UR_MODE, SCB_ACCESS_EN */
 	tmp = INSERT_FIELD(0, PCIE_MISC_MISC_CTRL, SCB_ACCESS_EN, 1);
 	tmp = INSERT_FIELD(tmp, PCIE_MISC_MISC_CTRL, CFG_READ_UR_MODE, 1);
-	burst = (pcie->type == GENERIC || pcie->type == BCM7278)
-		? BURST_SIZE_512 : BURST_SIZE_256;
-	tmp = INSERT_FIELD(tmp, PCIE_MISC_MISC_CTRL, MAX_BURST_SIZE, burst);
+	tmp = INSERT_FIELD(tmp, PCIE_MISC_MISC_CTRL, MAX_BURST_SIZE,
+			   pcie->max_burst_size);
 	bcm_writel(tmp, base + PCIE_MISC_MISC_CTRL);
 
 	/*
 	 * Set up inbound memory view for the EP (called RC_BAR2,
 	 * not to be confused with the BARs that are advertised by
 	 * the EP).
-	 */
-	for (i = 0; i < num_memc; i++)
-		total_mem_size += scb_size[i];
-
-	/*
+	 *
 	 * The PCIe host controller by design must set the inbound
 	 * viewport to be a contiguous arrangement of all of the
 	 * system's memory.  In addition, its size mut be a power of
@@ -1429,55 +1457,49 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
 	 * the controller will know to send outbound memory downstream
 	 * and everything else upstream.
 	 */
-	rc_bar2_size = roundup_pow_of_two_64(total_mem_size);
 
-	if (dma_ranges) {
+	if (num_dma_ranges) {
 		/*
-		 * The best-case scenario is to place the inbound
-		 * region in the first 4GB of pcie-space, as some
-		 * legacy devices can only address 32bits.
-		 * We would also like to put the MSI under 4GB
-		 * as well, since some devices require a 32bit
-		 * MSI target address.
+		 * Use the base address and size(s) provided in the dma-ranges
+		 * property.
 		 */
-		if (total_mem_size <= 0xc0000000ULL &&
-		    rc_bar2_size <= 0x100000000ULL) {
-			rc_bar2_offset = 0;
-			/* If the viewport is less then 4GB we can fit
-			 * the MSI target address under 4GB. Otherwise
-			 * put it right below 64GB.
-			 */
-			msi_target_addr =
-				(rc_bar2_size == 0x100000000ULL)
-				? BRCM_MSI_TARGET_ADDR_GT_4GB
-				: BRCM_MSI_TARGET_ADDR_LT_4GB;
-		} else {
-			/*
-			 * The system memory is 4GB or larger so we
-			 * cannot start the inbound region at location
-			 * 0 (since we have to allow some space for
-			 * outbound memory @ 3GB).  So instead we
-			 * start it at the 1x multiple of its size
-			 */
-			rc_bar2_offset = rc_bar2_size;
-
-			/* Since we are starting the viewport at 4GB or
-			 * higher, put the MSI target address below 4GB
-			 */
-			msi_target_addr = BRCM_MSI_TARGET_ADDR_LT_4GB;
-		}
-	} else {
+		for (i = 0; i < num_dma_ranges; i++)
+			scb_size[i] = roundup_pow_of_two_64(dma_ranges[i].size);
+
+		num_memc = num_dma_ranges;
+		rc_bar2_offset = dma_ranges[0].pci_addr;
+	} else if (num_memc) {
 		/*
 		 * Set simple configuration based on memory sizes
-		 * only.  We always start the viewport at address 0,
-		 * and set the MSI target address accordingly.
+		 * only.  We always start the viewport at address 0.
 		 */
 		rc_bar2_offset = 0;
+	} else {
+		return -EINVAL;
+	}
+
+	for (i = 0; i < num_memc; i++)
+		total_mem_size += scb_size[i];
+
+	rc_bar2_size = roundup_pow_of_two_64(total_mem_size);
 
-		msi_target_addr = (rc_bar2_size >= 0x100000000ULL)
-			? BRCM_MSI_TARGET_ADDR_GT_4GB
-			: BRCM_MSI_TARGET_ADDR_LT_4GB;
+	/* Verify the alignment is correct */
+	if (rc_bar2_offset & (rc_bar2_size - 1)) {
+		dev_err(dev, "inbound window is misaligned\n");
+		return -EINVAL;
 	}
+
+	/*
+	 * Position the MSI target low if possible.
+	 *
+	 * TO DO: Consider outbound window when choosing MSI target and
+	 * verifying configuration.
+	 */
+	msi_target_addr = BRCM_MSI_TARGET_ADDR_LT_4GB;
+	if (rc_bar2_offset <= msi_target_addr &&
+	    rc_bar2_offset + rc_bar2_size > msi_target_addr)
+		msi_target_addr = BRCM_MSI_TARGET_ADDR_GT_4GB;
+
 	pcie->msi_target_addr = msi_target_addr;
 
 	tmp = lower_32_bits(rc_bar2_offset);
@@ -1713,6 +1735,7 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 	data = of_id->data;
 	pcie->reg_offsets = data->offsets;
 	pcie->reg_field_info = data->reg_field_info;
+	pcie->max_burst_size = data->max_burst_size;
 	pcie->type = data->type;
 	pcie->dn = dn;
 	pcie->dev = &pdev->dev;
@@ -1732,7 +1755,7 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 
 	pcie->clk = of_clk_get_by_name(dn, "sw_pcie");
 	if (IS_ERR(pcie->clk)) {
-		dev_err(&pdev->dev, "could not get clock\n");
+		dev_warn(&pdev->dev, "could not get clock\n");
 		pcie->clk = NULL;
 	}
 	pcie->base = base;
@@ -1755,7 +1778,8 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 
 	ret = clk_prepare_enable(pcie->clk);
 	if (ret) {
-		dev_err(&pdev->dev, "could not enable clock\n");
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "could not enable clock\n");
 		return ret;
 	}
 
@@ -1818,7 +1842,6 @@ static struct platform_driver brcm_pcie_driver = {
 	.remove = brcm_pcie_remove,
 	.driver = {
 		.name = "brcm-pcie",
-		.owner = THIS_MODULE,
 		.of_match_table = brcm_pcie_match,
 		.pm = &brcm_pcie_pm_ops,
 	},
diff --git a/drivers/soc/bcm/brcmstb/Makefile b/drivers/soc/bcm/brcmstb/Makefile
index 01687c26535bf..e4ccd3a4c3fba 100644
--- a/drivers/soc/bcm/brcmstb/Makefile
+++ b/drivers/soc/bcm/brcmstb/Makefile
@@ -1,2 +1,2 @@
-obj-y				+= common.o biuctrl.o
+obj-y				+= common.o biuctrl.o memory.o
 obj-$(CONFIG_BRCMSTB_PM)	+= pm/
diff --git a/drivers/soc/bcm/brcmstb/memory.c b/drivers/soc/bcm/brcmstb/memory.c
new file mode 100644
index 0000000000000..254783d1065f7
--- /dev/null
+++ b/drivers/soc/bcm/brcmstb/memory.c
@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright © 2015-2017 Broadcom */
+
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/libfdt.h>
+#include <linux/of_address.h>
+#include <linux/of_fdt.h>
+#include <linux/sizes.h>
+#include <soc/brcmstb/memory_api.h>
+
+/* Macro to help extract property data */
+#define DT_PROP_DATA_TO_U32(b, offs) (fdt32_to_cpu(*(u32 *)(b + offs)))
+
+/* Constants used when retrieving memc info */
+#define NUM_BUS_RANGES 10
+#define BUS_RANGE_ULIMIT_SHIFT 4
+#define BUS_RANGE_LLIMIT_SHIFT 4
+#define BUS_RANGE_PA_SHIFT 12
+
+enum {
+	BUSNUM_MCP0 = 0x4,
+	BUSNUM_MCP1 = 0x5,
+	BUSNUM_MCP2 = 0x6,
+};
+
+/*
+ * If the DT nodes are handy, determine which MEMC holds the specified
+ * physical address.
+ */
+#ifdef CONFIG_ARCH_BRCMSTB
+int __brcmstb_memory_phys_addr_to_memc(phys_addr_t pa, void __iomem *base)
+{
+	int memc = -1;
+	int i;
+
+	for (i = 0; i < NUM_BUS_RANGES; i++, base += 8) {
+		const u64 ulimit_raw = readl(base);
+		const u64 llimit_raw = readl(base + 4);
+		const u64 ulimit =
+			((ulimit_raw >> BUS_RANGE_ULIMIT_SHIFT)
+			 << BUS_RANGE_PA_SHIFT) | 0xfff;
+		const u64 llimit = (llimit_raw >> BUS_RANGE_LLIMIT_SHIFT)
+				   << BUS_RANGE_PA_SHIFT;
+		const u32 busnum = (u32)(ulimit_raw & 0xf);
+
+		if (pa >= llimit && pa <= ulimit) {
+			if (busnum >= BUSNUM_MCP0 && busnum <= BUSNUM_MCP2) {
+				memc = busnum - BUSNUM_MCP0;
+				break;
+			}
+		}
+	}
+
+	return memc;
+}
+
+int brcmstb_memory_phys_addr_to_memc(phys_addr_t pa)
+{
+	int memc = -1;
+	struct device_node *np;
+	void __iomem *cpubiuctrl;
+
+	np = of_find_compatible_node(NULL, NULL, "brcm,brcmstb-cpu-biu-ctrl");
+	if (!np)
+		return memc;
+
+	cpubiuctrl = of_iomap(np, 0);
+	if (!cpubiuctrl)
+		goto cleanup;
+
+	memc = __brcmstb_memory_phys_addr_to_memc(pa, cpubiuctrl);
+	iounmap(cpubiuctrl);
+
+cleanup:
+	of_node_put(np);
+
+	return memc;
+}
+
+#elif defined(CONFIG_MIPS)
+int brcmstb_memory_phys_addr_to_memc(phys_addr_t pa)
+{
+	/* The logic here is fairly simple and hardcoded: if pa <= 0x5000_0000,
+	 * then this is MEMC0, else MEMC1.
+	 *
+	 * For systems with 2GB on MEMC0, MEMC1 starts at 9000_0000, with 1GB
+	 * on MEMC0, MEMC1 starts at 6000_0000.
+	 */
+	if (pa >= 0x50000000ULL)
+		return 1;
+	else
+		return 0;
+}
+#endif
+
+u64 brcmstb_memory_memc_size(int memc)
+{
+	const void *fdt = initial_boot_params;
+	const int mem_offset = fdt_path_offset(fdt, "/memory");
+	int addr_cells = 1, size_cells = 1;
+	const struct fdt_property *prop;
+	int proplen, cellslen;
+	u64 memc_size = 0;
+	int i;
+
+	/* Get root size and address cells if specified */
+	prop = fdt_get_property(fdt, 0, "#size-cells", &proplen);
+	if (prop)
+		size_cells = DT_PROP_DATA_TO_U32(prop->data, 0);
+
+	prop = fdt_get_property(fdt, 0, "#address-cells", &proplen);
+	if (prop)
+		addr_cells = DT_PROP_DATA_TO_U32(prop->data, 0);
+
+	if (mem_offset < 0)
+		return -1;
+
+	prop = fdt_get_property(fdt, mem_offset, "reg", &proplen);
+	cellslen = (int)sizeof(u32) * (addr_cells + size_cells);
+	if ((proplen % cellslen) != 0)
+		return -1;
+
+	for (i = 0; i < proplen / cellslen; ++i) {
+		u64 addr = 0;
+		u64 size = 0;
+		int memc_idx;
+		int j;
+
+		for (j = 0; j < addr_cells; ++j) {
+			int offset = (cellslen * i) + (sizeof(u32) * j);
+
+			addr |= (u64)DT_PROP_DATA_TO_U32(prop->data, offset) <<
+				((addr_cells - j - 1) * 32);
+		}
+		for (j = 0; j < size_cells; ++j) {
+			int offset = (cellslen * i) +
+				(sizeof(u32) * (j + addr_cells));
+
+			size |= (u64)DT_PROP_DATA_TO_U32(prop->data, offset) <<
+				((size_cells - j - 1) * 32);
+		}
+
+		if ((phys_addr_t)addr != addr) {
+			pr_err("phys_addr_t is smaller than provided address 0x%llx!\n",
+			       addr);
+			return -1;
+		}
+
+		memc_idx = brcmstb_memory_phys_addr_to_memc((phys_addr_t)addr);
+		if (memc_idx == memc)
+			memc_size += size;
+	}
+
+	return memc_size;
+}
+EXPORT_SYMBOL_GPL(brcmstb_memory_memc_size);
+
-- 
GitLab


From 278f37a1cbb70636a6eb000c1c9fd56bf7097f6c Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 29 May 2019 15:47:42 +0100
Subject: [PATCH 0543/1835] arm: bcm2835: DMA can only address 1GB

The legacy peripherals can only address the first gigabyte of RAM, so
ensure that DMA allocations are restricted to that region.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/mach-bcm/board_bcm2835.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/mach-bcm/board_bcm2835.c b/arch/arm/mach-bcm/board_bcm2835.c
index db426d73d9632..fd6c7130bfb6d 100644
--- a/arch/arm/mach-bcm/board_bcm2835.c
+++ b/arch/arm/mach-bcm/board_bcm2835.c
@@ -123,6 +123,9 @@ static const char * const bcm2835_compat[] = {
 };
 
 DT_MACHINE_START(BCM2835, "BCM2835")
+#if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE)
+	.dma_zone_size	= SZ_1G,
+#endif
 	.map_io = bcm2835_map_io,
 	.init_machine = bcm2835_init,
 	.dt_compat = bcm2835_compat,
-- 
GitLab


From ea1a6dab51c23e9ca4c6db02a0cad4cc058782f4 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 29 Aug 2018 09:05:15 +0100
Subject: [PATCH 0544/1835] mmc: bcm2835-sdhost: Support 64-bit physical
 addresses

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/bcm2835-sdhost.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
index 844bed552baec..3716a80a879b6 100644
--- a/drivers/mmc/host/bcm2835-sdhost.c
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -148,7 +148,7 @@ struct bcm2835_host {
 	spinlock_t		lock;
 
 	void __iomem		*ioaddr;
-	u32			bus_addr;
+	phys_addr_t		bus_addr;
 
 	struct mmc_host		*mmc;
 
@@ -246,8 +246,8 @@ static void log_init(struct device *dev, u32 bus_to_phys)
 	sdhost_log_buf = dma_zalloc_coherent(dev, LOG_SIZE, &sdhost_log_addr,
 					     GFP_KERNEL);
 	if (sdhost_log_buf) {
-		pr_info("sdhost: log_buf @ %p (%x)\n",
-			sdhost_log_buf, (u32)sdhost_log_addr);
+		pr_info("sdhost: log_buf @ %p (%llx)\n",
+			sdhost_log_buf, (u64)sdhost_log_addr);
 		timer_base = ioremap_nocache(bus_to_phys + 0x7e003000, SZ_4K);
 		if (!timer_base)
 			pr_err("sdhost: failed to remap timer\n");
@@ -2024,6 +2024,7 @@ static int bcm2835_sdhost_probe(struct platform_device *pdev)
 	struct mmc_host *mmc;
 	const __be32 *addr;
 	u32 msg[3];
+	int na;
 	int ret;
 
 	pr_debug("bcm2835_sdhost_probe\n");
@@ -2047,12 +2048,13 @@ static int bcm2835_sdhost_probe(struct platform_device *pdev)
 		goto err;
 	}
 
+	na = of_n_addr_cells(node);
 	addr = of_get_address(node, 0, NULL, NULL);
 	if (!addr) {
 		dev_err(dev, "could not get DMA-register address\n");
 		return -ENODEV;
 	}
-	host->bus_addr = be32_to_cpup(addr);
+	host->bus_addr = (phys_addr_t)of_read_number(addr, na);
 	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
 		 (unsigned long)host->ioaddr,
 		 (unsigned long)iomem->start,
-- 
GitLab


From 39afbd02cb63d932d495e91f68800efd59d620af Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 28 Sep 2018 16:24:05 +0100
Subject: [PATCH 0545/1835] mmc: sdhci: Mask "spurious" interrupts

Add a filter for "spurious" Transfer Complete interrupts, attempting
to make it as specific as possible:
* INT_DATA_END (transfer complete) is set
* There is a stop command in progress
* There is no data transfer in progress

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/mmc/host/sdhci.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index c749d3dc1d36d..bb753ba947d82 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2930,6 +2930,10 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
 			result = IRQ_WAKE_THREAD;
 		}
 
+		if ((intmask & SDHCI_INT_DATA_END) && !host->data &&
+		    host->cmd && (host->cmd == host->cmd->mrq->stop))
+			intmask &= ~SDHCI_INT_DATA_END;
+
 		if (intmask & SDHCI_INT_CMD_MASK)
 			sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK, &intmask);
 
-- 
GitLab


From 04c979ea47cc0f0c390b5b628094b9b67a91d55c Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Sat, 27 Apr 2019 12:33:57 +0200
Subject: [PATCH 0546/1835] mmc: sdhci-iproc: Add support for emmc2 of the
 BCM2838

The emmc2 interface of the BCM2838 should be integrated in sdhci-iproc
to avoid code redundancy. Except 32 bit only access no other quirks are
known yet. Add an additional compatible string for upstream proposal.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 drivers/mmc/host/sdhci-iproc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index f903ab96aa21e..983cddce9147b 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -250,8 +250,18 @@ static const struct sdhci_iproc_data bcm2835_data = {
 	.mmc_caps = 0x00000000,
 };
 
+static const struct sdhci_pltfm_data sdhci_bcm2838_pltfm_data = {
+	.ops = &sdhci_iproc_32only_ops,
+};
+
+static const struct sdhci_iproc_data bcm2838_data = {
+	.pdata = &sdhci_bcm2838_pltfm_data,
+};
+
 static const struct of_device_id sdhci_iproc_of_match[] = {
 	{ .compatible = "brcm,bcm2835-sdhci", .data = &bcm2835_data },
+	{ .compatible = "brcm,bcm2838-sdhci", .data = &bcm2838_data },
+	{ .compatible = "brcm,bcm2711-emmc2", .data = &bcm2838_data },
 	{ .compatible = "brcm,sdhci-iproc-cygnus", .data = &iproc_cygnus_data},
 	{ .compatible = "brcm,sdhci-iproc", .data = &iproc_data },
 	{ }
-- 
GitLab


From 5e74aadfd1e0e6c00994521863ba044ce25b40de Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Sat, 4 May 2019 17:06:15 +0200
Subject: [PATCH 0547/1835] hwrng: iproc-rng200: Add BCM2838 support

The HWRNG on the BCM2838 is compatible to iproc-rng200, so add the
support to this driver instead of bcm2835-rng.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 drivers/char/hw_random/Kconfig        |  4 +-
 drivers/char/hw_random/iproc-rng200.c | 81 +++++++++++++++++++++++++--
 2 files changed, 79 insertions(+), 6 deletions(-)

diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index dac895dc01b95..74fcbdae376c5 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -89,11 +89,11 @@ config HW_RANDOM_BCM2835
 
 config HW_RANDOM_IPROC_RNG200
 	tristate "Broadcom iProc/STB RNG200 support"
-	depends on ARCH_BCM_IPROC || ARCH_BRCMSTB
+	depends on ARCH_BCM_IPROC || ARCH_BCM2835 || ARCH_BRCMSTB
 	default HW_RANDOM
 	---help---
 	  This driver provides kernel-side support for the RNG200
-	  hardware found on the Broadcom iProc and STB SoCs.
+	  hardware found on the Broadcom iProc, BCM2838 and STB SoCs.
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called iproc-rng200
diff --git a/drivers/char/hw_random/iproc-rng200.c b/drivers/char/hw_random/iproc-rng200.c
index 8b5a20b352930..063dfea53059e 100644
--- a/drivers/char/hw_random/iproc-rng200.c
+++ b/drivers/char/hw_random/iproc-rng200.c
@@ -29,6 +29,7 @@
 #define RNG_CTRL_RNG_RBGEN_MASK				0x00001FFF
 #define RNG_CTRL_RNG_RBGEN_ENABLE			0x00000001
 #define RNG_CTRL_RNG_RBGEN_DISABLE			0x00000000
+#define RNG_CTRL_RNG_DIV_CTRL_SHIFT			13
 
 #define RNG_SOFT_RESET_OFFSET				0x04
 #define RNG_SOFT_RESET					0x00000001
@@ -36,16 +37,23 @@
 #define RBG_SOFT_RESET_OFFSET				0x08
 #define RBG_SOFT_RESET					0x00000001
 
+#define RNG_TOTAL_BIT_COUNT_OFFSET			0x0C
+
+#define RNG_TOTAL_BIT_COUNT_THRESHOLD_OFFSET		0x10
+
 #define RNG_INT_STATUS_OFFSET				0x18
 #define RNG_INT_STATUS_MASTER_FAIL_LOCKOUT_IRQ_MASK	0x80000000
 #define RNG_INT_STATUS_STARTUP_TRANSITIONS_MET_IRQ_MASK	0x00020000
 #define RNG_INT_STATUS_NIST_FAIL_IRQ_MASK		0x00000020
 #define RNG_INT_STATUS_TOTAL_BITS_COUNT_IRQ_MASK	0x00000001
 
+#define RNG_INT_ENABLE_OFFSET				0x1C
+
 #define RNG_FIFO_DATA_OFFSET				0x20
 
 #define RNG_FIFO_COUNT_OFFSET				0x24
 #define RNG_FIFO_COUNT_RNG_FIFO_COUNT_MASK		0x000000FF
+#define RNG_FIFO_COUNT_RNG_FIFO_THRESHOLD_SHIFT		8
 
 struct iproc_rng200_dev {
 	struct hwrng rng;
@@ -166,6 +174,64 @@ static int iproc_rng200_init(struct hwrng *rng)
 	return 0;
 }
 
+static int bcm2838_rng200_read(struct hwrng *rng, void *buf, size_t max,
+			       bool wait)
+{
+	struct iproc_rng200_dev *priv = to_rng_priv(rng);
+	u32 max_words = max / sizeof(u32);
+	u32 num_words, count, val;
+
+	/* ensure warm up period has elapsed */
+	while (1) {
+		val = ioread32(priv->base + RNG_TOTAL_BIT_COUNT_OFFSET);
+		if (val > 16)
+			break;
+		cpu_relax();
+	}
+
+	/* ensure fifo is not empty */
+	while (1) {
+		num_words = ioread32(priv->base + RNG_FIFO_COUNT_OFFSET) &
+			    RNG_FIFO_COUNT_RNG_FIFO_COUNT_MASK;
+		if (num_words)
+			break;
+		if (!wait)
+			return 0;
+		cpu_relax();
+	}
+
+	if (num_words > max_words)
+		num_words = max_words;
+
+	for (count = 0; count < num_words; count++) {
+		((u32 *)buf)[count] = ioread32(priv->base +
+					       RNG_FIFO_DATA_OFFSET);
+	}
+
+	return num_words * sizeof(u32);
+}
+
+static int bcm2838_rng200_init(struct hwrng *rng)
+{
+	struct iproc_rng200_dev *priv = to_rng_priv(rng);
+	uint32_t val;
+
+	if (ioread32(priv->base + RNG_CTRL_OFFSET) & RNG_CTRL_RNG_RBGEN_MASK)
+		return 0;
+
+	/* initial numbers generated are "less random" so will be discarded */
+	val = 0x40000;
+	iowrite32(val, priv->base + RNG_TOTAL_BIT_COUNT_THRESHOLD_OFFSET);
+	/* min fifo count to generate full interrupt */
+	val = 2 << RNG_FIFO_COUNT_RNG_FIFO_THRESHOLD_SHIFT;
+	iowrite32(val, priv->base + RNG_FIFO_COUNT_OFFSET);
+	/* enable the rng - 1Mhz sample rate */
+	val = (0x3 << RNG_CTRL_RNG_DIV_CTRL_SHIFT) | RNG_CTRL_RNG_RBGEN_MASK;
+	iowrite32(val, priv->base + RNG_CTRL_OFFSET);
+
+	return 0;
+}
+
 static void iproc_rng200_cleanup(struct hwrng *rng)
 {
 	struct iproc_rng200_dev *priv = to_rng_priv(rng);
@@ -202,10 +268,16 @@ static int iproc_rng200_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->base);
 	}
 
-	priv->rng.name = "iproc-rng200",
-	priv->rng.read = iproc_rng200_read,
-	priv->rng.init = iproc_rng200_init,
-	priv->rng.cleanup = iproc_rng200_cleanup,
+	priv->rng.name = pdev->name;
+	priv->rng.cleanup = iproc_rng200_cleanup;
+
+	if (of_device_is_compatible(dev->of_node, "brcm,bcm2838-rng200")) {
+		priv->rng.init = bcm2838_rng200_init;
+		priv->rng.read = bcm2838_rng200_read;
+	} else {
+		priv->rng.init = iproc_rng200_init;
+		priv->rng.read = iproc_rng200_read;
+	}
 
 	/* Register driver */
 	ret = devm_hwrng_register(dev, &priv->rng);
@@ -222,6 +294,7 @@ static int iproc_rng200_probe(struct platform_device *pdev)
 static const struct of_device_id iproc_rng200_of_match[] = {
 	{ .compatible = "brcm,bcm7278-rng200", },
 	{ .compatible = "brcm,iproc-rng200", },
+	{ .compatible = "brcm,bcm2838-rng200"},
 	{},
 };
 MODULE_DEVICE_TABLE(of, iproc_rng200_of_match);
-- 
GitLab


From f4d6c841192baab7979c38e075a581680b6a4c87 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Sat, 18 May 2019 12:26:11 +0200
Subject: [PATCH 0548/1835] thermal: brcmstb_thermal: Add BCM2838 support

The BCM2838 has an AVS TMON hardware block. This adds the necessary
support to the brcmstb_thermal driver ( no trip handling ).

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 drivers/thermal/broadcom/Kconfig           |  2 +-
 drivers/thermal/broadcom/brcmstb_thermal.c | 65 +++++++++++++++++++---
 2 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/drivers/thermal/broadcom/Kconfig b/drivers/thermal/broadcom/Kconfig
index c106a15bf7f90..d494073b41877 100644
--- a/drivers/thermal/broadcom/Kconfig
+++ b/drivers/thermal/broadcom/Kconfig
@@ -8,7 +8,7 @@ config BCM2835_THERMAL
 
 config BRCMSTB_THERMAL
 	tristate "Broadcom STB AVS TMON thermal driver"
-	depends on ARCH_BRCMSTB || COMPILE_TEST
+	depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
 	help
 	  Enable this driver if you have a Broadcom STB SoC and would like
 	  thermal framework support.
diff --git a/drivers/thermal/broadcom/brcmstb_thermal.c b/drivers/thermal/broadcom/brcmstb_thermal.c
index 1919f91fa7565..36289c5e16241 100644
--- a/drivers/thermal/broadcom/brcmstb_thermal.c
+++ b/drivers/thermal/broadcom/brcmstb_thermal.c
@@ -19,6 +19,7 @@
 #define pr_fmt(fmt)	DRV_NAME ": " fmt
 
 #include <linux/bitops.h>
+#include <linux/clk.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/io.h>
@@ -31,9 +32,6 @@
 #include <linux/thermal.h>
 
 #define AVS_TMON_STATUS			0x00
- #define AVS_TMON_STATUS_valid_msk	BIT(11)
- #define AVS_TMON_STATUS_data_msk	GENMASK(10, 1)
- #define AVS_TMON_STATUS_data_shift	1
 
 #define AVS_TMON_EN_OVERTEMP_RESET	0x04
  #define AVS_TMON_EN_OVERTEMP_RESET_msk	BIT(0)
@@ -111,10 +109,19 @@ static struct avs_tmon_trip avs_tmon_trips[] = {
 	},
 };
 
+struct brcmstb_thermal_of_data {
+	const struct thermal_zone_of_device_ops *of_ops;
+	u32 status_valid_mask;
+	u32 status_data_mask;
+	u32 status_data_shift;
+};
+
 struct brcmstb_thermal_priv {
 	void __iomem *tmon_base;
 	struct device *dev;
 	struct thermal_zone_device *thermal;
+	struct clk *clk;
+	const struct brcmstb_thermal_of_data *socdata;
 };
 
 static void avs_tmon_get_coeffs(struct thermal_zone_device *tz, int *slope,
@@ -164,17 +171,18 @@ static inline u32 avs_tmon_temp_to_code(struct thermal_zone_device *tz,
 static int brcmstb_get_temp(void *data, int *temp)
 {
 	struct brcmstb_thermal_priv *priv = data;
+	const struct brcmstb_thermal_of_data *socdata = priv->socdata;
 	u32 val;
 	long t;
 
 	val = __raw_readl(priv->tmon_base + AVS_TMON_STATUS);
 
-	if (!(val & AVS_TMON_STATUS_valid_msk)) {
+	if (!(val & socdata->status_valid_mask)) {
 		dev_err(priv->dev, "reading not valid\n");
 		return -EIO;
 	}
 
-	val = (val & AVS_TMON_STATUS_data_msk) >> AVS_TMON_STATUS_data_shift;
+	val = (val & socdata->status_data_mask) >> socdata->status_data_shift;
 
 	t = avs_tmon_code_to_temp(priv->thermal, val);
 	if (t < 0)
@@ -299,13 +307,34 @@ static int brcmstb_set_trips(void *data, int low, int high)
 	return 0;
 }
 
-static struct thermal_zone_of_device_ops of_ops = {
+static const struct thermal_zone_of_device_ops bcm7445_thermal_of_ops = {
 	.get_temp	= brcmstb_get_temp,
 	.set_trips	= brcmstb_set_trips,
 };
 
+static const struct thermal_zone_of_device_ops bcm2838_thermal_of_ops = {
+	.get_temp	= brcmstb_get_temp,
+};
+
+static const struct brcmstb_thermal_of_data bcm7445_thermal_of_data = {
+	.of_ops = &bcm7445_thermal_of_ops,
+	.status_valid_mask = BIT(11),
+	.status_data_mask = GENMASK(10, 1),
+	.status_data_shift = 1,
+};
+
+static const struct brcmstb_thermal_of_data bcm2838_thermal_of_data = {
+	.of_ops = &bcm2838_thermal_of_ops,
+	.status_valid_mask = BIT(10),
+	.status_data_mask = GENMASK(9, 0),
+	.status_data_shift = 0,
+};
+
 static const struct of_device_id brcmstb_thermal_id_table[] = {
-	{ .compatible = "brcm,avs-tmon" },
+	{ .compatible = "brcm,avs-tmon",
+	  .data = &bcm7445_thermal_of_data },
+	{ .compatible = "brcm,avs-tmon-bcm2838",
+	  .data = &bcm2838_thermal_of_data },
 	{},
 };
 MODULE_DEVICE_TABLE(of, brcmstb_thermal_id_table);
@@ -326,10 +355,27 @@ static int brcmstb_thermal_probe(struct platform_device *pdev)
 	if (IS_ERR(priv->tmon_base))
 		return PTR_ERR(priv->tmon_base);
 
+	priv->socdata = of_device_get_match_data(&pdev->dev);
+	if (!priv->socdata) {
+		dev_err(&pdev->dev, "no device match found\n");
+		return -ENODEV;
+	}
+
+	priv->clk = devm_clk_get(&pdev->dev, NULL);
+	if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER)
+		return -EPROBE_DEFER;
+
+	if (!IS_ERR(priv->clk)) {
+		ret = clk_prepare_enable(priv->clk);
+		if (ret)
+			return ret;
+	}
+
 	priv->dev = &pdev->dev;
 	platform_set_drvdata(pdev, priv);
 
-	thermal = thermal_zone_of_sensor_register(&pdev->dev, 0, priv, &of_ops);
+	thermal = thermal_zone_of_sensor_register(&pdev->dev, 0, priv,
+						  priv->socdata->of_ops);
 	if (IS_ERR(thermal)) {
 		ret = PTR_ERR(thermal);
 		dev_err(&pdev->dev, "could not register sensor: %d\n", ret);
@@ -369,6 +415,9 @@ static int brcmstb_thermal_exit(struct platform_device *pdev)
 	if (thermal)
 		thermal_zone_of_sensor_unregister(&pdev->dev, priv->thermal);
 
+	if (!IS_ERR(priv->clk))
+		clk_disable_unprepare(priv->clk);
+
 	return 0;
 }
 
-- 
GitLab


From f30d552e148eb73d265751713d53cae17ef214a6 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 1 Nov 2018 17:31:37 +0000
Subject: [PATCH 0549/1835] vchiq: Add 36-bit address support

Conditional on a new compatible string, change the pagelist encoding
such that the top 24 bits are the pfn, leaving 8 bits for run length
(-1).

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../interface/vchiq_arm/vchiq_2835_arm.c      | 90 ++++++++++++++-----
 .../interface/vchiq_arm/vchiq_arm.c           |  6 ++
 .../interface/vchiq_arm/vchiq_arm.h           |  1 +
 3 files changed, 75 insertions(+), 22 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 7694a4fc7cac9..66ee1886c9a16 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -47,6 +47,8 @@
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define TOTAL_SLOTS (VCHIQ_SLOT_ZERO_SLOTS + 2 * 32)
+#define VC_SAFE(x) (g_use_36bit_addrs ? ((u32)(x) | 0xc0000000) : (u32)(x))
+#define IS_VC_SAFE(x) (g_use_36bit_addrs ? !((x) & ~0x3fffffffull) : 1)
 
 #include "vchiq_arm.h"
 #include "vchiq_connected.h"
@@ -96,6 +98,7 @@ static void __iomem *g_regs;
  */
 static unsigned int g_cache_line_size;
 static struct dma_pool *g_dma_pool;
+static unsigned int g_use_36bit_addrs = 0;
 static unsigned int g_fragments_size;
 static char *g_fragments_base;
 static char *g_free_fragments;
@@ -139,6 +142,8 @@ int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 	g_cache_line_size = drvdata->cache_line_size;
 	g_fragments_size = 2 * g_cache_line_size;
 
+	g_use_36bit_addrs = (dev->dma_pfn_offset == 0);
+
 	/* Allocate space for the channels in coherent memory */
 	slot_mem_size = PAGE_ALIGN(TOTAL_SLOTS * VCHIQ_SLOT_SIZE);
 	frag_mem_size = PAGE_ALIGN(g_fragments_size * MAX_FRAGMENTS);
@@ -150,14 +155,21 @@ int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 		return -ENOMEM;
 	}
 
+	if (!IS_VC_SAFE(slot_phys)) {
+		dev_err(dev, "allocated DMA memory %pad is not VC-safe\n",
+			&slot_phys);
+		return -ENOMEM;
+	}
+
 	WARN_ON(((unsigned long)slot_mem & (PAGE_SIZE - 1)) != 0);
+	channelbase = VC_SAFE(slot_phys);
 
 	vchiq_slot_zero = vchiq_init_slots(slot_mem, slot_mem_size);
 	if (!vchiq_slot_zero)
 		return -EINVAL;
 
 	vchiq_slot_zero->platform_data[VCHIQ_PLATFORM_FRAGMENTS_OFFSET_IDX] =
-		(int)slot_phys + slot_mem_size;
+		channelbase + slot_mem_size;
 	vchiq_slot_zero->platform_data[VCHIQ_PLATFORM_FRAGMENTS_COUNT_IDX] =
 		MAX_FRAGMENTS;
 
@@ -193,7 +205,6 @@ int vchiq_platform_init(struct platform_device *pdev, VCHIQ_STATE_T *state)
 	}
 
 	/* Send the base address of the slots to VideoCore */
-	channelbase = slot_phys;
 	err = rpi_firmware_property(fw, RPI_FIRMWARE_VCHIQ_INIT,
 				    &channelbase, sizeof(channelbase));
 	if (err || channelbase) {
@@ -282,7 +293,7 @@ vchiq_prepare_bulk_data(VCHIQ_BULK_T *bulk, VCHI_MEM_HANDLE_T memhandle,
 		return VCHIQ_ERROR;
 
 	bulk->handle = memhandle;
-	bulk->data = (void *)(unsigned long)pagelistinfo->dma_addr;
+	bulk->data = (void *)VC_SAFE(pagelistinfo->dma_addr);
 
 	/*
 	 * Store the pagelistinfo address in remote_data,
@@ -570,25 +581,60 @@ create_pagelist(char __user *buf, size_t count, unsigned short type)
 
 	/* Combine adjacent blocks for performance */
 	k = 0;
-	for_each_sg(scatterlist, sg, dma_buffers, i) {
-		u32 len = sg_dma_len(sg);
-		u32 addr = sg_dma_address(sg);
-
-		/* Note: addrs is the address + page_count - 1
-		 * The firmware expects blocks after the first to be page-
-		 * aligned and a multiple of the page size
-		 */
-		WARN_ON(len == 0);
-		WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
-		WARN_ON(i && (addr & ~PAGE_MASK));
-		if (k > 0 &&
-		    ((addrs[k - 1] & PAGE_MASK) +
-		     (((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT))
-		    == (addr & PAGE_MASK))
-			addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
-		else
-			addrs[k++] = (addr & PAGE_MASK) |
-				(((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
+	if (g_use_36bit_addrs) {
+		for_each_sg(scatterlist, sg, dma_buffers, i) {
+			u32 len = sg_dma_len(sg);
+			u64 addr = sg_dma_address(sg);
+			u32 page_id = (u32)((addr >> 4) & ~0xff);
+			u32 sg_pages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+			/* Note: addrs is the address + page_count - 1
+			 * The firmware expects blocks after the first to be page-
+			 * aligned and a multiple of the page size
+			 */
+			WARN_ON(len == 0);
+			WARN_ON(i &&
+				(i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+			WARN_ON(i && (addr & ~PAGE_MASK));
+			WARN_ON(upper_32_bits(addr) > 0xf);
+			if (k > 0 &&
+			    ((addrs[k - 1] & ~0xff) +
+			     (((addrs[k - 1] & 0xff) + 1) << 8)
+			     == page_id)) {
+				u32 inc_pages = min(sg_pages,
+						    0xff - (addrs[k - 1] & 0xff));
+				addrs[k - 1] += inc_pages;
+				page_id += inc_pages << 8;
+				sg_pages -= inc_pages;
+			}
+			while (sg_pages) {
+				u32 inc_pages = min(sg_pages, 0x100u);
+				addrs[k++] = page_id | (inc_pages - 1);
+				page_id += inc_pages << 8;
+				sg_pages -= inc_pages;
+			}
+		}
+	} else {
+		for_each_sg(scatterlist, sg, dma_buffers, i) {
+			u32 len = sg_dma_len(sg);
+			u32 addr = VC_SAFE(sg_dma_address(sg));
+			u32 new_pages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+			/* Note: addrs is the address + page_count - 1
+			 * The firmware expects blocks after the first to be page-
+			 * aligned and a multiple of the page size
+			 */
+			WARN_ON(len == 0);
+			WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+			WARN_ON(i && (addr & ~PAGE_MASK));
+			if (k > 0 &&
+			    ((addrs[k - 1] & PAGE_MASK) +
+			     (((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT))
+			    == (addr & PAGE_MASK))
+				addrs[k - 1] += new_pages;
+			else
+				addrs[k++] = (addr & PAGE_MASK) | (new_pages - 1);
+		}
 	}
 
 	/* Partial cache lines (fragments) require special measures */
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index a38b4a8b14c6d..4bc1d47380692 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -181,6 +181,11 @@ static struct vchiq_drvdata bcm2836_drvdata = {
 	.cache_line_size = 64,
 };
 
+static struct vchiq_drvdata bcm2838_drvdata = {
+	.cache_line_size = 64,
+	.use_36bit_addrs = true,
+};
+
 static const char *const ioctl_names[] = {
 	"CONNECT",
 	"SHUTDOWN",
@@ -3618,6 +3623,7 @@ vchiq_register_child(struct platform_device *pdev, const char *name)
 static const struct of_device_id vchiq_of_match[] = {
 	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_drvdata },
 	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_drvdata },
+	{ .compatible = "brcm,bcm2838-vchiq", .data = &bcm2838_drvdata },
 	{},
 };
 MODULE_DEVICE_TABLE(of, vchiq_of_match);
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
index 2f3ebc99cbcfd..249437d0618d9 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h
@@ -125,6 +125,7 @@ typedef struct vchiq_arm_state_struct {
 
 struct vchiq_drvdata {
 	const unsigned int cache_line_size;
+	const bool use_36bit_addrs;
 	struct rpi_firmware *fw;
 };
 
-- 
GitLab


From 56c07246ad0cb594299286f76d07d6efca105350 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 30 Apr 2019 19:15:30 +0100
Subject: [PATCH 0550/1835] bcm2835-pcm.c: Support multichannel audio

---
 .../vc04_services/bcm2835-audio/bcm2835-pcm.c   | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
index bc1eaa3a07731..1c19c4e4598ff 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
@@ -14,9 +14,9 @@ static const struct snd_pcm_hardware snd_bcm2835_playback_hw = {
 		 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
 		 SNDRV_PCM_INFO_DRAIN_TRIGGER | SNDRV_PCM_INFO_SYNC_APPLPTR),
 	.formats = SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
-	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
+	.rates = SNDRV_PCM_RATE_CONTINUOUS |  SNDRV_PCM_RATE_8000_192000,
 	.rate_min = 8000,
-	.rate_max = 48000,
+	.rate_max = 192000,
 	.channels_min = 1,
 	.channels_max = 2,
 	.buffer_bytes_max = 128 * 1024,
@@ -31,15 +31,16 @@ static const struct snd_pcm_hardware snd_bcm2835_playback_spdif_hw = {
 		 SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_MMAP_VALID |
 		 SNDRV_PCM_INFO_DRAIN_TRIGGER | SNDRV_PCM_INFO_SYNC_APPLPTR),
 	.formats = SNDRV_PCM_FMTBIT_S16_LE,
-	.rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_44100 |
-	SNDRV_PCM_RATE_48000,
+	.rates = SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |
+	SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 |
+	SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000,
 	.rate_min = 44100,
-	.rate_max = 48000,
+	.rate_max = 192000,
 	.channels_min = 2,
-	.channels_max = 2,
-	.buffer_bytes_max = 128 * 1024,
+	.channels_max = 8,
+	.buffer_bytes_max = 512 * 1024,
 	.period_bytes_min = 1 * 1024,
-	.period_bytes_max = 128 * 1024,
+	.period_bytes_max = 512 * 1024,
 	.periods_min = 1,
 	.periods_max = 128,
 };
-- 
GitLab


From 90711e7fcc30c317e4240f26ac59f1dd0122b04f Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Wed, 12 Sep 2018 14:44:53 +0100
Subject: [PATCH 0551/1835] bcmgenet: constrain max DMA burst length

---
 drivers/net/ethernet/broadcom/genet/bcmgenet.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index 14b49612aa863..7730a09b9e7ce 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -31,7 +31,7 @@
 #define ENET_PAD		8
 #define ENET_MAX_MTU_SIZE	(ETH_DATA_LEN + ETH_HLEN + VLAN_HLEN + \
 				 ENET_BRCM_TAG_LEN + ETH_FCS_LEN + ENET_PAD)
-#define DMA_MAX_BURST_LENGTH    0x10
+#define DMA_MAX_BURST_LENGTH    0x08
 
 /* misc. configuration */
 #define CLEAR_ALL_HFB			0xFF
-- 
GitLab


From 6502950aad1ba53d3eb7aab309d9d3d232050f52 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 27 Mar 2019 13:45:46 +0000
Subject: [PATCH 0552/1835] bcmgenet: Better coalescing parameter defaults

Set defaults for TX and RX packet coalescing to be equivalent to:

  # ethtool -C eth0 tx-frames 10
  # ethtool -C eth0 rx-usecs 50

This may be something we want to set via DT parameters in the
future.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 2d6f090bf6440..bdd7717c890b1 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2147,7 +2147,7 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
 
 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_PROD_INDEX);
 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_CONS_INDEX);
-	bcmgenet_tdma_ring_writel(priv, index, 1, DMA_MBUF_DONE_THRESH);
+	bcmgenet_tdma_ring_writel(priv, index, 10, DMA_MBUF_DONE_THRESH);
 	/* Disable rate control for now */
 	bcmgenet_tdma_ring_writel(priv, index, flow_period_val,
 				  TDMA_FLOW_PERIOD);
@@ -3576,9 +3576,12 @@ static int bcmgenet_probe(struct platform_device *pdev)
 	netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
 
 	/* Set default coalescing parameters */
-	for (i = 0; i < priv->hw_params->rx_queues; i++)
+	for (i = 0; i < priv->hw_params->rx_queues; i++) {
 		priv->rx_rings[i].rx_max_coalesced_frames = 1;
+		priv->rx_rings[i].rx_coalesce_usecs = 50;
+	}
 	priv->rx_rings[DESC_INDEX].rx_max_coalesced_frames = 1;
+	priv->rx_rings[DESC_INDEX].rx_coalesce_usecs = 50;
 
 	/* libphy will determine the link state */
 	netif_carrier_off(dev);
-- 
GitLab


From eb5df670a81d7dfa879938ba0eaac679f024b264 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 14 May 2019 17:17:59 +0100
Subject: [PATCH 0553/1835] net: genet: enable link energy detect powerdown for
 external PHYs

There are several warts surrounding bcmgenet_mii_probe() as this
function is called from ndo_open, but it's calling registration-type
functions. The probe should be called at probe time and refactored
such that the PHY device data can be extracted to limit the scope
of this flag to Broadcom PHYs.

For now, pass this flag in as it puts our attached PHY into a low-power
state when disconnected.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/net/ethernet/broadcom/genet/bcmmii.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index de0e24d912fe9..20689b1a220b1 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -280,7 +280,10 @@ int bcmgenet_mii_probe(struct net_device *dev)
 	int ret;
 
 	/* Communicate the integrated PHY revision */
-	phy_flags = priv->gphy_rev;
+	if (priv->internal_phy)
+		phy_flags = priv->gphy_rev;
+	else
+		phy_flags = PHY_BRCM_AUTO_PWRDWN_ENABLE;
 
 	/* Initialize link state variables that bcmgenet_mii_setup() uses */
 	priv->old_link = -1;
-- 
GitLab


From 360c8e98883f9cd075564be8a7fc25ac0785dee4 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 14 May 2019 17:00:41 +0100
Subject: [PATCH 0554/1835] phy: broadcom: split out the BCM54213PE from the
 BCM54210E IDs

The last nibble is a revision ID, and the 54213pe is a later rev
than the 54210e. Running the 54210e setup code on a 54213pe results
in a broken RGMII interface.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/net/phy/broadcom.c | 17 ++++++++++++++---
 include/linux/brcmphy.h    |  1 +
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index e86ea105c8022..9bded877cd6eb 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -222,7 +222,8 @@ static void bcm54xx_adjust_rxrefclk(struct phy_device *phydev)
 	/* Abort if we are using an untested phy. */
 	if (BRCM_PHY_MODEL(phydev) != PHY_ID_BCM57780 &&
 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610 &&
-	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610M)
+	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610M &&
+	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM54213PE)
 		return;
 
 	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_SCR3);
@@ -604,13 +605,22 @@ static struct phy_driver broadcom_drivers[] = {
 	.config_intr	= bcm_phy_config_intr,
 }, {
 	.phy_id		= PHY_ID_BCM54210E,
-	.phy_id_mask	= 0xfffffff0,
+	.phy_id_mask	= 0xffffffff,
 	.name		= "Broadcom BCM54210E",
 	.features	= PHY_GBIT_FEATURES,
 	.flags		= PHY_HAS_INTERRUPT,
 	.config_init	= bcm54xx_config_init,
 	.ack_interrupt	= bcm_phy_ack_intr,
 	.config_intr	= bcm_phy_config_intr,
+}, {
+	.phy_id		= PHY_ID_BCM54213PE,
+	.phy_id_mask	= 0xffffffff,
+	.name		= "Broadcom BCM54213PE",
+	.features	= PHY_GBIT_FEATURES,
+	.flags		= PHY_HAS_INTERRUPT,
+	.config_init	= bcm54xx_config_init,
+	.ack_interrupt	= bcm_phy_ack_intr,
+	.config_intr	= bcm_phy_config_intr,
 }, {
 	.phy_id		= PHY_ID_BCM5461,
 	.phy_id_mask	= 0xfffffff0,
@@ -748,7 +758,8 @@ module_phy_driver(broadcom_drivers);
 static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
 	{ PHY_ID_BCM5411, 0xfffffff0 },
 	{ PHY_ID_BCM5421, 0xfffffff0 },
-	{ PHY_ID_BCM54210E, 0xfffffff0 },
+	{ PHY_ID_BCM54210E, 0xffffffff },
+	{ PHY_ID_BCM54213PE, 0xffffffff },
 	{ PHY_ID_BCM5461, 0xfffffff0 },
 	{ PHY_ID_BCM54612E, 0xfffffff0 },
 	{ PHY_ID_BCM54616S, 0xfffffff0 },
diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
index 949e9af8d9d61..67c7939b83070 100644
--- a/include/linux/brcmphy.h
+++ b/include/linux/brcmphy.h
@@ -20,6 +20,7 @@
 #define PHY_ID_BCM5411			0x00206070
 #define PHY_ID_BCM5421			0x002060e0
 #define PHY_ID_BCM54210E		0x600d84a0
+#define PHY_ID_BCM54213PE		0x600d84a2
 #define PHY_ID_BCM5464			0x002060b0
 #define PHY_ID_BCM5461			0x002060c0
 #define PHY_ID_BCM54612E		0x03625e60
-- 
GitLab


From af502b2acafb23364b5757f01ae2c43e2943f195 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Fri, 17 May 2019 13:31:21 +0100
Subject: [PATCH 0555/1835] phy: bcm54213pe: configure the LED outputs to be
 more user-friendly

The default state was both LEDs indicating link speed.

Change the default configuration to
- Amber: 1000/100 link speed indication
- Green: link present + activity indication

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/net/phy/broadcom.c | 17 +++++++++++++++++
 include/linux/brcmphy.h    |  4 ++++
 2 files changed, 21 insertions(+)

diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index 9bded877cd6eb..a919a6a4c970f 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -52,6 +52,21 @@ static int bcm54210e_config_init(struct phy_device *phydev)
 	return 0;
 }
 
+static void bcm54213pe_config_init(struct phy_device *phydev)
+{
+	u16 val;
+
+	/* Enable ACT+LINK indication on ACTIVITY trigger */
+	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_LEDCTL);
+	val |= BCM54XX_SHD_LEDCTL_ACTLINK_EN;
+	bcm_phy_write_shadow(phydev, BCM54XX_SHD_LEDCTL, val);
+
+	/* Set ACTIVITY on LED "1" output, LINKSPD[1] on LED "3" output */
+	val = BCM5482_SHD_LEDS1_LED1(BCM_LED_SRC_ACTIVITYLED) |
+		BCM5482_SHD_LEDS1_LED3(BCM_LED_SRC_LINKSPD1);
+	bcm_phy_write_shadow(phydev, BCM5482_SHD_LEDS1, val);
+}
+
 static int bcm54612e_config_init(struct phy_device *phydev)
 {
 	int reg;
@@ -310,6 +325,8 @@ static int bcm54xx_config_init(struct phy_device *phydev)
 		err = bcm54210e_config_init(phydev);
 		if (err)
 			return err;
+	} else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54213PE) {
+		bcm54213pe_config_init(phydev);
 	} else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54612E) {
 		err = bcm54612e_config_init(phydev);
 		if (err)
diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
index 67c7939b83070..f4c80638c5156 100644
--- a/include/linux/brcmphy.h
+++ b/include/linux/brcmphy.h
@@ -168,6 +168,10 @@
 #define  BCM54XX_SHD_SCR3_DLLAPD_DIS	0x0002
 #define  BCM54XX_SHD_SCR3_TRDDAPD	0x0004
 
+/* 01001: Additional LED trigger options */
+#define BCM54XX_SHD_LEDCTL		0x09
+#define  BCM54XX_SHD_LEDCTL_ACTLINK_EN	0x0010
+
 /* 01010: Auto Power-Down */
 #define BCM54XX_SHD_APD			0x0a
 #define  BCM_APD_CLR_MASK		0xFE9F /* clear bits 5, 6 & 8 */
-- 
GitLab


From 0a1cf0d4b15cd1e2d96f7c85cadc1b60c9337151 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 21 May 2019 13:36:52 +0100
Subject: [PATCH 0556/1835] dwc_otg: Choose appropriate IRQ handover strategy

2711 has no MPHI peripheral, but the ARM Control block can fake
interrupts. Use the size of the DTB "mphi" reg block to determine
which is required.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/usb/host/dwc_otg/dwc_otg_driver.c    |  9 +++--
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c   | 21 ++++++----
 drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h   |  2 +
 drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c  | 12 ++++--
 drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 41 +++++++++++++-------
 drivers/usb/host/dwc_otg/dwc_otg_os_dep.h    |  3 ++
 6 files changed, 60 insertions(+), 28 deletions(-)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.c b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
index 3fd21c7ba3607..6bfd35c57814a 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_driver.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
@@ -806,14 +806,15 @@ static int dwc_otg_driver_probe(
 		if (!request_mem_region(_dev->resource[1].start,
 	                                _dev->resource[1].end - _dev->resource[1].start + 1,
 	                                "dwc_otg")) {
-	          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
-	          retval = -EFAULT;
-	          goto fail;
-	}
+			dev_dbg(&_dev->dev, "error reserving mapped memory\n");
+			retval = -EFAULT;
+			goto fail;
+		}
 
 		dwc_otg_device->os_dep.mphi_base = ioremap_nocache(_dev->resource[1].start,
 							    _dev->resource[1].end -
 							    _dev->resource[1].start + 1);
+		dwc_otg_device->os_dep.use_swirq = (_dev->resource[1].end - _dev->resource[1].start) == 0x200;
 	}
 
 #else
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
index 3ac4c7984ce56..a86d8ed771409 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
@@ -1347,8 +1347,12 @@ void notrace dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels)
 	/* We got an interrupt, didn't handle it. */
 	if (kick_irq) {
 		state->mphi_int_count++;
-		FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
-		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+		if (state->mphi_regs.swirq_set) {
+			FIQ_WRITE(state->mphi_regs.swirq_set, 1);
+		} else {
+			FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
+			FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+		}
 
 	}
 	state->fiq_done++;
@@ -1406,11 +1410,14 @@ void notrace dwc_otg_fiq_nop(struct fiq_state *state)
 		state->mphi_int_count++;
 		gintmsk.d32 &= state->gintmsk_saved.d32;
 		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
-		/* Force a clear before another dummy send */
-		FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
-		FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
-		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
-
+		if (state->mphi_regs.swirq_set) {
+			FIQ_WRITE(state->mphi_regs.swirq_set, 1);
+		} else {
+			/* Force a clear before another dummy send */
+			FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
+			FIQ_WRITE(state->mphi_regs.outdda, state->dummy_send_dma);
+			FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+		}
 	}
 	state->fiq_done++;
 	mb();
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
index f517371421884..537cc237b4bca 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
@@ -118,6 +118,8 @@ typedef struct {
 	volatile void* outdda;
 	volatile void* outddb;
 	volatile void* intstat;
+	volatile void* swirq_set;
+	volatile void* swirq_clr;
 } mphi_regs_t;
 
 enum fiq_debug_level {
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
index 6947e98b87adb..d3097ef3728ca 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
@@ -220,16 +220,20 @@ exit_handler_routine:
 
 		/* The FIQ could have sneaked another interrupt in. If so, don't clear MPHI */
 		if ((gintmsk_new.d32 == ~0) && (haintmsk_new.d32 == 0x0000FFFF)) {
+			if (dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr) {
+				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr, 1);
+			} else {
 				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.intstat, (1<<16));
-				if (dwc_otg_hcd->fiq_state->mphi_int_count >= 50) {
-					fiq_print(FIQDBG_INT, dwc_otg_hcd->fiq_state, "MPHI CLR");
+			}
+			if (dwc_otg_hcd->fiq_state->mphi_int_count >= 50) {
+				fiq_print(FIQDBG_INT, dwc_otg_hcd->fiq_state, "MPHI CLR");
 					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, ((1<<31) + (1<<16)));
 					while (!(DWC_READ_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & (1 << 17)))
 						;
 					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, (1<<31));
 					dwc_otg_hcd->fiq_state->mphi_int_count = 0;
-				}
-				int_done++;
+			}
+			int_done++;
 		}
 		haintmsk.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
 		/* Re-enable interrupts that the FIQ masked (first time round) */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
index fc43f2a66d6ab..08a3e41038a3e 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -474,22 +474,37 @@ static void hcd_init_fiq(void *cookie)
 	set_fiq_regs(&regs);
 #endif
 
-	//Set the mphi periph to  the required registers
-	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
-	dwc_otg_hcd->fiq_state->mphi_regs.ctrl    = otg_dev->os_dep.mphi_base + 0x4c;
-	dwc_otg_hcd->fiq_state->mphi_regs.outdda  = otg_dev->os_dep.mphi_base + 0x28;
-	dwc_otg_hcd->fiq_state->mphi_regs.outddb  = otg_dev->os_dep.mphi_base + 0x2c;
-	dwc_otg_hcd->fiq_state->mphi_regs.intstat = otg_dev->os_dep.mphi_base + 0x50;
 	dwc_otg_hcd->fiq_state->dwc_regs_base = otg_dev->os_dep.base;
-	DWC_WARN("MPHI regs_base at %px", dwc_otg_hcd->fiq_state->mphi_regs.base);
-	//Enable mphi peripheral
-	writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
+	//Set the mphi periph to the required registers
+	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
+	if (otg_dev->os_dep.use_swirq) {
+		dwc_otg_hcd->fiq_state->mphi_regs.swirq_set =
+			otg_dev->os_dep.mphi_base + 0x1f0;
+		dwc_otg_hcd->fiq_state->mphi_regs.swirq_clr =
+			otg_dev->os_dep.mphi_base + 0x1f4;
+		DWC_WARN("Fake MPHI regs_base at 0x%08x",
+			 (int)dwc_otg_hcd->fiq_state->mphi_regs.base);
+	} else {
+		dwc_otg_hcd->fiq_state->mphi_regs.ctrl =
+			otg_dev->os_dep.mphi_base + 0x4c;
+		dwc_otg_hcd->fiq_state->mphi_regs.outdda
+			= otg_dev->os_dep.mphi_base + 0x28;
+		dwc_otg_hcd->fiq_state->mphi_regs.outddb
+			= otg_dev->os_dep.mphi_base + 0x2c;
+		dwc_otg_hcd->fiq_state->mphi_regs.intstat
+			= otg_dev->os_dep.mphi_base + 0x50;
+		DWC_WARN("MPHI regs_base at %px",
+			 dwc_otg_hcd->fiq_state->mphi_regs.base);
+
+		//Enable mphi peripheral
+		writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
 #ifdef DEBUG
-	if (readl(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & 0x80000000)
-		DWC_WARN("MPHI periph has been enabled");
-	else
-		DWC_WARN("MPHI periph has NOT been enabled");
+		if (readl(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & 0x80000000)
+			DWC_WARN("MPHI periph has been enabled");
+		else
+			DWC_WARN("MPHI periph has NOT been enabled");
 #endif
+	}
 	// Enable FIQ interrupt from USB peripheral
 #ifdef CONFIG_ARM64
 	irq = otg_dev->os_dep.fiq_num;
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
index 3da96b2531559..0e9a34fe3a5c8 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
+++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
@@ -102,6 +102,9 @@ typedef struct os_dependent {
 	/** Base address for MPHI peripheral */
 	void *mphi_base;
 
+	/** mphi_base actually points to the SWIRQ block */
+	bool use_swirq;
+
 	/** IRQ number (<0 if not valid) */
 	int irq_num;
 
-- 
GitLab


From 255ee621cf84e52ecc902d888ca3103d4c5456a4 Mon Sep 17 00:00:00 2001
From: Tim Gover <tim.gover@raspberrypi.org>
Date: Fri, 22 Mar 2019 09:47:14 +0000
Subject: [PATCH 0557/1835] usb: xhci: Disable the XHCI 5 second timeout

If the VL805 EEPROM has not been programmed then boot will hang for five
seconds. The timeout seems to be arbitrary and is an unecessary
delay on the first boot. Remove the timeout.

This is common code and probably can't be upstreamed unless the timeout
can be configurable somehow or perhaps the XHCI driver can be skipped
on the first boot.
---
 drivers/usb/host/xhci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index f30b065095fa7..e9edd823fe91d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -196,8 +196,9 @@ int xhci_reset(struct xhci_hcd *xhci)
 	if (xhci->quirks & XHCI_INTEL_HOST)
 		udelay(1000);
 
+	// Hack: reduce handshake timeout from 10s 0.5s due to unprogrammed vl805
 	ret = xhci_handshake(&xhci->op_regs->command,
-			CMD_RESET, 0, 10 * 1000 * 1000);
+			CMD_RESET, 0, 500 * 1000);
 	if (ret)
 		return ret;
 
-- 
GitLab


From 1909f49bd03f600ce35583b30452430f2e8633ee Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 23 May 2019 15:08:30 +0100
Subject: [PATCH 0558/1835] usb: xhci: Show that the VIA VL805 supports LPM

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/usb/host/xhci-pci.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 1493d0fdf5ad1..ac0d7a684fae2 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -222,6 +222,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 			pdev->device == 0x3432)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 
+	if (pdev->vendor == PCI_VENDOR_ID_VIA &&
+			pdev->device == 0x3483)
+		xhci->quirks |= XHCI_LPM_SUPPORT;
+
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 			pdev->device == 0x1042)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
-- 
GitLab


From 1e6abe096683e7520b9692cc490d02bf4d6e705c Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Thu, 30 May 2019 10:38:40 +0100
Subject: [PATCH 0559/1835] usb: xhci: hack xhci_urb_enqueue to support
 hid.mousepoll behaviour

xHCI creates endpoint contexts directly from the device's endpoint
data, so submitting URBs with urb->interval different from the hardware
interval has no effect.

Add an explicit reconfiguration of the endpoint context when requested,
which will happen only when the interval is different from the cached
value. In practice, the reconfiguration only happens on the first URB
submitted for the endpoint.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/usb/host/xhci.c | 86 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e9edd823fe91d..2d73827fe74eb 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1415,6 +1415,87 @@ command_cleanup:
 	return ret;
 }
 
+/*
+ * RPI: Fixup endpoint intervals when requested
+ * - Check interval versus the (cached) endpoint context
+ * - set the endpoint interval to the new value
+ * - force an endpoint configure command
+ */
+static void xhci_fixup_interval(struct xhci_hcd *xhci, struct urb *urb,
+				unsigned int slot_id, unsigned int ep_index)
+{
+	struct xhci_ep_ctx *ep_ctx_out, *ep_ctx_in;
+	struct xhci_command *command;
+	struct xhci_input_control_ctx *ctrl_ctx;
+	struct xhci_virt_device *vdev;
+	int xhci_interval, ep_interval;
+	int ret;
+	unsigned long flags;
+	u32 ep_info_tmp;
+
+	spin_lock_irqsave(&xhci->lock, flags);
+
+	vdev = xhci->devs[slot_id];
+	/* Get context-derived endpoint interval */
+	ep_ctx_out = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+	ep_ctx_in = xhci_get_ep_ctx(xhci, vdev->in_ctx, ep_index);
+	xhci_interval = EP_INTERVAL_TO_UFRAMES(le32_to_cpu(ep_ctx_out->ep_info));
+	ep_interval = urb->interval * 8;
+
+	if (ep_interval == xhci_interval) {
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		return;
+	}
+
+	xhci_dbg(xhci, "Fixup interval ep_interval=%d xhci_interval=%d\n",
+		 ep_interval, xhci_interval);
+	command = xhci_alloc_command_with_ctx(xhci, true, GFP_ATOMIC);
+	if (!command) {
+		/* Failure here is benign, poll at the original rate */
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		return;
+	}
+
+	/* xHCI uses exponents for intervals... */
+	xhci_interval = fls(ep_interval) - 1;
+	xhci_interval = clamp_val(xhci_interval, 3, 10);
+	ep_info_tmp = le32_to_cpu(ep_ctx_out->ep_info);
+	ep_info_tmp &= ~EP_INTERVAL(255);
+	ep_info_tmp |= EP_INTERVAL(xhci_interval);
+
+	/* Keep the endpoint context up-to-date while issuing the command. */
+	xhci_endpoint_copy(xhci, vdev->in_ctx,
+			   vdev->out_ctx, ep_index);
+	ep_ctx_in->ep_info = cpu_to_le32(ep_info_tmp);
+
+	/*
+	 * We need to drop the lock, so take an explicit copy
+	 * of the ep context.
+	 */
+	xhci_endpoint_copy(xhci, command->in_ctx, vdev->in_ctx, ep_index);
+
+	ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
+	if (!ctrl_ctx) {
+		xhci_warn(xhci,
+			  "%s: Could not get input context, bad type.\n",
+			  __func__);
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		xhci_free_command(xhci, command);
+		return;
+	}
+	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
+	ctrl_ctx->drop_flags = 0;
+
+	spin_unlock_irqrestore(&xhci->lock, flags);
+
+	ret = xhci_configure_endpoint(xhci, urb->dev, command,
+				      false, false);
+	if (ret)
+		xhci_warn(xhci, "%s: Configure endpoint failed: %d\n",
+			  __func__, ret);
+	xhci_free_command(xhci, command);
+}
+
 /*
  * non-error returns are a promise to giveback() the urb later
  * we drop ownership so next owner (or urb unlink) can get it
@@ -1479,6 +1560,11 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 		}
 	}
 
+	if (usb_endpoint_xfer_int(&urb->ep->desc) &&
+	    (urb->dev->speed == USB_SPEED_FULL ||
+	     urb->dev->speed == USB_SPEED_LOW))
+		xhci_fixup_interval(xhci, urb, slot_id, ep_index);
+
 	spin_lock_irqsave(&xhci->lock, flags);
 
 	if (xhci->xhc_state & XHCI_STATE_DYING) {
-- 
GitLab


From abcfd092860760087b87acbdda0963fe7906839c Mon Sep 17 00:00:00 2001
From: Tim Gover <tim.gover@raspberrypi.org>
Date: Wed, 9 Jan 2019 14:43:36 +0000
Subject: [PATCH 0560/1835] pinctrl-bcm2835: Add support for BCM2838

GPIO configuration on BCM2838 is largely the same as BCM2835 except for
the pull up/down configuration. The old mechanism has been replaced
by new registers which don't require the fixed delay.

Detect BCN2838 at run-time and use the new mechanism. Backwards
compatibility for the device-tree configuration has been retained.
---
 drivers/pinctrl/bcm/pinctrl-bcm2835.c | 58 ++++++++++++++++++++-------
 1 file changed, 44 insertions(+), 14 deletions(-)

diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 475e0fbd03c8d..0a61292924ec2 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -67,6 +67,12 @@
 #define GPPUD		0x94	/* Pin Pull-up/down Enable */
 #define GPPUDCLK0	0x98	/* Pin Pull-up/down Enable Clock */
 
+/* 2711 has a different mechanism for pin pull-up/down/enable  */
+#define GPPUPPDN0		0xe4	/* Pin pull-up/down for pins 15:0  */
+#define GPPUPPDN1		0xe8	/* Pin pull-up/down for pins 31:16 */
+#define GPPUPPDN2		0xec	/* Pin pull-up/down for pins 47:32 */
+#define GPPUPPDN3		0xf0	/* Pin pull-up/down for pins 57:48 */
+
 #define FSEL_REG(p)		(GPFSEL0 + (((p) / 10) * 4))
 #define FSEL_SHIFT(p)		(((p) % 10) * 3)
 #define GPIO_REG_OFFSET(p)	((p) / 32)
@@ -917,21 +923,45 @@ static void bcm2835_pull_config_set(struct bcm2835_pinctrl *pc,
 		unsigned int pin, unsigned int arg)
 {
 	u32 off, bit;
+	/* BCM2835, BCM2836 & BCM2837 return 'gpio' for this unused register */
+	int is_2835 = bcm2835_gpio_rd(pc, GPPUPPDN3) == 0x6770696f;
 
-	off = GPIO_REG_OFFSET(pin);
-	bit = GPIO_REG_SHIFT(pin);
-
-	bcm2835_gpio_wr(pc, GPPUD, arg & 3);
-	/*
-	 * BCM2835 datasheet say to wait 150 cycles, but not of what.
-	 * But the VideoCore firmware delay for this operation
-	 * based nearly on the same amount of VPU cycles and this clock
-	 * runs at 250 MHz.
-	 */
-	udelay(1);
-	bcm2835_gpio_wr(pc, GPPUDCLK0 + (off * 4), BIT(bit));
-	udelay(1);
-	bcm2835_gpio_wr(pc, GPPUDCLK0 + (off * 4), 0);
+        if (is_2835) {
+		off = GPIO_REG_OFFSET(pin);
+		bit = GPIO_REG_SHIFT(pin);
+		/*
+		 * BCM2835 datasheet say to wait 150 cycles, but not of what.
+		 * But the VideoCore firmware delay for this operation
+		 * based nearly on the same amount of VPU cycles and this clock
+		 * runs at 250 MHz.
+		 */
+		bcm2835_gpio_wr(pc, GPPUD, arg & 3);
+		udelay(1);
+		bcm2835_gpio_wr(pc, GPPUDCLK0 + (off * 4), BIT(bit));
+		udelay(1);
+		bcm2835_gpio_wr(pc, GPPUDCLK0 + (off * 4), 0);
+	} else {
+		u32 reg;
+		int lsb;
+
+		off = (pin >> 4);
+		if (off > 3)
+			return;
+		lsb = (pin & 0xf) << 1;
+
+		/* The up/down semantics are reversed compared to BCM2835.
+		 * Instead of updating all the device tree files, translate the
+		 * values here.
+		 */
+		if (arg == 2)
+			arg = 1;
+		else if (arg == 1)
+			arg = 2;
+		reg = bcm2835_gpio_rd(pc, GPPUPPDN0 + (off *4));
+		reg &= ~(0x3 << lsb);
+		reg |= (arg & 3) << lsb;
+		bcm2835_gpio_wr(pc, GPPUPPDN0 + (off * 4), reg);
+	}
 }
 
 static int bcm2835_pinconf_set(struct pinctrl_dev *pctldev,
-- 
GitLab


From e33c10004ef2e1ed0e637de603ab3941e758f8af Mon Sep 17 00:00:00 2001
From: Martin Sperl <kernel@martin.sperl.org>
Date: Mon, 13 May 2019 11:05:27 +0000
Subject: [PATCH 0561/1835] spi: bcm2835: enable shared interrupt support

Add shared interrupt support for this driver.

Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
---
 drivers/spi/spi-bcm2835.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 5816bae19d584..885740ccedfac 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -150,6 +150,10 @@ static irqreturn_t bcm2835_spi_interrupt(int irq, void *dev_id)
 	struct spi_master *master = dev_id;
 	struct bcm2835_spi *bs = spi_master_get_devdata(master);
 
+	/* check if we got interrupt enabled */
+	if (!(bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_INTR))
+		return IRQ_NONE;
+
 	/* Read as many bytes as possible from FIFO */
 	bcm2835_rd_fifo(bs);
 	/* Write as many bytes as possible to FIFO */
@@ -755,7 +759,8 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 	bcm2835_wr(bs, BCM2835_SPI_CS,
 		   BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
 
-	err = devm_request_irq(&pdev->dev, bs->irq, bcm2835_spi_interrupt, 0,
+	err = devm_request_irq(&pdev->dev, bs->irq, bcm2835_spi_interrupt,
+			       IRQF_SHARED,
 			       dev_name(&pdev->dev), master);
 	if (err) {
 		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
-- 
GitLab


From dbe83432062b4be86800da7b208434fde208437e Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Thu, 9 May 2019 14:30:37 +0100
Subject: [PATCH 0562/1835] drivers: char: add chardev for mmap'ing Argon
 control registers

Based on the gpiomem driver, allow mapping of the decoder register
spaces such that userspace can access control/status registers.
This driver is intended for use with a custom ffmpeg backend accelerator
prior to a v4l2 driver being written.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/char/broadcom/Kconfig     |   8 +
 drivers/char/broadcom/Makefile    |   1 +
 drivers/char/broadcom/argon-mem.c | 277 ++++++++++++++++++++++++++++++
 3 files changed, 286 insertions(+)
 create mode 100644 drivers/char/broadcom/argon-mem.c

diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
index cffd17df6a1b6..4ba3fb4049eb0 100644
--- a/drivers/char/broadcom/Kconfig
+++ b/drivers/char/broadcom/Kconfig
@@ -49,3 +49,11 @@ config BCM2835_SMI_DEV
 		This driver provides a character device interface (ioctl + read/write) to
 		Broadcom's Secondary Memory interface. The low-level functionality is provided
 		by the SMI driver itself.
+
+config ARGON_MEM
+	tristate "Character device driver for the Argon decoder hardware"
+	default n
+	help
+		This driver provides a character device interface for memory-map operations
+		so userspace tools can access the control and status registers of the Argon
+		video decoder hardware.
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
index 7d9cb3e0b1c3c..50767fc1b5690 100644
--- a/drivers/char/broadcom/Makefile
+++ b/drivers/char/broadcom/Makefile
@@ -4,3 +4,4 @@ obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
 
 obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
 obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
+obj-$(CONFIG_ARGON_MEM)		+= argon-mem.o
diff --git a/drivers/char/broadcom/argon-mem.c b/drivers/char/broadcom/argon-mem.c
new file mode 100644
index 0000000000000..01c36db7754a8
--- /dev/null
+++ b/drivers/char/broadcom/argon-mem.c
@@ -0,0 +1,277 @@
+/**
+ * argon-mem.c - character device access to the Argon decoder registers
+ *
+ * Based on bcm2835-gpiomem.c. Provides IO memory access to the decoder
+ * register blocks such that ffmpeg plugins can access the hardware.
+ *
+ * Jonathan Bell <jonathan@raspberrypi.org>
+ * Copyright (c) 2019, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <linux/pagemap.h>
+#include <linux/io.h>
+
+#define DRIVER_NAME "argon-mem"
+#define DEVICE_MINOR 0
+
+struct argon_mem_priv {
+	dev_t devid;
+	struct class *class;
+	struct cdev argon_mem_cdev;
+	unsigned long regs_phys;
+	unsigned long mem_window_len;
+	struct device *dev;
+	const char *name;
+};
+
+static int argon_mem_open(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+	int ret = 0;
+	struct argon_mem_priv *priv;
+	if (dev != DEVICE_MINOR)
+		ret = -ENXIO;
+
+	priv = container_of(inode->i_cdev, struct argon_mem_priv,
+				argon_mem_cdev);
+	if (!priv)
+		return -EINVAL;
+	file->private_data = priv;
+	return ret;
+}
+
+static int argon_mem_release(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+	int ret = 0;
+
+	if (dev != DEVICE_MINOR)
+		ret = -ENXIO;
+
+	return ret;
+}
+
+static const struct vm_operations_struct argon_mem_vm_ops = {
+#ifdef CONFIG_HAVE_IOREMAP_PROT
+	.access = generic_access_phys
+#endif
+};
+
+static int argon_mem_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	struct argon_mem_priv *priv;
+	unsigned long pages;
+
+	priv = file->private_data;
+	pages = priv->regs_phys >> PAGE_SHIFT;
+	/*
+	 * The address decode is far larger than the actual number of registers.
+	 * Just map the whole lot in.
+	 */
+	vma->vm_page_prot = phys_mem_access_prot(file, pages,
+						 priv->mem_window_len,
+						 vma->vm_page_prot);
+	vma->vm_ops = &argon_mem_vm_ops;
+	if (remap_pfn_range(vma, vma->vm_start,
+			pages,
+			priv->mem_window_len,
+			vma->vm_page_prot)) {
+		return -EAGAIN;
+	}
+	return 0;
+}
+
+static const struct file_operations
+argon_mem_fops = {
+	.owner = THIS_MODULE,
+	.open = argon_mem_open,
+	.release = argon_mem_release,
+	.mmap = argon_mem_mmap,
+};
+
+static const struct of_device_id argon_mem_of_match[];
+static int argon_mem_probe(struct platform_device *pdev)
+{
+	int err;
+	void *ptr_err;
+	const struct of_device_id *id;
+	struct device *dev = &pdev->dev;
+	struct device *argon_mem_dev;
+	struct resource *ioresource;
+	struct argon_mem_priv *priv;
+
+
+	/* Allocate buffers and instance data */
+
+	priv = kzalloc(sizeof(struct argon_mem_priv), GFP_KERNEL);
+
+	if (!priv) {
+		err = -ENOMEM;
+		goto failed_inst_alloc;
+	}
+	platform_set_drvdata(pdev, priv);
+
+	priv->dev = dev;
+	id = of_match_device(argon_mem_of_match, dev);
+	if (!id)
+		return -EINVAL;
+	priv->name = id->data;
+
+	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (ioresource) {
+		priv->regs_phys = ioresource->start;
+		priv->mem_window_len = ioresource->end - ioresource->start;
+	} else {
+		dev_err(priv->dev, "failed to get IO resource");
+		err = -ENOENT;
+		goto failed_get_resource;
+	}
+
+	/* Create character device entries */
+
+	err = alloc_chrdev_region(&priv->devid,
+				  DEVICE_MINOR, 1, priv->name);
+	if (err != 0) {
+		dev_err(priv->dev, "unable to allocate device number");
+		goto failed_alloc_chrdev;
+	}
+	cdev_init(&priv->argon_mem_cdev, &argon_mem_fops);
+	priv->argon_mem_cdev.owner = THIS_MODULE;
+	err = cdev_add(&priv->argon_mem_cdev, priv->devid, 1);
+	if (err != 0) {
+		dev_err(priv->dev, "unable to register device");
+		goto failed_cdev_add;
+	}
+
+	/* Create sysfs entries */
+
+	priv->class = class_create(THIS_MODULE, priv->name);
+	ptr_err = priv->class;
+	if (IS_ERR(ptr_err))
+		goto failed_class_create;
+
+	argon_mem_dev = device_create(priv->class, NULL,
+					priv->devid, NULL,
+					priv->name);
+	ptr_err = argon_mem_dev;
+	if (IS_ERR(ptr_err))
+		goto failed_device_create;
+
+	dev_info(priv->dev, "%s initialised: Registers at 0x%08lx length 0x%08lx",
+		priv->name, priv->regs_phys, priv->mem_window_len);
+
+	return 0;
+
+failed_device_create:
+	class_destroy(priv->class);
+failed_class_create:
+	cdev_del(&priv->argon_mem_cdev);
+	err = PTR_ERR(ptr_err);
+failed_cdev_add:
+	unregister_chrdev_region(priv->devid, 1);
+failed_alloc_chrdev:
+failed_get_resource:
+	kfree(priv);
+failed_inst_alloc:
+	dev_err(priv->dev, "could not load argon_mem");
+	return err;
+}
+
+static int argon_mem_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct argon_mem_priv *priv = platform_get_drvdata(pdev);
+
+	device_destroy(priv->class, priv->devid);
+	class_destroy(priv->class);
+	cdev_del(&priv->argon_mem_cdev);
+	unregister_chrdev_region(priv->devid, 1);
+	kfree(priv);
+
+	dev_info(dev, "%s driver removed - OK", priv->name);
+	return 0;
+}
+
+static const char argon_hevc_name[] = "argon-hevcmem";
+static const char argon_h264_name[] = "argon-h264mem";
+static const char argon_vp9_name[] = "argon-vp9mem";
+static const char argon_intc_name[] = "argon-intcmem";
+
+static const struct of_device_id argon_mem_of_match[] = {
+	{
+		.compatible = "raspberrypi,argon-hevc-decoder",
+		.data = &argon_hevc_name,
+	},
+	{
+		.compatible = "raspberrypi,argon-h264-decoder",
+		.data = &argon_h264_name,
+	},
+	{
+		.compatible = "raspberrypi,argon-vp9-decoder",
+		.data = &argon_vp9_name,
+	},
+	/* The "intc" is included as this block of hardware contains the
+	 * "frame done" status flags.
+	 */
+	{
+		.compatible = "raspberrypi,argon-local-intc",
+		.data = &argon_intc_name,
+	},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, argon_mem_of_match);
+
+static struct platform_driver argon_mem_driver = {
+	.probe = argon_mem_probe,
+	.remove = argon_mem_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = argon_mem_of_match,
+		   },
+};
+
+module_platform_driver(argon_mem_driver);
+
+MODULE_ALIAS("platform:argon-mem");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Driver for accessing Argon decoder registers from userspace");
+MODULE_AUTHOR("Jonathan Bell <jonathan@raspberrypi.org>");
-- 
GitLab


From e0a2bde82fc2323f2d6e2d51218df66b50b76fd0 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 23 Jan 2019 16:11:50 +0000
Subject: [PATCH 0563/1835] clk-bcm2835: Don't wait for pllh lock

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/clk/bcm/clk-bcm2835.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 3e001a7467a00..b8da17a6e6cdb 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -627,15 +627,17 @@ static int bcm2835_pll_on(struct clk_hw *hw)
 	spin_unlock(&cprman->regs_lock);
 
 	/* Wait for the PLL to lock. */
-	timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
-	while (!(cprman_read(cprman, CM_LOCK) & data->lock_mask)) {
-		if (ktime_after(ktime_get(), timeout)) {
-			dev_err(cprman->dev, "%s: couldn't lock PLL\n",
-				clk_hw_get_name(hw));
-			return -ETIMEDOUT;
+	if (strcmp(data->name, "pllh")) {
+		timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
+		while (!(cprman_read(cprman, CM_LOCK) & data->lock_mask)) {
+			if (ktime_after(ktime_get(), timeout)) {
+				dev_err(cprman->dev, "%s: couldn't lock PLL\n",
+					clk_hw_get_name(hw));
+				return -ETIMEDOUT;
+			}
+
+			cpu_relax();
 		}
-
-		cpu_relax();
 	}
 
 	cprman_write(cprman, data->a2w_ctrl_reg,
-- 
GitLab


From ae3f6780c32d263019c1ac87f896b3a4066322a0 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 12 Dec 2018 15:51:47 -0800
Subject: [PATCH 0564/1835] bcm2835-pm: Move bcm2835-watchdog's DT probe to an
 MFD.

The PM block that the wdt driver was binding to actually has multiple
features we want to expose (power domains, reset, watchdog).  Move the
DT attachment to a MFD driver and make WDT probe against MFD.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
(cherry picked from commit 5e6acc3e678ed3db746ab4fb53a980861cd711b6)
---
 drivers/mfd/Makefile           |  1 +
 drivers/mfd/bcm2835-pm.c       | 64 ++++++++++++++++++++++++++++++++++
 drivers/watchdog/bcm2835_wdt.c | 26 +++++---------
 include/linux/mfd/bcm2835-pm.h | 13 +++++++
 4 files changed, 87 insertions(+), 17 deletions(-)
 create mode 100644 drivers/mfd/bcm2835-pm.c
 create mode 100644 include/linux/mfd/bcm2835-pm.h

diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
index aa72f59f94c84..417ebd3abda66 100644
--- a/drivers/mfd/Makefile
+++ b/drivers/mfd/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_MFD_88PM805)	+= 88pm805.o 88pm80x.o
 obj-$(CONFIG_MFD_ACT8945A)	+= act8945a.o
 obj-$(CONFIG_MFD_SM501)		+= sm501.o
 obj-$(CONFIG_MFD_ASIC3)		+= asic3.o tmio_core.o
+obj-$(CONFIG_ARCH_BCM2835)	+= bcm2835-pm.o
 obj-$(CONFIG_MFD_BCM590XX)	+= bcm590xx.o
 obj-$(CONFIG_MFD_BD9571MWV)	+= bd9571mwv.o
 cros_ec_core-objs		:= cros_ec.o
diff --git a/drivers/mfd/bcm2835-pm.c b/drivers/mfd/bcm2835-pm.c
new file mode 100644
index 0000000000000..53839e6a81e7d
--- /dev/null
+++ b/drivers/mfd/bcm2835-pm.c
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * PM MFD driver for Broadcom BCM2835
+ *
+ * This driver binds to the PM block and creates the MFD device for
+ * the WDT driver.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/mfd/bcm2835-pm.h>
+#include <linux/mfd/core.h>
+#include <linux/module.h>
+#include <linux/of_address.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/types.h>
+#include <linux/watchdog.h>
+
+static const struct mfd_cell bcm2835_pm_devs[] = {
+	{ .name = "bcm2835-wdt" },
+};
+
+static int bcm2835_pm_probe(struct platform_device *pdev)
+{
+	struct resource *res;
+	struct device *dev = &pdev->dev;
+	struct bcm2835_pm *pm;
+
+	pm = devm_kzalloc(dev, sizeof(*pm), GFP_KERNEL);
+	if (!pm)
+		return -ENOMEM;
+	platform_set_drvdata(pdev, pm);
+
+	pm->dev = dev;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	pm->base = devm_ioremap_resource(dev, res);
+	if (IS_ERR(pm->base))
+		return PTR_ERR(pm->base);
+
+	return devm_mfd_add_devices(dev, -1,
+				    bcm2835_pm_devs, ARRAY_SIZE(bcm2835_pm_devs),
+				    NULL, 0, NULL);
+}
+
+static const struct of_device_id bcm2835_pm_of_match[] = {
+	{ .compatible = "brcm,bcm2835-pm-wdt", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, bcm2835_pm_of_match);
+
+static struct platform_driver bcm2835_pm_driver = {
+	.probe		= bcm2835_pm_probe,
+	.driver = {
+		.name =	"bcm2835-pm",
+		.of_match_table = bcm2835_pm_of_match,
+	},
+};
+module_platform_driver(bcm2835_pm_driver);
+
+MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+MODULE_DESCRIPTION("Driver for Broadcom BCM2835 PM MFD");
+MODULE_LICENSE("GPL");
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 9699e07119a72..4ed73194a64df 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -12,6 +12,7 @@
 
 #include <linux/delay.h>
 #include <linux/types.h>
+#include <linux/mfd/bcm2835-pm.h>
 #include <linux/module.h>
 #include <linux/io.h>
 #include <linux/watchdog.h>
@@ -41,6 +42,8 @@ struct bcm2835_wdt {
 	spinlock_t		lock;
 };
 
+static struct bcm2835_wdt *bcm2835_power_off_wdt;
+
 static unsigned int heartbeat;
 static bool nowayout = WATCHDOG_NOWAYOUT;
 
@@ -163,10 +166,7 @@ static struct watchdog_device bcm2835_wdt_wdd = {
  */
 static void bcm2835_power_off(void)
 {
-	struct device_node *np =
-		of_find_compatible_node(NULL, NULL, "brcm,bcm2835-pm-wdt");
-	struct platform_device *pdev = of_find_device_by_node(np);
-	struct bcm2835_wdt *wdt = platform_get_drvdata(pdev);
+	struct bcm2835_wdt *wdt = bcm2835_power_off_wdt;
 
 	/* Partition 63 tells the firmware that this is a halt */
 	__bcm2835_restart(wdt, 63);
@@ -174,7 +174,7 @@ static void bcm2835_power_off(void)
 
 static int bcm2835_wdt_probe(struct platform_device *pdev)
 {
-	struct resource *res;
+	struct bcm2835_pm *pm = dev_get_drvdata(pdev->dev.parent);
 	struct device *dev = &pdev->dev;
 	struct bcm2835_wdt *wdt;
 	int err;
@@ -186,10 +186,7 @@ static int bcm2835_wdt_probe(struct platform_device *pdev)
 
 	spin_lock_init(&wdt->lock);
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	wdt->base = devm_ioremap_resource(dev, res);
-	if (IS_ERR(wdt->base))
-		return PTR_ERR(wdt->base);
+	wdt->base = pm->base;
 
 	watchdog_set_drvdata(&bcm2835_wdt_wdd, wdt);
 	watchdog_init_timeout(&bcm2835_wdt_wdd, heartbeat, dev);
@@ -216,8 +213,10 @@ static int bcm2835_wdt_probe(struct platform_device *pdev)
 		return err;
 	}
 
-	if (pm_power_off == NULL)
+	if (pm_power_off == NULL) {
 		pm_power_off = bcm2835_power_off;
+		bcm2835_power_off_wdt = wdt;
+	}
 
 	dev_info(dev, "Broadcom BCM2835 watchdog timer");
 	return 0;
@@ -231,18 +230,11 @@ static int bcm2835_wdt_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static const struct of_device_id bcm2835_wdt_of_match[] = {
-	{ .compatible = "brcm,bcm2835-pm-wdt", },
-	{},
-};
-MODULE_DEVICE_TABLE(of, bcm2835_wdt_of_match);
-
 static struct platform_driver bcm2835_wdt_driver = {
 	.probe		= bcm2835_wdt_probe,
 	.remove		= bcm2835_wdt_remove,
 	.driver = {
 		.name =		"bcm2835-wdt",
-		.of_match_table = bcm2835_wdt_of_match,
 	},
 };
 module_platform_driver(bcm2835_wdt_driver);
diff --git a/include/linux/mfd/bcm2835-pm.h b/include/linux/mfd/bcm2835-pm.h
new file mode 100644
index 0000000000000..b7d0ee1feffad
--- /dev/null
+++ b/include/linux/mfd/bcm2835-pm.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
+#ifndef BCM2835_MFD_PM_H
+#define BCM2835_MFD_PM_H
+
+#include <linux/regmap.h>
+
+struct bcm2835_pm {
+	struct device *dev;
+	void __iomem *base;
+};
+
+#endif /* BCM2835_MFD_PM_H */
-- 
GitLab


From 716e6e18ca272365477d63d03aad91c8adb1422d Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 12 Dec 2018 15:51:48 -0800
Subject: [PATCH 0565/1835] soc: bcm: bcm2835-pm: Add support for power domains
 under a new binding.

This provides a free software alternative to raspberrypi-power.c's
firmware calls to manage power domains.  It also exposes a reset line,
where previously the vc4 driver had to try to force power off the
domain in order to trigger a reset.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
(cherry picked from commit 670c672608a1ffcbc7ac0f872734843593bb8b15)
---
 drivers/mfd/bcm2835-pm.c             |  36 +-
 drivers/soc/bcm/Kconfig              |  11 +
 drivers/soc/bcm/Makefile             |   1 +
 drivers/soc/bcm/bcm2835-power.c      | 661 +++++++++++++++++++++++++++
 include/dt-bindings/soc/bcm2835-pm.h |  28 ++
 include/linux/mfd/bcm2835-pm.h       |   1 +
 6 files changed, 734 insertions(+), 4 deletions(-)
 create mode 100644 drivers/soc/bcm/bcm2835-power.c
 create mode 100644 include/dt-bindings/soc/bcm2835-pm.h

diff --git a/drivers/mfd/bcm2835-pm.c b/drivers/mfd/bcm2835-pm.c
index 53839e6a81e7d..42fe67f1538e7 100644
--- a/drivers/mfd/bcm2835-pm.c
+++ b/drivers/mfd/bcm2835-pm.c
@@ -3,7 +3,7 @@
  * PM MFD driver for Broadcom BCM2835
  *
  * This driver binds to the PM block and creates the MFD device for
- * the WDT driver.
+ * the WDT and power drivers.
  */
 
 #include <linux/delay.h>
@@ -21,11 +21,16 @@ static const struct mfd_cell bcm2835_pm_devs[] = {
 	{ .name = "bcm2835-wdt" },
 };
 
+static const struct mfd_cell bcm2835_power_devs[] = {
+	{ .name = "bcm2835-power" },
+};
+
 static int bcm2835_pm_probe(struct platform_device *pdev)
 {
 	struct resource *res;
 	struct device *dev = &pdev->dev;
 	struct bcm2835_pm *pm;
+	int ret;
 
 	pm = devm_kzalloc(dev, sizeof(*pm), GFP_KERNEL);
 	if (!pm)
@@ -39,13 +44,36 @@ static int bcm2835_pm_probe(struct platform_device *pdev)
 	if (IS_ERR(pm->base))
 		return PTR_ERR(pm->base);
 
-	return devm_mfd_add_devices(dev, -1,
-				    bcm2835_pm_devs, ARRAY_SIZE(bcm2835_pm_devs),
-				    NULL, 0, NULL);
+	ret = devm_mfd_add_devices(dev, -1,
+				   bcm2835_pm_devs, ARRAY_SIZE(bcm2835_pm_devs),
+				   NULL, 0, NULL);
+	if (ret)
+		return ret;
+
+	/* We'll use the presence of the AXI ASB regs in the
+	 * bcm2835-pm binding as the key for whether we can reference
+	 * the full PM register range and support power domains.
+	 */
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	if (res) {
+		pm->asb = devm_ioremap_resource(dev, res);
+		if (IS_ERR(pm->asb))
+			return PTR_ERR(pm->asb);
+
+		ret = devm_mfd_add_devices(dev, -1,
+					   bcm2835_power_devs,
+					   ARRAY_SIZE(bcm2835_power_devs),
+					   NULL, 0, NULL);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
 }
 
 static const struct of_device_id bcm2835_pm_of_match[] = {
 	{ .compatible = "brcm,bcm2835-pm-wdt", },
+	{ .compatible = "brcm,bcm2835-pm", },
 	{},
 };
 MODULE_DEVICE_TABLE(of, bcm2835_pm_of_match);
diff --git a/drivers/soc/bcm/Kconfig b/drivers/soc/bcm/Kconfig
index 587c61998b722..c24f505ecd657 100644
--- a/drivers/soc/bcm/Kconfig
+++ b/drivers/soc/bcm/Kconfig
@@ -1,5 +1,16 @@
 menu "Broadcom SoC drivers"
 
+config BCM2835_POWER
+	bool "BCM2835 power domain driver"
+	depends on ARCH_BCM2835 || (COMPILE_TEST && OF)
+	select PM_GENERIC_DOMAINS if PM
+	select RESET_CONTROLLER
+	help
+	  This enables support for the BCM2835 power domains and reset
+	  controller.  Any usage of power domains by the Raspberry Pi
+	  firmware means that Linux usage of the same power domain
+	  must be accessed using the RASPBERRYPI_POWER driver
+
 config RASPBERRYPI_POWER
 	bool "Raspberry Pi power domain driver"
 	depends on ARCH_BCM2835 || (COMPILE_TEST && OF)
diff --git a/drivers/soc/bcm/Makefile b/drivers/soc/bcm/Makefile
index dc4fced72d21f..c81df4b2403c5 100644
--- a/drivers/soc/bcm/Makefile
+++ b/drivers/soc/bcm/Makefile
@@ -1,2 +1,3 @@
+obj-$(CONFIG_BCM2835_POWER)	+= bcm2835-power.o
 obj-$(CONFIG_RASPBERRYPI_POWER)	+= raspberrypi-power.o
 obj-$(CONFIG_SOC_BRCMSTB)	+= brcmstb/
diff --git a/drivers/soc/bcm/bcm2835-power.c b/drivers/soc/bcm/bcm2835-power.c
new file mode 100644
index 0000000000000..48412957ec7ad
--- /dev/null
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -0,0 +1,661 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Power domain driver for Broadcom BCM2835
+ *
+ * Copyright (C) 2018 Broadcom
+ */
+
+#include <dt-bindings/soc/bcm2835-pm.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/mfd/bcm2835-pm.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_domain.h>
+#include <linux/reset-controller.h>
+#include <linux/types.h>
+
+#define PM_GNRIC                        0x00
+#define PM_AUDIO                        0x04
+#define PM_STATUS                       0x18
+#define PM_RSTC				0x1c
+#define PM_RSTS				0x20
+#define PM_WDOG				0x24
+#define PM_PADS0			0x28
+#define PM_PADS2			0x2c
+#define PM_PADS3			0x30
+#define PM_PADS4			0x34
+#define PM_PADS5			0x38
+#define PM_PADS6			0x3c
+#define PM_CAM0				0x44
+#define PM_CAM0_LDOHPEN			BIT(2)
+#define PM_CAM0_LDOLPEN			BIT(1)
+#define PM_CAM0_CTRLEN			BIT(0)
+
+#define PM_CAM1				0x48
+#define PM_CAM1_LDOHPEN			BIT(2)
+#define PM_CAM1_LDOLPEN			BIT(1)
+#define PM_CAM1_CTRLEN			BIT(0)
+
+#define PM_CCP2TX			0x4c
+#define PM_CCP2TX_LDOEN			BIT(1)
+#define PM_CCP2TX_CTRLEN		BIT(0)
+
+#define PM_DSI0				0x50
+#define PM_DSI0_LDOHPEN			BIT(2)
+#define PM_DSI0_LDOLPEN			BIT(1)
+#define PM_DSI0_CTRLEN			BIT(0)
+
+#define PM_DSI1				0x54
+#define PM_DSI1_LDOHPEN			BIT(2)
+#define PM_DSI1_LDOLPEN			BIT(1)
+#define PM_DSI1_CTRLEN			BIT(0)
+
+#define PM_HDMI				0x58
+#define PM_HDMI_RSTDR			BIT(19)
+#define PM_HDMI_LDOPD			BIT(1)
+#define PM_HDMI_CTRLEN			BIT(0)
+
+#define PM_USB				0x5c
+/* The power gates must be enabled with this bit before enabling the LDO in the
+ * USB block.
+ */
+#define PM_USB_CTRLEN			BIT(0)
+
+#define PM_PXLDO			0x60
+#define PM_PXBG				0x64
+#define PM_DFT				0x68
+#define PM_SMPS				0x6c
+#define PM_XOSC				0x70
+#define PM_SPAREW			0x74
+#define PM_SPARER			0x78
+#define PM_AVS_RSTDR			0x7c
+#define PM_AVS_STAT			0x80
+#define PM_AVS_EVENT			0x84
+#define PM_AVS_INTEN			0x88
+#define PM_DUMMY			0xfc
+
+#define PM_IMAGE			0x108
+#define PM_GRAFX			0x10c
+#define PM_PROC				0x110
+#define PM_ENAB				BIT(12)
+#define PM_ISPRSTN			BIT(8)
+#define PM_H264RSTN			BIT(7)
+#define PM_PERIRSTN			BIT(6)
+#define PM_V3DRSTN			BIT(6)
+#define PM_ISFUNC			BIT(5)
+#define PM_MRDONE			BIT(4)
+#define PM_MEMREP			BIT(3)
+#define PM_ISPOW			BIT(2)
+#define PM_POWOK			BIT(1)
+#define PM_POWUP			BIT(0)
+#define PM_INRUSH_SHIFT			13
+#define PM_INRUSH_3_5_MA		0
+#define PM_INRUSH_5_MA			1
+#define PM_INRUSH_10_MA			2
+#define PM_INRUSH_20_MA			3
+#define PM_INRUSH_MASK			(3 << PM_INRUSH_SHIFT)
+
+#define PM_PASSWORD			0x5a000000
+
+#define PM_WDOG_TIME_SET		0x000fffff
+#define PM_RSTC_WRCFG_CLR		0xffffffcf
+#define PM_RSTS_HADWRH_SET		0x00000040
+#define PM_RSTC_WRCFG_SET		0x00000030
+#define PM_RSTC_WRCFG_FULL_RESET	0x00000020
+#define PM_RSTC_RESET			0x00000102
+
+#define PM_READ(reg) readl(power->base + (reg))
+#define PM_WRITE(reg, val) writel(PM_PASSWORD | (val), power->base + (reg))
+
+#define ASB_BRDG_VERSION                0x00
+#define ASB_CPR_CTRL                    0x04
+
+#define ASB_V3D_S_CTRL			0x08
+#define ASB_V3D_M_CTRL			0x0c
+#define ASB_ISP_S_CTRL			0x10
+#define ASB_ISP_M_CTRL			0x14
+#define ASB_H264_S_CTRL			0x18
+#define ASB_H264_M_CTRL			0x1c
+
+#define ASB_REQ_STOP                    BIT(0)
+#define ASB_ACK                         BIT(1)
+#define ASB_EMPTY                       BIT(2)
+#define ASB_FULL                        BIT(3)
+
+#define ASB_AXI_BRDG_ID			0x20
+
+#define ASB_READ(reg) readl(power->asb + (reg))
+#define ASB_WRITE(reg, val) writel(PM_PASSWORD | (val), power->asb + (reg))
+
+struct bcm2835_power_domain {
+	struct generic_pm_domain base;
+	struct bcm2835_power *power;
+	u32 domain;
+	struct clk *clk;
+};
+
+struct bcm2835_power {
+	struct device		*dev;
+	/* PM registers. */
+	void __iomem		*base;
+	/* AXI Async bridge registers. */
+	void __iomem		*asb;
+
+	struct genpd_onecell_data pd_xlate;
+	struct bcm2835_power_domain domains[BCM2835_POWER_DOMAIN_COUNT];
+	struct reset_controller_dev reset;
+};
+
+static int bcm2835_asb_enable(struct bcm2835_power *power, u32 reg)
+{
+	u64 start = ktime_get_ns();
+
+	/* Enable the module's async AXI bridges. */
+	ASB_WRITE(reg, ASB_READ(reg) & ~ASB_REQ_STOP);
+	while (ASB_READ(reg) & ASB_ACK) {
+		cpu_relax();
+		if (ktime_get_ns() - start >= 1000)
+			return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static int bcm2835_asb_disable(struct bcm2835_power *power, u32 reg)
+{
+	u64 start = ktime_get_ns();
+
+	/* Enable the module's async AXI bridges. */
+	ASB_WRITE(reg, ASB_READ(reg) | ASB_REQ_STOP);
+	while (!(ASB_READ(reg) & ASB_ACK)) {
+		cpu_relax();
+		if (ktime_get_ns() - start >= 1000)
+			return -ETIMEDOUT;
+	}
+
+	return 0;
+}
+
+static int bcm2835_power_power_off(struct bcm2835_power_domain *pd, u32 pm_reg)
+{
+	struct bcm2835_power *power = pd->power;
+
+	/* Enable functional isolation */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~PM_ISFUNC);
+
+	/* Enable electrical isolation */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~PM_ISPOW);
+
+	/* Open the power switches. */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~PM_POWUP);
+
+	return 0;
+}
+
+static int bcm2835_power_power_on(struct bcm2835_power_domain *pd, u32 pm_reg)
+{
+	struct bcm2835_power *power = pd->power;
+	struct device *dev = power->dev;
+	u64 start;
+	int ret;
+	int inrush;
+	bool powok;
+
+	/* If it was already powered on by the fw, leave it that way. */
+	if (PM_READ(pm_reg) & PM_POWUP)
+		return 0;
+
+	/* Enable power.  Allowing too much current at once may result
+	 * in POWOK never getting set, so start low and ramp it up as
+	 * necessary to succeed.
+	 */
+	powok = false;
+	for (inrush = PM_INRUSH_3_5_MA; inrush <= PM_INRUSH_20_MA; inrush++) {
+		PM_WRITE(pm_reg,
+			 (PM_READ(pm_reg) & ~PM_INRUSH_MASK) |
+			 (inrush << PM_INRUSH_SHIFT) |
+			 PM_POWUP);
+
+		start = ktime_get_ns();
+		while (!(powok = !!(PM_READ(pm_reg) & PM_POWOK))) {
+			cpu_relax();
+			if (ktime_get_ns() - start >= 3000)
+				break;
+		}
+	}
+	if (!powok) {
+		dev_err(dev, "Timeout waiting for %s power OK\n",
+			pd->base.name);
+		ret = -ETIMEDOUT;
+		goto err_disable_powup;
+	}
+
+	/* Disable electrical isolation */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) | PM_ISPOW);
+
+	/* Repair memory */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) | PM_MEMREP);
+	start = ktime_get_ns();
+	while (!(PM_READ(pm_reg) & PM_MRDONE)) {
+		cpu_relax();
+		if (ktime_get_ns() - start >= 1000) {
+			dev_err(dev, "Timeout waiting for %s memory repair\n",
+				pd->base.name);
+			ret = -ETIMEDOUT;
+			goto err_disable_ispow;
+		}
+	}
+
+	/* Disable functional isolation */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) | PM_ISFUNC);
+
+	return 0;
+
+err_disable_ispow:
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~PM_ISPOW);
+err_disable_powup:
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~(PM_POWUP | PM_INRUSH_MASK));
+	return ret;
+}
+
+static int bcm2835_asb_power_on(struct bcm2835_power_domain *pd,
+				u32 pm_reg,
+				u32 asb_m_reg,
+				u32 asb_s_reg,
+				u32 reset_flags)
+{
+	struct bcm2835_power *power = pd->power;
+	int ret;
+
+	ret = clk_prepare_enable(pd->clk);
+	if (ret) {
+		dev_err(power->dev, "Failed to enable clock for %s\n",
+			pd->base.name);
+		return ret;
+	}
+
+	/* Wait 32 clocks for reset to propagate, 1 us will be enough */
+	udelay(1);
+
+	clk_disable_unprepare(pd->clk);
+
+	/* Deassert the resets. */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) | reset_flags);
+
+	ret = clk_prepare_enable(pd->clk);
+	if (ret) {
+		dev_err(power->dev, "Failed to enable clock for %s\n",
+			pd->base.name);
+		goto err_enable_resets;
+	}
+
+	ret = bcm2835_asb_enable(power, asb_m_reg);
+	if (ret) {
+		dev_err(power->dev, "Failed to enable ASB master for %s\n",
+			pd->base.name);
+		goto err_disable_clk;
+	}
+	ret = bcm2835_asb_enable(power, asb_s_reg);
+	if (ret) {
+		dev_err(power->dev, "Failed to enable ASB slave for %s\n",
+			pd->base.name);
+		goto err_disable_asb_master;
+	}
+
+	return 0;
+
+err_disable_asb_master:
+	bcm2835_asb_disable(power, asb_m_reg);
+err_disable_clk:
+	clk_disable_unprepare(pd->clk);
+err_enable_resets:
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~reset_flags);
+	return ret;
+}
+
+static int bcm2835_asb_power_off(struct bcm2835_power_domain *pd,
+				 u32 pm_reg,
+				 u32 asb_m_reg,
+				 u32 asb_s_reg,
+				 u32 reset_flags)
+{
+	struct bcm2835_power *power = pd->power;
+	int ret;
+
+	ret = bcm2835_asb_disable(power, asb_s_reg);
+	if (ret) {
+		dev_warn(power->dev, "Failed to disable ASB slave for %s\n",
+			 pd->base.name);
+		return ret;
+	}
+	ret = bcm2835_asb_disable(power, asb_m_reg);
+	if (ret) {
+		dev_warn(power->dev, "Failed to disable ASB master for %s\n",
+			 pd->base.name);
+		bcm2835_asb_enable(power, asb_s_reg);
+		return ret;
+	}
+
+	clk_disable_unprepare(pd->clk);
+
+	/* Assert the resets. */
+	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~reset_flags);
+
+	return 0;
+}
+
+static int bcm2835_power_pd_power_on(struct generic_pm_domain *domain)
+{
+	struct bcm2835_power_domain *pd =
+		container_of(domain, struct bcm2835_power_domain, base);
+	struct bcm2835_power *power = pd->power;
+
+	switch (pd->domain) {
+	case BCM2835_POWER_DOMAIN_GRAFX:
+		return bcm2835_power_power_on(pd, PM_GRAFX);
+
+	case BCM2835_POWER_DOMAIN_GRAFX_V3D:
+		return bcm2835_asb_power_on(pd, PM_GRAFX,
+					    ASB_V3D_M_CTRL, ASB_V3D_S_CTRL,
+					    PM_V3DRSTN);
+
+	case BCM2835_POWER_DOMAIN_IMAGE:
+		return bcm2835_power_power_on(pd, PM_IMAGE);
+
+	case BCM2835_POWER_DOMAIN_IMAGE_PERI:
+		return bcm2835_asb_power_on(pd, PM_IMAGE,
+					    0, 0,
+					    PM_PERIRSTN);
+
+	case BCM2835_POWER_DOMAIN_IMAGE_ISP:
+		return bcm2835_asb_power_on(pd, PM_IMAGE,
+					    ASB_ISP_M_CTRL, ASB_ISP_S_CTRL,
+					    PM_ISPRSTN);
+
+	case BCM2835_POWER_DOMAIN_IMAGE_H264:
+		return bcm2835_asb_power_on(pd, PM_IMAGE,
+					    ASB_H264_M_CTRL, ASB_H264_S_CTRL,
+					    PM_H264RSTN);
+
+	case BCM2835_POWER_DOMAIN_USB:
+		PM_WRITE(PM_USB, PM_USB_CTRLEN);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_DSI0:
+		PM_WRITE(PM_DSI0, PM_DSI0_CTRLEN);
+		PM_WRITE(PM_DSI0, PM_DSI0_CTRLEN | PM_DSI0_LDOHPEN);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_DSI1:
+		PM_WRITE(PM_DSI1, PM_DSI1_CTRLEN);
+		PM_WRITE(PM_DSI1, PM_DSI1_CTRLEN | PM_DSI1_LDOHPEN);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_CCP2TX:
+		PM_WRITE(PM_CCP2TX, PM_CCP2TX_CTRLEN);
+		PM_WRITE(PM_CCP2TX, PM_CCP2TX_CTRLEN | PM_CCP2TX_LDOEN);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_HDMI:
+		PM_WRITE(PM_HDMI, PM_READ(PM_HDMI) | PM_HDMI_RSTDR);
+		PM_WRITE(PM_HDMI, PM_READ(PM_HDMI) | PM_HDMI_CTRLEN);
+		PM_WRITE(PM_HDMI, PM_READ(PM_HDMI) & ~PM_HDMI_LDOPD);
+		usleep_range(100, 200);
+		PM_WRITE(PM_HDMI, PM_READ(PM_HDMI) & ~PM_HDMI_RSTDR);
+		return 0;
+
+	default:
+		dev_err(power->dev, "Invalid domain %d\n", pd->domain);
+		return -EINVAL;
+	}
+}
+
+static int bcm2835_power_pd_power_off(struct generic_pm_domain *domain)
+{
+	struct bcm2835_power_domain *pd =
+		container_of(domain, struct bcm2835_power_domain, base);
+	struct bcm2835_power *power = pd->power;
+
+	switch (pd->domain) {
+	case BCM2835_POWER_DOMAIN_GRAFX:
+		return bcm2835_power_power_off(pd, PM_GRAFX);
+
+	case BCM2835_POWER_DOMAIN_GRAFX_V3D:
+		return bcm2835_asb_power_off(pd, PM_GRAFX,
+					     ASB_V3D_M_CTRL, ASB_V3D_S_CTRL,
+					     PM_V3DRSTN);
+
+	case BCM2835_POWER_DOMAIN_IMAGE:
+		return bcm2835_power_power_off(pd, PM_IMAGE);
+
+	case BCM2835_POWER_DOMAIN_IMAGE_PERI:
+		return bcm2835_asb_power_off(pd, PM_IMAGE,
+					     0, 0,
+					     PM_PERIRSTN);
+
+	case BCM2835_POWER_DOMAIN_IMAGE_ISP:
+		return bcm2835_asb_power_off(pd, PM_IMAGE,
+					     ASB_ISP_M_CTRL, ASB_ISP_S_CTRL,
+					     PM_ISPRSTN);
+
+	case BCM2835_POWER_DOMAIN_IMAGE_H264:
+		return bcm2835_asb_power_off(pd, PM_IMAGE,
+					     ASB_H264_M_CTRL, ASB_H264_S_CTRL,
+					     PM_H264RSTN);
+
+	case BCM2835_POWER_DOMAIN_USB:
+		PM_WRITE(PM_USB, 0);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_DSI0:
+		PM_WRITE(PM_DSI0, PM_DSI0_CTRLEN);
+		PM_WRITE(PM_DSI0, 0);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_DSI1:
+		PM_WRITE(PM_DSI1, PM_DSI1_CTRLEN);
+		PM_WRITE(PM_DSI1, 0);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_CCP2TX:
+		PM_WRITE(PM_CCP2TX, PM_CCP2TX_CTRLEN);
+		PM_WRITE(PM_CCP2TX, 0);
+		return 0;
+
+	case BCM2835_POWER_DOMAIN_HDMI:
+		PM_WRITE(PM_HDMI, PM_READ(PM_HDMI) | PM_HDMI_LDOPD);
+		PM_WRITE(PM_HDMI, PM_READ(PM_HDMI) & ~PM_HDMI_CTRLEN);
+		return 0;
+
+	default:
+		dev_err(power->dev, "Invalid domain %d\n", pd->domain);
+		return -EINVAL;
+	}
+}
+
+static void
+bcm2835_init_power_domain(struct bcm2835_power *power,
+			  int pd_xlate_index, const char *name)
+{
+	struct device *dev = power->dev;
+	struct bcm2835_power_domain *dom = &power->domains[pd_xlate_index];
+
+	dom->clk = devm_clk_get(dev->parent, name);
+
+	dom->base.name = name;
+	dom->base.power_on = bcm2835_power_pd_power_on;
+	dom->base.power_off = bcm2835_power_pd_power_off;
+
+	dom->domain = pd_xlate_index;
+	dom->power = power;
+
+	/* XXX: on/off at boot? */
+	pm_genpd_init(&dom->base, NULL, true);
+
+	power->pd_xlate.domains[pd_xlate_index] = &dom->base;
+}
+
+/** bcm2835_reset_reset - Resets a block that has a reset line in the
+ * PM block.
+ *
+ * The consumer of the reset controller must have the power domain up
+ * -- there's no reset ability with the power domain down.  To reset
+ * the sub-block, we just disable its access to memory through the
+ * ASB, reset, and re-enable.
+ */
+static int bcm2835_reset_reset(struct reset_controller_dev *rcdev,
+			       unsigned long id)
+{
+	struct bcm2835_power *power = container_of(rcdev, struct bcm2835_power,
+						   reset);
+	struct bcm2835_power_domain *pd;
+	int ret;
+
+	switch (id) {
+	case BCM2835_RESET_V3D:
+		pd = &power->domains[BCM2835_POWER_DOMAIN_GRAFX_V3D];
+		break;
+	case BCM2835_RESET_H264:
+		pd = &power->domains[BCM2835_POWER_DOMAIN_IMAGE_H264];
+		break;
+	case BCM2835_RESET_ISP:
+		pd = &power->domains[BCM2835_POWER_DOMAIN_IMAGE_ISP];
+		break;
+	default:
+		dev_err(power->dev, "Bad reset id %ld\n", id);
+		return -EINVAL;
+	}
+
+	ret = bcm2835_power_pd_power_off(&pd->base);
+	if (ret)
+		return ret;
+
+	return bcm2835_power_pd_power_on(&pd->base);
+}
+
+static int bcm2835_reset_status(struct reset_controller_dev *rcdev,
+				unsigned long id)
+{
+	struct bcm2835_power *power = container_of(rcdev, struct bcm2835_power,
+						   reset);
+
+	switch (id) {
+	case BCM2835_RESET_V3D:
+		return !PM_READ(PM_GRAFX & PM_V3DRSTN);
+	case BCM2835_RESET_H264:
+		return !PM_READ(PM_IMAGE & PM_H264RSTN);
+	case BCM2835_RESET_ISP:
+		return !PM_READ(PM_IMAGE & PM_ISPRSTN);
+	default:
+		return -EINVAL;
+	}
+}
+
+const struct reset_control_ops bcm2835_reset_ops = {
+	.reset = bcm2835_reset_reset,
+	.status = bcm2835_reset_status,
+};
+
+static const char *const power_domain_names[] = {
+	[BCM2835_POWER_DOMAIN_GRAFX] = "grafx",
+	[BCM2835_POWER_DOMAIN_GRAFX_V3D] = "v3d",
+
+	[BCM2835_POWER_DOMAIN_IMAGE] = "image",
+	[BCM2835_POWER_DOMAIN_IMAGE_PERI] = "peri_image",
+	[BCM2835_POWER_DOMAIN_IMAGE_H264] = "h264",
+	[BCM2835_POWER_DOMAIN_IMAGE_ISP] = "isp",
+
+	[BCM2835_POWER_DOMAIN_USB] = "usb",
+	[BCM2835_POWER_DOMAIN_DSI0] = "dsi0",
+	[BCM2835_POWER_DOMAIN_DSI1] = "dsi1",
+	[BCM2835_POWER_DOMAIN_CAM0] = "cam0",
+	[BCM2835_POWER_DOMAIN_CAM1] = "cam1",
+	[BCM2835_POWER_DOMAIN_CCP2TX] = "ccp2tx",
+	[BCM2835_POWER_DOMAIN_HDMI] = "hdmi",
+};
+
+static int bcm2835_power_probe(struct platform_device *pdev)
+{
+	struct bcm2835_pm *pm = dev_get_drvdata(pdev->dev.parent);
+	struct device *dev = &pdev->dev;
+	struct bcm2835_power *power;
+	static const struct {
+		int parent, child;
+	} domain_deps[] = {
+		{ BCM2835_POWER_DOMAIN_GRAFX, BCM2835_POWER_DOMAIN_GRAFX_V3D },
+		{ BCM2835_POWER_DOMAIN_IMAGE, BCM2835_POWER_DOMAIN_IMAGE_PERI },
+		{ BCM2835_POWER_DOMAIN_IMAGE, BCM2835_POWER_DOMAIN_IMAGE_H264 },
+		{ BCM2835_POWER_DOMAIN_IMAGE, BCM2835_POWER_DOMAIN_IMAGE_ISP },
+		{ BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_USB },
+		{ BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_CAM0 },
+		{ BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_CAM1 },
+	};
+	int ret, i;
+	u32 id;
+
+	power = devm_kzalloc(dev, sizeof(*power), GFP_KERNEL);
+	if (!power)
+		return -ENOMEM;
+	platform_set_drvdata(pdev, power);
+
+	power->dev = dev;
+	power->base = pm->base;
+	power->asb = pm->asb;
+
+	id = ASB_READ(ASB_AXI_BRDG_ID);
+	if (id != 0x62726467 /* "BRDG" */) {
+		dev_err(dev, "ASB register ID returned 0x%08x\n", id);
+		return -ENODEV;
+	}
+
+	power->pd_xlate.domains = devm_kcalloc(dev,
+					       ARRAY_SIZE(power_domain_names),
+					       sizeof(*power->pd_xlate.domains),
+					       GFP_KERNEL);
+	if (!power->pd_xlate.domains)
+		return -ENOMEM;
+
+	power->pd_xlate.num_domains = ARRAY_SIZE(power_domain_names);
+
+	for (i = 0; i < ARRAY_SIZE(power_domain_names); i++)
+		bcm2835_init_power_domain(power, i, power_domain_names[i]);
+
+	for (i = 0; i < ARRAY_SIZE(domain_deps); i++) {
+		pm_genpd_add_subdomain(&power->domains[domain_deps[i].parent].base,
+				       &power->domains[domain_deps[i].child].base);
+	}
+
+	power->reset.owner = THIS_MODULE;
+	power->reset.nr_resets = BCM2835_RESET_COUNT;
+	power->reset.ops = &bcm2835_reset_ops;
+	power->reset.of_node = dev->parent->of_node;
+
+	ret = devm_reset_controller_register(dev, &power->reset);
+	if (ret)
+		return ret;
+
+	of_genpd_add_provider_onecell(dev->parent->of_node, &power->pd_xlate);
+
+	dev_info(dev, "Broadcom BCM2835 power domains driver");
+	return 0;
+}
+
+static int bcm2835_power_remove(struct platform_device *pdev)
+{
+	return 0;
+}
+
+static struct platform_driver bcm2835_power_driver = {
+	.probe		= bcm2835_power_probe,
+	.remove		= bcm2835_power_remove,
+	.driver = {
+		.name =	"bcm2835-power",
+	},
+};
+module_platform_driver(bcm2835_power_driver);
+
+MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+MODULE_DESCRIPTION("Driver for Broadcom BCM2835 PM power domains and reset");
+MODULE_LICENSE("GPL");
diff --git a/include/dt-bindings/soc/bcm2835-pm.h b/include/dt-bindings/soc/bcm2835-pm.h
new file mode 100644
index 0000000000000..153d75b8d99ff
--- /dev/null
+++ b/include/dt-bindings/soc/bcm2835-pm.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: (GPL-2.0+ OR MIT) */
+
+#ifndef _DT_BINDINGS_ARM_BCM2835_PM_H
+#define _DT_BINDINGS_ARM_BCM2835_PM_H
+
+#define BCM2835_POWER_DOMAIN_GRAFX		0
+#define BCM2835_POWER_DOMAIN_GRAFX_V3D		1
+#define BCM2835_POWER_DOMAIN_IMAGE		2
+#define BCM2835_POWER_DOMAIN_IMAGE_PERI		3
+#define BCM2835_POWER_DOMAIN_IMAGE_ISP		4
+#define BCM2835_POWER_DOMAIN_IMAGE_H264		5
+#define BCM2835_POWER_DOMAIN_USB		6
+#define BCM2835_POWER_DOMAIN_DSI0		7
+#define BCM2835_POWER_DOMAIN_DSI1		8
+#define BCM2835_POWER_DOMAIN_CAM0		9
+#define BCM2835_POWER_DOMAIN_CAM1		10
+#define BCM2835_POWER_DOMAIN_CCP2TX		11
+#define BCM2835_POWER_DOMAIN_HDMI		12
+
+#define BCM2835_POWER_DOMAIN_COUNT		13
+
+#define BCM2835_RESET_V3D			0
+#define BCM2835_RESET_ISP			1
+#define BCM2835_RESET_H264			2
+
+#define BCM2835_RESET_COUNT			3
+
+#endif /* _DT_BINDINGS_ARM_BCM2835_PM_H */
diff --git a/include/linux/mfd/bcm2835-pm.h b/include/linux/mfd/bcm2835-pm.h
index b7d0ee1feffad..ed37dc40e82a8 100644
--- a/include/linux/mfd/bcm2835-pm.h
+++ b/include/linux/mfd/bcm2835-pm.h
@@ -8,6 +8,7 @@
 struct bcm2835_pm {
 	struct device *dev;
 	void __iomem *base;
+	void __iomem *asb;
 };
 
 #endif /* BCM2835_MFD_PM_H */
-- 
GitLab


From 332fd3975fec374d1b84b3523f610d70c674d120 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 11 Jan 2019 17:29:10 -0800
Subject: [PATCH 0566/1835] soc: bcm: bcm2835-pm: Fix PM_IMAGE_PERI power
 domain support.

We don't have ASB master/slave regs for this domain, so just skip that
step.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
---
 drivers/soc/bcm/bcm2835-power.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/bcm/bcm2835-power.c b/drivers/soc/bcm/bcm2835-power.c
index 48412957ec7ad..4a1b99b773c09 100644
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -150,7 +150,12 @@ struct bcm2835_power {
 
 static int bcm2835_asb_enable(struct bcm2835_power *power, u32 reg)
 {
-	u64 start = ktime_get_ns();
+	u64 start;
+
+	if (!reg)
+		return 0;
+
+	start = ktime_get_ns();
 
 	/* Enable the module's async AXI bridges. */
 	ASB_WRITE(reg, ASB_READ(reg) & ~ASB_REQ_STOP);
@@ -165,7 +170,12 @@ static int bcm2835_asb_enable(struct bcm2835_power *power, u32 reg)
 
 static int bcm2835_asb_disable(struct bcm2835_power *power, u32 reg)
 {
-	u64 start = ktime_get_ns();
+	u64 start;
+
+	if (!reg)
+		return 0;
+
+	start = ktime_get_ns();
 
 	/* Enable the module's async AXI bridges. */
 	ASB_WRITE(reg, ASB_READ(reg) | ASB_REQ_STOP);
-- 
GitLab


From 3c369e68d729714343f2bc322eda0e36ce963607 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Sat, 12 Jan 2019 08:07:43 -0800
Subject: [PATCH 0567/1835] soc: bcm: bcm2835-pm: Fix error paths of
 initialization.

The clock driver may probe after ours and so we need to pass the
-EPROBE_DEFER out.  Fix the other error path while we're here.

v2: Use dom->name instead of dom->gov as the flag for initialized
    domains, since we aren't setting up a governor.  Make sure to
    clear ->clk when no clk is present in the DT.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 670c672608a1 ("soc: bcm: bcm2835-pm: Add support for power domains under a new binding.")
---
 drivers/soc/bcm/bcm2835-power.c | 35 ++++++++++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/drivers/soc/bcm/bcm2835-power.c b/drivers/soc/bcm/bcm2835-power.c
index 4a1b99b773c09..241c4ed808992 100644
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -485,7 +485,7 @@ static int bcm2835_power_pd_power_off(struct generic_pm_domain *domain)
 	}
 }
 
-static void
+static int
 bcm2835_init_power_domain(struct bcm2835_power *power,
 			  int pd_xlate_index, const char *name)
 {
@@ -493,6 +493,17 @@ bcm2835_init_power_domain(struct bcm2835_power *power,
 	struct bcm2835_power_domain *dom = &power->domains[pd_xlate_index];
 
 	dom->clk = devm_clk_get(dev->parent, name);
+	if (IS_ERR(dom->clk)) {
+		int ret = PTR_ERR(dom->clk);
+
+		if (ret == -EPROBE_DEFER)
+			return ret;
+
+		/* Some domains don't have a clk, so make sure that we
+		 * don't deref an error pointer later.
+		 */
+		dom->clk = NULL;
+	}
 
 	dom->base.name = name;
 	dom->base.power_on = bcm2835_power_pd_power_on;
@@ -505,6 +516,8 @@ bcm2835_init_power_domain(struct bcm2835_power *power,
 	pm_genpd_init(&dom->base, NULL, true);
 
 	power->pd_xlate.domains[pd_xlate_index] = &dom->base;
+
+	return 0;
 }
 
 /** bcm2835_reset_reset - Resets a block that has a reset line in the
@@ -602,7 +615,7 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 		{ BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_CAM0 },
 		{ BCM2835_POWER_DOMAIN_IMAGE_PERI, BCM2835_POWER_DOMAIN_CAM1 },
 	};
-	int ret, i;
+	int ret = 0, i;
 	u32 id;
 
 	power = devm_kzalloc(dev, sizeof(*power), GFP_KERNEL);
@@ -629,8 +642,11 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 
 	power->pd_xlate.num_domains = ARRAY_SIZE(power_domain_names);
 
-	for (i = 0; i < ARRAY_SIZE(power_domain_names); i++)
-		bcm2835_init_power_domain(power, i, power_domain_names[i]);
+	for (i = 0; i < ARRAY_SIZE(power_domain_names); i++) {
+		ret = bcm2835_init_power_domain(power, i, power_domain_names[i]);
+		if (ret)
+			goto fail;
+	}
 
 	for (i = 0; i < ARRAY_SIZE(domain_deps); i++) {
 		pm_genpd_add_subdomain(&power->domains[domain_deps[i].parent].base,
@@ -644,12 +660,21 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 
 	ret = devm_reset_controller_register(dev, &power->reset);
 	if (ret)
-		return ret;
+		goto fail;
 
 	of_genpd_add_provider_onecell(dev->parent->of_node, &power->pd_xlate);
 
 	dev_info(dev, "Broadcom BCM2835 power domains driver");
 	return 0;
+
+fail:
+	for (i = 0; i < ARRAY_SIZE(power_domain_names); i++) {
+		struct generic_pm_domain *dom = &power->domains[i].base;
+
+		if (dom->name)
+			pm_genpd_remove(dom);
+	}
+	return ret;
 }
 
 static int bcm2835_power_remove(struct platform_device *pdev)
-- 
GitLab


From f1793128b677a963b7521ec0ca0845b98869fde9 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 11 Jan 2019 17:31:07 -0800
Subject: [PATCH 0568/1835] soc: bcm: bcm2835-pm: Add support for 2711.

Without the actual power management part any more, there's a lot less
to set up for V3D.  We just need to clear the RSTN field for the power
domain, and expose the reset controller for toggling it again.

This is definitely incomplete -- the old ISP and H264 is in the old
bridge, but since we have no consumers of it I've just done the
minimum to get V3D working.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/mfd/bcm2835-pm.c        | 11 +++++++++++
 drivers/soc/bcm/bcm2835-power.c | 22 ++++++++++++++++++++++
 include/linux/mfd/bcm2835-pm.h  |  1 +
 3 files changed, 34 insertions(+)

diff --git a/drivers/mfd/bcm2835-pm.c b/drivers/mfd/bcm2835-pm.c
index 42fe67f1538e7..ab1e9cbc50b1b 100644
--- a/drivers/mfd/bcm2835-pm.c
+++ b/drivers/mfd/bcm2835-pm.c
@@ -50,6 +50,17 @@ static int bcm2835_pm_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
+	/* Map the ARGON ASB regs if present. */
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+	if (res) {
+		pm->arg_asb = devm_ioremap_resource(dev, res);
+		if (IS_ERR(pm->arg_asb)) {
+			dev_err(dev, "Failed to map ARGON ASB: %ld\n",
+				PTR_ERR(pm->arg_asb));
+			return PTR_ERR(pm->arg_asb);
+		}
+	}
+
 	/* We'll use the presence of the AXI ASB regs in the
 	 * bcm2835-pm binding as the key for whether we can reference
 	 * the full PM register range and support power domains.
diff --git a/drivers/soc/bcm/bcm2835-power.c b/drivers/soc/bcm/bcm2835-power.c
index 241c4ed808992..918cf54ab9ef9 100644
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -143,6 +143,8 @@ struct bcm2835_power {
 	/* AXI Async bridge registers. */
 	void __iomem		*asb;
 
+	bool is_2711;
+
 	struct genpd_onecell_data pd_xlate;
 	struct bcm2835_power_domain domains[BCM2835_POWER_DOMAIN_COUNT];
 	struct reset_controller_dev reset;
@@ -192,6 +194,10 @@ static int bcm2835_power_power_off(struct bcm2835_power_domain *pd, u32 pm_reg)
 {
 	struct bcm2835_power *power = pd->power;
 
+	/* 2711 has no power domains above the reset controller. */
+	if (power->is_2711)
+		return 0;
+
 	/* Enable functional isolation */
 	PM_WRITE(pm_reg, PM_READ(pm_reg) & ~PM_ISFUNC);
 
@@ -213,6 +219,10 @@ static int bcm2835_power_power_on(struct bcm2835_power_domain *pd, u32 pm_reg)
 	int inrush;
 	bool powok;
 
+	/* 2711 has no power domains above the reset controller. */
+	if (power->is_2711)
+		return 0;
+
 	/* If it was already powered on by the fw, leave it that way. */
 	if (PM_READ(pm_reg) & PM_POWUP)
 		return 0;
@@ -627,6 +637,18 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 	power->base = pm->base;
 	power->asb = pm->asb;
 
+	/* 2711 hack: the new ARGON ASB took over V3D, which is our
+	 * only consumer of this driver so far.  The old ASB seems to
+	 * still be present with ISP and H264 bits but no V3D, but I
+	 * don't know if that's real or not.  The V3D is in the same
+	 * place in the new ASB as the old one, so just poke the new
+	 * one for now.
+	 */
+	if (pm->arg_asb) {
+		power->asb = pm->arg_asb;
+		power->is_2711 = true;
+	}
+
 	id = ASB_READ(ASB_AXI_BRDG_ID);
 	if (id != 0x62726467 /* "BRDG" */) {
 		dev_err(dev, "ASB register ID returned 0x%08x\n", id);
diff --git a/include/linux/mfd/bcm2835-pm.h b/include/linux/mfd/bcm2835-pm.h
index ed37dc40e82a8..b2d157091e12b 100644
--- a/include/linux/mfd/bcm2835-pm.h
+++ b/include/linux/mfd/bcm2835-pm.h
@@ -9,6 +9,7 @@ struct bcm2835_pm {
 	struct device *dev;
 	void __iomem *base;
 	void __iomem *asb;
+	void __iomem *arg_asb;
 };
 
 #endif /* BCM2835_MFD_PM_H */
-- 
GitLab


From 0ae366ee1b94caf7abfd0e07505b14d9dde56bcc Mon Sep 17 00:00:00 2001
From: Chunming Zhou <david1.zhou@amd.com>
Date: Thu, 30 Aug 2018 14:48:29 +0800
Subject: [PATCH 0569/1835] drm: expand drm_syncobj_find_fence to support
 timeline point v2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

we can fetch timeline point fence after expanded.
v2: The parameter fence is the result of the function and should come last.

Signed-off-by: Chunming Zhou <david1.zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/246541/
(cherry picked from commit 0a6730ea27b68c7ac4171c29a816c29d26a9637a)
Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
 drivers/gpu/drm/drm_syncobj.c          | 5 +++--
 drivers/gpu/drm/v3d/v3d_gem.c          | 4 ++--
 drivers/gpu/drm/vc4/vc4_gem.c          | 2 +-
 include/drm/drm_syncobj.h              | 2 +-
 5 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 81001d8793221..b5753d7802d32 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1105,7 +1105,7 @@ static int amdgpu_syncobj_lookup_and_add_to_sync(struct amdgpu_cs_parser *p,
 {
 	int r;
 	struct dma_fence *fence;
-	r = drm_syncobj_find_fence(p->filp, handle, &fence);
+	r = drm_syncobj_find_fence(p->filp, handle, 0, &fence);
 	if (r)
 		return r;
 
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 759278fef35ae..4ab6e78559e39 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -235,6 +235,7 @@ static int drm_syncobj_assign_null_handle(struct drm_syncobj *syncobj)
  * drm_syncobj_find_fence - lookup and reference the fence in a sync object
  * @file_private: drm file private pointer
  * @handle: sync object handle to lookup.
+ * @point: timeline point
  * @fence: out parameter for the fence
  *
  * This is just a convenience function that combines drm_syncobj_find() and
@@ -245,7 +246,7 @@ static int drm_syncobj_assign_null_handle(struct drm_syncobj *syncobj)
  * dma_fence_put().
  */
 int drm_syncobj_find_fence(struct drm_file *file_private,
-			   u32 handle,
+			   u32 handle, u64 point,
 			   struct dma_fence **fence)
 {
 	struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle);
@@ -516,7 +517,7 @@ static int drm_syncobj_export_sync_file(struct drm_file *file_private,
 	if (fd < 0)
 		return fd;
 
-	ret = drm_syncobj_find_fence(file_private, handle, &fence);
+	ret = drm_syncobj_find_fence(file_private, handle, 0, &fence);
 	if (ret)
 		goto err_put_fd;
 
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 5ce24098a5fda..9b9ab34fb461b 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -521,12 +521,12 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	kref_init(&exec->refcount);
 
 	ret = drm_syncobj_find_fence(file_priv, args->in_sync_bcl,
-				     &exec->bin.in_fence);
+				     0, &exec->bin.in_fence);
 	if (ret == -EINVAL)
 		goto fail;
 
 	ret = drm_syncobj_find_fence(file_priv, args->in_sync_rcl,
-				     &exec->render.in_fence);
+				     0, &exec->render.in_fence);
 	if (ret == -EINVAL)
 		goto fail;
 
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 7910b9acedd60..928718b467bd2 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -1173,7 +1173,7 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
 
 	if (args->in_sync) {
 		ret = drm_syncobj_find_fence(file_priv, args->in_sync,
-					     &in_fence);
+					     0, &in_fence);
 		if (ret)
 			goto fail;
 
diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h
index 3980602472c0f..da4a4ddd32bde 100644
--- a/include/drm/drm_syncobj.h
+++ b/include/drm/drm_syncobj.h
@@ -139,7 +139,7 @@ void drm_syncobj_remove_callback(struct drm_syncobj *syncobj,
 void drm_syncobj_replace_fence(struct drm_syncobj *syncobj,
 			       struct dma_fence *fence);
 int drm_syncobj_find_fence(struct drm_file *file_private,
-			   u32 handle,
+			   u32 handle, u64 point,
 			   struct dma_fence **fence);
 void drm_syncobj_free(struct kref *kref);
 int drm_syncobj_create(struct drm_syncobj **out_syncobj, uint32_t flags,
-- 
GitLab


From 047c917b9b1309e24bedc5f6a794e40b2b544da3 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 28 Sep 2018 16:21:23 -0700
Subject: [PATCH 0570/1835] drm/v3d: Fix a use-after-free race accessing the
 scheduler's fences.

Once we push the job, the scheduler could run it and free it.  So, if
we want to reference their fences, we need to grab them before then.
I haven't seen this happen in many days of conformance test runtime,
but let's still close the race.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
Link: https://patchwork.freedesktop.org/patch/254119/
Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
(cherry picked from commit 34c2c4f632f232ed2fdb66d4e42cc72d322273fe)
---
 drivers/gpu/drm/v3d/v3d_drv.h | 5 +++++
 drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 0ad73f4b7509a..eb32ff45a085e 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -198,6 +198,11 @@ struct v3d_exec_info {
 	 */
 	struct dma_fence *bin_done_fence;
 
+	/* Fence for when the scheduler considers the render to be
+	 * done, for when the BOs reservations should be complete.
+	 */
+	struct dma_fence *render_done_fence;
+
 	struct kref refcount;
 
 	/* This is the array of BOs that were looked up at the start of exec. */
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 9b9ab34fb461b..5c13b0807879a 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -209,7 +209,7 @@ v3d_flush_caches(struct v3d_dev *v3d)
 static void
 v3d_attach_object_fences(struct v3d_exec_info *exec)
 {
-	struct dma_fence *out_fence = &exec->render.base.s_fence->finished;
+	struct dma_fence *out_fence = exec->render_done_fence;
 	struct v3d_bo *bo;
 	int i;
 
@@ -409,6 +409,7 @@ v3d_exec_cleanup(struct kref *ref)
 	dma_fence_put(exec->render.done_fence);
 
 	dma_fence_put(exec->bin_done_fence);
+	dma_fence_put(exec->render_done_fence);
 
 	for (i = 0; i < exec->bo_count; i++)
 		drm_gem_object_put_unlocked(&exec->bo[i]->base);
@@ -572,6 +573,9 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto fail_unreserve;
 
+	exec->render_done_fence =
+		dma_fence_get(&exec->render.base.s_fence->finished);
+
 	kref_get(&exec->refcount); /* put by scheduler job completion */
 	drm_sched_entity_push_job(&exec->render.base,
 				  &v3d_priv->sched_entity[V3D_RENDER]);
@@ -585,7 +589,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	sync_out = drm_syncobj_find(file_priv, args->out_sync);
 	if (sync_out) {
 		drm_syncobj_replace_fence(sync_out,
-					  &exec->render.base.s_fence->finished);
+					  exec->render_done_fence);
 		drm_syncobj_put(sync_out);
 	}
 
-- 
GitLab


From 8545eb3f198f69c1575c6c731f98e0ce2885a61d Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 28 Sep 2018 16:21:24 -0700
Subject: [PATCH 0571/1835] drm/v3d: Add a little debugfs entry for measuring
 the core clock.

This adds just enough performance counter support to measure the
clock.  We don't have linux kernel drivers for the clock driving the
HW, and this was useful for determining that the V3D HW is running on
a slow clock, not that the driver was slow.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20180928232126.4332-2-eric@anholt.net
Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
(cherry picked from commit 6915c9a525e575732429c22b28eb11871a29374b)
---
 drivers/gpu/drm/v3d/v3d_debugfs.c | 35 +++++++++++++++++++++++++++++++
 drivers/gpu/drm/v3d/v3d_regs.h    | 30 ++++++++++++++++++++++++++
 2 files changed, 65 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
index 26470c77eb6e5..eb2b2d2f85538 100644
--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
+++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
@@ -179,9 +179,44 @@ static int v3d_debugfs_bo_stats(struct seq_file *m, void *unused)
 	return 0;
 }
 
+static int v3d_measure_clock(struct seq_file *m, void *unused)
+{
+	struct drm_info_node *node = (struct drm_info_node *)m->private;
+	struct drm_device *dev = node->minor->dev;
+	struct v3d_dev *v3d = to_v3d_dev(dev);
+	uint32_t cycles;
+	int core = 0;
+	int measure_ms = 1000;
+
+	if (v3d->ver >= 40) {
+		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_SRC_0_3,
+			       V3D_SET_FIELD(V3D_PCTR_CYCLE_COUNT,
+					     V3D_PCTR_S0));
+		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_CLR, 1);
+		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_EN, 1);
+	} else {
+		V3D_CORE_WRITE(core, V3D_V3_PCTR_0_PCTRS0,
+			       V3D_PCTR_CYCLE_COUNT);
+		V3D_CORE_WRITE(core, V3D_V3_PCTR_0_CLR, 1);
+		V3D_CORE_WRITE(core, V3D_V3_PCTR_0_EN,
+			       V3D_V3_PCTR_0_EN_ENABLE |
+			       1);
+	}
+	msleep(measure_ms);
+	cycles = V3D_CORE_READ(core, V3D_PCTR_0_PCTR0);
+
+	seq_printf(m, "cycles: %d (%d.%d Mhz)\n",
+		   cycles,
+		   cycles / (measure_ms * 1000),
+		   (cycles / (measure_ms * 100)) % 10);
+
+	return 0;
+}
+
 static const struct drm_info_list v3d_debugfs_list[] = {
 	{"v3d_ident", v3d_v3d_debugfs_ident, 0},
 	{"v3d_regs", v3d_v3d_debugfs_regs, 0},
+	{"measure_clock", v3d_measure_clock, 0},
 	{"bo_stats", v3d_debugfs_bo_stats, 0},
 };
 
diff --git a/drivers/gpu/drm/v3d/v3d_regs.h b/drivers/gpu/drm/v3d/v3d_regs.h
index 854046565989e..c3a5e4e44f731 100644
--- a/drivers/gpu/drm/v3d/v3d_regs.h
+++ b/drivers/gpu/drm/v3d/v3d_regs.h
@@ -267,6 +267,36 @@
 # define V3D_PTB_BXCF_RWORDERDISA                      BIT(1)
 # define V3D_PTB_BXCF_CLIPDISA                         BIT(0)
 
+#define V3D_V3_PCTR_0_EN                               0x00674
+#define V3D_V3_PCTR_0_EN_ENABLE                        BIT(31)
+#define V3D_V4_PCTR_0_EN                               0x00650
+/* When a bit is set, resets the counter to 0. */
+#define V3D_V3_PCTR_0_CLR                              0x00670
+#define V3D_V4_PCTR_0_CLR                              0x00654
+#define V3D_PCTR_0_OVERFLOW                            0x00658
+
+#define V3D_V3_PCTR_0_PCTRS0                           0x00684
+#define V3D_V3_PCTR_0_PCTRS15                          0x00660
+#define V3D_V3_PCTR_0_PCTRSX(x)                        (V3D_V3_PCTR_0_PCTRS0 + \
+							4 * (x))
+/* Each src reg muxes four counters each. */
+#define V3D_V4_PCTR_0_SRC_0_3                          0x00660
+#define V3D_V4_PCTR_0_SRC_28_31                        0x0067c
+# define V3D_PCTR_S0_MASK                              V3D_MASK(6, 0)
+# define V3D_PCTR_S0_SHIFT                             0
+# define V3D_PCTR_S1_MASK                              V3D_MASK(14, 8)
+# define V3D_PCTR_S1_SHIFT                             8
+# define V3D_PCTR_S2_MASK                              V3D_MASK(22, 16)
+# define V3D_PCTR_S2_SHIFT                             16
+# define V3D_PCTR_S3_MASK                              V3D_MASK(30, 24)
+# define V3D_PCTR_S3_SHIFT                             24
+# define V3D_PCTR_CYCLE_COUNT                          32
+
+/* Output values of the counters. */
+#define V3D_PCTR_0_PCTR0                               0x00680
+#define V3D_PCTR_0_PCTR31                              0x006fc
+#define V3D_PCTR_0_PCTRX(x)                            (V3D_PCTR_0_PCTR0 + \
+							4 * (x))
 #define V3D_GMP_STATUS                                 0x00800
 # define V3D_GMP_STATUS_GMPRST                         BIT(31)
 # define V3D_GMP_STATUS_WR_COUNT_MASK                  V3D_MASK(30, 24)
-- 
GitLab


From 44c52631e0a3e0a0d7a3326fb295bab564abd070 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 8 Nov 2018 08:16:52 -0800
Subject: [PATCH 0572/1835] drm/v3d: Update a comment about what uses
 v3d_job_dependency().

I merged bin and render's paths in a late refactoring.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181108161654.19888-3-eric@anholt.net
Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
(cherry picked from commit e90e45f6bd45cc494a6f4cd1853c5e7cd4be7f68)
---
 drivers/gpu/drm/v3d/v3d_sched.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index a5501581d96b3..7aafcc6f54462 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -39,7 +39,7 @@ v3d_job_free(struct drm_sched_job *sched_job)
 }
 
 /**
- * Returns the fences that the bin job depends on, one by one.
+ * Returns the fences that the bin or render job depends on, one by one.
  * v3d_job_run() won't be called until all of them have been signaled.
  */
 static struct dma_fence *
-- 
GitLab


From 7e09c10741324062d50fe48922baaa0dd9fa83ac Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 8 Nov 2018 08:16:53 -0800
Subject: [PATCH 0573/1835] drm/v3d: Clean up the reservation object setup.

The extra to_v3d_bo() calls came from copying this from the vc4
driver, which stored the cma gem object in the structs.

v2: Fix an unused var warning

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181108161654.19888-4-eric@anholt.net
Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com> (v1)
(cherry picked from commit 8f1cd826641d677d0f7494253ecfc3335f0bcd4e)
---
 drivers/gpu/drm/v3d/v3d_gem.c | 33 +++++++++++----------------------
 1 file changed, 11 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 5c13b0807879a..7296a3a5f84a3 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -210,14 +210,11 @@ static void
 v3d_attach_object_fences(struct v3d_exec_info *exec)
 {
 	struct dma_fence *out_fence = exec->render_done_fence;
-	struct v3d_bo *bo;
 	int i;
 
 	for (i = 0; i < exec->bo_count; i++) {
-		bo = to_v3d_bo(&exec->bo[i]->base);
-
 		/* XXX: Use shared fences for read-only objects. */
-		reservation_object_add_excl_fence(bo->resv, out_fence);
+		reservation_object_add_excl_fence(exec->bo[i]->resv, out_fence);
 	}
 }
 
@@ -228,11 +225,8 @@ v3d_unlock_bo_reservations(struct drm_device *dev,
 {
 	int i;
 
-	for (i = 0; i < exec->bo_count; i++) {
-		struct v3d_bo *bo = to_v3d_bo(&exec->bo[i]->base);
-
-		ww_mutex_unlock(&bo->resv->lock);
-	}
+	for (i = 0; i < exec->bo_count; i++)
+		ww_mutex_unlock(&exec->bo[i]->resv->lock);
 
 	ww_acquire_fini(acquire_ctx);
 }
@@ -251,13 +245,13 @@ v3d_lock_bo_reservations(struct drm_device *dev,
 {
 	int contended_lock = -1;
 	int i, ret;
-	struct v3d_bo *bo;
 
 	ww_acquire_init(acquire_ctx, &reservation_ww_class);
 
 retry:
 	if (contended_lock != -1) {
-		bo = to_v3d_bo(&exec->bo[contended_lock]->base);
+		struct v3d_bo *bo = exec->bo[contended_lock];
+
 		ret = ww_mutex_lock_slow_interruptible(&bo->resv->lock,
 						       acquire_ctx);
 		if (ret) {
@@ -270,19 +264,16 @@ retry:
 		if (i == contended_lock)
 			continue;
 
-		bo = to_v3d_bo(&exec->bo[i]->base);
-
-		ret = ww_mutex_lock_interruptible(&bo->resv->lock, acquire_ctx);
+		ret = ww_mutex_lock_interruptible(&exec->bo[i]->resv->lock,
+						  acquire_ctx);
 		if (ret) {
 			int j;
 
-			for (j = 0; j < i; j++) {
-				bo = to_v3d_bo(&exec->bo[j]->base);
-				ww_mutex_unlock(&bo->resv->lock);
-			}
+			for (j = 0; j < i; j++)
+				ww_mutex_unlock(&exec->bo[j]->resv->lock);
 
 			if (contended_lock != -1 && contended_lock >= i) {
-				bo = to_v3d_bo(&exec->bo[contended_lock]->base);
+				struct v3d_bo *bo = exec->bo[contended_lock];
 
 				ww_mutex_unlock(&bo->resv->lock);
 			}
@@ -303,9 +294,7 @@ retry:
 	 * before we commit the CL to the hardware.
 	 */
 	for (i = 0; i < exec->bo_count; i++) {
-		bo = to_v3d_bo(&exec->bo[i]->base);
-
-		ret = reservation_object_reserve_shared(bo->resv);
+		ret = reservation_object_reserve_shared(exec->bo[i]->resv);
 		if (ret) {
 			v3d_unlock_bo_reservations(dev, exec, acquire_ctx);
 			return ret;
-- 
GitLab


From 73fcf3b17c66b87b1ff2dc52c855cf44b7838f7f Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 28 Nov 2018 15:09:25 -0800
Subject: [PATCH 0574/1835] drm/v3d: Add support for submitting jobs to the
 TFU.

The TFU can copy from raster, UIF, and SAND input images to UIF output
images, with optional mipmap generation.  This will certainly be
useful for media EGL image input, but is also useful immediately for
mipmap generation without bogging the V3D core down.

For now we only run the queue 1 job deep, and don't have any hang
recovery (though I don't think we should need it, with TFU).  Queuing
multiple jobs in the HW will require synchronizing the YUV coefficient
regs updates since they don't get FIFOed with the job.

v2: Change the ioctl to IOW instead of IOWR, always set COEF0, explain
    why TFU is AUTH, clarify the syncing docs, drop the unused TFU
    interrupt regs (you're expected to use the hub's), don't take
    &bo->base for NULL bos.
v3: Fix a little whitespace alignment (noticed by checkpatch), rebase
    on drm_sched_job_cleanup() changes.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Dave Emett <david.emett@broadcom.com> (v2)
Link: https://patchwork.freedesktop.org/patch/264607/
(cherry picked from commit 1584f16ca96ef124aad79efa3303cff5f3530e2c)
---
 drivers/gpu/drm/v3d/v3d_drv.c   |  15 ++-
 drivers/gpu/drm/v3d/v3d_drv.h   |  32 +++++-
 drivers/gpu/drm/v3d/v3d_gem.c   | 178 ++++++++++++++++++++++++++++----
 drivers/gpu/drm/v3d/v3d_irq.c   |  12 ++-
 drivers/gpu/drm/v3d/v3d_regs.h  |  49 +++++++++
 drivers/gpu/drm/v3d/v3d_sched.c | 148 ++++++++++++++++++++++----
 drivers/gpu/drm/v3d/v3d_trace.h |  20 ++++
 include/uapi/drm/v3d_drm.h      |  25 +++++
 8 files changed, 426 insertions(+), 53 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 2a4c6187e675f..30ae1c74edaa8 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -112,10 +112,15 @@ static int v3d_get_param_ioctl(struct drm_device *dev, void *data,
 		return 0;
 	}
 
-	/* Any params that aren't just register reads would go here. */
 
-	DRM_DEBUG("Unknown parameter %d\n", args->param);
-	return -EINVAL;
+	switch (args->param) {
+	case DRM_V3D_PARAM_SUPPORTS_TFU:
+		args->value = 1;
+		return 0;
+	default:
+		DRM_DEBUG("Unknown parameter %d\n", args->param);
+		return -EINVAL;
+	}
 }
 
 static int
@@ -170,7 +175,8 @@ static const struct file_operations v3d_drm_fops = {
 /* DRM_AUTH is required on SUBMIT_CL for now, while we don't have GMP
  * protection between clients.  Note that render nodes would be be
  * able to submit CLs that could access BOs from clients authenticated
- * with the master node.
+ * with the master node.  The TFU doesn't use the GMP, so it would
+ * need to stay DRM_AUTH until we do buffer size/offset validation.
  */
 static const struct drm_ioctl_desc v3d_drm_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(V3D_SUBMIT_CL, v3d_submit_cl_ioctl, DRM_RENDER_ALLOW | DRM_AUTH),
@@ -179,6 +185,7 @@ static const struct drm_ioctl_desc v3d_drm_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(V3D_MMAP_BO, v3d_mmap_bo_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(V3D_GET_PARAM, v3d_get_param_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(V3D_GET_BO_OFFSET, v3d_get_bo_offset_ioctl, DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(V3D_SUBMIT_TFU, v3d_submit_tfu_ioctl, DRM_RENDER_ALLOW | DRM_AUTH),
 };
 
 static const struct vm_operations_struct v3d_vm_ops = {
diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index eb32ff45a085e..f2937a1da5814 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -7,19 +7,18 @@
 #include <drm/drm_encoder.h>
 #include <drm/drm_gem.h>
 #include <drm/gpu_scheduler.h>
+#include "uapi/drm/v3d_drm.h"
 
 #define GMP_GRANULARITY (128 * 1024)
 
-/* Enum for each of the V3D queues.  We maintain various queue
- * tracking as an array because at some point we'll want to support
- * the TFU (texture formatting unit) as another queue.
- */
+/* Enum for each of the V3D queues. */
 enum v3d_queue {
 	V3D_BIN,
 	V3D_RENDER,
+	V3D_TFU,
 };
 
-#define V3D_MAX_QUEUES (V3D_RENDER + 1)
+#define V3D_MAX_QUEUES (V3D_TFU + 1)
 
 struct v3d_queue_state {
 	struct drm_gpu_scheduler sched;
@@ -68,6 +67,7 @@ struct v3d_dev {
 
 	struct v3d_exec_info *bin_job;
 	struct v3d_exec_info *render_job;
+	struct v3d_tfu_job *tfu_job;
 
 	struct v3d_queue_state queue[V3D_MAX_QUEUES];
 
@@ -218,6 +218,25 @@ struct v3d_exec_info {
 	u32 qma, qms, qts;
 };
 
+struct v3d_tfu_job {
+	struct drm_sched_job base;
+
+	struct drm_v3d_submit_tfu args;
+
+	/* An optional fence userspace can pass in for the job to depend on. */
+	struct dma_fence *in_fence;
+
+	/* v3d fence to be signaled by IRQ handler when the job is complete. */
+	struct dma_fence *done_fence;
+
+	struct v3d_dev *v3d;
+
+	struct kref refcount;
+
+	/* This is the array of BOs that were looked up at the start of exec. */
+	struct v3d_bo *bo[4];
+};
+
 /**
  * _wait_for - magic (register) wait macro
  *
@@ -281,9 +300,12 @@ int v3d_gem_init(struct drm_device *dev);
 void v3d_gem_destroy(struct drm_device *dev);
 int v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 			struct drm_file *file_priv);
+int v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv);
 int v3d_wait_bo_ioctl(struct drm_device *dev, void *data,
 		      struct drm_file *file_priv);
 void v3d_exec_put(struct v3d_exec_info *exec);
+void v3d_tfu_job_put(struct v3d_tfu_job *exec);
 void v3d_reset(struct v3d_dev *v3d);
 void v3d_invalidate_caches(struct v3d_dev *v3d);
 void v3d_flush_caches(struct v3d_dev *v3d);
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 7296a3a5f84a3..7fbbe24c583a6 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -207,26 +207,27 @@ v3d_flush_caches(struct v3d_dev *v3d)
 }
 
 static void
-v3d_attach_object_fences(struct v3d_exec_info *exec)
+v3d_attach_object_fences(struct v3d_bo **bos, int bo_count,
+			 struct dma_fence *fence)
 {
-	struct dma_fence *out_fence = exec->render_done_fence;
 	int i;
 
-	for (i = 0; i < exec->bo_count; i++) {
+	for (i = 0; i < bo_count; i++) {
 		/* XXX: Use shared fences for read-only objects. */
-		reservation_object_add_excl_fence(exec->bo[i]->resv, out_fence);
+		reservation_object_add_excl_fence(bos[i]->resv, fence);
 	}
 }
 
 static void
 v3d_unlock_bo_reservations(struct drm_device *dev,
-			   struct v3d_exec_info *exec,
+			   struct v3d_bo **bos,
+			   int bo_count,
 			   struct ww_acquire_ctx *acquire_ctx)
 {
 	int i;
 
-	for (i = 0; i < exec->bo_count; i++)
-		ww_mutex_unlock(&exec->bo[i]->resv->lock);
+	for (i = 0; i < bo_count; i++)
+		ww_mutex_unlock(&bos[i]->resv->lock);
 
 	ww_acquire_fini(acquire_ctx);
 }
@@ -240,7 +241,8 @@ v3d_unlock_bo_reservations(struct drm_device *dev,
  */
 static int
 v3d_lock_bo_reservations(struct drm_device *dev,
-			 struct v3d_exec_info *exec,
+			 struct v3d_bo **bos,
+			 int bo_count,
 			 struct ww_acquire_ctx *acquire_ctx)
 {
 	int contended_lock = -1;
@@ -250,7 +252,7 @@ v3d_lock_bo_reservations(struct drm_device *dev,
 
 retry:
 	if (contended_lock != -1) {
-		struct v3d_bo *bo = exec->bo[contended_lock];
+		struct v3d_bo *bo = bos[contended_lock];
 
 		ret = ww_mutex_lock_slow_interruptible(&bo->resv->lock,
 						       acquire_ctx);
@@ -260,20 +262,20 @@ retry:
 		}
 	}
 
-	for (i = 0; i < exec->bo_count; i++) {
+	for (i = 0; i < bo_count; i++) {
 		if (i == contended_lock)
 			continue;
 
-		ret = ww_mutex_lock_interruptible(&exec->bo[i]->resv->lock,
+		ret = ww_mutex_lock_interruptible(&bos[i]->resv->lock,
 						  acquire_ctx);
 		if (ret) {
 			int j;
 
 			for (j = 0; j < i; j++)
-				ww_mutex_unlock(&exec->bo[j]->resv->lock);
+				ww_mutex_unlock(&bos[j]->resv->lock);
 
 			if (contended_lock != -1 && contended_lock >= i) {
-				struct v3d_bo *bo = exec->bo[contended_lock];
+				struct v3d_bo *bo = bos[contended_lock];
 
 				ww_mutex_unlock(&bo->resv->lock);
 			}
@@ -293,10 +295,11 @@ retry:
 	/* Reserve space for our shared (read-only) fence references,
 	 * before we commit the CL to the hardware.
 	 */
-	for (i = 0; i < exec->bo_count; i++) {
-		ret = reservation_object_reserve_shared(exec->bo[i]->resv);
+	for (i = 0; i < bo_count; i++) {
+		ret = reservation_object_reserve_shared(bos[i]->resv);
 		if (ret) {
-			v3d_unlock_bo_reservations(dev, exec, acquire_ctx);
+			v3d_unlock_bo_reservations(dev, bos, bo_count,
+						   acquire_ctx);
 			return ret;
 		}
 	}
@@ -419,6 +422,33 @@ void v3d_exec_put(struct v3d_exec_info *exec)
 	kref_put(&exec->refcount, v3d_exec_cleanup);
 }
 
+static void
+v3d_tfu_job_cleanup(struct kref *ref)
+{
+	struct v3d_tfu_job *job = container_of(ref, struct v3d_tfu_job,
+					       refcount);
+	struct v3d_dev *v3d = job->v3d;
+	unsigned int i;
+
+	dma_fence_put(job->in_fence);
+	dma_fence_put(job->done_fence);
+
+	for (i = 0; i < ARRAY_SIZE(job->bo); i++) {
+		if (job->bo[i])
+			drm_gem_object_put_unlocked(&job->bo[i]->base);
+	}
+
+	pm_runtime_mark_last_busy(v3d->dev);
+	pm_runtime_put_autosuspend(v3d->dev);
+
+	kfree(job);
+}
+
+void v3d_tfu_job_put(struct v3d_tfu_job *job)
+{
+	kref_put(&job->refcount, v3d_tfu_job_cleanup);
+}
+
 int
 v3d_wait_bo_ioctl(struct drm_device *dev, void *data,
 		  struct drm_file *file_priv)
@@ -536,7 +566,8 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto fail;
 
-	ret = v3d_lock_bo_reservations(dev, exec, &acquire_ctx);
+	ret = v3d_lock_bo_reservations(dev, exec->bo, exec->bo_count,
+				       &acquire_ctx);
 	if (ret)
 		goto fail;
 
@@ -570,9 +601,10 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 				  &v3d_priv->sched_entity[V3D_RENDER]);
 	mutex_unlock(&v3d->sched_lock);
 
-	v3d_attach_object_fences(exec);
+	v3d_attach_object_fences(exec->bo, exec->bo_count,
+				 exec->render_done_fence);
 
-	v3d_unlock_bo_reservations(dev, exec, &acquire_ctx);
+	v3d_unlock_bo_reservations(dev, exec->bo, exec->bo_count, &acquire_ctx);
 
 	/* Update the return sync object for the */
 	sync_out = drm_syncobj_find(file_priv, args->out_sync);
@@ -588,13 +620,119 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 
 fail_unreserve:
 	mutex_unlock(&v3d->sched_lock);
-	v3d_unlock_bo_reservations(dev, exec, &acquire_ctx);
+	v3d_unlock_bo_reservations(dev, exec->bo, exec->bo_count, &acquire_ctx);
 fail:
 	v3d_exec_put(exec);
 
 	return ret;
 }
 
+/**
+ * v3d_submit_tfu_ioctl() - Submits a TFU (texture formatting) job to the V3D.
+ * @dev: DRM device
+ * @data: ioctl argument
+ * @file_priv: DRM file for this fd
+ *
+ * Userspace provides the register setup for the TFU, which we don't
+ * need to validate since the TFU is behind the MMU.
+ */
+int
+v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
+		     struct drm_file *file_priv)
+{
+	struct v3d_dev *v3d = to_v3d_dev(dev);
+	struct v3d_file_priv *v3d_priv = file_priv->driver_priv;
+	struct drm_v3d_submit_tfu *args = data;
+	struct v3d_tfu_job *job;
+	struct ww_acquire_ctx acquire_ctx;
+	struct drm_syncobj *sync_out;
+	struct dma_fence *sched_done_fence;
+	int ret = 0;
+	int bo_count;
+
+	job = kcalloc(1, sizeof(*job), GFP_KERNEL);
+	if (!job)
+		return -ENOMEM;
+
+	ret = pm_runtime_get_sync(v3d->dev);
+	if (ret < 0) {
+		kfree(job);
+		return ret;
+	}
+
+	kref_init(&job->refcount);
+
+	ret = drm_syncobj_find_fence(file_priv, args->in_sync,
+				     0, &job->in_fence);
+	if (ret == -EINVAL)
+		goto fail;
+
+	job->args = *args;
+	job->v3d = v3d;
+
+	spin_lock(&file_priv->table_lock);
+	for (bo_count = 0; bo_count < ARRAY_SIZE(job->bo); bo_count++) {
+		struct drm_gem_object *bo;
+
+		if (!args->bo_handles[bo_count])
+			break;
+
+		bo = idr_find(&file_priv->object_idr,
+			      args->bo_handles[bo_count]);
+		if (!bo) {
+			DRM_DEBUG("Failed to look up GEM BO %d: %d\n",
+				  bo_count, args->bo_handles[bo_count]);
+			ret = -ENOENT;
+			spin_unlock(&file_priv->table_lock);
+			goto fail;
+		}
+		drm_gem_object_get(bo);
+		job->bo[bo_count] = to_v3d_bo(bo);
+	}
+	spin_unlock(&file_priv->table_lock);
+
+	ret = v3d_lock_bo_reservations(dev, job->bo, bo_count, &acquire_ctx);
+	if (ret)
+		goto fail;
+
+	mutex_lock(&v3d->sched_lock);
+	ret = drm_sched_job_init(&job->base,
+				 &v3d_priv->sched_entity[V3D_TFU],
+				 v3d_priv);
+	if (ret)
+		goto fail_unreserve;
+
+	sched_done_fence = dma_fence_get(&job->base.s_fence->finished);
+
+	kref_get(&job->refcount); /* put by scheduler job completion */
+	drm_sched_entity_push_job(&job->base, &v3d_priv->sched_entity[V3D_TFU]);
+	mutex_unlock(&v3d->sched_lock);
+
+	v3d_attach_object_fences(job->bo, bo_count, sched_done_fence);
+
+	v3d_unlock_bo_reservations(dev, job->bo, bo_count, &acquire_ctx);
+
+	/* Update the return sync object */
+	sync_out = drm_syncobj_find(file_priv, args->out_sync);
+	if (sync_out) {
+		drm_syncobj_replace_fence(sync_out, sched_done_fence);
+		drm_syncobj_put(sync_out);
+	}
+	dma_fence_put(sched_done_fence);
+
+	v3d_tfu_job_put(job);
+
+	return 0;
+
+fail_unreserve:
+	mutex_unlock(&v3d->sched_lock);
+	v3d_unlock_bo_reservations(dev, job->bo, bo_count, &acquire_ctx);
+fail:
+	v3d_tfu_job_put(job);
+
+	return ret;
+}
+
 int
 v3d_gem_init(struct drm_device *dev)
 {
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index 22be0f2dff99c..e33bca1a494b3 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -4,8 +4,8 @@
 /**
  * DOC: Interrupt management for the V3D engine
  *
- * When we take a binning or rendering flush done interrupt, we need
- * to signal the fence for that job so that the scheduler can queue up
+ * When we take a bin, render, or TFU done interrupt, we need to
+ * signal the fence for that job so that the scheduler can queue up
  * the next one and unblock any waiters.
  *
  * When we take the binner out of memory interrupt, we need to
@@ -23,7 +23,8 @@
 
 #define V3D_HUB_IRQS ((u32)(V3D_HUB_INT_MMU_WRV |	\
 			    V3D_HUB_INT_MMU_PTI |	\
-			    V3D_HUB_INT_MMU_CAP))
+			    V3D_HUB_INT_MMU_CAP |	\
+			    V3D_HUB_INT_TFUC))
 
 static void
 v3d_overflow_mem_work(struct work_struct *work)
@@ -117,6 +118,11 @@ v3d_hub_irq(int irq, void *arg)
 	/* Acknowledge the interrupts we're handling here. */
 	V3D_WRITE(V3D_HUB_INT_CLR, intsts);
 
+	if (intsts & V3D_HUB_INT_TFUC) {
+		dma_fence_signal(v3d->tfu_job->done_fence);
+		status = IRQ_HANDLED;
+	}
+
 	if (intsts & (V3D_HUB_INT_MMU_WRV |
 		      V3D_HUB_INT_MMU_PTI |
 		      V3D_HUB_INT_MMU_CAP)) {
diff --git a/drivers/gpu/drm/v3d/v3d_regs.h b/drivers/gpu/drm/v3d/v3d_regs.h
index c3a5e4e44f731..6ccdee9d47bd7 100644
--- a/drivers/gpu/drm/v3d/v3d_regs.h
+++ b/drivers/gpu/drm/v3d/v3d_regs.h
@@ -86,6 +86,55 @@
 # define V3D_TOP_GR_BRIDGE_SW_INIT_1                   0x0000c
 # define V3D_TOP_GR_BRIDGE_SW_INIT_1_V3D_CLK_108_SW_INIT BIT(0)
 
+#define V3D_TFU_CS                                     0x00400
+/* Stops current job, empties input fifo. */
+# define V3D_TFU_CS_TFURST                             BIT(31)
+# define V3D_TFU_CS_CVTCT_MASK                         V3D_MASK(23, 16)
+# define V3D_TFU_CS_CVTCT_SHIFT                        16
+# define V3D_TFU_CS_NFREE_MASK                         V3D_MASK(13, 8)
+# define V3D_TFU_CS_NFREE_SHIFT                        8
+# define V3D_TFU_CS_BUSY                               BIT(0)
+
+#define V3D_TFU_SU                                     0x00404
+/* Interrupt when FINTTHR input slots are free (0 = disabled) */
+# define V3D_TFU_SU_FINTTHR_MASK                       V3D_MASK(13, 8)
+# define V3D_TFU_SU_FINTTHR_SHIFT                      8
+/* Skips resetting the CRC at the start of CRC generation. */
+# define V3D_TFU_SU_CRCCHAIN                           BIT(4)
+/* skips writes, computes CRC of the image.  miplevels must be 0. */
+# define V3D_TFU_SU_CRC                                BIT(3)
+# define V3D_TFU_SU_THROTTLE_MASK                      V3D_MASK(1, 0)
+# define V3D_TFU_SU_THROTTLE_SHIFT                     0
+
+#define V3D_TFU_ICFG                                   0x00408
+/* Interrupt when the conversion is complete. */
+# define V3D_TFU_ICFG_IOC                              BIT(0)
+
+/* Input Image Address */
+#define V3D_TFU_IIA                                    0x0040c
+/* Input Chroma Address */
+#define V3D_TFU_ICA                                    0x00410
+/* Input Image Stride */
+#define V3D_TFU_IIS                                    0x00414
+/* Input Image U-Plane Address */
+#define V3D_TFU_IUA                                    0x00418
+/* Output Image Address */
+#define V3D_TFU_IOA                                    0x0041c
+/* Image Output Size */
+#define V3D_TFU_IOS                                    0x00420
+/* TFU YUV Coefficient 0 */
+#define V3D_TFU_COEF0                                  0x00424
+/* Use these regs instead of the defaults. */
+# define V3D_TFU_COEF0_USECOEF                         BIT(31)
+/* TFU YUV Coefficient 1 */
+#define V3D_TFU_COEF1                                  0x00428
+/* TFU YUV Coefficient 2 */
+#define V3D_TFU_COEF2                                  0x0042c
+/* TFU YUV Coefficient 3 */
+#define V3D_TFU_COEF3                                  0x00430
+
+#define V3D_TFU_CRC                                    0x00434
+
 /* Per-MMU registers. */
 
 #define V3D_MMUC_CONTROL                               0x01000
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index 7aafcc6f54462..2ab1bbdb100a9 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -30,6 +30,12 @@ to_v3d_job(struct drm_sched_job *sched_job)
 	return container_of(sched_job, struct v3d_job, base);
 }
 
+static struct v3d_tfu_job *
+to_tfu_job(struct drm_sched_job *sched_job)
+{
+	return container_of(sched_job, struct v3d_tfu_job, base);
+}
+
 static void
 v3d_job_free(struct drm_sched_job *sched_job)
 {
@@ -38,6 +44,14 @@ v3d_job_free(struct drm_sched_job *sched_job)
 	v3d_exec_put(job->exec);
 }
 
+static void
+v3d_tfu_job_free(struct drm_sched_job *sched_job)
+{
+	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+
+	v3d_tfu_job_put(job);
+}
+
 /**
  * Returns the fences that the bin or render job depends on, one by one.
  * v3d_job_run() won't be called until all of them have been signaled.
@@ -76,6 +90,27 @@ v3d_job_dependency(struct drm_sched_job *sched_job,
 	return fence;
 }
 
+/**
+ * Returns the fences that the TFU job depends on, one by one.
+ * v3d_tfu_job_run() won't be called until all of them have been
+ * signaled.
+ */
+static struct dma_fence *
+v3d_tfu_job_dependency(struct drm_sched_job *sched_job,
+		       struct drm_sched_entity *s_entity)
+{
+	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+	struct dma_fence *fence;
+
+	fence = job->in_fence;
+	if (fence) {
+		job->in_fence = NULL;
+		return fence;
+	}
+
+	return NULL;
+}
+
 static struct dma_fence *v3d_job_run(struct drm_sched_job *sched_job)
 {
 	struct v3d_job *job = to_v3d_job(sched_job);
@@ -147,31 +182,47 @@ static struct dma_fence *v3d_job_run(struct drm_sched_job *sched_job)
 	return fence;
 }
 
-static void
-v3d_job_timedout(struct drm_sched_job *sched_job)
+static struct dma_fence *
+v3d_tfu_job_run(struct drm_sched_job *sched_job)
 {
-	struct v3d_job *job = to_v3d_job(sched_job);
-	struct v3d_exec_info *exec = job->exec;
-	struct v3d_dev *v3d = exec->v3d;
-	enum v3d_queue job_q = job == &exec->bin ? V3D_BIN : V3D_RENDER;
-	enum v3d_queue q;
-	u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(job_q));
-	u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(job_q));
+	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+	struct v3d_dev *v3d = job->v3d;
+	struct drm_device *dev = &v3d->drm;
+	struct dma_fence *fence;
 
-	/* If the current address or return address have changed, then
-	 * the GPU has probably made progress and we should delay the
-	 * reset.  This could fail if the GPU got in an infinite loop
-	 * in the CL, but that is pretty unlikely outside of an i-g-t
-	 * testcase.
-	 */
-	if (job->timedout_ctca != ctca || job->timedout_ctra != ctra) {
-		job->timedout_ctca = ctca;
-		job->timedout_ctra = ctra;
+	fence = v3d_fence_create(v3d, V3D_TFU);
+	if (IS_ERR(fence))
+		return NULL;
 
-		schedule_delayed_work(&job->base.work_tdr,
-				      job->base.sched->timeout);
-		return;
+	v3d->tfu_job = job;
+	if (job->done_fence)
+		dma_fence_put(job->done_fence);
+	job->done_fence = dma_fence_get(fence);
+
+	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
+
+	V3D_WRITE(V3D_TFU_IIA, job->args.iia);
+	V3D_WRITE(V3D_TFU_IIS, job->args.iis);
+	V3D_WRITE(V3D_TFU_ICA, job->args.ica);
+	V3D_WRITE(V3D_TFU_IUA, job->args.iua);
+	V3D_WRITE(V3D_TFU_IOA, job->args.ioa);
+	V3D_WRITE(V3D_TFU_IOS, job->args.ios);
+	V3D_WRITE(V3D_TFU_COEF0, job->args.coef[0]);
+	if (job->args.coef[0] & V3D_TFU_COEF0_USECOEF) {
+		V3D_WRITE(V3D_TFU_COEF1, job->args.coef[1]);
+		V3D_WRITE(V3D_TFU_COEF2, job->args.coef[2]);
+		V3D_WRITE(V3D_TFU_COEF3, job->args.coef[3]);
 	}
+	/* ICFG kicks off the job. */
+	V3D_WRITE(V3D_TFU_ICFG, job->args.icfg | V3D_TFU_ICFG_IOC);
+
+	return fence;
+}
+
+static void
+v3d_gpu_reset_for_timeout(struct v3d_dev *v3d, struct drm_sched_job *sched_job)
+{
+	enum v3d_queue q;
 
 	mutex_lock(&v3d->reset_lock);
 
@@ -196,6 +247,41 @@ v3d_job_timedout(struct drm_sched_job *sched_job)
 	mutex_unlock(&v3d->reset_lock);
 }
 
+static void
+v3d_job_timedout(struct drm_sched_job *sched_job)
+{
+	struct v3d_job *job = to_v3d_job(sched_job);
+	struct v3d_exec_info *exec = job->exec;
+	struct v3d_dev *v3d = exec->v3d;
+	enum v3d_queue job_q = job == &exec->bin ? V3D_BIN : V3D_RENDER;
+	u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(job_q));
+	u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(job_q));
+
+	/* If the current address or return address have changed, then
+	 * the GPU has probably made progress and we should delay the
+	 * reset.  This could fail if the GPU got in an infinite loop
+	 * in the CL, but that is pretty unlikely outside of an i-g-t
+	 * testcase.
+	 */
+	if (job->timedout_ctca != ctca || job->timedout_ctra != ctra) {
+		job->timedout_ctca = ctca;
+		job->timedout_ctra = ctra;
+		schedule_delayed_work(&job->base.work_tdr,
+				      job->base.sched->timeout);
+		return;
+	}
+
+	v3d_gpu_reset_for_timeout(v3d, sched_job);
+}
+
+static void
+v3d_tfu_job_timedout(struct drm_sched_job *sched_job)
+{
+	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+
+	v3d_gpu_reset_for_timeout(job->v3d, sched_job);
+}
+
 static const struct drm_sched_backend_ops v3d_sched_ops = {
 	.dependency = v3d_job_dependency,
 	.run_job = v3d_job_run,
@@ -203,6 +289,13 @@ static const struct drm_sched_backend_ops v3d_sched_ops = {
 	.free_job = v3d_job_free
 };
 
+static const struct drm_sched_backend_ops v3d_tfu_sched_ops = {
+	.dependency = v3d_tfu_job_dependency,
+	.run_job = v3d_tfu_job_run,
+	.timedout_job = v3d_tfu_job_timedout,
+	.free_job = v3d_tfu_job_free
+};
+
 int
 v3d_sched_init(struct v3d_dev *v3d)
 {
@@ -233,6 +326,19 @@ v3d_sched_init(struct v3d_dev *v3d)
 		return ret;
 	}
 
+	ret = drm_sched_init(&v3d->queue[V3D_TFU].sched,
+			     &v3d_tfu_sched_ops,
+			     hw_jobs_limit, job_hang_limit,
+			     msecs_to_jiffies(hang_limit_ms),
+			     "v3d_tfu");
+	if (ret) {
+		dev_err(v3d->dev, "Failed to create TFU scheduler: %d.",
+			ret);
+		drm_sched_fini(&v3d->queue[V3D_RENDER].sched);
+		drm_sched_fini(&v3d->queue[V3D_BIN].sched);
+		return ret;
+	}
+
 	return 0;
 }
 
diff --git a/drivers/gpu/drm/v3d/v3d_trace.h b/drivers/gpu/drm/v3d/v3d_trace.h
index 85dd351e1e09a..f54ed9cd3444f 100644
--- a/drivers/gpu/drm/v3d/v3d_trace.h
+++ b/drivers/gpu/drm/v3d/v3d_trace.h
@@ -42,6 +42,26 @@ TRACE_EVENT(v3d_submit_cl,
 		      __entry->ctnqea)
 );
 
+TRACE_EVENT(v3d_submit_tfu,
+	    TP_PROTO(struct drm_device *dev,
+		     uint64_t seqno),
+	    TP_ARGS(dev, seqno),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u64, seqno)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->seqno = seqno;
+			   ),
+
+	    TP_printk("dev=%u, seqno=%llu",
+		      __entry->dev,
+		      __entry->seqno)
+);
+
 TRACE_EVENT(v3d_reset_begin,
 	    TP_PROTO(struct drm_device *dev),
 	    TP_ARGS(dev),
diff --git a/include/uapi/drm/v3d_drm.h b/include/uapi/drm/v3d_drm.h
index 7b6627783608e..c4b67eab7e594 100644
--- a/include/uapi/drm/v3d_drm.h
+++ b/include/uapi/drm/v3d_drm.h
@@ -36,6 +36,7 @@ extern "C" {
 #define DRM_V3D_MMAP_BO                           0x03
 #define DRM_V3D_GET_PARAM                         0x04
 #define DRM_V3D_GET_BO_OFFSET                     0x05
+#define DRM_V3D_SUBMIT_TFU                        0x06
 
 #define DRM_IOCTL_V3D_SUBMIT_CL           DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_SUBMIT_CL, struct drm_v3d_submit_cl)
 #define DRM_IOCTL_V3D_WAIT_BO             DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_WAIT_BO, struct drm_v3d_wait_bo)
@@ -43,6 +44,7 @@ extern "C" {
 #define DRM_IOCTL_V3D_MMAP_BO             DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_MMAP_BO, struct drm_v3d_mmap_bo)
 #define DRM_IOCTL_V3D_GET_PARAM           DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_GET_PARAM, struct drm_v3d_get_param)
 #define DRM_IOCTL_V3D_GET_BO_OFFSET       DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_GET_BO_OFFSET, struct drm_v3d_get_bo_offset)
+#define DRM_IOCTL_V3D_SUBMIT_TFU          DRM_IOW(DRM_COMMAND_BASE + DRM_V3D_SUBMIT_TFU, struct drm_v3d_submit_tfu)
 
 /**
  * struct drm_v3d_submit_cl - ioctl argument for submitting commands to the 3D
@@ -169,6 +171,7 @@ enum drm_v3d_param {
 	DRM_V3D_PARAM_V3D_CORE0_IDENT0,
 	DRM_V3D_PARAM_V3D_CORE0_IDENT1,
 	DRM_V3D_PARAM_V3D_CORE0_IDENT2,
+	DRM_V3D_PARAM_SUPPORTS_TFU,
 };
 
 struct drm_v3d_get_param {
@@ -187,6 +190,28 @@ struct drm_v3d_get_bo_offset {
 	__u32 offset;
 };
 
+struct drm_v3d_submit_tfu {
+	__u32 icfg;
+	__u32 iia;
+	__u32 iis;
+	__u32 ica;
+	__u32 iua;
+	__u32 ioa;
+	__u32 ios;
+	__u32 coef[4];
+	/* First handle is the output BO, following are other inputs.
+	 * 0 for unused.
+	 */
+	__u32 bo_handles[4];
+	/* sync object to block on before running the TFU job.  Each TFU
+	 * job will execute in the order submitted to its FD.  Synchronization
+	 * against rendering jobs requires using sync objects.
+	 */
+	__u32 in_sync;
+	/* Sync object to signal when the TFU job is done. */
+	__u32 out_sync;
+};
+
 #if defined(__cplusplus)
 }
 #endif
-- 
GitLab


From a65d035914638414d9dff57b200dbacb9baebc6e Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 28 Nov 2018 15:09:26 -0800
Subject: [PATCH 0575/1835] drm/v3d: Drop the "dev" argument to lock/unlock of
 BO reservations.

They were unused, as Dave Emett noticed in TFU review.

Signed-off-by: Eric Anholt <eric@anholt.net>
Cc: Dave Emett <david.emett@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181128230927.10951-2-eric@anholt.net
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
(cherry picked from commit e14a07fc4b961a75f6c275d6bd670ba54fbdae14)
---
 drivers/gpu/drm/v3d/v3d_gem.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 7fbbe24c583a6..46ef27fab2c5a 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -219,8 +219,7 @@ v3d_attach_object_fences(struct v3d_bo **bos, int bo_count,
 }
 
 static void
-v3d_unlock_bo_reservations(struct drm_device *dev,
-			   struct v3d_bo **bos,
+v3d_unlock_bo_reservations(struct v3d_bo **bos,
 			   int bo_count,
 			   struct ww_acquire_ctx *acquire_ctx)
 {
@@ -240,8 +239,7 @@ v3d_unlock_bo_reservations(struct drm_device *dev,
  * to v3d, so we don't attach dma-buf fences to them.
  */
 static int
-v3d_lock_bo_reservations(struct drm_device *dev,
-			 struct v3d_bo **bos,
+v3d_lock_bo_reservations(struct v3d_bo **bos,
 			 int bo_count,
 			 struct ww_acquire_ctx *acquire_ctx)
 {
@@ -298,7 +296,7 @@ retry:
 	for (i = 0; i < bo_count; i++) {
 		ret = reservation_object_reserve_shared(bos[i]->resv);
 		if (ret) {
-			v3d_unlock_bo_reservations(dev, bos, bo_count,
+			v3d_unlock_bo_reservations(bos, bo_count,
 						   acquire_ctx);
 			return ret;
 		}
@@ -566,7 +564,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto fail;
 
-	ret = v3d_lock_bo_reservations(dev, exec->bo, exec->bo_count,
+	ret = v3d_lock_bo_reservations(exec->bo, exec->bo_count,
 				       &acquire_ctx);
 	if (ret)
 		goto fail;
@@ -604,7 +602,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	v3d_attach_object_fences(exec->bo, exec->bo_count,
 				 exec->render_done_fence);
 
-	v3d_unlock_bo_reservations(dev, exec->bo, exec->bo_count, &acquire_ctx);
+	v3d_unlock_bo_reservations(exec->bo, exec->bo_count, &acquire_ctx);
 
 	/* Update the return sync object for the */
 	sync_out = drm_syncobj_find(file_priv, args->out_sync);
@@ -620,7 +618,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 
 fail_unreserve:
 	mutex_unlock(&v3d->sched_lock);
-	v3d_unlock_bo_reservations(dev, exec->bo, exec->bo_count, &acquire_ctx);
+	v3d_unlock_bo_reservations(exec->bo, exec->bo_count, &acquire_ctx);
 fail:
 	v3d_exec_put(exec);
 
@@ -691,7 +689,7 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 	}
 	spin_unlock(&file_priv->table_lock);
 
-	ret = v3d_lock_bo_reservations(dev, job->bo, bo_count, &acquire_ctx);
+	ret = v3d_lock_bo_reservations(job->bo, bo_count, &acquire_ctx);
 	if (ret)
 		goto fail;
 
@@ -710,7 +708,7 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 
 	v3d_attach_object_fences(job->bo, bo_count, sched_done_fence);
 
-	v3d_unlock_bo_reservations(dev, job->bo, bo_count, &acquire_ctx);
+	v3d_unlock_bo_reservations(job->bo, bo_count, &acquire_ctx);
 
 	/* Update the return sync object */
 	sync_out = drm_syncobj_find(file_priv, args->out_sync);
@@ -726,7 +724,7 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 
 fail_unreserve:
 	mutex_unlock(&v3d->sched_lock);
-	v3d_unlock_bo_reservations(dev, job->bo, bo_count, &acquire_ctx);
+	v3d_unlock_bo_reservations(job->bo, bo_count, &acquire_ctx);
 fail:
 	v3d_tfu_job_put(job);
 
-- 
GitLab


From da45105ee6ab068262f4273e3fdd91a6e27dc8d3 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 30 Nov 2018 16:57:59 -0800
Subject: [PATCH 0576/1835] drm/v3d: Add missing fence timeline name for TFU.

We shouldn't be returning v3d-render for our new queue.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 83d5139982db ("drm/v3d: Add support for submitting jobs to the TFU.")
Link: https://patchwork.freedesktop.org/patch/msgid/20181201005759.28093-6-eric@anholt.net
Reviewed-by: Dave Emett <david.emett@broadcom.com>
(cherry picked from commit db176f6ba1da39ad0016c77b9775a6bb3d0ce88a)
---
 drivers/gpu/drm/v3d/v3d_fence.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_fence.c b/drivers/gpu/drm/v3d/v3d_fence.c
index 50bfcf9a8a1ac..b0a2a1ae2eb1a 100644
--- a/drivers/gpu/drm/v3d/v3d_fence.c
+++ b/drivers/gpu/drm/v3d/v3d_fence.c
@@ -29,10 +29,16 @@ static const char *v3d_fence_get_timeline_name(struct dma_fence *fence)
 {
 	struct v3d_fence *f = to_v3d_fence(fence);
 
-	if (f->queue == V3D_BIN)
+	switch (f->queue) {
+	case V3D_BIN:
 		return "v3d-bin";
-	else
+	case V3D_RENDER:
 		return "v3d-render";
+	case V3D_TFU:
+		return "v3d-tfu";
+	default:
+		return NULL;
+	}
 }
 
 const struct dma_fence_ops v3d_fence_ops = {
-- 
GitLab


From 5ecb950808c32a75a63a97e4a3c73c9c2667046a Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 30 Nov 2018 16:57:58 -0800
Subject: [PATCH 0577/1835] drm/v3d: Add more tracepoints for V3D GPU
 rendering.

The core scheduler tells us when the job is pushed to the scheduler's
queue, and I had the job_run functions saying when they actually queue
the job to the hardware.  By adding tracepoints for the very top of
the ioctls and the IRQs signaling job completion, "perf record -a -e
v3d:.\* -e gpu_scheduler:.\* <job>; perf script" gets you a pretty
decent timeline.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181201005759.28093-5-eric@anholt.net
Reviewed-by: Dave Emett <david.emett@broadcom.com>
(cherry picked from commit 55a9b74846ed5e6219c7d81a8e1bf96f25d8ad5e)
---
 drivers/gpu/drm/v3d/v3d_gem.c   |   4 ++
 drivers/gpu/drm/v3d/v3d_irq.c   |  19 +++++-
 drivers/gpu/drm/v3d/v3d_trace.h | 101 ++++++++++++++++++++++++++++++++
 3 files changed, 121 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 46ef27fab2c5a..21f8ad5598321 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -521,6 +521,8 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	struct drm_syncobj *sync_out;
 	int ret = 0;
 
+	trace_v3d_submit_cl_ioctl(&v3d->drm, args->rcl_start, args->rcl_end);
+
 	if (args->pad != 0) {
 		DRM_INFO("pad must be zero: %d\n", args->pad);
 		return -EINVAL;
@@ -648,6 +650,8 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 	int ret = 0;
 	int bo_count;
 
+	trace_v3d_submit_tfu_ioctl(&v3d->drm, args->iia);
+
 	job = kcalloc(1, sizeof(*job), GFP_KERNEL);
 	if (!job)
 		return -ENOMEM;
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index e33bca1a494b3..29d746cfce572 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -15,6 +15,7 @@
 
 #include "v3d_drv.h"
 #include "v3d_regs.h"
+#include "v3d_trace.h"
 
 #define V3D_CORE_IRQS ((u32)(V3D_INT_OUTOMEM |	\
 			     V3D_INT_FLDONE |	\
@@ -88,12 +89,20 @@ v3d_irq(int irq, void *arg)
 	}
 
 	if (intsts & V3D_INT_FLDONE) {
-		dma_fence_signal(v3d->bin_job->bin.done_fence);
+		struct v3d_fence *fence =
+			to_v3d_fence(v3d->bin_job->bin.done_fence);
+
+		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
+		dma_fence_signal(&fence->base);
 		status = IRQ_HANDLED;
 	}
 
 	if (intsts & V3D_INT_FRDONE) {
-		dma_fence_signal(v3d->render_job->render.done_fence);
+		struct v3d_fence *fence =
+			to_v3d_fence(v3d->render_job->render.done_fence);
+
+		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
+		dma_fence_signal(&fence->base);
 		status = IRQ_HANDLED;
 	}
 
@@ -119,7 +128,11 @@ v3d_hub_irq(int irq, void *arg)
 	V3D_WRITE(V3D_HUB_INT_CLR, intsts);
 
 	if (intsts & V3D_HUB_INT_TFUC) {
-		dma_fence_signal(v3d->tfu_job->done_fence);
+		struct v3d_fence *fence =
+			to_v3d_fence(v3d->tfu_job->done_fence);
+
+		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
+		dma_fence_signal(&fence->base);
 		status = IRQ_HANDLED;
 	}
 
diff --git a/drivers/gpu/drm/v3d/v3d_trace.h b/drivers/gpu/drm/v3d/v3d_trace.h
index f54ed9cd3444f..edd984afa33fb 100644
--- a/drivers/gpu/drm/v3d/v3d_trace.h
+++ b/drivers/gpu/drm/v3d/v3d_trace.h
@@ -12,6 +12,28 @@
 #define TRACE_SYSTEM v3d
 #define TRACE_INCLUDE_FILE v3d_trace
 
+TRACE_EVENT(v3d_submit_cl_ioctl,
+	    TP_PROTO(struct drm_device *dev, u32 ct1qba, u32 ct1qea),
+	    TP_ARGS(dev, ct1qba, ct1qea),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u32, ct1qba)
+			     __field(u32, ct1qea)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->ct1qba = ct1qba;
+			   __entry->ct1qea = ct1qea;
+			   ),
+
+	    TP_printk("dev=%u, RCL 0x%08x..0x%08x",
+		      __entry->dev,
+		      __entry->ct1qba,
+		      __entry->ct1qea)
+);
+
 TRACE_EVENT(v3d_submit_cl,
 	    TP_PROTO(struct drm_device *dev, bool is_render,
 		     uint64_t seqno,
@@ -42,6 +64,85 @@ TRACE_EVENT(v3d_submit_cl,
 		      __entry->ctnqea)
 );
 
+TRACE_EVENT(v3d_bcl_irq,
+	    TP_PROTO(struct drm_device *dev,
+		     uint64_t seqno),
+	    TP_ARGS(dev, seqno),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u64, seqno)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->seqno = seqno;
+			   ),
+
+	    TP_printk("dev=%u, seqno=%llu",
+		      __entry->dev,
+		      __entry->seqno)
+);
+
+TRACE_EVENT(v3d_rcl_irq,
+	    TP_PROTO(struct drm_device *dev,
+		     uint64_t seqno),
+	    TP_ARGS(dev, seqno),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u64, seqno)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->seqno = seqno;
+			   ),
+
+	    TP_printk("dev=%u, seqno=%llu",
+		      __entry->dev,
+		      __entry->seqno)
+);
+
+TRACE_EVENT(v3d_tfu_irq,
+	    TP_PROTO(struct drm_device *dev,
+		     uint64_t seqno),
+	    TP_ARGS(dev, seqno),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u64, seqno)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->seqno = seqno;
+			   ),
+
+	    TP_printk("dev=%u, seqno=%llu",
+		      __entry->dev,
+		      __entry->seqno)
+);
+
+TRACE_EVENT(v3d_submit_tfu_ioctl,
+	    TP_PROTO(struct drm_device *dev, u32 iia),
+	    TP_ARGS(dev, iia),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u32, iia)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->iia = iia;
+			   ),
+
+	    TP_printk("dev=%u, IIA 0x%08x",
+		      __entry->dev,
+		      __entry->iia)
+);
+
 TRACE_EVENT(v3d_submit_tfu,
 	    TP_PROTO(struct drm_device *dev,
 		     uint64_t seqno),
-- 
GitLab


From 59d677155028619a96b400d85b758308fa3d0934 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 3 Dec 2018 14:24:34 -0800
Subject: [PATCH 0578/1835] drm/v3d: Drop unused v3d_flush_caches().

Now that I've specified how the end-of-pipeline flushing should work,
we're never going to use this function.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Dave Emett <david.emett@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181203222438.25417-2-eric@anholt.net
(cherry picked from commit 2aa34fd5c7754824cf5488b61ac644f30d3c5c85)
---
 drivers/gpu/drm/v3d/v3d_drv.h |  1 -
 drivers/gpu/drm/v3d/v3d_gem.c | 21 ---------------------
 2 files changed, 22 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index f2937a1da5814..2fdb456b72d32 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -308,7 +308,6 @@ void v3d_exec_put(struct v3d_exec_info *exec);
 void v3d_tfu_job_put(struct v3d_tfu_job *exec);
 void v3d_reset(struct v3d_dev *v3d);
 void v3d_invalidate_caches(struct v3d_dev *v3d);
-void v3d_flush_caches(struct v3d_dev *v3d);
 
 /* v3d_irq.c */
 int v3d_irq_init(struct v3d_dev *v3d);
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 21f8ad5598321..bb5a0ec29fded 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -175,20 +175,6 @@ v3d_invalidate_slices(struct v3d_dev *v3d, int core)
 		       V3D_SET_FIELD(0xf, V3D_SLCACTL_ICC));
 }
 
-/* Invalidates texture L2 cachelines */
-static void
-v3d_invalidate_l2t(struct v3d_dev *v3d, int core)
-{
-	V3D_CORE_WRITE(core,
-		       V3D_CTL_L2TCACTL,
-		       V3D_L2TCACTL_L2TFLS |
-		       V3D_SET_FIELD(V3D_L2TCACTL_FLM_CLEAR, V3D_L2TCACTL_FLM));
-	if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) &
-		       V3D_L2TCACTL_L2TFLS), 100)) {
-		DRM_ERROR("Timeout waiting for L2T invalidate\n");
-	}
-}
-
 void
 v3d_invalidate_caches(struct v3d_dev *v3d)
 {
@@ -199,13 +185,6 @@ v3d_invalidate_caches(struct v3d_dev *v3d)
 	v3d_flush_l2t(v3d, 0);
 }
 
-void
-v3d_flush_caches(struct v3d_dev *v3d)
-{
-	v3d_invalidate_l1td(v3d, 0);
-	v3d_invalidate_l2t(v3d, 0);
-}
-
 static void
 v3d_attach_object_fences(struct v3d_bo **bos, int bo_count,
 			 struct dma_fence *fence)
-- 
GitLab


From 69dabb23ccbd930032e0c5aecadf439937cf1f6c Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 3 Dec 2018 14:24:35 -0800
Subject: [PATCH 0579/1835] drm/v3d: Don't bother flushing L1TD at job start.

This is the write combiner for TMU writes.  You're supposed to flush
that at job end if you had dirtied any cachelines.  Flushing it at job
start then doesn't make any sense.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
Reviewed-by: Dave Emett <david.emett@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181203222438.25417-3-eric@anholt.net
(cherry picked from commit 2e6dc3bd80478212e84addf1cafd6ec60674b884)
---
 drivers/gpu/drm/v3d/v3d_gem.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index bb5a0ec29fded..15065d11f7818 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -139,22 +139,10 @@ v3d_invalidate_l2(struct v3d_dev *v3d, int core)
 		       V3D_L2CACTL_L2CENA);
 }
 
-static void
-v3d_invalidate_l1td(struct v3d_dev *v3d, int core)
-{
-	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL, V3D_L2TCACTL_TMUWCF);
-	if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) &
-		       V3D_L2TCACTL_L2TFLS), 100)) {
-		DRM_ERROR("Timeout waiting for L1T write combiner flush\n");
-	}
-}
-
 /* Invalidates texture L2 cachelines */
 static void
 v3d_flush_l2t(struct v3d_dev *v3d, int core)
 {
-	v3d_invalidate_l1td(v3d, core);
-
 	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL,
 		       V3D_L2TCACTL_L2TFLS |
 		       V3D_SET_FIELD(V3D_L2TCACTL_FLM_FLUSH, V3D_L2TCACTL_FLM));
-- 
GitLab


From d6f6accead7bacbe594d7b59729f8a25225f8267 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 3 Dec 2018 14:24:36 -0800
Subject: [PATCH 0580/1835] drm/v3d: Drop the wait for L2T flush to complete.

According to Dave, once you've started an L2T flush, all L2T accesses
will be blocked until the flush completes.  This fixes a consistent
3-4ms stall between the ioctl and running the job, and 3DMMES Taiji
goes from 27fps to 110fps.

v2: Leave a note about why we don't need to wait for completion.

Signed-off-by: Eric Anholt <eric@anholt.net>
Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
Reviewed-by: Dave Emett <david.emett@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181203222438.25417-4-eric@anholt.net
(cherry picked from commit 51c1b6f9eb3dbdec91b0e3c89f623e634c996bbb)
---
 drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 15065d11f7818..8c4380ef2b048 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -143,13 +143,13 @@ v3d_invalidate_l2(struct v3d_dev *v3d, int core)
 static void
 v3d_flush_l2t(struct v3d_dev *v3d, int core)
 {
+	/* While there is a busy bit (V3D_L2TCACTL_L2TFLS), we don't
+	 * need to wait for completion before dispatching the job --
+	 * L2T accesses will be stalled until the flush has completed.
+	 */
 	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL,
 		       V3D_L2TCACTL_L2TFLS |
 		       V3D_SET_FIELD(V3D_L2TCACTL_FLM_FLUSH, V3D_L2TCACTL_FLM));
-	if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) &
-		       V3D_L2TCACTL_L2TFLS), 100)) {
-		DRM_ERROR("Timeout waiting for L2T flush\n");
-	}
 }
 
 /* Invalidates the slice caches.  These are read-only caches. */
-- 
GitLab


From f45d756bd701ca9a4dac853f85cf72cbbce213dd Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 3 Dec 2018 14:24:37 -0800
Subject: [PATCH 0581/1835] drm/v3d: Stop trying to flush L2C on V3D 3.3+

This cache was replaced with the slice accessing the L2T in the newer
generations.  Noted by Dave during review.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181203222438.25417-5-eric@anholt.net
Reviewed-by: Dave Emett <david.emett@broadcom.com>
(cherry picked from commit 7b9d2fe4350a9c12f66ad8cc78c1098226f6c3c2)
---
 drivers/gpu/drm/v3d/v3d_gem.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 8c4380ef2b048..15998a77960c5 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -130,10 +130,15 @@ v3d_flush_l3(struct v3d_dev *v3d)
 	}
 }
 
-/* Invalidates the (read-only) L2 cache. */
+/* Invalidates the (read-only) L2C cache.  This was the L2 cache for
+ * uniforms and instructions on V3D 3.2.
+ */
 static void
-v3d_invalidate_l2(struct v3d_dev *v3d, int core)
+v3d_invalidate_l2c(struct v3d_dev *v3d, int core)
 {
+	if (v3d->ver > 32)
+		return;
+
 	V3D_CORE_WRITE(core, V3D_CTL_L2CACTL,
 		       V3D_L2CACTL_L2CCLR |
 		       V3D_L2CACTL_L2CENA);
@@ -168,7 +173,7 @@ v3d_invalidate_caches(struct v3d_dev *v3d)
 {
 	v3d_flush_l3(v3d);
 
-	v3d_invalidate_l2(v3d, 0);
+	v3d_invalidate_l2c(v3d, 0);
 	v3d_invalidate_slices(v3d, 0);
 	v3d_flush_l2t(v3d, 0);
 }
-- 
GitLab


From 0f3d303253879c812646371ff32e634286d56dc2 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 3 Dec 2018 14:24:38 -0800
Subject: [PATCH 0582/1835] drm/v3d: Invalidate the caches from the outside in.

This would be a fairly obscure race, but let's make sure we don't ever
lose it.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181203222438.25417-6-eric@anholt.net
Reviewed-by: Dave Emett <david.emett@broadcom.com>
(cherry picked from commit aa5beec32e8b78bfcf621e3c3daebfb1644b6365)
---
 drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 15998a77960c5..2cef279dc36ad 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -171,11 +171,15 @@ v3d_invalidate_slices(struct v3d_dev *v3d, int core)
 void
 v3d_invalidate_caches(struct v3d_dev *v3d)
 {
+	/* Invalidate the caches from the outside in.  That way if
+	 * another CL's concurrent use of nearby memory were to pull
+	 * an invalidated cacheline back in, we wouldn't leave stale
+	 * data in the inner cache.
+	 */
 	v3d_flush_l3(v3d);
-
 	v3d_invalidate_l2c(v3d, 0);
-	v3d_invalidate_slices(v3d, 0);
 	v3d_flush_l2t(v3d, 0);
+	v3d_invalidate_slices(v3d, 0);
 }
 
 static void
-- 
GitLab


From 179c5bdbc11fd012e766ac71138bd9a794e2bf39 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 7 Feb 2019 15:26:13 -0800
Subject: [PATCH 0583/1835] drm/v3d: Fix BO stats accounting for
 dma-buf-imported buffers.

We always decrement at GEM free, so make sure we increment at GEM
creation for dma-bufs.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20190207232613.24981-1-eric@anholt.net
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
(cherry picked from commit cc3f60cfd4f2752f1bad7eaa3839855c15347abc)
---
 drivers/gpu/drm/v3d/v3d_bo.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_bo.c b/drivers/gpu/drm/v3d/v3d_bo.c
index a08766d39eab5..b1766f096c4bd 100644
--- a/drivers/gpu/drm/v3d/v3d_bo.c
+++ b/drivers/gpu/drm/v3d/v3d_bo.c
@@ -282,6 +282,7 @@ v3d_prime_import_sg_table(struct drm_device *dev,
 			  struct dma_buf_attachment *attach,
 			  struct sg_table *sgt)
 {
+	struct v3d_dev *v3d = to_v3d_dev(dev);
 	struct drm_gem_object *obj;
 	struct v3d_bo *bo;
 
@@ -296,6 +297,11 @@ v3d_prime_import_sg_table(struct drm_device *dev,
 	obj->import_attach = attach;
 	v3d_bo_get_pages(bo);
 
+	mutex_lock(&v3d->bo_lock);
+	v3d->bo_stats.num_allocated++;
+	v3d->bo_stats.pages_allocated += obj->size >> PAGE_SHIFT;
+	mutex_unlock(&v3d->bo_lock);
+
 	v3d_mmu_insert_ptes(bo);
 
 	return obj;
-- 
GitLab


From d367d15e495238b7a2199231ebb187900c1396bd Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 7 Feb 2019 12:09:58 -0800
Subject: [PATCH 0584/1835] drm/v3d: Update top-level kerneldoc for the
 addition of TFU.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20190207201001.5730-1-eric@anholt.net
Reviewed-by: Thomas Spurden <thomas.spurden@broadcom.com>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
(cherry picked from commit fd347df16d4ed2eef565344b8f16a1134bddf185)
---
 drivers/gpu/drm/v3d/v3d_drv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 30ae1c74edaa8..41659f981f444 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -7,9 +7,9 @@
  * This driver supports the Broadcom V3D 3.3 and 4.1 OpenGL ES GPUs.
  * For V3D 2.x support, see the VC4 driver.
  *
- * Currently only single-core rendering using the binner and renderer
- * is supported.  The TFU (texture formatting unit) and V3D 4.x's CSD
- * (compute shader dispatch) are not yet supported.
+ * Currently only single-core rendering using the binner and renderer,
+ * along with TFU (texture formatting unit) rendering is supported.
+ * V3D 4.x's CSD (compute shader dispatch) is not yet supported.
  */
 
 #include <linux/clk.h>
-- 
GitLab


From 00503d7ce8fe07e4971185b4f93a628028eaece3 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 4 Mar 2019 11:59:34 -0800
Subject: [PATCH 0585/1835] drm/vc4: Fix oops at boot with firmwarekms on 4.19.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index f8c6cafff14a0..14ccd676b2e90 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -107,6 +107,9 @@ vc4_ctm_commit(struct vc4_dev *vc4, struct drm_atomic_state *state)
 	struct vc4_ctm_state *ctm_state = to_vc4_ctm_state(vc4->ctm_manager.state);
 	struct drm_color_ctm *ctm = ctm_state->ctm;
 
+	if (vc4->firmware_kms)
+		return;
+
 	if (ctm_state->fifo) {
 		HVS_WRITE(SCALER_OLEDCOEF2,
 			  VC4_SET_FIELD(vc4_ctm_s31_32_to_s0_9(ctm->matrix[0]),
-- 
GitLab


From 5135ce6a4eb3c13c91ce537143696bf732ca94c8 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 20 Feb 2019 13:03:41 -0800
Subject: [PATCH 0586/1835] drm/vc4: Disable V3D interactions if the v3d
 component didn't probe.

One might want to use the VC4 display stack without using Mesa.
Similar to the debugfs fixes for not having all of the possible
display bits enabled, make sure you can't oops in vc4 if v3d isn't
enabled.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_drv.c     | 11 +++++++++++
 drivers/gpu/drm/vc4/vc4_gem.c     | 10 ++++++++++
 drivers/gpu/drm/vc4/vc4_irq.c     |  9 +++++++++
 drivers/gpu/drm/vc4/vc4_perfmon.c | 18 ++++++++++++++++++
 4 files changed, 48 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 5b2f60b0e9048..9f692253ae3de 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -71,6 +71,9 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,
 	if (args->pad != 0)
 		return -EINVAL;
 
+	if (!vc4->v3d)
+		return -EINVAL;
+
 	switch (args->param) {
 	case DRM_VC4_PARAM_V3D_IDENT0:
 		ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
@@ -271,6 +274,7 @@ static int vc4_drm_bind(struct device *dev)
 	struct platform_device *pdev = to_platform_device(dev);
 	struct drm_device *drm;
 	struct vc4_dev *vc4;
+	struct device_node *node;
 	int ret = 0;
 
 	dev->coherent_dma_mask = DMA_BIT_MASK(32);
@@ -279,6 +283,13 @@ static int vc4_drm_bind(struct device *dev)
 	if (!vc4)
 		return -ENOMEM;
 
+	/* If VC4 V3D is missing, don't advertise render nodes. */
+	node = of_find_compatible_node(NULL, NULL, "brcm,bcm2835-v3d");
+	if (node)
+		of_node_put(node);
+	else
+		vc4_drm_driver.driver_features &= ~DRIVER_RENDER;
+
 	drm = drm_dev_alloc(&vc4_drm_driver, dev);
 	if (IS_ERR(drm))
 		return PTR_ERR(drm);
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 928718b467bd2..e174f972beb16 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -74,6 +74,11 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,
 	u32 i;
 	int ret = 0;
 
+	if (!vc4->v3d) {
+		DRM_DEBUG("VC4_GET_HANG_STATE with no VC4 V3D probed\n");
+		return -EINVAL;
+	}
+
 	spin_lock_irqsave(&vc4->job_lock, irqflags);
 	kernel_state = vc4->hang_state;
 	if (!kernel_state) {
@@ -1124,6 +1129,11 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
 	struct dma_fence *in_fence;
 	int ret = 0;
 
+	if (!vc4->v3d) {
+		DRM_DEBUG("VC4_SUBMIT_CL with no VC4 V3D probed\n");
+		return -EINVAL;
+	}
+
 	if ((args->flags & ~(VC4_SUBMIT_CL_USE_CLEAR_COLOR |
 			     VC4_SUBMIT_CL_FIXED_RCL_ORDER |
 			     VC4_SUBMIT_CL_RCL_ORDER_INCREASING_X |
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index 4cd2ccfe15f49..ffd0a4388752e 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -229,6 +229,9 @@ vc4_irq_preinstall(struct drm_device *dev)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 
+	if (!vc4->v3d)
+		return;
+
 	init_waitqueue_head(&vc4->job_wait_queue);
 	INIT_WORK(&vc4->overflow_mem_work, vc4_overflow_mem_work);
 
@@ -243,6 +246,9 @@ vc4_irq_postinstall(struct drm_device *dev)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 
+	if (!vc4->v3d)
+		return 0;
+
 	/* Enable both the render done and out of memory interrupts. */
 	V3D_WRITE(V3D_INTENA, V3D_DRIVER_IRQS);
 
@@ -254,6 +260,9 @@ vc4_irq_uninstall(struct drm_device *dev)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
 
+	if (!vc4->v3d)
+		return;
+
 	/* Disable sending interrupts for our driver's IRQs. */
 	V3D_WRITE(V3D_INTDIS, V3D_DRIVER_IRQS);
 
diff --git a/drivers/gpu/drm/vc4/vc4_perfmon.c b/drivers/gpu/drm/vc4/vc4_perfmon.c
index 437e7a27f21d9..4ef9802df8304 100644
--- a/drivers/gpu/drm/vc4/vc4_perfmon.c
+++ b/drivers/gpu/drm/vc4/vc4_perfmon.c
@@ -100,12 +100,18 @@ void vc4_perfmon_close_file(struct vc4_file *vc4file)
 int vc4_perfmon_create_ioctl(struct drm_device *dev, void *data,
 			     struct drm_file *file_priv)
 {
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_file *vc4file = file_priv->driver_priv;
 	struct drm_vc4_perfmon_create *req = data;
 	struct vc4_perfmon *perfmon;
 	unsigned int i;
 	int ret;
 
+	if (!vc4->v3d) {
+		DRM_DEBUG("Creating perfmon no VC4 V3D probed\n");
+		return -EINVAL;
+	}
+
 	/* Number of monitored counters cannot exceed HW limits. */
 	if (req->ncounters > DRM_VC4_MAX_PERF_COUNTERS ||
 	    !req->ncounters)
@@ -146,10 +152,16 @@ int vc4_perfmon_create_ioctl(struct drm_device *dev, void *data,
 int vc4_perfmon_destroy_ioctl(struct drm_device *dev, void *data,
 			      struct drm_file *file_priv)
 {
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_file *vc4file = file_priv->driver_priv;
 	struct drm_vc4_perfmon_destroy *req = data;
 	struct vc4_perfmon *perfmon;
 
+	if (!vc4->v3d) {
+		DRM_DEBUG("Destroying perfmon no VC4 V3D probed\n");
+		return -EINVAL;
+	}
+
 	mutex_lock(&vc4file->perfmon.lock);
 	perfmon = idr_remove(&vc4file->perfmon.idr, req->id);
 	mutex_unlock(&vc4file->perfmon.lock);
@@ -164,11 +176,17 @@ int vc4_perfmon_destroy_ioctl(struct drm_device *dev, void *data,
 int vc4_perfmon_get_values_ioctl(struct drm_device *dev, void *data,
 				 struct drm_file *file_priv)
 {
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
 	struct vc4_file *vc4file = file_priv->driver_priv;
 	struct drm_vc4_perfmon_get_values *req = data;
 	struct vc4_perfmon *perfmon;
 	int ret;
 
+	if (!vc4->v3d) {
+		DRM_DEBUG("Getting perfmon no VC4 V3D probed\n");
+		return -EINVAL;
+	}
+
 	mutex_lock(&vc4file->perfmon.lock);
 	perfmon = idr_find(&vc4file->perfmon.idr, req->id);
 	vc4_perfmon_get(perfmon);
-- 
GitLab


From a319dc7a8eea4e53cde4f2e8feb85e574aeaf0de Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 4 Oct 2018 17:22:43 -0700
Subject: [PATCH 0587/1835] drm/v3d: Add support for V3D v4.2.

No compatible string for it yet, just the version-dependent changes.
They've now tied the hub and the core interrupt lines into a single
interrupt line coming out of the block.  It also turns out I made a
mistake in modeling the V3D v3.3 and v4.1 bridge as a part of V3D
itself -- the bridge is going away in favor of an external reset
controller in a larger HW module.

v2: Use consistent checks for whether we're on 4.2, and fix a leak in
    an error path.
v3: Use more general means of determining if the current 4.2 changes
    are in place, as apparently other platforms may switch back (noted
    by Dave).  Update the binding doc.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 .../devicetree/bindings/gpu/brcm,bcm-v3d.txt  | 11 ++++--
 drivers/gpu/drm/v3d/v3d_drv.c                 | 21 +++++++++---
 drivers/gpu/drm/v3d/v3d_drv.h                 |  2 ++
 drivers/gpu/drm/v3d/v3d_gem.c                 | 12 ++++++-
 drivers/gpu/drm/v3d/v3d_irq.c                 | 34 ++++++++++++++-----
 5 files changed, 63 insertions(+), 17 deletions(-)

diff --git a/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.txt b/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.txt
index c907aa8dd755e..b2df82b446256 100644
--- a/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.txt
+++ b/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.txt
@@ -6,15 +6,20 @@ For V3D 2.x, see brcm,bcm-vc4.txt.
 Required properties:
 - compatible:	Should be "brcm,7268-v3d" or "brcm,7278-v3d"
 - reg:		Physical base addresses and lengths of the register areas
-- reg-names:	Names for the register areas.  The "hub", "bridge", and "core0"
+- reg-names:	Names for the register areas.  The "hub" and "core0"
 		  register areas are always required.  The "gca" register area
-		  is required if the GCA cache controller is present.
+		  is required if the GCA cache controller is present.  The
+		  "bridge" register area is required if an external reset
+		  controller is not present.
 - interrupts:	The interrupt numbers.  The first interrupt is for the hub,
-		  while the following interrupts are for the cores.
+		  while the following interrupts are separate interrupt lines
+		  for the cores (if they don't share the hub's interrupt).
 		  See bindings/interrupt-controller/interrupts.txt
 
 Optional properties:
 - clocks:	The core clock the unit runs on
+- resets:	The reset line for v3d, if not using a mapping of the bridge
+		  See bindings/reset/reset.txt
 
 v3d {
 	compatible = "brcm,7268-v3d";
diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 41659f981f444..4cf01092936e7 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -19,6 +19,7 @@
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <drm/drm_fb_cma_helper.h>
 #include <drm/drm_fb_helper.h>
 
@@ -265,10 +266,6 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
 	v3d->pdev = pdev;
 	drm = &v3d->drm;
 
-	ret = map_regs(v3d, &v3d->bridge_regs, "bridge");
-	if (ret)
-		goto dev_free;
-
 	ret = map_regs(v3d, &v3d->hub_regs, "hub");
 	if (ret)
 		goto dev_free;
@@ -283,6 +280,22 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
 	v3d->cores = V3D_GET_FIELD(ident1, V3D_HUB_IDENT1_NCORES);
 	WARN_ON(v3d->cores > 1); /* multicore not yet implemented */
 
+	v3d->reset = devm_reset_control_get_exclusive(dev, NULL);
+	if (IS_ERR(v3d->reset)) {
+		ret = PTR_ERR(v3d->reset);
+
+		if (ret == -EPROBE_DEFER)
+			goto dev_free;
+
+		v3d->reset = NULL;
+		ret = map_regs(v3d, &v3d->bridge_regs, "bridge");
+		if (ret) {
+			dev_err(dev,
+				"Failed to get reset control or bridge regs\n");
+			goto dev_free;
+		}
+	}
+
 	if (v3d->ver < 41) {
 		ret = map_regs(v3d, &v3d->gca_regs, "gca");
 		if (ret)
diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 2fdb456b72d32..7952fb99ca01e 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -34,6 +34,7 @@ struct v3d_dev {
 	 * and revision.
 	 */
 	int ver;
+	bool single_irq_line;
 
 	struct device *dev;
 	struct platform_device *pdev;
@@ -42,6 +43,7 @@ struct v3d_dev {
 	void __iomem *bridge_regs;
 	void __iomem *gca_regs;
 	struct clk *clk;
+	struct reset_control *reset;
 
 	/* Virtual and DMA addresses of the single shared page table. */
 	volatile u32 *pt;
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 2cef279dc36ad..e557a7130cae5 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -6,6 +6,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <linux/device.h>
 #include <linux/io.h>
 #include <linux/sched/signal.h>
@@ -69,7 +70,7 @@ v3d_idle_gca(struct v3d_dev *v3d)
 }
 
 static void
-v3d_reset_v3d(struct v3d_dev *v3d)
+v3d_reset_by_bridge(struct v3d_dev *v3d)
 {
 	int version = V3D_BRIDGE_READ(V3D_TOP_GR_BRIDGE_REVISION);
 
@@ -89,6 +90,15 @@ v3d_reset_v3d(struct v3d_dev *v3d)
 				 V3D_TOP_GR_BRIDGE_SW_INIT_1_V3D_CLK_108_SW_INIT);
 		V3D_BRIDGE_WRITE(V3D_TOP_GR_BRIDGE_SW_INIT_1, 0);
 	}
+}
+
+static void
+v3d_reset_v3d(struct v3d_dev *v3d)
+{
+	if (v3d->reset)
+		reset_control_reset(v3d->reset);
+	else
+		v3d_reset_by_bridge(v3d);
 
 	v3d_init_hw_state(v3d);
 }
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index 29d746cfce572..feb086026d9e0 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -27,6 +27,9 @@
 			    V3D_HUB_INT_MMU_CAP |	\
 			    V3D_HUB_INT_TFUC))
 
+static irqreturn_t
+v3d_hub_irq(int irq, void *arg);
+
 static void
 v3d_overflow_mem_work(struct work_struct *work)
 {
@@ -112,6 +115,12 @@ v3d_irq(int irq, void *arg)
 	if (intsts & V3D_INT_GMPV)
 		dev_err(v3d->dev, "GMP violation\n");
 
+	/* V3D 4.2 wires the hub and core IRQs together, so if we &
+	 * didn't see the common one then check hub for MMU IRQs.
+	 */
+	if (v3d->single_irq_line && status == IRQ_NONE)
+		return v3d_hub_irq(irq, arg);
+
 	return status;
 }
 
@@ -170,15 +179,22 @@ v3d_irq_init(struct v3d_dev *v3d)
 		V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS);
 	V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS);
 
-	ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
-			       v3d_hub_irq, IRQF_SHARED,
-			       "v3d_hub", v3d);
-	if (ret)
-		goto fail;
-
-	ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 1),
-			       v3d_irq, IRQF_SHARED,
-			       "v3d_core0", v3d);
+	if (platform_get_irq(v3d->pdev, 1) < 0) {
+		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
+				       v3d_irq, IRQF_SHARED,
+				       "v3d", v3d);
+		v3d->single_irq_line = true;
+	} else {
+		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
+				       v3d_hub_irq, IRQF_SHARED,
+				       "v3d_hub", v3d);
+		if (ret)
+			goto fail;
+
+		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 1),
+				       v3d_irq, IRQF_SHARED,
+				       "v3d_core0", v3d);
+	}
 	if (ret)
 		goto fail;
 
-- 
GitLab


From b9d6a655af87d50562657ea621e7112c88400a3b Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Tue, 16 Oct 2018 10:13:41 -0700
Subject: [PATCH 0588/1835] drm/v3d: Don't try to set OVRTMUOUT on V3D 4.x.

The old field is gone and the register now has a different field,
QRMAXCNT for how many TMU requests get serviced before thread switch.
We were accidentally reducing it from its default of 0x3 (4 requests)
to 0x0 (1).

v2: Skip setting the reg at all on 4.x, instead of trying to update
    only the old field.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_gem.c  | 3 ++-
 drivers/gpu/drm/v3d/v3d_regs.h | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index e557a7130cae5..762b5709fcd42 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -25,7 +25,8 @@ v3d_init_core(struct v3d_dev *v3d, int core)
 	 * type.  If you want the default behavior, you can still put
 	 * "2" in the indirect texture state's output_type field.
 	 */
-	V3D_CORE_WRITE(core, V3D_CTL_MISCCFG, V3D_MISCCFG_OVRTMUOUT);
+	if (v3d->ver < 40)
+		V3D_CORE_WRITE(core, V3D_CTL_MISCCFG, V3D_MISCCFG_OVRTMUOUT);
 
 	/* Whenever we flush the L2T cache, we always want to flush
 	 * the whole thing.
diff --git a/drivers/gpu/drm/v3d/v3d_regs.h b/drivers/gpu/drm/v3d/v3d_regs.h
index 6ccdee9d47bd7..8e88af2376108 100644
--- a/drivers/gpu/drm/v3d/v3d_regs.h
+++ b/drivers/gpu/drm/v3d/v3d_regs.h
@@ -216,6 +216,8 @@
 # define V3D_IDENT2_BCG_INT                            BIT(28)
 
 #define V3D_CTL_MISCCFG                                0x00018
+# define V3D_CTL_MISCCFG_QRMAXCNT_MASK                 V3D_MASK(3, 1)
+# define V3D_CTL_MISCCFG_QRMAXCNT_SHIFT                1
 # define V3D_MISCCFG_OVRTMUOUT                         BIT(0)
 
 #define V3D_CTL_L2CACTL                                0x00020
-- 
GitLab


From 8fec9f0134e40e54ff5b5289c01e564102dd6bee Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 14 Jan 2019 17:26:04 -0800
Subject: [PATCH 0589/1835] drm/v3d: Make sure the GPU is on when measuring
 clocks.

You'll get garbage measurements if the registers always read back
0xdeadbeef

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_debugfs.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
index eb2b2d2f85538..a24af2d2f5748 100644
--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
+++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
@@ -187,6 +187,11 @@ static int v3d_measure_clock(struct seq_file *m, void *unused)
 	uint32_t cycles;
 	int core = 0;
 	int measure_ms = 1000;
+	int ret;
+
+	ret = pm_runtime_get_sync(v3d->dev);
+	if (ret < 0)
+		return ret;
 
 	if (v3d->ver >= 40) {
 		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_SRC_0_3,
@@ -210,6 +215,9 @@ static int v3d_measure_clock(struct seq_file *m, void *unused)
 		   cycles / (measure_ms * 1000),
 		   (cycles / (measure_ms * 100)) % 10);
 
+	pm_runtime_mark_last_busy(v3d->dev);
+	pm_runtime_put_autosuspend(v3d->dev);
+
 	return 0;
 }
 
-- 
GitLab


From df9aee4540b1b81cec1a2f0942aab8b7e0c79c3c Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 4 Oct 2018 17:22:43 -0700
Subject: [PATCH 0590/1835] drm/v3d: Add support for 2711.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 4cf01092936e7..156ba517e6f3b 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -235,6 +235,7 @@ static struct drm_driver v3d_drm_driver = {
 static const struct of_device_id v3d_of_match[] = {
 	{ .compatible = "brcm,7268-v3d" },
 	{ .compatible = "brcm,7278-v3d" },
+	{ .compatible = "brcm,2711-v3d" },
 	{},
 };
 MODULE_DEVICE_TABLE(of, v3d_of_match);
-- 
GitLab


From 1b9ad8d7052a12794d34e49ec9e63e1693498256 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 14 Jan 2019 12:35:43 -0800
Subject: [PATCH 0591/1835] drm/v3d: Skip MMU flush if the device is currently
 off.

If it's off, we know it will be reset on poweron, so the MMU won't
have any TLB cached from before this point.  Avoids failed waits for
MMU flush to reply.

Signed-off-by: Eric Anholt <eric@anholt.net>
(cherry picked from commit 3ee4e2e0a9e9587eacbb69b067bbc72ab2cdc47b)
---
 drivers/gpu/drm/v3d/v3d_mmu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_mmu.c b/drivers/gpu/drm/v3d/v3d_mmu.c
index b00f97c31b70e..796eed177fd9f 100644
--- a/drivers/gpu/drm/v3d/v3d_mmu.c
+++ b/drivers/gpu/drm/v3d/v3d_mmu.c
@@ -18,6 +18,8 @@
  * each client.  This is not yet implemented.
  */
 
+#include <linux/pm_runtime.h>
+
 #include "v3d_drv.h"
 #include "v3d_regs.h"
 
@@ -34,6 +36,14 @@ static int v3d_mmu_flush_all(struct v3d_dev *v3d)
 {
 	int ret;
 
+	/* Keep power on the device on until we're done with this
+	 * call, but skip the flush if the device is off and will be
+	 * reset when powered back on.
+	 */
+	ret = pm_runtime_get_if_in_use(v3d->dev);
+	if (ret == 0)
+		return 0;
+
 	/* Make sure that another flush isn't already running when we
 	 * start this one.
 	 */
@@ -61,6 +71,9 @@ static int v3d_mmu_flush_all(struct v3d_dev *v3d)
 	if (ret)
 		dev_err(v3d->dev, "MMUC flush wait idle failed\n");
 
+	pm_runtime_mark_last_busy(v3d->dev);
+	pm_runtime_put_autosuspend(v3d->dev);
+
 	return ret;
 }
 
-- 
GitLab


From c43662345b49c802eca04703612be431668aa109 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 14 Jan 2019 14:47:57 -0800
Subject: [PATCH 0592/1835] drm/v3d: Hook up the runtime PM ops.

In translating the runtime PM code from vc4, I missed the ".pm"
assignment to actually connect them up.  Fixes missing MMU setup if
runtime PM resets V3D.

Signed-off-by: Eric Anholt <eric@anholt.net>
(cherry picked from commit ca197699af29baa8236c74c53d4904ca8957ee06)
---
 drivers/gpu/drm/v3d/v3d_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 156ba517e6f3b..9838c65bb8ec2 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -66,7 +66,7 @@ static int v3d_runtime_resume(struct device *dev)
 }
 #endif
 
-static const struct dev_pm_ops v3d_v3d_pm_ops = {
+static const struct dev_pm_ops v3d_pm_ops = {
 	SET_RUNTIME_PM_OPS(v3d_runtime_suspend, v3d_runtime_resume, NULL)
 };
 
@@ -371,6 +371,7 @@ static struct platform_driver v3d_platform_driver = {
 	.driver		= {
 		.name	= "v3d",
 		.of_match_table = v3d_of_match,
+		.pm = &v3d_pm_ops,
 	},
 };
 
-- 
GitLab


From ff042fa1445df8b3879aec847120abb443625d05 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 14 Jan 2019 15:13:17 -0800
Subject: [PATCH 0593/1835] drm/v3d: HACK: gut runtime pm for now.

Something is still unstable -- on starting a new glxgears from an idle
X11, I get an MMU violation in high addresses.  The CTS also failed
quite quickly.  With this, CTS progresses for an hour before OOMing
(allocating some big buffers when my board only has 600MB available to
Linux)

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_debugfs.c | 16 +---------------
 drivers/gpu/drm/v3d/v3d_drv.c     |  7 -------
 drivers/gpu/drm/v3d/v3d_gem.c     | 20 --------------------
 3 files changed, 1 insertion(+), 42 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
index a24af2d2f5748..b15051df2dbbc 100644
--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
+++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
@@ -4,7 +4,6 @@
 #include <linux/circ_buf.h>
 #include <linux/ctype.h>
 #include <linux/debugfs.h>
-#include <linux/pm_runtime.h>
 #include <linux/seq_file.h>
 #include <drm/drmP.h>
 
@@ -100,11 +99,8 @@ static int v3d_v3d_debugfs_ident(struct seq_file *m, void *unused)
 	struct drm_device *dev = node->minor->dev;
 	struct v3d_dev *v3d = to_v3d_dev(dev);
 	u32 ident0, ident1, ident2, ident3, cores;
-	int ret, core;
+	int core;
 
-	ret = pm_runtime_get_sync(v3d->dev);
-	if (ret < 0)
-		return ret;
 
 	ident0 = V3D_READ(V3D_HUB_IDENT0);
 	ident1 = V3D_READ(V3D_HUB_IDENT1);
@@ -157,9 +153,6 @@ static int v3d_v3d_debugfs_ident(struct seq_file *m, void *unused)
 			   (misccfg & V3D_MISCCFG_OVRTMUOUT) != 0);
 	}
 
-	pm_runtime_mark_last_busy(v3d->dev);
-	pm_runtime_put_autosuspend(v3d->dev);
-
 	return 0;
 }
 
@@ -187,11 +180,6 @@ static int v3d_measure_clock(struct seq_file *m, void *unused)
 	uint32_t cycles;
 	int core = 0;
 	int measure_ms = 1000;
-	int ret;
-
-	ret = pm_runtime_get_sync(v3d->dev);
-	if (ret < 0)
-		return ret;
 
 	if (v3d->ver >= 40) {
 		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_SRC_0_3,
@@ -215,8 +203,6 @@ static int v3d_measure_clock(struct seq_file *m, void *unused)
 		   cycles / (measure_ms * 1000),
 		   (cycles / (measure_ms * 100)) % 10);
 
-	pm_runtime_mark_last_busy(v3d->dev);
-	pm_runtime_put_autosuspend(v3d->dev);
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 9838c65bb8ec2..1f2c3555c0387 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -75,7 +75,6 @@ static int v3d_get_param_ioctl(struct drm_device *dev, void *data,
 {
 	struct v3d_dev *v3d = to_v3d_dev(dev);
 	struct drm_v3d_get_param *args = data;
-	int ret;
 	static const u32 reg_map[] = {
 		[DRM_V3D_PARAM_V3D_UIFCFG] = V3D_HUB_UIFCFG,
 		[DRM_V3D_PARAM_V3D_HUB_IDENT1] = V3D_HUB_IDENT1,
@@ -101,15 +100,12 @@ static int v3d_get_param_ioctl(struct drm_device *dev, void *data,
 		if (args->value != 0)
 			return -EINVAL;
 
-		ret = pm_runtime_get_sync(v3d->dev);
 		if (args->param >= DRM_V3D_PARAM_V3D_CORE0_IDENT0 &&
 		    args->param <= DRM_V3D_PARAM_V3D_CORE0_IDENT2) {
 			args->value = V3D_CORE_READ(0, offset);
 		} else {
 			args->value = V3D_READ(offset);
 		}
-		pm_runtime_mark_last_busy(v3d->dev);
-		pm_runtime_put_autosuspend(v3d->dev);
 		return 0;
 	}
 
@@ -311,9 +307,6 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
 		goto dev_free;
 	}
 
-	pm_runtime_use_autosuspend(dev);
-	pm_runtime_set_autosuspend_delay(dev, 50);
-	pm_runtime_enable(dev);
 
 	ret = drm_dev_init(&v3d->drm, &v3d_drm_driver, dev);
 	if (ret)
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 762b5709fcd42..341411e2e2920 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -375,7 +375,6 @@ v3d_exec_cleanup(struct kref *ref)
 {
 	struct v3d_exec_info *exec = container_of(ref, struct v3d_exec_info,
 						  refcount);
-	struct v3d_dev *v3d = exec->v3d;
 	unsigned int i;
 	struct v3d_bo *bo, *save;
 
@@ -396,9 +395,6 @@ v3d_exec_cleanup(struct kref *ref)
 		drm_gem_object_put_unlocked(&bo->base);
 	}
 
-	pm_runtime_mark_last_busy(v3d->dev);
-	pm_runtime_put_autosuspend(v3d->dev);
-
 	kfree(exec);
 }
 
@@ -412,7 +408,6 @@ v3d_tfu_job_cleanup(struct kref *ref)
 {
 	struct v3d_tfu_job *job = container_of(ref, struct v3d_tfu_job,
 					       refcount);
-	struct v3d_dev *v3d = job->v3d;
 	unsigned int i;
 
 	dma_fence_put(job->in_fence);
@@ -423,9 +418,6 @@ v3d_tfu_job_cleanup(struct kref *ref)
 			drm_gem_object_put_unlocked(&job->bo[i]->base);
 	}
 
-	pm_runtime_mark_last_busy(v3d->dev);
-	pm_runtime_put_autosuspend(v3d->dev);
-
 	kfree(job);
 }
 
@@ -519,12 +511,6 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (!exec)
 		return -ENOMEM;
 
-	ret = pm_runtime_get_sync(v3d->dev);
-	if (ret < 0) {
-		kfree(exec);
-		return ret;
-	}
-
 	kref_init(&exec->refcount);
 
 	ret = drm_syncobj_find_fence(file_priv, args->in_sync_bcl,
@@ -643,12 +629,6 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 	if (!job)
 		return -ENOMEM;
 
-	ret = pm_runtime_get_sync(v3d->dev);
-	if (ret < 0) {
-		kfree(job);
-		return ret;
-	}
-
 	kref_init(&job->refcount);
 
 	ret = drm_syncobj_find_fence(file_priv, args->in_sync,
-- 
GitLab


From d8d63e3c15e68224bedddd1ff8dcf702cadc89b0 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Tue, 12 Mar 2019 09:08:10 -0700
Subject: [PATCH 0594/1835] drm/v3d: Update to upstream IRQ code.

---
 drivers/gpu/drm/v3d/v3d_irq.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index feb086026d9e0..b8aea2dfbe82d 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -168,7 +168,7 @@ v3d_hub_irq(int irq, void *arg)
 int
 v3d_irq_init(struct v3d_dev *v3d)
 {
-	int ret, core;
+	int irq1, ret, core;
 
 	INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work);
 
@@ -179,24 +179,29 @@ v3d_irq_init(struct v3d_dev *v3d)
 		V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS);
 	V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS);
 
-	if (platform_get_irq(v3d->pdev, 1) < 0) {
-		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
+	irq1 = platform_get_irq(v3d->pdev, 1);
+	if (irq1 == -EPROBE_DEFER)
+		return irq1;
+	if (irq1 > 0) {
+		ret = devm_request_irq(v3d->dev, irq1,
 				       v3d_irq, IRQF_SHARED,
-				       "v3d", v3d);
-		v3d->single_irq_line = true;
-	} else {
+				       "v3d_core0", v3d);
+		if (ret)
+			goto fail;
 		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
 				       v3d_hub_irq, IRQF_SHARED,
 				       "v3d_hub", v3d);
 		if (ret)
 			goto fail;
+	} else {
+		v3d->single_irq_line = true;
 
-		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 1),
+		ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
 				       v3d_irq, IRQF_SHARED,
-				       "v3d_core0", v3d);
+				       "v3d", v3d);
+		if (ret)
+			goto fail;
 	}
-	if (ret)
-		goto fail;
 
 	v3d_irq_enable(v3d);
 	return 0;
-- 
GitLab


From 429d3726086f32d483fe7b575b476fea7b985a6b Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 27 Dec 2018 14:04:44 -0800
Subject: [PATCH 0595/1835] drm/v3d: Rename the fence signaled from IRQs to
 "irq_fence".

We have another thing called the "done fence" that tracks when the
scheduler considers the job done, and having the shared name was
confusing.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_drv.h   |  4 ++--
 drivers/gpu/drm/v3d/v3d_gem.c   |  6 +++---
 drivers/gpu/drm/v3d/v3d_irq.c   |  6 +++---
 drivers/gpu/drm/v3d/v3d_sched.c | 12 ++++++------
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 7952fb99ca01e..ee51a13c7f9af 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -182,7 +182,7 @@ struct v3d_job {
 	struct dma_fence *in_fence;
 
 	/* v3d fence to be signaled by IRQ handler when the job is complete. */
-	struct dma_fence *done_fence;
+	struct dma_fence *irq_fence;
 
 	/* GPU virtual addresses of the start/end of the CL job. */
 	u32 start, end;
@@ -229,7 +229,7 @@ struct v3d_tfu_job {
 	struct dma_fence *in_fence;
 
 	/* v3d fence to be signaled by IRQ handler when the job is complete. */
-	struct dma_fence *done_fence;
+	struct dma_fence *irq_fence;
 
 	struct v3d_dev *v3d;
 
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 341411e2e2920..2e920e4cad0fa 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -381,8 +381,8 @@ v3d_exec_cleanup(struct kref *ref)
 	dma_fence_put(exec->bin.in_fence);
 	dma_fence_put(exec->render.in_fence);
 
-	dma_fence_put(exec->bin.done_fence);
-	dma_fence_put(exec->render.done_fence);
+	dma_fence_put(exec->bin.irq_fence);
+	dma_fence_put(exec->render.irq_fence);
 
 	dma_fence_put(exec->bin_done_fence);
 	dma_fence_put(exec->render_done_fence);
@@ -411,7 +411,7 @@ v3d_tfu_job_cleanup(struct kref *ref)
 	unsigned int i;
 
 	dma_fence_put(job->in_fence);
-	dma_fence_put(job->done_fence);
+	dma_fence_put(job->irq_fence);
 
 	for (i = 0; i < ARRAY_SIZE(job->bo); i++) {
 		if (job->bo[i])
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index b8aea2dfbe82d..791a4c20a959e 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -93,7 +93,7 @@ v3d_irq(int irq, void *arg)
 
 	if (intsts & V3D_INT_FLDONE) {
 		struct v3d_fence *fence =
-			to_v3d_fence(v3d->bin_job->bin.done_fence);
+			to_v3d_fence(v3d->bin_job->bin.irq_fence);
 
 		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
 		dma_fence_signal(&fence->base);
@@ -102,7 +102,7 @@ v3d_irq(int irq, void *arg)
 
 	if (intsts & V3D_INT_FRDONE) {
 		struct v3d_fence *fence =
-			to_v3d_fence(v3d->render_job->render.done_fence);
+			to_v3d_fence(v3d->render_job->render.irq_fence);
 
 		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
 		dma_fence_signal(&fence->base);
@@ -138,7 +138,7 @@ v3d_hub_irq(int irq, void *arg)
 
 	if (intsts & V3D_HUB_INT_TFUC) {
 		struct v3d_fence *fence =
-			to_v3d_fence(v3d->tfu_job->done_fence);
+			to_v3d_fence(v3d->tfu_job->irq_fence);
 
 		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
 		dma_fence_signal(&fence->base);
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index 2ab1bbdb100a9..3827f7f291aaf 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -152,9 +152,9 @@ static struct dma_fence *v3d_job_run(struct drm_sched_job *sched_job)
 	if (IS_ERR(fence))
 		return NULL;
 
-	if (job->done_fence)
-		dma_fence_put(job->done_fence);
-	job->done_fence = dma_fence_get(fence);
+	if (job->irq_fence)
+		dma_fence_put(job->irq_fence);
+	job->irq_fence = dma_fence_get(fence);
 
 	trace_v3d_submit_cl(dev, q == V3D_RENDER, to_v3d_fence(fence)->seqno,
 			    job->start, job->end);
@@ -195,9 +195,9 @@ v3d_tfu_job_run(struct drm_sched_job *sched_job)
 		return NULL;
 
 	v3d->tfu_job = job;
-	if (job->done_fence)
-		dma_fence_put(job->done_fence);
-	job->done_fence = dma_fence_get(fence);
+	if (job->irq_fence)
+		dma_fence_put(job->irq_fence);
+	job->irq_fence = dma_fence_get(fence);
 
 	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
 
-- 
GitLab


From 55004640a096e242f60f7861c370ad0924829a21 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 27 Dec 2018 12:11:52 -0800
Subject: [PATCH 0596/1835] drm/v3d: Refactor job management.

The CL submission had two jobs embedded in an exec struct.  When I
added TFU support, I had to replicate some of the exec stuff and some
of the job stuff.  As I went to add CSD, it became clear that actually
what was in exec should just be in the two CL jobs, and it would let
us share a lot more code between the 4 queues.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_drv.h   |  77 ++++----
 drivers/gpu/drm/v3d/v3d_gem.c   | 331 +++++++++++++++++---------------
 drivers/gpu/drm/v3d/v3d_irq.c   |   8 +-
 drivers/gpu/drm/v3d/v3d_sched.c | 264 ++++++++++++++-----------
 4 files changed, 373 insertions(+), 307 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index ee51a13c7f9af..6ecd25631094d 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -67,8 +67,8 @@ struct v3d_dev {
 
 	struct work_struct overflow_mem_work;
 
-	struct v3d_exec_info *bin_job;
-	struct v3d_exec_info *render_job;
+	struct v3d_bin_job *bin_job;
+	struct v3d_render_job *render_job;
 	struct v3d_tfu_job *tfu_job;
 
 	struct v3d_queue_state queue[V3D_MAX_QUEUES];
@@ -132,7 +132,7 @@ struct v3d_bo {
 	struct list_head vmas;    /* list of v3d_vma */
 
 	/* List entry for the BO's position in
-	 * v3d_exec_info->unref_list
+	 * v3d_render_job->unref_list
 	 */
 	struct list_head unref_head;
 
@@ -176,7 +176,15 @@ to_v3d_fence(struct dma_fence *fence)
 struct v3d_job {
 	struct drm_sched_job base;
 
-	struct v3d_exec_info *exec;
+	struct kref refcount;
+
+	struct v3d_dev *v3d;
+
+	/* This is the array of BOs that were looked up at the start
+	 * of submission.
+	 */
+	struct v3d_bo **bo;
+	u32 bo_count;
 
 	/* An optional fence userspace can pass in for the job to depend on. */
 	struct dma_fence *in_fence;
@@ -184,59 +192,53 @@ struct v3d_job {
 	/* v3d fence to be signaled by IRQ handler when the job is complete. */
 	struct dma_fence *irq_fence;
 
+	/* scheduler fence for when the job is considered complete and
+	 * the BO reservations can be released.
+	 */
+	struct dma_fence *done_fence;
+
+	/* Callback for the freeing of the job on refcount going to 0. */
+	void (*free)(struct kref *ref);
+};
+
+struct v3d_bin_job {
+	struct v3d_job base;
+
 	/* GPU virtual addresses of the start/end of the CL job. */
 	u32 start, end;
 
 	u32 timedout_ctca, timedout_ctra;
-};
 
-struct v3d_exec_info {
-	struct v3d_dev *v3d;
+	/* Corresponding render job, for attaching our overflow memory. */
+	struct v3d_render_job *render;
+
+	/* Submitted tile memory allocation start/size, tile state. */
+	u32 qma, qms, qts;
+};
 
-	struct v3d_job bin, render;
+struct v3d_render_job {
+	struct v3d_job base;
 
-	/* Fence for when the scheduler considers the binner to be
-	 * done, for render to depend on.
+	/* Optional fence for the binner, to depend on before starting
+	 * our job.
 	 */
 	struct dma_fence *bin_done_fence;
 
-	/* Fence for when the scheduler considers the render to be
-	 * done, for when the BOs reservations should be complete.
-	 */
-	struct dma_fence *render_done_fence;
-
-	struct kref refcount;
+	/* GPU virtual addresses of the start/end of the CL job. */
+	u32 start, end;
 
-	/* This is the array of BOs that were looked up at the start of exec. */
-	struct v3d_bo **bo;
-	u32 bo_count;
+	u32 timedout_ctca, timedout_ctra;
 
 	/* List of overflow BOs used in the job that need to be
 	 * released once the job is complete.
 	 */
 	struct list_head unref_list;
-
-	/* Submitted tile memory allocation start/size, tile state. */
-	u32 qma, qms, qts;
 };
 
 struct v3d_tfu_job {
-	struct drm_sched_job base;
+	struct v3d_job base;
 
 	struct drm_v3d_submit_tfu args;
-
-	/* An optional fence userspace can pass in for the job to depend on. */
-	struct dma_fence *in_fence;
-
-	/* v3d fence to be signaled by IRQ handler when the job is complete. */
-	struct dma_fence *irq_fence;
-
-	struct v3d_dev *v3d;
-
-	struct kref refcount;
-
-	/* This is the array of BOs that were looked up at the start of exec. */
-	struct v3d_bo *bo[4];
 };
 
 /**
@@ -306,8 +308,7 @@ int v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 			 struct drm_file *file_priv);
 int v3d_wait_bo_ioctl(struct drm_device *dev, void *data,
 		      struct drm_file *file_priv);
-void v3d_exec_put(struct v3d_exec_info *exec);
-void v3d_tfu_job_put(struct v3d_tfu_job *exec);
+void v3d_job_put(struct v3d_job *job);
 void v3d_reset(struct v3d_dev *v3d);
 void v3d_invalidate_caches(struct v3d_dev *v3d);
 
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 2e920e4cad0fa..9a3930696c7e4 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -293,11 +293,11 @@ retry:
 }
 
 /**
- * v3d_cl_lookup_bos() - Sets up exec->bo[] with the GEM objects
+ * v3d_lookup_bos() - Sets up job->bo[] with the GEM objects
  * referenced by the job.
  * @dev: DRM device
  * @file_priv: DRM file for this fd
- * @exec: V3D job being set up
+ * @job: V3D job being set up
  *
  * The command validator needs to reference BOs by their index within
  * the submitted job's BO list.  This does the validation of the job's
@@ -307,18 +307,19 @@ retry:
  * failure, because that will happen at v3d_exec_cleanup() time.
  */
 static int
-v3d_cl_lookup_bos(struct drm_device *dev,
-		  struct drm_file *file_priv,
-		  struct drm_v3d_submit_cl *args,
-		  struct v3d_exec_info *exec)
+v3d_lookup_bos(struct drm_device *dev,
+	       struct drm_file *file_priv,
+	       struct v3d_job *job,
+	       u64 bo_handles,
+	       u32 bo_count)
 {
 	u32 *handles;
 	int ret = 0;
 	int i;
 
-	exec->bo_count = args->bo_handle_count;
+	job->bo_count = bo_count;
 
-	if (!exec->bo_count) {
+	if (!job->bo_count) {
 		/* See comment on bo_index for why we have to check
 		 * this.
 		 */
@@ -326,15 +327,15 @@ v3d_cl_lookup_bos(struct drm_device *dev,
 		return -EINVAL;
 	}
 
-	exec->bo = kvmalloc_array(exec->bo_count,
-				  sizeof(struct drm_gem_cma_object *),
-				  GFP_KERNEL | __GFP_ZERO);
-	if (!exec->bo) {
+	job->bo = kvmalloc_array(job->bo_count,
+				 sizeof(struct drm_gem_cma_object *),
+				 GFP_KERNEL | __GFP_ZERO);
+	if (!job->bo) {
 		DRM_DEBUG("Failed to allocate validated BO pointers\n");
 		return -ENOMEM;
 	}
 
-	handles = kvmalloc_array(exec->bo_count, sizeof(u32), GFP_KERNEL);
+	handles = kvmalloc_array(job->bo_count, sizeof(u32), GFP_KERNEL);
 	if (!handles) {
 		ret = -ENOMEM;
 		DRM_DEBUG("Failed to allocate incoming GEM handles\n");
@@ -342,15 +343,15 @@ v3d_cl_lookup_bos(struct drm_device *dev,
 	}
 
 	if (copy_from_user(handles,
-			   (void __user *)(uintptr_t)args->bo_handles,
-			   exec->bo_count * sizeof(u32))) {
+			   (void __user *)(uintptr_t)bo_handles,
+			   job->bo_count * sizeof(u32))) {
 		ret = -EFAULT;
 		DRM_DEBUG("Failed to copy in GEM handles\n");
 		goto fail;
 	}
 
 	spin_lock(&file_priv->table_lock);
-	for (i = 0; i < exec->bo_count; i++) {
+	for (i = 0; i < job->bo_count; i++) {
 		struct drm_gem_object *bo = idr_find(&file_priv->object_idr,
 						     handles[i]);
 		if (!bo) {
@@ -361,7 +362,7 @@ v3d_cl_lookup_bos(struct drm_device *dev,
 			goto fail;
 		}
 		drm_gem_object_get(bo);
-		exec->bo[i] = to_v3d_bo(bo);
+		job->bo[i] = to_v3d_bo(bo);
 	}
 	spin_unlock(&file_priv->table_lock);
 
@@ -371,59 +372,41 @@ fail:
 }
 
 static void
-v3d_exec_cleanup(struct kref *ref)
+v3d_job_free(struct kref *ref)
 {
-	struct v3d_exec_info *exec = container_of(ref, struct v3d_exec_info,
-						  refcount);
-	unsigned int i;
-	struct v3d_bo *bo, *save;
-
-	dma_fence_put(exec->bin.in_fence);
-	dma_fence_put(exec->render.in_fence);
-
-	dma_fence_put(exec->bin.irq_fence);
-	dma_fence_put(exec->render.irq_fence);
-
-	dma_fence_put(exec->bin_done_fence);
-	dma_fence_put(exec->render_done_fence);
-
-	for (i = 0; i < exec->bo_count; i++)
-		drm_gem_object_put_unlocked(&exec->bo[i]->base);
-	kvfree(exec->bo);
+	struct v3d_job *job = container_of(ref, struct v3d_job, refcount);
+	int i;
 
-	list_for_each_entry_safe(bo, save, &exec->unref_list, unref_head) {
-		drm_gem_object_put_unlocked(&bo->base);
+	for (i = 0; i < job->bo_count; i++) {
+		if (job->bo[i])
+			drm_gem_object_put_unlocked(&job->bo[i]->base);
 	}
+	kvfree(job->bo);
 
-	kfree(exec);
-}
+	dma_fence_put(job->in_fence);
+	dma_fence_put(job->irq_fence);
+	dma_fence_put(job->done_fence);
 
-void v3d_exec_put(struct v3d_exec_info *exec)
-{
-	kref_put(&exec->refcount, v3d_exec_cleanup);
+	kfree(job);
 }
 
 static void
-v3d_tfu_job_cleanup(struct kref *ref)
+v3d_render_job_free(struct kref *ref)
 {
-	struct v3d_tfu_job *job = container_of(ref, struct v3d_tfu_job,
-					       refcount);
-	unsigned int i;
-
-	dma_fence_put(job->in_fence);
-	dma_fence_put(job->irq_fence);
+	struct v3d_render_job *job = container_of(ref, struct v3d_render_job,
+						  base.refcount);
+	struct v3d_bo *bo, *save;
 
-	for (i = 0; i < ARRAY_SIZE(job->bo); i++) {
-		if (job->bo[i])
-			drm_gem_object_put_unlocked(&job->bo[i]->base);
+	list_for_each_entry_safe(bo, save, &job->unref_list, unref_head) {
+		drm_gem_object_put_unlocked(&bo->base);
 	}
 
-	kfree(job);
+	v3d_job_free(ref);
 }
 
-void v3d_tfu_job_put(struct v3d_tfu_job *job)
+void v3d_job_put(struct v3d_job *job)
 {
-	kref_put(&job->refcount, v3d_tfu_job_cleanup);
+	kref_put(&job->refcount, job->free);
 }
 
 int
@@ -476,6 +459,65 @@ v3d_wait_bo_ioctl(struct drm_device *dev, void *data,
 	return ret;
 }
 
+static int
+v3d_job_init(struct v3d_dev *v3d, struct drm_file *file_priv,
+	     struct v3d_job *job, void (*free)(struct kref *ref),
+	     u32 in_sync)
+{
+	int ret;
+
+	job->v3d = v3d;
+	job->free = free;
+
+	ret = drm_syncobj_find_fence(file_priv, in_sync, 0, &job->in_fence);
+	if (ret == -EINVAL)
+		return ret;
+
+	kref_init(&job->refcount);
+
+	return 0;
+}
+
+static int
+v3d_push_job(struct v3d_file_priv *v3d_priv,
+	     struct v3d_job *job, enum v3d_queue queue)
+{
+	int ret;
+
+	ret = drm_sched_job_init(&job->base, &v3d_priv->sched_entity[queue],
+				 v3d_priv);
+	if (ret)
+		return ret;
+
+	job->done_fence = dma_fence_get(&job->base.s_fence->finished);
+
+	/* put by scheduler job completion */
+	kref_get(&job->refcount);
+
+	drm_sched_entity_push_job(&job->base, &v3d_priv->sched_entity[queue]);
+
+	return 0;
+}
+
+static void
+v3d_attach_fences_and_unlock_reservation(struct drm_file *file_priv,
+					 struct v3d_job *job,
+					 struct ww_acquire_ctx *acquire_ctx,
+					 u32 out_sync)
+{
+	struct drm_syncobj *sync_out;
+
+	v3d_attach_object_fences(job->bo, job->bo_count, job->done_fence);
+	v3d_unlock_bo_reservations(job->bo, job->bo_count, acquire_ctx);
+
+	/* Update the return sync object for the job */
+	sync_out = drm_syncobj_find(file_priv, out_sync);
+	if (sync_out) {
+		drm_syncobj_replace_fence(sync_out, job->done_fence);
+		drm_syncobj_put(sync_out);
+	}
+}
+
 /**
  * v3d_submit_cl_ioctl() - Submits a job (frame) to the V3D.
  * @dev: DRM device
@@ -495,9 +537,9 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	struct v3d_dev *v3d = to_v3d_dev(dev);
 	struct v3d_file_priv *v3d_priv = file_priv->driver_priv;
 	struct drm_v3d_submit_cl *args = data;
-	struct v3d_exec_info *exec;
+	struct v3d_bin_job *bin = NULL;
+	struct v3d_render_job *render;
 	struct ww_acquire_ctx acquire_ctx;
-	struct drm_syncobj *sync_out;
 	int ret = 0;
 
 	trace_v3d_submit_cl_ioctl(&v3d->drm, args->rcl_start, args->rcl_end);
@@ -507,95 +549,84 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 		return -EINVAL;
 	}
 
-	exec = kcalloc(1, sizeof(*exec), GFP_KERNEL);
-	if (!exec)
+	render = kcalloc(1, sizeof(*render), GFP_KERNEL);
+	if (!render)
 		return -ENOMEM;
 
-	kref_init(&exec->refcount);
+	render->start = args->rcl_start;
+	render->end = args->rcl_end;
+	INIT_LIST_HEAD(&render->unref_list);
 
-	ret = drm_syncobj_find_fence(file_priv, args->in_sync_bcl,
-				     0, &exec->bin.in_fence);
-	if (ret == -EINVAL)
-		goto fail;
+	ret = v3d_job_init(v3d, file_priv, &render->base,
+			   v3d_render_job_free, args->in_sync_rcl);
+	if (ret) {
+		kfree(bin);
+		kfree(render);
+		return ret;
+	}
 
-	ret = drm_syncobj_find_fence(file_priv, args->in_sync_rcl,
-				     0, &exec->render.in_fence);
-	if (ret == -EINVAL)
-		goto fail;
+	if (args->bcl_start != args->bcl_end) {
+		bin = kcalloc(1, sizeof(*bin), GFP_KERNEL);
+		if (!bin)
+			return -ENOMEM;
+
+		ret = v3d_job_init(v3d, file_priv, &bin->base,
+				   v3d_job_free, args->in_sync_bcl);
+		if (ret) {
+			v3d_job_put(&render->base);
+			return ret;
+		}
+
+		bin->start = args->bcl_start;
+		bin->end = args->bcl_end;
+		bin->qma = args->qma;
+		bin->qms = args->qms;
+		bin->qts = args->qts;
+		bin->render = render;
+	}
 
-	exec->qma = args->qma;
-	exec->qms = args->qms;
-	exec->qts = args->qts;
-	exec->bin.exec = exec;
-	exec->bin.start = args->bcl_start;
-	exec->bin.end = args->bcl_end;
-	exec->render.exec = exec;
-	exec->render.start = args->rcl_start;
-	exec->render.end = args->rcl_end;
-	exec->v3d = v3d;
-	INIT_LIST_HEAD(&exec->unref_list);
-
-	ret = v3d_cl_lookup_bos(dev, file_priv, args, exec);
+	ret = v3d_lookup_bos(dev, file_priv, &render->base,
+			     args->bo_handles, args->bo_handle_count);
 	if (ret)
 		goto fail;
 
-	ret = v3d_lock_bo_reservations(exec->bo, exec->bo_count,
+	ret = v3d_lock_bo_reservations(render->base.bo, render->base.bo_count,
 				       &acquire_ctx);
 	if (ret)
 		goto fail;
 
 	mutex_lock(&v3d->sched_lock);
-	if (exec->bin.start != exec->bin.end) {
-		ret = drm_sched_job_init(&exec->bin.base,
-					 &v3d_priv->sched_entity[V3D_BIN],
-					 v3d_priv);
+	if (bin) {
+		ret = v3d_push_job(v3d_priv, &bin->base, V3D_BIN);
 		if (ret)
 			goto fail_unreserve;
 
-		exec->bin_done_fence =
-			dma_fence_get(&exec->bin.base.s_fence->finished);
-
-		kref_get(&exec->refcount); /* put by scheduler job completion */
-		drm_sched_entity_push_job(&exec->bin.base,
-					  &v3d_priv->sched_entity[V3D_BIN]);
+		render->bin_done_fence = dma_fence_get(bin->base.done_fence);
 	}
 
-	ret = drm_sched_job_init(&exec->render.base,
-				 &v3d_priv->sched_entity[V3D_RENDER],
-				 v3d_priv);
+	ret = v3d_push_job(v3d_priv, &render->base, V3D_RENDER);
 	if (ret)
 		goto fail_unreserve;
-
-	exec->render_done_fence =
-		dma_fence_get(&exec->render.base.s_fence->finished);
-
-	kref_get(&exec->refcount); /* put by scheduler job completion */
-	drm_sched_entity_push_job(&exec->render.base,
-				  &v3d_priv->sched_entity[V3D_RENDER]);
 	mutex_unlock(&v3d->sched_lock);
 
-	v3d_attach_object_fences(exec->bo, exec->bo_count,
-				 exec->render_done_fence);
-
-	v3d_unlock_bo_reservations(exec->bo, exec->bo_count, &acquire_ctx);
-
-	/* Update the return sync object for the */
-	sync_out = drm_syncobj_find(file_priv, args->out_sync);
-	if (sync_out) {
-		drm_syncobj_replace_fence(sync_out,
-					  exec->render_done_fence);
-		drm_syncobj_put(sync_out);
-	}
+	v3d_attach_fences_and_unlock_reservation(file_priv,
+						 &render->base, &acquire_ctx,
+						 args->out_sync);
 
-	v3d_exec_put(exec);
+	if (bin)
+		v3d_job_put(&bin->base);
+	v3d_job_put(&render->base);
 
 	return 0;
 
 fail_unreserve:
 	mutex_unlock(&v3d->sched_lock);
-	v3d_unlock_bo_reservations(exec->bo, exec->bo_count, &acquire_ctx);
+	v3d_unlock_bo_reservations(render->base.bo,
+				   render->base.bo_count, &acquire_ctx);
 fail:
-	v3d_exec_put(exec);
+	if (bin)
+		v3d_job_put(&bin->base);
+	v3d_job_put(&render->base);
 
 	return ret;
 }
@@ -618,10 +649,7 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 	struct drm_v3d_submit_tfu *args = data;
 	struct v3d_tfu_job *job;
 	struct ww_acquire_ctx acquire_ctx;
-	struct drm_syncobj *sync_out;
-	struct dma_fence *sched_done_fence;
 	int ret = 0;
-	int bo_count;
 
 	trace_v3d_submit_tfu_ioctl(&v3d->drm, args->iia);
 
@@ -629,75 +657,66 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 	if (!job)
 		return -ENOMEM;
 
-	kref_init(&job->refcount);
-
-	ret = drm_syncobj_find_fence(file_priv, args->in_sync,
-				     0, &job->in_fence);
-	if (ret == -EINVAL)
-		goto fail;
+	ret = v3d_job_init(v3d, file_priv, &job->base,
+			   v3d_job_free, args->in_sync);
+	if (ret) {
+		kfree(job);
+		return ret;
+	}
 
+	job->base.bo = kcalloc(ARRAY_SIZE(args->bo_handles),
+			       sizeof(*job->base.bo), GFP_KERNEL);
 	job->args = *args;
-	job->v3d = v3d;
 
 	spin_lock(&file_priv->table_lock);
-	for (bo_count = 0; bo_count < ARRAY_SIZE(job->bo); bo_count++) {
+	for (job->base.bo_count = 0;
+	     job->base.bo_count < ARRAY_SIZE(args->bo_handles);
+	     job->base.bo_count++) {
 		struct drm_gem_object *bo;
 
-		if (!args->bo_handles[bo_count])
+		if (!args->bo_handles[job->base.bo_count])
 			break;
 
 		bo = idr_find(&file_priv->object_idr,
-			      args->bo_handles[bo_count]);
+			      args->bo_handles[job->base.bo_count]);
 		if (!bo) {
 			DRM_DEBUG("Failed to look up GEM BO %d: %d\n",
-				  bo_count, args->bo_handles[bo_count]);
+				  job->base.bo_count,
+				  args->bo_handles[job->base.bo_count]);
 			ret = -ENOENT;
 			spin_unlock(&file_priv->table_lock);
 			goto fail;
 		}
 		drm_gem_object_get(bo);
-		job->bo[bo_count] = to_v3d_bo(bo);
+		job->base.bo[job->base.bo_count] = to_v3d_bo(bo);
 	}
 	spin_unlock(&file_priv->table_lock);
 
-	ret = v3d_lock_bo_reservations(job->bo, bo_count, &acquire_ctx);
+	ret = v3d_lock_bo_reservations(job->base.bo, job->base.bo_count,
+				       &acquire_ctx);
 	if (ret)
 		goto fail;
 
 	mutex_lock(&v3d->sched_lock);
-	ret = drm_sched_job_init(&job->base,
-				 &v3d_priv->sched_entity[V3D_TFU],
-				 v3d_priv);
+	ret = v3d_push_job(v3d_priv, &job->base, V3D_TFU);
 	if (ret)
 		goto fail_unreserve;
-
-	sched_done_fence = dma_fence_get(&job->base.s_fence->finished);
-
-	kref_get(&job->refcount); /* put by scheduler job completion */
-	drm_sched_entity_push_job(&job->base, &v3d_priv->sched_entity[V3D_TFU]);
 	mutex_unlock(&v3d->sched_lock);
 
-	v3d_attach_object_fences(job->bo, bo_count, sched_done_fence);
-
-	v3d_unlock_bo_reservations(job->bo, bo_count, &acquire_ctx);
-
-	/* Update the return sync object */
-	sync_out = drm_syncobj_find(file_priv, args->out_sync);
-	if (sync_out) {
-		drm_syncobj_replace_fence(sync_out, sched_done_fence);
-		drm_syncobj_put(sync_out);
-	}
-	dma_fence_put(sched_done_fence);
+	v3d_attach_fences_and_unlock_reservation(file_priv,
+						 &job->base, &acquire_ctx,
+						 args->out_sync);
 
-	v3d_tfu_job_put(job);
+	v3d_job_put(&job->base);
 
 	return 0;
 
 fail_unreserve:
 	mutex_unlock(&v3d->sched_lock);
-	v3d_unlock_bo_reservations(job->bo, bo_count, &acquire_ctx);
+	v3d_unlock_bo_reservations(job->base.bo, job->base.bo_count,
+				   &acquire_ctx);
 fail:
-	v3d_tfu_job_put(job);
+	v3d_job_put(&job->base);
 
 	return ret;
 }
@@ -755,7 +774,7 @@ v3d_gem_destroy(struct drm_device *dev)
 
 	v3d_sched_fini(v3d);
 
-	/* Waiting for exec to finish would need to be done before
+	/* Waiting for jobs to finish would need to be done before
 	 * unregistering V3D.
 	 */
 	WARN_ON(v3d->bin_job);
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index 791a4c20a959e..751332747b12e 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -60,7 +60,7 @@ v3d_overflow_mem_work(struct work_struct *work)
 	}
 
 	drm_gem_object_get(&bo->base);
-	list_add_tail(&bo->unref_head, &v3d->bin_job->unref_list);
+	list_add_tail(&bo->unref_head, &v3d->bin_job->render->unref_list);
 	spin_unlock_irqrestore(&v3d->job_lock, irqflags);
 
 	V3D_CORE_WRITE(0, V3D_PTB_BPOA, bo->node.start << PAGE_SHIFT);
@@ -93,7 +93,7 @@ v3d_irq(int irq, void *arg)
 
 	if (intsts & V3D_INT_FLDONE) {
 		struct v3d_fence *fence =
-			to_v3d_fence(v3d->bin_job->bin.irq_fence);
+			to_v3d_fence(v3d->bin_job->base.irq_fence);
 
 		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
 		dma_fence_signal(&fence->base);
@@ -102,7 +102,7 @@ v3d_irq(int irq, void *arg)
 
 	if (intsts & V3D_INT_FRDONE) {
 		struct v3d_fence *fence =
-			to_v3d_fence(v3d->render_job->render.irq_fence);
+			to_v3d_fence(v3d->render_job->base.irq_fence);
 
 		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
 		dma_fence_signal(&fence->base);
@@ -138,7 +138,7 @@ v3d_hub_irq(int irq, void *arg)
 
 	if (intsts & V3D_HUB_INT_TFUC) {
 		struct v3d_fence *fence =
-			to_v3d_fence(v3d->tfu_job->irq_fence);
+			to_v3d_fence(v3d->tfu_job->base.irq_fence);
 
 		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
 		dma_fence_signal(&fence->base);
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index 3827f7f291aaf..26290b6caaa44 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -30,39 +30,43 @@ to_v3d_job(struct drm_sched_job *sched_job)
 	return container_of(sched_job, struct v3d_job, base);
 }
 
-static struct v3d_tfu_job *
-to_tfu_job(struct drm_sched_job *sched_job)
+static struct v3d_bin_job *
+to_bin_job(struct drm_sched_job *sched_job)
 {
-	return container_of(sched_job, struct v3d_tfu_job, base);
+	return container_of(sched_job, struct v3d_bin_job, base.base);
 }
 
-static void
-v3d_job_free(struct drm_sched_job *sched_job)
+static struct v3d_render_job *
+to_render_job(struct drm_sched_job *sched_job)
 {
-	struct v3d_job *job = to_v3d_job(sched_job);
+	return container_of(sched_job, struct v3d_render_job, base.base);
+}
 
-	v3d_exec_put(job->exec);
+static struct v3d_tfu_job *
+to_tfu_job(struct drm_sched_job *sched_job)
+{
+	return container_of(sched_job, struct v3d_tfu_job, base.base);
 }
 
 static void
-v3d_tfu_job_free(struct drm_sched_job *sched_job)
+v3d_job_free(struct drm_sched_job *sched_job)
 {
-	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+	struct v3d_job *job = to_v3d_job(sched_job);
 
-	v3d_tfu_job_put(job);
+	v3d_job_put(job);
 }
 
 /**
- * Returns the fences that the bin or render job depends on, one by one.
- * v3d_job_run() won't be called until all of them have been signaled.
+ * Returns the fences that the job depends on, one by one.
+ *
+ * If placed in the scheduler's .dependency method, the corresponding
+ * .run_job won't be called until all of them have been signaled.
  */
 static struct dma_fence *
 v3d_job_dependency(struct drm_sched_job *sched_job,
 		   struct drm_sched_entity *s_entity)
 {
 	struct v3d_job *job = to_v3d_job(sched_job);
-	struct v3d_exec_info *exec = job->exec;
-	enum v3d_queue q = job == &exec->bin ? V3D_BIN : V3D_RENDER;
 	struct dma_fence *fence;
 
 	fence = job->in_fence;
@@ -71,113 +75,132 @@ v3d_job_dependency(struct drm_sched_job *sched_job,
 		return fence;
 	}
 
-	if (q == V3D_RENDER) {
-		/* If we had a bin job, the render job definitely depends on
-		 * it. We first have to wait for bin to be scheduled, so that
-		 * its done_fence is created.
-		 */
-		fence = exec->bin_done_fence;
-		if (fence) {
-			exec->bin_done_fence = NULL;
-			return fence;
-		}
-	}
-
-	/* XXX: Wait on a fence for switching the GMP if necessary,
-	 * and then do so.
-	 */
-
-	return fence;
+	return NULL;
 }
 
 /**
- * Returns the fences that the TFU job depends on, one by one.
- * v3d_tfu_job_run() won't be called until all of them have been
- * signaled.
+ * Returns the fences that the render job depends on, one by one.
+ * v3d_job_run() won't be called until all of them have been signaled.
  */
 static struct dma_fence *
-v3d_tfu_job_dependency(struct drm_sched_job *sched_job,
-		       struct drm_sched_entity *s_entity)
+v3d_render_job_dependency(struct drm_sched_job *sched_job,
+			  struct drm_sched_entity *s_entity)
 {
-	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+	struct v3d_render_job *job = to_render_job(sched_job);
 	struct dma_fence *fence;
 
-	fence = job->in_fence;
+	fence = v3d_job_dependency(sched_job, s_entity);
+	if (fence)
+		return fence;
+
+	/* If we had a bin job, the render job definitely depends on
+	 * it. We first have to wait for bin to be scheduled, so that
+	 * its done_fence is created.
+	 */
+	fence = job->bin_done_fence;
 	if (fence) {
-		job->in_fence = NULL;
+		job->bin_done_fence = NULL;
 		return fence;
 	}
 
-	return NULL;
+	/* XXX: Wait on a fence for switching the GMP if necessary,
+	 * and then do so.
+	 */
+
+	return fence;
 }
 
-static struct dma_fence *v3d_job_run(struct drm_sched_job *sched_job)
+static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
 {
-	struct v3d_job *job = to_v3d_job(sched_job);
-	struct v3d_exec_info *exec = job->exec;
-	enum v3d_queue q = job == &exec->bin ? V3D_BIN : V3D_RENDER;
-	struct v3d_dev *v3d = exec->v3d;
+	struct v3d_bin_job *job = to_bin_job(sched_job);
+	struct v3d_dev *v3d = job->base.v3d;
 	struct drm_device *dev = &v3d->drm;
 	struct dma_fence *fence;
 	unsigned long irqflags;
 
-	if (unlikely(job->base.s_fence->finished.error))
+	if (unlikely(job->base.base.s_fence->finished.error))
 		return NULL;
 
 	/* Lock required around bin_job update vs
 	 * v3d_overflow_mem_work().
 	 */
 	spin_lock_irqsave(&v3d->job_lock, irqflags);
-	if (q == V3D_BIN) {
-		v3d->bin_job = job->exec;
-
-		/* Clear out the overflow allocation, so we don't
-		 * reuse the overflow attached to a previous job.
-		 */
-		V3D_CORE_WRITE(0, V3D_PTB_BPOS, 0);
-	} else {
-		v3d->render_job = job->exec;
-	}
+	v3d->bin_job = job;
+	/* Clear out the overflow allocation, so we don't
+	 * reuse the overflow attached to a previous job.
+	 */
+	V3D_CORE_WRITE(0, V3D_PTB_BPOS, 0);
 	spin_unlock_irqrestore(&v3d->job_lock, irqflags);
 
-	/* Can we avoid this flush when q==RENDER?  We need to be
-	 * careful of scheduling, though -- imagine job0 rendering to
-	 * texture and job1 reading, and them being executed as bin0,
-	 * bin1, render0, render1, so that render1's flush at bin time
+	v3d_invalidate_caches(v3d);
+
+	fence = v3d_fence_create(v3d, V3D_BIN);
+	if (IS_ERR(fence))
+		return NULL;
+
+	if (job->base.irq_fence)
+		dma_fence_put(job->base.irq_fence);
+	job->base.irq_fence = dma_fence_get(fence);
+
+	trace_v3d_submit_cl(dev, false, to_v3d_fence(fence)->seqno,
+			    job->start, job->end);
+
+	/* Set the current and end address of the control list.
+	 * Writing the end register is what starts the job.
+	 */
+	if (job->qma) {
+		V3D_CORE_WRITE(0, V3D_CLE_CT0QMA, job->qma);
+		V3D_CORE_WRITE(0, V3D_CLE_CT0QMS, job->qms);
+	}
+	if (job->qts) {
+		V3D_CORE_WRITE(0, V3D_CLE_CT0QTS,
+			       V3D_CLE_CT0QTS_ENABLE |
+			       job->qts);
+	}
+	V3D_CORE_WRITE(0, V3D_CLE_CT0QBA, job->start);
+	V3D_CORE_WRITE(0, V3D_CLE_CT0QEA, job->end);
+
+	return fence;
+}
+
+static struct dma_fence *v3d_render_job_run(struct drm_sched_job *sched_job)
+{
+	struct v3d_render_job *job = to_render_job(sched_job);
+	struct v3d_dev *v3d = job->base.v3d;
+	struct drm_device *dev = &v3d->drm;
+	struct dma_fence *fence;
+
+	if (unlikely(job->base.base.s_fence->finished.error))
+		return NULL;
+
+	v3d->render_job = job;
+
+	/* Can we avoid this flush?  We need to be careful of
+	 * scheduling, though -- imagine job0 rendering to texture and
+	 * job1 reading, and them being executed as bin0, bin1,
+	 * render0, render1, so that render1's flush at bin time
 	 * wasn't enough.
 	 */
 	v3d_invalidate_caches(v3d);
 
-	fence = v3d_fence_create(v3d, q);
+	fence = v3d_fence_create(v3d, V3D_RENDER);
 	if (IS_ERR(fence))
 		return NULL;
 
-	if (job->irq_fence)
-		dma_fence_put(job->irq_fence);
-	job->irq_fence = dma_fence_get(fence);
+	if (job->base.irq_fence)
+		dma_fence_put(job->base.irq_fence);
+	job->base.irq_fence = dma_fence_get(fence);
 
-	trace_v3d_submit_cl(dev, q == V3D_RENDER, to_v3d_fence(fence)->seqno,
+	trace_v3d_submit_cl(dev, true, to_v3d_fence(fence)->seqno,
 			    job->start, job->end);
 
-	if (q == V3D_BIN) {
-		if (exec->qma) {
-			V3D_CORE_WRITE(0, V3D_CLE_CT0QMA, exec->qma);
-			V3D_CORE_WRITE(0, V3D_CLE_CT0QMS, exec->qms);
-		}
-		if (exec->qts) {
-			V3D_CORE_WRITE(0, V3D_CLE_CT0QTS,
-				       V3D_CLE_CT0QTS_ENABLE |
-				       exec->qts);
-		}
-	} else {
-		/* XXX: Set the QCFG */
-	}
+	/* XXX: Set the QCFG */
 
 	/* Set the current and end address of the control list.
 	 * Writing the end register is what starts the job.
 	 */
-	V3D_CORE_WRITE(0, V3D_CLE_CTNQBA(q), job->start);
-	V3D_CORE_WRITE(0, V3D_CLE_CTNQEA(q), job->end);
+	V3D_CORE_WRITE(0, V3D_CLE_CT1QBA, job->start);
+	V3D_CORE_WRITE(0, V3D_CLE_CT1QEA, job->end);
 
 	return fence;
 }
@@ -186,7 +209,7 @@ static struct dma_fence *
 v3d_tfu_job_run(struct drm_sched_job *sched_job)
 {
 	struct v3d_tfu_job *job = to_tfu_job(sched_job);
-	struct v3d_dev *v3d = job->v3d;
+	struct v3d_dev *v3d = job->base.v3d;
 	struct drm_device *dev = &v3d->drm;
 	struct dma_fence *fence;
 
@@ -195,9 +218,9 @@ v3d_tfu_job_run(struct drm_sched_job *sched_job)
 		return NULL;
 
 	v3d->tfu_job = job;
-	if (job->irq_fence)
-		dma_fence_put(job->irq_fence);
-	job->irq_fence = dma_fence_get(fence);
+	if (job->base.irq_fence)
+		dma_fence_put(job->base.irq_fence);
+	job->base.irq_fence = dma_fence_get(fence);
 
 	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
 
@@ -247,25 +270,23 @@ v3d_gpu_reset_for_timeout(struct v3d_dev *v3d, struct drm_sched_job *sched_job)
 	mutex_unlock(&v3d->reset_lock);
 }
 
+/* If the current address or return address have changed, then the GPU
+ * has probably made progress and we should delay the reset.  This
+ * could fail if the GPU got in an infinite loop in the CL, but that
+ * is pretty unlikely outside of an i-g-t testcase.
+ */
 static void
-v3d_job_timedout(struct drm_sched_job *sched_job)
+v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q,
+		      u32 *timedout_ctca, u32 *timedout_ctra)
 {
 	struct v3d_job *job = to_v3d_job(sched_job);
-	struct v3d_exec_info *exec = job->exec;
-	struct v3d_dev *v3d = exec->v3d;
-	enum v3d_queue job_q = job == &exec->bin ? V3D_BIN : V3D_RENDER;
-	u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(job_q));
-	u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(job_q));
-
-	/* If the current address or return address have changed, then
-	 * the GPU has probably made progress and we should delay the
-	 * reset.  This could fail if the GPU got in an infinite loop
-	 * in the CL, but that is pretty unlikely outside of an i-g-t
-	 * testcase.
-	 */
-	if (job->timedout_ctca != ctca || job->timedout_ctra != ctra) {
-		job->timedout_ctca = ctca;
-		job->timedout_ctra = ctra;
+	struct v3d_dev *v3d = job->v3d;
+	u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(q));
+	u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(q));
+
+	if (*timedout_ctca != ctca || *timedout_ctra != ctra) {
+		*timedout_ctca = ctca;
+		*timedout_ctra = ctra;
 		schedule_delayed_work(&job->base.work_tdr,
 				      job->base.sched->timeout);
 		return;
@@ -274,26 +295,51 @@ v3d_job_timedout(struct drm_sched_job *sched_job)
 	v3d_gpu_reset_for_timeout(v3d, sched_job);
 }
 
+static void
+v3d_bin_job_timedout(struct drm_sched_job *sched_job)
+{
+	struct v3d_bin_job *job = to_bin_job(sched_job);
+
+	v3d_cl_job_timedout(sched_job, V3D_BIN,
+			    &job->timedout_ctca, &job->timedout_ctra);
+}
+
+static void
+v3d_render_job_timedout(struct drm_sched_job *sched_job)
+{
+	struct v3d_render_job *job = to_render_job(sched_job);
+
+	v3d_cl_job_timedout(sched_job, V3D_RENDER,
+			    &job->timedout_ctca, &job->timedout_ctra);
+}
+
 static void
 v3d_tfu_job_timedout(struct drm_sched_job *sched_job)
 {
-	struct v3d_tfu_job *job = to_tfu_job(sched_job);
+	struct v3d_job *job = to_v3d_job(sched_job);
 
 	v3d_gpu_reset_for_timeout(job->v3d, sched_job);
 }
 
-static const struct drm_sched_backend_ops v3d_sched_ops = {
+static const struct drm_sched_backend_ops v3d_bin_sched_ops = {
 	.dependency = v3d_job_dependency,
-	.run_job = v3d_job_run,
-	.timedout_job = v3d_job_timedout,
-	.free_job = v3d_job_free
+	.run_job = v3d_bin_job_run,
+	.timedout_job = v3d_bin_job_timedout,
+	.free_job = v3d_job_free,
+};
+
+static const struct drm_sched_backend_ops v3d_render_sched_ops = {
+	.dependency = v3d_render_job_dependency,
+	.run_job = v3d_render_job_run,
+	.timedout_job = v3d_render_job_timedout,
+	.free_job = v3d_job_free,
 };
 
 static const struct drm_sched_backend_ops v3d_tfu_sched_ops = {
-	.dependency = v3d_tfu_job_dependency,
+	.dependency = v3d_job_dependency,
 	.run_job = v3d_tfu_job_run,
 	.timedout_job = v3d_tfu_job_timedout,
-	.free_job = v3d_tfu_job_free
+	.free_job = v3d_job_free,
 };
 
 int
@@ -305,7 +351,7 @@ v3d_sched_init(struct v3d_dev *v3d)
 	int ret;
 
 	ret = drm_sched_init(&v3d->queue[V3D_BIN].sched,
-			     &v3d_sched_ops,
+			     &v3d_bin_sched_ops,
 			     hw_jobs_limit, job_hang_limit,
 			     msecs_to_jiffies(hang_limit_ms),
 			     "v3d_bin");
@@ -315,7 +361,7 @@ v3d_sched_init(struct v3d_dev *v3d)
 	}
 
 	ret = drm_sched_init(&v3d->queue[V3D_RENDER].sched,
-			     &v3d_sched_ops,
+			     &v3d_render_sched_ops,
 			     hw_jobs_limit, job_hang_limit,
 			     msecs_to_jiffies(hang_limit_ms),
 			     "v3d_render");
-- 
GitLab


From 81a2ca9dd14751c05632f96d3375824862c4364a Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 27 Mar 2019 17:44:40 -0700
Subject: [PATCH 0597/1835] drm/v3d: Add missing implicit synchronization.

It is the expectation of existing userspace (X11 + Mesa, in
particular) that jobs submitted to the kernel against a shared BO will
get implicitly synchronized by their submission order.  If we want to
allow clever userspace to disable implicit synchronization, we should
do that under its own submit flag (as amdgpu and lima do).

Note that we currently only implicitly sync for the rendering pass,
not binning -- if you texture-from-pixmap in the binning vertex shader
(vertex coordinate generation), you'll miss out on synchronization.

Fixes flickering when multiple clients are running in parallel,
particularly GL apps and compositors.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_drv.h   | 10 +---
 drivers/gpu/drm/v3d/v3d_gem.c   | 98 ++++++++++++++++++++++++++++++---
 drivers/gpu/drm/v3d/v3d_sched.c | 45 ++-------------
 3 files changed, 96 insertions(+), 57 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 6ecd25631094d..2807fe702524f 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -186,8 +186,9 @@ struct v3d_job {
 	struct v3d_bo **bo;
 	u32 bo_count;
 
-	/* An optional fence userspace can pass in for the job to depend on. */
-	struct dma_fence *in_fence;
+	struct dma_fence **deps;
+	int deps_count;
+	int deps_size;
 
 	/* v3d fence to be signaled by IRQ handler when the job is complete. */
 	struct dma_fence *irq_fence;
@@ -219,11 +220,6 @@ struct v3d_bin_job {
 struct v3d_render_job {
 	struct v3d_job base;
 
-	/* Optional fence for the binner, to depend on before starting
-	 * our job.
-	 */
-	struct dma_fence *bin_done_fence;
-
 	/* GPU virtual addresses of the start/end of the CL job. */
 	u32 start, end;
 
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 9a3930696c7e4..40a72ef72099e 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -218,6 +218,71 @@ v3d_unlock_bo_reservations(struct v3d_bo **bos,
 	ww_acquire_fini(acquire_ctx);
 }
 
+static int
+v3d_add_dep(struct v3d_job *job, struct dma_fence *fence)
+{
+	if (!fence)
+		return 0;
+
+	if (job->deps_size == job->deps_count) {
+		int new_deps_size = max(job->deps_size * 2, 4);
+		struct dma_fence **new_deps =
+			krealloc(job->deps, new_deps_size * sizeof(*new_deps),
+				 GFP_KERNEL);
+		if (!new_deps) {
+			dma_fence_put(fence);
+			return -ENOMEM;
+		}
+
+		job->deps = new_deps;
+		job->deps_size = new_deps_size;
+	}
+
+	job->deps[job->deps_count++] = fence;
+
+	return 0;
+}
+
+/**
+ * Adds the required implicit fences before executing the job
+ *
+ * Userspace (X11 + Mesa) requires that a job submitted against a shared BO
+ * from one fd will implicitly synchronize against previous jobs submitted
+ * against that BO from other fds.
+ *
+ * Currently we don't bother trying to track the shared BOs, and instead just
+ * sync everything.  However, our synchronization is only for the render pass
+ * -- the binning stage (VS coordinate calculations) ignores implicit sync,
+ * since using shared buffers for texture coordinates seems unlikely, and
+ * implicitly syncing them would break bin/render parallelism.  If we want to
+ * fix that, we should introduce a flag when VS texturing has been used in the
+ * binning stage, or a set of flags for which BOs are sampled during binning.
+ */
+static int
+v3d_add_implicit_fences(struct v3d_job *job, struct v3d_bo *bo)
+{
+	int i, ret, nr_fences;
+	struct dma_fence **fences;
+
+	ret = reservation_object_get_fences_rcu(bo->resv, NULL,
+						&nr_fences, &fences);
+	if (ret || !nr_fences)
+		return ret;
+
+	for (i = 0; i < nr_fences; i++) {
+		ret = v3d_add_dep(job, fences[i]);
+		if (ret)
+			break;
+	}
+
+	/* Free any remaining fences after error. */
+	for (; i < nr_fences; i++)
+		dma_fence_put(fences[i]);
+	kfree(fences);
+
+	return ret;
+}
+
 /* Takes the reservation lock on all the BOs being referenced, so that
  * at queue submit time we can update the reservations.
  *
@@ -226,10 +291,11 @@ v3d_unlock_bo_reservations(struct v3d_bo **bos,
  * to v3d, so we don't attach dma-buf fences to them.
  */
 static int
-v3d_lock_bo_reservations(struct v3d_bo **bos,
-			 int bo_count,
+v3d_lock_bo_reservations(struct v3d_job *job,
 			 struct ww_acquire_ctx *acquire_ctx)
 {
+	struct v3d_bo **bos = job->bo;
+	int bo_count = job->bo_count;
 	int contended_lock = -1;
 	int i, ret;
 
@@ -281,6 +347,13 @@ retry:
 	 * before we commit the CL to the hardware.
 	 */
 	for (i = 0; i < bo_count; i++) {
+		ret = v3d_add_implicit_fences(job, bos[i]);
+		if (ret) {
+			v3d_unlock_bo_reservations(bos, bo_count,
+						   acquire_ctx);
+			return ret;
+		}
+
 		ret = reservation_object_reserve_shared(bos[i]->resv);
 		if (ret) {
 			v3d_unlock_bo_reservations(bos, bo_count,
@@ -383,7 +456,10 @@ v3d_job_free(struct kref *ref)
 	}
 	kvfree(job->bo);
 
-	dma_fence_put(job->in_fence);
+	for (i = 0; i < job->deps_count; i++)
+		dma_fence_put(job->deps[i]);
+	kfree(job->deps);
+
 	dma_fence_put(job->irq_fence);
 	dma_fence_put(job->done_fence);
 
@@ -464,15 +540,20 @@ v3d_job_init(struct v3d_dev *v3d, struct drm_file *file_priv,
 	     struct v3d_job *job, void (*free)(struct kref *ref),
 	     u32 in_sync)
 {
+	struct dma_fence *in_fence = NULL;
 	int ret;
 
 	job->v3d = v3d;
 	job->free = free;
 
-	ret = drm_syncobj_find_fence(file_priv, in_sync, 0, &job->in_fence);
+	ret = drm_syncobj_find_fence(file_priv, in_sync, 0, &in_fence);
 	if (ret == -EINVAL)
 		return ret;
 
+	ret = v3d_add_dep(job, in_fence);
+	if (ret)
+		return ret;
+
 	kref_init(&job->refcount);
 
 	return 0;
@@ -590,8 +671,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	if (ret)
 		goto fail;
 
-	ret = v3d_lock_bo_reservations(render->base.bo, render->base.bo_count,
-				       &acquire_ctx);
+	ret = v3d_lock_bo_reservations(&render->base, &acquire_ctx);
 	if (ret)
 		goto fail;
 
@@ -601,7 +681,8 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 		if (ret)
 			goto fail_unreserve;
 
-		render->bin_done_fence = dma_fence_get(bin->base.done_fence);
+		ret = v3d_add_dep(&render->base,
+				  dma_fence_get(bin->base.done_fence));
 	}
 
 	ret = v3d_push_job(v3d_priv, &render->base, V3D_RENDER);
@@ -692,8 +773,7 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 	}
 	spin_unlock(&file_priv->table_lock);
 
-	ret = v3d_lock_bo_reservations(job->base.bo, job->base.bo_count,
-				       &acquire_ctx);
+	ret = v3d_lock_bo_reservations(&job->base, &acquire_ctx);
 	if (ret)
 		goto fail;
 
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index 26290b6caaa44..e47f13bec114f 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -67,47 +67,10 @@ v3d_job_dependency(struct drm_sched_job *sched_job,
 		   struct drm_sched_entity *s_entity)
 {
 	struct v3d_job *job = to_v3d_job(sched_job);
-	struct dma_fence *fence;
-
-	fence = job->in_fence;
-	if (fence) {
-		job->in_fence = NULL;
-		return fence;
-	}
 
-	return NULL;
-}
-
-/**
- * Returns the fences that the render job depends on, one by one.
- * v3d_job_run() won't be called until all of them have been signaled.
- */
-static struct dma_fence *
-v3d_render_job_dependency(struct drm_sched_job *sched_job,
-			  struct drm_sched_entity *s_entity)
-{
-	struct v3d_render_job *job = to_render_job(sched_job);
-	struct dma_fence *fence;
-
-	fence = v3d_job_dependency(sched_job, s_entity);
-	if (fence)
-		return fence;
-
-	/* If we had a bin job, the render job definitely depends on
-	 * it. We first have to wait for bin to be scheduled, so that
-	 * its done_fence is created.
-	 */
-	fence = job->bin_done_fence;
-	if (fence) {
-		job->bin_done_fence = NULL;
-		return fence;
-	}
-
-	/* XXX: Wait on a fence for switching the GMP if necessary,
-	 * and then do so.
-	 */
-
-	return fence;
+	if (!job->deps_count)
+		return NULL;
+	return job->deps[--job->deps_count];
 }
 
 static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
@@ -329,7 +292,7 @@ static const struct drm_sched_backend_ops v3d_bin_sched_ops = {
 };
 
 static const struct drm_sched_backend_ops v3d_render_sched_ops = {
-	.dependency = v3d_render_job_dependency,
+	.dependency = v3d_job_dependency,
 	.run_job = v3d_render_job_run,
 	.timedout_job = v3d_render_job_timedout,
 	.free_job = v3d_job_free,
-- 
GitLab


From 7e2f4a3382d651bccc95b872383f35ce91feb23f Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 28 Mar 2019 11:58:51 -0700
Subject: [PATCH 0598/1835] drm/vc4: Fix synchronization firmwarekms against GL
 rendering.

We would present the framebuffer immediately without waiting for
rendering to finish first, resulting in stuttering and flickering as a
window was dragged around when the GPU was busy enough to not just win
the race.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 4701f68505510..d4f6ff1c410da 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -15,6 +15,7 @@
  */
 
 #include "drm/drm_atomic_helper.h"
+#include "drm/drm_gem_framebuffer_helper.h"
 #include "drm/drm_plane_helper.h"
 #include "drm/drm_crtc_helper.h"
 #include "drm/drm_fourcc.h"
@@ -291,7 +292,7 @@ static const struct drm_plane_funcs vc4_plane_funcs = {
 };
 
 static const struct drm_plane_helper_funcs vc4_primary_plane_helper_funcs = {
-	.prepare_fb = NULL,
+	.prepare_fb = drm_gem_fb_prepare_fb,
 	.cleanup_fb = NULL,
 	.atomic_check = vc4_plane_atomic_check,
 	.atomic_update = vc4_primary_plane_atomic_update,
@@ -299,7 +300,7 @@ static const struct drm_plane_helper_funcs vc4_primary_plane_helper_funcs = {
 };
 
 static const struct drm_plane_helper_funcs vc4_cursor_plane_helper_funcs = {
-	.prepare_fb = NULL,
+	.prepare_fb = drm_gem_fb_prepare_fb,
 	.cleanup_fb = NULL,
 	.atomic_check = vc4_plane_atomic_check,
 	.atomic_update = vc4_cursor_plane_atomic_update,
-- 
GitLab


From 3e846eeaeb95360bf2f99193b41dcbb839a9b5b6 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 29 Mar 2019 12:04:36 -0700
Subject: [PATCH 0599/1835] drm/vc4: Make sure that vblank waits work without
 v3d loaded.

This flag exists to protect legacy drivers, but when vc4's v3d doesn't
probe, it doesn't get set up by vc4_v3d.c's call of drm_irq_install.
This resulted in applications running as fast as possible, and laggy
performance from compton as it had to wait for the latest rendering by
the application for its presentation.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 14ccd676b2e90..432f9daa676c4 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -422,6 +422,7 @@ int vc4_kms_load(struct drm_device *dev)
 	/* Set support for vblank irq fast disable, before drm_vblank_init() */
 	dev->vblank_disable_immediate = true;
 
+	dev->irq_enabled = true;
 	ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
 	if (ret < 0) {
 		dev_err(dev->dev, "failed to initialize vblank\n");
-- 
GitLab


From c8d87d2bc5b53c89174cff52cf045eb5e76547bc Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 18 Mar 2019 16:38:32 -0700
Subject: [PATCH 0600/1835] drm/vc4: Expose the format modifiers for firmware
 kms.

This should technically not expose VC4_T_TILED on pi4.  However, if we
don't expose anything, then userspace will assume that display can
handle whatever modifiers 3d can do (UIF on 2711).  By exposing a
list, that will get intersected with what 3D can do so that we get T
tiling for display on 2710 and linear on 2711.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 33 +++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index d4f6ff1c410da..fe23983524cca 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -281,6 +281,27 @@ static void vc4_plane_destroy(struct drm_plane *plane)
 	drm_plane_cleanup(plane);
 }
 
+static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
+					  uint32_t format,
+					  uint64_t modifier)
+{
+	/* Support T_TILING for RGB formats only. */
+	switch (format) {
+	case DRM_FORMAT_XRGB8888:
+	case DRM_FORMAT_ARGB8888:
+		switch (modifier) {
+		case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
+		case DRM_FORMAT_MOD_LINEAR:
+		case DRM_FORMAT_MOD_BROADCOM_UIF:
+			return true;
+		default:
+			return false;
+		}
+	default:
+		return false;
+	}
+}
+
 static const struct drm_plane_funcs vc4_plane_funcs = {
 	.update_plane = drm_atomic_helper_update_plane,
 	.disable_plane = drm_atomic_helper_disable_plane,
@@ -289,6 +310,7 @@ static const struct drm_plane_funcs vc4_plane_funcs = {
 	.reset = drm_atomic_helper_plane_reset,
 	.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
+	.format_mod_supported = vc4_fkms_format_mod_supported,
 };
 
 static const struct drm_plane_helper_funcs vc4_primary_plane_helper_funcs = {
@@ -316,6 +338,14 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	u32 argb8888 = DRM_FORMAT_ARGB8888;
 	int ret = 0;
 	bool primary = (type == DRM_PLANE_TYPE_PRIMARY);
+	static const uint64_t modifiers[] = {
+		DRM_FORMAT_MOD_LINEAR,
+		/* VC4_T_TILED should come after linear, because we
+		 * would prefer to scan out linear (less bus traffic).
+		 */
+		DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED,
+		DRM_FORMAT_MOD_INVALID,
+	};
 
 	vc4_plane = devm_kzalloc(dev->dev, sizeof(*vc4_plane),
 				 GFP_KERNEL);
@@ -327,7 +357,8 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	plane = &vc4_plane->base;
 	ret = drm_universal_plane_init(dev, plane, 0xff,
 				       &vc4_plane_funcs,
-				       primary ? &xrgb8888 : &argb8888, 1, NULL,
+				       primary ? &xrgb8888 : &argb8888, 1,
+				       modifiers,
 				       type, primary ? "primary" : "cursor");
 
 	if (type == DRM_PLANE_TYPE_PRIMARY) {
-- 
GitLab


From 6da63d9e4bd78b9db8fcf07c7322d0a92696f0b1 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Tue, 2 Apr 2019 13:29:00 -0700
Subject: [PATCH 0601/1835] drm/vc4: Fix vblank timestamping for firmwarekms.

The core doesn't expect a false return from the scanoutpos function in
normal usage, so we were doing the precise vblank timestamping path
and thus "immediate" vblank disables (even though firmwarekms can't
actually disable vblanks interrupts, sigh), and the kernel would get
confused when getting timestamp info when also turning vblanks back
on.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/vc4/vc4_crtc.c         | 3 ---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 6 ++++++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 5a286801faa59..5615ceb15708f 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -133,9 +133,6 @@ bool vc4_crtc_get_scanoutpos(struct drm_device *dev, unsigned int crtc_id,
 	int vblank_lines;
 	bool ret = false;
 
-	if (vc4->firmware_kms)
-		return 0;
-
 	/* preempt_disable_rt() should go right here in PREEMPT_RT patchset. */
 
 	/* Get optional system timestamp before query. */
diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index fe23983524cca..eed391f1d1602 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -673,6 +673,12 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 
 	vc4->firmware_kms = true;
 
+	/* firmware kms doesn't have precise a scanoutpos implementation, so
+	 * we can't do the precise vblank timestamp mode.
+	 */
+	drm->driver->get_scanout_position = NULL;
+	drm->driver->get_vblank_timestamp = NULL;
+
 	vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
 	if (!vc4_crtc)
 		return -ENOMEM;
-- 
GitLab


From d635657254789e386fcef321ed6f71961c637311 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 26 Mar 2019 14:43:06 +0000
Subject: [PATCH 0602/1835] gpu: vc4-fkms: Switch to the newer mailbox frame
 buffer API.

The old mailbox FB API was ideally deprecated but still used by
the FKMS driver.
Update to the newer API.

NB This needs current firmware that accepts ARM allocated buffers
through the newer API.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c     | 109 +++++++++++----------
 include/soc/bcm2835/raspberrypi-firmware.h |  10 ++
 2 files changed, 67 insertions(+), 52 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index eed391f1d1602..6e90be13338cd 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -28,6 +28,25 @@
 #include "vc4_regs.h"
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
+struct fb_alloc_tags {
+	struct rpi_firmware_property_tag_header tag1;
+	u32 xres, yres;
+	struct rpi_firmware_property_tag_header tag2;
+	u32 xres_virtual, yres_virtual;
+	struct rpi_firmware_property_tag_header tag3;
+	u32 bpp;
+	struct rpi_firmware_property_tag_header tag4;
+	u32 xoffset, yoffset;
+	struct rpi_firmware_property_tag_header tag5;
+	u32 base, screen_size;
+	struct rpi_firmware_property_tag_header tag6;
+	u32 pitch;
+	struct rpi_firmware_property_tag_header tag7;
+	u32 alpha_mode;
+	struct rpi_firmware_property_tag_header tag8;
+	u32 layer;
+};
+
 /* The firmware delivers a vblank interrupt to us through the SMI
  * hardware, which has only this one register.
  */
@@ -121,45 +140,39 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 					    struct drm_plane_state *old_state)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
-	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
 	struct drm_plane_state *state = plane->state;
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
-	volatile struct fbinfo_s *fbinfo = vc4_plane->fbinfo;
+	u32 format = fb->format->format;
+	struct fb_alloc_tags fbinfo = {
+		.tag1 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT,
+			  8, 0, },
+			.xres = state->crtc_w,
+			.yres = state->crtc_h,
+		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT,
+			  8, 0, },
+			.xres_virtual = state->crtc_w,
+			.yres_virtual = state->crtc_h,
+		.tag3 = { RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH, 4, 0 },
+			.bpp = 32,
+		.tag4 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET, 8, 0 },
+			.xoffset = 0,
+			.yoffset = 0,
+		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
+			.base = bo->paddr + fb->offsets[0],
+			.screen_size = state->crtc_w * state->crtc_h * 4,
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
+			.pitch = fb->pitches[0],
+		.tag7 = { RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE, 4, 0 },
+			.alpha_mode = format == DRM_FORMAT_ARGB8888 ? 0 : 2,
+		.tag8 = { RPI_FIRMWARE_FRAMEBUFFER_SET_LAYER, 4, 0 },
+			.layer = -127,
+	};
 	u32 bpp = 32;
 	int ret;
 
-	fbinfo->xres = state->crtc_w;
-	fbinfo->yres = state->crtc_h;
-	fbinfo->xres_virtual = state->crtc_w;
-	fbinfo->yres_virtual = state->crtc_h;
-	fbinfo->bpp = bpp;
-	fbinfo->xoffset = state->crtc_x;
-	fbinfo->yoffset = state->crtc_y;
-	fbinfo->base = bo->paddr + fb->offsets[0];
-	fbinfo->pitch = fb->pitches[0];
-
 	if (fb->modifier == DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED)
-		fbinfo->bpp |= BIT(31);
-
-	/* A bug in the firmware makes it so that if the fb->base is
-	 * set to nonzero, the configured pitch gets overwritten with
-	 * the previous pitch.  So, to get the configured pitch
-	 * recomputed, we have to make it allocate itself a new buffer
-	 * in VC memory, first.
-	 */
-	if (vc4_plane->pitch != fb->pitches[0]) {
-		u32 saved_base = fbinfo->base;
-		fbinfo->base = 0;
-
-		ret = rpi_firmware_transaction(vc4->firmware,
-					       RPI_FIRMWARE_CHAN_FB,
-					       vc4_plane->fbinfo_bus_addr);
-		fbinfo->base = saved_base;
-
-		vc4_plane->pitch = fbinfo->pitch;
-		WARN_ON_ONCE(vc4_plane->pitch != fb->pitches[0]);
-	}
+		fbinfo.bpp |= BIT(31);
 
 	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary update %dx%d@%d +%d,%d 0x%pad/%d\n",
 			 plane->base.id, plane->name,
@@ -168,14 +181,13 @@ static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
 			 bpp,
 			 state->crtc_x,
 			 state->crtc_y,
-			 &fbinfo->base,
+			 &fbinfo.base,
 			 fb->pitches[0]);
 
-	ret = rpi_firmware_transaction(vc4->firmware,
-				       RPI_FIRMWARE_CHAN_FB,
-				       vc4_plane->fbinfo_bus_addr);
-	WARN_ON_ONCE(fbinfo->pitch != fb->pitches[0]);
-	WARN_ON_ONCE(fbinfo->base != bo->paddr + fb->offsets[0]);
+	ret = rpi_firmware_property_list(vc4->firmware, &fbinfo,
+					 sizeof(fbinfo));
+	WARN_ON_ONCE(fbinfo.pitch != fb->pitches[0]);
+	WARN_ON_ONCE(fbinfo.base != bo->paddr + fb->offsets[0]);
 
 	/* If the CRTC is on (or going to be on) and we're enabled,
 	 * then unblank.  Otherwise, stay blank until CRTC enable.
@@ -332,10 +344,10 @@ static const struct drm_plane_helper_funcs vc4_cursor_plane_helper_funcs = {
 static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 					     enum drm_plane_type type)
 {
+	/* Primary and cursor planes only */
 	struct drm_plane *plane = NULL;
 	struct vc4_fkms_plane *vc4_plane;
-	u32 xrgb8888 = DRM_FORMAT_XRGB8888;
-	u32 argb8888 = DRM_FORMAT_ARGB8888;
+	u32 formats[] = {DRM_FORMAT_ARGB8888, DRM_FORMAT_XRGB8888};
 	int ret = 0;
 	bool primary = (type == DRM_PLANE_TYPE_PRIMARY);
 	static const uint64_t modifiers[] = {
@@ -357,22 +369,15 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	plane = &vc4_plane->base;
 	ret = drm_universal_plane_init(dev, plane, 0xff,
 				       &vc4_plane_funcs,
-				       primary ? &xrgb8888 : &argb8888, 1,
-				       modifiers,
+				       formats, primary ? 2 : 1, modifiers,
 				       type, primary ? "primary" : "cursor");
 
-	if (type == DRM_PLANE_TYPE_PRIMARY) {
-		vc4_plane->fbinfo =
-			dma_alloc_coherent(dev->dev,
-					   sizeof(*vc4_plane->fbinfo),
-					   &vc4_plane->fbinfo_bus_addr,
-					   GFP_KERNEL);
-		memset(vc4_plane->fbinfo, 0, sizeof(*vc4_plane->fbinfo));
-
+	if (type == DRM_PLANE_TYPE_PRIMARY)
 		drm_plane_helper_add(plane, &vc4_primary_plane_helper_funcs);
-	} else {
+	else
 		drm_plane_helper_add(plane, &vc4_cursor_plane_helper_funcs);
-	}
+
+	drm_plane_create_alpha_property(plane);
 
 	return plane;
 fail:
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 23b9d356537f3..b54035b15b57f 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -111,9 +111,15 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_GET_VIRTUAL_OFFSET =         0x00040009,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN =               0x0004000a,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_PALETTE =                0x0004000b,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_LAYER =                  0x0004000c,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_TRANSFORM =              0x0004000d,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_VSYNC =                  0x0004000e,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF =               0x0004000f,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF =            0x00040010,
 	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM =            0x00048013,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS =           0x00040013,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS =       0x00040014,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT = 0x00044003,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT =  0x00044004,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_DEPTH =                 0x00044005,
@@ -122,6 +128,8 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_OFFSET =        0x00044009,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_OVERSCAN =              0x0004400a,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PALETTE =               0x0004400b,
+	RPI_FIRMWARE_FRAMEBUFFER_TEST_LAYER =                 0x0004400c,
+	RPI_FIRMWARE_FRAMEBUFFER_TEST_TRANSFORM =             0x0004400d,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VSYNC =                 0x0004400e,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT =  0x00048003,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT =   0x00048004,
@@ -134,6 +142,8 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC =                  0x0004800e,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_LAYER =                  0x0004800c,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_TRANSFORM =              0x0004800d,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT =              0x0004800f,
 
 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
-- 
GitLab


From 400fb9f6f59db3abd80716a8f116b9ab9e08814b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 27 Mar 2019 17:45:01 +0000
Subject: [PATCH 0603/1835] drm: vc4: Add an overlay plane to vc4-firmware-kms

This uses a new API that is exposed via the mailbox service
to stick an element straight on the screen using DispmanX.

The primary and cursor planes have also been switched to using
the new plane API, and it supports layering based on the DRM
zpos parameter.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c     | 518 ++++++++++++++-------
 drivers/gpu/drm/vc4/vc4_kms.c              |   1 +
 drivers/gpu/drm/vc4/vc_image_types.h       | 143 ++++++
 include/soc/bcm2835/raspberrypi-firmware.h |   2 +
 4 files changed, 495 insertions(+), 169 deletions(-)
 create mode 100644 drivers/gpu/drm/vc4/vc_image_types.h

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 6e90be13338cd..ccfe72926f5a9 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -26,8 +26,46 @@
 #include "linux/of_device.h"
 #include "vc4_drv.h"
 #include "vc4_regs.h"
+#include "vc_image_types.h"
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
+struct set_plane {
+	u8 display;
+	u8 plane_id;
+	u8 vc_image_type;
+	s8 layer;
+
+	u16 width;
+	u16 height;
+
+	u16 pitch;
+	u16 vpitch;
+
+	u32 src_x;	/* 16p16 */
+	u32 src_y;	/* 16p16 */
+
+	u32 src_w;	/* 16p16 */
+	u32 src_h;	/* 16p16 */
+
+	s16 dst_x;
+	s16 dst_y;
+
+	u16 dst_w;
+	u16 dst_h;
+
+	u8 alpha;
+	u8 num_planes;
+	u8 is_vu;
+	u8 padding;
+
+	u32 planes[4];  /* DMA address of each plane */
+};
+
+struct mailbox_set_plane {
+	struct rpi_firmware_property_tag_header tag;
+	struct set_plane plane;
+};
+
 struct fb_alloc_tags {
 	struct rpi_firmware_property_tag_header tag1;
 	u32 xres, yres;
@@ -47,6 +85,79 @@ struct fb_alloc_tags {
 	u32 layer;
 };
 
+static const struct vc_image_format {
+	u32 drm;	/* DRM_FORMAT_* */
+	u32 vc_image;	/* VC_IMAGE_* */
+	u32 is_vu;
+} vc_image_formats[] = {
+	{
+		.drm = DRM_FORMAT_XRGB8888,
+		.vc_image = VC_IMAGE_XRGB8888,
+	},
+	{
+		.drm = DRM_FORMAT_ARGB8888,
+		.vc_image = VC_IMAGE_ARGB8888,
+	},
+/*
+ *	FIXME: Need to resolve which DRM format goes to which vc_image format
+ *	for the remaining RGBA and RGBX formats.
+ *	{
+ *		.drm = DRM_FORMAT_ABGR8888,
+ *		.vc_image = VC_IMAGE_RGBA8888,
+ *	},
+ *	{
+ *		.drm = DRM_FORMAT_XBGR8888,
+ *		.vc_image = VC_IMAGE_RGBA8888,
+ *	},
+ */
+	{
+		.drm = DRM_FORMAT_RGB565,
+		.vc_image = VC_IMAGE_RGB565,
+	},
+	{
+		.drm = DRM_FORMAT_RGB888,
+		.vc_image = VC_IMAGE_BGR888,
+	},
+	{
+		.drm = DRM_FORMAT_BGR888,
+		.vc_image = VC_IMAGE_RGB888,
+	},
+	{
+		.drm = DRM_FORMAT_YUV422,
+		.vc_image = VC_IMAGE_YUV422PLANAR,
+	},
+	{
+		.drm = DRM_FORMAT_YUV420,
+		.vc_image = VC_IMAGE_YUV420,
+	},
+	{
+		.drm = DRM_FORMAT_YVU420,
+		.vc_image = VC_IMAGE_YUV420,
+		.is_vu = 1,
+	},
+	{
+		.drm = DRM_FORMAT_NV12,
+		.vc_image = VC_IMAGE_YUV420SP,
+	},
+	{
+		.drm = DRM_FORMAT_NV21,
+		.vc_image = VC_IMAGE_YUV420SP,
+		.is_vu = 1,
+	},
+};
+
+static const struct vc_image_format *vc4_get_vc_image_fmt(u32 drm_format)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(vc_image_formats); i++) {
+		if (vc_image_formats[i].drm == drm_format)
+			return &vc_image_formats[i];
+	}
+
+	return NULL;
+}
+
 /* The firmware delivers a vblank interrupt to us through the SMI
  * hardware, which has only this one register.
  */
@@ -113,6 +224,7 @@ struct vc4_fkms_plane {
 	struct fbinfo_s *fbinfo;
 	dma_addr_t fbinfo_bus_addr;
 	u32 pitch;
+	struct mailbox_set_plane mb;
 };
 
 static inline struct vc4_fkms_plane *to_vc4_fkms_plane(struct drm_plane *plane)
@@ -120,165 +232,183 @@ static inline struct vc4_fkms_plane *to_vc4_fkms_plane(struct drm_plane *plane)
 	return (struct vc4_fkms_plane *)plane;
 }
 
-/* Turns the display on/off. */
-static int vc4_plane_set_primary_blank(struct drm_plane *plane, bool blank)
+static int vc4_plane_set_blank(struct drm_plane *plane, bool blank)
 {
 	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
+	struct mailbox_set_plane blank_mb = {
+		.tag = { RPI_FIRMWARE_SET_PLANE, sizeof(struct set_plane), 0 },
+		.plane = {
+			.display = vc4_plane->mb.plane.display,
+			.plane_id = vc4_plane->mb.plane.plane_id,
+		}
+	};
+	int ret;
 
-	u32 packet = blank;
-
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary plane %s",
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] overlay plane %s",
 			 plane->base.id, plane->name,
 			 blank ? "blank" : "unblank");
 
-	return rpi_firmware_property(vc4->firmware,
-				     RPI_FIRMWARE_FRAMEBUFFER_BLANK,
-				     &packet, sizeof(packet));
+	if (blank)
+		ret = rpi_firmware_property_list(vc4->firmware, &blank_mb,
+						 sizeof(blank_mb));
+	else
+		ret = rpi_firmware_property_list(vc4->firmware, &vc4_plane->mb,
+						 sizeof(vc4_plane->mb));
+
+	WARN_ONCE(ret, "%s: firmware call failed. Please update your firmware",
+		  __func__);
+	return ret;
 }
 
-static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
-					    struct drm_plane_state *old_state)
+static void vc4_plane_atomic_update(struct drm_plane *plane,
+				    struct drm_plane_state *old_state)
 {
-	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
 	struct drm_plane_state *state = plane->state;
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
-	u32 format = fb->format->format;
-	struct fb_alloc_tags fbinfo = {
-		.tag1 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT,
-			  8, 0, },
-			.xres = state->crtc_w,
-			.yres = state->crtc_h,
-		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT,
-			  8, 0, },
-			.xres_virtual = state->crtc_w,
-			.yres_virtual = state->crtc_h,
-		.tag3 = { RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH, 4, 0 },
-			.bpp = 32,
-		.tag4 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET, 8, 0 },
-			.xoffset = 0,
-			.yoffset = 0,
-		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
-			.base = bo->paddr + fb->offsets[0],
-			.screen_size = state->crtc_w * state->crtc_h * 4,
-		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
-			.pitch = fb->pitches[0],
-		.tag7 = { RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE, 4, 0 },
-			.alpha_mode = format == DRM_FORMAT_ARGB8888 ? 0 : 2,
-		.tag8 = { RPI_FIRMWARE_FRAMEBUFFER_SET_LAYER, 4, 0 },
-			.layer = -127,
-	};
-	u32 bpp = 32;
-	int ret;
+	const struct drm_format_info *drm_fmt = fb->format;
+	const struct vc_image_format *vc_fmt =
+					vc4_get_vc_image_fmt(drm_fmt->format);
+	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
+	struct mailbox_set_plane *mb = &vc4_plane->mb;
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(state->crtc);
+	int num_planes = fb->format->num_planes;
+	struct drm_display_mode *mode = &state->crtc->mode;
+
+	mb->plane.vc_image_type = vc_fmt->vc_image;
+	mb->plane.width = fb->width;
+	mb->plane.height = fb->height;
+	mb->plane.pitch = fb->pitches[0];
+	mb->plane.src_w = state->src_w;
+	mb->plane.src_h = state->src_h;
+	mb->plane.src_x = state->src_x;
+	mb->plane.src_y = state->src_y;
+	mb->plane.dst_w = state->crtc_w;
+	mb->plane.dst_h = state->crtc_h;
+	mb->plane.dst_x = state->crtc_x;
+	mb->plane.dst_y = state->crtc_y;
+	mb->plane.alpha = state->alpha >> 8;
+	mb->plane.layer = state->normalized_zpos ?
+					state->normalized_zpos : -127;
+	mb->plane.num_planes = num_planes;
+	mb->plane.is_vu = vc_fmt->is_vu;
+	mb->plane.planes[0] = bo->paddr + fb->offsets[0];
+
+	/* FIXME: If the dest rect goes off screen then clip the src rect so we
+	 * don't have off-screen pixels.
+	 */
+	if (plane->type == DRM_PLANE_TYPE_CURSOR) {
+		/* There is no scaling on the cursor plane, therefore the calcs
+		 * to alter the source crop as the cursor goes off the screen
+		 * are simple.
+		 */
+		if (mb->plane.dst_x + mb->plane.dst_w > mode->hdisplay) {
+			mb->plane.dst_w = mode->hdisplay - mb->plane.dst_x;
+			mb->plane.src_w = (mode->hdisplay - mb->plane.dst_x)
+									<< 16;
+		}
+		if (mb->plane.dst_y + mb->plane.dst_h > mode->vdisplay) {
+			mb->plane.dst_h = mode->vdisplay - mb->plane.dst_y;
+			mb->plane.src_h = (mode->vdisplay - mb->plane.dst_y)
+									<< 16;
+		}
+	}
+
+	if (num_planes > 1) {
+		/* Assume this must be YUV */
+		/* Makes assumptions on the stride for the chroma planes as we
+		 * can't easily plumb in non-standard pitches.
+		 */
+		mb->plane.planes[1] = bo->paddr + fb->offsets[1];
+		if (num_planes > 2)
+			mb->plane.planes[2] = bo->paddr + fb->offsets[2];
+		else
+			mb->plane.planes[2] = 0;
+
+		/* Special case the YUV420 with U and V as line interleaved
+		 * planes as we have special handling for that case.
+		 */
+		if (num_planes == 3 &&
+		    (fb->offsets[2] - fb->offsets[1]) == fb->pitches[1])
+			mb->plane.vc_image_type = VC_IMAGE_YUV420_S;
+	} else {
+		mb->plane.planes[1] = 0;
+		mb->plane.planes[2] = 0;
+	}
+	mb->plane.planes[3] = 0;
+
+	switch (fb->modifier) {
+	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
+		switch (mb->plane.vc_image_type) {
+		case VC_IMAGE_RGBX32:
+			mb->plane.vc_image_type = VC_IMAGE_TF_RGBX32;
+			break;
+		case VC_IMAGE_RGBA32:
+			mb->plane.vc_image_type = VC_IMAGE_TF_RGBA32;
+			break;
+		case VC_IMAGE_RGB565:
+			mb->plane.vc_image_type = VC_IMAGE_TF_RGB565;
+			break;
+		}
+		break;
+	case DRM_FORMAT_MOD_BROADCOM_SAND128:
+		mb->plane.vc_image_type = VC_IMAGE_YUV_UV;
+		mb->plane.pitch = fourcc_mod_broadcom_param(fb->modifier);
+		break;
+	}
 
-	if (fb->modifier == DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED)
-		fbinfo.bpp |= BIT(31);
+	if (vc4_crtc) {
+		mb->plane.dst_x += vc4_crtc->overscan[0];
+		mb->plane.dst_y += vc4_crtc->overscan[1];
+	}
 
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary update %dx%d@%d +%d,%d 0x%pad/%d\n",
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane update %dx%d@%d +dst(%d,%d, %d,%d) +src(%d,%d, %d,%d) 0x%08x/%08x/%08x/%d, alpha %u zpos %u\n",
 			 plane->base.id, plane->name,
-			 state->crtc_w,
-			 state->crtc_h,
-			 bpp,
+			 mb->plane.width,
+			 mb->plane.height,
+			 mb->plane.vc_image_type,
 			 state->crtc_x,
 			 state->crtc_y,
-			 &fbinfo.base,
-			 fb->pitches[0]);
-
-	ret = rpi_firmware_property_list(vc4->firmware, &fbinfo,
-					 sizeof(fbinfo));
-	WARN_ON_ONCE(fbinfo.pitch != fb->pitches[0]);
-	WARN_ON_ONCE(fbinfo.base != bo->paddr + fb->offsets[0]);
-
-	/* If the CRTC is on (or going to be on) and we're enabled,
+			 state->crtc_w,
+			 state->crtc_h,
+			 mb->plane.src_x,
+			 mb->plane.src_y,
+			 mb->plane.src_w,
+			 mb->plane.src_h,
+			 mb->plane.planes[0],
+			 mb->plane.planes[1],
+			 mb->plane.planes[2],
+			 fb->pitches[0],
+			 state->alpha,
+			 state->normalized_zpos);
+
+	/*
+	 * Do NOT set now, as we haven't checked if the crtc is active or not.
+	 * Set from vc4_plane_set_blank instead.
+	 *
+	 * If the CRTC is on (or going to be on) and we're enabled,
 	 * then unblank.  Otherwise, stay blank until CRTC enable.
-	*/
+	 */
 	if (state->crtc->state->active)
-		vc4_plane_set_primary_blank(plane, false);
+		vc4_plane_set_blank(plane, false);
 }
 
-static void vc4_primary_plane_atomic_disable(struct drm_plane *plane,
-					     struct drm_plane_state *old_state)
+static void vc4_plane_atomic_disable(struct drm_plane *plane,
+				     struct drm_plane_state *old_state)
 {
-	vc4_plane_set_primary_blank(plane, true);
-}
-
-static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
-					   struct drm_plane_state *old_state)
-{
-	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	//struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
 	struct drm_plane_state *state = plane->state;
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(state->crtc);
-	struct drm_framebuffer *fb = state->fb;
-	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
-	dma_addr_t addr = bo->paddr + fb->offsets[0];
-	int ret;
-	u32 packet_state[] = {
-		state->crtc->state->active,
-		state->crtc_x,
-		state->crtc_y,
-		0
-	};
-	WARN_ON_ONCE(fb->pitches[0] != state->crtc_w * 4);
+	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
 
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] update %dx%d cursor at %d,%d (0x%pad/%d)",
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane disable %dx%d@%d +%d,%d\n",
 			 plane->base.id, plane->name,
 			 state->crtc_w,
 			 state->crtc_h,
+			 vc4_plane->mb.plane.vc_image_type,
 			 state->crtc_x,
-			 state->crtc_y,
-			 &addr,
-			 fb->pitches[0]);
-
-	/* add on the top/left offsets when overscan is active */
-	if (vc4_crtc) {
-		packet_state[1] += vc4_crtc->overscan[0];
-		packet_state[2] += vc4_crtc->overscan[1];
-	}
-
-	ret = rpi_firmware_property(vc4->firmware,
-				    RPI_FIRMWARE_SET_CURSOR_STATE,
-				    &packet_state,
-				    sizeof(packet_state));
-	if (ret || packet_state[0] != 0)
-		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
-
-	/* Note: When the cursor contents change, the modesetting
-	 * driver calls drm_mode_cursor_univeral() with
-	 * DRM_MODE_CURSOR_BO, which means a new fb will be allocated.
-	 */
-	if (!old_state ||
-	    state->crtc_w != old_state->crtc_w ||
-	    state->crtc_h != old_state->crtc_h ||
-	    fb != old_state->fb) {
-		u32 packet_info[] = { state->crtc_w, state->crtc_h,
-				      0, /* unused */
-				      addr,
-				      0, 0, /* hotx, hoty */};
-
-		ret = rpi_firmware_property(vc4->firmware,
-					    RPI_FIRMWARE_SET_CURSOR_INFO,
-					    &packet_info,
-					    sizeof(packet_info));
-		if (ret || packet_info[0] != 0)
-			DRM_ERROR("Failed to set cursor info: 0x%08x\n", packet_info[0]);
-	}
-}
-
-static void vc4_cursor_plane_atomic_disable(struct drm_plane *plane,
-					    struct drm_plane_state *old_state)
-{
-	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
-	u32 packet_state[] = { false, 0, 0, 0 };
-	int ret;
-
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] disabling cursor", plane->base.id, plane->name);
-
-	ret = rpi_firmware_property(vc4->firmware,
-				    RPI_FIRMWARE_SET_CURSOR_STATE,
-				    &packet_state,
-				    sizeof(packet_state));
-	if (ret || packet_state[0] != 0)
-		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
+			 state->crtc_y);
+	vc4_plane_set_blank(plane, true);
 }
 
 static int vc4_plane_atomic_check(struct drm_plane *plane,
@@ -301,6 +431,7 @@ static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
 	switch (format) {
 	case DRM_FORMAT_XRGB8888:
 	case DRM_FORMAT_ARGB8888:
+	case DRM_FORMAT_RGB565:
 		switch (modifier) {
 		case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
 		case DRM_FORMAT_MOD_LINEAR:
@@ -309,8 +440,22 @@ static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
 		default:
 			return false;
 		}
+	case DRM_FORMAT_NV12:
+	case DRM_FORMAT_NV21:
+		switch (fourcc_mod_broadcom_mod(modifier)) {
+		case DRM_FORMAT_MOD_LINEAR:
+		case DRM_FORMAT_MOD_BROADCOM_SAND128:
+			return true;
+		default:
+			return false;
+		}
+	case DRM_FORMAT_RGB888:
+	case DRM_FORMAT_BGR888:
+	case DRM_FORMAT_YUV422:
+	case DRM_FORMAT_YUV420:
+	case DRM_FORMAT_YVU420:
 	default:
-		return false;
+		return (modifier == DRM_FORMAT_MOD_LINEAR);
 	}
 }
 
@@ -325,31 +470,24 @@ static const struct drm_plane_funcs vc4_plane_funcs = {
 	.format_mod_supported = vc4_fkms_format_mod_supported,
 };
 
-static const struct drm_plane_helper_funcs vc4_primary_plane_helper_funcs = {
+static const struct drm_plane_helper_funcs vc4_plane_helper_funcs = {
 	.prepare_fb = drm_gem_fb_prepare_fb,
 	.cleanup_fb = NULL,
 	.atomic_check = vc4_plane_atomic_check,
-	.atomic_update = vc4_primary_plane_atomic_update,
-	.atomic_disable = vc4_primary_plane_atomic_disable,
-};
-
-static const struct drm_plane_helper_funcs vc4_cursor_plane_helper_funcs = {
-	.prepare_fb = drm_gem_fb_prepare_fb,
-	.cleanup_fb = NULL,
-	.atomic_check = vc4_plane_atomic_check,
-	.atomic_update = vc4_cursor_plane_atomic_update,
-	.atomic_disable = vc4_cursor_plane_atomic_disable,
+	.atomic_update = vc4_plane_atomic_update,
+	.atomic_disable = vc4_plane_atomic_disable,
 };
 
 static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
-					     enum drm_plane_type type)
+					     enum drm_plane_type type,
+					     u8 plane_id)
 {
-	/* Primary and cursor planes only */
 	struct drm_plane *plane = NULL;
 	struct vc4_fkms_plane *vc4_plane;
-	u32 formats[] = {DRM_FORMAT_ARGB8888, DRM_FORMAT_XRGB8888};
+	u32 formats[ARRAY_SIZE(vc_image_formats)];
+	unsigned int default_zpos;
+	u32 num_formats = 0;
 	int ret = 0;
-	bool primary = (type == DRM_PLANE_TYPE_PRIMARY);
 	static const uint64_t modifiers[] = {
 		DRM_FORMAT_MOD_LINEAR,
 		/* VC4_T_TILED should come after linear, because we
@@ -358,6 +496,7 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 		DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED,
 		DRM_FORMAT_MOD_INVALID,
 	};
+	int i;
 
 	vc4_plane = devm_kzalloc(dev->dev, sizeof(*vc4_plane),
 				 GFP_KERNEL);
@@ -366,19 +505,48 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 		goto fail;
 	}
 
+	for (i = 0; i < ARRAY_SIZE(vc_image_formats); i++)
+		formats[num_formats++] = vc_image_formats[i].drm;
+
 	plane = &vc4_plane->base;
 	ret = drm_universal_plane_init(dev, plane, 0xff,
 				       &vc4_plane_funcs,
-				       formats, primary ? 2 : 1, modifiers,
-				       type, primary ? "primary" : "cursor");
+				       formats, num_formats, modifiers,
+				       type, NULL);
 
-	if (type == DRM_PLANE_TYPE_PRIMARY)
-		drm_plane_helper_add(plane, &vc4_primary_plane_helper_funcs);
-	else
-		drm_plane_helper_add(plane, &vc4_cursor_plane_helper_funcs);
+	drm_plane_helper_add(plane, &vc4_plane_helper_funcs);
 
 	drm_plane_create_alpha_property(plane);
 
+	/*
+	 * Default frame buffer setup is with FB on -127, and raspistill etc
+	 * tend to drop overlays on layer 2. Cursor plane was on layer +127.
+	 *
+	 * For F-KMS the mailbox call allows for a s8.
+	 * Remap zpos 0 to -127 for the background layer, but leave all the
+	 * other layers as requested by KMS.
+	 */
+	switch (type) {
+	case DRM_PLANE_TYPE_PRIMARY:
+		default_zpos = 0;
+		break;
+	case DRM_PLANE_TYPE_OVERLAY:
+		default_zpos = 1;
+		break;
+	case DRM_PLANE_TYPE_CURSOR:
+		default_zpos = 2;
+		break;
+	}
+	drm_plane_create_zpos_property(plane, default_zpos, 0, 127);
+
+	/* Prepare the static elements of the mailbox structure */
+	vc4_plane->mb.tag.tag = RPI_FIRMWARE_SET_PLANE;
+	vc4_plane->mb.tag.buf_size = sizeof(struct set_plane);
+	vc4_plane->mb.tag.req_resp_size = 0;
+	vc4_plane->mb.plane.display = 0;
+	vc4_plane->mb.plane.plane_id = plane_id;
+	vc4_plane->mb.plane.layer = default_zpos ? default_zpos : -127;
+
 	return plane;
 fail:
 	if (plane)
@@ -400,19 +568,23 @@ static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_s
 	 * whether anything scans out at all, but the firmware doesn't
 	 * give us a CRTC-level control for that.
 	 */
-	vc4_cursor_plane_atomic_disable(crtc->cursor, crtc->cursor->state);
-	vc4_plane_set_primary_blank(crtc->primary, true);
+
+	vc4_plane_atomic_disable(crtc->cursor, crtc->cursor->state);
+	vc4_plane_atomic_disable(crtc->primary, crtc->primary->state);
+
+	/* FIXME: Disable overlay planes */
 }
 
 static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
 	/* Unblank the planes (if they're supposed to be displayed). */
+
 	if (crtc->primary->state->fb)
-		vc4_plane_set_primary_blank(crtc->primary, false);
-	if (crtc->cursor->state->fb) {
-		vc4_cursor_plane_atomic_update(crtc->cursor,
-					       crtc->cursor->state);
-	}
+		vc4_plane_set_blank(crtc->primary, false);
+	if (crtc->cursor->state->fb)
+		vc4_plane_set_blank(crtc->cursor, crtc->cursor->state);
+
+	/* FIXME: Enable overlay planes */
 }
 
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
@@ -672,8 +844,10 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	struct vc4_crtc *vc4_crtc;
 	struct vc4_fkms_encoder *vc4_encoder;
 	struct drm_crtc *crtc;
-	struct drm_plane *primary_plane, *cursor_plane, *destroy_plane, *temp;
+	struct drm_plane *primary_plane, *overlay_plane, *cursor_plane;
+	struct drm_plane *destroy_plane, *temp;
 	struct device_node *firmware_node;
+	u32 blank = 1;
 	int ret;
 
 	vc4->firmware_kms = true;
@@ -702,20 +876,26 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	if (IS_ERR(vc4_crtc->regs))
 		return PTR_ERR(vc4_crtc->regs);
 
-	/* For now, we create just the primary and the legacy cursor
-	 * planes.  We should be able to stack more planes on easily,
-	 * but to do that we would need to compute the bandwidth
-	 * requirement of the plane configuration, and reject ones
-	 * that will take too much.
-	 */
-	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY);
+	/* Blank the firmware provided framebuffer */
+	rpi_firmware_property(vc4->firmware,
+			      RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+			      &blank, sizeof(blank));
+
+	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY, 0);
 	if (IS_ERR(primary_plane)) {
 		dev_err(dev, "failed to construct primary plane\n");
 		ret = PTR_ERR(primary_plane);
 		goto err;
 	}
 
-	cursor_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_CURSOR);
+	overlay_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_OVERLAY, 1);
+	if (IS_ERR(overlay_plane)) {
+		dev_err(dev, "failed to construct overlay plane\n");
+		ret = PTR_ERR(overlay_plane);
+		goto err;
+	}
+
+	cursor_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_CURSOR, 2);
 	if (IS_ERR(cursor_plane)) {
 		dev_err(dev, "failed to construct cursor plane\n");
 		ret = PTR_ERR(cursor_plane);
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 432f9daa676c4..a16d9822abd1d 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -435,6 +435,7 @@ int vc4_kms_load(struct drm_device *dev)
 	dev->mode_config.preferred_depth = 24;
 	dev->mode_config.async_page_flip = true;
 	dev->mode_config.allow_fb_modifiers = true;
+	dev->mode_config.normalize_zpos = true;
 
 	drm_modeset_lock_init(&vc4->ctm_state_lock);
 
diff --git a/drivers/gpu/drm/vc4/vc_image_types.h b/drivers/gpu/drm/vc4/vc_image_types.h
new file mode 100644
index 0000000000000..669a70fdb8913
--- /dev/null
+++ b/drivers/gpu/drm/vc4/vc_image_types.h
@@ -0,0 +1,143 @@
+
+/*
+ * Copyright (c) 2012, Broadcom Europe Ltd
+ *
+ * Values taken from vc_image_types.h released by Broadcom at
+ * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_types.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+enum {
+	VC_IMAGE_MIN = 0, //bounds for error checking
+
+	VC_IMAGE_RGB565 = 1,
+	VC_IMAGE_1BPP,
+	VC_IMAGE_YUV420,
+	VC_IMAGE_48BPP,
+	VC_IMAGE_RGB888,
+	VC_IMAGE_8BPP,
+	/* 4bpp palettised image */
+	VC_IMAGE_4BPP,
+	/* A separated format of 16 colour/light shorts followed by 16 z
+	 * values
+	 */
+	VC_IMAGE_3D32,
+	/* 16 colours followed by 16 z values */
+	VC_IMAGE_3D32B,
+	/* A separated format of 16 material/colour/light shorts followed by
+	 * 16 z values
+	 */
+	VC_IMAGE_3D32MAT,
+	/* 32 bit format containing 18 bits of 6.6.6 RGB, 9 bits per short */
+	VC_IMAGE_RGB2X9,
+	/* 32-bit format holding 18 bits of 6.6.6 RGB */
+	VC_IMAGE_RGB666,
+	/* 4bpp palettised image with embedded palette */
+	VC_IMAGE_PAL4_OBSOLETE,
+	/* 8bpp palettised image with embedded palette */
+	VC_IMAGE_PAL8_OBSOLETE,
+	/* RGB888 with an alpha byte after each pixel */
+	VC_IMAGE_RGBA32,
+	/* a line of Y (32-byte padded), a line of U (16-byte padded), and a
+	 * line of V (16-byte padded)
+	 */
+	VC_IMAGE_YUV422,
+	/* RGB565 with a transparent patch */
+	VC_IMAGE_RGBA565,
+	/* Compressed (4444) version of RGBA32 */
+	VC_IMAGE_RGBA16,
+	/* VCIII codec format */
+	VC_IMAGE_YUV_UV,
+	/* VCIII T-format RGBA8888 */
+	VC_IMAGE_TF_RGBA32,
+	/* VCIII T-format RGBx8888 */
+	VC_IMAGE_TF_RGBX32,
+	/* VCIII T-format float */
+	VC_IMAGE_TF_FLOAT,
+	/* VCIII T-format RGBA4444 */
+	VC_IMAGE_TF_RGBA16,
+	/* VCIII T-format RGB5551 */
+	VC_IMAGE_TF_RGBA5551,
+	/* VCIII T-format RGB565 */
+	VC_IMAGE_TF_RGB565,
+	/* VCIII T-format 8-bit luma and 8-bit alpha */
+	VC_IMAGE_TF_YA88,
+	/* VCIII T-format 8 bit generic sample */
+	VC_IMAGE_TF_BYTE,
+	/* VCIII T-format 8-bit palette */
+	VC_IMAGE_TF_PAL8,
+	/* VCIII T-format 4-bit palette */
+	VC_IMAGE_TF_PAL4,
+	/* VCIII T-format Ericsson Texture Compressed */
+	VC_IMAGE_TF_ETC1,
+	/* RGB888 with R & B swapped */
+	VC_IMAGE_BGR888,
+	/* RGB888 with R & B swapped, but with no pitch, i.e. no padding after
+	 * each row of pixels
+	 */
+	VC_IMAGE_BGR888_NP,
+	/* Bayer image, extra defines which variant is being used */
+	VC_IMAGE_BAYER,
+	/* General wrapper for codec images e.g. JPEG from camera */
+	VC_IMAGE_CODEC,
+	/* VCIII codec format */
+	VC_IMAGE_YUV_UV32,
+	/* VCIII T-format 8-bit luma */
+	VC_IMAGE_TF_Y8,
+	/* VCIII T-format 8-bit alpha */
+	VC_IMAGE_TF_A8,
+	/* VCIII T-format 16-bit generic sample */
+	VC_IMAGE_TF_SHORT,
+	/* VCIII T-format 1bpp black/white */
+	VC_IMAGE_TF_1BPP,
+	VC_IMAGE_OPENGL,
+	/* VCIII-B0 HVS YUV 4:4:4 interleaved samples */
+	VC_IMAGE_YUV444I,
+	/* Y, U, & V planes separately (VC_IMAGE_YUV422 has them interleaved on
+	 * a per line basis)
+	 */
+	VC_IMAGE_YUV422PLANAR,
+	/* 32bpp with 8bit alpha at MS byte, with R, G, B (LS byte) */
+	VC_IMAGE_ARGB8888,
+	/* 32bpp with 8bit unused at MS byte, with R, G, B (LS byte) */
+	VC_IMAGE_XRGB8888,
+
+	/* interleaved 8 bit samples of Y, U, Y, V (4 flavours) */
+	VC_IMAGE_YUV422YUYV,
+	VC_IMAGE_YUV422YVYU,
+	VC_IMAGE_YUV422UYVY,
+	VC_IMAGE_YUV422VYUY,
+
+	/* 32bpp like RGBA32 but with unused alpha */
+	VC_IMAGE_RGBX32,
+	/* 32bpp, corresponding to RGBA with unused alpha */
+	VC_IMAGE_RGBX8888,
+	/* 32bpp, corresponding to BGRA with unused alpha */
+	VC_IMAGE_BGRX8888,
+
+	/* Y as a plane, then UV byte interleaved in plane with with same pitch,
+	 * half height
+	 */
+	VC_IMAGE_YUV420SP,
+
+	/* Y, U, & V planes separately 4:4:4 */
+	VC_IMAGE_YUV444PLANAR,
+
+	/* T-format 8-bit U - same as TF_Y8 buf from U plane */
+	VC_IMAGE_TF_U8,
+	/* T-format 8-bit U - same as TF_Y8 buf from V plane */
+	VC_IMAGE_TF_V8,
+
+	/* YUV4:2:0 planar, 16bit values */
+	VC_IMAGE_YUV420_16,
+	/* YUV4:2:0 codec format, 16bit values */
+	VC_IMAGE_YUV_UV_16,
+	/* YUV4:2:0 with U,V in side-by-side format */
+	VC_IMAGE_YUV420_S,
+
+	VC_IMAGE_MAX,     /* bounds for error checking */
+	VC_IMAGE_FORCE_ENUM_16BIT = 0xffff,
+};
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index b54035b15b57f..025550ab2c769 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -148,6 +148,8 @@ enum rpi_firmware_property_tag {
 
 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
 
+	RPI_FIRMWARE_SET_PLANE =                              0x00048015,
+
 	RPI_FIRMWARE_GET_COMMAND_LINE =                       0x00050001,
 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
 };
-- 
GitLab


From d65bb322a65128c4381e8e4bd3d62454ba917b44 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 3 Apr 2019 15:20:05 +0100
Subject: [PATCH 0604/1835] drm: vc4: Increase max screen size to 4096x4096.

We now should support 4k screens, therefore this limit needs to
be increased.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index a16d9822abd1d..a5dcfe38ffeac 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -429,8 +429,8 @@ int vc4_kms_load(struct drm_device *dev)
 		return ret;
 	}
 
-	dev->mode_config.max_width = 2048;
-	dev->mode_config.max_height = 2048;
+	dev->mode_config.max_width = 4096;
+	dev->mode_config.max_height = 4096;
 	dev->mode_config.funcs = &vc4_mode_funcs;
 	dev->mode_config.preferred_depth = 24;
 	dev->mode_config.async_page_flip = true;
-- 
GitLab


From 798ace8bcba09936f605edce998435b7a935b78d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 3 Apr 2019 17:15:45 +0100
Subject: [PATCH 0605/1835] drm: vc4: Add support for multiple displays to fkms

There is a slightly nasty hack in that all crtcs share the
same SMI interrupt from the firmware. This seems to currently
work well enough, but ought to be fixed at a later date.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 160 +++++++++++++++++--------
 1 file changed, 113 insertions(+), 47 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index ccfe72926f5a9..79d21efafa696 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -29,6 +29,8 @@
 #include "vc_image_types.h"
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
+#define PLANES_PER_CRTC		3
+
 struct set_plane {
 	u8 display;
 	u8 plane_id;
@@ -175,6 +177,7 @@ struct vc4_crtc {
 	struct drm_pending_vblank_event *event;
 	u32 overscan[4];
 	bool vblank_enabled;
+	u32 display_number;
 };
 
 static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
@@ -480,6 +483,7 @@ static const struct drm_plane_helper_funcs vc4_plane_helper_funcs = {
 
 static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 					     enum drm_plane_type type,
+					     u8 display_num,
 					     u8 plane_id)
 {
 	struct drm_plane *plane = NULL;
@@ -543,7 +547,7 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	vc4_plane->mb.tag.tag = RPI_FIRMWARE_SET_PLANE;
 	vc4_plane->mb.tag.buf_size = sizeof(struct set_plane);
 	vc4_plane->mb.tag.req_resp_size = 0;
-	vc4_plane->mb.plane.display = 0;
+	vc4_plane->mb.plane.display = display_num;
 	vc4_plane->mb.plane.plane_id = plane_id;
 	vc4_plane->mb.plane.layer = default_zpos ? default_zpos : -127;
 
@@ -630,16 +634,20 @@ static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
 
 static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 {
-	struct vc4_crtc *vc4_crtc = data;
-	u32 stat = readl(vc4_crtc->regs + SMICS);
+	struct vc4_crtc **crtc_list = data;
+	int i;
+	u32 stat = readl(crtc_list[0]->regs + SMICS);
 	irqreturn_t ret = IRQ_NONE;
 
 	if (stat & SMICS_INTERRUPTS) {
-		writel(0, vc4_crtc->regs + SMICS);
-		if (vc4_crtc->vblank_enabled)
-			drm_crtc_handle_vblank(&vc4_crtc->base);
-		vc4_crtc_handle_page_flip(vc4_crtc);
-		ret = IRQ_HANDLED;
+		writel(0, crtc_list[0]->regs + SMICS);
+
+		for (i = 0; crtc_list[i]; i++) {
+			if (crtc_list[i]->vblank_enabled)
+				drm_crtc_handle_vblank(&crtc_list[i]->base);
+			vc4_crtc_handle_page_flip(crtc_list[i]);
+			ret = IRQ_HANDLED;
+		}
 	}
 
 	return ret;
@@ -836,66 +844,55 @@ static const struct drm_encoder_helper_funcs vc4_fkms_encoder_helper_funcs = {
 	.disable = vc4_fkms_encoder_disable,
 };
 
-static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
+static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
+				  int display_idx, int display_ref,
+				  struct vc4_crtc **ret_crtc)
 {
-	struct platform_device *pdev = to_platform_device(dev);
-	struct drm_device *drm = dev_get_drvdata(master);
 	struct vc4_dev *vc4 = to_vc4_dev(drm);
 	struct vc4_crtc *vc4_crtc;
 	struct vc4_fkms_encoder *vc4_encoder;
 	struct drm_crtc *crtc;
 	struct drm_plane *primary_plane, *overlay_plane, *cursor_plane;
 	struct drm_plane *destroy_plane, *temp;
-	struct device_node *firmware_node;
 	u32 blank = 1;
 	int ret;
 
-	vc4->firmware_kms = true;
-
-	/* firmware kms doesn't have precise a scanoutpos implementation, so
-	 * we can't do the precise vblank timestamp mode.
-	 */
-	drm->driver->get_scanout_position = NULL;
-	drm->driver->get_vblank_timestamp = NULL;
-
 	vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
 	if (!vc4_crtc)
 		return -ENOMEM;
 	crtc = &vc4_crtc->base;
 
-	firmware_node = of_parse_phandle(dev->of_node, "brcm,firmware", 0);
-	vc4->firmware = rpi_firmware_get(firmware_node);
-	if (!vc4->firmware) {
-		DRM_DEBUG("Failed to get Raspberry Pi firmware reference.\n");
-		return -EPROBE_DEFER;
-	}
-	of_node_put(firmware_node);
-
-	/* Map the SMI interrupt reg */
-	vc4_crtc->regs = vc4_ioremap_regs(pdev, 0);
-	if (IS_ERR(vc4_crtc->regs))
-		return PTR_ERR(vc4_crtc->regs);
+	vc4_crtc->display_number = display_ref;
 
 	/* Blank the firmware provided framebuffer */
 	rpi_firmware_property(vc4->firmware,
 			      RPI_FIRMWARE_FRAMEBUFFER_BLANK,
 			      &blank, sizeof(blank));
 
-	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY, 0);
+	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY,
+					    display_ref,
+					    0 + (display_idx * PLANES_PER_CRTC)
+					   );
 	if (IS_ERR(primary_plane)) {
 		dev_err(dev, "failed to construct primary plane\n");
 		ret = PTR_ERR(primary_plane);
 		goto err;
 	}
 
-	overlay_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_OVERLAY, 1);
+	overlay_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_OVERLAY,
+					    display_ref,
+					    1 + (display_idx * PLANES_PER_CRTC)
+					   );
 	if (IS_ERR(overlay_plane)) {
 		dev_err(dev, "failed to construct overlay plane\n");
 		ret = PTR_ERR(overlay_plane);
 		goto err;
 	}
 
-	cursor_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_CURSOR, 2);
+	cursor_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_CURSOR,
+					   display_ref,
+					   2 + (display_idx * PLANES_PER_CRTC)
+					  );
 	if (IS_ERR(cursor_plane)) {
 		dev_err(dev, "failed to construct cursor plane\n");
 		ret = PTR_ERR(cursor_plane);
@@ -922,13 +919,6 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 		goto err_destroy_encoder;
 	}
 
-	writel(0, vc4_crtc->regs + SMICS);
-	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
-			       vc4_crtc_irq_handler, 0, "vc4 firmware kms",
-			       vc4_crtc);
-	if (ret)
-		goto err_destroy_connector;
-
 	ret = rpi_firmware_property(vc4->firmware,
 				    RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN,
 				    &vc4_crtc->overscan,
@@ -938,7 +928,7 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 		memset(&vc4_crtc->overscan, 0, sizeof(vc4_crtc->overscan));
 	}
 
-	platform_set_drvdata(pdev, vc4_crtc);
+	*ret_crtc = vc4_crtc;
 
 	return 0;
 
@@ -955,15 +945,91 @@ err:
 	return ret;
 }
 
+static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct drm_device *drm = dev_get_drvdata(master);
+	struct vc4_dev *vc4 = to_vc4_dev(drm);
+	struct device_node *firmware_node;
+	struct vc4_crtc **crtc_list;
+	u32 num_displays, display_num;
+	int ret;
+	const u32 display_num_lookup[] = {2, 7, 1};
+
+	vc4->firmware_kms = true;
+
+	/* firmware kms doesn't have precise a scanoutpos implementation, so
+	 * we can't do the precise vblank timestamp mode.
+	 */
+	drm->driver->get_scanout_position = NULL;
+	drm->driver->get_vblank_timestamp = NULL;
+
+	firmware_node = of_parse_phandle(dev->of_node, "brcm,firmware", 0);
+	vc4->firmware = rpi_firmware_get(firmware_node);
+	if (!vc4->firmware) {
+		DRM_DEBUG("Failed to get Raspberry Pi firmware reference.\n");
+		return -EPROBE_DEFER;
+	}
+	of_node_put(firmware_node);
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
+				    &num_displays, sizeof(u32));
+
+	/* If we fail to get the number of displays, or it returns 0, then
+	 * assume old firmware that doesn't have the mailbox call, so just
+	 * set one display
+	 */
+	if (ret || num_displays == 0) {
+		num_displays = 1;
+		DRM_WARN("Unable to determine number of displays's. Assuming 1\n");
+		ret = 0;
+	}
+
+	/* Allocate a list, with space for a NULL on the end */
+	crtc_list = devm_kzalloc(dev, sizeof(crtc_list) * (num_displays + 1),
+				 GFP_KERNEL);
+	if (!crtc_list)
+		return -ENOMEM;
+
+	for (display_num = 0; display_num < num_displays; display_num++) {
+		ret = vc4_fkms_create_screen(dev, drm, display_num,
+					     display_num_lookup[display_num],
+					     &crtc_list[display_num]);
+		if (ret)
+			DRM_ERROR("Oh dear, failed to create display %u\n",
+				  display_num);
+	}
+
+	/* Map the SMI interrupt reg */
+	crtc_list[0]->regs = vc4_ioremap_regs(pdev, 0);
+	if (IS_ERR(crtc_list[0]->regs))
+		DRM_ERROR("Oh dear, failed to map registers\n");
+
+	writel(0, crtc_list[0]->regs + SMICS);
+	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+			       vc4_crtc_irq_handler, 0, "vc4 firmware kms",
+			       crtc_list);
+	if (ret)
+		DRM_ERROR("Oh dear, failed to register IRQ\n");
+
+	platform_set_drvdata(pdev, crtc_list);
+
+	return 0;
+}
+
 static void vc4_fkms_unbind(struct device *dev, struct device *master,
 			    void *data)
 {
 	struct platform_device *pdev = to_platform_device(dev);
-	struct vc4_crtc *vc4_crtc = dev_get_drvdata(dev);
+	struct vc4_crtc **crtc_list = dev_get_drvdata(dev);
+	int i;
 
-	vc4_fkms_connector_destroy(vc4_crtc->connector);
-	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
-	drm_crtc_cleanup(&vc4_crtc->base);
+	for (i = 0; crtc_list[i]; i++) {
+		vc4_fkms_connector_destroy(crtc_list[i]->connector);
+		vc4_fkms_encoder_destroy(crtc_list[i]->encoder);
+		drm_crtc_cleanup(&crtc_list[i]->base);
+	}
 
 	platform_set_drvdata(pdev, NULL);
 }
-- 
GitLab


From 6daf6ba6a766d585b6e7256b472aa70146e79a21 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 5 Apr 2019 17:21:56 +0100
Subject: [PATCH 0606/1835] drm: vc4: Fix build warning

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 79d21efafa696..408a34122f046 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -932,8 +932,6 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 
 	return 0;
 
-err_destroy_connector:
-	vc4_fkms_connector_destroy(vc4_crtc->connector);
 err_destroy_encoder:
 	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
 	list_for_each_entry_safe(destroy_plane, temp,
-- 
GitLab


From 9f7bc733a8381facdd4ae4c44a11cd735333d245 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 5 Apr 2019 17:23:15 +0100
Subject: [PATCH 0607/1835] drm: vc4: Select display to blank during
 initialisation

Otherwise the rainbow splash screen remained in the display list

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 408a34122f046..45636bd69b541 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -87,6 +87,13 @@ struct fb_alloc_tags {
 	u32 layer;
 };
 
+struct mailbox_blank_display {
+	struct rpi_firmware_property_tag_header tag1;
+	u32 display;
+	struct rpi_firmware_property_tag_header tag2;
+	u32 blank;
+};
+
 static const struct vc_image_format {
 	u32 drm;	/* DRM_FORMAT_* */
 	u32 vc_image;	/* VC_IMAGE_* */
@@ -854,7 +861,12 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 	struct drm_crtc *crtc;
 	struct drm_plane *primary_plane, *overlay_plane, *cursor_plane;
 	struct drm_plane *destroy_plane, *temp;
-	u32 blank = 1;
+	struct mailbox_blank_display blank = {
+		.tag1 = {RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM, 4, 0, },
+		.display = display_idx,
+		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_BLANK, 4, 0, },
+		.blank = 1,
+	};
 	int ret;
 
 	vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
@@ -865,9 +877,7 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 	vc4_crtc->display_number = display_ref;
 
 	/* Blank the firmware provided framebuffer */
-	rpi_firmware_property(vc4->firmware,
-			      RPI_FIRMWARE_FRAMEBUFFER_BLANK,
-			      &blank, sizeof(blank));
+	rpi_firmware_property_list(vc4->firmware, &blank, sizeof(blank));
 
 	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY,
 					    display_ref,
-- 
GitLab


From 5b49bd791a7afee0afa0fe1cbfffbd5c54639f7f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 5 Apr 2019 17:24:20 +0100
Subject: [PATCH 0608/1835] drm: vc4: Remove now unused structure.

Cleaning up structure that was unused after
fbb59a2 drm: vc4: Add an overlay plane to vc4-firmware-kms

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 45636bd69b541..24dfda3129b17 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -68,25 +68,6 @@ struct mailbox_set_plane {
 	struct set_plane plane;
 };
 
-struct fb_alloc_tags {
-	struct rpi_firmware_property_tag_header tag1;
-	u32 xres, yres;
-	struct rpi_firmware_property_tag_header tag2;
-	u32 xres_virtual, yres_virtual;
-	struct rpi_firmware_property_tag_header tag3;
-	u32 bpp;
-	struct rpi_firmware_property_tag_header tag4;
-	u32 xoffset, yoffset;
-	struct rpi_firmware_property_tag_header tag5;
-	u32 base, screen_size;
-	struct rpi_firmware_property_tag_header tag6;
-	u32 pitch;
-	struct rpi_firmware_property_tag_header tag7;
-	u32 alpha_mode;
-	struct rpi_firmware_property_tag_header tag8;
-	u32 layer;
-};
-
 struct mailbox_blank_display {
 	struct rpi_firmware_property_tag_header tag1;
 	u32 display;
-- 
GitLab


From 478cc7e3da7eace420d752f24f7e74416a131867 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 9 Apr 2019 12:37:28 +0100
Subject: [PATCH 0609/1835] drm: vc4: Query the display ID for each display in
 FKMS

Replace the hard coded list of display IDs for a mailbox call
that returns the display ID for each display that has been
detected.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c     | 16 +++++++++++++---
 include/soc/bcm2835/raspberrypi-firmware.h |  1 +
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 24dfda3129b17..56484046ead29 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -943,7 +943,7 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	struct vc4_crtc **crtc_list;
 	u32 num_displays, display_num;
 	int ret;
-	const u32 display_num_lookup[] = {2, 7, 1};
+	u32 display_id;
 
 	vc4->firmware_kms = true;
 
@@ -982,8 +982,18 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 		return -ENOMEM;
 
 	for (display_num = 0; display_num < num_displays; display_num++) {
-		ret = vc4_fkms_create_screen(dev, drm, display_num,
-					     display_num_lookup[display_num],
+		display_id = display_num;
+		ret = rpi_firmware_property(vc4->firmware,
+					    RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID,
+					    &display_id, sizeof(display_id));
+		/* FIXME: Determine the correct error handling here.
+		 * Should we fail to create the one "screen" but keep the
+		 * others, or fail the whole thing?
+		 */
+		if (ret)
+			DRM_ERROR("Failed to get display id %u\n", display_num);
+
+		ret = vc4_fkms_create_screen(dev, drm, display_num, display_id,
 					     &crtc_list[display_num]);
 		if (ret)
 			DRM_ERROR("Oh dear, failed to create display %u\n",
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 025550ab2c769..5d55d1d7105a0 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -117,6 +117,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF =               0x0004000f,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF =            0x00040010,
 	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_ID =             0x00040016,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM =            0x00048013,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS =           0x00040013,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS =       0x00040014,
-- 
GitLab


From be92da644d5dee3b9f396396e352913fd85817f6 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 9 Apr 2019 14:00:07 +0100
Subject: [PATCH 0610/1835] drm/vc4: Set the display number when querying the
 display resolution

Without this the two displays got set to the same resolution.
(Requires a firmware bug fix to work).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 37 +++++++++++++++++++-------
 1 file changed, 27 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 56484046ead29..88844a9ffce9e 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -75,6 +75,13 @@ struct mailbox_blank_display {
 	u32 blank;
 };
 
+struct mailbox_get_width_height {
+	struct rpi_firmware_property_tag_header tag1;
+	u32 display;
+	struct rpi_firmware_property_tag_header tag2;
+	u32 wh[2];
+};
+
 static const struct vc_image_format {
 	u32 drm;	/* DRM_FORMAT_* */
 	u32 vc_image;	/* VC_IMAGE_* */
@@ -192,6 +199,7 @@ struct vc4_fkms_connector {
 	 * hook.
 	 */
 	struct drm_encoder *encoder;
+	u32 display_idx;
 };
 
 static inline struct vc4_fkms_connector *
@@ -723,21 +731,27 @@ vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
 static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
 {
 	struct drm_device *dev = connector->dev;
+	struct vc4_fkms_connector *fkms_connector =
+		to_vc4_fkms_connector(connector);
 	struct vc4_dev *vc4 = to_vc4_dev(dev);
-	u32 wh[2] = {0, 0};
-	int ret;
 	struct drm_display_mode *mode;
+	struct mailbox_get_width_height wh = {
+		.tag1 = {RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM, 4, 0, },
+		.display = fkms_connector->display_idx,
+		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT,
+			  8, 0, },
+	};
+	int ret;
+
+	ret = rpi_firmware_property_list(vc4->firmware, &wh, sizeof(wh));
 
-	ret = rpi_firmware_property(vc4->firmware,
-				    RPI_FIRMWARE_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT,
-				    &wh, sizeof(wh));
 	if (ret) {
 		DRM_ERROR("Failed to get screen size: %d (0x%08x 0x%08x)\n",
-			  ret, wh[0], wh[1]);
+			  ret, wh.wh[0], wh.wh[1]);
 		return 0;
 	}
 
-	mode = drm_cvt_mode(dev, wh[0], wh[1], 60 /* vrefresh */,
+	mode = drm_cvt_mode(dev, wh.wh[0], wh.wh[1], 60 /* vrefresh */,
 			    0, 0, false);
 	drm_mode_probed_add(connector, mode);
 
@@ -772,8 +786,9 @@ static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs =
 	.best_encoder = vc4_fkms_connector_best_encoder,
 };
 
-static struct drm_connector *vc4_fkms_connector_init(struct drm_device *dev,
-						     struct drm_encoder *encoder)
+static struct drm_connector *
+vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
+			u32 display_idx)
 {
 	struct drm_connector *connector = NULL;
 	struct vc4_fkms_connector *fkms_connector;
@@ -788,6 +803,7 @@ static struct drm_connector *vc4_fkms_connector_init(struct drm_device *dev,
 	connector = &fkms_connector->base;
 
 	fkms_connector->encoder = encoder;
+	fkms_connector->display_idx = display_idx;
 
 	drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
 			   DRM_MODE_CONNECTOR_HDMIA);
@@ -904,7 +920,8 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 	drm_encoder_helper_add(&vc4_encoder->base,
 			       &vc4_fkms_encoder_helper_funcs);
 
-	vc4_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base);
+	vc4_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base,
+						      display_idx);
 	if (IS_ERR(vc4_crtc->connector)) {
 		ret = PTR_ERR(vc4_crtc->connector);
 		goto err_destroy_encoder;
-- 
GitLab


From 77db9bd6daa52708b5d3bdd1093581d7ceb5df2c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 9 Apr 2019 18:14:44 +0100
Subject: [PATCH 0611/1835] drm: vc4: Need to call drm_crtc_vblank_[on|off]
 from vc4_crtc_[en|dis]able

vblank needs to be enabled and disabled by the driver to avoid the
DRM framework complaining in the kernel log.

vc4_fkms_disable_vblank needs to signal that we don't want vblank
callbacks too.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 88844a9ffce9e..adadf4d253b0d 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -562,6 +562,8 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	drm_crtc_vblank_off(crtc);
+
 	/* Always turn the planes off on CRTC disable. In DRM, planes
 	 * are enabled/disabled through the update/disable hooks
 	 * above, and the CRTC enable/disable independently controls
@@ -577,6 +579,7 @@ static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_s
 
 static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	drm_crtc_vblank_on(crtc);
 	/* Unblank the planes (if they're supposed to be displayed). */
 
 	if (crtc->primary->state->fb)
@@ -673,6 +676,9 @@ static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
 
 static void vc4_fkms_disable_vblank(struct drm_crtc *crtc)
 {
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+
+	vc4_crtc->vblank_enabled = false;
 }
 
 static const struct drm_crtc_funcs vc4_crtc_funcs = {
-- 
GitLab


From 0d67b2e2218753eb15c0221194513d4f01a9585f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 9 Apr 2019 17:19:51 +0100
Subject: [PATCH 0612/1835] drm: vc4: Add support for H & V flips on each plane
 for FKMS

They are near zero cost options for the HVS, therefore they
may as well be implemented, and it allows us to invert the
DSI display.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 36 ++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index adadf4d253b0d..06865d45ba1d2 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -61,8 +61,21 @@ struct set_plane {
 	u8 padding;
 
 	u32 planes[4];  /* DMA address of each plane */
+
+	u32 transform;
 };
 
+/* Values for the transform field */
+#define TRANSFORM_NO_ROTATE	0
+#define TRANSFORM_ROTATE_180	BIT(1)
+#define TRANSFORM_FLIP_HRIZ	BIT(16)
+#define TRANSFORM_FLIP_VERT	BIT(17)
+
+#define SUPPORTED_ROTATIONS	(DRM_MODE_ROTATE_0 | \
+				 DRM_MODE_ROTATE_180 | \
+				 DRM_MODE_REFLECT_X | \
+				 DRM_MODE_REFLECT_Y)
+
 struct mailbox_set_plane {
 	struct rpi_firmware_property_tag_header tag;
 	struct set_plane plane;
@@ -274,6 +287,7 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(state->crtc);
 	int num_planes = fb->format->num_planes;
 	struct drm_display_mode *mode = &state->crtc->mode;
+	unsigned int rotation = SUPPORTED_ROTATIONS;
 
 	mb->plane.vc_image_type = vc_fmt->vc_image;
 	mb->plane.width = fb->width;
@@ -294,6 +308,24 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 	mb->plane.is_vu = vc_fmt->is_vu;
 	mb->plane.planes[0] = bo->paddr + fb->offsets[0];
 
+	rotation = drm_rotation_simplify(state->rotation, rotation);
+
+	switch (rotation) {
+	default:
+	case DRM_MODE_ROTATE_0:
+		mb->plane.transform = TRANSFORM_NO_ROTATE;
+		break;
+	case DRM_MODE_ROTATE_180:
+		mb->plane.transform = TRANSFORM_ROTATE_180;
+		break;
+	case DRM_MODE_REFLECT_X:
+		mb->plane.transform = TRANSFORM_FLIP_HRIZ;
+		break;
+	case DRM_MODE_REFLECT_Y:
+		mb->plane.transform = TRANSFORM_FLIP_VERT;
+		break;
+	}
+
 	/* FIXME: If the dest rect goes off screen then clip the src rect so we
 	 * don't have off-screen pixels.
 	 */
@@ -514,9 +546,13 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 				       formats, num_formats, modifiers,
 				       type, NULL);
 
+	/* FIXME: Do we need to be checking return values from all these calls?
+	 */
 	drm_plane_helper_add(plane, &vc4_plane_helper_funcs);
 
 	drm_plane_create_alpha_property(plane);
+	drm_plane_create_rotation_property(plane, DRM_MODE_ROTATE_0,
+					   SUPPORTED_ROTATIONS);
 
 	/*
 	 * Default frame buffer setup is with FB on -127, and raspistill etc
-- 
GitLab


From 4fc20cfb6c971d23aac31682206e5d6418ed4405 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 10 Apr 2019 17:35:05 +0100
Subject: [PATCH 0613/1835] drm: vc4: Remove unused vc4_fkms_cancel_page_flip
 function

"32a3dbe drm/vc4: Nuke preclose hook" removed vc4_cancel_page_flip,
but vc4_fkms_cancel_page_flip was still be added to with the
fkms driver, even though it was never called.
Nuke it too.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_drv.h          |  1 -
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 20 --------------------
 2 files changed, 21 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index b4c3bc982d32e..6ab999a03914c 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -724,7 +724,6 @@ extern const struct dma_fence_ops vc4_fence_ops;
 
 /* vc4_firmware_kms.c */
 extern struct platform_driver vc4_firmware_kms_driver;
-void vc4_fkms_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file);
 
 /* vc4_gem.c */
 void vc4_gem_init(struct drm_device *dev);
diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 06865d45ba1d2..d22e25426b37c 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -739,26 +739,6 @@ static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
 	.atomic_flush = vc4_crtc_atomic_flush,
 };
 
-/* Frees the page flip event when the DRM device is closed with the
- * event still outstanding.
- */
-void vc4_fkms_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
-{
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
-	struct drm_device *dev = crtc->dev;
-	unsigned long flags;
-
-	spin_lock_irqsave(&dev->event_lock, flags);
-
-	if (vc4_crtc->event && vc4_crtc->event->base.file_priv == file) {
-		kfree(&vc4_crtc->event->base);
-		drm_crtc_vblank_put(crtc);
-		vc4_crtc->event = NULL;
-	}
-
-	spin_unlock_irqrestore(&dev->event_lock, flags);
-}
-
 static const struct of_device_id vc4_firmware_kms_dt_match[] = {
 	{ .compatible = "raspberrypi,rpi-firmware-kms" },
 	{}
-- 
GitLab


From 068dfbe33ce302bde78aa2232743f1428a2e9739 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 10 Apr 2019 17:42:37 +0100
Subject: [PATCH 0614/1835] drm: vc4: Iterate over all planes in
 vc4_crtc_[dis|en]able

Fixes a FIXME where the overlay plane wouldn't be restored.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index d22e25426b37c..0bfc4f54d4cc8 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -598,6 +598,8 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	struct drm_plane *plane;
+
 	drm_crtc_vblank_off(crtc);
 
 	/* Always turn the planes off on CRTC disable. In DRM, planes
@@ -607,23 +609,23 @@ static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_s
 	 * give us a CRTC-level control for that.
 	 */
 
-	vc4_plane_atomic_disable(crtc->cursor, crtc->cursor->state);
-	vc4_plane_atomic_disable(crtc->primary, crtc->primary->state);
-
-	/* FIXME: Disable overlay planes */
+	drm_atomic_crtc_for_each_plane(plane, crtc)
+		vc4_plane_atomic_disable(plane, plane->state);
 }
 
 static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	struct drm_plane *plane;
+
 	drm_crtc_vblank_on(crtc);
+
 	/* Unblank the planes (if they're supposed to be displayed). */
+	drm_atomic_crtc_for_each_plane(plane, crtc)
+		if (plane->state->fb)
+			vc4_plane_set_blank(plane, plane->state->visible);
+}
 
-	if (crtc->primary->state->fb)
-		vc4_plane_set_blank(crtc->primary, false);
-	if (crtc->cursor->state->fb)
-		vc4_plane_set_blank(crtc->cursor, crtc->cursor->state);
 
-	/* FIXME: Enable overlay planes */
 }
 
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
-- 
GitLab


From 21264f10c69376ce578a75c75e12fdb997d63cb9 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 10 Apr 2019 17:43:57 +0100
Subject: [PATCH 0615/1835] drm: vc4: Bring fkms into line with kms in blocking
 doublescan modes

Implement vc4_crtc_mode_valid so that it blocks doublescan modes

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 0bfc4f54d4cc8..6a657f44a6a1d 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -625,7 +625,17 @@ static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_st
 			vc4_plane_set_blank(plane, plane->state->visible);
 }
 
+static enum drm_mode_status
+vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
+{
+	/* Do not allow doublescan modes from user space */
+	if (mode->flags & DRM_MODE_FLAG_DBLSCAN) {
+		DRM_DEBUG_KMS("[CRTC:%d] Doublescan mode rejected.\n",
+			      crtc->base.id);
+		return MODE_NO_DBLESCAN;
+	}
 
+	return MODE_OK;
 }
 
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
@@ -735,10 +745,11 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = {
 
 static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
 	.mode_set_nofb = vc4_crtc_mode_set_nofb,
-	.atomic_disable = vc4_crtc_disable,
-	.atomic_enable = vc4_crtc_enable,
+	.mode_valid = vc4_crtc_mode_valid,
 	.atomic_check = vc4_crtc_atomic_check,
 	.atomic_flush = vc4_crtc_atomic_flush,
+	.atomic_enable = vc4_crtc_enable,
+	.atomic_disable = vc4_crtc_disable,
 };
 
 static const struct of_device_id vc4_firmware_kms_dt_match[] = {
-- 
GitLab


From 644e1030528dee45312b93cd017ec3132243ebfd Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 29 Apr 2019 18:45:00 +0100
Subject: [PATCH 0616/1835] drm: vc4: Increase max_width/height to 7680.

There are some limits still being investigated that stop
us going up to 8192, but 7680 is sufficient for dual 4k
displays.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index a5dcfe38ffeac..0fc0e901f7865 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -429,8 +429,8 @@ int vc4_kms_load(struct drm_device *dev)
 		return ret;
 	}
 
-	dev->mode_config.max_width = 4096;
-	dev->mode_config.max_height = 4096;
+	dev->mode_config.max_width = 7680;
+	dev->mode_config.max_height = 7680;
 	dev->mode_config.funcs = &vc4_mode_funcs;
 	dev->mode_config.preferred_depth = 24;
 	dev->mode_config.async_page_flip = true;
-- 
GitLab


From d4a7db404f22a7dafc963b3d72f14dc19c80be5f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 9 Apr 2019 18:23:41 +0100
Subject: [PATCH 0617/1835] drm: vc4: FKMS reads the EDID from fw, and supports
 mode setting

This extends FKMS to read the EDID from the display, and support
requesting a particular mode via KMS.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c     | 334 ++++++++++++++++++---
 include/soc/bcm2835/raspberrypi-firmware.h |   2 +
 2 files changed, 302 insertions(+), 34 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 6a657f44a6a1d..30d1a5048eb2e 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -88,11 +88,60 @@ struct mailbox_blank_display {
 	u32 blank;
 };
 
-struct mailbox_get_width_height {
+struct mailbox_get_edid {
 	struct rpi_firmware_property_tag_header tag1;
-	u32 display;
-	struct rpi_firmware_property_tag_header tag2;
-	u32 wh[2];
+	u32 block;
+	u32 display_number;
+	u8 edid[128];
+};
+
+struct set_timings {
+	u8 display;
+	u8 padding;
+	u16 video_id_code;
+
+	u32 clock;		/* in kHz */
+
+	u16 hdisplay;
+	u16 hsync_start;
+
+	u16 hsync_end;
+	u16 htotal;
+
+	u16 hskew;
+	u16 vdisplay;
+
+	u16 vsync_start;
+	u16 vsync_end;
+
+	u16 vtotal;
+	u16 vscan;
+
+	u16 vrefresh;
+	u16 padding2;
+
+	u32 flags;
+#define  TIMINGS_FLAGS_H_SYNC_POS	BIT(0)
+#define  TIMINGS_FLAGS_H_SYNC_NEG	0
+#define  TIMINGS_FLAGS_V_SYNC_POS	BIT(1)
+#define  TIMINGS_FLAGS_V_SYNC_NEG	0
+
+#define TIMINGS_FLAGS_ASPECT_MASK	GENMASK(7, 4)
+#define TIMINGS_FLAGS_ASPECT_NONE	(0 << 4)
+#define TIMINGS_FLAGS_ASPECT_4_3	(1 << 4)
+#define TIMINGS_FLAGS_ASPECT_16_9	(2 << 4)
+#define TIMINGS_FLAGS_ASPECT_64_27	(3 << 4)
+#define TIMINGS_FLAGS_ASPECT_256_135	(4 << 4)
+
+/* Limited range RGB flag. Not set corresponds to full range. */
+#define TIMINGS_FLAGS_RGB_LIMITED	BIT(8)
+/* DVI monitor, therefore disable infoframes. Not set corresponds to HDMI. */
+#define TIMINGS_FLAGS_DVI		BIT(9)
+};
+
+struct mailbox_set_mode {
+	struct rpi_firmware_property_tag_header tag1;
+	struct set_timings timings;
 };
 
 static const struct vc_image_format {
@@ -186,6 +235,7 @@ struct vc4_crtc {
 	u32 overscan[4];
 	bool vblank_enabled;
 	u32 display_number;
+	u32 display_type;
 };
 
 static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
@@ -195,6 +245,8 @@ static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
 
 struct vc4_fkms_encoder {
 	struct drm_encoder base;
+	bool hdmi_monitor;
+	bool rgb_range_selectable;
 };
 
 static inline struct vc4_fkms_encoder *
@@ -212,7 +264,9 @@ struct vc4_fkms_connector {
 	 * hook.
 	 */
 	struct drm_encoder *encoder;
-	u32 display_idx;
+	struct vc4_dev *vc4_dev;
+	u32 display_number;
+	u32 display_type;
 };
 
 static inline struct vc4_fkms_connector *
@@ -221,6 +275,26 @@ to_vc4_fkms_connector(struct drm_connector *connector)
 	return container_of(connector, struct vc4_fkms_connector, base);
 }
 
+static u32 vc4_get_display_type(u32 display_number)
+{
+	const u32 display_types[] = {
+		/* The firmware display (DispmanX) IDs map to specific types in
+		 * a fixed manner.
+		 */
+		DRM_MODE_ENCODER_DSI,	/* MAIN_LCD */
+		DRM_MODE_ENCODER_DSI,	/* AUX_LCD */
+		DRM_MODE_ENCODER_TMDS,	/* HDMI0 */
+		DRM_MODE_ENCODER_TVDAC,	/* VEC */
+		DRM_MODE_ENCODER_NONE,	/* FORCE_LCD */
+		DRM_MODE_ENCODER_NONE,	/* FORCE_TV */
+		DRM_MODE_ENCODER_NONE,	/* FORCE_OTHER */
+		DRM_MODE_ENCODER_TMDS,	/* HDMI1 */
+		DRM_MODE_ENCODER_NONE,	/* FORCE_TV2 */
+	};
+	return display_number > ARRAY_SIZE(display_types) - 1 ?
+			DRM_MODE_ENCODER_NONE : display_types[display_number];
+}
+
 /* Firmware's structure for making an FB mbox call. */
 struct fbinfo_s {
 	u32 xres, yres, xres_virtual, yres_virtual;
@@ -255,10 +329,15 @@ static int vc4_plane_set_blank(struct drm_plane *plane, bool blank)
 			.plane_id = vc4_plane->mb.plane.plane_id,
 		}
 	};
+	static const char * const plane_types[] = {
+							"overlay",
+							"primary",
+							"cursor"
+						  };
 	int ret;
 
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] overlay plane %s",
-			 plane->base.id, plane->name,
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] %s plane %s",
+			 plane->base.id, plane->name, plane_types[plane->type],
 			 blank ? "blank" : "unblank");
 
 	if (blank)
@@ -593,13 +672,102 @@ fail:
 
 static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 {
-	/* Everyting is handled in the planes. */
+	struct drm_device *dev = crtc->dev;
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_display_mode *mode = &crtc->state->adjusted_mode;
+	struct vc4_fkms_encoder *vc4_encoder =
+					to_vc4_fkms_encoder(vc4_crtc->encoder);
+	struct mailbox_set_mode mb = {
+		.tag1 = { RPI_FIRMWARE_SET_TIMING,
+			  sizeof(struct set_timings), 0},
+	};
+	union hdmi_infoframe frame;
+	int ret;
+
+	ret = drm_hdmi_avi_infoframe_from_display_mode(&frame.avi, mode, false);
+	if (ret < 0) {
+		DRM_ERROR("couldn't fill AVI infoframe\n");
+		return;
+	}
+
+	DRM_DEBUG_KMS("Setting mode for display num %u mode name %s, clk %d, h(disp %d, start %d, end %d, total %d, skew %d) v(disp %d, start %d, end %d, total %d, scan %d), vrefresh %d, par %u\n",
+		      vc4_crtc->display_number, mode->name, mode->clock,
+		      mode->hdisplay, mode->hsync_start, mode->hsync_end,
+		      mode->htotal, mode->hskew, mode->vdisplay,
+		      mode->vsync_start, mode->vsync_end, mode->vtotal,
+		      mode->vscan, mode->vrefresh, mode->picture_aspect_ratio);
+	mb.timings.display = vc4_crtc->display_number;
+
+	mb.timings.video_id_code = frame.avi.video_code;
+
+	mb.timings.clock = mode->clock;
+	mb.timings.hdisplay = mode->hdisplay;
+	mb.timings.hsync_start = mode->hsync_start;
+	mb.timings.hsync_end = mode->hsync_end;
+	mb.timings.htotal = mode->htotal;
+	mb.timings.hskew = mode->hskew;
+	mb.timings.vdisplay = mode->vdisplay;
+	mb.timings.vsync_start = mode->vsync_start;
+	mb.timings.vsync_end = mode->vsync_end;
+	mb.timings.vtotal = mode->vtotal;
+	mb.timings.vscan = mode->vscan;
+	mb.timings.vrefresh = 0;
+	mb.timings.flags = 0;
+	if (mode->flags & DRM_MODE_FLAG_PHSYNC)
+		mb.timings.flags |= TIMINGS_FLAGS_H_SYNC_POS;
+	if (mode->flags & DRM_MODE_FLAG_PVSYNC)
+		mb.timings.flags |= TIMINGS_FLAGS_V_SYNC_POS;
+
+	switch (frame.avi.picture_aspect) {
+	default:
+	case HDMI_PICTURE_ASPECT_NONE:
+		mode->flags |= TIMINGS_FLAGS_ASPECT_NONE;
+		break;
+	case HDMI_PICTURE_ASPECT_4_3:
+		mode->flags |= TIMINGS_FLAGS_ASPECT_4_3;
+		break;
+	case HDMI_PICTURE_ASPECT_16_9:
+		mode->flags |= TIMINGS_FLAGS_ASPECT_16_9;
+		break;
+	case HDMI_PICTURE_ASPECT_64_27:
+		mode->flags |= TIMINGS_FLAGS_ASPECT_64_27;
+		break;
+	case HDMI_PICTURE_ASPECT_256_135:
+		mode->flags |= TIMINGS_FLAGS_ASPECT_256_135;
+		break;
+	}
+
+	if (!vc4_encoder->hdmi_monitor)
+		mb.timings.flags |= TIMINGS_FLAGS_DVI;
+	else if (drm_default_rgb_quant_range(mode) ==
+					HDMI_QUANTIZATION_RANGE_LIMITED)
+		mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
+
+	/*
+	FIXME: To implement
+	switch(mode->flag & DRM_MODE_FLAG_3D_MASK) {
+	case DRM_MODE_FLAG_3D_NONE:
+	case DRM_MODE_FLAG_3D_FRAME_PACKING:
+	case DRM_MODE_FLAG_3D_FIELD_ALTERNATIVE:
+	case DRM_MODE_FLAG_3D_LINE_ALTERNATIVE:
+	case DRM_MODE_FLAG_3D_SIDE_BY_SIDE_FULL:
+	case DRM_MODE_FLAG_3D_L_DEPTH:
+	case DRM_MODE_FLAG_3D_L_DEPTH_GFX_GFX_DEPTH:
+	case DRM_MODE_FLAG_3D_TOP_AND_BOTTOM:
+	case DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF:
+	}
+	*/
+
+	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
 }
 
 static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
 	struct drm_plane *plane;
 
+	DRM_DEBUG_KMS("[CRTC:%d] vblanks off.\n",
+		      crtc->base.id);
 	drm_crtc_vblank_off(crtc);
 
 	/* Always turn the planes off on CRTC disable. In DRM, planes
@@ -617,6 +785,8 @@ static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_st
 {
 	struct drm_plane *plane;
 
+	DRM_DEBUG_KMS("[CRTC:%d] vblanks on.\n",
+		      crtc->base.id);
 	drm_crtc_vblank_on(crtc);
 
 	/* Unblank the planes (if they're supposed to be displayed). */
@@ -635,12 +805,20 @@ vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 		return MODE_NO_DBLESCAN;
 	}
 
+	/* Limit the pixel clock until we can get dynamic HDMI 2.0 scrambling
+	 * working.
+	 */
+	if (mode->clock > 340000)
+		return MODE_CLOCK_HIGH;
+
 	return MODE_OK;
 }
 
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
 				 struct drm_crtc_state *state)
 {
+	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_check.\n",
+		      crtc->base.id);
 	return 0;
 }
 
@@ -650,6 +828,8 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 	struct drm_device *dev = crtc->dev;
 
+	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_flush.\n",
+		      crtc->base.id);
 	if (crtc->state->event) {
 		unsigned long flags;
 
@@ -717,6 +897,8 @@ static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
 {
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 
+	DRM_DEBUG_KMS("[CRTC:%d] enable_vblank.\n",
+		      crtc->base.id);
 	vc4_crtc->vblank_enabled = true;
 
 	return 0;
@@ -726,6 +908,8 @@ static void vc4_fkms_disable_vblank(struct drm_crtc *crtc)
 {
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 
+	DRM_DEBUG_KMS("[CRTC:%d] disable_vblank.\n",
+		      crtc->base.id);
 	vc4_crtc->vblank_enabled = false;
 }
 
@@ -760,36 +944,92 @@ static const struct of_device_id vc4_firmware_kms_dt_match[] = {
 static enum drm_connector_status
 vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
 {
+	DRM_DEBUG_KMS("connector detect.\n");
 	return connector_status_connected;
 }
 
-static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
+static int vc4_fkms_get_edid_block(void *data, u8 *buf, unsigned int block,
+				   size_t len)
 {
-	struct drm_device *dev = connector->dev;
 	struct vc4_fkms_connector *fkms_connector =
-		to_vc4_fkms_connector(connector);
-	struct vc4_dev *vc4 = to_vc4_dev(dev);
-	struct drm_display_mode *mode;
-	struct mailbox_get_width_height wh = {
-		.tag1 = {RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM, 4, 0, },
-		.display = fkms_connector->display_idx,
-		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT,
-			  8, 0, },
+					(struct vc4_fkms_connector *)data;
+	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
+	struct mailbox_get_edid mb = {
+		.tag1 = { RPI_FIRMWARE_GET_EDID_BLOCK_DISPLAY,
+			  128 + 8, 0 },
+		.block = block,
+		.display_number = fkms_connector->display_number,
 	};
-	int ret;
+	int ret = 0;
 
-	ret = rpi_firmware_property_list(vc4->firmware, &wh, sizeof(wh));
+	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
 
-	if (ret) {
-		DRM_ERROR("Failed to get screen size: %d (0x%08x 0x%08x)\n",
-			  ret, wh.wh[0], wh.wh[1]);
-		return 0;
+	if (!ret)
+		memcpy(buf, mb.edid, len);
+
+	return ret;
+}
+
+static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
+{
+	struct vc4_fkms_connector *fkms_connector =
+					to_vc4_fkms_connector(connector);
+	struct drm_encoder *encoder = fkms_connector->encoder;
+	struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
+	int ret = 0;
+	struct edid *edid;
+
+	edid = drm_do_get_edid(connector, vc4_fkms_get_edid_block,
+			       fkms_connector);
+
+	/* FIXME: Can we do CEC?
+	 * cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
+	 * if (!edid)
+	 *	return -ENODEV;
+	 */
+
+	vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
+
+	if (edid && edid->input & DRM_EDID_INPUT_DIGITAL) {
+		vc4_encoder->rgb_range_selectable =
+			drm_rgb_quant_range_selectable(edid);
+	}
+
+	drm_connector_update_edid_property(connector, edid);
+	ret = drm_add_edid_modes(connector, edid);
+	kfree(edid);
+
+	return ret;
+}
+
+/* FIXME: Read LCD mode from the firmware. This is the DSI panel resolution. */
+static const struct drm_display_mode lcd_mode = {
+	DRM_MODE("800x480", DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
+		 25979400 / 1000,
+		 800, 800 + 1, 800 + 1 + 2, 800 + 1 + 2 + 46, 0,
+		 480, 480 + 7, 480 + 7 + 2, 480 + 7 + 2 + 21, 0,
+		 DRM_MODE_FLAG_INTERLACE)
+};
+
+static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
+{
+	//struct vc4_fkms_connector *fkms_connector =
+	//				to_vc4_fkms_connector(connector);
+	//struct drm_encoder *encoder = fkms_connector->encoder;
+	//struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
+	struct drm_display_mode *mode;
+	//int ret = 0;
+
+	mode = drm_mode_duplicate(connector->dev,
+				  &lcd_mode);
+	if (!mode) {
+		DRM_ERROR("Failed to create a new display mode\n");
+		return -ENOMEM;
 	}
 
-	mode = drm_cvt_mode(dev, wh.wh[0], wh.wh[1], 60 /* vrefresh */,
-			    0, 0, false);
 	drm_mode_probed_add(connector, mode);
 
+	/* We have one mode */
 	return 1;
 }
 
@@ -798,11 +1038,14 @@ vc4_fkms_connector_best_encoder(struct drm_connector *connector)
 {
 	struct vc4_fkms_connector *fkms_connector =
 		to_vc4_fkms_connector(connector);
+	DRM_DEBUG_KMS("best_connector.\n");
 	return fkms_connector->encoder;
 }
 
 static void vc4_fkms_connector_destroy(struct drm_connector *connector)
 {
+	DRM_DEBUG_KMS("[CONNECTOR:%d] destroy.\n",
+		      connector->base.id);
 	drm_connector_unregister(connector);
 	drm_connector_cleanup(connector);
 }
@@ -821,14 +1064,22 @@ static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs =
 	.best_encoder = vc4_fkms_connector_best_encoder,
 };
 
+static const struct drm_connector_helper_funcs vc4_fkms_lcd_conn_helper_funcs = {
+	.get_modes = vc4_fkms_lcd_connector_get_modes,
+	.best_encoder = vc4_fkms_connector_best_encoder,
+};
+
 static struct drm_connector *
 vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
-			u32 display_idx)
+			u32 display_num)
 {
 	struct drm_connector *connector = NULL;
 	struct vc4_fkms_connector *fkms_connector;
+	struct vc4_dev *vc4_dev = to_vc4_dev(dev);
 	int ret = 0;
 
+	DRM_DEBUG_KMS("connector_init, display_num %u\n", display_num);
+
 	fkms_connector = devm_kzalloc(dev->dev, sizeof(*fkms_connector),
 				      GFP_KERNEL);
 	if (!fkms_connector) {
@@ -838,11 +1089,21 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 	connector = &fkms_connector->base;
 
 	fkms_connector->encoder = encoder;
-	fkms_connector->display_idx = display_idx;
-
-	drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
-			   DRM_MODE_CONNECTOR_HDMIA);
-	drm_connector_helper_add(connector, &vc4_fkms_connector_helper_funcs);
+	fkms_connector->display_number = display_num;
+	fkms_connector->display_type = vc4_get_display_type(display_num);
+	fkms_connector->vc4_dev = vc4_dev;
+
+	if (fkms_connector->display_type == DRM_MODE_ENCODER_DSI) {
+		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
+				   DRM_MODE_CONNECTOR_DSI);
+		drm_connector_helper_add(connector,
+					 &vc4_fkms_lcd_conn_helper_funcs);
+	} else {
+		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
+				   DRM_MODE_CONNECTOR_HDMIA);
+		drm_connector_helper_add(connector,
+					 &vc4_fkms_connector_helper_funcs);
+	}
 
 	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
 			     DRM_CONNECTOR_POLL_DISCONNECT);
@@ -863,6 +1124,7 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 
 static void vc4_fkms_encoder_destroy(struct drm_encoder *encoder)
 {
+	DRM_DEBUG_KMS("Encoder_destroy\n");
 	drm_encoder_cleanup(encoder);
 }
 
@@ -872,10 +1134,12 @@ static const struct drm_encoder_funcs vc4_fkms_encoder_funcs = {
 
 static void vc4_fkms_encoder_enable(struct drm_encoder *encoder)
 {
+	DRM_DEBUG_KMS("Encoder_enable\n");
 }
 
 static void vc4_fkms_encoder_disable(struct drm_encoder *encoder)
 {
+	DRM_DEBUG_KMS("Encoder_disable\n");
 }
 
 static const struct drm_encoder_helper_funcs vc4_fkms_encoder_helper_funcs = {
@@ -907,6 +1171,7 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 	crtc = &vc4_crtc->base;
 
 	vc4_crtc->display_number = display_ref;
+	vc4_crtc->display_type = vc4_get_display_type(display_ref);
 
 	/* Blank the firmware provided framebuffer */
 	rpi_firmware_property_list(vc4->firmware, &blank, sizeof(blank));
@@ -950,13 +1215,14 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 		return -ENOMEM;
 	vc4_crtc->encoder = &vc4_encoder->base;
 	vc4_encoder->base.possible_crtcs |= drm_crtc_mask(crtc) ;
+
 	drm_encoder_init(drm, &vc4_encoder->base, &vc4_fkms_encoder_funcs,
-			 DRM_MODE_ENCODER_TMDS, NULL);
+			 vc4_crtc->display_type, NULL);
 	drm_encoder_helper_add(&vc4_encoder->base,
 			       &vc4_fkms_encoder_helper_funcs);
 
 	vc4_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base,
-						      display_idx);
+						      display_ref);
 	if (IS_ERR(vc4_crtc->connector)) {
 		ret = PTR_ERR(vc4_crtc->connector);
 		goto err_destroy_encoder;
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 5d55d1d7105a0..50ed6dc6ded1a 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -78,6 +78,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_GET_DISPMANX_RESOURCE_MEM_HANDLE =       0x00030014,
 	RPI_FIRMWARE_GET_EDID_BLOCK =                         0x00030020,
 	RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
+	RPI_FIRMWARE_GET_EDID_BLOCK_DISPLAY =                 0x00030023,
 	RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
 	RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
 	RPI_FIRMWARE_GET_CLOCK_MEASURED =                     0x00030047,
@@ -150,6 +151,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
 
 	RPI_FIRMWARE_SET_PLANE =                              0x00048015,
+	RPI_FIRMWARE_SET_TIMING =                             0x00048017,
 
 	RPI_FIRMWARE_GET_COMMAND_LINE =                       0x00050001,
 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
-- 
GitLab


From 637561e48b1885b7eb66a6f64eaa012e48a3f9c4 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 2 May 2019 15:11:05 -0700
Subject: [PATCH 0618/1835] clk: bcm2835: Add support for setting leaf clock
 rates while running.

As long as you wait for !BUSY, you can do glitch-free updates of clock
rate while the clock is running.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/clk/bcm/clk-bcm2835.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index b8da17a6e6cdb..9dfaf221aca3c 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1097,15 +1097,19 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
 
 	spin_lock(&cprman->regs_lock);
 
-	/*
-	 * Setting up frac support
-	 *
-	 * In principle it is recommended to stop/start the clock first,
-	 * but as we set CLK_SET_RATE_GATE during registration of the
-	 * clock this requirement should be take care of by the
-	 * clk-framework.
+	ctl = cprman_read(cprman, data->ctl_reg);
+
+	/* If the clock is running, we have to pause clock generation while
+	 * updating the control and div regs.  This is glitchless (no clock
+	 * signals generated faster than the rate) but each reg access is two
+	 * OSC cycles so the clock will slow down for a moment.
 	 */
-	ctl = cprman_read(cprman, data->ctl_reg) & ~CM_FRAC;
+	if (ctl & CM_ENABLE) {
+		cprman_write(cprman, data->ctl_reg, ctl & ~CM_ENABLE);
+		bcm2835_clock_wait_busy(clock);
+	}
+
+	ctl &= ~CM_FRAC;
 	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
 	cprman_write(cprman, data->ctl_reg, ctl);
 
@@ -1475,7 +1479,7 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman,
 		init.ops = &bcm2835_vpu_clock_clk_ops;
 	} else {
 		init.ops = &bcm2835_clock_clk_ops;
-		init.flags |= CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE;
+		init.flags |= CLK_SET_PARENT_GATE;
 
 		/* If the clock wasn't actually enabled at boot, it's not
 		 * critical.
-- 
GitLab


From 3240ab1fe84b3743beff0276dbac97e6bfa82187 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 2 May 2019 15:24:04 -0700
Subject: [PATCH 0619/1835] clk: bcm2835: Allow reparenting leaf clocks while
 they're running.

This falls under the same "we can reprogram glitch-free as long as we
pause generation" rule as updating the div/frac fields.  This can be
used for runtime reclocking of V3D to manage power leakage.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/clk/bcm/clk-bcm2835.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 9dfaf221aca3c..07ddfc02ac955 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -1086,8 +1086,10 @@ static int bcm2835_clock_on(struct clk_hw *hw)
 	return 0;
 }
 
-static int bcm2835_clock_set_rate(struct clk_hw *hw,
-				  unsigned long rate, unsigned long parent_rate)
+static int bcm2835_clock_set_rate_and_parent(struct clk_hw *hw,
+					     unsigned long rate,
+					     unsigned long parent_rate,
+					     u8 parent)
 {
 	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
 	struct bcm2835_cprman *cprman = clock->cprman;
@@ -1109,6 +1111,11 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
 		bcm2835_clock_wait_busy(clock);
 	}
 
+	if (parent != 0xff) {
+		ctl &= ~(CM_SRC_MASK << CM_SRC_SHIFT);
+		ctl |= parent << CM_SRC_SHIFT;
+	}
+
 	ctl &= ~CM_FRAC;
 	ctl |= (div & CM_DIV_FRAC_MASK) ? CM_FRAC : 0;
 	cprman_write(cprman, data->ctl_reg, ctl);
@@ -1120,6 +1127,12 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
 	return 0;
 }
 
+static int bcm2835_clock_set_rate(struct clk_hw *hw,
+				  unsigned long rate, unsigned long parent_rate)
+{
+	return bcm2835_clock_set_rate_and_parent(hw, rate, parent_rate, 0xff);
+}
+
 static bool
 bcm2835_clk_is_pllc(struct clk_hw *hw)
 {
@@ -1303,6 +1316,7 @@ static const struct clk_ops bcm2835_clock_clk_ops = {
 	.unprepare = bcm2835_clock_off,
 	.recalc_rate = bcm2835_clock_get_rate,
 	.set_rate = bcm2835_clock_set_rate,
+	.set_rate_and_parent = bcm2835_clock_set_rate_and_parent,
 	.determine_rate = bcm2835_clock_determine_rate,
 	.set_parent = bcm2835_clock_set_parent,
 	.get_parent = bcm2835_clock_get_parent,
@@ -1479,7 +1493,6 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman,
 		init.ops = &bcm2835_vpu_clock_clk_ops;
 	} else {
 		init.ops = &bcm2835_clock_clk_ops;
-		init.flags |= CLK_SET_PARENT_GATE;
 
 		/* If the clock wasn't actually enabled at boot, it's not
 		 * critical.
-- 
GitLab


From c1a40a21b2637d2ce7f71a71cc9c7fe101a14fef Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Tue, 16 Apr 2019 15:58:54 -0700
Subject: [PATCH 0620/1835] drm/v3d: Add support for compute shader dispatch.

The compute shader dispatch interface is pretty simple -- just pass in
the regs that userspace has passed us, with no CLs to run.  However,
with no CL to run it means that we need to do manual cache flushing of
the L2 after the HW execution completes (for SSBO, atomic, and
image_load_store writes that are the output of compute shaders).

This doesn't yet expose the L2 cache's ability to have a region of the
address space not write back to memory (which could be used for
shared_var storage).

So far, the Mesa side has been tested on V3D v4.2 simpenrose (passing
the ES31 tests), and on the kernel side on 7278 (failing atomic
compswap tests in a way that doesn't reproduce on simpenrose).

v2: Fix excessive allocation for the clean_job (reported by Dan
    Carpenter).  Keep refs on jobs until clean_job is finished, to
    avoid spurious MMU errors if the output BOs are freed by userspace
    before L2 cleaning is finished.

Signed-off-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20190416225856.20264-4-eric@anholt.net
Acked-by: Rob Clark <robdclark@gmail.com>
---
 drivers/gpu/drm/v3d/v3d_debugfs.c |  22 +++++
 drivers/gpu/drm/v3d/v3d_drv.c     |  10 +-
 drivers/gpu/drm/v3d/v3d_drv.h     |  28 +++++-
 drivers/gpu/drm/v3d/v3d_fence.c   |   2 +
 drivers/gpu/drm/v3d/v3d_gem.c     | 156 +++++++++++++++++++++++++++++-
 drivers/gpu/drm/v3d/v3d_irq.c     |  16 ++-
 drivers/gpu/drm/v3d/v3d_regs.h    |  73 ++++++++++++++
 drivers/gpu/drm/v3d/v3d_sched.c   | 121 +++++++++++++++++++++--
 drivers/gpu/drm/v3d/v3d_trace.h   |  94 ++++++++++++++++++
 include/uapi/drm/v3d_drm.h        |  28 ++++++
 10 files changed, 531 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
index b15051df2dbbc..089fde87b2fcf 100644
--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
+++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
@@ -57,6 +57,17 @@ static const struct v3d_reg_def v3d_core_reg_defs[] = {
 	REGDEF(V3D_GMP_VIO_ADDR),
 };
 
+static const struct v3d_reg_def v3d_csd_reg_defs[] = {
+	REGDEF(V3D_CSD_STATUS),
+	REGDEF(V3D_CSD_CURRENT_CFG0),
+	REGDEF(V3D_CSD_CURRENT_CFG1),
+	REGDEF(V3D_CSD_CURRENT_CFG2),
+	REGDEF(V3D_CSD_CURRENT_CFG3),
+	REGDEF(V3D_CSD_CURRENT_CFG4),
+	REGDEF(V3D_CSD_CURRENT_CFG5),
+	REGDEF(V3D_CSD_CURRENT_CFG6),
+};
+
 static int v3d_v3d_debugfs_regs(struct seq_file *m, void *unused)
 {
 	struct drm_info_node *node = (struct drm_info_node *)m->private;
@@ -88,6 +99,17 @@ static int v3d_v3d_debugfs_regs(struct seq_file *m, void *unused)
 				   V3D_CORE_READ(core,
 						 v3d_core_reg_defs[i].reg));
 		}
+
+		if (v3d_has_csd(v3d)) {
+			for (i = 0; i < ARRAY_SIZE(v3d_csd_reg_defs); i++) {
+				seq_printf(m, "core %d %s (0x%04x): 0x%08x\n",
+					   core,
+					   v3d_csd_reg_defs[i].name,
+					   v3d_csd_reg_defs[i].reg,
+					   V3D_CORE_READ(core,
+							 v3d_csd_reg_defs[i].reg));
+			}
+		}
 	}
 
 	return 0;
diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 1f2c3555c0387..05978cd7c8c64 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -7,9 +7,9 @@
  * This driver supports the Broadcom V3D 3.3 and 4.1 OpenGL ES GPUs.
  * For V3D 2.x support, see the VC4 driver.
  *
- * Currently only single-core rendering using the binner and renderer,
- * along with TFU (texture formatting unit) rendering is supported.
- * V3D 4.x's CSD (compute shader dispatch) is not yet supported.
+ * The V3D GPU includes a tiled render (composed of a bin and render
+ * pipelines), the TFU (texture formatting unit), and the CSD (compute
+ * shader dispatch).
  */
 
 #include <linux/clk.h>
@@ -114,6 +114,9 @@ static int v3d_get_param_ioctl(struct drm_device *dev, void *data,
 	case DRM_V3D_PARAM_SUPPORTS_TFU:
 		args->value = 1;
 		return 0;
+	case DRM_V3D_PARAM_SUPPORTS_CSD:
+		args->value = v3d_has_csd(v3d);
+		return 0;
 	default:
 		DRM_DEBUG("Unknown parameter %d\n", args->param);
 		return -EINVAL;
@@ -183,6 +186,7 @@ static const struct drm_ioctl_desc v3d_drm_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(V3D_GET_PARAM, v3d_get_param_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(V3D_GET_BO_OFFSET, v3d_get_bo_offset_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(V3D_SUBMIT_TFU, v3d_submit_tfu_ioctl, DRM_RENDER_ALLOW | DRM_AUTH),
+	DRM_IOCTL_DEF_DRV(V3D_SUBMIT_CSD, v3d_submit_csd_ioctl, DRM_RENDER_ALLOW | DRM_AUTH),
 };
 
 static const struct vm_operations_struct v3d_vm_ops = {
diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 2807fe702524f..2de04ada4d3bb 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -16,9 +16,11 @@ enum v3d_queue {
 	V3D_BIN,
 	V3D_RENDER,
 	V3D_TFU,
+	V3D_CSD,
+	V3D_CACHE_CLEAN,
 };
 
-#define V3D_MAX_QUEUES (V3D_TFU + 1)
+#define V3D_MAX_QUEUES (V3D_CACHE_CLEAN + 1)
 
 struct v3d_queue_state {
 	struct drm_gpu_scheduler sched;
@@ -70,6 +72,7 @@ struct v3d_dev {
 	struct v3d_bin_job *bin_job;
 	struct v3d_render_job *render_job;
 	struct v3d_tfu_job *tfu_job;
+	struct v3d_csd_job *csd_job;
 
 	struct v3d_queue_state queue[V3D_MAX_QUEUES];
 
@@ -92,6 +95,12 @@ struct v3d_dev {
 	 */
 	struct mutex sched_lock;
 
+	/* Lock taken during a cache clean and when initiating an L2
+	 * flush, to keep L2 flushes from interfering with the
+	 * synchronous L2 cleans.
+	 */
+	struct mutex cache_clean_lock;
+
 	struct {
 		u32 num_allocated;
 		u32 pages_allocated;
@@ -104,6 +113,12 @@ to_v3d_dev(struct drm_device *dev)
 	return (struct v3d_dev *)dev->dev_private;
 }
 
+static inline bool
+v3d_has_csd(struct v3d_dev *v3d)
+{
+	return v3d->ver >= 41;
+}
+
 /* The per-fd struct, which tracks the MMU mappings. */
 struct v3d_file_priv {
 	struct v3d_dev *v3d;
@@ -237,6 +252,14 @@ struct v3d_tfu_job {
 	struct drm_v3d_submit_tfu args;
 };
 
+struct v3d_csd_job {
+	struct v3d_job base;
+
+	u32 timedout_batches;
+
+	struct drm_v3d_submit_csd args;
+};
+
 /**
  * _wait_for - magic (register) wait macro
  *
@@ -302,11 +325,14 @@ int v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 			struct drm_file *file_priv);
 int v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 			 struct drm_file *file_priv);
+int v3d_submit_csd_ioctl(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv);
 int v3d_wait_bo_ioctl(struct drm_device *dev, void *data,
 		      struct drm_file *file_priv);
 void v3d_job_put(struct v3d_job *job);
 void v3d_reset(struct v3d_dev *v3d);
 void v3d_invalidate_caches(struct v3d_dev *v3d);
+void v3d_clean_caches(struct v3d_dev *v3d);
 
 /* v3d_irq.c */
 int v3d_irq_init(struct v3d_dev *v3d);
diff --git a/drivers/gpu/drm/v3d/v3d_fence.c b/drivers/gpu/drm/v3d/v3d_fence.c
index b0a2a1ae2eb1a..89840ed212c06 100644
--- a/drivers/gpu/drm/v3d/v3d_fence.c
+++ b/drivers/gpu/drm/v3d/v3d_fence.c
@@ -36,6 +36,8 @@ static const char *v3d_fence_get_timeline_name(struct dma_fence *fence)
 		return "v3d-render";
 	case V3D_TFU:
 		return "v3d-tfu";
+	case V3D_CSD:
+		return "v3d-csd";
 	default:
 		return NULL;
 	}
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 40a72ef72099e..fe14777c3c20e 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -162,10 +162,52 @@ v3d_flush_l2t(struct v3d_dev *v3d, int core)
 	/* While there is a busy bit (V3D_L2TCACTL_L2TFLS), we don't
 	 * need to wait for completion before dispatching the job --
 	 * L2T accesses will be stalled until the flush has completed.
+	 * However, we do need to make sure we don't try to trigger a
+	 * new flush while the L2_CLEAN queue is trying to
+	 * synchronously clean after a job.
 	 */
+	mutex_lock(&v3d->cache_clean_lock);
 	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL,
 		       V3D_L2TCACTL_L2TFLS |
 		       V3D_SET_FIELD(V3D_L2TCACTL_FLM_FLUSH, V3D_L2TCACTL_FLM));
+	mutex_unlock(&v3d->cache_clean_lock);
+}
+
+/* Cleans texture L1 and L2 cachelines (writing back dirty data).
+ *
+ * For cleaning, which happens from the CACHE_CLEAN queue after CSD has
+ * executed, we need to make sure that the clean is done before
+ * signaling job completion.  So, we synchronously wait before
+ * returning, and we make sure that L2 invalidates don't happen in the
+ * meantime to confuse our are-we-done checks.
+ */
+void
+v3d_clean_caches(struct v3d_dev *v3d)
+{
+	struct drm_device *dev = &v3d->drm;
+	int core = 0;
+
+	trace_v3d_cache_clean_begin(dev);
+
+	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL, V3D_L2TCACTL_TMUWCF);
+	if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) &
+		       V3D_L2TCACTL_L2TFLS), 100)) {
+		DRM_ERROR("Timeout waiting for L1T write combiner flush\n");
+	}
+
+	mutex_lock(&v3d->cache_clean_lock);
+	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL,
+		       V3D_L2TCACTL_L2TFLS |
+		       V3D_SET_FIELD(V3D_L2TCACTL_FLM_CLEAN, V3D_L2TCACTL_FLM));
+
+	if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) &
+		       V3D_L2TCACTL_L2TFLS), 100)) {
+		DRM_ERROR("Timeout waiting for L2T clean\n");
+	}
+
+	mutex_unlock(&v3d->cache_clean_lock);
+
+	trace_v3d_cache_clean_end(dev);
 }
 
 /* Invalidates the slice caches.  These are read-only caches. */
@@ -584,7 +626,8 @@ static void
 v3d_attach_fences_and_unlock_reservation(struct drm_file *file_priv,
 					 struct v3d_job *job,
 					 struct ww_acquire_ctx *acquire_ctx,
-					 u32 out_sync)
+					 u32 out_sync,
+					 struct dma_fence *done_fence)
 {
 	struct drm_syncobj *sync_out;
 
@@ -594,7 +637,7 @@ v3d_attach_fences_and_unlock_reservation(struct drm_file *file_priv,
 	/* Update the return sync object for the job */
 	sync_out = drm_syncobj_find(file_priv, out_sync);
 	if (sync_out) {
-		drm_syncobj_replace_fence(sync_out, job->done_fence);
+		drm_syncobj_replace_fence(sync_out, done_fence);
 		drm_syncobj_put(sync_out);
 	}
 }
@@ -691,8 +734,10 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 	mutex_unlock(&v3d->sched_lock);
 
 	v3d_attach_fences_and_unlock_reservation(file_priv,
-						 &render->base, &acquire_ctx,
-						 args->out_sync);
+						 &render->base,
+						 &acquire_ctx,
+						 args->out_sync,
+						 render->base.done_fence);
 
 	if (bin)
 		v3d_job_put(&bin->base);
@@ -785,7 +830,8 @@ v3d_submit_tfu_ioctl(struct drm_device *dev, void *data,
 
 	v3d_attach_fences_and_unlock_reservation(file_priv,
 						 &job->base, &acquire_ctx,
-						 args->out_sync);
+						 args->out_sync,
+						 job->base.done_fence);
 
 	v3d_job_put(&job->base);
 
@@ -801,6 +847,105 @@ fail:
 	return ret;
 }
 
+/**
+ * v3d_submit_csd_ioctl() - Submits a CSD (texture formatting) job to the V3D.
+ * @dev: DRM device
+ * @data: ioctl argument
+ * @file_priv: DRM file for this fd
+ *
+ * Userspace provides the register setup for the CSD, which we don't
+ * need to validate since the CSD is behind the MMU.
+ */
+int
+v3d_submit_csd_ioctl(struct drm_device *dev, void *data,
+		     struct drm_file *file_priv)
+{
+	struct v3d_dev *v3d = to_v3d_dev(dev);
+	struct v3d_file_priv *v3d_priv = file_priv->driver_priv;
+	struct drm_v3d_submit_csd *args = data;
+	struct v3d_csd_job *job;
+	struct v3d_job *clean_job;
+	struct ww_acquire_ctx acquire_ctx;
+	int ret;
+
+	trace_v3d_submit_csd_ioctl(&v3d->drm, args->cfg[5], args->cfg[6]);
+
+	if (!v3d_has_csd(v3d)) {
+		DRM_DEBUG("Attempting CSD submit on non-CSD hardware\n");
+		return -EINVAL;
+	}
+
+	job = kcalloc(1, sizeof(*job), GFP_KERNEL);
+	if (!job)
+		return -ENOMEM;
+
+	ret = v3d_job_init(v3d, file_priv, &job->base,
+			   v3d_job_free, args->in_sync);
+	if (ret) {
+		kfree(job);
+		return ret;
+	}
+
+	clean_job = kcalloc(1, sizeof(*clean_job), GFP_KERNEL);
+	if (!clean_job) {
+		v3d_job_put(&job->base);
+		kfree(job);
+		return -ENOMEM;
+	}
+
+	ret = v3d_job_init(v3d, file_priv, clean_job, v3d_job_free, 0);
+	if (ret) {
+		v3d_job_put(&job->base);
+		kfree(clean_job);
+		return ret;
+	}
+
+	job->args = *args;
+
+	ret = v3d_lookup_bos(dev, file_priv, clean_job,
+			     args->bo_handles, args->bo_handle_count);
+	if (ret)
+		goto fail;
+
+	ret = v3d_lock_bo_reservations(clean_job, &acquire_ctx);
+	if (ret)
+		goto fail;
+
+	mutex_lock(&v3d->sched_lock);
+	ret = v3d_push_job(v3d_priv, &job->base, V3D_CSD);
+	if (ret)
+		goto fail_unreserve;
+
+	ret = v3d_add_dep(clean_job, dma_fence_get(job->base.done_fence));
+	if (ret)
+		goto fail_unreserve;
+	ret = v3d_push_job(v3d_priv, clean_job, V3D_CACHE_CLEAN);
+	if (ret)
+		goto fail_unreserve;
+	mutex_unlock(&v3d->sched_lock);
+
+	v3d_attach_fences_and_unlock_reservation(file_priv,
+						 clean_job,
+						 &acquire_ctx,
+						 args->out_sync,
+						 clean_job->done_fence);
+
+	v3d_job_put(&job->base);
+	v3d_job_put(clean_job);
+
+	return 0;
+
+fail_unreserve:
+	mutex_unlock(&v3d->sched_lock);
+	v3d_unlock_bo_reservations(clean_job->bo, clean_job->bo_count,
+				   &acquire_ctx);
+fail:
+	v3d_job_put(&job->base);
+	v3d_job_put(clean_job);
+
+	return ret;
+}
+
 int
 v3d_gem_init(struct drm_device *dev)
 {
@@ -816,6 +961,7 @@ v3d_gem_init(struct drm_device *dev)
 	mutex_init(&v3d->bo_lock);
 	mutex_init(&v3d->reset_lock);
 	mutex_init(&v3d->sched_lock);
+	mutex_init(&v3d->cache_clean_lock);
 
 	/* Note: We don't allocate address 0.  Various bits of HW
 	 * treat 0 as special, such as the occlusion query counters
diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
index 751332747b12e..1d39697e610e8 100644
--- a/drivers/gpu/drm/v3d/v3d_irq.c
+++ b/drivers/gpu/drm/v3d/v3d_irq.c
@@ -4,9 +4,9 @@
 /**
  * DOC: Interrupt management for the V3D engine
  *
- * When we take a bin, render, or TFU done interrupt, we need to
- * signal the fence for that job so that the scheduler can queue up
- * the next one and unblock any waiters.
+ * When we take a bin, render, TFU done, or CSD done interrupt, we
+ * need to signal the fence for that job so that the scheduler can
+ * queue up the next one and unblock any waiters.
  *
  * When we take the binner out of memory interrupt, we need to
  * allocate some new memory and pass it to the binner so that the
@@ -20,6 +20,7 @@
 #define V3D_CORE_IRQS ((u32)(V3D_INT_OUTOMEM |	\
 			     V3D_INT_FLDONE |	\
 			     V3D_INT_FRDONE |	\
+			     V3D_INT_CSDDONE |	\
 			     V3D_INT_GMPV))
 
 #define V3D_HUB_IRQS ((u32)(V3D_HUB_INT_MMU_WRV |	\
@@ -109,6 +110,15 @@ v3d_irq(int irq, void *arg)
 		status = IRQ_HANDLED;
 	}
 
+	if (intsts & V3D_INT_CSDDONE) {
+		struct v3d_fence *fence =
+			to_v3d_fence(v3d->csd_job->base.irq_fence);
+
+		trace_v3d_csd_irq(&v3d->drm, fence->seqno);
+		dma_fence_signal(&fence->base);
+		status = IRQ_HANDLED;
+	}
+
 	/* We shouldn't be triggering these if we have GMP in
 	 * always-allowed mode.
 	 */
diff --git a/drivers/gpu/drm/v3d/v3d_regs.h b/drivers/gpu/drm/v3d/v3d_regs.h
index 8e88af2376108..9a8ff0ce648ea 100644
--- a/drivers/gpu/drm/v3d/v3d_regs.h
+++ b/drivers/gpu/drm/v3d/v3d_regs.h
@@ -238,8 +238,11 @@
 #define V3D_CTL_L2TCACTL                               0x00030
 # define V3D_L2TCACTL_TMUWCF                           BIT(8)
 # define V3D_L2TCACTL_L2T_NO_WM                        BIT(4)
+/* Invalidates cache lines. */
 # define V3D_L2TCACTL_FLM_FLUSH                        0
+/* Removes cachelines without writing dirty lines back. */
 # define V3D_L2TCACTL_FLM_CLEAR                        1
+/* Writes out dirty cachelines and marks them clean, but doesn't invalidate. */
 # define V3D_L2TCACTL_FLM_CLEAN                        2
 # define V3D_L2TCACTL_FLM_MASK                         V3D_MASK(2, 1)
 # define V3D_L2TCACTL_FLM_SHIFT                        1
@@ -255,6 +258,8 @@
 #define V3D_CTL_INT_MSK_CLR                            0x00064
 # define V3D_INT_QPU_MASK                              V3D_MASK(27, 16)
 # define V3D_INT_QPU_SHIFT                             16
+# define V3D_INT_CSDDONE                               BIT(7)
+# define V3D_INT_PCTR                                  BIT(6)
 # define V3D_INT_GMPV                                  BIT(5)
 # define V3D_INT_TRFB                                  BIT(4)
 # define V3D_INT_SPILLUSE                              BIT(3)
@@ -374,4 +379,72 @@
 #define V3D_GMP_PRESERVE_LOAD                          0x00818
 #define V3D_GMP_VALID_LINES                            0x00820
 
+#define V3D_CSD_STATUS                                 0x00900
+# define V3D_CSD_STATUS_NUM_COMPLETED_MASK             V3D_MASK(11, 4)
+# define V3D_CSD_STATUS_NUM_COMPLETED_SHIFT            4
+# define V3D_CSD_STATUS_NUM_ACTIVE_MASK                V3D_MASK(3, 2)
+# define V3D_CSD_STATUS_NUM_ACTIVE_SHIFT               2
+# define V3D_CSD_STATUS_HAVE_CURRENT_DISPATCH          BIT(1)
+# define V3D_CSD_STATUS_HAVE_QUEUED_DISPATCH           BIT(0)
+
+#define V3D_CSD_QUEUED_CFG0                            0x00904
+# define V3D_CSD_QUEUED_CFG0_NUM_WGS_X_MASK            V3D_MASK(31, 16)
+# define V3D_CSD_QUEUED_CFG0_NUM_WGS_X_SHIFT           16
+# define V3D_CSD_QUEUED_CFG0_WG_X_OFFSET_MASK          V3D_MASK(15, 0)
+# define V3D_CSD_QUEUED_CFG0_WG_X_OFFSET_SHIFT         0
+
+#define V3D_CSD_QUEUED_CFG1                            0x00908
+# define V3D_CSD_QUEUED_CFG1_NUM_WGS_Y_MASK            V3D_MASK(31, 16)
+# define V3D_CSD_QUEUED_CFG1_NUM_WGS_Y_SHIFT           16
+# define V3D_CSD_QUEUED_CFG1_WG_Y_OFFSET_MASK          V3D_MASK(15, 0)
+# define V3D_CSD_QUEUED_CFG1_WG_Y_OFFSET_SHIFT         0
+
+#define V3D_CSD_QUEUED_CFG2                            0x0090c
+# define V3D_CSD_QUEUED_CFG2_NUM_WGS_Z_MASK            V3D_MASK(31, 16)
+# define V3D_CSD_QUEUED_CFG2_NUM_WGS_Z_SHIFT           16
+# define V3D_CSD_QUEUED_CFG2_WG_Z_OFFSET_MASK          V3D_MASK(15, 0)
+# define V3D_CSD_QUEUED_CFG2_WG_Z_OFFSET_SHIFT         0
+
+#define V3D_CSD_QUEUED_CFG3                            0x00910
+# define V3D_CSD_QUEUED_CFG3_OVERLAP_WITH_PREV         BIT(26)
+# define V3D_CSD_QUEUED_CFG3_MAX_SG_ID_MASK            V3D_MASK(25, 20)
+# define V3D_CSD_QUEUED_CFG3_MAX_SG_ID_SHIFT           20
+# define V3D_CSD_QUEUED_CFG3_BATCHES_PER_SG_M1_MASK    V3D_MASK(19, 12)
+# define V3D_CSD_QUEUED_CFG3_BATCHES_PER_SG_M1_SHIFT   12
+# define V3D_CSD_QUEUED_CFG3_WGS_PER_SG_MASK           V3D_MASK(11, 8)
+# define V3D_CSD_QUEUED_CFG3_WGS_PER_SG_SHIFT          8
+# define V3D_CSD_QUEUED_CFG3_WG_SIZE_MASK              V3D_MASK(7, 0)
+# define V3D_CSD_QUEUED_CFG3_WG_SIZE_SHIFT             0
+
+/* Number of batches, minus 1 */
+#define V3D_CSD_QUEUED_CFG4                            0x00914
+
+/* Shader address, pnan, singleseg, threading, like a shader record. */
+#define V3D_CSD_QUEUED_CFG5                            0x00918
+
+/* Uniforms address (4 byte aligned) */
+#define V3D_CSD_QUEUED_CFG6                            0x0091c
+
+#define V3D_CSD_CURRENT_CFG0                          0x00920
+#define V3D_CSD_CURRENT_CFG1                          0x00924
+#define V3D_CSD_CURRENT_CFG2                          0x00928
+#define V3D_CSD_CURRENT_CFG3                          0x0092c
+#define V3D_CSD_CURRENT_CFG4                          0x00930
+#define V3D_CSD_CURRENT_CFG5                          0x00934
+#define V3D_CSD_CURRENT_CFG6                          0x00938
+
+#define V3D_CSD_CURRENT_ID0                            0x0093c
+# define V3D_CSD_CURRENT_ID0_WG_X_MASK                 V3D_MASK(31, 16)
+# define V3D_CSD_CURRENT_ID0_WG_X_SHIFT                16
+# define V3D_CSD_CURRENT_ID0_WG_IN_SG_MASK             V3D_MASK(11, 8)
+# define V3D_CSD_CURRENT_ID0_WG_IN_SG_SHIFT            8
+# define V3D_CSD_CURRENT_ID0_L_IDX_MASK                V3D_MASK(7, 0)
+# define V3D_CSD_CURRENT_ID0_L_IDX_SHIFT               0
+
+#define V3D_CSD_CURRENT_ID1                            0x00940
+# define V3D_CSD_CURRENT_ID0_WG_Z_MASK                 V3D_MASK(31, 16)
+# define V3D_CSD_CURRENT_ID0_WG_Z_SHIFT                16
+# define V3D_CSD_CURRENT_ID0_WG_Y_MASK                 V3D_MASK(15, 0)
+# define V3D_CSD_CURRENT_ID0_WG_Y_SHIFT                0
+
 #endif /* V3D_REGS_H */
diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
index e47f13bec114f..f7c61e4991d34 100644
--- a/drivers/gpu/drm/v3d/v3d_sched.c
+++ b/drivers/gpu/drm/v3d/v3d_sched.c
@@ -48,6 +48,12 @@ to_tfu_job(struct drm_sched_job *sched_job)
 	return container_of(sched_job, struct v3d_tfu_job, base.base);
 }
 
+static struct v3d_csd_job *
+to_csd_job(struct drm_sched_job *sched_job)
+{
+	return container_of(sched_job, struct v3d_csd_job, base.base);
+}
+
 static void
 v3d_job_free(struct drm_sched_job *sched_job)
 {
@@ -205,6 +211,48 @@ v3d_tfu_job_run(struct drm_sched_job *sched_job)
 	return fence;
 }
 
+static struct dma_fence *
+v3d_csd_job_run(struct drm_sched_job *sched_job)
+{
+	struct v3d_csd_job *job = to_csd_job(sched_job);
+	struct v3d_dev *v3d = job->base.v3d;
+	struct drm_device *dev = &v3d->drm;
+	struct dma_fence *fence;
+	int i;
+
+	v3d->csd_job = job;
+
+	v3d_invalidate_caches(v3d);
+
+	fence = v3d_fence_create(v3d, V3D_CSD);
+	if (IS_ERR(fence))
+		return NULL;
+
+	if (job->base.irq_fence)
+		dma_fence_put(job->base.irq_fence);
+	job->base.irq_fence = dma_fence_get(fence);
+
+	trace_v3d_submit_csd(dev, to_v3d_fence(fence)->seqno);
+
+	for (i = 1; i <= 6; i++)
+		V3D_CORE_WRITE(0, V3D_CSD_QUEUED_CFG0 + 4 * i, job->args.cfg[i]);
+	/* CFG0 write kicks off the job. */
+	V3D_CORE_WRITE(0, V3D_CSD_QUEUED_CFG0, job->args.cfg[0]);
+
+	return fence;
+}
+
+static struct dma_fence *
+v3d_cache_clean_job_run(struct drm_sched_job *sched_job)
+{
+	struct v3d_job *job = to_v3d_job(sched_job);
+	struct v3d_dev *v3d = job->v3d;
+
+	v3d_clean_caches(v3d);
+
+	return NULL;
+}
+
 static void
 v3d_gpu_reset_for_timeout(struct v3d_dev *v3d, struct drm_sched_job *sched_job)
 {
@@ -277,13 +325,31 @@ v3d_render_job_timedout(struct drm_sched_job *sched_job)
 }
 
 static void
-v3d_tfu_job_timedout(struct drm_sched_job *sched_job)
+v3d_generic_job_timedout(struct drm_sched_job *sched_job)
 {
 	struct v3d_job *job = to_v3d_job(sched_job);
 
 	v3d_gpu_reset_for_timeout(job->v3d, sched_job);
 }
 
+static void
+v3d_csd_job_timedout(struct drm_sched_job *sched_job)
+{
+	struct v3d_csd_job *job = to_csd_job(sched_job);
+	struct v3d_dev *v3d = job->base.v3d;
+	u32 batches = V3D_CORE_READ(0, V3D_CSD_CURRENT_CFG4);
+
+	/* If we've made progress, skip reset and let the timer get
+	 * rearmed.
+	 */
+	if (job->timedout_batches != batches) {
+		job->timedout_batches = batches;
+		return;
+	}
+
+	v3d_gpu_reset_for_timeout(v3d, sched_job);
+}
+
 static const struct drm_sched_backend_ops v3d_bin_sched_ops = {
 	.dependency = v3d_job_dependency,
 	.run_job = v3d_bin_job_run,
@@ -301,10 +367,24 @@ static const struct drm_sched_backend_ops v3d_render_sched_ops = {
 static const struct drm_sched_backend_ops v3d_tfu_sched_ops = {
 	.dependency = v3d_job_dependency,
 	.run_job = v3d_tfu_job_run,
-	.timedout_job = v3d_tfu_job_timedout,
+	.timedout_job = v3d_generic_job_timedout,
 	.free_job = v3d_job_free,
 };
 
+static const struct drm_sched_backend_ops v3d_csd_sched_ops = {
+	.dependency = v3d_job_dependency,
+	.run_job = v3d_csd_job_run,
+	.timedout_job = v3d_csd_job_timedout,
+	.free_job = v3d_job_free
+};
+
+static const struct drm_sched_backend_ops v3d_cache_clean_sched_ops = {
+	.dependency = v3d_job_dependency,
+	.run_job = v3d_cache_clean_job_run,
+	.timedout_job = v3d_generic_job_timedout,
+	.free_job = v3d_job_free
+};
+
 int
 v3d_sched_init(struct v3d_dev *v3d)
 {
@@ -331,7 +411,7 @@ v3d_sched_init(struct v3d_dev *v3d)
 	if (ret) {
 		dev_err(v3d->dev, "Failed to create render scheduler: %d.",
 			ret);
-		drm_sched_fini(&v3d->queue[V3D_BIN].sched);
+		v3d_sched_fini(v3d);
 		return ret;
 	}
 
@@ -343,11 +423,36 @@ v3d_sched_init(struct v3d_dev *v3d)
 	if (ret) {
 		dev_err(v3d->dev, "Failed to create TFU scheduler: %d.",
 			ret);
-		drm_sched_fini(&v3d->queue[V3D_RENDER].sched);
-		drm_sched_fini(&v3d->queue[V3D_BIN].sched);
+		v3d_sched_fini(v3d);
 		return ret;
 	}
 
+	if (v3d_has_csd(v3d)) {
+		ret = drm_sched_init(&v3d->queue[V3D_CSD].sched,
+				     &v3d_csd_sched_ops,
+				     hw_jobs_limit, job_hang_limit,
+				     msecs_to_jiffies(hang_limit_ms),
+				     "v3d_csd");
+		if (ret) {
+			dev_err(v3d->dev, "Failed to create CSD scheduler: %d.",
+				ret);
+			v3d_sched_fini(v3d);
+			return ret;
+		}
+
+		ret = drm_sched_init(&v3d->queue[V3D_CACHE_CLEAN].sched,
+				     &v3d_cache_clean_sched_ops,
+				     hw_jobs_limit, job_hang_limit,
+				     msecs_to_jiffies(hang_limit_ms),
+				     "v3d_cache_clean");
+		if (ret) {
+			dev_err(v3d->dev, "Failed to create CACHE_CLEAN scheduler: %d.",
+				ret);
+			v3d_sched_fini(v3d);
+			return ret;
+		}
+	}
+
 	return 0;
 }
 
@@ -356,6 +461,8 @@ v3d_sched_fini(struct v3d_dev *v3d)
 {
 	enum v3d_queue q;
 
-	for (q = 0; q < V3D_MAX_QUEUES; q++)
-		drm_sched_fini(&v3d->queue[q].sched);
+	for (q = 0; q < V3D_MAX_QUEUES; q++) {
+		if (v3d->queue[q].sched.ops)
+			drm_sched_fini(&v3d->queue[q].sched);
+	}
 }
diff --git a/drivers/gpu/drm/v3d/v3d_trace.h b/drivers/gpu/drm/v3d/v3d_trace.h
index edd984afa33fb..7aa8dc356e54c 100644
--- a/drivers/gpu/drm/v3d/v3d_trace.h
+++ b/drivers/gpu/drm/v3d/v3d_trace.h
@@ -124,6 +124,26 @@ TRACE_EVENT(v3d_tfu_irq,
 		      __entry->seqno)
 );
 
+TRACE_EVENT(v3d_csd_irq,
+	    TP_PROTO(struct drm_device *dev,
+		     uint64_t seqno),
+	    TP_ARGS(dev, seqno),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u64, seqno)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->seqno = seqno;
+			   ),
+
+	    TP_printk("dev=%u, seqno=%llu",
+		      __entry->dev,
+		      __entry->seqno)
+);
+
 TRACE_EVENT(v3d_submit_tfu_ioctl,
 	    TP_PROTO(struct drm_device *dev, u32 iia),
 	    TP_ARGS(dev, iia),
@@ -163,6 +183,80 @@ TRACE_EVENT(v3d_submit_tfu,
 		      __entry->seqno)
 );
 
+TRACE_EVENT(v3d_submit_csd_ioctl,
+	    TP_PROTO(struct drm_device *dev, u32 cfg5, u32 cfg6),
+	    TP_ARGS(dev, cfg5, cfg6),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u32, cfg5)
+			     __field(u32, cfg6)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->cfg5 = cfg5;
+			   __entry->cfg6 = cfg6;
+			   ),
+
+	    TP_printk("dev=%u, CFG5 0x%08x, CFG6 0x%08x",
+		      __entry->dev,
+		      __entry->cfg5,
+		      __entry->cfg6)
+);
+
+TRACE_EVENT(v3d_submit_csd,
+	    TP_PROTO(struct drm_device *dev,
+		     uint64_t seqno),
+	    TP_ARGS(dev, seqno),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     __field(u64, seqno)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   __entry->seqno = seqno;
+			   ),
+
+	    TP_printk("dev=%u, seqno=%llu",
+		      __entry->dev,
+		      __entry->seqno)
+);
+
+TRACE_EVENT(v3d_cache_clean_begin,
+	    TP_PROTO(struct drm_device *dev),
+	    TP_ARGS(dev),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   ),
+
+	    TP_printk("dev=%u",
+		      __entry->dev)
+);
+
+TRACE_EVENT(v3d_cache_clean_end,
+	    TP_PROTO(struct drm_device *dev),
+	    TP_ARGS(dev),
+
+	    TP_STRUCT__entry(
+			     __field(u32, dev)
+			     ),
+
+	    TP_fast_assign(
+			   __entry->dev = dev->primary->index;
+			   ),
+
+	    TP_printk("dev=%u",
+		      __entry->dev)
+);
+
 TRACE_EVENT(v3d_reset_begin,
 	    TP_PROTO(struct drm_device *dev),
 	    TP_ARGS(dev),
diff --git a/include/uapi/drm/v3d_drm.h b/include/uapi/drm/v3d_drm.h
index c4b67eab7e594..c8a508a5e9dab 100644
--- a/include/uapi/drm/v3d_drm.h
+++ b/include/uapi/drm/v3d_drm.h
@@ -37,6 +37,7 @@ extern "C" {
 #define DRM_V3D_GET_PARAM                         0x04
 #define DRM_V3D_GET_BO_OFFSET                     0x05
 #define DRM_V3D_SUBMIT_TFU                        0x06
+#define DRM_V3D_SUBMIT_CSD                        0x07
 
 #define DRM_IOCTL_V3D_SUBMIT_CL           DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_SUBMIT_CL, struct drm_v3d_submit_cl)
 #define DRM_IOCTL_V3D_WAIT_BO             DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_WAIT_BO, struct drm_v3d_wait_bo)
@@ -45,6 +46,7 @@ extern "C" {
 #define DRM_IOCTL_V3D_GET_PARAM           DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_GET_PARAM, struct drm_v3d_get_param)
 #define DRM_IOCTL_V3D_GET_BO_OFFSET       DRM_IOWR(DRM_COMMAND_BASE + DRM_V3D_GET_BO_OFFSET, struct drm_v3d_get_bo_offset)
 #define DRM_IOCTL_V3D_SUBMIT_TFU          DRM_IOW(DRM_COMMAND_BASE + DRM_V3D_SUBMIT_TFU, struct drm_v3d_submit_tfu)
+#define DRM_IOCTL_V3D_SUBMIT_CSD          DRM_IOW(DRM_COMMAND_BASE + DRM_V3D_SUBMIT_CSD, struct drm_v3d_submit_csd)
 
 /**
  * struct drm_v3d_submit_cl - ioctl argument for submitting commands to the 3D
@@ -172,6 +174,7 @@ enum drm_v3d_param {
 	DRM_V3D_PARAM_V3D_CORE0_IDENT1,
 	DRM_V3D_PARAM_V3D_CORE0_IDENT2,
 	DRM_V3D_PARAM_SUPPORTS_TFU,
+	DRM_V3D_PARAM_SUPPORTS_CSD,
 };
 
 struct drm_v3d_get_param {
@@ -212,6 +215,31 @@ struct drm_v3d_submit_tfu {
 	__u32 out_sync;
 };
 
+/* Submits a compute shader for dispatch.  This job will block on any
+ * previous compute shaders submitted on this fd, and any other
+ * synchronization must be performed with in_sync/out_sync.
+ */
+struct drm_v3d_submit_csd {
+	__u32 cfg[7];
+	__u32 coef[4];
+
+	/* Pointer to a u32 array of the BOs that are referenced by the job.
+	 */
+	__u64 bo_handles;
+
+	/* Number of BO handles passed in (size is that times 4). */
+	__u32 bo_handle_count;
+
+	/* sync object to block on before running the CSD job.  Each
+	 * CSD job will execute in the order submitted to its FD.
+	 * Synchronization against rendering/TFU jobs or CSD from
+	 * other fds requires using sync objects.
+	 */
+	__u32 in_sync;
+	/* Sync object to signal when the CSD job is done. */
+	__u32 out_sync;
+};
+
 #if defined(__cplusplus)
 }
 #endif
-- 
GitLab


From b051adf80d02f51507c5c198e49f0e54ac5f9e13 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Thu, 2 May 2019 13:22:53 -0700
Subject: [PATCH 0621/1835] drm/v3d: Clock V3D down when not in use.

My various attempts at re-enabling runtime PM have failed, so just
crank the clock down when V3D is idle to reduce power consumption.

Signed-off-by: Eric Anholt <eric@anholt.net>
---
 drivers/gpu/drm/v3d/v3d_drv.c | 18 +++++++++++++
 drivers/gpu/drm/v3d/v3d_drv.h |  6 +++++
 drivers/gpu/drm/v3d/v3d_gem.c | 49 +++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+)

diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index 05978cd7c8c64..cffd69464b17a 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -297,6 +297,21 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
 		}
 	}
 
+	v3d->clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(v3d->clk)) {
+		if (ret != -EPROBE_DEFER)
+			dev_err(dev, "Failed to get clock\n");
+		goto dev_free;
+	}
+	v3d->clk_up_rate = clk_get_rate(v3d->clk);
+	/* For downclocking, drop it to the minimum frequency we can get from
+	 * the CPRMAN clock generator dividing off our parent.  The divider is
+	 * 4 bits, but ask for just higher than that so that rounding doesn't
+	 * make cprman reject our rate.
+	 */
+	v3d->clk_down_rate =
+		(clk_get_rate(clk_get_parent(v3d->clk)) / (1 << 4)) + 10000;
+
 	if (v3d->ver < 41) {
 		ret = map_regs(v3d, &v3d->gca_regs, "gca");
 		if (ret)
@@ -331,6 +346,9 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
 	if (ret)
 		goto irq_disable;
 
+	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
+	WARN_ON_ONCE(ret != 0);
+
 	return 0;
 
 irq_disable:
diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
index 2de04ada4d3bb..7b4f3b5a086ed 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.h
+++ b/drivers/gpu/drm/v3d/v3d_drv.h
@@ -45,6 +45,12 @@ struct v3d_dev {
 	void __iomem *bridge_regs;
 	void __iomem *gca_regs;
 	struct clk *clk;
+	struct delayed_work clk_down_work;
+	unsigned long clk_up_rate, clk_down_rate;
+	struct mutex clk_lock;
+	u32 clk_refcount;
+	bool clk_up;
+
 	struct reset_control *reset;
 
 	/* Virtual and DMA addresses of the single shared page table. */
diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index fe14777c3c20e..ce72a4d08fe64 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -3,6 +3,7 @@
 
 #include <drm/drmP.h>
 #include <drm/drm_syncobj.h>
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
@@ -16,6 +17,47 @@
 #include "v3d_regs.h"
 #include "v3d_trace.h"
 
+static void
+v3d_clock_down_work(struct work_struct *work)
+{
+	struct v3d_dev *v3d =
+		container_of(work, struct v3d_dev, clk_down_work.work);
+	int ret;
+
+	ret = clk_set_rate(v3d->clk, v3d->clk_down_rate);
+	v3d->clk_up = false;
+	WARN_ON_ONCE(ret != 0);
+}
+
+static void
+v3d_clock_up_get(struct v3d_dev *v3d)
+{
+	mutex_lock(&v3d->clk_lock);
+	if (v3d->clk_refcount++ == 0) {
+		cancel_delayed_work_sync(&v3d->clk_down_work);
+		if (!v3d->clk_up)  {
+			int ret;
+
+			ret = clk_set_rate(v3d->clk, v3d->clk_up_rate);
+			WARN_ON_ONCE(ret != 0);
+			v3d->clk_up = true;
+		}
+	}
+	mutex_unlock(&v3d->clk_lock);
+}
+
+static void
+v3d_clock_up_put(struct v3d_dev *v3d)
+{
+	mutex_lock(&v3d->clk_lock);
+	if (--v3d->clk_refcount == 0) {
+		schedule_delayed_work(&v3d->clk_down_work,
+				      msecs_to_jiffies(100));
+	}
+	mutex_unlock(&v3d->clk_lock);
+}
+
+
 static void
 v3d_init_core(struct v3d_dev *v3d, int core)
 {
@@ -490,6 +532,7 @@ static void
 v3d_job_free(struct kref *ref)
 {
 	struct v3d_job *job = container_of(ref, struct v3d_job, refcount);
+	struct v3d_dev *v3d = job->v3d;
 	int i;
 
 	for (i = 0; i < job->bo_count; i++) {
@@ -505,6 +548,8 @@ v3d_job_free(struct kref *ref)
 	dma_fence_put(job->irq_fence);
 	dma_fence_put(job->done_fence);
 
+	v3d_clock_up_put(v3d);
+
 	kfree(job);
 }
 
@@ -596,6 +641,7 @@ v3d_job_init(struct v3d_dev *v3d, struct drm_file *file_priv,
 	if (ret)
 		return ret;
 
+	v3d_clock_up_get(v3d);
 	kref_init(&job->refcount);
 
 	return 0;
@@ -963,6 +1009,9 @@ v3d_gem_init(struct drm_device *dev)
 	mutex_init(&v3d->sched_lock);
 	mutex_init(&v3d->cache_clean_lock);
 
+	mutex_init(&v3d->clk_lock);
+	INIT_DELAYED_WORK(&v3d->clk_down_work, v3d_clock_down_work);
+
 	/* Note: We don't allocate address 0.  Various bits of HW
 	 * treat 0 as special, such as the occlusion query counters
 	 * where 0 means "disabled".
-- 
GitLab


From 1ac954a8c5dd939dffd3b256be50253082297d9a Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Thu, 2 May 2019 23:42:29 +0200
Subject: [PATCH 0622/1835] HACK: clk-bcm2835: Add BCM2838_CLOCK_EMMC2 support

The new BCM2838 supports an additional emmc2 clock. So add a new
compatible to register this clock only for BCM2838.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 drivers/clk/bcm/clk-bcm2835.c       | 20 ++++++++++++++++++--
 include/dt-bindings/clock/bcm2835.h |  2 ++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 07ddfc02ac955..a885c2faa7b0b 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -124,6 +124,8 @@
 #define CM_AVEODIV		0x1bc
 #define CM_EMMCCTL		0x1c0
 #define CM_EMMCDIV		0x1c4
+#define CM_EMMC2CTL		0x1d0
+#define CM_EMMC2DIV		0x1d4
 
 /* General bits for the CM_*CTL regs */
 # define CM_ENABLE			BIT(4)
@@ -2047,6 +2049,15 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
 		.frac_bits = 8,
 		.tcnt_mux = 39),
 
+	/* EMMC2 clock (only available for BCM2838) */
+	[BCM2838_CLOCK_EMMC2]	= REGISTER_PER_CLK(
+		.name = "emmc2",
+		.ctl_reg = CM_EMMC2CTL,
+		.div_reg = CM_EMMC2DIV,
+		.int_bits = 4,
+		.frac_bits = 8,
+		.tcnt_mux = 42),
+
 	/* General purpose (GPIO) clocks */
 	[BCM2835_CLOCK_GP0]	= REGISTER_PER_CLK(
 		.name = "gp0",
@@ -2276,8 +2287,12 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 
 	for (i = 0; i < asize; i++) {
 		desc = &clk_desc_array[i];
-		if (desc->clk_register && desc->data)
-			hws[i] = desc->clk_register(cprman, desc->data);
+		if (desc->clk_register && desc->data) {
+			if ((i != BCM2838_CLOCK_EMMC2) ||
+			    of_device_is_compatible(fw_node, "brcm,bcm2838-cprman")) {
+				hws[i] = desc->clk_register(cprman, desc->data);
+			}
+		}
 	}
 
 	ret = bcm2835_mark_sdc_parent_critical(hws[BCM2835_CLOCK_SDRAM]->clk);
@@ -2297,6 +2312,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 
 static const struct of_device_id bcm2835_clk_of_match[] = {
 	{ .compatible = "brcm,bcm2835-cprman", },
+	{ .compatible = "brcm,bcm2838-cprman", },
 	{}
 };
 MODULE_DEVICE_TABLE(of, bcm2835_clk_of_match);
diff --git a/include/dt-bindings/clock/bcm2835.h b/include/dt-bindings/clock/bcm2835.h
index a0c812b0fa391..077796e8f24b1 100644
--- a/include/dt-bindings/clock/bcm2835.h
+++ b/include/dt-bindings/clock/bcm2835.h
@@ -66,3 +66,5 @@
 #define BCM2835_CLOCK_DSI1E		48
 #define BCM2835_CLOCK_DSI0P		49
 #define BCM2835_CLOCK_DSI1P		50
+
+#define BCM2838_CLOCK_EMMC2		51
-- 
GitLab


From 36d9e05dfc05f41dd41125b2337161c4104c24bb Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 3 May 2019 13:58:03 +0100
Subject: [PATCH 0623/1835] drm: vc4-firmware-kms: Remove incorrect overscan
 support.

The overscan support was required for the old mailbox API
in order to match up the cursor and frame buffer planes.
With the newer API directly talking to dispmanx there is no
difference, therefore FKMS does not need to make any
adjustments.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 30d1a5048eb2e..2ca0f8e91719d 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -232,7 +232,6 @@ struct vc4_crtc {
 	void __iomem *regs;
 
 	struct drm_pending_vblank_event *event;
-	u32 overscan[4];
 	bool vblank_enabled;
 	u32 display_number;
 	u32 display_type;
@@ -468,11 +467,6 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 		break;
 	}
 
-	if (vc4_crtc) {
-		mb->plane.dst_x += vc4_crtc->overscan[0];
-		mb->plane.dst_y += vc4_crtc->overscan[1];
-	}
-
 	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane update %dx%d@%d +dst(%d,%d, %d,%d) +src(%d,%d, %d,%d) 0x%08x/%08x/%08x/%d, alpha %u zpos %u\n",
 			 plane->base.id, plane->name,
 			 mb->plane.width,
@@ -1228,15 +1222,6 @@ static int vc4_fkms_create_screen(struct device *dev, struct drm_device *drm,
 		goto err_destroy_encoder;
 	}
 
-	ret = rpi_firmware_property(vc4->firmware,
-				    RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN,
-				    &vc4_crtc->overscan,
-				    sizeof(vc4_crtc->overscan));
-	if (ret) {
-		DRM_ERROR("Failed to get overscan state: 0x%08x\n", vc4_crtc->overscan[0]);
-		memset(&vc4_crtc->overscan, 0, sizeof(vc4_crtc->overscan));
-	}
-
 	*ret_crtc = vc4_crtc;
 
 	return 0;
-- 
GitLab


From ae9a8ef00f8439541af21d189f43e343fee00806 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 7 May 2019 12:13:34 +0100
Subject: [PATCH 0624/1835] drm: vc4: Log flags in fkms mode set

The flags contain info such as limited/full range RGB, aspect
ratio, and a fwe other useful things.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 2ca0f8e91719d..30379c3f151be 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -685,12 +685,13 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 		return;
 	}
 
-	DRM_DEBUG_KMS("Setting mode for display num %u mode name %s, clk %d, h(disp %d, start %d, end %d, total %d, skew %d) v(disp %d, start %d, end %d, total %d, scan %d), vrefresh %d, par %u\n",
+	DRM_DEBUG_KMS("Setting mode for display num %u mode name %s, clk %d, h(disp %d, start %d, end %d, total %d, skew %d) v(disp %d, start %d, end %d, total %d, scan %d), vrefresh %d, par %u, flags 0x%04x\n",
 		      vc4_crtc->display_number, mode->name, mode->clock,
 		      mode->hdisplay, mode->hsync_start, mode->hsync_end,
 		      mode->htotal, mode->hskew, mode->vdisplay,
 		      mode->vsync_start, mode->vsync_end, mode->vtotal,
-		      mode->vscan, mode->vrefresh, mode->picture_aspect_ratio);
+		      mode->vscan, mode->vrefresh, mode->picture_aspect_ratio,
+		      mode->flags);
 	mb.timings.display = vc4_crtc->display_number;
 
 	mb.timings.video_id_code = frame.avi.video_code;
-- 
GitLab


From bd268c90a075bc64fbc254be64c511790db2e0eb Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 16 May 2019 17:49:42 +0100
Subject: [PATCH 0625/1835] drm: vc4-firmware-kms: Fix DSI display support

The mode was incorrectly listed as interlaced, which was then
rejected.
Correct this and FKMS works with the DSI display.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 30379c3f151be..42ce8334e7f1f 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -1003,7 +1003,7 @@ static const struct drm_display_mode lcd_mode = {
 		 25979400 / 1000,
 		 800, 800 + 1, 800 + 1 + 2, 800 + 1 + 2 + 46, 0,
 		 480, 480 + 7, 480 + 7 + 2, 480 + 7 + 2 + 21, 0,
-		 DRM_MODE_FLAG_INTERLACE)
+		 0)
 };
 
 static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
-- 
GitLab


From 1a003491c9786740896c8389ec78bf05a284b0be Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 21 May 2019 11:50:00 +0100
Subject: [PATCH 0626/1835] drm: vc4: Probe DPI/DSI timings from the firmware

For DPI and DSI displays query the firmware as to the configuration
and add it as the only mode for DRM.

In theory we can add plumbing for setting the DPI/DSI mode from
KMS, but this is not being added at present as the support frameworks
aren't present in the firmware.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c     | 60 ++++++++++++++++++----
 include/soc/bcm2835/raspberrypi-firmware.h |  1 +
 2 files changed, 51 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 42ce8334e7f1f..de2172d1faa72 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -280,7 +280,7 @@ static u32 vc4_get_display_type(u32 display_number)
 		/* The firmware display (DispmanX) IDs map to specific types in
 		 * a fixed manner.
 		 */
-		DRM_MODE_ENCODER_DSI,	/* MAIN_LCD */
+		DRM_MODE_ENCODER_DSI,	/* MAIN_LCD - DSI or DPI */
 		DRM_MODE_ENCODER_DSI,	/* AUX_LCD */
 		DRM_MODE_ENCODER_TMDS,	/* HDMI0 */
 		DRM_MODE_ENCODER_TVDAC,	/* VEC */
@@ -362,7 +362,6 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 					vc4_get_vc_image_fmt(drm_fmt->format);
 	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
 	struct mailbox_set_plane *mb = &vc4_plane->mb;
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(state->crtc);
 	int num_planes = fb->format->num_planes;
 	struct drm_display_mode *mode = &state->crtc->mode;
 	unsigned int rotation = SUPPORTED_ROTATIONS;
@@ -997,7 +996,9 @@ static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
 	return ret;
 }
 
-/* FIXME: Read LCD mode from the firmware. This is the DSI panel resolution. */
+/* This is the DSI panel resolution. Use this as a default should the firmware
+ * not respond to our request for the timings.
+ */
 static const struct drm_display_mode lcd_mode = {
 	DRM_MODE("800x480", DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
 		 25979400 / 1000,
@@ -1008,15 +1009,54 @@ static const struct drm_display_mode lcd_mode = {
 
 static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
 {
-	//struct vc4_fkms_connector *fkms_connector =
-	//				to_vc4_fkms_connector(connector);
-	//struct drm_encoder *encoder = fkms_connector->encoder;
-	//struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
+	struct vc4_fkms_connector *fkms_connector =
+					to_vc4_fkms_connector(connector);
+	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
 	struct drm_display_mode *mode;
-	//int ret = 0;
+	struct mailbox_set_mode mb = {
+		.tag1 = { RPI_FIRMWARE_GET_DISPLAY_TIMING,
+			  sizeof(struct set_timings), 0},
+		.timings = { .display = fkms_connector->display_number },
+	};
+	struct drm_display_mode fw_mode;
+	int ret = 0;
+
+	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
+	if (!ret) {
+		/* Equivalent to DRM_MODE macro. */
+		memset(&fw_mode, 0, sizeof(fw_mode));
+		strncpy(fw_mode.name, "LCD_MODE", sizeof(fw_mode.name));
+		fw_mode.status = 0;
+		fw_mode.type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
+		fw_mode.clock = mb.timings.clock;
+		fw_mode.hdisplay = mb.timings.hdisplay;
+		fw_mode.hsync_start = mb.timings.hsync_start;
+		fw_mode.hsync_end = mb.timings.hsync_end;
+		fw_mode.htotal = mb.timings.htotal;
+		fw_mode.hskew = 0;
+		fw_mode.vdisplay = mb.timings.vdisplay;
+		fw_mode.vsync_start = mb.timings.vsync_start;
+		fw_mode.vsync_end = mb.timings.vsync_end;
+		fw_mode.vtotal = mb.timings.vtotal;
+		fw_mode.vscan = mb.timings.vscan;
+		if (mb.timings.flags & TIMINGS_FLAGS_H_SYNC_POS)
+			fw_mode.flags |= DRM_MODE_FLAG_PHSYNC;
+		else
+			fw_mode.flags |= DRM_MODE_FLAG_NHSYNC;
+		if (mb.timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
+			fw_mode.flags |= DRM_MODE_FLAG_PVSYNC;
+		else
+			fw_mode.flags |= DRM_MODE_FLAG_NVSYNC;
+
+		fw_mode.base.type = DRM_MODE_OBJECT_MODE;
+
+		mode = drm_mode_duplicate(connector->dev,
+					  &fw_mode);
+	} else {
+		mode = drm_mode_duplicate(connector->dev,
+					  &lcd_mode);
+	}
 
-	mode = drm_mode_duplicate(connector->dev,
-				  &lcd_mode);
 	if (!mode) {
 		DRM_ERROR("Failed to create a new display mode\n");
 		return -ENOMEM;
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 50ed6dc6ded1a..3516ba60dcfc9 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -151,6 +151,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
 
 	RPI_FIRMWARE_SET_PLANE =                              0x00048015,
+	RPI_FIRMWARE_GET_DISPLAY_TIMING =                     0x00040017,
 	RPI_FIRMWARE_SET_TIMING =                             0x00048017,
 
 	RPI_FIRMWARE_GET_COMMAND_LINE =                       0x00050001,
-- 
GitLab


From 34d3ba04e890437b4776f271bbfa8899b6ac0327 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 28 May 2019 13:56:06 +0100
Subject: [PATCH 0627/1835] drm: vc4: handle the case where there are no
 available displays

It's reasonable for the firmware to return zero as the number of
attached displays. Handle this case as otherwise drm thinks that
the DSI panel is attached, which is nonsense.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 32 +++++++++++++++-----------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index de2172d1faa72..8c7d3df9f6872 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -1309,13 +1309,13 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
 				    &num_displays, sizeof(u32));
 
-	/* If we fail to get the number of displays, or it returns 0, then
+	/* If we fail to get the number of displays, then
 	 * assume old firmware that doesn't have the mailbox call, so just
 	 * set one display
 	 */
-	if (ret || num_displays == 0) {
+	if (ret) {
 		num_displays = 1;
-		DRM_WARN("Unable to determine number of displays's. Assuming 1\n");
+		DRM_WARN("Unable to determine number of displays - assuming 1\n");
 		ret = 0;
 	}
 
@@ -1344,17 +1344,21 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 				  display_num);
 	}
 
-	/* Map the SMI interrupt reg */
-	crtc_list[0]->regs = vc4_ioremap_regs(pdev, 0);
-	if (IS_ERR(crtc_list[0]->regs))
-		DRM_ERROR("Oh dear, failed to map registers\n");
-
-	writel(0, crtc_list[0]->regs + SMICS);
-	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
-			       vc4_crtc_irq_handler, 0, "vc4 firmware kms",
-			       crtc_list);
-	if (ret)
-		DRM_ERROR("Oh dear, failed to register IRQ\n");
+	if (num_displays > 0) {
+		/* Map the SMI interrupt reg */
+		crtc_list[0]->regs = vc4_ioremap_regs(pdev, 0);
+		if (IS_ERR(crtc_list[0]->regs))
+			DRM_ERROR("Oh dear, failed to map registers\n");
+
+		writel(0, crtc_list[0]->regs + SMICS);
+		ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+				       vc4_crtc_irq_handler, 0,
+				       "vc4 firmware kms", crtc_list);
+		if (ret)
+			DRM_ERROR("Oh dear, failed to register IRQ\n");
+	} else {
+		DRM_WARN("No displays found. Consider forcing hotplug if HDMI is attached\n");
+	}
 
 	platform_set_drvdata(pdev, crtc_list);
 
-- 
GitLab


From 6e4b6d7a91b0f0ec1d18c8dac64cfc49f90778e5 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 24 May 2019 17:59:01 +0100
Subject: [PATCH 0628/1835] drm/vc4: Support the VEC in FKMS

Extends the DPI/DSI support to also report the VEC output
which supports interlacing too.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 8c7d3df9f6872..d4e8f5eb9ea70 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -125,6 +125,7 @@ struct set_timings {
 #define  TIMINGS_FLAGS_H_SYNC_NEG	0
 #define  TIMINGS_FLAGS_V_SYNC_POS	BIT(1)
 #define  TIMINGS_FLAGS_V_SYNC_NEG	0
+#define  TIMINGS_FLAGS_INTERLACE	BIT(2)
 
 #define TIMINGS_FLAGS_ASPECT_MASK	GENMASK(7, 4)
 #define TIMINGS_FLAGS_ASPECT_NONE	(0 << 4)
@@ -1047,6 +1048,12 @@ static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
 			fw_mode.flags |= DRM_MODE_FLAG_PVSYNC;
 		else
 			fw_mode.flags |= DRM_MODE_FLAG_NVSYNC;
+		if (mb.timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
+			fw_mode.flags |= DRM_MODE_FLAG_PVSYNC;
+		else
+			fw_mode.flags |= DRM_MODE_FLAG_NVSYNC;
+		if (mb.timings.flags & TIMINGS_FLAGS_INTERLACE)
+			fw_mode.flags |= DRM_MODE_FLAG_INTERLACE;
 
 		fw_mode.base.type = DRM_MODE_OBJECT_MODE;
 
@@ -1133,17 +1140,24 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 				   DRM_MODE_CONNECTOR_DSI);
 		drm_connector_helper_add(connector,
 					 &vc4_fkms_lcd_conn_helper_funcs);
+		connector->interlace_allowed = 0;
+	} else if (fkms_connector->display_type == DRM_MODE_ENCODER_TVDAC) {
+		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
+				   DRM_MODE_CONNECTOR_Composite);
+		drm_connector_helper_add(connector,
+					 &vc4_fkms_lcd_conn_helper_funcs);
+		connector->interlace_allowed = 1;
 	} else {
 		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
 				   DRM_MODE_CONNECTOR_HDMIA);
 		drm_connector_helper_add(connector,
 					 &vc4_fkms_connector_helper_funcs);
+		connector->interlace_allowed = 0;
 	}
 
 	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
 			     DRM_CONNECTOR_POLL_DISCONNECT);
 
-	connector->interlace_allowed = 0;
 	connector->doublescan_allowed = 0;
 
 	drm_connector_attach_encoder(connector, encoder);
-- 
GitLab


From 8838a6009af220cef77e038f96c10d0ff6882094 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 7 May 2019 15:00:02 +0100
Subject: [PATCH 0629/1835] drm: vc4: Fixup typo when setting HDMI aspect ratio

Assignment was to the wrong structure.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index d4e8f5eb9ea70..c7e5e3a6f82c4 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -717,19 +717,19 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 	switch (frame.avi.picture_aspect) {
 	default:
 	case HDMI_PICTURE_ASPECT_NONE:
-		mode->flags |= TIMINGS_FLAGS_ASPECT_NONE;
+		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_NONE;
 		break;
 	case HDMI_PICTURE_ASPECT_4_3:
-		mode->flags |= TIMINGS_FLAGS_ASPECT_4_3;
+		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_4_3;
 		break;
 	case HDMI_PICTURE_ASPECT_16_9:
-		mode->flags |= TIMINGS_FLAGS_ASPECT_16_9;
+		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_16_9;
 		break;
 	case HDMI_PICTURE_ASPECT_64_27:
-		mode->flags |= TIMINGS_FLAGS_ASPECT_64_27;
+		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_64_27;
 		break;
 	case HDMI_PICTURE_ASPECT_256_135:
-		mode->flags |= TIMINGS_FLAGS_ASPECT_256_135;
+		mb.timings.flags |= TIMINGS_FLAGS_ASPECT_256_135;
 		break;
 	}
 
-- 
GitLab


From fe73195850f9b0d7efdeb3793ab3b384147df586 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 29 May 2019 15:44:11 +0100
Subject: [PATCH 0630/1835] drm/vc4: Correct SAND support for FKMS.

It was accepting NV21 which doesn't map through, but
also wasn't advertising the modifier so nothing would know
to request it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index c7e5e3a6f82c4..588c10f0c674b 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -545,7 +545,6 @@ static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
 			return false;
 		}
 	case DRM_FORMAT_NV12:
-	case DRM_FORMAT_NV21:
 		switch (fourcc_mod_broadcom_mod(modifier)) {
 		case DRM_FORMAT_MOD_LINEAR:
 		case DRM_FORMAT_MOD_BROADCOM_SAND128:
@@ -553,6 +552,7 @@ static bool vc4_fkms_format_mod_supported(struct drm_plane *plane,
 		default:
 			return false;
 		}
+	case DRM_FORMAT_NV21:
 	case DRM_FORMAT_RGB888:
 	case DRM_FORMAT_BGR888:
 	case DRM_FORMAT_YUV422:
@@ -599,6 +599,7 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 		 * would prefer to scan out linear (less bus traffic).
 		 */
 		DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED,
+		DRM_FORMAT_MOD_BROADCOM_SAND128,
 		DRM_FORMAT_MOD_INVALID,
 	};
 	int i;
-- 
GitLab


From c1ac2962fb1e85da0b4234104e8293cb84591988 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 30 May 2019 13:56:15 +0100
Subject: [PATCH 0631/1835] drm/vc4: fkms to query the VPU for HDMI clock
 limits

The VPU has configured clocks for 4k (or not) via config.txt,
and will limit the choice of video modes based on that.
Make fkms query it for these limits too to avoid selecting modes
that can not be handled by the current clock setup.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_drv.h              |  1 +
 drivers/gpu/drm/vc4/vc4_firmware_kms.c     | 48 ++++++++++++++++++++++
 include/soc/bcm2835/raspberrypi-firmware.h |  1 +
 3 files changed, 50 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 6ab999a03914c..e29895d47aff2 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -77,6 +77,7 @@ struct vc4_dev {
 	struct vc4_dsi *dsi1;
 	struct vc4_vec *vec;
 	struct vc4_txp *txp;
+	struct vc4_fkms *fkms;
 
 	struct vc4_hang_state *hang_state;
 
diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 588c10f0c674b..af98342ecd44b 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -29,6 +29,14 @@
 #include "vc_image_types.h"
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
+struct get_display_cfg {
+	u32  max_pixel_clock[2];  //Max pixel clock for each display
+};
+
+struct vc4_fkms {
+	struct get_display_cfg cfg;
+};
+
 #define PLANES_PER_CRTC		3
 
 struct set_plane {
@@ -794,6 +802,11 @@ static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_st
 static enum drm_mode_status
 vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 {
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
+	struct vc4_fkms *fkms = vc4->fkms;
+
 	/* Do not allow doublescan modes from user space */
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN) {
 		DRM_DEBUG_KMS("[CRTC:%d] Doublescan mode rejected.\n",
@@ -801,6 +814,22 @@ vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 		return MODE_NO_DBLESCAN;
 	}
 
+	/* Limit the pixel clock based on the HDMI clock limits from the
+	 * firmware
+	 */
+	switch (vc4_crtc->display_number) {
+	case 2:	/* HDMI0 */
+		if (fkms->cfg.max_pixel_clock[0] &&
+		    mode->clock > fkms->cfg.max_pixel_clock[0])
+			return MODE_CLOCK_HIGH;
+		break;
+	case 7:	/* HDMI1 */
+		if (fkms->cfg.max_pixel_clock[1] &&
+		    mode->clock > fkms->cfg.max_pixel_clock[1])
+			return MODE_CLOCK_HIGH;
+		break;
+	}
+
 	/* Limit the pixel clock until we can get dynamic HDMI 2.0 scrambling
 	 * working.
 	 */
@@ -1301,11 +1330,16 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 	struct device_node *firmware_node;
 	struct vc4_crtc **crtc_list;
 	u32 num_displays, display_num;
+	struct vc4_fkms *fkms;
 	int ret;
 	u32 display_id;
 
 	vc4->firmware_kms = true;
 
+	fkms = devm_kzalloc(dev, sizeof(*fkms), GFP_KERNEL);
+	if (!fkms)
+		return -ENOMEM;
+
 	/* firmware kms doesn't have precise a scanoutpos implementation, so
 	 * we can't do the precise vblank timestamp mode.
 	 */
@@ -1334,6 +1368,18 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 		ret = 0;
 	}
 
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_GET_DISPLAY_CFG,
+				    &fkms->cfg, sizeof(fkms->cfg));
+
+	if (ret)
+		return -EINVAL;
+	/* The firmware works in Hz. This will be compared against kHz, so div
+	 * 1000 now rather than multiple times later.
+	 */
+	fkms->cfg.max_pixel_clock[0] /= 1000;
+	fkms->cfg.max_pixel_clock[1] /= 1000;
+
 	/* Allocate a list, with space for a NULL on the end */
 	crtc_list = devm_kzalloc(dev, sizeof(crtc_list) * (num_displays + 1),
 				 GFP_KERNEL);
@@ -1375,6 +1421,8 @@ static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
 		DRM_WARN("No displays found. Consider forcing hotplug if HDMI is attached\n");
 	}
 
+	vc4->fkms = fkms;
+
 	platform_set_drvdata(pdev, crtc_list);
 
 	return 0;
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 3516ba60dcfc9..88b51f2ece2d7 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -153,6 +153,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_SET_PLANE =                              0x00048015,
 	RPI_FIRMWARE_GET_DISPLAY_TIMING =                     0x00040017,
 	RPI_FIRMWARE_SET_TIMING =                             0x00048017,
+	RPI_FIRMWARE_GET_DISPLAY_CFG =                        0x00040018,
 
 	RPI_FIRMWARE_GET_COMMAND_LINE =                       0x00050001,
 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
-- 
GitLab


From 4dc77d61462ab1837c0a04d4345ac35cf1db23c0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 30 May 2019 15:55:15 +0100
Subject: [PATCH 0632/1835] drm/vc4: Max resolution of 7680 is conditional on
 being Pi4

The max resolution had been increased from 2048 to 7680 for all
platforms. This code is common with Pi0-3 which have a max render
target for GL of 2048, therefore the increased resolution has to
be conditional on the platform.
Switch based on whether the bcm2835-v3d node is found, as that is
not present on Pi4. (There is a potential configuration on Pi0-3
with no v3d, but this is very unlikely).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_kms.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 0fc0e901f7865..966b9128f21af 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -429,8 +429,14 @@ int vc4_kms_load(struct drm_device *dev)
 		return ret;
 	}
 
-	dev->mode_config.max_width = 7680;
-	dev->mode_config.max_height = 7680;
+	if (!drm_core_check_feature(dev, DRIVER_RENDER)) {
+		/* No V3D as part of vc4. Assume this is Pi4. */
+		dev->mode_config.max_width = 7680;
+		dev->mode_config.max_height = 7680;
+	} else {
+		dev->mode_config.max_width = 2048;
+		dev->mode_config.max_height = 2048;
+	}
 	dev->mode_config.funcs = &vc4_mode_funcs;
 	dev->mode_config.preferred_depth = 24;
 	dev->mode_config.async_page_flip = true;
-- 
GitLab


From 6d6378f5d09ce820d9a076e55f953c1b8af3a43f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 10 Dec 2018 17:35:58 +0000
Subject: [PATCH 0633/1835] staging: vc-sm-cma: Remove obsolete comment and
 make function static

Removes obsolete comment about wanting to pass a function
pointer into mmal-vchiq as we now do.
As the function is passed as a function pointer, the function itself
can be static.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 888040e22d329..9893a3b682816 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -594,8 +594,7 @@ error:
 	return ret;
 }
 
-/* FIXME: Pass a function pointer to this into vc_vchi_sm.c */
-void
+static void
 vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
 		int reply_len)
 {
-- 
GitLab


From 554cc605b26fcd0d7292eed49b7d876301f696dc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 21 Dec 2018 16:50:53 +0000
Subject: [PATCH 0634/1835] staging: vc-sm-cma: Add in allocation for VPU
 requests.

Module has to change from tristate to bool as all CMA functions
are boolean.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vc-sm-cma/Kconfig   |   4 +-
 .../staging/vc04_services/vc-sm-cma/Makefile  |   2 +-
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 642 +++++++++++++++---
 .../staging/vc04_services/vc-sm-cma/vc_sm.h   |  30 +-
 .../vc04_services/vc-sm-cma/vc_sm_cma.c       |  99 +++
 .../vc04_services/vc-sm-cma/vc_sm_cma.h       |  39 ++
 .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  |  10 +
 .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.h  |   4 +
 .../vc04_services/vc-sm-cma/vc_sm_defs.h      |   2 +
 9 files changed, 723 insertions(+), 109 deletions(-)
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
 create mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h

diff --git a/drivers/staging/vc04_services/vc-sm-cma/Kconfig b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
index bbd296f5826b4..0607248200977 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/Kconfig
+++ b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
@@ -1,6 +1,6 @@
 config BCM_VC_SM_CMA
-	tristate "VideoCore Shared Memory (CMA) driver"
-	depends on BCM2835_VCHIQ
+	bool "VideoCore Shared Memory (CMA) driver"
+	depends on BCM2835_VCHIQ && DMA_CMA
 	select RBTREE
 	select DMA_SHARED_BUFFER
 	help
diff --git a/drivers/staging/vc04_services/vc-sm-cma/Makefile b/drivers/staging/vc04_services/vc-sm-cma/Makefile
index 9697e116b7651..edda1280772c3 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/Makefile
+++ b/drivers/staging/vc04_services/vc-sm-cma/Makefile
@@ -3,6 +3,6 @@ ccflags-y += -Idrivers/staging/vc04_services -Idrivers/staging/vc04_services/int
 ccflags-y += -D__VCCOREVER__=0
 
 vc-sm-cma-$(CONFIG_BCM_VC_SM_CMA) := \
-	vc_sm.o vc_sm_cma_vchi.o
+	vc_sm.o vc_sm_cma_vchi.o vc_sm_cma.o
 
 obj-$(CONFIG_BCM_VC_SM_CMA) += vc-sm-cma.o
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 9893a3b682816..35153d942a13e 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -9,10 +9,21 @@
  * and taking some code for CMA/dmabuf handling from the Android Ion
  * driver (Google/Linaro).
  *
- * This is cut down version to only support import of dma_bufs from
- * other kernel drivers. A more complete implementation of the old
- * vmcs_sm functionality can follow later.
  *
+ * This driver has 3 main uses:
+ * 1) Allocating buffers for the kernel or userspace that can be shared with the
+ *    VPU.
+ * 2) Importing dmabufs from elsewhere for sharing with the VPU.
+ * 3) Allocating buffers for use by the VPU.
+ *
+ * In the first and second cases the native handle is a dmabuf. Releasing the
+ * resource inherently comes from releasing the dmabuf, and this will trigger
+ * unmapping on the VPU. The underlying allocation and our buffer structure are
+ * retained until the VPU has confirmed that it has finished with it.
+ *
+ * For the VPU allocations the VPU is responsible for triggering the release,
+ * and therefore the released message decrements the dma_buf refcount (with the
+ * VPU mapping having already been marked as released).
  */
 
 /* ---- Include Files ----------------------------------------------------- */
@@ -39,6 +50,7 @@
 #include "vc_sm_cma_vchi.h"
 
 #include "vc_sm.h"
+#include "vc_sm_cma.h"
 #include "vc_sm_knl.h"
 
 /* ---- Private Constants and Types --------------------------------------- */
@@ -72,6 +84,7 @@ struct sm_state_t {
 	struct platform_device *pdev;
 
 	struct sm_instance *sm_handle;	/* Handle for videocore service. */
+	struct cma *cma_heap;
 
 	spinlock_t kernelid_map_lock;	/* Spinlock protecting kernelid_map */
 	struct idr kernelid_map;
@@ -80,6 +93,7 @@ struct sm_state_t {
 	struct list_head buffer_list;	/* List of buffer. */
 
 	struct vc_sm_privdata_t *data_knl;  /* Kernel internal data tracking. */
+	struct vc_sm_privdata_t *vpu_allocs; /* All allocations from the VPU */
 	struct dentry *dir_root;	/* Debug fs entries root. */
 	struct sm_pde_t dir_state;	/* Debug fs entries state sub-tree. */
 
@@ -89,6 +103,12 @@ struct sm_state_t {
 	u32 int_trans_id;		/* Interrupted transaction. */
 };
 
+struct vc_sm_dma_buf_attachment {
+	struct device *dev;
+	struct sg_table *table;
+	struct list_head list;
+};
+
 /* ---- Private Variables ----------------------------------------------- */
 
 static struct sm_state_t *sm_state;
@@ -172,12 +192,14 @@ static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
 				   resource->size);
 			seq_printf(s, "           DMABUF       %p\n",
 				   resource->dma_buf);
-			seq_printf(s, "           ATTACH       %p\n",
-				   resource->attach);
+			if (resource->imported) {
+				seq_printf(s, "           ATTACH       %p\n",
+					   resource->import.attach);
+				seq_printf(s, "           SGT          %p\n",
+					   resource->import.sgt);
+			}
 			seq_printf(s, "           SG_TABLE     %p\n",
 				   resource->sg_table);
-			seq_printf(s, "           SGT          %p\n",
-				   resource->sgt);
 			seq_printf(s, "           DMA_ADDR     %pad\n",
 				   &resource->dma_addr);
 			seq_printf(s, "           VC_HANDLE     %08x\n",
@@ -209,17 +231,33 @@ static void vc_sm_add_resource(struct vc_sm_privdata_t *privdata,
 }
 
 /*
- * Release an allocation.
- * All refcounting is done via the dma buf object.
+ * Cleans up imported dmabuf.
  */
-static void vc_sm_release_resource(struct vc_sm_buffer *buffer, int force)
+static void vc_sm_clean_up_dmabuf(struct vc_sm_buffer *buffer)
 {
-	mutex_lock(&sm_state->map_lock);
-	mutex_lock(&buffer->lock);
+	if (!buffer->imported)
+		return;
 
-	pr_debug("[%s]: buffer %p (name %s, size %zu)\n",
-		 __func__, buffer, buffer->name, buffer->size);
+	/* Handle cleaning up imported dmabufs */
+	mutex_lock(&buffer->lock);
+	if (buffer->import.sgt) {
+		dma_buf_unmap_attachment(buffer->import.attach,
+					 buffer->import.sgt,
+					 DMA_BIDIRECTIONAL);
+		buffer->import.sgt = NULL;
+	}
+	if (buffer->import.attach) {
+		dma_buf_detach(buffer->dma_buf, buffer->import.attach);
+		buffer->import.attach = NULL;
+	}
+	mutex_unlock(&buffer->lock);
+}
 
+/*
+ * Instructs VPU to decrement the refcount on a buffer.
+ */
+static void vc_sm_vpu_free(struct vc_sm_buffer *buffer)
+{
 	if (buffer->vc_handle && buffer->vpu_state == VPU_MAPPED) {
 		struct vc_sm_free_t free = { buffer->vc_handle, 0 };
 		int status = vc_sm_cma_vchi_free(sm_state->sm_handle, &free,
@@ -230,17 +268,32 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer, int force)
 		}
 
 		if (sm_state->require_released_callback) {
-			/* Need to wait for the VPU to confirm the free */
+			/* Need to wait for the VPU to confirm the free. */
 
 			/* Retain a reference on this until the VPU has
 			 * released it
 			 */
 			buffer->vpu_state = VPU_UNMAPPING;
-			goto defer;
+		} else {
+			buffer->vpu_state = VPU_NOT_MAPPED;
+			buffer->vc_handle = 0;
 		}
-		buffer->vpu_state = VPU_NOT_MAPPED;
-		buffer->vc_handle = 0;
 	}
+}
+
+/*
+ * Release an allocation.
+ * All refcounting is done via the dma buf object.
+ *
+ * Must be called with the mutex held. The function will either release the
+ * mutex (if defering the release) or destroy it. The caller must therefore not
+ * reuse the buffer on return.
+ */
+static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
+{
+	pr_debug("[%s]: buffer %p (name %s, size %zu)\n",
+		 __func__, buffer, buffer->name, buffer->size);
+
 	if (buffer->vc_handle) {
 		/* We've sent the unmap request but not had the response. */
 		pr_err("[%s]: Waiting for VPU unmap response on %p\n",
@@ -248,45 +301,43 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer, int force)
 		goto defer;
 	}
 	if (buffer->in_use) {
-		/* Don't release dmabuf here - we await the release */
+		/* dmabuf still in use - we await the release */
 		pr_err("[%s]: buffer %p is still in use\n",
 		       __func__, buffer);
 		goto defer;
 	}
 
-	/* Handle cleaning up imported dmabufs */
-	if (buffer->sgt) {
-		dma_buf_unmap_attachment(buffer->attach, buffer->sgt,
-					 DMA_BIDIRECTIONAL);
-		buffer->sgt = NULL;
-	}
-	if (buffer->attach) {
-		dma_buf_detach(buffer->dma_buf, buffer->attach);
-		buffer->attach = NULL;
+	/* Release the allocation (whether imported dmabuf or CMA allocation) */
+	if (buffer->imported) {
+		pr_debug("%s: Release imported dmabuf %p\n", __func__,
+			 buffer->import.dma_buf);
+		if (buffer->import.dma_buf)
+			dma_buf_put(buffer->import.dma_buf);
+		else
+			pr_err("%s: Imported dmabuf already been put for buf %p\n",
+			       __func__, buffer);
+		buffer->import.dma_buf = NULL;
+	} else {
+		if (buffer->sg_table) {
+			/* Our own allocation that we need to dma_unmap_sg */
+			dma_unmap_sg(&sm_state->pdev->dev,
+				     buffer->sg_table->sgl,
+				     buffer->sg_table->nents,
+				     DMA_BIDIRECTIONAL);
+		}
+		pr_debug("%s: Release our allocation\n", __func__);
+		vc_sm_cma_buffer_free(&buffer->alloc);
+		pr_debug("%s: Release our allocation - done\n", __func__);
 	}
 
-	/* Release the dma_buf (whether ours or imported) */
-	if (buffer->import_dma_buf) {
-		dma_buf_put(buffer->import_dma_buf);
-		buffer->import_dma_buf = NULL;
-		buffer->dma_buf = NULL;
-	} else if (buffer->dma_buf) {
-		dma_buf_put(buffer->dma_buf);
-		buffer->dma_buf = NULL;
-	}
 
-	if (buffer->sg_table && !buffer->import_dma_buf) {
-		/* Our own allocation that we need to dma_unmap_sg */
-		dma_unmap_sg(&sm_state->pdev->dev, buffer->sg_table->sgl,
-			     buffer->sg_table->nents, DMA_BIDIRECTIONAL);
-	}
-
-	/* Free the local resource. Start by removing it from the list */
-	buffer->private = NULL;
+	/* Free our buffer. Start by removing it from the list */
+	mutex_lock(&sm_state->map_lock);
 	list_del(&buffer->global_buffer_list);
+	mutex_unlock(&sm_state->map_lock);
 
+	pr_debug("%s: Release our allocation - done\n", __func__);
 	mutex_unlock(&buffer->lock);
-	mutex_unlock(&sm_state->map_lock);
 
 	mutex_destroy(&buffer->lock);
 
@@ -295,7 +346,7 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer, int force)
 
 defer:
 	mutex_unlock(&buffer->lock);
-	mutex_unlock(&sm_state->map_lock);
+	return;
 }
 
 /* Create support for private data tracking. */
@@ -317,16 +368,267 @@ static struct vc_sm_privdata_t *vc_sm_cma_create_priv_data(pid_t id)
 	return file_data;
 }
 
+static struct sg_table *dup_sg_table(struct sg_table *table)
+{
+	struct sg_table *new_table;
+	int ret, i;
+	struct scatterlist *sg, *new_sg;
+
+	new_table = kzalloc(sizeof(*new_table), GFP_KERNEL);
+	if (!new_table)
+		return ERR_PTR(-ENOMEM);
+
+	ret = sg_alloc_table(new_table, table->nents, GFP_KERNEL);
+	if (ret) {
+		kfree(new_table);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	new_sg = new_table->sgl;
+	for_each_sg(table->sgl, sg, table->nents, i) {
+		memcpy(new_sg, sg, sizeof(*sg));
+		sg->dma_address = 0;
+		new_sg = sg_next(new_sg);
+	}
+
+	return new_table;
+}
+
+static void free_duped_table(struct sg_table *table)
+{
+	sg_free_table(table);
+	kfree(table);
+}
+
+/* Dma buf operations for use with our own allocations */
+
+static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
+				struct dma_buf_attachment *attachment)
+
+{
+	struct vc_sm_dma_buf_attachment *a;
+	struct sg_table *table;
+	struct vc_sm_buffer *buf = dmabuf->priv;
+
+	a = kzalloc(sizeof(*a), GFP_KERNEL);
+	if (!a)
+		return -ENOMEM;
+
+	table = dup_sg_table(buf->sg_table);
+	if (IS_ERR(table)) {
+		kfree(a);
+		return -ENOMEM;
+	}
+
+	a->table = table;
+	INIT_LIST_HEAD(&a->list);
+
+	attachment->priv = a;
+
+	mutex_lock(&buf->lock);
+	list_add(&a->list, &buf->attachments);
+	mutex_unlock(&buf->lock);
+	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
+
+	return 0;
+}
+
+static void vc_sm_dma_buf_detatch(struct dma_buf *dmabuf,
+				  struct dma_buf_attachment *attachment)
+{
+	struct vc_sm_dma_buf_attachment *a = attachment->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
+
+	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
+	free_duped_table(a->table);
+	mutex_lock(&buf->lock);
+	list_del(&a->list);
+	mutex_unlock(&buf->lock);
+
+	kfree(a);
+}
+
+static struct sg_table *vc_sm_map_dma_buf(struct dma_buf_attachment *attachment,
+					  enum dma_data_direction direction)
+{
+	struct vc_sm_dma_buf_attachment *a = attachment->priv;
+	struct sg_table *table;
+
+	table = a->table;
+
+	if (!dma_map_sg(attachment->dev, table->sgl, table->nents,
+			direction))
+		return ERR_PTR(-ENOMEM);
+
+	pr_debug("%s attachment %p\n", __func__, attachment);
+	return table;
+}
+
+static void vc_sm_unmap_dma_buf(struct dma_buf_attachment *attachment,
+				struct sg_table *table,
+				enum dma_data_direction direction)
+{
+	pr_debug("%s attachment %p\n", __func__, attachment);
+	dma_unmap_sg(attachment->dev, table->sgl, table->nents, direction);
+}
+
+static int vc_sm_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+{
+	struct vc_sm_buffer *buf = dmabuf->priv;
+	struct sg_table *table = buf->sg_table;
+	unsigned long addr = vma->vm_start;
+	unsigned long offset = vma->vm_pgoff * PAGE_SIZE;
+	struct scatterlist *sg;
+	int i;
+	int ret = 0;
+
+	pr_debug("%s dmabuf %p, buf %p, vm_start %08lX\n", __func__, dmabuf,
+		 buf, addr);
+
+	mutex_lock(&buf->lock);
+
+	/* now map it to userspace */
+	for_each_sg(table->sgl, sg, table->nents, i) {
+		struct page *page = sg_page(sg);
+		unsigned long remainder = vma->vm_end - addr;
+		unsigned long len = sg->length;
+
+		if (offset >= sg->length) {
+			offset -= sg->length;
+			continue;
+		} else if (offset) {
+			page += offset / PAGE_SIZE;
+			len = sg->length - offset;
+			offset = 0;
+		}
+		len = min(len, remainder);
+		ret = remap_pfn_range(vma, addr, page_to_pfn(page), len,
+				      vma->vm_page_prot);
+		if (ret)
+			break;
+		addr += len;
+		if (addr >= vma->vm_end)
+			break;
+	}
+	mutex_unlock(&buf->lock);
+
+	if (ret)
+		pr_err("%s: failure mapping buffer to userspace\n",
+		       __func__);
+
+	return ret;
+}
+
+static void vc_sm_dma_buf_release(struct dma_buf *dmabuf)
+{
+	struct vc_sm_buffer *buffer;
+
+	if (!dmabuf)
+		return;
+
+	buffer = (struct vc_sm_buffer *)dmabuf->priv;
+
+	mutex_lock(&buffer->lock);
+
+	pr_debug("%s dmabuf %p, buffer %p\n", __func__, dmabuf, buffer);
+
+	buffer->in_use = 0;
+
+	/* Unmap on the VPU */
+	vc_sm_vpu_free(buffer);
+	pr_debug("%s vpu_free done\n", __func__);
+
+	/* Unmap our dma_buf object (the vc_sm_buffer remains until released
+	 * on the VPU).
+	 */
+	vc_sm_clean_up_dmabuf(buffer);
+	pr_debug("%s clean_up dmabuf done\n", __func__);
+
+	vc_sm_release_resource(buffer);
+	pr_debug("%s done\n", __func__);
+}
+
+static int vc_sm_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
+					  enum dma_data_direction direction)
+{
+	struct vc_sm_buffer *buf;
+	struct vc_sm_dma_buf_attachment *a;
+
+	if (!dmabuf)
+		return -EFAULT;
+
+	buf = dmabuf->priv;
+	if (!buf)
+		return -EFAULT;
+
+	mutex_lock(&buf->lock);
+
+	list_for_each_entry(a, &buf->attachments, list) {
+		dma_sync_sg_for_cpu(a->dev, a->table->sgl, a->table->nents,
+				    direction);
+	}
+	mutex_unlock(&buf->lock);
+
+	return 0;
+}
+
+static int vc_sm_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
+					enum dma_data_direction direction)
+{
+	struct vc_sm_buffer *buf;
+	struct vc_sm_dma_buf_attachment *a;
+
+	if (!dmabuf)
+		return -EFAULT;
+	buf = dmabuf->priv;
+	if (!buf)
+		return -EFAULT;
+
+	mutex_lock(&buf->lock);
+
+	list_for_each_entry(a, &buf->attachments, list) {
+		dma_sync_sg_for_device(a->dev, a->table->sgl, a->table->nents,
+				       direction);
+	}
+	mutex_unlock(&buf->lock);
+
+	return 0;
+}
+
+static void *vc_sm_dma_buf_kmap(struct dma_buf *dmabuf, unsigned long offset)
+{
+	/* FIXME */
+	return NULL;
+}
+
+static void vc_sm_dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long offset,
+				 void *ptr)
+{
+	/* FIXME */
+}
+
+static const struct dma_buf_ops dma_buf_ops = {
+	.map_dma_buf = vc_sm_map_dma_buf,
+	.unmap_dma_buf = vc_sm_unmap_dma_buf,
+	.mmap = vc_sm_dmabuf_mmap,
+	.release = vc_sm_dma_buf_release,
+	.attach = vc_sm_dma_buf_attach,
+	.detach = vc_sm_dma_buf_detatch,
+	.begin_cpu_access = vc_sm_dma_buf_begin_cpu_access,
+	.end_cpu_access = vc_sm_dma_buf_end_cpu_access,
+	.map = vc_sm_dma_buf_kmap,
+	.unmap = vc_sm_dma_buf_kunmap,
+};
 /* Dma_buf operations for chaining through to an imported dma_buf */
 static
 int vc_sm_import_dma_buf_attach(struct dma_buf *dmabuf,
 				struct dma_buf_attachment *attachment)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return -EINVAL;
-	return res->import_dma_buf->ops->attach(res->import_dma_buf,
+	return buf->import.dma_buf->ops->attach(buf->import.dma_buf,
 						attachment);
 }
 
@@ -334,22 +636,23 @@ static
 void vc_sm_import_dma_buf_detatch(struct dma_buf *dmabuf,
 				  struct dma_buf_attachment *attachment)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return;
-	res->import_dma_buf->ops->detach(res->import_dma_buf, attachment);
+	buf->import.dma_buf->ops->detach(buf->import.dma_buf, attachment);
 }
 
 static
 struct sg_table *vc_sm_import_map_dma_buf(struct dma_buf_attachment *attachment,
 					  enum dma_data_direction direction)
 {
-	struct vc_sm_buffer *res = attachment->dmabuf->priv;
+	struct vc_sm_buffer *buf = attachment->dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return NULL;
-	return res->import_dma_buf->ops->map_dma_buf(attachment, direction);
+	return buf->import.dma_buf->ops->map_dma_buf(attachment,
+						     direction);
 }
 
 static
@@ -357,87 +660,88 @@ void vc_sm_import_unmap_dma_buf(struct dma_buf_attachment *attachment,
 				struct sg_table *table,
 				enum dma_data_direction direction)
 {
-	struct vc_sm_buffer *res = attachment->dmabuf->priv;
+	struct vc_sm_buffer *buf = attachment->dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return;
-	res->import_dma_buf->ops->unmap_dma_buf(attachment, table, direction);
+	buf->import.dma_buf->ops->unmap_dma_buf(attachment, table, direction);
 }
 
 static
 int vc_sm_import_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	pr_debug("%s: mmap dma_buf %p, res %p, imported db %p\n", __func__,
-		 dmabuf, res, res->import_dma_buf);
-	if (!res->import_dma_buf) {
+	pr_debug("%s: mmap dma_buf %p, buf %p, imported db %p\n", __func__,
+		 dmabuf, buf, buf->import.dma_buf);
+	if (!buf->imported) {
 		pr_err("%s: mmap dma_buf %p- not an imported buffer\n",
 		       __func__, dmabuf);
 		return -EINVAL;
 	}
-	return res->import_dma_buf->ops->mmap(res->import_dma_buf, vma);
+	return buf->import.dma_buf->ops->mmap(buf->import.dma_buf, vma);
 }
 
 static
 void vc_sm_import_dma_buf_release(struct dma_buf *dmabuf)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
 	pr_debug("%s: Relasing dma_buf %p\n", __func__, dmabuf);
-	if (!res->import_dma_buf)
+	mutex_lock(&buf->lock);
+	if (!buf->imported)
 		return;
 
-	res->in_use = 0;
+	buf->in_use = 0;
+
+	vc_sm_vpu_free(buf);
 
-	vc_sm_release_resource(res, 0);
+	vc_sm_release_resource(buf);
 }
 
 static
 void *vc_sm_import_dma_buf_kmap(struct dma_buf *dmabuf,
 				unsigned long offset)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return NULL;
-	return res->import_dma_buf->ops->map(res->import_dma_buf,
-						      offset);
+	return buf->import.dma_buf->ops->map(buf->import.dma_buf, offset);
 }
 
 static
 void vc_sm_import_dma_buf_kunmap(struct dma_buf *dmabuf,
 				 unsigned long offset, void *ptr)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return;
-	res->import_dma_buf->ops->unmap(res->import_dma_buf,
-					       offset, ptr);
+	buf->import.dma_buf->ops->unmap(buf->import.dma_buf, offset, ptr);
 }
 
 static
 int vc_sm_import_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
 					  enum dma_data_direction direction)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return -EINVAL;
-	return res->import_dma_buf->ops->begin_cpu_access(res->import_dma_buf,
-							    direction);
+	return buf->import.dma_buf->ops->begin_cpu_access(buf->import.dma_buf,
+							  direction);
 }
 
 static
 int vc_sm_import_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
 					enum dma_data_direction direction)
 {
-	struct vc_sm_buffer *res = dmabuf->priv;
+	struct vc_sm_buffer *buf = dmabuf->priv;
 
-	if (!res->import_dma_buf)
+	if (!buf->imported)
 		return -EINVAL;
-	return res->import_dma_buf->ops->end_cpu_access(res->import_dma_buf,
+	return buf->import.dma_buf->ops->end_cpu_access(buf->import.dma_buf,
 							  direction);
 }
 
@@ -516,9 +820,8 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 	memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
 	       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
 
-	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %pad, size %u\n",
-		 __func__, import.name, import.type, &dma_addr,
-		 import.size);
+	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %pad, size %u.\n",
+		 __func__, import.name, import.type, &dma_addr, import.size);
 
 	/* Allocate the videocore buffer. */
 	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
@@ -548,12 +851,14 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 	buffer->size = import.size;
 	buffer->vpu_state = VPU_MAPPED;
 
-	buffer->import_dma_buf = dma_buf;
+	buffer->imported = 1;
+	buffer->import.dma_buf = dma_buf;
 
-	buffer->attach = attach;
-	buffer->sgt = sgt;
+	buffer->import.attach = attach;
+	buffer->import.sgt = sgt;
 	buffer->dma_addr = dma_addr;
 	buffer->in_use = 1;
+	buffer->kernel_id = import.kernel_id;
 
 	/*
 	 * We're done - we need to export a new dmabuf chaining through most
@@ -594,6 +899,91 @@ error:
 	return ret;
 }
 
+static int vc_sm_cma_vpu_alloc(u32 size, uint32_t align, const char *name,
+			       u32 mem_handle, struct vc_sm_buffer **ret_buffer)
+{
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct vc_sm_buffer *buffer = NULL;
+	int aligned_size;
+	int ret = 0;
+
+	/* Align to the user requested align */
+	aligned_size = ALIGN(size, align);
+	/* and then to a page boundary */
+	aligned_size = PAGE_ALIGN(aligned_size);
+
+	if (!aligned_size)
+		return -EINVAL;
+
+	/* Allocate local buffer to track this allocation. */
+	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+
+	mutex_init(&buffer->lock);
+
+	if (vc_sm_cma_buffer_allocate(sm_state->cma_heap, &buffer->alloc,
+				      aligned_size)) {
+		pr_err("[%s]: cma alloc of %d bytes failed\n",
+		       __func__, aligned_size);
+		ret = -ENOMEM;
+		goto error;
+	}
+	buffer->sg_table = buffer->alloc.sg_table;
+
+	pr_debug("[%s]: cma alloc of %d bytes success\n",
+		 __func__, aligned_size);
+
+	if (dma_map_sg(&sm_state->pdev->dev, buffer->sg_table->sgl,
+		       buffer->sg_table->nents, DMA_BIDIRECTIONAL) <= 0) {
+		pr_err("[%s]: dma_map_sg failed\n", __func__);
+		goto error;
+	}
+
+	INIT_LIST_HEAD(&buffer->attachments);
+
+	memcpy(buffer->name, name,
+	       min(sizeof(buffer->name), strlen(name)));
+
+	exp_info.ops = &dma_buf_ops;
+	exp_info.size = aligned_size;
+	exp_info.flags = O_RDWR;
+	exp_info.priv = buffer;
+
+	buffer->dma_buf = dma_buf_export(&exp_info);
+	if (IS_ERR(buffer->dma_buf)) {
+		ret = PTR_ERR(buffer->dma_buf);
+		goto error;
+	}
+	buffer->dma_addr = (uint32_t)sg_dma_address(buffer->sg_table->sgl);
+	if ((buffer->dma_addr & 0xC0000000) != 0xC0000000) {
+		pr_err("%s: Expecting an uncached alias for dma_addr %pad\n",
+		       __func__, &buffer->dma_addr);
+		buffer->dma_addr |= 0xC0000000;
+	}
+	buffer->private = sm_state->vpu_allocs;
+
+	buffer->vc_handle = mem_handle;
+	buffer->vpu_state = VPU_MAPPED;
+	buffer->vpu_allocated = 1;
+	buffer->size = size;
+	/*
+	 * Create an ID that will be passed along with our message so
+	 * that when we service the release reply, we can look up which
+	 * resource is being released.
+	 */
+	buffer->kernel_id = get_kernel_id(buffer);
+
+	vc_sm_add_resource(sm_state->vpu_allocs, buffer);
+
+	*ret_buffer = buffer;
+	return 0;
+error:
+	if (buffer)
+		vc_sm_release_resource(buffer);
+	return ret;
+}
+
 static void
 vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
 		int reply_len)
@@ -612,21 +1002,61 @@ vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
 		struct vc_sm_released *release = (struct vc_sm_released *)reply;
 		struct vc_sm_buffer *buffer =
 					lookup_kernel_id(release->kernel_id);
+		if (!buffer) {
+			pr_err("%s: VC released a buffer that is already released, kernel_id %d\n",
+			       __func__, release->kernel_id);
+			break;
+		}
+		mutex_lock(&buffer->lock);
 
-		/*
-		 * FIXME: Need to check buffer is still valid and allocated
-		 * before continuing
-		 */
 		pr_debug("%s: Released addr %08x, size %u, id %08x, mem_handle %08x\n",
 			 __func__, release->addr, release->size,
 			 release->kernel_id, release->vc_handle);
-		mutex_lock(&buffer->lock);
+
 		buffer->vc_handle = 0;
 		buffer->vpu_state = VPU_NOT_MAPPED;
-		mutex_unlock(&buffer->lock);
 		free_kernel_id(release->kernel_id);
 
-		vc_sm_release_resource(buffer, 0);
+		if (buffer->vpu_allocated) {
+			/* VPU allocation, so release the dmabuf which will
+			 * trigger the clean up.
+			 */
+			mutex_unlock(&buffer->lock);
+			dma_buf_put(buffer->dma_buf);
+		} else {
+			vc_sm_release_resource(buffer);
+		}
+	}
+	break;
+	case VC_SM_MSG_TYPE_VC_MEM_REQUEST:
+	{
+		struct vc_sm_buffer *buffer = NULL;
+		struct vc_sm_vc_mem_request *req =
+					(struct vc_sm_vc_mem_request *)reply;
+		struct vc_sm_vc_mem_request_result reply;
+		int ret;
+
+		pr_debug("%s: Request %u bytes of memory, align %d name %s, trans_id %08x\n",
+			 __func__, req->size, req->align, req->name,
+			 req->trans_id);
+		ret = vc_sm_cma_vpu_alloc(req->size, req->align, req->name,
+					  req->vc_handle, &buffer);
+
+		reply.trans_id = req->trans_id;
+		if (!ret) {
+			reply.addr = buffer->dma_addr;
+			reply.kernel_id = buffer->kernel_id;
+			pr_debug("%s: Allocated resource buffer %p, addr %pad\n",
+				 __func__, buffer, &buffer->dma_addr);
+		} else {
+			pr_err("%s: Allocation failed size %u, name %s, vc_handle %u\n",
+			       __func__, req->size, req->name, req->vc_handle);
+			reply.addr = 0;
+			reply.kernel_id = 0;
+		}
+		vc_sm_vchi_client_vc_mem_req_reply(sm_state->sm_handle, &reply,
+						   &sm_state->int_trans_id);
+		break;
 	}
 	break;
 	default:
@@ -645,6 +1075,14 @@ static void vc_sm_connected_init(void)
 
 	pr_info("[%s]: start\n", __func__);
 
+	if (vc_sm_cma_add_heaps(&sm_state->cma_heap) ||
+	    !sm_state->cma_heap) {
+		pr_err("[%s]: failed to initialise CMA heaps\n",
+		       __func__);
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
 	/*
 	 * Initialize and create a VCHI connection for the shared memory service
 	 * running on videocore.
@@ -696,7 +1134,7 @@ static void vc_sm_connected_init(void)
 		goto err_remove_shared_memory;
 	}
 
-	version.version = 1;
+	version.version = 2;
 	ret = vc_sm_cma_vchi_client_version(sm_state->sm_handle, &version,
 					    &version_result,
 					    &sm_state->int_trans_id);
@@ -768,7 +1206,7 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 int vc_sm_cma_int_handle(void *handle)
 {
 	struct dma_buf *dma_buf = (struct dma_buf *)handle;
-	struct vc_sm_buffer *res;
+	struct vc_sm_buffer *buf;
 
 	/* Validate we can work with this device. */
 	if (!sm_state || !handle) {
@@ -776,8 +1214,8 @@ int vc_sm_cma_int_handle(void *handle)
 		return 0;
 	}
 
-	res = (struct vc_sm_buffer *)dma_buf->priv;
-	return res->vc_handle;
+	buf = (struct vc_sm_buffer *)dma_buf->priv;
+	return buf->vc_handle;
 }
 EXPORT_SYMBOL_GPL(vc_sm_cma_int_handle);
 
@@ -804,7 +1242,7 @@ EXPORT_SYMBOL_GPL(vc_sm_cma_free);
 int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, void **handle)
 {
 	struct dma_buf *new_dma_buf;
-	struct vc_sm_buffer *res;
+	struct vc_sm_buffer *buf;
 	int ret;
 
 	/* Validate we can work with this device. */
@@ -818,7 +1256,7 @@ int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, void **handle)
 
 	if (!ret) {
 		pr_debug("%s: imported to ptr %p\n", __func__, new_dma_buf);
-		res = (struct vc_sm_buffer *)new_dma_buf->priv;
+		buf = (struct vc_sm_buffer *)new_dma_buf->priv;
 
 		/* Assign valid handle at this time.*/
 		*handle = new_dma_buf;
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
index 2ea105abf9278..3a3ff5b4626d5 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
@@ -21,6 +21,8 @@
 #include <linux/types.h>
 #include <linux/miscdevice.h>
 
+#include "vc_sm_cma.h"
+
 #define VC_SM_MAX_NAME_LEN 32
 
 enum vc_sm_vpu_mapping_state {
@@ -29,31 +31,51 @@ enum vc_sm_vpu_mapping_state {
 	VPU_UNMAPPING
 };
 
+struct vc_sm_imported {
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *sgt;
+};
+
 struct vc_sm_buffer {
 	struct list_head global_buffer_list;	/* Global list of buffers. */
 
+	/* Index in the kernel_id idr so that we can find the
+	 * mmal_msg_context again when servicing the VCHI reply.
+	 */
+	int kernel_id;
+
 	size_t size;
 
 	/* Lock over all the following state for this buffer */
 	struct mutex lock;
-	struct sg_table *sg_table;
 	struct list_head attachments;
 
 	char name[VC_SM_MAX_NAME_LEN];
 
 	int in_use:1;	/* Kernel is still using this resource */
+	int imported:1;	/* Imported dmabuf */
+
+	struct sg_table *sg_table;
 
 	enum vc_sm_vpu_mapping_state vpu_state;
 	u32 vc_handle;	/* VideoCore handle for this buffer */
+	int vpu_allocated;	/*
+				 * The VPU made this allocation. Release the
+				 * local dma_buf when the VPU releases the
+				 * resource.
+				 */
 
 	/* DMABUF related fields */
-	struct dma_buf *import_dma_buf;
 	struct dma_buf *dma_buf;
-	struct dma_buf_attachment *attach;
-	struct sg_table *sgt;
 	dma_addr_t dma_addr;
 
 	struct vc_sm_privdata_t *private;
+
+	union {
+		struct vc_sm_cma_alloc_data alloc;
+		struct vc_sm_imported import;
+	};
 };
 
 #endif
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
new file mode 100644
index 0000000000000..16095f30c2f8f
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * VideoCore Shared Memory CMA allocator
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ *
+ * Based on the Android ION allocator
+ * Copyright (C) Linaro 2012
+ * Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
+ *
+ */
+
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/cma.h>
+#include <linux/scatterlist.h>
+
+#include "vc_sm_cma.h"
+
+/* CMA heap operations functions */
+int vc_sm_cma_buffer_allocate(struct cma *cma_heap,
+			      struct vc_sm_cma_alloc_data *buffer,
+			      unsigned long len)
+{
+	/* len should already be page aligned */
+	unsigned long num_pages = len / PAGE_SIZE;
+	struct sg_table *table;
+	struct page *pages;
+	int ret;
+
+	pages = cma_alloc(cma_heap, num_pages, 0, GFP_KERNEL);
+	if (!pages)
+		return -ENOMEM;
+
+	table = kmalloc(sizeof(*table), GFP_KERNEL);
+	if (!table)
+		goto err;
+
+	ret = sg_alloc_table(table, 1, GFP_KERNEL);
+	if (ret)
+		goto free_mem;
+
+	sg_set_page(table->sgl, pages, len, 0);
+
+	buffer->priv_virt = pages;
+	buffer->sg_table = table;
+	buffer->cma_heap = cma_heap;
+	buffer->num_pages = num_pages;
+	return 0;
+
+free_mem:
+	kfree(table);
+err:
+	cma_release(cma_heap, pages, num_pages);
+	return -ENOMEM;
+}
+
+void vc_sm_cma_buffer_free(struct vc_sm_cma_alloc_data *buffer)
+{
+	struct cma *cma_heap = buffer->cma_heap;
+	struct page *pages = buffer->priv_virt;
+
+	/* release memory */
+	if (cma_heap)
+		cma_release(cma_heap, pages, buffer->num_pages);
+
+	/* release sg table */
+	if (buffer->sg_table) {
+		sg_free_table(buffer->sg_table);
+		kfree(buffer->sg_table);
+		buffer->sg_table = NULL;
+	}
+}
+
+int __vc_sm_cma_add_heaps(struct cma *cma, void *priv)
+{
+	struct cma **heap = (struct cma **)priv;
+	const char *name = cma_get_name(cma);
+
+	if (!(*heap)) {
+		phys_addr_t phys_addr = cma_get_base(cma);
+
+		pr_debug("%s: Adding cma heap %s (start %pap, size %lu) for use by vcsm\n",
+			 __func__, name, &phys_addr, cma_get_size(cma));
+		*heap = cma;
+	} else {
+		pr_err("%s: Ignoring heap %s as already set\n",
+		       __func__, name);
+	}
+
+	return 0;
+}
+
+int vc_sm_cma_add_heaps(struct cma **cma_heap)
+{
+	cma_for_each_area(__vc_sm_cma_add_heaps, cma_heap);
+	return 0;
+}
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
new file mode 100644
index 0000000000000..1fe94a652058f
--- /dev/null
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * VideoCore Shared Memory CMA allocator
+ *
+ * Copyright: 2018, Raspberry Pi (Trading) Ltd
+ *
+ * Based on the Android ION allocator
+ * Copyright (C) Linaro 2012
+ * Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+#ifndef VC_SM_CMA_H
+#define VC_SM_CMA_H
+
+struct vc_sm_cma_alloc_data {
+	struct cma *cma_heap;
+	unsigned long num_pages;
+	void *priv_virt;
+	struct sg_table *sg_table;
+};
+
+int vc_sm_cma_buffer_allocate(struct cma *cma_heap,
+			      struct vc_sm_cma_alloc_data *buffer,
+			      unsigned long len);
+void vc_sm_cma_buffer_free(struct vc_sm_cma_alloc_data *buffer);
+
+int vc_sm_cma_add_heaps(struct cma **cma_heap);
+
+#endif
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
index 711f2a346bbf0..a8ffdeda3f828 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
@@ -500,3 +500,13 @@ int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
 				   msg, sizeof(*msg), NULL, 0,
 				   cur_trans_id, 0);
 }
+
+int vc_sm_vchi_client_vc_mem_req_reply(struct sm_instance *handle,
+				       struct vc_sm_vc_mem_request_result *msg,
+				       uint32_t *cur_trans_id)
+{
+	return vc_sm_cma_vchi_send_msg(handle,
+				       VC_SM_MSG_TYPE_VC_MEM_REQUEST_REPLY,
+				       msg, sizeof(*msg), 0, 0, cur_trans_id,
+				       0);
+}
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
index 17dbb2c071612..05509efcdfcda 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.h
@@ -56,4 +56,8 @@ int vc_sm_cma_vchi_client_version(struct sm_instance *handle,
 				  struct vc_sm_result_t *result,
 				  u32 *cur_trans_id);
 
+int vc_sm_vchi_client_vc_mem_req_reply(struct sm_instance *handle,
+				       struct vc_sm_vc_mem_request_result *msg,
+				       uint32_t *cur_trans_id);
+
 #endif /* __VC_SM_CMA_VCHI_H__INCLUDED__ */
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
index e38d67eeafd61..8a0d1f6dbfe89 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_defs.h
@@ -264,6 +264,8 @@ struct vc_sm_vc_mem_request {
 	u32 align;
 	/* resource name (for easier tracking) */
 	char     name[VC_SM_RESOURCE_NAME];
+	/* VPU handle for the resource */
+	u32 vc_handle;
 };
 
 /* Response from the kernel to provide the VPU with some memory */
-- 
GitLab


From bbeb57ae5f4a8e48c344a62f7b671881406e7947 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 11 Mar 2019 16:38:32 +0000
Subject: [PATCH 0635/1835] staging: vc-sm-cma: Update TODO.

The driver is already a platform driver, so that can be
deleted from the TODO.
There are no known issues that need to be resolved.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/TODO | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/TODO b/drivers/staging/vc04_services/vc-sm-cma/TODO
index 683c6aab40f41..ac9b5f8a73895 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/TODO
+++ b/drivers/staging/vc04_services/vc-sm-cma/TODO
@@ -1,2 +1 @@
-1) Convert to a platform driver.
-
+No currently outstanding tasks except some clean-up.
-- 
GitLab


From d218dac3489b7a91eea1cb45c76eb177fb05d7cb Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 11 Mar 2019 16:35:23 +0000
Subject: [PATCH 0636/1835] staging: vc-sm-cma: Add in userspace allocation API

Replacing the functionality from the older vc-sm driver,
add in a userspace API that allows allocation of buffers,
and importing of dma-bufs.
The driver hands out dma-buf fds, therefore much of the
handling around lifespan and odd mmaps from the old driver
goes away.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 371 ++++++++++++++++--
 .../vc04_services/vc-sm-cma/vc_sm_cma.c       |   3 +-
 .../vc04_services/vc-sm-cma/vc_sm_cma.h       |   2 +-
 include/linux/broadcom/vc_sm_cma_ioctl.h      |  87 ++++
 4 files changed, 435 insertions(+), 28 deletions(-)
 create mode 100644 include/linux/broadcom/vc_sm_cma_ioctl.h

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 35153d942a13e..20385dd01de0f 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -36,6 +36,7 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/of_device.h>
@@ -52,6 +53,7 @@
 #include "vc_sm.h"
 #include "vc_sm_cma.h"
 #include "vc_sm_knl.h"
+#include <linux/broadcom/vc_sm_cma_ioctl.h>
 
 /* ---- Private Constants and Types --------------------------------------- */
 
@@ -83,6 +85,8 @@ struct sm_pde_t {
 struct sm_state_t {
 	struct platform_device *pdev;
 
+	struct miscdevice misc_dev;
+
 	struct sm_instance *sm_handle;	/* Handle for videocore service. */
 	struct cma *cma_heap;
 
@@ -346,7 +350,6 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
 
 defer:
 	mutex_unlock(&buffer->lock);
-	return;
 }
 
 /* Create support for private data tracking. */
@@ -381,7 +384,7 @@ static struct sg_table *dup_sg_table(struct sg_table *table)
 	ret = sg_alloc_table(new_table, table->nents, GFP_KERNEL);
 	if (ret) {
 		kfree(new_table);
-		return ERR_PTR(-ENOMEM);
+		return ERR_PTR(ret);
 	}
 
 	new_sg = new_table->sgl;
@@ -417,7 +420,7 @@ static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
 	table = dup_sg_table(buf->sg_table);
 	if (IS_ERR(table)) {
 		kfree(a);
-		return -ENOMEM;
+		return PTR_ERR(table);
 	}
 
 	a->table = table;
@@ -433,8 +436,8 @@ static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
 	return 0;
 }
 
-static void vc_sm_dma_buf_detatch(struct dma_buf *dmabuf,
-				  struct dma_buf_attachment *attachment)
+static void vc_sm_dma_buf_detach(struct dma_buf *dmabuf,
+				 struct dma_buf_attachment *attachment)
 {
 	struct vc_sm_dma_buf_attachment *a = attachment->priv;
 	struct vc_sm_buffer *buf = dmabuf->priv;
@@ -544,6 +547,9 @@ static void vc_sm_dma_buf_release(struct dma_buf *dmabuf)
 	vc_sm_clean_up_dmabuf(buffer);
 	pr_debug("%s clean_up dmabuf done\n", __func__);
 
+	/* buffer->lock will be destroyed by vc_sm_release_resource if finished
+	 * with, otherwise unlocked. Do NOT unlock here.
+	 */
 	vc_sm_release_resource(buffer);
 	pr_debug("%s done\n", __func__);
 }
@@ -613,7 +619,7 @@ static const struct dma_buf_ops dma_buf_ops = {
 	.mmap = vc_sm_dmabuf_mmap,
 	.release = vc_sm_dma_buf_release,
 	.attach = vc_sm_dma_buf_attach,
-	.detach = vc_sm_dma_buf_detatch,
+	.detach = vc_sm_dma_buf_detach,
 	.begin_cpu_access = vc_sm_dma_buf_begin_cpu_access,
 	.end_cpu_access = vc_sm_dma_buf_end_cpu_access,
 	.map = vc_sm_dma_buf_kmap,
@@ -762,6 +768,7 @@ static const struct dma_buf_ops dma_buf_import_ops = {
 int
 vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 				 struct dma_buf *dma_buf,
+				 int fd,
 				 struct dma_buf **imported_buf)
 {
 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
@@ -775,10 +782,15 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 	int status;
 
 	/* Setup our allocation parameters */
-	pr_debug("%s: importing dma_buf %p\n", __func__, dma_buf);
+	pr_debug("%s: importing dma_buf %p/fd %d\n", __func__, dma_buf, fd);
 
-	get_dma_buf(dma_buf);
-	dma_buf = dma_buf;
+	if (fd < 0)
+		get_dma_buf(dma_buf);
+	else
+		dma_buf = dma_buf_get(fd);
+
+	if (!dma_buf)
+		return -EINVAL;
 
 	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
 	if (IS_ERR(attach)) {
@@ -921,6 +933,10 @@ static int vc_sm_cma_vpu_alloc(u32 size, uint32_t align, const char *name,
 		return -ENOMEM;
 
 	mutex_init(&buffer->lock);
+	/* Acquire the mutex as vc_sm_release_resource will release it in the
+	 * error path.
+	 */
+	mutex_lock(&buffer->lock);
 
 	if (vc_sm_cma_buffer_allocate(sm_state->cma_heap, &buffer->alloc,
 				      aligned_size)) {
@@ -976,6 +992,8 @@ static int vc_sm_cma_vpu_alloc(u32 size, uint32_t align, const char *name,
 
 	vc_sm_add_resource(sm_state->vpu_allocs, buffer);
 
+	mutex_unlock(&buffer->lock);
+
 	*ret_buffer = buffer;
 	return 0;
 error:
@@ -1065,6 +1083,297 @@ vc_sm_vpu_event(struct sm_instance *instance, struct vc_sm_result_t *reply,
 	}
 }
 
+/* Userspace handling */
+/*
+ * Open the device.  Creates a private state to help track all allocation
+ * associated with this device.
+ */
+static int vc_sm_cma_open(struct inode *inode, struct file *file)
+{
+	/* Make sure the device was started properly. */
+	if (!sm_state) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return -EPERM;
+	}
+
+	file->private_data = vc_sm_cma_create_priv_data(current->tgid);
+	if (!file->private_data) {
+		pr_err("[%s]: failed to create data tracker\n", __func__);
+
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+/*
+ * Close the vcsm-cma device.
+ * All allocations are file descriptors to the dmabuf objects, so we will get
+ * the clean up request on those as those are cleaned up.
+ */
+static int vc_sm_cma_release(struct inode *inode, struct file *file)
+{
+	struct vc_sm_privdata_t *file_data =
+	    (struct vc_sm_privdata_t *)file->private_data;
+	int ret = 0;
+
+	/* Make sure the device was started properly. */
+	if (!sm_state || !file_data) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	pr_debug("[%s]: using private data %p\n", __func__, file_data);
+
+	/* Terminate the private data. */
+	kfree(file_data);
+
+out:
+	return ret;
+}
+
+/*
+ * Allocate a shared memory handle and block.
+ * Allocation is from CMA, and then imported into the VPU mappings.
+ */
+int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
+			  struct vc_sm_cma_ioctl_alloc *ioparam)
+{
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+	struct vc_sm_buffer *buffer = NULL;
+	struct vc_sm_import import = { 0 };
+	struct vc_sm_import_result result = { 0 };
+	struct dma_buf *dmabuf = NULL;
+	int aligned_size;
+	int ret = 0;
+	int status;
+	int fd = -1;
+
+	aligned_size = PAGE_ALIGN(ioparam->size);
+
+	if (!aligned_size)
+		return -EINVAL;
+
+	/* Allocate local buffer to track this allocation. */
+	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+	if (!buffer) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	if (vc_sm_cma_buffer_allocate(sm_state->cma_heap, &buffer->alloc,
+				      aligned_size)) {
+		pr_err("[%s]: cma alloc of %d bytes failed\n",
+		       __func__, aligned_size);
+		kfree(buffer);
+		return -ENOMEM;
+	}
+	buffer->sg_table = buffer->alloc.sg_table;
+
+	if (dma_map_sg(&sm_state->pdev->dev, buffer->sg_table->sgl,
+		       buffer->sg_table->nents, DMA_BIDIRECTIONAL) <= 0) {
+		pr_err("[%s]: dma_map_sg failed\n", __func__);
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	import.type = VC_SM_ALLOC_NON_CACHED;
+	import.allocator = current->tgid;
+
+	if (*ioparam->name)
+		memcpy(import.name, ioparam->name, sizeof(import.name) - 1);
+	else
+		memcpy(import.name, VC_SM_RESOURCE_NAME_DEFAULT,
+		       sizeof(VC_SM_RESOURCE_NAME_DEFAULT));
+
+	mutex_init(&buffer->lock);
+	INIT_LIST_HEAD(&buffer->attachments);
+	memcpy(buffer->name, import.name,
+	       min(sizeof(buffer->name), sizeof(import.name) - 1));
+
+	exp_info.ops = &dma_buf_ops;
+	exp_info.size = aligned_size;
+	exp_info.flags = O_RDWR;
+	exp_info.priv = buffer;
+
+	dmabuf = dma_buf_export(&exp_info);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto error;
+	}
+	buffer->dma_buf = dmabuf;
+
+	import.addr = (uint32_t)sg_dma_address(buffer->sg_table->sgl);
+	import.size = aligned_size;
+	import.kernel_id = (uint32_t)buffer;
+
+	/* Wrap it into a videocore buffer. */
+	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
+				       &sm_state->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
+			 __func__, sm_state->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_IMPORT;
+		goto error;
+	} else if (status || !result.res_handle) {
+		pr_err("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
+		       __func__, status, sm_state->int_trans_id);
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	/* Keep track of the buffer we created. */
+	buffer->private = private;
+	buffer->vc_handle = result.res_handle;
+	buffer->size = import.size;
+	buffer->dma_addr = import.addr;
+	buffer->vpu_state = VPU_MAPPED;
+	//buffer->res_cached = ioparam->cached;
+
+	fd = dma_buf_fd(dmabuf, O_CLOEXEC);
+	if (fd < 0)
+		goto error;
+
+	vc_sm_add_resource(private, buffer);
+
+	pr_debug("[%s]: Added resource as fd %d, buffer %p, private %p, dma_addr %pad\n",
+		 __func__, fd, buffer, private, &buffer->dma_addr);
+
+	/* We're done */
+	ioparam->handle = fd;
+	ioparam->vc_handle = buffer->vc_handle;
+	ioparam->dma_addr = buffer->dma_addr;
+	return 0;
+
+error:
+	if (buffer) {
+		pr_err("[%s]: something failed - cleanup. ret %d\n", __func__,
+		       ret);
+
+		dma_buf_put(dmabuf);
+	}
+	return ret;
+}
+
+static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
+			    unsigned long arg)
+{
+	int ret = 0;
+	unsigned int cmdnr = _IOC_NR(cmd);
+	struct vc_sm_privdata_t *file_data =
+	    (struct vc_sm_privdata_t *)file->private_data;
+
+	/* Validate we can work with this device. */
+	if (!sm_state || !file_data) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return -EPERM;
+	}
+
+	pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
+		 current->tgid, file_data->pid);
+
+	/* Action is a re-post of a previously interrupted action? */
+	if (file_data->restart_sys == -EINTR) {
+		struct vc_sm_action_clean_t action_clean;
+
+		pr_debug("[%s]: clean up of action %u (trans_id: %u) following EINTR\n",
+			 __func__, file_data->int_action,
+			 file_data->int_trans_id);
+
+		action_clean.res_action = file_data->int_action;
+		action_clean.action_trans_id = file_data->int_trans_id;
+
+		file_data->restart_sys = 0;
+	}
+
+	/* Now process the command. */
+	switch (cmdnr) {
+		/* New memory allocation.
+		 */
+	case VC_SM_CMA_CMD_ALLOC:
+	{
+		struct vc_sm_cma_ioctl_alloc ioparam;
+
+		/* Get the parameter data. */
+		if (copy_from_user
+		    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+			pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+			       __func__, cmdnr);
+			ret = -EFAULT;
+			break;
+		}
+
+		ret = vc_sm_cma_ioctl_alloc(file_data, &ioparam);
+		if (!ret &&
+		    (copy_to_user((void *)arg, &ioparam,
+				  sizeof(ioparam)) != 0)) {
+			/* FIXME: Release allocation */
+			pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+			       __func__, cmdnr);
+			ret = -EFAULT;
+		}
+		break;
+	}
+
+	case VC_SM_CMA_CMD_IMPORT_DMABUF:
+	{
+		struct vc_sm_cma_ioctl_import_dmabuf ioparam;
+		struct dma_buf *new_dmabuf;
+
+		/* Get the parameter data. */
+		if (copy_from_user
+		    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+			pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+			       __func__, cmdnr);
+			ret = -EFAULT;
+			break;
+		}
+
+		ret = vc_sm_cma_import_dmabuf_internal(file_data,
+						       NULL,
+						       ioparam.dmabuf_fd,
+						       &new_dmabuf);
+
+		if (!ret) {
+			struct vc_sm_buffer *buf = new_dmabuf->priv;
+
+			ioparam.size = buf->size;
+			ioparam.handle = dma_buf_fd(new_dmabuf,
+						    O_CLOEXEC);
+			ioparam.vc_handle = buf->vc_handle;
+			ioparam.dma_addr = buf->dma_addr;
+
+			if (ioparam.handle < 0 ||
+			    (copy_to_user((void *)arg, &ioparam,
+					  sizeof(ioparam)) != 0)) {
+				dma_buf_put(new_dmabuf);
+				/* FIXME: Release allocation */
+				ret = -EFAULT;
+			}
+		}
+		break;
+	}
+
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+/* Device operations that we managed in this driver. */
+static const struct file_operations vc_sm_ops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = vc_sm_cma_ioctl,
+	.open = vc_sm_cma_open,
+	.release = vc_sm_cma_release,
+};
+
+/* Driver load/unload functions */
 /* Videocore connected.  */
 static void vc_sm_connected_init(void)
 {
@@ -1075,12 +1384,11 @@ static void vc_sm_connected_init(void)
 
 	pr_info("[%s]: start\n", __func__);
 
-	if (vc_sm_cma_add_heaps(&sm_state->cma_heap) ||
-	    !sm_state->cma_heap) {
-		pr_err("[%s]: failed to initialise CMA heaps\n",
+	vc_sm_cma_add_heaps(&sm_state->cma_heap);
+	if (!sm_state->cma_heap) {
+		pr_err("[%s]: failed to initialise CMA heap\n",
 		       __func__);
-		ret = -EIO;
-		goto err_free_mem;
+		return;
 	}
 
 	/*
@@ -1092,8 +1400,7 @@ static void vc_sm_connected_init(void)
 		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
 		       __func__, ret);
 
-		ret = -EIO;
-		goto err_failed;
+		return;
 	}
 
 	ret = vchi_connect(NULL, 0, vchi_instance);
@@ -1101,8 +1408,7 @@ static void vc_sm_connected_init(void)
 		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
 		       __func__, ret);
 
-		ret = -EIO;
-		goto err_failed;
+		return;
 	}
 
 	/* Initialize an instance of the shared memory service. */
@@ -1112,8 +1418,7 @@ static void vc_sm_connected_init(void)
 		pr_err("[%s]: failed to initialize shared memory service\n",
 		       __func__);
 
-		ret = -EPERM;
-		goto err_failed;
+		return;
 	}
 
 	/* Create a debug fs directory entry (root). */
@@ -1127,11 +1432,22 @@ static void vc_sm_connected_init(void)
 
 	INIT_LIST_HEAD(&sm_state->buffer_list);
 
+	/* Create a shared memory device. */
+	sm_state->misc_dev.minor = MISC_DYNAMIC_MINOR;
+	sm_state->misc_dev.name = DEVICE_NAME;
+	sm_state->misc_dev.fops = &vc_sm_ops;
+	sm_state->misc_dev.parent = NULL;
+	ret = misc_register(&sm_state->misc_dev);
+	if (ret) {
+		pr_err("vcsm-cma: failed to register misc device.\n");
+		goto err_remove_debugfs;
+	}
+
 	sm_state->data_knl = vc_sm_cma_create_priv_data(0);
 	if (!sm_state->data_knl) {
 		pr_err("[%s]: failed to create kernel private data tracker\n",
 		       __func__);
-		goto err_remove_shared_memory;
+		goto err_remove_misc_dev;
 	}
 
 	version.version = 2;
@@ -1148,11 +1464,13 @@ static void vc_sm_connected_init(void)
 	pr_info("[%s]: installed successfully\n", __func__);
 	return;
 
-err_remove_shared_memory:
+err_remove_misc_dev:
+	misc_deregister(&sm_state->misc_dev);
+err_remove_debugfs:
 	debugfs_remove_recursive(sm_state->dir_root);
 	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
-err_failed:
-	pr_info("[%s]: failed, ret %d\n", __func__, ret);
+
+	return;
 }
 
 /* Driver loading. */
@@ -1184,6 +1502,8 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 {
 	pr_debug("[%s]: start\n", __func__);
 	if (sm_inited) {
+		misc_deregister(&sm_state->misc_dev);
+
 		/* Remove all proc entries. */
 		debugfs_remove_recursive(sm_state->dir_root);
 
@@ -1202,6 +1522,7 @@ static int bcm2835_vc_sm_cma_remove(struct platform_device *pdev)
 	return 0;
 }
 
+/* Kernel API calls */
 /* Get an internal resource handle mapped from the external one. */
 int vc_sm_cma_int_handle(void *handle)
 {
@@ -1252,7 +1573,7 @@ int vc_sm_cma_import_dmabuf(struct dma_buf *src_dmabuf, void **handle)
 	}
 
 	ret = vc_sm_cma_import_dmabuf_internal(sm_state->data_knl, src_dmabuf,
-					       &new_dma_buf);
+					       -1, &new_dma_buf);
 
 	if (!ret) {
 		pr_debug("%s: imported to ptr %p\n", __func__, new_dma_buf);
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
index 16095f30c2f8f..09ba3f927a29a 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
@@ -92,8 +92,7 @@ int __vc_sm_cma_add_heaps(struct cma *cma, void *priv)
 	return 0;
 }
 
-int vc_sm_cma_add_heaps(struct cma **cma_heap)
+void vc_sm_cma_add_heaps(struct cma **cma_heap)
 {
 	cma_for_each_area(__vc_sm_cma_add_heaps, cma_heap);
-	return 0;
 }
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
index 1fe94a652058f..210000fe91a07 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
@@ -34,6 +34,6 @@ int vc_sm_cma_buffer_allocate(struct cma *cma_heap,
 			      unsigned long len);
 void vc_sm_cma_buffer_free(struct vc_sm_cma_alloc_data *buffer);
 
-int vc_sm_cma_add_heaps(struct cma **cma_heap);
+void vc_sm_cma_add_heaps(struct cma **cma_heap);
 
 #endif
diff --git a/include/linux/broadcom/vc_sm_cma_ioctl.h b/include/linux/broadcom/vc_sm_cma_ioctl.h
new file mode 100644
index 0000000000000..1caadae9768ac
--- /dev/null
+++ b/include/linux/broadcom/vc_sm_cma_ioctl.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright 2019 Raspberry Pi (Trading) Ltd.  All rights reserved.
+ *
+ * Based on vmcs_sm_ioctl.h Copyright Broadcom Corporation.
+ */
+
+#ifndef __VC_SM_CMA_IOCTL_H
+#define __VC_SM_CMA_IOCTL_H
+
+/* ---- Include Files ---------------------------------------------------- */
+
+#if defined(__KERNEL__)
+#include <linux/types.h>	/* Needed for standard types */
+#else
+#include <stdint.h>
+#endif
+
+#include <linux/ioctl.h>
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+#define VC_SM_CMA_RESOURCE_NAME               32
+#define VC_SM_CMA_RESOURCE_NAME_DEFAULT       "sm-host-resource"
+
+/* Type define used to create unique IOCTL number */
+#define VC_SM_CMA_MAGIC_TYPE                  'J'
+
+/* IOCTL commands on /dev/vc-sm-cma */
+enum vc_sm_cma_cmd_e {
+	VC_SM_CMA_CMD_ALLOC = 0x5A,	/* Start at 0x5A arbitrarily */
+
+	VC_SM_CMA_CMD_IMPORT_DMABUF,
+
+	VC_SM_CMA_CMD_LAST	/* Do not delete */
+};
+
+/* Cache type supported, conveniently matches the user space definition in
+ * user-vcsm.h.
+ */
+enum vc_sm_cma_cache_e {
+	VC_SM_CMA_CACHE_NONE,
+	VC_SM_CMA_CACHE_HOST,
+	VC_SM_CMA_CACHE_VC,
+	VC_SM_CMA_CACHE_BOTH,
+};
+
+/* IOCTL Data structures */
+struct vc_sm_cma_ioctl_alloc {
+	/* user -> kernel */
+	__u32 size;
+	__u32 num;
+	__u32 cached;		/* enum vc_sm_cma_cache_e */
+	__u32 pad;
+	__u8 name[VC_SM_CMA_RESOURCE_NAME];
+
+	/* kernel -> user */
+	__s32 handle;
+	__u32 vc_handle;
+	__u64 dma_addr;
+};
+
+struct vc_sm_cma_ioctl_import_dmabuf {
+	/* user -> kernel */
+	__s32 dmabuf_fd;
+	__u32 cached;		/* enum vc_sm_cma_cache_e */
+	__u8 name[VC_SM_CMA_RESOURCE_NAME];
+
+	/* kernel -> user */
+	__s32 handle;
+	__u32 vc_handle;
+	__u32 size;
+	__u32 pad;
+	__u64 dma_addr;
+};
+
+/* IOCTL numbers */
+#define VC_SM_CMA_IOCTL_MEM_ALLOC\
+	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_ALLOC,\
+	 struct vc_sm_cma_ioctl_alloc)
+
+#define VC_SM_CMA_IOCTL_MEM_IMPORT_DMABUF\
+	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_IMPORT_DMABUF,\
+	 struct vc_sm_cma_ioctl_import_dmabuf)
+
+#endif /* __VC_SM_CMA_IOCTL_H */
-- 
GitLab


From 30e54a37c6f90626afc5598110c19badeb2e44fd Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 20 Mar 2019 10:40:00 +0000
Subject: [PATCH 0637/1835] staging: vcsm-cma: Add cache control ioctls

The old driver allowed for direct cache manipulation and that
was used by various clients. Replicate here.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 141 +++++++++++++++++-
 include/linux/broadcom/vc_sm_cma_ioctl.h      |  27 ++++
 2 files changed, 165 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 20385dd01de0f..371c14f64669d 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -46,6 +46,7 @@
 #include <linux/seq_file.h>
 #include <linux/syscalls.h>
 #include <linux/types.h>
+#include <asm/cacheflush.h>
 
 #include "vchiq_connected.h"
 #include "vc_sm_cma_vchi.h"
@@ -1258,6 +1259,99 @@ error:
 	return ret;
 }
 
+/* Converts VCSM_CACHE_OP_* to an operating function. */
+static void (*cache_op_to_func(const unsigned int cache_op))
+						(const void*, const void*)
+{
+	switch (cache_op) {
+	case VC_SM_CACHE_OP_NOP:
+		return NULL;
+
+	case VC_SM_CACHE_OP_INV:
+		return dmac_inv_range;
+
+	case VC_SM_CACHE_OP_CLEAN:
+		return dmac_clean_range;
+
+	case VC_SM_CACHE_OP_FLUSH:
+		return dmac_flush_range;
+
+	default:
+		pr_err("[%s]: Invalid cache_op: 0x%08x\n", __func__, cache_op);
+		return NULL;
+	}
+}
+
+/*
+ * Clean/invalid/flush cache of which buffer is already pinned (i.e. accessed).
+ */
+static int clean_invalid_contig_2d(const void __user *addr,
+				   const size_t block_count,
+				   const size_t block_size,
+				   const size_t stride,
+				   const unsigned int cache_op)
+{
+	size_t i;
+	void (*op_fn)(const void *start, const void *end);
+
+	if (!block_size) {
+		pr_err("[%s]: size cannot be 0\n", __func__);
+		return -EINVAL;
+	}
+
+	op_fn = cache_op_to_func(cache_op);
+	if (!op_fn)
+		return -EINVAL;
+
+	for (i = 0; i < block_count; i ++, addr += stride)
+		op_fn(addr, addr + block_size);
+
+	return 0;
+}
+
+static int vc_sm_cma_clean_invalid2(unsigned int cmdnr, unsigned long arg)
+{
+	struct vc_sm_cma_ioctl_clean_invalid2 ioparam;
+	struct vc_sm_cma_ioctl_clean_invalid_block *block = NULL;
+	int i, ret = 0;
+
+	/* Get parameter data. */
+	if (copy_from_user(&ioparam, (void *)arg, sizeof(ioparam))) {
+		pr_err("[%s]: failed to copy-from-user header for cmd %x\n",
+		       __func__, cmdnr);
+		return -EFAULT;
+	}
+	block = kmalloc(ioparam.op_count * sizeof(*block), GFP_KERNEL);
+	if (!block)
+		return -EFAULT;
+
+	if (copy_from_user(block, (void *)(arg + sizeof(ioparam)),
+			   ioparam.op_count * sizeof(*block)) != 0) {
+		pr_err("[%s]: failed to copy-from-user payload for cmd %x\n",
+		       __func__, cmdnr);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	for (i = 0; i < ioparam.op_count; i++) {
+		const struct vc_sm_cma_ioctl_clean_invalid_block * const op = block + i;
+
+		if (op->invalidate_mode == VC_SM_CACHE_OP_NOP)
+			continue;
+
+		ret = clean_invalid_contig_2d((void __user *)op->start_address,
+					      op->block_count, op->block_size,
+					      op->inter_block_stride,
+					      op->invalidate_mode);
+		if (ret)
+			break;
+	}
+out:
+	kfree(block);
+
+	return ret;
+}
+
 static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 			    unsigned long arg)
 {
@@ -1272,9 +1366,6 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 		return -EPERM;
 	}
 
-	pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
-		 current->tgid, file_data->pid);
-
 	/* Action is a re-post of a previously interrupted action? */
 	if (file_data->restart_sys == -EINTR) {
 		struct vc_sm_action_clean_t action_clean;
@@ -1357,7 +1448,18 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 		break;
 	}
 
+	/*
+	 * Flush/Invalidate the cache for a given mapping.
+	 * Blocks must be pinned (i.e. accessed) before this call.
+	 */
+	case VC_SM_CMA_CMD_CLEAN_INVALID2:
+		ret = vc_sm_cma_clean_invalid2(cmdnr, arg);
+		break;
+
 	default:
+		pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
+			 current->tgid, file_data->pid);
+
 		ret = -EINVAL;
 		break;
 	}
@@ -1365,10 +1467,43 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 	return ret;
 }
 
+#ifdef CONFIG_COMPAT
+struct vc_sm_cma_ioctl_clean_invalid2_32 {
+	u32 op_count;
+	struct vc_sm_cma_ioctl_clean_invalid_block {
+		u16 invalidate_mode;
+		u16 block_count;
+		compat_uptr_t start_address;
+		u32 block_size;
+		u32 inter_block_stride;
+	} s[0];
+};
+
+#define VC_SM_CMA_CMD_CLEAN_INVALID2_32\
+	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
+	 struct vc_sm_cma_ioctl_clean_invalid2)
+
+static long vc_sm_cma_compat_ioctl(struct file *file, unsigned int cmd,
+				   unsigned long arg)
+{
+	switch (cmd) {
+	case VC_SM_CMA_CMD_CLEAN_INVALID2_32:
+		/* FIXME */
+		break;
+
+	default:
+		return vc_sm_cma_compat_ioctl(file, cmd, arg);
+	}
+}
+#endif
+
 /* Device operations that we managed in this driver. */
 static const struct file_operations vc_sm_ops = {
 	.owner = THIS_MODULE,
 	.unlocked_ioctl = vc_sm_cma_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = vc_sm_cma_compat_ioctl,
+#endif
 	.open = vc_sm_cma_open,
 	.release = vc_sm_cma_release,
 };
diff --git a/include/linux/broadcom/vc_sm_cma_ioctl.h b/include/linux/broadcom/vc_sm_cma_ioctl.h
index 1caadae9768ac..107460ad1be34 100644
--- a/include/linux/broadcom/vc_sm_cma_ioctl.h
+++ b/include/linux/broadcom/vc_sm_cma_ioctl.h
@@ -33,6 +33,8 @@ enum vc_sm_cma_cmd_e {
 
 	VC_SM_CMA_CMD_IMPORT_DMABUF,
 
+	VC_SM_CMA_CMD_CLEAN_INVALID2,
+
 	VC_SM_CMA_CMD_LAST	/* Do not delete */
 };
 
@@ -75,6 +77,27 @@ struct vc_sm_cma_ioctl_import_dmabuf {
 	__u64 dma_addr;
 };
 
+/*
+ * Cache functions to be set to struct vc_sm_cma_ioctl_clean_invalid2
+ * invalidate_mode.
+ */
+#define VC_SM_CACHE_OP_NOP       0x00
+#define VC_SM_CACHE_OP_INV       0x01
+#define VC_SM_CACHE_OP_CLEAN     0x02
+#define VC_SM_CACHE_OP_FLUSH     0x03
+
+struct vc_sm_cma_ioctl_clean_invalid2 {
+	__u32 op_count;
+	__u32 pad;
+	struct vc_sm_cma_ioctl_clean_invalid_block {
+		__u32 invalidate_mode;
+		__u32 block_count;
+		void *  __user start_address;
+		__u32 block_size;
+		__u32 inter_block_stride;
+	} s[0];
+};
+
 /* IOCTL numbers */
 #define VC_SM_CMA_IOCTL_MEM_ALLOC\
 	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_ALLOC,\
@@ -84,4 +107,8 @@ struct vc_sm_cma_ioctl_import_dmabuf {
 	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_IMPORT_DMABUF,\
 	 struct vc_sm_cma_ioctl_import_dmabuf)
 
+#define VC_SM_CMA_IOCTL_MEM_CLEAN_INVALID2\
+	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
+	 struct vc_sm_cma_ioctl_clean_invalid2)
+
 #endif /* __VC_SM_CMA_IOCTL_H */
-- 
GitLab


From 3b1f3424f2924c371fd9da286bb249d7488db870 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 13 May 2019 16:47:54 +0100
Subject: [PATCH 0638/1835] staging: vcsm-cma: Alter dev node permissions to
 0666

Until the udev rules are updated, open up access to this node by
default.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 371c14f64669d..c26c9fa876dc3 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -1572,6 +1572,8 @@ static void vc_sm_connected_init(void)
 	sm_state->misc_dev.name = DEVICE_NAME;
 	sm_state->misc_dev.fops = &vc_sm_ops;
 	sm_state->misc_dev.parent = NULL;
+	/* Temporarily set as 666 until udev rules have been sorted */
+	sm_state->misc_dev.mode = 0666;
 	ret = misc_register(&sm_state->misc_dev);
 	if (ret) {
 		pr_err("vcsm-cma: failed to register misc device.\n");
-- 
GitLab


From 91f1b62804c6aedc55c12641a32acecf229bed71 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 16 May 2019 15:17:19 +0100
Subject: [PATCH 0639/1835] staging: vcsm-cma: Drop logging level on messages
 in vc_sm_release_resource

They weren't errors but were logged as such.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index c26c9fa876dc3..3cb9258b8e885 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -301,14 +301,13 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
 
 	if (buffer->vc_handle) {
 		/* We've sent the unmap request but not had the response. */
-		pr_err("[%s]: Waiting for VPU unmap response on %p\n",
-		       __func__, buffer);
+		pr_debug("[%s]: Waiting for VPU unmap response on %p\n",
+			 __func__, buffer);
 		goto defer;
 	}
 	if (buffer->in_use) {
 		/* dmabuf still in use - we await the release */
-		pr_err("[%s]: buffer %p is still in use\n",
-		       __func__, buffer);
+		pr_debug("[%s]: buffer %p is still in use\n", __func__, buffer);
 		goto defer;
 	}
 
-- 
GitLab


From 30dc1edad5a763ec8504a7f92f45a821f57f2c4d Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 22 May 2019 15:40:37 +0100
Subject: [PATCH 0640/1835] staging: vcsm-cma: Fixup the alloc code handling of
 kernel_id

The allocation code had been copied in from an old branch prior
to having added the IDR for 64bit support. It was therefore pushing
a pointer into the kernel_id field instead of an IDR handle, the
lookup therefore failed, and we never released the buffer.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 3cb9258b8e885..ccea692432197 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -1206,7 +1206,7 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 
 	import.addr = (uint32_t)sg_dma_address(buffer->sg_table->sgl);
 	import.size = aligned_size;
-	import.kernel_id = (uint32_t)buffer;
+	import.kernel_id = get_kernel_id(buffer);
 
 	/* Wrap it into a videocore buffer. */
 	status = vc_sm_cma_vchi_import(sm_state->sm_handle, &import, &result,
@@ -1231,6 +1231,7 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 	buffer->size = import.size;
 	buffer->dma_addr = import.addr;
 	buffer->vpu_state = VPU_MAPPED;
+	buffer->kernel_id = import.kernel_id;
 	//buffer->res_cached = ioparam->cached;
 
 	fd = dma_buf_fd(dmabuf, O_CLOEXEC);
-- 
GitLab


From 4600e91bb6dd75140bbafb271f30370bc2e33d60 Mon Sep 17 00:00:00 2001
From: James Hughes <james.hughes@raspberrypi.org>
Date: Thu, 14 Mar 2019 13:27:54 +0000
Subject: [PATCH 0641/1835] Pulled in the multi frame buffer support from the
 Pi3 repo

---
 drivers/video/fbdev/bcm2708_fb.c           | 580 +++++++++++++++------
 include/soc/bcm2835/raspberrypi-firmware.h |   4 +
 2 files changed, 432 insertions(+), 152 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 209a1504a1608..540567fe21a85 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -2,6 +2,7 @@
  *  linux/drivers/video/bcm2708_fb.c
  *
  * Copyright (C) 2010 Broadcom
+ * Copyright (C) 2018 Raspberry Pi (Trading) Ltd
  *
  * This file is subject to the terms and conditions of the GNU General Public
  * License.  See the file COPYING in the main directory of this archive
@@ -13,6 +14,7 @@
  * Copyright 1999-2001 Jeff Garzik <jgarzik@pobox.com>
  *
  */
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -36,6 +38,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/cred.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
+#include <linux/mutex.h>
 
 //#define BCM2708_FB_DEBUG
 #define MODULE_NAME "bcm2708_fb"
@@ -82,62 +85,139 @@ struct bcm2708_fb_stats {
 	u32 dma_irqs;
 };
 
+struct vc4_display_settings_t {
+	u32 display_num;
+	u32 width;
+	u32 height;
+	u32 pitch;
+	u32 depth;
+	u32 virtual_width;
+	u32 virtual_height;
+	u32 virtual_width_offset;
+	u32 virtual_height_offset;
+	unsigned long fb_bus_address;
+};
+
+struct bcm2708_fb_dev;
+
 struct bcm2708_fb {
 	struct fb_info fb;
 	struct platform_device *dev;
-	struct rpi_firmware *fw;
 	u32 cmap[16];
 	u32 gpu_cmap[256];
+	struct dentry *debugfs_dir;
+	struct dentry *debugfs_subdir;
+	unsigned long fb_bus_address;
+	struct { u32 base, length; } gpu;
+	struct vc4_display_settings_t display_settings;
+	struct debugfs_regset32 screeninfo_regset;
+	struct bcm2708_fb_dev *fbdev;
+	unsigned int image_size;
+	dma_addr_t dma_addr;
+	void *cpuaddr;
+};
+
+#define MAX_FRAMEBUFFERS 3
+
+struct bcm2708_fb_dev {
+	int firmware_supports_multifb;
+	/* Protects the DMA system from multiple FB access */
+	struct mutex dma_mutex;
 	int dma_chan;
 	int dma_irq;
 	void __iomem *dma_chan_base;
-	void *cb_base;		/* DMA control blocks */
-	dma_addr_t cb_handle;
-	struct dentry *debugfs_dir;
 	wait_queue_head_t dma_waitq;
-	struct bcm2708_fb_stats stats;
-	unsigned long fb_bus_address;
-	struct { u32 base, length; } gpu;
+	bool disable_arm_alloc;
+	struct bcm2708_fb_stats dma_stats;
+	void *cb_base;	/* DMA control blocks */
+	dma_addr_t cb_handle;
+	int instance_count;
+	int num_displays;
+	struct rpi_firmware *fw;
+	struct bcm2708_fb displays[MAX_FRAMEBUFFERS];
 };
 
 #define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
 
 static void bcm2708_fb_debugfs_deinit(struct bcm2708_fb *fb)
 {
-	debugfs_remove_recursive(fb->debugfs_dir);
-	fb->debugfs_dir = NULL;
+	debugfs_remove_recursive(fb->debugfs_subdir);
+	fb->debugfs_subdir = NULL;
+
+	fb->fbdev->instance_count--;
+
+	if (!fb->fbdev->instance_count) {
+		debugfs_remove_recursive(fb->debugfs_dir);
+		fb->debugfs_dir = NULL;
+	}
 }
 
 static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
 {
+	char buf[3];
+	struct bcm2708_fb_dev *fbdev = fb->fbdev;
+
 	static struct debugfs_reg32 stats_registers[] = {
-		{
-			"dma_copies",
-			offsetof(struct bcm2708_fb_stats, dma_copies)
-		},
-		{
-			"dma_irqs",
-			offsetof(struct bcm2708_fb_stats, dma_irqs)
-		},
+	{"dma_copies", offsetof(struct bcm2708_fb_stats, dma_copies)},
+	{"dma_irqs",   offsetof(struct bcm2708_fb_stats, dma_irqs)},
 	};
 
-	fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
+	static struct debugfs_reg32 screeninfo[] = {
+	{"width",	 offsetof(struct fb_var_screeninfo, xres)},
+	{"height",	 offsetof(struct fb_var_screeninfo, yres)},
+	{"bpp",		 offsetof(struct fb_var_screeninfo, bits_per_pixel)},
+	{"xres_virtual", offsetof(struct fb_var_screeninfo, xres_virtual)},
+	{"yres_virtual", offsetof(struct fb_var_screeninfo, yres_virtual)},
+	{"xoffset",	 offsetof(struct fb_var_screeninfo, xoffset)},
+	{"yoffset",	 offsetof(struct fb_var_screeninfo, yoffset)},
+	};
+
+	fb->debugfs_dir = debugfs_lookup(DRIVER_NAME, NULL);
+
+	if (!fb->debugfs_dir)
+		fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
+
 	if (!fb->debugfs_dir) {
-		pr_warn("%s: could not create debugfs entry\n",
-			__func__);
+		dev_warn(fb->fb.dev, "%s: could not create debugfs folder\n",
+			 __func__);
+		return -EFAULT;
+	}
+
+	snprintf(buf, sizeof(buf), "%u", fb->display_settings.display_num);
+
+	fb->debugfs_subdir = debugfs_create_dir(buf, fb->debugfs_dir);
+
+	if (!fb->debugfs_subdir) {
+		dev_warn(fb->fb.dev, "%s: could not create debugfs entry %u\n",
+			 __func__, fb->display_settings.display_num);
 		return -EFAULT;
 	}
 
-	fb->stats.regset.regs = stats_registers;
-	fb->stats.regset.nregs = ARRAY_SIZE(stats_registers);
-	fb->stats.regset.base = &fb->stats;
+	fbdev->dma_stats.regset.regs = stats_registers;
+	fbdev->dma_stats.regset.nregs = ARRAY_SIZE(stats_registers);
+	fbdev->dma_stats.regset.base = &fbdev->dma_stats;
+
+	if (!debugfs_create_regset32("dma_stats", 0444, fb->debugfs_subdir,
+				     &fbdev->dma_stats.regset)) {
+		dev_warn(fb->fb.dev, "%s: could not create statistics registers\n",
+			 __func__);
+		goto fail;
+	}
+
+	fb->screeninfo_regset.regs = screeninfo;
+	fb->screeninfo_regset.nregs = ARRAY_SIZE(screeninfo);
+	fb->screeninfo_regset.base = &fb->fb.var;
 
-	if (!debugfs_create_regset32("stats", 0444, fb->debugfs_dir,
-				     &fb->stats.regset)) {
-		pr_warn("%s: could not create statistics registers\n",
-			__func__);
+	if (!debugfs_create_regset32("screeninfo", 0444, fb->debugfs_subdir,
+				     &fb->screeninfo_regset)) {
+		dev_warn(fb->fb.dev,
+			 "%s: could not create dimensions registers\n",
+			 __func__);
 		goto fail;
 	}
+
+	fbdev->instance_count++;
+
 	return 0;
 
 fail:
@@ -145,6 +225,20 @@ fail:
 	return -EFAULT;
 }
 
+static void set_display_num(struct bcm2708_fb *fb)
+{
+	if (fb && fb->fbdev && fb->fbdev->firmware_supports_multifb) {
+		u32 tmp = fb->display_settings.display_num;
+
+		if (rpi_firmware_property(fb->fbdev->fw,
+					  RPI_FIRMWARE_FRAMEBUFFER_SET_DISPLAY_NUM,
+					  &tmp,
+					  sizeof(tmp)))
+			dev_warn_once(fb->fb.dev,
+				      "Set display number call failed. Old GPU firmware?");
+	}
+}
+
 static int bcm2708_fb_set_bitfields(struct fb_var_screeninfo *var)
 {
 	int ret = 0;
@@ -222,11 +316,11 @@ static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
 				struct fb_info *info)
 {
 	/* info input, var output */
-	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n",
+	print_debug("%s(%p) %ux%u (%ux%u), %ul, %u\n",
 		    __func__, info, info->var.xres, info->var.yres,
 		    info->var.xres_virtual, info->var.yres_virtual,
-		    (int)info->screen_size, info->var.bits_per_pixel);
-	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var, var->xres,
+		    info->screen_size, info->var.bits_per_pixel);
+	print_debug("%s(%p) %ux%u (%ux%u), %u\n", __func__, var, var->xres,
 		    var->yres, var->xres_virtual, var->yres_virtual,
 		    var->bits_per_pixel);
 
@@ -283,23 +377,96 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 			.xoffset = info->var.xoffset,
 			.yoffset = info->var.yoffset,
 		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
-			.base = 0,
-			.screen_size = 0,
-		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH, 4, 0 },
-			.pitch = 0,
+			/* base and screen_size will be initialised later */
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
+			/* pitch will be initialised later */
 	};
-	int ret;
+	int ret, image_size;
 
-	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
+
+	print_debug("%s(%p) %dx%d (%dx%d), %d, %d (display %d)\n", __func__,
+		    info,
 		    info->var.xres, info->var.yres, info->var.xres_virtual,
 		    info->var.yres_virtual, (int)info->screen_size,
-		    info->var.bits_per_pixel);
+		    info->var.bits_per_pixel, value);
+
+	/* Need to set the display number to act on first
+	 * Cannot do it in the tag list because on older firmware the call
+	 * will fail and stop the rest of the list being executed.
+	 * We can ignore this call failing as the default at other end is 0
+	 */
+	set_display_num(fb);
+
+	/* Try allocating our own buffer. We can specify all the parameters */
+	image_size = ((info->var.xres * info->var.yres) *
+		      info->var.bits_per_pixel) >> 3;
+
+	if (!fb->fbdev->disable_arm_alloc &&
+	    (image_size != fb->image_size || !fb->dma_addr)) {
+		if (fb->dma_addr) {
+			dma_free_coherent(info->device, fb->image_size,
+					  fb->cpuaddr, fb->dma_addr);
+			fb->image_size = 0;
+			fb->cpuaddr = NULL;
+			fb->dma_addr = 0;
+		}
+
+		fb->cpuaddr = dma_alloc_coherent(info->device, image_size,
+						 &fb->dma_addr, GFP_KERNEL);
+
+		if (!fb->cpuaddr) {
+			fb->dma_addr = 0;
+			fb->fbdev->disable_arm_alloc = true;
+		} else {
+			fb->image_size = image_size;
+		}
+	}
+
+	if (fb->cpuaddr) {
+		fbinfo.base = fb->dma_addr;
+		fbinfo.screen_size = image_size;
+		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
+
+		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
+						 sizeof(fbinfo));
+		if (ret || fbinfo.base != fb->dma_addr) {
+			/* Firmware either failed, or assigned a different base
+			 * address (ie it doesn't support being passed an FB
+			 * allocation).
+			 * Destroy the allocation, and don't try again.
+			 */
+			dma_free_coherent(info->device, fb->image_size,
+					  fb->cpuaddr, fb->dma_addr);
+			fb->image_size = 0;
+			fb->cpuaddr = NULL;
+			fb->dma_addr = 0;
+			fb->fbdev->disable_arm_alloc = true;
+		}
+	} else {
+		/* Our allocation failed - drop into the old scheme of
+		 * allocation by the VPU.
+		 */
+		ret = -ENOMEM;
+	}
 
-	ret = rpi_firmware_property_list(fb->fw, &fbinfo, sizeof(fbinfo));
 	if (ret) {
-		dev_err(info->device,
-			"Failed to allocate GPU framebuffer (%d)\n", ret);
-		return ret;
+		/* Old scheme:
+		 * - FRAMEBUFFER_ALLOCATE passes 0 for base and screen_size.
+		 * - GET_PITCH instead of SET_PITCH.
+		 */
+		fbinfo.base = 0;
+		fbinfo.screen_size = 0;
+		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
+		fbinfo.pitch = 0;
+
+		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
+						 sizeof(fbinfo));
+		if (ret) {
+			dev_err(info->device,
+				"Failed to allocate GPU framebuffer (%d)\n",
+				ret);
+			return ret;
+		}
 	}
 
 	if (info->var.bits_per_pixel <= 8)
@@ -314,9 +481,17 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 	fb->fb.fix.smem_start = fbinfo.base;
 	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
 	fb->fb.screen_size = fbinfo.screen_size;
-	if (fb->fb.screen_base)
-		iounmap(fb->fb.screen_base);
-	fb->fb.screen_base = ioremap_wc(fbinfo.base, fb->fb.screen_size);
+
+	if (!fb->dma_addr) {
+		if (fb->fb.screen_base)
+			iounmap(fb->fb.screen_base);
+
+		fb->fb.screen_base = ioremap_wc(fbinfo.base,
+						fb->fb.screen_size);
+	} else {
+		fb->fb.screen_base = fb->cpuaddr;
+	}
+
 	if (!fb->fb.screen_base) {
 		/* the console may currently be locked */
 		console_trylock();
@@ -374,7 +549,10 @@ static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
 			packet->length = regno + 1;
 			memcpy(packet->cmap, fb->gpu_cmap,
 			       sizeof(packet->cmap));
-			ret = rpi_firmware_property(fb->fw,
+
+			set_display_num(fb);
+
+			ret = rpi_firmware_property(fb->fbdev->fw,
 						    RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
 						    packet,
 						    (2 + packet->length) * sizeof(u32));
@@ -413,8 +591,11 @@ static int bcm2708_fb_blank(int blank_mode, struct fb_info *info)
 		return -EINVAL;
 	}
 
-	ret = rpi_firmware_property(fb->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+	set_display_num(fb);
+
+	ret = rpi_firmware_property(fb->fbdev->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
 				    &value, sizeof(value));
+
 	if (ret)
 		dev_err(info->device, "%s(%d) failed: %d\n", __func__,
 			blank_mode, ret);
@@ -431,7 +612,7 @@ static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
 	info->var.yoffset = var->yoffset;
 	result = bcm2708_fb_set_par(info);
 	if (result != 0)
-		pr_err("%s(%d,%d) returns=%d\n", __func__, var->xoffset,
+		pr_err("%s(%u,%u) returns=%d\n", __func__, var->xoffset,
 		       var->yoffset, result);
 	return result;
 }
@@ -439,8 +620,9 @@ static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
 static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
 		       int size)
 {
-	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
-	struct bcm2708_dma_cb *cb = fb->cb_base;
+	struct bcm2708_fb_dev *fbdev = fb->fbdev;
+	struct bcm2708_dma_cb *cb = fbdev->cb_base;
+	int burst_size = (fbdev->dma_chan == 0) ? 8 : 2;
 
 	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
 		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
@@ -453,21 +635,27 @@ static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
 	cb->pad[1] = 0;
 	cb->next = 0;
 
+	// Not sure what to do if this gets a signal whilst waiting
+	if (mutex_lock_interruptible(&fbdev->dma_mutex))
+		return;
+
 	if (size < dma_busy_wait_threshold) {
-		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
-		bcm_dma_wait_idle(fb->dma_chan_base);
+		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
+		bcm_dma_wait_idle(fbdev->dma_chan_base);
 	} else {
-		void __iomem *dma_chan = fb->dma_chan_base;
+		void __iomem *local_dma_chan = fbdev->dma_chan_base;
 
 		cb->info |= BCM2708_DMA_INT_EN;
-		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
-		while (bcm_dma_is_busy(dma_chan)) {
-			wait_event_interruptible(fb->dma_waitq,
-						 !bcm_dma_is_busy(dma_chan));
+		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
+		while (bcm_dma_is_busy(local_dma_chan)) {
+			wait_event_interruptible(fbdev->dma_waitq,
+						 !bcm_dma_is_busy(local_dma_chan));
 		}
-		fb->stats.dma_irqs++;
+		fbdev->dma_stats.dma_irqs++;
 	}
-	fb->stats.dma_copies++;
+	fbdev->dma_stats.dma_copies++;
+
+	mutex_unlock(&fbdev->dma_mutex);
 }
 
 /* address with no aliases */
@@ -542,10 +730,13 @@ static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
 
 	switch (cmd) {
 	case FBIO_WAITFORVSYNC:
-		ret = rpi_firmware_property(fb->fw,
+		set_display_num(fb);
+
+		ret = rpi_firmware_property(fb->fbdev->fw,
 					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
 					    &dummy, sizeof(dummy));
 		break;
+
 	case FBIODMACOPY:
 	{
 		struct fb_dmacopy ioparam;
@@ -615,23 +806,22 @@ static int bcm2708_compat_ioctl(struct fb_info *info, unsigned int cmd,
 static void bcm2708_fb_fillrect(struct fb_info *info,
 				const struct fb_fillrect *rect)
 {
-	/* (is called) print_debug("bcm2708_fb_fillrect\n"); */
 	cfb_fillrect(info, rect);
 }
 
 /* A helper function for configuring dma control block */
 static void set_dma_cb(struct bcm2708_dma_cb *cb,
-		       int        burst_size,
-		       dma_addr_t dst,
-		       int        dst_stride,
-		       dma_addr_t src,
-		       int        src_stride,
-		       int        w,
-		       int        h)
+		int        burst_size,
+		dma_addr_t dst,
+		int        dst_stride,
+		dma_addr_t src,
+		int        src_stride,
+		int        w,
+		int        h)
 {
 	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
-		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
-		   BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
+		BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
+		BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
 	cb->dst = dst;
 	cb->src = src;
 	/*
@@ -649,15 +839,19 @@ static void bcm2708_fb_copyarea(struct fb_info *info,
 				const struct fb_copyarea *region)
 {
 	struct bcm2708_fb *fb = to_bcm2708(info);
-	struct bcm2708_dma_cb *cb = fb->cb_base;
+	struct bcm2708_fb_dev *fbdev = fb->fbdev;
+	struct bcm2708_dma_cb *cb = fbdev->cb_base;
 	int bytes_per_pixel = (info->var.bits_per_pixel + 7) >> 3;
 
 	/* Channel 0 supports larger bursts and is a bit faster */
-	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
+	int burst_size = (fbdev->dma_chan == 0) ? 8 : 2;
 	int pixels = region->width * region->height;
 
-	/* Fallback to cfb_copyarea() if we don't like something */
-	if (bytes_per_pixel > 4 ||
+	/* If DMA is currently in use (ie being used on another FB), then
+	 * rather than wait for it to finish, just use the cfb_copyarea
+	 */
+	if (!mutex_trylock(&fbdev->dma_mutex) ||
+	    bytes_per_pixel > 4 ||
 	    info->var.xres * info->var.yres > 1920 * 1200 ||
 	    region->width <= 0 || region->width > info->var.xres ||
 	    region->height <= 0 || region->height > info->var.yres ||
@@ -684,8 +878,8 @@ static void bcm2708_fb_copyarea(struct fb_info *info,
 		 * 1920x1200 resolution at 32bpp pixel depth.
 		 */
 		int y;
-		dma_addr_t control_block_pa = fb->cb_handle;
-		dma_addr_t scratchbuf = fb->cb_handle + 16 * 1024;
+		dma_addr_t control_block_pa = fbdev->cb_handle;
+		dma_addr_t scratchbuf = fbdev->cb_handle + 16 * 1024;
 		int scanline_size = bytes_per_pixel * region->width;
 		int scanlines_per_cb = (64 * 1024 - 16 * 1024) / scanline_size;
 
@@ -735,10 +929,10 @@ static void bcm2708_fb_copyarea(struct fb_info *info,
 		}
 		set_dma_cb(cb, burst_size,
 			   fb->fb_bus_address + dy * fb->fb.fix.line_length +
-						   bytes_per_pixel * region->dx,
+			   bytes_per_pixel * region->dx,
 			   stride,
 			   fb->fb_bus_address + sy * fb->fb.fix.line_length +
-						   bytes_per_pixel * region->sx,
+			   bytes_per_pixel * region->sx,
 			   stride,
 			   region->width * bytes_per_pixel,
 			   region->height);
@@ -748,32 +942,33 @@ static void bcm2708_fb_copyarea(struct fb_info *info,
 	cb->next = 0;
 
 	if (pixels < dma_busy_wait_threshold) {
-		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
-		bcm_dma_wait_idle(fb->dma_chan_base);
+		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
+		bcm_dma_wait_idle(fbdev->dma_chan_base);
 	} else {
-		void __iomem *dma_chan = fb->dma_chan_base;
+		void __iomem *local_dma_chan = fbdev->dma_chan_base;
 
 		cb->info |= BCM2708_DMA_INT_EN;
-		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
-		while (bcm_dma_is_busy(dma_chan)) {
-			wait_event_interruptible(fb->dma_waitq,
-						 !bcm_dma_is_busy(dma_chan));
+		bcm_dma_start(fbdev->dma_chan_base, fbdev->cb_handle);
+		while (bcm_dma_is_busy(local_dma_chan)) {
+			wait_event_interruptible(fbdev->dma_waitq,
+						 !bcm_dma_is_busy(local_dma_chan));
 		}
-		fb->stats.dma_irqs++;
+		fbdev->dma_stats.dma_irqs++;
 	}
-	fb->stats.dma_copies++;
+	fbdev->dma_stats.dma_copies++;
+
+	mutex_unlock(&fbdev->dma_mutex);
 }
 
 static void bcm2708_fb_imageblit(struct fb_info *info,
 				 const struct fb_image *image)
 {
-	/* (is called) print_debug("bcm2708_fb_imageblit\n"); */
 	cfb_imageblit(info, image);
 }
 
 static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
 {
-	struct bcm2708_fb *fb = cxt;
+	struct bcm2708_fb_dev *fbdev = cxt;
 
 	/* FIXME: should read status register to check if this is
 	 * actually interrupting us or not, in case this interrupt
@@ -783,9 +978,9 @@ static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
 	 */
 
 	/* acknowledge the interrupt */
-	writel(BCM2708_DMA_INT, fb->dma_chan_base + BCM2708_DMA_CS);
+	writel(BCM2708_DMA_INT, fbdev->dma_chan_base + BCM2708_DMA_CS);
 
-	wake_up(&fb->dma_waitq);
+	wake_up(&fbdev->dma_waitq);
 	return IRQ_HANDLED;
 }
 
@@ -821,11 +1016,23 @@ static int bcm2708_fb_register(struct bcm2708_fb *fb)
 	fb->fb.fix.ywrapstep = 0;
 	fb->fb.fix.accel = FB_ACCEL_NONE;
 
-	fb->fb.var.xres = fbwidth;
-	fb->fb.var.yres = fbheight;
-	fb->fb.var.xres_virtual = fbwidth;
-	fb->fb.var.yres_virtual = fbheight;
-	fb->fb.var.bits_per_pixel = fbdepth;
+	/* If we have data from the VC4 on FB's, use that, otherwise use the
+	 * module parameters
+	 */
+	if (fb->display_settings.width) {
+		fb->fb.var.xres = fb->display_settings.width;
+		fb->fb.var.yres = fb->display_settings.height;
+		fb->fb.var.xres_virtual = fb->fb.var.xres;
+		fb->fb.var.yres_virtual = fb->fb.var.yres;
+		fb->fb.var.bits_per_pixel = fb->display_settings.depth;
+	} else {
+		fb->fb.var.xres = fbwidth;
+		fb->fb.var.yres = fbheight;
+		fb->fb.var.xres_virtual = fbwidth;
+		fb->fb.var.yres_virtual = fbheight;
+		fb->fb.var.bits_per_pixel = fbdepth;
+	}
+
 	fb->fb.var.vmode = FB_VMODE_NONINTERLACED;
 	fb->fb.var.activate = FB_ACTIVATE_NOW;
 	fb->fb.var.nonstd = 0;
@@ -841,26 +1048,23 @@ static int bcm2708_fb_register(struct bcm2708_fb *fb)
 	fb->fb.monspecs.dclkmax = 100000000;
 
 	bcm2708_fb_set_bitfields(&fb->fb.var);
-	init_waitqueue_head(&fb->dma_waitq);
 
 	/*
 	 * Allocate colourmap.
 	 */
-
 	fb_set_var(&fb->fb, &fb->fb.var);
+
 	ret = bcm2708_fb_set_par(&fb->fb);
+
 	if (ret)
 		return ret;
 
-	print_debug("BCM2708FB: registering framebuffer (%dx%d@%d) (%d)\n",
-		    fbwidth, fbheight, fbdepth, fbswap);
-
 	ret = register_framebuffer(&fb->fb);
-	print_debug("BCM2708FB: register framebuffer (%d)\n", ret);
+
 	if (ret == 0)
 		goto out;
 
-	print_debug("BCM2708FB: cannot register framebuffer (%d)\n", ret);
+	dev_warn(fb->fb.dev, "Unable to register framebuffer (%d)\n", ret);
 out:
 	return ret;
 }
@@ -869,10 +1073,18 @@ static int bcm2708_fb_probe(struct platform_device *dev)
 {
 	struct device_node *fw_np;
 	struct rpi_firmware *fw;
-	struct bcm2708_fb *fb;
-	int ret;
+	int ret, i;
+	u32 num_displays;
+	struct bcm2708_fb_dev *fbdev;
+	struct { u32 base, length; } gpu_mem;
+
+	fbdev = devm_kzalloc(&dev->dev, sizeof(*fbdev), GFP_KERNEL);
+
+	if (!fbdev)
+		return -ENOMEM;
 
 	fw_np = of_parse_phandle(dev->dev.of_node, "firmware", 0);
+
 /* Remove comment when booting without Device Tree is no longer supported
  *	if (!fw_np) {
  *		dev_err(&dev->dev, "Missing firmware node\n");
@@ -880,90 +1092,154 @@ static int bcm2708_fb_probe(struct platform_device *dev)
  *	}
  */
 	fw = rpi_firmware_get(fw_np);
+	fbdev->fw = fw;
+
 	if (!fw)
 		return -EPROBE_DEFER;
 
-	fb = kzalloc(sizeof(*fb), GFP_KERNEL);
-	if (!fb) {
-		ret = -ENOMEM;
-		goto free_region;
+	ret = rpi_firmware_property(fw,
+				    RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS,
+				    &num_displays, sizeof(u32));
+
+	/* If we fail to get the number of displays, or it returns 0, then
+	 * assume old firmware that doesn't have the mailbox call, so just
+	 * set one display
+	 */
+	if (ret || num_displays == 0) {
+		num_displays = 1;
+		dev_err(&dev->dev,
+			"Unable to determine number of FB's. Assuming 1\n");
+		ret = 0;
+	} else {
+		fbdev->firmware_supports_multifb = 1;
 	}
 
-	fb->fw = fw;
-	bcm2708_fb_debugfs_init(fb);
+	if (num_displays > MAX_FRAMEBUFFERS) {
+		dev_warn(&dev->dev,
+			 "More displays reported from firmware than supported in driver (%u vs %u)",
+			 num_displays, MAX_FRAMEBUFFERS);
+		num_displays = MAX_FRAMEBUFFERS;
+	}
+
+	dev_info(&dev->dev, "FB found %d display(s)\n", num_displays);
+
+	/* Set up the DMA information. Note we have just one set of DMA
+	 * parameters to work with all the FB's so requires synchronising when
+	 * being used
+	 */
 
-	fb->cb_base = dma_alloc_writecombine(&dev->dev, SZ_64K,
-					     &fb->cb_handle, GFP_KERNEL);
-	if (!fb->cb_base) {
+	mutex_init(&fbdev->dma_mutex);
+
+	fbdev->cb_base = dma_alloc_writecombine(&dev->dev, SZ_64K,
+						&fbdev->cb_handle,
+						GFP_KERNEL);
+	if (!fbdev->cb_base) {
 		dev_err(&dev->dev, "cannot allocate DMA CBs\n");
 		ret = -ENOMEM;
 		goto free_fb;
 	}
 
-	pr_info("BCM2708FB: allocated DMA memory %pad\n", &fb->cb_handle);
-
 	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
-				 &fb->dma_chan_base, &fb->dma_irq);
+				 &fbdev->dma_chan_base,
+				 &fbdev->dma_irq);
 	if (ret < 0) {
-		dev_err(&dev->dev, "couldn't allocate a DMA channel\n");
+		dev_err(&dev->dev, "Couldn't allocate a DMA channel\n");
 		goto free_cb;
 	}
-	fb->dma_chan = ret;
+	fbdev->dma_chan = ret;
 
-	ret = request_irq(fb->dma_irq, bcm2708_fb_dma_irq,
-			  0, "bcm2708_fb dma", fb);
+	ret = request_irq(fbdev->dma_irq, bcm2708_fb_dma_irq,
+			  0, "bcm2708_fb DMA", fbdev);
 	if (ret) {
-		pr_err("%s: failed to request DMA irq\n", __func__);
+		dev_err(&dev->dev,
+			"Failed to request DMA irq\n");
 		goto free_dma_chan;
 	}
 
-	pr_info("BCM2708FB: allocated DMA channel %d\n", fb->dma_chan);
+	rpi_firmware_property(fbdev->fw,
+			      RPI_FIRMWARE_GET_VC_MEMORY,
+			      &gpu_mem, sizeof(gpu_mem));
 
-	fb->dev = dev;
-	fb->fb.device = &dev->dev;
+	for (i = 0; i < num_displays; i++) {
+		struct bcm2708_fb *fb = &fbdev->displays[i];
 
-	/* failure here isn't fatal, but we'll fail in vc_mem_copy if
-	 * fb->gpu is not valid
-	 */
-	rpi_firmware_property(fb->fw, RPI_FIRMWARE_GET_VC_MEMORY, &fb->gpu,
-			      sizeof(fb->gpu));
+		fb->display_settings.display_num = i;
+		fb->dev = dev;
+		fb->fb.device = &dev->dev;
+		fb->fbdev = fbdev;
 
-	ret = bcm2708_fb_register(fb);
-	if (ret == 0) {
-		platform_set_drvdata(dev, fb);
-		goto out;
+		fb->gpu.base = gpu_mem.base;
+		fb->gpu.length = gpu_mem.length;
+
+		if (fbdev->firmware_supports_multifb) {
+			ret = rpi_firmware_property(fw,
+						    RPI_FIRMWARE_FRAMEBUFFER_GET_DISPLAY_SETTINGS,
+						    &fb->display_settings,
+						    GET_DISPLAY_SETTINGS_PAYLOAD_SIZE);
+		} else {
+			memset(&fb->display_settings, 0,
+			       sizeof(fb->display_settings));
+		}
+
+		ret = bcm2708_fb_register(fb);
+
+		if (ret == 0) {
+			bcm2708_fb_debugfs_init(fb);
+
+			fbdev->num_displays++;
+
+			dev_info(&dev->dev,
+				 "Registered framebuffer for display %u, size %ux%u\n",
+				 fb->display_settings.display_num,
+				 fb->fb.var.xres,
+				 fb->fb.var.yres);
+		} else {
+			// Use this to flag if this FB entry is in use.
+			fb->fbdev = NULL;
+		}
+	}
+
+	// Did we actually successfully create any FB's?
+	if (fbdev->num_displays) {
+		init_waitqueue_head(&fbdev->dma_waitq);
+		platform_set_drvdata(dev, fbdev);
+		return ret;
 	}
 
 free_dma_chan:
-	bcm_dma_chan_free(fb->dma_chan);
+	bcm_dma_chan_free(fbdev->dma_chan);
 free_cb:
-	dma_free_writecombine(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
+	dma_free_writecombine(&dev->dev, SZ_64K, fbdev->cb_base,
+			      fbdev->cb_handle);
 free_fb:
-	kfree(fb);
-free_region:
 	dev_err(&dev->dev, "probe failed, err %d\n", ret);
-out:
+
 	return ret;
 }
 
 static int bcm2708_fb_remove(struct platform_device *dev)
 {
-	struct bcm2708_fb *fb = platform_get_drvdata(dev);
+	struct bcm2708_fb_dev *fbdev = platform_get_drvdata(dev);
+	int i;
 
 	platform_set_drvdata(dev, NULL);
 
-	if (fb->fb.screen_base)
-		iounmap(fb->fb.screen_base);
-	unregister_framebuffer(&fb->fb);
-
-	dma_free_writecombine(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
-	bcm_dma_chan_free(fb->dma_chan);
+	for (i = 0; i < fbdev->num_displays; i++) {
+		if (fbdev->displays[i].fb.screen_base)
+			iounmap(fbdev->displays[i].fb.screen_base);
 
-	bcm2708_fb_debugfs_deinit(fb);
+		if (fbdev->displays[i].fbdev) {
+			unregister_framebuffer(&fbdev->displays[i].fb);
+			bcm2708_fb_debugfs_deinit(&fbdev->displays[i]);
+		}
+	}
 
-	free_irq(fb->dma_irq, fb);
+	dma_free_writecombine(&dev->dev, SZ_64K, fbdev->cb_base,
+			      fbdev->cb_handle);
+	bcm_dma_chan_free(fbdev->dma_chan);
+	free_irq(fbdev->dma_irq, fbdev);
 
-	kfree(fb);
+	mutex_destroy(&fbdev->dma_mutex);
 
 	return 0;
 }
@@ -978,10 +1254,10 @@ static struct platform_driver bcm2708_fb_driver = {
 	.probe = bcm2708_fb_probe,
 	.remove = bcm2708_fb_remove,
 	.driver = {
-		   .name = DRIVER_NAME,
-		   .owner = THIS_MODULE,
-		   .of_match_table = bcm2708_fb_of_match_table,
-		   },
+		  .name = DRIVER_NAME,
+		  .owner = THIS_MODULE,
+		  .of_match_table = bcm2708_fb_of_match_table,
+		  },
 };
 
 static int __init bcm2708_fb_init(void)
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 88b51f2ece2d7..10252aa519d3a 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -138,9 +138,11 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PIXEL_ORDER =            0x00048006,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE =             0x00048007,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH =                  0x00048008,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
+
 	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC =                  0x0004800e,
@@ -159,6 +161,8 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_GET_DMA_CHANNELS =                       0x00060001,
 };
 
+#define GET_DISPLAY_SETTINGS_PAYLOAD_SIZE 64
+
 #if IS_ENABLED(CONFIG_RASPBERRYPI_FIRMWARE)
 int rpi_firmware_property(struct rpi_firmware *fw,
 			  u32 tag, void *data, size_t len);
-- 
GitLab


From 769a7330aa5bebcc98b1ff12ecb767db4e5c644d Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Sun, 19 May 2019 12:26:21 +0200
Subject: [PATCH 0642/1835] ARM: dts: bcm283x: Move BCM2835/6/7 specific to
 bcm2835-common.dtsi

We want all common BCM2835/6/7/8 functions in bcm283x.dtsi and all
BCM2835/6/7 specific in the new bcm2835-common.dtsi.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
---
 arch/arm/boot/dts/bcm2835-common.dtsi | 53 +++++++++++++++++++++++++++
 arch/arm/boot/dts/bcm2835.dtsi        |  1 +
 arch/arm/boot/dts/bcm2836.dtsi        |  1 +
 arch/arm/boot/dts/bcm2837.dtsi        |  1 +
 arch/arm/boot/dts/bcm283x.dtsi        | 43 +---------------------
 5 files changed, 57 insertions(+), 42 deletions(-)
 create mode 100644 arch/arm/boot/dts/bcm2835-common.dtsi

diff --git a/arch/arm/boot/dts/bcm2835-common.dtsi b/arch/arm/boot/dts/bcm2835-common.dtsi
new file mode 100644
index 0000000000000..17771730a37bd
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2835-common.dtsi
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/* This include file covers the common peripherals and configuration between
+ * bcm2835, bcm2836 and bcm2837 implementations.
+ */
+
+/ {
+	soc {
+		timer@7e003000 {
+			compatible = "brcm,bcm2835-system-timer";
+			reg = <0x7e003000 0x1000>;
+			interrupts = <1 0>, <1 1>, <1 2>, <1 3>;
+			/* This could be a reference to BCM2835_CLOCK_TIMER,
+			 * but we don't have the driver using the common clock
+			 * support yet.
+			 */
+			clock-frequency = <1000000>;
+		};
+
+		intc: interrupt-controller@7e00b200 {
+			compatible = "brcm,bcm2835-armctrl-ic";
+			reg = <0x7e00b200 0x200>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		thermal: thermal@7e212000 {
+			compatible = "brcm,bcm2835-thermal";
+			reg = <0x7e212000 0x8>;
+			clocks = <&clocks BCM2835_CLOCK_TSENS>;
+			#thermal-sensor-cells = <0>;
+			status = "disabled";
+		};
+
+		v3d: v3d@7ec00000 {
+			compatible = "brcm,bcm2835-v3d";
+			reg = <0x7ec00000 0x1000>;
+			interrupts = <1 10>;
+		};
+	};
+};
+
+&gpio {
+	i2c_slave_gpio18: i2c_slave_gpio18 {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	jtag_gpio4: jtag_gpio4 {
+		brcm,pins = <4 5 6 12 13>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
index a5c3824c80563..53bf4579cc224 100644
--- a/arch/arm/boot/dts/bcm2835.dtsi
+++ b/arch/arm/boot/dts/bcm2835.dtsi
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include "bcm283x.dtsi"
+#include "bcm2835-common.dtsi"
 
 / {
 	compatible = "brcm,bcm2835";
diff --git a/arch/arm/boot/dts/bcm2836.dtsi b/arch/arm/boot/dts/bcm2836.dtsi
index c933e84138842..82d6c4662ae49 100644
--- a/arch/arm/boot/dts/bcm2836.dtsi
+++ b/arch/arm/boot/dts/bcm2836.dtsi
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include "bcm283x.dtsi"
+#include "bcm2835-common.dtsi"
 
 / {
 	compatible = "brcm,bcm2836";
diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi
index beb6c502dadc7..9e95fee78e192 100644
--- a/arch/arm/boot/dts/bcm2837.dtsi
+++ b/arch/arm/boot/dts/bcm2837.dtsi
@@ -1,4 +1,5 @@
 #include "bcm283x.dtsi"
+#include "bcm2835-common.dtsi"
 
 / {
 	compatible = "brcm,bcm2837";
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 65f666e41fa7a..9dcadc4e5d97c 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -55,17 +55,6 @@
 		#address-cells = <1>;
 		#size-cells = <1>;
 
-		timer@7e003000 {
-			compatible = "brcm,bcm2835-system-timer";
-			reg = <0x7e003000 0x1000>;
-			interrupts = <1 0>, <1 1>, <1 2>, <1 3>;
-			/* This could be a reference to BCM2835_CLOCK_TIMER,
-			 * but we don't have the driver using the common clock
-			 * support yet.
-			 */
-			clock-frequency = <1000000>;
-		};
-
 		txp@7e004000 {
 			compatible = "brcm,bcm2835-txp";
 			reg = <0x7e004000 0x20>;
@@ -113,13 +102,6 @@
 			brcm,dma-channel-mask = <0x7f35>;
 		};
 
-		intc: interrupt-controller@7e00b200 {
-			compatible = "brcm,bcm2835-armctrl-ic";
-			reg = <0x7e00b200 0x200>;
-			interrupt-controller;
-			#interrupt-cells = <2>;
-		};
-
 		watchdog@7e100000 {
 			compatible = "brcm,bcm2835-pm", "brcm,bcm2835-pm-wdt";
 			#power-domain-cells = <1>;
@@ -183,8 +165,7 @@
 			interrupt-controller;
 			#interrupt-cells = <2>;
 
-			/* Defines pin muxing groups according to
-			 * BCM2835-ARM-Peripherals.pdf page 102.
+			/* Defines common pin muxing groups
 			 *
 			 * While each pin can have its mux selected
 			 * for various functions individually, some
@@ -262,15 +243,7 @@
 				brcm,pins = <44 45>;
 				brcm,function = <BCM2835_FSEL_ALT2>;
 			};
-			i2c_slave_gpio18: i2c_slave_gpio18 {
-				brcm,pins = <18 19 20 21>;
-				brcm,function = <BCM2835_FSEL_ALT3>;
-			};
 
-			jtag_gpio4: jtag_gpio4 {
-				brcm,pins = <4 5 6 12 13>;
-				brcm,function = <BCM2835_FSEL_ALT5>;
-			};
 			jtag_gpio22: jtag_gpio22 {
 				brcm,pins = <22 23 24 25 26 27>;
 				brcm,function = <BCM2835_FSEL_ALT4>;
@@ -487,14 +460,6 @@
 
 		};
 
-		thermal: thermal@7e212000 {
-			compatible = "brcm,bcm2835-thermal";
-			reg = <0x7e212000 0x8>;
-			clocks = <&clocks BCM2835_CLOCK_TSENS>;
-			#thermal-sensor-cells = <0>;
-			status = "disabled";
-		};
-
 		aux: aux@7e215000 {
 			compatible = "brcm,bcm2835-aux";
 			#clock-cells = <1>;
@@ -660,12 +625,6 @@
 			phy-names = "usb2-phy";
 		};
 
-		v3d: v3d@7ec00000 {
-			compatible = "brcm,bcm2835-v3d";
-			reg = <0x7ec00000 0x1000>;
-			interrupts = <1 10>;
-		};
-
 		vc4: gpu {
 			compatible = "brcm,bcm2835-vc4";
 		};
-- 
GitLab


From 80189f361601aa49bdc116fdad56a54121f675ff Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 29 May 2019 13:54:21 +0100
Subject: [PATCH 0643/1835] ARM: dts: Add bcm2711-rpi-4-b.dts and components

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/Makefile            |   1 +
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 320 ++++++++++++
 arch/arm/boot/dts/bcm2711.dtsi        |  50 ++
 arch/arm/boot/dts/bcm2838.dtsi        | 724 ++++++++++++++++++++++++++
 4 files changed, 1095 insertions(+)
 create mode 100644 arch/arm/boot/dts/bcm2711-rpi-4-b.dts
 create mode 100644 arch/arm/boot/dts/bcm2711.dtsi
 create mode 100644 arch/arm/boot/dts/bcm2838.dtsi

diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 232f95f8fef40..86851cd7147ca 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -8,6 +8,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
 	bcm2708-rpi-zero-w.dtb \
 	bcm2709-rpi-2-b.dtb \
 	bcm2710-rpi-3-b.dtb \
+	bcm2711-rpi-4-b.dtb \
 	bcm2710-rpi-3-b-plus.dtb \
 	bcm2710-rpi-cm3.dtb
 
diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
new file mode 100644
index 0000000000000..87f8fdb7e7e52
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -0,0 +1,320 @@
+/dts-v1/;
+
+#include "bcm2711.dtsi"
+
+/ {
+	compatible = "raspberrypi,4-model-b", "brcm,bcm2838", "brcm,bcm2837";
+	model = "Raspberry Pi 4 Model B";
+	#address-cells = <2>;
+	#size-cells = <1>;
+
+	memory {
+		device_type = "memory";
+		reg = <0x0 0x0 0x0>;
+	};
+
+	chosen {
+		bootargs = "8250.nr_uarts=1 cma=64M";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+		mmc0 = &emmc2;
+		mmc1 = &mmcnr;
+		mmc2 = &sdhost;
+		/delete-property/ ethernet;
+		/delete-property/ intc;
+		ethernet0 = &genet;
+	};
+};
+
+&soc {
+	virtgpio: virtgpio {
+		compatible = "brcm,bcm2835-virtgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&mmcnr {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	bus-width = <4>;
+	status = "okay";
+};
+
+&firmware {
+	expgpio: expgpio {
+		compatible = "raspberrypi,firmware-gpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		status = "okay";
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+// =============================================
+// Board specific stuff here
+
+/ {
+
+	sd_io_1v8_reg: sd_io_1v8_reg {
+		status = "okay";
+		compatible = "regulator-gpio";
+		vin-supply = <&vdd_5v0_reg>;
+		regulator-name = "vdd-sd-io";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+		regulator-settling-time-us = <5000>;
+
+		gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
+		states = <1800000 0x1
+			  3300000 0x0>;
+	};
+};
+
+&sdhost {
+	status = "disabled";
+};
+
+&emmc2 {
+	status = "okay";
+	broken-cd;
+	vqmmc-supply = <&sd_io_1v8_reg>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 42 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&expgpio 2 0>;
+	};
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+&sdhost_gpio48 {
+	brcm,pins = <22 23 24 25 26 27>;
+	brcm,function = <BCM2835_FSEL_ALT0>;
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <BCM2835_FSEL_ALT0>;
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+	};
+
+	spi3_pins: spi3_pins {
+		brcm,pins = <1 2 3>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	spi3_cs_pins: spi3_cs_pins {
+		brcm,pins = <0 24>;
+		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+	};
+
+	spi4_pins: spi4_pins {
+		brcm,pins = <5 6 7>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	spi4_cs_pins: spi4_cs_pins {
+		brcm,pins = <4 25>;
+		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+	};
+
+	spi5_pins: spi5_pins {
+		brcm,pins = <13 14 15>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	spi5_cs_pins: spi5_cs_pins {
+		brcm,pins = <12 26>;
+		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+	};
+
+	spi6_pins: spi6_pins {
+		brcm,pins = <19 20 21>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	spi6_cs_pins: spi6_cs_pins {
+		brcm,pins = <18 27>;
+		brcm,function = <BCM2835_FSEL_GPIO_OUT>;
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <BCM2835_FSEL_ALT0>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <BCM2835_FSEL_ALT0>;
+	};
+
+	i2c3_pins: i2c3 {
+		brcm,pins = <4 5>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+
+	i2c4_pins: i2c4 {
+		brcm,pins = <8 9>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+
+	i2c5_pins: i2c5 {
+		brcm,pins = <12 13>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+
+	i2c6_pins: i2c6 {
+		brcm,pins = <22 23>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <BCM2835_FSEL_ALT0>;
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins =     <34 35 36 37 38 39>;
+		brcm,function = <BCM2835_FSEL_ALT3>; // alt3 = SD1
+		brcm,pull =     <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = "-"; // non-empty to keep btuart happy, //4 = 0
+				 // to fool pinctrl
+		brcm,function = <0>;
+		brcm,pull = <2>;
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <32 33>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+		brcm,pull = <0 2>;
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	uart2_pins: uart2_pins {
+		brcm,pins = <0 1>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <0 2>;
+	};
+
+	uart3_pins: uart3_pins {
+		brcm,pins = <4 5>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <0 2>;
+	};
+
+	uart4_pins: uart4_pins {
+		brcm,pins = <8 9>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <0 2>;
+	};
+
+	uart5_pins: uart5_pins {
+		brcm,pins = <12 13>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <0 2>;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 41>;
+		brcm,function = <4>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
new file mode 100644
index 0000000000000..07711dfe28f03
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2711.dtsi
@@ -0,0 +1,50 @@
+#include "bcm2838.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	soc {
+		/delete-node/ mailbox@7e00b840;
+		/delete-node/ v3d@7ec00000;
+	};
+
+	__overrides__ {
+		arm_freq;
+	};
+};
+
+&dma {
+	brcm,dma-channel-mask = <0x7ef5>;
+};
+
+&txp {
+	interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&firmwarekms {
+	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&smi {
+	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&mmc {
+	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&mmcnr {
+	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&usb {
+	reg = <0x7e980000 0x10000>,
+	      <0x7e00b200 0x200>;
+	interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&gpio {
+	interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
+};
diff --git a/arch/arm/boot/dts/bcm2838.dtsi b/arch/arm/boot/dts/bcm2838.dtsi
new file mode 100644
index 0000000000000..fc0e101bcf082
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2838.dtsi
@@ -0,0 +1,724 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "bcm283x.dtsi"
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/soc/bcm2835-pm.h>
+
+/ {
+	compatible = "brcm,bcm2838", "brcm,bcm2837";
+
+	interrupt-parent = <&gicv2>;
+
+	soc {
+		ranges = <0x7e000000  0x0 0xfe000000  0x01800000>,
+			 <0x7c000000  0x0 0xfc000000  0x02000000>,
+			 <0x40000000  0x0 0xff800000  0x00800000>;
+		/* Emulate a contiguous 30-bit address range for DMA */
+		dma-ranges = <0xc0000000  0x0 0x00000000  0x3c000000>;
+
+		/delete-node/ mailbox@7e00b840;
+		/delete-node/ interrupt-controller@7e00f300;
+
+		local_intc: local_intc@40000000 {
+			compatible = "brcm,bcm2836-l1-intc";
+			reg = <0x40000000 0x100>;
+		};
+
+		gicv2: gic400@40041000 {
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			compatible = "arm,gic-400";
+			reg =	<0x40041000 0x1000>,
+				<0x40042000 0x2000>,
+				<0x40046000 0x2000>,
+				<0x40048000 0x2000>;
+		};
+
+		thermal: thermal@7d5d2200 {
+			compatible = "brcm,avs-tmon-bcm2838";
+			reg = <0x7d5d2200 0x2c>;
+			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "tmon";
+			clocks = <&clocks BCM2835_CLOCK_TSENS>;
+			#thermal-sensor-cells = <0>;
+			status = "okay";
+		};
+
+		pm: watchdog@7e100000 {
+			reg = <0x7e100000 0x114>,
+			      <0x7e00a000 0x24>,
+			      <0x7ec11000 0x20>;
+		};
+
+		rng@7e104000 {
+			interrupts = <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		uart2: serial@7e201400 {
+			compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell";
+			reg = <0x7e201400 0x200>;
+			interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_UART>,
+				 <&clocks BCM2835_CLOCK_VPU>;
+			clock-names = "uartclk", "apb_pclk";
+			arm,primecell-periphid = <0x00241011>;
+			status = "disabled";
+		};
+
+		uart3: serial@7e201600 {
+			compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell";
+			reg = <0x7e201600 0x200>;
+			interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_UART>,
+				 <&clocks BCM2835_CLOCK_VPU>;
+			clock-names = "uartclk", "apb_pclk";
+			arm,primecell-periphid = <0x00241011>;
+			status = "disabled";
+		};
+
+		uart4: serial@7e201800 {
+			compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell";
+			reg = <0x7e201800 0x200>;
+			interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_UART>,
+				 <&clocks BCM2835_CLOCK_VPU>;
+			clock-names = "uartclk", "apb_pclk";
+			arm,primecell-periphid = <0x00241011>;
+			status = "disabled";
+		};
+
+		uart5: serial@7e201a00 {
+			compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell";
+			reg = <0x7e201a00 0x200>;
+			interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_UART>,
+				 <&clocks BCM2835_CLOCK_VPU>;
+			clock-names = "uartclk", "apb_pclk";
+			arm,primecell-periphid = <0x00241011>;
+			status = "disabled";
+		};
+
+		spi@7e204000 {
+			reg = <0x7e204000 0x0200>;
+			interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		spi3: spi@7e204600 {
+			compatible = "brcm,bcm2835-spi";
+			reg = <0x7e204600 0x0200>;
+			interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi4: spi@7e204800 {
+			compatible = "brcm,bcm2835-spi";
+			reg = <0x7e204800 0x0200>;
+			interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi5: spi@7e204a00 {
+			compatible = "brcm,bcm2835-spi";
+			reg = <0x7e204a00 0x0200>;
+			interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		spi6: spi@7e204c00 {
+			compatible = "brcm,bcm2835-spi";
+			reg = <0x7e204c00 0x0200>;
+			interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c3: i2c@7e205600 {
+			compatible = "brcm,bcm2835-i2c";
+			reg = <0x7e205600 0x200>;
+			interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c4: i2c@7e205800 {
+			compatible = "brcm,bcm2835-i2c";
+			reg = <0x7e205800 0x200>;
+			interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c5: i2c@7e205a00 {
+			compatible = "brcm,bcm2835-i2c";
+			reg = <0x7e205a00 0x200>;
+			interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		i2c6: i2c@7e205c00 {
+			compatible = "brcm,bcm2835-i2c";
+			reg = <0x7e205c00 0x200>;
+			interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		pixelvalve@7e206000 {
+			interrupts = <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		pixelvalve@7e207000 {
+			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		emmc2: emmc2@7e340000 {
+			compatible = "brcm,bcm2711-emmc2";
+			status = "okay";
+			interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&clocks BCM2838_CLOCK_EMMC2>;
+			reg = <0x7e340000 0x100>;
+		};
+
+		hvs@7e400000 {
+			interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		pixelvalve@7e807000 {
+			interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+		};
+	};
+
+	arm-pmu {
+		/*
+		 * N.B. the A72 PMU support only exists in arch/arm64, hence
+		 * the fallback to the A53 version.
+		 */
+		compatible = "arm,cortex-a72-pmu", "arm,cortex-a53-pmu";
+		interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
+			<GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+			<GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
+			<GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	timer {
+		compatible = "arm,armv7-timer";
+		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) |
+					  IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) |
+					  IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) |
+					  IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) |
+					  IRQ_TYPE_LEVEL_LOW)>;
+		arm,cpu-registers-not-fw-configured;
+		always-on;
+	};
+
+	cpus: cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit
+
+		cpu0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a72";
+			reg = <0>;
+			enable-method = "spin-table";
+			cpu-release-addr = <0x0 0x000000d8>;
+		};
+
+		cpu1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a72";
+			reg = <1>;
+			enable-method = "spin-table";
+			cpu-release-addr = <0x0 0x000000e0>;
+		};
+
+		cpu2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a72";
+			reg = <2>;
+			enable-method = "spin-table";
+			cpu-release-addr = <0x0 0x000000e8>;
+		};
+
+		cpu3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a72";
+			reg = <3>;
+			enable-method = "spin-table";
+			cpu-release-addr = <0x0 0x000000f0>;
+		};
+	};
+
+	v3dbus {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0x7c500000  0x0 0xfc500000  0x03300000>,
+			 <0x40000000  0x0 0xff800000  0x00800000>;
+		dma-ranges = <0x00000000  0x0 0x00000000  0x3c000000>;
+
+		v3d: v3d@7ec04000 {
+			compatible = "brcm,2711-v3d";
+			reg =
+			    <0x7ec00000 0x4000>,
+			    <0x7ec04000 0x4000>;
+			reg-names = "hub", "core0";
+
+			power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
+			resets = <&pm BCM2835_RESET_V3D>;
+			clocks = <&clocks BCM2835_CLOCK_V3D>;
+			interrupts = <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
+			status = "okay";
+		};
+	};
+
+	scb: scb {
+		compatible = "simple-bus";
+		#address-cells = <2>;
+		#size-cells = <1>;
+
+		ranges = <0x0 0x7c000000  0x0 0xfc000000  0x03800000>,
+			 <0x0 0x40000000  0x0 0xff800000  0x00800000>,
+			 <0x6 0x00000000  0x6 0x00000000  0x40000000>,
+			 <0x0 0x00000000  0x0 0x00000000  0xfc000000>;
+		dma-ranges = <0x0 0x00000000  0x0 0x00000000  0xfc000000>;
+
+		pcie_0: pcie@7d500000 {
+			reg = <0x0 0x7d500000 0x9310>,
+			      <0x0 0x7e00f300 0x20>;
+			msi-controller;
+			msi-parent = <&pcie_0>;
+			#address-cells = <3>;
+			#interrupt-cells = <1>;
+			#size-cells = <2>;
+			bus-range = <0x0 0x01>;
+			compatible = "brcm,bcm7211-pcie", "brcm,bcm7445-pcie",
+				     "brcm,pci-plat-dev";
+			max-link-speed = <2>;
+			tot-num-pcie = <1>;
+			linux,pci-domain = <0>;
+			interrupts = <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>;
+			interrupt-names = "pcie", "msi";
+			interrupt-map-mask = <0x0 0x0 0x0 0x7>;
+			interrupt-map = <0 0 0 1 &gicv2 GIC_SPI 143
+						IRQ_TYPE_LEVEL_HIGH
+					 0 0 0 2 &gicv2 GIC_SPI 144
+						IRQ_TYPE_LEVEL_HIGH
+					 0 0 0 3 &gicv2 GIC_SPI 145
+						IRQ_TYPE_LEVEL_HIGH
+					 0 0 0 4 &gicv2 GIC_SPI 146
+						IRQ_TYPE_LEVEL_HIGH>;
+
+			/* Map outbound accesses from scb:0x6_00000000-03ffffff
+			 * to pci:0x0_f8000000-fbffffff
+			 */
+			ranges = <0x02000000 0x0 0xf8000000  0x6 0x00000000
+				  0x0 0x04000000>;
+			/* Map inbound accesses from pci:0x0_00000000..ffffffff
+			 * to scb:0x0_00000000-ffffffff
+			 */
+			dma-ranges = <0x02000000 0x0 0x00000000  0x0 0x00000000
+				      0x1 0x00000000>;
+			status = "okay";
+		};
+
+		genet: genet@7d580000 {
+			compatible = "brcm,genet-v5";
+			reg = <0x0 0x7d580000 0x10000>;
+			status = "okay";
+			#address-cells = <0x1>;
+			#size-cells = <0x1>;
+			interrupts = <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>,
+				     <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>;
+			phy-handle = <&phy1>;
+			phy-mode = "rgmii";
+			mdio@e14 {
+				#address-cells = <0x0>;
+				#size-cells = <0x1>;
+				compatible = "brcm,genet-mdio-v5";
+				reg = <0xe14 0x8>;
+				reg-names = "mdio";
+				phy1: genet-phy@0 {
+					compatible =
+						"ethernet-phy-ieee802.3-c22";
+					/* No interrupts - use PHY_POLL */
+					max-speed = <1000>;
+					reg = <0x1>;
+				};
+			};
+		};
+
+		xhci: xhci@7e9c0000 {
+			compatible = "generic-xhci";
+			status = "disabled";
+			reg = <0x0 0x7e9c0000 0x100000>;
+			interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		vchiq: mailbox@7e00b840 {
+			compatible = "brcm,bcm2838-vchiq";
+			reg = <0 0x7e00b840 0x3c>;
+			interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		hevc-decoder@7eb00000 {
+			compatible = "raspberrypi,argon-hevc-decoder";
+			reg = <0x0 0x7eb00000 0x10000>;
+			status = "okay";
+		};
+
+		argon-local-intc@7eb10000 {
+			compatible = "raspberrypi,argon-local-intc";
+			reg = <0x0 0x7eb10000 0x1000>;
+			status = "okay";
+			interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
+		};
+
+		h264-decoder@7eb20000 {
+			compatible = "raspberrypi,argon-h264-decoder";
+			reg = <0x0 0x7eb20000 0x10000>;
+			status = "okay";
+		};
+
+		vp9-decoder@7eb30000 {
+			compatible = "raspberrypi,argon-vp9-decoder";
+			reg = <0x0 0x7eb30000 0x10000>;
+			status = "okay";
+		};
+	};
+};
+
+&clk_osc {
+	clock-frequency = <54000000>;
+};
+
+&clocks {
+	compatible = "brcm,bcm2838-cprman";
+};
+
+&cpu_thermal {
+	coefficients = <(-487)  410040>;
+};
+
+&dsi0 {
+	interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&dsi1 {
+	interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&gpio {
+	gpclk0_gpio49: gpclk0_gpio49 {
+		brcm,pins = <49>;
+		brcm,function = <BCM2835_FSEL_ALT1>;
+		brcm,pull = <BCM2835_PUD_OFF>;
+	};
+	gpclk1_gpio50: gpclk1_gpio50 {
+		brcm,pins = <50>;
+		brcm,function = <BCM2835_FSEL_ALT1>;
+		brcm,pull = <BCM2835_PUD_OFF>;
+	};
+	gpclk2_gpio51: gpclk2_gpio51 {
+		brcm,pins = <51>;
+		brcm,function = <BCM2835_FSEL_ALT1>;
+		brcm,pull = <BCM2835_PUD_OFF>;
+	};
+
+	i2c0_gpio46: i2c0_gpio46 {
+		brcm,pins = <46 47>;
+		brcm,function = <BCM2835_FSEL_ALT0>;
+	};
+	i2c1_gpio46: i2c1_gpio46 {
+		brcm,pins = <46 47>;
+		brcm,function = <BCM2835_FSEL_ALT1>;
+	};
+	i2c3_gpio2: i2c3_gpio2 {
+		brcm,pins = <2 3>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c3_gpio4: i2c3_gpio4 {
+		brcm,pins = <4 5>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c4_gpio6: i2c4_gpio6 {
+		brcm,pins = <6 7>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c4_gpio8: i2c4_gpio8 {
+		brcm,pins = <8 9>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c5_gpio10: i2c5_gpio10 {
+		brcm,pins = <10 11>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c5_gpio12: i2c5_gpio12 {
+		brcm,pins = <12 13>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c6_gpio0: i2c6_gpio0 {
+		brcm,pins = <0 1>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c6_gpio22: i2c6_gpio22 {
+		brcm,pins = <22 23>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	i2c_slave_gpio8: i2c_slave_gpio8 {
+		brcm,pins = <8 9 10 11>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	jtag_gpio48: jtag_gpio48 {
+		brcm,pins = <48 49 50 51 52 53>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+	};
+
+	mii_gpio28: mii_gpio28 {
+		brcm,pins = <28 29 30 31>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+	};
+	mii_gpio36: mii_gpio36 {
+		brcm,pins = <36 37 38 39>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+
+	pcm_gpio50: pcm_gpio50 {
+		brcm,pins = <50 51 52 53>;
+		brcm,function = <BCM2835_FSEL_ALT2>;
+	};
+
+	pwm0_gpio52: pwm0_gpio52 {
+		brcm,pins = <52>;
+		brcm,function = <BCM2835_FSEL_ALT1>;
+		brcm,pull = <BCM2835_PUD_OFF>;
+	};
+	pwm1_gpio53: pwm1_gpio53 {
+		brcm,pins = <53>;
+		brcm,function = <BCM2835_FSEL_ALT1>;
+		brcm,pull = <BCM2835_PUD_OFF>;
+	};
+
+	/* The following group consists of:
+         *  RGMII_START_STOP
+         *  RGMII_RX_OK
+         */
+	rgmii_gpio35: rgmii_gpio35 {
+		brcm,pins = <35 36>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+	};
+	rgmii_irq_gpio34: rgmii_irq_gpio34 {
+		brcm,pins = <34>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	rgmii_irq_gpio39: rgmii_irq_gpio39 {
+		brcm,pins = <39>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+	};
+	rgmii_mdio_gpio28: rgmii_mdio_gpio28 {
+		brcm,pins = <28 29>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	rgmii_mdio_gpio37: rgmii_mdio_gpio37 {
+		brcm,pins = <37 38>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+	};
+
+	spi0_gpio46: spi0_gpio46 {
+		brcm,pins = <46 47 48 49>;
+		brcm,function = <BCM2835_FSEL_ALT2>;
+	};
+	spi2_gpio46: spi2_gpio46 {
+		brcm,pins = <46 47 48 49 50>;
+		brcm,function = <BCM2835_FSEL_ALT5>;
+	};
+	spi3_gpio0: spi3_gpio0 {
+		brcm,pins = <0 1 2 3>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+	spi4_gpio4: spi4_gpio4 {
+		brcm,pins = <4 5 6 7>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+	spi5_gpio12: spi5_gpio12 {
+		brcm,pins = <12 13 14 15>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+	spi6_gpio18: spi6_gpio18 {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <BCM2835_FSEL_ALT3>;
+	};
+
+	uart2_gpio0: uart2_gpio0 {
+		brcm,pins = <0 1>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_OFF BCM2835_PUD_UP>;
+	};
+	uart2_ctsrts_gpio2: uart2_ctsrts_gpio2 {
+		brcm,pins = <2 3>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_OFF>;
+	};
+	uart3_gpio4: uart3_gpio4 {
+		brcm,pins = <4 5>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_OFF BCM2835_PUD_UP>;
+	};
+	uart3_ctsrts_gpio6: uart3_ctsrts_gpio6 {
+		brcm,pins = <6 7>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_OFF>;
+	};
+	uart4_gpio8: uart4_gpio8 {
+		brcm,pins = <8 9>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_OFF BCM2835_PUD_UP>;
+	};
+	uart4_ctsrts_gpio10: uart4_ctsrts_gpio10 {
+		brcm,pins = <10 11>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_OFF>;
+	};
+	uart5_gpio12: uart5_gpio12 {
+		brcm,pins = <12 13>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_OFF BCM2835_PUD_UP>;
+	};
+	uart5_ctsrts_gpio14: uart5_ctsrts_gpio14 {
+		brcm,pins = <14 15>;
+		brcm,function = <BCM2835_FSEL_ALT4>;
+		brcm,pull = <BCM2835_PUD_UP BCM2835_PUD_OFF>;
+	};
+};
+
+&vec {
+	interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&usb {
+	interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&hdmi {
+	interrupts = <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&uart1 {
+	interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&spi1 {
+	interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&spi2 {
+	interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&csi0 {
+	interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&csi1 {
+	interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&sdhci {
+	interrupts = <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&i2c0 {
+	interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&i2c1 {
+	interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&i2c2 {
+	interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&gpio {
+	interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>,
+		     <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&mailbox {
+	interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&rng {
+	compatible = "brcm,bcm2838-rng200";
+};
+
+&sdhost {
+	interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&uart0 {
+	interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+};
+
+&dma {
+	interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dmalite  7 */
+		<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dmalite  8 */
+		<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dmalite  9 */
+		<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dmalite 10 */
+		/* DMA4 - 40 bit DMA engines */
+		<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4    11 */
+		<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4    12 */
+		<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>, /* dma4    13 */
+		<GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>; /* dma4    14 */
+	interrupt-names = "dma0",
+			  "dma1",
+			  "dma2",
+			  "dma3",
+			  "dma4",
+			  "dma5",
+			  "dma6",
+			  "dma7",
+			  "dma8",
+			  "dma9",
+			  "dma10",
+			  "dma11",
+			  "dma12",
+			  "dma13",
+			  "dma14";
+	brcm,dma-channel-mask = <0x7ef5>;
+};
-- 
GitLab


From bd7aebbcdce2d5c5cdba3601764799382271606a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 30 May 2019 16:44:24 +0100
Subject: [PATCH 0644/1835] overlays: Add i2c3-6 and uart2-5 overlays

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile          |  8 +++
 arch/arm/boot/dts/overlays/README            | 52 ++++++++++++++++++++
 arch/arm/boot/dts/overlays/i2c3-overlay.dts  | 27 ++++++++++
 arch/arm/boot/dts/overlays/i2c4-overlay.dts  | 27 ++++++++++
 arch/arm/boot/dts/overlays/i2c5-overlay.dts  | 27 ++++++++++
 arch/arm/boot/dts/overlays/i2c6-overlay.dts  | 27 ++++++++++
 arch/arm/boot/dts/overlays/uart2-overlay.dts | 27 ++++++++++
 arch/arm/boot/dts/overlays/uart3-overlay.dts | 27 ++++++++++
 arch/arm/boot/dts/overlays/uart4-overlay.dts | 27 ++++++++++
 arch/arm/boot/dts/overlays/uart5-overlay.dts | 27 ++++++++++
 10 files changed, 276 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/i2c3-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c4-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c5-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c6-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/uart2-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/uart3-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/uart4-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/uart5-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 9aea64b0d325f..e764bab257fa6 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -65,6 +65,10 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	i2c-sensor.dtbo \
 	i2c0-bcm2708.dtbo \
 	i2c1-bcm2708.dtbo \
+	i2c3.dtbo \
+	i2c4.dtbo \
+	i2c5.dtbo \
+	i2c6.dtbo \
 	i2s-gpio28-31.dtbo \
 	ilitek251x.dtbo \
 	iqaudio-codec.dtbo \
@@ -149,6 +153,10 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	tpm-slb9670.dtbo \
 	uart0.dtbo \
 	uart1.dtbo \
+	uart2.dtbo \
+	uart3.dtbo \
+	uart4.dtbo \
+	uart5.dtbo \
 	udrc.dtbo \
 	upstream.dtbo \
 	vc4-fkms-v3d.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index c1863277cafbd..05312474ece69 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1137,6 +1137,34 @@ Params: sda1_pin                GPIO pin for SDA1 (2 or 44 - default 2)
                                 "yes")
 
 
+Name:   i2c3
+Info:   Enable the i2c3 bus
+Load:   dtoverlay=i2c3,<param>
+Params: pins_2_3                Use GPIOs 2 and 3
+        pins_4_5                Use GPIOs 4 and 5 (default)
+
+
+Name:   i2c4
+Info:   Enable the i2c4 bus
+Load:   dtoverlay=i2c4,<param>
+Params: pins_6_7                Use GPIOs 6 and 7
+        pins_8_9                Use GPIOs 8 and 9 (default)
+
+
+Name:   i2c5
+Info:   Enable the i2c5 bus
+Load:   dtoverlay=i2c5,<param>
+Params: pins_10_11              Use GPIOs 10 and 11
+        pins_12_13              Use GPIOs 12 and 13 (default)
+
+
+Name:   i2c6
+Info:   Enable the i2c6 bus
+Load:   dtoverlay=i2c6,<param>
+Params: pins_0_1                Use GPIOs 0 and 1
+        pins_22_23              Use GPIOs 22 and 23 (default)
+
+
 Name:   i2s-gpio28-31
 Info:   move I2S function block to GPIO 28 to 31
 Load:   dtoverlay=i2s-gpio28-31
@@ -2199,6 +2227,30 @@ Params: txd1_pin                GPIO pin for TXD1 (14, 32 or 40 - default 14)
         rxd1_pin                GPIO pin for RXD1 (15, 33 or 41 - default 15)
 
 
+Name:   uart2
+Info:   Enable uart 2 on GPIOs 0-3
+Load:   dtoverlay=uart2,<param>
+Params: ctsrts                  Enable CTS/RTS on GPIOs 2-3 (default off)
+
+
+Name:   uart3
+Info:   Enable uart 3 on GPIOs 4-7
+Load:   dtoverlay=uart3,<param>
+Params: ctsrts                  Enable CTS/RTS on GPIOs 6-7 (default off)
+
+
+Name:   uart4
+Info:   Enable uart 4 on GPIOs 8-11
+Load:   dtoverlay=uart4,<param>
+Params: ctsrts                  Enable CTS/RTS on GPIOs 10-11 (default off)
+
+
+Name:   uart5
+Info:   Enable uart 5 on GPIOs 12-15
+Load:   dtoverlay=uart5,<param>
+Params: ctsrts                  Enable CTS/RTS on GPIOs 14-15 (default off)
+
+
 Name:   udrc
 Info:   Configures the NW Digital Radio UDRC Hat
 Load:   dtoverlay=udrc,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/i2c3-overlay.dts b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
new file mode 100644
index 0000000000000..79d0da0ca6f2a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&i2c3>;
+		__overlay__ {
+			status = "okay";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c3_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c3_pins>;
+		__dormant__ {
+			brcm,pins = <2 3>;
+		};
+	};
+
+	__overrides__ {
+		pins_2_3 = <0>,"=1";
+		pins_4_5 = <0>,"!1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c4-overlay.dts b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
new file mode 100644
index 0000000000000..ffad91763f076
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&i2c4>;
+		__overlay__ {
+			status = "okay";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c4_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c4_pins>;
+		__dormant__ {
+			brcm,pins = <6 7>;
+		};
+	};
+
+	__overrides__ {
+		pins_6_7 = <0>,"=1";
+		pins_8_9 = <0>,"!1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c5-overlay.dts b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
new file mode 100644
index 0000000000000..551ce154f877a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&i2c5>;
+		__overlay__ {
+			status = "okay";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c5_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c5_pins>;
+		__dormant__ {
+			brcm,pins = <10 11>;
+		};
+	};
+
+	__overrides__ {
+		pins_10_11 = <0>,"=1";
+		pins_12_13 = <0>,"!1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c6-overlay.dts b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
new file mode 100644
index 0000000000000..0a67f7da6ac00
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&i2c6>;
+		__overlay__ {
+			status = "okay";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c6_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c6_pins>;
+		__dormant__ {
+			brcm,pins = <0 1>;
+		};
+	};
+
+	__overrides__ {
+		pins_0_1 = <0>,"=1";
+		pins_22_23 = <0>,"!1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart2-overlay.dts b/arch/arm/boot/dts/overlays/uart2-overlay.dts
new file mode 100644
index 0000000000000..d1ed09542058b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart2-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&uart2>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart2_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart2_pins>;
+		__dormant__ {
+			brcm,pins = <0 1 2 3>;
+			brcm,pull = <0 2 2 0>;
+		};
+	};
+
+	__overrides__ {
+		ctsrts = <0>,"=1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart3-overlay.dts b/arch/arm/boot/dts/overlays/uart3-overlay.dts
new file mode 100644
index 0000000000000..28bd2349125a7
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart3-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&uart3>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart3_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart3_pins>;
+		__dormant__ {
+			brcm,pins = <4 5 6 7>;
+			brcm,pull = <0 2 2 0>;
+		};
+	};
+
+	__overrides__ {
+		ctsrts = <0>,"=1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart4-overlay.dts b/arch/arm/boot/dts/overlays/uart4-overlay.dts
new file mode 100644
index 0000000000000..ea253eb200706
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart4-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&uart4>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart4_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart4_pins>;
+		__dormant__ {
+			brcm,pins = <8 9 10 11>;
+			brcm,pull = <0 2 2 0>;
+		};
+	};
+
+	__overrides__ {
+		ctsrts = <0>,"=1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart5-overlay.dts b/arch/arm/boot/dts/overlays/uart5-overlay.dts
new file mode 100644
index 0000000000000..af3fd8410ed6a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart5-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&uart5>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart5_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart5_pins>;
+		__dormant__ {
+			brcm,pins = <12 13 14 15>;
+			brcm,pull = <0 2 2 0>;
+		};
+	};
+
+	__overrides__ {
+		ctsrts = <0>,"=1";
+	};
+};
-- 
GitLab


From 6126f69a9eeca21ae62263f9e8a620c10f4a0549 Mon Sep 17 00:00:00 2001
From: Martin Sperl <kernel@martin.sperl.org>
Date: Sun, 12 May 2019 16:17:08 +0000
Subject: [PATCH 0645/1835] spi: devicetree: add overlays for spi 3 to 6

Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
---
 arch/arm/boot/dts/overlays/Makefile           |   8 ++
 arch/arm/boot/dts/overlays/README             | 104 ++++++++++++++++++
 .../boot/dts/overlays/spi3-1cs-overlay.dts    |  44 ++++++++
 .../boot/dts/overlays/spi3-2cs-overlay.dts    |  56 ++++++++++
 .../boot/dts/overlays/spi4-1cs-overlay.dts    |  44 ++++++++
 .../boot/dts/overlays/spi4-2cs-overlay.dts    |  56 ++++++++++
 .../boot/dts/overlays/spi5-1cs-overlay.dts    |  44 ++++++++
 .../boot/dts/overlays/spi5-2cs-overlay.dts    |  56 ++++++++++
 .../boot/dts/overlays/spi6-1cs-overlay.dts    |  44 ++++++++
 .../boot/dts/overlays/spi6-2cs-overlay.dts    |  56 ++++++++++
 10 files changed, 512 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index e764bab257fa6..c48c47cf32100 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -144,6 +144,14 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	spi2-1cs.dtbo \
 	spi2-2cs.dtbo \
 	spi2-3cs.dtbo \
+	spi3-1cs.dtbo \
+	spi3-2cs.dtbo \
+	spi4-1cs.dtbo \
+	spi4-2cs.dtbo \
+	spi5-1cs.dtbo \
+	spi5-2cs.dtbo \
+	spi6-1cs.dtbo \
+	spi6-2cs.dtbo \
 	ssd1306.dtbo \
 	superaudioboard.dtbo \
 	sx150x.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 05312474ece69..e61a437a31f35 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -2085,6 +2085,110 @@ Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
                                 is 'okay' or enabled).
 
 
+Name:   spi3-1cs
+Info:   Enables spi3 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi3-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 0 - BCM SPI3_CE0).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev3.0 (default
+                                is 'on' or enabled).
+
+
+Name:   spi3-2cs
+Info:   Enables spi3 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi3-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 0 - BCM SPI3_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 24 - BCM SPI3_CE1).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev3.0 (default
+                                is 'on' or enabled).
+        cs1_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev3.1 (default
+                                is 'on' or enabled).
+
+
+Name:   spi4-1cs
+Info:   Enables spi4 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi4-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 4 - BCM SPI4_CE0).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev4.0 (default
+                                is 'on' or enabled).
+
+
+Name:   spi4-2cs
+Info:   Enables spi4 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi4-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 4 - BCM SPI4_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 25 - BCM SPI4_CE1).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev4.0 (default
+                                is 'on' or enabled).
+        cs1_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev4.1 (default
+                                is 'on' or enabled).
+
+
+Name:   spi5-1cs
+Info:   Enables spi5 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi5-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 12 - BCM SPI5_CE0).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev5.0 (default
+                                is 'on' or enabled).
+
+
+Name:   spi5-2cs
+Info:   Enables spi5 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi5-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 12 - BCM SPI5_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 26 - BCM SPI5_CE1).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev5.0 (default
+                                is 'on' or enabled).
+        cs1_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev5.1 (default
+                                is 'on' or enabled).
+
+
+Name:   spi6-1cs
+Info:   Enables spi6 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi6-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI6_CE0).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev6.0 (default
+                                is 'on' or enabled).
+
+
+Name:   spi6-2cs
+Info:   Enables spi6 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+Load:   dtoverlay=spi6-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI6_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 27 - BCM SPI6_CE1).
+        cs0_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev6.0 (default
+                                is 'on' or enabled).
+        cs1_spidev              Set to 'off' to prevent the creation of a
+                                userspace device node /dev/spidev6.1 (default
+                                is 'on' or enabled).
+
+
 Name:   ssd1306
 Info:   Overlay for activation of SSD1306 over I2C OLED display framebuffer.
 Load:   dtoverlay=ssd1306,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
new file mode 100644
index 0000000000000..248426f69fb50
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi3-1cs-overlay.dts
@@ -0,0 +1,44 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi3_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <0>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi3>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
+			cs-gpios = <&gpio 0 1>;
+			status = "okay";
+
+			spidev3_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev3_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
new file mode 100644
index 0000000000000..9aa779420b311
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi3-2cs-overlay.dts
@@ -0,0 +1,56 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi3_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <0 24>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi3>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi3_pins &spi3_cs_pins>;
+			cs-gpios = <&gpio 0 1>, <&gpio 24 1>;
+			status = "okay";
+
+			spidev3_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev3_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&frag0>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev3_0>,"status";
+		cs1_spidev = <&spidev3_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
new file mode 100644
index 0000000000000..af1392f7c9dee
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi4-1cs-overlay.dts
@@ -0,0 +1,44 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi4_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <4>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi4>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
+			cs-gpios = <&gpio 4 1>;
+			status = "okay";
+
+			spidev4_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev4_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
new file mode 100644
index 0000000000000..7af0afc17fc40
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi4-2cs-overlay.dts
@@ -0,0 +1,56 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi4_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <4 25>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi4>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi4_pins &spi4_cs_pins>;
+			cs-gpios = <&gpio 4 1>, <&gpio 25 1>;
+			status = "okay";
+
+			spidev4_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev4_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&frag0>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev4_0>,"status";
+		cs1_spidev = <&spidev4_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
new file mode 100644
index 0000000000000..998dd96a15b0e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi5-1cs-overlay.dts
@@ -0,0 +1,44 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi5_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <12>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi5>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
+			cs-gpios = <&gpio 12 1>;
+			status = "okay";
+
+			spidev5_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev5_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
new file mode 100644
index 0000000000000..94c108140e0b6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi5-2cs-overlay.dts
@@ -0,0 +1,56 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi5_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <12 26>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi5>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi5_pins &spi5_cs_pins>;
+			cs-gpios = <&gpio 12 1>, <&gpio 26 1>;
+			status = "okay";
+
+			spidev5_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev5_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&frag0>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev5_0>,"status";
+		cs1_spidev = <&spidev5_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
new file mode 100644
index 0000000000000..30564eeba22a8
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi6-1cs-overlay.dts
@@ -0,0 +1,44 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi6_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <18>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi6>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
+			cs-gpios = <&gpio 18 1>;
+			status = "okay";
+
+			spidev6_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev6_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
new file mode 100644
index 0000000000000..c57b2802c83e5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi6-2cs-overlay.dts
@@ -0,0 +1,56 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2838";
+
+	fragment@0 {
+		target = <&spi6_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <18 27>;
+			brcm,function = <1>; /* output */
+		};
+	};
+
+	fragment@1 {
+		target = <&spi6>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pinctrl-names = "default";
+		        pinctrl-0 = <&spi6_pins &spi6_cs_pins>;
+			cs-gpios = <&gpio 18 1>, <&gpio 27 1>;
+			status = "okay";
+
+			spidev6_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev6_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&frag0>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev6_0>,"status";
+		cs1_spidev = <&spidev6_1>,"status";
+	};
+};
-- 
GitLab


From eb1e277adec199402616b3501b4906799b26233b Mon Sep 17 00:00:00 2001
From: Tim Gover <tim.gover@raspberrypi.org>
Date: Tue, 22 Jan 2019 10:49:41 +0000
Subject: [PATCH 0646/1835] overlays: Add the spi-gpio40-45 overlay

The 2711 B0 boot EEPROM is programmed via SPI0 on GPIO
pins 40-43 CS0. Add a device tree overlay to optionally
change the SPI0 pinmux from the external GPIO pins to
the boot EEPROM pins.
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  6 ++++
 .../dts/overlays/spi-gpio40-45-overlay.dts    | 36 +++++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index c48c47cf32100..2faeb1145125d 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -135,6 +135,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	smi-dev.dtbo \
 	smi-nand.dtbo \
 	spi-gpio35-39.dtbo \
+	spi-gpio40-45.dtbo \
 	spi-rtc.dtbo \
 	spi0-cs.dtbo \
 	spi0-hw-cs.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index e61a437a31f35..0c108669311a2 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1967,6 +1967,12 @@ Load:   dtoverlay=spi-gpio35-39
 Params: <None>
 
 
+Name:   spi-gpio40-45
+Info:   Move SPI function block to GPIOs 40 to 45
+Load:   dtoverlay=spi-gpio40-45
+Params: <None>
+
+
 Name:   spi-rtc
 Info:   Adds support for a number of SPI Real Time Clock devices
 Load:   dtoverlay=spi-rtc,<param>=<val>
diff --git a/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
new file mode 100644
index 0000000000000..9ebcaf1b5ea07
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi-gpio40-45-overlay.dts
@@ -0,0 +1,36 @@
+/*
+ * Boot EEPROM overlay
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0_cs_pins>;
+		__overlay__ {
+			brcm,pins = <45 44 43>;
+			brcm,function = <1>; /* output */
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0_pins>;
+		__overlay__ {
+			brcm,pins = <40 41 42>;
+			brcm,function = <3>; /* alt4 */
+			status = "okay";
+		};
+	};
+};
-- 
GitLab


From 573709bd28b113fa836217c24f49224eb1208db5 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 4 Sep 2018 11:50:25 +0100
Subject: [PATCH 0647/1835] config: Permit LPAE and PCIE_BRCMSTB on BCM2835

---
 arch/arm/mach-bcm/Kconfig      | 4 ++++
 drivers/pci/controller/Kconfig | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig
index e85de844f98ee..1b27b7336f592 100644
--- a/arch/arm/mach-bcm/Kconfig
+++ b/arch/arm/mach-bcm/Kconfig
@@ -161,6 +161,7 @@ config ARCH_BCM2835
 	select GPIOLIB
 	select ARM_AMBA
 	select ARM_ERRATA_411920 if ARCH_MULTI_V6
+	select ARM_GIC
 	select ARM_TIMER_SP804
 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
 	select TIMER_OF
@@ -169,6 +170,9 @@ config ARCH_BCM2835
 	select PINCTRL
 	select PINCTRL_BCM2835
 	select MFD_SYSCON if ARCH_MULTI_V7
+	select ARCH_DMA_ADDR_T_64BIT if ARM_LPAE
+	select ZONE_DMA if ARM_LPAE
+	select MFD_CORE
 	help
 	  This enables support for the Broadcom BCM2835 and BCM2836 SoCs.
 	  This SoC is used in the Raspberry Pi and Roku 2 devices.
diff --git a/drivers/pci/controller/Kconfig b/drivers/pci/controller/Kconfig
index 9c47c5be22719..fa3d69ce65be9 100644
--- a/drivers/pci/controller/Kconfig
+++ b/drivers/pci/controller/Kconfig
@@ -280,9 +280,9 @@ config VMD
 
 config PCIE_BRCMSTB
 	tristate "Broadcom Brcmstb PCIe platform host driver"
-	depends on ARCH_BRCMSTB || BMIPS_GENERIC
+	depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM2835
 	depends on OF
-	depends on SOC_BRCMSTB
+	depends on SOC_BRCMSTB || ARCH_BCM2835
 	default ARCH_BRCMSTB || BMIPS_GENERIC
 	help
 	  Adds support for Broadcom Settop Box PCIe host controller.
-- 
GitLab


From e879019c1947beceea2b37fd58656daa8ece9d4e Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 29 May 2019 15:40:21 +0100
Subject: [PATCH 0648/1835] configs: Add bcm2711_defconfig

---
 arch/arm/configs/bcm2711_defconfig | 1330 ++++++++++++++++++++++++++++
 1 file changed, 1330 insertions(+)
 create mode 100644 arch/arm/configs/bcm2711_defconfig

diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
new file mode 100644
index 0000000000000..e520e16eaf89d
--- /dev/null
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -0,0 +1,1330 @@
+CONFIG_LOCALVERSION="-v7l"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_GENERIC_IRQ_DEBUGFS=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT_VOLUNTARY=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_ARM_LPAE=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_PCI=y
+CONFIG_PCI_MSI=y
+CONFIG_PCIE_BRCMSTB=y
+CONFIG_SMP=y
+CONFIG_HIGHMEM=y
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_SECCOMP=y
+# CONFIG_ATAGS is not set
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=m
+CONFIG_CRYPTO_AES_ARM=m
+CONFIG_CRYPTO_AES_ARM_BS=m
+CONFIG_OPROFILE=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_BINFMT_MISC=m
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_NET_SCH_HHF=m
+CONFIG_NET_SCH_PIE=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_SLCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_GS_USB=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_SPI_NOR=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_BCMGENET=y
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_BROADCOM_PHY=y
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_BRCMDBG=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_PSXPAD_SPI=m
+CONFIG_JOYSTICK_PSXPAD_SPI_FF=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EXC3000=m
+CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM_VC_SM=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+CONFIG_ARGON_MEM=m
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_ROBOTFUZZ_OSIF=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_SLAVE=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_PINCTRL_MCP23S08=m
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_GAUGE_LTC2941=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_JC42=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_RPI_POE_FAN=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHT3x=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_ADS1015=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_SENSORS_TMP102=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_BRCMSTB_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=m
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=m
+CONFIG_REGULATOR_ARIZONA_LDO1=m
+CONFIG_REGULATOR_ARIZONA_MICSUPP=m
+CONFIG_REGULATOR_GPIO=y
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_VIDEO_BCM2835_UNICAM=m
+CONFIG_RADIO_SI470X=m
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_ADV7180=m
+CONFIG_VIDEO_TC358743=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV5647=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_V3D=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_MI0283QT=m
+CONFIG_TINYDRM_REPAPER=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SIMPLE=y
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_USB_HIFACE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS=m
+CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
+CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
+CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_ADAU7002=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_ASUS=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_UAS=y
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_CONFIGFS=m
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_LB_SS=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_USB_CONFIGFS_F_UAC1=y
+CONFIG_USB_CONFIGFS_F_UAC2=y
+CONFIG_USB_CONFIGFS_F_MIDI=y
+CONFIG_USB_CONFIGFS_F_HID=y
+CONFIG_USB_CONFIGFS_F_UVC=y
+CONFIG_USB_CONFIGFS_F_PRINTER=y
+CONFIG_USB_ZERO=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_ETH=m
+CONFIG_USB_GADGETFS=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_G_ACM_MS=m
+CONFIG_USB_G_MULTI=m
+CONFIG_USB_G_HID=m
+CONFIG_USB_G_WEBCAM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_SPI=m
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_ST7789V=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_BCM2835_VCHIQ=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_VIDEO_CODEC_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_BCM2835_POWER=y
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HDC100X=m
+CONFIG_HTU21=m
+CONFIG_TSL4531=m
+CONFIG_VEML6070=m
+CONFIG_BMP280=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_GENERIC_PHY=y
+CONFIG_RPI_AXIPERF=m
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_NFS_V4_1=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+# CONFIG_CRYPTO_HW is not set
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_RCU_TRACE is not set
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+# CONFIG_UPROBE_EVENTS is not set
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
-- 
GitLab


From cdb78ce891f6c6367a69c0a46b5779a58164bd4b Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 8 Mar 2019 21:12:39 +0000
Subject: [PATCH 0649/1835] 2711: Add basic 64-bit support

This commit adds initial support for 64-bit 2711 builds. However,
it will only work as much as it does if the Pi4 RAM is limited to
1GB - more than that and several things break (SD card, coherent
allocations, etc.)

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm64/boot/dts/broadcom/Makefile         |    1 +
 .../boot/dts/broadcom/bcm2711-rpi-4-b.dts     |    3 +
 arch/arm64/configs/bcm2711_defconfig          | 1291 +++++++++++++++++
 3 files changed, 1295 insertions(+)
 create mode 100644 arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts
 create mode 100644 arch/arm64/configs/bcm2711_defconfig

diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
index c8aae4a79102d..33c8e599c1d78 100644
--- a/arch/arm64/boot/dts/broadcom/Makefile
+++ b/arch/arm64/boot/dts/broadcom/Makefile
@@ -3,6 +3,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += bcm2837-rpi-3-b.dtb \
 			      bcm2837-rpi-3-b-plus.dtb
 dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-3-b.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb
+dtb-$(CONFIG_ARCH_BCM2835) += bcm2711-rpi-4-b.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b-plus.dtb
 dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-cm3.dtb
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-cm3.dtb
diff --git a/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts
new file mode 100644
index 0000000000000..1fd86f81f5426
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2711-rpi-4-b.dts
@@ -0,0 +1,3 @@
+#define RPI364
+
+#include "../../../../arm/boot/dts/bcm2711-rpi-4-b.dts"
diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
new file mode 100644
index 0000000000000..493ddc9211f24
--- /dev/null
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -0,0 +1,1291 @@
+CONFIG_LOCALVERSION="-v8"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_GENERIC_IRQ_DEBUGFS=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_PCI=y
+CONFIG_PCIE_BRCMSTB=y
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+CONFIG_SECCOMP=y
+CONFIG_ARMV8_DEPRECATED=y
+CONFIG_SWP_EMULATION=y
+CONFIG_CP15_BARRIER_EMULATION=y
+CONFIG_SETEND_EMULATION=y
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_COMPAT=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_CPU_IDLE=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_BINFMT_MISC=m
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_NET_SCH_HHF=m
+CONFIG_NET_SCH_PIE=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_SLCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_GS_USB=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_SPI_NOR=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_BCMGENET=y
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_BROADCOM_PHY=y
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_BRCMDBG=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_PSXPAD_SPI=m
+CONFIG_JOYSTICK_PSXPAD_SPI_FF=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EXC3000=m
+CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_BCM2835_SMI_DEV is not set
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+# CONFIG_HW_RANDOM_BCM2835 is not set
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_ROBOTFUZZ_OSIF=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_SLAVE=y
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_PINCTRL_MCP23S08=m
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_GAUGE_LTC2941=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_JC42=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHT3x=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_ADS1015=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_SENSORS_TMP102=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=m
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=m
+CONFIG_REGULATOR_ARIZONA_LDO1=m
+CONFIG_REGULATOR_ARIZONA_MICSUPP=m
+CONFIG_REGULATOR_GPIO=y
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=m
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_MI0283QT=m
+CONFIG_TINYDRM_REPAPER=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_USB_HIFACE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS=m
+CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
+CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
+CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_ADAU7002=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_ASUS=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_ETH=m
+CONFIG_USB_GADGETFS=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_G_ACM_MS=m
+CONFIG_USB_G_MULTI=m
+CONFIG_USB_G_HID=m
+CONFIG_USB_G_WEBCAM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI_BCM2711=y
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=m
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_ST7789V=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HDC100X=m
+CONFIG_HTU21=m
+CONFIG_TSL4531=m
+CONFIG_VEML6070=m
+CONFIG_BMP280=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_GENERIC_PHY=y
+CONFIG_RPI_AXIPERF=m
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_NFS_V4_1=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
-- 
GitLab


From 7efddf10e9f7222148ad07f8d41e1ff364f833c3 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 3 Jun 2019 14:57:56 +0100
Subject: [PATCH 0650/1835] config: Add NF_TABLES support

---
 arch/arm/configs/bcm2711_defconfig | 48 ++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index e520e16eaf89d..153f74cbc99c1 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -133,6 +133,36 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_CT_NETLINK=m
+CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_NUMGEN=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_FLOW_OFFLOAD=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_OBJREF=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_QUOTA=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_TPROXY=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_FIB_NETDEV=m
+CONFIG_NF_FLOW_TABLE_INET=m
+CONFIG_NF_FLOW_TABLE=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -220,6 +250,14 @@ CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_DUP_IPV4=m
+CONFIG_NFT_FIB_IPV4=m
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NF_FLOW_TABLE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NFT_MASQ_IPV4=m
+CONFIG_NFT_REDIR_IPV4=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -239,6 +277,13 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_NFT_MASQ_IPV6=m
+CONFIG_NFT_REDIR_IPV6=m
+CONFIG_NFT_DUP_IPV6=m
+CONFIG_NFT_FIB_IPV6=m
+CONFIG_NF_FLOW_TABLE_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -257,6 +302,9 @@ CONFIG_IP6_NF_RAW=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_NFT_BRIDGE_REJECT=m
+CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
 CONFIG_BRIDGE_EBT_BROUTE=m
 CONFIG_BRIDGE_EBT_T_FILTER=m
-- 
GitLab


From 670a4f406a0ef6b26a50454df78ed54ce7bb96d8 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Mon, 3 Jun 2019 15:33:02 +0100
Subject: [PATCH 0651/1835] bcm2711_defconfig: add xhci platform support

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 arch/arm/configs/bcm2711_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 153f74cbc99c1..706a2cad83b65 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -983,6 +983,7 @@ CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=m
 CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
 CONFIG_USB_DWCOTG=y
 CONFIG_USB_PRINTER=m
 CONFIG_USB_STORAGE=y
-- 
GitLab


From 8a17ffd878f51dae2197be2ecb97ba6bf9613d2c Mon Sep 17 00:00:00 2001
From: 6by9 <6by9@users.noreply.github.com>
Date: Wed, 30 Jan 2019 14:22:03 +0000
Subject: [PATCH 0652/1835] ARM: dts: bcm283x: Correct vchiq compatible string
 (#2840)

commit 499770ede3f829e80539f46b59b5f460dc327aa6 upstream.

To allow VCHIQ to determine the correct cache line size, use the new
"brcm,bcm2836-vchiq" compatible string on BCM2836 and BCM2837.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 arch/arm/boot/dts/bcm2835-rpi.dtsi         | 2 +-
 arch/arm/boot/dts/bcm2836-rpi-2-b.dts      | 2 +-
 arch/arm/boot/dts/bcm2836-rpi.dtsi         | 6 ++++++
 arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +-
 arch/arm/boot/dts/bcm2837-rpi-3-b.dts      | 2 +-
 5 files changed, 10 insertions(+), 4 deletions(-)
 create mode 100644 arch/arm/boot/dts/bcm2836-rpi.dtsi

diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index 55292af820e4d..f3d7474159279 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -30,7 +30,7 @@
 			#power-domain-cells = <1>;
 		};
 
-		mailbox@7e00b840 {
+		vchiq: mailbox@7e00b840 {
 			compatible = "brcm,bcm2835-vchiq";
 			reg = <0x7e00b840 0x3c>;
 			interrupts = <0 2>;
diff --git a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
index 3c6d475656eae..8dbecffbd1109 100644
--- a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
+++ b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /dts-v1/;
 #include "bcm2836.dtsi"
-#include "bcm2835-rpi.dtsi"
+#include "bcm2836-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
diff --git a/arch/arm/boot/dts/bcm2836-rpi.dtsi b/arch/arm/boot/dts/bcm2836-rpi.dtsi
new file mode 100644
index 0000000000000..c4c858b984c6b
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2836-rpi.dtsi
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "bcm2835-rpi.dtsi"
+
+&vchiq {
+	compatible = "brcm,bcm2836-vchiq", "brcm,bcm2835-vchiq";
+};
diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
index 93762244be7f4..42bb09044cc79 100644
--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /dts-v1/;
 #include "bcm2837.dtsi"
-#include "bcm2835-rpi.dtsi"
+#include "bcm2836-rpi.dtsi"
 #include "bcm283x-rpi-lan7515.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
index e34e90d46a44d..ae968ebf95af8 100644
--- a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /dts-v1/;
 #include "bcm2837.dtsi"
-#include "bcm2835-rpi.dtsi"
+#include "bcm2836-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-usb-host.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
-- 
GitLab


From e86d604656da910e721adfc81d5a97e719570a8c Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 6 Feb 2019 20:45:16 +0000
Subject: [PATCH 0653/1835] arm: dts: Change downstream vchiq compatible string

The new cache line size mechanism requires a different vchiq compatible
string on BCM2836 and BCM2837, but the downstream dts files didn't
inherit the upstream changes.

See: https://github.com/raspberrypi/linux/issues/2643

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2708-rpi.dtsi | 2 +-
 arch/arm/boot/dts/bcm2709-rpi.dtsi | 5 +++++
 arch/arm/boot/dts/bcm2709.dtsi     | 2 +-
 arch/arm/boot/dts/bcm2710.dtsi     | 2 +-
 4 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 arch/arm/boot/dts/bcm2709-rpi.dtsi

diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index 0cce7d1b99d32..57958c642381c 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -68,7 +68,7 @@
 			status = "disabled";
 		};
 
-		mailbox@7e00b840 {
+		vchiq: mailbox@7e00b840 {
 			compatible = "brcm,bcm2835-vchiq";
 			reg = <0x7e00b840 0x3c>;
 			interrupts = <0 2>;
diff --git a/arch/arm/boot/dts/bcm2709-rpi.dtsi b/arch/arm/boot/dts/bcm2709-rpi.dtsi
new file mode 100644
index 0000000000000..babfa41cd9f78
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2709-rpi.dtsi
@@ -0,0 +1,5 @@
+#include "bcm2708-rpi.dtsi"
+
+&vchiq {
+	compatible = "brcm,bcm2836-vchiq", "brcm,bcm2835-vchiq";
+};
diff --git a/arch/arm/boot/dts/bcm2709.dtsi b/arch/arm/boot/dts/bcm2709.dtsi
index 715f5aca753e5..9354bcc26cd84 100644
--- a/arch/arm/boot/dts/bcm2709.dtsi
+++ b/arch/arm/boot/dts/bcm2709.dtsi
@@ -1,6 +1,6 @@
 #include "bcm2836.dtsi"
 #include "bcm270x.dtsi"
-#include "bcm2708-rpi.dtsi"
+#include "bcm2709-rpi.dtsi"
 
 / {
 	soc {
diff --git a/arch/arm/boot/dts/bcm2710.dtsi b/arch/arm/boot/dts/bcm2710.dtsi
index 7628ca59f0286..fda5d26c68447 100644
--- a/arch/arm/boot/dts/bcm2710.dtsi
+++ b/arch/arm/boot/dts/bcm2710.dtsi
@@ -1,6 +1,6 @@
 #include "bcm2837.dtsi"
 #include "bcm270x.dtsi"
-#include "bcm2708-rpi.dtsi"
+#include "bcm2709-rpi.dtsi"
 
 / {
 	compatible = "brcm,bcm2837", "brcm,bcm2836";
-- 
GitLab


From 21d6aac43a0919aba1bc98edf89949c227259b31 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 4 Apr 2019 13:33:47 +0100
Subject: [PATCH 0654/1835] bcm2835-dma: Add proper 40-bit DMA support

The 40-bit additions are not fully tested, but it should be
capable of supporting both 40-bit memcpy on BCM2711 and regular
Lite channels on BCM2835.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2838.dtsi               |  33 +-
 drivers/dma/bcm2835-dma.c                    | 426 ++++++++++++++-----
 drivers/pci/controller/pcie-brcmstb-bounce.c |  30 +-
 drivers/pci/controller/pcie-brcmstb-bounce.h |  21 +-
 drivers/pci/controller/pcie-brcmstb.c        |  23 +-
 5 files changed, 395 insertions(+), 138 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2838.dtsi b/arch/arm/boot/dts/bcm2838.dtsi
index fc0e101bcf082..0cbe998a67d6e 100644
--- a/arch/arm/boot/dts/bcm2838.dtsi
+++ b/arch/arm/boot/dts/bcm2838.dtsi
@@ -372,6 +372,23 @@
 			};
 		};
 
+		dma40: dma@7e007b00 {
+			compatible = "brcm,bcm2838-dma";
+			reg = <0x0 0x7e007b00 0x400>;
+			interrupts =
+				<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4 11 */
+				<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4 12 */
+				<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>, /* dma4 13 */
+				<GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>; /* dma4 14 */
+			interrupt-names = "dma11",
+				"dma12",
+				"dma13",
+				"dma14";
+			#dma-cells = <1>;
+			brcm,dma-channel-mask = <0x7000>;
+		};
+		/* DMA4 - 40 bit DMA engines */
+
 		xhci: xhci@7e9c0000 {
 			compatible = "generic-xhci";
 			status = "disabled";
@@ -689,6 +706,7 @@
 };
 
 &dma {
+	reg = <0x7e007000 0xb00>;
 	interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
 		<GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>,
 		<GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
@@ -699,12 +717,7 @@
 		<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dmalite  7 */
 		<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>, /* dmalite  8 */
 		<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dmalite  9 */
-		<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>, /* dmalite 10 */
-		/* DMA4 - 40 bit DMA engines */
-		<GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>, /* dma4    11 */
-		<GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>, /* dma4    12 */
-		<GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>, /* dma4    13 */
-		<GIC_SPI 92 IRQ_TYPE_LEVEL_HIGH>; /* dma4    14 */
+		<GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>; /* dmalite 10 */
 	interrupt-names = "dma0",
 			  "dma1",
 			  "dma2",
@@ -715,10 +728,6 @@
 			  "dma7",
 			  "dma8",
 			  "dma9",
-			  "dma10",
-			  "dma11",
-			  "dma12",
-			  "dma13",
-			  "dma14";
-	brcm,dma-channel-mask = <0x7ef5>;
+			  "dma10";
+	brcm,dma-channel-mask = <0x01f5>;
 };
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 2514e9f3ffaeb..11904dabdad69 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -50,12 +50,18 @@
 #define BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED 14
 #define BCM2835_DMA_CHAN_NAME_SIZE 8
 #define BCM2835_DMA_BULK_MASK  BIT(0)
+#define BCM2838_DMA_MEMCPY_CHAN 14
+
+struct bcm2835_dma_cfg_data {
+	u32	chan_40bit_mask;
+};
 
 struct bcm2835_dmadev {
 	struct dma_device ddev;
 	spinlock_t lock;
 	void __iomem *base;
 	struct device_dma_parameters dma_parms;
+	const struct bcm2835_dma_cfg_data *cfg_data;
 };
 
 struct bcm2835_dma_cb {
@@ -100,6 +106,7 @@ struct bcm2835_chan {
 	unsigned int irq_flags;
 
 	bool is_lite_channel;
+	bool is_40bit_channel;
 };
 
 struct bcm2835_desc {
@@ -189,7 +196,8 @@ struct bcm2835_desc {
 #define BCM2835_DMA_DATA_TYPE_S128	16
 
 /* Valid only for channels 0 - 14, 15 has its own base address */
-#define BCM2835_DMA_CHAN(n)	((n) << 8) /* Base address */
+#define BCM2835_DMA_CHAN_SIZE	0x100
+#define BCM2835_DMA_CHAN(n)	((n) * BCM2835_DMA_CHAN_SIZE) /* Base address */
 #define BCM2835_DMA_CHANIO(base, n) ((base) + BCM2835_DMA_CHAN(n))
 
 /* the max dma length for different channels */
@@ -200,7 +208,7 @@ struct bcm2835_desc {
 #define BCM2838_DMA40_CS	0x00
 #define BCM2838_DMA40_CB	0x04
 #define BCM2838_DMA40_DEBUG	0x0c
-#define BCM2858_DMA40_TI	0x10
+#define BCM2838_DMA40_TI	0x10
 #define BCM2838_DMA40_SRC	0x14
 #define BCM2838_DMA40_SRCI	0x18
 #define BCM2838_DMA40_DEST	0x1c
@@ -209,32 +217,97 @@ struct bcm2835_desc {
 #define BCM2838_DMA40_NEXT_CB	0x28
 #define BCM2838_DMA40_DEBUG2	0x2c
 
-#define BCM2838_DMA40_CS_ACTIVE	BIT(0)
-#define BCM2838_DMA40_CS_END	BIT(1)
+#define BCM2838_DMA40_ACTIVE		BIT(0)
+#define BCM2838_DMA40_END		BIT(1)
+#define BCM2838_DMA40_INT		BIT(2)
+#define BCM2838_DMA40_DREQ		BIT(3)  /* DREQ state */
+#define BCM2838_DMA40_RD_PAUSED		BIT(4)  /* Reading is paused */
+#define BCM2838_DMA40_WR_PAUSED		BIT(5)  /* Writing is paused */
+#define BCM2838_DMA40_DREQ_PAUSED	BIT(6)  /* Is paused by DREQ flow control */
+#define BCM2838_DMA40_WAITING_FOR_WRITES BIT(7)  /* Waiting for last write */
+#define BCM2838_DMA40_ERR		BIT(10)
+#define BCM2838_DMA40_QOS(x)		(((x) & 0x1f) << 16)
+#define BCM2838_DMA40_PANIC_QOS(x)	(((x) & 0x1f) << 20)
+#define BCM2838_DMA40_WAIT_FOR_WRITES	BIT(28)
+#define BCM2838_DMA40_DISDEBUG		BIT(29)
+#define BCM2838_DMA40_ABORT		BIT(30)
+#define BCM2838_DMA40_HALT		BIT(31)
+#define BCM2838_DMA40_CS_FLAGS(x) (x & (BCM2838_DMA40_QOS(15) | \
+					BCM2838_DMA40_PANIC_QOS(15) | \
+					BCM2838_DMA40_WAIT_FOR_WRITES |	\
+					BCM2838_DMA40_DISDEBUG))
+
+/* Transfer information bits */
+#define BCM2838_DMA40_INTEN		BIT(0)
+#define BCM2838_DMA40_TDMODE		BIT(1) /* 2D-Mode */
+#define BCM2838_DMA40_WAIT_RESP		BIT(2) /* wait for AXI write to be acked */
+#define BCM2838_DMA40_WAIT_RD_RESP	BIT(3) /* wait for AXI read to complete */
+#define BCM2838_DMA40_PER_MAP(x)	((x & 31) << 9) /* REQ source */
+#define BCM2838_DMA40_S_DREQ		BIT(14) /* enable SREQ for source */
+#define BCM2838_DMA40_D_DREQ		BIT(15) /* enable DREQ for destination */
+#define BCM2838_DMA40_S_WAIT(x)		((x & 0xff) << 16) /* add DMA read-wait cycles */
+#define BCM2838_DMA40_D_WAIT(x)		((x & 0xff) << 24) /* add DMA write-wait cycles */
 
-#define BCM2838_DMA40_CS_QOS(x)	(((x) & 0x1f) << 16)
-#define BCM2838_DMA40_CS_PANIC_QOS(x)	(((x) & 0x1f) << 20)
-#define BCM2838_DMA40_CS_WRITE_WAIT	BIT(28)
+/* debug register bits */
+#define BCM2838_DMA40_DEBUG_WRITE_ERR		BIT(0)
+#define BCM2838_DMA40_DEBUG_FIFO_ERR		BIT(1)
+#define BCM2838_DMA40_DEBUG_READ_ERR		BIT(2)
+#define BCM2838_DMA40_DEBUG_READ_CB_ERR		BIT(3)
+#define BCM2838_DMA40_DEBUG_IN_ON_ERR		BIT(8)
+#define BCM2838_DMA40_DEBUG_ABORT_ON_ERR	BIT(9)
+#define BCM2838_DMA40_DEBUG_HALT_ON_ERR		BIT(10)
+#define BCM2838_DMA40_DEBUG_DISABLE_CLK_GATE	BIT(11)
+#define BCM2838_DMA40_DEBUG_RSTATE_SHIFT	14
+#define BCM2838_DMA40_DEBUG_RSTATE_BITS		4
+#define BCM2838_DMA40_DEBUG_WSTATE_SHIFT	18
+#define BCM2838_DMA40_DEBUG_WSTATE_BITS		4
+#define BCM2838_DMA40_DEBUG_RESET		BIT(23)
+#define BCM2838_DMA40_DEBUG_ID_SHIFT		24
+#define BCM2838_DMA40_DEBUG_ID_BITS		4
+#define BCM2838_DMA40_DEBUG_VERSION_SHIFT	28
+#define BCM2838_DMA40_DEBUG_VERSION_BITS	4
+
+/* Valid only for channels 0 - 3 (11 - 14) */
+#define BCM2838_DMA40_CHAN(n)	(((n) + 11) << 8) /* Base address */
+#define BCM2838_DMA40_CHANIO(base, n) ((base) + BCM2838_DMA_CHAN(n))
 
-#define BCM2838_DMA40_BURST_LEN(x)	((((x) - 1) & 0xf) << 8)
-#define BCM2838_DMA40_INC		BIT(12)
-#define BCM2838_DMA40_SIZE_128	(2 << 13)
+/* the max dma length for different channels */
+#define MAX_DMA40_LEN SZ_1G
 
-#define BCM2838_DMA40_MEMCPY_QOS \
-	(BCM2838_DMA40_CS_QOS(0x0) | \
-	 BCM2838_DMA40_CS_PANIC_QOS(0x0) | \
-	 BCM2838_DMA40_CS_WRITE_WAIT)
+#define BCM2838_DMA40_BURST_LEN(x)	((min(x,16) - 1) << 8)
+#define BCM2838_DMA40_INC		BIT(12)
+#define BCM2838_DMA40_SIZE_32		(0 << 13)
+#define BCM2838_DMA40_SIZE_64		(1 << 13)
+#define BCM2838_DMA40_SIZE_128		(2 << 13)
+#define BCM2838_DMA40_SIZE_256		(3 << 13)
+#define BCM2838_DMA40_IGNORE		BIT(15)
+#define BCM2838_DMA40_STRIDE(x)		((x) << 16) /* For 2D mode */
+
+#define BCM2838_DMA40_MEMCPY_FLAGS \
+	(BCM2838_DMA40_QOS(0) | \
+	 BCM2838_DMA40_PANIC_QOS(0) | \
+	 BCM2838_DMA40_WAIT_FOR_WRITES | \
+	 BCM2838_DMA40_DISDEBUG)
 
 #define BCM2838_DMA40_MEMCPY_XFER_INFO \
 	(BCM2838_DMA40_SIZE_128 | \
 	 BCM2838_DMA40_INC | \
 	 BCM2838_DMA40_BURST_LEN(16))
 
+struct bcm2835_dmadev *memcpy_parent;
 static void __iomem *memcpy_chan;
 static struct bcm2838_dma40_scb *memcpy_scb;
 static dma_addr_t memcpy_scb_dma;
 DEFINE_SPINLOCK(memcpy_lock);
 
+static const struct bcm2835_dma_cfg_data bcm2835_dma_cfg = {
+	.chan_40bit_mask = 0,
+};
+
+static const struct bcm2835_dma_cfg_data bcm2838_dma_cfg = {
+	.chan_40bit_mask = BIT(11) | BIT(12) | BIT(13) | BIT(14),
+};
+
 static inline size_t bcm2835_dma_max_frame_length(struct bcm2835_chan *c)
 {
 	/* lite and normal channels have different max frame length */
@@ -264,6 +337,32 @@ static inline struct bcm2835_desc *to_bcm2835_dma_desc(
 	return container_of(t, struct bcm2835_desc, vd.tx);
 }
 
+static inline uint32_t to_bcm2838_ti(uint32_t info)
+{
+	return ((info & BCM2835_DMA_INT_EN) ? BCM2838_DMA40_INTEN : 0) |
+		((info & BCM2835_DMA_WAIT_RESP) ? BCM2838_DMA40_WAIT_RESP : 0) |
+		((info & BCM2835_DMA_S_DREQ) ?
+		 (BCM2838_DMA40_S_DREQ | BCM2838_DMA40_WAIT_RD_RESP) : 0) |
+		((info & BCM2835_DMA_D_DREQ) ? BCM2838_DMA40_D_DREQ : 0) |
+		BCM2838_DMA40_PER_MAP((info >> 16) & 0x1f);
+}
+
+static inline uint32_t to_bcm2838_srci(uint32_t info)
+{
+	return ((info & BCM2835_DMA_S_INC) ? BCM2838_DMA40_INC : 0);
+}
+
+static inline uint32_t to_bcm2838_dsti(uint32_t info)
+{
+	return ((info & BCM2835_DMA_D_INC) ? BCM2838_DMA40_INC : 0);
+}
+
+static inline uint32_t to_bcm2838_cbaddr(dma_addr_t addr)
+{
+	BUG_ON(addr & 0x1f);
+	return (addr >> 5);
+}
+
 static void bcm2835_dma_free_cb_chain(struct bcm2835_desc *desc)
 {
 	size_t i;
@@ -282,45 +381,53 @@ static void bcm2835_dma_desc_free(struct virt_dma_desc *vd)
 }
 
 static void bcm2835_dma_create_cb_set_length(
-	struct bcm2835_chan *chan,
+	struct bcm2835_chan *c,
 	struct bcm2835_dma_cb *control_block,
 	size_t len,
 	size_t period_len,
 	size_t *total_len,
 	u32 finalextrainfo)
 {
-	size_t max_len = bcm2835_dma_max_frame_length(chan);
+	size_t max_len = bcm2835_dma_max_frame_length(c);
+	uint32_t cb_len;
 
 	/* set the length taking lite-channel limitations into account */
-	control_block->length = min_t(u32, len, max_len);
+	cb_len = min_t(u32, len, max_len);
 
-	/* finished if we have no period_length */
-	if (!period_len)
-		return;
+	if (period_len) {
+		/*
+		 * period_len means: that we need to generate
+		 * transfers that are terminating at every
+		 * multiple of period_len - this is typically
+		 * used to set the interrupt flag in info
+		 * which is required during cyclic transfers
+		 */
 
-	/*
-	 * period_len means: that we need to generate
-	 * transfers that are terminating at every
-	 * multiple of period_len - this is typically
-	 * used to set the interrupt flag in info
-	 * which is required during cyclic transfers
-	 */
+		/* have we filled in period_length yet? */
+		if (*total_len + cb_len < period_len) {
+			/* update number of bytes in this period so far */
+			*total_len += cb_len;
+		} else {
+			/* calculate the length that remains to reach period_len */
+			cb_len = period_len - *total_len;
 
-	/* have we filled in period_length yet? */
-	if (*total_len + control_block->length < period_len) {
-		/* update number of bytes in this period so far */
-		*total_len += control_block->length;
-		return;
+			/* reset total_length for next period */
+			*total_len = 0;
+		}
 	}
 
-	/* calculate the length that remains to reach period_length */
-	control_block->length = period_len - *total_len;
-
-	/* reset total_length for next period */
-	*total_len = 0;
+	if (c->is_40bit_channel) {
+		struct bcm2838_dma40_scb *scb =
+			(struct bcm2838_dma40_scb *)control_block;
 
-	/* add extrainfo bits in info */
-	control_block->info |= finalextrainfo;
+		scb->len = cb_len;
+		/* add extrainfo bits to ti */
+		scb->ti |= to_bcm2838_ti(finalextrainfo);
+	} else {
+		control_block->length = cb_len;
+		/* add extrainfo bits to info */
+		control_block->info |= finalextrainfo;
+	}
 }
 
 static inline size_t bcm2835_dma_count_frames_for_sg(
@@ -343,7 +450,7 @@ static inline size_t bcm2835_dma_count_frames_for_sg(
 /**
  * bcm2835_dma_create_cb_chain - create a control block and fills data in
  *
- * @chan:           the @dma_chan for which we run this
+ * @c:              the @bcm2835_chan for which we run this
  * @direction:      the direction in which we transfer
  * @cyclic:         it is a cyclic transfer
  * @info:           the default info bits to apply per controlblock
@@ -361,12 +468,11 @@ static inline size_t bcm2835_dma_count_frames_for_sg(
  * @gfp:            the GFP flag to use for allocation
  */
 static struct bcm2835_desc *bcm2835_dma_create_cb_chain(
-	struct dma_chan *chan, enum dma_transfer_direction direction,
+	struct bcm2835_chan *c, enum dma_transfer_direction direction,
 	bool cyclic, u32 info, u32 finalextrainfo, size_t frames,
 	dma_addr_t src, dma_addr_t dst, size_t buf_len,
 	size_t period_len, gfp_t gfp)
 {
-	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
 	size_t len = buf_len, total_len;
 	size_t frame;
 	struct bcm2835_desc *d;
@@ -399,11 +505,23 @@ static struct bcm2835_desc *bcm2835_dma_create_cb_chain(
 
 		/* fill in the control block */
 		control_block = cb_entry->cb;
-		control_block->info = info;
-		control_block->src = src;
-		control_block->dst = dst;
-		control_block->stride = 0;
-		control_block->next = 0;
+		if (c->is_40bit_channel) {
+			struct bcm2838_dma40_scb *scb =
+				(struct bcm2838_dma40_scb *)control_block;
+			scb->ti = to_bcm2838_ti(info);
+			scb->src = lower_32_bits(src);
+			scb->srci= upper_32_bits(src) | to_bcm2838_srci(info);
+			scb->dst = lower_32_bits(dst);
+			scb->dsti = upper_32_bits(dst) | to_bcm2838_dsti(info);
+			scb->next_cb = 0;
+		} else {
+			control_block->info = info;
+			control_block->src = src;
+			control_block->dst = dst;
+			control_block->stride = 0;
+			control_block->next = 0;
+		}
+
 		/* set up length in control_block if requested */
 		if (buf_len) {
 			/* calculate length honoring period_length */
@@ -417,7 +535,10 @@ static struct bcm2835_desc *bcm2835_dma_create_cb_chain(
 		}
 
 		/* link this the last controlblock */
-		if (frame)
+		if (frame && c->is_40bit_channel)
+			d->cb_list[frame - 1].cb->next =
+				to_bcm2838_cbaddr(cb_entry->paddr);
+		if (frame && !c->is_40bit_channel)
 			d->cb_list[frame - 1].cb->next = cb_entry->paddr;
 
 		/* update src and dst and length */
@@ -431,7 +552,14 @@ static struct bcm2835_desc *bcm2835_dma_create_cb_chain(
 	}
 
 	/* the last frame requires extra flags */
-	d->cb_list[d->frames - 1].cb->info |= finalextrainfo;
+	if (c->is_40bit_channel) {
+		struct bcm2838_dma40_scb *scb =
+			(struct bcm2838_dma40_scb *)d->cb_list[d->frames-1].cb;
+
+		scb->ti |= to_bcm2838_ti(finalextrainfo);
+	} else {
+		d->cb_list[d->frames - 1].cb->info |= finalextrainfo;
+	}
 
 	/* detect a size missmatch */
 	if (buf_len && (d->size != buf_len))
@@ -445,28 +573,51 @@ error_cb:
 }
 
 static void bcm2835_dma_fill_cb_chain_with_sg(
-	struct dma_chan *chan,
+	struct bcm2835_chan *c,
 	enum dma_transfer_direction direction,
 	struct bcm2835_cb_entry *cb,
 	struct scatterlist *sgl,
 	unsigned int sg_len)
 {
-	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
 	size_t len, max_len;
 	unsigned int i;
 	dma_addr_t addr;
 	struct scatterlist *sgent;
 
+	pr_err("dma_fill_chain_with_sg(ch %d, dir %d):\n", c->ch, direction);
+
 	max_len = bcm2835_dma_max_frame_length(c);
 	for_each_sg(sgl, sgent, sg_len, i) {
-		for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
-		     len > 0;
-		     addr += cb->cb->length, len -= cb->cb->length, cb++) {
-			if (direction == DMA_DEV_TO_MEM)
-				cb->cb->dst = addr;
-			else
-				cb->cb->src = addr;
-			cb->cb->length = min(len, max_len);
+		if (c->is_40bit_channel) {
+			struct bcm2838_dma40_scb *scb =
+				(struct bcm2838_dma40_scb *)cb->cb;
+			for (addr = sg_dma_address(sgent),
+				     len = sg_dma_len(sgent);
+			     len > 0;
+			     addr += scb->len, len -= scb->len, scb++) {
+				if (direction == DMA_DEV_TO_MEM) {
+					scb->dst = lower_32_bits(addr);
+					scb->dsti = upper_32_bits(addr) | BCM2838_DMA40_INC;
+				} else {
+					scb->src = lower_32_bits(addr);
+					scb->srci = upper_32_bits(addr) | BCM2838_DMA40_INC;
+				}
+				scb->len = min(len, max_len);
+				pr_err("  %llx, %x\n", (u64)addr, scb->len);
+			}
+		} else {
+			for (addr = sg_dma_address(sgent),
+				     len = sg_dma_len(sgent);
+			     len > 0;
+			     addr += cb->cb->length, len -= cb->cb->length,
+			     cb++) {
+				if (direction == DMA_DEV_TO_MEM)
+					cb->cb->dst = addr;
+				else
+					cb->cb->src = addr;
+				cb->cb->length = min(len, max_len);
+				pr_err("  %llx, %x\n", (u64)addr, cb->cb->length);
+			}
 		}
 	}
 }
@@ -475,6 +626,10 @@ static int bcm2835_dma_abort(struct bcm2835_chan *c)
 {
 	void __iomem *chan_base = c->chan_base;
 	long int timeout = 10000;
+	u32 wait_mask = BCM2835_DMA_WAITING_FOR_WRITES;
+
+	if (c->is_40bit_channel)
+		wait_mask = BCM2838_DMA40_WAITING_FOR_WRITES;
 
 	/*
 	 * A zero control block address means the channel is idle.
@@ -487,8 +642,7 @@ static int bcm2835_dma_abort(struct bcm2835_chan *c)
 	writel(0, chan_base + BCM2835_DMA_CS);
 
 	/* Wait for any current AXI transfer to complete */
-	while ((readl(chan_base + BCM2835_DMA_CS) &
-		BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
+	while ((readl(chan_base + BCM2835_DMA_CS) & wait_mask) && --timeout)
 		cpu_relax();
 
 	/* Peripheral might be stuck and fail to signal AXI write responses */
@@ -505,6 +659,7 @@ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
 	struct virt_dma_desc *vd = vchan_next_desc(&c->vc);
 	struct bcm2835_desc *d;
 
+	pr_err("dma_start_desc(%px)\n", vd);
 	if (!vd) {
 		c->desc = NULL;
 		return;
@@ -514,9 +669,16 @@ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
 
 	c->desc = d = to_bcm2835_dma_desc(&vd->tx);
 
-	writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
-	writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
-	       c->chan_base + BCM2835_DMA_CS);
+	if (c->is_40bit_channel) {
+		writel(to_bcm2838_cbaddr(d->cb_list[0].paddr),
+		       c->chan_base + BCM2838_DMA40_CB);
+		writel(BCM2838_DMA40_ACTIVE | BCM2838_DMA40_CS_FLAGS(c->dreq),
+		       c->chan_base + BCM2838_DMA40_CS);
+	} else {
+		writel(d->cb_list[0].paddr, c->chan_base + BCM2835_DMA_ADDR);
+		writel(BCM2835_DMA_ACTIVE | BCM2835_DMA_CS_FLAGS(c->dreq),
+		       c->chan_base + BCM2835_DMA_CS);
+	}
 }
 
 static irqreturn_t bcm2835_dma_callback(int irq, void *data)
@@ -544,7 +706,8 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 	 * will remain idle despite the ACTIVE flag being set.
 	 */
 	writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE |
-	       BCM2835_DMA_CS_FLAGS(c->dreq),
+	       (c->is_40bit_channel ? BCM2838_DMA40_CS_FLAGS(c->dreq) :
+		BCM2835_DMA_CS_FLAGS(c->dreq)),
 	       c->chan_base + BCM2835_DMA_CS);
 
 	d = c->desc;
@@ -643,9 +806,17 @@ static enum dma_status bcm2835_dma_tx_status(struct dma_chan *chan,
 		struct bcm2835_desc *d = c->desc;
 		dma_addr_t pos;
 
-		if (d->dir == DMA_MEM_TO_DEV)
+		if (d->dir == DMA_MEM_TO_DEV && c->is_40bit_channel)
+			pos = readl(c->chan_base + BCM2838_DMA40_SRC) +
+				((readl(c->chan_base + BCM2838_DMA40_SRCI) &
+				  0xff) << 8);
+		else if (d->dir == DMA_MEM_TO_DEV && !c->is_40bit_channel)
 			pos = readl(c->chan_base + BCM2835_DMA_SOURCE_AD);
-		else if (d->dir == DMA_DEV_TO_MEM)
+		else if (d->dir == DMA_DEV_TO_MEM && c->is_40bit_channel)
+			pos = readl(c->chan_base + BCM2838_DMA40_DEST) +
+				((readl(c->chan_base + BCM2838_DMA40_DESTI) &
+				  0xff) << 8);
+		else if (d->dir == DMA_DEV_TO_MEM && !c->is_40bit_channel)
 			pos = readl(c->chan_base + BCM2835_DMA_DEST_AD);
 		else
 			pos = 0;
@@ -691,7 +862,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_memcpy(
 	frames = bcm2835_dma_frames_for_length(len, max_len);
 
 	/* allocate the CB chain - this also fills in the pointers */
-	d = bcm2835_dma_create_cb_chain(chan, DMA_MEM_TO_MEM, false,
+	d = bcm2835_dma_create_cb_chain(c, DMA_MEM_TO_MEM, false,
 					info, extra, frames,
 					src, dst, len, 0, GFP_KERNEL);
 	if (!d)
@@ -726,11 +897,21 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_slave_sg(
 		if (c->cfg.src_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
 			return NULL;
 		src = c->cfg.src_addr;
+		/*
+		 * One would think it ought to be possible to get the physical
+		 * to dma address mapping information from the dma-ranges DT
+		 * property, but I've not found a way yet that doesn't involve
+		 * open-coding the whole thing.
+		 */
+		if (c->is_40bit_channel)
+		    src |= 0x400000000ull;
 		info |= BCM2835_DMA_S_DREQ | BCM2835_DMA_D_INC;
 	} else {
 		if (c->cfg.dst_addr_width != DMA_SLAVE_BUSWIDTH_4_BYTES)
 			return NULL;
 		dst = c->cfg.dst_addr;
+		if (c->is_40bit_channel)
+		    dst |= 0x400000000ull;
 		info |= BCM2835_DMA_D_DREQ | BCM2835_DMA_S_INC;
 	}
 
@@ -738,7 +919,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_slave_sg(
 	frames = bcm2835_dma_count_frames_for_sg(c, sgl, sg_len);
 
 	/* allocate the CB chain */
-	d = bcm2835_dma_create_cb_chain(chan, direction, false,
+	d = bcm2835_dma_create_cb_chain(c, direction, false,
 					info, extra,
 					frames, src, dst, 0, 0,
 					GFP_KERNEL);
@@ -746,7 +927,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_slave_sg(
 		return NULL;
 
 	/* fill in frames with scatterlist pointers */
-	bcm2835_dma_fill_cb_chain_with_sg(chan, direction, d->cb_list,
+	bcm2835_dma_fill_cb_chain_with_sg(c, direction, d->cb_list,
 					  sgl, sg_len);
 
 	return vchan_tx_prep(&c->vc, &d->vd, flags);
@@ -815,7 +996,7 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
 	 * note that we need to use GFP_NOWAIT, as the ALSA i2s dmaengine
 	 * implementation calls prep_dma_cyclic with interrupts disabled.
 	 */
-	d = bcm2835_dma_create_cb_chain(chan, direction, true,
+	d = bcm2835_dma_create_cb_chain(c, direction, true,
 					info, extra,
 					frames, src, dst, buf_len,
 					period_len, GFP_NOWAIT);
@@ -823,7 +1004,8 @@ static struct dma_async_tx_descriptor *bcm2835_dma_prep_dma_cyclic(
 		return NULL;
 
 	/* wrap around into a loop */
-	d->cb_list[d->frames - 1].cb->next = d->cb_list[0].paddr;
+	d->cb_list[d->frames - 1].cb->next = c->is_40bit_channel ?
+		to_bcm2838_cbaddr(d->cb_list[0].paddr) : d->cb_list[0].paddr;
 
 	return vchan_tx_prep(&c->vc, &d->vd, flags);
 }
@@ -899,9 +1081,11 @@ static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id,
 	c->irq_number = irq;
 	c->irq_flags = irq_flags;
 
-	/* check in DEBUG register if this is a LITE channel */
-	if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
-		BCM2835_DMA_DEBUG_LITE)
+	/* check for 40bit and lite channels */
+	if (d->cfg_data->chan_40bit_mask & BIT(chan_id))
+		c->is_40bit_channel = true;
+	else if (readl(c->chan_base + BCM2835_DMA_DEBUG) &
+		 BCM2835_DMA_DEBUG_LITE)
 		c->is_lite_channel = true;
 
 	return 0;
@@ -918,18 +1102,16 @@ static void bcm2835_dma_free(struct bcm2835_dmadev *od)
 	}
 }
 
-int bcm2838_dma40_memcpy_init(struct device *dev)
+int bcm2838_dma40_memcpy_init(void)
 {
-	if (memcpy_scb)
-		return 0;
+	if (!memcpy_parent)
+		return -EPROBE_DEFER;
 
-	memcpy_scb = dma_alloc_coherent(dev, sizeof(*memcpy_scb),
-					&memcpy_scb_dma, GFP_KERNEL);
+	if (!memcpy_chan)
+		return -EINVAL;
 
-	if (!memcpy_scb) {
-		pr_err("bcm2838_dma40_memcpy_init failed!\n");
+	if (!memcpy_scb)
 		return -ENOMEM;
-	}
 
 	return 0;
 }
@@ -956,20 +1138,22 @@ void bcm2838_dma40_memcpy(dma_addr_t dst, dma_addr_t src, size_t size)
 	scb->next_cb = 0;
 
 	writel((u32)(memcpy_scb_dma >> 5), memcpy_chan + BCM2838_DMA40_CB);
-	writel(BCM2838_DMA40_MEMCPY_QOS + BCM2838_DMA40_CS_ACTIVE,
+	writel(BCM2838_DMA40_MEMCPY_FLAGS + BCM2838_DMA40_ACTIVE,
 	       memcpy_chan + BCM2838_DMA40_CS);
+
 	/* Poll for completion */
-	while (!(readl(memcpy_chan + BCM2838_DMA40_CS) & BCM2838_DMA40_CS_END))
+	while (!(readl(memcpy_chan + BCM2838_DMA40_CS) & BCM2838_DMA40_END))
 		cpu_relax();
 
-	writel(BCM2838_DMA40_CS_END, memcpy_chan + BCM2838_DMA40_CS);
+	writel(BCM2838_DMA40_END, memcpy_chan + BCM2838_DMA40_CS);
 
 	spin_unlock_irqrestore(&memcpy_lock, flags);
 }
 EXPORT_SYMBOL(bcm2838_dma40_memcpy);
 
 static const struct of_device_id bcm2835_dma_of_match[] = {
-	{ .compatible = "brcm,bcm2835-dma", },
+	{ .compatible = "brcm,bcm2835-dma", .data = &bcm2835_dma_cfg },
+	{ .compatible = "brcm,bcm2838-dma", .data = &bcm2838_dma_cfg },
 	{},
 };
 MODULE_DEVICE_TABLE(of, bcm2835_dma_of_match);
@@ -1001,6 +1185,8 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 	int irq_flags;
 	uint32_t chans_available;
 	char chan_name[BCM2835_DMA_CHAN_NAME_SIZE];
+	const struct of_device_id *of_id;
+	int chan_count, chan_start, chan_end;
 
 	if (!pdev->dev.dma_mask)
 		pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
@@ -1020,9 +1206,13 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 	base = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(base))
 		return PTR_ERR(base);
-	rc = bcm_dmaman_probe(pdev, base, BCM2835_DMA_BULK_MASK);
-	if (rc)
-		dev_err(&pdev->dev, "Failed to initialize the legacy API\n");
+
+	/* The set of channels can be split across multiple instances. */
+	chan_start = ((u32)base / BCM2835_DMA_CHAN_SIZE) & 0xf;
+	base -= BCM2835_DMA_CHAN(chan_start);
+	chan_count = resource_size(res) / BCM2835_DMA_CHAN_SIZE;
+	chan_end = min(chan_start + chan_count,
+			 BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED + 1);
 
 	od->base = base;
 
@@ -1052,6 +1242,14 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, od);
 
+	of_id = of_match_node(bcm2835_dma_of_match, pdev->dev.of_node);
+	if (!of_id) {
+		dev_err(&pdev->dev, "Failed to match compatible string\n");
+		return -EINVAL;
+	}
+
+	od->cfg_data = of_id->data;
+
 	/* Request DMA channel mask from device tree */
 	if (of_property_read_u32(pdev->dev.of_node,
 			"brcm,dma-channel-mask",
@@ -1061,18 +1259,34 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 		goto err_no_dma;
 	}
 
-	/* Channel 0 is used by the legacy API */
-	chans_available &= ~BCM2835_DMA_BULK_MASK;
+	/* One channel is reserved for the legacy API */
+	if (chans_available & BCM2835_DMA_BULK_MASK) {
+		rc = bcm_dmaman_probe(pdev, base,
+				      chans_available & BCM2835_DMA_BULK_MASK);
+		if (rc)
+			dev_err(&pdev->dev,
+				"Failed to initialize the legacy API\n");
 
-	/* We can't use channels 11-13 yet */
-	chans_available &= ~(BIT(11) | BIT(12) | BIT(13));
+		chans_available &= ~BCM2835_DMA_BULK_MASK;
+	}
 
-	/* Grab channel 14 for the 40-bit DMA memcpy */
-	chans_available &= ~BIT(14);
-	memcpy_chan = BCM2835_DMA_CHANIO(base, 14);
+	/* And possibly one for the 40-bit DMA memcpy API */
+	if (chans_available & od->cfg_data->chan_40bit_mask &
+	    BIT(BCM2838_DMA_MEMCPY_CHAN)) {
+		memcpy_parent = od;
+		memcpy_chan = BCM2835_DMA_CHANIO(base, BCM2838_DMA_MEMCPY_CHAN);
+		memcpy_scb = dma_alloc_coherent(memcpy_parent->ddev.dev,
+						sizeof(*memcpy_scb),
+						&memcpy_scb_dma, GFP_KERNEL);
+		if (!memcpy_scb)
+			dev_warn(&pdev->dev,
+				 "Failed to allocated memcpy scb\n");
+
+		chans_available &= ~BIT(BCM2838_DMA_MEMCPY_CHAN);
+	}
 
 	/* get irqs for each channel that we support */
-	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
+	for (i = chan_start; i < chan_end; i++) {
 		/* skip masked out channels */
 		if (!(chans_available & (1 << i))) {
 			irq[i] = -1;
@@ -1095,13 +1309,17 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 		irq[i] = platform_get_irq(pdev, i < 11 ? i : 11);
 	}
 
+	chan_count = 0;
+
 	/* get irqs for each channel */
-	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
+	for (i = chan_start; i < chan_end; i++) {
 		/* skip channels without irq */
 		if (irq[i] < 0)
 			continue;
 
 		/* check if there are other channels that also use this irq */
+		/* FIXME: This will fail if interrupts are shared across
+		   instances */
 		irq_flags = 0;
 		for (j = 0; j <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; j++)
 			if ((i != j) && (irq[j] == irq[i])) {
@@ -1113,9 +1331,10 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 		rc = bcm2835_dma_chan_init(od, i, irq[i], irq_flags);
 		if (rc)
 			goto err_no_dma;
+		chan_count++;
 	}
 
-	dev_dbg(&pdev->dev, "Initialized %i DMA channels\n", i);
+	dev_dbg(&pdev->dev, "Initialized %i DMA channels\n", chan_count);
 
 	/* Device-tree DMA controller registration */
 	rc = of_dma_controller_register(pdev->dev.of_node,
@@ -1147,6 +1366,13 @@ static int bcm2835_dma_remove(struct platform_device *pdev)
 
 	bcm_dmaman_remove(pdev);
 	dma_async_device_unregister(&od->ddev);
+	if (memcpy_parent == od) {
+		dma_free_coherent(&pdev->dev, sizeof(*memcpy_scb), memcpy_scb,
+				  memcpy_scb_dma);
+		memcpy_parent = NULL;
+		memcpy_scb = NULL;
+		memcpy_chan = NULL;
+	}
 	bcm2835_dma_free(od);
 
 	return 0;
diff --git a/drivers/pci/controller/pcie-brcmstb-bounce.c b/drivers/pci/controller/pcie-brcmstb-bounce.c
index 2f59459308d60..846a2cccad9b0 100644
--- a/drivers/pci/controller/pcie-brcmstb-bounce.c
+++ b/drivers/pci/controller/pcie-brcmstb-bounce.c
@@ -91,7 +91,7 @@ struct dmabounce_device_info {
 
 static struct dmabounce_device_info *g_dmabounce_device_info;
 
-extern int bcm2838_dma40_memcpy_init(struct device *dev);
+extern int bcm2838_dma40_memcpy_init(void);
 extern void bcm2838_dma40_memcpy(dma_addr_t dst, dma_addr_t src, size_t size);
 
 #ifdef STATS
@@ -471,9 +471,9 @@ static const struct dma_map_ops dmabounce_ops = {
 	.mapping_error		= dmabounce_mapping_error,
 };
 
-int brcm_pcie_bounce_register_dev(struct device *dev,
-				  unsigned long buffer_size,
-				  dma_addr_t threshold)
+int brcm_pcie_bounce_init(struct device *dev,
+			  unsigned long buffer_size,
+			  dma_addr_t threshold)
 {
 	struct dmabounce_device_info *device_info;
 	int ret;
@@ -482,9 +482,9 @@ int brcm_pcie_bounce_register_dev(struct device *dev,
 	if (g_dmabounce_device_info)
 		return -EBUSY;
 
-	ret = bcm2838_dma40_memcpy_init(dev);
+	ret = bcm2838_dma40_memcpy_init();
 	if (ret)
-	    return ret;
+		return ret;
 
 	device_info = kmalloc(sizeof(struct dmabounce_device_info), GFP_ATOMIC);
 	if (!device_info) {
@@ -515,9 +515,8 @@ int brcm_pcie_bounce_register_dev(struct device *dev,
 		 device_create_file(dev, &dev_attr_dmabounce_stats));
 
 	g_dmabounce_device_info = device_info;
-	set_dma_ops(dev, &dmabounce_ops);
 
-	dev_info(dev, "dmabounce: registered device - %ld kB, threshold %pad\n",
+	dev_info(dev, "dmabounce: initialised - %ld kB, threshold %pad\n",
 		 buffer_size / 1024, &threshold);
 
 	return 0;
@@ -526,14 +525,13 @@ int brcm_pcie_bounce_register_dev(struct device *dev,
 	kfree(device_info);
 	return ret;
 }
-EXPORT_SYMBOL(brcm_pcie_bounce_register_dev);
+EXPORT_SYMBOL(brcm_pcie_bounce_init);
 
-void brcm_pcie_bounce_unregister_dev(struct device *dev)
+void brcm_pcie_bounce_uninit(struct device *dev)
 {
 	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
 
 	g_dmabounce_device_info = NULL;
-	set_dma_ops(dev, NULL);
 
 	if (!device_info) {
 		dev_warn(dev,
@@ -554,10 +552,16 @@ void brcm_pcie_bounce_unregister_dev(struct device *dev)
 			 device_remove_file(dev, &dev_attr_dmabounce_stats));
 
 	kfree(device_info);
+}
+EXPORT_SYMBOL(brcm_pcie_bounce_uninit);
+
+int brcm_pcie_bounce_register_dev(struct device *dev)
+{
+	set_dma_ops(dev, &dmabounce_ops);
 
-	dev_info(dev, "dmabounce: device unregistered\n");
+	return 0;
 }
-EXPORT_SYMBOL(brcm_pcie_bounce_unregister_dev);
+EXPORT_SYMBOL(brcm_pcie_bounce_register_dev);
 
 MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
 MODULE_DESCRIPTION("Dedicate DMA bounce support for pcie-brcmstb");
diff --git a/drivers/pci/controller/pcie-brcmstb-bounce.h b/drivers/pci/controller/pcie-brcmstb-bounce.h
index 5d07f679dc71b..2fe20a14d0352 100644
--- a/drivers/pci/controller/pcie-brcmstb-bounce.h
+++ b/drivers/pci/controller/pcie-brcmstb-bounce.h
@@ -8,21 +8,26 @@
 
 #ifdef CONFIG_ARM
 
-int brcm_pcie_bounce_register_dev(struct device *dev, unsigned long buffer_size,
-				  dma_addr_t threshold);
-
-int brcm_pcie_bounce_unregister_dev(struct device *dev);
+int brcm_pcie_bounce_init(struct device *dev, unsigned long buffer_size,
+			  dma_addr_t threshold);
+int brcm_pcie_bounce_uninit(struct device *dev);
+int brcm_pcie_bounce_register_dev(struct device *dev);
 
 #else
 
-static inline int brcm_pcie_bounce_register_dev(struct device *dev,
-						unsigned long buffer_size,
-						dma_addr_t threshold)
+static inline int brcm_pcie_bounce_init(struct device *dev,
+					unsigned long buffer_size,
+					dma_addr_t threshold)
+{
+	return 0;
+}
+
+static inline int brcm_pcie_bounce_uninit(struct device *dev)
 {
 	return 0;
 }
 
-static inline int brcm_pcie_bounce_unregister_dev(struct device *dev)
+static inline int brcm_pcie_bounce_register_dev(struct device *dev)
 {
 	return 0;
 }
diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index c988013a2c269..f99ab05ab4778 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -650,6 +650,7 @@ static void brcm_set_dma_ops(struct device *dev)
 
 static inline void brcm_pcie_perst_set(struct brcm_pcie *pcie,
 				       unsigned int val);
+
 static int brcmstb_platform_notifier(struct notifier_block *nb,
 				     unsigned long event, void *__dev)
 {
@@ -663,12 +664,11 @@ static int brcmstb_platform_notifier(struct notifier_block *nb,
 		    strcmp(dev->kobj.name, rc_name)) {
 			int ret;
 
-			ret = brcm_pcie_bounce_register_dev(dev, bounce_buffer,
-							    (dma_addr_t)bounce_threshold);
+			ret = brcm_pcie_bounce_register_dev(dev);
 			if (ret) {
 				dev_err(dev,
 					"brcm_pcie_bounce_register_dev() failed: %d\n",
-				ret);
+					ret);
 				return ret;
 			}
 		}
@@ -681,8 +681,6 @@ static int brcmstb_platform_notifier(struct notifier_block *nb,
 			brcm_pcie_perst_set(g_pcie, 1);
 			msleep(100);
 			brcm_pcie_perst_set(g_pcie, 0);
-		} else if (max_pfn > (bounce_threshold/PAGE_SIZE)) {
-			brcm_pcie_bounce_unregister_dev(dev);
 		}
 		return NOTIFY_OK;
 
@@ -1718,6 +1716,7 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 	void __iomem *base;
 	struct pci_host_bridge *bridge;
 	struct pci_bus *child;
+	extern unsigned long max_pfn;
 
 	bridge = devm_pci_alloc_host_bridge(&pdev->dev, sizeof(*pcie));
 	if (!bridge)
@@ -1753,6 +1752,20 @@ static int brcm_pcie_probe(struct platform_device *pdev)
 	if (IS_ERR(base))
 		return PTR_ERR(base);
 
+	/* To Do: Add hardware check if this ever gets fixed */
+	if (max_pfn > (bounce_threshold/PAGE_SIZE)) {
+		int ret;
+		ret = brcm_pcie_bounce_init(&pdev->dev, bounce_buffer,
+					    (dma_addr_t)bounce_threshold);
+		if (ret) {
+			if (ret != -EPROBE_DEFER)
+				dev_err(&pdev->dev,
+					"could not init bounce buffers: %d\n",
+					ret);
+			return ret;
+		}
+	}
+
 	pcie->clk = of_clk_get_by_name(dn, "sw_pcie");
 	if (IS_ERR(pcie->clk)) {
 		dev_warn(&pdev->dev, "could not get clock\n");
-- 
GitLab


From dab112e092e77cbb87432027cceb975c52f84770 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 5 Jun 2019 21:32:03 +0100
Subject: [PATCH 0655/1835] BCM270X_DT: Leave bulk channel in dma channel mask

The updated bcm2835-dma driver does not require the BULK channel
to be removed from the set of available channels, as provided by
dma-channel-mask.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2708-rpi.dtsi | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index 57958c642381c..a267807f3d6fa 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -124,10 +124,6 @@
 	};
 };
 
-&dma {
-	brcm,dma-channel-mask = <0x7f34>;
-};
-
 &hdmi {
 	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
 };
-- 
GitLab


From e912038f99270a57bb3f671c64ab328f83c8ecf9 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 6 Jun 2019 09:35:08 +0100
Subject: [PATCH 0656/1835] SQUASH: bcm2835-dma: Remove debugging

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/dma/bcm2835-dma.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 11904dabdad69..4183734a1fbfa 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -584,8 +584,6 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
 	dma_addr_t addr;
 	struct scatterlist *sgent;
 
-	pr_err("dma_fill_chain_with_sg(ch %d, dir %d):\n", c->ch, direction);
-
 	max_len = bcm2835_dma_max_frame_length(c);
 	for_each_sg(sgl, sgent, sg_len, i) {
 		if (c->is_40bit_channel) {
@@ -603,7 +601,6 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
 					scb->srci = upper_32_bits(addr) | BCM2838_DMA40_INC;
 				}
 				scb->len = min(len, max_len);
-				pr_err("  %llx, %x\n", (u64)addr, scb->len);
 			}
 		} else {
 			for (addr = sg_dma_address(sgent),
@@ -616,7 +613,6 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
 				else
 					cb->cb->src = addr;
 				cb->cb->length = min(len, max_len);
-				pr_err("  %llx, %x\n", (u64)addr, cb->cb->length);
 			}
 		}
 	}
@@ -659,7 +655,6 @@ static void bcm2835_dma_start_desc(struct bcm2835_chan *c)
 	struct virt_dma_desc *vd = vchan_next_desc(&c->vc);
 	struct bcm2835_desc *d;
 
-	pr_err("dma_start_desc(%px)\n", vd);
 	if (!vd) {
 		c->desc = NULL;
 		return;
-- 
GitLab


From 9b92dd96ae182573840fe254d54a46ab1d032e45 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 6 Jun 2019 15:22:29 +0100
Subject: [PATCH 0657/1835] defconfig: Update bcm2711 to match bcm2709 on extra
 modules

Lots of things like USB DVB tuners were missing from the
defconfig.
Resync it with bcm2709_defconfig

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2711_defconfig | 97 ++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 706a2cad83b65..6824188e46bd6 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -14,6 +14,9 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
@@ -65,8 +68,10 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_BINFMT_MISC=m
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
@@ -95,6 +100,7 @@ CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
 CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_IPCOMP=m
@@ -214,6 +220,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -520,6 +527,7 @@ CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=y
 CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
 CONFIG_USB_NET_AX88179_178A=m
 CONFIG_USB_NET_CDCETHER=m
 CONFIG_USB_NET_CDC_EEM=m
@@ -573,6 +581,8 @@ CONFIG_LIBERTAS_THINFIRM_USB=m
 CONFIG_MWIFIEX=m
 CONFIG_MWIFIEX_SDIO=m
 CONFIG_MT7601U=m
+CONFIG_MT76x0U=m
+CONFIG_MT76x2U=m
 CONFIG_RT2X00=m
 CONFIG_RT2500USB=m
 CONFIG_RT73USB=m
@@ -613,6 +623,7 @@ CONFIG_TOUCHSCREEN_ADS7846=m
 CONFIG_TOUCHSCREEN_EGALAX=m
 CONFIG_TOUCHSCREEN_EXC3000=m
 CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_ILI210X=m
 CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 CONFIG_TOUCHSCREEN_RPI_FT5406=m
 CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
@@ -657,8 +668,13 @@ CONFIG_SERIAL_DEV_BUS=m
 CONFIG_TTY_PRINTK=y
 CONFIG_HW_RANDOM=y
 CONFIG_RAW_DRIVER=y
+CONFIG_TCG_TPM=m
+CONFIG_TCG_TIS_SPI=m
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX=m
+CONFIG_I2C_MUX_GPMUX=m
+CONFIG_I2C_MUX_PCA954x=m
 CONFIG_I2C_BCM2708=m
 CONFIG_I2C_BCM2835=m
 CONFIG_I2C_GPIO=m
@@ -667,6 +683,7 @@ CONFIG_I2C_TINY_USB=m
 CONFIG_SPI=y
 CONFIG_SPI_BCM2835=m
 CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_GPIO=m
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPI_SLAVE=y
 CONFIG_PPS=m
@@ -698,11 +715,14 @@ CONFIG_W1_SLAVE_DS28E04=m
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_MAX17040=m
 CONFIG_BATTERY_GAUGE_LTC2941=m
 CONFIG_HWMON=m
 CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_GPIO_FAN=m
 CONFIG_SENSORS_JC42=m
 CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_SENSORS_RPI_POE_FAN=m
 CONFIG_SENSORS_SHT21=m
 CONFIG_SENSORS_SHT3x=m
@@ -726,6 +746,31 @@ CONFIG_REGULATOR_FIXED_VOLTAGE=m
 CONFIG_REGULATOR_ARIZONA_LDO1=m
 CONFIG_REGULATOR_ARIZONA_MICSUPP=m
 CONFIG_REGULATOR_GPIO=y
+CONFIG_RC_CORE=y
+CONFIG_LIRC=y
+CONFIG_RC_DECODERS=y
+CONFIG_IR_NEC_DECODER=m
+CONFIG_IR_RC5_DECODER=m
+CONFIG_IR_RC6_DECODER=m
+CONFIG_IR_JVC_DECODER=m
+CONFIG_IR_SONY_DECODER=m
+CONFIG_IR_SANYO_DECODER=m
+CONFIG_IR_SHARP_DECODER=m
+CONFIG_IR_MCE_KBD_DECODER=m
+CONFIG_IR_XMP_DECODER=m
+CONFIG_IR_IMON_DECODER=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_IR_GPIO_TX=m
+CONFIG_IR_PWM_TX=m
 CONFIG_MEDIA_SUPPORT=m
 CONFIG_MEDIA_CAMERA_SUPPORT=y
 CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
@@ -797,7 +842,40 @@ CONFIG_VIDEO_GO7007=m
 CONFIG_VIDEO_GO7007_USB=m
 CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
 CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
 CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
 CONFIG_DVB_USB_AF9035=m
 CONFIG_DVB_USB_ANYSEE=m
 CONFIG_DVB_USB_AU6610=m
@@ -805,7 +883,9 @@ CONFIG_DVB_USB_AZ6007=m
 CONFIG_DVB_USB_CE6230=m
 CONFIG_DVB_USB_EC168=m
 CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
 CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
 CONFIG_DVB_USB_DVBSKY=m
 CONFIG_SMS_USB_DRV=m
 CONFIG_DVB_B2C2_FLEXCOP_USB=m
@@ -900,9 +980,11 @@ CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
 CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M=m
 CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
 CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
 CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_AUDIOSENSE_PI=m
 CONFIG_SND_DIGIDAC1_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
 CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
@@ -913,10 +995,14 @@ CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
 CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
 CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
 CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_AD193X_SPI=m
+CONFIG_SND_SOC_AD193X_I2C=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_ICS43432=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
 CONFIG_SND_SIMPLE_CARD=m
@@ -929,6 +1015,7 @@ CONFIG_HID_APPLE=m
 CONFIG_HID_ASUS=m
 CONFIG_HID_BELKIN=m
 CONFIG_HID_BETOP_FF=m
+CONFIG_HID_BIGBEN_FF=m
 CONFIG_HID_CHERRY=m
 CONFIG_HID_CHICONY=m
 CONFIG_HID_CYPRESS=m
@@ -986,6 +1073,7 @@ CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_PLATFORM=y
 CONFIG_USB_DWCOTG=y
 CONFIG_USB_PRINTER=m
+CONFIG_USB_TMC=m
 CONFIG_USB_STORAGE=y
 CONFIG_USB_STORAGE_REALTEK=m
 CONFIG_USB_STORAGE_DATAFAB=m
@@ -1006,6 +1094,7 @@ CONFIG_USB_MICROTEK=m
 CONFIG_USBIP_CORE=m
 CONFIG_USBIP_VHCI_HCD=m
 CONFIG_USBIP_HOST=m
+CONFIG_USBIP_VUDC=m
 CONFIG_USB_DWC2=m
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
@@ -1122,6 +1211,8 @@ CONFIG_MMC_SDHCI_IPROC=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA963X=m
+CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
@@ -1133,6 +1224,7 @@ CONFIG_LEDS_TRIGGER_TRANSIENT=m
 CONFIG_LEDS_TRIGGER_CAMERA=m
 CONFIG_LEDS_TRIGGER_INPUT=y
 CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_LEDS_TRIGGER_NETDEV=m
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
 CONFIG_RTC_DRV_ABX80X=m
@@ -1154,6 +1246,7 @@ CONFIG_RTC_DRV_FM3130=m
 CONFIG_RTC_DRV_RX8581=m
 CONFIG_RTC_DRV_RX8025=m
 CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_RV3028=m
 CONFIG_RTC_DRV_M41T93=m
 CONFIG_RTC_DRV_M41T94=m
 CONFIG_RTC_DRV_DS1302=m
@@ -1170,6 +1263,8 @@ CONFIG_RTC_DRV_RV3029C2=m
 CONFIG_DMADEVICES=y
 CONFIG_DMA_BCM2835=y
 CONFIG_DMA_BCM2708=y
+CONFIG_AUXDISPLAY=y
+CONFIG_HD44780=m
 CONFIG_UIO=m
 CONFIG_UIO_PDRV_GENIRQ=m
 CONFIG_STAGING=y
@@ -1198,6 +1293,7 @@ CONFIG_FB_TFT_PCD8544=m
 CONFIG_FB_TFT_RA8875=m
 CONFIG_FB_TFT_S6D02A1=m
 CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SH1106=m
 CONFIG_FB_TFT_SSD1289=m
 CONFIG_FB_TFT_SSD1306=m
 CONFIG_FB_TFT_SSD1331=m
@@ -1229,6 +1325,7 @@ CONFIG_MCP3422=m
 CONFIG_DHT11=m
 CONFIG_HDC100X=m
 CONFIG_HTU21=m
+CONFIG_INV_MPU6050_I2C=m
 CONFIG_TSL4531=m
 CONFIG_VEML6070=m
 CONFIG_BMP280=m
-- 
GitLab


From 3ec2782b83157b43659e0017e8678dd8116863a4 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 31 May 2019 17:57:26 +0100
Subject: [PATCH 0658/1835] dts: Include CSI lane config for csi1

Without the include the peripheral is configured to have 0
data lanes, which doesn't allow much data to be passed.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 87f8fdb7e7e52..92ac213649a79 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2711.dtsi"
+#include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
 	compatible = "raspberrypi,4-model-b", "brcm,bcm2838", "brcm,bcm2837";
-- 
GitLab


From a393e883e599e13159baca610927a070af29a5c1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 7 Jun 2019 11:31:21 +0100
Subject: [PATCH 0659/1835] drm/vc4: Fix T-format modifiers in FKMS.

The wrong vc_image formats were being checked for in the switch
statement. Correct these.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index af98342ecd44b..3bf8df61ff00a 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -458,10 +458,10 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 	switch (fb->modifier) {
 	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
 		switch (mb->plane.vc_image_type) {
-		case VC_IMAGE_RGBX32:
+		case VC_IMAGE_XRGB8888:
 			mb->plane.vc_image_type = VC_IMAGE_TF_RGBX32;
 			break;
-		case VC_IMAGE_RGBA32:
+		case VC_IMAGE_ARGB8888:
 			mb->plane.vc_image_type = VC_IMAGE_TF_RGBA32;
 			break;
 		case VC_IMAGE_RGB565:
-- 
GitLab


From f6c186b07c41b8ab219bcd708486896dda18ec81 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 7 Jun 2019 11:35:01 +0100
Subject: [PATCH 0660/1835] defconfigs: Add FB_SIMPLE to both bcmrpi and
 bcm2709 configs

The firmware sets up simple fb should one of the KMS drivers
be enabled, but the driver isn't being built.
Add it to the build.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index c1dda5092433f..07be63a719364 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -928,6 +928,7 @@ CONFIG_TINYDRM_REPAPER=m
 CONFIG_FB=y
 CONFIG_FB_BCM2708=y
 CONFIG_FB_UDL=m
+CONFIG_FB_SIMPLE=y
 CONFIG_FB_SSD1307=m
 CONFIG_FB_RPISENSE=m
 # CONFIG_BACKLIGHT_GENERIC is not set
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 9a69e8b0a8ae1..e80e58d06ddec 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -920,6 +920,7 @@ CONFIG_TINYDRM_REPAPER=m
 CONFIG_FB=y
 CONFIG_FB_BCM2708=y
 CONFIG_FB_UDL=m
+CONFIG_FB_SIMPLE=y
 CONFIG_FB_SSD1307=m
 CONFIG_FB_RPISENSE=m
 # CONFIG_BACKLIGHT_GENERIC is not set
-- 
GitLab


From 5a2844ae421d747e903a9141b162179d3aaced23 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 10 Jun 2019 17:22:44 +0100
Subject: [PATCH 0661/1835] bcm2711 dts: Disable the v3d node by default

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2711.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
index 07711dfe28f03..767036c91324d 100644
--- a/arch/arm/boot/dts/bcm2711.dtsi
+++ b/arch/arm/boot/dts/bcm2711.dtsi
@@ -13,6 +13,10 @@
 	};
 };
 
+&v3d {
+	status = "disabled";
+};
+
 &dma {
 	brcm,dma-channel-mask = <0x7ef5>;
 };
-- 
GitLab


From 6052b121b88d2814e85c840dcb6dc7dcb0413dcc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 10 Jun 2019 16:32:51 +0100
Subject: [PATCH 0662/1835] drm/vc4: Remove 340MHz clock limit from FKMS now
 scrambling issues resolved

Firmware TMDS scrambling is now being correctly configured, so
we can use it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 3bf8df61ff00a..a78662f5707d6 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -830,12 +830,6 @@ vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 		break;
 	}
 
-	/* Limit the pixel clock until we can get dynamic HDMI 2.0 scrambling
-	 * working.
-	 */
-	if (mode->clock > 340000)
-		return MODE_CLOCK_HIGH;
-
 	return MODE_OK;
 }
 
-- 
GitLab


From 9fb65a12d5506e75ec58a6679bf44b656f5f8fb2 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Fri, 7 Jun 2019 14:50:12 +0100
Subject: [PATCH 0663/1835] Revert "usb: xhci: hack xhci_urb_enqueue to support
 hid.mousepoll behaviour"

This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
---
 drivers/usb/host/xhci.c | 86 -----------------------------------------
 1 file changed, 86 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2d73827fe74eb..e9edd823fe91d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1415,87 +1415,6 @@ command_cleanup:
 	return ret;
 }
 
-/*
- * RPI: Fixup endpoint intervals when requested
- * - Check interval versus the (cached) endpoint context
- * - set the endpoint interval to the new value
- * - force an endpoint configure command
- */
-static void xhci_fixup_interval(struct xhci_hcd *xhci, struct urb *urb,
-				unsigned int slot_id, unsigned int ep_index)
-{
-	struct xhci_ep_ctx *ep_ctx_out, *ep_ctx_in;
-	struct xhci_command *command;
-	struct xhci_input_control_ctx *ctrl_ctx;
-	struct xhci_virt_device *vdev;
-	int xhci_interval, ep_interval;
-	int ret;
-	unsigned long flags;
-	u32 ep_info_tmp;
-
-	spin_lock_irqsave(&xhci->lock, flags);
-
-	vdev = xhci->devs[slot_id];
-	/* Get context-derived endpoint interval */
-	ep_ctx_out = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
-	ep_ctx_in = xhci_get_ep_ctx(xhci, vdev->in_ctx, ep_index);
-	xhci_interval = EP_INTERVAL_TO_UFRAMES(le32_to_cpu(ep_ctx_out->ep_info));
-	ep_interval = urb->interval * 8;
-
-	if (ep_interval == xhci_interval) {
-		spin_unlock_irqrestore(&xhci->lock, flags);
-		return;
-	}
-
-	xhci_dbg(xhci, "Fixup interval ep_interval=%d xhci_interval=%d\n",
-		 ep_interval, xhci_interval);
-	command = xhci_alloc_command_with_ctx(xhci, true, GFP_ATOMIC);
-	if (!command) {
-		/* Failure here is benign, poll at the original rate */
-		spin_unlock_irqrestore(&xhci->lock, flags);
-		return;
-	}
-
-	/* xHCI uses exponents for intervals... */
-	xhci_interval = fls(ep_interval) - 1;
-	xhci_interval = clamp_val(xhci_interval, 3, 10);
-	ep_info_tmp = le32_to_cpu(ep_ctx_out->ep_info);
-	ep_info_tmp &= ~EP_INTERVAL(255);
-	ep_info_tmp |= EP_INTERVAL(xhci_interval);
-
-	/* Keep the endpoint context up-to-date while issuing the command. */
-	xhci_endpoint_copy(xhci, vdev->in_ctx,
-			   vdev->out_ctx, ep_index);
-	ep_ctx_in->ep_info = cpu_to_le32(ep_info_tmp);
-
-	/*
-	 * We need to drop the lock, so take an explicit copy
-	 * of the ep context.
-	 */
-	xhci_endpoint_copy(xhci, command->in_ctx, vdev->in_ctx, ep_index);
-
-	ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
-	if (!ctrl_ctx) {
-		xhci_warn(xhci,
-			  "%s: Could not get input context, bad type.\n",
-			  __func__);
-		spin_unlock_irqrestore(&xhci->lock, flags);
-		xhci_free_command(xhci, command);
-		return;
-	}
-	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
-	ctrl_ctx->drop_flags = 0;
-
-	spin_unlock_irqrestore(&xhci->lock, flags);
-
-	ret = xhci_configure_endpoint(xhci, urb->dev, command,
-				      false, false);
-	if (ret)
-		xhci_warn(xhci, "%s: Configure endpoint failed: %d\n",
-			  __func__, ret);
-	xhci_free_command(xhci, command);
-}
-
 /*
  * non-error returns are a promise to giveback() the urb later
  * we drop ownership so next owner (or urb unlink) can get it
@@ -1560,11 +1479,6 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 		}
 	}
 
-	if (usb_endpoint_xfer_int(&urb->ep->desc) &&
-	    (urb->dev->speed == USB_SPEED_FULL ||
-	     urb->dev->speed == USB_SPEED_LOW))
-		xhci_fixup_interval(xhci, urb, slot_id, ep_index);
-
 	spin_lock_irqsave(&xhci->lock, flags);
 
 	if (xhci->xhc_state & XHCI_STATE_DYING) {
-- 
GitLab


From ed37a9faa3e7e0525c15cd6ce2d75c0570e4ff38 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 11 Jun 2019 10:55:00 +0100
Subject: [PATCH 0664/1835] usb: add plumbing for updating interrupt endpoint
 interval state

xHCI caches device and endpoint data after the interface is configured,
so an explicit command needs to be issued for any device driver wanting
to alter the polling interval of an endpoint.

Add usb_fixup_endpoint() to allow drivers to do this. The fixup must be
called after calculating endpoint bandwidth requirements but before any
URBs are submitted.

If polling intervals are shortened, any bandwidth reservations are no
longer valid but in practice polling intervals are only ever relaxed.

Limit the scope to interrupt transfers for now.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/usb/core/hcd.c     | 10 ++++++++++
 drivers/usb/core/message.c | 15 +++++++++++++++
 include/linux/usb.h        |  2 ++
 include/linux/usb/hcd.h    |  7 +++++++
 4 files changed, 34 insertions(+)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index b82a7d787add8..69268aa21d381 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2071,6 +2071,16 @@ reset:
 	return ret;
 }
 
+void usb_hcd_fixup_endpoint(struct usb_device *udev,
+			    struct usb_host_endpoint *ep, int interval)
+{
+	struct usb_hcd *hcd;
+
+	hcd = bus_to_hcd(udev->bus);
+	if (hcd->driver->fixup_endpoint)
+		hcd->driver->fixup_endpoint(hcd, udev, ep, interval);
+}
+
 /* Disables the endpoint: synchronizes with the hcd to make sure all
  * endpoint state is gone from hardware.  usb_hcd_flush_endpoint() must
  * have been called previously.  Use for set_configuration, set_interface,
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9b5411635f96d..28a5c5ed0f2c1 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1113,6 +1113,21 @@ static void remove_intf_ep_devs(struct usb_interface *intf)
 	intf->ep_devs_created = 0;
 }
 
+void usb_fixup_endpoint(struct usb_device *dev, int epaddr, int interval)
+{
+	unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
+	struct usb_host_endpoint *ep;
+
+	if (usb_endpoint_out(epaddr))
+		ep = dev->ep_out[epnum];
+	else
+		ep = dev->ep_in[epnum];
+
+	if (ep && usb_endpoint_xfer_int(&ep->desc))
+		usb_hcd_fixup_endpoint(dev, ep, interval);
+}
+EXPORT_SYMBOL_GPL(usb_fixup_endpoint);
+
 /**
  * usb_disable_endpoint -- Disable an endpoint by address
  * @dev: the device whose endpoint is being disabled
diff --git a/include/linux/usb.h b/include/linux/usb.h
index ff010d1fd1c78..379a0acf0e03b 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1809,6 +1809,8 @@ extern int usb_clear_halt(struct usb_device *dev, int pipe);
 extern int usb_reset_configuration(struct usb_device *dev);
 extern int usb_set_interface(struct usb_device *dev, int ifnum, int alternate);
 extern void usb_reset_endpoint(struct usb_device *dev, unsigned int epaddr);
+extern void usb_fixup_endpoint(struct usb_device *dev, int epaddr,
+			       int interval);
 
 /* this request isn't really synchronous, but it belongs with the others */
 extern int usb_driver_set_configuration(struct usb_device *udev, int config);
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 97e2ddec18b1a..b5d0875b55954 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -379,6 +379,11 @@ struct hc_driver {
 		 * or bandwidth constraints.
 		 */
 	void	(*reset_bandwidth)(struct usb_hcd *, struct usb_device *);
+		/* Override the endpoint-derived interval
+		 * (if there is any cached hardware state).
+		 */
+	void	(*fixup_endpoint)(struct usb_hcd *hcd, struct usb_device *udev,
+				  struct usb_host_endpoint *ep, int interval);
 		/* Returns the hardware-chosen device address */
 	int	(*address_device)(struct usb_hcd *, struct usb_device *udev);
 		/* prepares the hardware to send commands to the device */
@@ -435,6 +440,8 @@ extern void usb_hcd_unmap_urb_setup_for_dma(struct usb_hcd *, struct urb *);
 extern void usb_hcd_unmap_urb_for_dma(struct usb_hcd *, struct urb *);
 extern void usb_hcd_flush_endpoint(struct usb_device *udev,
 		struct usb_host_endpoint *ep);
+extern void usb_hcd_fixup_endpoint(struct usb_device *udev,
+		struct usb_host_endpoint *ep, int interval);
 extern void usb_hcd_disable_endpoint(struct usb_device *udev,
 		struct usb_host_endpoint *ep);
 extern void usb_hcd_reset_endpoint(struct usb_device *udev,
-- 
GitLab


From b0535f57d138702ee5265e2a763990b9d3682564 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 11 Jun 2019 11:33:39 +0100
Subject: [PATCH 0665/1835] xhci: implement xhci_fixup_endpoint for interval
 adjustments

Must be called in a non-atomic context, after the endpoint
has been registered with the hardware via xhci_add_endpoint
and before the first URB is submitted for the endpoint.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/usb/host/xhci.c | 98 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 98 insertions(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e9edd823fe91d..8a15d2880f384 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1415,6 +1415,103 @@ command_cleanup:
 	return ret;
 }
 
+/*
+ * RPI: Fixup endpoint intervals when requested
+ * - Check interval versus the (cached) endpoint context
+ * - set the endpoint interval to the new value
+ * - force an endpoint configure command
+ * XXX: bandwidth is not recalculated. We should probably do that.
+ */
+static void xhci_fixup_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
+				struct usb_host_endpoint *ep, int interval)
+{
+	struct xhci_hcd *xhci;
+	struct xhci_ep_ctx *ep_ctx_out, *ep_ctx_in;
+	struct xhci_command *command;
+	struct xhci_input_control_ctx *ctrl_ctx;
+	struct xhci_virt_device *vdev;
+	int xhci_interval;
+	int ret;
+	int ep_index;
+	unsigned long flags;
+	u32 ep_info_tmp;
+
+	xhci = hcd_to_xhci(hcd);
+	ep_index = xhci_get_endpoint_index(&ep->desc);
+
+	/* FS/LS interval translations */
+	if ((udev->speed == USB_SPEED_FULL ||
+	     udev->speed == USB_SPEED_LOW))
+		interval *= 8;
+
+	mutex_lock(&xhci->mutex);
+
+	spin_lock_irqsave(&xhci->lock, flags);
+
+	vdev = xhci->devs[udev->slot_id];
+	/* Get context-derived endpoint interval */
+	ep_ctx_out = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+	ep_ctx_in = xhci_get_ep_ctx(xhci, vdev->in_ctx, ep_index);
+	xhci_interval = EP_INTERVAL_TO_UFRAMES(le32_to_cpu(ep_ctx_out->ep_info));
+
+	if (interval == xhci_interval) {
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		mutex_unlock(&xhci->mutex);
+		return;
+	}
+
+	xhci_dbg(xhci, "Fixup interval=%d xhci_interval=%d\n",
+		 interval, xhci_interval);
+	command = xhci_alloc_command_with_ctx(xhci, true, GFP_ATOMIC);
+	if (!command) {
+		/* Failure here is benign, poll at the original rate */
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		mutex_unlock(&xhci->mutex);
+		return;
+	}
+
+	/* xHCI uses exponents for intervals... */
+	xhci_interval = fls(interval) - 1;
+	xhci_interval = clamp_val(xhci_interval, 3, 10);
+	ep_info_tmp = le32_to_cpu(ep_ctx_out->ep_info);
+	ep_info_tmp &= ~EP_INTERVAL(255);
+	ep_info_tmp |= EP_INTERVAL(xhci_interval);
+
+	/* Keep the endpoint context up-to-date while issuing the command. */
+	xhci_endpoint_copy(xhci, vdev->in_ctx,
+			   vdev->out_ctx, ep_index);
+	ep_ctx_in->ep_info = cpu_to_le32(ep_info_tmp);
+
+	/*
+	 * We need to drop the lock, so take an explicit copy
+	 * of the ep context.
+	 */
+	xhci_endpoint_copy(xhci, command->in_ctx, vdev->in_ctx, ep_index);
+
+	ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
+	if (!ctrl_ctx) {
+		xhci_warn(xhci,
+			  "%s: Could not get input context, bad type.\n",
+			  __func__);
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		xhci_free_command(xhci, command);
+		mutex_unlock(&xhci->mutex);
+		return;
+	}
+	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
+	ctrl_ctx->drop_flags = 0;
+
+	spin_unlock_irqrestore(&xhci->lock, flags);
+
+	ret = xhci_configure_endpoint(xhci, udev, command,
+				      false, false);
+	if (ret)
+		xhci_warn(xhci, "%s: Configure endpoint failed: %d\n",
+			  __func__, ret);
+	xhci_free_command(xhci, command);
+	mutex_unlock(&xhci->mutex);
+}
+
 /*
  * non-error returns are a promise to giveback() the urb later
  * we drop ownership so next owner (or urb unlink) can get it
@@ -5165,6 +5262,7 @@ static const struct hc_driver xhci_hc_driver = {
 	.endpoint_reset =	xhci_endpoint_reset,
 	.check_bandwidth =	xhci_check_bandwidth,
 	.reset_bandwidth =	xhci_reset_bandwidth,
+	.fixup_endpoint =	xhci_fixup_endpoint,
 	.address_device =	xhci_address_device,
 	.enable_device =	xhci_enable_device,
 	.update_hub_device =	xhci_update_hub_device,
-- 
GitLab


From b5aa35de5be0cd8975aeb852b900cfd07e26ee85 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 11 Jun 2019 11:42:03 +0100
Subject: [PATCH 0666/1835] usbhid: call usb_fixup_endpoint after mangling
 intervals

Lets the mousepoll override mechanism work with xhci.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/hid/usbhid/hid-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 0fbdb8291eac3..0c28a3f93fa96 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1118,6 +1118,7 @@ static int usbhid_start(struct hid_device *hid)
 				interval = hid_kbpoll_interval;
 			break;
 		}
+		usb_fixup_endpoint(dev, endpoint->bEndpointAddress, interval);
 
 		ret = -ENOMEM;
 		if (usb_endpoint_dir_in(endpoint)) {
-- 
GitLab


From 34c5488a55f93187428c0979d26a3361b11ca314 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 4 Jun 2019 12:14:30 +0100
Subject: [PATCH 0667/1835] drm: vc4: Add status of which display is updated
 through vblank

Previously multiple  displays were slaved off the same SMI
interrupt, triggered by HVS channel 1 (HDMI0).
This doesn't work if you only have a DPI or DSI screen (HVS channel
0), and gives slightly erroneous results with dual HDMI as the
events for HDMI1 are incorrect.

Use SMIDSW0 and SMIDSW1 registers to denote which display has
triggered the vblank.
Handling should be backwards compatible with older firmware.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 41 ++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index a78662f5707d6..e2c5eaa70c78d 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -230,8 +230,13 @@ static const struct vc_image_format *vc4_get_vc_image_fmt(u32 drm_format)
  * hardware, which has only this one register.
  */
 #define SMICS 0x0
+#define SMIDSW0 0x14
+#define SMIDSW1 0x1C
 #define SMICS_INTERRUPTS (BIT(9) | BIT(10) | BIT(11))
 
+/* Flag to denote that the firmware is giving multiple display callbacks */
+#define SMI_NEW 0xabcd0000
+
 #define vc4_crtc vc4_kms_crtc
 #define to_vc4_crtc to_vc4_kms_crtc
 struct vc4_crtc {
@@ -884,16 +889,42 @@ static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 	int i;
 	u32 stat = readl(crtc_list[0]->regs + SMICS);
 	irqreturn_t ret = IRQ_NONE;
+	u32 chan;
 
 	if (stat & SMICS_INTERRUPTS) {
 		writel(0, crtc_list[0]->regs + SMICS);
 
-		for (i = 0; crtc_list[i]; i++) {
-			if (crtc_list[i]->vblank_enabled)
-				drm_crtc_handle_vblank(&crtc_list[i]->base);
-			vc4_crtc_handle_page_flip(crtc_list[i]);
-			ret = IRQ_HANDLED;
+		chan = readl(crtc_list[0]->regs + SMIDSW0);
+
+		if ((chan & 0xFFFF0000) != SMI_NEW) {
+			/* Older firmware. Treat the one interrupt as vblank/
+			 * complete for all crtcs.
+			 */
+			for (i = 0; crtc_list[i]; i++) {
+				if (crtc_list[i]->vblank_enabled)
+					drm_crtc_handle_vblank(&crtc_list[i]->base);
+				vc4_crtc_handle_page_flip(crtc_list[i]);
+			}
+		} else {
+			if (chan & 1) {
+				writel(SMI_NEW, crtc_list[0]->regs + SMIDSW0);
+				if (crtc_list[0]->vblank_enabled)
+					drm_crtc_handle_vblank(&crtc_list[0]->base);
+				vc4_crtc_handle_page_flip(crtc_list[0]);
+			}
+
+			/* Check for the secondary display too */
+			chan = readl(crtc_list[0]->regs + SMIDSW1);
+
+			if (chan & 1) {
+				writel(SMI_NEW, crtc_list[0]->regs + SMIDSW1);
+				if (crtc_list[1]->vblank_enabled)
+					drm_crtc_handle_vblank(&crtc_list[1]->base);
+				vc4_crtc_handle_page_flip(crtc_list[1]);
+			}
 		}
+
+		ret = IRQ_HANDLED;
 	}
 
 	return ret;
-- 
GitLab


From b220176ffc691bb74455ffb1b77ebd30aa12d89f Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 12 Jun 2019 17:13:21 +0100
Subject: [PATCH 0668/1835] drm/vc4: In FKMS look at the modifiers correctly
 for SAND

Incorrect masking was used in the switch for the modifier,
therefore for SAND (which puts the column pitch in the
modifier) it didn't match.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index e2c5eaa70c78d..6e9a20f542003 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -460,7 +460,7 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 	}
 	mb->plane.planes[3] = 0;
 
-	switch (fb->modifier) {
+	switch (fourcc_mod_broadcom_mod(fb->modifier)) {
 	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
 		switch (mb->plane.vc_image_type) {
 		case VC_IMAGE_XRGB8888:
@@ -476,6 +476,9 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 		break;
 	case DRM_FORMAT_MOD_BROADCOM_SAND128:
 		mb->plane.vc_image_type = VC_IMAGE_YUV_UV;
+		/* Note that the column pitch is passed across in lines, not
+		 * bytes.
+		 */
 		mb->plane.pitch = fourcc_mod_broadcom_param(fb->modifier);
 		break;
 	}
-- 
GitLab


From cd025a505c3857277c15bf50d1c4fadd9f038b93 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 17 Jun 2019 10:06:55 +0100
Subject: [PATCH 0669/1835] arm: dts: Fix Pi4 PWR LED configuration

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 92ac213649a79..240b8cca11518 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -126,13 +126,13 @@
 	act_led: act {
 		label = "led0";
 		linux,default-trigger = "mmc0";
-		gpios = <&gpio 42 0>;
+		gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
 	};
 
 	pwr_led: pwr {
 		label = "led1";
-		linux,default-trigger = "input";
-		gpios = <&expgpio 2 0>;
+		linux,default-trigger = "default-on";
+		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
 	};
 };
 
-- 
GitLab


From 05463ad37e96c542d5f70e4353c2fdd66bf8a180 Mon Sep 17 00:00:00 2001
From: dp111 <dominic.plunkett@gmail.com>
Date: Sat, 15 Jun 2019 18:19:50 +0100
Subject: [PATCH 0670/1835] bcm2838.dtsi : Correct gic400 memory address ranges

It appears to me the addresses for the gic400 are slightly wrong .  See section 3.2 https://static.docs.arm.com/ddi0471/a/DDI0471A_gic400_r0p0_trm.pdf
---
 arch/arm/boot/dts/bcm2838.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2838.dtsi b/arch/arm/boot/dts/bcm2838.dtsi
index 0cbe998a67d6e..fa8a94943fda8 100644
--- a/arch/arm/boot/dts/bcm2838.dtsi
+++ b/arch/arm/boot/dts/bcm2838.dtsi
@@ -30,8 +30,8 @@
 			compatible = "arm,gic-400";
 			reg =	<0x40041000 0x1000>,
 				<0x40042000 0x2000>,
-				<0x40046000 0x2000>,
-				<0x40048000 0x2000>;
+				<0x40044000 0x2000>,
+				<0x40046000 0x2000>;
 		};
 
 		thermal: thermal@7d5d2200 {
-- 
GitLab


From cbb5c28ea278cab430f20c4584397a4dcfe0fb93 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 18 Jun 2019 12:15:50 +0100
Subject: [PATCH 0671/1835] staging: vchiq: Use the old dma controller for OF
 config on platform devices

vchiq on Pi4 is no longer under the soc node, therefore it
doesn't get the dma-ranges for the VPU.

Switch to using the configuration of the old dma controller as
that will set the dma-ranges correctly.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../interface/vchiq_arm/vchiq_arm.c             | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 4bc1d47380692..f0578074af70a 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -3599,6 +3599,7 @@ vchiq_register_child(struct platform_device *pdev, const char *name)
 {
 	struct platform_device_info pdevinfo;
 	struct platform_device *new_dev;
+	struct device_node *np;
 
 	memset(&pdevinfo, 0, sizeof(pdevinfo));
 
@@ -3612,10 +3613,20 @@ vchiq_register_child(struct platform_device *pdev, const char *name)
 		return NULL;
 
 	/*
-	 * We want the dma-ranges etc to be copied from the parent VCHIQ device
-	 * to be passed on to the children too.
+	 * We want the dma-ranges etc to be copied from a device with the
+	 * correct dma-ranges for the VPU.
+	 * VCHIQ on Pi4 is now under scb which doesn't get those dma-ranges.
+	 * Take the "dma" node as going to be suitable as it sees the world
+	 * through the same eyes as the VPU.
 	 */
-	of_dma_configure(&new_dev->dev, pdev->dev.of_node, true);
+	np = of_find_node_by_path("dma");
+	if (!np)
+		np = pdev->dev.of_node;
+
+	of_dma_configure(&new_dev->dev, np, true);
+
+	if (np != pdev->dev.of_node)
+		of_node_put(np);
 
 	return new_dev;
 }
-- 
GitLab


From 883a1a5bf14abc9b3a014a3907772cd0b3129c8a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 18 Jun 2019 21:37:45 +0100
Subject: [PATCH 0672/1835] drm/vc4: Limit fkms to modes <= 85Hz

Selecting 1080p100 and 120 has very limited gain, but don't want
to block VGA85 and similar.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 6e9a20f542003..b5959abecf1ab 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -822,6 +822,10 @@ vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 		return MODE_NO_DBLESCAN;
 	}
 
+	/* Disable refresh rates > 85Hz as limited gain from them */
+	if (drm_mode_vrefresh(mode) > 85)
+		return MODE_BAD_VVALUE;
+
 	/* Limit the pixel clock based on the HDMI clock limits from the
 	 * firmware
 	 */
-- 
GitLab


From d2a34acaa98cd80b787fa15b7cc6e940c8673917 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 11 Jun 2019 17:38:28 +0100
Subject: [PATCH 0673/1835] arm: bcm2835: Add bcm2838 compatible string.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/mach-bcm/board_bcm2835.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-bcm/board_bcm2835.c b/arch/arm/mach-bcm/board_bcm2835.c
index fd6c7130bfb6d..3784ce541113c 100644
--- a/arch/arm/mach-bcm/board_bcm2835.c
+++ b/arch/arm/mach-bcm/board_bcm2835.c
@@ -118,6 +118,7 @@ static const char * const bcm2835_compat[] = {
 #ifdef CONFIG_ARCH_MULTI_V7
 	"brcm,bcm2836",
 	"brcm,bcm2837",
+	"brcm,bcm2838",
 #endif
 	NULL
 };
-- 
GitLab


From 906feb823cd0dfdf42c02dc362216f370530ef53 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 4 Jun 2019 16:22:22 +0100
Subject: [PATCH 0674/1835] arm: dts: Improve the bcm27xx inclusion hierarchy

1) The top-level .dts files now include parallel chains of bcm27xx.dtsi
   and bcm27xx-rpi.dtsi files, with no cross-inclusion between the two
   chains.

2) Move definitions and deletions to the point of maximum commonality
   to reduce redundancy.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2708-rpi-b-plus.dts   |  1 +
 arch/arm/boot/dts/bcm2708-rpi-b.dts        |  1 +
 arch/arm/boot/dts/bcm2708-rpi-cm.dtsi      |  1 +
 arch/arm/boot/dts/bcm2708-rpi-zero-w.dts   |  1 +
 arch/arm/boot/dts/bcm2708-rpi-zero.dts     |  1 +
 arch/arm/boot/dts/bcm2708-rpi.dtsi         | 63 +++++++---------------
 arch/arm/boot/dts/bcm2708.dtsi             |  1 -
 arch/arm/boot/dts/bcm2709-rpi-2-b.dts      |  1 +
 arch/arm/boot/dts/bcm2709.dtsi             |  1 -
 arch/arm/boot/dts/bcm270x.dtsi             | 18 +------
 arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts |  1 +
 arch/arm/boot/dts/bcm2710-rpi-3-b.dts      |  1 +
 arch/arm/boot/dts/bcm2710-rpi-cm3.dts      |  1 +
 arch/arm/boot/dts/bcm2710.dtsi             |  1 -
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts      | 15 ++++--
 arch/arm/boot/dts/bcm2711-rpi.dtsi         |  7 +++
 arch/arm/boot/dts/bcm2711.dtsi             | 10 ----
 arch/arm/boot/dts/bcm2835-rpi.dtsi         | 16 ++++++
 arch/arm/boot/dts/bcm2838.dtsi             | 33 ++++++++----
 arch/arm/boot/dts/bcm283x.dtsi             |  2 +-
 20 files changed, 86 insertions(+), 90 deletions(-)
 create mode 100644 arch/arm/boot/dts/bcm2711-rpi.dtsi

diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
index ef0beea3a3a38..b2b8e5c9d5823 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2708.dtsi"
+#include "bcm2708-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b.dts b/arch/arm/boot/dts/bcm2708-rpi-b.dts
index dea70fae90e64..3f9a8e4cfe8f5 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-b.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2708.dtsi"
+#include "bcm2708-rpi.dtsi"
 #include "bcm283x-rpi-smsc9512.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
index d0299e3d9a09d..dce160f420fdc 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
@@ -1,4 +1,5 @@
 #include "bcm2708.dtsi"
+#include "bcm2708-rpi.dtsi"
 
 &leds {
 	act_led: act {
diff --git a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
index 087f39106bef0..92f780a3e5577 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-zero-w.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2708.dtsi"
+#include "bcm2708-rpi.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
diff --git a/arch/arm/boot/dts/bcm2708-rpi-zero.dts b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
index dba3ece8eac5b..2909ddeafc833 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-zero.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-zero.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2708.dtsi"
+#include "bcm2708-rpi.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
index a267807f3d6fa..6a82591c51d19 100644
--- a/arch/arm/boot/dts/bcm2708-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -1,6 +1,6 @@
-/* Downstream version of bcm2835-rpi.dtsi */
+/* Downstream modifications to bcm2835-rpi.dtsi */
 
-#include <dt-bindings/power/raspberrypi-power.h>
+#include "bcm2835-rpi.dtsi"
 
 / {
 	memory {
@@ -49,29 +49,10 @@
 			reg = <0x7e200000 0x1000>;
 		};
 
-		firmware: firmware {
-			compatible = "raspberrypi,bcm2835-firmware", "simple-bus";
-			#address-cells = <0>;
-			#size-cells = <0>;
-			mboxes = <&mailbox>;
-		};
-
-		power: power {
-			compatible = "raspberrypi,bcm2835-power";
-			firmware = <&firmware>;
-			#power-domain-cells = <1>;
-		};
-
 		fb: fb {
 			compatible = "brcm,bcm2708-fb";
 			firmware = <&firmware>;
-			status = "disabled";
-		};
-
-		vchiq: mailbox@7e00b840 {
-			compatible = "brcm,bcm2835-vchiq";
-			reg = <0x7e00b840 0x3c>;
-			interrupts = <0 2>;
+			status = "okay";
 		};
 
 		vcsm: vcsm {
@@ -91,10 +72,6 @@
 		sound: sound {
 			status = "disabled";
 		};
-
-		txp: txp@7e004000 {
-			status = "disabled";
-		};
 	};
 
 	__overrides__ {
@@ -125,11 +102,23 @@
 };
 
 &hdmi {
-	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
+	status = "disabled";
 };
 
-&usb {
-	power-domains = <&power RPI_POWER_DOMAIN_USB>;
+&txp {
+	status = "disabled";
+};
+
+&i2c0 {
+	status = "disabled";
+};
+
+&i2c1 {
+	status = "disabled";
+};
+
+&i2c2 {
+	status = "disabled";
 };
 
 &clocks {
@@ -141,16 +130,8 @@ sdhost_pins: &sdhost_gpio48 {
 };
 
 &sdhost {
-	pinctrl-names = "default";
-	pinctrl-0 = <&sdhost_gpio48>;
-	bus-width = <4>;
 	brcm,overclock-50 = <0>;
 	brcm,pio-limit = <1>;
-	status = "okay";
-};
-
-&fb {
-	status = "okay";
 };
 
 &cpu_thermal {
@@ -160,11 +141,3 @@ sdhost_pins: &sdhost_gpio48 {
 &vec {
 	status = "disabled";
 };
-
-&csi0 {
-	power-domains = <&power RPI_POWER_DOMAIN_UNICAM0>;
-};
-
-&csi1 {
-	power-domains = <&power RPI_POWER_DOMAIN_UNICAM1>;
-};
diff --git a/arch/arm/boot/dts/bcm2708.dtsi b/arch/arm/boot/dts/bcm2708.dtsi
index 768c7da10f0eb..16a637363b5df 100644
--- a/arch/arm/boot/dts/bcm2708.dtsi
+++ b/arch/arm/boot/dts/bcm2708.dtsi
@@ -1,6 +1,5 @@
 #include "bcm2835.dtsi"
 #include "bcm270x.dtsi"
-#include "bcm2708-rpi.dtsi"
 
 / {
 	/delete-node/ cpus;
diff --git a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
index 34659505055aa..4d2262f8d376b 100644
--- a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
+++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2709.dtsi"
+#include "bcm2709-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2709.dtsi b/arch/arm/boot/dts/bcm2709.dtsi
index 9354bcc26cd84..8bc67c0aaff17 100644
--- a/arch/arm/boot/dts/bcm2709.dtsi
+++ b/arch/arm/boot/dts/bcm2709.dtsi
@@ -1,6 +1,5 @@
 #include "bcm2836.dtsi"
 #include "bcm270x.dtsi"
-#include "bcm2709-rpi.dtsi"
 
 / {
 	soc {
diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
index 3b6c101dcd916..9eb6becfbe411 100644
--- a/arch/arm/boot/dts/bcm270x.dtsi
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -68,7 +68,7 @@
 
 		/delete-node/ sdhci@7e300000;
 
-		mmc: mmc@7e300000 {
+		sdhci: mmc: mmc@7e300000 {
 			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
 			reg = <0x7e300000 0x100>;
 			interrupts = <2 30>;
@@ -152,22 +152,6 @@
 		};
 	};
 
-	vdd_5v0_reg: fixedregulator_5v0 {
-		compatible = "regulator-fixed";
-		regulator-name = "5v0";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		regulator-always-on;
-	};
-
-	vdd_3v3_reg: fixedregulator_3v3 {
-		compatible = "regulator-fixed";
-		regulator-name = "3v3";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		regulator-always-on;
-	};
-
 	__overrides__ {
 		cam0-pwdn-ctrl;
 		cam0-pwdn;
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
index 6e526d7e49893..55420ac94dcfa 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2710.dtsi"
+#include "bcm2709-rpi.dtsi"
 #include "bcm283x-rpi-lan7515.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
index 9d77cb1e9b0b8..261827cdb957c 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2710.dtsi"
+#include "bcm2709-rpi.dtsi"
 #include "bcm283x-rpi-smsc9514.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
index 9490177443a5e..14a37ffda8557 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -1,6 +1,7 @@
 /dts-v1/;
 
 #include "bcm2710.dtsi"
+#include "bcm2709-rpi.dtsi"
 #include "bcm283x-rpi-csi0-2lane.dtsi"
 #include "bcm283x-rpi-csi1-4lane.dtsi"
 
diff --git a/arch/arm/boot/dts/bcm2710.dtsi b/arch/arm/boot/dts/bcm2710.dtsi
index fda5d26c68447..5c45ded273fe3 100644
--- a/arch/arm/boot/dts/bcm2710.dtsi
+++ b/arch/arm/boot/dts/bcm2710.dtsi
@@ -1,6 +1,5 @@
 #include "bcm2837.dtsi"
 #include "bcm270x.dtsi"
-#include "bcm2709-rpi.dtsi"
 
 / {
 	compatible = "brcm,bcm2837", "brcm,bcm2836";
diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 240b8cca11518..5addb6130fa70 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -1,13 +1,12 @@
 /dts-v1/;
 
 #include "bcm2711.dtsi"
+#include "bcm2711-rpi.dtsi"
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
-	compatible = "raspberrypi,4-model-b", "brcm,bcm2838", "brcm,bcm2837";
+	compatible = "raspberrypi,4-model-b", "brcm,bcm2838";
 	model = "Raspberry Pi 4 Model B";
-	#address-cells = <2>;
-	#size-cells = <1>;
 
 	memory {
 		device_type = "memory";
@@ -48,10 +47,18 @@
 };
 
 &firmware {
-	expgpio: expgpio {
+	expgpio: gpio {
 		compatible = "raspberrypi,firmware-gpio";
 		gpio-controller;
 		#gpio-cells = <2>;
+		gpio-line-names = "BT_ON",
+				  "WL_ON",
+				  "PWR_LED_OFF",
+				  "GLOBAL_RESET",
+				  "VDD_SD_IO_SEL",
+				  "CAM_GPIO",
+				  "",
+				  "";
 		status = "okay";
 	};
 };
diff --git a/arch/arm/boot/dts/bcm2711-rpi.dtsi b/arch/arm/boot/dts/bcm2711-rpi.dtsi
new file mode 100644
index 0000000000000..d8ffaab8e86aa
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2711-rpi.dtsi
@@ -0,0 +1,7 @@
+#include "bcm2708-rpi.dtsi"
+#include "bcm2838-rpi.dtsi"
+
+&v3d {
+     /* Undo the overwriting by bcm270x.dtsi */
+     power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
+};
diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
index 767036c91324d..f134aba2badbc 100644
--- a/arch/arm/boot/dts/bcm2711.dtsi
+++ b/arch/arm/boot/dts/bcm2711.dtsi
@@ -1,10 +1,8 @@
 #include "bcm2838.dtsi"
 #include "bcm270x.dtsi"
-#include "bcm2708-rpi.dtsi"
 
 / {
 	soc {
-		/delete-node/ mailbox@7e00b840;
 		/delete-node/ v3d@7ec00000;
 	};
 
@@ -17,14 +15,6 @@
 	status = "disabled";
 };
 
-&dma {
-	brcm,dma-channel-mask = <0x7ef5>;
-};
-
-&txp {
-	interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
-};
-
 &firmwarekms {
 	interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
 };
diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index f3d7474159279..e8e16a919687a 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -36,6 +36,22 @@
 			interrupts = <0 2>;
 		};
 	};
+
+	vdd_3v3_reg: fixedregulator_3v3 {
+		compatible = "regulator-fixed";
+		regulator-name = "3v3";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-always-on;
+	};
+
+	vdd_5v0_reg: fixedregulator_5v0 {
+		compatible = "regulator-fixed";
+		regulator-name = "5v0";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-always-on;
+	};
 };
 
 &gpio {
diff --git a/arch/arm/boot/dts/bcm2838.dtsi b/arch/arm/boot/dts/bcm2838.dtsi
index fa8a94943fda8..3cecfa62af428 100644
--- a/arch/arm/boot/dts/bcm2838.dtsi
+++ b/arch/arm/boot/dts/bcm2838.dtsi
@@ -5,7 +5,10 @@
 #include <dt-bindings/soc/bcm2835-pm.h>
 
 / {
-	compatible = "brcm,bcm2838", "brcm,bcm2837";
+	compatible = "brcm,bcm2838";
+
+	#address-cells = <2>;
+	#size-cells = <1>;
 
 	interrupt-parent = <&gicv2>;
 
@@ -16,8 +19,8 @@
 		/* Emulate a contiguous 30-bit address range for DMA */
 		dma-ranges = <0xc0000000  0x0 0x00000000  0x3c000000>;
 
-		/delete-node/ mailbox@7e00b840;
 		/delete-node/ interrupt-controller@7e00f300;
+		/delete-node/ v3d@7ec00000;
 
 		local_intc: local_intc@40000000 {
 			compatible = "brcm,bcm2836-l1-intc";
@@ -191,6 +194,16 @@
 			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
+		pwm1: pwm@7e20c800 {
+			compatible = "brcm,bcm2835-pwm";
+			reg = <0x7e20c800 0x28>;
+			clocks = <&clocks BCM2835_CLOCK_PWM>;
+			assigned-clocks = <&clocks BCM2835_CLOCK_PWM>;
+			assigned-clock-rates = <10000000>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
 		emmc2: emmc2@7e340000 {
 			compatible = "brcm,bcm2711-emmc2";
 			status = "okay";
@@ -385,7 +398,7 @@
 				"dma13",
 				"dma14";
 			#dma-cells = <1>;
-			brcm,dma-channel-mask = <0x7000>;
+			brcm,dma-channel-mask = <0x7800>;
 		};
 		/* DMA4 - 40 bit DMA engines */
 
@@ -396,12 +409,6 @@
 			interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
-		vchiq: mailbox@7e00b840 {
-			compatible = "brcm,bcm2838-vchiq";
-			reg = <0 0x7e00b840 0x3c>;
-			interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
-		};
-
 		hevc-decoder@7eb00000 {
 			compatible = "raspberrypi,argon-hevc-decoder";
 			reg = <0x0 0x7eb00000 0x10000>;
@@ -450,6 +457,8 @@
 };
 
 &gpio {
+	compatible = "brcm,bcm2838-gpio", "brcm,bcm2835-gpio";
+
 	gpclk0_gpio49: gpclk0_gpio49 {
 		brcm,pins = <49>;
 		brcm,function = <BCM2835_FSEL_ALT1>;
@@ -729,5 +738,9 @@
 			  "dma8",
 			  "dma9",
 			  "dma10";
-	brcm,dma-channel-mask = <0x01f5>;
+	brcm,dma-channel-mask = <0x07f5>;
+};
+
+&txp {
+	interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
 };
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 9dcadc4e5d97c..914c4c14d714e 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -55,7 +55,7 @@
 		#address-cells = <1>;
 		#size-cells = <1>;
 
-		txp@7e004000 {
+		txp: txp@7e004000 {
 			compatible = "brcm,bcm2835-txp";
 			reg = <0x7e004000 0x20>;
 			interrupts = <1 11>;
-- 
GitLab


From 45b889cb7153d66fbd1942e61e59dac1c7bb1c88 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 11 Jun 2019 18:08:05 +0100
Subject: [PATCH 0675/1835] arm: dts: First draft of upstream Pi4 DTS

I've attempted to follow the upstream conventions in the DT commits,
but this is just presented here initially as a talking point.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/Makefile            |   1 +
 arch/arm/boot/dts/bcm2838-rpi-4-b.dts | 118 ++++++++++++++++++++++++++
 arch/arm/boot/dts/bcm2838-rpi.dtsi    |  25 ++++++
 3 files changed, 144 insertions(+)
 create mode 100644 arch/arm/boot/dts/bcm2838-rpi-4-b.dts
 create mode 100644 arch/arm/boot/dts/bcm2838-rpi.dtsi

diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 86851cd7147ca..c75b6f549b462 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -94,6 +94,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
 	bcm2836-rpi-2-b.dtb \
 	bcm2837-rpi-3-b.dtb \
 	bcm2837-rpi-3-b-plus.dtb \
+	bcm2838-rpi-4-b.dtb \
 	bcm2835-rpi-zero.dtb \
 	bcm2835-rpi-zero-w.dtb
 dtb-$(CONFIG_ARCH_BCM_5301X) += \
diff --git a/arch/arm/boot/dts/bcm2838-rpi-4-b.dts b/arch/arm/boot/dts/bcm2838-rpi-4-b.dts
new file mode 100644
index 0000000000000..c851ba108543a
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2838-rpi-4-b.dts
@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: GPL-2.0
+/dts-v1/;
+#include "bcm2838.dtsi"
+#include "bcm2835-rpi.dtsi"
+#include "bcm2838-rpi.dtsi"
+
+/ {
+	compatible = "raspberrypi,4-model-b", "brcm,bcm2838";
+	model = "Raspberry Pi 4 Model B";
+
+	chosen {
+		/* 8250 auxiliary UART instead of pl011 */
+		stdout-path = "serial1:115200n8";
+	};
+
+	memory {
+		reg = <0 0 0x40000000>;
+	};
+
+	leds {
+		act {
+			gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+		};
+
+		pwr {
+			label = "PWR";
+			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	wifi_pwrseq: wifi-pwrseq {
+		compatible = "mmc-pwrseq-simple";
+		reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+	};
+
+	sd_io_1v8_reg: sd_io_1v8_reg {
+		status = "okay";
+		compatible = "regulator-gpio";
+		vin-supply = <&vdd_5v0_reg>;
+		regulator-name = "vdd-sd-io";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+		regulator-settling-time-us = <5000>;
+
+		gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
+		states = <1800000 0x1
+			  3300000 0x0>;
+	};
+};
+
+&firmware {
+	expgpio: gpio {
+		compatible = "raspberrypi,firmware-gpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-line-names = "BT_ON",
+				  "WL_ON",
+				  "PWR_LED_OFF",
+				  "GLOBAL_RESET",
+				  "VDD_SD_IO_SEL",
+				  "CAM_GPIO",
+				  "",
+				  "";
+		status = "okay";
+	};
+};
+
+&pwm1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm0_gpio40 &pwm1_gpio41>;
+	status = "okay";
+};
+
+/* SDHCI is used to control the SDIO for wireless */
+&sdhci {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&emmc_gpio34>;
+	status = "okay";
+	bus-width = <4>;
+	non-removable;
+	mmc-pwrseq = <&wifi_pwrseq>;
+
+	brcmf: wifi@1 {
+		reg = <1>;
+		compatible = "brcm,bcm4329-fmac";
+	};
+};
+
+/* EMMC2 is used to drive the SD card */
+&emmc2 {
+	status = "okay";
+	broken-cd;
+	vqmmc-supply = <&sd_io_1v8_reg>;
+};
+
+/* uart0 communicates with the BT module */
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_ctsrts_gpio30 &uart0_gpio32 &gpclk2_gpio43>;
+	status = "okay";
+
+	bluetooth {
+		compatible = "brcm,bcm43438-bt";
+		max-speed = <2000000>;
+		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+/* uart1 is mapped to the pin header */
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_gpio14>;
+	status = "okay";
+};
diff --git a/arch/arm/boot/dts/bcm2838-rpi.dtsi b/arch/arm/boot/dts/bcm2838-rpi.dtsi
new file mode 100644
index 0000000000000..140cfa312d1ae
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2838-rpi.dtsi
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/ {
+	soc {
+		/delete-node/ mailbox@7e00b840;
+	};
+};
+
+&scb {
+	vchiq: mailbox@7e00b840 {
+		compatible = "brcm,bcm2838-vchiq";
+		reg = <0 0x7e00b840 0x3c>;
+		interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&dma {
+	/* The VPU firmware uses DMA channel 11 for VCHIQ */
+	brcm,dma-channel-mask = <0x1f5>;
+};
+
+&dma40 {
+	/* The VPU firmware DMA channel 11 for VCHIQ */
+	brcm,dma-channel-mask = <0x7000>;
+};
-- 
GitLab


From 18ec3066b9439c1811ab19f0e16c0b6a51fe4154 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 17 Jun 2019 14:36:12 +0100
Subject: [PATCH 0676/1835] overlays: Fix compatible string for ds1307 RTC

Kernels since 4.19 have required the correct manufacture name in the
compatible string for I2C devices, and unfortunately the one for the
Dallas/Maxim DS1307 should have been "dallas,ds1307" and not
"maxim,ds1307".

See: https://github.com/raspberrypi/linux/issues/3013

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
index 1672e7d2f282c..00f376415026d 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -30,7 +30,7 @@
 			status = "okay";
 
 			ds1307: ds1307@68 {
-				compatible = "maxim,ds1307";
+				compatible = "dallas,ds1307";
 				reg = <0x68>;
 				status = "okay";
 			};
-- 
GitLab


From f5315c901bd7ab58d683a6bad621f9c123fc47f3 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 18 Jun 2019 11:16:13 +0100
Subject: [PATCH 0677/1835] overlays: Fix further maxim,ds1307 references

See: https://github.com/raspberrypi/linux/issues/3013

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/balena-fin-overlay.dts   | 2 +-
 arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts | 2 +-
 arch/arm/boot/dts/overlays/tinylcd35-overlay.dts    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
index 8c1cba99fc8f5..249c8202b2ed4 100644
--- a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
+++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
@@ -84,7 +84,7 @@
 
 			// rtc clock
 			ds1307: ds1307@68 {
-				compatible = "maxim,ds1307";
+				compatible = "dallas,ds1307";
 				reg = <0x68>;
 				status = "okay";
 			};
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
index 3b19993bcbe9a..d647d88d212a5 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
@@ -46,7 +46,7 @@
 			status = "okay";
 
 			ds1307: ds1307@68 {
-				compatible = "maxim,ds1307";
+				compatible = "dallas,ds1307";
 				reg = <0x68>;
 				status = "okay";
 			};
diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
index 5ed6982d02391..254ac2e0a2144 100644
--- a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
+++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
@@ -155,7 +155,7 @@
 			status = "okay";
 
 			ds1307: ds1307@68 {
-				compatible = "maxim,ds1307";
+				compatible = "dallas,ds1307";
 				reg = <0x68>;
 				status = "okay";
 			};
-- 
GitLab


From 71d47f4c4bd7fd395b87c474498187b2f9be8751 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 18 Jun 2019 11:19:59 +0100
Subject: [PATCH 0678/1835] overlays: Cosmetic change to upstream overlay

The dwc2 overlay no longer uses the dwc2_usb label, and the latest
ovmerge (which generates the upstream overlay) removes unused labels.
Update the checked-in version to match.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/upstream-overlay.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
index 1e069f3672f4a..48e0ef61952c6 100644
--- a/arch/arm/boot/dts/overlays/upstream-overlay.dts
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -113,7 +113,7 @@
 		target = <&usb>;
 		#address-cells = <1>;
 		#size-cells = <1>;
-		dwc2_usb: __overlay__ {
+		__overlay__ {
 			compatible = "brcm,bcm2835-usb";
 			dr_mode = "otg";
 			g-np-tx-fifo-size = <32>;
-- 
GitLab


From 211785e0ac722faad9af7a8d2d95f5cd34d3dda2 Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Sat, 25 May 2019 10:45:38 +0200
Subject: [PATCH 0679/1835] w1: ds2805: rename w1_family struct, fixing c-p
 typo

commit 0e3743d870711ae4daf1e7170c8d9381564e244d upstream.

The ds2805 has a structure named: w1_family_2d, which surely
comes from a w1_ds2431 module. This commit fixes this name to
prevent confusion and mark a correct family name.

Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2805.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/w1/slaves/w1_ds2805.c b/drivers/w1/slaves/w1_ds2805.c
index 29348d283a655..ab349604531a4 100644
--- a/drivers/w1/slaves/w1_ds2805.c
+++ b/drivers/w1/slaves/w1_ds2805.c
@@ -288,7 +288,7 @@ static struct w1_family_ops w1_f0d_fops = {
 	.remove_slave   = w1_f0d_remove_slave,
 };
 
-static struct w1_family w1_family_2d = {
+static struct w1_family w1_family_0d = {
 	.fid = W1_EEPROM_DS2805,
 	.fops = &w1_f0d_fops,
 };
@@ -296,13 +296,13 @@ static struct w1_family w1_family_2d = {
 static int __init w1_f0d_init(void)
 {
 	pr_info("%s()\n", __func__);
-	return w1_register_family(&w1_family_2d);
+	return w1_register_family(&w1_family_0d);
 }
 
 static void __exit w1_f0d_fini(void)
 {
 	pr_info("%s()\n", __func__);
-	w1_unregister_family(&w1_family_2d);
+	w1_unregister_family(&w1_family_0d);
 }
 
 module_init(w1_f0d_init);
-- 
GitLab


From 73493781df0ef080465193443dcd77acd08c235b Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Mon, 20 May 2019 09:05:55 +0200
Subject: [PATCH 0680/1835] w1: ds2413: output_write() cosmetic fixes /
 simplify

commit ae2ee27aa985232f66421d7cd1c7f4b87c7dba7d upstream.

Make the output_write simpler.
Based on Jean-Francois Dagenais code from:
49695ac46861 ("w1: ds2408: reset on output_write retry with readback")

Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2413.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/w1/slaves/w1_ds2413.c b/drivers/w1/slaves/w1_ds2413.c
index 492e3d010321d..cd3763df69ac5 100644
--- a/drivers/w1/slaves/w1_ds2413.c
+++ b/drivers/w1/slaves/w1_ds2413.c
@@ -69,6 +69,7 @@ static ssize_t output_write(struct file *filp, struct kobject *kobj,
 	struct w1_slave *sl = kobj_to_w1_slave(kobj);
 	u8 w1_buf[3];
 	unsigned int retries = W1_F3A_RETRIES;
+	ssize_t bytes_written = -EIO;
 
 	if (count != 1 || off != 0)
 		return -EFAULT;
@@ -78,7 +79,7 @@ static ssize_t output_write(struct file *filp, struct kobject *kobj,
 	dev_dbg(&sl->dev, "mutex locked");
 
 	if (w1_reset_select_slave(sl))
-		goto error;
+		goto out;
 
 	/* according to the DS2413 datasheet the most significant 6 bits
 	   should be set to "1"s, so do it now */
@@ -91,18 +92,20 @@ static ssize_t output_write(struct file *filp, struct kobject *kobj,
 		w1_write_block(sl->master, w1_buf, 3);
 
 		if (w1_read_8(sl->master) == W1_F3A_SUCCESS_CONFIRM_BYTE) {
-			mutex_unlock(&sl->master->bus_mutex);
-			dev_dbg(&sl->dev, "mutex unlocked, retries:%d", retries);
-			return 1;
+			bytes_written = 1;
+			goto out;
 		}
 		if (w1_reset_resume_command(sl->master))
-			goto error;
+			goto out; /* unrecoverable error */
+
+		dev_warn(&sl->dev, "PIO_ACCESS_WRITE error, retries left: %d\n", retries);
 	}
 
-error:
+out:
 	mutex_unlock(&sl->master->bus_mutex);
-	dev_dbg(&sl->dev, "mutex unlocked in error, retries:%d", retries);
-	return -EIO;
+	dev_dbg(&sl->dev, "%s, mutex unlocked, retries: %d\n",
+		(bytes_written > 0) ? "succeeded" : "error", retries);
+	return bytes_written;
 }
 
 static BIN_ATTR(output, S_IRUGO | S_IWUSR | S_IWGRP, NULL, output_write, 1);
-- 
GitLab


From 55a3cf636741690dd12b9c57512a09ae999b5fc1 Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Mon, 20 May 2019 09:05:56 +0200
Subject: [PATCH 0681/1835] w1: ds2413: add retry support to state_read()

commit c50d09a86172073f55ebac0b92ad5a75907d64e7 upstream.

The state_read() was calling PIO_ACCESS_READ once and bail out if it
failed for this first time.
This commit is improving this to trying more times before it give up,
similarly as the write call is currently doing.

Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2413.c | 37 +++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/drivers/w1/slaves/w1_ds2413.c b/drivers/w1/slaves/w1_ds2413.c
index cd3763df69ac5..d63778c705685 100644
--- a/drivers/w1/slaves/w1_ds2413.c
+++ b/drivers/w1/slaves/w1_ds2413.c
@@ -30,6 +30,9 @@ static ssize_t state_read(struct file *filp, struct kobject *kobj,
 			  size_t count)
 {
 	struct w1_slave *sl = kobj_to_w1_slave(kobj);
+	unsigned int retries = W1_F3A_RETRIES;
+	ssize_t bytes_read = -EIO;
+
 	dev_dbg(&sl->dev,
 		"Reading %s kobj: %p, off: %0#10x, count: %zu, buff addr: %p",
 		bin_attr->attr.name, kobj, (unsigned int)off, count, buf);
@@ -42,22 +45,30 @@ static ssize_t state_read(struct file *filp, struct kobject *kobj,
 	mutex_lock(&sl->master->bus_mutex);
 	dev_dbg(&sl->dev, "mutex locked");
 
-	if (w1_reset_select_slave(sl)) {
-		mutex_unlock(&sl->master->bus_mutex);
-		return -EIO;
-	}
+	if (w1_reset_select_slave(sl))
+		goto out;
 
-	w1_write_8(sl->master, W1_F3A_FUNC_PIO_ACCESS_READ);
-	*buf = w1_read_8(sl->master);
+	while (retries--) {
+		w1_write_8(sl->master, W1_F3A_FUNC_PIO_ACCESS_READ);
 
-	mutex_unlock(&sl->master->bus_mutex);
-	dev_dbg(&sl->dev, "mutex unlocked");
+		*buf = w1_read_8(sl->master);
+		/* check for correct complement */
+		if ((*buf & 0x0F) == ((~*buf >> 4) & 0x0F)) {
+			bytes_read = 1;
+			goto out;
+		}
 
-	/* check for correct complement */
-	if ((*buf & 0x0F) != ((~*buf >> 4) & 0x0F))
-		return -EIO;
-	else
-		return 1;
+		if (w1_reset_resume_command(sl->master))
+			goto out; /* unrecoverable error */
+
+		dev_warn(&sl->dev, "PIO_ACCESS_READ error, retries left: %d\n", retries);
+	}
+
+out:
+	mutex_unlock(&sl->master->bus_mutex);
+	dev_dbg(&sl->dev, "%s, mutex unlocked, retries: %d\n",
+		(bytes_read > 0) ? "succeeded" : "error", retries);
+	return bytes_read;
 }
 
 static BIN_ATTR_RO(state, 1);
-- 
GitLab


From eb7c93f1db6a1e2b83d197afe79ed35ed406e953 Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Wed, 22 May 2019 12:40:53 +0200
Subject: [PATCH 0682/1835] w1: ds2413: when the slave is not responding during
 read, select it again

commit 3856032a0628e6b94badb9131a706dda185e071d upstream.

The protocol is not allowing to obtain a byte of 0xff for PIO_ACCESS_READ
call. It is very likely that the slave was not addressed properly and
it is just not respoding (leaving the bus in logic high state) during
the read of sampled PIO value.
We cannot just call w1_reset_resume_command() because the problem will
persist, instead try selecting (addressing) the slave again.

Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2413.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/w1/slaves/w1_ds2413.c b/drivers/w1/slaves/w1_ds2413.c
index d63778c705685..21f08ac8a4e09 100644
--- a/drivers/w1/slaves/w1_ds2413.c
+++ b/drivers/w1/slaves/w1_ds2413.c
@@ -24,6 +24,7 @@
 #define W1_F3A_FUNC_PIO_ACCESS_READ        0xF5
 #define W1_F3A_FUNC_PIO_ACCESS_WRITE       0x5A
 #define W1_F3A_SUCCESS_CONFIRM_BYTE        0xAA
+#define W1_F3A_INVALID_PIO_STATE           0xFF
 
 static ssize_t state_read(struct file *filp, struct kobject *kobj,
 			  struct bin_attribute *bin_attr, char *buf, loff_t off,
@@ -45,6 +46,7 @@ static ssize_t state_read(struct file *filp, struct kobject *kobj,
 	mutex_lock(&sl->master->bus_mutex);
 	dev_dbg(&sl->dev, "mutex locked");
 
+next:
 	if (w1_reset_select_slave(sl))
 		goto out;
 
@@ -52,10 +54,15 @@ static ssize_t state_read(struct file *filp, struct kobject *kobj,
 		w1_write_8(sl->master, W1_F3A_FUNC_PIO_ACCESS_READ);
 
 		*buf = w1_read_8(sl->master);
-		/* check for correct complement */
 		if ((*buf & 0x0F) == ((~*buf >> 4) & 0x0F)) {
+			/* complement is correct */
 			bytes_read = 1;
 			goto out;
+		} else if (*buf == W1_F3A_INVALID_PIO_STATE) {
+			/* slave didn't respond, try to select it again */
+			dev_warn(&sl->dev, "slave device did not respond to PIO_ACCESS_READ, " \
+					    "reselecting, retries left: %d\n", retries);
+			goto next;
 		}
 
 		if (w1_reset_resume_command(sl->master))
-- 
GitLab


From 9590e9aa6b1bc7a5946d6dae8c217bbde806133c Mon Sep 17 00:00:00 2001
From: Mariusz Bialonczyk <manio@skyboo.net>
Date: Thu, 30 May 2019 09:51:25 +0200
Subject: [PATCH 0683/1835] w1: ds2413: fix state byte comparision

commit aacd152ecd7b18af5d2d96dea9e7284c1c93abea upstream.

This commit is fixing a smatch warning:
drivers/w1/slaves/w1_ds2413.c:61 state_read() warn: impossible condition '(*buf == 255) => ((-128)-127 == 255)'
by creating additional u8 variable for the bus reading and comparision

Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 3856032a0628 ("w1: ds2413: when the slave is not responding during read, select it again")
Signed-off-by: Mariusz Bialonczyk <manio@skyboo.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/slaves/w1_ds2413.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/w1/slaves/w1_ds2413.c b/drivers/w1/slaves/w1_ds2413.c
index 21f08ac8a4e09..3364ad276b156 100644
--- a/drivers/w1/slaves/w1_ds2413.c
+++ b/drivers/w1/slaves/w1_ds2413.c
@@ -33,6 +33,7 @@ static ssize_t state_read(struct file *filp, struct kobject *kobj,
 	struct w1_slave *sl = kobj_to_w1_slave(kobj);
 	unsigned int retries = W1_F3A_RETRIES;
 	ssize_t bytes_read = -EIO;
+	u8 state;
 
 	dev_dbg(&sl->dev,
 		"Reading %s kobj: %p, off: %0#10x, count: %zu, buff addr: %p",
@@ -53,12 +54,13 @@ next:
 	while (retries--) {
 		w1_write_8(sl->master, W1_F3A_FUNC_PIO_ACCESS_READ);
 
-		*buf = w1_read_8(sl->master);
-		if ((*buf & 0x0F) == ((~*buf >> 4) & 0x0F)) {
+		state = w1_read_8(sl->master);
+		if ((state & 0x0F) == ((~state >> 4) & 0x0F)) {
 			/* complement is correct */
+			*buf = state;
 			bytes_read = 1;
 			goto out;
-		} else if (*buf == W1_F3A_INVALID_PIO_STATE) {
+		} else if (state == W1_F3A_INVALID_PIO_STATE) {
 			/* slave didn't respond, try to select it again */
 			dev_warn(&sl->dev, "slave device did not respond to PIO_ACCESS_READ, " \
 					    "reselecting, retries left: %d\n", retries);
-- 
GitLab


From eb0360356344d8ba633e61936c794aa46a02397f Mon Sep 17 00:00:00 2001
From: Chris Miller <chris@mesl2.co.uk>
Date: Wed, 26 Jun 2019 10:40:30 +0100
Subject: [PATCH 0684/1835] drm: vc4_dsi: Fix DMA channel and memory leak in
 vc4 (#3012)

Signed-off-by: Chris G Miller <chris@creative-electronics.net>
---
 drivers/gpu/drm/vc4/vc4_dsi.c | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c
index 0c607eb33d7e0..e79c436226e02 100644
--- a/drivers/gpu/drm/vc4/vc4_dsi.c
+++ b/drivers/gpu/drm/vc4/vc4_dsi.c
@@ -1536,9 +1536,11 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 	/* DSI1 has a broken AXI slave that doesn't respond to writes
 	 * from the ARM.  It does handle writes from the DMA engine,
 	 * so set up a channel for talking to it.
+	 * Where possible managed resource providers are used, but the DMA channel
+	 * must - if acquired - be explicitly released prior to taking an error exit path.
 	 */
 	if (dsi->port == 1) {
-		dsi->reg_dma_mem = dma_alloc_coherent(dev, 4,
+		dsi->reg_dma_mem = dmam_alloc_coherent(dev, 4,
 						      &dsi->reg_dma_paddr,
 						      GFP_KERNEL);
 		if (!dsi->reg_dma_mem) {
@@ -1557,6 +1559,8 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 			return ret;
 		}
 
+		/* From here on, any error exits must release the dma channel */
+
 		/* Get the physical address of the device's registers.  The
 		 * struct resource for the regs gives us the bus address
 		 * instead.
@@ -1583,7 +1587,7 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 	if (ret) {
 		if (ret != -EPROBE_DEFER)
 			dev_err(dev, "Failed to get interrupt: %d\n", ret);
-		return ret;
+		goto rel_dma_exit;
 	}
 
 	dsi->escape_clock = devm_clk_get(dev, "escape");
@@ -1591,7 +1595,7 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 		ret = PTR_ERR(dsi->escape_clock);
 		if (ret != -EPROBE_DEFER)
 			dev_err(dev, "Failed to get escape clock: %d\n", ret);
-		return ret;
+		goto rel_dma_exit;
 	}
 
 	dsi->pll_phy_clock = devm_clk_get(dev, "phy");
@@ -1599,7 +1603,7 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 		ret = PTR_ERR(dsi->pll_phy_clock);
 		if (ret != -EPROBE_DEFER)
 			dev_err(dev, "Failed to get phy clock: %d\n", ret);
-		return ret;
+		goto rel_dma_exit;
 	}
 
 	dsi->pixel_clock = devm_clk_get(dev, "pixel");
@@ -1607,7 +1611,7 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 		ret = PTR_ERR(dsi->pixel_clock);
 		if (ret != -EPROBE_DEFER)
 			dev_err(dev, "Failed to get pixel clock: %d\n", ret);
-		return ret;
+		goto rel_dma_exit;
 	}
 
 	ret = drm_of_find_panel_or_bridge(dev->of_node, 0, 0,
@@ -1622,26 +1626,28 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 		if (ret == -ENODEV)
 			return 0;
 
-		return ret;
+		goto rel_dma_exit;
 	}
 
 	if (panel) {
 		dsi->bridge = devm_drm_panel_bridge_add(dev, panel,
 							DRM_MODE_CONNECTOR_DSI);
-		if (IS_ERR(dsi->bridge))
-			return PTR_ERR(dsi->bridge);
+		if (IS_ERR(dsi->bridge)){
+			ret = PTR_ERR(dsi->bridge);
+			goto rel_dma_exit;
+		}
 	}
 
 	/* The esc clock rate is supposed to always be 100Mhz. */
 	ret = clk_set_rate(dsi->escape_clock, 100 * 1000000);
 	if (ret) {
 		dev_err(dev, "Failed to set esc clock: %d\n", ret);
-		return ret;
+		goto rel_dma_exit;
 	}
 
 	ret = vc4_dsi_init_phy_clocks(dsi);
 	if (ret)
-		return ret;
+		goto rel_dma_exit;
 
 	if (dsi->port == 1)
 		vc4->dsi1 = dsi;
@@ -1653,7 +1659,7 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 	ret = drm_bridge_attach(dsi->encoder, dsi->bridge, NULL);
 	if (ret) {
 		dev_err(dev, "bridge attach failed: %d\n", ret);
-		return ret;
+		goto rel_dma_exit;
 	}
 	/* Disable the atomic helper calls into the bridge.  We
 	 * manually call the bridge pre_enable / enable / etc. calls
@@ -1665,6 +1671,11 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 	pm_runtime_enable(dev);
 
 	return 0;
+
+rel_dma_exit:
+	dma_release_channel(dsi->reg_dma_chan);
+
+	return ret;
 }
 
 static void vc4_dsi_unbind(struct device *dev, struct device *master,
@@ -1679,6 +1690,8 @@ static void vc4_dsi_unbind(struct device *dev, struct device *master,
 
 	vc4_dsi_encoder_destroy(dsi->encoder);
 
+	dma_release_channel(dsi->reg_dma_chan);
+
 	if (dsi->port == 1)
 		vc4->dsi1 = NULL;
 }
-- 
GitLab


From a4750f850182ab7dbe25d519b385e592e1d5b353 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 19 Jun 2019 03:55:50 +0100
Subject: [PATCH 0685/1835] video/bcm2708_fb: Revert cma allocation attempt

"4600e91 Pulled in the multi frame buffer support from the Pi3 repo"
pulled back in the code for allocating the framebuffer from the CMA
heap.
Revert it again.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/video/fbdev/bcm2708_fb.c           | 101 +++------------------
 include/soc/bcm2835/raspberrypi-firmware.h |   1 -
 2 files changed, 13 insertions(+), 89 deletions(-)

diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
index 540567fe21a85..2b7d5ebc76114 100644
--- a/drivers/video/fbdev/bcm2708_fb.c
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -112,9 +112,6 @@ struct bcm2708_fb {
 	struct vc4_display_settings_t display_settings;
 	struct debugfs_regset32 screeninfo_regset;
 	struct bcm2708_fb_dev *fbdev;
-	unsigned int image_size;
-	dma_addr_t dma_addr;
-	void *cpuaddr;
 };
 
 #define MAX_FRAMEBUFFERS 3
@@ -377,12 +374,12 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 			.xoffset = info->var.xoffset,
 			.yoffset = info->var.yoffset,
 		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
-			/* base and screen_size will be initialised later */
-		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH, 4, 0 },
-			/* pitch will be initialised later */
+			.base = 0,
+			.screen_size = 0,
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH, 4, 0 },
+			.pitch = 0,
 	};
-	int ret, image_size;
-
+	int ret;
 
 	print_debug("%s(%p) %dx%d (%dx%d), %d, %d (display %d)\n", __func__,
 		    info,
@@ -397,76 +394,12 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 	 */
 	set_display_num(fb);
 
-	/* Try allocating our own buffer. We can specify all the parameters */
-	image_size = ((info->var.xres * info->var.yres) *
-		      info->var.bits_per_pixel) >> 3;
-
-	if (!fb->fbdev->disable_arm_alloc &&
-	    (image_size != fb->image_size || !fb->dma_addr)) {
-		if (fb->dma_addr) {
-			dma_free_coherent(info->device, fb->image_size,
-					  fb->cpuaddr, fb->dma_addr);
-			fb->image_size = 0;
-			fb->cpuaddr = NULL;
-			fb->dma_addr = 0;
-		}
-
-		fb->cpuaddr = dma_alloc_coherent(info->device, image_size,
-						 &fb->dma_addr, GFP_KERNEL);
-
-		if (!fb->cpuaddr) {
-			fb->dma_addr = 0;
-			fb->fbdev->disable_arm_alloc = true;
-		} else {
-			fb->image_size = image_size;
-		}
-	}
-
-	if (fb->cpuaddr) {
-		fbinfo.base = fb->dma_addr;
-		fbinfo.screen_size = image_size;
-		fbinfo.pitch = (info->var.xres * info->var.bits_per_pixel) >> 3;
-
-		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
-						 sizeof(fbinfo));
-		if (ret || fbinfo.base != fb->dma_addr) {
-			/* Firmware either failed, or assigned a different base
-			 * address (ie it doesn't support being passed an FB
-			 * allocation).
-			 * Destroy the allocation, and don't try again.
-			 */
-			dma_free_coherent(info->device, fb->image_size,
-					  fb->cpuaddr, fb->dma_addr);
-			fb->image_size = 0;
-			fb->cpuaddr = NULL;
-			fb->dma_addr = 0;
-			fb->fbdev->disable_arm_alloc = true;
-		}
-	} else {
-		/* Our allocation failed - drop into the old scheme of
-		 * allocation by the VPU.
-		 */
-		ret = -ENOMEM;
-	}
-
+	ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
+					 sizeof(fbinfo));
 	if (ret) {
-		/* Old scheme:
-		 * - FRAMEBUFFER_ALLOCATE passes 0 for base and screen_size.
-		 * - GET_PITCH instead of SET_PITCH.
-		 */
-		fbinfo.base = 0;
-		fbinfo.screen_size = 0;
-		fbinfo.tag6.tag = RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH;
-		fbinfo.pitch = 0;
-
-		ret = rpi_firmware_property_list(fb->fbdev->fw, &fbinfo,
-						 sizeof(fbinfo));
-		if (ret) {
-			dev_err(info->device,
-				"Failed to allocate GPU framebuffer (%d)\n",
-				ret);
-			return ret;
-		}
+		dev_err(info->device,
+			"Failed to allocate GPU framebuffer (%d)\n", ret);
+		return ret;
 	}
 
 	if (info->var.bits_per_pixel <= 8)
@@ -481,17 +414,9 @@ static int bcm2708_fb_set_par(struct fb_info *info)
 	fb->fb.fix.smem_start = fbinfo.base;
 	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
 	fb->fb.screen_size = fbinfo.screen_size;
-
-	if (!fb->dma_addr) {
-		if (fb->fb.screen_base)
-			iounmap(fb->fb.screen_base);
-
-		fb->fb.screen_base = ioremap_wc(fbinfo.base,
-						fb->fb.screen_size);
-	} else {
-		fb->fb.screen_base = fb->cpuaddr;
-	}
-
+	if (fb->fb.screen_base)
+		iounmap(fb->fb.screen_base);
+	fb->fb.screen_base = ioremap_wc(fbinfo.base, fb->fb.screen_size);
 	if (!fb->fb.screen_base) {
 		/* the console may currently be locked */
 		console_trylock();
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 10252aa519d3a..1ef454bd48b1f 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -138,7 +138,6 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PIXEL_ORDER =            0x00048006,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_ALPHA_MODE =             0x00048007,
-	RPI_FIRMWARE_FRAMEBUFFER_SET_PITCH =                  0x00048008,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
-- 
GitLab


From 56a097ef7a765fb35d50ff9a4fcd305fb6f6c5e0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 24 Jun 2019 02:29:40 +0100
Subject: [PATCH 0686/1835] drm/vc4: Add support for color encoding on YUV
 planes

Adds signalling for BT601/709/2020, and limited/full range
(on BT601).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 32 +++++++++++++++++++++++++-
 drivers/gpu/drm/vc4/vc_image_types.h   | 28 ++++++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index b5959abecf1ab..074766fc076e2 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -66,7 +66,7 @@ struct set_plane {
 	u8 alpha;
 	u8 num_planes;
 	u8 is_vu;
-	u8 padding;
+	u8 color_encoding;
 
 	u32 planes[4];  /* DMA address of each plane */
 
@@ -454,6 +454,28 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 		if (num_planes == 3 &&
 		    (fb->offsets[2] - fb->offsets[1]) == fb->pitches[1])
 			mb->plane.vc_image_type = VC_IMAGE_YUV420_S;
+
+		switch (state->color_encoding) {
+		default:
+		case DRM_COLOR_YCBCR_BT601:
+			if (state->color_range == DRM_COLOR_YCBCR_LIMITED_RANGE)
+				mb->plane.color_encoding =
+						VC_IMAGE_YUVINFO_CSC_ITUR_BT601;
+			else
+				mb->plane.color_encoding =
+						VC_IMAGE_YUVINFO_CSC_JPEG_JFIF;
+			break;
+		case DRM_COLOR_YCBCR_BT709:
+			/* Currently no support for a full range BT709 */
+			mb->plane.color_encoding =
+						VC_IMAGE_YUVINFO_CSC_ITUR_BT709;
+			break;
+		case DRM_COLOR_YCBCR_BT2020:
+			/* Currently no support for a full range BT2020 */
+			mb->plane.color_encoding =
+					VC_IMAGE_YUVINFO_CSC_REC_2020;
+			break;
+		}
 	} else {
 		mb->plane.planes[1] = 0;
 		mb->plane.planes[2] = 0;
@@ -643,6 +665,14 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	drm_plane_create_alpha_property(plane);
 	drm_plane_create_rotation_property(plane, DRM_MODE_ROTATE_0,
 					   SUPPORTED_ROTATIONS);
+	drm_plane_create_color_properties(plane,
+					  BIT(DRM_COLOR_YCBCR_BT601) |
+					  BIT(DRM_COLOR_YCBCR_BT709) |
+					  BIT(DRM_COLOR_YCBCR_BT2020),
+					  BIT(DRM_COLOR_YCBCR_LIMITED_RANGE) |
+					  BIT(DRM_COLOR_YCBCR_FULL_RANGE),
+					  DRM_COLOR_YCBCR_BT709,
+					  DRM_COLOR_YCBCR_LIMITED_RANGE);
 
 	/*
 	 * Default frame buffer setup is with FB on -127, and raspistill etc
diff --git a/drivers/gpu/drm/vc4/vc_image_types.h b/drivers/gpu/drm/vc4/vc_image_types.h
index 669a70fdb8913..0bdffe5dd1e9a 100644
--- a/drivers/gpu/drm/vc4/vc_image_types.h
+++ b/drivers/gpu/drm/vc4/vc_image_types.h
@@ -4,6 +4,8 @@
  *
  * Values taken from vc_image_types.h released by Broadcom at
  * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_types.h
+ * and vc_image_structs.h at
+ * https://github.com/raspberrypi/userland/blob/master/interface/vctypes/vc_image_structs.h
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -141,3 +143,29 @@ enum {
 	VC_IMAGE_MAX,     /* bounds for error checking */
 	VC_IMAGE_FORCE_ENUM_16BIT = 0xffff,
 };
+
+enum {
+	/* Unknown or unset - defaults to BT601 interstitial */
+	VC_IMAGE_YUVINFO_UNSPECIFIED    = 0,
+
+	/* colour-space conversions data [4 bits] */
+
+	/* ITU-R BT.601-5 [SDTV] (compatible with VideoCore-II) */
+	VC_IMAGE_YUVINFO_CSC_ITUR_BT601      = 1,
+	/* ITU-R BT.709-3 [HDTV] */
+	VC_IMAGE_YUVINFO_CSC_ITUR_BT709      = 2,
+	/* JPEG JFIF */
+	VC_IMAGE_YUVINFO_CSC_JPEG_JFIF       = 3,
+	/* Title 47 Code of Federal Regulations (2003) 73.682 (a) (20) */
+	VC_IMAGE_YUVINFO_CSC_FCC             = 4,
+	/* Society of Motion Picture and Television Engineers 240M (1999) */
+	VC_IMAGE_YUVINFO_CSC_SMPTE_240M      = 5,
+	/* ITU-R BT.470-2 System M */
+	VC_IMAGE_YUVINFO_CSC_ITUR_BT470_2_M  = 6,
+	/* ITU-R BT.470-2 System B,G */
+	VC_IMAGE_YUVINFO_CSC_ITUR_BT470_2_BG = 7,
+	/* JPEG JFIF, but with 16..255 luma */
+	VC_IMAGE_YUVINFO_CSC_JPEG_JFIF_Y16_255 = 8,
+	/* Rec 2020 */
+	VC_IMAGE_YUVINFO_CSC_REC_2020        = 9,
+};
-- 
GitLab


From e8a66b4f610b3a20bae8f706256d230135916c26 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 28 Jun 2019 16:05:25 +0100
Subject: [PATCH 0687/1835] configs: Drop V4L2 camera and codec drivers from
 bcmrpi3_defconfig

They rely on mmal_vchiq, which in turn wants vc-sm-cma.
vc-sm-cma needs some attention for 64 bit, so drop it for now.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 904163e4266dd..e81b099bd5420 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1086,8 +1086,6 @@ CONFIG_FB_TFT_WATTEROTT=m
 CONFIG_FB_FLEX=m
 CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_SND_BCM2835=m
-CONFIG_VIDEO_BCM2835=m
-CONFIG_VIDEO_CODEC_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 9d1deec93fa8b1b4953ff5e9210349f3c85b9a8d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 28 Jun 2019 22:44:09 +0100
Subject: [PATCH 0688/1835] configs: arm64/bcm2711: Remove CONFIG_VIDEO_BCM2835

Undefine CONFIG_VIDEO_BCM2835 until it builds for arm64.

See: https://github.com/raspberrypi/linux/issues/3024
See: https://github.com/raspberrypi/linux/pull/3030

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 2 +-
 arch/arm64/configs/bcm2711_defconfig | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 07be63a719364..f0d3eae017356 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -16,11 +16,11 @@ CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PIDS=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 493ddc9211f24..8cda13c6c64cd 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -1031,7 +1031,6 @@ CONFIG_USB_G_HID=m
 CONFIG_USB_G_WEBCAM=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
-CONFIG_MMC_SDHCI_BCM2711=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_SDHOST=y
@@ -1130,7 +1129,6 @@ CONFIG_FB_TFT_WATTEROTT=m
 CONFIG_FB_FLEX=m
 CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_SND_BCM2835=m
-CONFIG_VIDEO_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From dbb5d678f6a7c50d4026facf98b46c36555da084 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 2 Jul 2019 17:13:05 +0100
Subject: [PATCH 0689/1835] arm: dts: Add coherent_pool=1M to Pi 4 bootargs

Downstream Raspberry Pi dts files add "coherent_pool=1M" to the kernel
command line to aid the dwc_otg driver, but this excluded Pi 4 which
uses a new XCHI interface instead. UAS also benefits from a larger
coherent_pool value, so replicate the addition in bcm2711-rpi-4-b.dts.

See: https://github.com/raspberrypi/linux/pull/3040

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 5addb6130fa70..9b5c4f8a4d170 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -14,7 +14,7 @@
 	};
 
 	chosen {
-		bootargs = "8250.nr_uarts=1 cma=64M";
+		bootargs = "coherent_pool=1M 8250.nr_uarts=1 cma=64M";
 	};
 
 	aliases {
-- 
GitLab


From 109b8b904d7482236a9c6a51ec82e7f0144a4fd5 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 2 Jul 2019 21:25:59 +0100
Subject: [PATCH 0690/1835] configs: Enable USB_CONFIGFS=m in bcmrpi_defconfig

See: https://github.com/raspberrypi/linux/issues/3042

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcmrpi_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index e80e58d06ddec..86961d4f82804 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1150,6 +1150,7 @@ CONFIG_USB_CXACRU=m
 CONFIG_USB_UEAGLEATM=m
 CONFIG_USB_XUSBATM=m
 CONFIG_USB_GADGET=m
+CONFIG_USB_CONFIGFS=m
 CONFIG_USB_ZERO=m
 CONFIG_USB_AUDIO=m
 CONFIG_USB_ETH=m
-- 
GitLab


From fba6ea6a8f6e2eaf814475812aec64de3f4912c9 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 2 Jul 2019 21:43:13 +0100
Subject: [PATCH 0691/1835] configs: And all the other USB_CONFIGFS options

And all Rabbit's friends-and-relations.

See: https://github.com/raspberrypi/linux/issues/3042

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcmrpi_defconfig | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 86961d4f82804..77e3efaaee098 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1151,6 +1151,23 @@ CONFIG_USB_UEAGLEATM=m
 CONFIG_USB_XUSBATM=m
 CONFIG_USB_GADGET=m
 CONFIG_USB_CONFIGFS=m
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_ACM=y
+CONFIG_USB_CONFIGFS_OBEX=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_ECM=y
+CONFIG_USB_CONFIGFS_ECM_SUBSET=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_EEM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_LB_SS=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_USB_CONFIGFS_F_UAC1=y
+CONFIG_USB_CONFIGFS_F_UAC2=y
+CONFIG_USB_CONFIGFS_F_MIDI=y
+CONFIG_USB_CONFIGFS_F_HID=y
+CONFIG_USB_CONFIGFS_F_UVC=y
+CONFIG_USB_CONFIGFS_F_PRINTER=y
 CONFIG_USB_ZERO=m
 CONFIG_USB_AUDIO=m
 CONFIG_USB_ETH=m
-- 
GitLab


From 395a6a8b68fed103cb1c75d8e224cd4ff2b89bf0 Mon Sep 17 00:00:00 2001
From: Andrei Gherzan <andrei@gherzan.ro>
Date: Wed, 3 Jul 2019 13:53:29 +0100
Subject: [PATCH 0692/1835] configs: arm64/bcm2711: Add MMC_SDHCI_IPROC

This driver is used in the device tree for the emmc2 node.

See #3032

Signed-off-by: Andrei Gherzan <andrei@gherzan.ro>
---
 arch/arm64/configs/bcm2711_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 8cda13c6c64cd..0d5a1606aceb2 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -1036,6 +1036,7 @@ CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_SDHOST=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
-- 
GitLab


From 0d3c5fea8c6b309e1e61aae2389a4baf327d2967 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 3 Jul 2019 20:37:14 +0100
Subject: [PATCH 0693/1835] overlays: Correct gpio-fan gpio flags for 4.19

The gpio-fan overlay was submitted for the 4.14 kernel where the second
value in the Device Tree gpios declaration was ignored (thanks to an
old-style driver), allowing the fan-control output to be active-high
even though the declaration appears to request it be active-low.
The gpio-fan driver in 4.19 uses GPIO descriptors and honours the
active-low flag that the overlay (accidentally?) supplies.

Change/correct the flags field to mark the GPIO as active-high.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/gpio-fan-overlay.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
index 1a5e52c646656..0b14981b4824e 100644
--- a/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
+++ b/arch/arm/boot/dts/overlays/gpio-fan-overlay.dts
@@ -45,7 +45,7 @@
 		__overlay__ {
 			fan0: gpio-fan@0 {
 				compatible = "gpio-fan";
-				gpios = <&gpio 12 1>;
+				gpios = <&gpio 12 0>;
 				gpio-fan,speed-map = <0    0>,
 									 <5000 1>;
 				#cooling-cells = <2>;
-- 
GitLab


From eca9097946bc40759f3c27808255d53cd5a20f10 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 25 Jun 2019 00:29:44 +0100
Subject: [PATCH 0694/1835] staging: vcsm-cma: Remove cache manipulation ioctl
 from ARM64

The cache flushing ioctls are used by the Pi3 HEVC hw-assisted
decoder as it needs finer grained flushing control than dma_ops
allow.
These cache calls are not present for ARM64, therefore disable
them. We are not actively supporting 64bit kernels at present,
and the use case of the HEVC decoder is fairly limited.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index ccea692432197..f5dfb448f3fb6 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -1259,6 +1259,7 @@ error:
 	return ret;
 }
 
+#ifndef CONFIG_ARM64
 /* Converts VCSM_CACHE_OP_* to an operating function. */
 static void (*cache_op_to_func(const unsigned int cache_op))
 						(const void*, const void*)
@@ -1351,6 +1352,7 @@ out:
 
 	return ret;
 }
+#endif
 
 static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 			    unsigned long arg)
@@ -1448,6 +1450,7 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 		break;
 	}
 
+#ifndef CONFIG_ARM64
 	/*
 	 * Flush/Invalidate the cache for a given mapping.
 	 * Blocks must be pinned (i.e. accessed) before this call.
@@ -1455,6 +1458,7 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 	case VC_SM_CMA_CMD_CLEAN_INVALID2:
 		ret = vc_sm_cma_clean_invalid2(cmdnr, arg);
 		break;
+#endif
 
 	default:
 		pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
@@ -1467,6 +1471,7 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 	return ret;
 }
 
+#ifndef CONFIG_ARM64
 #ifdef CONFIG_COMPAT
 struct vc_sm_cma_ioctl_clean_invalid2_32 {
 	u32 op_count;
@@ -1496,13 +1501,16 @@ static long vc_sm_cma_compat_ioctl(struct file *file, unsigned int cmd,
 	}
 }
 #endif
+#endif
 
 /* Device operations that we managed in this driver. */
 static const struct file_operations vc_sm_ops = {
 	.owner = THIS_MODULE,
 	.unlocked_ioctl = vc_sm_cma_ioctl,
+#ifndef CONFIG_ARM64
 #ifdef CONFIG_COMPAT
 	.compat_ioctl = vc_sm_cma_compat_ioctl,
+#endif
 #endif
 	.open = vc_sm_cma_open,
 	.release = vc_sm_cma_release,
-- 
GitLab


From c2b13140ba625dbee8eddf5ebddb34770e3063f5 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 1 Jul 2019 11:57:25 +0100
Subject: [PATCH 0695/1835] staging: vcsm-cma: Rework to use dma APIs, not CMA

Due to a misunderstanding of the DMA mapping APIs, I made
the wrong decision on how to implement this.

Rework to use dma_alloc_coherent instead of the CMA
API. This also allows it to be built as a module easily.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vc-sm-cma/Kconfig   |   4 +-
 .../staging/vc04_services/vc-sm-cma/Makefile  |   2 +-
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   | 291 ++++++++++--------
 .../staging/vc04_services/vc-sm-cma/vc_sm.h   |  13 +-
 .../vc04_services/vc-sm-cma/vc_sm_cma.c       |  98 ------
 .../vc04_services/vc-sm-cma/vc_sm_cma.h       |  39 ---
 6 files changed, 168 insertions(+), 279 deletions(-)
 delete mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
 delete mode 100644 drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h

diff --git a/drivers/staging/vc04_services/vc-sm-cma/Kconfig b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
index 0607248200977..bbd296f5826b4 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/Kconfig
+++ b/drivers/staging/vc04_services/vc-sm-cma/Kconfig
@@ -1,6 +1,6 @@
 config BCM_VC_SM_CMA
-	bool "VideoCore Shared Memory (CMA) driver"
-	depends on BCM2835_VCHIQ && DMA_CMA
+	tristate "VideoCore Shared Memory (CMA) driver"
+	depends on BCM2835_VCHIQ
 	select RBTREE
 	select DMA_SHARED_BUFFER
 	help
diff --git a/drivers/staging/vc04_services/vc-sm-cma/Makefile b/drivers/staging/vc04_services/vc-sm-cma/Makefile
index edda1280772c3..9697e116b7651 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/Makefile
+++ b/drivers/staging/vc04_services/vc-sm-cma/Makefile
@@ -3,6 +3,6 @@ ccflags-y += -Idrivers/staging/vc04_services -Idrivers/staging/vc04_services/int
 ccflags-y += -D__VCCOREVER__=0
 
 vc-sm-cma-$(CONFIG_BCM_VC_SM_CMA) := \
-	vc_sm.o vc_sm_cma_vchi.o vc_sm_cma.o
+	vc_sm.o vc_sm_cma_vchi.o
 
 obj-$(CONFIG_BCM_VC_SM_CMA) += vc-sm-cma.o
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index f5dfb448f3fb6..c86e53c95710e 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -6,8 +6,8 @@
  * Dave Stevenson <dave.stevenson@raspberrypi.org>
  *
  * Based on vmcs_sm driver from Broadcom Corporation for some API,
- * and taking some code for CMA/dmabuf handling from the Android Ion
- * driver (Google/Linaro).
+ * and taking some code for buffer allocation and dmabuf handling from
+ * videobuf2.
  *
  *
  * This driver has 3 main uses:
@@ -52,7 +52,6 @@
 #include "vc_sm_cma_vchi.h"
 
 #include "vc_sm.h"
-#include "vc_sm_cma.h"
 #include "vc_sm_knl.h"
 #include <linux/broadcom/vc_sm_cma_ioctl.h>
 
@@ -89,7 +88,6 @@ struct sm_state_t {
 	struct miscdevice misc_dev;
 
 	struct sm_instance *sm_handle;	/* Handle for videocore service. */
-	struct cma *cma_heap;
 
 	spinlock_t kernelid_map_lock;	/* Spinlock protecting kernelid_map */
 	struct idr kernelid_map;
@@ -110,8 +108,9 @@ struct sm_state_t {
 
 struct vc_sm_dma_buf_attachment {
 	struct device *dev;
-	struct sg_table *table;
+	struct sg_table sg_table;
 	struct list_head list;
+	enum dma_data_direction	dma_dir;
 };
 
 /* ---- Private Variables ----------------------------------------------- */
@@ -202,9 +201,10 @@ static int vc_sm_cma_global_state_show(struct seq_file *s, void *v)
 					   resource->import.attach);
 				seq_printf(s, "           SGT          %p\n",
 					   resource->import.sgt);
+			} else {
+				seq_printf(s, "           SGT          %p\n",
+					   resource->alloc.sg_table);
 			}
-			seq_printf(s, "           SG_TABLE     %p\n",
-				   resource->sg_table);
 			seq_printf(s, "           DMA_ADDR     %pad\n",
 				   &resource->dma_addr);
 			seq_printf(s, "           VC_HANDLE     %08x\n",
@@ -296,8 +296,9 @@ static void vc_sm_vpu_free(struct vc_sm_buffer *buffer)
  */
 static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
 {
-	pr_debug("[%s]: buffer %p (name %s, size %zu)\n",
-		 __func__, buffer, buffer->name, buffer->size);
+	pr_debug("[%s]: buffer %p (name %s, size %zu), imported %u\n",
+		 __func__, buffer, buffer->name, buffer->size,
+		 buffer->imported);
 
 	if (buffer->vc_handle) {
 		/* We've sent the unmap request but not had the response. */
@@ -313,8 +314,6 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
 
 	/* Release the allocation (whether imported dmabuf or CMA allocation) */
 	if (buffer->imported) {
-		pr_debug("%s: Release imported dmabuf %p\n", __func__,
-			 buffer->import.dma_buf);
 		if (buffer->import.dma_buf)
 			dma_buf_put(buffer->import.dma_buf);
 		else
@@ -322,16 +321,8 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
 			       __func__, buffer);
 		buffer->import.dma_buf = NULL;
 	} else {
-		if (buffer->sg_table) {
-			/* Our own allocation that we need to dma_unmap_sg */
-			dma_unmap_sg(&sm_state->pdev->dev,
-				     buffer->sg_table->sgl,
-				     buffer->sg_table->nents,
-				     DMA_BIDIRECTIONAL);
-		}
-		pr_debug("%s: Release our allocation\n", __func__);
-		vc_sm_cma_buffer_free(&buffer->alloc);
-		pr_debug("%s: Release our allocation - done\n", __func__);
+		dma_free_coherent(&sm_state->pdev->dev, buffer->size,
+				  buffer->cookie, buffer->dma_addr);
 	}
 
 
@@ -371,38 +362,6 @@ static struct vc_sm_privdata_t *vc_sm_cma_create_priv_data(pid_t id)
 	return file_data;
 }
 
-static struct sg_table *dup_sg_table(struct sg_table *table)
-{
-	struct sg_table *new_table;
-	int ret, i;
-	struct scatterlist *sg, *new_sg;
-
-	new_table = kzalloc(sizeof(*new_table), GFP_KERNEL);
-	if (!new_table)
-		return ERR_PTR(-ENOMEM);
-
-	ret = sg_alloc_table(new_table, table->nents, GFP_KERNEL);
-	if (ret) {
-		kfree(new_table);
-		return ERR_PTR(ret);
-	}
-
-	new_sg = new_table->sgl;
-	for_each_sg(table->sgl, sg, table->nents, i) {
-		memcpy(new_sg, sg, sizeof(*sg));
-		sg->dma_address = 0;
-		new_sg = sg_next(new_sg);
-	}
-
-	return new_table;
-}
-
-static void free_duped_table(struct sg_table *table)
-{
-	sg_free_table(table);
-	kfree(table);
-}
-
 /* Dma buf operations for use with our own allocations */
 
 static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
@@ -410,28 +369,45 @@ static int vc_sm_dma_buf_attach(struct dma_buf *dmabuf,
 
 {
 	struct vc_sm_dma_buf_attachment *a;
-	struct sg_table *table;
+	struct sg_table *sgt;
 	struct vc_sm_buffer *buf = dmabuf->priv;
+	struct scatterlist *rd, *wr;
+	int ret, i;
 
 	a = kzalloc(sizeof(*a), GFP_KERNEL);
 	if (!a)
 		return -ENOMEM;
 
-	table = dup_sg_table(buf->sg_table);
-	if (IS_ERR(table)) {
+	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
+
+	mutex_lock(&buf->lock);
+
+	INIT_LIST_HEAD(&a->list);
+
+	sgt = &a->sg_table;
+
+	/* Copy the buf->base_sgt scatter list to the attachment, as we can't
+	 * map the same scatter list to multiple attachments at the same time.
+	 */
+	ret = sg_alloc_table(sgt, buf->alloc.sg_table->orig_nents, GFP_KERNEL);
+	if (ret) {
 		kfree(a);
-		return PTR_ERR(table);
+		return -ENOMEM;
 	}
 
-	a->table = table;
-	INIT_LIST_HEAD(&a->list);
+	rd = buf->alloc.sg_table->sgl;
+	wr = sgt->sgl;
+	for (i = 0; i < sgt->orig_nents; ++i) {
+		sg_set_page(wr, sg_page(rd), rd->length, rd->offset);
+		rd = sg_next(rd);
+		wr = sg_next(wr);
+	}
 
+	a->dma_dir = DMA_NONE;
 	attachment->priv = a;
 
-	mutex_lock(&buf->lock);
 	list_add(&a->list, &buf->attachments);
 	mutex_unlock(&buf->lock);
-	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
 
 	return 0;
 }
@@ -441,9 +417,20 @@ static void vc_sm_dma_buf_detach(struct dma_buf *dmabuf,
 {
 	struct vc_sm_dma_buf_attachment *a = attachment->priv;
 	struct vc_sm_buffer *buf = dmabuf->priv;
+	struct sg_table *sgt;
 
 	pr_debug("%s dmabuf %p attachment %p\n", __func__, dmabuf, attachment);
-	free_duped_table(a->table);
+	if (!a)
+		return;
+
+	sgt = &a->sg_table;
+
+	/* release the scatterlist cache */
+	if (a->dma_dir != DMA_NONE)
+		dma_unmap_sg(attachment->dev, sgt->sgl, sgt->orig_nents,
+			     a->dma_dir);
+	sg_free_table(sgt);
+
 	mutex_lock(&buf->lock);
 	list_del(&a->list);
 	mutex_unlock(&buf->lock);
@@ -455,13 +442,38 @@ static struct sg_table *vc_sm_map_dma_buf(struct dma_buf_attachment *attachment,
 					  enum dma_data_direction direction)
 {
 	struct vc_sm_dma_buf_attachment *a = attachment->priv;
+	/* stealing dmabuf mutex to serialize map/unmap operations */
+	struct mutex *lock = &attachment->dmabuf->lock;
 	struct sg_table *table;
 
-	table = a->table;
+	mutex_lock(lock);
+	pr_debug("%s attachment %p\n", __func__, attachment);
+	table = &a->sg_table;
 
-	if (!dma_map_sg(attachment->dev, table->sgl, table->nents,
-			direction))
-		return ERR_PTR(-ENOMEM);
+	/* return previously mapped sg table */
+	if (a->dma_dir == direction) {
+		mutex_unlock(lock);
+		return table;
+	}
+
+	/* release any previous cache */
+	if (a->dma_dir != DMA_NONE) {
+		dma_unmap_sg(attachment->dev, table->sgl, table->orig_nents,
+			     a->dma_dir);
+		a->dma_dir = DMA_NONE;
+	}
+
+	/* mapping to the client with new direction */
+	table->nents = dma_map_sg(attachment->dev, table->sgl,
+				  table->orig_nents, direction);
+	if (!table->nents) {
+		pr_err("failed to map scatterlist\n");
+		mutex_unlock(lock);
+		return ERR_PTR(-EIO);
+	}
+
+	a->dma_dir = direction;
+	mutex_unlock(lock);
 
 	pr_debug("%s attachment %p\n", __func__, attachment);
 	return table;
@@ -478,41 +490,26 @@ static void vc_sm_unmap_dma_buf(struct dma_buf_attachment *attachment,
 static int vc_sm_dmabuf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
 {
 	struct vc_sm_buffer *buf = dmabuf->priv;
-	struct sg_table *table = buf->sg_table;
-	unsigned long addr = vma->vm_start;
-	unsigned long offset = vma->vm_pgoff * PAGE_SIZE;
-	struct scatterlist *sg;
-	int i;
-	int ret = 0;
+	int ret;
 
 	pr_debug("%s dmabuf %p, buf %p, vm_start %08lX\n", __func__, dmabuf,
-		 buf, addr);
+		 buf, vma->vm_start);
 
 	mutex_lock(&buf->lock);
 
 	/* now map it to userspace */
-	for_each_sg(table->sgl, sg, table->nents, i) {
-		struct page *page = sg_page(sg);
-		unsigned long remainder = vma->vm_end - addr;
-		unsigned long len = sg->length;
+	vma->vm_pgoff = 0;
 
-		if (offset >= sg->length) {
-			offset -= sg->length;
-			continue;
-		} else if (offset) {
-			page += offset / PAGE_SIZE;
-			len = sg->length - offset;
-			offset = 0;
-		}
-		len = min(len, remainder);
-		ret = remap_pfn_range(vma, addr, page_to_pfn(page), len,
-				      vma->vm_page_prot);
-		if (ret)
-			break;
-		addr += len;
-		if (addr >= vma->vm_end)
-			break;
+	ret = dma_mmap_coherent(&sm_state->pdev->dev, vma, buf->cookie,
+				buf->dma_addr, buf->size);
+
+	if (ret) {
+		pr_err("Remapping memory failed, error: %d\n", ret);
+		return ret;
 	}
+
+	vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+
 	mutex_unlock(&buf->lock);
 
 	if (ret)
@@ -570,8 +567,8 @@ static int vc_sm_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
 	mutex_lock(&buf->lock);
 
 	list_for_each_entry(a, &buf->attachments, list) {
-		dma_sync_sg_for_cpu(a->dev, a->table->sgl, a->table->nents,
-				    direction);
+		dma_sync_sg_for_cpu(a->dev, a->sg_table.sgl,
+				    a->sg_table.nents, direction);
 	}
 	mutex_unlock(&buf->lock);
 
@@ -593,8 +590,8 @@ static int vc_sm_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
 	mutex_lock(&buf->lock);
 
 	list_for_each_entry(a, &buf->attachments, list) {
-		dma_sync_sg_for_device(a->dev, a->table->sgl, a->table->nents,
-				       direction);
+		dma_sync_sg_for_device(a->dev, a->sg_table.sgl,
+				       a->sg_table.nents, direction);
 	}
 	mutex_unlock(&buf->lock);
 
@@ -625,7 +622,9 @@ static const struct dma_buf_ops dma_buf_ops = {
 	.map = vc_sm_dma_buf_kmap,
 	.unmap = vc_sm_dma_buf_kunmap,
 };
+
 /* Dma_buf operations for chaining through to an imported dma_buf */
+
 static
 int vc_sm_import_dma_buf_attach(struct dma_buf *dmabuf,
 				struct dma_buf_attachment *attachment)
@@ -819,7 +818,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
 
 	import.type = VC_SM_ALLOC_NON_CACHED;
 	dma_addr = sg_dma_address(sgt->sgl);
-	import.addr = (uint32_t)dma_addr;
+	import.addr = (u32)dma_addr;
 	if ((import.addr & 0xC0000000) != 0xC0000000) {
 		pr_err("%s: Expecting an uncached alias for dma_addr %pad\n",
 		       __func__, &dma_addr);
@@ -911,11 +910,12 @@ error:
 	return ret;
 }
 
-static int vc_sm_cma_vpu_alloc(u32 size, uint32_t align, const char *name,
+static int vc_sm_cma_vpu_alloc(u32 size, u32 align, const char *name,
 			       u32 mem_handle, struct vc_sm_buffer **ret_buffer)
 {
 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 	struct vc_sm_buffer *buffer = NULL;
+	struct sg_table *sgt;
 	int aligned_size;
 	int ret = 0;
 
@@ -938,23 +938,34 @@ static int vc_sm_cma_vpu_alloc(u32 size, uint32_t align, const char *name,
 	 */
 	mutex_lock(&buffer->lock);
 
-	if (vc_sm_cma_buffer_allocate(sm_state->cma_heap, &buffer->alloc,
-				      aligned_size)) {
-		pr_err("[%s]: cma alloc of %d bytes failed\n",
+	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
+					    aligned_size, &buffer->dma_addr,
+					    GFP_KERNEL);
+	if (!buffer->cookie) {
+		pr_err("[%s]: dma_alloc_coherent alloc of %d bytes failed\n",
 		       __func__, aligned_size);
 		ret = -ENOMEM;
 		goto error;
 	}
-	buffer->sg_table = buffer->alloc.sg_table;
 
-	pr_debug("[%s]: cma alloc of %d bytes success\n",
+	pr_debug("[%s]: alloc of %d bytes success\n",
 		 __func__, aligned_size);
 
-	if (dma_map_sg(&sm_state->pdev->dev, buffer->sg_table->sgl,
-		       buffer->sg_table->nents, DMA_BIDIRECTIONAL) <= 0) {
-		pr_err("[%s]: dma_map_sg failed\n", __func__);
+	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
+			      buffer->dma_addr, buffer->size);
+	if (ret < 0) {
+		pr_err("failed to get scatterlist from DMA API\n");
+		kfree(sgt);
+		ret = -ENOMEM;
 		goto error;
 	}
+	buffer->alloc.sg_table = sgt;
 
 	INIT_LIST_HEAD(&buffer->attachments);
 
@@ -971,10 +982,10 @@ static int vc_sm_cma_vpu_alloc(u32 size, uint32_t align, const char *name,
 		ret = PTR_ERR(buffer->dma_buf);
 		goto error;
 	}
-	buffer->dma_addr = (uint32_t)sg_dma_address(buffer->sg_table->sgl);
+	buffer->dma_addr = (u32)sg_dma_address(buffer->alloc.sg_table->sgl);
 	if ((buffer->dma_addr & 0xC0000000) != 0xC0000000) {
-		pr_err("%s: Expecting an uncached alias for dma_addr %pad\n",
-		       __func__, &buffer->dma_addr);
+		pr_warn_once("%s: Expecting an uncached alias for dma_addr %pad\n",
+			     __func__, &buffer->dma_addr);
 		buffer->dma_addr |= 0xC0000000;
 	}
 	buffer->private = sm_state->vpu_allocs;
@@ -1145,6 +1156,7 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 	struct vc_sm_import import = { 0 };
 	struct vc_sm_import_result result = { 0 };
 	struct dma_buf *dmabuf = NULL;
+	struct sg_table *sgt;
 	int aligned_size;
 	int ret = 0;
 	int status;
@@ -1162,18 +1174,13 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 		goto error;
 	}
 
-	if (vc_sm_cma_buffer_allocate(sm_state->cma_heap, &buffer->alloc,
-				      aligned_size)) {
-		pr_err("[%s]: cma alloc of %d bytes failed\n",
+	buffer->cookie = dma_alloc_coherent(&sm_state->pdev->dev,
+					    aligned_size,
+					    &buffer->dma_addr,
+					    GFP_KERNEL);
+	if (!buffer->cookie) {
+		pr_err("[%s]: dma_alloc_coherent alloc of %d bytes failed\n",
 		       __func__, aligned_size);
-		kfree(buffer);
-		return -ENOMEM;
-	}
-	buffer->sg_table = buffer->alloc.sg_table;
-
-	if (dma_map_sg(&sm_state->pdev->dev, buffer->sg_table->sgl,
-		       buffer->sg_table->nents, DMA_BIDIRECTIONAL) <= 0) {
-		pr_err("[%s]: dma_map_sg failed\n", __func__);
 		ret = -ENOMEM;
 		goto error;
 	}
@@ -1204,7 +1211,7 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 	}
 	buffer->dma_buf = dmabuf;
 
-	import.addr = (uint32_t)sg_dma_address(buffer->sg_table->sgl);
+	import.addr = buffer->dma_addr;
 	import.size = aligned_size;
 	import.kernel_id = get_kernel_id(buffer);
 
@@ -1229,10 +1236,25 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 	buffer->private = private;
 	buffer->vc_handle = result.res_handle;
 	buffer->size = import.size;
-	buffer->dma_addr = import.addr;
 	buffer->vpu_state = VPU_MAPPED;
 	buffer->kernel_id = import.kernel_id;
-	//buffer->res_cached = ioparam->cached;
+
+	sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	ret = dma_get_sgtable(&sm_state->pdev->dev, sgt, buffer->cookie,
+			      buffer->dma_addr, buffer->size);
+	if (ret < 0) {
+		/* FIXME: error handling */
+		pr_err("failed to get scatterlist from DMA API\n");
+		kfree(sgt);
+		ret = -ENOMEM;
+		goto error;
+	}
+	buffer->alloc.sg_table = sgt;
 
 	fd = dma_buf_fd(dmabuf, O_CLOEXEC);
 	if (fd < 0)
@@ -1250,11 +1272,19 @@ int vc_sm_cma_ioctl_alloc(struct vc_sm_privdata_t *private,
 	return 0;
 
 error:
-	if (buffer) {
-		pr_err("[%s]: something failed - cleanup. ret %d\n", __func__,
-		       ret);
+	pr_err("[%s]: something failed - cleanup. ret %d\n", __func__, ret);
 
+	if (dmabuf) {
+		/* dmabuf has been exported, therefore allow dmabuf cleanup to
+		 * deal with this
+		 */
 		dma_buf_put(dmabuf);
+	} else {
+		/* No dmabuf, therefore just free the buffer here */
+		if (buffer->cookie)
+			dma_free_coherent(&sm_state->pdev->dev, buffer->size,
+					  buffer->cookie, buffer->dma_addr);
+		kfree(buffer);
 	}
 	return ret;
 }
@@ -1527,13 +1557,6 @@ static void vc_sm_connected_init(void)
 
 	pr_info("[%s]: start\n", __func__);
 
-	vc_sm_cma_add_heaps(&sm_state->cma_heap);
-	if (!sm_state->cma_heap) {
-		pr_err("[%s]: failed to initialise CMA heap\n",
-		       __func__);
-		return;
-	}
-
 	/*
 	 * Initialize and create a VCHI connection for the shared memory service
 	 * running on videocore.
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
index 3a3ff5b4626d5..f1c7b95b14cee 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.h
@@ -21,8 +21,6 @@
 #include <linux/types.h>
 #include <linux/miscdevice.h>
 
-#include "vc_sm_cma.h"
-
 #define VC_SM_MAX_NAME_LEN 32
 
 enum vc_sm_vpu_mapping_state {
@@ -31,6 +29,12 @@ enum vc_sm_vpu_mapping_state {
 	VPU_UNMAPPING
 };
 
+struct vc_sm_alloc_data {
+	unsigned long num_pages;
+	void *priv_virt;
+	struct sg_table *sg_table;
+};
+
 struct vc_sm_imported {
 	struct dma_buf *dma_buf;
 	struct dma_buf_attachment *attach;
@@ -56,8 +60,6 @@ struct vc_sm_buffer {
 	int in_use:1;	/* Kernel is still using this resource */
 	int imported:1;	/* Imported dmabuf */
 
-	struct sg_table *sg_table;
-
 	enum vc_sm_vpu_mapping_state vpu_state;
 	u32 vc_handle;	/* VideoCore handle for this buffer */
 	int vpu_allocated;	/*
@@ -69,11 +71,12 @@ struct vc_sm_buffer {
 	/* DMABUF related fields */
 	struct dma_buf *dma_buf;
 	dma_addr_t dma_addr;
+	void *cookie;
 
 	struct vc_sm_privdata_t *private;
 
 	union {
-		struct vc_sm_cma_alloc_data alloc;
+		struct vc_sm_alloc_data alloc;
 		struct vc_sm_imported import;
 	};
 };
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
deleted file mode 100644
index 09ba3f927a29a..0000000000000
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.c
+++ /dev/null
@@ -1,98 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * VideoCore Shared Memory CMA allocator
- *
- * Copyright: 2018, Raspberry Pi (Trading) Ltd
- *
- * Based on the Android ION allocator
- * Copyright (C) Linaro 2012
- * Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
- *
- */
-
-#include <linux/slab.h>
-#include <linux/errno.h>
-#include <linux/err.h>
-#include <linux/cma.h>
-#include <linux/scatterlist.h>
-
-#include "vc_sm_cma.h"
-
-/* CMA heap operations functions */
-int vc_sm_cma_buffer_allocate(struct cma *cma_heap,
-			      struct vc_sm_cma_alloc_data *buffer,
-			      unsigned long len)
-{
-	/* len should already be page aligned */
-	unsigned long num_pages = len / PAGE_SIZE;
-	struct sg_table *table;
-	struct page *pages;
-	int ret;
-
-	pages = cma_alloc(cma_heap, num_pages, 0, GFP_KERNEL);
-	if (!pages)
-		return -ENOMEM;
-
-	table = kmalloc(sizeof(*table), GFP_KERNEL);
-	if (!table)
-		goto err;
-
-	ret = sg_alloc_table(table, 1, GFP_KERNEL);
-	if (ret)
-		goto free_mem;
-
-	sg_set_page(table->sgl, pages, len, 0);
-
-	buffer->priv_virt = pages;
-	buffer->sg_table = table;
-	buffer->cma_heap = cma_heap;
-	buffer->num_pages = num_pages;
-	return 0;
-
-free_mem:
-	kfree(table);
-err:
-	cma_release(cma_heap, pages, num_pages);
-	return -ENOMEM;
-}
-
-void vc_sm_cma_buffer_free(struct vc_sm_cma_alloc_data *buffer)
-{
-	struct cma *cma_heap = buffer->cma_heap;
-	struct page *pages = buffer->priv_virt;
-
-	/* release memory */
-	if (cma_heap)
-		cma_release(cma_heap, pages, buffer->num_pages);
-
-	/* release sg table */
-	if (buffer->sg_table) {
-		sg_free_table(buffer->sg_table);
-		kfree(buffer->sg_table);
-		buffer->sg_table = NULL;
-	}
-}
-
-int __vc_sm_cma_add_heaps(struct cma *cma, void *priv)
-{
-	struct cma **heap = (struct cma **)priv;
-	const char *name = cma_get_name(cma);
-
-	if (!(*heap)) {
-		phys_addr_t phys_addr = cma_get_base(cma);
-
-		pr_debug("%s: Adding cma heap %s (start %pap, size %lu) for use by vcsm\n",
-			 __func__, name, &phys_addr, cma_get_size(cma));
-		*heap = cma;
-	} else {
-		pr_err("%s: Ignoring heap %s as already set\n",
-		       __func__, name);
-	}
-
-	return 0;
-}
-
-void vc_sm_cma_add_heaps(struct cma **cma_heap)
-{
-	cma_for_each_area(__vc_sm_cma_add_heaps, cma_heap);
-}
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
deleted file mode 100644
index 210000fe91a07..0000000000000
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-
-/*
- * VideoCore Shared Memory CMA allocator
- *
- * Copyright: 2018, Raspberry Pi (Trading) Ltd
- *
- * Based on the Android ION allocator
- * Copyright (C) Linaro 2012
- * Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-#ifndef VC_SM_CMA_H
-#define VC_SM_CMA_H
-
-struct vc_sm_cma_alloc_data {
-	struct cma *cma_heap;
-	unsigned long num_pages;
-	void *priv_virt;
-	struct sg_table *sg_table;
-};
-
-int vc_sm_cma_buffer_allocate(struct cma *cma_heap,
-			      struct vc_sm_cma_alloc_data *buffer,
-			      unsigned long len);
-void vc_sm_cma_buffer_free(struct vc_sm_cma_alloc_data *buffer);
-
-void vc_sm_cma_add_heaps(struct cma **cma_heap);
-
-#endif
-- 
GitLab


From 0989d75d91954009880309d2bb74b3100fabc0e7 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 1 Jul 2019 12:00:27 +0100
Subject: [PATCH 0696/1835] Revert "configs: Drop V4L2 camera and codec drivers
 from bcmrpi3_defconfig"

This reverts commit e8a66b4f610b3a20bae8f706256d230135916c26.

The issues are now resolved.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcmrpi3_defconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index e81b099bd5420..904163e4266dd 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -1086,6 +1086,8 @@ CONFIG_FB_TFT_WATTEROTT=m
 CONFIG_FB_FLEX=m
 CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_VIDEO_CODEC_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 83c19d81fc70fe3c3faec5b41da4d524b2773b1b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 1 Jul 2019 12:06:54 +0100
Subject: [PATCH 0697/1835] Revert "configs: arm64/bcm2711: Remove
 CONFIG_VIDEO_BCM2835"

This reverts commit 9d1deec93fa8b1b4953ff5e9210349f3c85b9a8d.

The issues are resolved, so reenable.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 2 +-
 arch/arm64/configs/bcm2711_defconfig | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index f0d3eae017356..07be63a719364 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -16,11 +16,11 @@ CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
-CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PIDS=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 0d5a1606aceb2..87f263a57a37a 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -1031,6 +1031,7 @@ CONFIG_USB_G_HID=m
 CONFIG_USB_G_WEBCAM=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_SDHCI_BCM2711=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_SDHOST=y
@@ -1130,6 +1131,7 @@ CONFIG_FB_TFT_WATTEROTT=m
 CONFIG_FB_FLEX=m
 CONFIG_FB_TFT_FBTFT_DEVICE=m
 CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-- 
GitLab


From 44508ba1d86f32cbbf234011ff97e34cba4e3ab0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 2 Jul 2019 17:19:04 +0100
Subject: [PATCH 0698/1835] staging: vc-sm-cma: Fix the few remaining coding
 style issues

Fix a few minor checkpatch complaints to make the driver clean

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/vc-sm-cma/vc_sm.c   |   6 +-
 .../vc04_services/vc-sm-cma/vc_sm_cma_vchi.c  | 128 +++++++++---------
 2 files changed, 65 insertions(+), 69 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index c86e53c95710e..1b5bb68b9bcd6 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -325,7 +325,6 @@ static void vc_sm_release_resource(struct vc_sm_buffer *buffer)
 				  buffer->cookie, buffer->dma_addr);
 	}
 
-
 	/* Free our buffer. Start by removing it from the list */
 	mutex_lock(&sm_state->map_lock);
 	list_del(&buffer->global_buffer_list);
@@ -1365,7 +1364,8 @@ static int vc_sm_cma_clean_invalid2(unsigned int cmdnr, unsigned long arg)
 	}
 
 	for (i = 0; i < ioparam.op_count; i++) {
-		const struct vc_sm_cma_ioctl_clean_invalid_block * const op = block + i;
+		const struct vc_sm_cma_ioctl_clean_invalid_block * const op =
+								block + i;
 
 		if (op->invalidate_mode == VC_SM_CACHE_OP_NOP)
 			continue;
@@ -1637,8 +1637,6 @@ err_remove_misc_dev:
 err_remove_debugfs:
 	debugfs_remove_recursive(sm_state->dir_root);
 	vc_sm_cma_vchi_stop(&sm_state->sm_handle);
-
-	return;
 }
 
 /* Driver loading. */
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
index a8ffdeda3f828..4a9874f41543c 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm_cma_vchi.c
@@ -188,79 +188,77 @@ static int vc_sm_cma_vchi_videocore_io(void *arg)
 		if (svc_use)
 			vchi_service_release(instance->vchi_handle[0]);
 		svc_use = 0;
-		if (!wait_for_completion_interruptible(&instance->io_cmplt)) {
-			vchi_service_use(instance->vchi_handle[0]);
-			svc_use = 1;
-
-			do {
-				/*
-				 * Get new command and move it to response list
-				 */
-				mutex_lock(&instance->lock);
-				if (list_empty(&instance->cmd_list)) {
-					/* no more commands to process */
-					mutex_unlock(&instance->lock);
-					break;
-				}
-				cmd =
-				    list_first_entry(&instance->cmd_list,
-						     struct sm_cmd_rsp_blk,
-						     head);
-				list_move(&cmd->head, &instance->rsp_list);
-				cmd->sent = 1;
+
+		if (wait_for_completion_interruptible(&instance->io_cmplt))
+			continue;
+
+		vchi_service_use(instance->vchi_handle[0]);
+		svc_use = 1;
+
+		do {
+			/*
+			 * Get new command and move it to response list
+			 */
+			mutex_lock(&instance->lock);
+			if (list_empty(&instance->cmd_list)) {
+				/* no more commands to process */
 				mutex_unlock(&instance->lock);
+				break;
+			}
+			cmd = list_first_entry(&instance->cmd_list,
+					       struct sm_cmd_rsp_blk, head);
+			list_move(&cmd->head, &instance->rsp_list);
+			cmd->sent = 1;
+			mutex_unlock(&instance->lock);
 
-				/* Send the command */
-				status = bcm2835_vchi_msg_queue(
-						instance->vchi_handle[0],
-						cmd->msg, cmd->length);
-				if (status) {
-					pr_err("%s: failed to queue message (%d)",
-					       __func__, status);
-				}
-
-				/* If no reply is needed then we're done */
-				if (!cmd->wait) {
-					mutex_lock(&instance->lock);
-					list_del(&cmd->head);
-					mutex_unlock(&instance->lock);
-					vc_vchi_cmd_delete(instance, cmd);
-					continue;
-				}
-
-				if (status) {
-					complete(&cmd->cmplt);
-					continue;
-				}
-
-			} while (1);
-
-			while (!vchi_msg_peek(instance->vchi_handle[0],
-					      (void **)&reply, &reply_len,
-					      VCHI_FLAGS_NONE)) {
-				if (reply->trans_id & 0x80000000) {
-					/* Async event or cmd from the VPU */
-					if (instance->vpu_event)
-						instance->vpu_event(
-							instance, reply,
-							reply_len);
-				} else {
-					vc_sm_cma_vchi_rx_ack(instance, cmd,
-							      reply, reply_len);
-				}
-
-				vchi_msg_remove(instance->vchi_handle[0]);
+			/* Send the command */
+			status =
+				bcm2835_vchi_msg_queue(instance->vchi_handle[0],
+						       cmd->msg, cmd->length);
+			if (status) {
+				pr_err("%s: failed to queue message (%d)",
+				       __func__, status);
 			}
 
-			/* Go through the dead list and free them */
-			mutex_lock(&instance->lock);
-			list_for_each_entry_safe(cmd, cmd_tmp,
-						 &instance->dead_list, head) {
+			/* If no reply is needed then we're done */
+			if (!cmd->wait) {
+				mutex_lock(&instance->lock);
 				list_del(&cmd->head);
+				mutex_unlock(&instance->lock);
 				vc_vchi_cmd_delete(instance, cmd);
+				continue;
 			}
-			mutex_unlock(&instance->lock);
+
+			if (status) {
+				complete(&cmd->cmplt);
+				continue;
+			}
+
+		} while (1);
+
+		while (!vchi_msg_peek(instance->vchi_handle[0], (void **)&reply,
+				      &reply_len, VCHI_FLAGS_NONE)) {
+			if (reply->trans_id & 0x80000000) {
+				/* Async event or cmd from the VPU */
+				if (instance->vpu_event)
+					instance->vpu_event(instance, reply,
+							    reply_len);
+			} else {
+				vc_sm_cma_vchi_rx_ack(instance, cmd, reply,
+						      reply_len);
+			}
+
+			vchi_msg_remove(instance->vchi_handle[0]);
 		}
+
+		/* Go through the dead list and free them */
+		mutex_lock(&instance->lock);
+		list_for_each_entry_safe(cmd, cmd_tmp, &instance->dead_list,
+					 head) {
+			list_del(&cmd->head);
+			vc_vchi_cmd_delete(instance, cmd);
+		}
+		mutex_unlock(&instance->lock);
 	}
 
 	return 0;
-- 
GitLab


From d5248ee3b41e7be5dd4ea360d7be8ba671d851e3 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 4 Jul 2019 11:52:43 +0100
Subject: [PATCH 0699/1835] configs: Drop MMC_SDHCI_BCM2711 from
 arm64/bcm2711_defconfig

Apparently this is a vestigial setting and should be removed.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm64/configs/bcm2711_defconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 87f263a57a37a..3bcce6daa9efd 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -1031,7 +1031,6 @@ CONFIG_USB_G_HID=m
 CONFIG_USB_G_WEBCAM=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
-CONFIG_MMC_SDHCI_BCM2711=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_SDHOST=y
-- 
GitLab


From fae075e4e75656d7c146f560696905c751defd3c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 28 Jun 2019 11:30:49 +0100
Subject: [PATCH 0700/1835] Revert "media: vb2: Allow reqbufs(0) with "in use"
 MMAP buffers"

This reverts commit a2c73e18c1f657de6d654f51effa0a94863abbd8.
An alternative version was accepted upstream. Revert this patch to
apply that one.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../media/common/videobuf2/videobuf2-core.c   | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 9c29c97ef9fd5..73732e04f90b8 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -550,6 +550,20 @@ bool vb2_buffer_in_use(struct vb2_queue *q, struct vb2_buffer *vb)
 }
 EXPORT_SYMBOL(vb2_buffer_in_use);
 
+/*
+ * __buffers_in_use() - return true if any buffers on the queue are in use and
+ * the queue cannot be freed (by the means of REQBUFS(0)) call
+ */
+static bool __buffers_in_use(struct vb2_queue *q)
+{
+	unsigned int buffer;
+	for (buffer = 0; buffer < q->num_buffers; ++buffer) {
+		if (vb2_buffer_in_use(q, q->bufs[buffer]))
+			return true;
+	}
+	return false;
+}
+
 void vb2_core_querybuf(struct vb2_queue *q, unsigned int index, void *pb)
 {
 	call_void_bufop(q, fill_user_buffer, q->bufs[index], pb);
@@ -661,7 +675,16 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
 
 	if (*count == 0 || q->num_buffers != 0 ||
 	    (q->memory != VB2_MEMORY_UNKNOWN && q->memory != memory)) {
+		/*
+		 * We already have buffers allocated, so first check if they
+		 * are not in use and can be freed.
+		 */
 		mutex_lock(&q->mmap_lock);
+		if (q->memory == VB2_MEMORY_MMAP && __buffers_in_use(q)) {
+			mutex_unlock(&q->mmap_lock);
+			dprintk(1, "memory in use, cannot free\n");
+			return -EBUSY;
+		}
 
 		/*
 		 * Call queue_cancel to clean up any buffers in the PREPARED or
-- 
GitLab


From 4e3e6d5bee0bfb2a3a13dfd6c54cbeb2bcdf6d17 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hansverk@cisco.com>
Date: Thu, 23 Aug 2018 09:56:22 -0400
Subject: [PATCH 0701/1835] media: videodev2.h: add new capabilities for buffer
 types

Upstream commit f35f5d72e70e6b91389eb98fcabf43b79f40587f

VIDIOC_REQBUFS and VIDIOC_CREATE_BUFFERS will return capabilities
telling userspace what the given buffer type is capable of.

Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
---
 .../media/uapi/v4l/vidioc-create-bufs.rst     | 14 ++++++-
 .../media/uapi/v4l/vidioc-reqbufs.rst         | 42 ++++++++++++++++++-
 include/uapi/linux/videodev2.h                | 13 +++++-
 3 files changed, 65 insertions(+), 4 deletions(-)

diff --git a/Documentation/media/uapi/v4l/vidioc-create-bufs.rst b/Documentation/media/uapi/v4l/vidioc-create-bufs.rst
index a39e18d69511f..eadf6f757fbfe 100644
--- a/Documentation/media/uapi/v4l/vidioc-create-bufs.rst
+++ b/Documentation/media/uapi/v4l/vidioc-create-bufs.rst
@@ -102,7 +102,19 @@ than the number requested.
       - ``format``
       - Filled in by the application, preserved by the driver.
     * - __u32
-      - ``reserved``\ [8]
+      - ``capabilities``
+      - Set by the driver. If 0, then the driver doesn't support
+        capabilities. In that case all you know is that the driver is
+	guaranteed to support ``V4L2_MEMORY_MMAP`` and *might* support
+	other :c:type:`v4l2_memory` types. It will not support any others
+	capabilities. See :ref:`here <v4l2-buf-capabilities>` for a list of the
+	capabilities.
+
+	If you want to just query the capabilities without making any
+	other changes, then set ``count`` to 0, ``memory`` to
+	``V4L2_MEMORY_MMAP`` and ``format.type`` to the buffer type.
+    * - __u32
+      - ``reserved``\ [7]
       - A place holder for future extensions. Drivers and applications
 	must set the array to zero.
 
diff --git a/Documentation/media/uapi/v4l/vidioc-reqbufs.rst b/Documentation/media/uapi/v4l/vidioc-reqbufs.rst
index 316f52c8a310b..d4bbbb0c60e80 100644
--- a/Documentation/media/uapi/v4l/vidioc-reqbufs.rst
+++ b/Documentation/media/uapi/v4l/vidioc-reqbufs.rst
@@ -88,10 +88,50 @@ any DMA in progress, an implicit
 	``V4L2_MEMORY_DMABUF`` or ``V4L2_MEMORY_USERPTR``. See
 	:c:type:`v4l2_memory`.
     * - __u32
-      - ``reserved``\ [2]
+      - ``capabilities``
+      - Set by the driver. If 0, then the driver doesn't support
+        capabilities. In that case all you know is that the driver is
+	guaranteed to support ``V4L2_MEMORY_MMAP`` and *might* support
+	other :c:type:`v4l2_memory` types. It will not support any others
+	capabilities.
+
+	If you want to query the capabilities with a minimum of side-effects,
+	then this can be called with ``count`` set to 0, ``memory`` set to
+	``V4L2_MEMORY_MMAP`` and ``type`` set to the buffer type. This will
+	free any previously allocated buffers, so this is typically something
+	that will be done at the start of the application.
+    * - __u32
+      - ``reserved``\ [1]
       - A place holder for future extensions. Drivers and applications
 	must set the array to zero.
 
+.. tabularcolumns:: |p{6.1cm}|p{2.2cm}|p{8.7cm}|
+
+.. _v4l2-buf-capabilities:
+.. _V4L2-BUF-CAP-SUPPORTS-MMAP:
+.. _V4L2-BUF-CAP-SUPPORTS-USERPTR:
+.. _V4L2-BUF-CAP-SUPPORTS-DMABUF:
+.. _V4L2-BUF-CAP-SUPPORTS-REQUESTS:
+
+.. cssclass:: longtable
+
+.. flat-table:: V4L2 Buffer Capabilities Flags
+    :header-rows:  0
+    :stub-columns: 0
+    :widths:       3 1 4
+
+    * - ``V4L2_BUF_CAP_SUPPORTS_MMAP``
+      - 0x00000001
+      - This buffer type supports the ``V4L2_MEMORY_MMAP`` streaming mode.
+    * - ``V4L2_BUF_CAP_SUPPORTS_USERPTR``
+      - 0x00000002
+      - This buffer type supports the ``V4L2_MEMORY_USERPTR`` streaming mode.
+    * - ``V4L2_BUF_CAP_SUPPORTS_DMABUF``
+      - 0x00000004
+      - This buffer type supports the ``V4L2_MEMORY_DMABUF`` streaming mode.
+    * - ``V4L2_BUF_CAP_SUPPORTS_REQUESTS``
+      - 0x00000008
+      - This buffer type supports :ref:`requests <media-request-api>`.
 
 Return Value
 ============
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index 9a860b2772178..f24b5d1f16f4d 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -872,9 +872,16 @@ struct v4l2_requestbuffers {
 	__u32			count;
 	__u32			type;		/* enum v4l2_buf_type */
 	__u32			memory;		/* enum v4l2_memory */
-	__u32			reserved[2];
+	__u32			capabilities;
+	__u32			reserved[1];
 };
 
+/* capabilities for struct v4l2_requestbuffers and v4l2_create_buffers */
+#define V4L2_BUF_CAP_SUPPORTS_MMAP	(1 << 0)
+#define V4L2_BUF_CAP_SUPPORTS_USERPTR	(1 << 1)
+#define V4L2_BUF_CAP_SUPPORTS_DMABUF	(1 << 2)
+#define V4L2_BUF_CAP_SUPPORTS_REQUESTS	(1 << 3)
+
 /**
  * struct v4l2_plane - plane info for multi-planar buffers
  * @bytesused:		number of bytes occupied by data in the plane (payload)
@@ -2318,6 +2325,7 @@ struct v4l2_dbg_chip_info {
  *		return: number of created buffers
  * @memory:	enum v4l2_memory; buffer memory type
  * @format:	frame format, for which buffers are requested
+ * @capabilities: capabilities of this buffer type.
  * @reserved:	future extensions
  */
 struct v4l2_create_buffers {
@@ -2325,7 +2333,8 @@ struct v4l2_create_buffers {
 	__u32			count;
 	__u32			memory;
 	struct v4l2_format	format;
-	__u32			reserved[8];
+	__u32			capabilities;
+	__u32			reserved[7];
 };
 
 /*
-- 
GitLab


From 20db870d10e60d71c95cb658f6e22493b0412c9e Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hansverk@cisco.com>
Date: Thu, 23 Aug 2018 10:18:35 -0400
Subject: [PATCH 0702/1835] media: vb2: set reqbufs/create_bufs capabilities

Upstream commit e5079cf11373e4cc98be8b1072aece429eb2d4d2.

Set the capabilities field of v4l2_requestbuffers and v4l2_create_buffers.

The various mapping modes were easy, but for signaling the request capability
a new 'supports_requests' bitfield was added to videobuf2-core.h (and set in
vim2m and vivid). Drivers have to set this bitfield for any queue where
requests are supported.

Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

Minor modifications required on the backport
---
 drivers/media/common/videobuf2/videobuf2-v4l2.c | 17 +++++++++++++++++
 drivers/media/platform/vim2m.c                  |  1 +
 drivers/media/platform/vivid/vivid-core.c       |  5 +++++
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c   |  4 +++-
 drivers/media/v4l2-core/v4l2-ioctl.c            |  4 ++--
 include/media/videobuf2-core.h                  |  2 ++
 6 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
index 9d4a81bb0e597..6e4b03bd4f582 100644
--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
+++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
@@ -482,10 +482,24 @@ int vb2_querybuf(struct vb2_queue *q, struct v4l2_buffer *b)
 }
 EXPORT_SYMBOL(vb2_querybuf);
 
+static void fill_buf_caps(struct vb2_queue *q, u32 *caps)
+{
+	*caps = 0;
+	if (q->io_modes & VB2_MMAP)
+		*caps |= V4L2_BUF_CAP_SUPPORTS_MMAP;
+	if (q->io_modes & VB2_USERPTR)
+		*caps |= V4L2_BUF_CAP_SUPPORTS_USERPTR;
+	if (q->io_modes & VB2_DMABUF)
+		*caps |= V4L2_BUF_CAP_SUPPORTS_DMABUF;
+	if (q->supports_requests)
+		*caps |= V4L2_BUF_CAP_SUPPORTS_REQUESTS;
+}
+
 int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
 {
 	int ret = vb2_verify_memory_type(q, req->memory, req->type);
 
+	fill_buf_caps(q, &req->capabilities);
 	return ret ? ret : vb2_core_reqbufs(q, req->memory, &req->count);
 }
 EXPORT_SYMBOL_GPL(vb2_reqbufs);
@@ -513,6 +527,7 @@ int vb2_create_bufs(struct vb2_queue *q, struct v4l2_create_buffers *create)
 	int ret = vb2_verify_memory_type(q, create->memory, f->type);
 	unsigned i;
 
+	fill_buf_caps(q, &create->capabilities);
 	create->index = q->num_buffers;
 	if (create->count == 0)
 		return ret != -EBUSY ? ret : 0;
@@ -713,6 +728,7 @@ int vb2_ioctl_reqbufs(struct file *file, void *priv,
 	struct video_device *vdev = video_devdata(file);
 	int res = vb2_verify_memory_type(vdev->queue, p->memory, p->type);
 
+	fill_buf_caps(vdev->queue, &p->capabilities);
 	if (res)
 		return res;
 	if (vb2_queue_is_busy(vdev, file))
@@ -734,6 +750,7 @@ int vb2_ioctl_create_bufs(struct file *file, void *priv,
 			p->format.type);
 
 	p->index = vdev->queue->num_buffers;
+	fill_buf_caps(vdev->queue, &p->capabilities);
 	/*
 	 * If count == 0, then just check if memory and type are valid.
 	 * Any -EBUSY result from vb2_verify_memory_type can be mapped to 0.
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index 462099a141e4a..12c986acbd7e8 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -841,6 +841,7 @@ static int queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_queue *ds
 	src_vq->mem_ops = &vb2_vmalloc_memops;
 	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
 	src_vq->lock = &ctx->dev->dev_mutex;
+	src_vq->supports_requests = true;
 
 	ret = vb2_queue_init(src_vq);
 	if (ret)
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 31db363602e53..ac6e87fb8297e 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -1060,6 +1060,7 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
 		q->min_buffers_needed = 2;
 		q->lock = &dev->mutex;
 		q->dev = dev->v4l2_dev.dev;
+		q->supports_requests = true;
 
 		ret = vb2_queue_init(q);
 		if (ret)
@@ -1080,6 +1081,7 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
 		q->min_buffers_needed = 2;
 		q->lock = &dev->mutex;
 		q->dev = dev->v4l2_dev.dev;
+		q->supports_requests = true;
 
 		ret = vb2_queue_init(q);
 		if (ret)
@@ -1100,6 +1102,7 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
 		q->min_buffers_needed = 2;
 		q->lock = &dev->mutex;
 		q->dev = dev->v4l2_dev.dev;
+		q->supports_requests = true;
 
 		ret = vb2_queue_init(q);
 		if (ret)
@@ -1120,6 +1123,7 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
 		q->min_buffers_needed = 2;
 		q->lock = &dev->mutex;
 		q->dev = dev->v4l2_dev.dev;
+		q->supports_requests = true;
 
 		ret = vb2_queue_init(q);
 		if (ret)
@@ -1139,6 +1143,7 @@ static int vivid_create_instance(struct platform_device *pdev, int inst)
 		q->min_buffers_needed = 8;
 		q->lock = &dev->mutex;
 		q->dev = dev->v4l2_dev.dev;
+		q->supports_requests = true;
 
 		ret = vb2_queue_init(q);
 		if (ret)
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 6481212fda772..86ff70caa7536 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -251,7 +251,8 @@ struct v4l2_create_buffers32 {
 	__u32			count;
 	__u32			memory;	/* enum v4l2_memory */
 	struct v4l2_format32	format;
-	__u32			reserved[8];
+	__u32			capabilities;
+	__u32			reserved[7];
 };
 
 static int __bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
@@ -411,6 +412,7 @@ static int put_v4l2_create32(struct v4l2_create_buffers __user *p64,
 	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
 	    copy_in_user(p32, p64,
 			 offsetof(struct v4l2_create_buffers32, format)) ||
+	    assign_in_user(&p32->capabilities, &p64->capabilities) ||
 	    copy_in_user(p32->reserved, p64->reserved, sizeof(p64->reserved)))
 		return -EFAULT;
 	return __put_v4l2_format32(&p64->format, &p32->format);
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index a4d3e94a400c8..f30f7a1de79cb 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -1879,7 +1879,7 @@ static int v4l_reqbufs(const struct v4l2_ioctl_ops *ops,
 	if (ret)
 		return ret;
 
-	CLEAR_AFTER_FIELD(p, memory);
+	CLEAR_AFTER_FIELD(p, capabilities);
 
 	return ops->vidioc_reqbufs(file, fh, p);
 }
@@ -1920,7 +1920,7 @@ static int v4l_create_bufs(const struct v4l2_ioctl_ops *ops,
 	if (ret)
 		return ret;
 
-	CLEAR_AFTER_FIELD(create, format);
+	CLEAR_AFTER_FIELD(create, capabilities);
 
 	v4l_sanitize_format(&create->format);
 
diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
index e8907dac97d78..fc4cf49debe40 100644
--- a/include/media/videobuf2-core.h
+++ b/include/media/videobuf2-core.h
@@ -449,6 +449,7 @@ struct vb2_buf_ops {
  * @quirk_poll_must_check_waiting_for_buffers: Return %EPOLLERR at poll when QBUF
  *              has not been called. This is a vb1 idiom that has been adopted
  *              also by vb2.
+ * @supports_requests: this queue supports the Request API.
  * @lock:	pointer to a mutex that protects the &struct vb2_queue. The
  *		driver can set this to a mutex to let the v4l2 core serialize
  *		the queuing ioctls. If the driver wants to handle locking
@@ -516,6 +517,7 @@ struct vb2_queue {
 	unsigned			fileio_write_immediately:1;
 	unsigned			allow_zero_bytesused:1;
 	unsigned		   quirk_poll_must_check_waiting_for_buffers:1;
+	unsigned			supports_requests:1;
 
 	struct mutex			*lock;
 	void				*owner;
-- 
GitLab


From 6e787b87ace9f945f17a9022288e2758ed281cf7 Mon Sep 17 00:00:00 2001
From: John Sheu <sheu@chromium.org>
Date: Thu, 15 Nov 2018 10:57:16 -0500
Subject: [PATCH 0703/1835] media: vb2: Allow reqbufs(0) with "in use" MMAP
 buffers

Upstream commit d644cca50f366cd109845ae92e37c09ed79adf81

Videobuf2 presently does not allow VIDIOC_REQBUFS to destroy outstanding
buffers if the queue is of type V4L2_MEMORY_MMAP, and if the buffers are
considered "in use".  This is different behavior than for other memory
types and prevents us from deallocating buffers in following two cases:

1) There are outstanding mmap()ed views on the buffer. However even if
   we put the buffer in reqbufs(0), there will be remaining references,
   due to vma .open/close() adjusting vb2 buffer refcount appropriately.
   This means that the buffer will be in fact freed only when the last
   mmap()ed view is unmapped.

2) Buffer has been exported as a DMABUF. Refcount of the vb2 buffer
   is managed properly by VB2 DMABUF ops, i.e. incremented on DMABUF
   get and decremented on DMABUF release. This means that the buffer
   will be alive until all importers release it.

Considering both cases above, there does not seem to be any need to
prevent reqbufs(0) operation, because buffer lifetime is already
properly managed by both mmap() and DMABUF code paths. Let's remove it
and allow userspace freeing the queue (and potentially allocating a new
one) even though old buffers might be still in processing.

To let userspace know that the kernel now supports orphaning buffers
that are still in use, add a new V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS
to be set by reqbufs and create_bufs.

[p.zabel@pengutronix.de: added V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS,
 updated documentation, and added back debug message]

Signed-off-by: John Sheu <sheu@chromium.org>
Reviewed-by: Pawel Osciak <posciak@chromium.org>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil-cisco@xs4all.nl: added V4L2-BUF-CAP-SUPPORTS-ORPHANED-BUFS ref]
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
---
 Documentation/media/uapi/v4l/vidioc-reqbufs.rst | 17 ++++++++++++++---
 drivers/media/common/videobuf2/videobuf2-core.c |  8 +++-----
 drivers/media/common/videobuf2/videobuf2-v4l2.c |  2 +-
 include/uapi/linux/videodev2.h                  |  1 +
 4 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/Documentation/media/uapi/v4l/vidioc-reqbufs.rst b/Documentation/media/uapi/v4l/vidioc-reqbufs.rst
index d4bbbb0c60e80..e62a157827903 100644
--- a/Documentation/media/uapi/v4l/vidioc-reqbufs.rst
+++ b/Documentation/media/uapi/v4l/vidioc-reqbufs.rst
@@ -59,9 +59,14 @@ When the I/O method is not supported the ioctl returns an ``EINVAL`` error
 code.
 
 Applications can call :ref:`VIDIOC_REQBUFS` again to change the number of
-buffers, however this cannot succeed when any buffers are still mapped.
-A ``count`` value of zero frees all buffers, after aborting or finishing
-any DMA in progress, an implicit
+buffers. Note that if any buffers are still mapped or exported via DMABUF,
+then :ref:`VIDIOC_REQBUFS` can only succeed if the
+``V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS`` capability is set. Otherwise
+:ref:`VIDIOC_REQBUFS` will return the ``EBUSY`` error code.
+If ``V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS`` is set, then these buffers are
+orphaned and will be freed when they are unmapped or when the exported DMABUF
+fds are closed. A ``count`` value of zero frees or orphans all buffers, after
+aborting or finishing any DMA in progress, an implicit
 :ref:`VIDIOC_STREAMOFF <VIDIOC_STREAMON>`.
 
 
@@ -112,6 +117,7 @@ any DMA in progress, an implicit
 .. _V4L2-BUF-CAP-SUPPORTS-USERPTR:
 .. _V4L2-BUF-CAP-SUPPORTS-DMABUF:
 .. _V4L2-BUF-CAP-SUPPORTS-REQUESTS:
+.. _V4L2-BUF-CAP-SUPPORTS-ORPHANED-BUFS:
 
 .. cssclass:: longtable
 
@@ -132,6 +138,11 @@ any DMA in progress, an implicit
     * - ``V4L2_BUF_CAP_SUPPORTS_REQUESTS``
       - 0x00000008
       - This buffer type supports :ref:`requests <media-request-api>`.
+    * - ``V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS``
+      - 0x00000010
+      - The kernel allows calling :ref:`VIDIOC_REQBUFS` while buffers are still
+        mapped or exported via DMABUF. These orphaned buffers will be freed
+        when they are unmapped or when the exported DMABUF fds are closed.
 
 Return Value
 ============
diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 73732e04f90b8..b0477136f728f 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -680,11 +680,9 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
 		 * are not in use and can be freed.
 		 */
 		mutex_lock(&q->mmap_lock);
-		if (q->memory == VB2_MEMORY_MMAP && __buffers_in_use(q)) {
-			mutex_unlock(&q->mmap_lock);
-			dprintk(1, "memory in use, cannot free\n");
-			return -EBUSY;
-		}
+		if (debug && q->memory == VB2_MEMORY_MMAP &&
+		    __buffers_in_use(q))
+			dprintk(1, "memory in use, orphaning buffers\n");
 
 		/*
 		 * Call queue_cancel to clean up any buffers in the PREPARED or
diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
index 6e4b03bd4f582..168235c6fdb27 100644
--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
+++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
@@ -484,7 +484,7 @@ EXPORT_SYMBOL(vb2_querybuf);
 
 static void fill_buf_caps(struct vb2_queue *q, u32 *caps)
 {
-	*caps = 0;
+	*caps = V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS;
 	if (q->io_modes & VB2_MMAP)
 		*caps |= V4L2_BUF_CAP_SUPPORTS_MMAP;
 	if (q->io_modes & VB2_USERPTR)
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index f24b5d1f16f4d..beded53c6039f 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -881,6 +881,7 @@ struct v4l2_requestbuffers {
 #define V4L2_BUF_CAP_SUPPORTS_USERPTR	(1 << 1)
 #define V4L2_BUF_CAP_SUPPORTS_DMABUF	(1 << 2)
 #define V4L2_BUF_CAP_SUPPORTS_REQUESTS	(1 << 3)
+#define V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS (1 << 4)
 
 /**
  * struct v4l2_plane - plane info for multi-planar buffers
-- 
GitLab


From 18acdefe95cfc7ccd76d0f0cd00e9c8d9f66fad4 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 5 Jul 2019 09:22:10 +0100
Subject: [PATCH 0704/1835] overlays: Add real parameters to the rpi-poe
 overlay

As a result of being loaded by the POE HAT EEPROM, the rpi-poe overlay
doesn't expose parameters in the usual way; instead it adds them to
the base Device Tree, and the user is expected to use "dtparam=..."
to access them.

To make the documentation correct and to protect users who load the
overlay explicitly, expecting to be able to use the parameters, add
real parameters to the overlay as well.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/rpi-poe-overlay.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
index 75e2f2ed5a470..21f8fe6f12295 100644
--- a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
@@ -60,4 +60,11 @@
 			poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
 		};
 	};
+
+	__overrides__ {
+		poe_fan_temp0 =		<&trip0>,"temperature:0";
+		poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
+		poe_fan_temp1 =		<&trip1>,"temperature:0";
+		poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
+	};
 };
-- 
GitLab


From 8332ad714232397caa3280dfdce0a28f853a2e0e Mon Sep 17 00:00:00 2001
From: Phil Elwell <pelwell@users.noreply.github.com>
Date: Fri, 5 Jul 2019 14:49:22 +0100
Subject: [PATCH 0705/1835] overlays: Rename pi3- overlays to be less
 model-specific (#3052)

Rename the various pi3- overlays to be more generic, listing
the devices they apply to in the README. The original names are
retained for backwards compatibility as files that just include
the new versions - the README marks them as being deprecated.

See: https://github.com/raspberrypi/firmware/issues/1174

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  4 +
 arch/arm/boot/dts/overlays/README             | 97 ++++++++++++-------
 .../arm/boot/dts/overlays/act-led-overlay.dts | 27 ++++++
 .../boot/dts/overlays/disable-bt-overlay.dts  | 55 +++++++++++
 .../dts/overlays/disable-wifi-overlay.dts     | 20 ++++
 .../boot/dts/overlays/miniuart-bt-overlay.dts | 74 ++++++++++++++
 .../boot/dts/overlays/pi3-act-led-overlay.dts | 28 +-----
 .../dts/overlays/pi3-disable-bt-overlay.dts   | 56 +----------
 .../dts/overlays/pi3-disable-wifi-overlay.dts | 21 +---
 .../dts/overlays/pi3-miniuart-bt-overlay.dts  | 75 +-------------
 10 files changed, 246 insertions(+), 211 deletions(-)
 create mode 100644 arch/arm/boot/dts/overlays/act-led-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/disable-bt-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 2faeb1145125d..e406582521fbe 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -1,6 +1,7 @@
 # Overlays for the Raspberry Pi platform
 
 dtbo-$(CONFIG_ARCH_BCM2835) += \
+	act-led.dtbo \
 	adau1977-adc.dtbo \
 	adau7002-simple.dtbo \
 	ads1015.dtbo \
@@ -26,6 +27,8 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	dht11.dtbo \
 	dionaudio-loco.dtbo \
 	dionaudio-loco-v2.dtbo \
+	disable-bt.dtbo \
+	disable-wifi.dtbo \
 	dpi18.dtbo \
 	dpi24.dtbo \
 	draws.dtbo \
@@ -91,6 +94,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	media-center.dtbo \
 	midi-uart0.dtbo \
 	midi-uart1.dtbo \
+	miniuart-bt.dtbo \
 	mmc.dtbo \
 	mpu6050.dtbo \
 	mz61581.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 0c108669311a2..336d0d6446c15 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -180,14 +180,16 @@ Params:
 
         act_led_activelow       Set to "on" to invert the sense of the LED
                                 (default "off")
-                                N.B. For Pi3 see pi3-act-led overlay.
+                                N.B. For Pi 3B, 3B+, 3A+ and 4B, use the act-led
+                                overlay.
 
         act_led_gpio            Set which GPIO to use for the activity LED
                                 (in case you want to connect it to an external
                                 device)
                                 (default "16" on a non-Plus board, "47" on a
                                 Plus or Pi 2)
-                                N.B. For Pi3 see pi3-act-led overlay.
+                                N.B. For Pi 3B, 3B+, 3A+ and 4B, use the act-led
+                                overlay.
 
         pwr_led_trigger
         pwr_led_activelow
@@ -205,6 +207,23 @@ Params:
         and the other i2c baudrate parameters.
 
 
+Name:   act-led
+Info:   Pi 3B, 3B+, 3A+ and 4B use a GPIO expander to drive the LEDs which can
+        only be accessed from the VPU. There is a special driver for this with a
+        separate DT node, which has the unfortunate consequence of breaking the
+        act_led_gpio and act_led_activelow dtparams.
+        This overlay changes the GPIO controller back to the standard one and
+        restores the dtparams.
+Load:   dtoverlay=act-led,<param>=<val>
+Params: activelow               Set to "on" to invert the sense of the LED
+                                (default "off")
+
+        gpio                    Set which GPIO to use for the activity LED
+                                (in case you want to connect it to an external
+                                device)
+                                REQUIRED
+
+
 Name:   adau1977-adc
 Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
         and I2S for data.
@@ -509,6 +528,21 @@ Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
                                 that does not result in clipping/distortion!)
 
 
+Name:   disable-bt
+Info:   Disable onboard Bluetooth on Pi 3B, 3B+, 3A+, 4B and Zero W, restoring
+        UART0/ttyAMA0 over GPIOs 14 & 15.
+        N.B. To disable the systemd service that initialises the modem so it
+        doesn't use the UART, use 'sudo systemctl disable hciuart'.
+Load:   dtoverlay=disable-bt
+Params: <None>
+
+
+Name:   disable-wifi
+Info:   Disable onboard WiFi on Pi 3B, 3B+, 3A+, 4B and Zero W.
+Load:   dtoverlay=disable-wifi
+Params: <None>
+
+
 Name:   dpi18
 Info:   Overlay for a generic 18-bit DPI display
         This uses GPIOs 0-21 (so no I2C, uart etc.), and activates the output
@@ -1447,6 +1481,20 @@ Load:   dtoverlay=midi-uart1
 Params: <None>
 
 
+Name:   miniuart-bt
+Info:   Switch the onboard Bluetooth function on Pi 3B, 3B+, 3A+, 4B and Zero W
+        to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 &
+        15. Note that this may reduce the maximum usable baudrate.
+        N.B. It is also necessary to edit /lib/systemd/system/hciuart.service
+        and replace ttyAMA0 with ttyS0, unless using Raspbian or another
+        distribution with udev rules that create /dev/serial0 and /dev/serial1,
+        in which case use /dev/serial1 instead because it will always be
+        correct. Furthermore, you must also set core_freq and core_freq_min to
+        the same value in config.txt or the miniuart will not work.
+Load:   dtoverlay=miniuart-bt
+Params: <None>
+
+
 Name:   mmc
 Info:   Selects the bcm2835-mmc SD/MMC driver, optionally with overclock
 Load:   dtoverlay=mmc,<param>=<val>
@@ -1509,48 +1557,27 @@ Params: panel                   Display panel (required):
 
 
 Name:   pi3-act-led
-Info:   Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
-        from the VPU. There is a special driver for this with a separate DT
-        node, which has the unfortunate consequence of breaking the
-        act_led_gpio and act_led_activelow dtparams.
-        This overlay changes the GPIO controller back to the standard one and
-        restores the dtparams.
-Load:   dtoverlay=pi3-act-led,<param>=<val>
-Params: activelow               Set to "on" to invert the sense of the LED
-                                (default "off")
-
-        gpio                    Set which GPIO to use for the activity LED
-                                (in case you want to connect it to an external
-                                device)
-                                REQUIRED
+Info:   This overlay has been renamed act-led, keeping pi3-act-led as an alias
+        for backwards compatibility.
+Load:   <Deprecated>
 
 
 Name:   pi3-disable-bt
-Info:   Disable Pi3 Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15
-        N.B. To disable the systemd service that initialises the modem so it
-        doesn't use the UART, use 'sudo systemctl disable hciuart'.
-Load:   dtoverlay=pi3-disable-bt
-Params: <None>
+Info:   This overlay has been renamed disable-bt, keeping pi3-disable-bt as an
+        alias for backwards compatibility.
+Load:   <Deprecated>
 
 
 Name:   pi3-disable-wifi
-Info:   Disable Pi3 onboard WiFi
-Load:   dtoverlay=pi3-disable-wifi
-Params: <None>
+Info:   This overlay has been renamed disable-wifi, keeping pi3-disable-wifi as
+        an alias for backwards compatibility.
+Load:   <Deprecated>
 
 
 Name:   pi3-miniuart-bt
-Info:   Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
-        UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
-        usable baudrate.
-        N.B. It is also necessary to edit /lib/systemd/system/hciuart.service
-        and replace ttyAMA0 with ttyS0, unless you have a system with udev rules
-        that create /dev/serial0 and /dev/serial1, in which case use
-        /dev/serial1 instead because it will always be correct. Furthermore,
-        you must also set core_freq=250 in config.txt or the miniuart will not
-        work.
-Load:   dtoverlay=pi3-miniuart-bt
-Params: <None>
+Info:   This overlay has been renamed miniuart-bt, keeping pi3-miniuart-bt as
+        an alias for backwards compatibility.
+Load:   <Deprecated>
 
 
 Name:   pibell
diff --git a/arch/arm/boot/dts/overlays/act-led-overlay.dts b/arch/arm/boot/dts/overlays/act-led-overlay.dts
new file mode 100644
index 0000000000000..2f4bbb407f896
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/act-led-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/* Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
+   from the VPU. There is a special driver for this with a separate DT node,
+   which has the unfortunate consequence of breaking the act_led_gpio and
+   act_led_activelow dtparams.
+
+   This overlay changes the GPIO controller back to the standard one and
+   restores the dtparams.
+*/
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&act_led>;
+		frag0: __overlay__ {
+			gpios = <&gpio 0 0>;
+		};
+	};
+
+	__overrides__ {
+		gpio = <&frag0>,"gpios:4";
+		activelow = <&frag0>,"gpios:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
new file mode 100644
index 0000000000000..2f1b655a133c3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/disable-bt-overlay.dts
@@ -0,0 +1,55 @@
+/dts-v1/;
+/plugin/;
+
+/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
+   To disable the systemd service that initialises the modem so it doesn't use
+   the UART:
+
+       sudo systemctl disable hciuart
+*/
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&uart1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&uart0_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@3 {
+		target = <&bt_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@4 {
+		target-path = "/aliases";
+		__overlay__ {
+			serial0 = "/soc/serial@7e201000";
+			serial1 = "/soc/serial@7e215040";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
new file mode 100644
index 0000000000000..75e0464639000
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/disable-wifi-overlay.dts
@@ -0,0 +1,20 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&mmcnr>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
new file mode 100644
index 0000000000000..30d3d8549da0a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/miniuart-bt-overlay.dts
@@ -0,0 +1,74 @@
+/dts-v1/;
+/plugin/;
+
+/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
+   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
+   usable baudrate.
+
+   It is also necessary to edit /lib/systemd/system/hciuart.service and
+   replace ttyAMA0 with ttyS0, unless you have a system with udev rules
+   that create /dev/serial0 and /dev/serial1, in which case use /dev/serial1
+   instead because it will always be correct.
+
+   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
+   then the firmware will replace with the appropriate port whether or not
+   this overlay is used.
+*/
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart1>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart1_pins &bt_pins &fake_bt_cts>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&uart0_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@3 {
+		target = <&uart1_pins>;
+		__overlay__ {
+			brcm,pins = <32 33>;
+			brcm,function = <2>; /* alt5=UART1 */
+			brcm,pull = <0 2>;
+		};
+	};
+
+	fragment@4 {
+		target = <&gpio>;
+		__overlay__ {
+			fake_bt_cts: fake_bt_cts {
+				brcm,pins = <31>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/aliases";
+		__overlay__ {
+			serial0 = "/soc/serial@7e201000";
+			serial1 = "/soc/serial@7e215040";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
index 2f4bbb407f896..aedfc90e8a31d 100644
--- a/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
@@ -1,27 +1 @@
-/dts-v1/;
-/plugin/;
-
-/* Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
-   from the VPU. There is a special driver for this with a separate DT node,
-   which has the unfortunate consequence of breaking the act_led_gpio and
-   act_led_activelow dtparams.
-
-   This overlay changes the GPIO controller back to the standard one and
-   restores the dtparams.
-*/
-
-/{
-	compatible = "brcm,bcm2835";
-
-	fragment@0 {
-		target = <&act_led>;
-		frag0: __overlay__ {
-			gpios = <&gpio 0 0>;
-		};
-	};
-
-	__overrides__ {
-		gpio = <&frag0>,"gpios:4";
-		activelow = <&frag0>,"gpios:8";
-	};
-};
+#include "act-led-overlay.dts"
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
index 2f1b655a133c3..e09a49295236b 100644
--- a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
@@ -1,55 +1 @@
-/dts-v1/;
-/plugin/;
-
-/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
-   To disable the systemd service that initialises the modem so it doesn't use
-   the UART:
-
-       sudo systemctl disable hciuart
-*/
-
-/{
-	compatible = "brcm,bcm2835";
-
-	fragment@0 {
-		target = <&uart1>;
-		__overlay__ {
-			status = "disabled";
-		};
-	};
-
-	fragment@1 {
-		target = <&uart0>;
-		__overlay__ {
-			pinctrl-names = "default";
-			pinctrl-0 = <&uart0_pins>;
-			status = "okay";
-		};
-	};
-
-	fragment@2 {
-		target = <&uart0_pins>;
-		__overlay__ {
-			brcm,pins;
-			brcm,function;
-			brcm,pull;
-		};
-	};
-
-	fragment@3 {
-		target = <&bt_pins>;
-		__overlay__ {
-			brcm,pins;
-			brcm,function;
-			brcm,pull;
-		};
-	};
-
-	fragment@4 {
-		target-path = "/aliases";
-		__overlay__ {
-			serial0 = "/soc/serial@7e201000";
-			serial1 = "/soc/serial@7e215040";
-		};
-	};
-};
+#include "disable-bt-overlay.dts"
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
index 75e0464639000..b61b69c14f37c 100644
--- a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
@@ -1,20 +1 @@
-/dts-v1/;
-/plugin/;
-
-/{
-	compatible = "brcm,bcm2835";
-
-	fragment@0 {
-		target = <&mmc>;
-		__overlay__ {
-			status = "disabled";
-		};
-	};
-
-	fragment@1 {
-		target = <&mmcnr>;
-		__overlay__ {
-			status = "disabled";
-		};
-	};
-};
+#include "disable-wifi-overlay.dts"
diff --git a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
index 30d3d8549da0a..94c14267716eb 100644
--- a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
+++ b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
@@ -1,74 +1 @@
-/dts-v1/;
-/plugin/;
-
-/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
-   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
-   usable baudrate.
-
-   It is also necessary to edit /lib/systemd/system/hciuart.service and
-   replace ttyAMA0 with ttyS0, unless you have a system with udev rules
-   that create /dev/serial0 and /dev/serial1, in which case use /dev/serial1
-   instead because it will always be correct.
-
-   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
-   then the firmware will replace with the appropriate port whether or not
-   this overlay is used.
-*/
-
-/{
-	compatible = "brcm,bcm2835";
-
-	fragment@0 {
-		target = <&uart0>;
-		__overlay__ {
-			pinctrl-names = "default";
-			pinctrl-0 = <&uart0_pins>;
-			status = "okay";
-		};
-	};
-
-	fragment@1 {
-		target = <&uart1>;
-		__overlay__ {
-			pinctrl-names = "default";
-			pinctrl-0 = <&uart1_pins &bt_pins &fake_bt_cts>;
-			status = "okay";
-		};
-	};
-
-	fragment@2 {
-		target = <&uart0_pins>;
-		__overlay__ {
-			brcm,pins;
-			brcm,function;
-			brcm,pull;
-		};
-	};
-
-	fragment@3 {
-		target = <&uart1_pins>;
-		__overlay__ {
-			brcm,pins = <32 33>;
-			brcm,function = <2>; /* alt5=UART1 */
-			brcm,pull = <0 2>;
-		};
-	};
-
-	fragment@4 {
-		target = <&gpio>;
-		__overlay__ {
-			fake_bt_cts: fake_bt_cts {
-				brcm,pins = <31>;
-				brcm,function = <1>; /* output */
-			};
-		};
-	};
-
-	fragment@5 {
-		target-path = "/aliases";
-		__overlay__ {
-			serial0 = "/soc/serial@7e201000";
-			serial1 = "/soc/serial@7e215040";
-		};
-	};
-};
+#include "miniuart-bt-overlay.dts"
-- 
GitLab


From b689c4cebf3517f6d8a804d264ecfb4d676572a7 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Fri, 21 Jun 2019 03:52:49 -0700
Subject: [PATCH 0706/1835] i2c: bcm2835: Move IRQ request after clock code in
 probe

Commit 4a5cfa39465cad25dd736d7ceba8a5d32eea4ecc upstream.

If any of the clock code in the probe fails and returns, the IRQ
will not be freed.  Moving the IRQ request to last allows it to
be freed on any errors further up in the probe function.  devm_
calls can apparently not be used because there are some potential
race conditions that will arise.

Fixes: bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF")
Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Acked-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
---
 drivers/i2c/busses/i2c-bcm2835.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index 108d2ae4632c8..27b2f204c6938 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -521,20 +521,6 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 	if (IS_ERR(i2c_dev->regs))
 		return PTR_ERR(i2c_dev->regs);
 
-	irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-	if (!irq) {
-		dev_err(&pdev->dev, "No IRQ resource\n");
-		return -ENODEV;
-	}
-	i2c_dev->irq = irq->start;
-
-	ret = request_irq(i2c_dev->irq, bcm2835_i2c_isr, IRQF_SHARED,
-			  dev_name(&pdev->dev), i2c_dev);
-	if (ret) {
-		dev_err(&pdev->dev, "Could not request IRQ\n");
-		return -ENODEV;
-	}
-
 	mclk_name = of_clk_get_parent_name(pdev->dev.of_node, 0);
 
 	bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk_name, i2c_dev);
@@ -564,6 +550,20 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 		return ret;
 	}
 
+	irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+	if (!irq) {
+		dev_err(&pdev->dev, "No IRQ resource\n");
+		return -ENODEV;
+	}
+	i2c_dev->irq = irq->start;
+
+	ret = request_irq(i2c_dev->irq, bcm2835_i2c_isr, IRQF_SHARED,
+			  dev_name(&pdev->dev), i2c_dev);
+	if (ret) {
+		dev_err(&pdev->dev, "Could not request IRQ\n");
+		return -ENODEV;
+	}
+
 	adap = &i2c_dev->adapter;
 	i2c_set_adapdata(adap, i2c_dev);
 	adap->owner = THIS_MODULE;
-- 
GitLab


From 8ea4810a9f2d0c510f6a8fd56805e82ac76904a3 Mon Sep 17 00:00:00 2001
From: Annaliese McDermond <nh6z@nh6z.net>
Date: Fri, 21 Jun 2019 03:52:50 -0700
Subject: [PATCH 0707/1835] i2c: bcm2835: Ensure clock exists when probing

Commit 9de93b04df16b055824e3f1f13fedb90fbcf2e4f upstream.

Probe function fails to recognize that upstream clock actually
doesn't yet exist because clock driver has not been initialized.
Actually try to go get the clock and test for its existence
before trying to set up a downstream clock based upon it.

This fixes a bug that causes the i2c driver not to work with
monolithic kernels.

Fixes: bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF")
Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
Acked-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
---
 drivers/i2c/busses/i2c-bcm2835.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index 27b2f204c6938..79d06286b9266 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -244,15 +244,18 @@ static const struct clk_ops clk_bcm2835_i2c_ops = {
 };
 
 static struct clk *bcm2835_i2c_register_div(struct device *dev,
-					const char *mclk_name,
+					struct clk *mclk,
 					struct bcm2835_i2c_dev *i2c_dev)
 {
 	struct clk_init_data init;
 	struct clk_bcm2835_i2c *priv;
 	char name[32];
+	const char *mclk_name;
 
 	snprintf(name, sizeof(name), "%s_div", dev_name(dev));
 
+	mclk_name = __clk_get_name(mclk);
+
 	init.ops = &clk_bcm2835_i2c_ops;
 	init.name = name;
 	init.parent_names = (const char* []) { mclk_name };
@@ -505,8 +508,8 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 	struct resource *mem, *irq;
 	int ret;
 	struct i2c_adapter *adap;
-	const char *mclk_name;
 	struct clk *bus_clk;
+	struct clk *mclk;
 	u32 bus_clk_rate;
 
 	i2c_dev = devm_kzalloc(&pdev->dev, sizeof(*i2c_dev), GFP_KERNEL);
@@ -521,9 +524,14 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
 	if (IS_ERR(i2c_dev->regs))
 		return PTR_ERR(i2c_dev->regs);
 
-	mclk_name = of_clk_get_parent_name(pdev->dev.of_node, 0);
+	mclk = devm_clk_get(&pdev->dev, NULL);
+	if (IS_ERR(mclk)) {
+		if (PTR_ERR(mclk) != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Could not get clock\n");
+		return PTR_ERR(mclk);
+	}
 
-	bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk_name, i2c_dev);
+	bus_clk = bcm2835_i2c_register_div(&pdev->dev, mclk, i2c_dev);
 
 	if (IS_ERR(bus_clk)) {
 		dev_err(&pdev->dev, "Could not register clock\n");
-- 
GitLab


From 55b89745a4782db50e86291bd1adee8fb44b84ad Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 9 Jul 2019 10:32:40 +0100
Subject: [PATCH 0708/1835] overlays: i2c-gpio: Fix the "bus" parameter

The "bus" parameter has two functions - providing unique names for
multiple instances of the overlay, and allowing the number of the bus
(i.e. "i2c-<bus>") to be specified. The second function hasn't worked
as intended because the overlay doesn't include a "reg" property and
the firmware intentionally won't create a "reg" property if one doesn't
already exist.

Allow the bus numbering scheme to work as intended by providing a "reg"
with a default value that means "the next available one".

See: https://github.com/raspberrypi/linux/issues/3062

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
index 74b1911a949f9..39e7bc5fa9d88 100644
--- a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
@@ -7,8 +7,10 @@
 
 	fragment@0 {
 		target-path = "/";
+
 		__overlay__ {
 			i2c_gpio: i2c@0 {
+				reg = <0xffffffff>;
 				compatible = "i2c-gpio";
 				gpios = <&gpio 23 0 /* sda */
 					 &gpio 24 0 /* scl */
-- 
GitLab


From 9bf5cd2dc5bf4680ec14b372fae5b457c6ccb497 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 11 Jul 2019 13:13:39 +0100
Subject: [PATCH 0709/1835] tty: amba-pl011: Make TX optimisation conditional

pl011_tx_chars takes a "from_irq" parameter to reduce the number of
register accesses. When from_irq is true the function assumes that the
FIFO is half empty and writes up to half a FIFO's worth of bytes
without polling the FIFO status register, the reasoning being that
the function is being called as a result of the TX interrupt being
raised. This logic would work were it not for the fact that
pl011_rx_chars, called from pl011_int before pl011_tx_chars, releases
the spinlock before calling tty_flip_buffer_push.

A user thread writing to the UART claims the spinlock and ultimately
calls pl011_tx_chars with from_irq set to false. This reverts to the
older logic that polls the FIFO status register before sending every
byte. If this happen on an SMP system during the section of the IRQ
handler where the spinlock has been released, then by the time the TX
interrupt handler is called, the FIFO may already be full, and any
further writes are likely to be lost.

The fix involves adding a per-port flag that is true iff running from
within the interrupt handler and the spinlock has not yet been released.
This flag is then used as the value for the from_irq parameter of
pl011_tx_chars, causing polling to be used in the unsafe case.

Fixes: 1e84d22322ce ("serial/amba-pl011: Refactor and simplify TX FIFO handling")

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/tty/serial/amba-pl011.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 1121df572ca6d..bca02b167e947 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -270,6 +270,7 @@ struct uart_amba_port {
 	unsigned int		old_cr;		/* state during shutdown */
 	unsigned int		fixed_baud;	/* vendor-set fixed baud rate */
 	char			type[12];
+	bool			irq_locked;	/* in irq, unreleased lock */
 #ifdef CONFIG_DMA_ENGINE
 	/* DMA stuff */
 	bool			using_tx_dma;
@@ -814,6 +815,7 @@ __acquires(&uap->port.lock)
 		return;
 
 	/* Avoid deadlock with the DMA engine callback */
+	uap->irq_locked = 0;
 	spin_unlock(&uap->port.lock);
 	dmaengine_terminate_all(uap->dmatx.chan);
 	spin_lock(&uap->port.lock);
@@ -941,6 +943,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap,
 		fifotaken = pl011_fifo_to_tty(uap);
 	}
 
+	uap->irq_locked = 0;
 	spin_unlock(&uap->port.lock);
 	dev_vdbg(uap->port.dev,
 		 "Took %d chars from DMA buffer and %d chars from the FIFO\n",
@@ -1349,6 +1352,7 @@ __acquires(&uap->port.lock)
 {
 	pl011_fifo_to_tty(uap);
 
+	uap->irq_locked = 0;
 	spin_unlock(&uap->port.lock);
 	tty_flip_buffer_push(&uap->port.state->port);
 	/*
@@ -1484,6 +1488,7 @@ static irqreturn_t pl011_int(int irq, void *dev_id)
 	int handled = 0;
 
 	spin_lock_irqsave(&uap->port.lock, flags);
+	uap->irq_locked = 1;
 	status = pl011_read(uap, REG_RIS) & uap->im;
 	if (status) {
 		do {
@@ -1503,7 +1508,7 @@ static irqreturn_t pl011_int(int irq, void *dev_id)
 				      UART011_CTSMIS|UART011_RIMIS))
 				pl011_modem_status(uap);
 			if (status & UART011_TXIS)
-				pl011_tx_chars(uap, true);
+				pl011_tx_chars(uap, uap->irq_locked);
 
 			if (pass_counter-- == 0)
 				break;
-- 
GitLab


From e95c533eba52d1879d94bdd1ede00548ad1cf622 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Thu, 11 Jul 2019 17:55:43 +0100
Subject: [PATCH 0710/1835] xhci: add quirk for host controllers that don't
 update endpoint DCS

Seen on a VLI VL805 PCIe to USB controller. For non-stream endpoints
at least, if the xHC halts on a particular TRB due to an error then
the DCS field in the Out Endpoint Context maintained by the hardware
is not updated with the current cycle state.

Using the quirk XHCI_EP_CTX_BROKEN_DCS and instead fetch the DCS bit
from the TRB that the xHC stopped on.

See: https://github.com/raspberrypi/linux/issues/3060

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/usb/host/xhci-pci.c  |  4 +++-
 drivers/usb/host/xhci-ring.c | 26 +++++++++++++++++++++++++-
 drivers/usb/host/xhci.h      |  1 +
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index ac0d7a684fae2..3348011e12e69 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -223,8 +223,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 
 	if (pdev->vendor == PCI_VENDOR_ID_VIA &&
-			pdev->device == 0x3483)
+			pdev->device == 0x3483) {
 		xhci->quirks |= XHCI_LPM_SUPPORT;
+		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
+	}
 
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 			pdev->device == 0x1042)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index f896a00662efe..26f81c984743f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -520,7 +520,10 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
 	struct xhci_virt_ep *ep = &dev->eps[ep_index];
 	struct xhci_ring *ep_ring;
 	struct xhci_segment *new_seg;
+	struct xhci_segment *halted_seg = NULL;
 	union xhci_trb *new_deq;
+	union xhci_trb *halted_trb;
+	int index = 0;
 	dma_addr_t addr;
 	u64 hw_dequeue;
 	bool cycle_found = false;
@@ -541,7 +544,28 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
 	hw_dequeue = xhci_get_hw_deq(xhci, dev, ep_index, stream_id);
 	new_seg = ep_ring->deq_seg;
 	new_deq = ep_ring->dequeue;
-	state->new_cycle_state = hw_dequeue & 0x1;
+
+	/*
+	 * Quirk: xHC write-back of the DCS field in the hardware dequeue
+	 * pointer is wrong - use the cycle state of the TRB pointed to by
+	 * the dequeue pointer.
+	 */
+	if (xhci->quirks & XHCI_EP_CTX_BROKEN_DCS &&
+	    !(ep->ep_state & EP_HAS_STREAMS))
+		halted_seg = trb_in_td(xhci, cur_td->start_seg,
+				       cur_td->first_trb, cur_td->last_trb,
+				       hw_dequeue & ~0xf, false);
+	if (halted_seg) {
+		index = ((dma_addr_t)(hw_dequeue & ~0xf) - halted_seg->dma) /
+			 sizeof(*halted_trb);
+		halted_trb = &halted_seg->trbs[index];
+		state->new_cycle_state = halted_trb->generic.field[3] & 0x1;
+		xhci_dbg(xhci, "Endpoint DCS = %d TRB index = %d cycle = %d\n",
+			 (u8)(hw_dequeue & 0x1), index,
+			 state->new_cycle_state);
+	} else {
+		state->new_cycle_state = hw_dequeue & 0x1;
+	}
 	state->stream_id = stream_id;
 
 	/*
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 761b341d27b07..3a6c451777e7d 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1865,6 +1865,7 @@ struct xhci_hcd {
 #define XHCI_ZERO_64B_REGS	BIT_ULL(32)
 #define XHCI_RESET_PLL_ON_DISCONNECT	BIT_ULL(34)
 #define XHCI_SNPS_BROKEN_SUSPEND    BIT_ULL(35)
+#define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(36)
 
 	unsigned int		num_active_eps;
 	unsigned int		limit_active_eps;
-- 
GitLab


From 246113692edbef9a438b31ab2dd0172a30ed5eb2 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 12 Jul 2019 15:38:35 +0100
Subject: [PATCH 0711/1835] i2c: bcm2835: Set clock-stretch timeout to 35ms

The BCM2835 I2C blocks have a register to set the clock-stretch
timeout - how long the device is allowed to hold SCL low - in bus
cycles. The current driver doesn't write to the register, therefore
the default value of 64 cycles is being used for all devices.

Set the timeout to the value recommended for SMBus - 35ms.

See: https://github.com/raspberrypi/linux/issues/3064

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/i2c/busses/i2c-bcm2835.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index 79d06286b9266..beaa63c9299ba 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -194,6 +194,7 @@ static int clk_bcm2835_i2c_set_rate(struct clk_hw *hw, unsigned long rate,
 {
 	struct clk_bcm2835_i2c *div = to_clk_bcm2835_i2c(hw);
 	u32 redl, fedl;
+	u32 clk_tout;
 	u32 divider = clk_bcm2835_i2c_calc_divider(rate, parent_rate);
 
 	if (divider == -EINVAL)
@@ -217,6 +218,17 @@ static int clk_bcm2835_i2c_set_rate(struct clk_hw *hw, unsigned long rate,
 	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_DEL,
 			   (fedl << BCM2835_I2C_FEDL_SHIFT) |
 			   (redl << BCM2835_I2C_REDL_SHIFT));
+
+	/*
+	 * Set the clock stretch timeout to the SMBUs-recommended 35ms.
+	 */
+	if (rate > 0xffff*1000/35)
+	    clk_tout = 0xffff;
+	else
+	    clk_tout = 35*rate/1000;
+
+	bcm2835_i2c_writel(div->i2c_dev, BCM2835_I2C_CLKT, clk_tout);
+
 	return 0;
 }
 
-- 
GitLab


From 4cc44111ce00064baf0939a2d21e53964e17eab6 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 8 Mar 2019 13:02:16 -0800
Subject: [PATCH 0712/1835] arm64: bcm2835: Add missing dependency on MFD_CORE.

commit 7a9b6be9fe58194d9a349159176e8cc0d8f10ef8 upstream.

When adding the MFD dependency for power domains and WDT in bcm2835, I
added it only on the arm32 side and missed it for arm64.

Fixes: 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe to an MFD.")
Signed-off-by: Eric Anholt <eric@anholt.net>
Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
---
 arch/arm64/Kconfig.platforms | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index e9bdec0ead72f..411f3716da928 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -20,6 +20,7 @@ config ARCH_BCM2835
 	bool "Broadcom BCM2835 family"
 	select TIMER_OF
 	select GPIOLIB
+	select MFD_CORE
 	select PINCTRL
 	select PINCTRL_BCM2835
 	select ARM_AMBA
-- 
GitLab


From 8222f38b1ceadd0642d49812fd34a3a6cb00e264 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 15 Jul 2019 10:39:05 +0100
Subject: [PATCH 0713/1835] overlays: Add PCF2129 RTC

Add support for the PCF2129 RTC to i2c-rtc and i2c-rtc-gpio overlays.
Also add rv3028 to i2c-rtc-gpio (it was missed previously), and don't
attempt to set an alternate address for the PCF2127.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README             | 11 ++++-
 .../dts/overlays/i2c-rtc-gpio-overlay.dts     | 41 +++++++++++++++++--
 .../arm/boot/dts/overlays/i2c-rtc-overlay.dts | 19 ++++++++-
 3 files changed, 64 insertions(+), 7 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 336d0d6446c15..d5e12fec29ef6 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1022,6 +1022,8 @@ Params: abx80x                  Select one of the ABx80x family:
 
         pcf2127                 Select the PCF2127 device
 
+        pcf2129                 Select the PCF2129 device
+
         pcf8523                 Select the PCF8523 device
 
         pcf8563                 Select the PCF8563 device
@@ -1067,10 +1069,14 @@ Params: abx80x                  Select one of the ABx80x family:
 
         pcf2127                 Select the PCF2127 device
 
+        pcf2129                 Select the PCF2129 device
+
         pcf8523                 Select the PCF8523 device
 
         pcf8563                 Select the PCF8563 device
 
+        rv3028                  Select the Micro Crystal RV3028 device
+
         addr                    Sets the address for the RTC. Note that the
                                 device must be configured to use the specified
                                 address.
@@ -1079,11 +1085,14 @@ Params: abx80x                  Select one of the ABx80x family:
                                 "schottky" (ABx80x only)
 
         trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
-                                ABx80x)
+                                ABx80x, RV3028)
 
         wakeup-source           Specify that the RTC can be used as a wakeup
                                 source
 
+        backup-switchover-mode  Backup power supply switch mode. Must be 0 for
+                                off or 1 for Vdd < VBackup (RV3028 only)
+
         i2c_gpio_sda            GPIO used for I2C data (default "23")
 
         i2c_gpio_scl            GPIO used for I2C clock (default "24")
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
index d647d88d212a5..44df77459520b 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
@@ -121,7 +121,7 @@
 			#size-cells = <0>;
 			status = "okay";
 
-			pcf2127: pcf2127@51 {
+			pcf2127@51 {
 				compatible = "nxp,pcf2127";
 				reg = <0x51>;
 				status = "okay";
@@ -174,6 +174,36 @@
 		};
 	};
 
+	fragment@11 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			rv3028: rv3028@52 {
+				compatible = "microcrystal,rv3028";
+				reg = <0x52>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf2129@51 {
+				compatible = "nxp,pcf2129";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
 	__overrides__ {
 		abx80x = <0>,"+1";
 		ds1307 = <0>,"+2";
@@ -185,6 +215,8 @@
 		pcf8523 = <0>,"+8";
 		pcf8563 = <0>,"+9";
 		m41t62 = <0>,"+10";
+		rv3028 = <0>,"+11";
+		pcf2129 = <0>,"+12";
 
 		addr = <&abx80x>, "reg:0",
 		       <&ds1307>, "reg:0",
@@ -192,18 +224,19 @@
 		       <&ds3231>, "reg:0",
 		       <&mcp7940x>, "reg:0",
 		       <&mcp7941x>, "reg:0",
-		       <&pcf2127>, "reg:0",
 		       <&pcf8523>, "reg:0",
 		       <&pcf8563>, "reg:0",
 		       <&m41t62>, "reg:0";
 
 		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
 		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
-					<&abx80x>,"abracon,tc-resistor";
+					<&abx80x>,"abracon,tc-resistor",
+					<&rv3028>,"trickle-resistor-ohms:0";
+		backup-switchover-mode = <&rv3028>,"backup-switchover-mode:0";
 		wakeup-source = <&ds1339>,"wakeup-source?",
 				<&ds3231>,"wakeup-source?",
 				<&mcp7940x>,"wakeup-source?",
-					<&mcp7941x>,"wakeup-source?";
+				<&mcp7941x>,"wakeup-source?";
 		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
 		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
 		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
index 00f376415026d..af5ca042de75a 100644
--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -105,7 +105,7 @@
 			#size-cells = <0>;
 			status = "okay";
 
-			pcf2127: pcf2127@51 {
+			pcf2127@51 {
 				compatible = "nxp,pcf2127";
 				reg = <0x51>;
 				status = "okay";
@@ -173,6 +173,21 @@
 		};
 	};
 
+	fragment@11 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf2129@51 {
+				compatible = "nxp,pcf2129";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
 	__overrides__ {
 		abx80x = <0>,"+0";
 		ds1307 = <0>,"+1";
@@ -185,6 +200,7 @@
 		pcf8563 = <0>,"+8";
 		m41t62 = <0>,"+9";
 		rv3028 = <0>,"+10";
+		pcf2129 = <0>,"+11";
 
 		addr = <&abx80x>, "reg:0",
 		       <&ds1307>, "reg:0",
@@ -192,7 +208,6 @@
 		       <&ds3231>, "reg:0",
 		       <&mcp7940x>, "reg:0",
 		       <&mcp7941x>, "reg:0",
-		       <&pcf2127>, "reg:0",
 		       <&pcf8523>, "reg:0",
 		       <&pcf8563>, "reg:0",
 		       <&m41t62>, "reg:0";
-- 
GitLab


From dbb3671fc402fc0bbede263951f739f5454f1ff0 Mon Sep 17 00:00:00 2001
From: Allen Wild <allenwild93@gmail.com>
Date: Sat, 13 Jul 2019 11:14:02 -0400
Subject: [PATCH 0714/1835] configs: arm64/bcm2711: Use CONFIG_BRCMSTB_THERMAL
 instead of CONFIG_BCM2835_THERMAL

The Raspberry Pi 4 uses the brcmstb thermal driver rather than brcm2835,
based on the device tree compatible string 'brcm,avs-tmon-bcm2838'. With
CONFIG_BRCMSTB_THERMAL enabled, reading temperature from
/sys/class/thermal/thermal_zone0/temp works as expected instead of
returning EINVAL.

Fixes: https://github.com/raspberrypi/linux/issues/3071
Signed-off-by: Allen Wild <allenwild93@gmail.com>
---
 arch/arm64/configs/bcm2711_defconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 3bcce6daa9efd..2265a77d6a53b 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -658,7 +658,7 @@ CONFIG_SENSORS_ADS1015=m
 CONFIG_SENSORS_INA2XX=m
 CONFIG_SENSORS_TMP102=m
 CONFIG_THERMAL=y
-CONFIG_BCM2835_THERMAL=y
+CONFIG_BRCMSTB_THERMAL=y
 CONFIG_WATCHDOG=y
 CONFIG_GPIO_WATCHDOG=m
 CONFIG_BCM2835_WDT=y
-- 
GitLab


From e12ef236ff2f068d4e1b1e76d1254876b33a380d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 16 Jul 2019 15:24:12 +0100
Subject: [PATCH 0715/1835] overlays: dpi18 and dpi24 vc4 compatibility

The dpi overlays use the fb device tree node as a place to hang the
necessary pinctrl changes. With one of the VC4 overlays loaded, the
fb node is disabled so the changes have no effect.

Modify the overlays to also use the vc4 node, to cover both use
cases.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/dpi18-overlay.dts | 8 ++++++++
 arch/arm/boot/dts/overlays/dpi24-overlay.dts | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
index 4bf5ef8327476..4abe5be744db7 100644
--- a/arch/arm/boot/dts/overlays/dpi18-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
@@ -17,6 +17,14 @@
 	};
 
 	fragment@1 {
+		target = <&vc4>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi18_pins>;
+		};
+	};
+
+	fragment@2 {
 		target = <&gpio>;
 		__overlay__ {
 			dpi18_pins: dpi18_pins {
diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
index d5f7c3f58890b..44335cc812770 100644
--- a/arch/arm/boot/dts/overlays/dpi24-overlay.dts
+++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
@@ -17,6 +17,14 @@
 	};
 
 	fragment@1 {
+		target = <&vc4>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi24_pins>;
+		};
+	};
+
+	fragment@2 {
 		target = <&gpio>;
 		__overlay__ {
 			dpi24_pins: dpi24_pins {
-- 
GitLab


From 152c5097b67680a3e243a95d6234f5865a5805fc Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 17 Jul 2019 10:08:55 +0100
Subject: [PATCH 0716/1835] overlays: Add i2c0 and i2c1 for regularity

The new i2c overlays for pi4 (i2c3, i2c4, i2c5, i2c6) have a
standardised interface that allows pin groups to be chosen
atomically rather than as individual pins. Add i2c0 and i2c1
overlays to fit the naming scheme and parameter usage, deprecating
i2c0-bcm2708 and i2c1-bcm2708.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |  2 +
 arch/arm/boot/dts/overlays/README             | 33 +++++---
 .../dts/overlays/i2c0-bcm2708-overlay.dts     | 77 +++----------------
 arch/arm/boot/dts/overlays/i2c0-overlay.dts   | 61 +++++++++++++++
 .../dts/overlays/i2c1-bcm2708-overlay.dts     | 46 ++---------
 arch/arm/boot/dts/overlays/i2c1-overlay.dts   | 44 +++++++++++
 6 files changed, 147 insertions(+), 116 deletions(-)
 create mode 100644 arch/arm/boot/dts/overlays/i2c0-overlay.dts
 create mode 100644 arch/arm/boot/dts/overlays/i2c1-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index e406582521fbe..216403c69c558 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -66,7 +66,9 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	i2c-rtc.dtbo \
 	i2c-rtc-gpio.dtbo \
 	i2c-sensor.dtbo \
+	i2c0.dtbo \
 	i2c0-bcm2708.dtbo \
+	i2c1.dtbo \
 	i2c1-bcm2708.dtbo \
 	i2c3.dtbo \
 	i2c4.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index d5e12fec29ef6..568e7117b456b 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1151,14 +1151,12 @@ Params: addr                    Set the address for the BME280, BMP280, DS1621,
                                 sensor
 
 
-Name:   i2c0-bcm2708
+Name:   i2c0
 Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
         platforms - platforms other then Compute Modules can only use this
         to disable transaction combining.
-Load:   dtoverlay=i2c0-bcm2708,<param>=<val>
-Params: sda0_pin                GPIO pin for SDA0 (deprecated - use pins_*)
-        scl0_pin                GPIO pin for SCL0 (deprecated - use pins_*)
-        pins_0_1                Use pins 0 and 1 (default)
+Load:   dtoverlay=i2c0,<param>=<val>
+Params: pins_0_1                Use pins 0 and 1 (default)
         pins_28_29              Use pins 28 and 29
         pins_44_45              Use pins 44 and 45
         pins_46_47              Use pins 46 and 47
@@ -1166,18 +1164,33 @@ Params: sda0_pin                GPIO pin for SDA0 (deprecated - use pins_*)
                                 "yes")
 
 
-Name:   i2c1-bcm2708
+Name:   i2c0-bcm2708
+Info:   Deprecated, legacy version of i2c0, from which it inherits its
+        parameters, just adding the explicit individual pin specifiers.
+Load:   <Deprecated>
+Params: sda0_pin                GPIO pin for SDA0 (deprecated - use pins_*)
+        scl0_pin                GPIO pin for SCL0 (deprecated - use pins_*)
+
+
+Name:   i2c1
 Info:   Change i2c1 pin usage. Not all pin combinations are usable on all
         platforms - platforms other then Compute Modules can only use this
         to disable transaction combining.
-Info:   Enable the i2c_bcm2708 driver for the i2c1 bus
-Load:   dtoverlay=i2c1-bcm2708,<param>=<val>
+Load:   dtoverlay=i2c1,<param>=<val>
+Params: pins_2_3                Use pins 2 and 3 (default)
+        pins_44_45              Use pins 44 and 45
+        combine                 Allow transactions to be combined (default
+                                "yes")
+
+
+Name:   i2c1-bcm2708
+Info:   Deprecated, legacy version of i2c1, from which it inherits its
+        parameters, just adding the explicit individual pin specifiers.
+Load:   <Deprecated>
 Params: sda1_pin                GPIO pin for SDA1 (2 or 44 - default 2)
         scl1_pin                GPIO pin for SCL1 (3 or 45 - default 3)
         pin_func                Alternative pin function (4 (alt0), 6 (alt2) -
                                 default 4)
-        combine                 Allow transactions to be combined (default
-                                "yes")
 
 
 Name:   i2c3
diff --git a/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
index 393244d14ec45..02f7dca9b71e6 100644
--- a/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
@@ -1,69 +1,14 @@
-/*
- * Device tree overlay for i2c_bcm2708, i2c0 bus
- *
- * Compile:
- * dtc -@ -I dts -O dtb -o i2c0-bcm2708-overlay.dtb i2c0-bcm2708-overlay.dts
- */
-
-/dts-v1/;
-/plugin/;
+#include "i2c0-overlay.dts"
 
 /{
-   compatible = "brcm,bcm2835";
-
-   fragment@0 {
-      target = <&i2c0>;
-      __overlay__ {
-         status = "okay";
-      };
-   };
-
-   fragment@1 {
-      target = <&i2c0_pins>;
-      frag1: __overlay__ {
-         brcm,pins = <0 1>;
-         brcm,function = <4>; /* alt0 */
-      };
-   };
-
-   fragment@2 {
-      target = <&i2c0_pins>;
-      __dormant__ {
-         brcm,pins = <28 29>;
-         brcm,function = <4>; /* alt0 */
-      };
-   };
-
-   fragment@3 {
-      target = <&i2c0_pins>;
-      __dormant__ {
-         brcm,pins = <44 45>;
-         brcm,function = <5>; /* alt1 */
-      };
-   };
-
-   fragment@4 {
-      target = <&i2c0_pins>;
-      __dormant__ {
-         brcm,pins = <46 47>;
-         brcm,function = <4>; /* alt0 */
-      };
-   };
-
-   fragment@5 {
-      target = <&i2c0>;
-      __dormant__ {
-         compatible = "brcm,bcm2708-i2c";
-      };
-   };
-
-   __overrides__ {
-      sda0_pin = <&frag1>,"brcm,pins:0";
-      scl0_pin = <&frag1>,"brcm,pins:4";
-      pins_0_1   = <0>,"+1-2-3-4";
-      pins_28_29 = <0>,"-1+2-3-4";
-      pins_44_45 = <0>,"-1-2+3-4";
-      pins_46_47 = <0>,"-1-2-3+4";
-      combine = <0>, "!5";
-   };
+	__overrides__ {
+		sda0_pin = <&pins1>,"brcm,pins:0",
+			   <&pins2>,"brcm,pins:0",
+			   <&pins3>,"brcm,pins:0",
+			   <&pins4>,"brcm,pins:0";
+		scl0_pin = <&pins1>,"brcm,pins:4",
+			   <&pins2>,"brcm,pins:4",
+			   <&pins3>,"brcm,pins:4",
+			   <&pins4>,"brcm,pins:4";
+	};
 };
diff --git a/arch/arm/boot/dts/overlays/i2c0-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-overlay.dts
new file mode 100644
index 0000000000000..6b1f9ec6c8782
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c0-overlay.dts
@@ -0,0 +1,61 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c0>;
+		__overlay__ {
+			status = "okay";
+			pinctrl-0 = <&i2c0_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c0_pins>;
+		pins1: __overlay__ {
+			brcm,pins = <0 1>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c0_pins>;
+		pins2: __dormant__ {
+			brcm,pins = <28 29>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c0_pins>;
+		pins3: __dormant__ {
+			brcm,pins = <44 45>;
+			brcm,function = <5>; /* alt1 */
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c0_pins>;
+		pins4: __dormant__ {
+			brcm,pins = <46 47>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c0>;
+		__dormant__ {
+			compatible = "brcm,bcm2708-i2c";
+		};
+	};
+
+	__overrides__ {
+		pins_0_1   = <0>,"+1-2-3-4";
+		pins_28_29 = <0>,"-1+2-3-4";
+		pins_44_45 = <0>,"-1-2+3-4";
+		pins_46_47 = <0>,"-1-2-3+4";
+		combine = <0>, "!5";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
index 825854dab6818..09d8b16a6256d 100644
--- a/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
@@ -1,43 +1,9 @@
-/*
- * Device tree overlay for i2c_bcm2708, i2c1 bus
- *
- * Compile:
- * dtc -@ -I dts -O dtb -o i2c1-bcm2708-overlay.dtb i2c1-bcm2708-overlay.dts
- */
-
-/dts-v1/;
-/plugin/;
+#include "i2c1-overlay.dts"
 
 /{
-   compatible = "brcm,bcm2835";
-
-   fragment@0 {
-      target = <&i2c1>;
-      __overlay__ {
-         pinctrl-0 = <&i2c1_pins>;
-         status = "okay";
-      };
-   };
-
-   fragment@1 {
-      target = <&i2c1_pins>;
-         pins: __overlay__ {
-         brcm,pins = <2 3>;
-         brcm,function = <4>; /* alt 0 */
-      };
-   };
-
-   fragment@2 {
-      target = <&i2c1>;
-      __dormant__ {
-         compatible = "brcm,bcm2708-i2c";
-      };
-   };
-
-   __overrides__ {
-      sda1_pin = <&pins>,"brcm,pins:0";
-      scl1_pin = <&pins>,"brcm,pins:4";
-      pin_func = <&pins>,"brcm,function:0";
-      combine = <0>, "!2";
-   };
+	__overrides__ {
+		sda1_pin = <&pins1>,"brcm,pins:0", <&pins2>,"brcm,pins:0";
+		scl1_pin = <&pins1>,"brcm,pins:4", <&pins1>,"brcm,pins:4";
+		pin_func = <&pins1>,"brcm,function:0", <&pins2>,"brcm,function:0";
+	};
 };
diff --git a/arch/arm/boot/dts/overlays/i2c1-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-overlay.dts
new file mode 100644
index 0000000000000..addaed73e6656
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c1-overlay.dts
@@ -0,0 +1,44 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			status = "okay";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c1_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1_pins>;
+		pins1: __overlay__ {
+			brcm,pins = <2 3>;
+			brcm,function = <4>; /* alt 0 */
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1_pins>;
+		pins2: __dormant__ {
+			brcm,pins = <44 45>;
+			brcm,function = <6>; /* alt 2 */
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c1>;
+		__dormant__ {
+			compatible = "brcm,bcm2708-i2c";
+		};
+	};
+
+	__overrides__ {
+		pins_2_3   = <0>,"=1!2";
+		pins_44_45 = <0>,"!1=2";
+		combine = <0>, "!3";
+	};
+};
-- 
GitLab


From 7b7d5b1b43985c3ad8752932477d6f0be0d50d82 Mon Sep 17 00:00:00 2001
From: Giedrius <giedrius@blokas.io>
Date: Fri, 12 Jul 2019 17:45:55 +0300
Subject: [PATCH 0717/1835] Pisound: Remove spinlock usage around spi_sync

---
 sound/soc/bcm/pisound.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/sound/soc/bcm/pisound.c b/sound/soc/bcm/pisound.c
index 1c5100bfd8bc0..2d73cf996105f 100644
--- a/sound/soc/bcm/pisound.c
+++ b/sound/soc/bcm/pisound.c
@@ -286,9 +286,6 @@ static irqreturn_t data_available_interrupt_handler(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
-static DEFINE_SPINLOCK(spilock);
-static unsigned long spilockflags;
-
 static uint16_t spi_transfer16(uint16_t val)
 {
 	uint8_t txbuf[2];
@@ -333,9 +330,7 @@ static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len)
 	transfer.delay_usecs = 10;
 	spi_message_add_tail(&transfer, &msg);
 
-	spin_lock_irqsave(&spilock, spilockflags);
 	err = spi_sync(pisnd_spi_device, &msg);
-	spin_unlock_irqrestore(&spilock, spilockflags);
 
 	if (err < 0) {
 		printe("spi_sync error %d\n", err);
-- 
GitLab


From d5dc848c982dff2e020f294e384447efe6ea6617 Mon Sep 17 00:00:00 2001
From: Andrei Gherzan <andrei@balena.io>
Date: Tue, 16 Jul 2019 13:28:22 +0100
Subject: [PATCH 0718/1835] arm64/mm: Limit the DMA zone for arm64

On RaspberryPi, only the first 1Gb can be used for DMA[1].

[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2019-July/665986.html

Signed-off-by: Andrei Gherzan <andrei@balena.io>
---
 arch/arm64/mm/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 774c3e17c7982..229e6f6cbdfeb 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -224,7 +224,7 @@ static void __init reserve_elfcorehdr(void)
 static phys_addr_t __init max_zone_dma_phys(void)
 {
 	phys_addr_t offset = memblock_start_of_DRAM() & GENMASK_ULL(63, 32);
-	return min(offset + (1ULL << 32), memblock_end_of_DRAM());
+	return min(offset + (1ULL << 30), memblock_end_of_DRAM());
 }
 
 #ifdef CONFIG_NUMA
-- 
GitLab


From 0ad09aef40287ad0ea9185c8e43c5d06506f8a7d Mon Sep 17 00:00:00 2001
From: Aapo Vienamo <aapo.vienamo@iki.fi>
Date: Wed, 17 Jul 2019 11:05:20 +0300
Subject: [PATCH 0719/1835] configs: Enable iio driver for TI ADS1015

Signed-off-by: Aapo Vienamo <aapo.vienamo@iki.fi>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcm2711_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 07be63a719364..70e9b2e8c4c76 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -1291,6 +1291,7 @@ CONFIG_IIO=m
 CONFIG_IIO_BUFFER_CB=m
 CONFIG_MCP320X=m
 CONFIG_MCP3422=m
+CONFIG_TI_ADS1015=m
 CONFIG_DHT11=m
 CONFIG_HDC100X=m
 CONFIG_HTU21=m
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 6824188e46bd6..984254814f9dc 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -1322,6 +1322,7 @@ CONFIG_IIO=m
 CONFIG_IIO_BUFFER_CB=m
 CONFIG_MCP320X=m
 CONFIG_MCP3422=m
+CONFIG_TI_ADS1015=m
 CONFIG_DHT11=m
 CONFIG_HDC100X=m
 CONFIG_HTU21=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 77e3efaaee098..08bbdde2f1163 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -1301,6 +1301,7 @@ CONFIG_IIO=m
 CONFIG_IIO_BUFFER_CB=m
 CONFIG_MCP320X=m
 CONFIG_MCP3422=m
+CONFIG_TI_ADS1015=m
 CONFIG_DHT11=m
 CONFIG_HDC100X=m
 CONFIG_HTU21=m
-- 
GitLab


From 2d32b63307e47ebdfb808aa0a5f556dd8f6bc260 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Thu, 18 Jul 2019 13:05:35 +0100
Subject: [PATCH 0720/1835] bcm2711_defconfig: enable PCI portbus support (and
 implicitly, PCIe AER)

PCIe advanced error reporting is supported by the root complex, so make
use of it.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 arch/arm/configs/bcm2711_defconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 984254814f9dc..837afe4aecd87 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -33,6 +33,8 @@ CONFIG_ARCH_BCM2835=y
 CONFIG_ARM_LPAE=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIEASPM is not set
 CONFIG_PCI_MSI=y
 CONFIG_PCIE_BRCMSTB=y
 CONFIG_SMP=y
-- 
GitLab


From 108a2cb94b856f63172b7fcd3a281b2847e9806a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 3 Jul 2019 17:44:53 +0100
Subject: [PATCH 0721/1835] drm/vc4: Query firmware for custom HDMI mode

Allow custom HDMI modes to be specified from config.txt,
and these then override EDID parsing.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 142 ++++++++++++++-----------
 1 file changed, 81 insertions(+), 61 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 074766fc076e2..5dfaa10f23556 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -1035,6 +1035,58 @@ vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
 	return connector_status_connected;
 }
 
+/* Queries the firmware to populate a drm_mode structure for this display */
+static int vc4_fkms_get_fw_mode(struct vc4_fkms_connector *fkms_connector,
+				struct drm_display_mode *mode)
+{
+	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
+	struct set_timings timings = { 0 };
+	int ret;
+
+	timings.display = fkms_connector->display_number;
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_GET_DISPLAY_TIMING, &timings,
+				    sizeof(timings));
+	if (ret || !timings.clock)
+		/* No mode returned - abort */
+		return -1;
+
+	/* Equivalent to DRM_MODE macro. */
+	memset(mode, 0, sizeof(*mode));
+	strncpy(mode->name, "FIXED_MODE", sizeof(mode->name));
+	mode->status = 0;
+	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
+	mode->clock = timings.clock;
+	mode->hdisplay = timings.hdisplay;
+	mode->hsync_start = timings.hsync_start;
+	mode->hsync_end = timings.hsync_end;
+	mode->htotal = timings.htotal;
+	mode->hskew = 0;
+	mode->vdisplay = timings.vdisplay;
+	mode->vsync_start = timings.vsync_start;
+	mode->vsync_end = timings.vsync_end;
+	mode->vtotal = timings.vtotal;
+	mode->vscan = timings.vscan;
+
+	if (timings.flags & TIMINGS_FLAGS_H_SYNC_POS)
+		mode->flags |= DRM_MODE_FLAG_PHSYNC;
+	else
+		mode->flags |= DRM_MODE_FLAG_NHSYNC;
+
+	if (timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
+		mode->flags |= DRM_MODE_FLAG_PVSYNC;
+	else
+		mode->flags |= DRM_MODE_FLAG_NVSYNC;
+
+	if (timings.flags & TIMINGS_FLAGS_INTERLACE)
+		mode->flags |= DRM_MODE_FLAG_INTERLACE;
+
+	mode->base.type = DRM_MODE_OBJECT_MODE;
+
+	return 0;
+}
+
 static int vc4_fkms_get_edid_block(void *data, u8 *buf, unsigned int block,
 				   size_t len)
 {
@@ -1063,30 +1115,40 @@ static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
 					to_vc4_fkms_connector(connector);
 	struct drm_encoder *encoder = fkms_connector->encoder;
 	struct vc4_fkms_encoder *vc4_encoder = to_vc4_fkms_encoder(encoder);
-	int ret = 0;
+	struct drm_display_mode fw_mode;
+	struct drm_display_mode *mode;
 	struct edid *edid;
+	int num_modes;
 
-	edid = drm_do_get_edid(connector, vc4_fkms_get_edid_block,
-			       fkms_connector);
+	if (!vc4_fkms_get_fw_mode(fkms_connector, &fw_mode)) {
+		drm_mode_debug_printmodeline(&fw_mode);
+		mode = drm_mode_duplicate(connector->dev,
+					  &fw_mode);
+		drm_mode_probed_add(connector, mode);
+		num_modes = 1;	/* 1 mode */
+	} else {
+		edid = drm_do_get_edid(connector, vc4_fkms_get_edid_block,
+				       fkms_connector);
 
-	/* FIXME: Can we do CEC?
-	 * cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
-	 * if (!edid)
-	 *	return -ENODEV;
-	 */
+		/* FIXME: Can we do CEC?
+		 * cec_s_phys_addr_from_edid(vc4->hdmi->cec_adap, edid);
+		 * if (!edid)
+		 *	return -ENODEV;
+		 */
 
-	vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
+		vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid);
 
-	if (edid && edid->input & DRM_EDID_INPUT_DIGITAL) {
-		vc4_encoder->rgb_range_selectable =
-			drm_rgb_quant_range_selectable(edid);
-	}
+		if (edid && edid->input & DRM_EDID_INPUT_DIGITAL) {
+			vc4_encoder->rgb_range_selectable =
+				drm_rgb_quant_range_selectable(edid);
+		}
 
-	drm_connector_update_edid_property(connector, edid);
-	ret = drm_add_edid_modes(connector, edid);
-	kfree(edid);
+		drm_connector_update_edid_property(connector, edid);
+		num_modes = drm_add_edid_modes(connector, edid);
+		kfree(edid);
+	}
 
-	return ret;
+	return num_modes;
 }
 
 /* This is the DSI panel resolution. Use this as a default should the firmware
@@ -1104,57 +1166,15 @@ static int vc4_fkms_lcd_connector_get_modes(struct drm_connector *connector)
 {
 	struct vc4_fkms_connector *fkms_connector =
 					to_vc4_fkms_connector(connector);
-	struct vc4_dev *vc4 = fkms_connector->vc4_dev;
 	struct drm_display_mode *mode;
-	struct mailbox_set_mode mb = {
-		.tag1 = { RPI_FIRMWARE_GET_DISPLAY_TIMING,
-			  sizeof(struct set_timings), 0},
-		.timings = { .display = fkms_connector->display_number },
-	};
 	struct drm_display_mode fw_mode;
-	int ret = 0;
-
-	ret = rpi_firmware_property_list(vc4->firmware, &mb, sizeof(mb));
-	if (!ret) {
-		/* Equivalent to DRM_MODE macro. */
-		memset(&fw_mode, 0, sizeof(fw_mode));
-		strncpy(fw_mode.name, "LCD_MODE", sizeof(fw_mode.name));
-		fw_mode.status = 0;
-		fw_mode.type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
-		fw_mode.clock = mb.timings.clock;
-		fw_mode.hdisplay = mb.timings.hdisplay;
-		fw_mode.hsync_start = mb.timings.hsync_start;
-		fw_mode.hsync_end = mb.timings.hsync_end;
-		fw_mode.htotal = mb.timings.htotal;
-		fw_mode.hskew = 0;
-		fw_mode.vdisplay = mb.timings.vdisplay;
-		fw_mode.vsync_start = mb.timings.vsync_start;
-		fw_mode.vsync_end = mb.timings.vsync_end;
-		fw_mode.vtotal = mb.timings.vtotal;
-		fw_mode.vscan = mb.timings.vscan;
-		if (mb.timings.flags & TIMINGS_FLAGS_H_SYNC_POS)
-			fw_mode.flags |= DRM_MODE_FLAG_PHSYNC;
-		else
-			fw_mode.flags |= DRM_MODE_FLAG_NHSYNC;
-		if (mb.timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
-			fw_mode.flags |= DRM_MODE_FLAG_PVSYNC;
-		else
-			fw_mode.flags |= DRM_MODE_FLAG_NVSYNC;
-		if (mb.timings.flags & TIMINGS_FLAGS_V_SYNC_POS)
-			fw_mode.flags |= DRM_MODE_FLAG_PVSYNC;
-		else
-			fw_mode.flags |= DRM_MODE_FLAG_NVSYNC;
-		if (mb.timings.flags & TIMINGS_FLAGS_INTERLACE)
-			fw_mode.flags |= DRM_MODE_FLAG_INTERLACE;
-
-		fw_mode.base.type = DRM_MODE_OBJECT_MODE;
 
+	if (!vc4_fkms_get_fw_mode(fkms_connector, &fw_mode) && fw_mode.clock)
 		mode = drm_mode_duplicate(connector->dev,
 					  &fw_mode);
-	} else {
+	else
 		mode = drm_mode_duplicate(connector->dev,
 					  &lcd_mode);
-	}
 
 	if (!mode) {
 		DRM_ERROR("Failed to create a new display mode\n");
-- 
GitLab


From 618fb8f1d333fbde5695a8086ca9db15d0e72af2 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 11 Jul 2019 15:12:05 +0100
Subject: [PATCH 0722/1835] drm/vc4: Pass the drm vrefresh to the firmware on
 mode set

More for completeness than need, but use drm_mode_vrefresh
to compute the vrefresh value, and pass that down to the
firmware on mode set.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 5dfaa10f23556..7a6c45e1b02c8 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -737,8 +737,8 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 		      mode->hdisplay, mode->hsync_start, mode->hsync_end,
 		      mode->htotal, mode->hskew, mode->vdisplay,
 		      mode->vsync_start, mode->vsync_end, mode->vtotal,
-		      mode->vscan, mode->vrefresh, mode->picture_aspect_ratio,
-		      mode->flags);
+		      mode->vscan, drm_mode_vrefresh(mode),
+		      mode->picture_aspect_ratio, mode->flags);
 	mb.timings.display = vc4_crtc->display_number;
 
 	mb.timings.video_id_code = frame.avi.video_code;
@@ -754,7 +754,7 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 	mb.timings.vsync_end = mode->vsync_end;
 	mb.timings.vtotal = mode->vtotal;
 	mb.timings.vscan = mode->vscan;
-	mb.timings.vrefresh = 0;
+	mb.timings.vrefresh = drm_mode_vrefresh(mode);
 	mb.timings.flags = 0;
 	if (mode->flags & DRM_MODE_FLAG_PHSYNC)
 		mb.timings.flags |= TIMINGS_FLAGS_H_SYNC_POS;
-- 
GitLab


From 8020568b404bdda1770125d3d00e18c489c92e57 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Wed, 17 Apr 2019 11:13:16 +0300
Subject: [PATCH 0723/1835] Revert "e1000e: fix cyclic resets at link up with
 active tx"

commit caff422ea81e144842bc44bab408d85ac449377b upstream.

This reverts commit 0f9e980bf5ee1a97e2e401c846b2af989eb21c61.

That change cased false-positive warning about hardware hang:

e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx
IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
e1000e 0000:00:1f.6 eth0: Detected Hardware Unit Hang:
   TDH                  <0>
   TDT                  <1>
   next_to_use          <1>
   next_to_clean        <0>
buffer_info[next_to_clean]:
   time_stamp           <fffba7a7>
   next_to_watch        <0>
   jiffies              <fffbb140>
   next_to_watch.status <0>
MAC Status             <40080080>
PHY Status             <7949>
PHY 1000BASE-T Status  <0>
PHY Extended Status    <3000>
PCI Status             <10>
e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx

Besides warning everything works fine.
Original issue will be fixed property in following patch.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reported-by: Joseph Yasi <joe.yasi@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=203175
Tested-by: Joseph Yasi <joe.yasi@gmail.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/e1000e/netdev.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 8cd339c92c1af..31ef42a031f24 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -5286,13 +5286,8 @@ static void e1000_watchdog_task(struct work_struct *work)
 			/* 8000ES2LAN requires a Rx packet buffer work-around
 			 * on link down event; reset the controller to flush
 			 * the Rx packet buffer.
-			 *
-			 * If the link is lost the controller stops DMA, but
-			 * if there is queued Tx work it cannot be done.  So
-			 * reset the controller to flush the Tx packet buffers.
 			 */
-			if ((adapter->flags & FLAG_RX_NEEDS_RESTART) ||
-			    e1000_desc_unused(tx_ring) + 1 < tx_ring->count)
+			if (adapter->flags & FLAG_RX_NEEDS_RESTART)
 				adapter->flags |= FLAG_RESTART_NOW;
 			else
 				pm_schedule_suspend(netdev->dev.parent,
@@ -5315,6 +5310,14 @@ link_up:
 	adapter->gotc_old = adapter->stats.gotc;
 	spin_unlock(&adapter->stats64_lock);
 
+	/* If the link is lost the controller stops DMA, but
+	 * if there is queued Tx work it cannot be done.  So
+	 * reset the controller to flush the Tx packet buffers.
+	 */
+	if (!netif_carrier_ok(netdev) &&
+	    (e1000_desc_unused(tx_ring) + 1 < tx_ring->count))
+		adapter->flags |= FLAG_RESTART_NOW;
+
 	/* If reset is necessary, do it outside of interrupt context. */
 	if (adapter->flags & FLAG_RESTART_NOW) {
 		schedule_work(&adapter->reset_task);
-- 
GitLab


From 438a3dc6f2c334932b44a103e76dbc19de50902e Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Wed, 17 Apr 2019 11:13:20 +0300
Subject: [PATCH 0724/1835] e1000e: start network tx queue only when link is up

commit d17ba0f616a08f597d9348c372d89b8c0405ccf3 upstream.

Driver does not want to keep packets in Tx queue when link is lost.
But present code only reset NIC to flush them, but does not prevent
queuing new packets. Moreover reset sequence itself could generate
new packets via netconsole and NIC falls into endless reset loop.

This patch wakes Tx queue only when NIC is ready to send packets.

This is proper fix for problem addressed by commit 0f9e980bf5ee
("e1000e: fix cyclic resets at link up with active tx").

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Suggested-by: Alexander Duyck <alexander.duyck@gmail.com>
Tested-by: Joseph Yasi <joe.yasi@gmail.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/e1000e/netdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 31ef42a031f24..a7b5a47ab83d5 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4208,7 +4208,7 @@ void e1000e_up(struct e1000_adapter *adapter)
 		e1000_configure_msix(adapter);
 	e1000_irq_enable(adapter);
 
-	netif_start_queue(adapter->netdev);
+	/* Tx queue started by watchdog timer when link is up */
 
 	e1000e_trigger_lsc(adapter);
 }
@@ -4584,6 +4584,7 @@ int e1000e_open(struct net_device *netdev)
 	pm_runtime_get_sync(&pdev->dev);
 
 	netif_carrier_off(netdev);
+	netif_stop_queue(netdev);
 
 	/* allocate transmit descriptors */
 	err = e1000e_setup_tx_resources(adapter->tx_ring);
@@ -4644,7 +4645,6 @@ int e1000e_open(struct net_device *netdev)
 	e1000_irq_enable(adapter);
 
 	adapter->tx_hang_recheck = false;
-	netif_start_queue(netdev);
 
 	hw->mac.get_link_status = true;
 	pm_runtime_put(&pdev->dev);
@@ -5266,6 +5266,7 @@ static void e1000_watchdog_task(struct work_struct *work)
 			if (phy->ops.cfg_on_link_up)
 				phy->ops.cfg_on_link_up(hw);
 
+			netif_wake_queue(netdev);
 			netif_carrier_on(netdev);
 
 			if (!test_bit(__E1000_DOWN, &adapter->state))
@@ -5279,6 +5280,7 @@ static void e1000_watchdog_task(struct work_struct *work)
 			/* Link status message must follow this format */
 			pr_info("%s NIC Link is Down\n", adapter->netdev->name);
 			netif_carrier_off(netdev);
+			netif_stop_queue(netdev);
 			if (!test_bit(__E1000_DOWN, &adapter->state))
 				mod_timer(&adapter->phy_info_timer,
 					  round_jiffies(jiffies + 2 * HZ));
-- 
GitLab


From 86859ef10d259f38aab80dc79f67d9f862f3e56d Mon Sep 17 00:00:00 2001
From: Cole Rogers <colerogers@disroot.org>
Date: Mon, 1 Jul 2019 00:47:48 -0700
Subject: [PATCH 0725/1835] Input: synaptics - enable SMBUS on T480 thinkpad
 trackpad

commit abbe3acd7d72ab4633ade6bd24e8306b67e0add3 upstream.

Thinkpad t480 laptops had some touchpad features disabled, resulting in the
loss of pinch to activities in GNOME, on wayland, and other touch gestures
being slower. This patch adds the touchpad of the t480 to the smbus_pnp_ids
whitelist to enable the extra features. In my testing this does not break
suspend (on fedora, with wayland, and GNOME, using the rc-6 kernel), while
also fixing the feature on a T480.

Signed-off-by: Cole Rogers <colerogers@disroot.org>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/synaptics.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 8e6077d8e434a..68fd8232d44cf 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -176,6 +176,7 @@ static const char * const smbus_pnp_ids[] = {
 	"LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
 	"LEN0073", /* X1 Carbon G5 (Elantech) */
 	"LEN0092", /* X1 Carbon 6 */
+	"LEN0093", /* T480 */
 	"LEN0096", /* X280 */
 	"LEN0097", /* X280 -> ALPS trackpoint */
 	"LEN200f", /* T450s */
-- 
GitLab


From 68048dce650eda36076793f4f894e2d019dcc4a7 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Thu, 11 Jul 2019 20:52:18 -0700
Subject: [PATCH 0726/1835] nilfs2: do not use unexported
 cpu_to_le32()/le32_to_cpu() in uapi header

commit c32cc30c0544f13982ee0185d55f4910319b1a79 upstream.

cpu_to_le32/le32_to_cpu is defined in include/linux/byteorder/generic.h,
which is not exported to user-space.

UAPI headers must use the ones prefixed with double-underscore.

Detected by compile-testing exported headers:

  include/linux/nilfs2_ondisk.h: In function `nilfs_checkpoint_set_snapshot':
  include/linux/nilfs2_ondisk.h:536:17: error: implicit declaration of function `cpu_to_le32' [-Werror=implicit-function-declaration]
    cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) |  \
                   ^
  include/linux/nilfs2_ondisk.h:552:1: note: in expansion of macro `NILFS_CHECKPOINT_FNS'
   NILFS_CHECKPOINT_FNS(SNAPSHOT, snapshot)
   ^~~~~~~~~~~~~~~~~~~~
  include/linux/nilfs2_ondisk.h:536:29: error: implicit declaration of function `le32_to_cpu' [-Werror=implicit-function-declaration]
    cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) |  \
                               ^
  include/linux/nilfs2_ondisk.h:552:1: note: in expansion of macro `NILFS_CHECKPOINT_FNS'
   NILFS_CHECKPOINT_FNS(SNAPSHOT, snapshot)
   ^~~~~~~~~~~~~~~~~~~~
  include/linux/nilfs2_ondisk.h: In function `nilfs_segment_usage_set_clean':
  include/linux/nilfs2_ondisk.h:622:19: error: implicit declaration of function `cpu_to_le64' [-Werror=implicit-function-declaration]
    su->su_lastmod = cpu_to_le64(0);
                     ^~~~~~~~~~~

Link: http://lkml.kernel.org/r/20190605053006.14332-1-yamada.masahiro@socionext.com
Fixes: e63e88bc53ba ("nilfs2: move ioctl interface and disk layout to uapi separately")
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Joe Perches <joe@perches.com>
Cc: <stable@vger.kernel.org>	[4.9+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/uapi/linux/nilfs2_ondisk.h | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/include/uapi/linux/nilfs2_ondisk.h b/include/uapi/linux/nilfs2_ondisk.h
index a7e66ab11d1d6..c23f91ae5fe8b 100644
--- a/include/uapi/linux/nilfs2_ondisk.h
+++ b/include/uapi/linux/nilfs2_ondisk.h
@@ -29,7 +29,7 @@
 
 #include <linux/types.h>
 #include <linux/magic.h>
-
+#include <asm/byteorder.h>
 
 #define NILFS_INODE_BMAP_SIZE	7
 
@@ -533,19 +533,19 @@ enum {
 static inline void							\
 nilfs_checkpoint_set_##name(struct nilfs_checkpoint *cp)		\
 {									\
-	cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) |		\
-				   (1UL << NILFS_CHECKPOINT_##flag));	\
+	cp->cp_flags = __cpu_to_le32(__le32_to_cpu(cp->cp_flags) |	\
+				     (1UL << NILFS_CHECKPOINT_##flag));	\
 }									\
 static inline void							\
 nilfs_checkpoint_clear_##name(struct nilfs_checkpoint *cp)		\
 {									\
-	cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) &		\
+	cp->cp_flags = __cpu_to_le32(__le32_to_cpu(cp->cp_flags) &	\
 				   ~(1UL << NILFS_CHECKPOINT_##flag));	\
 }									\
 static inline int							\
 nilfs_checkpoint_##name(const struct nilfs_checkpoint *cp)		\
 {									\
-	return !!(le32_to_cpu(cp->cp_flags) &				\
+	return !!(__le32_to_cpu(cp->cp_flags) &				\
 		  (1UL << NILFS_CHECKPOINT_##flag));			\
 }
 
@@ -595,20 +595,20 @@ enum {
 static inline void							\
 nilfs_segment_usage_set_##name(struct nilfs_segment_usage *su)		\
 {									\
-	su->su_flags = cpu_to_le32(le32_to_cpu(su->su_flags) |		\
+	su->su_flags = __cpu_to_le32(__le32_to_cpu(su->su_flags) |	\
 				   (1UL << NILFS_SEGMENT_USAGE_##flag));\
 }									\
 static inline void							\
 nilfs_segment_usage_clear_##name(struct nilfs_segment_usage *su)	\
 {									\
 	su->su_flags =							\
-		cpu_to_le32(le32_to_cpu(su->su_flags) &			\
+		__cpu_to_le32(__le32_to_cpu(su->su_flags) &		\
 			    ~(1UL << NILFS_SEGMENT_USAGE_##flag));      \
 }									\
 static inline int							\
 nilfs_segment_usage_##name(const struct nilfs_segment_usage *su)	\
 {									\
-	return !!(le32_to_cpu(su->su_flags) &				\
+	return !!(__le32_to_cpu(su->su_flags) &				\
 		  (1UL << NILFS_SEGMENT_USAGE_##flag));			\
 }
 
@@ -619,15 +619,15 @@ NILFS_SEGMENT_USAGE_FNS(ERROR, error)
 static inline void
 nilfs_segment_usage_set_clean(struct nilfs_segment_usage *su)
 {
-	su->su_lastmod = cpu_to_le64(0);
-	su->su_nblocks = cpu_to_le32(0);
-	su->su_flags = cpu_to_le32(0);
+	su->su_lastmod = __cpu_to_le64(0);
+	su->su_nblocks = __cpu_to_le32(0);
+	su->su_flags = __cpu_to_le32(0);
 }
 
 static inline int
 nilfs_segment_usage_clean(const struct nilfs_segment_usage *su)
 {
-	return !le32_to_cpu(su->su_flags);
+	return !__le32_to_cpu(su->su_flags);
 }
 
 /**
-- 
GitLab


From 079d7f16a9738f8ea8a71671f5481f9b5049da3a Mon Sep 17 00:00:00 2001
From: James Morse <james.morse@arm.com>
Date: Mon, 24 Jun 2019 18:36:56 +0100
Subject: [PATCH 0727/1835] drivers: base: cacheinfo: Ensure cpu hotplug work
 is done before Intel RDT

commit 83b44fe343b5abfcb1b2261289bd0cfcfcfd60a8 upstream.

The cacheinfo structures are alloced/freed by cpu online/offline
callbacks. Originally these were only used by sysfs to expose the
cache topology to user space. Without any in-kernel dependencies
CPUHP_AP_ONLINE_DYN was an appropriate choice.

resctrl has started using these structures to identify CPUs that
share a cache. It updates its 'domain' structures from cpu
online/offline callbacks. These depend on the cacheinfo structures
(resctrl_online_cpu()->domain_add_cpu()->get_cache_id()->
 get_cpu_cacheinfo()).
These also run as CPUHP_AP_ONLINE_DYN.

Now that there is an in-kernel dependency, move the cacheinfo
work earlier so we know its done before resctrl's CPUHP_AP_ONLINE_DYN
work runs.

Fixes: 2264d9c74dda1 ("x86/intel_rdt: Build structures for each resource based on cache topology")
Cc: <stable@vger.kernel.org>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: James Morse <james.morse@arm.com>
Link: https://lore.kernel.org/r/20190624173656.202407-1-james.morse@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/cacheinfo.c   | 3 ++-
 include/linux/cpuhotplug.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index dd6a6850cb450..ce015ce2977c4 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -653,7 +653,8 @@ static int cacheinfo_cpu_pre_down(unsigned int cpu)
 
 static int __init cacheinfo_sysfs_init(void)
 {
-	return cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "base/cacheinfo:online",
+	return cpuhp_setup_state(CPUHP_AP_BASE_CACHEINFO_ONLINE,
+				 "base/cacheinfo:online",
 				 cacheinfo_cpu_online, cacheinfo_cpu_pre_down);
 }
 device_initcall(cacheinfo_sysfs_init);
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index d64d8c2bbdabc..dec0372efe2e3 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -170,6 +170,7 @@ enum cpuhp_state {
 	CPUHP_AP_WATCHDOG_ONLINE,
 	CPUHP_AP_WORKQUEUE_ONLINE,
 	CPUHP_AP_RCUTREE_ONLINE,
+	CPUHP_AP_BASE_CACHEINFO_ONLINE,
 	CPUHP_AP_ONLINE_DYN,
 	CPUHP_AP_ONLINE_DYN_END		= CPUHP_AP_ONLINE_DYN + 30,
 	CPUHP_AP_X86_HPET_ONLINE,
-- 
GitLab


From 244db54441a110906d770f777d78abffa732b915 Mon Sep 17 00:00:00 2001
From: Sven Van Asbroeck <thesven73@gmail.com>
Date: Mon, 17 Jun 2019 14:23:54 -0400
Subject: [PATCH 0728/1835] firmware: improve LSM/IMA security behaviour

commit 2472d64af2d3561954e2f05365a67692bb852f2a upstream.

The firmware loader queries if LSM/IMA permits it to load firmware
via the sysfs fallback. Unfortunately, the code does the opposite:
it expressly permits sysfs fw loading if security_kernel_load_data(
LOADING_FIRMWARE) returns -EACCES. This happens because a
zero-on-success return value is cast to a bool that's true on success.

Fix the return value handling so we get the correct behaviour.

Fixes: 6e852651f28e ("firmware: add call to LSM hook before firmware sysfs fallback")
Cc: Stable <stable@vger.kernel.org>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Kees Cook <keescook@chromium.org>
To: Luis Chamberlain <mcgrof@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/firmware_loader/fallback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index b5c865fe263b2..818d8c37d70a9 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -659,7 +659,7 @@ static bool fw_run_sysfs_fallback(enum fw_opt opt_flags)
 	/* Also permit LSMs and IMA to fail firmware sysfs fallback */
 	ret = security_kernel_load_data(LOADING_FIRMWARE);
 	if (ret < 0)
-		return ret;
+		return false;
 
 	return fw_force_sysfs_fallback(opt_flags);
 }
-- 
GitLab


From ff232a47567f57852fec1cecdbdc2dc092e2f7d5 Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi@huawei.com>
Date: Mon, 13 May 2019 19:42:06 +0800
Subject: [PATCH 0729/1835] irqchip/gic-v3-its: Fix command queue pointer
 comparison bug

[ Upstream commit a050fa5476d418fc16b25abe168b3d38ba11e13c ]

When we run several VMs with PCI passthrough and GICv4 enabled, not
pinning vCPUs, we will occasionally see below warnings in dmesg:

ITS queue timeout (65440 65504 480)
ITS cmd its_build_vmovp_cmd failed

The reason for the above issue is that in BUILD_SINGLE_CMD_FUNC:
1. Post the write command.
2. Release the lock.
3. Start to read GITS_CREADR to get the reader pointer.
4. Compare the reader pointer to the target pointer.
5. If reader pointer does not reach the target, sleep 1us and continue
to try.

If we have several processors running the above concurrently, other
CPUs will post write commands while the 1st CPU is waiting the
completion. So we may have below issue:

phase 1:
---rd_idx-----from_idx-----to_idx--0---------

wait 1us:

phase 2:
--------------from_idx-----to_idx--0-rd_idx--

That is the rd_idx may fly ahead of to_idx, and if in case to_idx is
near the wrap point, rd_idx will wrap around. So the below condition
will not be met even after 1s:

if (from_idx < to_idx && rd_idx >= to_idx)

There is another theoretical issue. For a slow and busy ITS, the
initial rd_idx may fall behind from_idx a lot, just as below:

---rd_idx---0--from_idx-----to_idx-----------

This will cause the wait function exit too early.

Actually, it does not make much sense to use from_idx to judge if
to_idx is wrapped, but we need a initial rd_idx when lock is still
acquired, and it can be used to judge whether to_idx is wrapped and
the current rd_idx is wrapped.

We switch to a method of calculating the delta of two adjacent reads
and accumulating it to get the sum, so that we can get the real rd_idx
from the wrapped value even when the queue is almost full.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Heyi Guo <guoheyi@huawei.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v3-its.c | 35 ++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 65ab2c80529ce..ee30e8965d1be 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -740,32 +740,43 @@ static void its_flush_cmd(struct its_node *its, struct its_cmd_block *cmd)
 }
 
 static int its_wait_for_range_completion(struct its_node *its,
-					 struct its_cmd_block *from,
+					 u64	prev_idx,
 					 struct its_cmd_block *to)
 {
-	u64 rd_idx, from_idx, to_idx;
+	u64 rd_idx, to_idx, linear_idx;
 	u32 count = 1000000;	/* 1s! */
 
-	from_idx = its_cmd_ptr_to_offset(its, from);
+	/* Linearize to_idx if the command set has wrapped around */
 	to_idx = its_cmd_ptr_to_offset(its, to);
+	if (to_idx < prev_idx)
+		to_idx += ITS_CMD_QUEUE_SZ;
+
+	linear_idx = prev_idx;
 
 	while (1) {
+		s64 delta;
+
 		rd_idx = readl_relaxed(its->base + GITS_CREADR);
 
-		/* Direct case */
-		if (from_idx < to_idx && rd_idx >= to_idx)
-			break;
+		/*
+		 * Compute the read pointer progress, taking the
+		 * potential wrap-around into account.
+		 */
+		delta = rd_idx - prev_idx;
+		if (rd_idx < prev_idx)
+			delta += ITS_CMD_QUEUE_SZ;
 
-		/* Wrapped case */
-		if (from_idx >= to_idx && rd_idx >= to_idx && rd_idx < from_idx)
+		linear_idx += delta;
+		if (linear_idx >= to_idx)
 			break;
 
 		count--;
 		if (!count) {
-			pr_err_ratelimited("ITS queue timeout (%llu %llu %llu)\n",
-					   from_idx, to_idx, rd_idx);
+			pr_err_ratelimited("ITS queue timeout (%llu %llu)\n",
+					   to_idx, linear_idx);
 			return -1;
 		}
+		prev_idx = rd_idx;
 		cpu_relax();
 		udelay(1);
 	}
@@ -782,6 +793,7 @@ void name(struct its_node *its,						\
 	struct its_cmd_block *cmd, *sync_cmd, *next_cmd;		\
 	synctype *sync_obj;						\
 	unsigned long flags;						\
+	u64 rd_idx;							\
 									\
 	raw_spin_lock_irqsave(&its->lock, flags);			\
 									\
@@ -803,10 +815,11 @@ void name(struct its_node *its,						\
 	}								\
 									\
 post:									\
+	rd_idx = readl_relaxed(its->base + GITS_CREADR);		\
 	next_cmd = its_post_commands(its);				\
 	raw_spin_unlock_irqrestore(&its->lock, flags);			\
 									\
-	if (its_wait_for_range_completion(its, cmd, next_cmd))		\
+	if (its_wait_for_range_completion(its, rd_idx, next_cmd))	\
 		pr_err_ratelimited("ITS cmd %ps failed\n", builder);	\
 }
 
-- 
GitLab


From cf4deb2d4de6951ca30ce34f71c19e39ec92af57 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Wed, 29 May 2019 23:55:57 -0700
Subject: [PATCH 0730/1835] clk: ti: clkctrl: Fix returning uninitialized data

[ Upstream commit 41b3588dba6ef4b7995735a97e47ff0aeea6c276 ]

If we do a clk_get() for a clock that does not exists, we have
_ti_omap4_clkctrl_xlate() return uninitialized data if no match
is found. This can be seen in some cases with SLAB_DEBUG enabled:

Unable to handle kernel paging request at virtual address 5a5a5a5a
...
clk_hw_create_clk.part.33
sysc_notifier_call
notifier_call_chain
blocking_notifier_call_chain
device_add

Let's fix this by setting a found flag only when we find a match.

Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Fixes: 88a172526c32 ("clk: ti: add support for clkctrl clocks")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Tested-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/clkctrl.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index ca3218337fd74..dfaa5aad06927 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -229,6 +229,7 @@ static struct clk_hw *_ti_omap4_clkctrl_xlate(struct of_phandle_args *clkspec,
 {
 	struct omap_clkctrl_provider *provider = data;
 	struct omap_clkctrl_clk *entry;
+	bool found = false;
 
 	if (clkspec->args_count != 2)
 		return ERR_PTR(-EINVAL);
@@ -238,11 +239,13 @@ static struct clk_hw *_ti_omap4_clkctrl_xlate(struct of_phandle_args *clkspec,
 
 	list_for_each_entry(entry, &provider->clocks, node) {
 		if (entry->reg_offset == clkspec->args[0] &&
-		    entry->bit_offset == clkspec->args[1])
+		    entry->bit_offset == clkspec->args[1]) {
+			found = true;
 			break;
+		}
 	}
 
-	if (!entry)
+	if (!found)
 		return ERR_PTR(-EINVAL);
 
 	return entry->clk;
-- 
GitLab


From 627fdcc9b718e05d3aae886693c9388b4cb595a2 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 29 May 2019 15:28:28 +0200
Subject: [PATCH 0731/1835] efi/bgrt: Drop BGRT status field reserved bits
 check

[ Upstream commit a483fcab38b43fb34a7f12ab1daadd3907f150e2 ]

Starting with ACPI 6.2 bits 1 and 2 of the BGRT status field are no longer
reserved. These bits are now used to indicate if the image needs to be
rotated before being displayed.

The first device using these bits has now shown up (the GPD MicroPC) and
the reserved bits check causes us to reject the valid BGRT table on this
device.

Rather then changing the reserved bits check, allowing only the 2 new bits,
instead just completely remove it so that we do not end up with a similar
problem when more bits are added in the future.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/efi/efi-bgrt.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index b22ccfb0c991b..2bf4d31f49675 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -50,11 +50,6 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
 		       bgrt->version);
 		goto out;
 	}
-	if (bgrt->status & 0xfe) {
-		pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n",
-		       bgrt->status);
-		goto out;
-	}
 	if (bgrt->image_type != 0) {
 		pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n",
 		       bgrt->image_type);
-- 
GitLab


From afda29dc5ac6b6cda0d8cd6316e10ed7dff574f4 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Wed, 29 May 2019 14:37:24 +0200
Subject: [PATCH 0732/1835] perf/core: Fix perf_sample_regs_user() mm check

[ Upstream commit 085ebfe937d7a7a5df1729f35a12d6d655fea68c ]

perf_sample_regs_user() uses 'current->mm' to test for the presence of
userspace, but this is insufficient, consider use_mm().

A better test is: '!(current->flags & PF_KTHREAD)', exec() clears
PF_KTHREAD after it sets the new ->mm but before it drops to userspace
for the first time.

Possibly obsoletes: bf05fc25f268 ("powerpc/perf: Fix oops when kthread execs user process")

Reported-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
Reported-by: Young Xiao <92siuyang@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 4018994f3d87 ("perf: Add ability to attach user level registers dump to sample")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 171b83ebed4a3..3b61ff40bfe2b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5906,7 +5906,7 @@ static void perf_sample_regs_user(struct perf_regs *regs_user,
 	if (user_mode(regs)) {
 		regs_user->abi = perf_reg_abi(current);
 		regs_user->regs = regs;
-	} else if (current->mm) {
+	} else if (!(current->flags & PF_KTHREAD)) {
 		perf_get_regs_user(regs_user, regs, regs_user_copy);
 	} else {
 		regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
-- 
GitLab


From 5d3c45538151cbf89639290f3f110c937f68a4bb Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Sun, 16 Jun 2019 23:40:13 +0200
Subject: [PATCH 0733/1835] ARM: dts: gemini Fix up DNS-313 compatible string

[ Upstream commit 36558020128b1a48b7bddd5792ee70e3f64b04b0 ]

It's a simple typo in the DNS file, which was pretty serious.
No scripts were working properly. Fix it up.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/gemini-dlink-dns-313.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/gemini-dlink-dns-313.dts b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
index d1329322b9685..361dccd6c7eee 100644
--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
@@ -11,7 +11,7 @@
 
 / {
 	model = "D-Link DNS-313 1-Bay Network Storage Enclosure";
-	compatible = "dlink,dir-313", "cortina,gemini";
+	compatible = "dlink,dns-313", "cortina,gemini";
 	#address-cells = <1>;
 	#size-cells = <1>;
 
-- 
GitLab


From d47f06ab0c0e8b95851f00723dfddbe9c4af5b9c Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 19 Jun 2019 15:04:54 +0200
Subject: [PATCH 0734/1835] ARM: omap2: remove incorrect __init annotation

[ Upstream commit 27e23d8975270df6999f8b5b3156fc0c04927451 ]

omap3xxx_prm_enable_io_wakeup() is marked __init, but its caller is not, so
we get a warning with clang-8:

WARNING: vmlinux.o(.text+0x343c8): Section mismatch in reference from the function omap3xxx_prm_late_init() to the function .init.text:omap3xxx_prm_enable_io_wakeup()
The function omap3xxx_prm_late_init() references
the function __init omap3xxx_prm_enable_io_wakeup().
This is often because omap3xxx_prm_late_init lacks a __init
annotation or the annotation of omap3xxx_prm_enable_io_wakeup is wrong.

When building with gcc, omap3xxx_prm_enable_io_wakeup() is always
inlined, so we never noticed in the past.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Andrew Murray <andrew.murray@arm.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/prm3xxx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c
index 05858f966f7d9..dfa65fc2c82bc 100644
--- a/arch/arm/mach-omap2/prm3xxx.c
+++ b/arch/arm/mach-omap2/prm3xxx.c
@@ -433,7 +433,7 @@ static void omap3_prm_reconfigure_io_chain(void)
  * registers, and omap3xxx_prm_reconfigure_io_chain() must be called.
  * No return value.
  */
-static void __init omap3xxx_prm_enable_io_wakeup(void)
+static void omap3xxx_prm_enable_io_wakeup(void)
 {
 	if (prm_features & PRM_HAS_IO_WAKEUP)
 		omap2_prm_set_mod_reg_bits(OMAP3430_EN_IO_MASK, WKUP_MOD,
-- 
GitLab


From fdfff855cd3633680d26872771d10aeab0b7f340 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Thu, 20 Jun 2019 16:49:35 +0100
Subject: [PATCH 0735/1835] afs: Fix uninitialised spinlock
 afs_volume::cb_break_lock

[ Upstream commit 90fa9b64523a645a97edc0bdcf2d74759957eeee ]

Fix the cb_break_lock spinlock in afs_volume struct by initialising it when
the volume record is allocated.

Also rename the lock to cb_v_break_lock to distinguish it from the lock of
the same name in the afs_server struct.

Without this, the following trace may be observed when a volume-break
callback is received:

  INFO: trying to register non-static key.
  the code is fine but needs lockdep annotation.
  turning off the locking correctness validator.
  CPU: 2 PID: 50 Comm: kworker/2:1 Not tainted 5.2.0-rc1-fscache+ #3045
  Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
  Workqueue: afs SRXAFSCB_CallBack
  Call Trace:
   dump_stack+0x67/0x8e
   register_lock_class+0x23b/0x421
   ? check_usage_forwards+0x13c/0x13c
   __lock_acquire+0x89/0xf73
   lock_acquire+0x13b/0x166
   ? afs_break_callbacks+0x1b2/0x3dd
   _raw_write_lock+0x2c/0x36
   ? afs_break_callbacks+0x1b2/0x3dd
   afs_break_callbacks+0x1b2/0x3dd
   ? trace_event_raw_event_afs_server+0x61/0xac
   SRXAFSCB_CallBack+0x11f/0x16c
   process_one_work+0x2c5/0x4ee
   ? worker_thread+0x234/0x2ac
   worker_thread+0x1d8/0x2ac
   ? cancel_delayed_work_sync+0xf/0xf
   kthread+0x11f/0x127
   ? kthread_park+0x76/0x76
   ret_from_fork+0x24/0x30

Fixes: 68251f0a6818 ("afs: Fix whole-volume callback handling")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/callback.c | 4 ++--
 fs/afs/internal.h | 2 +-
 fs/afs/volume.c   | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index 5f261fbf2182b..4ad7012502998 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -276,9 +276,9 @@ static void afs_break_one_callback(struct afs_server *server,
 			struct afs_super_info *as = AFS_FS_S(cbi->sb);
 			struct afs_volume *volume = as->volume;
 
-			write_lock(&volume->cb_break_lock);
+			write_lock(&volume->cb_v_break_lock);
 			volume->cb_v_break++;
-			write_unlock(&volume->cb_break_lock);
+			write_unlock(&volume->cb_v_break_lock);
 		} else {
 			data.volume = NULL;
 			data.fid = *fid;
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 34c02fdcc25f1..aea19614c0822 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -477,7 +477,7 @@ struct afs_volume {
 	unsigned int		servers_seq;	/* Incremented each time ->servers changes */
 
 	unsigned		cb_v_break;	/* Break-everything counter. */
-	rwlock_t		cb_break_lock;
+	rwlock_t		cb_v_break_lock;
 
 	afs_voltype_t		type;		/* type of volume */
 	short			error;
diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index 3037bd01f617d..5ec186ec56519 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -47,6 +47,7 @@ static struct afs_volume *afs_alloc_volume(struct afs_mount_params *params,
 	atomic_set(&volume->usage, 1);
 	INIT_LIST_HEAD(&volume->proc_link);
 	rwlock_init(&volume->servers_lock);
+	rwlock_init(&volume->cb_v_break_lock);
 	memcpy(volume->name, vldb->name, vldb->name_len + 1);
 
 	slist = afs_alloc_server_list(params->cell, params->key, vldb, type_mask);
-- 
GitLab


From 2a6ee36917f02682e387d3e127af06bcb4a66aad Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 19 Jun 2019 19:14:46 +0100
Subject: [PATCH 0736/1835] x86/apic: Fix integer overflow on 10 bit left shift
 of cpu_khz

[ Upstream commit ea136a112d89bade596314a1ae49f748902f4727 ]

The left shift of unsigned int cpu_khz will overflow for large values of
cpu_khz, so cast it to a long long before shifting it to avoid overvlow.
For example, this can happen when cpu_khz is 4194305, i.e. ~4.2 GHz.

Addresses-Coverity: ("Unintentional integer overflow")
Fixes: 8c3ba8d04924 ("x86, apic: ack all pending irqs when crashed/on kexec")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: "H . Peter Anvin" <hpa@zytor.com>
Cc: kernel-janitors@vger.kernel.org
Link: https://lkml.kernel.org/r/20190619181446.13635-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/apic/apic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 84132eddb5a85..2646234380cc0 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1452,7 +1452,8 @@ static void apic_pending_intr_clear(void)
 		if (queued) {
 			if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
 				ntsc = rdtsc();
-				max_loops = (cpu_khz << 10) - (ntsc - tsc);
+				max_loops = (long long)cpu_khz << 10;
+				max_loops -= ntsc - tsc;
 			} else {
 				max_loops--;
 			}
-- 
GitLab


From 5ec7753c7c9e3be6a326a86d7f73a138addfe0eb Mon Sep 17 00:00:00 2001
From: Petr Oros <poros@redhat.com>
Date: Wed, 19 Jun 2019 14:29:42 +0200
Subject: [PATCH 0737/1835] be2net: fix link failure after ethtool offline test

[ Upstream commit 2e5db6eb3c23e5dc8171eb8f6af7a97ef9fcf3a9 ]

Certain cards in conjunction with certain switches need a little more
time for link setup that results in ethtool link test failure after
offline test. Patch adds a loop that waits for a link setup finish.

Changes in v2:
- added fixes header

Fixes: 4276e47e2d1c ("be2net: Add link test to list of ethtool self tests.")
Signed-off-by: Petr Oros <poros@redhat.com>
Reviewed-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/emulex/benet/be_ethtool.c    | 28 +++++++++++++++----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
index bfb16a4744901..d1905d50c26cb 100644
--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
+++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
@@ -895,7 +895,7 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
 			 u64 *data)
 {
 	struct be_adapter *adapter = netdev_priv(netdev);
-	int status;
+	int status, cnt;
 	u8 link_status = 0;
 
 	if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC) {
@@ -906,6 +906,9 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
 
 	memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
 
+	/* check link status before offline tests */
+	link_status = netif_carrier_ok(netdev);
+
 	if (test->flags & ETH_TEST_FL_OFFLINE) {
 		if (be_loopback_test(adapter, BE_MAC_LOOPBACK, &data[0]) != 0)
 			test->flags |= ETH_TEST_FL_FAILED;
@@ -926,13 +929,26 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
 		test->flags |= ETH_TEST_FL_FAILED;
 	}
 
-	status = be_cmd_link_status_query(adapter, NULL, &link_status, 0);
-	if (status) {
-		test->flags |= ETH_TEST_FL_FAILED;
-		data[4] = -1;
-	} else if (!link_status) {
+	/* link status was down prior to test */
+	if (!link_status) {
 		test->flags |= ETH_TEST_FL_FAILED;
 		data[4] = 1;
+		return;
+	}
+
+	for (cnt = 10; cnt; cnt--) {
+		status = be_cmd_link_status_query(adapter, NULL, &link_status,
+						  0);
+		if (status) {
+			test->flags |= ETH_TEST_FL_FAILED;
+			data[4] = -1;
+			break;
+		}
+
+		if (link_status)
+			break;
+
+		msleep_interruptible(500);
 	}
 }
 
-- 
GitLab


From 3232bccddebab7a80e70c42c7b8d1a73e32dbe85 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 19 Jun 2019 15:34:07 +0200
Subject: [PATCH 0738/1835] ppp: mppe: Add softdep to arc4

[ Upstream commit aad1dcc4f011ea409850e040363dff1e59aa4175 ]

The arc4 crypto is mandatory at ppp_mppe probe time, so let's put a
softdep line, so that the corresponding module gets prepared
gracefully.  Without this, a simple inclusion to initrd via dracut
failed due to the missing dependency, for example.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ppp/ppp_mppe.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c
index a205750b431ba..8609c1a0777b2 100644
--- a/drivers/net/ppp/ppp_mppe.c
+++ b/drivers/net/ppp/ppp_mppe.c
@@ -63,6 +63,7 @@ MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>");
 MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE));
+MODULE_SOFTDEP("pre: arc4");
 MODULE_VERSION("1.0.2");
 
 static unsigned int
-- 
GitLab


From a8cc2a2c2841f8e86089e6fd7d39e889c240127f Mon Sep 17 00:00:00 2001
From: Sergej Benilov <sergej.benilov@googlemail.com>
Date: Thu, 20 Jun 2019 11:02:18 +0200
Subject: [PATCH 0739/1835] sis900: fix TX completion

[ Upstream commit 8ac8a01092b2added0749ef937037bf1912e13e3 ]

Since commit 605ad7f184b60cfaacbc038aa6c55ee68dee3c89 "tcp: refine TSO autosizing",
outbound throughput is dramatically reduced for some connections, as sis900
is doing TX completion within idle states only.

Make TX completion happen after every transmitted packet.

Test:
netperf

before patch:
> netperf -H remote -l -2000000 -- -s 1000000
MIGRATED TCP STREAM TEST from 0.0.0.0 () port 0 AF_INET to 95.223.112.76 () port 0 AF_INET : demo
Recv   Send    Send
Socket Socket  Message  Elapsed
Size   Size    Size     Time     Throughput
bytes  bytes   bytes    secs.    10^6bits/sec

 87380 327680 327680    253.44      0.06

after patch:
> netperf -H remote -l -10000000 -- -s 1000000
MIGRATED TCP STREAM TEST from 0.0.0.0 () port 0 AF_INET to 95.223.112.76 () port 0 AF_INET : demo
Recv   Send    Send
Socket Socket  Message  Elapsed
Size   Size    Size     Time     Throughput
bytes  bytes   bytes    secs.    10^6bits/sec

 87380 327680 327680    5.38       14.89

Thx to Dave Miller and Eric Dumazet for helpful hints

Signed-off-by: Sergej Benilov <sergej.benilov@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sis/sis900.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
index 4bb89f74742c9..d5bcbc40a55fc 100644
--- a/drivers/net/ethernet/sis/sis900.c
+++ b/drivers/net/ethernet/sis/sis900.c
@@ -1057,7 +1057,7 @@ sis900_open(struct net_device *net_dev)
 	sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
 
 	/* Enable all known interrupts by setting the interrupt mask. */
-	sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
+	sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
 	sw32(cr, RxENA | sr32(cr));
 	sw32(ier, IE);
 
@@ -1578,7 +1578,7 @@ static void sis900_tx_timeout(struct net_device *net_dev)
 	sw32(txdp, sis_priv->tx_ring_dma);
 
 	/* Enable all known interrupts by setting the interrupt mask. */
-	sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
+	sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
 }
 
 /**
@@ -1618,7 +1618,7 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
 			spin_unlock_irqrestore(&sis_priv->lock, flags);
 			return NETDEV_TX_OK;
 	}
-	sis_priv->tx_ring[entry].cmdsts = (OWN | skb->len);
+	sis_priv->tx_ring[entry].cmdsts = (OWN | INTR | skb->len);
 	sw32(cr, TxENA | sr32(cr));
 
 	sis_priv->cur_tx ++;
@@ -1674,7 +1674,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
 	do {
 		status = sr32(isr);
 
-		if ((status & (HIBERR|TxURN|TxERR|TxIDLE|RxORN|RxERR|RxOK)) == 0)
+		if ((status & (HIBERR|TxURN|TxERR|TxIDLE|TxDESC|RxORN|RxERR|RxOK)) == 0)
 			/* nothing intresting happened */
 			break;
 		handled = 1;
@@ -1684,7 +1684,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
 			/* Rx interrupt */
 			sis900_rx(net_dev);
 
-		if (status & (TxURN | TxERR | TxIDLE))
+		if (status & (TxURN | TxERR | TxIDLE | TxDESC))
 			/* Tx interrupt */
 			sis900_finish_xmit(net_dev);
 
@@ -1896,8 +1896,8 @@ static void sis900_finish_xmit (struct net_device *net_dev)
 
 		if (tx_status & OWN) {
 			/* The packet is not transmitted yet (owned by hardware) !
-			 * Note: the interrupt is generated only when Tx Machine
-			 * is idle, so this is an almost impossible case */
+			 * Note: this is an almost impossible condition
+			 * in case of TxDESC ('descriptor interrupt') */
 			break;
 		}
 
@@ -2473,7 +2473,7 @@ static int sis900_resume(struct pci_dev *pci_dev)
 	sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
 
 	/* Enable all known interrupts by setting the interrupt mask. */
-	sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
+	sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
 	sw32(cr, RxENA | sr32(cr));
 	sw32(ier, IE);
 
-- 
GitLab


From 00640eb0eafa0ef8d5f2962c44e362e5225915b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Szymanski?=
 <sebastien.szymanski@armadeus.com>
Date: Tue, 18 Jun 2019 17:58:34 +0200
Subject: [PATCH 0740/1835] ARM: dts: imx6ul: fix PWM[1-4] interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3cf10132ac8d536565f2c02f60a3aeb315863a52 ]

According to the i.MX6UL/L RM, table 3.1 "ARM Cortex A7 domain interrupt
summary", the interrupts for the PWM[1-4] go from 83 to 86.

Fixes: b9901fe84f02 ("ARM: dts: imx6ul: add pwm[1-4] nodes")
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6ul.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
index 2366f093cc76d..336cdead3da54 100644
--- a/arch/arm/boot/dts/imx6ul.dtsi
+++ b/arch/arm/boot/dts/imx6ul.dtsi
@@ -359,7 +359,7 @@
 			pwm1: pwm@2080000 {
 				compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
 				reg = <0x02080000 0x4000>;
-				interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
+				interrupts = <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX6UL_CLK_PWM1>,
 					 <&clks IMX6UL_CLK_PWM1>;
 				clock-names = "ipg", "per";
@@ -370,7 +370,7 @@
 			pwm2: pwm@2084000 {
 				compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
 				reg = <0x02084000 0x4000>;
-				interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
+				interrupts = <GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX6UL_CLK_PWM2>,
 					 <&clks IMX6UL_CLK_PWM2>;
 				clock-names = "ipg", "per";
@@ -381,7 +381,7 @@
 			pwm3: pwm@2088000 {
 				compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
 				reg = <0x02088000 0x4000>;
-				interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+				interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX6UL_CLK_PWM3>,
 					 <&clks IMX6UL_CLK_PWM3>;
 				clock-names = "ipg", "per";
@@ -392,7 +392,7 @@
 			pwm4: pwm@208c000 {
 				compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
 				reg = <0x0208c000 0x4000>;
-				interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+				interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX6UL_CLK_PWM4>,
 					 <&clks IMX6UL_CLK_PWM4>;
 				clock-names = "ipg", "per";
-- 
GitLab


From 0fc080bc9a725ab4067a65e809cd029dcffd2540 Mon Sep 17 00:00:00 2001
From: Phil Reid <preid@electromag.com.au>
Date: Thu, 13 Jun 2019 12:10:23 +0800
Subject: [PATCH 0741/1835] pinctrl: mcp23s08: Fix add_data and
 irqchip_add_nested call order

[ Upstream commit 6dbc6e6f58556369bf999cd7d9793586f1b0e4b4 ]

Currently probing of the mcp23s08 results in an error message
"detected irqchip that is shared with multiple gpiochips:
please fix the driver"

This is due to the following:

Call to mcp23s08_irqchip_setup() with call hierarchy:
mcp23s08_irqchip_setup()
  gpiochip_irqchip_add_nested()
    gpiochip_irqchip_add_key()
      gpiochip_set_irq_hooks()

Call to devm_gpiochip_add_data() with call hierarchy:
devm_gpiochip_add_data()
  gpiochip_add_data_with_key()
    gpiochip_add_irqchip()
      gpiochip_set_irq_hooks()

The gpiochip_add_irqchip() returns immediately if there isn't a irqchip
but we added a irqchip due to the previous mcp23s08_irqchip_setup()
call. So it calls gpiochip_set_irq_hooks() a second time.

Fix this by moving the call to devm_gpiochip_add_data before
the call to mcp23s08_irqchip_setup

Fixes: 02e389e63e35 ("pinctrl: mcp23s08: fix irq setup order")
Suggested-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Phil Reid <preid@electromag.com.au>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-mcp23s08.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index cecbce21d01f7..33c3eca0ece97 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -889,6 +889,10 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
 	if (ret < 0)
 		goto fail;
 
+	ret = devm_gpiochip_add_data(dev, &mcp->chip, mcp);
+	if (ret < 0)
+		goto fail;
+
 	mcp->irq_controller =
 		device_property_read_bool(dev, "interrupt-controller");
 	if (mcp->irq && mcp->irq_controller) {
@@ -930,10 +934,6 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
 			goto fail;
 	}
 
-	ret = devm_gpiochip_add_data(dev, &mcp->chip, mcp);
-	if (ret < 0)
-		goto fail;
-
 	if (one_regmap_config) {
 		mcp->pinctrl_desc.name = devm_kasprintf(dev, GFP_KERNEL,
 				"mcp23xxx-pinctrl.%d", raw_chip_address);
-- 
GitLab


From 042be78692aee2649c58c41ddca04e5ae3441050 Mon Sep 17 00:00:00 2001
From: Jerome Marchand <jmarchan@redhat.com>
Date: Wed, 12 Jun 2019 18:22:26 +0200
Subject: [PATCH 0742/1835] dm table: don't copy from a NULL pointer in
 realloc_argv()

[ Upstream commit a0651926553cfe7992166432e418987760882652 ]

For the first call to realloc_argv() in dm_split_args(), old_argv is
NULL and size is zero. Then memcpy is called, with the NULL old_argv
as the source argument and a zero size argument. AFAIK, this is
undefined behavior and generates the following warning when compiled
with UBSAN on ppc64le:

In file included from ./arch/powerpc/include/asm/paca.h:19,
                 from ./arch/powerpc/include/asm/current.h:16,
                 from ./include/linux/sched.h:12,
                 from ./include/linux/kthread.h:6,
                 from drivers/md/dm-core.h:12,
                 from drivers/md/dm-table.c:8:
In function 'memcpy',
    inlined from 'realloc_argv' at drivers/md/dm-table.c:565:3,
    inlined from 'dm_split_args' at drivers/md/dm-table.c:588:9:
./include/linux/string.h:345:9: error: argument 2 null where non-null expected [-Werror=nonnull]
  return __builtin_memcpy(p, q, size);
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/md/dm-table.c: In function 'dm_split_args':
./include/linux/string.h:345:9: note: in a call to built-in function '__builtin_memcpy'

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index c7fe4789c40ef..34ab30dd5de93 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -562,7 +562,7 @@ static char **realloc_argv(unsigned *size, char **old_argv)
 		gfp = GFP_NOIO;
 	}
 	argv = kmalloc_array(new_size, sizeof(*argv), gfp);
-	if (argv) {
+	if (argv && old_argv) {
 		memcpy(argv, old_argv, *size * sizeof(*argv));
 		*size = new_size;
 	}
-- 
GitLab


From 136847140cc891a875fce5cfdc4886eacfe1f767 Mon Sep 17 00:00:00 2001
From: Milan Broz <gmazyland@gmail.com>
Date: Thu, 20 Jun 2019 13:00:19 +0200
Subject: [PATCH 0743/1835] dm verity: use message limit for data block
 corruption message

[ Upstream commit 2eba4e640b2c4161e31ae20090a53ee02a518657 ]

DM verity should also use DMERR_LIMIT to limit repeat data block
corruption messages.

Signed-off-by: Milan Broz <gmazyland@gmail.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-verity-target.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index fc65f0dedf7f7..e3599b43f9eb9 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -236,8 +236,8 @@ static int verity_handle_err(struct dm_verity *v, enum verity_block_type type,
 		BUG();
 	}
 
-	DMERR("%s: %s block %llu is corrupted", v->data_dev->name, type_str,
-		block);
+	DMERR_LIMIT("%s: %s block %llu is corrupted", v->data_dev->name,
+		    type_str, block);
 
 	if (v->corrupted_errs == DM_VERITY_MAX_CORRUPTED_ERRS)
 		DMERR("%s: reached maximum errors", v->data_dev->name);
-- 
GitLab


From 729d25f43b64986c1978c5235e2463d4478e1b46 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill@shutemov.name>
Date: Thu, 20 Jun 2019 14:23:45 +0300
Subject: [PATCH 0744/1835] x86/boot/64: Fix crash if kernel image crosses page
 table boundary

[ Upstream commit 81c7ed296dcd02bc0b4488246d040e03e633737a ]

A kernel which boots in 5-level paging mode crashes in a small percentage
of cases if KASLR is enabled.

This issue was tracked down to the case when the kernel image unpacks in a
way that it crosses an 1G boundary. The crash is caused by an overrun of
the PMD page table in __startup_64() and corruption of P4D page table
allocated next to it. This particular issue is not visible with 4-level
paging as P4D page tables are not used.

But the P4D and the PUD calculation have similar problems.

The PMD index calculation is wrong due to operator precedence, which fails
to confine the PMDs in the PMD array on wrap around.

The P4D calculation for 5-level paging and the PUD calculation calculate
the first index correctly, but then blindly increment it which causes the
same issue when a kernel image is located across a 512G and for 5-level
paging across a 46T boundary.

This wrap around mishandling was introduced when these parts moved from
assembly to C.

Restore it to the correct behaviour.

Fixes: c88d71508e36 ("x86/boot/64: Rewrite startup_64() in C")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20190620112345.28833-1-kirill.shutemov@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/head64.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index ddee1f0870c4b..cc5b519dc687a 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -190,18 +190,18 @@ unsigned long __head __startup_64(unsigned long physaddr,
 		pgd[i + 0] = (pgdval_t)p4d + pgtable_flags;
 		pgd[i + 1] = (pgdval_t)p4d + pgtable_flags;
 
-		i = (physaddr >> P4D_SHIFT) % PTRS_PER_P4D;
-		p4d[i + 0] = (pgdval_t)pud + pgtable_flags;
-		p4d[i + 1] = (pgdval_t)pud + pgtable_flags;
+		i = physaddr >> P4D_SHIFT;
+		p4d[(i + 0) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
+		p4d[(i + 1) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
 	} else {
 		i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
 		pgd[i + 0] = (pgdval_t)pud + pgtable_flags;
 		pgd[i + 1] = (pgdval_t)pud + pgtable_flags;
 	}
 
-	i = (physaddr >> PUD_SHIFT) % PTRS_PER_PUD;
-	pud[i + 0] = (pudval_t)pmd + pgtable_flags;
-	pud[i + 1] = (pudval_t)pmd + pgtable_flags;
+	i = physaddr >> PUD_SHIFT;
+	pud[(i + 0) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
+	pud[(i + 1) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
 
 	pmd_entry = __PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL;
 	/* Filter out unsupported __PAGE_KERNEL_* bits: */
@@ -211,8 +211,9 @@ unsigned long __head __startup_64(unsigned long physaddr,
 	pmd_entry +=  physaddr;
 
 	for (i = 0; i < DIV_ROUND_UP(_end - _text, PMD_SIZE); i++) {
-		int idx = i + (physaddr >> PMD_SHIFT) % PTRS_PER_PMD;
-		pmd[idx] = pmd_entry + i * PMD_SIZE;
+		int idx = i + (physaddr >> PMD_SHIFT);
+
+		pmd[idx % PTRS_PER_PMD] = pmd_entry + i * PMD_SIZE;
 	}
 
 	/*
-- 
GitLab


From 94968c37b6d37ccf02d3d58e2d2e8b8f262bd300 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill@shutemov.name>
Date: Thu, 20 Jun 2019 14:24:22 +0300
Subject: [PATCH 0745/1835] x86/boot/64: Add missing fixup_pointer() for
 next_early_pgt access

[ Upstream commit c1887159eb48ba40e775584cfb2a443962cf1a05 ]

__startup_64() uses fixup_pointer() to access global variables in a
position-independent fashion. Access to next_early_pgt was wrapped into the
helper, but one instance in the 5-level paging branch was missed.

GCC generates a R_X86_64_PC32 PC-relative relocation for the access which
doesn't trigger the issue, but Clang emmits a R_X86_64_32S which leads to
an invalid memory access and system reboot.

Fixes: 187e91fe5e91 ("x86/boot/64/clang: Use fixup_pointer() to access 'next_early_pgt'")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Alexander Potapenko <glider@google.com>
Link: https://lkml.kernel.org/r/20190620112422.29264-1-kirill.shutemov@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/head64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index cc5b519dc687a..250cfa85b6330 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -184,7 +184,8 @@ unsigned long __head __startup_64(unsigned long physaddr,
 	pgtable_flags = _KERNPG_TABLE_NOENC + sme_get_me_mask();
 
 	if (la57) {
-		p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+		p4d = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++],
+				    physaddr);
 
 		i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
 		pgd[i + 0] = (pgdval_t)p4d + pgtable_flags;
-- 
GitLab


From 9ea3b131441eb58859522c24842434ac95794ed3 Mon Sep 17 00:00:00 2001
From: Oleksandr Natalenko <oleksandr@redhat.com>
Date: Fri, 21 Jun 2019 11:17:36 +0200
Subject: [PATCH 0746/1835] HID: chicony: add another quirk for PixArt mouse

[ Upstream commit dcf768b0ac868630e7bdb6f2f1c9fe72788012fa ]

I've spotted another Chicony PixArt mouse in the wild, which requires
HID_QUIRK_ALWAYS_POLL quirk, otherwise it disconnects each minute.

USB ID of this device is 0x04f2:0x0939.

We've introduced quirks like this for other models before, so lets add
this mouse too.

Link: https://github.com/sriemer/fix-linux-mouse#usb-mouse-disconnectsreconnects-every-minute-on-linux
Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com>
Acked-by: Sebastian Parschauer <s.parschauer@gmx.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h    | 1 +
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 92452992b3681..97b4ecab7c125 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -265,6 +265,7 @@
 #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH	0xb19d
 #define USB_DEVICE_ID_CHICONY_WIRELESS	0x0618
 #define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE	0x1053
+#define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2	0x0939
 #define USB_DEVICE_ID_CHICONY_WIRELESS2	0x1123
 #define USB_DEVICE_ID_ASUS_AK1D		0x1125
 #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12	0x1421
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 5892f1bd037ec..91e86af44a04c 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -45,6 +45,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD), HID_QUIRK_BADPAD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK), HID_QUIRK_NOGET },
-- 
GitLab


From cd2646e57ec5a36a0c432345d6b9d5e4e0a45812 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Fri, 14 Jun 2019 16:56:55 +0800
Subject: [PATCH 0747/1835] HID: multitouch: Add pointstick support for ALPS
 Touchpad

[ Upstream commit 0a95fc733da375de0688d0f1fd3a2869a1c1d499 ]

There's a new ALPS touchpad/pointstick combo device that requires
MT_CLS_WIN_8_DUAL to make its pointsitck work as a mouse.

The device can be found on HP ZBook 17 G5.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h        | 1 +
 drivers/hid/hid-multitouch.c | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 97b4ecab7c125..50b3c0d89c9c2 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -82,6 +82,7 @@
 #define HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP	0x1220
 #define HID_DEVICE_ID_ALPS_U1		0x1215
 #define HID_DEVICE_ID_ALPS_T4_BTNLESS	0x120C
+#define HID_DEVICE_ID_ALPS_1222		0x1222
 
 
 #define USB_VENDOR_ID_AMI		0x046b
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 184e49036e1dc..f9167d0e095ce 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1788,6 +1788,10 @@ static const struct hid_device_id mt_devices[] = {
 		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
 			USB_VENDOR_ID_ALPS_JP,
 			HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
+	{ .driver_data = MT_CLS_WIN_8_DUAL,
+		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+			USB_VENDOR_ID_ALPS_JP,
+			HID_DEVICE_ID_ALPS_1222) },
 
 	/* Lenovo X1 TAB Gen 2 */
 	{ .driver_data = MT_CLS_WIN_8_DUAL,
-- 
GitLab


From fa99487a43cff7a5eca7f692c857052a0f7fb500 Mon Sep 17 00:00:00 2001
From: Nicolas Boichat <drinkcat@chromium.org>
Date: Mon, 29 Apr 2019 11:55:14 +0800
Subject: [PATCH 0748/1835] pinctrl: mediatek: Ignore interrupts that are wake
 only during resume

[ Upstream commit 35594bc7cecf3a78504b590e350570e8f4d7779e ]

Before suspending, mtk-eint would set the interrupt mask to the
one in wake_mask. However, some of these interrupts may not have a
corresponding interrupt handler, or the interrupt may be disabled.

On resume, the eint irq handler would trigger nevertheless,
and irq/pm.c:irq_pm_check_wakeup would be called, which would
try to call irq_disable. However, if the interrupt is not enabled
(irqd_irq_disabled(&desc->irq_data) is true), the call does nothing,
and the interrupt is left enabled in the eint driver.

Especially for level-sensitive interrupts, this will lead to an
interrupt storm on resume.

If we detect that an interrupt is only in wake_mask, but not in
cur_mask, we can just mask it out immediately (as mtk_eint_resume
would do anyway at a later stage in the resume sequence, when
restoring cur_mask).

Fixes: bf22ff45bed6 ("genirq: Avoid unnecessary low level irq function calls")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Acked-by: Sean Wang <sean.wang@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/mediatek/mtk-eint.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index a613e546717a8..b9f3c02ba59d8 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -318,7 +318,7 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
 	struct irq_chip *chip = irq_desc_get_chip(desc);
 	struct mtk_eint *eint = irq_desc_get_handler_data(desc);
 	unsigned int status, eint_num;
-	int offset, index, virq;
+	int offset, mask_offset, index, virq;
 	void __iomem *reg =  mtk_eint_get_offset(eint, 0, eint->regs->stat);
 	int dual_edge, start_level, curr_level;
 
@@ -328,10 +328,24 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
 		status = readl(reg);
 		while (status) {
 			offset = __ffs(status);
+			mask_offset = eint_num >> 5;
 			index = eint_num + offset;
 			virq = irq_find_mapping(eint->domain, index);
 			status &= ~BIT(offset);
 
+			/*
+			 * If we get an interrupt on pin that was only required
+			 * for wake (but no real interrupt requested), mask the
+			 * interrupt (as would mtk_eint_resume do anyway later
+			 * in the resume sequence).
+			 */
+			if (eint->wake_mask[mask_offset] & BIT(offset) &&
+			    !(eint->cur_mask[mask_offset] & BIT(offset))) {
+				writel_relaxed(BIT(offset), reg -
+					eint->regs->stat +
+					eint->regs->mask_set);
+			}
+
 			dual_edge = eint->dual_edge[index];
 			if (dual_edge) {
 				/*
-- 
GitLab


From f6e01328cb0e4bc88172bc3e4c5afedb864a6b43 Mon Sep 17 00:00:00 2001
From: Eiichi Tsukata <devel@etsukata.com>
Date: Thu, 27 Jun 2019 11:47:32 +0900
Subject: [PATCH 0749/1835] cpu/hotplug: Fix out-of-bounds read when setting
 fail state

[ Upstream commit 33d4a5a7a5b4d02915d765064b2319e90a11cbde ]

Setting invalid value to /sys/devices/system/cpu/cpuX/hotplug/fail
can control `struct cpuhp_step *sp` address, results in the following
global-out-of-bounds read.

Reproducer:

  # echo -2 > /sys/devices/system/cpu/cpu0/hotplug/fail

KASAN report:

  BUG: KASAN: global-out-of-bounds in write_cpuhp_fail+0x2cd/0x2e0
  Read of size 8 at addr ffffffff89734438 by task bash/1941

  CPU: 0 PID: 1941 Comm: bash Not tainted 5.2.0-rc6+ #31
  Call Trace:
   write_cpuhp_fail+0x2cd/0x2e0
   dev_attr_store+0x58/0x80
   sysfs_kf_write+0x13d/0x1a0
   kernfs_fop_write+0x2bc/0x460
   vfs_write+0x1e1/0x560
   ksys_write+0x126/0x250
   do_syscall_64+0xc1/0x390
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7f05e4f4c970

  The buggy address belongs to the variable:
   cpu_hotplug_lock+0x98/0xa0

  Memory state around the buggy address:
   ffffffff89734300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
   ffffffff89734380: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  >ffffffff89734400: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
                                          ^
   ffffffff89734480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   ffffffff89734500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Add a sanity check for the value written from user space.

Fixes: 1db49484f21ed ("smp/hotplug: Hotplug state fail injection")
Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: peterz@infradead.org
Link: https://lkml.kernel.org/r/20190627024732.31672-1-devel@etsukata.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/cpu.c b/kernel/cpu.c
index 46aefe5c0e35e..d9f855cb9f6f9 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1925,6 +1925,9 @@ static ssize_t write_cpuhp_fail(struct device *dev,
 	if (ret)
 		return ret;
 
+	if (fail < CPUHP_OFFLINE || fail > CPUHP_ONLINE)
+		return -EINVAL;
+
 	/*
 	 * Cannot fail STARTING/DYING callbacks.
 	 */
-- 
GitLab


From 9c875e8556d4176d476ea55f1fe747a40b37bec8 Mon Sep 17 00:00:00 2001
From: Nicolas Boichat <drinkcat@chromium.org>
Date: Wed, 26 Jun 2019 11:54:45 +0800
Subject: [PATCH 0750/1835] pinctrl: mediatek: Update cur_mask in mask/mask ops

[ Upstream commit 9d957a959bc8c3dfe37572ac8e99affb5a885965 ]

During suspend/resume, mtk_eint_mask may be called while
wake_mask is active. For example, this happens if a wake-source
with an active interrupt handler wakes the system:
irq/pm.c:irq_pm_check_wakeup would disable the interrupt, so
that it can be handled later on in the resume flow.

However, this may happen before mtk_eint_do_resume is called:
in this case, wake_mask is loaded, and cur_mask is restored
from an older copy, re-enabling the interrupt, and causing
an interrupt storm (especially for level interrupts).

Step by step, for a line that has both wake and interrupt enabled:
 1. cur_mask[irq] = 1; wake_mask[irq] = 1; EINT_EN[irq] = 1 (interrupt
    enabled at hardware level)
 2. System suspends, resumes due to that line (at this stage EINT_EN
    == wake_mask)
 3. irq_pm_check_wakeup is called, and disables the interrupt =>
    EINT_EN[irq] = 0, but we still have cur_mask[irq] = 1
 4. mtk_eint_do_resume is called, and restores EINT_EN = cur_mask, so
    it reenables EINT_EN[irq] = 1 => interrupt storm as the driver
    is not yet ready to handle the interrupt.

This patch fixes the issue in step 3, by recording all mask/unmask
changes in cur_mask. This also avoids the need to read the current
mask in eint_do_suspend, and we can remove mtk_eint_chip_read_mask
function.

The interrupt will be re-enabled properly later on, sometimes after
mtk_eint_do_resume, when the driver is ready to handle it.

Fixes: 58a5e1b64bb0 ("pinctrl: mediatek: Implement wake handler and suspend resume")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Acked-by: Sean Wang <sean.wang@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/mediatek/mtk-eint.c | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index b9f3c02ba59d8..564cfaee129d2 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -113,6 +113,8 @@ static void mtk_eint_mask(struct irq_data *d)
 	void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
 						eint->regs->mask_set);
 
+	eint->cur_mask[d->hwirq >> 5] &= ~mask;
+
 	writel(mask, reg);
 }
 
@@ -123,6 +125,8 @@ static void mtk_eint_unmask(struct irq_data *d)
 	void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
 						eint->regs->mask_clr);
 
+	eint->cur_mask[d->hwirq >> 5] |= mask;
+
 	writel(mask, reg);
 
 	if (eint->dual_edge[d->hwirq])
@@ -217,19 +221,6 @@ static void mtk_eint_chip_write_mask(const struct mtk_eint *eint,
 	}
 }
 
-static void mtk_eint_chip_read_mask(const struct mtk_eint *eint,
-				    void __iomem *base, u32 *buf)
-{
-	int port;
-	void __iomem *reg;
-
-	for (port = 0; port < eint->hw->ports; port++) {
-		reg = base + eint->regs->mask + (port << 2);
-		buf[port] = ~readl_relaxed(reg);
-		/* Mask is 0 when irq is enabled, and 1 when disabled. */
-	}
-}
-
 static int mtk_eint_irq_request_resources(struct irq_data *d)
 {
 	struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
@@ -384,7 +375,6 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
 
 int mtk_eint_do_suspend(struct mtk_eint *eint)
 {
-	mtk_eint_chip_read_mask(eint, eint->base, eint->cur_mask);
 	mtk_eint_chip_write_mask(eint, eint->base, eint->wake_mask);
 
 	return 0;
-- 
GitLab


From 2656ee5a5ad59300bbe183d0833867a582910dcc Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Fri, 28 Jun 2019 12:07:21 -0700
Subject: [PATCH 0751/1835] linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL

[ Upstream commit 8f9fab480c7a87b10bb5440b5555f370272a5d59 ]

DIV_ROUND_UP_ULL adds the two arguments and then invokes
DIV_ROUND_DOWN_ULL.  But on a 32bit system the addition of two 32 bit
values can overflow.  DIV_ROUND_DOWN_ULL does it correctly and stashes
the addition into a unsigned long long so cast the result to unsigned
long long here to avoid the overflow condition.

[akpm@linux-foundation.org: DIV_ROUND_UP_ULL must be an rval]
Link: http://lkml.kernel.org/r/20190625100518.30753-1-vkoul@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/kernel.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 3d83ebb302cfd..f6f94e54ab966 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -118,7 +118,8 @@
 #define DIV_ROUND_DOWN_ULL(ll, d) \
 	({ unsigned long long _tmp = (ll); do_div(_tmp, d); _tmp; })
 
-#define DIV_ROUND_UP_ULL(ll, d)		DIV_ROUND_DOWN_ULL((ll) + (d) - 1, (d))
+#define DIV_ROUND_UP_ULL(ll, d) \
+	DIV_ROUND_DOWN_ULL((unsigned long long)(ll) + (d) - 1, (d))
 
 #if BITS_PER_LONG == 32
 # define DIV_ROUND_UP_SECTOR_T(ll,d) DIV_ROUND_UP_ULL(ll, d)
-- 
GitLab


From 578db1aa595b421f35960765a0702e9facc13038 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 28 Jun 2019 13:11:49 +0200
Subject: [PATCH 0752/1835] genirq: Delay deactivation in free_irq()

commit 4001d8e8762f57d418b66e4e668601791900a1dd upstream

When interrupts are shutdown, they are immediately deactivated in the
irqdomain hierarchy. While this looks obviously correct there is a subtle
issue:

There might be an interrupt in flight when free_irq() is invoking the
shutdown. This is properly handled at the irq descriptor / primary handler
level, but the deactivation might completely disable resources which are
required to acknowledge the interrupt.

Split the shutdown code and deactivate the interrupt after synchronization
in free_irq(). Fixup all other usage sites where this is not an issue to
invoke the combined shutdown_and_deactivate() function instead.

This still might be an issue if the interrupt in flight servicing is
delayed on a remote CPU beyond the invocation of synchronize_irq(), but
that cannot be handled at that level and needs to be handled in the
synchronize_irq() context.

Fixes: f8264e34965a ("irqdomain: Introduce new interfaces to support hierarchy irqdomains")
Reported-by: Robert Hodaszi <Robert.Hodaszi@digi.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Link: https://lkml.kernel.org/r/20190628111440.098196390@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/autoprobe.c  |  6 +++---
 kernel/irq/chip.c       |  6 ++++++
 kernel/irq/cpuhotplug.c |  2 +-
 kernel/irq/internals.h  |  1 +
 kernel/irq/manage.c     | 10 ++++++++++
 5 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
index 16cbf6beb2768..ae60cae24e9aa 100644
--- a/kernel/irq/autoprobe.c
+++ b/kernel/irq/autoprobe.c
@@ -90,7 +90,7 @@ unsigned long probe_irq_on(void)
 			/* It triggered already - consider it spurious. */
 			if (!(desc->istate & IRQS_WAITING)) {
 				desc->istate &= ~IRQS_AUTODETECT;
-				irq_shutdown(desc);
+				irq_shutdown_and_deactivate(desc);
 			} else
 				if (i < 32)
 					mask |= 1 << i;
@@ -127,7 +127,7 @@ unsigned int probe_irq_mask(unsigned long val)
 				mask |= 1 << i;
 
 			desc->istate &= ~IRQS_AUTODETECT;
-			irq_shutdown(desc);
+			irq_shutdown_and_deactivate(desc);
 		}
 		raw_spin_unlock_irq(&desc->lock);
 	}
@@ -169,7 +169,7 @@ int probe_irq_off(unsigned long val)
 				nr_of_irqs++;
 			}
 			desc->istate &= ~IRQS_AUTODETECT;
-			irq_shutdown(desc);
+			irq_shutdown_and_deactivate(desc);
 		}
 		raw_spin_unlock_irq(&desc->lock);
 	}
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 379e89c706c9a..09d914e486a2d 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -314,6 +314,12 @@ void irq_shutdown(struct irq_desc *desc)
 		}
 		irq_state_clr_started(desc);
 	}
+}
+
+
+void irq_shutdown_and_deactivate(struct irq_desc *desc)
+{
+	irq_shutdown(desc);
 	/*
 	 * This must be called even if the interrupt was never started up,
 	 * because the activation can happen before the interrupt is
diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
index 5b1072e394b26..6c7ca2e983a59 100644
--- a/kernel/irq/cpuhotplug.c
+++ b/kernel/irq/cpuhotplug.c
@@ -116,7 +116,7 @@ static bool migrate_one_irq(struct irq_desc *desc)
 		 */
 		if (irqd_affinity_is_managed(d)) {
 			irqd_set_managed_shutdown(d);
-			irq_shutdown(desc);
+			irq_shutdown_and_deactivate(desc);
 			return false;
 		}
 		affinity = cpu_online_mask;
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index e74e7eea76cf1..c119aa1ffc40e 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -80,6 +80,7 @@ extern int irq_activate_and_startup(struct irq_desc *desc, bool resend);
 extern int irq_startup(struct irq_desc *desc, bool resend, bool force);
 
 extern void irq_shutdown(struct irq_desc *desc);
+extern void irq_shutdown_and_deactivate(struct irq_desc *desc);
 extern void irq_enable(struct irq_desc *desc);
 extern void irq_disable(struct irq_desc *desc);
 extern void irq_percpu_enable(struct irq_desc *desc, unsigned int cpu);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index cd4f9f3e8345c..5c76ed5271bb9 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/random.h>
 #include <linux/interrupt.h>
+#include <linux/irqdomain.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/sched/rt.h>
@@ -1619,6 +1620,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 	/* If this was the last handler, shut down the IRQ line: */
 	if (!desc->action) {
 		irq_settings_clr_disable_unlazy(desc);
+		/* Only shutdown. Deactivate after synchronize_hardirq() */
 		irq_shutdown(desc);
 	}
 
@@ -1688,6 +1690,14 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 		 * require it to deallocate resources over the slow bus.
 		 */
 		chip_bus_lock(desc);
+		/*
+		 * There is no interrupt on the fly anymore. Deactivate it
+		 * completely.
+		 */
+		raw_spin_lock_irqsave(&desc->lock, flags);
+		irq_domain_deactivate_irq(&desc->irq_data);
+		raw_spin_unlock_irqrestore(&desc->lock, flags);
+
 		irq_release_resources(desc);
 		chip_bus_sync_unlock(desc);
 		irq_remove_timings(desc);
-- 
GitLab


From 3f10ccc29780b5ca8b1638941a47018f694ecbc7 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 28 Jun 2019 13:11:50 +0200
Subject: [PATCH 0753/1835] genirq: Fix misleading synchronize_irq()
 documentation

commit 1d21f2af8571c6a6a44e7c1911780614847b0253 upstream

The function might sleep, so it cannot be called from interrupt
context. Not even with care.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Link: https://lkml.kernel.org/r/20190628111440.189241552@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/manage.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 5c76ed5271bb9..f8214bbcf5c01 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -96,7 +96,8 @@ EXPORT_SYMBOL(synchronize_hardirq);
  *	to complete before returning. If you use this function while
  *	holding a resource the IRQ handler may need you will deadlock.
  *
- *	This function may be called - with care - from IRQ context.
+ *	Can only be called from preemptible code as it might sleep when
+ *	an interrupt thread is associated to @irq.
  */
 void synchronize_irq(unsigned int irq)
 {
-- 
GitLab


From 6074f6043c49fceb1b22227c2db315fe0d5a331f Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 28 Jun 2019 13:11:51 +0200
Subject: [PATCH 0754/1835] genirq: Add optional hardware synchronization for
 shutdown

commit 62e0468650c30f0298822c580f382b16328119f6 upstream

free_irq() ensures that no hardware interrupt handler is executing on a
different CPU before actually releasing resources and deactivating the
interrupt completely in a domain hierarchy.

But that does not catch the case where the interrupt is on flight at the
hardware level but not yet serviced by the target CPU. That creates an
interesing race condition:

   CPU 0                  CPU 1               IRQ CHIP

                                              interrupt is raised
                                              sent to CPU1
			  Unable to handle
			  immediately
			  (interrupts off,
			   deep idle delay)
   mask()
   ...
   free()
     shutdown()
     synchronize_irq()
     release_resources()
                          do_IRQ()
                            -> resources are not available

That might be harmless and just trigger a spurious interrupt warning, but
some interrupt chips might get into a wedged state.

Utilize the existing irq_get_irqchip_state() callback for the
synchronization in free_irq().

synchronize_hardirq() is not using this mechanism as it might actually
deadlock unter certain conditions, e.g. when called with interrupts
disabled and the target CPU is the one on which the synchronization is
invoked. synchronize_irq() uses it because that function cannot be called
from non preemtible contexts as it might sleep.

No functional change intended and according to Marc the existing GIC
implementations where the driver supports the callback should be able
to cope with that core change. Famous last words.

Fixes: 464d12309e1b ("x86/vector: Switch IOAPIC to global reservation mode")
Reported-by: Robert Hodaszi <Robert.Hodaszi@digi.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Tested-by: Marc Zyngier <marc.zyngier@arm.com>
Link: https://lkml.kernel.org/r/20190628111440.279463375@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/internals.h |  4 +++
 kernel/irq/manage.c    | 75 +++++++++++++++++++++++++++++++-----------
 2 files changed, 60 insertions(+), 19 deletions(-)

diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index c119aa1ffc40e..ea57f3d397fe3 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -95,6 +95,10 @@ static inline void irq_mark_irq(unsigned int irq) { }
 extern void irq_mark_irq(unsigned int irq);
 #endif
 
+extern int __irq_get_irqchip_state(struct irq_data *data,
+				   enum irqchip_irq_state which,
+				   bool *state);
+
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
 
 irqreturn_t __handle_irq_event_percpu(struct irq_desc *desc, unsigned int *flags);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index f8214bbcf5c01..23bcfa71077fe 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -35,8 +35,9 @@ static int __init setup_forced_irqthreads(char *arg)
 early_param("threadirqs", setup_forced_irqthreads);
 #endif
 
-static void __synchronize_hardirq(struct irq_desc *desc)
+static void __synchronize_hardirq(struct irq_desc *desc, bool sync_chip)
 {
+	struct irq_data *irqd = irq_desc_get_irq_data(desc);
 	bool inprogress;
 
 	do {
@@ -52,6 +53,20 @@ static void __synchronize_hardirq(struct irq_desc *desc)
 		/* Ok, that indicated we're done: double-check carefully. */
 		raw_spin_lock_irqsave(&desc->lock, flags);
 		inprogress = irqd_irq_inprogress(&desc->irq_data);
+
+		/*
+		 * If requested and supported, check at the chip whether it
+		 * is in flight at the hardware level, i.e. already pending
+		 * in a CPU and waiting for service and acknowledge.
+		 */
+		if (!inprogress && sync_chip) {
+			/*
+			 * Ignore the return code. inprogress is only updated
+			 * when the chip supports it.
+			 */
+			__irq_get_irqchip_state(irqd, IRQCHIP_STATE_ACTIVE,
+						&inprogress);
+		}
 		raw_spin_unlock_irqrestore(&desc->lock, flags);
 
 		/* Oops, that failed? */
@@ -74,13 +89,18 @@ static void __synchronize_hardirq(struct irq_desc *desc)
  *	Returns: false if a threaded handler is active.
  *
  *	This function may be called - with care - from IRQ context.
+ *
+ *	It does not check whether there is an interrupt in flight at the
+ *	hardware level, but not serviced yet, as this might deadlock when
+ *	called with interrupts disabled and the target CPU of the interrupt
+ *	is the current CPU.
  */
 bool synchronize_hardirq(unsigned int irq)
 {
 	struct irq_desc *desc = irq_to_desc(irq);
 
 	if (desc) {
-		__synchronize_hardirq(desc);
+		__synchronize_hardirq(desc, false);
 		return !atomic_read(&desc->threads_active);
 	}
 
@@ -98,13 +118,17 @@ EXPORT_SYMBOL(synchronize_hardirq);
  *
  *	Can only be called from preemptible code as it might sleep when
  *	an interrupt thread is associated to @irq.
+ *
+ *	It optionally makes sure (when the irq chip supports that method)
+ *	that the interrupt is not pending in any CPU and waiting for
+ *	service.
  */
 void synchronize_irq(unsigned int irq)
 {
 	struct irq_desc *desc = irq_to_desc(irq);
 
 	if (desc) {
-		__synchronize_hardirq(desc);
+		__synchronize_hardirq(desc, true);
 		/*
 		 * We made sure that no hardirq handler is
 		 * running. Now verify that no threaded handlers are
@@ -1650,8 +1674,12 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 
 	unregister_handler_proc(irq, action);
 
-	/* Make sure it's not being used on another CPU: */
-	synchronize_hardirq(irq);
+	/*
+	 * Make sure it's not being used on another CPU and if the chip
+	 * supports it also make sure that there is no (not yet serviced)
+	 * interrupt in flight at the hardware level.
+	 */
+	__synchronize_hardirq(desc, true);
 
 #ifdef CONFIG_DEBUG_SHIRQ
 	/*
@@ -2184,6 +2212,28 @@ int __request_percpu_irq(unsigned int irq, irq_handler_t handler,
 }
 EXPORT_SYMBOL_GPL(__request_percpu_irq);
 
+int __irq_get_irqchip_state(struct irq_data *data, enum irqchip_irq_state which,
+			    bool *state)
+{
+	struct irq_chip *chip;
+	int err = -EINVAL;
+
+	do {
+		chip = irq_data_get_irq_chip(data);
+		if (chip->irq_get_irqchip_state)
+			break;
+#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
+		data = data->parent_data;
+#else
+		data = NULL;
+#endif
+	} while (data);
+
+	if (data)
+		err = chip->irq_get_irqchip_state(data, which, state);
+	return err;
+}
+
 /**
  *	irq_get_irqchip_state - returns the irqchip state of a interrupt.
  *	@irq: Interrupt line that is forwarded to a VM
@@ -2202,7 +2252,6 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which,
 {
 	struct irq_desc *desc;
 	struct irq_data *data;
-	struct irq_chip *chip;
 	unsigned long flags;
 	int err = -EINVAL;
 
@@ -2212,19 +2261,7 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which,
 
 	data = irq_desc_get_irq_data(desc);
 
-	do {
-		chip = irq_data_get_irq_chip(data);
-		if (chip->irq_get_irqchip_state)
-			break;
-#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
-		data = data->parent_data;
-#else
-		data = NULL;
-#endif
-	} while (data);
-
-	if (data)
-		err = chip->irq_get_irqchip_state(data, which, state);
+	err = __irq_get_irqchip_state(data, which, state);
 
 	irq_put_desc_busunlock(desc, flags);
 	return err;
-- 
GitLab


From 7897f5a443fb8a1277911aa0356f78d3940c6c39 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 28 Jun 2019 13:11:52 +0200
Subject: [PATCH 0755/1835] x86/ioapic: Implement irq_get_irqchip_state()
 callback

commit dfe0cf8b51b07e56ded571e3de0a4a9382517231 upstream

When an interrupt is shut down in free_irq() there might be an inflight
interrupt pending in the IO-APIC remote IRR which is not yet serviced. That
means the interrupt has been sent to the target CPUs local APIC, but the
target CPU is in a state which delays the servicing.

So free_irq() would proceed to free resources and to clear the vector
because synchronize_hardirq() does not see an interrupt handler in
progress.

That can trigger a spurious interrupt warning, which is harmless and just
confuses users, but it also can leave the remote IRR in a stale state
because once the handler is invoked the interrupt resources might be freed
already and therefore acknowledgement is not possible anymore.

Implement the irq_get_irqchip_state() callback for the IO-APIC irq chip. The
callback is invoked from free_irq() via __synchronize_hardirq(). Check the
remote IRR bit of the interrupt and return 'in flight' if it is set and the
interrupt is configured in level mode. For edge mode the remote IRR has no
meaning.

As this is only meaningful for level triggered interrupts this won't cure
the potential spurious interrupt warning for edge triggered interrupts, but
the edge trigger case does not result in stale hardware state. This has to
be addressed at the vector/interrupt entry level seperately.

Fixes: 464d12309e1b ("x86/vector: Switch IOAPIC to global reservation mode")
Reported-by: Robert Hodaszi <Robert.Hodaszi@digi.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Link: https://lkml.kernel.org/r/20190628111440.370295517@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/apic/io_apic.c | 46 ++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index ff0d14cd9e827..4077e309e5c4c 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1891,6 +1891,50 @@ static int ioapic_set_affinity(struct irq_data *irq_data,
 	return ret;
 }
 
+/*
+ * Interrupt shutdown masks the ioapic pin, but the interrupt might already
+ * be in flight, but not yet serviced by the target CPU. That means
+ * __synchronize_hardirq() would return and claim that everything is calmed
+ * down. So free_irq() would proceed and deactivate the interrupt and free
+ * resources.
+ *
+ * Once the target CPU comes around to service it it will find a cleared
+ * vector and complain. While the spurious interrupt is harmless, the full
+ * release of resources might prevent the interrupt from being acknowledged
+ * which keeps the hardware in a weird state.
+ *
+ * Verify that the corresponding Remote-IRR bits are clear.
+ */
+static int ioapic_irq_get_chip_state(struct irq_data *irqd,
+				   enum irqchip_irq_state which,
+				   bool *state)
+{
+	struct mp_chip_data *mcd = irqd->chip_data;
+	struct IO_APIC_route_entry rentry;
+	struct irq_pin_list *p;
+
+	if (which != IRQCHIP_STATE_ACTIVE)
+		return -EINVAL;
+
+	*state = false;
+	raw_spin_lock(&ioapic_lock);
+	for_each_irq_pin(p, mcd->irq_2_pin) {
+		rentry = __ioapic_read_entry(p->apic, p->pin);
+		/*
+		 * The remote IRR is only valid in level trigger mode. It's
+		 * meaning is undefined for edge triggered interrupts and
+		 * irrelevant because the IO-APIC treats them as fire and
+		 * forget.
+		 */
+		if (rentry.irr && rentry.trigger) {
+			*state = true;
+			break;
+		}
+	}
+	raw_spin_unlock(&ioapic_lock);
+	return 0;
+}
+
 static struct irq_chip ioapic_chip __read_mostly = {
 	.name			= "IO-APIC",
 	.irq_startup		= startup_ioapic_irq,
@@ -1900,6 +1944,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
 	.irq_eoi		= ioapic_ack_level,
 	.irq_set_affinity	= ioapic_set_affinity,
 	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+	.irq_get_irqchip_state	= ioapic_irq_get_chip_state,
 	.flags			= IRQCHIP_SKIP_SET_WAKE,
 };
 
@@ -1912,6 +1957,7 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
 	.irq_eoi		= ioapic_ir_ack_level,
 	.irq_set_affinity	= ioapic_set_affinity,
 	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+	.irq_get_irqchip_state	= ioapic_irq_get_chip_state,
 	.flags			= IRQCHIP_SKIP_SET_WAKE,
 };
 
-- 
GitLab


From 9494cd3928859a997bf79510d061e7dac5780d0a Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 28 Jun 2019 13:11:53 +0200
Subject: [PATCH 0756/1835] x86/irq: Handle spurious interrupt after shutdown
 gracefully

commit b7107a67f0d125459fe41f86e8079afd1a5e0b15 upstream

Since the rework of the vector management, warnings about spurious
interrupts have been reported. Robert provided some more information and
did an initial analysis. The following situation leads to these warnings:

   CPU 0                  CPU 1               IO_APIC

                                              interrupt is raised
                                              sent to CPU1
			  Unable to handle
			  immediately
			  (interrupts off,
			   deep idle delay)
   mask()
   ...
   free()
     shutdown()
     synchronize_irq()
     clear_vector()
                          do_IRQ()
                            -> vector is clear

Before the rework the vector entries of legacy interrupts were statically
assigned and occupied precious vector space while most of them were
unused. Due to that the above situation was handled silently because the
vector was handled and the core handler of the assigned interrupt
descriptor noticed that it is shut down and returned.

While this has been usually observed with legacy interrupts, this situation
is not limited to them. Any other interrupt source, e.g. MSI, can cause the
same issue.

After adding proper synchronization for level triggered interrupts, this
can only happen for edge triggered interrupts where the IO-APIC obviously
cannot provide information about interrupts in flight.

While the spurious warning is actually harmless in this case it worries
users and driver developers.

Handle it gracefully by marking the vector entry as VECTOR_SHUTDOWN instead
of VECTOR_UNUSED when the vector is freed up.

If that above late handling happens the spurious detector will not complain
and switch the entry to VECTOR_UNUSED. Any subsequent spurious interrupt on
that line will trigger the spurious warning as before.

Fixes: 464d12309e1b ("x86/vector: Switch IOAPIC to global reservation mode")
Reported-by: Robert Hodaszi <Robert.Hodaszi@digi.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>-
Tested-by: Robert Hodaszi <Robert.Hodaszi@digi.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Link: https://lkml.kernel.org/r/20190628111440.459647741@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/hw_irq.h | 3 ++-
 arch/x86/kernel/apic/vector.c | 4 ++--
 arch/x86/kernel/irq.c         | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index 32e666e1231e7..626e1ac6516ee 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -151,7 +151,8 @@ extern char irq_entries_start[];
 #endif
 
 #define VECTOR_UNUSED		NULL
-#define VECTOR_RETRIGGERED	((void *)~0UL)
+#define VECTOR_SHUTDOWN		((void *)~0UL)
+#define VECTOR_RETRIGGERED	((void *)~1UL)
 
 typedef struct irq_desc* vector_irq_t[NR_VECTORS];
 DECLARE_PER_CPU(vector_irq_t, vector_irq);
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 652e7ffa9b9de..10e1d17aa0608 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -342,7 +342,7 @@ static void clear_irq_vector(struct irq_data *irqd)
 	trace_vector_clear(irqd->irq, vector, apicd->cpu, apicd->prev_vector,
 			   apicd->prev_cpu);
 
-	per_cpu(vector_irq, apicd->cpu)[vector] = VECTOR_UNUSED;
+	per_cpu(vector_irq, apicd->cpu)[vector] = VECTOR_SHUTDOWN;
 	irq_matrix_free(vector_matrix, apicd->cpu, vector, managed);
 	apicd->vector = 0;
 
@@ -351,7 +351,7 @@ static void clear_irq_vector(struct irq_data *irqd)
 	if (!vector)
 		return;
 
-	per_cpu(vector_irq, apicd->prev_cpu)[vector] = VECTOR_UNUSED;
+	per_cpu(vector_irq, apicd->prev_cpu)[vector] = VECTOR_SHUTDOWN;
 	irq_matrix_free(vector_matrix, apicd->prev_cpu, vector, managed);
 	apicd->prev_vector = 0;
 	apicd->move_in_progress = 0;
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 59b5f2ea7c2f3..a975246074b5c 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -246,7 +246,7 @@ __visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
 	if (!handle_irq(desc, regs)) {
 		ack_APIC_irq();
 
-		if (desc != VECTOR_RETRIGGERED) {
+		if (desc != VECTOR_RETRIGGERED && desc != VECTOR_SHUTDOWN) {
 			pr_emerg_ratelimited("%s: %d.%d No irq handler for vector\n",
 					     __func__, smp_processor_id(),
 					     vector);
-- 
GitLab


From fc6975ee932b38992e5932e88cb3bb6790a09740 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 28 Jun 2019 13:11:54 +0200
Subject: [PATCH 0757/1835] x86/irq: Seperate unused system vectors from
 spurious entry again

commit f8a8fe61fec8006575699559ead88b0b833d5cad upstream

Quite some time ago the interrupt entry stubs for unused vectors in the
system vector range got removed and directly mapped to the spurious
interrupt vector entry point.

Sounds reasonable, but it's subtly broken. The spurious interrupt vector
entry point pushes vector number 0xFF on the stack which makes the whole
logic in __smp_spurious_interrupt() pointless.

As a consequence any spurious interrupt which comes from a vector != 0xFF
is treated as a real spurious interrupt (vector 0xFF) and not
acknowledged. That subsequently stalls all interrupt vectors of equal and
lower priority, which brings the system to a grinding halt.

This can happen because even on 64-bit the system vector space is not
guaranteed to be fully populated. A full compile time handling of the
unused vectors is not possible because quite some of them are conditonally
populated at runtime.

Bring the entry stubs back, which wastes 160 bytes if all stubs are unused,
but gains the proper handling back. There is no point to selectively spare
some of the stubs which are known at compile time as the required code in
the IDT management would be way larger and convoluted.

Do not route the spurious entries through common_interrupt and do_IRQ() as
the original code did. Route it to smp_spurious_interrupt() which evaluates
the vector number and acts accordingly now that the real vector numbers are
handed in.

Fixup the pr_warn so the actual spurious vector (0xff) is clearly
distiguished from the other vectors and also note for the vectored case
whether it was pending in the ISR or not.

 "Spurious APIC interrupt (vector 0xFF) on CPU#0, should never happen."
 "Spurious interrupt vector 0xed on CPU#1. Acked."
 "Spurious interrupt vector 0xee on CPU#1. Not pending!."

Fixes: 2414e021ac8d ("x86: Avoid building unused IRQ entry stubs")
Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Jan Beulich <jbeulich@suse.com>
Link: https://lkml.kernel.org/r/20190628111440.550568228@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/entry/entry_32.S     | 24 ++++++++++++++++++++++++
 arch/x86/entry/entry_64.S     | 30 ++++++++++++++++++++++++++----
 arch/x86/include/asm/hw_irq.h |  2 ++
 arch/x86/kernel/apic/apic.c   | 33 ++++++++++++++++++++++-----------
 arch/x86/kernel/idt.c         |  3 ++-
 5 files changed, 76 insertions(+), 16 deletions(-)

diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index b5c2b1091b18d..d7b64c8d19078 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -1098,6 +1098,30 @@ ENTRY(irq_entries_start)
     .endr
 END(irq_entries_start)
 
+#ifdef CONFIG_X86_LOCAL_APIC
+	.align 8
+ENTRY(spurious_entries_start)
+    vector=FIRST_SYSTEM_VECTOR
+    .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
+	pushl	$(~vector+0x80)			/* Note: always in signed byte range */
+    vector=vector+1
+	jmp	common_spurious
+	.align	8
+    .endr
+END(spurious_entries_start)
+
+common_spurious:
+	ASM_CLAC
+	addl	$-0x80, (%esp)			/* Adjust vector into the [-256, -1] range */
+	SAVE_ALL switch_stacks=1
+	ENCODE_FRAME_POINTER
+	TRACE_IRQS_OFF
+	movl	%esp, %eax
+	call	smp_spurious_interrupt
+	jmp	ret_from_intr
+ENDPROC(common_interrupt)
+#endif
+
 /*
  * the CPU automatically disables interrupts when executing an IRQ vector,
  * so IRQ-flags tracing has to follow that:
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index c90e00db5c13c..206df099950ea 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -438,6 +438,18 @@ ENTRY(irq_entries_start)
     .endr
 END(irq_entries_start)
 
+	.align 8
+ENTRY(spurious_entries_start)
+    vector=FIRST_SYSTEM_VECTOR
+    .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
+	UNWIND_HINT_IRET_REGS
+	pushq	$(~vector+0x80)			/* Note: always in signed byte range */
+	jmp	common_spurious
+	.align	8
+	vector=vector+1
+    .endr
+END(spurious_entries_start)
+
 .macro DEBUG_ENTRY_ASSERT_IRQS_OFF
 #ifdef CONFIG_DEBUG_ENTRY
 	pushq %rax
@@ -634,10 +646,20 @@ _ASM_NOKPROBE(interrupt_entry)
 
 /* Interrupt entry/exit. */
 
-	/*
-	 * The interrupt stubs push (~vector+0x80) onto the stack and
-	 * then jump to common_interrupt.
-	 */
+/*
+ * The interrupt stubs push (~vector+0x80) onto the stack and
+ * then jump to common_spurious/interrupt.
+ */
+common_spurious:
+	addq	$-0x80, (%rsp)			/* Adjust vector to [-256, -1] range */
+	call	interrupt_entry
+	UNWIND_HINT_REGS indirect=1
+	call	smp_spurious_interrupt		/* rdi points to pt_regs */
+	jmp	ret_from_intr
+END(common_spurious)
+_ASM_NOKPROBE(common_spurious)
+
+/* common_interrupt is a hotpath. Align it */
 	.p2align CONFIG_X86_L1_CACHE_SHIFT
 common_interrupt:
 	addq	$-0x80, (%rsp)			/* Adjust vector to [-256, -1] range */
diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index 626e1ac6516ee..cbd97e22d2f31 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -150,6 +150,8 @@ extern char irq_entries_start[];
 #define trace_irq_entries_start irq_entries_start
 #endif
 
+extern char spurious_entries_start[];
+
 #define VECTOR_UNUSED		NULL
 #define VECTOR_SHUTDOWN		((void *)~0UL)
 #define VECTOR_RETRIGGERED	((void *)~1UL)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 2646234380cc0..02020f2e00809 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -2027,21 +2027,32 @@ __visible void __irq_entry smp_spurious_interrupt(struct pt_regs *regs)
 	entering_irq();
 	trace_spurious_apic_entry(vector);
 
+	inc_irq_stat(irq_spurious_count);
+
+	/*
+	 * If this is a spurious interrupt then do not acknowledge
+	 */
+	if (vector == SPURIOUS_APIC_VECTOR) {
+		/* See SDM vol 3 */
+		pr_info("Spurious APIC interrupt (vector 0xFF) on CPU#%d, should never happen.\n",
+			smp_processor_id());
+		goto out;
+	}
+
 	/*
-	 * Check if this really is a spurious interrupt and ACK it
-	 * if it is a vectored one.  Just in case...
-	 * Spurious interrupts should not be ACKed.
+	 * If it is a vectored one, verify it's set in the ISR. If set,
+	 * acknowledge it.
 	 */
 	v = apic_read(APIC_ISR + ((vector & ~0x1f) >> 1));
-	if (v & (1 << (vector & 0x1f)))
+	if (v & (1 << (vector & 0x1f))) {
+		pr_info("Spurious interrupt (vector 0x%02x) on CPU#%d. Acked\n",
+			vector, smp_processor_id());
 		ack_APIC_irq();
-
-	inc_irq_stat(irq_spurious_count);
-
-	/* see sw-dev-man vol 3, chapter 7.4.13.5 */
-	pr_info("spurious APIC interrupt through vector %02x on CPU#%d, "
-		"should never happen.\n", vector, smp_processor_id());
-
+	} else {
+		pr_info("Spurious interrupt (vector 0x%02x) on CPU#%d. Not pending!\n",
+			vector, smp_processor_id());
+	}
+out:
 	trace_spurious_apic_exit(vector);
 	exiting_irq();
 }
diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
index 01adea278a710..a7e0e975043fd 100644
--- a/arch/x86/kernel/idt.c
+++ b/arch/x86/kernel/idt.c
@@ -321,7 +321,8 @@ void __init idt_setup_apic_and_irq_gates(void)
 #ifdef CONFIG_X86_LOCAL_APIC
 	for_each_clear_bit_from(i, system_vectors, NR_VECTORS) {
 		set_bit(i, system_vectors);
-		set_intr_gate(i, spurious_interrupt);
+		entry = spurious_entries_start + 8 * (i - FIRST_SYSTEM_VECTOR);
+		set_intr_gate(i, entry);
 	}
 #endif
 }
-- 
GitLab


From 9db915738e40b6957882eef4d32a9a7f039f1bb9 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 3 Jul 2019 15:39:25 +0200
Subject: [PATCH 0758/1835] ARC: hide unused function unw_hdr_alloc

commit fd5de2721ea7d16e2b16c4049ac49f229551b290 upstream.

As kernelci.org reports, this function is not used in
vdk_hs38_defconfig:

arch/arc/kernel/unwind.c:188:14: warning: 'unw_hdr_alloc' defined but not used [-Wunused-function]

Fixes: bc79c9a72165 ("ARC: dw2 unwind: Reinstante unwinding out of modules")
Link: https://kernelci.org/build/id/5d1cae3f59b514300340c132/logs/
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/kernel/unwind.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 183391d4d33a4..9cf2ee8b43493 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -185,11 +185,6 @@ static void *__init unw_hdr_alloc_early(unsigned long sz)
 				       MAX_DMA_ADDRESS);
 }
 
-static void *unw_hdr_alloc(unsigned long sz)
-{
-	return kmalloc(sz, GFP_KERNEL);
-}
-
 static void init_unwind_table(struct unwind_table *table, const char *name,
 			      const void *core_start, unsigned long core_size,
 			      const void *init_start, unsigned long init_size,
@@ -370,6 +365,10 @@ ret_err:
 }
 
 #ifdef CONFIG_MODULES
+static void *unw_hdr_alloc(unsigned long sz)
+{
+	return kmalloc(sz, GFP_KERNEL);
+}
 
 static struct unwind_table *last_table;
 
-- 
GitLab


From 02eb533e940aaefb587ac30d4276eaa323a50dbe Mon Sep 17 00:00:00 2001
From: Heiko Carstens <heiko.carstens@de.ibm.com>
Date: Mon, 17 Jun 2019 14:02:41 +0200
Subject: [PATCH 0759/1835] s390: fix stfle zero padding

commit 4f18d869ffd056c7858f3d617c71345cf19be008 upstream.

The stfle inline assembly returns the number of double words written
(condition code 0) or the double words it would have written
(condition code 3), if the memory array it got as parameter would have
been large enough.

The current stfle implementation assumes that the array is always
large enough and clears those parts of the array that have not been
written to with a subsequent memset call.

If however the array is not large enough memset will get a negative
length parameter, which means that memset clears memory until it gets
an exception and the kernel crashes.

To fix this simply limit the maximum length. Move also the inline
assembly to an extra function to avoid clobbering of register 0, which
might happen because of the added min_t invocation together with code
instrumentation.

The bug was introduced with commit 14375bc4eb8d ("[S390] cleanup
facility list handling") but was rather harmless, since it would only
write to a rather large array. It became a potential problem with
commit 3ab121ab1866 ("[S390] kernel: Add z/VM LGR detection"). Since
then it writes to an array with only four double words, while some
machines already deliver three double words. As soon as machines have
a facility bit within the fifth double a crash on IPL would happen.

Fixes: 14375bc4eb8d ("[S390] cleanup facility list handling")
Cc: <stable@vger.kernel.org> # v2.6.37+
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/facility.h | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
index 99c8ce30b3cd1..7ffbc5d7ccf38 100644
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@@ -59,6 +59,18 @@ static inline int test_facility(unsigned long nr)
 	return __test_facility(nr, &S390_lowcore.stfle_fac_list);
 }
 
+static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
+{
+	register unsigned long reg0 asm("0") = size - 1;
+
+	asm volatile(
+		".insn s,0xb2b00000,0(%1)" /* stfle */
+		: "+d" (reg0)
+		: "a" (stfle_fac_list)
+		: "memory", "cc");
+	return reg0;
+}
+
 /**
  * stfle - Store facility list extended
  * @stfle_fac_list: array where facility list can be stored
@@ -76,13 +88,8 @@ static inline void stfle(u64 *stfle_fac_list, int size)
 	memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4);
 	if (S390_lowcore.stfl_fac_list & 0x01000000) {
 		/* More facility bits available with stfle */
-		register unsigned long reg0 asm("0") = size - 1;
-
-		asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
-			     : "+d" (reg0)
-			     : "a" (stfle_fac_list)
-			     : "memory", "cc");
-		nr = (reg0 + 1) * 8; /* # bytes stored by stfle */
+		nr = __stfle_asm(stfle_fac_list, size);
+		nr = min_t(unsigned long, (nr + 1) * 8, size * 8);
 	}
 	memset((char *) stfle_fac_list + nr, 0, size * 8 - nr);
 	preempt_enable();
-- 
GitLab


From b1d52630b12a0913c549c4b3b8d2e783d59efec2 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Tue, 18 Jun 2019 11:25:59 +0200
Subject: [PATCH 0760/1835] s390/qdio: (re-)initialize tiqdio list entries

commit e54e4785cb5cb4896cf4285964aeef2125612fb2 upstream.

When tiqdio_remove_input_queues() removes a queue from the tiq_list as
part of qdio_shutdown(), it doesn't re-initialize the queue's list entry
and the prev/next pointers go stale.

If a subsequent qdio_establish() fails while sending the ESTABLISH cmd,
it calls qdio_shutdown() again in QDIO_IRQ_STATE_ERR state and
tiqdio_remove_input_queues() will attempt to remove the queue entry a
second time. This dereferences the stale pointers, and bad things ensue.
Fix this by re-initializing the list entry after removing it from the
list.

For good practice also initialize the list entry when the queue is first
allocated, and remove the quirky checks that papered over this omission.
Note that prior to
commit e521813468f7 ("s390/qdio: fix access to uninitialized qdio_q fields"),
these checks were bogus anyway.

setup_queues_misc() clears the whole queue struct, and thus needs to
re-init the prev/next pointers as well.

Fixes: 779e6e1c724d ("[S390] qdio: new qdio driver.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/qdio_setup.c   | 2 ++
 drivers/s390/cio/qdio_thinint.c | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 78f1be41b05e3..034528a5453ec 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -151,6 +151,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues)
 			return -ENOMEM;
 		}
 		irq_ptr_qs[i] = q;
+		INIT_LIST_HEAD(&q->entry);
 	}
 	return 0;
 }
@@ -179,6 +180,7 @@ static void setup_queues_misc(struct qdio_q *q, struct qdio_irq *irq_ptr,
 	q->mask = 1 << (31 - i);
 	q->nr = i;
 	q->handler = handler;
+	INIT_LIST_HEAD(&q->entry);
 }
 
 static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr,
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 07dea602205bd..6d1c1bc9ae73a 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -87,14 +87,14 @@ void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
 	struct qdio_q *q;
 
 	q = irq_ptr->input_qs[0];
-	/* if establish triggered an error */
-	if (!q || !q->entry.prev || !q->entry.next)
+	if (!q)
 		return;
 
 	mutex_lock(&tiq_list_lock);
 	list_del_rcu(&q->entry);
 	mutex_unlock(&tiq_list_lock);
 	synchronize_rcu();
+	INIT_LIST_HEAD(&q->entry);
 }
 
 static inline int has_multiple_inq_on_dsci(struct qdio_irq *irq_ptr)
-- 
GitLab


From b578b87bcab687984fe23774d0abc70889284895 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Tue, 18 Jun 2019 13:12:20 +0200
Subject: [PATCH 0761/1835] s390/qdio: don't touch the dsci in
 tiqdio_add_input_queues()

commit ac6639cd3db607d386616487902b4cc1850a7be5 upstream.

Current code sets the dsci to 0x00000080. Which doesn't make any sense,
as the indicator area is located in the _left-most_ byte.

Worse: if the dsci is the _shared_ indicator, this potentially clears
the indication of activity for a _different_ device.
tiqdio_thinint_handler() will then have no reason to call that device's
IRQ handler, and the device ends up stalling.

Fixes: d0c9d4a89fff ("[S390] qdio: set correct bit in dsci")
Cc: <stable@vger.kernel.org>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/qdio_thinint.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 6d1c1bc9ae73a..6628e0c9e70e3 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -79,7 +79,6 @@ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr)
 	mutex_lock(&tiq_list_lock);
 	list_add_rcu(&irq_ptr->input_qs[0]->entry, &tiq_list);
 	mutex_unlock(&tiq_list_lock);
-	xchg(irq_ptr->dsci, 1 << 7);
 }
 
 void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
-- 
GitLab


From ff1ce8ef1f88fb6ea9df1d811119ee2bbf271a40 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Mon, 24 Jun 2019 07:20:15 +0000
Subject: [PATCH 0762/1835] crypto: talitos - move struct talitos_edesc into
 talitos.h

commit d44769e4ccb636e8238adbc151f25467a536711b upstream.

Moves struct talitos_edesc into talitos.h so that it can be used
from any place in talitos.c

It will be required for next patch ("crypto: talitos - fix hash
on SEC1")

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/talitos.c | 30 ------------------------------
 drivers/crypto/talitos.h | 30 ++++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index c5859d3cb8254..4096f0f3e41b8 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -913,36 +913,6 @@ badkey:
 	return -EINVAL;
 }
 
-/*
- * talitos_edesc - s/w-extended descriptor
- * @src_nents: number of segments in input scatterlist
- * @dst_nents: number of segments in output scatterlist
- * @icv_ool: whether ICV is out-of-line
- * @iv_dma: dma address of iv for checking continuity and link table
- * @dma_len: length of dma mapped link_tbl space
- * @dma_link_tbl: bus physical address of link_tbl/buf
- * @desc: h/w descriptor
- * @link_tbl: input and output h/w link tables (if {src,dst}_nents > 1) (SEC2)
- * @buf: input and output buffeur (if {src,dst}_nents > 1) (SEC1)
- *
- * if decrypting (with authcheck), or either one of src_nents or dst_nents
- * is greater than 1, an integrity check value is concatenated to the end
- * of link_tbl data
- */
-struct talitos_edesc {
-	int src_nents;
-	int dst_nents;
-	bool icv_ool;
-	dma_addr_t iv_dma;
-	int dma_len;
-	dma_addr_t dma_link_tbl;
-	struct talitos_desc desc;
-	union {
-		struct talitos_ptr link_tbl[0];
-		u8 buf[0];
-	};
-};
-
 static void talitos_sg_unmap(struct device *dev,
 			     struct talitos_edesc *edesc,
 			     struct scatterlist *src,
diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
index a65a63e0d6c10..979f6a61e545f 100644
--- a/drivers/crypto/talitos.h
+++ b/drivers/crypto/talitos.h
@@ -65,6 +65,36 @@ struct talitos_desc {
 
 #define TALITOS_DESC_SIZE	(sizeof(struct talitos_desc) - sizeof(__be32))
 
+/*
+ * talitos_edesc - s/w-extended descriptor
+ * @src_nents: number of segments in input scatterlist
+ * @dst_nents: number of segments in output scatterlist
+ * @icv_ool: whether ICV is out-of-line
+ * @iv_dma: dma address of iv for checking continuity and link table
+ * @dma_len: length of dma mapped link_tbl space
+ * @dma_link_tbl: bus physical address of link_tbl/buf
+ * @desc: h/w descriptor
+ * @link_tbl: input and output h/w link tables (if {src,dst}_nents > 1) (SEC2)
+ * @buf: input and output buffeur (if {src,dst}_nents > 1) (SEC1)
+ *
+ * if decrypting (with authcheck), or either one of src_nents or dst_nents
+ * is greater than 1, an integrity check value is concatenated to the end
+ * of link_tbl data
+ */
+struct talitos_edesc {
+	int src_nents;
+	int dst_nents;
+	bool icv_ool;
+	dma_addr_t iv_dma;
+	int dma_len;
+	dma_addr_t dma_link_tbl;
+	struct talitos_desc desc;
+	union {
+		struct talitos_ptr link_tbl[0];
+		u8 buf[0];
+	};
+};
+
 /**
  * talitos_request - descriptor submission request
  * @desc: descriptor pointer (kernel virtual)
-- 
GitLab


From b24c6403633d416b463eb90138f6a02aa9f591d0 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Mon, 24 Jun 2019 07:20:16 +0000
Subject: [PATCH 0763/1835] crypto: talitos - fix hash on SEC1.

commit 58cdbc6d2263beb36954408522762bbe73169306 upstream.

On SEC1, hash provides wrong result when performing hashing in several
steps with input data SG list has more than one element. This was
detected with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS:

[   44.185947] alg: hash: md5-talitos test failed (wrong result) on test vector 6, cfg="random: may_sleep use_finup src_divs=[<reimport>25.88%@+8063, <flush>24.19%@+9588, 28.63%@+16333, <reimport>4.60%@+6756, 16.70%@+16281] dst_divs=[71.61%@alignmask+16361, 14.36%@+7756, 14.3%@+"
[   44.325122] alg: hash: sha1-talitos test failed (wrong result) on test vector 3, cfg="random: inplace use_final src_divs=[<flush,nosimd>16.56%@+16378, <reimport>52.0%@+16329, 21.42%@alignmask+16380, 10.2%@alignmask+16380] iv_offset=39"
[   44.493500] alg: hash: sha224-talitos test failed (wrong result) on test vector 4, cfg="random: use_final nosimd src_divs=[<reimport>52.27%@+7401, <reimport>17.34%@+16285, <flush>17.71%@+26, 12.68%@+10644] iv_offset=43"
[   44.673262] alg: hash: sha256-talitos test failed (wrong result) on test vector 4, cfg="random: may_sleep use_finup src_divs=[<reimport>60.6%@+12790, 17.86%@+1329, <reimport>12.64%@alignmask+16300, 8.29%@+15, 0.40%@+13506, <reimport>0.51%@+16322, <reimport>0.24%@+16339] dst_divs"

This is due to two issues:
- We have an overlap between the buffer used for copying the input
data (SEC1 doesn't do scatter/gather) and the chained descriptor.
- Data copy is wrong when the previous hash left less than one
blocksize of data to hash, implying a complement of the previous
block with a few bytes from the new request.

Fix it by:
- Moving the second descriptor after the buffer, as moving the buffer
after the descriptor would make it more complex for other cipher
operations (AEAD, ABLKCIPHER)
- Skip the bytes taken from the new request to complete the previous
one by moving the SG list forward.

Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/talitos.c | 69 ++++++++++++++++++++++++----------------
 1 file changed, 41 insertions(+), 28 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 4096f0f3e41b8..5849075d54c7c 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -334,6 +334,21 @@ int talitos_submit(struct device *dev, int ch, struct talitos_desc *desc,
 }
 EXPORT_SYMBOL(talitos_submit);
 
+static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1)
+{
+	struct talitos_edesc *edesc;
+
+	if (!is_sec1)
+		return request->desc->hdr;
+
+	if (!request->desc->next_desc)
+		return request->desc->hdr1;
+
+	edesc = container_of(request->desc, struct talitos_edesc, desc);
+
+	return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1;
+}
+
 /*
  * process what was done, notify callback of error if not
  */
@@ -355,12 +370,7 @@ static void flush_channel(struct device *dev, int ch, int error, int reset_ch)
 
 		/* descriptors with their done bits set don't get the error */
 		rmb();
-		if (!is_sec1)
-			hdr = request->desc->hdr;
-		else if (request->desc->next_desc)
-			hdr = (request->desc + 1)->hdr1;
-		else
-			hdr = request->desc->hdr1;
+		hdr = get_request_hdr(request, is_sec1);
 
 		if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE)
 			status = 0;
@@ -490,8 +500,14 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 		}
 	}
 
-	if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc)
-		return (priv->chan[ch].fifo[iter].desc + 1)->hdr;
+	if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
+		struct talitos_edesc *edesc;
+
+		edesc = container_of(priv->chan[ch].fifo[iter].desc,
+				     struct talitos_edesc, desc);
+		return ((struct talitos_desc *)
+			(edesc->buf + edesc->dma_len))->hdr;
+	}
 
 	return priv->chan[ch].fifo[iter].desc->hdr;
 }
@@ -1401,15 +1417,11 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 	edesc->dst_nents = dst_nents;
 	edesc->iv_dma = iv_dma;
 	edesc->dma_len = dma_len;
-	if (dma_len) {
-		void *addr = &edesc->link_tbl[0];
-
-		if (is_sec1 && !dst)
-			addr += sizeof(struct talitos_desc);
-		edesc->dma_link_tbl = dma_map_single(dev, addr,
+	if (dma_len)
+		edesc->dma_link_tbl = dma_map_single(dev, &edesc->link_tbl[0],
 						     edesc->dma_len,
 						     DMA_BIDIRECTIONAL);
-	}
+
 	return edesc;
 }
 
@@ -1676,14 +1688,16 @@ static void common_nonsnoop_hash_unmap(struct device *dev,
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	bool is_sec1 = has_ftr_sec1(priv);
 	struct talitos_desc *desc = &edesc->desc;
-	struct talitos_desc *desc2 = desc + 1;
+	struct talitos_desc *desc2 = (struct talitos_desc *)
+				     (edesc->buf + edesc->dma_len);
 
 	unmap_single_talitos_ptr(dev, &edesc->desc.ptr[5], DMA_FROM_DEVICE);
 	if (desc->next_desc &&
 	    desc->ptr[5].ptr != desc2->ptr[5].ptr)
 		unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE);
 
-	talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0);
+	if (req_ctx->psrc)
+		talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0);
 
 	/* When using hashctx-in, must unmap it. */
 	if (from_talitos_ptr_len(&edesc->desc.ptr[1], is_sec1))
@@ -1750,7 +1764,6 @@ static void talitos_handle_buggy_hash(struct talitos_ctx *ctx,
 
 static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 				struct ahash_request *areq, unsigned int length,
-				unsigned int offset,
 				void (*callback) (struct device *dev,
 						  struct talitos_desc *desc,
 						  void *context, int error))
@@ -1789,9 +1802,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 
 	sg_count = edesc->src_nents ?: 1;
 	if (is_sec1 && sg_count > 1)
-		sg_pcopy_to_buffer(req_ctx->psrc, sg_count,
-				   edesc->buf + sizeof(struct talitos_desc),
-				   length, req_ctx->nbuf);
+		sg_copy_to_buffer(req_ctx->psrc, sg_count, edesc->buf, length);
 	else if (length)
 		sg_count = dma_map_sg(dev, req_ctx->psrc, sg_count,
 				      DMA_TO_DEVICE);
@@ -1804,7 +1815,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 				       DMA_TO_DEVICE);
 	} else {
 		sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
-					  &desc->ptr[3], sg_count, offset, 0);
+					  &desc->ptr[3], sg_count, 0, 0);
 		if (sg_count > 1)
 			sync_needed = true;
 	}
@@ -1828,7 +1839,8 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 		talitos_handle_buggy_hash(ctx, edesc, &desc->ptr[3]);
 
 	if (is_sec1 && req_ctx->nbuf && length) {
-		struct talitos_desc *desc2 = desc + 1;
+		struct talitos_desc *desc2 = (struct talitos_desc *)
+					     (edesc->buf + edesc->dma_len);
 		dma_addr_t next_desc;
 
 		memset(desc2, 0, sizeof(*desc2));
@@ -1849,7 +1861,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 						      DMA_TO_DEVICE);
 		copy_talitos_ptr(&desc2->ptr[2], &desc->ptr[2], is_sec1);
 		sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
-					  &desc2->ptr[3], sg_count, offset, 0);
+					  &desc2->ptr[3], sg_count, 0, 0);
 		if (sg_count > 1)
 			sync_needed = true;
 		copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1);
@@ -1960,7 +1972,6 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
 	struct device *dev = ctx->dev;
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	bool is_sec1 = has_ftr_sec1(priv);
-	int offset = 0;
 	u8 *ctx_buf = req_ctx->buf[req_ctx->buf_idx];
 
 	if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) {
@@ -2000,6 +2011,8 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
 			sg_chain(req_ctx->bufsl, 2, areq->src);
 		req_ctx->psrc = req_ctx->bufsl;
 	} else if (is_sec1 && req_ctx->nbuf && req_ctx->nbuf < blocksize) {
+		int offset;
+
 		if (nbytes_to_hash > blocksize)
 			offset = blocksize - req_ctx->nbuf;
 		else
@@ -2012,7 +2025,8 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
 		sg_copy_to_buffer(areq->src, nents,
 				  ctx_buf + req_ctx->nbuf, offset);
 		req_ctx->nbuf += offset;
-		req_ctx->psrc = areq->src;
+		req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, areq->src,
+						 offset);
 	} else
 		req_ctx->psrc = areq->src;
 
@@ -2052,8 +2066,7 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
 	if (ctx->keylen && (req_ctx->first || req_ctx->last))
 		edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
 
-	return common_nonsnoop_hash(edesc, areq, nbytes_to_hash, offset,
-				    ahash_done);
+	return common_nonsnoop_hash(edesc, areq, nbytes_to_hash, ahash_done);
 }
 
 static int ahash_update(struct ahash_request *areq)
-- 
GitLab


From 820b010743ee55efe6cf2613e38672d8ce3e5555 Mon Sep 17 00:00:00 2001
From: Haren Myneni <haren@linux.vnet.ibm.com>
Date: Tue, 18 Jun 2019 12:09:22 -0700
Subject: [PATCH 0764/1835] crypto/NX: Set receive window credits to max number
 of CRBs in RxFIFO

commit e52d484d9869eb291140545746ccbe5ffc7c9306 upstream.

System gets checkstop if RxFIFO overruns with more requests than the
maximum possible number of CRBs in FIFO at the same time. The max number
of requests per window is controlled by window credits. So find max
CRBs from FIFO size and set it to receive window credits.

Fixes: b0d6c9bab5e4 ("crypto/nx: Add P9 NX support for 842 compression engine")
CC: stable@vger.kernel.org # v4.14+
Signed-off-by:Haren Myneni <haren@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---
 drivers/crypto/nx/nx-842-powernv.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/nx/nx-842-powernv.c b/drivers/crypto/nx/nx-842-powernv.c
index c68df7e8bee18..7ce2467c771eb 100644
--- a/drivers/crypto/nx/nx-842-powernv.c
+++ b/drivers/crypto/nx/nx-842-powernv.c
@@ -36,8 +36,6 @@ MODULE_ALIAS_CRYPTO("842-nx");
 #define WORKMEM_ALIGN	(CRB_ALIGN)
 #define CSB_WAIT_MAX	(5000) /* ms */
 #define VAS_RETRIES	(10)
-/* # of requests allowed per RxFIFO at a time. 0 for unlimited */
-#define MAX_CREDITS_PER_RXFIFO	(1024)
 
 struct nx842_workmem {
 	/* Below fields must be properly aligned */
@@ -821,7 +819,11 @@ static int __init vas_cfg_coproc_info(struct device_node *dn, int chip_id,
 	rxattr.lnotify_lpid = lpid;
 	rxattr.lnotify_pid = pid;
 	rxattr.lnotify_tid = tid;
-	rxattr.wcreds_max = MAX_CREDITS_PER_RXFIFO;
+	/*
+	 * Maximum RX window credits can not be more than #CRBs in
+	 * RxFIFO. Otherwise, can get checkstop if RxFIFO overruns.
+	 */
+	rxattr.wcreds_max = fifo_size / CRB_SIZE;
 
 	/*
 	 * Open a VAS receice window which is used to configure RxFIFO
-- 
GitLab


From 8f14cf159e9ffe45fe9b66d05a13231f0ed2b43e Mon Sep 17 00:00:00 2001
From: Mark Zhang <markz@nvidia.com>
Date: Mon, 14 Jan 2019 17:32:58 +0800
Subject: [PATCH 0765/1835] regmap-irq: do not write mask register if mask_base
 is zero

commit 7151449fe7fa5962c6153355f9779d6be99e8e97 upstream.

If client have not provided the mask base register then do not
write into the mask register.

Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Jinyoung Park <jinyoungp@nvidia.com>
Signed-off-by: Venkat Reddy Talla <vreddytalla@nvidia.com>
Signed-off-by: Mark Zhang <markz@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/regmap/regmap-irq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 429ca8ed7e518..982c7ac311b85 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -91,6 +91,9 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
 	 * suppress pointless writes.
 	 */
 	for (i = 0; i < d->chip->num_regs; i++) {
+		if (!d->chip->mask_base)
+			continue;
+
 		reg = d->chip->mask_base +
 			(i * map->reg_stride * d->irq_reg_stride);
 		if (d->chip->mask_invert) {
@@ -526,6 +529,9 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
 	/* Mask all the interrupts by default */
 	for (i = 0; i < chip->num_regs; i++) {
 		d->mask_buf[i] = d->mask_buf_def[i];
+		if (!chip->mask_base)
+			continue;
+
 		reg = chip->mask_base +
 			(i * map->reg_stride * d->irq_reg_stride);
 		if (chip->mask_invert)
-- 
GitLab


From cfd99eccede58edcf868240ed0e2d3ec9a2f56ee Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Mon, 15 Jul 2019 12:05:56 -0600
Subject: [PATCH 0766/1835] drm/udl: introduce a macro to convert dev to udl.

commit fd96e0dba19c53c2d66f2a398716bb74df8ca85e upstream.

This just makes it easier to later embed drm into udl.

Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-3-airlied@gmail.com
Signed-off-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/udl/udl_drv.h  |  2 ++
 drivers/gpu/drm/udl/udl_fb.c   | 10 +++++-----
 drivers/gpu/drm/udl/udl_gem.c  |  2 +-
 drivers/gpu/drm/udl/udl_main.c | 12 ++++++------
 4 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index 4ae67d882eae9..b3e08e876d622 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -71,6 +71,8 @@ struct udl_device {
 	atomic_t cpu_kcycles_used; /* transpired during pixel processing */
 };
 
+#define to_udl(x) ((x)->dev_private)
+
 struct udl_gem_object {
 	struct drm_gem_object base;
 	struct page **pages;
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index dd9ffded223b5..590323ea261fb 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -82,7 +82,7 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
 		      int width, int height)
 {
 	struct drm_device *dev = fb->base.dev;
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	int i, ret;
 	char *cmd;
 	cycles_t start_cycles, end_cycles;
@@ -210,7 +210,7 @@ static int udl_fb_open(struct fb_info *info, int user)
 {
 	struct udl_fbdev *ufbdev = info->par;
 	struct drm_device *dev = ufbdev->ufb.base.dev;
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 
 	/* If the USB device is gone, we don't accept new opens */
 	if (drm_dev_is_unplugged(udl->ddev))
@@ -441,7 +441,7 @@ static void udl_fbdev_destroy(struct drm_device *dev,
 
 int udl_fbdev_init(struct drm_device *dev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	int bpp_sel = fb_bpp;
 	struct udl_fbdev *ufbdev;
 	int ret;
@@ -480,7 +480,7 @@ free:
 
 void udl_fbdev_cleanup(struct drm_device *dev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	if (!udl->fbdev)
 		return;
 
@@ -491,7 +491,7 @@ void udl_fbdev_cleanup(struct drm_device *dev)
 
 void udl_fbdev_unplug(struct drm_device *dev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	struct udl_fbdev *ufbdev;
 	if (!udl->fbdev)
 		return;
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index bb7b58407039b..3b3e17652bb20 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -203,7 +203,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev,
 {
 	struct udl_gem_object *gobj;
 	struct drm_gem_object *obj;
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	int ret = 0;
 
 	mutex_lock(&udl->gem_lock);
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 19055dda31409..09ce98113c0eb 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -29,7 +29,7 @@
 static int udl_parse_vendor_descriptor(struct drm_device *dev,
 				       struct usb_device *usbdev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	char *desc;
 	char *buf;
 	char *desc_end;
@@ -165,7 +165,7 @@ void udl_urb_completion(struct urb *urb)
 
 static void udl_free_urb_list(struct drm_device *dev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	int count = udl->urbs.count;
 	struct list_head *node;
 	struct urb_node *unode;
@@ -198,7 +198,7 @@ static void udl_free_urb_list(struct drm_device *dev)
 
 static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	struct urb *urb;
 	struct urb_node *unode;
 	char *buf;
@@ -262,7 +262,7 @@ retry:
 
 struct urb *udl_get_urb(struct drm_device *dev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	int ret = 0;
 	struct list_head *entry;
 	struct urb_node *unode;
@@ -295,7 +295,7 @@ error:
 
 int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 	int ret;
 
 	BUG_ON(len > udl->urbs.size);
@@ -370,7 +370,7 @@ int udl_drop_usb(struct drm_device *dev)
 
 void udl_driver_unload(struct drm_device *dev)
 {
-	struct udl_device *udl = dev->dev_private;
+	struct udl_device *udl = to_udl(dev);
 
 	drm_kms_helper_poll_fini(dev);
 
-- 
GitLab


From af48f7d79faeaa9f426b400c6ec332fe669553e0 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Mon, 15 Jul 2019 12:05:57 -0600
Subject: [PATCH 0767/1835] drm/udl: Replace drm_dev_unref with drm_dev_put

commit ac3b35f11a06964f5fe7f6ea9a190a28a7994704 upstream.

This patch unifies the naming of DRM functions for reference counting
of struct drm_device. The resulting code is more aligned with the rest
of the Linux kernel interfaces.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180926120212.25359-1-tzimmermann@suse.de
Signed-off-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/udl/udl_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 54e767bd5ddb7..bd4f0b88bbd73 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -95,7 +95,7 @@ static int udl_usb_probe(struct usb_interface *interface,
 	return 0;
 
 err_free:
-	drm_dev_unref(dev);
+	drm_dev_put(dev);
 	return r;
 }
 
-- 
GitLab


From 466bdfc6c4d62c7e28e6785c7d2e106a906f7754 Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Mon, 15 Jul 2019 12:05:58 -0600
Subject: [PATCH 0768/1835] drm/udl: move to embedding drm device inside udl
 device.

commit 6ecac85eadb9d4065b9038fa3d3c66d49038e14b upstream.

This should help with some of the lifetime issues, and move us away
from load/unload.

Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-4-airlied@gmail.com
Signed-off-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/udl/udl_drv.c  | 56 +++++++++++++++++++++++++++-------
 drivers/gpu/drm/udl/udl_drv.h  |  9 +++---
 drivers/gpu/drm/udl/udl_fb.c   |  2 +-
 drivers/gpu/drm/udl/udl_main.c | 23 ++------------
 4 files changed, 53 insertions(+), 37 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index bd4f0b88bbd73..f28703db8dbd6 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -47,10 +47,16 @@ static const struct file_operations udl_driver_fops = {
 	.llseek = noop_llseek,
 };
 
+static void udl_driver_release(struct drm_device *dev)
+{
+	udl_fini(dev);
+	udl_modeset_cleanup(dev);
+	drm_dev_fini(dev);
+	kfree(dev);
+}
+
 static struct drm_driver driver = {
 	.driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
-	.load = udl_driver_load,
-	.unload = udl_driver_unload,
 	.release = udl_driver_release,
 
 	/* gem hooks */
@@ -74,28 +80,56 @@ static struct drm_driver driver = {
 	.patchlevel = DRIVER_PATCHLEVEL,
 };
 
+static struct udl_device *udl_driver_create(struct usb_interface *interface)
+{
+	struct usb_device *udev = interface_to_usbdev(interface);
+	struct udl_device *udl;
+	int r;
+
+	udl = kzalloc(sizeof(*udl), GFP_KERNEL);
+	if (!udl)
+		return ERR_PTR(-ENOMEM);
+
+	r = drm_dev_init(&udl->drm, &driver, &interface->dev);
+	if (r) {
+		kfree(udl);
+		return ERR_PTR(r);
+	}
+
+	udl->udev = udev;
+	udl->drm.dev_private = udl;
+
+	r = udl_init(udl);
+	if (r) {
+		drm_dev_fini(&udl->drm);
+		kfree(udl);
+		return ERR_PTR(r);
+	}
+
+	usb_set_intfdata(interface, udl);
+	return udl;
+}
+
 static int udl_usb_probe(struct usb_interface *interface,
 			 const struct usb_device_id *id)
 {
-	struct usb_device *udev = interface_to_usbdev(interface);
-	struct drm_device *dev;
 	int r;
+	struct udl_device *udl;
 
-	dev = drm_dev_alloc(&driver, &interface->dev);
-	if (IS_ERR(dev))
-		return PTR_ERR(dev);
+	udl = udl_driver_create(interface);
+	if (IS_ERR(udl))
+		return PTR_ERR(udl);
 
-	r = drm_dev_register(dev, (unsigned long)udev);
+	r = drm_dev_register(&udl->drm, 0);
 	if (r)
 		goto err_free;
 
-	usb_set_intfdata(interface, dev);
-	DRM_INFO("Initialized udl on minor %d\n", dev->primary->index);
+	DRM_INFO("Initialized udl on minor %d\n", udl->drm.primary->index);
 
 	return 0;
 
 err_free:
-	drm_dev_put(dev);
+	drm_dev_put(&udl->drm);
 	return r;
 }
 
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index b3e08e876d622..35c1f33fbc1a0 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -50,8 +50,8 @@ struct urb_list {
 struct udl_fbdev;
 
 struct udl_device {
+	struct drm_device drm;
 	struct device *dev;
-	struct drm_device *ddev;
 	struct usb_device *udev;
 	struct drm_crtc *crtc;
 
@@ -71,7 +71,7 @@ struct udl_device {
 	atomic_t cpu_kcycles_used; /* transpired during pixel processing */
 };
 
-#define to_udl(x) ((x)->dev_private)
+#define to_udl(x) container_of(x, struct udl_device, drm)
 
 struct udl_gem_object {
 	struct drm_gem_object base;
@@ -104,9 +104,8 @@ struct urb *udl_get_urb(struct drm_device *dev);
 int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len);
 void udl_urb_completion(struct urb *urb);
 
-int udl_driver_load(struct drm_device *dev, unsigned long flags);
-void udl_driver_unload(struct drm_device *dev);
-void udl_driver_release(struct drm_device *dev);
+int udl_init(struct udl_device *udl);
+void udl_fini(struct drm_device *dev);
 
 int udl_fbdev_init(struct drm_device *dev);
 void udl_fbdev_cleanup(struct drm_device *dev);
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index 590323ea261fb..4ab101bf1df01 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -213,7 +213,7 @@ static int udl_fb_open(struct fb_info *info, int user)
 	struct udl_device *udl = to_udl(dev);
 
 	/* If the USB device is gone, we don't accept new opens */
-	if (drm_dev_is_unplugged(udl->ddev))
+	if (drm_dev_is_unplugged(&udl->drm))
 		return -ENODEV;
 
 	ufbdev->fb_count++;
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 09ce98113c0eb..8d22b6cd52412 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -310,20 +310,12 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
 	return ret;
 }
 
-int udl_driver_load(struct drm_device *dev, unsigned long flags)
+int udl_init(struct udl_device *udl)
 {
-	struct usb_device *udev = (void*)flags;
-	struct udl_device *udl;
+	struct drm_device *dev = &udl->drm;
 	int ret = -ENOMEM;
 
 	DRM_DEBUG("\n");
-	udl = kzalloc(sizeof(struct udl_device), GFP_KERNEL);
-	if (!udl)
-		return -ENOMEM;
-
-	udl->udev = udev;
-	udl->ddev = dev;
-	dev->dev_private = udl;
 
 	mutex_init(&udl->gem_lock);
 
@@ -357,7 +349,6 @@ int udl_driver_load(struct drm_device *dev, unsigned long flags)
 err:
 	if (udl->urbs.count)
 		udl_free_urb_list(dev);
-	kfree(udl);
 	DRM_ERROR("%d\n", ret);
 	return ret;
 }
@@ -368,7 +359,7 @@ int udl_drop_usb(struct drm_device *dev)
 	return 0;
 }
 
-void udl_driver_unload(struct drm_device *dev)
+void udl_fini(struct drm_device *dev)
 {
 	struct udl_device *udl = to_udl(dev);
 
@@ -378,12 +369,4 @@ void udl_driver_unload(struct drm_device *dev)
 		udl_free_urb_list(dev);
 
 	udl_fbdev_cleanup(dev);
-	kfree(udl);
-}
-
-void udl_driver_release(struct drm_device *dev)
-{
-	udl_modeset_cleanup(dev);
-	drm_dev_fini(dev);
-	kfree(dev);
 }
-- 
GitLab


From d173ce091c1aab04cf704e73dee6cdd9faafb1ab Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Tue, 9 Jul 2019 08:34:02 +0200
Subject: [PATCH 0769/1835] x86/entry/32: Fix ENDPROC of common_spurious

[ Upstream commit 1cbec37b3f9cff074a67bef4fc34b30a09958a0a ]

common_spurious is currently ENDed erroneously. common_interrupt is used
in its ENDPROC. So fix this mistake.

Found by my asm macros rewrite patchset.

Fixes: f8a8fe61fec8 ("x86/irq: Seperate unused system vectors from spurious entry again")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190709063402.19847-1-jslaby@suse.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/entry/entry_32.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index d7b64c8d19078..8059d4fd915c9 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -1119,7 +1119,7 @@ common_spurious:
 	movl	%esp, %eax
 	call	smp_spurious_interrupt
 	jmp	ret_from_intr
-ENDPROC(common_interrupt)
+ENDPROC(common_spurious)
 #endif
 
 /*
-- 
GitLab


From be9b6782a9eb128a45b4d4fce556f7053234773d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 21 Jul 2019 09:03:18 +0200
Subject: [PATCH 0770/1835] Linux 4.19.60

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 38f2150457fdd..5fb79d493012e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 59
+SUBLEVEL = 60
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From d996dd9b8b6c49660bad02070ead29ae55740181 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 23 Jul 2019 12:55:07 +0100
Subject: [PATCH 0771/1835] overlays: audremap: Support GPIOs 18 & 19

PWM audio can also be used on GPIOs 18 and 19, so add the pins_18_19
parameter to select that location. pins_12_13 explicitly chooses GPIOs
12 and 13, although this is the default behaviour so is there only for
completeness.

See: https://github.com/raspberrypi/firmware/issues/1178

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README               |  4 +++-
 arch/arm/boot/dts/overlays/audremap-overlay.dts | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 568e7117b456b..f03065a7e00ed 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -475,12 +475,14 @@ Params: <None>
 
 
 Name:   audremap
-Info:   Switches PWM sound output to pins 12 (Right) & 13 (Left)
+Info:   Switches PWM sound output to GPIOs on the 40-pin header
 Load:   dtoverlay=audremap,<param>=<val>
 Params: swap_lr                 Reverse the channel allocation, which will also
                                 swap the audio jack outputs (default off)
         enable_jack             Don't switch off the audio jack output
                                 (default off)
+        pins_12_13              Select GPIOs 12 & 13 (default)
+        pins_18_19              Select GPIOs 18 & 19
 
 
 Name:   balena-fin
diff --git a/arch/arm/boot/dts/overlays/audremap-overlay.dts b/arch/arm/boot/dts/overlays/audremap-overlay.dts
index 4a818206a8912..d624bb3a3feaf 100644
--- a/arch/arm/boot/dts/overlays/audremap-overlay.dts
+++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
@@ -7,13 +7,29 @@
         fragment@0 {
                 target = <&audio_pins>;
                 frag0: __overlay__ {
+                };
+        };
+
+	fragment@1 {
+                target = <&audio_pins>;
+                __overlay__ {
                         brcm,pins = < 12 13 >;
                         brcm,function = < 4 >; /* alt0 alt0 */
                 };
         };
 
+	fragment@2 {
+		target = <&audio_pins>;
+		__dormant__ {
+                        brcm,pins = < 18 19 >;
+                        brcm,function = < 2 >; /* alt5 alt5 */
+		};
+	};
+
 	__overrides__ {
 		swap_lr = <&frag0>, "swap_lr?";
 		enable_jack = <&frag0>, "enable_jack?";
+		pins_12_13 = <0>,"+1-2";
+		pins_18_19 = <0>,"-1+2";
 	};
 };
-- 
GitLab


From 5d8307c0c5d1906c749497bfd89e234329f46451 Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Thu, 6 Dec 2018 15:24:35 +0100
Subject: [PATCH 0772/1835] drm/connector: Fix drm_mode_create_tv_properties()
 doc

Commit eda6887f1961e0d2fb866b1a520b2de5b3828de5 upstream.

The in the kernel-doc header did not match the function name.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181206142439.10441-2-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/drm_connector.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 6011d769d50bb..a434c8582dc76 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -1110,7 +1110,7 @@ void drm_hdmi_avi_infoframe_content_type(struct hdmi_avi_infoframe *frame,
 EXPORT_SYMBOL(drm_hdmi_avi_infoframe_content_type);
 
 /**
- * drm_create_tv_properties - create TV specific connector properties
+ * drm_mode_create_tv_properties - create TV specific connector properties
  * @dev: DRM device
  * @num_modes: number of different TV formats (modes) supported
  * @modes: array of pointers to strings containing name of each format
-- 
GitLab


From abdc0a0310dc620ac64448515e10a2b0ca10308c Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Thu, 6 Dec 2018 15:24:36 +0100
Subject: [PATCH 0773/1835] drm/connector: Clarify the unit of TV margins

Commit 56406e15b5e83256151ef74eb1a219cbf13d91c8 upstream.

All margins are expressed in pixels. Clarify that in the doc.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181206142439.10441-3-boris.brezillon@bootlin.com
---
 include/drm/drm_connector.h   | 2 +-
 include/drm/drm_mode_config.h | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 97ea41dc678fe..71f83956d7331 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -346,7 +346,7 @@ int drm_display_info_set_bus_formats(struct drm_display_info *info,
 /**
  * struct drm_tv_connector_state - TV connector related states
  * @subconnector: selected subconnector
- * @margins: margins
+ * @margins: margins (all margins are expressed in pixels)
  * @margins.left: left margin
  * @margins.right: right margin
  * @margins.top: top margin
diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h
index a0b202e1d69a0..238c7d2242076 100644
--- a/include/drm/drm_mode_config.h
+++ b/include/drm/drm_mode_config.h
@@ -668,22 +668,22 @@ struct drm_mode_config {
 	struct drm_property *tv_mode_property;
 	/**
 	 * @tv_left_margin_property: Optional TV property to set the left
-	 * margin.
+	 * margin (expressed in pixels).
 	 */
 	struct drm_property *tv_left_margin_property;
 	/**
 	 * @tv_right_margin_property: Optional TV property to set the right
-	 * margin.
+	 * margin (expressed in pixels).
 	 */
 	struct drm_property *tv_right_margin_property;
 	/**
 	 * @tv_top_margin_property: Optional TV property to set the right
-	 * margin.
+	 * margin (expressed in pixels).
 	 */
 	struct drm_property *tv_top_margin_property;
 	/**
 	 * @tv_bottom_margin_property: Optional TV property to set the right
-	 * margin.
+	 * margin (expressed in pixels).
 	 */
 	struct drm_property *tv_bottom_margin_property;
 	/**
-- 
GitLab


From a8e5cf30380dc8c74d9272bcd74bde3c8863fe0e Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Thu, 6 Dec 2018 15:24:37 +0100
Subject: [PATCH 0774/1835] drm/connector: Allow creation of margin props alone

Commit 6c4f52dca36f5e3e2354c30591d38e92f4657ed9 upstream.

TV margins properties can only be added as part of the SDTV TV
connector properties creation, but we might need those props for HDMI
TVs too, so let's move the margins props creation in a separate
function and expose it to drivers.

We also add an helper to attach margins props to a connector.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181206142439.10441-4-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/drm_connector.c | 83 ++++++++++++++++++++++++++-------
 include/drm/drm_connector.h     |  2 +
 2 files changed, 67 insertions(+), 18 deletions(-)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index a434c8582dc76..bbc3f3ed47a85 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -1109,6 +1109,70 @@ void drm_hdmi_avi_infoframe_content_type(struct hdmi_avi_infoframe *frame,
 }
 EXPORT_SYMBOL(drm_hdmi_avi_infoframe_content_type);
 
+/**
+ * drm_mode_attach_tv_margin_properties - attach TV connector margin properties
+ * @connector: DRM connector
+ *
+ * Called by a driver when it needs to attach TV margin props to a connector.
+ * Typically used on SDTV and HDMI connectors.
+ */
+void drm_connector_attach_tv_margin_properties(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+
+	drm_object_attach_property(&connector->base,
+				   dev->mode_config.tv_left_margin_property,
+				   0);
+	drm_object_attach_property(&connector->base,
+				   dev->mode_config.tv_right_margin_property,
+				   0);
+	drm_object_attach_property(&connector->base,
+				   dev->mode_config.tv_top_margin_property,
+				   0);
+	drm_object_attach_property(&connector->base,
+				   dev->mode_config.tv_bottom_margin_property,
+				   0);
+}
+EXPORT_SYMBOL(drm_connector_attach_tv_margin_properties);
+
+/**
+ * drm_mode_create_tv_margin_properties - create TV connector margin properties
+ * @dev: DRM device
+ *
+ * Called by a driver's HDMI connector initialization routine, this function
+ * creates the TV margin properties for a given device. No need to call this
+ * function for an SDTV connector, it's already called from
+ * drm_mode_create_tv_properties().
+ */
+int drm_mode_create_tv_margin_properties(struct drm_device *dev)
+{
+	if (dev->mode_config.tv_left_margin_property)
+		return 0;
+
+	dev->mode_config.tv_left_margin_property =
+		drm_property_create_range(dev, 0, "left margin", 0, 100);
+	if (!dev->mode_config.tv_left_margin_property)
+		return -ENOMEM;
+
+	dev->mode_config.tv_right_margin_property =
+		drm_property_create_range(dev, 0, "right margin", 0, 100);
+	if (!dev->mode_config.tv_right_margin_property)
+		return -ENOMEM;
+
+	dev->mode_config.tv_top_margin_property =
+		drm_property_create_range(dev, 0, "top margin", 0, 100);
+	if (!dev->mode_config.tv_top_margin_property)
+		return -ENOMEM;
+
+	dev->mode_config.tv_bottom_margin_property =
+		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
+	if (!dev->mode_config.tv_bottom_margin_property)
+		return -ENOMEM;
+
+	return 0;
+}
+EXPORT_SYMBOL(drm_mode_create_tv_margin_properties);
+
 /**
  * drm_mode_create_tv_properties - create TV specific connector properties
  * @dev: DRM device
@@ -1155,24 +1219,7 @@ int drm_mode_create_tv_properties(struct drm_device *dev,
 	/*
 	 * Other, TV specific properties: margins & TV modes.
 	 */
-	dev->mode_config.tv_left_margin_property =
-		drm_property_create_range(dev, 0, "left margin", 0, 100);
-	if (!dev->mode_config.tv_left_margin_property)
-		goto nomem;
-
-	dev->mode_config.tv_right_margin_property =
-		drm_property_create_range(dev, 0, "right margin", 0, 100);
-	if (!dev->mode_config.tv_right_margin_property)
-		goto nomem;
-
-	dev->mode_config.tv_top_margin_property =
-		drm_property_create_range(dev, 0, "top margin", 0, 100);
-	if (!dev->mode_config.tv_top_margin_property)
-		goto nomem;
-
-	dev->mode_config.tv_bottom_margin_property =
-		drm_property_create_range(dev, 0, "bottom margin", 0, 100);
-	if (!dev->mode_config.tv_bottom_margin_property)
+	if (drm_mode_create_tv_margin_properties(dev))
 		goto nomem;
 
 	dev->mode_config.tv_mode_property =
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 71f83956d7331..342a4db4b0c13 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1175,9 +1175,11 @@ const char *drm_get_tv_select_name(int val);
 const char *drm_get_content_protection_name(int val);
 
 int drm_mode_create_dvi_i_properties(struct drm_device *dev);
+int drm_mode_create_tv_margin_properties(struct drm_device *dev);
 int drm_mode_create_tv_properties(struct drm_device *dev,
 				  unsigned int num_modes,
 				  const char * const modes[]);
+void drm_connector_attach_tv_margin_properties(struct drm_connector *conn);
 int drm_mode_create_scaling_mode_property(struct drm_device *dev);
 int drm_connector_attach_content_type_property(struct drm_connector *dev);
 int drm_connector_attach_scaling_mode_property(struct drm_connector *connector,
-- 
GitLab


From f8fa37e1f48b98e06f04a4f01c2ea7fec63614c3 Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Thu, 6 Dec 2018 15:24:38 +0100
Subject: [PATCH 0775/1835] drm/vc4: Take margin setup into account when
 updating planes

Commit 666e73587f90f42d90385c1bea1009a650bf73f4 upstream.

Applyin margins is just a matter of scaling all planes appropriately
and adjusting the CRTC X/Y offset to account for the
left/right/top/bottom borders.

Create a vc4_plane_margins_adj() function doing that and call it from
vc4_plane_setup_clipping_and_scaling() so that we are ready to attach
margins properties to the HDMI connector.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181206142439.10441-5-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_crtc.c  | 43 +++++++++++++++++++++++++++
 drivers/gpu/drm/vc4/vc4_drv.h   |  3 ++
 drivers/gpu/drm/vc4/vc4_plane.c | 51 +++++++++++++++++++++++++++++++++
 3 files changed, 97 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 5615ceb15708f..193fe880df7c5 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -48,6 +48,13 @@ struct vc4_crtc_state {
 	struct drm_mm_node mm;
 	bool feed_txp;
 	bool txp_armed;
+
+	struct {
+		unsigned int left;
+		unsigned int right;
+		unsigned int top;
+		unsigned int bottom;
+	} margins;
 };
 
 static inline struct vc4_crtc_state *
@@ -623,6 +630,37 @@ static enum drm_mode_status vc4_crtc_mode_valid(struct drm_crtc *crtc,
 	return MODE_OK;
 }
 
+void vc4_crtc_get_margins(struct drm_crtc_state *state,
+			  unsigned int *left, unsigned int *right,
+			  unsigned int *top, unsigned int *bottom)
+{
+	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
+	struct drm_connector_state *conn_state;
+	struct drm_connector *conn;
+	int i;
+
+	*left = vc4_state->margins.left;
+	*right = vc4_state->margins.right;
+	*top = vc4_state->margins.top;
+	*bottom = vc4_state->margins.bottom;
+
+	/* We have to interate over all new connector states because
+	 * vc4_crtc_get_margins() might be called before
+	 * vc4_crtc_atomic_check() which means margins info in vc4_crtc_state
+	 * might be outdated.
+	 */
+	for_each_new_connector_in_state(state->state, conn, conn_state, i) {
+		if (conn_state->crtc != state->crtc)
+			continue;
+
+		*left = conn_state->tv.margins.left;
+		*right = conn_state->tv.margins.right;
+		*top = conn_state->tv.margins.top;
+		*bottom = conn_state->tv.margins.bottom;
+		break;
+	}
+}
+
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
 				 struct drm_crtc_state *state)
 {
@@ -670,6 +708,10 @@ static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
 			vc4_state->feed_txp = false;
 		}
 
+		vc4_state->margins.left = conn_state->tv.margins.left;
+		vc4_state->margins.right = conn_state->tv.margins.right;
+		vc4_state->margins.top = conn_state->tv.margins.top;
+		vc4_state->margins.bottom = conn_state->tv.margins.bottom;
 		break;
 	}
 
@@ -971,6 +1013,7 @@ static struct drm_crtc_state *vc4_crtc_duplicate_state(struct drm_crtc *crtc)
 
 	old_vc4_state = to_vc4_crtc_state(crtc->state);
 	vc4_state->feed_txp = old_vc4_state->feed_txp;
+	vc4_state->margins = old_vc4_state->margins;
 
 	__drm_atomic_helper_crtc_duplicate_state(crtc, &vc4_state->base);
 	return &vc4_state->base;
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index e29895d47aff2..67553b440d208 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -705,6 +705,9 @@ bool vc4_crtc_get_scanoutpos(struct drm_device *dev, unsigned int crtc_id,
 			     const struct drm_display_mode *mode);
 void vc4_crtc_handle_vblank(struct vc4_crtc *crtc);
 void vc4_crtc_txp_armed(struct drm_crtc_state *state);
+void vc4_crtc_get_margins(struct drm_crtc_state *state,
+			  unsigned int *right, unsigned int *left,
+			  unsigned int *top, unsigned int *bottom);
 
 /* vc4_debugfs.c */
 int vc4_debugfs_init(struct drm_minor *minor);
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 39e608271263d..3c3d97dbbb51f 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -258,6 +258,52 @@ static u32 vc4_get_scl_field(struct drm_plane_state *state, int plane)
 	}
 }
 
+static int vc4_plane_margins_adj(struct drm_plane_state *pstate)
+{
+	struct vc4_plane_state *vc4_pstate = to_vc4_plane_state(pstate);
+	unsigned int left, right, top, bottom, adjhdisplay, adjvdisplay;
+	struct drm_crtc_state *crtc_state;
+
+	crtc_state = drm_atomic_get_new_crtc_state(pstate->state,
+						   pstate->crtc);
+
+	vc4_crtc_get_margins(crtc_state, &left, &right, &top, &bottom);
+	if (!left && !right && !top && !bottom)
+		return 0;
+
+	if (left + right >= crtc_state->mode.hdisplay ||
+	    top + bottom >= crtc_state->mode.vdisplay)
+		return -EINVAL;
+
+	adjhdisplay = crtc_state->mode.hdisplay - (left + right);
+	vc4_pstate->crtc_x = DIV_ROUND_CLOSEST(vc4_pstate->crtc_x *
+					       adjhdisplay,
+					       crtc_state->mode.hdisplay);
+	vc4_pstate->crtc_x += left;
+	if (vc4_pstate->crtc_x > crtc_state->mode.hdisplay - left)
+		vc4_pstate->crtc_x = crtc_state->mode.hdisplay - left;
+
+	adjvdisplay = crtc_state->mode.vdisplay - (top + bottom);
+	vc4_pstate->crtc_y = DIV_ROUND_CLOSEST(vc4_pstate->crtc_y *
+					       adjvdisplay,
+					       crtc_state->mode.vdisplay);
+	vc4_pstate->crtc_y += top;
+	if (vc4_pstate->crtc_y > crtc_state->mode.vdisplay - top)
+		vc4_pstate->crtc_y = crtc_state->mode.vdisplay - top;
+
+	vc4_pstate->crtc_w = DIV_ROUND_CLOSEST(vc4_pstate->crtc_w *
+					       adjhdisplay,
+					       crtc_state->mode.hdisplay);
+	vc4_pstate->crtc_h = DIV_ROUND_CLOSEST(vc4_pstate->crtc_h *
+					       adjvdisplay,
+					       crtc_state->mode.vdisplay);
+
+	if (!vc4_pstate->crtc_w || !vc4_pstate->crtc_h)
+		return -EINVAL;
+
+	return 0;
+}
+
 static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 {
 	struct drm_plane *plane = state->plane;
@@ -269,6 +315,7 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 	int num_planes = fb->format->num_planes;
 	u32 h_subsample = 1;
 	u32 v_subsample = 1;
+	int ret;
 	int i;
 
 	for (i = 0; i < num_planes; i++)
@@ -292,6 +339,10 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 	vc4_state->crtc_w = state->crtc_w;
 	vc4_state->crtc_h = state->crtc_h;
 
+	ret = vc4_plane_margins_adj(state);
+	if (ret)
+		return ret;
+
 	vc4_state->x_scaling[0] = vc4_get_scaling_mode(vc4_state->src_w[0],
 						       vc4_state->crtc_w);
 	vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
-- 
GitLab


From 5352ca0ec04a242a6b8e197ce1238029948a559c Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Thu, 6 Dec 2018 15:24:39 +0100
Subject: [PATCH 0776/1835] drm/vc4: Attach margin props to the HDMI connector

Commit db999538fdb0679629d90652f8a1437df1e85a7d upstream.

Now that the plane code takes the margins setup into account, we can
safely attach margin props to the HDMI connector.

We also take care of filling AVI infoframes correctly to expose the
top/botton/left/right bar.

Note that those margin props match pretty well the
overscan_{left,right,top,bottom} properties defined in config.txt and
parsed by the VC4 firmware.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181206142439.10441-6-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index fd5522fd179e5..2f276222e30fa 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -310,6 +310,7 @@ static struct drm_connector *vc4_hdmi_connector_init(struct drm_device *dev,
 {
 	struct drm_connector *connector;
 	struct vc4_hdmi_connector *hdmi_connector;
+	int ret;
 
 	hdmi_connector = devm_kzalloc(dev->dev, sizeof(*hdmi_connector),
 				      GFP_KERNEL);
@@ -323,6 +324,13 @@ static struct drm_connector *vc4_hdmi_connector_init(struct drm_device *dev,
 			   DRM_MODE_CONNECTOR_HDMIA);
 	drm_connector_helper_add(connector, &vc4_hdmi_connector_helper_funcs);
 
+	/* Create and attach TV margin props to this connector. */
+	ret = drm_mode_create_tv_margin_properties(dev);
+	if (ret)
+		return ERR_PTR(ret);
+
+	drm_connector_attach_tv_margin_properties(connector);
+
 	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
 			     DRM_CONNECTOR_POLL_DISCONNECT);
 
@@ -408,6 +416,9 @@ static void vc4_hdmi_write_infoframe(struct drm_encoder *encoder,
 static void vc4_hdmi_set_avi_infoframe(struct drm_encoder *encoder)
 {
 	struct vc4_hdmi_encoder *vc4_encoder = to_vc4_hdmi_encoder(encoder);
+	struct vc4_dev *vc4 = encoder->dev->dev_private;
+	struct vc4_hdmi *hdmi = vc4->hdmi;
+	struct drm_connector_state *cstate = hdmi->connector->state;
 	struct drm_crtc *crtc = encoder->crtc;
 	const struct drm_display_mode *mode = &crtc->state->adjusted_mode;
 	union hdmi_infoframe frame;
@@ -426,6 +437,11 @@ static void vc4_hdmi_set_avi_infoframe(struct drm_encoder *encoder)
 					   vc4_encoder->rgb_range_selectable,
 					   false);
 
+	frame.avi.right_bar = cstate->tv.margins.right;
+	frame.avi.left_bar = cstate->tv.margins.left;
+	frame.avi.top_bar = cstate->tv.margins.top;
+	frame.avi.bottom_bar = cstate->tv.margins.bottom;
+
 	vc4_hdmi_write_infoframe(encoder, &frame);
 }
 
-- 
GitLab


From 89d137615bca61a7ad0541b506c95dd9f5d2088e Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 19 Jul 2019 15:35:13 +0100
Subject: [PATCH 0777/1835] drm/vc4: Add support for margins to fkms

Allows for overscan to be configured under FKMS.
NB This is rescaling the planes, not reducing the size of the
display mode.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 241 +++++++++++++++++++------
 1 file changed, 190 insertions(+), 51 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 7a6c45e1b02c8..2c564b04cac40 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -256,6 +256,23 @@ static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
 	return container_of(crtc, struct vc4_crtc, base);
 }
 
+struct vc4_crtc_state {
+	struct drm_crtc_state base;
+
+	struct {
+		unsigned int left;
+		unsigned int right;
+		unsigned int top;
+		unsigned int bottom;
+	} margins;
+};
+
+static inline struct vc4_crtc_state *
+to_vc4_crtc_state(struct drm_crtc_state *crtc_state)
+{
+	return (struct vc4_crtc_state *)crtc_state;
+}
+
 struct vc4_fkms_encoder {
 	struct drm_encoder base;
 	bool hdmi_monitor;
@@ -365,17 +382,127 @@ static int vc4_plane_set_blank(struct drm_plane *plane, bool blank)
 	return ret;
 }
 
+static void vc4_fkms_crtc_get_margins(struct drm_crtc_state *state,
+				      unsigned int *left, unsigned int *right,
+				      unsigned int *top, unsigned int *bottom)
+{
+	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
+	struct drm_connector_state *conn_state;
+	struct drm_connector *conn;
+	int i;
+
+	*left = vc4_state->margins.left;
+	*right = vc4_state->margins.right;
+	*top = vc4_state->margins.top;
+	*bottom = vc4_state->margins.bottom;
+
+	/* We have to interate over all new connector states because
+	 * vc4_fkms_crtc_get_margins() might be called before
+	 * vc4_fkms_crtc_atomic_check() which means margins info in
+	 * vc4_crtc_state might be outdated.
+	 */
+	for_each_new_connector_in_state(state->state, conn, conn_state, i) {
+		if (conn_state->crtc != state->crtc)
+			continue;
+
+		*left = conn_state->tv.margins.left;
+		*right = conn_state->tv.margins.right;
+		*top = conn_state->tv.margins.top;
+		*bottom = conn_state->tv.margins.bottom;
+		break;
+	}
+}
+
+static int vc4_fkms_margins_adj(struct drm_plane_state *pstate,
+				struct set_plane *plane)
+{
+	unsigned int left, right, top, bottom;
+	int adjhdisplay, adjvdisplay;
+	struct drm_crtc_state *crtc_state;
+
+	crtc_state = drm_atomic_get_new_crtc_state(pstate->state,
+						   pstate->crtc);
+
+	vc4_fkms_crtc_get_margins(crtc_state, &left, &right, &top, &bottom);
+
+	if (!left && !right && !top && !bottom)
+		return 0;
+
+	if (left + right >= crtc_state->mode.hdisplay ||
+	    top + bottom >= crtc_state->mode.vdisplay)
+		return -EINVAL;
+
+	adjhdisplay = crtc_state->mode.hdisplay - (left + right);
+	plane->dst_x = DIV_ROUND_CLOSEST(plane->dst_x * adjhdisplay,
+					 (int)crtc_state->mode.hdisplay);
+	plane->dst_x += left;
+	if (plane->dst_x > (int)(crtc_state->mode.hdisplay - left))
+		plane->dst_x = crtc_state->mode.hdisplay - left;
+
+	adjvdisplay = crtc_state->mode.vdisplay - (top + bottom);
+	plane->dst_y = DIV_ROUND_CLOSEST(plane->dst_y * adjvdisplay,
+					 (int)crtc_state->mode.vdisplay);
+	plane->dst_y += top;
+	if (plane->dst_y > (int)(crtc_state->mode.vdisplay - top))
+		plane->dst_y = crtc_state->mode.vdisplay - top;
+
+	plane->dst_w = DIV_ROUND_CLOSEST(plane->dst_w * adjhdisplay,
+					 crtc_state->mode.hdisplay);
+	plane->dst_h = DIV_ROUND_CLOSEST(plane->dst_h * adjvdisplay,
+					 crtc_state->mode.vdisplay);
+
+	if (!plane->dst_w || !plane->dst_h)
+		return -EINVAL;
+
+	return 0;
+}
+
 static void vc4_plane_atomic_update(struct drm_plane *plane,
 				    struct drm_plane_state *old_state)
 {
 	struct drm_plane_state *state = plane->state;
+
+	/*
+	 * Do NOT set now, as we haven't checked if the crtc is active or not.
+	 * Set from vc4_plane_set_blank instead.
+	 *
+	 * If the CRTC is on (or going to be on) and we're enabled,
+	 * then unblank.  Otherwise, stay blank until CRTC enable.
+	 */
+	if (state->crtc->state->active)
+		vc4_plane_set_blank(plane, false);
+}
+
+static void vc4_plane_atomic_disable(struct drm_plane *plane,
+				     struct drm_plane_state *old_state)
+{
+	struct drm_plane_state *state = plane->state;
+	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
+
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane disable %dx%d@%d +%d,%d\n",
+			 plane->base.id, plane->name,
+			 state->crtc_w,
+			 state->crtc_h,
+			 vc4_plane->mb.plane.vc_image_type,
+			 state->crtc_x,
+			 state->crtc_y);
+	vc4_plane_set_blank(plane, true);
+}
+
+static bool plane_enabled(struct drm_plane_state *state)
+{
+	return state->fb && state->crtc;
+}
+
+static int vc4_plane_to_mb(struct drm_plane *plane,
+			   struct mailbox_set_plane *mb,
+			   struct drm_plane_state *state)
+{
 	struct drm_framebuffer *fb = state->fb;
 	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
 	const struct drm_format_info *drm_fmt = fb->format;
 	const struct vc_image_format *vc_fmt =
 					vc4_get_vc_image_fmt(drm_fmt->format);
-	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
-	struct mailbox_set_plane *mb = &vc4_plane->mb;
 	int num_planes = fb->format->num_planes;
 	struct drm_display_mode *mode = &state->crtc->mode;
 	unsigned int rotation = SUPPORTED_ROTATIONS;
@@ -417,25 +544,7 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 		break;
 	}
 
-	/* FIXME: If the dest rect goes off screen then clip the src rect so we
-	 * don't have off-screen pixels.
-	 */
-	if (plane->type == DRM_PLANE_TYPE_CURSOR) {
-		/* There is no scaling on the cursor plane, therefore the calcs
-		 * to alter the source crop as the cursor goes off the screen
-		 * are simple.
-		 */
-		if (mb->plane.dst_x + mb->plane.dst_w > mode->hdisplay) {
-			mb->plane.dst_w = mode->hdisplay - mb->plane.dst_x;
-			mb->plane.src_w = (mode->hdisplay - mb->plane.dst_x)
-									<< 16;
-		}
-		if (mb->plane.dst_y + mb->plane.dst_h > mode->vdisplay) {
-			mb->plane.dst_h = mode->vdisplay - mb->plane.dst_y;
-			mb->plane.src_h = (mode->vdisplay - mb->plane.dst_y)
-									<< 16;
-		}
-	}
+	vc4_fkms_margins_adj(state, &mb->plane);
 
 	if (num_planes > 1) {
 		/* Assume this must be YUV */
@@ -525,38 +634,19 @@ static void vc4_plane_atomic_update(struct drm_plane *plane,
 			 state->alpha,
 			 state->normalized_zpos);
 
-	/*
-	 * Do NOT set now, as we haven't checked if the crtc is active or not.
-	 * Set from vc4_plane_set_blank instead.
-	 *
-	 * If the CRTC is on (or going to be on) and we're enabled,
-	 * then unblank.  Otherwise, stay blank until CRTC enable.
-	 */
-	if (state->crtc->state->active)
-		vc4_plane_set_blank(plane, false);
+	return 0;
 }
 
-static void vc4_plane_atomic_disable(struct drm_plane *plane,
-				     struct drm_plane_state *old_state)
+static int vc4_plane_atomic_check(struct drm_plane *plane,
+				  struct drm_plane_state *state)
 {
-	//struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
-	struct drm_plane_state *state = plane->state;
 	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
 
-	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] plane disable %dx%d@%d +%d,%d\n",
-			 plane->base.id, plane->name,
-			 state->crtc_w,
-			 state->crtc_h,
-			 vc4_plane->mb.plane.vc_image_type,
-			 state->crtc_x,
-			 state->crtc_y);
-	vc4_plane_set_blank(plane, true);
-}
+	if (!plane_enabled(state))
+		return 0;
+
+	return vc4_plane_to_mb(plane, &vc4_plane->mb, state);
 
-static int vc4_plane_atomic_check(struct drm_plane *plane,
-				  struct drm_plane_state *state)
-{
-	return 0;
 }
 
 static void vc4_plane_destroy(struct drm_plane *plane)
@@ -878,8 +968,23 @@ vc4_crtc_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode)
 static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
 				 struct drm_crtc_state *state)
 {
-	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_check.\n",
-		      crtc->base.id);
+	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(state);
+	struct drm_connector *conn;
+	struct drm_connector_state *conn_state;
+	int i;
+
+	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_check.\n", crtc->base.id);
+
+	for_each_new_connector_in_state(state->state, conn, conn_state, i) {
+		if (conn_state->crtc != crtc)
+			continue;
+
+		vc4_state->margins.left = conn_state->tv.margins.left;
+		vc4_state->margins.right = conn_state->tv.margins.right;
+		vc4_state->margins.top = conn_state->tv.margins.top;
+		vc4_state->margins.bottom = conn_state->tv.margins.bottom;
+		break;
+	}
 	return 0;
 }
 
@@ -980,6 +1085,33 @@ static int vc4_page_flip(struct drm_crtc *crtc,
 	return drm_atomic_helper_page_flip(crtc, fb, event, flags, ctx);
 }
 
+static struct drm_crtc_state *
+vc4_crtc_duplicate_state(struct drm_crtc *crtc)
+{
+	struct vc4_crtc_state *vc4_state, *old_vc4_state;
+
+	vc4_state = kzalloc(sizeof(*vc4_state), GFP_KERNEL);
+	if (!vc4_state)
+		return NULL;
+
+	old_vc4_state = to_vc4_crtc_state(crtc->state);
+	vc4_state->margins = old_vc4_state->margins;
+
+	__drm_atomic_helper_crtc_duplicate_state(crtc, &vc4_state->base);
+	return &vc4_state->base;
+}
+
+static void
+vc4_crtc_reset(struct drm_crtc *crtc)
+{
+	if (crtc->state)
+		__drm_atomic_helper_crtc_destroy_state(crtc->state);
+
+	crtc->state = kzalloc(sizeof(*crtc->state), GFP_KERNEL);
+	if (crtc->state)
+		crtc->state->crtc = crtc;
+}
+
 static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
 {
 	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
@@ -1007,8 +1139,8 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = {
 	.set_property = NULL,
 	.cursor_set = NULL, /* handled by drm_mode_cursor_universal */
 	.cursor_move = NULL, /* handled by drm_mode_cursor_universal */
-	.reset = drm_atomic_helper_crtc_reset,
-	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
+	.reset = vc4_crtc_reset,
+	.atomic_duplicate_state = vc4_crtc_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
 	.enable_vblank = vc4_fkms_enable_vblank,
 	.disable_vblank = vc4_fkms_disable_vblank,
@@ -1267,6 +1399,13 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 		connector->interlace_allowed = 0;
 	}
 
+	/* Create and attach TV margin props to this connector. */
+	ret = drm_mode_create_tv_margin_properties(dev);
+	if (ret)
+		return ERR_PTR(ret);
+
+	drm_connector_attach_tv_margin_properties(connector);
+
 	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
 			     DRM_CONNECTOR_POLL_DISCONNECT);
 
-- 
GitLab


From 689fc28a5af07cedb88760b2f35b1eb6f6a7e112 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 19 Jul 2019 17:49:00 +0100
Subject: [PATCH 0778/1835] drm/vc4: Ensure zpos is always initialised

The compiler is warning that default_zpos can be used
uninitialised as there is no default case to catch all plane
types.
No other plane types should ever be presented to vc4_fkms_plane_init,
but add a default case regardless.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 2c564b04cac40..8f3fe6f9246ea 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -773,6 +773,7 @@ static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
 	 * other layers as requested by KMS.
 	 */
 	switch (type) {
+	default:
 	case DRM_PLANE_TYPE_PRIMARY:
 		default_zpos = 0;
 		break;
-- 
GitLab


From 49e1d3f0b6fe2d77dcd71eedae3ca21e1c245a4c Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Wed, 24 Jul 2019 14:36:53 +0100
Subject: [PATCH 0779/1835] dts: bcm2838: add missing properties for pmu and
 gic nodes

The GIC has a virtual interface maintenance interrupt and the PMU
interrupts need affinity mappings as they are wired to generic SPIs.

Also, delete incorrect PMU compatible string.

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2838.dtsi | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2838.dtsi b/arch/arm/boot/dts/bcm2838.dtsi
index 3cecfa62af428..9d349b3fa6522 100644
--- a/arch/arm/boot/dts/bcm2838.dtsi
+++ b/arch/arm/boot/dts/bcm2838.dtsi
@@ -35,6 +35,8 @@
 				<0x40042000 0x2000>,
 				<0x40044000 0x2000>,
 				<0x40046000 0x2000>;
+			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) |
+						 IRQ_TYPE_LEVEL_HIGH)>;
 		};
 
 		thermal: thermal@7d5d2200 {
@@ -222,15 +224,12 @@
 	};
 
 	arm-pmu {
-		/*
-		 * N.B. the A72 PMU support only exists in arch/arm64, hence
-		 * the fallback to the A53 version.
-		 */
-		compatible = "arm,cortex-a72-pmu", "arm,cortex-a53-pmu";
+		compatible = "arm,cortex-a72-pmu";
 		interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
 			<GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
 			<GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
 			<GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
 	};
 
 	timer {
-- 
GitLab


From 33354f30c6b7f59bb7f5b4345b28f0e8c49bf993 Mon Sep 17 00:00:00 2001
From: Joerg Schambacher <joscha@schambacher.com>
Date: Tue, 23 Jul 2019 16:57:35 +0200
Subject: [PATCH 0780/1835] adds the Hifiberry DAC+ADC PRO version

This adds the driver for the DAC+ADC PRO version of the Hifiberry soundcard with software controlled PCM1863 ADC
Signed-off-by: Joerg Schambacher joerg@i2audio.com
---
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |  21 +
 .../hifiberry-dacplusadcpro-overlay.dts       |  64 +++
 arch/arm/configs/bcm2709_defconfig            |   1 +
 arch/arm/configs/bcm2711_defconfig            |   1 +
 arch/arm/configs/bcmrpi_defconfig             |   1 +
 sound/soc/bcm/Kconfig                         |   8 +
 sound/soc/bcm/Makefile                        |   2 +
 sound/soc/bcm/hifiberry_dacplusadcpro.c       | 538 ++++++++++++++++++
 9 files changed, 637 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
 create mode 100644 sound/soc/bcm/hifiberry_dacplusadcpro.c

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 216403c69c558..260fce213a575 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -53,6 +53,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	hifiberry-dac.dtbo \
 	hifiberry-dacplus.dtbo \
 	hifiberry-dacplusadc.dtbo \
+	hifiberry-dacplusadcpro.dtbo \
 	hifiberry-digi.dtbo \
 	hifiberry-digi-pro.dtbo \
 	hy28a.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index f03065a7e00ed..203041654d847 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -883,6 +883,27 @@ Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
                                 master for bit clock and frame clock.
 
 
+Name:   hifiberry-dacplusadcpro
+Info:   Configures the HifiBerry DAC+ADC PRO audio card
+Load:   dtoverlay=hifiberry-dacplusadcpro,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=hifiberry-dacplusadcpro,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        slave                   Force DAC+ADC Pro into slave mode, using Pi as
+                                master for bit clock and frame clock.
+
+
 Name:   hifiberry-digi
 Info:   Configures the HifiBerry Digi and Digi+ audio card
 Load:   dtoverlay=hifiberry-digi
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
new file mode 100644
index 0000000000000..00e5d450a88b1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusadcpro-overlay.dts
@@ -0,0 +1,64 @@
+// Definitions for HiFiBerry DAC+ADC PRO
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			dacpro_osc: dacpro_osc {
+				compatible = "hifiberry,dacpro-clk";
+				#clock-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			hb_dac: pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				clocks = <&dacpro_osc>;
+				status = "okay";
+			};
+			hb_adc: pcm186x@4a {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm1863";
+				reg = <0x4a>;
+				clocks = <&dacpro_osc>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		hifiberry_dacplusadcpro: __overlay__ {
+			compatible = "hifiberry,hifiberry-dacplusadcpro";
+			audio-codec = <&hb_dac &hb_adc>;
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,24db_digital_gain?";
+		slave = <&hifiberry_dacplusadcpro>,"hifiberry-dacplusadcpro,slave?";
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 70e9b2e8c4c76..e21341bd59ef7 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -961,6 +961,7 @@ CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 837afe4aecd87..159169797d57c 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -972,6 +972,7 @@ CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 08bbdde2f1163..27485b714eeb1 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -953,6 +953,7 @@ CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index 75786ab06a53b..a40042489b6cd 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -48,6 +48,14 @@ config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC
         help
          Say Y or M if you want to add support for HifiBerry DAC+ADC.
 
+config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO
+        tristate "Support for HifiBerry DAC+ADC PRO"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM512x_I2C
+	select SND_SOC_PCM186X_I2C
+        help
+         Say Y or M if you want to add support for HifiBerry DAC+ADC PRO.
+
 config SND_BCM2708_SOC_HIFIBERRY_DIGI
         tristate "Support for HifiBerry Digi"
         depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index 4f588a29d8253..78a96fa577d72 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -14,6 +14,7 @@ snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
 # BCM2708 Machine Support
 snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
 snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
+snd-soc-hifiberry-dacplusadcpro-objs := hifiberry_dacplusadcpro.o
 snd-soc-justboom-dac-objs := justboom-dac.o
 snd-soc-rpi-cirrus-objs := rpi-cirrus.o
 snd-soc-rpi-proto-objs := rpi-proto.o
@@ -38,6 +39,7 @@ snd-soc-rpi-wm8804-soundcard-objs := rpi-wm8804-soundcard.o
 obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusadc.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO) += snd-soc-hifiberry-dacplusadcpro.o
 obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
diff --git a/sound/soc/bcm/hifiberry_dacplusadcpro.c b/sound/soc/bcm/hifiberry_dacplusadcpro.c
new file mode 100644
index 0000000000000..ed080b24eb494
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_dacplusadcpro.c
@@ -0,0 +1,538 @@
+/*
+ * ASoC Driver for HiFiBerry DAC+ / DAC Pro with ADC PRO Version (SW control)
+ *
+ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
+ *		Copyright 2014-2015
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *		ADC added by Joerg Schambacher <joerg@i2audio.com>
+ *		Copyright 2018-19
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <sound/tlv.h>
+
+#include "../codecs/pcm512x.h"
+#include "../codecs/pcm186x.h"
+
+#define HIFIBERRY_DACPRO_NOCLOCK 0
+#define HIFIBERRY_DACPRO_CLK44EN 1
+#define HIFIBERRY_DACPRO_CLK48EN 2
+
+struct pcm512x_priv {
+	struct regmap *regmap;
+	struct clk *sclk;
+};
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 22579200UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 24576000UL
+
+static bool slave;
+static bool snd_rpi_hifiberry_is_dacpro;
+static bool digital_gain_0db_limit = true;
+
+static const unsigned int pcm186x_adc_input_channel_sel_value[] = {
+	0x00, 0x01, 0x02, 0x03, 0x10
+};
+
+static const char * const pcm186x_adcl_input_channel_sel_text[] = {
+	"No Select",
+	"VINL1[SE]",					/* Default for ADCL */
+	"VINL2[SE]",
+	"VINL2[SE] + VINL1[SE]",
+	"{VIN1P, VIN1M}[DIFF]"
+};
+
+static const char * const pcm186x_adcr_input_channel_sel_text[] = {
+	"No Select",
+	"VINR1[SE]",					/* Default for ADCR */
+	"VINR2[SE]",
+	"VINR2[SE] + VINR1[SE]",
+	"{VIN2P, VIN2M}[DIFF]"
+};
+
+static const struct soc_enum pcm186x_adc_input_channel_sel[] = {
+	SOC_VALUE_ENUM_SINGLE(PCM186X_ADC1_INPUT_SEL_L, 0,
+			      PCM186X_ADC_INPUT_SEL_MASK,
+			      ARRAY_SIZE(pcm186x_adcl_input_channel_sel_text),
+			      pcm186x_adcl_input_channel_sel_text,
+			      pcm186x_adc_input_channel_sel_value),
+	SOC_VALUE_ENUM_SINGLE(PCM186X_ADC1_INPUT_SEL_R, 0,
+			      PCM186X_ADC_INPUT_SEL_MASK,
+			      ARRAY_SIZE(pcm186x_adcr_input_channel_sel_text),
+			      pcm186x_adcr_input_channel_sel_text,
+			      pcm186x_adc_input_channel_sel_value),
+};
+
+static const unsigned int pcm186x_mic_bias_sel_value[] = {
+	0x00, 0x01, 0x11
+};
+
+static const char * const pcm186x_mic_bias_sel_text[] = {
+	"Mic Bias off",
+	"Mic Bias on",
+	"Mic Bias with Bypass Resistor"
+};
+
+static const struct soc_enum pcm186x_mic_bias_sel[] = {
+	SOC_VALUE_ENUM_SINGLE(PCM186X_MIC_BIAS_CTRL, 0,
+			      GENMASK(4, 0),
+			      ARRAY_SIZE(pcm186x_mic_bias_sel_text),
+			      pcm186x_mic_bias_sel_text,
+			      pcm186x_mic_bias_sel_value),
+};
+
+static const unsigned int pcm186x_gain_sel_value[] = {
+	0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
+	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+	0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+	0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
+	0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
+	0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
+	0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+	0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+	0x50
+};
+
+static const char * const pcm186x_gain_sel_text[] = {
+	"-12.0dB", "-11.5dB", "-11.0dB", "-10.5dB", "-10.0dB", "-9.5dB",
+	"-9.0dB", "-8.5dB", "-8.0dB", "-7.5dB", "-7.0dB", "-6.5dB",
+	"-6.0dB", "-5.5dB", "-5.0dB", "-4.5dB", "-4.0dB", "-3.5dB",
+	"-3.0dB", "-2.5dB", "-2.0dB", "-1.5dB", "-1.0dB", "-0.5dB",
+	"0.0dB", "0.5dB", "1.0dB", "1.5dB", "2.0dB", "2.5dB",
+	"3.0dB", "3.5dB", "4.0dB", "4.5dB", "5.0dB", "5.5dB",
+	"6.0dB", "6.5dB", "7.0dB", "7.5dB", "8.0dB", "8.5dB",
+	"9.0dB", "9.5dB", "10.0dB", "10.5dB", "11.0dB", "11.5dB",
+	"12.0dB", "12.5dB", "13.0dB", "13.5dB", "14.0dB", "14.5dB",
+	"15.0dB", "15.5dB", "16.0dB", "16.5dB", "17.0dB", "17.5dB",
+	"18.0dB", "18.5dB", "19.0dB", "19.5dB", "20.0dB", "20.5dB",
+	"21.0dB", "21.5dB", "22.0dB", "22.5dB", "23.0dB", "23.5dB",
+	"24.0dB", "24.5dB", "25.0dB", "25.5dB", "26.0dB", "26.5dB",
+	"27.0dB", "27.5dB", "28.0dB", "28.5dB", "29.0dB", "29.5dB",
+	"30.0dB", "30.5dB", "31.0dB", "31.5dB", "32.0dB", "32.5dB",
+	"33.0dB", "33.5dB", "34.0dB", "34.5dB", "35.0dB", "35.5dB",
+	"36.0dB", "36.5dB", "37.0dB", "37.5dB", "38.0dB", "38.5dB",
+	"39.0dB", "39.5dB", "40.0dB"};
+
+static const struct soc_enum pcm186x_gain_sel[] = {
+	SOC_VALUE_ENUM_SINGLE(PCM186X_PGA_VAL_CH1_L, 0,
+			      0xff,
+			      ARRAY_SIZE(pcm186x_gain_sel_text),
+			      pcm186x_gain_sel_text,
+			      pcm186x_gain_sel_value),
+	SOC_VALUE_ENUM_SINGLE(PCM186X_PGA_VAL_CH1_R, 0,
+			      0xff,
+			      ARRAY_SIZE(pcm186x_gain_sel_text),
+			      pcm186x_gain_sel_text,
+			      pcm186x_gain_sel_value),
+};
+
+static const struct snd_kcontrol_new pcm1863_snd_controls_card[] = {
+	SOC_ENUM("ADC Left Input", pcm186x_adc_input_channel_sel[0]),
+	SOC_ENUM("ADC Right Input", pcm186x_adc_input_channel_sel[1]),
+	SOC_ENUM("ADC Mic Bias", pcm186x_mic_bias_sel),
+	SOC_ENUM("PGA Gain Left", pcm186x_gain_sel[0]),
+	SOC_ENUM("PGA Gain Right", pcm186x_gain_sel[1]),
+};
+
+static int pcm1863_add_controls(struct snd_soc_component *component)
+{
+	snd_soc_add_component_controls(component,
+			pcm1863_snd_controls_card,
+			ARRAY_SIZE(pcm1863_snd_controls_card));
+	return 0;
+}
+
+static void snd_rpi_hifiberry_dacplusadcpro_select_clk(
+					struct snd_soc_component *component, int clk_id)
+{
+	switch (clk_id) {
+	case HIFIBERRY_DACPRO_NOCLOCK:
+		snd_soc_component_update_bits(component,
+				PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
+		break;
+	case HIFIBERRY_DACPRO_CLK44EN:
+		snd_soc_component_update_bits(component,
+				PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
+		break;
+	case HIFIBERRY_DACPRO_CLK48EN:
+		snd_soc_component_update_bits(component,
+				PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
+		break;
+	}
+}
+
+static void snd_rpi_hifiberry_dacplusadcpro_clk_gpio(struct snd_soc_component *component)
+{
+	snd_soc_component_update_bits(component, PCM512x_GPIO_EN, 0x24, 0x24);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
+	snd_soc_component_update_bits(component, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
+}
+
+static bool snd_rpi_hifiberry_dacplusadcpro_is_sclk(struct snd_soc_component *component)
+{
+	unsigned int sck;
+
+	snd_soc_component_read(component, PCM512x_RATE_DET_4, &sck);
+	return (!(sck & 0x40));
+}
+
+static bool snd_rpi_hifiberry_dacplusadcpro_is_sclk_sleep(
+	struct snd_soc_component *component)
+{
+	msleep(2);
+	return snd_rpi_hifiberry_dacplusadcpro_is_sclk(component);
+}
+
+static bool snd_rpi_hifiberry_dacplusadcpro_is_pro_card(struct snd_soc_component *component)
+{
+	bool isClk44EN, isClk48En, isNoClk;
+
+	snd_rpi_hifiberry_dacplusadcpro_clk_gpio(component);
+
+	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_CLK44EN);
+	isClk44EN = snd_rpi_hifiberry_dacplusadcpro_is_sclk_sleep(component);
+
+	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_NOCLOCK);
+	isNoClk = snd_rpi_hifiberry_dacplusadcpro_is_sclk_sleep(component);
+
+	snd_rpi_hifiberry_dacplusadcpro_select_clk(component, HIFIBERRY_DACPRO_CLK48EN);
+	isClk48En = snd_rpi_hifiberry_dacplusadcpro_is_sclk_sleep(component);
+
+	return (isClk44EN && isClk48En && !isNoClk);
+}
+
+static int snd_rpi_hifiberry_dacplusadcpro_clk_for_rate(int sample_rate)
+{
+	int type;
+
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+	case 352800:
+		type = HIFIBERRY_DACPRO_CLK44EN;
+		break;
+	default:
+		type = HIFIBERRY_DACPRO_CLK48EN;
+		break;
+	}
+	return type;
+}
+
+static void snd_rpi_hifiberry_dacplusadcpro_set_sclk(struct snd_soc_component *component,
+	int sample_rate)
+{
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+
+	if (!IS_ERR(pcm512x->sclk)) {
+		int ctype;
+
+		ctype = snd_rpi_hifiberry_dacplusadcpro_clk_for_rate(sample_rate);
+		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
+			? CLK_44EN_RATE : CLK_48EN_RATE);
+		snd_rpi_hifiberry_dacplusadcpro_select_clk(component, ctype);
+	}
+}
+
+static int snd_rpi_hifiberry_dacplusadcpro_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_component *dac = rtd->codec_dais[0]->component;
+	struct snd_soc_component *adc = rtd->codec_dais[1]->component;
+	struct snd_soc_dai_driver *adc_driver = rtd->codec_dais[1]->driver;
+	struct pcm512x_priv *priv;
+	int ret;
+
+	if (slave)
+		snd_rpi_hifiberry_is_dacpro = false;
+	else
+		snd_rpi_hifiberry_is_dacpro =
+				snd_rpi_hifiberry_dacplusadcpro_is_pro_card(dac);
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "HiFiBerry DAC+ADC Pro";
+		dai->stream_name = "HiFiBerry DAC+ADC Pro HiFi";
+
+		// set DAC DAI configuration
+		ret = snd_soc_dai_set_fmt(rtd->codec_dais[0],
+				SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBM_CFM);
+		if (ret < 0)
+			return ret;
+
+		// set ADC DAI configuration
+		ret = snd_soc_dai_set_fmt(rtd->codec_dais[1],
+				SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBS_CFS);
+		if (ret < 0)
+			return ret;
+
+		// set CPU DAI configuration
+		ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+			SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS);
+		if (ret < 0)
+			return ret;
+
+		snd_soc_component_update_bits(dac, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
+		snd_soc_component_update_bits(dac, PCM512x_MASTER_MODE, 0x03, 0x03);
+		snd_soc_component_update_bits(dac, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
+	} else {
+		priv = snd_soc_component_get_drvdata(dac);
+		priv->sclk = ERR_PTR(-ENOENT);
+	}
+
+	/* disable 24bit mode as long as I2S module does not have sign extension fixed */
+	adc_driver->capture.formats = SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S16_LE;
+
+	snd_soc_component_update_bits(dac, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_component_update_bits(dac, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
+	snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+
+	ret = pcm1863_add_controls(adc);
+	if (ret < 0)
+		dev_warn(rtd->dev, "Failed to add pcm1863 controls: %d\n",
+		ret);
+
+	/* set GPIO2 to output, GPIO3 input */
+	snd_soc_component_write(adc, PCM186X_GPIO3_2_CTRL, 0x00);
+	snd_soc_component_write(adc, PCM186X_GPIO3_2_DIR_CTRL, 0x04);
+	snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
+
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplusadcpro_update_rate_den(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *component = rtd->codec_dais[0]->component; /* only use DAC */
+	struct pcm512x_priv *pcm512x = snd_soc_component_get_drvdata(component);
+	struct snd_ratnum *rats_no_pll;
+	unsigned int num = 0, den = 0;
+	int err;
+
+	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
+	if (!rats_no_pll)
+		return -ENOMEM;
+
+	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
+	rats_no_pll->den_min = 1;
+	rats_no_pll->den_max = 128;
+	rats_no_pll->den_step = 1;
+
+	err = snd_interval_ratnum(hw_param_interval(params,
+		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
+	if (err >= 0 && den) {
+		params->rate_num = num;
+		params->rate_den = den;
+	}
+
+	devm_kfree(rtd->dev, rats_no_pll);
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplusadcpro_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	int channels = params_channels(params);
+	int width = 32;
+	struct snd_soc_component *dac = rtd->codec_dais[0]->component;
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+
+		width = snd_pcm_format_physical_width(params_format(params));
+
+		snd_rpi_hifiberry_dacplusadcpro_set_sclk(dac,
+			params_rate(params));
+
+		ret = snd_rpi_hifiberry_dacplusadcpro_update_rate_den(
+			substream, params);
+		if (ret)
+			return ret;
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dais[0], 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dais[1], 0x03, 0x03,
+		channels, width);
+	return ret;
+}
+
+static int snd_rpi_hifiberry_dacplusadcpro_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *dac = rtd->codec_dais[0]->component;
+	struct snd_soc_component *adc = rtd->codec_dais[1]->component;
+
+	/* switch on respective LED */
+	if (!substream->stream)
+		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+	else
+		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x40);
+	return 0;
+}
+
+static void snd_rpi_hifiberry_dacplusadcpro_shutdown(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_component *dac = rtd->codec_dais[0]->component;
+	struct snd_soc_component *adc = rtd->codec_dais[1]->component;
+
+	/* switch off respective LED */
+	if (!substream->stream)
+		snd_soc_component_update_bits(dac, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
+	else
+		snd_soc_component_update_bits(adc, PCM186X_GPIO_IN_OUT, 0x40, 0x00);
+}
+
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_hifiberry_dacplusadcpro_ops = {
+	.hw_params = snd_rpi_hifiberry_dacplusadcpro_hw_params,
+	.startup = snd_rpi_hifiberry_dacplusadcpro_startup,
+	.shutdown = snd_rpi_hifiberry_dacplusadcpro_shutdown,
+};
+
+static struct snd_soc_dai_link_component snd_rpi_hifiberry_dacplusadcpro_codecs[] = {
+	{
+		.name		= "pcm512x.1-004d",
+		.dai_name	= "pcm512x-hifi",
+	},
+	{
+		.name		= "pcm186x.1-004a",
+		.dai_name	= "pcm1863-aif",
+	},
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_dacplusadcpro_dai[] = {
+{
+	.name		= "HiFiBerry DAC+ADC PRO",
+	.stream_name	= "HiFiBerry DAC+ADC PRO HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.platform_name	= "bcm2708-i2s.0",
+	.codecs		= snd_rpi_hifiberry_dacplusadcpro_codecs,
+	.num_codecs	= 2,
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_hifiberry_dacplusadcpro_ops,
+	.init		= snd_rpi_hifiberry_dacplusadcpro_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_hifiberry_dacplusadcpro = {
+	.name         = "snd_rpi_hifiberry_dacplusadcpro",
+	.driver_name  = "HifiberryDacpAdcPro",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_dacplusadcpro_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplusadcpro_dai),
+};
+
+static int snd_rpi_hifiberry_dacplusadcpro_probe(struct platform_device *pdev)
+{
+	int ret = 0, i = 0;
+	struct snd_soc_card *card = &snd_rpi_hifiberry_dacplusadcpro;
+
+	snd_rpi_hifiberry_dacplusadcpro.dev = &pdev->dev;
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_rpi_hifiberry_dacplusadcpro_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+			"i2s-controller", 0);
+		if (i2s_node) {
+			for (i = 0; i < card->num_links; i++) {
+				dai->cpu_dai_name = NULL;
+				dai->cpu_of_node = i2s_node;
+				dai->platform_name = NULL;
+				dai->platform_of_node = i2s_node;
+			}
+		}
+	}
+	digital_gain_0db_limit = !of_property_read_bool(
+		pdev->dev.of_node, "hifiberry-dacplusadcpro,24db_digital_gain");
+	slave = of_property_read_bool(pdev->dev.of_node,
+					"hifiberry-dacplusadcpro,slave");
+	ret = snd_soc_register_card(&snd_rpi_hifiberry_dacplusadcpro);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static const struct of_device_id snd_rpi_hifiberry_dacplusadcpro_of_match[] = {
+	{ .compatible = "hifiberry,hifiberry-dacplusadcpro", },
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplusadcpro_of_match);
+
+static struct platform_driver snd_rpi_hifiberry_dacplusadcpro_driver = {
+	.driver = {
+		.name   = "snd-rpi-hifiberry-dacplusadcpro",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_dacplusadcpro_of_match,
+	},
+	.probe          = snd_rpi_hifiberry_dacplusadcpro_probe,
+};
+
+module_platform_driver(snd_rpi_hifiberry_dacplusadcpro_driver);
+
+MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
+MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
+MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+ADC");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 7202df6be6ec194297292a74fad29cc10dc9d42f Mon Sep 17 00:00:00 2001
From: Stefan Hellermann <stefan@the2masters.de>
Date: Mon, 17 Jun 2019 15:43:59 +0200
Subject: [PATCH 0781/1835] MIPS: ath79: fix ar933x uart parity mode

[ Upstream commit db13a5ba2732755cf13320f3987b77cf2a71e790 ]

While trying to get the uart with parity working I found setting even
parity enabled odd parity insted. Fix the register settings to match
the datasheet of AR9331.

A similar patch was created by 8devices, but not sent upstream.
https://github.com/8devices/openwrt-8devices/commit/77c5586ade3bb72cda010afad3f209ed0c98ea7c

Signed-off-by: Stefan Hellermann <stefan@the2masters.de>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/mach-ath79/ar933x_uart.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/mips/include/asm/mach-ath79/ar933x_uart.h b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
index c2917b39966bf..bba2c88379516 100644
--- a/arch/mips/include/asm/mach-ath79/ar933x_uart.h
+++ b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
@@ -27,8 +27,8 @@
 #define AR933X_UART_CS_PARITY_S		0
 #define AR933X_UART_CS_PARITY_M		0x3
 #define	  AR933X_UART_CS_PARITY_NONE	0
-#define	  AR933X_UART_CS_PARITY_ODD	1
-#define	  AR933X_UART_CS_PARITY_EVEN	2
+#define	  AR933X_UART_CS_PARITY_ODD	2
+#define	  AR933X_UART_CS_PARITY_EVEN	3
 #define AR933X_UART_CS_IF_MODE_S	2
 #define AR933X_UART_CS_IF_MODE_M	0x3
 #define	  AR933X_UART_CS_IF_MODE_NONE	0
-- 
GitLab


From 73ebefc814eff99bce4b69bd07320d5969381f02 Mon Sep 17 00:00:00 2001
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Date: Wed, 19 Jun 2019 15:08:18 +0100
Subject: [PATCH 0782/1835] MIPS: fix build on non-linux hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1196364f21ffe5d1e6d83cafd6a2edb89404a3ae ]

calc_vmlinuz_load_addr.c requires SZ_64K to be defined for alignment
purposes.  It included "../../../../include/linux/sizes.h" to define
that size, however "sizes.h" tries to include <linux/const.h> which
assumes linux system headers.  These may not exist eg. the following
error was encountered when building Linux for OpenWrt under macOS:

In file included from arch/mips/boot/compressed/calc_vmlinuz_load_addr.c:16:
arch/mips/boot/compressed/../../../../include/linux/sizes.h:11:10: fatal error: 'linux/const.h' file not found
         ^~~~~~~~~~

Change makefile to force building on local linux headers instead of
system headers.  Also change eye-watering relative reference in include
file spec.

Thanks to Jo-Philip Wich & Petr Štetiar for assistance in tracking this
down & fixing.

Suggested-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: linux-mips@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/boot/compressed/Makefile                 | 2 ++
 arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
index 3c453a1f1ff10..172801ed35b89 100644
--- a/arch/mips/boot/compressed/Makefile
+++ b/arch/mips/boot/compressed/Makefile
@@ -78,6 +78,8 @@ OBJCOPYFLAGS_piggy.o := --add-section=.image=$(obj)/vmlinux.bin.z \
 $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
 	$(call if_changed,objcopy)
 
+HOSTCFLAGS_calc_vmlinuz_load_addr.o += $(LINUXINCLUDE)
+
 # Calculate the load address of the compressed kernel image
 hostprogs-y := calc_vmlinuz_load_addr
 
diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
index 542c3ede97222..d14f75ec82732 100644
--- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
@@ -13,7 +13,7 @@
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include "../../../../include/linux/sizes.h"
+#include <linux/sizes.h>
 
 int main(int argc, char *argv[])
 {
-- 
GitLab


From 37cb02da44dca37829e714d03647e78fb3cdadc0 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Tue, 25 Jun 2019 21:20:17 -0700
Subject: [PATCH 0783/1835] arm64/efi: Mark __efistub_stext_offset as an
 absolute symbol explicitly

[ Upstream commit aa69fb62bea15126e744af2e02acc0d6cf3ed4da ]

After r363059 and r363928 in LLVM, a build using ld.lld as the linker
with CONFIG_RANDOMIZE_BASE enabled fails like so:

ld.lld: error: relocation R_AARCH64_ABS32 cannot be used against symbol
__efistub_stext_offset; recompile with -fPIC

Fangrui and Peter figured out that ld.lld is incorrectly considering
__efistub_stext_offset as a relative symbol because of the order in
which symbols are evaluated. _text is treated as an absolute symbol
and stext is a relative symbol, making __efistub_stext_offset a
relative symbol.

Adding ABSOLUTE will force ld.lld to evalute this expression in the
right context and does not change ld.bfd's behavior. ld.lld will
need to be fixed but the developers do not see a quick or simple fix
without some research (see the linked issue for further explanation).
Add this simple workaround so that ld.lld can continue to link kernels.

Link: https://github.com/ClangBuiltLinux/linux/issues/561
Link: https://github.com/llvm/llvm-project/commit/025a815d75d2356f2944136269aa5874721ec236
Link: https://github.com/llvm/llvm-project/commit/249fde85832c33f8b06c6b4ac65d1c4b96d23b83
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Debugged-by: Fangrui Song <maskray@google.com>
Debugged-by: Peter Smith <peter.smith@linaro.org>
Suggested-by: Fangrui Song <maskray@google.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
[will: add comment]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/image.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
index 8da289dc843a0..eff6a564ab808 100644
--- a/arch/arm64/kernel/image.h
+++ b/arch/arm64/kernel/image.h
@@ -73,7 +73,11 @@
 
 #ifdef CONFIG_EFI
 
-__efistub_stext_offset = stext - _text;
+/*
+ * Use ABSOLUTE() to avoid ld.lld treating this as a relative symbol:
+ * https://github.com/ClangBuiltLinux/linux/issues/561
+ */
+__efistub_stext_offset = ABSOLUTE(stext - _text);
 
 /*
  * The EFI stub has its own symbol namespace prefixed by __efistub_, to
-- 
GitLab


From 06e15cf5aeadffd205da71e2058d0e96540bc4a8 Mon Sep 17 00:00:00 2001
From: Maurizio Lombardi <mlombard@redhat.com>
Date: Wed, 26 Jun 2019 19:27:34 +0200
Subject: [PATCH 0784/1835] scsi: iscsi: set auth_protocol back to NULL if
 CHAP_A value is not supported

[ Upstream commit 5dd6c49339126c2c8df2179041373222362d6e49 ]

If the CHAP_A value is not supported, the chap_server_open() function
should free the auth_protocol pointer and set it to NULL, or we will leave
a dangling pointer around.

[   66.010905] Unsupported CHAP_A value
[   66.011660] Security negotiation failed.
[   66.012443] iSCSI Login negotiation failed.
[   68.413924] general protection fault: 0000 [#1] SMP PTI
[   68.414962] CPU: 0 PID: 1562 Comm: targetcli Kdump: loaded Not tainted 4.18.0-80.el8.x86_64 #1
[   68.416589] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[   68.417677] RIP: 0010:__kmalloc_track_caller+0xc2/0x210

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/iscsi/iscsi_target_auth.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index 4e680d753941f..e2fa3a3bc81df 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -89,6 +89,12 @@ out:
 	return CHAP_DIGEST_UNKNOWN;
 }
 
+static void chap_close(struct iscsi_conn *conn)
+{
+	kfree(conn->auth_protocol);
+	conn->auth_protocol = NULL;
+}
+
 static struct iscsi_chap *chap_server_open(
 	struct iscsi_conn *conn,
 	struct iscsi_node_auth *auth,
@@ -126,7 +132,7 @@ static struct iscsi_chap *chap_server_open(
 	case CHAP_DIGEST_UNKNOWN:
 	default:
 		pr_err("Unsupported CHAP_A value\n");
-		kfree(conn->auth_protocol);
+		chap_close(conn);
 		return NULL;
 	}
 
@@ -141,19 +147,13 @@ static struct iscsi_chap *chap_server_open(
 	 * Generate Challenge.
 	 */
 	if (chap_gen_challenge(conn, 1, aic_str, aic_len) < 0) {
-		kfree(conn->auth_protocol);
+		chap_close(conn);
 		return NULL;
 	}
 
 	return chap;
 }
 
-static void chap_close(struct iscsi_conn *conn)
-{
-	kfree(conn->auth_protocol);
-	conn->auth_protocol = NULL;
-}
-
 static int chap_server_compute_md5(
 	struct iscsi_conn *conn,
 	struct iscsi_node_auth *auth,
-- 
GitLab


From 09593c25b975458025fd4cd15d5861cbaa33683d Mon Sep 17 00:00:00 2001
From: Sven Van Asbroeck <thesven73@gmail.com>
Date: Mon, 24 Jun 2019 10:07:31 -0400
Subject: [PATCH 0785/1835] dmaengine: imx-sdma: fix use-after-free on probe
 error path

[ Upstream commit 2b8066c3deb9140fdf258417a51479b2aeaa7622 ]

If probe() fails anywhere beyond the point where
sdma_get_firmware() is called, then a kernel oops may occur.

Problematic sequence of events:
1. probe() calls sdma_get_firmware(), which schedules the
   firmware callback to run when firmware becomes available,
   using the sdma instance structure as the context
2. probe() encounters an error, which deallocates the
   sdma instance structure
3. firmware becomes available, firmware callback is
   called with deallocated sdma instance structure
4. use after free - kernel oops !

Solution: only attempt to load firmware when we're certain
that probe() will succeed. This guarantees that the firmware
callback's context will remain valid.

Note that the remove() path is unaffected by this issue: the
firmware loader will increment the driver module's use count,
ensuring that the module cannot be unloaded while the
firmware callback is pending or running.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
[vkoul: fixed braces for if condition]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/imx-sdma.c | 48 ++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 21 deletions(-)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 1c658ec3cbf42..3f5a01cb4ab45 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -2039,27 +2039,6 @@ static int sdma_probe(struct platform_device *pdev)
 	if (pdata && pdata->script_addrs)
 		sdma_add_scripts(sdma, pdata->script_addrs);
 
-	if (pdata) {
-		ret = sdma_get_firmware(sdma, pdata->fw_name);
-		if (ret)
-			dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
-	} else {
-		/*
-		 * Because that device tree does not encode ROM script address,
-		 * the RAM script in firmware is mandatory for device tree
-		 * probe, otherwise it fails.
-		 */
-		ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
-					      &fw_name);
-		if (ret)
-			dev_warn(&pdev->dev, "failed to get firmware name\n");
-		else {
-			ret = sdma_get_firmware(sdma, fw_name);
-			if (ret)
-				dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
-		}
-	}
-
 	sdma->dma_device.dev = &pdev->dev;
 
 	sdma->dma_device.device_alloc_chan_resources = sdma_alloc_chan_resources;
@@ -2103,6 +2082,33 @@ static int sdma_probe(struct platform_device *pdev)
 		of_node_put(spba_bus);
 	}
 
+	/*
+	 * Kick off firmware loading as the very last step:
+	 * attempt to load firmware only if we're not on the error path, because
+	 * the firmware callback requires a fully functional and allocated sdma
+	 * instance.
+	 */
+	if (pdata) {
+		ret = sdma_get_firmware(sdma, pdata->fw_name);
+		if (ret)
+			dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
+	} else {
+		/*
+		 * Because that device tree does not encode ROM script address,
+		 * the RAM script in firmware is mandatory for device tree
+		 * probe, otherwise it fails.
+		 */
+		ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
+					      &fw_name);
+		if (ret) {
+			dev_warn(&pdev->dev, "failed to get firmware name\n");
+		} else {
+			ret = sdma_get_firmware(sdma, fw_name);
+			if (ret)
+				dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
+		}
+	}
+
 	return 0;
 
 err_register:
-- 
GitLab


From 009edc622bba324631351e829c740a9b83eabf36 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Date: Mon, 15 Apr 2019 09:56:46 -0500
Subject: [PATCH 0786/1835] wil6210: fix potential out-of-bounds read

[ Upstream commit bfabdd6997323adbedccb13a3fed1967fb8cf8f5 ]

Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:

enum gro_result {
        GRO_MERGED,
        GRO_MERGED_FREE,
        GRO_HELD,
        GRO_NORMAL,
        GRO_DROP,
        GRO_CONSUMED,
};
typedef enum gro_result gro_result_t;

In case *rc* evaluates to 5, we end up having an out-of-bounds read
at drivers/net/wireless/ath/wil6210/txrx.c:821:

	wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
		     len, gro_res_str[rc]);

Fix this by adding element "GRO_CONSUMED" to array gro_res_str.

Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Reviewed-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wil6210/txrx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 75c8aa2971071..1b1b58e0129a3 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -736,6 +736,7 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
 		[GRO_HELD]		= "GRO_HELD",
 		[GRO_NORMAL]		= "GRO_NORMAL",
 		[GRO_DROP]		= "GRO_DROP",
+		[GRO_CONSUMED]		= "GRO_CONSUMED",
 	};
 
 	wil->txrx_ops.get_netif_rx_params(skb, &cid, &security);
-- 
GitLab


From 7e19e658e535d19f3e038a52606e10d5442b936a Mon Sep 17 00:00:00 2001
From: Surabhi Vishnoi <svishnoi@codeaurora.org>
Date: Wed, 17 Apr 2019 14:01:46 +0530
Subject: [PATCH 0787/1835] ath10k: Do not send probe response template for
 mesh

[ Upstream commit 97354f2c432788e3163134df6bb144f4b6289d87 ]

Currently mac80211 do not support probe response template for
mesh point. When WMI_SERVICE_BEACON_OFFLOAD is enabled, host
driver tries to configure probe response template for mesh, but
it fails because the interface type is not NL80211_IFTYPE_AP but
NL80211_IFTYPE_MESH_POINT.

To avoid this failure, skip sending probe response template to
firmware for mesh point.

Tested HW: WCN3990/QCA6174/QCA9984

Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index f3b1cfacfe9df..1419f9d1505fe 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1624,6 +1624,10 @@ static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
 	if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
 		return 0;
 
+	 /* For mesh, probe response and beacon share the same template */
+	if (ieee80211_vif_is_mesh(vif))
+		return 0;
+
 	prb = ieee80211_proberesp_get(hw, vif);
 	if (!prb) {
 		ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
-- 
GitLab


From 42dcbf20e182329f88e681f3c2870898151ec80d Mon Sep 17 00:00:00 2001
From: Tim Schumacher <timschumi@gmx.de>
Date: Mon, 18 Mar 2019 20:05:57 +0100
Subject: [PATCH 0788/1835] ath9k: Check for errors when reading SREV register

[ Upstream commit 2f90c7e5d09437a4d8d5546feaae9f1cf48cfbe1 ]

Right now, if an error is encountered during the SREV register
read (i.e. an EIO in ath9k_regread()), that error code gets
passed all the way to __ath9k_hw_init(), where it is visible
during the "Chip rev not supported" message.

    ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits
    ath: phy2: Mac Chip Rev 0x0f.3 is not supported by this driver
    ath: phy2: Unable to initialize hardware; initialization status: -95
    ath: phy2: Unable to initialize hardware; initialization status: -95
    ath9k_htc: Failed to initialize the device

Check for -EIO explicitly in ath9k_hw_read_revisions() and return
a boolean based on the success of the operation. Check for that in
__ath9k_hw_init() and abort with a more debugging-friendly message
if reading the revisions wasn't successful.

    ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits
    ath: phy2: Failed to read SREV register
    ath: phy2: Could not read hardware revision
    ath: phy2: Unable to initialize hardware; initialization status: -95
    ath: phy2: Unable to initialize hardware; initialization status: -95
    ath9k_htc: Failed to initialize the device

This helps when debugging by directly showing the first point of
failure and it could prevent possible errors if a 0x0f.3 revision
is ever supported.

Signed-off-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/hw.c | 32 +++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index bb319f22761fb..b4f7ee423d407 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -252,8 +252,9 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
 /* Chip Revisions */
 /******************/
 
-static void ath9k_hw_read_revisions(struct ath_hw *ah)
+static bool ath9k_hw_read_revisions(struct ath_hw *ah)
 {
+	u32 srev;
 	u32 val;
 
 	if (ah->get_mac_revision)
@@ -269,25 +270,33 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
 			val = REG_READ(ah, AR_SREV);
 			ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
 		}
-		return;
+		return true;
 	case AR9300_DEVID_AR9340:
 		ah->hw_version.macVersion = AR_SREV_VERSION_9340;
-		return;
+		return true;
 	case AR9300_DEVID_QCA955X:
 		ah->hw_version.macVersion = AR_SREV_VERSION_9550;
-		return;
+		return true;
 	case AR9300_DEVID_AR953X:
 		ah->hw_version.macVersion = AR_SREV_VERSION_9531;
-		return;
+		return true;
 	case AR9300_DEVID_QCA956X:
 		ah->hw_version.macVersion = AR_SREV_VERSION_9561;
-		return;
+		return true;
 	}
 
-	val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
+	srev = REG_READ(ah, AR_SREV);
+
+	if (srev == -EIO) {
+		ath_err(ath9k_hw_common(ah),
+			"Failed to read SREV register");
+		return false;
+	}
+
+	val = srev & AR_SREV_ID;
 
 	if (val == 0xFF) {
-		val = REG_READ(ah, AR_SREV);
+		val = srev;
 		ah->hw_version.macVersion =
 			(val & AR_SREV_VERSION2) >> AR_SREV_TYPE2_S;
 		ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
@@ -306,6 +315,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
 		if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCIE)
 			ah->is_pciexpress = true;
 	}
+
+	return true;
 }
 
 /************************************/
@@ -559,7 +570,10 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 	struct ath_common *common = ath9k_hw_common(ah);
 	int r = 0;
 
-	ath9k_hw_read_revisions(ah);
+	if (!ath9k_hw_read_revisions(ah)) {
+		ath_err(common, "Could not read hardware revisions");
+		return -EOPNOTSUPP;
+	}
 
 	switch (ah->hw_version.macVersion) {
 	case AR_SREV_VERSION_5416_PCI:
-- 
GitLab


From 83c911f4bd6846397017aa38c32dd18dc532f754 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 4 Apr 2019 11:56:51 +0300
Subject: [PATCH 0789/1835] ath6kl: add some bounds checking

[ Upstream commit 5d6751eaff672ea77642e74e92e6c0ac7f9709ab ]

The "ev->traffic_class" and "reply->ac" variables come from the network
and they're used as an offset into the wmi->stream_exist_for_ac[] array.
Those variables are u8 so they can be 0-255 but the stream_exist_for_ac[]
array only has WMM_NUM_AC (4) elements.  We need to add a couple bounds
checks to prevent array overflows.

I also modified one existing check from "if (traffic_class > 3) {" to
"if (traffic_class >= WMM_NUM_AC) {" just to make them all consistent.

Fixes: bdcd81707973 (" Add ath6kl cleaned up driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath6kl/wmi.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 777acc564ac99..bc7916f2add09 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1178,6 +1178,10 @@ static int ath6kl_wmi_pstream_timeout_event_rx(struct wmi *wmi, u8 *datap,
 		return -EINVAL;
 
 	ev = (struct wmi_pstream_timeout_event *) datap;
+	if (ev->traffic_class >= WMM_NUM_AC) {
+		ath6kl_err("invalid traffic class: %d\n", ev->traffic_class);
+		return -EINVAL;
+	}
 
 	/*
 	 * When the pstream (fat pipe == AC) timesout, it means there were
@@ -1519,6 +1523,10 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len,
 		return -EINVAL;
 
 	reply = (struct wmi_cac_event *) datap;
+	if (reply->ac >= WMM_NUM_AC) {
+		ath6kl_err("invalid AC: %d\n", reply->ac);
+		return -EINVAL;
+	}
 
 	if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
 	    (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) {
@@ -2635,7 +2643,7 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
 	u16 active_tsids = 0;
 	int ret;
 
-	if (traffic_class > 3) {
+	if (traffic_class >= WMM_NUM_AC) {
 		ath6kl_err("invalid traffic class: %d\n", traffic_class);
 		return -EINVAL;
 	}
-- 
GitLab


From a4bf4fecff16f30814922679a131331f2c3aabf8 Mon Sep 17 00:00:00 2001
From: Wen Gong <wgong@codeaurora.org>
Date: Mon, 29 Apr 2019 19:17:12 +0800
Subject: [PATCH 0790/1835] ath10k: add peer id check in ath10k_peer_find_by_id

[ Upstream commit 49ed34b835e231aa941257394716bc689bc98d9f ]

For some SDIO chip, the peer id is 65535 for MPDU with error status,
then test_bit will trigger buffer overflow for peer's memory, if kasan
enabled, it will report error.

Reason is when station is in disconnecting status, firmware do not delete
the peer info since it not disconnected completely, meanwhile some AP will
still send data packet to station, then hardware will receive the packet
and send to firmware, firmware's logic will report peer id of 65535 for
MPDU with error status.

Add check for overflow the size of peer's peer_ids will avoid the buffer
overflow access.

Call trace of kasan:
dump_backtrace+0x0/0x2ec
show_stack+0x20/0x2c
__dump_stack+0x20/0x28
dump_stack+0xc8/0xec
print_address_description+0x74/0x240
kasan_report+0x250/0x26c
__asan_report_load8_noabort+0x20/0x2c
ath10k_peer_find_by_id+0x180/0x1e4 [ath10k_core]
ath10k_htt_t2h_msg_handler+0x100c/0x2fd4 [ath10k_core]
ath10k_htt_htc_t2h_msg_handler+0x20/0x34 [ath10k_core]
ath10k_sdio_irq_handler+0xcc8/0x1678 [ath10k_sdio]
process_sdio_pending_irqs+0xec/0x370
sdio_run_irqs+0x68/0xe4
sdio_irq_work+0x1c/0x28
process_one_work+0x3d8/0x8b0
worker_thread+0x508/0x7cc
kthread+0x24c/0x264
ret_from_fork+0x10/0x18

Tested with QCA6174 SDIO with firmware
WLAN.RMH.4.4.1-00007-QCARMSWP-1.

Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/txrx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index cda164f6e9f62..6f62ddc0494c3 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -156,6 +156,9 @@ struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar, int peer_id)
 {
 	struct ath10k_peer *peer;
 
+	if (peer_id >= BITS_PER_TYPE(peer->peer_ids))
+		return NULL;
+
 	lockdep_assert_held(&ar->data_lock);
 
 	list_for_each_entry(peer, &ar->peers, list)
-- 
GitLab


From da153c0c57460313327864d13e1b4501c1678683 Mon Sep 17 00:00:00 2001
From: Maya Erez <merez@codeaurora.org>
Date: Fri, 26 Apr 2019 18:43:29 +0300
Subject: [PATCH 0791/1835] wil6210: fix spurious interrupts in 3-msi

[ Upstream commit e10b0eddd5235aa5aef4e40b970e34e735611a80 ]

Interrupt is set in ICM (ICR & ~IMV) rising trigger.
As the driver masks the IRQ after clearing it, there can
be a race where an additional spurious interrupt is triggered
when the driver unmask the IRQ.
This can happen in case HW triggers an interrupt after the clear
and before the mask.

To prevent the second spurious interrupt the driver needs to mask the
IRQ before reading and clearing it.

Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wil6210/interrupt.c | 65 ++++++++++++--------
 1 file changed, 40 insertions(+), 25 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 5d287a8e1b458..0655cd8845142 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -296,21 +296,24 @@ void wil_configure_interrupt_moderation(struct wil6210_priv *wil)
 static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
 {
 	struct wil6210_priv *wil = cookie;
-	u32 isr = wil_ioread32_and_clear(wil->csr +
-					 HOSTADDR(RGF_DMA_EP_RX_ICR) +
-					 offsetof(struct RGF_ICR, ICR));
+	u32 isr;
 	bool need_unmask = true;
 
+	wil6210_mask_irq_rx(wil);
+
+	isr = wil_ioread32_and_clear(wil->csr +
+				     HOSTADDR(RGF_DMA_EP_RX_ICR) +
+				     offsetof(struct RGF_ICR, ICR));
+
 	trace_wil6210_irq_rx(isr);
 	wil_dbg_irq(wil, "ISR RX 0x%08x\n", isr);
 
 	if (unlikely(!isr)) {
 		wil_err_ratelimited(wil, "spurious IRQ: RX\n");
+		wil6210_unmask_irq_rx(wil);
 		return IRQ_NONE;
 	}
 
-	wil6210_mask_irq_rx(wil);
-
 	/* RX_DONE and RX_HTRSH interrupts are the same if interrupt
 	 * moderation is not used. Interrupt moderation may cause RX
 	 * buffer overflow while RX_DONE is delayed. The required
@@ -355,21 +358,24 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
 static irqreturn_t wil6210_irq_rx_edma(int irq, void *cookie)
 {
 	struct wil6210_priv *wil = cookie;
-	u32 isr = wil_ioread32_and_clear(wil->csr +
-					 HOSTADDR(RGF_INT_GEN_RX_ICR) +
-					 offsetof(struct RGF_ICR, ICR));
+	u32 isr;
 	bool need_unmask = true;
 
+	wil6210_mask_irq_rx_edma(wil);
+
+	isr = wil_ioread32_and_clear(wil->csr +
+				     HOSTADDR(RGF_INT_GEN_RX_ICR) +
+				     offsetof(struct RGF_ICR, ICR));
+
 	trace_wil6210_irq_rx(isr);
 	wil_dbg_irq(wil, "ISR RX 0x%08x\n", isr);
 
 	if (unlikely(!isr)) {
 		wil_err(wil, "spurious IRQ: RX\n");
+		wil6210_unmask_irq_rx_edma(wil);
 		return IRQ_NONE;
 	}
 
-	wil6210_mask_irq_rx_edma(wil);
-
 	if (likely(isr & BIT_RX_STATUS_IRQ)) {
 		wil_dbg_irq(wil, "RX status ring\n");
 		isr &= ~BIT_RX_STATUS_IRQ;
@@ -403,21 +409,24 @@ static irqreturn_t wil6210_irq_rx_edma(int irq, void *cookie)
 static irqreturn_t wil6210_irq_tx_edma(int irq, void *cookie)
 {
 	struct wil6210_priv *wil = cookie;
-	u32 isr = wil_ioread32_and_clear(wil->csr +
-					 HOSTADDR(RGF_INT_GEN_TX_ICR) +
-					 offsetof(struct RGF_ICR, ICR));
+	u32 isr;
 	bool need_unmask = true;
 
+	wil6210_mask_irq_tx_edma(wil);
+
+	isr = wil_ioread32_and_clear(wil->csr +
+				     HOSTADDR(RGF_INT_GEN_TX_ICR) +
+				     offsetof(struct RGF_ICR, ICR));
+
 	trace_wil6210_irq_tx(isr);
 	wil_dbg_irq(wil, "ISR TX 0x%08x\n", isr);
 
 	if (unlikely(!isr)) {
 		wil_err(wil, "spurious IRQ: TX\n");
+		wil6210_unmask_irq_tx_edma(wil);
 		return IRQ_NONE;
 	}
 
-	wil6210_mask_irq_tx_edma(wil);
-
 	if (likely(isr & BIT_TX_STATUS_IRQ)) {
 		wil_dbg_irq(wil, "TX status ring\n");
 		isr &= ~BIT_TX_STATUS_IRQ;
@@ -446,21 +455,24 @@ static irqreturn_t wil6210_irq_tx_edma(int irq, void *cookie)
 static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
 {
 	struct wil6210_priv *wil = cookie;
-	u32 isr = wil_ioread32_and_clear(wil->csr +
-					 HOSTADDR(RGF_DMA_EP_TX_ICR) +
-					 offsetof(struct RGF_ICR, ICR));
+	u32 isr;
 	bool need_unmask = true;
 
+	wil6210_mask_irq_tx(wil);
+
+	isr = wil_ioread32_and_clear(wil->csr +
+				     HOSTADDR(RGF_DMA_EP_TX_ICR) +
+				     offsetof(struct RGF_ICR, ICR));
+
 	trace_wil6210_irq_tx(isr);
 	wil_dbg_irq(wil, "ISR TX 0x%08x\n", isr);
 
 	if (unlikely(!isr)) {
 		wil_err_ratelimited(wil, "spurious IRQ: TX\n");
+		wil6210_unmask_irq_tx(wil);
 		return IRQ_NONE;
 	}
 
-	wil6210_mask_irq_tx(wil);
-
 	if (likely(isr & BIT_DMA_EP_TX_ICR_TX_DONE)) {
 		wil_dbg_irq(wil, "TX done\n");
 		isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
@@ -532,20 +544,23 @@ static bool wil_validate_mbox_regs(struct wil6210_priv *wil)
 static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
 {
 	struct wil6210_priv *wil = cookie;
-	u32 isr = wil_ioread32_and_clear(wil->csr +
-					 HOSTADDR(RGF_DMA_EP_MISC_ICR) +
-					 offsetof(struct RGF_ICR, ICR));
+	u32 isr;
+
+	wil6210_mask_irq_misc(wil, false);
+
+	isr = wil_ioread32_and_clear(wil->csr +
+				     HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+				     offsetof(struct RGF_ICR, ICR));
 
 	trace_wil6210_irq_misc(isr);
 	wil_dbg_irq(wil, "ISR MISC 0x%08x\n", isr);
 
 	if (!isr) {
 		wil_err(wil, "spurious IRQ: MISC\n");
+		wil6210_unmask_irq_misc(wil, false);
 		return IRQ_NONE;
 	}
 
-	wil6210_mask_irq_misc(wil, false);
-
 	if (isr & ISR_MISC_FW_ERROR) {
 		u32 fw_assert_code = wil_r(wil, wil->rgf_fw_assert_code_addr);
 		u32 ucode_assert_code =
-- 
GitLab


From 2b5b12c0c1b76f7a70e87e0b8502e13b20a8d1c1 Mon Sep 17 00:00:00 2001
From: Anilkumar Kolli <akolli@codeaurora.org>
Date: Wed, 6 Mar 2019 23:06:11 +0530
Subject: [PATCH 0792/1835] ath: DFS JP domain W56 fixed pulse type 3 RADAR
 detection

[ Upstream commit d8792393a783158cbb2c39939cb897dc5e5299b6 ]

Increase pulse width range from 1-2usec to 0-4usec.
During data traffic HW occasionally fails detecting radar pulses,
so that SW cannot get enough radar reports to achieve the success rate.

Tested ath10k hw and fw:
	* QCA9888(10.4-3.5.1-00052)
	* QCA4019(10.4-3.2.1.1-00017)
	* QCA9984(10.4-3.6-00104)
	* QCA988X(10.2.4-1.0-00041)

Tested ath9k hw: AR9300

Tested-by: Tamizh chelvam <tamizhr@codeaurora.org>
Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/dfs_pattern_detector.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index d52b31b45df7d..a274eb0d19688 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -111,7 +111,7 @@ static const struct radar_detector_specs jp_radar_ref_types[] = {
 	JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18, 29, false),
 	JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18, 29, false),
 	JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18, 50, false),
-	JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18, 50, false),
+	JP_PATTERN(3, 0, 4, 4000, 4000, 1, 18, 50, false),
 	JP_PATTERN(4, 0, 5, 150, 230, 1, 23, 50, false),
 	JP_PATTERN(5, 6, 10, 200, 500, 1, 16, 50, false),
 	JP_PATTERN(6, 11, 20, 200, 500, 1, 12, 50, false),
-- 
GitLab


From 83d133c96aad15a0f3473ec8a678be549bc83917 Mon Sep 17 00:00:00 2001
From: Daniel Baluta <daniel.baluta@nxp.com>
Date: Fri, 17 May 2019 13:23:49 +0000
Subject: [PATCH 0793/1835] regmap: debugfs: Fix memory leak in
 regmap_debugfs_init

[ Upstream commit 2899872b627e99b7586fe3b6c9f861da1b4d5072 ]

As detected by kmemleak running on i.MX6ULL board:

nreferenced object 0xd8366600 (size 64):
  comm "swapper/0", pid 1, jiffies 4294937370 (age 933.220s)
  hex dump (first 32 bytes):
    64 75 6d 6d 79 2d 69 6f 6d 75 78 63 2d 67 70 72  dummy-iomuxc-gpr
    40 32 30 65 34 30 30 30 00 e3 f3 ab fe d1 1b dd  @20e4000........
  backtrace:
    [<b0402aec>] kasprintf+0x2c/0x54
    [<a6fbad2c>] regmap_debugfs_init+0x7c/0x31c
    [<9c8d91fa>] __regmap_init+0xb5c/0xcf4
    [<5b1c3d2a>] of_syscon_register+0x164/0x2c4
    [<596a5d80>] syscon_node_to_regmap+0x64/0x90
    [<49bd597b>] imx6ul_init_machine+0x34/0xa0
    [<250a4dac>] customize_machine+0x1c/0x30
    [<2d19fdaf>] do_one_initcall+0x7c/0x398
    [<e6084469>] kernel_init_freeable+0x328/0x448
    [<168c9101>] kernel_init+0x8/0x114
    [<913268aa>] ret_from_fork+0x14/0x20
    [<ce7b131a>] 0x0

Root cause is that map->debugfs_name is allocated using kasprintf
and then the pointer is lost by assigning it other memory address.

Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap-debugfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 87b562e49a435..c9687c8b23478 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -575,6 +575,8 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
 	}
 
 	if (!strcmp(name, "dummy")) {
+		kfree(map->debugfs_name);
+
 		map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
 						dummy_index);
 		name = map->debugfs_name;
-- 
GitLab


From 8f855c09e2af371d5fd075ad00b73990776be3a7 Mon Sep 17 00:00:00 2001
From: Jeremy Sowden <jeremy@azazel.net>
Date: Tue, 21 May 2019 20:58:57 +0100
Subject: [PATCH 0794/1835] batman-adv: fix for leaked TVLV handler.

[ Upstream commit 17f78dd1bd624a4dd78ed5db3284a63ee807fcc3 ]

A handler for BATADV_TVLV_ROAM was being registered when the
translation-table was initialized, but not unregistered when the
translation-table was freed.  Unregister it.

Fixes: 122edaa05940 ("batman-adv: tvlv - convert roaming adv packet to use tvlv unicast packets")
Reported-by: syzbot+d454a826e670502484b8@syzkaller.appspotmail.com
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/batman-adv/translation-table.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 359ec1a6e822f..9fa5389ea244c 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3821,6 +3821,8 @@ static void batadv_tt_purge(struct work_struct *work)
  */
 void batadv_tt_free(struct batadv_priv *bat_priv)
 {
+	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1);
+
 	batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1);
 	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1);
 
-- 
GitLab


From 94f2b518a7882f562537796b77e3ce6a6461236d Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 30 Apr 2019 09:07:36 -0400
Subject: [PATCH 0795/1835] media: dvb: usb: fix use after free in
 dvb_usb_device_exit

[ Upstream commit 6cf97230cd5f36b7665099083272595c55d72be7 ]

dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+26ec41e9f788b3eba396@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/dvb-usb-init.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
index 40ca4eafb1374..39ac22486bcd9 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
@@ -287,12 +287,15 @@ EXPORT_SYMBOL(dvb_usb_device_init);
 void dvb_usb_device_exit(struct usb_interface *intf)
 {
 	struct dvb_usb_device *d = usb_get_intfdata(intf);
-	const char *name = "generic DVB-USB module";
+	const char *default_name = "generic DVB-USB module";
+	char name[40];
 
 	usb_set_intfdata(intf, NULL);
 	if (d != NULL && d->desc != NULL) {
-		name = d->desc->name;
+		strscpy(name, d->desc->name, sizeof(name));
 		dvb_usb_exit(d);
+	} else {
+		strscpy(name, default_name, sizeof(name));
 	}
 	info("%s successfully deinitialized and disconnected.", name);
 
-- 
GitLab


From 6452712f95e354c573192f75c858ddef1b2ea78c Mon Sep 17 00:00:00 2001
From: Daniel Gomez <dagmcr@gmail.com>
Date: Mon, 22 Apr 2019 15:10:20 -0400
Subject: [PATCH 0796/1835] media: spi: IR LED: add missing of table
 registration

[ Upstream commit 24e4cf770371df6ad49ed873f21618d9878f64c8 ]

MODULE_DEVICE_TABLE(of, <of_match_table> should be called to complete DT
OF mathing mechanism and register it.

Before this patch:
modinfo drivers/media/rc/ir-spi.ko  | grep alias

After this patch:
modinfo drivers/media/rc/ir-spi.ko  | grep alias
alias:          of:N*T*Cir-spi-ledC*
alias:          of:N*T*Cir-spi-led

Reported-by: Javier Martinez Canillas <javier@dowhile0.org>
Signed-off-by: Daniel Gomez <dagmcr@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ir-spi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/rc/ir-spi.c b/drivers/media/rc/ir-spi.c
index 66334e8d63baa..c58f2d38a4582 100644
--- a/drivers/media/rc/ir-spi.c
+++ b/drivers/media/rc/ir-spi.c
@@ -161,6 +161,7 @@ static const struct of_device_id ir_spi_of_match[] = {
 	{ .compatible = "ir-spi-led" },
 	{},
 };
+MODULE_DEVICE_TABLE(of, ir_spi_of_match);
 
 static struct spi_driver ir_spi_driver = {
 	.probe = ir_spi_probe,
-- 
GitLab


From b0e199e13495fb20c5c9764b6049648e87e2a64d Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Wed, 15 May 2019 12:29:03 +0000
Subject: [PATCH 0797/1835] crypto: talitos - fix skcipher failure due to wrong
 output IV
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3e03e792865ae48b8cfc69a0b4d65f02f467389f ]

Selftests report the following:

[    2.984845] alg: skcipher: cbc-aes-talitos encryption test failed (wrong output IV) on test vector 0, cfg="in-place"
[    2.995377] 00000000: 3d af ba 42 9d 9e b4 30 b4 22 da 80 2c 9f ac 41
[    3.032673] alg: skcipher: cbc-des-talitos encryption test failed (wrong output IV) on test vector 0, cfg="in-place"
[    3.043185] 00000000: fe dc ba 98 76 54 32 10
[    3.063238] alg: skcipher: cbc-3des-talitos encryption test failed (wrong output IV) on test vector 0, cfg="in-place"
[    3.073818] 00000000: 7d 33 88 93 0f 93 b2 42

This above dumps show that the actual output IV is indeed the input IV.
This is due to the IV not being copied back into the request.

This patch fixes that.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 5849075d54c7c..d46f58c134334 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1553,11 +1553,15 @@ static void ablkcipher_done(struct device *dev,
 			    int err)
 {
 	struct ablkcipher_request *areq = context;
+	struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
+	struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
+	unsigned int ivsize = crypto_ablkcipher_ivsize(cipher);
 	struct talitos_edesc *edesc;
 
 	edesc = container_of(desc, struct talitos_edesc, desc);
 
 	common_nonsnoop_unmap(dev, edesc, areq);
+	memcpy(areq->info, ctx->iv, ivsize);
 
 	kfree(edesc);
 
-- 
GitLab


From add712b63185608ed961d8d58656164a89288d6f Mon Sep 17 00:00:00 2001
From: Akinobu Mita <akinobu.mita@gmail.com>
Date: Wed, 17 Apr 2019 10:06:39 -0400
Subject: [PATCH 0798/1835] media: ov7740: avoid invalid framesize setting

[ Upstream commit 6e4ab830ac6d6a0d7cd7f87dc5d6536369bf24a8 ]

If the requested framesize by VIDIOC_SUBDEV_S_FMT is larger than supported
framesizes, it causes an out of bounds array access and the resulting
framesize is unexpected.

Avoid out of bounds array access and select the default framesize.

Cc: Wenyou Yang <wenyou.yang@microchip.com>
Cc: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov7740.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
index f5a1ee90a6c5e..8a6a7a5929aa3 100644
--- a/drivers/media/i2c/ov7740.c
+++ b/drivers/media/i2c/ov7740.c
@@ -761,7 +761,11 @@ static int ov7740_try_fmt_internal(struct v4l2_subdev *sd,
 
 		fsize++;
 	}
-
+	if (i >= ARRAY_SIZE(ov7740_framesizes)) {
+		fsize = &ov7740_framesizes[0];
+		fmt->width = fsize->width;
+		fmt->height = fsize->height;
+	}
 	if (ret_frmsize != NULL)
 		*ret_frmsize = fsize;
 
-- 
GitLab


From 70da38e8050920c833826c41f9cc06aa5e43ebdd Mon Sep 17 00:00:00 2001
From: Lubomir Rintel <lkundrak@v3.sk>
Date: Sun, 5 May 2019 10:00:23 -0400
Subject: [PATCH 0799/1835] media: marvell-ccic: fix DMA s/g desc number
 calculation

[ Upstream commit 0c7aa32966dab0b8a7424e1b34c7f206817953ec ]

The commit d790b7eda953 ("[media] vb2-dma-sg: move dma_(un)map_sg here")
left dma_desc_nent unset. It previously contained the number of DMA
descriptors as returned from dma_map_sg().

We can now (since the commit referred to above) obtain the same value from
the sg_table and drop dma_desc_nent altogether.

Tested on OLPC XO-1.75 machine. Doesn't affect the OLPC XO-1's Cafe
driver, since that one doesn't do DMA.

[mchehab+samsung@kernel.org: fix a checkpatch warning]

Fixes: d790b7eda953 ("[media] vb2-dma-sg: move dma_(un)map_sg here")
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/marvell-ccic/mcam-core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c
index dfdbd4354b74c..eeee15ff007d8 100644
--- a/drivers/media/platform/marvell-ccic/mcam-core.c
+++ b/drivers/media/platform/marvell-ccic/mcam-core.c
@@ -200,7 +200,6 @@ struct mcam_vb_buffer {
 	struct list_head queue;
 	struct mcam_dma_desc *dma_desc;	/* Descriptor virtual address */
 	dma_addr_t dma_desc_pa;		/* Descriptor physical address */
-	int dma_desc_nent;		/* Number of mapped descriptors */
 };
 
 static inline struct mcam_vb_buffer *vb_to_mvb(struct vb2_v4l2_buffer *vb)
@@ -608,9 +607,11 @@ static void mcam_dma_contig_done(struct mcam_camera *cam, int frame)
 static void mcam_sg_next_buffer(struct mcam_camera *cam)
 {
 	struct mcam_vb_buffer *buf;
+	struct sg_table *sg_table;
 
 	buf = list_first_entry(&cam->buffers, struct mcam_vb_buffer, queue);
 	list_del_init(&buf->queue);
+	sg_table = vb2_dma_sg_plane_desc(&buf->vb_buf.vb2_buf, 0);
 	/*
 	 * Very Bad Not Good Things happen if you don't clear
 	 * C1_DESC_ENA before making any descriptor changes.
@@ -618,7 +619,7 @@ static void mcam_sg_next_buffer(struct mcam_camera *cam)
 	mcam_reg_clear_bit(cam, REG_CTRL1, C1_DESC_ENA);
 	mcam_reg_write(cam, REG_DMA_DESC_Y, buf->dma_desc_pa);
 	mcam_reg_write(cam, REG_DESC_LEN_Y,
-			buf->dma_desc_nent*sizeof(struct mcam_dma_desc));
+			sg_table->nents * sizeof(struct mcam_dma_desc));
 	mcam_reg_write(cam, REG_DESC_LEN_U, 0);
 	mcam_reg_write(cam, REG_DESC_LEN_V, 0);
 	mcam_reg_set_bit(cam, REG_CTRL1, C1_DESC_ENA);
-- 
GitLab


From 6fb470ace862bbadb756b178019d496b10fa01cc Mon Sep 17 00:00:00 2001
From: Kangjie Lu <kjlu@umn.edu>
Date: Fri, 22 Mar 2019 22:51:06 -0400
Subject: [PATCH 0800/1835] media: vpss: fix a potential NULL pointer
 dereference

[ Upstream commit e08f0761234def47961d3252eac09ccedfe4c6a0 ]

In case ioremap fails, the fix returns -ENOMEM to avoid NULL
pointer dereference.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpss.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c
index 19cf6853411e2..89a86c19579b8 100644
--- a/drivers/media/platform/davinci/vpss.c
+++ b/drivers/media/platform/davinci/vpss.c
@@ -518,6 +518,11 @@ static int __init vpss_init(void)
 		return -EBUSY;
 
 	oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4);
+	if (unlikely(!oper_cfg.vpss_regs_base2)) {
+		release_mem_region(VPSS_CLK_CTRL, 4);
+		return -ENOMEM;
+	}
+
 	writel(VPSS_CLK_CTRL_VENCCLKEN |
 		     VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
 
-- 
GitLab


From 810441651a8a289655aa0f1e107e5d802090231f Mon Sep 17 00:00:00 2001
From: Jungo Lin <jungo.lin@mediatek.com>
Date: Tue, 2 Apr 2019 21:44:27 -0400
Subject: [PATCH 0801/1835] media: media_device_enum_links32: clean a reserved
 field

[ Upstream commit f49308878d7202e07d8761238e01bd0e5fce2750 ]

In v4l2-compliance utility, test MEDIA_IOC_ENUM_ENTITIES
will check whether reserved field of media_links_enum filled
with zero.

However, for 32 bit program, the reserved field is missing
copy from kernel space to user space in media_device_enum_links32
function.

This patch adds the cleaning a reserved field logic in
media_device_enum_links32 function.

Signed-off-by: Jungo Lin <jungo.lin@mediatek.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/media-device.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 3bae24b15eaa4..ba344e6f0139a 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -487,6 +487,7 @@ static long media_device_enum_links32(struct media_device *mdev,
 {
 	struct media_links_enum links;
 	compat_uptr_t pads_ptr, links_ptr;
+	int ret;
 
 	memset(&links, 0, sizeof(links));
 
@@ -498,7 +499,13 @@ static long media_device_enum_links32(struct media_device *mdev,
 	links.pads = compat_ptr(pads_ptr);
 	links.links = compat_ptr(links_ptr);
 
-	return media_device_enum_links(mdev, &links);
+	ret = media_device_enum_links(mdev, &links);
+	if (ret)
+		return ret;
+
+	memset(ulinks->reserved, 0, sizeof(ulinks->reserved));
+
+	return 0;
 }
 
 #define MEDIA_IOC_ENUM_LINKS32		_IOWR('|', 0x02, struct media_links_enum32)
-- 
GitLab


From d3969670cb5a76f3abf762c6a732ae8cb612584e Mon Sep 17 00:00:00 2001
From: Jose Abreu <Jose.Abreu@synopsys.com>
Date: Fri, 24 May 2019 10:20:21 +0200
Subject: [PATCH 0802/1835] net: stmmac: dwmac1000: Clear unused address
 entries

[ Upstream commit 9463c445590091202659cdfdd44b236acadfbd84 ]

In case we don't use a given address entry we need to clear it because
it could contain previous values that are no longer valid.

Found out while running stmmac selftests.

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Cc: Joao Pinto <jpinto@synopsys.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index 0877bde6e860b..21d131347e2ef 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -216,6 +216,12 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
 					    GMAC_ADDR_LOW(reg));
 			reg++;
 		}
+
+		while (reg <= perfect_addr_number) {
+			writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
+			writel(0, ioaddr + GMAC_ADDR_LOW(reg));
+			reg++;
+		}
 	}
 
 #ifdef FRAME_FILTER_DEBUG
-- 
GitLab


From df6680de7a20387ef90db4c124ec1b8a3ec71112 Mon Sep 17 00:00:00 2001
From: Jose Abreu <Jose.Abreu@synopsys.com>
Date: Fri, 24 May 2019 10:20:25 +0200
Subject: [PATCH 0803/1835] net: stmmac: dwmac4/5: Clear unused address entries

[ Upstream commit 0620ec6c62a5a07625b65f699adc5d1b90394ee6 ]

In case we don't use a given address entry we need to clear it because
it could contain previous values that are no longer valid.

Found out while running stmmac selftests.

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Cc: Joao Pinto <jpinto@synopsys.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 7e5d5db0d5165..a2f3db39221e0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -444,14 +444,20 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
 		 * are required
 		 */
 		value |= GMAC_PACKET_FILTER_PR;
-	} else if (!netdev_uc_empty(dev)) {
-		int reg = 1;
+	} else {
 		struct netdev_hw_addr *ha;
+		int reg = 1;
 
 		netdev_for_each_uc_addr(ha, dev) {
 			dwmac4_set_umac_addr(hw, ha->addr, reg);
 			reg++;
 		}
+
+		while (reg <= GMAC_MAX_PERFECT_ADDRESSES) {
+			writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
+			writel(0, ioaddr + GMAC_ADDR_LOW(reg));
+			reg++;
+		}
 	}
 
 	writel(value, ioaddr + GMAC_PACKET_FILTER);
-- 
GitLab


From 1c8e736115cd291519467aaea274ccf9f7f7c1df Mon Sep 17 00:00:00 2001
From: Michal Kalderon <michal.kalderon@marvell.com>
Date: Sun, 26 May 2019 15:22:25 +0300
Subject: [PATCH 0804/1835] qed: Set the doorbell address correctly

[ Upstream commit 8366d520019f366fabd6c7a13032bdcd837e18d4 ]

In 100g mode the doorbell bar is united for both engines. Set
the correct offset in the hwfn so that the doorbell returned
for RoCE is in the affined hwfn.

Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Denis Bolotin <denis.bolotin@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_dev.c  | 29 ++++++++++++++--------
 drivers/net/ethernet/qlogic/qed/qed_rdma.c |  2 +-
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 4dd82a1612aa8..a6a9688db307f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -3096,6 +3096,7 @@ static void qed_nvm_info_free(struct qed_hwfn *p_hwfn)
 static int qed_hw_prepare_single(struct qed_hwfn *p_hwfn,
 				 void __iomem *p_regview,
 				 void __iomem *p_doorbells,
+				 u64 db_phys_addr,
 				 enum qed_pci_personality personality)
 {
 	int rc = 0;
@@ -3103,6 +3104,7 @@ static int qed_hw_prepare_single(struct qed_hwfn *p_hwfn,
 	/* Split PCI bars evenly between hwfns */
 	p_hwfn->regview = p_regview;
 	p_hwfn->doorbells = p_doorbells;
+	p_hwfn->db_phys_addr = db_phys_addr;
 
 	if (IS_VF(p_hwfn->cdev))
 		return qed_vf_hw_prepare(p_hwfn);
@@ -3198,7 +3200,9 @@ int qed_hw_prepare(struct qed_dev *cdev,
 	/* Initialize the first hwfn - will learn number of hwfns */
 	rc = qed_hw_prepare_single(p_hwfn,
 				   cdev->regview,
-				   cdev->doorbells, personality);
+				   cdev->doorbells,
+				   cdev->db_phys_addr,
+				   personality);
 	if (rc)
 		return rc;
 
@@ -3207,22 +3211,25 @@ int qed_hw_prepare(struct qed_dev *cdev,
 	/* Initialize the rest of the hwfns */
 	if (cdev->num_hwfns > 1) {
 		void __iomem *p_regview, *p_doorbell;
-		u8 __iomem *addr;
+		u64 db_phys_addr;
+		u32 offset;
 
 		/* adjust bar offset for second engine */
-		addr = cdev->regview +
-		       qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
-				       BAR_ID_0) / 2;
-		p_regview = addr;
+		offset = qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
+					 BAR_ID_0) / 2;
+		p_regview = cdev->regview + offset;
 
-		addr = cdev->doorbells +
-		       qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
-				       BAR_ID_1) / 2;
-		p_doorbell = addr;
+		offset = qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
+					 BAR_ID_1) / 2;
+
+		p_doorbell = cdev->doorbells + offset;
+
+		db_phys_addr = cdev->db_phys_addr + offset;
 
 		/* prepare second hw function */
 		rc = qed_hw_prepare_single(&cdev->hwfns[1], p_regview,
-					   p_doorbell, personality);
+					   p_doorbell, db_phys_addr,
+					   personality);
 
 		/* in case of error, need to free the previously
 		 * initiliazed hwfn 0.
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 7873d6dfd91f5..13802b825d65a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -803,7 +803,7 @@ static int qed_rdma_add_user(void *rdma_cxt,
 				     dpi_start_offset +
 				     ((out_params->dpi) * p_hwfn->dpi_size));
 
-	out_params->dpi_phys_addr = p_hwfn->cdev->db_phys_addr +
+	out_params->dpi_phys_addr = p_hwfn->db_phys_addr +
 				    dpi_start_offset +
 				    ((out_params->dpi) * p_hwfn->dpi_size);
 
-- 
GitLab


From b397462a010dcc3333f9ab86279f9a93c26b423f Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xmission.com>
Date: Wed, 15 May 2019 12:29:52 -0500
Subject: [PATCH 0805/1835] signal/pid_namespace: Fix reboot_pid_ns to use
 send_sig not force_sig

[ Upstream commit f9070dc94542093fd516ae4ccea17ef46a4362c5 ]

The locking in force_sig_info is not prepared to deal with a task that
exits or execs (as sighand may change).  The is not a locking problem
in force_sig as force_sig is only built to handle synchronous
exceptions.

Further the function force_sig_info changes the signal state if the
signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
delivery of the signal.  The signal SIGKILL can not be ignored and can
not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
delivered.

So using force_sig rather than send_sig for SIGKILL is confusing
and pointless.

Because it won't impact the sending of the signal and and because
using force_sig is wrong, replace force_sig with send_sig.

Cc: Daniel Lezcano <daniel.lezcano@free.fr>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Fixes: cf3f89214ef6 ("pidns: add reboot_pid_ns() to handle the reboot syscall")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/pid_namespace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 2a2ac53d8b8bb..95271f180687e 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -325,7 +325,7 @@ int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
 	}
 
 	read_lock(&tasklist_lock);
-	force_sig(SIGKILL, pid_ns->child_reaper);
+	send_sig(SIGKILL, pid_ns->child_reaper, 1);
 	read_unlock(&tasklist_lock);
 
 	do_exit(0);
-- 
GitLab


From 0544b64ceb644a2b21c27f57714a0d82fc2e3cfa Mon Sep 17 00:00:00 2001
From: Jeremy Sowden <jeremy@azazel.net>
Date: Sat, 25 May 2019 19:09:35 +0100
Subject: [PATCH 0806/1835] af_key: fix leaks in key_pol_get_resp and dump_sp.

[ Upstream commit 7c80eb1c7e2b8420477fbc998971d62a648035d9 ]

In both functions, if pfkey_xfrm_policy2msg failed we leaked the newly
allocated sk_buff.  Free it on error.

Fixes: 55569ce256ce ("Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx.")
Reported-by: syzbot+4f0529365f7f2208d9f0@syzkaller.appspotmail.com
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/key/af_key.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 0b79c9aa8eb1f..1982f9f31debb 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2442,8 +2442,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
 		goto out;
 	}
 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
-	if (err < 0)
+	if (err < 0) {
+		kfree_skb(out_skb);
 		goto out;
+	}
 
 	out_hdr = (struct sadb_msg *) out_skb->data;
 	out_hdr->sadb_msg_version = hdr->sadb_msg_version;
@@ -2694,8 +2696,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
 		return PTR_ERR(out_skb);
 
 	err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
-	if (err < 0)
+	if (err < 0) {
+		kfree_skb(out_skb);
 		return err;
+	}
 
 	out_hdr = (struct sadb_msg *) out_skb->data;
 	out_hdr->sadb_msg_version = pfk->dump.msg_version;
-- 
GitLab


From 2c6acf7478aacce620866fc1720d70287c9af934 Mon Sep 17 00:00:00 2001
From: Anirudh Gupta <anirudhrudr@gmail.com>
Date: Tue, 21 May 2019 20:59:47 +0530
Subject: [PATCH 0807/1835] xfrm: Fix xfrm sel prefix length validation

[ Upstream commit b38ff4075a80b4da5cb2202d7965332ca0efb213 ]

Family of src/dst can be different from family of selector src/dst.
Use xfrm selector family to validate address prefix length,
while verifying new sa from userspace.

Validated patch with this command:
ip xfrm state add src 1.1.6.1 dst 1.1.6.2 proto esp spi 4260196 \
reqid 20004 mode tunnel aead "rfc4106(gcm(aes))" \
0x1111016400000000000000000000000044440001 128 \
sel src 1011:1:4::2/128 sel dst 1021:1:4::2/128 dev Port5

Fixes: 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.")
Signed-off-by: Anirudh Gupta <anirudh.gupta@sophos.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_user.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 2122f89f61555..d80d54e663c09 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -150,6 +150,22 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 
 	err = -EINVAL;
 	switch (p->family) {
+	case AF_INET:
+		break;
+
+	case AF_INET6:
+#if IS_ENABLED(CONFIG_IPV6)
+		break;
+#else
+		err = -EAFNOSUPPORT;
+		goto out;
+#endif
+
+	default:
+		goto out;
+	}
+
+	switch (p->sel.family) {
 	case AF_INET:
 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
 			goto out;
-- 
GitLab


From 71b029a5d9085b629763beb64024e4547e04f4bf Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Mon, 20 May 2019 09:29:42 -0700
Subject: [PATCH 0808/1835] fscrypt: clean up some BUG_ON()s in block
 encryption/decryption

[ Upstream commit eeacfdc68a104967162dfcba60f53f6f5b62a334 ]

Replace some BUG_ON()s with WARN_ON_ONCE() and returning an error code,
and move the check for len divisible by FS_CRYPTO_BLOCK_SIZE into
fscrypt_crypt_block() so that it's done for both encryption and
decryption, not just encryption.

Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/crypto/crypto.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 0f46cf550907f..c83ddff3ff4ac 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -149,7 +149,10 @@ int fscrypt_do_page_crypto(const struct inode *inode, fscrypt_direction_t rw,
 	struct crypto_skcipher *tfm = ci->ci_ctfm;
 	int res = 0;
 
-	BUG_ON(len == 0);
+	if (WARN_ON_ONCE(len <= 0))
+		return -EINVAL;
+	if (WARN_ON_ONCE(len % FS_CRYPTO_BLOCK_SIZE != 0))
+		return -EINVAL;
 
 	BUILD_BUG_ON(sizeof(iv) != FS_IV_SIZE);
 	BUILD_BUG_ON(AES_BLOCK_SIZE != FS_IV_SIZE);
@@ -241,8 +244,6 @@ struct page *fscrypt_encrypt_page(const struct inode *inode,
 	struct page *ciphertext_page = page;
 	int err;
 
-	BUG_ON(len % FS_CRYPTO_BLOCK_SIZE != 0);
-
 	if (inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES) {
 		/* with inplace-encryption we just encrypt the page */
 		err = fscrypt_do_page_crypto(inode, FS_ENCRYPT, lblk_num, page,
@@ -254,7 +255,8 @@ struct page *fscrypt_encrypt_page(const struct inode *inode,
 		return ciphertext_page;
 	}
 
-	BUG_ON(!PageLocked(page));
+	if (WARN_ON_ONCE(!PageLocked(page)))
+		return ERR_PTR(-EINVAL);
 
 	ctx = fscrypt_get_ctx(inode, gfp_flags);
 	if (IS_ERR(ctx))
@@ -302,8 +304,9 @@ EXPORT_SYMBOL(fscrypt_encrypt_page);
 int fscrypt_decrypt_page(const struct inode *inode, struct page *page,
 			unsigned int len, unsigned int offs, u64 lblk_num)
 {
-	if (!(inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES))
-		BUG_ON(!PageLocked(page));
+	if (WARN_ON_ONCE(!PageLocked(page) &&
+			 !(inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES)))
+		return -EINVAL;
 
 	return fscrypt_do_page_crypto(inode, FS_DECRYPT, lblk_num, page, page,
 				      len, offs, GFP_NOFS);
-- 
GitLab


From a6dd4862b98f480e146f78192a62e9516dcec7fc Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Tue, 28 May 2019 16:02:56 -0300
Subject: [PATCH 0809/1835] perf annotate TUI browser: Do not use member from
 variable within its own initialization

[ Upstream commit da2019633f0b5c105ce658aada333422d8cb28fe ]

Some compilers will complain when using a member of a struct to
initialize another member, in the same struct initialization.

For instance:

  debian:8      Debian clang version 3.5.0-10 (tags/RELEASE_350/final) (based on LLVM 3.5.0)
  oraclelinux:7 clang version 3.4.2 (tags/RELEASE_34/dot2-final)

Produce:

  ui/browsers/annotate.c:104:12: error: variable 'ops' is uninitialized when used within its own initialization [-Werror,-Wuninitialized]
                                              (!ops.current_entry ||
                                                ^~~
  1 error generated.

So use an extra variable, initialized just before that struct, to have
the value used in the expressions used to init two of the struct
members.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Fixes: c298304bd747 ("perf annotate: Use a ops table for annotation_line__write()")
Link: https://lkml.kernel.org/n/tip-f9nexro58q62l3o9hez8hr0i@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/ui/browsers/annotate.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 1d00e5ec7906e..a3c255228d624 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -96,11 +96,12 @@ static void annotate_browser__write(struct ui_browser *browser, void *entry, int
 	struct annotate_browser *ab = container_of(browser, struct annotate_browser, b);
 	struct annotation *notes = browser__annotation(browser);
 	struct annotation_line *al = list_entry(entry, struct annotation_line, node);
+	const bool is_current_entry = ui_browser__is_current_entry(browser, row);
 	struct annotation_write_ops ops = {
 		.first_line		 = row == 0,
-		.current_entry		 = ui_browser__is_current_entry(browser, row),
+		.current_entry		 = is_current_entry,
 		.change_color		 = (!notes->options->hide_src_code &&
-					    (!ops.current_entry ||
+					    (!is_current_entry ||
 					     (browser->use_navkeypressed &&
 					      !browser->navkeypressed))),
 		.width			 = browser->width,
-- 
GitLab


From ea904c9f6a33698c4e6223d6be4a4e99fd60eeb2 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil@xs4all.nl>
Date: Mon, 27 May 2019 05:31:13 -0400
Subject: [PATCH 0810/1835] media: mc-device.c: don't memset __user pointer
 contents

[ Upstream commit 518fa4e0e0da97ea2e17c95ab57647ce748a96e2 ]

You can't memset the contents of a __user pointer. Instead, call copy_to_user to
copy links.reserved (which is zeroed) to the user memory.

This fixes this sparse warning:

SPARSE:drivers/media/mc/mc-device.c drivers/media/mc/mc-device.c:521:16:  warning: incorrect type in argument 1 (different address spaces)

Fixes: f49308878d720 ("media: media_device_enum_links32: clean a reserved field")

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/media-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index ba344e6f0139a..ed518b1f82e4a 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -503,8 +503,9 @@ static long media_device_enum_links32(struct media_device *mdev,
 	if (ret)
 		return ret;
 
-	memset(ulinks->reserved, 0, sizeof(ulinks->reserved));
-
+	if (copy_to_user(ulinks->reserved, links.reserved,
+			 sizeof(ulinks->reserved)))
+		return -EFAULT;
 	return 0;
 }
 
-- 
GitLab


From e36f25627362ab039a1bd728b631c0ab6f8102a3 Mon Sep 17 00:00:00 2001
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Date: Mon, 27 May 2019 08:14:55 -0400
Subject: [PATCH 0811/1835] media: saa7164: fix remove_proc_entry warning

[ Upstream commit 50710eeefbc1ed25375942aad0c4d1eb4af0f330 ]

if saa7164_proc_create() fails, saa7164_fini() will trigger a warning,

name 'saa7164'
WARNING: CPU: 1 PID: 6311 at fs/proc/generic.c:672 remove_proc_entry+0x1e8/0x3a0
  ? remove_proc_entry+0x1e8/0x3a0
  ? try_stop_module+0x7b/0x240
  ? proc_readdir+0x70/0x70
  ? rcu_read_lock_sched_held+0xd7/0x100
  saa7164_fini+0x13/0x1f [saa7164]
  __x64_sys_delete_module+0x30c/0x480
  ? __ia32_sys_delete_module+0x480/0x480
  ? __x64_sys_clock_gettime+0x11e/0x1c0
  ? __x64_sys_timer_create+0x1a0/0x1a0
  ? trace_hardirqs_off_caller+0x40/0x180
  ? do_syscall_64+0x18/0x450
  do_syscall_64+0x9f/0x450
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fix it by checking the return of proc_create_single() before
calling remove_proc_entry().

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil-cisco@xs4all.nl: use 0444 instead of S_IRUGO]
[hverkuil-cisco@xs4all.nl: use pr_info instead of KERN_INFO]
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7164/saa7164-core.c | 33 ++++++++++++++++--------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index d697e1ad929c2..5102519df1083 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1122,16 +1122,25 @@ static int saa7164_proc_show(struct seq_file *m, void *v)
 	return 0;
 }
 
+static struct proc_dir_entry *saa7164_pe;
+
 static int saa7164_proc_create(void)
 {
-	struct proc_dir_entry *pe;
-
-	pe = proc_create_single("saa7164", S_IRUGO, NULL, saa7164_proc_show);
-	if (!pe)
+	saa7164_pe = proc_create_single("saa7164", 0444, NULL, saa7164_proc_show);
+	if (!saa7164_pe)
 		return -ENOMEM;
 
 	return 0;
 }
+
+static void saa7164_proc_destroy(void)
+{
+	if (saa7164_pe)
+		remove_proc_entry("saa7164", NULL);
+}
+#else
+static int saa7164_proc_create(void) { return 0; }
+static void saa7164_proc_destroy(void) {}
 #endif
 
 static int saa7164_thread_function(void *data)
@@ -1503,19 +1512,21 @@ static struct pci_driver saa7164_pci_driver = {
 
 static int __init saa7164_init(void)
 {
-	printk(KERN_INFO "saa7164 driver loaded\n");
+	int ret = pci_register_driver(&saa7164_pci_driver);
+
+	if (ret)
+		return ret;
 
-#ifdef CONFIG_PROC_FS
 	saa7164_proc_create();
-#endif
-	return pci_register_driver(&saa7164_pci_driver);
+
+	pr_info("saa7164 driver loaded\n");
+
+	return 0;
 }
 
 static void __exit saa7164_fini(void)
 {
-#ifdef CONFIG_PROC_FS
-	remove_proc_entry("saa7164", NULL);
-#endif
+	saa7164_proc_destroy();
 	pci_unregister_driver(&saa7164_pci_driver);
 }
 
-- 
GitLab


From ef10d46d04a5353a6e066974374fb95584fbee91 Mon Sep 17 00:00:00 2001
From: Shailendra Verma <shailendra.v@samsung.com>
Date: Thu, 24 Nov 2016 23:57:34 -0500
Subject: [PATCH 0812/1835] media: staging: media: davinci_vpfe: - Fix for
 memory leak if decoder initialization fails.

[ Upstream commit 6995a659101bd4effa41cebb067f9dc18d77520d ]

Fix to avoid possible memory leak if the decoder initialization
got failed.Free the allocated memory for file handle object
before return in case decoder initialization fails.

Signed-off-by: Shailendra Verma <shailendra.v@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/davinci_vpfe/vpfe_video.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
index 1269a983455e5..13b890b9ef187 100644
--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
+++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
@@ -422,6 +422,9 @@ static int vpfe_open(struct file *file)
 	/* If decoder is not initialized. initialize it */
 	if (!video->initialized && vpfe_update_pipe_state(video)) {
 		mutex_unlock(&video->lock);
+		v4l2_fh_del(&handle->vfh);
+		v4l2_fh_exit(&handle->vfh);
+		kfree(handle);
 		return -ENODEV;
 	}
 	/* Increment device users counter */
-- 
GitLab


From fc25cfb03ea2918ab529dfef9fc45b4025943e3b Mon Sep 17 00:00:00 2001
From: Ioana Ciornei <ioana.ciornei@nxp.com>
Date: Tue, 28 May 2019 20:38:09 +0300
Subject: [PATCH 0813/1835] net: phy: Check against net_device being NULL

[ Upstream commit 82c76aca81187b3d28a6fb3062f6916450ce955e ]

In general, we don't want MAC drivers calling phy_attach_direct with the
net_device being NULL. Add checks against this in all the functions
calling it: phy_attach() and phy_connect_direct().

Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Suggested-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_device.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 8a96d985a52fd..6144146aec29d 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -757,6 +757,9 @@ int phy_connect_direct(struct net_device *dev, struct phy_device *phydev,
 {
 	int rc;
 
+	if (!dev)
+		return -EINVAL;
+
 	rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
 	if (rc)
 		return rc;
@@ -1098,6 +1101,9 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
 	struct device *d;
 	int rc;
 
+	if (!dev)
+		return ERR_PTR(-EINVAL);
+
 	/* Search the list of PHY devices on the mdio bus for the
 	 * PHY with the requested name
 	 */
-- 
GitLab


From 9d25aedef08ffbfb7fa2b2d802dc0b814dca5060 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Tue, 21 May 2019 13:34:17 +0000
Subject: [PATCH 0814/1835] crypto: talitos - properly handle split ICV.

[ Upstream commit eae55a586c3c8b50982bad3c3426e9c9dd7a0075 ]

The driver assumes that the ICV is as a single piece in the last
element of the scatterlist. This assumption is wrong.

This patch ensures that the ICV is properly handled regardless of
the scatterlist layout.

Fixes: 9c4a79653b35 ("crypto: talitos - Freescale integrated security engine (SEC) driver")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index d46f58c134334..254f711f19345 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1001,7 +1001,6 @@ static void ipsec_esp_encrypt_done(struct device *dev,
 	unsigned int authsize = crypto_aead_authsize(authenc);
 	unsigned int ivsize = crypto_aead_ivsize(authenc);
 	struct talitos_edesc *edesc;
-	struct scatterlist *sg;
 	void *icvdata;
 
 	edesc = container_of(desc, struct talitos_edesc, desc);
@@ -1015,9 +1014,8 @@ static void ipsec_esp_encrypt_done(struct device *dev,
 		else
 			icvdata = &edesc->link_tbl[edesc->src_nents +
 						   edesc->dst_nents + 2];
-		sg = sg_last(areq->dst, edesc->dst_nents);
-		memcpy((char *)sg_virt(sg) + sg->length - authsize,
-		       icvdata, authsize);
+		sg_pcopy_from_buffer(areq->dst, edesc->dst_nents ? : 1, icvdata,
+				     authsize, areq->assoclen + areq->cryptlen);
 	}
 
 	dma_unmap_single(dev, edesc->iv_dma, ivsize, DMA_TO_DEVICE);
@@ -1035,7 +1033,6 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
 	struct crypto_aead *authenc = crypto_aead_reqtfm(req);
 	unsigned int authsize = crypto_aead_authsize(authenc);
 	struct talitos_edesc *edesc;
-	struct scatterlist *sg;
 	char *oicv, *icv;
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	bool is_sec1 = has_ftr_sec1(priv);
@@ -1045,9 +1042,18 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
 	ipsec_esp_unmap(dev, edesc, req);
 
 	if (!err) {
+		char icvdata[SHA512_DIGEST_SIZE];
+		int nents = edesc->dst_nents ? : 1;
+		unsigned int len = req->assoclen + req->cryptlen;
+
 		/* auth check */
-		sg = sg_last(req->dst, edesc->dst_nents ? : 1);
-		icv = (char *)sg_virt(sg) + sg->length - authsize;
+		if (nents > 1) {
+			sg_pcopy_to_buffer(req->dst, nents, icvdata, authsize,
+					   len - authsize);
+			icv = icvdata;
+		} else {
+			icv = (char *)sg_virt(req->dst) + len - authsize;
+		}
 
 		if (edesc->dma_len) {
 			if (is_sec1)
@@ -1463,7 +1469,6 @@ static int aead_decrypt(struct aead_request *req)
 	struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
 	struct talitos_private *priv = dev_get_drvdata(ctx->dev);
 	struct talitos_edesc *edesc;
-	struct scatterlist *sg;
 	void *icvdata;
 
 	req->cryptlen -= authsize;
@@ -1497,9 +1502,8 @@ static int aead_decrypt(struct aead_request *req)
 	else
 		icvdata = &edesc->link_tbl[0];
 
-	sg = sg_last(req->src, edesc->src_nents ? : 1);
-
-	memcpy(icvdata, (char *)sg_virt(sg) + sg->length - authsize, authsize);
+	sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
+			   req->assoclen + req->cryptlen - authsize);
 
 	return ipsec_esp(edesc, req, ipsec_esp_decrypt_swauth_done);
 }
-- 
GitLab


From 9072450736d067fab2fd15774ff4d65199a3b702 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Tue, 21 May 2019 13:34:18 +0000
Subject: [PATCH 0815/1835] crypto: talitos - Align SEC1 accesses to 32 bits
 boundaries.

[ Upstream commit c9cca7034b34a2d82e9a03b757de2485c294851c ]

The MPC885 reference manual states:

SEC Lite-initiated 8xx writes can occur only on 32-bit-word boundaries, but
reads can occur on any byte boundary. Writing back a header read from a
non-32-bit-word boundary will yield unpredictable results.

In order to ensure that, cra_alignmask is set to 3 for SEC1.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Fixes: 9c4a79653b35 ("crypto: talitos - Freescale integrated security engine (SEC) driver")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 254f711f19345..41b288bdcdbfe 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -3193,7 +3193,10 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
 		alg->cra_priority = t_alg->algt.priority;
 	else
 		alg->cra_priority = TALITOS_CRA_PRIORITY;
-	alg->cra_alignmask = 0;
+	if (has_ftr_sec1(priv))
+		alg->cra_alignmask = 3;
+	else
+		alg->cra_alignmask = 0;
 	alg->cra_ctxsize = sizeof(struct talitos_ctx);
 	alg->cra_flags |= CRYPTO_ALG_KERN_DRIVER_ONLY;
 
-- 
GitLab


From aa2ad8b6fb2fdefea6a0c1fcdd074101fe28bc08 Mon Sep 17 00:00:00 2001
From: "David S. Miller" <davem@davemloft.net>
Date: Thu, 30 May 2019 11:36:15 -0700
Subject: [PATCH 0816/1835] tua6100: Avoid build warnings.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 621ccc6cc5f8d6730b740d31d4818227866c93c9 ]

Rename _P to _P_VAL and _R to _R_VAL to avoid global
namespace conflicts:

drivers/media/dvb-frontends/tua6100.c: In function ‘tua6100_set_params’:
drivers/media/dvb-frontends/tua6100.c:79: warning: "_P" redefined
 #define _P 32

In file included from ./include/acpi/platform/aclinux.h:54,
                 from ./include/acpi/platform/acenv.h:152,
                 from ./include/acpi/acpi.h:22,
                 from ./include/linux/acpi.h:34,
                 from ./include/linux/i2c.h:17,
                 from drivers/media/dvb-frontends/tua6100.h:30,
                 from drivers/media/dvb-frontends/tua6100.c:32:
./include/linux/ctype.h:14: note: this is the location of the previous definition
 #define _P 0x10 /* punct */

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/tua6100.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c
index b233b7be0b84a..e6aaf4973aef4 100644
--- a/drivers/media/dvb-frontends/tua6100.c
+++ b/drivers/media/dvb-frontends/tua6100.c
@@ -75,8 +75,8 @@ static int tua6100_set_params(struct dvb_frontend *fe)
 	struct i2c_msg msg1 = { .addr = priv->i2c_address, .flags = 0, .buf = reg1, .len = 4 };
 	struct i2c_msg msg2 = { .addr = priv->i2c_address, .flags = 0, .buf = reg2, .len = 3 };
 
-#define _R 4
-#define _P 32
+#define _R_VAL 4
+#define _P_VAL 32
 #define _ri 4000000
 
 	// setup register 0
@@ -91,14 +91,14 @@ static int tua6100_set_params(struct dvb_frontend *fe)
 	else
 		reg1[1] = 0x0c;
 
-	if (_P == 64)
+	if (_P_VAL == 64)
 		reg1[1] |= 0x40;
 	if (c->frequency >= 1525000)
 		reg1[1] |= 0x80;
 
 	// register 2
-	reg2[1] = (_R >> 8) & 0x03;
-	reg2[2] = _R;
+	reg2[1] = (_R_VAL >> 8) & 0x03;
+	reg2[2] = _R_VAL;
 	if (c->frequency < 1455000)
 		reg2[1] |= 0x1c;
 	else if (c->frequency < 1630000)
@@ -110,18 +110,18 @@ static int tua6100_set_params(struct dvb_frontend *fe)
 	 * The N divisor ratio (note: c->frequency is in kHz, but we
 	 * need it in Hz)
 	 */
-	prediv = (c->frequency * _R) / (_ri / 1000);
-	div = prediv / _P;
+	prediv = (c->frequency * _R_VAL) / (_ri / 1000);
+	div = prediv / _P_VAL;
 	reg1[1] |= (div >> 9) & 0x03;
 	reg1[2] = div >> 1;
 	reg1[3] = (div << 7);
-	priv->frequency = ((div * _P) * (_ri / 1000)) / _R;
+	priv->frequency = ((div * _P_VAL) * (_ri / 1000)) / _R_VAL;
 
 	// Finally, calculate and store the value for A
-	reg1[3] |= (prediv - (div*_P)) & 0x7f;
+	reg1[3] |= (prediv - (div*_P_VAL)) & 0x7f;
 
-#undef _R
-#undef _P
+#undef _R_VAL
+#undef _P_VAL
 #undef _ri
 
 	if (fe->ops.i2c_gate_ctrl)
-- 
GitLab


From 909034b8ac64d6f8d2a488dd63485781ebaff8ba Mon Sep 17 00:00:00 2001
From: Sven Eckelmann <sven@narfation.org>
Date: Sun, 2 Jun 2019 10:57:31 +0200
Subject: [PATCH 0817/1835] batman-adv: Fix duplicated OGMs on NETDEV_UP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9e6b5648bbc4cd48fab62cecbb81e9cc3c6e7e88 ]

The state of slave interfaces are handled differently depending on whether
the interface is up or not. All active interfaces (IFF_UP) will transmit
OGMs. But for B.A.T.M.A.N. IV, also non-active interfaces are scheduling
(low TTL) OGMs on active interfaces. The code which setups and schedules
the OGMs must therefore already be called when the interfaces gets added as
slave interface and the transmit function must then check whether it has to
send out the OGM or not on the specific slave interface.

But the commit f0d97253fb5f ("batman-adv: remove ogm_emit and ogm_schedule
API calls") moved the setup code from the enable function to the activate
function. The latter is called either when the added slave was already up
when batadv_hardif_enable_interface processed the new interface or when a
NETDEV_UP event was received for this slave interfac. As result, each
NETDEV_UP would schedule a new OGM worker for the interface and thus OGMs
would be send a lot more than expected.

Fixes: f0d97253fb5f ("batman-adv: remove ogm_emit and ogm_schedule API calls")
Reported-by: Linus Lüssing <linus.luessing@c0d3.blue>
Tested-by: Linus Lüssing <linus.luessing@c0d3.blue>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/batman-adv/bat_iv_ogm.c     | 4 ++--
 net/batman-adv/hard-interface.c | 3 +++
 net/batman-adv/types.h          | 3 +++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 73bf6a93a3cf1..0b7b36fa0d5cd 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2485,7 +2485,7 @@ batadv_iv_ogm_neigh_is_sob(struct batadv_neigh_node *neigh1,
 	return ret;
 }
 
-static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface)
+static void batadv_iv_iface_enabled(struct batadv_hard_iface *hard_iface)
 {
 	/* begin scheduling originator messages on that interface */
 	batadv_iv_ogm_schedule(hard_iface);
@@ -2825,8 +2825,8 @@ unlock:
 static struct batadv_algo_ops batadv_batman_iv __read_mostly = {
 	.name = "BATMAN_IV",
 	.iface = {
-		.activate = batadv_iv_iface_activate,
 		.enable = batadv_iv_ogm_iface_enable,
+		.enabled = batadv_iv_iface_enabled,
 		.disable = batadv_iv_ogm_iface_disable,
 		.update_mac = batadv_iv_ogm_iface_update_mac,
 		.primary_set = batadv_iv_ogm_primary_iface_set,
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 08690d06b7be2..36f0962040d16 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -821,6 +821,9 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface,
 
 	batadv_hardif_recalc_extra_skbroom(soft_iface);
 
+	if (bat_priv->algo_ops->iface.enabled)
+		bat_priv->algo_ops->iface.enabled(hard_iface);
+
 out:
 	return 0;
 
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index eeee3e61c625d..fdba8a144d737 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -2130,6 +2130,9 @@ struct batadv_algo_iface_ops {
 	/** @enable: init routing info when hard-interface is enabled */
 	int (*enable)(struct batadv_hard_iface *hard_iface);
 
+	/** @enabled: notification when hard-interface was enabled (optional) */
+	void (*enabled)(struct batadv_hard_iface *hard_iface);
+
 	/** @disable: de-init routing info when hard-interface is disabled */
 	void (*disable)(struct batadv_hard_iface *hard_iface);
 
-- 
GitLab


From 2fbde2746597b2e4893161a99edc36594c6c6f9d Mon Sep 17 00:00:00 2001
From: Imre Deak <imre.deak@intel.com>
Date: Fri, 24 May 2019 23:15:09 +0300
Subject: [PATCH 0818/1835] locking/lockdep: Fix merging of hlocks with
 non-zero references

[ Upstream commit d9349850e188b8b59e5322fda17ff389a1c0cd7d ]

The sequence

	static DEFINE_WW_CLASS(test_ww_class);

	struct ww_acquire_ctx ww_ctx;
	struct ww_mutex ww_lock_a;
	struct ww_mutex ww_lock_b;
	struct ww_mutex ww_lock_c;
	struct mutex lock_c;

	ww_acquire_init(&ww_ctx, &test_ww_class);

	ww_mutex_init(&ww_lock_a, &test_ww_class);
	ww_mutex_init(&ww_lock_b, &test_ww_class);
	ww_mutex_init(&ww_lock_c, &test_ww_class);

	mutex_init(&lock_c);

	ww_mutex_lock(&ww_lock_a, &ww_ctx);

	mutex_lock(&lock_c);

	ww_mutex_lock(&ww_lock_b, &ww_ctx);
	ww_mutex_lock(&ww_lock_c, &ww_ctx);

	mutex_unlock(&lock_c);	(*)

	ww_mutex_unlock(&ww_lock_c);
	ww_mutex_unlock(&ww_lock_b);
	ww_mutex_unlock(&ww_lock_a);

	ww_acquire_fini(&ww_ctx); (**)

will trigger the following error in __lock_release() when calling
mutex_release() at **:

	DEBUG_LOCKS_WARN_ON(depth <= 0)

The problem is that the hlock merging happening at * updates the
references for test_ww_class incorrectly to 3 whereas it should've
updated it to 4 (representing all the instances for ww_ctx and
ww_lock_[abc]).

Fix this by updating the references during merging correctly taking into
account that we can have non-zero references (both for the hlock that we
merge into another hlock or for the hlock we are merging into).

Signed-off-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Link: https://lkml.kernel.org/r/20190524201509.9199-2-imre.deak@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 26b57e24476f1..e810e8cb17e18 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -3326,17 +3326,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
 	if (depth) {
 		hlock = curr->held_locks + depth - 1;
 		if (hlock->class_idx == class_idx && nest_lock) {
-			if (hlock->references) {
-				/*
-				 * Check: unsigned int references:12, overflow.
-				 */
-				if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
-					return 0;
+			if (!references)
+				references++;
 
+			if (!hlock->references)
 				hlock->references++;
-			} else {
-				hlock->references = 2;
-			}
+
+			hlock->references += references;
+
+			/* Overflow */
+			if (DEBUG_LOCKS_WARN_ON(hlock->references < references))
+				return 0;
 
 			return 1;
 		}
-- 
GitLab


From 35407917b0bccaf06217c8db6733c737610d4d89 Mon Sep 17 00:00:00 2001
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Date: Thu, 30 May 2019 03:25:49 -0400
Subject: [PATCH 0819/1835] media: wl128x: Fix some error handling in
 fm_v4l2_init_video_device()

[ Upstream commit 69fbb3f47327d959830c94bf31893972b8c8f700 ]

X-Originating-IP: [10.175.113.25]
X-CFilter-Loop: Reflected
The fm_v4l2_init_video_device() forget to unregister v4l2/video device
in the error path, it could lead to UAF issue, eg,

  BUG: KASAN: use-after-free in atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
  BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
  BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x92/0x690 kernel/locking/mutex.c:1206
  Read of size 8 at addr ffff8881e84a7c70 by task v4l_id/3659

  CPU: 1 PID: 3659 Comm: v4l_id Not tainted 5.1.0 #8
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
  Call Trace:
   __dump_stack lib/dump_stack.c:77 [inline]
   dump_stack+0xa9/0x10e lib/dump_stack.c:113
   print_address_description+0x65/0x270 mm/kasan/report.c:187
   kasan_report+0x149/0x18d mm/kasan/report.c:317
   atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
   atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
   __mutex_unlock_slowpath+0x92/0x690 kernel/locking/mutex.c:1206
   fm_v4l2_fops_open+0xac/0x120 [fm_drv]
   v4l2_open+0x191/0x390 [videodev]
   chrdev_open+0x20d/0x570 fs/char_dev.c:417
   do_dentry_open+0x700/0xf30 fs/open.c:777
   do_last fs/namei.c:3416 [inline]
   path_openat+0x7c4/0x2a90 fs/namei.c:3532
   do_filp_open+0x1a5/0x2b0 fs/namei.c:3563
   do_sys_open+0x302/0x490 fs/open.c:1069
   do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7f8180c17c8e
  ...
  Allocated by task 3642:
   set_track mm/kasan/common.c:87 [inline]
   __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:497
   fm_drv_init+0x13/0x1000 [fm_drv]
   do_one_initcall+0xbc/0x47d init/main.c:901
   do_init_module+0x1b5/0x547 kernel/module.c:3456
   load_module+0x6405/0x8c10 kernel/module.c:3804
   __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
   do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

  Freed by task 3642:
   set_track mm/kasan/common.c:87 [inline]
   __kasan_slab_free+0x130/0x180 mm/kasan/common.c:459
   slab_free_hook mm/slub.c:1429 [inline]
   slab_free_freelist_hook mm/slub.c:1456 [inline]
   slab_free mm/slub.c:3003 [inline]
   kfree+0xe1/0x270 mm/slub.c:3958
   fm_drv_init+0x1e6/0x1000 [fm_drv]
   do_one_initcall+0xbc/0x47d init/main.c:901
   do_init_module+0x1b5/0x547 kernel/module.c:3456
   load_module+0x6405/0x8c10 kernel/module.c:3804
   __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
   do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
   entry_SYSCALL_64_after_hwframe+0x49/0xbe

Add relevant unregister functions to fix it.

Cc: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/radio/wl128x/fmdrv_v4l2.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c
index dccdf6558e6ab..33abc8616ecb8 100644
--- a/drivers/media/radio/wl128x/fmdrv_v4l2.c
+++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c
@@ -549,6 +549,7 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
 
 	/* Register with V4L2 subsystem as RADIO device */
 	if (video_register_device(&gradio_dev, VFL_TYPE_RADIO, radio_nr)) {
+		v4l2_device_unregister(&fmdev->v4l2_dev);
 		fmerr("Could not register video device\n");
 		return -ENOMEM;
 	}
@@ -562,6 +563,8 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
 	if (ret < 0) {
 		fmerr("(fmdev): Can't init ctrl handler\n");
 		v4l2_ctrl_handler_free(&fmdev->ctrl_handler);
+		video_unregister_device(fmdev->radio_dev);
+		v4l2_device_unregister(&fmdev->v4l2_dev);
 		return -EBUSY;
 	}
 
-- 
GitLab


From cac3032062e53fd83fbb7af4a8e7e673c75ec375 Mon Sep 17 00:00:00 2001
From: Weihang Li <liweihang@hisilicon.com>
Date: Mon, 3 Jun 2019 10:09:18 +0800
Subject: [PATCH 0820/1835] net: hns3: set ops to null when unregister ad_dev

[ Upstream commit 594a81b39525f0a17e92c2e0b167ae1400650380 ]

The hclge/hclgevf and hns3 module can be unloaded independently,
when hclge/hclgevf unloaded firstly, the ops of ae_dev should
be set to NULL, otherwise it will cause an use-after-free problem.

Fixes: 38caee9d3ee8 ("net: hns3: Add support of the HNAE3 framework")
Signed-off-by: Weihang Li <liweihang@hisilicon.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hnae3.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
index fff5be8078ac3..0594a6c3dccda 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -229,6 +229,7 @@ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo)
 
 		ae_algo->ops->uninit_ae_dev(ae_dev);
 		hnae3_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
+		ae_dev->ops = NULL;
 	}
 
 	list_del(&ae_algo->node);
@@ -316,6 +317,7 @@ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev)
 
 		ae_algo->ops->uninit_ae_dev(ae_dev);
 		hnae3_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
+		ae_dev->ops = NULL;
 	}
 
 	list_del(&ae_dev->node);
-- 
GitLab


From c360eb592938a2aff9d07aae1da8287e0c953b73 Mon Sep 17 00:00:00 2001
From: Abhishek Goel <huntbag@linux.vnet.ibm.com>
Date: Wed, 29 May 2019 04:30:33 -0500
Subject: [PATCH 0821/1835] cpupower : frequency-set -r option misses the last
 cpu in related cpu list

[ Upstream commit 04507c0a9385cc8280f794a36bfff567c8cc1042 ]

To set frequency on specific cpus using cpupower, following syntax can
be used :
cpupower -c #i frequency-set -f #f -r

While setting frequency using cpupower frequency-set command, if we use
'-r' option, it is expected to set frequency for all cpus related to
cpu #i. But it is observed to be missing the last cpu in related cpu
list. This patch fixes the problem.

Signed-off-by: Abhishek Goel <huntbag@linux.vnet.ibm.com>
Reviewed-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/power/cpupower/utils/cpufreq-set.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
index 1eef0aed64239..08a405593a791 100644
--- a/tools/power/cpupower/utils/cpufreq-set.c
+++ b/tools/power/cpupower/utils/cpufreq-set.c
@@ -306,6 +306,8 @@ int cmd_freq_set(int argc, char **argv)
 				bitmask_setbit(cpus_chosen, cpus->cpu);
 				cpus = cpus->next;
 			}
+			/* Set the last cpu in related cpus list */
+			bitmask_setbit(cpus_chosen, cpus->cpu);
 			cpufreq_put_related_cpus(cpus);
 		}
 	}
-- 
GitLab


From fb83987cbe6b632344e1b7eb27fccd7f8d70e778 Mon Sep 17 00:00:00 2001
From: Miles Chen <miles.chen@mediatek.com>
Date: Wed, 29 May 2019 00:08:20 +0800
Subject: [PATCH 0822/1835] arm64: mm: make CONFIG_ZONE_DMA32 configurable

[ Upstream commit 0c1f14ed12262f45a3af1d588e4d7bd12438b8f5 ]

This change makes CONFIG_ZONE_DMA32 defuly y and allows users
to overwrite it only when CONFIG_EXPERT=y.

For the SoCs that do not need CONFIG_ZONE_DMA32, this is the
first step to manage all available memory by a single
zone(normal zone) to reduce the overhead of multiple zones.

The change also fixes a build error when CONFIG_NUMA=y and
CONFIG_ZONE_DMA32=n.

arch/arm64/mm/init.c:195:17: error: use of undeclared identifier 'ZONE_DMA32'
                max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());

Change since v1:
1. only expose CONFIG_ZONE_DMA32 when CONFIG_EXPERT=y
2. remove redundant IS_ENABLED(CONFIG_ZONE_DMA32)

Cc: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Miles Chen <miles.chen@mediatek.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/Kconfig   | 3 ++-
 arch/arm64/mm/init.c | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 8790a29d0af43..e3ebece79617b 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -251,7 +251,8 @@ config GENERIC_CALIBRATE_DELAY
 	def_bool y
 
 config ZONE_DMA32
-	def_bool y
+	bool "Support DMA32 zone" if EXPERT
+	default y
 
 config HAVE_GENERIC_GUP
 	def_bool y
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 774c3e17c7982..29d2f425806e3 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -233,8 +233,9 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
 {
 	unsigned long max_zone_pfns[MAX_NR_ZONES]  = {0};
 
-	if (IS_ENABLED(CONFIG_ZONE_DMA32))
-		max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
+#ifdef CONFIG_ZONE_DMA32
+	max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
+#endif
 	max_zone_pfns[ZONE_NORMAL] = max;
 
 	free_area_init_nodes(max_zone_pfns);
-- 
GitLab


From 713737cac327e839044e60ae74fa99dce0021e1f Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@redhat.com>
Date: Fri, 31 May 2019 15:13:21 +0200
Subject: [PATCH 0823/1835] perf jvmti: Address gcc string overflow warning for
 strncpy()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 279ab04dbea1370d2eac0f854270369ccaef8a44 ]

We are getting false positive gcc warning when we compile with gcc9 (9.1.1):

     CC       jvmti/libjvmti.o
   In file included from /usr/include/string.h:494,
                    from jvmti/libjvmti.c:5:
   In function ‘strncpy’,
       inlined from ‘copy_class_filename.constprop’ at jvmti/libjvmti.c:166:3:
   /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
     106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
         |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   jvmti/libjvmti.c: In function ‘copy_class_filename.constprop’:
   jvmti/libjvmti.c:165:26: note: length computed here
     165 |   size_t file_name_len = strlen(file_name);
         |                          ^~~~~~~~~~~~~~~~~
   cc1: all warnings being treated as errors

As per Arnaldo's suggestion use strlcpy(), which does the same thing and keeps
gcc silent.

Suggested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ben Gainey <ben.gainey@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/r/20190531131321.GB1281@krava
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/jvmti/libjvmti.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/perf/jvmti/libjvmti.c b/tools/perf/jvmti/libjvmti.c
index 6add3e9826141..3361d98a4edd6 100644
--- a/tools/perf/jvmti/libjvmti.c
+++ b/tools/perf/jvmti/libjvmti.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/compiler.h>
+#include <linux/string.h>
 #include <sys/types.h>
 #include <stdio.h>
 #include <string.h>
@@ -150,8 +151,7 @@ copy_class_filename(const char * class_sign, const char * file_name, char * resu
 		result[i] = '\0';
 	} else {
 		/* fallback case */
-		size_t file_name_len = strlen(file_name);
-		strncpy(result, file_name, file_name_len < max_length ? file_name_len : max_length);
+		strlcpy(result, file_name, max_length);
 	}
 }
 
-- 
GitLab


From 1a0a837afc413a289f85d4750225fb200021768e Mon Sep 17 00:00:00 2001
From: Biao Huang <biao.huang@mediatek.com>
Date: Mon, 3 Jun 2019 09:58:06 +0800
Subject: [PATCH 0824/1835] net: stmmac: dwmac4: fix flow control issue

[ Upstream commit ee326fd01e79dfa42014d55931260b68b9fa3273 ]

Current dwmac4_flow_ctrl will not clear
GMAC_RX_FLOW_CTRL_RFE/GMAC_RX_FLOW_CTRL_RFE bits,
so MAC hw will keep flow control on although expecting
flow control off by ethtool. Add codes to fix it.

Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
Signed-off-by: Biao Huang <biao.huang@mediatek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index a2f3db39221e0..d0e6e1503581f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -475,8 +475,9 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
 	if (fc & FLOW_RX) {
 		pr_debug("\tReceive Flow-Control ON\n");
 		flow |= GMAC_RX_FLOW_CTRL_RFE;
-		writel(flow, ioaddr + GMAC_RX_FLOW_CTRL);
 	}
+	writel(flow, ioaddr + GMAC_RX_FLOW_CTRL);
+
 	if (fc & FLOW_TX) {
 		pr_debug("\tTransmit Flow-Control ON\n");
 
@@ -484,7 +485,7 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
 			pr_debug("\tduplex mode: PAUSE %d\n", pause_time);
 
 		for (queue = 0; queue < tx_cnt; queue++) {
-			flow |= GMAC_TX_FLOW_CTRL_TFE;
+			flow = GMAC_TX_FLOW_CTRL_TFE;
 
 			if (duplex)
 				flow |=
@@ -492,6 +493,9 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
 
 			writel(flow, ioaddr + GMAC_QX_TX_FLOW_CTRL(queue));
 		}
+	} else {
+		for (queue = 0; queue < tx_cnt; queue++)
+			writel(0, ioaddr + GMAC_QX_TX_FLOW_CTRL(queue));
 	}
 }
 
-- 
GitLab


From 50331c64f3ddcab2648760e51a7097e6bc5ddc20 Mon Sep 17 00:00:00 2001
From: Biao Huang <biao.huang@mediatek.com>
Date: Mon, 3 Jun 2019 09:58:05 +0800
Subject: [PATCH 0825/1835] net: stmmac: modify default value of tx-frames

[ Upstream commit d2facb4b3983425f6776c24dd678a82dbe673773 ]

the default value of tx-frames is 25, it's too late when
passing tstamp to stack, then the ptp4l will fail:

ptp4l -i eth0 -f gPTP.cfg -m
ptp4l: selected /dev/ptp0 as PTP clock
ptp4l: port 1: INITIALIZING to LISTENING on INITIALIZE
ptp4l: port 0: INITIALIZING to LISTENING on INITIALIZE
ptp4l: port 1: link up
ptp4l: timed out while polling for tx timestamp
ptp4l: increasing tx_timestamp_timeout may correct this issue,
       but it is likely caused by a driver bug
ptp4l: port 1: send peer delay response failed
ptp4l: port 1: LISTENING to FAULTY on FAULT_DETECTED (FT_UNSPECIFIED)

ptp4l tests pass when changing the tx-frames from 25 to 1 with
ethtool -C option.
It should be fine to set tx-frames default value to 1, so ptp4l will pass
by default.

Signed-off-by: Biao Huang <biao.huang@mediatek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 272b9ca663148..b069b3a2453be 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -261,7 +261,7 @@ struct stmmac_safety_stats {
 #define STMMAC_COAL_TX_TIMER	1000
 #define STMMAC_MAX_COAL_TX_TICK	100000
 #define STMMAC_TX_MAX_FRAMES	256
-#define STMMAC_TX_FRAMES	25
+#define STMMAC_TX_FRAMES	1
 
 /* Packets types */
 enum packets_types {
-- 
GitLab


From 403c4392147981d4e4d00d6bd8e6146c64ff16b8 Mon Sep 17 00:00:00 2001
From: Antoine Tenart <antoine.tenart@bootlin.com>
Date: Mon, 27 May 2019 16:51:06 +0200
Subject: [PATCH 0826/1835] crypto: inside-secure - do not rely on the hardware
 last bit for result descriptors

[ Upstream commit 89332590427235680236b9470e851afc49b3caa1 ]

When performing a transformation the hardware is given result
descriptors to save the result data. Those result descriptors are
batched using a 'first' and a 'last' bit. There are cases were more
descriptors than needed are given to the engine, leading to the engine
only using some of them, and not setting the last bit on the last
descriptor we gave. This causes issues were the driver and the hardware
aren't in sync anymore about the number of result descriptors given (as
the driver do not give a pool of descriptor to use for any
transformation, but a pool of descriptors to use *per* transformation).

This patch fixes it by attaching the number of given result descriptors
to the requests, and by using this number instead of the 'last' bit
found on the descriptors to process them.

Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../crypto/inside-secure/safexcel_cipher.c    | 24 ++++++++++++++-----
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
index 3aef1d43e4351..42a3830fbd190 100644
--- a/drivers/crypto/inside-secure/safexcel_cipher.c
+++ b/drivers/crypto/inside-secure/safexcel_cipher.c
@@ -51,6 +51,8 @@ struct safexcel_cipher_ctx {
 
 struct safexcel_cipher_req {
 	enum safexcel_cipher_direction direction;
+	/* Number of result descriptors associated to the request */
+	unsigned int rdescs;
 	bool needs_inv;
 };
 
@@ -333,7 +335,10 @@ static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int rin
 
 	*ret = 0;
 
-	do {
+	if (unlikely(!sreq->rdescs))
+		return 0;
+
+	while (sreq->rdescs--) {
 		rdesc = safexcel_ring_next_rptr(priv, &priv->ring[ring].rdr);
 		if (IS_ERR(rdesc)) {
 			dev_err(priv->dev,
@@ -346,7 +351,7 @@ static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int rin
 			*ret = safexcel_rdesc_check_errors(priv, rdesc);
 
 		ndesc++;
-	} while (!rdesc->last_seg);
+	}
 
 	safexcel_complete(priv, ring);
 
@@ -501,6 +506,7 @@ cdesc_rollback:
 static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
 				      int ring,
 				      struct crypto_async_request *base,
+				      struct safexcel_cipher_req *sreq,
 				      bool *should_complete, int *ret)
 {
 	struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(base->tfm);
@@ -509,7 +515,10 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
 
 	*ret = 0;
 
-	do {
+	if (unlikely(!sreq->rdescs))
+		return 0;
+
+	while (sreq->rdescs--) {
 		rdesc = safexcel_ring_next_rptr(priv, &priv->ring[ring].rdr);
 		if (IS_ERR(rdesc)) {
 			dev_err(priv->dev,
@@ -522,7 +531,7 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
 			*ret = safexcel_rdesc_check_errors(priv, rdesc);
 
 		ndesc++;
-	} while (!rdesc->last_seg);
+	}
 
 	safexcel_complete(priv, ring);
 
@@ -564,7 +573,7 @@ static int safexcel_skcipher_handle_result(struct safexcel_crypto_priv *priv,
 
 	if (sreq->needs_inv) {
 		sreq->needs_inv = false;
-		err = safexcel_handle_inv_result(priv, ring, async,
+		err = safexcel_handle_inv_result(priv, ring, async, sreq,
 						 should_complete, ret);
 	} else {
 		err = safexcel_handle_req_result(priv, ring, async, req->src,
@@ -587,7 +596,7 @@ static int safexcel_aead_handle_result(struct safexcel_crypto_priv *priv,
 
 	if (sreq->needs_inv) {
 		sreq->needs_inv = false;
-		err = safexcel_handle_inv_result(priv, ring, async,
+		err = safexcel_handle_inv_result(priv, ring, async, sreq,
 						 should_complete, ret);
 	} else {
 		err = safexcel_handle_req_result(priv, ring, async, req->src,
@@ -633,6 +642,8 @@ static int safexcel_skcipher_send(struct crypto_async_request *async, int ring,
 		ret = safexcel_send_req(async, ring, sreq, req->src,
 					req->dst, req->cryptlen, 0, 0, req->iv,
 					commands, results);
+
+	sreq->rdescs = *results;
 	return ret;
 }
 
@@ -655,6 +666,7 @@ static int safexcel_aead_send(struct crypto_async_request *async, int ring,
 					req->cryptlen, req->assoclen,
 					crypto_aead_authsize(tfm), req->iv,
 					commands, results);
+	sreq->rdescs = *results;
 	return ret;
 }
 
-- 
GitLab


From 9d643358386d46c261e000a93f5eb28dd8009e33 Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@gmail.com>
Date: Thu, 6 Jun 2019 09:40:33 -0300
Subject: [PATCH 0827/1835] net: fec: Do not use netdev messages too early

[ Upstream commit a19a0582363b9a5f8ba812f34f1b8df394898780 ]

When a valid MAC address is not found the current messages
are shown:

fec 2188000.ethernet (unnamed net_device) (uninitialized): Invalid MAC address: 00:00:00:00:00:00
fec 2188000.ethernet (unnamed net_device) (uninitialized): Using random MAC address: aa:9f:25:eb:7e:aa

Since the network device has not been registered at this point, it is better
to use dev_err()/dev_info() instead, which will provide cleaner log
messages like these:

fec 2188000.ethernet: Invalid MAC address: 00:00:00:00:00:00
fec 2188000.ethernet: Using random MAC address: aa:9f:25:eb:7e:aa

Tested on a imx6dl-pico-pi board.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index bf715a3672736..4cf80de4c471c 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1689,10 +1689,10 @@ static void fec_get_mac(struct net_device *ndev)
 	 */
 	if (!is_valid_ether_addr(iap)) {
 		/* Report it and use a random ethernet address instead */
-		netdev_err(ndev, "Invalid MAC address: %pM\n", iap);
+		dev_err(&fep->pdev->dev, "Invalid MAC address: %pM\n", iap);
 		eth_hw_addr_random(ndev);
-		netdev_info(ndev, "Using random MAC address: %pM\n",
-			    ndev->dev_addr);
+		dev_info(&fep->pdev->dev, "Using random MAC address: %pM\n",
+			 ndev->dev_addr);
 		return;
 	}
 
-- 
GitLab


From a76f32cbd38c6bf6cfe841c2916ded1ad371eaa5 Mon Sep 17 00:00:00 2001
From: Robert Hancock <hancock@sedsystems.ca>
Date: Thu, 6 Jun 2019 16:28:17 -0600
Subject: [PATCH 0828/1835] net: axienet: Fix race condition causing TX hang

[ Upstream commit 7de44285c1f69ccfbe8be1d6a16fcd956681fee6 ]

It is possible that the interrupt handler fires and frees up space in
the TX ring in between checking for sufficient TX ring space and
stopping the TX queue in axienet_start_xmit. If this happens, the
queue wake from the interrupt handler will occur before the queue is
stopped, causing a lost wakeup and the adapter's transmit hanging.

To avoid this, after stopping the queue, check again whether there is
sufficient space in the TX ring. If so, wake up the queue again.

Signed-off-by: Robert Hancock <hancock@sedsystems.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/xilinx/xilinx_axienet_main.c | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 7cfd7ff38e86f..66b30ebd45ee8 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -614,6 +614,10 @@ static void axienet_start_xmit_done(struct net_device *ndev)
 
 	ndev->stats.tx_packets += packets;
 	ndev->stats.tx_bytes += size;
+
+	/* Matches barrier in axienet_start_xmit */
+	smp_mb();
+
 	netif_wake_queue(ndev);
 }
 
@@ -668,9 +672,19 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 	cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
 
 	if (axienet_check_tx_bd_space(lp, num_frag)) {
-		if (!netif_queue_stopped(ndev))
-			netif_stop_queue(ndev);
-		return NETDEV_TX_BUSY;
+		if (netif_queue_stopped(ndev))
+			return NETDEV_TX_BUSY;
+
+		netif_stop_queue(ndev);
+
+		/* Matches barrier in axienet_start_xmit_done */
+		smp_mb();
+
+		/* Space might have just been freed - check again */
+		if (axienet_check_tx_bd_space(lp, num_frag))
+			return NETDEV_TX_BUSY;
+
+		netif_wake_queue(ndev);
 	}
 
 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
-- 
GitLab


From 99dcd701465fca915fe1e65668485564c4acd52f Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Mon, 3 Jun 2019 07:47:04 +0200
Subject: [PATCH 0829/1835] s390/qdio: handle PENDING state for QEBSM devices

[ Upstream commit 04310324c6f482921c071444833e70fe861b73d9 ]

When a CQ-enabled device uses QEBSM for SBAL state inspection,
get_buf_states() can return the PENDING state for an Output Queue.
get_outbound_buffer_frontier() isn't prepared for this, and any PENDING
buffer will permanently stall all further completion processing on this
Queue.

This isn't a concern for non-QEBSM devices, as get_buf_states() for such
devices will manually turn PENDING buffers into EMPTY ones.

Fixes: 104ea556ee7f ("qdio: support asynchronous delivery of storage blocks")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/qdio_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 9c7d9da42ba08..4ac4a73037f59 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -749,6 +749,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
 
 	switch (state) {
 	case SLSB_P_OUTPUT_EMPTY:
+	case SLSB_P_OUTPUT_PENDING:
 		/* the adapter got it */
 		DBF_DEV_EVENT(DBF_INFO, q->irq_ptr,
 			"out empty:%1d %02x", q->nr, count);
-- 
GitLab


From fa4059c5497e42fd9b91da1d32e14792f998e985 Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Sat, 20 Apr 2019 12:53:05 +0200
Subject: [PATCH 0830/1835] RAS/CEC: Fix pfn insertion

[ Upstream commit 6d8e294bf5f0e85c34e8b14b064e2965f53f38b0 ]

When inserting random PFNs for debugging the CEC through
(debugfs)/ras/cec/pfn, depending on the return value of pfn_set(),
multiple values get inserted per a single write.

That is because simple_attr_write() interprets a retval of 0 as
success and claims the whole input. However, pfn_set() returns the
cec_add_elem() value, which, if > 0 and smaller than the whole input
length, makes glibc continue issuing the write syscall until there's
input left:

  pfn_set
  simple_attr_write
  debugfs_attr_write
  full_proxy_write
  vfs_write
  ksys_write
  do_syscall_64
  entry_SYSCALL_64_after_hwframe

leading to those repeated calls.

Return 0 to fix that.

Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Tony Luck <tony.luck@intel.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ras/cec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
index f85d6b7a19848..5d2b2c02cbbec 100644
--- a/drivers/ras/cec.c
+++ b/drivers/ras/cec.c
@@ -369,7 +369,9 @@ static int pfn_set(void *data, u64 val)
 {
 	*(u64 *)data = val;
 
-	return cec_add_elem(val);
+	cec_add_elem(val);
+
+	return 0;
 }
 
 DEFINE_DEBUGFS_ATTRIBUTE(pfn_ops, u64_get, pfn_set, "0x%llx\n");
-- 
GitLab


From c7bf2df4504439480afce68e84490d5d976deebc Mon Sep 17 00:00:00 2001
From: Robert Hancock <hancock@sedsystems.ca>
Date: Fri, 7 Jun 2019 10:42:36 -0600
Subject: [PATCH 0831/1835] net: sfp: add mutex to prevent concurrent state
 checks

[ Upstream commit 2158e856f56bb762ef90f3ec244d41a519826f75 ]

sfp_check_state can potentially be called by both a threaded IRQ handler
and delayed work. If it is concurrently called, it could result in
incorrect state management. Add a st_mutex to protect the state - this
lock gets taken outside of code that checks and handle state changes, and
the existing sm_mutex nests inside of it.

Suggested-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Robert Hancock <hancock@sedsystems.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/sfp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 8807a806cc47f..418522aa2f71f 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -185,10 +185,11 @@ struct sfp {
 	struct gpio_desc *gpio[GPIO_MAX];
 
 	bool attached;
+	struct mutex st_mutex;			/* Protects state */
 	unsigned int state;
 	struct delayed_work poll;
 	struct delayed_work timeout;
-	struct mutex sm_mutex;
+	struct mutex sm_mutex;			/* Protects state machine */
 	unsigned char sm_mod_state;
 	unsigned char sm_dev_state;
 	unsigned short sm_state;
@@ -1718,6 +1719,7 @@ static void sfp_check_state(struct sfp *sfp)
 {
 	unsigned int state, i, changed;
 
+	mutex_lock(&sfp->st_mutex);
 	state = sfp_get_state(sfp);
 	changed = state ^ sfp->state;
 	changed &= SFP_F_PRESENT | SFP_F_LOS | SFP_F_TX_FAULT;
@@ -1743,6 +1745,7 @@ static void sfp_check_state(struct sfp *sfp)
 		sfp_sm_event(sfp, state & SFP_F_LOS ?
 				SFP_E_LOS_HIGH : SFP_E_LOS_LOW);
 	rtnl_unlock();
+	mutex_unlock(&sfp->st_mutex);
 }
 
 static irqreturn_t sfp_irq(int irq, void *data)
@@ -1773,6 +1776,7 @@ static struct sfp *sfp_alloc(struct device *dev)
 	sfp->dev = dev;
 
 	mutex_init(&sfp->sm_mutex);
+	mutex_init(&sfp->st_mutex);
 	INIT_DELAYED_WORK(&sfp->poll, sfp_poll);
 	INIT_DELAYED_WORK(&sfp->timeout, sfp_timeout);
 
-- 
GitLab


From ac510285d40ba9e9915ed242c6e2257e43bf9cbc Mon Sep 17 00:00:00 2001
From: Stefano Brivio <sbrivio@redhat.com>
Date: Sun, 26 May 2019 23:14:06 +0200
Subject: [PATCH 0832/1835] ipset: Fix memory accounting for hash types on
 resize

[ Upstream commit 11921796f4799ca9c61c4b22cc54d84aa69f8a35 ]

If a fresh array block is allocated during resize, the current in-memory
set size should be increased by the size of the block, not replaced by it.

Before the fix, adding entries to a hash set type, leading to a table
resize, caused an inconsistent memory size to be reported. This becomes
more obvious when swapping sets with similar sizes:

  # cat hash_ip_size.sh
  #!/bin/sh
  FAIL_RETRIES=10

  tries=0
  while [ ${tries} -lt ${FAIL_RETRIES} ]; do
  	ipset create t1 hash:ip
  	for i in `seq 1 4345`; do
  		ipset add t1 1.2.$((i / 255)).$((i % 255))
  	done
  	t1_init="$(ipset list t1|sed -n 's/Size in memory: \(.*\)/\1/p')"

  	ipset create t2 hash:ip
  	for i in `seq 1 4360`; do
  		ipset add t2 1.2.$((i / 255)).$((i % 255))
  	done
  	t2_init="$(ipset list t2|sed -n 's/Size in memory: \(.*\)/\1/p')"

  	ipset swap t1 t2
  	t1_swap="$(ipset list t1|sed -n 's/Size in memory: \(.*\)/\1/p')"
  	t2_swap="$(ipset list t2|sed -n 's/Size in memory: \(.*\)/\1/p')"

  	ipset destroy t1
  	ipset destroy t2
  	tries=$((tries + 1))

  	if [ ${t1_init} -lt 10000 ] || [ ${t2_init} -lt 10000 ]; then
  		echo "FAIL after ${tries} tries:"
  		echo "T1 size ${t1_init}, after swap ${t1_swap}"
  		echo "T2 size ${t2_init}, after swap ${t2_swap}"
  		exit 1
  	fi
  done
  echo "PASS"
  # echo -n 'func hash_ip4_resize +p' > /sys/kernel/debug/dynamic_debug/control
  # ./hash_ip_size.sh
  [ 2035.018673] attempt to resize set t1 from 10 to 11, t 00000000fe6551fa
  [ 2035.078583] set t1 resized from 10 (00000000fe6551fa) to 11 (00000000172a0163)
  [ 2035.080353] Table destroy by resize 00000000fe6551fa
  FAIL after 4 tries:
  T1 size 9064, after swap 71128
  T2 size 71128, after swap 9064

Reported-by: NOYB <JunkYardMail1@Frontier.com>
Fixes: 9e41f26a505c ("netfilter: ipset: Count non-static extension memory for userspace")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 8a33dac4e8058..ddfe06d7530ba 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -625,7 +625,7 @@ retry:
 					goto cleanup;
 				}
 				m->size = AHASH_INIT_SIZE;
-				extsize = ext_size(AHASH_INIT_SIZE, dsize);
+				extsize += ext_size(AHASH_INIT_SIZE, dsize);
 				RCU_INIT_POINTER(hbucket(t, key), m);
 			} else if (m->pos >= m->size) {
 				struct hbucket *ht;
-- 
GitLab


From 3662d8bca087c4b4799094689ee23a4406bc59de Mon Sep 17 00:00:00 2001
From: Mathieu Poirier <mathieu.poirier@linaro.org>
Date: Wed, 5 Jun 2019 10:16:33 -0600
Subject: [PATCH 0833/1835] perf cs-etm: Properly set the value of 'old' and
 'head' in snapshot mode

[ Upstream commit e45c48a9a4d20ebc7b639a62c3ef8f4b08007027 ]

This patch adds the necessary intelligence to properly compute the value
of 'old' and 'head' when operating in snapshot mode.  That way we can
get the latest information in the AUX buffer and be compatible with the
generic AUX ring buffer mechanic.

Tester notes:

> Leo, have you had the chance to test/review this one? Suzuki?

Sure.  I applied this patch on the perf/core branch (with latest
commit 3e4fbf36c1e3 'perf augmented_raw_syscalls: Move reading
filename to the loop') and passed testing with below steps:

  # perf record -e cs_etm/@tmc_etr0/ -S -m,64 --per-thread ./sort &
  [1] 19097
  Bubble sorting array of 30000 elements

  # kill -USR2 19097
  # kill -USR2 19097
  # kill -USR2 19097
  [ perf record: Woken up 4 times to write data ]
  [ perf record: Captured and wrote 0.753 MB perf.data ]

Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Tested-by: Leo Yan <leo.yan@linaro.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190605161633.12245-1-mathieu.poirier@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/arch/arm/util/cs-etm.c | 127 +++++++++++++++++++++++++++++-
 1 file changed, 123 insertions(+), 4 deletions(-)

diff --git a/tools/perf/arch/arm/util/cs-etm.c b/tools/perf/arch/arm/util/cs-etm.c
index 2f595cd73da66..16af6c3b1365b 100644
--- a/tools/perf/arch/arm/util/cs-etm.c
+++ b/tools/perf/arch/arm/util/cs-etm.c
@@ -32,6 +32,8 @@ struct cs_etm_recording {
 	struct auxtrace_record	itr;
 	struct perf_pmu		*cs_etm_pmu;
 	struct perf_evlist	*evlist;
+	int			wrapped_cnt;
+	bool			*wrapped;
 	bool			snapshot_mode;
 	size_t			snapshot_size;
 };
@@ -495,16 +497,131 @@ static int cs_etm_info_fill(struct auxtrace_record *itr,
 	return 0;
 }
 
-static int cs_etm_find_snapshot(struct auxtrace_record *itr __maybe_unused,
+static int cs_etm_alloc_wrapped_array(struct cs_etm_recording *ptr, int idx)
+{
+	bool *wrapped;
+	int cnt = ptr->wrapped_cnt;
+
+	/* Make @ptr->wrapped as big as @idx */
+	while (cnt <= idx)
+		cnt++;
+
+	/*
+	 * Free'ed in cs_etm_recording_free().  Using realloc() to avoid
+	 * cross compilation problems where the host's system supports
+	 * reallocarray() but not the target.
+	 */
+	wrapped = realloc(ptr->wrapped, cnt * sizeof(bool));
+	if (!wrapped)
+		return -ENOMEM;
+
+	wrapped[cnt - 1] = false;
+	ptr->wrapped_cnt = cnt;
+	ptr->wrapped = wrapped;
+
+	return 0;
+}
+
+static bool cs_etm_buffer_has_wrapped(unsigned char *buffer,
+				      size_t buffer_size, u64 head)
+{
+	u64 i, watermark;
+	u64 *buf = (u64 *)buffer;
+	size_t buf_size = buffer_size;
+
+	/*
+	 * We want to look the very last 512 byte (chosen arbitrarily) in
+	 * the ring buffer.
+	 */
+	watermark = buf_size - 512;
+
+	/*
+	 * @head is continuously increasing - if its value is equal or greater
+	 * than the size of the ring buffer, it has wrapped around.
+	 */
+	if (head >= buffer_size)
+		return true;
+
+	/*
+	 * The value of @head is somewhere within the size of the ring buffer.
+	 * This can be that there hasn't been enough data to fill the ring
+	 * buffer yet or the trace time was so long that @head has numerically
+	 * wrapped around.  To find we need to check if we have data at the very
+	 * end of the ring buffer.  We can reliably do this because mmap'ed
+	 * pages are zeroed out and there is a fresh mapping with every new
+	 * session.
+	 */
+
+	/* @head is less than 512 byte from the end of the ring buffer */
+	if (head > watermark)
+		watermark = head;
+
+	/*
+	 * Speed things up by using 64 bit transactions (see "u64 *buf" above)
+	 */
+	watermark >>= 3;
+	buf_size >>= 3;
+
+	/*
+	 * If we find trace data at the end of the ring buffer, @head has
+	 * been there and has numerically wrapped around at least once.
+	 */
+	for (i = watermark; i < buf_size; i++)
+		if (buf[i])
+			return true;
+
+	return false;
+}
+
+static int cs_etm_find_snapshot(struct auxtrace_record *itr,
 				int idx, struct auxtrace_mmap *mm,
-				unsigned char *data __maybe_unused,
+				unsigned char *data,
 				u64 *head, u64 *old)
 {
+	int err;
+	bool wrapped;
+	struct cs_etm_recording *ptr =
+			container_of(itr, struct cs_etm_recording, itr);
+
+	/*
+	 * Allocate memory to keep track of wrapping if this is the first
+	 * time we deal with this *mm.
+	 */
+	if (idx >= ptr->wrapped_cnt) {
+		err = cs_etm_alloc_wrapped_array(ptr, idx);
+		if (err)
+			return err;
+	}
+
+	/*
+	 * Check to see if *head has wrapped around.  If it hasn't only the
+	 * amount of data between *head and *old is snapshot'ed to avoid
+	 * bloating the perf.data file with zeros.  But as soon as *head has
+	 * wrapped around the entire size of the AUX ring buffer it taken.
+	 */
+	wrapped = ptr->wrapped[idx];
+	if (!wrapped && cs_etm_buffer_has_wrapped(data, mm->len, *head)) {
+		wrapped = true;
+		ptr->wrapped[idx] = true;
+	}
+
 	pr_debug3("%s: mmap index %d old head %zu new head %zu size %zu\n",
 		  __func__, idx, (size_t)*old, (size_t)*head, mm->len);
 
-	*old = *head;
-	*head += mm->len;
+	/* No wrap has occurred, we can just use *head and *old. */
+	if (!wrapped)
+		return 0;
+
+	/*
+	 * *head has wrapped around - adjust *head and *old to pickup the
+	 * entire content of the AUX buffer.
+	 */
+	if (*head >= mm->len) {
+		*old = *head - mm->len;
+	} else {
+		*head += mm->len;
+		*old = *head - mm->len;
+	}
 
 	return 0;
 }
@@ -545,6 +662,8 @@ static void cs_etm_recording_free(struct auxtrace_record *itr)
 {
 	struct cs_etm_recording *ptr =
 			container_of(itr, struct cs_etm_recording, itr);
+
+	zfree(&ptr->wrapped);
 	free(ptr);
 }
 
-- 
GitLab


From be32a9dc3f6221aae6dea35460409e2db748c067 Mon Sep 17 00:00:00 2001
From: Thomas Richter <tmricht@linux.ibm.com>
Date: Tue, 4 Jun 2019 07:35:04 +0200
Subject: [PATCH 0834/1835] perf test 6: Fix missing kvm module load for s390

[ Upstream commit 53fe307dfd309e425b171f6272d64296a54f4dff ]

Command

   # perf test -Fv 6

fails with error

   running test 100 'kvm-s390:kvm_s390_create_vm' failed to parse
    event 'kvm-s390:kvm_s390_create_vm', err -1, str 'unknown tracepoint'
    event syntax error: 'kvm-s390:kvm_s390_create_vm'
                         \___ unknown tracepoint

when the kvm module is not loaded or not built in.

Fix this by adding a valid function which tests if the module
is loaded. Loaded modules (or builtin KVM support) have a
directory named
  /sys/kernel/debug/tracing/events/kvm-s390
for this tracepoint.

Check for existence of this directory.

Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20190604053504.43073-1-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/parse-events.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
index 3b97ac018d5aa..532c95e8fa6b4 100644
--- a/tools/perf/tests/parse-events.c
+++ b/tools/perf/tests/parse-events.c
@@ -18,6 +18,32 @@
 #define PERF_TP_SAMPLE_TYPE (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | \
 			     PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD)
 
+#if defined(__s390x__)
+/* Return true if kvm module is available and loaded. Test this
+ * and retun success when trace point kvm_s390_create_vm
+ * exists. Otherwise this test always fails.
+ */
+static bool kvm_s390_create_vm_valid(void)
+{
+	char *eventfile;
+	bool rc = false;
+
+	eventfile = get_events_file("kvm-s390");
+
+	if (eventfile) {
+		DIR *mydir = opendir(eventfile);
+
+		if (mydir) {
+			rc = true;
+			closedir(mydir);
+		}
+		put_events_file(eventfile);
+	}
+
+	return rc;
+}
+#endif
+
 static int test__checkevent_tracepoint(struct perf_evlist *evlist)
 {
 	struct perf_evsel *evsel = perf_evlist__first(evlist);
@@ -1622,6 +1648,7 @@ static struct evlist_test test__events[] = {
 	{
 		.name  = "kvm-s390:kvm_s390_create_vm",
 		.check = test__checkevent_tracepoint,
+		.valid = kvm_s390_create_vm_valid,
 		.id    = 100,
 	},
 #endif
-- 
GitLab


From eac8b39d089a728489fbbb832cfc5183ecd2abfa Mon Sep 17 00:00:00 2001
From: Thomas Richter <tmricht@linux.ibm.com>
Date: Thu, 23 May 2019 10:25:21 +0200
Subject: [PATCH 0835/1835] perf report: Fix OOM error in TUI mode on s390

[ Upstream commit 8a07aa4e9b7b0222129c07afff81634a884b2866 ]

Debugging a OOM error using the TUI interface revealed this issue
on s390:

[tmricht@m83lp54 perf]$ cat /proc/kallsyms |sort
....
00000001119b7158 B radix_tree_node_cachep
00000001119b8000 B __bss_stop
00000001119b8000 B _end
000003ff80002850 t autofs_mount	[autofs4]
000003ff80002868 t autofs_show_options	[autofs4]
000003ff80002a98 t autofs_evict_inode	[autofs4]
....

There is a huge gap between the last kernel symbol
__bss_stop/_end and the first kernel module symbol
autofs_mount (from autofs4 module).

After reading the kernel symbol table via functions:

 dso__load()
 +--> dso__load_kernel_sym()
      +--> dso__load_kallsyms()
	   +--> __dso_load_kallsyms()
	        +--> symbols__fixup_end()

the symbol __bss_stop has a start address of 1119b8000 and
an end address of 3ff80002850, as can be seen by this debug statement:

  symbols__fixup_end __bss_stop start:0x1119b8000 end:0x3ff80002850

The size of symbol __bss_stop is 0x3fe6e64a850 bytes!
It is the last kernel symbol and fills up the space until
the first kernel module symbol.

This size kills the TUI interface when executing the following
code:

  process_sample_event()
    hist_entry_iter__add()
      hist_iter__report_callback()
        hist_entry__inc_addr_samples()
          symbol__inc_addr_samples(symbol = __bss_stop)
            symbol__cycles_hist()
               annotated_source__alloc_histograms(...,
				                symbol__size(sym),
		                                ...)

This function allocates memory to save sample histograms.
The symbol_size() marco is defined as sym->end - sym->start, which
results in above value of 0x3fe6e64a850 bytes and
the call to calloc() in annotated_source__alloc_histograms() fails.

The histgram memory allocation might fail, make this failure
no-fatal and continue processing.

Output before:
[tmricht@m83lp54 perf]$ ./perf --debug stderr=1 report -vvvvv \
					      -i ~/slow.data 2>/tmp/2
[tmricht@m83lp54 perf]$ tail -5 /tmp/2
  __symbol__inc_addr_samples(875): ENOMEM! sym->name=__bss_stop,
		start=0x1119b8000, addr=0x2aa0005eb08, end=0x3ff80002850,
		func: 0
problem adding hist entry, skipping event
0x938b8 [0x8]: failed to process type: 68 [Cannot allocate memory]
[tmricht@m83lp54 perf]$

Output after:
[tmricht@m83lp54 perf]$ ./perf --debug stderr=1 report -vvvvv \
					      -i ~/slow.data 2>/tmp/2
[tmricht@m83lp54 perf]$ tail -5 /tmp/2
   symbol__inc_addr_samples map:0x1597830 start:0x110730000 end:0x3ff80002850
   symbol__hists notes->src:0x2aa2a70 nr_hists:1
   symbol__inc_addr_samples sym:unlink_anon_vmas src:0x2aa2a70
   __symbol__inc_addr_samples: addr=0x11094c69e
   0x11094c670 unlink_anon_vmas: period++ [addr: 0x11094c69e, 0x2e, evidx=0]
   	=> nr_samples: 1, period: 526008
[tmricht@m83lp54 perf]$

There is no error about failed memory allocation and the TUI interface
shows all entries.

Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/90cb5607-3e12-5167-682d-978eba7dafa8@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/annotate.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index dfee110b3a589..c357051dd2b6f 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -911,9 +911,8 @@ static int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
 	if (sym == NULL)
 		return 0;
 	src = symbol__hists(sym, evsel->evlist->nr_entries);
-	if (src == NULL)
-		return -ENOMEM;
-	return __symbol__inc_addr_samples(sym, map, src, evsel->idx, addr, sample);
+	return (src) ?  __symbol__inc_addr_samples(sym, map, src, evsel->idx,
+						   addr, sample) : 0;
 }
 
 static int symbol__account_cycles(u64 addr, u64 start,
-- 
GitLab


From c844f4da9b92e689fc447a52d5996fd361a9d567 Mon Sep 17 00:00:00 2001
From: Xingyu Chen <xingyu.chen@amlogic.com>
Date: Sat, 8 Jun 2019 21:04:10 +0200
Subject: [PATCH 0836/1835] irqchip/meson-gpio: Add support for Meson-G12A SoC

[ Upstream commit c64a9e804ccf86eb202bfd1c6a8c5233c75a0431 ]

The Meson-G12A SoC uses the same GPIO interrupt controller IP block as the
other Meson SoCs, A totle of 100 pins can be spied on, which is the sum of:

- 223:100 undefined (no interrupt)
- 99:97   3 pins on bank GPIOE
- 96:77   20 pins on bank GPIOX
- 76:61   16 pins on bank GPIOA
- 60:53   8 pins on bank GPIOC
- 52:37   16 pins on bank BOOT
- 36:28   9 pins on bank GPIOH
- 27:12   16 pins on bank GPIOZ
- 11:0    12 pins in the AO domain

Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
Signed-off-by: Jianxin Pan <jianxin.pan@amlogic.com>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-meson-gpio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-meson-gpio.c b/drivers/irqchip/irq-meson-gpio.c
index 7b531fd075b88..7599b10ecf09d 100644
--- a/drivers/irqchip/irq-meson-gpio.c
+++ b/drivers/irqchip/irq-meson-gpio.c
@@ -73,6 +73,7 @@ static const struct of_device_id meson_irq_gpio_matches[] = {
 	{ .compatible = "amlogic,meson-gxbb-gpio-intc", .data = &gxbb_params },
 	{ .compatible = "amlogic,meson-gxl-gpio-intc", .data = &gxl_params },
 	{ .compatible = "amlogic,meson-axg-gpio-intc", .data = &axg_params },
+	{ .compatible = "amlogic,meson-g12a-gpio-intc", .data = &axg_params },
 	{ }
 };
 
-- 
GitLab


From 63e53991d791860131ce7bcf5c7f12704420c7c8 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 30 Apr 2019 08:28:14 -0400
Subject: [PATCH 0837/1835] media: uvcvideo: Fix access to uninitialized fields
 on probe error

[ Upstream commit 11a087f484bf15ff65f0a9f277aa5a61fd07ed2a ]

We need to check whether this work we are canceling actually is
initialized.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+2e1ef9188251d9cc7944@syzkaller.appspotmail.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_ctrl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 467b1ddaf4e75..f2854337cdcac 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2350,7 +2350,9 @@ void uvc_ctrl_cleanup_device(struct uvc_device *dev)
 	struct uvc_entity *entity;
 	unsigned int i;
 
-	cancel_work_sync(&dev->async_ctrl.work);
+	/* Can be uninitialized if we are aborting on probe error. */
+	if (dev->async_ctrl.work.func)
+		cancel_work_sync(&dev->async_ctrl.work);
 
 	/* Free controls and control mappings for all entities. */
 	list_for_each_entry(entity, &dev->entities, list) {
-- 
GitLab


From f2a4624be8f3d592389c9c5524377f0ae15fc5f7 Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Date: Wed, 15 May 2019 11:39:12 -0400
Subject: [PATCH 0838/1835] media: fdp1: Support M3N and E3 platforms

[ Upstream commit 4e8c120de9268fc26f583268b9d22e7d37c4595f ]

New Gen3 R-Car platforms incorporate the FDP1 with an updated version
register. No code change is required to support these targets, but they
will currently report an error stating that the device can not be
identified.

Update the driver to match against the new device types.

Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar_fdp1.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
index 2a15b7cca338f..0d14670288113 100644
--- a/drivers/media/platform/rcar_fdp1.c
+++ b/drivers/media/platform/rcar_fdp1.c
@@ -257,6 +257,8 @@ MODULE_PARM_DESC(debug, "activate debug info");
 #define FD1_IP_H3_ES1			0x02010101
 #define FD1_IP_M3W			0x02010202
 #define FD1_IP_H3			0x02010203
+#define FD1_IP_M3N			0x02010204
+#define FD1_IP_E3			0x02010205
 
 /* LUTs */
 #define FD1_LUT_DIF_ADJ			0x1000
@@ -2365,6 +2367,12 @@ static int fdp1_probe(struct platform_device *pdev)
 	case FD1_IP_H3:
 		dprintk(fdp1, "FDP1 Version R-Car H3\n");
 		break;
+	case FD1_IP_M3N:
+		dprintk(fdp1, "FDP1 Version R-Car M3N\n");
+		break;
+	case FD1_IP_E3:
+		dprintk(fdp1, "FDP1 Version R-Car E3\n");
+		break;
 	default:
 		dev_err(fdp1->dev, "FDP1 Unidentifiable (0x%08x)\n",
 				hw_version);
-- 
GitLab


From 79644b600850bc0102dbb44dca66069dc48441d8 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 3 Jun 2019 08:53:30 +0200
Subject: [PATCH 0839/1835] iommu: Fix a leak in iommu_insert_resv_region

[ Upstream commit ad0834dedaa15c3a176f783c0373f836e44b4700 ]

In case we expand an existing region, we unlink
this latter and insert the larger one. In
that case we should free the original region after
the insertion. Also we can immediately return.

Fixes: 6c65fb318e8b ("iommu: iommu_get_group_resv_regions")

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/iommu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 8c15c59802993..bc14825edc9cb 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -211,18 +211,21 @@ static int iommu_insert_resv_region(struct iommu_resv_region *new,
 			pos = pos->next;
 		} else if ((start >= a) && (end <= b)) {
 			if (new->type == type)
-				goto done;
+				return 0;
 			else
 				pos = pos->next;
 		} else {
 			if (new->type == type) {
 				phys_addr_t new_start = min(a, start);
 				phys_addr_t new_end = max(b, end);
+				int ret;
 
 				list_del(&entry->list);
 				entry->start = new_start;
 				entry->length = new_end - new_start + 1;
-				iommu_insert_resv_region(entry, regions);
+				ret = iommu_insert_resv_region(entry, regions);
+				kfree(entry);
+				return ret;
 			} else {
 				pos = pos->next;
 			}
@@ -235,7 +238,6 @@ insert:
 		return -ENOMEM;
 
 	list_add_tail(&region->list, pos);
-done:
 	return 0;
 }
 
-- 
GitLab


From ddeef7a00050bcd9ff285a3c20709cbea9132c04 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Mon, 10 Jun 2019 20:10:45 +0300
Subject: [PATCH 0840/1835] gpio: omap: fix lack of irqstatus_raw0 for OMAP4

[ Upstream commit 64ea3e9094a1f13b96c33244a3fb3a0f45690bd2 ]

Commit 384ebe1c2849 ("gpio/omap: Add DT support to GPIO driver") added
the register definition tables to the gpio-omap driver. Subsequently to
that commit, commit 4e962e8998cc ("gpio/omap: remove cpu_is_omapxxxx()
checks from *_runtime_resume()") added definitions for irqstatus_raw*
registers to the legacy OMAP4 definitions, but missed the DT
definitions.

This causes an unintentional change of behaviour for the 1.101 errata
workaround on OMAP4 platforms. Fix this oversight.

Fixes: 4e962e8998cc ("gpio/omap: remove cpu_is_omapxxxx() checks from *_runtime_resume()")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-omap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 6fa430d98517c..9254bcf7f6472 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -1687,6 +1687,8 @@ static struct omap_gpio_reg_offs omap4_gpio_regs = {
 	.clr_dataout =		OMAP4_GPIO_CLEARDATAOUT,
 	.irqstatus =		OMAP4_GPIO_IRQSTATUS0,
 	.irqstatus2 =		OMAP4_GPIO_IRQSTATUS1,
+	.irqstatus_raw0 =	OMAP4_GPIO_IRQSTATUSRAW0,
+	.irqstatus_raw1 =	OMAP4_GPIO_IRQSTATUSRAW1,
 	.irqenable =		OMAP4_GPIO_IRQSTATUSSET0,
 	.irqenable2 =		OMAP4_GPIO_IRQSTATUSSET1,
 	.set_irqenable =	OMAP4_GPIO_IRQSTATUSSET0,
-- 
GitLab


From 544cd592ca72785c4a9132536b715de8ad6242b3 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Mon, 10 Jun 2019 20:10:44 +0300
Subject: [PATCH 0841/1835] gpio: omap: ensure irq is enabled before wakeup

[ Upstream commit c859e0d479b3b4f6132fc12637c51e01492f31f6 ]

Documentation states:

  NOTE: There must be a correlation between the wake-up enable and
  interrupt-enable registers. If a GPIO pin has a wake-up configured
  on it, it must also have the corresponding interrupt enabled (on
  one of the two interrupt lines).

Ensure that this condition is always satisfied by enabling the detection
events after enabling the interrupt, and disabling the detection before
disabling the interrupt.  This ensures interrupt/wakeup events can not
happen until both the wakeup and interrupt enables correlate.

If we do any clearing, clear between the interrupt enable/disable and
trigger setting.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-omap.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 9254bcf7f6472..feabac40743ee 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -837,9 +837,9 @@ static void omap_gpio_irq_shutdown(struct irq_data *d)
 
 	raw_spin_lock_irqsave(&bank->lock, flags);
 	bank->irq_usage &= ~(BIT(offset));
-	omap_set_gpio_irqenable(bank, offset, 0);
-	omap_clear_gpio_irqstatus(bank, offset);
 	omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
+	omap_clear_gpio_irqstatus(bank, offset);
+	omap_set_gpio_irqenable(bank, offset, 0);
 	if (!LINE_USED(bank->mod_usage, offset))
 		omap_clear_gpio_debounce(bank, offset);
 	omap_disable_gpio_module(bank, offset);
@@ -881,8 +881,8 @@ static void omap_gpio_mask_irq(struct irq_data *d)
 	unsigned long flags;
 
 	raw_spin_lock_irqsave(&bank->lock, flags);
-	omap_set_gpio_irqenable(bank, offset, 0);
 	omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
+	omap_set_gpio_irqenable(bank, offset, 0);
 	raw_spin_unlock_irqrestore(&bank->lock, flags);
 }
 
@@ -894,9 +894,6 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
 	unsigned long flags;
 
 	raw_spin_lock_irqsave(&bank->lock, flags);
-	if (trigger)
-		omap_set_gpio_triggering(bank, offset, trigger);
-
 	omap_set_gpio_irqenable(bank, offset, 1);
 
 	/*
@@ -904,9 +901,13 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
 	 * is cleared, thus after the handler has run. OMAP4 needs this done
 	 * after enabing the interrupt to clear the wakeup status.
 	 */
-	if (bank->level_mask & BIT(offset))
+	if (bank->regs->leveldetect0 && bank->regs->wkup_en &&
+	    trigger & (IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW))
 		omap_clear_gpio_irqstatus(bank, offset);
 
+	if (trigger)
+		omap_set_gpio_triggering(bank, offset, trigger);
+
 	raw_spin_unlock_irqrestore(&bank->lock, flags);
 }
 
-- 
GitLab


From b01bf44c363dac31128c8a4ac15a740dcb6513cf Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Date: Wed, 12 Jun 2019 12:03:43 +0100
Subject: [PATCH 0842/1835] regmap: fix bulk writes on paged registers

[ Upstream commit db057679de3e9e6a03c1bcd5aee09b0d25fd9f5b ]

On buses like SlimBus and SoundWire which does not support
gather_writes yet in regmap, A bulk write on paged register
would be silently ignored after programming page.
This is because local variable 'ret' value in regmap_raw_write_impl()
gets reset to 0 once page register is written successfully and the
code below checks for 'ret' value to be -ENOTSUPP before linearising
the write buffer to send to bus->write().

Fix this by resetting the 'ret' value to -ENOTSUPP in cases where
gather_writes() is not supported or single register write is
not possible.

Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 0360a90ad6b62..6c9f6988bc093 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1618,6 +1618,8 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
 					     map->format.reg_bytes +
 					     map->format.pad_bytes,
 					     val, val_len);
+	else
+		ret = -ENOTSUPP;
 
 	/* If that didn't work fall back on linearising by hand. */
 	if (ret == -ENOTSUPP) {
-- 
GitLab


From 7c10f8941b956c7ef96d8c8fc4c5fa496efd828d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valdis=20Kl=C4=93tnieks?= <valdis.kletnieks@vt.edu>
Date: Thu, 6 Jun 2019 22:39:27 -0400
Subject: [PATCH 0843/1835] bpf: silence warning messages in core

[ Upstream commit aee450cbe482a8c2f6fa5b05b178ef8b8ff107ca ]

Compiling kernel/bpf/core.c with W=1 causes a flood of warnings:

kernel/bpf/core.c:1198:65: warning: initialized field overwritten [-Woverride-init]
 1198 | #define BPF_INSN_3_TBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = true
      |                                                                 ^~~~
kernel/bpf/core.c:1087:2: note: in expansion of macro 'BPF_INSN_3_TBL'
 1087 |  INSN_3(ALU, ADD,  X),   \
      |  ^~~~~~
kernel/bpf/core.c:1202:3: note: in expansion of macro 'BPF_INSN_MAP'
 1202 |   BPF_INSN_MAP(BPF_INSN_2_TBL, BPF_INSN_3_TBL),
      |   ^~~~~~~~~~~~
kernel/bpf/core.c:1198:65: note: (near initialization for 'public_insntable[12]')
 1198 | #define BPF_INSN_3_TBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = true
      |                                                                 ^~~~
kernel/bpf/core.c:1087:2: note: in expansion of macro 'BPF_INSN_3_TBL'
 1087 |  INSN_3(ALU, ADD,  X),   \
      |  ^~~~~~
kernel/bpf/core.c:1202:3: note: in expansion of macro 'BPF_INSN_MAP'
 1202 |   BPF_INSN_MAP(BPF_INSN_2_TBL, BPF_INSN_3_TBL),
      |   ^~~~~~~~~~~~

98 copies of the above.

The attached patch silences the warnings, because we *know* we're overwriting
the default initializer. That leaves bpf/core.c with only 6 other warnings,
which become more visible in comparison.

Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
index 0488b82583212..ffc39a7e028d7 100644
--- a/kernel/bpf/Makefile
+++ b/kernel/bpf/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y := core.o
+CFLAGS_core.o += $(call cc-disable-warning, override-init)
 
 obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o
 obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o
-- 
GitLab


From 10e3788e6575e370c63f3f6aa501b19c3b5aa9f6 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Wed, 12 Jun 2019 09:57:57 -0400
Subject: [PATCH 0844/1835] media: s5p-mfc: fix reading min scratch buffer size
 on MFC v6/v7

[ Upstream commit be22203aec440c1761ce8542c2636ac6c8951e3a ]

MFC v6 and v7 has no register to read min scratch buffer size, so it has
to be read conditionally only if hardware supports it. This fixes following
NULL pointer exception on SoCs with MFC v6/v7:

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = f25837f9
[00000000] *pgd=bd93d835
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
Modules linked in: btmrvl_sdio btmrvl bluetooth mwifiex_sdio mwifiex ecdh_generic ecc
Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
PC is at s5p_mfc_get_min_scratch_buf_size+0x30/0x3c
LR is at s5p_mfc_get_min_scratch_buf_size+0x28/0x3c
...
[<c074f998>] (s5p_mfc_get_min_scratch_buf_size) from [<c0745bc0>] (s5p_mfc_irq+0x814/0xa5c)
[<c0745bc0>] (s5p_mfc_irq) from [<c019a218>] (__handle_irq_event_percpu+0x64/0x3f8)
[<c019a218>] (__handle_irq_event_percpu) from [<c019a5d8>] (handle_irq_event_percpu+0x2c/0x7c)
[<c019a5d8>] (handle_irq_event_percpu) from [<c019a660>] (handle_irq_event+0x38/0x5c)
[<c019a660>] (handle_irq_event) from [<c019ebc4>] (handle_fasteoi_irq+0xc4/0x180)
[<c019ebc4>] (handle_fasteoi_irq) from [<c0199270>] (generic_handle_irq+0x24/0x34)
[<c0199270>] (generic_handle_irq) from [<c0199888>] (__handle_domain_irq+0x7c/0xec)
[<c0199888>] (__handle_domain_irq) from [<c04ac298>] (gic_handle_irq+0x58/0x9c)
[<c04ac298>] (gic_handle_irq) from [<c0101ab0>] (__irq_svc+0x70/0xb0)
Exception stack(0xe73ddc60 to 0xe73ddca8)
...
[<c0101ab0>] (__irq_svc) from [<c01967d8>] (console_unlock+0x5a8/0x6a8)
[<c01967d8>] (console_unlock) from [<c01981d0>] (vprintk_emit+0x118/0x2d8)
[<c01981d0>] (vprintk_emit) from [<c01983b0>] (vprintk_default+0x20/0x28)
[<c01983b0>] (vprintk_default) from [<c01989b4>] (printk+0x30/0x54)
[<c01989b4>] (printk) from [<c07500b8>] (s5p_mfc_init_decode_v6+0x1d4/0x284)
[<c07500b8>] (s5p_mfc_init_decode_v6) from [<c07230d0>] (vb2_start_streaming+0x24/0x150)
[<c07230d0>] (vb2_start_streaming) from [<c0724e4c>] (vb2_core_streamon+0x11c/0x15c)
[<c0724e4c>] (vb2_core_streamon) from [<c07478b8>] (vidioc_streamon+0x64/0xa0)
[<c07478b8>] (vidioc_streamon) from [<c0709640>] (__video_do_ioctl+0x28c/0x45c)
[<c0709640>] (__video_do_ioctl) from [<c0709bc8>] (video_usercopy+0x260/0x8a4)
[<c0709bc8>] (video_usercopy) from [<c02b3820>] (do_vfs_ioctl+0xb0/0x9fc)
[<c02b3820>] (do_vfs_ioctl) from [<c02b41a0>] (ksys_ioctl+0x34/0x58)
[<c02b41a0>] (ksys_ioctl) from [<c0101000>] (ret_fast_syscall+0x0/0x28)
Exception stack(0xe73ddfa8 to 0xe73ddff0)
...
---[ end trace 376cf5ba6e0bee93 ]---

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-mfc/s5p_mfc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index ca11f8a7569dc..4b8516c35bc20 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -527,7 +527,8 @@ static void s5p_mfc_handle_seq_done(struct s5p_mfc_ctx *ctx,
 				dev);
 		ctx->mv_count = s5p_mfc_hw_call(dev->mfc_ops, get_mv_count,
 				dev);
-		ctx->scratch_buf_size = s5p_mfc_hw_call(dev->mfc_ops,
+		if (FW_HAS_E_MIN_SCRATCH_BUF(dev))
+			ctx->scratch_buf_size = s5p_mfc_hw_call(dev->mfc_ops,
 						get_min_scratch_buf_size, dev);
 		if (ctx->img_width == 0 || ctx->img_height == 0)
 			ctx->state = MFCINST_ERROR;
-- 
GitLab


From 914026d581007a67a911630a0a8afebdbe7d41d3 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Wed, 12 Jun 2019 10:12:26 +0200
Subject: [PATCH 0845/1835] selinux: fix empty write to keycreate file

[ Upstream commit 464c258aa45b09f16aa0f05847ed8895873262d9 ]

When sid == 0 (we are resetting keycreate_sid to the default value), we
should skip the KEY__CREATE check.

Before this patch, doing a zero-sized write to /proc/self/keycreate
would check if the current task can create unlabeled keys (which would
usually fail with -EACCESS and generate an AVC). Now it skips the check
and correctly sets the task's keycreate_sid to 0.

Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1719067

Tested using the reproducer from the report above.

Fixes: 4eb582cf1fbd ("[PATCH] keys: add a way to store the appropriate context for newly-created keys")
Reported-by: Kir Kolyshkin <kir@sacred.ru>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 70bad15ed7a0f..109ab510bdb13 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6550,11 +6550,12 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
 	} else if (!strcmp(name, "fscreate")) {
 		tsec->create_sid = sid;
 	} else if (!strcmp(name, "keycreate")) {
-		error = avc_has_perm(&selinux_state,
-				     mysid, sid, SECCLASS_KEY, KEY__CREATE,
-				     NULL);
-		if (error)
-			goto abort_change;
+		if (sid) {
+			error = avc_has_perm(&selinux_state, mysid, sid,
+					     SECCLASS_KEY, KEY__CREATE, NULL);
+			if (error)
+				goto abort_change;
+		}
 		tsec->keycreate_sid = sid;
 	} else if (!strcmp(name, "sockcreate")) {
 		tsec->sockcreate_sid = sid;
-- 
GitLab


From 32df4043aed443d1232dc5a4c9d585c8223541c5 Mon Sep 17 00:00:00 2001
From: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
Date: Thu, 6 Jun 2019 06:54:19 +0530
Subject: [PATCH 0846/1835] x86/cpu: Add Ice Lake NNPI to Intel family

[ Upstream commit e32d045cd4ba06b59878323e434bad010e78e658 ]

Add the CPUID model number of Ice Lake Neural Network Processor for Deep
Learning Inference (ICL-NNPI) to the Intel family list. Ice Lake NNPI uses
model number 0x9D and this will be documented in a future version of Intel
Software Development Manual.

Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: bp@suse.de
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: platform-driver-x86@vger.kernel.org
Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Linux PM <linux-pm@vger.kernel.org>
Link: https://lkml.kernel.org/r/20190606012419.13250-1-rajneesh.bhardwaj@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/intel-family.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index 2e38fb82b91d1..aebedbaf52607 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -56,6 +56,7 @@
 #define INTEL_FAM6_ICELAKE_XEON_D	0x6C
 #define INTEL_FAM6_ICELAKE_DESKTOP	0x7D
 #define INTEL_FAM6_ICELAKE_MOBILE	0x7E
+#define INTEL_FAM6_ICELAKE_NNPI		0x9D
 
 /* "Small Core" Processors (Atom) */
 
-- 
GitLab


From 1fb3ce14f28d729af550e731254ff77a77ccce1a Mon Sep 17 00:00:00 2001
From: Jerome Brunet <jbrunet@baylibre.com>
Date: Thu, 13 Jun 2019 13:42:32 +0200
Subject: [PATCH 0847/1835] ASoC: meson: axg-tdm: fix sample clock inversion

[ Upstream commit cb36ff785e868992e96e8b9e5a0c2822b680a9e2 ]

The content of SND_SOC_DAIFMT_FORMAT_MASK is a number, not a bitfield,
so the test to check if the format is i2s is wrong. Because of this the
clock setting may be wrong. For example, the sample clock gets inverted
in DSP B mode, when it should not.

Fix the lrclk invert helper function

Fixes: 1a11d88f499c ("ASoC: meson: add tdm formatter base driver")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/meson/axg-tdm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/meson/axg-tdm.h b/sound/soc/meson/axg-tdm.h
index e578b6f40a07b..5774ce0916d40 100644
--- a/sound/soc/meson/axg-tdm.h
+++ b/sound/soc/meson/axg-tdm.h
@@ -40,7 +40,7 @@ struct axg_tdm_iface {
 
 static inline bool axg_tdm_lrclk_invert(unsigned int fmt)
 {
-	return (fmt & SND_SOC_DAIFMT_I2S) ^
+	return ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) == SND_SOC_DAIFMT_I2S) ^
 		!!(fmt & (SND_SOC_DAIFMT_IB_IF | SND_SOC_DAIFMT_NB_IF));
 }
 
-- 
GitLab


From 366ae49ed78ccdd66df37c7dcd3be7710511b2cc Mon Sep 17 00:00:00 2001
From: Waiman Long <longman@redhat.com>
Date: Tue, 21 May 2019 16:48:43 -0400
Subject: [PATCH 0848/1835] rcu: Force inlining of rcu_read_lock()

[ Upstream commit 6da9f775175e516fc7229ceaa9b54f8f56aa7924 ]

When debugging options are turned on, the rcu_read_lock() function
might not be inlined. This results in lockdep's print_lock() function
printing "rcu_read_lock+0x0/0x70" instead of rcu_read_lock()'s caller.
For example:

[   10.579995] =============================
[   10.584033] WARNING: suspicious RCU usage
[   10.588074] 4.18.0.memcg_v2+ #1 Not tainted
[   10.593162] -----------------------------
[   10.597203] include/linux/rcupdate.h:281 Illegal context switch in
RCU read-side critical section!
[   10.606220]
[   10.606220] other info that might help us debug this:
[   10.606220]
[   10.614280]
[   10.614280] rcu_scheduler_active = 2, debug_locks = 1
[   10.620853] 3 locks held by systemd/1:
[   10.624632]  #0: (____ptrval____) (&type->i_mutex_dir_key#5){.+.+}, at: lookup_slow+0x42/0x70
[   10.633232]  #1: (____ptrval____) (rcu_read_lock){....}, at: rcu_read_lock+0x0/0x70
[   10.640954]  #2: (____ptrval____) (rcu_read_lock){....}, at: rcu_read_lock+0x0/0x70

These "rcu_read_lock+0x0/0x70" strings are not providing any useful
information.  This commit therefore forces inlining of the rcu_read_lock()
function so that rcu_read_lock()'s caller is instead shown.

Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/rcupdate.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index e102c5bccbb9f..68cbe111420bc 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -620,7 +620,7 @@ static inline void rcu_preempt_sleep_check(void) { }
  * read-side critical sections may be preempted and they may also block, but
  * only when acquiring spinlocks that are subject to priority inheritance.
  */
-static inline void rcu_read_lock(void)
+static __always_inline void rcu_read_lock(void)
 {
 	__rcu_read_lock();
 	__acquire(RCU);
-- 
GitLab


From 670fb965da030261bda293b67fb196d6924a4e60 Mon Sep 17 00:00:00 2001
From: Aaron Lewis <aaronlewis@google.com>
Date: Wed, 5 Jun 2019 15:02:52 -0700
Subject: [PATCH 0849/1835] x86/cpufeatures: Add FDP_EXCPTN_ONLY and
 ZERO_FCS_FDS

[ Upstream commit cbb99c0f588737ec98c333558922ce47e9a95827 ]

Add the CPUID enumeration for Intel's de-feature bits to accommodate
passing these de-features through to kvm guests.

These de-features are (from SDM vol 1, section 8.1.8):
 - X86_FEATURE_FDP_EXCPTN_ONLY: If CPUID.(EAX=07H,ECX=0H):EBX[bit 6] = 1, the
   data pointer (FDP) is updated only for the x87 non-control instructions that
   incur unmasked x87 exceptions.
 - X86_FEATURE_ZERO_FCS_FDS: If CPUID.(EAX=07H,ECX=0H):EBX[bit 13] = 1, the
   processor deprecates FCS and FDS; it saves each as 0000H.

Signed-off-by: Aaron Lewis <aaronlewis@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jim Mattson <jmattson@google.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: marcorr@google.com
Cc: Peter Feiner <pfeiner@google.com>
Cc: pshier@google.com
Cc: Robert Hoo <robert.hu@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/20190605220252.103406-1-aaronlewis@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/cpufeatures.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 69037da75ea02..0cf704933f237 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -239,12 +239,14 @@
 #define X86_FEATURE_BMI1		( 9*32+ 3) /* 1st group bit manipulation extensions */
 #define X86_FEATURE_HLE			( 9*32+ 4) /* Hardware Lock Elision */
 #define X86_FEATURE_AVX2		( 9*32+ 5) /* AVX2 instructions */
+#define X86_FEATURE_FDP_EXCPTN_ONLY	( 9*32+ 6) /* "" FPU data pointer updated only on x87 exceptions */
 #define X86_FEATURE_SMEP		( 9*32+ 7) /* Supervisor Mode Execution Protection */
 #define X86_FEATURE_BMI2		( 9*32+ 8) /* 2nd group bit manipulation extensions */
 #define X86_FEATURE_ERMS		( 9*32+ 9) /* Enhanced REP MOVSB/STOSB instructions */
 #define X86_FEATURE_INVPCID		( 9*32+10) /* Invalidate Processor Context ID */
 #define X86_FEATURE_RTM			( 9*32+11) /* Restricted Transactional Memory */
 #define X86_FEATURE_CQM			( 9*32+12) /* Cache QoS Monitoring */
+#define X86_FEATURE_ZERO_FCS_FDS	( 9*32+13) /* "" Zero out FPU CS and FPU DS */
 #define X86_FEATURE_MPX			( 9*32+14) /* Memory Protection Extension */
 #define X86_FEATURE_RDT_A		( 9*32+15) /* Resource Director Technology Allocation */
 #define X86_FEATURE_AVX512F		( 9*32+16) /* AVX-512 Foundation */
-- 
GitLab


From 6a47a42f51cfa5821a82137185db0f1f6442c001 Mon Sep 17 00:00:00 2001
From: Michal Kalderon <michal.kalderon@marvell.com>
Date: Thu, 13 Jun 2019 11:29:42 +0300
Subject: [PATCH 0850/1835] qed: iWARP - Fix tc for MPA ll2 connection

[ Upstream commit cb94d52b93c74fe1f2595734fabeda9f8ae891ee ]

The driver needs to assign a lossless traffic class for the MPA ll2
connection to ensure no packets are dropped when returning from the
driver as they will never be re-transmitted by the peer.

Fixes: ae3488ff37dc ("qed: Add ll2 connection for processing unaligned MPA packets")
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index b7471e48db7b1..7002a660b6b4c 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -2709,6 +2709,8 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
 	data.input.rx_num_desc = n_ooo_bufs * 2;
 	data.input.tx_num_desc = data.input.rx_num_desc;
 	data.input.tx_max_bds_per_packet = QED_IWARP_MAX_BDS_PER_FPDU;
+	data.input.tx_tc = PKT_LB_TC;
+	data.input.tx_dest = QED_LL2_TX_DEST_LB;
 	data.p_connection_handle = &iwarp_info->ll2_mpa_handle;
 	data.input.secondary_queue = true;
 	data.cbs = &cbs;
-- 
GitLab


From 1a3706d8f800f2c2bbd7d8282dc019d780f1ea8b Mon Sep 17 00:00:00 2001
From: Yunsheng Lin <linyunsheng@huawei.com>
Date: Thu, 13 Jun 2019 17:12:30 +0800
Subject: [PATCH 0851/1835] net: hns3: fix for skb leak when doing selftest

[ Upstream commit 8f9eed1a8791b83eb1c54c261d68424717e4111e ]

If hns3_nic_net_xmit does not return NETDEV_TX_BUSY when doing
a loopback selftest, the skb is not freed in hns3_clean_tx_ring
or hns3_nic_net_xmit, which causes skb not freed problem.

This patch fixes it by freeing skb when hns3_nic_net_xmit does
not return NETDEV_TX_OK.

Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver")

Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 9684ad015c429..6a3c6b02a77cd 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -245,11 +245,13 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)
 
 		skb_get(skb);
 		tx_ret = hns3_nic_net_xmit(skb, ndev);
-		if (tx_ret == NETDEV_TX_OK)
+		if (tx_ret == NETDEV_TX_OK) {
 			good_cnt++;
-		else
+		} else {
+			kfree_skb(skb);
 			netdev_err(ndev, "hns3_lb_run_test xmit failed: %d\n",
 				   tx_ret);
+		}
 	}
 	if (good_cnt != HNS3_NIC_LB_TEST_PKT_NUM) {
 		ret_val = HNS3_NIC_LB_TEST_TX_CNT_ERR;
-- 
GitLab


From c8f75e75378439f244a55bc3ffdcb569fee429d7 Mon Sep 17 00:00:00 2001
From: Bob Liu <bob.liu@oracle.com>
Date: Sat, 15 Jun 2019 01:43:48 -0600
Subject: [PATCH 0852/1835] block: null_blk: fix race condition for
 null_del_dev

[ Upstream commit 7602843fd873cae43a444b83b14dfdd114a9659c ]

Dulicate call of null_del_dev() will trigger null pointer error like below.
The reason is a race condition between nullb_device_power_store() and
nullb_group_drop_item().

  CPU#0                         CPU#1
  ----------------              -----------------
  do_rmdir()
   >configfs_rmdir()
    >client_drop_item()
     >nullb_group_drop_item()
                                nullb_device_power_store()
				>null_del_dev()

      >test_and_clear_bit(NULLB_DEV_FL_UP
       >null_del_dev()
       ^^^^^
       Duplicated null_dev_dev() triger null pointer error

				>clear_bit(NULLB_DEV_FL_UP

The fix could be keep the sequnce of clear NULLB_DEV_FL_UP and null_del_dev().

[  698.613600] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[  698.613608] #PF error: [normal kernel read fault]
[  698.613611] PGD 0 P4D 0
[  698.613619] Oops: 0000 [#1] SMP PTI
[  698.613627] CPU: 3 PID: 6382 Comm: rmdir Not tainted 5.0.0+ #35
[  698.613631] Hardware name: LENOVO 20LJS2EV08/20LJS2EV08, BIOS R0SET33W (1.17 ) 07/18/2018
[  698.613644] RIP: 0010:null_del_dev+0xc/0x110 [null_blk]
[  698.613649] Code: 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b eb 97 e8 47 bb 2a e8 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 54 53 <8b> 77 18 48 89 fb 4c 8b 27 48 c7 c7 40 57 1e c1 e8 bf c7 cb e8 48
[  698.613654] RSP: 0018:ffffb887888bfde0 EFLAGS: 00010286
[  698.613659] RAX: 0000000000000000 RBX: ffff9d436d92bc00 RCX: ffff9d43a9184681
[  698.613663] RDX: ffffffffc11e5c30 RSI: 0000000068be6540 RDI: 0000000000000000
[  698.613667] RBP: ffffb887888bfdf0 R08: 0000000000000001 R09: 0000000000000000
[  698.613671] R10: ffffb887888bfdd8 R11: 0000000000000f16 R12: ffff9d436d92bc08
[  698.613675] R13: ffff9d436d94e630 R14: ffffffffc11e5088 R15: ffffffffc11e5000
[  698.613680] FS:  00007faa68be6540(0000) GS:ffff9d43d14c0000(0000) knlGS:0000000000000000
[  698.613685] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  698.613689] CR2: 0000000000000018 CR3: 000000042f70c002 CR4: 00000000003606e0
[  698.613693] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  698.613697] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  698.613700] Call Trace:
[  698.613712]  nullb_group_drop_item+0x50/0x70 [null_blk]
[  698.613722]  client_drop_item+0x29/0x40
[  698.613728]  configfs_rmdir+0x1ed/0x300
[  698.613738]  vfs_rmdir+0xb2/0x130
[  698.613743]  do_rmdir+0x1c7/0x1e0
[  698.613750]  __x64_sys_rmdir+0x17/0x20
[  698.613759]  do_syscall_64+0x5a/0x110
[  698.613768]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Signed-off-by: Bob Liu <bob.liu@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/null_blk_main.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 093b614d65244..c5c0b7c894815 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -321,11 +321,12 @@ static ssize_t nullb_device_power_store(struct config_item *item,
 		set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
 		dev->power = newp;
 	} else if (dev->power && !newp) {
-		mutex_lock(&lock);
-		dev->power = newp;
-		null_del_dev(dev->nullb);
-		mutex_unlock(&lock);
-		clear_bit(NULLB_DEV_FL_UP, &dev->flags);
+		if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) {
+			mutex_lock(&lock);
+			dev->power = newp;
+			null_del_dev(dev->nullb);
+			mutex_unlock(&lock);
+		}
 		clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
 	}
 
-- 
GitLab


From b7d66bbc8ad38a40ec758da0383a0e2a9694e205 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Thu, 13 Jun 2019 15:30:41 -0700
Subject: [PATCH 0853/1835] blkcg, writeback: dead memcgs shouldn't contribute
 to writeback ownership arbitration

[ Upstream commit 6631142229005e1b1c311a09efe9fb3cfdac8559 ]

wbc_account_io() collects information on cgroup ownership of writeback
pages to determine which cgroup should own the inode.  Pages can stay
associated with dead memcgs but we want to avoid attributing IOs to
dead blkcgs as much as possible as the association is likely to be
stale.  However, currently, pages associated with dead memcgs
contribute to the accounting delaying and/or confusing the
arbitration.

Fix it by ignoring pages associated with dead memcgs.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs-writeback.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 9544e2f8b79ff..7ee86d8f313d0 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -721,6 +721,7 @@ void wbc_detach_inode(struct writeback_control *wbc)
 void wbc_account_io(struct writeback_control *wbc, struct page *page,
 		    size_t bytes)
 {
+	struct cgroup_subsys_state *css;
 	int id;
 
 	/*
@@ -732,7 +733,12 @@ void wbc_account_io(struct writeback_control *wbc, struct page *page,
 	if (!wbc->wb)
 		return;
 
-	id = mem_cgroup_css_from_page(page)->id;
+	css = mem_cgroup_css_from_page(page);
+	/* dead cgroups shouldn't contribute to inode ownership arbitration */
+	if (!(css->flags & CSS_ONLINE))
+		return;
+
+	id = css->id;
 
 	if (id == wbc->wb_id) {
 		wbc->wb_bytes += bytes;
-- 
GitLab


From 930655b0136745f5ff57ad5779cb330fa26924de Mon Sep 17 00:00:00 2001
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Fri, 14 Jun 2019 11:13:55 +0200
Subject: [PATCH 0854/1835] xfrm: fix sa selector validation

[ Upstream commit b8d6d0079757cbd1b69724cfd1c08e2171c68cee ]

After commit b38ff4075a80, the following command does not work anymore:
$ ip xfrm state add src 10.125.0.2 dst 10.125.0.1 proto esp spi 34 reqid 1 \
  mode tunnel enc 'cbc(aes)' 0xb0abdba8b782ad9d364ec81e3a7d82a1 auth-trunc \
  'hmac(sha1)' 0xe26609ebd00acb6a4d51fca13e49ea78a72c73e6 96 flag align4

In fact, the selector is not mandatory, allow the user to provide an empty
selector.

Fixes: b38ff4075a80 ("xfrm: Fix xfrm sel prefix length validation")
CC: Anirudh Gupta <anirudh.gupta@sophos.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_user.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d80d54e663c09..1484bc99a5375 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -166,6 +166,9 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 	}
 
 	switch (p->sel.family) {
+	case AF_UNSPEC:
+		break;
+
 	case AF_INET:
 		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
 			goto out;
-- 
GitLab


From d8b7db6c500419795d2d3c5a4a76fbaabdcfaa01 Mon Sep 17 00:00:00 2001
From: Gao Xiang <gaoxiang25@huawei.com>
Date: Mon, 3 Jun 2019 17:13:38 +0800
Subject: [PATCH 0855/1835] sched/core: Add __sched tag for io_schedule()

[ Upstream commit e3b929b0a184edb35531153c5afcaebb09014f9d ]

Non-inline io_schedule() was introduced in:

  commit 10ab56434f2f ("sched/core: Separate out io_schedule_prepare() and io_schedule_finish()")

Keep in line with io_schedule_timeout(), otherwise "/proc/<pid>/wchan" will
report io_schedule() rather than its callers when waiting for IO.

Reported-by: Jilong Kou <koujilong@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Miao Xie <miaoxie@huawei.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 10ab56434f2f ("sched/core: Separate out io_schedule_prepare() and io_schedule_finish()")
Link: https://lkml.kernel.org/r/20190603091338.2695-1-gaoxiang25@huawei.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 6859ea1d5c049..795c63ca44a99 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5133,7 +5133,7 @@ long __sched io_schedule_timeout(long timeout)
 }
 EXPORT_SYMBOL(io_schedule_timeout);
 
-void io_schedule(void)
+void __sched io_schedule(void)
 {
 	int token;
 
-- 
GitLab


From 7fc96cd2b0decd8bdd0c8dee1d7845450ebcfd1c Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 3 Jun 2019 17:11:44 -0400
Subject: [PATCH 0856/1835] sched/fair: Fix "runnable_avg_yN_inv" not used
 warnings

[ Upstream commit 509466b7d480bc5d22e90b9fbe6122ae0e2fbe39 ]

runnable_avg_yN_inv[] is only used in kernel/sched/pelt.c but was
included in several other places because they need other macros all
came from kernel/sched/sched-pelt.h which was generated by
Documentation/scheduler/sched-pelt. As the result, it causes compilation
a lot of warnings,

  kernel/sched/sched-pelt.h:4:18: warning: 'runnable_avg_yN_inv' defined but not used [-Wunused-const-variable=]
  kernel/sched/sched-pelt.h:4:18: warning: 'runnable_avg_yN_inv' defined but not used [-Wunused-const-variable=]
  kernel/sched/sched-pelt.h:4:18: warning: 'runnable_avg_yN_inv' defined but not used [-Wunused-const-variable=]
  ...

Silence it by appending the __maybe_unused attribute for it, so all
generated variables and macros can still be kept in the same file.

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/1559596304-31581-1-git-send-email-cai@lca.pw
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/scheduler/sched-pelt.c | 3 ++-
 kernel/sched/sched-pelt.h            | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Documentation/scheduler/sched-pelt.c b/Documentation/scheduler/sched-pelt.c
index e4219139386ae..7238b355919c7 100644
--- a/Documentation/scheduler/sched-pelt.c
+++ b/Documentation/scheduler/sched-pelt.c
@@ -20,7 +20,8 @@ void calc_runnable_avg_yN_inv(void)
 	int i;
 	unsigned int x;
 
-	printf("static const u32 runnable_avg_yN_inv[] = {");
+	/* To silence -Wunused-but-set-variable warnings. */
+	printf("static const u32 runnable_avg_yN_inv[] __maybe_unused = {");
 	for (i = 0; i < HALFLIFE; i++) {
 		x = ((1UL<<32)-1)*pow(y, i);
 
diff --git a/kernel/sched/sched-pelt.h b/kernel/sched/sched-pelt.h
index a26473674fb79..c529706bed115 100644
--- a/kernel/sched/sched-pelt.h
+++ b/kernel/sched/sched-pelt.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /* Generated by Documentation/scheduler/sched-pelt; do not modify. */
 
-static const u32 runnable_avg_yN_inv[] = {
+static const u32 runnable_avg_yN_inv[] __maybe_unused = {
 	0xffffffff, 0xfa83b2da, 0xf5257d14, 0xefe4b99a, 0xeac0c6e6, 0xe5b906e6,
 	0xe0ccdeeb, 0xdbfbb796, 0xd744fcc9, 0xd2a81d91, 0xce248c14, 0xc9b9bd85,
 	0xc5672a10, 0xc12c4cc9, 0xbd08a39e, 0xb8fbaf46, 0xb504f333, 0xb123f581,
-- 
GitLab


From dd0260fd1e3af66a3b3c87301f72cb04d3dcf147 Mon Sep 17 00:00:00 2001
From: Kan Liang <kan.liang@linux.intel.com>
Date: Tue, 30 Apr 2019 17:53:43 -0700
Subject: [PATCH 0857/1835] perf/x86/intel/uncore: Handle invalid event coding
 for free-running counter

[ Upstream commit 543ac280b3576c0009e8c0fcd4d6bfc9978d7bd0 ]

Counting with invalid event coding for free-running counter may cause
OOPs, e.g. uncore_iio_free_running_0/event=1/.

Current code only validate the event with free-running event format,
event=0xff,umask=0xXY. Non-free-running event format never be checked
for the PMU with free-running counters.

Add generic hw_config() to check and reject the invalid event coding
for free-running PMU.

Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: acme@kernel.org
Cc: eranian@google.com
Fixes: 0f519f0352e3 ("perf/x86/intel/uncore: Support IIO free-running counters on SKX")
Link: https://lkml.kernel.org/r/1556672028-119221-2-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/uncore.h       | 10 ++++++++++
 arch/x86/events/intel/uncore_snbep.c |  1 +
 2 files changed, 11 insertions(+)

diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index cc6dd4f78158b..42fa3974c421c 100644
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -402,6 +402,16 @@ static inline bool is_freerunning_event(struct perf_event *event)
 	       (((cfg >> 8) & 0xff) >= UNCORE_FREERUNNING_UMASK_START);
 }
 
+/* Check and reject invalid config */
+static inline int uncore_freerunning_hw_config(struct intel_uncore_box *box,
+					       struct perf_event *event)
+{
+	if (is_freerunning_event(event))
+		return 0;
+
+	return -EINVAL;
+}
+
 static inline void uncore_disable_box(struct intel_uncore_box *box)
 {
 	if (box->pmu->type->ops->disable_box)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index b10e04387f380..8e4e8e423839a 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3585,6 +3585,7 @@ static struct uncore_event_desc skx_uncore_iio_freerunning_events[] = {
 
 static struct intel_uncore_ops skx_uncore_iio_freerunning_ops = {
 	.read_counter		= uncore_msr_read_counter,
+	.hw_config		= uncore_freerunning_hw_config,
 };
 
 static struct attribute *skx_uncore_iio_freerunning_formats_attr[] = {
-- 
GitLab


From 9e0bcb59b6c0badce64f9862fca5b0b997929f1f Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Wed, 24 Apr 2019 13:38:23 +0200
Subject: [PATCH 0858/1835] x86/atomic: Fix smp_mb__{before,after}_atomic()

[ Upstream commit 69d927bba39517d0980462efc051875b7f4db185 ]

Recent probing at the Linux Kernel Memory Model uncovered a
'surprise'. Strongly ordered architectures where the atomic RmW
primitive implies full memory ordering and
smp_mb__{before,after}_atomic() are a simple barrier() (such as x86)
fail for:

	*x = 1;
	atomic_inc(u);
	smp_mb__after_atomic();
	r0 = *y;

Because, while the atomic_inc() implies memory order, it
(surprisingly) does not provide a compiler barrier. This then allows
the compiler to re-order like so:

	atomic_inc(u);
	*x = 1;
	smp_mb__after_atomic();
	r0 = *y;

Which the CPU is then allowed to re-order (under TSO rules) like:

	atomic_inc(u);
	r0 = *y;
	*x = 1;

And this very much was not intended. Therefore strengthen the atomic
RmW ops to include a compiler barrier.

NOTE: atomic_{or,and,xor} and the bitops already had the compiler
barrier.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/atomic_t.txt         | 3 +++
 arch/x86/include/asm/atomic.h      | 8 ++++----
 arch/x86/include/asm/atomic64_64.h | 8 ++++----
 arch/x86/include/asm/barrier.h     | 4 ++--
 4 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/Documentation/atomic_t.txt b/Documentation/atomic_t.txt
index 913396ac58243..ed0d814df7e06 100644
--- a/Documentation/atomic_t.txt
+++ b/Documentation/atomic_t.txt
@@ -177,6 +177,9 @@ These helper barriers exist because architectures have varying implicit
 ordering on their SMP atomic primitives. For example our TSO architectures
 provide full ordered atomics and these barriers are no-ops.
 
+NOTE: when the atomic RmW ops are fully ordered, they should also imply a
+compiler barrier.
+
 Thus:
 
   atomic_fetch_add();
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index ce84388e540c9..d266a40662893 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -54,7 +54,7 @@ static __always_inline void arch_atomic_add(int i, atomic_t *v)
 {
 	asm volatile(LOCK_PREFIX "addl %1,%0"
 		     : "+m" (v->counter)
-		     : "ir" (i));
+		     : "ir" (i) : "memory");
 }
 
 /**
@@ -68,7 +68,7 @@ static __always_inline void arch_atomic_sub(int i, atomic_t *v)
 {
 	asm volatile(LOCK_PREFIX "subl %1,%0"
 		     : "+m" (v->counter)
-		     : "ir" (i));
+		     : "ir" (i) : "memory");
 }
 
 /**
@@ -95,7 +95,7 @@ static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
 static __always_inline void arch_atomic_inc(atomic_t *v)
 {
 	asm volatile(LOCK_PREFIX "incl %0"
-		     : "+m" (v->counter));
+		     : "+m" (v->counter) :: "memory");
 }
 #define arch_atomic_inc arch_atomic_inc
 
@@ -108,7 +108,7 @@ static __always_inline void arch_atomic_inc(atomic_t *v)
 static __always_inline void arch_atomic_dec(atomic_t *v)
 {
 	asm volatile(LOCK_PREFIX "decl %0"
-		     : "+m" (v->counter));
+		     : "+m" (v->counter) :: "memory");
 }
 #define arch_atomic_dec arch_atomic_dec
 
diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
index 5f851d92eecd9..55ca027f8c1c3 100644
--- a/arch/x86/include/asm/atomic64_64.h
+++ b/arch/x86/include/asm/atomic64_64.h
@@ -45,7 +45,7 @@ static __always_inline void arch_atomic64_add(long i, atomic64_t *v)
 {
 	asm volatile(LOCK_PREFIX "addq %1,%0"
 		     : "=m" (v->counter)
-		     : "er" (i), "m" (v->counter));
+		     : "er" (i), "m" (v->counter) : "memory");
 }
 
 /**
@@ -59,7 +59,7 @@ static inline void arch_atomic64_sub(long i, atomic64_t *v)
 {
 	asm volatile(LOCK_PREFIX "subq %1,%0"
 		     : "=m" (v->counter)
-		     : "er" (i), "m" (v->counter));
+		     : "er" (i), "m" (v->counter) : "memory");
 }
 
 /**
@@ -87,7 +87,7 @@ static __always_inline void arch_atomic64_inc(atomic64_t *v)
 {
 	asm volatile(LOCK_PREFIX "incq %0"
 		     : "=m" (v->counter)
-		     : "m" (v->counter));
+		     : "m" (v->counter) : "memory");
 }
 #define arch_atomic64_inc arch_atomic64_inc
 
@@ -101,7 +101,7 @@ static __always_inline void arch_atomic64_dec(atomic64_t *v)
 {
 	asm volatile(LOCK_PREFIX "decq %0"
 		     : "=m" (v->counter)
-		     : "m" (v->counter));
+		     : "m" (v->counter) : "memory");
 }
 #define arch_atomic64_dec arch_atomic64_dec
 
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 14de0432d2884..84f848c2541a6 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -80,8 +80,8 @@ do {									\
 })
 
 /* Atomic operations are already serializing on x86 */
-#define __smp_mb__before_atomic()	barrier()
-#define __smp_mb__after_atomic()	barrier()
+#define __smp_mb__before_atomic()	do { } while (0)
+#define __smp_mb__after_atomic()	do { } while (0)
 
 #include <asm-generic/barrier.h>
 
-- 
GitLab


From 4c57957ed6c8055cf13c1a8a7e29d1a6bed273ef Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Mon, 17 Jun 2019 14:32:53 -0300
Subject: [PATCH 0859/1835] perf evsel: Make perf_evsel__name() accept a NULL
 argument

[ Upstream commit fdbdd7e8580eac9bdafa532746c865644d125e34 ]

In which case it simply returns "unknown", like when it can't figure out
the evsel->name value.

This makes this code more robust and fixes a problem in 'perf trace'
where a NULL evsel was being passed to a routine that only used the
evsel for printing its name when a invalid syscall id was passed.

Reported-by: Leo Yan <leo.yan@linaro.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lkml.kernel.org/n/tip-f30ztaasku3z935cn3ak3h53@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/evsel.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index b65ad5a273eb1..4fad92213609f 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -590,6 +590,9 @@ const char *perf_evsel__name(struct perf_evsel *evsel)
 {
 	char bf[128];
 
+	if (!evsel)
+		goto out_unknown;
+
 	if (evsel->name)
 		return evsel->name;
 
@@ -626,7 +629,10 @@ const char *perf_evsel__name(struct perf_evsel *evsel)
 
 	evsel->name = strdup(bf);
 
-	return evsel->name ?: "unknown";
+	if (evsel->name)
+		return evsel->name;
+out_unknown:
+	return "unknown";
 }
 
 const char *perf_evsel__group_name(struct perf_evsel *evsel)
-- 
GitLab


From 0e2af9b06c00a30bc396cf455f50320a7c5b71da Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Mon, 17 Jun 2019 05:20:54 -0400
Subject: [PATCH 0860/1835] vhost_net: disable zerocopy by default

[ Upstream commit 098eadce3c622c07b328d0a43dda379b38cf7c5e ]

Vhost_net was known to suffer from HOL[1] issues which is not easy to
fix. Several downstream disable the feature by default. What's more,
the datapath was split and datacopy path got the support of batching
and XDP support recently which makes it faster than zerocopy part for
small packets transmission.

It looks to me that disable zerocopy by default is more
appropriate. It cold be enabled by default again in the future if we
fix the above issues.

[1] https://patchwork.kernel.org/patch/3787671/

Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vhost/net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 39155d7cc8946..ae704658b528f 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -36,7 +36,7 @@
 
 #include "vhost.h"
 
-static int experimental_zcopytx = 1;
+static int experimental_zcopytx = 0;
 module_param(experimental_zcopytx, int, 0444);
 MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;"
 		                       " 1 -Enable; 0 - Disable");
-- 
GitLab


From 3252b29ea41bf73c596c2970045f35b5cc2fcf0f Mon Sep 17 00:00:00 2001
From: Denis Kirjanov <kda@linux-powerpc.org>
Date: Mon, 17 Jun 2019 10:53:40 +0200
Subject: [PATCH 0861/1835] ipoib: correcly show a VF hardware address

[ Upstream commit 64d701c608fea362881e823b666327f5d28d7ffd ]

in the case of IPoIB with SRIOV enabled hardware
ip link show command incorrecly prints
0 instead of a VF hardware address.

Before:
11: ib1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 2044 qdisc pfifo_fast
state UP mode DEFAULT group default qlen 256
    link/infiniband
80:00:00:66:fe:80:00:00:00:00:00:00:24:8a:07:03:00:a4:3e:7c brd
00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff
    vf 0 MAC 00:00:00:00:00:00, spoof checking off, link-state disable,
trust off, query_rss off
...
After:
11: ib1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 2044 qdisc pfifo_fast
state UP mode DEFAULT group default qlen 256
    link/infiniband
80:00:00:66:fe:80:00:00:00:00:00:00:24:8a:07:03:00:a4:3e:7c brd
00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff
    vf 0     link/infiniband
80:00:00:66:fe:80:00:00:00:00:00:00:24:8a:07:03:00:a4:3e:7c brd
00:ff:ff:ff:ff:12:40:1b:ff:ff:00:00:00:00:00:00:ff:ff:ff:ff, spoof
checking off, link-state disable, trust off, query_rss off

v1->v2: just copy an address without modifing ifla_vf_mac
v2->v3: update the changelog

Signed-off-by: Denis Kirjanov <kda@linux-powerpc.org>
Acked-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 30f840f874b3c..009615499b37a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1997,6 +1997,7 @@ static int ipoib_get_vf_config(struct net_device *dev, int vf,
 		return err;
 
 	ivf->vf = vf;
+	memcpy(ivf->mac, dev->dev_addr, dev->addr_len);
 
 	return 0;
 }
-- 
GitLab


From a952f7c384aa52f22b14dc26d5dace7c939fe0a7 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Wed, 19 Jun 2019 10:32:53 -0400
Subject: [PATCH 0862/1835] x86/cacheinfo: Fix a -Wtype-limits warning

[ Upstream commit 1b7aebf0487613033aff26420e32fa2076d52846 ]

cpuinfo_x86.x86_model is an unsigned type, so comparing against zero
will generate a compilation warning:

  arch/x86/kernel/cpu/cacheinfo.c: In function 'cacheinfo_amd_init_llc_id':
  arch/x86/kernel/cpu/cacheinfo.c:662:19: warning: comparison is always true \
    due to limited range of data type [-Wtype-limits]

Remove the unnecessary lower bound check.

 [ bp: Massage. ]

Fixes: 68091ee7ac3c ("x86/CPU/AMD: Calculate last level cache ID from number of sharing threads")
Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Pu Wen <puwen@hygon.cn>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/1560954773-11967-1-git-send-email-cai@lca.pw
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/cacheinfo.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
index 0c5fcbd998cf1..9d863e8f9b3f2 100644
--- a/arch/x86/kernel/cpu/cacheinfo.c
+++ b/arch/x86/kernel/cpu/cacheinfo.c
@@ -651,8 +651,7 @@ void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id)
 	if (c->x86 < 0x17) {
 		/* LLC is at the node level. */
 		per_cpu(cpu_llc_id, cpu) = node_id;
-	} else if (c->x86 == 0x17 &&
-		   c->x86_model >= 0 && c->x86_model <= 0x1F) {
+	} else if (c->x86 == 0x17 && c->x86_model <= 0x1F) {
 		/*
 		 * LLC is at the core complex level.
 		 * Core complex ID is ApicId[3] for these processors.
-- 
GitLab


From 3ae98dc2db1e937bda7cefdb9caadc653d865f58 Mon Sep 17 00:00:00 2001
From: Dennis Zhou <dennis@kernel.org>
Date: Thu, 23 May 2019 16:10:18 -0400
Subject: [PATCH 0863/1835] blk-iolatency: only account submitted bios

[ Upstream commit a3fb01ba5af066521f3f3421839e501bb2c71805 ]

As is, iolatency recognizes done_bio and cleanup as ending paths. If a
request is marked REQ_NOWAIT and fails to get a request, the bio is
cleaned up via rq_qos_cleanup() and ended in bio_wouldblock_error().
This results in underflowing the inflight counter. Fix this by only
accounting bios that were actually submitted.

Signed-off-by: Dennis Zhou <dennis@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-iolatency.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index 6b8396ccb5c44..75df47ad2e795 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -565,6 +565,10 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
 	if (!blkg)
 		return;
 
+	/* We didn't actually submit this bio, don't account it. */
+	if (bio->bi_status == BLK_STS_AGAIN)
+		return;
+
 	iolat = blkg_to_lat(bio->bi_blkg);
 	if (!iolat)
 		return;
-- 
GitLab


From f6502ce4f050d3fbe3558d6d4555adc7679b92b6 Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Mon, 17 Jun 2019 13:31:45 +0200
Subject: [PATCH 0864/1835] ACPICA: Clear status of GPEs on first direct enable

[ Upstream commit 44758bafa53602f2581a6857bb20b55d4d8ad5b2 ]

ACPI GPEs (other than the EC one) can be enabled in two situations.
First, the GPEs with existing _Lxx and _Exx methods are enabled
implicitly by ACPICA during system initialization.  Second, the
GPEs without these methods (like GPEs listed by _PRW objects for
wakeup devices) need to be enabled directly by the code that is
going to use them (e.g. ACPI power management or device drivers).

In the former case, if the status of a given GPE is set to start
with, its handler method (either _Lxx or _Exx) needs to be invoked
to take care of the events (possibly) signaled before the GPE was
enabled.  In the latter case, however, the first caller of
acpi_enable_gpe() for a given GPE should not be expected to care
about any events that might be signaled through it earlier.  In
that case, it is better to clear the status of the GPE before
enabling it, to prevent stale events from triggering unwanted
actions (like spurious system resume, for example).

For this reason, modify acpi_ev_add_gpe_reference() to take an
additional boolean argument indicating whether or not the GPE
status needs to be cleared when its reference counter changes from
zero to one and make acpi_enable_gpe() pass TRUE to it through
that new argument.

Fixes: 18996f2db918 ("ACPICA: Events: Stop unconditionally clearing ACPI IRQs during suspend/resume")
Reported-by: Furquan Shaikh <furquan@google.com>
Tested-by: Furquan Shaikh <furquan@google.com>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/acpica/acevents.h | 3 ++-
 drivers/acpi/acpica/evgpe.c    | 8 +++++++-
 drivers/acpi/acpica/evgpeblk.c | 2 +-
 drivers/acpi/acpica/evxface.c  | 2 +-
 drivers/acpi/acpica/evxfgpe.c  | 2 +-
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
index 704bebbd35b06..298180bf7e3c1 100644
--- a/drivers/acpi/acpica/acevents.h
+++ b/drivers/acpi/acpica/acevents.h
@@ -69,7 +69,8 @@ acpi_status
 acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked);
 
 acpi_status
-acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info);
+acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info,
+			  u8 clear_on_enable);
 
 acpi_status
 acpi_ev_remove_gpe_reference(struct acpi_gpe_event_info *gpe_event_info);
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index e10fec99a182e..4b5d3b4c627a7 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -146,6 +146,7 @@ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked)
  * FUNCTION:    acpi_ev_add_gpe_reference
  *
  * PARAMETERS:  gpe_event_info          - Add a reference to this GPE
+ *              clear_on_enable         - Clear GPE status before enabling it
  *
  * RETURN:      Status
  *
@@ -155,7 +156,8 @@ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked)
  ******************************************************************************/
 
 acpi_status
-acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
+acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info,
+			  u8 clear_on_enable)
 {
 	acpi_status status = AE_OK;
 
@@ -170,6 +172,10 @@ acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
 
 		/* Enable on first reference */
 
+		if (clear_on_enable) {
+			(void)acpi_hw_clear_gpe(gpe_event_info);
+		}
+
 		status = acpi_ev_update_gpe_enable_mask(gpe_event_info);
 		if (ACPI_SUCCESS(status)) {
 			status = acpi_ev_enable_gpe(gpe_event_info);
diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
index b253063b09d39..8d96270ed8c73 100644
--- a/drivers/acpi/acpica/evgpeblk.c
+++ b/drivers/acpi/acpica/evgpeblk.c
@@ -453,7 +453,7 @@ acpi_ev_initialize_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
 				continue;
 			}
 
-			status = acpi_ev_add_gpe_reference(gpe_event_info);
+			status = acpi_ev_add_gpe_reference(gpe_event_info, FALSE);
 			if (ACPI_FAILURE(status)) {
 				ACPI_EXCEPTION((AE_INFO, status,
 					"Could not enable GPE 0x%02X",
diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
index febc332b00ac1..841557bda6419 100644
--- a/drivers/acpi/acpica/evxface.c
+++ b/drivers/acpi/acpica/evxface.c
@@ -971,7 +971,7 @@ acpi_remove_gpe_handler(acpi_handle gpe_device,
 	      ACPI_GPE_DISPATCH_METHOD) ||
 	     (ACPI_GPE_DISPATCH_TYPE(handler->original_flags) ==
 	      ACPI_GPE_DISPATCH_NOTIFY)) && handler->originally_enabled) {
-		(void)acpi_ev_add_gpe_reference(gpe_event_info);
+		(void)acpi_ev_add_gpe_reference(gpe_event_info, FALSE);
 		if (ACPI_GPE_IS_POLLING_NEEDED(gpe_event_info)) {
 
 			/* Poll edge triggered GPEs to handle existing events */
diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
index b2d5f66cc1b05..4188731e7c406 100644
--- a/drivers/acpi/acpica/evxfgpe.c
+++ b/drivers/acpi/acpica/evxfgpe.c
@@ -108,7 +108,7 @@ acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number)
 	if (gpe_event_info) {
 		if (ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) !=
 		    ACPI_GPE_DISPATCH_NONE) {
-			status = acpi_ev_add_gpe_reference(gpe_event_info);
+			status = acpi_ev_add_gpe_reference(gpe_event_info, TRUE);
 			if (ACPI_SUCCESS(status) &&
 			    ACPI_GPE_IS_POLLING_NEEDED(gpe_event_info)) {
 
-- 
GitLab


From 10cc3a65a55b7b9ae013af32258033052ffd8701 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Thu, 18 Apr 2019 10:27:18 +0800
Subject: [PATCH 0865/1835] EDAC/sysfs: Fix memory leak when creating a csrow
 object

[ Upstream commit 585fb3d93d32dbe89e718b85009f9c322cc554cd ]

In edac_create_csrow_object(), the reference to the object is not
released when adding the device to the device hierarchy fails
(device_add()). This may result in a memory leak.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: James Morse <james.morse@arm.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: https://lkml.kernel.org/r/1555554438-103953-1-git-send-email-bianpan2016@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/edac_mc_sysfs.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 20374b8248f08..e50610b5bd067 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -404,6 +404,8 @@ static inline int nr_pages_per_csrow(struct csrow_info *csrow)
 static int edac_create_csrow_object(struct mem_ctl_info *mci,
 				    struct csrow_info *csrow, int index)
 {
+	int err;
+
 	csrow->dev.type = &csrow_attr_type;
 	csrow->dev.bus = mci->bus;
 	csrow->dev.groups = csrow_dev_groups;
@@ -416,7 +418,11 @@ static int edac_create_csrow_object(struct mem_ctl_info *mci,
 	edac_dbg(0, "creating (virtual) csrow node %s\n",
 		 dev_name(&csrow->dev));
 
-	return device_add(&csrow->dev);
+	err = device_add(&csrow->dev);
+	if (err)
+		put_device(&csrow->dev);
+
+	return err;
 }
 
 /* Create a CSROW object under specifed edac_mc_device */
-- 
GitLab


From f0c83dd15ee1e89f73523cb82da9205d204cf440 Mon Sep 17 00:00:00 2001
From: Anton Eidelman <anton@lightbitslabs.com>
Date: Thu, 20 Jun 2019 08:48:10 +0200
Subject: [PATCH 0866/1835] nvme: fix possible io failures when removing
 multipathed ns

[ Upstream commit 2181e455612a8db2761eabbf126640552a451e96 ]

When a shared namespace is removed, we call blk_cleanup_queue()
when the device can still be accessed as the current path and this can
result in submission to a dying queue. Hence, direct_make_request()
called by our mpath device may fail (propagating the failure to userspace).
Instead, we want to failover this I/O to a different path if one exists.
Thus, before we cleanup the request queue, we make sure that the device is
cleared from the current path nor it can be selected again as such.

Fix this by:
- clear the ns from the head->list and synchronize rcu to make sure there is
  no concurrent path search that restores it as the current path
- clear the mpath current path in order to trigger a subsequent path search
  and sync srcu to wait for any ongoing request submissions
- safely continue to namespace removal and blk_cleanup_queue

Signed-off-by: Anton Eidelman <anton@lightbitslabs.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d8869d978c341..e26d1191c5ad6 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3168,6 +3168,14 @@ static void nvme_ns_remove(struct nvme_ns *ns)
 		return;
 
 	nvme_fault_inject_fini(ns);
+
+	mutex_lock(&ns->ctrl->subsys->lock);
+	list_del_rcu(&ns->siblings);
+	mutex_unlock(&ns->ctrl->subsys->lock);
+	synchronize_rcu(); /* guarantee not available in head->list */
+	nvme_mpath_clear_current_path(ns);
+	synchronize_srcu(&ns->head->srcu); /* wait for concurrent submissions */
+
 	if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
 		sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
 					&nvme_ns_id_attr_group);
@@ -3179,16 +3187,10 @@ static void nvme_ns_remove(struct nvme_ns *ns)
 			blk_integrity_unregister(ns->disk);
 	}
 
-	mutex_lock(&ns->ctrl->subsys->lock);
-	list_del_rcu(&ns->siblings);
-	nvme_mpath_clear_current_path(ns);
-	mutex_unlock(&ns->ctrl->subsys->lock);
-
 	down_write(&ns->ctrl->namespaces_rwsem);
 	list_del_init(&ns->list);
 	up_write(&ns->ctrl->namespaces_rwsem);
 
-	synchronize_srcu(&ns->head->srcu);
 	nvme_mpath_check_last_path(ns);
 	nvme_put_ns(ns);
 }
-- 
GitLab


From c876a66553d7075aa893cc3720bab9e7ed06bca1 Mon Sep 17 00:00:00 2001
From: Minwoo Im <minwoo.im.dev@gmail.com>
Date: Sun, 9 Jun 2019 03:35:20 +0900
Subject: [PATCH 0867/1835] nvme-pci: properly report state change failure in
 nvme_reset_work

[ Upstream commit cee6c269b016ba89c62e34d6bccb103ee2c7de4f ]

If the state change to NVME_CTRL_CONNECTING fails, the dmesg is going to
be like:

  [  293.689160] nvme nvme0: failed to mark controller CONNECTING
  [  293.689160] nvme nvme0: Removing after probe failure status: 0

Even it prints the first line to indicate the situation, the second line
is not proper because the status is 0 which means normally success of
the previous operation.

This patch makes it indicate the proper error value when it fails.
  [   25.932367] nvme nvme0: failed to mark controller CONNECTING
  [   25.932369] nvme nvme0: Removing after probe failure status: -16

This situation is able to be easily reproduced by:
  root@target:~# rmmod nvme && modprobe nvme && rmmod nvme

Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index c8eeecc581154..03e72e2f57f54 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2294,6 +2294,7 @@ static void nvme_reset_work(struct work_struct *work)
 	if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
 		dev_warn(dev->ctrl.device,
 			"failed to mark controller CONNECTING\n");
+		result = -EBUSY;
 		goto out;
 	}
 
-- 
GitLab


From 762bba1b7ee755977d3f8d3d1140a54eb5d8bd07 Mon Sep 17 00:00:00 2001
From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Date: Sat, 8 Jun 2019 13:01:02 -0700
Subject: [PATCH 0868/1835] nvme-pci: set the errno on ctrl state change error

[ Upstream commit e71afda49335620e3d9adf56015676db33a3bd86 ]

This patch removes the confusing assignment of the variable result at
the time of declaration and sets the value in error cases next to the
places where the actual error is happening.

Here we also set the result value to -ENODEV when we fail at the final
ctrl state transition in nvme_reset_work(). Without this assignment
result will hold 0 from nvme_setup_io_queue() and on failure 0 will be
passed to he nvme_remove_dead_ctrl() from final state transition.

Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 03e72e2f57f54..0a5d064f82ca3 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2253,11 +2253,13 @@ static void nvme_reset_work(struct work_struct *work)
 	struct nvme_dev *dev =
 		container_of(work, struct nvme_dev, ctrl.reset_work);
 	bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
-	int result = -ENODEV;
+	int result;
 	enum nvme_ctrl_state new_state = NVME_CTRL_LIVE;
 
-	if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
+	if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING)) {
+		result = -ENODEV;
 		goto out;
+	}
 
 	/*
 	 * If we're called to reset a live controller first shut it down before
@@ -2355,6 +2357,7 @@ static void nvme_reset_work(struct work_struct *work)
 	if (!nvme_change_ctrl_state(&dev->ctrl, new_state)) {
 		dev_warn(dev->ctrl.device,
 			"failed to mark controller state %d\n", new_state);
+		result = -ENODEV;
 		goto out;
 	}
 
-- 
GitLab


From 010bfbc9342468b419247bae250e72a81e5828d1 Mon Sep 17 00:00:00 2001
From: Heiner Litz <hlitz@ucsc.edu>
Date: Fri, 21 Jun 2019 11:11:59 +0200
Subject: [PATCH 0869/1835] lightnvm: pblk: fix freeing of merged pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 510fd8ea98fcb586c01aef93d87c060a159ac30a ]

bio_add_pc_page() may merge pages when a bio is padded due to a flush.
Fix iteration over the bio to free the correct pages in case of a merge.

Signed-off-by: Heiner Litz <hlitz@ucsc.edu>
Reviewed-by: Javier González <javier@javigon.com>
Signed-off-by: Matias Bjørling <mb@lightnvm.io>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/lightnvm/pblk-core.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
index 95be6e36c7ddf..80710c62ac293 100644
--- a/drivers/lightnvm/pblk-core.c
+++ b/drivers/lightnvm/pblk-core.c
@@ -288,14 +288,16 @@ void pblk_free_rqd(struct pblk *pblk, struct nvm_rq *rqd, int type)
 void pblk_bio_free_pages(struct pblk *pblk, struct bio *bio, int off,
 			 int nr_pages)
 {
-	struct bio_vec bv;
-	int i;
-
-	WARN_ON(off + nr_pages != bio->bi_vcnt);
-
-	for (i = off; i < nr_pages + off; i++) {
-		bv = bio->bi_io_vec[i];
-		mempool_free(bv.bv_page, &pblk->page_bio_pool);
+	struct bio_vec *bv;
+	struct page *page;
+	int i, e, nbv = 0;
+
+	for (i = 0; i < bio->bi_vcnt; i++) {
+		bv = &bio->bi_io_vec[i];
+		page = bv->bv_page;
+		for (e = 0; e < bv->bv_len; e += PBLK_EXPOSED_PAGE_SIZE, nbv++)
+			if (nbv >= off)
+				mempool_free(page++, &pblk->page_bio_pool);
 	}
 }
 
-- 
GitLab


From 723ba79384922f6fbf910dfd8af307c86517378c Mon Sep 17 00:00:00 2001
From: Julien Thierry <julien.thierry@arm.com>
Date: Tue, 11 Jun 2019 10:38:06 +0100
Subject: [PATCH 0870/1835] arm64: Do not enable IRQs for ct_user_exit

[ Upstream commit 9034f6251572a4744597c51dea5ab73a55f2b938 ]

For el0_dbg and el0_error, DAIF bits get explicitly cleared before
calling ct_user_exit.

When context tracking is disabled, DAIF gets set (almost) immediately
after. When context tracking is enabled, among the first things done
is disabling IRQs.

What is actually needed is:
- PSR.D = 0 so the system can be debugged (should be already the case)
- PSR.A = 0 so async error can be handled during context tracking

Do not clear PSR.I in those two locations.

Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: James Morse <james.morse@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/entry.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 8556876c91096..5f800384cb9a8 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -824,7 +824,7 @@ el0_dbg:
 	mov	x1, x25
 	mov	x2, sp
 	bl	do_debug_exception
-	enable_daif
+	enable_da_f
 	ct_user_exit
 	b	ret_to_user
 el0_inv:
@@ -876,7 +876,7 @@ el0_error_naked:
 	enable_dbg
 	mov	x0, sp
 	bl	do_serror
-	enable_daif
+	enable_da_f
 	ct_user_exit
 	b	ret_to_user
 ENDPROC(el0_error)
-- 
GitLab


From 06a3cd416224997a376f17cae17120c50fcb9e3b Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 18 Jun 2019 13:22:13 +0200
Subject: [PATCH 0871/1835] ipsec: select crypto ciphers for xfrm_algo

[ Upstream commit 597179b0ba550bd83fab1a9d57c42a9343c58514 ]

kernelci.org reports failed builds on arc because of what looks
like an old missed 'select' statement:

net/xfrm/xfrm_algo.o: In function `xfrm_probe_algs':
xfrm_algo.c:(.text+0x1e8): undefined reference to `crypto_has_ahash'

I don't see this in randconfig builds on other architectures, but
it's fairly clear we want to select the hash code for it, like we
do for all its other users. As Herbert points out, CRYPTO_BLKCIPHER
is also required even though it has not popped up in build tests.

Fixes: 17bc19702221 ("ipsec: Use skcipher and ahash when probing algorithms")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 4a9ee2d83158b..372c91faa2834 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -14,6 +14,8 @@ config XFRM_ALGO
 	tristate
 	select XFRM
 	select CRYPTO
+	select CRYPTO_HASH
+	select CRYPTO_BLKCIPHER
 
 config XFRM_USER
 	tristate "Transformation user configuration interface"
-- 
GitLab


From 57de3c78f0b7e1d3ba2d0a793e40ae5c49397930 Mon Sep 17 00:00:00 2001
From: Julian Anastasov <ja@ssi.bg>
Date: Tue, 4 Jun 2019 21:56:35 +0300
Subject: [PATCH 0872/1835] ipvs: defer hook registration to avoid leaks

[ Upstream commit cf47a0b882a4e5f6b34c7949d7b293e9287f1972 ]

syzkaller reports for memory leak when registering hooks [1]

As we moved the nf_unregister_net_hooks() call into
__ip_vs_dev_cleanup(), defer the nf_register_net_hooks()
call, so that hooks are allocated and freed from same
pernet_operations (ipvs_core_dev_ops).

[1]
BUG: memory leak
unreferenced object 0xffff88810acd8a80 (size 96):
 comm "syz-executor073", pid 7254, jiffies 4294950560 (age 22.250s)
 hex dump (first 32 bytes):
   02 00 00 00 00 00 00 00 50 8b bb 82 ff ff ff ff  ........P.......
   00 00 00 00 00 00 00 00 00 77 bb 82 ff ff ff ff  .........w......
 backtrace:
   [<0000000013db61f1>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
   [<0000000013db61f1>] slab_post_alloc_hook mm/slab.h:439 [inline]
   [<0000000013db61f1>] slab_alloc_node mm/slab.c:3269 [inline]
   [<0000000013db61f1>] kmem_cache_alloc_node_trace+0x15b/0x2a0 mm/slab.c:3597
   [<000000001a27307d>] __do_kmalloc_node mm/slab.c:3619 [inline]
   [<000000001a27307d>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
   [<0000000025054add>] kmalloc_node include/linux/slab.h:590 [inline]
   [<0000000025054add>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
   [<0000000050d1bc00>] kvmalloc include/linux/mm.h:637 [inline]
   [<0000000050d1bc00>] kvzalloc include/linux/mm.h:645 [inline]
   [<0000000050d1bc00>] allocate_hook_entries_size+0x3b/0x60 net/netfilter/core.c:61
   [<00000000e8abe142>] nf_hook_entries_grow+0xae/0x270 net/netfilter/core.c:128
   [<000000004b94797c>] __nf_register_net_hook+0x9a/0x170 net/netfilter/core.c:337
   [<00000000d1545cbc>] nf_register_net_hook+0x34/0xc0 net/netfilter/core.c:464
   [<00000000876c9b55>] nf_register_net_hooks+0x53/0xc0 net/netfilter/core.c:480
   [<000000002ea868e0>] __ip_vs_init+0xe8/0x170 net/netfilter/ipvs/ip_vs_core.c:2280
   [<000000002eb2d451>] ops_init+0x4c/0x140 net/core/net_namespace.c:130
   [<000000000284ec48>] setup_net+0xde/0x230 net/core/net_namespace.c:316
   [<00000000a70600fa>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
   [<00000000ff26c15e>] create_new_namespaces+0x141/0x2a0 kernel/nsproxy.c:107
   [<00000000b103dc79>] copy_namespaces+0xa1/0xe0 kernel/nsproxy.c:165
   [<000000007cc008a2>] copy_process.part.0+0x11fd/0x2150 kernel/fork.c:2035
   [<00000000c344af7c>] copy_process kernel/fork.c:1800 [inline]
   [<00000000c344af7c>] _do_fork+0x121/0x4f0 kernel/fork.c:2369

Reported-by: syzbot+722da59ccb264bc19910@syzkaller.appspotmail.com
Fixes: 719c7d563c17 ("ipvs: Fix use-after-free in ip_vs_in")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipvs/ip_vs_core.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 62c0e80dcd719..a71f777d1353a 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -2218,7 +2218,6 @@ static const struct nf_hook_ops ip_vs_ops[] = {
 static int __net_init __ip_vs_init(struct net *net)
 {
 	struct netns_ipvs *ipvs;
-	int ret;
 
 	ipvs = net_generic(net, ip_vs_net_id);
 	if (ipvs == NULL)
@@ -2250,17 +2249,11 @@ static int __net_init __ip_vs_init(struct net *net)
 	if (ip_vs_sync_net_init(ipvs) < 0)
 		goto sync_fail;
 
-	ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
-	if (ret < 0)
-		goto hook_fail;
-
 	return 0;
 /*
  * Error handling
  */
 
-hook_fail:
-	ip_vs_sync_net_cleanup(ipvs);
 sync_fail:
 	ip_vs_conn_net_cleanup(ipvs);
 conn_fail:
@@ -2290,6 +2283,19 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
 	net->ipvs = NULL;
 }
 
+static int __net_init __ip_vs_dev_init(struct net *net)
+{
+	int ret;
+
+	ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+	if (ret < 0)
+		goto hook_fail;
+	return 0;
+
+hook_fail:
+	return ret;
+}
+
 static void __net_exit __ip_vs_dev_cleanup(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
@@ -2309,6 +2315,7 @@ static struct pernet_operations ipvs_core_ops = {
 };
 
 static struct pernet_operations ipvs_core_dev_ops = {
+	.init = __ip_vs_dev_init,
 	.exit = __ip_vs_dev_cleanup,
 };
 
-- 
GitLab


From 6439110fbeee3c9618ba29c3ea03cdebbf5129ca Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Thu, 13 Jun 2019 06:48:34 -0400
Subject: [PATCH 0873/1835] media: s5p-mfc: Make additional clocks optional

[ Upstream commit e08efef8fe7db87206314c19b341612c719f891a ]

Since the beginning the second clock ('special', 'sclk') was optional and
it is not available on some variants of Exynos SoCs (i.e. Exynos5420 with
v7 of MFC hardware).

However commit 1bce6fb3edf1 ("[media] s5p-mfc: Rework clock handling")
made handling of all specified clocks mandatory. This patch restores
original behavior of the driver and fixes its operation on
Exynos5420 SoCs.

Fixes: 1bce6fb3edf1 ("[media] s5p-mfc: Rework clock handling")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
index eb85cedc5ef34..5e080f32b0e82 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
@@ -38,6 +38,11 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
 	for (i = 0; i < pm->num_clocks; i++) {
 		pm->clocks[i] = devm_clk_get(pm->device, pm->clk_names[i]);
 		if (IS_ERR(pm->clocks[i])) {
+			/* additional clocks are optional */
+			if (i && PTR_ERR(pm->clocks[i]) == -ENOENT) {
+				pm->clocks[i] = NULL;
+				continue;
+			}
 			mfc_err("Failed to get clock: %s\n",
 				pm->clk_names[i]);
 			return PTR_ERR(pm->clocks[i]);
-- 
GitLab


From 8d8f0b9009d01409a626c91c2b88760060b4a287 Mon Sep 17 00:00:00 2001
From: Anders Roxell <anders.roxell@linaro.org>
Date: Wed, 12 Jun 2019 12:19:35 -0400
Subject: [PATCH 0874/1835] media: i2c: fix warning same module names

[ Upstream commit b2ce5617dad254230551feda3599f2cc68e53ad8 ]

When building with CONFIG_VIDEO_ADV7511 and CONFIG_DRM_I2C_ADV7511
enabled as loadable modules, we see the following warning:

  drivers/gpu/drm/bridge/adv7511/adv7511.ko
  drivers/media/i2c/adv7511.ko

Rework so that the file is named adv7511-v4l2.c.

Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/Makefile                      | 2 +-
 drivers/media/i2c/{adv7511.c => adv7511-v4l2.c} | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)
 rename drivers/media/i2c/{adv7511.c => adv7511-v4l2.c} (99%)

diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
index a94eb03d10d4e..520b3c3bf48c2 100644
--- a/drivers/media/i2c/Makefile
+++ b/drivers/media/i2c/Makefile
@@ -36,7 +36,7 @@ obj-$(CONFIG_VIDEO_ADV748X) += adv748x/
 obj-$(CONFIG_VIDEO_ADV7604) += adv7604.o
 obj-$(CONFIG_VIDEO_ADV7842) += adv7842.o
 obj-$(CONFIG_VIDEO_AD9389B) += ad9389b.o
-obj-$(CONFIG_VIDEO_ADV7511) += adv7511.o
+obj-$(CONFIG_VIDEO_ADV7511) += adv7511-v4l2.o
 obj-$(CONFIG_VIDEO_VPX3220) += vpx3220.o
 obj-$(CONFIG_VIDEO_VS6624)  += vs6624.o
 obj-$(CONFIG_VIDEO_BT819) += bt819.o
diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511-v4l2.c
similarity index 99%
rename from drivers/media/i2c/adv7511.c
rename to drivers/media/i2c/adv7511-v4l2.c
index 88349b5053cce..6869bb593a682 100644
--- a/drivers/media/i2c/adv7511.c
+++ b/drivers/media/i2c/adv7511-v4l2.c
@@ -5,6 +5,11 @@
  * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  */
 
+/*
+ * This file is named adv7511-v4l2.c so it doesn't conflict with the Analog
+ * Device ADV7511 (config fragment CONFIG_DRM_I2C_ADV7511).
+ */
+
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-- 
GitLab


From d86c0b73f75b7732824905c7e59ed632c182bb3d Mon Sep 17 00:00:00 2001
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Tue, 18 Jun 2019 17:47:13 +0200
Subject: [PATCH 0875/1835] ntp: Limit TAI-UTC offset

[ Upstream commit d897a4ab11dc8a9fda50d2eccc081a96a6385998 ]

Don't allow the TAI-UTC offset of the system clock to be set by adjtimex()
to a value larger than 100000 seconds.

This prevents an overflow in the conversion to int, prevents the CLOCK_TAI
clock from getting too far ahead of the CLOCK_REALTIME clock, and it is
still large enough to allow leap seconds to be inserted at the maximum rate
currently supported by the kernel (once per day) for the next ~270 years,
however unlikely it is that someone can survive a catastrophic event which
slowed down the rotation of the Earth so much.

Reported-by: Weikang shi <swkhack@gmail.com>
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Link: https://lkml.kernel.org/r/20190618154713.20929-1-mlichvar@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/ntp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 6b23cd584295f..e1110a7bd3e64 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -43,6 +43,7 @@ static u64			tick_length_base;
 #define MAX_TICKADJ		500LL		/* usecs */
 #define MAX_TICKADJ_SCALED \
 	(((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
+#define MAX_TAI_OFFSET		100000
 
 /*
  * phase-lock loop variables
@@ -698,7 +699,8 @@ static inline void process_adjtimex_modes(const struct timex *txc, s32 *time_tai
 		time_constant = max(time_constant, 0l);
 	}
 
-	if (txc->modes & ADJ_TAI && txc->constant >= 0)
+	if (txc->modes & ADJ_TAI &&
+			txc->constant >= 0 && txc->constant <= MAX_TAI_OFFSET)
 		*time_tai = txc->constant;
 
 	if (txc->modes & ADJ_OFFSET)
-- 
GitLab


From b9f547b7bdd91fa04ccb0992dbbac5a1d7326afb Mon Sep 17 00:00:00 2001
From: Nathan Huckleberry <nhuck@google.com>
Date: Fri, 14 Jun 2019 11:16:04 -0700
Subject: [PATCH 0876/1835] timer_list: Guard procfs specific code

[ Upstream commit a9314773a91a1d3b36270085246a6715a326ff00 ]

With CONFIG_PROC_FS=n the following warning is emitted:

kernel/time/timer_list.c:361:36: warning: unused variable
'timer_list_sops' [-Wunused-const-variable]
   static const struct seq_operations timer_list_sops = {

Add #ifdef guard around procfs specific code.

Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: john.stultz@linaro.org
Cc: sboyd@kernel.org
Cc: clang-built-linux@googlegroups.com
Link: https://github.com/ClangBuiltLinux/linux/issues/534
Link: https://lkml.kernel.org/r/20190614181604.112297-1-nhuck@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/timer_list.c | 36 +++++++++++++++++++-----------------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index d647dabdac97a..07afcfe2a61b7 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -287,23 +287,6 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
 	SEQ_printf(m, "\n");
 }
 
-static int timer_list_show(struct seq_file *m, void *v)
-{
-	struct timer_list_iter *iter = v;
-
-	if (iter->cpu == -1 && !iter->second_pass)
-		timer_list_header(m, iter->now);
-	else if (!iter->second_pass)
-		print_cpu(m, iter->cpu, iter->now);
-#ifdef CONFIG_GENERIC_CLOCKEVENTS
-	else if (iter->cpu == -1 && iter->second_pass)
-		timer_list_show_tickdevices_header(m);
-	else
-		print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
-#endif
-	return 0;
-}
-
 void sysrq_timer_list_show(void)
 {
 	u64 now = ktime_to_ns(ktime_get());
@@ -322,6 +305,24 @@ void sysrq_timer_list_show(void)
 	return;
 }
 
+#ifdef CONFIG_PROC_FS
+static int timer_list_show(struct seq_file *m, void *v)
+{
+	struct timer_list_iter *iter = v;
+
+	if (iter->cpu == -1 && !iter->second_pass)
+		timer_list_header(m, iter->now);
+	else if (!iter->second_pass)
+		print_cpu(m, iter->cpu, iter->now);
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+	else if (iter->cpu == -1 && iter->second_pass)
+		timer_list_show_tickdevices_header(m);
+	else
+		print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
+#endif
+	return 0;
+}
+
 static void *move_iter(struct timer_list_iter *iter, loff_t offset)
 {
 	for (; offset; offset--) {
@@ -381,3 +382,4 @@ static int __init init_timer_list_procfs(void)
 	return 0;
 }
 __initcall(init_timer_list_procfs);
+#endif
-- 
GitLab


From c647c00f28afe678ed1908900db984b72f68a9ff Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date: Wed, 19 Jun 2019 14:18:31 +0200
Subject: [PATCH 0877/1835] acpi/arm64: ignore 5.1 FADTs that are reported as
 5.0

[ Upstream commit 2af22f3ec3ca452f1e79b967f634708ff01ced8a ]

Some Qualcomm Snapdragon based laptops built to run Microsoft Windows
are clearly ACPI 5.1 based, given that that is the first ACPI revision
that supports ARM, and introduced the FADT 'arm_boot_flags' field,
which has a non-zero field on those systems.

So in these cases, infer from the ARM boot flags that the FADT must be
5.1 or later, and treat it as 5.1.

Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Tested-by: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Graeme Gregory <graeme.gregory@linaro.org>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/acpi.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
index ed46dc188b225..970f15c76bace 100644
--- a/arch/arm64/kernel/acpi.c
+++ b/arch/arm64/kernel/acpi.c
@@ -154,10 +154,14 @@ static int __init acpi_fadt_sanity_check(void)
 	 */
 	if (table->revision < 5 ||
 	   (table->revision == 5 && fadt->minor_revision < 1)) {
-		pr_err("Unsupported FADT revision %d.%d, should be 5.1+\n",
+		pr_err(FW_BUG "Unsupported FADT revision %d.%d, should be 5.1+\n",
 		       table->revision, fadt->minor_revision);
-		ret = -EINVAL;
-		goto out;
+
+		if (!fadt->arm_boot_flags) {
+			ret = -EINVAL;
+			goto out;
+		}
+		pr_err("FADT has ARM boot flags set, assuming 5.1\n");
 	}
 
 	if (!(fadt->flags & ACPI_FADT_HW_REDUCED)) {
-- 
GitLab


From 6fd3e9f65db9a69e10861fc046f23d3c86350499 Mon Sep 17 00:00:00 2001
From: Philipp Zabel <p.zabel@pengutronix.de>
Date: Tue, 18 Jun 2019 12:45:10 -0400
Subject: [PATCH 0878/1835] media: coda: fix mpeg2 sequence number handling

[ Upstream commit 56d159a4ec6d8da7313aac6fcbb95d8fffe689ba ]

Sequence number handling assumed that the BIT processor frame number
starts counting at 1, but this is not true for the MPEG-2 decoder,
which starts at 0. Fix the sequence counter offset detection to handle
this.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/coda/coda-bit.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index a3cfefdbee127..25ef0c928a815 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -1728,6 +1728,7 @@ static int __coda_start_decoding(struct coda_ctx *ctx)
 		v4l2_err(&dev->v4l2_dev, "CODA_COMMAND_SEQ_INIT timeout\n");
 		return ret;
 	}
+	ctx->sequence_offset = ~0U;
 	ctx->initialized = 1;
 
 	/* Update kfifo out pointer from coda bitstream read pointer */
@@ -2147,7 +2148,9 @@ static void coda_finish_decode(struct coda_ctx *ctx)
 		v4l2_err(&dev->v4l2_dev,
 			 "decoded frame index out of range: %d\n", decoded_idx);
 	} else {
-		val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM) - 1;
+		val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM);
+		if (ctx->sequence_offset == -1)
+			ctx->sequence_offset = val;
 		val -= ctx->sequence_offset;
 		spin_lock_irqsave(&ctx->buffer_meta_lock, flags);
 		if (!list_empty(&ctx->buffer_meta_list)) {
-- 
GitLab


From 3697c12c44259e1b3e16ce4cf1be9348e624893a Mon Sep 17 00:00:00 2001
From: Marco Felsch <m.felsch@pengutronix.de>
Date: Tue, 18 Jun 2019 12:45:11 -0400
Subject: [PATCH 0879/1835] media: coda: fix last buffer handling in
 V4L2_ENC_CMD_STOP

[ Upstream commit f3775f89852d167990b0d718587774cf00d22ac2 ]

coda_encoder_cmd() is racy, as the last scheduled picture run worker can
still be in-flight while the ENC_CMD_STOP command is issued. Depending
on the exact timing the sequence numbers might already be changed, but
the last buffer might not have been put on the destination queue yet.

In this case the current implementation would prematurely wake the
destination queue with last_buffer_dequeued=true, causing userspace to
call streamoff before the last buffer is handled.

Close this race window by synchronizing with the pic_run_worker before
doing the sequence check.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
[l.stach@pengutronix.de: switch to flush_work, reword commit message]
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/coda/coda-common.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
index 19d92edcc9811..4b0220f40b425 100644
--- a/drivers/media/platform/coda/coda-common.c
+++ b/drivers/media/platform/coda/coda-common.c
@@ -997,6 +997,8 @@ static int coda_encoder_cmd(struct file *file, void *fh,
 	/* Set the stream-end flag on this context */
 	ctx->bit_stream_param |= CODA_BIT_STREAM_END_FLAG;
 
+	flush_work(&ctx->pic_run_work);
+
 	/* If there is no buffer in flight, wake up */
 	if (!ctx->streamon_out || ctx->qsequence == ctx->osequence) {
 		dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
-- 
GitLab


From d562537dbf0d884fab82654ed3df0130736b0903 Mon Sep 17 00:00:00 2001
From: Philipp Zabel <p.zabel@pengutronix.de>
Date: Tue, 18 Jun 2019 12:45:22 -0400
Subject: [PATCH 0880/1835] media: coda: increment sequence offset for the last
 returned frame

[ Upstream commit b3b7d96817cdb8b6fc353867705275dce8f41ccc ]

If no more frames are decoded in bitstream end mode, and a previously
decoded frame has been returned, the firmware still increments the frame
number. To avoid a sequence number mismatch after decoder restart,
increment the sequence_offset correction parameter.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/coda/coda-bit.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index 25ef0c928a815..925581d65ad8a 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -2143,6 +2143,9 @@ static void coda_finish_decode(struct coda_ctx *ctx)
 		else if (ctx->display_idx < 0)
 			ctx->hold = true;
 	} else if (decoded_idx == -2) {
+		if (ctx->display_idx >= 0 &&
+		    ctx->display_idx < ctx->num_internal_frames)
+			ctx->sequence_offset++;
 		/* no frame was decoded, we still return remaining buffers */
 	} else if (decoded_idx < 0 || decoded_idx >= ctx->num_internal_frames) {
 		v4l2_err(&dev->v4l2_dev,
-- 
GitLab


From 43b9fdc48377d4ba22ee8d47c9566c71854ae1be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Almeida?= <andrealmeid@collabora.com>
Date: Mon, 17 Jun 2019 12:28:02 -0400
Subject: [PATCH 0881/1835] media: vimc: cap: check v4l2_fill_pixfmt return
 value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 77ae46e11df5c96bb4582633851f838f5d954df4 ]

v4l2_fill_pixfmt() returns -EINVAL if the pixelformat used as parameter is
invalid or if the user is trying to use a multiplanar format with the
singleplanar API. Currently, the vimc_cap_try_fmt_vid_cap() returns such
value, but vimc_cap_s_fmt_vid_cap() is ignoring it. Fix that and returns
an error value if vimc_cap_try_fmt_vid_cap() has failed.

Signed-off-by: André Almeida <andrealmeid@collabora.com>
Suggested-by: Helen Koike <helen.koike@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/vimc/vimc-capture.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/vimc/vimc-capture.c b/drivers/media/platform/vimc/vimc-capture.c
index 65d657daf66f8..8e014cc485f00 100644
--- a/drivers/media/platform/vimc/vimc-capture.c
+++ b/drivers/media/platform/vimc/vimc-capture.c
@@ -132,12 +132,15 @@ static int vimc_cap_s_fmt_vid_cap(struct file *file, void *priv,
 				  struct v4l2_format *f)
 {
 	struct vimc_cap_device *vcap = video_drvdata(file);
+	int ret;
 
 	/* Do not change the format while stream is on */
 	if (vb2_is_busy(&vcap->queue))
 		return -EBUSY;
 
-	vimc_cap_try_fmt_vid_cap(file, priv, f);
+	ret = vimc_cap_try_fmt_vid_cap(file, priv, f);
+	if (ret)
+		return ret;
 
 	dev_dbg(vcap->dev, "%s: format update: "
 		"old:%dx%d (0x%x, %d, %d, %d, %d) "
-- 
GitLab


From bce037abc29f37c88f78be8f893976a7145b4fc3 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil@xs4all.nl>
Date: Thu, 20 Jun 2019 07:43:41 -0400
Subject: [PATCH 0882/1835] media: hdpvr: fix locking and a missing msleep

[ Upstream commit 6bc5a4a1927556ff9adce1aa95ea408c95453225 ]

This driver has three locking issues:

- The wait_event_interruptible() condition calls hdpvr_get_next_buffer(dev)
  which uses a mutex, which is not allowed. Rewrite with list_empty_careful()
  that doesn't need locking.

- In hdpvr_read() the call to hdpvr_stop_streaming() didn't lock io_mutex,
  but it should have since stop_streaming expects that.

- In hdpvr_device_release() io_mutex was locked when calling flush_work(),
  but there it shouldn't take that mutex since the work done by flush_work()
  also wants to lock that mutex.

There are also two other changes (suggested by Keith):

- msecs_to_jiffies(4000); (a NOP) should have been msleep(4000).
- Change v4l2_dbg to v4l2_info to always log if streaming had to be restarted.

Reported-by: Keith Pyle <kpyle@austin.rr.com>
Suggested-by: Keith Pyle <kpyle@austin.rr.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/hdpvr/hdpvr-video.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
index 1b89c77bad667..0615996572e41 100644
--- a/drivers/media/usb/hdpvr/hdpvr-video.c
+++ b/drivers/media/usb/hdpvr/hdpvr-video.c
@@ -439,7 +439,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
 	/* wait for the first buffer */
 	if (!(file->f_flags & O_NONBLOCK)) {
 		if (wait_event_interruptible(dev->wait_data,
-					     hdpvr_get_next_buffer(dev)))
+					     !list_empty_careful(&dev->rec_buff_list)))
 			return -ERESTARTSYS;
 	}
 
@@ -465,10 +465,17 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
 				goto err;
 			}
 			if (!err) {
-				v4l2_dbg(MSG_INFO, hdpvr_debug, &dev->v4l2_dev,
-					"timeout: restart streaming\n");
+				v4l2_info(&dev->v4l2_dev,
+					  "timeout: restart streaming\n");
+				mutex_lock(&dev->io_mutex);
 				hdpvr_stop_streaming(dev);
-				msecs_to_jiffies(4000);
+				mutex_unlock(&dev->io_mutex);
+				/*
+				 * The FW needs about 4 seconds after streaming
+				 * stopped before it is ready to restart
+				 * streaming.
+				 */
+				msleep(4000);
 				err = hdpvr_start_streaming(dev);
 				if (err) {
 					ret = err;
@@ -1133,9 +1140,7 @@ static void hdpvr_device_release(struct video_device *vdev)
 	struct hdpvr_device *dev = video_get_drvdata(vdev);
 
 	hdpvr_delete(dev);
-	mutex_lock(&dev->io_mutex);
 	flush_work(&dev->worker);
-	mutex_unlock(&dev->io_mutex);
 
 	v4l2_device_unregister(&dev->v4l2_dev);
 	v4l2_ctrl_handler_free(&dev->hdl);
-- 
GitLab


From 41864adfee2e8aebf695b053a0738bb08aee4b31 Mon Sep 17 00:00:00 2001
From: Icenowy Zheng <icenowy@aosc.io>
Date: Thu, 20 Jun 2019 15:47:44 +0200
Subject: [PATCH 0883/1835] net: stmmac: sun8i: force select external PHY when
 no internal one

[ Upstream commit 0fec7e72ae1391bb2d7527efb54fe6ae88acabce ]

The PHY selection bit also exists on SoCs without an internal PHY; if it's
set to 1 (internal PHY, default value) then the MAC will not make use of
any PHY on such SoCs.

This problem appears when adapting for H6, which has no real internal PHY
(the "internal PHY" on H6 is not on-die, but on a co-packaged AC200 chip,
connected via RMII interface at GPIO bank A).

Force the PHY selection bit to 0 when the SOC doesn't have an internal PHY,
to address the problem of a wrong default value.

Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Ondrej Jirman <megous@megous.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 49a896a163919..79c91526f3ecc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -893,6 +893,11 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv)
 		 * address. No need to mask it again.
 		 */
 		reg |= 1 << H3_EPHY_ADDR_SHIFT;
+	} else {
+		/* For SoCs without internal PHY the PHY selection bit should be
+		 * set to 0 (external PHY).
+		 */
+		reg &= ~H3_EPHY_SELECT;
 	}
 
 	if (!of_property_read_u32(node, "allwinner,tx-delay-ps", &val)) {
-- 
GitLab


From 6f6e126e19952289ba8e215cc21139052c34bfae Mon Sep 17 00:00:00 2001
From: Ping-Ke Shih <pkshih@realtek.com>
Date: Wed, 29 May 2019 14:57:30 +0800
Subject: [PATCH 0884/1835] rtlwifi: rtl8192cu: fix error handle when usb probe
 failed

[ Upstream commit 6c0ed66f1a5b84e2a812c7c2d6571a5621bf3396 ]

rtl_usb_probe() must do error handle rtl_deinit_core() only if
rtl_init_core() is done, otherwise goto error_out2.

| usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
| rtl_usb: reg 0xf0, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0
| rtl8192cu: Chip version 0x10
| rtl_usb: reg 0xa, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0
| rtl_usb: Too few input end points found
| INFO: trying to register non-static key.
| the code is fine but needs lockdep annotation.
| turning off the locking correctness validator.
| CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
| Google 01/01/2011
| Workqueue: usb_hub_wq hub_event
| Call Trace:
|   __dump_stack lib/dump_stack.c:77 [inline]
|   dump_stack+0xe8/0x16e lib/dump_stack.c:113
|   assign_lock_key kernel/locking/lockdep.c:786 [inline]
|   register_lock_class+0x11b8/0x1250 kernel/locking/lockdep.c:1095
|   __lock_acquire+0xfb/0x37c0 kernel/locking/lockdep.c:3582
|   lock_acquire+0x10d/0x2f0 kernel/locking/lockdep.c:4211
|   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
|   _raw_spin_lock_irqsave+0x44/0x60 kernel/locking/spinlock.c:152
|   rtl_c2hcmd_launcher+0xd1/0x390
| drivers/net/wireless/realtek/rtlwifi/base.c:2344
|   rtl_deinit_core+0x25/0x2d0 drivers/net/wireless/realtek/rtlwifi/base.c:574
|   rtl_usb_probe.cold+0x861/0xa70
| drivers/net/wireless/realtek/rtlwifi/usb.c:1093
|   usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361
|   really_probe+0x2da/0xb10 drivers/base/dd.c:509
|   driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
|   __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
|   bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
|   __device_attach+0x223/0x3a0 drivers/base/dd.c:844
|   bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
|   device_add+0xad2/0x16e0 drivers/base/core.c:2106
|   usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
|   generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
|   usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
|   really_probe+0x2da/0xb10 drivers/base/dd.c:509
|   driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
|   __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
|   bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
|   __device_attach+0x223/0x3a0 drivers/base/dd.c:844
|   bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
|   device_add+0xad2/0x16e0 drivers/base/core.c:2106
|   usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
|   hub_port_connect drivers/usb/core/hub.c:5089 [inline]
|   hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
|   port_event drivers/usb/core/hub.c:5350 [inline]
|   hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
|   process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
|   worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
|   kthread+0x313/0x420 kernel/kthread.c:253
|   ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Reported-by: syzbot+1fcc5ef45175fc774231@syzkaller.appspotmail.com
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtlwifi/usb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 2ac5004d7a401..5adb939afee88 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1081,13 +1081,13 @@ int rtl_usb_probe(struct usb_interface *intf,
 	rtlpriv->cfg->ops->read_eeprom_info(hw);
 	err = _rtl_usb_init(hw);
 	if (err)
-		goto error_out;
+		goto error_out2;
 	rtl_usb_init_sw(hw);
 	/* Init mac80211 sw */
 	err = rtl_init_core(hw);
 	if (err) {
 		pr_err("Can't allocate sw for mac80211\n");
-		goto error_out;
+		goto error_out2;
 	}
 	if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
 		pr_err("Can't init_sw_vars\n");
@@ -1108,6 +1108,7 @@ int rtl_usb_probe(struct usb_interface *intf,
 
 error_out:
 	rtl_deinit_core(hw);
+error_out2:
 	_rtl_usb_io_handler_release(hw);
 	usb_put_dev(udev);
 	complete(&rtlpriv->firmware_loading_complete);
-- 
GitLab


From 3f7952b275c8aa35c9015657377b2cfb19627658 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Fri, 7 Jun 2019 13:48:09 +0200
Subject: [PATCH 0885/1835] mt7601u: do not schedule rx_tasklet when the device
 has been disconnected

[ Upstream commit 4079e8ccabc3b6d1b503f2376123cb515d14921f ]

Do not schedule rx_tasklet when the usb dongle is disconnected.
Moreover do not grub rx_lock in mt7601u_kill_rx since usb_poison_urb
can run concurrently with urb completion and we can unlink urbs from rx
ring in any order.
This patch fixes the common kernel warning reported when
the device is removed.

[   24.921354] usb 3-14: USB disconnect, device number 7
[   24.921593] ------------[ cut here ]------------
[   24.921594] RX urb mismatch
[   24.921675] WARNING: CPU: 4 PID: 163 at drivers/net/wireless/mediatek/mt7601u/dma.c:200 mt7601u_complete_rx+0xcb/0xd0 [mt7601u]
[   24.921769] CPU: 4 PID: 163 Comm: kworker/4:2 Tainted: G           OE     4.19.31-041931-generic #201903231635
[   24.921770] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P1.30 05/23/2014
[   24.921782] Workqueue: usb_hub_wq hub_event
[   24.921797] RIP: 0010:mt7601u_complete_rx+0xcb/0xd0 [mt7601u]
[   24.921800] RSP: 0018:ffff9bd9cfd03d08 EFLAGS: 00010086
[   24.921802] RAX: 0000000000000000 RBX: ffff9bd9bf043540 RCX: 0000000000000006
[   24.921803] RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9bd9cfd16420
[   24.921804] RBP: ffff9bd9cfd03d28 R08: 0000000000000002 R09: 00000000000003a8
[   24.921805] R10: 0000002f485fca34 R11: 0000000000000000 R12: ffff9bd9bf043c1c
[   24.921806] R13: ffff9bd9c62fa3c0 R14: 0000000000000082 R15: 0000000000000000
[   24.921807] FS:  0000000000000000(0000) GS:ffff9bd9cfd00000(0000) knlGS:0000000000000000
[   24.921808] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   24.921808] CR2: 00007fb2648b0000 CR3: 0000000142c0a004 CR4: 00000000001606e0
[   24.921809] Call Trace:
[   24.921812]  <IRQ>
[   24.921819]  __usb_hcd_giveback_urb+0x8b/0x140
[   24.921821]  usb_hcd_giveback_urb+0xca/0xe0
[   24.921828]  xhci_giveback_urb_in_irq.isra.42+0x82/0xf0
[   24.921834]  handle_cmd_completion+0xe02/0x10d0
[   24.921837]  xhci_irq+0x274/0x4a0
[   24.921838]  xhci_msi_irq+0x11/0x20
[   24.921851]  __handle_irq_event_percpu+0x44/0x190
[   24.921856]  handle_irq_event_percpu+0x32/0x80
[   24.921861]  handle_irq_event+0x3b/0x5a
[   24.921867]  handle_edge_irq+0x80/0x190
[   24.921874]  handle_irq+0x20/0x30
[   24.921889]  do_IRQ+0x4e/0xe0
[   24.921891]  common_interrupt+0xf/0xf
[   24.921892]  </IRQ>
[   24.921900] RIP: 0010:usb_hcd_flush_endpoint+0x78/0x180
[   24.921354] usb 3-14: USB disconnect, device number 7

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt7601u/dma.c | 33 +++++++++++----------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
index 7f3e3983b781d..bc36712cfffc3 100644
--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
@@ -193,10 +193,23 @@ static void mt7601u_complete_rx(struct urb *urb)
 	struct mt7601u_rx_queue *q = &dev->rx_q;
 	unsigned long flags;
 
-	spin_lock_irqsave(&dev->rx_lock, flags);
+	/* do no schedule rx tasklet if urb has been unlinked
+	 * or the device has been removed
+	 */
+	switch (urb->status) {
+	case -ECONNRESET:
+	case -ESHUTDOWN:
+	case -ENOENT:
+		return;
+	default:
+		dev_err_ratelimited(dev->dev, "rx urb failed: %d\n",
+				    urb->status);
+		/* fall through */
+	case 0:
+		break;
+	}
 
-	if (mt7601u_urb_has_error(urb))
-		dev_err(dev->dev, "Error: RX urb failed:%d\n", urb->status);
+	spin_lock_irqsave(&dev->rx_lock, flags);
 	if (WARN_ONCE(q->e[q->end].urb != urb, "RX urb mismatch"))
 		goto out;
 
@@ -363,19 +376,9 @@ int mt7601u_dma_enqueue_tx(struct mt7601u_dev *dev, struct sk_buff *skb,
 static void mt7601u_kill_rx(struct mt7601u_dev *dev)
 {
 	int i;
-	unsigned long flags;
 
-	spin_lock_irqsave(&dev->rx_lock, flags);
-
-	for (i = 0; i < dev->rx_q.entries; i++) {
-		int next = dev->rx_q.end;
-
-		spin_unlock_irqrestore(&dev->rx_lock, flags);
-		usb_poison_urb(dev->rx_q.e[next].urb);
-		spin_lock_irqsave(&dev->rx_lock, flags);
-	}
-
-	spin_unlock_irqrestore(&dev->rx_lock, flags);
+	for (i = 0; i < dev->rx_q.entries; i++)
+		usb_poison_urb(dev->rx_q.e[i].urb);
 }
 
 static int mt7601u_submit_rx_buf(struct mt7601u_dev *dev,
-- 
GitLab


From 0335778801356ba8bc8af93c6babf58bb42f839e Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Tue, 25 Jun 2019 16:26:22 +0900
Subject: [PATCH 0886/1835] x86/build: Add 'set -e' to mkcapflags.sh to delete
 broken capflags.c

[ Upstream commit bc53d3d777f81385c1bb08b07bd1c06450ecc2c1 ]

Without 'set -e', shell scripts continue running even after any
error occurs. The missed 'set -e' is a typical bug in shell scripting.

For example, when a disk space shortage occurs while this script is
running, it actually ends up with generating a truncated capflags.c.

Yet, mkcapflags.sh continues running and exits with 0. So, the build
system assumes it has succeeded.

It will not be re-generated in the next invocation of Make since its
timestamp is newer than that of any of the source files.

Add 'set -e' so that any error in this script is caught and propagated
to the build system.

Since 9c2af1c7377a ("kbuild: add .DELETE_ON_ERROR special target"),
make automatically deletes the target on any failure. So, the broken
capflags.c will be deleted automatically.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Borislav Petkov <bp@alien8.de>
Link: https://lkml.kernel.org/r/20190625072622.17679-1-yamada.masahiro@socionext.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/mkcapflags.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kernel/cpu/mkcapflags.sh b/arch/x86/kernel/cpu/mkcapflags.sh
index d0dfb892c72fe..aed45b8895d5b 100644
--- a/arch/x86/kernel/cpu/mkcapflags.sh
+++ b/arch/x86/kernel/cpu/mkcapflags.sh
@@ -4,6 +4,8 @@
 # Generate the x86_cap/bug_flags[] arrays from include/asm/cpufeatures.h
 #
 
+set -e
+
 IN=$1
 OUT=$2
 
-- 
GitLab


From 20de38d282b3821995edfc5a3e84787510c52171 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Fri, 7 Jun 2019 13:48:10 +0200
Subject: [PATCH 0887/1835] mt7601u: fix possible memory leak when the device
 is disconnected

[ Upstream commit 23377c200b2eb48a60d0f228b2a2e75ed6ee6060 ]

When the device is disconnected while passing traffic it is possible
to receive out of order urbs causing a memory leak since the skb linked
to the current tx urb is not removed. Fix the issue deallocating the skb
cleaning up the tx ring. Moreover this patch fixes the following kernel
warning

[   57.480771] usb 1-1: USB disconnect, device number 2
[   57.483451] ------------[ cut here ]------------
[   57.483462] TX urb mismatch
[   57.483481] WARNING: CPU: 1 PID: 32 at drivers/net/wireless/mediatek/mt7601u/dma.c:245 mt7601u_complete_tx+0x165/00
[   57.483483] Modules linked in:
[   57.483496] CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.2.0-rc1+ #72
[   57.483498] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014
[   57.483502] Workqueue: usb_hub_wq hub_event
[   57.483507] RIP: 0010:mt7601u_complete_tx+0x165/0x1e0
[   57.483510] Code: 8b b5 10 04 00 00 8b 8d 14 04 00 00 eb 8b 80 3d b1 cb e1 00 00 75 9e 48 c7 c7 a4 ea 05 82 c6 05 f
[   57.483513] RSP: 0000:ffffc900000a0d28 EFLAGS: 00010092
[   57.483516] RAX: 000000000000000f RBX: ffff88802c0a62c0 RCX: ffffc900000a0c2c
[   57.483518] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff810a8371
[   57.483520] RBP: ffff88803ced6858 R08: 0000000000000000 R09: 0000000000000001
[   57.483540] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000046
[   57.483542] R13: ffff88802c0a6c88 R14: ffff88803baab540 R15: ffff88803a0cc078
[   57.483548] FS:  0000000000000000(0000) GS:ffff88803eb00000(0000) knlGS:0000000000000000
[   57.483550] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   57.483552] CR2: 000055e7f6780100 CR3: 0000000028c86000 CR4: 00000000000006a0
[   57.483554] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   57.483556] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   57.483559] Call Trace:
[   57.483561]  <IRQ>
[   57.483565]  __usb_hcd_giveback_urb+0x77/0xe0
[   57.483570]  xhci_giveback_urb_in_irq.isra.0+0x8b/0x140
[   57.483574]  handle_cmd_completion+0xf5b/0x12c0
[   57.483577]  xhci_irq+0x1f6/0x1810
[   57.483581]  ? lockdep_hardirqs_on+0x9e/0x180
[   57.483584]  ? _raw_spin_unlock_irq+0x24/0x30
[   57.483588]  __handle_irq_event_percpu+0x3a/0x260
[   57.483592]  handle_irq_event_percpu+0x1c/0x60
[   57.483595]  handle_irq_event+0x2f/0x4c
[   57.483599]  handle_edge_irq+0x7e/0x1a0
[   57.483603]  handle_irq+0x17/0x20
[   57.483607]  do_IRQ+0x54/0x110
[   57.483610]  common_interrupt+0xf/0xf
[   57.483612]  </IRQ>

Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt7601u/dma.c | 21 ++++++++++++++++-----
 drivers/net/wireless/mediatek/mt7601u/tx.c  |  4 ++--
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
index bc36712cfffc3..47cebb2ec05c5 100644
--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
@@ -241,14 +241,25 @@ static void mt7601u_complete_tx(struct urb *urb)
 	struct sk_buff *skb;
 	unsigned long flags;
 
-	spin_lock_irqsave(&dev->tx_lock, flags);
+	switch (urb->status) {
+	case -ECONNRESET:
+	case -ESHUTDOWN:
+	case -ENOENT:
+		return;
+	default:
+		dev_err_ratelimited(dev->dev, "tx urb failed: %d\n",
+				    urb->status);
+		/* fall through */
+	case 0:
+		break;
+	}
 
-	if (mt7601u_urb_has_error(urb))
-		dev_err(dev->dev, "Error: TX urb failed:%d\n", urb->status);
+	spin_lock_irqsave(&dev->tx_lock, flags);
 	if (WARN_ONCE(q->e[q->start].urb != urb, "TX urb mismatch"))
 		goto out;
 
 	skb = q->e[q->start].skb;
+	q->e[q->start].skb = NULL;
 	trace_mt_tx_dma_done(dev, skb);
 
 	__skb_queue_tail(&dev->tx_skb_done, skb);
@@ -448,10 +459,10 @@ static void mt7601u_free_tx_queue(struct mt7601u_tx_queue *q)
 {
 	int i;
 
-	WARN_ON(q->used);
-
 	for (i = 0; i < q->entries; i++)  {
 		usb_poison_urb(q->e[i].urb);
+		if (q->e[i].skb)
+			mt7601u_tx_status(q->dev, q->e[i].skb);
 		usb_free_urb(q->e[i].urb);
 	}
 }
diff --git a/drivers/net/wireless/mediatek/mt7601u/tx.c b/drivers/net/wireless/mediatek/mt7601u/tx.c
index 3600e911a63e8..4d81c45722fbb 100644
--- a/drivers/net/wireless/mediatek/mt7601u/tx.c
+++ b/drivers/net/wireless/mediatek/mt7601u/tx.c
@@ -117,9 +117,9 @@ void mt7601u_tx_status(struct mt7601u_dev *dev, struct sk_buff *skb)
 	info->status.rates[0].idx = -1;
 	info->flags |= IEEE80211_TX_STAT_ACK;
 
-	spin_lock(&dev->mac_lock);
+	spin_lock_bh(&dev->mac_lock);
 	ieee80211_tx_status(dev->hw, skb);
-	spin_unlock(&dev->mac_lock);
+	spin_unlock_bh(&dev->mac_lock);
 }
 
 static int mt7601u_skb_rooms(struct mt7601u_dev *dev, struct sk_buff *skb)
-- 
GitLab


From fe2ceeb4cffc43c4f64196b13c33f3a52390b114 Mon Sep 17 00:00:00 2001
From: Julian Anastasov <ja@ssi.bg>
Date: Tue, 18 Jun 2019 23:07:36 +0300
Subject: [PATCH 0888/1835] ipvs: fix tinfo memory leak in start_sync_thread

[ Upstream commit 5db7c8b9f9fc2aeec671ae3ca6375752c162e0e7 ]

syzkaller reports for memory leak in start_sync_thread [1]

As Eric points out, kthread may start and stop before the
threadfn function is called, so there is no chance the
data (tinfo in our case) to be released in thread.

Fix this by releasing tinfo in the controlling code instead.

[1]
BUG: memory leak
unreferenced object 0xffff8881206bf700 (size 32):
 comm "syz-executor761", pid 7268, jiffies 4294943441 (age 20.470s)
 hex dump (first 32 bytes):
   00 40 7c 09 81 88 ff ff 80 45 b8 21 81 88 ff ff  .@|......E.!....
   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 backtrace:
   [<0000000057619e23>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
   [<0000000057619e23>] slab_post_alloc_hook mm/slab.h:439 [inline]
   [<0000000057619e23>] slab_alloc mm/slab.c:3326 [inline]
   [<0000000057619e23>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
   [<0000000086ce5479>] kmalloc include/linux/slab.h:547 [inline]
   [<0000000086ce5479>] start_sync_thread+0x5d2/0xe10 net/netfilter/ipvs/ip_vs_sync.c:1862
   [<000000001a9229cc>] do_ip_vs_set_ctl+0x4c5/0x780 net/netfilter/ipvs/ip_vs_ctl.c:2402
   [<00000000ece457c8>] nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
   [<00000000ece457c8>] nf_setsockopt+0x4c/0x80 net/netfilter/nf_sockopt.c:115
   [<00000000942f62d4>] ip_setsockopt net/ipv4/ip_sockglue.c:1258 [inline]
   [<00000000942f62d4>] ip_setsockopt+0x9b/0xb0 net/ipv4/ip_sockglue.c:1238
   [<00000000a56a8ffd>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616
   [<00000000fa895401>] sock_common_setsockopt+0x38/0x50 net/core/sock.c:3130
   [<0000000095eef4cf>] __sys_setsockopt+0x98/0x120 net/socket.c:2078
   [<000000009747cf88>] __do_sys_setsockopt net/socket.c:2089 [inline]
   [<000000009747cf88>] __se_sys_setsockopt net/socket.c:2086 [inline]
   [<000000009747cf88>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086
   [<00000000ded8ba80>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301
   [<00000000893b4ac8>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported-by: syzbot+7e2e50c8adfccd2e5041@syzkaller.appspotmail.com
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Fixes: 998e7a76804b ("ipvs: Use kthread_run() instead of doing a double-fork via kernel_thread()")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/ip_vs.h             |   6 +-
 net/netfilter/ipvs/ip_vs_ctl.c  |   4 -
 net/netfilter/ipvs/ip_vs_sync.c | 134 +++++++++++++++++---------------
 3 files changed, 76 insertions(+), 68 deletions(-)

diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index a0d2e0bb9a94b..0e3c0d83bd991 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -806,11 +806,12 @@ struct ipvs_master_sync_state {
 	struct ip_vs_sync_buff	*sync_buff;
 	unsigned long		sync_queue_len;
 	unsigned int		sync_queue_delay;
-	struct task_struct	*master_thread;
 	struct delayed_work	master_wakeup_work;
 	struct netns_ipvs	*ipvs;
 };
 
+struct ip_vs_sync_thread_data;
+
 /* How much time to keep dests in trash */
 #define IP_VS_DEST_TRASH_PERIOD		(120 * HZ)
 
@@ -941,7 +942,8 @@ struct netns_ipvs {
 	spinlock_t		sync_lock;
 	struct ipvs_master_sync_state *ms;
 	spinlock_t		sync_buff_lock;
-	struct task_struct	**backup_threads;
+	struct ip_vs_sync_thread_data *master_tinfo;
+	struct ip_vs_sync_thread_data *backup_tinfo;
 	int			threads_mask;
 	volatile int		sync_state;
 	struct mutex		sync_mutex;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 2d4e048762f6d..3df94a4991266 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2382,9 +2382,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 			cfg.syncid = dm->syncid;
 			ret = start_sync_thread(ipvs, &cfg, dm->state);
 		} else {
-			mutex_lock(&ipvs->sync_mutex);
 			ret = stop_sync_thread(ipvs, dm->state);
-			mutex_unlock(&ipvs->sync_mutex);
 		}
 		goto out_dec;
 	}
@@ -3492,10 +3490,8 @@ static int ip_vs_genl_del_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
 	if (!attrs[IPVS_DAEMON_ATTR_STATE])
 		return -EINVAL;
 
-	mutex_lock(&ipvs->sync_mutex);
 	ret = stop_sync_thread(ipvs,
 			       nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
-	mutex_unlock(&ipvs->sync_mutex);
 	return ret;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index d4020c5e831d3..ecb71062fcb3c 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -195,6 +195,7 @@ union ip_vs_sync_conn {
 #define IPVS_OPT_F_PARAM	(1 << (IPVS_OPT_PARAM-1))
 
 struct ip_vs_sync_thread_data {
+	struct task_struct *task;
 	struct netns_ipvs *ipvs;
 	struct socket *sock;
 	char *buf;
@@ -374,8 +375,11 @@ static inline void sb_queue_tail(struct netns_ipvs *ipvs,
 					      max(IPVS_SYNC_SEND_DELAY, 1));
 		ms->sync_queue_len++;
 		list_add_tail(&sb->list, &ms->sync_queue);
-		if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE)
-			wake_up_process(ms->master_thread);
+		if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE) {
+			int id = (int)(ms - ipvs->ms);
+
+			wake_up_process(ipvs->master_tinfo[id].task);
+		}
 	} else
 		ip_vs_sync_buff_release(sb);
 	spin_unlock(&ipvs->sync_lock);
@@ -1636,8 +1640,10 @@ static void master_wakeup_work_handler(struct work_struct *work)
 	spin_lock_bh(&ipvs->sync_lock);
 	if (ms->sync_queue_len &&
 	    ms->sync_queue_delay < IPVS_SYNC_WAKEUP_RATE) {
+		int id = (int)(ms - ipvs->ms);
+
 		ms->sync_queue_delay = IPVS_SYNC_WAKEUP_RATE;
-		wake_up_process(ms->master_thread);
+		wake_up_process(ipvs->master_tinfo[id].task);
 	}
 	spin_unlock_bh(&ipvs->sync_lock);
 }
@@ -1703,10 +1709,6 @@ done:
 	if (sb)
 		ip_vs_sync_buff_release(sb);
 
-	/* release the sending multicast socket */
-	sock_release(tinfo->sock);
-	kfree(tinfo);
-
 	return 0;
 }
 
@@ -1740,11 +1742,6 @@ static int sync_thread_backup(void *data)
 		}
 	}
 
-	/* release the sending multicast socket */
-	sock_release(tinfo->sock);
-	kfree(tinfo->buf);
-	kfree(tinfo);
-
 	return 0;
 }
 
@@ -1752,8 +1749,8 @@ static int sync_thread_backup(void *data)
 int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
 		      int state)
 {
-	struct ip_vs_sync_thread_data *tinfo = NULL;
-	struct task_struct **array = NULL, *task;
+	struct ip_vs_sync_thread_data *ti = NULL, *tinfo;
+	struct task_struct *task;
 	struct net_device *dev;
 	char *name;
 	int (*threadfn)(void *data);
@@ -1822,7 +1819,7 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
 		threadfn = sync_thread_master;
 	} else if (state == IP_VS_STATE_BACKUP) {
 		result = -EEXIST;
-		if (ipvs->backup_threads)
+		if (ipvs->backup_tinfo)
 			goto out_early;
 
 		ipvs->bcfg = *c;
@@ -1849,28 +1846,22 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
 					  master_wakeup_work_handler);
 			ms->ipvs = ipvs;
 		}
-	} else {
-		array = kcalloc(count, sizeof(struct task_struct *),
-				GFP_KERNEL);
-		result = -ENOMEM;
-		if (!array)
-			goto out;
 	}
+	result = -ENOMEM;
+	ti = kcalloc(count, sizeof(struct ip_vs_sync_thread_data),
+		     GFP_KERNEL);
+	if (!ti)
+		goto out;
 
 	for (id = 0; id < count; id++) {
-		result = -ENOMEM;
-		tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
-		if (!tinfo)
-			goto out;
+		tinfo = &ti[id];
 		tinfo->ipvs = ipvs;
-		tinfo->sock = NULL;
 		if (state == IP_VS_STATE_BACKUP) {
+			result = -ENOMEM;
 			tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen,
 					     GFP_KERNEL);
 			if (!tinfo->buf)
 				goto out;
-		} else {
-			tinfo->buf = NULL;
 		}
 		tinfo->id = id;
 		if (state == IP_VS_STATE_MASTER)
@@ -1885,17 +1876,15 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
 			result = PTR_ERR(task);
 			goto out;
 		}
-		tinfo = NULL;
-		if (state == IP_VS_STATE_MASTER)
-			ipvs->ms[id].master_thread = task;
-		else
-			array[id] = task;
+		tinfo->task = task;
 	}
 
 	/* mark as active */
 
-	if (state == IP_VS_STATE_BACKUP)
-		ipvs->backup_threads = array;
+	if (state == IP_VS_STATE_MASTER)
+		ipvs->master_tinfo = ti;
+	else
+		ipvs->backup_tinfo = ti;
 	spin_lock_bh(&ipvs->sync_buff_lock);
 	ipvs->sync_state |= state;
 	spin_unlock_bh(&ipvs->sync_buff_lock);
@@ -1910,29 +1899,31 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
 
 out:
 	/* We do not need RTNL lock anymore, release it here so that
-	 * sock_release below and in the kthreads can use rtnl_lock
-	 * to leave the mcast group.
+	 * sock_release below can use rtnl_lock to leave the mcast group.
 	 */
 	rtnl_unlock();
-	count = id;
-	while (count-- > 0) {
-		if (state == IP_VS_STATE_MASTER)
-			kthread_stop(ipvs->ms[count].master_thread);
-		else
-			kthread_stop(array[count]);
+	id = min(id, count - 1);
+	if (ti) {
+		for (tinfo = ti + id; tinfo >= ti; tinfo--) {
+			if (tinfo->task)
+				kthread_stop(tinfo->task);
+		}
 	}
 	if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
 		kfree(ipvs->ms);
 		ipvs->ms = NULL;
 	}
 	mutex_unlock(&ipvs->sync_mutex);
-	if (tinfo) {
-		if (tinfo->sock)
-			sock_release(tinfo->sock);
-		kfree(tinfo->buf);
-		kfree(tinfo);
+
+	/* No more mutexes, release socks */
+	if (ti) {
+		for (tinfo = ti + id; tinfo >= ti; tinfo--) {
+			if (tinfo->sock)
+				sock_release(tinfo->sock);
+			kfree(tinfo->buf);
+		}
+		kfree(ti);
 	}
-	kfree(array);
 	return result;
 
 out_early:
@@ -1944,15 +1935,18 @@ out_early:
 
 int stop_sync_thread(struct netns_ipvs *ipvs, int state)
 {
-	struct task_struct **array;
+	struct ip_vs_sync_thread_data *ti, *tinfo;
 	int id;
 	int retc = -EINVAL;
 
 	IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
 
+	mutex_lock(&ipvs->sync_mutex);
 	if (state == IP_VS_STATE_MASTER) {
+		retc = -ESRCH;
 		if (!ipvs->ms)
-			return -ESRCH;
+			goto err;
+		ti = ipvs->master_tinfo;
 
 		/*
 		 * The lock synchronizes with sb_queue_tail(), so that we don't
@@ -1971,38 +1965,56 @@ int stop_sync_thread(struct netns_ipvs *ipvs, int state)
 			struct ipvs_master_sync_state *ms = &ipvs->ms[id];
 			int ret;
 
+			tinfo = &ti[id];
 			pr_info("stopping master sync thread %d ...\n",
-				task_pid_nr(ms->master_thread));
+				task_pid_nr(tinfo->task));
 			cancel_delayed_work_sync(&ms->master_wakeup_work);
-			ret = kthread_stop(ms->master_thread);
+			ret = kthread_stop(tinfo->task);
 			if (retc >= 0)
 				retc = ret;
 		}
 		kfree(ipvs->ms);
 		ipvs->ms = NULL;
+		ipvs->master_tinfo = NULL;
 	} else if (state == IP_VS_STATE_BACKUP) {
-		if (!ipvs->backup_threads)
-			return -ESRCH;
+		retc = -ESRCH;
+		if (!ipvs->backup_tinfo)
+			goto err;
+		ti = ipvs->backup_tinfo;
 
 		ipvs->sync_state &= ~IP_VS_STATE_BACKUP;
-		array = ipvs->backup_threads;
 		retc = 0;
 		for (id = ipvs->threads_mask; id >= 0; id--) {
 			int ret;
 
+			tinfo = &ti[id];
 			pr_info("stopping backup sync thread %d ...\n",
-				task_pid_nr(array[id]));
-			ret = kthread_stop(array[id]);
+				task_pid_nr(tinfo->task));
+			ret = kthread_stop(tinfo->task);
 			if (retc >= 0)
 				retc = ret;
 		}
-		kfree(array);
-		ipvs->backup_threads = NULL;
+		ipvs->backup_tinfo = NULL;
+	} else {
+		goto err;
 	}
+	id = ipvs->threads_mask;
+	mutex_unlock(&ipvs->sync_mutex);
+
+	/* No more mutexes, release socks */
+	for (tinfo = ti + id; tinfo >= ti; tinfo--) {
+		if (tinfo->sock)
+			sock_release(tinfo->sock);
+		kfree(tinfo->buf);
+	}
+	kfree(ti);
 
 	/* decrease the module use count */
 	ip_vs_use_count_dec();
+	return retc;
 
+err:
+	mutex_unlock(&ipvs->sync_mutex);
 	return retc;
 }
 
@@ -2021,7 +2033,6 @@ void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs)
 {
 	int retc;
 
-	mutex_lock(&ipvs->sync_mutex);
 	retc = stop_sync_thread(ipvs, IP_VS_STATE_MASTER);
 	if (retc && retc != -ESRCH)
 		pr_err("Failed to stop Master Daemon\n");
@@ -2029,5 +2040,4 @@ void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs)
 	retc = stop_sync_thread(ipvs, IP_VS_STATE_BACKUP);
 	if (retc && retc != -ESRCH)
 		pr_err("Failed to stop Backup Daemon\n");
-	mutex_unlock(&ipvs->sync_mutex);
 }
-- 
GitLab


From 8a808fadc9f701d0f4e849724cf33d8bfe214b3f Mon Sep 17 00:00:00 2001
From: Claire Chang <tientzu@chromium.org>
Date: Thu, 23 May 2019 15:15:34 +0800
Subject: [PATCH 0889/1835] ath10k: add missing error handling

[ Upstream commit 4b553f3ca4cbde67399aa3a756c37eb92145b8a1 ]

In function ath10k_sdio_mbox_rx_alloc() [sdio.c],
ath10k_sdio_mbox_alloc_rx_pkt() is called without handling the error cases.
This will make the driver think the allocation for skb is successful and
try to access the skb. If we enable failslab, system will easily crash with
NULL pointer dereferencing.

Call trace of CONFIG_FAILSLAB:
ath10k_sdio_irq_handler+0x570/0xa88 [ath10k_sdio]
process_sdio_pending_irqs+0x4c/0x174
sdio_run_irqs+0x3c/0x64
sdio_irq_work+0x1c/0x28

Fixes: d96db25d2025 ("ath10k: add initial SDIO support")
Signed-off-by: Claire Chang <tientzu@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/sdio.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
index 7f61591ce0de6..cb527a21f1ace 100644
--- a/drivers/net/wireless/ath/ath10k/sdio.c
+++ b/drivers/net/wireless/ath/ath10k/sdio.c
@@ -613,6 +613,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar,
 						    full_len,
 						    last_in_bundle,
 						    last_in_bundle);
+		if (ret) {
+			ath10k_warn(ar, "alloc_rx_pkt error %d\n", ret);
+			goto err;
+		}
 	}
 
 	ar_sdio->n_rx_pkts = i;
-- 
GitLab


From 7201cc227d4a6314392368d0fb9140696dc7b6bb Mon Sep 17 00:00:00 2001
From: Miaoqing Pan <miaoqing@codeaurora.org>
Date: Thu, 30 May 2019 09:49:20 +0800
Subject: [PATCH 0890/1835] ath10k: fix PCIE device wake up failed

[ Upstream commit 011d4111c8c602ea829fa4917af1818eb0500a90 ]

Observed PCIE device wake up failed after ~120 iterations of
soft-reboot test. The error message is
"ath10k_pci 0000:01:00.0: failed to wake up device : -110"

The call trace as below:
ath10k_pci_probe -> ath10k_pci_force_wake -> ath10k_pci_wake_wait ->
ath10k_pci_is_awake

Once trigger the device to wake up, we will continuously check the RTC
state until it returns RTC_STATE_V_ON or timeout.

But for QCA99x0 chips, we use wrong value for RTC_STATE_V_ON.
Occasionally, we get 0x7 on the fist read, we thought as a failure
case, but actually is the right value, also verified with the spec.
So fix the issue by changing RTC_STATE_V_ON from 0x5 to 0x7, passed
~2000 iterations.

Tested HW: QCA9984

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index 677535b3d2070..476e0535f06f0 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -168,7 +168,7 @@ const struct ath10k_hw_values qca6174_values = {
 };
 
 const struct ath10k_hw_values qca99x0_values = {
-	.rtc_state_val_on		= 5,
+	.rtc_state_val_on		= 7,
 	.ce_count			= 12,
 	.msi_assign_ce_max		= 12,
 	.num_target_ce_config_wlan	= 10,
-- 
GitLab


From 1182ff2248474066039a2be42e6c1a4985d5562d Mon Sep 17 00:00:00 2001
From: Kyle Meyer <kyle.meyer@hpe.com>
Date: Thu, 20 Jun 2019 14:36:30 -0500
Subject: [PATCH 0891/1835] perf tools: Increase MAX_NR_CPUS and MAX_CACHES

[ Upstream commit 9f94c7f947e919c343b30f080285af53d0fa9902 ]

Attempting to profile 1024 or more CPUs with perf causes two errors:

  perf record -a
  [ perf record: Woken up X times to write data ]
  way too many cpu caches..
  [ perf record: Captured and wrote X MB perf.data (X samples) ]

  perf report -C 1024
  Error: failed to set  cpu bitmap
  Requested CPU 1024 too large. Consider raising MAX_NR_CPUS

  Increasing MAX_NR_CPUS from 1024 to 2048 and redefining MAX_CACHES as
  MAX_NR_CPUS * 4 returns normal functionality to perf:

  perf record -a
  [ perf record: Woken up X times to write data ]
  [ perf record: Captured and wrote X MB perf.data (X samples) ]

  perf report -C 1024
  ...

Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20190620193630.154025-1-meyerk@stormcage.eag.rdlabs.hpecorp.net
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/perf.h        | 2 +-
 tools/perf/util/header.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 21bf7f5a3cf51..19d435a9623b5 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -26,7 +26,7 @@ static inline unsigned long long rdclock(void)
 }
 
 #ifndef MAX_NR_CPUS
-#define MAX_NR_CPUS			1024
+#define MAX_NR_CPUS			2048
 #endif
 
 extern const char *input_name;
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index b9a82598e2ac3..7f2e3b1c746c9 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1173,7 +1173,7 @@ static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp)
 	return 0;
 }
 
-#define MAX_CACHES 2000
+#define MAX_CACHES (MAX_NR_CPUS * 4)
 
 static int write_cache(struct feat_fd *ff,
 		       struct perf_evlist *evlist __maybe_unused)
-- 
GitLab


From 6e6bc34f85702ea065a84477eec4a1401e759f9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?=
 <amadeuszx.slawinski@linux.intel.com>
Date: Mon, 17 Jun 2019 13:36:42 +0200
Subject: [PATCH 0892/1835] ASoC: Intel: hdac_hdmi: Set ops to NULL on remove
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0f6ff78540bd1b4df1e0f17806b0ce2e1dff0d78 ]

When we unload Skylake driver we may end up calling
hdac_component_master_unbind(), it uses acomp->audio_ops, which we set
in hdmi_codec_probe(), so we need to set it to NULL in hdmi_codec_remove(),
otherwise we will dereference no longer existing pointer.

Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/hdac_hdmi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 63487240b61e4..098196610542a 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -1854,6 +1854,12 @@ static void hdmi_codec_remove(struct snd_soc_component *component)
 {
 	struct hdac_hdmi_priv *hdmi = snd_soc_component_get_drvdata(component);
 	struct hdac_device *hdev = hdmi->hdev;
+	int ret;
+
+	ret = snd_hdac_acomp_register_notifier(hdev->bus, NULL);
+	if (ret < 0)
+		dev_err(&hdev->dev, "notifier unregister failed: err: %d\n",
+				ret);
 
 	pm_runtime_disable(&hdev->dev);
 }
-- 
GitLab


From 12e20eca894b90598cba34ca4634869d14f2e868 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Mon, 24 Jun 2019 09:32:50 -0700
Subject: [PATCH 0893/1835] libata: don't request sense data on !ZAC ATA
 devices

[ Upstream commit ca156e006add67e4beea7896be395160735e09b0 ]

ZAC support added sense data requesting on error for both ZAC and ATA
devices. This seems to cause erratic error handling behaviors on some
SSDs where the device reports sense data availability and then
delivers the wrong content making EH take the wrong actions.  The
failure mode was sporadic on a LITE-ON ssd and couldn't be reliably
reproduced.

There is no value in requesting sense data from non-ZAC ATA devices
while there's a significant risk of introducing EH misbehaviors which
are difficult to reproduce and fix.  Let's do the sense data dancing
only for ZAC devices.

Reviewed-by: Hannes Reinecke <hare@suse.com>
Tested-by: Masato Suzuki <masato.suzuki@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-eh.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 01306c018398f..ccc80ff57eb20 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1490,7 +1490,7 @@ static int ata_eh_read_log_10h(struct ata_device *dev,
 	tf->hob_lbah = buf[10];
 	tf->nsect = buf[12];
 	tf->hob_nsect = buf[13];
-	if (ata_id_has_ncq_autosense(dev->id))
+	if (dev->class == ATA_DEV_ZAC && ata_id_has_ncq_autosense(dev->id))
 		tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16];
 
 	return 0;
@@ -1737,7 +1737,8 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
 	memcpy(&qc->result_tf, &tf, sizeof(tf));
 	qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48;
 	qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ;
-	if ((qc->result_tf.command & ATA_SENSE) || qc->result_tf.auxiliary) {
+	if (dev->class == ATA_DEV_ZAC &&
+	    ((qc->result_tf.command & ATA_SENSE) || qc->result_tf.auxiliary)) {
 		char sense_key, asc, ascq;
 
 		sense_key = (qc->result_tf.auxiliary >> 16) & 0xff;
@@ -1791,10 +1792,11 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
 	}
 
 	switch (qc->dev->class) {
-	case ATA_DEV_ATA:
 	case ATA_DEV_ZAC:
 		if (stat & ATA_SENSE)
 			ata_eh_request_sense(qc, qc->scsicmd);
+		/* fall through */
+	case ATA_DEV_ATA:
 		if (err & ATA_ICRC)
 			qc->err_mask |= AC_ERR_ATA_BUS;
 		if (err & (ATA_UNC | ATA_AMNF))
-- 
GitLab


From e69fac59c493107bf25343ad7b387530e2334836 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Thu, 30 May 2019 12:50:43 +0200
Subject: [PATCH 0894/1835] clocksource/drivers/exynos_mct: Increase priority
 over ARM arch timer

[ Upstream commit 6282edb72bed5324352522d732080d4c1b9dfed6 ]

Exynos SoCs based on CA7/CA15 have 2 timer interfaces: custom Exynos MCT
(Multi Core Timer) and standard ARM Architected Timers.

There are use cases, where both timer interfaces are used simultanously.
One of such examples is using Exynos MCT for the main system timer and
ARM Architected Timers for the KVM and virtualized guests (KVM requires
arch timers).

Exynos Multi-Core Timer driver (exynos_mct) must be however started
before ARM Architected Timers (arch_timer), because they both share some
common hardware blocks (global system counter) and turning on MCT is
needed to get ARM Architected Timer working properly.

To ensure selecting Exynos MCT as the main system timer, increase MCT
timer rating. To ensure proper starting order of both timers during
suspend/resume cycle, increase MCT hotplug priority over ARM Archictected
Timers.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/exynos_mct.c | 4 ++--
 include/linux/cpuhotplug.h       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index d55c30f6981dc..aaf5bfa9bd9c9 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -211,7 +211,7 @@ static void exynos4_frc_resume(struct clocksource *cs)
 
 static struct clocksource mct_frc = {
 	.name		= "mct-frc",
-	.rating		= 400,
+	.rating		= 450,	/* use value higher than ARM arch timer */
 	.read		= exynos4_frc_read,
 	.mask		= CLOCKSOURCE_MASK(32),
 	.flags		= CLOCK_SOURCE_IS_CONTINUOUS,
@@ -466,7 +466,7 @@ static int exynos4_mct_starting_cpu(unsigned int cpu)
 	evt->set_state_oneshot_stopped = set_state_shutdown;
 	evt->tick_resume = set_state_shutdown;
 	evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
-	evt->rating = 450;
+	evt->rating = 500;	/* use value higher than ARM arch timer */
 
 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
 
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index dec0372efe2e3..d67c0035165c2 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -116,10 +116,10 @@ enum cpuhp_state {
 	CPUHP_AP_PERF_ARM_ACPI_STARTING,
 	CPUHP_AP_PERF_ARM_STARTING,
 	CPUHP_AP_ARM_L2X0_STARTING,
+	CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
 	CPUHP_AP_ARM_ARCH_TIMER_STARTING,
 	CPUHP_AP_ARM_GLOBAL_TIMER_STARTING,
 	CPUHP_AP_JCORE_TIMER_STARTING,
-	CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
 	CPUHP_AP_ARM_TWD_STARTING,
 	CPUHP_AP_QCOM_TIMER_STARTING,
 	CPUHP_AP_ARMADA_TIMER_STARTING,
-- 
GitLab


From dad0b17e4a4e68df83e2904034e76a94c0a82d91 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Tue, 25 Jun 2019 11:23:52 -0700
Subject: [PATCH 0895/1835] xsk: Properly terminate assignment in
 xskq_produce_flush_desc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f7019b7b0ad14bde732b8953161994edfc384953 ]

Clang warns:

In file included from net/xdp/xsk_queue.c:10:
net/xdp/xsk_queue.h:292:2: warning: expression result unused
[-Wunused-value]
        WRITE_ONCE(q->ring->producer, q->prod_tail);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/compiler.h:284:6: note: expanded from macro 'WRITE_ONCE'
        __u.__val;                                      \
        ~~~ ^~~~~
1 warning generated.

The q->prod_tail assignment has a comma at the end, not a semi-colon.
Fix that so clang no longer warns and everything works as expected.

Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support")
Link: https://github.com/ClangBuiltLinux/linux/issues/544
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk_queue.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 8a64b150be546..fe96c0d039f2f 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -239,7 +239,7 @@ static inline void xskq_produce_flush_desc(struct xsk_queue *q)
 	/* Order producer and data */
 	smp_wmb();
 
-	q->prod_tail = q->prod_head,
+	q->prod_tail = q->prod_head;
 	WRITE_ONCE(q->ring->producer, q->prod_tail);
 }
 
-- 
GitLab


From 8ba93c59441a368749337318e78c8c1db07677b9 Mon Sep 17 00:00:00 2001
From: Ferdinand Blomqvist <ferdinand.blomqvist@gmail.com>
Date: Thu, 20 Jun 2019 17:10:34 +0300
Subject: [PATCH 0896/1835] rslib: Fix decoding of shortened codes

[ Upstream commit 2034a42d1747fc1e1eeef2c6f1789c4d0762cb9c ]

The decoding of shortenend codes is broken. It only works as expected if
there are no erasures.

When decoding with erasures, Lambda (the error and erasure locator
polynomial) is initialized from the given erasure positions. The pad
parameter is not accounted for by the initialisation code, and hence
Lambda is initialized from incorrect erasure positions.

The fix is to adjust the erasure positions by the supplied pad.

Signed-off-by: Ferdinand Blomqvist <ferdinand.blomqvist@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190620141039.9874-3-ferdinand.blomqvist@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/reed_solomon/decode_rs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/reed_solomon/decode_rs.c b/lib/reed_solomon/decode_rs.c
index 1db74eb098d0e..3313bf944ff14 100644
--- a/lib/reed_solomon/decode_rs.c
+++ b/lib/reed_solomon/decode_rs.c
@@ -99,9 +99,9 @@
 	if (no_eras > 0) {
 		/* Init lambda to be the erasure locator polynomial */
 		lambda[1] = alpha_to[rs_modnn(rs,
-					      prim * (nn - 1 - eras_pos[0]))];
+					prim * (nn - 1 - (eras_pos[0] + pad)))];
 		for (i = 1; i < no_eras; i++) {
-			u = rs_modnn(rs, prim * (nn - 1 - eras_pos[i]));
+			u = rs_modnn(rs, prim * (nn - 1 - (eras_pos[i] + pad)));
 			for (j = i + 1; j > 0; j--) {
 				tmp = index_of[lambda[j - 1]];
 				if (tmp != nn) {
-- 
GitLab


From 0340c621eca84943c8a81b5c6e49cc88e0eedc38 Mon Sep 17 00:00:00 2001
From: Ferdinand Blomqvist <ferdinand.blomqvist@gmail.com>
Date: Thu, 20 Jun 2019 17:10:37 +0300
Subject: [PATCH 0897/1835] rslib: Fix handling of of caller provided syndrome

[ Upstream commit ef4d6a8556b637ad27c8c2a2cff1dda3da38e9a9 ]

Check if the syndrome provided by the caller is zero, and act
accordingly.

Signed-off-by: Ferdinand Blomqvist <ferdinand.blomqvist@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190620141039.9874-6-ferdinand.blomqvist@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/reed_solomon/decode_rs.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/reed_solomon/decode_rs.c b/lib/reed_solomon/decode_rs.c
index 3313bf944ff14..121beb2f09307 100644
--- a/lib/reed_solomon/decode_rs.c
+++ b/lib/reed_solomon/decode_rs.c
@@ -42,8 +42,18 @@
 	BUG_ON(pad < 0 || pad >= nn);
 
 	/* Does the caller provide the syndrome ? */
-	if (s != NULL)
-		goto decode;
+	if (s != NULL) {
+		for (i = 0; i < nroots; i++) {
+			/* The syndrome is in index form,
+			 * so nn represents zero
+			 */
+			if (s[i] != nn)
+				goto decode;
+		}
+
+		/* syndrome is zero, no errors to correct  */
+		return 0;
+	}
 
 	/* form the syndromes; i.e., evaluate data(x) at roots of
 	 * g(x) */
-- 
GitLab


From b346070c72cd0f154eb799a36cec2b2fdb5d5648 Mon Sep 17 00:00:00 2001
From: "Mauro S. M. Rodrigues" <maurosr@linux.vnet.ibm.com>
Date: Thu, 23 May 2019 16:11:12 -0300
Subject: [PATCH 0898/1835] ixgbe: Check DDM existence in transceiver before
 access

[ Upstream commit 655c91414579d7bb115a4f7898ee726fc18e0984 ]

Some transceivers may comply with SFF-8472 but not implement the Digital
Diagnostic Monitoring (DDM) interface described in it. The existence of
such area is specified by bit 6 of byte 92, set to 1 if implemented.

Currently, due to not checking this bit ixgbe fails trying to read SFP
module's eeprom with the follow message:

ethtool -m enP51p1s0f0
Cannot get Module EEPROM data: Input/output error

Because it fails to read the additional 256 bytes in which it was assumed
to exist the DDM data.

This issue was noticed using a Mellanox Passive DAC PN 01FT738. The eeprom
data was confirmed by Mellanox as correct and present in other Passive
DACs in from other manufacturers.

Signed-off-by: "Mauro S. M. Rodrigues" <maurosr@linux.vnet.ibm.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 3 ++-
 drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h     | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index e5a8461fe6a99..8829bd95d0d36 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -3223,7 +3223,8 @@ static int ixgbe_get_module_info(struct net_device *dev,
 		page_swap = true;
 	}
 
-	if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap) {
+	if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap ||
+	    !(addr_mode & IXGBE_SFF_DDM_IMPLEMENTED)) {
 		/* We have a SFP, but it does not support SFF-8472 */
 		modinfo->type = ETH_MODULE_SFF_8079;
 		modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index 64e44e01c973f..c56baad04ee61 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -45,6 +45,7 @@
 #define IXGBE_SFF_SOFT_RS_SELECT_10G		0x8
 #define IXGBE_SFF_SOFT_RS_SELECT_1G		0x0
 #define IXGBE_SFF_ADDRESSING_MODE		0x4
+#define IXGBE_SFF_DDM_IMPLEMENTED		0x40
 #define IXGBE_SFF_QSFP_DA_ACTIVE_CABLE		0x1
 #define IXGBE_SFF_QSFP_DA_PASSIVE_CABLE		0x8
 #define IXGBE_SFF_QSFP_CONNECTOR_NOT_SEPARABLE	0x23
-- 
GitLab


From 1dea395c9e129be2b33317940493dc77c3b75301 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 18 Jun 2019 13:19:42 +0200
Subject: [PATCH 0899/1835] crypto: serpent - mark __serpent_setkey_sbox
 noinline

[ Upstream commit 473971187d6727609951858c63bf12b0307ef015 ]

The same bug that gcc hit in the past is apparently now showing
up with clang, which decides to inline __serpent_setkey_sbox:

crypto/serpent_generic.c:268:5: error: stack frame size of 2112 bytes in function '__serpent_setkey' [-Werror,-Wframe-larger-than=]

Marking it 'noinline' reduces the stack usage from 2112 bytes to
192 and 96 bytes, respectively, and seems to generate more
useful object code.

Fixes: c871c10e4ea7 ("crypto: serpent - improve __serpent_setkey with UBSAN")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/serpent_generic.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crypto/serpent_generic.c b/crypto/serpent_generic.c
index 7c3382facc82e..600bd288881dd 100644
--- a/crypto/serpent_generic.c
+++ b/crypto/serpent_generic.c
@@ -229,7 +229,13 @@
 	x4 ^= x2;					\
 	})
 
-static void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2, u32 r3, u32 r4, u32 *k)
+/*
+ * both gcc and clang have misoptimized this function in the past,
+ * producing horrible object code from spilling temporary variables
+ * on the stack. Forcing this part out of line avoids that.
+ */
+static noinline void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2,
+					   u32 r3, u32 r4, u32 *k)
 {
 	k += 100;
 	S3(r3, r4, r0, r1, r2); store_and_load_keys(r1, r2, r4, r3, 28, 24);
-- 
GitLab


From 0388597d062717d22035a51d2ce15b0a2a79922d Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 18 Jun 2019 14:13:47 +0200
Subject: [PATCH 0900/1835] crypto: asymmetric_keys - select CRYPTO_HASH where
 needed

[ Upstream commit 90acc0653d2bee203174e66d519fbaaa513502de ]

Build testing with some core crypto options disabled revealed
a few modules that are missing CRYPTO_HASH:

crypto/asymmetric_keys/x509_public_key.o: In function `x509_get_sig_params':
x509_public_key.c:(.text+0x4c7): undefined reference to `crypto_alloc_shash'
x509_public_key.c:(.text+0x5e5): undefined reference to `crypto_shash_digest'
crypto/asymmetric_keys/pkcs7_verify.o: In function `pkcs7_digest.isra.0':
pkcs7_verify.c:(.text+0xab): undefined reference to `crypto_alloc_shash'
pkcs7_verify.c:(.text+0x1b2): undefined reference to `crypto_shash_digest'
pkcs7_verify.c:(.text+0x3c1): undefined reference to `crypto_shash_update'
pkcs7_verify.c:(.text+0x411): undefined reference to `crypto_shash_finup'

This normally doesn't show up in randconfig tests because there is
a large number of other options that select CRYPTO_HASH.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/asymmetric_keys/Kconfig | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index f3702e533ff41..d8a73d94bb309 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -15,6 +15,7 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
 	select MPILIB
 	select CRYPTO_HASH_INFO
 	select CRYPTO_AKCIPHER
+	select CRYPTO_HASH
 	help
 	  This option provides support for asymmetric public key type handling.
 	  If signature generation and/or verification are to be used,
@@ -34,6 +35,7 @@ config X509_CERTIFICATE_PARSER
 config PKCS7_MESSAGE_PARSER
 	tristate "PKCS#7 message parser"
 	depends on X509_CERTIFICATE_PARSER
+	select CRYPTO_HASH
 	select ASN1
 	select OID_REGISTRY
 	help
@@ -56,6 +58,7 @@ config SIGNED_PE_FILE_VERIFICATION
 	bool "Support for PE file signature verification"
 	depends on PKCS7_MESSAGE_PARSER=y
 	depends on SYSTEM_DATA_VERIFICATION
+	select CRYPTO_HASH
 	select ASN1
 	select OID_REGISTRY
 	help
-- 
GitLab


From e54cc89e6f0a4d818cf1ff168851543d6beeaee0 Mon Sep 17 00:00:00 2001
From: Ahmad Masri <amasri@codeaurora.org>
Date: Sun, 16 Jun 2019 10:26:07 +0300
Subject: [PATCH 0901/1835] wil6210: drop old event after wmi_call timeout

[ Upstream commit 1a276003111c0404f6bfeffe924c5a21f482428b ]

This change fixes a rare race condition of handling WMI events after
wmi_call expires.

wmi_recv_cmd immediately handles an event when reply_buf is defined and
a wmi_call is waiting for the event.
However, in case the wmi_call has already timed-out, there will be no
waiting/running wmi_call and the event will be queued in WMI queue and
will be handled later in wmi_event_handle.
Meanwhile, a new similar wmi_call for the same command and event may
be issued. In this case, when handling the queued event we got WARN_ON
printed.

Fixing this case as a valid timeout and drop the unexpected event.

Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wil6210/wmi.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 6e3b3031f29bd..2010f771478df 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -2816,7 +2816,18 @@ static void wmi_event_handle(struct wil6210_priv *wil,
 		/* check if someone waits for this event */
 		if (wil->reply_id && wil->reply_id == id &&
 		    wil->reply_mid == mid) {
-			WARN_ON(wil->reply_buf);
+			if (wil->reply_buf) {
+				/* event received while wmi_call is waiting
+				 * with a buffer. Such event should be handled
+				 * in wmi_recv_cmd function. Handling the event
+				 * here means a previous wmi_call was timeout.
+				 * Drop the event and do not handle it.
+				 */
+				wil_err(wil,
+					"Old event (%d, %s) while wmi_call is waiting. Drop it and Continue waiting\n",
+					id, eventid2name(id));
+				return;
+			}
 
 			wmi_evt_call_handler(vif, id, evt_data,
 					     len - sizeof(*wmi));
-- 
GitLab


From e78d1d2344693ddcd8a2d0a66242f5bf394d6d98 Mon Sep 17 00:00:00 2001
From: Eiichi Tsukata <devel@etsukata.com>
Date: Wed, 26 Jun 2019 14:40:11 +0900
Subject: [PATCH 0902/1835] EDAC: Fix global-out-of-bounds write when setting
 edac_mc_poll_msec

[ Upstream commit d8655e7630dafa88bc37f101640e39c736399771 ]

Commit 9da21b1509d8 ("EDAC: Poll timeout cannot be zero, p2") assumes
edac_mc_poll_msec to be unsigned long, but the type of the variable still
remained as int. Setting edac_mc_poll_msec can trigger out-of-bounds
write.

Reproducer:

  # echo 1001 > /sys/module/edac_core/parameters/edac_mc_poll_msec

KASAN report:

  BUG: KASAN: global-out-of-bounds in edac_set_poll_msec+0x140/0x150
  Write of size 8 at addr ffffffffb91b2d00 by task bash/1996

  CPU: 1 PID: 1996 Comm: bash Not tainted 5.2.0-rc6+ #23
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
  Call Trace:
   dump_stack+0xca/0x13e
   print_address_description.cold+0x5/0x246
   __kasan_report.cold+0x75/0x9a
   ? edac_set_poll_msec+0x140/0x150
   kasan_report+0xe/0x20
   edac_set_poll_msec+0x140/0x150
   ? dimmdev_location_show+0x30/0x30
   ? vfs_lock_file+0xe0/0xe0
   ? _raw_spin_lock+0x87/0xe0
   param_attr_store+0x1b5/0x310
   ? param_array_set+0x4f0/0x4f0
   module_attr_store+0x58/0x80
   ? module_attr_show+0x80/0x80
   sysfs_kf_write+0x13d/0x1a0
   kernfs_fop_write+0x2bc/0x460
   ? sysfs_kf_bin_read+0x270/0x270
   ? kernfs_notify+0x1f0/0x1f0
   __vfs_write+0x81/0x100
   vfs_write+0x1e1/0x560
   ksys_write+0x126/0x250
   ? __ia32_sys_read+0xb0/0xb0
   ? do_syscall_64+0x1f/0x390
   do_syscall_64+0xc1/0x390
   entry_SYSCALL_64_after_hwframe+0x49/0xbe
  RIP: 0033:0x7fa7caa5e970
  Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 04
  RSP: 002b:00007fff6acfdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
  RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa7caa5e970
  RDX: 0000000000000005 RSI: 0000000000e95c08 RDI: 0000000000000001
  RBP: 0000000000e95c08 R08: 00007fa7cad1e760 R09: 00007fa7cb36a700
  R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000005
  R13: 0000000000000001 R14: 00007fa7cad1d600 R15: 0000000000000005

  The buggy address belongs to the variable:
   edac_mc_poll_msec+0x0/0x40

  Memory state around the buggy address:
   ffffffffb91b2c00: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
   ffffffffb91b2c80: 00 00 00 00 fa fa fa fa 00 00 00 00 fa fa fa fa
  >ffffffffb91b2d00: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
                     ^
   ffffffffb91b2d80: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
   ffffffffb91b2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Fix it by changing the type of edac_mc_poll_msec to unsigned int.
The reason why this patch adopts unsigned int rather than unsigned long
is msecs_to_jiffies() assumes arg to be unsigned int. We can avoid
integer conversion bugs and unsigned int will be large enough for
edac_mc_poll_msec.

Reviewed-by: James Morse <james.morse@arm.com>
Fixes: 9da21b1509d8 ("EDAC: Poll timeout cannot be zero, p2")
Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/edac_mc_sysfs.c | 16 ++++++++--------
 drivers/edac/edac_module.h   |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index e50610b5bd067..d4545a9222a07 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -26,7 +26,7 @@
 static int edac_mc_log_ue = 1;
 static int edac_mc_log_ce = 1;
 static int edac_mc_panic_on_ue;
-static int edac_mc_poll_msec = 1000;
+static unsigned int edac_mc_poll_msec = 1000;
 
 /* Getter functions for above */
 int edac_mc_get_log_ue(void)
@@ -45,30 +45,30 @@ int edac_mc_get_panic_on_ue(void)
 }
 
 /* this is temporary */
-int edac_mc_get_poll_msec(void)
+unsigned int edac_mc_get_poll_msec(void)
 {
 	return edac_mc_poll_msec;
 }
 
 static int edac_set_poll_msec(const char *val, const struct kernel_param *kp)
 {
-	unsigned long l;
+	unsigned int i;
 	int ret;
 
 	if (!val)
 		return -EINVAL;
 
-	ret = kstrtoul(val, 0, &l);
+	ret = kstrtouint(val, 0, &i);
 	if (ret)
 		return ret;
 
-	if (l < 1000)
+	if (i < 1000)
 		return -EINVAL;
 
-	*((unsigned long *)kp->arg) = l;
+	*((unsigned int *)kp->arg) = i;
 
 	/* notify edac_mc engine to reset the poll period */
-	edac_mc_reset_delay_period(l);
+	edac_mc_reset_delay_period(i);
 
 	return 0;
 }
@@ -82,7 +82,7 @@ MODULE_PARM_DESC(edac_mc_log_ue,
 module_param(edac_mc_log_ce, int, 0644);
 MODULE_PARM_DESC(edac_mc_log_ce,
 		 "Log correctable error to console: 0=off 1=on");
-module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_int,
+module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_uint,
 		  &edac_mc_poll_msec, 0644);
 MODULE_PARM_DESC(edac_mc_poll_msec, "Polling period in milliseconds");
 
diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
index dec88dcea036f..c9f0e73872a64 100644
--- a/drivers/edac/edac_module.h
+++ b/drivers/edac/edac_module.h
@@ -36,7 +36,7 @@ extern int edac_mc_get_log_ue(void);
 extern int edac_mc_get_log_ce(void);
 extern int edac_mc_get_panic_on_ue(void);
 extern int edac_get_poll_msec(void);
-extern int edac_mc_get_poll_msec(void);
+extern unsigned int edac_mc_get_poll_msec(void);
 
 unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
 				 unsigned len);
-- 
GitLab


From 57cfb755c356a256daae7a78d6358f3d4f0d0e75 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:35 +0800
Subject: [PATCH 0903/1835] bcache: check CACHE_SET_IO_DISABLE in allocator
 code

[ Upstream commit e775339e1ae1205b47d94881db124c11385e597c ]

If CACHE_SET_IO_DISABLE of a cache set flag is set by too many I/O
errors, currently allocator routines can still continue allocate
space which may introduce inconsistent metadata state.

This patch checkes CACHE_SET_IO_DISABLE bit in following allocator
routines,
- bch_bucket_alloc()
- __bch_bucket_alloc_set()
Once CACHE_SET_IO_DISABLE is set on cache set, the allocator routines
may reject allocation request earlier to avoid potential inconsistent
metadata.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/alloc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index de85b3af3b39d..9c3beb1e382b9 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -393,6 +393,11 @@ long bch_bucket_alloc(struct cache *ca, unsigned int reserve, bool wait)
 	struct bucket *b;
 	long r;
 
+
+	/* No allocation if CACHE_SET_IO_DISABLE bit is set */
+	if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &ca->set->flags)))
+		return -1;
+
 	/* fastpath */
 	if (fifo_pop(&ca->free[RESERVE_NONE], r) ||
 	    fifo_pop(&ca->free[reserve], r))
@@ -484,6 +489,10 @@ int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
 {
 	int i;
 
+	/* No allocation if CACHE_SET_IO_DISABLE bit is set */
+	if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
+		return -1;
+
 	lockdep_assert_held(&c->bucket_lock);
 	BUG_ON(!n || n > c->caches_loaded || n > 8);
 
-- 
GitLab


From d81080a0bcf88e8a7d23736f74e24fd4529d7348 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:36 +0800
Subject: [PATCH 0904/1835] bcache: check CACHE_SET_IO_DISABLE bit in
 bch_journal()

[ Upstream commit 383ff2183ad16a8842d1fbd9dd3e1cbd66813e64 ]

When too many I/O errors happen on cache set and CACHE_SET_IO_DISABLE
bit is set, bch_journal() may continue to work because the journaling
bkey might be still in write set yet. The caller of bch_journal() may
believe the journal still work but the truth is in-memory journal write
set won't be written into cache device any more. This behavior may
introduce potential inconsistent metadata status.

This patch checks CACHE_SET_IO_DISABLE bit at the head of bch_journal(),
if the bit is set, bch_journal() returns NULL immediately to notice
caller to know journal does not work.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/journal.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index f880e5eba8dd9..8d4d63b515533 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -810,6 +810,10 @@ atomic_t *bch_journal(struct cache_set *c,
 	struct journal_write *w;
 	atomic_t *ret;
 
+	/* No journaling if CACHE_SET_IO_DISABLE set already */
+	if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
+		return NULL;
+
 	if (!CACHE_SYNC(&c->sb))
 		return NULL;
 
-- 
GitLab


From 81b88c05bc4599d63cea63b106bf5225732db017 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:48 +0800
Subject: [PATCH 0905/1835] bcache: acquire bch_register_lock later in
 cached_dev_free()

[ Upstream commit 80265d8dfd77792e133793cef44a21323aac2908 ]

When enable lockdep engine, a lockdep warning can be observed when
reboot or shutdown system,

[ 3142.764557][    T1] bcache: bcache_reboot() Stopping all devices:
[ 3142.776265][ T2649]
[ 3142.777159][ T2649] ======================================================
[ 3142.780039][ T2649] WARNING: possible circular locking dependency detected
[ 3142.782869][ T2649] 5.2.0-rc4-lp151.20-default+ #1 Tainted: G        W
[ 3142.785684][ T2649] ------------------------------------------------------
[ 3142.788479][ T2649] kworker/3:67/2649 is trying to acquire lock:
[ 3142.790738][ T2649] 00000000aaf02291 ((wq_completion)bcache_writeback_wq){+.+.}, at: flush_workqueue+0x87/0x4c0
[ 3142.794678][ T2649]
[ 3142.794678][ T2649] but task is already holding lock:
[ 3142.797402][ T2649] 000000004fcf89c5 (&bch_register_lock){+.+.}, at: cached_dev_free+0x17/0x120 [bcache]
[ 3142.801462][ T2649]
[ 3142.801462][ T2649] which lock already depends on the new lock.
[ 3142.801462][ T2649]
[ 3142.805277][ T2649]
[ 3142.805277][ T2649] the existing dependency chain (in reverse order) is:
[ 3142.808902][ T2649]
[ 3142.808902][ T2649] -> #2 (&bch_register_lock){+.+.}:
[ 3142.812396][ T2649]        __mutex_lock+0x7a/0x9d0
[ 3142.814184][ T2649]        cached_dev_free+0x17/0x120 [bcache]
[ 3142.816415][ T2649]        process_one_work+0x2a4/0x640
[ 3142.818413][ T2649]        worker_thread+0x39/0x3f0
[ 3142.820276][ T2649]        kthread+0x125/0x140
[ 3142.822061][ T2649]        ret_from_fork+0x3a/0x50
[ 3142.823965][ T2649]
[ 3142.823965][ T2649] -> #1 ((work_completion)(&cl->work)#2){+.+.}:
[ 3142.827244][ T2649]        process_one_work+0x277/0x640
[ 3142.829160][ T2649]        worker_thread+0x39/0x3f0
[ 3142.830958][ T2649]        kthread+0x125/0x140
[ 3142.832674][ T2649]        ret_from_fork+0x3a/0x50
[ 3142.834915][ T2649]
[ 3142.834915][ T2649] -> #0 ((wq_completion)bcache_writeback_wq){+.+.}:
[ 3142.838121][ T2649]        lock_acquire+0xb4/0x1c0
[ 3142.840025][ T2649]        flush_workqueue+0xae/0x4c0
[ 3142.842035][ T2649]        drain_workqueue+0xa9/0x180
[ 3142.844042][ T2649]        destroy_workqueue+0x17/0x250
[ 3142.846142][ T2649]        cached_dev_free+0x52/0x120 [bcache]
[ 3142.848530][ T2649]        process_one_work+0x2a4/0x640
[ 3142.850663][ T2649]        worker_thread+0x39/0x3f0
[ 3142.852464][ T2649]        kthread+0x125/0x140
[ 3142.854106][ T2649]        ret_from_fork+0x3a/0x50
[ 3142.855880][ T2649]
[ 3142.855880][ T2649] other info that might help us debug this:
[ 3142.855880][ T2649]
[ 3142.859663][ T2649] Chain exists of:
[ 3142.859663][ T2649]   (wq_completion)bcache_writeback_wq --> (work_completion)(&cl->work)#2 --> &bch_register_lock
[ 3142.859663][ T2649]
[ 3142.865424][ T2649]  Possible unsafe locking scenario:
[ 3142.865424][ T2649]
[ 3142.868022][ T2649]        CPU0                    CPU1
[ 3142.869885][ T2649]        ----                    ----
[ 3142.871751][ T2649]   lock(&bch_register_lock);
[ 3142.873379][ T2649]                                lock((work_completion)(&cl->work)#2);
[ 3142.876399][ T2649]                                lock(&bch_register_lock);
[ 3142.879727][ T2649]   lock((wq_completion)bcache_writeback_wq);
[ 3142.882064][ T2649]
[ 3142.882064][ T2649]  *** DEADLOCK ***
[ 3142.882064][ T2649]
[ 3142.885060][ T2649] 3 locks held by kworker/3:67/2649:
[ 3142.887245][ T2649]  #0: 00000000e774cdd0 ((wq_completion)events){+.+.}, at: process_one_work+0x21e/0x640
[ 3142.890815][ T2649]  #1: 00000000f7df89da ((work_completion)(&cl->work)#2){+.+.}, at: process_one_work+0x21e/0x640
[ 3142.894884][ T2649]  #2: 000000004fcf89c5 (&bch_register_lock){+.+.}, at: cached_dev_free+0x17/0x120 [bcache]
[ 3142.898797][ T2649]
[ 3142.898797][ T2649] stack backtrace:
[ 3142.900961][ T2649] CPU: 3 PID: 2649 Comm: kworker/3:67 Tainted: G        W         5.2.0-rc4-lp151.20-default+ #1
[ 3142.904789][ T2649] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
[ 3142.909168][ T2649] Workqueue: events cached_dev_free [bcache]
[ 3142.911422][ T2649] Call Trace:
[ 3142.912656][ T2649]  dump_stack+0x85/0xcb
[ 3142.914181][ T2649]  print_circular_bug+0x19a/0x1f0
[ 3142.916193][ T2649]  __lock_acquire+0x16cd/0x1850
[ 3142.917936][ T2649]  ? __lock_acquire+0x6a8/0x1850
[ 3142.919704][ T2649]  ? lock_acquire+0xb4/0x1c0
[ 3142.921335][ T2649]  ? find_held_lock+0x34/0xa0
[ 3142.923052][ T2649]  lock_acquire+0xb4/0x1c0
[ 3142.924635][ T2649]  ? flush_workqueue+0x87/0x4c0
[ 3142.926375][ T2649]  flush_workqueue+0xae/0x4c0
[ 3142.928047][ T2649]  ? flush_workqueue+0x87/0x4c0
[ 3142.929824][ T2649]  ? drain_workqueue+0xa9/0x180
[ 3142.931686][ T2649]  drain_workqueue+0xa9/0x180
[ 3142.933534][ T2649]  destroy_workqueue+0x17/0x250
[ 3142.935787][ T2649]  cached_dev_free+0x52/0x120 [bcache]
[ 3142.937795][ T2649]  process_one_work+0x2a4/0x640
[ 3142.939803][ T2649]  worker_thread+0x39/0x3f0
[ 3142.941487][ T2649]  ? process_one_work+0x640/0x640
[ 3142.943389][ T2649]  kthread+0x125/0x140
[ 3142.944894][ T2649]  ? kthread_create_worker_on_cpu+0x70/0x70
[ 3142.947744][ T2649]  ret_from_fork+0x3a/0x50
[ 3142.970358][ T2649] bcache: bcache_device_free() bcache0 stopped

Here is how the deadlock happens.
1) bcache_reboot() calls bcache_device_stop(), then inside
   bcache_device_stop() BCACHE_DEV_CLOSING bit is set on d->flags.
   Then closure_queue(&d->cl) is called to invoke cached_dev_flush().
2) In cached_dev_flush(), cached_dev_free() is called by continu_at().
3) In cached_dev_free(), when stopping the writeback kthread of the
   cached device by kthread_stop(), dc->writeback_thread will be waken
   up to quite the kthread while-loop, then cached_dev_put() is called
   in bch_writeback_thread().
4) Calling cached_dev_put() in writeback kthread may drop dc->count to
   0, then dc->detach kworker is scheduled, which is initialized as
   cached_dev_detach_finish().
5) Inside cached_dev_detach_finish(), the last line of code is to call
   closure_put(&dc->disk.cl), which drops the last reference counter of
   closrure dc->disk.cl, then the callback cached_dev_flush() gets
   called.
Now cached_dev_flush() is called for second time in the code path, the
first time is in step 2). And again bch_register_lock will be acquired
again, and a A-A lock (lockdep terminology) is happening.

The root cause of the above A-A lock is in cached_dev_free(), mutex
bch_register_lock is held before stopping writeback kthread and other
kworkers. Fortunately now we have variable 'bcache_is_reboot', which may
prevent device registration or unregistration during reboot/shutdown
time, so it is unncessary to hold bch_register_lock such early now.

This is how this patch fixes the reboot/shutdown time A-A lock issue:
After moving mutex_lock(&bch_register_lock) to a later location where
before atomic_read(&dc->running) in cached_dev_free(), such A-A lock
problem can be solved without any reboot time registration race.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 2409507d7bff8..ca39cf20aa96d 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1180,8 +1180,6 @@ static void cached_dev_free(struct closure *cl)
 {
 	struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
 
-	mutex_lock(&bch_register_lock);
-
 	if (test_and_clear_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags))
 		cancel_writeback_rate_update_dwork(dc);
 
@@ -1192,6 +1190,8 @@ static void cached_dev_free(struct closure *cl)
 	if (!IS_ERR_OR_NULL(dc->status_update_thread))
 		kthread_stop(dc->status_update_thread);
 
+	mutex_lock(&bch_register_lock);
+
 	if (atomic_read(&dc->running))
 		bd_unlink_disk_holder(dc->bdev, dc->disk.disk);
 	bcache_device_free(&dc->disk);
-- 
GitLab


From 4b7758e9c4ed4d13f1472a91e4e9162d12aad109 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:25 +0800
Subject: [PATCH 0906/1835] bcache: check c->gc_thread by IS_ERR_OR_NULL in
 cache_set_flush()

[ Upstream commit b387e9b58679c60f5b1e4313939bd4878204fc37 ]

When system memory is in heavy pressure, bch_gc_thread_start() from
run_cache_set() may fail due to out of memory. In such condition,
c->gc_thread is assigned to -ENOMEM, not NULL pointer. Then in following
failure code path bch_cache_set_error(), when cache_set_flush() gets
called, the code piece to stop c->gc_thread is broken,
         if (!IS_ERR_OR_NULL(c->gc_thread))
                 kthread_stop(c->gc_thread);

And KASAN catches such NULL pointer deference problem, with the warning
information:

[  561.207881] ==================================================================
[  561.207900] BUG: KASAN: null-ptr-deref in kthread_stop+0x3b/0x440
[  561.207904] Write of size 4 at addr 000000000000001c by task kworker/15:1/313

[  561.207913] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G        W         5.0.0-vanilla+ #3
[  561.207916] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019
[  561.207935] Workqueue: events cache_set_flush [bcache]
[  561.207940] Call Trace:
[  561.207948]  dump_stack+0x9a/0xeb
[  561.207955]  ? kthread_stop+0x3b/0x440
[  561.207960]  ? kthread_stop+0x3b/0x440
[  561.207965]  kasan_report+0x176/0x192
[  561.207973]  ? kthread_stop+0x3b/0x440
[  561.207981]  kthread_stop+0x3b/0x440
[  561.207995]  cache_set_flush+0xd4/0x6d0 [bcache]
[  561.208008]  process_one_work+0x856/0x1620
[  561.208015]  ? find_held_lock+0x39/0x1d0
[  561.208028]  ? drain_workqueue+0x380/0x380
[  561.208048]  worker_thread+0x87/0xb80
[  561.208058]  ? __kthread_parkme+0xb6/0x180
[  561.208067]  ? process_one_work+0x1620/0x1620
[  561.208072]  kthread+0x326/0x3e0
[  561.208079]  ? kthread_create_worker_on_cpu+0xc0/0xc0
[  561.208090]  ret_from_fork+0x3a/0x50
[  561.208110] ==================================================================
[  561.208113] Disabling lock debugging due to kernel taint
[  561.208115] irq event stamp: 11800231
[  561.208126] hardirqs last  enabled at (11800231): [<ffffffff83008538>] do_syscall_64+0x18/0x410
[  561.208127] BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
[  561.208129] #PF error: [WRITE]
[  561.312253] hardirqs last disabled at (11800230): [<ffffffff830052ff>] trace_hardirqs_off_thunk+0x1a/0x1c
[  561.312259] softirqs last  enabled at (11799832): [<ffffffff850005c7>] __do_softirq+0x5c7/0x8c3
[  561.405975] PGD 0 P4D 0
[  561.442494] softirqs last disabled at (11799821): [<ffffffff831add2c>] irq_exit+0x1ac/0x1e0
[  561.791359] Oops: 0002 [#1] SMP KASAN NOPTI
[  561.791362] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G    B   W         5.0.0-vanilla+ #3
[  561.791363] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019
[  561.791371] Workqueue: events cache_set_flush [bcache]
[  561.791374] RIP: 0010:kthread_stop+0x3b/0x440
[  561.791376] Code: 00 00 65 8b 05 26 d5 e0 7c 89 c0 48 0f a3 05 ec aa df 02 0f 82 dc 02 00 00 4c 8d 63 20 be 04 00 00 00 4c 89 e7 e8 65 c5 53 00 <f0> ff 43 20 48 8d 7b 24 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48
[  561.791377] RSP: 0018:ffff88872fc8fd10 EFLAGS: 00010286
[  561.838895] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  561.838916] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  561.838934] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  561.838948] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  561.838966] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  561.838979] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  561.838996] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  563.067028] RAX: 0000000000000000 RBX: fffffffffffffffc RCX: ffffffff832dd314
[  563.067030] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000297
[  563.067032] RBP: ffff88872fc8fe88 R08: fffffbfff0b8213d R09: fffffbfff0b8213d
[  563.067034] R10: 0000000000000001 R11: fffffbfff0b8213c R12: 000000000000001c
[  563.408618] R13: ffff88dc61cc0f68 R14: ffff888102b94900 R15: ffff88dc61cc0f68
[  563.408620] FS:  0000000000000000(0000) GS:ffff888f7dc00000(0000) knlGS:0000000000000000
[  563.408622] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  563.408623] CR2: 000000000000001c CR3: 0000000f48a1a004 CR4: 00000000007606e0
[  563.408625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  563.408627] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  563.904795] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  563.915796] PKRU: 55555554
[  563.915797] Call Trace:
[  563.915807]  cache_set_flush+0xd4/0x6d0 [bcache]
[  563.915812]  process_one_work+0x856/0x1620
[  564.001226] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  564.033563]  ? find_held_lock+0x39/0x1d0
[  564.033567]  ? drain_workqueue+0x380/0x380
[  564.033574]  worker_thread+0x87/0xb80
[  564.062823] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  564.118042]  ? __kthread_parkme+0xb6/0x180
[  564.118046]  ? process_one_work+0x1620/0x1620
[  564.118048]  kthread+0x326/0x3e0
[  564.118050]  ? kthread_create_worker_on_cpu+0xc0/0xc0
[  564.167066] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  564.252441]  ret_from_fork+0x3a/0x50
[  564.252447] Modules linked in: msr rpcrdma sunrpc rdma_ucm ib_iser ib_umad rdma_cm ib_ipoib i40iw configfs iw_cm ib_cm libiscsi scsi_transport_iscsi mlx4_ib ib_uverbs mlx4_en ib_core nls_iso8859_1 nls_cp437 vfat fat intel_rapl skx_edac x86_pkg_temp_thermal coretemp iTCO_wdt iTCO_vendor_support crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel ses raid0 aesni_intel cdc_ether enclosure usbnet ipmi_ssif joydev aes_x86_64 i40e scsi_transport_sas mii bcache md_mod crypto_simd mei_me ioatdma crc64 ptp cryptd pcspkr i2c_i801 mlx4_core glue_helper pps_core mei lpc_ich dca wmi ipmi_si ipmi_devintf nd_pmem dax_pmem nd_btt ipmi_msghandler device_dax pcc_cpufreq button hid_generic usbhid mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect xhci_pci sysimgblt fb_sys_fops xhci_hcd ttm megaraid_sas drm usbcore nfit libnvdimm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs
[  564.299390] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
[  564.348360] CR2: 000000000000001c
[  564.348362] ---[ end trace b7f0e5cc7b2103b0 ]---

Therefore, it is not enough to only check whether c->gc_thread is NULL,
we should use IS_ERR_OR_NULL() to check both NULL pointer and error
value.

This patch changes the above buggy code piece in this way,
         if (!IS_ERR_OR_NULL(c->gc_thread))
                 kthread_stop(c->gc_thread);

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index ca39cf20aa96d..be8054c04eb77 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1552,7 +1552,7 @@ static void cache_set_flush(struct closure *cl)
 	kobject_put(&c->internal);
 	kobject_del(&c->kobj);
 
-	if (c->gc_thread)
+	if (!IS_ERR_OR_NULL(c->gc_thread))
 		kthread_stop(c->gc_thread);
 
 	if (!IS_ERR_OR_NULL(c->root))
-- 
GitLab


From 95d0848094958332f9792653f509857f5d9c7538 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:49 +0800
Subject: [PATCH 0907/1835] bcache: fix potential deadlock in cached_def_free()

[ Upstream commit 7e865eba00a3df2dc8c4746173a8ca1c1c7f042e ]

When enable lockdep and reboot system with a writeback mode bcache
device, the following potential deadlock warning is reported by lockdep
engine.

[  101.536569][  T401] kworker/2:2/401 is trying to acquire lock:
[  101.538575][  T401] 00000000bbf6e6c7 ((wq_completion)bcache_writeback_wq){+.+.}, at: flush_workqueue+0x87/0x4c0
[  101.542054][  T401]
[  101.542054][  T401] but task is already holding lock:
[  101.544587][  T401] 00000000f5f305b3 ((work_completion)(&cl->work)#2){+.+.}, at: process_one_work+0x21e/0x640
[  101.548386][  T401]
[  101.548386][  T401] which lock already depends on the new lock.
[  101.548386][  T401]
[  101.551874][  T401]
[  101.551874][  T401] the existing dependency chain (in reverse order) is:
[  101.555000][  T401]
[  101.555000][  T401] -> #1 ((work_completion)(&cl->work)#2){+.+.}:
[  101.557860][  T401]        process_one_work+0x277/0x640
[  101.559661][  T401]        worker_thread+0x39/0x3f0
[  101.561340][  T401]        kthread+0x125/0x140
[  101.562963][  T401]        ret_from_fork+0x3a/0x50
[  101.564718][  T401]
[  101.564718][  T401] -> #0 ((wq_completion)bcache_writeback_wq){+.+.}:
[  101.567701][  T401]        lock_acquire+0xb4/0x1c0
[  101.569651][  T401]        flush_workqueue+0xae/0x4c0
[  101.571494][  T401]        drain_workqueue+0xa9/0x180
[  101.573234][  T401]        destroy_workqueue+0x17/0x250
[  101.575109][  T401]        cached_dev_free+0x44/0x120 [bcache]
[  101.577304][  T401]        process_one_work+0x2a4/0x640
[  101.579357][  T401]        worker_thread+0x39/0x3f0
[  101.581055][  T401]        kthread+0x125/0x140
[  101.582709][  T401]        ret_from_fork+0x3a/0x50
[  101.584592][  T401]
[  101.584592][  T401] other info that might help us debug this:
[  101.584592][  T401]
[  101.588355][  T401]  Possible unsafe locking scenario:
[  101.588355][  T401]
[  101.590974][  T401]        CPU0                    CPU1
[  101.592889][  T401]        ----                    ----
[  101.594743][  T401]   lock((work_completion)(&cl->work)#2);
[  101.596785][  T401]                                lock((wq_completion)bcache_writeback_wq);
[  101.600072][  T401]                                lock((work_completion)(&cl->work)#2);
[  101.602971][  T401]   lock((wq_completion)bcache_writeback_wq);
[  101.605255][  T401]
[  101.605255][  T401]  *** DEADLOCK ***
[  101.605255][  T401]
[  101.608310][  T401] 2 locks held by kworker/2:2/401:
[  101.610208][  T401]  #0: 00000000cf2c7d17 ((wq_completion)events){+.+.}, at: process_one_work+0x21e/0x640
[  101.613709][  T401]  #1: 00000000f5f305b3 ((work_completion)(&cl->work)#2){+.+.}, at: process_one_work+0x21e/0x640
[  101.617480][  T401]
[  101.617480][  T401] stack backtrace:
[  101.619539][  T401] CPU: 2 PID: 401 Comm: kworker/2:2 Tainted: G        W         5.2.0-rc4-lp151.20-default+ #1
[  101.623225][  T401] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
[  101.627210][  T401] Workqueue: events cached_dev_free [bcache]
[  101.629239][  T401] Call Trace:
[  101.630360][  T401]  dump_stack+0x85/0xcb
[  101.631777][  T401]  print_circular_bug+0x19a/0x1f0
[  101.633485][  T401]  __lock_acquire+0x16cd/0x1850
[  101.635184][  T401]  ? __lock_acquire+0x6a8/0x1850
[  101.636863][  T401]  ? lock_acquire+0xb4/0x1c0
[  101.638421][  T401]  ? find_held_lock+0x34/0xa0
[  101.640015][  T401]  lock_acquire+0xb4/0x1c0
[  101.641513][  T401]  ? flush_workqueue+0x87/0x4c0
[  101.643248][  T401]  flush_workqueue+0xae/0x4c0
[  101.644832][  T401]  ? flush_workqueue+0x87/0x4c0
[  101.646476][  T401]  ? drain_workqueue+0xa9/0x180
[  101.648303][  T401]  drain_workqueue+0xa9/0x180
[  101.649867][  T401]  destroy_workqueue+0x17/0x250
[  101.651503][  T401]  cached_dev_free+0x44/0x120 [bcache]
[  101.653328][  T401]  process_one_work+0x2a4/0x640
[  101.655029][  T401]  worker_thread+0x39/0x3f0
[  101.656693][  T401]  ? process_one_work+0x640/0x640
[  101.658501][  T401]  kthread+0x125/0x140
[  101.660012][  T401]  ? kthread_create_worker_on_cpu+0x70/0x70
[  101.661985][  T401]  ret_from_fork+0x3a/0x50
[  101.691318][  T401] bcache: bcache_device_free() bcache0 stopped

Here is how the above potential deadlock may happen in reboot/shutdown
code path,
1) bcache_reboot() is called firstly in the reboot/shutdown code path,
   then in bcache_reboot(), bcache_device_stop() is called.
2) bcache_device_stop() sets BCACHE_DEV_CLOSING on d->falgs, then call
   closure_queue(&d->cl) to invoke cached_dev_flush(). And in turn
   cached_dev_flush() calls cached_dev_free() via closure_at()
3) In cached_dev_free(), after stopped writebach kthread
   dc->writeback_thread, the kwork dc->writeback_write_wq is stopping by
   destroy_workqueue().
4) Inside destroy_workqueue(), drain_workqueue() is called. Inside
   drain_workqueue(), flush_workqueue() is called. Then wq->lockdep_map
   is acquired by lock_map_acquire() in flush_workqueue(). After the
   lock acquired the rest part of flush_workqueue() just wait for the
   workqueue to complete.
5) Now we look back at writeback thread routine bch_writeback_thread(),
   in the main while-loop, write_dirty() is called via continue_at() in
   read_dirty_submit(), which is called via continue_at() in while-loop
   level called function read_dirty(). Inside write_dirty() it may be
   re-called on workqueeu dc->writeback_write_wq via continue_at().
   It means when the writeback kthread is stopped in cached_dev_free()
   there might be still one kworker queued on dc->writeback_write_wq
   to execute write_dirty() again.
6) Now this kworker is scheduled on dc->writeback_write_wq to run by
   process_one_work() (which is called by worker_thread()). Before
   calling the kwork routine, wq->lockdep_map is acquired.
7) But wq->lockdep_map is acquired already in step 4), so a A-A lock
   (lockdep terminology) scenario happens.

Indeed on multiple cores syatem, the above deadlock is very rare to
happen, just as the code comments in process_one_work() says,
2263     * AFAICT there is no possible deadlock scenario between the
2264     * flush_work() and complete() primitives (except for
	   single-threaded
2265     * workqueues), so hiding them isn't a problem.

But it is still good to fix such lockdep warning, even no one running
bcache on single core system.

The fix is simple. This patch solves the above potential deadlock by,
- Do not destroy workqueue dc->writeback_write_wq in cached_dev_free().
- Flush and destroy dc->writeback_write_wq in writebach kthread routine
  bch_writeback_thread(), where after quit the thread main while-loop
  and before cached_dev_put() is called.

By this fix, dc->writeback_write_wq will be stopped and destroy before
the writeback kthread stopped, so the chance for a A-A locking on
wq->lockdep_map is disappeared, such A-A deadlock won't happen
any more.

Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/super.c     | 2 --
 drivers/md/bcache/writeback.c | 4 ++++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index be8054c04eb77..173a2be72eeba 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1185,8 +1185,6 @@ static void cached_dev_free(struct closure *cl)
 
 	if (!IS_ERR_OR_NULL(dc->writeback_thread))
 		kthread_stop(dc->writeback_thread);
-	if (dc->writeback_write_wq)
-		destroy_workqueue(dc->writeback_write_wq);
 	if (!IS_ERR_OR_NULL(dc->status_update_thread))
 		kthread_stop(dc->status_update_thread);
 
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 08c3a9f9676c9..6e72bb6c00f26 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -708,6 +708,10 @@ static int bch_writeback_thread(void *arg)
 		}
 	}
 
+	if (dc->writeback_write_wq) {
+		flush_workqueue(dc->writeback_write_wq);
+		destroy_workqueue(dc->writeback_write_wq);
+	}
 	cached_dev_put(dc);
 	wait_for_kthread_stop();
 
-- 
GitLab


From ddfdbcccd71a2e0c7594b36cfc080fa7f551debf Mon Sep 17 00:00:00 2001
From: Yonglong Liu <liuyonglong@huawei.com>
Date: Fri, 28 Jun 2019 19:50:11 +0800
Subject: [PATCH 0908/1835] net: hns3: fix a -Wformat-nonliteral compile
 warning

[ Upstream commit 18d219b783da61a6cc77581f55fc4af2fa16bc36 ]

When setting -Wformat=2, there is a compiler warning like this:

hclge_main.c:xxx:x: warning: format not a string literal and no
format arguments [-Wformat-nonliteral]
strs[i].desc);
^~~~

This patch adds missing format parameter "%s" to snprintf() to
fix it.

Fixes: 46a3df9f9718 ("Add HNS3 Acceleration Engine & Compatibility Layer Support")
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 4648c6a9d9e86..89ca69fa2b97b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -663,8 +663,7 @@ static u8 *hclge_comm_get_strings(u32 stringset,
 		return buff;
 
 	for (i = 0; i < size; i++) {
-		snprintf(buff, ETH_GSTRING_LEN,
-			 strs[i].desc);
+		snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc);
 		buff = buff + ETH_GSTRING_LEN;
 	}
 
-- 
GitLab


From 26d86b29e806769adba91bd6fc1f077b94e9b64b Mon Sep 17 00:00:00 2001
From: Yunsheng Lin <linyunsheng@huawei.com>
Date: Fri, 28 Jun 2019 19:50:10 +0800
Subject: [PATCH 0909/1835] net: hns3: add some error checking in hclge_tm
 module

[ Upstream commit 04f25edb48c441fc278ecc154c270f16966cbb90 ]

When hdev->tx_sch_mode is HCLGE_FLAG_VNET_BASE_SCH_MODE, the
hclge_tm_schd_mode_vnet_base_cfg calls hclge_tm_pri_schd_mode_cfg
with vport->vport_id as pri_id, which is used as index for
hdev->tm_info.tc_info, it will cause out of bound access issue
if vport_id is equal to or larger than HNAE3_MAX_TC.

Also hardware only support maximum speed of HCLGE_ETHER_MAX_RATE.

So this patch adds two checks for above cases.

Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 48235dc2dd56f..11e9259ca0407 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -54,7 +54,8 @@ static int hclge_shaper_para_calc(u32 ir, u8 shaper_level,
 	u32 tick;
 
 	/* Calc tick */
-	if (shaper_level >= HCLGE_SHAPER_LVL_CNT)
+	if (shaper_level >= HCLGE_SHAPER_LVL_CNT ||
+	    ir > HCLGE_ETHER_MAX_RATE)
 		return -EINVAL;
 
 	tick = tick_array[shaper_level];
@@ -1057,6 +1058,9 @@ static int hclge_tm_schd_mode_vnet_base_cfg(struct hclge_vport *vport)
 	int ret;
 	u8 i;
 
+	if (vport->vport_id >= HNAE3_MAX_TC)
+		return -EINVAL;
+
 	ret = hclge_tm_pri_schd_mode_cfg(hdev, vport->vport_id);
 	if (ret)
 		return ret;
-- 
GitLab


From 05592b9b7f256ee36936a9012c6fcb51850468d8 Mon Sep 17 00:00:00 2001
From: Wen Gong <wgong@codeaurora.org>
Date: Thu, 27 Jun 2019 21:21:51 +0300
Subject: [PATCH 0910/1835] ath10k: destroy sdio workqueue while remove sdio
 module

[ Upstream commit 3ed39f8e747a7aafeec07bb244f2c3a1bdca5730 ]

The workqueue need to flush and destory while remove sdio module,
otherwise it will have thread which is not destory after remove
sdio modules.

Tested with QCA6174 SDIO with firmware
WLAN.RMH.4.4.1-00007-QCARMSWP-1.

Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/sdio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
index cb527a21f1ace..686759b5613f2 100644
--- a/drivers/net/wireless/ath/ath10k/sdio.c
+++ b/drivers/net/wireless/ath/ath10k/sdio.c
@@ -2073,6 +2073,9 @@ static void ath10k_sdio_remove(struct sdio_func *func)
 	cancel_work_sync(&ar_sdio->wr_async_work);
 	ath10k_core_unregister(ar);
 	ath10k_core_destroy(ar);
+
+	flush_workqueue(ar_sdio->workqueue);
+	destroy_workqueue(ar_sdio->workqueue);
 }
 
 static const struct sdio_device_id ath10k_sdio_devices[] = {
-- 
GitLab


From 0024b12b776c2d0939670fb5c6a81416c09f601c Mon Sep 17 00:00:00 2001
From: Maxime Chevallier <maxime.chevallier@bootlin.com>
Date: Thu, 20 Jun 2019 11:42:45 +0200
Subject: [PATCH 0911/1835] net: mvpp2: prs: Don't override the sign bit in
 SRAM parser shift

[ Upstream commit 8ec3ede559956f8ad58db7b57d25ac724bab69e9 ]

The Header Parser allows identifying various fields in the packet
headers, used for various kind of filtering and classification
steps.

This is a re-entrant process, where the offset in the packet header
depends on the previous lookup results. This offset is represented in
the SRAM results of the TCAM, as a shift to be operated.

This shift can be negative in some cases, such as in IPv6 parsing.

This commit prevents overriding the sign bit when setting the shift
value, which could cause instabilities when parsing IPv6 flows.

Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
Suggested-by: Alan Winkowski <walan@marvell.com>
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
index ae2240074d8ef..5692c6087bbb0 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
@@ -312,7 +312,8 @@ static void mvpp2_prs_sram_shift_set(struct mvpp2_prs_entry *pe, int shift,
 	}
 
 	/* Set value */
-	pe->sram[MVPP2_BIT_TO_WORD(MVPP2_PRS_SRAM_SHIFT_OFFS)] = shift & MVPP2_PRS_SRAM_SHIFT_MASK;
+	pe->sram[MVPP2_BIT_TO_WORD(MVPP2_PRS_SRAM_SHIFT_OFFS)] |=
+		shift & MVPP2_PRS_SRAM_SHIFT_MASK;
 
 	/* Reset and set operation */
 	mvpp2_prs_sram_bits_clear(pe, MVPP2_PRS_SRAM_OP_SEL_SHIFT_OFFS,
-- 
GitLab


From 036184af23e07272482e224d5c4643c80760d78f Mon Sep 17 00:00:00 2001
From: Vedang Patel <vedang.patel@intel.com>
Date: Tue, 25 Jun 2019 15:07:12 -0700
Subject: [PATCH 0912/1835] igb: clear out skb->tstamp after reading the txtime

[ Upstream commit 1e08511d5d01884a3c9070afd52a47799312074a ]

If a packet which is utilizing the launchtime feature (via SO_TXTIME socket
option) also requests the hardware transmit timestamp, the hardware
timestamp is not delivered to the userspace. This is because the value in
skb->tstamp is mistaken as the software timestamp.

Applications, like ptp4l, request a hardware timestamp by setting the
SOF_TIMESTAMPING_TX_HARDWARE socket option. Whenever a new timestamp is
detected by the driver (this work is done in igb_ptp_tx_work() which calls
igb_ptp_tx_hwtstamps() in igb_ptp.c[1]), it will queue the timestamp in the
ERR_QUEUE for the userspace to read. When the userspace is ready, it will
issue a recvmsg() call to collect this timestamp.  The problem is in this
recvmsg() call. If the skb->tstamp is not cleared out, it will be
interpreted as a software timestamp and the hardware tx timestamp will not
be successfully sent to the userspace. Look at skb_is_swtx_tstamp() and the
callee function __sock_recv_timestamp() in net/socket.c for more details.

Signed-off-by: Vedang Patel <vedang.patel@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 5aa083d9a6c9a..ab76a5f77cd0e 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5703,6 +5703,7 @@ static void igb_tx_ctxtdesc(struct igb_ring *tx_ring,
 	 */
 	if (tx_ring->launchtime_enable) {
 		ts = ns_to_timespec64(first->skb->tstamp);
+		first->skb->tstamp = 0;
 		context_desc->seqnum_seed = cpu_to_le32(ts.tv_nsec / 32);
 	} else {
 		context_desc->seqnum_seed = 0;
-- 
GitLab


From af3790a46a55afabedb7c7957aebfb17a6143735 Mon Sep 17 00:00:00 2001
From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Date: Mon, 15 Apr 2019 16:45:04 +0300
Subject: [PATCH 0913/1835] iwlwifi: mvm: Drop large non sta frames

[ Upstream commit ac70499ee97231a418dc1a4d6c9dc102e8f64631 ]

In some buggy scenarios we could possible attempt to transmit frames larger
than maximum MSDU size. Since our devices don't know how to handle this,
it may result in asserts, hangs etc.
This can happen, for example, when we receive a large multicast frame
and try to transmit it back to the air in AP mode.
Since in a legal scenario this should never happen, drop such frames and
warn about it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 2d21f0a1fa006..ffae299c34928 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -641,6 +641,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
 
 	memcpy(&info, skb->cb, sizeof(info));
 
+	if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen))
+		return -1;
+
 	if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
 		return -1;
 
-- 
GitLab


From 7343178ccf7db5533ecbecaf270a2dac9fbeb161 Mon Sep 17 00:00:00 2001
From: Baruch Siach <baruch@tkos.co.il>
Date: Fri, 28 Jun 2019 07:08:45 +0300
Subject: [PATCH 0914/1835] bpf: fix uapi bpf_prog_info fields alignment

[ Upstream commit 0472301a28f6cf53a6bc5783e48a2d0bbff4682f ]

Merge commit 1c8c5a9d38f60 ("Merge
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next") undid the
fix from commit 36f9814a494 ("bpf: fix uapi hole for 32 bit compat
applications") by taking the gpl_compatible 1-bit field definition from
commit b85fab0e67b162 ("bpf: Add gpl_compatible flag to struct
bpf_prog_info") as is. That breaks architectures with 16-bit alignment
like m68k. Add 31-bit pad after gpl_compatible to restore alignment of
following fields.

Thanks to Dmitry V. Levin his analysis of this bug history.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Acked-by: Song Liu <songliubraving@fb.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/bpf.h       | 1 +
 tools/include/uapi/linux/bpf.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 2932600ce271c..d143e277cdaf2 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2486,6 +2486,7 @@ struct bpf_prog_info {
 	char name[BPF_OBJ_NAME_LEN];
 	__u32 ifindex;
 	__u32 gpl_compatible:1;
+	__u32 :31; /* alignment pad */
 	__u64 netns_dev;
 	__u64 netns_ino;
 	__u32 nr_jited_ksyms;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 66917a4eba271..bf4cd924aed55 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2484,6 +2484,7 @@ struct bpf_prog_info {
 	char name[BPF_OBJ_NAME_LEN];
 	__u32 ifindex;
 	__u32 gpl_compatible:1;
+	__u32 :31; /* alignment pad */
 	__u64 netns_dev;
 	__u64 netns_ino;
 	__u32 nr_jited_ksyms;
-- 
GitLab


From a64e018be77a15035862e68dcda120adf732d1ca Mon Sep 17 00:00:00 2001
From: Andi Kleen <ak@linux.intel.com>
Date: Mon, 24 Jun 2019 12:37:08 -0700
Subject: [PATCH 0915/1835] perf stat: Make metric event lookup more robust

[ Upstream commit 145c407c808352acd625be793396fd4f33c794f8 ]

After setting up metric groups through the event parser, the metricgroup
code looks them up again in the event list.

Make sure we only look up events that haven't been used by some other
metric. The data structures currently cannot handle more than one metric
per event. This avoids problems with multiple events partially
overlapping.

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Link: http://lkml.kernel.org/r/20190624193711.35241-2-andi@firstfloor.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/stat-shadow.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
index 99990f5f2512a..bbb0e042d8e58 100644
--- a/tools/perf/util/stat-shadow.c
+++ b/tools/perf/util/stat-shadow.c
@@ -303,7 +303,7 @@ static struct perf_evsel *perf_stat__find_event(struct perf_evlist *evsel_list,
 	struct perf_evsel *c2;
 
 	evlist__for_each_entry (evsel_list, c2) {
-		if (!strcasecmp(c2->name, name))
+		if (!strcasecmp(c2->name, name) && !c2->collect_stat)
 			return c2;
 	}
 	return NULL;
@@ -342,7 +342,8 @@ void perf_stat__collect_metric_expr(struct perf_evlist *evsel_list)
 			if (leader) {
 				/* Search in group */
 				for_each_group_member (oc, leader) {
-					if (!strcasecmp(oc->name, metric_names[i])) {
+					if (!strcasecmp(oc->name, metric_names[i]) &&
+						!oc->collect_stat) {
 						found = true;
 						break;
 					}
-- 
GitLab


From e358d2ab42f8323c1628cd08090afed072ef55eb Mon Sep 17 00:00:00 2001
From: Andi Kleen <ak@linux.intel.com>
Date: Mon, 24 Jun 2019 12:37:10 -0700
Subject: [PATCH 0916/1835] perf stat: Fix group lookup for metric group

[ Upstream commit 2f87f33f4226523df9c9cc28f9874ea02fcc3d3f ]

The metric group code tries to find a group it added earlier in the
evlist. Fix the lookup to handle groups with partially overlaps
correctly. When a sub string match fails and we reset the match, we have
to compare the first element again.

I also renamed the find_evsel function to find_evsel_group to make its
purpose clearer.

With the earlier changes this fixes:

Before:

  % perf stat -M UPI,IPC sleep 1
  ...
         1,032,922      uops_retired.retire_slots #      1.1 UPI
         1,896,096      inst_retired.any
         1,896,096      inst_retired.any
         1,177,254      cpu_clk_unhalted.thread

After:

  % perf stat -M UPI,IPC sleep 1
  ...
        1,013,193      uops_retired.retire_slots #      1.1 UPI
           932,033      inst_retired.any
           932,033      inst_retired.any          #      0.9 IPC
         1,091,245      cpu_clk_unhalted.thread

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Fixes: b18f3e365019 ("perf stat: Support JSON metrics in perf stat")
Link: http://lkml.kernel.org/r/20190624193711.35241-4-andi@firstfloor.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/metricgroup.c | 47 ++++++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 12 deletions(-)

diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
index a28f9b5cc4ffe..8b3dafe3fac3a 100644
--- a/tools/perf/util/metricgroup.c
+++ b/tools/perf/util/metricgroup.c
@@ -94,26 +94,49 @@ struct egroup {
 	const char *metric_expr;
 };
 
-static struct perf_evsel *find_evsel(struct perf_evlist *perf_evlist,
-				     const char **ids,
-				     int idnum,
-				     struct perf_evsel **metric_events)
+static bool record_evsel(int *ind, struct perf_evsel **start,
+			 int idnum,
+			 struct perf_evsel **metric_events,
+			 struct perf_evsel *ev)
+{
+	metric_events[*ind] = ev;
+	if (*ind == 0)
+		*start = ev;
+	if (++*ind == idnum) {
+		metric_events[*ind] = NULL;
+		return true;
+	}
+	return false;
+}
+
+static struct perf_evsel *find_evsel_group(struct perf_evlist *perf_evlist,
+					   const char **ids,
+					   int idnum,
+					   struct perf_evsel **metric_events)
 {
 	struct perf_evsel *ev, *start = NULL;
 	int ind = 0;
 
 	evlist__for_each_entry (perf_evlist, ev) {
+		if (ev->collect_stat)
+			continue;
 		if (!strcmp(ev->name, ids[ind])) {
-			metric_events[ind] = ev;
-			if (ind == 0)
-				start = ev;
-			if (++ind == idnum) {
-				metric_events[ind] = NULL;
+			if (record_evsel(&ind, &start, idnum,
+					 metric_events, ev))
 				return start;
-			}
 		} else {
+			/*
+			 * We saw some other event that is not
+			 * in our list of events. Discard
+			 * the whole match and start again.
+			 */
 			ind = 0;
 			start = NULL;
+			if (!strcmp(ev->name, ids[ind])) {
+				if (record_evsel(&ind, &start, idnum,
+						 metric_events, ev))
+					return start;
+			}
 		}
 	}
 	/*
@@ -143,8 +166,8 @@ static int metricgroup__setup_events(struct list_head *groups,
 			ret = -ENOMEM;
 			break;
 		}
-		evsel = find_evsel(perf_evlist, eg->ids, eg->idnum,
-				   metric_events);
+		evsel = find_evsel_group(perf_evlist, eg->ids, eg->idnum,
+					 metric_events);
 		if (!evsel) {
 			pr_debug("Cannot resolve %s: %s\n",
 					eg->metric_name, eg->metric_expr);
-- 
GitLab


From 51216937c3196b61ede2ec86098af50c65ab321d Mon Sep 17 00:00:00 2001
From: "Guilherme G. Piccoli" <gpiccoli@canonical.com>
Date: Thu, 27 Jun 2019 13:31:33 -0300
Subject: [PATCH 0917/1835] bnx2x: Prevent ptp_task to be rescheduled
 indefinitely

[ Upstream commit 3c91f25c2f72ba6001775a5932857c1d2131c531 ]

Currently bnx2x ptp worker tries to read a register with timestamp
information in case of TX packet timestamping and in case it fails,
the routine reschedules itself indefinitely. This was reported as a
kworker always at 100% of CPU usage, which was narrowed down to be
bnx2x ptp_task.

By following the ioctl handler, we could narrow down the problem to
an NTP tool (chrony) requesting HW timestamping from bnx2x NIC with
RX filter zeroed; this isn't reproducible for example with ptp4l
(from linuxptp) since this tool requests a supported RX filter.
It seems NIC FW timestamp mechanism cannot work well with
RX_FILTER_NONE - driver's PTP filter init routine skips a register
write to the adapter if there's not a supported filter request.

This patch addresses the problem of bnx2x ptp thread's everlasting
reschedule by retrying the register read 10 times; between the read
attempts the thread sleeps for an increasing amount of time starting
in 1ms to give FW some time to perform the timestamping. If it still
fails after all retries, we bail out in order to prevent an unbound
resource consumption from bnx2x.

The patch also adds an ethtool statistic for accounting the skipped
TX timestamp packets and it reduces the priority of timestamping
error messages to prevent log flooding. The code was tested using
both linuxptp and chrony.

Reported-and-tested-by: Przemyslaw Hausman <przemyslaw.hausman@canonical.com>
Suggested-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@canonical.com>
Acked-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c   |  5 ++-
 .../ethernet/broadcom/bnx2x/bnx2x_ethtool.c   |  4 ++-
 .../net/ethernet/broadcom/bnx2x/bnx2x_main.c  | 33 ++++++++++++++-----
 .../net/ethernet/broadcom/bnx2x/bnx2x_stats.h |  3 ++
 4 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 5a727d4729da7..e3ce29951c5e3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3858,9 +3858,12 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) {
 		if (!(bp->flags & TX_TIMESTAMPING_EN)) {
+			bp->eth_stats.ptp_skip_tx_ts++;
 			BNX2X_ERR("Tx timestamping was not enabled, this packet will not be timestamped\n");
 		} else if (bp->ptp_tx_skb) {
-			BNX2X_ERR("The device supports only a single outstanding packet to timestamp, this packet will not be timestamped\n");
+			bp->eth_stats.ptp_skip_tx_ts++;
+			netdev_err_once(bp->dev,
+					"Device supports only a single outstanding packet to timestamp, this packet won't be timestamped\n");
 		} else {
 			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
 			/* schedule check for Tx timestamp */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index c428b0655c26e..00f9ed93360c6 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -182,7 +182,9 @@ static const struct {
 	{ STATS_OFFSET32(driver_filtered_tx_pkt),
 				4, false, "driver_filtered_tx_pkt" },
 	{ STATS_OFFSET32(eee_tx_lpi),
-				4, true, "Tx LPI entry count"}
+				4, true, "Tx LPI entry count"},
+	{ STATS_OFFSET32(ptp_skip_tx_ts),
+				4, false, "ptp_skipped_tx_tstamp" },
 };
 
 #define BNX2X_NUM_STATS		ARRAY_SIZE(bnx2x_stats_arr)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a585f1025a580..2c9af0f420e5d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -15244,11 +15244,24 @@ static void bnx2x_ptp_task(struct work_struct *work)
 	u32 val_seq;
 	u64 timestamp, ns;
 	struct skb_shared_hwtstamps shhwtstamps;
+	bool bail = true;
+	int i;
+
+	/* FW may take a while to complete timestamping; try a bit and if it's
+	 * still not complete, may indicate an error state - bail out then.
+	 */
+	for (i = 0; i < 10; i++) {
+		/* Read Tx timestamp registers */
+		val_seq = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_SEQID :
+				 NIG_REG_P0_TLLH_PTP_BUF_SEQID);
+		if (val_seq & 0x10000) {
+			bail = false;
+			break;
+		}
+		msleep(1 << i);
+	}
 
-	/* Read Tx timestamp registers */
-	val_seq = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_SEQID :
-			 NIG_REG_P0_TLLH_PTP_BUF_SEQID);
-	if (val_seq & 0x10000) {
+	if (!bail) {
 		/* There is a valid timestamp value */
 		timestamp = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_TS_MSB :
 				   NIG_REG_P0_TLLH_PTP_BUF_TS_MSB);
@@ -15263,16 +15276,18 @@ static void bnx2x_ptp_task(struct work_struct *work)
 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
 		shhwtstamps.hwtstamp = ns_to_ktime(ns);
 		skb_tstamp_tx(bp->ptp_tx_skb, &shhwtstamps);
-		dev_kfree_skb_any(bp->ptp_tx_skb);
-		bp->ptp_tx_skb = NULL;
 
 		DP(BNX2X_MSG_PTP, "Tx timestamp, timestamp cycles = %llu, ns = %llu\n",
 		   timestamp, ns);
 	} else {
-		DP(BNX2X_MSG_PTP, "There is no valid Tx timestamp yet\n");
-		/* Reschedule to keep checking for a valid timestamp value */
-		schedule_work(&bp->ptp_task);
+		DP(BNX2X_MSG_PTP,
+		   "Tx timestamp is not recorded (register read=%u)\n",
+		   val_seq);
+		bp->eth_stats.ptp_skip_tx_ts++;
 	}
+
+	dev_kfree_skb_any(bp->ptp_tx_skb);
+	bp->ptp_tx_skb = NULL;
 }
 
 void bnx2x_set_rx_ts(struct bnx2x *bp, struct sk_buff *skb)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index b2644ed13d064..d55e63692cf3b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -207,6 +207,9 @@ struct bnx2x_eth_stats {
 	u32 driver_filtered_tx_pkt;
 	/* src: Clear-on-Read register; Will not survive PMF Migration */
 	u32 eee_tx_lpi;
+
+	/* PTP */
+	u32 ptp_skip_tx_ts;
 };
 
 struct bnx2x_eth_q_stats {
-- 
GitLab


From ca37b9a74689f385715a5c3d5cda438c78021734 Mon Sep 17 00:00:00 2001
From: Phong Tran <tranmanphong@gmail.com>
Date: Tue, 2 Jul 2019 07:10:08 +0700
Subject: [PATCH 0918/1835] net: usb: asix: init MAC address buffers

[ Upstream commit 78226f6eaac80bf30256a33a4926c194ceefdf36 ]

This is for fixing bug KMSAN: uninit-value in ax88772_bind

Tested by
https://groups.google.com/d/msg/syzkaller-bugs/aFQurGotng4/eB_HlNhhCwAJ

Reported-by: syzbot+8a3fc6674bbc3978ed4e@syzkaller.appspotmail.com

syzbot found the following crash on:

HEAD commit:    f75e4cfe kmsan: use kmsan_handle_urb() in urb.c
git tree:       kmsan
console output: https://syzkaller.appspot.com/x/log.txt?x=136d720ea00000
kernel config:
https://syzkaller.appspot.com/x/.config?x=602468164ccdc30a
dashboard link:
https://syzkaller.appspot.com/bug?extid=8a3fc6674bbc3978ed4e
compiler:       clang version 9.0.0 (/home/glider/llvm/clang
06d00afa61eef8f7f501ebdb4e8612ea43ec2d78)
syz repro:
https://syzkaller.appspot.com/x/repro.syz?x=12788316a00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=120359aaa00000

==================================================================
BUG: KMSAN: uninit-value in is_valid_ether_addr
include/linux/etherdevice.h:200 [inline]
BUG: KMSAN: uninit-value in asix_set_netdev_dev_addr
drivers/net/usb/asix_devices.c:73 [inline]
BUG: KMSAN: uninit-value in ax88772_bind+0x93d/0x11e0
drivers/net/usb/asix_devices.c:724
CPU: 0 PID: 3348 Comm: kworker/0:2 Not tainted 5.1.0+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x191/0x1f0 lib/dump_stack.c:113
  kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622
  __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310
  is_valid_ether_addr include/linux/etherdevice.h:200 [inline]
  asix_set_netdev_dev_addr drivers/net/usb/asix_devices.c:73 [inline]
  ax88772_bind+0x93d/0x11e0 drivers/net/usb/asix_devices.c:724
  usbnet_probe+0x10f5/0x3940 drivers/net/usb/usbnet.c:1728
  usb_probe_interface+0xd66/0x1320 drivers/usb/core/driver.c:361
  really_probe+0xdae/0x1d80 drivers/base/dd.c:513
  driver_probe_device+0x1b3/0x4f0 drivers/base/dd.c:671
  __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:778
  bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:454
  __device_attach+0x454/0x730 drivers/base/dd.c:844
  device_initial_probe+0x4a/0x60 drivers/base/dd.c:891
  bus_probe_device+0x137/0x390 drivers/base/bus.c:514
  device_add+0x288d/0x30e0 drivers/base/core.c:2106
  usb_set_configuration+0x30dc/0x3750 drivers/usb/core/message.c:2027
  generic_probe+0xe7/0x280 drivers/usb/core/generic.c:210
  usb_probe_device+0x14c/0x200 drivers/usb/core/driver.c:266
  really_probe+0xdae/0x1d80 drivers/base/dd.c:513
  driver_probe_device+0x1b3/0x4f0 drivers/base/dd.c:671
  __device_attach_driver+0x5b8/0x790 drivers/base/dd.c:778
  bus_for_each_drv+0x28e/0x3b0 drivers/base/bus.c:454
  __device_attach+0x454/0x730 drivers/base/dd.c:844
  device_initial_probe+0x4a/0x60 drivers/base/dd.c:891
  bus_probe_device+0x137/0x390 drivers/base/bus.c:514
  device_add+0x288d/0x30e0 drivers/base/core.c:2106
  usb_new_device+0x23e5/0x2ff0 drivers/usb/core/hub.c:2534
  hub_port_connect drivers/usb/core/hub.c:5089 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
  port_event drivers/usb/core/hub.c:5350 [inline]
  hub_event+0x48d1/0x7290 drivers/usb/core/hub.c:5432
  process_one_work+0x1572/0x1f00 kernel/workqueue.c:2269
  process_scheduled_works kernel/workqueue.c:2331 [inline]
  worker_thread+0x189c/0x2460 kernel/workqueue.c:2417
  kthread+0x4b5/0x4f0 kernel/kthread.c:254
  ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355

Signed-off-by: Phong Tran <tranmanphong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/asix_devices.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 3d93993e74da0..2eca4168af2f0 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -238,7 +238,7 @@ static void asix_phy_reset(struct usbnet *dev, unsigned int reset_bits)
 static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf)
 {
 	int ret = 0;
-	u8 buf[ETH_ALEN];
+	u8 buf[ETH_ALEN] = {0};
 	int i;
 	unsigned long gpio_bits = dev->driver_info->data;
 
@@ -689,7 +689,7 @@ static int asix_resume(struct usb_interface *intf)
 static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
 {
 	int ret, i;
-	u8 buf[ETH_ALEN], chipcode = 0;
+	u8 buf[ETH_ALEN] = {0}, chipcode = 0;
 	u32 phyid;
 	struct asix_common_private *priv;
 
@@ -1073,7 +1073,7 @@ static const struct net_device_ops ax88178_netdev_ops = {
 static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf)
 {
 	int ret;
-	u8 buf[ETH_ALEN];
+	u8 buf[ETH_ALEN] = {0};
 
 	usbnet_get_endpoints(dev,intf);
 
-- 
GitLab


From 0f2f2cebe64d4028058970353dfaf079218affb4 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 2 Jul 2019 16:04:19 +0100
Subject: [PATCH 0919/1835] rxrpc: Fix oops in tracepoint

[ Upstream commit 99f0eae653b2db64917d0b58099eb51e300b311d ]

If the rxrpc_eproto tracepoint is enabled, an oops will be cause by the
trace line that rxrpc_extract_header() tries to emit when a protocol error
occurs (typically because the packet is short) because the call argument is
NULL.

Fix this by using ?: to assume 0 as the debug_id if call is NULL.

This can then be induced by:

	echo -e '\0\0\0\0\0\0\0\0' | ncat -4u --send-only <addr> 20001

where addr has the following program running on it:

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <sys/socket.h>
	#include <arpa/inet.h>
	#include <linux/rxrpc.h>
	int main(void)
	{
		struct sockaddr_rxrpc srx;
		int fd;
		memset(&srx, 0, sizeof(srx));
		srx.srx_family			= AF_RXRPC;
		srx.srx_service			= 0;
		srx.transport_type		= AF_INET;
		srx.transport_len		= sizeof(srx.transport.sin);
		srx.transport.sin.sin_family	= AF_INET;
		srx.transport.sin.sin_port	= htons(0x4e21);
		fd = socket(AF_RXRPC, SOCK_DGRAM, AF_INET6);
		bind(fd, (struct sockaddr *)&srx, sizeof(srx));
		sleep(20);
		return 0;
	}

It results in the following oops.

	BUG: kernel NULL pointer dereference, address: 0000000000000340
	#PF: supervisor read access in kernel mode
	#PF: error_code(0x0000) - not-present page
	...
	RIP: 0010:trace_event_raw_event_rxrpc_rx_eproto+0x47/0xac
	...
	Call Trace:
	 <IRQ>
	 rxrpc_extract_header+0x86/0x171
	 ? rcu_read_lock_sched_held+0x5d/0x63
	 ? rxrpc_new_skb+0xd4/0x109
	 rxrpc_input_packet+0xef/0x14fc
	 ? rxrpc_input_data+0x986/0x986
	 udp_queue_rcv_one_skb+0xbf/0x3d0
	 udp_unicast_rcv_skb.isra.8+0x64/0x71
	 ip_protocol_deliver_rcu+0xe4/0x1b4
	 ip_local_deliver+0xf0/0x154
	 __netif_receive_skb_one_core+0x50/0x6c
	 netif_receive_skb_internal+0x26b/0x2e9
	 napi_gro_receive+0xf8/0x1da
	 rtl8169_poll+0x303/0x4c4
	 net_rx_action+0x10e/0x333
	 __do_softirq+0x1a5/0x38f
	 irq_exit+0x54/0xc4
	 do_IRQ+0xda/0xf8
	 common_interrupt+0xf/0xf
	 </IRQ>
	 ...
	 ? cpuidle_enter_state+0x23c/0x34d
	 cpuidle_enter+0x2a/0x36
	 do_idle+0x163/0x1ea
	 cpu_startup_entry+0x1d/0x1f
	 start_secondary+0x157/0x172
	 secondary_startup_64+0xa4/0xb0

Fixes: a25e21f0bcd2 ("rxrpc, afs: Use debug_ids rather than pointers in traces")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/trace/events/rxrpc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 6d182746afab3..147546e0c11bd 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -1381,7 +1381,7 @@ TRACE_EVENT(rxrpc_rx_eproto,
 			     ),
 
 	    TP_fast_assign(
-		    __entry->call = call->debug_id;
+		    __entry->call = call ? call->debug_id : 0;
 		    __entry->serial = serial;
 		    __entry->why = why;
 			   ),
-- 
GitLab


From ef5b204336b348dd1fbea7bfe9978a2999d9e24f Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Tue, 2 Jul 2019 18:25:31 +0800
Subject: [PATCH 0920/1835] bpf, libbpf, smatch: Fix potential NULL pointer
 dereference

[ Upstream commit 33bae185f74d49a0d7b1bfaafb8e959efce0f243 ]

Based on the following report from Smatch, fix the potential NULL
pointer dereference check:

  tools/lib/bpf/libbpf.c:3493
  bpf_prog_load_xattr() warn: variable dereferenced before check 'attr'
  (see line 3483)

  3479 int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
  3480                         struct bpf_object **pobj, int *prog_fd)
  3481 {
  3482         struct bpf_object_open_attr open_attr = {
  3483                 .file           = attr->file,
  3484                 .prog_type      = attr->prog_type,
                                         ^^^^^^
  3485         };

At the head of function, it directly access 'attr' without checking
if it's NULL pointer. This patch moves the values assignment after
validating 'attr' and 'attr->file'.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index bdb94939fd602..a350f97e3a1a4 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -2293,10 +2293,7 @@ int bpf_prog_load(const char *file, enum bpf_prog_type type,
 int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
 			struct bpf_object **pobj, int *prog_fd)
 {
-	struct bpf_object_open_attr open_attr = {
-		.file		= attr->file,
-		.prog_type	= attr->prog_type,
-	};
+	struct bpf_object_open_attr open_attr = {};
 	struct bpf_program *prog, *first_prog = NULL;
 	enum bpf_attach_type expected_attach_type;
 	enum bpf_prog_type prog_type;
@@ -2309,6 +2306,9 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
 	if (!attr->file)
 		return -EINVAL;
 
+	open_attr.file = attr->file;
+	open_attr.prog_type = attr->prog_type;
+
 	obj = bpf_object__open_xattr(&open_attr);
 	if (IS_ERR_OR_NULL(obj))
 		return -ENOENT;
-- 
GitLab


From 88f751b066f2431231444847c753f2dc1d738e82 Mon Sep 17 00:00:00 2001
From: Jiri Benc <jbenc@redhat.com>
Date: Tue, 2 Jul 2019 19:40:31 +0200
Subject: [PATCH 0921/1835] selftests: bpf: fix inlines in test_lwt_seg6local

[ Upstream commit 11aca65ec4db09527d3e9b6b41a0615b7da4386b ]

Selftests are reporting this failure in test_lwt_seg6local.sh:

+ ip netns exec ns2 ip -6 route add fb00::6 encap bpf in obj test_lwt_seg6local.o sec encap_srh dev veth2
Error fetching program/map!
Failed to parse eBPF program: Operation not permitted

The problem is __attribute__((always_inline)) alone is not enough to prevent
clang from inserting those functions in .text. In that case, .text is not
marked as relocateable.

See the output of objdump -h test_lwt_seg6local.o:

Idx Name          Size      VMA               LMA               File off  Algn
  0 .text         00003530  0000000000000000  0000000000000000  00000040  2**3
                  CONTENTS, ALLOC, LOAD, READONLY, CODE

This causes the iproute bpf loader to fail in bpf_fetch_prog_sec:
bpf_has_call_data returns true but bpf_fetch_prog_relo fails as there's no
relocateable .text section in the file.

To fix this, convert to 'static __always_inline'.

v2: Use 'static __always_inline' instead of 'static inline
    __attribute__((always_inline))'

Fixes: c99a84eac026 ("selftests/bpf: test for seg6local End.BPF action")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_lwt_seg6local.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_lwt_seg6local.c b/tools/testing/selftests/bpf/test_lwt_seg6local.c
index 0575751bc1bc4..e2f6ed0a583de 100644
--- a/tools/testing/selftests/bpf/test_lwt_seg6local.c
+++ b/tools/testing/selftests/bpf/test_lwt_seg6local.c
@@ -61,7 +61,7 @@ struct sr6_tlv_t {
 	unsigned char value[0];
 } BPF_PACKET_HEADER;
 
-__attribute__((always_inline)) struct ip6_srh_t *get_srh(struct __sk_buff *skb)
+static __always_inline struct ip6_srh_t *get_srh(struct __sk_buff *skb)
 {
 	void *cursor, *data_end;
 	struct ip6_srh_t *srh;
@@ -95,7 +95,7 @@ __attribute__((always_inline)) struct ip6_srh_t *get_srh(struct __sk_buff *skb)
 	return srh;
 }
 
-__attribute__((always_inline))
+static __always_inline
 int update_tlv_pad(struct __sk_buff *skb, uint32_t new_pad,
 		   uint32_t old_pad, uint32_t pad_off)
 {
@@ -125,7 +125,7 @@ int update_tlv_pad(struct __sk_buff *skb, uint32_t new_pad,
 	return 0;
 }
 
-__attribute__((always_inline))
+static __always_inline
 int is_valid_tlv_boundary(struct __sk_buff *skb, struct ip6_srh_t *srh,
 			  uint32_t *tlv_off, uint32_t *pad_size,
 			  uint32_t *pad_off)
@@ -184,7 +184,7 @@ int is_valid_tlv_boundary(struct __sk_buff *skb, struct ip6_srh_t *srh,
 	return 0;
 }
 
-__attribute__((always_inline))
+static __always_inline
 int add_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh, uint32_t tlv_off,
 	    struct sr6_tlv_t *itlv, uint8_t tlv_size)
 {
@@ -228,7 +228,7 @@ int add_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh, uint32_t tlv_off,
 	return update_tlv_pad(skb, new_pad, pad_size, pad_off);
 }
 
-__attribute__((always_inline))
+static __always_inline
 int delete_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh,
 	       uint32_t tlv_off)
 {
@@ -266,7 +266,7 @@ int delete_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh,
 	return update_tlv_pad(skb, new_pad, pad_size, pad_off);
 }
 
-__attribute__((always_inline))
+static __always_inline
 int has_egr_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh)
 {
 	int tlv_offset = sizeof(struct ip6_t) + sizeof(struct ip6_srh_t) +
-- 
GitLab


From 157d1c7a1a000c94f760c3b07fd4f3452430862c Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Mon, 1 Jul 2019 20:40:24 -0700
Subject: [PATCH 0922/1835] bonding: validate ip header before check
 IPPROTO_IGMP

[ Upstream commit 9d1bc24b52fb8c5d859f9a47084bf1179470e04c ]

bond_xmit_roundrobin() checks for IGMP packets but it parses
the IP header even before checking skb->protocol.

We should validate the IP header with pskb_may_pull() before
using iph->protocol.

Reported-and-tested-by: syzbot+e5be16aa39ad6e755391@syzkaller.appspotmail.com
Fixes: a2fd940f4cff ("bonding: fix broken multicast with round-robin mode")
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 37 ++++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 7e162fff01abb..be0b785becd09 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3852,8 +3852,8 @@ static netdev_tx_t bond_xmit_roundrobin(struct sk_buff *skb,
 					struct net_device *bond_dev)
 {
 	struct bonding *bond = netdev_priv(bond_dev);
-	struct iphdr *iph = ip_hdr(skb);
 	struct slave *slave;
+	int slave_cnt;
 	u32 slave_id;
 
 	/* Start with the curr_active_slave that joined the bond as the
@@ -3862,23 +3862,32 @@ static netdev_tx_t bond_xmit_roundrobin(struct sk_buff *skb,
 	 * send the join/membership reports.  The curr_active_slave found
 	 * will send all of this type of traffic.
 	 */
-	if (iph->protocol == IPPROTO_IGMP && skb->protocol == htons(ETH_P_IP)) {
-		slave = rcu_dereference(bond->curr_active_slave);
-		if (slave)
-			bond_dev_queue_xmit(bond, skb, slave->dev);
-		else
-			bond_xmit_slave_id(bond, skb, 0);
-	} else {
-		int slave_cnt = READ_ONCE(bond->slave_cnt);
+	if (skb->protocol == htons(ETH_P_IP)) {
+		int noff = skb_network_offset(skb);
+		struct iphdr *iph;
 
-		if (likely(slave_cnt)) {
-			slave_id = bond_rr_gen_slave_id(bond);
-			bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
-		} else {
-			bond_tx_drop(bond_dev, skb);
+		if (unlikely(!pskb_may_pull(skb, noff + sizeof(*iph))))
+			goto non_igmp;
+
+		iph = ip_hdr(skb);
+		if (iph->protocol == IPPROTO_IGMP) {
+			slave = rcu_dereference(bond->curr_active_slave);
+			if (slave)
+				bond_dev_queue_xmit(bond, skb, slave->dev);
+			else
+				bond_xmit_slave_id(bond, skb, 0);
+			return NETDEV_TX_OK;
 		}
 	}
 
+non_igmp:
+	slave_cnt = READ_ONCE(bond->slave_cnt);
+	if (likely(slave_cnt)) {
+		slave_id = bond_rr_gen_slave_id(bond);
+		bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
+	} else {
+		bond_tx_drop(bond_dev, skb);
+	}
 	return NETDEV_TX_OK;
 }
 
-- 
GitLab


From 2ad04d31bb3ed89948f4b4d08cc2ed5553ab65f6 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Mon, 1 Jul 2019 16:27:38 +0200
Subject: [PATCH 0923/1835] gpiolib: Fix references to
 gpiod_[gs]et_*value_cansleep() variants

[ Upstream commit 3285170f28a850638794cdfe712eb6d93e51e706 ]

Commit 372e722ea4dd4ca1 ("gpiolib: use descriptors internally") renamed
the functions to use a "gpiod" prefix, and commit 79a9becda8940deb
("gpiolib: export descriptor-based GPIO interface") introduced the "raw"
variants, but both changes forgot to update the comments.

Readd a similar reference to gpiod_set_value(), which was accidentally
removed by commit 1e77fc82110ac36f ("gpio: Add missing open drain/source
handling to gpiod_set_value_cansleep()").

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20190701142738.25219-1-geert+renesas@glider.be
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index fd713326dcfcf..4a48c7c477094 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2877,7 +2877,7 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep,
 int gpiod_get_raw_value(const struct gpio_desc *desc)
 {
 	VALIDATE_DESC(desc);
-	/* Should be using gpio_get_value_cansleep() */
+	/* Should be using gpiod_get_raw_value_cansleep() */
 	WARN_ON(desc->gdev->chip->can_sleep);
 	return gpiod_get_raw_value_commit(desc);
 }
@@ -2898,7 +2898,7 @@ int gpiod_get_value(const struct gpio_desc *desc)
 	int value;
 
 	VALIDATE_DESC(desc);
-	/* Should be using gpio_get_value_cansleep() */
+	/* Should be using gpiod_get_value_cansleep() */
 	WARN_ON(desc->gdev->chip->can_sleep);
 
 	value = gpiod_get_raw_value_commit(desc);
@@ -3123,7 +3123,7 @@ int gpiod_set_array_value_complex(bool raw, bool can_sleep,
 void gpiod_set_raw_value(struct gpio_desc *desc, int value)
 {
 	VALIDATE_DESC_VOID(desc);
-	/* Should be using gpiod_set_value_cansleep() */
+	/* Should be using gpiod_set_raw_value_cansleep() */
 	WARN_ON(desc->gdev->chip->can_sleep);
 	gpiod_set_raw_value_commit(desc, value);
 }
@@ -3164,6 +3164,7 @@ static void gpiod_set_value_nocheck(struct gpio_desc *desc, int value)
 void gpiod_set_value(struct gpio_desc *desc, int value)
 {
 	VALIDATE_DESC_VOID(desc);
+	/* Should be using gpiod_set_value_cansleep() */
 	WARN_ON(desc->gdev->chip->can_sleep);
 	gpiod_set_value_nocheck(desc, value);
 }
-- 
GitLab


From 9d47bd2175396a57d08521b3f09be9aa06a55a97 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@redhat.com>
Date: Fri, 5 Jul 2019 14:10:31 +0200
Subject: [PATCH 0924/1835] tools: bpftool: Fix json dump crash on powerpc

[ Upstream commit aa52bcbe0e72fac36b1862db08b9c09c4caefae3 ]

Michael reported crash with by bpf program in json mode on powerpc:

  # bpftool prog -p dump jited id 14
  [{
        "name": "0xd00000000a9aa760",
        "insns": [{
                "pc": "0x0",
                "operation": "nop",
                "operands": [null
                ]
            },{
                "pc": "0x4",
                "operation": "nop",
                "operands": [null
                ]
            },{
                "pc": "0x8",
                "operation": "mflr",
  Segmentation fault (core dumped)

The code is assuming char pointers in format, which is not always
true at least for powerpc. Fixing this by dumping the whole string
into buffer based on its format.

Please note that libopcodes code does not check return values from
fprintf callback, but as per Jakub suggestion returning -1 on allocation
failure so we do the best effort to propagate the error.

Fixes: 107f041212c1 ("tools: bpftool: add JSON output for `bpftool prog dump jited *` command")
Reported-by: Michael Petlan <mpetlan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/jit_disasm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/bpf/bpftool/jit_disasm.c b/tools/bpf/bpftool/jit_disasm.c
index 87439320ef70e..73d7252729fad 100644
--- a/tools/bpf/bpftool/jit_disasm.c
+++ b/tools/bpf/bpftool/jit_disasm.c
@@ -10,6 +10,8 @@
  * Licensed under the GNU General Public License, version 2.0 (GPLv2)
  */
 
+#define _GNU_SOURCE
+#include <stdio.h>
 #include <stdarg.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -51,11 +53,13 @@ static int fprintf_json(void *out, const char *fmt, ...)
 	char *s;
 
 	va_start(ap, fmt);
+	if (vasprintf(&s, fmt, ap) < 0)
+		return -1;
+	va_end(ap);
+
 	if (!oper_count) {
 		int i;
 
-		s = va_arg(ap, char *);
-
 		/* Strip trailing spaces */
 		i = strlen(s) - 1;
 		while (s[i] == ' ')
@@ -68,11 +72,10 @@ static int fprintf_json(void *out, const char *fmt, ...)
 	} else if (!strcmp(fmt, ",")) {
 		   /* Skip */
 	} else {
-		s = va_arg(ap, char *);
 		jsonw_string(json_wtr, s);
 		oper_count++;
 	}
-	va_end(ap);
+	free(s);
 	return 0;
 }
 
-- 
GitLab


From 578658df21d58cd7f41e6f68d64655c2cc9d8a74 Mon Sep 17 00:00:00 2001
From: Tomas Bortoli <tomasbortoli@gmail.com>
Date: Tue, 28 May 2019 15:42:58 +0200
Subject: [PATCH 0925/1835] Bluetooth: hci_bcsp: Fix memory leak in rx_skb

[ Upstream commit 4ce9146e0370fcd573f0372d9b4e5a211112567c ]

Syzkaller found that it is possible to provoke a memory leak by
never freeing rx_skb in struct bcsp_struct.

Fix by freeing in bcsp_close()

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_bcsp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 1a7f0c82fb362..66fe1e6dc631f 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -759,6 +759,11 @@ static int bcsp_close(struct hci_uart *hu)
 	skb_queue_purge(&bcsp->rel);
 	skb_queue_purge(&bcsp->unrel);
 
+	if (bcsp->rx_skb) {
+		kfree_skb(bcsp->rx_skb);
+		bcsp->rx_skb = NULL;
+	}
+
 	kfree(bcsp);
 	return 0;
 }
-- 
GitLab


From 1cbce19bd6976aec202b48bcec919423e35b07e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Paulo=20Rechi=20Vita?= <jprvita@gmail.com>
Date: Thu, 23 May 2019 13:32:01 -0700
Subject: [PATCH 0926/1835] Bluetooth: Add new 13d3:3491 QCA_ROME device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 44d34af2e4cfd0c5357182f8b43f3e0a1fe30a2e ]

Without the QCA ROME setup routine this adapter fails to establish a SCO
connection.

T:  Bus=01 Lev=01 Prnt=01 Port=08 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3491 Rev=00.01
C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:  If#=0x0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:  If#=0x1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 40a4f95f61781..f494fa30a9126 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -277,6 +277,7 @@ static const struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
+	{ USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME },
 
 	/* Broadcom BCM2035 */
-- 
GitLab


From c82c4910e9e618e5c3024c26cc668be8a13f19bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Paulo=20Rechi=20Vita?= <jprvita@gmail.com>
Date: Thu, 23 May 2019 13:32:02 -0700
Subject: [PATCH 0927/1835] Bluetooth: Add new 13d3:3501 QCA_ROME device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 881cec4f6b4da78e54b73c046a60f39315964c7d ]

Without the QCA ROME setup routine this adapter fails to establish a SCO
connection.

T:  Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3501 Rev=00.01
C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:  If#=0x0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:  If#=0x1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f494fa30a9126..75cf605f54e5e 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -279,6 +279,7 @@ static const struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME },
+	{ USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME },
 
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
-- 
GitLab


From c814f618b799b213ffb1c7757880c8e6a58278e0 Mon Sep 17 00:00:00 2001
From: Josua Mayer <josua.mayer@jm0.eu>
Date: Sat, 6 Jul 2019 17:54:46 +0200
Subject: [PATCH 0928/1835] Bluetooth: 6lowpan: search for destination address
 in all peers

[ Upstream commit b188b03270b7f8568fc714101ce82fbf5e811c5a ]

Handle overlooked case where the target address is assigned to a peer
and neither route nor gateway exist.

For one peer, no checks are performed to see if it is meant to receive
packets for a given address.

As soon as there is a second peer however, checks are performed
to deal with routes and gateways for handling complex setups with
multiple hops to a target address.
This logic assumed that no route and no gateway imply that the
destination address can not be reached, which is false in case of a
direct peer.

Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Tested-by: Michael Scott <mike@foundries.io>
Signed-off-by: Josua Mayer <josua.mayer@jm0.eu>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/6lowpan.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 4e2576fc0c599..357475cceec61 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -187,10 +187,16 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_btle_dev *dev,
 	}
 
 	if (!rt) {
-		nexthop = &lowpan_cb(skb)->gw;
-
-		if (ipv6_addr_any(nexthop))
-			return NULL;
+		if (ipv6_addr_any(&lowpan_cb(skb)->gw)) {
+			/* There is neither route nor gateway,
+			 * probably the destination is a direct peer.
+			 */
+			nexthop = daddr;
+		} else {
+			/* There is a known gateway
+			 */
+			nexthop = &lowpan_cb(skb)->gw;
+		}
 	} else {
 		nexthop = rt6_nexthop(rt, daddr);
 
-- 
GitLab


From 3b57b7a3a82ae7c0ab7f4c809c71f5b6e417e9ca Mon Sep 17 00:00:00 2001
From: Seeteena Thoufeek <s1seetee@linux.vnet.ibm.com>
Date: Thu, 27 Jun 2019 15:46:54 +0530
Subject: [PATCH 0929/1835] perf tests: Fix record+probe_libc_inet_pton.sh for
 powerpc64

[ Upstream commit bff5a556c149804de29347a88a884d25e4e4e3a2 ]

'probe libc's inet_pton & backtrace it with ping' testcase sometimes
fails on powerpc because distro ping binary does not have symbol
information and thus it prints "[unknown]" function name in the
backtrace.

Accept "[unknown]" as valid function name for powerpc as well.

 # perf test -v "probe libc's inet_pton & backtrace it with ping"

Before:

  59: probe libc's inet_pton & backtrace it with ping       :
  --- start ---
  test child forked, pid 79695
  ping 79718 [077] 96483.787025: probe_libc:inet_pton: (7fff83a754c8)
  7fff83a754c8 __GI___inet_pton+0x8 (/usr/lib64/power9/libc-2.28.so)
  7fff83a2b7a0 gaih_inet.constprop.7+0x1020
  (/usr/lib64/power9/libc-2.28.so)
  7fff83a2c170 getaddrinfo+0x160 (/usr/lib64/power9/libc-2.28.so)
  1171830f4 [unknown] (/usr/bin/ping)
  FAIL: expected backtrace entry
  ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$"
  got "1171830f4 [unknown] (/usr/bin/ping)"
  test child finished with -1
  ---- end ----
  probe libc's inet_pton & backtrace it with ping: FAILED!

After:

  59: probe libc's inet_pton & backtrace it with ping       :
  --- start ---
  test child forked, pid 79085
  ping 79108 [045] 96400.214177: probe_libc:inet_pton: (7fffbb9654c8)
  7fffbb9654c8 __GI___inet_pton+0x8 (/usr/lib64/power9/libc-2.28.so)
  7fffbb91b7a0 gaih_inet.constprop.7+0x1020
  (/usr/lib64/power9/libc-2.28.so)
  7fffbb91c170 getaddrinfo+0x160 (/usr/lib64/power9/libc-2.28.so)
  132e830f4 [unknown] (/usr/bin/ping)
  test child finished with 0
  ---- end ----
  probe libc's inet_pton & backtrace it with ping: Ok

Signed-off-by: Seeteena Thoufeek <s1seetee@linux.vnet.ibm.com>
Reviewed-by: Kim Phillips <kim.phillips@amd.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sandipan Das <sandipan@linux.ibm.com>
Fixes: 1632936480a5 ("perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo")
Link: http://lkml.kernel.org/r/1561630614-3216-1-git-send-email-s1seetee@linux.vnet.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
index cab7b0aea6eab..f5837f28f3af4 100755
--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
@@ -43,7 +43,7 @@ trace_libc_inet_pton_backtrace() {
 		eventattr='max-stack=4'
 		echo "gaih_inet.*\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
 		echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
-		echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+		echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected
 		;;
 	*)
 		eventattr='max-stack=3'
-- 
GitLab


From 0fdb922d0ef0cbb03ecc16b6389454e2d4ebbe91 Mon Sep 17 00:00:00 2001
From: Matias Karhumaa <matias.karhumaa@gmail.com>
Date: Tue, 21 May 2019 13:07:22 +0300
Subject: [PATCH 0930/1835] Bluetooth: Check state in l2cap_disconnect_rsp

[ Upstream commit 28261da8a26f4915aa257d12d506c6ba179d961f ]

Because of both sides doing L2CAP disconnection at the same time, it
was possible to receive L2CAP Disconnection Response with CID that was
already freed. That caused problems if CID was already reused and L2CAP
Connection Request with same CID was sent out. Before this patch kernel
deleted channel context regardless of the state of the channel.

Example where leftover Disconnection Response (frame #402) causes local
device to delete L2CAP channel which was not yet connected. This in
turn confuses remote device's stack because same CID is re-used without
properly disconnecting.

Btmon capture before patch:
** snip **
> ACL Data RX: Handle 43 flags 0x02 dlen 8                #394 [hci1] 10.748949
      Channel: 65 len 4 [PSM 3 mode 0] {chan 2}
      RFCOMM: Disconnect (DISC) (0x43)
         Address: 0x03 cr 1 dlci 0x00
         Control: 0x53 poll/final 1
         Length: 0
         FCS: 0xfd
< ACL Data TX: Handle 43 flags 0x00 dlen 8                #395 [hci1] 10.749062
      Channel: 65 len 4 [PSM 3 mode 0] {chan 2}
      RFCOMM: Unnumbered Ack (UA) (0x63)
         Address: 0x03 cr 1 dlci 0x00
         Control: 0x73 poll/final 1
         Length: 0
         FCS: 0xd7
< ACL Data TX: Handle 43 flags 0x00 dlen 12               #396 [hci1] 10.749073
      L2CAP: Disconnection Request (0x06) ident 17 len 4
        Destination CID: 65
        Source CID: 65
> HCI Event: Number of Completed Packets (0x13) plen 5    #397 [hci1] 10.752391
        Num handles: 1
        Handle: 43
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5    #398 [hci1] 10.753394
        Num handles: 1
        Handle: 43
        Count: 1
> ACL Data RX: Handle 43 flags 0x02 dlen 12               #399 [hci1] 10.756499
      L2CAP: Disconnection Request (0x06) ident 26 len 4
        Destination CID: 65
        Source CID: 65
< ACL Data TX: Handle 43 flags 0x00 dlen 12               #400 [hci1] 10.756548
      L2CAP: Disconnection Response (0x07) ident 26 len 4
        Destination CID: 65
        Source CID: 65
< ACL Data TX: Handle 43 flags 0x00 dlen 12               #401 [hci1] 10.757459
      L2CAP: Connection Request (0x02) ident 18 len 4
        PSM: 1 (0x0001)
        Source CID: 65
> ACL Data RX: Handle 43 flags 0x02 dlen 12               #402 [hci1] 10.759148
      L2CAP: Disconnection Response (0x07) ident 17 len 4
        Destination CID: 65
        Source CID: 65
= bluetoothd: 00:1E:AB:4C:56:54: error updating services: Input/o..   10.759447
> HCI Event: Number of Completed Packets (0x13) plen 5    #403 [hci1] 10.759386
        Num handles: 1
        Handle: 43
        Count: 1
> ACL Data RX: Handle 43 flags 0x02 dlen 12               #404 [hci1] 10.760397
      L2CAP: Connection Request (0x02) ident 27 len 4
        PSM: 3 (0x0003)
        Source CID: 65
< ACL Data TX: Handle 43 flags 0x00 dlen 16               #405 [hci1] 10.760441
      L2CAP: Connection Response (0x03) ident 27 len 8
        Destination CID: 65
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
< ACL Data TX: Handle 43 flags 0x00 dlen 27               #406 [hci1] 10.760449
      L2CAP: Configure Request (0x04) ident 19 len 19
        Destination CID: 65
        Flags: 0x0000
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 1013
        Option: Retransmission and Flow Control (0x04) [mandatory]
          Mode: Basic (0x00)
          TX window size: 0
          Max transmit: 0
          Retransmission timeout: 0
          Monitor timeout: 0
          Maximum PDU size: 0
> HCI Event: Number of Completed Packets (0x13) plen 5    #407 [hci1] 10.761399
        Num handles: 1
        Handle: 43
        Count: 1
> ACL Data RX: Handle 43 flags 0x02 dlen 16               #408 [hci1] 10.762942
      L2CAP: Connection Response (0x03) ident 18 len 8
        Destination CID: 66
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
*snip*

Similar case after the patch:
*snip*
> ACL Data RX: Handle 43 flags 0x02 dlen 8            #22702 [hci0] 1664.411056
      Channel: 65 len 4 [PSM 3 mode 0] {chan 3}
      RFCOMM: Disconnect (DISC) (0x43)
         Address: 0x03 cr 1 dlci 0x00
         Control: 0x53 poll/final 1
         Length: 0
         FCS: 0xfd
< ACL Data TX: Handle 43 flags 0x00 dlen 8            #22703 [hci0] 1664.411136
      Channel: 65 len 4 [PSM 3 mode 0] {chan 3}
      RFCOMM: Unnumbered Ack (UA) (0x63)
         Address: 0x03 cr 1 dlci 0x00
         Control: 0x73 poll/final 1
         Length: 0
         FCS: 0xd7
< ACL Data TX: Handle 43 flags 0x00 dlen 12           #22704 [hci0] 1664.411143
      L2CAP: Disconnection Request (0x06) ident 11 len 4
        Destination CID: 65
        Source CID: 65
> HCI Event: Number of Completed Pac.. (0x13) plen 5  #22705 [hci0] 1664.414009
        Num handles: 1
        Handle: 43
        Count: 1
> HCI Event: Number of Completed Pac.. (0x13) plen 5  #22706 [hci0] 1664.415007
        Num handles: 1
        Handle: 43
        Count: 1
> ACL Data RX: Handle 43 flags 0x02 dlen 12           #22707 [hci0] 1664.418674
      L2CAP: Disconnection Request (0x06) ident 17 len 4
        Destination CID: 65
        Source CID: 65
< ACL Data TX: Handle 43 flags 0x00 dlen 12           #22708 [hci0] 1664.418762
      L2CAP: Disconnection Response (0x07) ident 17 len 4
        Destination CID: 65
        Source CID: 65
< ACL Data TX: Handle 43 flags 0x00 dlen 12           #22709 [hci0] 1664.421073
      L2CAP: Connection Request (0x02) ident 12 len 4
        PSM: 1 (0x0001)
        Source CID: 65
> ACL Data RX: Handle 43 flags 0x02 dlen 12           #22710 [hci0] 1664.421371
      L2CAP: Disconnection Response (0x07) ident 11 len 4
        Destination CID: 65
        Source CID: 65
> HCI Event: Number of Completed Pac.. (0x13) plen 5  #22711 [hci0] 1664.424082
        Num handles: 1
        Handle: 43
        Count: 1
> HCI Event: Number of Completed Pac.. (0x13) plen 5  #22712 [hci0] 1664.425040
        Num handles: 1
        Handle: 43
        Count: 1
> ACL Data RX: Handle 43 flags 0x02 dlen 12           #22713 [hci0] 1664.426103
      L2CAP: Connection Request (0x02) ident 18 len 4
        PSM: 3 (0x0003)
        Source CID: 65
< ACL Data TX: Handle 43 flags 0x00 dlen 16           #22714 [hci0] 1664.426186
      L2CAP: Connection Response (0x03) ident 18 len 8
        Destination CID: 66
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
< ACL Data TX: Handle 43 flags 0x00 dlen 27           #22715 [hci0] 1664.426196
      L2CAP: Configure Request (0x04) ident 13 len 19
        Destination CID: 65
        Flags: 0x0000
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 1013
        Option: Retransmission and Flow Control (0x04) [mandatory]
          Mode: Basic (0x00)
          TX window size: 0
          Max transmit: 0
          Retransmission timeout: 0
          Monitor timeout: 0
          Maximum PDU size: 0
> ACL Data RX: Handle 43 flags 0x02 dlen 16           #22716 [hci0] 1664.428804
      L2CAP: Connection Response (0x03) ident 12 len 8
        Destination CID: 66
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
*snip*

Fix is to check that channel is in state BT_DISCONN before deleting the
channel.

This bug was found while fuzzing Bluez's OBEX implementation using
Synopsys Defensics.

Reported-by: Matti Kamunen <matti.kamunen@synopsys.com>
Reported-by: Ari Timonen <ari.timonen@synopsys.com>
Signed-off-by: Matias Karhumaa <matias.karhumaa@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 879d5432bf779..260ef5426e0ca 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4384,6 +4384,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
 
 	l2cap_chan_lock(chan);
 
+	if (chan->state != BT_DISCONN) {
+		l2cap_chan_unlock(chan);
+		mutex_unlock(&conn->chan_lock);
+		return 0;
+	}
+
 	l2cap_chan_hold(chan);
 	l2cap_chan_del(chan, 0);
 
-- 
GitLab


From ca33af18b5fc497bd1d6260ccee1ff7b8f6d41d6 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Wed, 3 Jul 2019 00:24:04 +0900
Subject: [PATCH 0931/1835] gtp: add missing gtp_encap_disable_sock() in
 gtp_encap_enable()

[ Upstream commit e30155fd23c9c141cbe7d99b786e10a83a328837 ]

If an invalid role is sent from user space, gtp_encap_enable() will fail.
Then, it should call gtp_encap_disable_sock() but current code doesn't.
It makes memory leak.

Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/gtp.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 7a145172d5038..83488f2bf7a0e 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -847,8 +847,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
 
 	if (data[IFLA_GTP_ROLE]) {
 		role = nla_get_u32(data[IFLA_GTP_ROLE]);
-		if (role > GTP_ROLE_SGSN)
+		if (role > GTP_ROLE_SGSN) {
+			if (sk0)
+				gtp_encap_disable_sock(sk0);
+			if (sk1u)
+				gtp_encap_disable_sock(sk1u);
 			return -EINVAL;
+		}
 	}
 
 	gtp->sk0 = sk0;
-- 
GitLab


From 202de90df2b7e96786a17cd54409317906e579c2 Mon Sep 17 00:00:00 2001
From: csonsino <csonsino@gmail.com>
Date: Wed, 12 Jun 2019 15:00:52 -0600
Subject: [PATCH 0932/1835] Bluetooth: validate BLE connection interval updates

[ Upstream commit c49a8682fc5d298d44e8d911f4fa14690ea9485e ]

Problem: The Linux Bluetooth stack yields complete control over the BLE
connection interval to the remote device.

The Linux Bluetooth stack provides access to the BLE connection interval
min and max values through /sys/kernel/debug/bluetooth/hci0/
conn_min_interval and /sys/kernel/debug/bluetooth/hci0/conn_max_interval.
These values are used for initial BLE connections, but the remote device
has the ability to request a connection parameter update. In the event
that the remote side requests to change the connection interval, the Linux
kernel currently only validates that the desired value is within the
acceptable range in the Bluetooth specification (6 - 3200, corresponding to
7.5ms - 4000ms). There is currently no validation that the desired value
requested by the remote device is within the min/max limits specified in
the conn_min_interval/conn_max_interval configurations. This essentially
leads to Linux yielding complete control over the connection interval to
the remote device.

The proposed patch adds a verification step to the connection parameter
update mechanism, ensuring that the desired value is within the min/max
bounds of the current connection. If the desired value is outside of the
current connection min/max values, then the connection parameter update
request is rejected and the negative response is returned to the remote
device. Recall that the initial connection is established using the local
conn_min_interval/conn_max_interval values, so this allows the Linux
administrator to retain control over the BLE connection interval.

The one downside that I see is that the current default Linux values for
conn_min_interval and conn_max_interval typically correspond to 30ms and
50ms respectively. If this change were accepted, then it is feasible that
some devices would no longer be able to negotiate to their desired
connection interval values. This might be remedied by setting the default
Linux conn_min_interval and conn_max_interval values to the widest
supported range (6 - 3200 / 7.5ms - 4000ms). This could lead to the same
behavior as the current implementation, where the remote device could
request to change the connection interval value to any value that is
permitted by the Bluetooth specification, and Linux would accept the
desired value.

Signed-off-by: Carey Sonsino <csonsino@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c  | 5 +++++
 net/bluetooth/l2cap_core.c | 9 ++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3e7badb3ac2d5..0adcddb211fa5 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5545,6 +5545,11 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
 		return send_conn_param_neg_reply(hdev, handle,
 						 HCI_ERROR_UNKNOWN_CONN_ID);
 
+	if (min < hcon->le_conn_min_interval ||
+	    max > hcon->le_conn_max_interval)
+		return send_conn_param_neg_reply(hdev, handle,
+						 HCI_ERROR_INVALID_LL_PARAMS);
+
 	if (hci_check_conn_params(min, max, latency, timeout))
 		return send_conn_param_neg_reply(hdev, handle,
 						 HCI_ERROR_INVALID_LL_PARAMS);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 260ef5426e0ca..a54dadf4a6ca0 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5287,7 +5287,14 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 
 	memset(&rsp, 0, sizeof(rsp));
 
-	err = hci_check_conn_params(min, max, latency, to_multiplier);
+	if (min < hcon->le_conn_min_interval ||
+	    max > hcon->le_conn_max_interval) {
+		BT_DBG("requested connection interval exceeds current bounds.");
+		err = -EINVAL;
+	} else {
+		err = hci_check_conn_params(min, max, latency, to_multiplier);
+	}
+
 	if (err)
 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
 	else
-- 
GitLab


From e117a04133c673cc54292e12086a8177cd9bd4a4 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Wed, 3 Jul 2019 00:20:51 +0900
Subject: [PATCH 0933/1835] gtp: fix suspicious RCU usage

[ Upstream commit e198987e7dd7d3645a53875151cd6f8fc425b706 ]

gtp_encap_enable_socket() and gtp_encap_destroy() are not protected
by rcu_read_lock(). and it's not safe to write sk->sk_user_data.
This patch make these functions to use lock_sock() instead of
rcu_dereference_sk_user_data().

Test commands:
    gtp-link add gtp1

Splat looks like:
[   83.238315] =============================
[   83.239127] WARNING: suspicious RCU usage
[   83.239702] 5.2.0-rc6+ #49 Not tainted
[   83.240268] -----------------------------
[   83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage!
[   83.243828]
[   83.243828] other info that might help us debug this:
[   83.243828]
[   83.246325]
[   83.246325] rcu_scheduler_active = 2, debug_locks = 1
[   83.247314] 1 lock held by gtp-link/1008:
[   83.248523]  #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0
[   83.251503]
[   83.251503] stack backtrace:
[   83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49
[   83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   83.254562] Call Trace:
[   83.254995]  dump_stack+0x7c/0xbb
[   83.255567]  gtp_encap_enable_socket+0x2df/0x360 [gtp]
[   83.256415]  ? gtp_find_dev+0x1a0/0x1a0 [gtp]
[   83.257161]  ? memset+0x1f/0x40
[   83.257843]  gtp_newlink+0x90/0xa21 [gtp]
[   83.258497]  ? __netlink_ns_capable+0xc3/0xf0
[   83.259260]  __rtnl_newlink+0xb9f/0x11b0
[   83.260022]  ? rtnl_link_unregister+0x230/0x230
[ ... ]

Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/gtp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 83488f2bf7a0e..f45a806b6c06d 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -293,12 +293,14 @@ static void gtp_encap_destroy(struct sock *sk)
 {
 	struct gtp_dev *gtp;
 
-	gtp = rcu_dereference_sk_user_data(sk);
+	lock_sock(sk);
+	gtp = sk->sk_user_data;
 	if (gtp) {
 		udp_sk(sk)->encap_type = 0;
 		rcu_assign_sk_user_data(sk, NULL);
 		sock_put(sk);
 	}
+	release_sock(sk);
 }
 
 static void gtp_encap_disable_sock(struct sock *sk)
@@ -800,7 +802,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
 		goto out_sock;
 	}
 
-	if (rcu_dereference_sk_user_data(sock->sk)) {
+	lock_sock(sock->sk);
+	if (sock->sk->sk_user_data) {
 		sk = ERR_PTR(-EBUSY);
 		goto out_sock;
 	}
@@ -816,6 +819,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
 	setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
 
 out_sock:
+	release_sock(sock->sk);
 	sockfd_put(sock);
 	return sk;
 }
-- 
GitLab


From 0a5eca2c949cfafafb94e0524ff39505677da90d Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Wed, 3 Jul 2019 00:23:13 +0900
Subject: [PATCH 0934/1835] gtp: fix Illegal context switch in RCU read-side
 critical section.

[ Upstream commit 3f167e1921865b379a9becf03828e7202c7b4917 ]

ipv4_pdp_add() is called in RCU read-side critical section.
So GFP_KERNEL should not be used in the function.
This patch make ipv4_pdp_add() to use GFP_ATOMIC instead of GFP_KERNEL.

Test commands:
gtp-link add gtp1 &
gtp-tunnel add gtp1 v1 100 200 1.1.1.1 2.2.2.2

Splat looks like:
[  130.618881] =============================
[  130.626382] WARNING: suspicious RCU usage
[  130.626994] 5.2.0-rc6+ #50 Not tainted
[  130.627622] -----------------------------
[  130.628223] ./include/linux/rcupdate.h:266 Illegal context switch in RCU read-side critical section!
[  130.629684]
[  130.629684] other info that might help us debug this:
[  130.629684]
[  130.631022]
[  130.631022] rcu_scheduler_active = 2, debug_locks = 1
[  130.632136] 4 locks held by gtp-tunnel/1025:
[  130.632925]  #0: 000000002b93c8b7 (cb_lock){++++}, at: genl_rcv+0x15/0x40
[  130.634159]  #1: 00000000f17bc999 (genl_mutex){+.+.}, at: genl_rcv_msg+0xfb/0x130
[  130.635487]  #2: 00000000c644ed8e (rtnl_mutex){+.+.}, at: gtp_genl_new_pdp+0x18c/0x1150 [gtp]
[  130.636936]  #3: 0000000007a1cde7 (rcu_read_lock){....}, at: gtp_genl_new_pdp+0x187/0x1150 [gtp]
[  130.638348]
[  130.638348] stack backtrace:
[  130.639062] CPU: 1 PID: 1025 Comm: gtp-tunnel Not tainted 5.2.0-rc6+ #50
[  130.641318] Call Trace:
[  130.641707]  dump_stack+0x7c/0xbb
[  130.642252]  ___might_sleep+0x2c0/0x3b0
[  130.642862]  kmem_cache_alloc_trace+0x1cd/0x2b0
[  130.643591]  gtp_genl_new_pdp+0x6c5/0x1150 [gtp]
[  130.644371]  genl_family_rcv_msg+0x63a/0x1030
[  130.645074]  ? mutex_lock_io_nested+0x1090/0x1090
[  130.645845]  ? genl_unregister_family+0x630/0x630
[  130.646592]  ? debug_show_all_locks+0x2d0/0x2d0
[  130.647293]  ? check_flags.part.40+0x440/0x440
[  130.648099]  genl_rcv_msg+0xa3/0x130
[ ... ]

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/gtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index f45a806b6c06d..6f1ad7ccaea68 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -958,7 +958,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
 
 	}
 
-	pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL);
+	pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC);
 	if (pctx == NULL)
 		return -ENOMEM;
 
-- 
GitLab


From 141222216438632c72ce6d67544c2328d11f459d Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Wed, 3 Jul 2019 00:22:25 +0900
Subject: [PATCH 0935/1835] gtp: fix use-after-free in gtp_encap_destroy()

[ Upstream commit 1788b8569f5de27da09087fa3f6580d2aa04cc75 ]

gtp_encap_destroy() is called twice.
1. When interface is deleted.
2. When udp socket is destroyed.
either gtp->sk0 or gtp->sk1u could be freed by sock_put() in
gtp_encap_destroy(). so, when gtp_encap_destroy() is called again,
it would uses freed sk pointer.

patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to
null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected
by rtnl_lock. so, rtnl_lock() is added.

Test command:
   gtp-link add gtp1 &
   killall gtp-link
   ip link del gtp1

Splat looks like:
[   83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0
[   83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008
[   83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50
[   83.188469] Call Trace:
[ ... ]
[   83.200126]  lock_acquire+0x141/0x380
[   83.200575]  ? lock_sock_nested+0x3a/0xf0
[   83.201069]  _raw_spin_lock_bh+0x38/0x70
[   83.201551]  ? lock_sock_nested+0x3a/0xf0
[   83.202044]  lock_sock_nested+0x3a/0xf0
[   83.202520]  gtp_encap_destroy+0x18/0xe0 [gtp]
[   83.203065]  gtp_encap_disable.isra.14+0x13/0x50 [gtp]
[   83.203687]  gtp_dellink+0x56/0x170 [gtp]
[   83.204190]  rtnl_delete_link+0xb4/0x100
[ ... ]
[   83.236513] Allocated by task 976:
[   83.236925]  save_stack+0x19/0x80
[   83.237332]  __kasan_kmalloc.constprop.3+0xa0/0xd0
[   83.237894]  kmem_cache_alloc+0xd8/0x280
[   83.238360]  sk_prot_alloc.isra.42+0x50/0x200
[   83.238874]  sk_alloc+0x32/0x940
[   83.239264]  inet_create+0x283/0xc20
[   83.239684]  __sock_create+0x2dd/0x540
[   83.240136]  __sys_socket+0xca/0x1a0
[   83.240550]  __x64_sys_socket+0x6f/0xb0
[   83.240998]  do_syscall_64+0x9c/0x450
[   83.241466]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   83.242061]
[   83.242249] Freed by task 0:
[   83.242616]  save_stack+0x19/0x80
[   83.243013]  __kasan_slab_free+0x111/0x150
[   83.243498]  kmem_cache_free+0x89/0x250
[   83.244444]  __sk_destruct+0x38f/0x5a0
[   83.245366]  rcu_core+0x7e9/0x1c20
[   83.245766]  __do_softirq+0x213/0x8fa

Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/gtp.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 6f1ad7ccaea68..61e9b288d2dcf 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -289,13 +289,17 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 }
 
-static void gtp_encap_destroy(struct sock *sk)
+static void __gtp_encap_destroy(struct sock *sk)
 {
 	struct gtp_dev *gtp;
 
 	lock_sock(sk);
 	gtp = sk->sk_user_data;
 	if (gtp) {
+		if (gtp->sk0 == sk)
+			gtp->sk0 = NULL;
+		else
+			gtp->sk1u = NULL;
 		udp_sk(sk)->encap_type = 0;
 		rcu_assign_sk_user_data(sk, NULL);
 		sock_put(sk);
@@ -303,12 +307,19 @@ static void gtp_encap_destroy(struct sock *sk)
 	release_sock(sk);
 }
 
+static void gtp_encap_destroy(struct sock *sk)
+{
+	rtnl_lock();
+	__gtp_encap_destroy(sk);
+	rtnl_unlock();
+}
+
 static void gtp_encap_disable_sock(struct sock *sk)
 {
 	if (!sk)
 		return;
 
-	gtp_encap_destroy(sk);
+	__gtp_encap_destroy(sk);
 }
 
 static void gtp_encap_disable(struct gtp_dev *gtp)
@@ -1047,6 +1058,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
 		return -EINVAL;
 	}
 
+	rtnl_lock();
 	rcu_read_lock();
 
 	gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
@@ -1071,6 +1083,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
 
 out_unlock:
 	rcu_read_unlock();
+	rtnl_unlock();
 	return err;
 }
 
-- 
GitLab


From 5f6c5f5ae25e34a8fe5177e383eca95f46e2ba78 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Wed, 3 Jul 2019 00:23:42 +0900
Subject: [PATCH 0936/1835] gtp: fix use-after-free in gtp_newlink()

[ Upstream commit a2bed90704c68d3763bf24decb1b781a45395de8 ]

Current gtp_newlink() could be called after unregister_pernet_subsys().
gtp_newlink() uses gtp_net but it can be destroyed by
unregister_pernet_subsys().
So unregister_pernet_subsys() should be called after
rtnl_link_unregister().

Test commands:
   #SHELL 1
   while :
   do
	   for i in {1..5}
	   do
		./gtp-link add gtp$i &
	   done
	   killall gtp-link
   done

   #SHELL 2
   while :
   do
	modprobe -rv gtp
   done

Splat looks like:
[  753.176631] BUG: KASAN: use-after-free in gtp_newlink+0x9b4/0xa5c [gtp]
[  753.177722] Read of size 8 at addr ffff8880d48f2458 by task gtp-link/7126
[  753.179082] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G        W         5.2.0-rc6+ #50
[  753.185801] Call Trace:
[  753.186264]  dump_stack+0x7c/0xbb
[  753.186863]  ? gtp_newlink+0x9b4/0xa5c [gtp]
[  753.187583]  print_address_description+0xc7/0x240
[  753.188382]  ? gtp_newlink+0x9b4/0xa5c [gtp]
[  753.189097]  ? gtp_newlink+0x9b4/0xa5c [gtp]
[  753.189846]  __kasan_report+0x12a/0x16f
[  753.190542]  ? gtp_newlink+0x9b4/0xa5c [gtp]
[  753.191298]  kasan_report+0xe/0x20
[  753.191893]  gtp_newlink+0x9b4/0xa5c [gtp]
[  753.192580]  ? __netlink_ns_capable+0xc3/0xf0
[  753.193370]  __rtnl_newlink+0xb9f/0x11b0
[ ... ]
[  753.241201] Allocated by task 7186:
[  753.241844]  save_stack+0x19/0x80
[  753.242399]  __kasan_kmalloc.constprop.3+0xa0/0xd0
[  753.243192]  __kmalloc+0x13e/0x300
[  753.243764]  ops_init+0xd6/0x350
[  753.244314]  register_pernet_operations+0x249/0x6f0
[ ... ]
[  753.251770] Freed by task 7178:
[  753.252288]  save_stack+0x19/0x80
[  753.252833]  __kasan_slab_free+0x111/0x150
[  753.253962]  kfree+0xc7/0x280
[  753.254509]  ops_free_list.part.11+0x1c4/0x2d0
[  753.255241]  unregister_pernet_operations+0x262/0x390
[ ... ]
[  753.285883] list_add corruption. next->prev should be prev (ffff8880d48f2458), but was ffff8880d497d878. (next.
[  753.287241] ------------[ cut here ]------------
[  753.287794] kernel BUG at lib/list_debug.c:25!
[  753.288364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[  753.289099] CPU: 0 PID: 7126 Comm: gtp-link Tainted: G    B   W         5.2.0-rc6+ #50
[  753.291036] RIP: 0010:__list_add_valid+0x74/0xd0
[  753.291589] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 89 d9 48b
[  753.293779] RSP: 0018:ffff8880cae8f398 EFLAGS: 00010286
[  753.294401] RAX: 0000000000000075 RBX: ffff8880d497d878 RCX: 0000000000000000
[  753.296260] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed10195d1e69
[  753.297070] RBP: ffff8880cd250ae0 R08: ffffed101b4bff21 R09: ffffed101b4bff21
[  753.297899] R10: 0000000000000001 R11: ffffed101b4bff20 R12: ffff8880d497d878
[  753.298703] R13: 0000000000000000 R14: ffff8880cd250ae0 R15: ffff8880d48f2458
[  753.299564] FS:  00007f5f79805740(0000) GS:ffff8880da400000(0000) knlGS:0000000000000000
[  753.300533] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  753.301231] CR2: 00007fe8c7ef4f10 CR3: 00000000b71a6006 CR4: 00000000000606f0
[  753.302183] Call Trace:
[  753.302530]  gtp_newlink+0x5f6/0xa5c [gtp]
[  753.303037]  ? __netlink_ns_capable+0xc3/0xf0
[  753.303576]  __rtnl_newlink+0xb9f/0x11b0
[  753.304092]  ? rtnl_link_unregister+0x230/0x230

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/gtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 61e9b288d2dcf..d178d5bad7e48 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1385,9 +1385,9 @@ late_initcall(gtp_init);
 
 static void __exit gtp_fini(void)
 {
-	unregister_pernet_subsys(&gtp_net_ops);
 	genl_unregister_family(&gtp_genl_family);
 	rtnl_link_unregister(&gtp_link_ops);
+	unregister_pernet_subsys(&gtp_net_ops);
 
 	pr_info("GTP module unloaded\n");
 }
-- 
GitLab


From e9896b29d01098bb2eb0884821820c24f54d8f77 Mon Sep 17 00:00:00 2001
From: Josua Mayer <josua@solid-run.com>
Date: Tue, 9 Jul 2019 15:01:01 +0200
Subject: [PATCH 0937/1835] net: mvmdio: defer probe of orion-mdio if a clock
 is not ready

[ Upstream commit 433a06d7d74e677c40b1148c70c48677ff62fb6b ]

Defer probing of the orion-mdio interface when getting a clock returns
EPROBE_DEFER. This avoids locking up the Armada 8k SoC when mdio is used
before all clocks have been enabled.

Signed-off-by: Josua Mayer <josua@solid-run.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/mvmdio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index c5dac6bd2be4d..903836e334d87 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -321,6 +321,10 @@ static int orion_mdio_probe(struct platform_device *pdev)
 
 	for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
 		dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
+		if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
+			ret = -EPROBE_DEFER;
+			goto out_clk;
+		}
 		if (IS_ERR(dev->clk[i]))
 			break;
 		clk_prepare_enable(dev->clk[i]);
@@ -362,6 +366,7 @@ out_mdio:
 	if (dev->err_interrupt > 0)
 		writel(0, dev->regs + MVMDIO_ERR_INT_MASK);
 
+out_clk:
 	for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
 		if (IS_ERR(dev->clk[i]))
 			break;
-- 
GitLab


From 7c16c5eae41a9bf8e8580dd64fdb765c22148406 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 19 Jun 2019 15:30:44 +0100
Subject: [PATCH 0938/1835] iavf: fix dereference of null rx_buffer pointer

[ Upstream commit 9fe06a51287b2d41baef7ece94df34b5abf19b90 ]

A recent commit efa14c3985828d ("iavf: allow null RX descriptors") added
a null pointer sanity check on rx_buffer, however, rx_buffer is being
dereferenced before that check, which implies a null pointer dereference
bug can potentially occur.  Fix this by only dereferencing rx_buffer
until after the null pointer check.

Addresses-Coverity: ("Dereference before null check")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index a9730711e2579..b56d22b530a70 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1291,7 +1291,7 @@ static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
 					  struct i40e_rx_buffer *rx_buffer,
 					  unsigned int size)
 {
-	void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+	void *va;
 #if (PAGE_SIZE < 8192)
 	unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
@@ -1301,6 +1301,7 @@ static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
 	struct sk_buff *skb;
 
 	/* prefetch first cache line of first page */
+	va = page_address(rx_buffer->page) + rx_buffer->page_offset;
 	prefetch(va);
 #if L1_CACHE_BYTES < 128
 	prefetch(va + L1_CACHE_BYTES);
@@ -1355,7 +1356,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 				      struct i40e_rx_buffer *rx_buffer,
 				      unsigned int size)
 {
-	void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+	void *va;
 #if (PAGE_SIZE < 8192)
 	unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
@@ -1365,6 +1366,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 	struct sk_buff *skb;
 
 	/* prefetch first cache line of first page */
+	va = page_address(rx_buffer->page) + rx_buffer->page_offset;
 	prefetch(va);
 #if L1_CACHE_BYTES < 128
 	prefetch(va + L1_CACHE_BYTES);
-- 
GitLab


From 6e34fd07484a0622a17b40e0ca89ed451260ef45 Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@ispras.ru>
Date: Fri, 12 Jul 2019 21:55:20 +0300
Subject: [PATCH 0939/1835] floppy: fix div-by-zero in setup_format_params

[ Upstream commit f3554aeb991214cbfafd17d55e2bfddb50282e32 ]

This fixes a divide by zero error in the setup_format_params function of
the floppy driver.

Two consecutive ioctls can trigger the bug: The first one should set the
drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
to become zero.  Next, the floppy format operation should be called.

A floppy disk is not required to be inserted.  An unprivileged user
could trigger the bug if the device is accessible.

The patch checks F_SECT_PER_TRACK for a non-zero value in the
set_geometry function.  The proper check should involve a reasonable
upper limit for the .sect and .rate fields, but it could change the
UAPI.

The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
cancels the formatting operation in case of zero.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/floppy.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index a8de56f1936db..b1425b2186066 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -2119,6 +2119,9 @@ static void setup_format_params(int track)
 	raw_cmd->kernel_data = floppy_track_buffer;
 	raw_cmd->length = 4 * F_SECT_PER_TRACK;
 
+	if (!F_SECT_PER_TRACK)
+		return;
+
 	/* allow for about 30ms for data transport per track */
 	head_shift = (F_SECT_PER_TRACK + 5) / 6;
 
@@ -3243,6 +3246,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 	/* sanity checking for parameters. */
 	if (g->sect <= 0 ||
 	    g->head <= 0 ||
+	    /* check for zero in F_SECT_PER_TRACK */
+	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
 	    /* check if reserved bits are set */
 	    (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
-- 
GitLab


From 5b565f3276f3bafdf912e94ede83430aa604ed08 Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@ispras.ru>
Date: Fri, 12 Jul 2019 21:55:21 +0300
Subject: [PATCH 0940/1835] floppy: fix out-of-bounds read in next_valid_format

[ Upstream commit 5635f897ed83fd539df78e98ba69ee91592f9bb8 ]

This fixes a global out-of-bounds read access in the next_valid_format
function of the floppy driver.

The values from autodetect field of the struct floppy_drive_params are
used as indices for the floppy_type array in the next_valid_format
function 'floppy_type[DP->autodetect[probed_format]].sect'.

To trigger the bug, one could use a value out of range and set the drive
parameters with the FDSETDRVPRM ioctl.  A floppy disk is not required to
be inserted.

CAP_SYS_ADMIN is required to call FDSETDRVPRM.

The patch adds the check for values of the autodetect field to be in the
'0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array indices.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/floppy.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index b1425b2186066..dd49737effbfb 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3391,6 +3391,20 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 	return 0;
 }
 
+static bool valid_floppy_drive_params(const short autodetect[8])
+{
+	size_t floppy_type_size = ARRAY_SIZE(floppy_type);
+	size_t i = 0;
+
+	for (i = 0; i < 8; ++i) {
+		if (autodetect[i] < 0 ||
+		    autodetect[i] >= floppy_type_size)
+			return false;
+	}
+
+	return true;
+}
+
 static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
 		    unsigned long param)
 {
@@ -3517,6 +3531,8 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		SUPBOUND(size, strlen((const char *)outparam) + 1);
 		break;
 	case FDSETDRVPRM:
+		if (!valid_floppy_drive_params(inparam.dp.autodetect))
+			return -EINVAL;
 		*UDP = inparam.dp;
 		break;
 	case FDGETDRVPRM:
@@ -3714,6 +3730,8 @@ static int compat_setdrvprm(int drive,
 		return -EPERM;
 	if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params)))
 		return -EFAULT;
+	if (!valid_floppy_drive_params(v.autodetect))
+		return -EINVAL;
 	mutex_lock(&floppy_mutex);
 	UDP->cmos = v.cmos;
 	UDP->max_dtr = v.max_dtr;
-- 
GitLab


From a9444d9d0f6f47a7894a5762d25f9ed0965188c6 Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@ispras.ru>
Date: Fri, 12 Jul 2019 21:55:22 +0300
Subject: [PATCH 0941/1835] floppy: fix invalid pointer dereference in
 drive_name

[ Upstream commit 9b04609b784027968348796a18f601aed9db3789 ]

This fixes the invalid pointer dereference in the drive_name function of
the floppy driver.

The native_format field of the struct floppy_drive_params is used as
floppy_type array index in the drive_name function.  Thus, the field
should be checked the same way as the autodetect field.

To trigger the bug, one could use a value out of range and set the drive
parameters with the FDSETDRVPRM ioctl.  Next, FDGETDRVTYP ioctl should
be used to call the drive_name.  A floppy disk is not required to be
inserted.

CAP_SYS_ADMIN is required to call FDSETDRVPRM.

The patch adds the check for a value of the native_format field to be in
the '0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array
indices.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/floppy.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index dd49737effbfb..8d69a8af8b788 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3391,7 +3391,8 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 	return 0;
 }
 
-static bool valid_floppy_drive_params(const short autodetect[8])
+static bool valid_floppy_drive_params(const short autodetect[8],
+		int native_format)
 {
 	size_t floppy_type_size = ARRAY_SIZE(floppy_type);
 	size_t i = 0;
@@ -3402,6 +3403,9 @@ static bool valid_floppy_drive_params(const short autodetect[8])
 			return false;
 	}
 
+	if (native_format < 0 || native_format >= floppy_type_size)
+		return false;
+
 	return true;
 }
 
@@ -3531,7 +3535,8 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		SUPBOUND(size, strlen((const char *)outparam) + 1);
 		break;
 	case FDSETDRVPRM:
-		if (!valid_floppy_drive_params(inparam.dp.autodetect))
+		if (!valid_floppy_drive_params(inparam.dp.autodetect,
+				inparam.dp.native_format))
 			return -EINVAL;
 		*UDP = inparam.dp;
 		break;
@@ -3730,7 +3735,7 @@ static int compat_setdrvprm(int drive,
 		return -EPERM;
 	if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params)))
 		return -EFAULT;
-	if (!valid_floppy_drive_params(v.autodetect))
+	if (!valid_floppy_drive_params(v.autodetect, v.native_format))
 		return -EINVAL;
 	mutex_lock(&floppy_mutex);
 	UDP->cmos = v.cmos;
-- 
GitLab


From ff54c44f103825a426e46d08b5d3d76e44791a87 Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@ispras.ru>
Date: Fri, 12 Jul 2019 21:55:23 +0300
Subject: [PATCH 0942/1835] floppy: fix out-of-bounds read in copy_buffer

[ Upstream commit da99466ac243f15fbba65bd261bfc75ffa1532b6 ]

This fixes a global out-of-bounds read access in the copy_buffer
function of the floppy driver.

The FDDEFPRM ioctl allows one to set the geometry of a disk.  The sect
and head fields (unsigned int) of the floppy_drive structure are used to
compute the max_sector (int) in the make_raw_rw_request function.  It is
possible to overflow the max_sector.  Next, max_sector is passed to the
copy_buffer function and used in one of the memcpy calls.

An unprivileged user could trigger the bug if the device is accessible,
but requires a floppy disk to be inserted.

The patch adds the check for the .sect * .head multiplication for not
overflowing in the set_geometry function.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/floppy.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 8d69a8af8b788..4a9a4d12721ae 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3244,8 +3244,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 	int cnt;
 
 	/* sanity checking for parameters. */
-	if (g->sect <= 0 ||
-	    g->head <= 0 ||
+	if ((int)g->sect <= 0 ||
+	    (int)g->head <= 0 ||
+	    /* check for overflow in max_sector */
+	    (int)(g->sect * g->head) <= 0 ||
 	    /* check for zero in F_SECT_PER_TRACK */
 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
-- 
GitLab


From e73db096691e5f2720049502a3794a2a0c6d1b1f Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Wed, 19 Jun 2019 11:00:56 +0200
Subject: [PATCH 0943/1835] xen: let alloc_xenballooned_pages() fail if not
 enough memory free

commit a1078e821b605813b63bf6bca414a85f804d5c66 upstream.

Instead of trying to allocate pages with GFP_USER in
add_ballooned_pages() check the available free memory via
si_mem_available(). GFP_USER is far less limiting memory exhaustion
than the test via si_mem_available().

This will avoid dom0 running out of memory due to excessive foreign
page mappings especially on ARM and on x86 in PVH mode, as those don't
have a pre-ballooned area which can be used for foreign mappings.

As the normal ballooning suffers from the same problem don't balloon
down more than si_mem_available() pages in one iteration. At the same
time limit the default maximum number of retries.

This is part of XSA-300.

Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/balloon.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 7ab6caef599c5..d4e8b717ce2b2 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -527,8 +527,15 @@ static void balloon_process(struct work_struct *work)
 				state = reserve_additional_memory();
 		}
 
-		if (credit < 0)
-			state = decrease_reservation(-credit, GFP_BALLOON);
+		if (credit < 0) {
+			long n_pages;
+
+			n_pages = min(-credit, si_mem_available());
+			state = decrease_reservation(n_pages, GFP_BALLOON);
+			if (state == BP_DONE && n_pages != -credit &&
+			    n_pages < totalreserve_pages)
+				state = BP_EAGAIN;
+		}
 
 		state = update_schedule(state);
 
@@ -567,6 +574,9 @@ static int add_ballooned_pages(int nr_pages)
 		}
 	}
 
+	if (si_mem_available() < nr_pages)
+		return -ENOMEM;
+
 	st = decrease_reservation(nr_pages, GFP_USER);
 	if (st != BP_DONE)
 		return -ENOMEM;
@@ -696,7 +706,7 @@ static int __init balloon_init(void)
 	balloon_stats.schedule_delay = 1;
 	balloon_stats.max_schedule_delay = 32;
 	balloon_stats.retry_count = 1;
-	balloon_stats.max_retry_count = RETRY_UNLIMITED;
+	balloon_stats.max_retry_count = 4;
 
 #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
 	set_online_page_callback(&xen_online_page);
-- 
GitLab


From d91baba81a6e2ddba5e05dfd6f7f770e1368df13 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Thu, 27 Sep 2018 11:17:11 +1000
Subject: [PATCH 0944/1835] scsi: NCR5380: Reduce goto statements in
 NCR5380_select()

commit 6a162836997c10bbefb7c7ca772201cc45c0e4a6 upstream.

Replace a 'goto' statement with a simple 'return' where possible.  This
improves readability. No functional change.

Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/NCR5380.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index 90ea0f5d9bdbb..9e67b83ec0f3e 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -984,7 +984,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 	if (!hostdata->selecting) {
 		/* Command was aborted */
 		NCR5380_write(MODE_REG, MR_BASE);
-		goto out;
+		return NULL;
 	}
 	if (err < 0) {
 		NCR5380_write(MODE_REG, MR_BASE);
@@ -1033,7 +1033,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 	if (!hostdata->selecting) {
 		NCR5380_write(MODE_REG, MR_BASE);
 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
-		goto out;
+		return NULL;
 	}
 
 	dsprintk(NDEBUG_ARBITRATION, instance, "won arbitration\n");
@@ -1116,13 +1116,16 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 		spin_lock_irq(&hostdata->lock);
 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
 		NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+
 		/* Can't touch cmd if it has been reclaimed by the scsi ML */
-		if (hostdata->selecting) {
-			cmd->result = DID_BAD_TARGET << 16;
-			complete_cmd(instance, cmd);
-			dsprintk(NDEBUG_SELECTION, instance, "target did not respond within 250ms\n");
-			cmd = NULL;
-		}
+		if (!hostdata->selecting)
+			return NULL;
+
+		cmd->result = DID_BAD_TARGET << 16;
+		complete_cmd(instance, cmd);
+		dsprintk(NDEBUG_SELECTION, instance,
+			"target did not respond within 250ms\n");
+		cmd = NULL;
 		goto out;
 	}
 
@@ -1155,7 +1158,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 	}
 	if (!hostdata->selecting) {
 		do_abort(instance);
-		goto out;
+		return NULL;
 	}
 
 	dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
-- 
GitLab


From 7cfded7a705c8886a2d309428f35ede2764d930e Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sun, 9 Jun 2019 11:19:11 +1000
Subject: [PATCH 0945/1835] scsi: NCR5380: Always re-enable reselection
 interrupt

commit 57f31326518e98ee4cabf9a04efe00ed57c54147 upstream.

The reselection interrupt gets disabled during selection and must be
re-enabled when hostdata->connected becomes NULL. If it isn't re-enabled a
disconnected command may time-out or the target may wedge the bus while
trying to reselect the host. This can happen after a command is aborted.

Fix this by enabling the reselection interrupt in NCR5380_main() after
calls to NCR5380_select() and NCR5380_information_transfer() return.

Cc: Michael Schmitz <schmitzmic@gmail.com>
Cc: stable@vger.kernel.org # v4.9+
Fixes: 8b00c3d5d40d ("ncr5380: Implement new eh_abort_handler")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/NCR5380.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index 9e67b83ec0f3e..5160d6214a36b 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -710,6 +710,8 @@ static void NCR5380_main(struct work_struct *work)
 			NCR5380_information_transfer(instance);
 			done = 0;
 		}
+		if (!hostdata->connected)
+			NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
 		spin_unlock_irq(&hostdata->lock);
 		if (!done)
 			cond_resched();
@@ -1106,8 +1108,6 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 		spin_lock_irq(&hostdata->lock);
 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
 		NCR5380_reselect(instance);
-		if (!hostdata->connected)
-			NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
 		shost_printk(KERN_ERR, instance, "reselection after won arbitration?\n");
 		goto out;
 	}
@@ -1115,7 +1115,6 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 	if (err < 0) {
 		spin_lock_irq(&hostdata->lock);
 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
-		NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
 
 		/* Can't touch cmd if it has been reclaimed by the scsi ML */
 		if (!hostdata->selecting)
@@ -1153,7 +1152,6 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
 	if (err < 0) {
 		shost_printk(KERN_ERR, instance, "select: REQ timeout\n");
 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
-		NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
 		goto out;
 	}
 	if (!hostdata->selecting) {
@@ -1820,9 +1818,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
 					 */
 					NCR5380_write(TARGET_COMMAND_REG, 0);
 
-					/* Enable reselect interrupts */
-					NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
-
 					maybe_release_dma_irq(instance);
 					return;
 				case MESSAGE_REJECT:
@@ -1854,8 +1849,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
 					 */
 					NCR5380_write(TARGET_COMMAND_REG, 0);
 
-					/* Enable reselect interrupts */
-					NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
 #ifdef SUN3_SCSI_VME
 					dregs->csr |= CSR_DMA_ENABLE;
 #endif
@@ -1957,7 +1950,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
 					cmd->result = DID_ERROR << 16;
 					complete_cmd(instance, cmd);
 					maybe_release_dma_irq(instance);
-					NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
 					return;
 				}
 				msgout = NOP;
-- 
GitLab


From 58f59f6072ab02ad2af0e51f177ec939619e9c57 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sun, 9 Jun 2019 11:19:11 +1000
Subject: [PATCH 0946/1835] Revert "scsi: ncr5380: Increase register polling
 limit"

commit 25fcf94a2fa89dd3e73e965ebb0b38a2a4f72aa4 upstream.

This reverts commit 4822827a69d7cd3bc5a07b7637484ebd2cf88db6.

The purpose of that commit was to suppress a timeout warning message which
appeared to be caused by target latency. But suppressing the warning is
undesirable as the warning may indicate a messed up transfer count.

Another problem with that commit is that 15 ms is too long to keep
interrupts disabled as interrupt latency can cause system clock drift and
other problems.

Cc: Michael Schmitz <schmitzmic@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 4822827a69d7 ("scsi: ncr5380: Increase register polling limit")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/NCR5380.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/NCR5380.h b/drivers/scsi/NCR5380.h
index 31096a0b0fdd3..8a6d002e67894 100644
--- a/drivers/scsi/NCR5380.h
+++ b/drivers/scsi/NCR5380.h
@@ -235,7 +235,7 @@ struct NCR5380_cmd {
 #define NCR5380_PIO_CHUNK_SIZE		256
 
 /* Time limit (ms) to poll registers when IRQs are disabled, e.g. during PDMA */
-#define NCR5380_REG_POLL_TIME		15
+#define NCR5380_REG_POLL_TIME		10
 
 static inline struct scsi_cmnd *NCR5380_to_scmd(struct NCR5380_cmd *ncmd_ptr)
 {
-- 
GitLab


From 1334a3e2d6d03afa49590db9b7d2506d5ebd39de Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Fri, 12 Jul 2019 10:08:19 +0800
Subject: [PATCH 0947/1835] scsi: core: Fix race on creating sense cache

commit f9b0530fa02e0c73f31a49ef743e8f44eb8e32cc upstream.

When scsi_init_sense_cache(host) is called concurrently from different
hosts, each code path may find that no cache has been created and
allocate a new one. The lack of locking can lead to potentially
overriding a cache allocated by a different host.

Fix the issue by moving 'mutex_lock(&scsi_sense_cache_mutex)' before
scsi_select_sense_cache().

Fixes: 0a6ac4ee7c21 ("scsi: respect unchecked_isa_dma for blk-mq")
Cc: Stable <stable@vger.kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_lib.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 1fc832751a4fb..32652b2c5e7cb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -71,11 +71,11 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
 	struct kmem_cache *cache;
 	int ret = 0;
 
+	mutex_lock(&scsi_sense_cache_mutex);
 	cache = scsi_select_sense_cache(shost->unchecked_isa_dma);
 	if (cache)
-		return 0;
+		goto exit;
 
-	mutex_lock(&scsi_sense_cache_mutex);
 	if (shost->unchecked_isa_dma) {
 		scsi_sense_isadma_cache =
 			kmem_cache_create("scsi_sense_cache(DMA)",
@@ -91,7 +91,7 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
 		if (!scsi_sense_cache)
 			ret = -ENOMEM;
 	}
-
+ exit:
 	mutex_unlock(&scsi_sense_cache_mutex);
 	return ret;
 }
-- 
GitLab


From 3e9534fa50463bfc7cd98bea2d0f933e94fbdb21 Mon Sep 17 00:00:00 2001
From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Date: Fri, 28 Jun 2019 18:02:12 -0700
Subject: [PATCH 0948/1835] scsi: megaraid_sas: Fix calculation of target ID

commit c8f96df5b8e633056b7ebf5d52a9d6fb1b156ce3 upstream.

In megasas_get_target_prop(), driver is incorrectly calculating the target
ID for devices with channel 1 and 3.  Due to this, firmware will either
fail the command (if there is no device with the target id sent from
driver) or could return the properties for a target which was not
intended.  Devices could end up with the wrong queue depth due to this.

Fix target id calculation for channel 1 and 3.

Fixes: 96188a89cc6d ("scsi: megaraid_sas: NVME interface target prop added")
Cc: stable@vger.kernel.org
Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index acb503ea8f0c4..e0c87228438d3 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5862,7 +5862,8 @@ megasas_get_target_prop(struct megasas_instance *instance,
 	int ret;
 	struct megasas_cmd *cmd;
 	struct megasas_dcmd_frame *dcmd;
-	u16 targetId = (sdev->channel % 2) + sdev->id;
+	u16 targetId = ((sdev->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) +
+			sdev->id;
 
 	cmd = megasas_get_cmd(instance);
 
-- 
GitLab


From de769c762626b36595624f4e6f38b8ee614c9636 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sun, 9 Jun 2019 11:19:11 +1000
Subject: [PATCH 0949/1835] scsi: mac_scsi: Increase PIO/PDMA transfer length
 threshold

commit 7398cee4c3e6aea1ba07a6449e5533ecd0b92cdd upstream.

Some targets introduce delays when handshaking the response to certain
commands. For example, a disk may send a 96-byte response to an INQUIRY
command (or a 24-byte response to a MODE SENSE command) too slowly.

Apparently the first 12 or 14 bytes are handshaked okay but then the system
bus error timeout is reached while transferring the next word.

Since the scsi bus phase hasn't changed, the driver then sets the target
borken flag to prevent further PDMA transfers. The driver also logs the
warning, "switching to slow handshake".

Raise the PDMA threshold to 512 bytes so that PIO transfers will be used
for these commands. This default is sufficiently low that PDMA will still
be used for READ and WRITE commands.

The existing threshold (16 bytes) was chosen more or less at random.
However, best performance requires the threshold to be as low as possible.
Those systems that don't need the PIO workaround at all may benefit from
mac_scsi.setup_use_pdma=1

Cc: Michael Schmitz <schmitzmic@gmail.com>
Cc: stable@vger.kernel.org # v4.14+
Fixes: 3a0f64bfa907 ("mac_scsi: Fix pseudo DMA implementation")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/mac_scsi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
index dd6057359d7c6..c80fb498a61ef 100644
--- a/drivers/scsi/mac_scsi.c
+++ b/drivers/scsi/mac_scsi.c
@@ -52,7 +52,7 @@ static int setup_cmd_per_lun = -1;
 module_param(setup_cmd_per_lun, int, 0);
 static int setup_sg_tablesize = -1;
 module_param(setup_sg_tablesize, int, 0);
-static int setup_use_pdma = -1;
+static int setup_use_pdma = 512;
 module_param(setup_use_pdma, int, 0);
 static int setup_hostid = -1;
 module_param(setup_hostid, int, 0);
@@ -305,7 +305,7 @@ static int macscsi_dma_xfer_len(struct NCR5380_hostdata *hostdata,
                                 struct scsi_cmnd *cmd)
 {
 	if (hostdata->flags & FLAG_NO_PSEUDO_DMA ||
-	    cmd->SCp.this_residual < 16)
+	    cmd->SCp.this_residual < setup_use_pdma)
 		return 0;
 
 	return cmd->SCp.this_residual;
-- 
GitLab


From ce7ec07abaf7d66eaaa5fca9cb5a15db3f8974f9 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sun, 9 Jun 2019 11:19:11 +1000
Subject: [PATCH 0950/1835] scsi: mac_scsi: Fix pseudo DMA implementation, take
 2

commit 78ff751f8e6a9446e9fb26b2bff0b8d3f8974cbd upstream.

A system bus error during a PDMA transfer can mess up the calculation of
the transfer residual (the PDMA handshaking hardware lacks a byte
counter). This results in data corruption.

The algorithm in this patch anticipates a bus error by starting each
transfer with a MOVE.B instruction. If a bus error is caught the transfer
will be retried. If a bus error is caught later in the transfer (for a
MOVE.W instruction) the transfer gets failed and subsequent requests for
that target will use PIO instead of PDMA.

This avoids the "!REQ and !ACK" error so the severity level of that message
is reduced to KERN_DEBUG.

Cc: Michael Schmitz <schmitzmic@gmail.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: stable@vger.kernel.org # v4.14+
Fixes: 3a0f64bfa907 ("mac_scsi: Fix pseudo DMA implementation")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Reported-by: Chris Jones <chris@martin-jones.com>
Tested-by: Stan Johnson <userm57@yahoo.com>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/mac_scsi.c | 371 +++++++++++++++++++++++-----------------
 1 file changed, 218 insertions(+), 153 deletions(-)

diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
index c80fb498a61ef..643321fc152dd 100644
--- a/drivers/scsi/mac_scsi.c
+++ b/drivers/scsi/mac_scsi.c
@@ -3,6 +3,8 @@
  *
  * Copyright 1998, Michael Schmitz <mschmitz@lbl.gov>
  *
+ * Copyright 2019 Finn Thain
+ *
  * derived in part from:
  */
 /*
@@ -11,6 +13,7 @@
  * Copyright 1995, Russell King
  */
 
+#include <linux/delay.h>
 #include <linux/types.h>
 #include <linux/module.h>
 #include <linux/ioport.h>
@@ -89,101 +92,217 @@ static int __init mac_scsi_setup(char *str)
 __setup("mac5380=", mac_scsi_setup);
 #endif /* !MODULE */
 
-/* Pseudo DMA asm originally by Ove Edlund */
-
-#define CP_IO_TO_MEM(s,d,n)				\
-__asm__ __volatile__					\
-    ("    cmp.w  #4,%2\n"				\
-     "    bls    8f\n"					\
-     "    move.w %1,%%d0\n"				\
-     "    neg.b  %%d0\n"				\
-     "    and.w  #3,%%d0\n"				\
-     "    sub.w  %%d0,%2\n"				\
-     "    bra    2f\n"					\
-     " 1: move.b (%0),(%1)+\n"				\
-     " 2: dbf    %%d0,1b\n"				\
-     "    move.w %2,%%d0\n"				\
-     "    lsr.w  #5,%%d0\n"				\
-     "    bra    4f\n"					\
-     " 3: move.l (%0),(%1)+\n"				\
-     "31: move.l (%0),(%1)+\n"				\
-     "32: move.l (%0),(%1)+\n"				\
-     "33: move.l (%0),(%1)+\n"				\
-     "34: move.l (%0),(%1)+\n"				\
-     "35: move.l (%0),(%1)+\n"				\
-     "36: move.l (%0),(%1)+\n"				\
-     "37: move.l (%0),(%1)+\n"				\
-     " 4: dbf    %%d0,3b\n"				\
-     "    move.w %2,%%d0\n"				\
-     "    lsr.w  #2,%%d0\n"				\
-     "    and.w  #7,%%d0\n"				\
-     "    bra    6f\n"					\
-     " 5: move.l (%0),(%1)+\n"				\
-     " 6: dbf    %%d0,5b\n"				\
-     "    and.w  #3,%2\n"				\
-     "    bra    8f\n"					\
-     " 7: move.b (%0),(%1)+\n"				\
-     " 8: dbf    %2,7b\n"				\
-     "    moveq.l #0, %2\n"				\
-     " 9: \n"						\
-     ".section .fixup,\"ax\"\n"				\
-     "    .even\n"					\
-     "91: moveq.l #1, %2\n"				\
-     "    jra 9b\n"					\
-     "94: moveq.l #4, %2\n"				\
-     "    jra 9b\n"					\
-     ".previous\n"					\
-     ".section __ex_table,\"a\"\n"			\
-     "   .align 4\n"					\
-     "   .long  1b,91b\n"				\
-     "   .long  3b,94b\n"				\
-     "   .long 31b,94b\n"				\
-     "   .long 32b,94b\n"				\
-     "   .long 33b,94b\n"				\
-     "   .long 34b,94b\n"				\
-     "   .long 35b,94b\n"				\
-     "   .long 36b,94b\n"				\
-     "   .long 37b,94b\n"				\
-     "   .long  5b,94b\n"				\
-     "   .long  7b,91b\n"				\
-     ".previous"					\
-     : "=a"(s), "=a"(d), "=d"(n)			\
-     : "0"(s), "1"(d), "2"(n)				\
-     : "d0")
+/*
+ * According to "Inside Macintosh: Devices", Mac OS requires disk drivers to
+ * specify the number of bytes between the delays expected from a SCSI target.
+ * This allows the operating system to "prevent bus errors when a target fails
+ * to deliver the next byte within the processor bus error timeout period."
+ * Linux SCSI drivers lack knowledge of the timing behaviour of SCSI targets
+ * so bus errors are unavoidable.
+ *
+ * If a MOVE.B instruction faults, we assume that zero bytes were transferred
+ * and simply retry. That assumption probably depends on target behaviour but
+ * seems to hold up okay. The NOP provides synchronization: without it the
+ * fault can sometimes occur after the program counter has moved past the
+ * offending instruction. Post-increment addressing can't be used.
+ */
+
+#define MOVE_BYTE(operands) \
+	asm volatile ( \
+		"1:     moveb " operands "     \n" \
+		"11:    nop                    \n" \
+		"       addq #1,%0             \n" \
+		"       subq #1,%1             \n" \
+		"40:                           \n" \
+		"                              \n" \
+		".section .fixup,\"ax\"        \n" \
+		".even                         \n" \
+		"90:    movel #1, %2           \n" \
+		"       jra 40b                \n" \
+		".previous                     \n" \
+		"                              \n" \
+		".section __ex_table,\"a\"     \n" \
+		".align  4                     \n" \
+		".long   1b,90b                \n" \
+		".long  11b,90b                \n" \
+		".previous                     \n" \
+		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
+
+/*
+ * If a MOVE.W (or MOVE.L) instruction faults, it cannot be retried because
+ * the residual byte count would be uncertain. In that situation the MOVE_WORD
+ * macro clears n in the fixup section to abort the transfer.
+ */
+
+#define MOVE_WORD(operands) \
+	asm volatile ( \
+		"1:     movew " operands "     \n" \
+		"11:    nop                    \n" \
+		"       subq #2,%1             \n" \
+		"40:                           \n" \
+		"                              \n" \
+		".section .fixup,\"ax\"        \n" \
+		".even                         \n" \
+		"90:    movel #0, %1           \n" \
+		"       movel #2, %2           \n" \
+		"       jra 40b                \n" \
+		".previous                     \n" \
+		"                              \n" \
+		".section __ex_table,\"a\"     \n" \
+		".align  4                     \n" \
+		".long   1b,90b                \n" \
+		".long  11b,90b                \n" \
+		".previous                     \n" \
+		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
+
+#define MOVE_16_WORDS(operands) \
+	asm volatile ( \
+		"1:     movew " operands "     \n" \
+		"2:     movew " operands "     \n" \
+		"3:     movew " operands "     \n" \
+		"4:     movew " operands "     \n" \
+		"5:     movew " operands "     \n" \
+		"6:     movew " operands "     \n" \
+		"7:     movew " operands "     \n" \
+		"8:     movew " operands "     \n" \
+		"9:     movew " operands "     \n" \
+		"10:    movew " operands "     \n" \
+		"11:    movew " operands "     \n" \
+		"12:    movew " operands "     \n" \
+		"13:    movew " operands "     \n" \
+		"14:    movew " operands "     \n" \
+		"15:    movew " operands "     \n" \
+		"16:    movew " operands "     \n" \
+		"17:    nop                    \n" \
+		"       subl  #32,%1           \n" \
+		"40:                           \n" \
+		"                              \n" \
+		".section .fixup,\"ax\"        \n" \
+		".even                         \n" \
+		"90:    movel #0, %1           \n" \
+		"       movel #2, %2           \n" \
+		"       jra 40b                \n" \
+		".previous                     \n" \
+		"                              \n" \
+		".section __ex_table,\"a\"     \n" \
+		".align  4                     \n" \
+		".long   1b,90b                \n" \
+		".long   2b,90b                \n" \
+		".long   3b,90b                \n" \
+		".long   4b,90b                \n" \
+		".long   5b,90b                \n" \
+		".long   6b,90b                \n" \
+		".long   7b,90b                \n" \
+		".long   8b,90b                \n" \
+		".long   9b,90b                \n" \
+		".long  10b,90b                \n" \
+		".long  11b,90b                \n" \
+		".long  12b,90b                \n" \
+		".long  13b,90b                \n" \
+		".long  14b,90b                \n" \
+		".long  15b,90b                \n" \
+		".long  16b,90b                \n" \
+		".long  17b,90b                \n" \
+		".previous                     \n" \
+		: "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
+
+#define MAC_PDMA_DELAY		32
+
+static inline int mac_pdma_recv(void __iomem *io, unsigned char *start, int n)
+{
+	unsigned char *addr = start;
+	int result = 0;
+
+	if (n >= 1) {
+		MOVE_BYTE("%3@,%0@");
+		if (result)
+			goto out;
+	}
+	if (n >= 1 && ((unsigned long)addr & 1)) {
+		MOVE_BYTE("%3@,%0@");
+		if (result)
+			goto out;
+	}
+	while (n >= 32)
+		MOVE_16_WORDS("%3@,%0@+");
+	while (n >= 2)
+		MOVE_WORD("%3@,%0@+");
+	if (result)
+		return start - addr; /* Negated to indicate uncertain length */
+	if (n == 1)
+		MOVE_BYTE("%3@,%0@");
+out:
+	return addr - start;
+}
+
+static inline int mac_pdma_send(unsigned char *start, void __iomem *io, int n)
+{
+	unsigned char *addr = start;
+	int result = 0;
+
+	if (n >= 1) {
+		MOVE_BYTE("%0@,%3@");
+		if (result)
+			goto out;
+	}
+	if (n >= 1 && ((unsigned long)addr & 1)) {
+		MOVE_BYTE("%0@,%3@");
+		if (result)
+			goto out;
+	}
+	while (n >= 32)
+		MOVE_16_WORDS("%0@+,%3@");
+	while (n >= 2)
+		MOVE_WORD("%0@+,%3@");
+	if (result)
+		return start - addr; /* Negated to indicate uncertain length */
+	if (n == 1)
+		MOVE_BYTE("%0@,%3@");
+out:
+	return addr - start;
+}
 
 static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
                                 unsigned char *dst, int len)
 {
 	u8 __iomem *s = hostdata->pdma_io + (INPUT_DATA_REG << 4);
 	unsigned char *d = dst;
-	int n = len;
-	int transferred;
+
+	hostdata->pdma_residual = len;
 
 	while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
 	                              BASR_DRQ | BASR_PHASE_MATCH,
 	                              BASR_DRQ | BASR_PHASE_MATCH, HZ / 64)) {
-		CP_IO_TO_MEM(s, d, n);
+		int bytes;
 
-		transferred = d - dst - n;
-		hostdata->pdma_residual = len - transferred;
+		bytes = mac_pdma_recv(s, d, min(hostdata->pdma_residual, 512));
 
-		/* No bus error. */
-		if (n == 0)
+		if (bytes > 0) {
+			d += bytes;
+			hostdata->pdma_residual -= bytes;
+		}
+
+		if (hostdata->pdma_residual == 0)
 			return 0;
 
-		/* Target changed phase early? */
 		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
-		                           BUS_AND_STATUS_REG, BASR_ACK, BASR_ACK, HZ / 64) < 0)
-			scmd_printk(KERN_ERR, hostdata->connected,
+		                           BUS_AND_STATUS_REG, BASR_ACK,
+		                           BASR_ACK, HZ / 64) < 0)
+			scmd_printk(KERN_DEBUG, hostdata->connected,
 			            "%s: !REQ and !ACK\n", __func__);
 		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
 			return 0;
 
+		if (bytes == 0)
+			udelay(MAC_PDMA_DELAY);
+
+		if (bytes >= 0)
+			continue;
+
 		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
-		         "%s: bus error (%d/%d)\n", __func__, transferred, len);
+		         "%s: bus error (%d/%d)\n", __func__, d - dst, len);
 		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-		d = dst + transferred;
-		n = len - transferred;
+		return -1;
 	}
 
 	scmd_printk(KERN_ERR, hostdata->connected,
@@ -192,93 +311,27 @@ static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
 	return -1;
 }
 
-
-#define CP_MEM_TO_IO(s,d,n)				\
-__asm__ __volatile__					\
-    ("    cmp.w  #4,%2\n"				\
-     "    bls    8f\n"					\
-     "    move.w %0,%%d0\n"				\
-     "    neg.b  %%d0\n"				\
-     "    and.w  #3,%%d0\n"				\
-     "    sub.w  %%d0,%2\n"				\
-     "    bra    2f\n"					\
-     " 1: move.b (%0)+,(%1)\n"				\
-     " 2: dbf    %%d0,1b\n"				\
-     "    move.w %2,%%d0\n"				\
-     "    lsr.w  #5,%%d0\n"				\
-     "    bra    4f\n"					\
-     " 3: move.l (%0)+,(%1)\n"				\
-     "31: move.l (%0)+,(%1)\n"				\
-     "32: move.l (%0)+,(%1)\n"				\
-     "33: move.l (%0)+,(%1)\n"				\
-     "34: move.l (%0)+,(%1)\n"				\
-     "35: move.l (%0)+,(%1)\n"				\
-     "36: move.l (%0)+,(%1)\n"				\
-     "37: move.l (%0)+,(%1)\n"				\
-     " 4: dbf    %%d0,3b\n"				\
-     "    move.w %2,%%d0\n"				\
-     "    lsr.w  #2,%%d0\n"				\
-     "    and.w  #7,%%d0\n"				\
-     "    bra    6f\n"					\
-     " 5: move.l (%0)+,(%1)\n"				\
-     " 6: dbf    %%d0,5b\n"				\
-     "    and.w  #3,%2\n"				\
-     "    bra    8f\n"					\
-     " 7: move.b (%0)+,(%1)\n"				\
-     " 8: dbf    %2,7b\n"				\
-     "    moveq.l #0, %2\n"				\
-     " 9: \n"						\
-     ".section .fixup,\"ax\"\n"				\
-     "    .even\n"					\
-     "91: moveq.l #1, %2\n"				\
-     "    jra 9b\n"					\
-     "94: moveq.l #4, %2\n"				\
-     "    jra 9b\n"					\
-     ".previous\n"					\
-     ".section __ex_table,\"a\"\n"			\
-     "   .align 4\n"					\
-     "   .long  1b,91b\n"				\
-     "   .long  3b,94b\n"				\
-     "   .long 31b,94b\n"				\
-     "   .long 32b,94b\n"				\
-     "   .long 33b,94b\n"				\
-     "   .long 34b,94b\n"				\
-     "   .long 35b,94b\n"				\
-     "   .long 36b,94b\n"				\
-     "   .long 37b,94b\n"				\
-     "   .long  5b,94b\n"				\
-     "   .long  7b,91b\n"				\
-     ".previous"					\
-     : "=a"(s), "=a"(d), "=d"(n)			\
-     : "0"(s), "1"(d), "2"(n)				\
-     : "d0")
-
 static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
                                  unsigned char *src, int len)
 {
 	unsigned char *s = src;
 	u8 __iomem *d = hostdata->pdma_io + (OUTPUT_DATA_REG << 4);
-	int n = len;
-	int transferred;
+
+	hostdata->pdma_residual = len;
 
 	while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
 	                              BASR_DRQ | BASR_PHASE_MATCH,
 	                              BASR_DRQ | BASR_PHASE_MATCH, HZ / 64)) {
-		CP_MEM_TO_IO(s, d, n);
+		int bytes;
 
-		transferred = s - src - n;
-		hostdata->pdma_residual = len - transferred;
+		bytes = mac_pdma_send(s, d, min(hostdata->pdma_residual, 512));
 
-		/* Target changed phase early? */
-		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
-		                           BUS_AND_STATUS_REG, BASR_ACK, BASR_ACK, HZ / 64) < 0)
-			scmd_printk(KERN_ERR, hostdata->connected,
-			            "%s: !REQ and !ACK\n", __func__);
-		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
-			return 0;
+		if (bytes > 0) {
+			s += bytes;
+			hostdata->pdma_residual -= bytes;
+		}
 
-		/* No bus error. */
-		if (n == 0) {
+		if (hostdata->pdma_residual == 0) {
 			if (NCR5380_poll_politely(hostdata, TARGET_COMMAND_REG,
 			                          TCR_LAST_BYTE_SENT,
 			                          TCR_LAST_BYTE_SENT, HZ / 64) < 0)
@@ -287,17 +340,29 @@ static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
 			return 0;
 		}
 
+		if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
+		                           BUS_AND_STATUS_REG, BASR_ACK,
+		                           BASR_ACK, HZ / 64) < 0)
+			scmd_printk(KERN_DEBUG, hostdata->connected,
+			            "%s: !REQ and !ACK\n", __func__);
+		if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
+			return 0;
+
+		if (bytes == 0)
+			udelay(MAC_PDMA_DELAY);
+
+		if (bytes >= 0)
+			continue;
+
 		dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
-		         "%s: bus error (%d/%d)\n", __func__, transferred, len);
+		         "%s: bus error (%d/%d)\n", __func__, s - src, len);
 		NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-		s = src + transferred;
-		n = len - transferred;
+		return -1;
 	}
 
 	scmd_printk(KERN_ERR, hostdata->connected,
 	            "%s: phase mismatch or !DRQ\n", __func__);
 	NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
-
 	return -1;
 }
 
-- 
GitLab


From bed97f6469974aecf3db3874e2cfcf5ae4d14018 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Thu, 30 May 2019 10:50:39 -0700
Subject: [PATCH 0951/1835] crypto: ghash - fix unaligned memory access in
 ghash_setkey()

commit 5c6bc4dfa515738149998bb0db2481a4fdead979 upstream.

Changing ghash_mod_init() to be subsys_initcall made it start running
before the alignment fault handler has been installed on ARM.  In kernel
builds where the keys in the ghash test vectors happened to be
misaligned in the kernel image, this exposed the longstanding bug that
ghash_setkey() is incorrectly casting the key buffer (which can have any
alignment) to be128 for passing to gf128mul_init_4k_lle().

Fix this by memcpy()ing the key to a temporary buffer.

Don't fix it by setting an alignmask on the algorithm instead because
that would unnecessarily force alignment of the data too.

Fixes: 2cdc6899a88e ("crypto: ghash - Add GHASH digest algorithm for GCM")
Reported-by: Peter Robinson <pbrobinson@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 crypto/ghash-generic.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
index d9f192b953b22..591b52d3bdca3 100644
--- a/crypto/ghash-generic.c
+++ b/crypto/ghash-generic.c
@@ -34,6 +34,7 @@ static int ghash_setkey(struct crypto_shash *tfm,
 			const u8 *key, unsigned int keylen)
 {
 	struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
+	be128 k;
 
 	if (keylen != GHASH_BLOCK_SIZE) {
 		crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
@@ -42,7 +43,12 @@ static int ghash_setkey(struct crypto_shash *tfm,
 
 	if (ctx->gf128)
 		gf128mul_free_4k(ctx->gf128);
-	ctx->gf128 = gf128mul_init_4k_lle((be128 *)key);
+
+	BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
+	memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
+	ctx->gf128 = gf128mul_init_4k_lle(&k);
+	memzero_explicit(&k, GHASH_BLOCK_SIZE);
+
 	if (!ctx->gf128)
 		return -ENOMEM;
 
-- 
GitLab


From 52f07c1ac70e2ed0f9f49baf7e55d501364f6019 Mon Sep 17 00:00:00 2001
From: "Hook, Gary" <Gary.Hook@amd.com>
Date: Thu, 27 Jun 2019 16:16:23 +0000
Subject: [PATCH 0952/1835] crypto: ccp - Validate the the error value used to
 index error messages

commit 52393d617af7b554f03531e6756facf2ea687d2e upstream.

The error code read from the queue status register is only 6 bits wide,
but we need to verify its value is within range before indexing the error
messages.

Fixes: 81422badb3907 ("crypto: ccp - Make syslog errors human-readable")
Cc: <stable@vger.kernel.org>
Reported-by: Cfir Cohen <cfir@google.com>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-dev.c | 96 +++++++++++++++++++-----------------
 drivers/crypto/ccp/ccp-dev.h |  2 +-
 2 files changed, 52 insertions(+), 46 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
index 1b5035d562880..9b6d8972a5650 100644
--- a/drivers/crypto/ccp/ccp-dev.c
+++ b/drivers/crypto/ccp/ccp-dev.c
@@ -35,56 +35,62 @@ struct ccp_tasklet_data {
 };
 
 /* Human-readable error strings */
+#define CCP_MAX_ERROR_CODE	64
 static char *ccp_error_codes[] = {
 	"",
-	"ERR 01: ILLEGAL_ENGINE",
-	"ERR 02: ILLEGAL_KEY_ID",
-	"ERR 03: ILLEGAL_FUNCTION_TYPE",
-	"ERR 04: ILLEGAL_FUNCTION_MODE",
-	"ERR 05: ILLEGAL_FUNCTION_ENCRYPT",
-	"ERR 06: ILLEGAL_FUNCTION_SIZE",
-	"ERR 07: Zlib_MISSING_INIT_EOM",
-	"ERR 08: ILLEGAL_FUNCTION_RSVD",
-	"ERR 09: ILLEGAL_BUFFER_LENGTH",
-	"ERR 10: VLSB_FAULT",
-	"ERR 11: ILLEGAL_MEM_ADDR",
-	"ERR 12: ILLEGAL_MEM_SEL",
-	"ERR 13: ILLEGAL_CONTEXT_ID",
-	"ERR 14: ILLEGAL_KEY_ADDR",
-	"ERR 15: 0xF Reserved",
-	"ERR 16: Zlib_ILLEGAL_MULTI_QUEUE",
-	"ERR 17: Zlib_ILLEGAL_JOBID_CHANGE",
-	"ERR 18: CMD_TIMEOUT",
-	"ERR 19: IDMA0_AXI_SLVERR",
-	"ERR 20: IDMA0_AXI_DECERR",
-	"ERR 21: 0x15 Reserved",
-	"ERR 22: IDMA1_AXI_SLAVE_FAULT",
-	"ERR 23: IDMA1_AIXI_DECERR",
-	"ERR 24: 0x18 Reserved",
-	"ERR 25: ZLIBVHB_AXI_SLVERR",
-	"ERR 26: ZLIBVHB_AXI_DECERR",
-	"ERR 27: 0x1B Reserved",
-	"ERR 27: ZLIB_UNEXPECTED_EOM",
-	"ERR 27: ZLIB_EXTRA_DATA",
-	"ERR 30: ZLIB_BTYPE",
-	"ERR 31: ZLIB_UNDEFINED_SYMBOL",
-	"ERR 32: ZLIB_UNDEFINED_DISTANCE_S",
-	"ERR 33: ZLIB_CODE_LENGTH_SYMBOL",
-	"ERR 34: ZLIB _VHB_ILLEGAL_FETCH",
-	"ERR 35: ZLIB_UNCOMPRESSED_LEN",
-	"ERR 36: ZLIB_LIMIT_REACHED",
-	"ERR 37: ZLIB_CHECKSUM_MISMATCH0",
-	"ERR 38: ODMA0_AXI_SLVERR",
-	"ERR 39: ODMA0_AXI_DECERR",
-	"ERR 40: 0x28 Reserved",
-	"ERR 41: ODMA1_AXI_SLVERR",
-	"ERR 42: ODMA1_AXI_DECERR",
-	"ERR 43: LSB_PARITY_ERR",
+	"ILLEGAL_ENGINE",
+	"ILLEGAL_KEY_ID",
+	"ILLEGAL_FUNCTION_TYPE",
+	"ILLEGAL_FUNCTION_MODE",
+	"ILLEGAL_FUNCTION_ENCRYPT",
+	"ILLEGAL_FUNCTION_SIZE",
+	"Zlib_MISSING_INIT_EOM",
+	"ILLEGAL_FUNCTION_RSVD",
+	"ILLEGAL_BUFFER_LENGTH",
+	"VLSB_FAULT",
+	"ILLEGAL_MEM_ADDR",
+	"ILLEGAL_MEM_SEL",
+	"ILLEGAL_CONTEXT_ID",
+	"ILLEGAL_KEY_ADDR",
+	"0xF Reserved",
+	"Zlib_ILLEGAL_MULTI_QUEUE",
+	"Zlib_ILLEGAL_JOBID_CHANGE",
+	"CMD_TIMEOUT",
+	"IDMA0_AXI_SLVERR",
+	"IDMA0_AXI_DECERR",
+	"0x15 Reserved",
+	"IDMA1_AXI_SLAVE_FAULT",
+	"IDMA1_AIXI_DECERR",
+	"0x18 Reserved",
+	"ZLIBVHB_AXI_SLVERR",
+	"ZLIBVHB_AXI_DECERR",
+	"0x1B Reserved",
+	"ZLIB_UNEXPECTED_EOM",
+	"ZLIB_EXTRA_DATA",
+	"ZLIB_BTYPE",
+	"ZLIB_UNDEFINED_SYMBOL",
+	"ZLIB_UNDEFINED_DISTANCE_S",
+	"ZLIB_CODE_LENGTH_SYMBOL",
+	"ZLIB _VHB_ILLEGAL_FETCH",
+	"ZLIB_UNCOMPRESSED_LEN",
+	"ZLIB_LIMIT_REACHED",
+	"ZLIB_CHECKSUM_MISMATCH0",
+	"ODMA0_AXI_SLVERR",
+	"ODMA0_AXI_DECERR",
+	"0x28 Reserved",
+	"ODMA1_AXI_SLVERR",
+	"ODMA1_AXI_DECERR",
 };
 
-void ccp_log_error(struct ccp_device *d, int e)
+void ccp_log_error(struct ccp_device *d, unsigned int e)
 {
-	dev_err(d->dev, "CCP error: %s (0x%x)\n", ccp_error_codes[e], e);
+	if (WARN_ON(e >= CCP_MAX_ERROR_CODE))
+		return;
+
+	if (e < ARRAY_SIZE(ccp_error_codes))
+		dev_err(d->dev, "CCP error %d: %s\n", e, ccp_error_codes[e]);
+	else
+		dev_err(d->dev, "CCP error %d: Unknown Error\n", e);
 }
 
 /* List of CCPs, CCP count, read-write access lock, and access functions
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 6810b65c1939c..7442b0422f8ac 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -632,7 +632,7 @@ struct ccp5_desc {
 void ccp_add_device(struct ccp_device *ccp);
 void ccp_del_device(struct ccp_device *ccp);
 
-extern void ccp_log_error(struct ccp_device *, int);
+extern void ccp_log_error(struct ccp_device *, unsigned int);
 
 struct ccp_device *ccp_alloc_struct(struct sp_device *sp);
 bool ccp_queues_suspended(struct ccp_device *ccp);
-- 
GitLab


From 4230e09e61e6dada0e9d1eec4cd9b008d40647a9 Mon Sep 17 00:00:00 2001
From: Elena Petrova <lenaptr@google.com>
Date: Tue, 28 May 2019 13:41:52 +0100
Subject: [PATCH 0953/1835] crypto: arm64/sha1-ce - correct digest for empty
 data in finup

commit 1d4aaf16defa86d2665ae7db0259d6cb07e2091f upstream.

The sha1-ce finup implementation for ARM64 produces wrong digest
for empty input (len=0). Expected: da39a3ee..., result: 67452301...
(initial value of SHA internal state). The error is in sha1_ce_finup:
for empty data `finalize` will be 1, so the code is relying on
sha1_ce_transform to make the final round. However, in
sha1_base_do_update, the block function will not be called when
len == 0.

Fix it by setting finalize to 0 if data is empty.

Fixes: 07eb54d306f4 ("crypto: arm64/sha1-ce - move SHA-1 ARMv8 implementation to base layer")
Cc: stable@vger.kernel.org
Signed-off-by: Elena Petrova <lenaptr@google.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/crypto/sha1-ce-glue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c
index 17fac2889f56e..d8c521c757e83 100644
--- a/arch/arm64/crypto/sha1-ce-glue.c
+++ b/arch/arm64/crypto/sha1-ce-glue.c
@@ -54,7 +54,7 @@ static int sha1_ce_finup(struct shash_desc *desc, const u8 *data,
 			 unsigned int len, u8 *out)
 {
 	struct sha1_ce_state *sctx = shash_desc_ctx(desc);
-	bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE);
+	bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE) && len;
 
 	if (!may_use_simd())
 		return crypto_sha1_finup(desc, data, len, out);
-- 
GitLab


From eb99c084da2801d35108d6f80b8ac666f141c56b Mon Sep 17 00:00:00 2001
From: Elena Petrova <lenaptr@google.com>
Date: Tue, 28 May 2019 15:35:06 +0100
Subject: [PATCH 0954/1835] crypto: arm64/sha2-ce - correct digest for empty
 data in finup

commit 6bd934de1e393466b319d29c4427598fda096c57 upstream.

The sha256-ce finup implementation for ARM64 produces wrong digest
for empty input (len=0). Expected: the actual digest, result: initial
value of SHA internal state. The error is in sha256_ce_finup:
for empty data `finalize` will be 1, so the code is relying on
sha2_ce_transform to make the final round. However, in
sha256_base_do_update, the block function will not be called when
len == 0.

Fix it by setting finalize to 0 if data is empty.

Fixes: 03802f6a80b3a ("crypto: arm64/sha2-ce - move SHA-224/256 ARMv8 implementation to base layer")
Cc: stable@vger.kernel.org
Signed-off-by: Elena Petrova <lenaptr@google.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/crypto/sha2-ce-glue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c
index 261f5195cab74..c47d1a28ff6bb 100644
--- a/arch/arm64/crypto/sha2-ce-glue.c
+++ b/arch/arm64/crypto/sha2-ce-glue.c
@@ -59,7 +59,7 @@ static int sha256_ce_finup(struct shash_desc *desc, const u8 *data,
 			   unsigned int len, u8 *out)
 {
 	struct sha256_ce_state *sctx = shash_desc_ctx(desc);
-	bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE);
+	bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE) && len;
 
 	if (!may_use_simd()) {
 		if (len)
-- 
GitLab


From 1c9b0a7665134193fab2485499571c02a38f161e Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Fri, 31 May 2019 11:12:30 -0700
Subject: [PATCH 0955/1835] crypto: chacha20poly1305 - fix atomic sleep when
 using async algorithm

commit 7545b6c2087f4ef0287c8c9b7eba6a728c67ff8e upstream.

Clear the CRYPTO_TFM_REQ_MAY_SLEEP flag when the chacha20poly1305
operation is being continued from an async completion callback, since
sleeping may not be allowed in that context.

This is basically the same bug that was recently fixed in the xts and
lrw templates.  But, it's always been broken in chacha20poly1305 too.
This was found using syzkaller in combination with the updated crypto
self-tests which actually test the MAY_SLEEP flag now.

Reproducer:

    python -c 'import socket; socket.socket(socket.AF_ALG, 5, 0).bind(
    	       ("aead", "rfc7539(cryptd(chacha20-generic),poly1305-generic)"))'

Kernel output:

    BUG: sleeping function called from invalid context at include/crypto/algapi.h:426
    in_atomic(): 1, irqs_disabled(): 0, pid: 1001, name: kworker/2:2
    [...]
    CPU: 2 PID: 1001 Comm: kworker/2:2 Not tainted 5.2.0-rc2 #5
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
    Workqueue: crypto cryptd_queue_worker
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x4d/0x6a lib/dump_stack.c:113
     ___might_sleep kernel/sched/core.c:6138 [inline]
     ___might_sleep.cold.19+0x8e/0x9f kernel/sched/core.c:6095
     crypto_yield include/crypto/algapi.h:426 [inline]
     crypto_hash_walk_done+0xd6/0x100 crypto/ahash.c:113
     shash_ahash_update+0x41/0x60 crypto/shash.c:251
     shash_async_update+0xd/0x10 crypto/shash.c:260
     crypto_ahash_update include/crypto/hash.h:539 [inline]
     poly_setkey+0xf6/0x130 crypto/chacha20poly1305.c:337
     poly_init+0x51/0x60 crypto/chacha20poly1305.c:364
     async_done_continue crypto/chacha20poly1305.c:78 [inline]
     poly_genkey_done+0x15/0x30 crypto/chacha20poly1305.c:369
     cryptd_skcipher_complete+0x29/0x70 crypto/cryptd.c:279
     cryptd_skcipher_decrypt+0xcd/0x110 crypto/cryptd.c:339
     cryptd_queue_worker+0x70/0xa0 crypto/cryptd.c:184
     process_one_work+0x1ed/0x420 kernel/workqueue.c:2269
     worker_thread+0x3e/0x3a0 kernel/workqueue.c:2415
     kthread+0x11f/0x140 kernel/kthread.c:255
     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Fixes: 71ebc4d1b27d ("crypto: chacha20poly1305 - Add a ChaCha20-Poly1305 AEAD construction, RFC7539")
Cc: <stable@vger.kernel.org> # v4.2+
Cc: Martin Willi <martin@strongswan.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 crypto/chacha20poly1305.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
index 4d6f51bcdfabe..af8afe5c06ea9 100644
--- a/crypto/chacha20poly1305.c
+++ b/crypto/chacha20poly1305.c
@@ -67,6 +67,8 @@ struct chachapoly_req_ctx {
 	unsigned int cryptlen;
 	/* Actual AD, excluding IV */
 	unsigned int assoclen;
+	/* request flags, with MAY_SLEEP cleared if needed */
+	u32 flags;
 	union {
 		struct poly_req poly;
 		struct chacha_req chacha;
@@ -76,8 +78,12 @@ struct chachapoly_req_ctx {
 static inline void async_done_continue(struct aead_request *req, int err,
 				       int (*cont)(struct aead_request *))
 {
-	if (!err)
+	if (!err) {
+		struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
+
+		rctx->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
 		err = cont(req);
+	}
 
 	if (err != -EINPROGRESS && err != -EBUSY)
 		aead_request_complete(req, err);
@@ -144,7 +150,7 @@ static int chacha_decrypt(struct aead_request *req)
 		dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
 	}
 
-	skcipher_request_set_callback(&creq->req, aead_request_flags(req),
+	skcipher_request_set_callback(&creq->req, rctx->flags,
 				      chacha_decrypt_done, req);
 	skcipher_request_set_tfm(&creq->req, ctx->chacha);
 	skcipher_request_set_crypt(&creq->req, src, dst,
@@ -188,7 +194,7 @@ static int poly_tail(struct aead_request *req)
 	memcpy(&preq->tail.cryptlen, &len, sizeof(len));
 	sg_set_buf(preq->src, &preq->tail, sizeof(preq->tail));
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_tail_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 	ahash_request_set_crypt(&preq->req, preq->src,
@@ -219,7 +225,7 @@ static int poly_cipherpad(struct aead_request *req)
 	sg_init_table(preq->src, 1);
 	sg_set_buf(preq->src, &preq->pad, padlen);
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_cipherpad_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 	ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
@@ -250,7 +256,7 @@ static int poly_cipher(struct aead_request *req)
 	sg_init_table(rctx->src, 2);
 	crypt = scatterwalk_ffwd(rctx->src, crypt, req->assoclen);
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_cipher_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 	ahash_request_set_crypt(&preq->req, crypt, NULL, rctx->cryptlen);
@@ -280,7 +286,7 @@ static int poly_adpad(struct aead_request *req)
 	sg_init_table(preq->src, 1);
 	sg_set_buf(preq->src, preq->pad, padlen);
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_adpad_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 	ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
@@ -304,7 +310,7 @@ static int poly_ad(struct aead_request *req)
 	struct poly_req *preq = &rctx->u.poly;
 	int err;
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_ad_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 	ahash_request_set_crypt(&preq->req, req->src, NULL, rctx->assoclen);
@@ -331,7 +337,7 @@ static int poly_setkey(struct aead_request *req)
 	sg_init_table(preq->src, 1);
 	sg_set_buf(preq->src, rctx->key, sizeof(rctx->key));
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_setkey_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 	ahash_request_set_crypt(&preq->req, preq->src, NULL, sizeof(rctx->key));
@@ -355,7 +361,7 @@ static int poly_init(struct aead_request *req)
 	struct poly_req *preq = &rctx->u.poly;
 	int err;
 
-	ahash_request_set_callback(&preq->req, aead_request_flags(req),
+	ahash_request_set_callback(&preq->req, rctx->flags,
 				   poly_init_done, req);
 	ahash_request_set_tfm(&preq->req, ctx->poly);
 
@@ -393,7 +399,7 @@ static int poly_genkey(struct aead_request *req)
 
 	chacha_iv(creq->iv, req, 0);
 
-	skcipher_request_set_callback(&creq->req, aead_request_flags(req),
+	skcipher_request_set_callback(&creq->req, rctx->flags,
 				      poly_genkey_done, req);
 	skcipher_request_set_tfm(&creq->req, ctx->chacha);
 	skcipher_request_set_crypt(&creq->req, creq->src, creq->src,
@@ -433,7 +439,7 @@ static int chacha_encrypt(struct aead_request *req)
 		dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
 	}
 
-	skcipher_request_set_callback(&creq->req, aead_request_flags(req),
+	skcipher_request_set_callback(&creq->req, rctx->flags,
 				      chacha_encrypt_done, req);
 	skcipher_request_set_tfm(&creq->req, ctx->chacha);
 	skcipher_request_set_crypt(&creq->req, src, dst,
@@ -451,6 +457,7 @@ static int chachapoly_encrypt(struct aead_request *req)
 	struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
 
 	rctx->cryptlen = req->cryptlen;
+	rctx->flags = aead_request_flags(req);
 
 	/* encrypt call chain:
 	 * - chacha_encrypt/done()
@@ -472,6 +479,7 @@ static int chachapoly_decrypt(struct aead_request *req)
 	struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
 
 	rctx->cryptlen = req->cryptlen - POLY1305_DIGEST_SIZE;
+	rctx->flags = aead_request_flags(req);
 
 	/* decrypt call chain:
 	 * - poly_genkey/done()
-- 
GitLab


From 4598094d24c7b89332ca4c45163f3aa802a140e5 Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@gmail.com>
Date: Fri, 17 May 2019 23:15:57 +0200
Subject: [PATCH 0956/1835] crypto: crypto4xx - fix AES CTR blocksize value

commit bfa2ba7d9e6b20aca82b99e6842fe18842ae3a0f upstream.

This patch fixes a issue with crypto4xx's ctr(aes) that was
discovered by libcapi's kcapi-enc-test.sh test.

The some of the ctr(aes) encryptions test were failing on the
non-power-of-two test:

kcapi-enc - Error: encryption failed with error 0
kcapi-enc - Error: decryption failed with error 0
[FAILED: 32-bit - 5.1.0-rc1+] 15 bytes: STDIN / STDOUT enc test (128 bits):
original file (1d100e..cc96184c) and generated file (e3b0c442..1b7852b855)
[FAILED: 32-bit - 5.1.0-rc1+] 15 bytes: STDIN / STDOUT enc test (128 bits)
(openssl generated CT): original file (e3b0..5) and generated file (3..8e)
[PASSED: 32-bit - 5.1.0-rc1+] 15 bytes: STDIN / STDOUT enc test (128 bits)
(openssl generated PT)
[FAILED: 32-bit - 5.1.0-rc1+] 15 bytes: STDIN / STDOUT enc test (password):
original file (1d1..84c) and generated file (e3b..852b855)

But the 16, 32, 512, 65536 tests always worked.

Thankfully, this isn't a hidden hardware problem like previously,
instead this turned out to be a copy and paste issue.

With this patch, all the tests are passing with and
kcapi-enc-test.sh gives crypto4xx's a clean bill of health:
 "Number of failures: 0" :).

Cc: stable@vger.kernel.org
Fixes: 98e87e3d933b ("crypto: crypto4xx - add aes-ctr support")
Fixes: f2a13e7cba9e ("crypto: crypto4xx - enable AES RFC3686, ECB, CFB and OFB offloads")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/amcc/crypto4xx_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index d2ec9fd1b8bb0..3cfe69bc7eb05 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1186,7 +1186,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 			.cra_flags = CRYPTO_ALG_NEED_FALLBACK |
 				CRYPTO_ALG_ASYNC |
 				CRYPTO_ALG_KERN_DRIVER_ONLY,
-			.cra_blocksize = AES_BLOCK_SIZE,
+			.cra_blocksize = 1,
 			.cra_ctxsize = sizeof(struct crypto4xx_ctx),
 			.cra_module = THIS_MODULE,
 		},
@@ -1206,7 +1206,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 			.cra_priority = CRYPTO4XX_CRYPTO_PRIORITY,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				CRYPTO_ALG_KERN_DRIVER_ONLY,
-			.cra_blocksize = AES_BLOCK_SIZE,
+			.cra_blocksize = 1,
 			.cra_ctxsize = sizeof(struct crypto4xx_ctx),
 			.cra_module = THIS_MODULE,
 		},
-- 
GitLab


From 17e63172d53640cb2ebc53088a4214f5db8afcfb Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@gmail.com>
Date: Sat, 18 May 2019 23:28:11 +0200
Subject: [PATCH 0957/1835] crypto: crypto4xx - fix blocksize for cfb and ofb

commit 70c4997f34b6c6888b3ac157adec49e01d0df2d5 upstream.

While the hardware consider them to be blockciphers, the
reference implementation defines them as streamciphers.

Do the right thing and set the blocksize to 1. This
was found by CONFIG_CRYPTO_MANAGER_EXTRA_TESTS.

This fixes the following issues:
skcipher: blocksize for ofb-aes-ppc4xx (16) doesn't match generic impl (1)
skcipher: blocksize for cfb-aes-ppc4xx (16) doesn't match generic impl (1)

Cc: Eric Biggers <ebiggers@kernel.org>
Cc: stable@vger.kernel.org
Fixes: f2a13e7cba9e ("crypto: crypto4xx - enable AES RFC3686, ECB, CFB and OFB offloads")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/amcc/crypto4xx_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 3cfe69bc7eb05..febe719e2d67c 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1226,7 +1226,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 			.cra_priority = CRYPTO4XX_CRYPTO_PRIORITY,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				CRYPTO_ALG_KERN_DRIVER_ONLY,
-			.cra_blocksize = AES_BLOCK_SIZE,
+			.cra_blocksize = 1,
 			.cra_ctxsize = sizeof(struct crypto4xx_ctx),
 			.cra_module = THIS_MODULE,
 		},
@@ -1245,7 +1245,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 			.cra_priority = CRYPTO4XX_CRYPTO_PRIORITY,
 			.cra_flags = CRYPTO_ALG_ASYNC |
 				CRYPTO_ALG_KERN_DRIVER_ONLY,
-			.cra_blocksize = AES_BLOCK_SIZE,
+			.cra_blocksize = 1,
 			.cra_ctxsize = sizeof(struct crypto4xx_ctx),
 			.cra_module = THIS_MODULE,
 		},
-- 
GitLab


From 13805a5df489c4c870b3aaca2be56ee26c6db0c7 Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@gmail.com>
Date: Sat, 18 May 2019 23:28:12 +0200
Subject: [PATCH 0958/1835] crypto: crypto4xx - block ciphers should only
 accept complete blocks

commit 0f7a81374060828280fcfdfbaa162cb559017f9f upstream.

The hardware automatically zero pads incomplete block ciphers
blocks without raising any errors. This is a screw-up. This
was noticed by CONFIG_CRYPTO_MANAGER_EXTRA_TESTS tests that
sent a incomplete blocks and expect them to fail.

This fixes:
cbc-aes-ppc4xx encryption unexpectedly succeeded on test vector
"random: len=2409 klen=32"; expected_error=-22, cfg="random:
may_sleep use_digest src_divs=[96.90%@+2295, 2.34%@+4066,
0.32%@alignmask+12, 0.34%@+4087, 0.9%@alignmask+1787, 0.1%@+3767]
iv_offset=6"

ecb-aes-ppc4xx encryption unexpectedly succeeded on test vector
"random: len=1011 klen=32"; expected_error=-22, cfg="random:
may_sleep use_digest src_divs=[100.0%@alignmask+20]
dst_divs=[3.12%@+3001, 96.88%@+4070]"

Cc: Eric Biggers <ebiggers@kernel.org>
Cc: stable@vger.kernel.org [4.19, 5.0 and 5.1]
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/amcc/crypto4xx_alg.c  | 36 +++++++++++++++++++---------
 drivers/crypto/amcc/crypto4xx_core.c | 16 ++++++-------
 drivers/crypto/amcc/crypto4xx_core.h | 10 ++++----
 3 files changed, 39 insertions(+), 23 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c
index 0c85a5123f85d..1d87deca32ed5 100644
--- a/drivers/crypto/amcc/crypto4xx_alg.c
+++ b/drivers/crypto/amcc/crypto4xx_alg.c
@@ -76,12 +76,16 @@ static void set_dynamic_sa_command_1(struct dynamic_sa_ctl *sa, u32 cm,
 }
 
 static inline int crypto4xx_crypt(struct skcipher_request *req,
-				  const unsigned int ivlen, bool decrypt)
+				  const unsigned int ivlen, bool decrypt,
+				  bool check_blocksize)
 {
 	struct crypto_skcipher *cipher = crypto_skcipher_reqtfm(req);
 	struct crypto4xx_ctx *ctx = crypto_skcipher_ctx(cipher);
 	__le32 iv[AES_IV_SIZE];
 
+	if (check_blocksize && !IS_ALIGNED(req->cryptlen, AES_BLOCK_SIZE))
+		return -EINVAL;
+
 	if (ivlen)
 		crypto4xx_memcpy_to_le32(iv, req->iv, ivlen);
 
@@ -90,24 +94,34 @@ static inline int crypto4xx_crypt(struct skcipher_request *req,
 		ctx->sa_len, 0, NULL);
 }
 
-int crypto4xx_encrypt_noiv(struct skcipher_request *req)
+int crypto4xx_encrypt_noiv_block(struct skcipher_request *req)
+{
+	return crypto4xx_crypt(req, 0, false, true);
+}
+
+int crypto4xx_encrypt_iv_stream(struct skcipher_request *req)
+{
+	return crypto4xx_crypt(req, AES_IV_SIZE, false, false);
+}
+
+int crypto4xx_decrypt_noiv_block(struct skcipher_request *req)
 {
-	return crypto4xx_crypt(req, 0, false);
+	return crypto4xx_crypt(req, 0, true, true);
 }
 
-int crypto4xx_encrypt_iv(struct skcipher_request *req)
+int crypto4xx_decrypt_iv_stream(struct skcipher_request *req)
 {
-	return crypto4xx_crypt(req, AES_IV_SIZE, false);
+	return crypto4xx_crypt(req, AES_IV_SIZE, true, false);
 }
 
-int crypto4xx_decrypt_noiv(struct skcipher_request *req)
+int crypto4xx_encrypt_iv_block(struct skcipher_request *req)
 {
-	return crypto4xx_crypt(req, 0, true);
+	return crypto4xx_crypt(req, AES_IV_SIZE, false, true);
 }
 
-int crypto4xx_decrypt_iv(struct skcipher_request *req)
+int crypto4xx_decrypt_iv_block(struct skcipher_request *req)
 {
-	return crypto4xx_crypt(req, AES_IV_SIZE, true);
+	return crypto4xx_crypt(req, AES_IV_SIZE, true, true);
 }
 
 /**
@@ -278,8 +292,8 @@ crypto4xx_ctr_crypt(struct skcipher_request *req, bool encrypt)
 		return ret;
 	}
 
-	return encrypt ? crypto4xx_encrypt_iv(req)
-		       : crypto4xx_decrypt_iv(req);
+	return encrypt ? crypto4xx_encrypt_iv_stream(req)
+		       : crypto4xx_decrypt_iv_stream(req);
 }
 
 static int crypto4xx_sk_setup_fallback(struct crypto4xx_ctx *ctx,
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index febe719e2d67c..6386e1784fe41 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1153,8 +1153,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 		.max_keysize = AES_MAX_KEY_SIZE,
 		.ivsize	= AES_IV_SIZE,
 		.setkey = crypto4xx_setkey_aes_cbc,
-		.encrypt = crypto4xx_encrypt_iv,
-		.decrypt = crypto4xx_decrypt_iv,
+		.encrypt = crypto4xx_encrypt_iv_block,
+		.decrypt = crypto4xx_decrypt_iv_block,
 		.init = crypto4xx_sk_init,
 		.exit = crypto4xx_sk_exit,
 	} },
@@ -1173,8 +1173,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 		.max_keysize = AES_MAX_KEY_SIZE,
 		.ivsize	= AES_IV_SIZE,
 		.setkey	= crypto4xx_setkey_aes_cfb,
-		.encrypt = crypto4xx_encrypt_iv,
-		.decrypt = crypto4xx_decrypt_iv,
+		.encrypt = crypto4xx_encrypt_iv_stream,
+		.decrypt = crypto4xx_decrypt_iv_stream,
 		.init = crypto4xx_sk_init,
 		.exit = crypto4xx_sk_exit,
 	} },
@@ -1233,8 +1233,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 		.min_keysize = AES_MIN_KEY_SIZE,
 		.max_keysize = AES_MAX_KEY_SIZE,
 		.setkey	= crypto4xx_setkey_aes_ecb,
-		.encrypt = crypto4xx_encrypt_noiv,
-		.decrypt = crypto4xx_decrypt_noiv,
+		.encrypt = crypto4xx_encrypt_noiv_block,
+		.decrypt = crypto4xx_decrypt_noiv_block,
 		.init = crypto4xx_sk_init,
 		.exit = crypto4xx_sk_exit,
 	} },
@@ -1253,8 +1253,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
 		.max_keysize = AES_MAX_KEY_SIZE,
 		.ivsize	= AES_IV_SIZE,
 		.setkey	= crypto4xx_setkey_aes_ofb,
-		.encrypt = crypto4xx_encrypt_iv,
-		.decrypt = crypto4xx_decrypt_iv,
+		.encrypt = crypto4xx_encrypt_iv_stream,
+		.decrypt = crypto4xx_decrypt_iv_stream,
 		.init = crypto4xx_sk_init,
 		.exit = crypto4xx_sk_exit,
 	} },
diff --git a/drivers/crypto/amcc/crypto4xx_core.h b/drivers/crypto/amcc/crypto4xx_core.h
index e2ca56722f077..21a6bbcedc55d 100644
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -179,10 +179,12 @@ int crypto4xx_setkey_rfc3686(struct crypto_skcipher *cipher,
 			     const u8 *key, unsigned int keylen);
 int crypto4xx_encrypt_ctr(struct skcipher_request *req);
 int crypto4xx_decrypt_ctr(struct skcipher_request *req);
-int crypto4xx_encrypt_iv(struct skcipher_request *req);
-int crypto4xx_decrypt_iv(struct skcipher_request *req);
-int crypto4xx_encrypt_noiv(struct skcipher_request *req);
-int crypto4xx_decrypt_noiv(struct skcipher_request *req);
+int crypto4xx_encrypt_iv_stream(struct skcipher_request *req);
+int crypto4xx_decrypt_iv_stream(struct skcipher_request *req);
+int crypto4xx_encrypt_iv_block(struct skcipher_request *req);
+int crypto4xx_decrypt_iv_block(struct skcipher_request *req);
+int crypto4xx_encrypt_noiv_block(struct skcipher_request *req);
+int crypto4xx_decrypt_noiv_block(struct skcipher_request *req);
 int crypto4xx_rfc3686_encrypt(struct skcipher_request *req);
 int crypto4xx_rfc3686_decrypt(struct skcipher_request *req);
 int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm);
-- 
GitLab


From 561c4424f1e3f30615bc5701151709e0b59e1d3e Mon Sep 17 00:00:00 2001
From: "Hook, Gary" <Gary.Hook@amd.com>
Date: Wed, 10 Jul 2019 00:09:22 +0000
Subject: [PATCH 0959/1835] crypto: ccp - memset structure fields to zero
 before reuse

commit 20e833dc36355ed642d00067641a679c618303fa upstream.

The AES GCM function reuses an 'op' data structure, which members
contain values that must be cleared for each (re)use.

This fix resolves a crypto self-test failure:
alg: aead: gcm-aes-ccp encryption test failed (wrong result) on test vector 2, cfg="two even aligned splits"

Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-ops.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 0ea43cdeb05f0..5df77e4fc97b5 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -625,6 +625,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 
 	unsigned long long *final;
 	unsigned int dm_offset;
+	unsigned int jobid;
 	unsigned int ilen;
 	bool in_place = true; /* Default value */
 	int ret;
@@ -663,9 +664,11 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 		p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen);
 	}
 
+	jobid = CCP_NEW_JOBID(cmd_q->ccp);
+
 	memset(&op, 0, sizeof(op));
 	op.cmd_q = cmd_q;
-	op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
+	op.jobid = jobid;
 	op.sb_key = cmd_q->sb_key; /* Pre-allocated */
 	op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
 	op.init = 1;
@@ -816,6 +819,13 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 	final[0] = cpu_to_be64(aes->aad_len * 8);
 	final[1] = cpu_to_be64(ilen * 8);
 
+	memset(&op, 0, sizeof(op));
+	op.cmd_q = cmd_q;
+	op.jobid = jobid;
+	op.sb_key = cmd_q->sb_key; /* Pre-allocated */
+	op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
+	op.init = 1;
+	op.u.aes.type = aes->type;
 	op.u.aes.mode = CCP_AES_MODE_GHASH;
 	op.u.aes.action = CCP_AES_GHASHFINAL;
 	op.src.type = CCP_MEMTYPE_SYSTEM;
-- 
GitLab


From a9fd1795fee69a9d384ead855e045edd5a035bb5 Mon Sep 17 00:00:00 2001
From: Cfir Cohen <cfir@google.com>
Date: Tue, 2 Jul 2019 10:32:56 -0700
Subject: [PATCH 0960/1835] crypto: ccp/gcm - use const time tag comparison.

commit 538a5a072e6ef04377b180ee9b3ce5bae0a85da4 upstream.

Avoid leaking GCM tag through timing side channel.

Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Cfir Cohen <cfir@google.com>
Acked-by: Gary R Hook <ghook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-ops.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 5df77e4fc97b5..e212badd39fa4 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -853,7 +853,8 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 		if (ret)
 			goto e_tag;
 
-		ret = memcmp(tag.address, final_wa.address, AES_BLOCK_SIZE);
+		ret = crypto_memneq(tag.address, final_wa.address,
+				    AES_BLOCK_SIZE) ? -EBADMSG : 0;
 		ccp_dm_free(&tag);
 	}
 
-- 
GitLab


From c3b7d27f3746e7a54df1ada38710f82f1102f43b Mon Sep 17 00:00:00 2001
From: Wen Yang <wen.yang99@zte.com.cn>
Date: Mon, 8 Jul 2019 14:19:03 +0800
Subject: [PATCH 0961/1835] crypto: crypto4xx - fix a potential double free in
 ppc4xx_trng_probe

commit 95566aa75cd6b3b404502c06f66956b5481194b3 upstream.

There is a possible double free issue in ppc4xx_trng_probe():

85:	dev->trng_base = of_iomap(trng, 0);
86:	of_node_put(trng);          ---> released here
87:	if (!dev->trng_base)
88:		goto err_out;
...
110:	ierr_out:
111:		of_node_put(trng);  ---> double released here
...

This issue was detected by using the Coccinelle software.
We fix it by removing the unnecessary of_node_put().

Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: <stable@vger.kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Allison Randal <allison@lohutok.net>
Cc: Armijn Hemel <armijn@tjaldur.nl>
Cc: Julia Lawall <Julia.Lawall@lip6.fr>
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/amcc/crypto4xx_trng.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c
index 53ab1f140a265..8a3ed40312061 100644
--- a/drivers/crypto/amcc/crypto4xx_trng.c
+++ b/drivers/crypto/amcc/crypto4xx_trng.c
@@ -111,7 +111,6 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev)
 	return;
 
 err_out:
-	of_node_put(trng);
 	iounmap(dev->trng_base);
 	kfree(rng);
 	dev->trng_base = NULL;
-- 
GitLab


From 58169c189bd66329459a982a1d0ab613e33626fc Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:27 +0800
Subject: [PATCH 0962/1835] Revert "bcache: set CACHE_SET_IO_DISABLE in
 bch_cached_dev_error()"

commit 695277f16b3a102fcc22c97fdf2de77c7b19f0b3 upstream.

This reverts commit 6147305c73e4511ca1a975b766b97a779d442567.

Although this patch helps the failed bcache device to stop faster when
too many I/O errors detected on corresponding cached device, setting
CACHE_SET_IO_DISABLE bit to cache set c->flags was not a good idea. This
operation will disable all I/Os on cache set, which means other attached
bcache devices won't work neither.

Without this patch, the failed bcache device can also be stopped
eventually if internal I/O accomplished (e.g. writeback). Therefore here
I revert it.

Fixes: 6147305c73e4 ("bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()")
Reported-by: Yong Li <mr.liyong@qq.com>
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/super.c | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 173a2be72eeba..e6c7a84bb1dfd 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1423,8 +1423,6 @@ int bch_flash_dev_create(struct cache_set *c, uint64_t size)
 
 bool bch_cached_dev_error(struct cached_dev *dc)
 {
-	struct cache_set *c;
-
 	if (!dc || test_bit(BCACHE_DEV_CLOSING, &dc->disk.flags))
 		return false;
 
@@ -1435,21 +1433,6 @@ bool bch_cached_dev_error(struct cached_dev *dc)
 	pr_err("stop %s: too many IO errors on backing device %s\n",
 		dc->disk.disk->disk_name, dc->backing_dev_name);
 
-	/*
-	 * If the cached device is still attached to a cache set,
-	 * even dc->io_disable is true and no more I/O requests
-	 * accepted, cache device internal I/O (writeback scan or
-	 * garbage collection) may still prevent bcache device from
-	 * being stopped. So here CACHE_SET_IO_DISABLE should be
-	 * set to c->flags too, to make the internal I/O to cache
-	 * device rejected and stopped immediately.
-	 * If c is NULL, that means the bcache device is not attached
-	 * to any cache set, then no CACHE_SET_IO_DISABLE bit to set.
-	 */
-	c = dc->disk.c;
-	if (c && test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
-		pr_info("CACHE_SET_IO_DISABLE already set");
-
 	bcache_device_stop(&dc->disk);
 	return true;
 }
-- 
GitLab


From ab966241d59ab77c98ec94faea38d21946c036e4 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:54 +0800
Subject: [PATCH 0963/1835] bcache: Revert "bcache: fix high CPU occupancy
 during journal"

commit 249a5f6da57c28a903c75d81505d58ec8c10030d upstream.

This reverts commit c4dc2497d50d9c6fb16aa0d07b6a14f3b2adb1e0.

This patch enlarges a race between normal btree flush code path and
flush_btree_write(), which causes deadlock when journal space is
exhausted. Reverts this patch makes the race window from 128 btree
nodes to only 1 btree nodes.

Fixes: c4dc2497d50d ("bcache: fix high CPU occupancy during journal")
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Cc: Tang Junhui <tang.junhui.linux@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/bcache.h  |  2 --
 drivers/md/bcache/journal.c | 47 ++++++++++++-------------------------
 drivers/md/bcache/util.h    |  2 --
 3 files changed, 15 insertions(+), 36 deletions(-)

diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 954dad29e6e8f..83f0b91aeb90d 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -708,8 +708,6 @@ struct cache_set {
 
 #define BUCKET_HASH_BITS	12
 	struct hlist_head	bucket_hash[1 << BUCKET_HASH_BITS];
-
-	DECLARE_HEAP(struct btree *, flush_btree);
 };
 
 struct bbio {
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 8d4d63b515533..0eb853e2a29db 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -390,12 +390,6 @@ err:
 }
 
 /* Journalling */
-#define journal_max_cmp(l, r) \
-	(fifo_idx(&c->journal.pin, btree_current_write(l)->journal) < \
-	 fifo_idx(&(c)->journal.pin, btree_current_write(r)->journal))
-#define journal_min_cmp(l, r) \
-	(fifo_idx(&c->journal.pin, btree_current_write(l)->journal) > \
-	 fifo_idx(&(c)->journal.pin, btree_current_write(r)->journal))
 
 static void btree_flush_write(struct cache_set *c)
 {
@@ -403,35 +397,25 @@ static void btree_flush_write(struct cache_set *c)
 	 * Try to find the btree node with that references the oldest journal
 	 * entry, best is our current candidate and is locked if non NULL:
 	 */
-	struct btree *b;
-	int i;
+	struct btree *b, *best;
+	unsigned int i;
 
 	atomic_long_inc(&c->flush_write);
-
 retry:
-	spin_lock(&c->journal.lock);
-	if (heap_empty(&c->flush_btree)) {
-		for_each_cached_btree(b, c, i)
-			if (btree_current_write(b)->journal) {
-				if (!heap_full(&c->flush_btree))
-					heap_add(&c->flush_btree, b,
-						 journal_max_cmp);
-				else if (journal_max_cmp(b,
-					 heap_peek(&c->flush_btree))) {
-					c->flush_btree.data[0] = b;
-					heap_sift(&c->flush_btree, 0,
-						  journal_max_cmp);
-				}
+	best = NULL;
+
+	for_each_cached_btree(b, c, i)
+		if (btree_current_write(b)->journal) {
+			if (!best)
+				best = b;
+			else if (journal_pin_cmp(c,
+					btree_current_write(best)->journal,
+					btree_current_write(b)->journal)) {
+				best = b;
 			}
+		}
 
-		for (i = c->flush_btree.used / 2 - 1; i >= 0; --i)
-			heap_sift(&c->flush_btree, i, journal_min_cmp);
-	}
-
-	b = NULL;
-	heap_pop(&c->flush_btree, b, journal_min_cmp);
-	spin_unlock(&c->journal.lock);
-
+	b = best;
 	if (b) {
 		mutex_lock(&b->write_lock);
 		if (!btree_current_write(b)->journal) {
@@ -873,8 +857,7 @@ int bch_journal_alloc(struct cache_set *c)
 	j->w[0].c = c;
 	j->w[1].c = c;
 
-	if (!(init_heap(&c->flush_btree, 128, GFP_KERNEL)) ||
-	    !(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
+	if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
 	    !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) ||
 	    !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)))
 		return -ENOMEM;
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 00aab6abcfe4f..b1f5b7aea8724 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -113,8 +113,6 @@ do {									\
 
 #define heap_full(h)	((h)->used == (h)->size)
 
-#define heap_empty(h)	((h)->used == 0)
-
 #define DECLARE_FIFO(type, name)					\
 	struct {							\
 		size_t front, back, size, mask;				\
-- 
GitLab


From 4fc48cd21a31e6560a6cfab0ac7c248b1ee7921c Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:53 +0800
Subject: [PATCH 0964/1835] bcache: Revert "bcache: free heap
 cache_set->flush_btree in bch_journal_free"

commit ba82c1ac1667d6efb91a268edb13fc9cdaecec9b upstream.

This reverts commit 6268dc2c4703aabfb0b35681be709acf4c2826c6.

This patch depends on commit c4dc2497d50d ("bcache: fix high CPU
occupancy during journal") which is reverted in previous patch. So
revert this one too.

Fixes: 6268dc2c4703 ("bcache: free heap cache_set->flush_btree in bch_journal_free")
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Cc: Shenghui Wang <shhuiw@foxmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/journal.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 0eb853e2a29db..ec1e35a62934d 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -842,7 +842,6 @@ void bch_journal_free(struct cache_set *c)
 	free_pages((unsigned long) c->journal.w[1].data, JSET_BITS);
 	free_pages((unsigned long) c->journal.w[0].data, JSET_BITS);
 	free_fifo(&c->journal.pin);
-	free_heap(&c->flush_btree);
 }
 
 int bch_journal_alloc(struct cache_set *c)
-- 
GitLab


From 3c466df8fc5950fa7b7256aa5ec820f0ab640ae7 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:29 +0800
Subject: [PATCH 0965/1835] bcache: ignore read-ahead request failure on
 backing device

commit 578df99b1b0531d19af956530fe4da63d01a1604 upstream.

When md raid device (e.g. raid456) is used as backing device, read-ahead
requests on a degrading and recovering md raid device might be failured
immediately by md raid code, but indeed this md raid array can still be
read or write for normal I/O requests. Therefore such failed read-ahead
request are not real hardware failure. Further more, after degrading and
recovering accomplished, read-ahead requests will be handled by md raid
array again.

For such condition, I/O failures of read-ahead requests don't indicate
real health status (because normal I/O still be served), they should not
be counted into I/O error counter dc->io_errors.

Since there is no simple way to detect whether the backing divice is a
md raid device, this patch simply ignores I/O failures for read-ahead
bios on backing device, to avoid bogus backing device failure on a
degrading md raid array.

Suggested-and-tested-by: Thorsten Knabe <linux@thorsten-knabe.de>
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/io.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index c250979683194..4d93f07f63e51 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -58,6 +58,18 @@ void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
 
 	WARN_ONCE(!dc, "NULL pointer of struct cached_dev");
 
+	/*
+	 * Read-ahead requests on a degrading and recovering md raid
+	 * (e.g. raid6) device might be failured immediately by md
+	 * raid code, which is not a real hardware media failure. So
+	 * we shouldn't count failed REQ_RAHEAD bio to dc->io_errors.
+	 */
+	if (bio->bi_opf & REQ_RAHEAD) {
+		pr_warn_ratelimited("%s: Read-ahead I/O failed on backing device, ignore",
+				    dc->backing_dev_name);
+		return;
+	}
+
 	errors = atomic_add_return(1, &dc->io_errors);
 	if (errors < dc->error_limit)
 		pr_err("%s: IO error on backing device, unrecoverable",
-- 
GitLab


From 2ab14861d2eb33b8471c73a8089d1a64e846d289 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:43 +0800
Subject: [PATCH 0966/1835] bcache: fix mistaken sysfs entry for io_error
 counter

commit 5461999848e0462c14f306a62923d22de820a59c upstream.

In bch_cached_dev_files[] from driver/md/bcache/sysfs.c, sysfs_errors is
incorrectly inserted in. The correct entry should be sysfs_io_errors.

This patch fixes the problem and now I/O errors of cached device can be
read from /sys/block/bcache<N>/bcache/io_errors.

Fixes: c7b7bd07404c5 ("bcache: add io_disable to struct cached_dev")
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 541454b4f479c..5bb81e564ce88 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -175,7 +175,7 @@ SHOW(__bch_cached_dev)
 	var_print(writeback_percent);
 	sysfs_hprint(writeback_rate,
 		     wb ? atomic_long_read(&dc->writeback_rate.rate) << 9 : 0);
-	sysfs_hprint(io_errors,		atomic_read(&dc->io_errors));
+	sysfs_printf(io_errors,		"%i", atomic_read(&dc->io_errors));
 	sysfs_printf(io_error_limit,	"%i", dc->error_limit);
 	sysfs_printf(io_disable,	"%i", dc->io_disable);
 	var_print(writeback_rate_update_seconds);
@@ -426,7 +426,7 @@ static struct attribute *bch_cached_dev_files[] = {
 	&sysfs_writeback_rate_p_term_inverse,
 	&sysfs_writeback_rate_minimum,
 	&sysfs_writeback_rate_debug,
-	&sysfs_errors,
+	&sysfs_io_errors,
 	&sysfs_io_error_limit,
 	&sysfs_io_disable,
 	&sysfs_dirty_data,
-- 
GitLab


From f11ba9df8eed1abce9c5d7306711e32b657694eb Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Fri, 28 Jun 2019 19:59:44 +0800
Subject: [PATCH 0967/1835] bcache: destroy dc->writeback_write_wq if failed to
 create dc->writeback_thread

commit f54d801dda14942dbefa00541d10603015b7859c upstream.

Commit 9baf30972b55 ("bcache: fix for gc and write-back race") added a
new work queue dc->writeback_write_wq, but forgot to destroy it in the
error condition when creating dc->writeback_thread failed.

This patch destroys dc->writeback_write_wq if kthread_create() returns
error pointer to dc->writeback_thread, then a memory leak is avoided.

Fixes: 9baf30972b55 ("bcache: fix for gc and write-back race")
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/writeback.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 6e72bb6c00f26..ba5395fd386d5 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -807,6 +807,7 @@ int bch_cached_dev_writeback_start(struct cached_dev *dc)
 					      "bcache_writeback");
 	if (IS_ERR(dc->writeback_thread)) {
 		cached_dev_put(dc);
+		destroy_workqueue(dc->writeback_write_wq);
 		return PTR_ERR(dc->writeback_thread);
 	}
 
-- 
GitLab


From d657077eda7b5572d86f2f618391bb016b5d9a64 Mon Sep 17 00:00:00 2001
From: Grant Hernandez <granthernandez@google.com>
Date: Sat, 13 Jul 2019 01:00:12 -0700
Subject: [PATCH 0968/1835] Input: gtco - bounds check collection indent level

commit 2a017fd82c5402b3c8df5e3d6e5165d9e6147dc1 upstream.

The GTCO tablet input driver configures itself from an HID report sent
via USB during the initial enumeration process. Some debugging messages
are generated during the parsing. A debugging message indentation
counter is not bounds checked, leading to the ability for a specially
crafted HID report to cause '-' and null bytes be written past the end
of the indentation array. As long as the kernel has CONFIG_DYNAMIC_DEBUG
enabled, this code will not be optimized out.  This was discovered
during code review after a previous syzkaller bug was found in this
driver.

Signed-off-by: Grant Hernandez <granthernandez@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/tablet/gtco.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
index 4b8b9d7aa75e2..35031228a6d07 100644
--- a/drivers/input/tablet/gtco.c
+++ b/drivers/input/tablet/gtco.c
@@ -78,6 +78,7 @@ Scott Hill shill@gtcocalcomp.com
 
 /* Max size of a single report */
 #define REPORT_MAX_SIZE       10
+#define MAX_COLLECTION_LEVELS  10
 
 
 /* Bitmask whether pen is in range */
@@ -223,8 +224,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
 	char  maintype = 'x';
 	char  globtype[12];
 	int   indent = 0;
-	char  indentstr[10] = "";
-
+	char  indentstr[MAX_COLLECTION_LEVELS + 1] = { 0 };
 
 	dev_dbg(ddev, "======>>>>>>PARSE<<<<<<======\n");
 
@@ -350,6 +350,13 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
 			case TAG_MAIN_COL_START:
 				maintype = 'S';
 
+				if (indent == MAX_COLLECTION_LEVELS) {
+					dev_err(ddev, "Collection level %d would exceed limit of %d\n",
+						indent + 1,
+						MAX_COLLECTION_LEVELS);
+					break;
+				}
+
 				if (data == 0) {
 					dev_dbg(ddev, "======>>>>>> Physical\n");
 					strcpy(globtype, "Physical");
@@ -369,8 +376,15 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
 				break;
 
 			case TAG_MAIN_COL_END:
-				dev_dbg(ddev, "<<<<<<======\n");
 				maintype = 'E';
+
+				if (indent == 0) {
+					dev_err(ddev, "Collection level already at zero\n");
+					break;
+				}
+
+				dev_dbg(ddev, "<<<<<<======\n");
+
 				indent--;
 				for (x = 0; x < indent; x++)
 					indentstr[x] = '-';
-- 
GitLab


From cfb9250619c89efeb6d8b8a45a245649fd37f0f3 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Mon, 15 Jul 2019 10:00:58 -0700
Subject: [PATCH 0969/1835] Input: alps - don't handle ALPS cs19
 trackpoint-only device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7e4935ccc3236751e5fe4bd6846f86e46bb2e427 upstream.

On a latest Lenovo laptop, the trackpoint and 3 buttons below it
don't work at all, when we move the trackpoint or press those 3
buttons, the kernel will print out:
"Rejected trackstick packet from non DualPoint device"

This device is identified as an alps touchpad but the packet has
trackpoint format, so the alps.c drops the packet and prints out
the message above.

According to XiaoXiao's explanation, this device is named cs19 and
is trackpoint-only device, its firmware is only for trackpoint, it
is independent of touchpad and is a device completely different from
DualPoint ones.

To drive this device with mininal changes to the existing driver, we
just let the alps driver not handle this device, then the trackpoint.c
will be the driver of this device if the trackpoint driver is enabled.
(if not, this device will fallback to a bare PS/2 device)

With the trackpoint.c, this trackpoint and 3 buttons all work well,
they have all features that the trackpoint should have, like
scrolling-screen, drag-and-drop and frame-selection.

Signed-off-by: XiaoXiao Liu <sliuuxiaonxiao@gmail.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/alps.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0a6f7ca883e7f..11a4363c3b60f 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -24,6 +24,7 @@
 
 #include "psmouse.h"
 #include "alps.h"
+#include "trackpoint.h"
 
 /*
  * Definitions for ALPS version 3 and 4 command mode protocol
@@ -2864,6 +2865,23 @@ static const struct alps_protocol_info *alps_match_table(unsigned char *e7,
 	return NULL;
 }
 
+static bool alps_is_cs19_trackpoint(struct psmouse *psmouse)
+{
+	u8 param[2] = { 0 };
+
+	if (ps2_command(&psmouse->ps2dev,
+			param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
+		return false;
+
+	/*
+	 * param[0] contains the trackpoint device variant_id while
+	 * param[1] contains the firmware_id. So far all alps
+	 * trackpoint-only devices have their variant_ids equal
+	 * TP_VARIANT_ALPS and their firmware_ids are in 0x20~0x2f range.
+	 */
+	return param[0] == TP_VARIANT_ALPS && (param[1] & 0x20);
+}
+
 static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
 {
 	const struct alps_protocol_info *protocol;
@@ -3164,6 +3182,20 @@ int alps_detect(struct psmouse *psmouse, bool set_properties)
 	if (error)
 		return error;
 
+	/*
+	 * ALPS cs19 is a trackpoint-only device, and uses different
+	 * protocol than DualPoint ones, so we return -EINVAL here and let
+	 * trackpoint.c drive this device. If the trackpoint driver is not
+	 * enabled, the device will fall back to a bare PS/2 mouse.
+	 * If ps2_command() fails here, we depend on the immediately
+	 * followed psmouse_reset() to reset the device to normal state.
+	 */
+	if (alps_is_cs19_trackpoint(psmouse)) {
+		psmouse_dbg(psmouse,
+			    "ALPS CS19 trackpoint-only device detected, ignoring\n");
+		return -EINVAL;
+	}
+
 	/*
 	 * Reset the device to make sure it is fully operational:
 	 * on some laptops, like certain Dell Latitudes, we may
-- 
GitLab


From 81368a9a98d9f3b92f31baa28fc5e1c4e805d664 Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen@gmail.com>
Date: Thu, 11 Jul 2019 23:42:03 -0700
Subject: [PATCH 0970/1835] Input: synaptics - whitelist Lenovo T580 SMBus
 intertouch

commit 1976d7d200c5a32e72293a2ada36b7b7c9d6dd6e upstream.

Adds the Lenovo T580 to the SMBus intertouch list for Synaptics
touchpads. I've tested with this for a week now, and it seems a great
improvement. It's also nice to have the complaint gone from dmesg.

Signed-off-by: Nick Black <dankamongmen@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/synaptics.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 68fd8232d44cf..af7d48431b851 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
 	"LEN0093", /* T480 */
 	"LEN0096", /* X280 */
 	"LEN0097", /* X280 -> ALPS trackpoint */
+	"LEN009b", /* T580 */
 	"LEN200f", /* T450s */
 	"LEN2054", /* E480 */
 	"LEN2055", /* E580 */
-- 
GitLab


From 8da63aa46e2685db6834cbe91dd7a1a4d04b5db9 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Fri, 19 Jul 2019 12:38:58 +0300
Subject: [PATCH 0971/1835] Input: alps - fix a mismatch between a condition
 check and its comment

commit 771a081e44a9baa1991ef011cc453ef425591740 upstream.

In the function alps_is_cs19_trackpoint(), we check if the param[1] is
in the 0x20~0x2f range, but the code we wrote for this checking is not
correct:
(param[1] & 0x20) does not mean param[1] is in the range of 0x20~0x2f,
it also means the param[1] is in the range of 0x30~0x3f, 0x60~0x6f...

Now fix it with a new condition checking ((param[1] & 0xf0) == 0x20).

Fixes: 7e4935ccc323 ("Input: alps - don't handle ALPS cs19 trackpoint-only device")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/alps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 11a4363c3b60f..dd80ff6cc4273 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2879,7 +2879,7 @@ static bool alps_is_cs19_trackpoint(struct psmouse *psmouse)
 	 * trackpoint-only devices have their variant_ids equal
 	 * TP_VARIANT_ALPS and their firmware_ids are in 0x20~0x2f range.
 	 */
-	return param[0] == TP_VARIANT_ALPS && (param[1] & 0x20);
+	return param[0] == TP_VARIANT_ALPS && ((param[1] & 0xf0) == 0x20);
 }
 
 static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
-- 
GitLab


From 042451b921b10373e3c3294bdd802e383298754e Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Sat, 29 Jun 2019 13:44:45 +0200
Subject: [PATCH 0972/1835] regulator: s2mps11: Fix buck7 and buck8 wrong
 voltages

commit 16da0eb5ab6ef2dd1d33431199126e63db9997cc upstream.

On S2MPS11 device, the buck7 and buck8 regulator voltages start at 750
mV, not 600 mV.  Using wrong minimal value caused shifting of these
regulator values by 150 mV (e.g. buck7 usually configured to v1.35 V was
reported as 1.2 V).

On most of the boards these regulators are left in default state so this
was only affecting reported voltage.  However if any driver wanted to
change them, then effectively it would set voltage 150 mV higher than
intended.

Cc: <stable@vger.kernel.org>
Fixes: cb74685ecb39 ("regulator: s2mps11: Add samsung s2mps11 regulator driver")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/regulator/s2mps11.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index c584bd1ffa9c1..7c598c156d9e1 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -373,8 +373,8 @@ static const struct regulator_desc s2mps11_regulators[] = {
 	regulator_desc_s2mps11_buck1_4(4),
 	regulator_desc_s2mps11_buck5,
 	regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV),
-	regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV),
-	regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV),
+	regulator_desc_s2mps11_buck67810(7, MIN_750_MV, STEP_12_5_MV),
+	regulator_desc_s2mps11_buck67810(8, MIN_750_MV, STEP_12_5_MV),
 	regulator_desc_s2mps11_buck9,
 	regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV),
 };
-- 
GitLab


From 7ebddd5fe217f8be670412cfe2cda5b4ec805269 Mon Sep 17 00:00:00 2001
From: Jon Hunter <jonathanh@nvidia.com>
Date: Thu, 20 Jun 2019 09:17:01 +0100
Subject: [PATCH 0973/1835] arm64: tegra: Update Jetson TX1 GPU regulator
 timings

commit ece6031ece2dd64d63708cfe1088016cee5b10c0 upstream.

The GPU regulator enable ramp delay for Jetson TX1 is set to 1ms which
not sufficient because the enable ramp delay has been measured to be
greater than 1ms. Furthermore, the downstream kernels released by NVIDIA
for Jetson TX1 are using a enable ramp delay 2ms and a settling delay of
160us. Update the GPU regulator enable ramp delay for Jetson TX1 to be
2ms and add a settling delay of 160us.

Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Fixes: 5e6b9a89afce ("arm64: tegra: Add VDD_GPU regulator to Jetson TX1")
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
index 212e6634c9baa..7398ae8856dc0 100644
--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
@@ -330,7 +330,8 @@
 			regulator-max-microvolt = <1320000>;
 			enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
 			regulator-ramp-delay = <80>;
-			regulator-enable-ramp-delay = <1000>;
+			regulator-enable-ramp-delay = <2000>;
+			regulator-settling-time-us = <160>;
 		};
 	};
 };
-- 
GitLab


From 04c52c105a386a2f1edafdb78b585ff55452e999 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Tue, 21 May 2019 15:10:38 +0300
Subject: [PATCH 0974/1835] iwlwifi: pcie: don't service an interrupt that was
 masked

commit 3b57a10ca14c619707398dc58fe5ece18c95b20b upstream.

Sometimes the register status can include interrupts that
were masked. We can, for example, get the RF-Kill bit set
in the interrupt status register although this interrupt
was masked. Then if we get the ALIVE interrupt (for example)
that was not masked, we need to *not* service the RF-Kill
interrupt.
Fix this in the MSI-X interrupt handler.

Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 27 +++++++++++++++-----
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 6dcd5374d9b4d..cb20a8e73671b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -2060,10 +2060,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
 		return IRQ_NONE;
 	}
 
-	if (iwl_have_debug_level(IWL_DL_ISR))
-		IWL_DEBUG_ISR(trans, "ISR inta_fh 0x%08x, enabled 0x%08x\n",
-			      inta_fh,
+	if (iwl_have_debug_level(IWL_DL_ISR)) {
+		IWL_DEBUG_ISR(trans,
+			      "ISR inta_fh 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
+			      inta_fh, trans_pcie->fh_mask,
 			      iwl_read32(trans, CSR_MSIX_FH_INT_MASK_AD));
+		if (inta_fh & ~trans_pcie->fh_mask)
+			IWL_DEBUG_ISR(trans,
+				      "We got a masked interrupt (0x%08x)\n",
+				      inta_fh & ~trans_pcie->fh_mask);
+	}
+
+	inta_fh &= trans_pcie->fh_mask;
 
 	if ((trans_pcie->shared_vec_mask & IWL_SHARED_IRQ_NON_RX) &&
 	    inta_fh & MSIX_FH_INT_CAUSES_Q0) {
@@ -2103,11 +2111,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
 	}
 
 	/* After checking FH register check HW register */
-	if (iwl_have_debug_level(IWL_DL_ISR))
+	if (iwl_have_debug_level(IWL_DL_ISR)) {
 		IWL_DEBUG_ISR(trans,
-			      "ISR inta_hw 0x%08x, enabled 0x%08x\n",
-			      inta_hw,
+			      "ISR inta_hw 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
+			      inta_hw, trans_pcie->hw_mask,
 			      iwl_read32(trans, CSR_MSIX_HW_INT_MASK_AD));
+		if (inta_hw & ~trans_pcie->hw_mask)
+			IWL_DEBUG_ISR(trans,
+				      "We got a masked interrupt 0x%08x\n",
+				      inta_hw & ~trans_pcie->hw_mask);
+	}
+
+	inta_hw &= trans_pcie->hw_mask;
 
 	/* Alive notification via Rx interrupt will do the real work */
 	if (inta_hw & MSIX_HW_INT_CAUSES_REG_ALIVE) {
-- 
GitLab


From d9ce0788da91dc8a1afa00695462cd88b1987078 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Tue, 21 May 2019 15:03:21 +0300
Subject: [PATCH 0975/1835] iwlwifi: pcie: fix ALIVE interrupt handling for
 gen2 devices w/o MSI-X

commit ec46ae30245ecb41d73f8254613db07c653fb498 upstream.

We added code to restock the buffer upon ALIVE interrupt
when MSI-X is disabled. This was added as part of the context
info code. This code was added only if the ISR debug level
is set which is very unlikely to be related.
Move this code to run even when the ISR debug level is not
set.

Note that gen2 devices work with MSI-X in most cases so that
this path is seldom used.

Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 34 +++++++++-----------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index cb20a8e73671b..747ca8b92cdcf 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -1778,25 +1778,23 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 		goto out;
 	}
 
-	if (iwl_have_debug_level(IWL_DL_ISR)) {
-		/* NIC fires this, but we don't use it, redundant with WAKEUP */
-		if (inta & CSR_INT_BIT_SCD) {
-			IWL_DEBUG_ISR(trans,
-				      "Scheduler finished to transmit the frame/frames.\n");
-			isr_stats->sch++;
-		}
+	/* NIC fires this, but we don't use it, redundant with WAKEUP */
+	if (inta & CSR_INT_BIT_SCD) {
+		IWL_DEBUG_ISR(trans,
+			      "Scheduler finished to transmit the frame/frames.\n");
+		isr_stats->sch++;
+	}
 
-		/* Alive notification via Rx interrupt will do the real work */
-		if (inta & CSR_INT_BIT_ALIVE) {
-			IWL_DEBUG_ISR(trans, "Alive interrupt\n");
-			isr_stats->alive++;
-			if (trans->cfg->gen2) {
-				/*
-				 * We can restock, since firmware configured
-				 * the RFH
-				 */
-				iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
-			}
+	/* Alive notification via Rx interrupt will do the real work */
+	if (inta & CSR_INT_BIT_ALIVE) {
+		IWL_DEBUG_ISR(trans, "Alive interrupt\n");
+		isr_stats->alive++;
+		if (trans->cfg->gen2) {
+			/*
+			 * We can restock, since firmware configured
+			 * the RFH
+			 */
+			iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
 		}
 	}
 
-- 
GitLab


From a32e2ceca0efd2dc5647debc0aaf1b37dc410a62 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Wed, 22 May 2019 12:17:09 +0300
Subject: [PATCH 0976/1835] iwlwifi: don't WARN when calling
 iwl_get_shared_mem_conf with RF-Kill

commit 0d53cfd0cca3c729a089c39eef0e7d8ae7662974 upstream.

iwl_mvm_send_cmd returns 0 when the command won't be sent
because RF-Kill is asserted. Do the same when we call
iwl_get_shared_mem_conf since it is not sent through
iwl_mvm_send_cmd but directly calls the transport layer.

Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/smem.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
index ff85d69c2a8cb..557ee47bffd8c 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -134,6 +134,7 @@ void iwl_get_shared_mem_conf(struct iwl_fw_runtime *fwrt)
 		.len = { 0, },
 	};
 	struct iwl_rx_packet *pkt;
+	int ret;
 
 	if (fw_has_capa(&fwrt->fw->ucode_capa,
 			IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG))
@@ -141,8 +142,13 @@ void iwl_get_shared_mem_conf(struct iwl_fw_runtime *fwrt)
 	else
 		cmd.id = SHARED_MEM_CFG;
 
-	if (WARN_ON(iwl_trans_send_cmd(fwrt->trans, &cmd)))
+	ret = iwl_trans_send_cmd(fwrt->trans, &cmd);
+
+	if (ret) {
+		WARN(ret != -ERFKILL,
+		     "Could not send the SMEM command: %d\n", ret);
 		return;
+	}
 
 	pkt = cmd.resp_pkt;
 	if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000)
-- 
GitLab


From 6825ff011c7c1a3419584055ba05f3a3143b32b5 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Mon, 20 May 2019 15:18:24 +0300
Subject: [PATCH 0977/1835] iwlwifi: fix RF-Kill interrupt while FW load for
 gen2 devices

commit ed3e4c6d3cd8f093a3636cb05492429fe2af228d upstream.

Newest devices have a new firmware load mechanism. This
mechanism is called the context info. It means that the
driver doesn't need to load the sections of the firmware.
The driver rather prepares a place in DRAM, with pointers
to the relevant sections of the firmware, and the firmware
loads itself.
At the end of the process, the firmware sends the ALIVE
interrupt. This is different from the previous scheme in
which the driver expected the FH_TX interrupt after each
section being transferred over the DMA.

In order to support this new flow, we enabled all the
interrupts. This broke the assumption that we have in the
code that the RF-Kill interrupt can't interrupt the firmware
load flow.

Change the context info flow to enable only the ALIVE
interrupt, and re-enable all the other interrupts only
after the firmware is alive. Then, we won't see the RF-Kill
interrupt until then. Getting the RF-Kill interrupt while
loading the firmware made us kill the firmware while it is
loading and we ended up dumping garbage instead of the firmware
state.

Re-enable the ALIVE | RX interrupts from the ISR when we
get the ALIVE interrupt to be able to get the RX interrupt
that comes immediately afterwards for the ALIVE
notification. This is needed for non MSI-X only.

Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../intel/iwlwifi/pcie/ctxt-info-gen3.c       |  2 +-
 .../wireless/intel/iwlwifi/pcie/ctxt-info.c   |  2 +-
 .../wireless/intel/iwlwifi/pcie/internal.h    | 27 +++++++++++++++++++
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c  |  5 ++++
 .../wireless/intel/iwlwifi/pcie/trans-gen2.c  |  9 +++++++
 5 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
index 2146fda8da2fd..64d976d872b84 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -164,7 +164,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
 
 	memcpy(iml_img, trans->iml, trans->iml_len);
 
-	iwl_enable_interrupts(trans);
+	iwl_enable_fw_load_int_ctx_info(trans);
 
 	/* kick FW self load */
 	iwl_write64(trans, CSR_CTXT_INFO_ADDR,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
index b2cd7ef5fc3a9..6f25fd1bbd8f4 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
@@ -206,7 +206,7 @@ int iwl_pcie_ctxt_info_init(struct iwl_trans *trans,
 
 	trans_pcie->ctxt_info = ctxt_info;
 
-	iwl_enable_interrupts(trans);
+	iwl_enable_fw_load_int_ctx_info(trans);
 
 	/* Configure debug, if exists */
 	if (trans->dbg_dest_tlv)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index b63d44b7cd7c7..00f9566bcc213 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -896,6 +896,33 @@ static inline void iwl_enable_fw_load_int(struct iwl_trans *trans)
 	}
 }
 
+static inline void iwl_enable_fw_load_int_ctx_info(struct iwl_trans *trans)
+{
+	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+	IWL_DEBUG_ISR(trans, "Enabling ALIVE interrupt only\n");
+
+	if (!trans_pcie->msix_enabled) {
+		/*
+		 * When we'll receive the ALIVE interrupt, the ISR will call
+		 * iwl_enable_fw_load_int_ctx_info again to set the ALIVE
+		 * interrupt (which is not really needed anymore) but also the
+		 * RX interrupt which will allow us to receive the ALIVE
+		 * notification (which is Rx) and continue the flow.
+		 */
+		trans_pcie->inta_mask =  CSR_INT_BIT_ALIVE | CSR_INT_BIT_FH_RX;
+		iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
+	} else {
+		iwl_enable_hw_int_msk_msix(trans,
+					   MSIX_HW_INT_CAUSES_REG_ALIVE);
+		/*
+		 * Leave all the FH causes enabled to get the ALIVE
+		 * notification.
+		 */
+		iwl_enable_fh_int_msk_msix(trans, trans_pcie->fh_init_mask);
+	}
+}
+
 static inline u16 iwl_pcie_get_cmd_index(const struct iwl_txq *q, u32 index)
 {
 	return index & (q->n_window - 1);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 747ca8b92cdcf..1d144985ea589 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -1796,6 +1796,8 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 			 */
 			iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
 		}
+
+		handled |= CSR_INT_BIT_ALIVE;
 	}
 
 	/* Safely ignore these bits for debug checks below */
@@ -1914,6 +1916,9 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 	/* Re-enable RF_KILL if it occurred */
 	else if (handled & CSR_INT_BIT_RF_KILL)
 		iwl_enable_rfkill_int(trans);
+	/* Re-enable the ALIVE / Rx interrupt if it occurred */
+	else if (handled & (CSR_INT_BIT_ALIVE | CSR_INT_BIT_FH_RX))
+		iwl_enable_fw_load_int_ctx_info(trans);
 	spin_unlock(&trans_pcie->irq_lock);
 
 out:
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index 2bc67219ed3ef..31e72e1ff1e26 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -289,6 +289,15 @@ void iwl_trans_pcie_gen2_fw_alive(struct iwl_trans *trans, u32 scd_addr)
 	 * paging memory cannot be freed included since FW will still use it
 	 */
 	iwl_pcie_ctxt_info_free(trans);
+
+	/*
+	 * Re-enable all the interrupts, including the RF-Kill one, now that
+	 * the firmware is alive.
+	 */
+	iwl_enable_interrupts(trans);
+	mutex_lock(&trans_pcie->mutex);
+	iwl_pcie_check_hw_rf_kill(trans);
+	mutex_unlock(&trans_pcie->mutex);
 }
 
 int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
-- 
GitLab


From 5347e61954fcf2e47cbe9620aa21e42f4bc94057 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Thu, 27 Jun 2019 06:41:45 -0400
Subject: [PATCH 0978/1835] NFSv4: Handle the special Linux file open access
 mode

commit 44942b4e457beda00981f616402a1a791e8c616e upstream.

According to the open() manpage, Linux reserves the access mode 3
to mean "check for read and write permission on the file and return
a file descriptor that can't be used for reading or writing."

Currently, the NFSv4 code will ask the server to open the file,
and will use an incorrect share access mode of 0. Since it has
an incorrect share access mode, the client later forgets to send
a corresponding close, meaning it can leak stateids on the server.

Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations")
Cc: stable@vger.kernel.org # 3.6+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/inode.c    | 1 +
 fs/nfs/nfs4file.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index b65aee481d131..e4cd3a2fe6989 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1100,6 +1100,7 @@ int nfs_open(struct inode *inode, struct file *filp)
 	nfs_fscache_open_file(inode, filp);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(nfs_open);
 
 /*
  * This function is called whenever some part of NFS notices that
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 134858507268f..61abbb087ed13 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
 		return err;
 
 	if ((openflags & O_ACCMODE) == 3)
-		openflags--;
+		return nfs_open(inode, filp);
 
 	/* We can't create new files here */
 	openflags &= ~(O_CREAT|O_EXCL);
-- 
GitLab


From 603e7497bf275ef3766bb55323a23235dc0f0dfa Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Wed, 17 Jul 2019 13:57:44 -0400
Subject: [PATCH 0979/1835] pnfs/flexfiles: Fix PTR_ERR() dereferences in
 ff_layout_track_ds_error

commit 8e04fdfadda75a849c649f7e50fe7d97772e1fcb upstream.

mirror->mirror_ds can be NULL if uninitialised, but can contain
a PTR_ERR() if call to GETDEVICEINFO failed.

Fixes: 65990d1afbd2 ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: stable@vger.kernel.org # 4.10+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 364028c710a8b..8da239b6cc16f 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -307,7 +307,7 @@ int ff_layout_track_ds_error(struct nfs4_flexfile_layout *flo,
 	if (status == 0)
 		return 0;
 
-	if (mirror->mirror_ds == NULL)
+	if (IS_ERR_OR_NULL(mirror->mirror_ds))
 		return -EINVAL;
 
 	dserr = kmalloc(sizeof(*dserr), gfp_flags);
-- 
GitLab


From f64ff5914f00f51882da9cdc269f067d7b82a774 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Tue, 12 Mar 2019 16:04:51 -0400
Subject: [PATCH 0980/1835] pNFS: Fix a typo in pnfs_update_layout

commit 400417b05f3ec0531544ca5f94e64d838d8b8849 upstream.

We're supposed to wait for the outstanding layout count to go to zero,
but that got lost somehow.

Fixes: d03360aaf5cca ("pNFS: Ensure we return the error if someone...")
Reported-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/pnfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 7d9a51e6b847c..1aa628c98966b 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1866,7 +1866,7 @@ lookup_again:
 	    atomic_read(&lo->plh_outstanding) != 0) {
 		spin_unlock(&ino->i_lock);
 		lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding,
-					atomic_read(&lo->plh_outstanding)));
+					!atomic_read(&lo->plh_outstanding)));
 		if (IS_ERR(lseg) || !list_empty(&lo->plh_segs))
 			goto out_put_layout_hdr;
 		pnfs_put_layout_hdr(lo);
-- 
GitLab


From 0b174bac4e43d9de3e46df5165dd59f98a955cd9 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Thu, 18 Jul 2019 15:33:42 -0400
Subject: [PATCH 0981/1835] pnfs: Fix a problem where we gratuitously start
 doing I/O through the MDS

commit 58bbeab425c6c5e318f5b6ae31d351331ddfb34b upstream.

If the client has to stop in pnfs_update_layout() to wait for another
layoutget to complete, it currently exits and defaults to I/O through
the MDS if the layoutget was successful.

Fixes: d03360aaf5cc ("pNFS: Ensure we return the error if someone kills...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: stable@vger.kernel.org # v4.20+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/pnfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 1aa628c98966b..4931c3a75f038 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1867,7 +1867,7 @@ lookup_again:
 		spin_unlock(&ino->i_lock);
 		lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding,
 					!atomic_read(&lo->plh_outstanding)));
-		if (IS_ERR(lseg) || !list_empty(&lo->plh_segs))
+		if (IS_ERR(lseg))
 			goto out_put_layout_hdr;
 		pnfs_put_layout_hdr(lo);
 		goto lookup_again;
-- 
GitLab


From 677b2aa3be5ce01fa0d1e3514b069874ce2ea245 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Mon, 24 Jun 2019 07:20:14 +0000
Subject: [PATCH 0982/1835] lib/scatterlist: Fix mapping iterator when
 sg->offset is greater than PAGE_SIZE

commit aeb87246537a83c2aff482f3f34a2e0991e02cbc upstream.

All mapping iterator logic is based on the assumption that sg->offset
is always lower than PAGE_SIZE.

But there are situations where sg->offset is such that the SG item
is on the second page. In that case sg_copy_to_buffer() fails
properly copying the data into the buffer. One of the reason is
that the data will be outside the kmapped area used to access that
data.

This patch fixes the issue by adjusting the mapping iterator
offset and pgoffset fields such that offset is always lower than
PAGE_SIZE.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Fixes: 4225fc8555a9 ("lib/scatterlist: use page iterator in the mapping iterator")
Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/scatterlist.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 7c6096a717048..8c3036c37ba0e 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -652,17 +652,18 @@ static bool sg_miter_get_next_page(struct sg_mapping_iter *miter)
 {
 	if (!miter->__remaining) {
 		struct scatterlist *sg;
-		unsigned long pgoffset;
 
 		if (!__sg_page_iter_next(&miter->piter))
 			return false;
 
 		sg = miter->piter.sg;
-		pgoffset = miter->piter.sg_pgoffset;
 
-		miter->__offset = pgoffset ? 0 : sg->offset;
+		miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset;
+		miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT;
+		miter->__offset &= PAGE_SIZE - 1;
 		miter->__remaining = sg->offset + sg->length -
-				(pgoffset << PAGE_SHIFT) - miter->__offset;
+				     (miter->piter.sg_pgoffset << PAGE_SHIFT) -
+				     miter->__offset;
 		miter->__remaining = min_t(unsigned long, miter->__remaining,
 					   PAGE_SIZE - miter->__offset);
 	}
-- 
GitLab


From 3f42c0000b23ec5a6bf86893e4f4172aa94d5c6a Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Fri, 21 Jun 2019 12:33:57 +0100
Subject: [PATCH 0983/1835] ASoC: dapm: Adapt for debugfs API change

commit ceaea851b9ea75f9ea2bbefb53ff0d4b27cd5a6e upstream.

Back in ff9fb72bc07705c (debugfs: return error values, not NULL) the
debugfs APIs were changed to return error pointers rather than NULL
pointers on error, breaking the error checking in ASoC. Update the
code to use IS_ERR() and log the codes that are returned as part of
the error messages.

Fixes: ff9fb72bc07705c (debugfs: return error values, not NULL)
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/soc-dapm.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 2257b1b0151c4..3bfc788372f31 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2139,23 +2139,25 @@ void snd_soc_dapm_debugfs_init(struct snd_soc_dapm_context *dapm,
 {
 	struct dentry *d;
 
-	if (!parent)
+	if (!parent || IS_ERR(parent))
 		return;
 
 	dapm->debugfs_dapm = debugfs_create_dir("dapm", parent);
 
-	if (!dapm->debugfs_dapm) {
+	if (IS_ERR(dapm->debugfs_dapm)) {
 		dev_warn(dapm->dev,
-		       "ASoC: Failed to create DAPM debugfs directory\n");
+			 "ASoC: Failed to create DAPM debugfs directory %ld\n",
+			 PTR_ERR(dapm->debugfs_dapm));
 		return;
 	}
 
 	d = debugfs_create_file("bias_level", 0444,
 				dapm->debugfs_dapm, dapm,
 				&dapm_bias_fops);
-	if (!d)
+	if (IS_ERR(d))
 		dev_warn(dapm->dev,
-			 "ASoC: Failed to create bias level debugfs file\n");
+			 "ASoC: Failed to create bias level debugfs file: %ld\n",
+			 PTR_ERR(d));
 }
 
 static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
@@ -2169,10 +2171,10 @@ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
 	d = debugfs_create_file(w->name, 0444,
 				dapm->debugfs_dapm, w,
 				&dapm_widget_power_fops);
-	if (!d)
+	if (IS_ERR(d))
 		dev_warn(w->dapm->dev,
-			"ASoC: Failed to create %s debugfs file\n",
-			w->name);
+			 "ASoC: Failed to create %s debugfs file: %ld\n",
+			 w->name, PTR_ERR(d));
 }
 
 static void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm)
-- 
GitLab


From eb6c84e4b4f2cf23e2cbd6e358703b1675ff8bec Mon Sep 17 00:00:00 2001
From: Xiao Ni <xni@redhat.com>
Date: Fri, 14 Jun 2019 15:41:05 -0700
Subject: [PATCH 0984/1835] raid5-cache: Need to do start() part job after
 adding journal device

commit d9771f5ec46c282d518b453c793635dbdc3a2a94 upstream.

commit d5d885fd514f ("md: introduce new personality funciton start()")
splits the init job to two parts. The first part run() does the jobs that
do not require the md threads. The second part start() does the jobs that
require the md threads.

Now it just does run() in adding new journal device. It needs to do the
second part start() too.

Fixes: d5d885fd514f ("md: introduce new personality funciton start()")
Cc: stable@vger.kernel.org #v4.9+
Reported-by: Michal Soltys <soltys@ziu.info>
Signed-off-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/raid5.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index f237d6f307529..a147619498dfb 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7670,7 +7670,7 @@ abort:
 static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 {
 	struct r5conf *conf = mddev->private;
-	int err = -EEXIST;
+	int ret, err = -EEXIST;
 	int disk;
 	struct disk_info *p;
 	int first = 0;
@@ -7685,7 +7685,14 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 		 * The array is in readonly mode if journal is missing, so no
 		 * write requests running. We should be safe
 		 */
-		log_init(conf, rdev, false);
+		ret = log_init(conf, rdev, false);
+		if (ret)
+			return ret;
+
+		ret = r5l_start(conf->log);
+		if (ret)
+			return ret;
+
 		return 0;
 	}
 	if (mddev->recovery_disabled == conf->recovery_disabled)
-- 
GitLab


From c92212a816171ecce22c808f5d6b9ec227cdf126 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Mon, 15 Jul 2019 22:50:27 +0200
Subject: [PATCH 0985/1835] ALSA: seq: Break too long mutex context in the
 write loop

commit ede34f397ddb063b145b9e7d79c6026f819ded13 upstream.

The fix for the racy writes and ioctls to sequencer widened the
application of client->ioctl_mutex to the whole write loop.  Although
it does unlock/relock for the lengthy operation like the event dup,
the loop keeps the ioctl_mutex for the whole time in other
situations.  This may take quite long time if the user-space would
give a huge buffer, and this is a likely cause of some weird behavior
spotted by syzcaller fuzzer.

This patch puts a simple workaround, just adding a mutex break in the
loop when a large number of events have been processed.  This
shouldn't hit any performance drop because the threshold is set high
enough for usual operations.

Fixes: 7bd800915677 ("ALSA: seq: More protection for concurrent write and ioctl races")
Reported-by: syzbot+97aae04ce27e39cbfca9@syzkaller.appspotmail.com
Reported-by: syzbot+4c595632b98bb8ffcc66@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq/seq_clientmgr.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index f59e13c1d84a8..bbf91a5a938b6 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1004,7 +1004,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 {
 	struct snd_seq_client *client = file->private_data;
 	int written = 0, len;
-	int err;
+	int err, handled;
 	struct snd_seq_event event;
 
 	if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
@@ -1017,6 +1017,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 	if (!client->accept_output || client->pool == NULL)
 		return -ENXIO;
 
+ repeat:
+	handled = 0;
 	/* allocate the pool now if the pool is not allocated yet */ 
 	mutex_lock(&client->ioctl_mutex);
 	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
@@ -1076,12 +1078,19 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 						   0, 0, &client->ioctl_mutex);
 		if (err < 0)
 			break;
+		handled++;
 
 	__skip_event:
 		/* Update pointers and counts */
 		count -= len;
 		buf += len;
 		written += len;
+
+		/* let's have a coffee break if too many events are queued */
+		if (++handled >= 200) {
+			mutex_unlock(&client->ioctl_mutex);
+			goto repeat;
+		}
 	}
 
  out:
-- 
GitLab


From 8ba78e4d564e79c43777770c06bdaf3ab9e1b3c6 Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Mon, 15 Jul 2019 10:41:50 +0800
Subject: [PATCH 0986/1835] ALSA: hda/realtek - Fixed Headphone Mic can't
 record on Dell platform

commit fbc571290d9f7bfe089c50f4ac4028dd98ebfe98 upstream.

It assigned to wrong model. So, The headphone Mic can't work.

Fixes: 3f640970a414 ("ALSA: hda - Fix headset mic detection problem for several Dell laptops")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 98cfdcfce5b36..d5c36e8d2aa2b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7518,9 +7518,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
 		{0x12, 0x90a60130},
 		{0x17, 0x90170110},
 		{0x21, 0x03211020}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 		{0x14, 0x90170110},
 		{0x21, 0x04211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+		{0x14, 0x90170110},
+		{0x21, 0x04211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC295_STANDARD_PINS,
 		{0x17, 0x21014020},
-- 
GitLab


From a4c4c06f175541308a4fcc214b9ce7bfea58bc33 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Tue, 16 Jul 2019 15:21:34 +0800
Subject: [PATCH 0987/1835] ALSA: hda/realtek: apply ALC891 headset fixup to
 one Dell machine

commit 4b4e0e32e4b09274dbc9d173016c1a026f44608c upstream.

Without this patch, the headset-mic and headphone-mic don't work.

Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d5c36e8d2aa2b..dc1989686f09b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8657,6 +8657,11 @@ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
 		{0x18, 0x01a19030},
 		{0x1a, 0x01813040},
 		{0x21, 0x01014020}),
+	SND_HDA_PIN_QUIRK(0x10ec0867, 0x1028, "Dell", ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
+		{0x16, 0x01813030},
+		{0x17, 0x02211010},
+		{0x18, 0x01a19040},
+		{0x21, 0x01014020}),
 	SND_HDA_PIN_QUIRK(0x10ec0662, 0x1028, "Dell", ALC662_FIXUP_DELL_MIC_NO_PRESENCE,
 		{0x14, 0x01014010},
 		{0x18, 0x01a19020},
-- 
GitLab


From fc0232e24541ca3051973d377559644be49d4f1a Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@collabora.com>
Date: Wed, 19 Jun 2019 05:21:33 -0400
Subject: [PATCH 0988/1835] media: v4l2: Test type instead of cfg->type in
 v4l2_ctrl_new_custom()

commit 07d89227a983df957a6a7c56f7c040cde9ac571f upstream.

cfg->type can be overridden by v4l2_ctrl_fill() and the new value is
stored in the local type var. Fix the tests to use this local var.

Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
[hverkuil-cisco@xs4all.nl: change to !qmenu and !qmenu_int (checkpatch)]
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/v4l2-core/v4l2-ctrls.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 6ac5f5d426154..0986572bbe881 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -2249,16 +2249,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
 		v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
 								&def, &flags);
 
-	is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU ||
-		   cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU);
+	is_menu = (type == V4L2_CTRL_TYPE_MENU ||
+		   type == V4L2_CTRL_TYPE_INTEGER_MENU);
 	if (is_menu)
 		WARN_ON(step);
 	else
 		WARN_ON(cfg->menu_skip_mask);
-	if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL)
+	if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
 		qmenu = v4l2_ctrl_get_menu(cfg->id);
-	else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU &&
-		 qmenu_int == NULL) {
+	} else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
 		handler_set_err(hdl, -EINVAL);
 		return NULL;
 	}
-- 
GitLab


From deb78bd24e0cd196acffbedffb9bed7a8839b227 Mon Sep 17 00:00:00 2001
From: Ezequiel Garcia <ezequiel@collabora.com>
Date: Thu, 2 May 2019 18:00:43 -0400
Subject: [PATCH 0989/1835] media: coda: Remove unbalanced and unneeded mutex
 unlock

commit 766b9b168f6c75c350dd87c3e0bc6a9b322f0013 upstream.

The mutex unlock in the threaded interrupt handler is not paired
with any mutex lock. Remove it.

This bug has been here for a really long time, so it applies
to any stable repo.

Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/coda/coda-bit.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index 925581d65ad8a..c3eaddced7214 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -2309,7 +2309,6 @@ irqreturn_t coda_irq_handler(int irq, void *data)
 	if (ctx == NULL) {
 		v4l2_err(&dev->v4l2_dev,
 			 "Instance released before the end of transaction\n");
-		mutex_unlock(&dev->coda_mutex);
 		return IRQ_HANDLED;
 	}
 
-- 
GitLab


From cb2e2b0ae55421b320830dbd5d860aadce86bf3e Mon Sep 17 00:00:00 2001
From: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Wed, 12 Dec 2018 07:27:10 -0500
Subject: [PATCH 0990/1835] media: videobuf2-core: Prevent size alignment
 wrapping buffer size to 0

commit defcdc5d89ced780fb45196d539d6570ec5b1ba5 upstream.

PAGE_ALIGN() may wrap the buffer size around to 0. Prevent this by
checking that the aligned value is not smaller than the unaligned one.

Note on backporting to stable: the file used to be under
drivers/media/v4l2-core, it was moved to the current location after 4.14.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 9226dca44e907..93d250db0b6f0 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -207,6 +207,10 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb)
 	for (plane = 0; plane < vb->num_planes; ++plane) {
 		unsigned long size = PAGE_ALIGN(vb->planes[plane].length);
 
+		/* Did it wrap around? */
+		if (size < vb->planes[plane].length)
+			goto free;
+
 		mem_priv = call_ptr_memop(vb, alloc,
 				q->alloc_devs[plane] ? : q->dev,
 				q->dma_attrs, size, q->dma_dir, q->gfp_flags);
-- 
GitLab


From 87bae91a0fe9e76b69e5110ca35caeba29dcc182 Mon Sep 17 00:00:00 2001
From: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Wed, 12 Dec 2018 07:44:14 -0500
Subject: [PATCH 0991/1835] media: videobuf2-dma-sg: Prevent size from
 overflowing

commit 14f28f5cea9e3998442de87846d1907a531b6748 upstream.

buf->size is an unsigned long; casting that to int will lead to an
overflow if buf->size exceeds INT_MAX.

Fix this by changing the type to unsigned long instead. This is possible
as the buf->size is always aligned to PAGE_SIZE, and therefore the size
will never have values lesser than 0.

Note on backporting to stable: the file used to be under
drivers/media/v4l2-core, it was moved to the current location after 4.14.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
index 015e737095cdd..e9bfea986cc47 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
@@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct vb2_dma_sg_buf *buf,
 		gfp_t gfp_flags)
 {
 	unsigned int last_page = 0;
-	int size = buf->size;
+	unsigned long size = buf->size;
 
 	while (size > 0) {
 		struct page *pages;
-- 
GitLab


From ba27a25df6df0ad3dad12d87fbc39a3218c7f5d2 Mon Sep 17 00:00:00 2001
From: Like Xu <like.xu@linux.intel.com>
Date: Thu, 18 Jul 2019 13:35:14 +0800
Subject: [PATCH 0992/1835] KVM: x86/vPMU: refine kvm_pmu err msg when event
 creation failed

commit 6fc3977ccc5d3c22e851f2dce2d3ce2a0a843842 upstream.

If a perf_event creation fails due to any reason of the host perf
subsystem, it has no chance to log the corresponding event for guest
which may cause abnormal sampling data in guest result. In debug mode,
this message helps to understand the state of vPMC and we may not
limit the number of occurrences but not in a spamming style.

Suggested-by: Joe Perches <joe@perches.com>
Signed-off-by: Like Xu <like.xu@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/pmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 952aebd0a8a34..acc8d217f6565 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -131,8 +131,8 @@ static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type,
 						 intr ? kvm_perf_overflow_intr :
 						 kvm_perf_overflow, pmc);
 	if (IS_ERR(event)) {
-		printk_once("kvm_pmu: event creation failed %ld\n",
-			    PTR_ERR(event));
+		pr_debug_ratelimited("kvm_pmu: event creation failed %ld for pmc->idx = %d\n",
+			    PTR_ERR(event), pmc->idx);
 		return;
 	}
 
-- 
GitLab


From ba271659ad4231706b84e5539f630792db5b42ce Mon Sep 17 00:00:00 2001
From: Jon Hunter <jonathanh@nvidia.com>
Date: Thu, 20 Jun 2019 09:17:00 +0100
Subject: [PATCH 0993/1835] arm64: tegra: Fix AGIC register range

commit ba24eee6686f6ed3738602b54d959253316a9541 upstream.

The Tegra AGIC interrupt controller is an ARM GIC400 interrupt
controller. Per the ARM GIC device-tree binding, the first address
region is for the GIC distributor registers and the second address
region is for the GIC CPU interface registers. The address space for
the distributor registers is 4kB, but currently this is incorrectly
defined as 8kB for the Tegra AGIC and overlaps with the CPU interface
registers. Correct the address space for the distributor to be 4kB.

Cc: stable@vger.kernel.org
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Fixes: bcdbde433542 ("arm64: tegra: Add AGIC node for Tegra210")
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/nvidia/tegra210.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
index 3be920efee823..6597c0894137a 100644
--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
@@ -1119,7 +1119,7 @@
 			compatible = "nvidia,tegra210-agic";
 			#interrupt-cells = <3>;
 			interrupt-controller;
-			reg = <0x702f9000 0x2000>,
+			reg = <0x702f9000 0x1000>,
 			      <0x702fa000 0x2000>;
 			interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
 			clocks = <&tegra_car TEGRA210_CLK_APE>;
-- 
GitLab


From 2c7b50c7b1d036f71acd9a917a8cb0f9b6e43dab Mon Sep 17 00:00:00 2001
From: Radoslaw Burny <rburny@google.com>
Date: Tue, 16 Jul 2019 16:26:51 -0700
Subject: [PATCH 0994/1835] fs/proc/proc_sysctl.c: fix the default values of
 i_uid/i_gid on /proc/sys inodes.

commit 5ec27ec735ba0477d48c80561cc5e856f0c5dfaf upstream.

Normally, the inode's i_uid/i_gid are translated relative to s_user_ns,
but this is not a correct behavior for proc.  Since sysctl permission
check in test_perm is done against GLOBAL_ROOT_[UG]ID, it makes more
sense to use these values in u_[ug]id of proc inodes.  In other words:
although uid/gid in the inode is not read during test_perm, the inode
logically belongs to the root of the namespace.  I have confirmed this
with Eric Biederman at LPC and in this thread:
  https://lore.kernel.org/lkml/87k1kzjdff.fsf@xmission.com

Consequences
============

Since the i_[ug]id values of proc nodes are not used for permissions
checks, this change usually makes no functional difference.  However, it
causes an issue in a setup where:

 * a namespace container is created without root user in container -
   hence the i_[ug]id of proc nodes are set to INVALID_[UG]ID

 * container creator tries to configure it by writing /proc/sys files,
   e.g. writing /proc/sys/kernel/shmmax to configure shared memory limit

Kernel does not allow to open an inode for writing if its i_[ug]id are
invalid, making it impossible to write shmmax and thus - configure the
container.

Using a container with no root mapping is apparently rare, but we do use
this configuration at Google.  Also, we use a generic tool to configure
the container limits, and the inability to write any of them causes a
failure.

History
=======

The invalid uids/gids in inodes first appeared due to 81754357770e (fs:
Update i_[ug]id_(read|write) to translate relative to s_user_ns).
However, AFAIK, this did not immediately cause any issues.  The
inability to write to these "invalid" inodes was only caused by a later
commit 0bd23d09b874 (vfs: Don't modify inodes with a uid or gid unknown
to the vfs).

Tested: Used a repro program that creates a user namespace without any
mapping and stat'ed /proc/$PID/root/proc/sys/kernel/shmmax from outside.
Before the change, it shows the overflow uid, with the change it's 0.
The overflow uid indicates that the uid in the inode is not correct and
thus it is not possible to open the file for writing.

Link: http://lkml.kernel.org/r/20190708115130.250149-1-rburny@google.com
Fixes: 0bd23d09b874 ("vfs: Don't modify inodes with a uid or gid unknown to the vfs")
Signed-off-by: Radoslaw Burny <rburny@google.com>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: "Eric W . Biederman" <ebiederm@xmission.com>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: John Sperbeck <jsperbeck@google.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>	[4.8+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/proc_sysctl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 7325baa8f9d47..c95f32b83a942 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -498,6 +498,10 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
 
 	if (root->set_ownership)
 		root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
+	else {
+		inode->i_uid = GLOBAL_ROOT_UID;
+		inode->i_gid = GLOBAL_ROOT_GID;
+	}
 
 	return inode;
 }
-- 
GitLab


From c77cbc873586322b40401bc35262cddcf8cfefca Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Fri, 12 Jul 2019 15:07:09 +0900
Subject: [PATCH 0995/1835] kconfig: fix missing choice values in auto.conf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8e2442a5f86e1f77b86401fce274a7f622740bc4 upstream.

Since commit 00c864f8903d ("kconfig: allow all config targets to write
auto.conf if missing"), Kconfig creates include/config/auto.conf in the
defconfig stage when it is missing.

Joonas Kylmälä reported incorrect auto.conf generation under some
circumstances.

To reproduce it, apply the following diff:

|  --- a/arch/arm/configs/imx_v6_v7_defconfig
|  +++ b/arch/arm/configs/imx_v6_v7_defconfig
|  @@ -345,14 +345,7 @@ CONFIG_USB_CONFIGFS_F_MIDI=y
|   CONFIG_USB_CONFIGFS_F_HID=y
|   CONFIG_USB_CONFIGFS_F_UVC=y
|   CONFIG_USB_CONFIGFS_F_PRINTER=y
|  -CONFIG_USB_ZERO=m
|  -CONFIG_USB_AUDIO=m
|  -CONFIG_USB_ETH=m
|  -CONFIG_USB_G_NCM=m
|  -CONFIG_USB_GADGETFS=m
|  -CONFIG_USB_FUNCTIONFS=m
|  -CONFIG_USB_MASS_STORAGE=m
|  -CONFIG_USB_G_SERIAL=m
|  +CONFIG_USB_FUNCTIONFS=y
|   CONFIG_MMC=y
|   CONFIG_MMC_SDHCI=y
|   CONFIG_MMC_SDHCI_PLTFM=y

And then, run:

$ make ARCH=arm mrproper imx_v6_v7_defconfig

You will see CONFIG_USB_FUNCTIONFS=y is correctly contained in the
.config, but not in the auto.conf.

Please note drivers/usb/gadget/legacy/Kconfig is included from a choice
block in drivers/usb/gadget/Kconfig. So USB_FUNCTIONFS is a choice value.

This is probably a similar situation described in commit beaaddb62540
("kconfig: tests: test defconfig when two choices interact").

When sym_calc_choice() is called, the choice symbol forgets the
SYMBOL_DEF_USER unless all of its choice values are explicitly set by
the user.

The choice symbol is given just one chance to recall it because
set_all_choice_values() is called if SYMBOL_NEED_SET_CHOICE_VALUES
is set.

When sym_calc_choice() is called again, the choice symbol forgets it
forever, since SYMBOL_NEED_SET_CHOICE_VALUES is a one-time aid.
Hence, we cannot call sym_clear_all_valid() again and again.

It is crazy to repeat set and unset of internal flags. However, we
cannot simply get rid of "sym->flags &= flags | ~SYMBOL_DEF_USER;"
Doing so would re-introduce the problem solved by commit 5d09598d488f
("kconfig: fix new choices being skipped upon config update").

To work around the issue, conf_write_autoconf() stopped calling
sym_clear_all_valid().

conf_write() must be changed accordingly. Currently, it clears
SYMBOL_WRITE after the symbol is written into the .config file. This
is needed to prevent it from writing the same symbol multiple times in
case the symbol is declared in two or more locations. I added the new
flag SYMBOL_WRITTEN, to track the symbols that have been written.

Anyway, this is a cheesy workaround in order to suppress the issue
as far as defconfig is concerned.

Handling of choices is totally broken. sym_clear_all_valid() is called
every time a user touches a symbol from the GUI interface. To reproduce
it, just add a new symbol drivers/usb/gadget/legacy/Kconfig, then touch
around unrelated symbols from menuconfig. USB_FUNCTIONFS will disappear
from the .config file.

I added the Fixes tag since it is more fatal than before. But, this
has been broken since long long time before, and still it is.
We should take a closer look to fix this correctly somehow.

Fixes: 00c864f8903d ("kconfig: allow all config targets to write auto.conf if missing")
Cc: linux-stable <stable@vger.kernel.org> # 4.19+
Reported-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Tested-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/kconfig/confdata.c | 7 +++----
 scripts/kconfig/expr.h     | 1 +
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 91d0a5c014acd..fd99ae90a618b 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -834,11 +834,12 @@ int conf_write(const char *name)
 				     "#\n"
 				     "# %s\n"
 				     "#\n", str);
-		} else if (!(sym->flags & SYMBOL_CHOICE)) {
+		} else if (!(sym->flags & SYMBOL_CHOICE) &&
+			   !(sym->flags & SYMBOL_WRITTEN)) {
 			sym_calc_value(sym);
 			if (!(sym->flags & SYMBOL_WRITE))
 				goto next;
-			sym->flags &= ~SYMBOL_WRITE;
+			sym->flags |= SYMBOL_WRITTEN;
 
 			conf_write_symbol(out, sym, &kconfig_printer_cb, NULL);
 		}
@@ -1024,8 +1025,6 @@ int conf_write_autoconf(int overwrite)
 	if (!overwrite && is_present(autoconf_name))
 		return 0;
 
-	sym_clear_all_valid();
-
 	conf_write_dep("include/config/auto.conf.cmd");
 
 	if (conf_split_config())
diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
index 7c329e179007a..43a87f8ea738c 100644
--- a/scripts/kconfig/expr.h
+++ b/scripts/kconfig/expr.h
@@ -141,6 +141,7 @@ struct symbol {
 #define SYMBOL_OPTIONAL   0x0100  /* choice is optional - values can be 'n' */
 #define SYMBOL_WRITE      0x0200  /* write symbol to file (KCONFIG_CONFIG) */
 #define SYMBOL_CHANGED    0x0400  /* ? */
+#define SYMBOL_WRITTEN    0x0800  /* track info to avoid double-write to .config */
 #define SYMBOL_NO_WRITE   0x1000  /* Symbol for internal use only; it will not be written */
 #define SYMBOL_CHECKED    0x2000  /* used during dependency checking */
 #define SYMBOL_WARNED     0x8000  /* warning has been issued */
-- 
GitLab


From 0489d808a5f23debc252e6580c4550f55f39693f Mon Sep 17 00:00:00 2001
From: Lyude Paul <lyude@redhat.com>
Date: Wed, 26 Jun 2019 14:10:27 -0400
Subject: [PATCH 0996/1835] drm/nouveau/i2c: Enable i2c pads & busses during
 preinit

commit 7cb95eeea6706c790571042a06782e378b2561ea upstream.

It turns out that while disabling i2c bus access from software when the
GPU is suspended was a step in the right direction with:

commit 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after
->fini()")

We also ended up accidentally breaking the vbios init scripts on some
older Tesla GPUs, as apparently said scripts can actually use the i2c
bus. Since these scripts are executed before initializing any
subdevices, we end up failing to acquire access to the i2c bus which has
left a number of cards with their fan controllers uninitialized. Luckily
this doesn't break hardware - it just means the fan gets stuck at 100%.

This also means that we've always been using our i2c busses before
initializing them during the init scripts for older GPUs, we just didn't
notice it until we started preventing them from being used until init.
It's pretty impressive this never caused us any issues before!

So, fix this by initializing our i2c pad and busses during subdev
pre-init. We skip initializing aux busses during pre-init, as those are
guaranteed to only ever be used by nouveau for DP aux transactions.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Tested-by: Marc Meledandri <m.meledandri@gmail.com>
Fixes: 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after ->fini()")
Cc: stable@vger.kernel.org
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../gpu/drm/nouveau/nvkm/subdev/i2c/base.c    | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
index ecacb22834d76..7193450747111 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
@@ -184,6 +184,25 @@ nvkm_i2c_fini(struct nvkm_subdev *subdev, bool suspend)
 	return 0;
 }
 
+static int
+nvkm_i2c_preinit(struct nvkm_subdev *subdev)
+{
+	struct nvkm_i2c *i2c = nvkm_i2c(subdev);
+	struct nvkm_i2c_bus *bus;
+	struct nvkm_i2c_pad *pad;
+
+	/*
+	 * We init our i2c busses as early as possible, since they may be
+	 * needed by the vbios init scripts on some cards
+	 */
+	list_for_each_entry(pad, &i2c->pad, head)
+		nvkm_i2c_pad_init(pad);
+	list_for_each_entry(bus, &i2c->bus, head)
+		nvkm_i2c_bus_init(bus);
+
+	return 0;
+}
+
 static int
 nvkm_i2c_init(struct nvkm_subdev *subdev)
 {
@@ -238,6 +257,7 @@ nvkm_i2c_dtor(struct nvkm_subdev *subdev)
 static const struct nvkm_subdev_func
 nvkm_i2c = {
 	.dtor = nvkm_i2c_dtor,
+	.preinit = nvkm_i2c_preinit,
 	.init = nvkm_i2c_init,
 	.fini = nvkm_i2c_fini,
 	.intr = nvkm_i2c_intr,
-- 
GitLab


From 1e4247d7958baa2defb4ca81eefdc94c20bc752e Mon Sep 17 00:00:00 2001
From: Daniel Jordan <daniel.m.jordan@oracle.com>
Date: Tue, 16 Jul 2019 12:32:53 -0400
Subject: [PATCH 0997/1835] padata: use smp_mb in padata_reorder to avoid
 orphaned padata jobs

commit cf144f81a99d1a3928f90b0936accfd3f45c9a0a upstream.

Testing padata with the tcrypt module on a 5.2 kernel...

    # modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes)))" type=3
    # modprobe tcrypt mode=211 sec=1

...produces this splat:

    INFO: task modprobe:10075 blocked for more than 120 seconds.
          Not tainted 5.2.0-base+ #16
    modprobe        D    0 10075  10064 0x80004080
    Call Trace:
     ? __schedule+0x4dd/0x610
     ? ring_buffer_unlock_commit+0x23/0x100
     schedule+0x6c/0x90
     schedule_timeout+0x3b/0x320
     ? trace_buffer_unlock_commit_regs+0x4f/0x1f0
     wait_for_common+0x160/0x1a0
     ? wake_up_q+0x80/0x80
     { crypto_wait_req }             # entries in braces added by hand
     { do_one_aead_op }
     { test_aead_jiffies }
     test_aead_speed.constprop.17+0x681/0xf30 [tcrypt]
     do_test+0x4053/0x6a2b [tcrypt]
     ? 0xffffffffa00f4000
     tcrypt_mod_init+0x50/0x1000 [tcrypt]
     ...

The second modprobe command never finishes because in padata_reorder,
CPU0's load of reorder_objects is executed before the unlocking store in
spin_unlock_bh(pd->lock), causing CPU0 to miss CPU1's increment:

CPU0                                 CPU1

padata_reorder                       padata_do_serial
  LOAD reorder_objects  // 0
                                       INC reorder_objects  // 1
                                       padata_reorder
                                         TRYLOCK pd->lock   // failed
  UNLOCK pd->lock

CPU0 deletes the timer before returning from padata_reorder and since no
other job is submitted to padata, modprobe waits indefinitely.

Add a pair of full barriers to guarantee proper ordering:

CPU0                                 CPU1

padata_reorder                       padata_do_serial
  UNLOCK pd->lock
  smp_mb()
  LOAD reorder_objects
                                       INC reorder_objects
                                       smp_mb__after_atomic()
                                       padata_reorder
                                         TRYLOCK pd->lock

smp_mb__after_atomic is needed so the read part of the trylock operation
comes after the INC, as Andrea points out.   Thanks also to Andrea for
help with writing a litmus test.

Fixes: 16295bec6398 ("padata: Generic parallelization/serialization interface")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: <stable@vger.kernel.org>
Cc: Andrea Parri <andrea.parri@amarulasolutions.com>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Paul E. McKenney <paulmck@linux.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: linux-arch@vger.kernel.org
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/padata.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/padata.c b/kernel/padata.c
index d568cc56405f8..6c06b3039faed 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -267,7 +267,12 @@ static void padata_reorder(struct parallel_data *pd)
 	 * The next object that needs serialization might have arrived to
 	 * the reorder queues in the meantime, we will be called again
 	 * from the timer function if no one else cares for it.
+	 *
+	 * Ensure reorder_objects is read after pd->lock is dropped so we see
+	 * an increment from another task in padata_do_serial.  Pairs with
+	 * smp_mb__after_atomic in padata_do_serial.
 	 */
+	smp_mb();
 	if (atomic_read(&pd->reorder_objects)
 			&& !(pinst->flags & PADATA_RESET))
 		mod_timer(&pd->timer, jiffies + HZ);
@@ -387,6 +392,13 @@ void padata_do_serial(struct padata_priv *padata)
 	list_add_tail(&padata->list, &pqueue->reorder.list);
 	spin_unlock(&pqueue->reorder.lock);
 
+	/*
+	 * Ensure the atomic_inc of reorder_objects above is ordered correctly
+	 * with the trylock of pd->lock in padata_reorder.  Pairs with smp_mb
+	 * in padata_reorder.
+	 */
+	smp_mb__after_atomic();
+
 	put_cpu();
 
 	/* If we're running on the wrong CPU, call padata_reorder() via a
-- 
GitLab


From e380170b3b3a08b2f69f9abd0cbc381d18f15b52 Mon Sep 17 00:00:00 2001
From: Damien Le Moal <damien.lemoal@wdc.com>
Date: Tue, 16 Jul 2019 14:39:34 +0900
Subject: [PATCH 0998/1835] dm zoned: fix zone state management race

commit 3b8cafdd5436f9298b3bf6eb831df5eef5ee82b6 upstream.

dm-zoned uses the zone flag DMZ_ACTIVE to indicate that a zone of the
backend device is being actively read or written and so cannot be
reclaimed. This flag is set as long as the zone atomic reference
counter is not 0. When this atomic is decremented and reaches 0 (e.g.
on BIO completion), the active flag is cleared and set again whenever
the zone is reused and BIO issued with the atomic counter incremented.
These 2 operations (atomic inc/dec and flag set/clear) are however not
always executed atomically under the target metadata mutex lock and
this causes the warning:

WARN_ON(!test_bit(DMZ_ACTIVE, &zone->flags));

in dmz_deactivate_zone() to be displayed. This problem is regularly
triggered with xfstests generic/209, generic/300, generic/451 and
xfs/077 with XFS being used as the file system on the dm-zoned target
device. Similarly, xfstests ext4/303, ext4/304, generic/209 and
generic/300 trigger the warning with ext4 use.

This problem can be easily fixed by simply removing the DMZ_ACTIVE flag
and managing the "ACTIVE" state by directly looking at the reference
counter value. To do so, the functions dmz_activate_zone() and
dmz_deactivate_zone() are changed to inline functions respectively
calling atomic_inc() and atomic_dec(), while the dmz_is_active() macro
is changed to an inline function calling atomic_read().

Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target")
Cc: stable@vger.kernel.org
Reported-by: Masato Suzuki <masato.suzuki@wdc.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-zoned-metadata.c | 24 ------------------------
 drivers/md/dm-zoned.h          | 28 ++++++++++++++++++++++++----
 2 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index d8334cd45d7cb..4cdde7a02e94a 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1593,30 +1593,6 @@ struct dm_zone *dmz_get_zone_for_reclaim(struct dmz_metadata *zmd)
 	return zone;
 }
 
-/*
- * Activate a zone (increment its reference count).
- */
-void dmz_activate_zone(struct dm_zone *zone)
-{
-	set_bit(DMZ_ACTIVE, &zone->flags);
-	atomic_inc(&zone->refcount);
-}
-
-/*
- * Deactivate a zone. This decrement the zone reference counter
- * and clears the active state of the zone once the count reaches 0,
- * indicating that all BIOs to the zone have completed. Returns
- * true if the zone was deactivated.
- */
-void dmz_deactivate_zone(struct dm_zone *zone)
-{
-	if (atomic_dec_and_test(&zone->refcount)) {
-		WARN_ON(!test_bit(DMZ_ACTIVE, &zone->flags));
-		clear_bit_unlock(DMZ_ACTIVE, &zone->flags);
-		smp_mb__after_atomic();
-	}
-}
-
 /*
  * Get the zone mapping a chunk, if the chunk is mapped already.
  * If no mapping exist and the operation is WRITE, a zone is
diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
index 12419f0bfe78b..ed8de49c9a082 100644
--- a/drivers/md/dm-zoned.h
+++ b/drivers/md/dm-zoned.h
@@ -115,7 +115,6 @@ enum {
 	DMZ_BUF,
 
 	/* Zone internal state */
-	DMZ_ACTIVE,
 	DMZ_RECLAIM,
 	DMZ_SEQ_WRITE_ERR,
 };
@@ -128,7 +127,6 @@ enum {
 #define dmz_is_empty(z)		((z)->wp_block == 0)
 #define dmz_is_offline(z)	test_bit(DMZ_OFFLINE, &(z)->flags)
 #define dmz_is_readonly(z)	test_bit(DMZ_READ_ONLY, &(z)->flags)
-#define dmz_is_active(z)	test_bit(DMZ_ACTIVE, &(z)->flags)
 #define dmz_in_reclaim(z)	test_bit(DMZ_RECLAIM, &(z)->flags)
 #define dmz_seq_write_err(z)	test_bit(DMZ_SEQ_WRITE_ERR, &(z)->flags)
 
@@ -188,8 +186,30 @@ void dmz_unmap_zone(struct dmz_metadata *zmd, struct dm_zone *zone);
 unsigned int dmz_nr_rnd_zones(struct dmz_metadata *zmd);
 unsigned int dmz_nr_unmap_rnd_zones(struct dmz_metadata *zmd);
 
-void dmz_activate_zone(struct dm_zone *zone);
-void dmz_deactivate_zone(struct dm_zone *zone);
+/*
+ * Activate a zone (increment its reference count).
+ */
+static inline void dmz_activate_zone(struct dm_zone *zone)
+{
+	atomic_inc(&zone->refcount);
+}
+
+/*
+ * Deactivate a zone. This decrement the zone reference counter
+ * indicating that all BIOs to the zone have completed when the count is 0.
+ */
+static inline void dmz_deactivate_zone(struct dm_zone *zone)
+{
+	atomic_dec(&zone->refcount);
+}
+
+/*
+ * Test if a zone is active, that is, has a refcount > 0.
+ */
+static inline bool dmz_is_active(struct dm_zone *zone)
+{
+	return atomic_read(&zone->refcount);
+}
 
 int dmz_lock_zone_reclaim(struct dm_zone *zone);
 void dmz_unlock_zone_reclaim(struct dm_zone *zone);
-- 
GitLab


From 007e5aaf287c0191e54fb034340fe860b1fb96be Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 21 Jun 2019 20:47:03 +0200
Subject: [PATCH 0999/1835] xen/events: fix binding user event channels to cpus

commit bce5963bcb4f9934faa52be323994511d59fd13c upstream.

When binding an interdomain event channel to a vcpu via
IOCTL_EVTCHN_BIND_INTERDOMAIN not only the event channel needs to be
bound, but the affinity of the associated IRQi must be changed, too.
Otherwise the IRQ and the event channel won't be moved to another vcpu
in case the original vcpu they were bound to is going offline.

Cc: <stable@vger.kernel.org> # 4.13
Fixes: c48f64ab472389df ("xen-evtchn: Bind dyn evtchn:qemu-dm interrupt to next online VCPU")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 12 ++++++++++--
 drivers/xen/evtchn.c             |  2 +-
 include/xen/events.h             |  3 ++-
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index fe1f16351f941..8d49b91d92cd3 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -1293,7 +1293,7 @@ void rebind_evtchn_irq(int evtchn, int irq)
 }
 
 /* Rebind an evtchn so that it gets delivered to a specific cpu */
-int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu)
+static int xen_rebind_evtchn_to_cpu(int evtchn, unsigned int tcpu)
 {
 	struct evtchn_bind_vcpu bind_vcpu;
 	int masked;
@@ -1327,7 +1327,6 @@ int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(xen_rebind_evtchn_to_cpu);
 
 static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
 			    bool force)
@@ -1341,6 +1340,15 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
 	return ret;
 }
 
+/* To be called with desc->lock held. */
+int xen_set_affinity_evtchn(struct irq_desc *desc, unsigned int tcpu)
+{
+	struct irq_data *d = irq_desc_get_irq_data(desc);
+
+	return set_affinity_irq(d, cpumask_of(tcpu), false);
+}
+EXPORT_SYMBOL_GPL(xen_set_affinity_evtchn);
+
 static void enable_dynirq(struct irq_data *data)
 {
 	int evtchn = evtchn_from_irq(data->irq);
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 6d1a5e58968ff..47c70b826a6ab 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -447,7 +447,7 @@ static void evtchn_bind_interdom_next_vcpu(int evtchn)
 	this_cpu_write(bind_last_selected_cpu, selected_cpu);
 
 	/* unmask expects irqs to be disabled */
-	xen_rebind_evtchn_to_cpu(evtchn, selected_cpu);
+	xen_set_affinity_evtchn(desc, selected_cpu);
 	raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
diff --git a/include/xen/events.h b/include/xen/events.h
index c3e6bc643a7bd..1650d39decaec 100644
--- a/include/xen/events.h
+++ b/include/xen/events.h
@@ -3,6 +3,7 @@
 #define _XEN_EVENTS_H
 
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #ifdef CONFIG_PCI_MSI
 #include <linux/msi.h>
 #endif
@@ -59,7 +60,7 @@ void evtchn_put(unsigned int evtchn);
 
 void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector);
 void rebind_evtchn_irq(int evtchn, int irq);
-int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu);
+int xen_set_affinity_evtchn(struct irq_desc *desc, unsigned int tcpu);
 
 static inline void notify_remote_via_evtchn(int port)
 {
-- 
GitLab


From 1253882d64d06a851d93acd95c153f3a2cb0c392 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Tue, 30 Apr 2019 22:39:33 +0800
Subject: [PATCH 1000/1835] 9p/xen: Add cleanup path in p9_trans_xen_init

commit 80a316ff16276b36d0392a8f8b2f63259857ae98 upstream.

If xenbus_register_frontend() fails in p9_trans_xen_init,
we should call v9fs_unregister_trans() to do cleanup.

Link: http://lkml.kernel.org/r/20190430143933.19368-1-yuehaibing@huawei.com
Cc: stable@vger.kernel.org
Fixes: 868eb122739a ("xen/9pfs: introduce Xen 9pfs transport driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/9p/trans_xen.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index e2fbf3677b9ba..9daab0dd833b3 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -530,13 +530,19 @@ static struct xenbus_driver xen_9pfs_front_driver = {
 
 static int p9_trans_xen_init(void)
 {
+	int rc;
+
 	if (!xen_domain())
 		return -ENODEV;
 
 	pr_info("Initialising Xen transport for 9pfs\n");
 
 	v9fs_register_trans(&p9_xen_trans);
-	return xenbus_register_frontend(&xen_9pfs_front_driver);
+	rc = xenbus_register_frontend(&xen_9pfs_front_driver);
+	if (rc)
+		v9fs_unregister_trans(&p9_xen_trans);
+
+	return rc;
 }
 module_init(p9_trans_xen_init);
 
-- 
GitLab


From b52807e607f19d763ad19c2cdfcb7ef834a15259 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Tue, 30 Apr 2019 19:59:42 +0800
Subject: [PATCH 1001/1835] 9p/virtio: Add cleanup path in p9_virtio_init

commit d4548543fc4ece56c6f04b8586f435fb4fd84c20 upstream.

KASAN report this:

BUG: unable to handle kernel paging request at ffffffffa0097000
PGD 3870067 P4D 3870067 PUD 3871063 PMD 2326e2067 PTE 0
Oops: 0000 [#1
CPU: 0 PID: 5340 Comm: modprobe Not tainted 5.1.0-rc7+ #25
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
RIP: 0010:__list_add_valid+0x10/0x70
Code: c3 48 8b 06 55 48 89 e5 5d 48 39 07 0f 94 c0 0f b6 c0 c3 90 90 90 90 90 90 90 55 48 89 d0 48 8b 52 08 48 89 e5 48 39 f2 75 19 <48> 8b 32 48 39 f0 75 3a

RSP: 0018:ffffc90000e23c68 EFLAGS: 00010246
RAX: ffffffffa00ad000 RBX: ffffffffa009d000 RCX: 0000000000000000
RDX: ffffffffa0097000 RSI: ffffffffa0097000 RDI: ffffffffa009d000
RBP: ffffc90000e23c68 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa0097000
R13: ffff888231797180 R14: 0000000000000000 R15: ffffc90000e23e78
FS:  00007fb215285540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0097000 CR3: 000000022f144000 CR4: 00000000000006f0
Call Trace:
 v9fs_register_trans+0x2f/0x60 [9pnet
 ? 0xffffffffa0087000
 p9_virtio_init+0x25/0x1000 [9pnet_virtio
 do_one_initcall+0x6c/0x3cc
 ? kmem_cache_alloc_trace+0x248/0x3b0
 do_init_module+0x5b/0x1f1
 load_module+0x1db1/0x2690
 ? m_show+0x1d0/0x1d0
 __do_sys_finit_module+0xc5/0xd0
 __x64_sys_finit_module+0x15/0x20
 do_syscall_64+0x6b/0x1d0
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fb214d8e839
Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01

RSP: 002b:00007ffc96554278 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055e67eed2aa0 RCX: 00007fb214d8e839
RDX: 0000000000000000 RSI: 000055e67ce95c2e RDI: 0000000000000003
RBP: 000055e67ce95c2e R08: 0000000000000000 R09: 000055e67eed2aa0
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 000055e67eeda500 R14: 0000000000040000 R15: 000055e67eed2aa0
Modules linked in: 9pnet_virtio(+) 9pnet gre rfkill vmw_vsock_virtio_transport_common vsock [last unloaded: 9pnet_virtio
CR2: ffffffffa0097000
---[ end trace 4a52bb13ff07b761

If register_virtio_driver() fails in p9_virtio_init,
we should call v9fs_unregister_trans() to do cleanup.

Link: http://lkml.kernel.org/r/20190430115942.41840-1-yuehaibing@huawei.com
Cc: stable@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: b530cc794024 ("9p: add virtio transport")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/9p/trans_virtio.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index eb596c2ed546c..849336211c79b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -782,10 +782,16 @@ static struct p9_trans_module p9_virtio_trans = {
 /* The standard init function */
 static int __init p9_virtio_init(void)
 {
+	int rc;
+
 	INIT_LIST_HEAD(&virtio_chan_list);
 
 	v9fs_register_trans(&p9_virtio_trans);
-	return register_virtio_driver(&p9_virtio_drv);
+	rc = register_virtio_driver(&p9_virtio_drv);
+	if (rc)
+		v9fs_unregister_trans(&p9_virtio_trans);
+
+	return rc;
 }
 
 static void __exit p9_virtio_cleanup(void)
-- 
GitLab


From 0d4c0bb706653ebc52cbf5adaa68d73f108488c2 Mon Sep 17 00:00:00 2001
From: David Rientjes <rientjes@google.com>
Date: Tue, 9 Jul 2019 19:44:03 -0700
Subject: [PATCH 1002/1835] x86/boot: Fix memory leak in
 default_get_smp_config()

commit e74bd96989dd42a51a73eddb4a5510a6f5e42ac3 upstream.

When default_get_smp_config() is called with early == 1 and mpf->feature1
is non-zero, mpf is leaked because the return path does not do
early_memunmap().

Fix this and share a common exit routine.

Fixes: 5997efb96756 ("x86/boot: Use memremap() to map the MPF and MPC data")
Reported-by: Cfir Cohen <cfir@google.com>
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1907091942570.28240@chino.kir.corp.google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/mpparse.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index ddb1ca6923b1b..5b4c327990947 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -547,17 +547,15 @@ void __init default_get_smp_config(unsigned int early)
 			 * local APIC has default address
 			 */
 			mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
-			return;
+			goto out;
 		}
 
 		pr_info("Default MP configuration #%d\n", mpf->feature1);
 		construct_default_ISA_mptable(mpf->feature1);
 
 	} else if (mpf->physptr) {
-		if (check_physptr(mpf, early)) {
-			early_memunmap(mpf, sizeof(*mpf));
-			return;
-		}
+		if (check_physptr(mpf, early))
+			goto out;
 	} else
 		BUG();
 
@@ -566,7 +564,7 @@ void __init default_get_smp_config(unsigned int early)
 	/*
 	 * Only use the first configuration found.
 	 */
-
+out:
 	early_memunmap(mpf, sizeof(*mpf));
 }
 
-- 
GitLab


From a847a52254321722c625ae8faffa59b940440c12 Mon Sep 17 00:00:00 2001
From: Kan Liang <kan.liang@linux.intel.com>
Date: Tue, 25 Jun 2019 07:21:35 -0700
Subject: [PATCH 1003/1835] perf/x86/intel: Fix spurious NMI on fixed counter

commit e4557c1a46b0d32746bd309e1941914b5a6912b4 upstream.

If a user first sample a PEBS event on a fixed counter, then sample a
non-PEBS event on the same fixed counter on Icelake, it will trigger
spurious NMI. For example:

  perf record -e 'cycles:p' -a
  perf record -e 'cycles' -a

The error message for spurious NMI:

  [June 21 15:38] Uhhuh. NMI received for unknown reason 30 on CPU 2.
  [    +0.000000] Do you have a strange power saving mode enabled?
  [    +0.000000] Dazed and confused, but trying to continue

The bug was introduced by the following commit:

  commit 6f55967ad9d9 ("perf/x86/intel: Fix race in intel_pmu_disable_event()")

The commit moves the intel_pmu_pebs_disable() after intel_pmu_disable_fixed(),
which returns immediately.  The related bit of PEBS_ENABLE MSR will never be
cleared for the fixed counter. Then a non-PEBS event runs on the fixed counter,
but the bit on PEBS_ENABLE is still set, which triggers spurious NMIs.

Check and disable PEBS for fixed counters after intel_pmu_disable_fixed().

Reported-by: Yi, Ammy <ammy.yi@intel.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: <stable@vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: 6f55967ad9d9 ("perf/x86/intel: Fix race in intel_pmu_disable_event()")
Link: https://lkml.kernel.org/r/20190625142135.22112-1-kan.liang@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/intel/core.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index c8b0bf2b0d5e4..db5a2ba617536 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2074,12 +2074,10 @@ static void intel_pmu_disable_event(struct perf_event *event)
 	cpuc->intel_ctrl_host_mask &= ~(1ull << hwc->idx);
 	cpuc->intel_cp_status &= ~(1ull << hwc->idx);
 
-	if (unlikely(hwc->config_base == MSR_ARCH_PERFMON_FIXED_CTR_CTRL)) {
+	if (unlikely(hwc->config_base == MSR_ARCH_PERFMON_FIXED_CTR_CTRL))
 		intel_pmu_disable_fixed(hwc);
-		return;
-	}
-
-	x86_pmu_disable_event(event);
+	else
+		x86_pmu_disable_event(event);
 
 	/*
 	 * Needs to be called after x86_pmu_disable_event,
-- 
GitLab


From 82c46f7b0918c7fd13ace45ed3648d5436cd3ad5 Mon Sep 17 00:00:00 2001
From: Kim Phillips <kim.phillips@amd.com>
Date: Fri, 28 Jun 2019 21:59:20 +0000
Subject: [PATCH 1004/1835] perf/x86/amd/uncore: Do not set 'ThreadMask' and
 'SliceMask' for non-L3 PMCs

commit 16f4641166b10e199f0d7b68c2c5f004fef0bda3 upstream.

The following commit:

  d7cbbe49a930 ("perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events")

enables L3 PMC events for all threads and slices by writing 1's in
'ChL3PmcCfg' (L3 PMC PERF_CTL) register fields.

Those bitfields overlap with high order event select bits in the Data
Fabric PMC control register, however.

So when a user requests raw Data Fabric events (-e amd_df/event=0xYYY/),
the two highest order bits get inadvertently set, changing the counter
select to events that don't exist, and for which no counts are read.

This patch changes the logic to write the L3 masks only when dealing
with L3 PMC counters.

AMD Family 16h and below Northbridge (NB) counters were not affected.

Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Gary Hook <Gary.Hook@amd.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Martin Liska <mliska@suse.cz>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Pu Wen <puwen@hygon.cn>
Cc: Stephane Eranian <eranian@google.com>
Cc: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: d7cbbe49a930 ("perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events")
Link: https://lkml.kernel.org/r/20190628215906.4276-1-kim.phillips@amd.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/amd/uncore.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index 8671de126eac0..19caa458f2260 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -214,7 +214,7 @@ static int amd_uncore_event_init(struct perf_event *event)
 	 * SliceMask and ThreadMask need to be set for certain L3 events in
 	 * Family 17h. For other events, the two fields do not affect the count.
 	 */
-	if (l3_mask)
+	if (l3_mask && is_llc_event(event))
 		hwc->config |= (AMD64_L3_SLICE_MASK | AMD64_L3_THREAD_MASK);
 
 	if (event->cpu < 0)
-- 
GitLab


From 9854e06842bc9e86a9e9508a527127fe713a711e Mon Sep 17 00:00:00 2001
From: Kim Phillips <kim.phillips@amd.com>
Date: Fri, 28 Jun 2019 21:59:33 +0000
Subject: [PATCH 1005/1835] perf/x86/amd/uncore: Set the thread mask for F17h
 L3 PMCs

commit 2f217d58a8a086d3399fecce39fb358848e799c4 upstream.

Fill in the L3 performance event select register ThreadMask
bitfield, to enable per hardware thread accounting.

Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Gary Hook <Gary.Hook@amd.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Martin Liska <mliska@suse.cz>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Pu Wen <puwen@hygon.cn>
Cc: Stephane Eranian <eranian@google.com>
Cc: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Link: https://lkml.kernel.org/r/20190628215906.4276-2-kim.phillips@amd.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/amd/uncore.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index 19caa458f2260..baa7e36073f90 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -210,15 +210,22 @@ static int amd_uncore_event_init(struct perf_event *event)
 	hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB;
 	hwc->idx = -1;
 
+	if (event->cpu < 0)
+		return -EINVAL;
+
 	/*
 	 * SliceMask and ThreadMask need to be set for certain L3 events in
 	 * Family 17h. For other events, the two fields do not affect the count.
 	 */
-	if (l3_mask && is_llc_event(event))
-		hwc->config |= (AMD64_L3_SLICE_MASK | AMD64_L3_THREAD_MASK);
+	if (l3_mask && is_llc_event(event)) {
+		int thread = 2 * (cpu_data(event->cpu).cpu_core_id % 4);
 
-	if (event->cpu < 0)
-		return -EINVAL;
+		if (smp_num_siblings > 1)
+			thread += cpu_data(event->cpu).apicid & 1;
+
+		hwc->config |= (1ULL << (AMD64_L3_THREAD_SHIFT + thread) &
+				AMD64_L3_THREAD_MASK) | AMD64_L3_SLICE_MASK;
+	}
 
 	uncore = event_to_amd_uncore(event);
 	if (!uncore)
-- 
GitLab


From 66a13b5e4e9cc7bb2c6a5d12a650df4309b77c46 Mon Sep 17 00:00:00 2001
From: Andres Rodriguez <andresx7@gmail.com>
Date: Wed, 19 Jun 2019 14:09:01 -0400
Subject: [PATCH 1006/1835] drm/edid: parse CEA blocks embedded in DisplayID

commit e28ad544f462231d3fd081a7316339359efbb481 upstream.

DisplayID blocks allow embedding of CEA blocks. The payloads are
identical to traditional top level CEA extension blocks, but the header
is slightly different.

This change allows the CEA parser to find a CEA block inside a DisplayID
block. Additionally, it adds support for parsing the embedded CTA
header. No further changes are necessary due to payload parity.

This change fixes audio support for the Valve Index HMD.

Signed-off-by: Andres Rodriguez <andresx7@gmail.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.15
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190619180901.17901-1-andresx7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_edid.c  | 81 ++++++++++++++++++++++++++++++++-----
 include/drm/drm_displayid.h | 10 +++++
 2 files changed, 80 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5965f6383ada3..e5e7e65934da9 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1349,6 +1349,7 @@ MODULE_PARM_DESC(edid_fixup,
 
 static void drm_get_displayid(struct drm_connector *connector,
 			      struct edid *edid);
+static int validate_displayid(u8 *displayid, int length, int idx);
 
 static int drm_edid_block_checksum(const u8 *raw_edid)
 {
@@ -2932,16 +2933,46 @@ static u8 *drm_find_edid_extension(const struct edid *edid, int ext_id)
 	return edid_ext;
 }
 
-static u8 *drm_find_cea_extension(const struct edid *edid)
-{
-	return drm_find_edid_extension(edid, CEA_EXT);
-}
 
 static u8 *drm_find_displayid_extension(const struct edid *edid)
 {
 	return drm_find_edid_extension(edid, DISPLAYID_EXT);
 }
 
+static u8 *drm_find_cea_extension(const struct edid *edid)
+{
+	int ret;
+	int idx = 1;
+	int length = EDID_LENGTH;
+	struct displayid_block *block;
+	u8 *cea;
+	u8 *displayid;
+
+	/* Look for a top level CEA extension block */
+	cea = drm_find_edid_extension(edid, CEA_EXT);
+	if (cea)
+		return cea;
+
+	/* CEA blocks can also be found embedded in a DisplayID block */
+	displayid = drm_find_displayid_extension(edid);
+	if (!displayid)
+		return NULL;
+
+	ret = validate_displayid(displayid, length, idx);
+	if (ret)
+		return NULL;
+
+	idx += sizeof(struct displayid_hdr);
+	for_each_displayid_db(displayid, block, idx, length) {
+		if (block->tag == DATA_BLOCK_CTA) {
+			cea = (u8 *)block;
+			break;
+		}
+	}
+
+	return cea;
+}
+
 /*
  * Calculate the alternate clock for the CEA mode
  * (60Hz vs. 59.94Hz etc.)
@@ -3665,13 +3696,38 @@ cea_revision(const u8 *cea)
 static int
 cea_db_offsets(const u8 *cea, int *start, int *end)
 {
-	/* Data block offset in CEA extension block */
-	*start = 4;
-	*end = cea[2];
-	if (*end == 0)
-		*end = 127;
-	if (*end < 4 || *end > 127)
-		return -ERANGE;
+	/* DisplayID CTA extension blocks and top-level CEA EDID
+	 * block header definitions differ in the following bytes:
+	 *   1) Byte 2 of the header specifies length differently,
+	 *   2) Byte 3 is only present in the CEA top level block.
+	 *
+	 * The different definitions for byte 2 follow.
+	 *
+	 * DisplayID CTA extension block defines byte 2 as:
+	 *   Number of payload bytes
+	 *
+	 * CEA EDID block defines byte 2 as:
+	 *   Byte number (decimal) within this block where the 18-byte
+	 *   DTDs begin. If no non-DTD data is present in this extension
+	 *   block, the value should be set to 04h (the byte after next).
+	 *   If set to 00h, there are no DTDs present in this block and
+	 *   no non-DTD data.
+	 */
+	if (cea[0] == DATA_BLOCK_CTA) {
+		*start = 3;
+		*end = *start + cea[2];
+	} else if (cea[0] == CEA_EXT) {
+		/* Data block offset in CEA extension block */
+		*start = 4;
+		*end = cea[2];
+		if (*end == 0)
+			*end = 127;
+		if (*end < 4 || *end > 127)
+			return -ERANGE;
+	} else {
+		return -ENOTSUPP;
+	}
+
 	return 0;
 }
 
@@ -5218,6 +5274,9 @@ static int drm_parse_display_id(struct drm_connector *connector,
 		case DATA_BLOCK_TYPE_1_DETAILED_TIMING:
 			/* handled in mode gathering code. */
 			break;
+		case DATA_BLOCK_CTA:
+			/* handled in the cea parser code. */
+			break;
 		default:
 			DRM_DEBUG_KMS("found DisplayID tag 0x%x, unhandled\n", block->tag);
 			break;
diff --git a/include/drm/drm_displayid.h b/include/drm/drm_displayid.h
index c0d4df6a606fc..9d3b745c31077 100644
--- a/include/drm/drm_displayid.h
+++ b/include/drm/drm_displayid.h
@@ -40,6 +40,7 @@
 #define DATA_BLOCK_DISPLAY_INTERFACE 0x0f
 #define DATA_BLOCK_STEREO_DISPLAY_INTERFACE 0x10
 #define DATA_BLOCK_TILED_DISPLAY 0x12
+#define DATA_BLOCK_CTA 0x81
 
 #define DATA_BLOCK_VENDOR_SPECIFIC 0x7f
 
@@ -90,4 +91,13 @@ struct displayid_detailed_timing_block {
 	struct displayid_block base;
 	struct displayid_detailed_timings_1 timings[0];
 };
+
+#define for_each_displayid_db(displayid, block, idx, length) \
+	for ((block) = (struct displayid_block *)&(displayid)[idx]; \
+	     (idx) + sizeof(struct displayid_block) <= (length) && \
+	     (idx) + sizeof(struct displayid_block) + (block)->num_bytes <= (length) && \
+	     (block)->num_bytes > 0; \
+	     (idx) += (block)->num_bytes + sizeof(struct displayid_block), \
+	     (block) = (struct displayid_block *)&(displayid)[idx])
+
 #endif
-- 
GitLab


From f0ff76a42ef596beb885160c022c57afae7a2896 Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date: Fri, 21 Jun 2019 19:19:30 +0300
Subject: [PATCH 1007/1835] intel_th: pci: Add Ice Lake NNPI support

commit 4aa5aed2b6f267592705a526f57518a5d715b769 upstream.

This adds Ice Lake NNPI support to the Intel(R) Trace Hub.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190621161930.60785-5-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/intel_th/pci.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 70f2cb90adc5e..e759ac0d48bee 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -170,6 +170,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
 	},
+	{
+		/* Ice Lake NNPI */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
 	{ 0 },
 };
 
-- 
GitLab


From 4d8504004c864dfb98b6fa691c47da1d9714d4bd Mon Sep 17 00:00:00 2001
From: Dexuan Cui <decui@microsoft.com>
Date: Fri, 21 Jun 2019 23:45:23 +0000
Subject: [PATCH 1008/1835] PCI: hv: Fix a use-after-free bug in
 hv_eject_device_work()

commit 4df591b20b80cb77920953812d894db259d85bd7 upstream.

Fix a use-after-free in hv_eject_device_work().

Fixes: 05f151a73ec2 ("PCI: hv: Fix a memory leak in hv_eject_device_work()")
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-hyperv.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index 808a182830e5c..5dadc964ad3b4 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -1880,6 +1880,7 @@ static void hv_pci_devices_present(struct hv_pcibus_device *hbus,
 static void hv_eject_device_work(struct work_struct *work)
 {
 	struct pci_eject_response *ejct_pkt;
+	struct hv_pcibus_device *hbus;
 	struct hv_pci_dev *hpdev;
 	struct pci_dev *pdev;
 	unsigned long flags;
@@ -1890,6 +1891,7 @@ static void hv_eject_device_work(struct work_struct *work)
 	} ctxt;
 
 	hpdev = container_of(work, struct hv_pci_dev, wrk);
+	hbus = hpdev->hbus;
 
 	WARN_ON(hpdev->state != hv_pcichild_ejecting);
 
@@ -1900,8 +1902,7 @@ static void hv_eject_device_work(struct work_struct *work)
 	 * because hbus->pci_bus may not exist yet.
 	 */
 	wslot = wslot_to_devfn(hpdev->desc.win_slot.slot);
-	pdev = pci_get_domain_bus_and_slot(hpdev->hbus->sysdata.domain, 0,
-					   wslot);
+	pdev = pci_get_domain_bus_and_slot(hbus->sysdata.domain, 0, wslot);
 	if (pdev) {
 		pci_lock_rescan_remove();
 		pci_stop_and_remove_bus_device(pdev);
@@ -1909,9 +1910,9 @@ static void hv_eject_device_work(struct work_struct *work)
 		pci_unlock_rescan_remove();
 	}
 
-	spin_lock_irqsave(&hpdev->hbus->device_list_lock, flags);
+	spin_lock_irqsave(&hbus->device_list_lock, flags);
 	list_del(&hpdev->list_entry);
-	spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
+	spin_unlock_irqrestore(&hbus->device_list_lock, flags);
 
 	if (hpdev->pci_slot)
 		pci_destroy_slot(hpdev->pci_slot);
@@ -1920,7 +1921,7 @@ static void hv_eject_device_work(struct work_struct *work)
 	ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
 	ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
 	ejct_pkt->wslot.slot = hpdev->desc.win_slot.slot;
-	vmbus_sendpacket(hpdev->hbus->hdev->channel, ejct_pkt,
+	vmbus_sendpacket(hbus->hdev->channel, ejct_pkt,
 			 sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
 			 VM_PKT_DATA_INBAND, 0);
 
@@ -1929,7 +1930,9 @@ static void hv_eject_device_work(struct work_struct *work)
 	/* For the two refs got in new_pcichild_device() */
 	put_pcichild(hpdev);
 	put_pcichild(hpdev);
-	put_hvpcibus(hpdev->hbus);
+	/* hpdev has been freed. Do not use it any more. */
+
+	put_hvpcibus(hbus);
 }
 
 /**
-- 
GitLab


From 529e71cae929209bdc4f7ba835a52d64c4e878e2 Mon Sep 17 00:00:00 2001
From: Mika Westerberg <mika.westerberg@linux.intel.com>
Date: Wed, 12 Jun 2019 13:57:39 +0300
Subject: [PATCH 1009/1835] PCI: Do not poll for PME if the device is in D3cold

commit 000dd5316e1c756a1c028f22e01d06a38249dd4d upstream.

PME polling does not take into account that a device that is directly
connected to the host bridge may go into D3cold as well. This leads to a
situation where the PME poll thread reads from a config space of a
device that is in D3cold and gets incorrect information because the
config space is not accessible.

Here is an example from Intel Ice Lake system where two PCIe root ports
are in D3cold (I've instrumented the kernel to log the PMCSR register
contents):

  [   62.971442] pcieport 0000:00:07.1: Check PME status, PMCSR=0xffff
  [   62.971504] pcieport 0000:00:07.0: Check PME status, PMCSR=0xffff

Since 0xffff is interpreted so that PME is pending, the root ports will
be runtime resumed. This repeats over and over again essentially
blocking all runtime power management.

Prevent this from happening by checking whether the device is in D3cold
before its PME status is read.

Fixes: 71a83bd727cc ("PCI/PM: add runtime PM support to PCIe port")
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: 3.6+ <stable@vger.kernel.org> # v3.6+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pci.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 61f2ef28ea1c7..c65465385d8c8 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2004,6 +2004,13 @@ static void pci_pme_list_scan(struct work_struct *work)
 			 */
 			if (bridge && bridge->current_state != PCI_D0)
 				continue;
+			/*
+			 * If the device is in D3cold it should not be
+			 * polled either.
+			 */
+			if (pme_dev->dev->current_state == PCI_D3cold)
+				continue;
+
 			pci_pme_wakeup(pme_dev->dev, NULL);
 		} else {
 			list_del(&pme_dev->list);
-- 
GitLab


From 6b71c62ea9dac0e7e0b3a79575b4a2c7033b7cab Mon Sep 17 00:00:00 2001
From: Niklas Cassel <niklas.cassel@linaro.org>
Date: Wed, 29 May 2019 11:43:52 +0200
Subject: [PATCH 1010/1835] PCI: qcom: Ensure that PERST is asserted for at
 least 100 ms

commit 64adde31c8e996a6db6f7a1a4131180e363aa9f2 upstream.

Currently, there is only a 1 ms sleep after asserting PERST.

Reading the datasheets for different endpoints, some require PERST to be
asserted for 10 ms in order for the endpoint to perform a reset, others
require it to be asserted for 50 ms.

Several SoCs using this driver uses PCIe Mini Card, where we don't know
what endpoint will be plugged in.

The PCI Express Card Electromechanical Specification r2.0, section
2.2, "PERST# Signal" specifies:

"On power up, the deassertion of PERST# is delayed 100 ms (TPVPERL) from
the power rails achieving specified operating limits."

Add a sleep of 100 ms before deasserting PERST, in order to ensure that
we are compliant with the spec.

Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver")
Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Stanimir Varbanov <svarbanov@mm-sol.com>
Cc: stable@vger.kernel.org # 4.5+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pcie-qcom.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 4352c1cb926d5..87a8887fd4d3e 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -178,6 +178,8 @@ static void qcom_ep_reset_assert(struct qcom_pcie *pcie)
 
 static void qcom_ep_reset_deassert(struct qcom_pcie *pcie)
 {
+	/* Ensure that PERST has been asserted for at least 100 ms */
+	msleep(100);
 	gpiod_set_value_cansleep(pcie->reset, 0);
 	usleep_range(PERST_DELAY_US, PERST_DELAY_US + 500);
 }
-- 
GitLab


From 110850fffeb075a63418fe6b1ec0aed53a9ab8b3 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 7 Jun 2019 11:25:24 +0100
Subject: [PATCH 1011/1835] Btrfs: fix data loss after inode eviction, renaming
 it, and fsync it

commit d1d832a0b51dd9570429bb4b81b2a6c1759e681a upstream.

When we log an inode, regardless of logging it completely or only that it
exists, we always update it as logged (logged_trans and last_log_commit
fields of the inode are updated). This is generally fine and avoids future
attempts to log it from having to do repeated work that brings no value.

However, if we write data to a file, then evict its inode after all the
dealloc was flushed (and ordered extents completed), rename the file and
fsync it, we end up not logging the new extents, since the rename may
result in logging that the inode exists in case the parent directory was
logged before. The following reproducer shows and explains how this can
happen:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt

  $ mkdir /mnt/dir
  $ touch /mnt/dir/foo
  $ touch /mnt/dir/bar

  # Do a direct IO write instead of a buffered write because with a
  # buffered write we would need to make sure dealloc gets flushed and
  # complete before we do the inode eviction later, and we can not do that
  # from user space with call to things such as sync(2) since that results
  # in a transaction commit as well.
  $ xfs_io -d -c "pwrite -S 0xd3 0 4K" /mnt/dir/bar

  # Keep the directory dir in use while we evict inodes. We want our file
  # bar's inode to be evicted but we don't want our directory's inode to
  # be evicted (if it were evicted too, we would not be able to reproduce
  # the issue since the first fsync below, of file foo, would result in a
  # transaction commit.
  $ ( cd /mnt/dir; while true; do :; done ) &
  $ pid=$!

  # Wait a bit to give time for the background process to chdir.
  $ sleep 0.1

  # Evict all inodes, except the inode for the directory dir because it is
  # currently in use by our background process.
  $ echo 2 > /proc/sys/vm/drop_caches

  # fsync file foo, which ends up persisting information about the parent
  # directory because it is a new inode.
  $ xfs_io -c fsync /mnt/dir/foo

  # Rename bar, this results in logging that this inode exists (inode item,
  # names, xattrs) because the parent directory is in the log.
  $ mv /mnt/dir/bar /mnt/dir/baz

  # Now fsync baz, which ends up doing absolutely nothing because of the
  # rename operation which logged that the inode exists only.
  $ xfs_io -c fsync /mnt/dir/baz

  <power failure>

  $ mount /dev/sdb /mnt
  $ od -t x1 -A d /mnt/dir/baz
  0000000

    --> Empty file, data we wrote is missing.

Fix this by not updating last_sub_trans of an inode when we are logging
only that it exists and the inode was not yet logged since it was loaded
from disk (full_sync bit set), this is enough to make btrfs_inode_in_log()
return false for this scenario and make us log the inode. The logged_trans
of the inode is still always setsince that alone is used to track if names
need to be deleted as part of unlink operations.

Fixes: 257c62e1bce03e ("Btrfs: avoid tree log commit when there are no changes")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 0d5840d20efcb..c514f7c3267c9 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -5250,9 +5250,19 @@ log_extents:
 		}
 	}
 
+	/*
+	 * Don't update last_log_commit if we logged that an inode exists after
+	 * it was loaded to memory (full_sync bit set).
+	 * This is to prevent data loss when we do a write to the inode, then
+	 * the inode gets evicted after all delalloc was flushed, then we log
+	 * it exists (due to a rename for example) and then fsync it. This last
+	 * fsync would do nothing (not logging the extents previously written).
+	 */
 	spin_lock(&inode->lock);
 	inode->logged_trans = trans->transid;
-	inode->last_log_commit = inode->last_sub_trans;
+	if (inode_only != LOG_INODE_EXISTS ||
+	    !test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags))
+		inode->last_log_commit = inode->last_sub_trans;
 	spin_unlock(&inode->lock);
 out_unlock:
 	mutex_unlock(&inode->log_mutex);
-- 
GitLab


From fffedf5cf67e7ab4733534a870304069075785d8 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 19 Jun 2019 13:05:39 +0100
Subject: [PATCH 1012/1835] Btrfs: fix fsync not persisting dentry deletions
 due to inode evictions

commit 803f0f64d17769071d7287d9e3e3b79a3e1ae937 upstream.

In order to avoid searches on a log tree when unlinking an inode, we check
if the inode being unlinked was logged in the current transaction, as well
as the inode of its parent directory. When any of the inodes are logged,
we proceed to delete directory items and inode reference items from the
log, to ensure that if a subsequent fsync of only the inode being unlinked
or only of the parent directory when the other is not fsync'ed as well,
does not result in the entry still existing after a power failure.

That check however is not reliable when one of the inodes involved (the
one being unlinked or its parent directory's inode) is evicted, since the
logged_trans field is transient, that is, it is not stored on disk, so it
is lost when the inode is evicted and loaded into memory again (which is
set to zero on load). As a consequence the checks currently being done by
btrfs_del_dir_entries_in_log() and btrfs_del_inode_ref_in_log() always
return true if the inode was evicted before, regardless of the inode
having been logged or not before (and in the current transaction), this
results in the dentry being unlinked still existing after a log replay
if after the unlink operation only one of the inodes involved is fsync'ed.

Example:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt

  $ mkdir /mnt/dir
  $ touch /mnt/dir/foo
  $ xfs_io -c fsync /mnt/dir/foo

  # Keep an open file descriptor on our directory while we evict inodes.
  # We just want to evict the file's inode, the directory's inode must not
  # be evicted.
  $ ( cd /mnt/dir; while true; do :; done ) &
  $ pid=$!

  # Wait a bit to give time to background process to chdir to our test
  # directory.
  $ sleep 0.5

  # Trigger eviction of the file's inode.
  $ echo 2 > /proc/sys/vm/drop_caches

  # Unlink our file and fsync the parent directory. After a power failure
  # we don't expect to see the file anymore, since we fsync'ed the parent
  # directory.
  $ rm -f $SCRATCH_MNT/dir/foo
  $ xfs_io -c fsync /mnt/dir

  <power failure>

  $ mount /dev/sdb /mnt
  $ ls /mnt/dir
  foo
  $
   --> file still there, unlink not persisted despite explicit fsync on dir

Fix this by checking if the inode has the full_sync bit set in its runtime
flags as well, since that bit is set everytime an inode is loaded from
disk, or for other less common cases such as after a shrinking truncate
or failure to allocate extent maps for holes, and gets cleared after the
first fsync. Also consider the inode as possibly logged only if it was
last modified in the current transaction (besides having the full_fsync
flag set).

Fixes: 3a5f1d458ad161 ("Btrfs: Optimize btree walking while logging inodes")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c514f7c3267c9..08c5afa06aee0 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3262,6 +3262,30 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
 	return 0;
 }
 
+/*
+ * Check if an inode was logged in the current transaction. We can't always rely
+ * on an inode's logged_trans value, because it's an in-memory only field and
+ * therefore not persisted. This means that its value is lost if the inode gets
+ * evicted and loaded again from disk (in which case it has a value of 0, and
+ * certainly it is smaller then any possible transaction ID), when that happens
+ * the full_sync flag is set in the inode's runtime flags, so on that case we
+ * assume eviction happened and ignore the logged_trans value, assuming the
+ * worst case, that the inode was logged before in the current transaction.
+ */
+static bool inode_logged(struct btrfs_trans_handle *trans,
+			 struct btrfs_inode *inode)
+{
+	if (inode->logged_trans == trans->transid)
+		return true;
+
+	if (inode->last_trans == trans->transid &&
+	    test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags) &&
+	    !test_bit(BTRFS_FS_LOG_RECOVERING, &trans->fs_info->flags))
+		return true;
+
+	return false;
+}
+
 /*
  * If both a file and directory are logged, and unlinks or renames are
  * mixed in, we have a few interesting corners:
@@ -3296,7 +3320,7 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 	int bytes_del = 0;
 	u64 dir_ino = btrfs_ino(dir);
 
-	if (dir->logged_trans < trans->transid)
+	if (!inode_logged(trans, dir))
 		return 0;
 
 	ret = join_running_log_trans(root);
@@ -3401,7 +3425,7 @@ int btrfs_del_inode_ref_in_log(struct btrfs_trans_handle *trans,
 	u64 index;
 	int ret;
 
-	if (inode->logged_trans < trans->transid)
+	if (!inode_logged(trans, inode))
 		return 0;
 
 	ret = join_running_log_trans(root);
-- 
GitLab


From 4bd953241d81fc9bb00210859346a0a3db2e3ef6 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 19 Jun 2019 13:05:50 +0100
Subject: [PATCH 1013/1835] Btrfs: add missing inode version, ctime and mtime
 updates when punching hole

commit 179006688a7e888cbff39577189f2e034786d06a upstream.

If the range for which we are punching a hole covers only part of a page,
we end up updating the inode item but we skip the update of the inode's
iversion, mtime and ctime. Fix that by ensuring we update those properties
of the inode.

A patch for fstests test case generic/059 that tests this as been sent
along with this fix.

Fixes: 2aaa66558172b0 ("Btrfs: add hole punching")
Fixes: e8c1c76e804b18 ("Btrfs: add missing inode update when punching hole")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/file.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e24c0a69ff5d4..c84186563c311 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2732,6 +2732,11 @@ out_only_mutex:
 		 * for detecting, at fsync time, if the inode isn't yet in the
 		 * log tree or it's there but not up to date.
 		 */
+		struct timespec64 now = current_time(inode);
+
+		inode_inc_iversion(inode);
+		inode->i_mtime = now;
+		inode->i_ctime = now;
 		trans = btrfs_start_transaction(root, 1);
 		if (IS_ERR(trans)) {
 			err = PTR_ERR(trans);
-- 
GitLab


From cb4c2b94f629b8c4fbb1edfc23040ef0f651f730 Mon Sep 17 00:00:00 2001
From: Danit Goldberg <danitg@mellanox.com>
Date: Fri, 5 Jul 2019 19:21:57 +0300
Subject: [PATCH 1014/1835] IB/mlx5: Report correctly tag matching rendezvous
 capability

commit 89705e92700170888236555fe91b45e4c1bb0985 upstream.

Userspace expects the IB_TM_CAP_RC bit to indicate that the device
supports RC transport tag matching with rendezvous offload. However the
firmware splits this into two capabilities for eager and rendezvous tag
matching.

Only if the FW supports both modes should userspace be told the tag
matching capability is available.

Cc: <stable@vger.kernel.org> # 4.13
Fixes: eb761894351d ("IB/mlx5: Fill XRQ capabilities")
Signed-off-by: Danit Goldberg <danitg@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/main.c | 8 ++++++--
 include/rdma/ib_verbs.h           | 4 ++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 8cc4da62f050e..53eccc0da8fd1 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -939,15 +939,19 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
 	}
 
 	if (MLX5_CAP_GEN(mdev, tag_matching)) {
-		props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
 		props->tm_caps.max_num_tags =
 			(1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
-		props->tm_caps.flags = IB_TM_CAP_RC;
 		props->tm_caps.max_ops =
 			1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
 		props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
 	}
 
+	if (MLX5_CAP_GEN(mdev, tag_matching) &&
+	    MLX5_CAP_GEN(mdev, rndv_offload_rc)) {
+		props->tm_caps.flags = IB_TM_CAP_RNDV_RC;
+		props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+	}
+
 	if (MLX5_CAP_GEN(dev->mdev, cq_moderation)) {
 		props->cq_caps.max_cq_moderation_count =
 						MLX5_MAX_CQ_COUNT;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index ec299fcf55f7a..412c2820626da 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -290,8 +290,8 @@ struct ib_rss_caps {
 };
 
 enum ib_tm_cap_flags {
-	/*  Support tag matching on RC transport */
-	IB_TM_CAP_RC		    = 1 << 0,
+	/*  Support tag matching with rendezvous offload for RC transport */
+	IB_TM_CAP_RNDV_RC = 1 << 0,
 };
 
 struct ib_tm_caps {
-- 
GitLab


From 46f71a15abe7d555213349079ded2ba6abb965d5 Mon Sep 17 00:00:00 2001
From: Aaron Armstrong Skomra <skomra@gmail.com>
Date: Fri, 10 May 2019 15:31:16 -0700
Subject: [PATCH 1015/1835] HID: wacom: generic: only switch the mode on
 devices with LEDs

commit d8e9806005f28bbb49899dab2068e3359e22ba35 upstream.

Currently, the driver will attempt to set the mode on all
devices with a center button, but some devices with a center
button lack LEDs, and attempting to set the LEDs on devices
without LEDs results in the kernel error message of the form:

"leds input8::wacom-0.1: Setting an LED's brightness failed (-32)"

This is because the generic codepath erroneously assumes that the
BUTTON_CENTER usage indicates that the device has LEDs, the
previously ignored TOUCH_RING_SETTING usage is a more accurate
indication of the existence of LEDs on the device.

Fixes: 10c55cacb8b2 ("HID: wacom: generic: support LEDs")
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_sys.c | 3 +++
 drivers/hid/wacom_wac.c | 2 --
 drivers/hid/wacom_wac.h | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 0bdd85d486fee..9cd4705b74bda 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -275,6 +275,9 @@ static void wacom_feature_mapping(struct hid_device *hdev,
 	wacom_hid_usage_quirk(hdev, field, usage);
 
 	switch (equivalent_usage) {
+	case WACOM_HID_WD_TOUCH_RING_SETTING:
+		wacom->generic_has_leds = true;
+		break;
 	case HID_DG_CONTACTMAX:
 		/* leave touch_max as is if predefined */
 		if (!features->touch_max) {
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index d7c3f4ac2c045..8a75123ed0095 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1928,8 +1928,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
 		features->device_type |= WACOM_DEVICETYPE_PAD;
 		break;
 	case WACOM_HID_WD_BUTTONCENTER:
-		wacom->generic_has_leds = true;
-		/* fall through */
 	case WACOM_HID_WD_BUTTONHOME:
 	case WACOM_HID_WD_BUTTONUP:
 	case WACOM_HID_WD_BUTTONDOWN:
diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
index 295fd3718caa0..f67d871841c0c 100644
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -145,6 +145,7 @@
 #define WACOM_HID_WD_OFFSETBOTTOM       (WACOM_HID_UP_WACOMDIGITIZER | 0x0d33)
 #define WACOM_HID_WD_DATAMODE           (WACOM_HID_UP_WACOMDIGITIZER | 0x1002)
 #define WACOM_HID_WD_DIGITIZERINFO      (WACOM_HID_UP_WACOMDIGITIZER | 0x1013)
+#define WACOM_HID_WD_TOUCH_RING_SETTING (WACOM_HID_UP_WACOMDIGITIZER | 0x1032)
 #define WACOM_HID_UP_G9                 0xff090000
 #define WACOM_HID_G9_PEN                (WACOM_HID_UP_G9 | 0x02)
 #define WACOM_HID_G9_TOUCHSCREEN        (WACOM_HID_UP_G9 | 0x11)
-- 
GitLab


From 1c871b4006b2ef586abd4193acbc9dbe621f3334 Mon Sep 17 00:00:00 2001
From: Aaron Armstrong Skomra <skomra@gmail.com>
Date: Fri, 10 May 2019 15:34:17 -0700
Subject: [PATCH 1016/1835] HID: wacom: generic: Correct pad syncing

commit d4b8efeb46d99a5d02e7f88ac4eaccbe49370770 upstream.

Only sync the pad once per report, not once per collection.
Also avoid syncing the pad on battery reports.

Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
Cc: <stable@vger.kernel.org> # v4.17+
Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 8a75123ed0095..9bb165a15658b 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2119,14 +2119,12 @@ static void wacom_wac_pad_report(struct hid_device *hdev,
 	bool active = wacom_wac->hid_data.inrange_state != 0;
 
 	/* report prox for expresskey events */
-	if ((wacom_equivalent_usage(field->physical) == HID_DG_TABLETFUNCTIONKEY) &&
-	    wacom_wac->hid_data.pad_input_event_flag) {
+	if (wacom_wac->hid_data.pad_input_event_flag) {
 		input_event(input, EV_ABS, ABS_MISC, active ? PAD_DEVICE_ID : 0);
 		input_sync(input);
 		if (!active)
 			wacom_wac->hid_data.pad_input_event_flag = false;
 	}
-
 }
 
 static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
@@ -2723,9 +2721,7 @@ static int wacom_wac_collection(struct hid_device *hdev, struct hid_report *repo
 	if (report->type != HID_INPUT_REPORT)
 		return -1;
 
-	if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input)
-		wacom_wac_pad_report(hdev, report, field);
-	else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
+	if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
 		wacom_wac_pen_report(hdev, report);
 	else if (WACOM_FINGER_FIELD(field) && wacom->wacom_wac.touch_input)
 		wacom_wac_finger_report(hdev, report);
@@ -2739,7 +2735,7 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
 	struct wacom_wac *wacom_wac = &wacom->wacom_wac;
 	struct hid_field *field;
 	bool pad_in_hid_field = false, pen_in_hid_field = false,
-		finger_in_hid_field = false;
+		finger_in_hid_field = false, true_pad = false;
 	int r;
 	int prev_collection = -1;
 
@@ -2755,6 +2751,8 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
 			pen_in_hid_field = true;
 		if (WACOM_FINGER_FIELD(field))
 			finger_in_hid_field = true;
+		if (wacom_equivalent_usage(field->physical) == HID_DG_TABLETFUNCTIONKEY)
+			true_pad = true;
 	}
 
 	wacom_wac_battery_pre_report(hdev, report);
@@ -2778,6 +2776,9 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
 	}
 
 	wacom_wac_battery_report(hdev, report);
+
+	if (true_pad && wacom->wacom_wac.pad_input)
+		wacom_wac_pad_report(hdev, report, field);
 }
 
 static int wacom_bpt_touch(struct wacom_wac *wacom)
-- 
GitLab


From 656d06dab4d618c21cd006930b19eee8aa6a24f7 Mon Sep 17 00:00:00 2001
From: Aaron Armstrong Skomra <skomra@gmail.com>
Date: Fri, 10 May 2019 15:34:18 -0700
Subject: [PATCH 1017/1835] HID: wacom: correct touch resolution x/y typo

commit 68c20cc2164cc5c7c73f8012ae6491afdb1f7f72 upstream.

This affects the 2nd-gen Intuos Pro Medium and Large
when using their Bluetooth connection.

Fixes: 4922cd26f03c ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface")
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 9bb165a15658b..0ae8483694742 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3734,7 +3734,7 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
 					     0, 5920, 4, 0);
 		}
 		input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
-		input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
+		input_abs_set_res(input_dev, ABS_MT_POSITION_Y, 40);
 
 		/* fall through */
 
-- 
GitLab


From 2c0222b48e77230899680e1e3c56055639766ee2 Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Thu, 18 Jul 2019 15:58:36 -0700
Subject: [PATCH 1018/1835] libnvdimm/pfn: fix fsdax-mode namespace info-block
 zero-fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7e3e888dfc138089f4c15a81b418e88f0978f744 upstream.

At namespace creation time there is the potential for the "expected to
be zero" fields of a 'pfn' info-block to be filled with indeterminate
data.  While the kernel buffer is zeroed on allocation it is immediately
overwritten by nd_pfn_validate() filling it with the current contents of
the on-media info-block location.  For fields like, 'flags' and the
'padding' it potentially means that future implementations can not rely on
those fields being zero.

In preparation to stop using the 'start_pad' and 'end_trunc' fields for
section alignment, arrange for fields that are not explicitly
initialized to be guaranteed zero.  Bump the minor version to indicate
it is safe to assume the 'padding' and 'flags' are zero.  Otherwise,
this corruption is expected to benign since all other critical fields
are explicitly initialized.

Note The cc: stable is about spreading this new policy to as many
kernels as possible not fixing an issue in those kernels.  It is not
until the change titled "libnvdimm/pfn: Stop padding pmem namespaces to
section alignment" where this improper initialization becomes a problem.
So if someone decides to backport "libnvdimm/pfn: Stop padding pmem
namespaces to section alignment" (which is not tagged for stable), make
sure this pre-requisite is flagged.

Link: http://lkml.kernel.org/r/156092356065.979959.6681003754765958296.stgit@dwillia2-desk3.amr.corp.intel.com
Fixes: 32ab0a3f5170 ("libnvdimm, pmem: 'struct page' for pmem")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Tested-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>	[ppc64]
Cc: <stable@vger.kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jane Chu <jane.chu@oracle.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Logan Gunthorpe <logang@deltatee.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvdimm/dax_devs.c |  2 +-
 drivers/nvdimm/pfn.h      |  1 +
 drivers/nvdimm/pfn_devs.c | 18 +++++++++++++++---
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
index 0453f49dc7081..326f02ffca81f 100644
--- a/drivers/nvdimm/dax_devs.c
+++ b/drivers/nvdimm/dax_devs.c
@@ -126,7 +126,7 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
 	nvdimm_bus_unlock(&ndns->dev);
 	if (!dax_dev)
 		return -ENOMEM;
-	pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
 	nd_pfn->pfn_sb = pfn_sb;
 	rc = nd_pfn_validate(nd_pfn, DAX_SIG);
 	dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
diff --git a/drivers/nvdimm/pfn.h b/drivers/nvdimm/pfn.h
index dde9853453d3c..e901e3a3b04c9 100644
--- a/drivers/nvdimm/pfn.h
+++ b/drivers/nvdimm/pfn.h
@@ -36,6 +36,7 @@ struct nd_pfn_sb {
 	__le32 end_trunc;
 	/* minor-version-2 record the base alignment of the mapping */
 	__le32 align;
+	/* minor-version-3 guarantee the padding and flags are zero */
 	u8 padding[4000];
 	__le64 checksum;
 };
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 3ee995a3bfc9b..86ed09b2a1929 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -361,6 +361,15 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
 	return dev;
 }
 
+/**
+ * nd_pfn_validate - read and validate info-block
+ * @nd_pfn: fsdax namespace runtime state / properties
+ * @sig: 'devdax' or 'fsdax' signature
+ *
+ * Upon return the info-block buffer contents (->pfn_sb) are
+ * indeterminate when validation fails, and a coherent info-block
+ * otherwise.
+ */
 int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 {
 	u64 checksum, offset;
@@ -506,7 +515,7 @@ int nd_pfn_probe(struct device *dev, struct nd_namespace_common *ndns)
 	nvdimm_bus_unlock(&ndns->dev);
 	if (!pfn_dev)
 		return -ENOMEM;
-	pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+	pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
 	nd_pfn = to_nd_pfn(pfn_dev);
 	nd_pfn->pfn_sb = pfn_sb;
 	rc = nd_pfn_validate(nd_pfn, PFN_SIG);
@@ -638,7 +647,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
 	u64 checksum;
 	int rc;
 
-	pfn_sb = devm_kzalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
+	pfn_sb = devm_kmalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
 	if (!pfn_sb)
 		return -ENOMEM;
 
@@ -647,11 +656,14 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
 		sig = DAX_SIG;
 	else
 		sig = PFN_SIG;
+
 	rc = nd_pfn_validate(nd_pfn, sig);
 	if (rc != -ENODEV)
 		return rc;
 
 	/* no info block, do init */;
+	memset(pfn_sb, 0, sizeof(*pfn_sb));
+
 	nd_region = to_nd_region(nd_pfn->dev.parent);
 	if (nd_region->ro) {
 		dev_info(&nd_pfn->dev,
@@ -705,7 +717,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
 	memcpy(pfn_sb->uuid, nd_pfn->uuid, 16);
 	memcpy(pfn_sb->parent_uuid, nd_dev_to_uuid(&ndns->dev), 16);
 	pfn_sb->version_major = cpu_to_le16(1);
-	pfn_sb->version_minor = cpu_to_le16(2);
+	pfn_sb->version_minor = cpu_to_le16(3);
 	pfn_sb->start_pad = cpu_to_le32(start_pad);
 	pfn_sb->end_trunc = cpu_to_le32(end_trunc);
 	pfn_sb->align = cpu_to_le32(nd_pfn->align);
-- 
GitLab


From afa3e571cde398b3e310d4ea73bffcd58a7fb4fe Mon Sep 17 00:00:00 2001
From: Jan Harkes <jaharkes@cs.cmu.edu>
Date: Tue, 16 Jul 2019 16:28:04 -0700
Subject: [PATCH 1019/1835] coda: pass the host file in vma->vm_file on mmap

commit 7fa0a1da3dadfd9216df7745a1331fdaa0940d1c upstream.

Patch series "Coda updates".

The following patch series is a collection of various fixes for Coda,
most of which were collected from linux-fsdevel or linux-kernel but
which have as yet not found their way upstream.

This patch (of 22):

Various file systems expect that vma->vm_file points at their own file
handle, several use file_inode(vma->vm_file) to get at their inode or
use vma->vm_file->private_data.  However the way Coda wrapped mmap on a
host file broke this assumption, vm_file was still pointing at the Coda
file and the host file systems would scribble over Coda's inode and
private file data.

This patch fixes the incorrect expectation and wraps vm_ops->open and
vm_ops->close to allow Coda to track when the vm_area_struct is
destroyed so we still release the reference on the Coda file handle at
the right time.

Link: http://lkml.kernel.org/r/0e850c6e59c0b147dc2dcd51a3af004c948c3697.1558117389.git.jaharkes@cs.cmu.edu
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Mikko Rapeli <mikko.rapeli@iki.fi>
Cc: Sam Protsenko <semen.protsenko@linaro.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Zhouyang Jia <jiazhouyang09@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/coda/file.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 68 insertions(+), 2 deletions(-)

diff --git a/fs/coda/file.c b/fs/coda/file.c
index 1cbc1f2298ee4..43d371551d2b1 100644
--- a/fs/coda/file.c
+++ b/fs/coda/file.c
@@ -27,6 +27,13 @@
 #include "coda_linux.h"
 #include "coda_int.h"
 
+struct coda_vm_ops {
+	atomic_t refcnt;
+	struct file *coda_file;
+	const struct vm_operations_struct *host_vm_ops;
+	struct vm_operations_struct vm_ops;
+};
+
 static ssize_t
 coda_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
@@ -61,6 +68,34 @@ coda_file_write_iter(struct kiocb *iocb, struct iov_iter *to)
 	return ret;
 }
 
+static void
+coda_vm_open(struct vm_area_struct *vma)
+{
+	struct coda_vm_ops *cvm_ops =
+		container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
+
+	atomic_inc(&cvm_ops->refcnt);
+
+	if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open)
+		cvm_ops->host_vm_ops->open(vma);
+}
+
+static void
+coda_vm_close(struct vm_area_struct *vma)
+{
+	struct coda_vm_ops *cvm_ops =
+		container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
+
+	if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close)
+		cvm_ops->host_vm_ops->close(vma);
+
+	if (atomic_dec_and_test(&cvm_ops->refcnt)) {
+		vma->vm_ops = cvm_ops->host_vm_ops;
+		fput(cvm_ops->coda_file);
+		kfree(cvm_ops);
+	}
+}
+
 static int
 coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
 {
@@ -68,6 +103,8 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
 	struct coda_inode_info *cii;
 	struct file *host_file;
 	struct inode *coda_inode, *host_inode;
+	struct coda_vm_ops *cvm_ops;
+	int ret;
 
 	cfi = CODA_FTOC(coda_file);
 	BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC);
@@ -76,6 +113,13 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
 	if (!host_file->f_op->mmap)
 		return -ENODEV;
 
+	if (WARN_ON(coda_file != vma->vm_file))
+		return -EIO;
+
+	cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL);
+	if (!cvm_ops)
+		return -ENOMEM;
+
 	coda_inode = file_inode(coda_file);
 	host_inode = file_inode(host_file);
 
@@ -89,6 +133,7 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
 	 * the container file on us! */
 	else if (coda_inode->i_mapping != host_inode->i_mapping) {
 		spin_unlock(&cii->c_lock);
+		kfree(cvm_ops);
 		return -EBUSY;
 	}
 
@@ -97,7 +142,29 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
 	cfi->cfi_mapcount++;
 	spin_unlock(&cii->c_lock);
 
-	return call_mmap(host_file, vma);
+	vma->vm_file = get_file(host_file);
+	ret = call_mmap(vma->vm_file, vma);
+
+	if (ret) {
+		/* if call_mmap fails, our caller will put coda_file so we
+		 * should drop the reference to the host_file that we got.
+		 */
+		fput(host_file);
+		kfree(cvm_ops);
+	} else {
+		/* here we add redirects for the open/close vm_operations */
+		cvm_ops->host_vm_ops = vma->vm_ops;
+		if (vma->vm_ops)
+			cvm_ops->vm_ops = *vma->vm_ops;
+
+		cvm_ops->vm_ops.open = coda_vm_open;
+		cvm_ops->vm_ops.close = coda_vm_close;
+		cvm_ops->coda_file = coda_file;
+		atomic_set(&cvm_ops->refcnt, 1);
+
+		vma->vm_ops = &cvm_ops->vm_ops;
+	}
+	return ret;
 }
 
 int coda_open(struct inode *coda_inode, struct file *coda_file)
@@ -207,4 +274,3 @@ const struct file_operations coda_file_operations = {
 	.fsync		= coda_fsync,
 	.splice_read	= generic_file_splice_read,
 };
-
-- 
GitLab


From 41f64437f030dc56b738afaa3b3ba7cf9e4064d6 Mon Sep 17 00:00:00 2001
From: Drew Davenport <ddavenport@chromium.org>
Date: Tue, 16 Jul 2019 16:30:18 -0700
Subject: [PATCH 1020/1835] include/asm-generic/bug.h: fix "cut here" for
 WARN_ON for __WARN_TAINT architectures

commit 6b15f678fb7d5ef54e089e6ace72f007fe6e9895 upstream.

For architectures using __WARN_TAINT, the WARN_ON macro did not print
out the "cut here" string.  The other WARN_XXX macros would print "cut
here" inside __warn_printk, which is not called for WARN_ON since it
doesn't have a message to print.

Link: http://lkml.kernel.org/r/20190624154831.163888-1-ddavenport@chromium.org
Fixes: a7bed27af194 ("bug: fix "cut here" location for __WARN_TAINT architectures")
Signed-off-by: Drew Davenport <ddavenport@chromium.org>
Acked-by: Kees Cook <keescook@chromium.org>
Tested-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/asm-generic/bug.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 20561a60db9c4..d4fb510a4fbe9 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -104,8 +104,10 @@ extern void warn_slowpath_null(const char *file, const int line);
 	warn_slowpath_fmt_taint(__FILE__, __LINE__, taint, arg)
 #else
 extern __printf(1, 2) void __warn_printk(const char *fmt, ...);
-#define __WARN()		__WARN_TAINT(TAINT_WARN)
-#define __WARN_printf(arg...)	do { __warn_printk(arg); __WARN(); } while (0)
+#define __WARN() do { \
+	printk(KERN_WARNING CUT_HERE); __WARN_TAINT(TAINT_WARN); \
+} while (0)
+#define __WARN_printf(arg...)	__WARN_printf_taint(TAINT_WARN, arg)
 #define __WARN_printf_taint(taint, arg...)				\
 	do { __warn_printk(arg); __WARN_TAINT(taint); } while (0)
 #endif
-- 
GitLab


From 788920d12b95398f7cfe0022dd1021f31bc7ed76 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 18 Jul 2019 23:06:09 +0000
Subject: [PATCH 1021/1835] xfs: fix pagecache truncation prior to reflink

commit 4918ef4ea008cd2ff47eb852894e3f9b9047f4f3 upstream.

Prior to remapping blocks, it is necessary to remove pages from the
destination file's page cache.  Unfortunately, the truncation is not
aggressive enough -- if page size > block size, we'll end up zeroing
subpage blocks instead of removing them.  So, round the start offset
down and the end offset up to page boundaries.  We already wrote all
the dirty data so the larger range shouldn't be a problem.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_reflink.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 7088f44c0c594..38ea08a3dd1d0 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -1369,8 +1369,9 @@ xfs_reflink_remap_prep(
 		goto out_unlock;
 
 	/* Zap any page cache for the destination file's range. */
-	truncate_inode_pages_range(&inode_out->i_data, pos_out,
-				   PAGE_ALIGN(pos_out + *len) - 1);
+	truncate_inode_pages_range(&inode_out->i_data,
+			round_down(pos_out, PAGE_SIZE),
+			round_up(pos_out + *len, PAGE_SIZE) - 1);
 
 	/* If we're altering the file contents... */
 	if (!is_dedupe) {
-- 
GitLab


From 1dc8b13cc66daef39bac6e2aee601f4c934e90c3 Mon Sep 17 00:00:00 2001
From: Dave Chinner <dchinner@redhat.com>
Date: Thu, 18 Jul 2019 23:06:10 +0000
Subject: [PATCH 1022/1835] xfs: flush removing page cache in
 xfs_reflink_remap_prep

commit 2c307174ab77e34645e75e12827646e044d273c3 upstream.

On a sub-page block size filesystem, fsx is failing with a data
corruption after a series of operations involving copying a file
with the destination offset beyond EOF of the destination of the file:

8093(157 mod 256): TRUNCATE DOWN        from 0x7a120 to 0x50000 ******WWWW
8094(158 mod 256): INSERT 0x25000 thru 0x25fff  (0x1000 bytes)
8095(159 mod 256): COPY 0x18000 thru 0x1afff    (0x3000 bytes) to 0x2f400
8096(160 mod 256): WRITE    0x5da00 thru 0x651ff        (0x7800 bytes) HOLE
8097(161 mod 256): COPY 0x2000 thru 0x5fff      (0x4000 bytes) to 0x6fc00

The second copy here is beyond EOF, and it is to sub-page (4k) but
block aligned (1k) offset. The clone runs the EOF zeroing, landing
in a pre-existing post-eof delalloc extent. This zeroes the post-eof
extents in the page cache just fine, dirtying the pages correctly.

The problem is that xfs_reflink_remap_prep() now truncates the page
cache over the range that it is copying it to, and rounds that down
to cover the entire start page. This removes the dirty page over the
delalloc extent from the page cache without having written it back.
Hence later, when the page cache is flushed, the page at offset
0x6f000 has not been written back and hence exposes stale data,
which fsx trips over less than 10 operations later.

Fix this by changing xfs_reflink_remap_prep() to use
xfs_flush_unmap_range().

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_bmap_util.c |  2 +-
 fs/xfs/xfs_bmap_util.h |  2 ++
 fs/xfs/xfs_reflink.c   | 17 +++++++++++++----
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 211b06e4702e7..41ad9eaab6ce9 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1080,7 +1080,7 @@ xfs_adjust_extent_unmap_boundaries(
 	return 0;
 }
 
-static int
+int
 xfs_flush_unmap_range(
 	struct xfs_inode	*ip,
 	xfs_off_t		offset,
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 87363d136bb61..9c73d012f56ab 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -76,6 +76,8 @@ int	xfs_swap_extents(struct xfs_inode *ip, struct xfs_inode *tip,
 xfs_daddr_t xfs_fsb_to_db(struct xfs_inode *ip, xfs_fsblock_t fsb);
 
 xfs_extnum_t xfs_bmap_count_leaves(struct xfs_ifork *ifp, xfs_filblks_t *count);
+int   xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
+			    xfs_off_t len);
 int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
 			  int whichfork, xfs_extnum_t *nextents,
 			  xfs_filblks_t *count);
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 38ea08a3dd1d0..f3c393f309e19 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -1368,10 +1368,19 @@ xfs_reflink_remap_prep(
 	if (ret)
 		goto out_unlock;
 
-	/* Zap any page cache for the destination file's range. */
-	truncate_inode_pages_range(&inode_out->i_data,
-			round_down(pos_out, PAGE_SIZE),
-			round_up(pos_out + *len, PAGE_SIZE) - 1);
+	/*
+	 * If pos_out > EOF, we may have dirtied blocks between EOF and
+	 * pos_out. In that case, we need to extend the flush and unmap to cover
+	 * from EOF to the end of the copy length.
+	 */
+	if (pos_out > XFS_ISIZE(dest)) {
+		loff_t	flen = *len + (pos_out - XFS_ISIZE(dest));
+		ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
+	} else {
+		ret = xfs_flush_unmap_range(dest, pos_out, *len);
+	}
+	if (ret)
+		goto out_unlock;
 
 	/* If we're altering the file contents... */
 	if (!is_dedupe) {
-- 
GitLab


From 2ab62234e8237bc16e4c81fc59322c305b2ad3c7 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 18 Jul 2019 23:06:11 +0000
Subject: [PATCH 1023/1835] xfs: don't overflow xattr listent buffer

commit 3b50086f0c0d78c144d9483fa292c1509c931b70 upstream.

For VFS listxattr calls, xfs_xattr_put_listent calls
__xfs_xattr_put_listent twice if it sees an attribute
"trusted.SGI_ACL_FILE": once for that name, and again for
"system.posix_acl_access".  Unfortunately, if we happen to run out of
buffer space while emitting the first name, we set count to -1 (so that
we can feed ERANGE to the caller).  The second invocation doesn't check that
the context parameters make sense and overwrites the byte before the
buffer, triggering a KASAN report:

==================================================================
BUG: KASAN: slab-out-of-bounds in strncpy+0xb3/0xd0
Write of size 1 at addr ffff88807fbd317f by task syz/1113

CPU: 3 PID: 1113 Comm: syz Not tainted 5.0.0-rc6-xfsx #rc6
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
 dump_stack+0xcc/0x180
 print_address_description+0x6c/0x23c
 kasan_report.cold.3+0x1c/0x35
 strncpy+0xb3/0xd0
 __xfs_xattr_put_listent+0x1a9/0x2c0 [xfs]
 xfs_attr_list_int_ilocked+0x11af/0x1800 [xfs]
 xfs_attr_list_int+0x20c/0x2e0 [xfs]
 xfs_vn_listxattr+0x225/0x320 [xfs]
 listxattr+0x11f/0x1b0
 path_listxattr+0xbd/0x130
 do_syscall_64+0x139/0x560

While we're at it we add an assert to the other put_listent to avoid
this sort of thing ever happening to the attrlist_by_handle code.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Suggested-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_attr_list.c | 1 +
 fs/xfs/xfs_xattr.c     | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
index a58034049995b..3d213a7394c5b 100644
--- a/fs/xfs/xfs_attr_list.c
+++ b/fs/xfs/xfs_attr_list.c
@@ -555,6 +555,7 @@ xfs_attr_put_listent(
 	attrlist_ent_t *aep;
 	int arraytop;
 
+	ASSERT(!context->seen_enough);
 	ASSERT(!(context->flags & ATTR_KERNOVAL));
 	ASSERT(context->count >= 0);
 	ASSERT(context->count < (ATTR_MAX_VALUELEN/8));
diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c
index 63ee1d5bf1d77..9a63016009a13 100644
--- a/fs/xfs/xfs_xattr.c
+++ b/fs/xfs/xfs_xattr.c
@@ -129,6 +129,9 @@ __xfs_xattr_put_listent(
 	char *offset;
 	int arraytop;
 
+	if (context->count < 0 || context->seen_enough)
+		return;
+
 	if (!context->alist)
 		goto compute_size;
 
-- 
GitLab


From 3a895cc066c07dc9d1d35485be9c71a520b5a090 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 18 Jul 2019 23:06:12 +0000
Subject: [PATCH 1024/1835] xfs: rename m_inotbt_nores to m_finobt_nores

commit e1f6ca11381588e3ef138c10de60eeb34cb8466a upstream.

Rename this flag variable to imply more strongly that it's related to
the free inode btree (finobt) operation.  No functional changes.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Suggested-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_ag_resv.c      | 2 +-
 fs/xfs/libxfs/xfs_ialloc_btree.c | 4 ++--
 fs/xfs/xfs_inode.c               | 2 +-
 fs/xfs/xfs_mount.h               | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
index e701ebc36c069..e2ba2a3b63b20 100644
--- a/fs/xfs/libxfs/xfs_ag_resv.c
+++ b/fs/xfs/libxfs/xfs_ag_resv.c
@@ -281,7 +281,7 @@ xfs_ag_resv_init(
 			 */
 			ask = used = 0;
 
-			mp->m_inotbt_nores = true;
+			mp->m_finobt_nores = true;
 
 			error = xfs_refcountbt_calc_reserves(mp, tp, agno, &ask,
 					&used);
diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
index 86c50208a1437..adb2f6df5a114 100644
--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
+++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
@@ -124,7 +124,7 @@ xfs_finobt_alloc_block(
 	union xfs_btree_ptr	*new,
 	int			*stat)
 {
-	if (cur->bc_mp->m_inotbt_nores)
+	if (cur->bc_mp->m_finobt_nores)
 		return xfs_inobt_alloc_block(cur, start, new, stat);
 	return __xfs_inobt_alloc_block(cur, start, new, stat,
 			XFS_AG_RESV_METADATA);
@@ -157,7 +157,7 @@ xfs_finobt_free_block(
 	struct xfs_btree_cur	*cur,
 	struct xfs_buf		*bp)
 {
-	if (cur->bc_mp->m_inotbt_nores)
+	if (cur->bc_mp->m_finobt_nores)
 		return xfs_inobt_free_block(cur, bp);
 	return __xfs_inobt_free_block(cur, bp, XFS_AG_RESV_METADATA);
 }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 05db9540e4597..ae07baa7bdbfd 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1754,7 +1754,7 @@ xfs_inactive_ifree(
 	 * now remains allocated and sits on the unlinked list until the fs is
 	 * repaired.
 	 */
-	if (unlikely(mp->m_inotbt_nores)) {
+	if (unlikely(mp->m_finobt_nores)) {
 		error = xfs_trans_alloc(mp, &M_RES(mp)->tr_ifree,
 				XFS_IFREE_SPACE_RES(mp), 0, XFS_TRANS_RESERVE,
 				&tp);
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 7964513c31281..7e0bf952e087d 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -127,7 +127,7 @@ typedef struct xfs_mount {
 	struct mutex		m_growlock;	/* growfs mutex */
 	int			m_fixedfsid[2];	/* unchanged for life of FS */
 	uint64_t		m_flags;	/* global mount flags */
-	bool			m_inotbt_nores; /* no per-AG finobt resv. */
+	bool			m_finobt_nores; /* no per-AG finobt resv. */
 	int			m_ialloc_inos;	/* inodes in inode allocation */
 	int			m_ialloc_blks;	/* blocks in inode allocation */
 	int			m_ialloc_min_blks;/* min blocks in sparse inode
-- 
GitLab


From 424543a53ae0e4cf1d887485855ae54e774b2de2 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 18 Jul 2019 23:06:13 +0000
Subject: [PATCH 1025/1835] xfs: don't ever put nlink > 0 inodes on the
 unlinked list

commit c4a6bf7f6cc7eb4cce120fb7eb1e1fb8b2d65e09 upstream.

When XFS creates an O_TMPFILE file, the inode is created with nlink = 1,
put on the unlinked list, and then the VFS sets nlink = 0 in d_tmpfile.
If we crash before anything logs the inode (it's dirty incore but the
vfs doesn't tell us it's dirty so we never log that change), the iunlink
processing part of recovery will then explode with a pile of:

XFS: Assertion failed: VFS_I(ip)->i_nlink == 0, file:
fs/xfs/xfs_log_recover.c, line: 5072

Worse yet, since nlink is nonzero, the inodes also don't get cleaned up
and they just leak until the next xfs_repair run.

Therefore, change xfs_iunlink to require that inodes being put on the
unlinked list have nlink == 0, change the tmpfile callers to instantiate
nodes that way, and set the nlink to 1 just prior to calling d_tmpfile.
Fix the comment for xfs_iunlink while we're at it.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Suggested-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_inode.c | 16 ++++++----------
 fs/xfs/xfs_iops.c  | 13 +++++++++++--
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index ae07baa7bdbfd..5ed84d6c70597 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1332,7 +1332,7 @@ xfs_create_tmpfile(
 	if (error)
 		goto out_trans_cancel;
 
-	error = xfs_dir_ialloc(&tp, dp, mode, 1, 0, prid, &ip);
+	error = xfs_dir_ialloc(&tp, dp, mode, 0, 0, prid, &ip);
 	if (error)
 		goto out_trans_cancel;
 
@@ -1907,11 +1907,8 @@ xfs_inactive(
 }
 
 /*
- * This is called when the inode's link count goes to 0 or we are creating a
- * tmpfile via O_TMPFILE. In the case of a tmpfile, @ignore_linkcount will be
- * set to true as the link count is dropped to zero by the VFS after we've
- * created the file successfully, so we have to add it to the unlinked list
- * while the link count is non-zero.
+ * This is called when the inode's link count has gone to 0 or we are creating
+ * a tmpfile via O_TMPFILE.  The inode @ip must have nlink == 0.
  *
  * We place the on-disk inode on a list in the AGI.  It will be pulled from this
  * list when the inode is freed.
@@ -1931,6 +1928,7 @@ xfs_iunlink(
 	int		offset;
 	int		error;
 
+	ASSERT(VFS_I(ip)->i_nlink == 0);
 	ASSERT(VFS_I(ip)->i_mode != 0);
 
 	/*
@@ -2837,11 +2835,9 @@ xfs_rename_alloc_whiteout(
 
 	/*
 	 * Prepare the tmpfile inode as if it were created through the VFS.
-	 * Otherwise, the link increment paths will complain about nlink 0->1.
-	 * Drop the link count as done by d_tmpfile(), complete the inode setup
-	 * and flag it as linkable.
+	 * Complete the inode setup and flag it as linkable.  nlink is already
+	 * zero, so we can skip the drop_nlink.
 	 */
-	drop_nlink(VFS_I(tmpfile));
 	xfs_setup_iops(tmpfile);
 	xfs_finish_inode_setup(tmpfile);
 	VFS_I(tmpfile)->i_state |= I_LINKABLE;
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index f48ffd7a8d3e4..1efef69a7f1c3 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -191,9 +191,18 @@ xfs_generic_create(
 
 	xfs_setup_iops(ip);
 
-	if (tmpfile)
+	if (tmpfile) {
+		/*
+		 * The VFS requires that any inode fed to d_tmpfile must have
+		 * nlink == 1 so that it can decrement the nlink in d_tmpfile.
+		 * However, we created the temp file with nlink == 0 because
+		 * we're not allowed to put an inode with nlink > 0 on the
+		 * unlinked list.  Therefore we have to set nlink to 1 so that
+		 * d_tmpfile can immediately set it back to zero.
+		 */
+		set_nlink(inode, 1);
 		d_tmpfile(dentry, inode);
-	else
+	} else
 		d_instantiate(dentry, inode);
 
 	xfs_finish_inode_setup(ip);
-- 
GitLab


From f614ef7a34b0731cda9d382b610ff82ef264eb02 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 18 Jul 2019 23:06:14 +0000
Subject: [PATCH 1026/1835] xfs: reserve blocks for ifree transaction during
 log recovery

commit 15a268d9f263ed3a0601a1296568241a5a3da7aa upstream.

Log recovery frees all the inodes stored in the unlinked list, which can
cause expansion of the free inode btree.  The ifree code skips block
reservations if it thinks there's a per-AG space reservation, but we
don't set up the reservation until after log recovery, which means that
a finobt expansion blows up in xfs_trans_mod_sb when we exceed the
transaction's block reservation.

To fix this, we set the "no finobt reservation" flag to true when we
create the xfs_mount and only set it to false if we confirm that every
AG had enough free space to put aside for the finobt.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Suggested-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_fsops.c | 1 +
 fs/xfs/xfs_super.c | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 7c00b8bedfe35..09fd602507eff 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -534,6 +534,7 @@ xfs_fs_reserve_ag_blocks(
 	int			error = 0;
 	int			err2;
 
+	mp->m_finobt_nores = false;
 	for (agno = 0; agno < mp->m_sb.sb_agcount; agno++) {
 		pag = xfs_perag_get(mp, agno);
 		err2 = xfs_ag_resv_init(pag, NULL);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 207ee302b1bb9..dce8114e3198c 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1561,6 +1561,13 @@ xfs_mount_alloc(
 	INIT_DELAYED_WORK(&mp->m_eofblocks_work, xfs_eofblocks_worker);
 	INIT_DELAYED_WORK(&mp->m_cowblocks_work, xfs_cowblocks_worker);
 	mp->m_kobj.kobject.kset = xfs_kset;
+	/*
+	 * We don't create the finobt per-ag space reservation until after log
+	 * recovery, so we must set this to true so that an ifree transaction
+	 * started during log recovery will not depend on space reservations
+	 * for finobt expansion.
+	 */
+	mp->m_finobt_nores = true;
 	return mp;
 }
 
-- 
GitLab


From d61d885b17b0cb9fb18fb61ec3ea672dce02f0e4 Mon Sep 17 00:00:00 2001
From: "Luis R. Rodriguez" <mcgrof@kernel.org>
Date: Thu, 18 Jul 2019 23:06:15 +0000
Subject: [PATCH 1027/1835] xfs: fix reporting supported extra file attributes
 for statx()

commit 1b9598c8fb9965fff901c4caa21fed9644c34df3 upstream.

statx(2) notes that any attribute that is not indicated as supported by
stx_attributes_mask has no usable value. Commit 5f955f26f3d42d ("xfs: report
crtime and attribute flags to statx") added support for informing userspace
of extra file attributes but forgot to list these flags as supported
making reporting them rather useless for the pedantic userspace author.

$ git describe --contains 5f955f26f3d42d04aba65590a32eb70eedb7f37d
v4.11-rc6~5^2^2~2

Fixes: 5f955f26f3d42d ("xfs: report crtime and attribute flags to statx")
Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
[darrick: add a comment reminding people to keep attributes_mask up to date]
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_iops.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 1efef69a7f1c3..74047bd0c1aeb 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -531,6 +531,10 @@ xfs_vn_getattr(
 		}
 	}
 
+	/*
+	 * Note: If you add another clause to set an attribute flag, please
+	 * update attributes_mask below.
+	 */
 	if (ip->i_d.di_flags & XFS_DIFLAG_IMMUTABLE)
 		stat->attributes |= STATX_ATTR_IMMUTABLE;
 	if (ip->i_d.di_flags & XFS_DIFLAG_APPEND)
@@ -538,6 +542,10 @@ xfs_vn_getattr(
 	if (ip->i_d.di_flags & XFS_DIFLAG_NODUMP)
 		stat->attributes |= STATX_ATTR_NODUMP;
 
+	stat->attributes_mask |= (STATX_ATTR_IMMUTABLE |
+				  STATX_ATTR_APPEND |
+				  STATX_ATTR_NODUMP);
+
 	switch (inode->i_mode & S_IFMT) {
 	case S_IFBLK:
 	case S_IFCHR:
-- 
GitLab


From 669c867972c0057bd47cb96ee746fcce26c802d0 Mon Sep 17 00:00:00 2001
From: Brian Foster <bfoster@redhat.com>
Date: Thu, 18 Jul 2019 23:06:16 +0000
Subject: [PATCH 1028/1835] xfs: serialize unaligned dio writes against all
 other dio writes

commit 2032a8a27b5cc0f578d37fa16fa2494b80a0d00a upstream.

XFS applies more strict serialization constraints to unaligned
direct writes to accommodate things like direct I/O layer zeroing,
unwritten extent conversion, etc. Unaligned submissions acquire the
exclusive iolock and wait for in-flight dio to complete to ensure
multiple submissions do not race on the same block and cause data
corruption.

This generally works in the case of an aligned dio followed by an
unaligned dio, but the serialization is lost if I/Os occur in the
opposite order. If an unaligned write is submitted first and
immediately followed by an overlapping, aligned write, the latter
submits without the typical unaligned serialization barriers because
there is no indication of an unaligned dio still in-flight. This can
lead to unpredictable results.

To provide proper unaligned dio serialization, require that such
direct writes are always the only dio allowed in-flight at one time
for a particular inode. We already acquire the exclusive iolock and
drain pending dio before submitting the unaligned dio. Wait once
more after the dio submission to hold the iolock across the I/O and
prevent further submissions until the unaligned I/O completes. This
is heavy handed, but consistent with the current pre-submission
serialization for unaligned direct writes.

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_file.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 61a5ad2600e86..10f75965243c9 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -529,18 +529,17 @@ xfs_file_dio_aio_write(
 	count = iov_iter_count(from);
 
 	/*
-	 * If we are doing unaligned IO, wait for all other IO to drain,
-	 * otherwise demote the lock if we had to take the exclusive lock
-	 * for other reasons in xfs_file_aio_write_checks.
+	 * If we are doing unaligned IO, we can't allow any other overlapping IO
+	 * in-flight at the same time or we risk data corruption. Wait for all
+	 * other IO to drain before we submit. If the IO is aligned, demote the
+	 * iolock if we had to take the exclusive lock in
+	 * xfs_file_aio_write_checks() for other reasons.
 	 */
 	if (unaligned_io) {
-		/* If we are going to wait for other DIO to finish, bail */
-		if (iocb->ki_flags & IOCB_NOWAIT) {
-			if (atomic_read(&inode->i_dio_count))
-				return -EAGAIN;
-		} else {
-			inode_dio_wait(inode);
-		}
+		/* unaligned dio always waits, bail */
+		if (iocb->ki_flags & IOCB_NOWAIT)
+			return -EAGAIN;
+		inode_dio_wait(inode);
 	} else if (iolock == XFS_IOLOCK_EXCL) {
 		xfs_ilock_demote(ip, XFS_IOLOCK_EXCL);
 		iolock = XFS_IOLOCK_SHARED;
@@ -548,6 +547,14 @@ xfs_file_dio_aio_write(
 
 	trace_xfs_file_direct_write(ip, count, iocb->ki_pos);
 	ret = iomap_dio_rw(iocb, from, &xfs_iomap_ops, xfs_dio_write_end_io);
+
+	/*
+	 * If unaligned, this is the only IO in-flight. If it has not yet
+	 * completed, wait on it before we release the iolock to prevent
+	 * subsequent overlapping IO.
+	 */
+	if (ret == -EIOCBQUEUED && unaligned_io)
+		inode_dio_wait(inode);
 out:
 	xfs_iunlock(ip, iolock);
 
-- 
GitLab


From ef30c073943959b524443becbb1132d37f7bed6d Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 18 Jul 2019 23:06:17 +0000
Subject: [PATCH 1029/1835] xfs: abort unaligned nowait directio early

commit 1fdeaea4d92c69fb9f871a787af6ad00f32eeea7 upstream.

Dave Chinner noticed that xfs_file_dio_aio_write returns EAGAIN without
dropping the IOLOCK when its deciding not to wait, which means that we
leak the IOLOCK there.  Since we now make unaligned directio always
wait, we have the opportunity to bail out before trying to take the
lock, which should reduce the overhead of this never-gonna-work case
considerably while also solving the dropped lock problem.

Reported-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_file.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 10f75965243c9..259549698ba7e 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -517,6 +517,9 @@ xfs_file_dio_aio_write(
 	}
 
 	if (iocb->ki_flags & IOCB_NOWAIT) {
+		/* unaligned dio always waits, bail */
+		if (unaligned_io)
+			return -EAGAIN;
 		if (!xfs_ilock_nowait(ip, iolock))
 			return -EAGAIN;
 	} else {
@@ -536,9 +539,6 @@ xfs_file_dio_aio_write(
 	 * xfs_file_aio_write_checks() for other reasons.
 	 */
 	if (unaligned_io) {
-		/* unaligned dio always waits, bail */
-		if (iocb->ki_flags & IOCB_NOWAIT)
-			return -EAGAIN;
 		inode_dio_wait(inode);
 	} else if (iolock == XFS_IOLOCK_EXCL) {
 		xfs_ilock_demote(ip, XFS_IOLOCK_EXCL);
-- 
GitLab


From 376b80276d84e25cc530b672e150ebc3ebfe7b1b Mon Sep 17 00:00:00 2001
From: Steve Longerbeam <slongerbeam@gmail.com>
Date: Tue, 21 May 2019 18:03:13 -0700
Subject: [PATCH 1030/1835] gpu: ipu-v3: ipu-ic: Fix saturation bit offset in
 TPMEM

commit 3d1f62c686acdedf5ed9642b763f3808d6a47d1e upstream.

The saturation bit was being set at bit 9 in the second 32-bit word
of the TPMEM CSC. This isn't correct, the saturation bit is bit 42,
which is bit 10 of the second word.

Fixes: 1aa8ea0d2bd5d ("gpu: ipu-v3: Add Image Converter unit")

Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/ipu-v3/ipu-ic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/ipu-v3/ipu-ic.c b/drivers/gpu/ipu-v3/ipu-ic.c
index 67cc820253a99..fb79e118f26c8 100644
--- a/drivers/gpu/ipu-v3/ipu-ic.c
+++ b/drivers/gpu/ipu-v3/ipu-ic.c
@@ -257,7 +257,7 @@ static int init_csc(struct ipu_ic *ic,
 	writel(param, base++);
 
 	param = ((a[0] & 0x1fe0) >> 5) | (params->scale << 8) |
-		(params->sat << 9);
+		(params->sat << 10);
 	writel(param, base++);
 
 	param = ((a[1] & 0x1f) << 27) | ((c[0][1] & 0x1ff) << 18) |
-- 
GitLab


From ef5c2e165ab0a38c949bd44055fd0384e7d8c235 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date: Fri, 31 May 2019 10:13:06 +0200
Subject: [PATCH 1031/1835] crypto: caam - limit output IV to CBC to work
 around CTR mode DMA issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ed527b13d800dd515a9e6c582f0a73eca65b2e1b upstream.

The CAAM driver currently violates an undocumented and slightly
controversial requirement imposed by the crypto stack that a buffer
referred to by the request structure via its virtual address may not
be modified while any scatterlists passed via the same request
structure are mapped for inbound DMA.

This may result in errors like

  alg: aead: decryption failed on test 1 for gcm_base(ctr-aes-caam,ghash-generic): ret=74
  alg: aead: Failed to load transform for gcm(aes): -2

on non-cache coherent systems, due to the fact that the GCM driver
passes an IV buffer by virtual address which shares a cacheline with
the auth_tag buffer passed via a scatterlist, resulting in corruption
of the auth_tag when the IV is updated while the DMA mapping is live.

Since the IV that is returned to the caller is only valid for CBC mode,
and given that the in-kernel users of CBC (such as CTS) don't trigger the
same issue as the GCM driver, let's just disable the output IV generation
for all modes except CBC for the time being.

Fixes: 854b06f76879 ("crypto: caam - properly set IV after {en,de}crypt")
Cc: Horia Geanta <horia.geanta@nxp.com>
Cc: Iuliana Prodan <iuliana.prodan@nxp.com>
Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[ Horia: backported to 4.14, 4.19 ]
Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/caam/caamalg.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 9bc54c3c2cb97..1907945f82b78 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -887,6 +887,7 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
 	struct ablkcipher_request *req = context;
 	struct ablkcipher_edesc *edesc;
 	struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
+	struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
 	int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
 
 #ifdef DEBUG
@@ -911,10 +912,11 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
 
 	/*
 	 * The crypto API expects us to set the IV (req->info) to the last
-	 * ciphertext block. This is used e.g. by the CTS mode.
+	 * ciphertext block when running in CBC mode.
 	 */
-	scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize,
-				 ivsize, 0);
+	if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC)
+		scatterwalk_map_and_copy(req->info, req->dst, req->nbytes -
+					 ivsize, ivsize, 0);
 
 	/* In case initial IV was generated, copy it in GIVCIPHER request */
 	if (edesc->iv_dir == DMA_FROM_DEVICE) {
@@ -1651,10 +1653,11 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req)
 
 	/*
 	 * The crypto API expects us to set the IV (req->info) to the last
-	 * ciphertext block.
+	 * ciphertext block when running in CBC mode.
 	 */
-	scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize,
-				 ivsize, 0);
+	if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC)
+		scatterwalk_map_and_copy(req->info, req->src, req->nbytes -
+					 ivsize, ivsize, 0);
 
 	/* Create and submit job descriptor*/
 	init_ablkcipher_job(ctx->sh_desc_dec, ctx->sh_desc_dec_dma, edesc, req);
-- 
GitLab


From a6a0daa775e84d72e292ffd0edb2fa9f246212e5 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 4 Jul 2019 03:44:17 +0200
Subject: [PATCH 1032/1835] parisc: Ensure userspace privilege for ptraced
 processes in regset functions

commit 34c32fc603311a72cb558e5e337555434f64c27b upstream.

On parisc the privilege level of a process is stored in the lowest two bits of
the instruction pointers (IAOQ0 and IAOQ1). On Linux we use privilege level 0
for the kernel and privilege level 3 for user-space. So userspace should not be
allowed to modify IAOQ0 or IAOQ1 of a ptraced process to change it's privilege
level to e.g. 0 to try to gain kernel privileges.

This patch prevents such modifications in the regset support functions by
always setting the two lowest bits to one (which relates to privilege level 3
for user-space) if IAOQ0 or IAOQ1 are modified via ptrace regset calls.

Link: https://bugs.gentoo.org/481768
Cc: <stable@vger.kernel.org> # v4.7+
Tested-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 0964c236e3e5a..855ccbca8049b 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -496,7 +496,8 @@ static void set_reg(struct pt_regs *regs, int num, unsigned long val)
 			return;
 	case RI(iaoq[0]):
 	case RI(iaoq[1]):
-			regs->iaoq[num - RI(iaoq[0])] = val;
+			/* set 2 lowest bits to ensure userspace privilege: */
+			regs->iaoq[num - RI(iaoq[0])] = val | 3;
 			return;
 	case RI(sar):	regs->sar = val;
 			return;
-- 
GitLab


From 7961981718d67e3a3bc03a72c83374046121bc81 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 16 Jul 2019 21:43:11 +0200
Subject: [PATCH 1033/1835] parisc: Fix kernel panic due invalid values in
 IAOQ0 or IAOQ1

commit 10835c854685393a921b68f529bf740fa7c9984d upstream.

On parisc the privilege level of a process is stored in the lowest two bits of
the instruction pointers (IAOQ0 and IAOQ1). On Linux we use privilege level 0
for the kernel and privilege level 3 for user-space. So userspace should not be
allowed to modify IAOQ0 or IAOQ1 of a ptraced process to change it's privilege
level to e.g. 0 to try to gain kernel privileges.

This patch prevents such modifications by always setting the two lowest bits to
one (which relates to privilege level 3 for user-space) if IAOQ0 or IAOQ1 are
modified via ptrace calls in the native and compat ptrace paths.

Link: https://bugs.gentoo.org/481768
Reported-by: Jeroen Roovers <jer@gentoo.org>
Cc: <stable@vger.kernel.org>
Tested-by: Rolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/ptrace.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 855ccbca8049b..de2998cb189e8 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -167,6 +167,9 @@ long arch_ptrace(struct task_struct *child, long request,
 		if ((addr & (sizeof(unsigned long)-1)) ||
 		     addr >= sizeof(struct pt_regs))
 			break;
+		if (addr == PT_IAOQ0 || addr == PT_IAOQ1) {
+			data |= 3; /* ensure userspace privilege */
+		}
 		if ((addr >= PT_GR1 && addr <= PT_GR31) ||
 				addr == PT_IAOQ0 || addr == PT_IAOQ1 ||
 				(addr >= PT_FR0 && addr <= PT_FR31 + 4) ||
@@ -228,16 +231,18 @@ long arch_ptrace(struct task_struct *child, long request,
 
 static compat_ulong_t translate_usr_offset(compat_ulong_t offset)
 {
-	if (offset < 0)
-		return sizeof(struct pt_regs);
-	else if (offset <= 32*4)	/* gr[0..31] */
-		return offset * 2 + 4;
-	else if (offset <= 32*4+32*8)	/* gr[0..31] + fr[0..31] */
-		return offset + 32*4;
-	else if (offset < sizeof(struct pt_regs)/2 + 32*4)
-		return offset * 2 + 4 - 32*8;
+	compat_ulong_t pos;
+
+	if (offset < 32*4)	/* gr[0..31] */
+		pos = offset * 2 + 4;
+	else if (offset < 32*4+32*8)	/* fr[0] ... fr[31] */
+		pos = (offset - 32*4) + PT_FR0;
+	else if (offset < sizeof(struct pt_regs)/2 + 32*4) /* sr[0] ... ipsw */
+		pos = (offset - 32*4 - 32*8) * 2 + PT_SR0 + 4;
 	else
-		return sizeof(struct pt_regs);
+		pos = sizeof(struct pt_regs);
+
+	return pos;
 }
 
 long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
@@ -281,9 +286,12 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 			addr = translate_usr_offset(addr);
 			if (addr >= sizeof(struct pt_regs))
 				break;
+			if (addr == PT_IAOQ0+4 || addr == PT_IAOQ1+4) {
+				data |= 3; /* ensure userspace privilege */
+			}
 			if (addr >= PT_FR0 && addr <= PT_FR31 + 4) {
 				/* Special case, fp regs are 64 bits anyway */
-				*(__u64 *) ((char *) task_regs(child) + addr) = data;
+				*(__u32 *) ((char *) task_regs(child) + addr) = data;
 				ret = 0;
 			}
 			else if ((addr >= PT_GR1+4 && addr <= PT_GR31+4) ||
-- 
GitLab


From 237ac0d73b551499f476c1d578651e587b741c4e Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Mon, 17 Jun 2019 21:42:14 +0000
Subject: [PATCH 1034/1835] powerpc/32s: fix suspend/resume when IBATs 4-7 are
 used

commit 6ecb78ef56e08d2119d337ae23cb951a640dc52d upstream.

Previously, only IBAT1 and IBAT2 were used to map kernel linear mem.
Since commit 63b2bc619565 ("powerpc/mm/32s: Use BATs for
STRICT_KERNEL_RWX"), we may have all 8 BATs used for mapping
kernel text. But the suspend/restore functions only save/restore
BATs 0 to 3, and clears BATs 4 to 7.

Make suspend and restore functions respectively save and reload
the 8 BATs on CPUs having MMU_FTR_USE_HIGH_BATS feature.

Reported-by: Andreas Schwab <schwab@linux-m68k.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/swsusp_32.S         | 73 ++++++++++++++++++++++---
 arch/powerpc/platforms/powermac/sleep.S | 68 +++++++++++++++++++++--
 2 files changed, 128 insertions(+), 13 deletions(-)

diff --git a/arch/powerpc/kernel/swsusp_32.S b/arch/powerpc/kernel/swsusp_32.S
index 7a919e9a3400b..cbdf86228eaaa 100644
--- a/arch/powerpc/kernel/swsusp_32.S
+++ b/arch/powerpc/kernel/swsusp_32.S
@@ -25,11 +25,19 @@
 #define SL_IBAT2	0x48
 #define SL_DBAT3	0x50
 #define SL_IBAT3	0x58
-#define SL_TB		0x60
-#define SL_R2		0x68
-#define SL_CR		0x6c
-#define SL_LR		0x70
-#define SL_R12		0x74	/* r12 to r31 */
+#define SL_DBAT4	0x60
+#define SL_IBAT4	0x68
+#define SL_DBAT5	0x70
+#define SL_IBAT5	0x78
+#define SL_DBAT6	0x80
+#define SL_IBAT6	0x88
+#define SL_DBAT7	0x90
+#define SL_IBAT7	0x98
+#define SL_TB		0xa0
+#define SL_R2		0xa8
+#define SL_CR		0xac
+#define SL_LR		0xb0
+#define SL_R12		0xb4	/* r12 to r31 */
 #define SL_SIZE		(SL_R12 + 80)
 
 	.section .data
@@ -114,6 +122,41 @@ _GLOBAL(swsusp_arch_suspend)
 	mfibatl	r4,3
 	stw	r4,SL_IBAT3+4(r11)
 
+BEGIN_MMU_FTR_SECTION
+	mfspr	r4,SPRN_DBAT4U
+	stw	r4,SL_DBAT4(r11)
+	mfspr	r4,SPRN_DBAT4L
+	stw	r4,SL_DBAT4+4(r11)
+	mfspr	r4,SPRN_DBAT5U
+	stw	r4,SL_DBAT5(r11)
+	mfspr	r4,SPRN_DBAT5L
+	stw	r4,SL_DBAT5+4(r11)
+	mfspr	r4,SPRN_DBAT6U
+	stw	r4,SL_DBAT6(r11)
+	mfspr	r4,SPRN_DBAT6L
+	stw	r4,SL_DBAT6+4(r11)
+	mfspr	r4,SPRN_DBAT7U
+	stw	r4,SL_DBAT7(r11)
+	mfspr	r4,SPRN_DBAT7L
+	stw	r4,SL_DBAT7+4(r11)
+	mfspr	r4,SPRN_IBAT4U
+	stw	r4,SL_IBAT4(r11)
+	mfspr	r4,SPRN_IBAT4L
+	stw	r4,SL_IBAT4+4(r11)
+	mfspr	r4,SPRN_IBAT5U
+	stw	r4,SL_IBAT5(r11)
+	mfspr	r4,SPRN_IBAT5L
+	stw	r4,SL_IBAT5+4(r11)
+	mfspr	r4,SPRN_IBAT6U
+	stw	r4,SL_IBAT6(r11)
+	mfspr	r4,SPRN_IBAT6L
+	stw	r4,SL_IBAT6+4(r11)
+	mfspr	r4,SPRN_IBAT7U
+	stw	r4,SL_IBAT7(r11)
+	mfspr	r4,SPRN_IBAT7L
+	stw	r4,SL_IBAT7+4(r11)
+END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+
 #if  0
 	/* Backup various CPU config stuffs */
 	bl	__save_cpu_setup
@@ -279,27 +322,41 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 	mtibatu	3,r4
 	lwz	r4,SL_IBAT3+4(r11)
 	mtibatl	3,r4
-#endif
-
 BEGIN_MMU_FTR_SECTION
-	li	r4,0
+	lwz	r4,SL_DBAT4(r11)
 	mtspr	SPRN_DBAT4U,r4
+	lwz	r4,SL_DBAT4+4(r11)
 	mtspr	SPRN_DBAT4L,r4
+	lwz	r4,SL_DBAT5(r11)
 	mtspr	SPRN_DBAT5U,r4
+	lwz	r4,SL_DBAT5+4(r11)
 	mtspr	SPRN_DBAT5L,r4
+	lwz	r4,SL_DBAT6(r11)
 	mtspr	SPRN_DBAT6U,r4
+	lwz	r4,SL_DBAT6+4(r11)
 	mtspr	SPRN_DBAT6L,r4
+	lwz	r4,SL_DBAT7(r11)
 	mtspr	SPRN_DBAT7U,r4
+	lwz	r4,SL_DBAT7+4(r11)
 	mtspr	SPRN_DBAT7L,r4
+	lwz	r4,SL_IBAT4(r11)
 	mtspr	SPRN_IBAT4U,r4
+	lwz	r4,SL_IBAT4+4(r11)
 	mtspr	SPRN_IBAT4L,r4
+	lwz	r4,SL_IBAT5(r11)
 	mtspr	SPRN_IBAT5U,r4
+	lwz	r4,SL_IBAT5+4(r11)
 	mtspr	SPRN_IBAT5L,r4
+	lwz	r4,SL_IBAT6(r11)
 	mtspr	SPRN_IBAT6U,r4
+	lwz	r4,SL_IBAT6+4(r11)
 	mtspr	SPRN_IBAT6L,r4
+	lwz	r4,SL_IBAT7(r11)
 	mtspr	SPRN_IBAT7U,r4
+	lwz	r4,SL_IBAT7+4(r11)
 	mtspr	SPRN_IBAT7L,r4
 END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+#endif
 
 	/* Flush all TLBs */
 	lis	r4,0x1000
diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S
index f89808b9713d0..b0660ef691779 100644
--- a/arch/powerpc/platforms/powermac/sleep.S
+++ b/arch/powerpc/platforms/powermac/sleep.S
@@ -38,10 +38,18 @@
 #define SL_IBAT2	0x48
 #define SL_DBAT3	0x50
 #define SL_IBAT3	0x58
-#define SL_TB		0x60
-#define SL_R2		0x68
-#define SL_CR		0x6c
-#define SL_R12		0x70	/* r12 to r31 */
+#define SL_DBAT4	0x60
+#define SL_IBAT4	0x68
+#define SL_DBAT5	0x70
+#define SL_IBAT5	0x78
+#define SL_DBAT6	0x80
+#define SL_IBAT6	0x88
+#define SL_DBAT7	0x90
+#define SL_IBAT7	0x98
+#define SL_TB		0xa0
+#define SL_R2		0xa8
+#define SL_CR		0xac
+#define SL_R12		0xb0	/* r12 to r31 */
 #define SL_SIZE		(SL_R12 + 80)
 
 	.section .text
@@ -126,6 +134,41 @@ _GLOBAL(low_sleep_handler)
 	mfibatl	r4,3
 	stw	r4,SL_IBAT3+4(r1)
 
+BEGIN_MMU_FTR_SECTION
+	mfspr	r4,SPRN_DBAT4U
+	stw	r4,SL_DBAT4(r1)
+	mfspr	r4,SPRN_DBAT4L
+	stw	r4,SL_DBAT4+4(r1)
+	mfspr	r4,SPRN_DBAT5U
+	stw	r4,SL_DBAT5(r1)
+	mfspr	r4,SPRN_DBAT5L
+	stw	r4,SL_DBAT5+4(r1)
+	mfspr	r4,SPRN_DBAT6U
+	stw	r4,SL_DBAT6(r1)
+	mfspr	r4,SPRN_DBAT6L
+	stw	r4,SL_DBAT6+4(r1)
+	mfspr	r4,SPRN_DBAT7U
+	stw	r4,SL_DBAT7(r1)
+	mfspr	r4,SPRN_DBAT7L
+	stw	r4,SL_DBAT7+4(r1)
+	mfspr	r4,SPRN_IBAT4U
+	stw	r4,SL_IBAT4(r1)
+	mfspr	r4,SPRN_IBAT4L
+	stw	r4,SL_IBAT4+4(r1)
+	mfspr	r4,SPRN_IBAT5U
+	stw	r4,SL_IBAT5(r1)
+	mfspr	r4,SPRN_IBAT5L
+	stw	r4,SL_IBAT5+4(r1)
+	mfspr	r4,SPRN_IBAT6U
+	stw	r4,SL_IBAT6(r1)
+	mfspr	r4,SPRN_IBAT6L
+	stw	r4,SL_IBAT6+4(r1)
+	mfspr	r4,SPRN_IBAT7U
+	stw	r4,SL_IBAT7(r1)
+	mfspr	r4,SPRN_IBAT7L
+	stw	r4,SL_IBAT7+4(r1)
+END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+
 	/* Backup various CPU config stuffs */
 	bl	__save_cpu_setup
 
@@ -326,22 +369,37 @@ grackle_wake_up:
 	mtibatl	3,r4
 
 BEGIN_MMU_FTR_SECTION
-	li	r4,0
+	lwz	r4,SL_DBAT4(r1)
 	mtspr	SPRN_DBAT4U,r4
+	lwz	r4,SL_DBAT4+4(r1)
 	mtspr	SPRN_DBAT4L,r4
+	lwz	r4,SL_DBAT5(r1)
 	mtspr	SPRN_DBAT5U,r4
+	lwz	r4,SL_DBAT5+4(r1)
 	mtspr	SPRN_DBAT5L,r4
+	lwz	r4,SL_DBAT6(r1)
 	mtspr	SPRN_DBAT6U,r4
+	lwz	r4,SL_DBAT6+4(r1)
 	mtspr	SPRN_DBAT6L,r4
+	lwz	r4,SL_DBAT7(r1)
 	mtspr	SPRN_DBAT7U,r4
+	lwz	r4,SL_DBAT7+4(r1)
 	mtspr	SPRN_DBAT7L,r4
+	lwz	r4,SL_IBAT4(r1)
 	mtspr	SPRN_IBAT4U,r4
+	lwz	r4,SL_IBAT4+4(r1)
 	mtspr	SPRN_IBAT4L,r4
+	lwz	r4,SL_IBAT5(r1)
 	mtspr	SPRN_IBAT5U,r4
+	lwz	r4,SL_IBAT5+4(r1)
 	mtspr	SPRN_IBAT5L,r4
+	lwz	r4,SL_IBAT6(r1)
 	mtspr	SPRN_IBAT6U,r4
+	lwz	r4,SL_IBAT6+4(r1)
 	mtspr	SPRN_IBAT6L,r4
+	lwz	r4,SL_IBAT7(r1)
 	mtspr	SPRN_IBAT7U,r4
+	lwz	r4,SL_IBAT7+4(r1)
 	mtspr	SPRN_IBAT7L,r4
 END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
 
-- 
GitLab


From 1e3b61cbc30dc64e9ac244803430e225f9ff990f Mon Sep 17 00:00:00 2001
From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Date: Thu, 13 Jun 2019 09:00:14 +0530
Subject: [PATCH 1035/1835] powerpc/watchpoint: Restore NV GPRs while returning
 from exception

commit f474c28fbcbe42faca4eb415172c07d76adcb819 upstream.

powerpc hardware triggers watchpoint before executing the instruction.
To make trigger-after-execute behavior, kernel emulates the
instruction. If the instruction is 'load something into non-volatile
register', exception handler should restore emulated register state
while returning back, otherwise there will be register state
corruption. eg, adding a watchpoint on a list can corrput the list:

  # cat /proc/kallsyms | grep kthread_create_list
  c00000000121c8b8 d kthread_create_list

Add watchpoint on kthread_create_list->prev:

  # perf record -e mem:0xc00000000121c8c0

Run some workload such that new kthread gets invoked. eg, I just
logged out from console:

  list_add corruption. next->prev should be prev (c000000001214e00), \
	but was c00000000121c8b8. (next=c00000000121c8b8).
  WARNING: CPU: 59 PID: 309 at lib/list_debug.c:25 __list_add_valid+0xb4/0xc0
  CPU: 59 PID: 309 Comm: kworker/59:0 Kdump: loaded Not tainted 5.1.0-rc7+ #69
  ...
  NIP __list_add_valid+0xb4/0xc0
  LR __list_add_valid+0xb0/0xc0
  Call Trace:
  __list_add_valid+0xb0/0xc0 (unreliable)
  __kthread_create_on_node+0xe0/0x260
  kthread_create_on_node+0x34/0x50
  create_worker+0xe8/0x260
  worker_thread+0x444/0x560
  kthread+0x160/0x1a0
  ret_from_kernel_thread+0x5c/0x70

List corruption happened because it uses 'load into non-volatile
register' instruction:

Snippet from __kthread_create_on_node:

  c000000000136be8:     addis   r29,r2,-19
  c000000000136bec:     ld      r29,31424(r29)
        if (!__list_add_valid(new, prev, next))
  c000000000136bf0:     mr      r3,r30
  c000000000136bf4:     mr      r5,r28
  c000000000136bf8:     mr      r4,r29
  c000000000136bfc:     bl      c00000000059a2f8 <__list_add_valid+0x8>

Register state from WARN_ON():

  GPR00: c00000000059a3a0 c000007ff23afb50 c000000001344e00 0000000000000075
  GPR04: 0000000000000000 0000000000000000 0000001852af8bc1 0000000000000000
  GPR08: 0000000000000001 0000000000000007 0000000000000006 00000000000004aa
  GPR12: 0000000000000000 c000007ffffeb080 c000000000137038 c000005ff62aaa00
  GPR16: 0000000000000000 0000000000000000 c000007fffbe7600 c000007fffbe7370
  GPR20: c000007fffbe7320 c000007fffbe7300 c000000001373a00 0000000000000000
  GPR24: fffffffffffffef7 c00000000012e320 c000007ff23afcb0 c000000000cb8628
  GPR28: c00000000121c8b8 c000000001214e00 c000007fef5b17e8 c000007fef5b17c0

Watchpoint hit at 0xc000000000136bec.

  addis   r29,r2,-19
   => r29 = 0xc000000001344e00 + (-19 << 16)
   => r29 = 0xc000000001214e00

  ld      r29,31424(r29)
   => r29 = *(0xc000000001214e00 + 31424)
   => r29 = *(0xc00000000121c8c0)

0xc00000000121c8c0 is where we placed a watchpoint and thus this
instruction was emulated by emulate_step. But because handle_dabr_fault
did not restore emulated register state, r29 still contains stale
value in above register state.

Fixes: 5aae8a5370802 ("powerpc, hw_breakpoints: Implement hw_breakpoints for 64-bit server processors")
Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Cc: stable@vger.kernel.org # 2.6.36+
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/exceptions-64s.S | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 2d8fc8c9da7a1..06cc77813dbb7 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1745,7 +1745,7 @@ handle_page_fault:
 	addi	r3,r1,STACK_FRAME_OVERHEAD
 	bl	do_page_fault
 	cmpdi	r3,0
-	beq+	12f
+	beq+	ret_from_except_lite
 	bl	save_nvgprs
 	mr	r5,r3
 	addi	r3,r1,STACK_FRAME_OVERHEAD
@@ -1760,7 +1760,12 @@ handle_dabr_fault:
 	ld      r5,_DSISR(r1)
 	addi    r3,r1,STACK_FRAME_OVERHEAD
 	bl      do_break
-12:	b       ret_from_except_lite
+	/*
+	 * do_break() may have changed the NV GPRS while handling a breakpoint.
+	 * If so, we need to restore them with their updated values. Don't use
+	 * ret_from_except_lite here.
+	 */
+	b       ret_from_except
 
 
 #ifdef CONFIG_PPC_BOOK3S_64
-- 
GitLab


From e725502b854887ac45a4ff3ac19c3b18995c6842 Mon Sep 17 00:00:00 2001
From: Greg Kurz <groug@kaod.org>
Date: Fri, 19 Apr 2019 17:34:13 +0200
Subject: [PATCH 1036/1835] powerpc/powernv/npu: Fix reference leak

commit 02c5f5394918b9b47ff4357b1b18335768cd867d upstream.

Since 902bdc57451c, get_pci_dev() calls pci_get_domain_bus_and_slot(). This
has the effect of incrementing the reference count of the PCI device, as
explained in drivers/pci/search.c:

 * Given a PCI domain, bus, and slot/function number, the desired PCI
 * device is located in the list of PCI devices. If the device is
 * found, its reference count is increased and this function returns a
 * pointer to its data structure.  The caller must decrement the
 * reference count by calling pci_dev_put().  If no device is found,
 * %NULL is returned.

Nothing was done to call pci_dev_put() and the reference count of GPU and
NPU PCI devices rockets up.

A natural way to fix this would be to teach the callers about the change,
so that they call pci_dev_put() when done with the pointer. This turns
out to be quite intrusive, as it affects many paths in npu-dma.c,
pci-ioda.c and vfio_pci_nvlink2.c. Also, the issue appeared in 4.16 and
some affected code got moved around since then: it would be problematic
to backport the fix to stable releases.

All that code never cared for reference counting anyway. Call pci_dev_put()
from get_pci_dev() to revert to the previous behavior.

Fixes: 902bdc57451c ("powerpc/powernv/idoa: Remove unnecessary pcidev from pci_dn")
Cc: stable@vger.kernel.org # v4.16
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/powernv/npu-dma.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 8006c54a91e3f..fd8166ffbffa7 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -56,9 +56,22 @@ static struct dentry *atsd_threshold_dentry;
 static struct pci_dev *get_pci_dev(struct device_node *dn)
 {
 	struct pci_dn *pdn = PCI_DN(dn);
+	struct pci_dev *pdev;
 
-	return pci_get_domain_bus_and_slot(pci_domain_nr(pdn->phb->bus),
+	pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pdn->phb->bus),
 					   pdn->busno, pdn->devfn);
+
+	/*
+	 * pci_get_domain_bus_and_slot() increased the reference count of
+	 * the PCI device, but callers don't need that actually as the PE
+	 * already holds a reference to the device. Since callers aren't
+	 * aware of the reference count change, call pci_dev_put() now to
+	 * avoid leaks.
+	 */
+	if (pdev)
+		pci_dev_put(pdev);
+
+	return pdev;
 }
 
 /* Given a NPU device get the associated PCI device. */
-- 
GitLab


From 01982f7bcc9d6a2f8bd07c8f0a93ca83dd7827fc Mon Sep 17 00:00:00 2001
From: Nathan Lynch <nathanl@linux.ibm.com>
Date: Fri, 7 Jun 2019 00:04:07 -0500
Subject: [PATCH 1037/1835] powerpc/pseries: Fix oops in hotplug memory
 notifier

commit 0aa82c482ab2ece530a6f44897b63b274bb43c8e upstream.

During post-migration device tree updates, we can oops in
pseries_update_drconf_memory() if the source device tree has an
ibm,dynamic-memory-v2 property and the destination has a
ibm,dynamic_memory (v1) property. The notifier processes an "update"
for the ibm,dynamic-memory property but it's really an add in this
scenario. So make sure the old property object is there before
dereferencing it.

Fixes: 2b31e3aec1db ("powerpc/drmem: Add support for ibm, dynamic-memory-v2 property")
Cc: stable@vger.kernel.org # v4.16+
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/pseries/hotplug-memory.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index e4c658cda3a73..f99cd31b6fd1a 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -1012,6 +1012,9 @@ static int pseries_update_drconf_memory(struct of_reconfig_data *pr)
 	if (!memblock_size)
 		return -EINVAL;
 
+	if (!pr->old_prop)
+		return 0;
+
 	p = (__be32 *) pr->old_prop->value;
 	if (!p)
 		return -EINVAL;
-- 
GitLab


From 92e23f5fc0490a5672f78a24f83e054b354cd19c Mon Sep 17 00:00:00 2001
From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Date: Mon, 1 Jul 2019 17:01:25 +0200
Subject: [PATCH 1038/1835] mmc: sdhci-msm: fix mutex while in spinlock

commit 5e6b6651d22de109ebf48ca00d0373bc2c0cc080 upstream.

mutexes can sleep and therefore should not be taken while holding a
spinlock. move clk_get_rate (can sleep) outside the spinlock protected
region.

Fixes: 83736352e0ca ("mmc: sdhci-msm: Update DLL reset sequence")
Cc: stable@vger.kernel.org
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Vinod Koul <vkoul@kernel.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-msm.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 8594659cb5923..ad0275191d910 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -582,11 +582,14 @@ static int msm_init_cm_dll(struct sdhci_host *host)
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
 	int wait_cnt = 50;
-	unsigned long flags;
+	unsigned long flags, xo_clk = 0;
 	u32 config;
 	const struct sdhci_msm_offset *msm_offset =
 					msm_host->offset;
 
+	if (msm_host->use_14lpp_dll_reset && !IS_ERR_OR_NULL(msm_host->xo_clk))
+		xo_clk = clk_get_rate(msm_host->xo_clk);
+
 	spin_lock_irqsave(&host->lock, flags);
 
 	/*
@@ -634,10 +637,10 @@ static int msm_init_cm_dll(struct sdhci_host *host)
 		config &= CORE_FLL_CYCLE_CNT;
 		if (config)
 			mclk_freq = DIV_ROUND_CLOSEST_ULL((host->clock * 8),
-					clk_get_rate(msm_host->xo_clk));
+					xo_clk);
 		else
 			mclk_freq = DIV_ROUND_CLOSEST_ULL((host->clock * 4),
-					clk_get_rate(msm_host->xo_clk));
+					xo_clk);
 
 		config = readl_relaxed(host->ioaddr +
 				msm_offset->core_dll_config_2);
-- 
GitLab


From 30c6b34759f6522432b8b5422956070b6aa9ee81 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 4 Jul 2018 12:35:56 +0300
Subject: [PATCH 1039/1835] eCryptfs: fix a couple type promotion bugs

commit 0bdf8a8245fdea6f075a5fede833a5fcf1b3466c upstream.

ECRYPTFS_SIZE_AND_MARKER_BYTES is type size_t, so if "rc" is negative
that gets type promoted to a high positive value and treated as success.

Fixes: 778aeb42a708 ("eCryptfs: Cleanup and optimize ecryptfs_lookup_interpose()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[tyhicks: Use "if/else if" rather than "if/if"]
Cc: stable@vger.kernel.org
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ecryptfs/crypto.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 4dd842f728465..708f931c36f14 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1018,8 +1018,10 @@ int ecryptfs_read_and_validate_header_region(struct inode *inode)
 
 	rc = ecryptfs_read_lower(file_size, 0, ECRYPTFS_SIZE_AND_MARKER_BYTES,
 				 inode);
-	if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
-		return rc >= 0 ? -EINVAL : rc;
+	if (rc < 0)
+		return rc;
+	else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
+		return -EINVAL;
 	rc = ecryptfs_validate_marker(marker);
 	if (!rc)
 		ecryptfs_i_size_init(file_size, inode);
@@ -1381,8 +1383,10 @@ int ecryptfs_read_and_validate_xattr_region(struct dentry *dentry,
 				     ecryptfs_inode_to_lower(inode),
 				     ECRYPTFS_XATTR_NAME, file_size,
 				     ECRYPTFS_SIZE_AND_MARKER_BYTES);
-	if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
-		return rc >= 0 ? -EINVAL : rc;
+	if (rc < 0)
+		return rc;
+	else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
+		return -EINVAL;
 	rc = ecryptfs_validate_marker(marker);
 	if (!rc)
 		ecryptfs_i_size_init(file_size, inode);
-- 
GitLab


From 94f1db42a968a4b30a34bb9438218db4ed88e354 Mon Sep 17 00:00:00 2001
From: Xiaolei Li <xiaolei.li@mediatek.com>
Date: Tue, 7 May 2019 18:25:38 +0800
Subject: [PATCH 1040/1835] mtd: rawnand: mtk: Correct low level time
 calculation of r/w cycle

commit e1884ffddacc0424d7e785e6f8087bd12f7196db upstream.

At present, the flow of calculating AC timing of read/write cycle in SDR
mode is that:
At first, calculate high hold time which is valid for both read and write
cycle using the max value between tREH_min and tWH_min.
Secondly, calculate WE# pulse width using tWP_min.
Thridly, calculate RE# pulse width using the bigger one between tREA_max
and tRP_min.

But NAND SPEC shows that Controller should also meet write/read cycle time.
That is write cycle time should be more than tWC_min and read cycle should
be more than tRC_min. Obviously, we do not achieve that now.

This patch corrects the low level time calculation to meet minimum
read/write cycle time required. After getting the high hold time, WE# low
level time will be promised to meet tWP_min and tWC_min requirement,
and RE# low level time will be promised to meet tREA_max, tRP_min and
tRC_min requirement.

Fixes: edfee3619c49 ("mtd: nand: mtk: add ->setup_data_interface() hook")
Cc: stable@vger.kernel.org # v4.17+
Signed-off-by: Xiaolei Li <xiaolei.li@mediatek.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/mtk_nand.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
index 57b5ed1699e38..dce5b7e44e7af 100644
--- a/drivers/mtd/nand/raw/mtk_nand.c
+++ b/drivers/mtd/nand/raw/mtk_nand.c
@@ -509,7 +509,8 @@ static int mtk_nfc_setup_data_interface(struct mtd_info *mtd, int csline,
 {
 	struct mtk_nfc *nfc = nand_get_controller_data(mtd_to_nand(mtd));
 	const struct nand_sdr_timings *timings;
-	u32 rate, tpoecs, tprecs, tc2r, tw2r, twh, twst, trlt;
+	u32 rate, tpoecs, tprecs, tc2r, tw2r, twh, twst = 0, trlt = 0;
+	u32 thold;
 
 	timings = nand_get_sdr_timings(conf);
 	if (IS_ERR(timings))
@@ -545,11 +546,28 @@ static int mtk_nfc_setup_data_interface(struct mtd_info *mtd, int csline,
 	twh = DIV_ROUND_UP(twh * rate, 1000000) - 1;
 	twh &= 0xf;
 
-	twst = timings->tWP_min / 1000;
+	/* Calculate real WE#/RE# hold time in nanosecond */
+	thold = (twh + 1) * 1000000 / rate;
+	/* nanosecond to picosecond */
+	thold *= 1000;
+
+	/*
+	 * WE# low level time should be expaned to meet WE# pulse time
+	 * and WE# cycle time at the same time.
+	 */
+	if (thold < timings->tWC_min)
+		twst = timings->tWC_min - thold;
+	twst = max(timings->tWP_min, twst) / 1000;
 	twst = DIV_ROUND_UP(twst * rate, 1000000) - 1;
 	twst &= 0xf;
 
-	trlt = max(timings->tREA_max, timings->tRP_min) / 1000;
+	/*
+	 * RE# low level time should be expaned to meet RE# pulse time,
+	 * RE# access time and RE# cycle time at the same time.
+	 */
+	if (thold < timings->tRC_min)
+		trlt = timings->tRC_min - thold;
+	trlt = max3(trlt, timings->tREA_max, timings->tRP_min) / 1000;
 	trlt = DIV_ROUND_UP(trlt * rate, 1000000) - 1;
 	trlt &= 0xf;
 
-- 
GitLab


From d6328d7c1a71b1cd17a7ea5ba0f3009a50e5d357 Mon Sep 17 00:00:00 2001
From: liaoweixiong <liaoweixiong@allwinnertech.com>
Date: Fri, 28 Jun 2019 12:14:46 +0800
Subject: [PATCH 1041/1835] mtd: spinand: read returns badly if the last page
 has bitflips

commit b83408b580eccf8d2797cd6cb9ae42c2a28656a7 upstream.

In case of the last page containing bitflips (ret > 0),
spinand_mtd_read() will return that number of bitflips for the last
page while it should instead return max_bitflips like it does when the
last page read returns with 0.

Signed-off-by: Weixiong Liao <liaoweixiong@allwinnertech.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Cc: stable@vger.kernel.org
Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/spi/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 8c7bf91ce4e1d..48b3ab26b1249 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -572,12 +572,12 @@ static int spinand_mtd_read(struct mtd_info *mtd, loff_t from,
 		if (ret == -EBADMSG) {
 			ecc_failed = true;
 			mtd->ecc_stats.failed++;
-			ret = 0;
 		} else {
 			mtd->ecc_stats.corrected += ret;
 			max_bitflips = max_t(unsigned int, max_bitflips, ret);
 		}
 
+		ret = 0;
 		ops->retlen += iter.req.datalen;
 		ops->oobretlen += iter.req.ooblen;
 	}
-- 
GitLab


From 98318cd31b95096f7f2936e6ae6e010ed4abfdd5 Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date: Fri, 21 Jun 2019 19:19:29 +0300
Subject: [PATCH 1042/1835] intel_th: msu: Fix single mode with disabled IOMMU

commit 918b8646497b5dba6ae82d4a7325f01b258972b9 upstream.

Commit 4e0eaf239fb3 ("intel_th: msu: Fix single mode with IOMMU") switched
the single mode code to use dma mapping pages obtained from the page
allocator, but with IOMMU disabled, that may lead to using SWIOTLB bounce
buffers and without additional sync'ing, produces empty trace buffers.

Fix this by using a DMA32 GFP flag to the page allocation in single mode,
as the device supports full 32-bit DMA addressing.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: 4e0eaf239fb3 ("intel_th: msu: Fix single mode with IOMMU")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reported-by: Ammy Yi <ammy.yi@intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190621161930.60785-4-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/intel_th/msu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index 8ff326c0c406c..3cdf85b1ce4fe 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -632,7 +632,7 @@ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
 		goto err_out;
 
 	ret = -ENOMEM;
-	page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+	page = alloc_pages(GFP_KERNEL | __GFP_ZERO | GFP_DMA32, order);
 	if (!page)
 		goto err_free_sgt;
 
-- 
GitLab


From 152ddf9f0458331912657c381276fc0677e8fc13 Mon Sep 17 00:00:00 2001
From: Szymon Janc <szymon.janc@codecoup.pl>
Date: Wed, 19 Jun 2019 00:47:47 +0200
Subject: [PATCH 1043/1835] Bluetooth: Add SMP workaround Microsoft Surface
 Precision Mouse bug

commit 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 upstream.

Microsoft Surface Precision Mouse provides bogus identity address when
pairing. It connects with Static Random address but provides Public
Address in SMP Identity Address Information PDU. Address has same
value but type is different. Workaround this by dropping IRK if ID
address discrepancy is detected.

> HCI Event: LE Meta Event (0x3e) plen 19
      LE Connection Complete (0x01)
        Status: Success (0x00)
        Handle: 75
        Role: Master (0x00)
        Peer address type: Random (0x01)
        Peer address: E0:52:33:93:3B:21 (Static)
        Connection interval: 50.00 msec (0x0028)
        Connection latency: 0 (0x0000)
        Supervision timeout: 420 msec (0x002a)
        Master clock accuracy: 0x00

....

> ACL Data RX: Handle 75 flags 0x02 dlen 12
      SMP: Identity Address Information (0x09) len 7
        Address type: Public (0x00)
        Address: E0:52:33:93:3B:21

Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
Tested-by: Maarten Fonville <maarten.fonville@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199461
Cc: stable@vger.kernel.org
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/smp.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index a1c1b7e8a45ca..cc2f7ca91ccdd 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2580,6 +2580,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
 		goto distribute;
 	}
 
+	/* Drop IRK if peer is using identity address during pairing but is
+	 * providing different address as identity information.
+	 *
+	 * Microsoft Surface Precision Mouse is known to have this bug.
+	 */
+	if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
+	    (bacmp(&info->bdaddr, &hcon->dst) ||
+	     info->addr_type != hcon->dst_type)) {
+		bt_dev_err(hcon->hdev,
+			   "ignoring IRK with invalid identity address");
+		goto distribute;
+	}
+
 	bacpy(&smp->id_addr, &info->bdaddr);
 	smp->id_addr_type = info->addr_type;
 
-- 
GitLab


From 91da712ff592ef3bb1f09060eae0fa391769fbdf Mon Sep 17 00:00:00 2001
From: "Lee, Chiasheng" <chiasheng.lee@intel.com>
Date: Thu, 20 Jun 2019 10:56:04 +0300
Subject: [PATCH 1044/1835] usb: Handle USB3 remote wakeup for LPM enabled
 devices correctly

commit e244c4699f859cf7149b0781b1894c7996a8a1df upstream.

With Link Power Management (LPM) enabled USB3 links transition to low
power U1/U2 link states from U0 state automatically.

Current hub code detects USB3 remote wakeups by checking if the software
state still shows suspended, but the link has transitioned from suspended
U3 to enabled U0 state.

As it takes some time before the hub thread reads the port link state
after a USB3 wake notification, the link may have transitioned from U0
to U1/U2, and wake is not detected by hub code.

Fix this by handling U1/U2 states in the same way as U0 in USB3 wakeup
handling

This patch should be added to stable kernels since 4.13 where LPM was
kept enabled during suspend/resume

Cc: <stable@vger.kernel.org> # v4.13+
Signed-off-by: Lee, Chiasheng <chiasheng.lee@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hub.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index eb24ec0e160d4..f4e8e869649a5 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3575,6 +3575,7 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,
 	struct usb_device *hdev;
 	struct usb_device *udev;
 	int connect_change = 0;
+	u16 link_state;
 	int ret;
 
 	hdev = hub->hdev;
@@ -3584,9 +3585,11 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,
 			return 0;
 		usb_clear_port_feature(hdev, port, USB_PORT_FEAT_C_SUSPEND);
 	} else {
+		link_state = portstatus & USB_PORT_STAT_LINK_STATE;
 		if (!udev || udev->state != USB_STATE_SUSPENDED ||
-				 (portstatus & USB_PORT_STAT_LINK_STATE) !=
-				 USB_SS_PORT_LS_U0)
+				(link_state != USB_SS_PORT_LS_U0 &&
+				 link_state != USB_SS_PORT_LS_U1 &&
+				 link_state != USB_SS_PORT_LS_U2))
 			return 0;
 	}
 
-- 
GitLab


From 1ab644bd02ab716a981acc0460ebca15784ff127 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Mon, 8 Jul 2019 18:29:57 +0300
Subject: [PATCH 1045/1835] blk-throttle: fix zero wait time for iops throttled
 group

commit 3a10f999ffd464d01c5a05592a15470a3c4bbc36 upstream.

After commit 991f61fe7e1d ("Blk-throttle: reduce tail io latency when
iops limit is enforced") wait time could be zero even if group is
throttled and cannot issue requests right now. As a result
throtl_select_dispatch() turns into busy-loop under irq-safe queue
spinlock.

Fix is simple: always round up target time to the next throttle slice.

Fixes: 991f61fe7e1d ("Blk-throttle: reduce tail io latency when iops limit is enforced")
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-throttle.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 01d0620a4e4a5..caee658609d73 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -892,13 +892,10 @@ static bool tg_with_in_iops_limit(struct throtl_grp *tg, struct bio *bio,
 	unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;
 	u64 tmp;
 
-	jiffy_elapsed = jiffy_elapsed_rnd = jiffies - tg->slice_start[rw];
-
-	/* Slice has just started. Consider one slice interval */
-	if (!jiffy_elapsed)
-		jiffy_elapsed_rnd = tg->td->throtl_slice;
+	jiffy_elapsed = jiffies - tg->slice_start[rw];
 
-	jiffy_elapsed_rnd = roundup(jiffy_elapsed_rnd, tg->td->throtl_slice);
+	/* Round up to the next throttle slice, wait time must be nonzero */
+	jiffy_elapsed_rnd = roundup(jiffy_elapsed + 1, tg->td->throtl_slice);
 
 	/*
 	 * jiffy_elapsed_rnd should not be a big value as minimum iops can be
-- 
GitLab


From 73efdc5d7d3b27d158eb46b161606bd492e3bcec Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Thu, 13 Jun 2019 15:30:37 -0700
Subject: [PATCH 1046/1835] blk-iolatency: clear use_delay when io.latency is
 set to zero

commit 5de0073fcd50cc1f150895a7bb04d3cf8067b1d7 upstream.

If use_delay was non-zero when the latency target of a cgroup was set
to zero, it will stay stuck until io.latency is enabled on the cgroup
again.  This keeps readahead disabled for the cgroup impacting
performance negatively.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Josef Bacik <jbacik@fb.com>
Fixes: d70675121546 ("block: introduce blk-iolatency io controller")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-iolatency.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index 75df47ad2e795..f4f7c73fb8284 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -746,8 +746,10 @@ static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
 
 	if (!oldval && val)
 		return 1;
-	if (oldval && !val)
+	if (oldval && !val) {
+		blkcg_clear_delay(blkg);
 		return -1;
+	}
 	return 0;
 }
 
-- 
GitLab


From dd87cc633ba578f322c61655d90abfd8c86c74fc Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Thu, 13 Jun 2019 15:30:38 -0700
Subject: [PATCH 1047/1835] blkcg: update blkcg_print_stat() to handle larger
 outputs

commit f539da82f2158916e154d206054e0efd5df7ab61 upstream.

Depending on the number of devices, blkcg stats can go over the
default seqfile buf size.  seqfile normally retries with a larger
buffer but since the ->pd_stat() addition, blkcg_print_stat() doesn't
tell seqfile that overflow has happened and the output gets printed
truncated.  Fix it by calling seq_commit() w/ -1 on possible
overflows.

Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: 903d23f0a354 ("blk-cgroup: allow controllers to output their own stats")
Cc: stable@vger.kernel.org # v4.19+
Cc: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-cgroup.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index c630e02836a80..5275241346930 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1016,8 +1016,12 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
 		}
 next:
 		if (has_stats) {
-			off += scnprintf(buf+off, size-off, "\n");
-			seq_commit(sf, off);
+			if (off < size - 1) {
+				off += scnprintf(buf+off, size-off, "\n");
+				seq_commit(sf, off);
+			} else {
+				seq_commit(sf, -1);
+			}
 		}
 	}
 
-- 
GitLab


From 03e6a668ea1f3dd03d579a94388eb861c1c7f5d2 Mon Sep 17 00:00:00 2001
From: Josua Mayer <josua@solid-run.com>
Date: Tue, 9 Jul 2019 15:00:59 +0200
Subject: [PATCH 1048/1835] net: mvmdio: allow up to four clocks to be
 specified for orion-mdio

commit 4aabed699c400810981d3dda170f05fa4d782905 upstream.

Allow up to four clocks to be specified and enabled for the orion-mdio
interface, which are required by the Armada 8k and defined in
armada-cp110.dtsi.

Fixes a hang in probing the mvmdio driver that was encountered on the
Clearfog GT 8K with all drivers built as modules, but also affects other
boards such as the MacchiatoBIN.

Cc: stable@vger.kernel.org
Fixes: 96cb43423822 ("net: mvmdio: allow up to three clocks to be specified for orion-mdio")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/marvell/mvmdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index 903836e334d87..ee7857298361d 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -64,7 +64,7 @@
 
 struct orion_mdio_dev {
 	void __iomem *regs;
-	struct clk *clk[3];
+	struct clk *clk[4];
 	/*
 	 * If we have access to the error interrupt pin (which is
 	 * somewhat misnamed as it not only reflects internal errors
-- 
GitLab


From 404f59e265ac0334c334b28e34128024c7c389fa Mon Sep 17 00:00:00 2001
From: Josua Mayer <josua@solid-run.com>
Date: Tue, 9 Jul 2019 15:00:58 +0200
Subject: [PATCH 1049/1835] dt-bindings: allow up to four clocks for orion-mdio

commit 80785f5a22e9073e2ded5958feb7f220e066d17b upstream.

Armada 8040 needs four clocks to be enabled for MDIO accesses to work.
Update the binding to allow the extra clock to be specified.

Cc: stable@vger.kernel.org
Fixes: 6d6a331f44a1 ("dt-bindings: allow up to three clocks for orion-mdio")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/net/marvell-orion-mdio.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
index 42cd81090a2c7..3f3cfc1d8d4d8 100644
--- a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
+++ b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
@@ -16,7 +16,7 @@ Required properties:
 
 Optional properties:
 - interrupts: interrupt line number for the SMI error/done interrupt
-- clocks: phandle for up to three required clocks for the MDIO instance
+- clocks: phandle for up to four required clocks for the MDIO instance
 
 The child nodes of the MDIO driver are the individual PHY devices
 connected to this MDIO bus. They must have a "reg" property given the
-- 
GitLab


From 025eb12bb4b0a9f3b1b91eb8a67e2156ae60c9d3 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Tue, 9 Jul 2019 17:17:19 -0700
Subject: [PATCH 1050/1835] dm bufio: fix deadlock with loop device

commit bd293d071ffe65e645b4d8104f9d8fe15ea13862 upstream.

When thin-volume is built on loop device, if available memory is low,
the following deadlock can be triggered:

One process P1 allocates memory with GFP_FS flag, direct alloc fails,
memory reclaim invokes memory shrinker in dm_bufio, dm_bufio_shrink_scan()
runs, mutex dm_bufio_client->lock is acquired, then P1 waits for dm_buffer
IO to complete in __try_evict_buffer().

But this IO may never complete if issued to an underlying loop device
that forwards it using direct-IO, which allocates memory using
GFP_KERNEL (see: do_blockdev_direct_IO()).  If allocation fails, memory
reclaim will invoke memory shrinker in dm_bufio, dm_bufio_shrink_scan()
will be invoked, and since the mutex is already held by P1 the loop
thread will hang, and IO will never complete.  Resulting in ABBA
deadlock.

Cc: stable@vger.kernel.org
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-bufio.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index dc385b70e4c33..b1d0ae2dbd3dd 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1602,9 +1602,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
 	unsigned long freed;
 
 	c = container_of(shrink, struct dm_bufio_client, shrinker);
-	if (sc->gfp_mask & __GFP_FS)
-		dm_bufio_lock(c);
-	else if (!dm_bufio_trylock(c))
+	if (!dm_bufio_trylock(c))
 		return SHRINK_STOP;
 
 	freed  = __scan(c, sc->nr_to_scan, sc->gfp_mask);
-- 
GitLab


From 7250956f6eafc6edf2ad9a1cccaffb7f16c7b38d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 26 Jul 2019 09:14:31 +0200
Subject: [PATCH 1051/1835] Linux 4.19.61

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 5fb79d493012e..b16485c580d76 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 60
+SUBLEVEL = 61
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 8fb37be120469a4bd729be833d32010d4bba4e41 Mon Sep 17 00:00:00 2001
From: Brian King <brking@linux.vnet.ibm.com>
Date: Mon, 15 Jul 2019 16:41:50 -0500
Subject: [PATCH 1052/1835] bnx2x: Prevent load reordering in tx completion
 processing

[ Upstream commit ea811b795df24644a8eb760b493c43fba4450677 ]

This patch fixes an issue seen on Power systems with bnx2x which results
in the skb is NULL WARN_ON in bnx2x_free_tx_pkt firing due to the skb
pointer getting loaded in bnx2x_free_tx_pkt prior to the hw_cons
load in bnx2x_tx_int. Adding a read memory barrier resolves the issue.

Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index e3ce29951c5e3..3edb81a4f0756 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -286,6 +286,9 @@ int bnx2x_tx_int(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata)
 	hw_cons = le16_to_cpu(*txdata->tx_cons_sb);
 	sw_cons = txdata->tx_pkt_cons;
 
+	/* Ensure subsequent loads occur after hw_cons */
+	smp_rmb();
+
 	while (sw_cons != hw_cons) {
 		u16 pkt_cons;
 
-- 
GitLab


From d7cdac6dc4180d89e6289192c3334fa59acd3980 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Mon, 15 Jul 2019 14:10:17 +0900
Subject: [PATCH 1053/1835] caif-hsi: fix possible deadlock in
 cfhsi_exit_module()

[ Upstream commit fdd258d49e88a9e0b49ef04a506a796f1c768a8e ]

cfhsi_exit_module() calls unregister_netdev() under rtnl_lock().
but unregister_netdev() internally calls rtnl_lock().
So deadlock would occur.

Fixes: c41254006377 ("caif-hsi: Add rtnl support")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/caif/caif_hsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 433a14b9f731b..253a1bbe37e8b 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -1455,7 +1455,7 @@ static void __exit cfhsi_exit_module(void)
 	rtnl_lock();
 	list_for_each_safe(list_node, n, &cfhsi_list) {
 		cfhsi = list_entry(list_node, struct cfhsi, list);
-		unregister_netdev(cfhsi->ndev);
+		unregister_netdevice(cfhsi->ndev);
 	}
 	rtnl_unlock();
 }
-- 
GitLab


From 9770fe1b202f423e69e415a695c46c6a1a2a9a02 Mon Sep 17 00:00:00 2001
From: Haiyang Zhang <haiyangz@microsoft.com>
Date: Fri, 19 Jul 2019 17:33:51 +0000
Subject: [PATCH 1054/1835] hv_netvsc: Fix extra rcu_read_unlock in
 netvsc_recv_callback()

[ Upstream commit be4363bdf0ce9530f15aa0a03d1060304d116b15 ]

There is an extra rcu_read_unlock left in netvsc_recv_callback(),
after a previous patch that removes RCU from this function.
This patch removes the extra RCU unlock.

Fixes: 345ac08990b8 ("hv_netvsc: pass netvsc_device to receive callback")
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/hyperv/netvsc_drv.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index cf6b9b1771f12..cc60ef9634db2 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -847,7 +847,6 @@ int netvsc_recv_callback(struct net_device *net,
 				    csum_info, vlan, data, len);
 	if (unlikely(!skb)) {
 		++net_device_ctx->eth_stats.rx_no_memory;
-		rcu_read_unlock();
 		return NVSP_STAT_FAIL;
 	}
 
-- 
GitLab


From aee5dd00341b71fe3cec964a9661c578bf46ee52 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 27 Jun 2019 01:27:01 -0700
Subject: [PATCH 1055/1835] igmp: fix memory leak in igmpv3_del_delrec()

[ Upstream commit e5b1c6c6277d5a283290a8c033c72544746f9b5b ]

im->tomb and/or im->sources might not be NULL, but we
currently overwrite their values blindly.

Using swap() will make sure the following call to kfree_pmc(pmc)
will properly free the psf structures.

Tested with the C repro provided by syzbot, which basically does :

 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
 setsockopt(3, SOL_IP, IP_ADD_MEMBERSHIP, "\340\0\0\2\177\0\0\1\0\0\0\0", 12) = 0
 ioctl(3, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=0}) = 0
 setsockopt(3, SOL_IP, IP_MSFILTER, "\340\0\0\2\177\0\0\1\1\0\0\0\1\0\0\0\377\377\377\377", 20) = 0
 ioctl(3, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP}) = 0
 exit_group(0)                    = ?

BUG: memory leak
unreferenced object 0xffff88811450f140 (size 64):
  comm "softirq", pid 0, jiffies 4294942448 (age 32.070s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00  ................
    00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000c7bad083>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000c7bad083>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<00000000c7bad083>] slab_alloc mm/slab.c:3326 [inline]
    [<00000000c7bad083>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
    [<000000009acc4151>] kmalloc include/linux/slab.h:547 [inline]
    [<000000009acc4151>] kzalloc include/linux/slab.h:742 [inline]
    [<000000009acc4151>] ip_mc_add1_src net/ipv4/igmp.c:1976 [inline]
    [<000000009acc4151>] ip_mc_add_src+0x36b/0x400 net/ipv4/igmp.c:2100
    [<000000004ac14566>] ip_mc_msfilter+0x22d/0x310 net/ipv4/igmp.c:2484
    [<0000000052d8f995>] do_ip_setsockopt.isra.0+0x1795/0x1930 net/ipv4/ip_sockglue.c:959
    [<000000004ee1e21f>] ip_setsockopt+0x3b/0xb0 net/ipv4/ip_sockglue.c:1248
    [<0000000066cdfe74>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2618
    [<000000009383a786>] sock_common_setsockopt+0x38/0x50 net/core/sock.c:3126
    [<00000000d8ac0c94>] __sys_setsockopt+0x98/0x120 net/socket.c:2072
    [<000000001b1e9666>] __do_sys_setsockopt net/socket.c:2083 [inline]
    [<000000001b1e9666>] __se_sys_setsockopt net/socket.c:2080 [inline]
    [<000000001b1e9666>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2080
    [<00000000420d395e>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301
    [<000000007fd83a4b>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 24803f38a5c0 ("igmp: do not remove igmp souce list info when set link down")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Reported-by: syzbot+6ca1abd0db68b5173a4f@syzkaller.appspotmail.com
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/igmp.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d187ee8156a19..b2240b7f225d5 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1218,12 +1218,8 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
 	if (pmc) {
 		im->interface = pmc->interface;
 		if (im->sfmode == MCAST_INCLUDE) {
-			im->tomb = pmc->tomb;
-			pmc->tomb = NULL;
-
-			im->sources = pmc->sources;
-			pmc->sources = NULL;
-
+			swap(im->tomb, pmc->tomb);
+			swap(im->sources, pmc->sources);
 			for (psf = im->sources; psf; psf = psf->sf_next)
 				psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
 		} else {
-- 
GitLab


From 47ce442783d76f3a779b5a9c429fb7cb263c6018 Mon Sep 17 00:00:00 2001
From: Matteo Croce <mcroce@redhat.com>
Date: Mon, 1 Jul 2019 19:01:55 +0200
Subject: [PATCH 1056/1835] ipv4: don't set IPv6 only flags to IPv4 addresses

[ Upstream commit 2e60546368165c2449564d71f6005dda9205b5fb ]

Avoid the situation where an IPV6 only flag is applied to an IPv4 address:

    # ip addr add 192.0.2.1/24 dev dummy0 nodad home mngtmpaddr noprefixroute
    # ip -4 addr show dev dummy0
    2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
        inet 192.0.2.1/24 scope global noprefixroute dummy0
           valid_lft forever preferred_lft forever

Or worse, by sending a malicious netlink command:

    # ip -4 addr show dev dummy0
    2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
        inet 192.0.2.1/24 scope global nodad optimistic dadfailed home tentative mngtmpaddr noprefixroute stable-privacy dummy0
           valid_lft forever preferred_lft forever

Signed-off-by: Matteo Croce <mcroce@redhat.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/devinet.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ea4bd8a52422e..d23746143cd2b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -66,6 +66,11 @@
 #include <net/net_namespace.h>
 #include <net/addrconf.h>
 
+#define IPV6ONLY_FLAGS	\
+		(IFA_F_NODAD | IFA_F_OPTIMISTIC | IFA_F_DADFAILED | \
+		 IFA_F_HOMEADDRESS | IFA_F_TENTATIVE | \
+		 IFA_F_MANAGETEMPADDR | IFA_F_STABLE_PRIVACY)
+
 static struct ipv4_devconf ipv4_devconf = {
 	.data = {
 		[IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
@@ -462,6 +467,9 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
 	ifa->ifa_flags &= ~IFA_F_SECONDARY;
 	last_primary = &in_dev->ifa_list;
 
+	/* Don't set IPv6 only flags to IPv4 addresses */
+	ifa->ifa_flags &= ~IPV6ONLY_FLAGS;
+
 	for (ifap = &in_dev->ifa_list; (ifa1 = *ifap) != NULL;
 	     ifap = &ifa1->ifa_next) {
 		if (!(ifa1->ifa_flags & IFA_F_SECONDARY) &&
-- 
GitLab


From 0bd84505f16f43e588d91ec8e0834faa5d42e8b9 Mon Sep 17 00:00:00 2001
From: David Ahern <dsahern@gmail.com>
Date: Wed, 17 Jul 2019 15:08:43 -0700
Subject: [PATCH 1057/1835] ipv6: rt6_check should return NULL if 'from' is
 NULL

[ Upstream commit 49d05fe2c9d1b4a27761c9807fec39b8155bef9e ]

Paul reported that l2tp sessions were broken after the commit referenced
in the Fixes tag. Prior to this commit rt6_check returned NULL if the
rt6_info 'from' was NULL - ie., the dst_entry was disconnected from a FIB
entry. Restore that behavior.

Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes")
Reported-by: Paul Donohue <linux-kernel@PaulSD.com>
Tested-by: Paul Donohue <linux-kernel@PaulSD.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 24f7b2cf504b2..81220077d62f2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2214,7 +2214,7 @@ static struct dst_entry *rt6_check(struct rt6_info *rt,
 {
 	u32 rt_cookie = 0;
 
-	if ((from && !fib6_get_cookie_safe(from, &rt_cookie)) ||
+	if (!from || !fib6_get_cookie_safe(from, &rt_cookie) ||
 	    rt_cookie != cookie)
 		return NULL;
 
-- 
GitLab


From c0f4a6447977b165354940db4c0f2e14a54654dc Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@mellanox.com>
Date: Wed, 17 Jul 2019 23:39:33 +0300
Subject: [PATCH 1058/1835] ipv6: Unlink sibling route in case of failure

[ Upstream commit 54851aa90cf27041d64b12f65ac72e9f97bd90fd ]

When a route needs to be appended to an existing multipath route,
fib6_add_rt2node() first appends it to the siblings list and increments
the number of sibling routes on each sibling.

Later, the function notifies the route via call_fib6_entry_notifiers().
In case the notification is vetoed, the route is not unlinked from the
siblings list, which can result in a use-after-free.

Fix this by unlinking the route from the siblings list before returning
an error.

Audited the rest of the call sites from which the FIB notification chain
is called and could not find more problems.

Fixes: 2233000cba40 ("net/ipv6: Move call_fib6_entry_notifiers up for route adds")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_fib.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index a6c0479c1d55f..bbb5ffb3397d8 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1081,8 +1081,24 @@ add:
 		err = call_fib6_entry_notifiers(info->nl_net,
 						FIB_EVENT_ENTRY_ADD,
 						rt, extack);
-		if (err)
+		if (err) {
+			struct fib6_info *sibling, *next_sibling;
+
+			/* If the route has siblings, then it first
+			 * needs to be unlinked from them.
+			 */
+			if (!rt->fib6_nsiblings)
+				return err;
+
+			list_for_each_entry_safe(sibling, next_sibling,
+						 &rt->fib6_siblings,
+						 fib6_siblings)
+				sibling->fib6_nsiblings--;
+			rt->fib6_nsiblings = 0;
+			list_del_init(&rt->fib6_siblings);
+			rt6_multipath_rebalance(next_sibling);
 			return err;
+		}
 
 		rcu_assign_pointer(rt->fib6_next, iter);
 		atomic_inc(&rt->fib6_ref);
-- 
GitLab


From 5832ef4afd90ef5dda9960b56fa3b8092530e0fb Mon Sep 17 00:00:00 2001
From: Justin Chen <justinpopo6@gmail.com>
Date: Wed, 17 Jul 2019 14:58:53 -0700
Subject: [PATCH 1059/1835] net: bcmgenet: use promisc for unsupported filters

[ Upstream commit 35cbef9863640f06107144687bd13151bc2e8ce3 ]

Currently we silently ignore filters if we cannot meet the filter
requirements. This will lead to the MAC dropping packets that are
expected to pass. A better solution would be to set the NIC to promisc
mode when the required filters cannot be met.

Also correct the number of MDF filters supported. It should be 17,
not 16.

Signed-off-by: Justin Chen <justinpopo6@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/broadcom/genet/bcmgenet.c    | 57 +++++++++----------
 1 file changed, 26 insertions(+), 31 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 2d6f090bf6440..fd587bed32ebd 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3086,39 +3086,42 @@ static void bcmgenet_timeout(struct net_device *dev)
 	netif_tx_wake_all_queues(dev);
 }
 
-#define MAX_MC_COUNT	16
+#define MAX_MDF_FILTER	17
 
 static inline void bcmgenet_set_mdf_addr(struct bcmgenet_priv *priv,
 					 unsigned char *addr,
-					 int *i,
-					 int *mc)
+					 int *i)
 {
-	u32 reg;
-
 	bcmgenet_umac_writel(priv, addr[0] << 8 | addr[1],
 			     UMAC_MDF_ADDR + (*i * 4));
 	bcmgenet_umac_writel(priv, addr[2] << 24 | addr[3] << 16 |
 			     addr[4] << 8 | addr[5],
 			     UMAC_MDF_ADDR + ((*i + 1) * 4));
-	reg = bcmgenet_umac_readl(priv, UMAC_MDF_CTRL);
-	reg |= (1 << (MAX_MC_COUNT - *mc));
-	bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL);
 	*i += 2;
-	(*mc)++;
 }
 
 static void bcmgenet_set_rx_mode(struct net_device *dev)
 {
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 	struct netdev_hw_addr *ha;
-	int i, mc;
+	int i, nfilter;
 	u32 reg;
 
 	netif_dbg(priv, hw, dev, "%s: %08X\n", __func__, dev->flags);
 
-	/* Promiscuous mode */
+	/* Number of filters needed */
+	nfilter = netdev_uc_count(dev) + netdev_mc_count(dev) + 2;
+
+	/*
+	 * Turn on promicuous mode for three scenarios
+	 * 1. IFF_PROMISC flag is set
+	 * 2. IFF_ALLMULTI flag is set
+	 * 3. The number of filters needed exceeds the number filters
+	 *    supported by the hardware.
+	*/
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
-	if (dev->flags & IFF_PROMISC) {
+	if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||
+	    (nfilter > MAX_MDF_FILTER)) {
 		reg |= CMD_PROMISC;
 		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
 		bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);
@@ -3128,32 +3131,24 @@ static void bcmgenet_set_rx_mode(struct net_device *dev)
 		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
 	}
 
-	/* UniMac doesn't support ALLMULTI */
-	if (dev->flags & IFF_ALLMULTI) {
-		netdev_warn(dev, "ALLMULTI is not supported\n");
-		return;
-	}
-
 	/* update MDF filter */
 	i = 0;
-	mc = 0;
 	/* Broadcast */
-	bcmgenet_set_mdf_addr(priv, dev->broadcast, &i, &mc);
+	bcmgenet_set_mdf_addr(priv, dev->broadcast, &i);
 	/* my own address.*/
-	bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i, &mc);
-	/* Unicast list*/
-	if (netdev_uc_count(dev) > (MAX_MC_COUNT - mc))
-		return;
+	bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i);
 
-	if (!netdev_uc_empty(dev))
-		netdev_for_each_uc_addr(ha, dev)
-			bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc);
-	/* Multicast */
-	if (netdev_mc_empty(dev) || netdev_mc_count(dev) >= (MAX_MC_COUNT - mc))
-		return;
+	/* Unicast */
+	netdev_for_each_uc_addr(ha, dev)
+		bcmgenet_set_mdf_addr(priv, ha->addr, &i);
 
+	/* Multicast */
 	netdev_for_each_mc_addr(ha, dev)
-		bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc);
+		bcmgenet_set_mdf_addr(priv, ha->addr, &i);
+
+	/* Enable filters */
+	reg = GENMASK(MAX_MDF_FILTER - 1, MAX_MDF_FILTER - nfilter);
+	bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL);
 }
 
 /* Set the hardware MAC address. */
-- 
GitLab


From 6ab30a4cc5c621248b397a5fa60f6be456940969 Mon Sep 17 00:00:00 2001
From: Baruch Siach <baruch@tkos.co.il>
Date: Thu, 27 Jun 2019 21:17:39 +0300
Subject: [PATCH 1060/1835] net: dsa: mv88e6xxx: wait after reset deactivation

[ Upstream commit 7b75e49de424ceb53d13e60f35d0a73765626fda ]

Add a 1ms delay after reset deactivation. Otherwise the chip returns
bogus ID value. This is observed with 88E6390 (Peridot) chip.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 411cfb806459a..703e6bdaf0e1f 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -4816,6 +4816,8 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
 		err = PTR_ERR(chip->reset);
 		goto out;
 	}
+	if (chip->reset)
+		usleep_range(1000, 2000);
 
 	err = mv88e6xxx_detect(chip);
 	if (err)
-- 
GitLab


From 832d0ea751a8c511d719c3ede60db05981ebc7d4 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 26 Jun 2019 20:40:45 +0200
Subject: [PATCH 1061/1835] net: make skb_dst_force return true when dst is
 refcounted

[ Upstream commit b60a77386b1d4868f72f6353d35dabe5fbe981f2 ]

netfilter did not expect that skb_dst_force() can cause skb to lose its
dst entry.

I got a bug report with a skb->dst NULL dereference in netfilter
output path.  The backtrace contains nf_reinject(), so the dst might have
been cleared when skb got queued to userspace.

Other users were fixed via
if (skb_dst(skb)) {
	skb_dst_force(skb);
	if (!skb_dst(skb))
		goto handle_err;
}

But I think its preferable to make the 'dst might be cleared' part
of the function explicit.

In netfilter case, skb with a null dst is expected when queueing in
prerouting hook, so drop skb for the other hooks.

v2:
 v1 of this patch returned true in case skb had no dst entry.
 Eric said:
   Say if we have two skb_dst_force() calls for some reason
   on the same skb, only the first one will return false.

 This now returns false even when skb had no dst, as per Erics
 suggestion, so callers might need to check skb_dst() first before
 skb_dst_force().

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/dst.h        | 5 ++++-
 net/netfilter/nf_queue.c | 6 +++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/net/dst.h b/include/net/dst.h
index 6cf0870414c78..ffc8ee0ea5e5b 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -313,8 +313,9 @@ static inline bool dst_hold_safe(struct dst_entry *dst)
  * @skb: buffer
  *
  * If dst is not yet refcounted and not destroyed, grab a ref on it.
+ * Returns true if dst is refcounted.
  */
-static inline void skb_dst_force(struct sk_buff *skb)
+static inline bool skb_dst_force(struct sk_buff *skb)
 {
 	if (skb_dst_is_noref(skb)) {
 		struct dst_entry *dst = skb_dst(skb);
@@ -325,6 +326,8 @@ static inline void skb_dst_force(struct sk_buff *skb)
 
 		skb->_skb_refdst = (unsigned long)dst;
 	}
+
+	return skb->_skb_refdst != 0UL;
 }
 
 
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 7569ba00e7328..a96a8c16baf99 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -174,6 +174,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
 		goto err;
 	}
 
+	if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
+		status = -ENETDOWN;
+		goto err;
+	}
+
 	*entry = (struct nf_queue_entry) {
 		.skb	= skb,
 		.state	= *state,
@@ -182,7 +187,6 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
 	};
 
 	nf_queue_entry_get_refs(entry);
-	skb_dst_force(skb);
 
 	switch (entry->state.pf) {
 	case AF_INET:
-- 
GitLab


From 257441a072010d880a79048cd3158cde32ff8258 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Date: Sun, 14 Jul 2019 23:36:11 +0200
Subject: [PATCH 1062/1835] net: neigh: fix multiple neigh timer scheduling

[ Upstream commit 071c37983d99da07797294ea78e9da1a6e287144 ]

Neigh timer can be scheduled multiple times from userspace adding
multiple neigh entries and forcing the neigh timer scheduling passing
NTF_USE in the netlink requests.
This will result in a refcount leak and in the following dump stack:

[   32.465295] NEIGH: BUG, double timer add, state is 8
[   32.465308] CPU: 0 PID: 416 Comm: double_timer_ad Not tainted 5.2.0+ #65
[   32.465311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014
[   32.465313] Call Trace:
[   32.465318]  dump_stack+0x7c/0xc0
[   32.465323]  __neigh_event_send+0x20c/0x880
[   32.465326]  ? ___neigh_create+0x846/0xfb0
[   32.465329]  ? neigh_lookup+0x2a9/0x410
[   32.465332]  ? neightbl_fill_info.constprop.0+0x800/0x800
[   32.465334]  neigh_add+0x4f8/0x5e0
[   32.465337]  ? neigh_xmit+0x620/0x620
[   32.465341]  ? find_held_lock+0x85/0xa0
[   32.465345]  rtnetlink_rcv_msg+0x204/0x570
[   32.465348]  ? rtnl_dellink+0x450/0x450
[   32.465351]  ? mark_held_locks+0x90/0x90
[   32.465354]  ? match_held_lock+0x1b/0x230
[   32.465357]  netlink_rcv_skb+0xc4/0x1d0
[   32.465360]  ? rtnl_dellink+0x450/0x450
[   32.465363]  ? netlink_ack+0x420/0x420
[   32.465366]  ? netlink_deliver_tap+0x115/0x560
[   32.465369]  ? __alloc_skb+0xc9/0x2f0
[   32.465372]  netlink_unicast+0x270/0x330
[   32.465375]  ? netlink_attachskb+0x2f0/0x2f0
[   32.465378]  netlink_sendmsg+0x34f/0x5a0
[   32.465381]  ? netlink_unicast+0x330/0x330
[   32.465385]  ? move_addr_to_kernel.part.0+0x20/0x20
[   32.465388]  ? netlink_unicast+0x330/0x330
[   32.465391]  sock_sendmsg+0x91/0xa0
[   32.465394]  ___sys_sendmsg+0x407/0x480
[   32.465397]  ? copy_msghdr_from_user+0x200/0x200
[   32.465401]  ? _raw_spin_unlock_irqrestore+0x37/0x40
[   32.465404]  ? lockdep_hardirqs_on+0x17d/0x250
[   32.465407]  ? __wake_up_common_lock+0xcb/0x110
[   32.465410]  ? __wake_up_common+0x230/0x230
[   32.465413]  ? netlink_bind+0x3e1/0x490
[   32.465416]  ? netlink_setsockopt+0x540/0x540
[   32.465420]  ? __fget_light+0x9c/0xf0
[   32.465423]  ? sockfd_lookup_light+0x8c/0xb0
[   32.465426]  __sys_sendmsg+0xa5/0x110
[   32.465429]  ? __ia32_sys_shutdown+0x30/0x30
[   32.465432]  ? __fd_install+0xe1/0x2c0
[   32.465435]  ? lockdep_hardirqs_off+0xb5/0x100
[   32.465438]  ? mark_held_locks+0x24/0x90
[   32.465441]  ? do_syscall_64+0xf/0x270
[   32.465444]  do_syscall_64+0x63/0x270
[   32.465448]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fix the issue unscheduling neigh_timer if selected entry is in 'IN_TIMER'
receiving a netlink request with NTF_USE flag set

Reported-by: Marek Majkowski <marek@cloudflare.com>
Fixes: 0c5c2d308906 ("neigh: Allow for user space users of the neighbour table")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/neighbour.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index cd9e991f21d73..c52d6e6b341cf 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1021,6 +1021,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 
 			atomic_set(&neigh->probes,
 				   NEIGH_VAR(neigh->parms, UCAST_PROBES));
+			neigh_del_timer(neigh);
 			neigh->nud_state     = NUD_INCOMPLETE;
 			neigh->updated = now;
 			next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
@@ -1037,6 +1038,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 		}
 	} else if (neigh->nud_state & NUD_STALE) {
 		neigh_dbg(2, "neigh %p is delayed\n", neigh);
+		neigh_del_timer(neigh);
 		neigh->nud_state = NUD_DELAY;
 		neigh->updated = jiffies;
 		neigh_add_timer(neigh, jiffies +
-- 
GitLab


From c60bce64615db987ab3f5cedff88cc7f4aa5ff53 Mon Sep 17 00:00:00 2001
From: John Hurley <john.hurley@netronome.com>
Date: Thu, 27 Jun 2019 14:37:30 +0100
Subject: [PATCH 1063/1835] net: openvswitch: fix csum updates for MPLS actions

[ Upstream commit 0e3183cd2a64843a95b62f8bd4a83605a4cf0615 ]

Skbs may have their checksum value populated by HW. If this is a checksum
calculated over the entire packet then the CHECKSUM_COMPLETE field is
marked. Changes to the data pointer on the skb throughout the network
stack still try to maintain this complete csum value if it is required
through functions such as skb_postpush_rcsum.

The MPLS actions in Open vSwitch modify a CHECKSUM_COMPLETE value when
changes are made to packet data without a push or a pull. This occurs when
the ethertype of the MAC header is changed or when MPLS lse fields are
modified.

The modification is carried out using the csum_partial function to get the
csum of a buffer and add it into the larger checksum. The buffer is an
inversion of the data to be removed followed by the new data. Because the
csum is calculated over 16 bits and these values align with 16 bits, the
effect is the removal of the old value from the CHECKSUM_COMPLETE and
addition of the new value.

However, the csum fed into the function and the outcome of the
calculation are also inverted. This would only make sense if it was the
new value rather than the old that was inverted in the input buffer.

Fix the issue by removing the bit inverts in the csum_partial calculation.

The bug was verified and the fix tested by comparing the folded value of
the updated CHECKSUM_COMPLETE value with the folded value of a full
software checksum calculation (reset skb->csum to 0 and run
skb_checksum_complete(skb)). Prior to the fix the outcomes differed but
after they produce the same result.

Fixes: 25cd9ba0abc0 ("openvswitch: Add basic MPLS support to kernel")
Fixes: bc7cc5999fd3 ("openvswitch: update checksum in {push,pop}_mpls")
Signed-off-by: John Hurley <john.hurley@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/actions.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 85ae53d8fd098..8211e8e97c964 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -175,8 +175,7 @@ static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
 	if (skb->ip_summed == CHECKSUM_COMPLETE) {
 		__be16 diff[] = { ~(hdr->h_proto), ethertype };
 
-		skb->csum = ~csum_partial((char *)diff, sizeof(diff),
-					~skb->csum);
+		skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum);
 	}
 
 	hdr->h_proto = ethertype;
@@ -268,8 +267,7 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
 	if (skb->ip_summed == CHECKSUM_COMPLETE) {
 		__be32 diff[] = { ~(stack->label_stack_entry), lse };
 
-		skb->csum = ~csum_partial((char *)diff, sizeof(diff),
-					  ~skb->csum);
+		skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum);
 	}
 
 	stack->label_stack_entry = lse;
-- 
GitLab


From 201d7d62a82a01f6085adc08e9fa2c093f717d25 Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 21 Jul 2019 18:50:08 +0200
Subject: [PATCH 1064/1835] net: phy: sfp: hwmon: Fix scaling of RX power

[ Upstream commit 0cea0e1148fe134a4a3aaf0b1496f09241fb943a ]

The RX power read from the SFP uses units of 0.1uW. This must be
scaled to units of uW for HWMON. This requires a divide by 10, not the
current 100.

With this change in place, sensors(1) and ethtool -m agree:

sff2-isa-0000
Adapter: ISA adapter
in0:          +3.23 V
temp1:        +33.1 C
power1:      270.00 uW
power2:      200.00 uW
curr1:        +0.01 A

        Laser output power                        : 0.2743 mW / -5.62 dBm
        Receiver signal average optical power     : 0.2014 mW / -6.96 dBm

Reported-by: chris.healy@zii.aero
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Fixes: 1323061a018a ("net: phy: sfp: Add HWMON support for module sensors")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/sfp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 418522aa2f71f..998d08ae7431a 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -514,7 +514,7 @@ static int sfp_hwmon_read_sensor(struct sfp *sfp, int reg, long *value)
 
 static void sfp_hwmon_to_rx_power(long *value)
 {
-	*value = DIV_ROUND_CLOSEST(*value, 100);
+	*value = DIV_ROUND_CLOSEST(*value, 10);
 }
 
 static void sfp_hwmon_calibrate(struct sfp *sfp, unsigned int slope, int offset,
-- 
GitLab


From f47f68cc9d33572c3bee66eb86aa9db5dc612ddd Mon Sep 17 00:00:00 2001
From: Jose Abreu <Jose.Abreu@synopsys.com>
Date: Mon, 8 Jul 2019 14:26:28 +0200
Subject: [PATCH 1065/1835] net: stmmac: Re-work the queue selection for TSO
 packets

[ Upstream commit 4993e5b37e8bcb55ac90f76eb6d2432647273747 ]

Ben Hutchings says:
	"This is the wrong place to change the queue mapping.
	stmmac_xmit() is called with a specific TX queue locked,
	and accessing a different TX queue results in a data race
	for all of that queue's state.

	I think this commit should be reverted upstream and in all
	stable branches.  Instead, the driver should implement the
	ndo_select_queue operation and override the queue mapping there."

Fixes: c5acdbee22a1 ("net: stmmac: Send TSO packets always from Queue 0")
Suggested-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/stmicro/stmmac/stmmac_main.c | 29 ++++++++++++-------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 5c18874614ba1..0101ebaecf028 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3036,17 +3036,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	/* Manage oversized TCP frames for GMAC4 device */
 	if (skb_is_gso(skb) && priv->tso) {
-		if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
-			/*
-			 * There is no way to determine the number of TSO
-			 * capable Queues. Let's use always the Queue 0
-			 * because if TSO is supported then at least this
-			 * one will be capable.
-			 */
-			skb_set_queue_mapping(skb, 0);
-
+		if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
 			return stmmac_tso_xmit(skb, dev);
-		}
 	}
 
 	if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
@@ -3855,6 +3846,23 @@ static int stmmac_setup_tc(struct net_device *ndev, enum tc_setup_type type,
 	}
 }
 
+static u16 stmmac_select_queue(struct net_device *dev, struct sk_buff *skb,
+			       struct net_device *sb_dev,
+			       select_queue_fallback_t fallback)
+{
+	if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+		/*
+		 * There is no way to determine the number of TSO
+		 * capable Queues. Let's use always the Queue 0
+		 * because if TSO is supported then at least this
+		 * one will be capable.
+		 */
+		return 0;
+	}
+
+	return fallback(dev, skb, NULL) % dev->real_num_tx_queues;
+}
+
 static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
 {
 	struct stmmac_priv *priv = netdev_priv(ndev);
@@ -4097,6 +4105,7 @@ static const struct net_device_ops stmmac_netdev_ops = {
 	.ndo_tx_timeout = stmmac_tx_timeout,
 	.ndo_do_ioctl = stmmac_ioctl,
 	.ndo_setup_tc = stmmac_setup_tc,
+	.ndo_select_queue = stmmac_select_queue,
 #ifdef CONFIG_NET_POLL_CONTROLLER
 	.ndo_poll_controller = stmmac_poll_controller,
 #endif
-- 
GitLab


From 97739e5c9e73b5cde1622c79b60fda12298779cd Mon Sep 17 00:00:00 2001
From: Yang Wei <albin_yang@163.com>
Date: Mon, 8 Jul 2019 22:57:39 +0800
Subject: [PATCH 1066/1835] nfc: fix potential illegal memory access

[ Upstream commit dd006fc434e107ef90f7de0db9907cbc1c521645 ]

The frags_q is not properly initialized, it may result in illegal memory
access when conn_info is NULL.
The "goto free_exit" should be replaced by "goto exit".

Signed-off-by: Yang Wei <albin_yang@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/nci/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
index 908f25e3773e5..5405d073804c6 100644
--- a/net/nfc/nci/data.c
+++ b/net/nfc/nci/data.c
@@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
 	conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id);
 	if (!conn_info) {
 		rc = -EPROTO;
-		goto free_exit;
+		goto exit;
 	}
 
 	__skb_queue_head_init(&frags_q);
-- 
GitLab


From 3e4e6b71ece09266e58242029813eb772dc7f535 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sat, 13 Jul 2019 13:45:47 +0200
Subject: [PATCH 1067/1835] r8169: fix issue with confused RX unit after PHY
 power-down on RTL8411b

[ Upstream commit fe4e8db0392a6c2e795eb89ef5fcd86522e66248 ]

On RTL8411b the RX unit gets confused if the PHY is powered-down.
This was reported in [0] and confirmed by Realtek. Realtek provided
a sequence to fix the RX unit after PHY wakeup.

The issue itself seems to have been there longer, the Fixes tag
refers to where the fix applies properly.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=1692075

Fixes: a99790bf5c7f ("r8169: Reinstate ASPM Support")
Tested-by: Ionut Radu <ionut.radu@gmail.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/realtek/r8169.c | 137 +++++++++++++++++++++++++++
 1 file changed, 137 insertions(+)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7a50b911b1804..a6992c4c7313b 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5202,6 +5202,143 @@ static void rtl_hw_start_8411_2(struct rtl8169_private *tp)
 	/* disable aspm and clock request before access ephy */
 	rtl_hw_aspm_clkreq_enable(tp, false);
 	rtl_ephy_init(tp, e_info_8411_2, ARRAY_SIZE(e_info_8411_2));
+
+	/* The following Realtek-provided magic fixes an issue with the RX unit
+	 * getting confused after the PHY having been powered-down.
+	 */
+	r8168_mac_ocp_write(tp, 0xFC28, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC2A, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC2C, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC2E, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC30, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC32, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC34, 0x0000);
+	r8168_mac_ocp_write(tp, 0xFC36, 0x0000);
+	mdelay(3);
+	r8168_mac_ocp_write(tp, 0xFC26, 0x0000);
+
+	r8168_mac_ocp_write(tp, 0xF800, 0xE008);
+	r8168_mac_ocp_write(tp, 0xF802, 0xE00A);
+	r8168_mac_ocp_write(tp, 0xF804, 0xE00C);
+	r8168_mac_ocp_write(tp, 0xF806, 0xE00E);
+	r8168_mac_ocp_write(tp, 0xF808, 0xE027);
+	r8168_mac_ocp_write(tp, 0xF80A, 0xE04F);
+	r8168_mac_ocp_write(tp, 0xF80C, 0xE05E);
+	r8168_mac_ocp_write(tp, 0xF80E, 0xE065);
+	r8168_mac_ocp_write(tp, 0xF810, 0xC602);
+	r8168_mac_ocp_write(tp, 0xF812, 0xBE00);
+	r8168_mac_ocp_write(tp, 0xF814, 0x0000);
+	r8168_mac_ocp_write(tp, 0xF816, 0xC502);
+	r8168_mac_ocp_write(tp, 0xF818, 0xBD00);
+	r8168_mac_ocp_write(tp, 0xF81A, 0x074C);
+	r8168_mac_ocp_write(tp, 0xF81C, 0xC302);
+	r8168_mac_ocp_write(tp, 0xF81E, 0xBB00);
+	r8168_mac_ocp_write(tp, 0xF820, 0x080A);
+	r8168_mac_ocp_write(tp, 0xF822, 0x6420);
+	r8168_mac_ocp_write(tp, 0xF824, 0x48C2);
+	r8168_mac_ocp_write(tp, 0xF826, 0x8C20);
+	r8168_mac_ocp_write(tp, 0xF828, 0xC516);
+	r8168_mac_ocp_write(tp, 0xF82A, 0x64A4);
+	r8168_mac_ocp_write(tp, 0xF82C, 0x49C0);
+	r8168_mac_ocp_write(tp, 0xF82E, 0xF009);
+	r8168_mac_ocp_write(tp, 0xF830, 0x74A2);
+	r8168_mac_ocp_write(tp, 0xF832, 0x8CA5);
+	r8168_mac_ocp_write(tp, 0xF834, 0x74A0);
+	r8168_mac_ocp_write(tp, 0xF836, 0xC50E);
+	r8168_mac_ocp_write(tp, 0xF838, 0x9CA2);
+	r8168_mac_ocp_write(tp, 0xF83A, 0x1C11);
+	r8168_mac_ocp_write(tp, 0xF83C, 0x9CA0);
+	r8168_mac_ocp_write(tp, 0xF83E, 0xE006);
+	r8168_mac_ocp_write(tp, 0xF840, 0x74F8);
+	r8168_mac_ocp_write(tp, 0xF842, 0x48C4);
+	r8168_mac_ocp_write(tp, 0xF844, 0x8CF8);
+	r8168_mac_ocp_write(tp, 0xF846, 0xC404);
+	r8168_mac_ocp_write(tp, 0xF848, 0xBC00);
+	r8168_mac_ocp_write(tp, 0xF84A, 0xC403);
+	r8168_mac_ocp_write(tp, 0xF84C, 0xBC00);
+	r8168_mac_ocp_write(tp, 0xF84E, 0x0BF2);
+	r8168_mac_ocp_write(tp, 0xF850, 0x0C0A);
+	r8168_mac_ocp_write(tp, 0xF852, 0xE434);
+	r8168_mac_ocp_write(tp, 0xF854, 0xD3C0);
+	r8168_mac_ocp_write(tp, 0xF856, 0x49D9);
+	r8168_mac_ocp_write(tp, 0xF858, 0xF01F);
+	r8168_mac_ocp_write(tp, 0xF85A, 0xC526);
+	r8168_mac_ocp_write(tp, 0xF85C, 0x64A5);
+	r8168_mac_ocp_write(tp, 0xF85E, 0x1400);
+	r8168_mac_ocp_write(tp, 0xF860, 0xF007);
+	r8168_mac_ocp_write(tp, 0xF862, 0x0C01);
+	r8168_mac_ocp_write(tp, 0xF864, 0x8CA5);
+	r8168_mac_ocp_write(tp, 0xF866, 0x1C15);
+	r8168_mac_ocp_write(tp, 0xF868, 0xC51B);
+	r8168_mac_ocp_write(tp, 0xF86A, 0x9CA0);
+	r8168_mac_ocp_write(tp, 0xF86C, 0xE013);
+	r8168_mac_ocp_write(tp, 0xF86E, 0xC519);
+	r8168_mac_ocp_write(tp, 0xF870, 0x74A0);
+	r8168_mac_ocp_write(tp, 0xF872, 0x48C4);
+	r8168_mac_ocp_write(tp, 0xF874, 0x8CA0);
+	r8168_mac_ocp_write(tp, 0xF876, 0xC516);
+	r8168_mac_ocp_write(tp, 0xF878, 0x74A4);
+	r8168_mac_ocp_write(tp, 0xF87A, 0x48C8);
+	r8168_mac_ocp_write(tp, 0xF87C, 0x48CA);
+	r8168_mac_ocp_write(tp, 0xF87E, 0x9CA4);
+	r8168_mac_ocp_write(tp, 0xF880, 0xC512);
+	r8168_mac_ocp_write(tp, 0xF882, 0x1B00);
+	r8168_mac_ocp_write(tp, 0xF884, 0x9BA0);
+	r8168_mac_ocp_write(tp, 0xF886, 0x1B1C);
+	r8168_mac_ocp_write(tp, 0xF888, 0x483F);
+	r8168_mac_ocp_write(tp, 0xF88A, 0x9BA2);
+	r8168_mac_ocp_write(tp, 0xF88C, 0x1B04);
+	r8168_mac_ocp_write(tp, 0xF88E, 0xC508);
+	r8168_mac_ocp_write(tp, 0xF890, 0x9BA0);
+	r8168_mac_ocp_write(tp, 0xF892, 0xC505);
+	r8168_mac_ocp_write(tp, 0xF894, 0xBD00);
+	r8168_mac_ocp_write(tp, 0xF896, 0xC502);
+	r8168_mac_ocp_write(tp, 0xF898, 0xBD00);
+	r8168_mac_ocp_write(tp, 0xF89A, 0x0300);
+	r8168_mac_ocp_write(tp, 0xF89C, 0x051E);
+	r8168_mac_ocp_write(tp, 0xF89E, 0xE434);
+	r8168_mac_ocp_write(tp, 0xF8A0, 0xE018);
+	r8168_mac_ocp_write(tp, 0xF8A2, 0xE092);
+	r8168_mac_ocp_write(tp, 0xF8A4, 0xDE20);
+	r8168_mac_ocp_write(tp, 0xF8A6, 0xD3C0);
+	r8168_mac_ocp_write(tp, 0xF8A8, 0xC50F);
+	r8168_mac_ocp_write(tp, 0xF8AA, 0x76A4);
+	r8168_mac_ocp_write(tp, 0xF8AC, 0x49E3);
+	r8168_mac_ocp_write(tp, 0xF8AE, 0xF007);
+	r8168_mac_ocp_write(tp, 0xF8B0, 0x49C0);
+	r8168_mac_ocp_write(tp, 0xF8B2, 0xF103);
+	r8168_mac_ocp_write(tp, 0xF8B4, 0xC607);
+	r8168_mac_ocp_write(tp, 0xF8B6, 0xBE00);
+	r8168_mac_ocp_write(tp, 0xF8B8, 0xC606);
+	r8168_mac_ocp_write(tp, 0xF8BA, 0xBE00);
+	r8168_mac_ocp_write(tp, 0xF8BC, 0xC602);
+	r8168_mac_ocp_write(tp, 0xF8BE, 0xBE00);
+	r8168_mac_ocp_write(tp, 0xF8C0, 0x0C4C);
+	r8168_mac_ocp_write(tp, 0xF8C2, 0x0C28);
+	r8168_mac_ocp_write(tp, 0xF8C4, 0x0C2C);
+	r8168_mac_ocp_write(tp, 0xF8C6, 0xDC00);
+	r8168_mac_ocp_write(tp, 0xF8C8, 0xC707);
+	r8168_mac_ocp_write(tp, 0xF8CA, 0x1D00);
+	r8168_mac_ocp_write(tp, 0xF8CC, 0x8DE2);
+	r8168_mac_ocp_write(tp, 0xF8CE, 0x48C1);
+	r8168_mac_ocp_write(tp, 0xF8D0, 0xC502);
+	r8168_mac_ocp_write(tp, 0xF8D2, 0xBD00);
+	r8168_mac_ocp_write(tp, 0xF8D4, 0x00AA);
+	r8168_mac_ocp_write(tp, 0xF8D6, 0xE0C0);
+	r8168_mac_ocp_write(tp, 0xF8D8, 0xC502);
+	r8168_mac_ocp_write(tp, 0xF8DA, 0xBD00);
+	r8168_mac_ocp_write(tp, 0xF8DC, 0x0132);
+
+	r8168_mac_ocp_write(tp, 0xFC26, 0x8000);
+
+	r8168_mac_ocp_write(tp, 0xFC2A, 0x0743);
+	r8168_mac_ocp_write(tp, 0xFC2C, 0x0801);
+	r8168_mac_ocp_write(tp, 0xFC2E, 0x0BE9);
+	r8168_mac_ocp_write(tp, 0xFC30, 0x02FD);
+	r8168_mac_ocp_write(tp, 0xFC32, 0x0C25);
+	r8168_mac_ocp_write(tp, 0xFC34, 0x00A9);
+	r8168_mac_ocp_write(tp, 0xFC36, 0x012D);
+
 	rtl_hw_aspm_clkreq_enable(tp, true);
 }
 
-- 
GitLab


From bfa7913575b7b3ccbdeddb81dc0da13dc5fb22de Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 2 Jul 2019 15:59:12 +0100
Subject: [PATCH 1068/1835] rxrpc: Fix send on a connected, but unbound socket

[ Upstream commit e835ada07091f40dcfb1bc735082bd0a7c005e59 ]

If sendmsg() or sendmmsg() is called on a connected socket that hasn't had
bind() called on it, then an oops will occur when the kernel tries to
connect the call because no local endpoint has been allocated.

Fix this by implicitly binding the socket if it is in the
RXRPC_CLIENT_UNBOUND state, just like it does for the RXRPC_UNBOUND state.

Further, the state should be transitioned to RXRPC_CLIENT_BOUND after this
to prevent further attempts to bind it.

This can be tested with:

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/socket.h>
	#include <arpa/inet.h>
	#include <linux/rxrpc.h>
	static const unsigned char inet6_addr[16] = {
		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1, -1, 0xac, 0x14, 0x14, 0xaa
	};
	int main(void)
	{
		struct sockaddr_rxrpc srx;
		struct cmsghdr *cm;
		struct msghdr msg;
		unsigned char control[16];
		int fd;
		memset(&srx, 0, sizeof(srx));
		srx.srx_family = 0x21;
		srx.srx_service = 0;
		srx.transport_type = AF_INET;
		srx.transport_len = 0x1c;
		srx.transport.sin6.sin6_family = AF_INET6;
		srx.transport.sin6.sin6_port = htons(0x4e22);
		srx.transport.sin6.sin6_flowinfo = htons(0x4e22);
		srx.transport.sin6.sin6_scope_id = htons(0xaa3b);
		memcpy(&srx.transport.sin6.sin6_addr, inet6_addr, 16);
		cm = (struct cmsghdr *)control;
		cm->cmsg_len	= CMSG_LEN(sizeof(unsigned long));
		cm->cmsg_level	= SOL_RXRPC;
		cm->cmsg_type	= RXRPC_USER_CALL_ID;
		*(unsigned long *)CMSG_DATA(cm) = 0;
		msg.msg_name = NULL;
		msg.msg_namelen = 0;
		msg.msg_iov = NULL;
		msg.msg_iovlen = 0;
		msg.msg_control = control;
		msg.msg_controllen = cm->cmsg_len;
		msg.msg_flags = 0;
		fd = socket(AF_RXRPC, SOCK_DGRAM, AF_INET);
		connect(fd, (struct sockaddr *)&srx, sizeof(srx));
		sendmsg(fd, &msg, 0);
		return 0;
	}

Leading to the following oops:

	BUG: kernel NULL pointer dereference, address: 0000000000000018
	#PF: supervisor read access in kernel mode
	#PF: error_code(0x0000) - not-present page
	...
	RIP: 0010:rxrpc_connect_call+0x42/0xa01
	...
	Call Trace:
	 ? mark_held_locks+0x47/0x59
	 ? __local_bh_enable_ip+0xb6/0xba
	 rxrpc_new_client_call+0x3b1/0x762
	 ? rxrpc_do_sendmsg+0x3c0/0x92e
	 rxrpc_do_sendmsg+0x3c0/0x92e
	 rxrpc_sendmsg+0x16b/0x1b5
	 sock_sendmsg+0x2d/0x39
	 ___sys_sendmsg+0x1a4/0x22a
	 ? release_sock+0x19/0x9e
	 ? reacquire_held_locks+0x136/0x160
	 ? release_sock+0x19/0x9e
	 ? find_held_lock+0x2b/0x6e
	 ? __lock_acquire+0x268/0xf73
	 ? rxrpc_connect+0xdd/0xe4
	 ? __local_bh_enable_ip+0xb6/0xba
	 __sys_sendmsg+0x5e/0x94
	 do_syscall_64+0x7d/0x1bf
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fixes: 2341e0775747 ("rxrpc: Simplify connect() implementation and simplify sendmsg() op")
Reported-by: syzbot+7966f2a0b2c7da8939b4@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/af_rxrpc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 3c39b8805d01f..d76e5e58905d8 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -552,6 +552,7 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
 
 	switch (rx->sk.sk_state) {
 	case RXRPC_UNBOUND:
+	case RXRPC_CLIENT_UNBOUND:
 		rx->srx.srx_family = AF_RXRPC;
 		rx->srx.srx_service = 0;
 		rx->srx.transport_type = SOCK_DGRAM;
@@ -576,10 +577,9 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
 		}
 
 		rx->local = local;
-		rx->sk.sk_state = RXRPC_CLIENT_UNBOUND;
+		rx->sk.sk_state = RXRPC_CLIENT_BOUND;
 		/* Fall through */
 
-	case RXRPC_CLIENT_UNBOUND:
 	case RXRPC_CLIENT_BOUND:
 		if (!m->msg_name &&
 		    test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) {
-- 
GitLab


From d9ee5afd916500f5dc63bcf6c8f0c94a97772090 Mon Sep 17 00:00:00 2001
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Thu, 27 Jun 2019 19:48:10 -0300
Subject: [PATCH 1069/1835] sctp: fix error handling on stream scheduler
 initialization

[ Upstream commit 4d1415811e492d9a8238f8a92dd0d51612c788e9 ]

It allocates the extended area for outbound streams only on sendmsg
calls, if they are not yet allocated.  When using the priority
stream scheduler, this initialization may imply into a subsequent
allocation, which may fail.  In this case, it was aborting the stream
scheduler initialization but leaving the ->ext pointer (allocated) in
there, thus in a partially initialized state.  On a subsequent call to
sendmsg, it would notice the ->ext pointer in there, and trip on
uninitialized stuff when trying to schedule the data chunk.

The fix is undo the ->ext initialization if the stream scheduler
initialization fails and avoid the partially initialized state.

Although syzkaller bisected this to commit 4ff40b86262b ("sctp: set
chunk transport correctly when it's a new asoc"), this bug was actually
introduced on the commit I marked below.

Reported-by: syzbot+c1a380d42b190ad1e559@syzkaller.appspotmail.com
Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/stream.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 3b47457862ccd..0da57938a6c5d 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -253,13 +253,20 @@ out:
 int sctp_stream_init_ext(struct sctp_stream *stream, __u16 sid)
 {
 	struct sctp_stream_out_ext *soute;
+	int ret;
 
 	soute = kzalloc(sizeof(*soute), GFP_KERNEL);
 	if (!soute)
 		return -ENOMEM;
 	SCTP_SO(stream, sid)->ext = soute;
 
-	return sctp_sched_init_sid(stream, sid, GFP_KERNEL);
+	ret = sctp_sched_init_sid(stream, sid, GFP_KERNEL);
+	if (ret) {
+		kfree(SCTP_SO(stream, sid)->ext);
+		SCTP_SO(stream, sid)->ext = NULL;
+	}
+
+	return ret;
 }
 
 void sctp_stream_free(struct sctp_stream *stream)
-- 
GitLab


From b640ade07295fbc5329779acdecf14384b545bf8 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 23 Jul 2019 17:15:25 +0200
Subject: [PATCH 1070/1835] sky2: Disable MSI on ASUS P6T

[ Upstream commit a261e3797506bd561700be643fe1a85bf81e9661 ]

The onboard sky2 NIC on ASUS P6T WS PRO doesn't work after PM resume
due to the infamous IRQ problem.  Disabling MSI works around it, so
let's add it to the blacklist.

Unfortunately the BIOS on the machine doesn't fill the standard
DMI_SYS_* entry, so we pick up DMI_BOARD_* entries instead.

BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1142496
Reported-and-tested-by: Marcus Seyfarth <m.seyfarth@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/marvell/sky2.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index 1485f66cf7b0c..4ade864c8d531 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -4947,6 +4947,13 @@ static const struct dmi_system_id msi_blacklist[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "P-79"),
 		},
 	},
+	{
+		.ident = "ASUS P6T",
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "P6T"),
+		},
+	},
 	{}
 };
 
-- 
GitLab


From 6323c238bb4374d1477348cfbd5854f2bebe9a21 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 19 Jul 2019 11:52:33 -0700
Subject: [PATCH 1071/1835] tcp: be more careful in tcp_fragment()

[ Upstream commit b617158dc096709d8600c53b6052144d12b89fab ]

Some applications set tiny SO_SNDBUF values and expect
TCP to just work. Recent patches to address CVE-2019-11478
broke them in case of losses, since retransmits might
be prevented.

We should allow these flows to make progress.

This patch allows the first and last skb in retransmit queue
to be split even if memory limits are hit.

It also adds the some room due to the fact that tcp_sendmsg()
and tcp_sendpage() might overshoot sk_wmem_queued by about one full
TSO skb (64KB size). Note this allowance was already present
in stable backports for kernels < 4.15

Note for < 4.15 backports :
 tcp_rtx_queue_tail() will probably look like :

static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk)
{
	struct sk_buff *skb = tcp_send_head(sk);

	return skb ? tcp_write_queue_prev(sk, skb) : tcp_write_queue_tail(sk);
}

Fixes: f070ef2ac667 ("tcp: tcp_fragment() should apply sane memory limits")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrew Prout <aprout@ll.mit.edu>
Tested-by: Andrew Prout <aprout@ll.mit.edu>
Tested-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Tested-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Christoph Paasch <cpaasch@apple.com>
Cc: Jonathan Looney <jtl@netflix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tcp.h     |  5 +++++
 net/ipv4/tcp_output.c | 13 +++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index e75661f92daaa..15156cd6e7973 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1646,6 +1646,11 @@ static inline struct sk_buff *tcp_rtx_queue_head(const struct sock *sk)
 	return skb_rb_first(&sk->tcp_rtx_queue);
 }
 
+static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk)
+{
+	return skb_rb_last(&sk->tcp_rtx_queue);
+}
+
 static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk)
 {
 	return skb_peek(&sk->sk_write_queue);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 221d9b72423b9..88c7e821fd116 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1289,6 +1289,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *buff;
 	int nsize, old_factor;
+	long limit;
 	int nlen;
 	u8 flags;
 
@@ -1299,8 +1300,16 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
 	if (nsize < 0)
 		nsize = 0;
 
-	if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf &&
-		     tcp_queue != TCP_FRAG_IN_WRITE_QUEUE)) {
+	/* tcp_sendmsg() can overshoot sk_wmem_queued by one full size skb.
+	 * We need some allowance to not penalize applications setting small
+	 * SO_SNDBUF values.
+	 * Also allow first and last skb in retransmit queue to be split.
+	 */
+	limit = sk->sk_sndbuf + 2 * SKB_TRUESIZE(GSO_MAX_SIZE);
+	if (unlikely((sk->sk_wmem_queued >> 1) > limit &&
+		     tcp_queue != TCP_FRAG_IN_WRITE_QUEUE &&
+		     skb != tcp_rtx_queue_head(sk) &&
+		     skb != tcp_rtx_queue_tail(sk))) {
 		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
 		return -ENOMEM;
 	}
-- 
GitLab


From c60f57dfe995172c2f01e59266e3ffa3419c6cd9 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 18 Jul 2019 19:28:14 -0700
Subject: [PATCH 1072/1835] tcp: fix tcp_set_congestion_control() use from bpf
 hook

[ Upstream commit 8d650cdedaabb33e85e9b7c517c0c71fcecc1de9 ]

Neal reported incorrect use of ns_capable() from bpf hook.

bpf_setsockopt(...TCP_CONGESTION...)
  -> tcp_set_congestion_control()
   -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)
    -> ns_capable_common()
     -> current_cred()
      -> rcu_dereference_protected(current->cred, 1)

Accessing 'current' in bpf context makes no sense, since packets
are processed from softirq context.

As Neal stated : The capability check in tcp_set_congestion_control()
was written assuming a system call context, and then was reused from
a BPF call site.

The fix is to add a new parameter to tcp_set_congestion_control(),
so that the ns_capable() call is only performed under the right
context.

Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Lawrence Brakmo <brakmo@fb.com>
Reported-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Lawrence Brakmo <brakmo@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tcp.h   | 3 ++-
 net/core/filter.c   | 2 +-
 net/ipv4/tcp.c      | 4 +++-
 net/ipv4/tcp_cong.c | 6 +++---
 4 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 15156cd6e7973..abcf53a6db045 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1054,7 +1054,8 @@ void tcp_get_default_congestion_control(struct net *net, char *name);
 void tcp_get_available_congestion_control(char *buf, size_t len);
 void tcp_get_allowed_congestion_control(char *buf, size_t len);
 int tcp_set_allowed_congestion_control(char *allowed);
-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit);
+int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
+			       bool reinit, bool cap_net_admin);
 u32 tcp_slow_start(struct tcp_sock *tp, u32 acked);
 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked);
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 34ec9324737b3..c996380f29597 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3991,7 +3991,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
 						    TCP_CA_NAME_MAX-1));
 			name[TCP_CA_NAME_MAX-1] = 0;
 			ret = tcp_set_congestion_control(sk, name, false,
-							 reinit);
+							 reinit, true);
 		} else {
 			struct tcp_sock *tp = tcp_sk(sk);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 364e6fdaa38f5..cc25c8cbe15ad 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2729,7 +2729,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 		name[val] = 0;
 
 		lock_sock(sk);
-		err = tcp_set_congestion_control(sk, name, true, true);
+		err = tcp_set_congestion_control(sk, name, true, true,
+						 ns_capable(sock_net(sk)->user_ns,
+							    CAP_NET_ADMIN));
 		release_sock(sk);
 		return err;
 	}
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index bc6c02f162438..48f79db446a02 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -332,7 +332,8 @@ out:
  * tcp_reinit_congestion_control (if the current congestion control was
  * already initialized.
  */
-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit)
+int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
+			       bool reinit, bool cap_net_admin)
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	const struct tcp_congestion_ops *ca;
@@ -368,8 +369,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, boo
 		} else {
 			err = -EBUSY;
 		}
-	} else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
-		     ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) {
+	} else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || cap_net_admin)) {
 		err = -EPERM;
 	} else if (!try_module_get(ca->owner)) {
 		err = -EBUSY;
-- 
GitLab


From 1b200acde418f4d6d87279d3f6f976ebf188f272 Mon Sep 17 00:00:00 2001
From: Christoph Paasch <cpaasch@apple.com>
Date: Sat, 6 Jul 2019 16:13:07 -0700
Subject: [PATCH 1073/1835] tcp: Reset bytes_acked and bytes_received when
 disconnecting

[ Upstream commit e858faf556d4e14c750ba1e8852783c6f9520a0e ]

If an app is playing tricks to reuse a socket via tcp_disconnect(),
bytes_acked/received needs to be reset to 0. Otherwise tcp_info will
report the sum of the current and the old connection..

Cc: Eric Dumazet <edumazet@google.com>
Fixes: 0df48c26d841 ("tcp: add tcpi_bytes_acked to tcp_info")
Fixes: bdd1f9edacb5 ("tcp: add tcpi_bytes_received to tcp_info")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cc25c8cbe15ad..b7ef367fe6a17 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2594,6 +2594,8 @@ int tcp_disconnect(struct sock *sk, int flags)
 	tcp_saved_syn_free(tp);
 	tp->compressed_ack = 0;
 	tp->bytes_sent = 0;
+	tp->bytes_acked = 0;
+	tp->bytes_received = 0;
 	tp->bytes_retrans = 0;
 	tp->dsack_dups = 0;
 	tp->reord_seen = 0;
-- 
GitLab


From a2aa162a63319a003982a39e2cffc110bf76c591 Mon Sep 17 00:00:00 2001
From: Peter Kosyh <p.kosyh@gmail.com>
Date: Fri, 19 Jul 2019 11:11:47 +0300
Subject: [PATCH 1074/1835] vrf: make sure skb->data contains ip header to make
 routing

[ Upstream commit 107e47cc80ec37cb332bd41b22b1c7779e22e018 ]

vrf_process_v4_outbound() and vrf_process_v6_outbound() do routing
using ip/ipv6 addresses, but don't make sure the header is available
in skb->data[] (skb_headlen() is less then header size).

Case:

1) igb driver from intel.
2) Packet size is greater then 255.
3) MPLS forwards to VRF device.

So, patch adds pskb_may_pull() calls in vrf_process_v4/v6_outbound()
functions.

Signed-off-by: Peter Kosyh <p.kosyh@gmail.com>
Reviewed-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vrf.c | 58 ++++++++++++++++++++++++++++-------------------
 1 file changed, 35 insertions(+), 23 deletions(-)

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 449fc52f9a89e..9f895083bc0aa 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -169,23 +169,29 @@ static int vrf_ip6_local_out(struct net *net, struct sock *sk,
 static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
 					   struct net_device *dev)
 {
-	const struct ipv6hdr *iph = ipv6_hdr(skb);
+	const struct ipv6hdr *iph;
 	struct net *net = dev_net(skb->dev);
-	struct flowi6 fl6 = {
-		/* needed to match OIF rule */
-		.flowi6_oif = dev->ifindex,
-		.flowi6_iif = LOOPBACK_IFINDEX,
-		.daddr = iph->daddr,
-		.saddr = iph->saddr,
-		.flowlabel = ip6_flowinfo(iph),
-		.flowi6_mark = skb->mark,
-		.flowi6_proto = iph->nexthdr,
-		.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF,
-	};
+	struct flowi6 fl6;
 	int ret = NET_XMIT_DROP;
 	struct dst_entry *dst;
 	struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst;
 
+	if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr)))
+		goto err;
+
+	iph = ipv6_hdr(skb);
+
+	memset(&fl6, 0, sizeof(fl6));
+	/* needed to match OIF rule */
+	fl6.flowi6_oif = dev->ifindex;
+	fl6.flowi6_iif = LOOPBACK_IFINDEX;
+	fl6.daddr = iph->daddr;
+	fl6.saddr = iph->saddr;
+	fl6.flowlabel = ip6_flowinfo(iph);
+	fl6.flowi6_mark = skb->mark;
+	fl6.flowi6_proto = iph->nexthdr;
+	fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
+
 	dst = ip6_route_output(net, NULL, &fl6);
 	if (dst == dst_null)
 		goto err;
@@ -241,21 +247,27 @@ static int vrf_ip_local_out(struct net *net, struct sock *sk,
 static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
 					   struct net_device *vrf_dev)
 {
-	struct iphdr *ip4h = ip_hdr(skb);
+	struct iphdr *ip4h;
 	int ret = NET_XMIT_DROP;
-	struct flowi4 fl4 = {
-		/* needed to match OIF rule */
-		.flowi4_oif = vrf_dev->ifindex,
-		.flowi4_iif = LOOPBACK_IFINDEX,
-		.flowi4_tos = RT_TOS(ip4h->tos),
-		.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF,
-		.flowi4_proto = ip4h->protocol,
-		.daddr = ip4h->daddr,
-		.saddr = ip4h->saddr,
-	};
+	struct flowi4 fl4;
 	struct net *net = dev_net(vrf_dev);
 	struct rtable *rt;
 
+	if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))
+		goto err;
+
+	ip4h = ip_hdr(skb);
+
+	memset(&fl4, 0, sizeof(fl4));
+	/* needed to match OIF rule */
+	fl4.flowi4_oif = vrf_dev->ifindex;
+	fl4.flowi4_iif = LOOPBACK_IFINDEX;
+	fl4.flowi4_tos = RT_TOS(ip4h->tos);
+	fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF;
+	fl4.flowi4_proto = ip4h->protocol;
+	fl4.daddr = ip4h->daddr;
+	fl4.saddr = ip4h->saddr;
+
 	rt = ip_route_output_flow(net, &fl4, NULL);
 	if (IS_ERR(rt))
 		goto err;
-- 
GitLab


From a8ba53da071e30c3276ad5868400ac01b912a8e6 Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal@mellanox.com>
Date: Sun, 7 Jul 2019 16:57:06 +0300
Subject: [PATCH 1075/1835] net/mlx5e: IPoIB, Add error path in
 mlx5_rdma_setup_rn

[ Upstream commit ef1ce7d7b67b46661091c7ccc0396186b7a247ef ]

Check return value from mlx5e_attach_netdev, add error path on failure.

Fixes: 48935bbb7ae8 ("net/mlx5e: IPoIB, Add netdevice profile skeleton")
Signed-off-by: Aya Levin <ayal@mellanox.com>
Reviewed-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 5b7fe82641447..db6aafcced0dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -662,7 +662,9 @@ struct net_device *mlx5_rdma_netdev_alloc(struct mlx5_core_dev *mdev,
 
 	profile->init(mdev, netdev, profile, ipriv);
 
-	mlx5e_attach_netdev(epriv);
+	err = mlx5e_attach_netdev(epriv);
+	if (err)
+		goto detach;
 	netif_carrier_off(netdev);
 
 	/* set rdma_netdev func pointers */
@@ -678,6 +680,11 @@ struct net_device *mlx5_rdma_netdev_alloc(struct mlx5_core_dev *mdev,
 
 	return netdev;
 
+detach:
+	profile->cleanup(epriv);
+	if (ipriv->sub_interface)
+		return NULL;
+	mlx5e_destroy_mdev_resources(mdev);
 destroy_ht:
 	mlx5i_pkey_qpn_ht_cleanup(netdev);
 destroy_wq:
-- 
GitLab


From 21252f49cddf9878e2eb4af65df64b399dd94496 Mon Sep 17 00:00:00 2001
From: Andreas Steinmetz <ast@domdv.de>
Date: Sun, 30 Jun 2019 22:46:42 +0200
Subject: [PATCH 1076/1835] macsec: fix use-after-free of skb during RX

[ Upstream commit 095c02da80a41cf6d311c504d8955d6d1c2add10 ]

Fix use-after-free of skb when rx_handler returns RX_HANDLER_PASS.

Signed-off-by: Andreas Steinmetz <ast@domdv.de>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/macsec.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 7de88b33d5b96..7a2dae9261942 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -1103,10 +1103,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
 	}
 
 	skb = skb_unshare(skb, GFP_ATOMIC);
-	if (!skb) {
-		*pskb = NULL;
+	*pskb = skb;
+	if (!skb)
 		return RX_HANDLER_CONSUMED;
-	}
 
 	pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
 	if (!pulled_sci) {
-- 
GitLab


From 0c5cb5a12623b242166b9d7636daebea13a604af Mon Sep 17 00:00:00 2001
From: Andreas Steinmetz <ast@domdv.de>
Date: Sun, 30 Jun 2019 22:46:45 +0200
Subject: [PATCH 1077/1835] macsec: fix checksumming after decryption

[ Upstream commit 7d8b16b9facb0dd81d1469808dd9a575fa1d525a ]

Fix checksumming after decryption.

Signed-off-by: Andreas Steinmetz <ast@domdv.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/macsec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 7a2dae9261942..2c971357e66cf 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -869,6 +869,7 @@ static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev)
 
 static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len)
 {
+	skb->ip_summed = CHECKSUM_NONE;
 	memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN);
 	skb_pull(skb, hdr_len);
 	pskb_trim_unique(skb, skb->len - icv_len);
-- 
GitLab


From dc59a2abd33e23ba5eb153924a773e65d72ca65d Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Thu, 27 Jun 2019 14:30:58 -0700
Subject: [PATCH 1078/1835] netrom: fix a memory leak in nr_rx_frame()

[ Upstream commit c8c8218ec5af5d2598381883acbefbf604e56b5e ]

When the skb is associated with a new sock, just assigning
it to skb->sk is not sufficient, we have to set its destructor
to free the sock properly too.

Reported-by: syzbot+d6636a36d3c34bd88938@syzkaller.appspotmail.com
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netrom/af_netrom.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 71ffd1a6dc7c6..f11b6747e18c4 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -872,7 +872,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
 	unsigned short frametype, flags, window, timeout;
 	int ret;
 
-	skb->sk = NULL;		/* Initially we don't know who it's for */
+	skb_orphan(skb);
 
 	/*
 	 *	skb->data points to the netrom frame start
@@ -971,6 +971,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
 	window = skb->data[20];
 
 	skb->sk             = make;
+	skb->destructor     = sock_efree;
 	make->sk_state	    = TCP_ESTABLISHED;
 
 	/* Fill in his circuit details */
-- 
GitLab


From 69cd584546159c82e869cef15675cfe191a649e1 Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Mon, 22 Jul 2019 20:41:22 -0700
Subject: [PATCH 1079/1835] netrom: hold sock when setting skb->destructor

[ Upstream commit 4638faac032756f7eab5524be7be56bee77e426b ]

sock_efree() releases the sock refcnt, if we don't hold this refcnt
when setting skb->destructor to it, the refcnt would not be balanced.
This leads to several bug reports from syzbot.

I have checked other users of sock_efree(), all of them hold the
sock refcnt.

Fixes: c8c8218ec5af ("netrom: fix a memory leak in nr_rx_frame()")
Reported-and-tested-by: <syzbot+622bdabb128acc33427d@syzkaller.appspotmail.com>
Reported-and-tested-by: <syzbot+6eaef7158b19e3fec3a0@syzkaller.appspotmail.com>
Reported-and-tested-by: <syzbot+9399c158fcc09b21d0d2@syzkaller.appspotmail.com>
Reported-and-tested-by: <syzbot+a34e5f3d0300163f0c87@syzkaller.appspotmail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netrom/af_netrom.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index f11b6747e18c4..43910e50752cb 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -970,6 +970,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
 
 	window = skb->data[20];
 
+	sock_hold(make);
 	skb->sk             = make;
 	skb->destructor     = sock_efree;
 	make->sk_state	    = TCP_ESTABLISHED;
-- 
GitLab


From d9571a9f5ec19820571de3c2244d16f5b53b8bf0 Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Tue, 16 Jul 2019 13:57:30 -0700
Subject: [PATCH 1080/1835] net_sched: unset TCQ_F_CAN_BYPASS when adding
 filters

[ Upstream commit 3f05e6886a595c9a29a309c52f45326be917823c ]

For qdisc's that support TC filters and set TCQ_F_CAN_BYPASS,
notably fq_codel, it makes no sense to let packets bypass the TC
filters we setup in any scenario, otherwise our packets steering
policy could not be enforced.

This can be reproduced easily with the following script:

 ip li add dev dummy0 type dummy
 ifconfig dummy0 up
 tc qd add dev dummy0 root fq_codel
 tc filter add dev dummy0 parent 8001: protocol arp basic action mirred egress redirect dev lo
 tc filter add dev dummy0 parent 8001: protocol ip basic action mirred egress redirect dev lo
 ping -I dummy0 192.168.112.1

Without this patch, packets are sent directly to dummy0 without
hitting any of the filters. With this patch, packets are redirected
to loopback as expected.

This fix is not perfect, it only unsets the flag but does not set it back
because we have to save the information somewhere in the qdisc if we
really want that. Note, both fq_codel and sfq clear this flag in their
->bind_tcf() but this is clearly not sufficient when we don't use any
class ID.

Fixes: 23624935e0c4 ("net_sched: TCQ_F_CAN_BYPASS generalization")
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_api.c      | 1 +
 net/sched/sch_fq_codel.c | 2 --
 net/sched/sch_sfq.c      | 2 --
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 2167c6ca55e3e..3374903d5f96a 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1325,6 +1325,7 @@ replay:
 			tcf_chain_tp_insert(chain, &chain_info, tp);
 		tfilter_notify(net, skb, n, tp, block, q, parent, fh,
 			       RTM_NEWTFILTER, false);
+		q->flags &= ~TCQ_F_CAN_BYPASS;
 	} else {
 		if (tp_created)
 			tcf_proto_destroy(tp, NULL);
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 6c0a9d5dbf944..137692cb8b4f9 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -600,8 +600,6 @@ static unsigned long fq_codel_find(struct Qdisc *sch, u32 classid)
 static unsigned long fq_codel_bind(struct Qdisc *sch, unsigned long parent,
 			      u32 classid)
 {
-	/* we cannot bypass queue discipline anymore */
-	sch->flags &= ~TCQ_F_CAN_BYPASS;
 	return 0;
 }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 2f2678197760a..650f214638537 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -828,8 +828,6 @@ static unsigned long sfq_find(struct Qdisc *sch, u32 classid)
 static unsigned long sfq_bind(struct Qdisc *sch, unsigned long parent,
 			      u32 classid)
 {
-	/* we cannot bypass queue discipline anymore */
-	sch->flags &= ~TCQ_F_CAN_BYPASS;
 	return 0;
 }
 
-- 
GitLab


From fde351aeff4afe74c430395be01dd83c070ab85c Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <jakub.kicinski@netronome.com>
Date: Fri, 28 Jun 2019 16:11:39 -0700
Subject: [PATCH 1081/1835] net/tls: make sure offload also gets the keys wiped

[ Upstream commit acd3e96d53a24d219f720ed4012b62723ae05da1 ]

Commit 86029d10af18 ("tls: zero the crypto information from tls_context
before freeing") added memzero_explicit() calls to clear the key material
before freeing struct tls_context, but it missed tls_device.c has its
own way of freeing this structure. Replace the missing free.

Fixes: 86029d10af18 ("tls: zero the crypto information from tls_context before freeing")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tls.h    | 1 +
 net/tls/tls_device.c | 2 +-
 net/tls/tls_main.c   | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/net/tls.h b/include/net/tls.h
index 9541105758914..98f5ad0319a2b 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -234,6 +234,7 @@ struct tls_offload_context_rx {
 	(ALIGN(sizeof(struct tls_offload_context_rx), sizeof(void *)) + \
 	 TLS_DRIVER_STATE_SIZE)
 
+void tls_ctx_free(struct tls_context *ctx);
 int wait_on_pending_writer(struct sock *sk, long *timeo);
 int tls_sk_query(struct sock *sk, int optname, char __user *optval,
 		int __user *optlen);
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index ead29c2aefa76..0a613e0ef3bf9 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -61,7 +61,7 @@ static void tls_device_free_ctx(struct tls_context *ctx)
 	if (ctx->rx_conf == TLS_HW)
 		kfree(tls_offload_ctx_rx(ctx));
 
-	kfree(ctx);
+	tls_ctx_free(ctx);
 }
 
 static void tls_device_gc_task(struct work_struct *work)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 25b3fb585777b..4c0ac79f82d4e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -241,7 +241,7 @@ static void tls_write_space(struct sock *sk)
 	ctx->sk_write_space(sk);
 }
 
-static void tls_ctx_free(struct tls_context *ctx)
+void tls_ctx_free(struct tls_context *ctx)
 {
 	if (!ctx)
 		return;
-- 
GitLab


From bc9a2f36a7d6a3cfdfc0001cdaa6f44d73347ec9 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 26 Jun 2019 16:31:39 +0800
Subject: [PATCH 1082/1835] sctp: not bind the socket in sctp_connect

[ Upstream commit 9b6c08878e23adb7cc84bdca94d8a944b03f099e ]

Now when sctp_connect() is called with a wrong sa_family, it binds
to a port but doesn't set bp->port, then sctp_get_af_specific will
return NULL and sctp_connect() returns -EINVAL.

Then if sctp_bind() is called to bind to another port, the last
port it has bound will leak due to bp->port is NULL by then.

sctp_connect() doesn't need to bind ports, as later __sctp_connect
will do it if bp->port is NULL. So remove it from sctp_connect().
While at it, remove the unnecessary sockaddr.sa_family len check
as it's already done in sctp_inet_connect.

Fixes: 644fbdeacf1d ("sctp: fix the issue that flags are ignored when using kernel_connect")
Reported-by: syzbot+079bf326b38072f849d9@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c | 20 ++------------------
 1 file changed, 2 insertions(+), 18 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 8c00a7ef1bcda..9f5b4e547b631 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4507,34 +4507,18 @@ out_nounlock:
 static int sctp_connect(struct sock *sk, struct sockaddr *addr,
 			int addr_len, int flags)
 {
-	struct inet_sock *inet = inet_sk(sk);
 	struct sctp_af *af;
-	int err = 0;
+	int err = -EINVAL;
 
 	lock_sock(sk);
 
 	pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
 		 addr, addr_len);
 
-	/* We may need to bind the socket. */
-	if (!inet->inet_num) {
-		if (sk->sk_prot->get_port(sk, 0)) {
-			release_sock(sk);
-			return -EAGAIN;
-		}
-		inet->inet_sport = htons(inet->inet_num);
-	}
-
 	/* Validate addr_len before calling common connect/connectx routine. */
 	af = sctp_get_af_specific(addr->sa_family);
-	if (!af || addr_len < af->sockaddr_len) {
-		err = -EINVAL;
-	} else {
-		/* Pass correct addr len to common routine (so it knows there
-		 * is only one address being passed.
-		 */
+	if (af && addr_len >= af->sockaddr_len)
 		err = __sctp_connect(sk, addr, af->sockaddr_len, flags, NULL);
-	}
 
 	release_sock(sk);
 	return err;
-- 
GitLab


From caf4488fc06ecafa0f359ff20d6e4569977a9f9e Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Date: Tue, 2 Jul 2019 15:00:18 +0300
Subject: [PATCH 1083/1835] net: bridge: mcast: fix stale nsrcs pointer in
 igmp3/mld2 report handling

[ Upstream commit e57f61858b7cf478ed6fa23ed4b3876b1c9625c4 ]

We take a pointer to grec prior to calling pskb_may_pull and use it
afterwards to get nsrcs so record nsrcs before the pull when handling
igmp3 and we get a pointer to nsrcs and call pskb_may_pull when handling
mld2 which again could lead to reading 2 bytes out-of-bounds.

 ==================================================================
 BUG: KASAN: use-after-free in br_multicast_rcv+0x480c/0x4ad0 [bridge]
 Read of size 2 at addr ffff8880421302b4 by task ksoftirqd/1/16

 CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G           OE     5.2.0-rc6+ #1
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
 Call Trace:
  dump_stack+0x71/0xab
  print_address_description+0x6a/0x280
  ? br_multicast_rcv+0x480c/0x4ad0 [bridge]
  __kasan_report+0x152/0x1aa
  ? br_multicast_rcv+0x480c/0x4ad0 [bridge]
  ? br_multicast_rcv+0x480c/0x4ad0 [bridge]
  kasan_report+0xe/0x20
  br_multicast_rcv+0x480c/0x4ad0 [bridge]
  ? br_multicast_disable_port+0x150/0x150 [bridge]
  ? ktime_get_with_offset+0xb4/0x150
  ? __kasan_kmalloc.constprop.6+0xa6/0xf0
  ? __netif_receive_skb+0x1b0/0x1b0
  ? br_fdb_update+0x10e/0x6e0 [bridge]
  ? br_handle_frame_finish+0x3c6/0x11d0 [bridge]
  br_handle_frame_finish+0x3c6/0x11d0 [bridge]
  ? br_pass_frame_up+0x3a0/0x3a0 [bridge]
  ? virtnet_probe+0x1c80/0x1c80 [virtio_net]
  br_handle_frame+0x731/0xd90 [bridge]
  ? select_idle_sibling+0x25/0x7d0
  ? br_handle_frame_finish+0x11d0/0x11d0 [bridge]
  __netif_receive_skb_core+0xced/0x2d70
  ? virtqueue_get_buf_ctx+0x230/0x1130 [virtio_ring]
  ? do_xdp_generic+0x20/0x20
  ? virtqueue_napi_complete+0x39/0x70 [virtio_net]
  ? virtnet_poll+0x94d/0xc78 [virtio_net]
  ? receive_buf+0x5120/0x5120 [virtio_net]
  ? __netif_receive_skb_one_core+0x97/0x1d0
  __netif_receive_skb_one_core+0x97/0x1d0
  ? __netif_receive_skb_core+0x2d70/0x2d70
  ? _raw_write_trylock+0x100/0x100
  ? __queue_work+0x41e/0xbe0
  process_backlog+0x19c/0x650
  ? _raw_read_lock_irq+0x40/0x40
  net_rx_action+0x71e/0xbc0
  ? __switch_to_asm+0x40/0x70
  ? napi_complete_done+0x360/0x360
  ? __switch_to_asm+0x34/0x70
  ? __switch_to_asm+0x40/0x70
  ? __schedule+0x85e/0x14d0
  __do_softirq+0x1db/0x5f9
  ? takeover_tasklets+0x5f0/0x5f0
  run_ksoftirqd+0x26/0x40
  smpboot_thread_fn+0x443/0x680
  ? sort_range+0x20/0x20
  ? schedule+0x94/0x210
  ? __kthread_parkme+0x78/0xf0
  ? sort_range+0x20/0x20
  kthread+0x2ae/0x3a0
  ? kthread_create_worker_on_cpu+0xc0/0xc0
  ret_from_fork+0x35/0x40

 The buggy address belongs to the page:
 page:ffffea0001084c00 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0
 flags: 0xffffc000000000()
 raw: 00ffffc000000000 ffffea0000cfca08 ffffea0001098608 0000000000000000
 raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
 ffff888042130180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888042130200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 > ffff888042130280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                     ^
 ffff888042130300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888042130380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ==================================================================
 Disabling lock debugging due to kernel taint

Fixes: bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with INCLUDE and no sources as a leave")
Reported-by: Martin Weinelt <martin@linuxlounge.net>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Tested-by: Martin Weinelt <martin@linuxlounge.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_multicast.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 75901c4641b1c..2bb52be929ea7 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1147,6 +1147,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
 	int type;
 	int err = 0;
 	__be32 group;
+	u16 nsrcs;
 
 	ih = igmpv3_report_hdr(skb);
 	num = ntohs(ih->ngrec);
@@ -1160,8 +1161,9 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
 		grec = (void *)(skb->data + len - sizeof(*grec));
 		group = grec->grec_mca;
 		type = grec->grec_type;
+		nsrcs = ntohs(grec->grec_nsrcs);
 
-		len += ntohs(grec->grec_nsrcs) * 4;
+		len += nsrcs * 4;
 		if (!pskb_may_pull(skb, len))
 			return -EINVAL;
 
@@ -1182,7 +1184,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
 		src = eth_hdr(skb)->h_source;
 		if ((type == IGMPV3_CHANGE_TO_INCLUDE ||
 		     type == IGMPV3_MODE_IS_INCLUDE) &&
-		    ntohs(grec->grec_nsrcs) == 0) {
+		    nsrcs == 0) {
 			br_ip4_multicast_leave_group(br, port, group, vid, src);
 		} else {
 			err = br_ip4_multicast_add_group(br, port, group, vid,
@@ -1217,23 +1219,26 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 	len = skb_transport_offset(skb) + sizeof(*icmp6h);
 
 	for (i = 0; i < num; i++) {
-		__be16 *nsrcs, _nsrcs;
-
-		nsrcs = skb_header_pointer(skb,
-					   len + offsetof(struct mld2_grec,
-							  grec_nsrcs),
-					   sizeof(_nsrcs), &_nsrcs);
-		if (!nsrcs)
+		__be16 *_nsrcs, __nsrcs;
+		u16 nsrcs;
+
+		_nsrcs = skb_header_pointer(skb,
+					    len + offsetof(struct mld2_grec,
+							   grec_nsrcs),
+					    sizeof(__nsrcs), &__nsrcs);
+		if (!_nsrcs)
 			return -EINVAL;
 
+		nsrcs = ntohs(*_nsrcs);
+
 		if (!pskb_may_pull(skb,
 				   len + sizeof(*grec) +
-				   sizeof(struct in6_addr) * ntohs(*nsrcs)))
+				   sizeof(struct in6_addr) * nsrcs))
 			return -EINVAL;
 
 		grec = (struct mld2_grec *)(skb->data + len);
 		len += sizeof(*grec) +
-		       sizeof(struct in6_addr) * ntohs(*nsrcs);
+		       sizeof(struct in6_addr) * nsrcs;
 
 		/* We treat these as MLDv1 reports for now. */
 		switch (grec->grec_type) {
@@ -1252,7 +1257,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 		src = eth_hdr(skb)->h_source;
 		if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
 		     grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
-		    ntohs(*nsrcs) == 0) {
+		    nsrcs == 0) {
 			br_ip6_multicast_leave_group(br, port, &grec->grec_mca,
 						     vid, src);
 		} else {
-- 
GitLab


From 41a8df71809ec0052ce4c0176f2f363c4f783969 Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Date: Tue, 2 Jul 2019 15:00:19 +0300
Subject: [PATCH 1084/1835] net: bridge: mcast: fix stale ipv6 hdr pointer when
 handling v6 query

[ Upstream commit 3b26a5d03d35d8f732d75951218983c0f7f68dff ]

We get a pointer to the ipv6 hdr in br_ip6_multicast_query but we may
call pskb_may_pull afterwards and end up using a stale pointer.
So use the header directly, it's just 1 place where it's needed.

Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Tested-by: Martin Weinelt <martin@linuxlounge.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_multicast.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2bb52be929ea7..fb54d32321ec9 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1510,7 +1510,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
 				  struct sk_buff *skb,
 				  u16 vid)
 {
-	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 	struct mld_msg *mld;
 	struct net_bridge_mdb_entry *mp;
 	struct mld2_query *mld2q;
@@ -1554,7 +1553,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
 
 	if (is_general_query) {
 		saddr.proto = htons(ETH_P_IPV6);
-		saddr.u.ip6 = ip6h->saddr;
+		saddr.u.ip6 = ipv6_hdr(skb)->saddr;
 
 		br_multicast_query_received(br, port, &br->ip6_other_query,
 					    &saddr, max_delay);
-- 
GitLab


From 78701843ecc429db5fc632c51c61b3cc986a2b84 Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Date: Tue, 2 Jul 2019 15:00:20 +0300
Subject: [PATCH 1085/1835] net: bridge: don't cache ether dest pointer on
 input

[ Upstream commit 3d26eb8ad1e9b906433903ce05f775cf038e747f ]

We would cache ether dst pointer on input in br_handle_frame_finish but
after the neigh suppress code that could lead to a stale pointer since
both ipv4 and ipv6 suppress code do pskb_may_pull. This means we have to
always reload it after the suppress code so there's no point in having
it cached just retrieve it directly.

Fixes: 057658cb33fbf ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports")
Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_input.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index fed0ff446abb3..2532c1a19645c 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -79,7 +79,6 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
 	struct net_bridge_fdb_entry *dst = NULL;
 	struct net_bridge_mdb_entry *mdst;
 	bool local_rcv, mcast_hit = false;
-	const unsigned char *dest;
 	struct net_bridge *br;
 	u16 vid = 0;
 
@@ -97,10 +96,9 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
 		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
 
 	local_rcv = !!(br->dev->flags & IFF_PROMISC);
-	dest = eth_hdr(skb)->h_dest;
-	if (is_multicast_ether_addr(dest)) {
+	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
 		/* by definition the broadcast is also a multicast address */
-		if (is_broadcast_ether_addr(dest)) {
+		if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
 			pkt_type = BR_PKT_BROADCAST;
 			local_rcv = true;
 		} else {
@@ -150,7 +148,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
 		}
 		break;
 	case BR_PKT_UNICAST:
-		dst = br_fdb_find_rcu(br, dest, vid);
+		dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
 	default:
 		break;
 	}
-- 
GitLab


From b72fb8dec1836773d226caeb4a2c5bc57158005b Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Date: Tue, 2 Jul 2019 15:00:21 +0300
Subject: [PATCH 1086/1835] net: bridge: stp: don't cache eth dest pointer
 before skb pull

[ Upstream commit 2446a68ae6a8cee6d480e2f5b52f5007c7c41312 ]

Don't cache eth dest pointer before calling pskb_may_pull.

Fixes: cf0f02d04a83 ("[BRIDGE]: use llc for receiving STP packets")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_stp_bpdu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 1b75d6bf12bd9..37ddcea3fc96b 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -147,7 +147,6 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
 void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
 		struct net_device *dev)
 {
-	const unsigned char *dest = eth_hdr(skb)->h_dest;
 	struct net_bridge_port *p;
 	struct net_bridge *br;
 	const unsigned char *buf;
@@ -176,7 +175,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
 	if (p->state == BR_STATE_DISABLED)
 		goto out;
 
-	if (!ether_addr_equal(dest, br->group_addr))
+	if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr))
 		goto out;
 
 	if (p->flags & BR_BPDU_GUARD) {
-- 
GitLab


From 95ee55cab118135c7dd3741e3bc53c404407f9a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>
Date: Thu, 6 Dec 2018 11:18:40 -0500
Subject: [PATCH 1087/1835] dma-buf: balance refcount inbalance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5e383a9798990c69fc759a4930de224bb497e62c upstream.

The debugfs take reference on fence without dropping them.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: linux-media@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: linaro-mm-sig@lists.linaro.org
Cc: Stéphane Marchesin <marcheu@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20181206161840.6578-1-jglisse@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma-buf/dma-buf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 13884474d1588..69842145c223f 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1069,6 +1069,7 @@ static int dma_buf_debug_show(struct seq_file *s, void *unused)
 				   fence->ops->get_driver_name(fence),
 				   fence->ops->get_timeline_name(fence),
 				   dma_fence_is_signaled(fence) ? "" : "un");
+			dma_fence_put(fence);
 		}
 		rcu_read_unlock();
 
-- 
GitLab


From c947cf3e95839e9f449d8194fd15979e5ebc5f16 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Tue, 4 Jun 2019 13:53:23 +0100
Subject: [PATCH 1088/1835] dma-buf: Discard old fence_excl on retrying
 get_fences_rcu for realloc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f5b07b04e5f090a85d1e96938520f2b2b58e4a8e upstream.

If we have to drop the seqcount & rcu lock to perform a krealloc, we
have to restart the loop. In doing so, be careful not to lose track of
the already acquired exclusive fence.

Fixes: fedf54132d24 ("dma-buf: Restart reservation_object_get_fences_rcu() after writes")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: stable@vger.kernel.org #v4.10
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190604125323.21396-1-chris@chris-wilson.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma-buf/reservation.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
index 6c95f61a32e73..49ab09468ba15 100644
--- a/drivers/dma-buf/reservation.c
+++ b/drivers/dma-buf/reservation.c
@@ -416,6 +416,10 @@ int reservation_object_get_fences_rcu(struct reservation_object *obj,
 					   GFP_NOWAIT | __GFP_NOWARN);
 			if (!nshared) {
 				rcu_read_unlock();
+
+				dma_fence_put(fence_excl);
+				fence_excl = NULL;
+
 				nshared = krealloc(shared, sz, GFP_KERNEL);
 				if (nshared) {
 					shared = nshared;
-- 
GitLab


From dd5994ab1f00aa2cf67336d03212e239176e5389 Mon Sep 17 00:00:00 2001
From: Keerthy <j-keerthy@ti.com>
Date: Mon, 8 Jul 2019 14:19:04 +0530
Subject: [PATCH 1089/1835] gpio: davinci: silence error prints in case of
 EPROBE_DEFER

commit 541e4095f388c196685685633c950cb9b97f8039 upstream.

Silence error prints in case of EPROBE_DEFER. This avoids
multiple/duplicate defer prints during boot.

Cc: <stable@vger.kernel.org>
Signed-off-by: Keerthy <j-keerthy@ti.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-davinci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index a5ece8ea79bc8..abb332d15a131 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -222,8 +222,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
 	for (i = 0; i < nirq; i++) {
 		chips->irqs[i] = platform_get_irq(pdev, i);
 		if (chips->irqs[i] < 0) {
-			dev_info(dev, "IRQ not populated, err = %d\n",
-				 chips->irqs[i]);
+			if (chips->irqs[i] != -EPROBE_DEFER)
+				dev_info(dev, "IRQ not populated, err = %d\n",
+					 chips->irqs[i]);
 			return chips->irqs[i];
 		}
 	}
-- 
GitLab


From 0e6ef184315d43ec26ae6c3acaadd88466621e5d Mon Sep 17 00:00:00 2001
From: Paul Cercueil <paul@crapouillou.net>
Date: Tue, 4 Jun 2019 18:33:11 +0200
Subject: [PATCH 1090/1835] MIPS: lb60: Fix pin mappings

commit 1323c3b72a987de57141cabc44bf9cd83656bc70 upstream.

The pin mappings introduced in commit 636f8ba67fb6
("MIPS: JZ4740: Qi LB60: Add pinctrl configuration for several drivers")
are completely wrong. The pinctrl driver name is incorrect, and the
function and group fields are swapped.

Fixes: 636f8ba67fb6 ("MIPS: JZ4740: Qi LB60: Add pinctrl configuration for several drivers")
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: od@zcrc.me
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/jz4740/board-qi_lb60.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c
index 705593d40d120..05c60fa4fa06b 100644
--- a/arch/mips/jz4740/board-qi_lb60.c
+++ b/arch/mips/jz4740/board-qi_lb60.c
@@ -471,27 +471,27 @@ static unsigned long pin_cfg_bias_disable[] = {
 static struct pinctrl_map pin_map[] __initdata = {
 	/* NAND pin configuration */
 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-nand",
-			"10010000.jz4740-pinctrl", "nand", "nand-cs1"),
+			"10010000.pin-controller", "nand-cs1", "nand"),
 
 	/* fbdev pin configuration */
 	PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_DEFAULT,
-			"10010000.jz4740-pinctrl", "lcd", "lcd-8bit"),
+			"10010000.pin-controller", "lcd-8bit", "lcd"),
 	PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_SLEEP,
-			"10010000.jz4740-pinctrl", "lcd", "lcd-no-pins"),
+			"10010000.pin-controller", "lcd-no-pins", "lcd"),
 
 	/* MMC pin configuration */
 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0",
-			"10010000.jz4740-pinctrl", "mmc", "mmc-1bit"),
+			"10010000.pin-controller", "mmc-1bit", "mmc"),
 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0",
-			"10010000.jz4740-pinctrl", "mmc", "mmc-4bit"),
+			"10010000.pin-controller", "mmc-4bit", "mmc"),
 	PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0",
-			"10010000.jz4740-pinctrl", "PD0", pin_cfg_bias_disable),
+			"10010000.pin-controller", "PD0", pin_cfg_bias_disable),
 	PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0",
-			"10010000.jz4740-pinctrl", "PD2", pin_cfg_bias_disable),
+			"10010000.pin-controller", "PD2", pin_cfg_bias_disable),
 
 	/* PWM pin configuration */
 	PIN_MAP_MUX_GROUP_DEFAULT("jz4740-pwm",
-			"10010000.jz4740-pinctrl", "pwm4", "pwm4"),
+			"10010000.pin-controller", "pwm4", "pwm4"),
 };
 
 
-- 
GitLab


From 75100ec5f079c5c3c65b28a6b8d360acfe00b983 Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date: Mon, 1 Jul 2019 14:07:55 +0300
Subject: [PATCH 1091/1835] perf/core: Fix exclusive events' grouping

commit 8a58ddae23796c733c5dfbd717538d89d036c5bd upstream.

So far, we tried to disallow grouping exclusive events for the fear of
complications they would cause with moving between contexts. Specifically,
moving a software group to a hardware context would violate the exclusivity
rules if both groups contain matching exclusive events.

This attempt was, however, unsuccessful: the check that we have in the
perf_event_open() syscall is both wrong (looks at wrong PMU) and
insufficient (group leader may still be exclusive), as can be illustrated
by running:

  $ perf record -e '{intel_pt//,cycles}' uname
  $ perf record -e '{cycles,intel_pt//}' uname

ultimately successfully.

Furthermore, we are completely free to trigger the exclusivity violation
by:

   perf -e '{cycles,intel_pt//}' -e '{intel_pt//,instructions}'

even though the helpful perf record will not allow that, the ABI will.

The warning later in the perf_event_open() path will also not trigger, because
it's also wrong.

Fix all this by validating the original group before moving, getting rid
of broken safeguards and placing a useful one to perf_install_in_context().

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: mathieu.poirier@linaro.org
Cc: will.deacon@arm.com
Fixes: bed5b25ad9c8a ("perf: Add a pmu capability for "exclusive" events")
Link: https://lkml.kernel.org/r/20190701110755.24646-1-alexander.shishkin@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/perf_event.h |  5 +++++
 kernel/events/core.c       | 34 ++++++++++++++++++++++------------
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 42fc852bf5123..b22bc81f3669a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1030,6 +1030,11 @@ static inline int in_software_context(struct perf_event *event)
 	return event->ctx->pmu->task_ctx_nr == perf_sw_context;
 }
 
+static inline int is_exclusive_pmu(struct pmu *pmu)
+{
+	return pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE;
+}
+
 extern struct static_key perf_swevent_enabled[PERF_COUNT_SW_MAX];
 
 extern void ___perf_sw_event(u32, u64, struct pt_regs *, u64);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3b61ff40bfe2b..6fb9c60eba00f 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2541,6 +2541,9 @@ unlock:
 	return ret;
 }
 
+static bool exclusive_event_installable(struct perf_event *event,
+					struct perf_event_context *ctx);
+
 /*
  * Attach a performance event to a context.
  *
@@ -2555,6 +2558,8 @@ perf_install_in_context(struct perf_event_context *ctx,
 
 	lockdep_assert_held(&ctx->mutex);
 
+	WARN_ON_ONCE(!exclusive_event_installable(event, ctx));
+
 	if (event->cpu != -1)
 		event->cpu = cpu;
 
@@ -4341,7 +4346,7 @@ static int exclusive_event_init(struct perf_event *event)
 {
 	struct pmu *pmu = event->pmu;
 
-	if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE))
+	if (!is_exclusive_pmu(pmu))
 		return 0;
 
 	/*
@@ -4372,7 +4377,7 @@ static void exclusive_event_destroy(struct perf_event *event)
 {
 	struct pmu *pmu = event->pmu;
 
-	if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE))
+	if (!is_exclusive_pmu(pmu))
 		return;
 
 	/* see comment in exclusive_event_init() */
@@ -4392,14 +4397,15 @@ static bool exclusive_event_match(struct perf_event *e1, struct perf_event *e2)
 	return false;
 }
 
-/* Called under the same ctx::mutex as perf_install_in_context() */
 static bool exclusive_event_installable(struct perf_event *event,
 					struct perf_event_context *ctx)
 {
 	struct perf_event *iter_event;
 	struct pmu *pmu = event->pmu;
 
-	if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE))
+	lockdep_assert_held(&ctx->mutex);
+
+	if (!is_exclusive_pmu(pmu))
 		return true;
 
 	list_for_each_entry(iter_event, &ctx->event_list, event_entry) {
@@ -10613,11 +10619,6 @@ SYSCALL_DEFINE5(perf_event_open,
 		goto err_alloc;
 	}
 
-	if ((pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE) && group_leader) {
-		err = -EBUSY;
-		goto err_context;
-	}
-
 	/*
 	 * Look up the group leader (we will attach this event to it):
 	 */
@@ -10705,6 +10706,18 @@ SYSCALL_DEFINE5(perf_event_open,
 				move_group = 0;
 			}
 		}
+
+		/*
+		 * Failure to create exclusive events returns -EBUSY.
+		 */
+		err = -EBUSY;
+		if (!exclusive_event_installable(group_leader, ctx))
+			goto err_locked;
+
+		for_each_sibling_event(sibling, group_leader) {
+			if (!exclusive_event_installable(sibling, ctx))
+				goto err_locked;
+		}
 	} else {
 		mutex_lock(&ctx->mutex);
 	}
@@ -10741,9 +10754,6 @@ SYSCALL_DEFINE5(perf_event_open,
 	 * because we need to serialize with concurrent event creation.
 	 */
 	if (!exclusive_event_installable(event, ctx)) {
-		/* exclusive and group stuff are assumed mutually exclusive */
-		WARN_ON_ONCE(move_group);
-
 		err = -EBUSY;
 		goto err_locked;
 	}
-- 
GitLab


From 4a5cc64d8a8a0f937e6d857faf571966c903341d Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Sat, 13 Jul 2019 11:21:25 +0200
Subject: [PATCH 1092/1835] perf/core: Fix race between close() and fork()

commit 1cf8dfe8a661f0462925df943140e9f6d1ea5233 upstream.

Syzcaller reported the following Use-after-Free bug:

	close()						clone()

							  copy_process()
							    perf_event_init_task()
							      perf_event_init_context()
							        mutex_lock(parent_ctx->mutex)
								inherit_task_group()
								  inherit_group()
								    inherit_event()
								      mutex_lock(event->child_mutex)
								      // expose event on child list
								      list_add_tail()
								      mutex_unlock(event->child_mutex)
							        mutex_unlock(parent_ctx->mutex)

							    ...
							    goto bad_fork_*

							  bad_fork_cleanup_perf:
							    perf_event_free_task()

	  perf_release()
	    perf_event_release_kernel()
	      list_for_each_entry()
		mutex_lock(ctx->mutex)
		mutex_lock(event->child_mutex)
		// event is from the failing inherit
		// on the other CPU
		perf_remove_from_context()
		list_move()
		mutex_unlock(event->child_mutex)
		mutex_unlock(ctx->mutex)

							      mutex_lock(ctx->mutex)
							      list_for_each_entry_safe()
							        // event already stolen
							      mutex_unlock(ctx->mutex)

							    delayed_free_task()
							      free_task()

	     list_for_each_entry_safe()
	       list_del()
	       free_event()
	         _free_event()
		   // and so event->hw.target
		   // is the already freed failed clone()
		   if (event->hw.target)
		     put_task_struct(event->hw.target)
		       // WHOOPSIE, already quite dead

Which puts the lie to the the comment on perf_event_free_task():
'unexposed, unused context' not so much.

Which is a 'fun' confluence of fail; copy_process() doing an
unconditional free_task() and not respecting refcounts, and perf having
creative locking. In particular:

  82d94856fa22 ("perf/core: Fix lock inversion between perf,trace,cpuhp")

seems to have overlooked this 'fun' parade.

Solve it by using the fact that detached events still have a reference
count on their (previous) context. With this perf_event_free_task()
can detect when events have escaped and wait for their destruction.

Debugged-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Reported-by: syzbot+a24c397a29ad22d86c98@syzkaller.appspotmail.com
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: 82d94856fa22 ("perf/core: Fix lock inversion between perf,trace,cpuhp")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 49 ++++++++++++++++++++++++++++++++++++--------
 1 file changed, 41 insertions(+), 8 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6fb9c60eba00f..e8979c72514be 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4452,12 +4452,20 @@ static void _free_event(struct perf_event *event)
 	if (event->destroy)
 		event->destroy(event);
 
-	if (event->ctx)
-		put_ctx(event->ctx);
-
+	/*
+	 * Must be after ->destroy(), due to uprobe_perf_close() using
+	 * hw.target.
+	 */
 	if (event->hw.target)
 		put_task_struct(event->hw.target);
 
+	/*
+	 * perf_event_free_task() relies on put_ctx() being 'last', in particular
+	 * all task references must be cleaned up.
+	 */
+	if (event->ctx)
+		put_ctx(event->ctx);
+
 	exclusive_event_destroy(event);
 	module_put(event->pmu->module);
 
@@ -4637,8 +4645,17 @@ again:
 	mutex_unlock(&event->child_mutex);
 
 	list_for_each_entry_safe(child, tmp, &free_list, child_list) {
+		void *var = &child->ctx->refcount;
+
 		list_del(&child->child_list);
 		free_event(child);
+
+		/*
+		 * Wake any perf_event_free_task() waiting for this event to be
+		 * freed.
+		 */
+		smp_mb(); /* pairs with wait_var_event() */
+		wake_up_var(var);
 	}
 
 no_ctx:
@@ -11220,11 +11237,11 @@ static void perf_free_event(struct perf_event *event,
 }
 
 /*
- * Free an unexposed, unused context as created by inheritance by
- * perf_event_init_task below, used by fork() in case of fail.
+ * Free a context as created by inheritance by perf_event_init_task() below,
+ * used by fork() in case of fail.
  *
- * Not all locks are strictly required, but take them anyway to be nice and
- * help out with the lockdep assertions.
+ * Even though the task has never lived, the context and events have been
+ * exposed through the child_list, so we must take care tearing it all down.
  */
 void perf_event_free_task(struct task_struct *task)
 {
@@ -11254,7 +11271,23 @@ void perf_event_free_task(struct task_struct *task)
 			perf_free_event(event, ctx);
 
 		mutex_unlock(&ctx->mutex);
-		put_ctx(ctx);
+
+		/*
+		 * perf_event_release_kernel() could've stolen some of our
+		 * child events and still have them on its free_list. In that
+		 * case we must wait for these events to have been freed (in
+		 * particular all their references to this task must've been
+		 * dropped).
+		 *
+		 * Without this copy_process() will unconditionally free this
+		 * task (irrespective of its reference count) and
+		 * _free_event()'s put_task_struct(event->hw.target) will be a
+		 * use-after-free.
+		 *
+		 * Wait for all events to drop their context reference.
+		 */
+		wait_var_event(&ctx->refcount, atomic_read(&ctx->refcount) == 1);
+		put_ctx(ctx); /* must be last */
 	}
 }
 
-- 
GitLab


From 29171e82348cb0ce787120d42f0b94e8fba2bcae Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Sun, 9 Jun 2019 21:41:41 -0400
Subject: [PATCH 1093/1835] ext4: don't allow any modifications to an immutable
 file

commit 2e53840362771c73eb0a5ff71611507e64e8eecd upstream.

Don't allow any modifications to a file that's marked immutable, which
means that we have to flush all the writable pages to make the readonly
and we have to check the setattr/setflags parameters more closely.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ioctl.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 53d57cdf3c4d8..abb6fcff0a1d3 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -268,6 +268,29 @@ static int uuid_is_zero(__u8 u[16])
 }
 #endif
 
+/*
+ * If immutable is set and we are not clearing it, we're not allowed to change
+ * anything else in the inode.  Don't error out if we're only trying to set
+ * immutable on an immutable file.
+ */
+static int ext4_ioctl_check_immutable(struct inode *inode, __u32 new_projid,
+				      unsigned int flags)
+{
+	struct ext4_inode_info *ei = EXT4_I(inode);
+	unsigned int oldflags = ei->i_flags;
+
+	if (!(oldflags & EXT4_IMMUTABLE_FL) || !(flags & EXT4_IMMUTABLE_FL))
+		return 0;
+
+	if ((oldflags & ~EXT4_IMMUTABLE_FL) != (flags & ~EXT4_IMMUTABLE_FL))
+		return -EPERM;
+	if (ext4_has_feature_project(inode->i_sb) &&
+	    __kprojid_val(ei->i_projid) != new_projid)
+		return -EPERM;
+
+	return 0;
+}
+
 static int ext4_ioctl_setflags(struct inode *inode,
 			       unsigned int flags)
 {
@@ -321,6 +344,20 @@ static int ext4_ioctl_setflags(struct inode *inode,
 			goto flags_out;
 	}
 
+	/*
+	 * Wait for all pending directio and then flush all the dirty pages
+	 * for this file.  The flush marks all the pages readonly, so any
+	 * subsequent attempt to write to the file (particularly mmap pages)
+	 * will come through the filesystem and fail.
+	 */
+	if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) &&
+	    (flags & EXT4_IMMUTABLE_FL)) {
+		inode_dio_wait(inode);
+		err = filemap_write_and_wait(inode->i_mapping);
+		if (err)
+			goto flags_out;
+	}
+
 	handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
 	if (IS_ERR(handle)) {
 		err = PTR_ERR(handle);
@@ -750,7 +787,11 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 			return err;
 
 		inode_lock(inode);
-		err = ext4_ioctl_setflags(inode, flags);
+		err = ext4_ioctl_check_immutable(inode,
+				from_kprojid(&init_user_ns, ei->i_projid),
+				flags);
+		if (!err)
+			err = ext4_ioctl_setflags(inode, flags);
 		inode_unlock(inode);
 		mnt_drop_write_file(filp);
 		return err;
@@ -1120,6 +1161,9 @@ resizefs_out:
 			goto out;
 		flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
 			 (flags & EXT4_FL_XFLAG_VISIBLE);
+		err = ext4_ioctl_check_immutable(inode, fa.fsx_projid, flags);
+		if (err)
+			goto out;
 		err = ext4_ioctl_setflags(inode, flags);
 		if (err)
 			goto out;
-- 
GitLab


From c9ea4620a37f544e46cead4e276b4f273141f08a Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Sun, 9 Jun 2019 22:04:33 -0400
Subject: [PATCH 1094/1835] ext4: enforce the immutable flag on open files

commit 02b016ca7f99229ae6227e7b2fc950c4e140d74a upstream.

According to the chattr man page, "a file with the 'i' attribute
cannot be modified..."  Historically, this was only enforced when the
file was opened, per the rest of the description, "... and the file
can not be opened in write mode".

There is general agreement that we should standardize all file systems
to prevent modifications even for files that were opened at the time
the immutable flag is set.  Eventually, a change to enforce this at
the VFS layer should be landing in mainline.  Until then, enforce this
at the ext4 level to prevent xfstests generic/553 from failing.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/file.c  |  4 ++++
 fs/ext4/inode.c | 11 +++++++++++
 2 files changed, 15 insertions(+)

diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 2c5baa5e82911..f4a24a46245ea 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -165,6 +165,10 @@ static ssize_t ext4_write_checks(struct kiocb *iocb, struct iov_iter *from)
 	ret = generic_write_checks(iocb, from);
 	if (ret <= 0)
 		return ret;
+
+	if (unlikely(IS_IMMUTABLE(inode)))
+		return -EPERM;
+
 	/*
 	 * If we have encountered a bitmap-format file, the size limit
 	 * is smaller than s_maxbytes, which is for extent-mapped files.
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 05dc5a4ba481b..db318b5ec8122 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5491,6 +5491,14 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
 	if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
 		return -EIO;
 
+	if (unlikely(IS_IMMUTABLE(inode)))
+		return -EPERM;
+
+	if (unlikely(IS_APPEND(inode) &&
+		     (ia_valid & (ATTR_MODE | ATTR_UID |
+				  ATTR_GID | ATTR_TIMES_SET))))
+		return -EPERM;
+
 	error = setattr_prepare(dentry, attr);
 	if (error)
 		return error;
@@ -6190,6 +6198,9 @@ int ext4_page_mkwrite(struct vm_fault *vmf)
 	get_block_t *get_block;
 	int retries = 0;
 
+	if (unlikely(IS_IMMUTABLE(inode)))
+		return VM_FAULT_SIGBUS;
+
 	sb_start_pagefault(inode->i_sb);
 	file_update_time(vma->vm_file);
 
-- 
GitLab


From 4becd6c11e9a0be4ab8af7b28e9bbc01288da014 Mon Sep 17 00:00:00 2001
From: Ross Zwisler <zwisler@chromium.org>
Date: Thu, 20 Jun 2019 17:05:37 -0400
Subject: [PATCH 1095/1835] mm: add filemap_fdatawait_range_keep_errors()

commit aa0bfcd939c30617385ffa28682c062d78050eba upstream.

In the spirit of filemap_fdatawait_range() and
filemap_fdatawait_keep_errors(), introduce
filemap_fdatawait_range_keep_errors() which both takes a range upon
which to wait and does not clear errors from the address space.

Signed-off-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/fs.h |  2 ++
 mm/filemap.c       | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index d4e1b43a53c37..92420009b9bcb 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2651,6 +2651,8 @@ extern int filemap_flush(struct address_space *);
 extern int filemap_fdatawait_keep_errors(struct address_space *mapping);
 extern int filemap_fdatawait_range(struct address_space *, loff_t lstart,
 				   loff_t lend);
+extern int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
+		loff_t start_byte, loff_t end_byte);
 
 static inline int filemap_fdatawait(struct address_space *mapping)
 {
diff --git a/mm/filemap.c b/mm/filemap.c
index 52517f28e6f4a..287f3fa02e5ee 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -561,6 +561,28 @@ int filemap_fdatawait_range(struct address_space *mapping, loff_t start_byte,
 }
 EXPORT_SYMBOL(filemap_fdatawait_range);
 
+/**
+ * filemap_fdatawait_range_keep_errors - wait for writeback to complete
+ * @mapping:		address space structure to wait for
+ * @start_byte:		offset in bytes where the range starts
+ * @end_byte:		offset in bytes where the range ends (inclusive)
+ *
+ * Walk the list of under-writeback pages of the given address space in the
+ * given range and wait for all of them.  Unlike filemap_fdatawait_range(),
+ * this function does not clear error status of the address space.
+ *
+ * Use this function if callers don't handle errors themselves.  Expected
+ * call sites are system-wide / filesystem-wide data flushers: e.g. sync(2),
+ * fsfreeze(8)
+ */
+int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
+		loff_t start_byte, loff_t end_byte)
+{
+	__filemap_fdatawait_range(mapping, start_byte, end_byte);
+	return filemap_check_and_keep_errors(mapping);
+}
+EXPORT_SYMBOL(filemap_fdatawait_range_keep_errors);
+
 /**
  * file_fdatawait_range - wait for writeback to complete
  * @file:		file pointing to address space structure to wait for
-- 
GitLab


From af3812b65c3785f7d052b4a1f5dd7c6f54a77e24 Mon Sep 17 00:00:00 2001
From: Ross Zwisler <zwisler@chromium.org>
Date: Thu, 20 Jun 2019 17:24:56 -0400
Subject: [PATCH 1096/1835] jbd2: introduce jbd2_inode dirty range scoping

commit 6ba0e7dc64a5adcda2fbe65adc466891795d639e upstream.

Currently both journal_submit_inode_data_buffers() and
journal_finish_inode_data_buffers() operate on the entire address space
of each of the inodes associated with a given journal entry.  The
consequence of this is that if we have an inode where we are constantly
appending dirty pages we can end up waiting for an indefinite amount of
time in journal_finish_inode_data_buffers() while we wait for all the
pages under writeback to be written out.

The easiest way to cause this type of workload is do just dd from
/dev/zero to a file until it fills the entire filesystem.  This can
cause journal_finish_inode_data_buffers() to wait for the duration of
the entire dd operation.

We can improve this situation by scoping each of the inode dirty ranges
associated with a given transaction.  We do this via the jbd2_inode
structure so that the scoping is contained within jbd2 and so that it
follows the lifetime and locking rules for that structure.

This allows us to limit the writeback & wait in
journal_submit_inode_data_buffers() and
journal_finish_inode_data_buffers() respectively to the dirty range for
a given struct jdb2_inode, keeping us from waiting forever if the inode
in question is still being appended to.

Signed-off-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jbd2/commit.c      | 23 ++++++++++++++------
 fs/jbd2/journal.c     |  4 ++++
 fs/jbd2/transaction.c | 49 ++++++++++++++++++++++++-------------------
 include/linux/jbd2.h  | 22 +++++++++++++++++++
 4 files changed, 71 insertions(+), 27 deletions(-)

diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 65ea0355a4f64..24f86ffe11d74 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -187,14 +187,15 @@ static int journal_wait_on_commit_record(journal_t *journal,
  * use writepages() because with dealyed allocation we may be doing
  * block allocation in writepages().
  */
-static int journal_submit_inode_data_buffers(struct address_space *mapping)
+static int journal_submit_inode_data_buffers(struct address_space *mapping,
+		loff_t dirty_start, loff_t dirty_end)
 {
 	int ret;
 	struct writeback_control wbc = {
 		.sync_mode =  WB_SYNC_ALL,
 		.nr_to_write = mapping->nrpages * 2,
-		.range_start = 0,
-		.range_end = i_size_read(mapping->host),
+		.range_start = dirty_start,
+		.range_end = dirty_end,
 	};
 
 	ret = generic_writepages(mapping, &wbc);
@@ -218,6 +219,9 @@ static int journal_submit_data_buffers(journal_t *journal,
 
 	spin_lock(&journal->j_list_lock);
 	list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) {
+		loff_t dirty_start = jinode->i_dirty_start;
+		loff_t dirty_end = jinode->i_dirty_end;
+
 		if (!(jinode->i_flags & JI_WRITE_DATA))
 			continue;
 		mapping = jinode->i_vfs_inode->i_mapping;
@@ -230,7 +234,8 @@ static int journal_submit_data_buffers(journal_t *journal,
 		 * only allocated blocks here.
 		 */
 		trace_jbd2_submit_inode_data(jinode->i_vfs_inode);
-		err = journal_submit_inode_data_buffers(mapping);
+		err = journal_submit_inode_data_buffers(mapping, dirty_start,
+				dirty_end);
 		if (!ret)
 			ret = err;
 		spin_lock(&journal->j_list_lock);
@@ -257,12 +262,16 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
 	/* For locking, see the comment in journal_submit_data_buffers() */
 	spin_lock(&journal->j_list_lock);
 	list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) {
+		loff_t dirty_start = jinode->i_dirty_start;
+		loff_t dirty_end = jinode->i_dirty_end;
+
 		if (!(jinode->i_flags & JI_WAIT_DATA))
 			continue;
 		jinode->i_flags |= JI_COMMIT_RUNNING;
 		spin_unlock(&journal->j_list_lock);
-		err = filemap_fdatawait_keep_errors(
-				jinode->i_vfs_inode->i_mapping);
+		err = filemap_fdatawait_range_keep_errors(
+				jinode->i_vfs_inode->i_mapping, dirty_start,
+				dirty_end);
 		if (!ret)
 			ret = err;
 		spin_lock(&journal->j_list_lock);
@@ -282,6 +291,8 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
 				&jinode->i_transaction->t_inode_list);
 		} else {
 			jinode->i_transaction = NULL;
+			jinode->i_dirty_start = 0;
+			jinode->i_dirty_end = 0;
 		}
 	}
 	spin_unlock(&journal->j_list_lock);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index e9cf88f0bc291..df390a69c49a8 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -94,6 +94,8 @@ EXPORT_SYMBOL(jbd2_journal_try_to_free_buffers);
 EXPORT_SYMBOL(jbd2_journal_force_commit);
 EXPORT_SYMBOL(jbd2_journal_inode_add_write);
 EXPORT_SYMBOL(jbd2_journal_inode_add_wait);
+EXPORT_SYMBOL(jbd2_journal_inode_ranged_write);
+EXPORT_SYMBOL(jbd2_journal_inode_ranged_wait);
 EXPORT_SYMBOL(jbd2_journal_init_jbd_inode);
 EXPORT_SYMBOL(jbd2_journal_release_jbd_inode);
 EXPORT_SYMBOL(jbd2_journal_begin_ordered_truncate);
@@ -2588,6 +2590,8 @@ void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode)
 	jinode->i_next_transaction = NULL;
 	jinode->i_vfs_inode = inode;
 	jinode->i_flags = 0;
+	jinode->i_dirty_start = 0;
+	jinode->i_dirty_end = 0;
 	INIT_LIST_HEAD(&jinode->i_list);
 }
 
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index e20a6703531f4..911ff18249b75 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2500,7 +2500,7 @@ void jbd2_journal_refile_buffer(journal_t *journal, struct journal_head *jh)
  * File inode in the inode list of the handle's transaction
  */
 static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
-				   unsigned long flags)
+		unsigned long flags, loff_t start_byte, loff_t end_byte)
 {
 	transaction_t *transaction = handle->h_transaction;
 	journal_t *journal;
@@ -2512,26 +2512,17 @@ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
 	jbd_debug(4, "Adding inode %lu, tid:%d\n", jinode->i_vfs_inode->i_ino,
 			transaction->t_tid);
 
-	/*
-	 * First check whether inode isn't already on the transaction's
-	 * lists without taking the lock. Note that this check is safe
-	 * without the lock as we cannot race with somebody removing inode
-	 * from the transaction. The reason is that we remove inode from the
-	 * transaction only in journal_release_jbd_inode() and when we commit
-	 * the transaction. We are guarded from the first case by holding
-	 * a reference to the inode. We are safe against the second case
-	 * because if jinode->i_transaction == transaction, commit code
-	 * cannot touch the transaction because we hold reference to it,
-	 * and if jinode->i_next_transaction == transaction, commit code
-	 * will only file the inode where we want it.
-	 */
-	if ((jinode->i_transaction == transaction ||
-	    jinode->i_next_transaction == transaction) &&
-	    (jinode->i_flags & flags) == flags)
-		return 0;
-
 	spin_lock(&journal->j_list_lock);
 	jinode->i_flags |= flags;
+
+	if (jinode->i_dirty_end) {
+		jinode->i_dirty_start = min(jinode->i_dirty_start, start_byte);
+		jinode->i_dirty_end = max(jinode->i_dirty_end, end_byte);
+	} else {
+		jinode->i_dirty_start = start_byte;
+		jinode->i_dirty_end = end_byte;
+	}
+
 	/* Is inode already attached where we need it? */
 	if (jinode->i_transaction == transaction ||
 	    jinode->i_next_transaction == transaction)
@@ -2566,12 +2557,28 @@ done:
 int jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *jinode)
 {
 	return jbd2_journal_file_inode(handle, jinode,
-				       JI_WRITE_DATA | JI_WAIT_DATA);
+			JI_WRITE_DATA | JI_WAIT_DATA, 0, LLONG_MAX);
 }
 
 int jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *jinode)
 {
-	return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA);
+	return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA, 0,
+			LLONG_MAX);
+}
+
+int jbd2_journal_inode_ranged_write(handle_t *handle,
+		struct jbd2_inode *jinode, loff_t start_byte, loff_t length)
+{
+	return jbd2_journal_file_inode(handle, jinode,
+			JI_WRITE_DATA | JI_WAIT_DATA, start_byte,
+			start_byte + length - 1);
+}
+
+int jbd2_journal_inode_ranged_wait(handle_t *handle, struct jbd2_inode *jinode,
+		loff_t start_byte, loff_t length)
+{
+	return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA,
+			start_byte, start_byte + length - 1);
 }
 
 /*
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 583b82b5a1e98..1cf1b9b8e9754 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -454,6 +454,22 @@ struct jbd2_inode {
 	 * @i_flags: Flags of inode [j_list_lock]
 	 */
 	unsigned long i_flags;
+
+	/**
+	 * @i_dirty_start:
+	 *
+	 * Offset in bytes where the dirty range for this inode starts.
+	 * [j_list_lock]
+	 */
+	loff_t i_dirty_start;
+
+	/**
+	 * @i_dirty_end:
+	 *
+	 * Inclusive offset in bytes where the dirty range for this inode
+	 * ends. [j_list_lock]
+	 */
+	loff_t i_dirty_end;
 };
 
 struct jbd2_revoke_table_s;
@@ -1399,6 +1415,12 @@ extern int	   jbd2_journal_force_commit(journal_t *);
 extern int	   jbd2_journal_force_commit_nested(journal_t *);
 extern int	   jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *inode);
 extern int	   jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *inode);
+extern int	   jbd2_journal_inode_ranged_write(handle_t *handle,
+			struct jbd2_inode *inode, loff_t start_byte,
+			loff_t length);
+extern int	   jbd2_journal_inode_ranged_wait(handle_t *handle,
+			struct jbd2_inode *inode, loff_t start_byte,
+			loff_t length);
 extern int	   jbd2_journal_begin_ordered_truncate(journal_t *journal,
 				struct jbd2_inode *inode, loff_t new_size);
 extern void	   jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode);
-- 
GitLab


From caa4e08253eb3d7cb2e00a20daac240b6ef82197 Mon Sep 17 00:00:00 2001
From: Ross Zwisler <zwisler@chromium.org>
Date: Thu, 20 Jun 2019 17:26:26 -0400
Subject: [PATCH 1097/1835] ext4: use jbd2_inode dirty range scoping

commit 73131fbb003b3691cfcf9656f234b00da497fcd6 upstream.

Use the newly introduced jbd2_inode dirty range scoping to prevent us
from waiting forever when trying to complete a journal transaction.

Signed-off-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ext4_jbd2.h   | 12 ++++++------
 fs/ext4/inode.c       | 13 ++++++++++---
 fs/ext4/move_extent.c |  3 ++-
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index df908ef79ccea..402dc366117ea 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -361,20 +361,20 @@ static inline int ext4_journal_force_commit(journal_t *journal)
 }
 
 static inline int ext4_jbd2_inode_add_write(handle_t *handle,
-					    struct inode *inode)
+		struct inode *inode, loff_t start_byte, loff_t length)
 {
 	if (ext4_handle_valid(handle))
-		return jbd2_journal_inode_add_write(handle,
-						    EXT4_I(inode)->jinode);
+		return jbd2_journal_inode_ranged_write(handle,
+				EXT4_I(inode)->jinode, start_byte, length);
 	return 0;
 }
 
 static inline int ext4_jbd2_inode_add_wait(handle_t *handle,
-					   struct inode *inode)
+		struct inode *inode, loff_t start_byte, loff_t length)
 {
 	if (ext4_handle_valid(handle))
-		return jbd2_journal_inode_add_wait(handle,
-						   EXT4_I(inode)->jinode);
+		return jbd2_journal_inode_ranged_wait(handle,
+				EXT4_I(inode)->jinode, start_byte, length);
 	return 0;
 }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index db318b5ec8122..e65559bf77281 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -729,10 +729,16 @@ out_sem:
 		    !(flags & EXT4_GET_BLOCKS_ZERO) &&
 		    !ext4_is_quota_file(inode) &&
 		    ext4_should_order_data(inode)) {
+			loff_t start_byte =
+				(loff_t)map->m_lblk << inode->i_blkbits;
+			loff_t length = (loff_t)map->m_len << inode->i_blkbits;
+
 			if (flags & EXT4_GET_BLOCKS_IO_SUBMIT)
-				ret = ext4_jbd2_inode_add_wait(handle, inode);
+				ret = ext4_jbd2_inode_add_wait(handle, inode,
+						start_byte, length);
 			else
-				ret = ext4_jbd2_inode_add_write(handle, inode);
+				ret = ext4_jbd2_inode_add_write(handle, inode,
+						start_byte, length);
 			if (ret)
 				return ret;
 		}
@@ -4058,7 +4064,8 @@ static int __ext4_block_zero_page_range(handle_t *handle,
 		err = 0;
 		mark_buffer_dirty(bh);
 		if (ext4_should_order_data(inode))
-			err = ext4_jbd2_inode_add_write(handle, inode);
+			err = ext4_jbd2_inode_add_write(handle, inode, from,
+					length);
 	}
 
 unlock:
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 2f5be02fc6f6a..287631bb09e75 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -390,7 +390,8 @@ data_copy:
 
 	/* Even in case of data=writeback it is reasonable to pin
 	 * inode to transaction, to prevent unexpected data loss */
-	*err = ext4_jbd2_inode_add_write(handle, orig_inode);
+	*err = ext4_jbd2_inode_add_write(handle, orig_inode,
+			(loff_t)orig_page_offset << PAGE_SHIFT, replaced_size);
 
 unlock_pages:
 	unlock_page(pagep[0]);
-- 
GitLab


From 3a17ca864baffc0c6f6e8aad525aa4365775a193 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 20 Jun 2019 21:19:02 -0400
Subject: [PATCH 1098/1835] ext4: allow directory holes

commit 4e19d6b65fb4fc42e352ce9883649e049da14743 upstream.

The largedir feature was intended to allow ext4 directories to have
unmapped directory blocks (e.g., directory holes).  And so the
released e2fsprogs no longer enforces this for largedir file systems;
however, the corresponding change to the kernel-side code was not made.

This commit fixes this oversight.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/dir.c   | 19 +++++++++----------
 fs/ext4/namei.c | 45 +++++++++++++++++++++++++++++++++++++--------
 2 files changed, 46 insertions(+), 18 deletions(-)

diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
index f93f9881ec184..46d5c40f2835f 100644
--- a/fs/ext4/dir.c
+++ b/fs/ext4/dir.c
@@ -108,7 +108,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
 	struct inode *inode = file_inode(file);
 	struct super_block *sb = inode->i_sb;
 	struct buffer_head *bh = NULL;
-	int dir_has_error = 0;
 	struct fscrypt_str fstr = FSTR_INIT(NULL, 0);
 
 	if (ext4_encrypted_inode(inode)) {
@@ -144,8 +143,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
 			return err;
 	}
 
-	offset = ctx->pos & (sb->s_blocksize - 1);
-
 	while (ctx->pos < inode->i_size) {
 		struct ext4_map_blocks map;
 
@@ -154,9 +151,18 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
 			goto errout;
 		}
 		cond_resched();
+		offset = ctx->pos & (sb->s_blocksize - 1);
 		map.m_lblk = ctx->pos >> EXT4_BLOCK_SIZE_BITS(sb);
 		map.m_len = 1;
 		err = ext4_map_blocks(NULL, inode, &map, 0);
+		if (err == 0) {
+			/* m_len should never be zero but let's avoid
+			 * an infinite loop if it somehow is */
+			if (map.m_len == 0)
+				map.m_len = 1;
+			ctx->pos += map.m_len * sb->s_blocksize;
+			continue;
+		}
 		if (err > 0) {
 			pgoff_t index = map.m_pblk >>
 					(PAGE_SHIFT - inode->i_blkbits);
@@ -175,13 +181,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
 		}
 
 		if (!bh) {
-			if (!dir_has_error) {
-				EXT4_ERROR_FILE(file, 0,
-						"directory contains a "
-						"hole at offset %llu",
-					   (unsigned long long) ctx->pos);
-				dir_has_error = 1;
-			}
 			/* corrupt size?  Maybe no more blocks to read */
 			if (ctx->pos > inode->i_blocks << 9)
 				break;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 4c5aa5df65731..61dc1b0e4465d 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -81,8 +81,18 @@ static struct buffer_head *ext4_append(handle_t *handle,
 static int ext4_dx_csum_verify(struct inode *inode,
 			       struct ext4_dir_entry *dirent);
 
+/*
+ * Hints to ext4_read_dirblock regarding whether we expect a directory
+ * block being read to be an index block, or a block containing
+ * directory entries (and if the latter, whether it was found via a
+ * logical block in an htree index block).  This is used to control
+ * what sort of sanity checkinig ext4_read_dirblock() will do on the
+ * directory block read from the storage device.  EITHER will means
+ * the caller doesn't know what kind of directory block will be read,
+ * so no specific verification will be done.
+ */
 typedef enum {
-	EITHER, INDEX, DIRENT
+	EITHER, INDEX, DIRENT, DIRENT_HTREE
 } dirblock_type_t;
 
 #define ext4_read_dirblock(inode, block, type) \
@@ -108,11 +118,14 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode,
 
 		return bh;
 	}
-	if (!bh) {
+	if (!bh && (type == INDEX || type == DIRENT_HTREE)) {
 		ext4_error_inode(inode, func, line, block,
-				 "Directory hole found");
+				 "Directory hole found for htree %s block",
+				 (type == INDEX) ? "index" : "leaf");
 		return ERR_PTR(-EFSCORRUPTED);
 	}
+	if (!bh)
+		return NULL;
 	dirent = (struct ext4_dir_entry *) bh->b_data;
 	/* Determine whether or not we have an index block */
 	if (is_dx(inode)) {
@@ -979,7 +992,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
 
 	dxtrace(printk(KERN_INFO "In htree dirblock_to_tree: block %lu\n",
 							(unsigned long)block));
-	bh = ext4_read_dirblock(dir, block, DIRENT);
+	bh = ext4_read_dirblock(dir, block, DIRENT_HTREE);
 	if (IS_ERR(bh))
 		return PTR_ERR(bh);
 
@@ -1509,7 +1522,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 		return (struct buffer_head *) frame;
 	do {
 		block = dx_get_block(frame->at);
-		bh = ext4_read_dirblock(dir, block, DIRENT);
+		bh = ext4_read_dirblock(dir, block, DIRENT_HTREE);
 		if (IS_ERR(bh))
 			goto errout;
 
@@ -2079,6 +2092,11 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
 	blocks = dir->i_size >> sb->s_blocksize_bits;
 	for (block = 0; block < blocks; block++) {
 		bh = ext4_read_dirblock(dir, block, DIRENT);
+		if (bh == NULL) {
+			bh = ext4_bread(handle, dir, block,
+					EXT4_GET_BLOCKS_CREATE);
+			goto add_to_new_block;
+		}
 		if (IS_ERR(bh)) {
 			retval = PTR_ERR(bh);
 			bh = NULL;
@@ -2099,6 +2117,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
 		brelse(bh);
 	}
 	bh = ext4_append(handle, dir, &block);
+add_to_new_block:
 	if (IS_ERR(bh)) {
 		retval = PTR_ERR(bh);
 		bh = NULL;
@@ -2143,7 +2162,7 @@ again:
 		return PTR_ERR(frame);
 	entries = frame->entries;
 	at = frame->at;
-	bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT);
+	bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT_HTREE);
 	if (IS_ERR(bh)) {
 		err = PTR_ERR(bh);
 		bh = NULL;
@@ -2691,7 +2710,10 @@ bool ext4_empty_dir(struct inode *inode)
 		EXT4_ERROR_INODE(inode, "invalid size");
 		return true;
 	}
-	bh = ext4_read_dirblock(inode, 0, EITHER);
+	/* The first directory block must not be a hole,
+	 * so treat it as DIRENT_HTREE
+	 */
+	bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
 	if (IS_ERR(bh))
 		return true;
 
@@ -2713,6 +2735,10 @@ bool ext4_empty_dir(struct inode *inode)
 			brelse(bh);
 			lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb);
 			bh = ext4_read_dirblock(inode, lblock, EITHER);
+			if (bh == NULL) {
+				offset += sb->s_blocksize;
+				continue;
+			}
 			if (IS_ERR(bh))
 				return true;
 			de = (struct ext4_dir_entry_2 *) bh->b_data;
@@ -3256,7 +3282,10 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
 	struct buffer_head *bh;
 
 	if (!ext4_has_inline_data(inode)) {
-		bh = ext4_read_dirblock(inode, 0, EITHER);
+		/* The first directory block must not be a hole, so
+		 * treat it as DIRENT_HTREE
+		 */
+		bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
 		if (IS_ERR(bh)) {
 			*retval = PTR_ERR(bh);
 			return NULL;
-- 
GitLab


From 967bc679c596ebf41afbb5c9ffc4216354428b6f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Jul 2019 18:41:10 +0200
Subject: [PATCH 1099/1835] KVM: nVMX: do not use dangling shadow VMCS after
 guest reset

commit 88dddc11a8d6b09201b4db9d255b3394d9bc9e57 upstream.

If a KVM guest is reset while running a nested guest, free_nested will
disable the shadow VMCS execution control in the vmcs01.  However,
on the next KVM_RUN vmx_vcpu_run would nevertheless try to sync
the VMCS12 to the shadow VMCS which has since been freed.

This causes a vmptrld of a NULL pointer on my machime, but Jan reports
the host to hang altogether.  Let's see how much this trivial patch fixes.

Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Liran Alon <liran.alon@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 73d6d585dd66d..880bc36a0d5d0 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8457,6 +8457,7 @@ static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx)
 {
 	vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS);
 	vmcs_write64(VMCS_LINK_POINTER, -1ull);
+	vmx->nested.sync_shadow_vmcs = false;
 }
 
 static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
@@ -8468,7 +8469,6 @@ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
 		/* copy to memory all shadowed fields in case
 		   they were modified */
 		copy_shadow_to_vmcs12(vmx);
-		vmx->nested.sync_shadow_vmcs = false;
 		vmx_disable_shadow_vmcs(vmx);
 	}
 	vmx->nested.posted_intr_nv = -1;
@@ -8668,6 +8668,9 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
 	u64 field_value;
 	struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
 
+	if (WARN_ON(!shadow_vmcs))
+		return;
+
 	preempt_disable();
 
 	vmcs_load(shadow_vmcs);
@@ -8706,6 +8709,9 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
 	u64 field_value = 0;
 	struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
 
+	if (WARN_ON(!shadow_vmcs))
+		return;
+
 	vmcs_load(shadow_vmcs);
 
 	for (q = 0; q < ARRAY_SIZE(fields); q++) {
-- 
GitLab


From 7560e33369ed30ab68180dcd6b8ef342bbb3c29a Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Sun, 21 Jul 2019 13:52:18 +0200
Subject: [PATCH 1100/1835] KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES
 when leaving nested

commit cf64527bb33f6cec2ed50f89182fc4688d0056b6 upstream.

Letting this pend may cause nested_get_vmcs12_pages to run against an
invalid state, corrupting the effective vmcs of L1.

This was triggerable in QEMU after a guest corruption in L2, followed by
a L1 reset.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Liran Alon <liran.alon@oracle.com>
Cc: stable@vger.kernel.org
Fixes: 7f7f1ba33cf2 ("KVM: x86: do not load vmcs12 pages while still in SMM")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 880bc36a0d5d0..4cf16378dffe7 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8490,6 +8490,8 @@ static void free_nested(struct vcpu_vmx *vmx)
 	if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
 		return;
 
+	kvm_clear_request(KVM_REQ_GET_VMCS12_PAGES, &vmx->vcpu);
+
 	hrtimer_cancel(&vmx->nested.preemption_timer);
 	vmx->nested.vmxon = false;
 	vmx->nested.smm.vmxon = false;
-- 
GitLab


From c1d98b766ebe9a6b94d41c76f2ada07604c18c95 Mon Sep 17 00:00:00 2001
From: Kuo-Hsin Yang <vovoy@chromium.org>
Date: Thu, 11 Jul 2019 20:52:04 -0700
Subject: [PATCH 1101/1835] mm: vmscan: scan anonymous pages on file refaults

commit 2c012a4ad1a2cd3fb5a0f9307b9d219f84eda1fa upstream.

When file refaults are detected and there are many inactive file pages,
the system never reclaim anonymous pages, the file pages are dropped
aggressively when there are still a lot of cold anonymous pages and
system thrashes.  This issue impacts the performance of applications
with large executable, e.g.  chrome.

With this patch, when file refault is detected, inactive_list_is_low()
always returns true for file pages in get_scan_count() to enable
scanning anonymous pages.

The problem can be reproduced by the following test program.

---8<---
void fallocate_file(const char *filename, off_t size)
{
	struct stat st;
	int fd;

	if (!stat(filename, &st) && st.st_size >= size)
		return;

	fd = open(filename, O_WRONLY | O_CREAT, 0600);
	if (fd < 0) {
		perror("create file");
		exit(1);
	}
	if (posix_fallocate(fd, 0, size)) {
		perror("fallocate");
		exit(1);
	}
	close(fd);
}

long *alloc_anon(long size)
{
	long *start = malloc(size);
	memset(start, 1, size);
	return start;
}

long access_file(const char *filename, long size, long rounds)
{
	int fd, i;
	volatile char *start1, *end1, *start2;
	const int page_size = getpagesize();
	long sum = 0;

	fd = open(filename, O_RDONLY);
	if (fd == -1) {
		perror("open");
		exit(1);
	}

	/*
	 * Some applications, e.g. chrome, use a lot of executable file
	 * pages, map some of the pages with PROT_EXEC flag to simulate
	 * the behavior.
	 */
	start1 = mmap(NULL, size / 2, PROT_READ | PROT_EXEC, MAP_SHARED,
		      fd, 0);
	if (start1 == MAP_FAILED) {
		perror("mmap");
		exit(1);
	}
	end1 = start1 + size / 2;

	start2 = mmap(NULL, size / 2, PROT_READ, MAP_SHARED, fd, size / 2);
	if (start2 == MAP_FAILED) {
		perror("mmap");
		exit(1);
	}

	for (i = 0; i < rounds; ++i) {
		struct timeval before, after;
		volatile char *ptr1 = start1, *ptr2 = start2;
		gettimeofday(&before, NULL);
		for (; ptr1 < end1; ptr1 += page_size, ptr2 += page_size)
			sum += *ptr1 + *ptr2;
		gettimeofday(&after, NULL);
		printf("File access time, round %d: %f (sec)
", i,
		       (after.tv_sec - before.tv_sec) +
		       (after.tv_usec - before.tv_usec) / 1000000.0);
	}
	return sum;
}

int main(int argc, char *argv[])
{
	const long MB = 1024 * 1024;
	long anon_mb, file_mb, file_rounds;
	const char filename[] = "large";
	long *ret1;
	long ret2;

	if (argc != 4) {
		printf("usage: thrash ANON_MB FILE_MB FILE_ROUNDS
");
		exit(0);
	}
	anon_mb = atoi(argv[1]);
	file_mb = atoi(argv[2]);
	file_rounds = atoi(argv[3]);

	fallocate_file(filename, file_mb * MB);
	printf("Allocate %ld MB anonymous pages
", anon_mb);
	ret1 = alloc_anon(anon_mb * MB);
	printf("Access %ld MB file pages
", file_mb);
	ret2 = access_file(filename, file_mb * MB, file_rounds);
	printf("Print result to prevent optimization: %ld
",
	       *ret1 + ret2);
	return 0;
}
---8<---

Running the test program on 2GB RAM VM with kernel 5.2.0-rc5, the program
fills ram with 2048 MB memory, access a 200 MB file for 10 times.  Without
this patch, the file cache is dropped aggresively and every access to the
file is from disk.

  $ ./thrash 2048 200 10
  Allocate 2048 MB anonymous pages
  Access 200 MB file pages
  File access time, round 0: 2.489316 (sec)
  File access time, round 1: 2.581277 (sec)
  File access time, round 2: 2.487624 (sec)
  File access time, round 3: 2.449100 (sec)
  File access time, round 4: 2.420423 (sec)
  File access time, round 5: 2.343411 (sec)
  File access time, round 6: 2.454833 (sec)
  File access time, round 7: 2.483398 (sec)
  File access time, round 8: 2.572701 (sec)
  File access time, round 9: 2.493014 (sec)

With this patch, these file pages can be cached.

  $ ./thrash 2048 200 10
  Allocate 2048 MB anonymous pages
  Access 200 MB file pages
  File access time, round 0: 2.475189 (sec)
  File access time, round 1: 2.440777 (sec)
  File access time, round 2: 2.411671 (sec)
  File access time, round 3: 1.955267 (sec)
  File access time, round 4: 0.029924 (sec)
  File access time, round 5: 0.000808 (sec)
  File access time, round 6: 0.000771 (sec)
  File access time, round 7: 0.000746 (sec)
  File access time, round 8: 0.000738 (sec)
  File access time, round 9: 0.000747 (sec)

Checked the swap out stats during the test [1], 19006 pages swapped out
with this patch, 3418 pages swapped out without this patch. There are
more swap out, but I think it's within reasonable range when file backed
data set doesn't fit into the memory.

$ ./thrash 2000 100 2100 5 1 # ANON_MB FILE_EXEC FILE_NOEXEC ROUNDS
PROCESSES Allocate 2000 MB anonymous pages active_anon: 1613644,
inactive_anon: 348656, active_file: 892, inactive_file: 1384 (kB)
pswpout: 7972443, pgpgin: 478615246 Access 100 MB executable file pages
Access 2100 MB regular file pages File access time, round 0: 12.165,
(sec) active_anon: 1433788, inactive_anon: 478116, active_file: 17896,
inactive_file: 24328 (kB) File access time, round 1: 11.493, (sec)
active_anon: 1430576, inactive_anon: 477144, active_file: 25440,
inactive_file: 26172 (kB) File access time, round 2: 11.455, (sec)
active_anon: 1427436, inactive_anon: 476060, active_file: 21112,
inactive_file: 28808 (kB) File access time, round 3: 11.454, (sec)
active_anon: 1420444, inactive_anon: 473632, active_file: 23216,
inactive_file: 35036 (kB) File access time, round 4: 11.479, (sec)
active_anon: 1413964, inactive_anon: 471460, active_file: 31728,
inactive_file: 32224 (kB) pswpout: 7991449 (+ 19006), pgpgin: 489924366
(+ 11309120)

With 4 processes accessing non-overlapping parts of a large file, 30316
pages swapped out with this patch, 5152 pages swapped out without this
patch.  The swapout number is small comparing to pgpgin.

[1]: https://github.com/vovo/testing/blob/master/mem_thrash.c

Link: http://lkml.kernel.org/r/20190701081038.GA83398@google.com
Fixes: e9868505987a ("mm,vmscan: only evict file pages when we have plenty")
Fixes: 7c5bd705d8f9 ("mm: memcg: only evict file pages when we have plenty")
Signed-off-by: Kuo-Hsin Yang <vovoy@chromium.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Sonny Rao <sonnyrao@chromium.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>	[4.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[backported to 4.14.y, 4.19.y, 5.1.y: adjust context]
Signed-off-by: Kuo-Hsin Yang <vovoy@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/vmscan.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index e42f44cf7b435..576379e874214 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2190,7 +2190,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
  *   10TB     320        32GB
  */
 static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
-				 struct scan_control *sc, bool actual_reclaim)
+				 struct scan_control *sc, bool trace)
 {
 	enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE;
 	struct pglist_data *pgdat = lruvec_pgdat(lruvec);
@@ -2216,7 +2216,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
 	 * rid of the stale workingset quickly.
 	 */
 	refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
-	if (file && actual_reclaim && lruvec->refaults != refaults) {
+	if (file && lruvec->refaults != refaults) {
 		inactive_ratio = 0;
 	} else {
 		gb = (inactive + active) >> (30 - PAGE_SHIFT);
@@ -2226,7 +2226,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
 			inactive_ratio = 1;
 	}
 
-	if (actual_reclaim)
+	if (trace)
 		trace_mm_vmscan_inactive_list_is_low(pgdat->node_id, sc->reclaim_idx,
 			lruvec_lru_size(lruvec, inactive_lru, MAX_NR_ZONES), inactive,
 			lruvec_lru_size(lruvec, active_lru, MAX_NR_ZONES), active,
-- 
GitLab


From 60e9babfda94023ea39a09841804d44551fb98fd Mon Sep 17 00:00:00 2001
From: Vlad Buslov <vladbu@mellanox.com>
Date: Sun, 21 Jul 2019 17:44:12 +0300
Subject: [PATCH 1102/1835] net: sched: verify that q!=NULL before setting
 q->flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 503d81d428bd598430f7f9d02021634e1a8139a0 upstream.

In function int tc_new_tfilter() q pointer can be NULL when adding filter
on a shared block. With recent change that resets TCQ_F_CAN_BYPASS after
filter creation, following NULL pointer dereference happens in case parent
block is shared:

[  212.925060] BUG: kernel NULL pointer dereference, address: 0000000000000010
[  212.925445] #PF: supervisor write access in kernel mode
[  212.925709] #PF: error_code(0x0002) - not-present page
[  212.925965] PGD 8000000827923067 P4D 8000000827923067 PUD 827924067 PMD 0
[  212.926302] Oops: 0002 [#1] SMP KASAN PTI
[  212.926539] CPU: 18 PID: 2617 Comm: tc Tainted: G    B             5.2.0+ #512
[  212.926938] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017
[  212.927364] RIP: 0010:tc_new_tfilter+0x698/0xd40
[  212.927633] Code: 74 0d 48 85 c0 74 08 48 89 ef e8 03 aa 62 00 48 8b 84 24 a0 00 00 00 48 8d 78 10 48 89 44 24 18 e8 4d 0c 6b ff 48 8b 44 24 18 <83> 60 10 f
b 48 85 ed 0f 85 3d fe ff ff e9 4f fe ff ff e8 81 26 f8
[  212.928607] RSP: 0018:ffff88884fd5f5d8 EFLAGS: 00010296
[  212.928905] RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
[  212.929201] RDX: 0000000000000007 RSI: 0000000000000004 RDI: 0000000000000297
[  212.929402] RBP: ffff88886bedd600 R08: ffffffffb91d4b51 R09: fffffbfff7616e4d
[  212.929609] R10: fffffbfff7616e4c R11: ffffffffbb0b7263 R12: ffff88886bc61040
[  212.929803] R13: ffff88884fd5f950 R14: ffffc900039c5000 R15: ffff88835e927680
[  212.929999] FS:  00007fe7c50b6480(0000) GS:ffff88886f980000(0000) knlGS:0000000000000000
[  212.930235] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  212.930394] CR2: 0000000000000010 CR3: 000000085bd04002 CR4: 00000000001606e0
[  212.930588] Call Trace:
[  212.930682]  ? tc_del_tfilter+0xa40/0xa40
[  212.930811]  ? __lock_acquire+0x5b5/0x2460
[  212.930948]  ? find_held_lock+0x85/0xa0
[  212.931081]  ? tc_del_tfilter+0xa40/0xa40
[  212.931201]  rtnetlink_rcv_msg+0x4ab/0x5f0
[  212.931332]  ? rtnl_dellink+0x490/0x490
[  212.931454]  ? lockdep_hardirqs_on+0x260/0x260
[  212.931589]  ? netlink_deliver_tap+0xab/0x5a0
[  212.931717]  ? match_held_lock+0x1b/0x240
[  212.931844]  netlink_rcv_skb+0xd0/0x200
[  212.931958]  ? rtnl_dellink+0x490/0x490
[  212.932079]  ? netlink_ack+0x440/0x440
[  212.932205]  ? netlink_deliver_tap+0x161/0x5a0
[  212.932335]  ? lock_downgrade+0x360/0x360
[  212.932457]  ? lock_acquire+0xe5/0x210
[  212.932579]  netlink_unicast+0x296/0x350
[  212.932705]  ? netlink_attachskb+0x390/0x390
[  212.932834]  ? _copy_from_iter_full+0xe0/0x3a0
[  212.932976]  netlink_sendmsg+0x394/0x600
[  212.937998]  ? netlink_unicast+0x350/0x350
[  212.943033]  ? move_addr_to_kernel.part.0+0x90/0x90
[  212.948115]  ? netlink_unicast+0x350/0x350
[  212.953185]  sock_sendmsg+0x96/0xa0
[  212.958099]  ___sys_sendmsg+0x482/0x520
[  212.962881]  ? match_held_lock+0x1b/0x240
[  212.967618]  ? copy_msghdr_from_user+0x250/0x250
[  212.972337]  ? lock_downgrade+0x360/0x360
[  212.976973]  ? rwlock_bug.part.0+0x60/0x60
[  212.981548]  ? __mod_node_page_state+0x1f/0xa0
[  212.986060]  ? match_held_lock+0x1b/0x240
[  212.990567]  ? find_held_lock+0x85/0xa0
[  212.994989]  ? do_user_addr_fault+0x349/0x5b0
[  212.999387]  ? lock_downgrade+0x360/0x360
[  213.003713]  ? find_held_lock+0x85/0xa0
[  213.007972]  ? __fget_light+0xa1/0xf0
[  213.012143]  ? sockfd_lookup_light+0x91/0xb0
[  213.016165]  __sys_sendmsg+0xba/0x130
[  213.020040]  ? __sys_sendmsg_sock+0xb0/0xb0
[  213.023870]  ? handle_mm_fault+0x337/0x470
[  213.027592]  ? page_fault+0x8/0x30
[  213.031316]  ? lockdep_hardirqs_off+0xbe/0x100
[  213.034999]  ? mark_held_locks+0x24/0x90
[  213.038671]  ? do_syscall_64+0x1e/0xe0
[  213.042297]  do_syscall_64+0x74/0xe0
[  213.045828]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  213.049354] RIP: 0033:0x7fe7c527c7b8
[  213.052792] Code: 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 65 8f 0c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f
0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 89 54
[  213.060269] RSP: 002b:00007ffc3f7908a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  213.064144] RAX: ffffffffffffffda RBX: 000000005d34716f RCX: 00007fe7c527c7b8
[  213.068094] RDX: 0000000000000000 RSI: 00007ffc3f790910 RDI: 0000000000000003
[  213.072109] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007fe7c5340cc0
[  213.076113] R10: 0000000000404ec2 R11: 0000000000000246 R12: 0000000000000080
[  213.080146] R13: 0000000000480640 R14: 0000000000000080 R15: 0000000000000000
[  213.084147] Modules linked in: act_gact cls_flower sch_ingress nfsv3 nfs_acl nfs lockd grace fscache bridge stp llc sunrpc intel_rapl_msr intel_rapl_common
[<1;69;32Msb_edac rdma_ucm rdma_cm x86_pkg_temp_thermal iw_cm intel_powerclamp ib_cm coretemp kvm_intel kvm irqbypass mlx5_ib ib_uverbs ib_core crct10dif_pclmul crc32_pc
lmul crc32c_intel ghash_clmulni_intel mlx5_core intel_cstate intel_uncore iTCO_wdt igb iTCO_vendor_support mlxfw mei_me ptp ses intel_rapl_perf mei pcspkr ipmi
_ssif i2c_i801 joydev enclosure pps_core lpc_ich ioatdma wmi dca ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad ast i2c_algo_bit drm_vram_helpe
r ttm drm_kms_helper drm mpt3sas raid_class scsi_transport_sas
[  213.112326] CR2: 0000000000000010
[  213.117429] ---[ end trace adb58eb0a4ee6283 ]---

Verify that q pointer is not NULL before setting the 'flags' field.

Fixes: 3f05e6886a59 ("net_sched: unset TCQ_F_CAN_BYPASS when adding filters")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_api.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 3374903d5f96a..4159bcb479c6b 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1325,7 +1325,9 @@ replay:
 			tcf_chain_tp_insert(chain, &chain_info, tp);
 		tfilter_notify(net, skb, n, tp, block, q, parent, fh,
 			       RTM_NEWTFILTER, false);
-		q->flags &= ~TCQ_F_CAN_BYPASS;
+		/* q pointer is NULL for shared blocks */
+		if (q)
+			q->flags &= ~TCQ_F_CAN_BYPASS;
 	} else {
 		if (tp_created)
 			tcf_proto_destroy(tp, NULL);
-- 
GitLab


From 64f4694072aa4ac23eb9ad2feeb0a178d2a054da Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 28 Jul 2019 08:29:30 +0200
Subject: [PATCH 1103/1835] Linux 4.19.62

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index b16485c580d76..a4463d880ae2e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 61
+SUBLEVEL = 62
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 2b3cf6c405f000c7b25953ab138d4dca0acaf74f Mon Sep 17 00:00:00 2001
From: allo-com <jaikumar@cem-solutions.net>
Date: Mon, 29 Jul 2019 15:06:57 +0530
Subject: [PATCH 1104/1835] codecs: Correct Katana minimum volume

Update Katana minimum volume to get the exact 0.5 dB value in each step.

Signed-off-by: Sudeep Kumar <sudeepkumar@cem-solutions.net>
---
 sound/soc/bcm/allo-katana-codec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/bcm/allo-katana-codec.c b/sound/soc/bcm/allo-katana-codec.c
index 228531dd785ee..b0aebd40fe5ea 100644
--- a/sound/soc/bcm/allo-katana-codec.c
+++ b/sound/soc/bcm/allo-katana-codec.c
@@ -126,7 +126,7 @@ static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_deemphasis,
 				  katana_codec_deemphasis_texts,
 				  katana_codec_deemphasis_values);
 
-static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12700, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12750, 0);
 
 static const struct snd_kcontrol_new katana_codec_controls[] = {
 	SOC_DOUBLE_R_TLV("Master Playback Volume", KATANA_CODEC_VOLUME_1,
-- 
GitLab


From 49fb03de361d9e77be31279a99684074199ffdcb Mon Sep 17 00:00:00 2001
From: Sunil Muthuswamy <sunilmut@microsoft.com>
Date: Mon, 17 Jun 2019 19:26:25 +0000
Subject: [PATCH 1105/1835] hvsock: fix epollout hang from race condition

[ Upstream commit cb359b60416701c8bed82fec79de25a144beb893 ]

Currently, hvsock can enter into a state where epoll_wait on EPOLLOUT will
not return even when the hvsock socket is writable, under some race
condition. This can happen under the following sequence:
- fd = socket(hvsocket)
- fd_out = dup(fd)
- fd_in = dup(fd)
- start a writer thread that writes data to fd_out with a combination of
  epoll_wait(fd_out, EPOLLOUT) and
- start a reader thread that reads data from fd_in with a combination of
  epoll_wait(fd_in, EPOLLIN)
- On the host, there are two threads that are reading/writing data to the
  hvsocket

stack:
hvs_stream_has_space
hvs_notify_poll_out
vsock_poll
sock_poll
ep_poll

Race condition:
check for epollout from ep_poll():
	assume no writable space in the socket
	hvs_stream_has_space() returns 0
check for epollin from ep_poll():
	assume socket has some free space < HVS_PKT_LEN(HVS_SEND_BUF_SIZE)
	hvs_stream_has_space() will clear the channel pending send size
	host will not notify the guest because the pending send size has
		been cleared and so the hvsocket will never mark the
		socket writable

Now, the EPOLLOUT will never return even if the socket write buffer is
empty.

The fix is to set the pending size to the default size and never change it.
This way the host will always notify the guest whenever the writable space
is bigger than the pending size. The host is already optimized to *only*
notify the guest when the pending size threshold boundary is crossed and
not everytime.

This change also reduces the cpu usage somewhat since hv_stream_has_space()
is in the hotpath of send:
vsock_stream_sendmsg()->hv_stream_has_space()
Earlier hv_stream_has_space was setting/clearing the pending size on every
call.

Signed-off-by: Sunil Muthuswamy <sunilmut@microsoft.com>
Reviewed-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/vmw_vsock/hyperv_transport.c | 44 ++++++++------------------------
 1 file changed, 11 insertions(+), 33 deletions(-)

diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index a827547aa102b..b131561a94692 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -217,18 +217,6 @@ static void hvs_set_channel_pending_send_size(struct vmbus_channel *chan)
 	set_channel_pending_send_size(chan,
 				      HVS_PKT_LEN(HVS_SEND_BUF_SIZE));
 
-	/* See hvs_stream_has_space(): we must make sure the host has seen
-	 * the new pending send size, before we can re-check the writable
-	 * bytes.
-	 */
-	virt_mb();
-}
-
-static void hvs_clear_channel_pending_send_size(struct vmbus_channel *chan)
-{
-	set_channel_pending_send_size(chan, 0);
-
-	/* Ditto */
 	virt_mb();
 }
 
@@ -298,9 +286,6 @@ static void hvs_channel_cb(void *ctx)
 	if (hvs_channel_readable(chan))
 		sk->sk_data_ready(sk);
 
-	/* See hvs_stream_has_space(): when we reach here, the writable bytes
-	 * may be already less than HVS_PKT_LEN(HVS_SEND_BUF_SIZE).
-	 */
 	if (hv_get_bytes_to_write(&chan->outbound) > 0)
 		sk->sk_write_space(sk);
 }
@@ -328,8 +313,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
 
 	struct sockaddr_vm addr;
 	struct sock *sk, *new = NULL;
-	struct vsock_sock *vnew;
-	struct hvsock *hvs, *hvs_new;
+	struct vsock_sock *vnew = NULL;
+	struct hvsock *hvs = NULL;
+	struct hvsock *hvs_new = NULL;
 	int ret;
 
 	if_type = &chan->offermsg.offer.if_type;
@@ -388,6 +374,13 @@ static void hvs_open_connection(struct vmbus_channel *chan)
 	set_per_channel_state(chan, conn_from_host ? new : sk);
 	vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
 
+	/* Set the pending send size to max packet size to always get
+	 * notifications from the host when there is enough writable space.
+	 * The host is optimized to send notifications only when the pending
+	 * size boundary is crossed, and not always.
+	 */
+	hvs_set_channel_pending_send_size(chan);
+
 	if (conn_from_host) {
 		new->sk_state = TCP_ESTABLISHED;
 		sk->sk_ack_backlog++;
@@ -651,23 +644,8 @@ static s64 hvs_stream_has_data(struct vsock_sock *vsk)
 static s64 hvs_stream_has_space(struct vsock_sock *vsk)
 {
 	struct hvsock *hvs = vsk->trans;
-	struct vmbus_channel *chan = hvs->chan;
-	s64 ret;
-
-	ret = hvs_channel_writable_bytes(chan);
-	if (ret > 0)  {
-		hvs_clear_channel_pending_send_size(chan);
-	} else {
-		/* See hvs_channel_cb() */
-		hvs_set_channel_pending_send_size(chan);
-
-		/* Re-check the writable bytes to avoid race */
-		ret = hvs_channel_writable_bytes(chan);
-		if (ret > 0)
-			hvs_clear_channel_pending_send_size(chan);
-	}
 
-	return ret;
+	return hvs_channel_writable_bytes(hvs->chan);
 }
 
 static u64 hvs_stream_rcvhiwat(struct vsock_sock *vsk)
-- 
GitLab


From 586946ce83e4fb55c08381c6715fa743b2801363 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Tue, 26 Feb 2019 10:11:53 +0200
Subject: [PATCH 1106/1835] drm/panel: simple: Fix panel_simple_dsi_probe

[ Upstream commit 7ad9db66fafb0f0ad53fd2a66217105da5ddeffe ]

In case mipi_dsi_attach() fails remove the registered panel to avoid added
panel without corresponding device.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190226081153.31334-1-peter.ujfalusi@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 97964f7f2acee..b1d41c4921dd5 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -2803,7 +2803,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi)
 	dsi->format = desc->format;
 	dsi->lanes = desc->lanes;
 
-	return mipi_dsi_attach(dsi);
+	err = mipi_dsi_attach(dsi);
+	if (err) {
+		struct panel_simple *panel = dev_get_drvdata(&dsi->dev);
+
+		drm_panel_remove(&panel->base);
+	}
+
+	return err;
 }
 
 static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi)
-- 
GitLab


From 302e4cdca1f4b46c0506489d1a4042f950b427c1 Mon Sep 17 00:00:00 2001
From: Fabien Dessenne <fabien.dessenne@st.com>
Date: Wed, 24 Apr 2019 14:51:25 +0200
Subject: [PATCH 1107/1835] iio: adc: stm32-dfsdm: manage the get_irq error
 case

[ Upstream commit 3e53ef91f826957dec013c47707ffc1bb42b42d7 ]

During probe, check the "get_irq" error value.

Signed-off-by: Fabien Dessenne <fabien.dessenne@st.com>
Acked-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/stm32-dfsdm-adc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
index fcd4a1c00ca05..15a115210108d 100644
--- a/drivers/iio/adc/stm32-dfsdm-adc.c
+++ b/drivers/iio/adc/stm32-dfsdm-adc.c
@@ -1144,6 +1144,12 @@ static int stm32_dfsdm_adc_probe(struct platform_device *pdev)
 	 * So IRQ associated to filter instance 0 is dedicated to the Filter 0.
 	 */
 	irq = platform_get_irq(pdev, 0);
+	if (irq < 0) {
+		if (irq != -EPROBE_DEFER)
+			dev_err(dev, "Failed to get IRQ: %d\n", irq);
+		return irq;
+	}
+
 	ret = devm_request_irq(dev, irq, stm32_dfsdm_irq,
 			       0, pdev->name, adc);
 	if (ret < 0) {
-- 
GitLab


From b59f7650a507c1bb389070d82b4e2c0999004609 Mon Sep 17 00:00:00 2001
From: Fabien Dessenne <fabien.dessenne@st.com>
Date: Wed, 24 Apr 2019 14:51:26 +0200
Subject: [PATCH 1108/1835] iio: adc: stm32-dfsdm: missing error case during
 probe

[ Upstream commit d2fc0156963cae8f1eec8e2dd645fbbf1e1c1c8e ]

During probe, check the devm_ioremap_resource() error value.
Also return the devm_clk_get() error value instead of -EINVAL.

Signed-off-by: Fabien Dessenne <fabien.dessenne@st.com>
Acked-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/stm32-dfsdm-core.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/stm32-dfsdm-core.c b/drivers/iio/adc/stm32-dfsdm-core.c
index bf089f5d62253..941630615e885 100644
--- a/drivers/iio/adc/stm32-dfsdm-core.c
+++ b/drivers/iio/adc/stm32-dfsdm-core.c
@@ -213,6 +213,8 @@ static int stm32_dfsdm_parse_of(struct platform_device *pdev,
 	}
 	priv->dfsdm.phys_base = res->start;
 	priv->dfsdm.base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(priv->dfsdm.base))
+		return PTR_ERR(priv->dfsdm.base);
 
 	/*
 	 * "dfsdm" clock is mandatory for DFSDM peripheral clocking.
@@ -222,8 +224,10 @@ static int stm32_dfsdm_parse_of(struct platform_device *pdev,
 	 */
 	priv->clk = devm_clk_get(&pdev->dev, "dfsdm");
 	if (IS_ERR(priv->clk)) {
-		dev_err(&pdev->dev, "No stm32_dfsdm_clk clock found\n");
-		return -EINVAL;
+		ret = PTR_ERR(priv->clk);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Failed to get clock (%d)\n", ret);
+		return ret;
 	}
 
 	priv->aclk = devm_clk_get(&pdev->dev, "audio");
-- 
GitLab


From 19755a124f4c3bc3a5c41f10df066b813f07a5ab Mon Sep 17 00:00:00 2001
From: Quentin Deslandes <quentin.deslandes@itdev.co.uk>
Date: Mon, 20 May 2019 16:39:04 +0000
Subject: [PATCH 1109/1835] staging: vt6656: use meaningful error code during
 buffer allocation

[ Upstream commit d8c2869300ab5f7a19bf6f5a04fe473c5c9887e3 ]

Check on called function's returned value for error and return 0 on
success or a negative errno value on error instead of a boolean value.

Signed-off-by: Quentin Deslandes <quentin.deslandes@itdev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/vt6656/main_usb.c | 42 ++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 14 deletions(-)

diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index ccafcc2c87ac9..70433f756d8e1 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -402,16 +402,19 @@ static void vnt_free_int_bufs(struct vnt_private *priv)
 	kfree(priv->int_buf.data_buf);
 }
 
-static bool vnt_alloc_bufs(struct vnt_private *priv)
+static int vnt_alloc_bufs(struct vnt_private *priv)
 {
+	int ret = 0;
 	struct vnt_usb_send_context *tx_context;
 	struct vnt_rcb *rcb;
 	int ii;
 
 	for (ii = 0; ii < priv->num_tx_context; ii++) {
 		tx_context = kmalloc(sizeof(*tx_context), GFP_KERNEL);
-		if (!tx_context)
+		if (!tx_context) {
+			ret = -ENOMEM;
 			goto free_tx;
+		}
 
 		priv->tx_context[ii] = tx_context;
 		tx_context->priv = priv;
@@ -419,16 +422,20 @@ static bool vnt_alloc_bufs(struct vnt_private *priv)
 
 		/* allocate URBs */
 		tx_context->urb = usb_alloc_urb(0, GFP_KERNEL);
-		if (!tx_context->urb)
+		if (!tx_context->urb) {
+			ret = -ENOMEM;
 			goto free_tx;
+		}
 
 		tx_context->in_use = false;
 	}
 
 	for (ii = 0; ii < priv->num_rcb; ii++) {
 		priv->rcb[ii] = kzalloc(sizeof(*priv->rcb[ii]), GFP_KERNEL);
-		if (!priv->rcb[ii])
+		if (!priv->rcb[ii]) {
+			ret = -ENOMEM;
 			goto free_rx_tx;
+		}
 
 		rcb = priv->rcb[ii];
 
@@ -436,39 +443,46 @@ static bool vnt_alloc_bufs(struct vnt_private *priv)
 
 		/* allocate URBs */
 		rcb->urb = usb_alloc_urb(0, GFP_KERNEL);
-		if (!rcb->urb)
+		if (!rcb->urb) {
+			ret = -ENOMEM;
 			goto free_rx_tx;
+		}
 
 		rcb->skb = dev_alloc_skb(priv->rx_buf_sz);
-		if (!rcb->skb)
+		if (!rcb->skb) {
+			ret = -ENOMEM;
 			goto free_rx_tx;
+		}
 
 		rcb->in_use = false;
 
 		/* submit rx urb */
-		if (vnt_submit_rx_urb(priv, rcb))
+		ret = vnt_submit_rx_urb(priv, rcb);
+		if (ret)
 			goto free_rx_tx;
 	}
 
 	priv->interrupt_urb = usb_alloc_urb(0, GFP_KERNEL);
-	if (!priv->interrupt_urb)
+	if (!priv->interrupt_urb) {
+		ret = -ENOMEM;
 		goto free_rx_tx;
+	}
 
 	priv->int_buf.data_buf = kmalloc(MAX_INTERRUPT_SIZE, GFP_KERNEL);
 	if (!priv->int_buf.data_buf) {
-		usb_free_urb(priv->interrupt_urb);
-		goto free_rx_tx;
+		ret = -ENOMEM;
+		goto free_rx_tx_urb;
 	}
 
-	return true;
+	return 0;
 
+free_rx_tx_urb:
+	usb_free_urb(priv->interrupt_urb);
 free_rx_tx:
 	vnt_free_rx_bufs(priv);
-
 free_tx:
 	vnt_free_tx_bufs(priv);
-
-	return false;
+	return ret;
 }
 
 static void vnt_tx_80211(struct ieee80211_hw *hw,
-- 
GitLab


From b0084c1b505802f0a410d4beef58336a6114f4b6 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Tue, 14 May 2019 14:38:38 -0700
Subject: [PATCH 1110/1835] usb: core: hub: Disable hub-initiated U1/U2

[ Upstream commit 561759292774707b71ee61aecc07724905bb7ef1 ]

If the device rejects the control transfer to enable device-initiated
U1/U2 entry, then the device will not initiate U1/U2 transition. To
improve the performance, the downstream port should not initate
transition to U1/U2 to avoid the delay from the device link command
response (no packet can be transmitted while waiting for a response from
the device). If the device has some quirks and does not implement U1/U2,
it may reject all the link state change requests, and the downstream
port may resend and flood the bus with more requests. This will affect
the device performance even further. This patch disables the
hub-initated U1/U2 if the device-initiated U1/U2 entry fails.

Reference: USB 3.2 spec 7.2.4.2.3

Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/hub.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f4e8e869649a5..8018f813972e0 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3961,6 +3961,9 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
  * control transfers to set the hub timeout or enable device-initiated U1/U2
  * will be successful.
  *
+ * If the control transfer to enable device-initiated U1/U2 entry fails, then
+ * hub-initiated U1/U2 will be disabled.
+ *
  * If we cannot set the parent hub U1/U2 timeout, we attempt to let the xHCI
  * driver know about it.  If that call fails, it should be harmless, and just
  * take up more slightly more bus bandwidth for unnecessary U1/U2 exit latency.
@@ -4015,23 +4018,24 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
 		 * host know that this link state won't be enabled.
 		 */
 		hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
-	} else {
-		/* Only a configured device will accept the Set Feature
-		 * U1/U2_ENABLE
-		 */
-		if (udev->actconfig)
-			usb_set_device_initiated_lpm(udev, state, true);
+		return;
+	}
 
-		/* As soon as usb_set_lpm_timeout(timeout) returns 0, the
-		 * hub-initiated LPM is enabled. Thus, LPM is enabled no
-		 * matter the result of usb_set_device_initiated_lpm().
-		 * The only difference is whether device is able to initiate
-		 * LPM.
-		 */
+	/* Only a configured device will accept the Set Feature
+	 * U1/U2_ENABLE
+	 */
+	if (udev->actconfig &&
+	    usb_set_device_initiated_lpm(udev, state, true) == 0) {
 		if (state == USB3_LPM_U1)
 			udev->usb3_lpm_u1_enabled = 1;
 		else if (state == USB3_LPM_U2)
 			udev->usb3_lpm_u2_enabled = 1;
+	} else {
+		/* Don't request U1/U2 entry if the device
+		 * cannot transition to U1/U2.
+		 */
+		usb_set_lpm_timeout(udev, state, 0);
+		hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
 	}
 }
 
-- 
GitLab


From a9dfb6e43677ddf27d33339597fc9ed9ee706272 Mon Sep 17 00:00:00 2001
From: Serge Semin <fancer.lancer@gmail.com>
Date: Tue, 14 May 2019 13:14:12 +0300
Subject: [PATCH 1111/1835] tty: max310x: Fix invalid baudrate divisors
 calculator

[ Upstream commit 35240ba26a932b279a513f66fa4cabfd7af55221 ]

Current calculator doesn't do it' job quite correct. First of all the
max310x baud-rates generator supports the divisor being less than 16.
In this case the x2/x4 modes can be used to double or quadruple
the reference frequency. But the current baud-rate setter function
just filters all these modes out by the first condition and setups
these modes only if there is a clocks-baud division remainder. The former
doesn't seem right at all, since enabling the x2/x4 modes causes the line
noise tolerance reduction and should be only used as a last resort to
enable a requested too high baud-rate.

Finally the fraction is supposed to be calculated from D = Fref/(c*baud)
formulae, but not from D % 16, which causes the precision loss. So to speak
the current baud-rate calculator code works well only if the baud perfectly
fits to the uart reference input frequency.

Lets fix the calculator by implementing the algo fully compliant with
the fractional baud-rate generator described in the datasheet:
D = Fref / (c*baud), where c={16,8,4} is the x1/x2/x4 rate mode
respectively, Fref - reference input frequency. The divisor fraction is
calculated from the same formulae, but making sure it is found with a
resolution of 0.0625 (four bits).

Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/max310x.c | 51 ++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 20 deletions(-)

diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index 38c48a02b9206..bd3e6cf81af5c 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -491,37 +491,48 @@ static bool max310x_reg_precious(struct device *dev, unsigned int reg)
 
 static int max310x_set_baud(struct uart_port *port, int baud)
 {
-	unsigned int mode = 0, clk = port->uartclk, div = clk / baud;
+	unsigned int mode = 0, div = 0, frac = 0, c = 0, F = 0;
 
-	/* Check for minimal value for divider */
-	if (div < 16)
-		div = 16;
-
-	if (clk % baud && (div / 16) < 0x8000) {
+	/*
+	 * Calculate the integer divisor first. Select a proper mode
+	 * in case if the requested baud is too high for the pre-defined
+	 * clocks frequency.
+	 */
+	div = port->uartclk / baud;
+	if (div < 8) {
+		/* Mode x4 */
+		c = 4;
+		mode = MAX310X_BRGCFG_4XMODE_BIT;
+	} else if (div < 16) {
 		/* Mode x2 */
+		c = 8;
 		mode = MAX310X_BRGCFG_2XMODE_BIT;
-		clk = port->uartclk * 2;
-		div = clk / baud;
-
-		if (clk % baud && (div / 16) < 0x8000) {
-			/* Mode x4 */
-			mode = MAX310X_BRGCFG_4XMODE_BIT;
-			clk = port->uartclk * 4;
-			div = clk / baud;
-		}
+	} else {
+		c = 16;
 	}
 
-	max310x_port_write(port, MAX310X_BRGDIVMSB_REG, (div / 16) >> 8);
-	max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div / 16);
-	max310x_port_write(port, MAX310X_BRGCFG_REG, (div % 16) | mode);
+	/* Calculate the divisor in accordance with the fraction coefficient */
+	div /= c;
+	F = c*baud;
+
+	/* Calculate the baud rate fraction */
+	if (div > 0)
+		frac = (16*(port->uartclk % F)) / F;
+	else
+		div = 1;
+
+	max310x_port_write(port, MAX310X_BRGDIVMSB_REG, div >> 8);
+	max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div);
+	max310x_port_write(port, MAX310X_BRGCFG_REG, frac | mode);
 
-	return DIV_ROUND_CLOSEST(clk, div);
+	/* Return the actual baud rate we just programmed */
+	return (16*port->uartclk) / (c*(16*div + frac));
 }
 
 static int max310x_update_best_err(unsigned long f, long *besterr)
 {
 	/* Use baudrate 115200 for calculate error */
-	long err = f % (115200 * 16);
+	long err = f % (460800 * 16);
 
 	if ((*besterr < 0) || (*besterr > err)) {
 		*besterr = err;
-- 
GitLab


From c901780d92946da11b67d4898e6e323fab43c3b7 Mon Sep 17 00:00:00 2001
From: Wen Yang <wen.yang99@zte.com.cn>
Date: Mon, 15 Apr 2019 14:24:02 +0800
Subject: [PATCH 1112/1835] pinctrl: rockchip: fix leaked of_node references

[ Upstream commit 3c89c70634bb0b6f48512de873e7a45c7e1fbaa5 ]

The call to of_parse_phandle returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
./drivers/pinctrl/pinctrl-rockchip.c:3221:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3196, but without a corresponding object release within this function.
./drivers/pinctrl/pinctrl-rockchip.c:3223:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3196, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Heiko Stuebner <heiko@sntech.de>
Cc: linux-gpio@vger.kernel.org
Cc: linux-rockchip@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-rockchip.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index f4a61429e06e7..8d83817935dae 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -3172,6 +3172,7 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank,
 						    base,
 						    &rockchip_regmap_config);
 		}
+		of_node_put(node);
 	}
 
 	bank->irq = irq_of_parse_and_map(bank->of_node, 0);
-- 
GitLab


From 08b0bcc8076b63778a67b3ab32eeda48e02de1b9 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Wed, 22 May 2019 12:17:11 +0000
Subject: [PATCH 1113/1835] tty: serial: cpm_uart - fix init when SMC is
 relocated

[ Upstream commit 06aaa3d066db87e8478522d910285141d44b1e58 ]

SMC relocation can also be activated earlier by the bootloader,
so the driver's behaviour cannot rely on selected kernel config.

When the SMC is relocated, CPM_CR_INIT_TRX cannot be used.

But the only thing CPM_CR_INIT_TRX does is to clear the
rstate and tstate registers, so this can be done manually,
even when SMC is not relocated.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Fixes: 9ab921201444 ("cpm_uart: fix non-console port startup bug")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/cpm_uart/cpm_uart_core.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index e5389591bb4f1..ad40c75bb58f8 100644
--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -407,7 +407,16 @@ static int cpm_uart_startup(struct uart_port *port)
 			clrbits16(&pinfo->sccp->scc_sccm, UART_SCCM_RX);
 		}
 		cpm_uart_initbd(pinfo);
-		cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
+		if (IS_SMC(pinfo)) {
+			out_be32(&pinfo->smcup->smc_rstate, 0);
+			out_be32(&pinfo->smcup->smc_tstate, 0);
+			out_be16(&pinfo->smcup->smc_rbptr,
+				 in_be16(&pinfo->smcup->smc_rbase));
+			out_be16(&pinfo->smcup->smc_tbptr,
+				 in_be16(&pinfo->smcup->smc_tbase));
+		} else {
+			cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
+		}
 	}
 	/* Install interrupt handler. */
 	retval = request_irq(port->irq, cpm_uart_int, 0, "cpm_uart", port);
@@ -861,16 +870,14 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
 	         (u8 __iomem *)pinfo->tx_bd_base - DPRAM_BASE);
 
 /*
- *  In case SMC1 is being relocated...
+ *  In case SMC is being relocated...
  */
-#if defined (CONFIG_I2C_SPI_SMC1_UCODE_PATCH)
 	out_be16(&up->smc_rbptr, in_be16(&pinfo->smcup->smc_rbase));
 	out_be16(&up->smc_tbptr, in_be16(&pinfo->smcup->smc_tbase));
 	out_be32(&up->smc_rstate, 0);
 	out_be32(&up->smc_tstate, 0);
 	out_be16(&up->smc_brkcr, 1);              /* number of break chars */
 	out_be16(&up->smc_brkec, 0);
-#endif
 
 	/* Set up the uart parameters in the
 	 * parameter ram.
@@ -884,8 +891,6 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
 	out_be16(&up->smc_brkec, 0);
 	out_be16(&up->smc_brkcr, 1);
 
-	cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
-
 	/* Set UART mode, 8 bit, no parity, one stop.
 	 * Enable receive and transmit.
 	 */
-- 
GitLab


From 147137f86b5b72aea3af4edb2e66f10c0baa841e Mon Sep 17 00:00:00 2001
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Date: Tue, 16 Apr 2019 10:30:29 -0400
Subject: [PATCH 1114/1835] drm/amd/display: Fill prescale_params->scale for
 RGB565

[ Upstream commit 1352c779cb74d427f4150cbe779a2f7886f70cae ]

[Why]
An assertion is thrown when using SURFACE_PIXEL_FORMAT_GRPH_RGB565
formats on DCE since the prescale_params->scale wasn't being filled.

Found by a dmesg-fail when running the
igt@kms_plane@pixel-format-pipe-a-planes test on Baffin.

[How]
Fill in the scale parameter.

Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Reviewed-by: Roman Li <Roman.Li@amd.com>
Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 53ccacf99eca4..c3ad2bbec1a52 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -242,6 +242,9 @@ static void build_prescale_params(struct ipp_prescale_params *prescale_params,
 	prescale_params->mode = IPP_PRESCALE_MODE_FIXED_UNSIGNED;
 
 	switch (plane_state->format) {
+	case SURFACE_PIXEL_FORMAT_GRPH_RGB565:
+		prescale_params->scale = 0x2082;
+		break;
 	case SURFACE_PIXEL_FORMAT_GRPH_ARGB8888:
 	case SURFACE_PIXEL_FORMAT_GRPH_ABGR8888:
 		prescale_params->scale = 0x2020;
-- 
GitLab


From c242a531bb068c91bea7454353206330423ec1a6 Mon Sep 17 00:00:00 2001
From: Tiecheng Zhou <Tiecheng.Zhou@amd.com>
Date: Tue, 14 May 2019 10:03:35 +0800
Subject: [PATCH 1115/1835] drm/amdgpu/sriov: Need to initialize the
 HDP_NONSURFACE_BAStE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fe2b5323d2c3cedaa3bf943dc7a0d233c853c914 ]

it requires to initialize HDP_NONSURFACE_BASE, so as to avoid
using the value left by a previous VM under sriov scenario.

v2: it should not hurt baremetal, generalize it for both sriov
and baremetal

Signed-off-by: Emily Deng <Emily.Deng@amd.com>
Signed-off-by: Tiecheng Zhou <Tiecheng.Zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 72f8018fa2a83..ede27dab675fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -1037,6 +1037,9 @@ static int gmc_v9_0_gart_enable(struct amdgpu_device *adev)
 	tmp = RREG32_SOC15(HDP, 0, mmHDP_HOST_PATH_CNTL);
 	WREG32_SOC15(HDP, 0, mmHDP_HOST_PATH_CNTL, tmp);
 
+	WREG32_SOC15(HDP, 0, mmHDP_NONSURFACE_BASE, (adev->gmc.vram_start >> 8));
+	WREG32_SOC15(HDP, 0, mmHDP_NONSURFACE_BASE_HI, (adev->gmc.vram_start >> 40));
+
 	/* After HDP is initialized, flush HDP.*/
 	adev->nbio_funcs->hdp_flush(adev, NULL);
 
-- 
GitLab


From 6b1d2871fe369cb65f087cd300bad6af50764ac7 Mon Sep 17 00:00:00 2001
From: Paul Hsieh <paul.hsieh@amd.com>
Date: Fri, 3 May 2019 23:50:10 +0800
Subject: [PATCH 1116/1835] drm/amd/display: Disable ABM before destroy ABM
 struct

[ Upstream commit 1090d58d4815b1fcd95a80987391006c86398b4c ]

[Why]
When disable driver, OS will set backlight optimization
then do stop device.  But this flag will cause driver to
enable ABM when driver disabled.

[How]
Send ABM disable command before destroy ABM construct

Signed-off-by: Paul Hsieh <paul.hsieh@amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dce/dce_abm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
index 29294db1a96b7..070ab56a8aca7 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
@@ -474,6 +474,8 @@ void dce_abm_destroy(struct abm **abm)
 {
 	struct dce_abm *abm_dce = TO_DCE_ABM(*abm);
 
+	abm_dce->base.funcs->set_abm_immediate_disable(*abm);
+
 	kfree(abm_dce);
 	*abm = NULL;
 }
-- 
GitLab


From db64bc13944013357d231cbf9d1aee798d7b9892 Mon Sep 17 00:00:00 2001
From: Oak Zeng <ozeng@amd.com>
Date: Tue, 27 Nov 2018 22:08:25 -0600
Subject: [PATCH 1117/1835] drm/amdkfd: Fix a potential memory leak

[ Upstream commit e73390d181103a19e1111ec2f25559a0570e9fe0 ]

Free mqd_mem_obj it GTT buffer allocation for MQD+control stack fails.

Signed-off-by: Oak Zeng <ozeng@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
index 0cedb37cf5135..985bebde5a343 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
@@ -75,6 +75,7 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
 	struct v9_mqd *m;
 	struct kfd_dev *kfd = mm->dev;
 
+	*mqd_mem_obj = NULL;
 	/* From V9,  for CWSR, the control stack is located on the next page
 	 * boundary after the mqd, we will use the gtt allocation function
 	 * instead of sub-allocation function.
@@ -92,8 +93,10 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
 	} else
 		retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct v9_mqd),
 				mqd_mem_obj);
-	if (retval != 0)
+	if (retval) {
+		kfree(*mqd_mem_obj);
 		return -ENOMEM;
+	}
 
 	m = (struct v9_mqd *) (*mqd_mem_obj)->cpu_ptr;
 	addr = (*mqd_mem_obj)->gpu_addr;
-- 
GitLab


From 210dfe6309112dd028bf06561b828a749b6e1169 Mon Sep 17 00:00:00 2001
From: Oak Zeng <Oak.Zeng@amd.com>
Date: Fri, 8 Feb 2019 15:44:35 -0600
Subject: [PATCH 1118/1835] drm/amdkfd: Fix sdma queue map issue

[ Upstream commit 065e4bdfa1f3ab2884c110394d8b7e7ebe3b988c ]

Previous codes assumes there are two sdma engines.
This is not true e.g., Raven only has 1 SDMA engine.
Fix the issue by using sdma engine number info in
device_info.

Signed-off-by: Oak Zeng <Oak.Zeng@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/amdkfd/kfd_device_queue_manager.c | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 4f22e745df51b..189212cb35475 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1268,12 +1268,17 @@ int amdkfd_fence_wait_timeout(unsigned int *fence_addr,
 	return 0;
 }
 
-static int unmap_sdma_queues(struct device_queue_manager *dqm,
-				unsigned int sdma_engine)
+static int unmap_sdma_queues(struct device_queue_manager *dqm)
 {
-	return pm_send_unmap_queue(&dqm->packets, KFD_QUEUE_TYPE_SDMA,
-			KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0, false,
-			sdma_engine);
+	int i, retval = 0;
+
+	for (i = 0; i < dqm->dev->device_info->num_sdma_engines; i++) {
+		retval = pm_send_unmap_queue(&dqm->packets, KFD_QUEUE_TYPE_SDMA,
+			KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0, false, i);
+		if (retval)
+			return retval;
+	}
+	return retval;
 }
 
 /* dqm->lock mutex has to be locked before calling this function */
@@ -1312,10 +1317,8 @@ static int unmap_queues_cpsch(struct device_queue_manager *dqm,
 	pr_debug("Before destroying queues, sdma queue count is : %u\n",
 		dqm->sdma_queue_count);
 
-	if (dqm->sdma_queue_count > 0) {
-		unmap_sdma_queues(dqm, 0);
-		unmap_sdma_queues(dqm, 1);
-	}
+	if (dqm->sdma_queue_count > 0)
+		unmap_sdma_queues(dqm);
 
 	retval = pm_send_unmap_queue(&dqm->packets, KFD_QUEUE_TYPE_COMPUTE,
 			filter, filter_param, false, 0);
-- 
GitLab


From 2a18d76592e0d86c7fddcc6a7aa52509a2900f9d Mon Sep 17 00:00:00 2001
From: Gen Zhang <blackgod016574@gmail.com>
Date: Fri, 24 May 2019 10:32:22 +0800
Subject: [PATCH 1119/1835] drm/edid: Fix a missing-check bug in
 drm_load_edid_firmware()

[ Upstream commit 9f1f1a2dab38d4ce87a13565cf4dc1b73bef3a5f ]

In drm_load_edid_firmware(), fwstr is allocated by kstrdup(). And fwstr
is dereferenced in the following codes. However, memory allocation
functions such as kstrdup() may fail and returns NULL. Dereferencing
this null pointer may cause the kernel go wrong. Thus we should check
this kstrdup() operation.
Further, if kstrdup() returns NULL, we should return ERR_PTR(-ENOMEM) to
the caller site.

Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190524023222.GA5302@zhanggen-UX430UQ
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_edid_load.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
index a4915099aaa99..a0e107abc40d7 100644
--- a/drivers/gpu/drm/drm_edid_load.c
+++ b/drivers/gpu/drm/drm_edid_load.c
@@ -290,6 +290,8 @@ struct edid *drm_load_edid_firmware(struct drm_connector *connector)
 	 * the last one found one as a fallback.
 	 */
 	fwstr = kstrdup(edid_firmware, GFP_KERNEL);
+	if (!fwstr)
+		return ERR_PTR(-ENOMEM);
 	edidstr = fwstr;
 
 	while ((edidname = strsep(&edidstr, ","))) {
-- 
GitLab


From 49c7230d8f104abeab20eb6e4dd98a9870a20360 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Wed, 1 May 2019 11:00:16 -0600
Subject: [PATCH 1120/1835] PCI: Return error if cannot probe VF

[ Upstream commit 76002d8b48c4b08c9bd414517dd295e132ad910b ]

Commit 0e7df22401a3 ("PCI: Add sysfs sriov_drivers_autoprobe to control
VF driver binding") allows the user to specify that drivers for VFs of
a PF should not be probed, but it actually causes pci_device_probe() to
return success back to the driver core in this case.  Therefore by all
sysfs appearances the device is bound to a driver, the driver link from
the device exists as does the device link back from the driver, yet the
driver's probe function is never called on the device.  We also fail to
do any sort of cleanup when we're prohibited from probing the device,
the IRQ setup remains in place and we even hold a device reference.

Instead, abort with errno before any setup or references are taken when
pci_device_can_probe() prevents us from trying to probe the device.

Link: https://lore.kernel.org/lkml/155672991496.20698.4279330795743262888.stgit@gimli.home
Fixes: 0e7df22401a3 ("PCI: Add sysfs sriov_drivers_autoprobe to control VF driver binding")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci-driver.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 33f3f475e5c6b..956ee7527d2c4 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -414,6 +414,9 @@ static int pci_device_probe(struct device *dev)
 	struct pci_dev *pci_dev = to_pci_dev(dev);
 	struct pci_driver *drv = to_pci_driver(dev->driver);
 
+	if (!pci_device_can_probe(pci_dev))
+		return -ENODEV;
+
 	pci_assign_irq(pci_dev);
 
 	error = pcibios_alloc_irq(pci_dev);
@@ -421,12 +424,10 @@ static int pci_device_probe(struct device *dev)
 		return error;
 
 	pci_dev_get(pci_dev);
-	if (pci_device_can_probe(pci_dev)) {
-		error = __pci_device_probe(drv, pci_dev);
-		if (error) {
-			pcibios_free_irq(pci_dev);
-			pci_dev_put(pci_dev);
-		}
+	error = __pci_device_probe(drv, pci_dev);
+	if (error) {
+		pcibios_free_irq(pci_dev);
+		pci_dev_put(pci_dev);
 	}
 
 	return error;
-- 
GitLab


From 7af9abd7d6bd7df0aea2408d6541a011cfaa99b3 Mon Sep 17 00:00:00 2001
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
Date: Tue, 28 May 2019 11:27:44 +0300
Subject: [PATCH 1121/1835] drm/bridge: tc358767: read display_props in
 get_modes()

[ Upstream commit 3231573065ad4f4ecc5c9147b24f29f846dc0c2f ]

We need to know the link bandwidth to filter out modes we cannot
support, so we need to have read the display props before doing the
filtering.

To ensure we have up to date display props, call tc_get_display_props()
in the beginning of tc_connector_get_modes().

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190528082747.3631-22-tomi.valkeinen@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/tc358767.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 3915473587569..aaca5248da070 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1149,6 +1149,13 @@ static int tc_connector_get_modes(struct drm_connector *connector)
 	struct tc_data *tc = connector_to_tc(connector);
 	struct edid *edid;
 	unsigned int count;
+	int ret;
+
+	ret = tc_get_display_props(tc);
+	if (ret < 0) {
+		dev_err(tc->dev, "failed to read display props: %d\n", ret);
+		return 0;
+	}
 
 	if (tc->panel && tc->panel->funcs && tc->panel->funcs->get_modes) {
 		count = tc->panel->funcs->get_modes(tc->panel);
-- 
GitLab


From f9bfd6bd8223b0fccd12d39131a8c6d5d3333cc0 Mon Sep 17 00:00:00 2001
From: Jyri Sarha <jsarha@ti.com>
Date: Mon, 27 May 2019 16:47:54 +0300
Subject: [PATCH 1122/1835] drm/bridge: sii902x: pixel clock unit is 10kHz
 instead of 1kHz

[ Upstream commit 8dbfc5b65023b67397aca28e8adb25c819f6398c ]

The pixel clock unit in the first two registers (0x00 and 0x01) of
sii9022 is 10kHz, not 1kHz as in struct drm_display_mode. Division by
10 fixes the issue.

Signed-off-by: Jyri Sarha <jsarha@ti.com>
Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1a2a8eae0b9d6333e7a5841026bf7fd65c9ccd09.1558964241.git.jsarha@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/sii902x.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c
index e59a135423336..0cc6dbbcddcf5 100644
--- a/drivers/gpu/drm/bridge/sii902x.c
+++ b/drivers/gpu/drm/bridge/sii902x.c
@@ -261,10 +261,11 @@ static void sii902x_bridge_mode_set(struct drm_bridge *bridge,
 	struct regmap *regmap = sii902x->regmap;
 	u8 buf[HDMI_INFOFRAME_SIZE(AVI)];
 	struct hdmi_avi_infoframe frame;
+	u16 pixel_clock_10kHz = adj->clock / 10;
 	int ret;
 
-	buf[0] = adj->clock;
-	buf[1] = adj->clock >> 8;
+	buf[0] = pixel_clock_10kHz & 0xff;
+	buf[1] = pixel_clock_10kHz >> 8;
 	buf[2] = adj->vrefresh;
 	buf[3] = 0x00;
 	buf[4] = adj->hdisplay;
-- 
GitLab


From 4d14323a2eb556a9d06d0a956618662bc9dad1c1 Mon Sep 17 00:00:00 2001
From: Thierry Reding <treding@nvidia.com>
Date: Wed, 5 Jun 2019 10:46:05 +0200
Subject: [PATCH 1123/1835] gpu: host1x: Increase maximum DMA segment size

[ Upstream commit 1e390478cfb527e34c9ab89ba57212cb05c33c51 ]

Recent versions of the DMA API debug code have started to warn about
violations of the maximum DMA segment size. This is because the segment
size defaults to 64 KiB, which can easily be exceeded in large buffer
allocations such as used in DRM/KMS for framebuffers.

Technically the Tegra SMMU and ARM SMMU don't have a maximum segment
size (they map individual pages irrespective of whether they are
contiguous or not), so the choice of 4 MiB is a bit arbitrary here. The
maximum segment size is a 32-bit unsigned integer, though, so we can't
set it to the correct maximum size, which would be the size of the
aperture.

Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/host1x/bus.c | 3 +++
 include/linux/host1x.h   | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 815bdb42e3f03..0121fe7a4548d 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -423,6 +423,9 @@ static int host1x_device_add(struct host1x *host1x,
 
 	of_dma_configure(&device->dev, host1x->dev->of_node, true);
 
+	device->dev.dma_parms = &device->dma_parms;
+	dma_set_max_seg_size(&device->dev, SZ_4M);
+
 	err = host1x_device_parse_dt(device, driver);
 	if (err < 0) {
 		kfree(device);
diff --git a/include/linux/host1x.h b/include/linux/host1x.h
index 89110d896d72d..aef6e2f738027 100644
--- a/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@ -310,6 +310,8 @@ struct host1x_device {
 	struct list_head clients;
 
 	bool registered;
+
+	struct device_dma_parameters dma_parms;
 };
 
 static inline struct host1x_device *to_host1x_device(struct device *dev)
-- 
GitLab


From 26a66454541c8e57e4e96fb0e1fdb4342dba1616 Mon Sep 17 00:00:00 2001
From: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Wed, 5 Jun 2019 21:45:56 +0200
Subject: [PATCH 1124/1835] drm/crc-debugfs: User irqsafe spinlock in
 drm_crtc_add_crc_entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1882018a70e06376234133e69ede9dd743b4dbd9 ]

We can be called from any context, we need to be prepared.

Noticed this while hacking on vkms, which calls this function from a
normal worker. Which really upsets lockdep.

Cc: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Emil Velikov <emil.velikov@collabora.com>
Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190605194556.16744-1-daniel.vetter@ffwll.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_debugfs_crc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
index 99961192bf034..a334a82fcb366 100644
--- a/drivers/gpu/drm/drm_debugfs_crc.c
+++ b/drivers/gpu/drm/drm_debugfs_crc.c
@@ -379,8 +379,9 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
 	struct drm_crtc_crc *crc = &crtc->crc;
 	struct drm_crtc_crc_entry *entry;
 	int head, tail;
+	unsigned long flags;
 
-	spin_lock(&crc->lock);
+	spin_lock_irqsave(&crc->lock, flags);
 
 	/* Caller may not have noticed yet that userspace has stopped reading */
 	if (!crc->entries) {
@@ -411,7 +412,7 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
 	head = (head + 1) & (DRM_CRC_ENTRIES_NR - 1);
 	crc->head = head;
 
-	spin_unlock(&crc->lock);
+	spin_unlock_irqrestore(&crc->lock, flags);
 
 	wake_up_interruptible(&crc->wq);
 
-- 
GitLab


From 0a50a272389f58ad45e40c5ab018a8ba76a3ddc3 Mon Sep 17 00:00:00 2001
From: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Thu, 6 Jun 2019 23:15:44 +0200
Subject: [PATCH 1125/1835] drm/crc-debugfs: Also sprinkle irqrestore over
 early exits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d99004d7201aa653658ff2390d6e516567c96ebc ]

I. was. blind.

Caught with vkms, which has some really slow crc computation function.

Fixes: 1882018a70e0 ("drm/crc-debugfs: User irqsafe spinlock in drm_crtc_add_crc_entry")
Cc: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: Emil Velikov <emil.velikov@collabora.com>
Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190606211544.5389-1-daniel.vetter@ffwll.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_debugfs_crc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
index a334a82fcb366..c88e5ff41add6 100644
--- a/drivers/gpu/drm/drm_debugfs_crc.c
+++ b/drivers/gpu/drm/drm_debugfs_crc.c
@@ -385,7 +385,7 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
 
 	/* Caller may not have noticed yet that userspace has stopped reading */
 	if (!crc->entries) {
-		spin_unlock(&crc->lock);
+		spin_unlock_irqrestore(&crc->lock, flags);
 		return -EINVAL;
 	}
 
@@ -396,7 +396,7 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
 		bool was_overflow = crc->overflow;
 
 		crc->overflow = true;
-		spin_unlock(&crc->lock);
+		spin_unlock_irqrestore(&crc->lock, flags);
 
 		if (!was_overflow)
 			DRM_ERROR("Overflow of CRC buffer, userspace reads too slow.\n");
-- 
GitLab


From 5c0e54839d4803595c3a7a12cb5902b104814da8 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai26@huawei.com>
Date: Wed, 15 May 2019 22:37:25 +0800
Subject: [PATCH 1126/1835] memstick: Fix error cleanup path of memstick_init

[ Upstream commit 65f1a0d39c289bb6fc85635528cd36c4b07f560e ]

If bus_register fails. On its error handling path, it has cleaned up
what it has done. There is no need to call bus_unregister again.
Otherwise, if bus_unregister is called, issues such as null-ptr-deref
will arise.

Syzkaller report this:

kobject_add_internal failed for memstick (error: -12 parent: bus)
BUG: KASAN: null-ptr-deref in sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
Read of size 8 at addr 0000000000000078 by task syz-executor.0/4460

Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xa9/0x10e lib/dump_stack.c:113
 __kasan_report+0x171/0x18d mm/kasan/report.c:321
 kasan_report+0xe/0x20 mm/kasan/common.c:614
 sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
 sysfs_remove_file include/linux/sysfs.h:519 [inline]
 bus_remove_file+0x6c/0x90 drivers/base/bus.c:145
 remove_probe_files drivers/base/bus.c:599 [inline]
 bus_unregister+0x6e/0x100 drivers/base/bus.c:916 ? 0xffffffffc1590000
 memstick_init+0x7a/0x1000 [memstick]
 do_one_initcall+0xb9/0x3b5 init/main.c:914
 do_init_module+0xe0/0x330 kernel/module.c:3468
 load_module+0x38eb/0x4270 kernel/module.c:3819
 __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
 do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fixes: baf8532a147d ("memstick: initial commit for Sony MemoryStick support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai26@huawei.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/memstick.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index 1246d69ba1874..b1564cacd19e1 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -629,13 +629,18 @@ static int __init memstick_init(void)
 		return -ENOMEM;
 
 	rc = bus_register(&memstick_bus_type);
-	if (!rc)
-		rc = class_register(&memstick_host_class);
+	if (rc)
+		goto error_destroy_workqueue;
 
-	if (!rc)
-		return 0;
+	rc = class_register(&memstick_host_class);
+	if (rc)
+		goto error_bus_unregister;
+
+	return 0;
 
+error_bus_unregister:
 	bus_unregister(&memstick_bus_type);
+error_destroy_workqueue:
 	destroy_workqueue(workqueue);
 
 	return rc;
-- 
GitLab


From e40f5a873fc7de360130740c20947b0b7a9b0e1d Mon Sep 17 00:00:00 2001
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Date: Fri, 31 May 2019 21:37:33 +0800
Subject: [PATCH 1127/1835] tty/serial: digicolor: Fix digicolor-usart already
 registered warning

[ Upstream commit c7ad9ba0611c53cfe194223db02e3bca015f0674 ]

When modprobe/rmmod/modprobe module, if platform_driver_register() fails,
the kernel complained,

  proc_dir_entry 'driver/digicolor-usart' already registered
  WARNING: CPU: 1 PID: 5636 at fs/proc/generic.c:360 proc_register+0x19d/0x270

Fix this by adding uart_unregister_driver() when platform_driver_register() fails.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/digicolor-usart.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c
index f460cca139e23..13ac36e2da4f0 100644
--- a/drivers/tty/serial/digicolor-usart.c
+++ b/drivers/tty/serial/digicolor-usart.c
@@ -541,7 +541,11 @@ static int __init digicolor_uart_init(void)
 	if (ret)
 		return ret;
 
-	return platform_driver_register(&digicolor_uart_platform);
+	ret = platform_driver_register(&digicolor_uart_platform);
+	if (ret)
+		uart_unregister_driver(&digicolor_uart);
+
+	return ret;
 }
 module_init(digicolor_uart_init);
 
-- 
GitLab


From a0e7d6b7fa55679915bded19ae0de9f7460ffcfd Mon Sep 17 00:00:00 2001
From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Date: Mon, 10 Jun 2019 19:23:08 +0200
Subject: [PATCH 1128/1835] tty: serial: msm_serial: avoid system lockup
 condition

[ Upstream commit ba3684f99f1b25d2a30b6956d02d339d7acb9799 ]

The function msm_wait_for_xmitr can be taken with interrupts
disabled. In order to avoid a potential system lockup - demonstrated
under stress testing conditions on SoC QCS404/5 - make sure we wait
for a bounded amount of time.

Tested on SoC QCS404.

Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/msm_serial.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index 0f41b936da032..310bbae515b04 100644
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -383,10 +383,14 @@ no_rx:
 
 static inline void msm_wait_for_xmitr(struct uart_port *port)
 {
+	unsigned int timeout = 500000;
+
 	while (!(msm_read(port, UART_SR) & UART_SR_TX_EMPTY)) {
 		if (msm_read(port, UART_ISR) & UART_ISR_TX_READY)
 			break;
 		udelay(1);
+		if (!timeout--)
+			break;
 	}
 	msm_write(port, UART_CR_CMD_RESET_TX_READY, UART_CR);
 }
-- 
GitLab


From 1a2425b597fa46adb043ae5c2bf81223142526f3 Mon Sep 17 00:00:00 2001
From: Rautkoski Kimmo EXT <ext-kimmo.rautkoski@vaisala.com>
Date: Fri, 24 May 2019 09:19:22 +0000
Subject: [PATCH 1129/1835] serial: 8250: Fix TX interrupt handling condition

[ Upstream commit db1b5bc047b3cadaedab3826bba82c3d9e023c4b ]

Interrupt handler checked THRE bit (transmitter holding register
empty) in LSR to detect if TX fifo is empty.
In case when there is only receive interrupts the TX handling
got called because THRE bit in LSR is set when there is no
transmission (FIFO empty). TX handling caused TX stop, which in
RS-485 half-duplex mode actually resets receiver FIFO. This is not
desired during reception because of possible data loss.

The fix is to check if THRI is set in IER in addition of the TX
fifo status. THRI in IER is set when TX is started and cleared
when TX is stopped.
This ensures that TX handling is only called when there is really
transmission on going and an interrupt for THRE and not when there
are only RX interrupts.

Signed-off-by: Kimmo Rautkoski <ext-kimmo.rautkoski@vaisala.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_port.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index e26d87b6ffc53..aa4de6907f771 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1874,7 +1874,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
 			status = serial8250_rx_chars(up, status);
 	}
 	serial8250_modem_status(up);
-	if ((!up->dma || up->dma->tx_err) && (status & UART_LSR_THRE))
+	if ((!up->dma || up->dma->tx_err) && (status & UART_LSR_THRE) &&
+		(up->ier & UART_IER_THRI))
 		serial8250_tx_chars(up);
 
 	spin_unlock_irqrestore(&port->lock, flags);
-- 
GitLab


From 11b4e9f3695c155f71cb2bc56d761284bf5e65b1 Mon Sep 17 00:00:00 2001
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Date: Tue, 4 Jun 2019 15:21:14 -0400
Subject: [PATCH 1130/1835] drm/amd/display: Always allocate initial connector
 state state

[ Upstream commit f04bee34d6e35df26cbb2d65e801adfd0d8fe20d ]

[Why]
Unlike our regular connectors, MST connectors don't start off with
an initial connector state. This causes a NULL pointer dereference to
occur when attaching the bpc property since it tries to modify the
connector state.

We need an initial connector state on the connector to avoid the crash.

[How]
Use our reset helper to allocate an initial state and reset the values
to their defaults. We were already doing this before, just not for
MST connectors.

Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Reviewed-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index dac7978f5ee1f..221de241535a5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3644,6 +3644,13 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
 {
 	struct amdgpu_device *adev = dm->ddev->dev_private;
 
+	/*
+	 * Some of the properties below require access to state, like bpc.
+	 * Allocate some default initial connector state with our reset helper.
+	 */
+	if (aconnector->base.funcs->reset)
+		aconnector->base.funcs->reset(&aconnector->base);
+
 	aconnector->connector_id = link_index;
 	aconnector->dc_link = link;
 	aconnector->base.interlace_allowed = false;
@@ -3811,9 +3818,6 @@ static int amdgpu_dm_connector_init(struct amdgpu_display_manager *dm,
 			&aconnector->base,
 			&amdgpu_dm_connector_helper_funcs);
 
-	if (aconnector->base.funcs->reset)
-		aconnector->base.funcs->reset(&aconnector->base);
-
 	amdgpu_dm_connector_init_helper(
 		dm,
 		aconnector,
-- 
GitLab


From 725c7b78115074f67c4f5f7ece3fcb3abd7d9d1a Mon Sep 17 00:00:00 2001
From: David Riley <davidriley@chromium.org>
Date: Mon, 10 Jun 2019 14:18:10 -0700
Subject: [PATCH 1131/1835] drm/virtio: Add memory barriers for capset cache.

[ Upstream commit 9ff3a5c88e1f1ab17a31402b96d45abe14aab9d7 ]

After data is copied to the cache entry, atomic_set is used indicate
that the data is the entry is valid without appropriate memory barriers.
Similarly the read side was missing the corresponding memory barriers.

Signed-off-by: David Riley <davidriley@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20190610211810.253227-5-davidriley@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_ioctl.c | 3 +++
 drivers/gpu/drm/virtio/virtgpu_vq.c    | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 7bdf6f0e58a53..8d2f5ded86d66 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -528,6 +528,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
 	if (!ret)
 		return -EBUSY;
 
+	/* is_valid check must proceed before copy of the cache entry. */
+	smp_rmb();
+
 	ptr = cache_ent->caps_cache;
 
 copy_exit:
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 020070d483d35..c8a581b1f4c40 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -588,6 +588,8 @@ static void virtio_gpu_cmd_capset_cb(struct virtio_gpu_device *vgdev,
 		    cache_ent->id == le32_to_cpu(cmd->capset_id)) {
 			memcpy(cache_ent->caps_cache, resp->capset_data,
 			       cache_ent->size);
+			/* Copy must occur before is_valid is signalled. */
+			smp_wmb();
 			atomic_set(&cache_ent->is_valid, 1);
 			break;
 		}
-- 
GitLab


From 709ca46f1d46e2fcc7f1ef57053f8ed696a35e4e Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Tue, 28 May 2019 14:04:02 +0900
Subject: [PATCH 1132/1835] phy: renesas: rcar-gen2: Fix memory leak at error
 paths

[ Upstream commit d4a36e82924d3305a17ac987a510f3902df5a4b2 ]

This patch fixes memory leak at error paths of the probe function.
In for_each_child_of_node, if the loop returns, the driver should
call of_put_node() before returns.

Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Fixes: 1233f59f745b237 ("phy: Renesas R-Car Gen2 PHY driver")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/renesas/phy-rcar-gen2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c
index 97d4dd6ea9247..aa02b19b7e0e9 100644
--- a/drivers/phy/renesas/phy-rcar-gen2.c
+++ b/drivers/phy/renesas/phy-rcar-gen2.c
@@ -288,6 +288,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
 		error = of_property_read_u32(np, "reg", &channel_num);
 		if (error || channel_num > 2) {
 			dev_err(dev, "Invalid \"reg\" property\n");
+			of_node_put(np);
 			return error;
 		}
 		channel->select_mask = select_mask[channel_num];
@@ -303,6 +304,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
 						   &rcar_gen2_phy_ops);
 			if (IS_ERR(phy->phy)) {
 				dev_err(dev, "Failed to create PHY\n");
+				of_node_put(np);
 				return PTR_ERR(phy->phy);
 			}
 			phy_set_drvdata(phy->phy, phy);
-- 
GitLab


From 6a7047471073c2cf8e375b2fe5a71bacf9799973 Mon Sep 17 00:00:00 2001
From: Hariprasad Kelam <hariprasad.kelam@gmail.com>
Date: Thu, 13 Jun 2019 08:02:08 +0530
Subject: [PATCH 1133/1835] drm/amd/display: fix compilation error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 88099f53cc3717437f5fc9cf84205c5b65118377 ]

this patch fixes below compilation error

drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_hw_sequencer.c: In
function ‘dcn10_apply_ctx_for_surface’:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_hw_sequencer.c:2378:3:
error: implicit declaration of function ‘udelay’
[-Werror=implicit-function-declaration]
   udelay(underflow_check_delay_us);

Signed-off-by: Hariprasad Kelam <hariprasad.kelam@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 7736ef123e9be..ead221ccb93e0 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -23,6 +23,7 @@
  *
  */
 
+#include <linux/delay.h>
 #include "dm_services.h"
 #include "core_types.h"
 #include "resource.h"
-- 
GitLab


From fd0d171c706462bcb5bfd2fc21997aac6dc3d801 Mon Sep 17 00:00:00 2001
From: Nathan Lynch <nathanl@linux.ibm.com>
Date: Tue, 11 Jun 2019 23:45:05 -0500
Subject: [PATCH 1134/1835] powerpc/pseries/mobility: prevent cpu hotplug
 during DT update

[ Upstream commit e59a175faa8df9d674247946f2a5a9c29c835725 ]

CPU online/offline code paths are sensitive to parts of the device
tree (various cpu node properties, cache nodes) that can be changed as
a result of a migration.

Prevent CPU hotplug while the device tree potentially is inconsistent.

Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/mobility.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
index f0e30dc949888..7b60fcf04dc47 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -9,6 +9,7 @@
  * 2 as published by the Free Software Foundation.
  */
 
+#include <linux/cpu.h>
 #include <linux/kernel.h>
 #include <linux/kobject.h>
 #include <linux/smp.h>
@@ -344,11 +345,19 @@ void post_mobility_fixup(void)
 	if (rc)
 		printk(KERN_ERR "Post-mobility activate-fw failed: %d\n", rc);
 
+	/*
+	 * We don't want CPUs to go online/offline while the device
+	 * tree is being updated.
+	 */
+	cpus_read_lock();
+
 	rc = pseries_devicetree_update(MIGRATION_SCOPE);
 	if (rc)
 		printk(KERN_ERR "Post-mobility device tree update "
 			"failed: %d\n", rc);
 
+	cpus_read_unlock();
+
 	/* Possibly switch to a new RFI flush type */
 	pseries_setup_rfi_flush();
 
-- 
GitLab


From 741f8b39b6d4fe284ede321732484059ab7d27a4 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 14 Jun 2019 15:47:29 -0700
Subject: [PATCH 1135/1835] drm/rockchip: Properly adjust to a true clock in
 adjusted_mode

[ Upstream commit 99b9683f2142b20bad78e61f7f829e8714e45685 ]

When fixing up the clock in vop_crtc_mode_fixup() we're not doing it
quite correctly.  Specifically if we've got the true clock 266666667 Hz,
we'll perform this calculation:
   266666667 / 1000 => 266666

Later when we try to set the clock we'll do clk_set_rate(266666 *
1000).  The common clock framework won't actually pick the proper clock
in this case since it always wants clocks <= the specified one.

Let's solve this by using DIV_ROUND_UP.

Fixes: b59b8de31497 ("drm/rockchip: return a true clock rate to adjusted_mode")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Yakir Yang <ykk@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20190614224730.98622-1-dianders@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index f8f9ae6622eb5..873624a11ce88 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -880,7 +880,8 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
 	struct vop *vop = to_vop(crtc);
 
 	adjusted_mode->clock =
-		clk_round_rate(vop->dclk, mode->clock * 1000) / 1000;
+		DIV_ROUND_UP(clk_round_rate(vop->dclk, mode->clock * 1000),
+			     1000);
 
 	return true;
 }
-- 
GitLab


From 785e11c06db3ebd154fa1cf290170269140a5285 Mon Sep 17 00:00:00 2001
From: Sergey Organov <sorganov@gmail.com>
Date: Tue, 11 Jun 2019 15:05:24 +0300
Subject: [PATCH 1136/1835] serial: imx: fix locking in set_termios()

[ Upstream commit 4e828c3e09201512be5ee162393f334321f7cf01 ]

imx_uart_set_termios() called imx_uart_rts_active(), or
imx_uart_rts_inactive() before taking port->port.lock.

As a consequence, sport->port.mctrl that these functions modify
could have been changed without holding port->port.lock.

Moved locking of port->port.lock above the calls to fix the issue.

Signed-off-by: Sergey Organov <sorganov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/imx.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 0f67197a3783f..105de92b0b3bf 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -382,6 +382,7 @@ static void imx_uart_ucrs_restore(struct imx_port *sport,
 }
 #endif
 
+/* called with port.lock taken and irqs caller dependent */
 static void imx_uart_rts_active(struct imx_port *sport, u32 *ucr2)
 {
 	*ucr2 &= ~(UCR2_CTSC | UCR2_CTS);
@@ -390,6 +391,7 @@ static void imx_uart_rts_active(struct imx_port *sport, u32 *ucr2)
 	mctrl_gpio_set(sport->gpios, sport->port.mctrl);
 }
 
+/* called with port.lock taken and irqs caller dependent */
 static void imx_uart_rts_inactive(struct imx_port *sport, u32 *ucr2)
 {
 	*ucr2 &= ~UCR2_CTSC;
@@ -399,6 +401,7 @@ static void imx_uart_rts_inactive(struct imx_port *sport, u32 *ucr2)
 	mctrl_gpio_set(sport->gpios, sport->port.mctrl);
 }
 
+/* called with port.lock taken and irqs caller dependent */
 static void imx_uart_rts_auto(struct imx_port *sport, u32 *ucr2)
 {
 	*ucr2 |= UCR2_CTSC;
@@ -1554,6 +1557,16 @@ imx_uart_set_termios(struct uart_port *port, struct ktermios *termios,
 		old_csize = CS8;
 	}
 
+	del_timer_sync(&sport->timer);
+
+	/*
+	 * Ask the core to calculate the divisor for us.
+	 */
+	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
+	quot = uart_get_divisor(port, baud);
+
+	spin_lock_irqsave(&sport->port.lock, flags);
+
 	if ((termios->c_cflag & CSIZE) == CS8)
 		ucr2 = UCR2_WS | UCR2_SRST | UCR2_IRTS;
 	else
@@ -1597,16 +1610,6 @@ imx_uart_set_termios(struct uart_port *port, struct ktermios *termios,
 			ucr2 |= UCR2_PROE;
 	}
 
-	del_timer_sync(&sport->timer);
-
-	/*
-	 * Ask the core to calculate the divisor for us.
-	 */
-	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
-	quot = uart_get_divisor(port, baud);
-
-	spin_lock_irqsave(&sport->port.lock, flags);
-
 	sport->port.read_status_mask = 0;
 	if (termios->c_iflag & INPCK)
 		sport->port.read_status_mask |= (URXD_FRMERR | URXD_PRERR);
-- 
GitLab


From ac380eb479de4a37ac15a121e10fd37876ccedac Mon Sep 17 00:00:00 2001
From: Serge Semin <fancer.lancer@gmail.com>
Date: Wed, 8 May 2019 13:44:41 +0300
Subject: [PATCH 1137/1835] tty: serial_core: Set port active bit in
 uart_port_activate

[ Upstream commit 13b18d35909707571af9539f7731389fbf0feb31 ]

A bug was introduced by commit b3b576461864 ("tty: serial_core: convert
uart_open to use tty_port_open"). It caused a constant warning printed
into the system log regarding the tty and port counter mismatch:

[   21.644197] ttyS ttySx: tty_port_close_start: tty->count = 1 port count = 2

in case if session hangup was detected so the warning is printed starting
from the second open-close iteration.

Particularly the problem was discovered in situation when there is a
serial tty device without hardware back-end being setup. It is considered
by the tty-serial subsystems as a hardware problem with session hang up.
In this case uart_startup() will return a positive value with TTY_IO_ERROR
flag set in corresponding tty_struct instance. The same value will get
passed to be returned from the activate() callback and then being returned
from tty_port_open(). But since in this case tty_port_block_til_ready()
isn't called the TTY_PORT_ACTIVE flag isn't set (while the method had been
called before tty_port_open conversion was introduced and the rest of the
subsystem code expected the bit being set in this case), which prevents the
uart_hangup() method to perform any cleanups including the tty port
counter setting to zero. So the next attempt to open/close the tty device
will discover the counters mismatch.

In order to fix the problem we need to manually set the TTY_PORT_ACTIVE
flag in case if uart_startup() returned a positive value. In this case
the hang up procedure will perform a full set of cleanup actions including
the port ref-counter resetting.

Fixes: b3b576461864 "tty: serial_core: convert uart_open to use tty_port_open"
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/serial_core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 8dbeb14a1e3ab..fe9261ffe3dbc 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1738,6 +1738,7 @@ static int uart_port_activate(struct tty_port *port, struct tty_struct *tty)
 {
 	struct uart_state *state = container_of(port, struct uart_state, port);
 	struct uart_port *uport;
+	int ret;
 
 	uport = uart_port_check(state);
 	if (!uport || uport->flags & UPF_DEAD)
@@ -1748,7 +1749,11 @@ static int uart_port_activate(struct tty_port *port, struct tty_struct *tty)
 	/*
 	 * Start up the serial port.
 	 */
-	return uart_startup(tty, state, 0);
+	ret = uart_startup(tty, state, 0);
+	if (ret > 0)
+		tty_port_set_active(port, 1);
+
+	return ret;
 }
 
 static const char *uart_type(struct uart_port *port)
-- 
GitLab


From bf7cf9fb02dbe59a3c471bdbe2088355c5946f08 Mon Sep 17 00:00:00 2001
From: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Date: Mon, 3 Jun 2019 19:05:28 +0200
Subject: [PATCH 1138/1835] usb: gadget: Zero ffs_io_data

[ Upstream commit 508595515f4bcfe36246e4a565cf280937aeaade ]

In some cases the "Allocate & copy" block in ffs_epfile_io() is not
executed. Consequently, in such a case ffs_alloc_buffer() is never called
and struct ffs_io_data is not initialized properly. This in turn leads to
problems when ffs_free_buffer() is called at the end of ffs_epfile_io().

This patch uses kzalloc() instead of kmalloc() in the aio case and memset()
in non-aio case to properly initialize struct ffs_io_data.

Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/f_fs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index aa15593a3ac47..2050993fb58b7 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1101,11 +1101,12 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
 	ENTER();
 
 	if (!is_sync_kiocb(kiocb)) {
-		p = kmalloc(sizeof(io_data), GFP_KERNEL);
+		p = kzalloc(sizeof(io_data), GFP_KERNEL);
 		if (unlikely(!p))
 			return -ENOMEM;
 		p->aio = true;
 	} else {
+		memset(p, 0, sizeof(*p));
 		p->aio = false;
 	}
 
@@ -1137,11 +1138,12 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
 	ENTER();
 
 	if (!is_sync_kiocb(kiocb)) {
-		p = kmalloc(sizeof(io_data), GFP_KERNEL);
+		p = kzalloc(sizeof(io_data), GFP_KERNEL);
 		if (unlikely(!p))
 			return -ENOMEM;
 		p->aio = true;
 	} else {
+		memset(p, 0, sizeof(*p));
 		p->aio = false;
 	}
 
-- 
GitLab


From 5d3ad905af431fcfd1e51ce97c02c062c076e1a7 Mon Sep 17 00:00:00 2001
From: Raul E Rangel <rrangel@chromium.org>
Date: Mon, 17 Jun 2019 14:10:13 -0600
Subject: [PATCH 1139/1835] mmc: sdhci: sdhci-pci-o2micro: Check if controller
 supports 8-bit width

[ Upstream commit de23f0b757766d9fae59df97da6e8bdc5b231351 ]

The O2 controller supports 8-bit EMMC access.

JESD84-B51 section A.6.3.a defines the bus testing procedure that
`mmc_select_bus_width()` implements. This is used to determine the actual
bus width of the eMMC.

Signed-off-by: Raul E Rangel <rrangel@chromium.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-pci-o2micro.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
index fa8d9da2ab7f6..e248d7945c062 100644
--- a/drivers/mmc/host/sdhci-pci-o2micro.c
+++ b/drivers/mmc/host/sdhci-pci-o2micro.c
@@ -290,11 +290,21 @@ int sdhci_pci_o2_probe_slot(struct sdhci_pci_slot *slot)
 {
 	struct sdhci_pci_chip *chip;
 	struct sdhci_host *host;
-	u32 reg;
+	u32 reg, caps;
 	int ret;
 
 	chip = slot->chip;
 	host = slot->host;
+
+	caps = sdhci_readl(host, SDHCI_CAPABILITIES);
+
+	/*
+	 * mmc_select_bus_width() will test the bus to determine the actual bus
+	 * width.
+	 */
+	if (caps & SDHCI_CAN_DO_8BIT)
+		host->mmc->caps |= MMC_CAP_8_BIT_DATA;
+
 	switch (chip->pdev->device) {
 	case PCI_DEVICE_ID_O2_SDS0:
 	case PCI_DEVICE_ID_O2_SEABIRD0:
-- 
GitLab


From 216462fa884f7dfaa8a866410b4e62358f36b476 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Wed, 5 Jun 2019 13:38:14 +1000
Subject: [PATCH 1140/1835] powerpc/pci/of: Fix OF flags parsing for 64bit BARs

[ Upstream commit df5be5be8735ef2ae80d5ae1f2453cd81a035c4b ]

When the firmware does PCI BAR resource allocation, it passes the assigned
addresses and flags (prefetch/64bit/...) via the "reg" property of
a PCI device device tree node so the kernel does not need to do
resource allocation.

The flags are stored in resource::flags - the lower byte stores
PCI_BASE_ADDRESS_SPACE/etc bits and the other bytes are IORESOURCE_IO/etc.
Some flags from PCI_BASE_ADDRESS_xxx and IORESOURCE_xxx are duplicated,
such as PCI_BASE_ADDRESS_MEM_PREFETCH/PCI_BASE_ADDRESS_MEM_TYPE_64/etc.
When parsing the "reg" property, we copy the prefetch flag but we skip
on PCI_BASE_ADDRESS_MEM_TYPE_64 which leaves the flags out of sync.

The missing IORESOURCE_MEM_64 flag comes into play under 2 conditions:
1. we remove PCI_PROBE_ONLY for pseries (by hacking pSeries_setup_arch()
or by passing "/chosen/linux,pci-probe-only");
2. we request resource alignment (by passing pci=resource_alignment=
via the kernel cmd line to request PAGE_SIZE alignment or defining
ppc_md.pcibios_default_alignment which returns anything but 0). Note that
the alignment requests are ignored if PCI_PROBE_ONLY is enabled.

With 1) and 2), the generic PCI code in the kernel unconditionally
decides to:
- reassign the BARs in pci_specified_resource_alignment() (works fine)
- write new BARs to the device - this fails for 64bit BARs as the generic
code looks at IORESOURCE_MEM_64 (not set) and writes only lower 32bits
of the BAR and leaves the upper 32bit unmodified which breaks BAR mapping
in the hypervisor.

This fixes the issue by copying the flag. This is useful if we want to
enforce certain BAR alignment per platform as handling subpage sized BARs
is proven to cause problems with hotplug (SLOF already aligns BARs to 64k).

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
Reviewed-by: Oliver O'Halloran <oohall@gmail.com>
Reviewed-by: Shawn Anastasio <shawn@anastas.io>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/pci_of_scan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
index 98f04725def75..c101b321dece8 100644
--- a/arch/powerpc/kernel/pci_of_scan.c
+++ b/arch/powerpc/kernel/pci_of_scan.c
@@ -45,6 +45,8 @@ unsigned int pci_parse_of_flags(u32 addr0, int bridge)
 	if (addr0 & 0x02000000) {
 		flags = IORESOURCE_MEM | PCI_BASE_ADDRESS_SPACE_MEMORY;
 		flags |= (addr0 >> 22) & PCI_BASE_ADDRESS_MEM_TYPE_64;
+		if (flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
+			flags |= IORESOURCE_MEM_64;
 		flags |= (addr0 >> 28) & PCI_BASE_ADDRESS_MEM_TYPE_1M;
 		if (addr0 & 0x40000000)
 			flags |= IORESOURCE_PREFETCH
-- 
GitLab


From e7f206f42fb64adc8a4b9b0ea24d4e2c666c9cb9 Mon Sep 17 00:00:00 2001
From: Sean Paul <seanpaul@chromium.org>
Date: Mon, 17 Jun 2019 16:12:51 -0400
Subject: [PATCH 1141/1835] drm/msm: Depopulate platform on probe failure

[ Upstream commit 4368a1539c6b41ac3cddc06f5a5117952998804c ]

add_display_components() calls of_platform_populate, and we depopluate
on pdev remove, but not when probe fails. So if we get a probe deferral
in one of the components, we won't depopulate the platform. This causes
the core to keep references to devices which should be destroyed, which
causes issues when those same devices try to re-initialize on the next
probe attempt.

I think this is the reason we had issues with the gmu's device-managed
resources on deferral (worked around in commit 94e3a17f33a5).

Reviewed-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190617201301.133275-3-sean@poorly.run
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_drv.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index c1abad8a86126..ed9a3a1e50efb 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -1321,16 +1321,24 @@ static int msm_pdev_probe(struct platform_device *pdev)
 
 	ret = add_gpu_components(&pdev->dev, &match);
 	if (ret)
-		return ret;
+		goto fail;
 
 	/* on all devices that I am aware of, iommu's which can map
 	 * any address the cpu can see are used:
 	 */
 	ret = dma_set_mask_and_coherent(&pdev->dev, ~0);
 	if (ret)
-		return ret;
+		goto fail;
+
+	ret = component_master_add_with_match(&pdev->dev, &msm_drm_ops, match);
+	if (ret)
+		goto fail;
 
-	return component_master_add_with_match(&pdev->dev, &msm_drm_ops, match);
+	return 0;
+
+fail:
+	of_platform_depopulate(&pdev->dev);
+	return ret;
 }
 
 static int msm_pdev_remove(struct platform_device *pdev)
-- 
GitLab


From 9d45fbee76af0b95e7256bf2c13c2c5a7d4c5457 Mon Sep 17 00:00:00 2001
From: Stefan Roese <sr@denx.de>
Date: Thu, 20 Jun 2019 08:24:19 +0200
Subject: [PATCH 1142/1835] serial: mctrl_gpio: Check if GPIO property exisits
 before requesting it

[ Upstream commit d99482673f950817b30caf3fcdfb31179b050ce1 ]

This patch adds a check for the GPIOs property existence, before the
GPIO is requested. This fixes an issue seen when the 8250 mctrl_gpio
support is added (2nd patch in this patch series) on x86 platforms using
ACPI.

Here Mika's comments from 2016-08-09:

"
I noticed that with v4.8-rc1 serial console of some of our Broxton
systems does not work properly anymore. I'm able to see output but input
does not work.

I bisected it down to commit 4ef03d328769eddbfeca1f1c958fdb181a69c341
("tty/serial/8250: use mctrl_gpio helpers").

The reason why it fails is that in ACPI we do not have names for GPIOs
(except when _DSD is used) so we use the "idx" to index into _CRS GPIO
resources. Now mctrl_gpio_init_noauto() goes through a list of GPIOs
calling devm_gpiod_get_index_optional() passing "idx" of 0 for each. The
UART device in Broxton has following (simplified) ACPI description:

    Device (URT4)
    {
        ...
        Name (_CRS, ResourceTemplate () {
            GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly,
                    "\\_SB.GPO0", 0x00, ResourceConsumer)
            {
                0x003A
            }
            GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly,
                    "\\_SB.GPO0", 0x00, ResourceConsumer)
            {
                0x003D
            }
        })

In this case it finds the first GPIO (0x003A which happens to be RX pin
for that UART), turns it into GPIO which then breaks input for the UART
device. This also breaks systems with bluetooth connected to UART (those
typically have some GPIOs in their _CRS).

Any ideas how to fix this?

We cannot just drop the _CRS index lookup fallback because that would
break many existing machines out there so maybe we can limit this to
only DT enabled machines. Or alternatively probe if the property first
exists before trying to acquire the GPIOs (using
device_property_present()).
"

This patch implements the fix suggested by Mika in his statement above.

Signed-off-by: Stefan Roese <sr@denx.de>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Yegor Yefremov <yegorslists@googlemail.com>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/serial_mctrl_gpio.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c
index 1c06325beacae..07f318603e740 100644
--- a/drivers/tty/serial/serial_mctrl_gpio.c
+++ b/drivers/tty/serial/serial_mctrl_gpio.c
@@ -12,6 +12,7 @@
 #include <linux/termios.h>
 #include <linux/serial_core.h>
 #include <linux/module.h>
+#include <linux/property.h>
 
 #include "serial_mctrl_gpio.h"
 
@@ -115,6 +116,19 @@ struct mctrl_gpios *mctrl_gpio_init_noauto(struct device *dev, unsigned int idx)
 
 	for (i = 0; i < UART_GPIO_MAX; i++) {
 		enum gpiod_flags flags;
+		char *gpio_str;
+		bool present;
+
+		/* Check if GPIO property exists and continue if not */
+		gpio_str = kasprintf(GFP_KERNEL, "%s-gpios",
+				     mctrl_gpios_desc[i].name);
+		if (!gpio_str)
+			continue;
+
+		present = device_property_present(dev, gpio_str);
+		kfree(gpio_str);
+		if (!present)
+			continue;
 
 		if (mctrl_gpios_desc[i].dir_out)
 			flags = GPIOD_OUT_LOW;
-- 
GitLab


From f930727faef2da1cbaf3a63fdf61ea4d5155630b Mon Sep 17 00:00:00 2001
From: Marek Vasut <marek.vasut+renesas@gmail.com>
Date: Mon, 27 May 2019 00:51:51 +0200
Subject: [PATCH 1143/1835] PCI: sysfs: Ignore lockdep for remove attribute

[ Upstream commit dc6b698a86fe40a50525433eb8e92a267847f6f9 ]

With CONFIG_PROVE_LOCKING=y, using sysfs to remove a bridge with a device
below it causes a lockdep warning, e.g.,

  # echo 1 > /sys/class/pci_bus/0000:00/device/0000:00:00.0/remove
  ============================================
  WARNING: possible recursive locking detected
  ...
  pci_bus 0000:01: busn_res: [bus 01] is released

The remove recursively removes the subtree below the bridge.  Each call
uses a different lock so there's no deadlock, but the locks were all
created with the same lockdep key so the lockdep checker can't tell them
apart.

Mark the "remove" sysfs attribute with __ATTR_IGNORE_LOCKDEP() as it is
safe to ignore the lockdep check between different "remove" kernfs
instances.

There's discussion about a similar issue in USB at [1], which resulted in
356c05d58af0 ("sysfs: get rid of some lockdep false positives") and
e9b526fe7048 ("i2c: suppress lockdep warning on delete_device"), which do
basically the same thing for USB "remove" and i2c "delete_device" files.

[1] https://lore.kernel.org/r/Pine.LNX.4.44L0.1204251436140.1206-100000@iolanthe.rowland.org
Link: https://lore.kernel.org/r/20190526225151.3865-1-marek.vasut@gmail.com
Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
[bhelgaas: trim commit log, details at above links]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Phil Edworthy <phil.edworthy@renesas.com>
Cc: Simon Horman <horms+renesas@verge.net.au>
Cc: Tejun Heo <tj@kernel.org>
Cc: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci-sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 9ecfe13157c09..1edf5a1836ea9 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -478,7 +478,7 @@ static ssize_t remove_store(struct device *dev, struct device_attribute *attr,
 		pci_stop_and_remove_bus_device_locked(to_pci_dev(dev));
 	return count;
 }
-static struct device_attribute dev_remove_attr = __ATTR(remove,
+static struct device_attribute dev_remove_attr = __ATTR_IGNORE_LOCKDEP(remove,
 							(S_IWUSR|S_IWGRP),
 							NULL, remove_store);
 
-- 
GitLab


From 1fa94381fdeb59e6165d17b1261991f26b145d68 Mon Sep 17 00:00:00 2001
From: Fabrice Gasnier <fabrice.gasnier@st.com>
Date: Mon, 17 Jun 2019 09:53:01 +0200
Subject: [PATCH 1144/1835] i2c: stm32f7: fix the get_irq error cases

[ Upstream commit 79b4499524ed659fb76323efc30f3dc03967c88f ]

During probe, return the "get_irq" error value instead of -EINVAL which
allows the driver to be deferred probed if needed.
Fix also the case where of_irq_get() returns a negative value.
Note :
On failure of_irq_get() returns 0 or a negative value while
platform_get_irq() returns a negative value.

Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
Signed-off-by: Fabien Dessenne <fabien.dessenne@st.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-stm32f7.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index a492da9fd0d32..ac9c9486b834c 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -24,7 +24,6 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
-#include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
 #include <linux/reset.h>
@@ -1782,15 +1781,14 @@ static struct i2c_algorithm stm32f7_i2c_algo = {
 
 static int stm32f7_i2c_probe(struct platform_device *pdev)
 {
-	struct device_node *np = pdev->dev.of_node;
 	struct stm32f7_i2c_dev *i2c_dev;
 	const struct stm32f7_i2c_setup *setup;
 	struct resource *res;
-	u32 irq_error, irq_event, clk_rate, rise_time, fall_time;
+	u32 clk_rate, rise_time, fall_time;
 	struct i2c_adapter *adap;
 	struct reset_control *rst;
 	dma_addr_t phy_addr;
-	int ret;
+	int irq_error, irq_event, ret;
 
 	i2c_dev = devm_kzalloc(&pdev->dev, sizeof(*i2c_dev), GFP_KERNEL);
 	if (!i2c_dev)
@@ -1802,16 +1800,20 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
 		return PTR_ERR(i2c_dev->base);
 	phy_addr = (dma_addr_t)res->start;
 
-	irq_event = irq_of_parse_and_map(np, 0);
-	if (!irq_event) {
-		dev_err(&pdev->dev, "IRQ event missing or invalid\n");
-		return -EINVAL;
+	irq_event = platform_get_irq(pdev, 0);
+	if (irq_event <= 0) {
+		if (irq_event != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Failed to get IRQ event: %d\n",
+				irq_event);
+		return irq_event ? : -ENOENT;
 	}
 
-	irq_error = irq_of_parse_and_map(np, 1);
-	if (!irq_error) {
-		dev_err(&pdev->dev, "IRQ error missing or invalid\n");
-		return -EINVAL;
+	irq_error = platform_get_irq(pdev, 1);
+	if (irq_error <= 0) {
+		if (irq_error != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "Failed to get IRQ error: %d\n",
+				irq_error);
+		return irq_error ? : -ENOENT;
 	}
 
 	i2c_dev->clk = devm_clk_get(&pdev->dev, NULL);
-- 
GitLab


From 27f2335e1440128eb53ea2dacfc9e685cfa587aa Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Tue, 11 Jun 2019 11:43:31 -0700
Subject: [PATCH 1145/1835] kbuild: Add -Werror=unknown-warning-option to
 CLANG_FLAGS

[ Upstream commit 589834b3a0097a4908f4112eac0ca2feb486fa32 ]

In commit ebcc5928c5d9 ("arm64: Silence gcc warnings about arch ABI
drift"), the arm64 Makefile added -Wno-psabi to KBUILD_CFLAGS, which is
a GCC only option so clang rightfully complains:

warning: unknown warning option '-Wno-psabi' [-Wunknown-warning-option]

https://clang.llvm.org/docs/DiagnosticsReference.html#wunknown-warning-option

However, by default, this is merely a warning so the build happily goes
on with a slew of these warnings in the process.

Commit c3f0d0bc5b01 ("kbuild, LLVMLinux: Add -Werror to cc-option to
support clang") worked around this behavior in cc-option by adding
-Werror so that unknown flags cause an error. However, this all happens
silently and when an unknown flag is added to the build unconditionally
like -Wno-psabi, cc-option will always fail because there is always an
unknown flag in the list of flags. This manifested as link time failures
in the arm64 libstub because -fno-stack-protector didn't get added to
KBUILD_CFLAGS.

To avoid these weird cryptic failures in the future, make clang behave
like gcc and immediately error when it encounters an unknown flag by
adding -Werror=unknown-warning-option to CLANG_FLAGS. This can be added
unconditionally for clang because it is supported by at least 3.0.0,
according to godbolt [1] and 4.0.0, according to its documentation [2],
which is far earlier than we typically support.

[1]: https://godbolt.org/z/7F7rm3
[2]: https://releases.llvm.org/4.0.0/tools/clang/docs/DiagnosticsReference.html#wunknown-warning-option

Link: https://github.com/ClangBuiltLinux/linux/issues/511
Link: https://github.com/ClangBuiltLinux/linux/issues/517
Suggested-by: Peter Smith <peter.smith@linaro.org>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index a4463d880ae2e..c1f38f4107d97 100644
--- a/Makefile
+++ b/Makefile
@@ -491,6 +491,7 @@ ifneq ($(GCC_TOOLCHAIN),)
 CLANG_FLAGS	+= --gcc-toolchain=$(GCC_TOOLCHAIN)
 endif
 CLANG_FLAGS	+= -no-integrated-as
+CLANG_FLAGS	+= -Werror=unknown-warning-option
 KBUILD_CFLAGS	+= $(CLANG_FLAGS)
 KBUILD_AFLAGS	+= $(CLANG_FLAGS)
 export CLANG_FLAGS
-- 
GitLab


From e3e2bb12c8a72bcbaf486c023a02566027224adf Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon@arm.com>
Date: Tue, 18 Jun 2019 14:10:48 +0100
Subject: [PATCH 1146/1835] genksyms: Teach parser about 128-bit built-in types

[ Upstream commit a222061b85234d8a44486a46bd4df7e2cda52385 ]

__uint128_t crops up in a few files that export symbols to modules, so
teach genksyms about it and the other GCC built-in 128-bit integer types
so that we don't end up skipping the CRC generation for some symbols due
to the parser failing to spot them:

  | WARNING: EXPORT symbol "kernel_neon_begin" [vmlinux] version
  |          generation failed, symbol will not be versioned.
  | ld: arch/arm64/kernel/fpsimd.o: relocation R_AARCH64_ABS32 against
  |     `__crc_kernel_neon_begin' can not be used when making a shared
  |     object
  | ld: arch/arm64/kernel/fpsimd.o:(.data+0x0): dangerous relocation:
  |     unsupported relocation

Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/genksyms/keywords.c | 4 ++++
 scripts/genksyms/parse.y    | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/scripts/genksyms/keywords.c b/scripts/genksyms/keywords.c
index 9f40bcd17d07f..f6956aa413668 100644
--- a/scripts/genksyms/keywords.c
+++ b/scripts/genksyms/keywords.c
@@ -24,6 +24,10 @@ static struct resword {
 	{ "__volatile__", VOLATILE_KEYW },
 	{ "__builtin_va_list", VA_LIST_KEYW },
 
+	{ "__int128", BUILTIN_INT_KEYW },
+	{ "__int128_t", BUILTIN_INT_KEYW },
+	{ "__uint128_t", BUILTIN_INT_KEYW },
+
 	// According to rth, c99 defines "_Bool", __restrict", __restrict__", "restrict".  KAO
 	{ "_Bool", BOOL_KEYW },
 	{ "_restrict", RESTRICT_KEYW },
diff --git a/scripts/genksyms/parse.y b/scripts/genksyms/parse.y
index 00a6d7e549712..1ebcf52cd0f9e 100644
--- a/scripts/genksyms/parse.y
+++ b/scripts/genksyms/parse.y
@@ -76,6 +76,7 @@ static void record_compound(struct string_list **keyw,
 %token ATTRIBUTE_KEYW
 %token AUTO_KEYW
 %token BOOL_KEYW
+%token BUILTIN_INT_KEYW
 %token CHAR_KEYW
 %token CONST_KEYW
 %token DOUBLE_KEYW
@@ -263,6 +264,7 @@ simple_type_specifier:
 	| VOID_KEYW
 	| BOOL_KEYW
 	| VA_LIST_KEYW
+	| BUILTIN_INT_KEYW
 	| TYPE			{ (*$1)->tag = SYM_TYPEDEF; $$ = $1; }
 	;
 
-- 
GitLab


From fc9c15c4e3ffe2f067cb743f7f716e8dbc9430bf Mon Sep 17 00:00:00 2001
From: Bharat Kumar Gogada <bharat.kumar.gogada@xilinx.com>
Date: Wed, 12 Jun 2019 15:47:59 +0530
Subject: [PATCH 1147/1835] PCI: xilinx-nwl: Fix Multi MSI data programming

[ Upstream commit 181fa434d0514e40ebf6e9721f2b72700287b6e2 ]

According to the PCI Local Bus specification Revision 3.0,
section 6.8.1.3 (Message Control for MSI), endpoints that
are Multiple Message Capable as defined by bits [3:1] in
the Message Control for MSI can request a number of vectors
that is power of two aligned.

As specified in section 6.8.1.6 "Message data for MSI", the Multiple
Message Enable field (bits [6:4] of the Message Control register)
defines the number of low order message data bits the function is
permitted to modify to generate its system software allocated
vectors.

The MSI controller in the Xilinx NWL PCIe controller supports a number
of MSI vectors specified through a bitmap and the hwirq number for an
MSI, that is the value written in the MSI data TLP is determined by
the bitmap allocation.

For instance, in a situation where two endpoints sitting on
the PCI bus request the following MSI configuration, with
the current PCI Xilinx bitmap allocation code (that does not
align MSI vector allocation on a power of two boundary):

Endpoint #1: Requesting 1 MSI vector - allocated bitmap bits 0
Endpoint #2: Requesting 2 MSI vectors - allocated bitmap bits [1,2]

The bitmap value(s) corresponds to the hwirq number that is programmed
into the Message Data for MSI field in the endpoint MSI capability
and is detected by the root complex to fire the corresponding
MSI irqs. The value written in Message Data for MSI field corresponds
to the first bit allocated in the bitmap for Multi MSI vectors.

The current Xilinx NWL MSI allocation code allows a bitmap allocation
that is not a power of two boundaries, so endpoint #2, is allowed to
toggle Message Data bit[0] to differentiate between its two vectors
(meaning that the MSI data will be respectively 0x0 and 0x1 for the two
vectors allocated to endpoint #2).

This clearly aliases with the Endpoint #1 vector allocation, resulting
in a broken Multi MSI implementation.

Update the code to allocate MSI bitmap ranges with a power of two
alignment, fixing the bug.

Fixes: ab597d35ef11 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller")
Suggested-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Bharat Kumar Gogada <bharat.kumar.gogada@xilinx.com>
[lorenzo.pieralisi@arm.com: updated commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-xilinx-nwl.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
index fb32840ce8e66..4850a1b8eec12 100644
--- a/drivers/pci/controller/pcie-xilinx-nwl.c
+++ b/drivers/pci/controller/pcie-xilinx-nwl.c
@@ -483,15 +483,13 @@ static int nwl_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 	int i;
 
 	mutex_lock(&msi->lock);
-	bit = bitmap_find_next_zero_area(msi->bitmap, INT_PCI_MSI_NR, 0,
-					 nr_irqs, 0);
-	if (bit >= INT_PCI_MSI_NR) {
+	bit = bitmap_find_free_region(msi->bitmap, INT_PCI_MSI_NR,
+				      get_count_order(nr_irqs));
+	if (bit < 0) {
 		mutex_unlock(&msi->lock);
 		return -ENOSPC;
 	}
 
-	bitmap_set(msi->bitmap, bit, nr_irqs);
-
 	for (i = 0; i < nr_irqs; i++) {
 		irq_domain_set_info(domain, virq + i, bit + i, &nwl_irq_chip,
 				domain->host_data, handle_simple_irq,
@@ -509,7 +507,8 @@ static void nwl_irq_domain_free(struct irq_domain *domain, unsigned int virq,
 	struct nwl_msi *msi = &pcie->msi;
 
 	mutex_lock(&msi->lock);
-	bitmap_clear(msi->bitmap, data->hwirq, nr_irqs);
+	bitmap_release_region(msi->bitmap, data->hwirq,
+			      get_count_order(nr_irqs));
 	mutex_unlock(&msi->lock);
 }
 
-- 
GitLab


From b150423e0d5eeca091e0af2eb4594a53df304f9a Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Thu, 27 Jun 2019 09:20:45 +0200
Subject: [PATCH 1148/1835] iio: iio-utils: Fix possible incorrect mask
 calculation

[ Upstream commit 208a68c8393d6041a90862992222f3d7943d44d6 ]

On some machines, iio-sensor-proxy was returning all 0's for IIO sensor
values. It turns out that the bits_used for this sensor is 32, which makes
the mask calculation:

*mask = (1 << 32) - 1;

If the compiler interprets the 1 literals as 32-bit ints, it generates
undefined behavior depending on compiler version and optimization level.
On my system, it optimizes out the shift, so the mask value becomes

*mask = (1) - 1;

With a mask value of 0, iio-sensor-proxy will always return 0 for every axis.

Avoid incorrect 0 values caused by compiler optimization.

See original fix by Brett Dutro <brett.dutro@gmail.com> in
iio-sensor-proxy:
https://github.com/hadess/iio-sensor-proxy/commit/9615ceac7c134d838660e209726cd86aa2064fd3

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/iio/iio_utils.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
index 7a6d61c6c0121..55272fef3b508 100644
--- a/tools/iio/iio_utils.c
+++ b/tools/iio/iio_utils.c
@@ -159,9 +159,9 @@ int iioutils_get_type(unsigned *is_signed, unsigned *bytes, unsigned *bits_used,
 			*be = (endianchar == 'b');
 			*bytes = padint / 8;
 			if (*bits_used == 64)
-				*mask = ~0;
+				*mask = ~(0ULL);
 			else
-				*mask = (1ULL << *bits_used) - 1;
+				*mask = (1ULL << *bits_used) - 1ULL;
 
 			*is_signed = (signchar == 's');
 			if (fclose(sysfsfp)) {
-- 
GitLab


From a80f67d5560c213f7f54b7ac7593e0dfa661161f Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Thu, 6 Jun 2019 09:58:13 -0400
Subject: [PATCH 1149/1835] powerpc/cacheflush: fix variable set but not used

[ Upstream commit 04db3ede40ae4fc23a5c4237254c4a53bbe4c1f2 ]

The powerpc's flush_cache_vmap() is defined as a macro and never use
both of its arguments, so it will generate a compilation warning,

lib/ioremap.c: In function 'ioremap_page_range':
lib/ioremap.c:203:16: warning: variable 'start' set but not used
[-Wunused-but-set-variable]

Fix it by making it an inline function.

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/cacheflush.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/include/asm/cacheflush.h b/arch/powerpc/include/asm/cacheflush.h
index d5a8d7bf07594..b189f7aee222e 100644
--- a/arch/powerpc/include/asm/cacheflush.h
+++ b/arch/powerpc/include/asm/cacheflush.h
@@ -32,9 +32,12 @@
  * not expect this type of fault. flush_cache_vmap is not exactly the right
  * place to put this, but it seems to work well enough.
  */
-#define flush_cache_vmap(start, end)		do { asm volatile("ptesync" ::: "memory"); } while (0)
+static inline void flush_cache_vmap(unsigned long start, unsigned long end)
+{
+	asm volatile("ptesync" ::: "memory");
+}
 #else
-#define flush_cache_vmap(start, end)		do { } while (0)
+static inline void flush_cache_vmap(unsigned long start, unsigned long end) { }
 #endif
 
 #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1
-- 
GitLab


From 9fac39480e398c608231ccd48fa7b55edf936ec7 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Thu, 27 Jun 2019 15:29:40 +0530
Subject: [PATCH 1150/1835] powerpc/xmon: Fix disabling tracing while in xmon

[ Upstream commit aaf06665f7ea3ee9f9754e16c1a507a89f1de5b1 ]

Commit ed49f7fd6438d ("powerpc/xmon: Disable tracing when entering
xmon") added code to disable recording trace entries while in xmon. The
commit introduced a variable 'tracing_enabled' to record if tracing was
enabled on xmon entry, and used this to conditionally enable tracing
during exit from xmon.

However, we are not checking the value of 'fromipi' variable in
xmon_core() when setting 'tracing_enabled'. Due to this, when secondary
cpus enter xmon, they will see tracing as being disabled already and
tracing won't be re-enabled on exit. Fix the same.

Fixes: ed49f7fd6438d ("powerpc/xmon: Disable tracing when entering xmon")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/xmon/xmon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index dd6badc31f458..74cfc1be04d6e 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -466,8 +466,10 @@ static int xmon_core(struct pt_regs *regs, int fromipi)
 	local_irq_save(flags);
 	hard_irq_disable();
 
-	tracing_enabled = tracing_is_on();
-	tracing_off();
+	if (!fromipi) {
+		tracing_enabled = tracing_is_on();
+		tracing_off();
+	}
 
 	bp = in_breakpoint_table(regs->nip, &offset);
 	if (bp != NULL) {
-- 
GitLab


From e00cf1dac30ce291ce002810c5ec167edf8c91c1 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Thu, 27 Jun 2019 00:08:01 +0530
Subject: [PATCH 1151/1835] recordmcount: Fix spurious mcount entries on
 powerpc

[ Upstream commit 80e5302e4bc85a6b685b7668c36c6487b5f90e9a ]

An impending change to enable HAVE_C_RECORDMCOUNT on powerpc leads to
warnings such as the following:

  # modprobe kprobe_example
  ftrace-powerpc: Not expected bl: opcode is 3c4c0001
  WARNING: CPU: 0 PID: 227 at kernel/trace/ftrace.c:2001 ftrace_bug+0x90/0x318
  Modules linked in:
  CPU: 0 PID: 227 Comm: modprobe Not tainted 5.2.0-rc6-00678-g1c329100b942 #2
  NIP:  c000000000264318 LR: c00000000025d694 CTR: c000000000f5cd30
  REGS: c000000001f2b7b0 TRAP: 0700   Not tainted  (5.2.0-rc6-00678-g1c329100b942)
  MSR:  900000010282b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]>  CR: 28228222  XER: 00000000
  CFAR: c0000000002642fc IRQMASK: 0
  <snip>
  NIP [c000000000264318] ftrace_bug+0x90/0x318
  LR [c00000000025d694] ftrace_process_locs+0x4f4/0x5e0
  Call Trace:
  [c000000001f2ba40] [0000000000000004] 0x4 (unreliable)
  [c000000001f2bad0] [c00000000025d694] ftrace_process_locs+0x4f4/0x5e0
  [c000000001f2bb90] [c00000000020ff10] load_module+0x25b0/0x30c0
  [c000000001f2bd00] [c000000000210cb0] sys_finit_module+0xc0/0x130
  [c000000001f2be20] [c00000000000bda4] system_call+0x5c/0x70
  Instruction dump:
  419e0018 2f83ffff 419e00bc 2f83ffea 409e00cc 4800001c 0fe00000 3c62ff96
  39000001 39400000 386386d0 480000c4 <0fe00000> 3ce20003 39000001 3c62ff96
  ---[ end trace 4c438d5cebf78381 ]---
  ftrace failed to modify
  [<c0080000012a0008>] 0xc0080000012a0008
   actual:   01:00:4c:3c
  Initializing ftrace call sites
  ftrace record flags: 2000000
   (0)
   expected tramp: c00000000006af4c

Looking at the relocation records in __mcount_loc shows a few spurious
entries:

  RELOCATION RECORDS FOR [__mcount_loc]:
  OFFSET           TYPE              VALUE
  0000000000000000 R_PPC64_ADDR64    .text.unlikely+0x0000000000000008
  0000000000000008 R_PPC64_ADDR64    .text.unlikely+0x0000000000000014
  0000000000000010 R_PPC64_ADDR64    .text.unlikely+0x0000000000000060
  0000000000000018 R_PPC64_ADDR64    .text.unlikely+0x00000000000000b4
  0000000000000020 R_PPC64_ADDR64    .init.text+0x0000000000000008
  0000000000000028 R_PPC64_ADDR64    .init.text+0x0000000000000014

The first entry in each section is incorrect. Looking at the
relocation records, the spurious entries correspond to the
R_PPC64_ENTRY records:

  RELOCATION RECORDS FOR [.text.unlikely]:
  OFFSET           TYPE              VALUE
  0000000000000000 R_PPC64_REL64     .TOC.-0x0000000000000008
  0000000000000008 R_PPC64_ENTRY     *ABS*
  0000000000000014 R_PPC64_REL24     _mcount
  <snip>

The problem is that we are not validating the return value from
get_mcountsym() in sift_rel_mcount(). With this entry, mcountsym is 0,
but Elf_r_sym(relp) also ends up being 0. Fix this by ensuring
mcountsym is valid before processing the entry.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Tested-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/recordmcount.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
index 2e7793735e145..ccfbfde615563 100644
--- a/scripts/recordmcount.h
+++ b/scripts/recordmcount.h
@@ -326,7 +326,8 @@ static uint_t *sift_rel_mcount(uint_t *mlocp,
 		if (!mcountsym)
 			mcountsym = get_mcountsym(sym0, relp, str0);
 
-		if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) {
+		if (mcountsym && mcountsym == Elf_r_sym(relp) &&
+				!is_fake_mcount(relp)) {
 			uint_t const addend =
 				_w(_w(relp->r_offset) - recval + mcount_adjust);
 			mrelp->r_offset = _w(offbase
-- 
GitLab


From 7b24a4a363a90d8708d6b59046843eddf3eee1a7 Mon Sep 17 00:00:00 2001
From: Daniel Gomez <dagmcr@gmail.com>
Date: Sat, 11 May 2019 12:03:58 +0200
Subject: [PATCH 1152/1835] mfd: madera: Add missing of table registration

[ Upstream commit 5aa3709c0a5c026735b0ddd4ec80810a23d65f5b ]

MODULE_DEVICE_TABLE(of, <of_match_table>) should be called to complete DT
OF mathing mechanism and register it.

Before this patch:
modinfo ./drivers/mfd/madera.ko | grep alias

After this patch:
modinfo ./drivers/mfd/madera.ko | grep alias
alias:          of:N*T*Ccirrus,wm1840C*
alias:          of:N*T*Ccirrus,wm1840
alias:          of:N*T*Ccirrus,cs47l91C*
alias:          of:N*T*Ccirrus,cs47l91
alias:          of:N*T*Ccirrus,cs47l90C*
alias:          of:N*T*Ccirrus,cs47l90
alias:          of:N*T*Ccirrus,cs47l85C*
alias:          of:N*T*Ccirrus,cs47l85
alias:          of:N*T*Ccirrus,cs47l35C*
alias:          of:N*T*Ccirrus,cs47l35

Reported-by: Javier Martinez Canillas <javier@dowhile0.org>
Signed-off-by: Daniel Gomez <dagmcr@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/madera-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
index 8cfea969b0602..45c7d8b973493 100644
--- a/drivers/mfd/madera-core.c
+++ b/drivers/mfd/madera-core.c
@@ -278,6 +278,7 @@ const struct of_device_id madera_of_match[] = {
 	{ .compatible = "cirrus,wm1840", .data = (void *)WM1840 },
 	{}
 };
+MODULE_DEVICE_TABLE(of, madera_of_match);
 EXPORT_SYMBOL_GPL(madera_of_match);
 
 static int madera_get_reset_gpio(struct madera *madera)
-- 
GitLab


From d9c74176c275431894c301c6c3c093b81306eed8 Mon Sep 17 00:00:00 2001
From: Robert Hancock <hancock@sedsystems.ca>
Date: Tue, 4 Jun 2019 16:35:43 -0600
Subject: [PATCH 1153/1835] mfd: core: Set fwnode for created devices

[ Upstream commit c176c6d7e932662668bcaec2d763657096589d85 ]

The logic for setting the of_node on devices created by mfd did not set
the fwnode pointer to match, which caused fwnode-based APIs to
malfunction on these devices since the fwnode pointer was null. Fix
this.

Signed-off-by: Robert Hancock <hancock@sedsystems.ca>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/mfd-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 94e3f32ce9357..182973df1aed4 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -179,6 +179,7 @@ static int mfd_add_device(struct device *parent, int id,
 		for_each_child_of_node(parent->of_node, np) {
 			if (of_device_is_compatible(np, cell->of_compatible)) {
 				pdev->dev.of_node = np;
+				pdev->dev.fwnode = &np->fwnode;
 				break;
 			}
 		}
-- 
GitLab


From 9b1691c3f6602c8e26e99433a1511570b2e6e80c Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 20 May 2019 10:06:25 +0100
Subject: [PATCH 1154/1835] mfd: arizona: Fix undefined behavior

[ Upstream commit 5da6cbcd2f395981aa9bfc571ace99f1c786c985 ]

When the driver is used with a subdevice that is disabled in the
kernel configuration, clang gets a little confused about the
control flow and fails to notice that n_subdevs is only
uninitialized when subdevs is NULL, and we check for that,
leading to a false-positive warning:

drivers/mfd/arizona-core.c:1423:19: error: variable 'n_subdevs' is uninitialized when used here
      [-Werror,-Wuninitialized]
                              subdevs, n_subdevs, NULL, 0, NULL);
                                       ^~~~~~~~~
drivers/mfd/arizona-core.c:999:15: note: initialize the variable 'n_subdevs' to silence this warning
        int n_subdevs, ret, i;
                     ^
                      = 0

Ideally, we would rearrange the code to avoid all those early
initializations and have an explicit exit in each disabled case,
but it's much easier to chicken out and add one more initialization
here to shut up the warning.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/arizona-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index 5f1e37d23943a..47d6d40f41cd5 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -996,7 +996,7 @@ int arizona_dev_init(struct arizona *arizona)
 	unsigned int reg, val;
 	int (*apply_patch)(struct arizona *) = NULL;
 	const struct mfd_cell *subdevs = NULL;
-	int n_subdevs, ret, i;
+	int n_subdevs = 0, ret, i;
 
 	dev_set_drvdata(arizona->dev, arizona);
 	mutex_init(&arizona->clk_lock);
-- 
GitLab


From b4e77006d5a77c13f84ea07767bf7790db0cd033 Mon Sep 17 00:00:00 2001
From: Axel Lin <axel.lin@ingics.com>
Date: Wed, 26 Jun 2019 21:30:07 +0800
Subject: [PATCH 1155/1835] mfd: hi655x-pmic: Fix missing return value check
 for devm_regmap_init_mmio_clk

[ Upstream commit 7efd105c27fd2323789b41b64763a0e33ed79c08 ]

Since devm_regmap_init_mmio_clk can fail, add return value checking.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Chen Feng <puck.chen@hisilicon.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/hi655x-pmic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
index 96c07fa1802ad..6693f74aa6ab9 100644
--- a/drivers/mfd/hi655x-pmic.c
+++ b/drivers/mfd/hi655x-pmic.c
@@ -112,6 +112,8 @@ static int hi655x_pmic_probe(struct platform_device *pdev)
 
 	pmic->regmap = devm_regmap_init_mmio_clk(dev, NULL, base,
 						 &hi655x_regmap_config);
+	if (IS_ERR(pmic->regmap))
+		return PTR_ERR(pmic->regmap);
 
 	regmap_read(pmic->regmap, HI655X_BUS_ADDR(HI655X_VER_REG), &pmic->ver);
 	if ((pmic->ver < PMU_VER_START) || (pmic->ver > PMU_VER_END)) {
-- 
GitLab


From 30edc7c1fed524bb85fcf3ad7312f93411f48055 Mon Sep 17 00:00:00 2001
From: Ira Weiny <ira.weiny@intel.com>
Date: Wed, 5 Jun 2019 14:49:22 -0700
Subject: [PATCH 1156/1835] mm/swap: fix release_pages() when releasing devmap
 pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c5d6c45e90c49150670346967971e14576afd7f1 ]

release_pages() is an optimized version of a loop around put_page().
Unfortunately for devmap pages the logic is not entirely correct in
release_pages().  This is because device pages can be more than type
MEMORY_DEVICE_PUBLIC.  There are in fact 4 types, private, public, FS DAX,
and PCI P2PDMA.  Some of these have specific needs to "put" the page while
others do not.

This logic to handle any special needs is contained in
put_devmap_managed_page().  Therefore all devmap pages should be processed
by this function where we can contain the correct logic for a page put.

Handle all device type pages within release_pages() by calling
put_devmap_managed_page() on all devmap pages.  If
put_devmap_managed_page() returns true the page has been put and we
continue with the next page.  A false return of put_devmap_managed_page()
means the page did not require special processing and should fall to
"normal" processing.

This was found via code inspection while determining if release_pages()
and the new put_user_pages() could be interchangeable.[1]

[1] https://lkml.kernel.org/r/20190523172852.GA27175@iweiny-DESK2.sc.intel.com

Link: https://lkml.kernel.org/r/20190605214922.17684-1-ira.weiny@intel.com
Cc: Jérôme Glisse <jglisse@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/swap.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/mm/swap.c b/mm/swap.c
index a3fc028e338e5..45fdbfb6b2a60 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -740,15 +740,20 @@ void release_pages(struct page **pages, int nr)
 		if (is_huge_zero_page(page))
 			continue;
 
-		/* Device public page can not be huge page */
-		if (is_device_public_page(page)) {
+		if (is_zone_device_page(page)) {
 			if (locked_pgdat) {
 				spin_unlock_irqrestore(&locked_pgdat->lru_lock,
 						       flags);
 				locked_pgdat = NULL;
 			}
-			put_devmap_managed_page(page);
-			continue;
+			/*
+			 * ZONE_DEVICE pages that return 'false' from
+			 * put_devmap_managed_page() do not require special
+			 * processing, and instead, expect a call to
+			 * put_page_testzero().
+			 */
+			if (put_devmap_managed_page(page))
+				continue;
 		}
 
 		page = compound_head(page);
-- 
GitLab


From 74520144700d59118313559c5fc7869facc2437d Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 24 May 2019 21:54:14 +0200
Subject: [PATCH 1157/1835] um: Silence lockdep complaint about mmap_sem

[ Upstream commit 80bf6ceaf9310b3f61934c69b382d4912deee049 ]

When we get into activate_mm(), lockdep complains that we're doing
something strange:

    WARNING: possible circular locking dependency detected
    5.1.0-10252-gb00152307319-dirty #121 Not tainted
    ------------------------------------------------------
    inside.sh/366 is trying to acquire lock:
    (____ptrval____) (&(&p->alloc_lock)->rlock){+.+.}, at: flush_old_exec+0x703/0x8d7

    but task is already holding lock:
    (____ptrval____) (&mm->mmap_sem){++++}, at: flush_old_exec+0x6c5/0x8d7

    which lock already depends on the new lock.

    the existing dependency chain (in reverse order) is:

    -> #1 (&mm->mmap_sem){++++}:
           [...]
           __lock_acquire+0x12ab/0x139f
           lock_acquire+0x155/0x18e
           down_write+0x3f/0x98
           flush_old_exec+0x748/0x8d7
           load_elf_binary+0x2ca/0xddb
           [...]

    -> #0 (&(&p->alloc_lock)->rlock){+.+.}:
           [...]
           __lock_acquire+0x12ab/0x139f
           lock_acquire+0x155/0x18e
           _raw_spin_lock+0x30/0x83
           flush_old_exec+0x703/0x8d7
           load_elf_binary+0x2ca/0xddb
           [...]

    other info that might help us debug this:

     Possible unsafe locking scenario:

           CPU0                    CPU1
           ----                    ----
      lock(&mm->mmap_sem);
                                   lock(&(&p->alloc_lock)->rlock);
                                   lock(&mm->mmap_sem);
      lock(&(&p->alloc_lock)->rlock);

     *** DEADLOCK ***

    2 locks held by inside.sh/366:
     #0: (____ptrval____) (&sig->cred_guard_mutex){+.+.}, at: __do_execve_file+0x12d/0x869
     #1: (____ptrval____) (&mm->mmap_sem){++++}, at: flush_old_exec+0x6c5/0x8d7

    stack backtrace:
    CPU: 0 PID: 366 Comm: inside.sh Not tainted 5.1.0-10252-gb00152307319-dirty #121
    Stack:
     [...]
    Call Trace:
     [<600420de>] show_stack+0x13b/0x155
     [<6048906b>] dump_stack+0x2a/0x2c
     [<6009ae64>] print_circular_bug+0x332/0x343
     [<6009c5c6>] check_prev_add+0x669/0xdad
     [<600a06b4>] __lock_acquire+0x12ab/0x139f
     [<6009f3d0>] lock_acquire+0x155/0x18e
     [<604a07e0>] _raw_spin_lock+0x30/0x83
     [<60151e6a>] flush_old_exec+0x703/0x8d7
     [<601a8eb8>] load_elf_binary+0x2ca/0xddb
     [...]

I think it's because in exec_mmap() we have

	down_read(&old_mm->mmap_sem);
...
        task_lock(tsk);
...
	activate_mm(active_mm, mm);
	(which does down_write(&mm->mmap_sem))

I'm not really sure why lockdep throws in the whole knowledge
about the task lock, but it seems that old_mm and mm shouldn't
ever be the same (and it doesn't deadlock) so tell lockdep that
they're different.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/include/asm/mmu_context.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h
index fca34b2177e28..129fb1d1f1c5b 100644
--- a/arch/um/include/asm/mmu_context.h
+++ b/arch/um/include/asm/mmu_context.h
@@ -53,7 +53,7 @@ static inline void activate_mm(struct mm_struct *old, struct mm_struct *new)
 	 * when the new ->mm is used for the first time.
 	 */
 	__switch_mm(&new->context.id);
-	down_write(&new->mmap_sem);
+	down_write_nested(&new->mmap_sem, 1);
 	uml_setup_stubs(new);
 	up_write(&new->mmap_sem);
 }
-- 
GitLab


From 52373ab6a6c75ba885f11d3f3ce6dfdf897a7264 Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@gmail.com>
Date: Sat, 15 Jun 2019 17:23:13 +0200
Subject: [PATCH 1158/1835] powerpc/4xx/uic: clear pending interrupt after irq
 type/pol change

[ Upstream commit 3ab3a0689e74e6aa5b41360bc18861040ddef5b1 ]

When testing out gpio-keys with a button, a spurious
interrupt (and therefore a key press or release event)
gets triggered as soon as the driver enables the irq
line for the first time.

This patch clears any potential bogus generated interrupt
that was caused by the switching of the associated irq's
type and polarity.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/4xx/uic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/platforms/4xx/uic.c b/arch/powerpc/platforms/4xx/uic.c
index 8b4dd0da08395..9e27cfe270268 100644
--- a/arch/powerpc/platforms/4xx/uic.c
+++ b/arch/powerpc/platforms/4xx/uic.c
@@ -158,6 +158,7 @@ static int uic_set_irq_type(struct irq_data *d, unsigned int flow_type)
 
 	mtdcr(uic->dcrbase + UIC_PR, pr);
 	mtdcr(uic->dcrbase + UIC_TR, tr);
+	mtdcr(uic->dcrbase + UIC_SR, ~mask);
 
 	raw_spin_unlock_irqrestore(&uic->lock, flags);
 
-- 
GitLab


From ca730bf0cd67233041a6749f86ff2a431ca85524 Mon Sep 17 00:00:00 2001
From: "Liu, Changcheng" <changcheng.liu@intel.com>
Date: Fri, 28 Jun 2019 14:16:13 +0800
Subject: [PATCH 1159/1835] RDMA/i40iw: Set queue pair state when being queried

[ Upstream commit 2e67e775845373905d2c2aecb9062c2c4352a535 ]

The API for ib_query_qp requires the driver to set qp_state and
cur_qp_state on return, add the missing sets.

Fixes: d37498417947 ("i40iw: add files for iwarp interface")
Signed-off-by: Changcheng Liu <changcheng.liu@aliyun.com>
Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/i40iw/i40iw_verbs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index e2e6c74a74522..a5e3349b8a7c3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -806,6 +806,8 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
 	struct i40iw_qp *iwqp = to_iwqp(ibqp);
 	struct i40iw_sc_qp *qp = &iwqp->sc_qp;
 
+	attr->qp_state = iwqp->ibqp_state;
+	attr->cur_qp_state = attr->qp_state;
 	attr->qp_access_flags = 0;
 	attr->cap.max_send_wr = qp->qp_uk.sq_size;
 	attr->cap.max_recv_wr = qp->qp_uk.rq_size;
-- 
GitLab


From 48c73b8ee5c966fd9bbe4da0ab9c5f1fab5ce416 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Mon, 24 Jun 2019 14:35:40 +0200
Subject: [PATCH 1160/1835] serial: sh-sci: Terminate TX DMA during buffer
 flushing

[ Upstream commit 775b7ffd7d6d5db320d99b0a485c51e04dfcf9f1 ]

While the .flush_buffer() callback clears sci_port.tx_dma_len since
commit 1cf4a7efdc71cab8 ("serial: sh-sci: Fix race condition causing
garbage during shutdown"), it does not terminate a transmit DMA
operation that may be in progress.

Fix this by terminating any pending DMA operations, and resetting the
corresponding cookie.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Tested-by: Eugeniu Rosca <erosca@de.adit-jv.com>

Link: https://lore.kernel.org/r/20190624123540.20629-3-geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/sh-sci.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 040832635a649..71f12601e693b 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1633,11 +1633,18 @@ static void sci_free_dma(struct uart_port *port)
 
 static void sci_flush_buffer(struct uart_port *port)
 {
+	struct sci_port *s = to_sci_port(port);
+
 	/*
 	 * In uart_flush_buffer(), the xmit circular buffer has just been
-	 * cleared, so we have to reset tx_dma_len accordingly.
+	 * cleared, so we have to reset tx_dma_len accordingly, and stop any
+	 * pending transfers
 	 */
-	to_sci_port(port)->tx_dma_len = 0;
+	s->tx_dma_len = 0;
+	if (s->chan_tx) {
+		dmaengine_terminate_async(s->chan_tx);
+		s->cookie_tx = -EINVAL;
+	}
 }
 #else /* !CONFIG_SERIAL_SH_SCI_DMA */
 static inline void sci_request_dma(struct uart_port *port)
-- 
GitLab


From d03aeb8d6b98bc6e8ddf001d492c9f03bb68f867 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Mon, 24 Jun 2019 14:35:39 +0200
Subject: [PATCH 1161/1835] serial: sh-sci: Fix TX DMA buffer flushing and
 workqueue races

[ Upstream commit 8493eab02608b0e82f67b892aa72882e510c31d0 ]

When uart_flush_buffer() is called, the .flush_buffer() callback zeroes
the tx_dma_len field.  This may race with the work queue function
handling transmit DMA requests:

  1. If the buffer is flushed before the first DMA API call,
     dmaengine_prep_slave_single() may be called with a zero length,
     causing the DMA request to never complete, leading to messages
     like:

        rcar-dmac e7300000.dma-controller: Channel Address Error happen

     and, with debug enabled:

	sh-sci e6e88000.serial: sci_dma_tx_work_fn: ffff800639b55000: 0...0, cookie 126

     and DMA timeouts.

  2. If the buffer is flushed after the first DMA API call, but before
     the second, dma_sync_single_for_device() may be called with a zero
     length, causing the transmit data not to be flushed to RAM, and
     leading to stale data being output.

Fix this by:
  1. Letting sci_dma_tx_work_fn() return immediately if the transmit
     buffer is empty,
  2. Extending the critical section to cover all DMA preparational work,
     so tx_dma_len stays consistent for all of it,
  3. Using local copies of circ_buf.head and circ_buf.tail, to make sure
     they match the actual operation above.

Reported-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Suggested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Tested-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Link: https://lore.kernel.org/r/20190624123540.20629-2-geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/sh-sci.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 71f12601e693b..5550289e6678b 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1376,6 +1376,7 @@ static void work_fn_tx(struct work_struct *work)
 	struct circ_buf *xmit = &port->state->xmit;
 	unsigned long flags;
 	dma_addr_t buf;
+	int head, tail;
 
 	/*
 	 * DMA is idle now.
@@ -1385,16 +1386,23 @@ static void work_fn_tx(struct work_struct *work)
 	 * consistent xmit buffer state.
 	 */
 	spin_lock_irq(&port->lock);
-	buf = s->tx_dma_addr + (xmit->tail & (UART_XMIT_SIZE - 1));
+	head = xmit->head;
+	tail = xmit->tail;
+	buf = s->tx_dma_addr + (tail & (UART_XMIT_SIZE - 1));
 	s->tx_dma_len = min_t(unsigned int,
-		CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
-		CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE));
-	spin_unlock_irq(&port->lock);
+		CIRC_CNT(head, tail, UART_XMIT_SIZE),
+		CIRC_CNT_TO_END(head, tail, UART_XMIT_SIZE));
+	if (!s->tx_dma_len) {
+		/* Transmit buffer has been flushed */
+		spin_unlock_irq(&port->lock);
+		return;
+	}
 
 	desc = dmaengine_prep_slave_single(chan, buf, s->tx_dma_len,
 					   DMA_MEM_TO_DEV,
 					   DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
 	if (!desc) {
+		spin_unlock_irq(&port->lock);
 		dev_warn(port->dev, "Failed preparing Tx DMA descriptor\n");
 		goto switch_to_pio;
 	}
@@ -1402,18 +1410,18 @@ static void work_fn_tx(struct work_struct *work)
 	dma_sync_single_for_device(chan->device->dev, buf, s->tx_dma_len,
 				   DMA_TO_DEVICE);
 
-	spin_lock_irq(&port->lock);
 	desc->callback = sci_dma_tx_complete;
 	desc->callback_param = s;
-	spin_unlock_irq(&port->lock);
 	s->cookie_tx = dmaengine_submit(desc);
 	if (dma_submit_error(s->cookie_tx)) {
+		spin_unlock_irq(&port->lock);
 		dev_warn(port->dev, "Failed submitting Tx DMA descriptor\n");
 		goto switch_to_pio;
 	}
 
+	spin_unlock_irq(&port->lock);
 	dev_dbg(port->dev, "%s: %p: %d...%d, cookie %d\n",
-		__func__, xmit->buf, xmit->tail, xmit->head, s->cookie_tx);
+		__func__, xmit->buf, tail, head, s->cookie_tx);
 
 	dma_async_issue_pending(chan);
 	return;
-- 
GitLab


From f14537bb81d1afb0e9e7c3a6c5f83ad1fd6478ec Mon Sep 17 00:00:00 2001
From: Parav Pandit <parav@mellanox.com>
Date: Sun, 30 Jun 2019 10:52:52 +0300
Subject: [PATCH 1162/1835] IB/mlx5: Fixed reporting counters on 2nd port for
 Dual port RoCE

[ Upstream commit 2f40cf30c8644360d37287861d5288f00eab35e5 ]

Currently during dual port IB device registration in below code flow,

ib_register_device()
  ib_device_register_sysfs()
    ib_setup_port_attrs()
      add_port()
        get_counter_table()
          get_perf_mad()
            process_mad()
              mlx5_ib_process_mad()

mlx5_ib_process_mad() fails on 2nd port when both the ports are not fully
setup at the device level (because 2nd port is unaffiliated).

As a result, get_perf_mad() registers different PMA counter group for 1st
and 2nd port, namely pma_counter_ext and pma_counter. However both ports
have the same capability and counter offsets.

Due to this when counters are read by the user via sysfs in below code
flow, counters are queried from wrong location from the device mainly from
PPCNT instead of VPORT counters.

show_pma_counter()
  get_perf_mad()
    process_mad()
      mlx5_ib_process_mad()
        process_pma_cmd()

This shows all zero counters for 2nd port.

To overcome this, process_pma_cmd() is invoked, and when unaffiliated port
is not yet setup during device registration phase, make the query on the
first port.  while at it, only process_pma_cmd() needs to work on the
native port number and underlying mdev, so shift the get, put calls to
where its needed inside process_pma_cmd().

Fixes: 212f2a87b74f ("IB/mlx5: Route MADs for dual port RoCE")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/mad.c | 60 +++++++++++++++++++-------------
 1 file changed, 36 insertions(+), 24 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
index 32a9e9228b135..cdf6e26ebc87d 100644
--- a/drivers/infiniband/hw/mlx5/mad.c
+++ b/drivers/infiniband/hw/mlx5/mad.c
@@ -197,19 +197,33 @@ static void pma_cnt_assign(struct ib_pma_portcounters *pma_cnt,
 			     vl_15_dropped);
 }
 
-static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
+static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num,
 			   const struct ib_mad *in_mad, struct ib_mad *out_mad)
 {
-	int err;
+	struct mlx5_core_dev *mdev;
+	bool native_port = true;
+	u8 mdev_port_num;
 	void *out_cnt;
+	int err;
 
+	mdev = mlx5_ib_get_native_port_mdev(dev, port_num, &mdev_port_num);
+	if (!mdev) {
+		/* Fail to get the native port, likely due to 2nd port is still
+		 * unaffiliated. In such case default to 1st port and attached
+		 * PF device.
+		 */
+		native_port = false;
+		mdev = dev->mdev;
+		mdev_port_num = 1;
+	}
 	/* Declaring support of extended counters */
 	if (in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO) {
 		struct ib_class_port_info cpi = {};
 
 		cpi.capability_mask = IB_PMA_CLASS_CAP_EXT_WIDTH;
 		memcpy((out_mad->data + 40), &cpi, sizeof(cpi));
-		return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
+		err = IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
+		goto done;
 	}
 
 	if (in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS_EXT) {
@@ -218,11 +232,13 @@ static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
 		int sz = MLX5_ST_SZ_BYTES(query_vport_counter_out);
 
 		out_cnt = kvzalloc(sz, GFP_KERNEL);
-		if (!out_cnt)
-			return IB_MAD_RESULT_FAILURE;
+		if (!out_cnt) {
+			err = IB_MAD_RESULT_FAILURE;
+			goto done;
+		}
 
 		err = mlx5_core_query_vport_counter(mdev, 0, 0,
-						    port_num, out_cnt, sz);
+						    mdev_port_num, out_cnt, sz);
 		if (!err)
 			pma_cnt_ext_assign(pma_cnt_ext, out_cnt);
 	} else {
@@ -231,20 +247,23 @@ static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
 		int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
 
 		out_cnt = kvzalloc(sz, GFP_KERNEL);
-		if (!out_cnt)
-			return IB_MAD_RESULT_FAILURE;
+		if (!out_cnt) {
+			err = IB_MAD_RESULT_FAILURE;
+			goto done;
+		}
 
-		err = mlx5_core_query_ib_ppcnt(mdev, port_num,
+		err = mlx5_core_query_ib_ppcnt(mdev, mdev_port_num,
 					       out_cnt, sz);
 		if (!err)
 			pma_cnt_assign(pma_cnt, out_cnt);
-		}
-
+	}
 	kvfree(out_cnt);
-	if (err)
-		return IB_MAD_RESULT_FAILURE;
-
-	return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
+	err = err ? IB_MAD_RESULT_FAILURE :
+		    IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
+done:
+	if (native_port)
+		mlx5_ib_put_native_port_mdev(dev, port_num);
+	return err;
 }
 
 int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
@@ -256,8 +275,6 @@ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 	struct mlx5_ib_dev *dev = to_mdev(ibdev);
 	const struct ib_mad *in_mad = (const struct ib_mad *)in;
 	struct ib_mad *out_mad = (struct ib_mad *)out;
-	struct mlx5_core_dev *mdev;
-	u8 mdev_port_num;
 	int ret;
 
 	if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
@@ -266,19 +283,14 @@ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 
 	memset(out_mad->data, 0, sizeof(out_mad->data));
 
-	mdev = mlx5_ib_get_native_port_mdev(dev, port_num, &mdev_port_num);
-	if (!mdev)
-		return IB_MAD_RESULT_FAILURE;
-
-	if (MLX5_CAP_GEN(mdev, vport_counters) &&
+	if (MLX5_CAP_GEN(dev->mdev, vport_counters) &&
 	    in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
 	    in_mad->mad_hdr.method == IB_MGMT_METHOD_GET) {
-		ret = process_pma_cmd(mdev, mdev_port_num, in_mad, out_mad);
+		ret = process_pma_cmd(dev, port_num, in_mad, out_mad);
 	} else {
 		ret =  process_mad(ibdev, mad_flags, port_num, in_wc, in_grh,
 				   in_mad, out_mad);
 	}
-	mlx5_ib_put_native_port_mdev(dev, port_num);
 	return ret;
 }
 
-- 
GitLab


From d48720bafd904f23d05b7c026c7fb44972d6e8f1 Mon Sep 17 00:00:00 2001
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Date: Tue, 28 May 2019 11:06:24 +0530
Subject: [PATCH 1163/1835] powerpc/mm: Handle page table allocation failures

[ Upstream commit 2230ebf6e6dd0b7751e2921b40f6cfe34f09bb16 ]

This fixes kernel crash that arises due to not handling page table allocation
failures while allocating hugetlb page table.

Fixes: e2b3d202d1db ("powerpc: Switch 16GB and 16MB explicit hugepages to a different page table format")
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/hugetlbpage.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 7296a42eb62e4..cef0b7ee10246 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -150,6 +150,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
 	} else {
 		pdshift = PUD_SHIFT;
 		pu = pud_alloc(mm, pg, addr);
+		if (!pu)
+			return NULL;
 		if (pshift == PUD_SHIFT)
 			return (pte_t *)pu;
 		else if (pshift > PMD_SHIFT) {
@@ -158,6 +160,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
 		} else {
 			pdshift = PMD_SHIFT;
 			pm = pmd_alloc(mm, pu, addr);
+			if (!pm)
+				return NULL;
 			if (pshift == PMD_SHIFT)
 				/* 16MB hugepage */
 				return (pte_t *)pm;
@@ -174,12 +178,16 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
 	} else {
 		pdshift = PUD_SHIFT;
 		pu = pud_alloc(mm, pg, addr);
+		if (!pu)
+			return NULL;
 		if (pshift >= PUD_SHIFT) {
 			ptl = pud_lockptr(mm, pu);
 			hpdp = (hugepd_t *)pu;
 		} else {
 			pdshift = PMD_SHIFT;
 			pm = pmd_alloc(mm, pu, addr);
+			if (!pm)
+				return NULL;
 			ptl = pmd_lockptr(mm, pm);
 			hpdp = (hugepd_t *)pm;
 		}
-- 
GitLab


From 007b01a27d4d5628d686d64c1b13356a7f21aad7 Mon Sep 17 00:00:00 2001
From: Valentine Fatiev <valentinef@mellanox.com>
Date: Sun, 30 Jun 2019 16:48:41 +0300
Subject: [PATCH 1164/1835] IB/ipoib: Add child to parent list only if device
 initialized

[ Upstream commit 91b01061fef9c57d2f5b712a6322ef51061f4efd ]

Despite failure in ipoib_dev_init() we continue with initialization flow
and creation of child device. It causes to the situation where this child
device is added too early to parent device list.

Change the logic, so in case of failure we properly return error from
ipoib_dev_init() and add child only in success path.

Fixes: eaeb39842508 ("IB/ipoib: Move init code to ndo_init")
Signed-off-by: Valentine Fatiev <valentinef@mellanox.com>
Reviewed-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c | 34 +++++++++++++----------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 009615499b37a..78dd36daac00e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1892,12 +1892,6 @@ static void ipoib_child_init(struct net_device *ndev)
 	struct ipoib_dev_priv *priv = ipoib_priv(ndev);
 	struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
 
-	dev_hold(priv->parent);
-
-	down_write(&ppriv->vlan_rwsem);
-	list_add_tail(&priv->list, &ppriv->child_intfs);
-	up_write(&ppriv->vlan_rwsem);
-
 	priv->max_ib_mtu = ppriv->max_ib_mtu;
 	set_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags);
 	memcpy(priv->dev->dev_addr, ppriv->dev->dev_addr, INFINIBAND_ALEN);
@@ -1940,6 +1934,17 @@ static int ipoib_ndo_init(struct net_device *ndev)
 	if (rc) {
 		pr_warn("%s: failed to initialize device: %s port %d (ret = %d)\n",
 			priv->ca->name, priv->dev->name, priv->port, rc);
+		return rc;
+	}
+
+	if (priv->parent) {
+		struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
+
+		dev_hold(priv->parent);
+
+		down_write(&ppriv->vlan_rwsem);
+		list_add_tail(&priv->list, &ppriv->child_intfs);
+		up_write(&ppriv->vlan_rwsem);
 	}
 
 	return 0;
@@ -1957,6 +1962,14 @@ static void ipoib_ndo_uninit(struct net_device *dev)
 	 */
 	WARN_ON(!list_empty(&priv->child_intfs));
 
+	if (priv->parent) {
+		struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
+
+		down_write(&ppriv->vlan_rwsem);
+		list_del(&priv->list);
+		up_write(&ppriv->vlan_rwsem);
+	}
+
 	ipoib_neigh_hash_uninit(dev);
 
 	ipoib_ib_dev_cleanup(dev);
@@ -1968,15 +1981,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)
 		priv->wq = NULL;
 	}
 
-	if (priv->parent) {
-		struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
-
-		down_write(&ppriv->vlan_rwsem);
-		list_del(&priv->list);
-		up_write(&ppriv->vlan_rwsem);
-
+	if (priv->parent)
 		dev_put(priv->parent);
-	}
 }
 
 static int ipoib_set_vf_link_state(struct net_device *dev, int vf, int link_state)
-- 
GitLab


From 05959ed85e34240ba3980c784d7634a4ebc753f5 Mon Sep 17 00:00:00 2001
From: James Morse <james.morse@arm.com>
Date: Tue, 18 Jun 2019 16:17:33 +0100
Subject: [PATCH 1165/1835] arm64: assembler: Switch ESB-instruction with a
 vanilla nop if !ARM64_HAS_RAS

[ Upstream commit 2b68a2a963a157f024c67c0697b16f5f792c8a35 ]

The ESB-instruction is a nop on CPUs that don't implement the RAS
extensions. This lets us use it in places like the vectors without
having to use alternatives.

If someone disables CONFIG_ARM64_RAS_EXTN, this instruction still has
its RAS extensions behaviour, but we no longer read DISR_EL1 as this
register does depend on alternatives.

This could go wrong if we want to synchronize an SError from a KVM
guest. On a CPU that has the RAS extensions, but the KConfig option
was disabled, we consume the pending SError with no chance of ever
reading it.

Hide the ESB-instruction behind the CONFIG_ARM64_RAS_EXTN option,
outputting a regular nop if the feature has been disabled.

Reported-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/assembler.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index f90f5d83b228a..5a97ac8531682 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -112,7 +112,11 @@
  * RAS Error Synchronization barrier
  */
 	.macro  esb
+#ifdef CONFIG_ARM64_RAS_EXTN
 	hint    #16
+#else
+	nop
+#endif
 	.endm
 
 /*
-- 
GitLab


From 51308ec525cc1d2bf0552b9d4c2ad6abe0000d80 Mon Sep 17 00:00:00 2001
From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Date: Fri, 5 Jul 2019 17:56:31 +0800
Subject: [PATCH 1166/1835] PCI: mobiveil: Fix PCI base address in MEM/IO
 outbound windows

[ Upstream commit f99536e9d2f55996038158a6559d4254a7cc1693 ]

The outbound memory windows PCI base addresses should be taken
from the 'ranges' property of DT node to setup MEM/IO outbound
windows decoding correctly instead of being hardcoded to zero.

Update the code to retrieve the PCI base address for each range
and use it to program the outbound windows address decoders

Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver")
Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Reviewed-by: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index a939e8d31735a..d9f2d0f2d602a 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -559,8 +559,9 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
 		if (type) {
 			/* configure outbound translation window */
 			program_ob_windows(pcie, pcie->ob_wins_configured,
-				win->res->start, 0, type,
-				resource_size(win->res));
+					   win->res->start,
+					   win->res->start - win->offset,
+					   type, resource_size(win->res));
 		}
 	}
 
-- 
GitLab


From 4613f46ef47211d2979b23a0801cb05a34f2c98a Mon Sep 17 00:00:00 2001
From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Date: Fri, 5 Jul 2019 17:56:35 +0800
Subject: [PATCH 1167/1835] PCI: mobiveil: Fix the Class Code field

[ Upstream commit 0122af0a08243f344a438f924e5c2486486555b3 ]

Fix up the Class Code field in PCI configuration space and set it to
PCI_CLASS_BRIDGE_PCI.

Move the Class Code fixup to function mobiveil_host_init() where
it belongs.

Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver")
Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Reviewed-by: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index d9f2d0f2d602a..3e81e68b5ce02 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -565,6 +565,12 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
 		}
 	}
 
+	/* fixup for PCIe class register */
+	value = csr_readl(pcie, PAB_INTP_AXI_PIO_CLASS);
+	value &= 0xff;
+	value |= (PCI_CLASS_BRIDGE_PCI << 16);
+	csr_writel(pcie, value, PAB_INTP_AXI_PIO_CLASS);
+
 	/* setup MSI hardware registers */
 	mobiveil_pcie_enable_msi(pcie);
 
@@ -805,9 +811,6 @@ static int mobiveil_pcie_probe(struct platform_device *pdev)
 		goto error;
 	}
 
-	/* fixup for PCIe class register */
-	csr_writel(pcie, 0x060402ab, PAB_INTP_AXI_PIO_CLASS);
-
 	/* initialize the IRQ domains */
 	ret = mobiveil_pcie_init_irq_domain(pcie);
 	if (ret) {
-- 
GitLab


From 9eb4f2886db31f4735c334d69ddae1d8deca02e9 Mon Sep 17 00:00:00 2001
From: Vasily Gorbik <gor@linux.ibm.com>
Date: Fri, 28 Jun 2019 19:22:47 +0200
Subject: [PATCH 1168/1835] kallsyms: exclude kasan local symbols on s390

[ Upstream commit 33177f01ca3fe550146bb9001bec2fd806b2f40c ]

gcc asan instrumentation emits the following sequence to store frame pc
when the kernel is built with CONFIG_RELOCATABLE:
debug/vsprintf.s:
        .section        .data.rel.ro.local,"aw"
        .align  8
.LC3:
        .quad   .LASANPC4826@GOTOFF
.text
        .align  8
        .type   number, @function
number:
.LASANPC4826:

and in case reloc is issued for LASANPC label it also gets into .symtab
with the same address as actual function symbol:
$ nm -n vmlinux | grep 0000000001397150
0000000001397150 t .LASANPC4826
0000000001397150 t number

In the end kernel backtraces are almost unreadable:
[  143.748476] Call Trace:
[  143.748484] ([<000000002da3e62c>] .LASANPC2671+0x114/0x190)
[  143.748492]  [<000000002eca1a58>] .LASANPC2612+0x110/0x160
[  143.748502]  [<000000002de9d830>] print_address_description+0x80/0x3b0
[  143.748511]  [<000000002de9dd64>] __kasan_report+0x15c/0x1c8
[  143.748521]  [<000000002ecb56d4>] strrchr+0x34/0x60
[  143.748534]  [<000003ff800a9a40>] kasan_strings+0xb0/0x148 [test_kasan]
[  143.748547]  [<000003ff800a9bba>] kmalloc_tests_init+0xe2/0x528 [test_kasan]
[  143.748555]  [<000000002da2117c>] .LASANPC4069+0x354/0x748
[  143.748563]  [<000000002dbfbb16>] do_init_module+0x136/0x3b0
[  143.748571]  [<000000002dbff3f4>] .LASANPC3191+0x2164/0x25d0
[  143.748580]  [<000000002dbffc4c>] .LASANPC3196+0x184/0x1b8
[  143.748587]  [<000000002ecdf2ec>] system_call+0xd8/0x2d8

Since LASANPC labels are not even unique and get into .symtab only due
to relocs filter them out in kallsyms.

Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kallsyms.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 0c9c54b57515e..31ed7f3f0e157 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -152,6 +152,9 @@ static int read_symbol(FILE *in, struct sym_entry *s)
 	/* exclude debugging symbols */
 	else if (stype == 'N' || stype == 'n')
 		return -1;
+	/* exclude s390 kasan local symbols */
+	else if (!strncmp(sym, ".LASANPC", 8))
+		return -1;
 
 	/* include the type field in the symbol name, so that it gets
 	 * compressed together */
-- 
GitLab


From 270972df68fbe20e379771d870b1446f7255f64d Mon Sep 17 00:00:00 2001
From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Date: Fri, 5 Jul 2019 17:56:38 +0800
Subject: [PATCH 1169/1835] PCI: mobiveil: Initialize
 Primary/Secondary/Subordinate bus numbers

[ Upstream commit 6f3ab451aa5c2cbff33197d82fe8489cbd55ad91 ]

The reset value of Primary, Secondary and Subordinate bus numbers is
zero which is a broken setup.

Program a sensible default value for Primary/Secondary/Subordinate
bus numbers.

Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Reviewed-by: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index 3e81e68b5ce02..2fe7ebdad2d2f 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -508,6 +508,12 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
 		return err;
 	}
 
+	/* setup bus numbers */
+	value = csr_readl(pcie, PCI_PRIMARY_BUS);
+	value &= 0xff000000;
+	value |= 0x00ff0100;
+	csr_writel(pcie, value, PCI_PRIMARY_BUS);
+
 	/*
 	 * program Bus Master Enable Bit in Command Register in PAB Config
 	 * Space
-- 
GitLab


From dd0a0c72a10f947fb5c1eb2682866249a2317af3 Mon Sep 17 00:00:00 2001
From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Date: Fri, 5 Jul 2019 17:56:34 +0800
Subject: [PATCH 1170/1835] PCI: mobiveil: Use the 1st inbound window for MEM
 inbound transactions

[ Upstream commit f7fee1b42fe4f8171a4b1cad05c61907c33c53f6 ]

The inbound and outbound windows have completely separate control
registers sets in the host controller MMIO space. Windows control
register are accessed through an MMIO base address and an offset
that depends on the window index.

Since inbound and outbound windows control registers are completely
separate there is no real need to use different window indexes in the
inbound/outbound windows initialization routines to prevent clashing.

To fix this inconsistency, change the MEM inbound window index to 0,
mirroring the outbound window set-up.

Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
[lorenzo.pieralisi@arm.com: update commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Reviewed-by: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index 2fe7ebdad2d2f..a2d1e89d48674 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -553,7 +553,7 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
 			resource_size(pcie->ob_io_res));
 
 	/* memory inbound translation window */
-	program_ib_windows(pcie, WIN_NUM_1, 0, MEM_WINDOW_TYPE, IB_WIN_SIZE);
+	program_ib_windows(pcie, WIN_NUM_0, 0, MEM_WINDOW_TYPE, IB_WIN_SIZE);
 
 	/* Get the I/O and memory ranges from DT */
 	resource_list_for_each_entry_safe(win, tmp, &pcie->resources) {
-- 
GitLab


From 3b8c4eae5541409a280f19cf03a43bc4af0c1ceb Mon Sep 17 00:00:00 2001
From: Numfor Mbiziwo-Tiapo <nums@google.com>
Date: Tue, 2 Jul 2019 10:37:15 -0700
Subject: [PATCH 1171/1835] perf test mmap-thread-lookup: Initialize variable
 to suppress memory sanitizer warning

[ Upstream commit 4e4cf62b37da5ff45c904a3acf242ab29ed5881d ]

Running the 'perf test' command after building perf with a memory
sanitizer causes a warning that says:

  WARNING: MemorySanitizer: use-of-uninitialized-value... in mmap-thread-lookup.c

Initializing the go variable to 0 silences this harmless warning.

Committer warning:

This was harmless, just a simple test writing whatever was at that
sizeof(int) memory area just to signal another thread blocked reading
that file created with pipe(). Initialize it tho so that we don't get
this warning.

Signed-off-by: Numfor Mbiziwo-Tiapo <nums@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Drayton <mbd@fb.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/r/20190702173716.181223-1-nums@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/mmap-thread-lookup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/mmap-thread-lookup.c b/tools/perf/tests/mmap-thread-lookup.c
index b1af2499a3c97..7a9b123c7bfcf 100644
--- a/tools/perf/tests/mmap-thread-lookup.c
+++ b/tools/perf/tests/mmap-thread-lookup.c
@@ -52,7 +52,7 @@ static void *thread_fn(void *arg)
 {
 	struct thread_data *td = arg;
 	ssize_t ret;
-	int go;
+	int go = 0;
 
 	if (thread_init(td))
 		return NULL;
-- 
GitLab


From 995527db41f6d9cdaf35eaf606c01a329566ec2b Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Tue, 2 Jul 2019 18:34:11 +0800
Subject: [PATCH 1172/1835] perf stat: Fix use-after-freed pointer detected by
 the smatch tool

[ Upstream commit c74b05030edb3b52f4208d8415b8c933bc509a29 ]

Based on the following report from Smatch, fix the use-after-freed
pointer.

  tools/perf/builtin-stat.c:1353
  add_default_attributes() warn: passing freed memory 'str'.

The pointer 'str' has been freed but later it is still passed into the
function parse_events_print_error().  This patch fixes this
use-after-freed issue.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Alexios Zavras <alexios.zavras@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Changbin Du <changbin.du@intel.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@oracle.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Song Liu <songliubraving@fb.com>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Link: http://lkml.kernel.org/r/20190702103420.27540-3-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-stat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 40720150ccd80..789962565c9c5 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -2497,8 +2497,8 @@ static int add_default_attributes(void)
 				fprintf(stderr,
 					"Cannot set up top down events %s: %d\n",
 					str, err);
-				free(str);
 				parse_events_print_error(&errinfo, str);
+				free(str);
 				return -1;
 			}
 		} else {
-- 
GitLab


From 19cf571c64b7dc84649cafb135e14f9692da3bcc Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Tue, 2 Jul 2019 18:34:12 +0800
Subject: [PATCH 1173/1835] perf top: Fix potential NULL pointer dereference
 detected by the smatch tool

[ Upstream commit 111442cfc8abdeaa7ec1407f07ef7b3e5f76654e ]

Based on the following report from Smatch, fix the potential NULL
pointer dereference check.

  tools/perf/builtin-top.c:109
  perf_top__parse_source() warn: variable dereferenced before check 'he'
  (see line 103)

  tools/perf/builtin-top.c:233
  perf_top__show_details() warn: variable dereferenced before check 'he'
  (see line 228)

  tools/perf/builtin-top.c
  101 static int perf_top__parse_source(struct perf_top *top, struct hist_entry *he)
  102 {
  103         struct perf_evsel *evsel = hists_to_evsel(he->hists);
                                                        ^^^^
  104         struct symbol *sym;
  105         struct annotation *notes;
  106         struct map *map;
  107         int err = -1;
  108
  109         if (!he || !he->ms.sym)
  110                 return -1;

This patch moves the values assignment after validating pointer 'he'.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Alexios Zavras <alexios.zavras@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Changbin Du <changbin.du@intel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@oracle.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Song Liu <songliubraving@fb.com>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190702103420.27540-4-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-top.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 33eefc33e0ea9..d0733251a386e 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -99,7 +99,7 @@ static void perf_top__resize(struct perf_top *top)
 
 static int perf_top__parse_source(struct perf_top *top, struct hist_entry *he)
 {
-	struct perf_evsel *evsel = hists_to_evsel(he->hists);
+	struct perf_evsel *evsel;
 	struct symbol *sym;
 	struct annotation *notes;
 	struct map *map;
@@ -108,6 +108,8 @@ static int perf_top__parse_source(struct perf_top *top, struct hist_entry *he)
 	if (!he || !he->ms.sym)
 		return -1;
 
+	evsel = hists_to_evsel(he->hists);
+
 	sym = he->ms.sym;
 	map = he->ms.map;
 
@@ -224,7 +226,7 @@ static void perf_top__record_precise_ip(struct perf_top *top,
 static void perf_top__show_details(struct perf_top *top)
 {
 	struct hist_entry *he = top->sym_filter_entry;
-	struct perf_evsel *evsel = hists_to_evsel(he->hists);
+	struct perf_evsel *evsel;
 	struct annotation *notes;
 	struct symbol *symbol;
 	int more;
@@ -232,6 +234,8 @@ static void perf_top__show_details(struct perf_top *top)
 	if (!he)
 		return;
 
+	evsel = hists_to_evsel(he->hists);
+
 	symbol = he->ms.sym;
 	notes = symbol__annotation(symbol);
 
-- 
GitLab


From b305dcff1518545bdb9bf23e95a4ee7391775b38 Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Tue, 2 Jul 2019 18:34:17 +0800
Subject: [PATCH 1174/1835] perf session: Fix potential NULL pointer
 dereference found by the smatch tool

[ Upstream commit f3c8d90757724982e5f07cd77d315eb64ca145ac ]

Based on the following report from Smatch, fix the potential
NULL pointer dereference check.

  tools/perf/util/session.c:1252
  dump_read() error: we previously assumed 'evsel' could be null
  (see line 1249)

  tools/perf/util/session.c
  1240 static void dump_read(struct perf_evsel *evsel, union perf_event *event)
  1241 {
  1242         struct read_event *read_event = &event->read;
  1243         u64 read_format;
  1244
  1245         if (!dump_trace)
  1246                 return;
  1247
  1248         printf(": %d %d %s %" PRIu64 "\n", event->read.pid, event->read.tid,
  1249                evsel ? perf_evsel__name(evsel) : "FAIL",
  1250                event->read.value);
  1251
  1252         read_format = evsel->attr.read_format;
                             ^^^^^^^

'evsel' could be NULL pointer, for this case this patch directly bails
out without dumping read_event.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Alexios Zavras <alexios.zavras@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Changbin Du <changbin.du@intel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@oracle.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Song Liu <songliubraving@fb.com>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190702103420.27540-9-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/session.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 11086097fc9f8..f016d1b330e54 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1141,6 +1141,9 @@ static void dump_read(struct perf_evsel *evsel, union perf_event *event)
 	       evsel ? perf_evsel__name(evsel) : "FAIL",
 	       event->read.value);
 
+	if (!evsel)
+		return;
+
 	read_format = evsel->attr.read_format;
 
 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
-- 
GitLab


From 915945f3bdc20def5f8b31a2269a967d63ef89fa Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Tue, 2 Jul 2019 18:34:13 +0800
Subject: [PATCH 1175/1835] perf annotate: Fix dereferencing freed memory found
 by the smatch tool

[ Upstream commit 600c787dbf6521d8d07ee717ab7606d5070103ea ]

Based on the following report from Smatch, fix the potential
dereferencing freed memory check.

  tools/perf/util/annotate.c:1125
  disasm_line__parse() error: dereferencing freed memory 'namep'

  tools/perf/util/annotate.c
  1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
  1101 {
  1102         char tmp, *name = ltrim(line);

  [...]

  1114         *namep = strdup(name);
  1115
  1116         if (*namep == NULL)
  1117                 goto out_free_name;

  [...]

  1124 out_free_name:
  1125         free((void *)namep);
                            ^^^^^
  1126         *namep = NULL;
               ^^^^^^
  1127         return -1;
  1128 }

If strdup() fails to allocate memory space for *namep, we don't need to
free memory with pointer 'namep', which is resident in data structure
disasm_line::ins::name; and *namep is NULL pointer for this failure, so
it's pointless to assign NULL to *namep again.

Committer note:

Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Alexios Zavras <alexios.zavras@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Changbin Du <changbin.du@intel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@oracle.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Song Liu <songliubraving@fb.com>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190702103420.27540-5-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/annotate.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index c357051dd2b6f..daea1fdf73856 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1079,16 +1079,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
 	*namep = strdup(name);
 
 	if (*namep == NULL)
-		goto out_free_name;
+		goto out;
 
 	(*rawp)[0] = tmp;
 	*rawp = ltrim(*rawp);
 
 	return 0;
 
-out_free_name:
-	free((void *)namep);
-	*namep = NULL;
+out:
 	return -1;
 }
 
-- 
GitLab


From 4fe7ea29e4a696c4067579fe5c92bd0db165dcbf Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Mon, 8 Jul 2019 22:39:34 +0800
Subject: [PATCH 1176/1835] perf hists browser: Fix potential NULL pointer
 dereference found by the smatch tool

[ Upstream commit ceb75476db1617a88cc29b09839acacb69aa076e ]

Based on the following report from Smatch, fix the potential
NULL pointer dereference check.

  tools/perf/ui/browsers/hists.c:641
  hist_browser__run() error: we previously assumed 'hbt' could be
  null (see line 625)

  tools/perf/ui/browsers/hists.c:3088
  perf_evsel__hists_browse() error: we previously assumed
  'browser->he_selection' could be null (see line 2902)

  tools/perf/ui/browsers/hists.c:3272
  perf_evsel_menu__run() error: we previously assumed 'hbt' could be
  null (see line 3260)

This patch firstly validating the pointers before access them, so can
fix potential NULL pointer dereference.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190708143937.7722-2-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/ui/browsers/hists.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index a96f62ca984ac..692d2fa31c351 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -633,7 +633,11 @@ int hist_browser__run(struct hist_browser *browser, const char *help,
 		switch (key) {
 		case K_TIMER: {
 			u64 nr_entries;
-			hbt->timer(hbt->arg);
+
+			WARN_ON_ONCE(!hbt);
+
+			if (hbt)
+				hbt->timer(hbt->arg);
 
 			if (hist_browser__has_filter(browser) ||
 			    symbol_conf.report_hierarchy)
@@ -2707,7 +2711,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 {
 	struct hists *hists = evsel__hists(evsel);
 	struct hist_browser *browser = perf_evsel_browser__new(evsel, hbt, env, annotation_opts);
-	struct branch_info *bi;
+	struct branch_info *bi = NULL;
 #define MAX_OPTIONS  16
 	char *options[MAX_OPTIONS];
 	struct popup_action actions[MAX_OPTIONS];
@@ -2973,7 +2977,9 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 			goto skip_annotation;
 
 		if (sort__mode == SORT_MODE__BRANCH) {
-			bi = browser->he_selection->branch_info;
+
+			if (browser->he_selection)
+				bi = browser->he_selection->branch_info;
 
 			if (bi == NULL)
 				goto skip_annotation;
@@ -3144,7 +3150,8 @@ static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
 
 		switch (key) {
 		case K_TIMER:
-			hbt->timer(hbt->arg);
+			if (hbt)
+				hbt->timer(hbt->arg);
 
 			if (!menu->lost_events_warned &&
 			    menu->lost_events &&
-- 
GitLab


From 367cc371a8e3c03b13fe309065371bd19cf3a33f Mon Sep 17 00:00:00 2001
From: Konstantin Taranov <konstantin.taranov@inf.ethz.ch>
Date: Thu, 27 Jun 2019 16:06:43 +0200
Subject: [PATCH 1177/1835] RDMA/rxe: Fill in wc byte_len with
 IB_WC_RECV_RDMA_WITH_IMM

[ Upstream commit bdce1290493caa3f8119f24b5dacc3fb7ca27389 ]

Calculate the correct byte_len on the receiving side when a work
completion is generated with IB_WC_RECV_RDMA_WITH_IMM opcode.

According to the IBA byte_len must indicate the number of written bytes,
whereas it was always equal to zero for the IB_WC_RECV_RDMA_WITH_IMM
opcode, even though data was transferred.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Konstantin Taranov <konstantin.taranov@inf.ethz.ch>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_resp.c  | 5 ++++-
 drivers/infiniband/sw/rxe/rxe_verbs.h | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index 4111b798fd3c9..681d8e0913d06 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -435,6 +435,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
 			qp->resp.va = reth_va(pkt);
 			qp->resp.rkey = reth_rkey(pkt);
 			qp->resp.resid = reth_len(pkt);
+			qp->resp.length = reth_len(pkt);
 		}
 		access = (pkt->mask & RXE_READ_MASK) ? IB_ACCESS_REMOTE_READ
 						     : IB_ACCESS_REMOTE_WRITE;
@@ -859,7 +860,9 @@ static enum resp_states do_complete(struct rxe_qp *qp,
 				pkt->mask & RXE_WRITE_MASK) ?
 					IB_WC_RECV_RDMA_WITH_IMM : IB_WC_RECV;
 		wc->vendor_err = 0;
-		wc->byte_len = wqe->dma.length - wqe->dma.resid;
+		wc->byte_len = (pkt->mask & RXE_IMMDT_MASK &&
+				pkt->mask & RXE_WRITE_MASK) ?
+					qp->resp.length : wqe->dma.length - wqe->dma.resid;
 
 		/* fields after byte_len are different between kernel and user
 		 * space
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
index 332a16dad2a7e..3b731c7682e5b 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
@@ -212,6 +212,7 @@ struct rxe_resp_info {
 	struct rxe_mem		*mr;
 	u32			resid;
 	u32			rkey;
+	u32			length;
 	u64			atomic_orig;
 
 	/* SRQ only */
-- 
GitLab


From 549f726fb094b1f9477b2d841c82d979ea5a9bbd Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 14 Jun 2019 23:40:44 +0800
Subject: [PATCH 1178/1835] PCI: dwc: pci-dra7xx: Fix compilation when
 !CONFIG_GPIOLIB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 381ed79c8655a40268ee7391f716edd90c5c3a97 ]

If CONFIG_GPIOLIB is not selected the compilation results in the
following build errors:

drivers/pci/controller/dwc/pci-dra7xx.c:
 In function dra7xx_pcie_probe:
drivers/pci/controller/dwc/pci-dra7xx.c:777:10:
 error: implicit declaration of function devm_gpiod_get_optional;
 did you mean devm_regulator_get_optional? [-Werror=implicit-function-declaration]

  reset = devm_gpiod_get_optional(dev, NULL, GPIOD_OUT_HIGH);

drivers/pci/controller/dwc/pci-dra7xx.c:778:45: error: ‘GPIOD_OUT_HIGH’
undeclared (first use in this function); did you mean ‘GPIOF_INIT_HIGH’?
  reset = devm_gpiod_get_optional(dev, NULL, GPIOD_OUT_HIGH);
                                             ^~~~~~~~~~~~~~
                                             GPIOF_INIT_HIGH

Fix them by including the appropriate header file.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
[lorenzo.pieralisi@arm.com: commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pci-dra7xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/controller/dwc/pci-dra7xx.c b/drivers/pci/controller/dwc/pci-dra7xx.c
index a32d6dde7a579..412524aa1fdec 100644
--- a/drivers/pci/controller/dwc/pci-dra7xx.c
+++ b/drivers/pci/controller/dwc/pci-dra7xx.c
@@ -26,6 +26,7 @@
 #include <linux/types.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
+#include <linux/gpio/consumer.h>
 
 #include "../../pci.h"
 #include "pcie-designware.h"
-- 
GitLab


From 4b9dc73a0d4adc67bdd33b8c60dcbfe1e04c61b0 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Fri, 5 Jul 2019 19:01:43 +0900
Subject: [PATCH 1179/1835] powerpc/boot: add {get, put}_unaligned_be32 to
 xz_config.h

[ Upstream commit 9e005b761e7ad153dcf40a6cba1d681fe0830ac6 ]

The next commit will make the way of passing CONFIG options more robust.
Unfortunately, it would uncover another hidden issue; without this
commit, skiroot_defconfig would be broken like this:

|   WRAP    arch/powerpc/boot/zImage.pseries
| arch/powerpc/boot/wrapper.a(decompress.o): In function `bcj_powerpc.isra.10':
| decompress.c:(.text+0x720): undefined reference to `get_unaligned_be32'
| decompress.c:(.text+0x7a8): undefined reference to `put_unaligned_be32'
| make[1]: *** [arch/powerpc/boot/Makefile;383: arch/powerpc/boot/zImage.pseries] Error 1
| make: *** [arch/powerpc/Makefile;295: zImage] Error 2

skiroot_defconfig is the only defconfig that enables CONFIG_KERNEL_XZ
for ppc, which has never been correctly built before.

I figured out the root cause in lib/decompress_unxz.c:

| #ifdef CONFIG_PPC
| #      define XZ_DEC_POWERPC
| #endif

CONFIG_PPC is undefined here in the ppc bootwrapper because autoconf.h
is not included except by arch/powerpc/boot/serial.c

XZ_DEC_POWERPC is not defined, therefore, bcj_powerpc() is not compiled
for the bootwrapper.

With the next commit passing CONFIG_PPC correctly, we would realize that
{get,put}_unaligned_be32 was missing.

Unlike the other decompressors, the ppc bootwrapper duplicates all the
necessary helpers in arch/powerpc/boot/.

The other architectures define __KERNEL__ and pull in helpers for
building the decompressors.

If ppc bootwrapper had defined __KERNEL__, lib/xz/xz_private.h would
have included <asm/unaligned.h>:

| #ifdef __KERNEL__
| #       include <linux/xz.h>
| #       include <linux/kernel.h>
| #       include <asm/unaligned.h>

However, doing so would cause tons of definition conflicts since the
bootwrapper has duplicated everything.

I just added copies of {get,put}_unaligned_be32, following the
bootwrapper coding convention.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190705100144.28785-1-yamada.masahiro@socionext.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/boot/xz_config.h | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/arch/powerpc/boot/xz_config.h b/arch/powerpc/boot/xz_config.h
index e22e5b3770ddc..ebfadd39e1924 100644
--- a/arch/powerpc/boot/xz_config.h
+++ b/arch/powerpc/boot/xz_config.h
@@ -20,10 +20,30 @@ static inline uint32_t swab32p(void *p)
 
 #ifdef __LITTLE_ENDIAN__
 #define get_le32(p) (*((uint32_t *) (p)))
+#define cpu_to_be32(x) swab32(x)
+static inline u32 be32_to_cpup(const u32 *p)
+{
+	return swab32p((u32 *)p);
+}
 #else
 #define get_le32(p) swab32p(p)
+#define cpu_to_be32(x) (x)
+static inline u32 be32_to_cpup(const u32 *p)
+{
+	return *p;
+}
 #endif
 
+static inline uint32_t get_unaligned_be32(const void *p)
+{
+	return be32_to_cpup(p);
+}
+
+static inline void put_unaligned_be32(u32 val, void *p)
+{
+	*((u32 *)p) = cpu_to_be32(val);
+}
+
 #define memeq(a, b, size) (memcmp(a, b, size) == 0)
 #define memzero(buf, size) memset(buf, 0, size)
 
-- 
GitLab


From 8a1a3d3839233406eed675b1695019802dc4284a Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Thu, 7 Mar 2019 21:37:18 +0000
Subject: [PATCH 1180/1835] block: init flush rq ref count to 1

[ Upstream commit b554db147feea39617b533ab6bca247c91c6198a ]

We discovered a problem in newer kernels where a disconnect of a NBD
device while the flush request was pending would result in a hang.  This
is because the blk mq timeout handler does

        if (!refcount_inc_not_zero(&rq->ref))
                return true;

to determine if it's ok to run the timeout handler for the request.
Flush_rq's don't have a ref count set, so we'd skip running the timeout
handler for this request and it would just sit there in limbo forever.

Fix this by always setting the refcount of any request going through
blk_init_rq() to 1.  I tested this with a nbd-server that dropped flush
requests to verify that it hung, and then tested with this patch to
verify I got the timeout as expected and the error handling kicked in.
Thanks,

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-core.c b/block/blk-core.c
index 682bc561b77b8..9ca703bcfe3b1 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -198,6 +198,7 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
 	rq->internal_tag = -1;
 	rq->start_time_ns = ktime_get_ns();
 	rq->part = NULL;
+	refcount_set(&rq->ref, 1);
 }
 EXPORT_SYMBOL(blk_rq_init);
 
-- 
GitLab


From 2140a6b03a6141d353e93632c9a20c0471062ac5 Mon Sep 17 00:00:00 2001
From: Ocean Chen <oceanchen@google.com>
Date: Mon, 8 Jul 2019 12:34:56 +0800
Subject: [PATCH 1181/1835] f2fs: avoid out-of-range memory access

[ Upstream commit 56f3ce675103e3fb9e631cfb4131fc768bc23e9a ]

blkoff_off might over 512 due to fs corrupt or security
vulnerability. That should be checked before being using.

Use ENTRIES_IN_SUM to protect invalid value in cur_data_blkoff.

Signed-off-by: Ocean Chen <oceanchen@google.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/segment.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 8fc3edb6760c2..92f72bb5aff43 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -3261,6 +3261,11 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
 		seg_i = CURSEG_I(sbi, i);
 		segno = le32_to_cpu(ckpt->cur_data_segno[i]);
 		blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]);
+		if (blk_off > ENTRIES_IN_SUM) {
+			f2fs_bug_on(sbi, 1);
+			f2fs_put_page(page, 1);
+			return -EFAULT;
+		}
 		seg_i->next_segno = segno;
 		reset_curseg(sbi, i, 0);
 		seg_i->alloc_type = ckpt->alloc_type[i];
-- 
GitLab


From 5d59e28c3d1b94d318e3e74d4e9adb327bb116c0 Mon Sep 17 00:00:00 2001
From: morten petersen <morten_bp@live.dk>
Date: Mon, 8 Jul 2019 11:41:54 +0000
Subject: [PATCH 1182/1835] mailbox: handle failed named mailbox channel
 request

[ Upstream commit 25777e5784a7b417967460d4fcf9660d05a0c320 ]

Previously, if mbox_request_channel_byname was used with a name
which did not exist in the "mbox-names" property of a mailbox
client, the mailbox corresponding to the last entry in the
"mbox-names" list would be incorrectly selected.
With this patch, -EINVAL is returned if the named mailbox is
not found.

Signed-off-by: Morten Borup Petersen <morten_bp@live.dk>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/mailbox.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index 674b35f402f5e..055c90b8253cb 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -391,11 +391,13 @@ struct mbox_chan *mbox_request_channel_byname(struct mbox_client *cl,
 
 	of_property_for_each_string(np, "mbox-names", prop, mbox_name) {
 		if (!strncmp(name, mbox_name, strlen(name)))
-			break;
+			return mbox_request_channel(cl, index);
 		index++;
 	}
 
-	return mbox_request_channel(cl, index);
+	dev_err(cl->dev, "%s() could not locate channel named \"%s\"\n",
+		__func__, name);
+	return ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(mbox_request_channel_byname);
 
-- 
GitLab


From e7a41b276974d35bac948f08327d8f4297d739ba Mon Sep 17 00:00:00 2001
From: David Windsor <dwindsor@redhat.com>
Date: Tue, 2 Apr 2019 08:37:10 -0400
Subject: [PATCH 1183/1835] dlm: check if workqueues are NULL before
 flushing/destroying

[ Upstream commit b355516f450703c9015316e429b66a93dfff0e6f ]

If the DLM lowcomms stack is shut down before any DLM
traffic can be generated, flush_workqueue() and
destroy_workqueue() can be called on empty send and/or recv
workqueues.

Insert guard conditionals to only call flush_workqueue()
and destroy_workqueue() on workqueues that are not NULL.

Signed-off-by: David Windsor <dwindsor@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/lowcomms.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index a5e4a221435c0..a93ebffe84b38 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -1630,8 +1630,10 @@ static void clean_writequeues(void)
 
 static void work_stop(void)
 {
-	destroy_workqueue(recv_workqueue);
-	destroy_workqueue(send_workqueue);
+	if (recv_workqueue)
+		destroy_workqueue(recv_workqueue);
+	if (send_workqueue)
+		destroy_workqueue(send_workqueue);
 }
 
 static int work_start(void)
@@ -1691,13 +1693,17 @@ static void work_flush(void)
 	struct hlist_node *n;
 	struct connection *con;
 
-	flush_workqueue(recv_workqueue);
-	flush_workqueue(send_workqueue);
+	if (recv_workqueue)
+		flush_workqueue(recv_workqueue);
+	if (send_workqueue)
+		flush_workqueue(send_workqueue);
 	do {
 		ok = 1;
 		foreach_conn(stop_conn);
-		flush_workqueue(recv_workqueue);
-		flush_workqueue(send_workqueue);
+		if (recv_workqueue)
+			flush_workqueue(recv_workqueue);
+		if (send_workqueue)
+			flush_workqueue(send_workqueue);
 		for (i = 0; i < CONN_HASH_SIZE && ok; i++) {
 			hlist_for_each_entry_safe(con, n,
 						  &connection_hash[i], list) {
-- 
GitLab


From 7f775a67abe412634cdfb635fd3c84db2d315d93 Mon Sep 17 00:00:00 2001
From: Oliver O'Halloran <oohall@gmail.com>
Date: Thu, 11 Jul 2019 01:05:17 +1000
Subject: [PATCH 1184/1835] powerpc/eeh: Handle hugepages in ioremap space

[ Upstream commit 33439620680be5225c1b8806579a291e0d761ca0 ]

In commit 4a7b06c157a2 ("powerpc/eeh: Handle hugepages in ioremap
space") support for using hugepages in the vmalloc and ioremap areas was
enabled for radix. Unfortunately this broke EEH MMIO error checking.

Detection works by inserting a hook which checks the results of the
ioreadXX() set of functions.  When a read returns a 0xFFs response we
need to check for an error which we do by mapping the (virtual) MMIO
address back to a physical address, then mapping physical address to a
PCI device via an interval tree.

When translating virt -> phys we currently assume the ioremap space is
only populated by PAGE_SIZE mappings. If a hugepage mapping is found we
emit a WARN_ON(), but otherwise handles the check as though a normal
page was found. In pathalogical cases such as copying a buffer
containing a lot of 0xFFs from BAR memory this can result in the system
not booting because it's too busy printing WARN_ON()s.

There's no real reason to assume huge pages can't be present and we're
prefectly capable of handling them, so do that.

Fixes: 4a7b06c157a2 ("powerpc/eeh: Handle hugepages in ioremap space")
Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190710150517.27114-1-oohall@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/eeh.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index c72767a5327ad..fe3c6f3bd3b62 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -360,10 +360,19 @@ static inline unsigned long eeh_token_to_phys(unsigned long token)
 	ptep = find_init_mm_pte(token, &hugepage_shift);
 	if (!ptep)
 		return token;
-	WARN_ON(hugepage_shift);
-	pa = pte_pfn(*ptep) << PAGE_SHIFT;
 
-	return pa | (token & (PAGE_SIZE-1));
+	pa = pte_pfn(*ptep);
+
+	/* On radix we can do hugepage mappings for io, so handle that */
+	if (hugepage_shift) {
+		pa <<= hugepage_shift;
+		pa |= token & ((1ul << hugepage_shift) - 1);
+	} else {
+		pa <<= PAGE_SHIFT;
+		pa |= token & (PAGE_SIZE - 1);
+	}
+
+	return pa;
 }
 
 /*
-- 
GitLab


From af50d6a1c24514d466951351bdf9aafe928ad716 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Thu, 11 Jul 2019 14:22:02 -0500
Subject: [PATCH 1185/1835] block/bio-integrity: fix a memory leak bug

[ Upstream commit e7bf90e5afe3aa1d1282c1635a49e17a32c4ecec ]

In bio_integrity_prep(), a kernel buffer is allocated through kmalloc() to
hold integrity metadata. Later on, the buffer will be attached to the bio
structure through bio_integrity_add_page(), which returns the number of
bytes of integrity metadata attached. Due to unexpected situations,
bio_integrity_add_page() may return 0. As a result, bio_integrity_prep()
needs to be terminated with 'false' returned to indicate this error.
However, the allocated kernel buffer is not freed on this execution path,
leading to a memory leak.

To fix this issue, free the allocated buffer before returning from
bio_integrity_prep().

Reviewed-by: Ming Lei <ming.lei@redhat.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bio-integrity.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 67b5fb861a510..5bd90cd4b51e3 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -291,8 +291,12 @@ bool bio_integrity_prep(struct bio *bio)
 		ret = bio_integrity_add_page(bio, virt_to_page(buf),
 					     bytes, offset);
 
-		if (ret == 0)
-			return false;
+		if (ret == 0) {
+			printk(KERN_ERR "could not attach integrity payload\n");
+			kfree(buf);
+			status = BLK_STS_RESOURCE;
+			goto err_end_io;
+		}
 
 		if (ret < bytes)
 			break;
-- 
GitLab


From 7bd5902a1e18d72bed22431540c17f601fae62b9 Mon Sep 17 00:00:00 2001
From: Sam Ravnborg <sam@ravnborg.org>
Date: Thu, 11 Jul 2019 20:52:52 -0700
Subject: [PATCH 1186/1835] sh: prevent warnings when using iounmap

[ Upstream commit 733f0025f0fb43e382b84db0930ae502099b7e62 ]

When building drm/exynos for sh, as part of an allmodconfig build, the
following warning triggered:

  exynos7_drm_decon.c: In function `decon_remove':
  exynos7_drm_decon.c:769:24: warning: unused variable `ctx'
    struct decon_context *ctx = dev_get_drvdata(&pdev->dev);

The ctx variable is only used as argument to iounmap().

In sh - allmodconfig CONFIG_MMU is not defined
so it ended up in:

\#define __iounmap(addr)	do { } while (0)
\#define iounmap		__iounmap

Fix the warning by introducing a static inline function for iounmap.

This is similar to several other architectures.

Link: http://lkml.kernel.org/r/20190622114208.24427-1-sam@ravnborg.org
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Inki Dae <inki.dae@samsung.com>
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/include/asm/io.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
index 98cb8c802b1a8..0ae60d6800004 100644
--- a/arch/sh/include/asm/io.h
+++ b/arch/sh/include/asm/io.h
@@ -371,7 +371,11 @@ static inline int iounmap_fixed(void __iomem *addr) { return -EINVAL; }
 
 #define ioremap_nocache	ioremap
 #define ioremap_uc	ioremap
-#define iounmap		__iounmap
+
+static inline void iounmap(void __iomem *addr)
+{
+	__iounmap(addr);
+}
 
 /*
  * Convert a physical pointer to a virtual kernel pointer for /dev/mem
-- 
GitLab


From 071f2135cfec4b89200876eb9dc115f6957d227b Mon Sep 17 00:00:00 2001
From: Dmitry Vyukov <dvyukov@google.com>
Date: Thu, 11 Jul 2019 20:53:39 -0700
Subject: [PATCH 1187/1835] mm/kmemleak.c: fix check for softirq context

[ Upstream commit 6ef9056952532c3b746de46aa10d45b4d7797bd8 ]

in_softirq() is a wrong predicate to check if we are in a softirq
context.  It also returns true if we have BH disabled, so objects are
falsely stamped with "softirq" comm.  The correct predicate is
in_serving_softirq().

If user does cat from /sys/kernel/debug/kmemleak previously they would
see this, which is clearly wrong, this is system call context (see the
comm):

unreferenced object 0xffff88805bd661c0 (size 64):
  comm "softirq", pid 0, jiffies 4294942959 (age 12.400s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00  ................
    00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000007dcb30c>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
    [<0000000007dcb30c>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<0000000007dcb30c>] slab_alloc mm/slab.c:3326 [inline]
    [<0000000007dcb30c>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
    [<00000000969722b7>] kmalloc include/linux/slab.h:547 [inline]
    [<00000000969722b7>] kzalloc include/linux/slab.h:742 [inline]
    [<00000000969722b7>] ip_mc_add1_src net/ipv4/igmp.c:1961 [inline]
    [<00000000969722b7>] ip_mc_add_src+0x36b/0x400 net/ipv4/igmp.c:2085
    [<00000000a4134b5f>] ip_mc_msfilter+0x22d/0x310 net/ipv4/igmp.c:2475
    [<00000000d20248ad>] do_ip_setsockopt.isra.0+0x19fe/0x1c00 net/ipv4/ip_sockglue.c:957
    [<000000003d367be7>] ip_setsockopt+0x3b/0xb0 net/ipv4/ip_sockglue.c:1246
    [<000000003c7c76af>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616
    [<000000000c1aeb23>] sock_common_setsockopt+0x3e/0x50 net/core/sock.c:3130
    [<000000000157b92b>] __sys_setsockopt+0x9e/0x120 net/socket.c:2078
    [<00000000a9f3d058>] __do_sys_setsockopt net/socket.c:2089 [inline]
    [<00000000a9f3d058>] __se_sys_setsockopt net/socket.c:2086 [inline]
    [<00000000a9f3d058>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086
    [<000000001b8da885>] do_syscall_64+0x7c/0x1a0 arch/x86/entry/common.c:301
    [<00000000ba770c62>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

now they will see this:

unreferenced object 0xffff88805413c800 (size 64):
  comm "syz-executor.4", pid 8960, jiffies 4294994003 (age 14.350s)
  hex dump (first 32 bytes):
    00 7a 8a 57 80 88 ff ff e0 00 00 01 00 00 00 00  .z.W............
    00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000c5d3be64>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
    [<00000000c5d3be64>] slab_post_alloc_hook mm/slab.h:439 [inline]
    [<00000000c5d3be64>] slab_alloc mm/slab.c:3326 [inline]
    [<00000000c5d3be64>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
    [<0000000023865be2>] kmalloc include/linux/slab.h:547 [inline]
    [<0000000023865be2>] kzalloc include/linux/slab.h:742 [inline]
    [<0000000023865be2>] ip_mc_add1_src net/ipv4/igmp.c:1961 [inline]
    [<0000000023865be2>] ip_mc_add_src+0x36b/0x400 net/ipv4/igmp.c:2085
    [<000000003029a9d4>] ip_mc_msfilter+0x22d/0x310 net/ipv4/igmp.c:2475
    [<00000000ccd0a87c>] do_ip_setsockopt.isra.0+0x19fe/0x1c00 net/ipv4/ip_sockglue.c:957
    [<00000000a85a3785>] ip_setsockopt+0x3b/0xb0 net/ipv4/ip_sockglue.c:1246
    [<00000000ec13c18d>] udp_setsockopt+0x4e/0x90 net/ipv4/udp.c:2616
    [<0000000052d748e3>] sock_common_setsockopt+0x3e/0x50 net/core/sock.c:3130
    [<00000000512f1014>] __sys_setsockopt+0x9e/0x120 net/socket.c:2078
    [<00000000181758bc>] __do_sys_setsockopt net/socket.c:2089 [inline]
    [<00000000181758bc>] __se_sys_setsockopt net/socket.c:2086 [inline]
    [<00000000181758bc>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2086
    [<00000000d4b73623>] do_syscall_64+0x7c/0x1a0 arch/x86/entry/common.c:301
    [<00000000c1098bec>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Link: http://lkml.kernel.org/r/20190517171507.96046-1-dvyukov@gmail.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/kmemleak.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 72e3fb3bb0377..6c94b6865ac22 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -576,7 +576,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
 	if (in_irq()) {
 		object->pid = 0;
 		strncpy(object->comm, "hardirq", sizeof(object->comm));
-	} else if (in_softirq()) {
+	} else if (in_serving_softirq()) {
 		object->pid = 0;
 		strncpy(object->comm, "softirq", sizeof(object->comm));
 	} else {
-- 
GitLab


From 8be4a30e2d34435392206b1ab7665a9d7c30de72 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Thu, 11 Jul 2019 20:55:26 -0700
Subject: [PATCH 1188/1835] 9p: pass the correct prototype to read_cache_page

[ Upstream commit f053cbd4366051d7eb6ba1b8d529d20f719c2963 ]

Fix the callback 9p passes to read_cache_page to actually have the
proper type expected.  Casting around function pointers can easily
hide typing bugs, and defeats control flow protection.

Link: http://lkml.kernel.org/r/20190520055731.24538-5-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Sami Tolvanen <samitolvanen@google.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/9p/vfs_addr.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index e1cbdfdb7c684..1970693035109 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -50,8 +50,9 @@
  * @page: structure to page
  *
  */
-static int v9fs_fid_readpage(struct p9_fid *fid, struct page *page)
+static int v9fs_fid_readpage(void *data, struct page *page)
 {
+	struct p9_fid *fid = data;
 	struct inode *inode = page->mapping->host;
 	struct bio_vec bvec = {.bv_page = page, .bv_len = PAGE_SIZE};
 	struct iov_iter to;
@@ -122,7 +123,8 @@ static int v9fs_vfs_readpages(struct file *filp, struct address_space *mapping,
 	if (ret == 0)
 		return ret;
 
-	ret = read_cache_pages(mapping, pages, (void *)v9fs_vfs_readpage, filp);
+	ret = read_cache_pages(mapping, pages, v9fs_fid_readpage,
+			filp->private_data);
 	p9_debug(P9_DEBUG_VFS, "  = %d\n", ret);
 	return ret;
 }
-- 
GitLab


From fa099d6ddf685e0537547414d226632045156323 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Thu, 11 Jul 2019 20:57:46 -0700
Subject: [PATCH 1189/1835] mm/gup.c: mark undo_dev_pagemap as __maybe_unused

[ Upstream commit 790c73690c2bbecb3f6f8becbdb11ddc9bcff8cc ]

Several mips builds generate the following build warning.

  mm/gup.c:1788:13: warning: 'undo_dev_pagemap' defined but not used

The function is declared unconditionally but only called from behind
various ifdefs. Mark it __maybe_unused.

Link: http://lkml.kernel.org/r/1562072523-22311-1-git-send-email-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/gup.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/gup.c b/mm/gup.c
index caadd31714a54..43c71397c7ca9 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1367,7 +1367,8 @@ static inline pte_t gup_get_pte(pte_t *ptep)
 }
 #endif
 
-static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages)
+static void __maybe_unused undo_dev_pagemap(int *nr, int nr_start,
+					    struct page **pages)
 {
 	while ((*nr) - nr_start) {
 		struct page *page = pages[--(*nr)];
-- 
GitLab


From 041b127df733ec1457dc60de41c091c5e73e3741 Mon Sep 17 00:00:00 2001
From: Andy Lutomirski <luto@kernel.org>
Date: Thu, 11 Jul 2019 20:57:43 -0700
Subject: [PATCH 1190/1835] mm/gup.c: remove some BUG_ONs from get_gate_page()

[ Upstream commit b5d1c39f34d1c9bca0c4b9ae2e339fbbe264a9c7 ]

If we end up without a PGD or PUD entry backing the gate area, don't BUG
-- just fail gracefully.

It's not entirely implausible that this could happen some day on x86.  It
doesn't right now even with an execute-only emulated vsyscall page because
the fixmap shares the PUD, but the core mm code shouldn't rely on that
particular detail to avoid OOPSing.

Link: http://lkml.kernel.org/r/a1d9f4efb75b9d464e59fd6af00104b21c58f6f7.1561610798.git.luto@kernel.org
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/gup.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index 43c71397c7ca9..f3088d25bd926 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -458,11 +458,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
 		pgd = pgd_offset_k(address);
 	else
 		pgd = pgd_offset_gate(mm, address);
-	BUG_ON(pgd_none(*pgd));
+	if (pgd_none(*pgd))
+		return -EFAULT;
 	p4d = p4d_offset(pgd, address);
-	BUG_ON(p4d_none(*p4d));
+	if (p4d_none(*p4d))
+		return -EFAULT;
 	pud = pud_offset(p4d, address);
-	BUG_ON(pud_none(*pud));
+	if (pud_none(*pud))
+		return -EFAULT;
 	pmd = pmd_offset(pud, address);
 	if (!pmd_present(*pmd))
 		return -EFAULT;
-- 
GitLab


From 3062448e3ee29aa18015854b7f599ae0fa33fff2 Mon Sep 17 00:00:00 2001
From: Shakeel Butt <shakeelb@google.com>
Date: Thu, 11 Jul 2019 20:55:52 -0700
Subject: [PATCH 1191/1835] memcg, fsnotify: no oom-kill for remote memcg
 charging

[ Upstream commit ec165450968b26298bd1c373de37b0ab6d826b33 ]

Commit d46eb14b735b ("fs: fsnotify: account fsnotify metadata to
kmemcg") added remote memcg charging for fanotify and inotify event
objects.  The aim was to charge the memory to the listener who is
interested in the events but without triggering the OOM killer.
Otherwise there would be security concerns for the listener.

At the time, oom-kill trigger was not in the charging path.  A parallel
work added the oom-kill back to charging path i.e.  commit 29ef680ae7c2
("memcg, oom: move out_of_memory back to the charge path").  So to not
trigger oom-killer in the remote memcg, explicitly add
__GFP_RETRY_MAYFAIL to the fanotigy and inotify event allocations.

Link: http://lkml.kernel.org/r/20190514212259.156585-2-shakeelb@google.com
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Roman Gushchin <guro@fb.com>
Acked-by: Jan Kara <jack@suse.cz>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/notify/fanotify/fanotify.c        | 5 ++++-
 fs/notify/inotify/inotify_fsnotify.c | 8 ++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 29dee9630eecc..a18b8d7a30759 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -148,10 +148,13 @@ struct fanotify_event_info *fanotify_alloc_event(struct fsnotify_group *group,
 	/*
 	 * For queues with unlimited length lost events are not expected and
 	 * can possibly have security implications. Avoid losing events when
-	 * memory is short.
+	 * memory is short. For the limited size queues, avoid OOM killer in the
+	 * target monitoring memcg as it may have security repercussion.
 	 */
 	if (group->max_events == UINT_MAX)
 		gfp |= __GFP_NOFAIL;
+	else
+		gfp |= __GFP_RETRY_MAYFAIL;
 
 	/* Whoever is interested in the event, pays for the allocation. */
 	memalloc_use_memcg(group->memcg);
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index f4184b4f38154..16b8702af0e7f 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -99,9 +99,13 @@ int inotify_handle_event(struct fsnotify_group *group,
 	i_mark = container_of(inode_mark, struct inotify_inode_mark,
 			      fsn_mark);
 
-	/* Whoever is interested in the event, pays for the allocation. */
+	/*
+	 * Whoever is interested in the event, pays for the allocation. Do not
+	 * trigger OOM killer in the target monitoring memcg as it may have
+	 * security repercussion.
+	 */
 	memalloc_use_memcg(group->memcg);
-	event = kmalloc(alloc_len, GFP_KERNEL_ACCOUNT);
+	event = kmalloc(alloc_len, GFP_KERNEL_ACCOUNT | __GFP_RETRY_MAYFAIL);
 	memalloc_unuse_memcg();
 
 	if (unlikely(!event)) {
-- 
GitLab


From a8c568fc48320cea9bf3cb346b3007371ca5e49c Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
Date: Thu, 11 Jul 2019 20:58:50 -0700
Subject: [PATCH 1192/1835] mm/mmu_notifier: use hlist_add_head_rcu()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 543bdb2d825fe2400d6e951f1786d92139a16931 ]

Make mmu_notifier_register() safer by issuing a memory barrier before
registering a new notifier.  This fixes a theoretical bug on weakly
ordered CPUs.  For example, take this simplified use of notifiers by a
driver:

	my_struct->mn.ops = &my_ops; /* (1) */
	mmu_notifier_register(&my_struct->mn, mm)
		...
		hlist_add_head(&mn->hlist, &mm->mmu_notifiers); /* (2) */
		...

Once mmu_notifier_register() releases the mm locks, another thread can
invalidate a range:

	mmu_notifier_invalidate_range()
		...
		hlist_for_each_entry_rcu(mn, &mm->mmu_notifiers, hlist) {
			if (mn->ops->invalidate_range)

The read side relies on the data dependency between mn and ops to ensure
that the pointer is properly initialized.  But the write side doesn't have
any dependency between (1) and (2), so they could be reordered and the
readers could dereference an invalid mn->ops.  mmu_notifier_register()
does take all the mm locks before adding to the hlist, but those have
acquire semantics which isn't sufficient.

By calling hlist_add_head_rcu() instead of hlist_add_head() we update the
hlist using a store-release, ensuring that readers see prior
initialization of my_struct.  This situation is better illustated by
litmus test MP+onceassign+derefonce.

Link: http://lkml.kernel.org/r/20190502133532.24981-1-jean-philippe.brucker@arm.com
Fixes: cddb8a5c14aa ("mmu-notifiers: core")
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mmu_notifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index 82bb1a939c0e4..06dedb1755727 100644
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -316,7 +316,7 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
 	 * thanks to mm_take_all_locks().
 	 */
 	spin_lock(&mm->mmu_notifier_mm->lock);
-	hlist_add_head(&mn->hlist, &mm->mmu_notifier_mm->list);
+	hlist_add_head_rcu(&mn->hlist, &mm->mmu_notifier_mm->list);
 	spin_unlock(&mm->mmu_notifier_mm->lock);
 
 	mm_drop_all_locks(mm);
-- 
GitLab


From 1b3042d0d32b850910ae4f0d73cb8bbc6b0e658f Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Thu, 11 Jul 2019 20:59:53 -0700
Subject: [PATCH 1193/1835] proc: use down_read_killable mmap_sem for
 /proc/pid/smaps_rollup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a26a97815548574213fd37f29b4b78ccc6d9ed20 ]

Do not remain stuck forever if something goes wrong.  Using a killable
lock permits cleanup of stuck tasks and simplifies investigation.

Link: http://lkml.kernel.org/r/156007493429.3335.14666825072272692455.stgit@buzz
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reviewed-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/task_mmu.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index c5819baee35c0..b2010055180e9 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -826,7 +826,10 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
 
 	memset(&mss, 0, sizeof(mss));
 
-	down_read(&mm->mmap_sem);
+	ret = down_read_killable(&mm->mmap_sem);
+	if (ret)
+		goto out_put_mm;
+
 	hold_task_mempolicy(priv);
 
 	for (vma = priv->mm->mmap; vma; vma = vma->vm_next) {
@@ -843,8 +846,9 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
 
 	release_task_mempolicy(priv);
 	up_read(&mm->mmap_sem);
-	mmput(mm);
 
+out_put_mm:
+	mmput(mm);
 out_put_task:
 	put_task_struct(priv->task);
 	priv->task = NULL;
-- 
GitLab


From 42beb7b3d446f035d93c818dbc81c467d25a45c8 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Thu, 11 Jul 2019 20:59:56 -0700
Subject: [PATCH 1194/1835] proc: use down_read_killable mmap_sem for
 /proc/pid/pagemap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ad80b932c57d85fd6377f97f359b025baf179a87 ]

Do not remain stuck forever if something goes wrong.  Using a killable
lock permits cleanup of stuck tasks and simplifies investigation.

Link: http://lkml.kernel.org/r/156007493638.3335.4872164955523928492.stgit@buzz
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reviewed-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/task_mmu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index b2010055180e9..74965e17ffd58 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1535,7 +1535,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 		/* overflow ? */
 		if (end < start_vaddr || end > end_vaddr)
 			end = end_vaddr;
-		down_read(&mm->mmap_sem);
+		ret = down_read_killable(&mm->mmap_sem);
+		if (ret)
+			goto out_free;
 		ret = walk_page_range(start_vaddr, end, &pagemap_walk);
 		up_read(&mm->mmap_sem);
 		start_vaddr = end;
-- 
GitLab


From 3d617da8a9567da93dde8c5a5a998b6346e1d2a0 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Thu, 11 Jul 2019 21:00:00 -0700
Subject: [PATCH 1195/1835] proc: use down_read_killable mmap_sem for
 /proc/pid/clear_refs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c46038017fbdcac627b670c9d4176f1d0c2f5fa3 ]

Do not remain stuck forever if something goes wrong.  Using a killable
lock permits cleanup of stuck tasks and simplifies investigation.

Replace the only unkillable mmap_sem lock in clear_refs_write().

Link: http://lkml.kernel.org/r/156007493826.3335.5424884725467456239.stgit@buzz
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reviewed-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/task_mmu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 74965e17ffd58..195fbbaf77d42 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1131,7 +1131,10 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
 			goto out_mm;
 		}
 
-		down_read(&mm->mmap_sem);
+		if (down_read_killable(&mm->mmap_sem)) {
+			count = -EINTR;
+			goto out_mm;
+		}
 		tlb_gather_mmu(&tlb, mm, 0, -1);
 		if (type == CLEAR_REFS_SOFT_DIRTY) {
 			for (vma = mm->mmap; vma; vma = vma->vm_next) {
-- 
GitLab


From 6ecdcbcd309167884a5672e76d35bfb02595e046 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Thu, 11 Jul 2019 21:00:03 -0700
Subject: [PATCH 1196/1835] proc: use down_read_killable mmap_sem for
 /proc/pid/map_files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cd9e2bb8271c971d9f37c722be2616c7f8ba0664 ]

Do not remain stuck forever if something goes wrong.  Using a killable
lock permits cleanup of stuck tasks and simplifies investigation.

It seems ->d_revalidate() could return any error (except ECHILD) to abort
validation and pass error as result of lookup sequence.

[akpm@linux-foundation.org: fix proc_map_files_lookup() return value, per Andrei]
Link: http://lkml.kernel.org/r/156007493995.3335.9595044802115356911.stgit@buzz
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reviewed-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/base.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index f999e8bd3771c..a7fbda72afeba 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1960,9 +1960,12 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags)
 		goto out;
 
 	if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) {
-		down_read(&mm->mmap_sem);
-		exact_vma_exists = !!find_exact_vma(mm, vm_start, vm_end);
-		up_read(&mm->mmap_sem);
+		status = down_read_killable(&mm->mmap_sem);
+		if (!status) {
+			exact_vma_exists = !!find_exact_vma(mm, vm_start,
+							    vm_end);
+			up_read(&mm->mmap_sem);
+		}
 	}
 
 	mmput(mm);
@@ -2008,8 +2011,11 @@ static int map_files_get_link(struct dentry *dentry, struct path *path)
 	if (rc)
 		goto out_mmput;
 
+	rc = down_read_killable(&mm->mmap_sem);
+	if (rc)
+		goto out_mmput;
+
 	rc = -ENOENT;
-	down_read(&mm->mmap_sem);
 	vma = find_exact_vma(mm, vm_start, vm_end);
 	if (vma && vma->vm_file) {
 		*path = vma->vm_file->f_path;
@@ -2105,7 +2111,11 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
 	if (!mm)
 		goto out_put_task;
 
-	down_read(&mm->mmap_sem);
+	result = ERR_PTR(-EINTR);
+	if (down_read_killable(&mm->mmap_sem))
+		goto out_put_mm;
+
+	result = ERR_PTR(-ENOENT);
 	vma = find_exact_vma(mm, vm_start, vm_end);
 	if (!vma)
 		goto out_no_vma;
@@ -2116,6 +2126,7 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
 
 out_no_vma:
 	up_read(&mm->mmap_sem);
+out_put_mm:
 	mmput(mm);
 out_put_task:
 	put_task_struct(task);
@@ -2157,7 +2168,12 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
 	mm = get_task_mm(task);
 	if (!mm)
 		goto out_put_task;
-	down_read(&mm->mmap_sem);
+
+	ret = down_read_killable(&mm->mmap_sem);
+	if (ret) {
+		mmput(mm);
+		goto out_put_task;
+	}
 
 	nr_files = 0;
 
-- 
GitLab


From 0d72bb853afc1076201ec705ce15662bddaf96af Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 12 Jul 2019 11:06:33 +0200
Subject: [PATCH 1197/1835] cxgb4: reduce kernel stack usage in
 cudbg_collect_mem_region()

[ Upstream commit 752c2ea2d8e7c23b0f64e2e7d4337f3604d44c9f ]

The cudbg_collect_mem_region() and cudbg_read_fw_mem() both use several
hundred kilobytes of kernel stack space. One gets inlined into the other,
which causes the stack usage to be combined beyond the warning limit
when building with clang:

drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c:1057:12: error: stack frame size of 1244 bytes in function 'cudbg_collect_mem_region' [-Werror,-Wframe-larger-than=]

Restructuring cudbg_collect_mem_region() lets clang do the same
optimization that gcc does and reuse the stack slots as it can
see that the large variables are never used together.

A better fix might be to avoid using cudbg_meminfo on the stack
altogether, but that requires a larger rewrite.

Fixes: a1c69520f785 ("cxgb4: collect MC memory dump")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/chelsio/cxgb4/cudbg_lib.c    | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index d97e0d7e541af..b766362031c32 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -1065,14 +1065,12 @@ static void cudbg_t4_fwcache(struct cudbg_init *pdbg_init,
 	}
 }
 
-static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
-				    struct cudbg_buffer *dbg_buff,
-				    struct cudbg_error *cudbg_err,
-				    u8 mem_type)
+static unsigned long cudbg_mem_region_size(struct cudbg_init *pdbg_init,
+					   struct cudbg_error *cudbg_err,
+					   u8 mem_type)
 {
 	struct adapter *padap = pdbg_init->adap;
 	struct cudbg_meminfo mem_info;
-	unsigned long size;
 	u8 mc_idx;
 	int rc;
 
@@ -1086,7 +1084,16 @@ static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
 	if (rc)
 		return rc;
 
-	size = mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
+	return mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
+}
+
+static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
+				    struct cudbg_buffer *dbg_buff,
+				    struct cudbg_error *cudbg_err,
+				    u8 mem_type)
+{
+	unsigned long size = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type);
+
 	return cudbg_read_fw_mem(pdbg_init, dbg_buff, mem_type, size,
 				 cudbg_err);
 }
-- 
GitLab


From af0883f9dcf6603ca8d1a59d4baf930b7f90eeae Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Thu, 11 Jul 2019 20:59:50 -0700
Subject: [PATCH 1198/1835] proc: use down_read_killable mmap_sem for
 /proc/pid/maps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8a713e7df3352b8d9392476e9cf29e4e185dac32 ]

Do not remain stuck forever if something goes wrong.  Using a killable
lock permits cleanup of stuck tasks and simplifies investigation.

This function is also used for /proc/pid/smaps.

Link: http://lkml.kernel.org/r/156007493160.3335.14447544314127417266.stgit@buzz
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reviewed-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/task_mmu.c   | 6 +++++-
 fs/proc/task_nommu.c | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 195fbbaf77d42..71aba44c4fa6d 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -166,7 +166,11 @@ static void *m_start(struct seq_file *m, loff_t *ppos)
 	if (!mm || !mmget_not_zero(mm))
 		return NULL;
 
-	down_read(&mm->mmap_sem);
+	if (down_read_killable(&mm->mmap_sem)) {
+		mmput(mm);
+		return ERR_PTR(-EINTR);
+	}
+
 	hold_task_mempolicy(priv);
 	priv->tail_vma = get_gate_vma(mm);
 
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 0b63d68dedb2a..5161894a6d623 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -211,7 +211,11 @@ static void *m_start(struct seq_file *m, loff_t *pos)
 	if (!mm || !mmget_not_zero(mm))
 		return NULL;
 
-	down_read(&mm->mmap_sem);
+	if (down_read_killable(&mm->mmap_sem)) {
+		mmput(mm);
+		return ERR_PTR(-EINTR);
+	}
+
 	/* start from the Nth VMA */
 	for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
 		if (n-- == 0)
-- 
GitLab


From 4acb04ef5e42300020feb466d784164c35181772 Mon Sep 17 00:00:00 2001
From: Yuyang Du <duyuyang@gmail.com>
Date: Tue, 9 Jul 2019 18:15:22 +0800
Subject: [PATCH 1199/1835] locking/lockdep: Fix lock used or unused stats
 error

[ Upstream commit 68d41d8c94a31dfb8233ab90b9baf41a2ed2da68 ]

The stats variable nr_unused_locks is incremented every time a new lock
class is register and decremented when the lock is first used in
__lock_acquire(). And after all, it is shown and checked in lockdep_stats.

However, under configurations that either CONFIG_TRACE_IRQFLAGS or
CONFIG_PROVE_LOCKING is not defined:

The commit:

  091806515124b20 ("locking/lockdep: Consolidate lock usage bit initialization")

missed marking the LOCK_USED flag at IRQ usage initialization because
as mark_usage() is not called. And the commit:

  886532aee3cd42d ("locking/lockdep: Move mark_lock() inside CONFIG_TRACE_IRQFLAGS && CONFIG_PROVE_LOCKING")

further made mark_lock() not defined such that the LOCK_USED cannot be
marked at all when the lock is first acquired.

As a result, we fix this by not showing and checking the stats under such
configurations for lockdep_stats.

Reported-by: Qian Cai <cai@lca.pw>
Signed-off-by: Yuyang Du <duyuyang@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Cc: arnd@arndb.de
Cc: frederic@kernel.org
Link: https://lkml.kernel.org/r/20190709101522.9117-1-duyuyang@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep_proc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index 3dd980dfba2de..6cf288eef6709 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -210,6 +210,7 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 		      nr_hardirq_read_safe = 0, nr_hardirq_read_unsafe = 0,
 		      sum_forward_deps = 0;
 
+#ifdef CONFIG_PROVE_LOCKING
 	list_for_each_entry(class, &all_lock_classes, lock_entry) {
 
 		if (class->usage_mask == 0)
@@ -241,12 +242,12 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 		if (class->usage_mask & LOCKF_ENABLED_HARDIRQ_READ)
 			nr_hardirq_read_unsafe++;
 
-#ifdef CONFIG_PROVE_LOCKING
 		sum_forward_deps += lockdep_count_forward_deps(class);
-#endif
 	}
 #ifdef CONFIG_DEBUG_LOCKDEP
 	DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused);
+#endif
+
 #endif
 	seq_printf(m, " lock-classes:                  %11lu [max: %lu]\n",
 			nr_lock_classes, MAX_LOCKDEP_KEYS);
-- 
GitLab


From b07687243d4a1eac564de3fca8cb0e5b1494c024 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Thu, 11 Jul 2019 21:00:07 -0700
Subject: [PATCH 1200/1835] mm: use down_read_killable for locking mmap_sem in
 access_remote_vm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1e426fe28261b03f297992e89da3320b42816f4e ]

This function is used by ptrace and proc files like /proc/pid/cmdline and
/proc/pid/environ.

Access_remote_vm never returns error codes, all errors are ignored and
only size of successfully read data is returned.  So, if current task was
killed we'll simply return 0 (bytes read).

Mmap_sem could be locked for a long time or forever if something goes
wrong.  Using a killable lock permits cleanup of stuck tasks and
simplifies investigation.

Link: http://lkml.kernel.org/r/156007494202.3335.16782303099589302087.stgit@buzz
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Roman Gushchin <guro@fb.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memory.c | 4 +++-
 mm/nommu.c  | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index e0010cb870e05..fb5655b518c99 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4491,7 +4491,9 @@ int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
 	void *old_buf = buf;
 	int write = gup_flags & FOLL_WRITE;
 
-	down_read(&mm->mmap_sem);
+	if (down_read_killable(&mm->mmap_sem))
+		return 0;
+
 	/* ignore errors, just check how much was successfully transferred */
 	while (len) {
 		int bytes, ret, offset;
diff --git a/mm/nommu.c b/mm/nommu.c
index e4aac33216aec..1d63ecfc98c5d 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1779,7 +1779,8 @@ int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
 	struct vm_area_struct *vma;
 	int write = gup_flags & FOLL_WRITE;
 
-	down_read(&mm->mmap_sem);
+	if (down_read_killable(&mm->mmap_sem))
+		return 0;
 
 	/* the access must start within one of the target process's mappings */
 	vma = find_vma(mm, addr);
-- 
GitLab


From 148959cc64e1ca3bf5091c6b79401fe1469e0cc6 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 15 Jul 2019 11:27:49 +0200
Subject: [PATCH 1201/1835] locking/lockdep: Hide unused 'class' variable

[ Upstream commit 68037aa78208f34bda4e5cd76c357f718b838cbb ]

The usage is now hidden in an #ifdef, so we need to move
the variable itself in there as well to avoid this warning:

  kernel/locking/lockdep_proc.c:203:21: error: unused variable 'class' [-Werror,-Wunused-variable]

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Qian Cai <cai@lca.pw>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yuyang Du <duyuyang@gmail.com>
Cc: frederic@kernel.org
Fixes: 68d41d8c94a3 ("locking/lockdep: Fix lock used or unused stats error")
Link: https://lkml.kernel.org/r/20190715092809.736834-1-arnd@arndb.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep_proc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index 6cf288eef6709..6fcc4650f0c48 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -200,7 +200,6 @@ static void lockdep_stats_debug_show(struct seq_file *m)
 
 static int lockdep_stats_show(struct seq_file *m, void *v)
 {
-	struct lock_class *class;
 	unsigned long nr_unused = 0, nr_uncategorized = 0,
 		      nr_irq_safe = 0, nr_irq_unsafe = 0,
 		      nr_softirq_safe = 0, nr_softirq_unsafe = 0,
@@ -211,6 +210,8 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
 		      sum_forward_deps = 0;
 
 #ifdef CONFIG_PROVE_LOCKING
+	struct lock_class *class;
+
 	list_for_each_entry(class, &all_lock_classes, lock_entry) {
 
 		if (class->usage_mask == 0)
-- 
GitLab


From 41d3dbb931c07fb7135e7a5a0b01b42c92b7a7df Mon Sep 17 00:00:00 2001
From: Phong Tran <tranmanphong@gmail.com>
Date: Wed, 24 Jul 2019 09:06:01 +0700
Subject: [PATCH 1202/1835] usb: wusbcore: fix unbalanced get/put cluster_id

commit f90bf1ece48a736097ea224430578fe586a9544c upstream.

syzboot reported that
https://syzkaller.appspot.com/bug?extid=fd2bd7df88c606eea4ef

There is not consitency parameter in cluste_id_get/put calling.
In case of getting the id with result is failure, the wusbhc->cluster_id
will not be updated and this can not be used for wusb_cluster_id_put().

Tested report
https://groups.google.com/d/msg/syzkaller-bugs/0znZopp3-9k/oxOrhLkLEgAJ

Reproduce and gdb got the details:

139		addr = wusb_cluster_id_get();
(gdb) n
140		if (addr == 0)
(gdb) print addr
$1 = 254 '\376'
(gdb) n
142		result = __hwahc_set_cluster_id(hwahc, addr);
(gdb) print result
$2 = -71
(gdb) break wusb_cluster_id_put
Breakpoint 3 at 0xffffffff836e3f20: file drivers/usb/wusbcore/wusbhc.c, line 384.
(gdb) s
Thread 2 hit Breakpoint 3, wusb_cluster_id_put (id=0 '\000') at drivers/usb/wusbcore/wusbhc.c:384
384		id = 0xff - id;
(gdb) n
385		BUG_ON(id >= CLUSTER_IDS);
(gdb) print id
$3 = 255 '\377'

Reported-by: syzbot+fd2bd7df88c606eea4ef@syzkaller.appspotmail.com
Signed-off-by: Phong Tran <tranmanphong@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190724020601.15257-1-tranmanphong@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/hwa-hc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 09a8ebd955888..6968b9f2b76b5 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -159,7 +159,7 @@ out:
 	return result;
 
 error_set_cluster_id:
-	wusb_cluster_id_put(wusbhc->cluster_id);
+	wusb_cluster_id_put(addr);
 error_cluster_id_get:
 	goto out;
 
-- 
GitLab


From 1f37bec82f41ef2ceec5a8f03722d1b53aa4dbeb Mon Sep 17 00:00:00 2001
From: Ryan Kennedy <ryan5544@gmail.com>
Date: Thu, 4 Jul 2019 11:35:28 -0400
Subject: [PATCH 1203/1835] usb: pci-quirks: Correct AMD PLL quirk detection

commit f3dccdaade4118070a3a47bef6b18321431f9ac6 upstream.

The AMD PLL USB quirk is incorrectly enabled on newer Ryzen
chipsets. The logic in usb_amd_find_chipset_info currently checks
for unaffected chipsets rather than affected ones. This broke
once a new chipset was added in e788787ef. It makes more sense
to reverse the logic so it won't need to be updated as new
chipsets are added. Note that the core of the workaround in
usb_amd_quirk_pll does correctly check the chipset.

Signed-off-by: Ryan Kennedy <ryan5544@gmail.com>
Fixes: e788787ef4f9 ("usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume")
Cc: stable <stable@vger.kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20190704153529.9429-2-ryan5544@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/pci-quirks.c | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 3625a5c1a41b8..070c66f86e67d 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -205,7 +205,7 @@ int usb_amd_find_chipset_info(void)
 {
 	unsigned long flags;
 	struct amd_chipset_info info;
-	int ret;
+	int need_pll_quirk = 0;
 
 	spin_lock_irqsave(&amd_lock, flags);
 
@@ -219,21 +219,28 @@ int usb_amd_find_chipset_info(void)
 	spin_unlock_irqrestore(&amd_lock, flags);
 
 	if (!amd_chipset_sb_type_init(&info)) {
-		ret = 0;
 		goto commit;
 	}
 
-	/* Below chipset generations needn't enable AMD PLL quirk */
-	if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN ||
-			info.sb_type.gen == AMD_CHIPSET_SB600 ||
-			info.sb_type.gen == AMD_CHIPSET_YANGTZE ||
-			(info.sb_type.gen == AMD_CHIPSET_SB700 &&
-			info.sb_type.rev > 0x3b)) {
+	switch (info.sb_type.gen) {
+	case AMD_CHIPSET_SB700:
+		need_pll_quirk = info.sb_type.rev <= 0x3B;
+		break;
+	case AMD_CHIPSET_SB800:
+	case AMD_CHIPSET_HUDSON2:
+	case AMD_CHIPSET_BOLTON:
+		need_pll_quirk = 1;
+		break;
+	default:
+		need_pll_quirk = 0;
+		break;
+	}
+
+	if (!need_pll_quirk) {
 		if (info.smbus_dev) {
 			pci_dev_put(info.smbus_dev);
 			info.smbus_dev = NULL;
 		}
-		ret = 0;
 		goto commit;
 	}
 
@@ -252,7 +259,7 @@ int usb_amd_find_chipset_info(void)
 		}
 	}
 
-	ret = info.probe_result = 1;
+	need_pll_quirk = info.probe_result = 1;
 	printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n");
 
 commit:
@@ -263,7 +270,7 @@ commit:
 
 		/* Mark that we where here */
 		amd_chipset.probe_count++;
-		ret = amd_chipset.probe_result;
+		need_pll_quirk = amd_chipset.probe_result;
 
 		spin_unlock_irqrestore(&amd_lock, flags);
 
@@ -277,7 +284,7 @@ commit:
 		spin_unlock_irqrestore(&amd_lock, flags);
 	}
 
-	return ret;
+	return need_pll_quirk;
 }
 EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
 
-- 
GitLab


From e3dc9ea5464e77f0056df8d187d184629f87139f Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Mon, 1 Jul 2019 05:12:46 +0000
Subject: [PATCH 1204/1835] btrfs: inode: Don't compress if NODATASUM or
 NODATACOW set

commit 42c16da6d684391db83788eb680accd84f6c2083 upstream.

As btrfs(5) specified:

	Note
	If nodatacow or nodatasum are enabled, compression is disabled.

If NODATASUM or NODATACOW set, we should not compress the extent.

Normally NODATACOW is detected properly in run_delalloc_range() so
compression won't happen for NODATACOW.

However for NODATASUM we don't have any check, and it can cause
compressed extent without csum pretty easily, just by:
  mkfs.btrfs -f $dev
  mount $dev $mnt -o nodatasum
  touch $mnt/foobar
  mount -o remount,datasum,compress $mnt
  xfs_io -f -c "pwrite 0 128K" $mnt/foobar

And in fact, we have a bug report about corrupted compressed extent
without proper data checksum so even RAID1 can't recover the corruption.
(https://bugzilla.kernel.org/show_bug.cgi?id=199707)

Running compression without proper checksum could cause more damage when
corruption happens, as compressed data could make the whole extent
unreadable, so there is no need to allow compression for
NODATACSUM.

The fix will refactor the inode compression check into two parts:

- inode_can_compress()
  As the hard requirement, checked at btrfs_run_delalloc_range(), so no
  compression will happen for NODATASUM inode at all.

- inode_need_compress()
  As the soft requirement, checked at btrfs_run_delalloc_range() and
  compress_file_range().

Reported-by: James Harvey <jamespharvey20@gmail.com>
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index c1cd3fe2b2953..355ff08e9d44e 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -388,10 +388,31 @@ static noinline int add_async_extent(struct async_cow *cow,
 	return 0;
 }
 
+/*
+ * Check if the inode has flags compatible with compression
+ */
+static inline bool inode_can_compress(struct inode *inode)
+{
+	if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW ||
+	    BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)
+		return false;
+	return true;
+}
+
+/*
+ * Check if the inode needs to be submitted to compression, based on mount
+ * options, defragmentation, properties or heuristics.
+ */
 static inline int inode_need_compress(struct inode *inode, u64 start, u64 end)
 {
 	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
 
+	if (!inode_can_compress(inode)) {
+		WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
+			KERN_ERR "BTRFS: unexpected compression for ino %llu\n",
+			btrfs_ino(BTRFS_I(inode)));
+		return 0;
+	}
 	/* force compress */
 	if (btrfs_test_opt(fs_info, FORCE_COMPRESS))
 		return 1;
@@ -1596,7 +1617,8 @@ static int run_delalloc_range(void *private_data, struct page *locked_page,
 	} else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC && !force_cow) {
 		ret = run_delalloc_nocow(inode, locked_page, start, end,
 					 page_started, 0, nr_written);
-	} else if (!inode_need_compress(inode, start, end)) {
+	} else if (!inode_can_compress(inode) ||
+		   !inode_need_compress(inode, start, end)) {
 		ret = cow_file_range(inode, locked_page, start, end, end,
 				      page_started, nr_written, 1, NULL);
 	} else {
-- 
GitLab


From 5e87e8b4dc0cfaffe3a1fa04b92a096244d227ef Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 21 Jul 2019 17:24:18 +0200
Subject: [PATCH 1205/1835] x86/sysfb_efi: Add quirks for some devices with
 swapped width and height

commit d02f1aa39189e0619c3525d5cd03254e61bf606a upstream.

Some Lenovo 2-in-1s with a detachable keyboard have a portrait screen but
advertise a landscape resolution and pitch, resulting in a messed up
display if the kernel tries to show anything on the efifb (because of the
wrong pitch).

Fix this by adding a new DMI match table for devices which need to have
their width and height swapped.

At first it was tried to use the existing table for overriding some of the
efifb parameters, but some of the affected devices have variants with
different LCD resolutions which will not work with hardcoded override
values.

Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1730783
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190721152418.11644-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/sysfb_efi.c | 46 +++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
index 623965e86b65e..897da526e40e6 100644
--- a/arch/x86/kernel/sysfb_efi.c
+++ b/arch/x86/kernel/sysfb_efi.c
@@ -231,9 +231,55 @@ static const struct dmi_system_id efifb_dmi_system_table[] __initconst = {
 	{},
 };
 
+/*
+ * Some devices have a portrait LCD but advertise a landscape resolution (and
+ * pitch). We simply swap width and height for these devices so that we can
+ * correctly deal with some of them coming with multiple resolutions.
+ */
+static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = {
+	{
+		/*
+		 * Lenovo MIIX310-10ICR, only some batches have the troublesome
+		 * 800x1280 portrait screen. Luckily the portrait version has
+		 * its own BIOS version, so we match on that.
+		 */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "MIIX 310-10ICR"),
+			DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1HCN44WW"),
+		},
+	},
+	{
+		/* Lenovo MIIX 320-10ICR with 800x1280 portrait screen */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
+					"Lenovo MIIX 320-10ICR"),
+		},
+	},
+	{
+		/* Lenovo D330 with 800x1280 or 1200x1920 portrait screen */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
+					"Lenovo ideapad D330-10IGM"),
+		},
+	},
+	{},
+};
+
 __init void sysfb_apply_efi_quirks(void)
 {
 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI ||
 	    !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS))
 		dmi_check_system(efifb_dmi_system_table);
+
+	if (screen_info.orig_video_isVGA == VIDEO_TYPE_EFI &&
+	    dmi_check_system(efifb_dmi_swap_width_height)) {
+		u16 temp = screen_info.lfb_width;
+
+		screen_info.lfb_width = screen_info.lfb_height;
+		screen_info.lfb_height = temp;
+		screen_info.lfb_linelength = 4 * screen_info.lfb_width;
+	}
 }
-- 
GitLab


From 7d20e3ba707211c9e571cf0a5fc5fc0442f74313 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Date: Thu, 25 Jul 2019 10:39:09 +0800
Subject: [PATCH 1206/1835] x86/speculation/mds: Apply more accurate check on
 hypervisor platform

commit 517c3ba00916383af6411aec99442c307c23f684 upstream.

X86_HYPER_NATIVE isn't accurate for checking if running on native platform,
e.g. CONFIG_HYPERVISOR_GUEST isn't set or "nopv" is enabled.

Checking the CPU feature bit X86_FEATURE_HYPERVISOR to determine if it's
running on native platform is more accurate.

This still doesn't cover the platforms on which X86_FEATURE_HYPERVISOR is
unsupported, e.g. VMware, but there is nothing which can be done about this
scenario.

Fixes: 8a4b06d391b0 ("x86/speculation/mds: Add sysfs reporting for MDS")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1564022349-17338-1-git-send-email-zhenzhong.duan@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/bugs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index a5cde748cf76b..c5690440fbd41 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1196,7 +1196,7 @@ static ssize_t l1tf_show_state(char *buf)
 
 static ssize_t mds_show_state(char *buf)
 {
-	if (!hypervisor_is_type(X86_HYPER_NATIVE)) {
+	if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
 		return sprintf(buf, "%s; SMT Host state unknown\n",
 			       mds_strings[mds_mitigation]);
 	}
-- 
GitLab


From e907b1314481c8586ff3793fd92c7dbd8aa841ae Mon Sep 17 00:00:00 2001
From: Hridya Valsaraju <hridya@google.com>
Date: Mon, 15 Jul 2019 12:18:04 -0700
Subject: [PATCH 1207/1835] binder: prevent transactions to context manager
 from its own process.

commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec upstream.

Currently, a transaction to context manager from its own process
is prevented by checking if its binder_proc struct is the same as
that of the sender. However, this would not catch cases where the
process opens the binder device again and uses the new fd to send
a transaction to the context manager.

Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 5d67f5fec6c1b..1e0e438f079fd 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2838,7 +2838,7 @@ static void binder_transaction(struct binder_proc *proc,
 			else
 				return_error = BR_DEAD_REPLY;
 			mutex_unlock(&context->context_mgr_node_lock);
-			if (target_node && target_proc == proc) {
+			if (target_node && target_proc->pid == proc->pid) {
 				binder_user_error("%d:%d got transaction to context manager from process owning it\n",
 						  proc->pid, thread->pid);
 				return_error = BR_FAILED_REPLY;
-- 
GitLab


From 3d0a6926e610e126f06fc43cea982aebc71d0223 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Mon, 8 Jul 2019 15:13:56 +0800
Subject: [PATCH 1208/1835] fpga-manager: altera-ps-spi: Fix build error

commit 3d139703d397f6281368047ba7ad1c8bf95aa8ab upstream.

If BITREVERSE is m and FPGA_MGR_ALTERA_PS_SPI is y,
build fails:

drivers/fpga/altera-ps-spi.o: In function `altera_ps_write':
altera-ps-spi.c:(.text+0x4ec): undefined reference to `byte_rev_table'

Select BITREVERSE to fix this.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: fcfe18f885f6 ("fpga-manager: altera-ps-spi: use bitrev8x4")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Moritz Fischer <mdf@kernel.org>
Link: https://lore.kernel.org/r/20190708071356.50928-1-yuehaibing@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/fpga/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/fpga/Kconfig b/drivers/fpga/Kconfig
index 1ebcef4bab5b8..87337fcfbc0d2 100644
--- a/drivers/fpga/Kconfig
+++ b/drivers/fpga/Kconfig
@@ -39,6 +39,7 @@ config ALTERA_PR_IP_CORE_PLAT
 config FPGA_MGR_ALTERA_PS_SPI
 	tristate "Altera FPGA Passive Serial over SPI"
 	depends on SPI
+	select BITREVERSE
 	help
 	  FPGA manager driver support for Altera Arria/Cyclone/Stratix
 	  using the passive serial interface over SPI.
-- 
GitLab


From e4c91583b39cd71906dd40570e3e6b75cbb35c1a Mon Sep 17 00:00:00 2001
From: Alexander Usyskin <alexander.usyskin@intel.com>
Date: Fri, 12 Jul 2019 12:58:14 +0300
Subject: [PATCH 1209/1835] mei: me: add mule creek canyon (EHL) device ids

commit 1be8624a0cbef720e8da39a15971e01abffc865b upstream.

Add Mule Creek Canyon (PCH) MEI device ids for Elkhart Lake (EHL) Platform.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190712095814.20746-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/hw-me-regs.h | 3 +++
 drivers/misc/mei/pci-me.c     | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index bb1ee9834a029..225373e4a9ef9 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -141,6 +141,9 @@
 
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
 
+#define MEI_DEV_ID_MCC        0x4B70  /* Mule Creek Canyon (EHL) */
+#define MEI_DEV_ID_MCC_4      0x4B75  /* Mule Creek Canyon 4 (EHL) */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 4299658d48d63..a66ebceea4081 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -107,6 +107,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
 
+	{MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH12_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
+
 	/* required last entry */
 	{0, }
 };
-- 
GitLab


From 9845fb5a3f9069111244f6aa9438f1f5d7392df6 Mon Sep 17 00:00:00 2001
From: Kefeng Wang <wangkefeng.wang@huawei.com>
Date: Thu, 11 Jul 2019 21:27:57 +0800
Subject: [PATCH 1210/1835] hpet: Fix division by zero in hpet_time_div()

commit 0c7d37f4d9b8446956e97b7c5e61173cdb7c8522 upstream.

The base value in do_div() called by hpet_time_div() is truncated from
unsigned long to uint32_t, resulting in a divide-by-zero exception.

UBSAN: Undefined behaviour in ../drivers/char/hpet.c:572:2
division by zero
CPU: 1 PID: 23682 Comm: syz-executor.3 Not tainted 4.4.184.x86_64+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
 0000000000000000 b573382df1853d00 ffff8800a3287b98 ffffffff81ad7561
 ffff8800a3287c00 ffffffff838b35b0 ffffffff838b3860 ffff8800a3287c20
 0000000000000000 ffff8800a3287bb0 ffffffff81b8f25e ffffffff838b35a0
Call Trace:
 [<ffffffff81ad7561>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81ad7561>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81b8f25e>] ubsan_epilogue+0x12/0x8d lib/ubsan.c:166
 [<ffffffff81b900cb>] __ubsan_handle_divrem_overflow+0x282/0x2c8 lib/ubsan.c:262
 [<ffffffff823560dd>] hpet_time_div drivers/char/hpet.c:572 [inline]
 [<ffffffff823560dd>] hpet_ioctl_common drivers/char/hpet.c:663 [inline]
 [<ffffffff823560dd>] hpet_ioctl_common.cold+0xa8/0xad drivers/char/hpet.c:577
 [<ffffffff81e63d56>] hpet_ioctl+0xc6/0x180 drivers/char/hpet.c:676
 [<ffffffff81711590>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81711590>] file_ioctl fs/ioctl.c:470 [inline]
 [<ffffffff81711590>] do_vfs_ioctl+0x6e0/0xf70 fs/ioctl.c:605
 [<ffffffff81711eb4>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff81711eb4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:613
 [<ffffffff82846003>] tracesys_phase2+0x90/0x95

The main C reproducer autogenerated by syzkaller,

  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  memcpy((void*)0x20000100, "/dev/hpet\000", 10);
  syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0, 0);
  syscall(__NR_ioctl, r[0], 0x40086806, 0x40000000000000);

Fix it by using div64_ul().

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Zhang HongJun <zhanghongjun2@huawei.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190711132757.130092-1-wangkefeng.wang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/hpet.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 9bffcd37cc7bd..c0732f0322484 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -570,8 +570,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
 	unsigned long long m;
 
 	m = hpets->hp_tick_freq + (dis >> 1);
-	do_div(m, dis);
-	return (unsigned long)m;
+	return div64_ul(m, dis);
 }
 
 static int
-- 
GitLab


From 602744097b2ed21b133586d8bd937b2ce79c1949 Mon Sep 17 00:00:00 2001
From: Ding Xiang <dingxiang@cmss.chinamobile.com>
Date: Tue, 23 Jul 2019 15:44:41 +0800
Subject: [PATCH 1211/1835] ALSA: ac97: Fix double free of ac97_codec_device

commit 607975b30db41aad6edc846ed567191aa6b7d893 upstream.

put_device will call ac97_codec_release to free
ac97_codec_device and other resources, so remove the kfree
and other redundant code.

Fixes: 74426fbff66e ("ALSA: ac97: add an ac97 bus")
Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/ac97/bus.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c
index 9cbf6927abe96..ca50ff4447964 100644
--- a/sound/ac97/bus.c
+++ b/sound/ac97/bus.c
@@ -125,17 +125,12 @@ static int ac97_codec_add(struct ac97_controller *ac97_ctrl, int idx,
 						      vendor_id);
 
 	ret = device_add(&codec->dev);
-	if (ret)
-		goto err_free_codec;
+	if (ret) {
+		put_device(&codec->dev);
+		return ret;
+	}
 
 	return 0;
-err_free_codec:
-	of_node_put(codec->dev.of_node);
-	put_device(&codec->dev);
-	kfree(codec);
-	ac97_ctrl->codecs[idx] = NULL;
-
-	return ret;
 }
 
 unsigned int snd_ac97_bus_scan_one(struct ac97_controller *adrv,
-- 
GitLab


From 491483ed70f17a374943c825385c356264035f31 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Thu, 18 Jul 2019 17:53:13 +0800
Subject: [PATCH 1212/1835] ALSA: line6: Fix wrong altsetting for
 LINE6_PODHD500_1

commit 70256b42caaf3e13c2932c2be7903a73fbe8bb8b upstream.

Commit 7b9584fa1c0b ("staging: line6: Move altsetting to properties")
set a wrong altsetting for LINE6_PODHD500_1 during refactoring.

Set the correct altsetting number to fix the issue.

BugLink: https://bugs.launchpad.net/bugs/1790595
Fixes: 7b9584fa1c0b ("staging: line6: Move altsetting to properties")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/line6/podhd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
index 5f3c87264e667..da627b015b32b 100644
--- a/sound/usb/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -417,7 +417,7 @@ static const struct line6_properties podhd_properties_table[] = {
 		.name = "POD HD500",
 		.capabilities	= LINE6_CAP_PCM
 				| LINE6_CAP_HWMON,
-		.altsetting = 1,
+		.altsetting = 0,
 		.ep_ctrl_r = 0x81,
 		.ep_ctrl_w = 0x01,
 		.ep_audio_r = 0x86,
-- 
GitLab


From c219444254cf72f53490ab3f07a2b164c621a8d4 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Thu, 25 Jul 2019 14:57:37 +0800
Subject: [PATCH 1213/1835] ALSA: hda - Add a conexant codec entry to let mute
 led work

commit 3f8809499bf02ef7874254c5e23fc764a47a21a0 upstream.

This conexant codec isn't in the supported codec list yet, the hda
generic driver can drive this codec well, but on a Lenovo machine
with mute/mic-mute leds, we need to apply CXT_FIXUP_THINKPAD_ACPI
to make the leds work. After adding this codec to the list, the
driver patch_conexant.c will apply THINKPAD_ACPI to this machine.

Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_conexant.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 3cbd2119e1489..b70fbfa80546e 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1096,6 +1096,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
  */
 
 static const struct hda_device_id snd_hda_id_conexant[] = {
+	HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto),
-- 
GitLab


From b9310c56fcfbdbc6cd22fd6270a5ee49359ae6ae Mon Sep 17 00:00:00 2001
From: "Gautham R. Shenoy" <ego@linux.vnet.ibm.com>
Date: Wed, 17 Jul 2019 16:05:24 +0530
Subject: [PATCH 1214/1835] powerpc/xive: Fix loop exit-condition in
 xive_find_target_in_mask()

commit 4d202c8c8ed3822327285747db1765967110b274 upstream.

xive_find_target_in_mask() has the following for(;;) loop which has a
bug when @first == cpumask_first(@mask) and condition 1 fails to hold
for every CPU in @mask. In this case we loop forever in the for-loop.

  first = cpu;
  for (;;) {
  	  if (cpu_online(cpu) && xive_try_pick_target(cpu)) // condition 1
		  return cpu;
	  cpu = cpumask_next(cpu, mask);
	  if (cpu == first) // condition 2
		  break;

	  if (cpu >= nr_cpu_ids) // condition 3
		  cpu = cpumask_first(mask);
  }

This is because, when @first == cpumask_first(@mask), we never hit the
condition 2 (cpu == first) since prior to this check, we would have
executed "cpu = cpumask_next(cpu, mask)" which will set the value of
@cpu to a value greater than @first or to nr_cpus_ids. When this is
coupled with the fact that condition 1 is not met, we will never exit
this loop.

This was discovered by the hard-lockup detector while running LTP test
concurrently with SMT switch tests.

 watchdog: CPU 12 detected hard LOCKUP on other CPUs 68
 watchdog: CPU 12 TB:85587019220796, last SMP heartbeat TB:85578827223399 (15999ms ago)
 watchdog: CPU 68 Hard LOCKUP
 watchdog: CPU 68 TB:85587019361273, last heartbeat TB:85576815065016 (19930ms ago)
 CPU: 68 PID: 45050 Comm: hxediag Kdump: loaded Not tainted 4.18.0-100.el8.ppc64le #1
 NIP:  c0000000006f5578 LR: c000000000cba9ec CTR: 0000000000000000
 REGS: c000201fff3c7d80 TRAP: 0100   Not tainted  (4.18.0-100.el8.ppc64le)
 MSR:  9000000002883033 <SF,HV,VEC,VSX,FP,ME,IR,DR,RI,LE>  CR: 24028424  XER: 00000000
 CFAR: c0000000006f558c IRQMASK: 1
 GPR00: c0000000000afc58 c000201c01c43400 c0000000015ce500 c000201cae26ec18
 GPR04: 0000000000000800 0000000000000540 0000000000000800 00000000000000f8
 GPR08: 0000000000000020 00000000000000a8 0000000080000000 c00800001a1beed8
 GPR12: c0000000000b1410 c000201fff7f4c00 0000000000000000 0000000000000000
 GPR16: 0000000000000000 0000000000000000 0000000000000540 0000000000000001
 GPR20: 0000000000000048 0000000010110000 c00800001a1e3780 c000201cae26ed18
 GPR24: 0000000000000000 c000201cae26ed8c 0000000000000001 c000000001116bc0
 GPR28: c000000001601ee8 c000000001602494 c000201cae26ec18 000000000000001f
 NIP [c0000000006f5578] find_next_bit+0x38/0x90
 LR [c000000000cba9ec] cpumask_next+0x2c/0x50
 Call Trace:
 [c000201c01c43400] [c000201cae26ec18] 0xc000201cae26ec18 (unreliable)
 [c000201c01c43420] [c0000000000afc58] xive_find_target_in_mask+0x1b8/0x240
 [c000201c01c43470] [c0000000000b0228] xive_pick_irq_target.isra.3+0x168/0x1f0
 [c000201c01c435c0] [c0000000000b1470] xive_irq_startup+0x60/0x260
 [c000201c01c43640] [c0000000001d8328] __irq_startup+0x58/0xf0
 [c000201c01c43670] [c0000000001d844c] irq_startup+0x8c/0x1a0
 [c000201c01c436b0] [c0000000001d57b0] __setup_irq+0x9f0/0xa90
 [c000201c01c43760] [c0000000001d5aa0] request_threaded_irq+0x140/0x220
 [c000201c01c437d0] [c00800001a17b3d4] bnx2x_nic_load+0x188c/0x3040 [bnx2x]
 [c000201c01c43950] [c00800001a187c44] bnx2x_self_test+0x1fc/0x1f70 [bnx2x]
 [c000201c01c43a90] [c000000000adc748] dev_ethtool+0x11d8/0x2cb0
 [c000201c01c43b60] [c000000000b0b61c] dev_ioctl+0x5ac/0xa50
 [c000201c01c43bf0] [c000000000a8d4ec] sock_do_ioctl+0xbc/0x1b0
 [c000201c01c43c60] [c000000000a8dfb8] sock_ioctl+0x258/0x4f0
 [c000201c01c43d20] [c0000000004c9704] do_vfs_ioctl+0xd4/0xa70
 [c000201c01c43de0] [c0000000004ca274] sys_ioctl+0xc4/0x160
 [c000201c01c43e30] [c00000000000b388] system_call+0x5c/0x70
 Instruction dump:
 78aad182 54a806be 3920ffff 78a50664 794a1f24 7d294036 7d43502a 7d295039
 4182001c 48000034 78a9d182 79291f24 <7d23482a> 2fa90000 409e0020 38a50040

To fix this, move the check for condition 2 after the check for
condition 3, so that we are able to break out of the loop soon after
iterating through all the CPUs in the @mask in the problem case. Use
do..while() to achieve this.

Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
Cc: stable@vger.kernel.org # v4.12+
Reported-by: Indira P. Joga <indira.priya@in.ibm.com>
Signed-off-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1563359724-13931-1-git-send-email-ego@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/sysdev/xive/common.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 959a2a62f2332..0b24b10312213 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -483,7 +483,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
 	 * Now go through the entire mask until we find a valid
 	 * target.
 	 */
-	for (;;) {
+	do {
 		/*
 		 * We re-check online as the fallback case passes us
 		 * an untested affinity mask
@@ -491,12 +491,11 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
 		if (cpu_online(cpu) && xive_try_pick_target(cpu))
 			return cpu;
 		cpu = cpumask_next(cpu, mask);
-		if (cpu == first)
-			break;
 		/* Wrap around */
 		if (cpu >= nr_cpu_ids)
 			cpu = cpumask_first(mask);
-	}
+	} while (cpu != first);
+
 	return -1;
 }
 
-- 
GitLab


From b993a66d8ddc1c26da0d9aa3471789cc170b28ee Mon Sep 17 00:00:00 2001
From: Michael Neuling <mikey@neuling.org>
Date: Fri, 19 Jul 2019 15:05:02 +1000
Subject: [PATCH 1215/1835] powerpc/tm: Fix oops on sigreturn on systems
 without TM

commit f16d80b75a096c52354c6e0a574993f3b0dfbdfe upstream.

On systems like P9 powernv where we have no TM (or P8 booted with
ppc_tm=off), userspace can construct a signal context which still has
the MSR TS bits set. The kernel tries to restore this context which
results in the following crash:

  Unexpected TM Bad Thing exception at c0000000000022fc (msr 0x8000000102a03031) tm_scratch=800000020280f033
  Oops: Unrecoverable exception, sig: 6 [#1]
  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
  Modules linked in:
  CPU: 0 PID: 1636 Comm: sigfuz Not tainted 5.2.0-11043-g0a8ad0ffa4 #69
  NIP:  c0000000000022fc LR: 00007fffb2d67e48 CTR: 0000000000000000
  REGS: c00000003fffbd70 TRAP: 0700   Not tainted  (5.2.0-11045-g7142b497d8)
  MSR:  8000000102a03031 <SF,VEC,VSX,FP,ME,IR,DR,LE,TM[E]>  CR: 42004242  XER: 00000000
  CFAR: c0000000000022e0 IRQMASK: 0
  GPR00: 0000000000000072 00007fffb2b6e560 00007fffb2d87f00 0000000000000669
  GPR04: 00007fffb2b6e728 0000000000000000 0000000000000000 00007fffb2b6f2a8
  GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
  GPR12: 0000000000000000 00007fffb2b76900 0000000000000000 0000000000000000
  GPR16: 00007fffb2370000 00007fffb2d84390 00007fffea3a15ac 000001000a250420
  GPR20: 00007fffb2b6f260 0000000010001770 0000000000000000 0000000000000000
  GPR24: 00007fffb2d843a0 00007fffea3a14a0 0000000000010000 0000000000800000
  GPR28: 00007fffea3a14d8 00000000003d0f00 0000000000000000 00007fffb2b6e728
  NIP [c0000000000022fc] rfi_flush_fallback+0x7c/0x80
  LR [00007fffb2d67e48] 0x7fffb2d67e48
  Call Trace:
  Instruction dump:
  e96a0220 e96a02a8 e96a0330 e96a03b8 394a0400 4200ffdc 7d2903a6 e92d0c00
  e94d0c08 e96d0c10 e82d0c18 7db242a6 <4c000024> 7db243a6 7db142a6 f82d0c18

The problem is the signal code assumes TM is enabled when
CONFIG_PPC_TRANSACTIONAL_MEM is enabled. This may not be the case as
with P9 powernv or if `ppc_tm=off` is used on P8.

This means any local user can crash the system.

Fix the problem by returning a bad stack frame to the user if they try
to set the MSR TS bits with sigreturn() on systems where TM is not
supported.

Found with sigfuz kernel selftest on P9.

This fixes CVE-2019-13648.

Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context")
Cc: stable@vger.kernel.org # v3.9
Reported-by: Praveen Pandey <Praveen.Pandey@in.ibm.com>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190719050502.405-1-mikey@neuling.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/signal_32.c | 3 +++
 arch/powerpc/kernel/signal_64.c | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index fd59fef9931bf..906b05c2adae3 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1202,6 +1202,9 @@ SYSCALL_DEFINE0(rt_sigreturn)
 			goto bad;
 
 		if (MSR_TM_ACTIVE(msr_hi<<32)) {
+			/* Trying to start TM on non TM system */
+			if (!cpu_has_feature(CPU_FTR_TM))
+				goto bad;
 			/* We only recheckpoint on return if we're
 			 * transaction.
 			 */
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 14b0f5b6a373d..b5933d7219db6 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -750,6 +750,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
 	if (MSR_TM_ACTIVE(msr)) {
 		/* We recheckpoint on return. */
 		struct ucontext __user *uc_transact;
+
+		/* Trying to start TM on non TM system */
+		if (!cpu_has_feature(CPU_FTR_TM))
+			goto badframe;
+
 		if (__get_user(uc_transact, &uc->uc_link))
 			goto badframe;
 		if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
-- 
GitLab


From 1a547d24ec8a488a7f2f4b85f1f1b82c015b7ac8 Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Wed, 17 Jul 2019 18:08:15 -0700
Subject: [PATCH 1216/1835] libnvdimm/bus: Stop holding nvdimm_bus_list_mutex
 over __nd_ioctl()

commit b70d31d054ee3a6fc1034b9d7fc0ae1e481aa018 upstream.

In preparation for fixing a deadlock between wait_for_bus_probe_idle()
and the nvdimm_bus_list_mutex arrange for __nd_ioctl() without
nvdimm_bus_list_mutex held. This also unifies the 'dimm' and 'bus' level
ioctls into a common nd_ioctl() preamble implementation.

Marked for -stable as it is a pre-requisite for a follow-on fix.

Cc: <stable@vger.kernel.org>
Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation")
Cc: Vishal Verma <vishal.l.verma@intel.com>
Tested-by: Jane Chu <jane.chu@oracle.com>
Link: https://lore.kernel.org/r/156341209518.292348.7183897251740665198.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvdimm/bus.c     | 96 ++++++++++++++++++++++++----------------
 drivers/nvdimm/nd-core.h |  3 +-
 2 files changed, 60 insertions(+), 39 deletions(-)

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index a3132a9eb91c2..ee39e2c1644ae 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -86,7 +86,7 @@ static void nvdimm_bus_probe_end(struct nvdimm_bus *nvdimm_bus)
 {
 	nvdimm_bus_lock(&nvdimm_bus->dev);
 	if (--nvdimm_bus->probe_active == 0)
-		wake_up(&nvdimm_bus->probe_wait);
+		wake_up(&nvdimm_bus->wait);
 	nvdimm_bus_unlock(&nvdimm_bus->dev);
 }
 
@@ -348,7 +348,7 @@ struct nvdimm_bus *nvdimm_bus_register(struct device *parent,
 		return NULL;
 	INIT_LIST_HEAD(&nvdimm_bus->list);
 	INIT_LIST_HEAD(&nvdimm_bus->mapping_list);
-	init_waitqueue_head(&nvdimm_bus->probe_wait);
+	init_waitqueue_head(&nvdimm_bus->wait);
 	nvdimm_bus->id = ida_simple_get(&nd_ida, 0, 0, GFP_KERNEL);
 	mutex_init(&nvdimm_bus->reconfig_mutex);
 	badrange_init(&nvdimm_bus->badrange);
@@ -418,6 +418,9 @@ static int nd_bus_remove(struct device *dev)
 	list_del_init(&nvdimm_bus->list);
 	mutex_unlock(&nvdimm_bus_list_mutex);
 
+	wait_event(nvdimm_bus->wait,
+			atomic_read(&nvdimm_bus->ioctl_active) == 0);
+
 	nd_synchronize();
 	device_for_each_child(&nvdimm_bus->dev, NULL, child_unregister);
 
@@ -838,7 +841,7 @@ void wait_nvdimm_bus_probe_idle(struct device *dev)
 		if (nvdimm_bus->probe_active == 0)
 			break;
 		nvdimm_bus_unlock(&nvdimm_bus->dev);
-		wait_event(nvdimm_bus->probe_wait,
+		wait_event(nvdimm_bus->wait,
 				nvdimm_bus->probe_active == 0);
 		nvdimm_bus_lock(&nvdimm_bus->dev);
 	} while (true);
@@ -1068,24 +1071,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 	return rc;
 }
 
-static long nd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-{
-	long id = (long) file->private_data;
-	int rc = -ENXIO, ro;
-	struct nvdimm_bus *nvdimm_bus;
-
-	ro = ((file->f_flags & O_ACCMODE) == O_RDONLY);
-	mutex_lock(&nvdimm_bus_list_mutex);
-	list_for_each_entry(nvdimm_bus, &nvdimm_bus_list, list) {
-		if (nvdimm_bus->id == id) {
-			rc = __nd_ioctl(nvdimm_bus, NULL, ro, cmd, arg);
-			break;
-		}
-	}
-	mutex_unlock(&nvdimm_bus_list_mutex);
-
-	return rc;
-}
+enum nd_ioctl_mode {
+	BUS_IOCTL,
+	DIMM_IOCTL,
+};
 
 static int match_dimm(struct device *dev, void *data)
 {
@@ -1100,31 +1089,62 @@ static int match_dimm(struct device *dev, void *data)
 	return 0;
 }
 
-static long nvdimm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long nd_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
+		enum nd_ioctl_mode mode)
+
 {
-	int rc = -ENXIO, ro;
-	struct nvdimm_bus *nvdimm_bus;
+	struct nvdimm_bus *nvdimm_bus, *found = NULL;
+	long id = (long) file->private_data;
+	struct nvdimm *nvdimm = NULL;
+	int rc, ro;
 
 	ro = ((file->f_flags & O_ACCMODE) == O_RDONLY);
 	mutex_lock(&nvdimm_bus_list_mutex);
 	list_for_each_entry(nvdimm_bus, &nvdimm_bus_list, list) {
-		struct device *dev = device_find_child(&nvdimm_bus->dev,
-				file->private_data, match_dimm);
-		struct nvdimm *nvdimm;
-
-		if (!dev)
-			continue;
+		if (mode == DIMM_IOCTL) {
+			struct device *dev;
+
+			dev = device_find_child(&nvdimm_bus->dev,
+					file->private_data, match_dimm);
+			if (!dev)
+				continue;
+			nvdimm = to_nvdimm(dev);
+			found = nvdimm_bus;
+		} else if (nvdimm_bus->id == id) {
+			found = nvdimm_bus;
+		}
 
-		nvdimm = to_nvdimm(dev);
-		rc = __nd_ioctl(nvdimm_bus, nvdimm, ro, cmd, arg);
-		put_device(dev);
-		break;
+		if (found) {
+			atomic_inc(&nvdimm_bus->ioctl_active);
+			break;
+		}
 	}
 	mutex_unlock(&nvdimm_bus_list_mutex);
 
+	if (!found)
+		return -ENXIO;
+
+	nvdimm_bus = found;
+	rc = __nd_ioctl(nvdimm_bus, nvdimm, ro, cmd, arg);
+
+	if (nvdimm)
+		put_device(&nvdimm->dev);
+	if (atomic_dec_and_test(&nvdimm_bus->ioctl_active))
+		wake_up(&nvdimm_bus->wait);
+
 	return rc;
 }
 
+static long bus_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	return nd_ioctl(file, cmd, arg, BUS_IOCTL);
+}
+
+static long dimm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	return nd_ioctl(file, cmd, arg, DIMM_IOCTL);
+}
+
 static int nd_open(struct inode *inode, struct file *file)
 {
 	long minor = iminor(inode);
@@ -1136,16 +1156,16 @@ static int nd_open(struct inode *inode, struct file *file)
 static const struct file_operations nvdimm_bus_fops = {
 	.owner = THIS_MODULE,
 	.open = nd_open,
-	.unlocked_ioctl = nd_ioctl,
-	.compat_ioctl = nd_ioctl,
+	.unlocked_ioctl = bus_ioctl,
+	.compat_ioctl = bus_ioctl,
 	.llseek = noop_llseek,
 };
 
 static const struct file_operations nvdimm_fops = {
 	.owner = THIS_MODULE,
 	.open = nd_open,
-	.unlocked_ioctl = nvdimm_ioctl,
-	.compat_ioctl = nvdimm_ioctl,
+	.unlocked_ioctl = dimm_ioctl,
+	.compat_ioctl = dimm_ioctl,
 	.llseek = noop_llseek,
 };
 
diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
index 5ff254dc9b14f..adf62a6c0fe27 100644
--- a/drivers/nvdimm/nd-core.h
+++ b/drivers/nvdimm/nd-core.h
@@ -25,10 +25,11 @@ extern int nvdimm_major;
 
 struct nvdimm_bus {
 	struct nvdimm_bus_descriptor *nd_desc;
-	wait_queue_head_t probe_wait;
+	wait_queue_head_t wait;
 	struct list_head list;
 	struct device dev;
 	int id, probe_active;
+	atomic_t ioctl_active;
 	struct list_head mapping_list;
 	struct mutex reconfig_mutex;
 	struct badrange badrange;
-- 
GitLab


From 408af82309a73e6b47c9227756fef9a0d4400708 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu, 11 Jul 2019 09:54:40 -0700
Subject: [PATCH 1217/1835] access: avoid the RCU grace period for the
 temporary subjective credentials

commit d7852fbd0f0423937fa287a598bfde188bb68c22 upstream.

It turns out that 'access()' (and 'faccessat()') can cause a lot of RCU
work because it installs a temporary credential that gets allocated and
freed for each system call.

The allocation and freeing overhead is mostly benign, but because
credentials can be accessed under the RCU read lock, the freeing
involves a RCU grace period.

Which is not a huge deal normally, but if you have a lot of access()
calls, this causes a fair amount of seconday damage: instead of having a
nice alloc/free patterns that hits in hot per-CPU slab caches, you have
all those delayed free's, and on big machines with hundreds of cores,
the RCU overhead can end up being enormous.

But it turns out that all of this is entirely unnecessary.  Exactly
because access() only installs the credential as the thread-local
subjective credential, the temporary cred pointer doesn't actually need
to be RCU free'd at all.  Once we're done using it, we can just free it
synchronously and avoid all the RCU overhead.

So add a 'non_rcu' flag to 'struct cred', which can be set by users that
know they only use it in non-RCU context (there are other potential
users for this).  We can make it a union with the rcu freeing list head
that we need for the RCU case, so this doesn't need any extra storage.

Note that this also makes 'get_current_cred()' clear the new non_rcu
flag, in case we have filesystems that take a long-term reference to the
cred and then expect the RCU delayed freeing afterwards.  It's not
entirely clear that this is required, but it makes for clear semantics:
the subjective cred remains non-RCU as long as you only access it
synchronously using the thread-local accessors, but you _can_ use it as
a generic cred if you want to.

It is possible that we should just remove the whole RCU markings for
->cred entirely.  Only ->real_cred is really supposed to be accessed
through RCU, and the long-term cred copies that nfs uses might want to
explicitly re-enable RCU freeing if required, rather than have
get_current_cred() do it implicitly.

But this is a "minimal semantic changes" change for the immediate
problem.

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Paul E. McKenney <paulmck@linux.ibm.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Jan Glauber <jglauber@marvell.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Jayachandran Chandrasekharan Nair <jnair@marvell.com>
Cc: Greg KH <greg@kroah.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/open.c            | 19 +++++++++++++++++++
 include/linux/cred.h |  7 ++++++-
 kernel/cred.c        | 21 +++++++++++++++++++--
 3 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/fs/open.c b/fs/open.c
index a00350018a479..878478745924b 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -373,6 +373,25 @@ long do_faccessat(int dfd, const char __user *filename, int mode)
 				override_cred->cap_permitted;
 	}
 
+	/*
+	 * The new set of credentials can *only* be used in
+	 * task-synchronous circumstances, and does not need
+	 * RCU freeing, unless somebody then takes a separate
+	 * reference to it.
+	 *
+	 * NOTE! This is _only_ true because this credential
+	 * is used purely for override_creds() that installs
+	 * it as the subjective cred. Other threads will be
+	 * accessing ->real_cred, not the subjective cred.
+	 *
+	 * If somebody _does_ make a copy of this (using the
+	 * 'get_current_cred()' function), that will clear the
+	 * non_rcu field, because now that other user may be
+	 * expecting RCU freeing. But normal thread-synchronous
+	 * cred accesses will keep things non-RCY.
+	 */
+	override_cred->non_rcu = 1;
+
 	old_cred = override_creds(override_cred);
 retry:
 	res = user_path_at(dfd, filename, lookup_flags, &path);
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 7eed6101c7914..1dc351d8548bf 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -150,7 +150,11 @@ struct cred {
 	struct user_struct *user;	/* real user ID subscription */
 	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
 	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
-	struct rcu_head	rcu;		/* RCU deletion hook */
+	/* RCU deletion */
+	union {
+		int non_rcu;			/* Can we skip RCU deletion? */
+		struct rcu_head	rcu;		/* RCU deletion hook */
+	};
 } __randomize_layout;
 
 extern void __put_cred(struct cred *);
@@ -248,6 +252,7 @@ static inline const struct cred *get_cred(const struct cred *cred)
 {
 	struct cred *nonconst_cred = (struct cred *) cred;
 	validate_creds(cred);
+	nonconst_cred->non_rcu = 0;
 	return get_new_cred(nonconst_cred);
 }
 
diff --git a/kernel/cred.c b/kernel/cred.c
index efd04b2ec84c2..5ab1f7ec946e1 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -147,7 +147,10 @@ void __put_cred(struct cred *cred)
 	BUG_ON(cred == current->cred);
 	BUG_ON(cred == current->real_cred);
 
-	call_rcu(&cred->rcu, put_cred_rcu);
+	if (cred->non_rcu)
+		put_cred_rcu(&cred->rcu);
+	else
+		call_rcu(&cred->rcu, put_cred_rcu);
 }
 EXPORT_SYMBOL(__put_cred);
 
@@ -258,6 +261,7 @@ struct cred *prepare_creds(void)
 	old = task->cred;
 	memcpy(new, old, sizeof(struct cred));
 
+	new->non_rcu = 0;
 	atomic_set(&new->usage, 1);
 	set_cred_subscribers(new, 0);
 	get_group_info(new->group_info);
@@ -537,7 +541,19 @@ const struct cred *override_creds(const struct cred *new)
 
 	validate_creds(old);
 	validate_creds(new);
-	get_cred(new);
+
+	/*
+	 * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'.
+	 *
+	 * That means that we do not clear the 'non_rcu' flag, since
+	 * we are only installing the cred into the thread-synchronous
+	 * '->cred' pointer, not the '->real_cred' pointer that is
+	 * visible to other threads under RCU.
+	 *
+	 * Also note that we did validate_creds() manually, not depending
+	 * on the validation in 'get_cred()'.
+	 */
+	get_new_cred((struct cred *)new);
 	alter_cred_subscribers(new, 1);
 	rcu_assign_pointer(current->cred, new);
 	alter_cred_subscribers(old, -1);
@@ -620,6 +636,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
 	validate_creds(old);
 
 	*new = *old;
+	new->non_rcu = 0;
 	atomic_set(&new->usage, 1);
 	set_cred_subscribers(new, 0);
 	get_uid(new->user);
-- 
GitLab


From 9a9de33a9dfaaf6628d63c56d58ea5cbfe707739 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 31 Jul 2019 07:27:12 +0200
Subject: [PATCH 1218/1835] Linux 4.19.63

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c1f38f4107d97..8ad77a93de305 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 62
+SUBLEVEL = 63
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 5d1250c4a623fba8f10e3578f10cbde75c0f41ff Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 31 Jul 2019 17:36:34 +0100
Subject: [PATCH 1219/1835] drm/vc4: A present but empty dmas disables audio

Overlays are unable to remove properties in the base DTB, but they
can overwrite them. Allow a present but empty 'dmas' property
to also disable the HDMI audio interface.

See: https://github.com/raspberrypi/linux/issues/2489

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 2f276222e30fa..be80769d7b5bf 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -1087,10 +1087,12 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *hdmi)
 	struct device *dev = &hdmi->pdev->dev;
 	const __be32 *addr;
 	int ret;
+	int len;
 
-	if (!of_find_property(dev->of_node, "dmas", NULL)) {
+	if (!of_find_property(dev->of_node, "dmas", &len) ||
+	    len == 0) {
 		dev_warn(dev,
-			 "'dmas' DT property is missing, no HDMI audio\n");
+			 "'dmas' DT property is missing or empty, no HDMI audio\n");
 		return 0;
 	}
 
-- 
GitLab


From e8e84b725b2d9048f34c57c85893e4c35d94ea9e Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 31 Jul 2019 17:39:37 +0100
Subject: [PATCH 1220/1835] overlays: Add audio parameter to vc4-kms-v3d

The audio parameter to the vc4-kms-v3d overlay allows audio support
to be disabled (it defaults to on) by adding "audio=off" to the
dtoverlay parameters.

See: https://github.com/raspberrypi/linux/issues/2489

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README                  | 1 +
 arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 203041654d847..6131ac3d967cc 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -2480,6 +2480,7 @@ Params: cma-256                 CMA is 256MB (needs 1GB)
         cma-128                 CMA is 128MB
         cma-96                  CMA is 96MB
         cma-64                  CMA is 64MB
+        audio                   Enable or disable audio over HDMI (default "on")
 
 
 Name:   vga666
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
index 19e1d2548e7bb..c5f687e8bcb9a 100644
--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
@@ -134,11 +134,19 @@
 		};
 	};
 
+	fragment@17 {
+		target = <&hdmi>;
+		__dormant__  {
+			dmas;
+		};
+	};
+
 	__overrides__ {
 		cma-256 = <0>,"+0-1-2-3-4";
 		cma-192 = <0>,"-0+1-2-3-4";
 		cma-128 = <0>,"-0-1+2-3-4";
 		cma-96  = <0>,"-0-1-2+3-4";
 		cma-64  = <0>,"-0-1-2-3+4";
+		audio   = <0>,"!17";
 	};
 };
-- 
GitLab


From 3560542c15a3b71ecd58e347f7fcfc3b6e7770a2 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Wed, 31 Jul 2019 17:41:47 +0100
Subject: [PATCH 1221/1835] overlays: Update the upstream overlay

The recent vc4-kms-v3d commit has changed the content of the
upstream overlay (even though the extra fragment is disabled).

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/upstream-overlay.dts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
index 48e0ef61952c6..6112640837fc0 100644
--- a/arch/arm/boot/dts/overlays/upstream-overlay.dts
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -110,6 +110,12 @@
 		};
 	};
 	fragment@17 {
+		target = <&hdmi>;
+		__dormant__ {
+			dmas;
+		};
+	};
+	fragment@18 {
 		target = <&usb>;
 		#address-cells = <1>;
 		#size-cells = <1>;
-- 
GitLab


From 9543c9ffe07dcfd7b7a93e9009bd004c3c1cfdec Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 1 Aug 2019 08:58:48 +0100
Subject: [PATCH 1222/1835] can: mcp251x: Allow more time after a reset

Some boards take longer than 5ms to power up after a reset, so allow
a few retry attempts before giving up.

See: https://github.com/raspberrypi/linux/issues/2767

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/can/spi/mcp251x.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index cae0f5b633d00..c5c2ac423fc9a 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -628,6 +628,7 @@ static int mcp251x_hw_reset(struct spi_device *spi)
 	struct mcp251x_priv *priv = spi_get_drvdata(spi);
 	u8 reg;
 	int ret;
+	int retries = 10;
 
 	/* Wait for oscillator startup timer after power up */
 	mdelay(MCP251X_OST_DELAY_MS);
@@ -637,10 +638,18 @@ static int mcp251x_hw_reset(struct spi_device *spi)
 	if (ret)
 		return ret;
 
-	/* Wait for oscillator startup timer after reset */
-	mdelay(MCP251X_OST_DELAY_MS);
+	/*
+	 * Wait for oscillator startup timer after reset
+	 *
+	 * Some devices can take longer than the expected 5ms to wake
+	 * up, so allow a few retries.
+	 */
+
+	do {
+		mdelay(MCP251X_OST_DELAY_MS);
+		reg = mcp251x_read_reg(spi, CANSTAT);
+	} while (!reg && retries--);
 
-	reg = mcp251x_read_reg(spi, CANSTAT);
 	if ((reg & CANCTRL_REQOP_MASK) != CANCTRL_REQOP_CONF)
 		return -ENODEV;
 
-- 
GitLab


From e27970cd68f7b52523ce0992446f43b7ed2fb211 Mon Sep 17 00:00:00 2001
From: James Hughes <james.hughes@raspberrypi.org>
Date: Mon, 29 Jul 2019 12:02:59 +0100
Subject: [PATCH 1223/1835] Fixup FKMS interrupt handing for non-existent
 display

If an errant interrupt flag was received from a non-existent display,
a NULL pointer access was made. Protect against this by checking if a
second display is present prior to checking the interrupt flags.
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 8f3fe6f9246ea..bcbd2f709c7f6 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -1056,14 +1056,17 @@ static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
 				vc4_crtc_handle_page_flip(crtc_list[0]);
 			}
 
-			/* Check for the secondary display too */
-			chan = readl(crtc_list[0]->regs + SMIDSW1);
+			if (crtc_list[1]) {
+				/* Check for the secondary display too */
+				chan = readl(crtc_list[0]->regs + SMIDSW1);
 
-			if (chan & 1) {
-				writel(SMI_NEW, crtc_list[0]->regs + SMIDSW1);
-				if (crtc_list[1]->vblank_enabled)
-					drm_crtc_handle_vblank(&crtc_list[1]->base);
-				vc4_crtc_handle_page_flip(crtc_list[1]);
+				if (chan & 1) {
+					writel(SMI_NEW, crtc_list[0]->regs + SMIDSW1);
+
+					if (crtc_list[1]->vblank_enabled)
+						drm_crtc_handle_vblank(&crtc_list[1]->base);
+					vc4_crtc_handle_page_flip(crtc_list[1]);
+				}
 			}
 		}
 
-- 
GitLab


From f8838a2ac019050145abb3931dfb9270b8208e2d Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Sun, 28 Jul 2019 22:22:36 +0100
Subject: [PATCH 1224/1835] drivers: char: Use correct name for the Raspberry
 Pi video decoder

Replace the old code name with a more appropriate name - RPiVid.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2838.dtsi                |  10 +-
 arch/arm/configs/bcm2711_defconfig            |   2 +-
 drivers/char/broadcom/Kconfig                 |   8 +-
 drivers/char/broadcom/Makefile                |   2 +-
 .../broadcom/{argon-mem.c => rpivid-mem.c}    | 105 +++++++++---------
 drivers/mfd/bcm2835-pm.c                      |  12 +-
 drivers/soc/bcm/bcm2835-power.c               |   6 +-
 include/linux/mfd/bcm2835-pm.h                |   2 +-
 8 files changed, 71 insertions(+), 76 deletions(-)
 rename drivers/char/broadcom/{argon-mem.c => rpivid-mem.c} (69%)

diff --git a/arch/arm/boot/dts/bcm2838.dtsi b/arch/arm/boot/dts/bcm2838.dtsi
index 9d349b3fa6522..1d321ad6640a6 100644
--- a/arch/arm/boot/dts/bcm2838.dtsi
+++ b/arch/arm/boot/dts/bcm2838.dtsi
@@ -409,26 +409,26 @@
 		};
 
 		hevc-decoder@7eb00000 {
-			compatible = "raspberrypi,argon-hevc-decoder";
+			compatible = "raspberrypi,rpivid-hevc-decoder";
 			reg = <0x0 0x7eb00000 0x10000>;
 			status = "okay";
 		};
 
-		argon-local-intc@7eb10000 {
-			compatible = "raspberrypi,argon-local-intc";
+		rpivid-local-intc@7eb10000 {
+			compatible = "raspberrypi,rpivid-local-intc";
 			reg = <0x0 0x7eb10000 0x1000>;
 			status = "okay";
 			interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
 		};
 
 		h264-decoder@7eb20000 {
-			compatible = "raspberrypi,argon-h264-decoder";
+			compatible = "raspberrypi,rpivid-h264-decoder";
 			reg = <0x0 0x7eb20000 0x10000>;
 			status = "okay";
 		};
 
 		vp9-decoder@7eb30000 {
-			compatible = "raspberrypi,argon-vp9-decoder";
+			compatible = "raspberrypi,rpivid-vp9-decoder";
 			reg = <0x0 0x7eb30000 0x10000>;
 			status = "okay";
 		};
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 159169797d57c..2ff5dd6f51750 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -650,7 +650,7 @@ CONFIG_BRCM_CHAR_DRIVERS=y
 CONFIG_BCM_VCIO=y
 CONFIG_BCM_VC_SM=y
 CONFIG_BCM2835_DEVGPIOMEM=y
-CONFIG_ARGON_MEM=m
+CONFIG_RPIVID_MEM=m
 # CONFIG_LEGACY_PTYS is not set
 CONFIG_SERIAL_8250=y
 # CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
index 4ba3fb4049eb0..6f9b37bf6b8a9 100644
--- a/drivers/char/broadcom/Kconfig
+++ b/drivers/char/broadcom/Kconfig
@@ -50,10 +50,10 @@ config BCM2835_SMI_DEV
 		Broadcom's Secondary Memory interface. The low-level functionality is provided
 		by the SMI driver itself.
 
-config ARGON_MEM
-	tristate "Character device driver for the Argon decoder hardware"
+config RPIVID_MEM
+	tristate "Character device driver for the Raspberry Pi RPIVid video decoder hardware"
 	default n
 	help
 		This driver provides a character device interface for memory-map operations
-		so userspace tools can access the control and status registers of the Argon
-		video decoder hardware.
+		so userspace tools can access the control and status registers of the
+		Raspberry Pi RPiVid video decoder hardware.
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
index 50767fc1b5690..e060265397193 100644
--- a/drivers/char/broadcom/Makefile
+++ b/drivers/char/broadcom/Makefile
@@ -4,4 +4,4 @@ obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
 
 obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
 obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
-obj-$(CONFIG_ARGON_MEM)		+= argon-mem.o
+obj-$(CONFIG_RPIVID_MEM)	+= rpivid-mem.o
diff --git a/drivers/char/broadcom/argon-mem.c b/drivers/char/broadcom/rpivid-mem.c
similarity index 69%
rename from drivers/char/broadcom/argon-mem.c
rename to drivers/char/broadcom/rpivid-mem.c
index 01c36db7754a8..fae84c7d3cf43 100644
--- a/drivers/char/broadcom/argon-mem.c
+++ b/drivers/char/broadcom/rpivid-mem.c
@@ -1,5 +1,5 @@
 /**
- * argon-mem.c - character device access to the Argon decoder registers
+ * rpivid-mem.c - character device access to the RPiVid decoder registers
  *
  * Based on bcm2835-gpiomem.c. Provides IO memory access to the decoder
  * register blocks such that ffmpeg plugins can access the hardware.
@@ -48,36 +48,36 @@
 #include <linux/pagemap.h>
 #include <linux/io.h>
 
-#define DRIVER_NAME "argon-mem"
+#define DRIVER_NAME "rpivid-mem"
 #define DEVICE_MINOR 0
 
-struct argon_mem_priv {
+struct rpivid_mem_priv {
 	dev_t devid;
 	struct class *class;
-	struct cdev argon_mem_cdev;
+	struct cdev rpivid_mem_cdev;
 	unsigned long regs_phys;
 	unsigned long mem_window_len;
 	struct device *dev;
 	const char *name;
 };
 
-static int argon_mem_open(struct inode *inode, struct file *file)
+static int rpivid_mem_open(struct inode *inode, struct file *file)
 {
 	int dev = iminor(inode);
 	int ret = 0;
-	struct argon_mem_priv *priv;
+	struct rpivid_mem_priv *priv;
 	if (dev != DEVICE_MINOR)
 		ret = -ENXIO;
 
-	priv = container_of(inode->i_cdev, struct argon_mem_priv,
-				argon_mem_cdev);
+	priv = container_of(inode->i_cdev, struct rpivid_mem_priv,
+				rpivid_mem_cdev);
 	if (!priv)
 		return -EINVAL;
 	file->private_data = priv;
 	return ret;
 }
 
-static int argon_mem_release(struct inode *inode, struct file *file)
+static int rpivid_mem_release(struct inode *inode, struct file *file)
 {
 	int dev = iminor(inode);
 	int ret = 0;
@@ -88,15 +88,15 @@ static int argon_mem_release(struct inode *inode, struct file *file)
 	return ret;
 }
 
-static const struct vm_operations_struct argon_mem_vm_ops = {
+static const struct vm_operations_struct rpivid_mem_vm_ops = {
 #ifdef CONFIG_HAVE_IOREMAP_PROT
 	.access = generic_access_phys
 #endif
 };
 
-static int argon_mem_mmap(struct file *file, struct vm_area_struct *vma)
+static int rpivid_mem_mmap(struct file *file, struct vm_area_struct *vma)
 {
-	struct argon_mem_priv *priv;
+	struct rpivid_mem_priv *priv;
 	unsigned long pages;
 
 	priv = file->private_data;
@@ -108,7 +108,7 @@ static int argon_mem_mmap(struct file *file, struct vm_area_struct *vma)
 	vma->vm_page_prot = phys_mem_access_prot(file, pages,
 						 priv->mem_window_len,
 						 vma->vm_page_prot);
-	vma->vm_ops = &argon_mem_vm_ops;
+	vma->vm_ops = &rpivid_mem_vm_ops;
 	if (remap_pfn_range(vma, vma->vm_start,
 			pages,
 			priv->mem_window_len,
@@ -119,28 +119,28 @@ static int argon_mem_mmap(struct file *file, struct vm_area_struct *vma)
 }
 
 static const struct file_operations
-argon_mem_fops = {
+rpivid_mem_fops = {
 	.owner = THIS_MODULE,
-	.open = argon_mem_open,
-	.release = argon_mem_release,
-	.mmap = argon_mem_mmap,
+	.open = rpivid_mem_open,
+	.release = rpivid_mem_release,
+	.mmap = rpivid_mem_mmap,
 };
 
-static const struct of_device_id argon_mem_of_match[];
-static int argon_mem_probe(struct platform_device *pdev)
+static const struct of_device_id rpivid_mem_of_match[];
+static int rpivid_mem_probe(struct platform_device *pdev)
 {
 	int err;
 	void *ptr_err;
 	const struct of_device_id *id;
 	struct device *dev = &pdev->dev;
-	struct device *argon_mem_dev;
+	struct device *rpivid_mem_dev;
 	struct resource *ioresource;
-	struct argon_mem_priv *priv;
+	struct rpivid_mem_priv *priv;
 
 
 	/* Allocate buffers and instance data */
 
-	priv = kzalloc(sizeof(struct argon_mem_priv), GFP_KERNEL);
+	priv = kzalloc(sizeof(struct rpivid_mem_priv), GFP_KERNEL);
 
 	if (!priv) {
 		err = -ENOMEM;
@@ -149,7 +149,7 @@ static int argon_mem_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, priv);
 
 	priv->dev = dev;
-	id = of_match_device(argon_mem_of_match, dev);
+	id = of_match_device(rpivid_mem_of_match, dev);
 	if (!id)
 		return -EINVAL;
 	priv->name = id->data;
@@ -172,9 +172,9 @@ static int argon_mem_probe(struct platform_device *pdev)
 		dev_err(priv->dev, "unable to allocate device number");
 		goto failed_alloc_chrdev;
 	}
-	cdev_init(&priv->argon_mem_cdev, &argon_mem_fops);
-	priv->argon_mem_cdev.owner = THIS_MODULE;
-	err = cdev_add(&priv->argon_mem_cdev, priv->devid, 1);
+	cdev_init(&priv->rpivid_mem_cdev, &rpivid_mem_fops);
+	priv->rpivid_mem_cdev.owner = THIS_MODULE;
+	err = cdev_add(&priv->rpivid_mem_cdev, priv->devid, 1);
 	if (err != 0) {
 		dev_err(priv->dev, "unable to register device");
 		goto failed_cdev_add;
@@ -187,10 +187,10 @@ static int argon_mem_probe(struct platform_device *pdev)
 	if (IS_ERR(ptr_err))
 		goto failed_class_create;
 
-	argon_mem_dev = device_create(priv->class, NULL,
+	rpivid_mem_dev = device_create(priv->class, NULL,
 					priv->devid, NULL,
 					priv->name);
-	ptr_err = argon_mem_dev;
+	ptr_err = rpivid_mem_dev;
 	if (IS_ERR(ptr_err))
 		goto failed_device_create;
 
@@ -202,7 +202,7 @@ static int argon_mem_probe(struct platform_device *pdev)
 failed_device_create:
 	class_destroy(priv->class);
 failed_class_create:
-	cdev_del(&priv->argon_mem_cdev);
+	cdev_del(&priv->rpivid_mem_cdev);
 	err = PTR_ERR(ptr_err);
 failed_cdev_add:
 	unregister_chrdev_region(priv->devid, 1);
@@ -210,18 +210,18 @@ failed_alloc_chrdev:
 failed_get_resource:
 	kfree(priv);
 failed_inst_alloc:
-	dev_err(priv->dev, "could not load argon_mem");
+	dev_err(priv->dev, "could not load rpivid_mem");
 	return err;
 }
 
-static int argon_mem_remove(struct platform_device *pdev)
+static int rpivid_mem_remove(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct argon_mem_priv *priv = platform_get_drvdata(pdev);
+	struct rpivid_mem_priv *priv = platform_get_drvdata(pdev);
 
 	device_destroy(priv->class, priv->devid);
 	class_destroy(priv->class);
-	cdev_del(&priv->argon_mem_cdev);
+	cdev_del(&priv->rpivid_mem_cdev);
 	unregister_chrdev_region(priv->devid, 1);
 	kfree(priv);
 
@@ -229,49 +229,44 @@ static int argon_mem_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static const char argon_hevc_name[] = "argon-hevcmem";
-static const char argon_h264_name[] = "argon-h264mem";
-static const char argon_vp9_name[] = "argon-vp9mem";
-static const char argon_intc_name[] = "argon-intcmem";
-
-static const struct of_device_id argon_mem_of_match[] = {
+static const struct of_device_id rpivid_mem_of_match[] = {
 	{
-		.compatible = "raspberrypi,argon-hevc-decoder",
-		.data = &argon_hevc_name,
+		.compatible = "raspberrypi,rpivid-hevc-decoder",
+		.data = "rpivid-hevcmem",
 	},
 	{
-		.compatible = "raspberrypi,argon-h264-decoder",
-		.data = &argon_h264_name,
+		.compatible = "raspberrypi,rpivid-h264-decoder",
+		.data = "rpivid-h264mem",
 	},
 	{
-		.compatible = "raspberrypi,argon-vp9-decoder",
-		.data = &argon_vp9_name,
+		.compatible = "raspberrypi,rpivid-vp9-decoder",
+		.data = "rpivid-vp9mem",
 	},
 	/* The "intc" is included as this block of hardware contains the
 	 * "frame done" status flags.
 	 */
 	{
-		.compatible = "raspberrypi,argon-local-intc",
-		.data = &argon_intc_name,
+		.compatible = "raspberrypi,rpivid-local-intc",
+		.data = "rpivid-intcmem",
 	},
 	{ /* sentinel */ },
 };
 
-MODULE_DEVICE_TABLE(of, argon_mem_of_match);
+MODULE_DEVICE_TABLE(of, rpivid_mem_of_match);
 
-static struct platform_driver argon_mem_driver = {
-	.probe = argon_mem_probe,
-	.remove = argon_mem_remove,
+static struct platform_driver rpivid_mem_driver = {
+	.probe = rpivid_mem_probe,
+	.remove = rpivid_mem_remove,
 	.driver = {
 		   .name = DRIVER_NAME,
 		   .owner = THIS_MODULE,
-		   .of_match_table = argon_mem_of_match,
+		   .of_match_table = rpivid_mem_of_match,
 		   },
 };
 
-module_platform_driver(argon_mem_driver);
+module_platform_driver(rpivid_mem_driver);
 
-MODULE_ALIAS("platform:argon-mem");
+MODULE_ALIAS("platform:rpivid-mem");
 MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("Driver for accessing Argon decoder registers from userspace");
+MODULE_DESCRIPTION("Driver for accessing RPiVid decoder registers from userspace");
 MODULE_AUTHOR("Jonathan Bell <jonathan@raspberrypi.org>");
diff --git a/drivers/mfd/bcm2835-pm.c b/drivers/mfd/bcm2835-pm.c
index ab1e9cbc50b1b..f66f92fe28c34 100644
--- a/drivers/mfd/bcm2835-pm.c
+++ b/drivers/mfd/bcm2835-pm.c
@@ -50,14 +50,14 @@ static int bcm2835_pm_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	/* Map the ARGON ASB regs if present. */
+	/* Map the RPiVid ASB regs if present. */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
 	if (res) {
-		pm->arg_asb = devm_ioremap_resource(dev, res);
-		if (IS_ERR(pm->arg_asb)) {
-			dev_err(dev, "Failed to map ARGON ASB: %ld\n",
-				PTR_ERR(pm->arg_asb));
-			return PTR_ERR(pm->arg_asb);
+		pm->rpivid_asb = devm_ioremap_resource(dev, res);
+		if (IS_ERR(pm->rpivid_asb)) {
+			dev_err(dev, "Failed to map RPiVid ASB: %ld\n",
+				PTR_ERR(pm->rpivid_asb));
+			return PTR_ERR(pm->rpivid_asb);
 		}
 	}
 
diff --git a/drivers/soc/bcm/bcm2835-power.c b/drivers/soc/bcm/bcm2835-power.c
index 918cf54ab9ef9..05d2293e8e584 100644
--- a/drivers/soc/bcm/bcm2835-power.c
+++ b/drivers/soc/bcm/bcm2835-power.c
@@ -637,15 +637,15 @@ static int bcm2835_power_probe(struct platform_device *pdev)
 	power->base = pm->base;
 	power->asb = pm->asb;
 
-	/* 2711 hack: the new ARGON ASB took over V3D, which is our
+	/* 2711 hack: the new RPiVid ASB took over V3D, which is our
 	 * only consumer of this driver so far.  The old ASB seems to
 	 * still be present with ISP and H264 bits but no V3D, but I
 	 * don't know if that's real or not.  The V3D is in the same
 	 * place in the new ASB as the old one, so just poke the new
 	 * one for now.
 	 */
-	if (pm->arg_asb) {
-		power->asb = pm->arg_asb;
+	if (pm->rpivid_asb) {
+		power->asb = pm->rpivid_asb;
 		power->is_2711 = true;
 	}
 
diff --git a/include/linux/mfd/bcm2835-pm.h b/include/linux/mfd/bcm2835-pm.h
index b2d157091e12b..f70a810c55f7d 100644
--- a/include/linux/mfd/bcm2835-pm.h
+++ b/include/linux/mfd/bcm2835-pm.h
@@ -9,7 +9,7 @@ struct bcm2835_pm {
 	struct device *dev;
 	void __iomem *base;
 	void __iomem *asb;
-	void __iomem *arg_asb;
+	void __iomem *rpivid_asb;
 };
 
 #endif /* BCM2835_MFD_PM_H */
-- 
GitLab


From 75f1d14cee8cfb1964cbda21a30cb030a632c3c2 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 29 Jul 2019 12:03:21 +0100
Subject: [PATCH 1225/1835] driver: char: rpivid - also support legacy name

Provide transitional support for the previous names of
the character devices.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/char/broadcom/rpivid-mem.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/drivers/char/broadcom/rpivid-mem.c b/drivers/char/broadcom/rpivid-mem.c
index fae84c7d3cf43..e4e5fb1fb8209 100644
--- a/drivers/char/broadcom/rpivid-mem.c
+++ b/drivers/char/broadcom/rpivid-mem.c
@@ -66,7 +66,7 @@ static int rpivid_mem_open(struct inode *inode, struct file *file)
 	int dev = iminor(inode);
 	int ret = 0;
 	struct rpivid_mem_priv *priv;
-	if (dev != DEVICE_MINOR)
+	if (dev != DEVICE_MINOR && dev != DEVICE_MINOR + 1)
 		ret = -ENXIO;
 
 	priv = container_of(inode->i_cdev, struct rpivid_mem_priv,
@@ -82,7 +82,7 @@ static int rpivid_mem_release(struct inode *inode, struct file *file)
 	int dev = iminor(inode);
 	int ret = 0;
 
-	if (dev != DEVICE_MINOR)
+	if (dev != DEVICE_MINOR && dev != DEVICE_MINOR + 1)
 		ret = -ENXIO;
 
 	return ret;
@@ -167,14 +167,14 @@ static int rpivid_mem_probe(struct platform_device *pdev)
 	/* Create character device entries */
 
 	err = alloc_chrdev_region(&priv->devid,
-				  DEVICE_MINOR, 1, priv->name);
+				  DEVICE_MINOR, 2, priv->name);
 	if (err != 0) {
 		dev_err(priv->dev, "unable to allocate device number");
 		goto failed_alloc_chrdev;
 	}
 	cdev_init(&priv->rpivid_mem_cdev, &rpivid_mem_fops);
 	priv->rpivid_mem_cdev.owner = THIS_MODULE;
-	err = cdev_add(&priv->rpivid_mem_cdev, priv->devid, 1);
+	err = cdev_add(&priv->rpivid_mem_cdev, priv->devid, 2);
 	if (err != 0) {
 		dev_err(priv->dev, "unable to register device");
 		goto failed_cdev_add;
@@ -194,6 +194,20 @@ static int rpivid_mem_probe(struct platform_device *pdev)
 	if (IS_ERR(ptr_err))
 		goto failed_device_create;
 
+	/* Legacy alias */
+	{
+		char *oldname = kstrdup(priv->name, GFP_KERNEL);
+
+		oldname[1] = 'a';
+		oldname[2] = 'r';
+		oldname[3] = 'g';
+		oldname[4] = 'o';
+		oldname[5] = 'n';
+		(void)device_create(priv->class, NULL, priv->devid + 1, NULL,
+				       oldname + 1);
+		kfree(oldname);
+	}
+
 	dev_info(priv->dev, "%s initialised: Registers at 0x%08lx length 0x%08lx",
 		priv->name, priv->regs_phys, priv->mem_window_len);
 
-- 
GitLab


From dee43611031fb719b1472e14d9e90e176284d98c Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Thu, 1 Aug 2019 16:41:20 +0100
Subject: [PATCH 1226/1835] hid: usb: Add device quirks for Freeway Airmouse T3
 and MX3

These wireless mouse/keyboard combo remote control devices specify
multiple "wheel" events in their report descriptors. The wheel events
are incorrectly defined and apparently map to accelerometer data, leading
to spurious mouse scroll events being generated at an extreme rate when
the device is moved.

As a workaround, use HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE to mask
feeding the extra wheel events to the input subsystem.

See: https://github.com/raspberrypi/firmware/issues/1189

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/hid/hid-ids.h    | 6 ++++++
 drivers/hid/hid-quirks.c | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index ab373a3942aa2..4a643a60998f8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -222,6 +222,9 @@
 #define USB_VENDOR_ID_BAANTO		0x2453
 #define USB_DEVICE_ID_BAANTO_MT_190W2	0x0100
 
+#define USB_VENDOR_ID_BEKEN		0x25a7
+#define USB_DEVICE_ID_AIRMOUSE_T3	0x2402
+
 #define USB_VENDOR_ID_BELKIN		0x050d
 #define USB_DEVICE_ID_FLIP_KVM		0x3201
 
@@ -1186,6 +1189,9 @@
 #define USB_VENDOR_ID_XAT	0x2505
 #define USB_DEVICE_ID_XAT_CSR	0x0220
 
+#define USB_VENDOR_ID_XENTA			0x1d57
+#define USB_DEVICE_ID_AIRMOUSE_MX3		0xad03
+
 #define USB_VENDOR_ID_XIN_MO			0x16c0
 #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE	0x05e1
 #define USB_DEVICE_ID_THT_2P_ARCADE		0x75e1
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 91e86af44a04c..80b8c6ba8939b 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -43,6 +43,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_BEKEN, USB_DEVICE_ID_AIRMOUSE_T3), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
@@ -171,6 +172,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_XENTA, USB_DEVICE_ID_AIRMOUSE_MX3), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
 
 	{ 0 }
 };
-- 
GitLab


From 9d3586bcdae3ad6be352e5f551894c66c41e6dcd Mon Sep 17 00:00:00 2001
From: Sunil Muthuswamy <sunilmut@microsoft.com>
Date: Wed, 15 May 2019 00:56:05 +0000
Subject: [PATCH 1227/1835] hv_sock: Add support for delayed close

commit a9eeb998c28d5506616426bd3a216bd5735a18b8 upstream.

Currently, hvsock does not implement any delayed or background close
logic. Whenever the hvsock socket is closed, a FIN is sent to the peer, and
the last reference to the socket is dropped, which leads to a call to
.destruct where the socket can hang indefinitely waiting for the peer to
close it's side. The can cause the user application to hang in the close()
call.

This change implements proper STREAM(TCP) closing handshake mechanism by
sending the FIN to the peer and the waiting for the peer's FIN to arrive
for a given timeout. On timeout, it will try to terminate the connection
(i.e. a RST). This is in-line with other socket providers such as virtio.

This change does not address the hang in the vmbus_hvsock_device_unregister
where it waits indefinitely for the host to rescind the channel. That
should be taken up as a separate fix.

Signed-off-by: Sunil Muthuswamy <sunilmut@microsoft.com>
Reviewed-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/vmw_vsock/hyperv_transport.c | 108 ++++++++++++++++++++++---------
 1 file changed, 77 insertions(+), 31 deletions(-)

diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index b131561a94692..9c7da811d130f 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -35,6 +35,9 @@
 /* The MTU is 16KB per the host side's design */
 #define HVS_MTU_SIZE		(1024 * 16)
 
+/* How long to wait for graceful shutdown of a connection */
+#define HVS_CLOSE_TIMEOUT (8 * HZ)
+
 struct vmpipe_proto_header {
 	u32 pkt_type;
 	u32 data_size;
@@ -290,19 +293,32 @@ static void hvs_channel_cb(void *ctx)
 		sk->sk_write_space(sk);
 }
 
-static void hvs_close_connection(struct vmbus_channel *chan)
+static void hvs_do_close_lock_held(struct vsock_sock *vsk,
+				   bool cancel_timeout)
 {
-	struct sock *sk = get_per_channel_state(chan);
-	struct vsock_sock *vsk = vsock_sk(sk);
-
-	lock_sock(sk);
+	struct sock *sk = sk_vsock(vsk);
 
-	sk->sk_state = TCP_CLOSE;
 	sock_set_flag(sk, SOCK_DONE);
-	vsk->peer_shutdown |= SEND_SHUTDOWN | RCV_SHUTDOWN;
-
+	vsk->peer_shutdown = SHUTDOWN_MASK;
+	if (vsock_stream_has_data(vsk) <= 0)
+		sk->sk_state = TCP_CLOSING;
 	sk->sk_state_change(sk);
+	if (vsk->close_work_scheduled &&
+	    (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) {
+		vsk->close_work_scheduled = false;
+		vsock_remove_sock(vsk);
 
+		/* Release the reference taken while scheduling the timeout */
+		sock_put(sk);
+	}
+}
+
+static void hvs_close_connection(struct vmbus_channel *chan)
+{
+	struct sock *sk = get_per_channel_state(chan);
+
+	lock_sock(sk);
+	hvs_do_close_lock_held(vsock_sk(sk), true);
 	release_sock(sk);
 }
 
@@ -445,50 +461,80 @@ static int hvs_connect(struct vsock_sock *vsk)
 	return vmbus_send_tl_connect_request(&h->vm_srv_id, &h->host_srv_id);
 }
 
+static void hvs_shutdown_lock_held(struct hvsock *hvs, int mode)
+{
+	struct vmpipe_proto_header hdr;
+
+	if (hvs->fin_sent || !hvs->chan)
+		return;
+
+	/* It can't fail: see hvs_channel_writable_bytes(). */
+	(void)hvs_send_data(hvs->chan, (struct hvs_send_buf *)&hdr, 0);
+	hvs->fin_sent = true;
+}
+
 static int hvs_shutdown(struct vsock_sock *vsk, int mode)
 {
 	struct sock *sk = sk_vsock(vsk);
-	struct vmpipe_proto_header hdr;
-	struct hvs_send_buf *send_buf;
-	struct hvsock *hvs;
 
 	if (!(mode & SEND_SHUTDOWN))
 		return 0;
 
 	lock_sock(sk);
+	hvs_shutdown_lock_held(vsk->trans, mode);
+	release_sock(sk);
+	return 0;
+}
 
-	hvs = vsk->trans;
-	if (hvs->fin_sent)
-		goto out;
-
-	send_buf = (struct hvs_send_buf *)&hdr;
+static void hvs_close_timeout(struct work_struct *work)
+{
+	struct vsock_sock *vsk =
+		container_of(work, struct vsock_sock, close_work.work);
+	struct sock *sk = sk_vsock(vsk);
 
-	/* It can't fail: see hvs_channel_writable_bytes(). */
-	(void)hvs_send_data(hvs->chan, send_buf, 0);
+	sock_hold(sk);
+	lock_sock(sk);
+	if (!sock_flag(sk, SOCK_DONE))
+		hvs_do_close_lock_held(vsk, false);
 
-	hvs->fin_sent = true;
-out:
+	vsk->close_work_scheduled = false;
 	release_sock(sk);
-	return 0;
+	sock_put(sk);
 }
 
-static void hvs_release(struct vsock_sock *vsk)
+/* Returns true, if it is safe to remove socket; false otherwise */
+static bool hvs_close_lock_held(struct vsock_sock *vsk)
 {
 	struct sock *sk = sk_vsock(vsk);
-	struct hvsock *hvs = vsk->trans;
-	struct vmbus_channel *chan;
 
-	lock_sock(sk);
+	if (!(sk->sk_state == TCP_ESTABLISHED ||
+	      sk->sk_state == TCP_CLOSING))
+		return true;
 
-	sk->sk_state = TCP_CLOSING;
-	vsock_remove_sock(vsk);
+	if ((sk->sk_shutdown & SHUTDOWN_MASK) != SHUTDOWN_MASK)
+		hvs_shutdown_lock_held(vsk->trans, SHUTDOWN_MASK);
 
-	release_sock(sk);
+	if (sock_flag(sk, SOCK_DONE))
+		return true;
 
-	chan = hvs->chan;
-	if (chan)
-		hvs_shutdown(vsk, RCV_SHUTDOWN | SEND_SHUTDOWN);
+	/* This reference will be dropped by the delayed close routine */
+	sock_hold(sk);
+	INIT_DELAYED_WORK(&vsk->close_work, hvs_close_timeout);
+	vsk->close_work_scheduled = true;
+	schedule_delayed_work(&vsk->close_work, HVS_CLOSE_TIMEOUT);
+	return false;
+}
 
+static void hvs_release(struct vsock_sock *vsk)
+{
+	struct sock *sk = sk_vsock(vsk);
+	bool remove_sock;
+
+	lock_sock(sk);
+	remove_sock = hvs_close_lock_held(vsk);
+	release_sock(sk);
+	if (remove_sock)
+		vsock_remove_sock(vsk);
 }
 
 static void hvs_destruct(struct vsock_sock *vsk)
-- 
GitLab


From 8a474bc4e6135cfdcd1573f0071e0b1b4318b307 Mon Sep 17 00:00:00 2001
From: Sunil Muthuswamy <sunilmut@microsoft.com>
Date: Thu, 13 Jun 2019 03:52:27 +0000
Subject: [PATCH 1228/1835] vsock: correct removal of socket from the list

commit d5afa82c977ea06f7119058fa0eb8519ea501031 upstream.

The current vsock code for removal of socket from the list is both
subject to race and inefficient. It takes the lock, checks whether
the socket is in the list, drops the lock and if the socket was on the
list, deletes it from the list. This is subject to race because as soon
as the lock is dropped once it is checked for presence, that condition
cannot be relied upon for any decision. It is also inefficient because
if the socket is present in the list, it takes the lock twice.

Signed-off-by: Sunil Muthuswamy <sunilmut@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/vmw_vsock/af_vsock.c | 38 +++++++-------------------------------
 1 file changed, 7 insertions(+), 31 deletions(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index ab27a28729357..2e30bf1975835 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -281,7 +281,8 @@ EXPORT_SYMBOL_GPL(vsock_insert_connected);
 void vsock_remove_bound(struct vsock_sock *vsk)
 {
 	spin_lock_bh(&vsock_table_lock);
-	__vsock_remove_bound(vsk);
+	if (__vsock_in_bound_table(vsk))
+		__vsock_remove_bound(vsk);
 	spin_unlock_bh(&vsock_table_lock);
 }
 EXPORT_SYMBOL_GPL(vsock_remove_bound);
@@ -289,7 +290,8 @@ EXPORT_SYMBOL_GPL(vsock_remove_bound);
 void vsock_remove_connected(struct vsock_sock *vsk)
 {
 	spin_lock_bh(&vsock_table_lock);
-	__vsock_remove_connected(vsk);
+	if (__vsock_in_connected_table(vsk))
+		__vsock_remove_connected(vsk);
 	spin_unlock_bh(&vsock_table_lock);
 }
 EXPORT_SYMBOL_GPL(vsock_remove_connected);
@@ -325,35 +327,10 @@ struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
 }
 EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
 
-static bool vsock_in_bound_table(struct vsock_sock *vsk)
-{
-	bool ret;
-
-	spin_lock_bh(&vsock_table_lock);
-	ret = __vsock_in_bound_table(vsk);
-	spin_unlock_bh(&vsock_table_lock);
-
-	return ret;
-}
-
-static bool vsock_in_connected_table(struct vsock_sock *vsk)
-{
-	bool ret;
-
-	spin_lock_bh(&vsock_table_lock);
-	ret = __vsock_in_connected_table(vsk);
-	spin_unlock_bh(&vsock_table_lock);
-
-	return ret;
-}
-
 void vsock_remove_sock(struct vsock_sock *vsk)
 {
-	if (vsock_in_bound_table(vsk))
-		vsock_remove_bound(vsk);
-
-	if (vsock_in_connected_table(vsk))
-		vsock_remove_connected(vsk);
+	vsock_remove_bound(vsk);
+	vsock_remove_connected(vsk);
 }
 EXPORT_SYMBOL_GPL(vsock_remove_sock);
 
@@ -484,8 +461,7 @@ static void vsock_pending_work(struct work_struct *work)
 	 * incoming packets can't find this socket, and to reduce the reference
 	 * count.
 	 */
-	if (vsock_in_connected_table(vsk))
-		vsock_remove_connected(vsk);
+	vsock_remove_connected(vsk);
 
 	sk->sk_state = TCP_CLOSE;
 
-- 
GitLab


From 01eea1cbba9d8309851f63356fa2f20a790af98f Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Thu, 27 Sep 2018 17:12:33 -0400
Subject: [PATCH 1229/1835] NFS: Fix dentry revalidation on NFSv4 lookup

commit be189f7e7f03de35887e5a85ddcf39b91b5d7fc1 upstream.

We need to ensure that inode and dentry revalidation occurs correctly
on reopen of a file that is already open. Currently, we can end up
not revalidating either in the case of NFSv4.0, due to the 'cached open'
path.
Let's fix that by ensuring that we only do cached open for the special
cases of open recovery and delegation return.

Reported-by: Stan Hu <stanhu@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Qian Lu <luqia@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4proc.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1de855e0ae611..904e08bbb2892 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1355,12 +1355,20 @@ static bool nfs4_mode_match_open_stateid(struct nfs4_state *state,
 	return false;
 }
 
-static int can_open_cached(struct nfs4_state *state, fmode_t mode, int open_mode)
+static int can_open_cached(struct nfs4_state *state, fmode_t mode,
+		int open_mode, enum open_claim_type4 claim)
 {
 	int ret = 0;
 
 	if (open_mode & (O_EXCL|O_TRUNC))
 		goto out;
+	switch (claim) {
+	case NFS4_OPEN_CLAIM_NULL:
+	case NFS4_OPEN_CLAIM_FH:
+		goto out;
+	default:
+		break;
+	}
 	switch (mode & (FMODE_READ|FMODE_WRITE)) {
 		case FMODE_READ:
 			ret |= test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0
@@ -1753,7 +1761,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
 
 	for (;;) {
 		spin_lock(&state->owner->so_lock);
-		if (can_open_cached(state, fmode, open_mode)) {
+		if (can_open_cached(state, fmode, open_mode, claim)) {
 			update_open_stateflags(state, fmode);
 			spin_unlock(&state->owner->so_lock);
 			goto out_return_state;
@@ -2282,7 +2290,8 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
 	if (data->state != NULL) {
 		struct nfs_delegation *delegation;
 
-		if (can_open_cached(data->state, data->o_arg.fmode, data->o_arg.open_flags))
+		if (can_open_cached(data->state, data->o_arg.fmode,
+					data->o_arg.open_flags, claim))
 			goto out_no_action;
 		rcu_read_lock();
 		delegation = rcu_dereference(NFS_I(data->state->inode)->delegation);
-- 
GitLab


From 24acd93f59955956c1ae825ed7773f63ff5cbfdb Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Fri, 28 Sep 2018 09:04:05 -0400
Subject: [PATCH 1230/1835] NFS: Refactor nfs_lookup_revalidate()

commit 5ceb9d7fdaaf6d8ced6cd7861cf1deb9cd93fa47 upstream.

Refactor the code in nfs_lookup_revalidate() as a stepping stone towards
optimising and fixing nfs4_lookup_revalidate().

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Qian Lu <luqia@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/dir.c | 222 +++++++++++++++++++++++++++++----------------------
 1 file changed, 126 insertions(+), 96 deletions(-)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 8bfaa658b2c19..2e6a253e41043 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1072,6 +1072,100 @@ int nfs_neg_need_reval(struct inode *dir, struct dentry *dentry,
 	return !nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU);
 }
 
+static int
+nfs_lookup_revalidate_done(struct inode *dir, struct dentry *dentry,
+			   struct inode *inode, int error)
+{
+	switch (error) {
+	case 1:
+		dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is valid\n",
+			__func__, dentry);
+		return 1;
+	case 0:
+		nfs_mark_for_revalidate(dir);
+		if (inode && S_ISDIR(inode->i_mode)) {
+			/* Purge readdir caches. */
+			nfs_zap_caches(inode);
+			/*
+			 * We can't d_drop the root of a disconnected tree:
+			 * its d_hash is on the s_anon list and d_drop() would hide
+			 * it from shrink_dcache_for_unmount(), leading to busy
+			 * inodes on unmount and further oopses.
+			 */
+			if (IS_ROOT(dentry))
+				return 1;
+		}
+		dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is invalid\n",
+				__func__, dentry);
+		return 0;
+	}
+	dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) lookup returned error %d\n",
+				__func__, dentry, error);
+	return error;
+}
+
+static int
+nfs_lookup_revalidate_negative(struct inode *dir, struct dentry *dentry,
+			       unsigned int flags)
+{
+	int ret = 1;
+	if (nfs_neg_need_reval(dir, dentry, flags)) {
+		if (flags & LOOKUP_RCU)
+			return -ECHILD;
+		ret = 0;
+	}
+	return nfs_lookup_revalidate_done(dir, dentry, NULL, ret);
+}
+
+static int
+nfs_lookup_revalidate_delegated(struct inode *dir, struct dentry *dentry,
+				struct inode *inode)
+{
+	nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+	return nfs_lookup_revalidate_done(dir, dentry, inode, 1);
+}
+
+static int
+nfs_lookup_revalidate_dentry(struct inode *dir, struct dentry *dentry,
+			     struct inode *inode)
+{
+	struct nfs_fh *fhandle;
+	struct nfs_fattr *fattr;
+	struct nfs4_label *label;
+	int ret;
+
+	ret = -ENOMEM;
+	fhandle = nfs_alloc_fhandle();
+	fattr = nfs_alloc_fattr();
+	label = nfs4_label_alloc(NFS_SERVER(inode), GFP_KERNEL);
+	if (fhandle == NULL || fattr == NULL || IS_ERR(label))
+		goto out;
+
+	ret = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
+	if (ret < 0) {
+		if (ret == -ESTALE || ret == -ENOENT)
+			ret = 0;
+		goto out;
+	}
+	ret = 0;
+	if (nfs_compare_fh(NFS_FH(inode), fhandle))
+		goto out;
+	if (nfs_refresh_inode(inode, fattr) < 0)
+		goto out;
+
+	nfs_setsecurity(inode, fattr, label);
+	nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+
+	/* set a readdirplus hint that we had a cache miss */
+	nfs_force_use_readdirplus(dir);
+	ret = 1;
+out:
+	nfs_free_fattr(fattr);
+	nfs_free_fhandle(fhandle);
+	nfs4_label_free(label);
+	return nfs_lookup_revalidate_done(dir, dentry, inode, ret);
+}
+
 /*
  * This is called every time the dcache has a lookup hit,
  * and we should check whether we can really trust that
@@ -1083,58 +1177,36 @@ int nfs_neg_need_reval(struct inode *dir, struct dentry *dentry,
  * If the parent directory is seen to have changed, we throw out the
  * cached dentry and do a new lookup.
  */
-static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+static int
+nfs_do_lookup_revalidate(struct inode *dir, struct dentry *dentry,
+			 unsigned int flags)
 {
-	struct inode *dir;
 	struct inode *inode;
-	struct dentry *parent;
-	struct nfs_fh *fhandle = NULL;
-	struct nfs_fattr *fattr = NULL;
-	struct nfs4_label *label = NULL;
 	int error;
 
-	if (flags & LOOKUP_RCU) {
-		parent = READ_ONCE(dentry->d_parent);
-		dir = d_inode_rcu(parent);
-		if (!dir)
-			return -ECHILD;
-	} else {
-		parent = dget_parent(dentry);
-		dir = d_inode(parent);
-	}
 	nfs_inc_stats(dir, NFSIOS_DENTRYREVALIDATE);
 	inode = d_inode(dentry);
 
-	if (!inode) {
-		if (nfs_neg_need_reval(dir, dentry, flags)) {
-			if (flags & LOOKUP_RCU)
-				return -ECHILD;
-			goto out_bad;
-		}
-		goto out_valid;
-	}
+	if (!inode)
+		return nfs_lookup_revalidate_negative(dir, dentry, flags);
 
 	if (is_bad_inode(inode)) {
-		if (flags & LOOKUP_RCU)
-			return -ECHILD;
 		dfprintk(LOOKUPCACHE, "%s: %pd2 has dud inode\n",
 				__func__, dentry);
 		goto out_bad;
 	}
 
 	if (NFS_PROTO(dir)->have_delegation(inode, FMODE_READ))
-		goto out_set_verifier;
+		return nfs_lookup_revalidate_delegated(dir, dentry, inode);
 
 	/* Force a full look up iff the parent directory has changed */
 	if (!(flags & (LOOKUP_EXCL | LOOKUP_REVAL)) &&
 	    nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU)) {
 		error = nfs_lookup_verify_inode(inode, flags);
 		if (error) {
-			if (flags & LOOKUP_RCU)
-				return -ECHILD;
 			if (error == -ESTALE)
-				goto out_zap_parent;
-			goto out_error;
+				nfs_zap_caches(dir);
+			goto out_bad;
 		}
 		nfs_advise_use_readdirplus(dir);
 		goto out_valid;
@@ -1146,81 +1218,39 @@ static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
 	if (NFS_STALE(inode))
 		goto out_bad;
 
-	error = -ENOMEM;
-	fhandle = nfs_alloc_fhandle();
-	fattr = nfs_alloc_fattr();
-	if (fhandle == NULL || fattr == NULL)
-		goto out_error;
-
-	label = nfs4_label_alloc(NFS_SERVER(inode), GFP_NOWAIT);
-	if (IS_ERR(label))
-		goto out_error;
-
 	trace_nfs_lookup_revalidate_enter(dir, dentry, flags);
-	error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
+	error = nfs_lookup_revalidate_dentry(dir, dentry, inode);
 	trace_nfs_lookup_revalidate_exit(dir, dentry, flags, error);
-	if (error == -ESTALE || error == -ENOENT)
-		goto out_bad;
-	if (error)
-		goto out_error;
-	if (nfs_compare_fh(NFS_FH(inode), fhandle))
-		goto out_bad;
-	if ((error = nfs_refresh_inode(inode, fattr)) != 0)
-		goto out_bad;
-
-	nfs_setsecurity(inode, fattr, label);
-
-	nfs_free_fattr(fattr);
-	nfs_free_fhandle(fhandle);
-	nfs4_label_free(label);
+	return error;
+out_valid:
+	return nfs_lookup_revalidate_done(dir, dentry, inode, 1);
+out_bad:
+	if (flags & LOOKUP_RCU)
+		return -ECHILD;
+	return nfs_lookup_revalidate_done(dir, dentry, inode, 0);
+}
 
-	/* set a readdirplus hint that we had a cache miss */
-	nfs_force_use_readdirplus(dir);
+static int
+nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+{
+	struct dentry *parent;
+	struct inode *dir;
+	int ret;
 
-out_set_verifier:
-	nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
- out_valid:
 	if (flags & LOOKUP_RCU) {
+		parent = READ_ONCE(dentry->d_parent);
+		dir = d_inode_rcu(parent);
+		if (!dir)
+			return -ECHILD;
+		ret = nfs_do_lookup_revalidate(dir, dentry, flags);
 		if (parent != READ_ONCE(dentry->d_parent))
 			return -ECHILD;
-	} else
+	} else {
+		parent = dget_parent(dentry);
+		ret = nfs_do_lookup_revalidate(d_inode(parent), dentry, flags);
 		dput(parent);
-	dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is valid\n",
-			__func__, dentry);
-	return 1;
-out_zap_parent:
-	nfs_zap_caches(dir);
- out_bad:
-	WARN_ON(flags & LOOKUP_RCU);
-	nfs_free_fattr(fattr);
-	nfs_free_fhandle(fhandle);
-	nfs4_label_free(label);
-	nfs_mark_for_revalidate(dir);
-	if (inode && S_ISDIR(inode->i_mode)) {
-		/* Purge readdir caches. */
-		nfs_zap_caches(inode);
-		/*
-		 * We can't d_drop the root of a disconnected tree:
-		 * its d_hash is on the s_anon list and d_drop() would hide
-		 * it from shrink_dcache_for_unmount(), leading to busy
-		 * inodes on unmount and further oopses.
-		 */
-		if (IS_ROOT(dentry))
-			goto out_valid;
 	}
-	dput(parent);
-	dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is invalid\n",
-			__func__, dentry);
-	return 0;
-out_error:
-	WARN_ON(flags & LOOKUP_RCU);
-	nfs_free_fattr(fattr);
-	nfs_free_fhandle(fhandle);
-	nfs4_label_free(label);
-	dput(parent);
-	dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) lookup returned error %d\n",
-			__func__, dentry, error);
-	return error;
+	return ret;
 }
 
 /*
-- 
GitLab


From 9e441c7844a6223e20105a9e4316079f7b26f15c Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Fri, 28 Sep 2018 12:42:51 -0400
Subject: [PATCH 1231/1835] NFSv4: Fix lookup revalidate of regular files

commit c7944ebb9ce9461079659e9e6ec5baaf73724b3b upstream.

If we're revalidating an existing dentry in order to open a file, we need
to ensure that we check the directory has not changed before we optimise
away the lookup.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Qian Lu <luqia@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/dir.c | 79 ++++++++++++++++++++++++++--------------------------
 1 file changed, 39 insertions(+), 40 deletions(-)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2e6a253e41043..71b2e390becf2 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1231,7 +1231,8 @@ out_bad:
 }
 
 static int
-nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+__nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags,
+			int (*reval)(struct inode *, struct dentry *, unsigned int))
 {
 	struct dentry *parent;
 	struct inode *dir;
@@ -1242,17 +1243,22 @@ nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
 		dir = d_inode_rcu(parent);
 		if (!dir)
 			return -ECHILD;
-		ret = nfs_do_lookup_revalidate(dir, dentry, flags);
+		ret = reval(dir, dentry, flags);
 		if (parent != READ_ONCE(dentry->d_parent))
 			return -ECHILD;
 	} else {
 		parent = dget_parent(dentry);
-		ret = nfs_do_lookup_revalidate(d_inode(parent), dentry, flags);
+		ret = reval(d_inode(parent), dentry, flags);
 		dput(parent);
 	}
 	return ret;
 }
 
+static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+{
+	return __nfs_lookup_revalidate(dentry, flags, nfs_do_lookup_revalidate);
+}
+
 /*
  * A weaker form of d_revalidate for revalidating just the d_inode(dentry)
  * when we don't really care about the dentry name. This is called when a
@@ -1609,62 +1615,55 @@ no_open:
 }
 EXPORT_SYMBOL_GPL(nfs_atomic_open);
 
-static int nfs4_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+static int
+nfs4_do_lookup_revalidate(struct inode *dir, struct dentry *dentry,
+			  unsigned int flags)
 {
 	struct inode *inode;
-	int ret = 0;
 
 	if (!(flags & LOOKUP_OPEN) || (flags & LOOKUP_DIRECTORY))
-		goto no_open;
+		goto full_reval;
 	if (d_mountpoint(dentry))
-		goto no_open;
-	if (NFS_SB(dentry->d_sb)->caps & NFS_CAP_ATOMIC_OPEN_V1)
-		goto no_open;
+		goto full_reval;
 
 	inode = d_inode(dentry);
 
 	/* We can't create new files in nfs_open_revalidate(), so we
 	 * optimize away revalidation of negative dentries.
 	 */
-	if (inode == NULL) {
-		struct dentry *parent;
-		struct inode *dir;
-
-		if (flags & LOOKUP_RCU) {
-			parent = READ_ONCE(dentry->d_parent);
-			dir = d_inode_rcu(parent);
-			if (!dir)
-				return -ECHILD;
-		} else {
-			parent = dget_parent(dentry);
-			dir = d_inode(parent);
-		}
-		if (!nfs_neg_need_reval(dir, dentry, flags))
-			ret = 1;
-		else if (flags & LOOKUP_RCU)
-			ret = -ECHILD;
-		if (!(flags & LOOKUP_RCU))
-			dput(parent);
-		else if (parent != READ_ONCE(dentry->d_parent))
-			return -ECHILD;
-		goto out;
-	}
+	if (inode == NULL)
+		goto full_reval;
+
+	if (NFS_PROTO(dir)->have_delegation(inode, FMODE_READ))
+		return nfs_lookup_revalidate_delegated(dir, dentry, inode);
 
 	/* NFS only supports OPEN on regular files */
 	if (!S_ISREG(inode->i_mode))
-		goto no_open;
+		goto full_reval;
+
 	/* We cannot do exclusive creation on a positive dentry */
-	if (flags & LOOKUP_EXCL)
-		goto no_open;
+	if (flags & (LOOKUP_EXCL | LOOKUP_REVAL))
+		goto reval_dentry;
+
+	/* Check if the directory changed */
+	if (!nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU))
+		goto reval_dentry;
 
 	/* Let f_op->open() actually open (and revalidate) the file */
-	ret = 1;
+	return 1;
+reval_dentry:
+	if (flags & LOOKUP_RCU)
+		return -ECHILD;
+	return nfs_lookup_revalidate_dentry(dir, dentry, inode);;
 
-out:
-	return ret;
+full_reval:
+	return nfs_do_lookup_revalidate(dir, dentry, flags);
+}
 
-no_open:
-	return nfs_lookup_revalidate(dentry, flags);
+static int nfs4_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+{
+	return __nfs_lookup_revalidate(dentry, flags,
+			nfs4_do_lookup_revalidate);
 }
 
 #endif /* CONFIG_NFSV4 */
-- 
GitLab


From ec58bfa2d4120ea39ef39c8e54abcde461f94248 Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Date: Wed, 19 Sep 2018 18:13:52 +0400
Subject: [PATCH 1232/1835] usb: dwc2: Disable all EP's on disconnect

commit dccf1bad4be7eaa096c1f3697bd37883f9a08ecb upstream.

Disabling all EP's allow to reset EP's to initial state.
On disconnect disable all EP's instead of just killing
all requests. Because of some platform didn't catch
disconnect event, same stuff added to
dwc2_hsotg_core_init_disconnected() function when USB
reset detected on the bus.

Changed from version 1:
Changed lock acquire flow in dwc2_hsotg_ep_disable()
function.

Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/gadget.c | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 03614ef64ca47..ed79bdf6f56c6 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3107,6 +3107,8 @@ static void kill_all_requests(struct dwc2_hsotg *hsotg,
 		dwc2_hsotg_txfifo_flush(hsotg, ep->fifo_index);
 }
 
+static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
+
 /**
  * dwc2_hsotg_disconnect - disconnect service
  * @hsotg: The device state.
@@ -3125,13 +3127,12 @@ void dwc2_hsotg_disconnect(struct dwc2_hsotg *hsotg)
 	hsotg->connected = 0;
 	hsotg->test_mode = 0;
 
+	/* all endpoints should be shutdown */
 	for (ep = 0; ep < hsotg->num_of_eps; ep++) {
 		if (hsotg->eps_in[ep])
-			kill_all_requests(hsotg, hsotg->eps_in[ep],
-					  -ESHUTDOWN);
+			dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
 		if (hsotg->eps_out[ep])
-			kill_all_requests(hsotg, hsotg->eps_out[ep],
-					  -ESHUTDOWN);
+			dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
 	}
 
 	call_gadget(hsotg, disconnect);
@@ -3189,13 +3190,23 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
 	u32 val;
 	u32 usbcfg;
 	u32 dcfg = 0;
+	int ep;
 
 	/* Kill any ep0 requests as controller will be reinitialized */
 	kill_all_requests(hsotg, hsotg->eps_out[0], -ECONNRESET);
 
-	if (!is_usb_reset)
+	if (!is_usb_reset) {
 		if (dwc2_core_reset(hsotg, true))
 			return;
+	} else {
+		/* all endpoints should be shutdown */
+		for (ep = 1; ep < hsotg->num_of_eps; ep++) {
+			if (hsotg->eps_in[ep])
+				dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+			if (hsotg->eps_out[ep])
+				dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+		}
+	}
 
 	/*
 	 * we must now enable ep0 ready for host detection and then
@@ -3996,6 +4007,7 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	unsigned long flags;
 	u32 epctrl_reg;
 	u32 ctrl;
+	int locked;
 
 	dev_dbg(hsotg->dev, "%s(ep %p)\n", __func__, ep);
 
@@ -4011,7 +4023,9 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 
 	epctrl_reg = dir_in ? DIEPCTL(index) : DOEPCTL(index);
 
-	spin_lock_irqsave(&hsotg->lock, flags);
+	locked = spin_is_locked(&hsotg->lock);
+	if (!locked)
+		spin_lock_irqsave(&hsotg->lock, flags);
 
 	ctrl = dwc2_readl(hsotg, epctrl_reg);
 
@@ -4035,7 +4049,9 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	hs_ep->fifo_index = 0;
 	hs_ep->fifo_size = 0;
 
-	spin_unlock_irqrestore(&hsotg->lock, flags);
+	if (!locked)
+		spin_unlock_irqrestore(&hsotg->lock, flags);
+
 	return 0;
 }
 
-- 
GitLab


From b544a6855dfb7afee0ad498ce7d57ef4ce3a2dd8 Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
Date: Mon, 10 Dec 2018 18:09:32 +0400
Subject: [PATCH 1233/1835] usb: dwc2: Fix disable all EP's on disconnect
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 4fe4f9fecc36956fd53c8edf96dd0c691ef98ff9 upstream.

Disabling all EP's allow to reset EP's to initial state.
Introduced new function dwc2_hsotg_ep_disable_lock() which
before calling dwc2_hsotg_ep_disable() function acquire
hsotg->lock and release on exiting.
From dwc2_hsotg_ep_disable() function removed acquiring
hsotg->lock.
In dwc2_hsotg_core_init_disconnected() function when USB
reset interrupt asserted disabling all ep’s by
dwc2_hsotg_ep_disable() function.
This updates eliminating sparse imbalance warnings.

Reverted changes in dwc2_hostg_disconnect() function.
Introduced new function dwc2_hsotg_ep_disable_lock().
Changed dwc2_hsotg_ep_ops. Now disable point to
dwc2_hsotg_ep_disable_lock() function.
In functions dwc2_hsotg_udc_stop() and dwc2_hsotg_suspend()
dwc2_hsotg_ep_disable() function replaced by
dwc2_hsotg_ep_disable_lock() function.
In dwc2_hsotg_ep_disable() function removed acquiring
of hsotg->lock.

Fixes: dccf1bad4be7 ("usb: dwc2: Disable all EP's on disconnect")
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/gadget.c | 41 ++++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index ed79bdf6f56c6..3f68edde0f03a 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3107,8 +3107,6 @@ static void kill_all_requests(struct dwc2_hsotg *hsotg,
 		dwc2_hsotg_txfifo_flush(hsotg, ep->fifo_index);
 }
 
-static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
-
 /**
  * dwc2_hsotg_disconnect - disconnect service
  * @hsotg: The device state.
@@ -3130,9 +3128,11 @@ void dwc2_hsotg_disconnect(struct dwc2_hsotg *hsotg)
 	/* all endpoints should be shutdown */
 	for (ep = 0; ep < hsotg->num_of_eps; ep++) {
 		if (hsotg->eps_in[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+			kill_all_requests(hsotg, hsotg->eps_in[ep],
+					  -ESHUTDOWN);
 		if (hsotg->eps_out[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+			kill_all_requests(hsotg, hsotg->eps_out[ep],
+					  -ESHUTDOWN);
 	}
 
 	call_gadget(hsotg, disconnect);
@@ -3176,6 +3176,7 @@ static void dwc2_hsotg_irq_fifoempty(struct dwc2_hsotg *hsotg, bool periodic)
 			GINTSTS_PTXFEMP |  \
 			GINTSTS_RXFLVL)
 
+static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
 /**
  * dwc2_hsotg_core_init - issue softreset to the core
  * @hsotg: The device state
@@ -4004,10 +4005,8 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	struct dwc2_hsotg *hsotg = hs_ep->parent;
 	int dir_in = hs_ep->dir_in;
 	int index = hs_ep->index;
-	unsigned long flags;
 	u32 epctrl_reg;
 	u32 ctrl;
-	int locked;
 
 	dev_dbg(hsotg->dev, "%s(ep %p)\n", __func__, ep);
 
@@ -4023,10 +4022,6 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 
 	epctrl_reg = dir_in ? DIEPCTL(index) : DOEPCTL(index);
 
-	locked = spin_is_locked(&hsotg->lock);
-	if (!locked)
-		spin_lock_irqsave(&hsotg->lock, flags);
-
 	ctrl = dwc2_readl(hsotg, epctrl_reg);
 
 	if (ctrl & DXEPCTL_EPENA)
@@ -4049,12 +4044,22 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
 	hs_ep->fifo_index = 0;
 	hs_ep->fifo_size = 0;
 
-	if (!locked)
-		spin_unlock_irqrestore(&hsotg->lock, flags);
-
 	return 0;
 }
 
+static int dwc2_hsotg_ep_disable_lock(struct usb_ep *ep)
+{
+	struct dwc2_hsotg_ep *hs_ep = our_ep(ep);
+	struct dwc2_hsotg *hsotg = hs_ep->parent;
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&hsotg->lock, flags);
+	ret = dwc2_hsotg_ep_disable(ep);
+	spin_unlock_irqrestore(&hsotg->lock, flags);
+	return ret;
+}
+
 /**
  * on_list - check request is on the given endpoint
  * @ep: The endpoint to check.
@@ -4202,7 +4207,7 @@ static int dwc2_hsotg_ep_sethalt_lock(struct usb_ep *ep, int value)
 
 static const struct usb_ep_ops dwc2_hsotg_ep_ops = {
 	.enable		= dwc2_hsotg_ep_enable,
-	.disable	= dwc2_hsotg_ep_disable,
+	.disable	= dwc2_hsotg_ep_disable_lock,
 	.alloc_request	= dwc2_hsotg_ep_alloc_request,
 	.free_request	= dwc2_hsotg_ep_free_request,
 	.queue		= dwc2_hsotg_ep_queue_lock,
@@ -4342,9 +4347,9 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget)
 	/* all endpoints should be shutdown */
 	for (ep = 1; ep < hsotg->num_of_eps; ep++) {
 		if (hsotg->eps_in[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+			dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
 		if (hsotg->eps_out[ep])
-			dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+			dwc2_hsotg_ep_disable_lock(&hsotg->eps_out[ep]->ep);
 	}
 
 	spin_lock_irqsave(&hsotg->lock, flags);
@@ -4792,9 +4797,9 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
 
 		for (ep = 0; ep < hsotg->num_of_eps; ep++) {
 			if (hsotg->eps_in[ep])
-				dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
+				dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
 			if (hsotg->eps_out[ep])
-				dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
+				dwc2_hsotg_ep_disable_lock(&hsotg->eps_out[ep]->ep);
 		}
 	}
 
-- 
GitLab


From ba2c247a451570c2bbc9f248b0a8730dcd4146a2 Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon@arm.com>
Date: Wed, 5 Sep 2018 15:34:43 +0100
Subject: [PATCH 1234/1835] arm64: compat: Provide definition for
 COMPAT_SIGMINSTKSZ

commit 24951465cbd279f60b1fdc2421b3694405bcff42 upstream.

arch/arm/ defines a SIGMINSTKSZ of 2k, so we should use the same value
for compat tasks.

Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Reported-by: Steve McIntyre <steve.mcintyre@arm.com>
Tested-by: Steve McIntyre <93sam@debian.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/compat.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/include/asm/compat.h b/arch/arm64/include/asm/compat.h
index 1a037b94eba10..cee28a05ee98f 100644
--- a/arch/arm64/include/asm/compat.h
+++ b/arch/arm64/include/asm/compat.h
@@ -159,6 +159,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
 }
 
 #define compat_user_stack_pointer() (user_stack_pointer(task_pt_regs(current)))
+#define COMPAT_MINSIGSTKSZ	2048
 
 static inline void __user *arch_compat_alloc_user_space(long len)
 {
-- 
GitLab


From 22068d49d09d2b3890e19d7b2048a33340f992da Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@android.com>
Date: Wed, 12 Jun 2019 13:29:27 -0700
Subject: [PATCH 1235/1835] binder: fix possible UAF when freeing buffer

commit a370003cc301d4361bae20c9ef615f89bf8d1e8a upstream.

There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.

Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 1e0e438f079fd..6e04e7a707a12 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1960,8 +1960,18 @@ static struct binder_thread *binder_get_txn_from_and_acq_inner(
 
 static void binder_free_transaction(struct binder_transaction *t)
 {
-	if (t->buffer)
-		t->buffer->transaction = NULL;
+	struct binder_proc *target_proc = t->to_proc;
+
+	if (target_proc) {
+		binder_inner_proc_lock(target_proc);
+		if (t->buffer)
+			t->buffer->transaction = NULL;
+		binder_inner_proc_unlock(target_proc);
+	}
+	/*
+	 * If the transaction has no target_proc, then
+	 * t->buffer->transaction has already been cleared.
+	 */
 	kfree(t);
 	binder_stats_deleted(BINDER_STAT_TRANSACTION);
 }
@@ -3484,10 +3494,12 @@ static int binder_thread_write(struct binder_proc *proc,
 				     buffer->debug_id,
 				     buffer->transaction ? "active" : "finished");
 
+			binder_inner_proc_lock(proc);
 			if (buffer->transaction) {
 				buffer->transaction->buffer = NULL;
 				buffer->transaction = NULL;
 			}
+			binder_inner_proc_unlock(proc);
 			if (buffer->async_transaction && buffer->target_node) {
 				struct binder_node *buf_node;
 				struct binder_work *w;
-- 
GitLab


From f13ee5ae0b2f3c0e2e26287394de7c645d0d8d7d Mon Sep 17 00:00:00 2001
From: Phong Tran <tranmanphong@gmail.com>
Date: Mon, 15 Jul 2019 22:08:14 +0700
Subject: [PATCH 1236/1835] ISDN: hfcsusb: checking idx of ep configuration

commit f384e62a82ba5d85408405fdd6aeff89354deaa9 upstream.

The syzbot test with random endpoint address which made the idx is
overflow in the table of endpoint configuations.

this adds the checking for fixing the error report from
syzbot

KASAN: stack-out-of-bounds Read in hfcsusb_probe [1]
The patch tested by syzbot [2]

Reported-by: syzbot+8750abbc3a46ef47d509@syzkaller.appspotmail.com

[1]:
https://syzkaller.appspot.com/bug?id=30a04378dac680c5d521304a00a86156bb913522
[2]:
https://groups.google.com/d/msg/syzkaller-bugs/_6HBdge8F3E/OJn7wVNpBAAJ

Signed-off-by: Phong Tran <tranmanphong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/isdn/hardware/mISDN/hfcsusb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index 6d05946b445eb..060dc7fd66c1d 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1967,6 +1967,9 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
 
 				/* get endpoint base */
 				idx = ((ep_addr & 0x7f) - 1) * 2;
+				if (idx > 15)
+					return -EIO;
+
 				if (ep_addr & 0x80)
 					idx++;
 				attr = ep->desc.bmAttributes;
-- 
GitLab


From 3cf6a070708895b1f7b1d54a8519ea46fdd4262b Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Sun, 19 May 2019 15:28:22 -0400
Subject: [PATCH 1237/1835] media: au0828: fix null dereference in error path

commit 6d0d1ff9ff21fbb06b867c13a1d41ce8ddcd8230 upstream.

au0828_usb_disconnect() gets the au0828_dev struct via usb_get_intfdata,
so it needs to set up for the error paths.

Reported-by: syzbot+357d86bcb4cca1a2f572@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/au0828/au0828-core.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
index 257ae0d8cfe27..e3f63299f85c0 100644
--- a/drivers/media/usb/au0828/au0828-core.c
+++ b/drivers/media/usb/au0828/au0828-core.c
@@ -623,6 +623,12 @@ static int au0828_usb_probe(struct usb_interface *interface,
 	/* Setup */
 	au0828_card_setup(dev);
 
+	/*
+	 * Store the pointer to the au0828_dev so it can be accessed in
+	 * au0828_usb_disconnect
+	 */
+	usb_set_intfdata(interface, dev);
+
 	/* Analog TV */
 	retval = au0828_analog_register(dev, interface);
 	if (retval) {
@@ -641,12 +647,6 @@ static int au0828_usb_probe(struct usb_interface *interface,
 	/* Remote controller */
 	au0828_rc_register(dev);
 
-	/*
-	 * Store the pointer to the au0828_dev so it can be accessed in
-	 * au0828_usb_disconnect
-	 */
-	usb_set_intfdata(interface, dev);
-
 	pr_info("Registered device AU0828 [%s]\n",
 		dev->board.name == NULL ? "Unset" : dev->board.name);
 
-- 
GitLab


From 693019ee7d98b4d6233e64af82d531c574d5c53b Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@gmail.com>
Date: Thu, 9 May 2019 09:15:00 -0300
Subject: [PATCH 1238/1835] ath10k: Change the warning message string

commit 265df32eae5845212ad9f55f5ae6b6dcb68b187b upstream.

The "WARNING" string confuses syzbot, which thinks it found
a crash [1].

Change the string to avoid such problem.

[1] https://lkml.org/lkml/2019/5/9/243

Reported-by: syzbot+c1b25598aa60dcd47e78@syzkaller.appspotmail.com
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index d4803ff5a78a7..f09a4ad2e9de7 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1025,7 +1025,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 	}
 
 	/* TODO: remove this once USB support is fully implemented */
-	ath10k_warn(ar, "WARNING: ath10k USB support is incomplete, don't expect anything to work!\n");
+	ath10k_warn(ar, "Warning: ath10k USB support is incomplete, don't expect anything to work!\n");
 
 	return 0;
 
-- 
GitLab


From 8b44cc225e6024174508164931cab9f01c79dca2 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 9 May 2019 04:57:09 -0400
Subject: [PATCH 1239/1835] media: cpia2_usb: first wake up, then free in
 disconnect

commit eff73de2b1600ad8230692f00bc0ab49b166512a upstream.

Kasan reported a use after free in cpia2_usb_disconnect()
It first freed everything and then woke up those waiting.
The reverse order is correct.

Fixes: 6c493f8b28c67 ("[media] cpia2: major overhaul to get it in a working state again")

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+0c90fc937c84f97d0aa6@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/cpia2/cpia2_usb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index a771e0a52610c..f5b04594e2094 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -902,7 +902,6 @@ static void cpia2_usb_disconnect(struct usb_interface *intf)
 	cpia2_unregister_camera(cam);
 	v4l2_device_disconnect(&cam->v4l2_dev);
 	mutex_unlock(&cam->v4l2_lock);
-	v4l2_device_put(&cam->v4l2_dev);
 
 	if(cam->buffers) {
 		DBG("Wakeup waiting processes\n");
@@ -911,6 +910,8 @@ static void cpia2_usb_disconnect(struct usb_interface *intf)
 		wake_up_interruptible(&cam->wq_stream);
 	}
 
+	v4l2_device_put(&cam->v4l2_dev);
+
 	LOG("CPiA2 camera disconnected.\n");
 }
 
-- 
GitLab


From 8edcabb2c2e9c3f8234718918c8808c79fd74aeb Mon Sep 17 00:00:00 2001
From: Andrey Konovalov <andreyknvl@google.com>
Date: Thu, 2 May 2019 12:09:26 -0400
Subject: [PATCH 1240/1835] media: pvrusb2: use a different format for warnings

commit 1753c7c4367aa1201e1e5d0a601897ab33444af1 upstream.

When the pvrusb2 driver detects that there's something wrong with the
device, it prints a warning message. Right now those message are
printed in two different formats:

1. ***WARNING*** message here
2. WARNING: message here

There's an issue with the second format. Syzkaller recognizes it as a
message produced by a WARN_ON(), which is used to indicate a bug in the
kernel. However pvrusb2 prints those warnings to indicate an issue with
the device, not the bug in the kernel.

This patch changes the pvrusb2 driver to consistently use the first
warning message format. This will unblock syzkaller testing of this
driver.

Reported-by: syzbot+af8f8d2ac0d39b0ed3a0@syzkaller.appspotmail.com
Reported-by: syzbot+170a86bf206dd2c6217e@syzkaller.appspotmail.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c      | 4 ++--
 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c | 6 +++---
 drivers/media/usb/pvrusb2/pvrusb2-std.c      | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index 673fdca8d2dac..fcb201a40920e 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -1680,7 +1680,7 @@ static int pvr2_decoder_enable(struct pvr2_hdw *hdw,int enablefl)
 	}
 	if (!hdw->flag_decoder_missed) {
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
-			   "WARNING: No decoder present");
+			   "***WARNING*** No decoder present");
 		hdw->flag_decoder_missed = !0;
 		trace_stbit("flag_decoder_missed",
 			    hdw->flag_decoder_missed);
@@ -2366,7 +2366,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
 	if (hdw_desc->flag_is_experimental) {
 		pvr2_trace(PVR2_TRACE_INFO, "**********");
 		pvr2_trace(PVR2_TRACE_INFO,
-			   "WARNING: Support for this device (%s) is experimental.",
+			   "***WARNING*** Support for this device (%s) is experimental.",
 							      hdw_desc->description);
 		pvr2_trace(PVR2_TRACE_INFO,
 			   "Important functionality might not be entirely working.");
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
index f3003ca05f4ba..922c062796635 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
@@ -343,11 +343,11 @@ static int i2c_hack_cx25840(struct pvr2_hdw *hdw,
 
 	if ((ret != 0) || (*rdata == 0x04) || (*rdata == 0x0a)) {
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
-			   "WARNING: Detected a wedged cx25840 chip; the device will not work.");
+			   "***WARNING*** Detected a wedged cx25840 chip; the device will not work.");
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
-			   "WARNING: Try power cycling the pvrusb2 device.");
+			   "***WARNING*** Try power cycling the pvrusb2 device.");
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
-			   "WARNING: Disabling further access to the device to prevent other foul-ups.");
+			   "***WARNING*** Disabling further access to the device to prevent other foul-ups.");
 		// This blocks all further communication with the part.
 		hdw->i2c_func[0x44] = NULL;
 		pvr2_hdw_render_useless(hdw);
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-std.c b/drivers/media/usb/pvrusb2/pvrusb2-std.c
index 6b651f8b54df0..37dc299a1ca26 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-std.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-std.c
@@ -353,7 +353,7 @@ struct v4l2_standard *pvr2_std_create_enum(unsigned int *countptr,
 		bcnt = pvr2_std_id_to_str(buf,sizeof(buf),fmsk);
 		pvr2_trace(
 			PVR2_TRACE_ERROR_LEGS,
-			"WARNING: Failed to classify the following standard(s): %.*s",
+			"***WARNING*** Failed to classify the following standard(s): %.*s",
 			bcnt,buf);
 	}
 
-- 
GitLab


From afb5340f9438f15312de8dd5ef6de1960a30f74d Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <bcodding@redhat.com>
Date: Tue, 11 Jun 2019 12:57:52 -0400
Subject: [PATCH 1241/1835] NFS: Cleanup if nfs_match_client is interrupted

commit 9f7761cf0409465075dadb875d5d4b8ef2f890c8 upstream.

Don't bail out before cleaning up a new allocation if the wait for
searching for a matching nfs client is interrupted.  Memory leaks.

Reported-by: syzbot+7fe11b49c1cc30e3fce2@syzkaller.appspotmail.com
Fixes: 950a578c6128 ("NFS: make nfs_match_client killable")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/client.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index c092661147b30..0a2b59c1ecb3d 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -416,10 +416,10 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)
 		clp = nfs_match_client(cl_init);
 		if (clp) {
 			spin_unlock(&nn->nfs_client_lock);
-			if (IS_ERR(clp))
-				return clp;
 			if (new)
 				new->rpc_ops->free_client(new);
+			if (IS_ERR(clp))
+				return clp;
 			return nfs_found_client(cl_init, clp);
 		}
 		if (new) {
-- 
GitLab


From b3836af8560e27cd0d27940ff9c5a08b90b8d256 Mon Sep 17 00:00:00 2001
From: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
Date: Fri, 21 Jun 2019 21:04:38 -0400
Subject: [PATCH 1242/1835] media: radio-raremono: change devm_k*alloc to
 k*alloc

commit c666355e60ddb4748ead3bdd983e3f7f2224aaf0 upstream.

Change devm_k*alloc to k*alloc to manually allocate memory

The manual allocation and freeing of memory is necessary because when
the USB radio is disconnected, the memory associated with devm_k*alloc
is freed. Meaning if we still have unresolved references to the radio
device, then we get use-after-free errors.

This patch fixes this by manually allocating memory, and freeing it in
the v4l2.release callback that gets called when the last radio device
exits.

Reported-and-tested-by: syzbot+a4387f5b6b799f6becbf@syzkaller.appspotmail.com

Signed-off-by: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil-cisco@xs4all.nl: cleaned up two small checkpatch.pl warnings]
[hverkuil-cisco@xs4all.nl: prefix subject with driver name]
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/radio/radio-raremono.c | 30 +++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/drivers/media/radio/radio-raremono.c b/drivers/media/radio/radio-raremono.c
index 9a5079d64c4ab..729600c4a056b 100644
--- a/drivers/media/radio/radio-raremono.c
+++ b/drivers/media/radio/radio-raremono.c
@@ -271,6 +271,14 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 	return 0;
 }
 
+static void raremono_device_release(struct v4l2_device *v4l2_dev)
+{
+	struct raremono_device *radio = to_raremono_dev(v4l2_dev);
+
+	kfree(radio->buffer);
+	kfree(radio);
+}
+
 /* File system interface */
 static const struct v4l2_file_operations usb_raremono_fops = {
 	.owner		= THIS_MODULE,
@@ -295,12 +303,14 @@ static int usb_raremono_probe(struct usb_interface *intf,
 	struct raremono_device *radio;
 	int retval = 0;
 
-	radio = devm_kzalloc(&intf->dev, sizeof(struct raremono_device), GFP_KERNEL);
-	if (radio)
-		radio->buffer = devm_kmalloc(&intf->dev, BUFFER_LENGTH, GFP_KERNEL);
-
-	if (!radio || !radio->buffer)
+	radio = kzalloc(sizeof(*radio), GFP_KERNEL);
+	if (!radio)
+		return -ENOMEM;
+	radio->buffer = kmalloc(BUFFER_LENGTH, GFP_KERNEL);
+	if (!radio->buffer) {
+		kfree(radio);
 		return -ENOMEM;
+	}
 
 	radio->usbdev = interface_to_usbdev(intf);
 	radio->intf = intf;
@@ -324,7 +334,8 @@ static int usb_raremono_probe(struct usb_interface *intf,
 	if (retval != 3 ||
 	    (get_unaligned_be16(&radio->buffer[1]) & 0xfff) == 0x0242) {
 		dev_info(&intf->dev, "this is not Thanko's Raremono.\n");
-		return -ENODEV;
+		retval = -ENODEV;
+		goto free_mem;
 	}
 
 	dev_info(&intf->dev, "Thanko's Raremono connected: (%04X:%04X)\n",
@@ -333,7 +344,7 @@ static int usb_raremono_probe(struct usb_interface *intf,
 	retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);
 	if (retval < 0) {
 		dev_err(&intf->dev, "couldn't register v4l2_device\n");
-		return retval;
+		goto free_mem;
 	}
 
 	mutex_init(&radio->lock);
@@ -345,6 +356,7 @@ static int usb_raremono_probe(struct usb_interface *intf,
 	radio->vdev.ioctl_ops = &usb_raremono_ioctl_ops;
 	radio->vdev.lock = &radio->lock;
 	radio->vdev.release = video_device_release_empty;
+	radio->v4l2_dev.release = raremono_device_release;
 
 	usb_set_intfdata(intf, &radio->v4l2_dev);
 
@@ -360,6 +372,10 @@ static int usb_raremono_probe(struct usb_interface *intf,
 	}
 	dev_err(&intf->dev, "could not register video device\n");
 	v4l2_device_unregister(&radio->v4l2_dev);
+
+free_mem:
+	kfree(radio->buffer);
+	kfree(radio);
 	return retval;
 }
 
-- 
GitLab


From 4fd0eb60bad18067b6ebc2764913697b9a373bf3 Mon Sep 17 00:00:00 2001
From: Dmitry Safonov <dima@arista.com>
Date: Tue, 16 Jul 2019 22:38:05 +0100
Subject: [PATCH 1243/1835] iommu/vt-d: Don't queue_iova() if there is no flush
 queue

commit effa467870c7612012885df4e246bdb8ffd8e44c upstream.

Intel VT-d driver was reworked to use common deferred flushing
implementation. Previously there was one global per-cpu flush queue,
afterwards - one per domain.

Before deferring a flush, the queue should be allocated and initialized.

Currently only domains with IOMMU_DOMAIN_DMA type initialize their flush
queue. It's probably worth to init it for static or unmanaged domains
too, but it may be arguable - I'm leaving it to iommu folks.

Prevent queuing an iova flush if the domain doesn't have a queue.
The defensive check seems to be worth to keep even if queue would be
initialized for all kinds of domains. And is easy backportable.

On 4.19.43 stable kernel it has a user-visible effect: previously for
devices in si domain there were crashes, on sata devices:

 BUG: spinlock bad magic on CPU#6, swapper/0/1
  lock: 0xffff88844f582008, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
 CPU: 6 PID: 1 Comm: swapper/0 Not tainted 4.19.43 #1
 Call Trace:
  <IRQ>
  dump_stack+0x61/0x7e
  spin_bug+0x9d/0xa3
  do_raw_spin_lock+0x22/0x8e
  _raw_spin_lock_irqsave+0x32/0x3a
  queue_iova+0x45/0x115
  intel_unmap+0x107/0x113
  intel_unmap_sg+0x6b/0x76
  __ata_qc_complete+0x7f/0x103
  ata_qc_complete+0x9b/0x26a
  ata_qc_complete_multiple+0xd0/0xe3
  ahci_handle_port_interrupt+0x3ee/0x48a
  ahci_handle_port_intr+0x73/0xa9
  ahci_single_level_irq_intr+0x40/0x60
  __handle_irq_event_percpu+0x7f/0x19a
  handle_irq_event_percpu+0x32/0x72
  handle_irq_event+0x38/0x56
  handle_edge_irq+0x102/0x121
  handle_irq+0x147/0x15c
  do_IRQ+0x66/0xf2
  common_interrupt+0xf/0xf
 RIP: 0010:__do_softirq+0x8c/0x2df

The same for usb devices that use ehci-pci:
 BUG: spinlock bad magic on CPU#0, swapper/0/1
  lock: 0xffff88844f402008, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.43 #4
 Call Trace:
  <IRQ>
  dump_stack+0x61/0x7e
  spin_bug+0x9d/0xa3
  do_raw_spin_lock+0x22/0x8e
  _raw_spin_lock_irqsave+0x32/0x3a
  queue_iova+0x77/0x145
  intel_unmap+0x107/0x113
  intel_unmap_page+0xe/0x10
  usb_hcd_unmap_urb_setup_for_dma+0x53/0x9d
  usb_hcd_unmap_urb_for_dma+0x17/0x100
  unmap_urb_for_dma+0x22/0x24
  __usb_hcd_giveback_urb+0x51/0xc3
  usb_giveback_urb_bh+0x97/0xde
  tasklet_action_common.isra.4+0x5f/0xa1
  tasklet_action+0x2d/0x30
  __do_softirq+0x138/0x2df
  irq_exit+0x7d/0x8b
  smp_apic_timer_interrupt+0x10f/0x151
  apic_timer_interrupt+0xf/0x20
  </IRQ>
 RIP: 0010:_raw_spin_unlock_irqrestore+0x17/0x39

Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Cc: iommu@lists.linux-foundation.org
Cc: <stable@vger.kernel.org> # 4.14+
Fixes: 13cf01744608 ("iommu/vt-d: Make use of iova deferred flushing")
Signed-off-by: Dmitry Safonov <dima@arista.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
[v4.14-port notes:
o minor conflict with untrusted IOMMU devices check under if-condition]
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/intel-iommu.c |  2 +-
 drivers/iommu/iova.c        | 18 ++++++++++++++----
 include/linux/iova.h        |  6 ++++++
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index c1439019dd127..b9af2419006f8 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3721,7 +3721,7 @@ static void intel_unmap(struct device *dev, dma_addr_t dev_addr, size_t size)
 
 	freelist = domain_unmap(domain, start_pfn, last_pfn);
 
-	if (intel_iommu_strict) {
+	if (intel_iommu_strict || !has_iova_flush_queue(&domain->iovad)) {
 		iommu_flush_iotlb_psi(iommu, domain, start_pfn,
 				      nrpages, !freelist, 0);
 		/* free iova */
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index 83fe2621effe7..60348d707b993 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -65,9 +65,14 @@ init_iova_domain(struct iova_domain *iovad, unsigned long granule,
 }
 EXPORT_SYMBOL_GPL(init_iova_domain);
 
+bool has_iova_flush_queue(struct iova_domain *iovad)
+{
+	return !!iovad->fq;
+}
+
 static void free_iova_flush_queue(struct iova_domain *iovad)
 {
-	if (!iovad->fq)
+	if (!has_iova_flush_queue(iovad))
 		return;
 
 	if (timer_pending(&iovad->fq_timer))
@@ -85,13 +90,14 @@ static void free_iova_flush_queue(struct iova_domain *iovad)
 int init_iova_flush_queue(struct iova_domain *iovad,
 			  iova_flush_cb flush_cb, iova_entry_dtor entry_dtor)
 {
+	struct iova_fq __percpu *queue;
 	int cpu;
 
 	atomic64_set(&iovad->fq_flush_start_cnt,  0);
 	atomic64_set(&iovad->fq_flush_finish_cnt, 0);
 
-	iovad->fq = alloc_percpu(struct iova_fq);
-	if (!iovad->fq)
+	queue = alloc_percpu(struct iova_fq);
+	if (!queue)
 		return -ENOMEM;
 
 	iovad->flush_cb   = flush_cb;
@@ -100,13 +106,17 @@ int init_iova_flush_queue(struct iova_domain *iovad,
 	for_each_possible_cpu(cpu) {
 		struct iova_fq *fq;
 
-		fq = per_cpu_ptr(iovad->fq, cpu);
+		fq = per_cpu_ptr(queue, cpu);
 		fq->head = 0;
 		fq->tail = 0;
 
 		spin_lock_init(&fq->lock);
 	}
 
+	smp_wmb();
+
+	iovad->fq = queue;
+
 	timer_setup(&iovad->fq_timer, fq_flush_timeout, 0);
 	atomic_set(&iovad->fq_timer_on, 0);
 
diff --git a/include/linux/iova.h b/include/linux/iova.h
index 928442dda565f..073dc27d2e5f7 100644
--- a/include/linux/iova.h
+++ b/include/linux/iova.h
@@ -156,6 +156,7 @@ struct iova *reserve_iova(struct iova_domain *iovad, unsigned long pfn_lo,
 void copy_reserved_iova(struct iova_domain *from, struct iova_domain *to);
 void init_iova_domain(struct iova_domain *iovad, unsigned long granule,
 	unsigned long start_pfn);
+bool has_iova_flush_queue(struct iova_domain *iovad);
 int init_iova_flush_queue(struct iova_domain *iovad,
 			  iova_flush_cb flush_cb, iova_entry_dtor entry_dtor);
 struct iova *find_iova(struct iova_domain *iovad, unsigned long pfn);
@@ -236,6 +237,11 @@ static inline void init_iova_domain(struct iova_domain *iovad,
 {
 }
 
+bool has_iova_flush_queue(struct iova_domain *iovad)
+{
+	return false;
+}
+
 static inline int init_iova_flush_queue(struct iova_domain *iovad,
 					iova_flush_cb flush_cb,
 					iova_entry_dtor entry_dtor)
-- 
GitLab


From 3a0c22cbc5d0b570a2cc9a7cffa1ac715fe564b7 Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Tue, 23 Jul 2019 09:51:00 +0200
Subject: [PATCH 1244/1835] iommu/iova: Fix compilation error with
 !CONFIG_IOMMU_IOVA

commit 201c1db90cd643282185a00770f12f95da330eca upstream.

The stub function for !CONFIG_IOMMU_IOVA needs to be
'static inline'.

Fixes: effa467870c76 ('iommu/vt-d: Don't queue_iova() if there is no flush queue')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/iova.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/iova.h b/include/linux/iova.h
index 073dc27d2e5f7..84fbe73d2ec08 100644
--- a/include/linux/iova.h
+++ b/include/linux/iova.h
@@ -237,7 +237,7 @@ static inline void init_iova_domain(struct iova_domain *iovad,
 {
 }
 
-bool has_iova_flush_queue(struct iova_domain *iovad)
+static inline bool has_iova_flush_queue(struct iova_domain *iovad)
 {
 	return false;
 }
-- 
GitLab


From 56966212e23f82ced10831f7cca02f7339147428 Mon Sep 17 00:00:00 2001
From: Vladis Dronov <vdronov@redhat.com>
Date: Tue, 30 Jul 2019 11:33:45 +0200
Subject: [PATCH 1245/1835] Bluetooth: hci_uart: check for missing tty
 operations

commit b36a1552d7319bbfd5cf7f08726c23c5c66d4f73 upstream.

Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
functions which are called by the certain HCI UART protocols (hci_ath,
hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
or directly. This leads to an execution at NULL and can be triggered by
an unprivileged user. Fix this by adding a helper function and a check
for the missing tty operations in the protocols code.

This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
protocols.

Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org # v2.6.36+
Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip")
Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support")
Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Reviewed-by: Yu-Chen, Cho <acho@suse.com>
Tested-by: Yu-Chen, Cho <acho@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/hci_ath.c   |  3 +++
 drivers/bluetooth/hci_bcm.c   |  3 +++
 drivers/bluetooth/hci_intel.c |  3 +++
 drivers/bluetooth/hci_ldisc.c | 13 +++++++++++++
 drivers/bluetooth/hci_mrvl.c  |  3 +++
 drivers/bluetooth/hci_qca.c   |  3 +++
 drivers/bluetooth/hci_uart.h  |  1 +
 7 files changed, 29 insertions(+)

diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
index d568fbd94d6c8..20235925344dd 100644
--- a/drivers/bluetooth/hci_ath.c
+++ b/drivers/bluetooth/hci_ath.c
@@ -112,6 +112,9 @@ static int ath_open(struct hci_uart *hu)
 
 	BT_DBG("hu %p", hu);
 
+	if (!hci_uart_has_flow_control(hu))
+		return -EOPNOTSUPP;
+
 	ath = kzalloc(sizeof(*ath), GFP_KERNEL);
 	if (!ath)
 		return -ENOMEM;
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 8001323691349..aa6b7ed9fdf12 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -369,6 +369,9 @@ static int bcm_open(struct hci_uart *hu)
 
 	bt_dev_dbg(hu->hdev, "hu %p", hu);
 
+	if (!hci_uart_has_flow_control(hu))
+		return -EOPNOTSUPP;
+
 	bcm = kzalloc(sizeof(*bcm), GFP_KERNEL);
 	if (!bcm)
 		return -ENOMEM;
diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index 46ace321bf60e..e9228520e4c7a 100644
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -406,6 +406,9 @@ static int intel_open(struct hci_uart *hu)
 
 	BT_DBG("hu %p", hu);
 
+	if (!hci_uart_has_flow_control(hu))
+		return -EOPNOTSUPP;
+
 	intel = kzalloc(sizeof(*intel), GFP_KERNEL);
 	if (!intel)
 		return -ENOMEM;
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index c915daf01a89d..efeb8137ec67f 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -299,6 +299,19 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 	return 0;
 }
 
+/* Check the underlying device or tty has flow control support */
+bool hci_uart_has_flow_control(struct hci_uart *hu)
+{
+	/* serdev nodes check if the needed operations are present */
+	if (hu->serdev)
+		return true;
+
+	if (hu->tty->driver->ops->tiocmget && hu->tty->driver->ops->tiocmset)
+		return true;
+
+	return false;
+}
+
 /* Flow control or un-flow control the device */
 void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
 {
diff --git a/drivers/bluetooth/hci_mrvl.c b/drivers/bluetooth/hci_mrvl.c
index ffb00669346f0..23791df081bab 100644
--- a/drivers/bluetooth/hci_mrvl.c
+++ b/drivers/bluetooth/hci_mrvl.c
@@ -66,6 +66,9 @@ static int mrvl_open(struct hci_uart *hu)
 
 	BT_DBG("hu %p", hu);
 
+	if (!hci_uart_has_flow_control(hu))
+		return -EOPNOTSUPP;
+
 	mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL);
 	if (!mrvl)
 		return -ENOMEM;
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 77004c29da089..f96e58de049b3 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -450,6 +450,9 @@ static int qca_open(struct hci_uart *hu)
 
 	BT_DBG("hu %p qca_open", hu);
 
+	if (!hci_uart_has_flow_control(hu))
+		return -EOPNOTSUPP;
+
 	qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
 	if (!qca)
 		return -ENOMEM;
diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
index 00cab2fd7a1b8..067a610f1372a 100644
--- a/drivers/bluetooth/hci_uart.h
+++ b/drivers/bluetooth/hci_uart.h
@@ -118,6 +118,7 @@ int hci_uart_tx_wakeup(struct hci_uart *hu);
 int hci_uart_init_ready(struct hci_uart *hu);
 void hci_uart_init_work(struct work_struct *work);
 void hci_uart_set_baudrate(struct hci_uart *hu, unsigned int speed);
+bool hci_uart_has_flow_control(struct hci_uart *hu);
 void hci_uart_set_flow_control(struct hci_uart *hu, bool enable);
 void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed,
 			 unsigned int oper_speed);
-- 
GitLab


From ad5fc8953d61b99f445db447ac1eadc99a00d47e Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Fri, 17 May 2019 00:29:49 -0400
Subject: [PATCH 1246/1835] vhost: introduce vhost_exceeds_weight()

commit e82b9b0727ff6d665fff2d326162b460dded554d upstream.

We used to have vhost_exceeds_weight() for vhost-net to:

- prevent vhost kthread from hogging the cpu
- balance the time spent between TX and RX

This function could be useful for vsock and scsi as well. So move it
to vhost.c. Device must specify a weight which counts the number of
requests, or it can also specific a byte_weight which counts the
number of bytes that has been processed.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
[jwang: backport to 4.19, fix conflict in net.c]
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/net.c   | 22 ++++++----------------
 drivers/vhost/scsi.c  |  9 ++++++++-
 drivers/vhost/vhost.c | 20 +++++++++++++++++++-
 drivers/vhost/vhost.h |  5 ++++-
 drivers/vhost/vsock.c | 12 +++++++++++-
 5 files changed, 48 insertions(+), 20 deletions(-)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ae704658b528f..ee039444d3c5f 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -497,12 +497,6 @@ static size_t init_iov_iter(struct vhost_virtqueue *vq, struct iov_iter *iter,
 	return iov_iter_count(iter);
 }
 
-static bool vhost_exceeds_weight(int pkts, int total_len)
-{
-	return total_len >= VHOST_NET_WEIGHT ||
-	       pkts >= VHOST_NET_PKT_WEIGHT;
-}
-
 static int get_tx_bufs(struct vhost_net *net,
 		       struct vhost_net_virtqueue *nvq,
 		       struct msghdr *msg,
@@ -598,10 +592,8 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
 				 err, len);
 		if (++nvq->done_idx >= VHOST_NET_BATCH)
 			vhost_net_signal_used(nvq);
-		if (vhost_exceeds_weight(++sent_pkts, total_len)) {
-			vhost_poll_queue(&vq->poll);
+		if (vhost_exceeds_weight(vq, ++sent_pkts, total_len))
 			break;
-		}
 	}
 
 	vhost_net_signal_used(nvq);
@@ -701,10 +693,9 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
 		else
 			vhost_zerocopy_signal_used(net, vq);
 		vhost_net_tx_packet(net);
-		if (unlikely(vhost_exceeds_weight(++sent_pkts, total_len))) {
-			vhost_poll_queue(&vq->poll);
+		if (unlikely(vhost_exceeds_weight(vq, ++sent_pkts,
+						  total_len)))
 			break;
-		}
 	}
 }
 
@@ -1027,10 +1018,8 @@ static void handle_rx(struct vhost_net *net)
 			vhost_log_write(vq, vq_log, log, vhost_len,
 					vq->iov, in);
 		total_len += vhost_len;
-		if (unlikely(vhost_exceeds_weight(++recv_pkts, total_len))) {
-			vhost_poll_queue(&vq->poll);
+		if (unlikely(vhost_exceeds_weight(vq, ++recv_pkts, total_len)))
 			goto out;
-		}
 	}
 	if (unlikely(busyloop_intr))
 		vhost_poll_queue(&vq->poll);
@@ -1115,7 +1104,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
 		vhost_net_buf_init(&n->vqs[i].rxq);
 	}
 	vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
-		       UIO_MAXIOV + VHOST_NET_BATCH);
+		       UIO_MAXIOV + VHOST_NET_BATCH,
+		       VHOST_NET_WEIGHT, VHOST_NET_PKT_WEIGHT);
 
 	vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
 	vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 0cfa925be4ec6..087ce17b0c397 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -57,6 +57,12 @@
 #define VHOST_SCSI_PREALLOC_UPAGES 2048
 #define VHOST_SCSI_PREALLOC_PROT_SGLS 2048
 
+/* Max number of requests before requeueing the job.
+ * Using this limit prevents one virtqueue from starving others with
+ * request.
+ */
+#define VHOST_SCSI_WEIGHT 256
+
 struct vhost_scsi_inflight {
 	/* Wait for the flush operation to finish */
 	struct completion comp;
@@ -1398,7 +1404,8 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
 		vqs[i] = &vs->vqs[i].vq;
 		vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
 	}
-	vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
+	vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV,
+		       VHOST_SCSI_WEIGHT, 0);
 
 	vhost_scsi_init_inflight(vs, NULL);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c163bc15976ab..0752f8dc47b12 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -413,8 +413,24 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
 		vhost_vq_free_iovecs(dev->vqs[i]);
 }
 
+bool vhost_exceeds_weight(struct vhost_virtqueue *vq,
+			  int pkts, int total_len)
+{
+	struct vhost_dev *dev = vq->dev;
+
+	if ((dev->byte_weight && total_len >= dev->byte_weight) ||
+	    pkts >= dev->weight) {
+		vhost_poll_queue(&vq->poll);
+		return true;
+	}
+
+	return false;
+}
+EXPORT_SYMBOL_GPL(vhost_exceeds_weight);
+
 void vhost_dev_init(struct vhost_dev *dev,
-		    struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
+		    struct vhost_virtqueue **vqs, int nvqs,
+		    int iov_limit, int weight, int byte_weight)
 {
 	struct vhost_virtqueue *vq;
 	int i;
@@ -428,6 +444,8 @@ void vhost_dev_init(struct vhost_dev *dev,
 	dev->mm = NULL;
 	dev->worker = NULL;
 	dev->iov_limit = iov_limit;
+	dev->weight = weight;
+	dev->byte_weight = byte_weight;
 	init_llist_head(&dev->work_list);
 	init_waitqueue_head(&dev->wait);
 	INIT_LIST_HEAD(&dev->read_list);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 9490e7ddb3404..27a78a9b8cc7d 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -171,10 +171,13 @@ struct vhost_dev {
 	struct list_head pending_list;
 	wait_queue_head_t wait;
 	int iov_limit;
+	int weight;
+	int byte_weight;
 };
 
+bool vhost_exceeds_weight(struct vhost_virtqueue *vq, int pkts, int total_len);
 void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
-		    int nvqs, int iov_limit);
+		    int nvqs, int iov_limit, int weight, int byte_weight);
 long vhost_dev_set_owner(struct vhost_dev *dev);
 bool vhost_dev_has_owner(struct vhost_dev *dev);
 long vhost_dev_check_owner(struct vhost_dev *);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index e440f87ae1d60..58c5c82bc0beb 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -21,6 +21,14 @@
 #include "vhost.h"
 
 #define VHOST_VSOCK_DEFAULT_HOST_CID	2
+/* Max number of bytes transferred before requeueing the job.
+ * Using this limit prevents one virtqueue from starving others. */
+#define VHOST_VSOCK_WEIGHT 0x80000
+/* Max number of packets transferred before requeueing the job.
+ * Using this limit prevents one virtqueue from starving others with
+ * small pkts.
+ */
+#define VHOST_VSOCK_PKT_WEIGHT 256
 
 enum {
 	VHOST_VSOCK_FEATURES = VHOST_FEATURES,
@@ -531,7 +539,9 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
 	vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
 	vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
 
-	vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
+	vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs),
+		       UIO_MAXIOV, VHOST_VSOCK_PKT_WEIGHT,
+		       VHOST_VSOCK_WEIGHT);
 
 	file->private_data = vsock;
 	spin_lock_init(&vsock->send_pkt_list_lock);
-- 
GitLab


From 3af3b843aee41ed22343b011a4cf3812a80d2f38 Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Fri, 17 May 2019 00:29:50 -0400
Subject: [PATCH 1247/1835] vhost_net: fix possible infinite loop

commit e2412c07f8f3040593dfb88207865a3cd58680c0 upstream.

When the rx buffer is too small for a packet, we will discard the vq
descriptor and retry it for the next packet:

while ((sock_len = vhost_net_rx_peek_head_len(net, sock->sk,
					      &busyloop_intr))) {
...
	/* On overrun, truncate and discard */
	if (unlikely(headcount > UIO_MAXIOV)) {
		iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
		err = sock->ops->recvmsg(sock, &msg,
					 1, MSG_DONTWAIT | MSG_TRUNC);
		pr_debug("Discarded rx packet: len %zd\n", sock_len);
		continue;
	}
...
}

This makes it possible to trigger a infinite while..continue loop
through the co-opreation of two VMs like:

1) Malicious VM1 allocate 1 byte rx buffer and try to slow down the
   vhost process as much as possible e.g using indirect descriptors or
   other.
2) Malicious VM2 generate packets to VM1 as fast as possible

Fixing this by checking against weight at the end of RX and TX
loop. This also eliminate other similar cases when:

- userspace is consuming the packets in the meanwhile
- theoretical TOCTOU attack if guest moving avail index back and forth
  to hit the continue after vhost find guest just add new buffers

This addresses CVE-2019-3900.

Fixes: d8316f3991d20 ("vhost: fix total length when packets are too short")
Fixes: 3a4d5c94e9593 ("vhost_net: a kernel-level virtio server")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
[jwang: backport to 4.19]
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/net.c | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ee039444d3c5f..124356dc39e14 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -551,7 +551,7 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
 	int err;
 	int sent_pkts = 0;
 
-	for (;;) {
+	do {
 		bool busyloop_intr = false;
 
 		head = get_tx_bufs(net, nvq, &msg, &out, &in, &len,
@@ -592,9 +592,7 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
 				 err, len);
 		if (++nvq->done_idx >= VHOST_NET_BATCH)
 			vhost_net_signal_used(nvq);
-		if (vhost_exceeds_weight(vq, ++sent_pkts, total_len))
-			break;
-	}
+	} while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
 
 	vhost_net_signal_used(nvq);
 }
@@ -618,7 +616,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
 	bool zcopy_used;
 	int sent_pkts = 0;
 
-	for (;;) {
+	do {
 		bool busyloop_intr;
 
 		/* Release DMAs done buffers first */
@@ -693,10 +691,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
 		else
 			vhost_zerocopy_signal_used(net, vq);
 		vhost_net_tx_packet(net);
-		if (unlikely(vhost_exceeds_weight(vq, ++sent_pkts,
-						  total_len)))
-			break;
-	}
+	} while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
 }
 
 /* Expects to be always run from workqueue - which acts as
@@ -932,8 +927,11 @@ static void handle_rx(struct vhost_net *net)
 		vq->log : NULL;
 	mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF);
 
-	while ((sock_len = vhost_net_rx_peek_head_len(net, sock->sk,
-						      &busyloop_intr))) {
+	do {
+		sock_len = vhost_net_rx_peek_head_len(net, sock->sk,
+						      &busyloop_intr);
+		if (!sock_len)
+			break;
 		sock_len += sock_hlen;
 		vhost_len = sock_len + vhost_hlen;
 		headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx,
@@ -1018,12 +1016,11 @@ static void handle_rx(struct vhost_net *net)
 			vhost_log_write(vq, vq_log, log, vhost_len,
 					vq->iov, in);
 		total_len += vhost_len;
-		if (unlikely(vhost_exceeds_weight(vq, ++recv_pkts, total_len)))
-			goto out;
-	}
+	} while (likely(!vhost_exceeds_weight(vq, ++recv_pkts, total_len)));
+
 	if (unlikely(busyloop_intr))
 		vhost_poll_queue(&vq->poll);
-	else
+	else if (!sock_len)
 		vhost_net_enable_vq(net, vq);
 out:
 	vhost_net_signal_used(nvq);
@@ -1105,7 +1102,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
 	}
 	vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
 		       UIO_MAXIOV + VHOST_NET_BATCH,
-		       VHOST_NET_WEIGHT, VHOST_NET_PKT_WEIGHT);
+		       VHOST_NET_PKT_WEIGHT, VHOST_NET_WEIGHT);
 
 	vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
 	vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
-- 
GitLab


From 239910101c4ebf91a00e6f4a81ac3144b121f0c4 Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Fri, 17 May 2019 00:29:51 -0400
Subject: [PATCH 1248/1835] vhost: vsock: add weight support

commit e79b431fb901ba1106670bcc80b9b617b25def7d upstream.

This patch will check the weight and exit the loop if we exceeds the
weight. This is useful for preventing vsock kthread from hogging cpu
which is guest triggerable. The weight can help to avoid starving the
request from on direction while another direction is being processed.

The value of weight is picked from vhost-net.

This addresses CVE-2019-3900.

Cc: Stefan Hajnoczi <stefanha@redhat.com>
Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/vsock.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 58c5c82bc0beb..bab495d73195f 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -86,6 +86,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
 			    struct vhost_virtqueue *vq)
 {
 	struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
+	int pkts = 0, total_len = 0;
 	bool added = false;
 	bool restart_tx = false;
 
@@ -97,7 +98,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
 	/* Avoid further vmexits, we're already processing the virtqueue */
 	vhost_disable_notify(&vsock->dev, vq);
 
-	for (;;) {
+	do {
 		struct virtio_vsock_pkt *pkt;
 		struct iov_iter iov_iter;
 		unsigned out, in;
@@ -182,8 +183,9 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
 		 */
 		virtio_transport_deliver_tap_pkt(pkt);
 
+		total_len += pkt->len;
 		virtio_transport_free_pkt(pkt);
-	}
+	} while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
 	if (added)
 		vhost_signal(&vsock->dev, vq);
 
@@ -358,7 +360,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 	struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock,
 						 dev);
 	struct virtio_vsock_pkt *pkt;
-	int head;
+	int head, pkts = 0, total_len = 0;
 	unsigned int out, in;
 	bool added = false;
 
@@ -368,7 +370,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 		goto out;
 
 	vhost_disable_notify(&vsock->dev, vq);
-	for (;;) {
+	do {
 		u32 len;
 
 		if (!vhost_vsock_more_replies(vsock)) {
@@ -409,9 +411,11 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 		else
 			virtio_transport_free_pkt(pkt);
 
-		vhost_add_used(vq, head, sizeof(pkt->hdr) + len);
+		len += sizeof(pkt->hdr);
+		vhost_add_used(vq, head, len);
+		total_len += len;
 		added = true;
-	}
+	} while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
 
 no_more_replies:
 	if (added)
-- 
GitLab


From 02cdc166128cf9cb2be4786b997eebbc0b976bfa Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Fri, 17 May 2019 00:29:52 -0400
Subject: [PATCH 1249/1835] vhost: scsi: add weight support

commit c1ea02f15ab5efb3e93fc3144d895410bf79fcf2 upstream.

This patch will check the weight and exit the loop if we exceeds the
weight. This is useful for preventing scsi kthread from hogging cpu
which is guest triggerable.

This addresses CVE-2019-3900.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric driver")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[jwang: backport to 4.19]
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/scsi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 087ce17b0c397..5e298d9287f1c 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -817,7 +817,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
 	u64 tag;
 	u32 exp_data_len, data_direction;
 	unsigned int out = 0, in = 0;
-	int head, ret, prot_bytes;
+	int head, ret, prot_bytes, c = 0;
 	size_t req_size, rsp_size = sizeof(struct virtio_scsi_cmd_resp);
 	size_t out_size, in_size;
 	u16 lun;
@@ -836,7 +836,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
 
 	vhost_disable_notify(&vs->dev, vq);
 
-	for (;;) {
+	do {
 		head = vhost_get_vq_desc(vq, vq->iov,
 					 ARRAY_SIZE(vq->iov), &out, &in,
 					 NULL, NULL);
@@ -1051,7 +1051,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
 		 */
 		INIT_WORK(&cmd->work, vhost_scsi_submission_work);
 		queue_work(vhost_scsi_workqueue, &cmd->work);
-	}
+	} while (likely(!vhost_exceeds_weight(vq, ++c, 0)));
 out:
 	mutex_unlock(&vq->mutex);
 }
-- 
GitLab


From 48046e092ad557a01d7daf53205624944793b19d Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Tue, 16 Jul 2019 17:20:45 +0200
Subject: [PATCH 1250/1835] sched/fair: Don't free p->numa_faults with
 concurrent readers

commit 16d51a590a8ce3befb1308e0e7ab77f3b661af33 upstream.

When going through execve(), zero out the NUMA fault statistics instead of
freeing them.

During execve, the task is reachable through procfs and the scheduler. A
concurrent /proc/*/sched reader can read data from a freed ->numa_faults
allocation (confirmed by KASAN) and write it back to userspace.
I believe that it would also be possible for a use-after-free read to occur
through a race between a NUMA fault and execve(): task_numa_fault() can
lead to task_numa_compare(), which invokes task_weight() on the currently
running task of a different CPU.

Another way to fix this would be to make ->numa_faults RCU-managed or add
extra locking, but it seems easier to wipe the NUMA fault statistics on
execve.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Fixes: 82727018b0d3 ("sched/numa: Call task_numa_free() from do_execve()")
Link: https://lkml.kernel.org/r/20190716152047.14424-1-jannh@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/exec.c                            |  2 +-
 include/linux/sched/numa_balancing.h |  4 ++--
 kernel/fork.c                        |  2 +-
 kernel/sched/fair.c                  | 24 ++++++++++++++++++++----
 4 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 433b1257694ab..561ea64829ece 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1826,7 +1826,7 @@ static int __do_execve_file(int fd, struct filename *filename,
 	membarrier_execve(current);
 	rseq_execve(current);
 	acct_update_integrals(current);
-	task_numa_free(current);
+	task_numa_free(current, false);
 	free_bprm(bprm);
 	kfree(pathbuf);
 	if (filename)
diff --git a/include/linux/sched/numa_balancing.h b/include/linux/sched/numa_balancing.h
index e7dd04a84ba89..3988762efe15c 100644
--- a/include/linux/sched/numa_balancing.h
+++ b/include/linux/sched/numa_balancing.h
@@ -19,7 +19,7 @@
 extern void task_numa_fault(int last_node, int node, int pages, int flags);
 extern pid_t task_numa_group_id(struct task_struct *p);
 extern void set_numabalancing_state(bool enabled);
-extern void task_numa_free(struct task_struct *p);
+extern void task_numa_free(struct task_struct *p, bool final);
 extern bool should_numa_migrate_memory(struct task_struct *p, struct page *page,
 					int src_nid, int dst_cpu);
 #else
@@ -34,7 +34,7 @@ static inline pid_t task_numa_group_id(struct task_struct *p)
 static inline void set_numabalancing_state(bool enabled)
 {
 }
-static inline void task_numa_free(struct task_struct *p)
+static inline void task_numa_free(struct task_struct *p, bool final)
 {
 }
 static inline bool should_numa_migrate_memory(struct task_struct *p,
diff --git a/kernel/fork.c b/kernel/fork.c
index 69874db3fba83..e76ce81c9c757 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -679,7 +679,7 @@ void __put_task_struct(struct task_struct *tsk)
 	WARN_ON(tsk == current);
 
 	cgroup_free(tsk);
-	task_numa_free(tsk);
+	task_numa_free(tsk, true);
 	security_task_free(tsk);
 	exit_creds(tsk);
 	delayacct_tsk_free(tsk);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 4a433608ba74a..34b998678b97d 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2345,13 +2345,23 @@ no_join:
 	return;
 }
 
-void task_numa_free(struct task_struct *p)
+/*
+ * Get rid of NUMA staticstics associated with a task (either current or dead).
+ * If @final is set, the task is dead and has reached refcount zero, so we can
+ * safely free all relevant data structures. Otherwise, there might be
+ * concurrent reads from places like load balancing and procfs, and we should
+ * reset the data back to default state without freeing ->numa_faults.
+ */
+void task_numa_free(struct task_struct *p, bool final)
 {
 	struct numa_group *grp = p->numa_group;
-	void *numa_faults = p->numa_faults;
+	unsigned long *numa_faults = p->numa_faults;
 	unsigned long flags;
 	int i;
 
+	if (!numa_faults)
+		return;
+
 	if (grp) {
 		spin_lock_irqsave(&grp->lock, flags);
 		for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
@@ -2364,8 +2374,14 @@ void task_numa_free(struct task_struct *p)
 		put_numa_group(grp);
 	}
 
-	p->numa_faults = NULL;
-	kfree(numa_faults);
+	if (final) {
+		p->numa_faults = NULL;
+		kfree(numa_faults);
+	} else {
+		p->total_numa_faults = 0;
+		for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
+			numa_faults[i] = 0;
+	}
 }
 
 /*
-- 
GitLab


From a5a3915f17ab7746a4c7499e086fb7318bda9461 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Tue, 16 Jul 2019 17:20:47 +0200
Subject: [PATCH 1251/1835] sched/fair: Use RCU accessors consistently for
 ->numa_group

commit cb361d8cdef69990f6b4504dc1fd9a594d983c97 upstream.

The old code used RCU annotations and accessors inconsistently for
->numa_group, which can lead to use-after-frees and NULL dereferences.

Let all accesses to ->numa_group use proper RCU helpers to prevent such
issues.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Fixes: 8c8a743c5087 ("sched/numa: Use {cpu, pid} to create task groups for shared faults")
Link: https://lkml.kernel.org/r/20190716152047.14424-3-jannh@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/sched.h |  10 +++-
 kernel/sched/fair.c   | 120 ++++++++++++++++++++++++++++--------------
 2 files changed, 90 insertions(+), 40 deletions(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 5dc024e283979..20f5ba262cc0d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1023,7 +1023,15 @@ struct task_struct {
 	u64				last_sum_exec_runtime;
 	struct callback_head		numa_work;
 
-	struct numa_group		*numa_group;
+	/*
+	 * This pointer is only modified for current in syscall and
+	 * pagefault context (and for tasks being destroyed), so it can be read
+	 * from any of the following contexts:
+	 *  - RCU read-side critical section
+	 *  - current->numa_group from everywhere
+	 *  - task's runqueue locked, task not running
+	 */
+	struct numa_group __rcu		*numa_group;
 
 	/*
 	 * numa_faults is an array split into four regions:
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 34b998678b97d..75f322603d442 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1053,6 +1053,21 @@ struct numa_group {
 	unsigned long faults[0];
 };
 
+/*
+ * For functions that can be called in multiple contexts that permit reading
+ * ->numa_group (see struct task_struct for locking rules).
+ */
+static struct numa_group *deref_task_numa_group(struct task_struct *p)
+{
+	return rcu_dereference_check(p->numa_group, p == current ||
+		(lockdep_is_held(&task_rq(p)->lock) && !READ_ONCE(p->on_cpu)));
+}
+
+static struct numa_group *deref_curr_numa_group(struct task_struct *p)
+{
+	return rcu_dereference_protected(p->numa_group, p == current);
+}
+
 static inline unsigned long group_faults_priv(struct numa_group *ng);
 static inline unsigned long group_faults_shared(struct numa_group *ng);
 
@@ -1096,10 +1111,12 @@ static unsigned int task_scan_start(struct task_struct *p)
 {
 	unsigned long smin = task_scan_min(p);
 	unsigned long period = smin;
+	struct numa_group *ng;
 
 	/* Scale the maximum scan period with the amount of shared memory. */
-	if (p->numa_group) {
-		struct numa_group *ng = p->numa_group;
+	rcu_read_lock();
+	ng = rcu_dereference(p->numa_group);
+	if (ng) {
 		unsigned long shared = group_faults_shared(ng);
 		unsigned long private = group_faults_priv(ng);
 
@@ -1107,6 +1124,7 @@ static unsigned int task_scan_start(struct task_struct *p)
 		period *= shared + 1;
 		period /= private + shared + 1;
 	}
+	rcu_read_unlock();
 
 	return max(smin, period);
 }
@@ -1115,13 +1133,14 @@ static unsigned int task_scan_max(struct task_struct *p)
 {
 	unsigned long smin = task_scan_min(p);
 	unsigned long smax;
+	struct numa_group *ng;
 
 	/* Watch for min being lower than max due to floor calculations */
 	smax = sysctl_numa_balancing_scan_period_max / task_nr_scan_windows(p);
 
 	/* Scale the maximum scan period with the amount of shared memory. */
-	if (p->numa_group) {
-		struct numa_group *ng = p->numa_group;
+	ng = deref_curr_numa_group(p);
+	if (ng) {
 		unsigned long shared = group_faults_shared(ng);
 		unsigned long private = group_faults_priv(ng);
 		unsigned long period = smax;
@@ -1153,7 +1172,7 @@ void init_numa_balancing(unsigned long clone_flags, struct task_struct *p)
 	p->numa_scan_period		= sysctl_numa_balancing_scan_delay;
 	p->numa_work.next		= &p->numa_work;
 	p->numa_faults			= NULL;
-	p->numa_group			= NULL;
+	RCU_INIT_POINTER(p->numa_group, NULL);
 	p->last_task_numa_placement	= 0;
 	p->last_sum_exec_runtime	= 0;
 
@@ -1200,7 +1219,16 @@ static void account_numa_dequeue(struct rq *rq, struct task_struct *p)
 
 pid_t task_numa_group_id(struct task_struct *p)
 {
-	return p->numa_group ? p->numa_group->gid : 0;
+	struct numa_group *ng;
+	pid_t gid = 0;
+
+	rcu_read_lock();
+	ng = rcu_dereference(p->numa_group);
+	if (ng)
+		gid = ng->gid;
+	rcu_read_unlock();
+
+	return gid;
 }
 
 /*
@@ -1225,11 +1253,13 @@ static inline unsigned long task_faults(struct task_struct *p, int nid)
 
 static inline unsigned long group_faults(struct task_struct *p, int nid)
 {
-	if (!p->numa_group)
+	struct numa_group *ng = deref_task_numa_group(p);
+
+	if (!ng)
 		return 0;
 
-	return p->numa_group->faults[task_faults_idx(NUMA_MEM, nid, 0)] +
-		p->numa_group->faults[task_faults_idx(NUMA_MEM, nid, 1)];
+	return ng->faults[task_faults_idx(NUMA_MEM, nid, 0)] +
+		ng->faults[task_faults_idx(NUMA_MEM, nid, 1)];
 }
 
 static inline unsigned long group_faults_cpu(struct numa_group *group, int nid)
@@ -1367,12 +1397,13 @@ static inline unsigned long task_weight(struct task_struct *p, int nid,
 static inline unsigned long group_weight(struct task_struct *p, int nid,
 					 int dist)
 {
+	struct numa_group *ng = deref_task_numa_group(p);
 	unsigned long faults, total_faults;
 
-	if (!p->numa_group)
+	if (!ng)
 		return 0;
 
-	total_faults = p->numa_group->total_faults;
+	total_faults = ng->total_faults;
 
 	if (!total_faults)
 		return 0;
@@ -1386,7 +1417,7 @@ static inline unsigned long group_weight(struct task_struct *p, int nid,
 bool should_numa_migrate_memory(struct task_struct *p, struct page * page,
 				int src_nid, int dst_cpu)
 {
-	struct numa_group *ng = p->numa_group;
+	struct numa_group *ng = deref_curr_numa_group(p);
 	int dst_nid = cpu_to_node(dst_cpu);
 	int last_cpupid, this_cpupid;
 
@@ -1592,13 +1623,14 @@ static bool load_too_imbalanced(long src_load, long dst_load,
 static void task_numa_compare(struct task_numa_env *env,
 			      long taskimp, long groupimp, bool maymove)
 {
+	struct numa_group *cur_ng, *p_ng = deref_curr_numa_group(env->p);
 	struct rq *dst_rq = cpu_rq(env->dst_cpu);
+	long imp = p_ng ? groupimp : taskimp;
 	struct task_struct *cur;
 	long src_load, dst_load;
-	long load;
-	long imp = env->p->numa_group ? groupimp : taskimp;
-	long moveimp = imp;
 	int dist = env->dist;
+	long moveimp = imp;
+	long load;
 
 	if (READ_ONCE(dst_rq->numa_migrate_on))
 		return;
@@ -1637,21 +1669,22 @@ static void task_numa_compare(struct task_numa_env *env,
 	 * If dst and source tasks are in the same NUMA group, or not
 	 * in any group then look only at task weights.
 	 */
-	if (cur->numa_group == env->p->numa_group) {
+	cur_ng = rcu_dereference(cur->numa_group);
+	if (cur_ng == p_ng) {
 		imp = taskimp + task_weight(cur, env->src_nid, dist) -
 		      task_weight(cur, env->dst_nid, dist);
 		/*
 		 * Add some hysteresis to prevent swapping the
 		 * tasks within a group over tiny differences.
 		 */
-		if (cur->numa_group)
+		if (cur_ng)
 			imp -= imp / 16;
 	} else {
 		/*
 		 * Compare the group weights. If a task is all by itself
 		 * (not part of a group), use the task weight instead.
 		 */
-		if (cur->numa_group && env->p->numa_group)
+		if (cur_ng && p_ng)
 			imp += group_weight(cur, env->src_nid, dist) -
 			       group_weight(cur, env->dst_nid, dist);
 		else
@@ -1749,11 +1782,12 @@ static int task_numa_migrate(struct task_struct *p)
 		.best_imp = 0,
 		.best_cpu = -1,
 	};
+	unsigned long taskweight, groupweight;
 	struct sched_domain *sd;
+	long taskimp, groupimp;
+	struct numa_group *ng;
 	struct rq *best_rq;
-	unsigned long taskweight, groupweight;
 	int nid, ret, dist;
-	long taskimp, groupimp;
 
 	/*
 	 * Pick the lowest SD_NUMA domain, as that would have the smallest
@@ -1799,7 +1833,8 @@ static int task_numa_migrate(struct task_struct *p)
 	 *   multiple NUMA nodes; in order to better consolidate the group,
 	 *   we need to check other locations.
 	 */
-	if (env.best_cpu == -1 || (p->numa_group && p->numa_group->active_nodes > 1)) {
+	ng = deref_curr_numa_group(p);
+	if (env.best_cpu == -1 || (ng && ng->active_nodes > 1)) {
 		for_each_online_node(nid) {
 			if (nid == env.src_nid || nid == p->numa_preferred_nid)
 				continue;
@@ -1832,7 +1867,7 @@ static int task_numa_migrate(struct task_struct *p)
 	 * A task that migrated to a second choice node will be better off
 	 * trying for a better one later. Do not set the preferred node here.
 	 */
-	if (p->numa_group) {
+	if (ng) {
 		if (env.best_cpu == -1)
 			nid = env.src_nid;
 		else
@@ -2127,6 +2162,7 @@ static void task_numa_placement(struct task_struct *p)
 	unsigned long total_faults;
 	u64 runtime, period;
 	spinlock_t *group_lock = NULL;
+	struct numa_group *ng;
 
 	/*
 	 * The p->mm->numa_scan_seq field gets updated without
@@ -2144,8 +2180,9 @@ static void task_numa_placement(struct task_struct *p)
 	runtime = numa_get_avg_runtime(p, &period);
 
 	/* If the task is part of a group prevent parallel updates to group stats */
-	if (p->numa_group) {
-		group_lock = &p->numa_group->lock;
+	ng = deref_curr_numa_group(p);
+	if (ng) {
+		group_lock = &ng->lock;
 		spin_lock_irq(group_lock);
 	}
 
@@ -2186,7 +2223,7 @@ static void task_numa_placement(struct task_struct *p)
 			p->numa_faults[cpu_idx] += f_diff;
 			faults += p->numa_faults[mem_idx];
 			p->total_numa_faults += diff;
-			if (p->numa_group) {
+			if (ng) {
 				/*
 				 * safe because we can only change our own group
 				 *
@@ -2194,14 +2231,14 @@ static void task_numa_placement(struct task_struct *p)
 				 * nid and priv in a specific region because it
 				 * is at the beginning of the numa_faults array.
 				 */
-				p->numa_group->faults[mem_idx] += diff;
-				p->numa_group->faults_cpu[mem_idx] += f_diff;
-				p->numa_group->total_faults += diff;
-				group_faults += p->numa_group->faults[mem_idx];
+				ng->faults[mem_idx] += diff;
+				ng->faults_cpu[mem_idx] += f_diff;
+				ng->total_faults += diff;
+				group_faults += ng->faults[mem_idx];
 			}
 		}
 
-		if (!p->numa_group) {
+		if (!ng) {
 			if (faults > max_faults) {
 				max_faults = faults;
 				max_nid = nid;
@@ -2212,8 +2249,8 @@ static void task_numa_placement(struct task_struct *p)
 		}
 	}
 
-	if (p->numa_group) {
-		numa_group_count_active_nodes(p->numa_group);
+	if (ng) {
+		numa_group_count_active_nodes(ng);
 		spin_unlock_irq(group_lock);
 		max_nid = preferred_group_nid(p, max_nid);
 	}
@@ -2247,7 +2284,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
 	int cpu = cpupid_to_cpu(cpupid);
 	int i;
 
-	if (unlikely(!p->numa_group)) {
+	if (unlikely(!deref_curr_numa_group(p))) {
 		unsigned int size = sizeof(struct numa_group) +
 				    4*nr_node_ids*sizeof(unsigned long);
 
@@ -2283,7 +2320,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
 	if (!grp)
 		goto no_join;
 
-	my_grp = p->numa_group;
+	my_grp = deref_curr_numa_group(p);
 	if (grp == my_grp)
 		goto no_join;
 
@@ -2354,7 +2391,8 @@ no_join:
  */
 void task_numa_free(struct task_struct *p, bool final)
 {
-	struct numa_group *grp = p->numa_group;
+	/* safe: p either is current or is being freed by current */
+	struct numa_group *grp = rcu_dereference_raw(p->numa_group);
 	unsigned long *numa_faults = p->numa_faults;
 	unsigned long flags;
 	int i;
@@ -2434,7 +2472,7 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
 	 * actively using should be counted as local. This allows the
 	 * scan rate to slow down when a workload has settled down.
 	 */
-	ng = p->numa_group;
+	ng = deref_curr_numa_group(p);
 	if (!priv && !local && ng && ng->active_nodes > 1 &&
 				numa_is_active_node(cpu_node, ng) &&
 				numa_is_active_node(mem_node, ng))
@@ -10234,18 +10272,22 @@ void show_numa_stats(struct task_struct *p, struct seq_file *m)
 {
 	int node;
 	unsigned long tsf = 0, tpf = 0, gsf = 0, gpf = 0;
+	struct numa_group *ng;
 
+	rcu_read_lock();
+	ng = rcu_dereference(p->numa_group);
 	for_each_online_node(node) {
 		if (p->numa_faults) {
 			tsf = p->numa_faults[task_faults_idx(NUMA_MEM, node, 0)];
 			tpf = p->numa_faults[task_faults_idx(NUMA_MEM, node, 1)];
 		}
-		if (p->numa_group) {
-			gsf = p->numa_group->faults[task_faults_idx(NUMA_MEM, node, 0)],
-			gpf = p->numa_group->faults[task_faults_idx(NUMA_MEM, node, 1)];
+		if (ng) {
+			gsf = ng->faults[task_faults_idx(NUMA_MEM, node, 0)],
+			gpf = ng->faults[task_faults_idx(NUMA_MEM, node, 1)];
 		}
 		print_numa_stats(m, node, tsf, tpf, gsf, gpf);
 	}
+	rcu_read_unlock();
 }
 #endif /* CONFIG_NUMA_BALANCING */
 #endif /* CONFIG_SCHED_DEBUG */
-- 
GitLab


From 54ffaa53e785ad72df597bf0544b65f0dfd19cdc Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 13 Jul 2019 13:40:13 -0700
Subject: [PATCH 1252/1835] /proc/<pid>/cmdline: remove all the special cases

commit 3d712546d8ba9f25cdf080d79f90482aa4231ed4 upstream.

Start off with a clean slate that only reads exactly from arg_start to
arg_end, without any oddities.  This simplifies the code and in the
process removes the case that caused us to potentially leak an
uninitialized byte from the temporary kernel buffer.

Note that in order to start from scratch with an understandable base,
this simplifies things _too_ much, and removes all the legacy logic to
handle setproctitle() having changed the argument strings.

We'll add back those special cases very differently in the next commit.

Link: https://lore.kernel.org/lkml/20190712160913.17727-1-izbyshev@ispras.ru/
Fixes: f5b65348fd77 ("proc: fix missing final NUL in get_mm_cmdline() rewrite")
Cc: Alexey Izbyshev <izbyshev@ispras.ru>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/base.c | 71 ++++++--------------------------------------------
 1 file changed, 8 insertions(+), 63 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index a7fbda72afeba..24547400c1198 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -208,7 +208,7 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
 static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 			      size_t count, loff_t *ppos)
 {
-	unsigned long arg_start, arg_end, env_start, env_end;
+	unsigned long arg_start, arg_end;
 	unsigned long pos, len;
 	char *page;
 
@@ -219,36 +219,18 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 	spin_lock(&mm->arg_lock);
 	arg_start = mm->arg_start;
 	arg_end = mm->arg_end;
-	env_start = mm->env_start;
-	env_end = mm->env_end;
 	spin_unlock(&mm->arg_lock);
 
 	if (arg_start >= arg_end)
 		return 0;
 
-	/*
-	 * We have traditionally allowed the user to re-write
-	 * the argument strings and overflow the end result
-	 * into the environment section. But only do that if
-	 * the environment area is contiguous to the arguments.
-	 */
-	if (env_start != arg_end || env_start >= env_end)
-		env_start = env_end = arg_end;
-
-	/* .. and limit it to a maximum of one page of slop */
-	if (env_end >= arg_end + PAGE_SIZE)
-		env_end = arg_end + PAGE_SIZE - 1;
-
 	/* We're not going to care if "*ppos" has high bits set */
-	pos = arg_start + *ppos;
-
 	/* .. but we do check the result is in the proper range */
-	if (pos < arg_start || pos >= env_end)
+	pos = arg_start + *ppos;
+	if (pos < arg_start || pos >= arg_end)
 		return 0;
-
-	/* .. and we never go past env_end */
-	if (env_end - pos < count)
-		count = env_end - pos;
+	if (count > arg_end - pos)
+		count = arg_end - pos;
 
 	page = (char *)__get_free_page(GFP_KERNEL);
 	if (!page)
@@ -258,48 +240,11 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 	while (count) {
 		int got;
 		size_t size = min_t(size_t, PAGE_SIZE, count);
-		long offset;
 
-		/*
-		 * Are we already starting past the official end?
-		 * We always include the last byte that is *supposed*
-		 * to be NUL
-		 */
-		offset = (pos >= arg_end) ? pos - arg_end + 1 : 0;
-
-		got = access_remote_vm(mm, pos - offset, page, size + offset, FOLL_ANON);
-		if (got <= offset)
+		got = access_remote_vm(mm, pos, page, size, FOLL_ANON);
+		if (got <= 0)
 			break;
-		got -= offset;
-
-		/* Don't walk past a NUL character once you hit arg_end */
-		if (pos + got >= arg_end) {
-			int n = 0;
-
-			/*
-			 * If we started before 'arg_end' but ended up
-			 * at or after it, we start the NUL character
-			 * check at arg_end-1 (where we expect the normal
-			 * EOF to be).
-			 *
-			 * NOTE! This is smaller than 'got', because
-			 * pos + got >= arg_end
-			 */
-			if (pos < arg_end)
-				n = arg_end - pos - 1;
-
-			/* Cut off at first NUL after 'n' */
-			got = n + strnlen(page+n, offset+got-n);
-			if (got < offset)
-				break;
-			got -= offset;
-
-			/* Include the NUL if it existed */
-			if (got < size)
-				got++;
-		}
-
-		got -= copy_to_user(buf, page+offset, got);
+		got -= copy_to_user(buf, page, got);
 		if (unlikely(!got)) {
 			if (!len)
 				len = -EFAULT;
-- 
GitLab


From 54695343b4910a3a6e09513a3231336ede39484a Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 13 Jul 2019 14:27:14 -0700
Subject: [PATCH 1253/1835] /proc/<pid>/cmdline: add back the setproctitle()
 special case

commit d26d0cd97c88eb1a5704b42e41ab443406807810 upstream.

This makes the setproctitle() special case very explicit indeed, and
handles it with a separate helper function entirely.  In the process, it
re-instates the original semantics of simply stopping at the first NUL
character when the original last NUL character is no longer there.

[ The original semantics can still be seen in mm/util.c: get_cmdline()
  that is limited to a fixed-size buffer ]

This makes the logic about when we use the string lengths etc much more
obvious, and makes it easier to see what we do and what the two very
different cases are.

Note that even when we allow walking past the end of the argument array
(because the setproctitle() might have overwritten and overflowed the
original argv[] strings), we only allow it when it overflows into the
environment region if it is immediately adjacent.

[ Fixed for missing 'count' checks noted by Alexey Izbyshev ]

Link: https://lore.kernel.org/lkml/alpine.LNX.2.21.1904052326230.3249@kich.toxcorp.com/
Fixes: 5ab827189965 ("fs/proc: simplify and clarify get_mm_cmdline() function")
Cc: Jakub Jankowski <shasta@toxcorp.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Alexey Izbyshev <izbyshev@ispras.ru>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/base.c | 81 +++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 77 insertions(+), 4 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 24547400c1198..3b9b726b1a6ca 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -205,12 +205,53 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
 	return result;
 }
 
+/*
+ * If the user used setproctitle(), we just get the string from
+ * user space at arg_start, and limit it to a maximum of one page.
+ */
+static ssize_t get_mm_proctitle(struct mm_struct *mm, char __user *buf,
+				size_t count, unsigned long pos,
+				unsigned long arg_start)
+{
+	char *page;
+	int ret, got;
+
+	if (pos >= PAGE_SIZE)
+		return 0;
+
+	page = (char *)__get_free_page(GFP_KERNEL);
+	if (!page)
+		return -ENOMEM;
+
+	ret = 0;
+	got = access_remote_vm(mm, arg_start, page, PAGE_SIZE, FOLL_ANON);
+	if (got > 0) {
+		int len = strnlen(page, got);
+
+		/* Include the NUL character if it was found */
+		if (len < got)
+			len++;
+
+		if (len > pos) {
+			len -= pos;
+			if (len > count)
+				len = count;
+			len -= copy_to_user(buf, page+pos, len);
+			if (!len)
+				len = -EFAULT;
+			ret = len;
+		}
+	}
+	free_page((unsigned long)page);
+	return ret;
+}
+
 static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 			      size_t count, loff_t *ppos)
 {
-	unsigned long arg_start, arg_end;
+	unsigned long arg_start, arg_end, env_start, env_end;
 	unsigned long pos, len;
-	char *page;
+	char *page, c;
 
 	/* Check if process spawned far enough to have cmdline. */
 	if (!mm->env_end)
@@ -219,14 +260,46 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 	spin_lock(&mm->arg_lock);
 	arg_start = mm->arg_start;
 	arg_end = mm->arg_end;
+	env_start = mm->env_start;
+	env_end = mm->env_end;
 	spin_unlock(&mm->arg_lock);
 
 	if (arg_start >= arg_end)
 		return 0;
 
+	/*
+	 * We allow setproctitle() to overwrite the argument
+	 * strings, and overflow past the original end. But
+	 * only when it overflows into the environment area.
+	 */
+	if (env_start != arg_end || env_end < env_start)
+		env_start = env_end = arg_end;
+	len = env_end - arg_start;
+
 	/* We're not going to care if "*ppos" has high bits set */
-	/* .. but we do check the result is in the proper range */
-	pos = arg_start + *ppos;
+	pos = *ppos;
+	if (pos >= len)
+		return 0;
+	if (count > len - pos)
+		count = len - pos;
+	if (!count)
+		return 0;
+
+	/*
+	 * Magical special case: if the argv[] end byte is not
+	 * zero, the user has overwritten it with setproctitle(3).
+	 *
+	 * Possible future enhancement: do this only once when
+	 * pos is 0, and set a flag in the 'struct file'.
+	 */
+	if (access_remote_vm(mm, arg_end-1, &c, 1, FOLL_ANON) == 1 && c)
+		return get_mm_proctitle(mm, buf, count, pos, arg_start);
+
+	/*
+	 * For the non-setproctitle() case we limit things strictly
+	 * to the [arg_start, arg_end[ range.
+	 */
+	pos += arg_start;
 	if (pos < arg_start || pos >= arg_end)
 		return 0;
 	if (count > arg_end - pos)
-- 
GitLab


From 135e7737e21f9fa23917be0dc5a594b50340590f Mon Sep 17 00:00:00 2001
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Tue, 16 Jul 2019 16:30:09 -0700
Subject: [PATCH 1254/1835] drivers/pps/pps.c: clear offset flags in
 PPS_SETPARAMS ioctl

commit 5515e9a6273b8c02034466bcbd717ac9f53dab99 upstream.

The PPS assert/clear offset corrections are set by the PPS_SETPARAMS
ioctl in the pps_ktime structs, which also contain flags.  The flags are
not initialized by applications (using the timepps.h header) and they
are not used by the kernel for anything except returning them back in
the PPS_GETPARAMS ioctl.

Set the flags to zero to make it clear they are unused and avoid leaking
uninitialized data of the PPS_SETPARAMS caller to other applications
that have a read access to the PPS device.

Link: http://lkml.kernel.org/r/20190702092251.24303-1-mlichvar@redhat.com
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Cc: Greg KH <greg@kroah.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pps/pps.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 8febacb8fc54d..0951564b6830a 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -166,6 +166,14 @@ static long pps_cdev_ioctl(struct file *file,
 			pps->params.mode |= PPS_CANWAIT;
 		pps->params.api_version = PPS_API_VERS;
 
+		/*
+		 * Clear unused fields of pps_kparams to avoid leaking
+		 * uninitialized data of the PPS_SETPARAMS caller via
+		 * PPS_GETPARAMS
+		 */
+		pps->params.assert_off_tu.flags = 0;
+		pps->params.clear_off_tu.flags = 0;
+
 		spin_unlock_irq(&pps->lock);
 
 		break;
-- 
GitLab


From b6c3b6a2c66280a5a7c272adce5f30733de6bfc1 Mon Sep 17 00:00:00 2001
From: Yoshinori Sato <ysato@users.sourceforge.jp>
Date: Sun, 21 Apr 2019 22:53:58 +0900
Subject: [PATCH 1255/1835] Fix allyesconfig output.

commit 1b496469d0c020e09124e03e66a81421c21272a7 upstream.

Conflict JCore-SoC and SolutionEngine 7619.

Signed-off-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sh/boards/Kconfig | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/arch/sh/boards/Kconfig b/arch/sh/boards/Kconfig
index 6394b4f0a69be..f42feab25dcf1 100644
--- a/arch/sh/boards/Kconfig
+++ b/arch/sh/boards/Kconfig
@@ -8,27 +8,19 @@ config SH_ALPHA_BOARD
 	bool
 
 config SH_DEVICE_TREE
-	bool "Board Described by Device Tree"
+	bool
 	select OF
 	select OF_EARLY_FLATTREE
 	select TIMER_OF
 	select COMMON_CLK
 	select GENERIC_CALIBRATE_DELAY
-	help
-	  Select Board Described by Device Tree to build a kernel that
-	  does not hard-code any board-specific knowledge but instead uses
-	  a device tree blob provided by the boot-loader. You must enable
-	  drivers for any hardware you want to use separately. At this
-	  time, only boards based on the open-hardware J-Core processors
-	  have sufficient driver coverage to use this option; do not
-	  select it if you are using original SuperH hardware.
 
 config SH_JCORE_SOC
 	bool "J-Core SoC"
-	depends on SH_DEVICE_TREE && (CPU_SH2 || CPU_J2)
+	select SH_DEVICE_TREE
 	select CLKSRC_JCORE_PIT
 	select JCORE_AIC
-	default y if CPU_J2
+	depends on CPU_J2
 	help
 	  Select this option to include drivers core components of the
 	  J-Core SoC, including interrupt controllers and timers.
-- 
GitLab


From 9b17512d9165668eb71c3d51e36ef8ab4c5f2edc Mon Sep 17 00:00:00 2001
From: "Yan, Zheng" <zyan@redhat.com>
Date: Thu, 23 May 2019 11:01:37 +0800
Subject: [PATCH 1256/1835] ceph: hold i_ceph_lock when removing caps for
 freeing inode

commit d6e47819721ae2d9d090058ad5570a66f3c42e39 upstream.

ceph_d_revalidate(, LOOKUP_RCU) may call __ceph_caps_issued_mask()
on a freeing inode.

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/caps.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index c7542e8dd096c..a11fa0b6b34d5 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1237,20 +1237,23 @@ static int send_cap_msg(struct cap_msg_args *arg)
 }
 
 /*
- * Queue cap releases when an inode is dropped from our cache.  Since
- * inode is about to be destroyed, there is no need for i_ceph_lock.
+ * Queue cap releases when an inode is dropped from our cache.
  */
 void ceph_queue_caps_release(struct inode *inode)
 {
 	struct ceph_inode_info *ci = ceph_inode(inode);
 	struct rb_node *p;
 
+	/* lock i_ceph_lock, because ceph_d_revalidate(..., LOOKUP_RCU)
+	 * may call __ceph_caps_issued_mask() on a freeing inode. */
+	spin_lock(&ci->i_ceph_lock);
 	p = rb_first(&ci->i_caps);
 	while (p) {
 		struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
 		p = rb_next(p);
 		__ceph_remove_cap(cap, true);
 	}
+	spin_unlock(&ci->i_ceph_lock);
 }
 
 /*
-- 
GitLab


From c58a6507363b7d9b5ac3aefeb4b54172eafa3bc6 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Wed, 26 Sep 2018 14:01:04 -0700
Subject: [PATCH 1257/1835] block, scsi: Change the preempt-only flag into a
 counter

commit cd84a62e0078dce09f4ed349bec84f86c9d54b30 upstream.

The RQF_PREEMPT flag is used for three purposes:
- In the SCSI core, for making sure that power management requests
  are executed even if a device is in the "quiesced" state.
- For domain validation by SCSI drivers that use the parallel port.
- In the IDE driver, for IDE preempt requests.
Rename "preempt-only" into "pm-only" because the primary purpose of
this mode is power management. Since the power management core may
but does not have to resume a runtime suspended device before
performing system-wide suspend and since a later patch will set
"pm-only" mode as long as a block device is runtime suspended, make
it possible to set "pm-only" mode from more than one context. Since
with this change scsi_device_quiesce() is no longer idempotent, make
that function return early if it is called for a quiesced queue.

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Cc: Jianchao Wang <jianchao.w.wang@oracle.com>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-core.c        | 35 ++++++++++++++++++-----------------
 block/blk-mq-debugfs.c  | 10 +++++++++-
 drivers/scsi/scsi_lib.c | 11 +++++++----
 include/linux/blkdev.h  | 14 +++++++++-----
 4 files changed, 43 insertions(+), 27 deletions(-)

diff --git a/block/blk-core.c b/block/blk-core.c
index 9ca703bcfe3b1..4a3e1f4178804 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -421,24 +421,25 @@ void blk_sync_queue(struct request_queue *q)
 EXPORT_SYMBOL(blk_sync_queue);
 
 /**
- * blk_set_preempt_only - set QUEUE_FLAG_PREEMPT_ONLY
+ * blk_set_pm_only - increment pm_only counter
  * @q: request queue pointer
- *
- * Returns the previous value of the PREEMPT_ONLY flag - 0 if the flag was not
- * set and 1 if the flag was already set.
  */
-int blk_set_preempt_only(struct request_queue *q)
+void blk_set_pm_only(struct request_queue *q)
 {
-	return blk_queue_flag_test_and_set(QUEUE_FLAG_PREEMPT_ONLY, q);
+	atomic_inc(&q->pm_only);
 }
-EXPORT_SYMBOL_GPL(blk_set_preempt_only);
+EXPORT_SYMBOL_GPL(blk_set_pm_only);
 
-void blk_clear_preempt_only(struct request_queue *q)
+void blk_clear_pm_only(struct request_queue *q)
 {
-	blk_queue_flag_clear(QUEUE_FLAG_PREEMPT_ONLY, q);
-	wake_up_all(&q->mq_freeze_wq);
+	int pm_only;
+
+	pm_only = atomic_dec_return(&q->pm_only);
+	WARN_ON_ONCE(pm_only < 0);
+	if (pm_only == 0)
+		wake_up_all(&q->mq_freeze_wq);
 }
-EXPORT_SYMBOL_GPL(blk_clear_preempt_only);
+EXPORT_SYMBOL_GPL(blk_clear_pm_only);
 
 /**
  * __blk_run_queue_uncond - run a queue whether or not it has been stopped
@@ -916,7 +917,7 @@ EXPORT_SYMBOL(blk_alloc_queue);
  */
 int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 {
-	const bool preempt = flags & BLK_MQ_REQ_PREEMPT;
+	const bool pm = flags & BLK_MQ_REQ_PREEMPT;
 
 	while (true) {
 		bool success = false;
@@ -924,11 +925,11 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 		rcu_read_lock();
 		if (percpu_ref_tryget_live(&q->q_usage_counter)) {
 			/*
-			 * The code that sets the PREEMPT_ONLY flag is
-			 * responsible for ensuring that that flag is globally
-			 * visible before the queue is unfrozen.
+			 * The code that increments the pm_only counter is
+			 * responsible for ensuring that that counter is
+			 * globally visible before the queue is unfrozen.
 			 */
-			if (preempt || !blk_queue_preempt_only(q)) {
+			if (pm || !blk_queue_pm_only(q)) {
 				success = true;
 			} else {
 				percpu_ref_put(&q->q_usage_counter);
@@ -953,7 +954,7 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 
 		wait_event(q->mq_freeze_wq,
 			   (atomic_read(&q->mq_freeze_depth) == 0 &&
-			    (preempt || !blk_queue_preempt_only(q))) ||
+			    (pm || !blk_queue_pm_only(q))) ||
 			   blk_queue_dying(q));
 		if (blk_queue_dying(q))
 			return -ENODEV;
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index cb1e6cf7ac48f..a5ea86835fcb2 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -102,6 +102,14 @@ static int blk_flags_show(struct seq_file *m, const unsigned long flags,
 	return 0;
 }
 
+static int queue_pm_only_show(void *data, struct seq_file *m)
+{
+	struct request_queue *q = data;
+
+	seq_printf(m, "%d\n", atomic_read(&q->pm_only));
+	return 0;
+}
+
 #define QUEUE_FLAG_NAME(name) [QUEUE_FLAG_##name] = #name
 static const char *const blk_queue_flag_name[] = {
 	QUEUE_FLAG_NAME(QUEUED),
@@ -132,7 +140,6 @@ static const char *const blk_queue_flag_name[] = {
 	QUEUE_FLAG_NAME(REGISTERED),
 	QUEUE_FLAG_NAME(SCSI_PASSTHROUGH),
 	QUEUE_FLAG_NAME(QUIESCED),
-	QUEUE_FLAG_NAME(PREEMPT_ONLY),
 };
 #undef QUEUE_FLAG_NAME
 
@@ -209,6 +216,7 @@ static ssize_t queue_write_hint_store(void *data, const char __user *buf,
 static const struct blk_mq_debugfs_attr blk_mq_debugfs_queue_attrs[] = {
 	{ "poll_stat", 0400, queue_poll_stat_show },
 	{ "requeue_list", 0400, .seq_ops = &queue_requeue_list_seq_ops },
+	{ "pm_only", 0600, queue_pm_only_show, NULL },
 	{ "state", 0600, queue_state_show, queue_state_write },
 	{ "write_hints", 0600, queue_write_hint_show, queue_write_hint_store },
 	{ "zone_wlock", 0400, queue_zone_wlock_show, NULL },
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 32652b2c5e7cb..83bbcdb627986 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -3059,11 +3059,14 @@ scsi_device_quiesce(struct scsi_device *sdev)
 	 */
 	WARN_ON_ONCE(sdev->quiesced_by && sdev->quiesced_by != current);
 
-	blk_set_preempt_only(q);
+	if (sdev->quiesced_by == current)
+		return 0;
+
+	blk_set_pm_only(q);
 
 	blk_mq_freeze_queue(q);
 	/*
-	 * Ensure that the effect of blk_set_preempt_only() will be visible
+	 * Ensure that the effect of blk_set_pm_only() will be visible
 	 * for percpu_ref_tryget() callers that occur after the queue
 	 * unfreeze even if the queue was already frozen before this function
 	 * was called. See also https://lwn.net/Articles/573497/.
@@ -3076,7 +3079,7 @@ scsi_device_quiesce(struct scsi_device *sdev)
 	if (err == 0)
 		sdev->quiesced_by = current;
 	else
-		blk_clear_preempt_only(q);
+		blk_clear_pm_only(q);
 	mutex_unlock(&sdev->state_mutex);
 
 	return err;
@@ -3100,7 +3103,7 @@ void scsi_device_resume(struct scsi_device *sdev)
 	 */
 	mutex_lock(&sdev->state_mutex);
 	sdev->quiesced_by = NULL;
-	blk_clear_preempt_only(sdev->request_queue);
+	blk_clear_pm_only(sdev->request_queue);
 	if (sdev->sdev_state == SDEV_QUIESCE)
 		scsi_device_set_state(sdev, SDEV_RUNNING);
 	mutex_unlock(&sdev->state_mutex);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 6980014357d47..d51e10f50e755 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -504,6 +504,12 @@ struct request_queue {
 	 * various queue flags, see QUEUE_* below
 	 */
 	unsigned long		queue_flags;
+	/*
+	 * Number of contexts that have called blk_set_pm_only(). If this
+	 * counter is above zero then only RQF_PM and RQF_PREEMPT requests are
+	 * processed.
+	 */
+	atomic_t		pm_only;
 
 	/*
 	 * ida allocated id for this queue.  Used to index queues from
@@ -698,7 +704,6 @@ struct request_queue {
 #define QUEUE_FLAG_REGISTERED  26	/* queue has been registered to a disk */
 #define QUEUE_FLAG_SCSI_PASSTHROUGH 27	/* queue supports SCSI commands */
 #define QUEUE_FLAG_QUIESCED    28	/* queue has been quiesced */
-#define QUEUE_FLAG_PREEMPT_ONLY	29	/* only process REQ_PREEMPT requests */
 
 #define QUEUE_FLAG_DEFAULT	((1 << QUEUE_FLAG_IO_STAT) |		\
 				 (1 << QUEUE_FLAG_SAME_COMP)	|	\
@@ -736,12 +741,11 @@ bool blk_queue_flag_test_and_clear(unsigned int flag, struct request_queue *q);
 	((rq)->cmd_flags & (REQ_FAILFAST_DEV|REQ_FAILFAST_TRANSPORT| \
 			     REQ_FAILFAST_DRIVER))
 #define blk_queue_quiesced(q)	test_bit(QUEUE_FLAG_QUIESCED, &(q)->queue_flags)
-#define blk_queue_preempt_only(q)				\
-	test_bit(QUEUE_FLAG_PREEMPT_ONLY, &(q)->queue_flags)
+#define blk_queue_pm_only(q)	atomic_read(&(q)->pm_only)
 #define blk_queue_fua(q)	test_bit(QUEUE_FLAG_FUA, &(q)->queue_flags)
 
-extern int blk_set_preempt_only(struct request_queue *q);
-extern void blk_clear_preempt_only(struct request_queue *q);
+extern void blk_set_pm_only(struct request_queue *q);
+extern void blk_clear_pm_only(struct request_queue *q);
 
 static inline int queue_in_flight(struct request_queue *q)
 {
-- 
GitLab


From 475f7781a8047d5fc5a16b1f6148cd0bc62d8a69 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Fri, 15 Mar 2019 16:27:58 -0700
Subject: [PATCH 1258/1835] scsi: core: Avoid that a kernel warning appears
 during system resume

commit 17605afaae825b0291f80c62a7f6565879edaa8a upstream.

Since scsi_device_quiesce() skips SCSI devices that have another state than
RUNNING, OFFLINE or TRANSPORT_OFFLINE, scsi_device_resume() should not
complain about SCSI devices that have been skipped. Hence this patch.  This
patch avoids that the following warning appears during resume:

WARNING: CPU: 3 PID: 1039 at blk_clear_pm_only+0x2a/0x30
CPU: 3 PID: 1039 Comm: kworker/u8:49 Not tainted 5.0.0+ #1
Hardware name: LENOVO 4180F42/4180F42, BIOS 83ET75WW (1.45 ) 05/10/2013
Workqueue: events_unbound async_run_entry_fn
RIP: 0010:blk_clear_pm_only+0x2a/0x30
Call Trace:
 ? scsi_device_resume+0x28/0x50
 ? scsi_dev_type_resume+0x2b/0x80
 ? async_run_entry_fn+0x2c/0xd0
 ? process_one_work+0x1f0/0x3f0
 ? worker_thread+0x28/0x3c0
 ? process_one_work+0x3f0/0x3f0
 ? kthread+0x10c/0x130
 ? __kthread_create_on_node+0x150/0x150
 ? ret_from_fork+0x1f/0x30

Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Johannes Thumshirn <jthumshirn@suse.de>
Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
Cc: Martin Steigerwald <martin@lichtvoll.de>
Cc: <stable@vger.kernel.org>
Reported-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Tested-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Fixes: 3a0a529971ec ("block, scsi: Make SCSI quiesce and resume work reliably") # v4.15
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_lib.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 83bbcdb627986..75b926e700766 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -3102,8 +3102,10 @@ void scsi_device_resume(struct scsi_device *sdev)
 	 * device deleted during suspend)
 	 */
 	mutex_lock(&sdev->state_mutex);
-	sdev->quiesced_by = NULL;
-	blk_clear_pm_only(sdev->request_queue);
+	if (sdev->quiesced_by) {
+		sdev->quiesced_by = NULL;
+		blk_clear_pm_only(sdev->request_queue);
+	}
 	if (sdev->sdev_state == SDEV_QUIESCE)
 		scsi_device_set_state(sdev, SDEV_RUNNING);
 	mutex_unlock(&sdev->state_mutex);
-- 
GitLab


From 4736bb27774449cf759ee81663b4126a297ba9d4 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 17 Jun 2019 21:34:13 +0800
Subject: [PATCH 1259/1835] ip_tunnel: allow not to count pkts on tstats by
 setting skb's dev to NULL

commit 5684abf7020dfc5f0b6ba1d68eda3663871fce52 upstream.

iptunnel_xmit() works as a common function, also used by a udp tunnel
which doesn't have to have a tunnel device, like how TIPC works with
udp media.

In these cases, we should allow not to count pkts on dev's tstats, so
that udp tunnel can work with no tunnel device safely.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Tommi Rantala <tommi.t.rantala@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_tunnel_core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index c248e0dccbe17..67ef9d853d906 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -89,9 +89,12 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
 	__ip_select_ident(net, iph, skb_shinfo(skb)->gso_segs ?: 1);
 
 	err = ip_local_out(net, sk, skb);
-	if (unlikely(net_xmit_eval(err)))
-		pkt_len = 0;
-	iptunnel_xmit_stats(dev, pkt_len);
+
+	if (dev) {
+		if (unlikely(net_xmit_eval(err)))
+			pkt_len = 0;
+		iptunnel_xmit_stats(dev, pkt_len);
+	}
 }
 EXPORT_SYMBOL_GPL(iptunnel_xmit);
 
-- 
GitLab


From b3060a1a313ff7a545d658378f62fe9c250acdee Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 4 Aug 2019 09:30:58 +0200
Subject: [PATCH 1260/1835] Linux 4.19.64

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8ad77a93de305..203d9e80a315e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 63
+SUBLEVEL = 64
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From d7c5bc668cd07ccf3682e5a271375421bff915d0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 14 Jun 2019 10:12:07 +0100
Subject: [PATCH 1261/1835] drm/vc4: Add "Broadcast RGB" connector property

Some HDMI monitors do not abide by the full or limited
(16-235) range RGB flags in the AVI infoframe. This can
result in images looking washed out (if given limited and
interpreting as full), or detail disappearing at the extremes
(given full and interpreting as limited).

Copy the Intel i915 driver's approach of adding an override
property ("Broadcast RGB") to force one mode or the other.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 190 +++++++++++++++++++++++--
 1 file changed, 177 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index bcbd2f709c7f6..8e235e65d5a81 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -285,6 +285,13 @@ to_vc4_fkms_encoder(struct drm_encoder *encoder)
 	return container_of(encoder, struct vc4_fkms_encoder, base);
 }
 
+/* "Broadcast RGB" property.
+ * Allows overriding of HDMI full or limited range RGB
+ */
+#define VC4_BROADCAST_RGB_AUTO 0
+#define VC4_BROADCAST_RGB_FULL 1
+#define VC4_BROADCAST_RGB_LIMITED 2
+
 /* VC4 FKMS connector KMS struct */
 struct vc4_fkms_connector {
 	struct drm_connector base;
@@ -297,6 +304,8 @@ struct vc4_fkms_connector {
 	struct vc4_dev *vc4_dev;
 	u32 display_number;
 	u32 display_type;
+
+	struct drm_property *broadcast_rgb_property;
 };
 
 static inline struct vc4_fkms_connector *
@@ -305,6 +314,16 @@ to_vc4_fkms_connector(struct drm_connector *connector)
 	return container_of(connector, struct vc4_fkms_connector, base);
 }
 
+/* VC4 FKMS connector state */
+struct vc4_fkms_connector_state {
+	struct drm_connector_state base;
+
+	int broadcast_rgb;
+};
+
+#define to_vc4_fkms_connector_state(x) \
+			container_of(x, struct vc4_fkms_connector_state, base)
+
 static u32 vc4_get_display_type(u32 display_number)
 {
 	const u32 display_types[] = {
@@ -832,8 +851,6 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 		      mode->picture_aspect_ratio, mode->flags);
 	mb.timings.display = vc4_crtc->display_number;
 
-	mb.timings.video_id_code = frame.avi.video_code;
-
 	mb.timings.clock = mode->clock;
 	mb.timings.hdisplay = mode->hdisplay;
 	mb.timings.hsync_start = mode->hsync_start;
@@ -871,11 +888,30 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 		break;
 	}
 
-	if (!vc4_encoder->hdmi_monitor)
+	if (!vc4_encoder->hdmi_monitor) {
 		mb.timings.flags |= TIMINGS_FLAGS_DVI;
-	else if (drm_default_rgb_quant_range(mode) ==
+		mb.timings.video_id_code = frame.avi.video_code;
+	} else {
+		struct vc4_fkms_connector_state *conn_state =
+			to_vc4_fkms_connector_state(vc4_crtc->connector->state);
+
+		/* Do not provide a VIC as the HDMI spec requires that we do not
+		 * signal the opposite of the defined range in the AVI
+		 * infoframe.
+		 */
+		mb.timings.video_id_code = 0;
+
+		if (conn_state->broadcast_rgb == VC4_BROADCAST_RGB_AUTO) {
+			/* See CEA-861-E - 5.1 Default Encoding Parameters */
+			if (drm_default_rgb_quant_range(mode) ==
 					HDMI_QUANTIZATION_RANGE_LIMITED)
-		mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
+				mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
+		} else {
+			if (conn_state->broadcast_rgb ==
+						VC4_BROADCAST_RGB_LIMITED)
+				mb.timings.flags |= TIMINGS_FLAGS_RGB_LIMITED;
+		}
+	}
 
 	/*
 	FIXME: To implement
@@ -1340,13 +1376,95 @@ static void vc4_fkms_connector_destroy(struct drm_connector *connector)
 	drm_connector_cleanup(connector);
 }
 
+/**
+ * vc4_connector_duplicate_state - duplicate connector state
+ * @connector: digital connector
+ *
+ * Allocates and returns a copy of the connector state (both common and
+ * digital connector specific) for the specified connector.
+ *
+ * Returns: The newly allocated connector state, or NULL on failure.
+ */
+struct drm_connector_state *
+vc4_connector_duplicate_state(struct drm_connector *connector)
+{
+	struct vc4_fkms_connector_state *state;
+
+	state = kmemdup(connector->state, sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return NULL;
+
+	__drm_atomic_helper_connector_duplicate_state(connector, &state->base);
+	return &state->base;
+}
+
+/**
+ * vc4_connector_atomic_get_property - hook for connector->atomic_get_property.
+ * @connector: Connector to get the property for.
+ * @state: Connector state to retrieve the property from.
+ * @property: Property to retrieve.
+ * @val: Return value for the property.
+ *
+ * Returns the atomic property value for a digital connector.
+ */
+int vc4_connector_atomic_get_property(struct drm_connector *connector,
+				      const struct drm_connector_state *state,
+				      struct drm_property *property,
+				      uint64_t *val)
+{
+	struct vc4_fkms_connector *fkms_connector =
+					to_vc4_fkms_connector(connector);
+	struct vc4_fkms_connector_state *vc4_conn_state =
+					to_vc4_fkms_connector_state(state);
+
+	if (property == fkms_connector->broadcast_rgb_property) {
+		*val = vc4_conn_state->broadcast_rgb;
+	} else {
+		DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
+				 property->base.id, property->name);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * vc4_connector_atomic_set_property - hook for connector->atomic_set_property.
+ * @connector: Connector to set the property for.
+ * @state: Connector state to set the property on.
+ * @property: Property to set.
+ * @val: New value for the property.
+ *
+ * Sets the atomic property value for a digital connector.
+ */
+int vc4_connector_atomic_set_property(struct drm_connector *connector,
+				      struct drm_connector_state *state,
+				      struct drm_property *property,
+				      uint64_t val)
+{
+	struct vc4_fkms_connector *fkms_connector =
+					to_vc4_fkms_connector(connector);
+	struct vc4_fkms_connector_state *vc4_conn_state =
+					to_vc4_fkms_connector_state(state);
+
+	if (property == fkms_connector->broadcast_rgb_property) {
+		vc4_conn_state->broadcast_rgb = val;
+		return 0;
+	}
+
+	DRM_DEBUG_ATOMIC("Unknown property [PROP:%d:%s]\n",
+			 property->base.id, property->name);
+	return -EINVAL;
+}
+
 static const struct drm_connector_funcs vc4_fkms_connector_funcs = {
 	.detect = vc4_fkms_connector_detect,
 	.fill_modes = drm_helper_probe_single_connector_modes,
 	.destroy = vc4_fkms_connector_destroy,
-	.reset = drm_atomic_helper_connector_reset,
-	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_duplicate_state = vc4_connector_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+	.atomic_get_property = vc4_connector_atomic_get_property,
+	.atomic_set_property = vc4_connector_atomic_set_property,
 };
 
 static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs = {
@@ -1359,12 +1477,40 @@ static const struct drm_connector_helper_funcs vc4_fkms_lcd_conn_helper_funcs =
 	.best_encoder = vc4_fkms_connector_best_encoder,
 };
 
+static const struct drm_prop_enum_list broadcast_rgb_names[] = {
+	{ VC4_BROADCAST_RGB_AUTO, "Automatic" },
+	{ VC4_BROADCAST_RGB_FULL, "Full" },
+	{ VC4_BROADCAST_RGB_LIMITED, "Limited 16:235" },
+};
+
+static void
+vc4_attach_broadcast_rgb_property(struct vc4_fkms_connector *fkms_connector)
+{
+	struct drm_device *dev = fkms_connector->base.dev;
+	struct drm_property *prop;
+
+	prop = fkms_connector->broadcast_rgb_property;
+	if (!prop) {
+		prop = drm_property_create_enum(dev, DRM_MODE_PROP_ENUM,
+						"Broadcast RGB",
+						broadcast_rgb_names,
+						ARRAY_SIZE(broadcast_rgb_names));
+		if (!prop)
+			return;
+
+		fkms_connector->broadcast_rgb_property = prop;
+	}
+
+	drm_object_attach_property(&fkms_connector->base.base, prop, 0);
+}
+
 static struct drm_connector *
 vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 			u32 display_num)
 {
 	struct drm_connector *connector = NULL;
 	struct vc4_fkms_connector *fkms_connector;
+	struct vc4_fkms_connector_state *conn_state = NULL;
 	struct vc4_dev *vc4_dev = to_vc4_dev(dev);
 	int ret = 0;
 
@@ -1373,9 +1519,18 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 	fkms_connector = devm_kzalloc(dev->dev, sizeof(*fkms_connector),
 				      GFP_KERNEL);
 	if (!fkms_connector) {
-		ret = -ENOMEM;
-		goto fail;
+		return ERR_PTR(-ENOMEM);
+	}
+
+	/*
+	 * Allocate enough memory to hold vc4_fkms_connector_state,
+	 */
+	conn_state = kzalloc(sizeof(*conn_state), GFP_KERNEL);
+	if (!conn_state) {
+		kfree(fkms_connector);
+		return ERR_PTR(-ENOMEM);
 	}
+
 	connector = &fkms_connector->base;
 
 	fkms_connector->encoder = encoder;
@@ -1383,6 +1538,9 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 	fkms_connector->display_type = vc4_get_display_type(display_num);
 	fkms_connector->vc4_dev = vc4_dev;
 
+	__drm_atomic_helper_connector_reset(connector,
+					    &conn_state->base);
+
 	if (fkms_connector->display_type == DRM_MODE_ENCODER_DSI) {
 		drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
 				   DRM_MODE_CONNECTOR_DSI);
@@ -1403,10 +1561,14 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 		connector->interlace_allowed = 0;
 	}
 
-	/* Create and attach TV margin props to this connector. */
-	ret = drm_mode_create_tv_margin_properties(dev);
-	if (ret)
-		return ERR_PTR(ret);
+	/* Create and attach TV margin props to this connector.
+	 * Already done for SDTV outputs.
+	 */
+	if (fkms_connector->display_type != DRM_MODE_ENCODER_TVDAC) {
+		ret = drm_mode_create_tv_margin_properties(dev);
+		if (ret)
+			goto fail;
+	}
 
 	drm_connector_attach_tv_margin_properties(connector);
 
@@ -1415,6 +1577,8 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 
 	connector->doublescan_allowed = 0;
 
+	vc4_attach_broadcast_rgb_property(fkms_connector);
+
 	drm_connector_attach_encoder(connector, encoder);
 
 	return connector;
-- 
GitLab


From 1039d354cbdb917b4e532c45c65635ce7ae2a1c7 Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:48 +0200
Subject: [PATCH 1262/1835] drm/connector: Add documentation for
 drm_cmdline_mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 772cd52c5574b04b00a97d638b2cfe94c0c1a9b6 upstream.

The struct drm_cmdline_mode holds the result of the command line parsers.
However, it wasn't documented so far, so let's do that.

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/963c893c16c6a25fc469b53c726f493d99bdc578.1560783090.git-series.maxime.ripard@bootlin.com
---
 include/drm/drm_connector.h | 86 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 84 insertions(+), 2 deletions(-)

diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 342a4db4b0c13..83ed80edb0830 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -755,18 +755,100 @@ struct drm_connector_funcs {
 				   const struct drm_connector_state *state);
 };
 
-/* mode specified on the command line */
+/**
+ * struct drm_cmdline_mode - DRM Mode passed through the kernel command-line
+ *
+ * Each connector can have an initial mode with additional options
+ * passed through the kernel command line. This structure allows to
+ * express those parameters and will be filled by the command-line
+ * parser.
+ */
 struct drm_cmdline_mode {
+	/**
+	 * @specified:
+	 *
+	 * Has a mode been read from the command-line?
+	 */
 	bool specified;
+
+	/**
+	 * @refresh_specified:
+	 *
+	 * Did the mode have a preferred refresh rate?
+	 */
 	bool refresh_specified;
+
+	/**
+	 * @bpp_specified:
+	 *
+	 * Did the mode have a preferred BPP?
+	 */
 	bool bpp_specified;
-	int xres, yres;
+
+	/**
+	 * @xres:
+	 *
+	 * Active resolution on the X axis, in pixels.
+	 */
+	int xres;
+
+	/**
+	 * @yres:
+	 *
+	 * Active resolution on the Y axis, in pixels.
+	 */
+	int yres;
+
+	/**
+	 * @bpp:
+	 *
+	 * Bits per pixels for the mode.
+	 */
 	int bpp;
+
+	/**
+	 * @refresh:
+	 *
+	 * Refresh rate, in Hertz.
+	 */
 	int refresh;
+
+	/**
+	 * @rb:
+	 *
+	 * Do we need to use reduced blanking?
+	 */
 	bool rb;
+
+	/**
+	 * @interlace:
+	 *
+	 * The mode is interlaced.
+	 */
 	bool interlace;
+
+	/**
+	 * @cvt:
+	 *
+	 * The timings will be calculated using the VESA Coordinated
+	 * Video Timings instead of looking up the mode from a table.
+	 */
 	bool cvt;
+
+	/**
+	 * @margins:
+	 *
+	 * Add margins to the mode calculation (1.8% of xres rounded
+	 * down to 8 pixels and 1.8% of yres).
+	 */
 	bool margins;
+
+	/**
+	 * @force:
+	 *
+	 * Ignore the hotplug state of the connector, and force its
+	 * state to one of the DRM_FORCE_* values.
+	 */
 	enum drm_connector_force force;
 };
 
-- 
GitLab


From 402f0b03a46f4dcaf83e89cfca8edfa9057831e1 Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:49 +0200
Subject: [PATCH 1263/1835] drm/modes: Rewrite the command line parser
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e08ab74bd4c7a5fe311bc05f32dbb4f1e7fa3428 upstream.

Rewrite the command line parser in order to get away from the state machine
parsing the video mode lines.

Hopefully, this will allow to extend it more easily to support named modes
and / or properties set directly on the command line.

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/e32cd4009153b184103554009135c7bf7c9975d7.1560783090.git-series.maxime.ripard@bootlin.com
---
 drivers/gpu/drm/drm_modes.c | 325 +++++++++++++++++++++++-------------
 1 file changed, 210 insertions(+), 115 deletions(-)

diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index a3104d79b48f0..faae19afa6862 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -30,6 +30,7 @@
  * authorization from the copyright holder(s) and author(s).
  */
 
+#include <linux/ctype.h>
 #include <linux/list.h>
 #include <linux/list_sort.h>
 #include <linux/export.h>
@@ -1414,6 +1415,151 @@ void drm_connector_list_update(struct drm_connector *connector)
 }
 EXPORT_SYMBOL(drm_connector_list_update);
 
+static int drm_mode_parse_cmdline_bpp(const char *str, char **end_ptr,
+				      struct drm_cmdline_mode *mode)
+{
+	unsigned int bpp;
+
+	if (str[0] != '-')
+		return -EINVAL;
+
+	str++;
+	bpp = simple_strtol(str, end_ptr, 10);
+	if (*end_ptr == str)
+		return -EINVAL;
+
+	mode->bpp = bpp;
+	mode->bpp_specified = true;
+
+	return 0;
+}
+
+static int drm_mode_parse_cmdline_refresh(const char *str, char **end_ptr,
+					  struct drm_cmdline_mode *mode)
+{
+	unsigned int refresh;
+
+	if (str[0] != '@')
+		return -EINVAL;
+
+	str++;
+	refresh = simple_strtol(str, end_ptr, 10);
+	if (*end_ptr == str)
+		return -EINVAL;
+
+	mode->refresh = refresh;
+	mode->refresh_specified = true;
+
+	return 0;
+}
+
+static int drm_mode_parse_cmdline_extra(const char *str, int length,
+					struct drm_connector *connector,
+					struct drm_cmdline_mode *mode)
+{
+	int i;
+
+	for (i = 0; i < length; i++) {
+		switch (str[i]) {
+		case 'i':
+			mode->interlace = true;
+			break;
+		case 'm':
+			mode->margins = true;
+			break;
+		case 'D':
+			if (mode->force != DRM_FORCE_UNSPECIFIED)
+				return -EINVAL;
+
+			if ((connector->connector_type != DRM_MODE_CONNECTOR_DVII) &&
+			    (connector->connector_type != DRM_MODE_CONNECTOR_HDMIB))
+				mode->force = DRM_FORCE_ON;
+			else
+				mode->force = DRM_FORCE_ON_DIGITAL;
+			break;
+		case 'd':
+			if (mode->force != DRM_FORCE_UNSPECIFIED)
+				return -EINVAL;
+
+			mode->force = DRM_FORCE_OFF;
+			break;
+		case 'e':
+			if (mode->force != DRM_FORCE_UNSPECIFIED)
+				return -EINVAL;
+
+			mode->force = DRM_FORCE_ON;
+			break;
+		default:
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static int drm_mode_parse_cmdline_res_mode(const char *str, unsigned int length,
+					   bool extras,
+					   struct drm_connector *connector,
+					   struct drm_cmdline_mode *mode)
+{
+	const char *str_start = str;
+	bool rb = false, cvt = false;
+	int xres = 0, yres = 0;
+	int remaining, i;
+	char *end_ptr;
+
+	xres = simple_strtol(str, &end_ptr, 10);
+	if (end_ptr == str)
+		return -EINVAL;
+
+	if (end_ptr[0] != 'x')
+		return -EINVAL;
+	end_ptr++;
+
+	str = end_ptr;
+	yres = simple_strtol(str, &end_ptr, 10);
+	if (end_ptr == str)
+		return -EINVAL;
+
+	remaining = length - (end_ptr - str_start);
+	if (remaining < 0)
+		return -EINVAL;
+
+	for (i = 0; i < remaining; i++) {
+		switch (end_ptr[i]) {
+		case 'M':
+			cvt = true;
+			break;
+		case 'R':
+			rb = true;
+			break;
+		default:
+			/*
+			 * Try to pass that to our extras parsing
+			 * function to handle the case where the
+			 * extras are directly after the resolution
+			 */
+			if (extras) {
+				int ret = drm_mode_parse_cmdline_extra(end_ptr + i,
+								       1,
+								       connector,
+								       mode);
+				if (ret)
+					return ret;
+			} else {
+				return -EINVAL;
+			}
+		}
+	}
+
+	mode->xres = xres;
+	mode->yres = yres;
+	mode->cvt = cvt;
+	mode->rb = rb;
+
+	return 0;
+}
+
 /**
  * drm_mode_parse_command_line_for_connector - parse command line modeline for connector
  * @mode_option: optional per connector mode option
@@ -1440,13 +1586,12 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 					       struct drm_cmdline_mode *mode)
 {
 	const char *name;
-	unsigned int namelen;
-	bool res_specified = false, bpp_specified = false, refresh_specified = false;
-	unsigned int xres = 0, yres = 0, bpp = 32, refresh = 0;
-	bool yres_specified = false, cvt = false, rb = false;
-	bool interlace = false, margins = false, was_digit = false;
-	int i;
-	enum drm_connector_force force = DRM_FORCE_UNSPECIFIED;
+	bool parse_extras = false;
+	unsigned int bpp_off = 0, refresh_off = 0;
+	unsigned int mode_end = 0;
+	char *bpp_ptr = NULL, *refresh_ptr = NULL, *extra_ptr = NULL;
+	char *bpp_end_ptr = NULL, *refresh_end_ptr = NULL;
+	int ret;
 
 #ifdef CONFIG_FB
 	if (!mode_option)
@@ -1459,127 +1604,77 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 	}
 
 	name = mode_option;
-	namelen = strlen(name);
-	for (i = namelen-1; i >= 0; i--) {
-		switch (name[i]) {
-		case '@':
-			if (!refresh_specified && !bpp_specified &&
-			    !yres_specified && !cvt && !rb && was_digit) {
-				refresh = simple_strtol(&name[i+1], NULL, 10);
-				refresh_specified = true;
-				was_digit = false;
-			} else
-				goto done;
-			break;
-		case '-':
-			if (!bpp_specified && !yres_specified && !cvt &&
-			    !rb && was_digit) {
-				bpp = simple_strtol(&name[i+1], NULL, 10);
-				bpp_specified = true;
-				was_digit = false;
-			} else
-				goto done;
-			break;
-		case 'x':
-			if (!yres_specified && was_digit) {
-				yres = simple_strtol(&name[i+1], NULL, 10);
-				yres_specified = true;
-				was_digit = false;
-			} else
-				goto done;
-			break;
-		case '0' ... '9':
-			was_digit = true;
-			break;
-		case 'M':
-			if (yres_specified || cvt || was_digit)
-				goto done;
-			cvt = true;
-			break;
-		case 'R':
-			if (yres_specified || cvt || rb || was_digit)
-				goto done;
-			rb = true;
-			break;
-		case 'm':
-			if (cvt || yres_specified || was_digit)
-				goto done;
-			margins = true;
-			break;
-		case 'i':
-			if (cvt || yres_specified || was_digit)
-				goto done;
-			interlace = true;
-			break;
-		case 'e':
-			if (yres_specified || bpp_specified || refresh_specified ||
-			    was_digit || (force != DRM_FORCE_UNSPECIFIED))
-				goto done;
 
-			force = DRM_FORCE_ON;
-			break;
-		case 'D':
-			if (yres_specified || bpp_specified || refresh_specified ||
-			    was_digit || (force != DRM_FORCE_UNSPECIFIED))
-				goto done;
+	if (!isdigit(name[0]))
+		return false;
 
-			if ((connector->connector_type != DRM_MODE_CONNECTOR_DVII) &&
-			    (connector->connector_type != DRM_MODE_CONNECTOR_HDMIB))
-				force = DRM_FORCE_ON;
-			else
-				force = DRM_FORCE_ON_DIGITAL;
-			break;
-		case 'd':
-			if (yres_specified || bpp_specified || refresh_specified ||
-			    was_digit || (force != DRM_FORCE_UNSPECIFIED))
-				goto done;
+	/* Try to locate the bpp and refresh specifiers, if any */
+	bpp_ptr = strchr(name, '-');
+	if (bpp_ptr) {
+		bpp_off = bpp_ptr - name;
+		mode->bpp_specified = true;
+	}
 
-			force = DRM_FORCE_OFF;
-			break;
-		default:
-			goto done;
-		}
+	refresh_ptr = strchr(name, '@');
+	if (refresh_ptr) {
+		refresh_off = refresh_ptr - name;
+		mode->refresh_specified = true;
 	}
 
-	if (i < 0 && yres_specified) {
-		char *ch;
-		xres = simple_strtol(name, &ch, 10);
-		if ((ch != NULL) && (*ch == 'x'))
-			res_specified = true;
-		else
-			i = ch - name;
-	} else if (!yres_specified && was_digit) {
-		/* catch mode that begins with digits but has no 'x' */
-		i = 0;
+	/* Locate the end of the name / resolution, and parse it */
+	if (bpp_ptr && refresh_ptr) {
+		mode_end = min(bpp_off, refresh_off);
+	} else if (bpp_ptr) {
+		mode_end = bpp_off;
+	} else if (refresh_ptr) {
+		mode_end = refresh_off;
+	} else {
+		mode_end = strlen(name);
+		parse_extras = true;
 	}
-done:
-	if (i >= 0) {
-		pr_warn("[drm] parse error at position %i in video mode '%s'\n",
-			i, name);
-		mode->specified = false;
+
+	ret = drm_mode_parse_cmdline_res_mode(name, mode_end,
+					      parse_extras,
+					      connector,
+					      mode);
+	if (ret)
 		return false;
-	}
+	mode->specified = true;
 
-	if (res_specified) {
-		mode->specified = true;
-		mode->xres = xres;
-		mode->yres = yres;
+	if (bpp_ptr) {
+		ret = drm_mode_parse_cmdline_bpp(bpp_ptr, &bpp_end_ptr, mode);
+		if (ret)
+			return false;
 	}
 
-	if (refresh_specified) {
-		mode->refresh_specified = true;
-		mode->refresh = refresh;
+	if (refresh_ptr) {
+		ret = drm_mode_parse_cmdline_refresh(refresh_ptr,
+						     &refresh_end_ptr, mode);
+		if (ret)
+			return false;
 	}
 
-	if (bpp_specified) {
-		mode->bpp_specified = true;
-		mode->bpp = bpp;
+	/*
+	 * Locate the end of the bpp / refresh, and parse the extras
+	 * if relevant
+	 */
+	if (bpp_ptr && refresh_ptr)
+		extra_ptr = max(bpp_end_ptr, refresh_end_ptr);
+	else if (bpp_ptr)
+		extra_ptr = bpp_end_ptr;
+	else if (refresh_ptr)
+		extra_ptr = refresh_end_ptr;
+
+	if (extra_ptr) {
+		int remaining = strlen(name) - (extra_ptr - name);
+
+		/*
+		 * We still have characters to process, while
+		 * we shouldn't have any
+		 */
+		if (remaining > 0)
+			return false;
 	}
-	mode->rb = rb;
-	mode->cvt = cvt;
-	mode->interlace = interlace;
-	mode->margins = margins;
-	mode->force = force;
 
 	return true;
 }
-- 
GitLab


From 5329799326fa5bab28d5cbc9c8bb045478f24ba2 Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:50 +0200
Subject: [PATCH 1264/1835] drm/modes: Support modes names on the command line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 3aeeb13d899627fe2b86bdbdcd0927cf7192234f upstream.
Minor conflict resolution as upstream has moved functions
from drm_fb_helper.c to a new drm_client_modeset.c

The drm subsystem also uses the video= kernel parameter, and in the
documentation refers to the fbdev documentation for that parameter.

However, that documentation also says that instead of giving the mode using
its resolution we can also give a name. However, DRM doesn't handle that
case at the moment. Even though in most case it shouldn't make any
difference, it might be useful for analog modes, where different standards
might have the same resolution, but still have a few different parameters
that are not encoded in the modes (NTSC vs NTSC-J vs PAL-M for example).

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/18443e0c3bdbbd16cea4ec63bc7f2079b820b43b.1560783090.git-series.maxime.ripard@bootlin.com
---
 drivers/gpu/drm/drm_connector.c |  3 +-
 drivers/gpu/drm/drm_fb_helper.c |  4 +++
 drivers/gpu/drm/drm_modes.c     | 62 ++++++++++++++++++++++++---------
 include/drm/drm_connector.h     |  7 ++++
 4 files changed, 59 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index bbc3f3ed47a85..ff0996f49b211 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -135,8 +135,9 @@ static void drm_connector_get_cmdline_mode(struct drm_connector *connector)
 		connector->force = mode->force;
 	}
 
-	DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n",
+	DRM_DEBUG_KMS("cmdline mode for connector %s %s %dx%d@%dHz%s%s%s\n",
 		      connector->name,
+		      mode->name ? mode->name : "",
 		      mode->xres, mode->yres,
 		      mode->refresh_specified ? mode->refresh : 60,
 		      mode->rb ? " reduced blanking" : "",
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 8b546fde139d6..c8a8e0d7212d8 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2099,6 +2099,10 @@ struct drm_display_mode *drm_pick_cmdline_mode(struct drm_fb_helper_connector *f
 	prefer_non_interlace = !cmdline_mode->interlace;
 again:
 	list_for_each_entry(mode, &fb_helper_conn->connector->modes, head) {
+		/* Check (optional) mode name first */
+		if (!strcmp(mode->name, cmdline_mode->name))
+			return mode;
+
 		/* check width/height */
 		if (mode->hdisplay != cmdline_mode->xres ||
 		    mode->vdisplay != cmdline_mode->yres)
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index faae19afa6862..c6ce1d526b10b 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1586,7 +1586,7 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 					       struct drm_cmdline_mode *mode)
 {
 	const char *name;
-	bool parse_extras = false;
+	bool named_mode = false, parse_extras = false;
 	unsigned int bpp_off = 0, refresh_off = 0;
 	unsigned int mode_end = 0;
 	char *bpp_ptr = NULL, *refresh_ptr = NULL, *extra_ptr = NULL;
@@ -1605,8 +1605,22 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 
 	name = mode_option;
 
-	if (!isdigit(name[0]))
-		return false;
+	/*
+	 * This is a bit convoluted. To differentiate between the
+	 * named modes and poorly formatted resolutions, we need a
+	 * bunch of things:
+	 *   - We need to make sure that the first character (which
+	 *     would be our resolution in X) is a digit.
+	 *   - However, if the X resolution is missing, then we end up
+	 *     with something like x<yres>, with our first character
+	 *     being an alpha-numerical character, which would be
+	 *     considered a named mode.
+	 *
+	 * If this isn't enough, we should add more heuristics here,
+	 * and matching unit-tests.
+	 */
+	if (!isdigit(name[0]) && name[0] != 'x')
+		named_mode = true;
 
 	/* Try to locate the bpp and refresh specifiers, if any */
 	bpp_ptr = strchr(name, '-');
@@ -1617,6 +1631,9 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 
 	refresh_ptr = strchr(name, '@');
 	if (refresh_ptr) {
+		if (named_mode)
+			return false;
+
 		refresh_off = refresh_ptr - name;
 		mode->refresh_specified = true;
 	}
@@ -1633,12 +1650,16 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 		parse_extras = true;
 	}
 
-	ret = drm_mode_parse_cmdline_res_mode(name, mode_end,
-					      parse_extras,
-					      connector,
-					      mode);
-	if (ret)
-		return false;
+	if (named_mode) {
+		strncpy(mode->name, name, mode_end);
+	} else {
+		ret = drm_mode_parse_cmdline_res_mode(name, mode_end,
+						      parse_extras,
+						      connector,
+						      mode);
+		if (ret)
+			return false;
+	}
 	mode->specified = true;
 
 	if (bpp_ptr) {
@@ -1666,14 +1687,23 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 		extra_ptr = refresh_end_ptr;
 
 	if (extra_ptr) {
-		int remaining = strlen(name) - (extra_ptr - name);
+		if (!named_mode) {
+			int len = strlen(name) - (extra_ptr - name);
 
-		/*
-		 * We still have characters to process, while
-		 * we shouldn't have any
-		 */
-		if (remaining > 0)
-			return false;
+			ret = drm_mode_parse_cmdline_extra(extra_ptr, len,
+							   connector, mode);
+			if (ret)
+				return false;
+		} else {
+			int remaining = strlen(name) - (extra_ptr - name);
+
+			/*
+			 * We still have characters to process, while
+			 * we shouldn't have any
+			 */
+			if (remaining > 0)
+				return false;
+		}
 	}
 
 	return true;
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 83ed80edb0830..9ffd8e931ee03 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -764,6 +764,13 @@ struct drm_connector_funcs {
  * parser.
  */
 struct drm_cmdline_mode {
+	/**
+	 * @name:
+	 *
+	 * Name of the mode.
+	 */
+	char name[DRM_DISPLAY_MODE_LEN];
+
 	/**
 	 * @specified:
 	 *
-- 
GitLab


From 119273663afb44806748f42af20333ce8b6cfa08 Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:51 +0200
Subject: [PATCH 1265/1835] drm/modes: Allow to specify rotation and reflection
 on the commandline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 1bf4e09227c345e246062285eba4b8fe660e512e upstream.
Minor conflict resolution as upstream has moved functions
from drm_fb_helper.c to a new drm_client_modeset.c

Rotations and reflections setup are needed in some scenarios to initialise
properly the initial framebuffer. Some drivers already had a bunch of
quirks to deal with this, such as either a private kernel command line
parameter (omapdss) or on the device tree (various panels).

In order to accomodate this, let's create a video mode parameter to deal
with the rotation and reflexion.

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/777da16e42db757c1f5b414b5ca34507097fed5c.1560783090.git-series.maxime.ripard@bootlin.com
---
 Documentation/fb/modedb.txt     |  12 ++++
 drivers/gpu/drm/drm_fb_helper.c |  30 +++++++++
 drivers/gpu/drm/drm_modes.c     | 114 ++++++++++++++++++++++++++------
 include/drm/drm_connector.h     |  10 +++
 4 files changed, 146 insertions(+), 20 deletions(-)

diff --git a/Documentation/fb/modedb.txt b/Documentation/fb/modedb.txt
index 16aa08453911c..52418c6dbfc45 100644
--- a/Documentation/fb/modedb.txt
+++ b/Documentation/fb/modedb.txt
@@ -51,6 +51,18 @@ To force the VGA output to be enabled and drive a specific mode say:
 Specifying the option multiple times for different ports is possible, e.g.:
     video=LVDS-1:d video=HDMI-1:D
 
+Options can also be passed after the mode, using commas as separator.
+
+       Sample usage: 720x480,rotate=180 - 720x480 mode, rotated by 180 degrees
+
+Valid options are:
+
+  - reflect_x (boolean): Perform an axial symmetry on the X axis
+  - reflect_y (boolean): Perform an axial symmetry on the Y axis
+  - rotate (integer): Rotate the initial framebuffer by x
+    degrees. Valid values are 0, 90, 180 and 270.
+
+
 ***** oOo ***** oOo ***** oOo ***** oOo ***** oOo ***** oOo ***** oOo *****
 
 What is the VESA(TM) Coordinated Video Timings (CVT)?
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index c8a8e0d7212d8..cfa272fab56a9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2464,6 +2464,7 @@ static void drm_setup_crtc_rotation(struct drm_fb_helper *fb_helper,
 				    struct drm_connector *connector)
 {
 	struct drm_plane *plane = fb_crtc->mode_set.crtc->primary;
+	struct drm_cmdline_mode *cmdline;
 	uint64_t valid_mask = 0;
 	int i, rotation;
 
@@ -2483,6 +2484,35 @@ static void drm_setup_crtc_rotation(struct drm_fb_helper *fb_helper,
 		rotation = DRM_MODE_ROTATE_0;
 	}
 
+	/**
+	 * The panel already defined the default rotation
+	 * through its orientation. Whatever has been provided
+	 * on the command line needs to be added to that.
+	 *
+	 * Unfortunately, the rotations are at different bit
+	 * indices, so the math to add them up are not as
+	 * trivial as they could.
+	 *
+	 * Reflections on the other hand are pretty trivial to deal with, a
+	 * simple XOR between the two handle the addition nicely.
+	 */
+	cmdline = &connector->cmdline_mode;
+	if (cmdline->specified) {
+		unsigned int cmdline_rest, panel_rest;
+		unsigned int cmdline_rot, panel_rot;
+		unsigned int sum_rot, sum_rest;
+
+		panel_rot = ilog2(rotation & DRM_MODE_ROTATE_MASK);
+		cmdline_rot = ilog2(cmdline->rotation_reflection & DRM_MODE_ROTATE_MASK);
+		sum_rot = (panel_rot + cmdline_rot) % 4;
+
+		panel_rest = rotation & ~DRM_MODE_ROTATE_MASK;
+		cmdline_rest = cmdline->rotation_reflection & ~DRM_MODE_ROTATE_MASK;
+		sum_rest = panel_rest ^ cmdline_rest;
+
+		rotation = (1 << sum_rot) | sum_rest;
+	}
+
 	/*
 	 * TODO: support 90 / 270 degree hardware rotation,
 	 * depending on the hardware this may require the framebuffer
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index c6ce1d526b10b..b5eed64d7349c 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1560,6 +1560,71 @@ static int drm_mode_parse_cmdline_res_mode(const char *str, unsigned int length,
 	return 0;
 }
 
+static int drm_mode_parse_cmdline_options(char *str, size_t len,
+					  struct drm_connector *connector,
+					  struct drm_cmdline_mode *mode)
+{
+	unsigned int rotation = 0;
+	char *sep = str;
+
+	while ((sep = strchr(sep, ','))) {
+		char *delim, *option;
+
+		option = sep + 1;
+		delim = strchr(option, '=');
+		if (!delim) {
+			delim = strchr(option, ',');
+
+			if (!delim)
+				delim = str + len;
+		}
+
+		if (!strncmp(option, "rotate", delim - option)) {
+			const char *value = delim + 1;
+			unsigned int deg;
+
+			deg = simple_strtol(value, &sep, 10);
+
+			/* Make sure we have parsed something */
+			if (sep == value)
+				return -EINVAL;
+
+			switch (deg) {
+			case 0:
+				rotation |= DRM_MODE_ROTATE_0;
+				break;
+
+			case 90:
+				rotation |= DRM_MODE_ROTATE_90;
+				break;
+
+			case 180:
+				rotation |= DRM_MODE_ROTATE_180;
+				break;
+
+			case 270:
+				rotation |= DRM_MODE_ROTATE_270;
+				break;
+
+			default:
+				return -EINVAL;
+			}
+		} else if (!strncmp(option, "reflect_x", delim - option)) {
+			rotation |= DRM_MODE_REFLECT_X;
+			sep = delim;
+		} else if (!strncmp(option, "reflect_y", delim - option)) {
+			rotation |= DRM_MODE_REFLECT_Y;
+			sep = delim;
+		} else {
+			return -EINVAL;
+		}
+	}
+
+	mode->rotation_reflection = rotation;
+
+	return 0;
+}
+
 /**
  * drm_mode_parse_command_line_for_connector - parse command line modeline for connector
  * @mode_option: optional per connector mode option
@@ -1575,6 +1640,10 @@ static int drm_mode_parse_cmdline_res_mode(const char *str, unsigned int length,
  *
  *	<xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m][eDd]
  *
+ * Additionals options can be provided following the mode, using a comma to
+ * separate each option. Valid options can be found in
+ * Documentation/fb/modedb.txt.
+ *
  * The intermediate drm_cmdline_mode structure is required to store additional
  * options from the command line modline like the force-enable/disable flag.
  *
@@ -1587,9 +1656,10 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 {
 	const char *name;
 	bool named_mode = false, parse_extras = false;
-	unsigned int bpp_off = 0, refresh_off = 0;
+	unsigned int bpp_off = 0, refresh_off = 0, options_off = 0;
 	unsigned int mode_end = 0;
 	char *bpp_ptr = NULL, *refresh_ptr = NULL, *extra_ptr = NULL;
+	char *options_ptr = NULL;
 	char *bpp_end_ptr = NULL, *refresh_end_ptr = NULL;
 	int ret;
 
@@ -1638,13 +1708,18 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 		mode->refresh_specified = true;
 	}
 
+	/* Locate the start of named options */
+	options_ptr = strchr(name, ',');
+	if (options_ptr)
+		options_off = options_ptr - name;
+
 	/* Locate the end of the name / resolution, and parse it */
-	if (bpp_ptr && refresh_ptr) {
-		mode_end = min(bpp_off, refresh_off);
-	} else if (bpp_ptr) {
+	if (bpp_ptr) {
 		mode_end = bpp_off;
 	} else if (refresh_ptr) {
 		mode_end = refresh_off;
+	} else if (options_ptr) {
+		mode_end = options_off;
 	} else {
 		mode_end = strlen(name);
 		parse_extras = true;
@@ -1686,24 +1761,23 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
 	else if (refresh_ptr)
 		extra_ptr = refresh_end_ptr;
 
-	if (extra_ptr) {
-		if (!named_mode) {
-			int len = strlen(name) - (extra_ptr - name);
+	if (extra_ptr &&
+	    extra_ptr != options_ptr) {
+		int len = strlen(name) - (extra_ptr - name);
 
-			ret = drm_mode_parse_cmdline_extra(extra_ptr, len,
-							   connector, mode);
-			if (ret)
-				return false;
-		} else {
-			int remaining = strlen(name) - (extra_ptr - name);
+		ret = drm_mode_parse_cmdline_extra(extra_ptr, len,
+						   connector, mode);
+		if (ret)
+			return false;
+	}
 
-			/*
-			 * We still have characters to process, while
-			 * we shouldn't have any
-			 */
-			if (remaining > 0)
-				return false;
-		}
+	if (options_ptr) {
+		int len = strlen(name) - (options_ptr - name);
+
+		ret = drm_mode_parse_cmdline_options(options_ptr, len,
+						     connector, mode);
+		if (ret)
+			return false;
 	}
 
 	return true;
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 9ffd8e931ee03..37e9bae302248 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -857,6 +857,16 @@ struct drm_cmdline_mode {
 	 * state to one of the DRM_FORCE_* values.
 	 */
 	enum drm_connector_force force;
+
+	/**
+	 * @rotation_reflection:
+	 *
+	 * Initial rotation and reflection of the mode setup from the
+	 * command line. See DRM_MODE_ROTATE_* and
+	 * DRM_MODE_REFLECT_*. The only rotations supported are
+	 * DRM_MODE_ROTATE_0 and DRM_MODE_ROTATE_180.
+	 */
+	unsigned int rotation_reflection;
 };
 
 /**
-- 
GitLab


From e5f25780cd3af08542c64fbdbe4d266b6e355b7d Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:51 +0200
Subject: [PATCH 1266/1835] drm/connector: Introduce a TV margins structure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 22045e8e52bd802f743f0471242782fc3b479707 upstream.

The TV margins has been defined as a structure inside the
drm_connector_state structure so far. However, we will need it in other
structures as well, so let's move that structure definition so that it can
be reused.

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/38b773b03f15ec7a135cdf8f7db669e5ada20cf2.1560783090.git-series.maxime.ripard@bootlin.com
---
 include/drm/drm_connector.h | 41 +++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 37e9bae302248..7789fbf785e91 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -343,14 +343,38 @@ int drm_display_info_set_bus_formats(struct drm_display_info *info,
 				     const u32 *formats,
 				     unsigned int num_formats);
 
+/**
+ * struct drm_connector_tv_margins - TV connector related margins
+ *
+ * Describes the margins in pixels to put around the image on TV
+ * connectors to deal with overscan.
+ */
+struct drm_connector_tv_margins {
+	/**
+	 * @bottom: Bottom margin in pixels.
+	 */
+	unsigned int bottom;
+
+	/**
+	 * @left: Left margin in pixels.
+	 */
+	unsigned int left;
+
+	/**
+	 * @right: Right margin in pixels.
+	 */
+	unsigned int right;
+
+	/**
+	 * @top: Top margin in pixels.
+	 */
+	unsigned int top;
+};
+
 /**
  * struct drm_tv_connector_state - TV connector related states
  * @subconnector: selected subconnector
- * @margins: margins (all margins are expressed in pixels)
- * @margins.left: left margin
- * @margins.right: right margin
- * @margins.top: top margin
- * @margins.bottom: bottom margin
+ * @margins: TV margins
  * @mode: TV mode
  * @brightness: brightness in percent
  * @contrast: contrast in percent
@@ -361,12 +385,7 @@ int drm_display_info_set_bus_formats(struct drm_display_info *info,
  */
 struct drm_tv_connector_state {
 	enum drm_mode_subconnector subconnector;
-	struct {
-		unsigned int left;
-		unsigned int right;
-		unsigned int top;
-		unsigned int bottom;
-	} margins;
+	struct drm_connector_tv_margins margins;
 	unsigned int mode;
 	unsigned int brightness;
 	unsigned int contrast;
-- 
GitLab


From 43e6a2a4ce7bf5fc75a4dcad706cca33db8d7e7e Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:51 +0200
Subject: [PATCH 1267/1835] drm/modes: Parse overscan properties
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 3d46a3007cd8f73bae502bf5c171977b91d7aacc upstream.

Properly configuring the overscan properties might be needed for the
initial setup of the framebuffer for display that still have overscan.
Let's allow for more properties on the kernel command line to setup each
margin.

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/e481f1628e3768ca49226ec2115cfa4dfcbd5e4c.1560783090.git-series.maxime.ripard@bootlin.com
---
 Documentation/fb/modedb.txt |  2 ++
 drivers/gpu/drm/drm_modes.c | 44 +++++++++++++++++++++++++++++++++++++
 include/drm/drm_connector.h |  5 +++++
 3 files changed, 51 insertions(+)

diff --git a/Documentation/fb/modedb.txt b/Documentation/fb/modedb.txt
index 52418c6dbfc45..1dd5a52f9390f 100644
--- a/Documentation/fb/modedb.txt
+++ b/Documentation/fb/modedb.txt
@@ -57,6 +57,8 @@ Options can also be passed after the mode, using commas as separator.
 
 Valid options are:
 
+  - margin_top, margin_bottom, margin_left, margin_right (integer):
+    Number of pixels in the margins, typically to deal with overscan on TVs
   - reflect_x (boolean): Perform an axial symmetry on the X axis
   - reflect_y (boolean): Perform an axial symmetry on the Y axis
   - rotate (integer): Rotate the initial framebuffer by x
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index b5eed64d7349c..243de91ee9ee1 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1615,6 +1615,50 @@ static int drm_mode_parse_cmdline_options(char *str, size_t len,
 		} else if (!strncmp(option, "reflect_y", delim - option)) {
 			rotation |= DRM_MODE_REFLECT_Y;
 			sep = delim;
+		} else if (!strncmp(option, "margin_right", delim - option)) {
+			const char *value = delim + 1;
+			unsigned int margin;
+
+			margin = simple_strtol(value, &sep, 10);
+
+			/* Make sure we have parsed something */
+			if (sep == value)
+				return -EINVAL;
+
+			mode->tv_margins.right = margin;
+		} else if (!strncmp(option, "margin_left", delim - option)) {
+			const char *value = delim + 1;
+			unsigned int margin;
+
+			margin = simple_strtol(value, &sep, 10);
+
+			/* Make sure we have parsed something */
+			if (sep == value)
+				return -EINVAL;
+
+			mode->tv_margins.left = margin;
+		} else if (!strncmp(option, "margin_top", delim - option)) {
+			const char *value = delim + 1;
+			unsigned int margin;
+
+			margin = simple_strtol(value, &sep, 10);
+
+			/* Make sure we have parsed something */
+			if (sep == value)
+				return -EINVAL;
+
+			mode->tv_margins.top = margin;
+		} else if (!strncmp(option, "margin_bottom", delim - option)) {
+			const char *value = delim + 1;
+			unsigned int margin;
+
+			margin = simple_strtol(value, &sep, 10);
+
+			/* Make sure we have parsed something */
+			if (sep == value)
+				return -EINVAL;
+
+			mode->tv_margins.bottom = margin;
 		} else {
 			return -EINVAL;
 		}
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 7789fbf785e91..6712a934c051b 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -886,6 +886,11 @@ struct drm_cmdline_mode {
 	 * DRM_MODE_ROTATE_0 and DRM_MODE_ROTATE_180.
 	 */
 	unsigned int rotation_reflection;
+
+	/**
+	 * @tv_margins: TV margins to apply to the mode.
+	 */
+	struct drm_connector_tv_margins tv_margins;
 };
 
 /**
-- 
GitLab


From c26132f177c3417531b80d1c3984c10a48e513e6 Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:52 +0200
Subject: [PATCH 1268/1835] drm/atomic: Add a function to reset connector TV
 properties
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 731514b446fe6748d5a55a3dff202efb45c7d8df upstream.
Reworked as functions have been moved from drm_atomic_helper.[c|h]
to drm_atomic_state_helper.[c|h].

During the connector reset, if that connector has a TV property, it needs
to be reset to the value provided on the command line.

Provide a helper to do that.

Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/84a7b657f09303a2850e1cc79e68f623547f3fdd.1560783090.git-series.maxime.ripard@bootlin.com
---
 drivers/gpu/drm/drm_atomic_helper.c | 18 ++++++++++++++++++
 include/drm/drm_atomic_helper.h     |  1 +
 2 files changed, 19 insertions(+)

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index c22062cc99923..2f416b283ef8d 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -3736,6 +3736,24 @@ void drm_atomic_helper_connector_reset(struct drm_connector *connector)
 }
 EXPORT_SYMBOL(drm_atomic_helper_connector_reset);
 
+/**
+ * drm_atomic_helper_connector_tv_reset - Resets TV connector properties
+ * @connector: DRM connector
+ *
+ * Resets the TV-related properties attached to a connector.
+ */
+void drm_atomic_helper_connector_tv_reset(struct drm_connector *connector)
+{
+	struct drm_cmdline_mode *cmdline = &connector->cmdline_mode;
+	struct drm_connector_state *state = connector->state;
+
+	state->tv.margins.left = cmdline->tv_margins.left;
+	state->tv.margins.right = cmdline->tv_margins.right;
+	state->tv.margins.top = cmdline->tv_margins.top;
+	state->tv.margins.bottom = cmdline->tv_margins.bottom;
+}
+EXPORT_SYMBOL(drm_atomic_helper_connector_tv_reset);
+
 /**
  * __drm_atomic_helper_connector_duplicate_state - copy atomic connector state
  * @connector: connector object
diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h
index 99e2a5297c697..f88752489d0c0 100644
--- a/include/drm/drm_atomic_helper.h
+++ b/include/drm/drm_atomic_helper.h
@@ -168,6 +168,7 @@ void drm_atomic_helper_plane_destroy_state(struct drm_plane *plane,
 void __drm_atomic_helper_connector_reset(struct drm_connector *connector,
 					 struct drm_connector_state *conn_state);
 void drm_atomic_helper_connector_reset(struct drm_connector *connector);
+void drm_atomic_helper_connector_tv_reset(struct drm_connector *connector);
 void
 __drm_atomic_helper_connector_duplicate_state(struct drm_connector *connector,
 					   struct drm_connector_state *state);
-- 
GitLab


From d217f5cdcef652124a39e318cde98bfdfa677a74 Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime.ripard@bootlin.com>
Date: Wed, 19 Jun 2019 12:17:53 +0200
Subject: [PATCH 1269/1835] drm/vc4: hdmi: Set default state margin at reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the TV margins are properly parsed and filled into
drm_cmdline_mode, we just need to initialise the first state at reset to
get those values and start using them.

Acked-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/44e24172e300be6a41578517021ef6a6e90ed682.1560783090.git-series.maxime.ripard@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index be80769d7b5bf..9dc0fc6b8a2a8 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -292,11 +292,17 @@ static int vc4_hdmi_connector_get_modes(struct drm_connector *connector)
 	return ret;
 }
 
+static void vc4_hdmi_connector_reset(struct drm_connector *connector)
+{
+	drm_atomic_helper_connector_reset(connector);
+	drm_atomic_helper_connector_tv_reset(connector);
+}
+
 static const struct drm_connector_funcs vc4_hdmi_connector_funcs = {
 	.detect = vc4_hdmi_connector_detect,
 	.fill_modes = drm_helper_probe_single_connector_modes,
 	.destroy = vc4_hdmi_connector_destroy,
-	.reset = drm_atomic_helper_connector_reset,
+	.reset = vc4_hdmi_connector_reset,
 	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 };
-- 
GitLab


From 884c11bacd3baf9da45f540ec4ad17ea49accfb1 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 23 Jul 2019 11:09:26 +0100
Subject: [PATCH 1270/1835] drm/vc4: fkms: Set default state margin at reset

Now that the TV margins are properly parsed and filled into
drm_cmdline_mode, we just need to initialise the first state at reset to
get those values and start using them.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 8e235e65d5a81..066f6d17db973 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -1457,10 +1457,17 @@ int vc4_connector_atomic_set_property(struct drm_connector *connector,
 	return -EINVAL;
 }
 
+static void vc4_hdmi_connector_reset(struct drm_connector *connector)
+{
+	drm_atomic_helper_connector_reset(connector);
+	drm_atomic_helper_connector_tv_reset(connector);
+}
+
 static const struct drm_connector_funcs vc4_fkms_connector_funcs = {
 	.detect = vc4_fkms_connector_detect,
 	.fill_modes = drm_helper_probe_single_connector_modes,
 	.destroy = vc4_fkms_connector_destroy,
+	.reset = vc4_hdmi_connector_reset,
 	.atomic_duplicate_state = vc4_connector_duplicate_state,
 	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 	.atomic_get_property = vc4_connector_atomic_get_property,
-- 
GitLab


From bb0b99b86606be0ef3f7426ed3eb7d09deba3514 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 23 Jul 2019 14:10:31 +0100
Subject: [PATCH 1271/1835] drm/modes: Don't apply cmdline's rotation if it
 wasn't specified

Taken from the dri-devel mailing list (11/7/2019) to fixup the cmdline
parsing, but requires changes as things have moved between 4.19 and 5.2.

From: Dmitry Osipenko <digetx@gmail.com>

The rotation mode from cmdline shouldn't be taken into account if it
wasn't specified in the cmdline. This fixes ignored default display
orientation when display mode is given using cmdline without the
rotation being specified.

Fixes: 1bf4e09227c3 ("drm/modes: Allow to specify rotation and reflection on the commandline")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/drm_fb_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index cfa272fab56a9..a0b217f93a0d2 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2497,7 +2497,7 @@ static void drm_setup_crtc_rotation(struct drm_fb_helper *fb_helper,
 	 * simple XOR between the two handle the addition nicely.
 	 */
 	cmdline = &connector->cmdline_mode;
-	if (cmdline->specified) {
+	if (cmdline->specified && cmdline->rotation_reflection) {
 		unsigned int cmdline_rest, panel_rest;
 		unsigned int cmdline_rot, panel_rot;
 		unsigned int sum_rot, sum_rest;
-- 
GitLab


From 3e638cc74ed9382407667dcb1f302ebd7ef4bd8a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Tue, 23 Jul 2019 14:14:05 +0100
Subject: [PATCH 1272/1835] configs: Add CONFIG_FRAMEBUFFER_CONSOLE_ROTATION to
 Pi configs

To allow for console rotation under DRM (where the firmware
can't lie about geometry), add FRAMEBUFFER_CONSOLE_ROTATION
so that the kernel can do it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 1 +
 arch/arm/configs/bcm2711_defconfig | 1 +
 arch/arm/configs/bcmrpi_defconfig  | 1 +
 3 files changed, 3 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index e21341bd59ef7..f3235aa2eb8fb 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -935,6 +935,7 @@ CONFIG_FB_RPISENSE=m
 CONFIG_BACKLIGHT_RPI=m
 CONFIG_BACKLIGHT_GPIO=m
 CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 2ff5dd6f51750..314b8590e35f2 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -946,6 +946,7 @@ CONFIG_FB_RPISENSE=m
 CONFIG_BACKLIGHT_RPI=m
 CONFIG_BACKLIGHT_GPIO=m
 CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 27485b714eeb1..ffdc1b3b2b931 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -927,6 +927,7 @@ CONFIG_FB_RPISENSE=m
 CONFIG_BACKLIGHT_RPI=m
 CONFIG_BACKLIGHT_GPIO=m
 CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
-- 
GitLab


From 5e484a3e2a1118e66ec39a007ac5a9f83fe20114 Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wens@csie.org>
Date: Thu, 18 Jul 2019 17:07:05 +0800
Subject: [PATCH 1273/1835] staging: bcm2835-codec: switch to multi-planar API

There are two APIs for mem2mem devices, the older single-planar API and
the newer multi-planar one. Without making things overly complex, the
driver can only support one or the other. However the userspace libv4l2
library has a plugin that allows multi-planar API devices to service
single-planar consumers.

Chromium supports the multi-planar API exclusively, though this is
currently limited to ChromiumOS. It would be possible to add support
for generic Linux.

Switching to the multi-planar API would allow usage of both APIs from
userspace.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 145 +++++++++---------
 1 file changed, 76 insertions(+), 69 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 708f76b7aa92b..43b903cd53911 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -504,7 +504,7 @@ static struct bcm2835_codec_fmt *find_format(struct v4l2_format *f,
 
 	for (k = 0; k < fmts->num_entries; k++) {
 		fmt = &fmts->list[k];
-		if (fmt->fourcc == f->fmt.pix.pixelformat)
+		if (fmt->fourcc == f->fmt.pix_mp.pixelformat)
 			break;
 	}
 	if (k == fmts->num_entries)
@@ -522,9 +522,9 @@ static struct bcm2835_codec_q_data *get_q_data(struct bcm2835_codec_ctx *ctx,
 					       enum v4l2_buf_type type)
 {
 	switch (type) {
-	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
 		return &ctx->q_data[V4L2_M2M_SRC];
-	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
 		return &ctx->q_data[V4L2_M2M_DST];
 	default:
 		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
@@ -541,9 +541,9 @@ static struct vchiq_mmal_port *get_port_data(struct bcm2835_codec_ctx *ctx,
 		return NULL;
 
 	switch (type) {
-	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
 		return &ctx->component->input[0];
-	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
 		return &ctx->component->output[0];
 	default:
 		v4l2_err(&ctx->dev->v4l2_dev, "%s: Invalid queue type %u\n",
@@ -752,7 +752,7 @@ static void handle_fmt_changed(struct bcm2835_codec_ctx *ctx,
 		 format->es.video.crop.width, format->es.video.crop.height,
 		 format->es.video.color_space);
 
-	q_data = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
+	q_data = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
 	q_data->crop_width = format->es.video.crop.width;
 	q_data->crop_height = format->es.video.crop.height;
 	q_data->bytesperline = format->es.video.crop.width;
@@ -945,7 +945,7 @@ static int vidioc_querycap(struct file *file, void *priv,
 	strncpy(cap->card, MEM2MEM_NAME, sizeof(cap->card) - 1);
 	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
 		 MEM2MEM_NAME);
-	cap->device_caps = V4L2_CAP_VIDEO_M2M | V4L2_CAP_STREAMING;
+	cap->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
 	cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
 	return 0;
 }
@@ -996,16 +996,20 @@ static int vidioc_g_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f)
 
 	q_data = get_q_data(ctx, f->type);
 
-	f->fmt.pix.width	= q_data->crop_width;
-	f->fmt.pix.height	= q_data->height;
-	f->fmt.pix.field	= V4L2_FIELD_NONE;
-	f->fmt.pix.pixelformat	= q_data->fmt->fourcc;
-	f->fmt.pix.bytesperline	= q_data->bytesperline;
-	f->fmt.pix.sizeimage	= q_data->sizeimage;
-	f->fmt.pix.colorspace	= ctx->colorspace;
-	f->fmt.pix.xfer_func	= ctx->xfer_func;
-	f->fmt.pix.ycbcr_enc	= ctx->ycbcr_enc;
-	f->fmt.pix.quantization	= ctx->quant;
+	f->fmt.pix_mp.width			= q_data->crop_width;
+	f->fmt.pix_mp.height			= q_data->height;
+	f->fmt.pix_mp.pixelformat		= q_data->fmt->fourcc;
+	f->fmt.pix_mp.field			= V4L2_FIELD_NONE;
+	f->fmt.pix_mp.colorspace		= ctx->colorspace;
+	f->fmt.pix_mp.plane_fmt[0].sizeimage	= q_data->sizeimage;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline	= q_data->bytesperline;
+	f->fmt.pix_mp.num_planes		= 1;
+	f->fmt.pix_mp.ycbcr_enc			= ctx->ycbcr_enc;
+	f->fmt.pix_mp.quantization		= ctx->quant;
+	f->fmt.pix_mp.xfer_func			= ctx->xfer_func;
+
+	memset(f->fmt.pix_mp.plane_fmt[0].reserved, 0,
+	       sizeof(f->fmt.pix_mp.plane_fmt[0].reserved));
 
 	return 0;
 }
@@ -1029,17 +1033,17 @@ static int vidioc_try_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	 * The V4L2 specification requires the driver to correct the format
 	 * struct if any of the dimensions is unsupported
 	 */
-	if (f->fmt.pix.width > MAX_W)
-		f->fmt.pix.width = MAX_W;
-	if (f->fmt.pix.height > MAX_H)
-		f->fmt.pix.height = MAX_H;
+	if (f->fmt.pix_mp.width > MAX_W)
+		f->fmt.pix_mp.width = MAX_W;
+	if (f->fmt.pix_mp.height > MAX_H)
+		f->fmt.pix_mp.height = MAX_H;
 
 	if (!fmt->flags & V4L2_FMT_FLAG_COMPRESSED) {
 		/* Only clip min w/h on capture. Treat 0x0 as unknown. */
-		if (f->fmt.pix.width < MIN_W)
-			f->fmt.pix.width = MIN_W;
-		if (f->fmt.pix.height < MIN_H)
-			f->fmt.pix.height = MIN_H;
+		if (f->fmt.pix_mp.width < MIN_W)
+			f->fmt.pix_mp.width = MIN_W;
+		if (f->fmt.pix_mp.height < MIN_H)
+			f->fmt.pix_mp.height = MIN_H;
 
 		/*
 		 * For codecs the buffer must have a vertical alignment of 16
@@ -1048,16 +1052,18 @@ static int vidioc_try_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 		 * some of the pixels are active.
 		 */
 		if (ctx->dev->role != ISP)
-			f->fmt.pix.height = ALIGN(f->fmt.pix.height, 16);
+			f->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, 16);
 	}
-	f->fmt.pix.bytesperline = get_bytesperline(f->fmt.pix.width,
-						   fmt);
-	f->fmt.pix.sizeimage = get_sizeimage(f->fmt.pix.bytesperline,
-					     f->fmt.pix.width,
-					     f->fmt.pix.height,
-					     fmt);
+	f->fmt.pix_mp.num_planes = 1;
+	f->fmt.pix_mp.plane_fmt[0].bytesperline =
+		get_bytesperline(f->fmt.pix_mp.width, fmt);
+	f->fmt.pix_mp.plane_fmt[0].sizeimage =
+		get_sizeimage(f->fmt.pix_mp.plane_fmt[0].bytesperline,
+			      f->fmt.pix_mp.width, f->fmt.pix_mp.height, fmt);
+	memset(f->fmt.pix_mp.plane_fmt[0].reserved, 0,
+	       sizeof(f->fmt.pix_mp.plane_fmt[0].reserved));
 
-	f->fmt.pix.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
 
 	return 0;
 }
@@ -1070,8 +1076,8 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 
 	fmt = find_format(f, ctx->dev, true);
 	if (!fmt) {
-		f->fmt.pix.pixelformat = get_default_format(ctx->dev,
-							    true)->fourcc;
+		f->fmt.pix_mp.pixelformat = get_default_format(ctx->dev,
+							       true)->fourcc;
 		fmt = find_format(f, ctx->dev, true);
 	}
 
@@ -1086,13 +1092,13 @@ static int vidioc_try_fmt_vid_out(struct file *file, void *priv,
 
 	fmt = find_format(f, ctx->dev, false);
 	if (!fmt) {
-		f->fmt.pix.pixelformat = get_default_format(ctx->dev,
-							    false)->fourcc;
+		f->fmt.pix_mp.pixelformat = get_default_format(ctx->dev,
+							       false)->fourcc;
 		fmt = find_format(f, ctx->dev, false);
 	}
 
-	if (!f->fmt.pix.colorspace)
-		f->fmt.pix.colorspace = ctx->colorspace;
+	if (!f->fmt.pix_mp.colorspace)
+		f->fmt.pix_mp.colorspace = ctx->colorspace;
 
 	return vidioc_try_fmt(ctx, f, fmt);
 }
@@ -1106,9 +1112,10 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	bool update_capture_port = false;
 	int ret;
 
-	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Setting format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
-		 f->type, f->fmt.pix.width, f->fmt.pix.height,
-		 f->fmt.pix.pixelformat, f->fmt.pix.sizeimage);
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "Setting format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
+		 f->type, f->fmt.pix_mp.width, f->fmt.pix_mp.height,
+		 f->fmt.pix_mp.pixelformat, f->fmt.pix_mp.plane_fmt[0].sizeimage);
+
 
 	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
 	if (!vq)
@@ -1124,9 +1131,9 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	}
 
 	q_data->fmt = find_format(f, ctx->dev,
-				  f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE);
-	q_data->crop_width = f->fmt.pix.width;
-	q_data->height = f->fmt.pix.height;
+				  f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+	q_data->crop_width = f->fmt.pix_mp.width;
+	q_data->height = f->fmt.pix_mp.height;
 	if (!q_data->selection_set)
 		q_data->crop_height = requested_height;
 
@@ -1134,21 +1141,21 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	 * Copying the behaviour of vicodec which retains a single set of
 	 * colorspace parameters for both input and output.
 	 */
-	ctx->colorspace = f->fmt.pix.colorspace;
-	ctx->xfer_func = f->fmt.pix.xfer_func;
-	ctx->ycbcr_enc = f->fmt.pix.ycbcr_enc;
-	ctx->quant = f->fmt.pix.quantization;
+	ctx->colorspace = f->fmt.pix_mp.colorspace;
+	ctx->xfer_func = f->fmt.pix_mp.xfer_func;
+	ctx->ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
+	ctx->quant = f->fmt.pix_mp.quantization;
 
 	/* All parameters should have been set correctly by try_fmt */
-	q_data->bytesperline = f->fmt.pix.bytesperline;
-	q_data->sizeimage = f->fmt.pix.sizeimage;
+	q_data->bytesperline = f->fmt.pix_mp.plane_fmt[0].bytesperline;
+	q_data->sizeimage = f->fmt.pix_mp.plane_fmt[0].sizeimage;
 
 	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Calulated bpl as %u, size %u\n",
 		 q_data->bytesperline, q_data->sizeimage);
 
 	if (ctx->dev->role == DECODE &&
 	    q_data->fmt->flags & V4L2_FMT_FLAG_COMPRESSED &&
-	    f->fmt.pix.width && f->fmt.pix.height) {
+	    q_data->crop_width && q_data->height) {
 		/*
 		 * On the decoder, if provided with a resolution on the input
 		 * side, then replicate that to the output side.
@@ -1165,7 +1172,7 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 		q_data_dst->height = ALIGN(q_data->crop_height, 16);
 
 		q_data_dst->bytesperline =
-			get_bytesperline(f->fmt.pix.width, q_data_dst->fmt);
+			get_bytesperline(f->fmt.pix_mp.width, q_data_dst->fmt);
 		q_data_dst->sizeimage = get_sizeimage(q_data_dst->bytesperline,
 						      q_data_dst->crop_width,
 						      q_data_dst->height,
@@ -1215,7 +1222,7 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
 				struct v4l2_format *f)
 {
-	unsigned int height = f->fmt.pix.height;
+	unsigned int height = f->fmt.pix_mp.height;
 	int ret;
 
 	ret = vidioc_try_fmt_vid_cap(file, priv, f);
@@ -1228,7 +1235,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
 static int vidioc_s_fmt_vid_out(struct file *file, void *priv,
 				struct v4l2_format *f)
 {
-	unsigned int height = f->fmt.pix.height;
+	unsigned int height = f->fmt.pix_mp.height;
 	int ret;
 
 	ret = vidioc_try_fmt_vid_out(file, priv, f);
@@ -1244,7 +1251,7 @@ static int vidioc_g_selection(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 	struct bcm2835_codec_q_data *q_data;
-	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ?
+	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE ?
 								true : false;
 
 	if ((ctx->dev->role == DECODE && !capture_queue) ||
@@ -1307,7 +1314,7 @@ static int vidioc_s_selection(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 	struct bcm2835_codec_q_data *q_data = NULL;
-	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ?
+	bool capture_queue = s->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE ?
 								true : false;
 
 	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: ctx %p, type %d, q_data %p, target %d, rect x/y %d/%d, w/h %ux%u\n",
@@ -1368,7 +1375,7 @@ static int vidioc_s_parm(struct file *file, void *priv,
 {
 	struct bcm2835_codec_ctx *ctx = file2ctx(file);
 
-	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+	if (parm->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
 		return -EINVAL;
 
 	ctx->framerate_num =
@@ -1738,15 +1745,15 @@ static int vidioc_encoder_cmd(struct file *file, void *priv,
 static const struct v4l2_ioctl_ops bcm2835_codec_ioctl_ops = {
 	.vidioc_querycap	= vidioc_querycap,
 
-	.vidioc_enum_fmt_vid_cap = vidioc_enum_fmt_vid_cap,
-	.vidioc_g_fmt_vid_cap	= vidioc_g_fmt_vid_cap,
-	.vidioc_try_fmt_vid_cap	= vidioc_try_fmt_vid_cap,
-	.vidioc_s_fmt_vid_cap	= vidioc_s_fmt_vid_cap,
+	.vidioc_enum_fmt_vid_cap_mplane = vidioc_enum_fmt_vid_cap,
+	.vidioc_g_fmt_vid_cap_mplane	= vidioc_g_fmt_vid_cap,
+	.vidioc_try_fmt_vid_cap_mplane	= vidioc_try_fmt_vid_cap,
+	.vidioc_s_fmt_vid_cap_mplane	= vidioc_s_fmt_vid_cap,
 
-	.vidioc_enum_fmt_vid_out = vidioc_enum_fmt_vid_out,
-	.vidioc_g_fmt_vid_out	= vidioc_g_fmt_vid_out,
-	.vidioc_try_fmt_vid_out	= vidioc_try_fmt_vid_out,
-	.vidioc_s_fmt_vid_out	= vidioc_s_fmt_vid_out,
+	.vidioc_enum_fmt_vid_out_mplane = vidioc_enum_fmt_vid_out,
+	.vidioc_g_fmt_vid_out_mplane	= vidioc_g_fmt_vid_out,
+	.vidioc_try_fmt_vid_out_mplane	= vidioc_try_fmt_vid_out,
+	.vidioc_s_fmt_vid_out_mplane	= vidioc_s_fmt_vid_out,
 
 	.vidioc_reqbufs		= v4l2_m2m_ioctl_reqbufs,
 	.vidioc_querybuf	= v4l2_m2m_ioctl_querybuf,
@@ -2089,7 +2096,7 @@ static int bcm2835_codec_start_streaming(struct vb2_queue *q,
 		ctx->component_enabled = true;
 	}
 
-	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
+	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
 		/*
 		 * Create the EOS buffer.
 		 * We only need the MMAL part, and want to NOT attach a memory
@@ -2216,7 +2223,7 @@ static int queue_init(void *priv, struct vb2_queue *src_vq,
 	struct bcm2835_codec_ctx *ctx = priv;
 	int ret;
 
-	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
+	src_vq->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
 	src_vq->io_modes = VB2_MMAP | VB2_DMABUF;
 	src_vq->drv_priv = ctx;
 	src_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
@@ -2230,7 +2237,7 @@ static int queue_init(void *priv, struct vb2_queue *src_vq,
 	if (ret)
 		return ret;
 
-	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	dst_vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
 	dst_vq->io_modes = VB2_MMAP | VB2_DMABUF;
 	dst_vq->drv_priv = ctx;
 	dst_vq->buf_struct_size = sizeof(struct m2m_mmal_buffer);
-- 
GitLab


From 962099a5bee23abfbf17815b21d94b3563ee18fe Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wens@csie.org>
Date: Mon, 22 Jul 2019 22:13:30 +0800
Subject: [PATCH 1274/1835] staging: bcm2835-codec: implement
 V4L2_CID_MIN_BUFFERS_FOR_CAPTURE

The stateful decoder specification shows an optional step for retrieving
the miminum number of capture buffers required for the decoder to
proceed. While not a required parameter, having it makes some
applications happy.

bcm2835-codec is a little different from other decoder implementations
in that there is an intermediate format conversion between the hardware
and V4L2 buffers. The number of capture buffers required is therefore
independent of the stream and DPB etc.

There are plans to remove the conversion, but it requires a fair amount
of rework within the firmware. Until that is done, simply return a value
of 1.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 43b903cd53911..a6a6e9d56d808 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -2357,6 +2357,18 @@ static int bcm2835_codec_open(struct file *file)
 		}
 		ctx->fh.ctrl_handler = hdl;
 		v4l2_ctrl_handler_setup(hdl);
+	} else if (dev->role == DECODE) {
+		v4l2_ctrl_handler_init(hdl, 1);
+
+		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+				  V4L2_CID_MIN_BUFFERS_FOR_CAPTURE,
+				  1, 1, 1, 1);
+		if (hdl->error) {
+			rc = hdl->error;
+			goto free_ctrl_handler;
+		}
+		ctx->fh.ctrl_handler = hdl;
+		v4l2_ctrl_handler_setup(hdl);
 	}
 
 	ctx->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, ctx, &queue_init);
-- 
GitLab


From 8c54e77880234ee3937d0db7318c3e0dacfecb88 Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wens@csie.org>
Date: Mon, 22 Jul 2019 22:20:55 +0800
Subject: [PATCH 1275/1835] staging: bcm2835-codec: set device_caps in struct
 video_device

Instead of filling in the struct v4l2_capability device_caps
field, fill in the struct video_device device_caps field.

That way the V4L2 core knows what the capabilities of the
video device are.

This is similar to a cleanup series by Hans Verkuil [1].

[1] https://www.spinics.net/lists/linux-media/msg153313.html

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c   | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index a6a6e9d56d808..2902e49a7c779 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -945,8 +945,6 @@ static int vidioc_querycap(struct file *file, void *priv,
 	strncpy(cap->card, MEM2MEM_NAME, sizeof(cap->card) - 1);
 	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
 		 MEM2MEM_NAME);
-	cap->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
-	cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
 	return 0;
 }
 
@@ -2600,6 +2598,7 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 	vfd = &dev->vfd;
 	vfd->lock = &dev->dev_mutex;
 	vfd->v4l2_dev = &dev->v4l2_dev;
+	vfd->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
 
 	switch (role) {
 	case DECODE:
-- 
GitLab


From 41c722d8f45e1da8b8ffc8767162ac6483cbd18e Mon Sep 17 00:00:00 2001
From: James Hughes <james.hughes@raspberrypi.org>
Date: Tue, 16 Jul 2019 12:18:21 +0100
Subject: [PATCH 1276/1835] Add HDMI1 facility to the driver.

For generic ALSA, all you need is the bcm2835.h change, but
have also added structures for IEC958 HDMI. Not sure how to
test those.
---
 .../vc04_services/bcm2835-audio/bcm2835.c     | 29 ++++++++++++++++---
 .../vc04_services/bcm2835-audio/bcm2835.h     |  4 ++-
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
index 86b921030db7b..4d5b99d8ae9dc 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
@@ -79,7 +79,11 @@ static int bcm2835_audio_alsa_newpcm(struct bcm2835_chip *chip,
 	if (err)
 		return err;
 
-	err = snd_bcm2835_new_pcm(chip, "bcm2835 IEC958/HDMI", 1, 0, 1, true);
+	err = snd_bcm2835_new_pcm(chip, "bcm2835 IEC958/HDMI", 1, AUDIO_DEST_HDMI0, 1, true);
+	if (err)
+		return err;
+
+	err = snd_bcm2835_new_pcm(chip, "bcm2835 IEC958/HDMI1", 2, AUDIO_DEST_HDMI1, 1, true);
 	if (err)
 		return err;
 
@@ -106,7 +110,7 @@ static struct bcm2835_audio_driver bcm2835_audio_alsa = {
 	.newctl = snd_bcm2835_new_ctl,
 };
 
-static struct bcm2835_audio_driver bcm2835_audio_hdmi = {
+static struct bcm2835_audio_driver bcm2835_audio_hdmi0 = {
 	.driver = {
 		.name = "bcm2835_hdmi",
 		.owner = THIS_MODULE,
@@ -116,7 +120,20 @@ static struct bcm2835_audio_driver bcm2835_audio_hdmi = {
 	.minchannels = 1,
 	.newpcm = bcm2835_audio_simple_newpcm,
 	.newctl = snd_bcm2835_new_hdmi_ctl,
-	.route = AUDIO_DEST_HDMI
+	.route = AUDIO_DEST_HDMI0
+};
+
+static struct bcm2835_audio_driver bcm2835_audio_hdmi1 = {
+	.driver = {
+		.name = "bcm2835_hdmi",
+		.owner = THIS_MODULE,
+	},
+	.shortname = "bcm2835 HDMI 1",
+	.longname  = "bcm2835 HDMI 1",
+	.minchannels = 1,
+	.newpcm = bcm2835_audio_simple_newpcm,
+	.newctl = snd_bcm2835_new_hdmi_ctl,
+	.route = AUDIO_DEST_HDMI1
 };
 
 static struct bcm2835_audio_driver bcm2835_audio_headphones = {
@@ -143,7 +160,11 @@ static struct bcm2835_audio_drivers children_devices[] = {
 		.is_enabled = &enable_compat_alsa,
 	},
 	{
-		.audio_driver = &bcm2835_audio_hdmi,
+		.audio_driver = &bcm2835_audio_hdmi0,
+		.is_enabled = &enable_hdmi,
+	},
+	{
+		.audio_driver = &bcm2835_audio_hdmi1,
 		.is_enabled = &enable_hdmi,
 	},
 	{
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
index 595ad584243f6..67beb9f17dc5d 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.h
@@ -33,7 +33,9 @@ enum {
 enum snd_bcm2835_route {
 	AUDIO_DEST_AUTO = 0,
 	AUDIO_DEST_HEADPHONES = 1,
-	AUDIO_DEST_HDMI = 2,
+	AUDIO_DEST_HDMI = 2,  // for backwards compatibility.
+	AUDIO_DEST_HDMI0 = 2,
+	AUDIO_DEST_HDMI1 = 3,
 	AUDIO_DEST_MAX,
 };
 
-- 
GitLab


From a08305b0a8318f07b1fe06825985373373f0fa65 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 5 Aug 2019 14:17:14 +0100
Subject: [PATCH 1277/1835] overlays: Add baudrate parameter to i2c3-i2c6

The overlays for enabling the new BCM2711 I2C interfaces were lacking
the means to configure the baud/clock rate.

Also explictly set the default pins, rather than relying on the values
in the base DTB.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README           |  8 ++++++++
 arch/arm/boot/dts/overlays/i2c3-overlay.dts | 15 ++++++++++++---
 arch/arm/boot/dts/overlays/i2c4-overlay.dts | 15 ++++++++++++---
 arch/arm/boot/dts/overlays/i2c5-overlay.dts | 15 ++++++++++++---
 arch/arm/boot/dts/overlays/i2c6-overlay.dts | 15 ++++++++++++---
 5 files changed, 56 insertions(+), 12 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 6131ac3d967cc..a034d07be96af 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1221,6 +1221,8 @@ Info:   Enable the i2c3 bus
 Load:   dtoverlay=i2c3,<param>
 Params: pins_2_3                Use GPIOs 2 and 3
         pins_4_5                Use GPIOs 4 and 5 (default)
+        baudrate                Set the baudrate for the interface (default
+                                "100000")
 
 
 Name:   i2c4
@@ -1228,6 +1230,8 @@ Info:   Enable the i2c4 bus
 Load:   dtoverlay=i2c4,<param>
 Params: pins_6_7                Use GPIOs 6 and 7
         pins_8_9                Use GPIOs 8 and 9 (default)
+        baudrate                Set the baudrate for the interface (default
+                                "100000")
 
 
 Name:   i2c5
@@ -1235,6 +1239,8 @@ Info:   Enable the i2c5 bus
 Load:   dtoverlay=i2c5,<param>
 Params: pins_10_11              Use GPIOs 10 and 11
         pins_12_13              Use GPIOs 12 and 13 (default)
+        baudrate                Set the baudrate for the interface (default
+                                "100000")
 
 
 Name:   i2c6
@@ -1242,6 +1248,8 @@ Info:   Enable the i2c6 bus
 Load:   dtoverlay=i2c6,<param>
 Params: pins_0_1                Use GPIOs 0 and 1
         pins_22_23              Use GPIOs 22 and 23 (default)
+        baudrate                Set the baudrate for the interface (default
+                                "100000")
 
 
 Name:   i2s-gpio28-31
diff --git a/arch/arm/boot/dts/overlays/i2c3-overlay.dts b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
index 79d0da0ca6f2a..f651f3541d25b 100644
--- a/arch/arm/boot/dts/overlays/i2c3-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c3-overlay.dts
@@ -6,10 +6,11 @@
 
 	fragment@0 {
 		target = <&i2c3>;
-		__overlay__ {
+		frag0: __overlay__ {
 			status = "okay";
 			pinctrl-names = "default";
 			pinctrl-0 = <&i2c3_pins>;
+			clock-frequency = <100000>;
 		};
 	};
 
@@ -20,8 +21,16 @@
 		};
 	};
 
+	fragment@2 {
+		target = <&i2c3_pins>;
+		__overlay__ {
+			brcm,pins = <4 5>;
+		};
+	};
+
 	__overrides__ {
-		pins_2_3 = <0>,"=1";
-		pins_4_5 = <0>,"!1";
+		pins_2_3 = <0>,"=1!2";
+		pins_4_5 = <0>,"!1=2";
+		baudrate = <&frag0>, "clock-frequency:0";
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/i2c4-overlay.dts b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
index ffad91763f076..3cfd87913918e 100644
--- a/arch/arm/boot/dts/overlays/i2c4-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c4-overlay.dts
@@ -6,10 +6,11 @@
 
 	fragment@0 {
 		target = <&i2c4>;
-		__overlay__ {
+		frag0: __overlay__ {
 			status = "okay";
 			pinctrl-names = "default";
 			pinctrl-0 = <&i2c4_pins>;
+			clock-frequency = <100000>;
 		};
 	};
 
@@ -20,8 +21,16 @@
 		};
 	};
 
+	fragment@2 {
+		target = <&i2c4_pins>;
+		__overlay__ {
+			brcm,pins = <8 9>;
+		};
+	};
+
 	__overrides__ {
-		pins_6_7 = <0>,"=1";
-		pins_8_9 = <0>,"!1";
+		pins_6_7 = <0>,"=1!2";
+		pins_8_9 = <0>,"!1=2";
+		baudrate = <&frag0>, "clock-frequency:0";
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/i2c5-overlay.dts b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
index 551ce154f877a..c71f511d90cf2 100644
--- a/arch/arm/boot/dts/overlays/i2c5-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c5-overlay.dts
@@ -6,10 +6,11 @@
 
 	fragment@0 {
 		target = <&i2c5>;
-		__overlay__ {
+		frag0: __overlay__ {
 			status = "okay";
 			pinctrl-names = "default";
 			pinctrl-0 = <&i2c5_pins>;
+			clock-frequency = <100000>;
 		};
 	};
 
@@ -20,8 +21,16 @@
 		};
 	};
 
+	fragment@2 {
+		target = <&i2c5_pins>;
+		__overlay__ {
+			brcm,pins = <12 13>;
+		};
+	};
+
 	__overrides__ {
-		pins_10_11 = <0>,"=1";
-		pins_12_13 = <0>,"!1";
+		pins_10_11 = <0>,"=1!2";
+		pins_12_13 = <0>,"!1=2";
+		baudrate = <&frag0>, "clock-frequency:0";
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/i2c6-overlay.dts b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
index 0a67f7da6ac00..17861ef00c5b4 100644
--- a/arch/arm/boot/dts/overlays/i2c6-overlay.dts
+++ b/arch/arm/boot/dts/overlays/i2c6-overlay.dts
@@ -6,10 +6,11 @@
 
 	fragment@0 {
 		target = <&i2c6>;
-		__overlay__ {
+		frag0: __overlay__ {
 			status = "okay";
 			pinctrl-names = "default";
 			pinctrl-0 = <&i2c6_pins>;
+			clock-frequency = <100000>;
 		};
 	};
 
@@ -20,8 +21,16 @@
 		};
 	};
 
+	fragment@2 {
+		target = <&i2c6_pins>;
+		__overlay__ {
+			brcm,pins = <22 23>;
+		};
+	};
+
 	__overrides__ {
-		pins_0_1 = <0>,"=1";
-		pins_22_23 = <0>,"!1";
+		pins_0_1 = <0>,"=1!2";
+		pins_22_23 = <0>,"!1=2";
+		baudrate = <&frag0>, "clock-frequency:0";
 	};
 };
-- 
GitLab


From 9c0770ea7682a84a22c33410ef6870af258abacc Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 2 Aug 2019 22:25:27 +0100
Subject: [PATCH 1278/1835] net: bcmgenet: Workaround for Pi 4B network issue

Some combinations of Pi 4Bs and Ethernet switches don't reliably get a
DCHP-assigned IP address, leaving the unit with a self=assigned 169.254
address.

Forcing renegotiation has been found to be an effective workaround, so
add an automatic renegotiation after the link comes up for the first
time; enable it with genet.force_reneg=y - by default it is disabled.

See: https://github.com/raspberrypi/linux/issues/3108

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 .../net/ethernet/broadcom/genet/bcmgenet.c    | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index b02f33a2ff088..582cfc7eb1d15 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -72,6 +72,10 @@
 #define GENET_RDMA_REG_OFF	(priv->hw_params->rdma_offset + \
 				TOTAL_DESC * DMA_DESC_SIZE)
 
+static bool force_reneg = false;
+module_param(force_reneg, bool, 0444);
+MODULE_PARM_DESC(force_reneg, "Force a renegotiation after the initial link-up");
+
 static inline void bcmgenet_writel(u32 value, void __iomem *offset)
 {
 	/* MIPS chips strapped for BE will automagically configure the
@@ -2610,6 +2614,7 @@ static void bcmgenet_irq_task(struct work_struct *work)
 	unsigned int status;
 	struct bcmgenet_priv *priv = container_of(
 			work, struct bcmgenet_priv, bcmgenet_irq_work);
+	static int first_link = 1;
 
 	netif_dbg(priv, intr, priv->dev, "%s\n", __func__);
 
@@ -2622,6 +2627,23 @@ static void bcmgenet_irq_task(struct work_struct *work)
 	if (status & UMAC_IRQ_LINK_EVENT) {
 		priv->dev->phydev->link = !!(status & UMAC_IRQ_LINK_UP);
 		phy_mac_interrupt(priv->dev->phydev);
+
+		if (priv->dev->phydev->link && first_link) {
+			first_link = 0;
+			/*
+			 * HACK: Some Pi4Bs, when paired with some switches,
+			 * come up in a strange state where they are unable to
+			 * transmit, causing them to fail to get an IP address.
+			 * Although the failure mechanism is not yet understood,
+			 * forcing renegotiation at this point has been shown
+			 * to be effective in avoiding the problem.
+			 */
+			if (force_reneg) {
+				dev_info(&priv->pdev->dev,
+					 "Forcing renegotiation\n");
+				genphy_restart_aneg(priv->dev->phydev);
+			}
+		}
 	}
 }
 
-- 
GitLab


From a5b534bb890687b7fc08787ad47421e8f6d72422 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 25 Jul 2019 17:27:44 +0100
Subject: [PATCH 1279/1835] drm/vc4: Resolve the vblank warnings on mode
 switching

The details over when and how a driver is to service the
vblank events are sketchy, and the fkms driver was triggering
a kernel warning every time the crtc was enabled or disabled.

Copy the event handling as used by the vc4-kms driver slightly
more closely, and we avoid the warnings.

https://github.com/raspberrypi/linux/issues/3020

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 48 ++++++++++++++++++--------
 1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 066f6d17db973..425625b24e298 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -933,6 +933,7 @@ static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
 {
+	struct drm_device *dev = crtc->dev;
 	struct drm_plane *plane;
 
 	DRM_DEBUG_KMS("[CRTC:%d] vblanks off.\n",
@@ -948,6 +949,35 @@ static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_s
 
 	drm_atomic_crtc_for_each_plane(plane, crtc)
 		vc4_plane_atomic_disable(plane, plane->state);
+
+	/*
+	 * Make sure we issue a vblank event after disabling the CRTC if
+	 * someone was waiting it.
+	 */
+	if (crtc->state->event) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&dev->event_lock, flags);
+		drm_crtc_send_vblank_event(crtc, crtc->state->event);
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+	}
+}
+
+static void vc4_crtc_consume_event(struct drm_crtc *crtc)
+{
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	crtc->state->event->pipe = drm_crtc_index(crtc);
+
+	WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	vc4_crtc->event = crtc->state->event;
+	crtc->state->event = NULL;
+	spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
 static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
@@ -957,6 +987,7 @@ static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_st
 	DRM_DEBUG_KMS("[CRTC:%d] vblanks on.\n",
 		      crtc->base.id);
 	drm_crtc_vblank_on(crtc);
+	vc4_crtc_consume_event(crtc);
 
 	/* Unblank the planes (if they're supposed to be displayed). */
 	drm_atomic_crtc_for_each_plane(plane, crtc)
@@ -1028,23 +1059,10 @@ static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
 static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 				  struct drm_crtc_state *old_state)
 {
-	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
-	struct drm_device *dev = crtc->dev;
-
 	DRM_DEBUG_KMS("[CRTC:%d] crtc_atomic_flush.\n",
 		      crtc->base.id);
-	if (crtc->state->event) {
-		unsigned long flags;
-
-		crtc->state->event->pipe = drm_crtc_index(crtc);
-
-		WARN_ON(drm_crtc_vblank_get(crtc) != 0);
-
-		spin_lock_irqsave(&dev->event_lock, flags);
-		vc4_crtc->event = crtc->state->event;
-		crtc->state->event = NULL;
-		spin_unlock_irqrestore(&dev->event_lock, flags);
-	}
+	if (crtc->state->active && old_state->active && crtc->state->event)
+		vc4_crtc_consume_event(crtc);
 }
 
 static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
-- 
GitLab


From c76cadf3388c4fb96cd57139dae6f4581ee13f77 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 25 Jul 2019 17:34:29 +0100
Subject: [PATCH 1280/1835] drm/vc4: Remove unused mode variable

"89d1376 drm/vc4: Add support for margins to fkms" removed
the requirement for having the mode structure from vc4_plane_to_mb,
but didn't remove it as a local to the function, causing a
compiler warning.

Remove the unused variable.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 425625b24e298..357b497f19ae7 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -523,7 +523,6 @@ static int vc4_plane_to_mb(struct drm_plane *plane,
 	const struct vc_image_format *vc_fmt =
 					vc4_get_vc_image_fmt(drm_fmt->format);
 	int num_planes = fb->format->num_planes;
-	struct drm_display_mode *mode = &state->crtc->mode;
 	unsigned int rotation = SUPPORTED_ROTATIONS;
 
 	mb->plane.vc_image_type = vc_fmt->vc_image;
-- 
GitLab


From eb76255e91c1f5fdbfc6b0b038a2cf8f0d610129 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Mon, 5 Aug 2019 10:44:38 +0100
Subject: [PATCH 1281/1835] staging/vc04_services: Resolve merge issue over
 atomic_inc/dec

e59fc3ed "staging: bcm2835_camera: Ensure all buffers are returned on
disable" was upstreamed and then backported to 4.19 as fcbc6ddcd.
In merging that upstream update back into our tree, the merge
has failed and we have ended up with duplication of the lines.

Fix up this merge issue.

https://github.com/raspberrypi/linux/issues/3124

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
index 134b2e782f242..5bfba5b5b08f1 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c
@@ -270,8 +270,6 @@ static void buffer_work_cb(struct work_struct *work)
 	if (!buffer->cmd)
 		atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
 
-	atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
-
 	msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
 					    msg_context->u.bulk.port,
 					    msg_context->u.bulk.status,
@@ -415,8 +413,6 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
 
 	atomic_inc(&port->buffers_with_vpu);
 
-	atomic_inc(&port->buffers_with_vpu);
-
 	/* prep the buffer from host message */
 	memset(&m, 0xbc, sizeof(m));	/* just to make debug clearer */
 
-- 
GitLab


From a86716fb9f7668aea882d1f890ff30b75eff4bfc Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 11 Jul 2019 14:57:09 +0100
Subject: [PATCH 1282/1835] staging:bcm2835-codec: Expand logging on format
 setting

Adds some more useful logging during format changed events and
s_fmt.

Reported by: zillevdr <zillevdr@gmx.de>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c   | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 2902e49a7c779..a6ef88958b60e 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -753,6 +753,10 @@ static void handle_fmt_changed(struct bcm2835_codec_ctx *ctx,
 		 format->es.video.color_space);
 
 	q_data = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "%s: Format was %ux%u, crop %ux%u\n",
+		 __func__, q_data->bytesperline, q_data->height,
+		 q_data->crop_width, q_data->crop_height);
+
 	q_data->crop_width = format->es.video.crop.width;
 	q_data->crop_height = format->es.video.crop.height;
 	q_data->bytesperline = format->es.video.crop.width;
@@ -1110,10 +1114,10 @@ static int vidioc_s_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 	bool update_capture_port = false;
 	int ret;
 
-	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev, "Setting format for type %d, wxh: %dx%d, fmt: %08x, size %u\n",
+	v4l2_dbg(1, debug, &ctx->dev->v4l2_dev,	"Setting format for type %d, wxh: %dx%d, fmt: " V4L2_FOURCC_CONV ", size %u\n",
 		 f->type, f->fmt.pix_mp.width, f->fmt.pix_mp.height,
-		 f->fmt.pix_mp.pixelformat, f->fmt.pix_mp.plane_fmt[0].sizeimage);
-
+		 V4L2_FOURCC_CONV_ARGS(f->fmt.pix_mp.pixelformat),
+		 f->fmt.pix_mp.plane_fmt[0].sizeimage);
 
 	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
 	if (!vq)
-- 
GitLab


From 6da0550a342143e11ca1d558b5307aac6c284514 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 11 Jul 2019 14:58:35 +0100
Subject: [PATCH 1283/1835] staging: bcm2835-codec: Correct bytesperline on
 format changed

The handling of format changed events incorrectly set bytesperline
to the cropped width, which ignored padding and formats with
more than 8bpp.
Fix these.

Reported by: zillevdr <zillevdr@gmx.de>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index a6ef88958b60e..66edec1197ea4 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -759,7 +759,9 @@ static void handle_fmt_changed(struct bcm2835_codec_ctx *ctx,
 
 	q_data->crop_width = format->es.video.crop.width;
 	q_data->crop_height = format->es.video.crop.height;
-	q_data->bytesperline = format->es.video.crop.width;
+	q_data->bytesperline = get_bytesperline(format->es.video.width,
+						q_data->fmt);
+
 	q_data->height = format->es.video.height;
 	q_data->sizeimage = format->buffer_size_min;
 	if (format->es.video.color_space)
-- 
GitLab


From 3c1d1bad8a571cefed38df5931d2bd9fe4d5dc38 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Thu, 2 May 2019 17:19:18 +0100
Subject: [PATCH 1284/1835] ARM: riscpc: fix DMA

[ Upstream commit ffd9a1ba9fdb7f2bd1d1ad9b9243d34e96756ba2 ]

DMA got broken a while back in two different ways:
1) a change in the behaviour of disable_irq() to wait for the interrupt
   to finish executing causes us to deadlock at the end of DMA.
2) a change to avoid modifying the scatterlist left the first transfer
   uninitialised.

DMA is only used with expansion cards, so has gone unnoticed.

Fixes: fa4e99899932 ("[ARM] dma: RiscPC: don't modify DMA SG entries")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-rpc/dma.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-rpc/dma.c b/arch/arm/mach-rpc/dma.c
index fb48f3141fb4d..c4c96661eb89a 100644
--- a/arch/arm/mach-rpc/dma.c
+++ b/arch/arm/mach-rpc/dma.c
@@ -131,7 +131,7 @@ static irqreturn_t iomd_dma_handle(int irq, void *dev_id)
 	} while (1);
 
 	idma->state = ~DMA_ST_AB;
-	disable_irq(irq);
+	disable_irq_nosync(irq);
 
 	return IRQ_HANDLED;
 }
@@ -174,6 +174,9 @@ static void iomd_enable_dma(unsigned int chan, dma_t *dma)
 				DMA_FROM_DEVICE : DMA_TO_DEVICE);
 		}
 
+		idma->dma_addr = idma->dma.sg->dma_address;
+		idma->dma_len = idma->dma.sg->length;
+
 		iomd_writeb(DMA_CR_C, dma_base + CR);
 		idma->state = DMA_ST_AB;
 	}
-- 
GitLab


From 8c5a33d34be671cf009e2adac4cd21b3999a8d52 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 3 May 2019 16:41:42 -0700
Subject: [PATCH 1285/1835] ARM: dts: rockchip: Make rk3288-veyron-minnie run
 at hs200

[ Upstream commit 1c0479023412ab7834f2e98b796eb0d8c627cd62 ]

As some point hs200 was failing on rk3288-veyron-minnie.  See commit
984926781122 ("ARM: dts: rockchip: temporarily remove emmc hs200 speed
from rk3288 minnie").  Although I didn't track down exactly when it
started working, it seems to work OK now, so let's turn it back on.

To test this, I booted from SD card and then used this script to
stress the enumeration process after fixing a memory leak [1]:
  cd /sys/bus/platform/drivers/dwmmc_rockchip
  for i in $(seq 1 3000); do
    echo "========================" $i
    echo ff0f0000.dwmmc > unbind
    sleep .5
    echo ff0f0000.dwmmc > bind
    while true; do
      if [ -e /dev/mmcblk2 ]; then
        break;
      fi
      sleep .1
    done
  done

It worked fine.

[1] https://lkml.kernel.org/r/20190503233526.226272-1-dianders@chromium.org

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/rk3288-veyron-minnie.dts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm/boot/dts/rk3288-veyron-minnie.dts b/arch/arm/boot/dts/rk3288-veyron-minnie.dts
index f95d0c5fcf712..6e8946052c78b 100644
--- a/arch/arm/boot/dts/rk3288-veyron-minnie.dts
+++ b/arch/arm/boot/dts/rk3288-veyron-minnie.dts
@@ -90,10 +90,6 @@
 	pwm-off-delay-ms = <200>;
 };
 
-&emmc {
-	/delete-property/mmc-hs200-1_8v;
-};
-
 &gpio_keys {
 	pinctrl-0 = <&pwr_key_l &ap_lid_int_l &volum_down_l &volum_up_l>;
 
-- 
GitLab


From 22befe671728c8570c59477b36e96645ea25b46a Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 3 May 2019 16:45:37 -0700
Subject: [PATCH 1286/1835] ARM: dts: rockchip: Make rk3288-veyron-mickey's
 emmc work again

[ Upstream commit 99fa066710f75f18f4d9a5bc5f6a711968a581d5 ]

When I try to boot rk3288-veyron-mickey I totally fail to make the
eMMC work.  Specifically my logs (on Chrome OS 4.19):

  mmc_host mmc1: card is non-removable.
  mmc_host mmc1: Bus speed (slot 0) = 400000Hz (slot req 400000Hz, actual 400000HZ div = 0)
  mmc_host mmc1: Bus speed (slot 0) = 50000000Hz (slot req 52000000Hz, actual 50000000HZ div = 0)
  mmc1: switch to bus width 8 failed
  mmc1: switch to bus width 4 failed
  mmc1: new high speed MMC card at address 0001
  mmcblk1: mmc1:0001 HAG2e 14.7 GiB
  mmcblk1boot0: mmc1:0001 HAG2e partition 1 4.00 MiB
  mmcblk1boot1: mmc1:0001 HAG2e partition 2 4.00 MiB
  mmcblk1rpmb: mmc1:0001 HAG2e partition 3 4.00 MiB, chardev (243:0)
  mmc_host mmc1: Bus speed (slot 0) = 400000Hz (slot req 400000Hz, actual 400000HZ div = 0)
  mmc_host mmc1: Bus speed (slot 0) = 50000000Hz (slot req 52000000Hz, actual 50000000HZ div = 0)
  mmc1: switch to bus width 8 failed
  mmc1: switch to bus width 4 failed
  mmc1: tried to HW reset card, got error -110
  mmcblk1: error -110 requesting status
  mmcblk1: recovery failed!
  print_req_error: I/O error, dev mmcblk1, sector 0
  ...

When I remove the '/delete-property/mmc-hs200-1_8v' then everything is
hunky dory.

That line comes from the original submission of the mickey dts
upstream, so presumably at the time the HS200 was failing and just
enumerating things as a high speed device was fine.  ...or maybe it's
just that some mickey devices work when enumerating at "high speed",
just not mine?

In any case, hs200 seems good now.  Let's turn it on.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/rk3288-veyron-mickey.dts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm/boot/dts/rk3288-veyron-mickey.dts b/arch/arm/boot/dts/rk3288-veyron-mickey.dts
index 1e0158acf895d..a593d0a998fc8 100644
--- a/arch/arm/boot/dts/rk3288-veyron-mickey.dts
+++ b/arch/arm/boot/dts/rk3288-veyron-mickey.dts
@@ -124,10 +124,6 @@
 	};
 };
 
-&emmc {
-	/delete-property/mmc-hs200-1_8v;
-};
-
 &i2c2 {
 	status = "disabled";
 };
-- 
GitLab


From ea26b427cb91810be09dc2614ef3b51d3b5fd1ee Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Tue, 21 May 2019 16:49:33 -0700
Subject: [PATCH 1287/1835] ARM: dts: rockchip: Mark that the rk3288 timer
 might stop in suspend

[ Upstream commit 8ef1ba39a9fa53d2205e633bc9b21840a275908e ]

This is similar to commit e6186820a745 ("arm64: dts: rockchip: Arch
counter doesn't tick in system suspend").  Specifically on the rk3288
it can be seen that the timer stops ticking in suspend if we end up
running through the "osc_disable" path in rk3288_slp_mode_set().  In
that path the 24 MHz clock will turn off and the timer stops.

To test this, I ran this on a Chrome OS filesystem:
  before=$(date); \
  suspend_stress_test -c1 --suspend_min=30 --suspend_max=31; \
  echo ${before}; date

...and I found that unless I plug in a device that requests USB wakeup
to be active that the two calls to "date" would show that fewer than
30 seconds passed.

NOTE: deep suspend (where the 24 MHz clock gets disabled) isn't
supported yet on upstream Linux so this was tested on a downstream
kernel.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/rk3288.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index c706adf4aed2f..440d6783faca5 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -227,6 +227,7 @@
 			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
 		clock-frequency = <24000000>;
+		arm,no-tick-in-suspend;
 	};
 
 	timer: timer@ff810000 {
-- 
GitLab


From f486088d38ec174ffdd6183535b45dac6d568e22 Mon Sep 17 00:00:00 2001
From: Cheng Jian <cj.chengjian@huawei.com>
Date: Sat, 4 May 2019 19:39:39 +0800
Subject: [PATCH 1288/1835] ftrace: Enable trampoline when rec count returns
 back to one

[ Upstream commit a124692b698b00026a58d89831ceda2331b2e1d0 ]

Custom trampolines can only be enabled if there is only a single ops
attached to it. If there's only a single callback registered to a function,
and the ops has a trampoline registered for it, then we can call the
trampoline directly. This is very useful for improving the performance of
ftrace and livepatch.

If more than one callback is registered to a function, the general
trampoline is used, and the custom trampoline is not restored back to the
direct call even if all the other callbacks were unregistered and we are
back to one callback for the function.

To fix this, set FTRACE_FL_TRAMP flag if rec count is decremented
to one, and the ops that left has a trampoline.

Testing After this patch :

insmod livepatch_unshare_files.ko
cat /sys/kernel/debug/tracing/enabled_functions

	unshare_files (1) R I	tramp: 0xffffffffc0000000(klp_ftrace_handler+0x0/0xa0) ->ftrace_ops_assist_func+0x0/0xf0

echo unshare_files > /sys/kernel/debug/tracing/set_ftrace_filter
echo function > /sys/kernel/debug/tracing/current_tracer
cat /sys/kernel/debug/tracing/enabled_functions

	unshare_files (2) R I ->ftrace_ops_list_func+0x0/0x150

echo nop > /sys/kernel/debug/tracing/current_tracer
cat /sys/kernel/debug/tracing/enabled_functions

	unshare_files (1) R I	tramp: 0xffffffffc0000000(klp_ftrace_handler+0x0/0xa0) ->ftrace_ops_assist_func+0x0/0xf0

Link: http://lkml.kernel.org/r/1556969979-111047-1-git-send-email-cj.chengjian@huawei.com

Signed-off-by: Cheng Jian <cj.chengjian@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/ftrace.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 118ecce143866..d9dd709b3c12f 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1647,6 +1647,11 @@ static bool test_rec_ops_needs_regs(struct dyn_ftrace *rec)
 	return  keep_regs;
 }
 
+static struct ftrace_ops *
+ftrace_find_tramp_ops_any(struct dyn_ftrace *rec);
+static struct ftrace_ops *
+ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops);
+
 static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
 				     int filter_hash,
 				     bool inc)
@@ -1775,15 +1780,17 @@ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
 			}
 
 			/*
-			 * If the rec had TRAMP enabled, then it needs to
-			 * be cleared. As TRAMP can only be enabled iff
-			 * there is only a single ops attached to it.
-			 * In otherwords, always disable it on decrementing.
-			 * In the future, we may set it if rec count is
-			 * decremented to one, and the ops that is left
-			 * has a trampoline.
+			 * The TRAMP needs to be set only if rec count
+			 * is decremented to one, and the ops that is
+			 * left has a trampoline. As TRAMP can only be
+			 * enabled if there is only a single ops attached
+			 * to it.
 			 */
-			rec->flags &= ~FTRACE_FL_TRAMP;
+			if (ftrace_rec_count(rec) == 1 &&
+			    ftrace_find_tramp_ops_any(rec))
+				rec->flags |= FTRACE_FL_TRAMP;
+			else
+				rec->flags &= ~FTRACE_FL_TRAMP;
 
 			/*
 			 * flags will be cleared in ftrace_check_record()
@@ -1976,11 +1983,6 @@ static void print_ip_ins(const char *fmt, const unsigned char *p)
 		printk(KERN_CONT "%s%02x", i ? ":" : "", p[i]);
 }
 
-static struct ftrace_ops *
-ftrace_find_tramp_ops_any(struct dyn_ftrace *rec);
-static struct ftrace_ops *
-ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops);
-
 enum ftrace_bug_type ftrace_bug_type;
 const void *ftrace_expected;
 
-- 
GitLab


From d8388cbd4327d2dc9e8d12cf396ac97c26fd0b19 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Thu, 30 May 2019 00:43:55 +0300
Subject: [PATCH 1289/1835] dmaengine: tegra-apb: Error out if
 DMA_PREP_INTERRUPT flag is unset

[ Upstream commit dc161064beb83c668e0f85766b92b1e7ed186e58 ]

Apparently driver was never tested with DMA_PREP_INTERRUPT flag being
unset since it completely disables interrupt handling instead of skipping
the callbacks invocations, hence putting channel into unusable state.

The flag is always set by all of kernel drivers that use APB DMA, so let's
error out in otherwise case for consistency. It won't be difficult to
support that case properly if ever will be needed.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra20-apb-dma.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 8219ab88a507c..fb23993430d31 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -981,8 +981,12 @@ static struct dma_async_tx_descriptor *tegra_dma_prep_slave_sg(
 		csr |= tdc->slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
 	}
 
-	if (flags & DMA_PREP_INTERRUPT)
+	if (flags & DMA_PREP_INTERRUPT) {
 		csr |= TEGRA_APBDMA_CSR_IE_EOC;
+	} else {
+		WARN_ON_ONCE(1);
+		return NULL;
+	}
 
 	apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
 
@@ -1124,8 +1128,12 @@ static struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
 		csr |= tdc->slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
 	}
 
-	if (flags & DMA_PREP_INTERRUPT)
+	if (flags & DMA_PREP_INTERRUPT) {
 		csr |= TEGRA_APBDMA_CSR_IE_EOC;
+	} else {
+		WARN_ON_ONCE(1);
+		return NULL;
+	}
 
 	apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
 
-- 
GitLab


From fd53e45a11e9c7f3a1c6f3c9457a0e7d2268064f Mon Sep 17 00:00:00 2001
From: Helen Koike <helen.koike@collabora.com>
Date: Mon, 3 Jun 2019 11:22:15 -0300
Subject: [PATCH 1290/1835] arm64: dts: rockchip: fix isp iommu clocks and
 power domain

[ Upstream commit c432a29d3fc9ee928caeca2f5cf68b3aebfa6817 ]

isp iommu requires wrapper variants of the clocks.
noc variants are always on and using the wrapper variants will activate
{A,H}CLK_ISP{0,1} due to the hierarchy.

Tested using the pending isp patch set (which is not upstream
yet). Without this patch, streaming from the isp stalls.

Also add the respective power domain and remove the "disabled" status.

Refer:
 RK3399 TRM v1.4 Fig. 2-4 RK3399 Clock Architecture Diagram
 RK3399 TRM v1.4 Fig. 8-1 RK3399 Power Domain Partition

Signed-off-by: Helen Koike <helen.koike@collabora.com>
Tested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3399.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index df7e62d9a6708..cea44a7c7cf99 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1643,11 +1643,11 @@
 		reg = <0x0 0xff914000 0x0 0x100>, <0x0 0xff915000 0x0 0x100>;
 		interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH 0>;
 		interrupt-names = "isp0_mmu";
-		clocks = <&cru ACLK_ISP0_NOC>, <&cru HCLK_ISP0_NOC>;
+		clocks = <&cru ACLK_ISP0_WRAPPER>, <&cru HCLK_ISP0_WRAPPER>;
 		clock-names = "aclk", "iface";
 		#iommu-cells = <0>;
+		power-domains = <&power RK3399_PD_ISP0>;
 		rockchip,disable-mmu-reset;
-		status = "disabled";
 	};
 
 	isp1_mmu: iommu@ff924000 {
@@ -1655,11 +1655,11 @@
 		reg = <0x0 0xff924000 0x0 0x100>, <0x0 0xff925000 0x0 0x100>;
 		interrupts = <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH 0>;
 		interrupt-names = "isp1_mmu";
-		clocks = <&cru ACLK_ISP1_NOC>, <&cru HCLK_ISP1_NOC>;
+		clocks = <&cru ACLK_ISP1_WRAPPER>, <&cru HCLK_ISP1_WRAPPER>;
 		clock-names = "aclk", "iface";
 		#iommu-cells = <0>;
+		power-domains = <&power RK3399_PD_ISP1>;
 		rockchip,disable-mmu-reset;
-		status = "disabled";
 	};
 
 	hdmi_sound: hdmi-sound {
-- 
GitLab


From 09ec6c6783ff0414cfb85798b3f08bd8c3493314 Mon Sep 17 00:00:00 2001
From: Prarit Bhargava <prarit@redhat.com>
Date: Wed, 29 May 2019 07:26:25 -0400
Subject: [PATCH 1291/1835] kernel/module.c: Only return -EEXIST for modules
 that have finished loading

[ Upstream commit 6e6de3dee51a439f76eb73c22ae2ffd2c9384712 ]

Microsoft HyperV disables the X86_FEATURE_SMCA bit on AMD systems, and
linux guests boot with repeated errors:

amd64_edac_mod: Unknown symbol amd_unregister_ecc_decoder (err -2)
amd64_edac_mod: Unknown symbol amd_register_ecc_decoder (err -2)
amd64_edac_mod: Unknown symbol amd_report_gart_errors (err -2)
amd64_edac_mod: Unknown symbol amd_unregister_ecc_decoder (err -2)
amd64_edac_mod: Unknown symbol amd_register_ecc_decoder (err -2)
amd64_edac_mod: Unknown symbol amd_report_gart_errors (err -2)

The warnings occur because the module code erroneously returns -EEXIST
for modules that have failed to load and are in the process of being
removed from the module list.

module amd64_edac_mod has a dependency on module edac_mce_amd.  Using
modules.dep, systemd will load edac_mce_amd for every request of
amd64_edac_mod.  When the edac_mce_amd module loads, the module has
state MODULE_STATE_UNFORMED and once the module load fails and the state
becomes MODULE_STATE_GOING.  Another request for edac_mce_amd module
executes and add_unformed_module() will erroneously return -EEXIST even
though the previous instance of edac_mce_amd has MODULE_STATE_GOING.
Upon receiving -EEXIST, systemd attempts to load amd64_edac_mod, which
fails because of unknown symbols from edac_mce_amd.

add_unformed_module() must wait to return for any case other than
MODULE_STATE_LIVE to prevent a race between multiple loads of
dependent modules.

Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Signed-off-by: Barret Rhoden <brho@google.com>
Cc: David Arcari <darcari@redhat.com>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/module.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index b8f37376856bd..3fda10c549a25 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3388,8 +3388,7 @@ static bool finished_loading(const char *name)
 	sched_annotate_sleep();
 	mutex_lock(&module_mutex);
 	mod = find_module_all(name, strlen(name), true);
-	ret = !mod || mod->state == MODULE_STATE_LIVE
-		|| mod->state == MODULE_STATE_GOING;
+	ret = !mod || mod->state == MODULE_STATE_LIVE;
 	mutex_unlock(&module_mutex);
 
 	return ret;
@@ -3559,8 +3558,7 @@ again:
 	mutex_lock(&module_mutex);
 	old = find_module_all(mod->name, strlen(mod->name), true);
 	if (old != NULL) {
-		if (old->state == MODULE_STATE_COMING
-		    || old->state == MODULE_STATE_UNFORMED) {
+		if (old->state != MODULE_STATE_LIVE) {
 			/* Wait in case it fails to load. */
 			mutex_unlock(&module_mutex);
 			err = wait_event_interruptible(module_wq,
-- 
GitLab


From cdee3f53510a65c07b98e18a534c69b62027eb96 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
Date: Mon, 10 Jun 2019 18:38:29 +0100
Subject: [PATCH 1292/1835] firmware/psci: psci_checker: Park kthreads before
 stopping them

[ Upstream commit 92e074acf6f7694e96204265eb18ac113f546e80 ]

Since commit 85f1abe0019f ("kthread, sched/wait: Fix kthread_parkme()
completion issue"), kthreads that are bound to a CPU must be parked
before being stopped. At the moment the PSCI checker calls
kthread_stop() directly on the suspend kthread, which triggers the
following warning:

[    6.068288] WARNING: CPU: 1 PID: 1 at kernel/kthread.c:398 __kthread_bind_mask+0x20/0x78
               ...
[    6.190151] Call trace:
[    6.192566]  __kthread_bind_mask+0x20/0x78
[    6.196615]  kthread_unpark+0x74/0x80
[    6.200235]  kthread_stop+0x44/0x1d8
[    6.203769]  psci_checker+0x3bc/0x484
[    6.207389]  do_one_initcall+0x48/0x260
[    6.211180]  kernel_init_freeable+0x2c8/0x368
[    6.215488]  kernel_init+0x10/0x100
[    6.218935]  ret_from_fork+0x10/0x1c
[    6.222467] ---[ end trace e05e22863d043cd3 ]---

kthread_unpark() tries to bind the thread to its CPU and aborts with a
WARN() if the thread wasn't in TASK_PARKED state. Park the kthreads
before stopping them.

Fixes: 85f1abe0019f ("kthread, sched/wait: Fix kthread_parkme() completion issue")
Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/psci_checker.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/psci_checker.c b/drivers/firmware/psci_checker.c
index 3469436579622..cbd53cb1b2d47 100644
--- a/drivers/firmware/psci_checker.c
+++ b/drivers/firmware/psci_checker.c
@@ -366,16 +366,16 @@ static int suspend_test_thread(void *arg)
 	for (;;) {
 		/* Needs to be set first to avoid missing a wakeup. */
 		set_current_state(TASK_INTERRUPTIBLE);
-		if (kthread_should_stop()) {
-			__set_current_state(TASK_RUNNING);
+		if (kthread_should_park())
 			break;
-		}
 		schedule();
 	}
 
 	pr_info("CPU %d suspend test results: success %d, shallow states %d, errors %d\n",
 		cpu, nb_suspend, nb_shallow_sleep, nb_err);
 
+	kthread_parkme();
+
 	return nb_err;
 }
 
@@ -440,8 +440,10 @@ static int suspend_tests(void)
 
 
 	/* Stop and destroy all threads, get return status. */
-	for (i = 0; i < nb_threads; ++i)
+	for (i = 0; i < nb_threads; ++i) {
+		err += kthread_park(threads[i]);
 		err += kthread_stop(threads[i]);
+	}
  out:
 	cpuidle_resume_and_unlock();
 	kfree(threads);
-- 
GitLab


From a3524486535a02aa5db127a70e2bf6a0f7f62cd4 Mon Sep 17 00:00:00 2001
From: Petr Cvek <petrcvekcz@gmail.com>
Date: Thu, 20 Jun 2019 23:39:37 +0200
Subject: [PATCH 1293/1835] MIPS: lantiq: Fix bitfield masking

[ Upstream commit ba1bc0fcdeaf3bf583c1517bd2e3e29cf223c969 ]

The modification of EXIN register doesn't clean the bitfield before
the writing of a new value. After a few modifications the bitfield would
accumulate only '1's.

Signed-off-by: Petr Cvek <petrcvekcz@gmail.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: hauke@hauke-m.de
Cc: john@phrozen.org
Cc: linux-mips@vger.kernel.org
Cc: openwrt-devel@lists.openwrt.org
Cc: pakahmar@hotmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lantiq/irq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index c4ef1c31e0c4f..37caeadb2964c 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -156,8 +156,9 @@ static int ltq_eiu_settype(struct irq_data *d, unsigned int type)
 			if (edge)
 				irq_set_handler(d->hwirq, handle_edge_irq);
 
-			ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_C) |
-				(val << (i * 4)), LTQ_EIU_EXIN_C);
+			ltq_eiu_w32((ltq_eiu_r32(LTQ_EIU_EXIN_C) &
+				    (~(7 << (i * 4)))) | (val << (i * 4)),
+				    LTQ_EIU_EXIN_C);
 		}
 	}
 
-- 
GitLab


From cf0fcc7fe2008a8cf7c53ab6af2901a61204700e Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Mon, 24 Jun 2019 14:38:18 +0200
Subject: [PATCH 1294/1835] dmaengine: rcar-dmac: Reject zero-length slave DMA
 requests

[ Upstream commit 78efb76ab4dfb8f74f290ae743f34162cd627f19 ]

While the .device_prep_slave_sg() callback rejects empty scatterlists,
it still accepts single-entry scatterlists with a zero-length segment.
These may happen if a driver calls dmaengine_prep_slave_single() with a
zero len parameter.  The corresponding DMA request will never complete,
leading to messages like:

    rcar-dmac e7300000.dma-controller: Channel Address Error happen

and DMA timeouts.

Although requesting a zero-length DMA request is a driver bug, rejecting
it early eases debugging.  Note that the .device_prep_dma_memcpy()
callback already rejects requests to copy zero bytes.

Reported-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Analyzed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/sh/rcar-dmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index 0b05a1e08d213..041ce864097e4 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1164,7 +1164,7 @@ rcar_dmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 	struct rcar_dmac_chan *rchan = to_rcar_dmac_chan(chan);
 
 	/* Someone calling slave DMA on a generic channel? */
-	if (rchan->mid_rid < 0 || !sg_len) {
+	if (rchan->mid_rid < 0 || !sg_len || !sg_dma_len(sgl)) {
 		dev_warn(chan->device->dev,
 			 "%s: bad parameter: len=%d, id=%d\n",
 			 __func__, sg_len, rchan->mid_rid);
-- 
GitLab


From 85d854b421130b3f9a6bee50be9f159e578e6b6d Mon Sep 17 00:00:00 2001
From: JC Kuo <jckuo@nvidia.com>
Date: Wed, 12 Jun 2019 11:14:34 +0800
Subject: [PATCH 1295/1835] clk: tegra210: fix PLLU and PLLU_OUT1

[ Upstream commit 0d34dfbf3023cf119b83f6470692c0b10c832495 ]

Full-speed and low-speed USB devices do not work with Tegra210
platforms because of incorrect PLLU/PLLU_OUT1 clock settings.

When full-speed device is connected:
[   14.059886] usb 1-3: new full-speed USB device number 2 using tegra-xusb
[   14.196295] usb 1-3: device descriptor read/64, error -71
[   14.436311] usb 1-3: device descriptor read/64, error -71
[   14.675749] usb 1-3: new full-speed USB device number 3 using tegra-xusb
[   14.812335] usb 1-3: device descriptor read/64, error -71
[   15.052316] usb 1-3: device descriptor read/64, error -71
[   15.164799] usb usb1-port3: attempt power cycle

When low-speed device is connected:
[   37.610949] usb usb1-port3: Cannot enable. Maybe the USB cable is bad?
[   38.557376] usb usb1-port3: Cannot enable. Maybe the USB cable is bad?
[   38.564977] usb usb1-port3: attempt power cycle

This commit fixes the issue by:
 1. initializing PLLU_OUT1 before initializing XUSB_FS_SRC clock
    because PLLU_OUT1 is parent of XUSB_FS_SRC.
 2. changing PLLU post-divider to /2 (DIVP=1) according to Technical
    Reference Manual.

Fixes: e745f992cf4b ("clk: tegra: Rework pll_u")
Signed-off-by: JC Kuo <jckuo@nvidia.com>
Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/tegra/clk-tegra210.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
index 9eb1cb14fce11..4e1bc23c98655 100644
--- a/drivers/clk/tegra/clk-tegra210.c
+++ b/drivers/clk/tegra/clk-tegra210.c
@@ -2214,9 +2214,9 @@ static struct div_nmp pllu_nmp = {
 };
 
 static struct tegra_clk_pll_freq_table pll_u_freq_table[] = {
-	{ 12000000, 480000000, 40, 1, 0, 0 },
-	{ 13000000, 480000000, 36, 1, 0, 0 }, /* actual: 468.0 MHz */
-	{ 38400000, 480000000, 25, 2, 0, 0 },
+	{ 12000000, 480000000, 40, 1, 1, 0 },
+	{ 13000000, 480000000, 36, 1, 1, 0 }, /* actual: 468.0 MHz */
+	{ 38400000, 480000000, 25, 2, 1, 0 },
 	{        0,         0,  0, 0, 0, 0 },
 };
 
@@ -3343,6 +3343,7 @@ static struct tegra_clk_init_table init_table[] __initdata = {
 	{ TEGRA210_CLK_DFLL_REF, TEGRA210_CLK_PLL_P, 51000000, 1 },
 	{ TEGRA210_CLK_SBC4, TEGRA210_CLK_PLL_P, 12000000, 1 },
 	{ TEGRA210_CLK_PLL_RE_VCO, TEGRA210_CLK_CLK_MAX, 672000000, 1 },
+	{ TEGRA210_CLK_PLL_U_OUT1, TEGRA210_CLK_CLK_MAX, 48000000, 1 },
 	{ TEGRA210_CLK_XUSB_GATE, TEGRA210_CLK_CLK_MAX, 0, 1 },
 	{ TEGRA210_CLK_XUSB_SS_SRC, TEGRA210_CLK_PLL_U_480M, 120000000, 0 },
 	{ TEGRA210_CLK_XUSB_FS_SRC, TEGRA210_CLK_PLL_U_48M, 48000000, 0 },
@@ -3367,7 +3368,6 @@ static struct tegra_clk_init_table init_table[] __initdata = {
 	{ TEGRA210_CLK_PLL_DP, TEGRA210_CLK_CLK_MAX, 270000000, 0 },
 	{ TEGRA210_CLK_SOC_THERM, TEGRA210_CLK_PLL_P, 51000000, 0 },
 	{ TEGRA210_CLK_CCLK_G, TEGRA210_CLK_CLK_MAX, 0, 1 },
-	{ TEGRA210_CLK_PLL_U_OUT1, TEGRA210_CLK_CLK_MAX, 48000000, 1 },
 	{ TEGRA210_CLK_PLL_U_OUT2, TEGRA210_CLK_CLK_MAX, 60000000, 1 },
 	/* This MUST be the last entry. */
 	{ TEGRA210_CLK_CLK_MAX, TEGRA210_CLK_CLK_MAX, 0, 0 },
-- 
GitLab


From a093208b4c73fcf4519828a8338245c139ecfd4b Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Tue, 4 Jun 2019 14:50:14 +0100
Subject: [PATCH 1296/1835] fs/adfs: super: fix use-after-free bug

[ Upstream commit 5808b14a1f52554de612fee85ef517199855e310 ]

Fix a use-after-free bug during filesystem initialisation, where we
access the disc record (which is stored in a buffer) after we have
released the buffer.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/adfs/super.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index 7e099a7a4eb1e..4dc15b2634894 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -369,6 +369,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
 	struct buffer_head *bh;
 	struct object_info root_obj;
 	unsigned char *b_data;
+	unsigned int blocksize;
 	struct adfs_sb_info *asb;
 	struct inode *root;
 	int ret = -EINVAL;
@@ -420,8 +421,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
 		goto error_free_bh;
 	}
 
+	blocksize = 1 << dr->log2secsize;
 	brelse(bh);
-	if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {
+
+	if (sb_set_blocksize(sb, blocksize)) {
 		bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
 		if (!bh) {
 			adfs_error(sb, "couldn't read superblock on "
-- 
GitLab


From e7fcc587e0763c5061f0a5220f8dfa41f71e64bc Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <zhang.chunyan@linaro.org>
Date: Wed, 22 May 2019 09:15:03 +0800
Subject: [PATCH 1297/1835] clk: sprd: Add check for return value of
 sprd_clk_regmap_init()

[ Upstream commit c974c48deeb969c5e4250e4f06af91edd84b1f10 ]

sprd_clk_regmap_init() doesn't always return success, adding check
for its return value should make the code more strong.

Signed-off-by: Chunyan Zhang <zhang.chunyan@linaro.org>
Reviewed-by: Baolin Wang <baolin.wang@linaro.org>
[sboyd@kernel.org: Add a missing int ret]
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sprd/sc9860-clk.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/sprd/sc9860-clk.c b/drivers/clk/sprd/sc9860-clk.c
index 9980ab55271ba..f76305b4bc8df 100644
--- a/drivers/clk/sprd/sc9860-clk.c
+++ b/drivers/clk/sprd/sc9860-clk.c
@@ -2023,6 +2023,7 @@ static int sc9860_clk_probe(struct platform_device *pdev)
 {
 	const struct of_device_id *match;
 	const struct sprd_clk_desc *desc;
+	int ret;
 
 	match = of_match_node(sprd_sc9860_clk_ids, pdev->dev.of_node);
 	if (!match) {
@@ -2031,7 +2032,9 @@ static int sc9860_clk_probe(struct platform_device *pdev)
 	}
 
 	desc = match->data;
-	sprd_clk_regmap_init(pdev, desc);
+	ret = sprd_clk_regmap_init(pdev, desc);
+	if (ret)
+		return ret;
 
 	return sprd_clk_probe(&pdev->dev, desc->hw_clks);
 }
-- 
GitLab


From d9245dabfce1f421733c3bab00e579c2df337d8e Mon Sep 17 00:00:00 2001
From: David Sterba <dsterba@suse.com>
Date: Fri, 17 May 2019 11:43:13 +0200
Subject: [PATCH 1298/1835] btrfs: fix minimum number of chunk errors for DUP

[ Upstream commit 0ee5f8ae082e1f675a2fb6db601c31ac9958a134 ]

The list of profiles in btrfs_chunk_max_errors lists DUP as a profile
DUP able to tolerate 1 device missing. Though this profile is special
with 2 copies, it still needs the device, unlike the others.

Looking at the history of changes, thre's no clear reason why DUP is
there, functions were refactored and blocks of code merged to one
helper.

d20983b40e828 Btrfs: fix writing data into the seed filesystem
  - factor code to a helper

de11cc12df173 Btrfs: don't pre-allocate btrfs bio
  - unrelated change, DUP still in the list with max errors 1

a236aed14ccb0 Btrfs: Deal with failed writes in mirrored configurations
  - introduced the max errors, leaves DUP and RAID1 in the same group

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2fd000308be76..6e008bd5c8cd1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -5040,8 +5040,7 @@ static inline int btrfs_chunk_max_errors(struct map_lookup *map)
 
 	if (map->type & (BTRFS_BLOCK_GROUP_RAID1 |
 			 BTRFS_BLOCK_GROUP_RAID10 |
-			 BTRFS_BLOCK_GROUP_RAID5 |
-			 BTRFS_BLOCK_GROUP_DUP)) {
+			 BTRFS_BLOCK_GROUP_RAID5)) {
 		max_errors = 1;
 	} else if (map->type & BTRFS_BLOCK_GROUP_RAID6) {
 		max_errors = 2;
-- 
GitLab


From f96c70fa810d233cf271267dbcb274663b98017c Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Thu, 13 Jun 2019 17:31:24 +0800
Subject: [PATCH 1299/1835] btrfs: qgroup: Don't hold qgroup_ioctl_lock in
 btrfs_qgroup_inherit()

[ Upstream commit e88439debd0a7f969b3ddba6f147152cd0732676 ]

[BUG]
Lockdep will report the following circular locking dependency:

  WARNING: possible circular locking dependency detected
  5.2.0-rc2-custom #24 Tainted: G           O
  ------------------------------------------------------
  btrfs/8631 is trying to acquire lock:
  000000002536438c (&fs_info->qgroup_ioctl_lock#2){+.+.}, at: btrfs_qgroup_inherit+0x40/0x620 [btrfs]

  but task is already holding lock:
  000000003d52cc23 (&fs_info->tree_log_mutex){+.+.}, at: create_pending_snapshot+0x8b6/0xe60 [btrfs]

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #2 (&fs_info->tree_log_mutex){+.+.}:
         __mutex_lock+0x76/0x940
         mutex_lock_nested+0x1b/0x20
         btrfs_commit_transaction+0x475/0xa00 [btrfs]
         btrfs_commit_super+0x71/0x80 [btrfs]
         close_ctree+0x2bd/0x320 [btrfs]
         btrfs_put_super+0x15/0x20 [btrfs]
         generic_shutdown_super+0x72/0x110
         kill_anon_super+0x18/0x30
         btrfs_kill_super+0x16/0xa0 [btrfs]
         deactivate_locked_super+0x3a/0x80
         deactivate_super+0x51/0x60
         cleanup_mnt+0x3f/0x80
         __cleanup_mnt+0x12/0x20
         task_work_run+0x94/0xb0
         exit_to_usermode_loop+0xd8/0xe0
         do_syscall_64+0x210/0x240
         entry_SYSCALL_64_after_hwframe+0x49/0xbe

  -> #1 (&fs_info->reloc_mutex){+.+.}:
         __mutex_lock+0x76/0x940
         mutex_lock_nested+0x1b/0x20
         btrfs_commit_transaction+0x40d/0xa00 [btrfs]
         btrfs_quota_enable+0x2da/0x730 [btrfs]
         btrfs_ioctl+0x2691/0x2b40 [btrfs]
         do_vfs_ioctl+0xa9/0x6d0
         ksys_ioctl+0x67/0x90
         __x64_sys_ioctl+0x1a/0x20
         do_syscall_64+0x65/0x240
         entry_SYSCALL_64_after_hwframe+0x49/0xbe

  -> #0 (&fs_info->qgroup_ioctl_lock#2){+.+.}:
         lock_acquire+0xa7/0x190
         __mutex_lock+0x76/0x940
         mutex_lock_nested+0x1b/0x20
         btrfs_qgroup_inherit+0x40/0x620 [btrfs]
         create_pending_snapshot+0x9d7/0xe60 [btrfs]
         create_pending_snapshots+0x94/0xb0 [btrfs]
         btrfs_commit_transaction+0x415/0xa00 [btrfs]
         btrfs_mksubvol+0x496/0x4e0 [btrfs]
         btrfs_ioctl_snap_create_transid+0x174/0x180 [btrfs]
         btrfs_ioctl_snap_create_v2+0x11c/0x180 [btrfs]
         btrfs_ioctl+0xa90/0x2b40 [btrfs]
         do_vfs_ioctl+0xa9/0x6d0
         ksys_ioctl+0x67/0x90
         __x64_sys_ioctl+0x1a/0x20
         do_syscall_64+0x65/0x240
         entry_SYSCALL_64_after_hwframe+0x49/0xbe

  other info that might help us debug this:

  Chain exists of:
    &fs_info->qgroup_ioctl_lock#2 --> &fs_info->reloc_mutex --> &fs_info->tree_log_mutex

   Possible unsafe locking scenario:

         CPU0                    CPU1
         ----                    ----
    lock(&fs_info->tree_log_mutex);
                                 lock(&fs_info->reloc_mutex);
                                 lock(&fs_info->tree_log_mutex);
    lock(&fs_info->qgroup_ioctl_lock#2);

   *** DEADLOCK ***

  6 locks held by btrfs/8631:
   #0: 00000000ed8f23f6 (sb_writers#12){.+.+}, at: mnt_want_write_file+0x28/0x60
   #1: 000000009fb1597a (&type->i_mutex_dir_key#10/1){+.+.}, at: btrfs_mksubvol+0x70/0x4e0 [btrfs]
   #2: 0000000088c5ad88 (&fs_info->subvol_sem){++++}, at: btrfs_mksubvol+0x128/0x4e0 [btrfs]
   #3: 000000009606fc3e (sb_internal#2){.+.+}, at: start_transaction+0x37a/0x520 [btrfs]
   #4: 00000000f82bbdf5 (&fs_info->reloc_mutex){+.+.}, at: btrfs_commit_transaction+0x40d/0xa00 [btrfs]
   #5: 000000003d52cc23 (&fs_info->tree_log_mutex){+.+.}, at: create_pending_snapshot+0x8b6/0xe60 [btrfs]

[CAUSE]
Due to the delayed subvolume creation, we need to call
btrfs_qgroup_inherit() inside commit transaction code, with a lot of
other mutex hold.
This hell of lock chain can lead to above problem.

[FIX]
On the other hand, we don't really need to hold qgroup_ioctl_lock if
we're in the context of create_pending_snapshot().
As in that context, we're the only one being able to modify qgroup.

All other qgroup functions which needs qgroup_ioctl_lock are either
holding a transaction handle, or will start a new transaction:
  Functions will start a new transaction():
  * btrfs_quota_enable()
  * btrfs_quota_disable()
  Functions hold a transaction handler:
  * btrfs_add_qgroup_relation()
  * btrfs_del_qgroup_relation()
  * btrfs_create_qgroup()
  * btrfs_remove_qgroup()
  * btrfs_limit_qgroup()
  * btrfs_qgroup_inherit() call inside create_subvol()

So we have a higher level protection provided by transaction, thus we
don't need to always hold qgroup_ioctl_lock in btrfs_qgroup_inherit().

Only the btrfs_qgroup_inherit() call in create_subvol() needs to hold
qgroup_ioctl_lock, while the btrfs_qgroup_inherit() call in
create_pending_snapshot() is already protected by transaction.

So the fix is to detect the context by checking
trans->transaction->state.
If we're at TRANS_STATE_COMMIT_DOING, then we're in commit transaction
context and no need to get the mutex.

Reported-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/qgroup.c | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index e46e83e876001..734866ab51941 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2249,6 +2249,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
 	int ret = 0;
 	int i;
 	u64 *i_qgroups;
+	bool committing = false;
 	struct btrfs_fs_info *fs_info = trans->fs_info;
 	struct btrfs_root *quota_root;
 	struct btrfs_qgroup *srcgroup;
@@ -2256,7 +2257,25 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
 	u32 level_size = 0;
 	u64 nums;
 
-	mutex_lock(&fs_info->qgroup_ioctl_lock);
+	/*
+	 * There are only two callers of this function.
+	 *
+	 * One in create_subvol() in the ioctl context, which needs to hold
+	 * the qgroup_ioctl_lock.
+	 *
+	 * The other one in create_pending_snapshot() where no other qgroup
+	 * code can modify the fs as they all need to either start a new trans
+	 * or hold a trans handler, thus we don't need to hold
+	 * qgroup_ioctl_lock.
+	 * This would avoid long and complex lock chain and make lockdep happy.
+	 */
+	spin_lock(&fs_info->trans_lock);
+	if (trans->transaction->state == TRANS_STATE_COMMIT_DOING)
+		committing = true;
+	spin_unlock(&fs_info->trans_lock);
+
+	if (!committing)
+		mutex_lock(&fs_info->qgroup_ioctl_lock);
 	if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
 		goto out;
 
@@ -2420,7 +2439,8 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
 unlock:
 	spin_unlock(&fs_info->qgroup_lock);
 out:
-	mutex_unlock(&fs_info->qgroup_ioctl_lock);
+	if (!committing)
+		mutex_unlock(&fs_info->qgroup_ioctl_lock);
 	return ret;
 }
 
-- 
GitLab


From d29fbf6779639cec8c04e1087c3feaab4c7b5e58 Mon Sep 17 00:00:00 2001
From: Ronnie Sahlberg <lsahlber@redhat.com>
Date: Sat, 6 Jul 2019 06:52:46 +1000
Subject: [PATCH 1300/1835] cifs: Fix a race condition with cifs_echo_request

[ Upstream commit f2caf901c1b7ce65f9e6aef4217e3241039db768 ]

There is a race condition with how we send (or supress and don't send)
smb echos that will cause the client to incorrectly think the
server is unresponsive and thus needs to be reconnected.

Summary of the race condition:
 1) Daisy chaining scheduling creates a gap.
 2) If traffic comes unfortunate shortly after
    the last echo, the planned echo is suppressed.
 3) Due to the gap, the next echo transmission is delayed
    until after the timeout, which is set hard to twice
    the echo interval.

This is fixed by changing the timeouts from 2 to three times the echo interval.

Detailed description of the bug: https://lutz.donnerhacke.de/eng/Blog/Groundhog-Day-with-SMB-remount

Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/connect.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f31339db45fdb..c53a2e86ed544 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -563,10 +563,10 @@ static bool
 server_unresponsive(struct TCP_Server_Info *server)
 {
 	/*
-	 * We need to wait 2 echo intervals to make sure we handle such
+	 * We need to wait 3 echo intervals to make sure we handle such
 	 * situations right:
 	 * 1s  client sends a normal SMB request
-	 * 2s  client gets a response
+	 * 3s  client gets a response
 	 * 30s echo workqueue job pops, and decides we got a response recently
 	 *     and don't need to send another
 	 * ...
@@ -575,9 +575,9 @@ server_unresponsive(struct TCP_Server_Info *server)
 	 */
 	if ((server->tcpStatus == CifsGood ||
 	    server->tcpStatus == CifsNeedNegotiate) &&
-	    time_after(jiffies, server->lstrp + 2 * server->echo_interval)) {
+	    time_after(jiffies, server->lstrp + 3 * server->echo_interval)) {
 		cifs_dbg(VFS, "Server %s has not responded in %lu seconds. Reconnecting...\n",
-			 server->hostname, (2 * server->echo_interval) / HZ);
+			 server->hostname, (3 * server->echo_interval) / HZ);
 		cifs_reconnect(server);
 		wake_up(&server->response_q);
 		return true;
-- 
GitLab


From b39c377ea08f377367297b7369f0e580c5cd189d Mon Sep 17 00:00:00 2001
From: Andrea Parri <andrea.parri@amarulasolutions.com>
Date: Mon, 20 May 2019 19:23:58 +0200
Subject: [PATCH 1301/1835] ceph: fix improper use of smp_mb__before_atomic()

[ Upstream commit 749607731e26dfb2558118038c40e9c0c80d23b5 ]

This barrier only applies to the read-modify-write operations; in
particular, it does not apply to the atomic64_set() primitive.

Replace the barrier with an smp_mb().

Fixes: fdd4e15838e59 ("ceph: rework dcache readdir")
Reported-by: "Paul E. McKenney" <paulmck@linux.ibm.com>
Reported-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andrea Parri <andrea.parri@amarulasolutions.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/super.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 582e28fd1b7bf..d8579a56e5dc2 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -526,7 +526,12 @@ static inline void __ceph_dir_set_complete(struct ceph_inode_info *ci,
 					   long long release_count,
 					   long long ordered_count)
 {
-	smp_mb__before_atomic();
+	/*
+	 * Makes sure operations that setup readdir cache (update page
+	 * cache and i_size) are strongly ordered w.r.t. the following
+	 * atomic64_set() operations.
+	 */
+	smp_mb();
 	atomic64_set(&ci->i_complete_seq[0], release_count);
 	atomic64_set(&ci->i_complete_seq[1], ordered_count);
 }
-- 
GitLab


From c47e2552607174787e65ac3713c16cbae2c0e7d0 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 13 Jun 2019 15:17:00 -0400
Subject: [PATCH 1302/1835] ceph: return -ERANGE if virtual xattr value didn't
 fit in buffer

[ Upstream commit 3b421018f48c482bdc9650f894aa1747cf90e51d ]

The getxattr manpage states that we should return ERANGE if the
destination buffer size is too small to hold the value.
ceph_vxattrcb_layout does this internally, but we should be doing
this for all vxattrs.

Fix the only caller of getxattr_cb to check the returned size
against the buffer length and return -ERANGE if it doesn't fit.
Drop the same check in ceph_vxattrcb_layout and just rely on the
caller to handle it.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Acked-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/xattr.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 5cc8b94f82069..0a2d4898ee163 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -79,7 +79,7 @@ static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
 	const char *ns_field = " pool_namespace=";
 	char buf[128];
 	size_t len, total_len = 0;
-	int ret;
+	ssize_t ret;
 
 	pool_ns = ceph_try_get_string(ci->i_layout.pool_ns);
 
@@ -103,11 +103,8 @@ static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
 	if (pool_ns)
 		total_len += strlen(ns_field) + pool_ns->len;
 
-	if (!size) {
-		ret = total_len;
-	} else if (total_len > size) {
-		ret = -ERANGE;
-	} else {
+	ret = total_len;
+	if (size >= total_len) {
 		memcpy(val, buf, len);
 		ret = len;
 		if (pool_name) {
@@ -817,8 +814,11 @@ ssize_t __ceph_getxattr(struct inode *inode, const char *name, void *value,
 		if (err)
 			return err;
 		err = -ENODATA;
-		if (!(vxattr->exists_cb && !vxattr->exists_cb(ci)))
+		if (!(vxattr->exists_cb && !vxattr->exists_cb(ci))) {
 			err = vxattr->getxattr_cb(ci, value, size);
+			if (size && size < err)
+				err = -ERANGE;
+		}
 		return err;
 	}
 
-- 
GitLab


From d5568763dd1de9c834d86220e4ec0b9b569a9256 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 10 Jul 2019 15:05:43 +0200
Subject: [PATCH 1303/1835] ACPI: blacklist: fix clang warning for unused DMI
 table

[ Upstream commit b80d6a42bdc97bdb6139107d6034222e9843c6e2 ]

When CONFIG_DMI is disabled, we only have a tentative declaration,
which causes a warning from clang:

drivers/acpi/blacklist.c:20:35: error: tentative array definition assumed to have one element [-Werror]
static const struct dmi_system_id acpi_rev_dmi_table[] __initconst;

As the variable is not actually used here, hide it entirely
in an #ifdef to shut up the warning.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/blacklist.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 995c4d8922b12..761f0c19a4512 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -30,7 +30,9 @@
 
 #include "internal.h"
 
+#ifdef CONFIG_DMI
 static const struct dmi_system_id acpi_rev_dmi_table[] __initconst;
+#endif
 
 /*
  * POLICY: If *anything* doesn't work, put it on the blacklist.
@@ -74,7 +76,9 @@ int __init acpi_blacklisted(void)
 	}
 
 	(void)early_acpi_osi_init();
+#ifdef CONFIG_DMI
 	dmi_check_system(acpi_rev_dmi_table);
+#endif
 
 	return blacklisted;
 }
-- 
GitLab


From abfe761a53582e0a87825908cd0b6321c9e52464 Mon Sep 17 00:00:00 2001
From: Benjamin Block <bblock@linux.ibm.com>
Date: Tue, 2 Jul 2019 23:02:02 +0200
Subject: [PATCH 1304/1835] scsi: zfcp: fix GCC compiler warning emitted with
 -Wmaybe-uninitialized

[ Upstream commit 484647088826f2f651acbda6bcf9536b8a466703 ]

GCC v9 emits this warning:
      CC      drivers/s390/scsi/zfcp_erp.o
    drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_action_enqueue':
    drivers/s390/scsi/zfcp_erp.c:217:26: warning: 'erp_action' may be used uninitialized in this function [-Wmaybe-uninitialized]
      217 |  struct zfcp_erp_action *erp_action;
          |                          ^~~~~~~~~~

This is a possible false positive case, as also documented in the GCC
documentations:
    https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wmaybe-uninitialized

The actual code-sequence is like this:
    Various callers can invoke the function below with the argument "want"
    being one of:
    ZFCP_ERP_ACTION_REOPEN_ADAPTER,
    ZFCP_ERP_ACTION_REOPEN_PORT_FORCED,
    ZFCP_ERP_ACTION_REOPEN_PORT, or
    ZFCP_ERP_ACTION_REOPEN_LUN.

    zfcp_erp_action_enqueue(want, ...)
        ...
        need = zfcp_erp_required_act(want, ...)
            need = want
            ...
            maybe: need = ZFCP_ERP_ACTION_REOPEN_PORT
            maybe: need = ZFCP_ERP_ACTION_REOPEN_ADAPTER
            ...
            return need
        ...
        zfcp_erp_setup_act(need, ...)
            struct zfcp_erp_action *erp_action; // <== line 217
            ...
            switch(need) {
            case ZFCP_ERP_ACTION_REOPEN_LUN:
                    ...
                    erp_action = &zfcp_sdev->erp_action;
                    WARN_ON_ONCE(erp_action->port != port); // <== access
                    ...
                    break;
            case ZFCP_ERP_ACTION_REOPEN_PORT:
            case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
                    ...
                    erp_action = &port->erp_action;
                    WARN_ON_ONCE(erp_action->port != port); // <== access
                    ...
                    break;
            case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
                    ...
                    erp_action = &adapter->erp_action;
                    WARN_ON_ONCE(erp_action->port != NULL); // <== access
                    ...
                    break;
            }
            ...
            WARN_ON_ONCE(erp_action->adapter != adapter); // <== access

When zfcp_erp_setup_act() is called, 'need' will never be anything else
than one of the 4 possible enumeration-names that are used in the
switch-case, and 'erp_action' is initialized for every one of them, before
it is used. Thus the warning is a false positive, as documented.

We introduce the extra if{} in the beginning to create an extra code-flow,
so the compiler can be convinced that the switch-case will never see any
other value.

BUG_ON()/BUG() is intentionally not used to not crash anything, should
this ever happen anyway - right now it's impossible, as argued above; and
it doesn't introduce a 'default:' switch-case to retain warnings should
'enum zfcp_erp_act_type' ever be extended and no explicit case be
introduced. See also v5.0 commit 399b6c8bc9f7 ("scsi: zfcp: drop old
default switch case which might paper over missing case").

Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/scsi/zfcp_erp.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index ebdbc457003fe..332701db7379d 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -11,6 +11,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/kthread.h>
+#include <linux/bug.h>
 #include "zfcp_ext.h"
 #include "zfcp_reqlist.h"
 
@@ -238,6 +239,12 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
 	struct zfcp_erp_action *erp_action;
 	struct zfcp_scsi_dev *zfcp_sdev;
 
+	if (WARN_ON_ONCE(need != ZFCP_ERP_ACTION_REOPEN_LUN &&
+			 need != ZFCP_ERP_ACTION_REOPEN_PORT &&
+			 need != ZFCP_ERP_ACTION_REOPEN_PORT_FORCED &&
+			 need != ZFCP_ERP_ACTION_REOPEN_ADAPTER))
+		return NULL;
+
 	switch (need) {
 	case ZFCP_ERP_ACTION_REOPEN_LUN:
 		zfcp_sdev = sdev_to_zfcp(sdev);
-- 
GitLab


From d60e8c0cbccb162f7b86fd19838b09a8acc39139 Mon Sep 17 00:00:00 2001
From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Date: Tue, 11 Jun 2019 08:31:09 +0530
Subject: [PATCH 1305/1835] perf version: Fix segfault due to missing OPT_END()

[ Upstream commit 916c31fff946fae0e05862f9b2435fdb29fd5090 ]

'perf version' on powerpc segfaults when used with non-supported
option:
  # perf version -a
  Segmentation fault (core dumped)

Fix this.

Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
Tested-by: Mamatha Inamdar <mamatha4@linux.vnet.ibm.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20190611030109.20228-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-version.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/perf/builtin-version.c b/tools/perf/builtin-version.c
index 50df168be326d..b02c961046403 100644
--- a/tools/perf/builtin-version.c
+++ b/tools/perf/builtin-version.c
@@ -19,6 +19,7 @@ static struct version version;
 static struct option version_options[] = {
 	OPT_BOOLEAN(0, "build-options", &version.build_options,
 		    "display the build options"),
+	OPT_END(),
 };
 
 static const char * const version_usage[] = {
-- 
GitLab


From 80f58147da0f40bc427dcd96c6bcf07786c41c11 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 12 Jul 2019 11:12:30 +0200
Subject: [PATCH 1306/1835] x86: kvm: avoid constant-conversion warning

[ Upstream commit a6a6d3b1f867d34ba5bd61aa7bb056b48ca67cff ]

clang finds a contruct suspicious that converts an unsigned
character to a signed integer and back, causing an overflow:

arch/x86/kvm/mmu.c:4605:39: error: implicit conversion from 'int' to 'u8' (aka 'unsigned char') changes value from -205 to 51 [-Werror,-Wconstant-conversion]
                u8 wf = (pfec & PFERR_WRITE_MASK) ? ~w : 0;
                   ~~                               ^~
arch/x86/kvm/mmu.c:4607:38: error: implicit conversion from 'int' to 'u8' (aka 'unsigned char') changes value from -241 to 15 [-Werror,-Wconstant-conversion]
                u8 uf = (pfec & PFERR_USER_MASK) ? ~u : 0;
                   ~~                              ^~
arch/x86/kvm/mmu.c:4609:39: error: implicit conversion from 'int' to 'u8' (aka 'unsigned char') changes value from -171 to 85 [-Werror,-Wconstant-conversion]
                u8 ff = (pfec & PFERR_FETCH_MASK) ? ~x : 0;
                   ~~                               ^~

Add an explicit cast to tell clang that everything works as
intended here.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://github.com/ClangBuiltLinux/linux/issues/95
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/mmu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index e0f982e35c96b..cdc0c460950f3 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4532,11 +4532,11 @@ static void update_permission_bitmask(struct kvm_vcpu *vcpu,
 		 */
 
 		/* Faults from writes to non-writable pages */
-		u8 wf = (pfec & PFERR_WRITE_MASK) ? ~w : 0;
+		u8 wf = (pfec & PFERR_WRITE_MASK) ? (u8)~w : 0;
 		/* Faults from user mode accesses to supervisor pages */
-		u8 uf = (pfec & PFERR_USER_MASK) ? ~u : 0;
+		u8 uf = (pfec & PFERR_USER_MASK) ? (u8)~u : 0;
 		/* Faults from fetches of non-executable pages*/
-		u8 ff = (pfec & PFERR_FETCH_MASK) ? ~x : 0;
+		u8 ff = (pfec & PFERR_FETCH_MASK) ? (u8)~x : 0;
 		/* Faults from kernel mode fetches of user pages */
 		u8 smepf = 0;
 		/* Faults from kernel mode accesses of user pages */
-- 
GitLab


From c0cca0e97ce47e62dbfea72bce1cba71aa19e010 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 12 Jul 2019 11:01:21 +0200
Subject: [PATCH 1307/1835] ACPI: fix false-positive -Wuninitialized warning

[ Upstream commit dfd6f9ad36368b8dbd5f5a2b2f0a4705ae69a323 ]

clang gets confused by an uninitialized variable in what looks
to it like a never executed code path:

arch/x86/kernel/acpi/boot.c:618:13: error: variable 'polarity' is uninitialized when used here [-Werror,-Wuninitialized]
        polarity = polarity ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
                   ^~~~~~~~
arch/x86/kernel/acpi/boot.c:606:32: note: initialize the variable 'polarity' to silence this warning
        int rc, irq, trigger, polarity;
                                      ^
                                       = 0
arch/x86/kernel/acpi/boot.c:617:12: error: variable 'trigger' is uninitialized when used here [-Werror,-Wuninitialized]
        trigger = trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
                  ^~~~~~~
arch/x86/kernel/acpi/boot.c:606:22: note: initialize the variable 'trigger' to silence this warning
        int rc, irq, trigger, polarity;
                            ^
                             = 0

This is unfortunately a design decision in clang and won't be fixed.

Changing the acpi_get_override_irq() macro to an inline function
reliably avoids the issue.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/acpi.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index de8d3d3fa6512..b4d23b3a2ef2d 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -326,7 +326,10 @@ void acpi_set_irq_model(enum acpi_irq_model_id model,
 #ifdef CONFIG_X86_IO_APIC
 extern int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity);
 #else
-#define acpi_get_override_irq(gsi, trigger, polarity) (-1)
+static inline int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity)
+{
+	return -1;
+}
 #endif
 /*
  * This function undoes the effect of one call to acpi_register_gsi().
-- 
GitLab


From ade866ad5aedc4e319ffa27ae15574e2d9d466d5 Mon Sep 17 00:00:00 2001
From: Benjamin Poirier <bpoirier@suse.com>
Date: Tue, 16 Jul 2019 17:16:55 +0900
Subject: [PATCH 1308/1835] be2net: Signal that the device cannot transmit
 during reconfiguration

[ Upstream commit 7429c6c0d9cb086d8e79f0d2a48ae14851d2115e ]

While changing the number of interrupt channels, be2net stops adapter
operation (including netif_tx_disable()) but it doesn't signal that it
cannot transmit. This may lead dev_watchdog() to falsely trigger during
that time.

Add the missing call to netif_carrier_off(), following the pattern used in
many other drivers. netif_carrier_on() is already taken care of in
be_open().

Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/emulex/benet/be_main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index bff74752cef16..3fe6a28027fe1 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4700,8 +4700,12 @@ int be_update_queues(struct be_adapter *adapter)
 	struct net_device *netdev = adapter->netdev;
 	int status;
 
-	if (netif_running(netdev))
+	if (netif_running(netdev)) {
+		/* device cannot transmit now, avoid dev_watchdog timeouts */
+		netif_carrier_off(netdev);
+
 		be_close(netdev);
+	}
 
 	be_cancel_worker(adapter);
 
-- 
GitLab


From 242666b2b7e2223cf60c586c6167a51a1b6a2725 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 8 Jul 2019 17:36:45 -0400
Subject: [PATCH 1309/1835] x86/apic: Silence -Wtype-limits compiler warnings

[ Upstream commit ec6335586953b0df32f83ef696002063090c7aef ]

There are many compiler warnings like this,

In file included from ./arch/x86/include/asm/smp.h:13,
                 from ./arch/x86/include/asm/mmzone_64.h:11,
                 from ./arch/x86/include/asm/mmzone.h:5,
                 from ./include/linux/mmzone.h:969,
                 from ./include/linux/gfp.h:6,
                 from ./include/linux/mm.h:10,
                 from arch/x86/kernel/apic/io_apic.c:34:
arch/x86/kernel/apic/io_apic.c: In function 'check_timer':
./arch/x86/include/asm/apic.h:37:11: warning: comparison of unsigned
expression >= 0 is always true [-Wtype-limits]
   if ((v) <= apic_verbosity) \
           ^~
arch/x86/kernel/apic/io_apic.c:2160:2: note: in expansion of macro
'apic_printk'
  apic_printk(APIC_QUIET, KERN_INFO "..TIMER: vector=0x%02X "
  ^~~~~~~~~~~
./arch/x86/include/asm/apic.h:37:11: warning: comparison of unsigned
expression >= 0 is always true [-Wtype-limits]
   if ((v) <= apic_verbosity) \
           ^~
arch/x86/kernel/apic/io_apic.c:2207:4: note: in expansion of macro
'apic_printk'
    apic_printk(APIC_QUIET, KERN_ERR "..MP-BIOS bug: "
    ^~~~~~~~~~~

APIC_QUIET is 0, so silence them by making apic_verbosity type int.

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/1562621805-24789-1-git-send-email-cai@lca.pw
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/apic.h | 2 +-
 arch/x86/kernel/apic/apic.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 130e81e10fc7c..050368db9d357 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -48,7 +48,7 @@ static inline void generic_apic_probe(void)
 
 #ifdef CONFIG_X86_LOCAL_APIC
 
-extern unsigned int apic_verbosity;
+extern int apic_verbosity;
 extern int local_apic_timer_c2_ok;
 
 extern int disable_apic;
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 02020f2e00809..272a12865b2aa 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -181,7 +181,7 @@ EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
 /*
  * Debug level, exported for io_apic.c
  */
-unsigned int apic_verbosity;
+int apic_verbosity;
 
 int pic_mode;
 
-- 
GitLab


From 1b84e67496d3fd0eb9b9ff345e5428134116d1c6 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 12 Jul 2019 11:08:05 +0200
Subject: [PATCH 1310/1835] x86: math-emu: Hide clang warnings for 16-bit
 overflow

[ Upstream commit 29e7e9664aec17b94a9c8c5a75f8d216a206aa3a ]

clang warns about a few parts of the math-emu implementation
where a 16-bit integer becomes negative during assignment:

arch/x86/math-emu/poly_tan.c:88:35: error: implicit conversion from 'int' to 'short' changes value from 49216 to -16320 [-Werror,-Wconstant-conversion]
                                      (0x41 + EXTENDED_Ebias) | SIGN_Negative);
                                      ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
arch/x86/math-emu/fpu_emu.h:180:58: note: expanded from macro 'setexponent16'
 #define setexponent16(x,y)  { (*(short *)&((x)->exp)) = (y); }
                                                      ~  ^
arch/x86/math-emu/reg_constant.c:37:32: error: implicit conversion from 'int' to 'short' changes value from 49085 to -16451 [-Werror,-Wconstant-conversion]
FPU_REG const CONST_PI2extra = MAKE_REG(NEG, -66,
                               ^~~~~~~~~~~~~~~~~~
arch/x86/math-emu/reg_constant.c:21:25: note: expanded from macro 'MAKE_REG'
                ((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
                 ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
arch/x86/math-emu/reg_constant.c:48:28: error: implicit conversion from 'int' to 'short' changes value from 65535 to -1 [-Werror,-Wconstant-conversion]
FPU_REG const CONST_QNaN = MAKE_REG(NEG, EXP_OVER, 0x00000000, 0xC0000000);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/x86/math-emu/reg_constant.c:21:25: note: expanded from macro 'MAKE_REG'
                ((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
                 ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~

The code is correct as is, so add a typecast to shut up the warnings.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190712090816.350668-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/math-emu/fpu_emu.h      | 2 +-
 arch/x86/math-emu/reg_constant.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/math-emu/fpu_emu.h b/arch/x86/math-emu/fpu_emu.h
index a5a41ec580721..0c122226ca56f 100644
--- a/arch/x86/math-emu/fpu_emu.h
+++ b/arch/x86/math-emu/fpu_emu.h
@@ -177,7 +177,7 @@ static inline void reg_copy(FPU_REG const *x, FPU_REG *y)
 #define setexponentpos(x,y) { (*(short *)&((x)->exp)) = \
   ((y) + EXTENDED_Ebias) & 0x7fff; }
 #define exponent16(x)         (*(short *)&((x)->exp))
-#define setexponent16(x,y)  { (*(short *)&((x)->exp)) = (y); }
+#define setexponent16(x,y)  { (*(short *)&((x)->exp)) = (u16)(y); }
 #define addexponent(x,y)    { (*(short *)&((x)->exp)) += (y); }
 #define stdexp(x)           { (*(short *)&((x)->exp)) += EXTENDED_Ebias; }
 
diff --git a/arch/x86/math-emu/reg_constant.c b/arch/x86/math-emu/reg_constant.c
index 8dc9095bab224..742619e94bdf2 100644
--- a/arch/x86/math-emu/reg_constant.c
+++ b/arch/x86/math-emu/reg_constant.c
@@ -18,7 +18,7 @@
 #include "control_w.h"
 
 #define MAKE_REG(s, e, l, h) { l, h, \
-		((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
+		(u16)((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
 
 FPU_REG const CONST_1 = MAKE_REG(POS, 0, 0x00000000, 0x80000000);
 #if 0
-- 
GitLab


From 439c79ed7718ee509421ca201a1f1a009bc403d0 Mon Sep 17 00:00:00 2001
From: Doug Berger <opendmb@gmail.com>
Date: Tue, 16 Jul 2019 16:26:24 -0700
Subject: [PATCH 1311/1835] mm/cma.c: fail if fixed declaration can't be
 honored

[ Upstream commit c633324e311243586675e732249339685e5d6faa ]

The description of cma_declare_contiguous() indicates that if the
'fixed' argument is true the reserved contiguous area must be exactly at
the address of the 'base' argument.

However, the function currently allows the 'base', 'size', and 'limit'
arguments to be silently adjusted to meet alignment constraints.  This
commit enforces the documented behavior through explicit checks that
return an error if the region does not fit within a specified region.

Link: http://lkml.kernel.org/r/1561422051-16142-1-git-send-email-opendmb@gmail.com
Fixes: 5ea3b1b2f8ad ("cma: add placement specifier for "cma=" kernel parameter")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Michal Nazarewicz <mina86@mina86.com>
Cc: Yue Hu <huyue2@yulong.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Peng Fan <peng.fan@nxp.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/cma.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/mm/cma.c b/mm/cma.c
index 476dfe13a701f..4c2864270a39b 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -282,6 +282,12 @@ int __init cma_declare_contiguous(phys_addr_t base,
 	 */
 	alignment = max(alignment,  (phys_addr_t)PAGE_SIZE <<
 			  max_t(unsigned long, MAX_ORDER - 1, pageblock_order));
+	if (fixed && base & (alignment - 1)) {
+		ret = -EINVAL;
+		pr_err("Region at %pa must be aligned to %pa bytes\n",
+			&base, &alignment);
+		goto err;
+	}
 	base = ALIGN(base, alignment);
 	size = ALIGN(size, alignment);
 	limit &= ~(alignment - 1);
@@ -312,6 +318,13 @@ int __init cma_declare_contiguous(phys_addr_t base,
 	if (limit == 0 || limit > memblock_end)
 		limit = memblock_end;
 
+	if (base + size > limit) {
+		ret = -EINVAL;
+		pr_err("Size (%pa) of region at %pa exceeds limit (%pa)\n",
+			&size, &base, &limit);
+		goto err;
+	}
+
 	/* Reserve memory */
 	if (fixed) {
 		if (memblock_is_region_reserved(base, size) ||
-- 
GitLab


From 8e087a2abaf8a1d11bba8770c7e4e73572b52eff Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 16 Jul 2019 16:27:24 -0700
Subject: [PATCH 1312/1835] lib/test_overflow.c: avoid tainting the kernel and
 fix wrap size

[ Upstream commit 8e060c21ae2c265a2b596e9e7f9f97ec274151a4 ]

This adds __GFP_NOWARN to the kmalloc()-portions of the overflow test to
avoid tainting the kernel.  Additionally fixes up the math on wrap size
to be architecture and page size agnostic.

Link: http://lkml.kernel.org/r/201905282012.0A8767E24@keescook
Fixes: ca90800a91ba ("test_overflow: Add memory allocation overflow tests")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_overflow.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/test_overflow.c b/lib/test_overflow.c
index fc680562d8b69..7a4b6f6c5473c 100644
--- a/lib/test_overflow.c
+++ b/lib/test_overflow.c
@@ -486,16 +486,17 @@ static int __init test_overflow_shift(void)
  * Deal with the various forms of allocator arguments. See comments above
  * the DEFINE_TEST_ALLOC() instances for mapping of the "bits".
  */
-#define alloc010(alloc, arg, sz) alloc(sz, GFP_KERNEL)
-#define alloc011(alloc, arg, sz) alloc(sz, GFP_KERNEL, NUMA_NO_NODE)
+#define alloc_GFP		 (GFP_KERNEL | __GFP_NOWARN)
+#define alloc010(alloc, arg, sz) alloc(sz, alloc_GFP)
+#define alloc011(alloc, arg, sz) alloc(sz, alloc_GFP, NUMA_NO_NODE)
 #define alloc000(alloc, arg, sz) alloc(sz)
 #define alloc001(alloc, arg, sz) alloc(sz, NUMA_NO_NODE)
-#define alloc110(alloc, arg, sz) alloc(arg, sz, GFP_KERNEL)
+#define alloc110(alloc, arg, sz) alloc(arg, sz, alloc_GFP)
 #define free0(free, arg, ptr)	 free(ptr)
 #define free1(free, arg, ptr)	 free(arg, ptr)
 
-/* Wrap around to 8K */
-#define TEST_SIZE		(9 << PAGE_SHIFT)
+/* Wrap around to 16K */
+#define TEST_SIZE		(5 * 4096)
 
 #define DEFINE_TEST_ALLOC(func, free_func, want_arg, want_gfp, want_node)\
 static int __init test_ ## func (void *arg)				\
-- 
GitLab


From 93b83005ea872555e7f1547d99b695654c75a020 Mon Sep 17 00:00:00 2001
From: Peter Rosin <peda@axentia.se>
Date: Tue, 16 Jul 2019 16:27:18 -0700
Subject: [PATCH 1313/1835] lib/test_string.c: avoid masking memset16/32/64
 failures

[ Upstream commit 33d6e0ff68af74be0c846c8e042e84a9a1a0561e ]

If a memsetXX implementation is completely broken and fails in the first
iteration, when i, j, and k are all zero, the failure is masked as zero
is returned.  Failing in the first iteration is perhaps the most likely
failure, so this makes the tests pretty much useless.  Avoid the
situation by always setting a random unused bit in the result on
failure.

Link: http://lkml.kernel.org/r/20190506124634.6807-3-peda@axentia.se
Fixes: 03270c13c5ff ("lib/string.c: add testcases for memset16/32/64")
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_string.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/test_string.c b/lib/test_string.c
index 0fcdb82dca866..98a787e7a1fd6 100644
--- a/lib/test_string.c
+++ b/lib/test_string.c
@@ -35,7 +35,7 @@ static __init int memset16_selftest(void)
 fail:
 	kfree(p);
 	if (i < 256)
-		return (i << 24) | (j << 16) | k;
+		return (i << 24) | (j << 16) | k | 0x8000;
 	return 0;
 }
 
@@ -71,7 +71,7 @@ static __init int memset32_selftest(void)
 fail:
 	kfree(p);
 	if (i < 256)
-		return (i << 24) | (j << 16) | k;
+		return (i << 24) | (j << 16) | k | 0x8000;
 	return 0;
 }
 
@@ -107,7 +107,7 @@ static __init int memset64_selftest(void)
 fail:
 	kfree(p);
 	if (i < 256)
-		return (i << 24) | (j << 16) | k;
+		return (i << 24) | (j << 16) | k | 0x8000;
 	return 0;
 }
 
-- 
GitLab


From cf3ddc00a47d8e70701ecd33ca583d389f1080e3 Mon Sep 17 00:00:00 2001
From: Zhouyang Jia <jiazhouyang09@gmail.com>
Date: Tue, 16 Jul 2019 16:28:13 -0700
Subject: [PATCH 1314/1835] coda: add error handling for fget

[ Upstream commit 02551c23bcd85f0c68a8259c7b953d49d44f86af ]

When fget fails, the lack of error-handling code may cause unexpected
results.

This patch adds error-handling code after calling fget.

Link: http://lkml.kernel.org/r/2514ec03df9c33b86e56748513267a80dd8004d9.1558117389.git.jaharkes@cs.cmu.edu
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Mikko Rapeli <mikko.rapeli@iki.fi>
Cc: Sam Protsenko <semen.protsenko@linaro.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/coda/psdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index c5234c21b5394..55824cba32453 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -187,8 +187,11 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
 	if (req->uc_opcode == CODA_OPEN_BY_FD) {
 		struct coda_open_by_fd_out *outp =
 			(struct coda_open_by_fd_out *)req->uc_data;
-		if (!outp->oh.result)
+		if (!outp->oh.result) {
 			outp->fh = fget(outp->fd);
+			if (!outp->fh)
+				return -EBADF;
+		}
 	}
 
         wake_up(&req->uc_sleep);
-- 
GitLab


From dea2ee496a85f0cb58c8dab93598e89b9798e633 Mon Sep 17 00:00:00 2001
From: Sam Protsenko <semen.protsenko@linaro.org>
Date: Tue, 16 Jul 2019 16:28:20 -0700
Subject: [PATCH 1315/1835] coda: fix build using bare-metal toolchain

[ Upstream commit b2a57e334086602be56b74958d9f29b955cd157f ]

The kernel is self-contained project and can be built with bare-metal
toolchain.  But bare-metal toolchain doesn't define __linux__.  Because
of this u_quad_t type is not defined when using bare-metal toolchain and
codafs build fails.  This patch fixes it by defining u_quad_t type
unconditionally.

Link: http://lkml.kernel.org/r/3cbb40b0a57b6f9923a9d67b53473c0b691a3eaa.1558117389.git.jaharkes@cs.cmu.edu
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Mikko Rapeli <mikko.rapeli@iki.fi>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/coda.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/linux/coda.h b/include/linux/coda.h
index d30209b9cef81..0ca0c83fdb1c4 100644
--- a/include/linux/coda.h
+++ b/include/linux/coda.h
@@ -58,8 +58,7 @@ Mellon the rights to redistribute these changes without encumbrance.
 #ifndef _CODA_HEADER_
 #define _CODA_HEADER_
 
-#if defined(__linux__)
 typedef unsigned long long u_quad_t;
-#endif
+
 #include <uapi/linux/coda.h>
 #endif 
-- 
GitLab


From 35ee8b844845a16de36258edad2577c8dd0a66f6 Mon Sep 17 00:00:00 2001
From: Mikko Rapeli <mikko.rapeli@iki.fi>
Date: Tue, 16 Jul 2019 16:28:10 -0700
Subject: [PATCH 1316/1835] uapi linux/coda_psdev.h: move upc_req definition
 from uapi to kernel side headers

[ Upstream commit f90fb3c7e2c13ae829db2274b88b845a75038b8a ]

Only users of upc_req in kernel side fs/coda/psdev.c and
fs/coda/upcall.c already include linux/coda_psdev.h.

Suggested by Jan Harkes <jaharkes@cs.cmu.edu> in
  https://lore.kernel.org/lkml/20150531111913.GA23377@cs.cmu.edu/

Fixes these include/uapi/linux/coda_psdev.h compilation errors in userspace:

  linux/coda_psdev.h:12:19: error: field `uc_chain' has incomplete type
  struct list_head    uc_chain;
                   ^
  linux/coda_psdev.h:13:2: error: unknown type name `caddr_t'
  caddr_t             uc_data;
  ^
  linux/coda_psdev.h:14:2: error: unknown type name `u_short'
  u_short             uc_flags;
  ^
  linux/coda_psdev.h:15:2: error: unknown type name `u_short'
  u_short             uc_inSize;  /* Size is at most 5000 bytes */
  ^
  linux/coda_psdev.h:16:2: error: unknown type name `u_short'
  u_short             uc_outSize;
  ^
  linux/coda_psdev.h:17:2: error: unknown type name `u_short'
  u_short             uc_opcode;  /* copied from data to save lookup */
  ^
  linux/coda_psdev.h:19:2: error: unknown type name `wait_queue_head_t'
  wait_queue_head_t   uc_sleep;   /* process' wait queue */
  ^

Link: http://lkml.kernel.org/r/9f99f5ce6a0563d5266e6cf7aa9585aac2cae971.1558117389.git.jaharkes@cs.cmu.edu
Signed-off-by: Mikko Rapeli <mikko.rapeli@iki.fi>
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Sam Protsenko <semen.protsenko@linaro.org>
Cc: Yann Droneaud <ydroneaud@opteya.com>
Cc: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/coda_psdev.h      | 11 +++++++++++
 include/uapi/linux/coda_psdev.h | 13 -------------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/include/linux/coda_psdev.h b/include/linux/coda_psdev.h
index 15170954aa2b3..57d2b2faf6a3e 100644
--- a/include/linux/coda_psdev.h
+++ b/include/linux/coda_psdev.h
@@ -19,6 +19,17 @@ struct venus_comm {
 	struct mutex	    vc_mutex;
 };
 
+/* messages between coda filesystem in kernel and Venus */
+struct upc_req {
+	struct list_head	uc_chain;
+	caddr_t			uc_data;
+	u_short			uc_flags;
+	u_short			uc_inSize;  /* Size is at most 5000 bytes */
+	u_short			uc_outSize;
+	u_short			uc_opcode;  /* copied from data to save lookup */
+	int			uc_unique;
+	wait_queue_head_t	uc_sleep;   /* process' wait queue */
+};
 
 static inline struct venus_comm *coda_vcp(struct super_block *sb)
 {
diff --git a/include/uapi/linux/coda_psdev.h b/include/uapi/linux/coda_psdev.h
index aa6623efd2dd0..d50d51a57fe4e 100644
--- a/include/uapi/linux/coda_psdev.h
+++ b/include/uapi/linux/coda_psdev.h
@@ -7,19 +7,6 @@
 #define CODA_PSDEV_MAJOR 67
 #define MAX_CODADEVS  5	   /* how many do we allow */
 
-
-/* messages between coda filesystem in kernel and Venus */
-struct upc_req {
-	struct list_head    uc_chain;
-	caddr_t	            uc_data;
-	u_short	            uc_flags;
-	u_short             uc_inSize;  /* Size is at most 5000 bytes */
-	u_short	            uc_outSize;
-	u_short	            uc_opcode;  /* copied from data to save lookup */
-	int		    uc_unique;
-	wait_queue_head_t   uc_sleep;   /* process' wait queue */
-};
-
 #define CODA_REQ_ASYNC  0x1
 #define CODA_REQ_READ   0x2
 #define CODA_REQ_WRITE  0x4
-- 
GitLab


From f87314225294217c00bf80f56e21c57515f214a1 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 16 Jul 2019 16:30:03 -0700
Subject: [PATCH 1317/1835] drivers/rapidio/devices/rio_mport_cdev.c: NUL
 terminate some strings

[ Upstream commit 156e0b1a8112b76e351684ac948c59757037ac36 ]

The dev_info.name[] array has space for RIO_MAX_DEVNAME_SZ + 1
characters.  But the problem here is that we don't ensure that the user
put a NUL terminator on the end of the string.  It could lead to an out
of bounds read.

Link: http://lkml.kernel.org/r/20190529110601.GB19119@mwanda
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rapidio/devices/rio_mport_cdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index cbe467ff1aba9..fa0bbda4b3f2e 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -1688,6 +1688,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
 
 	if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
 		return -EFAULT;
+	dev_info.name[sizeof(dev_info.name) - 1] = '\0';
 
 	rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
 		   dev_info.comptag, dev_info.destid, dev_info.hopcount);
@@ -1819,6 +1820,7 @@ static int rio_mport_del_riodev(struct mport_cdev_priv *priv, void __user *arg)
 
 	if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
 		return -EFAULT;
+	dev_info.name[sizeof(dev_info.name) - 1] = '\0';
 
 	mport = priv->md->mport;
 
-- 
GitLab


From 48c5c4f0a47f52a90f532bd1d2257e41c0057c2f Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 16 Jul 2019 16:30:21 -0700
Subject: [PATCH 1318/1835] ipc/mqueue.c: only perform resource calculation if
 user valid

[ Upstream commit a318f12ed8843cfac53198390c74a565c632f417 ]

Andreas Christoforou reported:

  UBSAN: Undefined behaviour in ipc/mqueue.c:414:49 signed integer overflow:
  9 * 2305843009213693951 cannot be represented in type 'long int'
  ...
  Call Trace:
    mqueue_evict_inode+0x8e7/0xa10 ipc/mqueue.c:414
    evict+0x472/0x8c0 fs/inode.c:558
    iput_final fs/inode.c:1547 [inline]
    iput+0x51d/0x8c0 fs/inode.c:1573
    mqueue_get_inode+0x8eb/0x1070 ipc/mqueue.c:320
    mqueue_create_attr+0x198/0x440 ipc/mqueue.c:459
    vfs_mkobj+0x39e/0x580 fs/namei.c:2892
    prepare_open ipc/mqueue.c:731 [inline]
    do_mq_open+0x6da/0x8e0 ipc/mqueue.c:771

Which could be triggered by:

        struct mq_attr attr = {
                .mq_flags = 0,
                .mq_maxmsg = 9,
                .mq_msgsize = 0x1fffffffffffffff,
                .mq_curmsgs = 0,
        };

        if (mq_open("/testing", 0x40, 3, &attr) == (mqd_t) -1)
                perror("mq_open");

mqueue_get_inode() was correctly rejecting the giant mq_msgsize, and
preparing to return -EINVAL.  During the cleanup, it calls
mqueue_evict_inode() which performed resource usage tracking math for
updating "user", before checking if there was a valid "user" at all
(which would indicate that the calculations would be sane).  Instead,
delay this check to after seeing a valid "user".

The overflow was real, but the results went unused, so while the flaw is
harmless, it's noisy for kernel fuzzers, so just fix it by moving the
calculation under the non-NULL "user" where it actually gets used.

Link: http://lkml.kernel.org/r/201906072207.ECB65450@keescook
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Andreas Christoforou <andreaschristofo@gmail.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ipc/mqueue.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index bce7af1546d9c..de4070d5472f2 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -389,7 +389,6 @@ static void mqueue_evict_inode(struct inode *inode)
 {
 	struct mqueue_inode_info *info;
 	struct user_struct *user;
-	unsigned long mq_bytes, mq_treesize;
 	struct ipc_namespace *ipc_ns;
 	struct msg_msg *msg, *nmsg;
 	LIST_HEAD(tmp_msg);
@@ -412,16 +411,18 @@ static void mqueue_evict_inode(struct inode *inode)
 		free_msg(msg);
 	}
 
-	/* Total amount of bytes accounted for the mqueue */
-	mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
-		min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
-		sizeof(struct posix_msg_tree_node);
-
-	mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
-				  info->attr.mq_msgsize);
-
 	user = info->user;
 	if (user) {
+		unsigned long mq_bytes, mq_treesize;
+
+		/* Total amount of bytes accounted for the mqueue */
+		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
+			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
+			sizeof(struct posix_msg_tree_node);
+
+		mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
+					  info->attr.mq_msgsize);
+
 		spin_lock(&mq_lock);
 		user->mq_bytes -= mq_bytes;
 		/*
-- 
GitLab


From d3e36788d9be20eca113c113c76cd3a4fadd2416 Mon Sep 17 00:00:00 2001
From: Petr Machata <petrm@mellanox.com>
Date: Wed, 17 Jul 2019 23:29:07 +0300
Subject: [PATCH 1319/1835] mlxsw: spectrum_dcb: Configure DSCP map as the last
 rule is removed

[ Upstream commit dedfde2fe1c4ccf27179fcb234e2112d065c39bb ]

Spectrum systems use DSCP rewrite map to update DSCP field in egressing
packets to correspond to priority that the packet has. Whether rewriting
will take place is determined at the point when the packet ingresses the
switch: if the port is in Trust L3 mode, packet priority is determined from
the DSCP map at the port, and DSCP rewrite will happen. If the port is in
Trust L2 mode, 802.1p is used for packet prioritization, and no DSCP
rewrite will happen.

The driver determines the port trust mode based on whether any DSCP
prioritization rules are in effect at given port. If there are any, trust
level is L3, otherwise it's L2. When the last DSCP rule is removed, the
port is switched to trust L2. Under that scenario, if DSCP of a packet
should be rewritten, it should be rewritten to 0.

However, when switching to Trust L2, the driver neglects to also update the
DSCP rewrite map. The last DSCP rule thus remains in effect, and packets
egressing through this port, if they have the right priority, will have
their DSCP set according to this rule.

Fix by first configuring the rewrite map, and only then switching to trust
L2 and bailing out.

Fixes: b2b1dab6884e ("mlxsw: spectrum: Support ieee_setapp, ieee_delapp")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Reported-by: Alex Veber <alexve@mellanox.com>
Tested-by: Alex Veber <alexve@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlxsw/spectrum_dcb.c   | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
index b25048c6c7618..21296fa7f7fbf 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
@@ -408,14 +408,6 @@ static int mlxsw_sp_port_dcb_app_update(struct mlxsw_sp_port *mlxsw_sp_port)
 	have_dscp = mlxsw_sp_port_dcb_app_prio_dscp_map(mlxsw_sp_port,
 							&prio_map);
 
-	if (!have_dscp) {
-		err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
-					MLXSW_REG_QPTS_TRUST_STATE_PCP);
-		if (err)
-			netdev_err(mlxsw_sp_port->dev, "Couldn't switch to trust L2\n");
-		return err;
-	}
-
 	mlxsw_sp_port_dcb_app_dscp_prio_map(mlxsw_sp_port, default_prio,
 					    &dscp_map);
 	err = mlxsw_sp_port_dcb_app_update_qpdpm(mlxsw_sp_port,
@@ -432,6 +424,14 @@ static int mlxsw_sp_port_dcb_app_update(struct mlxsw_sp_port *mlxsw_sp_port)
 		return err;
 	}
 
+	if (!have_dscp) {
+		err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
+					MLXSW_REG_QPTS_TRUST_STATE_PCP);
+		if (err)
+			netdev_err(mlxsw_sp_port->dev, "Couldn't switch to trust L2\n");
+		return err;
+	}
+
 	err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
 					     MLXSW_REG_QPTS_TRUST_STATE_DSCP);
 	if (err) {
-- 
GitLab


From 11cb9f8700c9c16f1742a5e51af662e349b35d53 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Date: Sun, 14 Jul 2019 17:15:32 +0800
Subject: [PATCH 1320/1835] xen/pv: Fix a boot up hang revealed by int3 self
 test

[ Upstream commit b23e5844dfe78a80ba672793187d3f52e4b528d7 ]

Commit 7457c0da024b ("x86/alternatives: Add int3_emulate_call()
selftest") is used to ensure there is a gap setup in int3 exception stack
which could be used for inserting call return address.

This gap is missed in XEN PV int3 exception entry path, then below panic
triggered:

[    0.772876] general protection fault: 0000 [#1] SMP NOPTI
[    0.772886] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.2.0+ #11
[    0.772893] RIP: e030:int3_magic+0x0/0x7
[    0.772905] RSP: 3507:ffffffff82203e98 EFLAGS: 00000246
[    0.773334] Call Trace:
[    0.773334]  alternative_instructions+0x3d/0x12e
[    0.773334]  check_bugs+0x7c9/0x887
[    0.773334]  ? __get_locked_pte+0x178/0x1f0
[    0.773334]  start_kernel+0x4ff/0x535
[    0.773334]  ? set_init_arg+0x55/0x55
[    0.773334]  xen_start_kernel+0x571/0x57a

For 64bit PV guests, Xen's ABI enters the kernel with using SYSRET, with
%rcx/%r11 on the stack. To convert back to "normal" looking exceptions,
the xen thunks do 'xen_*: pop %rcx; pop %r11; jmp *'.

E.g. Extracting 'xen_pv_trap xenint3' we have:
xen_xenint3:
 pop %rcx;
 pop %r11;
 jmp xenint3

As xenint3 and int3 entry code are same except xenint3 doesn't generate
a gap, we can fix it by using int3 and drop useless xenint3.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/entry/entry_64.S    | 1 -
 arch/x86/include/asm/traps.h | 2 +-
 arch/x86/xen/enlighten_pv.c  | 2 +-
 arch/x86/xen/xen-asm_64.S    | 1 -
 4 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 206df099950ea..e7572a209fbe7 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1196,7 +1196,6 @@ idtentry stack_segment		do_stack_segment	has_error_code=1
 #ifdef CONFIG_XEN
 idtentry xennmi			do_nmi			has_error_code=0
 idtentry xendebug		do_debug		has_error_code=0
-idtentry xenint3		do_int3			has_error_code=0
 #endif
 
 idtentry general_protection	do_general_protection	has_error_code=1
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index afbc87206886e..b771bb3d159bc 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -40,7 +40,7 @@ asmlinkage void simd_coprocessor_error(void);
 asmlinkage void xen_divide_error(void);
 asmlinkage void xen_xennmi(void);
 asmlinkage void xen_xendebug(void);
-asmlinkage void xen_xenint3(void);
+asmlinkage void xen_int3(void);
 asmlinkage void xen_overflow(void);
 asmlinkage void xen_bounds(void);
 asmlinkage void xen_invalid_op(void);
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 782f98b332f05..1730a26ff6abc 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -597,12 +597,12 @@ struct trap_array_entry {
 
 static struct trap_array_entry trap_array[] = {
 	{ debug,                       xen_xendebug,                    true },
-	{ int3,                        xen_xenint3,                     true },
 	{ double_fault,                xen_double_fault,                true },
 #ifdef CONFIG_X86_MCE
 	{ machine_check,               xen_machine_check,               true },
 #endif
 	{ nmi,                         xen_xennmi,                      true },
+	{ int3,                        xen_int3,                        false },
 	{ overflow,                    xen_overflow,                    false },
 #ifdef CONFIG_IA32_EMULATION
 	{ entry_INT80_compat,          xen_entry_INT80_compat,          false },
diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
index 417b339e5c8e1..3a6feed76dfc1 100644
--- a/arch/x86/xen/xen-asm_64.S
+++ b/arch/x86/xen/xen-asm_64.S
@@ -30,7 +30,6 @@ xen_pv_trap divide_error
 xen_pv_trap debug
 xen_pv_trap xendebug
 xen_pv_trap int3
-xen_pv_trap xenint3
 xen_pv_trap xennmi
 xen_pv_trap overflow
 xen_pv_trap bounds
-- 
GitLab


From ba5c072fbf8ba9ab78402d0932c5f63ae1f66a9b Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Wed, 17 Jul 2019 20:36:39 -0500
Subject: [PATCH 1321/1835] x86/kvm: Don't call kvm_spurious_fault() from
 .fixup

[ Upstream commit 3901336ed9887b075531bffaeef7742ba614058b ]

After making a change to improve objtool's sibling call detection, it
started showing the following warning:

  arch/x86/kvm/vmx/nested.o: warning: objtool: .fixup+0x15: sibling call from callable instruction with modified stack frame

The problem is the ____kvm_handle_fault_on_reboot() macro.  It does a
fake call by pushing a fake RIP and doing a jump.  That tricks the
unwinder into printing the function which triggered the exception,
rather than the .fixup code.

Instead of the hack to make it look like the original function made the
call, just change the macro so that the original function actually does
make the call.  This allows removal of the hack, and also makes objtool
happy.

I triggered a vmx instruction exception and verified that the stack
trace is still sane:

  kernel BUG at arch/x86/kvm/x86.c:358!
  invalid opcode: 0000 [#1] SMP PTI
  CPU: 28 PID: 4096 Comm: qemu-kvm Not tainted 5.2.0+ #16
  Hardware name: Lenovo THINKSYSTEM SD530 -[7X2106Z000]-/-[7X2106Z000]-, BIOS -[TEE113Z-1.00]- 07/17/2017
  RIP: 0010:kvm_spurious_fault+0x5/0x10
  Code: 00 00 00 00 00 8b 44 24 10 89 d2 45 89 c9 48 89 44 24 10 8b 44 24 08 48 89 44 24 08 e9 d4 40 22 00 0f 1f 40 00 0f 1f 44 00 00 <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 55 49 89 fd 41
  RSP: 0018:ffffbf91c683bd00 EFLAGS: 00010246
  RAX: 000061f040000000 RBX: ffff9e159c77bba0 RCX: ffff9e15a5c87000
  RDX: 0000000665c87000 RSI: ffff9e15a5c87000 RDI: ffff9e159c77bba0
  RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9e15a5c87000
  R10: 0000000000000000 R11: fffff8f2d99721c0 R12: ffff9e159c77bba0
  R13: ffffbf91c671d960 R14: ffff9e159c778000 R15: 0000000000000000
  FS:  00007fa341cbe700(0000) GS:ffff9e15b7400000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007fdd38356804 CR3: 00000006759de003 CR4: 00000000007606e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  PKRU: 55555554
  Call Trace:
   loaded_vmcs_init+0x4f/0xe0
   alloc_loaded_vmcs+0x38/0xd0
   vmx_create_vcpu+0xf7/0x600
   kvm_vm_ioctl+0x5e9/0x980
   ? __switch_to_asm+0x40/0x70
   ? __switch_to_asm+0x34/0x70
   ? __switch_to_asm+0x40/0x70
   ? __switch_to_asm+0x34/0x70
   ? free_one_page+0x13f/0x4e0
   do_vfs_ioctl+0xa4/0x630
   ksys_ioctl+0x60/0x90
   __x64_sys_ioctl+0x16/0x20
   do_syscall_64+0x55/0x1c0
   entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x7fa349b1ee5b

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/64a9b64d127e87b6920a97afde8e96ea76f6524e.1563413318.git.jpoimboe@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/kvm_host.h | 34 ++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 7014dba23d20c..2877e1fbadd86 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1427,25 +1427,29 @@ enum {
 #define kvm_arch_vcpu_memslots_id(vcpu) ((vcpu)->arch.hflags & HF_SMM_MASK ? 1 : 0)
 #define kvm_memslots_for_spte_role(kvm, role) __kvm_memslots(kvm, (role).smm)
 
+asmlinkage void __noreturn kvm_spurious_fault(void);
+
 /*
  * Hardware virtualization extension instructions may fault if a
  * reboot turns off virtualization while processes are running.
- * Trap the fault and ignore the instruction if that happens.
+ * Usually after catching the fault we just panic; during reboot
+ * instead the instruction is ignored.
  */
-asmlinkage void kvm_spurious_fault(void);
-
-#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn)	\
-	"666: " insn "\n\t" \
-	"668: \n\t"                           \
-	".pushsection .fixup, \"ax\" \n" \
-	"667: \n\t" \
-	cleanup_insn "\n\t"		      \
-	"cmpb $0, kvm_rebooting \n\t"	      \
-	"jne 668b \n\t"      		      \
-	__ASM_SIZE(push) " $666b \n\t"	      \
-	"jmp kvm_spurious_fault \n\t"	      \
-	".popsection \n\t" \
-	_ASM_EXTABLE(666b, 667b)
+#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn)		\
+	"666: \n\t"							\
+	insn "\n\t"							\
+	"jmp	668f \n\t"						\
+	"667: \n\t"							\
+	"call	kvm_spurious_fault \n\t"				\
+	"668: \n\t"							\
+	".pushsection .fixup, \"ax\" \n\t"				\
+	"700: \n\t"							\
+	cleanup_insn "\n\t"						\
+	"cmpb	$0, kvm_rebooting\n\t"					\
+	"je	667b \n\t"						\
+	"jmp	668b \n\t"						\
+	".popsection \n\t"						\
+	_ASM_EXTABLE(666b, 700b)
 
 #define __kvm_handle_fault_on_reboot(insn)		\
 	____kvm_handle_fault_on_reboot(insn, "")
-- 
GitLab


From 740e0167a382d04f7c06c7f177f109e1cf47f9a7 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Wed, 17 Jul 2019 20:36:36 -0500
Subject: [PATCH 1322/1835] x86/paravirt: Fix callee-saved function ELF sizes

[ Upstream commit 083db6764821996526970e42d09c1ab2f4155dd4 ]

The __raw_callee_save_*() functions have an ELF symbol size of zero,
which confuses objtool and other tools.

Fixes a bunch of warnings like the following:

  arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_pte_val() is missing an ELF size annotation
  arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_pgd_val() is missing an ELF size annotation
  arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_make_pte() is missing an ELF size annotation
  arch/x86/xen/mmu_pv.o: warning: objtool: __raw_callee_save_xen_make_pgd() is missing an ELF size annotation

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/afa6d49bb07497ca62e4fc3b27a2d0cece545b4e.1563413318.git.jpoimboe@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/paravirt.h | 1 +
 arch/x86/kernel/kvm.c           | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index e375d4266b53e..a04677038872c 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -768,6 +768,7 @@ static __always_inline bool pv_vcpu_is_preempted(long cpu)
 	    PV_RESTORE_ALL_CALLER_REGS					\
 	    FRAME_END							\
 	    "ret;"							\
+	    ".size " PV_THUNK_NAME(func) ", .-" PV_THUNK_NAME(func) ";"	\
 	    ".popsection")
 
 /* Get a reference to a callee-save function */
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 7f89d609095ac..cee45d46e67dc 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -830,6 +830,7 @@ asm(
 "cmpb	$0, " __stringify(KVM_STEAL_TIME_preempted) "+steal_time(%rax);"
 "setne	%al;"
 "ret;"
+".size __raw_callee_save___kvm_vcpu_is_preempted, .-__raw_callee_save___kvm_vcpu_is_preempted;"
 ".popsection");
 
 #endif
-- 
GitLab


From 84ce045222e977d31deb1a4b738a990f60dc1df9 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Date: Tue, 16 Jul 2019 21:18:12 +0800
Subject: [PATCH 1323/1835] x86, boot: Remove multiple copy of static function
 sanitize_boot_params()

[ Upstream commit 8c5477e8046ca139bac250386c08453da37ec1ae ]

Kernel build warns:
 'sanitize_boot_params' defined but not used [-Wunused-function]

at below files:
  arch/x86/boot/compressed/cmdline.c
  arch/x86/boot/compressed/error.c
  arch/x86/boot/compressed/early_serial_console.c
  arch/x86/boot/compressed/acpi.c

That's becausethey each include misc.h which includes a definition of
sanitize_boot_params() via bootparam_utils.h.

Remove the inclusion from misc.h and have the c file including
bootparam_utils.h directly.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/1563283092-1189-1-git-send-email-zhenzhong.duan@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/boot/compressed/misc.c | 1 +
 arch/x86/boot/compressed/misc.h | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 8dd1d5ccae580..0387d7a96c842 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -17,6 +17,7 @@
 #include "pgtable.h"
 #include "../string.h"
 #include "../voffset.h"
+#include <asm/bootparam_utils.h>
 
 /*
  * WARNING!!
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index a423bdb426862..47fd18db6b3bf 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -22,7 +22,6 @@
 #include <asm/page.h>
 #include <asm/boot.h>
 #include <asm/bootparam.h>
-#include <asm/bootparam_utils.h>
 
 #define BOOT_BOOT_H
 #include "../ctype.h"
-- 
GitLab


From 4c6500b5328f313e0d0427568a7691ee3865ce64 Mon Sep 17 00:00:00 2001
From: Yongxin Liu <yongxin.liu@windriver.com>
Date: Mon, 1 Jul 2019 09:46:22 +0800
Subject: [PATCH 1324/1835] drm/nouveau: fix memory leak in
 nouveau_conn_reset()

[ Upstream commit 09b90e2fe35faeace2488234e2a7728f2ea8ba26 ]

In nouveau_conn_reset(), if connector->state is true,
__drm_atomic_helper_connector_destroy_state() will be called,
but the memory pointed by asyc isn't freed. Memory leak happens
in the following function __drm_atomic_helper_connector_reset(),
where newly allocated asyc->state will be assigned to connector->state.

So using nouveau_conn_atomic_destroy_state() instead of
__drm_atomic_helper_connector_destroy_state to free the "old" asyc.

Here the is the log showing memory leak.

unreferenced object 0xffff8c5480483c80 (size 192):
  comm "kworker/0:2", pid 188, jiffies 4294695279 (age 53.179s)
  hex dump (first 32 bytes):
    00 f0 ba 7b 54 8c ff ff 00 00 00 00 00 00 00 00  ...{T...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000005005c0d0>] kmem_cache_alloc_trace+0x195/0x2c0
    [<00000000a122baed>] nouveau_conn_reset+0x25/0xc0 [nouveau]
    [<000000004fd189a2>] nouveau_connector_create+0x3a7/0x610 [nouveau]
    [<00000000c73343a8>] nv50_display_create+0x343/0x980 [nouveau]
    [<000000002e2b03c3>] nouveau_display_create+0x51f/0x660 [nouveau]
    [<00000000c924699b>] nouveau_drm_device_init+0x182/0x7f0 [nouveau]
    [<00000000cc029436>] nouveau_drm_probe+0x20c/0x2c0 [nouveau]
    [<000000007e961c3e>] local_pci_probe+0x47/0xa0
    [<00000000da14d569>] work_for_cpu_fn+0x1a/0x30
    [<0000000028da4805>] process_one_work+0x27c/0x660
    [<000000001d415b04>] worker_thread+0x22b/0x3f0
    [<0000000003b69f1f>] kthread+0x12f/0x150
    [<00000000c94c29b7>] ret_from_fork+0x3a/0x50

Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 247f72cc4d10a..fb0094fc55834 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -251,7 +251,7 @@ nouveau_conn_reset(struct drm_connector *connector)
 		return;
 
 	if (connector->state)
-		__drm_atomic_helper_connector_destroy_state(connector->state);
+		nouveau_conn_atomic_destroy_state(connector, connector->state);
 	__drm_atomic_helper_connector_reset(connector, &asyc->state);
 	asyc->dither.mode = DITHERING_MODE_AUTO;
 	asyc->dither.depth = DITHERING_DEPTH_AUTO;
-- 
GitLab


From 3736612d25828351cc74ac3cdf3d582c194963d1 Mon Sep 17 00:00:00 2001
From: "M. Vefa Bicakci" <m.v.b@runbox.com>
Date: Sat, 3 Aug 2019 06:02:12 -0400
Subject: [PATCH 1325/1835] kconfig: Clear "written" flag to avoid data loss

commit 0c5b6c28ed68becb692b43eae5e44d5aa7e160ce upstream.

Prior to this commit, starting nconfig, xconfig or gconfig, and saving
the .config file more than once caused data loss, where a .config file
that contained only comments would be written to disk starting from the
second save operation.

This bug manifests itself because the SYMBOL_WRITTEN flag is never
cleared after the first call to conf_write, and subsequent calls to
conf_write then skip all of the configuration symbols due to the
SYMBOL_WRITTEN flag being set.

This commit resolves this issue by clearing the SYMBOL_WRITTEN flag
from all symbols before conf_write returns.

Fixes: 8e2442a5f86e ("kconfig: fix missing choice values in auto.conf")
Cc: linux-stable <stable@vger.kernel.org> # 4.19+
Signed-off-by: M. Vefa Bicakci <m.v.b@runbox.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/kconfig/confdata.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index fd99ae90a618b..0dde19cf74865 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -784,6 +784,7 @@ int conf_write(const char *name)
 	const char *str;
 	char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8];
 	char *env;
+	int i;
 
 	dirname[0] = 0;
 	if (name && name[0]) {
@@ -860,6 +861,9 @@ next:
 	}
 	fclose(out);
 
+	for_all_symbols(i, sym)
+		sym->flags &= ~SYMBOL_WRITTEN;
+
 	if (*tmpname) {
 		strcat(dirname, basename);
 		strcat(dirname, ".old");
-- 
GitLab


From 4c5a442561e86933b656b5357da43c5967f5c91f Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Mon, 29 Jul 2019 18:15:17 +0900
Subject: [PATCH 1326/1835] kbuild: initialize CLANG_FLAGS correctly in the top
 Makefile

commit 5241ab4cf42d3a93b933b55d3d53f43049081fa1 upstream.

CLANG_FLAGS is initialized by the following line:

  CLANG_FLAGS     := --target=$(notdir $(CROSS_COMPILE:%-=%))

..., which is run only when CROSS_COMPILE is set.

Some build targets (bindeb-pkg etc.) recurse to the top Makefile.

When you build the kernel with Clang but without CROSS_COMPILE,
the same compiler flags such as -no-integrated-as are accumulated
into CLANG_FLAGS.

If you run 'make CC=clang' and then 'make CC=clang bindeb-pkg',
Kbuild will recompile everything needlessly due to the build command
change.

Fix this by correctly initializing CLANG_FLAGS.

Fixes: 238bcbc4e07f ("kbuild: consolidate Clang compiler flags")
Cc: <stable@vger.kernel.org> # v5.0+
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 203d9e80a315e..97deee85e3f4a 100644
--- a/Makefile
+++ b/Makefile
@@ -430,6 +430,7 @@ KBUILD_CFLAGS_MODULE  := -DMODULE
 KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
 KBUILD_LDFLAGS :=
 GCC_PLUGINS_CFLAGS :=
+CLANG_FLAGS :=
 
 export ARCH SRCARCH CONFIG_SHELL HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE AS LD CC
 export CPP AR NM STRIP OBJCOPY OBJDUMP KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS
@@ -482,7 +483,7 @@ endif
 
 ifeq ($(cc-name),clang)
 ifneq ($(CROSS_COMPILE),)
-CLANG_FLAGS	:= --target=$(notdir $(CROSS_COMPILE:%-=%))
+CLANG_FLAGS	+= --target=$(notdir $(CROSS_COMPILE:%-=%))
 GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
 CLANG_FLAGS	+= --prefix=$(GCC_TOOLCHAIN_DIR)
 GCC_TOOLCHAIN	:= $(realpath $(GCC_TOOLCHAIN_DIR)/..)
-- 
GitLab


From 009d7a4eb3298392f72fc3ccc14321ca7a68941b Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 17 Jul 2019 13:23:39 +0100
Subject: [PATCH 1327/1835] Btrfs: fix incremental send failure after
 deduplication

commit b4f9a1a87a48c255bb90d8a6c3d555a1abb88130 upstream.

When doing an incremental send operation we can fail if we previously did
deduplication operations against a file that exists in both snapshots. In
that case we will fail the send operation with -EIO and print a message
to dmesg/syslog like the following:

  BTRFS error (device sdc): Send: inconsistent snapshot, found updated \
  extent for inode 257 without updated inode item, send root is 258, \
  parent root is 257

This requires that we deduplicate to the same file in both snapshots for
the same amount of times on each snapshot. The issue happens because a
deduplication only updates the iversion of an inode and does not update
any other field of the inode, therefore if we deduplicate the file on
each snapshot for the same amount of time, the inode will have the same
iversion value (stored as the "sequence" field on the inode item) on both
snapshots, therefore it will be seen as unchanged between in the send
snapshot while there are new/updated/deleted extent items when comparing
to the parent snapshot. This makes the send operation return -EIO and
print an error message.

Example reproducer:

  $ mkfs.btrfs -f /dev/sdb
  $ mount /dev/sdb /mnt

  # Create our first file. The first half of the file has several 64Kb
  # extents while the second half as a single 512Kb extent.
  $ xfs_io -f -s -c "pwrite -S 0xb8 -b 64K 0 512K" /mnt/foo
  $ xfs_io -c "pwrite -S 0xb8 512K 512K" /mnt/foo

  # Create the base snapshot and the parent send stream from it.
  $ btrfs subvolume snapshot -r /mnt /mnt/mysnap1
  $ btrfs send -f /tmp/1.snap /mnt/mysnap1

  # Create our second file, that has exactly the same data as the first
  # file.
  $ xfs_io -f -c "pwrite -S 0xb8 0 1M" /mnt/bar

  # Create the second snapshot, used for the incremental send, before
  # doing the file deduplication.
  $ btrfs subvolume snapshot -r /mnt /mnt/mysnap2

  # Now before creating the incremental send stream:
  #
  # 1) Deduplicate into a subrange of file foo in snapshot mysnap1. This
  #    will drop several extent items and add a new one, also updating
  #    the inode's iversion (sequence field in inode item) by 1, but not
  #    any other field of the inode;
  #
  # 2) Deduplicate into a different subrange of file foo in snapshot
  #    mysnap2. This will replace an extent item with a new one, also
  #    updating the inode's iversion by 1 but not any other field of the
  #    inode.
  #
  # After these two deduplication operations, the inode items, for file
  # foo, are identical in both snapshots, but we have different extent
  # items for this inode in both snapshots. We want to check this doesn't
  # cause send to fail with an error or produce an incorrect stream.

  $ xfs_io -r -c "dedupe /mnt/bar 0 0 512K" /mnt/mysnap1/foo
  $ xfs_io -r -c "dedupe /mnt/bar 512K 512K 512K" /mnt/mysnap2/foo

  # Create the incremental send stream.
  $ btrfs send -p /mnt/mysnap1 -f /tmp/2.snap /mnt/mysnap2
  ERROR: send ioctl failed with -5: Input/output error

This issue started happening back in 2015 when deduplication was updated
to not update the inode's ctime and mtime and update only the iversion.
Back then we would hit a BUG_ON() in send, but later in 2016 send was
updated to return -EIO and print the error message instead of doing the
BUG_ON().

A test case for fstests follows soon.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203933
Fixes: 1c919a5e13702c ("btrfs: don't update mtime/ctime on deduped inodes")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/send.c | 77 ++++++++++---------------------------------------
 1 file changed, 15 insertions(+), 62 deletions(-)

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 258392b75048e..48ddbc187e58b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -6272,68 +6272,21 @@ static int changed_extent(struct send_ctx *sctx,
 {
 	int ret = 0;
 
-	if (sctx->cur_ino != sctx->cmp_key->objectid) {
-
-		if (result == BTRFS_COMPARE_TREE_CHANGED) {
-			struct extent_buffer *leaf_l;
-			struct extent_buffer *leaf_r;
-			struct btrfs_file_extent_item *ei_l;
-			struct btrfs_file_extent_item *ei_r;
-
-			leaf_l = sctx->left_path->nodes[0];
-			leaf_r = sctx->right_path->nodes[0];
-			ei_l = btrfs_item_ptr(leaf_l,
-					      sctx->left_path->slots[0],
-					      struct btrfs_file_extent_item);
-			ei_r = btrfs_item_ptr(leaf_r,
-					      sctx->right_path->slots[0],
-					      struct btrfs_file_extent_item);
-
-			/*
-			 * We may have found an extent item that has changed
-			 * only its disk_bytenr field and the corresponding
-			 * inode item was not updated. This case happens due to
-			 * very specific timings during relocation when a leaf
-			 * that contains file extent items is COWed while
-			 * relocation is ongoing and its in the stage where it
-			 * updates data pointers. So when this happens we can
-			 * safely ignore it since we know it's the same extent,
-			 * but just at different logical and physical locations
-			 * (when an extent is fully replaced with a new one, we
-			 * know the generation number must have changed too,
-			 * since snapshot creation implies committing the current
-			 * transaction, and the inode item must have been updated
-			 * as well).
-			 * This replacement of the disk_bytenr happens at
-			 * relocation.c:replace_file_extents() through
-			 * relocation.c:btrfs_reloc_cow_block().
-			 */
-			if (btrfs_file_extent_generation(leaf_l, ei_l) ==
-			    btrfs_file_extent_generation(leaf_r, ei_r) &&
-			    btrfs_file_extent_ram_bytes(leaf_l, ei_l) ==
-			    btrfs_file_extent_ram_bytes(leaf_r, ei_r) &&
-			    btrfs_file_extent_compression(leaf_l, ei_l) ==
-			    btrfs_file_extent_compression(leaf_r, ei_r) &&
-			    btrfs_file_extent_encryption(leaf_l, ei_l) ==
-			    btrfs_file_extent_encryption(leaf_r, ei_r) &&
-			    btrfs_file_extent_other_encoding(leaf_l, ei_l) ==
-			    btrfs_file_extent_other_encoding(leaf_r, ei_r) &&
-			    btrfs_file_extent_type(leaf_l, ei_l) ==
-			    btrfs_file_extent_type(leaf_r, ei_r) &&
-			    btrfs_file_extent_disk_bytenr(leaf_l, ei_l) !=
-			    btrfs_file_extent_disk_bytenr(leaf_r, ei_r) &&
-			    btrfs_file_extent_disk_num_bytes(leaf_l, ei_l) ==
-			    btrfs_file_extent_disk_num_bytes(leaf_r, ei_r) &&
-			    btrfs_file_extent_offset(leaf_l, ei_l) ==
-			    btrfs_file_extent_offset(leaf_r, ei_r) &&
-			    btrfs_file_extent_num_bytes(leaf_l, ei_l) ==
-			    btrfs_file_extent_num_bytes(leaf_r, ei_r))
-				return 0;
-		}
-
-		inconsistent_snapshot_error(sctx, result, "extent");
-		return -EIO;
-	}
+	/*
+	 * We have found an extent item that changed without the inode item
+	 * having changed. This can happen either after relocation (where the
+	 * disk_bytenr of an extent item is replaced at
+	 * relocation.c:replace_file_extents()) or after deduplication into a
+	 * file in both the parent and send snapshots (where an extent item can
+	 * get modified or replaced with a new one). Note that deduplication
+	 * updates the inode item, but it only changes the iversion (sequence
+	 * field in the inode item) of the inode, so if a file is deduplicated
+	 * the same amount of times in both the parent and send snapshots, its
+	 * iversion becames the same in both snapshots, whence the inode item is
+	 * the same on both snapshots.
+	 */
+	if (sctx->cur_ino != sctx->cmp_key->objectid)
+		return 0;
 
 	if (!sctx->cur_inode_new_gen && !sctx->cur_inode_deleted) {
 		if (result != BTRFS_COMPARE_TREE_DELETED)
-- 
GitLab


From 50d700408a0019eb34656dc2d2e09b08cfff80f0 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Thu, 25 Jul 2019 11:27:04 +0100
Subject: [PATCH 1328/1835] Btrfs: fix race leading to fs corruption after
 transaction abort

commit cb2d3daddbfb6318d170e79aac1f7d5e4d49f0d7 upstream.

When one transaction is finishing its commit, it is possible for another
transaction to start and enter its initial commit phase as well. If the
first ends up getting aborted, we have a small time window where the second
transaction commit does not notice that the previous transaction aborted
and ends up committing, writing a superblock that points to btrees that
reference extent buffers (nodes and leafs) that were not persisted to disk.
The consequence is that after mounting the filesystem again, we will be
unable to load some btree nodes/leafs, either because the content on disk
is either garbage (or just zeroes) or corresponds to the old content of a
previouly COWed or deleted node/leaf, resulting in the well known error
messages "parent transid verify failed on ...".
The following sequence diagram illustrates how this can happen.

        CPU 1                                           CPU 2

 <at transaction N>

 btrfs_commit_transaction()
   (...)
   --> sets transaction state to
       TRANS_STATE_UNBLOCKED
   --> sets fs_info->running_transaction
       to NULL

                                                    (...)
                                                    btrfs_start_transaction()
                                                      start_transaction()
                                                        wait_current_trans()
                                                          --> returns immediately
                                                              because
                                                              fs_info->running_transaction
                                                              is NULL
                                                        join_transaction()
                                                          --> creates transaction N + 1
                                                          --> sets
                                                              fs_info->running_transaction
                                                              to transaction N + 1
                                                          --> adds transaction N + 1 to
                                                              the fs_info->trans_list list
                                                        --> returns transaction handle
                                                            pointing to the new
                                                            transaction N + 1
                                                    (...)

                                                    btrfs_sync_file()
                                                      btrfs_start_transaction()
                                                        --> returns handle to
                                                            transaction N + 1
                                                      (...)

   btrfs_write_and_wait_transaction()
     --> writeback of some extent
         buffer fails, returns an
	 error
   btrfs_handle_fs_error()
     --> sets BTRFS_FS_STATE_ERROR in
         fs_info->fs_state
   --> jumps to label "scrub_continue"
   cleanup_transaction()
     btrfs_abort_transaction(N)
       --> sets BTRFS_FS_STATE_TRANS_ABORTED
           flag in fs_info->fs_state
       --> sets aborted field in the
           transaction and transaction
	   handle structures, for
           transaction N only
     --> removes transaction from the
         list fs_info->trans_list
                                                      btrfs_commit_transaction(N + 1)
                                                        --> transaction N + 1 was not
							    aborted, so it proceeds
                                                        (...)
                                                        --> sets the transaction's state
                                                            to TRANS_STATE_COMMIT_START
                                                        --> does not find the previous
                                                            transaction (N) in the
                                                            fs_info->trans_list, so it
                                                            doesn't know that transaction
                                                            was aborted, and the commit
                                                            of transaction N + 1 proceeds
                                                        (...)
                                                        --> sets transaction N + 1 state
                                                            to TRANS_STATE_UNBLOCKED
                                                        btrfs_write_and_wait_transaction()
                                                          --> succeeds writing all extent
                                                              buffers created in the
                                                              transaction N + 1
                                                        write_all_supers()
                                                           --> succeeds
                                                           --> we now have a superblock on
                                                               disk that points to trees
                                                               that refer to at least one
                                                               extent buffer that was
                                                               never persisted

So fix this by updating the transaction commit path to check if the flag
BTRFS_FS_STATE_TRANS_ABORTED is set on fs_info->fs_state if after setting
the transaction to the TRANS_STATE_COMMIT_START we do not find any previous
transaction in the fs_info->trans_list. If the flag is set, just fail the
transaction commit with -EROFS, as we do in other places. The exact error
code for the previous transaction abort was already logged and reported.

Fixes: 49b25e0540904b ("btrfs: enhance transaction abort infrastructure")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/transaction.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index bb8f6c020d227..f1ca53a3ff0bf 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -2027,6 +2027,16 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
 		}
 	} else {
 		spin_unlock(&fs_info->trans_lock);
+		/*
+		 * The previous transaction was aborted and was already removed
+		 * from the list of transactions at fs_info->trans_list. So we
+		 * abort to prevent writing a new superblock that reflects a
+		 * corrupt state (pointing to trees with unwritten nodes/leafs).
+		 */
+		if (test_bit(BTRFS_FS_STATE_TRANS_ABORTED, &fs_info->fs_state)) {
+			ret = -EROFS;
+			goto cleanup_transaction;
+		}
 	}
 
 	extwriter_counter_dec(cur_trans, trans->type);
-- 
GitLab


From 29841b5c6ab1ee09f616151f06eb39648fe9046d Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Mon, 8 Jul 2019 12:56:13 -0700
Subject: [PATCH 1329/1835] mmc: dw_mmc: Fix occasional hang after tuning on
 eMMC

commit ba2d139b02ba684c6c101de42fed782d6cd2b997 upstream.

In commit 46d179525a1f ("mmc: dw_mmc: Wait for data transfer after
response errors.") we fixed a tuning-induced hang that I saw when
stress testing tuning on certain SD cards.  I won't re-hash that whole
commit, but the summary is that as a normal part of tuning you need to
deal with transfer errors and there were cases where these transfer
errors was putting my system into a bad state causing all future
transfers to fail.  That commit fixed handling of the transfer errors
for me.

In downstream Chrome OS my fix landed and had the same behavior for
all SD/MMC commands.  However, it looks like when the commit landed
upstream we limited it to only SD tuning commands.  Presumably this
was to try to get around problems that Alim Akhtar reported on exynos
[1].

Unfortunately while stress testing reboots (and suspend/resume) on
some rk3288-based Chromebooks I found the same problem on the eMMC on
some of my Chromebooks (the ones with Hynix eMMC).  Since the eMMC
tuning command is different (MMC_SEND_TUNING_BLOCK_HS200
vs. MMC_SEND_TUNING_BLOCK) we were basically getting back into the
same situation.

I'm hoping that whatever problems exynos was having in the past are
somehow magically fixed now and we can make the behavior the same for
all commands.

[1] https://lkml.kernel.org/r/CAGOxZ53WfNbaMe0_AM0qBqU47kAfgmPBVZC8K8Y-_J3mDMqW4A@mail.gmail.com

Fixes: 46d179525a1f ("mmc: dw_mmc: Wait for data transfer after response errors.")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Alim Akhtar <alim.akhtar@gmail.com>
Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/dw_mmc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 80dc2fd6576cf..942da07c9eb87 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2038,8 +2038,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
 				 * delayed. Allowing the transfer to take place
 				 * avoids races and keeps things simple.
 				 */
-				if ((err != -ETIMEDOUT) &&
-				    (cmd->opcode == MMC_SEND_TUNING_BLOCK)) {
+				if (err != -ETIMEDOUT) {
 					state = STATE_SENDING_DATA;
 					continue;
 				}
-- 
GitLab


From 7e3efb655012a344fde83928f202f7234dfc5c4e Mon Sep 17 00:00:00 2001
From: Joe Perches <joe@perches.com>
Date: Tue, 9 Jul 2019 22:04:19 -0700
Subject: [PATCH 1330/1835] mmc: meson-mx-sdio: Fix misuse of GENMASK macro

commit 665e985c2f41bebc3e6cee7e04c36a44afbc58f7 upstream.

Arguments are supposed to be ordered high then low.

Signed-off-by: Joe Perches <joe@perches.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Fixes: ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic
Meson8 and Meson8b SoCs")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/meson-mx-sdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
index 9841b447ccde0..f6c76be2be0d3 100644
--- a/drivers/mmc/host/meson-mx-sdio.c
+++ b/drivers/mmc/host/meson-mx-sdio.c
@@ -76,7 +76,7 @@
 	#define MESON_MX_SDIO_IRQC_IF_CONFIG_MASK		GENMASK(7, 6)
 	#define MESON_MX_SDIO_IRQC_FORCE_DATA_CLK		BIT(8)
 	#define MESON_MX_SDIO_IRQC_FORCE_DATA_CMD		BIT(9)
-	#define MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK		GENMASK(10, 13)
+	#define MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK		GENMASK(13, 10)
 	#define MESON_MX_SDIO_IRQC_SOFT_RESET			BIT(15)
 	#define MESON_MX_SDIO_IRQC_FORCE_HALT			BIT(30)
 	#define MESON_MX_SDIO_IRQC_HALT_HOLE			BIT(31)
-- 
GitLab


From fdb0fb56addb0e516eea557721008e32c239ac62 Mon Sep 17 00:00:00 2001
From: Michael Wu <michael.wu@vatics.com>
Date: Mon, 8 Jul 2019 13:23:08 +0800
Subject: [PATCH 1331/1835] gpiolib: fix incorrect IRQ requesting of an
 active-low lineevent

commit 223ecaf140b1dd1c1d2a1a1d96281efc5c906984 upstream.

When a pin is active-low, logical trigger edge should be inverted to match
the same interrupt opportunity.

For example, a button pushed triggers falling edge in ACTIVE_HIGH case; in
ACTIVE_LOW case, the button pushed triggers rising edge. For user space the
IRQ requesting doesn't need to do any modification except to configuring
GPIOHANDLE_REQUEST_ACTIVE_LOW.

For example, we want to catch the event when the button is pushed. The
button on the original board drives level to be low when it is pushed, and
drives level to be high when it is released.

In user space we can do:

	req.handleflags = GPIOHANDLE_REQUEST_INPUT;
	req.eventflags = GPIOEVENT_REQUEST_FALLING_EDGE;

	while (1) {
		read(fd, &dat, sizeof(dat));
		if (dat.id == GPIOEVENT_EVENT_FALLING_EDGE)
			printf("button pushed\n");
	}

Run the same logic on another board which the polarity of the button is
inverted; it drives level to be high when pushed, and level to be low when
released. For this inversion we add flag GPIOHANDLE_REQUEST_ACTIVE_LOW:

	req.handleflags = GPIOHANDLE_REQUEST_INPUT |
		GPIOHANDLE_REQUEST_ACTIVE_LOW;
	req.eventflags = GPIOEVENT_REQUEST_FALLING_EDGE;

At the result, there are no any events caught when the button is pushed.
By the way, button releasing will emit a "falling" event. The timing of
"falling" catching is not expected.

Cc: stable@vger.kernel.org
Signed-off-by: Michael Wu <michael.wu@vatics.com>
Tested-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpiolib.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 4a48c7c477094..b308ce92685d9 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -946,9 +946,11 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
 	}
 
 	if (eflags & GPIOEVENT_REQUEST_RISING_EDGE)
-		irqflags |= IRQF_TRIGGER_RISING;
+		irqflags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
+			IRQF_TRIGGER_FALLING : IRQF_TRIGGER_RISING;
 	if (eflags & GPIOEVENT_REQUEST_FALLING_EDGE)
-		irqflags |= IRQF_TRIGGER_FALLING;
+		irqflags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
+			IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
 	irqflags |= IRQF_ONESHOT;
 	irqflags |= IRQF_SHARED;
 
-- 
GitLab


From fafaeae4d356f3003a703dbb5948786f8de4d43c Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Date: Wed, 31 Jul 2019 12:54:28 -0500
Subject: [PATCH 1332/1835] IB/hfi1: Fix Spectre v1 vulnerability

commit 6497d0a9c53df6e98b25e2b79f2295d7caa47b6e upstream.

sl is controlled by user-space, hence leading to a potential
exploitation of the Spectre variant 1 vulnerability.

Fix this by sanitizing sl before using it to index ibp->sl_to_sc.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Link: https://lore.kernel.org/r/20190731175428.GA16736@embeddedor
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/hfi1/verbs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 27d9c4cefdc7a..1ad38c8c1ef97 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -54,6 +54,7 @@
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
 #include <rdma/opa_addr.h>
+#include <linux/nospec.h>
 
 #include "hfi.h"
 #include "common.h"
@@ -1596,6 +1597,7 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct rdma_ah_attr *ah_attr)
 	sl = rdma_ah_get_sl(ah_attr);
 	if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
 		return -EINVAL;
+	sl = array_index_nospec(sl, ARRAY_SIZE(ibp->sl_to_sc));
 
 	sc5 = ibp->sl_to_sc[sl];
 	if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
-- 
GitLab


From e7bb4c81b3c791c7eab7fbfc2a312c7442aad5a6 Mon Sep 17 00:00:00 2001
From: Marco Felsch <m.felsch@pengutronix.de>
Date: Tue, 30 Jul 2019 15:44:07 +0200
Subject: [PATCH 1333/1835] mtd: rawnand: micron: handle on-die "ECC-off"
 devices correctly

commit 8493b2a06fc5b77ef5c579dc32b12761f7b7a84c upstream.

Some devices are not supposed to support on-die ECC but experience
shows that internal ECC machinery can actually be enabled through the
"SET FEATURE (EFh)" command, even if a read of the "READ ID Parameter
Tables" returns that it is not.

Currently, the driver checks the "READ ID Parameter" field directly
after having enabled the feature. If the check fails it returns
immediately but leaves the ECC on. When using buggy chips like
MT29F2G08ABAGA and MT29F2G08ABBGA, all future read/program cycles will
go through the on-die ECC, confusing the host controller which is
supposed to be the one handling correction.

To address this in a common way we need to turn off the on-die ECC
directly after reading the "READ ID Parameter" and before checking the
"ECC status".

Cc: stable@vger.kernel.org
Fixes: dbc44edbf833 ("mtd: rawnand: micron: Fix on-die ECC detection logic")
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/nand_micron.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/nand_micron.c b/drivers/mtd/nand/raw/nand_micron.c
index f5dc0a7a24563..fb401c25732c7 100644
--- a/drivers/mtd/nand/raw/nand_micron.c
+++ b/drivers/mtd/nand/raw/nand_micron.c
@@ -400,6 +400,14 @@ static int micron_supports_on_die_ecc(struct nand_chip *chip)
 	    (chip->id.data[4] & MICRON_ID_INTERNAL_ECC_MASK) != 0x2)
 		return MICRON_ON_DIE_UNSUPPORTED;
 
+	/*
+	 * It seems that there are devices which do not support ECC officially.
+	 * At least the MT29F2G08ABAGA / MT29F2G08ABBGA devices supports
+	 * enabling the ECC feature but don't reflect that to the READ_ID table.
+	 * So we have to guarantee that we disable the ECC feature directly
+	 * after we did the READ_ID table command. Later we can evaluate the
+	 * ECC_ENABLE support.
+	 */
 	ret = micron_nand_on_die_ecc_setup(chip, true);
 	if (ret)
 		return MICRON_ON_DIE_UNSUPPORTED;
@@ -408,13 +416,13 @@ static int micron_supports_on_die_ecc(struct nand_chip *chip)
 	if (ret)
 		return MICRON_ON_DIE_UNSUPPORTED;
 
-	if (!(id[4] & MICRON_ID_ECC_ENABLED))
-		return MICRON_ON_DIE_UNSUPPORTED;
-
 	ret = micron_nand_on_die_ecc_setup(chip, false);
 	if (ret)
 		return MICRON_ON_DIE_UNSUPPORTED;
 
+	if (!(id[4] & MICRON_ID_ECC_ENABLED))
+		return MICRON_ON_DIE_UNSUPPORTED;
+
 	ret = nand_readid_op(chip, 0, id, sizeof(id));
 	if (ret)
 		return MICRON_ON_DIE_UNSUPPORTED;
-- 
GitLab


From 46650ac2e1d89687175547a9f67e1bd70eb1c924 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Thu, 25 Jul 2019 12:52:43 +0200
Subject: [PATCH 1334/1835] selinux: fix memory leak in policydb_init()

commit 45385237f65aeee73641f1ef737d7273905a233f upstream.

Since roles_init() adds some entries to the role hash table, we need to
destroy also its keys/values on error, otherwise we get a memory leak in
the error path.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+fee3a14d4cdf92646287@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/selinux/ss/policydb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index d31a52e56b9ec..91d259c87d10c 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -275,6 +275,8 @@ static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2)
 	return v;
 }
 
+static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap);
+
 /*
  * Initialize a policy database structure.
  */
@@ -322,8 +324,10 @@ static int policydb_init(struct policydb *p)
 out:
 	hashtab_destroy(p->filename_trans);
 	hashtab_destroy(p->range_tr);
-	for (i = 0; i < SYM_NUM; i++)
+	for (i = 0; i < SYM_NUM; i++) {
+		hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
 		hashtab_destroy(p->symtab[i].table);
+	}
 	return rc;
 }
 
-- 
GitLab


From 72651bbdf3d5e2d587c0a1cc0da977cb608787a5 Mon Sep 17 00:00:00 2001
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date: Fri, 26 Jul 2019 23:47:02 +0200
Subject: [PATCH 1335/1835] ALSA: hda: Fix 1-minute detection delay when i915
 module is not available

commit 74bf71ed792ab0f64631cc65ccdb54c356c36d45 upstream.

Distribution installation images such as Debian include different sets
of modules which can be downloaded dynamically.  Such images may notably
include the hda sound modules but not the i915 DRM module, even if the
latter was enabled at build time, as reported on
https://bugs.debian.org/931507

In such a case hdac_i915 would be linked in and try to load the i915
module, fail since it is not there, but still wait for a whole minute
before giving up binding with it.

This fixes such as case by only waiting for the binding if the module
was properly loaded (or module support is disabled, in which case i915
is already compiled-in anyway).

Fixes: f9b54e1961c7 ("ALSA: hda/i915: Allow delayed i915 audio component binding")
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/hda/hdac_i915.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
index 27eb0270a711f..3847fe841d33b 100644
--- a/sound/hda/hdac_i915.c
+++ b/sound/hda/hdac_i915.c
@@ -143,10 +143,12 @@ int snd_hdac_i915_init(struct hdac_bus *bus)
 	if (!acomp)
 		return -ENODEV;
 	if (!acomp->ops) {
-		request_module("i915");
-		/* 60s timeout */
-		wait_for_completion_timeout(&bind_complete,
-					    msecs_to_jiffies(60 * 1000));
+		if (!IS_ENABLED(CONFIG_MODULES) ||
+		    !request_module("i915")) {
+			/* 60s timeout */
+			wait_for_completion_timeout(&bind_complete,
+						   msecs_to_jiffies(60 * 1000));
+		}
 	}
 	if (!acomp->ops) {
 		dev_info(bus->dev, "couldn't bind with audio component\n");
-- 
GitLab


From beb0cc781b8e07d4bf89b6be2bf6e7ff7fe8b7ff Mon Sep 17 00:00:00 2001
From: Yang Shi <yang.shi@linux.alibaba.com>
Date: Fri, 2 Aug 2019 21:48:44 -0700
Subject: [PATCH 1336/1835] mm: vmscan: check if mem cgroup is disabled or not
 before calling memcg slab shrinker

commit fa1e512fac717f34e7c12d7a384c46e90a647392 upstream.

Shakeel Butt reported premature oom on kernel with
"cgroup_disable=memory" since mem_cgroup_is_root() returns false even
though memcg is actually NULL.  The drop_caches is also broken.

It is because commit aeed1d325d42 ("mm/vmscan.c: generalize
shrink_slab() calls in shrink_node()") removed the !memcg check before
!mem_cgroup_is_root().  And, surprisingly root memcg is allocated even
though memory cgroup is disabled by kernel boot parameter.

Add mem_cgroup_disabled() check to make reclaimer work as expected.

Link: http://lkml.kernel.org/r/1563385526-20805-1-git-send-email-yang.shi@linux.alibaba.com
Fixes: aeed1d325d42 ("mm/vmscan.c: generalize shrink_slab() calls in shrink_node()")
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Reported-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Jan Hadrava <had@kam.mff.cuni.cz>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Roman Gushchin <guro@fb.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Qian Cai <cai@lca.pw>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org>	[4.19+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/vmscan.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 576379e874214..b37610c0eac62 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -670,7 +670,14 @@ static unsigned long shrink_slab(gfp_t gfp_mask, int nid,
 	unsigned long ret, freed = 0;
 	struct shrinker *shrinker;
 
-	if (!mem_cgroup_is_root(memcg))
+	/*
+	 * The root memcg might be allocated even though memcg is disabled
+	 * via "cgroup_disable=memory" boot parameter.  This could make
+	 * mem_cgroup_is_root() return false, then just run memcg slab
+	 * shrink, but skip global shrink.  This may result in premature
+	 * oom.
+	 */
+	if (!mem_cgroup_disabled() && !mem_cgroup_is_root(memcg))
 		return shrink_slab_memcg(gfp_mask, nid, memcg, priority);
 
 	if (!down_read_trylock(&shrinker_rwsem))
-- 
GitLab


From 6cb9e0d9ad3e6b079bc0b95a154e86b82c4aada9 Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Thu, 1 Aug 2019 13:06:30 +0200
Subject: [PATCH 1337/1835] s390/dasd: fix endless loop after read unit address
 configuration

commit 41995342b40c418a47603e1321256d2c4a2ed0fb upstream.

After getting a storage server event that causes the DASD device driver
to update its unit address configuration during a device shutdown there is
the possibility of an endless loop in the device driver.

In the system log there will be ongoing DASD error messages with RC: -19.

The reason is that the loop starting the ruac request only terminates when
the retry counter is decreased to 0. But in the sleep_on function there are
early exit paths that do not decrease the retry counter.

Prevent an endless loop by handling those cases separately.

Remove the unnecessary do..while loop since the sleep_on function takes
care of retries by itself.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org # 2.6.25+
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/block/dasd_alias.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index b9ce93e9df892..99f86612f7751 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -383,6 +383,20 @@ suborder_not_supported(struct dasd_ccw_req *cqr)
 	char msg_format;
 	char msg_no;
 
+	/*
+	 * intrc values ENODEV, ENOLINK and EPERM
+	 * will be optained from sleep_on to indicate that no
+	 * IO operation can be started
+	 */
+	if (cqr->intrc == -ENODEV)
+		return 1;
+
+	if (cqr->intrc == -ENOLINK)
+		return 1;
+
+	if (cqr->intrc == -EPERM)
+		return 1;
+
 	sense = dasd_get_sense(&cqr->irb);
 	if (!sense)
 		return 0;
@@ -447,12 +461,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
 	lcu->flags &= ~NEED_UAC_UPDATE;
 	spin_unlock_irqrestore(&lcu->lock, flags);
 
-	do {
-		rc = dasd_sleep_on(cqr);
-		if (rc && suborder_not_supported(cqr))
-			return -EOPNOTSUPP;
-	} while (rc && (cqr->retries > 0));
-	if (rc) {
+	rc = dasd_sleep_on(cqr);
+	if (rc && !suborder_not_supported(cqr)) {
 		spin_lock_irqsave(&lcu->lock, flags);
 		lcu->flags |= NEED_UAC_UPDATE;
 		spin_unlock_irqrestore(&lcu->lock, flags);
-- 
GitLab


From 001f93d95d6c2432e397c48a68e80adfbfaba2a3 Mon Sep 17 00:00:00 2001
From: Chris Down <chris@chrisdown.name>
Date: Fri, 2 Aug 2019 21:49:15 -0700
Subject: [PATCH 1338/1835] cgroup: kselftest: relax fs_spec checks

commit b59b1baab789eacdde809135542e3d4f256f6878 upstream.

On my laptop most memcg kselftests were being skipped because it claimed
cgroup v2 hierarchy wasn't mounted, but this isn't correct.  Instead, it
seems current systemd HEAD mounts it with the name "cgroup2" instead of
"cgroup":

    % grep cgroup /proc/mounts
    cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0

I can't think of a reason to need to check fs_spec explicitly
since it's arbitrary, so we can just rely on fs_vfstype.

After these changes, `make TARGETS=cgroup kselftest` actually runs the
cgroup v2 tests in more cases.

Link: http://lkml.kernel.org/r/20190723210737.GA487@chrisdown.name
Signed-off-by: Chris Down <chris@chrisdown.name>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/cgroup/cgroup_util.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c
index 14c9fe2848062..075cb0c730149 100644
--- a/tools/testing/selftests/cgroup/cgroup_util.c
+++ b/tools/testing/selftests/cgroup/cgroup_util.c
@@ -181,8 +181,7 @@ int cg_find_unified_root(char *root, size_t len)
 		strtok(NULL, delim);
 		strtok(NULL, delim);
 
-		if (strcmp(fs, "cgroup") == 0 &&
-		    strcmp(type, "cgroup2") == 0) {
+		if (strcmp(type, "cgroup2") == 0) {
 			strncpy(root, mount, len);
 			return 0;
 		}
-- 
GitLab


From 5f80ac50b98caa092122c31f1efca1d708ad4661 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 1 Aug 2019 13:33:39 +0200
Subject: [PATCH 1339/1835] parisc: Fix build of compressed kernel even with
 debug enabled

commit 3fe6c873af2f2247544debdbe51ec29f690a2ccf upstream.

With debug info enabled (CONFIG_DEBUG_INFO=y) the resulting vmlinux may get
that huge that we need to increase the start addresss for the decompression
text section otherwise one will face a linker error.

Reported-by: Sven Schnelle <svens@stackframe.org>
Tested-by: Sven Schnelle <svens@stackframe.org>
Cc: stable@vger.kernel.org # v4.14+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/boot/compressed/vmlinux.lds.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/parisc/boot/compressed/vmlinux.lds.S b/arch/parisc/boot/compressed/vmlinux.lds.S
index 4ebd4e65524cd..41ebe97fad109 100644
--- a/arch/parisc/boot/compressed/vmlinux.lds.S
+++ b/arch/parisc/boot/compressed/vmlinux.lds.S
@@ -42,8 +42,8 @@ SECTIONS
 #endif
 	_startcode_end = .;
 
-	/* bootloader code and data starts behind area of extracted kernel */
-	. = (SZ_end - SZparisc_kernel_start + KERNEL_BINARY_TEXT_START);
+	/* bootloader code and data starts at least behind area of extracted kernel */
+	. = MAX(ABSOLUTE(.), (SZ_end - SZparisc_kernel_start + KERNEL_BINARY_TEXT_START));
 
 	/* align on next page boundary */
 	. = ALIGN(4096);
-- 
GitLab


From c385cda0e70a565f7b3d93e2f665ea7b691ec937 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Mon, 29 Jul 2019 11:43:48 +0100
Subject: [PATCH 1340/1835] drivers/perf: arm_pmu: Fix failure path in PM
 notifier

commit 0d7fd70f26039bd4b33444ca47f0e69ce3ae0354 upstream.

Handling of the CPU_PM_ENTER_FAILED transition in the Arm PMU PM
notifier code incorrectly skips restoration of the counters. Fix the
logic so that CPU_PM_ENTER_FAILED follows the same path as CPU_PM_EXIT.

Cc: <stable@vger.kernel.org>
Fixes: da4e4f18afe0f372 ("drivers/perf: arm_pmu: implement CPU_PM notifier")
Reported-by: Anders Roxell <anders.roxell@linaro.org>
Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/perf/arm_pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index d0b7dd8fb184b..77995df7fe547 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -730,8 +730,8 @@ static int cpu_pm_pmu_notify(struct notifier_block *b, unsigned long cmd,
 		cpu_pm_pmu_setup(armpmu, cmd);
 		break;
 	case CPU_PM_EXIT:
-		cpu_pm_pmu_setup(armpmu, cmd);
 	case CPU_PM_ENTER_FAILED:
+		cpu_pm_pmu_setup(armpmu, cmd);
 		armpmu->start(armpmu);
 		break;
 	default:
-- 
GitLab


From 2bddc985656a9ccddf2d4b9399e587f14df3cd20 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Mon, 29 Jul 2019 11:06:17 +0100
Subject: [PATCH 1341/1835] arm64: compat: Allow single-byte watchpoints on all
 addresses

commit 849adec41203ac5837c40c2d7e08490ffdef3c2c upstream.

Commit d968d2b801d8 ("ARM: 7497/1: hw_breakpoint: allow single-byte
watchpoints on all addresses") changed the validation requirements for
hardware watchpoints on arch/arm/. Update our compat layer to implement
the same relaxation.

Cc: <stable@vger.kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/hw_breakpoint.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index 8c9644376326f..7c0611f5d2ce7 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -547,13 +547,14 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
 			/* Aligned */
 			break;
 		case 1:
-			/* Allow single byte watchpoint. */
-			if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1)
-				break;
 		case 2:
 			/* Allow halfword watchpoints and breakpoints. */
 			if (hw->ctrl.len == ARM_BREAKPOINT_LEN_2)
 				break;
+		case 3:
+			/* Allow single byte watchpoint. */
+			if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1)
+				break;
 		default:
 			return -EINVAL;
 		}
-- 
GitLab


From 8dfef0f442c7f83b9fecb6211cc519fceb7b018a Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Tue, 30 Jul 2019 15:40:20 +0100
Subject: [PATCH 1342/1835] arm64: cpufeature: Fix feature comparison for
 CTR_EL0.{CWG,ERG}

commit 147b9635e6347104b91f48ca9dca61eb0fbf2a54 upstream.

If CTR_EL0.{CWG,ERG} are 0b0000 then they must be interpreted to have
their architecturally maximum values, which defeats the use of
FTR_HIGHER_SAFE when sanitising CPU ID registers on heterogeneous
machines.

Introduce FTR_HIGHER_OR_ZERO_SAFE so that these fields effectively
saturate at zero.

Fixes: 3c739b571084 ("arm64: Keep track of CPU feature registers")
Cc: <stable@vger.kernel.org> # 4.4.x-
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/cpufeature.h | 7 ++++---
 arch/arm64/kernel/cpufeature.c      | 8 ++++++--
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 1717ba1db35dd..510f687d269a1 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -45,9 +45,10 @@
  */
 
 enum ftr_type {
-	FTR_EXACT,	/* Use a predefined safe value */
-	FTR_LOWER_SAFE,	/* Smaller value is safe */
-	FTR_HIGHER_SAFE,/* Bigger value is safe */
+	FTR_EXACT,			/* Use a predefined safe value */
+	FTR_LOWER_SAFE,			/* Smaller value is safe */
+	FTR_HIGHER_SAFE,		/* Bigger value is safe */
+	FTR_HIGHER_OR_ZERO_SAFE,	/* Bigger value is safe, but 0 is biggest */
 };
 
 #define FTR_STRICT	true	/* SANITY check strict matching required */
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 93f69d82225de..bce06083685dc 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -206,8 +206,8 @@ static const struct arm64_ftr_bits ftr_ctr[] = {
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RES1 */
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_DIC_SHIFT, 1, 1),
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_IDC_SHIFT, 1, 1),
-	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, CTR_CWG_SHIFT, 4, 0),
-	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, CTR_ERG_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, CTR_CWG_SHIFT, 4, 0),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, CTR_ERG_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_DMINLINE_SHIFT, 4, 1),
 	/*
 	 * Linux can handle differing I-cache policies. Userspace JITs will
@@ -449,6 +449,10 @@ static s64 arm64_ftr_safe_value(const struct arm64_ftr_bits *ftrp, s64 new,
 	case FTR_LOWER_SAFE:
 		ret = new < cur ? new : cur;
 		break;
+	case FTR_HIGHER_OR_ZERO_SAFE:
+		if (!cur || !new)
+			break;
+		/* Fallthrough */
 	case FTR_HIGHER_SAFE:
 		ret = new > cur ? new : cur;
 		break;
-- 
GitLab


From eb828241b491c5e970a583a306f1ab7fffc75624 Mon Sep 17 00:00:00 2001
From: Munehisa Kamata <kamatam@amazon.com>
Date: Wed, 31 Jul 2019 20:13:10 +0800
Subject: [PATCH 1343/1835] nbd: replace kill_bdev() with __invalidate_device()
 again

commit 2b5c8f0063e4b263cf2de82029798183cf85c320 upstream.

Commit abbbdf12497d ("replace kill_bdev() with __invalidate_device()")
once did this, but 29eaadc03649 ("nbd: stop using the bdev everywhere")
resurrected kill_bdev() and it has been there since then. So buffer_head
mappings still get killed on a server disconnection, and we can still
hit the BUG_ON on a filesystem on the top of the nbd device.

  EXT4-fs (nbd0): mounted filesystem with ordered data mode. Opts: (null)
  block nbd0: Receive control failed (result -32)
  block nbd0: shutting down sockets
  print_req_error: I/O error, dev nbd0, sector 66264 flags 3000
  EXT4-fs warning (device nbd0): htree_dirblock_to_tree:979: inode #2: lblock 0: comm ls: error -5 reading directory block
  print_req_error: I/O error, dev nbd0, sector 2264 flags 3000
  EXT4-fs error (device nbd0): __ext4_get_inode_loc:4690: inode #2: block 283: comm ls: unable to read itable block
  EXT4-fs error (device nbd0) in ext4_reserve_inode_write:5894: IO failure
  ------------[ cut here ]------------
  kernel BUG at fs/buffer.c:3057!
  invalid opcode: 0000 [#1] SMP PTI
  CPU: 7 PID: 40045 Comm: jbd2/nbd0-8 Not tainted 5.1.0-rc3+ #4
  Hardware name: Amazon EC2 m5.12xlarge/, BIOS 1.0 10/16/2017
  RIP: 0010:submit_bh_wbc+0x18b/0x190
  ...
  Call Trace:
   jbd2_write_superblock+0xf1/0x230 [jbd2]
   ? account_entity_enqueue+0xc5/0xf0
   jbd2_journal_update_sb_log_tail+0x94/0xe0 [jbd2]
   jbd2_journal_commit_transaction+0x12f/0x1d20 [jbd2]
   ? __switch_to_asm+0x40/0x70
   ...
   ? lock_timer_base+0x67/0x80
   kjournald2+0x121/0x360 [jbd2]
   ? remove_wait_queue+0x60/0x60
   kthread+0xf8/0x130
   ? commit_timeout+0x10/0x10 [jbd2]
   ? kthread_bind+0x10/0x10
   ret_from_fork+0x35/0x40

With __invalidate_device(), I no longer hit the BUG_ON with sync or
unmount on the disconnected device.

Fixes: 29eaadc03649 ("nbd: stop using the bdev everywhere")
Cc: linux-block@vger.kernel.org
Cc: Ratna Manoj Bolla <manoj.br@gmail.com>
Cc: nbd@other.debian.org
Cc: stable@vger.kernel.org
Cc: David Woodhouse <dwmw@amazon.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Munehisa Kamata <kamatam@amazon.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/nbd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index c13a6d1796a77..fa60f265ee506 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1218,7 +1218,7 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
 				 struct block_device *bdev)
 {
 	sock_shutdown(nbd);
-	kill_bdev(bdev);
+	__invalidate_device(bdev, true);
 	nbd_bdev_reset(bdev);
 	if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
 			       &nbd->config->runtime_flags))
-- 
GitLab


From 04fdca1f2f65660267eea5eebd294a15dc3b6a9d Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 14 Jun 2019 07:46:02 +0200
Subject: [PATCH 1344/1835] xen/swiotlb: fix condition for calling
 xen_destroy_contiguous_region()

commit 50f6393f9654c561df4cdcf8e6cfba7260143601 upstream.

The condition in xen_swiotlb_free_coherent() for deciding whether to
call xen_destroy_contiguous_region() is wrong: in case the region to
be freed is not contiguous calling xen_destroy_contiguous_region() is
the wrong thing to do: it would result in inconsistent mappings of
multiple PFNs to the same MFN. This will lead to various strange
crashes or data corruption.

Instead of calling xen_destroy_contiguous_region() in that case a
warning should be issued as that situation should never occur.

Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/swiotlb-xen.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index aa081f8067283..3d9997595d900 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -357,8 +357,8 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
 	/* Convert the size to actually allocated. */
 	size = 1UL << (order + XEN_PAGE_SHIFT);
 
-	if (((dev_addr + size - 1 <= dma_mask)) ||
-	    range_straddles_page_boundary(phys, size))
+	if (!WARN_ON((dev_addr + size - 1 > dma_mask) ||
+		     range_straddles_page_boundary(phys, size)))
 		xen_destroy_contiguous_region(phys, order);
 
 	xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs);
-- 
GitLab


From 41be1928053a8cdc4e1a2fc4820d313425a0da4a Mon Sep 17 00:00:00 2001
From: Yishai Hadas <yishaih@mellanox.com>
Date: Tue, 23 Jul 2019 09:57:25 +0300
Subject: [PATCH 1345/1835] IB/mlx5: Fix unreg_umr to ignore the mkey state

commit 6a053953739d23694474a5f9c81d1a30093da81a upstream.

Fix unreg_umr to ignore the mkey state and do not fail if was freed.  This
prevents a case that a user space application already changed the mkey
state to free and then the UMR operation will fail leaving the mkey in an
inappropriate state.

Link: https://lore.kernel.org/r/20190723065733.4899-3-leon@kernel.org
Cc: <stable@vger.kernel.org> # 3.19
Fixes: 968e78dd9644 ("IB/mlx5: Enhance UMR support to allow partial page table update")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/mlx5_ib.h |  1 +
 drivers/infiniband/hw/mlx5/mr.c      |  4 ++--
 drivers/infiniband/hw/mlx5/qp.c      | 12 ++++++++----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 320d4dfe8c2f4..941d1df54631a 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -467,6 +467,7 @@ struct mlx5_umr_wr {
 	u64				length;
 	int				access_flags;
 	u32				mkey;
+	u8				ignore_free_state:1;
 };
 
 static inline const struct mlx5_umr_wr *umr_wr(const struct ib_send_wr *wr)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 7df4a4fe4af47..84cde889199bc 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1407,10 +1407,10 @@ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 	if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
 		return 0;
 
-	umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR |
-			      MLX5_IB_SEND_UMR_FAIL_IF_FREE;
+	umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR;
 	umrwr.wr.opcode = MLX5_IB_WR_UMR;
 	umrwr.mkey = mr->mmkey.key;
+	umrwr.ignore_free_state = 1;
 
 	return mlx5_ib_post_send_wait(dev, &umrwr);
 }
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 183fe5c8ceb77..93f7c884a14e6 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3717,10 +3717,14 @@ static int set_reg_umr_segment(struct mlx5_ib_dev *dev,
 
 	memset(umr, 0, sizeof(*umr));
 
-	if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
-		umr->flags = MLX5_UMR_CHECK_FREE; /* fail if free */
-	else
-		umr->flags = MLX5_UMR_CHECK_NOT_FREE; /* fail if not free */
+	if (!umrwr->ignore_free_state) {
+		if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
+			 /* fail if free */
+			umr->flags = MLX5_UMR_CHECK_FREE;
+		else
+			/* fail if not free */
+			umr->flags = MLX5_UMR_CHECK_NOT_FREE;
+	}
 
 	umr->xlt_octowords = cpu_to_be16(get_xlt_octo(umrwr->xlt_size));
 	if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_XLT) {
-- 
GitLab


From 3cfa1087a1729ad9380b85539c728fbd00334666 Mon Sep 17 00:00:00 2001
From: Yishai Hadas <yishaih@mellanox.com>
Date: Tue, 23 Jul 2019 09:57:26 +0300
Subject: [PATCH 1346/1835] IB/mlx5: Use direct mkey destroy command upon UMR
 unreg failure

commit afd1417404fba6dbfa6c0a8e5763bd348da682e4 upstream.

Use a direct firmware command to destroy the mkey in case the unreg UMR
operation has failed.

This prevents a case that a mkey will leak out from the cache post a
failure to be destroyed by a UMR WR.

In case the MR cache limit didn't reach a call to add another entry to the
cache instead of the destroyed one is issued.

In addition, replaced a warn message to WARN_ON() as this flow is fatal
and can't happen unless some bug around.

Link: https://lore.kernel.org/r/20190723065733.4899-4-leon@kernel.org
Cc: <stable@vger.kernel.org> # 4.10
Fixes: 49780d42dfc9 ("IB/mlx5: Expose MR cache for mlx5_ib")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/mr.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 84cde889199bc..c4198a73cdbe2 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -548,13 +548,16 @@ void mlx5_mr_cache_free(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 		return;
 
 	c = order2idx(dev, mr->order);
-	if (c < 0 || c >= MAX_MR_CACHE_ENTRIES) {
-		mlx5_ib_warn(dev, "order %d, cache index %d\n", mr->order, c);
-		return;
-	}
+	WARN_ON(c < 0 || c >= MAX_MR_CACHE_ENTRIES);
 
-	if (unreg_umr(dev, mr))
+	if (unreg_umr(dev, mr)) {
+		mr->allocated_from_cache = false;
+		destroy_mkey(dev, mr);
+		ent = &cache->ent[c];
+		if (ent->cur < ent->limit)
+			queue_work(cache->wq, &ent->work);
 		return;
+	}
 
 	ent = &cache->ent[c];
 	spin_lock_irq(&ent->lock);
-- 
GitLab


From 7e5ce9f3943c7341f101e2783f1e12df4647553c Mon Sep 17 00:00:00 2001
From: Yishai Hadas <yishaih@mellanox.com>
Date: Tue, 23 Jul 2019 09:57:27 +0300
Subject: [PATCH 1347/1835] IB/mlx5: Move MRs to a kernel PD when freeing them
 to the MR cache

commit 9ec4483a3f0f71a228a5933bc040441322bfb090 upstream.

Fix unreg_umr to move the MR to a kernel owned PD (i.e. the UMR PD) which
can't be accessed by userspace.

This ensures that nothing can continue to access the MR once it has been
placed in the kernels cache for reuse.

MRs in the cache continue to have their HW state, including DMA tables,
present. Even though the MR has been invalidated, changing the PD provides
an additional layer of protection against use of the MR.

Link: https://lore.kernel.org/r/20190723065733.4899-5-leon@kernel.org
Cc: <stable@vger.kernel.org> # 3.10
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/mr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index c4198a73cdbe2..397d938763c88 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1410,8 +1410,10 @@ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 	if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
 		return 0;
 
-	umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR;
+	umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR |
+			      MLX5_IB_SEND_UMR_UPDATE_PD_ACCESS;
 	umrwr.wr.opcode = MLX5_IB_WR_UMR;
+	umrwr.pd = dev->umrc.pd;
 	umrwr.mkey = mr->mmkey.key;
 	umrwr.ignore_free_state = 1;
 
-- 
GitLab


From 924308d2a6ea49bde4db326715ed5a6c584455dd Mon Sep 17 00:00:00 2001
From: Yishai Hadas <yishaih@mellanox.com>
Date: Tue, 23 Jul 2019 09:57:28 +0300
Subject: [PATCH 1348/1835] IB/mlx5: Fix clean_mr() to work in the expected
 order

commit b9332dad987018745a0c0bb718d12dacfa760489 upstream.

Any dma map underlying the MR should only be freed once the MR is fenced
at the hardware.

As of the above we first destroy the MKEY and just after that can safely
call to dma_unmap_single().

Link: https://lore.kernel.org/r/20190723065733.4899-6-leon@kernel.org
Cc: <stable@vger.kernel.org> # 4.3
Fixes: 8a187ee52b04 ("IB/mlx5: Support the new memory registration API")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/mr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 397d938763c88..9bab4fb65c688 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1620,10 +1620,10 @@ static void clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 		mr->sig = NULL;
 	}
 
-	mlx5_free_priv_descs(mr);
-
-	if (!allocated_from_cache)
+	if (!allocated_from_cache) {
 		destroy_mkey(dev, mr);
+		mlx5_free_priv_descs(mr);
+	}
 }
 
 static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
-- 
GitLab


From e9cd4962a85bee33e9ca25295277706a7d32c377 Mon Sep 17 00:00:00 2001
From: Yishai Hadas <yishaih@mellanox.com>
Date: Tue, 23 Jul 2019 09:57:29 +0300
Subject: [PATCH 1349/1835] IB/mlx5: Fix RSS Toeplitz setup to be aligned with
 the HW specification

commit b7165bd0d6cbb93732559be6ea8774653b204480 upstream.

The specification for the Toeplitz function doesn't require to set the key
explicitly to be symmetric. In case a symmetric functionality is required
a symmetric key can be simply used.

Wrongly forcing the algorithm to symmetric causes the wrong packet
distribution and a performance degradation.

Link: https://lore.kernel.org/r/20190723065733.4899-7-leon@kernel.org
Cc: <stable@vger.kernel.org> # 4.7
Fixes: 28d6137008b2 ("IB/mlx5: Add RSS QP support")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Alex Vainman <alexv@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 93f7c884a14e6..77b1f3fd086ad 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1501,7 +1501,6 @@ static int create_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
 		}
 
 		MLX5_SET(tirc, tirc, rx_hash_fn, MLX5_RX_HASH_FN_TOEPLITZ);
-		MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
 		memcpy(rss_key, ucmd.rx_hash_key, len);
 		break;
 	}
-- 
GitLab


From a1c020ce266925bafa1b1956c34c6dfe48268734 Mon Sep 17 00:00:00 2001
From: John Fleck <john.fleck@intel.com>
Date: Mon, 15 Jul 2019 12:45:21 -0400
Subject: [PATCH 1350/1835] IB/hfi1: Check for error on call to
 alloc_rsm_map_table

commit cd48a82087231fdba0e77521102386c6ed0168d6 upstream.

The call to alloc_rsm_map_table does not check if the kmalloc fails.
Check for a NULL on alloc, and bail if it fails.

Fixes: 372cc85a13c9 ("IB/hfi1: Extract RSM map table init from QOS")
Link: https://lore.kernel.org/r/20190715164521.74174.27047.stgit@awfm-01.aw.intel.com
Cc: <stable@vger.kernel.org>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: John Fleck <john.fleck@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/hfi1/chip.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index d8eb4dc04d690..6aa5a8a242ffd 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -14586,7 +14586,7 @@ void hfi1_deinit_vnic_rsm(struct hfi1_devdata *dd)
 		clear_rcvctrl(dd, RCV_CTRL_RCV_RSM_ENABLE_SMASK);
 }
 
-static void init_rxe(struct hfi1_devdata *dd)
+static int init_rxe(struct hfi1_devdata *dd)
 {
 	struct rsm_map_table *rmt;
 	u64 val;
@@ -14595,6 +14595,9 @@ static void init_rxe(struct hfi1_devdata *dd)
 	write_csr(dd, RCV_ERR_MASK, ~0ull);
 
 	rmt = alloc_rsm_map_table(dd);
+	if (!rmt)
+		return -ENOMEM;
+
 	/* set up QOS, including the QPN map table */
 	init_qos(dd, rmt);
 	init_user_fecn_handling(dd, rmt);
@@ -14621,6 +14624,7 @@ static void init_rxe(struct hfi1_devdata *dd)
 	val |= ((4ull & RCV_BYPASS_HDR_SIZE_MASK) <<
 		RCV_BYPASS_HDR_SIZE_SHIFT);
 	write_csr(dd, RCV_BYPASS, val);
+	return 0;
 }
 
 static void init_other(struct hfi1_devdata *dd)
@@ -15163,7 +15167,10 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
 		goto bail_cleanup;
 
 	/* set initial RXE CSRs */
-	init_rxe(dd);
+	ret = init_rxe(dd);
+	if (ret)
+		goto bail_cleanup;
+
 	/* set initial TXE CSRs */
 	init_txe(dd);
 	/* set initial non-RXE, non-TXE CSRs */
-- 
GitLab


From a7340d31abacf60efb68b299829c85e171878eae Mon Sep 17 00:00:00 2001
From: Xiaolin Zhang <xiaolin.zhang@intel.com>
Date: Thu, 18 Jul 2019 01:10:24 +0800
Subject: [PATCH 1351/1835] drm/i915/gvt: fix incorrect cache entry for guest
 page mapping

commit 7366aeb77cd840f3edea02c65065d40affaa7f45 upstream.

GPU hang observed during the guest OCL conformance test which is caused
by THP GTT feature used durning the test.

It was observed the same GFN with different size (4K and 2M) requested
from the guest in GVT. So during the guest page dma map stage, it is
required to unmap first with orginal size and then remap again with
requested size.

Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
Cc: stable@vger.kernel.org
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Xiaolin Zhang <xiaolin.zhang@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/gvt/kvmgt.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 12e4203c06dbd..66abe061f07b0 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1741,6 +1741,18 @@ int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn,
 
 	entry = __gvt_cache_find_gfn(info->vgpu, gfn);
 	if (!entry) {
+		ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
+		if (ret)
+			goto err_unlock;
+
+		ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
+		if (ret)
+			goto err_unmap;
+	} else if (entry->size != size) {
+		/* the same gfn with different size: unmap and re-map */
+		gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size);
+		__gvt_cache_remove_entry(vgpu, entry);
+
 		ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
 		if (ret)
 			goto err_unlock;
-- 
GitLab


From 8dd376273fb42934b0e99f55d36dc95e3447f7cd Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de>
Date: Sun, 28 Jul 2019 18:41:38 +0200
Subject: [PATCH 1352/1835] eeprom: at24: make spd world-readable again

commit 25e5ef302c24a6fead369c0cfe88c073d7b97ca8 upstream.

The integration of the at24 driver into the nvmem framework broke the
world-readability of spd EEPROMs. Fix it.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: stable@vger.kernel.org
Fixes: 57d155506dd5 ("eeprom: at24: extend driver to plug into the NVMEM framework")
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Bartosz Golaszewski <brgl@bgdev.pl>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
[Bartosz: backported to v4.19.y]
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/eeprom/at24.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index ddfcf4ade7bf3..dc3537651b807 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -724,7 +724,7 @@ static int at24_probe(struct i2c_client *client)
 	nvmem_config.name = dev_name(dev);
 	nvmem_config.dev = dev;
 	nvmem_config.read_only = !writable;
-	nvmem_config.root_only = true;
+	nvmem_config.root_only = !(pdata.flags & AT24_FLAG_IRUGO);
 	nvmem_config.owner = THIS_MODULE;
 	nvmem_config.compat = true;
 	nvmem_config.base_dev = dev;
-- 
GitLab


From 89f3896b658b1f8c4d4c1e0933f833ea0e1dcdd5 Mon Sep 17 00:00:00 2001
From: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
Date: Thu, 14 Feb 2019 18:07:45 +0300
Subject: [PATCH 1353/1835] ARC: enable uboot support unconditionally

commit 493a2f812446e92bcb1e69a77381b4d39808d730 upstream.

After reworking U-boot args handling code and adding paranoid
arguments check we can eliminate CONFIG_ARC_UBOOT_SUPPORT and
enable uboot support unconditionally.

For JTAG case we can assume that core registers will come up
reset value of 0 or in worst case we rely on user passing
'-on=clear_regs' to Metaware debugger.

Cc: stable@vger.kernel.org
Tested-by: Corentin LABBE <clabbe@baylibre.com>
Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/Kconfig                        | 13 -------------
 arch/arc/configs/nps_defconfig          |  1 -
 arch/arc/configs/vdk_hs38_defconfig     |  1 -
 arch/arc/configs/vdk_hs38_smp_defconfig |  2 --
 arch/arc/kernel/head.S                  |  2 --
 arch/arc/kernel/setup.c                 |  2 --
 6 files changed, 21 deletions(-)

diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 74953e76a57d5..0cce54182cc57 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -199,7 +199,6 @@ config NR_CPUS
 
 config ARC_SMP_HALT_ON_RESET
 	bool "Enable Halt-on-reset boot mode"
-	default y if ARC_UBOOT_SUPPORT
 	help
 	  In SMP configuration cores can be configured as Halt-on-reset
 	  or they could all start at same time. For Halt-on-reset, non
@@ -539,18 +538,6 @@ config ARC_DBG_TLB_PARANOIA
 
 endif
 
-config ARC_UBOOT_SUPPORT
-	bool "Support uboot arg Handling"
-	default n
-	help
-	  ARC Linux by default checks for uboot provided args as pointers to
-	  external cmdline or DTB. This however breaks in absence of uboot,
-	  when booting from Metaware debugger directly, as the registers are
-	  not zeroed out on reset by mdb and/or ARCv2 based cores. The bogus
-	  registers look like uboot args to kernel which then chokes.
-	  So only enable the uboot arg checking/processing if users are sure
-	  of uboot being in play.
-
 config ARC_BUILTIN_DTB_NAME
 	string "Built in DTB"
 	help
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index 6e84060e7c90a..621f59407d769 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -31,7 +31,6 @@ CONFIG_ARC_CACHE_LINE_SHIFT=5
 # CONFIG_ARC_HAS_LLSC is not set
 CONFIG_ARC_KVADDR_SIZE=402
 CONFIG_ARC_EMUL_UNALIGNED=y
-CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_PREEMPT=y
 CONFIG_NET=y
 CONFIG_UNIX=y
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index 1e59a2e9c602f..e447ace6fa1ca 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -13,7 +13,6 @@ CONFIG_PARTITION_ADVANCED=y
 CONFIG_ARC_PLAT_AXS10X=y
 CONFIG_AXS103=y
 CONFIG_ISA_ARCV2=y
-CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38"
 CONFIG_PREEMPT=y
 CONFIG_NET=y
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index b5c3f6c54b032..c82cdb10aaf4f 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -15,8 +15,6 @@ CONFIG_AXS103=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 # CONFIG_ARC_TIMERS_64BIT is not set
-# CONFIG_ARC_SMP_HALT_ON_RESET is not set
-CONFIG_ARC_UBOOT_SUPPORT=y
 CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38_smp"
 CONFIG_PREEMPT=y
 CONFIG_NET=y
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 208bf2c9e7b0d..a72bbda2f7aad 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -100,7 +100,6 @@ ENTRY(stext)
 	st.ab   0, [r5, 4]
 1:
 
-#ifdef CONFIG_ARC_UBOOT_SUPPORT
 	; Uboot - kernel ABI
 	;    r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
 	;    r1 = magic number (always zero as of now)
@@ -109,7 +108,6 @@ ENTRY(stext)
 	st	r0, [@uboot_tag]
 	st      r1, [@uboot_magic]
 	st	r2, [@uboot_arg]
-#endif
 
 	; setup "current" tsk and optionally cache it in dedicated r25
 	mov	r9, @init_task
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index a1218937abd68..89c97dcfa3602 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -493,7 +493,6 @@ void __init handle_uboot_args(void)
 	bool use_embedded_dtb = true;
 	bool append_cmdline = false;
 
-#ifdef CONFIG_ARC_UBOOT_SUPPORT
 	/* check that we know this tag */
 	if (uboot_tag != UBOOT_TAG_NONE &&
 	    uboot_tag != UBOOT_TAG_CMDLINE &&
@@ -525,7 +524,6 @@ void __init handle_uboot_args(void)
 		append_cmdline = true;
 
 ignore_uboot_args:
-#endif
 
 	if (use_embedded_dtb) {
 		machine_desc = setup_machine_fdt(__dtb_start);
-- 
GitLab


From 354887ae31689ce2b9e8eb556e4ea4954d9fe809 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Wed, 31 Oct 2018 21:57:30 -0500
Subject: [PATCH 1354/1835] objtool: Support GCC 9 cold subfunction naming
 scheme

commit bcb6fb5da77c2a228adf07cc9cb1a0c2aa2001c6 upstream.

Starting with GCC 8, a lot of unlikely code was moved out of line to
"cold" subfunctions in .text.unlikely.

For example, the unlikely bits of:

  irq_do_set_affinity()

are moved out to the following subfunction:

  irq_do_set_affinity.cold.49()

Starting with GCC 9, the numbered suffix has been removed.  So in the
above example, the cold subfunction is instead:

  irq_do_set_affinity.cold()

Tweak the objtool subfunction detection logic so that it detects both
GCC 8 and GCC 9 naming schemes.

Reported-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/015e9544b1f188d36a7f02fa31e9e95629aa5f50.1541040800.git.jpoimboe@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/objtool/elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index abed594a9653b..b8f3cca8e58b4 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -305,7 +305,7 @@ static int read_symbols(struct elf *elf)
 			if (sym->type != STT_FUNC)
 				continue;
 			sym->pfunc = sym->cfunc = sym;
-			coldstr = strstr(sym->name, ".cold.");
+			coldstr = strstr(sym->name, ".cold");
 			if (!coldstr)
 				continue;
 
-- 
GitLab


From 8320768d26aa1c68bdea02a1303c71a4e46a702e Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 1 May 2019 11:20:53 -0700
Subject: [PATCH 1355/1835] gcc-9: properly declare the {pv,hv}clock_page
 storage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 459e3a21535ae3c7a9a123650e54f5c882b8fcbf upstream.

The pvlock_page and hvclock_page variables are (as the name implies)
addresses to pages, created by the linker script.

But we declared them as just "extern u8" variables, which _works_, but
now that gcc does some more bounds checking, it causes warnings like

    warning: array subscript 1 is outside array bounds of ‘u8[1]’

when we then access more than one byte from those variables.

Fix this by simply making the declaration of the variables match
reality, which makes the compiler happy too.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/entry/vdso/vclock_gettime.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
index e48ca3afa0912..86bb256039e78 100644
--- a/arch/x86/entry/vdso/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vclock_gettime.c
@@ -29,12 +29,12 @@ extern int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz);
 extern time_t __vdso_time(time_t *t);
 
 #ifdef CONFIG_PARAVIRT_CLOCK
-extern u8 pvclock_page
+extern u8 pvclock_page[PAGE_SIZE]
 	__attribute__((visibility("hidden")));
 #endif
 
 #ifdef CONFIG_HYPERV_TSCPAGE
-extern u8 hvclock_page
+extern u8 hvclock_page[PAGE_SIZE]
 	__attribute__((visibility("hidden")));
 #endif
 
-- 
GitLab


From 3732a473be54b1eee65100b79d2d80c382f7e742 Mon Sep 17 00:00:00 2001
From: Andy Lutomirski <luto@kernel.org>
Date: Fri, 21 Jun 2019 08:43:04 -0700
Subject: [PATCH 1356/1835] x86/vdso: Prevent segfaults due to hoisted vclock
 reads

commit ff17bbe0bb405ad8b36e55815d381841f9fdeebc upstream.

GCC 5.5.0 sometimes cleverly hoists reads of the pvclock and/or hvclock
pages before the vclock mode checks.  This creates a path through
vclock_gettime() in which no vclock is enabled at all (due to disabled
TSC on old CPUs, for example) but the pvclock or hvclock page
nevertheless read.  This will segfault on bare metal.

This fixes commit 459e3a21535a ("gcc-9: properly declare the
{pv,hv}clock_page storage") in the sense that, before that commit, GCC
didn't seem to generate the offending code.  There was nothing wrong
with that commit per se, and -stable maintainers should backport this to
all supported kernels regardless of whether the offending commit was
present, since the same crash could just as easily be triggered by the
phase of the moon.

On GCC 9.1.1, this doesn't seem to affect the generated code at all, so
I'm not too concerned about performance regressions from this fix.

Cc: stable@vger.kernel.org
Cc: x86@kernel.org
Cc: Borislav Petkov <bp@alien8.de>
Reported-by: Duncan Roe <duncan_roe@optusnet.com.au>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/entry/vdso/vclock_gettime.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
index 86bb256039e78..8a88e738f87db 100644
--- a/arch/x86/entry/vdso/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vclock_gettime.c
@@ -191,13 +191,24 @@ notrace static inline u64 vgetsns(int *mode)
 
 	if (gtod->vclock_mode == VCLOCK_TSC)
 		cycles = vread_tsc();
+
+	/*
+	 * For any memory-mapped vclock type, we need to make sure that gcc
+	 * doesn't cleverly hoist a load before the mode check.  Otherwise we
+	 * might end up touching the memory-mapped page even if the vclock in
+	 * question isn't enabled, which will segfault.  Hence the barriers.
+	 */
 #ifdef CONFIG_PARAVIRT_CLOCK
-	else if (gtod->vclock_mode == VCLOCK_PVCLOCK)
+	else if (gtod->vclock_mode == VCLOCK_PVCLOCK) {
+		barrier();
 		cycles = vread_pvclock(mode);
+	}
 #endif
 #ifdef CONFIG_HYPERV_TSCPAGE
-	else if (gtod->vclock_mode == VCLOCK_HVCLOCK)
+	else if (gtod->vclock_mode == VCLOCK_HVCLOCK) {
+		barrier();
 		cycles = vread_hvclock(mode);
+	}
 #endif
 	else
 		return 0;
-- 
GitLab


From 9e034c61951acdc1378d936875641fcb61b6a7a3 Mon Sep 17 00:00:00 2001
From: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
Date: Tue, 30 Jul 2019 03:43:57 -0400
Subject: [PATCH 1357/1835] scsi: mpt3sas: Use 63-bit DMA addressing on SAS35
 HBA

commit df9a606184bfdb5ae3ca9d226184e9489f5c24f7 upstream.

Although SAS3 & SAS3.5 IT HBA controllers support 64-bit DMA addressing, as
per hardware design, if DMA-able range contains all 64-bits
set (0xFFFFFFFF-FFFFFFFF) then it results in a firmware fault.

E.g. SGE's start address is 0xFFFFFFFF-FFFF000 and data length is 0x1000
bytes. when HBA tries to DMA the data at 0xFFFFFFFF-FFFFFFFF location then
HBA will fault the firmware.

Driver will set 63-bit DMA mask to ensure the above address will not be
used.

Cc: <stable@vger.kernel.org> # 4.19.63
Signed-off-by: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 8776330175e34..d2ab52026014f 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2565,12 +2565,14 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
 {
 	struct sysinfo s;
 	u64 consistent_dma_mask;
+	/* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
+	int dma_mask = (ioc->hba_mpi_version_belonged > MPI2_VERSION) ? 63 : 64;
 
 	if (ioc->is_mcpu_endpoint)
 		goto try_32bit;
 
 	if (ioc->dma_mask)
-		consistent_dma_mask = DMA_BIT_MASK(64);
+		consistent_dma_mask = DMA_BIT_MASK(dma_mask);
 	else
 		consistent_dma_mask = DMA_BIT_MASK(32);
 
@@ -2578,11 +2580,11 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
 		const uint64_t required_mask =
 		    dma_get_required_mask(&pdev->dev);
 		if ((required_mask > DMA_BIT_MASK(32)) &&
-		    !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
+		    !pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_mask)) &&
 		    !pci_set_consistent_dma_mask(pdev, consistent_dma_mask)) {
 			ioc->base_add_sg_single = &_base_add_sg_single_64;
 			ioc->sge_size = sizeof(Mpi2SGESimple64_t);
-			ioc->dma_mask = 64;
+			ioc->dma_mask = dma_mask;
 			goto out;
 		}
 	}
@@ -2609,7 +2611,7 @@ static int
 _base_change_consistent_dma_mask(struct MPT3SAS_ADAPTER *ioc,
 				      struct pci_dev *pdev)
 {
-	if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+	if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(ioc->dma_mask))) {
 		if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)))
 			return -ENODEV;
 	}
@@ -4545,7 +4547,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc)
 		total_sz += sz;
 	} while (ioc->rdpq_array_enable && (++i < ioc->reply_queue_count));
 
-	if (ioc->dma_mask == 64) {
+	if (ioc->dma_mask > 32) {
 		if (_base_change_consistent_dma_mask(ioc, ioc->pdev) != 0) {
 			pr_warn(MPT3SAS_FMT
 			    "no suitable consistent DMA mask for %s\n",
-- 
GitLab


From 16ad0b63f382a16454cb927f2eb45b32dbb71b94 Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Wed, 19 Jun 2019 17:24:34 +0200
Subject: [PATCH 1358/1835] x86/cpufeatures: Carve out CQM features retrieval

commit 45fc56e629caa451467e7664fbd4c797c434a6c4 upstream

... into a separate function for better readability. Split out from a
patch from Fenghua Yu <fenghua.yu@intel.com> to keep the mechanical,
sole code movement separate for easy review.

No functional changes.

Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: x86@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/common.c | 60 ++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 27 deletions(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 1073118b9bf03..a315e475e4845 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -808,6 +808,38 @@ static void init_speculation_control(struct cpuinfo_x86 *c)
 	}
 }
 
+static void init_cqm(struct cpuinfo_x86 *c)
+{
+	u32 eax, ebx, ecx, edx;
+
+	/* Additional Intel-defined flags: level 0x0000000F */
+	if (c->cpuid_level >= 0x0000000F) {
+
+		/* QoS sub-leaf, EAX=0Fh, ECX=0 */
+		cpuid_count(0x0000000F, 0, &eax, &ebx, &ecx, &edx);
+		c->x86_capability[CPUID_F_0_EDX] = edx;
+
+		if (cpu_has(c, X86_FEATURE_CQM_LLC)) {
+			/* will be overridden if occupancy monitoring exists */
+			c->x86_cache_max_rmid = ebx;
+
+			/* QoS sub-leaf, EAX=0Fh, ECX=1 */
+			cpuid_count(0x0000000F, 1, &eax, &ebx, &ecx, &edx);
+			c->x86_capability[CPUID_F_1_EDX] = edx;
+
+			if ((cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC)) ||
+			      ((cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL)) ||
+			       (cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)))) {
+				c->x86_cache_max_rmid = ecx;
+				c->x86_cache_occ_scale = ebx;
+			}
+		} else {
+			c->x86_cache_max_rmid = -1;
+			c->x86_cache_occ_scale = -1;
+		}
+	}
+}
+
 void get_cpu_cap(struct cpuinfo_x86 *c)
 {
 	u32 eax, ebx, ecx, edx;
@@ -839,33 +871,6 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
 		c->x86_capability[CPUID_D_1_EAX] = eax;
 	}
 
-	/* Additional Intel-defined flags: level 0x0000000F */
-	if (c->cpuid_level >= 0x0000000F) {
-
-		/* QoS sub-leaf, EAX=0Fh, ECX=0 */
-		cpuid_count(0x0000000F, 0, &eax, &ebx, &ecx, &edx);
-		c->x86_capability[CPUID_F_0_EDX] = edx;
-
-		if (cpu_has(c, X86_FEATURE_CQM_LLC)) {
-			/* will be overridden if occupancy monitoring exists */
-			c->x86_cache_max_rmid = ebx;
-
-			/* QoS sub-leaf, EAX=0Fh, ECX=1 */
-			cpuid_count(0x0000000F, 1, &eax, &ebx, &ecx, &edx);
-			c->x86_capability[CPUID_F_1_EDX] = edx;
-
-			if ((cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC)) ||
-			      ((cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL)) ||
-			       (cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)))) {
-				c->x86_cache_max_rmid = ecx;
-				c->x86_cache_occ_scale = ebx;
-			}
-		} else {
-			c->x86_cache_max_rmid = -1;
-			c->x86_cache_occ_scale = -1;
-		}
-	}
-
 	/* AMD-defined flags: level 0x80000001 */
 	eax = cpuid_eax(0x80000000);
 	c->extended_cpuid_level = eax;
@@ -896,6 +901,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
 
 	init_scattered_cpuid_features(c);
 	init_speculation_control(c);
+	init_cqm(c);
 
 	/*
 	 * Clear/Set all flags overridden by options, after probe.
-- 
GitLab


From b5dd7f61fce44a1d5df5c63ce7bcb9e0a05ce2f7 Mon Sep 17 00:00:00 2001
From: Fenghua Yu <fenghua.yu@intel.com>
Date: Wed, 19 Jun 2019 18:51:09 +0200
Subject: [PATCH 1359/1835] x86/cpufeatures: Combine word 11 and 12 into a new
 scattered features word
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit acec0ce081de0c36459eea91647faf99296445a3 upstream

It's a waste for the four X86_FEATURE_CQM_* feature bits to occupy two
whole feature bits words. To better utilize feature words, re-define
word 11 to host scattered features and move the four X86_FEATURE_CQM_*
features into Linux defined word 11. More scattered features can be
added in word 11 in the future.

Rename leaf 11 in cpuid_leafs to CPUID_LNX_4 to reflect it's a
Linux-defined leaf.

Rename leaf 12 as CPUID_DUMMY which will be replaced by a meaningful
name in the next patch when CPUID.7.1:EAX occupies world 12.

Maximum number of RMID and cache occupancy scale are retrieved from
CPUID.0xf.1 after scattered CQM features are enumerated. Carve out the
code into a separate function.

KVM doesn't support resctrl now. So it's safe to move the
X86_FEATURE_CQM_* features to scattered features word 11 for KVM.

Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Aaron Lewis <aaronlewis@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Babu Moger <babu.moger@amd.com>
Cc: "Chang S. Bae" <chang.seok.bae@intel.com>
Cc: "Sean J Christopherson" <sean.j.christopherson@intel.com>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: kvm ML <kvm@vger.kernel.org>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Nadav Amit <namit@vmware.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
Cc: Peter Feiner <pfeiner@google.com>
Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Cc: Ravi V Shankar <ravi.v.shankar@intel.com>
Cc: Sherry Hurwitz <sherry.hurwitz@amd.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
Cc: x86 <x86@kernel.org>
Link: https://lkml.kernel.org/r/1560794416-217638-2-git-send-email-fenghua.yu@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/cpufeature.h  |  4 ++--
 arch/x86/include/asm/cpufeatures.h | 17 +++++++------
 arch/x86/kernel/cpu/common.c       | 38 ++++++++++++------------------
 arch/x86/kernel/cpu/cpuid-deps.c   |  3 +++
 arch/x86/kernel/cpu/scattered.c    |  4 ++++
 arch/x86/kvm/cpuid.h               |  2 --
 6 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index ce95b8cbd2296..68889ace9c4c6 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -22,8 +22,8 @@ enum cpuid_leafs
 	CPUID_LNX_3,
 	CPUID_7_0_EBX,
 	CPUID_D_1_EAX,
-	CPUID_F_0_EDX,
-	CPUID_F_1_EDX,
+	CPUID_LNX_4,
+	CPUID_DUMMY,
 	CPUID_8000_0008_EBX,
 	CPUID_6_EAX,
 	CPUID_8000_000A_EDX,
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 0cf704933f237..5041f19918f2e 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -271,13 +271,16 @@
 #define X86_FEATURE_XGETBV1		(10*32+ 2) /* XGETBV with ECX = 1 instruction */
 #define X86_FEATURE_XSAVES		(10*32+ 3) /* XSAVES/XRSTORS instructions */
 
-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (EDX), word 11 */
-#define X86_FEATURE_CQM_LLC		(11*32+ 1) /* LLC QoS if 1 */
-
-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (EDX), word 12 */
-#define X86_FEATURE_CQM_OCCUP_LLC	(12*32+ 0) /* LLC occupancy monitoring */
-#define X86_FEATURE_CQM_MBM_TOTAL	(12*32+ 1) /* LLC Total MBM monitoring */
-#define X86_FEATURE_CQM_MBM_LOCAL	(12*32+ 2) /* LLC Local MBM monitoring */
+/*
+ * Extended auxiliary flags: Linux defined - for features scattered in various
+ * CPUID levels like 0xf, etc.
+ *
+ * Reuse free bits when adding new feature flags!
+ */
+#define X86_FEATURE_CQM_LLC		(11*32+ 0) /* LLC QoS if 1 */
+#define X86_FEATURE_CQM_OCCUP_LLC	(11*32+ 1) /* LLC occupancy monitoring */
+#define X86_FEATURE_CQM_MBM_TOTAL	(11*32+ 2) /* LLC Total MBM monitoring */
+#define X86_FEATURE_CQM_MBM_LOCAL	(11*32+ 3) /* LLC Local MBM monitoring */
 
 /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
 #define X86_FEATURE_CLZERO		(13*32+ 0) /* CLZERO instruction */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index a315e475e4845..417d09f2bcaf0 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -810,33 +810,25 @@ static void init_speculation_control(struct cpuinfo_x86 *c)
 
 static void init_cqm(struct cpuinfo_x86 *c)
 {
-	u32 eax, ebx, ecx, edx;
-
-	/* Additional Intel-defined flags: level 0x0000000F */
-	if (c->cpuid_level >= 0x0000000F) {
+	if (!cpu_has(c, X86_FEATURE_CQM_LLC)) {
+		c->x86_cache_max_rmid  = -1;
+		c->x86_cache_occ_scale = -1;
+		return;
+	}
 
-		/* QoS sub-leaf, EAX=0Fh, ECX=0 */
-		cpuid_count(0x0000000F, 0, &eax, &ebx, &ecx, &edx);
-		c->x86_capability[CPUID_F_0_EDX] = edx;
+	/* will be overridden if occupancy monitoring exists */
+	c->x86_cache_max_rmid = cpuid_ebx(0xf);
 
-		if (cpu_has(c, X86_FEATURE_CQM_LLC)) {
-			/* will be overridden if occupancy monitoring exists */
-			c->x86_cache_max_rmid = ebx;
+	if (cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC) ||
+	    cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL) ||
+	    cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)) {
+		u32 eax, ebx, ecx, edx;
 
-			/* QoS sub-leaf, EAX=0Fh, ECX=1 */
-			cpuid_count(0x0000000F, 1, &eax, &ebx, &ecx, &edx);
-			c->x86_capability[CPUID_F_1_EDX] = edx;
+		/* QoS sub-leaf, EAX=0Fh, ECX=1 */
+		cpuid_count(0xf, 1, &eax, &ebx, &ecx, &edx);
 
-			if ((cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC)) ||
-			      ((cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL)) ||
-			       (cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)))) {
-				c->x86_cache_max_rmid = ecx;
-				c->x86_cache_occ_scale = ebx;
-			}
-		} else {
-			c->x86_cache_max_rmid = -1;
-			c->x86_cache_occ_scale = -1;
-		}
+		c->x86_cache_max_rmid  = ecx;
+		c->x86_cache_occ_scale = ebx;
 	}
 }
 
diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c
index 2c0bd38a44ab1..fa07a224e7b98 100644
--- a/arch/x86/kernel/cpu/cpuid-deps.c
+++ b/arch/x86/kernel/cpu/cpuid-deps.c
@@ -59,6 +59,9 @@ static const struct cpuid_dep cpuid_deps[] = {
 	{ X86_FEATURE_AVX512_4VNNIW,	X86_FEATURE_AVX512F   },
 	{ X86_FEATURE_AVX512_4FMAPS,	X86_FEATURE_AVX512F   },
 	{ X86_FEATURE_AVX512_VPOPCNTDQ, X86_FEATURE_AVX512F   },
+	{ X86_FEATURE_CQM_OCCUP_LLC,	X86_FEATURE_CQM_LLC   },
+	{ X86_FEATURE_CQM_MBM_TOTAL,	X86_FEATURE_CQM_LLC   },
+	{ X86_FEATURE_CQM_MBM_LOCAL,	X86_FEATURE_CQM_LLC   },
 	{}
 };
 
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index 772c219b68898..5a52672e3f8ba 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -21,6 +21,10 @@ struct cpuid_bit {
 static const struct cpuid_bit cpuid_bits[] = {
 	{ X86_FEATURE_APERFMPERF,       CPUID_ECX,  0, 0x00000006, 0 },
 	{ X86_FEATURE_EPB,		CPUID_ECX,  3, 0x00000006, 0 },
+	{ X86_FEATURE_CQM_LLC,		CPUID_EDX,  1, 0x0000000f, 0 },
+	{ X86_FEATURE_CQM_OCCUP_LLC,	CPUID_EDX,  0, 0x0000000f, 1 },
+	{ X86_FEATURE_CQM_MBM_TOTAL,	CPUID_EDX,  1, 0x0000000f, 1 },
+	{ X86_FEATURE_CQM_MBM_LOCAL,	CPUID_EDX,  2, 0x0000000f, 1 },
 	{ X86_FEATURE_CAT_L3,		CPUID_EBX,  1, 0x00000010, 0 },
 	{ X86_FEATURE_CAT_L2,		CPUID_EBX,  2, 0x00000010, 0 },
 	{ X86_FEATURE_CDP_L3,		CPUID_ECX,  2, 0x00000010, 1 },
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index 9a327d5b6d1f5..d78a61408243f 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -47,8 +47,6 @@ static const struct cpuid_reg reverse_cpuid[] = {
 	[CPUID_8000_0001_ECX] = {0x80000001, 0, CPUID_ECX},
 	[CPUID_7_0_EBX]       = {         7, 0, CPUID_EBX},
 	[CPUID_D_1_EAX]       = {       0xd, 1, CPUID_EAX},
-	[CPUID_F_0_EDX]       = {       0xf, 0, CPUID_EDX},
-	[CPUID_F_1_EDX]       = {       0xf, 1, CPUID_EDX},
 	[CPUID_8000_0008_EBX] = {0x80000008, 0, CPUID_EBX},
 	[CPUID_6_EAX]         = {         6, 0, CPUID_EAX},
 	[CPUID_8000_000A_EDX] = {0x8000000a, 0, CPUID_EDX},
-- 
GitLab


From befb822c062b4c3d93380a58d5fd479395e8b267 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Mon, 8 Jul 2019 11:52:25 -0500
Subject: [PATCH 1360/1835] x86/speculation: Prepare entry code for Spectre v1
 swapgs mitigations

commit 18ec54fdd6d18d92025af097cd042a75cf0ea24c upstream

Spectre v1 isn't only about array bounds checks.  It can affect any
conditional checks.  The kernel entry code interrupt, exception, and NMI
handlers all have conditional swapgs checks.  Those may be problematic in
the context of Spectre v1, as kernel code can speculatively run with a user
GS.

For example:

	if (coming from user space)
		swapgs
	mov %gs:<percpu_offset>, %reg
	mov (%reg), %reg1

When coming from user space, the CPU can speculatively skip the swapgs, and
then do a speculative percpu load using the user GS value.  So the user can
speculatively force a read of any kernel value.  If a gadget exists which
uses the percpu value as an address in another load/store, then the
contents of the kernel value may become visible via an L1 side channel
attack.

A similar attack exists when coming from kernel space.  The CPU can
speculatively do the swapgs, causing the user GS to get used for the rest
of the speculative window.

The mitigation is similar to a traditional Spectre v1 mitigation, except:

  a) index masking isn't possible; because the index (percpu offset)
     isn't user-controlled; and

  b) an lfence is needed in both the "from user" swapgs path and the
     "from kernel" non-swapgs path (because of the two attacks described
     above).

The user entry swapgs paths already have SWITCH_TO_KERNEL_CR3, which has a
CR3 write when PTI is enabled.  Since CR3 writes are serializing, the
lfences can be skipped in those cases.

On the other hand, the kernel entry swapgs paths don't depend on PTI.

To avoid unnecessary lfences for the user entry case, create two separate
features for alternative patching:

  X86_FEATURE_FENCE_SWAPGS_USER
  X86_FEATURE_FENCE_SWAPGS_KERNEL

Use these features in entry code to patch in lfences where needed.

The features aren't enabled yet, so there's no functional change.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/entry/calling.h           | 17 +++++++++++++++++
 arch/x86/entry/entry_64.S          | 21 ++++++++++++++++++---
 arch/x86/include/asm/cpufeatures.h |  2 ++
 3 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index e699b20416653..578b5455334f0 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -329,6 +329,23 @@ For 32-bit we have the following conventions - kernel is built with
 
 #endif
 
+/*
+ * Mitigate Spectre v1 for conditional swapgs code paths.
+ *
+ * FENCE_SWAPGS_USER_ENTRY is used in the user entry swapgs code path, to
+ * prevent a speculative swapgs when coming from kernel space.
+ *
+ * FENCE_SWAPGS_KERNEL_ENTRY is used in the kernel entry non-swapgs code path,
+ * to prevent the swapgs from getting speculatively skipped when coming from
+ * user space.
+ */
+.macro FENCE_SWAPGS_USER_ENTRY
+	ALTERNATIVE "", "lfence", X86_FEATURE_FENCE_SWAPGS_USER
+.endm
+.macro FENCE_SWAPGS_KERNEL_ENTRY
+	ALTERNATIVE "", "lfence", X86_FEATURE_FENCE_SWAPGS_KERNEL
+.endm
+
 #endif /* CONFIG_X86_64 */
 
 /*
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index e7572a209fbe7..7d8da285e1850 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -582,7 +582,7 @@ ENTRY(interrupt_entry)
 	testb	$3, CS-ORIG_RAX+8(%rsp)
 	jz	1f
 	SWAPGS
-
+	FENCE_SWAPGS_USER_ENTRY
 	/*
 	 * Switch to the thread stack. The IRET frame and orig_ax are
 	 * on the stack, as well as the return address. RDI..R12 are
@@ -612,8 +612,10 @@ ENTRY(interrupt_entry)
 	UNWIND_HINT_FUNC
 
 	movq	(%rdi), %rdi
+	jmpq	2f
 1:
-
+	FENCE_SWAPGS_KERNEL_ENTRY
+2:
 	PUSH_AND_CLEAR_REGS save_ret=1
 	ENCODE_FRAME_POINTER 8
 
@@ -1240,6 +1242,13 @@ ENTRY(paranoid_entry)
 	 */
 	SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14
 
+	/*
+	 * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an
+	 * unconditional CR3 write, even in the PTI case.  So do an lfence
+	 * to prevent GS speculation, regardless of whether PTI is enabled.
+	 */
+	FENCE_SWAPGS_KERNEL_ENTRY
+
 	ret
 END(paranoid_entry)
 
@@ -1290,6 +1299,7 @@ ENTRY(error_entry)
 	 * from user mode due to an IRET fault.
 	 */
 	SWAPGS
+	FENCE_SWAPGS_USER_ENTRY
 	/* We have user CR3.  Change to kernel CR3. */
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
 
@@ -1311,6 +1321,8 @@ ENTRY(error_entry)
 	CALL_enter_from_user_mode
 	ret
 
+.Lerror_entry_done_lfence:
+	FENCE_SWAPGS_KERNEL_ENTRY
 .Lerror_entry_done:
 	TRACE_IRQS_OFF
 	ret
@@ -1329,7 +1341,7 @@ ENTRY(error_entry)
 	cmpq	%rax, RIP+8(%rsp)
 	je	.Lbstep_iret
 	cmpq	$.Lgs_change, RIP+8(%rsp)
-	jne	.Lerror_entry_done
+	jne	.Lerror_entry_done_lfence
 
 	/*
 	 * hack: .Lgs_change can fail with user gsbase.  If this happens, fix up
@@ -1337,6 +1349,7 @@ ENTRY(error_entry)
 	 * .Lgs_change's error handler with kernel gsbase.
 	 */
 	SWAPGS
+	FENCE_SWAPGS_USER_ENTRY
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
 	jmp .Lerror_entry_done
 
@@ -1351,6 +1364,7 @@ ENTRY(error_entry)
 	 * gsbase and CR3.  Switch to kernel gsbase and CR3:
 	 */
 	SWAPGS
+	FENCE_SWAPGS_USER_ENTRY
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
 
 	/*
@@ -1442,6 +1456,7 @@ ENTRY(nmi)
 
 	swapgs
 	cld
+	FENCE_SWAPGS_USER_ENTRY
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdx
 	movq	%rsp, %rdx
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 5041f19918f2e..e0f47f6a1017f 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -281,6 +281,8 @@
 #define X86_FEATURE_CQM_OCCUP_LLC	(11*32+ 1) /* LLC occupancy monitoring */
 #define X86_FEATURE_CQM_MBM_TOTAL	(11*32+ 2) /* LLC Total MBM monitoring */
 #define X86_FEATURE_CQM_MBM_LOCAL	(11*32+ 3) /* LLC Local MBM monitoring */
+#define X86_FEATURE_FENCE_SWAPGS_USER	(11*32+ 4) /* "" LFENCE in user entry SWAPGS path */
+#define X86_FEATURE_FENCE_SWAPGS_KERNEL	(11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */
 
 /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
 #define X86_FEATURE_CLZERO		(13*32+ 0) /* CLZERO instruction */
-- 
GitLab


From 23e7a7b3a75f6dd24c161bf7d1399f251bf5c109 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Mon, 8 Jul 2019 11:52:26 -0500
Subject: [PATCH 1361/1835] x86/speculation: Enable Spectre v1 swapgs
 mitigations

commit a2059825986a1c8143fd6698774fa9d83733bb11 upstream

The previous commit added macro calls in the entry code which mitigate the
Spectre v1 swapgs issue if the X86_FEATURE_FENCE_SWAPGS_* features are
enabled.  Enable those features where applicable.

The mitigations may be disabled with "nospectre_v1" or "mitigations=off".

There are different features which can affect the risk of attack:

- When FSGSBASE is enabled, unprivileged users are able to place any
  value in GS, using the wrgsbase instruction.  This means they can
  write a GS value which points to any value in kernel space, which can
  be useful with the following gadget in an interrupt/exception/NMI
  handler:

	if (coming from user space)
		swapgs
	mov %gs:<percpu_offset>, %reg1
	// dependent load or store based on the value of %reg
	// for example: mov %(reg1), %reg2

  If an interrupt is coming from user space, and the entry code
  speculatively skips the swapgs (due to user branch mistraining), it
  may speculatively execute the GS-based load and a subsequent dependent
  load or store, exposing the kernel data to an L1 side channel leak.

  Note that, on Intel, a similar attack exists in the above gadget when
  coming from kernel space, if the swapgs gets speculatively executed to
  switch back to the user GS.  On AMD, this variant isn't possible
  because swapgs is serializing with respect to future GS-based
  accesses.

  NOTE: The FSGSBASE patch set hasn't been merged yet, so the above case
	doesn't exist quite yet.

- When FSGSBASE is disabled, the issue is mitigated somewhat because
  unprivileged users must use prctl(ARCH_SET_GS) to set GS, which
  restricts GS values to user space addresses only.  That means the
  gadget would need an additional step, since the target kernel address
  needs to be read from user space first.  Something like:

	if (coming from user space)
		swapgs
	mov %gs:<percpu_offset>, %reg1
	mov (%reg1), %reg2
	// dependent load or store based on the value of %reg2
	// for example: mov %(reg2), %reg3

  It's difficult to audit for this gadget in all the handlers, so while
  there are no known instances of it, it's entirely possible that it
  exists somewhere (or could be introduced in the future).  Without
  tooling to analyze all such code paths, consider it vulnerable.

  Effects of SMAP on the !FSGSBASE case:

  - If SMAP is enabled, and the CPU reports RDCL_NO (i.e., not
    susceptible to Meltdown), the kernel is prevented from speculatively
    reading user space memory, even L1 cached values.  This effectively
    disables the !FSGSBASE attack vector.

  - If SMAP is enabled, but the CPU *is* susceptible to Meltdown, SMAP
    still prevents the kernel from speculatively reading user space
    memory.  But it does *not* prevent the kernel from reading the
    user value from L1, if it has already been cached.  This is probably
    only a small hurdle for an attacker to overcome.

Thanks to Dave Hansen for contributing the speculative_smap() function.

Thanks to Andrew Cooper for providing the inside scoop on whether swapgs
is serializing on AMD.

[ tglx: Fixed the USER fence decision and polished the comment as suggested
  	by Dave Hansen ]

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../admin-guide/kernel-parameters.txt         |   7 +-
 arch/x86/kernel/cpu/bugs.c                    | 115 ++++++++++++++++--
 2 files changed, 110 insertions(+), 12 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 1cee1174cde6e..c96a8e9ad5c2e 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2515,6 +2515,7 @@
 				Equivalent to: nopti [X86,PPC]
 					       nospectre_v1 [PPC]
 					       nobp=0 [S390]
+					       nospectre_v1 [X86]
 					       nospectre_v2 [X86,PPC,S390]
 					       spectre_v2_user=off [X86]
 					       spec_store_bypass_disable=off [X86,PPC]
@@ -2861,9 +2862,9 @@
 			nosmt=force: Force disable SMT, cannot be undone
 				     via the sysfs control file.
 
-	nospectre_v1	[PPC] Disable mitigations for Spectre Variant 1 (bounds
-			check bypass). With this option data leaks are possible
-			in the system.
+	nospectre_v1	[X66, PPC] Disable mitigations for Spectre Variant 1
+			(bounds check bypass). With this option data leaks
+			are possible in the system.
 
 	nospectre_v2	[X86,PPC_FSL_BOOK3E] Disable all mitigations for the Spectre variant 2
 			(indirect branch prediction) vulnerability. System may
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index c5690440fbd41..844ad5d3ef516 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -32,6 +32,7 @@
 #include <asm/e820/api.h>
 #include <asm/hypervisor.h>
 
+static void __init spectre_v1_select_mitigation(void);
 static void __init spectre_v2_select_mitigation(void);
 static void __init ssb_select_mitigation(void);
 static void __init l1tf_select_mitigation(void);
@@ -96,17 +97,11 @@ void __init check_bugs(void)
 	if (boot_cpu_has(X86_FEATURE_STIBP))
 		x86_spec_ctrl_mask |= SPEC_CTRL_STIBP;
 
-	/* Select the proper spectre mitigation before patching alternatives */
+	/* Select the proper CPU mitigations before patching alternatives: */
+	spectre_v1_select_mitigation();
 	spectre_v2_select_mitigation();
-
-	/*
-	 * Select proper mitigation for any exposure to the Speculative Store
-	 * Bypass vulnerability.
-	 */
 	ssb_select_mitigation();
-
 	l1tf_select_mitigation();
-
 	mds_select_mitigation();
 
 	arch_smt_update();
@@ -271,6 +266,108 @@ static int __init mds_cmdline(char *str)
 }
 early_param("mds", mds_cmdline);
 
+#undef pr_fmt
+#define pr_fmt(fmt)     "Spectre V1 : " fmt
+
+enum spectre_v1_mitigation {
+	SPECTRE_V1_MITIGATION_NONE,
+	SPECTRE_V1_MITIGATION_AUTO,
+};
+
+static enum spectre_v1_mitigation spectre_v1_mitigation __ro_after_init =
+	SPECTRE_V1_MITIGATION_AUTO;
+
+static const char * const spectre_v1_strings[] = {
+	[SPECTRE_V1_MITIGATION_NONE] = "Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers",
+	[SPECTRE_V1_MITIGATION_AUTO] = "Mitigation: usercopy/swapgs barriers and __user pointer sanitization",
+};
+
+static bool is_swapgs_serializing(void)
+{
+	/*
+	 * Technically, swapgs isn't serializing on AMD (despite it previously
+	 * being documented as such in the APM).  But according to AMD, %gs is
+	 * updated non-speculatively, and the issuing of %gs-relative memory
+	 * operands will be blocked until the %gs update completes, which is
+	 * good enough for our purposes.
+	 */
+	return boot_cpu_data.x86_vendor == X86_VENDOR_AMD;
+}
+
+/*
+ * Does SMAP provide full mitigation against speculative kernel access to
+ * userspace?
+ */
+static bool smap_works_speculatively(void)
+{
+	if (!boot_cpu_has(X86_FEATURE_SMAP))
+		return false;
+
+	/*
+	 * On CPUs which are vulnerable to Meltdown, SMAP does not
+	 * prevent speculative access to user data in the L1 cache.
+	 * Consider SMAP to be non-functional as a mitigation on these
+	 * CPUs.
+	 */
+	if (boot_cpu_has(X86_BUG_CPU_MELTDOWN))
+		return false;
+
+	return true;
+}
+
+static void __init spectre_v1_select_mitigation(void)
+{
+	if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1) || cpu_mitigations_off()) {
+		spectre_v1_mitigation = SPECTRE_V1_MITIGATION_NONE;
+		return;
+	}
+
+	if (spectre_v1_mitigation == SPECTRE_V1_MITIGATION_AUTO) {
+		/*
+		 * With Spectre v1, a user can speculatively control either
+		 * path of a conditional swapgs with a user-controlled GS
+		 * value.  The mitigation is to add lfences to both code paths.
+		 *
+		 * If FSGSBASE is enabled, the user can put a kernel address in
+		 * GS, in which case SMAP provides no protection.
+		 *
+		 * [ NOTE: Don't check for X86_FEATURE_FSGSBASE until the
+		 *	   FSGSBASE enablement patches have been merged. ]
+		 *
+		 * If FSGSBASE is disabled, the user can only put a user space
+		 * address in GS.  That makes an attack harder, but still
+		 * possible if there's no SMAP protection.
+		 */
+		if (!smap_works_speculatively()) {
+			/*
+			 * Mitigation can be provided from SWAPGS itself or
+			 * PTI as the CR3 write in the Meltdown mitigation
+			 * is serializing.
+			 *
+			 * If neither is there, mitigate with an LFENCE.
+			 */
+			if (!is_swapgs_serializing() && !boot_cpu_has(X86_FEATURE_PTI))
+				setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_USER);
+
+			/*
+			 * Enable lfences in the kernel entry (non-swapgs)
+			 * paths, to prevent user entry from speculatively
+			 * skipping swapgs.
+			 */
+			setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_KERNEL);
+		}
+	}
+
+	pr_info("%s\n", spectre_v1_strings[spectre_v1_mitigation]);
+}
+
+static int __init nospectre_v1_cmdline(char *str)
+{
+	spectre_v1_mitigation = SPECTRE_V1_MITIGATION_NONE;
+	return 0;
+}
+early_param("nospectre_v1", nospectre_v1_cmdline);
+
 #undef pr_fmt
 #define pr_fmt(fmt)     "Spectre V2 : " fmt
 
@@ -1258,7 +1355,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 		break;
 
 	case X86_BUG_SPECTRE_V1:
-		return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+		return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
 
 	case X86_BUG_SPECTRE_V2:
 		return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
-- 
GitLab


From 931b6bfe8af1069fd1a494ef6ab14509ffeacdc3 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Mon, 15 Jul 2019 11:51:39 -0500
Subject: [PATCH 1362/1835] x86/entry/64: Use JMP instead of JMPQ

commit 64dbc122b20f75183d8822618c24f85144a5a94d upstream

Somehow the swapgs mitigation entry code patch ended up with a JMPQ
instruction instead of JMP, where only the short jump is needed.  Some
assembler versions apparently fail to optimize JMPQ into a two-byte JMP
when possible, instead always using a 7-byte JMP with relocation.  For
some reason that makes the entry code explode with a #GP during boot.

Change it back to "JMP" as originally intended.

Fixes: 18ec54fdd6d1 ("x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations")
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/entry/entry_64.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 7d8da285e1850..ccb5e3486aee7 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -612,7 +612,7 @@ ENTRY(interrupt_entry)
 	UNWIND_HINT_FUNC
 
 	movq	(%rdi), %rdi
-	jmpq	2f
+	jmp	2f
 1:
 	FENCE_SWAPGS_KERNEL_ENTRY
 2:
-- 
GitLab


From b88241aef6f1654417bb281546da316ffab57807 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 17 Jul 2019 21:18:59 +0200
Subject: [PATCH 1363/1835] x86/speculation/swapgs: Exclude ATOMs from
 speculation through SWAPGS

commit f36cf386e3fec258a341d446915862eded3e13d8 upstream

Intel provided the following information:

 On all current Atom processors, instructions that use a segment register
 value (e.g. a load or store) will not speculatively execute before the
 last writer of that segment retires. Thus they will not use a
 speculatively written segment value.

That means on ATOMs there is no speculation through SWAPGS, so the SWAPGS
entry paths can be excluded from the extra LFENCE if PTI is disabled.

Create a separate bug flag for the through SWAPGS speculation and mark all
out-of-order ATOMs and AMD/HYGON CPUs as not affected. The in-order ATOMs
are excluded from the whole mitigation mess anyway.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/cpufeatures.h |  1 +
 arch/x86/kernel/cpu/bugs.c         | 18 +++----------
 arch/x86/kernel/cpu/common.c       | 42 +++++++++++++++++++-----------
 3 files changed, 32 insertions(+), 29 deletions(-)

diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index e0f47f6a1017f..759f0a1766124 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -388,5 +388,6 @@
 #define X86_BUG_L1TF			X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
 #define X86_BUG_MDS			X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
 #define X86_BUG_MSBDS_ONLY		X86_BUG(20) /* CPU is only affected by the  MSDBS variant of BUG_MDS */
+#define X86_BUG_SWAPGS			X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
 
 #endif /* _ASM_X86_CPUFEATURES_H */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 844ad5d3ef516..ee7d17611ead4 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -282,18 +282,6 @@ static const char * const spectre_v1_strings[] = {
 	[SPECTRE_V1_MITIGATION_AUTO] = "Mitigation: usercopy/swapgs barriers and __user pointer sanitization",
 };
 
-static bool is_swapgs_serializing(void)
-{
-	/*
-	 * Technically, swapgs isn't serializing on AMD (despite it previously
-	 * being documented as such in the APM).  But according to AMD, %gs is
-	 * updated non-speculatively, and the issuing of %gs-relative memory
-	 * operands will be blocked until the %gs update completes, which is
-	 * good enough for our purposes.
-	 */
-	return boot_cpu_data.x86_vendor == X86_VENDOR_AMD;
-}
-
 /*
  * Does SMAP provide full mitigation against speculative kernel access to
  * userspace?
@@ -344,9 +332,11 @@ static void __init spectre_v1_select_mitigation(void)
 			 * PTI as the CR3 write in the Meltdown mitigation
 			 * is serializing.
 			 *
-			 * If neither is there, mitigate with an LFENCE.
+			 * If neither is there, mitigate with an LFENCE to
+			 * stop speculation through swapgs.
 			 */
-			if (!is_swapgs_serializing() && !boot_cpu_has(X86_FEATURE_PTI))
+			if (boot_cpu_has_bug(X86_BUG_SWAPGS) &&
+			    !boot_cpu_has(X86_FEATURE_PTI))
 				setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_USER);
 
 			/*
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 417d09f2bcaf0..b33fdfa0ff49e 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -952,6 +952,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
 #define NO_L1TF		BIT(3)
 #define NO_MDS		BIT(4)
 #define MSBDS_ONLY	BIT(5)
+#define NO_SWAPGS	BIT(6)
 
 #define VULNWL(_vendor, _family, _model, _whitelist)	\
 	{ X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
@@ -975,29 +976,37 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
 	VULNWL_INTEL(ATOM_BONNELL,		NO_SPECULATION),
 	VULNWL_INTEL(ATOM_BONNELL_MID,		NO_SPECULATION),
 
-	VULNWL_INTEL(ATOM_SILVERMONT,		NO_SSB | NO_L1TF | MSBDS_ONLY),
-	VULNWL_INTEL(ATOM_SILVERMONT_X,		NO_SSB | NO_L1TF | MSBDS_ONLY),
-	VULNWL_INTEL(ATOM_SILVERMONT_MID,	NO_SSB | NO_L1TF | MSBDS_ONLY),
-	VULNWL_INTEL(ATOM_AIRMONT,		NO_SSB | NO_L1TF | MSBDS_ONLY),
-	VULNWL_INTEL(XEON_PHI_KNL,		NO_SSB | NO_L1TF | MSBDS_ONLY),
-	VULNWL_INTEL(XEON_PHI_KNM,		NO_SSB | NO_L1TF | MSBDS_ONLY),
+	VULNWL_INTEL(ATOM_SILVERMONT,		NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+	VULNWL_INTEL(ATOM_SILVERMONT_X,		NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+	VULNWL_INTEL(ATOM_SILVERMONT_MID,	NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+	VULNWL_INTEL(ATOM_AIRMONT,		NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+	VULNWL_INTEL(XEON_PHI_KNL,		NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+	VULNWL_INTEL(XEON_PHI_KNM,		NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
 
 	VULNWL_INTEL(CORE_YONAH,		NO_SSB),
 
-	VULNWL_INTEL(ATOM_AIRMONT_MID,		NO_L1TF | MSBDS_ONLY),
+	VULNWL_INTEL(ATOM_AIRMONT_MID,		NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
 
-	VULNWL_INTEL(ATOM_GOLDMONT,		NO_MDS | NO_L1TF),
-	VULNWL_INTEL(ATOM_GOLDMONT_X,		NO_MDS | NO_L1TF),
-	VULNWL_INTEL(ATOM_GOLDMONT_PLUS,	NO_MDS | NO_L1TF),
+	VULNWL_INTEL(ATOM_GOLDMONT,		NO_MDS | NO_L1TF | NO_SWAPGS),
+	VULNWL_INTEL(ATOM_GOLDMONT_X,		NO_MDS | NO_L1TF | NO_SWAPGS),
+	VULNWL_INTEL(ATOM_GOLDMONT_PLUS,	NO_MDS | NO_L1TF | NO_SWAPGS),
+
+	/*
+	 * Technically, swapgs isn't serializing on AMD (despite it previously
+	 * being documented as such in the APM).  But according to AMD, %gs is
+	 * updated non-speculatively, and the issuing of %gs-relative memory
+	 * operands will be blocked until the %gs update completes, which is
+	 * good enough for our purposes.
+	 */
 
 	/* AMD Family 0xf - 0x12 */
-	VULNWL_AMD(0x0f,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
-	VULNWL_AMD(0x10,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
-	VULNWL_AMD(0x11,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
-	VULNWL_AMD(0x12,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
+	VULNWL_AMD(0x0f,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+	VULNWL_AMD(0x10,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+	VULNWL_AMD(0x11,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+	VULNWL_AMD(0x12,	NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
 
 	/* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
-	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS),
+	VULNWL_AMD(X86_FAMILY_ANY,	NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS),
 	{}
 };
 
@@ -1034,6 +1043,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 			setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
 	}
 
+	if (!cpu_matches(NO_SWAPGS))
+		setup_force_cpu_bug(X86_BUG_SWAPGS);
+
 	if (cpu_matches(NO_MELTDOWN))
 		return;
 
-- 
GitLab


From 7634b9cd27e8f867dd3438d262c78d4b9262497f Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Sat, 3 Aug 2019 21:21:54 +0200
Subject: [PATCH 1364/1835] Documentation: Add swapgs description to the
 Spectre v1 documentation

commit 4c92057661a3412f547ede95715641d7ee16ddac upstream

Add documentation to the Spectre document about the new swapgs variant of
Spectre v1.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/admin-guide/hw-vuln/spectre.rst | 88 +++++++++++++++++--
 1 file changed, 80 insertions(+), 8 deletions(-)

diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
index 25f3b25321985..e05e581af5cfe 100644
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -41,10 +41,11 @@ Related CVEs
 
 The following CVE entries describe Spectre variants:
 
-   =============   =======================  =================
+   =============   =======================  ==========================
    CVE-2017-5753   Bounds check bypass      Spectre variant 1
    CVE-2017-5715   Branch target injection  Spectre variant 2
-   =============   =======================  =================
+   CVE-2019-1125   Spectre v1 swapgs        Spectre variant 1 (swapgs)
+   =============   =======================  ==========================
 
 Problem
 -------
@@ -78,6 +79,13 @@ There are some extensions of Spectre variant 1 attacks for reading data
 over the network, see :ref:`[12] <spec_ref12>`. However such attacks
 are difficult, low bandwidth, fragile, and are considered low risk.
 
+Note that, despite "Bounds Check Bypass" name, Spectre variant 1 is not
+only about user-controlled array bounds checks.  It can affect any
+conditional checks.  The kernel entry code interrupt, exception, and NMI
+handlers all have conditional swapgs checks.  Those may be problematic
+in the context of Spectre v1, as kernel code can speculatively run with
+a user GS.
+
 Spectre variant 2 (Branch Target Injection)
 -------------------------------------------
 
@@ -132,6 +140,9 @@ not cover all possible attack vectors.
 1. A user process attacking the kernel
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
+Spectre variant 1
+~~~~~~~~~~~~~~~~~
+
    The attacker passes a parameter to the kernel via a register or
    via a known address in memory during a syscall. Such parameter may
    be used later by the kernel as an index to an array or to derive
@@ -144,7 +155,40 @@ not cover all possible attack vectors.
    potentially be influenced for Spectre attacks, new "nospec" accessor
    macros are used to prevent speculative loading of data.
 
-   Spectre variant 2 attacker can :ref:`poison <poison_btb>` the branch
+Spectre variant 1 (swapgs)
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+   An attacker can train the branch predictor to speculatively skip the
+   swapgs path for an interrupt or exception.  If they initialize
+   the GS register to a user-space value, if the swapgs is speculatively
+   skipped, subsequent GS-related percpu accesses in the speculation
+   window will be done with the attacker-controlled GS value.  This
+   could cause privileged memory to be accessed and leaked.
+
+   For example:
+
+   ::
+
+     if (coming from user space)
+         swapgs
+     mov %gs:<percpu_offset>, %reg
+     mov (%reg), %reg1
+
+   When coming from user space, the CPU can speculatively skip the
+   swapgs, and then do a speculative percpu load using the user GS
+   value.  So the user can speculatively force a read of any kernel
+   value.  If a gadget exists which uses the percpu value as an address
+   in another load/store, then the contents of the kernel value may
+   become visible via an L1 side channel attack.
+
+   A similar attack exists when coming from kernel space.  The CPU can
+   speculatively do the swapgs, causing the user GS to get used for the
+   rest of the speculative window.
+
+Spectre variant 2
+~~~~~~~~~~~~~~~~~
+
+   A spectre variant 2 attacker can :ref:`poison <poison_btb>` the branch
    target buffer (BTB) before issuing syscall to launch an attack.
    After entering the kernel, the kernel could use the poisoned branch
    target buffer on indirect jump and jump to gadget code in speculative
@@ -280,11 +324,18 @@ The sysfs file showing Spectre variant 1 mitigation status is:
 
 The possible values in this file are:
 
-  =======================================  =================================
-  'Mitigation: __user pointer sanitation'  Protection in kernel on a case by
-                                           case base with explicit pointer
-                                           sanitation.
-  =======================================  =================================
+  .. list-table::
+
+     * - 'Not affected'
+       - The processor is not vulnerable.
+     * - 'Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers'
+       - The swapgs protections are disabled; otherwise it has
+         protection in the kernel on a case by case base with explicit
+         pointer sanitation and usercopy LFENCE barriers.
+     * - 'Mitigation: usercopy/swapgs barriers and __user pointer sanitization'
+       - Protection in the kernel on a case by case base with explicit
+         pointer sanitation, usercopy LFENCE barriers, and swapgs LFENCE
+         barriers.
 
 However, the protections are put in place on a case by case basis,
 and there is no guarantee that all possible attack vectors for Spectre
@@ -366,12 +417,27 @@ Turning on mitigation for Spectre variant 1 and Spectre variant 2
 1. Kernel mitigation
 ^^^^^^^^^^^^^^^^^^^^
 
+Spectre variant 1
+~~~~~~~~~~~~~~~~~
+
    For the Spectre variant 1, vulnerable kernel code (as determined
    by code audit or scanning tools) is annotated on a case by case
    basis to use nospec accessor macros for bounds clipping :ref:`[2]
    <spec_ref2>` to avoid any usable disclosure gadgets. However, it may
    not cover all attack vectors for Spectre variant 1.
 
+   Copy-from-user code has an LFENCE barrier to prevent the access_ok()
+   check from being mis-speculated.  The barrier is done by the
+   barrier_nospec() macro.
+
+   For the swapgs variant of Spectre variant 1, LFENCE barriers are
+   added to interrupt, exception and NMI entry where needed.  These
+   barriers are done by the FENCE_SWAPGS_KERNEL_ENTRY and
+   FENCE_SWAPGS_USER_ENTRY macros.
+
+Spectre variant 2
+~~~~~~~~~~~~~~~~~
+
    For Spectre variant 2 mitigation, the compiler turns indirect calls or
    jumps in the kernel into equivalent return trampolines (retpolines)
    :ref:`[3] <spec_ref3>` :ref:`[9] <spec_ref9>` to go to the target
@@ -473,6 +539,12 @@ Mitigation control on the kernel command line
 Spectre variant 2 mitigation can be disabled or force enabled at the
 kernel command line.
 
+	nospectre_v1
+
+		[X86,PPC] Disable mitigations for Spectre Variant 1
+		(bounds check bypass). With this option data leaks are
+		possible in the system.
+
 	nospectre_v2
 
 		[X86] Disable all mitigations for the Spectre variant 2
-- 
GitLab


From cc4c818b2219c58af5f0ca59f3e9f02c48bc0b65 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 6 Aug 2019 19:06:58 +0200
Subject: [PATCH 1365/1835] Linux 4.19.65

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 97deee85e3f4a..41a565770431a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 64
+SUBLEVEL = 65
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 76b2727efaca513fe81b4ba56658ea2b9f9d0907 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 7 Aug 2019 11:31:08 +0100
Subject: [PATCH 1366/1835] drm/vc4: Add missing NULL check to
 vc4_crtc_consume_event

vc4_crtc_consume_event wasn't checking crtc->state->event was
set before dereferencing it, leading to an OOPS.

Fixes "a5b534b drm/vc4: Resolve the vblank warnings on mode switching"

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 357b497f19ae7..89ad71cff2bdf 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -969,6 +969,9 @@ static void vc4_crtc_consume_event(struct drm_crtc *crtc)
 	struct drm_device *dev = crtc->dev;
 	unsigned long flags;
 
+	if (!crtc->state->event)
+		return;
+
 	crtc->state->event->pipe = drm_crtc_index(crtc);
 
 	WARN_ON(drm_crtc_vblank_get(crtc) != 0);
-- 
GitLab


From dad4f188bf4f53052b87a9cfb77870cf8f660282 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 9 Aug 2019 08:52:16 +0100
Subject: [PATCH 1367/1835] Revert "net: bcmgenet: Workaround for Pi 4B network
 issue"

This reverts commit 9c0770ea7682a84a22c33410ef6870af258abacc.
---
 .../net/ethernet/broadcom/genet/bcmgenet.c    | 22 -------------------
 1 file changed, 22 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 582cfc7eb1d15..b02f33a2ff088 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -72,10 +72,6 @@
 #define GENET_RDMA_REG_OFF	(priv->hw_params->rdma_offset + \
 				TOTAL_DESC * DMA_DESC_SIZE)
 
-static bool force_reneg = false;
-module_param(force_reneg, bool, 0444);
-MODULE_PARM_DESC(force_reneg, "Force a renegotiation after the initial link-up");
-
 static inline void bcmgenet_writel(u32 value, void __iomem *offset)
 {
 	/* MIPS chips strapped for BE will automagically configure the
@@ -2614,7 +2610,6 @@ static void bcmgenet_irq_task(struct work_struct *work)
 	unsigned int status;
 	struct bcmgenet_priv *priv = container_of(
 			work, struct bcmgenet_priv, bcmgenet_irq_work);
-	static int first_link = 1;
 
 	netif_dbg(priv, intr, priv->dev, "%s\n", __func__);
 
@@ -2627,23 +2622,6 @@ static void bcmgenet_irq_task(struct work_struct *work)
 	if (status & UMAC_IRQ_LINK_EVENT) {
 		priv->dev->phydev->link = !!(status & UMAC_IRQ_LINK_UP);
 		phy_mac_interrupt(priv->dev->phydev);
-
-		if (priv->dev->phydev->link && first_link) {
-			first_link = 0;
-			/*
-			 * HACK: Some Pi4Bs, when paired with some switches,
-			 * come up in a strange state where they are unable to
-			 * transmit, causing them to fail to get an IP address.
-			 * Although the failure mechanism is not yet understood,
-			 * forcing renegotiation at this point has been shown
-			 * to be effective in avoiding the problem.
-			 */
-			if (force_reneg) {
-				dev_info(&priv->pdev->dev,
-					 "Forcing renegotiation\n");
-				genphy_restart_aneg(priv->dev->phydev);
-			}
-		}
 	}
 }
 
-- 
GitLab


From 02f18a908b8de64ffb2f18cc8acfd8892bc8b038 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 9 Aug 2019 08:51:43 +0100
Subject: [PATCH 1368/1835] net: bcmgenet: Workaround #2 for Pi4 Ethernet fail

Some combinations of Pi 4Bs and Ethernet switches don't reliably get a
DCHP-assigned IP address, leaving the unit with a self=assigned 169.254
address. In the failure case, the Pi is left able to receive packets
but not send them, suggesting that the MAC<->PHY link is getting into
a bad state.

It has been found empirically that skipping a reset step by the genet
driver prevents the failures. No downsides have been discovered yet,
and unlike the forced renegotiation it doesn't increase the time to
get an IP address, so the workaround is enabled by default; add

  genet.skip_umac_reset=n

to the command line to disable it.

See: https://github.com/raspberrypi/linux/issues/3108

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index b02f33a2ff088..251166dfb8a83 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -72,6 +72,10 @@
 #define GENET_RDMA_REG_OFF	(priv->hw_params->rdma_offset + \
 				TOTAL_DESC * DMA_DESC_SIZE)
 
+static bool skip_umac_reset = true;
+module_param(skip_umac_reset, bool, 0444);
+MODULE_PARM_DESC(skip_umac_reset, "Skip UMAC reset step");
+
 static inline void bcmgenet_writel(u32 value, void __iomem *offset)
 {
 	/* MIPS chips strapped for BE will automagically configure the
@@ -1993,6 +1997,11 @@ static void reset_umac(struct bcmgenet_priv *priv)
 	bcmgenet_rbuf_ctrl_set(priv, 0);
 	udelay(10);
 
+	if (skip_umac_reset) {
+		pr_warn("Skipping UMAC reset\n");
+		return;
+	}
+
 	/* disable MAC while updating its registers */
 	bcmgenet_umac_writel(priv, 0, UMAC_CMD);
 
-- 
GitLab


From 93d6f0841eef6304c13803a84588f00476b06a14 Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
Date: Wed, 24 Jul 2019 11:00:55 +0200
Subject: [PATCH 1369/1835] scsi: fcoe: Embed fc_rport_priv in fcoe_rport
 structure

commit 023358b136d490ca91735ac6490db3741af5a8bd upstream.

Gcc-9 complains for a memset across pointer boundaries, which happens as
the code tries to allocate a flexible array on the stack.  Turns out we
cannot do this without relying on gcc-isms, so with this patch we'll embed
the fc_rport_priv structure into fcoe_rport, can use the normal
'container_of' outcast, and will only have to do a memset over one
structure.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/fcoe/fcoe_ctlr.c | 51 ++++++++++++++---------------------
 drivers/scsi/libfc/fc_rport.c |  5 +++-
 include/scsi/libfcoe.h        |  1 +
 3 files changed, 25 insertions(+), 32 deletions(-)

diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 7dc4ffa244304..24cbd0a2cc69f 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(fcoe_wwn_from_mac);
  */
 static inline struct fcoe_rport *fcoe_ctlr_rport(struct fc_rport_priv *rdata)
 {
-	return (struct fcoe_rport *)(rdata + 1);
+	return container_of(rdata, struct fcoe_rport, rdata);
 }
 
 /**
@@ -2281,7 +2281,7 @@ static void fcoe_ctlr_vn_start(struct fcoe_ctlr *fip)
  */
 static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
 			      struct sk_buff *skb,
-			      struct fc_rport_priv *rdata)
+			      struct fcoe_rport *frport)
 {
 	struct fip_header *fiph;
 	struct fip_desc *desc = NULL;
@@ -2289,16 +2289,12 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
 	struct fip_wwn_desc *wwn = NULL;
 	struct fip_vn_desc *vn = NULL;
 	struct fip_size_desc *size = NULL;
-	struct fcoe_rport *frport;
 	size_t rlen;
 	size_t dlen;
 	u32 desc_mask = 0;
 	u32 dtype;
 	u8 sub;
 
-	memset(rdata, 0, sizeof(*rdata) + sizeof(*frport));
-	frport = fcoe_ctlr_rport(rdata);
-
 	fiph = (struct fip_header *)skb->data;
 	frport->flags = ntohs(fiph->fip_flags);
 
@@ -2361,15 +2357,17 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
 			if (dlen != sizeof(struct fip_wwn_desc))
 				goto len_err;
 			wwn = (struct fip_wwn_desc *)desc;
-			rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn);
+			frport->rdata.ids.node_name =
+				get_unaligned_be64(&wwn->fd_wwn);
 			break;
 		case FIP_DT_VN_ID:
 			if (dlen != sizeof(struct fip_vn_desc))
 				goto len_err;
 			vn = (struct fip_vn_desc *)desc;
 			memcpy(frport->vn_mac, vn->fd_mac, ETH_ALEN);
-			rdata->ids.port_id = ntoh24(vn->fd_fc_id);
-			rdata->ids.port_name = get_unaligned_be64(&vn->fd_wwpn);
+			frport->rdata.ids.port_id = ntoh24(vn->fd_fc_id);
+			frport->rdata.ids.port_name =
+				get_unaligned_be64(&vn->fd_wwpn);
 			break;
 		case FIP_DT_FC4F:
 			if (dlen != sizeof(struct fip_fc4_feat))
@@ -2750,10 +2748,7 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
 	struct fip_header *fiph;
 	enum fip_vn2vn_subcode sub;
-	struct {
-		struct fc_rport_priv rdata;
-		struct fcoe_rport frport;
-	} buf;
+	struct fcoe_rport frport = { };
 	int rc, vlan_id = 0;
 
 	fiph = (struct fip_header *)skb->data;
@@ -2769,7 +2764,7 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 		goto drop;
 	}
 
-	rc = fcoe_ctlr_vn_parse(fip, skb, &buf.rdata);
+	rc = fcoe_ctlr_vn_parse(fip, skb, &frport);
 	if (rc) {
 		LIBFCOE_FIP_DBG(fip, "vn_recv vn_parse error %d\n", rc);
 		goto drop;
@@ -2778,19 +2773,19 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 	mutex_lock(&fip->ctlr_mutex);
 	switch (sub) {
 	case FIP_SC_VN_PROBE_REQ:
-		fcoe_ctlr_vn_probe_req(fip, &buf.rdata);
+		fcoe_ctlr_vn_probe_req(fip, &frport.rdata);
 		break;
 	case FIP_SC_VN_PROBE_REP:
-		fcoe_ctlr_vn_probe_reply(fip, &buf.rdata);
+		fcoe_ctlr_vn_probe_reply(fip, &frport.rdata);
 		break;
 	case FIP_SC_VN_CLAIM_NOTIFY:
-		fcoe_ctlr_vn_claim_notify(fip, &buf.rdata);
+		fcoe_ctlr_vn_claim_notify(fip, &frport.rdata);
 		break;
 	case FIP_SC_VN_CLAIM_REP:
-		fcoe_ctlr_vn_claim_resp(fip, &buf.rdata);
+		fcoe_ctlr_vn_claim_resp(fip, &frport.rdata);
 		break;
 	case FIP_SC_VN_BEACON:
-		fcoe_ctlr_vn_beacon(fip, &buf.rdata);
+		fcoe_ctlr_vn_beacon(fip, &frport.rdata);
 		break;
 	default:
 		LIBFCOE_FIP_DBG(fip, "vn_recv unknown subcode %d\n", sub);
@@ -2814,22 +2809,18 @@ drop:
  */
 static int fcoe_ctlr_vlan_parse(struct fcoe_ctlr *fip,
 			      struct sk_buff *skb,
-			      struct fc_rport_priv *rdata)
+			      struct fcoe_rport *frport)
 {
 	struct fip_header *fiph;
 	struct fip_desc *desc = NULL;
 	struct fip_mac_desc *macd = NULL;
 	struct fip_wwn_desc *wwn = NULL;
-	struct fcoe_rport *frport;
 	size_t rlen;
 	size_t dlen;
 	u32 desc_mask = 0;
 	u32 dtype;
 	u8 sub;
 
-	memset(rdata, 0, sizeof(*rdata) + sizeof(*frport));
-	frport = fcoe_ctlr_rport(rdata);
-
 	fiph = (struct fip_header *)skb->data;
 	frport->flags = ntohs(fiph->fip_flags);
 
@@ -2883,7 +2874,8 @@ static int fcoe_ctlr_vlan_parse(struct fcoe_ctlr *fip,
 			if (dlen != sizeof(struct fip_wwn_desc))
 				goto len_err;
 			wwn = (struct fip_wwn_desc *)desc;
-			rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn);
+			frport->rdata.ids.node_name =
+				get_unaligned_be64(&wwn->fd_wwn);
 			break;
 		default:
 			LIBFCOE_FIP_DBG(fip, "unexpected descriptor type %x "
@@ -2994,22 +2986,19 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
 	struct fip_header *fiph;
 	enum fip_vlan_subcode sub;
-	struct {
-		struct fc_rport_priv rdata;
-		struct fcoe_rport frport;
-	} buf;
+	struct fcoe_rport frport = { };
 	int rc;
 
 	fiph = (struct fip_header *)skb->data;
 	sub = fiph->fip_subcode;
-	rc = fcoe_ctlr_vlan_parse(fip, skb, &buf.rdata);
+	rc = fcoe_ctlr_vlan_parse(fip, skb, &frport);
 	if (rc) {
 		LIBFCOE_FIP_DBG(fip, "vlan_recv vlan_parse error %d\n", rc);
 		goto drop;
 	}
 	mutex_lock(&fip->ctlr_mutex);
 	if (sub == FIP_SC_VL_REQ)
-		fcoe_ctlr_vlan_disc_reply(fip, &buf.rdata);
+		fcoe_ctlr_vlan_disc_reply(fip, &frport.rdata);
 	mutex_unlock(&fip->ctlr_mutex);
 
 drop:
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 3d51a936f6d54..90a748551ede5 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -140,6 +140,7 @@ EXPORT_SYMBOL(fc_rport_lookup);
 struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
 {
 	struct fc_rport_priv *rdata;
+	size_t rport_priv_size = sizeof(*rdata);
 
 	lockdep_assert_held(&lport->disc.disc_mutex);
 
@@ -147,7 +148,9 @@ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
 	if (rdata)
 		return rdata;
 
-	rdata = kzalloc(sizeof(*rdata) + lport->rport_priv_size, GFP_KERNEL);
+	if (lport->rport_priv_size > 0)
+		rport_priv_size = lport->rport_priv_size;
+	rdata = kzalloc(rport_priv_size, GFP_KERNEL);
 	if (!rdata)
 		return NULL;
 
diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
index bb8092fa1e364..58507c7783cf0 100644
--- a/include/scsi/libfcoe.h
+++ b/include/scsi/libfcoe.h
@@ -241,6 +241,7 @@ struct fcoe_fcf {
  * @vn_mac:	VN_Node assigned MAC address for data
  */
 struct fcoe_rport {
+	struct fc_rport_priv rdata;
 	unsigned long time;
 	u16 fcoe_len;
 	u16 flags;
-- 
GitLab


From a152a7b411a54b73707f37ab753cd907c3edfc56 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 1 May 2019 11:07:40 -0700
Subject: [PATCH 1370/1835] gcc-9: don't warn about uninitialized variable

commit cf676908846a06443fa5e6724ca3f5dd7460eca1 upstream.

I'm not sure what made gcc warn about this code now.  The 'ret' variable
does end up initialized in all cases, but it's definitely not obvious,
so the compiler is quite reasonable to warn about this.

So just add initialization to make it all much more obvious both to
compilers and to humans.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/i2c-core-base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 5b0e1d9e5adc0..1de10e5c70d7b 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -185,7 +185,7 @@ static int i2c_generic_bus_free(struct i2c_adapter *adap)
 int i2c_generic_scl_recovery(struct i2c_adapter *adap)
 {
 	struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
-	int i = 0, scl = 1, ret;
+	int i = 0, scl = 1, ret = 0;
 
 	if (bri->prepare_recovery)
 		bri->prepare_recovery(adap);
-- 
GitLab


From 7c43f84efd6d01fc646feb67d2b2b500435b191a Mon Sep 17 00:00:00 2001
From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Date: Mon, 5 Aug 2019 18:31:45 -0700
Subject: [PATCH 1371/1835] driver core: Establish order of operations for
 device_add and device_del via bitflag

commit 3451a495ef244a88ed6317a035299d835554d579 upstream.

Add an additional bit flag to the device_private struct named "dead".

This additional flag provides a guarantee that when a device_del is
executed on a given interface an async worker will not attempt to attach
the driver following the earlier device_del call. Previously this
guarantee was not present and could result in the device_del call
attempting to remove a driver from an interface only to have the async
worker attempt to probe the driver later when it finally completes the
asynchronous probe call.

One additional change added was that I pulled the check for dev->driver
out of the __device_attach_driver call and instead placed it in the
__device_attach_async_helper call. This was motivated by the fact that the
only other caller of this, __device_attach, had already taken the
device_lock() and checked for dev->driver. Instead of testing for this
twice in this path it makes more sense to just consolidate the dev->dead
and dev->driver checks together into one set of checks.

Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/base.h |  4 ++++
 drivers/base/core.c | 11 +++++++++++
 drivers/base/dd.c   | 22 +++++++++++-----------
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/drivers/base/base.h b/drivers/base/base.h
index 7a419a7a6235b..559b047de9f75 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -66,6 +66,9 @@ struct driver_private {
  *	probed first.
  * @device - pointer back to the struct device that this structure is
  * associated with.
+ * @dead - This device is currently either in the process of or has been
+ *	removed from the system. Any asynchronous events scheduled for this
+ *	device should exit without taking any action.
  *
  * Nothing outside of the driver core should ever touch these fields.
  */
@@ -76,6 +79,7 @@ struct device_private {
 	struct klist_node knode_bus;
 	struct list_head deferred_probe;
 	struct device *device;
+	u8 dead:1;
 };
 #define to_device_private_parent(obj)	\
 	container_of(obj, struct device_private, knode_parent)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 92e2c32c22270..37a90d72f3736 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2050,6 +2050,17 @@ void device_del(struct device *dev)
 	struct kobject *glue_dir = NULL;
 	struct class_interface *class_intf;
 
+	/*
+	 * Hold the device lock and set the "dead" flag to guarantee that
+	 * the update behavior is consistent with the other bitfields near
+	 * it and that we cannot have an asynchronous probe routine trying
+	 * to run while we are tearing out the bus/class/sysfs from
+	 * underneath the device.
+	 */
+	device_lock(dev);
+	dev->p->dead = true;
+	device_unlock(dev);
+
 	/* Notify clients of device removal.  This call must come
 	 * before dpm_sysfs_remove().
 	 */
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index d48b310c47603..11d24a552ee49 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -725,15 +725,6 @@ static int __device_attach_driver(struct device_driver *drv, void *_data)
 	bool async_allowed;
 	int ret;
 
-	/*
-	 * Check if device has already been claimed. This may
-	 * happen with driver loading, device discovery/registration,
-	 * and deferred probe processing happens all at once with
-	 * multiple threads.
-	 */
-	if (dev->driver)
-		return -EBUSY;
-
 	ret = driver_match_device(drv, dev);
 	if (ret == 0) {
 		/* no match */
@@ -768,6 +759,15 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
 
 	device_lock(dev);
 
+	/*
+	 * Check if device has already been removed or claimed. This may
+	 * happen with driver loading, device discovery/registration,
+	 * and deferred probe processing happens all at once with
+	 * multiple threads.
+	 */
+	if (dev->p->dead || dev->driver)
+		goto out_unlock;
+
 	if (dev->parent)
 		pm_runtime_get_sync(dev->parent);
 
@@ -778,7 +778,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
 
 	if (dev->parent)
 		pm_runtime_put(dev->parent);
-
+out_unlock:
 	device_unlock(dev);
 
 	put_device(dev);
@@ -891,7 +891,7 @@ static int __driver_attach(struct device *dev, void *data)
 	if (dev->parent && dev->bus->need_parent_lock)
 		device_lock(dev->parent);
 	device_lock(dev);
-	if (!dev->driver)
+	if (!dev->p->dead && !dev->driver)
 		driver_probe_device(drv, dev);
 	device_unlock(dev);
 	if (dev->parent && dev->bus->need_parent_lock)
-- 
GitLab


From c23106d4276d7d03f1b3e9dfca40fcf793a6ebab Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 5 Aug 2019 18:31:51 -0700
Subject: [PATCH 1372/1835] drivers/base: Introduce kill_device()

commit 00289cd87676e14913d2d8492d1ce05c4baafdae upstream.

The libnvdimm subsystem arranges for devices to be destroyed as a result
of a sysfs operation. Since device_unregister() cannot be called from
an actively running sysfs attribute of the same device libnvdimm
arranges for device_unregister() to be performed in an out-of-line async
context.

The driver core maintains a 'dead' state for coordinating its own racing
async registration / de-registration requests. Rather than add local
'dead' state tracking infrastructure to libnvdimm device objects, export
the existing state tracking via a new kill_device() helper.

The kill_device() helper simply marks the device as dead, i.e. that it
is on its way to device_del(), or returns that the device was already
dead. This can be used in advance of calling device_unregister() for
subsystems like libnvdimm that might need to handle multiple user
threads racing to delete a device.

This refactoring does not change any behavior, but it is a pre-requisite
for follow-on fixes and therefore marked for -stable.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver...")
Cc: <stable@vger.kernel.org>
Tested-by: Jane Chu <jane.chu@oracle.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/156341207332.292348.14959761496009347574.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c    | 27 +++++++++++++++++++--------
 include/linux/device.h |  1 +
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 37a90d72f3736..e1a8d5c06f65e 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2031,6 +2031,24 @@ void put_device(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(put_device);
 
+bool kill_device(struct device *dev)
+{
+	/*
+	 * Require the device lock and set the "dead" flag to guarantee that
+	 * the update behavior is consistent with the other bitfields near
+	 * it and that we cannot have an asynchronous probe routine trying
+	 * to run while we are tearing out the bus/class/sysfs from
+	 * underneath the device.
+	 */
+	lockdep_assert_held(&dev->mutex);
+
+	if (dev->p->dead)
+		return false;
+	dev->p->dead = true;
+	return true;
+}
+EXPORT_SYMBOL_GPL(kill_device);
+
 /**
  * device_del - delete device from system.
  * @dev: device.
@@ -2050,15 +2068,8 @@ void device_del(struct device *dev)
 	struct kobject *glue_dir = NULL;
 	struct class_interface *class_intf;
 
-	/*
-	 * Hold the device lock and set the "dead" flag to guarantee that
-	 * the update behavior is consistent with the other bitfields near
-	 * it and that we cannot have an asynchronous probe routine trying
-	 * to run while we are tearing out the bus/class/sysfs from
-	 * underneath the device.
-	 */
 	device_lock(dev);
-	dev->p->dead = true;
+	kill_device(dev);
 	device_unlock(dev);
 
 	/* Notify clients of device removal.  This call must come
diff --git a/include/linux/device.h b/include/linux/device.h
index 3f1066a9e1c3a..19dd8852602c4 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1332,6 +1332,7 @@ extern int (*platform_notify_remove)(struct device *dev);
  */
 extern struct device *get_device(struct device *dev);
 extern void put_device(struct device *dev);
+extern bool kill_device(struct device *dev);
 
 #ifdef CONFIG_DEVTMPFS
 extern int devtmpfs_create_node(struct device *dev);
-- 
GitLab


From d16bbdbbcb5002c5366cbf6402561d0350afd5fe Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 5 Aug 2019 18:31:56 -0700
Subject: [PATCH 1373/1835] libnvdimm/bus: Prevent duplicate
 device_unregister() calls

commit 8aac0e2338916e273ccbd438a2b7a1e8c61749f5 upstream.

A multithreaded namespace creation/destruction stress test currently
fails with signatures like the following:

    sysfs group 'power' not found for kobject 'dax1.1'
    RIP: 0010:sysfs_remove_group+0x76/0x80
    Call Trace:
     device_del+0x73/0x370
     device_unregister+0x16/0x50
     nd_async_device_unregister+0x1e/0x30 [libnvdimm]
     async_run_entry_fn+0x39/0x160
     process_one_work+0x23c/0x5e0
     worker_thread+0x3c/0x390

    BUG: kernel NULL pointer dereference, address: 0000000000000020
    RIP: 0010:klist_put+0x1b/0x6c
    Call Trace:
     klist_del+0xe/0x10
     device_del+0x8a/0x2c9
     ? __switch_to_asm+0x34/0x70
     ? __switch_to_asm+0x40/0x70
     device_unregister+0x44/0x4f
     nd_async_device_unregister+0x22/0x2d [libnvdimm]
     async_run_entry_fn+0x47/0x15a
     process_one_work+0x1a2/0x2eb
     worker_thread+0x1b8/0x26e

Use the kill_device() helper to atomically resolve the race of multiple
threads issuing kill, device_unregister(), requests.

Reported-by: Jane Chu <jane.chu@oracle.com>
Reported-by: Erwin Tsaur <erwin.tsaur@oracle.com>
Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver...")
Cc: <stable@vger.kernel.org>
Link: https://github.com/pmem/ndctl/issues/96
Tested-by: Tested-by: Jane Chu <jane.chu@oracle.com>
Link: https://lore.kernel.org/r/156341207846.292348.10435719262819764054.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/bus.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index ee39e2c1644ae..11cfd23e5aff7 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -528,13 +528,38 @@ EXPORT_SYMBOL(nd_device_register);
 
 void nd_device_unregister(struct device *dev, enum nd_async_mode mode)
 {
+	bool killed;
+
 	switch (mode) {
 	case ND_ASYNC:
+		/*
+		 * In the async case this is being triggered with the
+		 * device lock held and the unregistration work needs to
+		 * be moved out of line iff this is thread has won the
+		 * race to schedule the deletion.
+		 */
+		if (!kill_device(dev))
+			return;
+
 		get_device(dev);
 		async_schedule_domain(nd_async_device_unregister, dev,
 				&nd_async_domain);
 		break;
 	case ND_SYNC:
+		/*
+		 * In the sync case the device is being unregistered due
+		 * to a state change of the parent. Claim the kill state
+		 * to synchronize against other unregistration requests,
+		 * or otherwise let the async path handle it if the
+		 * unregistration was already queued.
+		 */
+		device_lock(dev);
+		killed = kill_device(dev);
+		device_unlock(dev);
+
+		if (!killed)
+			return;
+
 		nd_synchronize();
 		device_unregister(dev);
 		break;
-- 
GitLab


From 3248536919c17855ef5f2bc736d9565d9580706a Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 5 Aug 2019 18:32:02 -0700
Subject: [PATCH 1374/1835] libnvdimm/region: Register badblocks before
 namespaces

commit 700cd033a82d466ad8f9615f9985525e45f8960a upstream.

Namespace activation expects to be able to reference region badblocks.
The following warning sometimes triggers when asynchronous namespace
activation races in front of the completion of namespace probing. Move
all possible namespace probing after region badblocks initialization.

Otherwise, lockdep sometimes catches the uninitialized state of the
badblocks seqlock with stack trace signatures like:

    INFO: trying to register non-static key.
    pmem2: detected capacity change from 0 to 136365211648
    the code is fine but needs lockdep annotation.
    turning off the locking correctness validator.
    CPU: 9 PID: 358 Comm: kworker/u80:5 Tainted: G           OE     5.2.0-rc4+ #3382
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
    Workqueue: events_unbound async_run_entry_fn
    Call Trace:
     dump_stack+0x85/0xc0
    pmem1.12: detected capacity change from 0 to 8589934592
     register_lock_class+0x56a/0x570
     ? check_object+0x140/0x270
     __lock_acquire+0x80/0x1710
     ? __mutex_lock+0x39d/0x910
     lock_acquire+0x9e/0x180
     ? nd_pfn_validate+0x28f/0x440 [libnvdimm]
     badblocks_check+0x93/0x1f0
     ? nd_pfn_validate+0x28f/0x440 [libnvdimm]
     nd_pfn_validate+0x28f/0x440 [libnvdimm]
     ? lockdep_hardirqs_on+0xf0/0x180
     nd_dax_probe+0x9a/0x120 [libnvdimm]
     nd_pmem_probe+0x6d/0x180 [nd_pmem]
     nvdimm_bus_probe+0x90/0x2c0 [libnvdimm]

Fixes: 48af2f7e52f4 ("libnvdimm, pfn: during init, clear errors...")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Link: https://lore.kernel.org/r/156341208365.292348.1547528796026249120.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/region.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/nvdimm/region.c b/drivers/nvdimm/region.c
index b9ca0033cc999..f9130cc157e83 100644
--- a/drivers/nvdimm/region.c
+++ b/drivers/nvdimm/region.c
@@ -42,17 +42,6 @@ static int nd_region_probe(struct device *dev)
 	if (rc)
 		return rc;
 
-	rc = nd_region_register_namespaces(nd_region, &err);
-	if (rc < 0)
-		return rc;
-
-	ndrd = dev_get_drvdata(dev);
-	ndrd->ns_active = rc;
-	ndrd->ns_count = rc + err;
-
-	if (rc && err && rc == err)
-		return -ENODEV;
-
 	if (is_nd_pmem(&nd_region->dev)) {
 		struct resource ndr_res;
 
@@ -68,6 +57,17 @@ static int nd_region_probe(struct device *dev)
 		nvdimm_badblocks_populate(nd_region, &nd_region->bb, &ndr_res);
 	}
 
+	rc = nd_region_register_namespaces(nd_region, &err);
+	if (rc < 0)
+		return rc;
+
+	ndrd = dev_get_drvdata(dev);
+	ndrd->ns_active = rc;
+	ndrd->ns_count = rc + err;
+
+	if (rc && err && rc == err)
+		return -ENODEV;
+
 	nd_region->btt_seed = nd_btt_create(nd_region);
 	nd_region->pfn_seed = nd_pfn_create(nd_region);
 	nd_region->dax_seed = nd_dax_create(nd_region);
-- 
GitLab


From 7f000e7b44901519b41bbe6352a9fb0afc5b6d18 Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 5 Aug 2019 18:32:07 -0700
Subject: [PATCH 1375/1835] libnvdimm/bus: Prepare the nd_ioctl() path to be
 re-entrant

commit 6de5d06e657acdbcf9637dac37916a4a5309e0f4 upstream.

In preparation for not holding a lock over the execution of nd_ioctl(),
update the implementation to allow multiple threads to be attempting
ioctls at the same time. The bus lock still prevents multiple in-flight
->ndctl() invocations from corrupting each other's state, but static
global staging buffers are moved to the heap.

Reported-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Tested-by: Vishal Verma <vishal.l.verma@intel.com>
Link: https://lore.kernel.org/r/156341208947.292348.10560140326807607481.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/bus.c | 59 +++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 22 deletions(-)

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 11cfd23e5aff7..5abcdb4faa644 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -951,20 +951,19 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		int read_only, unsigned int ioctl_cmd, unsigned long arg)
 {
 	struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
-	static char out_env[ND_CMD_MAX_ENVELOPE];
-	static char in_env[ND_CMD_MAX_ENVELOPE];
 	const struct nd_cmd_desc *desc = NULL;
 	unsigned int cmd = _IOC_NR(ioctl_cmd);
 	struct device *dev = &nvdimm_bus->dev;
 	void __user *p = (void __user *) arg;
+	char *out_env = NULL, *in_env = NULL;
 	const char *cmd_name, *dimm_name;
 	u32 in_len = 0, out_len = 0;
 	unsigned int func = cmd;
 	unsigned long cmd_mask;
 	struct nd_cmd_pkg pkg;
 	int rc, i, cmd_rc;
+	void *buf = NULL;
 	u64 buf_len = 0;
-	void *buf;
 
 	if (nvdimm) {
 		desc = nd_cmd_dimm_desc(cmd);
@@ -1004,6 +1003,9 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		}
 
 	/* process an input envelope */
+	in_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
+	if (!in_env)
+		return -ENOMEM;
 	for (i = 0; i < desc->in_num; i++) {
 		u32 in_size, copy;
 
@@ -1011,14 +1013,17 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		if (in_size == UINT_MAX) {
 			dev_err(dev, "%s:%s unknown input size cmd: %s field: %d\n",
 					__func__, dimm_name, cmd_name, i);
-			return -ENXIO;
+			rc = -ENXIO;
+			goto out;
 		}
-		if (in_len < sizeof(in_env))
-			copy = min_t(u32, sizeof(in_env) - in_len, in_size);
+		if (in_len < ND_CMD_MAX_ENVELOPE)
+			copy = min_t(u32, ND_CMD_MAX_ENVELOPE - in_len, in_size);
 		else
 			copy = 0;
-		if (copy && copy_from_user(&in_env[in_len], p + in_len, copy))
-			return -EFAULT;
+		if (copy && copy_from_user(&in_env[in_len], p + in_len, copy)) {
+			rc = -EFAULT;
+			goto out;
+		}
 		in_len += in_size;
 	}
 
@@ -1030,6 +1035,12 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 	}
 
 	/* process an output envelope */
+	out_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
+	if (!out_env) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
 	for (i = 0; i < desc->out_num; i++) {
 		u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
 				(u32 *) in_env, (u32 *) out_env, 0);
@@ -1038,15 +1049,18 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		if (out_size == UINT_MAX) {
 			dev_dbg(dev, "%s unknown output size cmd: %s field: %d\n",
 					dimm_name, cmd_name, i);
-			return -EFAULT;
+			rc = -EFAULT;
+			goto out;
 		}
-		if (out_len < sizeof(out_env))
-			copy = min_t(u32, sizeof(out_env) - out_len, out_size);
+		if (out_len < ND_CMD_MAX_ENVELOPE)
+			copy = min_t(u32, ND_CMD_MAX_ENVELOPE - out_len, out_size);
 		else
 			copy = 0;
 		if (copy && copy_from_user(&out_env[out_len],
-					p + in_len + out_len, copy))
-			return -EFAULT;
+					p + in_len + out_len, copy)) {
+			rc = -EFAULT;
+			goto out;
+		}
 		out_len += out_size;
 	}
 
@@ -1054,12 +1068,15 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 	if (buf_len > ND_IOCTL_MAX_BUFLEN) {
 		dev_dbg(dev, "%s cmd: %s buf_len: %llu > %d\n", dimm_name,
 				cmd_name, buf_len, ND_IOCTL_MAX_BUFLEN);
-		return -EINVAL;
+		rc = -EINVAL;
+		goto out;
 	}
 
 	buf = vmalloc(buf_len);
-	if (!buf)
-		return -ENOMEM;
+	if (!buf) {
+		rc = -ENOMEM;
+		goto out;
+	}
 
 	if (copy_from_user(buf, p, buf_len)) {
 		rc = -EFAULT;
@@ -1081,17 +1098,15 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		nvdimm_account_cleared_poison(nvdimm_bus, clear_err->address,
 				clear_err->cleared);
 	}
-	nvdimm_bus_unlock(&nvdimm_bus->dev);
 
 	if (copy_to_user(p, buf, buf_len))
 		rc = -EFAULT;
 
-	vfree(buf);
-	return rc;
-
- out_unlock:
+out_unlock:
 	nvdimm_bus_unlock(&nvdimm_bus->dev);
- out:
+out:
+	kfree(in_env);
+	kfree(out_env);
 	vfree(buf);
 	return rc;
 }
-- 
GitLab


From 2364ed0d8ed11e30757563312587516911c88ae3 Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 5 Aug 2019 18:32:13 -0700
Subject: [PATCH 1376/1835] libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle()
 ABBA deadlock

commit ca6bf264f6d856f959c4239cda1047b587745c67 upstream.

A multithreaded namespace creation/destruction stress test currently
deadlocks with the following lockup signature:

    INFO: task ndctl:2924 blocked for more than 122 seconds.
          Tainted: G           OE     5.2.0-rc4+ #3382
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    ndctl           D    0  2924   1176 0x00000000
    Call Trace:
     ? __schedule+0x27e/0x780
     schedule+0x30/0xb0
     wait_nvdimm_bus_probe_idle+0x8a/0xd0 [libnvdimm]
     ? finish_wait+0x80/0x80
     uuid_store+0xe6/0x2e0 [libnvdimm]
     kernfs_fop_write+0xf0/0x1a0
     vfs_write+0xb7/0x1b0
     ksys_write+0x5c/0xd0
     do_syscall_64+0x60/0x240

     INFO: task ndctl:2923 blocked for more than 122 seconds.
           Tainted: G           OE     5.2.0-rc4+ #3382
     "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
     ndctl           D    0  2923   1175 0x00000000
     Call Trace:
      ? __schedule+0x27e/0x780
      ? __mutex_lock+0x489/0x910
      schedule+0x30/0xb0
      schedule_preempt_disabled+0x11/0x20
      __mutex_lock+0x48e/0x910
      ? nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm]
      ? __lock_acquire+0x23f/0x1710
      ? nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm]
      nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm]
      __dax_pmem_probe+0x5e/0x210 [dax_pmem_core]
      ? nvdimm_bus_probe+0x1d0/0x2c0 [libnvdimm]
      dax_pmem_probe+0xc/0x20 [dax_pmem]
      nvdimm_bus_probe+0x90/0x2c0 [libnvdimm]
      really_probe+0xef/0x390
      driver_probe_device+0xb4/0x100

In this sequence an 'nd_dax' device is being probed and trying to take
the lock on its backing namespace to validate that the 'nd_dax' device
indeed has exclusive access to the backing namespace. Meanwhile, another
thread is trying to update the uuid property of that same backing
namespace. So one thread is in the probe path trying to acquire the
lock, and the other thread has acquired the lock and tries to flush the
probe path.

Fix this deadlock by not holding the namespace device_lock over the
wait_nvdimm_bus_probe_idle() synchronization step. In turn this requires
the device_lock to be held on entry to wait_nvdimm_bus_probe_idle() and
subsequently dropped internally to wait_nvdimm_bus_probe_idle().

Cc: <stable@vger.kernel.org>
Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation")
Cc: Vishal Verma <vishal.l.verma@intel.com>
Tested-by: Jane Chu <jane.chu@oracle.com>
Link: https://lore.kernel.org/r/156341210094.292348.2384694131126767789.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/bus.c         | 14 +++++++++-----
 drivers/nvdimm/region_devs.c |  4 ++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 5abcdb4faa644..2ba22cd1331b0 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -865,10 +865,12 @@ void wait_nvdimm_bus_probe_idle(struct device *dev)
 	do {
 		if (nvdimm_bus->probe_active == 0)
 			break;
-		nvdimm_bus_unlock(&nvdimm_bus->dev);
+		nvdimm_bus_unlock(dev);
+		device_unlock(dev);
 		wait_event(nvdimm_bus->wait,
 				nvdimm_bus->probe_active == 0);
-		nvdimm_bus_lock(&nvdimm_bus->dev);
+		device_lock(dev);
+		nvdimm_bus_lock(dev);
 	} while (true);
 }
 
@@ -994,7 +996,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		case ND_CMD_ARS_START:
 		case ND_CMD_CLEAR_ERROR:
 		case ND_CMD_CALL:
-			dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n",
+			dev_dbg(dev, "'%s' command while read-only.\n",
 					nvdimm ? nvdimm_cmd_name(cmd)
 					: nvdimm_bus_cmd_name(cmd));
 			return -EPERM;
@@ -1083,7 +1085,8 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		goto out;
 	}
 
-	nvdimm_bus_lock(&nvdimm_bus->dev);
+	device_lock(dev);
+	nvdimm_bus_lock(dev);
 	rc = nd_cmd_clear_to_send(nvdimm_bus, nvdimm, func, buf);
 	if (rc)
 		goto out_unlock;
@@ -1103,7 +1106,8 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 		rc = -EFAULT;
 
 out_unlock:
-	nvdimm_bus_unlock(&nvdimm_bus->dev);
+	nvdimm_bus_unlock(dev);
+	device_unlock(dev);
 out:
 	kfree(in_env);
 	kfree(out_env);
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index e7377f1028ef6..0303296e6d5b6 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -425,10 +425,12 @@ static ssize_t available_size_show(struct device *dev,
 	 * memory nvdimm_bus_lock() is dropped, but that's userspace's
 	 * problem to not race itself.
 	 */
+	device_lock(dev);
 	nvdimm_bus_lock(dev);
 	wait_nvdimm_bus_probe_idle(dev);
 	available = nd_region_available_dpa(nd_region);
 	nvdimm_bus_unlock(dev);
+	device_unlock(dev);
 
 	return sprintf(buf, "%llu\n", available);
 }
@@ -440,10 +442,12 @@ static ssize_t max_available_extent_show(struct device *dev,
 	struct nd_region *nd_region = to_nd_region(dev);
 	unsigned long long available = 0;
 
+	device_lock(dev);
 	nvdimm_bus_lock(dev);
 	wait_nvdimm_bus_probe_idle(dev);
 	available = nd_region_allocatable_dpa(nd_region);
 	nvdimm_bus_unlock(dev);
+	device_unlock(dev);
 
 	return sprintf(buf, "%llu\n", available);
 }
-- 
GitLab


From e830c2c3c1748613cdcd0df85e6edcd8b59d9336 Mon Sep 17 00:00:00 2001
From: Aaron Armstrong Skomra <skomra@gmail.com>
Date: Tue, 23 Jul 2019 11:09:15 -0700
Subject: [PATCH 1377/1835] HID: wacom: fix bit shift for Cintiq Companion 2

commit 693c3dab4e50403f91bca4b52fc6d8562a3180f6 upstream.

The bit indicating BTN_6 on this device is overshifted
by 2 bits, resulting in the incorrect button being
reported.

Also fix copy-paste mistake in comments.

Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Link: https://github.com/linuxwacom/xf86-input-wacom/issues/71
Fixes: c7f0522a1ad1 ("HID: wacom: Slim down wacom_intuos_pad processing")
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 0ae8483694742..e56dc97fe4b6e 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -537,14 +537,14 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
 		 */
 		buttons = (data[4] << 1) | (data[3] & 0x01);
 	} else if (features->type == CINTIQ_COMPANION_2) {
-		/* d-pad right  -> data[4] & 0x10
-		 * d-pad up     -> data[4] & 0x20
-		 * d-pad left   -> data[4] & 0x40
-		 * d-pad down   -> data[4] & 0x80
-		 * d-pad center -> data[3] & 0x01
+		/* d-pad right  -> data[2] & 0x10
+		 * d-pad up     -> data[2] & 0x20
+		 * d-pad left   -> data[2] & 0x40
+		 * d-pad down   -> data[2] & 0x80
+		 * d-pad center -> data[1] & 0x01
 		 */
 		buttons = ((data[2] >> 4) << 7) |
-		          ((data[1] & 0x04) << 6) |
+		          ((data[1] & 0x04) << 4) |
 		          ((data[2] & 0x0F) << 2) |
 		          (data[1] & 0x03);
 	} else if (features->type >= INTUOS5S && features->type <= INTUOSPL) {
-- 
GitLab


From 608cfdfa9eb712a54900859dabae5c5c19a2a93c Mon Sep 17 00:00:00 2001
From: Sebastian Parschauer <s.parschauer@gmx.de>
Date: Wed, 24 Jul 2019 20:40:03 +0200
Subject: [PATCH 1378/1835] HID: Add quirk for HP X1200 PIXART OEM mouse

commit 49869d2ea9eecc105a10724c1abf035151a3c4e2 upstream.

The PixArt OEM mice are known for disconnecting every minute in
runlevel 1 or 3 if they are not always polled. So add quirk
ALWAYS_POLL for this one as well.

Jonathan Teh (@jonathan-teh) reported and tested the quirk.
Reference: https://github.com/sriemer/fix-linux-mouse/issues/15

Signed-off-by: Sebastian Parschauer <s.parschauer@gmx.de>
CC: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-ids.h    | 1 +
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 50b3c0d89c9c2..2898bb0619454 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -559,6 +559,7 @@
 #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A	0x0b4a
 #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE		0x134a
 #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A	0x094a
+#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641	0x0641
 
 #define USB_VENDOR_ID_HUION		0x256c
 #define USB_DEVICE_ID_HUION_TABLET	0x006e
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 91e86af44a04c..d29c7c9cd185d 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -94,6 +94,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT },
-- 
GitLab


From 8440cdc77577e5177153e121229cff73c0ba4e6c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 7 Aug 2019 18:44:12 +0200
Subject: [PATCH 1379/1835] IB: directly cast the sockaddr union to aockaddr

Like commit 641114d2af31 ("RDMA: Directly cast the sockaddr union to
sockaddr") we need to quiet gcc 9 from warning about this crazy union.
That commit did not fix all of the warnings in 4.19 and older kernels
because the logic in roce_resolve_route_from_path() was rewritten
between 4.19 and 5.2 when that change happened.

Cc: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/core/sa_query.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 7b794a14d6e85..8be082edf986f 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1232,7 +1232,6 @@ static int roce_resolve_route_from_path(struct sa_path_rec *rec,
 {
 	struct rdma_dev_addr dev_addr = {};
 	union {
-		struct sockaddr     _sockaddr;
 		struct sockaddr_in  _sockaddr_in;
 		struct sockaddr_in6 _sockaddr_in6;
 	} sgid_addr, dgid_addr;
@@ -1249,12 +1248,12 @@ static int roce_resolve_route_from_path(struct sa_path_rec *rec,
 	 */
 	dev_addr.net = &init_net;
 
-	rdma_gid2ip(&sgid_addr._sockaddr, &rec->sgid);
-	rdma_gid2ip(&dgid_addr._sockaddr, &rec->dgid);
+	rdma_gid2ip((struct sockaddr *)&sgid_addr, &rec->sgid);
+	rdma_gid2ip((struct sockaddr *)&dgid_addr, &rec->dgid);
 
 	/* validate the route */
-	ret = rdma_resolve_ip_route(&sgid_addr._sockaddr,
-				    &dgid_addr._sockaddr, &dev_addr);
+	ret = rdma_resolve_ip_route((struct sockaddr *)&sgid_addr,
+				    (struct sockaddr *)&dgid_addr, &dev_addr);
 	if (ret)
 		return ret;
 
-- 
GitLab


From cb4626784f398ae9222ed5e70ab79a2c74d9c74c Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Date: Tue, 30 Jul 2019 22:21:41 -0500
Subject: [PATCH 1380/1835] atm: iphase: Fix Spectre v1 vulnerability

[ Upstream commit ea443e5e98b5b74e317ef3d26bcaea54931ccdee ]

board is controlled by user-space, hence leading to a potential
exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/atm/iphase.c:2765 ia_ioctl() warn: potential spectre issue 'ia_dev' [r] (local cap)
drivers/atm/iphase.c:2774 ia_ioctl() warn: possible spectre second half.  'iadev'
drivers/atm/iphase.c:2782 ia_ioctl() warn: possible spectre second half.  'iadev'
drivers/atm/iphase.c:2816 ia_ioctl() warn: possible spectre second half.  'iadev'
drivers/atm/iphase.c:2823 ia_ioctl() warn: possible spectre second half.  'iadev'
drivers/atm/iphase.c:2830 ia_ioctl() warn: potential spectre issue '_ia_dev' [r] (local cap)
drivers/atm/iphase.c:2845 ia_ioctl() warn: possible spectre second half.  'iadev'
drivers/atm/iphase.c:2856 ia_ioctl() warn: possible spectre second half.  'iadev'

Fix this by sanitizing board before using it to index ia_dev and _ia_dev

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/atm/iphase.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 82532c299bb59..008905d4152a3 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -63,6 +63,7 @@
 #include <asm/byteorder.h>  
 #include <linux/vmalloc.h>
 #include <linux/jiffies.h>
+#include <linux/nospec.h>
 #include "iphase.h"		  
 #include "suni.h"		  
 #define swap_byte_order(x) (((x & 0xff) << 8) | ((x & 0xff00) >> 8))
@@ -2760,8 +2761,11 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
    }
    if (copy_from_user(&ia_cmds, arg, sizeof ia_cmds)) return -EFAULT; 
    board = ia_cmds.status;
-   if ((board < 0) || (board > iadev_count))
-         board = 0;    
+
+	if ((board < 0) || (board > iadev_count))
+		board = 0;
+	board = array_index_nospec(board, iadev_count + 1);
+
    iadev = ia_dev[board];
    switch (ia_cmds.cmd) {
    case MEMDUMP:
-- 
GitLab


From 774358df88f7259dafebb5876de4196826ca75a7 Mon Sep 17 00:00:00 2001
From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Date: Tue, 23 Jul 2019 19:32:41 -0700
Subject: [PATCH 1381/1835] bnx2x: Disable multi-cos feature.

[ Upstream commit d1f0b5dce8fda09a7f5f04c1878f181d548e42f5 ]

Commit 3968d38917eb ("bnx2x: Fix Multi-Cos.") which enabled multi-cos
feature after prolonged time in driver added some regression causing
numerous issues (sudden reboots, tx timeout etc.) reported by customers.
We plan to backout this commit and submit proper fix once we have root
cause of issues reported with this feature enabled.

Fixes: 3968d38917eb ("bnx2x: Fix Multi-Cos.")
Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 3edb81a4f0756..33baa17fa9d55 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1936,8 +1936,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
 	}
 
 	/* select a non-FCoE queue */
-	return fallback(dev, skb, NULL) %
-	       (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
+	return fallback(dev, skb, NULL) % (BNX2X_NUM_ETH_QUEUES(bp));
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
-- 
GitLab


From c4c8899376c2eb363c70b0b200434cc9abd3d34e Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Mon, 22 Jul 2019 21:43:00 -0700
Subject: [PATCH 1382/1835] ife: error out when nla attributes are empty

[ Upstream commit c8ec4632c6ac9cda0e8c3d51aa41eeab66585bd5 ]

act_ife at least requires TCA_IFE_PARMS, so we have to bail out
when there is no attribute passed in.

Reported-by: syzbot+fbb5b288c9cb6a2eeac4@syzkaller.appspotmail.com
Fixes: ef6980b6becb ("introduce IFE action")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_ife.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 06a3d48018782..915b6e94da635 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -484,6 +484,11 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 	int ret = 0;
 	int err;
 
+	if (!nla) {
+		NL_SET_ERR_MSG_MOD(extack, "IFE requires attributes to be passed");
+		return -EINVAL;
+	}
+
 	err = nla_parse_nested(tb, TCA_IFE_MAX, nla, ife_policy, NULL);
 	if (err < 0)
 		return err;
-- 
GitLab


From fdcefa46c5c22fdff4960c6bdabf245af667ceaf Mon Sep 17 00:00:00 2001
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Date: Wed, 24 Jul 2019 20:00:42 +0800
Subject: [PATCH 1383/1835] ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6

[ Upstream commit 3bc817d665ac6d9de89f59df522ad86f5b5dfc03 ]

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull()
which may change skb->data, so we need to re-load ipv6h at
the right place.

Fixes: 898b29798e36 ("ip6_gre: Refactor ip6gre xmit codes")
Cc: William Tu <u9012063@gmail.com>
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Acked-by: William Tu <u9012063@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_gre.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 01ecd510014f2..a53ef079a5394 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -680,12 +680,13 @@ static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
 				    struct flowi6 *fl6, __u8 *dsfield,
 				    int *encap_limit)
 {
-	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+	struct ipv6hdr *ipv6h;
 	struct ip6_tnl *t = netdev_priv(dev);
 	__u16 offset;
 
 	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
 	/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
+	ipv6h = ipv6_hdr(skb);
 
 	if (offset > 0) {
 		struct ipv6_tlv_tnl_enc_lim *tel;
-- 
GitLab


From 1bb2dd37cb878da69b43957804f2925d6ce33d1b Mon Sep 17 00:00:00 2001
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Date: Fri, 26 Jul 2019 00:40:17 +0800
Subject: [PATCH 1384/1835] ip6_tunnel: fix possible use-after-free on xmit

[ Upstream commit 01f5bffad555f8e22a61f4b1261fe09cf1b96994 ]

ip4ip6/ip6ip6 tunnels run iptunnel_handle_offloads on xmit which
can cause a possible use-after-free accessing iph/ipv6h pointer
since the packet will be 'uncloned' running pskb_expand_head if
it is a cloned gso skb.

Fixes: 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_tunnel.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ade1390c63488..d0ad85b8650da 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1283,12 +1283,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
+	dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
 
 	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
 		return -1;
 
-	dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
-
 	skb_set_inner_ipproto(skb, IPPROTO_IPIP);
 
 	err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1372,12 +1371,11 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
+	dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
 
 	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
 		return -1;
 
-	dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
-
 	skb_set_inner_ipproto(skb, IPPROTO_IPV6);
 
 	err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
-- 
GitLab


From f186fb5ccf699487a38b5b924fa6068274ae7d4f Mon Sep 17 00:00:00 2001
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Date: Thu, 25 Jul 2019 11:07:56 +0800
Subject: [PATCH 1385/1835] ipip: validate header length in ipip_tunnel_xmit

[ Upstream commit 47d858d0bdcd47cc1c6c9eeca91b091dd9e55637 ]

We need the same checks introduced by commit cb9f1b783850
("ip: validate header length on virtual device xmit") for
ipip tunnel.

Fixes: cb9f1b783850b ("ip: validate header length on virtual device xmit")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ipip.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index c891235b4966c..4368282eb6f8f 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -281,6 +281,9 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb,
 	const struct iphdr  *tiph = &tunnel->parms.iph;
 	u8 ipproto;
 
+	if (!pskb_inet_may_pull(skb))
+		goto tx_error;
+
 	switch (skb->protocol) {
 	case htons(ETH_P_IP):
 		ipproto = IPPROTO_IPIP;
-- 
GitLab


From 3c46905fb182334eaa6737e8faa9f6067a45c027 Mon Sep 17 00:00:00 2001
From: Jiri Pirko <jiri@mellanox.com>
Date: Wed, 31 Jul 2019 09:33:14 +0300
Subject: [PATCH 1386/1835] mlxsw: spectrum: Fix error path in
 mlxsw_sp_module_init()

[ Upstream commit 28fe79000e9b0a6f99959869947f1ca305f14599 ]

In case of sp2 pci driver registration fail, fix the error path to
start with sp1 pci driver unregister.

Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 0cab06046e5dc..ee126bcf7c350 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -5032,7 +5032,7 @@ static int __init mlxsw_sp_module_init(void)
 	return 0;
 
 err_sp2_pci_driver_register:
-	mlxsw_pci_driver_unregister(&mlxsw_sp2_pci_driver);
+	mlxsw_pci_driver_unregister(&mlxsw_sp1_pci_driver);
 err_sp1_pci_driver_register:
 	mlxsw_core_driver_unregister(&mlxsw_sp2_driver);
 err_sp2_core_driver_register:
-- 
GitLab


From ffab47bf69df0f340d56ded363bac09950ae2395 Mon Sep 17 00:00:00 2001
From: Matteo Croce <mcroce@redhat.com>
Date: Thu, 1 Aug 2019 14:13:30 +0200
Subject: [PATCH 1387/1835] mvpp2: fix panic on module removal

[ Upstream commit 944a83a2669ae8aa2c7664e79376ca7468eb0a2b ]

mvpp2 uses a delayed workqueue to gather traffic statistics.
On module removal the workqueue can be destroyed before calling
cancel_delayed_work_sync() on its works.
Fix it by moving the destroy_workqueue() call after mvpp2_port_remove().
Also remove an unneeded call to flush_workqueue()

    # rmmod mvpp2
    [ 2743.311722] mvpp2 f4000000.ethernet eth1: phy link down 10gbase-kr/10Gbps/Full
    [ 2743.320063] mvpp2 f4000000.ethernet eth1: Link is Down
    [ 2743.572263] mvpp2 f4000000.ethernet eth2: phy link down sgmii/1Gbps/Full
    [ 2743.580076] mvpp2 f4000000.ethernet eth2: Link is Down
    [ 2744.102169] mvpp2 f2000000.ethernet eth0: phy link down 10gbase-kr/10Gbps/Full
    [ 2744.110441] mvpp2 f2000000.ethernet eth0: Link is Down
    [ 2744.115614] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
    [ 2744.115615] Mem abort info:
    [ 2744.115616]   ESR = 0x96000005
    [ 2744.115617]   Exception class = DABT (current EL), IL = 32 bits
    [ 2744.115618]   SET = 0, FnV = 0
    [ 2744.115619]   EA = 0, S1PTW = 0
    [ 2744.115620] Data abort info:
    [ 2744.115621]   ISV = 0, ISS = 0x00000005
    [ 2744.115622]   CM = 0, WnR = 0
    [ 2744.115624] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000422681000
    [ 2744.115626] [0000000000000000] pgd=0000000000000000, pud=0000000000000000
    [ 2744.115630] Internal error: Oops: 96000005 [#1] SMP
    [ 2744.115632] Modules linked in: mvpp2(-) algif_hash af_alg nls_iso8859_1 nls_cp437 vfat fat xhci_plat_hcd m25p80 spi_nor xhci_hcd mtd usbcore i2c_mv64xxx sfp usb_common marvell10g phy_generic spi_orion mdio_i2c i2c_core mvmdio phylink sbsa_gwdt ip_tables x_tables autofs4 [last unloaded: mvpp2]
    [ 2744.115654] CPU: 3 PID: 8357 Comm: kworker/3:2 Not tainted 5.3.0-rc2 #1
    [ 2744.115655] Hardware name: Marvell 8040 MACCHIATOBin Double-shot (DT)
    [ 2744.115665] Workqueue: events_power_efficient phylink_resolve [phylink]
    [ 2744.115669] pstate: a0000085 (NzCv daIf -PAN -UAO)
    [ 2744.115675] pc : __queue_work+0x9c/0x4d8
    [ 2744.115677] lr : __queue_work+0x170/0x4d8
    [ 2744.115678] sp : ffffff801001bd50
    [ 2744.115680] x29: ffffff801001bd50 x28: ffffffc422597600
    [ 2744.115684] x27: ffffff80109ae6f0 x26: ffffff80108e4018
    [ 2744.115688] x25: 0000000000000003 x24: 0000000000000004
    [ 2744.115691] x23: ffffff80109ae6e0 x22: 0000000000000017
    [ 2744.115694] x21: ffffffc42c030000 x20: ffffffc42209e8f8
    [ 2744.115697] x19: 0000000000000000 x18: 0000000000000000
    [ 2744.115699] x17: 0000000000000000 x16: 0000000000000000
    [ 2744.115701] x15: 0000000000000010 x14: ffffffffffffffff
    [ 2744.115702] x13: ffffff8090e2b95f x12: ffffff8010e2b967
    [ 2744.115704] x11: ffffff8010906000 x10: 0000000000000040
    [ 2744.115706] x9 : ffffff80109223b8 x8 : ffffff80109223b0
    [ 2744.115707] x7 : ffffffc42bc00068 x6 : 0000000000000000
    [ 2744.115709] x5 : ffffffc42bc00000 x4 : 0000000000000000
    [ 2744.115710] x3 : 0000000000000000 x2 : 0000000000000000
    [ 2744.115712] x1 : 0000000000000008 x0 : ffffffc42c030000
    [ 2744.115714] Call trace:
    [ 2744.115716]  __queue_work+0x9c/0x4d8
    [ 2744.115718]  delayed_work_timer_fn+0x28/0x38
    [ 2744.115722]  call_timer_fn+0x3c/0x180
    [ 2744.115723]  expire_timers+0x60/0x168
    [ 2744.115724]  run_timer_softirq+0xbc/0x1e8
    [ 2744.115727]  __do_softirq+0x128/0x320
    [ 2744.115731]  irq_exit+0xa4/0xc0
    [ 2744.115734]  __handle_domain_irq+0x70/0xc0
    [ 2744.115735]  gic_handle_irq+0x58/0xa8
    [ 2744.115737]  el1_irq+0xb8/0x140
    [ 2744.115738]  console_unlock+0x3a0/0x568
    [ 2744.115740]  vprintk_emit+0x200/0x2a0
    [ 2744.115744]  dev_vprintk_emit+0x1c8/0x1e4
    [ 2744.115747]  dev_printk_emit+0x6c/0x7c
    [ 2744.115751]  __netdev_printk+0x104/0x1d8
    [ 2744.115752]  netdev_printk+0x60/0x70
    [ 2744.115756]  phylink_resolve+0x38c/0x3c8 [phylink]
    [ 2744.115758]  process_one_work+0x1f8/0x448
    [ 2744.115760]  worker_thread+0x54/0x500
    [ 2744.115762]  kthread+0x12c/0x130
    [ 2744.115764]  ret_from_fork+0x10/0x1c
    [ 2744.115768] Code: aa1403e0 97fffbbe aa0003f5 b4000700 (f9400261)

Fixes: 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Matteo Croce <mcroce@redhat.com>
Acked-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index df5b74f289e19..c357aafee1069 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -5358,9 +5358,6 @@ static int mvpp2_remove(struct platform_device *pdev)
 
 	mvpp2_dbgfs_cleanup(priv);
 
-	flush_workqueue(priv->stats_queue);
-	destroy_workqueue(priv->stats_queue);
-
 	fwnode_for_each_available_child_node(fwnode, port_fwnode) {
 		if (priv->port_list[i]) {
 			mutex_destroy(&priv->port_list[i]->gather_stats_lock);
@@ -5369,6 +5366,8 @@ static int mvpp2_remove(struct platform_device *pdev)
 		i++;
 	}
 
+	destroy_workqueue(priv->stats_queue);
+
 	for (i = 0; i < MVPP2_BM_POOLS_NUM; i++) {
 		struct mvpp2_bm_pool *bm_pool = &priv->bm_pools[i];
 
-- 
GitLab


From b3645a487373e2182bd9899a4fe3a2cbf2010e6e Mon Sep 17 00:00:00 2001
From: Matteo Croce <mcroce@redhat.com>
Date: Sun, 28 Jul 2019 02:46:45 +0200
Subject: [PATCH 1388/1835] mvpp2: refactor MTU change code

[ Upstream commit 230bd958c2c846ee292aa38bc6b006296c24ca01 ]

The MTU change code can call napi_disable() with the device already down,
leading to a deadlock. Also, lot of code is duplicated unnecessarily.

Rework mvpp2_change_mtu() to avoid the deadlock and remove duplicated code.

Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
Signed-off-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/marvell/mvpp2/mvpp2_main.c   | 41 ++++++-------------
 1 file changed, 13 insertions(+), 28 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index c357aafee1069..6455511457ca3 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -3501,6 +3501,7 @@ static int mvpp2_set_mac_address(struct net_device *dev, void *p)
 static int mvpp2_change_mtu(struct net_device *dev, int mtu)
 {
 	struct mvpp2_port *port = netdev_priv(dev);
+	bool running = netif_running(dev);
 	int err;
 
 	if (!IS_ALIGNED(MVPP2_RX_PKT_SIZE(mtu), 8)) {
@@ -3509,40 +3510,24 @@ static int mvpp2_change_mtu(struct net_device *dev, int mtu)
 		mtu = ALIGN(MVPP2_RX_PKT_SIZE(mtu), 8);
 	}
 
-	if (!netif_running(dev)) {
-		err = mvpp2_bm_update_mtu(dev, mtu);
-		if (!err) {
-			port->pkt_size =  MVPP2_RX_PKT_SIZE(mtu);
-			return 0;
-		}
-
-		/* Reconfigure BM to the original MTU */
-		err = mvpp2_bm_update_mtu(dev, dev->mtu);
-		if (err)
-			goto log_error;
-	}
-
-	mvpp2_stop_dev(port);
+	if (running)
+		mvpp2_stop_dev(port);
 
 	err = mvpp2_bm_update_mtu(dev, mtu);
-	if (!err) {
+	if (err) {
+		netdev_err(dev, "failed to change MTU\n");
+		/* Reconfigure BM to the original MTU */
+		mvpp2_bm_update_mtu(dev, dev->mtu);
+	} else {
 		port->pkt_size =  MVPP2_RX_PKT_SIZE(mtu);
-		goto out_start;
 	}
 
-	/* Reconfigure BM to the original MTU */
-	err = mvpp2_bm_update_mtu(dev, dev->mtu);
-	if (err)
-		goto log_error;
-
-out_start:
-	mvpp2_start_dev(port);
-	mvpp2_egress_enable(port);
-	mvpp2_ingress_enable(port);
+	if (running) {
+		mvpp2_start_dev(port);
+		mvpp2_egress_enable(port);
+		mvpp2_ingress_enable(port);
+	}
 
-	return 0;
-log_error:
-	netdev_err(dev, "failed to change MTU\n");
 	return err;
 }
 
-- 
GitLab


From 639239be11ad95fab3266577e8d1efa1e8ec9672 Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Date: Mon, 29 Jul 2019 12:28:41 +0300
Subject: [PATCH 1389/1835] net: bridge: delete local fdb on device init
 failure

[ Upstream commit d7bae09fa008c6c9a489580db0a5a12063b97f97 ]

On initialization failure we have to delete the local fdb which was
inserted due to the default pvid creation. This problem has been present
since the inception of default_pvid. Note that currently there are 2 cases:
1) in br_dev_init() when br_multicast_init() fails
2) if register_netdevice() fails after calling ndo_init()

This patch takes care of both since br_vlan_flush() is called on both
occasions. Also the new fdb delete would be a no-op on normal bridge
device destruction since the local fdb would've been already flushed by
br_dev_delete(). This is not an issue for ports since nbp_vlan_init() is
called last when adding a port thus nothing can fail after it.

Reported-by: syzbot+88533dc8b582309bf3ee@syzkaller.appspotmail.com
Fixes: 5be5a2df40f0 ("bridge: Add filtering support for default_pvid")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_vlan.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 7df269092103c..5f3950f00f73b 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -677,6 +677,11 @@ void br_vlan_flush(struct net_bridge *br)
 
 	ASSERT_RTNL();
 
+	/* delete auto-added default pvid local fdb before flushing vlans
+	 * otherwise it will be leaked on bridge device init failure
+	 */
+	br_fdb_delete_by_port(br, NULL, 0, 1);
+
 	vg = br_vlan_group(br);
 	__vlan_flush(vg);
 	RCU_INIT_POINTER(br->vlgrp, NULL);
-- 
GitLab


From a19d4e34f092fdb74e39de0193627f16a38997b8 Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Date: Tue, 30 Jul 2019 14:21:00 +0300
Subject: [PATCH 1390/1835] net: bridge: mcast: don't delete permanent entries
 when fast leave is enabled

[ Upstream commit 5c725b6b65067909548ac9ca9bc777098ec9883d ]

When permanent entries were introduced by the commit below, they were
exempt from timing out and thus igmp leave wouldn't affect them unless
fast leave was enabled on the port which was added before permanent
entries existed. It shouldn't matter if fast leave is enabled or not
if the user added a permanent entry it shouldn't be deleted on igmp
leave.

Before:
$ echo 1 > /sys/class/net/eth4/brport/multicast_fast_leave
$ bridge mdb add dev br0 port eth4 grp 229.1.1.1 permanent
$ bridge mdb show
dev br0 port eth4 grp 229.1.1.1 permanent

< join and leave 229.1.1.1 on eth4 >

$ bridge mdb show
$

After:
$ echo 1 > /sys/class/net/eth4/brport/multicast_fast_leave
$ bridge mdb add dev br0 port eth4 grp 229.1.1.1 permanent
$ bridge mdb show
dev br0 port eth4 grp 229.1.1.1 permanent

< join and leave 229.1.1.1 on eth4 >

$ bridge mdb show
dev br0 port eth4 grp 229.1.1.1 permanent

Fixes: ccb1c31a7a87 ("bridge: add flags to distinguish permanent mdb entires")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_multicast.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index fb54d32321ec9..6a362da211e1b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1621,6 +1621,9 @@ br_multicast_leave_group(struct net_bridge *br,
 			if (!br_port_group_equal(p, port, src))
 				continue;
 
+			if (p->flags & MDB_PG_FLAGS_PERMANENT)
+				break;
+
 			rcu_assign_pointer(*pp, p->next);
 			hlist_del_init(&p->mglist);
 			del_timer(&p->timer);
-- 
GitLab


From edb7ad69c439cdb960d9f519233d8d9771e329b5 Mon Sep 17 00:00:00 2001
From: Jiri Pirko <jiri@mellanox.com>
Date: Sun, 28 Jul 2019 14:56:36 +0200
Subject: [PATCH 1391/1835] net: fix ifindex collision during namespace removal

[ Upstream commit 55b40dbf0e76b4bfb9d8b3a16a0208640a9a45df ]

Commit aca51397d014 ("netns: Fix arbitrary net_device-s corruptions
on net_ns stop.") introduced a possibility to hit a BUG in case device
is returning back to init_net and two following conditions are met:
1) dev->ifindex value is used in a name of another "dev%d"
   device in init_net.
2) dev->name is used by another device in init_net.

Under real life circumstances this is hard to get. Therefore this has
been present happily for over 10 years. To reproduce:

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 86:89:3f:86:61:29 brd ff:ff:ff:ff:ff:ff
3: enp0s2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
$ ip netns add ns1
$ ip -n ns1 link add dummy1ns1 type dummy
$ ip -n ns1 link add dummy2ns1 type dummy
$ ip link set enp0s2 netns ns1
$ ip -n ns1 link set enp0s2 name dummy0
[  100.858894] virtio_net virtio0 dummy0: renamed from enp0s2
$ ip link add dev4 type dummy
$ ip -n ns1 a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: dummy1ns1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 16:63:4c:38:3e:ff brd ff:ff:ff:ff:ff:ff
3: dummy2ns1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether aa:9e:86:dd:6b:5d brd ff:ff:ff:ff:ff:ff
4: dummy0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 86:89:3f:86:61:29 brd ff:ff:ff:ff:ff:ff
4: dev4: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 5a:e1:4a:b6:ec:f8 brd ff:ff:ff:ff:ff:ff
$ ip netns del ns1
[  158.717795] default_device_exit: failed to move dummy0 to init_net: -17
[  158.719316] ------------[ cut here ]------------
[  158.720591] kernel BUG at net/core/dev.c:9824!
[  158.722260] invalid opcode: 0000 [#1] SMP KASAN PTI
[  158.723728] CPU: 0 PID: 56 Comm: kworker/u2:1 Not tainted 5.3.0-rc1+ #18
[  158.725422] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
[  158.727508] Workqueue: netns cleanup_net
[  158.728915] RIP: 0010:default_device_exit.cold+0x1d/0x1f
[  158.730683] Code: 84 e8 18 c9 3e fe 0f 0b e9 70 90 ff ff e8 36 e4 52 fe 89 d9 4c 89 e2 48 c7 c6 80 d6 25 84 48 c7 c7 20 c0 25 84 e8 f4 c8 3e
[  158.736854] RSP: 0018:ffff8880347e7b90 EFLAGS: 00010282
[  158.738752] RAX: 000000000000003b RBX: 00000000ffffffef RCX: 0000000000000000
[  158.741369] RDX: 0000000000000000 RSI: ffffffff8128013d RDI: ffffed10068fcf64
[  158.743418] RBP: ffff888033550170 R08: 000000000000003b R09: fffffbfff0b94b9c
[  158.745626] R10: fffffbfff0b94b9b R11: ffffffff85ca5cdf R12: ffff888032f28000
[  158.748405] R13: dffffc0000000000 R14: ffff8880335501b8 R15: 1ffff110068fcf72
[  158.750638] FS:  0000000000000000(0000) GS:ffff888036000000(0000) knlGS:0000000000000000
[  158.752944] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  158.755245] CR2: 00007fe8b45d21d0 CR3: 00000000340b4005 CR4: 0000000000360ef0
[  158.757654] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  158.760012] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  158.762758] Call Trace:
[  158.763882]  ? dev_change_net_namespace+0xbb0/0xbb0
[  158.766148]  ? devlink_nl_cmd_set_doit+0x520/0x520
[  158.768034]  ? dev_change_net_namespace+0xbb0/0xbb0
[  158.769870]  ops_exit_list.isra.0+0xa8/0x150
[  158.771544]  cleanup_net+0x446/0x8f0
[  158.772945]  ? unregister_pernet_operations+0x4a0/0x4a0
[  158.775294]  process_one_work+0xa1a/0x1740
[  158.776896]  ? pwq_dec_nr_in_flight+0x310/0x310
[  158.779143]  ? do_raw_spin_lock+0x11b/0x280
[  158.780848]  worker_thread+0x9e/0x1060
[  158.782500]  ? process_one_work+0x1740/0x1740
[  158.784454]  kthread+0x31b/0x420
[  158.786082]  ? __kthread_create_on_node+0x3f0/0x3f0
[  158.788286]  ret_from_fork+0x3a/0x50
[  158.789871] ---[ end trace defd6c657c71f936 ]---
[  158.792273] RIP: 0010:default_device_exit.cold+0x1d/0x1f
[  158.795478] Code: 84 e8 18 c9 3e fe 0f 0b e9 70 90 ff ff e8 36 e4 52 fe 89 d9 4c 89 e2 48 c7 c6 80 d6 25 84 48 c7 c7 20 c0 25 84 e8 f4 c8 3e
[  158.804854] RSP: 0018:ffff8880347e7b90 EFLAGS: 00010282
[  158.807865] RAX: 000000000000003b RBX: 00000000ffffffef RCX: 0000000000000000
[  158.811794] RDX: 0000000000000000 RSI: ffffffff8128013d RDI: ffffed10068fcf64
[  158.816652] RBP: ffff888033550170 R08: 000000000000003b R09: fffffbfff0b94b9c
[  158.820930] R10: fffffbfff0b94b9b R11: ffffffff85ca5cdf R12: ffff888032f28000
[  158.825113] R13: dffffc0000000000 R14: ffff8880335501b8 R15: 1ffff110068fcf72
[  158.829899] FS:  0000000000000000(0000) GS:ffff888036000000(0000) knlGS:0000000000000000
[  158.834923] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  158.838164] CR2: 00007fe8b45d21d0 CR3: 00000000340b4005 CR4: 0000000000360ef0
[  158.841917] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  158.845149] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Fix this by checking if a device with the same name exists in init_net
and fallback to original code - dev%d to allocate name - in case it does.

This was found using syzkaller.

Fixes: aca51397d014 ("netns: Fix arbitrary net_device-s corruptions on net_ns stop.")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/dev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 138951d286432..e4b4cb40da00c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9510,6 +9510,8 @@ static void __net_exit default_device_exit(struct net *net)
 
 		/* Push remaining network devices to init_net */
 		snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
+		if (__dev_get_by_name(&init_net, fb_name))
+			snprintf(fb_name, IFNAMSIZ, "dev%%d");
 		err = dev_change_net_namespace(dev, &init_net, fb_name);
 		if (err) {
 			pr_emerg("%s: failed to move %s to init_net: %d\n",
-- 
GitLab


From 858f82c63667281719805a1b03a1405f14ac0269 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Thu, 1 Aug 2019 09:52:54 -0400
Subject: [PATCH 1392/1835] net/mlx5e: always initialize frag->last_in_page

[ Upstream commit 60d60c8fbd8d1acf25b041ecd72ae4fa16e9405b ]

The commit 069d11465a80 ("net/mlx5e: RX, Enhance legacy Receive Queue
memory scheme") introduced an undefined behaviour below due to
"frag->last_in_page" is only initialized in mlx5e_init_frags_partition()
when,

if (next_frag.offset + frag_info[f].frag_stride > PAGE_SIZE)

or after bailed out the loop,

for (i = 0; i < mlx5_wq_cyc_get_size(&rq->wqe.wq); i++)

As the result, there could be some "frag" have uninitialized
value of "last_in_page".

Later, get_frag() obtains those "frag" and check "frag->last_in_page" in
mlx5e_put_rx_frag() and triggers the error during boot. Fix it by always
initializing "frag->last_in_page" to "false" in
mlx5e_init_frags_partition().

UBSAN: Undefined behaviour in
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c:325:12
load of value 170 is not a valid value for type 'bool' (aka '_Bool')
Call trace:
 dump_backtrace+0x0/0x264
 show_stack+0x20/0x2c
 dump_stack+0xb0/0x104
 __ubsan_handle_load_invalid_value+0x104/0x128
 mlx5e_handle_rx_cqe+0x8e8/0x12cc [mlx5_core]
 mlx5e_poll_rx_cq+0xca8/0x1a94 [mlx5_core]
 mlx5e_napi_poll+0x17c/0xa30 [mlx5_core]
 net_rx_action+0x248/0x940
 __do_softirq+0x350/0x7b8
 irq_exit+0x200/0x26c
 __handle_domain_irq+0xc8/0x128
 gic_handle_irq+0x138/0x228
 el1_irq+0xb8/0x140
 arch_cpu_idle+0x1a4/0x348
 do_idle+0x114/0x1b0
 cpu_startup_entry+0x24/0x28
 rest_init+0x1ac/0x1dc
 arch_call_rest_init+0x10/0x18
 start_kernel+0x4d4/0x57c

Fixes: 069d11465a80 ("net/mlx5e: RX, Enhance legacy Receive Queue memory scheme")
Signed-off-by: Qian Cai <cai@lca.pw>
Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 0f1c296c3ce4e..83ab2c0e6b61f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -420,12 +420,11 @@ static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix)
 
 static void mlx5e_init_frags_partition(struct mlx5e_rq *rq)
 {
-	struct mlx5e_wqe_frag_info next_frag, *prev;
+	struct mlx5e_wqe_frag_info next_frag = {};
+	struct mlx5e_wqe_frag_info *prev = NULL;
 	int i;
 
 	next_frag.di = &rq->wqe.di[0];
-	next_frag.offset = 0;
-	prev = NULL;
 
 	for (i = 0; i < mlx5_wq_cyc_get_size(&rq->wqe.wq); i++) {
 		struct mlx5e_rq_frag_info *frag_info = &rq->wqe.info.arr[0];
-- 
GitLab


From 4dddd08b571d73e9acb87b4b7fff763ba3e6d6cd Mon Sep 17 00:00:00 2001
From: Mark Zhang <markz@mellanox.com>
Date: Tue, 9 Jul 2019 05:37:12 +0300
Subject: [PATCH 1393/1835] net/mlx5: Use reversed order when unregister
 devices

[ Upstream commit 08aa5e7da6bce1a1963f63cf32c2e7ad434ad578 ]

When lag is active, which is controlled by the bonded mlx5e netdev, mlx5
interface unregestering must happen in the reverse order where rdma is
unregistered (unloaded) first, to guarantee all references to the lag
context in hardware is removed, then remove mlx5e netdev interface which
will cleanup the lag context from hardware.

Without this fix during destroy of LAG interface, we observed following
errors:
 * mlx5_cmd_check:752:(pid 12556): DESTROY_LAG(0x843) op_mod(0x0) failed,
   status bad parameter(0x3), syndrome (0xe4ac33)
 * mlx5_cmd_check:752:(pid 12556): DESTROY_LAG(0x843) op_mod(0x0) failed,
   status bad parameter(0x3), syndrome (0xa5aee8).

Fixes: a31208b1e11d ("net/mlx5_core: New init and exit flow for mlx5_core")
Reviewed-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Mark Zhang <markz@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index 1c225be9c7db9..3692d6a1cce8d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -307,7 +307,7 @@ void mlx5_unregister_device(struct mlx5_core_dev *dev)
 	struct mlx5_interface *intf;
 
 	mutex_lock(&mlx5_intf_mutex);
-	list_for_each_entry(intf, &intf_list, list)
+	list_for_each_entry_reverse(intf, &intf_list, list)
 		mlx5_remove_device(intf, priv);
 	list_del(&priv->dev_list);
 	mutex_unlock(&mlx5_intf_mutex);
-- 
GitLab


From c8b05980c4bf7abfe9a016c34f8bf3bb5396cbfb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20van=20Dorst?= <opensource@vdorst.com>
Date: Sat, 27 Jul 2019 11:40:11 +0200
Subject: [PATCH 1394/1835] net: phylink: Fix flow control for fixed-link
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8aace4f3eba2a3ceb431e18683ea0e1ecbade5cd ]

In phylink_parse_fixedlink() the pl->link_config.advertising bits are AND
with pl->supported, pl->supported is zeroed and only the speed/duplex
modes and MII bits are set.
So pl->link_config.advertising always loses the flow control/pause bits.

By setting Pause and Asym_Pause bits in pl->supported, the flow control
work again when devicetree "pause" is set in fixes-link node and the MAC
advertise that is supports pause.

Results with this patch.

Legend:
- DT = 'Pause' is set in the fixed-link in devicetree.
- validate() = ‘Yes’ means phylink_set(mask, Pause) is set in the
  validate().
- flow = results reported my link is Up line.

+-----+------------+-------+
| DT  | validate() | flow  |
+-----+------------+-------+
| Yes | Yes        | rx/tx |
| No  | Yes        | off   |
| Yes | No         | off   |
+-----+------------+-------+

Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
Signed-off-by: René van Dorst <opensource@vdorst.com>
Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phylink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index e029c7977a562..2e8056d48f4a0 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -226,6 +226,8 @@ static int phylink_parse_fixedlink(struct phylink *pl,
 			       __ETHTOOL_LINK_MODE_MASK_NBITS, true);
 	linkmode_zero(pl->supported);
 	phylink_set(pl->supported, MII);
+	phylink_set(pl->supported, Pause);
+	phylink_set(pl->supported, Asym_Pause);
 	if (s) {
 		__set_bit(s->bit, pl->supported);
 	} else {
-- 
GitLab


From 44b96a38c2b5dd6e67039898201fdbcbaa4974ae Mon Sep 17 00:00:00 2001
From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Date: Thu, 25 Jul 2019 12:07:12 -0600
Subject: [PATCH 1395/1835] net: qualcomm: rmnet: Fix incorrect UL checksum
 offload logic

[ Upstream commit a7cf3d24ee6081930feb4c830a7f6f16ebe31c49 ]

The udp_ip4_ind bit is set only for IPv4 UDP non-fragmented packets
so that the hardware can flip the checksum to 0xFFFF if the computed
checksum is 0 per RFC768.

However, this bit had to be set for IPv6 UDP non fragmented packets
as well per hardware requirements. Otherwise, IPv6 UDP packets
with computed checksum as 0 were transmitted by hardware and were
dropped in the network.

In addition to setting this bit for IPv6 UDP, the field is also
appropriately renamed to udp_ind as part of this change.

Fixes: 5eb5f8608ef1 ("net: qualcomm: rmnet: Add support for TX checksum offload")
Cc: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h     |  2 +-
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c    | 13 +++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index 884f1f52dcc25..70879a3ab567c 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -59,7 +59,7 @@ struct rmnet_map_dl_csum_trailer {
 struct rmnet_map_ul_csum_header {
 	__be16 csum_start_offset;
 	u16 csum_insert_offset:14;
-	u16 udp_ip4_ind:1;
+	u16 udp_ind:1;
 	u16 csum_enabled:1;
 } __aligned(1);
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 57a9c314a665f..b2090cedd2e96 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -215,9 +215,9 @@ rmnet_map_ipv4_ul_csum_header(void *iphdr,
 	ul_header->csum_insert_offset = skb->csum_offset;
 	ul_header->csum_enabled = 1;
 	if (ip4h->protocol == IPPROTO_UDP)
-		ul_header->udp_ip4_ind = 1;
+		ul_header->udp_ind = 1;
 	else
-		ul_header->udp_ip4_ind = 0;
+		ul_header->udp_ind = 0;
 
 	/* Changing remaining fields to network order */
 	hdr++;
@@ -248,6 +248,7 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
 			      struct rmnet_map_ul_csum_header *ul_header,
 			      struct sk_buff *skb)
 {
+	struct ipv6hdr *ip6h = (struct ipv6hdr *)ip6hdr;
 	__be16 *hdr = (__be16 *)ul_header, offset;
 
 	offset = htons((__force u16)(skb_transport_header(skb) -
@@ -255,7 +256,11 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
 	ul_header->csum_start_offset = offset;
 	ul_header->csum_insert_offset = skb->csum_offset;
 	ul_header->csum_enabled = 1;
-	ul_header->udp_ip4_ind = 0;
+
+	if (ip6h->nexthdr == IPPROTO_UDP)
+		ul_header->udp_ind = 1;
+	else
+		ul_header->udp_ind = 0;
 
 	/* Changing remaining fields to network order */
 	hdr++;
@@ -428,7 +433,7 @@ sw_csum:
 	ul_header->csum_start_offset = 0;
 	ul_header->csum_insert_offset = 0;
 	ul_header->csum_enabled = 0;
-	ul_header->udp_ip4_ind = 0;
+	ul_header->udp_ind = 0;
 
 	priv->stats.csum_sw++;
 }
-- 
GitLab


From d82dc254b9670068fe8c2652553eb144cfa26399 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Mon, 29 Jul 2019 16:24:33 +0800
Subject: [PATCH 1396/1835] net: sched: Fix a possible null-pointer dereference
 in dequeue_func()

[ Upstream commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c ]

In dequeue_func(), there is an if statement on line 74 to check whether
skb is NULL:
    if (skb)

When skb is NULL, it is used on line 77:
    prefetch(&skb->end);

Thus, a possible null-pointer dereference may occur.

To fix this bug, skb->end is used when skb is not NULL.

This bug is found by a static analysis tool STCheck written by us.

Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_codel.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 17cd81f84b5de..77fae0b7c6ee1 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx)
 	struct Qdisc *sch = ctx;
 	struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
 
-	if (skb)
+	if (skb) {
 		sch->qstats.backlog -= qdisc_pkt_len(skb);
-
-	prefetch(&skb->end); /* we'll need skb_shinfo() */
+		prefetch(&skb->end); /* we'll need skb_shinfo() */
+	}
 	return skb;
 }
 
-- 
GitLab


From cb20f74135df76ab386afa3bb1ad1af6b995f697 Mon Sep 17 00:00:00 2001
From: Roman Mashak <mrv@mojatatu.com>
Date: Fri, 2 Aug 2019 15:16:46 -0400
Subject: [PATCH 1397/1835] net sched: update vlan action for batched events
 operations

[ Upstream commit b35475c5491a14c8ce7a5046ef7bcda8a860581a ]

Add get_fill_size() routine used to calculate the action size
when building a batch of events.

Fixes: c7e2b9689 ("sched: introduce vlan action")
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_vlan.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 033d273afe502..20a7d4dc381c0 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -296,6 +296,14 @@ static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index,
 	return tcf_idr_search(tn, a, index);
 }
 
+static size_t tcf_vlan_get_fill_size(const struct tc_action *act)
+{
+	return nla_total_size(sizeof(struct tc_vlan))
+		+ nla_total_size(sizeof(u16)) /* TCA_VLAN_PUSH_VLAN_ID */
+		+ nla_total_size(sizeof(u16)) /* TCA_VLAN_PUSH_VLAN_PROTOCOL */
+		+ nla_total_size(sizeof(u8)); /* TCA_VLAN_PUSH_VLAN_PRIORITY */
+}
+
 static struct tc_action_ops act_vlan_ops = {
 	.kind		=	"vlan",
 	.type		=	TCA_ACT_VLAN,
@@ -305,6 +313,7 @@ static struct tc_action_ops act_vlan_ops = {
 	.init		=	tcf_vlan_init,
 	.cleanup	=	tcf_vlan_cleanup,
 	.walk		=	tcf_vlan_walker,
+	.get_fill_size	=	tcf_vlan_get_fill_size,
 	.lookup		=	tcf_vlan_search,
 	.size		=	sizeof(struct tcf_vlan),
 };
-- 
GitLab


From 51d240a144a5742977b4a421ea42b7da5bf1439c Mon Sep 17 00:00:00 2001
From: Dmytro Linkin <dmitrolin@mellanox.com>
Date: Thu, 1 Aug 2019 13:02:51 +0000
Subject: [PATCH 1398/1835] net: sched: use temporary variable for actions
 indexes

[ Upstream commit 7be8ef2cdbfe41a2e524b7c6cc3f8e6cfaa906e4 ]

Currently init call of all actions (except ipt) init their 'parm'
structure as a direct pointer to nla data in skb. This leads to race
condition when some of the filter actions were initialized successfully
(and were assigned with idr action index that was written directly
into nla data), but then were deleted and retried (due to following
action module missing or classifier-initiated retry), in which case
action init code tries to insert action to idr with index that was
assigned on previous iteration. During retry the index can be reused
by another action that was inserted concurrently, which causes
unintended action sharing between filters.
To fix described race condition, save action idr index to temporary
stack-allocated variable instead on nla data.

Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action")
Signed-off-by: Dmytro Linkin <dmitrolin@mellanox.com>
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_bpf.c        |  9 +++++----
 net/sched/act_connmark.c   |  9 +++++----
 net/sched/act_csum.c       |  9 +++++----
 net/sched/act_gact.c       |  8 +++++---
 net/sched/act_ife.c        |  8 +++++---
 net/sched/act_mirred.c     | 13 +++++++------
 net/sched/act_nat.c        |  9 +++++----
 net/sched/act_pedit.c      | 10 ++++++----
 net/sched/act_police.c     |  8 +++++---
 net/sched/act_sample.c     | 10 +++++-----
 net/sched/act_simple.c     | 10 ++++++----
 net/sched/act_skbedit.c    | 11 ++++++-----
 net/sched/act_skbmod.c     | 11 ++++++-----
 net/sched/act_tunnel_key.c |  8 +++++---
 net/sched/act_vlan.c       | 16 +++++++++-------
 15 files changed, 85 insertions(+), 64 deletions(-)

diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 0c68bc9cf0b4d..20fae5ca87faa 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -287,6 +287,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
 	struct tcf_bpf *prog;
 	bool is_bpf, is_ebpf;
 	int ret, res = 0;
+	u32 index;
 
 	if (!nla)
 		return -EINVAL;
@@ -299,13 +300,13 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
 		return -EINVAL;
 
 	parm = nla_data(tb[TCA_ACT_BPF_PARMS]);
-
-	ret = tcf_idr_check_alloc(tn, &parm->index, act, bind);
+	index = parm->index;
+	ret = tcf_idr_check_alloc(tn, &index, act, bind);
 	if (!ret) {
-		ret = tcf_idr_create(tn, parm->index, est, act,
+		ret = tcf_idr_create(tn, index, est, act,
 				     &act_bpf_ops, bind, true);
 		if (ret < 0) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 6f0f273f1139f..6054367479784 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -104,6 +104,7 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
 	struct tcf_connmark_info *ci;
 	struct tc_connmark *parm;
 	int ret = 0;
+	u32 index;
 
 	if (!nla)
 		return -EINVAL;
@@ -117,13 +118,13 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
 		return -EINVAL;
 
 	parm = nla_data(tb[TCA_CONNMARK_PARMS]);
-
-	ret = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	ret = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (!ret) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_connmark_ops, bind, false);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index b8a67ae3105ad..40437197e053e 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -55,6 +55,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
 	struct tc_csum *parm;
 	struct tcf_csum *p;
 	int ret = 0, err;
+	u32 index;
 
 	if (nla == NULL)
 		return -EINVAL;
@@ -66,13 +67,13 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
 	if (tb[TCA_CSUM_PARMS] == NULL)
 		return -EINVAL;
 	parm = nla_data(tb[TCA_CSUM_PARMS]);
-
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (!err) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_csum_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index cd1d9bd32ef9a..72d3347bdd41c 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -64,6 +64,7 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
 	struct tc_gact *parm;
 	struct tcf_gact *gact;
 	int ret = 0;
+	u32 index;
 	int err;
 #ifdef CONFIG_GACT_PROB
 	struct tc_gact_p *p_parm = NULL;
@@ -79,6 +80,7 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
 	if (tb[TCA_GACT_PARMS] == NULL)
 		return -EINVAL;
 	parm = nla_data(tb[TCA_GACT_PARMS]);
+	index = parm->index;
 
 #ifndef CONFIG_GACT_PROB
 	if (tb[TCA_GACT_PROB] != NULL)
@@ -91,12 +93,12 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
 	}
 #endif
 
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (!err) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_gact_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 915b6e94da635..24047e0e5db01 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -482,6 +482,7 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 	u8 *saddr = NULL;
 	bool exists = false;
 	int ret = 0;
+	u32 index;
 	int err;
 
 	if (!nla) {
@@ -509,7 +510,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 	if (!p)
 		return -ENOMEM;
 
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0) {
 		kfree(p);
 		return err;
@@ -521,10 +523,10 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a, &act_ife_ops,
+		ret = tcf_idr_create(tn, index, est, a, &act_ife_ops,
 				     bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			kfree(p);
 			return ret;
 		}
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index f767e78e38c98..548614bd9366c 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -104,6 +104,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
 	struct net_device *dev;
 	bool exists = false;
 	int ret, err;
+	u32 index;
 
 	if (!nla) {
 		NL_SET_ERR_MSG_MOD(extack, "Mirred requires attributes to be passed");
@@ -117,8 +118,8 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
 		return -EINVAL;
 	}
 	parm = nla_data(tb[TCA_MIRRED_PARMS]);
-
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -135,21 +136,21 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
 		if (exists)
 			tcf_idr_release(*a, bind);
 		else
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 		NL_SET_ERR_MSG_MOD(extack, "Unknown mirred option");
 		return -EINVAL;
 	}
 
 	if (!exists) {
 		if (!parm->ifindex) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			NL_SET_ERR_MSG_MOD(extack, "Specified device does not exist");
 			return -EINVAL;
 		}
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_mirred_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 4313aa102440e..619828920b97b 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -45,6 +45,7 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
 	struct tc_nat *parm;
 	int ret = 0, err;
 	struct tcf_nat *p;
+	u32 index;
 
 	if (nla == NULL)
 		return -EINVAL;
@@ -56,13 +57,13 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
 	if (tb[TCA_NAT_PARMS] == NULL)
 		return -EINVAL;
 	parm = nla_data(tb[TCA_NAT_PARMS]);
-
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (!err) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_nat_ops, bind, false);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index ca535a8585bc8..82d258b2a75ab 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -149,6 +149,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 	struct tcf_pedit *p;
 	int ret = 0, err;
 	int ksize;
+	u32 index;
 
 	if (!nla) {
 		NL_SET_ERR_MSG_MOD(extack, "Pedit requires attributes to be passed");
@@ -178,18 +179,19 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 	if (IS_ERR(keys_ex))
 		return PTR_ERR(keys_ex);
 
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (!err) {
 		if (!parm->nkeys) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			NL_SET_ERR_MSG_MOD(extack, "Pedit requires keys to be passed");
 			ret = -EINVAL;
 			goto out_free;
 		}
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_pedit_ops, bind, false);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			goto out_free;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 5d8bfa878477e..997c34db14919 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -85,6 +85,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
 	struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
 	struct tc_action_net *tn = net_generic(net, police_net_id);
 	bool exists = false;
+	u32 index;
 	int size;
 
 	if (nla == NULL)
@@ -101,7 +102,8 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
 		return -EINVAL;
 
 	parm = nla_data(tb[TCA_POLICE_TBF]);
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -109,10 +111,10 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
 		return 0;
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, NULL, a,
+		ret = tcf_idr_create(tn, index, NULL, a,
 				     &act_police_ops, bind, false);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index c7f5d630d97cf..ac37654ca2922 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -43,7 +43,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
 	struct tc_action_net *tn = net_generic(net, sample_net_id);
 	struct nlattr *tb[TCA_SAMPLE_MAX + 1];
 	struct psample_group *psample_group;
-	u32 psample_group_num, rate;
+	u32 psample_group_num, rate, index;
 	struct tc_sample *parm;
 	struct tcf_sample *s;
 	bool exists = false;
@@ -59,8 +59,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
 		return -EINVAL;
 
 	parm = nla_data(tb[TCA_SAMPLE_PARMS]);
-
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -68,10 +68,10 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
 		return 0;
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_sample_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 		ret = ACT_P_CREATED;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 52400d49f81f2..658efae71a09d 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -88,6 +88,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
 	struct tcf_defact *d;
 	bool exists = false;
 	int ret = 0, err;
+	u32 index;
 
 	if (nla == NULL)
 		return -EINVAL;
@@ -100,7 +101,8 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
 		return -EINVAL;
 
 	parm = nla_data(tb[TCA_DEF_PARMS]);
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -111,15 +113,15 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
 		if (exists)
 			tcf_idr_release(*a, bind);
 		else
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 		return -EINVAL;
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_simp_ops, bind, false);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 86d90fc5e97ea..7709710a41f72 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -107,6 +107,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
 	u16 *queue_mapping = NULL, *ptype = NULL;
 	bool exists = false;
 	int ret = 0, err;
+	u32 index;
 
 	if (nla == NULL)
 		return -EINVAL;
@@ -153,8 +154,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
 	}
 
 	parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
-
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -165,15 +166,15 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
 		if (exists)
 			tcf_idr_release(*a, bind);
 		else
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 		return -EINVAL;
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_skbedit_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 588077fafd6cc..3038493d18ca1 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -88,12 +88,12 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
 	struct nlattr *tb[TCA_SKBMOD_MAX + 1];
 	struct tcf_skbmod_params *p, *p_old;
 	struct tc_skbmod *parm;
+	u32 lflags = 0, index;
 	struct tcf_skbmod *d;
 	bool exists = false;
 	u8 *daddr = NULL;
 	u8 *saddr = NULL;
 	u16 eth_type = 0;
-	u32 lflags = 0;
 	int ret = 0, err;
 
 	if (!nla)
@@ -122,10 +122,11 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
 	}
 
 	parm = nla_data(tb[TCA_SKBMOD_PARMS]);
+	index = parm->index;
 	if (parm->flags & SKBMOD_F_SWAPMAC)
 		lflags = SKBMOD_F_SWAPMAC;
 
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -136,15 +137,15 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
 		if (exists)
 			tcf_idr_release(*a, bind);
 		else
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 		return -EINVAL;
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_skbmod_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 72d9c432e8b42..66bfe57e74ae0 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -224,6 +224,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 	__be16 flags;
 	u8 tos, ttl;
 	int ret = 0;
+	u32 index;
 	int err;
 
 	if (!nla) {
@@ -244,7 +245,8 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 	}
 
 	parm = nla_data(tb[TCA_TUNNEL_KEY_PARMS]);
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -338,7 +340,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 	}
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_tunnel_key_ops, bind, true);
 		if (ret) {
 			NL_SET_ERR_MSG(extack, "Cannot create TC IDR");
@@ -384,7 +386,7 @@ err_out:
 	if (exists)
 		tcf_idr_release(*a, bind);
 	else
-		tcf_idr_cleanup(tn, parm->index);
+		tcf_idr_cleanup(tn, index);
 	return ret;
 }
 
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 20a7d4dc381c0..da993edd2e40b 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -118,6 +118,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 	u8 push_prio = 0;
 	bool exists = false;
 	int ret = 0, err;
+	u32 index;
 
 	if (!nla)
 		return -EINVAL;
@@ -129,7 +130,8 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 	if (!tb[TCA_VLAN_PARMS])
 		return -EINVAL;
 	parm = nla_data(tb[TCA_VLAN_PARMS]);
-	err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+	index = parm->index;
+	err = tcf_idr_check_alloc(tn, &index, a, bind);
 	if (err < 0)
 		return err;
 	exists = err;
@@ -145,7 +147,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 			if (exists)
 				tcf_idr_release(*a, bind);
 			else
-				tcf_idr_cleanup(tn, parm->index);
+				tcf_idr_cleanup(tn, index);
 			return -EINVAL;
 		}
 		push_vid = nla_get_u16(tb[TCA_VLAN_PUSH_VLAN_ID]);
@@ -153,7 +155,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 			if (exists)
 				tcf_idr_release(*a, bind);
 			else
-				tcf_idr_cleanup(tn, parm->index);
+				tcf_idr_cleanup(tn, index);
 			return -ERANGE;
 		}
 
@@ -167,7 +169,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 				if (exists)
 					tcf_idr_release(*a, bind);
 				else
-					tcf_idr_cleanup(tn, parm->index);
+					tcf_idr_cleanup(tn, index);
 				return -EPROTONOSUPPORT;
 			}
 		} else {
@@ -181,16 +183,16 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 		if (exists)
 			tcf_idr_release(*a, bind);
 		else
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 		return -EINVAL;
 	}
 	action = parm->v_action;
 
 	if (!exists) {
-		ret = tcf_idr_create(tn, parm->index, est, a,
+		ret = tcf_idr_create(tn, index, est, a,
 				     &act_vlan_ops, bind, true);
 		if (ret) {
-			tcf_idr_cleanup(tn, parm->index);
+			tcf_idr_cleanup(tn, index);
 			return ret;
 		}
 
-- 
GitLab


From ce58a3655121936ebf353db542315e3531233113 Mon Sep 17 00:00:00 2001
From: Ursula Braun <ubraun@linux.ibm.com>
Date: Fri, 2 Aug 2019 10:16:38 +0200
Subject: [PATCH 1399/1835] net/smc: do not schedule tx_work in SMC_CLOSED
 state

[ Upstream commit f9cedf1a9b1cdcfb0c52edb391d01771e43994a4 ]

The setsockopts options TCP_NODELAY and TCP_CORK may schedule the
tx worker. Make sure the socket is not yet moved into SMC_CLOSED
state (for instance by a shutdown SHUT_RDWR call).

Reported-by: syzbot+92209502e7aab127c75f@syzkaller.appspotmail.com
Reported-by: syzbot+b972214bb803a343f4fe@syzkaller.appspotmail.com
Fixes: 01d2f7e2cdd31 ("net/smc: sockopts TCP_NODELAY and TCP_CORK")
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/smc/af_smc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 9bbab6ba2dab0..26dcd02b2d0ce 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1680,14 +1680,18 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
 		}
 		break;
 	case TCP_NODELAY:
-		if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+		if (sk->sk_state != SMC_INIT &&
+		    sk->sk_state != SMC_LISTEN &&
+		    sk->sk_state != SMC_CLOSED) {
 			if (val && !smc->use_fallback)
 				mod_delayed_work(system_wq, &smc->conn.tx_work,
 						 0);
 		}
 		break;
 	case TCP_CORK:
-		if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+		if (sk->sk_state != SMC_INIT &&
+		    sk->sk_state != SMC_LISTEN &&
+		    sk->sk_state != SMC_CLOSED) {
 			if (!val && !smc->use_fallback)
 				mod_delayed_work(system_wq, &smc->conn.tx_work,
 						 0);
-- 
GitLab


From cd7f02fecac188f3363ef1d420b284c2239947e0 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 5 Aug 2019 12:00:55 +0200
Subject: [PATCH 1400/1835] NFC: nfcmrvl: fix gpio-handling regression

[ Upstream commit c3953a3c2d3175d2f9f0304c9a1ba89e7743c5e4 ]

Fix two reset-gpio sanity checks which were never converted to use
gpio_is_valid(), and make sure to use -EINVAL to indicate a missing
reset line also for the UART-driver module parameter and for the USB
driver.

This specifically prevents the UART and USB drivers from incidentally
trying to request and use gpio 0, and also avoids triggering a WARN() in
gpio_to_desc() during probe when no valid reset line has been specified.

Fixes: e33a3f84f88f ("NFC: nfcmrvl: allow gpio 0 for reset signalling")
Reported-by: syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com
Tested-by: syzbot+cf35b76f35e068a1107f@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nfc/nfcmrvl/main.c | 4 ++--
 drivers/nfc/nfcmrvl/uart.c | 4 ++--
 drivers/nfc/nfcmrvl/usb.c  | 1 +
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
index e65d027b91faf..529be35ac1782 100644
--- a/drivers/nfc/nfcmrvl/main.c
+++ b/drivers/nfc/nfcmrvl/main.c
@@ -244,7 +244,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
 	/* Reset possible fault of previous session */
 	clear_bit(NFCMRVL_PHY_ERROR, &priv->flags);
 
-	if (priv->config.reset_n_io) {
+	if (gpio_is_valid(priv->config.reset_n_io)) {
 		nfc_info(priv->dev, "reset the chip\n");
 		gpio_set_value(priv->config.reset_n_io, 0);
 		usleep_range(5000, 10000);
@@ -255,7 +255,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
 
 void nfcmrvl_chip_halt(struct nfcmrvl_private *priv)
 {
-	if (priv->config.reset_n_io)
+	if (gpio_is_valid(priv->config.reset_n_io))
 		gpio_set_value(priv->config.reset_n_io, 0);
 }
 
diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
index 9a22056e8d9ee..e5a622ce4b951 100644
--- a/drivers/nfc/nfcmrvl/uart.c
+++ b/drivers/nfc/nfcmrvl/uart.c
@@ -26,7 +26,7 @@
 static unsigned int hci_muxed;
 static unsigned int flow_control;
 static unsigned int break_control;
-static unsigned int reset_n_io;
+static int reset_n_io = -EINVAL;
 
 /*
 ** NFCMRVL NCI OPS
@@ -231,5 +231,5 @@ MODULE_PARM_DESC(break_control, "Tell if UART driver must drive break signal.");
 module_param(hci_muxed, uint, 0);
 MODULE_PARM_DESC(hci_muxed, "Tell if transport is muxed in HCI one.");
 
-module_param(reset_n_io, uint, 0);
+module_param(reset_n_io, int, 0);
 MODULE_PARM_DESC(reset_n_io, "GPIO that is wired to RESET_N signal.");
diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
index 945cc903d8f11..888e298f610b8 100644
--- a/drivers/nfc/nfcmrvl/usb.c
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -305,6 +305,7 @@ static int nfcmrvl_probe(struct usb_interface *intf,
 
 	/* No configuration for USB */
 	memset(&config, 0, sizeof(config));
+	config.reset_n_io = -EINVAL;
 
 	nfc_info(&udev->dev, "intf %p id %p\n", intf, id);
 
-- 
GitLab


From eaa34bd4f7b5e505c6c211cb906f6a2ce2242e4c Mon Sep 17 00:00:00 2001
From: Claudiu Manoil <claudiu.manoil@nxp.com>
Date: Thu, 25 Jul 2019 16:33:18 +0300
Subject: [PATCH 1401/1835] ocelot: Cancel delayed work before wq destruction

[ Upstream commit c5d139697d5d9ecf9c7cd92d7d7838a173508900 ]

Make sure the delayed work for stats update is not pending before
wq destruction.
This fixes the module unload path.
The issue is there since day 1.

Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")

Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mscc/ocelot.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 10291198decd6..732ba21d3369d 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -1767,6 +1767,7 @@ EXPORT_SYMBOL(ocelot_init);
 
 void ocelot_deinit(struct ocelot *ocelot)
 {
+	cancel_delayed_work(&ocelot->stats_work);
 	destroy_workqueue(ocelot->stats_queue);
 	mutex_destroy(&ocelot->stats_lock);
 }
-- 
GitLab


From 5295d651548559e90245a5d744566af98d951df1 Mon Sep 17 00:00:00 2001
From: Taras Kondratiuk <takondra@cisco.com>
Date: Mon, 29 Jul 2019 22:15:07 +0000
Subject: [PATCH 1402/1835] tipc: compat: allow tipc commands without arguments

[ Upstream commit 4da5f0018eef4c0de31675b670c80e82e13e99d1 ]

Commit 2753ca5d9009 ("tipc: fix uninit-value in tipc_nl_compat_doit")
broke older tipc tools that use compat interface (e.g. tipc-config from
tipcutils package):

% tipc-config -p
operation not supported

The commit started to reject TIPC netlink compat messages that do not
have attributes. It is too restrictive because some of such messages are
valid (they don't need any arguments):

% grep 'tx none' include/uapi/linux/tipc_config.h
#define  TIPC_CMD_NOOP              0x0000    /* tx none, rx none */
#define  TIPC_CMD_GET_MEDIA_NAMES   0x0002    /* tx none, rx media_name(s) */
#define  TIPC_CMD_GET_BEARER_NAMES  0x0003    /* tx none, rx bearer_name(s) */
#define  TIPC_CMD_SHOW_PORTS        0x0006    /* tx none, rx ultra_string */
#define  TIPC_CMD_GET_REMOTE_MNG    0x4003    /* tx none, rx unsigned */
#define  TIPC_CMD_GET_MAX_PORTS     0x4004    /* tx none, rx unsigned */
#define  TIPC_CMD_GET_NETID         0x400B    /* tx none, rx unsigned */
#define  TIPC_CMD_NOT_NET_ADMIN     0xC001    /* tx none, rx none */

This patch relaxes the original fix and rejects messages without
arguments only if such arguments are expected by a command (reg_type is
non zero).

Fixes: 2753ca5d9009 ("tipc: fix uninit-value in tipc_nl_compat_doit")
Cc: stable@vger.kernel.org
Signed-off-by: Taras Kondratiuk <takondra@cisco.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/netlink_compat.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 85ebb675600c5..318c541970ecd 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -55,6 +55,7 @@ struct tipc_nl_compat_msg {
 	int rep_type;
 	int rep_size;
 	int req_type;
+	int req_size;
 	struct net *net;
 	struct sk_buff *rep;
 	struct tlv_desc *req;
@@ -257,7 +258,8 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
 	int err;
 	struct sk_buff *arg;
 
-	if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
+	if (msg->req_type && (!msg->req_size ||
+			      !TLV_CHECK_TYPE(msg->req, msg->req_type)))
 		return -EINVAL;
 
 	msg->rep = tipc_tlv_alloc(msg->rep_size);
@@ -354,7 +356,8 @@ static int tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
 {
 	int err;
 
-	if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
+	if (msg->req_type && (!msg->req_size ||
+			      !TLV_CHECK_TYPE(msg->req, msg->req_type)))
 		return -EINVAL;
 
 	err = __tipc_nl_compat_doit(cmd, msg);
@@ -1276,8 +1279,8 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
 		goto send;
 	}
 
-	len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
-	if (!len || !TLV_OK(msg.req, len)) {
+	msg.req_size = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
+	if (msg.req_size && !TLV_OK(msg.req, msg.req_size)) {
 		msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
 		err = -EOPNOTSUPP;
 		goto send;
-- 
GitLab


From f378724e10ced69c5e55db2e23ad350ede76f174 Mon Sep 17 00:00:00 2001
From: Alexis Bauvin <abauvin@scaleway.com>
Date: Tue, 23 Jul 2019 16:23:01 +0200
Subject: [PATCH 1403/1835] tun: mark small packets as owned by the tap sock

[ Upstream commit 4b663366246be1d1d4b1b8b01245b2e88ad9e706 ]

- v1 -> v2: Move skb_set_owner_w to __tun_build_skb to reduce patch size

Small packets going out of a tap device go through an optimized code
path that uses build_skb() rather than sock_alloc_send_pskb(). The
latter calls skb_set_owner_w(), but the small packet code path does not.

The net effect is that small packets are not owned by the userland
application's socket (e.g. QEMU), while large packets are.
This can be seen with a TCP session, where packets are not owned when
the window size is small enough (around PAGE_SIZE), while they are once
the window grows (note that this requires the host to support virtio
tso for the guest to offload segmentation).
All this leads to inconsistent behaviour in the kernel, especially on
netfilter modules that uses sk->socket (e.g. xt_owner).

Fixes: 66ccbc9c87c2 ("tap: use build_skb() for small packet")
Signed-off-by: Alexis Bauvin <abauvin@scaleway.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/tun.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b67fee56ec81b..5fa7047ea3618 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1682,6 +1682,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
 
 	skb_reserve(skb, pad - delta);
 	skb_put(skb, len);
+	skb_set_owner_w(skb, tfile->socket.sk);
 	get_page(alloc_frag->page);
 	alloc_frag->offset += buflen;
 
-- 
GitLab


From cd84a10792f08d3d0cc1cbeed07634e454fe9abd Mon Sep 17 00:00:00 2001
From: Edward Srouji <edwards@mellanox.com>
Date: Tue, 23 Jul 2019 10:12:55 +0300
Subject: [PATCH 1404/1835] net/mlx5: Fix modify_cq_in alignment

[ Upstream commit 7a32f2962c56d9d8a836b4469855caeee8766bd4 ]

Fix modify_cq_in alignment to match the device specification.
After this fix the 'cq_umem_valid' field will be in the right offset.

Cc: <stable@vger.kernel.org> # 4.19
Fixes: bd37197554eb ("net/mlx5: Update mlx5_ifc with DEVX UID bits")
Signed-off-by: Edward Srouji <edwards@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/mlx5/mlx5_ifc.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index f043d65b9bac2..177f11c96187b 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -5623,7 +5623,12 @@ struct mlx5_ifc_modify_cq_in_bits {
 
 	struct mlx5_ifc_cqc_bits cq_context;
 
-	u8         reserved_at_280[0x600];
+	u8         reserved_at_280[0x60];
+
+ 	u8         cq_umem_valid[0x1];
+	u8         reserved_at_2e1[0x1f];
+
+	u8         reserved_at_300[0x580];
 
 	u8         pas[0][0x40];
 };
-- 
GitLab


From 0ccf47265e4cb7fd13d339ee20a84bdbdbd466ef Mon Sep 17 00:00:00 2001
From: Ariel Levkovich <lariel@mellanox.com>
Date: Sat, 6 Jul 2019 18:06:15 +0300
Subject: [PATCH 1405/1835] net/mlx5e: Prevent encap flow counter update async
 to user query

[ Upstream commit 90bb769291161cf25a818d69cf608c181654473e ]

This patch prevents a race between user invoked cached counters
query and a neighbor last usage updater.

The cached flow counter stats can be queried by calling
"mlx5_fc_query_cached" which provides the number of bytes and
packets that passed via this flow since the last time this counter
was queried.
It does so by reducting the last saved stats from the current, cached
stats and then updating the last saved stats with the cached stats.
It also provide the lastuse value for that flow.

Since "mlx5e_tc_update_neigh_used_value" needs to retrieve the
last usage time of encapsulation flows, it calls the flow counter
query method periodically and async to user queries of the flow counter
using cls_flower.
This call is causing the driver to update the last reported bytes and
packets from the cache and therefore, future user queries of the flow
stats will return lower than expected number for bytes and packets
since the last saved stats in the driver was updated async to the last
saved stats in cls_flower.

This causes wrong stats presentation of encapsulation flows to user.

Since the neighbor usage updater only needs the lastuse stats from the
cached counter, the fix is to use a dedicated lastuse query call that
returns the lastuse value without synching between the cached stats and
the last saved stats.

Fixes: f6dfb4c3f216 ("net/mlx5e: Update neighbour 'used' state using HW flow rules counters")
Signed-off-by: Ariel Levkovich <lariel@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c       | 4 ++--
 drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c | 5 +++++
 include/linux/mlx5/fs.h                               | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 9f7f8425f6767..c8928ce69185f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -992,13 +992,13 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,
 void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
 {
 	struct mlx5e_neigh *m_neigh = &nhe->m_neigh;
-	u64 bytes, packets, lastuse = 0;
 	struct mlx5e_tc_flow *flow;
 	struct mlx5e_encap_entry *e;
 	struct mlx5_fc *counter;
 	struct neigh_table *tbl;
 	bool neigh_used = false;
 	struct neighbour *n;
+	u64 lastuse;
 
 	if (m_neigh->family == AF_INET)
 		tbl = &arp_tbl;
@@ -1015,7 +1015,7 @@ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
 		list_for_each_entry(flow, &e->flows, encap) {
 			if (flow->flags & MLX5E_TC_FLOW_OFFLOADED) {
 				counter = mlx5_flow_rule_counter(flow->rule[0]);
-				mlx5_fc_query_cached(counter, &bytes, &packets, &lastuse);
+				lastuse = mlx5_fc_query_lastuse(counter);
 				if (time_after((unsigned long)lastuse, nhe->reported_lastuse)) {
 					neigh_used = true;
 					break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index 58af6be13dfa8..808ddd732e044 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -321,6 +321,11 @@ int mlx5_fc_query(struct mlx5_core_dev *dev, struct mlx5_fc *counter,
 }
 EXPORT_SYMBOL(mlx5_fc_query);
 
+u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter)
+{
+	return counter->cache.lastuse;
+}
+
 void mlx5_fc_query_cached(struct mlx5_fc *counter,
 			  u64 *bytes, u64 *packets, u64 *lastuse)
 {
diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h
index 804516e4f4832..3386399feadc8 100644
--- a/include/linux/mlx5/fs.h
+++ b/include/linux/mlx5/fs.h
@@ -188,6 +188,7 @@ int mlx5_modify_rule_destination(struct mlx5_flow_handle *handler,
 struct mlx5_fc *mlx5_flow_rule_counter(struct mlx5_flow_handle *handler);
 struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging);
 void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter);
+u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter);
 void mlx5_fc_query_cached(struct mlx5_fc *counter,
 			  u64 *bytes, u64 *packets, u64 *lastuse);
 int mlx5_fc_query(struct mlx5_core_dev *dev, struct mlx5_fc *counter,
-- 
GitLab


From 473430ed61174498db9fcac8bbfee122657d3933 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sat, 27 Jul 2019 12:45:10 +0200
Subject: [PATCH 1406/1835] r8169: don't use MSI before RTL8168d
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 003bd5b4a7b4a94b501e3a1e2e7c9df6b2a94ed4 ]

It was reported that after resuming from suspend network fails with
error "do_IRQ: 3.38 No irq handler for vector", see [0]. Enabling WoL
can work around the issue, but the only actual fix is to disable MSI.
So let's mimic the behavior of the vendor driver and disable MSI on
all chip versions before RTL8168d.

[0] https://bugzilla.kernel.org/show_bug.cgi?id=204079

Fixes: 6c6aa15fdea5 ("r8169: improve interrupt handling")
Reported-by: Dušan Dragić <dragic.dusan@gmail.com>
Tested-by: Dušan Dragić <dragic.dusan@gmail.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/realtek/r8169.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index a6992c4c7313b..0c8b7146637e1 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7239,13 +7239,18 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)
 {
 	unsigned int flags;
 
-	if (tp->mac_version <= RTL_GIGA_MAC_VER_06) {
+	switch (tp->mac_version) {
+	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
 		RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
 		RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
 		RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+		/* fall through */
+	case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_24:
 		flags = PCI_IRQ_LEGACY;
-	} else {
+		break;
+	default:
 		flags = PCI_IRQ_ALL_TYPES;
+		break;
 	}
 
 	return pci_alloc_irq_vectors(tp->pci_dev, 1, 1, flags);
-- 
GitLab


From e6e9bcef12ca2e2119f999d38dbca5147b06bc14 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 30 Jul 2019 21:25:20 +0200
Subject: [PATCH 1407/1835] compat_ioctl: pppoe: fix PPPOEIOCSFWD handling

[ Upstream commit 055d88242a6046a1ceac3167290f054c72571cd9 ]

Support for handling the PPPOEIOCSFWD ioctl in compat mode was added in
linux-2.5.69 along with hundreds of other commands, but was always broken
sincen only the structure is compatible, but the command number is not,
due to the size being sizeof(size_t), or at first sizeof(sizeof((struct
sockaddr_pppox)), which is different on 64-bit architectures.

Guillaume Nault adds:

  And the implementation was broken until 2016 (see 29e73269aa4d ("pppoe:
  fix reference counting in PPPoE proxy")), and nobody ever noticed. I
  should probably have removed this ioctl entirely instead of fixing it.
  Clearly, it has never been used.

Fix it by adding a compat_ioctl handler for all pppoe variants that
translates the command number and then calls the regular ioctl function.

All other ioctl commands handled by pppoe are compatible between 32-bit
and 64-bit, and require compat_ptr() conversion.

This should apply to all stable kernels.

Acked-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ppp/pppoe.c  |  3 +++
 drivers/net/ppp/pppox.c  | 13 +++++++++++++
 drivers/net/ppp/pptp.c   |  3 +++
 fs/compat_ioctl.c        |  3 ---
 include/linux/if_pppox.h |  3 +++
 net/l2tp/l2tp_ppp.c      |  3 +++
 6 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index f22639f0116a4..c04f3dc17d76f 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -1120,6 +1120,9 @@ static const struct proto_ops pppoe_ops = {
 	.recvmsg	= pppoe_recvmsg,
 	.mmap		= sock_no_mmap,
 	.ioctl		= pppox_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl	= pppox_compat_ioctl,
+#endif
 };
 
 static const struct pppox_proto pppoe_proto = {
diff --git a/drivers/net/ppp/pppox.c b/drivers/net/ppp/pppox.c
index c0599b3b23c06..9128e42e33e74 100644
--- a/drivers/net/ppp/pppox.c
+++ b/drivers/net/ppp/pppox.c
@@ -22,6 +22,7 @@
 #include <linux/string.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/compat.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
 #include <linux/net.h>
@@ -103,6 +104,18 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 
 EXPORT_SYMBOL(pppox_ioctl);
 
+#ifdef CONFIG_COMPAT
+int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+	if (cmd == PPPOEIOCSFWD32)
+		cmd = PPPOEIOCSFWD;
+
+	return pppox_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
+}
+
+EXPORT_SYMBOL(pppox_compat_ioctl);
+#endif
+
 static int pppox_create(struct net *net, struct socket *sock, int protocol,
 			int kern)
 {
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 7321a4eca2354..9ad3ff40a563f 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -633,6 +633,9 @@ static const struct proto_ops pptp_ops = {
 	.recvmsg    = sock_no_recvmsg,
 	.mmap       = sock_no_mmap,
 	.ioctl      = pppox_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = pppox_compat_ioctl,
+#endif
 };
 
 static const struct pppox_proto pppox_pptp_proto = {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index a9b00942e87d7..8f08095ee54e9 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -894,9 +894,6 @@ COMPATIBLE_IOCTL(PPPIOCDISCONN)
 COMPATIBLE_IOCTL(PPPIOCATTCHAN)
 COMPATIBLE_IOCTL(PPPIOCGCHAN)
 COMPATIBLE_IOCTL(PPPIOCGL2TPSTATS)
-/* PPPOX */
-COMPATIBLE_IOCTL(PPPOEIOCSFWD)
-COMPATIBLE_IOCTL(PPPOEIOCDFWD)
 /* Big A */
 /* sparc only */
 /* Big Q for sound/OSS */
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index ba7a9b0c7c57e..24e9b360da659 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -84,6 +84,9 @@ extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
 extern void unregister_pppox_proto(int proto_num);
 extern void pppox_unbind_sock(struct sock *sk);/* delete ppp-channel binding */
 extern int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
+extern int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
+
+#define PPPOEIOCSFWD32    _IOW(0xB1 ,0, compat_size_t)
 
 /* PPPoX socket states */
 enum {
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 04d9946dcdba6..c0956781665e1 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1686,6 +1686,9 @@ static const struct proto_ops pppol2tp_ops = {
 	.recvmsg	= pppol2tp_recvmsg,
 	.mmap		= sock_no_mmap,
 	.ioctl		= pppox_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = pppox_compat_ioctl,
+#endif
 };
 
 static const struct pppox_proto pppol2tp_proto = {
-- 
GitLab


From 7528e95b7519d24027a4362e2a05a12d4747586f Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Fri, 31 May 2019 10:38:57 -0700
Subject: [PATCH 1408/1835] cgroup: Call cgroup_release() before
 __exit_signal()

commit 6b115bf58e6f013ca75e7115aabcbd56c20ff31d upstream.

cgroup_release() calls cgroup_subsys->release() which is used by the
pids controller to uncharge its pid.  We want to use it to manage
iteration of dying tasks which requires putting it before
__unhash_process().  Move cgroup_release() above __exit_signal().
While this makes it uncharge before the pid is freed, pid is RCU freed
anyway and the window is very narrow.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/exit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index 5c0964dc805ac..e10de9836dd77 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -194,6 +194,7 @@ repeat:
 	rcu_read_unlock();
 
 	proc_flush_task(p);
+	cgroup_release(p);
 
 	write_lock_irq(&tasklist_lock);
 	ptrace_release_task(p);
@@ -219,7 +220,6 @@ repeat:
 	}
 
 	write_unlock_irq(&tasklist_lock);
-	cgroup_release(p);
 	release_thread(p);
 	call_rcu(&p->rcu, delayed_put_task_struct);
 
-- 
GitLab


From 370b9e6399da09fe10005fe455878b356de7b85f Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Fri, 31 May 2019 10:38:58 -0700
Subject: [PATCH 1409/1835] cgroup: Implement css_task_iter_skip()

commit b636fd38dc40113f853337a7d2a6885ad23b8811 upstream.

When a task is moved out of a cset, task iterators pointing to the
task are advanced using the normal css_task_iter_advance() call.  This
is fine but we'll be tracking dying tasks on csets and thus moving
tasks from cset->tasks to (to be added) cset->dying_tasks.  When we
remove a task from cset->tasks, if we advance the iterators, they may
move over to the next cset before we had the chance to add the task
back on the dying list, which can allow the task to escape iteration.

This patch separates out skipping from advancing.  Skipping only moves
the affected iterators to the next pointer rather than fully advancing
it and the following advancing will recognize that the cursor has
already been moved forward and do the rest of advancing.  This ensures
that when a task moves from one list to another in its cset, as long
as it moves in the right direction, it's always visible to iteration.

This doesn't cause any visible behavior changes.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/cgroup.h |  3 +++
 kernel/cgroup/cgroup.c | 60 +++++++++++++++++++++++++-----------------
 2 files changed, 39 insertions(+), 24 deletions(-)

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 8937d48a5389d..f85e65b248b77 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -43,6 +43,9 @@
 /* walk all threaded css_sets in the domain */
 #define CSS_TASK_ITER_THREADED		(1U << 1)
 
+/* internal flags */
+#define CSS_TASK_ITER_SKIPPED		(1U << 16)
+
 /* a css_task_iter should be treated as an opaque object */
 struct css_task_iter {
 	struct cgroup_subsys		*ss;
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 81441117f6114..c093e187f6a6e 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -212,7 +212,8 @@ static struct cftype cgroup_base_files[];
 
 static int cgroup_apply_control(struct cgroup *cgrp);
 static void cgroup_finalize_control(struct cgroup *cgrp, int ret);
-static void css_task_iter_advance(struct css_task_iter *it);
+static void css_task_iter_skip(struct css_task_iter *it,
+			       struct task_struct *task);
 static int cgroup_destroy_locked(struct cgroup *cgrp);
 static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 					      struct cgroup_subsys *ss);
@@ -775,6 +776,21 @@ static void css_set_update_populated(struct css_set *cset, bool populated)
 		cgroup_update_populated(link->cgrp, populated);
 }
 
+/*
+ * @task is leaving, advance task iterators which are pointing to it so
+ * that they can resume at the next position.  Advancing an iterator might
+ * remove it from the list, use safe walk.  See css_task_iter_skip() for
+ * details.
+ */
+static void css_set_skip_task_iters(struct css_set *cset,
+				    struct task_struct *task)
+{
+	struct css_task_iter *it, *pos;
+
+	list_for_each_entry_safe(it, pos, &cset->task_iters, iters_node)
+		css_task_iter_skip(it, task);
+}
+
 /**
  * css_set_move_task - move a task from one css_set to another
  * @task: task being moved
@@ -800,22 +816,9 @@ static void css_set_move_task(struct task_struct *task,
 		css_set_update_populated(to_cset, true);
 
 	if (from_cset) {
-		struct css_task_iter *it, *pos;
-
 		WARN_ON_ONCE(list_empty(&task->cg_list));
 
-		/*
-		 * @task is leaving, advance task iterators which are
-		 * pointing to it so that they can resume at the next
-		 * position.  Advancing an iterator might remove it from
-		 * the list, use safe walk.  See css_task_iter_advance*()
-		 * for details.
-		 */
-		list_for_each_entry_safe(it, pos, &from_cset->task_iters,
-					 iters_node)
-			if (it->task_pos == &task->cg_list)
-				css_task_iter_advance(it);
-
+		css_set_skip_task_iters(from_cset, task);
 		list_del_init(&task->cg_list);
 		if (!css_set_populated(from_cset))
 			css_set_update_populated(from_cset, false);
@@ -4183,10 +4186,19 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
 	list_add(&it->iters_node, &cset->task_iters);
 }
 
-static void css_task_iter_advance(struct css_task_iter *it)
+static void css_task_iter_skip(struct css_task_iter *it,
+			       struct task_struct *task)
 {
-	struct list_head *next;
+	lockdep_assert_held(&css_set_lock);
+
+	if (it->task_pos == &task->cg_list) {
+		it->task_pos = it->task_pos->next;
+		it->flags |= CSS_TASK_ITER_SKIPPED;
+	}
+}
 
+static void css_task_iter_advance(struct css_task_iter *it)
+{
 	lockdep_assert_held(&css_set_lock);
 repeat:
 	if (it->task_pos) {
@@ -4195,15 +4207,15 @@ repeat:
 		 * consumed first and then ->mg_tasks.  After ->mg_tasks,
 		 * we move onto the next cset.
 		 */
-		next = it->task_pos->next;
-
-		if (next == it->tasks_head)
-			next = it->mg_tasks_head->next;
+		if (it->flags & CSS_TASK_ITER_SKIPPED)
+			it->flags &= ~CSS_TASK_ITER_SKIPPED;
+		else
+			it->task_pos = it->task_pos->next;
 
-		if (next == it->mg_tasks_head)
+		if (it->task_pos == it->tasks_head)
+			it->task_pos = it->mg_tasks_head->next;
+		if (it->task_pos == it->mg_tasks_head)
 			css_task_iter_advance_css_set(it);
-		else
-			it->task_pos = next;
 	} else {
 		/* called from start, proceed to the first cset */
 		css_task_iter_advance_css_set(it);
-- 
GitLab


From 4340d175b89896d069c1e875f5b98c80a408f680 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Fri, 31 May 2019 10:38:58 -0700
Subject: [PATCH 1410/1835] cgroup: Include dying leaders with live threads in
 PROCS iterations

commit c03cd7738a83b13739f00546166969342c8ff014 upstream.

CSS_TASK_ITER_PROCS currently iterates live group leaders; however,
this means that a process with dying leader and live threads will be
skipped.  IOW, cgroup.procs might be empty while cgroup.threads isn't,
which is confusing to say the least.

Fix it by making cset track dying tasks and include dying leaders with
live threads in PROCS iteration.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Topi Miettinen <toiwoton@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/cgroup-defs.h |  1 +
 include/linux/cgroup.h      |  1 +
 kernel/cgroup/cgroup.c      | 44 +++++++++++++++++++++++++++++++------
 3 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index a6090154b2ab7..a01ebb630abc8 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -207,6 +207,7 @@ struct css_set {
 	 */
 	struct list_head tasks;
 	struct list_head mg_tasks;
+	struct list_head dying_tasks;
 
 	/* all css_task_iters currently walking this cset */
 	struct list_head task_iters;
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index f85e65b248b77..b4854b48a4f3d 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -60,6 +60,7 @@ struct css_task_iter {
 	struct list_head		*task_pos;
 	struct list_head		*tasks_head;
 	struct list_head		*mg_tasks_head;
+	struct list_head		*dying_tasks_head;
 
 	struct css_set			*cur_cset;
 	struct css_set			*cur_dcset;
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c093e187f6a6e..89dd464f6862b 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -673,6 +673,7 @@ struct css_set init_css_set = {
 	.dom_cset		= &init_css_set,
 	.tasks			= LIST_HEAD_INIT(init_css_set.tasks),
 	.mg_tasks		= LIST_HEAD_INIT(init_css_set.mg_tasks),
+	.dying_tasks		= LIST_HEAD_INIT(init_css_set.dying_tasks),
 	.task_iters		= LIST_HEAD_INIT(init_css_set.task_iters),
 	.threaded_csets		= LIST_HEAD_INIT(init_css_set.threaded_csets),
 	.cgrp_links		= LIST_HEAD_INIT(init_css_set.cgrp_links),
@@ -1145,6 +1146,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
 	cset->dom_cset = cset;
 	INIT_LIST_HEAD(&cset->tasks);
 	INIT_LIST_HEAD(&cset->mg_tasks);
+	INIT_LIST_HEAD(&cset->dying_tasks);
 	INIT_LIST_HEAD(&cset->task_iters);
 	INIT_LIST_HEAD(&cset->threaded_csets);
 	INIT_HLIST_NODE(&cset->hlist);
@@ -4152,15 +4154,18 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
 			it->task_pos = NULL;
 			return;
 		}
-	} while (!css_set_populated(cset));
+	} while (!css_set_populated(cset) && !list_empty(&cset->dying_tasks));
 
 	if (!list_empty(&cset->tasks))
 		it->task_pos = cset->tasks.next;
-	else
+	else if (!list_empty(&cset->mg_tasks))
 		it->task_pos = cset->mg_tasks.next;
+	else
+		it->task_pos = cset->dying_tasks.next;
 
 	it->tasks_head = &cset->tasks;
 	it->mg_tasks_head = &cset->mg_tasks;
+	it->dying_tasks_head = &cset->dying_tasks;
 
 	/*
 	 * We don't keep css_sets locked across iteration steps and thus
@@ -4199,6 +4204,8 @@ static void css_task_iter_skip(struct css_task_iter *it,
 
 static void css_task_iter_advance(struct css_task_iter *it)
 {
+	struct task_struct *task;
+
 	lockdep_assert_held(&css_set_lock);
 repeat:
 	if (it->task_pos) {
@@ -4215,17 +4222,32 @@ repeat:
 		if (it->task_pos == it->tasks_head)
 			it->task_pos = it->mg_tasks_head->next;
 		if (it->task_pos == it->mg_tasks_head)
+			it->task_pos = it->dying_tasks_head->next;
+		if (it->task_pos == it->dying_tasks_head)
 			css_task_iter_advance_css_set(it);
 	} else {
 		/* called from start, proceed to the first cset */
 		css_task_iter_advance_css_set(it);
 	}
 
-	/* if PROCS, skip over tasks which aren't group leaders */
-	if ((it->flags & CSS_TASK_ITER_PROCS) && it->task_pos &&
-	    !thread_group_leader(list_entry(it->task_pos, struct task_struct,
-					    cg_list)))
-		goto repeat;
+	if (!it->task_pos)
+		return;
+
+	task = list_entry(it->task_pos, struct task_struct, cg_list);
+
+	if (it->flags & CSS_TASK_ITER_PROCS) {
+		/* if PROCS, skip over tasks which aren't group leaders */
+		if (!thread_group_leader(task))
+			goto repeat;
+
+		/* and dying leaders w/o live member threads */
+		if (!atomic_read(&task->signal->live))
+			goto repeat;
+	} else {
+		/* skip all dying ones */
+		if (task->flags & PF_EXITING)
+			goto repeat;
+	}
 }
 
 /**
@@ -5682,6 +5704,7 @@ void cgroup_exit(struct task_struct *tsk)
 	if (!list_empty(&tsk->cg_list)) {
 		spin_lock_irq(&css_set_lock);
 		css_set_move_task(tsk, cset, NULL, false);
+		list_add_tail(&tsk->cg_list, &cset->dying_tasks);
 		cset->nr_tasks--;
 		spin_unlock_irq(&css_set_lock);
 	} else {
@@ -5702,6 +5725,13 @@ void cgroup_release(struct task_struct *task)
 	do_each_subsys_mask(ss, ssid, have_release_callback) {
 		ss->release(task);
 	} while_each_subsys_mask();
+
+	if (use_task_css_set_links) {
+		spin_lock_irq(&css_set_lock);
+		css_set_skip_task_iters(task_css_set(task), task);
+		list_del_init(&task->cg_list);
+		spin_unlock_irq(&css_set_lock);
+	}
 }
 
 void cgroup_free(struct task_struct *task)
-- 
GitLab


From 0a9abd277819058b6beafa40bfe0a56f19edec38 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Wed, 5 Jun 2019 09:54:34 -0700
Subject: [PATCH 1411/1835] cgroup: css_task_iter_skip()'d iterators must be
 advanced before accessed

commit cee0c33c546a93957a52ae9ab6bebadbee765ec5 upstream.

b636fd38dc40 ("cgroup: Implement css_task_iter_skip()") introduced
css_task_iter_skip() which is used to fix task iterations skipping
dying threadgroup leaders with live threads.  Skipping is implemented
as a subportion of full advancing but css_task_iter_next() forgot to
fully advance a skipped iterator before determining the next task to
visit causing it to return invalid task pointers.

Fix it by making css_task_iter_next() fully advance the iterator if it
has been skipped since the previous iteration.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: syzbot
Link: http://lkml.kernel.org/r/00000000000097025d058a7fd785@google.com
Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cgroup/cgroup.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 89dd464f6862b..ddde75bae7af6 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4303,6 +4303,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 
 	spin_lock_irq(&css_set_lock);
 
+	/* @it may be half-advanced by skips, finish advancing */
+	if (it->flags & CSS_TASK_ITER_SKIPPED)
+		css_task_iter_advance(it);
+
 	if (it->task_pos) {
 		it->cur_task = list_entry(it->task_pos, struct task_struct,
 					  cg_list);
-- 
GitLab


From ebda41dd170fd160e44f97d7a2a215ae9d0009b1 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Mon, 10 Jun 2019 09:08:27 -0700
Subject: [PATCH 1412/1835] cgroup: Fix css_task_iter_advance_css_set() cset
 skip condition

commit c596687a008b579c503afb7a64fcacc7270fae9e upstream.

While adding handling for dying task group leaders c03cd7738a83
("cgroup: Include dying leaders with live threads in PROCS
iterations") added an inverted cset skip condition to
css_task_iter_advance_css_set().  It should skip cset if it's
completely empty but was incorrectly testing for the inverse condition
for the dying_tasks list.  Fix it.

Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: c03cd7738a83 ("cgroup: Include dying leaders with live threads in PROCS iterations")
Reported-by: syzbot+d4bba5ccd4f9a2a68681@syzkaller.appspotmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cgroup/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index ddde75bae7af6..78ef274b036ed 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4154,7 +4154,7 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
 			it->task_pos = NULL;
 			return;
 		}
-	} while (!css_set_populated(cset) && !list_empty(&cset->dying_tasks));
+	} while (!css_set_populated(cset) && list_empty(&cset->dying_tasks));
 
 	if (!list_empty(&cset->tasks))
 		it->task_pos = cset->tasks.next;
-- 
GitLab


From 48fcdaba7b0d31e59f01ce96b4f53e8149787d1a Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Wed, 3 Jul 2019 12:29:31 +0200
Subject: [PATCH 1413/1835] spi: bcm2835: Fix 3-wire mode if DMA is enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8d8bef50365847134b51c1ec46786bc2873e4e47 upstream.

Commit 6935224da248 ("spi: bcm2835: enable support of 3-wire mode")
added 3-wire support to the BCM2835 SPI driver by setting the REN bit
(Read Enable) in the CS register when receiving data.  The REN bit puts
the transmitter in high-impedance state.  The driver recognizes that
data is to be received by checking whether the rx_buf of a transfer is
non-NULL.

Commit 3ecd37edaa2a ("spi: bcm2835: enable dma modes for transfers
meeting certain conditions") subsequently broke 3-wire support because
it set the SPI_MASTER_MUST_RX flag which causes spi_map_msg() to replace
rx_buf with a dummy buffer if it is NULL.  As a result, rx_buf is
*always* non-NULL if DMA is enabled.

Reinstate 3-wire support by not only checking whether rx_buf is non-NULL,
but also checking that it is not the dummy buffer.

Fixes: 3ecd37edaa2a ("spi: bcm2835: enable dma modes for transfers meeting certain conditions")
Reported-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v4.2+
Cc: Martin Sperl <kernel@martin.sperl.org>
Acked-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/328318841455e505370ef8ecad97b646c033dc8a.1562148527.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 25abf2d1732a0..eab27d41ba83f 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -554,7 +554,8 @@ static int bcm2835_spi_transfer_one(struct spi_master *master,
 	bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv);
 
 	/* handle all the 3-wire mode */
-	if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf))
+	if (spi->mode & SPI_3WIRE && tfr->rx_buf &&
+	    tfr->rx_buf != master->dummy_rx)
 		cs |= BCM2835_SPI_CS_REN;
 	else
 		cs &= ~BCM2835_SPI_CS_REN;
-- 
GitLab


From 893af1c79e42e53af0da22165b46eea135af0613 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 9 Aug 2019 17:52:35 +0200
Subject: [PATCH 1414/1835] Linux 4.19.66

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 41a565770431a..065e5b34dc02c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 65
+SUBLEVEL = 66
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 167347104c80c4a61e0eff9de19682f5342477e1 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 3 Aug 2018 11:22:27 +0200
Subject: [PATCH 1415/1835] drm/vc4: Fix TILE_Y_OFFSET definitions

Y_OFFSET field starts at bit 8 not 7.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803092231.26446-1-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_regs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
index d6864fa4bd141..ccbd6b377ffe6 100644
--- a/drivers/gpu/drm/vc4/vc4_regs.h
+++ b/drivers/gpu/drm/vc4/vc4_regs.h
@@ -1043,8 +1043,8 @@ enum hvs_pixel_format {
 #define SCALER_PITCH0_TILE_LINE_DIR		BIT(15)
 #define SCALER_PITCH0_TILE_INITIAL_LINE_DIR	BIT(14)
 /* Y offset within a tile. */
-#define SCALER_PITCH0_TILE_Y_OFFSET_MASK	VC4_MASK(13, 7)
-#define SCALER_PITCH0_TILE_Y_OFFSET_SHIFT	7
+#define SCALER_PITCH0_TILE_Y_OFFSET_MASK	VC4_MASK(13, 8)
+#define SCALER_PITCH0_TILE_Y_OFFSET_SHIFT	8
 #define SCALER_PITCH0_TILE_WIDTH_R_MASK		VC4_MASK(6, 0)
 #define SCALER_PITCH0_TILE_WIDTH_R_SHIFT	0
 
-- 
GitLab


From 904a5b062a6fb566da579b5ccc4c11ee93d825e3 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Fri, 3 Aug 2018 11:22:28 +0200
Subject: [PATCH 1416/1835] drm/vc4: Define missing PITCH0_SINK_PIX field

This is needed to support X/Y negative placement of planes using
T-format buffers.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803092231.26446-2-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_regs.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
index ccbd6b377ffe6..9310880142724 100644
--- a/drivers/gpu/drm/vc4/vc4_regs.h
+++ b/drivers/gpu/drm/vc4/vc4_regs.h
@@ -1037,6 +1037,10 @@ enum hvs_pixel_format {
 #define SCALER_TILE_HEIGHT_MASK			VC4_MASK(15, 0)
 #define SCALER_TILE_HEIGHT_SHIFT		0
 
+/* Common PITCH0 fields */
+#define SCALER_PITCH0_SINK_PIX_MASK		VC4_MASK(31, 26)
+#define SCALER_PITCH0_SINK_PIX_SHIFT		26
+
 /* PITCH0 fields for T-tiled. */
 #define SCALER_PITCH0_TILE_WIDTH_L_MASK		VC4_MASK(22, 16)
 #define SCALER_PITCH0_TILE_WIDTH_L_SHIFT	16
-- 
GitLab


From 299176a3472b3dcec51a29cf561f7fee804d0614 Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Fri, 3 Aug 2018 11:22:29 +0200
Subject: [PATCH 1417/1835] drm/vc4: Use drm_atomic_helper_check_plane_state()
 to simplify the logic

drm_atomic_helper_check_plane_state() takes care of checking the
scaling capabilities and calculating the clipped X/Y offsets for us.

Rely on this function instead of open-coding the logic.

Incidentally, it seems to fix a problem we had with negative X/Y
positioning of YUV planes.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803092231.26446-3-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_plane.c | 103 ++++++++++++++++----------------
 1 file changed, 52 insertions(+), 51 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 3c3d97dbbb51f..09186d69753bf 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -313,31 +313,59 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 	u32 subpixel_src_mask = (1 << 16) - 1;
 	u32 format = fb->format->format;
 	int num_planes = fb->format->num_planes;
-	u32 h_subsample = 1;
-	u32 v_subsample = 1;
-	int ret;
-	int i;
+	int min_scale = 1, max_scale = INT_MAX;
+	struct drm_crtc_state *crtc_state;
+	u32 h_subsample, v_subsample;
+	int i, ret;
+
+	crtc_state = drm_atomic_get_existing_crtc_state(state->state,
+							state->crtc);
+	if (!crtc_state) {
+		DRM_DEBUG_KMS("Invalid crtc state\n");
+		return -EINVAL;
+	}
+
+	/* No configuring scaling on the cursor plane, since it gets
+	 * non-vblank-synced updates, and scaling requires LBM changes which
+	 * have to be vblank-synced.
+	 */
+	if (plane->type == DRM_PLANE_TYPE_CURSOR) {
+		min_scale = DRM_PLANE_HELPER_NO_SCALING;
+		max_scale = DRM_PLANE_HELPER_NO_SCALING;
+	} else {
+		min_scale = 1;
+		max_scale = INT_MAX;
+	}
+
+	ret = drm_atomic_helper_check_plane_state(state, crtc_state,
+						  min_scale, max_scale,
+						  true, true);
+	if (ret)
+		return ret;
+
+	h_subsample = drm_format_horz_chroma_subsampling(format);
+	v_subsample = drm_format_vert_chroma_subsampling(format);
 
 	for (i = 0; i < num_planes; i++)
 		vc4_state->offsets[i] = bo->paddr + fb->offsets[i];
 
 	/* We don't support subpixel source positioning for scaling. */
-	if ((state->src_x & subpixel_src_mask) ||
-	    (state->src_y & subpixel_src_mask) ||
-	    (state->src_w & subpixel_src_mask) ||
-	    (state->src_h & subpixel_src_mask)) {
+	if ((state->src.x1 & subpixel_src_mask) ||
+	    (state->src.x2 & subpixel_src_mask) ||
+	    (state->src.y1 & subpixel_src_mask) ||
+	    (state->src.y2 & subpixel_src_mask)) {
 		return -EINVAL;
 	}
 
-	vc4_state->src_x = state->src_x >> 16;
-	vc4_state->src_y = state->src_y >> 16;
-	vc4_state->src_w[0] = state->src_w >> 16;
-	vc4_state->src_h[0] = state->src_h >> 16;
+	vc4_state->src_x = state->src.x1 >> 16;
+	vc4_state->src_y = state->src.y1 >> 16;
+	vc4_state->src_w[0] = (state->src.x2 - state->src.x1) >> 16;
+	vc4_state->src_h[0] = (state->src.y2 - state->src.y1) >> 16;
 
-	vc4_state->crtc_x = state->crtc_x;
-	vc4_state->crtc_y = state->crtc_y;
-	vc4_state->crtc_w = state->crtc_w;
-	vc4_state->crtc_h = state->crtc_h;
+	vc4_state->crtc_x = state->dst.x1;
+	vc4_state->crtc_y = state->dst.y1;
+	vc4_state->crtc_w = state->dst.x2 - state->dst.x1;
+	vc4_state->crtc_h = state->dst.y2 - state->dst.y1;
 
 	ret = vc4_plane_margins_adj(state);
 	if (ret)
@@ -354,8 +382,6 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 	if (num_planes > 1) {
 		vc4_state->is_yuv = true;
 
-		h_subsample = drm_format_horz_chroma_subsampling(format);
-		v_subsample = drm_format_vert_chroma_subsampling(format);
 		vc4_state->src_w[1] = vc4_state->src_w[0] / h_subsample;
 		vc4_state->src_h[1] = vc4_state->src_h[0] / v_subsample;
 
@@ -380,39 +406,14 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 		vc4_state->y_scaling[1] = VC4_SCALING_NONE;
 	}
 
-	/* No configuring scaling on the cursor plane, since it gets
-	   non-vblank-synced updates, and scaling requires requires
-	   LBM changes which have to be vblank-synced.
-	 */
-	if (plane->type == DRM_PLANE_TYPE_CURSOR && !vc4_state->is_unity)
-		return -EINVAL;
-
-	/* Clamp the on-screen start x/y to 0.  The hardware doesn't
-	 * support negative y, and negative x wastes bandwidth.
-	 */
-	if (vc4_state->crtc_x < 0) {
-		for (i = 0; i < num_planes; i++) {
-			u32 cpp = fb->format->cpp[i];
-			u32 subs = ((i == 0) ? 1 : h_subsample);
-
-			vc4_state->offsets[i] += (cpp *
-						  (-vc4_state->crtc_x) / subs);
-		}
-		vc4_state->src_w[0] += vc4_state->crtc_x;
-		vc4_state->src_w[1] += vc4_state->crtc_x / h_subsample;
-		vc4_state->crtc_x = 0;
-	}
-
-	if (vc4_state->crtc_y < 0) {
-		for (i = 0; i < num_planes; i++) {
-			u32 subs = ((i == 0) ? 1 : v_subsample);
-
-			vc4_state->offsets[i] += (fb->pitches[i] *
-						  (-vc4_state->crtc_y) / subs);
-		}
-		vc4_state->src_h[0] += vc4_state->crtc_y;
-		vc4_state->src_h[1] += vc4_state->crtc_y / v_subsample;
-		vc4_state->crtc_y = 0;
+	/* Adjust the base pointer to the first pixel to be scanned out. */
+	for (i = 0; i < num_planes; i++) {
+		vc4_state->offsets[i] += (vc4_state->src_y /
+					  (i ? v_subsample : 1)) *
+					 fb->pitches[i];
+		vc4_state->offsets[i] += (vc4_state->src_x /
+					  (i ? h_subsample : 1)) *
+					 fb->format->cpp[i];
 	}
 
 	return 0;
-- 
GitLab


From ed9e15008174c71274bda7bfd6168ba8b6b0f5f8 Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Fri, 3 Aug 2018 11:22:30 +0200
Subject: [PATCH 1418/1835] drm/vc4: Move ->offsets[] adjustment out of
 setup_clipping_and_scaling()

The offset adjustment depends on the framebuffer modified, so let's
just move this operation in the DRM_FORMAT_MOD_LINEAR case inside
vc4_plane_mode_set().

This we'll be able to fix offset calculation for
DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED and DRM_FORMAT_MOD_BROADCOM_SANDXXX.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803092231.26446-4-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_plane.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 09186d69753bf..42e96641f1acb 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -406,16 +406,6 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 		vc4_state->y_scaling[1] = VC4_SCALING_NONE;
 	}
 
-	/* Adjust the base pointer to the first pixel to be scanned out. */
-	for (i = 0; i < num_planes; i++) {
-		vc4_state->offsets[i] += (vc4_state->src_y /
-					  (i ? v_subsample : 1)) *
-					 fb->pitches[i];
-		vc4_state->offsets[i] += (vc4_state->src_x /
-					  (i ? h_subsample : 1)) *
-					 fb->format->cpp[i];
-	}
-
 	return 0;
 }
 
@@ -523,6 +513,7 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
 	const struct hvs_format *format = vc4_get_hvs_format(fb->format->format);
 	u64 base_format_mod = fourcc_mod_broadcom_mod(fb->modifier);
 	int num_planes = drm_format_num_planes(format->drm);
+	u32 h_subsample, v_subsample;
 	bool mix_plane_alpha;
 	bool covers_screen;
 	u32 scl0, scl1, pitch0;
@@ -568,10 +559,25 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
 		scl1 = vc4_get_scl_field(state, 0);
 	}
 
+	h_subsample = drm_format_horz_chroma_subsampling(format->drm);
+	v_subsample = drm_format_vert_chroma_subsampling(format->drm);
+
 	switch (base_format_mod) {
 	case DRM_FORMAT_MOD_LINEAR:
 		tiling = SCALER_CTL0_TILING_LINEAR;
 		pitch0 = VC4_SET_FIELD(fb->pitches[0], SCALER_SRC_PITCH);
+
+		/* Adjust the base pointer to the first pixel to be scanned
+		 * out.
+		 */
+		for (i = 0; i < num_planes; i++) {
+			vc4_state->offsets[i] += vc4_state->src_y /
+						 (i ? v_subsample : 1) *
+						 fb->pitches[i];
+			vc4_state->offsets[i] += vc4_state->src_x /
+						 (i ? h_subsample : 1) *
+						 fb->format->cpp[i];
+		}
 		break;
 
 	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED: {
-- 
GitLab


From c3f1afdbcfef63fa720f6143f1ee417d8d87d4e7 Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Fri, 3 Aug 2018 11:22:31 +0200
Subject: [PATCH 1419/1835] drm/vc4: Fix X/Y positioning of planes using
 T_TILES modifier

X/Y positioning of T-format buffers is quite tricky and the current
implementation was failing to position a plane using this format
correctly when the CRTC X, Y or both X and Y offsets were negative.
It was also failing when the SRC X/Y offsets were != 0.

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803092231.26446-5-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_plane.c | 50 ++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 42e96641f1acb..267f8125d86fe 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -578,22 +578,58 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
 						 (i ? h_subsample : 1) *
 						 fb->format->cpp[i];
 		}
+
 		break;
 
 	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED: {
-		/* For T-tiled, the FB pitch is "how many bytes from
-		 * one row to the next, such that pitch * tile_h ==
-		 * tile_size * tiles_per_row."
-		 */
 		u32 tile_size_shift = 12; /* T tiles are 4kb */
+		/* Whole-tile offsets, mostly for setting the pitch. */
+		u32 tile_w_shift = fb->format->cpp[0] == 2 ? 6 : 5;
 		u32 tile_h_shift = 5; /* 16 and 32bpp are 32 pixels high */
+		u32 tile_w_mask = (1 << tile_w_shift) - 1;
+		/* The height mask on 32-bit-per-pixel tiles is 63, i.e. twice
+		 * the height (in pixels) of a 4k tile.
+		 */
+		u32 tile_h_mask = (2 << tile_h_shift) - 1;
+		/* For T-tiled, the FB pitch is "how many bytes from one row to
+		 * the next, such that
+		 *
+		 *	pitch * tile_h == tile_size * tiles_per_row
+		 */
 		u32 tiles_w = fb->pitches[0] >> (tile_size_shift - tile_h_shift);
+		u32 tiles_l = vc4_state->src_x >> tile_w_shift;
+		u32 tiles_r = tiles_w - tiles_l;
+		u32 tiles_t = vc4_state->src_y >> tile_h_shift;
+		/* Intra-tile offsets, which modify the base address (the
+		 * SCALER_PITCH0_TILE_Y_OFFSET tells HVS how to walk from that
+		 * base address).
+		 */
+		u32 tile_y = (vc4_state->src_y >> 4) & 1;
+		u32 subtile_y = (vc4_state->src_y >> 2) & 3;
+		u32 utile_y = vc4_state->src_y & 3;
+		u32 x_off = vc4_state->src_x & tile_w_mask;
+		u32 y_off = vc4_state->src_y & tile_h_mask;
 
 		tiling = SCALER_CTL0_TILING_256B_OR_T;
+		pitch0 = (VC4_SET_FIELD(x_off, SCALER_PITCH0_SINK_PIX) |
+			  VC4_SET_FIELD(y_off, SCALER_PITCH0_TILE_Y_OFFSET) |
+			  VC4_SET_FIELD(tiles_l, SCALER_PITCH0_TILE_WIDTH_L) |
+			  VC4_SET_FIELD(tiles_r, SCALER_PITCH0_TILE_WIDTH_R));
+		vc4_state->offsets[0] += tiles_t * (tiles_w << tile_size_shift);
+		vc4_state->offsets[0] += subtile_y << 8;
+		vc4_state->offsets[0] += utile_y << 4;
+
+		/* Rows of tiles alternate left-to-right and right-to-left. */
+		if (tiles_t & 1) {
+			pitch0 |= SCALER_PITCH0_TILE_INITIAL_LINE_DIR;
+			vc4_state->offsets[0] += (tiles_w - tiles_l) <<
+						 tile_size_shift;
+			vc4_state->offsets[0] -= (1 + !tile_y) << 10;
+		} else {
+			vc4_state->offsets[0] += tiles_l << tile_size_shift;
+			vc4_state->offsets[0] += tile_y << 10;
+		}
 
-		pitch0 = (VC4_SET_FIELD(0, SCALER_PITCH0_TILE_Y_OFFSET) |
-			  VC4_SET_FIELD(0, SCALER_PITCH0_TILE_WIDTH_L) |
-			  VC4_SET_FIELD(tiles_w, SCALER_PITCH0_TILE_WIDTH_R));
 		break;
 	}
 
-- 
GitLab


From f1c1b67b26ed3cb789037d1c844d4105deaa3cfd Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@bootlin.com>
Date: Thu, 15 Nov 2018 11:58:51 +0100
Subject: [PATCH 1420/1835] drm/vc4: Fix NULL pointer dereference in the async
 update path

vc4_plane_atomic_async_update() calls vc4_plane_atomic_check()
which in turn calls vc4_plane_setup_clipping_and_scaling(), and since
commit 58a6a36fe8e0 ("drm/vc4: Use
drm_atomic_helper_check_plane_state() to simplify the logic"), this
function accesses plane_state->state which will be NULL when called
from the async update path because we're passing the current plane
state, and plane_state->state has been assigned to NULL in
drm_atomic_helper_swap_state().

Pass the new state instead of the current one (the new state has
->state set to a non-NULL value).

Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic")
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Link: https://patchwork.freedesktop.org/patch/msgid/20181115105852.9844-1-boris.brezillon@bootlin.com
---
 drivers/gpu/drm/vc4/vc4_plane.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 267f8125d86fe..ce2749d90dd00 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -905,7 +905,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane, struct drm_framebuffer *fb)
 static void vc4_plane_atomic_async_update(struct drm_plane *plane,
 					  struct drm_plane_state *state)
 {
-	struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
+	struct vc4_plane_state *vc4_state, *new_vc4_state;
 
 	if (plane->state->fb != state->fb) {
 		vc4_plane_async_set_fb(plane, state->fb);
@@ -927,7 +927,18 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
 	plane->state->src_y = state->src_y;
 
 	/* Update the display list based on the new crtc_x/y. */
-	vc4_plane_atomic_check(plane, plane->state);
+	vc4_plane_atomic_check(plane, state);
+
+	new_vc4_state = to_vc4_plane_state(state);
+	vc4_state = to_vc4_plane_state(plane->state);
+
+	/* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
+	vc4_state->dlist[vc4_state->pos0_offset] =
+		new_vc4_state->dlist[vc4_state->pos0_offset];
+	vc4_state->dlist[vc4_state->pos2_offset] =
+		new_vc4_state->dlist[vc4_state->pos2_offset];
+	vc4_state->dlist[vc4_state->ptr0_offset] =
+		new_vc4_state->dlist[vc4_state->ptr0_offset];
 
 	/* Note that we can't just call vc4_plane_write_dlist()
 	 * because that would smash the context data that the HVS is
-- 
GitLab


From 59e097df65f4f39fac5ab3c9eeedf5f1239b97fd Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Sun, 11 Aug 2019 21:31:46 +0100
Subject: [PATCH 1421/1835] configs: Regenerate the defconfigs

Update bcm2709_defconfig to match the output from savedefconfig.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index f3235aa2eb8fb..5366a27a3cb68 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -16,11 +16,11 @@ CONFIG_IKCONFIG=m
 CONFIG_IKCONFIG_PROC=y
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
 CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PIDS=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
-- 
GitLab


From 067fe10f2379864196d873ae0f4bd849c7b3950a Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Sun, 11 Aug 2019 21:34:43 +0100
Subject: [PATCH 1422/1835] configs: Enable building the DS28E17 driver module

See: https://github.com/raspberrypi/linux/issues/3141

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcm2711_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcm2711_defconfig | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 5 files changed, 5 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 5366a27a3cb68..2fe8c2f47f04a 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -706,6 +706,7 @@ CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_W1_SLAVE_DS28E17=m
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 314b8590e35f2..f2bf634347def 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -714,6 +714,7 @@ CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_W1_SLAVE_DS28E17=m
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index ffdc1b3b2b931..c4867727fedf7 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -698,6 +698,7 @@ CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_W1_SLAVE_DS28E17=m
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 2265a77d6a53b..e06ba27ccb255 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -644,6 +644,7 @@ CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_W1_SLAVE_DS28E17=m
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
 CONFIG_BATTERY_GAUGE_LTC2941=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 904163e4266dd..1e8ff7ae2b019 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -628,6 +628,7 @@ CONFIG_W1_SLAVE_DS2433=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
 CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_W1_SLAVE_DS28E17=m
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_BATTERY_DS2760=m
 CONFIG_BATTERY_MAX17040=m
-- 
GitLab


From 1f8e54151926498bd1f462d758301669cb354fd0 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 12 Aug 2019 15:48:39 +0100
Subject: [PATCH 1423/1835] ARM: dts: bcm2711-rpi-4-b: I2C aliases and pulls

The I2C interface nodes need aliases to give them fixed bus numbers,
and setting the pulls on the GPIOs (particularly 9-13) increases the
chances of the bus working with weak or absent external pulls.

See: https://www.raspberrypi.org/forums/posting.php?mode=reply&f=107&t=248439

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 9b5c4f8a4d170..18c0f9599d3aa 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -23,6 +23,10 @@
 		mmc0 = &emmc2;
 		mmc1 = &mmcnr;
 		mmc2 = &sdhost;
+		i2c3 = &i2c3;
+		i2c4 = &i2c4;
+		i2c5 = &i2c5;
+		i2c6 = &i2c6;
 		/delete-property/ ethernet;
 		/delete-property/ intc;
 		ethernet0 = &genet;
@@ -207,31 +211,37 @@
 	i2c0_pins: i2c0 {
 		brcm,pins = <0 1>;
 		brcm,function = <BCM2835_FSEL_ALT0>;
+		brcm,pull = <BCM2835_PUD_UP>;
 	};
 
 	i2c1_pins: i2c1 {
 		brcm,pins = <2 3>;
 		brcm,function = <BCM2835_FSEL_ALT0>;
+		brcm,pull = <BCM2835_PUD_UP>;
 	};
 
 	i2c3_pins: i2c3 {
 		brcm,pins = <4 5>;
 		brcm,function = <BCM2835_FSEL_ALT5>;
+		brcm,pull = <BCM2835_PUD_UP>;
 	};
 
 	i2c4_pins: i2c4 {
 		brcm,pins = <8 9>;
 		brcm,function = <BCM2835_FSEL_ALT5>;
+		brcm,pull = <BCM2835_PUD_UP>;
 	};
 
 	i2c5_pins: i2c5 {
 		brcm,pins = <12 13>;
 		brcm,function = <BCM2835_FSEL_ALT5>;
+		brcm,pull = <BCM2835_PUD_UP>;
 	};
 
 	i2c6_pins: i2c6 {
 		brcm,pins = <22 23>;
 		brcm,function = <BCM2835_FSEL_ALT5>;
+		brcm,pull = <BCM2835_PUD_UP>;
 	};
 
 	i2s_pins: i2s {
-- 
GitLab


From 5f945aad8e7668a6f59b281c60aad87524a32a15 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Tue, 13 Aug 2019 15:53:29 +0100
Subject: [PATCH 1424/1835] xhci: Use more event ring segment table entries

Users have reported log spam created by "Event Ring Full" xHC event
TRBs. These are caused by interrupt latency in conjunction with a very
busy set of devices on the bus. The errors are benign, but throughput
will suffer as the xHC will pause processing of transfers until the
event ring is drained by the kernel. Expand the number of event TRB slots
available by increasing the number of event ring segments in the ERST.

Controllers have a hardware-defined limit as to the number of ERST
entries they can process, so make the actual number in use
min(ERST_MAX_SEGS, hw_max).

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/usb/host/xhci-mem.c | 8 +++++---
 drivers/usb/host/xhci.h     | 4 ++--
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index b1f27aa38b100..7e417b71d24cb 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2491,9 +2491,11 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 	 * Event ring setup: Allocate a normal ring, but also setup
 	 * the event ring segment table (ERST).  Section 4.9.3.
 	 */
+	val2 = 1 << HCS_ERST_MAX(xhci->hcs_params2);
+	val2 = min_t(unsigned int, ERST_MAX_SEGS, val2);
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "// Allocating event ring");
-	xhci->event_ring = xhci_ring_alloc(xhci, ERST_NUM_SEGS, 1, TYPE_EVENT,
-					0, flags);
+	xhci->event_ring = xhci_ring_alloc(xhci, val2, 1, TYPE_EVENT,
+					   0, flags);
 	if (!xhci->event_ring)
 		goto fail;
 	if (xhci_check_trb_in_td_math(xhci) < 0)
@@ -2506,7 +2508,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 	/* set ERST count with the number of entries in the segment table */
 	val = readl(&xhci->ir_set->erst_size);
 	val &= ERST_SIZE_MASK;
-	val |= ERST_NUM_SEGS;
+	val |= val2;
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"// Write ERST size = %i to ir_set 0 (some bits preserved)",
 			val);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 3a6c451777e7d..ec515c563a37e 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1643,8 +1643,8 @@ struct urb_priv {
  * Each segment table entry is 4*32bits long.  1K seems like an ok size:
  * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
  * meaning 64 ring segments.
- * Initial allocated size of the ERST, in number of entries */
-#define	ERST_NUM_SEGS	1
+ * Maximum number of segments in the ERST */
+#define	ERST_MAX_SEGS	8
 /* Initial allocated size of the ERST, in number of entries */
 #define	ERST_SIZE	64
 /* Initial number of event segment rings allocated */
-- 
GitLab


From c0e4ca17457d6669a263e86a88f0036875fc019e Mon Sep 17 00:00:00 2001
From: P33M <2474547+P33M@users.noreply.github.com>
Date: Wed, 14 Aug 2019 14:35:50 +0100
Subject: [PATCH 1425/1835] dwc_otg: use align_buf for small IN control
 transfers (#3150)

The hardware will do a 4-byte write to memory on any IN packet received
that is between 1 and 3 bytes long. This tramples memory in the uvcvideo
driver, as it uses a sequence of 1- and 2-byte control transfers to
query the min/max/range/step of each individual camera control and
gives us buffers that are offsets into a struct.

Catch small control transfers in the data phase and use the align_buf
to bounce the correct number of bytes into the URB's buffer.

In general, short packets on non-control endpoints should be OK as URBs
should have enough buffer space for a wMaxPacket size transfer.

See: https://github.com/raspberrypi/linux/issues/3148

Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
---
 drivers/usb/host/dwc_otg/dwc_otg_hcd.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
index cdfb9a6b7c597..9f2cd510c3015 100644
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -1182,6 +1182,7 @@ static void assign_and_init_hc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
 	dwc_otg_qtd_t *qtd;
 	dwc_otg_hcd_urb_t *urb;
 	void* ptr = NULL;
+	uint16_t wLength;
 	uint32_t intr_enable;
 	unsigned long flags;
 	gintmsk_data_t gintmsk = { .d32 = 0, };
@@ -1293,6 +1294,23 @@ static void assign_and_init_hc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
 			break;
 		case DWC_OTG_CONTROL_DATA:
 			DWC_DEBUGPL(DBG_HCDV, "  Control data transaction\n");
+			/*
+			 * Hardware bug: small IN packets with length < 4
+			 * cause a 4-byte write to memory. We can only catch
+			 * the case where we know a short packet is going to be
+			 * returned in a control transfer, as the length is
+			 * specified in the setup packet. This is only an issue
+			 * for drivers that insist on packing a device's various
+			 * properties into a struct and querying them one at a
+			 * time (uvcvideo).
+			 * Force the use of align_buf so that the subsequent
+			 * memcpy puts the right number of bytes in the URB's
+			 * buffer.
+			 */
+			wLength = ((uint16_t *)urb->setup_packet)[3];
+			if (hc->ep_is_in && wLength < 4)
+				ptr = hc->xfer_buff;
+
 			hc->data_pid_start = qtd->data_toggle;
 			break;
 		case DWC_OTG_CONTROL_STATUS:
-- 
GitLab


From ea2c11a187c0e248343452846457b94715e04969 Mon Sep 17 00:00:00 2001
From: yaroslavros <yaroslavros@gmail.com>
Date: Wed, 14 Aug 2019 15:22:55 +0100
Subject: [PATCH 1426/1835] Ported pcie-brcmstb bounce buffer implementation to
 ARM64. (#3144)

Ported pcie-brcmstb bounce buffer implementation to ARM64.
This enables full 4G RAM usage on Raspberry Pi in 64-bit mode.

Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
---
 arch/arm64/include/asm/dma-mapping.h          |  21 +
 arch/arm64/mm/dma-mapping.c                   |  50 ++
 drivers/pci/controller/Makefile               |   3 +
 drivers/pci/controller/pcie-brcmstb-bounce.h  |   2 +-
 .../pci/controller/pcie-brcmstb-bounce64.c    | 576 ++++++++++++++++++
 drivers/pci/controller/pcie-brcmstb.c         |  30 +-
 6 files changed, 658 insertions(+), 24 deletions(-)
 create mode 100644 drivers/pci/controller/pcie-brcmstb-bounce64.c

diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
index b7847eb8a7bb7..9195e524cb082 100644
--- a/arch/arm64/include/asm/dma-mapping.h
+++ b/arch/arm64/include/asm/dma-mapping.h
@@ -24,6 +24,27 @@
 #include <xen/xen.h>
 #include <asm/xen/hypervisor.h>
 
+extern void *arm64_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
+			   gfp_t gfp, unsigned long attrs);
+extern void arm64_dma_free(struct device *dev, size_t size, void *cpu_addr,
+			 dma_addr_t handle, unsigned long attrs);
+extern int arm64_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+			void *cpu_addr, dma_addr_t dma_addr, size_t size,
+			unsigned long attrs);
+extern int arm64_dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+		void *cpu_addr, dma_addr_t dma_addr, size_t size,
+		unsigned long attrs);
+extern int arm64_dma_map_sg(struct device *dev, struct scatterlist *sgl, int nelems,
+		enum dma_data_direction dir, unsigned long attrs);
+extern void arm64_dma_unmap_sg(struct device *dev, struct scatterlist *sgl, int,
+		enum dma_data_direction dir, unsigned long attrs);
+extern void arm64_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sgl, int nelems,
+		enum dma_data_direction dir);
+extern void arm64_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sgl, int nelems,
+		enum dma_data_direction dir);
+
+
+
 extern const struct dma_map_ops dummy_dma_ops;
 
 static inline const struct dma_map_ops *get_arch_dma_ops(struct bus_type *bus)
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index d3a5bb16f0b23..b1f6d4e1f4645 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -138,6 +138,12 @@ no_mem:
 	return NULL;
 }
 
+void *arm64_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
+                           gfp_t gfp, unsigned long attrs)
+{
+        return __dma_alloc(dev, size, handle, gfp, attrs);
+}
+
 static void __dma_free(struct device *dev, size_t size,
 		       void *vaddr, dma_addr_t dma_handle,
 		       unsigned long attrs)
@@ -154,6 +160,12 @@ static void __dma_free(struct device *dev, size_t size,
 	swiotlb_free(dev, size, swiotlb_addr, dma_handle, attrs);
 }
 
+void arm64_dma_free(struct device *dev, size_t size, void *cpu_addr,
+                         dma_addr_t handle, unsigned long attrs)
+{
+        __dma_free(dev, size, cpu_addr, handle, attrs);
+}
+
 static dma_addr_t __swiotlb_map_page(struct device *dev, struct page *page,
 				     unsigned long offset, size_t size,
 				     enum dma_data_direction dir,
@@ -197,6 +209,12 @@ static int __swiotlb_map_sg_attrs(struct device *dev, struct scatterlist *sgl,
 	return ret;
 }
 
+int arm64_dma_map_sg(struct device *dev, struct scatterlist *sgl, int nelems,
+                enum dma_data_direction dir, unsigned long attrs)
+{
+	return __swiotlb_map_sg_attrs(dev, sgl, nelems, dir, attrs);
+}
+
 static void __swiotlb_unmap_sg_attrs(struct device *dev,
 				     struct scatterlist *sgl, int nelems,
 				     enum dma_data_direction dir,
@@ -213,6 +231,12 @@ static void __swiotlb_unmap_sg_attrs(struct device *dev,
 	swiotlb_unmap_sg_attrs(dev, sgl, nelems, dir, attrs);
 }
 
+void arm64_dma_unmap_sg(struct device *dev, struct scatterlist *sgl, int nelems,
+                enum dma_data_direction dir, unsigned long attrs)
+{
+	__swiotlb_unmap_sg_attrs(dev, sgl, nelems, dir, attrs);
+}
+
 static void __swiotlb_sync_single_for_cpu(struct device *dev,
 					  dma_addr_t dev_addr, size_t size,
 					  enum dma_data_direction dir)
@@ -245,6 +269,12 @@ static void __swiotlb_sync_sg_for_cpu(struct device *dev,
 	swiotlb_sync_sg_for_cpu(dev, sgl, nelems, dir);
 }
 
+void arm64_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sgl, int nelems,
+                enum dma_data_direction dir)
+{
+	__swiotlb_sync_sg_for_cpu(dev, sgl, nelems, dir);
+}
+
 static void __swiotlb_sync_sg_for_device(struct device *dev,
 					 struct scatterlist *sgl, int nelems,
 					 enum dma_data_direction dir)
@@ -259,6 +289,12 @@ static void __swiotlb_sync_sg_for_device(struct device *dev,
 				       sg->length, dir);
 }
 
+void arm64_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sgl, int nelems,
+                enum dma_data_direction dir)
+{
+	__swiotlb_sync_sg_for_device(dev, sgl, nelems, dir);
+}
+
 static int __swiotlb_mmap_pfn(struct vm_area_struct *vma,
 			      unsigned long pfn, size_t size)
 {
@@ -294,6 +330,13 @@ static int __swiotlb_mmap(struct device *dev,
 	return __swiotlb_mmap_pfn(vma, pfn, size);
 }
 
+int arm64_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                        void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                        unsigned long attrs)
+{
+	return __swiotlb_mmap(dev, vma, cpu_addr, dma_addr, size, attrs);
+}
+
 static int __swiotlb_get_sgtable_page(struct sg_table *sgt,
 				      struct page *page, size_t size)
 {
@@ -314,6 +357,13 @@ static int __swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
 	return __swiotlb_get_sgtable_page(sgt, page, size);
 }
 
+int arm64_dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                unsigned long attrs)
+{
+	return __swiotlb_get_sgtable(dev, sgt, cpu_addr, dma_addr, size, attrs);
+}
+
 static int __swiotlb_dma_supported(struct device *hwdev, u64 mask)
 {
 	if (swiotlb)
diff --git a/drivers/pci/controller/Makefile b/drivers/pci/controller/Makefile
index c40b7b982ea48..71be2a0a7e68d 100644
--- a/drivers/pci/controller/Makefile
+++ b/drivers/pci/controller/Makefile
@@ -32,6 +32,9 @@ obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb.o
 ifdef CONFIG_ARM
 obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb-bounce.o
 endif
+ifdef CONFIG_ARM64
+obj-$(CONFIG_PCIE_BRCMSTB) += pcie-brcmstb-bounce64.o
+endif
 
 obj-$(CONFIG_VMD) += vmd.o
 # pcie-hisi.o quirks are needed even without CONFIG_PCIE_DW
diff --git a/drivers/pci/controller/pcie-brcmstb-bounce.h b/drivers/pci/controller/pcie-brcmstb-bounce.h
index 2fe20a14d0352..7caa0781329b5 100644
--- a/drivers/pci/controller/pcie-brcmstb-bounce.h
+++ b/drivers/pci/controller/pcie-brcmstb-bounce.h
@@ -6,7 +6,7 @@
 #ifndef _PCIE_BRCMSTB_BOUNCE_H
 #define _PCIE_BRCMSTB_BOUNCE_H
 
-#ifdef CONFIG_ARM
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
 
 int brcm_pcie_bounce_init(struct device *dev, unsigned long buffer_size,
 			  dma_addr_t threshold);
diff --git a/drivers/pci/controller/pcie-brcmstb-bounce64.c b/drivers/pci/controller/pcie-brcmstb-bounce64.c
new file mode 100644
index 0000000000000..d9f1a46fc3315
--- /dev/null
+++ b/drivers/pci/controller/pcie-brcmstb-bounce64.c
@@ -0,0 +1,576 @@
+/*
+ *  This code started out as a version of arch/arm/common/dmabounce.c,
+ *  modified to cope with highmem pages. Now it has been changed heavily -
+ *  it now preallocates a large block (currently 4MB) and carves it up
+ *  sequentially in ring fashion, and DMA is used to copy the data - to the
+ *  point where very little of the original remains.
+ *
+ *  Copyright (C) 2019 Raspberry Pi (Trading) Ltd.
+ *
+ *  Original version by Brad Parker (brad@heeltoe.com)
+ *  Re-written by Christopher Hoover <ch@murgatroid.com>
+ *  Made generic by Deepak Saxena <dsaxena@plexity.net>
+ *
+ *  Copyright (C) 2002 Hewlett Packard Company.
+ *  Copyright (C) 2004 MontaVista Software, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  version 2 as published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/page-flags.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-direct.h>
+#include <linux/dmapool.h>
+#include <linux/list.h>
+#include <linux/scatterlist.h>
+#include <linux/bitmap.h>
+#include <linux/swiotlb.h>
+
+#include <asm/cacheflush.h>
+
+#define STATS
+
+#ifdef STATS
+#define DO_STATS(X) do { X ; } while (0)
+#else
+#define DO_STATS(X) do { } while (0)
+#endif
+
+/* ************************************************** */
+
+struct safe_buffer {
+	struct list_head node;
+
+	/* original request */
+	size_t		size;
+	int		direction;
+
+	struct dmabounce_pool *pool;
+	void		*safe;
+	dma_addr_t	unsafe_dma_addr;
+	dma_addr_t	safe_dma_addr;
+};
+
+struct dmabounce_pool {
+	unsigned long	pages;
+	void		*virt_addr;
+	dma_addr_t	dma_addr;
+	unsigned long	*alloc_map;
+	unsigned long	alloc_pos;
+	spinlock_t	lock;
+	struct device	*dev;
+	unsigned long   num_pages;
+#ifdef STATS
+	size_t		max_size;
+	unsigned long	num_bufs;
+	unsigned long   max_bufs;
+	unsigned long   max_pages;
+#endif
+};
+
+struct dmabounce_device_info {
+	struct device *dev;
+	dma_addr_t threshold;
+	struct list_head safe_buffers;
+	struct dmabounce_pool pool;
+	rwlock_t lock;
+#ifdef STATS
+	unsigned long map_count;
+	unsigned long unmap_count;
+	unsigned long sync_dev_count;
+	unsigned long sync_cpu_count;
+	unsigned long fail_count;
+	int attr_res;
+#endif
+};
+
+static struct dmabounce_device_info *g_dmabounce_device_info;
+
+extern int bcm2838_dma40_memcpy_init(void);
+extern void bcm2838_dma40_memcpy(dma_addr_t dst, dma_addr_t src, size_t size);
+
+#ifdef STATS
+static ssize_t
+bounce_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
+	return sprintf(buf, "m:%lu/%lu s:%lu/%lu f:%lu s:%zu b:%lu/%lu a:%lu/%lu\n",
+		device_info->map_count,
+		device_info->unmap_count,
+		device_info->sync_dev_count,
+		device_info->sync_cpu_count,
+		device_info->fail_count,
+		device_info->pool.max_size,
+		device_info->pool.num_bufs,
+		device_info->pool.max_bufs,
+		device_info->pool.num_pages * PAGE_SIZE,
+		device_info->pool.max_pages * PAGE_SIZE);
+}
+
+static DEVICE_ATTR(dmabounce_stats, 0444, bounce_show, NULL);
+#endif
+
+static int bounce_create(struct dmabounce_pool *pool, struct device *dev,
+			 unsigned long buffer_size)
+{
+	int ret = -ENOMEM;
+	pool->pages = (buffer_size + PAGE_SIZE - 1)/PAGE_SIZE;
+	pool->alloc_map = bitmap_zalloc(pool->pages, GFP_KERNEL);
+	if (!pool->alloc_map)
+		goto err_bitmap;
+	pool->virt_addr = dma_alloc_coherent(dev, pool->pages * PAGE_SIZE,
+					     &pool->dma_addr, GFP_KERNEL);
+	if (!pool->virt_addr)
+		goto err_dmabuf;
+
+	pool->alloc_pos = 0;
+	spin_lock_init(&pool->lock);
+	pool->dev = dev;
+	pool->num_pages = 0;
+
+	DO_STATS(pool->max_size = 0);
+	DO_STATS(pool->num_bufs = 0);
+	DO_STATS(pool->max_bufs = 0);
+	DO_STATS(pool->max_pages = 0);
+
+	return  0;
+
+err_dmabuf:
+	bitmap_free(pool->alloc_map);
+err_bitmap:
+	return ret;
+}
+
+static void bounce_destroy(struct dmabounce_pool *pool)
+{
+	dma_free_coherent(pool->dev, pool->pages * PAGE_SIZE, pool->virt_addr,
+			  pool->dma_addr);
+
+	bitmap_free(pool->alloc_map);
+}
+
+static void *bounce_alloc(struct dmabounce_pool *pool, size_t size,
+			  dma_addr_t *dmaaddrp)
+{
+	unsigned long pages;
+	unsigned long flags;
+	unsigned long pos;
+
+	pages = (size + PAGE_SIZE - 1)/PAGE_SIZE;
+
+	DO_STATS(pool->max_size = max(size, pool->max_size));
+
+	spin_lock_irqsave(&pool->lock, flags);
+	pos = bitmap_find_next_zero_area(pool->alloc_map, pool->pages,
+					 pool->alloc_pos, pages, 0);
+	/* If not found, try from the start */
+	if (pos >= pool->pages && pool->alloc_pos)
+		pos = bitmap_find_next_zero_area(pool->alloc_map, pool->pages,
+						 0, pages, 0);
+
+	if (pos >= pool->pages) {
+		spin_unlock_irqrestore(&pool->lock, flags);
+		return NULL;
+	}
+
+	bitmap_set(pool->alloc_map, pos, pages);
+	pool->alloc_pos = (pos + pages) % pool->pages;
+	pool->num_pages += pages;
+
+	DO_STATS(pool->num_bufs++);
+	DO_STATS(pool->max_bufs = max(pool->num_bufs, pool->max_bufs));
+	DO_STATS(pool->max_pages = max(pool->num_pages, pool->max_pages));
+
+	spin_unlock_irqrestore(&pool->lock, flags);
+
+	*dmaaddrp = pool->dma_addr + pos * PAGE_SIZE;
+
+	return pool->virt_addr + pos * PAGE_SIZE;
+}
+
+static void
+bounce_free(struct dmabounce_pool *pool, void *buf, size_t size)
+{
+	unsigned long pages;
+	unsigned long flags;
+	unsigned long pos;
+
+	pages = (size + PAGE_SIZE - 1)/PAGE_SIZE;
+	pos = (buf - pool->virt_addr)/PAGE_SIZE;
+
+	BUG_ON((buf - pool->virt_addr) & (PAGE_SIZE - 1));
+
+	spin_lock_irqsave(&pool->lock, flags);
+	bitmap_clear(pool->alloc_map, pos, pages);
+	pool->num_pages -= pages;
+	if (pool->num_pages == 0)
+		pool->alloc_pos = 0;
+	DO_STATS(pool->num_bufs--);
+	spin_unlock_irqrestore(&pool->lock, flags);
+}
+
+/* allocate a 'safe' buffer and keep track of it */
+static struct safe_buffer *
+alloc_safe_buffer(struct dmabounce_device_info *device_info,
+		  dma_addr_t dma_addr, size_t size, enum dma_data_direction dir)
+{
+	struct safe_buffer *buf;
+	struct dmabounce_pool *pool = &device_info->pool;
+	struct device *dev = device_info->dev;
+	unsigned long flags;
+
+	/*
+	 * Although one might expect this to be called in thread context,
+	 * using GFP_KERNEL here leads to hard-to-debug lockups. in_atomic()
+	 * was previously used to select the appropriate allocation mode,
+	 * but this is unsafe.
+	 */
+	buf = kmalloc(sizeof(struct safe_buffer), GFP_ATOMIC);
+	if (!buf) {
+		dev_warn(dev, "%s: kmalloc failed\n", __func__);
+		return NULL;
+	}
+
+	buf->unsafe_dma_addr = dma_addr;
+	buf->size = size;
+	buf->direction = dir;
+	buf->pool = pool;
+
+	buf->safe = bounce_alloc(pool, size, &buf->safe_dma_addr);
+
+	if (!buf->safe) {
+		dev_warn(dev,
+			 "%s: could not alloc dma memory (size=%d)\n",
+			 __func__, size);
+		kfree(buf);
+		return NULL;
+	}
+
+	write_lock_irqsave(&device_info->lock, flags);
+	list_add(&buf->node, &device_info->safe_buffers);
+	write_unlock_irqrestore(&device_info->lock, flags);
+
+	return buf;
+}
+
+/* determine if a buffer is from our "safe" pool */
+static struct safe_buffer *
+find_safe_buffer(struct dmabounce_device_info *device_info,
+		 dma_addr_t safe_dma_addr)
+{
+	struct safe_buffer *b, *rb = NULL;
+	unsigned long flags;
+
+	read_lock_irqsave(&device_info->lock, flags);
+
+	list_for_each_entry(b, &device_info->safe_buffers, node)
+		if (b->safe_dma_addr <= safe_dma_addr &&
+		    b->safe_dma_addr + b->size > safe_dma_addr) {
+			rb = b;
+			break;
+		}
+
+	read_unlock_irqrestore(&device_info->lock, flags);
+	return rb;
+}
+
+static void
+free_safe_buffer(struct dmabounce_device_info *device_info,
+		 struct safe_buffer *buf)
+{
+	unsigned long flags;
+
+	write_lock_irqsave(&device_info->lock, flags);
+	list_del(&buf->node);
+	write_unlock_irqrestore(&device_info->lock, flags);
+
+	bounce_free(buf->pool, buf->safe, buf->size);
+
+	kfree(buf);
+}
+
+/* ************************************************** */
+
+static struct safe_buffer *
+find_safe_buffer_dev(struct device *dev, dma_addr_t dma_addr, const char *where)
+{
+	if (!dev || !g_dmabounce_device_info)
+		return NULL;
+	if (dma_mapping_error(dev, dma_addr)) {
+		dev_err(dev, "Trying to %s invalid mapping\n", where);
+		return NULL;
+	}
+	return find_safe_buffer(g_dmabounce_device_info, dma_addr);
+}
+
+static dma_addr_t
+map_single(struct device *dev, struct safe_buffer *buf, size_t size,
+	   enum dma_data_direction dir, unsigned long attrs)
+{
+	BUG_ON(buf->size != size);
+	BUG_ON(buf->direction != dir);
+
+	dev_dbg(dev, "map: %llx->%llx\n", (u64)buf->unsafe_dma_addr,
+		(u64)buf->safe_dma_addr);
+
+	if ((dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL) &&
+	    !(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+		bcm2838_dma40_memcpy(buf->safe_dma_addr, buf->unsafe_dma_addr,
+				     size);
+
+	return buf->safe_dma_addr;
+}
+
+static dma_addr_t
+unmap_single(struct device *dev, struct safe_buffer *buf, size_t size,
+	     enum dma_data_direction dir, unsigned long attrs)
+{
+	BUG_ON(buf->size != size);
+	BUG_ON(buf->direction != dir);
+
+	if ((dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL) &&
+	    !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) {
+		dev_dbg(dev, "unmap: %llx->%llx\n", (u64)buf->safe_dma_addr,
+			(u64)buf->unsafe_dma_addr);
+
+		bcm2838_dma40_memcpy(buf->unsafe_dma_addr, buf->safe_dma_addr,
+				     size);
+	}
+	return buf->unsafe_dma_addr;
+}
+
+/* ************************************************** */
+
+/*
+ * see if a buffer address is in an 'unsafe' range.  if it is
+ * allocate a 'safe' buffer and copy the unsafe buffer into it.
+ * substitute the safe buffer for the unsafe one.
+ * (basically move the buffer from an unsafe area to a safe one)
+ */
+static dma_addr_t
+dmabounce_map_page(struct device *dev, struct page *page, unsigned long offset,
+		   size_t size, enum dma_data_direction dir,
+		   unsigned long attrs)
+{
+	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
+	dma_addr_t dma_addr;
+
+	dma_addr = phys_to_dma(dev, page_to_phys(page)) + offset;
+
+	swiotlb_sync_single_for_device(dev, dma_addr, size, dir);
+        if (!is_device_dma_coherent(dev))
+		__dma_map_area(phys_to_virt(dma_to_phys(dev, dma_addr)), size, dir);
+
+	if (device_info && (dma_addr + size) > device_info->threshold) {
+		struct safe_buffer *buf;
+
+		buf = alloc_safe_buffer(device_info, dma_addr, size, dir);
+		if (!buf) {
+			DO_STATS(device_info->fail_count++);
+			return (~(dma_addr_t)0x0);
+		}
+
+		DO_STATS(device_info->map_count++);
+
+		dma_addr = map_single(dev, buf, size, dir, attrs);
+	}
+	return dma_addr;
+}
+
+/*
+ * see if a mapped address was really a "safe" buffer and if so, copy
+ * the data from the safe buffer back to the unsafe buffer and free up
+ * the safe buffer.  (basically return things back to the way they
+ * should be)
+ */
+static void
+dmabounce_unmap_page(struct device *dev, dma_addr_t dma_addr, size_t size,
+		     enum dma_data_direction dir, unsigned long attrs)
+{
+	struct safe_buffer *buf;
+
+	buf = find_safe_buffer_dev(dev, dma_addr, __func__);
+	if (buf) {
+		DO_STATS(g_dmabounce_device_info->unmap_count++);
+		dma_addr = unmap_single(dev, buf, size, dir, attrs);
+		free_safe_buffer(g_dmabounce_device_info, buf);
+	}
+
+        if (!is_device_dma_coherent(dev))
+		__dma_unmap_area(phys_to_virt(dma_to_phys(dev, dma_addr)), size, dir);
+	swiotlb_sync_single_for_cpu(dev, dma_addr, size, dir);
+}
+
+/*
+ * A version of dmabounce_map_page that assumes the mapping has already
+ * been created - intended for streaming operation.
+ */
+static void
+dmabounce_sync_for_device(struct device *dev, dma_addr_t dma_addr, size_t size,
+			  enum dma_data_direction dir)
+{
+	struct safe_buffer *buf;
+
+        swiotlb_sync_single_for_device(dev, dma_addr, size, dir);
+        if (!is_device_dma_coherent(dev))
+                __dma_map_area(phys_to_virt(dma_to_phys(dev, dma_addr)), size, dir);
+
+	buf = find_safe_buffer_dev(dev, dma_addr, __func__);
+	if (buf) {
+		DO_STATS(g_dmabounce_device_info->sync_dev_count++);
+		map_single(dev, buf, size, dir, 0);
+	}
+}
+
+/*
+ * A version of dmabounce_unmap_page that doesn't destroy the mapping -
+ * intended for streaming operation.
+ */
+static void
+dmabounce_sync_for_cpu(struct device *dev, dma_addr_t dma_addr,
+		       size_t size, enum dma_data_direction dir)
+{
+	struct safe_buffer *buf;
+
+	buf = find_safe_buffer_dev(dev, dma_addr, __func__);
+	if (buf) {
+		DO_STATS(g_dmabounce_device_info->sync_cpu_count++);
+		dma_addr = unmap_single(dev, buf, size, dir, 0);
+	}
+
+        if (!is_device_dma_coherent(dev))
+                __dma_unmap_area(phys_to_virt(dma_to_phys(dev, dma_addr)), size, dir);
+        swiotlb_sync_single_for_cpu(dev, dma_addr, size, dir);
+}
+
+static int dmabounce_dma_supported(struct device *dev, u64 dma_mask)
+{
+	if (g_dmabounce_device_info)
+		return 0;
+
+	return swiotlb_dma_supported(dev, dma_mask);
+}
+
+static int dmabounce_mapping_error(struct device *dev, dma_addr_t dma_addr)
+{
+	return swiotlb_dma_mapping_error(dev, dma_addr);
+}
+
+static const struct dma_map_ops dmabounce_ops = {
+	.alloc			= arm64_dma_alloc,
+	.free			= arm64_dma_free,
+	.mmap			= arm64_dma_mmap,
+	.get_sgtable		= arm64_dma_get_sgtable,
+	.map_page		= dmabounce_map_page,
+	.unmap_page		= dmabounce_unmap_page,
+	.sync_single_for_cpu	= dmabounce_sync_for_cpu,
+	.sync_single_for_device	= dmabounce_sync_for_device,
+	.map_sg			= arm64_dma_map_sg,
+	.unmap_sg		= arm64_dma_unmap_sg,
+	.sync_sg_for_cpu	= arm64_dma_sync_sg_for_cpu,
+	.sync_sg_for_device	= arm64_dma_sync_sg_for_device,
+	.dma_supported		= dmabounce_dma_supported,
+	.mapping_error		= dmabounce_mapping_error,
+};
+
+int brcm_pcie_bounce_init(struct device *dev,
+			  unsigned long buffer_size,
+			  dma_addr_t threshold)
+{
+	struct dmabounce_device_info *device_info;
+	int ret;
+
+	/* Only support a single client */
+	if (g_dmabounce_device_info)
+		return -EBUSY;
+
+	ret = bcm2838_dma40_memcpy_init();
+	if (ret)
+		return ret;
+
+	device_info = kmalloc(sizeof(struct dmabounce_device_info), GFP_ATOMIC);
+	if (!device_info) {
+		dev_err(dev,
+			"Could not allocated dmabounce_device_info\n");
+		return -ENOMEM;
+	}
+
+	ret = bounce_create(&device_info->pool, dev, buffer_size);
+	if (ret) {
+		dev_err(dev,
+			"dmabounce: could not allocate %ld byte DMA pool\n",
+			buffer_size);
+		goto err_bounce;
+	}
+
+	device_info->dev = dev;
+	device_info->threshold = threshold;
+	INIT_LIST_HEAD(&device_info->safe_buffers);
+	rwlock_init(&device_info->lock);
+
+	DO_STATS(device_info->map_count = 0);
+	DO_STATS(device_info->unmap_count = 0);
+	DO_STATS(device_info->sync_dev_count = 0);
+	DO_STATS(device_info->sync_cpu_count = 0);
+	DO_STATS(device_info->fail_count = 0);
+	DO_STATS(device_info->attr_res =
+		 device_create_file(dev, &dev_attr_dmabounce_stats));
+
+	g_dmabounce_device_info = device_info;
+
+	dev_err(dev, "dmabounce: initialised - %ld kB, threshold %pad\n",
+		 buffer_size / 1024, &threshold);
+
+	return 0;
+
+ err_bounce:
+	kfree(device_info);
+	return ret;
+}
+EXPORT_SYMBOL(brcm_pcie_bounce_init);
+
+void brcm_pcie_bounce_uninit(struct device *dev)
+{
+	struct dmabounce_device_info *device_info = g_dmabounce_device_info;
+
+	g_dmabounce_device_info = NULL;
+
+	if (!device_info) {
+		dev_warn(dev,
+			 "Never registered with dmabounce but attempting"
+			 "to unregister!\n");
+		return;
+	}
+
+	if (!list_empty(&device_info->safe_buffers)) {
+		dev_err(dev,
+			"Removing from dmabounce with pending buffers!\n");
+		BUG();
+	}
+
+	bounce_destroy(&device_info->pool);
+
+	DO_STATS(if (device_info->attr_res == 0)
+			 device_remove_file(dev, &dev_attr_dmabounce_stats));
+
+	kfree(device_info);
+}
+EXPORT_SYMBOL(brcm_pcie_bounce_uninit);
+
+int brcm_pcie_bounce_register_dev(struct device *dev)
+{
+	set_dma_ops(dev, &dmabounce_ops);
+
+	return 0;
+}
+EXPORT_SYMBOL(brcm_pcie_bounce_register_dev);
+
+MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
+MODULE_DESCRIPTION("Dedicate DMA bounce support for pcie-brcmstb");
+MODULE_LICENSE("GPL");
diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index f99ab05ab4778..f279ed67e4e16 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -617,28 +617,6 @@ static const struct dma_map_ops brcm_dma_ops = {
 
 static void brcm_set_dma_ops(struct device *dev)
 {
-	int ret;
-
-	if (IS_ENABLED(CONFIG_ARM64)) {
-		/*
-		 * We are going to invoke get_dma_ops().  That
-		 * function, at this point in time, invokes
-		 * get_arch_dma_ops(), and for ARM64 that function
-		 * returns a pointer to dummy_dma_ops.  So then we'd
-		 * like to call arch_setup_dma_ops(), but that isn't
-		 * exported.  Instead, we call of_dma_configure(),
-		 * which is exported, and this calls
-		 * arch_setup_dma_ops().  Once we do this the call to
-		 * get_dma_ops() will work properly because
-		 * dev->dma_ops will be set.
-		 */
-		ret = of_dma_configure(dev, dev->of_node, true);
-		if (ret) {
-			dev_err(dev, "of_dma_configure() failed: %d\n", ret);
-			return;
-		}
-	}
-
 	arch_dma_ops = get_dma_ops(dev);
 	if (!arch_dma_ops) {
 		dev_err(dev, "failed to get arch_dma_ops\n");
@@ -657,12 +635,12 @@ static int brcmstb_platform_notifier(struct notifier_block *nb,
 	extern unsigned long max_pfn;
 	struct device *dev = __dev;
 	const char *rc_name = "0000:00:00.0";
+	int ret;
 
 	switch (event) {
 	case BUS_NOTIFY_ADD_DEVICE:
 		if (max_pfn > (bounce_threshold/PAGE_SIZE) &&
 		    strcmp(dev->kobj.name, rc_name)) {
-			int ret;
 
 			ret = brcm_pcie_bounce_register_dev(dev);
 			if (ret) {
@@ -671,6 +649,12 @@ static int brcmstb_platform_notifier(struct notifier_block *nb,
 					ret);
 				return ret;
 			}
+		} else if (IS_ENABLED(CONFIG_ARM64)) {
+			ret = of_dma_configure(dev, dev->of_node, true);
+			if (ret) {
+				dev_err(dev, "of_dma_configure() failed: %d\n", ret);
+				return;
+			}
 		}
 		brcm_set_dma_ops(dev);
 		return NOTIFY_OK;
-- 
GitLab


From fc5826fb999e0b32900d1f487e90c27a92010214 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Thu, 15 Aug 2019 12:02:34 +0100
Subject: [PATCH 1427/1835] configs: arm64/vcm2711: Enable V3D

Enable the V3D driver, which depends on BCM2835_POWER.

Originally submitted by GitHub user 'phire' in a slightly different
form.

See: https://github.com/raspberrypi/linux/pull/3063

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm64/configs/bcm2711_defconfig | 2 ++
 drivers/gpu/drm/v3d/Kconfig          | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index e06ba27ccb255..200f66c006d68 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -791,6 +791,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM_UDL=m
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_TINYDRM=m
 CONFIG_TINYDRM_MI0283QT=m
@@ -1135,6 +1136,7 @@ CONFIG_VIDEO_BCM2835=m
 CONFIG_MAILBOX=y
 CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_BCM2835_POWER=y
 CONFIG_RASPBERRYPI_POWER=y
 CONFIG_EXTCON=m
 CONFIG_EXTCON_ARIZONA=m
diff --git a/drivers/gpu/drm/v3d/Kconfig b/drivers/gpu/drm/v3d/Kconfig
index 1552bf552c942..2967459b8fb0f 100644
--- a/drivers/gpu/drm/v3d/Kconfig
+++ b/drivers/gpu/drm/v3d/Kconfig
@@ -1,6 +1,6 @@
 config DRM_V3D
 	tristate "Broadcom V3D 3.x and newer"
-	depends on ARCH_BCM || ARCH_BCMSTB || COMPILE_TEST
+	depends on ARCH_BCM || ARCH_BCMSTB || ARCH_BCM2835 || COMPILE_TEST
 	depends on DRM
 	depends on COMMON_CLK
 	depends on MMU
-- 
GitLab


From 805bd34ac2690ada3ea93407d95936190662bd32 Mon Sep 17 00:00:00 2001
From: Gwendal Grignou <gwendal@chromium.org>
Date: Fri, 28 Jun 2019 12:17:09 -0700
Subject: [PATCH 1428/1835] iio: cros_ec_accel_legacy: Fix incorrect channel
 setting

commit 6cdff99c9f7d7d28b87cf05dd464f7c7736332ae upstream.

INFO_SCALE is set both for each channel and all channels.
iio is using all channel setting, so the error was not user visible.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/cros_ec_accel_legacy.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/iio/accel/cros_ec_accel_legacy.c b/drivers/iio/accel/cros_ec_accel_legacy.c
index 063e89eff791a..c776a3509a717 100644
--- a/drivers/iio/accel/cros_ec_accel_legacy.c
+++ b/drivers/iio/accel/cros_ec_accel_legacy.c
@@ -328,7 +328,6 @@ static const struct iio_chan_spec_ext_info cros_ec_accel_legacy_ext_info[] = {
 		.modified = 1,					        \
 		.info_mask_separate =					\
 			BIT(IIO_CHAN_INFO_RAW) |			\
-			BIT(IIO_CHAN_INFO_SCALE) |			\
 			BIT(IIO_CHAN_INFO_CALIBBIAS),			\
 		.info_mask_shared_by_all = BIT(IIO_CHAN_INFO_SCALE),	\
 		.ext_info = cros_ec_accel_legacy_ext_info,		\
-- 
GitLab


From fcab3783017779e1969c017b9a9bbbc605807e4a Mon Sep 17 00:00:00 2001
From: Joe Perches <joe@perches.com>
Date: Tue, 9 Jul 2019 22:04:17 -0700
Subject: [PATCH 1429/1835] iio: adc: max9611: Fix misuse of GENMASK macro

commit ae8cc91a7d85e018c0c267f580820b2bb558cd48 upstream.

Arguments are supposed to be ordered high then low.

Signed-off-by: Joe Perches <joe@perches.com>
Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver")
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/max9611.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index 0538ff8c4ac1d..ce9af43fa2de7 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -86,7 +86,7 @@
 #define MAX9611_TEMP_MAX_POS		0x7f80
 #define MAX9611_TEMP_MAX_NEG		0xff80
 #define MAX9611_TEMP_MIN_NEG		0xd980
-#define MAX9611_TEMP_MASK		GENMASK(7, 15)
+#define MAX9611_TEMP_MASK		GENMASK(15, 7)
 #define MAX9611_TEMP_SHIFT		0x07
 #define MAX9611_TEMP_RAW(_r)		((_r) >> MAX9611_TEMP_SHIFT)
 #define MAX9611_TEMP_SCALE_NUM		1000000
-- 
GitLab


From 6b8f93b5a4f78bed2bd8373987cf47614a415c45 Mon Sep 17 00:00:00 2001
From: Ivan Bornyakov <brnkv.i1@gmail.com>
Date: Wed, 10 Jul 2019 23:45:18 +0300
Subject: [PATCH 1430/1835] staging: gasket: apex: fix copy-paste typo

commit 66665bb9979246729562a09fcdbb101c83127989 upstream.

In sysfs_show() case-branches ATTR_KERNEL_HIB_PAGE_TABLE_SIZE and
ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE do the same. It looks like
copy-paste mistake.

Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190710204518.16814-1-brnkv.i1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/gasket/apex_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/gasket/apex_driver.c b/drivers/staging/gasket/apex_driver.c
index c747e9ca45186..0cef1d6d2e2b0 100644
--- a/drivers/staging/gasket/apex_driver.c
+++ b/drivers/staging/gasket/apex_driver.c
@@ -538,7 +538,7 @@ static ssize_t sysfs_show(struct device *device, struct device_attribute *attr,
 		break;
 	case ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE:
 		ret = scnprintf(buf, PAGE_SIZE, "%u\n",
-				gasket_page_table_num_entries(
+				gasket_page_table_num_simple_entries(
 					gasket_dev->page_table[0]));
 		break;
 	case ATTR_KERNEL_HIB_NUM_ACTIVE_PAGES:
-- 
GitLab


From b9de21575a20a1c252b820555433c48ae978e70d Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Mon, 1 Jul 2019 19:55:19 +0900
Subject: [PATCH 1431/1835] staging: android: ion: Bail out upon SIGKILL when
 allocating memory.

commit 8f9e86ee795971eabbf372e6d804d6b8578287a7 upstream.

syzbot found that a thread can stall for minutes inside
ion_system_heap_allocate() after that thread was killed by SIGKILL [1].
Let's check for SIGKILL before doing memory allocation.

[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@syzkaller.appspotmail.com>
Acked-by: Laura Abbott <labbott@redhat.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://lore.kernel.org/r/d088f188-5f32-d8fc-b9a0-0b404f7501cc@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/android/ion/ion_page_pool.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/android/ion/ion_page_pool.c b/drivers/staging/android/ion/ion_page_pool.c
index 9bc56eb48d2a8..890d264ac6879 100644
--- a/drivers/staging/android/ion/ion_page_pool.c
+++ b/drivers/staging/android/ion/ion_page_pool.c
@@ -8,11 +8,14 @@
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/swap.h>
+#include <linux/sched/signal.h>
 
 #include "ion.h"
 
 static inline struct page *ion_page_pool_alloc_pages(struct ion_page_pool *pool)
 {
+	if (fatal_signal_pending(current))
+		return NULL;
 	return alloc_pages(pool->gfp_mask, pool->order);
 }
 
-- 
GitLab


From 1c4393df3622d4a00aadff617b8fbcddc3c17204 Mon Sep 17 00:00:00 2001
From: Gary R Hook <gary.hook@amd.com>
Date: Tue, 30 Jul 2019 16:05:22 +0000
Subject: [PATCH 1432/1835] crypto: ccp - Fix oops by properly managing
 allocated structures

commit 25e44338321af545ab34243a6081c3f0fc6107d0 upstream.

A plaintext or ciphertext length of 0 is allowed in AES, in which case
no encryption occurs. Ensure that we don't clean up data structures
that were never allocated.

Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-ops.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index e212badd39fa4..43129a5b69fe9 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -862,11 +862,11 @@ e_tag:
 	ccp_dm_free(&final_wa);
 
 e_dst:
-	if (aes->src_len && !in_place)
+	if (ilen > 0 && !in_place)
 		ccp_free_data(&dst, cmd_q);
 
 e_src:
-	if (aes->src_len)
+	if (ilen > 0)
 		ccp_free_data(&src, cmd_q);
 
 e_aad:
-- 
GitLab


From 30692edea30d633212e01f2378ac94d09c52f5d3 Mon Sep 17 00:00:00 2001
From: Gary R Hook <gary.hook@amd.com>
Date: Tue, 30 Jul 2019 16:05:24 +0000
Subject: [PATCH 1433/1835] crypto: ccp - Add support for valid authsize values
 less than 16

commit 9f00baf74e4b6f79a3a3dfab44fb7bb2e797b551 upstream.

AES GCM encryption allows for authsize values of 4, 8, and 12-16 bytes.
Validate the requested authsize, and retain it to save in the request
context.

Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-crypto-aes-galois.c | 14 ++++++++++++
 drivers/crypto/ccp/ccp-ops.c               | 26 +++++++++++++++++-----
 include/linux/ccp.h                        |  2 ++
 3 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-crypto-aes-galois.c b/drivers/crypto/ccp/ccp-crypto-aes-galois.c
index ca1f0d780b61c..e5dcb29b687f6 100644
--- a/drivers/crypto/ccp/ccp-crypto-aes-galois.c
+++ b/drivers/crypto/ccp/ccp-crypto-aes-galois.c
@@ -61,6 +61,19 @@ static int ccp_aes_gcm_setkey(struct crypto_aead *tfm, const u8 *key,
 static int ccp_aes_gcm_setauthsize(struct crypto_aead *tfm,
 				   unsigned int authsize)
 {
+	switch (authsize) {
+	case 16:
+	case 15:
+	case 14:
+	case 13:
+	case 12:
+	case 8:
+	case 4:
+		break;
+	default:
+		return -EINVAL;
+	}
+
 	return 0;
 }
 
@@ -107,6 +120,7 @@ static int ccp_aes_gcm_crypt(struct aead_request *req, bool encrypt)
 	memset(&rctx->cmd, 0, sizeof(rctx->cmd));
 	INIT_LIST_HEAD(&rctx->cmd.entry);
 	rctx->cmd.engine = CCP_ENGINE_AES;
+	rctx->cmd.u.aes.authsize = crypto_aead_authsize(tfm);
 	rctx->cmd.u.aes.type = ctx->u.aes.type;
 	rctx->cmd.u.aes.mode = ctx->u.aes.mode;
 	rctx->cmd.u.aes.action = encrypt;
diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 43129a5b69fe9..a01db9a8ca14f 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -625,6 +625,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 
 	unsigned long long *final;
 	unsigned int dm_offset;
+	unsigned int authsize;
 	unsigned int jobid;
 	unsigned int ilen;
 	bool in_place = true; /* Default value */
@@ -646,6 +647,21 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 	if (!aes->key) /* Gotta have a key SGL */
 		return -EINVAL;
 
+	/* Zero defaults to 16 bytes, the maximum size */
+	authsize = aes->authsize ? aes->authsize : AES_BLOCK_SIZE;
+	switch (authsize) {
+	case 16:
+	case 15:
+	case 14:
+	case 13:
+	case 12:
+	case 8:
+	case 4:
+		break;
+	default:
+		return -EINVAL;
+	}
+
 	/* First, decompose the source buffer into AAD & PT,
 	 * and the destination buffer into AAD, CT & tag, or
 	 * the input into CT & tag.
@@ -660,7 +676,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 		p_tag = scatterwalk_ffwd(sg_tag, p_outp, ilen);
 	} else {
 		/* Input length for decryption includes tag */
-		ilen = aes->src_len - AES_BLOCK_SIZE;
+		ilen = aes->src_len - authsize;
 		p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen);
 	}
 
@@ -842,19 +858,19 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 
 	if (aes->action == CCP_AES_ACTION_ENCRYPT) {
 		/* Put the ciphered tag after the ciphertext. */
-		ccp_get_dm_area(&final_wa, 0, p_tag, 0, AES_BLOCK_SIZE);
+		ccp_get_dm_area(&final_wa, 0, p_tag, 0, authsize);
 	} else {
 		/* Does this ciphered tag match the input? */
-		ret = ccp_init_dm_workarea(&tag, cmd_q, AES_BLOCK_SIZE,
+		ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
 					   DMA_BIDIRECTIONAL);
 		if (ret)
 			goto e_tag;
-		ret = ccp_set_dm_area(&tag, 0, p_tag, 0, AES_BLOCK_SIZE);
+		ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
 		if (ret)
 			goto e_tag;
 
 		ret = crypto_memneq(tag.address, final_wa.address,
-				    AES_BLOCK_SIZE) ? -EBADMSG : 0;
+				    authsize) ? -EBADMSG : 0;
 		ccp_dm_free(&tag);
 	}
 
diff --git a/include/linux/ccp.h b/include/linux/ccp.h
index 7e9c991c95e03..43ed9e77cf81a 100644
--- a/include/linux/ccp.h
+++ b/include/linux/ccp.h
@@ -173,6 +173,8 @@ struct ccp_aes_engine {
 	enum ccp_aes_mode mode;
 	enum ccp_aes_action action;
 
+	u32 authsize;
+
 	struct scatterlist *key;
 	u32 key_len;		/* In bytes */
 
-- 
GitLab


From 6dbc3b74daeb3475354cd135fcbfe14ae6abfe24 Mon Sep 17 00:00:00 2001
From: Gary R Hook <gary.hook@amd.com>
Date: Tue, 30 Jul 2019 16:05:26 +0000
Subject: [PATCH 1434/1835] crypto: ccp - Ignore tag length when decrypting GCM
 ciphertext

commit e2664ecbb2f26225ac6646876f2899558ffb2604 upstream.

AES GCM input buffers for decryption contain AAD+CTEXT+TAG. Only
decrypt the ciphertext, and use the tag for comparison.

Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-ops.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index a01db9a8ca14f..1e2e42106dee0 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -785,8 +785,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
 		while (src.sg_wa.bytes_left) {
 			ccp_prepare_data(&src, &dst, &op, AES_BLOCK_SIZE, true);
 			if (!src.sg_wa.bytes_left) {
-				unsigned int nbytes = aes->src_len
-						      % AES_BLOCK_SIZE;
+				unsigned int nbytes = ilen % AES_BLOCK_SIZE;
 
 				if (nbytes) {
 					op.eom = 1;
-- 
GitLab


From b43611cd762c8b74b4ab4c714aa8de3beb08ff5c Mon Sep 17 00:00:00 2001
From: Gavin Li <git@thegavinli.com>
Date: Sun, 4 Aug 2019 16:50:44 -0700
Subject: [PATCH 1435/1835] usb: usbfs: fix double-free of usb memory upon
 submiturb error

commit c43f28dfdc4654e738aa6d3fd08a105b2bee758d upstream.

Upon an error within proc_do_submiturb(), dec_usb_memory_use_count()
gets called once by the error handling tail and again by free_async().
Remove the first call.

Signed-off-by: Gavin Li <git@thegavinli.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190804235044.22327-1-gavinli@thegavinli.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/devio.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index ffccd40ea67da..29c6414f48f13 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1792,8 +1792,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 	return 0;
 
  error:
-	if (as && as->usbm)
-		dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
 	kfree(isopkt);
 	kfree(dr);
 	if (as)
-- 
GitLab


From d397091dbac0716645e0e5b090246337691d1d1e Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 8 Aug 2019 11:27:28 +0200
Subject: [PATCH 1436/1835] usb: iowarrior: fix deadlock on disconnect

commit c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 upstream.

We have to drop the mutex before we close() upon disconnect()
as close() needs the lock. This is safe to do by dropping the
mutex as intfdata is already set to NULL, so open() will fail.

Fixes: 03f36e885fc26 ("USB: open disconnect race in iowarrior")
Reported-by: syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/iowarrior.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index c2991b8a65ce4..55db0fc87927e 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -866,19 +866,20 @@ static void iowarrior_disconnect(struct usb_interface *interface)
 	dev = usb_get_intfdata(interface);
 	mutex_lock(&iowarrior_open_disc_lock);
 	usb_set_intfdata(interface, NULL);
+	/* prevent device read, write and ioctl */
+	dev->present = 0;
 
 	minor = dev->minor;
+	mutex_unlock(&iowarrior_open_disc_lock);
+	/* give back our minor - this will call close() locks need to be dropped at this point*/
 
-	/* give back our minor */
 	usb_deregister_dev(interface, &iowarrior_class);
 
 	mutex_lock(&dev->mutex);
 
 	/* prevent device read, write and ioctl */
-	dev->present = 0;
 
 	mutex_unlock(&dev->mutex);
-	mutex_unlock(&iowarrior_open_disc_lock);
 
 	if (dev->opened) {
 		/* There is a process that holds a filedescriptor to the device ,
-- 
GitLab


From 9575ba61ba19edea77575c28bc2f6ff1f8145298 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Thu, 8 Aug 2019 00:15:21 -0500
Subject: [PATCH 1437/1835] sound: fix a memory leak bug

commit c7cd7c748a3250ca33509f9235efab9c803aca09 upstream.

In sound_insert_unit(), the controlling structure 's' is allocated through
kmalloc(). Then it is added to the sound driver list by invoking
__sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is
removed from the list through __sound_remove_unit(). If 'index' is not less
than 0, -EBUSY is returned to indicate the error. However, 's' is not
deallocated on this execution path, leading to a memory leak bug.

To fix the above issue, free 's' before -EBUSY is returned.

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/sound_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/sound_core.c b/sound/sound_core.c
index 40ad000c2e3ca..dd64c4b19f239 100644
--- a/sound/sound_core.c
+++ b/sound/sound_core.c
@@ -280,7 +280,8 @@ retry:
 				goto retry;
 			}
 			spin_unlock(&sound_loader_lock);
-			return -EBUSY;
+			r = -EBUSY;
+			goto fail;
 		}
 	}
 
-- 
GitLab


From fd3f902dd1d5e7021b46ecc1e38ed00c9fa0ba4b Mon Sep 17 00:00:00 2001
From: Kevin Hao <haokexin@gmail.com>
Date: Fri, 26 Jul 2019 10:30:48 +0800
Subject: [PATCH 1438/1835] mmc: cavium: Set the correct dma max segment size
 for mmc_host

commit fa25eba6993b3750f417baabba169afaba076178 upstream.

We have set the mmc_host.max_seg_size to 8M, but the dma max segment
size of PCI device is set to 64K by default in function pci_device_add().
The mmc_host.max_seg_size is used to set the max segment size of
the blk queue. Then this mismatch will trigger a calltrace like below
when a bigger than 64K segment request arrives at mmc dev. So we should
consider the limitation of the cvm_mmc_host when setting the
mmc_host.max_seg_size.
  DMA-API: thunderx_mmc 0000:01:01.4: mapping sg segment longer than device claims to support [len=131072] [max=65536]
  WARNING: CPU: 6 PID: 238 at kernel/dma/debug.c:1221 debug_dma_map_sg+0x2b8/0x350
  Modules linked in:
  CPU: 6 PID: 238 Comm: kworker/6:1H Not tainted 5.3.0-rc1-next-20190724-yocto-standard+ #62
  Hardware name: Marvell OcteonTX CN96XX board (DT)
  Workqueue: kblockd blk_mq_run_work_fn
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : debug_dma_map_sg+0x2b8/0x350
  lr : debug_dma_map_sg+0x2b8/0x350
  sp : ffff00001770f9e0
  x29: ffff00001770f9e0 x28: ffffffff00000000
  x27: 00000000ffffffff x26: ffff800bc2c73180
  x25: ffff000010e83700 x24: 0000000000000002
  x23: 0000000000000001 x22: 0000000000000001
  x21: 0000000000000000 x20: ffff800bc48ba0b0
  x19: ffff800bc97e8c00 x18: ffffffffffffffff
  x17: 0000000000000000 x16: 0000000000000000
  x15: ffff000010e835c8 x14: 6874207265676e6f
  x13: 6c20746e656d6765 x12: 7320677320676e69
  x11: 7070616d203a342e x10: 31303a31303a3030
  x9 : 303020636d6d5f78 x8 : 35363d78616d5b20
  x7 : 00000000000002fd x6 : ffff000010fd57dc
  x5 : 0000000000000000 x4 : ffff0000106c61f0
  x3 : 00000000ffffffff x2 : 0000800bee060000
  x1 : 7010678df3041a00 x0 : 0000000000000000
  Call trace:
   debug_dma_map_sg+0x2b8/0x350
   cvm_mmc_request+0x3c4/0x988
   __mmc_start_request+0x9c/0x1f8
   mmc_start_request+0x7c/0xb0
   mmc_blk_mq_issue_rq+0x5c4/0x7b8
   mmc_mq_queue_rq+0x11c/0x278
   blk_mq_dispatch_rq_list+0xb0/0x568
   blk_mq_do_dispatch_sched+0x6c/0x108
   blk_mq_sched_dispatch_requests+0x110/0x1b8
   __blk_mq_run_hw_queue+0xb0/0x118
   blk_mq_run_work_fn+0x28/0x38
   process_one_work+0x210/0x490
   worker_thread+0x48/0x458
   kthread+0x130/0x138
   ret_from_fork+0x10/0x1c

Signed-off-by: Kevin Hao <haokexin@gmail.com>
Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/cavium.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index ed5cefb837683..c956813bc6bd4 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -1046,7 +1046,8 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
 		mmc->max_segs = 1;
 
 	/* DMA size field can address up to 8 MB */
-	mmc->max_seg_size = 8 * 1024 * 1024;
+	mmc->max_seg_size = min_t(unsigned int, 8 * 1024 * 1024,
+				  dma_get_max_seg_size(host->dev));
 	mmc->max_req_size = mmc->max_seg_size;
 	/* External DMA is in 512 byte blocks */
 	mmc->max_blk_size = 512;
-- 
GitLab


From d79d76f2bbb0cb20c467bd7dd86658f5e7724016 Mon Sep 17 00:00:00 2001
From: Kevin Hao <haokexin@gmail.com>
Date: Fri, 26 Jul 2019 10:30:49 +0800
Subject: [PATCH 1439/1835] mmc: cavium: Add the missing dma unmap when the dma
 has finished.

commit b803974a86039913d5280add083d730b2b9ed8ec upstream.

This fixes the below calltrace when the CONFIG_DMA_API_DEBUG is enabled.
  DMA-API: thunderx_mmc 0000:01:01.4: cpu touching an active dma mapped cacheline [cln=0x000000002fdf9800]
  WARNING: CPU: 21 PID: 1 at kernel/dma/debug.c:596 debug_dma_assert_idle+0x1f8/0x270
  Modules linked in:
  CPU: 21 PID: 1 Comm: init Not tainted 5.3.0-rc1-next-20190725-yocto-standard+ #64
  Hardware name: Marvell OcteonTX CN96XX board (DT)
  pstate: 80400009 (Nzcv daif +PAN -UAO)
  pc : debug_dma_assert_idle+0x1f8/0x270
  lr : debug_dma_assert_idle+0x1f8/0x270
  sp : ffff0000113cfc10
  x29: ffff0000113cfc10 x28: 0000ffff8c880000
  x27: ffff800bc72a0000 x26: ffff000010ff8000
  x25: ffff000010ff8940 x24: ffff000010ff8968
  x23: 0000000000000000 x22: ffff000010e83700
  x21: ffff000010ea2000 x20: ffff000010e835c8
  x19: ffff800bc2c73300 x18: ffffffffffffffff
  x17: 0000000000000000 x16: 0000000000000000
  x15: ffff000010e835c8 x14: 6d20616d64206576
  x13: 69746361206e6120 x12: 676e696863756f74
  x11: 20757063203a342e x10: 31303a31303a3030
  x9 : 303020636d6d5f78 x8 : 3230303030303030
  x7 : 00000000000002fd x6 : ffff000010fd57d0
  x5 : 0000000000000000 x4 : ffff0000106c5210
  x3 : 00000000ffffffff x2 : 0000800bee9c0000
  x1 : 57d5843f4aa62800 x0 : 0000000000000000
  Call trace:
   debug_dma_assert_idle+0x1f8/0x270
   wp_page_copy+0xb0/0x688
   do_wp_page+0xa8/0x5b8
   __handle_mm_fault+0x600/0xd00
   handle_mm_fault+0x118/0x1e8
   do_page_fault+0x200/0x500
   do_mem_abort+0x50/0xb0
   el0_da+0x20/0x24
  ---[ end trace a005534bd23e109f ]---
  DMA-API: Mapped at:
   debug_dma_map_sg+0x94/0x350
   cvm_mmc_request+0x3c4/0x988
   __mmc_start_request+0x9c/0x1f8
   mmc_start_request+0x7c/0xb0
   mmc_blk_mq_issue_rq+0x5c4/0x7b8

Signed-off-by: Kevin Hao <haokexin@gmail.com>
Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/cavium.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index c956813bc6bd4..89deb451e0ac6 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -374,6 +374,7 @@ static int finish_dma_single(struct cvm_mmc_host *host, struct mmc_data *data)
 {
 	data->bytes_xfered = data->blocks * data->blksz;
 	data->error = 0;
+	dma_unmap_sg(host->dev, data->sg, data->sg_len, get_dma_dir(data));
 	return 1;
 }
 
-- 
GitLab


From c9a1c10487b988d664f318a69962ac71dba0db90 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Thu, 8 Aug 2019 11:17:01 -0400
Subject: [PATCH 1440/1835] loop: set PF_MEMALLOC_NOIO for the worker thread

commit d0a255e795ab976481565f6ac178314b34fbf891 upstream.

A deadlock with this stacktrace was observed.

The loop thread does a GFP_KERNEL allocation, it calls into dm-bufio
shrinker and the shrinker depends on I/O completion in the dm-bufio
subsystem.

In order to fix the deadlock (and other similar ones), we set the flag
PF_MEMALLOC_NOIO at loop thread entry.

PID: 474    TASK: ffff8813e11f4600  CPU: 10  COMMAND: "kswapd0"
   #0 [ffff8813dedfb938] __schedule at ffffffff8173f405
   #1 [ffff8813dedfb990] schedule at ffffffff8173fa27
   #2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec
   #3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186
   #4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f
   #5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8
   #6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81
   #7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio]
   #8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio]
   #9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio]
  #10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce
  #11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778
  #12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f
  #13 [ffff8813dedfbec0] kthread at ffffffff810a8428
  #14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242

  PID: 14127  TASK: ffff881455749c00  CPU: 11  COMMAND: "loop1"
   #0 [ffff88272f5af228] __schedule at ffffffff8173f405
   #1 [ffff88272f5af280] schedule at ffffffff8173fa27
   #2 [ffff88272f5af2a0] schedule_preempt_disabled at ffffffff8173fd5e
   #3 [ffff88272f5af2b0] __mutex_lock_slowpath at ffffffff81741fb5
   #4 [ffff88272f5af330] mutex_lock at ffffffff81742133
   #5 [ffff88272f5af350] dm_bufio_shrink_count at ffffffffa03865f9 [dm_bufio]
   #6 [ffff88272f5af380] shrink_slab at ffffffff811a86bd
   #7 [ffff88272f5af470] shrink_zone at ffffffff811ad778
   #8 [ffff88272f5af500] do_try_to_free_pages at ffffffff811adb34
   #9 [ffff88272f5af590] try_to_free_pages at ffffffff811adef8
  #10 [ffff88272f5af610] __alloc_pages_nodemask at ffffffff811a09c3
  #11 [ffff88272f5af710] alloc_pages_current at ffffffff811e8b71
  #12 [ffff88272f5af760] new_slab at ffffffff811f4523
  #13 [ffff88272f5af7b0] __slab_alloc at ffffffff8173a1b5
  #14 [ffff88272f5af880] kmem_cache_alloc at ffffffff811f484b
  #15 [ffff88272f5af8d0] do_blockdev_direct_IO at ffffffff812535b3
  #16 [ffff88272f5afb00] __blockdev_direct_IO at ffffffff81255dc3
  #17 [ffff88272f5afb30] xfs_vm_direct_IO at ffffffffa01fe3fc [xfs]
  #18 [ffff88272f5afb90] generic_file_read_iter at ffffffff81198994
  #19 [ffff88272f5afc50] __dta_xfs_file_read_iter_2398 at ffffffffa020c970 [xfs]
  #20 [ffff88272f5afcc0] lo_rw_aio at ffffffffa0377042 [loop]
  #21 [ffff88272f5afd70] loop_queue_work at ffffffffa0377c3b [loop]
  #22 [ffff88272f5afe60] kthread_worker_fn at ffffffff810a8a0c
  #23 [ffff88272f5afec0] kthread at ffffffff810a8428
  #24 [ffff88272f5aff50] ret_from_fork at ffffffff81745242

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/loop.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index f1e63eb7cbca6..cef8e00c9d9d6 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -886,7 +886,7 @@ static void loop_unprepare_queue(struct loop_device *lo)
 
 static int loop_kthread_worker_fn(void *worker_ptr)
 {
-	current->flags |= PF_LESS_THROTTLE;
+	current->flags |= PF_LESS_THROTTLE | PF_MEMALLOC_NOIO;
 	return kthread_worker_fn(worker_ptr);
 }
 
-- 
GitLab


From ce7d4fe4e52bf60bff9e70e977f3ead097a8854b Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 1 Aug 2019 09:40:26 -0700
Subject: [PATCH 1441/1835] Input: usbtouchscreen - initialize PM mutex before
 using it

commit b55d996f057bf2e7ba9422a80b5e17e99860cb0b upstream.

Mutexes shall be initialized before they are used.

Fixes: 12e510dbc57b2 ("Input: usbtouchscreen - fix deadlock in autosuspend")
Reported-by: syzbot+199ea16c7f26418b4365@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/touchscreen/usbtouchscreen.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index d61570d64ee76..48304e26f988b 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -1672,6 +1672,8 @@ static int usbtouch_probe(struct usb_interface *intf,
 	if (!usbtouch || !input_dev)
 		goto out_free;
 
+	mutex_init(&usbtouch->pm_mutex);
+
 	type = &usbtouch_dev_info[id->driver_info];
 	usbtouch->type = type;
 	if (!type->process_pkt)
-- 
GitLab


From 3d180fe5cd7625b67e0879ffa1f6ae1f09385485 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Mon, 22 Jul 2019 10:56:55 +0300
Subject: [PATCH 1442/1835] Input: elantech - enable SMBus on new (2018+)
 systems

commit 883a2a80f79ca5c0c105605fafabd1f3df99b34c upstream.

There are some new HP laptops with Elantech touchpad that don't support
multitouch.

Currently we use ETP_NEW_IC_SMBUS_HOST_NOTIFY() to check if SMBus is supported,
but in addition to firmware version, the bus type also informs us whether the IC
can support SMBus. To avoid breaking old ICs, we will only enable SMbus support
based the bus type on systems manufactured after 2018.

Lastly, let's consolidate all checks into elantech_use_host_notify() and use it
to determine whether to use PS/2 or SMBus.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/elantech.c | 54 ++++++++++++++++------------------
 1 file changed, 25 insertions(+), 29 deletions(-)

diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 530142b5a1154..eb9b9de47fd1c 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1810,6 +1810,30 @@ static int elantech_create_smbus(struct psmouse *psmouse,
 				  leave_breadcrumbs);
 }
 
+static bool elantech_use_host_notify(struct psmouse *psmouse,
+				     struct elantech_device_info *info)
+{
+	if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+		return true;
+
+	switch (info->bus) {
+	case ETP_BUS_PS2_ONLY:
+		/* expected case */
+		break;
+	case ETP_BUS_SMB_HST_NTFY_ONLY:
+	case ETP_BUS_PS2_SMB_HST_NTFY:
+		/* SMbus implementation is stable since 2018 */
+		if (dmi_get_bios_year() >= 2018)
+			return true;
+	default:
+		psmouse_dbg(psmouse,
+			    "Ignoring SMBus bus provider %d\n", info->bus);
+		break;
+	}
+
+	return false;
+}
+
 /**
  * elantech_setup_smbus - called once the PS/2 devices are enumerated
  * and decides to instantiate a SMBus InterTouch device.
@@ -1829,7 +1853,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
 		 * i2c_blacklist_pnp_ids.
 		 * Old ICs are up to the user to decide.
 		 */
-		if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
+		if (!elantech_use_host_notify(psmouse, info) ||
 		    psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
 			return -ENXIO;
 	}
@@ -1849,34 +1873,6 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
 	return 0;
 }
 
-static bool elantech_use_host_notify(struct psmouse *psmouse,
-				     struct elantech_device_info *info)
-{
-	if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
-		return true;
-
-	switch (info->bus) {
-	case ETP_BUS_PS2_ONLY:
-		/* expected case */
-		break;
-	case ETP_BUS_SMB_ALERT_ONLY:
-		/* fall-through  */
-	case ETP_BUS_PS2_SMB_ALERT:
-		psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
-		break;
-	case ETP_BUS_SMB_HST_NTFY_ONLY:
-		/* fall-through  */
-	case ETP_BUS_PS2_SMB_HST_NTFY:
-		return true;
-	default:
-		psmouse_dbg(psmouse,
-			    "Ignoring SMBus bus provider %d.\n",
-			    info->bus);
-	}
-
-	return false;
-}
-
 int elantech_init_smbus(struct psmouse *psmouse)
 {
 	struct elantech_device_info info;
-- 
GitLab


From b8a2169bcad849d595a8e5ac19d2df2e37a2d55c Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Fri, 12 Jul 2019 11:37:17 -0700
Subject: [PATCH 1443/1835] Input: synaptics - enable RMI mode for HP Spectre
 X360

commit 25f8c834e2a6871920cc1ca113f02fb301d007c3 upstream.

The 2016 kabylake HP Spectre X360 (model number 13-w013dx) works much better
with psmouse.synaptics_intertouch=1 kernel parameter, so let's enable RMI4
mode automatically.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204115
Reported-by: Nate Graham <pointedstick@zoho.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/synaptics.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index af7d48431b851..06cebde2422ea 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -185,6 +185,7 @@ static const char * const smbus_pnp_ids[] = {
 	"LEN2055", /* E580 */
 	"SYN3052", /* HP EliteBook 840 G4 */
 	"SYN3221", /* HP 15-ay000 */
+	"SYN323d", /* HP Spectre X360 13-w013dx */
 	NULL
 };
 
-- 
GitLab


From dd524d488f5bd2cc6421f1b82e8e87c104ec51ad Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Fri, 19 Jul 2019 20:46:50 +0200
Subject: [PATCH 1444/1835] x86/mm: Check for pfn instead of page in
 vmalloc_sync_one()

commit 51b75b5b563a2637f9d8dc5bd02a31b2ff9e5ea0 upstream.

Do not require a struct page for the mapped memory location because it
might not exist. This can happen when an ioremapped region is mapped with
2MB pages.

Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lkml.kernel.org/r/20190719184652.11391-2-joro@8bytes.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/fault.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9d9765e4d1ef1..4d12176a470ee 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -267,7 +267,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
 	if (!pmd_present(*pmd))
 		set_pmd(pmd, *pmd_k);
 	else
-		BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k));
+		BUG_ON(pmd_pfn(*pmd) != pmd_pfn(*pmd_k));
 
 	return pmd_k;
 }
-- 
GitLab


From 9935d7ed8406f62ae49a7ebf8109a81c704b2c1f Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Fri, 19 Jul 2019 20:46:51 +0200
Subject: [PATCH 1445/1835] x86/mm: Sync also unmappings in vmalloc_sync_all()

commit 8e998fc24de47c55b47a887f6c95ab91acd4a720 upstream.

With huge-page ioremap areas the unmappings also need to be synced between
all page-tables. Otherwise it can cause data corruption when a region is
unmapped and later re-used.

Make the vmalloc_sync_one() function ready to sync unmappings and make sure
vmalloc_sync_all() iterates over all page-tables even when an unmapped PMD
is found.

Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lkml.kernel.org/r/20190719184652.11391-3-joro@8bytes.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/fault.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 4d12176a470ee..1bcb7242ad79a 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -261,11 +261,12 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
 
 	pmd = pmd_offset(pud, address);
 	pmd_k = pmd_offset(pud_k, address);
-	if (!pmd_present(*pmd_k))
-		return NULL;
 
-	if (!pmd_present(*pmd))
+	if (pmd_present(*pmd) != pmd_present(*pmd_k))
 		set_pmd(pmd, *pmd_k);
+
+	if (!pmd_present(*pmd_k))
+		return NULL;
 	else
 		BUG_ON(pmd_pfn(*pmd) != pmd_pfn(*pmd_k));
 
@@ -287,17 +288,13 @@ void vmalloc_sync_all(void)
 		spin_lock(&pgd_lock);
 		list_for_each_entry(page, &pgd_list, lru) {
 			spinlock_t *pgt_lock;
-			pmd_t *ret;
 
 			/* the pgt_lock only for Xen */
 			pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
 
 			spin_lock(pgt_lock);
-			ret = vmalloc_sync_one(page_address(page), address);
+			vmalloc_sync_one(page_address(page), address);
 			spin_unlock(pgt_lock);
-
-			if (!ret)
-				break;
 		}
 		spin_unlock(&pgd_lock);
 	}
-- 
GitLab


From 46b306f3cd7b47901382ca014eb1082b4b25db4a Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Fri, 19 Jul 2019 20:46:52 +0200
Subject: [PATCH 1446/1835] mm/vmalloc: Sync unmappings in
 __purge_vmap_area_lazy()

commit 3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167 upstream.

On x86-32 with PTI enabled, parts of the kernel page-tables are not shared
between processes. This can cause mappings in the vmalloc/ioremap area to
persist in some page-tables after the region is unmapped and released.

When the region is re-used the processes with the old mappings do not fault
in the new mappings but still access the old ones.

This causes undefined behavior, in reality often data corruption, kernel
oopses and panics and even spontaneous reboots.

Fix this problem by activly syncing unmaps in the vmalloc/ioremap area to
all page-tables in the system before the regions can be re-used.

References: https://bugzilla.suse.com/show_bug.cgi?id=1118689
Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lkml.kernel.org/r/20190719184652.11391-4-joro@8bytes.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/vmalloc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index a46ec261a44e8..d8e877365f9f5 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1751,6 +1751,12 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
 	if (!addr)
 		return NULL;
 
+	/*
+	 * First make sure the mappings are removed from all page-tables
+	 * before they are freed.
+	 */
+	vmalloc_sync_all();
+
 	/*
 	 * In this function, newly allocated vm_struct has VM_UNINITIALIZED
 	 * flag. It means that vm_struct is not fully initialized.
@@ -2296,6 +2302,9 @@ EXPORT_SYMBOL(remap_vmalloc_range);
 /*
  * Implement a stub for vmalloc_sync_all() if the architecture chose not to
  * have one.
+ *
+ * The purpose of this function is to make sure the vmalloc area
+ * mappings are identical in all page-tables in the system.
  */
 void __weak vmalloc_sync_all(void)
 {
-- 
GitLab


From 532db2b9756a35672d2f8a582e4acf590d348b46 Mon Sep 17 00:00:00 2001
From: Thomas Richter <tmricht@linux.ibm.com>
Date: Wed, 24 Jul 2019 14:27:03 +0200
Subject: [PATCH 1447/1835] perf annotate: Fix s390 gap between kernel end and
 module start

commit b9c0a64901d5bdec6eafd38d1dc8fa0e2974fccb upstream.

During execution of command 'perf top' the error message:

   Not enough memory for annotating '__irf_end' symbol!)

is emitted from this call sequence:
  __cmd_top
    perf_top__mmap_read
      perf_top__mmap_read_idx
        perf_event__process_sample
          hist_entry_iter__add
            hist_iter__top_callback
              perf_top__record_precise_ip
                hist_entry__inc_addr_samples
                  symbol__inc_addr_samples
                    symbol__get_annotation
                      symbol__alloc_hist

In this function the size of symbol __irf_end is calculated. The size of
a symbol is the difference between its start and end address.

When the symbol was read the first time, its start and end was set to:

   symbol__new: __irf_end 0xe954d0-0xe954d0

which is correct and maps with /proc/kallsyms:

   root@s8360046:~/linux-4.15.0/tools/perf# fgrep _irf_end /proc/kallsyms
   0000000000e954d0 t __irf_end
   root@s8360046:~/linux-4.15.0/tools/perf#

In function symbol__alloc_hist() the end of symbol __irf_end is

  symbol__alloc_hist sym:__irf_end start:0xe954d0 end:0x3ff80045a8

which is identical with the first module entry in /proc/kallsyms

This results in a symbol size of __irf_req for histogram analyses of
70334140059072 bytes and a malloc() for this requested size fails.

The root cause of this is function
  __dso__load_kallsyms()
  +-> symbols__fixup_end()

Function symbols__fixup_end() enlarges the last symbol in the kallsyms
map:

   # fgrep __irf_end /proc/kallsyms
   0000000000e954d0 t __irf_end
   #

to the start address of the first module:
   # cat /proc/kallsyms | sort  | egrep ' [tT] '
   ....
   0000000000e952d0 T __security_initcall_end
   0000000000e954d0 T __initramfs_size
   0000000000e954d0 t __irf_end
   000003ff800045a8 T fc_get_event_number       [scsi_transport_fc]
   000003ff800045d0 t store_fc_vport_disable    [scsi_transport_fc]
   000003ff800046a8 T scsi_is_fc_rport  [scsi_transport_fc]
   000003ff800046d0 t fc_target_setup   [scsi_transport_fc]

On s390 the kernel is located around memory address 0x200, 0x10000 or
0x100000, depending on linux version. Modules however start some- where
around 0x3ff xxxx xxxx.

This is different than x86 and produces a large gap for which histogram
allocation fails.

Fix this by detecting the kernel's last symbol and do no adjustment for
it. Introduce a weak function and handle s390 specifics.

Reported-by: Klaus Theurich <klaus.theurich@de.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20190724122703.3996-2-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/arch/s390/util/machine.c | 17 +++++++++++++++++
 tools/perf/util/symbol.c            |  7 ++++++-
 tools/perf/util/symbol.h            |  1 +
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/tools/perf/arch/s390/util/machine.c b/tools/perf/arch/s390/util/machine.c
index a19690a17291e..00daff97b31fa 100644
--- a/tools/perf/arch/s390/util/machine.c
+++ b/tools/perf/arch/s390/util/machine.c
@@ -6,6 +6,7 @@
 #include "machine.h"
 #include "api/fs/fs.h"
 #include "debug.h"
+#include "symbol.h"
 
 int arch__fix_module_text_start(u64 *start, const char *name)
 {
@@ -21,3 +22,19 @@ int arch__fix_module_text_start(u64 *start, const char *name)
 
 	return 0;
 }
+
+/* On s390 kernel text segment start is located at very low memory addresses,
+ * for example 0x10000. Modules are located at very high memory addresses,
+ * for example 0x3ff xxxx xxxx. The gap between end of kernel text segment
+ * and beginning of first module's text segment is very big.
+ * Therefore do not fill this gap and do not assign it to the kernel dso map.
+ */
+void arch__symbols__fixup_end(struct symbol *p, struct symbol *c)
+{
+	if (strchr(p->name, '[') == NULL && strchr(c->name, '['))
+		/* Last kernel symbol mapped to end of page */
+		p->end = roundup(p->end, page_size);
+	else
+		p->end = c->start;
+	pr_debug4("%s sym:%s end:%#lx\n", __func__, p->name, p->end);
+}
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 0715f972a275c..91404bacc3df8 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -86,6 +86,11 @@ static int prefix_underscores_count(const char *str)
 	return tail - str;
 }
 
+void __weak arch__symbols__fixup_end(struct symbol *p, struct symbol *c)
+{
+	p->end = c->start;
+}
+
 const char * __weak arch__normalize_symbol_name(const char *name)
 {
 	return name;
@@ -212,7 +217,7 @@ void symbols__fixup_end(struct rb_root *symbols)
 		curr = rb_entry(nd, struct symbol, rb_node);
 
 		if (prev->end == prev->start && prev->end != curr->start)
-			prev->end = curr->start;
+			arch__symbols__fixup_end(prev, curr);
 	}
 
 	/* Last entry */
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index f25fae4b5743c..76ef2facd9345 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -349,6 +349,7 @@ const char *arch__normalize_symbol_name(const char *name);
 #define SYMBOL_A 0
 #define SYMBOL_B 1
 
+void arch__symbols__fixup_end(struct symbol *p, struct symbol *c);
 int arch__compare_symbol_names(const char *namea, const char *nameb);
 int arch__compare_symbol_names_n(const char *namea, const char *nameb,
 				 unsigned int n);
-- 
GitLab


From f1f662894361e84fa60b80e9768194280816461c Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Thu, 8 Aug 2019 09:48:23 +0300
Subject: [PATCH 1448/1835] perf db-export: Fix thread__exec_comm()

commit 3de7ae0b2a1d86dbb23d0cb135150534fdb2e836 upstream.

Threads synthesized from /proc have comms with a start time of zero, and
not marked as "exec". Currently, there can be 2 such comms. The first is
created by processing a synthesized fork event and is set to the
parent's comm string, and the second by processing a synthesized comm
event set to the thread's current comm string.

In the absence of an "exec" comm, thread__exec_comm() picks the last
(oldest) comm, which, in the case above, is the parent's comm string.
For a main thread, that is very probably wrong. Use the second-to-last
in that case.

This affects only db-export because it is the only user of
thread__exec_comm().

Example:

  $ sudo perf record -a -o pt-a-sleep-1 -e intel_pt//u -- sleep 1
  $ sudo chown ahunter pt-a-sleep-1

Before:

  $ perf script -i pt-a-sleep-1 --itrace=bep -s tools/perf/scripts/python/export-to-sqlite.py pt-a-sleep-1.db branches calls
  $ sqlite3 -header -column pt-a-sleep-1.db 'select * from comm_threads_view'
  comm_id     command     thread_id   pid         tid
  ----------  ----------  ----------  ----------  ----------
  1           swapper     1           0           0
  2           rcu_sched   2           10          10
  3           kthreadd    3           78          78
  5           sudo        4           15180       15180
  5           sudo        5           15180       15182
  7           kworker/4:  6           10335       10335
  8           kthreadd    7           55          55
  10          systemd     8           865         865
  10          systemd     9           865         875
  13          perf        10          15181       15181
  15          sleep       10          15181       15181
  16          kworker/3:  11          14179       14179
  17          kthreadd    12          29376       29376
  19          systemd     13          746         746
  21          systemd     14          401         401
  23          systemd     15          879         879
  23          systemd     16          879         945
  25          kthreadd    17          556         556
  27          kworker/u1  18          14136       14136
  28          kworker/u1  19          15021       15021
  29          kthreadd    20          509         509
  31          systemd     21          836         836
  31          systemd     22          836         967
  33          systemd     23          1148        1148
  33          systemd     24          1148        1163
  35          kworker/2:  25          17988       17988
  36          kworker/0:  26          13478       13478

After:

  $ perf script -i pt-a-sleep-1 --itrace=bep -s tools/perf/scripts/python/export-to-sqlite.py pt-a-sleep-1b.db branches calls
  $ sqlite3 -header -column pt-a-sleep-1b.db 'select * from comm_threads_view'
  comm_id     command     thread_id   pid         tid
  ----------  ----------  ----------  ----------  ----------
  1           swapper     1           0           0
  2           rcu_sched   2           10          10
  3           kswapd0     3           78          78
  4           perf        4           15180       15180
  4           perf        5           15180       15182
  6           kworker/4:  6           10335       10335
  7           kcompactd0  7           55          55
  8           accounts-d  8           865         865
  8           accounts-d  9           865         875
  10          perf        10          15181       15181
  12          sleep       10          15181       15181
  13          kworker/3:  11          14179       14179
  14          kworker/1:  12          29376       29376
  15          haveged     13          746         746
  16          systemd-jo  14          401         401
  17          NetworkMan  15          879         879
  17          NetworkMan  16          879         945
  19          irq/131-iw  17          556         556
  20          kworker/u1  18          14136       14136
  21          kworker/u1  19          15021       15021
  22          kworker/u1  20          509         509
  23          thermald    21          836         836
  23          thermald    22          836         967
  25          unity-sett  23          1148        1148
  25          unity-sett  24          1148        1163
  27          kworker/2:  25          17988       17988
  28          kworker/0:  26          13478       13478

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 65de51f93ebf ("perf tools: Identify which comms are from exec")
Link: http://lkml.kernel.org/r/20190808064823.14846-1-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/thread.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 56007a7e0b4d7..2c146d0c217be 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -192,14 +192,24 @@ struct comm *thread__comm(const struct thread *thread)
 
 struct comm *thread__exec_comm(const struct thread *thread)
 {
-	struct comm *comm, *last = NULL;
+	struct comm *comm, *last = NULL, *second_last = NULL;
 
 	list_for_each_entry(comm, &thread->comm_list, list) {
 		if (comm->exec)
 			return comm;
+		second_last = last;
 		last = comm;
 	}
 
+	/*
+	 * 'last' with no start time might be the parent's comm of a synthesized
+	 * thread (created by processing a synthesized fork event). For a main
+	 * thread, that is very probably wrong. Prefer a later comm to avoid
+	 * that case.
+	 */
+	if (second_last && !last->start && thread->pid_ == thread->tid)
+		return second_last;
+
 	return last;
 }
 
-- 
GitLab


From 0a9e41e27659430bf64828d7a7d8f57956bece08 Mon Sep 17 00:00:00 2001
From: Thomas Richter <tmricht@linux.ibm.com>
Date: Wed, 24 Jul 2019 14:27:02 +0200
Subject: [PATCH 1449/1835] perf record: Fix module size on s390

commit 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea upstream.

On s390 the modules loaded in memory have the text segment located after
the GOT and Relocation table. This can be seen with this output:

  [root@m35lp76 perf]# fgrep qeth /proc/modules
  qeth 151552 1 qeth_l2, Live 0x000003ff800b2000
  ...
  [root@m35lp76 perf]# cat /sys/module/qeth/sections/.text
  0x000003ff800b3990
  [root@m35lp76 perf]#

There is an offset of 0x1990 bytes. The size of the qeth module is
151552 bytes (0x25000 in hex).

The location of the GOT/relocation table at the beginning of a module is
unique to s390.

commit 203d8a4aa6ed ("perf s390: Fix 'start' address of module's map")
adjusts the start address of a module in the map structures, but does
not adjust the size of the modules. This leads to overlapping of module
maps as this example shows:

[root@m35lp76 perf] # ./perf report -D
     0 0 0xfb0 [0xa0]: PERF_RECORD_MMAP -1/0: [0x3ff800b3990(0x25000)
          @ 0]:  x /lib/modules/.../qeth.ko.xz
     0 0 0x1050 [0xb0]: PERF_RECORD_MMAP -1/0: [0x3ff800d85a0(0x8000)
          @ 0]:  x /lib/modules/.../ip6_tables.ko.xz

The module qeth.ko has an adjusted start address modified to b3990, but
its size is unchanged and the module ends at 0x3ff800d8990.  This end
address overlaps with the next modules start address of 0x3ff800d85a0.

When the size of the leading GOT/Relocation table stored in the
beginning of the text segment (0x1990 bytes) is subtracted from module
qeth end address, there are no overlaps anymore:

   0x3ff800d8990 - 0x1990 = 0x0x3ff800d7000

which is the same as

   0x3ff800b2000 + 0x25000 = 0x0x3ff800d7000.

To fix this issue, also adjust the modules size in function
arch__fix_module_text_start(). Add another function parameter named size
and reduce the size of the module when the text segment start address is
changed.

Output after:
     0 0 0xfb0 [0xa0]: PERF_RECORD_MMAP -1/0: [0x3ff800b3990(0x23670)
          @ 0]:  x /lib/modules/.../qeth.ko.xz
     0 0 0x1050 [0xb0]: PERF_RECORD_MMAP -1/0: [0x3ff800d85a0(0x7a60)
          @ 0]:  x /lib/modules/.../ip6_tables.ko.xz

Reported-by: Stefan Liebler <stli@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: stable@vger.kernel.org
Fixes: 203d8a4aa6ed ("perf s390: Fix 'start' address of module's map")
Link: http://lkml.kernel.org/r/20190724122703.3996-1-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/arch/s390/util/machine.c | 14 +++++++++++++-
 tools/perf/util/machine.c           |  3 ++-
 tools/perf/util/machine.h           |  2 +-
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/tools/perf/arch/s390/util/machine.c b/tools/perf/arch/s390/util/machine.c
index 00daff97b31fa..c8c86a0c9b793 100644
--- a/tools/perf/arch/s390/util/machine.c
+++ b/tools/perf/arch/s390/util/machine.c
@@ -8,7 +8,7 @@
 #include "debug.h"
 #include "symbol.h"
 
-int arch__fix_module_text_start(u64 *start, const char *name)
+int arch__fix_module_text_start(u64 *start, u64 *size, const char *name)
 {
 	u64 m_start = *start;
 	char path[PATH_MAX];
@@ -18,6 +18,18 @@ int arch__fix_module_text_start(u64 *start, const char *name)
 	if (sysfs__read_ull(path, (unsigned long long *)start) < 0) {
 		pr_debug2("Using module %s start:%#lx\n", path, m_start);
 		*start = m_start;
+	} else {
+		/* Successful read of the modules segment text start address.
+		 * Calculate difference between module start address
+		 * in memory and module text segment start address.
+		 * For example module load address is 0x3ff8011b000
+		 * (from /proc/modules) and module text segment start
+		 * address is 0x3ff8011b870 (from file above).
+		 *
+		 * Adjust the module size and subtract the GOT table
+		 * size located at the beginning of the module.
+		 */
+		*size -= (*start - m_start);
 	}
 
 	return 0;
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 076718a7b3eaa..003b70daf0bfc 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1295,6 +1295,7 @@ static int machine__set_modules_path(struct machine *machine)
 	return map_groups__set_modules_path_dir(&machine->kmaps, modules_path, 0);
 }
 int __weak arch__fix_module_text_start(u64 *start __maybe_unused,
+				u64 *size __maybe_unused,
 				const char *name __maybe_unused)
 {
 	return 0;
@@ -1306,7 +1307,7 @@ static int machine__create_module(void *arg, const char *name, u64 start,
 	struct machine *machine = arg;
 	struct map *map;
 
-	if (arch__fix_module_text_start(&start, name) < 0)
+	if (arch__fix_module_text_start(&start, &size, name) < 0)
 		return -1;
 
 	map = machine__findnew_module_map(machine, start, name);
diff --git a/tools/perf/util/machine.h b/tools/perf/util/machine.h
index ebde3ea70225b..6f3767808bd92 100644
--- a/tools/perf/util/machine.h
+++ b/tools/perf/util/machine.h
@@ -219,7 +219,7 @@ struct symbol *machine__find_kernel_symbol_by_name(struct machine *machine,
 
 struct map *machine__findnew_module_map(struct machine *machine, u64 start,
 					const char *filename);
-int arch__fix_module_text_start(u64 *start, const char *name);
+int arch__fix_module_text_start(u64 *start, u64 *size, const char *name);
 
 int machine__load_kallsyms(struct machine *machine, const char *filename);
 
-- 
GitLab


From b674f7914a64efe9709c912911c72a700683424e Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Wed, 7 Aug 2019 15:15:33 -0700
Subject: [PATCH 1450/1835] x86/purgatory: Use CFLAGS_REMOVE rather than reset
 KBUILD_CFLAGS

commit b059f801a937d164e03b33c1848bb3dca67c0b04 upstream.

KBUILD_CFLAGS is very carefully built up in the top level Makefile,
particularly when cross compiling or using different build tools.
Resetting KBUILD_CFLAGS via := assignment is an antipattern.

The comment above the reset mentions that -pg is problematic.  Other
Makefiles use `CFLAGS_REMOVE_file.o = $(CC_FLAGS_FTRACE)` when
CONFIG_FUNCTION_TRACER is set. Prefer that pattern to wiping out all of
the important KBUILD_CFLAGS then manually having to re-add them. Seems
also that __stack_chk_fail references are generated when using
CONFIG_STACKPROTECTOR or CONFIG_STACKPROTECTOR_STRONG.

Fixes: 8fc5b4d4121c ("purgatory: core purgatory functionality")
Reported-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190807221539.94583-2-ndesaulniers@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/purgatory/Makefile | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index 3cf302b263322..3d8144627b126 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -17,11 +17,34 @@ KCOV_INSTRUMENT := n
 
 # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
 # in turn leaves some undefined symbols like __fentry__ in purgatory and not
-# sure how to relocate those. Like kexec-tools, use custom flags.
-
-KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -Os -mcmodel=large
-KBUILD_CFLAGS += -m$(BITS)
-KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
+# sure how to relocate those.
+ifdef CONFIG_FUNCTION_TRACER
+CFLAGS_REMOVE_sha256.o		+= $(CC_FLAGS_FTRACE)
+CFLAGS_REMOVE_purgatory.o	+= $(CC_FLAGS_FTRACE)
+CFLAGS_REMOVE_string.o		+= $(CC_FLAGS_FTRACE)
+CFLAGS_REMOVE_kexec-purgatory.o	+= $(CC_FLAGS_FTRACE)
+endif
+
+ifdef CONFIG_STACKPROTECTOR
+CFLAGS_REMOVE_sha256.o		+= -fstack-protector
+CFLAGS_REMOVE_purgatory.o	+= -fstack-protector
+CFLAGS_REMOVE_string.o		+= -fstack-protector
+CFLAGS_REMOVE_kexec-purgatory.o	+= -fstack-protector
+endif
+
+ifdef CONFIG_STACKPROTECTOR_STRONG
+CFLAGS_REMOVE_sha256.o		+= -fstack-protector-strong
+CFLAGS_REMOVE_purgatory.o	+= -fstack-protector-strong
+CFLAGS_REMOVE_string.o		+= -fstack-protector-strong
+CFLAGS_REMOVE_kexec-purgatory.o	+= -fstack-protector-strong
+endif
+
+ifdef CONFIG_RETPOLINE
+CFLAGS_REMOVE_sha256.o		+= $(RETPOLINE_CFLAGS)
+CFLAGS_REMOVE_purgatory.o	+= $(RETPOLINE_CFLAGS)
+CFLAGS_REMOVE_string.o		+= $(RETPOLINE_CFLAGS)
+CFLAGS_REMOVE_kexec-purgatory.o	+= $(RETPOLINE_CFLAGS)
+endif
 
 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
 		$(call if_changed,ld)
-- 
GitLab


From 21344f0575f0ad63a7258c8addea9abbbc1a4dd6 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@redhat.com>
Date: Mon, 5 Aug 2019 12:22:03 +0100
Subject: [PATCH 1451/1835] gfs2: gfs2_walk_metadata fix

commit a27a0c9b6a208722016c8ec5ad31ec96082b91ec upstream.

It turns out that the current version of gfs2_metadata_walker suffers
from multiple problems that can cause gfs2_hole_size to report an
incorrect size.  This will confuse fiemap as well as lseek with the
SEEK_DATA flag.

Fix that by changing gfs2_hole_walker to compute the metapath to the
first data block after the hole (if any), and compute the hole size
based on that.

Fixes xfstest generic/490.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Bob Peterson <rpeterso@redhat.com>
Cc: stable@vger.kernel.org # v4.18+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/gfs2/bmap.c | 164 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 101 insertions(+), 63 deletions(-)

diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 7f8bb0868c0f8..d14d71d8d7eeb 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -392,6 +392,19 @@ static int fillup_metapath(struct gfs2_inode *ip, struct metapath *mp, int h)
 	return mp->mp_aheight - x - 1;
 }
 
+static sector_t metapath_to_block(struct gfs2_sbd *sdp, struct metapath *mp)
+{
+	sector_t factor = 1, block = 0;
+	int hgt;
+
+	for (hgt = mp->mp_fheight - 1; hgt >= 0; hgt--) {
+		if (hgt < mp->mp_aheight)
+			block += mp->mp_list[hgt] * factor;
+		factor *= sdp->sd_inptrs;
+	}
+	return block;
+}
+
 static void release_metapath(struct metapath *mp)
 {
 	int i;
@@ -432,60 +445,84 @@ static inline unsigned int gfs2_extent_length(struct buffer_head *bh, __be64 *pt
 	return ptr - first;
 }
 
-typedef const __be64 *(*gfs2_metadata_walker)(
-		struct metapath *mp,
-		const __be64 *start, const __be64 *end,
-		u64 factor, void *data);
+enum walker_status { WALK_STOP, WALK_FOLLOW, WALK_CONTINUE };
 
-#define WALK_STOP ((__be64 *)0)
-#define WALK_NEXT ((__be64 *)1)
+/*
+ * gfs2_metadata_walker - walk an indirect block
+ * @mp: Metapath to indirect block
+ * @ptrs: Number of pointers to look at
+ *
+ * When returning WALK_FOLLOW, the walker must update @mp to point at the right
+ * indirect block to follow.
+ */
+typedef enum walker_status (*gfs2_metadata_walker)(struct metapath *mp,
+						   unsigned int ptrs);
+
+/*
+ * gfs2_walk_metadata - walk a tree of indirect blocks
+ * @inode: The inode
+ * @mp: Starting point of walk
+ * @max_len: Maximum number of blocks to walk
+ * @walker: Called during the walk
+ *
+ * Returns 1 if the walk was stopped by @walker, 0 if we went past @max_len or
+ * past the end of metadata, and a negative error code otherwise.
+ */
 
-static int gfs2_walk_metadata(struct inode *inode, sector_t lblock,
-		u64 len, struct metapath *mp, gfs2_metadata_walker walker,
-		void *data)
+static int gfs2_walk_metadata(struct inode *inode, struct metapath *mp,
+		u64 max_len, gfs2_metadata_walker walker)
 {
-	struct metapath clone;
 	struct gfs2_inode *ip = GFS2_I(inode);
 	struct gfs2_sbd *sdp = GFS2_SB(inode);
-	const __be64 *start, *end, *ptr;
 	u64 factor = 1;
 	unsigned int hgt;
-	int ret = 0;
+	int ret;
 
-	for (hgt = ip->i_height - 1; hgt >= mp->mp_aheight; hgt--)
+	/*
+	 * The walk starts in the lowest allocated indirect block, which may be
+	 * before the position indicated by @mp.  Adjust @max_len accordingly
+	 * to avoid a short walk.
+	 */
+	for (hgt = mp->mp_fheight - 1; hgt >= mp->mp_aheight; hgt--) {
+		max_len += mp->mp_list[hgt] * factor;
+		mp->mp_list[hgt] = 0;
 		factor *= sdp->sd_inptrs;
+	}
 
 	for (;;) {
-		u64 step;
+		u16 start = mp->mp_list[hgt];
+		enum walker_status status;
+		unsigned int ptrs;
+		u64 len;
 
 		/* Walk indirect block. */
-		start = metapointer(hgt, mp);
-		end = metaend(hgt, mp);
-
-		step = (end - start) * factor;
-		if (step > len)
-			end = start + DIV_ROUND_UP_ULL(len, factor);
-
-		ptr = walker(mp, start, end, factor, data);
-		if (ptr == WALK_STOP)
+		ptrs = (hgt >= 1 ? sdp->sd_inptrs : sdp->sd_diptrs) - start;
+		len = ptrs * factor;
+		if (len > max_len)
+			ptrs = DIV_ROUND_UP_ULL(max_len, factor);
+		status = walker(mp, ptrs);
+		switch (status) {
+		case WALK_STOP:
+			return 1;
+		case WALK_FOLLOW:
+			BUG_ON(mp->mp_aheight == mp->mp_fheight);
+			ptrs = mp->mp_list[hgt] - start;
+			len = ptrs * factor;
 			break;
-		if (step >= len)
+		case WALK_CONTINUE:
 			break;
-		len -= step;
-		if (ptr != WALK_NEXT) {
-			BUG_ON(!*ptr);
-			mp->mp_list[hgt] += ptr - start;
-			goto fill_up_metapath;
 		}
+		if (len >= max_len)
+			break;
+		max_len -= len;
+		if (status == WALK_FOLLOW)
+			goto fill_up_metapath;
 
 lower_metapath:
 		/* Decrease height of metapath. */
-		if (mp != &clone) {
-			clone_metapath(&clone, mp);
-			mp = &clone;
-		}
 		brelse(mp->mp_bh[hgt]);
 		mp->mp_bh[hgt] = NULL;
+		mp->mp_list[hgt] = 0;
 		if (!hgt)
 			break;
 		hgt--;
@@ -493,10 +530,7 @@ lower_metapath:
 
 		/* Advance in metadata tree. */
 		(mp->mp_list[hgt])++;
-		start = metapointer(hgt, mp);
-		end = metaend(hgt, mp);
-		if (start >= end) {
-			mp->mp_list[hgt] = 0;
+		if (mp->mp_list[hgt] >= sdp->sd_inptrs) {
 			if (!hgt)
 				break;
 			goto lower_metapath;
@@ -504,44 +538,36 @@ lower_metapath:
 
 fill_up_metapath:
 		/* Increase height of metapath. */
-		if (mp != &clone) {
-			clone_metapath(&clone, mp);
-			mp = &clone;
-		}
 		ret = fillup_metapath(ip, mp, ip->i_height - 1);
 		if (ret < 0)
-			break;
+			return ret;
 		hgt += ret;
 		for (; ret; ret--)
 			do_div(factor, sdp->sd_inptrs);
 		mp->mp_aheight = hgt + 1;
 	}
-	if (mp == &clone)
-		release_metapath(mp);
-	return ret;
+	return 0;
 }
 
-struct gfs2_hole_walker_args {
-	u64 blocks;
-};
-
-static const __be64 *gfs2_hole_walker(struct metapath *mp,
-		const __be64 *start, const __be64 *end,
-		u64 factor, void *data)
+static enum walker_status gfs2_hole_walker(struct metapath *mp,
+					   unsigned int ptrs)
 {
-	struct gfs2_hole_walker_args *args = data;
-	const __be64 *ptr;
+	const __be64 *start, *ptr, *end;
+	unsigned int hgt;
+
+	hgt = mp->mp_aheight - 1;
+	start = metapointer(hgt, mp);
+	end = start + ptrs;
 
 	for (ptr = start; ptr < end; ptr++) {
 		if (*ptr) {
-			args->blocks += (ptr - start) * factor;
+			mp->mp_list[hgt] += ptr - start;
 			if (mp->mp_aheight == mp->mp_fheight)
 				return WALK_STOP;
-			return ptr;  /* increase height */
+			return WALK_FOLLOW;
 		}
 	}
-	args->blocks += (end - start) * factor;
-	return WALK_NEXT;
+	return WALK_CONTINUE;
 }
 
 /**
@@ -559,12 +585,24 @@ static const __be64 *gfs2_hole_walker(struct metapath *mp,
 static int gfs2_hole_size(struct inode *inode, sector_t lblock, u64 len,
 			  struct metapath *mp, struct iomap *iomap)
 {
-	struct gfs2_hole_walker_args args = { };
-	int ret = 0;
+	struct metapath clone;
+	u64 hole_size;
+	int ret;
 
-	ret = gfs2_walk_metadata(inode, lblock, len, mp, gfs2_hole_walker, &args);
-	if (!ret)
-		iomap->length = args.blocks << inode->i_blkbits;
+	clone_metapath(&clone, mp);
+	ret = gfs2_walk_metadata(inode, &clone, len, gfs2_hole_walker);
+	if (ret < 0)
+		goto out;
+
+	if (ret == 1)
+		hole_size = metapath_to_block(GFS2_SB(inode), &clone) - lblock;
+	else
+		hole_size = len;
+	iomap->length = hole_size << inode->i_blkbits;
+	ret = 0;
+
+out:
+	release_metapath(&clone);
 	return ret;
 }
 
-- 
GitLab


From 49888a4f0ebcc8de9023fd409f314f7ba7dfeb29 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Fri, 2 Aug 2019 17:33:35 +0900
Subject: [PATCH 1452/1835] usb: host: xhci-rcar: Fix timeout in xhci_suspend()

commit 783bda5e41acc71f98336e1a402c180f9748e5dc upstream.

When a USB device is connected to the host controller and
the system enters suspend, the following error happens
in xhci_suspend():

	xhci-hcd ee000000.usb: WARN: xHC CMD_RUN timeout

Since the firmware/internal CPU control the USBSTS.STS_HALT
and the process speed is down when the roothub port enters U3,
long delay for the handshake of STS_HALT is neeed in xhci_suspend().
So, this patch adds to set the XHCI_SLOW_SUSPEND.

Fixes: 435cc1138ec9 ("usb: host: xhci-plat: set resume_quirk() for R-Car controllers")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1564734815-17964-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-rcar.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index 671bce18782c5..8616c52849c6d 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -238,10 +238,15 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd)
 	 * pointers. So, this driver clears the AC64 bit of xhci->hcc_params
 	 * to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in
 	 * xhci_gen_setup().
+	 *
+	 * And, since the firmware/internal CPU control the USBSTS.STS_HALT
+	 * and the process speed is down when the roothub port enters U3,
+	 * long delay for the handshake of STS_HALT is neeed in xhci_suspend().
 	 */
 	if (xhci_rcar_is_gen2(hcd->self.controller) ||
-			xhci_rcar_is_gen3(hcd->self.controller))
-		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+			xhci_rcar_is_gen3(hcd->self.controller)) {
+		xhci->quirks |= XHCI_NO_64BIT_SUPPORT | XHCI_SLOW_SUSPEND;
+	}
 
 	if (!xhci_rcar_wait_for_pll_active(hcd))
 		return -ETIMEDOUT;
-- 
GitLab


From 33f2240acfa8b4017ee5dd64601c8a5ec7f53b4e Mon Sep 17 00:00:00 2001
From: Suzuki K Poulose <suzuki.poulose@arm.com>
Date: Mon, 5 Aug 2019 12:15:28 +0100
Subject: [PATCH 1453/1835] usb: yurex: Fix use-after-free in yurex_delete

commit fc05481b2fcabaaeccf63e32ac1baab54e5b6963 upstream.

syzbot reported the following crash [0]:

BUG: KASAN: use-after-free in usb_free_coherent+0x79/0x80
drivers/usb/core/usb.c:928
Read of size 8 at addr ffff8881b18599c8 by task syz-executor.4/16007

CPU: 0 PID: 16007 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  usb_free_coherent+0x79/0x80 drivers/usb/core/usb.c:928
  yurex_delete+0x138/0x330 drivers/usb/misc/yurex.c:100
  kref_put include/linux/kref.h:65 [inline]
  yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x413511
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffc424ea2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000413511
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 0000000000000001 R08: 0000000029a2fc22 R09: 0000000029a2fc26
R10: 00007ffc424ea3c0 R11: 0000000000000293 R12: 000000000075c9a0
R13: 000000000075c9a0 R14: 0000000000761938 R15: ffffffffffffffff

Allocated by task 2776:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  usb_alloc_dev+0x51/0xf95 drivers/usb/core/usb.c:583
  hub_port_connect drivers/usb/core/hub.c:5004 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x15c0/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 16007:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  device_release+0x71/0x200 drivers/base/core.c:1064
  kobject_cleanup lib/kobject.c:693 [inline]
  kobject_release lib/kobject.c:722 [inline]
  kref_put include/linux/kref.h:65 [inline]
  kobject_put+0x171/0x280 lib/kobject.c:739
  put_device+0x1b/0x30 drivers/base/core.c:2213
  usb_put_dev+0x1f/0x30 drivers/usb/core/usb.c:725
  yurex_delete+0x40/0x330 drivers/usb/misc/yurex.c:95
  kref_put include/linux/kref.h:65 [inline]
  yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:188 [inline]
  exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881b1859980
  which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 72 bytes inside of
  2048-byte region [ffff8881b1859980, ffff8881b185a180)
The buggy address belongs to the page:
page:ffffea0006c61600 refcount:1 mapcount:0 mapping:ffff8881da00c000
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da00c000
raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881b1859880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff8881b1859900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8881b1859980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                               ^
  ffff8881b1859a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881b1859a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

A quick look at the yurex_delete() shows that we drop the reference
to the usb_device before releasing any buffers associated with the
device. Delay the reference drop until we have finished the cleanup.

[0] https://lore.kernel.org/lkml/0000000000003f86d8058f0bd671@google.com/

Fixes: 6bc235a2e24a5e ("USB: add driver for Meywa-Denki & Kayac YUREX")
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Cc: Oliver Neukum <oneukum@suse.com>
Cc: andreyknvl@google.com
Cc: gregkh@linuxfoundation.org
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: syzkaller-bugs@googlegroups.com
Cc: dtor@chromium.org
Reported-by: syzbot+d1fedb1c1fdb07fca507@syzkaller.appspotmail.com
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190805111528.6758-1-suzuki.poulose@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/yurex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 7b306aa22d258..6715a128e6c8b 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -92,7 +92,6 @@ static void yurex_delete(struct kref *kref)
 
 	dev_dbg(&dev->interface->dev, "%s\n", __func__);
 
-	usb_put_dev(dev->udev);
 	if (dev->cntl_urb) {
 		usb_kill_urb(dev->cntl_urb);
 		kfree(dev->cntl_req);
@@ -108,6 +107,7 @@ static void yurex_delete(struct kref *kref)
 				dev->int_buffer, dev->urb->transfer_dma);
 		usb_free_urb(dev->urb);
 	}
+	usb_put_dev(dev->udev);
 	kfree(dev);
 }
 
-- 
GitLab


From 2ec5c9b785f4868cc94d30a28d55150f4c3bd39b Mon Sep 17 00:00:00 2001
From: Li Jun <jun.li@nxp.com>
Date: Wed, 17 Jul 2019 16:06:45 +0800
Subject: [PATCH 1454/1835] usb: typec: tcpm: free log buf memory when remove
 debug file

commit fd5da3e2cc61b4a7c877172fdc9348c82cf6ccfc upstream.

The logbuffer memory should be freed when remove debug file.

Cc: stable@vger.kernel.org # v4.15+
Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging")
Signed-off-by: Li Jun <jun.li@nxp.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20190717080646.30421-1-jun.li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 3457c1fdebd1b..d3f48374ad358 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -585,6 +585,15 @@ static void tcpm_debugfs_init(struct tcpm_port *port)
 
 static void tcpm_debugfs_exit(struct tcpm_port *port)
 {
+	int i;
+
+	mutex_lock(&port->logbuffer_lock);
+	for (i = 0; i < LOG_BUFFER_ENTRIES; i++) {
+		kfree(port->logbuffer[i]);
+		port->logbuffer[i] = NULL;
+	}
+	mutex_unlock(&port->logbuffer_lock);
+
 	debugfs_remove(port->dentry);
 }
 
-- 
GitLab


From bbc2e8206012504c9ba14fc9fd108a43a0d5201f Mon Sep 17 00:00:00 2001
From: Li Jun <jun.li@nxp.com>
Date: Wed, 17 Jul 2019 16:06:46 +0800
Subject: [PATCH 1455/1835] usb: typec: tcpm: remove tcpm dir if no children

commit 12ca7297b8855c0af1848503d37196159b24e6b9 upstream.

If config tcpm as module, module unload will not remove tcpm dir,
then the next module load will have problem: the rootdir is NULL
but tcpm dir is still there, so tcpm_debugfs_init() will create
tcpm dir again with failure, fix it by remove the tcpm dir if no
children.

Cc: stable@vger.kernel.org # v4.15+
Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging")
Signed-off-by: Li Jun <jun.li@nxp.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20190717080646.30421-2-jun.li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index d3f48374ad358..519b0f38dc6c5 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -595,6 +595,10 @@ static void tcpm_debugfs_exit(struct tcpm_port *port)
 	mutex_unlock(&port->logbuffer_lock);
 
 	debugfs_remove(port->dentry);
+	if (list_empty(&rootdir->d_subdirs)) {
+		debugfs_remove(rootdir);
+		rootdir = NULL;
+	}
 }
 
 #else
-- 
GitLab


From 3f524b631db72b78db88e19a8548c798ead3139e Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 24 Jul 2019 07:38:32 -0700
Subject: [PATCH 1456/1835] usb: typec: tcpm: Add NULL check before
 dereferencing config

commit 1957de95d425d1c06560069dc7277a73a8b28683 upstream.

When instantiating tcpm on an NXP OM 13588 board with NXP PTN5110,
the following crash is seen when writing into the 'preferred_role'
sysfs attribute.

Unable to handle kernel NULL pointer dereference at virtual address 00000028
pgd = f69149ad
[00000028] *pgd=00000000
Internal error: Oops: 5 [#1] THUMB2
Modules linked in: tcpci tcpm
CPU: 0 PID: 1882 Comm: bash Not tainted 5.1.18-sama5-armv7-r2 #4
Hardware name: Atmel SAMA5
PC is at tcpm_try_role+0x3a/0x4c [tcpm]
LR is at tcpm_try_role+0x15/0x4c [tcpm]
pc : [<bf8000e2>]    lr : [<bf8000bd>]    psr: 60030033
sp : dc1a1e88  ip : c03fb47d  fp : 00000000
r10: dc216190  r9 : dc1a1f78  r8 : 00000001
r7 : df4ae044  r6 : dd032e90  r5 : dd1ce340  r4 : df4ae054
r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : df4ae044
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA Thumb  Segment none
Control: 50c53c7d  Table: 3efec059  DAC: 00000051
Process bash (pid: 1882, stack limit = 0x6a6d4aa5)
Stack: (0xdc1a1e88 to 0xdc1a2000)
1e80:                   dd05d808 dd1ce340 00000001 00000007 dd1ce340 c03fb4a7
1ea0: 00000007 00000007 dc216180 00000000 00000000 c01e1e03 00000000 00000000
1ec0: c0907008 dee98b40 c01e1d5d c06106c4 00000000 00000000 00000007 c0194e8b
1ee0: 0000000a 00000400 00000000 c01a97db dc22bf00 ffffe000 df4b6a00 df745900
1f00: 00000001 00000001 000000dd c01a9c2f 7aeab3be c0907008 00000000 dc22bf00
1f20: c0907008 00000000 00000000 00000000 00000000 7aeab3be 00000007 dee98b40
1f40: 005dc318 dc1a1f78 00000000 00000000 00000007 c01969f7 0000000a c01a20cb
1f60: dee98b40 c0907008 dee98b40 005dc318 00000000 c0196b9b 00000000 00000000
1f80: dee98b40 7aeab3be 00000074 005dc318 b6f3bdb0 00000004 c0101224 dc1a0000
1fa0: 00000004 c0101001 00000074 005dc318 00000001 005dc318 00000007 00000000
1fc0: 00000074 005dc318 b6f3bdb0 00000004 00000007 00000007 00000000 00000000
1fe0: 00000004 be800880 b6ed35b3 b6e5c746 60030030 00000001 00000000 00000000
[<bf8000e2>] (tcpm_try_role [tcpm]) from [<c03fb4a7>] (preferred_role_store+0x2b/0x5c)
[<c03fb4a7>] (preferred_role_store) from [<c01e1e03>] (kernfs_fop_write+0xa7/0x150)
[<c01e1e03>] (kernfs_fop_write) from [<c0194e8b>] (__vfs_write+0x1f/0x104)
[<c0194e8b>] (__vfs_write) from [<c01969f7>] (vfs_write+0x6b/0x104)
[<c01969f7>] (vfs_write) from [<c0196b9b>] (ksys_write+0x43/0x94)
[<c0196b9b>] (ksys_write) from [<c0101001>] (ret_fast_syscall+0x1/0x62)

Since commit 96232cbc6c994 ("usb: typec: tcpm: support get typec and pd
config from device properties"), the 'config' pointer in struct tcpc_dev
is optional when registering a Type-C port. Since it is optional, we have
to check if it is NULL before dereferencing it.

Reported-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Fixes: 96232cbc6c994 ("usb: typec: tcpm: support get typec and pd config from device properties")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Jun Li <jun.li@nxp.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/1563979112-22483-1-git-send-email-linux@roeck-us.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 519b0f38dc6c5..eb8579226289a 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -378,7 +378,8 @@ static enum tcpm_state tcpm_default_state(struct tcpm_port *port)
 			return SNK_UNATTACHED;
 		else if (port->try_role == TYPEC_SOURCE)
 			return SRC_UNATTACHED;
-		else if (port->tcpc->config->default_role == TYPEC_SINK)
+		else if (port->tcpc->config &&
+			 port->tcpc->config->default_role == TYPEC_SINK)
 			return SNK_UNATTACHED;
 		/* Fall through to return SRC_UNATTACHED */
 	} else if (port->port_type == TYPEC_PORT_SNK) {
@@ -4096,7 +4097,7 @@ static int tcpm_try_role(const struct typec_capability *cap, int role)
 	mutex_lock(&port->lock);
 	if (tcpc->try_role)
 		ret = tcpc->try_role(tcpc, role);
-	if (!ret && !tcpc->config->try_role_hw)
+	if (!ret && (!tcpc->config || !tcpc->config->try_role_hw))
 		port->try_role = role;
 	port->try_src_count = 0;
 	port->try_snk_count = 0;
@@ -4743,7 +4744,7 @@ static int tcpm_copy_caps(struct tcpm_port *port,
 	port->typec_caps.prefer_role = tcfg->default_role;
 	port->typec_caps.type = tcfg->type;
 	port->typec_caps.data = tcfg->data;
-	port->self_powered = port->tcpc->config->self_powered;
+	port->self_powered = tcfg->self_powered;
 
 	return 0;
 }
-- 
GitLab


From 9479a058992355ad16551bb9e3ed1e90aa2b81ab Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Fri, 2 Aug 2019 09:03:42 -0700
Subject: [PATCH 1457/1835] usb: typec: tcpm: Ignore unsupported/unknown
 alternate mode requests

commit 88d02c9ba2e83fc22d37ccb1f11c62ea6fc9ae50 upstream.

TCPM may receive PD messages associated with unknown or unsupported
alternate modes. If that happens, calls to typec_match_altmode()
will return NULL. The tcpm code does not currently take this into
account. This results in crashes.

Unable to handle kernel NULL pointer dereference at virtual address 000001f0
pgd = 41dad9a1
[000001f0] *pgd=00000000
Internal error: Oops: 5 [#1] THUMB2
Modules linked in: tcpci tcpm
CPU: 0 PID: 2338 Comm: kworker/u2:0 Not tainted 5.1.18-sama5-armv7-r2 #6
Hardware name: Atmel SAMA5
Workqueue: 2-0050 tcpm_pd_rx_handler [tcpm]
PC is at typec_altmode_attention+0x0/0x14
LR is at tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm]
...
[<c03fbee8>] (typec_altmode_attention) from [<bf8030fb>]
				(tcpm_pd_rx_handler+0xa3b/0xda0 [tcpm])
[<bf8030fb>] (tcpm_pd_rx_handler [tcpm]) from [<c012082b>]
				(process_one_work+0x123/0x2a8)
[<c012082b>] (process_one_work) from [<c0120a6d>]
				(worker_thread+0xbd/0x3b0)
[<c0120a6d>] (worker_thread) from [<c012431f>] (kthread+0xcf/0xf4)
[<c012431f>] (kthread) from [<c01010f9>] (ret_from_fork+0x11/0x38)

Ignore PD messages if the associated alternate mode is not supported.

Fixes: e9576fe8e605c ("usb: typec: tcpm: Support for Alternate Modes")
Cc: stable <stable@vger.kernel.org>
Reported-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/1564761822-13984-1-git-send-email-linux@roeck-us.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm.c | 38 ++++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index eb8579226289a..5f29ce8d6c3f9 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -1108,7 +1108,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
 			break;
 		case CMD_ATTENTION:
 			/* Attention command does not have response */
-			typec_altmode_attention(adev, p[1]);
+			if (adev)
+				typec_altmode_attention(adev, p[1]);
 			return 0;
 		default:
 			break;
@@ -1160,20 +1161,26 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
 			}
 			break;
 		case CMD_ENTER_MODE:
-			typec_altmode_update_active(pdev, true);
-
-			if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
-				response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE);
-				response[0] |= VDO_OPOS(adev->mode);
-				return 1;
+			if (adev && pdev) {
+				typec_altmode_update_active(pdev, true);
+
+				if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
+					response[0] = VDO(adev->svid, 1,
+							  CMD_EXIT_MODE);
+					response[0] |= VDO_OPOS(adev->mode);
+					return 1;
+				}
 			}
 			return 0;
 		case CMD_EXIT_MODE:
-			typec_altmode_update_active(pdev, false);
+			if (adev && pdev) {
+				typec_altmode_update_active(pdev, false);
 
-			/* Back to USB Operation */
-			WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
-						     NULL));
+				/* Back to USB Operation */
+				WARN_ON(typec_altmode_notify(adev,
+							     TYPEC_STATE_USB,
+							     NULL));
+			}
 			break;
 		default:
 			break;
@@ -1183,8 +1190,10 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
 		switch (cmd) {
 		case CMD_ENTER_MODE:
 			/* Back to USB Operation */
-			WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
-						     NULL));
+			if (adev)
+				WARN_ON(typec_altmode_notify(adev,
+							     TYPEC_STATE_USB,
+							     NULL));
 			break;
 		default:
 			break;
@@ -1195,7 +1204,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
 	}
 
 	/* Informing the alternate mode drivers about everything */
-	typec_altmode_vdm(adev, p[0], &p[1], cnt);
+	if (adev)
+		typec_altmode_vdm(adev, p[0], &p[1], cnt);
 
 	return rlen;
 }
-- 
GitLab


From 0e9038a26c9b78da7fe6bb694c0104446581c05c Mon Sep 17 00:00:00 2001
From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Date: Wed, 26 Jun 2019 16:08:48 +0300
Subject: [PATCH 1458/1835] can: rcar_canfd: fix possible IRQ storm on high
 load

commit d4b890aec4bea7334ca2ca56fd3b12fb48a00cd1 upstream.

We have observed rcar_canfd driver entering IRQ storm under high load,
with following scenario:
- rcar_canfd_global_interrupt() in entered due to Rx available,
- napi_schedule_prep() is called, and sets NAPIF_STATE_SCHED in state
- Rx fifo interrupts are masked,
- rcar_canfd_global_interrupt() is entered again, this time due to
  error interrupt (e.g. due to overflow),
- since scheduled napi poller has not yet executed, condition for calling
  napi_schedule_prep() from rcar_canfd_global_interrupt() remains true,
  thus napi_schedule_prep() gets called and sets NAPIF_STATE_MISSED flag
  in state,
- later, napi poller function rcar_canfd_rx_poll() gets executed, and
  calls napi_complete_done(),
- due to NAPIF_STATE_MISSED flag in state, this call does not clear
  NAPIF_STATE_SCHED flag from state,
- on return from napi_complete_done(), rcar_canfd_rx_poll() unmasks Rx
  interrutps,
- Rx interrupt happens, rcar_canfd_global_interrupt() gets called
  and calls napi_schedule_prep(),
- since NAPIF_STATE_SCHED is set in state at this time, this call
  returns false,
- due to that false return, rcar_canfd_global_interrupt() returns
  without masking Rx interrupt
- and this results into IRQ storm: unmasked Rx interrupt happens again
  and again is misprocessed in the same way.

This patch fixes that scenario by unmasking Rx interrupts only when
napi_complete_done() returns true, which means it has cleared
NAPIF_STATE_SCHED in state.

Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver")
Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/rcar/rcar_canfd.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
index 602c19e23f052..786d852a70d58 100644
--- a/drivers/net/can/rcar/rcar_canfd.c
+++ b/drivers/net/can/rcar/rcar_canfd.c
@@ -1512,10 +1512,11 @@ static int rcar_canfd_rx_poll(struct napi_struct *napi, int quota)
 
 	/* All packets processed */
 	if (num_pkts < quota) {
-		napi_complete_done(napi, num_pkts);
-		/* Enable Rx FIFO interrupts */
-		rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
-				   RCANFD_RFCC_RFIE);
+		if (napi_complete_done(napi, num_pkts)) {
+			/* Enable Rx FIFO interrupts */
+			rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
+					   RCANFD_RFCC_RFIE);
+		}
 	}
 	return num_pkts;
 }
-- 
GitLab


From f61c4d3a1f18caeda6997109175b628be793cca3 Mon Sep 17 00:00:00 2001
From: Stephane Grosjean <s.grosjean@peak-system.com>
Date: Fri, 5 Jul 2019 15:32:16 +0200
Subject: [PATCH 1459/1835] can: peak_usb: fix potential double kfree_skb()

commit fee6a8923ae0d318a7f7950c6c6c28a96cea099b upstream.

When closing the CAN device while tx skbs are inflight, echo skb could
be released twice. By calling close_candev() before unlinking all
pending tx urbs, then the internal echo_skb[] array is fully and
correctly cleared before the USB write callback and, therefore,
can_get_echo_skb() are called, for each aborted URB.

Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 611f9d31be5d0..740ef47eab017 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -576,16 +576,16 @@ static int peak_usb_ndo_stop(struct net_device *netdev)
 	dev->state &= ~PCAN_USB_STATE_STARTED;
 	netif_stop_queue(netdev);
 
+	close_candev(netdev);
+
+	dev->can.state = CAN_STATE_STOPPED;
+
 	/* unlink all pending urbs and free used memory */
 	peak_usb_unlink_all_urbs(dev);
 
 	if (dev->adapter->dev_stop)
 		dev->adapter->dev_stop(dev);
 
-	close_candev(netdev);
-
-	dev->can.state = CAN_STATE_STOPPED;
-
 	/* can set bus off now */
 	if (dev->adapter->dev_set_bus) {
 		int err = dev->adapter->dev_set_bus(dev, 0);
-- 
GitLab


From bb312b4aa8b080b24a6ae190170d23304f6d0f56 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 2 Jul 2019 21:41:40 +0200
Subject: [PATCH 1460/1835] netfilter: nfnetlink: avoid deadlock due to
 synchronous request_module

[ Upstream commit 1b0890cd60829bd51455dc5ad689ed58c4408227 ]

Thomas and Juliana report a deadlock when running:

(rmmod nf_conntrack_netlink/xfrm_user)

  conntrack -e NEW -E &
  modprobe -v xfrm_user

They provided following analysis:

conntrack -e NEW -E
    netlink_bind()
        netlink_lock_table() -> increases "nl_table_users"
            nfnetlink_bind()
            # does not unlock the table as it's locked by netlink_bind()
                __request_module()
                    call_usermodehelper_exec()

This triggers "modprobe nf_conntrack_netlink" from kernel, netlink_bind()
won't return until modprobe process is done.

"modprobe xfrm_user":
    xfrm_user_init()
        register_pernet_subsys()
            -> grab pernet_ops_rwsem
                ..
                netlink_table_grab()
                    calls schedule() as "nl_table_users" is non-zero

so modprobe is blocked because netlink_bind() increased
nl_table_users while also holding pernet_ops_rwsem.

"modprobe nf_conntrack_netlink" runs and inits nf_conntrack_netlink:
    ctnetlink_init()
        register_pernet_subsys()
            -> blocks on "pernet_ops_rwsem" thanks to xfrm_user module

both modprobe processes wait on one another -- neither can make
progress.

Switch netlink_bind() to "nowait" modprobe -- this releases the netlink
table lock, which then allows both modprobe instances to complete.

Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Reported-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 916913454624f..7f2c1915763f8 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -575,7 +575,7 @@ static int nfnetlink_bind(struct net *net, int group)
 	ss = nfnetlink_get_subsys(type << 8);
 	rcu_read_unlock();
 	if (!ss)
-		request_module("nfnetlink-subsys-%d", type);
+		request_module_nowait("nfnetlink-subsys-%d", type);
 	return 0;
 }
 #endif
-- 
GitLab


From 6f9dff8d1d581e776caeb4dae65453bda2eb9d92 Mon Sep 17 00:00:00 2001
From: Farhan Ali <alifm@linux.ibm.com>
Date: Thu, 11 Jul 2019 10:28:53 -0400
Subject: [PATCH 1461/1835] vfio-ccw: Set pa_nr to 0 if memory allocation fails
 for pa_iova_pfn

[ Upstream commit c1ab69268d124ebdbb3864580808188ccd3ea355 ]

So we don't call try to call vfio_unpin_pages() incorrectly.

Fixes: 0a19e61e6d4c ("vfio: ccw: introduce channel program interfaces")
Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <33a89467ad6369196ae6edf820cbcb1e2d8d050c.1562854091.git.alifm@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/vfio_ccw_cp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index 70a006ba4d050..4fe06ff7b2c8b 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -89,8 +89,10 @@ static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
 				  sizeof(*pa->pa_iova_pfn) +
 				  sizeof(*pa->pa_pfn),
 				  GFP_KERNEL);
-	if (unlikely(!pa->pa_iova_pfn))
+	if (unlikely(!pa->pa_iova_pfn)) {
+		pa->pa_nr = 0;
 		return -ENOMEM;
+	}
 	pa->pa_pfn = pa->pa_iova_pfn + pa->pa_nr;
 
 	pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT;
-- 
GitLab


From 307b6e5d90dc19cae65392ea8ad6152954e5e954 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Tue, 2 Jul 2019 03:59:36 +0000
Subject: [PATCH 1462/1835] netfilter: Fix rpfilter dropping vrf packets by
 mistake

[ Upstream commit b575b24b8eee37f10484e951b62ce2a31c579775 ]

When firewalld is enabled with ipv4/ipv6 rpfilter, vrf
ipv4/ipv6 packets will be dropped. Vrf device will pass
through netfilter hook twice. One with enslaved device
and another one with l3 master device. So in device may
dismatch witch out device because out device is always
enslaved device.So failed with the check of the rpfilter
and drop the packets by mistake.

Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/netfilter/ipt_rpfilter.c  | 1 +
 net/ipv6/netfilter/ip6t_rpfilter.c | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 12843c9ef1421..74b19a5c572e9 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -96,6 +96,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
 	flow.flowi4_tos = RT_TOS(iph->tos);
 	flow.flowi4_scope = RT_SCOPE_UNIVERSE;
+	flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));
 
 	return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert;
 }
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index c3c6b09acdc4f..0f3407f2851ed 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -58,7 +58,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
 	if (rpfilter_addr_linklocal(&iph->saddr)) {
 		lookup_flags |= RT6_LOOKUP_F_IFACE;
 		fl6.flowi6_oif = dev->ifindex;
-	} else if ((flags & XT_RPFILTER_LOOSE) == 0)
+	/* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */
+	} else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) ||
+		  (flags & XT_RPFILTER_LOOSE) == 0)
 		fl6.flowi6_oif = dev->ifindex;
 
 	rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
@@ -73,7 +75,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
 		goto out;
 	}
 
-	if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
+	if (rt->rt6i_idev->dev == dev ||
+	    l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex ||
+	    (flags & XT_RPFILTER_LOOSE))
 		ret = true;
  out:
 	ip6_rt_put(rt);
-- 
GitLab


From 6f1d7f0d66899646ac50e717ca4cffd9c6c794ba Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Fri, 12 Jul 2019 00:29:05 +0200
Subject: [PATCH 1463/1835] netfilter: conntrack: always store window size
 un-scaled

[ Upstream commit 959b69ef57db00cb33e9c4777400ae7183ebddd3 ]

Jakub Jankowski reported following oddity:

After 3 way handshake completes, timeout of new connection is set to
max_retrans (300s) instead of established (5 days).

shortened excerpt from pcap provided:
25.070622 IP (flags [DF], proto TCP (6), length 52)
10.8.5.4.1025 > 10.8.1.2.80: Flags [S], seq 11, win 64240, [wscale 8]
26.070462 IP (flags [DF], proto TCP (6), length 48)
10.8.1.2.80 > 10.8.5.4.1025: Flags [S.], seq 82, ack 12, win 65535, [wscale 3]
27.070449 IP (flags [DF], proto TCP (6), length 40)
10.8.5.4.1025 > 10.8.1.2.80: Flags [.], ack 83, win 512, length 0

Turns out the last_win is of u16 type, but we store the scaled value:
512 << 8 (== 0x20000) becomes 0 window.

The Fixes tag is not correct, as the bug has existed forever, but
without that change all that this causes might cause is to mistake a
window update (to-nonzero-from-zero) for a retransmit.

Fixes: fbcd253d2448b8 ("netfilter: conntrack: lower timeout to RETRANS seconds if window is 0")
Reported-by: Jakub Jankowski <shasta@toxcorp.com>
Tested-by: Jakub Jankowski <shasta@toxcorp.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_proto_tcp.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 842f3f86fb2e7..7011ab27c4371 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -480,6 +480,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
 	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 	__u32 seq, ack, sack, end, win, swin;
+	u16 win_raw;
 	s32 receiver_offset;
 	bool res, in_recv_win;
 
@@ -488,7 +489,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 	 */
 	seq = ntohl(tcph->seq);
 	ack = sack = ntohl(tcph->ack_seq);
-	win = ntohs(tcph->window);
+	win_raw = ntohs(tcph->window);
+	win = win_raw;
 	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
 
 	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
@@ -663,14 +665,14 @@ static bool tcp_in_window(const struct nf_conn *ct,
 			    && state->last_seq == seq
 			    && state->last_ack == ack
 			    && state->last_end == end
-			    && state->last_win == win)
+			    && state->last_win == win_raw)
 				state->retrans++;
 			else {
 				state->last_dir = dir;
 				state->last_seq = seq;
 				state->last_ack = ack;
 				state->last_end = end;
-				state->last_win = win;
+				state->last_win = win_raw;
 				state->retrans = 0;
 			}
 		}
-- 
GitLab


From 36b6458d8541d47a55b6aa20ac1792edf270410c Mon Sep 17 00:00:00 2001
From: Laura Garcia Liebana <nevola@gmail.com>
Date: Mon, 15 Jul 2019 13:23:37 +0200
Subject: [PATCH 1464/1835] netfilter: nft_hash: fix symhash with modulus one

[ Upstream commit 28b1d6ef53e3303b90ca8924bb78f31fa527cafb ]

The rule below doesn't work as the kernel raises -ERANGE.

nft add rule netdev nftlb lb01 ip daddr set \
	symhash mod 1 map { 0 : 192.168.0.10 } fwd to "eth0"

This patch allows to use the symhash modulus with one
element, in the same way that the other types of hashes and
algorithms that uses the modulus parameter.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c2d237144f747..b8f23f75aea6c 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -196,7 +196,7 @@ static int nft_symhash_init(const struct nft_ctx *ctx,
 	priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
 
 	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
-	if (priv->modulus <= 1)
+	if (priv->modulus < 1)
 		return -ERANGE;
 
 	if (priv->offset + priv->modulus - 1 < priv->offset)
-- 
GitLab


From 056af94d6e109852305043bca283c24b5d354153 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Date: Sat, 13 Jul 2019 08:50:24 -0300
Subject: [PATCH 1465/1835] scripts/sphinx-pre-install: fix script for
 RHEL/CentOS

[ Upstream commit b308467c916aa7acc5069802ab76a9f657434701 ]

There's a missing parenthesis at the script, with causes it to
fail to detect non-Fedora releases (e. g. RHEL/CentOS).

Tested with Centos 7.6.1810.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/sphinx-pre-install | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/sphinx-pre-install b/scripts/sphinx-pre-install
index 067459760a7b0..3524dbc313163 100755
--- a/scripts/sphinx-pre-install
+++ b/scripts/sphinx-pre-install
@@ -301,7 +301,7 @@ sub give_redhat_hints()
 	#
 	# Checks valid for RHEL/CentOS version 7.x.
 	#
-	if (! $system_release =~ /Fedora/) {
+	if (!($system_release =~ /Fedora/)) {
 		$map{"virtualenv"} = "python-virtualenv";
 	}
 
-- 
GitLab


From 2a5e21adc71b46beec9232cc6418676fd2255bc5 Mon Sep 17 00:00:00 2001
From: SivapiriyanKumarasamy <sivapiriyan.kumarasamy@amd.com>
Date: Fri, 14 Jun 2019 15:04:00 -0400
Subject: [PATCH 1466/1835] drm/amd/display: Wait for backlight programming
 completion in set backlight level

[ Upstream commit c7990daebe71d11a9e360b5c3b0ecd1846a3a4bb ]

[WHY]
Currently we don't wait for blacklight programming completion in DMCU
when setting backlight level. Some sequences such as PSR static screen
event trigger reprogramming requires it to be complete.

[How]
Add generic wait for dmcu command completion in set backlight level.

Signed-off-by: SivapiriyanKumarasamy <sivapiriyan.kumarasamy@amd.com>
Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dce/dce_abm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
index 070ab56a8aca7..da8b198538e5f 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
@@ -242,6 +242,10 @@ static void dmcu_set_backlight_level(
 	s2 |= (level << ATOM_S2_CURRENT_BL_LEVEL_SHIFT);
 
 	REG_WRITE(BIOS_SCRATCH_2, s2);
+
+	/* waitDMCUReadyForCmd */
+	REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT,
+			0, 1, 80000);
 }
 
 static void dce_abm_init(struct abm *abm)
-- 
GitLab


From e7a8a794109c07e0b8d7bd55fbfcb3082991626a Mon Sep 17 00:00:00 2001
From: Tai Man <taiman.wong@amd.com>
Date: Fri, 7 Jun 2019 17:32:27 -0400
Subject: [PATCH 1467/1835] drm/amd/display: use encoder's engine id to find
 matched free audio device

[ Upstream commit 74eda776d7a4e69ec7aa1ce30a87636f14220fbb ]

[Why]
On some platforms, the encoder id 3 is not populated. So the encoders
are not stored in right order as index (id: 0, 1, 2, 4, 5) at pool. This
would cause encoders id 4 & id 5 to fail when finding corresponding
audio device, defaulting to the first available audio device. As result,
we cannot stream audio into two DP ports with encoders id 4 & id 5.

[How]
It need to create enough audio device objects (0 - 5) to perform matching.
Then use encoder engine id to find matched audio device.

Signed-off-by: Tai Man <taiman.wong@amd.com>
Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index e0a96abb3c46c..06d5988dff723 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -222,7 +222,7 @@ bool resource_construct(
 		 * PORT_CONNECTIVITY == 1 (as instructed by HW team).
 		 */
 		update_num_audio(&straps, &num_audio, &pool->audio_support);
-		for (i = 0; i < pool->pipe_count && i < num_audio; i++) {
+		for (i = 0; i < caps->num_audio; i++) {
 			struct audio *aud = create_funcs->create_audio(ctx, i);
 
 			if (aud == NULL) {
@@ -1713,6 +1713,12 @@ static struct audio *find_first_free_audio(
 			return pool->audios[i];
 		}
 	}
+
+    /* use engine id to find free audio */
+	if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
+		return pool->audios[id];
+	}
+
 	/*not found the matching one, first come first serve*/
 	for (i = 0; i < pool->audio_count; i++) {
 		if (res_ctx->is_audio_acquired[i] == false) {
-- 
GitLab


From 3998e684463a7fa1721c171172ca085978d03a00 Mon Sep 17 00:00:00 2001
From: Julian Parkin <julian.parkin@amd.com>
Date: Tue, 25 Jun 2019 14:55:53 -0400
Subject: [PATCH 1468/1835] drm/amd/display: Fix dc_create failure handling and
 666 color depths

[ Upstream commit 0905f32977268149f06e3ce6ea4bd6d374dd891f ]

[Why]
It is possible (but very unlikely) that constructing dc fails
before current_state is created.

We support 666 color depth in some scenarios, but this
isn't handled in get_norm_pix_clk. It uses exactly the
same pixel clock as the 888 case.

[How]
Check for non null current_state before destructing.

Add case for 666 color depth to get_norm_pix_clk to
avoid assertion.

Signed-off-by: Julian Parkin <julian.parkin@amd.com>
Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc.c          | 6 ++++--
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index e3f5e5d6f0c18..f4b89d1ea6f6f 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -462,8 +462,10 @@ void dc_link_set_test_pattern(struct dc_link *link,
 
 static void destruct(struct dc *dc)
 {
-	dc_release_state(dc->current_state);
-	dc->current_state = NULL;
+	if (dc->current_state) {
+		dc_release_state(dc->current_state);
+		dc->current_state = NULL;
+	}
 
 	destroy_links(dc);
 
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 06d5988dff723..19a951e5818ac 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -1872,6 +1872,7 @@ static int get_norm_pix_clk(const struct dc_crtc_timing *timing)
 		pix_clk /= 2;
 	if (timing->pixel_encoding != PIXEL_ENCODING_YCBCR422) {
 		switch (timing->display_color_depth) {
+		case COLOR_DEPTH_666:
 		case COLOR_DEPTH_888:
 			normalized_pix_clk = pix_clk;
 			break;
-- 
GitLab


From f9420bfa29f9ece0b02a5435ae95f1a48bc97723 Mon Sep 17 00:00:00 2001
From: Alvin Lee <alvin.lee2@amd.com>
Date: Thu, 4 Jul 2019 15:17:42 -0400
Subject: [PATCH 1469/1835] drm/amd/display: Only enable audio if speaker
 allocation exists

[ Upstream commit 6ac25e6d5b2fbf251e9fa2f4131d42c815b43867 ]

[Why]

In dm_helpers_parse_edid_caps, there is a corner case where no speakers
can be allocated even though the audio mode count is greater than 0.
Enabling audio when no speaker allocations exists can cause issues in
the video stream.

[How]

Add a check to not enable audio unless one or more speaker allocations
exist (since doing this can cause issues in the video stream).

Signed-off-by: Alvin Lee <alvin.lee2@amd.com>
Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 19a951e5818ac..f0d68aa7c8fcc 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -1956,7 +1956,7 @@ enum dc_status resource_map_pool_resources(
 	/* TODO: Add check if ASIC support and EDID audio */
 	if (!stream->sink->converter_disable_audio &&
 	    dc_is_audio_capable_signal(pipe_ctx->stream->signal) &&
-	    stream->audio_info.mode_count) {
+	    stream->audio_info.mode_count && stream->audio_info.flags.all) {
 		pipe_ctx->stream_res.audio = find_first_free_audio(
 		&context->res_ctx, pool, pipe_ctx->stream_res.stream_enc->id);
 
-- 
GitLab


From 8d641499bf969a284161d2682b71669c96389773 Mon Sep 17 00:00:00 2001
From: Tai Man <taiman.wong@amd.com>
Date: Fri, 28 Jun 2019 11:40:38 -0400
Subject: [PATCH 1470/1835] drm/amd/display: Increase size of audios array

[ Upstream commit 7352193a33dfc9b69ba3bf6a8caea925b96243b1 ]

[Why]
The audios array defined in "struct resource_pool" is only 6 (MAX_PIPES)
but the max number of audio devices (num_audio) is 7. In some projects,
it will run out of audios array.

[How]
Incraese the audios array size to 7.

Signed-off-by: Tai Man <taiman.wong@amd.com>
Reviewed-by: Joshua Aberback <Joshua.Aberback@amd.com>
Acked-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/inc/core_types.h   | 2 +-
 drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
index c0b9ca13393b6..f4469fa5afb55 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
@@ -159,7 +159,7 @@ struct resource_pool {
 	struct clock_source *clock_sources[MAX_CLOCK_SOURCES];
 	unsigned int clk_src_count;
 
-	struct audio *audios[MAX_PIPES];
+	struct audio *audios[MAX_AUDIOS];
 	unsigned int audio_count;
 	struct audio_support audio_support;
 
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
index cf7433ebf91a0..71901743a9387 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
@@ -34,6 +34,7 @@
  * Data types shared between different Virtual HW blocks
  ******************************************************************************/
 
+#define MAX_AUDIOS 7
 #define MAX_PIPES 6
 
 struct gamma_curve {
-- 
GitLab


From 492c158ab2c0c99301f73deda38ca45dea3fe25e Mon Sep 17 00:00:00 2001
From: Thomas Tai <thomas.tai@oracle.com>
Date: Thu, 18 Jul 2019 18:37:34 +0000
Subject: [PATCH 1471/1835] iscsi_ibft: make ISCSI_IBFT dependson ACPI instead
 of ISCSI_IBFT_FIND

[ Upstream commit 94bccc34071094c165c79b515d21b63c78f7e968 ]

iscsi_ibft can use ACPI to find the iBFT entry during bootup,
currently, ISCSI_IBFT depends on ISCSI_IBFT_FIND which is
a X86 legacy way to find the iBFT by searching through the
low memory. This patch changes the dependency so that other
arch like ARM64 can use ISCSI_IBFT as long as the arch supports
ACPI.

ibft_init() needs to use the global variable ibft_addr declared
in iscsi_ibft_find.c. A #ifndef CONFIG_ISCSI_IBFT_FIND is needed
to declare the variable if CONFIG_ISCSI_IBFT_FIND is not selected.
Moving ibft_addr into the iscsi_ibft.c does not work because if
ISCSI_IBFT is selected as a module, the arch/x86/kernel/setup.c won't
be able to find the variable at compile time.

Signed-off-by: Thomas Tai <thomas.tai@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/Kconfig      | 5 +++--
 drivers/firmware/iscsi_ibft.c | 4 ++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 6e83880046d78..ed212c8b41083 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -198,7 +198,7 @@ config DMI_SCAN_MACHINE_NON_EFI_FALLBACK
 
 config ISCSI_IBFT_FIND
 	bool "iSCSI Boot Firmware Table Attributes"
-	depends on X86 && ACPI
+	depends on X86 && ISCSI_IBFT
 	default n
 	help
 	  This option enables the kernel to find the region of memory
@@ -209,7 +209,8 @@ config ISCSI_IBFT_FIND
 config ISCSI_IBFT
 	tristate "iSCSI Boot Firmware Table Attributes module"
 	select ISCSI_BOOT_SYSFS
-	depends on ISCSI_IBFT_FIND && SCSI && SCSI_LOWLEVEL
+	select ISCSI_IBFT_FIND if X86
+	depends on ACPI && SCSI && SCSI_LOWLEVEL
 	default	n
 	help
 	  This option enables support for detection and exposing of iSCSI
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index c51462f5aa1e4..966aef334c420 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -93,6 +93,10 @@ MODULE_DESCRIPTION("sysfs interface to BIOS iBFT information");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBFT_ISCSI_VERSION);
 
+#ifndef CONFIG_ISCSI_IBFT_FIND
+struct acpi_table_ibft *ibft_addr;
+#endif
+
 struct ibft_hdr {
 	u8 id;
 	u8 version;
-- 
GitLab


From f2fd89817212fbbe2e67b04a4fa80f1e992ff812 Mon Sep 17 00:00:00 2001
From: John Crispin <john@phrozen.org>
Date: Thu, 27 Jun 2019 11:58:32 +0200
Subject: [PATCH 1472/1835] nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN

[ Upstream commit 5edaac063bbf1267260ad2a5b9bb803399343e58 ]

NL80211_HE_MAX_CAPABILITY_LEN has changed between D2.0 and D4.0. It is now
MAC (6) + PHY (11) + MCS (12) + PPE (25) = 54.

Signed-off-by: John Crispin <john@phrozen.org>
Link: https://lore.kernel.org/r/20190627095832.19445-1-john@phrozen.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/nl80211.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 7acc16f349427..fa43dd5a7b3dc 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -2732,7 +2732,7 @@ enum nl80211_attrs {
 #define NL80211_HT_CAPABILITY_LEN		26
 #define NL80211_VHT_CAPABILITY_LEN		12
 #define NL80211_HE_MIN_CAPABILITY_LEN           16
-#define NL80211_HE_MAX_CAPABILITY_LEN           51
+#define NL80211_HE_MAX_CAPABILITY_LEN           54
 #define NL80211_MAX_NR_CIPHER_SUITES		5
 #define NL80211_MAX_NR_AKM_SUITES		2
 
-- 
GitLab


From f4cfdd46b3563ff33f167fd44b022e78981bcda8 Mon Sep 17 00:00:00 2001
From: Brian Norris <briannorris@chromium.org>
Date: Wed, 17 Jul 2019 18:57:12 -0700
Subject: [PATCH 1473/1835] mac80211: don't warn about CW params when not using
 them

[ Upstream commit d2b3fe42bc629c2d4002f652b3abdfb2e72991c7 ]

ieee80211_set_wmm_default() normally sets up the initial CW min/max for
each queue, except that it skips doing this if the driver doesn't
support ->conf_tx. We still end up calling drv_conf_tx() in some cases
(e.g., ieee80211_reconfig()), which also still won't do anything
useful...except it complains here about the invalid CW parameters.

Let's just skip the WARN if we weren't going to do anything useful with
the parameters.

Signed-off-by: Brian Norris <briannorris@chromium.org>
Link: https://lore.kernel.org/r/20190718015712.197499-1-briannorris@chromium.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/driver-ops.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index bb886e7db47f1..f783d1377d9a8 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -169,11 +169,16 @@ int drv_conf_tx(struct ieee80211_local *local,
 	if (!check_sdata_in_driver(sdata))
 		return -EIO;
 
-	if (WARN_ONCE(params->cw_min == 0 ||
-		      params->cw_min > params->cw_max,
-		      "%s: invalid CW_min/CW_max: %d/%d\n",
-		      sdata->name, params->cw_min, params->cw_max))
+	if (params->cw_min == 0 || params->cw_min > params->cw_max) {
+		/*
+		 * If we can't configure hardware anyway, don't warn. We may
+		 * never have initialized the CW parameters.
+		 */
+		WARN_ONCE(local->ops->conf_tx,
+			  "%s: invalid CW_min/CW_max: %d/%d\n",
+			  sdata->name, params->cw_min, params->cw_max);
 		return -EINVAL;
+	}
 
 	trace_drv_conf_tx(local, sdata, ac, params);
 	if (local->ops->conf_tx)
-- 
GitLab


From 56dc57c705efe743de9bb13b48ea3ea771213190 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sun, 21 Jul 2019 01:37:31 -0500
Subject: [PATCH 1474/1835] allocate_flower_entry: should check for null deref

[ Upstream commit bb1320834b8a80c6ac2697ab418d066981ea08ba ]

allocate_flower_entry does not check for allocation success, but tries
to deref the result. I only moved the spin_lock under null check, because
 the caller is checking allocation's status at line 652.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
index f2aba5b160c2d..d45c435a599d6 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
@@ -67,7 +67,8 @@ static struct ch_tc_pedit_fields pedits[] = {
 static struct ch_tc_flower_entry *allocate_flower_entry(void)
 {
 	struct ch_tc_flower_entry *new = kzalloc(sizeof(*new), GFP_KERNEL);
-	spin_lock_init(&new->lock);
+	if (new)
+		spin_lock_init(&new->lock);
 	return new;
 }
 
-- 
GitLab


From ca1b1940a32a4cbdaee43e1073a72712eb60118d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Gerhart?= <gerhart@posteo.de>
Date: Mon, 15 Jul 2019 18:33:55 +0200
Subject: [PATCH 1475/1835] hwmon: (nct6775) Fix register address and added
 missed tolerance for nct6106

[ Upstream commit f3d43e2e45fd9d44ba52d20debd12cd4ee9c89bf ]

Fixed address of third NCT6106_REG_WEIGHT_DUTY_STEP, and
added missed NCT6106_REG_TOLERANCE_H.

Fixes: 6c009501ff200 ("hwmon: (nct6775) Add support for NCT6102D/6106D")
Signed-off-by: Bjoern Gerhart <gerhart@posteo.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/nct6775.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 78603b78cf410..eba692cddbdee 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -818,7 +818,7 @@ static const u16 NCT6106_REG_TARGET[] = { 0x111, 0x121, 0x131 };
 static const u16 NCT6106_REG_WEIGHT_TEMP_SEL[] = { 0x168, 0x178, 0x188 };
 static const u16 NCT6106_REG_WEIGHT_TEMP_STEP[] = { 0x169, 0x179, 0x189 };
 static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL[] = { 0x16a, 0x17a, 0x18a };
-static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x17c };
+static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x18b };
 static const u16 NCT6106_REG_WEIGHT_TEMP_BASE[] = { 0x16c, 0x17c, 0x18c };
 static const u16 NCT6106_REG_WEIGHT_DUTY_BASE[] = { 0x16d, 0x17d, 0x18d };
 
@@ -3673,6 +3673,7 @@ static int nct6775_probe(struct platform_device *pdev)
 		data->REG_FAN_TIME[0] = NCT6106_REG_FAN_STOP_TIME;
 		data->REG_FAN_TIME[1] = NCT6106_REG_FAN_STEP_UP_TIME;
 		data->REG_FAN_TIME[2] = NCT6106_REG_FAN_STEP_DOWN_TIME;
+		data->REG_TOLERANCE_H = NCT6106_REG_TOLERANCE_H;
 		data->REG_PWM[0] = NCT6106_REG_PWM;
 		data->REG_PWM[1] = NCT6106_REG_FAN_START_OUTPUT;
 		data->REG_PWM[2] = NCT6106_REG_FAN_STOP_OUTPUT;
-- 
GitLab


From 991c4756be69417f720734ceb32a22071e0aa0af Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 22 Jul 2019 15:14:46 -0400
Subject: [PATCH 1476/1835] drm: silence variable 'conn' set but not used

[ Upstream commit bbb6fc43f131f77fcb7ae8081f6d7c51396a2120 ]

The "struct drm_connector" iteration cursor from
"for_each_new_connector_in_state" is never used in atomic_remove_fb()
which generates a compilation warning,

drivers/gpu/drm/drm_framebuffer.c: In function 'atomic_remove_fb':
drivers/gpu/drm/drm_framebuffer.c:838:24: warning: variable 'conn' set
but not used [-Wunused-but-set-variable]

Silence it by marking "conn" __maybe_unused.

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1563822886-13570-1-git-send-email-cai@lca.pw
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_framebuffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 781af1d42d766..b64a6ffc0aed7 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -793,7 +793,7 @@ static int atomic_remove_fb(struct drm_framebuffer *fb)
 	struct drm_device *dev = fb->dev;
 	struct drm_atomic_state *state;
 	struct drm_plane *plane;
-	struct drm_connector *conn;
+	struct drm_connector *conn __maybe_unused;
 	struct drm_connector_state *conn_state;
 	int i, ret;
 	unsigned plane_mask;
-- 
GitLab


From 8729fe83b0d56c1dabd33b61abce5c0924114b96 Mon Sep 17 00:00:00 2001
From: Wen Yang <wen.yang99@zte.com.cn>
Date: Wed, 17 Jul 2019 11:55:04 +0800
Subject: [PATCH 1477/1835] cpufreq/pasemi: fix use-after-free in
 pas_cpufreq_cpu_init()

[ Upstream commit e0a12445d1cb186d875410d093a00d215bec6a89 ]

The cpu variable is still being used in the of_get_property() call
after the of_node_put() call, which may result in use-after-free.

Fixes: a9acc26b75f6 ("cpufreq/pasemi: fix possible object reference leak")
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/pasemi-cpufreq.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
index c7710c149de85..a0620c9ec0649 100644
--- a/drivers/cpufreq/pasemi-cpufreq.c
+++ b/drivers/cpufreq/pasemi-cpufreq.c
@@ -145,10 +145,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
 	int err = -ENODEV;
 
 	cpu = of_get_cpu_node(policy->cpu, NULL);
+	if (!cpu)
+		goto out;
 
+	max_freqp = of_get_property(cpu, "clock-frequency", NULL);
 	of_node_put(cpu);
-	if (!cpu)
+	if (!max_freqp) {
+		err = -EINVAL;
 		goto out;
+	}
+
+	/* we need the freq in kHz */
+	max_freq = *max_freqp / 1000;
 
 	dn = of_find_compatible_node(NULL, NULL, "1682m-sdc");
 	if (!dn)
@@ -185,16 +193,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
 	}
 
 	pr_debug("init cpufreq on CPU %d\n", policy->cpu);
-
-	max_freqp = of_get_property(cpu, "clock-frequency", NULL);
-	if (!max_freqp) {
-		err = -EINVAL;
-		goto out_unmap_sdcpwr;
-	}
-
-	/* we need the freq in kHz */
-	max_freq = *max_freqp / 1000;
-
 	pr_debug("max clock-frequency is at %u kHz\n", max_freq);
 	pr_debug("initializing frequency table\n");
 
@@ -212,9 +210,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
 
 	return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency());
 
-out_unmap_sdcpwr:
-	iounmap(sdcpwr_mapbase);
-
 out_unmap_sdcasr:
 	iounmap(sdcasr_mapbase);
 out:
-- 
GitLab


From 77868c0003cc0369d88df858239393545db12769 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Thu, 11 Jul 2019 18:17:36 +0200
Subject: [PATCH 1478/1835] s390/qdio: add sanity checks to the fast-requeue
 path

[ Upstream commit a6ec414a4dd529eeac5c3ea51c661daba3397108 ]

If the device driver were to send out a full queue's worth of SBALs,
current code would end up discovering the last of those SBALs as PRIMED
and erroneously skip the SIGA-w. This immediately stalls the queue.

Add a check to not attempt fast-requeue in this case. While at it also
make sure that the state of the previous SBAL was successfully extracted
before inspecting it.

Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/qdio_main.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 4ac4a73037f59..4b7cc8d425b1c 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1569,13 +1569,13 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
 		rc = qdio_kick_outbound_q(q, phys_aob);
 	} else if (need_siga_sync(q)) {
 		rc = qdio_siga_sync_q(q);
+	} else if (count < QDIO_MAX_BUFFERS_PER_Q &&
+		   get_buf_state(q, prev_buf(bufnr), &state, 0) > 0 &&
+		   state == SLSB_CU_OUTPUT_PRIMED) {
+		/* The previous buffer is not processed yet, tack on. */
+		qperf_inc(q, fast_requeue);
 	} else {
-		/* try to fast requeue buffers */
-		get_buf_state(q, prev_buf(bufnr), &state, 0);
-		if (state != SLSB_CU_OUTPUT_PRIMED)
-			rc = qdio_kick_outbound_q(q, 0);
-		else
-			qperf_inc(q, fast_requeue);
+		rc = qdio_kick_outbound_q(q, 0);
 	}
 
 	/* in case of SIGA errors we must process the error immediately */
-- 
GitLab


From b9e2fa1e15b7a9edfe77d0059a2c7e8f31c58a15 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Mon, 22 Jul 2019 10:24:33 +0100
Subject: [PATCH 1479/1835] ALSA: compress: Fix regression on compressed
 capture streams

[ Upstream commit 4475f8c4ab7b248991a60d9c02808dbb813d6be8 ]

A previous fix to the stop handling on compressed capture streams causes
some knock on issues. The previous fix updated snd_compr_drain_notify to
set the state back to PREPARED for capture streams. This causes some
issues however as the handling for snd_compr_poll differs between the
two states and some user-space applications were relying on the poll
failing after the stream had been stopped.

To correct this regression whilst still fixing the original problem the
patch was addressing, update the capture handling to skip the PREPARED
state rather than skipping the SETUP state as it has done until now.

Fixes: 4f2ab5e1d13d ("ALSA: compress: Fix stop handling on compressed capture streams")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/sound/compress_driver.h |  5 +----
 sound/core/compress_offload.c   | 16 +++++++++++-----
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
index e87f2d5b3cc65..127c2713b543a 100644
--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -171,10 +171,7 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
 	if (snd_BUG_ON(!stream))
 		return;
 
-	if (stream->direction == SND_COMPRESS_PLAYBACK)
-		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
-	else
-		stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+	stream->runtime->state = SNDRV_PCM_STATE_SETUP;
 
 	wake_up(&stream->runtime->sleep);
 }
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 8b78ddffa509a..44e81cf302401 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -575,10 +575,7 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 		stream->metadata_set = false;
 		stream->next_track = false;
 
-		if (stream->direction == SND_COMPRESS_PLAYBACK)
-			stream->runtime->state = SNDRV_PCM_STATE_SETUP;
-		else
-			stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
 	} else {
 		return -EPERM;
 	}
@@ -694,8 +691,17 @@ static int snd_compr_start(struct snd_compr_stream *stream)
 {
 	int retval;
 
-	if (stream->runtime->state != SNDRV_PCM_STATE_PREPARED)
+	switch (stream->runtime->state) {
+	case SNDRV_PCM_STATE_SETUP:
+		if (stream->direction != SND_COMPRESS_CAPTURE)
+			return -EPERM;
+		break;
+	case SNDRV_PCM_STATE_PREPARED:
+		break;
+	default:
 		return -EPERM;
+	}
+
 	retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_START);
 	if (!retval)
 		stream->runtime->state = SNDRV_PCM_STATE_RUNNING;
-- 
GitLab


From f1ea9a6387709a6f13665140f74cd8df0ec9337d Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Mon, 22 Jul 2019 10:24:34 +0100
Subject: [PATCH 1480/1835] ALSA: compress: Prevent bypasses of set_params

[ Upstream commit 26c3f1542f5064310ad26794c09321780d00c57d ]

Currently, whilst in SNDRV_PCM_STATE_OPEN it is possible to call
snd_compr_stop, snd_compr_drain and snd_compr_partial_drain, which
allow a transition to SNDRV_PCM_STATE_SETUP. The stream should
only be able to move to the setup state once it has received a
SNDRV_COMPRESS_SET_PARAMS ioctl. Fix this issue by not allowing
those ioctls whilst in the open state.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 44e81cf302401..5e74f518bd598 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -712,9 +712,15 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
 {
 	int retval;
 
-	if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
-			stream->runtime->state == SNDRV_PCM_STATE_SETUP)
+	switch (stream->runtime->state) {
+	case SNDRV_PCM_STATE_OPEN:
+	case SNDRV_PCM_STATE_SETUP:
+	case SNDRV_PCM_STATE_PREPARED:
 		return -EPERM;
+	default:
+		break;
+	}
+
 	retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
 	if (!retval) {
 		snd_compr_drain_notify(stream);
@@ -802,9 +808,14 @@ static int snd_compr_drain(struct snd_compr_stream *stream)
 {
 	int retval;
 
-	if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
-			stream->runtime->state == SNDRV_PCM_STATE_SETUP)
+	switch (stream->runtime->state) {
+	case SNDRV_PCM_STATE_OPEN:
+	case SNDRV_PCM_STATE_SETUP:
+	case SNDRV_PCM_STATE_PREPARED:
 		return -EPERM;
+	default:
+		break;
+	}
 
 	retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_DRAIN);
 	if (retval) {
@@ -841,9 +852,16 @@ static int snd_compr_next_track(struct snd_compr_stream *stream)
 static int snd_compr_partial_drain(struct snd_compr_stream *stream)
 {
 	int retval;
-	if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
-			stream->runtime->state == SNDRV_PCM_STATE_SETUP)
+
+	switch (stream->runtime->state) {
+	case SNDRV_PCM_STATE_OPEN:
+	case SNDRV_PCM_STATE_SETUP:
+	case SNDRV_PCM_STATE_PREPARED:
 		return -EPERM;
+	default:
+		break;
+	}
+
 	/* stream can be drained only when next track has been signalled */
 	if (stream->next_track == false)
 		return -EPERM;
-- 
GitLab


From 30dd700da7de7b1c4f382a7a8637ccc4cae506b9 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Mon, 22 Jul 2019 10:24:35 +0100
Subject: [PATCH 1481/1835] ALSA: compress: Don't allow paritial drain
 operations on capture streams

[ Upstream commit a70ab8a8645083f3700814e757f2940a88b7ef88 ]

Partial drain and next track are intended for gapless playback and
don't really have an obvious interpretation for a capture stream, so
makes sense to not allow those operations on capture streams.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 5e74f518bd598..9c1684f01aca0 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -835,6 +835,10 @@ static int snd_compr_next_track(struct snd_compr_stream *stream)
 	if (stream->runtime->state != SNDRV_PCM_STATE_RUNNING)
 		return -EPERM;
 
+	/* next track doesn't have any meaning for capture streams */
+	if (stream->direction == SND_COMPRESS_CAPTURE)
+		return -EPERM;
+
 	/* you can signal next track if this is intended to be a gapless stream
 	 * and current track metadata is set
 	 */
@@ -862,6 +866,10 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
 		break;
 	}
 
+	/* partial drain doesn't have any meaning for capture streams */
+	if (stream->direction == SND_COMPRESS_CAPTURE)
+		return -EPERM;
+
 	/* stream can be drained only when next track has been signalled */
 	if (stream->next_track == false)
 		return -EPERM;
-- 
GitLab


From b065f404c946804a4cca28f483e1dd9b343395ee Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Mon, 22 Jul 2019 10:24:36 +0100
Subject: [PATCH 1482/1835] ALSA: compress: Be more restrictive about when a
 drain is allowed

[ Upstream commit 3b8179944cb0dd53e5223996966746cdc8a60657 ]

Draining makes little sense in the situation of hardware overrun, as the
hardware will have consumed all its available samples. Additionally,
draining whilst the stream is paused would presumably get stuck as no
data is being consumed on the DSP side.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 9c1684f01aca0..516ec35873256 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -812,7 +812,10 @@ static int snd_compr_drain(struct snd_compr_stream *stream)
 	case SNDRV_PCM_STATE_OPEN:
 	case SNDRV_PCM_STATE_SETUP:
 	case SNDRV_PCM_STATE_PREPARED:
+	case SNDRV_PCM_STATE_PAUSED:
 		return -EPERM;
+	case SNDRV_PCM_STATE_XRUN:
+		return -EPIPE;
 	default:
 		break;
 	}
@@ -861,7 +864,10 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
 	case SNDRV_PCM_STATE_OPEN:
 	case SNDRV_PCM_STATE_SETUP:
 	case SNDRV_PCM_STATE_PREPARED:
+	case SNDRV_PCM_STATE_PAUSED:
 		return -EPERM;
+	case SNDRV_PCM_STATE_XRUN:
+		return -EPIPE;
 	default:
 		break;
 	}
-- 
GitLab


From 101a155436fe1e20be0c9c23d387698e59932354 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@kernel.org>
Date: Mon, 15 Jul 2019 16:04:26 +0200
Subject: [PATCH 1483/1835] perf tools: Fix proper buffer size for feature
 processing

[ Upstream commit 79b2fe5e756163897175a8f57d66b26cd9befd59 ]

After Song Liu's segfault fix for pipe mode, Arnaldo reported following
error:

  # perf record -o - | perf script
  0x514 [0x1ac]: failed to process type: 80

It's caused by wrong buffer size setup in feature processing, which
makes cpu topology feature fail, because it's using buffer size to
recognize its header version.

Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: David Carrillo-Cisneros <davidcc@google.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Fixes: e9def1b2e74e ("perf tools: Add feature header record to pipe-mode")
Link: http://lkml.kernel.org/r/20190715140426.32509-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/header.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 7f2e3b1c746c9..a94bd6850a0b2 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3472,7 +3472,7 @@ int perf_event__process_feature(struct perf_tool *tool,
 		return 0;
 
 	ff.buf  = (void *)fe->data;
-	ff.size = event->header.size - sizeof(event->header);
+	ff.size = event->header.size - sizeof(*fe);
 	ff.ph = &session->header;
 
 	if (feat_ops[feat].process(&ff, NULL))
-- 
GitLab


From f4e2d182d6a6770243f7803003ed556c3963da6f Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Thu, 18 Jul 2019 11:28:37 -0300
Subject: [PATCH 1484/1835] perf probe: Avoid calling freeing routine multiple
 times for same pointer

[ Upstream commit d95daf5accf4a72005daa13fbb1d1bd8709f2861 ]

When perf_add_probe_events() we call cleanup_perf_probe_events() for the
pev pointer it receives, then, as part of handling this failure the main
'perf probe' goes on and calls cleanup_params() and that will again call
cleanup_perf_probe_events()for the same pointer, so just set nevents to
zero when handling the failure of perf_add_probe_events() to avoid the
double free.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lkml.kernel.org/n/tip-x8qgma4g813z96dvtw9w219q@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-probe.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 99de91698de1e..0bdb34fee9d81 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -711,6 +711,16 @@ __cmd_probe(int argc, const char **argv)
 
 		ret = perf_add_probe_events(params.events, params.nevents);
 		if (ret < 0) {
+
+			/*
+			 * When perf_add_probe_events() fails it calls
+			 * cleanup_perf_probe_events(pevs, npevs), i.e.
+			 * cleanup_perf_probe_events(params.events, params.nevents), which
+			 * will call clear_perf_probe_event(), so set nevents to zero
+			 * to avoid cleanup_params() to call clear_perf_probe_event() again
+			 * on the same pevs.
+			 */
+			params.nevents = 0;
 			pr_err_with_code("  Error: Failed to add events.", ret);
 			return ret;
 		}
-- 
GitLab


From 38c919ec7b305b2934d7b9a1b8fdd05325974030 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Jul 2019 14:26:34 +0200
Subject: [PATCH 1485/1835] drbd: dynamically allocate shash descriptor

[ Upstream commit 77ce56e2bfaa64127ae5e23ef136c0168b818777 ]

Building with clang and KASAN, we get a warning about an overly large
stack frame on 32-bit architectures:

drivers/block/drbd/drbd_receiver.c:921:31: error: stack frame size of 1280 bytes in function 'conn_connect'
      [-Werror,-Wframe-larger-than=]

We already allocate other data dynamically in this function, so
just do the same for the shash descriptor, which makes up most of
this memory.

Link: https://lore.kernel.org/lkml/20190617132440.2721536-1-arnd@arndb.de/
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Roland Kammerer <roland.kammerer@linbit.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_receiver.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index cb919b9640660..3cdadf75c82da 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -5240,7 +5240,7 @@ static int drbd_do_auth(struct drbd_connection *connection)
 	unsigned int key_len;
 	char secret[SHARED_SECRET_MAX]; /* 64 byte */
 	unsigned int resp_size;
-	SHASH_DESC_ON_STACK(desc, connection->cram_hmac_tfm);
+	struct shash_desc *desc;
 	struct packet_info pi;
 	struct net_conf *nc;
 	int err, rv;
@@ -5253,6 +5253,13 @@ static int drbd_do_auth(struct drbd_connection *connection)
 	memcpy(secret, nc->shared_secret, key_len);
 	rcu_read_unlock();
 
+	desc = kmalloc(sizeof(struct shash_desc) +
+		       crypto_shash_descsize(connection->cram_hmac_tfm),
+		       GFP_KERNEL);
+	if (!desc) {
+		rv = -1;
+		goto fail;
+	}
 	desc->tfm = connection->cram_hmac_tfm;
 	desc->flags = 0;
 
@@ -5395,7 +5402,10 @@ static int drbd_do_auth(struct drbd_connection *connection)
 	kfree(peers_ch);
 	kfree(response);
 	kfree(right_response);
-	shash_desc_zero(desc);
+	if (desc) {
+		shash_desc_zero(desc);
+		kfree(desc);
+	}
 
 	return rv;
 }
-- 
GitLab


From b1689742ff4ad874a4df3ffc01b4315e6354980f Mon Sep 17 00:00:00 2001
From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Date: Mon, 22 Jul 2019 17:25:48 +0100
Subject: [PATCH 1486/1835] ACPI/IORT: Fix off-by-one check in
 iort_dev_find_its_id()

[ Upstream commit 5a46d3f71d5e5a9f82eabc682f996f1281705ac7 ]

Static analysis identified that index comparison against ITS entries in
iort_dev_find_its_id() is off by one.

Update the comparison condition and clarify the resulting error
message.

Fixes: 4bf2efd26d76 ("ACPI: Add new IORT functions to support MSI domain handling")
Link: https://lore.kernel.org/linux-arm-kernel/20190613065410.GB16334@mwanda/
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Will Deacon <will@kernel.org>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/arm64/iort.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 43c2615434b48..e11b5da6f828f 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -616,8 +616,8 @@ static int iort_dev_find_its_id(struct device *dev, u32 req_id,
 
 	/* Move to ITS specific data */
 	its = (struct acpi_iort_its_group *)node->node_data;
-	if (idx > its->its_count) {
-		dev_err(dev, "requested ITS ID index [%d] is greater than available [%d]\n",
+	if (idx >= its->its_count) {
+		dev_err(dev, "requested ITS ID index [%d] overruns ITS entries [%d]\n",
 			idx, its->its_count);
 		return -ENXIO;
 	}
-- 
GitLab


From bdce5621e6b04ea5ca34e756f692614d0d264287 Mon Sep 17 00:00:00 2001
From: Marta Rybczynska <mrybczyn@kalray.eu>
Date: Tue, 23 Jul 2019 07:41:20 +0200
Subject: [PATCH 1487/1835] nvme: fix multipath crash when ANA is deactivated

[ Upstream commit 66b20ac0a1a10769d059d6903202f53494e3d902 ]

Fix a crash with multipath activated. It happends when ANA log
page is larger than MDTS and because of that ANA is disabled.
The driver then tries to access unallocated buffer when connecting
to a nvme target. The signature is as follows:

[  300.433586] nvme nvme0: ANA log page size (8208) larger than MDTS (8192).
[  300.435387] nvme nvme0: disabling ANA support.
[  300.437835] nvme nvme0: creating 4 I/O queues.
[  300.459132] nvme nvme0: new ctrl: NQN "nqn.0.0.0", addr 10.91.0.1:8009
[  300.464609] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[  300.466342] #PF error: [normal kernel read fault]
[  300.467385] PGD 0 P4D 0
[  300.467987] Oops: 0000 [#1] SMP PTI
[  300.468787] CPU: 3 PID: 50 Comm: kworker/u8:1 Not tainted 5.0.20kalray+ #4
[  300.470264] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  300.471532] Workqueue: nvme-wq nvme_scan_work [nvme_core]
[  300.472724] RIP: 0010:nvme_parse_ana_log+0x21/0x140 [nvme_core]
[  300.474038] Code: 45 01 d2 d8 48 98 c3 66 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 08 48 8b af 20 0a 00 00 48 89 34 24 <66> 83 7d 08 00 0f 84 c6 00 00 00 44 8b 7d 14 49 89 d5 8b 55 10 48
[  300.477374] RSP: 0018:ffffa50e80fd7cb8 EFLAGS: 00010296
[  300.478334] RAX: 0000000000000001 RBX: ffff9130f1872258 RCX: 0000000000000000
[  300.479784] RDX: ffffffffc06c4c30 RSI: ffff9130edad4280 RDI: ffff9130f1872258
[  300.481488] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
[  300.483203] R10: 0000000000000220 R11: 0000000000000040 R12: ffff9130f18722c0
[  300.484928] R13: ffff9130f18722d0 R14: ffff9130edad4280 R15: ffff9130f18722c0
[  300.486626] FS:  0000000000000000(0000) GS:ffff9130f7b80000(0000) knlGS:0000000000000000
[  300.488538] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  300.489907] CR2: 0000000000000008 CR3: 00000002365e6000 CR4: 00000000000006e0
[  300.491612] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  300.493303] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  300.494991] Call Trace:
[  300.495645]  nvme_mpath_add_disk+0x5c/0xb0 [nvme_core]
[  300.496880]  nvme_validate_ns+0x2ef/0x550 [nvme_core]
[  300.498105]  ? nvme_identify_ctrl.isra.45+0x6a/0xb0 [nvme_core]
[  300.499539]  nvme_scan_work+0x2b4/0x370 [nvme_core]
[  300.500717]  ? __switch_to_asm+0x35/0x70
[  300.501663]  process_one_work+0x171/0x380
[  300.502340]  worker_thread+0x49/0x3f0
[  300.503079]  kthread+0xf8/0x130
[  300.503795]  ? max_active_store+0x80/0x80
[  300.504690]  ? kthread_bind+0x10/0x10
[  300.505502]  ret_from_fork+0x35/0x40
[  300.506280] Modules linked in: nvme_tcp nvme_rdma rdma_cm iw_cm ib_cm ib_core nvme_fabrics nvme_core xt_physdev ip6table_raw ip6table_mangle ip6table_filter ip6_tables xt_comment iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_CHECKSUM iptable_mangle iptable_filter veth ebtable_filter ebtable_nat ebtables iptable_raw vxlan ip6_udp_tunnel udp_tunnel sunrpc joydev pcspkr virtio_balloon br_netfilter bridge stp llc ip_tables xfs libcrc32c ata_generic pata_acpi virtio_net virtio_console net_failover virtio_blk failover ata_piix serio_raw libata virtio_pci virtio_ring virtio
[  300.514984] CR2: 0000000000000008
[  300.515569] ---[ end trace faa2eefad7e7f218 ]---
[  300.516354] RIP: 0010:nvme_parse_ana_log+0x21/0x140 [nvme_core]
[  300.517330] Code: 45 01 d2 d8 48 98 c3 66 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 08 48 8b af 20 0a 00 00 48 89 34 24 <66> 83 7d 08 00 0f 84 c6 00 00 00 44 8b 7d 14 49 89 d5 8b 55 10 48
[  300.520353] RSP: 0018:ffffa50e80fd7cb8 EFLAGS: 00010296
[  300.521229] RAX: 0000000000000001 RBX: ffff9130f1872258 RCX: 0000000000000000
[  300.522399] RDX: ffffffffc06c4c30 RSI: ffff9130edad4280 RDI: ffff9130f1872258
[  300.523560] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000044
[  300.524734] R10: 0000000000000220 R11: 0000000000000040 R12: ffff9130f18722c0
[  300.525915] R13: ffff9130f18722d0 R14: ffff9130edad4280 R15: ffff9130f18722c0
[  300.527084] FS:  0000000000000000(0000) GS:ffff9130f7b80000(0000) knlGS:0000000000000000
[  300.528396] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  300.529440] CR2: 0000000000000008 CR3: 00000002365e6000 CR4: 00000000000006e0
[  300.530739] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  300.531989] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  300.533264] Kernel panic - not syncing: Fatal exception
[  300.534338] Kernel Offset: 0x17c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[  300.536227] ---[ end Kernel panic - not syncing: Fatal exception ]---

Condition check refactoring from Christoph Hellwig.

Signed-off-by: Marta Rybczynska <marta.rybczynska@kalray.eu>
Tested-by: Jean-Baptiste Riaux <jbriaux@kalray.eu>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/multipath.c | 8 ++------
 drivers/nvme/host/nvme.h      | 6 +++++-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 260248fbb8feb..a11e210d173e4 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -20,11 +20,6 @@ module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
 	"turn on native support for multiple controllers per subsystem");
 
-inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
-{
-	return multipath && ctrl->subsys && (ctrl->subsys->cmic & (1 << 3));
-}
-
 /*
  * If multipathing is enabled we need to always use the subsystem instance
  * number for numbering our devices to avoid conflicts between subsystems that
@@ -516,7 +511,8 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
 {
 	int error;
 
-	if (!nvme_ctrl_use_ana(ctrl))
+	/* check if multipath is enabled and we have the capability */
+	if (!multipath || !ctrl->subsys || !(ctrl->subsys->cmic & (1 << 3)))
 		return 0;
 
 	ctrl->anacap = id->anacap;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index e82cdaec81c9c..d5e29b57eb340 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -464,7 +464,11 @@ extern const struct attribute_group nvme_ns_id_attr_group;
 extern const struct block_device_operations nvme_ns_head_ops;
 
 #ifdef CONFIG_NVME_MULTIPATH
-bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl);
+static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
+{
+	return ctrl->ana_log_buf != NULL;
+}
+
 void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
 			struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
-- 
GitLab


From 19e7df3e4fe77f788343213103c5d2b054d0ff91 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Jul 2019 16:51:50 +0200
Subject: [PATCH 1488/1835] ARM: davinci: fix sleep.S build error on ARMv4

[ Upstream commit d64b212ea960db4276a1d8372bd98cb861dfcbb0 ]

When building a multiplatform kernel that includes armv4 support,
the default target CPU does not support the blx instruction,
which leads to a build failure:

arch/arm/mach-davinci/sleep.S: Assembler messages:
arch/arm/mach-davinci/sleep.S:56: Error: selected processor does not support `blx ip' in ARM mode

Add a .arch statement in the sources to make this file build.

Link: https://lore.kernel.org/r/20190722145211.1154785-1-arnd@arndb.de
Acked-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-davinci/sleep.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-davinci/sleep.S b/arch/arm/mach-davinci/sleep.S
index cd350dee4df37..efcd400b2abb3 100644
--- a/arch/arm/mach-davinci/sleep.S
+++ b/arch/arm/mach-davinci/sleep.S
@@ -37,6 +37,7 @@
 #define DEEPSLEEP_SLEEPENABLE_BIT	BIT(31)
 
 	.text
+	.arch	armv5te
 /*
  * Move DaVinci into deep sleep state
  *
-- 
GitLab


From bb41940c89bd16d55afd81335719e4fc7205c469 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Jul 2019 16:55:52 +0200
Subject: [PATCH 1489/1835] ARM: dts: bcm: bcm47094: add missing #cells for
 mdio-bus-mux

[ Upstream commit 3a9d2569e45cb02769cda26fee4a02126867c934 ]

The mdio-bus-mux has no #address-cells/#size-cells property,
which causes a few dtc warnings:

arch/arm/boot/dts/bcm47094-linksys-panamera.dts:129.4-18: Warning (reg_format): /mdio-bus-mux/mdio@200:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1)
arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (pci_device_bus_num): Failed prerequisite 'reg_format'
arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (i2c_bus_reg): Failed prerequisite 'reg_format'
arch/arm/boot/dts/bcm47094-linksys-panamera.dtb: Warning (spi_bus_reg): Failed prerequisite 'reg_format'
arch/arm/boot/dts/bcm47094-linksys-panamera.dts:128.22-132.5: Warning (avoid_default_addr_size): /mdio-bus-mux/mdio@200: Relying on default #address-cells value
arch/arm/boot/dts/bcm47094-linksys-panamera.dts:128.22-132.5: Warning (avoid_default_addr_size): /mdio-bus-mux/mdio@200: Relying on default #size-cells value

Add the normal cell numbers.

Link: https://lore.kernel.org/r/20190722145618.1155492-1-arnd@arndb.de
Fixes: 2bebdfcdcd0f ("ARM: dts: BCM5301X: Add support for Linksys EA9500")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/bcm47094-linksys-panamera.dts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
index 36efe410dcd71..9e33c41f54112 100644
--- a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
+++ b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
@@ -125,6 +125,9 @@
 	};
 
 	mdio-bus-mux {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
 		/* BIT(9) = 1 => external mdio */
 		mdio_ext: mdio@200 {
 			reg = <0x200>;
-- 
GitLab


From f254faed41531234999117955bc388346301dee5 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Mon, 22 Jul 2019 09:15:24 -0700
Subject: [PATCH 1490/1835] scsi: megaraid_sas: fix panic on loading firmware
 crashdump

[ Upstream commit 3b5f307ef3cb5022bfe3c8ca5b8f2114d5bf6c29 ]

While loading fw crashdump in function fw_crash_buffer_show(), left bytes
in one dma chunk was not checked, if copying size over it, overflow access
will cause kernel panic.

Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index e0c87228438d3..806ceabcabc3f 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3025,6 +3025,7 @@ megasas_fw_crash_buffer_show(struct device *cdev,
 	u32 size;
 	unsigned long buff_addr;
 	unsigned long dmachunk = CRASH_DMA_BUF_SIZE;
+	unsigned long chunk_left_bytes;
 	unsigned long src_addr;
 	unsigned long flags;
 	u32 buff_offset;
@@ -3050,6 +3051,8 @@ megasas_fw_crash_buffer_show(struct device *cdev,
 	}
 
 	size = (instance->fw_crash_buffer_size * dmachunk) - buff_offset;
+	chunk_left_bytes = dmachunk - (buff_offset % dmachunk);
+	size = (size > chunk_left_bytes) ? chunk_left_bytes : size;
 	size = (size >= PAGE_SIZE) ? (PAGE_SIZE - 1) : size;
 
 	src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] +
-- 
GitLab


From b620c6d5779a3319fe9970e8b84b1027233f6921 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Date: Wed, 17 Jul 2019 14:48:27 -0500
Subject: [PATCH 1491/1835] scsi: ibmvfc: fix WARN_ON during event pool release

[ Upstream commit 5578257ca0e21056821e6481bd534ba267b84e58 ]

While removing an ibmvfc client adapter a WARN_ON like the following
WARN_ON is seen in the kernel log:

WARNING: CPU: 6 PID: 5421 at ./include/linux/dma-mapping.h:541
ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc]
CPU: 6 PID: 5421 Comm: rmmod Tainted: G            E     4.17.0-rc1-next-20180419-autotest #1
NIP:  d00000000290328c LR: d00000000290325c CTR: c00000000036ee20
REGS: c000000288d1b7e0 TRAP: 0700   Tainted: G            E      (4.17.0-rc1-next-20180419-autotest)
MSR:  800000010282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]>  CR: 44008828  XER: 20000000
CFAR: c00000000036e408 SOFTE: 1
GPR00: d00000000290325c c000000288d1ba60 d000000002917900 c000000289d75448
GPR04: 0000000000000071 c0000000ff870000 0000000018040000 0000000000000001
GPR08: 0000000000000000 c00000000156e838 0000000000000001 d00000000290c640
GPR12: c00000000036ee20 c00000001ec4dc00 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 00000100276901e0 0000000010020598
GPR20: 0000000010020550 0000000010020538 0000000010020578 00000000100205b0
GPR24: 0000000000000000 0000000000000000 0000000010020590 5deadbeef0000100
GPR28: 5deadbeef0000200 d000000002910b00 0000000000000071 c0000002822f87d8
NIP [d00000000290328c] ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc]
LR [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc]
Call Trace:
[c000000288d1ba60] [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc] (unreliable)
[c000000288d1baf0] [d000000002909390] ibmvfc_abort_task_set+0x7b0/0x8b0 [ibmvfc]
[c000000288d1bb70] [c0000000000d8c68] vio_bus_remove+0x68/0x100
[c000000288d1bbb0] [c0000000007da7c4] device_release_driver_internal+0x1f4/0x2d0
[c000000288d1bc00] [c0000000007da95c] driver_detach+0x7c/0x100
[c000000288d1bc40] [c0000000007d8af4] bus_remove_driver+0x84/0x140
[c000000288d1bcb0] [c0000000007db6ac] driver_unregister+0x4c/0xa0
[c000000288d1bd20] [c0000000000d6e7c] vio_unregister_driver+0x2c/0x50
[c000000288d1bd50] [d00000000290ba0c] cleanup_module+0x24/0x15e0 [ibmvfc]
[c000000288d1bd70] [c0000000001dadb0] sys_delete_module+0x220/0x2d0
[c000000288d1be30] [c00000000000b284] system_call+0x58/0x6c
Instruction dump:
e8410018 e87f0068 809f0078 e8bf0080 e8df0088 2fa30000 419e008c e9230200
2fa90000 419e0080 894d098a 794a07e0 <0b0a0000> e9290008 2fa90000 419e0028

This is tripped as a result of irqs being disabled during the call to
dma_free_coherent() by ibmvfc_free_event_pool(). At this point in the code path
we have quiesced the adapter and its overly paranoid anyways to be holding the
host lock.

Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ibmvscsi/ibmvfc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index b64ca977825df..71d53bb239e25 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -4874,8 +4874,8 @@ static int ibmvfc_remove(struct vio_dev *vdev)
 
 	spin_lock_irqsave(vhost->host->host_lock, flags);
 	ibmvfc_purge_requests(vhost, DID_ERROR);
-	ibmvfc_free_event_pool(vhost);
 	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+	ibmvfc_free_event_pool(vhost);
 
 	ibmvfc_free_mem(vhost);
 	spin_lock(&ibmvfc_driver_lock);
-- 
GitLab


From cdd92ebe29c2e36c6b76d0e404ffb6d3d191ec5b Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
Date: Fri, 12 Jul 2019 08:53:47 +0200
Subject: [PATCH 1492/1835] scsi: scsi_dh_alua: always use a 2 second delay
 before retrying RTPG

[ Upstream commit 20122994e38aef0ae50555884d287adde6641c94 ]

Retrying immediately after we've received a 'transitioning' sense code is
pretty much pointless, we should always use a delay before retrying.  So
ensure the default delay is applied before retrying.

Signed-off-by: Hannes Reinecke <hare@suse.com>
Tested-by: Zhangguanghui <zhang.guanghui@h3c.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/device_handler/scsi_dh_alua.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index d1154baa9436a..9c21938ed67ed 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -54,6 +54,7 @@
 #define ALUA_FAILOVER_TIMEOUT		60
 #define ALUA_FAILOVER_RETRIES		5
 #define ALUA_RTPG_DELAY_MSECS		5
+#define ALUA_RTPG_RETRY_DELAY		2
 
 /* device handler flags */
 #define ALUA_OPTIMIZE_STPG		0x01
@@ -696,7 +697,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
 	case SCSI_ACCESS_STATE_TRANSITIONING:
 		if (time_before(jiffies, pg->expiry)) {
 			/* State transition, retry */
-			pg->interval = 2;
+			pg->interval = ALUA_RTPG_RETRY_DELAY;
 			err = SCSI_DH_RETRY;
 		} else {
 			struct alua_dh_data *h;
@@ -821,6 +822,8 @@ static void alua_rtpg_work(struct work_struct *work)
 				spin_lock_irqsave(&pg->lock, flags);
 				pg->flags &= ~ALUA_PG_RUNNING;
 				pg->flags |= ALUA_PG_RUN_RTPG;
+				if (!pg->interval)
+					pg->interval = ALUA_RTPG_RETRY_DELAY;
 				spin_unlock_irqrestore(&pg->lock, flags);
 				queue_delayed_work(kaluad_wq, &pg->rtpg_work,
 						   pg->interval * HZ);
@@ -832,6 +835,8 @@ static void alua_rtpg_work(struct work_struct *work)
 		spin_lock_irqsave(&pg->lock, flags);
 		if (err == SCSI_DH_RETRY || pg->flags & ALUA_PG_RUN_RTPG) {
 			pg->flags &= ~ALUA_PG_RUNNING;
+			if (!pg->interval && !(pg->flags & ALUA_PG_RUN_RTPG))
+				pg->interval = ALUA_RTPG_RETRY_DELAY;
 			pg->flags |= ALUA_PG_RUN_RTPG;
 			spin_unlock_irqrestore(&pg->lock, flags);
 			queue_delayed_work(kaluad_wq, &pg->rtpg_work,
-- 
GitLab


From 0ba69e96cc625786bca775f4e9e8f9d06d512d1a Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Sun, 14 Jul 2019 01:11:35 -0500
Subject: [PATCH 1493/1835] test_firmware: fix a memory leak bug

[ Upstream commit d4fddac5a51c378c5d3e68658816c37132611e1f ]

In test_firmware_init(), the buffer pointed to by the global pointer
'test_fw_config' is allocated through kzalloc(). Then, the buffer is
initialized in __test_firmware_config_init(). In the case that the
initialization fails, the following execution in test_firmware_init() needs
to be terminated with an error code returned to indicate this failure.
However, the allocated buffer is not freed on this execution path, leading
to a memory leak bug.

To fix the above issue, free the allocated buffer before returning from
test_firmware_init().

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Link: https://lore.kernel.org/r/1563084696-6865-1-git-send-email-wang6495@umn.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_firmware.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/test_firmware.c b/lib/test_firmware.c
index fd48a15a0710c..a74b1aae74618 100644
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -894,8 +894,11 @@ static int __init test_firmware_init(void)
 		return -ENOMEM;
 
 	rc = __test_firmware_config_init();
-	if (rc)
+	if (rc) {
+		kfree(test_fw_config);
+		pr_err("could not init firmware test config: %d\n", rc);
 		return rc;
+	}
 
 	rc = misc_register(&test_fw_misc_device);
 	if (rc) {
-- 
GitLab


From 06dc92142b5efbacd051b21ac7d74abd96240779 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Thu, 18 Jul 2019 15:03:15 +0200
Subject: [PATCH 1494/1835] tty/ldsem, locking/rwsem: Add missing ACQUIRE to
 read_failed sleep loop

[ Upstream commit 952041a8639a7a3a73a2b6573cb8aa8518bc39f8 ]

While reviewing rwsem down_slowpath, Will noticed ldsem had a copy of
a bug we just found for rwsem.

  X = 0;

  CPU0			CPU1

  rwsem_down_read()
    for (;;) {
      set_current_state(TASK_UNINTERRUPTIBLE);

                        X = 1;
                        rwsem_up_write();
                          rwsem_mark_wake()
                            atomic_long_add(adjustment, &sem->count);
                            smp_store_release(&waiter->task, NULL);

      if (!waiter.task)
        break;

      ...
    }

  r = X;

Allows 'r == 0'.

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Will Deacon <will@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Hurley <peter@hurleysoftware.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 4898e640caf0 ("tty: Add timed, writer-prioritized rw semaphore")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/tty_ldsem.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index b989ca26fc788..2f0372976459e 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -116,8 +116,7 @@ static void __ldsem_wake_readers(struct ld_semaphore *sem)
 
 	list_for_each_entry_safe(waiter, next, &sem->read_wait, list) {
 		tsk = waiter->task;
-		smp_mb();
-		waiter->task = NULL;
+		smp_store_release(&waiter->task, NULL);
 		wake_up_process(tsk);
 		put_task_struct(tsk);
 	}
@@ -217,7 +216,7 @@ down_read_failed(struct ld_semaphore *sem, long count, long timeout)
 	for (;;) {
 		set_current_state(TASK_UNINTERRUPTIBLE);
 
-		if (!waiter.task)
+		if (!smp_load_acquire(&waiter.task))
 			break;
 		if (!timeout)
 			break;
-- 
GitLab


From d768173982ece75b8ef821897e32fd0da9d60131 Mon Sep 17 00:00:00 2001
From: Leonard Crestez <leonard.crestez@nxp.com>
Date: Wed, 24 Jul 2019 15:53:24 +0300
Subject: [PATCH 1495/1835] perf/core: Fix creating kernel counters for PMUs
 that override event->cpu

[ Upstream commit 4ce54af8b33d3e21ca935fc1b89b58cbba956051 ]

Some hardware PMU drivers will override perf_event.cpu inside their
event_init callback. This causes a lockdep splat when initialized through
the kernel API:

 WARNING: CPU: 0 PID: 250 at kernel/events/core.c:2917 ctx_sched_out+0x78/0x208
 pc : ctx_sched_out+0x78/0x208
 Call trace:
  ctx_sched_out+0x78/0x208
  __perf_install_in_context+0x160/0x248
  remote_function+0x58/0x68
  generic_exec_single+0x100/0x180
  smp_call_function_single+0x174/0x1b8
  perf_install_in_context+0x178/0x188
  perf_event_create_kernel_counter+0x118/0x160

Fix this by calling perf_install_in_context with event->cpu, just like
perf_event_open

Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Frank Li <Frank.li@nxp.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will@kernel.org>
Link: https://lkml.kernel.org/r/c4ebe0503623066896d7046def4d6b1e06e0eb2e.1563972056.git.leonard.crestez@nxp.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e8979c72514be..7ca44b8523c81 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10957,7 +10957,7 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
 		goto err_unlock;
 	}
 
-	perf_install_in_context(ctx, event, cpu);
+	perf_install_in_context(ctx, event, event->cpu);
 	perf_unpin_context(ctx);
 	mutex_unlock(&ctx->mutex);
 
-- 
GitLab


From 5c4689cbe95ad597a416baa55bcb1fa05311fd86 Mon Sep 17 00:00:00 2001
From: Halil Pasic <pasic@linux.ibm.com>
Date: Wed, 24 Jul 2019 00:51:55 +0200
Subject: [PATCH 1496/1835] s390/dma: provide proper ARCH_ZONE_DMA_BITS value

[ Upstream commit 1a2dcff881059dedc14fafc8a442664c8dbd60f1 ]

On s390 ZONE_DMA is up to 2G, i.e. ARCH_ZONE_DMA_BITS should be 31 bits.
The current value is 24 and makes __dma_direct_alloc_pages() take a
wrong turn first (but __dma_direct_alloc_pages() recovers then).

Let's correct ARCH_ZONE_DMA_BITS value and avoid wrong turns.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reported-by: Petr Tesarik <ptesarik@suse.cz>
Fixes: c61e9637340e ("dma-direct: add support for allocation from ZONE_DMA and ZONE_DMA32")
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/include/asm/page.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 41e3908b397f8..0d753291c43c0 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -176,6 +176,8 @@ static inline int devmem_is_allowed(unsigned long pfn)
 #define VM_DATA_DEFAULT_FLAGS	(VM_READ | VM_WRITE | \
 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
+#define ARCH_ZONE_DMA_BITS	31
+
 #include <asm-generic/memory_model.h>
 #include <asm-generic/getorder.h>
 
-- 
GitLab


From 1182930700967e28800e75f7a999307dd191f68e Mon Sep 17 00:00:00 2001
From: Roderick Colenbrander <roderick@gaikai.com>
Date: Fri, 2 Aug 2019 15:50:19 -0700
Subject: [PATCH 1497/1835] HID: sony: Fix race condition between rumble and
 device remove.

commit e0f6974a54d3f7f1b5fdf5a593bd43ce9206ec04 upstream.

Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4
gamepad while rumble is enabled. This issue is reproducible with a
frequency of 1 in 3 times in the game Borderlands 2 when using an
automatic weapon, which triggers many rumble operations.

We found the issue to be a race condition between sony_remove and the
final device destruction by the HID / input system. The problem was
that sony_remove didn't clean some of its work_item state in
"struct sony_sc". After sony_remove work, the corresponding evdev
node was around for sufficient time for applications to still queue
rumble work after "sony_remove".

On pre-4.19 kernels the race condition caused a kernel crash due to a
NULL-pointer dereference as "sc->output_report_dmabuf" got freed during
sony_remove. On newer kernels this crash doesn't happen due the buffer
now being allocated using devm_kzalloc. However we can still queue work,
while the driver is an undefined state.

This patch fixes the described problem, by guarding the work_item
"state_worker" with an initialized variable, which we are setting back
to 0 on cleanup.

Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-sony.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 9671a4bad6439..31f1023214d36 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -587,10 +587,14 @@ static void sony_set_leds(struct sony_sc *sc);
 static inline void sony_schedule_work(struct sony_sc *sc,
 				      enum sony_worker which)
 {
+	unsigned long flags;
+
 	switch (which) {
 	case SONY_WORKER_STATE:
-		if (!sc->defer_initialization)
+		spin_lock_irqsave(&sc->lock, flags);
+		if (!sc->defer_initialization && sc->state_worker_initialized)
 			schedule_work(&sc->state_worker);
+		spin_unlock_irqrestore(&sc->lock, flags);
 		break;
 	case SONY_WORKER_HOTPLUG:
 		if (sc->hotplug_worker_initialized)
@@ -2553,13 +2557,18 @@ static inline void sony_init_output_report(struct sony_sc *sc,
 
 static inline void sony_cancel_work_sync(struct sony_sc *sc)
 {
+	unsigned long flags;
+
 	if (sc->hotplug_worker_initialized)
 		cancel_work_sync(&sc->hotplug_worker);
-	if (sc->state_worker_initialized)
+	if (sc->state_worker_initialized) {
+		spin_lock_irqsave(&sc->lock, flags);
+		sc->state_worker_initialized = 0;
+		spin_unlock_irqrestore(&sc->lock, flags);
 		cancel_work_sync(&sc->state_worker);
+	}
 }
 
-
 static int sony_input_configured(struct hid_device *hdev,
 					struct hid_input *hidinput)
 {
-- 
GitLab


From e0d262a57fc741a9b362e458c714e37a77ddb62d Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Wed, 7 Aug 2019 15:15:32 -0700
Subject: [PATCH 1498/1835] x86/purgatory: Do not use __builtin_memcpy and
 __builtin_memset

commit 4ce97317f41d38584fb93578e922fcd19e535f5b upstream.

Implementing memcpy and memset in terms of __builtin_memcpy and
__builtin_memset is problematic.

GCC at -O2 will replace calls to the builtins with calls to memcpy and
memset (but will generate an inline implementation at -Os).  Clang will
replace the builtins with these calls regardless of optimization level.
$ llvm-objdump -dr arch/x86/purgatory/string.o | tail

0000000000000339 memcpy:
     339: 48 b8 00 00 00 00 00 00 00 00 movabsq $0, %rax
                000000000000033b:  R_X86_64_64  memcpy
     343: ff e0                         jmpq    *%rax

0000000000000345 memset:
     345: 48 b8 00 00 00 00 00 00 00 00 movabsq $0, %rax
                0000000000000347:  R_X86_64_64  memset
     34f: ff e0

Such code results in infinite recursion at runtime. This is observed
when doing kexec.

Instead, reuse an implementation from arch/x86/boot/compressed/string.c.
This requires to implement a stub function for warn(). Also, Clang may
lower memcmp's that compare against 0 to bcmp's, so add a small definition,
too. See also: commit 5f074f3e192f ("lib/string.c: implement a basic bcmp")

Fixes: 8fc5b4d4121c ("purgatory: core purgatory functionality")
Reported-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Debugged-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Debugged-by: Manoj Gupta <manojgupta@google.com>
Suggested-by: Alistair Delva <adelva@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Cc: stable@vger.kernel.org
Link: https://bugs.chromium.org/p/chromium/issues/detail?id=984056
Link: https://lkml.kernel.org/r/20190807221539.94583-1-ndesaulniers@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/boot/string.c         |  8 ++++++++
 arch/x86/purgatory/Makefile    |  3 +++
 arch/x86/purgatory/purgatory.c |  6 ++++++
 arch/x86/purgatory/string.c    | 25 -------------------------
 4 files changed, 17 insertions(+), 25 deletions(-)
 delete mode 100644 arch/x86/purgatory/string.c

diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
index c4428a1769733..2622c0742c92d 100644
--- a/arch/x86/boot/string.c
+++ b/arch/x86/boot/string.c
@@ -34,6 +34,14 @@ int memcmp(const void *s1, const void *s2, size_t len)
 	return diff;
 }
 
+/*
+ * Clang may lower `memcmp == 0` to `bcmp == 0`.
+ */
+int bcmp(const void *s1, const void *s2, size_t len)
+{
+	return memcmp(s1, s2, len);
+}
+
 int strcmp(const char *str1, const char *str2)
 {
 	const unsigned char *s1 = (const unsigned char *)str1;
diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index 3d8144627b126..8901a1f89cf57 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -6,6 +6,9 @@ purgatory-y := purgatory.o stack.o setup-x86_$(BITS).o sha256.o entry64.o string
 targets += $(purgatory-y)
 PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
 
+$(obj)/string.o: $(srctree)/arch/x86/boot/compressed/string.c FORCE
+	$(call if_changed_rule,cc_o_c)
+
 $(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE
 	$(call if_changed_rule,cc_o_c)
 
diff --git a/arch/x86/purgatory/purgatory.c b/arch/x86/purgatory/purgatory.c
index 025c34ac0d848..7971f7a8af59f 100644
--- a/arch/x86/purgatory/purgatory.c
+++ b/arch/x86/purgatory/purgatory.c
@@ -70,3 +70,9 @@ void purgatory(void)
 	}
 	copy_backup_region();
 }
+
+/*
+ * Defined in order to reuse memcpy() and memset() from
+ * arch/x86/boot/compressed/string.c
+ */
+void warn(const char *msg) {}
diff --git a/arch/x86/purgatory/string.c b/arch/x86/purgatory/string.c
deleted file mode 100644
index 795ca4f2cb3c9..0000000000000
--- a/arch/x86/purgatory/string.c
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Simple string functions.
- *
- * Copyright (C) 2014 Red Hat Inc.
- *
- * Author:
- *       Vivek Goyal <vgoyal@redhat.com>
- *
- * This source code is licensed under the GNU General Public License,
- * Version 2.  See the file COPYING for more details.
- */
-
-#include <linux/types.h>
-
-#include "../boot/string.c"
-
-void *memcpy(void *dst, const void *src, size_t len)
-{
-	return __builtin_memcpy(dst, src, len);
-}
-
-void *memset(void *dst, int c, size_t len)
-{
-	return __builtin_memset(dst, c, len);
-}
-- 
GitLab


From d4d904e4e258e1e5c794af3e702d6f6ecc8fd56d Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Tue, 6 Aug 2019 03:00:27 -0400
Subject: [PATCH 1499/1835] ALSA: usb-audio: fix a memory leak bug

commit a67060201b746a308b1674f66bf289c9faef6d09 upstream.

In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is
allocated through kzalloc() before the execution goto 'found_clock'.
However, this structure is not deallocated if the memory allocation for
'pd' fails, leading to a memory leak bug.

To fix the above issue, free 'fp->chmap' before returning NULL.

Fixes: 7edf3b5e6a45 ("ALSA: usb-audio: AudioStreaming Power Domain parsing")
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/stream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index d9e3de495c163..bc582202bd101 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -1053,6 +1053,7 @@ found_clock:
 
 		pd = kzalloc(sizeof(*pd), GFP_KERNEL);
 		if (!pd) {
+			kfree(fp->chmap);
 			kfree(fp->rate_table);
 			kfree(fp);
 			return NULL;
-- 
GitLab


From cab569a44a524709d95bbd88700860ac45e5d5cf Mon Sep 17 00:00:00 2001
From: Tomas Bortoli <tomasbortoli@gmail.com>
Date: Wed, 31 Jul 2019 10:54:47 -0400
Subject: [PATCH 1500/1835] can: peak_usb: pcan_usb_pro: Fix info-leaks to USB
 devices

commit ead16e53c2f0ed946d82d4037c630e2f60f4ab69 upstream.

Uninitialized Kernel memory can leak to USB devices.

Fix by using kzalloc() instead of kmalloc() on the affected buffers.

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+d6a5a1a3657b596ef132@syzkaller.appspotmail.com
Fixes: f14e22435a27 ("net: can: peak_usb: Do not do dma on the stack")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index d516def846abe..b304198f0b3af 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -502,7 +502,7 @@ static int pcan_usb_pro_drv_loaded(struct peak_usb_device *dev, int loaded)
 	u8 *buffer;
 	int err;
 
-	buffer = kmalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
+	buffer = kzalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
 	if (!buffer)
 		return -ENOMEM;
 
-- 
GitLab


From 9ce1b3eb5489416338b2fb2b40f30f0d425700b4 Mon Sep 17 00:00:00 2001
From: Tomas Bortoli <tomasbortoli@gmail.com>
Date: Wed, 31 Jul 2019 10:54:47 -0400
Subject: [PATCH 1501/1835] can: peak_usb: pcan_usb_fd: Fix info-leaks to USB
 devices

commit 30a8beeb3042f49d0537b7050fd21b490166a3d9 upstream.

Uninitialized Kernel memory can leak to USB devices.

Fix by using kzalloc() instead of kmalloc() on the affected buffers.

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+513e4d0985298538bf9b@syzkaller.appspotmail.com
Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index dd161c5eea8ec..41988358f63c8 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -849,7 +849,7 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
 			goto err_out;
 
 		/* allocate command buffer once for all for the interface */
-		pdev->cmd_buffer_addr = kmalloc(PCAN_UFD_CMD_BUFFER_SIZE,
+		pdev->cmd_buffer_addr = kzalloc(PCAN_UFD_CMD_BUFFER_SIZE,
 						GFP_KERNEL);
 		if (!pdev->cmd_buffer_addr)
 			goto err_out_1;
-- 
GitLab


From a73027204ac5f1a7333851e50bfad55461b81378 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Fri, 26 Jul 2019 08:00:49 -0700
Subject: [PATCH 1502/1835] hwmon: (nct7802) Fix wrong detection of in4
 presence

commit 38ada2f406a9b81fb1249c5c9227fa657e7d5671 upstream.

The code to detect if in4 is present is wrong; if in4 is not present,
the in4_input sysfs attribute is still present.

In detail:

- Ihen RTD3_MD=11 (VSEN3 present), everything is as expected (no bug).
- If we have RTD3_MD!=11 (no VSEN3), we unexpectedly have a in4_input
  file under /sys and the "sensors" command displays in4_input.
  But as expected, we have no in4_min, in4_max, in4_alarm, in4_beep.

Fix is_visible function to detect and report in4_input visibility
as expected.

Reported-by: Gilles Buloz <Gilles.Buloz@kontron.com>
Cc: Gilles Buloz <Gilles.Buloz@kontron.com>
Cc: stable@vger.kernel.org
Fixes: 3434f37835804 ("hwmon: Driver for Nuvoton NCT7802Y")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/nct7802.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
index 2876c18ed8411..38ffbdb0a85fb 100644
--- a/drivers/hwmon/nct7802.c
+++ b/drivers/hwmon/nct7802.c
@@ -768,7 +768,7 @@ static struct attribute *nct7802_in_attrs[] = {
 	&sensor_dev_attr_in3_alarm.dev_attr.attr,
 	&sensor_dev_attr_in3_beep.dev_attr.attr,
 
-	&sensor_dev_attr_in4_input.dev_attr.attr,	/* 17 */
+	&sensor_dev_attr_in4_input.dev_attr.attr,	/* 16 */
 	&sensor_dev_attr_in4_min.dev_attr.attr,
 	&sensor_dev_attr_in4_max.dev_attr.attr,
 	&sensor_dev_attr_in4_alarm.dev_attr.attr,
@@ -794,9 +794,9 @@ static umode_t nct7802_in_is_visible(struct kobject *kobj,
 
 	if (index >= 6 && index < 11 && (reg & 0x03) != 0x03)	/* VSEN1 */
 		return 0;
-	if (index >= 11 && index < 17 && (reg & 0x0c) != 0x0c)	/* VSEN2 */
+	if (index >= 11 && index < 16 && (reg & 0x0c) != 0x0c)	/* VSEN2 */
 		return 0;
-	if (index >= 17 && (reg & 0x30) != 0x30)		/* VSEN3 */
+	if (index >= 16 && (reg & 0x30) != 0x30)		/* VSEN3 */
 		return 0;
 
 	return attr->mode;
-- 
GitLab


From edc388566a1d25f88e631bd8170462d4f86c5a24 Mon Sep 17 00:00:00 2001
From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Date: Fri, 12 Jul 2019 11:19:38 +0300
Subject: [PATCH 1503/1835] drm/i915: Fix wrong escape clock divisor init for
 GLK

commit 73a0ff0b30af79bf0303d557eb82f1d1945bb6ee upstream.

According to Bspec clock divisor registers in GeminiLake
should be initialized by shifting 1(<<) to amount of correspondent
divisor. While i915 was writing all this time that value as is.

Surprisingly that it by accident worked, until we met some issues
with Microtech Etab.

v2: Added Fixes tag and cc
v3: Added stable to cc as well.

Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Reviewed-by: Vandita Kulkarni <vandita.kulkarni@intel.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108826
Fixes: bcc657004841 ("drm/i915/glk: Program txesc clock divider for GLK")
Cc: Deepak M <m.deepak@intel.com>
Cc: Madhav Chauhan <madhav.chauhan@intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: stable@vger.kernel.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190712081938.14185-1-stanislav.lisovskiy@intel.com
(cherry picked from commit ce52ad5dd52cfaf3398058384e0ff94134bbd89c)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/vlv_dsi_pll.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/vlv_dsi_pll.c b/drivers/gpu/drm/i915/vlv_dsi_pll.c
index a132a8037ecc6..77df7903e071e 100644
--- a/drivers/gpu/drm/i915/vlv_dsi_pll.c
+++ b/drivers/gpu/drm/i915/vlv_dsi_pll.c
@@ -413,8 +413,8 @@ static void glk_dsi_program_esc_clock(struct drm_device *dev,
 	else
 		txesc2_div = 10;
 
-	I915_WRITE(MIPIO_TXESC_CLK_DIV1, txesc1_div & GLK_TX_ESC_CLK_DIV1_MASK);
-	I915_WRITE(MIPIO_TXESC_CLK_DIV2, txesc2_div & GLK_TX_ESC_CLK_DIV2_MASK);
+	I915_WRITE(MIPIO_TXESC_CLK_DIV1, (1 << (txesc1_div - 1)) & GLK_TX_ESC_CLK_DIV1_MASK);
+	I915_WRITE(MIPIO_TXESC_CLK_DIV2, (1 << (txesc2_div - 1)) & GLK_TX_ESC_CLK_DIV2_MASK);
 }
 
 /* Program BXT Mipi clocks and dividers */
-- 
GitLab


From bc972b6b52e2ddd93b7532cd2213d9c2be5d6340 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Thu, 8 Aug 2019 00:50:58 -0500
Subject: [PATCH 1504/1835] ALSA: firewire: fix a memory leak bug

commit 1be3c1fae6c1e1f5bb982b255d2034034454527a upstream.

In iso_packets_buffer_init(), 'b->packets' is allocated through
kmalloc_array(). Then, the aligned packet size is checked. If it is
larger than PAGE_SIZE, -EINVAL will be returned to indicate the error.
However, the allocated 'b->packets' is not deallocated on this path,
leading to a memory leak.

To fix the above issue, free 'b->packets' before returning the error code.

Fixes: 31ef9134eb52 ("ALSA: add LaCie FireWire Speakers/Griffin FireWave Surround driver")
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org> # v2.6.39+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/firewire/packets-buffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/firewire/packets-buffer.c b/sound/firewire/packets-buffer.c
index 1ebf00c834096..715cd99f28de8 100644
--- a/sound/firewire/packets-buffer.c
+++ b/sound/firewire/packets-buffer.c
@@ -37,7 +37,7 @@ int iso_packets_buffer_init(struct iso_packets_buffer *b, struct fw_unit *unit,
 	packets_per_page = PAGE_SIZE / packet_size;
 	if (WARN_ON(!packets_per_page)) {
 		err = -EINVAL;
-		goto error;
+		goto err_packets;
 	}
 	pages = DIV_ROUND_UP(count, packets_per_page);
 
-- 
GitLab


From 1c286e4e13f258a948dc20396eaae475ea930040 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Wed, 7 Aug 2019 04:08:51 -0500
Subject: [PATCH 1505/1835] ALSA: hiface: fix multiple memory leak bugs

commit 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723 upstream.

In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later
on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In
hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through
kzalloc().  However, if hiface_pcm_init_urb() fails, both 'rt' and
'rt->out_urbs[i].buffer' are not deallocated, leading to memory leak bugs.
Also, 'rt->out_urbs[i].buffer' is not deallocated if snd_pcm_new() fails.

To fix the above issues, free 'rt' and 'rt->out_urbs[i].buffer'.

Fixes: a91c3fb2f842 ("Add M2Tech hiFace USB-SPDIF driver")
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/hiface/pcm.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c
index e1fbb9cc9ea76..a197fc3b9ab08 100644
--- a/sound/usb/hiface/pcm.c
+++ b/sound/usb/hiface/pcm.c
@@ -604,14 +604,13 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
 		ret = hiface_pcm_init_urb(&rt->out_urbs[i], chip, OUT_EP,
 				    hiface_pcm_out_urb_handler);
 		if (ret < 0)
-			return ret;
+			goto error;
 	}
 
 	ret = snd_pcm_new(chip->card, "USB-SPDIF Audio", 0, 1, 0, &pcm);
 	if (ret < 0) {
-		kfree(rt);
 		dev_err(&chip->dev->dev, "Cannot create pcm instance\n");
-		return ret;
+		goto error;
 	}
 
 	pcm->private_data = rt;
@@ -624,4 +623,10 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
 
 	chip->pcm = rt;
 	return 0;
+
+error:
+	for (i = 0; i < PCM_N_URBS; i++)
+		kfree(rt->out_urbs[i].buffer);
+	kfree(rt);
+	return ret;
 }
-- 
GitLab


From 06f0bcaceb8cc506b58e81b63fae9f1fb949f12b Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 6 Aug 2019 14:03:56 +0200
Subject: [PATCH 1506/1835] ALSA: hda - Don't override global PCM hw info flag

commit c1c6c877b0c79fd7e05c931435aa42211eaeebaf upstream.

The commit bfcba288b97f ("ALSA - hda: Add support for link audio time
reporting") introduced the conditional PCM hw info setup, but it
overwrites the global azx_pcm_hw object.  This will cause a problem if
any other HD-audio controller, as it'll inherit the same bit flag
although another controller doesn't support that feature.

Fix the bug by setting the PCM hw info flag locally.

Fixes: bfcba288b97f ("ALSA - hda: Add support for link audio time reporting")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_controller.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index a12e594d4e3b3..750a4d235a125 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -609,11 +609,9 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
 	}
 	runtime->private_data = azx_dev;
 
-	if (chip->gts_present)
-		azx_pcm_hw.info = azx_pcm_hw.info |
-			SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
-
 	runtime->hw = azx_pcm_hw;
+	if (chip->gts_present)
+		runtime->hw.info |= SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
 	runtime->hw.channels_min = hinfo->channels_min;
 	runtime->hw.channels_max = hinfo->channels_max;
 	runtime->hw.formats = hinfo->formats;
-- 
GitLab


From af9d64f871cfe441508f116f31b49410453f96db Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 6 Aug 2019 17:31:48 +0200
Subject: [PATCH 1507/1835] ALSA: hda - Workaround for crackled sound on AMD
 controller (1022:1457)

commit c02f77d32d2c45cfb1b2bb99eabd8a78f5ecc7db upstream.

A long-time problem on the recent AMD chip (X370, X470, B450, etc with
PCI ID 1022:1457) with Realtek codecs is the crackled or distorted
sound for capture streams, as well as occasional playback hiccups.
After lengthy debugging sessions, the workarounds we've found are like
the following:

- Set up the proper driver caps for this controller, similar as the
  other AMD controller.

- Correct the DMA position reporting with the fixed FIFO size, which
  is similar like as workaround used for VIA chip set.

- Even after the position correction, PulseAudio still shows
  mysterious stalls of playback streams when a capture is triggered in
  timer-scheduled mode.  Since we have no clear way to eliminate the
  stall, pass the BATCH PCM flag for PA to suppress the tsched mode as
  a temporary workaround.

This patch implements the workarounds.  For the driver caps, it
defines a new preset, AXZ_DCAPS_PRESET_AMD_SB.  It enables the FIFO-
corrected position reporting (corresponding to the new position_fix=6)
and enforces the SNDRV_PCM_INFO_BATCH flag.

Note that the current implementation is merely a workaround.
Hopefully we'll find a better alternative in future, especially about
removing the BATCH flag hack again.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195303
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_controller.c |  7 ++++
 sound/pci/hda/hda_controller.h |  2 +-
 sound/pci/hda/hda_intel.c      | 63 +++++++++++++++++++++++++++++++++-
 3 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index 750a4d235a125..a41c1bec7c88c 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -624,6 +624,13 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
 				     20,
 				     178000000);
 
+	/* by some reason, the playback stream stalls on PulseAudio with
+	 * tsched=1 when a capture stream triggers.  Until we figure out the
+	 * real cause, disable tsched mode by telling the PCM info flag.
+	 */
+	if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND)
+		runtime->hw.info |= SNDRV_PCM_INFO_BATCH;
+
 	if (chip->align_buffer_size)
 		/* constrain buffer sizes to be multiple of 128
 		   bytes. This is more efficient in terms of memory
diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index 53c3cd28bc995..8a9dd4767b1ec 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -40,7 +40,7 @@
 /* 14 unused */
 #define AZX_DCAPS_CTX_WORKAROUND (1 << 15)	/* X-Fi workaround */
 #define AZX_DCAPS_POSFIX_LPIB	(1 << 16)	/* Use LPIB as default */
-/* 17 unused */
+#define AZX_DCAPS_AMD_WORKAROUND (1 << 17)	/* AMD-specific workaround */
 #define AZX_DCAPS_NO_64BIT	(1 << 18)	/* No 64bit address */
 #define AZX_DCAPS_SYNC_WRITE	(1 << 19)	/* sync each cmd write */
 #define AZX_DCAPS_OLD_SSYNC	(1 << 20)	/* Old SSYNC reg for ICH */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 308ce76149cca..81cea34aff1c6 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -78,6 +78,7 @@ enum {
 	POS_FIX_VIACOMBO,
 	POS_FIX_COMBO,
 	POS_FIX_SKL,
+	POS_FIX_FIFO,
 };
 
 /* Defines for ATI HD Audio support in SB450 south bridge */
@@ -149,7 +150,7 @@ module_param_array(model, charp, NULL, 0444);
 MODULE_PARM_DESC(model, "Use the given board model.");
 module_param_array(position_fix, int, NULL, 0444);
 MODULE_PARM_DESC(position_fix, "DMA pointer read method."
-		 "(-1 = system default, 0 = auto, 1 = LPIB, 2 = POSBUF, 3 = VIACOMBO, 4 = COMBO, 5 = SKL+).");
+		 "(-1 = system default, 0 = auto, 1 = LPIB, 2 = POSBUF, 3 = VIACOMBO, 4 = COMBO, 5 = SKL+, 6 = FIFO).");
 module_param_array(bdl_pos_adj, int, NULL, 0644);
 MODULE_PARM_DESC(bdl_pos_adj, "BDL position adjustment offset.");
 module_param_array(probe_mask, int, NULL, 0444);
@@ -350,6 +351,11 @@ enum {
 #define AZX_DCAPS_PRESET_ATI_HDMI_NS \
 	(AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)
 
+/* quirks for AMD SB */
+#define AZX_DCAPS_PRESET_AMD_SB \
+	(AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_AMD_WORKAROUND |\
+	 AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME)
+
 /* quirks for Nvidia */
 #define AZX_DCAPS_PRESET_NVIDIA \
 	(AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\
@@ -920,6 +926,49 @@ static unsigned int azx_via_get_position(struct azx *chip,
 	return bound_pos + mod_dma_pos;
 }
 
+#define AMD_FIFO_SIZE	32
+
+/* get the current DMA position with FIFO size correction */
+static unsigned int azx_get_pos_fifo(struct azx *chip, struct azx_dev *azx_dev)
+{
+	struct snd_pcm_substream *substream = azx_dev->core.substream;
+	struct snd_pcm_runtime *runtime = substream->runtime;
+	unsigned int pos, delay;
+
+	pos = snd_hdac_stream_get_pos_lpib(azx_stream(azx_dev));
+	if (!runtime)
+		return pos;
+
+	runtime->delay = AMD_FIFO_SIZE;
+	delay = frames_to_bytes(runtime, AMD_FIFO_SIZE);
+	if (azx_dev->insufficient) {
+		if (pos < delay) {
+			delay = pos;
+			runtime->delay = bytes_to_frames(runtime, pos);
+		} else {
+			azx_dev->insufficient = 0;
+		}
+	}
+
+	/* correct the DMA position for capture stream */
+	if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
+		if (pos < delay)
+			pos += azx_dev->core.bufsize;
+		pos -= delay;
+	}
+
+	return pos;
+}
+
+static int azx_get_delay_from_fifo(struct azx *chip, struct azx_dev *azx_dev,
+				   unsigned int pos)
+{
+	struct snd_pcm_substream *substream = azx_dev->core.substream;
+
+	/* just read back the calculated value in the above */
+	return substream->runtime->delay;
+}
+
 static unsigned int azx_skl_get_dpib_pos(struct azx *chip,
 					 struct azx_dev *azx_dev)
 {
@@ -1528,6 +1577,7 @@ static int check_position_fix(struct azx *chip, int fix)
 	case POS_FIX_VIACOMBO:
 	case POS_FIX_COMBO:
 	case POS_FIX_SKL:
+	case POS_FIX_FIFO:
 		return fix;
 	}
 
@@ -1544,6 +1594,10 @@ static int check_position_fix(struct azx *chip, int fix)
 		dev_dbg(chip->card->dev, "Using VIACOMBO position fix\n");
 		return POS_FIX_VIACOMBO;
 	}
+	if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND) {
+		dev_dbg(chip->card->dev, "Using FIFO position fix\n");
+		return POS_FIX_FIFO;
+	}
 	if (chip->driver_caps & AZX_DCAPS_POSFIX_LPIB) {
 		dev_dbg(chip->card->dev, "Using LPIB position fix\n");
 		return POS_FIX_LPIB;
@@ -1564,6 +1618,7 @@ static void assign_position_fix(struct azx *chip, int fix)
 		[POS_FIX_VIACOMBO] = azx_via_get_position,
 		[POS_FIX_COMBO] = azx_get_pos_lpib,
 		[POS_FIX_SKL] = azx_get_pos_skl,
+		[POS_FIX_FIFO] = azx_get_pos_fifo,
 	};
 
 	chip->get_position[0] = chip->get_position[1] = callbacks[fix];
@@ -1578,6 +1633,9 @@ static void assign_position_fix(struct azx *chip, int fix)
 			azx_get_delay_from_lpib;
 	}
 
+	if (fix == POS_FIX_FIFO)
+		chip->get_delay[0] = chip->get_delay[1] =
+			azx_get_delay_from_fifo;
 }
 
 /*
@@ -2594,6 +2652,9 @@ static const struct pci_device_id azx_ids[] = {
 	/* AMD Hudson */
 	{ PCI_DEVICE(0x1022, 0x780d),
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+	/* AMD, X370 & co */
+	{ PCI_DEVICE(0x1022, 0x1457),
+	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
 	/* AMD Stoney */
 	{ PCI_DEVICE(0x1022, 0x157a),
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
-- 
GitLab


From a566750c3a78b0dc78c328a88ded49db4f7876ea Mon Sep 17 00:00:00 2001
From: Brian Norris <briannorris@chromium.org>
Date: Fri, 26 Jul 2019 15:47:58 -0700
Subject: [PATCH 1508/1835] mac80211: don't WARN on short WMM parameters from
 AP

commit 05aaa5c97dce4c10a9e7eae2f1569a684e0c5ced upstream.

In a very similar spirit to commit c470bdc1aaf3 ("mac80211: don't WARN
on bad WMM parameters from buggy APs"), an AP may not transmit a
fully-formed WMM IE. For example, it may miss or repeat an Access
Category. The above loop won't catch that and will instead leave one of
the four ACs zeroed out. This triggers the following warning in
drv_conf_tx()

  wlan0: invalid CW_min/CW_max: 0/0

and it may leave one of the hardware queues unconfigured. If we detect
such a case, let's just print a warning and fall back to the defaults.

Tested with a hacked version of hostapd, intentionally corrupting the
IEs in hostapd_eid_wmm().

Cc: stable@vger.kernel.org
Signed-off-by: Brian Norris <briannorris@chromium.org>
Link: https://lore.kernel.org/r/20190726224758.210953-1-briannorris@chromium.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/mlme.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 1aaa73fa308e6..b5c06242a92e5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1967,6 +1967,16 @@ ieee80211_sta_wmm_params(struct ieee80211_local *local,
 		ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
 	}
 
+	/* WMM specification requires all 4 ACIs. */
+	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+		if (params[ac].cw_min == 0) {
+			sdata_info(sdata,
+				   "AP has invalid WMM params (missing AC %d), using defaults\n",
+				   ac);
+			return false;
+		}
+	}
+
 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 		mlme_dbg(sdata,
 			 "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
-- 
GitLab


From 2afa6c13e498f4e082e4b6afc09b3e12e4152f1f Mon Sep 17 00:00:00 2001
From: Vivek Goyal <vgoyal@redhat.com>
Date: Fri, 2 Aug 2019 15:29:56 -0400
Subject: [PATCH 1509/1835] dax: dax_layout_busy_page() should not unmap cow
 pages

commit d75996dd022b6d83bd14af59b2775b1aa639e4b9 upstream.

Vivek:

    "As of now dax_layout_busy_page() calls unmap_mapping_range() with last
     argument as 1, which says even unmap cow pages. I am wondering who needs
     to get rid of cow pages as well.

     I noticed one interesting side affect of this. I mount xfs with -o dax and
     mmaped a file with MAP_PRIVATE and wrote some data to a page which created
     cow page. Then I called fallocate() on that file to zero a page of file.
     fallocate() called dax_layout_busy_page() which unmapped cow pages as well
     and then I tried to read back the data I wrote and what I get is old
     data from persistent memory. I lost the data I had written. This
     read basically resulted in new fault and read back the data from
     persistent memory.

     This sounds wrong. Are there any users which need to unmap cow pages
     as well? If not, I am proposing changing it to not unmap cow pages.

     I noticed this while while writing virtio_fs code where when I tried
     to reclaim a memory range and that corrupted the executable and I
     was running from virtio-fs and program got segment violation."

Dan:

    "In fact the unmap_mapping_range() in this path is only to synchronize
     against get_user_pages_fast() and force it to call back into the
     filesystem to re-establish the mapping. COW pages should be left
     untouched by dax_layout_busy_page()."

Cc: <stable@vger.kernel.org>
Fixes: 5fac7408d828 ("mm, fs, dax: handle layout changes to pinned dax mappings")
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Link: https://lore.kernel.org/r/20190802192956.GA3032@redhat.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/dax.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dax.c b/fs/dax.c
index 75a289c31c7e5..f0d932fa39c20 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -659,7 +659,7 @@ struct page *dax_layout_busy_page(struct address_space *mapping)
 	 * guaranteed to either see new references or prevent new
 	 * references from being established.
 	 */
-	unmap_mapping_range(mapping, 0, 0, 1);
+	unmap_mapping_range(mapping, 0, 0, 0);
 
 	while (index < end && pagevec_lookup_entries(&pvec, mapping, index,
 				min(end - index, (pgoff_t)PAGEVEC_SIZE),
-- 
GitLab


From 50831f1a2f570eb7007c60519f21652342f1d07c Mon Sep 17 00:00:00 2001
From: Pavel Shilovsky <pshilov@microsoft.com>
Date: Mon, 22 Jul 2019 11:34:59 -0700
Subject: [PATCH 1510/1835] SMB3: Fix deadlock in validate negotiate hits
 reconnect

commit e99c63e4d86d3a94818693147b469fa70de6f945 upstream.

Currently we skip SMB2_TREE_CONNECT command when checking during
reconnect because Tree Connect happens when establishing
an SMB session. For SMB 3.0 protocol version the code also calls
validate negotiate which results in SMB2_IOCL command being sent
over the wire. This may deadlock on trying to acquire a mutex when
checking for reconnect. Fix this by skipping SMB2_IOCL command
when doing the reconnect check.

Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/smb2pdu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index c181f1621e1af..55502bb6dee81 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -168,7 +168,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
 	if (tcon == NULL)
 		return 0;
 
-	if (smb2_command == SMB2_TREE_CONNECT)
+	if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL)
 		return 0;
 
 	if (tcon->tidStatus == CifsExiting) {
-- 
GitLab


From 898c19f1b4c8b9429dee99e3fdbc2cfa2464eb60 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Thu, 25 Jul 2019 18:13:10 -0500
Subject: [PATCH 1511/1835] smb3: send CAP_DFS capability during session setup

commit 8d33096a460d5b9bd13300f01615df5bb454db10 upstream.

We had a report of a server which did not do a DFS referral
because the session setup Capabilities field was set to 0
(unlike negotiate protocol where we set CAP_DFS).  Better to
send it session setup in the capabilities as well (this also
more closely matches Windows client behavior).

Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/smb2pdu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 55502bb6dee81..2bc47eb6215e2 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1006,7 +1006,12 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
 	else
 		req->SecurityMode = 0;
 
+#ifdef CONFIG_CIFS_DFS_UPCALL
+	req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS);
+#else
 	req->Capabilities = 0;
+#endif /* DFS_UPCALL */
+
 	req->Channel = 0; /* MBZ */
 
 	sess_data->iov[0].iov_base = (char *)req;
-- 
GitLab


From d1489f0b4de73a06f10d3cc9c7dddc5f89784abb Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sat, 3 Aug 2019 10:28:18 -0400
Subject: [PATCH 1512/1835] NFSv4: Fix an Oops in nfs4_do_setattr

commit 09a54f0ebfe263bc27c90bbd80187b9a93283887 upstream.

If the user specifies an open mode of 3, then we don't have a NFSv4 state
attached to the context, and so we Oops when we try to dereference it.

Reported-by: Olga Kornievskaia <aglo@umich.edu>
Fixes: 29b59f9416937 ("NFSv4: change nfs4_do_setattr to take...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: stable@vger.kernel.org # v4.10: 991eedb1371dc: NFSv4: Only pass the...
Cc: stable@vger.kernel.org # v4.10+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4proc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 904e08bbb2892..31ae3bd5d9d20 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3133,7 +3133,7 @@ static int _nfs4_do_setattr(struct inode *inode,
 
 	if (nfs4_copy_delegation_stateid(inode, FMODE_WRITE, &arg->stateid, &delegation_cred)) {
 		/* Use that stateid */
-	} else if (ctx != NULL) {
+	} else if (ctx != NULL && ctx->state) {
 		struct nfs_lock_context *l_ctx;
 		if (!nfs4_valid_open_stateid(ctx->state))
 			return -EBADF;
-- 
GitLab


From 2bc73d91411423dd7092596f9c0f91d3ea5a9e26 Mon Sep 17 00:00:00 2001
From: Wanpeng Li <wanpengli@tencent.com>
Date: Mon, 5 Aug 2019 10:03:19 +0800
Subject: [PATCH 1513/1835] KVM: Fix leak vCPU's VMCS value into other pCPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 17e433b54393a6269acbcb792da97791fe1592d8 upstream.

After commit d73eb57b80b (KVM: Boost vCPUs that are delivering interrupts), a
five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs
on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting
in the VMs after stress testing:

 INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073)
 Call Trace:
   flush_tlb_mm_range+0x68/0x140
   tlb_flush_mmu.part.75+0x37/0xe0
   tlb_finish_mmu+0x55/0x60
   zap_page_range+0x142/0x190
   SyS_madvise+0x3cd/0x9c0
   system_call_fastpath+0x1c/0x21

swait_active() sustains to be true before finish_swait() is called in
kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account
by kvm_vcpu_on_spin() loop greatly increases the probability condition
kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv
is enabled the yield-candidate vCPU's VMCS RVI field leaks(by
vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current
VMCS.

This patch fixes it by checking conservatively a subset of events.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Marc Zyngier <Marc.Zyngier@arm.com>
Cc: stable@vger.kernel.org
Fixes: 98f4a1467 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop)
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/powerpc.c      |  5 +++++
 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/kvm/svm.c              |  6 ++++++
 arch/x86/kvm/vmx.c              |  6 ++++++
 arch/x86/kvm/x86.c              | 16 ++++++++++++++++
 include/linux/kvm_host.h        |  1 +
 virt/kvm/kvm_main.c             | 25 ++++++++++++++++++++++++-
 7 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 578174a33d229..51cd66dc1bb09 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -61,6 +61,11 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
 	return !!(v->arch.pending_exceptions) || kvm_request_pending(v);
 }
 
+bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
+{
+	return kvm_arch_vcpu_runnable(vcpu);
+}
+
 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
 {
 	return false;
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 2877e1fbadd86..3245b95ad2d97 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1113,6 +1113,7 @@ struct kvm_x86_ops {
 	int (*update_pi_irte)(struct kvm *kvm, unsigned int host_irq,
 			      uint32_t guest_irq, bool set);
 	void (*apicv_post_state_restore)(struct kvm_vcpu *vcpu);
+	bool (*dy_apicv_has_pending_interrupt)(struct kvm_vcpu *vcpu);
 
 	int (*set_hv_timer)(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc);
 	void (*cancel_hv_timer)(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index ea454d3f7763f..0f33f00aa4dfe 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -5146,6 +5146,11 @@ static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
 		kvm_vcpu_wake_up(vcpu);
 }
 
+static bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
+{
+	return false;
+}
+
 static void svm_ir_list_del(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
 {
 	unsigned long flags;
@@ -7203,6 +7208,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
 
 	.pmu_ops = &amd_pmu_ops,
 	.deliver_posted_interrupt = svm_deliver_avic_intr,
+	.dy_apicv_has_pending_interrupt = svm_dy_apicv_has_pending_interrupt,
 	.update_pi_irte = svm_update_pi_irte,
 	.setup_mce = svm_setup_mce,
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4cf16378dffe7..2e310ea62d609 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10411,6 +10411,11 @@ static u8 vmx_has_apicv_interrupt(struct kvm_vcpu *vcpu)
 	return ((rvi & 0xf0) > (vppr & 0xf0));
 }
 
+static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
+{
+	return pi_test_on(vcpu_to_pi_desc(vcpu));
+}
+
 static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 {
 	if (!kvm_vcpu_apicv_active(vcpu))
@@ -14387,6 +14392,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
 	.guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
 	.sync_pir_to_irr = vmx_sync_pir_to_irr,
 	.deliver_posted_interrupt = vmx_deliver_posted_interrupt,
+	.dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
 
 	.set_tss_addr = vmx_set_tss_addr,
 	.set_identity_map_addr = vmx_set_identity_map_addr,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index cea6568667c42..e10a7a42449b3 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -9336,6 +9336,22 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
 	return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);
 }
 
+bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
+{
+	if (READ_ONCE(vcpu->arch.pv.pv_unhalted))
+		return true;
+
+	if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
+		kvm_test_request(KVM_REQ_SMI, vcpu) ||
+		 kvm_test_request(KVM_REQ_EVENT, vcpu))
+		return true;
+
+	if (vcpu->arch.apicv_active && kvm_x86_ops->dy_apicv_has_pending_interrupt(vcpu))
+		return true;
+
+	return false;
+}
+
 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
 {
 	return vcpu->arch.preempted_in_kernel;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 30efb36638923..d42a36e4e6c24 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -818,6 +818,7 @@ void kvm_arch_check_processor_compat(void *rtn);
 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu);
 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu);
 int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu);
+bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu);
 
 #ifndef __KVM_HAVE_ARCH_VM_ALLOC
 /*
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 2b36a51afb576..4a584a5752216 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2317,6 +2317,29 @@ static bool kvm_vcpu_eligible_for_directed_yield(struct kvm_vcpu *vcpu)
 #endif
 }
 
+/*
+ * Unlike kvm_arch_vcpu_runnable, this function is called outside
+ * a vcpu_load/vcpu_put pair.  However, for most architectures
+ * kvm_arch_vcpu_runnable does not require vcpu_load.
+ */
+bool __weak kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
+{
+	return kvm_arch_vcpu_runnable(vcpu);
+}
+
+static bool vcpu_dy_runnable(struct kvm_vcpu *vcpu)
+{
+	if (kvm_arch_dy_runnable(vcpu))
+		return true;
+
+#ifdef CONFIG_KVM_ASYNC_PF
+	if (!list_empty_careful(&vcpu->async_pf.done))
+		return true;
+#endif
+
+	return false;
+}
+
 void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
 {
 	struct kvm *kvm = me->kvm;
@@ -2346,7 +2369,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
 				continue;
 			if (vcpu == me)
 				continue;
-			if (swait_active(&vcpu->wq) && !kvm_arch_vcpu_runnable(vcpu))
+			if (swait_active(&vcpu->wq) && !vcpu_dy_runnable(vcpu))
 				continue;
 			if (yield_to_kernel_mode && !kvm_arch_vcpu_in_kernel(vcpu))
 				continue;
-- 
GitLab


From b38c56b76dcce71e8885190d13bb49979fcb6127 Mon Sep 17 00:00:00 2001
From: Brian Norris <briannorris@chromium.org>
Date: Wed, 24 Jul 2019 12:46:34 -0700
Subject: [PATCH 1514/1835] mwifiex: fix 802.11n/WPA detection

commit df612421fe2566654047769c6852ffae1a31df16 upstream.

Commit 63d7ef36103d ("mwifiex: Don't abort on small, spec-compliant
vendor IEs") adjusted the ieee_types_vendor_header struct, which
inadvertently messed up the offsets used in
mwifiex_is_wpa_oui_present(). Add that offset back in, mirroring
mwifiex_is_rsn_oui_present().

As it stands, commit 63d7ef36103d breaks compatibility with WPA (not
WPA2) 802.11n networks, since we hit the "info: Disable 11n if AES is
not supported by AP" case in mwifiex_is_network_compatible().

Fixes: 63d7ef36103d ("mwifiex: Don't abort on small, spec-compliant vendor IEs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/marvell/mwifiex/main.h | 1 +
 drivers/net/wireless/marvell/mwifiex/scan.c | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h
index b025ba1644128..e39bb5c42c9a5 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.h
+++ b/drivers/net/wireless/marvell/mwifiex/main.h
@@ -124,6 +124,7 @@ enum {
 
 #define MWIFIEX_MAX_TOTAL_SCAN_TIME	(MWIFIEX_TIMER_10S - MWIFIEX_TIMER_1S)
 
+#define WPA_GTK_OUI_OFFSET				2
 #define RSN_GTK_OUI_OFFSET				2
 
 #define MWIFIEX_OUI_NOT_PRESENT			0
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 6dd771ce68a35..ed27147efcb37 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -181,7 +181,8 @@ mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
 	u8 ret = MWIFIEX_OUI_NOT_PRESENT;
 
 	if (has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)) {
-		iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data;
+		iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
+					    WPA_GTK_OUI_OFFSET);
 		oui = &mwifiex_wpa_oui[cipher][0];
 		ret = mwifiex_search_oui_in_ie(iebody, oui);
 		if (ret)
-- 
GitLab


From 7626b510fc77c6828a1989fd3d032597f934d347 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Sun, 21 Jul 2019 14:02:27 +0300
Subject: [PATCH 1515/1835] iwlwifi: don't unmap as page memory that was mapped
 as single

commit 87e7e25aee6b59fef740856f4e86d4b60496c9e1 upstream.

In order to remember how to unmap a memory (as single or
as page), we maintain a bit per Transmit Buffer (TBs) in
the meta data (structure iwl_cmd_meta).
We maintain a bitmap: 1 bit per TB.
If the TB is set, we will free the memory as a page.
This bitmap was never cleared. Fix this.

Cc: stable@vger.kernel.org
Fixes: 3cd1980b0cdf ("iwlwifi: pcie: introduce new tfd and tb formats")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 93f0d387688a1..42fdb7970cfdc 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -403,6 +403,8 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
 					 DMA_TO_DEVICE);
 	}
 
+	meta->tbs = 0;
+
 	if (trans->cfg->use_tfh) {
 		struct iwl_tfh_tfd *tfd_fh = (void *)tfd;
 
-- 
GitLab


From 80bac45e3ad88e026bbb80c4bd9c49fc50418003 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Mon, 22 Jul 2019 12:47:27 +0300
Subject: [PATCH 1516/1835] iwlwifi: mvm: fix an out-of-bound access

commit ba3224db78034435e9ff0247277cce7c7bb1756c upstream.

The index for the elements of the ACPI object we dereference
was static. This means that if we called the function twice
we wouldn't start from 3 again, but rather from the latest
index we reached in the previous call.
This was dutifully reported by KASAN.

Fix this.

Cc: stable@vger.kernel.org
Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 8b7d70e3a3793..83d8f121171fa 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -724,7 +724,7 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
 
 	for (i = 0; i < n_profiles; i++) {
 		/* the tables start at element 3 */
-		static int pos = 3;
+		int pos = 3;
 
 		/* The EWRD profiles officially go from 2 to 4, but we
 		 * save them in sar_profiles[1-3] (because we don't
-- 
GitLab


From 6a81677a2e653af3dbe71f007d7fb86562fd0db8 Mon Sep 17 00:00:00 2001
From: Luca Coelho <luciano.coelho@intel.com>
Date: Mon, 24 Jun 2019 22:29:33 +0300
Subject: [PATCH 1517/1835] iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT on
 version < 41

commit 39bd984c203e86f3109b49c2a2e20677c4d3ab65 upstream.

Firmware versions before 41 don't support the GEO_TX_POWER_LIMIT
command, and sending it to the firmware will cause a firmware crash.
We allow this via debugfs, so we need to return an error value in case
it's not supported.

This had already been fixed during init, when we send the command if
the ACPI WGDS table is present.  Fix it also for the other,
userspace-triggered case.

Cc: stable@vger.kernel.org
Fixes: 7fe90e0e3d60 ("iwlwifi: mvm: refactor geo init")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 22 ++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 83d8f121171fa..0369378bf07b5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -836,6 +836,17 @@ int iwl_mvm_sar_select_profile(struct iwl_mvm *mvm, int prof_a, int prof_b)
 	return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
 }
 
+static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
+{
+	/*
+	 * The GEO_TX_POWER_LIMIT command is not supported on earlier
+	 * firmware versions.  Unfortunately, we don't have a TLV API
+	 * flag to rely on, so rely on the major version which is in
+	 * the first byte of ucode_ver.
+	 */
+	return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 41;
+}
+
 int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
 {
 	struct iwl_geo_tx_power_profiles_resp *resp;
@@ -851,6 +862,9 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
 		.data = { &geo_cmd },
 	};
 
+	if (!iwl_mvm_sar_geo_support(mvm))
+		return -EOPNOTSUPP;
+
 	ret = iwl_mvm_send_cmd(mvm, &cmd);
 	if (ret) {
 		IWL_ERR(mvm, "Failed to get geographic profile info %d\n", ret);
@@ -876,13 +890,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
 	int ret, i, j;
 	u16 cmd_wide_id =  WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
 
-	/*
-	 * This command is not supported on earlier firmware versions.
-	 * Unfortunately, we don't have a TLV API flag to rely on, so
-	 * rely on the major version which is in the first byte of
-	 * ucode_ver.
-	 */
-	if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
+	if (!iwl_mvm_sar_geo_support(mvm))
 		return 0;
 
 	ret = iwl_mvm_sar_get_wgds_table(mvm);
-- 
GitLab


From ac2951114955cc36f21108e8cd3dfaf6c9026f62 Mon Sep 17 00:00:00 2001
From: Luca Coelho <luciano.coelho@intel.com>
Date: Fri, 19 Jul 2019 12:21:59 +0300
Subject: [PATCH 1518/1835] iwlwifi: mvm: fix version check for
 GEO_TX_POWER_LIMIT support

commit f5a47fae6aa3eb06f100e701d2342ee56b857bee upstream.

We erroneously added a check for FW API version 41 before sending
GEO_TX_POWER_LIMIT, but this was already implemented in version 38.
Additionally, it was cherry-picked to older versions, namely 17, 26
and 29, so check for those as well.

Cc: stable@vger.kernel.org
Fixes: eca1e56ceedd ("iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 0369378bf07b5..3fe7605a2cca4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -842,9 +842,14 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
 	 * The GEO_TX_POWER_LIMIT command is not supported on earlier
 	 * firmware versions.  Unfortunately, we don't have a TLV API
 	 * flag to rely on, so rely on the major version which is in
-	 * the first byte of ucode_ver.
+	 * the first byte of ucode_ver.  This was implemented
+	 * initially on version 38 and then backported to 36, 29 and
+	 * 17.
 	 */
-	return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 41;
+	return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
+	       IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 36 ||
+	       IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
+	       IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
 }
 
 int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
-- 
GitLab


From a5aa80588fcd5520ece36121c41b7d8e72245e33 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 16 Aug 2019 10:12:54 +0200
Subject: [PATCH 1519/1835] Linux 4.19.67

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 065e5b34dc02c..b6aa6e8d4411f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 66
+SUBLEVEL = 67
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 73a743bcf8618982afab993a25cc36df0d9d9ae4 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Sat, 17 Aug 2019 19:47:30 +0100
Subject: [PATCH 1520/1835] overlays: sc16ic752-i2c: Fix xtal parameter

The xtal parameter is targetting the wrong node - fix it.

See: https://github.com/raspberrypi/linux/issues/3156

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
index 355eaac656c8c..57ae35c384425 100644
--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
@@ -35,6 +35,6 @@
 	__overrides__ {
 		int_pin = <&sc16is752>,"interrupts:0";
 		addr = <&sc16is752>,"reg:0",<&sc16is752_clk>,"name";
-		xtal = <&sc16is752>,"clock-frequency:0";
+		xtal = <&sc16is752_clk>,"clock-frequency:0";
 	};
 };
-- 
GitLab


From 7ee8d72eeb56b85aaad25f368b486cc335224882 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Mon, 19 Aug 2019 15:45:20 +0100
Subject: [PATCH 1521/1835] vc-sm-cma: Fix compatibility ioctl

This code path hasn't been used previously.
Fixed up after testing with kodi on 32-bit userland and 64-bit kernel

Signed-off-by: popcornmix <popcornmix@gmail.com>
---
 drivers/staging/vc04_services/vc-sm-cma/vc_sm.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 1b5bb68b9bcd6..caaa52cd03f8d 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -1501,11 +1501,10 @@ static long vc_sm_cma_ioctl(struct file *file, unsigned int cmd,
 	return ret;
 }
 
-#ifndef CONFIG_ARM64
 #ifdef CONFIG_COMPAT
 struct vc_sm_cma_ioctl_clean_invalid2_32 {
 	u32 op_count;
-	struct vc_sm_cma_ioctl_clean_invalid_block {
+	struct vc_sm_cma_ioctl_clean_invalid_block_32 {
 		u16 invalidate_mode;
 		u16 block_count;
 		compat_uptr_t start_address;
@@ -1516,7 +1515,7 @@ struct vc_sm_cma_ioctl_clean_invalid2_32 {
 
 #define VC_SM_CMA_CMD_CLEAN_INVALID2_32\
 	_IOR(VC_SM_CMA_MAGIC_TYPE, VC_SM_CMA_CMD_CLEAN_INVALID2,\
-	 struct vc_sm_cma_ioctl_clean_invalid2)
+	 struct vc_sm_cma_ioctl_clean_invalid2_32)
 
 static long vc_sm_cma_compat_ioctl(struct file *file, unsigned int cmd,
 				   unsigned long arg)
@@ -1524,23 +1523,20 @@ static long vc_sm_cma_compat_ioctl(struct file *file, unsigned int cmd,
 	switch (cmd) {
 	case VC_SM_CMA_CMD_CLEAN_INVALID2_32:
 		/* FIXME */
-		break;
+		return -EINVAL;
 
 	default:
-		return vc_sm_cma_compat_ioctl(file, cmd, arg);
+		return vc_sm_cma_ioctl(file, cmd, arg);
 	}
 }
 #endif
-#endif
 
 /* Device operations that we managed in this driver. */
 static const struct file_operations vc_sm_ops = {
 	.owner = THIS_MODULE,
 	.unlocked_ioctl = vc_sm_cma_ioctl,
-#ifndef CONFIG_ARM64
 #ifdef CONFIG_COMPAT
 	.compat_ioctl = vc_sm_cma_compat_ioctl,
-#endif
 #endif
 	.open = vc_sm_cma_open,
 	.release = vc_sm_cma_release,
-- 
GitLab


From 9798c94b34db4a32707f7f501616dbcbd088a696 Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Thu, 22 Aug 2019 17:20:58 +0100
Subject: [PATCH 1522/1835] configs: Add TINYDRM modules

---
 arch/arm/configs/bcm2709_defconfig | 4 ++++
 arch/arm/configs/bcm2711_defconfig | 4 ++++
 arch/arm/configs/bcmrpi_defconfig  | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 2fe8c2f47f04a..9e909da129936 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -924,8 +924,12 @@ CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_ILI9225=m
+CONFIG_TINYDRM_ILI9341=m
 CONFIG_TINYDRM_MI0283QT=m
 CONFIG_TINYDRM_REPAPER=m
+CONFIG_TINYDRM_ST7586=m
+CONFIG_TINYDRM_ST7735R=m
 CONFIG_FB=y
 CONFIG_FB_BCM2708=y
 CONFIG_FB_UDL=m
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index f2bf634347def..cea778ba68564 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -935,8 +935,12 @@ CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
 CONFIG_DRM_V3D=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_ILI9225=m
+CONFIG_TINYDRM_ILI9341=m
 CONFIG_TINYDRM_MI0283QT=m
 CONFIG_TINYDRM_REPAPER=m
+CONFIG_TINYDRM_ST7586=m
+CONFIG_TINYDRM_ST7735R=m
 CONFIG_FB=y
 CONFIG_FB_BCM2708=y
 CONFIG_FB_UDL=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index c4867727fedf7..aff78029b95f5 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -916,8 +916,12 @@ CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
 CONFIG_DRM_VC4=m
 CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_ILI9225=m
+CONFIG_TINYDRM_ILI9341=m
 CONFIG_TINYDRM_MI0283QT=m
 CONFIG_TINYDRM_REPAPER=m
+CONFIG_TINYDRM_ST7586=m
+CONFIG_TINYDRM_ST7735R=m
 CONFIG_FB=y
 CONFIG_FB_BCM2708=y
 CONFIG_FB_UDL=m
-- 
GitLab


From 174fcab91765ef8fe3562c9858fb62f1a471c2d6 Mon Sep 17 00:00:00 2001
From: Aman Gupta <aman@tmm1.net>
Date: Thu, 22 Aug 2019 22:31:37 +0000
Subject: [PATCH 1523/1835] staging: bcm2835-codec: add support for
 V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME

fixes #3171

Signed-off-by: Aman Gupta <aman@tmm1.net>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 66edec1197ea4..6ef7b16374953 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -1587,6 +1587,20 @@ static int bcm2835_codec_s_ctrl(struct v4l2_ctrl *ctrl)
 		ret = bcm2835_codec_set_level_profile(ctx, ctrl);
 		break;
 
+	case V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME: {
+		u32 mmal_bool = 1;
+
+		if (!ctx->component)
+			break;
+
+		ret = vchiq_mmal_port_parameter_set(ctx->dev->instance,
+						    &ctx->component->output[0],
+						    MMAL_PARAMETER_VIDEO_REQUEST_I_FRAME,
+						    &mmal_bool,
+						    sizeof(mmal_bool));
+		break;
+	}
+
 	default:
 		v4l2_err(&ctx->dev->v4l2_dev, "Invalid control\n");
 		return -EINVAL;
@@ -2311,7 +2325,7 @@ static int bcm2835_codec_open(struct file *file)
 	hdl = &ctx->hdl;
 	if (dev->role == ENCODE) {
 		/* Encode controls */
-		v4l2_ctrl_handler_init(hdl, 6);
+		v4l2_ctrl_handler_init(hdl, 7);
 
 		v4l2_ctrl_new_std_menu(hdl, &bcm2835_codec_ctrl_ops,
 				       V4L2_CID_MPEG_VIDEO_BITRATE_MODE,
@@ -2355,6 +2369,9 @@ static int bcm2835_codec_open(struct file *file)
 					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
 					 BIT(V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
 					V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
+		v4l2_ctrl_new_std(hdl, &bcm2835_codec_ctrl_ops,
+				  V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME,
+				  0, 0, 0, 0);
 		if (hdl->error) {
 			rc = hdl->error;
 			goto free_ctrl_handler;
-- 
GitLab


From 50d15197254a1efb0374fc1da2a0b98c78da49b3 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Date: Fri, 9 Aug 2019 23:43:56 -0500
Subject: [PATCH 1524/1835] sh: kernel: hw_breakpoint: Fix missing break in
 switch statement

commit 1ee1119d184bb06af921b48c3021d921bbd85bac upstream.

Add missing break statement in order to prevent the code from falling
through to case SH_BREAKPOINT_WRITE.

Fixes: 09a072947791 ("sh: hw-breakpoints: Add preliminary support for SH-4A UBC.")
Cc: stable@vger.kernel.org
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sh/kernel/hw_breakpoint.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/sh/kernel/hw_breakpoint.c b/arch/sh/kernel/hw_breakpoint.c
index d9ff3b42da7cb..2569ffc061f9c 100644
--- a/arch/sh/kernel/hw_breakpoint.c
+++ b/arch/sh/kernel/hw_breakpoint.c
@@ -160,6 +160,7 @@ int arch_bp_generic_fields(int sh_len, int sh_type,
 	switch (sh_type) {
 	case SH_BREAKPOINT_READ:
 		*gen_type = HW_BREAKPOINT_R;
+		break;
 	case SH_BREAKPOINT_WRITE:
 		*gen_type = HW_BREAKPOINT_W;
 		break;
-- 
GitLab


From 3858cca150c69ea8dbc1f1b03fd444d99fb747b7 Mon Sep 17 00:00:00 2001
From: NeilBrown <neilb@suse.com>
Date: Tue, 13 Aug 2019 15:37:44 -0700
Subject: [PATCH 1525/1835] seq_file: fix problem when seeking mid-record

commit 6a2aeab59e97101b4001bac84388fc49a992f87e upstream.

If you use lseek or similar (e.g.  pread) to access a location in a
seq_file file that is within a record, rather than at a record boundary,
then the first read will return the remainder of the record, and the
second read will return the whole of that same record (instead of the
next record).  When seeking to a record boundary, the next record is
correctly returned.

This bug was introduced by a recent patch (identified below).  Before
that patch, seq_read() would increment m->index when the last of the
buffer was returned (m->count == 0).  After that patch, we rely on
->next to increment m->index after filling the buffer - but there was
one place where that didn't happen.

Link: https://lkml.kernel.org/lkml/877e7xl029.fsf@notabene.neil.brown.name/
Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and interface")
Signed-off-by: NeilBrown <neilb@suse.com>
Reported-by: Sergei Turchanov <turchanov@farpost.com>
Tested-by: Sergei Turchanov <turchanov@farpost.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Markus Elfring <Markus.Elfring@web.de>
Cc: <stable@vger.kernel.org>	[4.19+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/seq_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/seq_file.c b/fs/seq_file.c
index 1dea7a8a52550..05e58b56f6202 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -119,6 +119,7 @@ static int traverse(struct seq_file *m, loff_t offset)
 		}
 		if (seq_has_overflowed(m))
 			goto Eoverflow;
+		p = m->op->next(m, p, &m->index);
 		if (pos + m->count > offset) {
 			m->from = offset - pos;
 			m->count -= m->from;
@@ -126,7 +127,6 @@ static int traverse(struct seq_file *m, loff_t offset)
 		}
 		pos += m->count;
 		m->count = 0;
-		p = m->op->next(m, p, &m->index);
 		if (pos == offset)
 			break;
 	}
-- 
GitLab


From f0fed8283deb13d36ff8285f4c93bd012dae554d Mon Sep 17 00:00:00 2001
From: Ralph Campbell <rcampbell@nvidia.com>
Date: Tue, 13 Aug 2019 15:37:11 -0700
Subject: [PATCH 1526/1835] mm/hmm: fix bad subpage pointer in try_to_unmap_one
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1de13ee59225dfc98d483f8cce7d83f97c0b31de upstream.

When migrating an anonymous private page to a ZONE_DEVICE private page,
the source page->mapping and page->index fields are copied to the
destination ZONE_DEVICE struct page and the page_mapcount() is
increased.  This is so rmap_walk() can be used to unmap and migrate the
page back to system memory.

However, try_to_unmap_one() computes the subpage pointer from a swap pte
which computes an invalid page pointer and a kernel panic results such
as:

  BUG: unable to handle page fault for address: ffffea1fffffffc8

Currently, only single pages can be migrated to device private memory so
no subpage computation is needed and it can be set to "page".

[rcampbell@nvidia.com: add comment]
  Link: http://lkml.kernel.org/r/20190724232700.23327-4-rcampbell@nvidia.com
Link: http://lkml.kernel.org/r/20190719192955.30462-4-rcampbell@nvidia.com
Fixes: a5430dda8a3a1c ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Cc: "Jérôme Glisse" <jglisse@redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Logan Gunthorpe <logang@deltatee.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/rmap.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mm/rmap.c b/mm/rmap.c
index f048c2651954b..1bd94ea62f7f1 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1467,7 +1467,15 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
 			/*
 			 * No need to invalidate here it will synchronize on
 			 * against the special swap migration pte.
+			 *
+			 * The assignment to subpage above was computed from a
+			 * swap PTE which results in an invalid pointer.
+			 * Since only PAGE_SIZE pages can currently be
+			 * migrated, just set it to page. This will need to be
+			 * changed when hugepage migrations to device private
+			 * memory are supported.
 			 */
+			subpage = page;
 			goto discard;
 		}
 
-- 
GitLab


From cd825d87140d00fbd4f6de6b51b801be89595b2c Mon Sep 17 00:00:00 2001
From: Yang Shi <yang.shi@linux.alibaba.com>
Date: Tue, 13 Aug 2019 15:37:15 -0700
Subject: [PATCH 1527/1835] mm: mempolicy: make the behavior consistent when
 MPOL_MF_MOVE* and MPOL_MF_STRICT were specified

commit d883544515aae54842c21730b880172e7894fde9 upstream.

When both MPOL_MF_MOVE* and MPOL_MF_STRICT was specified, mbind() should
try best to migrate misplaced pages, if some of the pages could not be
migrated, then return -EIO.

There are three different sub-cases:
 1. vma is not migratable
 2. vma is migratable, but there are unmovable pages
 3. vma is migratable, pages are movable, but migrate_pages() fails

If #1 happens, kernel would just abort immediately, then return -EIO,
after a7f40cfe3b7a ("mm: mempolicy: make mbind() return -EIO when
MPOL_MF_STRICT is specified").

If #3 happens, kernel would set policy and migrate pages with
best-effort, but won't rollback the migrated pages and reset the policy
back.

Before that commit, they behaves in the same way.  It'd better to keep
their behavior consistent.  But, rolling back the migrated pages and
resetting the policy back sounds not feasible, so just make #1 behave as
same as #3.

Userspace will know that not everything was successfully migrated (via
-EIO), and can take whatever steps it deems necessary - attempt
rollback, determine which exact page(s) are violating the policy, etc.

Make queue_pages_range() return 1 to indicate there are unmovable pages
or vma is not migratable.

The #2 is not handled correctly in the current kernel, the following
patch will fix it.

[yang.shi@linux.alibaba.com: fix review comments from Vlastimil]
  Link: http://lkml.kernel.org/r/1563556862-54056-2-git-send-email-yang.shi@linux.alibaba.com
Link: http://lkml.kernel.org/r/1561162809-59140-2-git-send-email-yang.shi@linux.alibaba.com
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/mempolicy.c | 68 +++++++++++++++++++++++++++++++++++---------------
 1 file changed, 48 insertions(+), 20 deletions(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 62f945ea3e362..a3a5229afe748 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -429,11 +429,14 @@ static inline bool queue_pages_required(struct page *page,
 }
 
 /*
- * queue_pages_pmd() has three possible return values:
- * 1 - pages are placed on the right node or queued successfully.
- * 0 - THP was split.
- * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
- *        page was already on a node that does not follow the policy.
+ * queue_pages_pmd() has four possible return values:
+ * 0 - pages are placed on the right node or queued successfully.
+ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * 2 - THP was split.
+ * -EIO - is migration entry or only MPOL_MF_STRICT was specified and an
+ *        existing page was already on a node that does not follow the
+ *        policy.
  */
 static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
 				unsigned long end, struct mm_walk *walk)
@@ -451,19 +454,17 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
 	if (is_huge_zero_page(page)) {
 		spin_unlock(ptl);
 		__split_huge_pmd(walk->vma, pmd, addr, false, NULL);
+		ret = 2;
 		goto out;
 	}
-	if (!queue_pages_required(page, qp)) {
-		ret = 1;
+	if (!queue_pages_required(page, qp))
 		goto unlock;
-	}
 
-	ret = 1;
 	flags = qp->flags;
 	/* go to thp migration */
 	if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
 		if (!vma_migratable(walk->vma)) {
-			ret = -EIO;
+			ret = 1;
 			goto unlock;
 		}
 
@@ -479,6 +480,13 @@ out:
 /*
  * Scan through pages checking if pages follow certain conditions,
  * and move them to the pagelist if they do.
+ *
+ * queue_pages_pte_range() has three possible return values:
+ * 0 - pages are placed on the right node or queued successfully.
+ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * -EIO - only MPOL_MF_STRICT was specified and an existing page was already
+ *        on a node that does not follow the policy.
  */
 static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 			unsigned long end, struct mm_walk *walk)
@@ -488,17 +496,17 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 	struct queue_pages *qp = walk->private;
 	unsigned long flags = qp->flags;
 	int ret;
+	bool has_unmovable = false;
 	pte_t *pte;
 	spinlock_t *ptl;
 
 	ptl = pmd_trans_huge_lock(pmd, vma);
 	if (ptl) {
 		ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
-		if (ret > 0)
-			return 0;
-		else if (ret < 0)
+		if (ret != 2)
 			return ret;
 	}
+	/* THP was split, fall through to pte walk */
 
 	if (pmd_trans_unstable(pmd))
 		return 0;
@@ -519,14 +527,21 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 		if (!queue_pages_required(page, qp))
 			continue;
 		if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-			if (!vma_migratable(vma))
+			/* MPOL_MF_STRICT must be specified if we get here */
+			if (!vma_migratable(vma)) {
+				has_unmovable = true;
 				break;
+			}
 			migrate_page_add(page, qp->pagelist, flags);
 		} else
 			break;
 	}
 	pte_unmap_unlock(pte - 1, ptl);
 	cond_resched();
+
+	if (has_unmovable)
+		return 1;
+
 	return addr != end ? -EIO : 0;
 }
 
@@ -639,7 +654,13 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
  *
  * If pages found in a given range are on a set of nodes (determined by
  * @nodes and @flags,) it's isolated and queued to the pagelist which is
- * passed via @private.)
+ * passed via @private.
+ *
+ * queue_pages_range() has three possible return values:
+ * 1 - there is unmovable page, but MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * 0 - queue pages successfully or no misplaced page.
+ * -EIO - there is misplaced page and only MPOL_MF_STRICT was specified.
  */
 static int
 queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
@@ -1168,6 +1189,7 @@ static long do_mbind(unsigned long start, unsigned long len,
 	struct mempolicy *new;
 	unsigned long end;
 	int err;
+	int ret;
 	LIST_HEAD(pagelist);
 
 	if (flags & ~(unsigned long)MPOL_MF_VALID)
@@ -1229,10 +1251,15 @@ static long do_mbind(unsigned long start, unsigned long len,
 	if (err)
 		goto mpol_out;
 
-	err = queue_pages_range(mm, start, end, nmask,
+	ret = queue_pages_range(mm, start, end, nmask,
 			  flags | MPOL_MF_INVERT, &pagelist);
-	if (!err)
-		err = mbind_range(mm, start, end, new);
+
+	if (ret < 0) {
+		err = -EIO;
+		goto up_out;
+	}
+
+	err = mbind_range(mm, start, end, new);
 
 	if (!err) {
 		int nr_failed = 0;
@@ -1245,13 +1272,14 @@ static long do_mbind(unsigned long start, unsigned long len,
 				putback_movable_pages(&pagelist);
 		}
 
-		if (nr_failed && (flags & MPOL_MF_STRICT))
+		if ((ret > 0) || (nr_failed && (flags & MPOL_MF_STRICT)))
 			err = -EIO;
 	} else
 		putback_movable_pages(&pagelist);
 
+up_out:
 	up_write(&mm->mmap_sem);
- mpol_out:
+mpol_out:
 	mpol_put(new);
 	return err;
 }
-- 
GitLab


From 3c0cb90e9212b746dd4fd341dcdf50124c90bd76 Mon Sep 17 00:00:00 2001
From: Yang Shi <yang.shi@linux.alibaba.com>
Date: Tue, 13 Aug 2019 15:37:18 -0700
Subject: [PATCH 1528/1835] mm: mempolicy: handle vma with unmovable pages
 mapped correctly in mbind

commit a53190a4aaa36494f4d7209fd1fcc6f2ee08e0e0 upstream.

When running syzkaller internally, we ran into the below bug on 4.9.x
kernel:

  kernel BUG at mm/huge_memory.c:2124!
  invalid opcode: 0000 [#1] SMP KASAN
  CPU: 0 PID: 1518 Comm: syz-executor107 Not tainted 4.9.168+ #2
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011
  task: ffff880067b34900 task.stack: ffff880068998000
  RIP: split_huge_page_to_list+0x8fb/0x1030 mm/huge_memory.c:2124
  Call Trace:
    split_huge_page include/linux/huge_mm.h:100 [inline]
    queue_pages_pte_range+0x7e1/0x1480 mm/mempolicy.c:538
    walk_pmd_range mm/pagewalk.c:50 [inline]
    walk_pud_range mm/pagewalk.c:90 [inline]
    walk_pgd_range mm/pagewalk.c:116 [inline]
    __walk_page_range+0x44a/0xdb0 mm/pagewalk.c:208
    walk_page_range+0x154/0x370 mm/pagewalk.c:285
    queue_pages_range+0x115/0x150 mm/mempolicy.c:694
    do_mbind mm/mempolicy.c:1241 [inline]
    SYSC_mbind+0x3c3/0x1030 mm/mempolicy.c:1370
    SyS_mbind+0x46/0x60 mm/mempolicy.c:1352
    do_syscall_64+0x1d2/0x600 arch/x86/entry/common.c:282
    entry_SYSCALL_64_after_swapgs+0x5d/0xdb
  Code: c7 80 1c 02 00 e8 26 0a 76 01 <0f> 0b 48 c7 c7 40 46 45 84 e8 4c
  RIP  [<ffffffff81895d6b>] split_huge_page_to_list+0x8fb/0x1030 mm/huge_memory.c:2124
   RSP <ffff88006899f980>

with the below test:

  uint64_t r[1] = {0xffffffffffffffff};

  int main(void)
  {
        syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
                                intptr_t res = 0;
        res = syscall(__NR_socket, 0x11, 3, 0x300);
        if (res != -1)
                r[0] = res;
        *(uint32_t*)0x20000040 = 0x10000;
        *(uint32_t*)0x20000044 = 1;
        *(uint32_t*)0x20000048 = 0xc520;
        *(uint32_t*)0x2000004c = 1;
        syscall(__NR_setsockopt, r[0], 0x107, 0xd, 0x20000040, 0x10);
        syscall(__NR_mmap, 0x20fed000, 0x10000, 0, 0x8811, r[0], 0);
        *(uint64_t*)0x20000340 = 2;
        syscall(__NR_mbind, 0x20ff9000, 0x4000, 0x4002, 0x20000340, 0x45d4, 3);
        return 0;
  }

Actually the test does:

  mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
  socket(AF_PACKET, SOCK_RAW, 768)        = 3
  setsockopt(3, SOL_PACKET, PACKET_TX_RING, {block_size=65536, block_nr=1, frame_size=50464, frame_nr=1}, 16) = 0
  mmap(0x20fed000, 65536, PROT_NONE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_DENYWRITE, 3, 0) = 0x20fed000
  mbind(..., MPOL_MF_STRICT|MPOL_MF_MOVE) = 0

The setsockopt() would allocate compound pages (16 pages in this test)
for packet tx ring, then the mmap() would call packet_mmap() to map the
pages into the user address space specified by the mmap() call.

When calling mbind(), it would scan the vma to queue the pages for
migration to the new node.  It would split any huge page since 4.9
doesn't support THP migration, however, the packet tx ring compound
pages are not THP and even not movable.  So, the above bug is triggered.

However, the later kernel is not hit by this issue due to commit
d44d363f6578 ("mm: don't assume anonymous pages have SwapBacked flag"),
which just removes the PageSwapBacked check for a different reason.

But, there is a deeper issue.  According to the semantic of mbind(), it
should return -EIO if MPOL_MF_MOVE or MPOL_MF_MOVE_ALL was specified and
MPOL_MF_STRICT was also specified, but the kernel was unable to move all
existing pages in the range.  The tx ring of the packet socket is
definitely not movable, however, mbind() returns success for this case.

Although the most socket file associates with non-movable pages, but XDP
may have movable pages from gup.  So, it sounds not fine to just check
the underlying file type of vma in vma_migratable().

Change migrate_page_add() to check if the page is movable or not, if it
is unmovable, just return -EIO.  But do not abort pte walk immediately,
since there may be pages off LRU temporarily.  We should migrate other
pages if MPOL_MF_MOVE* is specified.  Set has_unmovable flag if some
paged could not be not moved, then return -EIO for mbind() eventually.

With this change the above test would return -EIO as expected.

[yang.shi@linux.alibaba.com: fix review comments from Vlastimil]
  Link: http://lkml.kernel.org/r/1563556862-54056-3-git-send-email-yang.shi@linux.alibaba.com
Link: http://lkml.kernel.org/r/1561162809-59140-3-git-send-email-yang.shi@linux.alibaba.com
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/mempolicy.c | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index a3a5229afe748..70298b635b593 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -403,7 +403,7 @@ static const struct mempolicy_operations mpol_ops[MPOL_MAX] = {
 	},
 };
 
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
 				unsigned long flags);
 
 struct queue_pages {
@@ -463,12 +463,11 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
 	flags = qp->flags;
 	/* go to thp migration */
 	if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-		if (!vma_migratable(walk->vma)) {
+		if (!vma_migratable(walk->vma) ||
+		    migrate_page_add(page, qp->pagelist, flags)) {
 			ret = 1;
 			goto unlock;
 		}
-
-		migrate_page_add(page, qp->pagelist, flags);
 	} else
 		ret = -EIO;
 unlock:
@@ -532,7 +531,14 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 				has_unmovable = true;
 				break;
 			}
-			migrate_page_add(page, qp->pagelist, flags);
+
+			/*
+			 * Do not abort immediately since there may be
+			 * temporary off LRU pages in the range.  Still
+			 * need migrate other LRU pages.
+			 */
+			if (migrate_page_add(page, qp->pagelist, flags))
+				has_unmovable = true;
 		} else
 			break;
 	}
@@ -947,7 +953,7 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
 /*
  * page migration, thp tail pages can be passed.
  */
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
 				unsigned long flags)
 {
 	struct page *head = compound_head(page);
@@ -960,8 +966,19 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
 			mod_node_page_state(page_pgdat(head),
 				NR_ISOLATED_ANON + page_is_file_cache(head),
 				hpage_nr_pages(head));
+		} else if (flags & MPOL_MF_STRICT) {
+			/*
+			 * Non-movable page may reach here.  And, there may be
+			 * temporary off LRU pages or non-LRU movable pages.
+			 * Treat them as unmovable pages since they can't be
+			 * isolated, so they can't be moved at the moment.  It
+			 * should return -EIO for this case too.
+			 */
+			return -EIO;
 		}
 	}
+
+	return 0;
 }
 
 /* page allocation callback for NUMA node migration */
@@ -1164,9 +1181,10 @@ static struct page *new_page(struct page *page, unsigned long start)
 }
 #else
 
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
 				unsigned long flags)
 {
+	return -EIO;
 }
 
 int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
-- 
GitLab


From c8282f1b5653b192e5066551f32a3afc6c74339b Mon Sep 17 00:00:00 2001
From: Miles Chen <miles.chen@mediatek.com>
Date: Tue, 13 Aug 2019 15:37:28 -0700
Subject: [PATCH 1529/1835] mm/memcontrol.c: fix use after free in
 mem_cgroup_iter()

commit 54a83d6bcbf8f4700013766b974bf9190d40b689 upstream.

This patch is sent to report an use after free in mem_cgroup_iter()
after merging commit be2657752e9e ("mm: memcg: fix use after free in
mem_cgroup_iter()").

I work with android kernel tree (4.9 & 4.14), and commit be2657752e9e
("mm: memcg: fix use after free in mem_cgroup_iter()") has been merged
to the trees.  However, I can still observe use after free issues
addressed in the commit be2657752e9e.  (on low-end devices, a few times
this month)

backtrace:
        css_tryget <- crash here
        mem_cgroup_iter
        shrink_node
        shrink_zones
        do_try_to_free_pages
        try_to_free_pages
        __perform_reclaim
        __alloc_pages_direct_reclaim
        __alloc_pages_slowpath
        __alloc_pages_nodemask

To debug, I poisoned mem_cgroup before freeing it:

  static void __mem_cgroup_free(struct mem_cgroup *memcg)
        for_each_node(node)
        free_mem_cgroup_per_node_info(memcg, node);
        free_percpu(memcg->stat);
  +     /* poison memcg before freeing it */
  +     memset(memcg, 0x78, sizeof(struct mem_cgroup));
        kfree(memcg);
  }

The coredump shows the position=0xdbbc2a00 is freed.

  (gdb) p/x ((struct mem_cgroup_per_node *)0xe5009e00)->iter[8]
  $13 = {position = 0xdbbc2a00, generation = 0x2efd}

  0xdbbc2a00:     0xdbbc2e00      0x00000000      0xdbbc2800      0x00000100
  0xdbbc2a10:     0x00000200      0x78787878      0x00026218      0x00000000
  0xdbbc2a20:     0xdcad6000      0x00000001      0x78787800      0x00000000
  0xdbbc2a30:     0x78780000      0x00000000      0x0068fb84      0x78787878
  0xdbbc2a40:     0x78787878      0x78787878      0x78787878      0xe3fa5cc0
  0xdbbc2a50:     0x78787878      0x78787878      0x00000000      0x00000000
  0xdbbc2a60:     0x00000000      0x00000000      0x00000000      0x00000000
  0xdbbc2a70:     0x00000000      0x00000000      0x00000000      0x00000000
  0xdbbc2a80:     0x00000000      0x00000000      0x00000000      0x00000000
  0xdbbc2a90:     0x00000001      0x00000000      0x00000000      0x00100000
  0xdbbc2aa0:     0x00000001      0xdbbc2ac8      0x00000000      0x00000000
  0xdbbc2ab0:     0x00000000      0x00000000      0x00000000      0x00000000
  0xdbbc2ac0:     0x00000000      0x00000000      0xe5b02618      0x00001000
  0xdbbc2ad0:     0x00000000      0x78787878      0x78787878      0x78787878
  0xdbbc2ae0:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2af0:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b00:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b10:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b20:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b30:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b40:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b50:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b60:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b70:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2b80:     0x78787878      0x78787878      0x00000000      0x78787878
  0xdbbc2b90:     0x78787878      0x78787878      0x78787878      0x78787878
  0xdbbc2ba0:     0x78787878      0x78787878      0x78787878      0x78787878

In the reclaim path, try_to_free_pages() does not setup
sc.target_mem_cgroup and sc is passed to do_try_to_free_pages(), ...,
shrink_node().

In mem_cgroup_iter(), root is set to root_mem_cgroup because
sc->target_mem_cgroup is NULL.  It is possible to assign a memcg to
root_mem_cgroup.nodeinfo.iter in mem_cgroup_iter().

        try_to_free_pages
        	struct scan_control sc = {...}, target_mem_cgroup is 0x0;
        do_try_to_free_pages
        shrink_zones
        shrink_node
        	 mem_cgroup *root = sc->target_mem_cgroup;
        	 memcg = mem_cgroup_iter(root, NULL, &reclaim);
        mem_cgroup_iter()
        	if (!root)
        		root = root_mem_cgroup;
        	...

        	css = css_next_descendant_pre(css, &root->css);
        	memcg = mem_cgroup_from_css(css);
        	cmpxchg(&iter->position, pos, memcg);

My device uses memcg non-hierarchical mode.  When we release a memcg:
invalidate_reclaim_iterators() reaches only dead_memcg and its parents.
If non-hierarchical mode is used, invalidate_reclaim_iterators() never
reaches root_mem_cgroup.

  static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
  {
        struct mem_cgroup *memcg = dead_memcg;

        for (; memcg; memcg = parent_mem_cgroup(memcg)
        ...
  }

So the use after free scenario looks like:

  CPU1						CPU2

  try_to_free_pages
  do_try_to_free_pages
  shrink_zones
  shrink_node
  mem_cgroup_iter()
      if (!root)
      	root = root_mem_cgroup;
      ...
      css = css_next_descendant_pre(css, &root->css);
      memcg = mem_cgroup_from_css(css);
      cmpxchg(&iter->position, pos, memcg);

        				invalidate_reclaim_iterators(memcg);
        				...
        				__mem_cgroup_free()
        					kfree(memcg);

  try_to_free_pages
  do_try_to_free_pages
  shrink_zones
  shrink_node
  mem_cgroup_iter()
      if (!root)
      	root = root_mem_cgroup;
      ...
      mz = mem_cgroup_nodeinfo(root, reclaim->pgdat->node_id);
      iter = &mz->iter[reclaim->priority];
      pos = READ_ONCE(iter->position);
      css_tryget(&pos->css) <- use after free

To avoid this, we should also invalidate root_mem_cgroup.nodeinfo.iter
in invalidate_reclaim_iterators().

[cai@lca.pw: fix -Wparentheses compilation warning]
  Link: http://lkml.kernel.org/r/1564580753-17531-1-git-send-email-cai@lca.pw
Link: http://lkml.kernel.org/r/20190730015729.4406-1-miles.chen@mediatek.com
Fixes: 5ac8fb31ad2e ("mm: memcontrol: convert reclaim iterator to simple css refcounting")
Signed-off-by: Miles Chen <miles.chen@mediatek.com>
Signed-off-by: Qian Cai <cai@lca.pw>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memcontrol.c | 39 +++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7e7cc0cd89fe8..ecde75f2189be 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1037,26 +1037,45 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
 		css_put(&prev->css);
 }
 
-static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+static void __invalidate_reclaim_iterators(struct mem_cgroup *from,
+					struct mem_cgroup *dead_memcg)
 {
-	struct mem_cgroup *memcg = dead_memcg;
 	struct mem_cgroup_reclaim_iter *iter;
 	struct mem_cgroup_per_node *mz;
 	int nid;
 	int i;
 
-	for (; memcg; memcg = parent_mem_cgroup(memcg)) {
-		for_each_node(nid) {
-			mz = mem_cgroup_nodeinfo(memcg, nid);
-			for (i = 0; i <= DEF_PRIORITY; i++) {
-				iter = &mz->iter[i];
-				cmpxchg(&iter->position,
-					dead_memcg, NULL);
-			}
+	for_each_node(nid) {
+		mz = mem_cgroup_nodeinfo(from, nid);
+		for (i = 0; i <= DEF_PRIORITY; i++) {
+			iter = &mz->iter[i];
+			cmpxchg(&iter->position,
+				dead_memcg, NULL);
 		}
 	}
 }
 
+static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+{
+	struct mem_cgroup *memcg = dead_memcg;
+	struct mem_cgroup *last;
+
+	do {
+		__invalidate_reclaim_iterators(memcg, dead_memcg);
+		last = memcg;
+	} while ((memcg = parent_mem_cgroup(memcg)));
+
+	/*
+	 * When cgruop1 non-hierarchy mode is used,
+	 * parent_mem_cgroup() does not walk all the way up to the
+	 * cgroup root (root_mem_cgroup). So we have to handle
+	 * dead_memcg from cgroup root separately.
+	 */
+	if (last != root_mem_cgroup)
+		__invalidate_reclaim_iterators(root_mem_cgroup,
+						dead_memcg);
+}
+
 /**
  * mem_cgroup_scan_tasks - iterate over tasks of a memory cgroup hierarchy
  * @memcg: hierarchy root
-- 
GitLab


From 056368fc3ef7e7425a7a0c1ba3d00d4c3462db1e Mon Sep 17 00:00:00 2001
From: "Isaac J. Manjarres" <isaacm@codeaurora.org>
Date: Tue, 13 Aug 2019 15:37:37 -0700
Subject: [PATCH 1530/1835] mm/usercopy: use memory range to be accessed for
 wraparound check

commit 951531691c4bcaa59f56a316e018bc2ff1ddf855 upstream.

Currently, when checking to see if accessing n bytes starting at address
"ptr" will cause a wraparound in the memory addresses, the check in
check_bogus_address() adds an extra byte, which is incorrect, as the
range of addresses that will be accessed is [ptr, ptr + (n - 1)].

This can lead to incorrectly detecting a wraparound in the memory
address, when trying to read 4 KB from memory that is mapped to the the
last possible page in the virtual address space, when in fact, accessing
that range of memory would not cause a wraparound to occur.

Use the memory range that will actually be accessed when considering if
accessing a certain amount of bytes will cause the memory address to
wrap around.

Link: http://lkml.kernel.org/r/1564509253-23287-1-git-send-email-isaacm@codeaurora.org
Fixes: f5509cc18daa ("mm: Hardened usercopy")
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Co-developed-by: Prasad Sodagudi <psodagud@codeaurora.org>
Reviewed-by: William Kucharski <william.kucharski@oracle.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Trilok Soni <tsoni@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/usercopy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/usercopy.c b/mm/usercopy.c
index 14faadcedd06c..51411f9c40682 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -151,7 +151,7 @@ static inline void check_bogus_address(const unsigned long ptr, unsigned long n,
 				       bool to_user)
 {
 	/* Reject if object wraps past end of memory. */
-	if (ptr + n < ptr)
+	if (ptr + (n - 1) < ptr)
 		usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);
 
 	/* Reject if NULL or ZERO-allocation. */
-- 
GitLab


From 7f68aa2e3e1bfa03a4e34e02d81718a4c19b47db Mon Sep 17 00:00:00 2001
From: Fabrice Gasnier <fabrice.gasnier@st.com>
Date: Mon, 1 Oct 2018 15:23:56 +0200
Subject: [PATCH 1531/1835] Revert "pwm: Set class for exported channels in
 sysfs"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c289d6625237aa785b484b4e94c23b3b91ea7e60 upstream.

This reverts commit 7e5d1fd75c3dde9fc10c4472b9368089d1b81d00 ("pwm: Set
class for exported channels in sysfs") as it causes regression with
multiple pwm chip[1], when exporting a pwm channel (echo X > export):

- ABI (Documentation/ABI/testing/sysfs-class-pwm) states pwmX should be
  created in /sys/class/pwm/pwmchipN/pwmX
- Reverted patch causes new entry to be also created directly in
  /sys/class/pwm/pwmX
- 1st time, exporting pwmX will create an entry in /sys/class/pwm/pwmX
- class attributes are added under pwmX folder, such as export, unexport
  npwm, symlinks. This is wrong as it belongs to pwmchipN. It may cause
  bad behavior and report wrong values.
- when another export happens on another pwmchip, it can't be created
  (e.g. -EEXIST). This is causing the issue with multiple pwmchip.

Example on stm32 (stm32429i-eval) platform:
$ ls /sys/class/pwm
pwmchip0 pwmchip4

$ cd /sys/class/pwm/pwmchip0/
$ echo 0 > export
$ ls /sys/class/pwm
pwm0 pwmchip0 pwmchip4

$ cd /sys/class/pwm/pwmchip4/
$ echo 0 > export
sysfs: cannot create duplicate filename '/class/pwm/pwm0'
...Exception stack follows...

This is also seen on other platform [2]

[1] https://lkml.org/lkml/2018/9/25/713
[2] https://lkml.org/lkml/2018/9/25/447

Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Tested-by: Gottfried Haider <gottfried.haider@gmail.com>
Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Cc: John Keeping <john@metanate.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pwm/sysfs.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index 1c64fd8e9234a..72bdda4ccebfd 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -263,7 +263,6 @@ static int pwm_export_child(struct device *parent, struct pwm_device *pwm)
 	export->pwm = pwm;
 	mutex_init(&export->lock);
 
-	export->child.class = parent->class;
 	export->child.release = pwm_export_release;
 	export->child.parent = parent;
 	export->child.devt = MKDEV(0, 0);
-- 
GitLab


From 7c001e5aab6dcf4883d67fe3154ce73725251f47 Mon Sep 17 00:00:00 2001
From: Viresh Kumar <viresh.kumar@linaro.org>
Date: Wed, 7 Aug 2019 12:36:01 +0530
Subject: [PATCH 1532/1835] cpufreq: schedutil: Don't skip freq update when
 limits change

commit 600f5badb78c316146d062cfd7af4a2cfb655baa upstream.

To avoid reducing the frequency of a CPU prematurely, we skip reducing
the frequency if the CPU had been busy recently.

This should not be done when the limits of the policy are changed, for
example due to thermal throttling. We should always get the frequency
within the new limits as soon as possible.

Trying to fix this by using only one flag, i.e. need_freq_update, can
lead to a race condition where the flag gets cleared without forcing us
to change the frequency at least once. And so this patch introduces
another flag to avoid that race condition.

Fixes: ecd288429126 ("cpufreq: schedutil: Don't set next_freq to UINT_MAX")
Cc: v4.18+ <stable@vger.kernel.org> # v4.18+
Reported-by: Doug Smythies <dsmythies@telus.net>
Tested-by: Doug Smythies <dsmythies@telus.net>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/sched/cpufreq_schedutil.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 4e3625109b28d..64d54acc99282 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -40,6 +40,7 @@ struct sugov_policy {
 	struct task_struct	*thread;
 	bool			work_in_progress;
 
+	bool			limits_changed;
 	bool			need_freq_update;
 };
 
@@ -90,8 +91,11 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
 	    !cpufreq_this_cpu_can_update(sg_policy->policy))
 		return false;
 
-	if (unlikely(sg_policy->need_freq_update))
+	if (unlikely(sg_policy->limits_changed)) {
+		sg_policy->limits_changed = false;
+		sg_policy->need_freq_update = true;
 		return true;
+	}
 
 	delta_ns = time - sg_policy->last_freq_update_time;
 
@@ -405,7 +409,7 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
 static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu, struct sugov_policy *sg_policy)
 {
 	if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl)
-		sg_policy->need_freq_update = true;
+		sg_policy->limits_changed = true;
 }
 
 static void sugov_update_single(struct update_util_data *hook, u64 time,
@@ -425,7 +429,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
 	if (!sugov_should_update_freq(sg_policy, time))
 		return;
 
-	busy = sugov_cpu_is_busy(sg_cpu);
+	/* Limits may have changed, don't skip frequency update */
+	busy = !sg_policy->need_freq_update && sugov_cpu_is_busy(sg_cpu);
 
 	util = sugov_get_util(sg_cpu);
 	max = sg_cpu->max;
@@ -798,6 +803,7 @@ static int sugov_start(struct cpufreq_policy *policy)
 	sg_policy->last_freq_update_time	= 0;
 	sg_policy->next_freq			= 0;
 	sg_policy->work_in_progress		= false;
+	sg_policy->limits_changed		= false;
 	sg_policy->need_freq_update		= false;
 	sg_policy->cached_raw_freq		= 0;
 
@@ -849,7 +855,7 @@ static void sugov_limits(struct cpufreq_policy *policy)
 		mutex_unlock(&sg_policy->work_lock);
 	}
 
-	sg_policy->need_freq_update = true;
+	sg_policy->limits_changed = true;
 }
 
 static struct cpufreq_governor schedutil_gov = {
-- 
GitLab


From 61f6ecb758453d51f25c4cd991cfcc52c41e709a Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Mon, 12 Aug 2019 15:01:30 -0700
Subject: [PATCH 1533/1835] xtensa: add missing isync to the cpu_reset TLB code

commit cd8869f4cb257f22b89495ca40f5281e58ba359c upstream.

ITLB entry modifications must be followed by the isync instruction
before the new entries are possibly used. cpu_reset lacks one isync
between ITLB way 6 initialization and jump to the identity mapping.
Add missing isync to xtensa cpu_reset.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/xtensa/kernel/setup.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index a285fbd0fd9be..15580e4fc766a 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -515,6 +515,7 @@ void cpu_reset(void)
 				      "add	%2, %2, %7\n\t"
 				      "addi	%0, %0, -1\n\t"
 				      "bnez	%0, 1b\n\t"
+				      "isync\n\t"
 				      /* Jump to identity mapping */
 				      "jx	%3\n"
 				      "2:\n\t"
-- 
GitLab


From d5bb1240280526d644095e98e505e73de753371a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 13 Aug 2019 17:39:56 +0200
Subject: [PATCH 1534/1835] ALSA: hda/realtek - Add quirk for HP Envy x360

commit 190d03814eb3b49d4f87ff38fef26d36f3568a60 upstream.

HP Envy x360 (AMD Ryzen-based model) with 103c:8497 needs the same
quirk like HP Spectre x360 for enabling the mute LED over Mic3 pin.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204373
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index dc1989686f09b..bb19dd6c0a322 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6851,6 +6851,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+	SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-- 
GitLab


From 46f9a1bc60a4c15a14a6504168cee1c2e0bf3ab4 Mon Sep 17 00:00:00 2001
From: Hui Peng <benquike@gmail.com>
Date: Thu, 15 Aug 2019 00:31:34 -0400
Subject: [PATCH 1535/1835] ALSA: usb-audio: Fix a stack buffer overflow bug in
 check_input_term

commit 19bce474c45be69a284ecee660aa12d8f1e88f18 upstream.

`check_input_term` recursively calls itself with input from
device side (e.g., uac_input_terminal_descriptor.bCSourceID)
as argument (id). In `check_input_term`, if `check_input_term`
is called with the same `id` argument as the caller, it triggers
endless recursive call, resulting kernel space stack overflow.

This patch fixes the bug by adding a bitmap to `struct mixer_build`
to keep track of the checked ids and stop the execution if some id
has been checked (similar to how parse_audio_unit handles unitid
argument).

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer.c | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 7e1c6c2dc99e8..996126a280729 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -83,6 +83,7 @@ struct mixer_build {
 	unsigned char *buffer;
 	unsigned int buflen;
 	DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+	DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
 	struct usb_audio_term oterm;
 	const struct usbmix_name_map *map;
 	const struct usbmix_selector_map *selector_map;
@@ -788,16 +789,25 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
  * parse the source unit recursively until it reaches to a terminal
  * or a branched unit.
  */
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
 			    struct usb_audio_term *term)
 {
 	int protocol = state->mixer->protocol;
 	int err;
 	void *p1;
+	unsigned char *hdr;
 
 	memset(term, 0, sizeof(*term));
-	while ((p1 = find_audio_control_unit(state, id)) != NULL) {
-		unsigned char *hdr = p1;
+	for (;;) {
+		/* a loop in the terminal chain? */
+		if (test_and_set_bit(id, state->termbitmap))
+			return -EINVAL;
+
+		p1 = find_audio_control_unit(state, id);
+		if (!p1)
+			break;
+
+		hdr = p1;
 		term->id = id;
 
 		if (protocol == UAC_VERSION_1 || protocol == UAC_VERSION_2) {
@@ -815,7 +825,7 @@ static int check_input_term(struct mixer_build *state, int id,
 
 					/* call recursively to verify that the
 					 * referenced clock entity is valid */
-					err = check_input_term(state, d->bCSourceID, term);
+					err = __check_input_term(state, d->bCSourceID, term);
 					if (err < 0)
 						return err;
 
@@ -849,7 +859,7 @@ static int check_input_term(struct mixer_build *state, int id,
 			case UAC2_CLOCK_SELECTOR: {
 				struct uac_selector_unit_descriptor *d = p1;
 				/* call recursively to retrieve the channel info */
-				err = check_input_term(state, d->baSourceID[0], term);
+				err = __check_input_term(state, d->baSourceID[0], term);
 				if (err < 0)
 					return err;
 				term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
@@ -912,7 +922,7 @@ static int check_input_term(struct mixer_build *state, int id,
 
 				/* call recursively to verify that the
 				 * referenced clock entity is valid */
-				err = check_input_term(state, d->bCSourceID, term);
+				err = __check_input_term(state, d->bCSourceID, term);
 				if (err < 0)
 					return err;
 
@@ -963,7 +973,7 @@ static int check_input_term(struct mixer_build *state, int id,
 			case UAC3_CLOCK_SELECTOR: {
 				struct uac_selector_unit_descriptor *d = p1;
 				/* call recursively to retrieve the channel info */
-				err = check_input_term(state, d->baSourceID[0], term);
+				err = __check_input_term(state, d->baSourceID[0], term);
 				if (err < 0)
 					return err;
 				term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
@@ -979,7 +989,7 @@ static int check_input_term(struct mixer_build *state, int id,
 					return -EINVAL;
 
 				/* call recursively to retrieve the channel info */
-				err = check_input_term(state, d->baSourceID[0], term);
+				err = __check_input_term(state, d->baSourceID[0], term);
 				if (err < 0)
 					return err;
 
@@ -997,6 +1007,15 @@ static int check_input_term(struct mixer_build *state, int id,
 	return -ENODEV;
 }
 
+
+static int check_input_term(struct mixer_build *state, int id,
+			    struct usb_audio_term *term)
+{
+	memset(term, 0, sizeof(*term));
+	memset(state->termbitmap, 0, sizeof(state->termbitmap));
+	return __check_input_term(state, id, term);
+}
+
 /*
  * Feature Unit
  */
-- 
GitLab


From 58b9f19ee438990f6406e61943d0bc7c875a0921 Mon Sep 17 00:00:00 2001
From: Hui Peng <benquike@gmail.com>
Date: Tue, 13 Aug 2019 22:34:04 -0400
Subject: [PATCH 1536/1835] ALSA: usb-audio: Fix an OOB bug in
 parse_audio_mixer_unit

commit daac07156b330b18eb5071aec4b3ddca1c377f2c upstream.

The `uac_mixer_unit_descriptor` shown as below is read from the
device side. In `parse_audio_mixer_unit`, `baSourceID` field is
accessed from index 0 to `bNrInPins` - 1, the current implementation
assumes that descriptor is always valid (the length  of descriptor
is no shorter than 5 + `bNrInPins`). If a descriptor read from
the device side is invalid, it may trigger out-of-bound memory
access.

```
struct uac_mixer_unit_descriptor {
	__u8 bLength;
	__u8 bDescriptorType;
	__u8 bDescriptorSubtype;
	__u8 bUnitID;
	__u8 bNrInPins;
	__u8 baSourceID[];
}
```

This patch fixes the bug by add a sanity check on the length of
the descriptor.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 996126a280729..4b3e1c48ca2f3 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -760,6 +760,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
 		return -EINVAL;
 	if (!desc->bNrInPins)
 		return -EINVAL;
+	if (desc->bLength < sizeof(*desc) + desc->bNrInPins)
+		return -EINVAL;
 
 	switch (state->mixer->protocol) {
 	case UAC_VERSION_1:
-- 
GitLab


From 1bf5f827564c34d034997635b06e2c0b66bedae4 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 9 Aug 2019 11:23:00 +0200
Subject: [PATCH 1537/1835] ALSA: hda - Apply workaround for another AMD chip
 1022:1487

commit de768ce45466f3009809719eb7b1f6f5277d9373 upstream.

MSI MPG X570 board is with another AMD HD-audio controller (PCI ID
1022:1487) and it requires the same workaround applied for X370, etc
(PCI ID 1022:1457).

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195303
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_intel.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 81cea34aff1c6..7a3e34b120b33 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2655,6 +2655,9 @@ static const struct pci_device_id azx_ids[] = {
 	/* AMD, X370 & co */
 	{ PCI_DEVICE(0x1022, 0x1457),
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+	/* AMD, X570 & co */
+	{ PCI_DEVICE(0x1022, 0x1487),
+	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
 	/* AMD Stoney */
 	{ PCI_DEVICE(0x1022, 0x157a),
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
-- 
GitLab


From 6c4a536ca97bc1bc7df5aa315dc6cad92c84d813 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Fri, 9 Aug 2019 23:29:48 -0500
Subject: [PATCH 1538/1835] ALSA: hda - Fix a memory leak bug

commit cfef67f016e4c00a2f423256fc678a6967a9fc09 upstream.

In snd_hda_parse_generic_codec(), 'spec' is allocated through kzalloc().
Then, the pin widgets in 'codec' are parsed. However, if the parsing
process fails, 'spec' is not deallocated, leading to a memory leak.

To fix the above issue, free 'spec' before returning the error.

Fixes: 352f7f914ebb ("ALSA: hda - Merge Realtek parser code to generic parser")
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_generic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 579984ecdec30..eb7461e74a949 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -6082,7 +6082,7 @@ static int snd_hda_parse_generic_codec(struct hda_codec *codec)
 
 	err = snd_hda_parse_pin_defcfg(codec, &spec->autocfg, NULL, 0);
 	if (err < 0)
-		return err;
+		goto error;
 
 	err = snd_hda_gen_parse_auto_config(codec, &spec->autocfg);
 	if (err < 0)
-- 
GitLab


From e58ba88d6c60fe10a1ec996c394c29a08f0cb2c8 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Wed, 14 Aug 2019 12:09:08 +0800
Subject: [PATCH 1539/1835] ALSA: hda - Add a generic reboot_notify

commit 871b9066027702e6e6589da0e1edd3b7dede7205 upstream.

Make codec enter D3 before rebooting or poweroff can fix the noise
issue on some laptops. And in theory it is harmless for all codecs
to enter D3 before rebooting or poweroff, let us add a generic
reboot_notify, then realtek and conexant drivers can call this
function.

Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_generic.c    | 19 +++++++++++++++++++
 sound/pci/hda/hda_generic.h    |  1 +
 sound/pci/hda/patch_conexant.c |  6 +-----
 sound/pci/hda/patch_realtek.c  | 11 +----------
 4 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index eb7461e74a949..bb2bd33b00ec3 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -6033,6 +6033,24 @@ void snd_hda_gen_free(struct hda_codec *codec)
 }
 EXPORT_SYMBOL_GPL(snd_hda_gen_free);
 
+/**
+ * snd_hda_gen_reboot_notify - Make codec enter D3 before rebooting
+ * @codec: the HDA codec
+ *
+ * This can be put as patch_ops reboot_notify function.
+ */
+void snd_hda_gen_reboot_notify(struct hda_codec *codec)
+{
+	/* Make the codec enter D3 to avoid spurious noises from the internal
+	 * speaker during (and after) reboot
+	 */
+	snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
+	snd_hda_codec_write(codec, codec->core.afg, 0,
+			    AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
+	msleep(10);
+}
+EXPORT_SYMBOL_GPL(snd_hda_gen_reboot_notify);
+
 #ifdef CONFIG_PM
 /**
  * snd_hda_gen_check_power_status - check the loopback power save state
@@ -6060,6 +6078,7 @@ static const struct hda_codec_ops generic_patch_ops = {
 	.init = snd_hda_gen_init,
 	.free = snd_hda_gen_free,
 	.unsol_event = snd_hda_jack_unsol_event,
+	.reboot_notify = snd_hda_gen_reboot_notify,
 #ifdef CONFIG_PM
 	.check_power_status = snd_hda_gen_check_power_status,
 #endif
diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
index 10123664fa619..ce9c293717b96 100644
--- a/sound/pci/hda/hda_generic.h
+++ b/sound/pci/hda/hda_generic.h
@@ -336,6 +336,7 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
 				  struct auto_pin_cfg *cfg);
 int snd_hda_gen_build_controls(struct hda_codec *codec);
 int snd_hda_gen_build_pcms(struct hda_codec *codec);
+void snd_hda_gen_reboot_notify(struct hda_codec *codec);
 
 /* standard jack event callbacks */
 void snd_hda_gen_hp_automute(struct hda_codec *codec,
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index b70fbfa80546e..077d1f7561c22 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -188,11 +188,7 @@ static void cx_auto_reboot_notify(struct hda_codec *codec)
 	/* Turn the problematic codec into D3 to avoid spurious noises
 	   from the internal speaker during (and after) reboot */
 	cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false);
-
-	snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
-	snd_hda_codec_write(codec, codec->core.afg, 0,
-			    AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-	msleep(10);
+	snd_hda_gen_reboot_notify(codec);
 }
 
 static void cx_auto_free(struct hda_codec *codec)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bb19dd6c0a322..9b5caf099bfbf 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -868,15 +868,6 @@ static void alc_reboot_notify(struct hda_codec *codec)
 		alc_shutup(codec);
 }
 
-/* power down codec to D3 at reboot/shutdown; set as reboot_notify ops */
-static void alc_d3_at_reboot(struct hda_codec *codec)
-{
-	snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
-	snd_hda_codec_write(codec, codec->core.afg, 0,
-			    AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-	msleep(10);
-}
-
 #define alc_free	snd_hda_gen_free
 
 #ifdef CONFIG_PM
@@ -5111,7 +5102,7 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
 	struct alc_spec *spec = codec->spec;
 
 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-		spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
+		spec->reboot_notify = snd_hda_gen_reboot_notify; /* reduce noise */
 		spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
 		codec->power_save_node = 0; /* avoid click noises */
 		snd_hda_apply_pincfgs(codec, pincfgs);
-- 
GitLab


From 9585f4440cecaf1b1a513d1515adfb11d865bd03 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Wed, 14 Aug 2019 12:09:07 +0800
Subject: [PATCH 1540/1835] ALSA: hda - Let all conexant codec enter D3 when
 rebooting

commit 401714d9534aad8c24196b32600da683116bbe09 upstream.

We have 3 new lenovo laptops which have conexant codec 0x14f11f86,
these 3 laptops also have the noise issue when rebooting, after
letting the codec enter D3 before rebooting or poweroff, the noise
disappers.

Instead of adding a new ID again in the reboot_notify(), let us make
this function apply to all conexant codec. In theory make codec enter
D3 before rebooting or poweroff is harmless, and I tested this change
on a couple of other Lenovo laptops which have different conexant
codecs, there is no side effect so far.

Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_conexant.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 077d1f7561c22..6f17b256fcd02 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -176,15 +176,6 @@ static void cx_auto_reboot_notify(struct hda_codec *codec)
 {
 	struct conexant_spec *spec = codec->spec;
 
-	switch (codec->core.vendor_id) {
-	case 0x14f12008: /* CX8200 */
-	case 0x14f150f2: /* CX20722 */
-	case 0x14f150f4: /* CX20724 */
-		break;
-	default:
-		return;
-	}
-
 	/* Turn the problematic codec into D3 to avoid spurious noises
 	   from the internal speaker during (and after) reboot */
 	cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false);
-- 
GitLab


From 537d957b144f0531f67dc3962afd12b1b96cef4d Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 25 Jul 2019 15:13:33 +0200
Subject: [PATCH 1541/1835] HID: holtek: test for sanity of intfdata

commit 01ec0a5f19c8c82960a07f6c7410fc9e01d7fb51 upstream.

The ioctl handler uses the intfdata of a second interface,
which may not be present in a broken or malicious device, hence
the intfdata needs to be checked for NULL.

[jkosina@suse.cz: fix newly added spurious space]
Reported-by: syzbot+965152643a75a56737be@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-holtek-kbd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
index 6e1a4a4fc0c10..ab9da597106fa 100644
--- a/drivers/hid/hid-holtek-kbd.c
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -126,9 +126,14 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
 
 	/* Locate the boot interface, to receive the LED change events */
 	struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0);
+	struct hid_device *boot_hid;
+	struct hid_input *boot_hid_input;
 
-	struct hid_device *boot_hid = usb_get_intfdata(boot_interface);
-	struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs,
+	if (unlikely(boot_interface == NULL))
+		return -ENODEV;
+
+	boot_hid = usb_get_intfdata(boot_interface);
+	boot_hid_input = list_first_entry(&boot_hid->inputs,
 		struct hid_input, list);
 
 	return boot_hid_input->input->event(boot_hid_input->input, type, code,
-- 
GitLab


From 0aab1a4653a6a21509e8add4bb460be76fcf9c70 Mon Sep 17 00:00:00 2001
From: Hillf Danton <hdanton@sina.com>
Date: Tue, 6 Aug 2019 16:38:58 +0800
Subject: [PATCH 1542/1835] HID: hiddev: avoid opening a disconnected device

commit 9c09b214f30e3c11f9b0b03f89442df03643794d upstream.

syzbot found the following crash on:

HEAD commit:    e96407b4 usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=147ac20c600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=792eb47789f57810
dashboard link: https://syzkaller.appspot.com/bug?extid=62a1e04fd3ec2abf099e
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50
kernel/locking/lockdep.c:3753
Read of size 8 at addr ffff8881cf591a08 by task syz-executor.1/26260

CPU: 1 PID: 26260 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  print_address_description+0x6a/0x32c mm/kasan/report.c:351
  __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
  kasan_report+0xe/0x12 mm/kasan/common.c:612
  __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753
  lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412
  __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
  _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159
  hiddev_release+0x82/0x520 drivers/hid/usbhid/hiddev.c:221
  __fput+0x2d7/0x840 fs/file_table.c:280
  task_work_run+0x13f/0x1c0 kernel/task_work.c:113
  exit_task_work include/linux/task_work.h:22 [inline]
  do_exit+0x8ef/0x2c50 kernel/exit.c:878
  do_group_exit+0x125/0x340 kernel/exit.c:982
  get_signal+0x466/0x23d0 kernel/signal.c:2728
  do_signal+0x88/0x14e0 arch/x86/kernel/signal.c:815
  exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:159
  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
  do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f75b2a6ccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000075c078 RCX: 0000000000459829
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075c078
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075c07c
R13: 00007ffcdfe1023f R14: 00007f75b2a6d9c0 R15: 000000000075c07c

Allocated by task 104:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_kmalloc mm/kasan/common.c:487 [inline]
  __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
  kmalloc include/linux/slab.h:552 [inline]
  kzalloc include/linux/slab.h:748 [inline]
  hiddev_connect+0x242/0x5b0 drivers/hid/usbhid/hiddev.c:900
  hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882
  hid_hw_start drivers/hid/hid-core.c:1981 [inline]
  hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972
  appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308
  hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365
  usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 104:
  save_stack+0x1b/0x80 mm/kasan/common.c:69
  set_track mm/kasan/common.c:77 [inline]
  __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
  slab_free_hook mm/slub.c:1423 [inline]
  slab_free_freelist_hook mm/slub.c:1470 [inline]
  slab_free mm/slub.c:3012 [inline]
  kfree+0xe4/0x2f0 mm/slub.c:3953
  hiddev_connect.cold+0x45/0x5c drivers/hid/usbhid/hiddev.c:914
  hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882
  hid_hw_start drivers/hid/hid-core.c:1981 [inline]
  hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972
  appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308
  hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365
  usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386
  usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
  generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
  usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
  really_probe+0x281/0x650 drivers/base/dd.c:548
  driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709
  __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816
  bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
  __device_attach+0x217/0x360 drivers/base/dd.c:882
  bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
  device_add+0xae6/0x16f0 drivers/base/core.c:2114
  usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536
  hub_port_connect drivers/usb/core/hub.c:5098 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
  port_event drivers/usb/core/hub.c:5359 [inline]
  hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441
  process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
  worker_thread+0x96/0xe20 kernel/workqueue.c:2415
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff8881cf591900
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
  512-byte region [ffff8881cf591900, ffff8881cf591b00)
The buggy address belongs to the page:
page:ffffea00073d6400 refcount:1 mapcount:0 mapping:ffff8881da002500
index:0x0 compound_mapcount: 0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da002500
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8881cf591900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881cf591980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8881cf591a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff8881cf591a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8881cf591b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

In order to avoid opening a disconnected device, we need to check exist
again after acquiring the existance lock, and bail out if necessary.

Reported-by: syzbot <syzbot+62a1e04fd3ec2abf099e@syzkaller.appspotmail.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/usbhid/hiddev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index a746017fac170..56da33bc3862e 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -297,6 +297,14 @@ static int hiddev_open(struct inode *inode, struct file *file)
 	spin_unlock_irq(&list->hiddev->list_lock);
 
 	mutex_lock(&hiddev->existancelock);
+	/*
+	 * recheck exist with existance lock held to
+	 * avoid opening a disconnected device
+	 */
+	if (!list->hiddev->exist) {
+		res = -ENODEV;
+		goto bail_unlock;
+	}
 	if (!list->hiddev->open++)
 		if (list->hiddev->exist) {
 			struct hid_device *hid = hiddev->hid;
-- 
GitLab


From b545dc9debe69ca513b93f4a244451e9be14b0c5 Mon Sep 17 00:00:00 2001
From: Hillf Danton <hdanton@sina.com>
Date: Tue, 6 Aug 2019 16:40:15 +0800
Subject: [PATCH 1543/1835] HID: hiddev: do cleanup in failure of opening a
 device

commit 6d4472d7bec39917b54e4e80245784ea5d60ce49 upstream.

Undo what we did for opening before releasing the memory slice.

Reported-by: syzbot <syzbot+62a1e04fd3ec2abf099e@syzkaller.appspotmail.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/usbhid/hiddev.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 56da33bc3862e..5a949ca42b1d0 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -321,6 +321,10 @@ bail_normal_power:
 	hid_hw_power(hid, PM_HINT_NORMAL);
 bail_unlock:
 	mutex_unlock(&hiddev->existancelock);
+
+	spin_lock_irq(&list->hiddev->list_lock);
+	list_del(&list->node);
+	spin_unlock_irq(&list->hiddev->list_lock);
 bail:
 	file->private_data = NULL;
 	vfree(list);
-- 
GitLab


From 08b3af00a16188f3299ab6dc2c685947d61bd787 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 1 Aug 2019 09:44:25 -0700
Subject: [PATCH 1544/1835] Input: kbtab - sanity check for endpoint type

commit c88090dfc84254fa149174eb3e6a8458de1912c4 upstream.

The driver should check whether the endpoint it uses has the correct
type.

Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/tablet/kbtab.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index 75b500651e4e4..b1cf0c9712740 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -116,6 +116,10 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
 	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
 		return -ENODEV;
 
+	endpoint = &intf->cur_altsetting->endpoint[0].desc;
+	if (!usb_endpoint_is_int_in(endpoint))
+		return -ENODEV;
+
 	kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
 	input_dev = input_allocate_device();
 	if (!kbtab || !input_dev)
@@ -154,8 +158,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
 	input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0);
 	input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0);
 
-	endpoint = &intf->cur_altsetting->endpoint[0].desc;
-
 	usb_fill_int_urb(kbtab->irq, dev,
 			 usb_rcvintpipe(dev, endpoint->bEndpointAddress),
 			 kbtab->data, 8,
-- 
GitLab


From f13de3d677d1084485c0e4978d6e9f8b44f9972d Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 6 Aug 2019 09:05:55 -0700
Subject: [PATCH 1545/1835] Input: iforce - add sanity checks

commit 849f5ae3a513c550cad741c68dd3d7eb2bcc2a2c upstream.

The endpoint type should also be checked before a device
is accepted.

Reported-by: syzbot+5efc10c005014d061a74@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/iforce/iforce-usb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index 78073259c9a1a..c431df7401b44 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -141,7 +141,12 @@ static int iforce_usb_probe(struct usb_interface *intf,
 		return -ENODEV;
 
 	epirq = &interface->endpoint[0].desc;
+	if (!usb_endpoint_is_int_in(epirq))
+		return -ENODEV;
+
 	epout = &interface->endpoint[1].desc;
+	if (!usb_endpoint_is_int_out(epout))
+		return -ENODEV;
 
 	if (!(iforce = kzalloc(sizeof(struct iforce) + 32, GFP_KERNEL)))
 		goto fail;
-- 
GitLab


From 07d92caeb945093b25eaca3454263a0beca607b2 Mon Sep 17 00:00:00 2001
From: Denis Kirjanov <kda@linux-powerpc.org>
Date: Tue, 30 Jul 2019 15:13:57 +0200
Subject: [PATCH 1546/1835] net: usb: pegasus: fix improper read if
 get_registers() fail

commit 224c04973db1125fcebefffd86115f99f50f8277 upstream.

get_registers() may fail with -ENOMEM and in this
case we can read a garbage from the status variable tmp.

Reported-by: syzbot+3499a83b2d062ae409d4@syzkaller.appspotmail.com
Signed-off-by: Denis Kirjanov <kda@linux-powerpc.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/pegasus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index f4247b275e090..b7a0df95d4b0f 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -285,7 +285,7 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val)
 static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata)
 {
 	int i;
-	__u8 tmp;
+	__u8 tmp = 0;
 	__le16 retdatai;
 	int ret;
 
-- 
GitLab


From cef0e9eb22315f7c5f3126eb5003e3ea0348ee93 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Mon, 29 Jul 2019 17:58:10 +0200
Subject: [PATCH 1547/1835] netfilter: ebtables: also count base chain policies

commit 3b48300d5cc7c7bed63fddb006c4046549ed4aec upstream.

ebtables doesn't include the base chain policies in the rule count,
so we need to add them manually when we call into the x_tables core
to allocate space for the comapt offset table.

This lead syzbot to trigger:
WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649
xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649

Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com
Fixes: 2035f3ff8eaa ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/netfilter/ebtables.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 0bb4d712b80cb..995b3842ba7c0 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1779,20 +1779,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
 	return 0;
 }
 
+static int ebt_compat_init_offsets(unsigned int number)
+{
+	if (number > INT_MAX)
+		return -EINVAL;
+
+	/* also count the base chain policies */
+	number += NF_BR_NUMHOOKS;
+
+	return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
+}
 
 static int compat_table_info(const struct ebt_table_info *info,
 			     struct compat_ebt_replace *newinfo)
 {
 	unsigned int size = info->entries_size;
 	const void *entries = info->entries;
+	int ret;
 
 	newinfo->entries_size = size;
-	if (info->nentries) {
-		int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
-						 info->nentries);
-		if (ret)
-			return ret;
-	}
+	ret = ebt_compat_init_offsets(info->nentries);
+	if (ret)
+		return ret;
 
 	return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
 							entries, newinfo);
@@ -2241,11 +2249,9 @@ static int compat_do_replace(struct net *net, void __user *user,
 
 	xt_compat_lock(NFPROTO_BRIDGE);
 
-	if (tmp.nentries) {
-		ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
-		if (ret < 0)
-			goto out_unlock;
-	}
+	ret = ebt_compat_init_offsets(tmp.nentries);
+	if (ret < 0)
+		goto out_unlock;
 
 	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
 	if (ret < 0)
-- 
GitLab


From 28fd9b37b6bb86c5d90694f4493c46b7d71cf9a6 Mon Sep 17 00:00:00 2001
From: Vincent Chen <vincent.chen@sifive.com>
Date: Wed, 14 Aug 2019 16:23:53 +0800
Subject: [PATCH 1548/1835] riscv: Make __fstate_clean() work correctly.

commit 69703eb9a8ae28a46cd5bce7d69ceeef6273a104 upstream.

Make the __fstate_clean() function correctly set the
state of sstatus.FS in pt_regs to SR_FS_CLEAN.

Fixes: 7db91e57a0acd ("RISC-V: Task implementation")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Vincent Chen <vincent.chen@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[paul.walmsley@sifive.com: expanded "Fixes" commit ID]
Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/riscv/include/asm/switch_to.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h
index dd6b05bff75b6..d911a8c2314d2 100644
--- a/arch/riscv/include/asm/switch_to.h
+++ b/arch/riscv/include/asm/switch_to.h
@@ -23,7 +23,7 @@ extern void __fstate_restore(struct task_struct *restore_from);
 
 static inline void __fstate_clean(struct pt_regs *regs)
 {
-	regs->sstatus |= (regs->sstatus & ~(SR_FS)) | SR_FS_CLEAN;
+	regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_CLEAN;
 }
 
 static inline void fstate_save(struct task_struct *task,
-- 
GitLab


From 3e5f29b6667539006d9d746c540507ca1e638244 Mon Sep 17 00:00:00 2001
From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Date: Tue, 25 Jun 2019 12:10:02 +0300
Subject: [PATCH 1549/1835] clk: at91: generated: Truncate divisor to
 GENERATED_MAX_DIV + 1

[ Upstream commit 1573eebeaa8055777eb753f9b4d1cbe653380c38 ]

In clk_generated_determine_rate(), if the divisor is greater than
GENERATED_MAX_DIV + 1, then the wrong best_rate will be returned.
If clk_generated_set_rate() will be called later with this wrong
rate, it will return -EINVAL, so the generated clock won't change
its value. Do no let the divisor be greater than GENERATED_MAX_DIV + 1.

Fixes: 8c7aa6328947 ("clk: at91: clk-generated: remove useless divisor loop")
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/clk-generated.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
index 33481368740e7..113152425a95d 100644
--- a/drivers/clk/at91/clk-generated.c
+++ b/drivers/clk/at91/clk-generated.c
@@ -153,6 +153,8 @@ static int clk_generated_determine_rate(struct clk_hw *hw,
 			continue;
 
 		div = DIV_ROUND_CLOSEST(parent_rate, req->rate);
+		if (div > GENERATED_MAX_DIV + 1)
+			div = GENERATED_MAX_DIV + 1;
 
 		clk_generated_best_diff(req, parent, parent_rate, div,
 					&best_diff, &best_rate);
-- 
GitLab


From af2ed1a05a7a398a784589b125b7df587f5a6e79 Mon Sep 17 00:00:00 2001
From: Chunyan Zhang <chunyan.zhang@unisoc.com>
Date: Thu, 18 Jul 2019 13:36:16 +0800
Subject: [PATCH 1550/1835] clk: sprd: Select REGMAP_MMIO to avoid compile
 errors

[ Upstream commit c9a67cbb5189e966c70451562b2ca4c3876ab546 ]

Make REGMAP_MMIO selected to avoid undefined reference to regmap symbols.

Fixes: d41f59fd92f2 ("clk: sprd: Add common infrastructure")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sprd/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/sprd/Kconfig b/drivers/clk/sprd/Kconfig
index 87892471eb96c..bad8099832d48 100644
--- a/drivers/clk/sprd/Kconfig
+++ b/drivers/clk/sprd/Kconfig
@@ -2,6 +2,7 @@ config SPRD_COMMON_CLK
 	tristate "Clock support for Spreadtrum SoCs"
 	depends on ARCH_SPRD || COMPILE_TEST
 	default ARCH_SPRD
+	select REGMAP_MMIO
 
 if SPRD_COMMON_CLK
 
-- 
GitLab


From ca5b26a8f1d8084970218ce97e3177be0c956cc9 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Thu, 11 Jul 2019 15:03:59 +0200
Subject: [PATCH 1551/1835] clk: renesas: cpg-mssr: Fix reset control race
 condition

[ Upstream commit e1f1ae8002e4b06addc52443fcd975bbf554ae92 ]

The module reset code in the Renesas CPG/MSSR driver uses
read-modify-write (RMW) operations to write to a Software Reset Register
(SRCRn), and simple writes to write to a Software Reset Clearing
Register (SRSTCLRn), as was mandated by the R-Car Gen2 and Gen3 Hardware
User's Manuals.

However, this may cause a race condition when two devices are reset in
parallel: if the reset for device A completes in the middle of the RMW
operation for device B, device A may be reset again, causing subtle
failures (e.g. i2c timeouts):

	thread A			thread B
	--------			--------

	val = SRCRn
	val |= bit A
	SRCRn = val

	delay

					val = SRCRn (bit A is set)

	SRSTCLRn = bit A
	(bit A in SRCRn is cleared)

					val |= bit B
					SRCRn = val (bit A and B are set)

This can be reproduced on e.g. Salvator-XS using:

    $ while true; do i2cdump -f -y 4 0x6A b > /dev/null; done &
    $ while true; do i2cdump -f -y 2 0x10 b > /dev/null; done &

    i2c-rcar e6510000.i2c: error -110 : 40000002
    i2c-rcar e66d8000.i2c: error -110 : 40000002

According to the R-Car Gen3 Hardware Manual Errata for Rev.
0.80 of Feb 28, 2018, reflected in Rev. 1.00 of the R-Car Gen3 Hardware
User's Manual, writes to SRCRn do not require read-modify-write cycles.

Note that the R-Car Gen2 Hardware User's Manual has not been updated
yet, and still says a read-modify-write sequence is required.  According
to the hardware team, the reset hardware block is the same on both R-Car
Gen2 and Gen3, though.

Hence fix the issue by replacing the read-modify-write operations on
SRCRn by simple writes.

Reported-by: Yao Lihua <Lihua.Yao@desay-svautomotive.com>
Fixes: 6197aa65c4905532 ("clk: renesas: cpg-mssr: Add support for reset control")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Linh Phung <linh.phung.jy@renesas.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/renesas/renesas-cpg-mssr.c | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index f4b013e9352d9..24485bee9b49e 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -535,17 +535,11 @@ static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
 	unsigned int reg = id / 32;
 	unsigned int bit = id % 32;
 	u32 bitmask = BIT(bit);
-	unsigned long flags;
-	u32 value;
 
 	dev_dbg(priv->dev, "reset %u%02u\n", reg, bit);
 
 	/* Reset module */
-	spin_lock_irqsave(&priv->rmw_lock, flags);
-	value = readl(priv->base + SRCR(reg));
-	value |= bitmask;
-	writel(value, priv->base + SRCR(reg));
-	spin_unlock_irqrestore(&priv->rmw_lock, flags);
+	writel(bitmask, priv->base + SRCR(reg));
 
 	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
 	udelay(35);
@@ -562,16 +556,10 @@ static int cpg_mssr_assert(struct reset_controller_dev *rcdev, unsigned long id)
 	unsigned int reg = id / 32;
 	unsigned int bit = id % 32;
 	u32 bitmask = BIT(bit);
-	unsigned long flags;
-	u32 value;
 
 	dev_dbg(priv->dev, "assert %u%02u\n", reg, bit);
 
-	spin_lock_irqsave(&priv->rmw_lock, flags);
-	value = readl(priv->base + SRCR(reg));
-	value |= bitmask;
-	writel(value, priv->base + SRCR(reg));
-	spin_unlock_irqrestore(&priv->rmw_lock, flags);
+	writel(bitmask, priv->base + SRCR(reg));
 	return 0;
 }
 
-- 
GitLab


From e72e6ba17ab4c188023828644281ef9abdf98e92 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Wed, 24 Jul 2019 22:08:50 +0800
Subject: [PATCH 1552/1835] xen/pciback: remove set but not used variable
 'old_state'

[ Upstream commit 09e088a4903bd0dd911b4f1732b250130cdaffed ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/xen/xen-pciback/conf_space_capability.c: In function pm_ctrl_write:
drivers/xen/xen-pciback/conf_space_capability.c:119:25: warning:
 variable old_state set but not used [-Wunused-but-set-variable]

It is never used so can be removed.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/xen-pciback/conf_space_capability.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
index 73427d8e01161..e5694133ebe57 100644
--- a/drivers/xen/xen-pciback/conf_space_capability.c
+++ b/drivers/xen/xen-pciback/conf_space_capability.c
@@ -116,13 +116,12 @@ static int pm_ctrl_write(struct pci_dev *dev, int offset, u16 new_value,
 {
 	int err;
 	u16 old_value;
-	pci_power_t new_state, old_state;
+	pci_power_t new_state;
 
 	err = pci_read_config_word(dev, offset, &old_value);
 	if (err)
 		goto out;
 
-	old_state = (pci_power_t)(old_value & PCI_PM_CTRL_STATE_MASK);
 	new_state = (pci_power_t)(new_value & PCI_PM_CTRL_STATE_MASK);
 
 	new_value &= PM_OK_BITS;
-- 
GitLab


From dcb73180de61454eef0b6a1d8f8ce6de32b53f9e Mon Sep 17 00:00:00 2001
From: Nianyao Tang <tangnianyao@huawei.com>
Date: Fri, 26 Jul 2019 17:32:57 +0800
Subject: [PATCH 1553/1835] irqchip/gic-v3-its: Free unused vpt_page when alloc
 vpe table fail

[ Upstream commit 34f8eb92ca053cbba2887bb7e4dbf2b2cd6eb733 ]

In its_vpe_init, when its_alloc_vpe_table fails, we should free
vpt_page allocated just before, instead of vpe->vpt_page.
Let's fix it.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Nianyao Tang <tangnianyao@huawei.com>
Signed-off-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v3-its.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index ee30e8965d1be..9ba73e11757d9 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2883,7 +2883,7 @@ static int its_vpe_init(struct its_vpe *vpe)
 
 	if (!its_alloc_vpe_table(vpe_id)) {
 		its_vpe_id_free(vpe_id);
-		its_free_pending_table(vpe->vpt_page);
+		its_free_pending_table(vpt_page);
 		return -ENOMEM;
 	}
 
-- 
GitLab


From a5e40452c916752c12127b53d3f3373c3d0af601 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 12 Jul 2019 15:29:05 +0200
Subject: [PATCH 1554/1835] irqchip/irq-imx-gpcv2: Forward irq type to parent

[ Upstream commit 9a446ef08f3bfc0c3deb9c6be840af2528ef8cf8 ]

The GPCv2 is a stacked IRQ controller below the ARM GIC. It doesn't
care about the IRQ type itself, but needs to forward the type to the
parent IRQ controller, so this one can be configured correctly.

Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-imx-gpcv2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 4760307ab43fc..cef8f5e2e8fce 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -131,6 +131,7 @@ static struct irq_chip gpcv2_irqchip_data_chip = {
 	.irq_unmask		= imx_gpcv2_irq_unmask,
 	.irq_set_wake		= imx_gpcv2_irq_set_wake,
 	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+	.irq_set_type		= irq_chip_set_type_parent,
 #ifdef CONFIG_SMP
 	.irq_set_affinity	= irq_chip_set_affinity_parent,
 #endif
-- 
GitLab


From ab5aa579ca82741013274ea8df1e5caed76d067e Mon Sep 17 00:00:00 2001
From: Vince Weaver <vincent.weaver@maine.edu>
Date: Tue, 23 Jul 2019 11:06:01 -0400
Subject: [PATCH 1555/1835] perf header: Fix divide by zero error if
 f_header.attr_size==0

[ Upstream commit 7622236ceb167aa3857395f9bdaf871442aa467e ]

So I have been having lots of trouble with hand-crafted perf.data files
causing segfaults and the like, so I have started fuzzing the perf tool.

First issue found:

If f_header.attr_size is 0 in the perf.data file, then perf will crash
with a divide-by-zero error.

Committer note:

Added a pr_err() to tell the user why the command failed.

Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1907231100440.14532@macbook-air
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/header.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index a94bd6850a0b2..4a5e1907a7ab3 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3285,6 +3285,13 @@ int perf_session__read_header(struct perf_session *session)
 			   data->file.path);
 	}
 
+	if (f_header.attr_size == 0) {
+		pr_err("ERROR: The %s file's attr size field is 0 which is unexpected.\n"
+		       "Was the 'perf record' command properly terminated?\n",
+		       data->file.path);
+		return -EINVAL;
+	}
+
 	nr_attrs = f_header.attrs.size / f_header.attr_size;
 	lseek(fd, f_header.attrs.offset, SEEK_SET);
 
-- 
GitLab


From 0a19fff567a07ce808f2daa27c3d8e842e62766a Mon Sep 17 00:00:00 2001
From: Numfor Mbiziwo-Tiapo <nums@google.com>
Date: Wed, 24 Jul 2019 16:44:58 -0700
Subject: [PATCH 1556/1835] perf header: Fix use of unitialized value warning

[ Upstream commit 20f9781f491360e7459c589705a2e4b1f136bee9 ]

When building our local version of perf with MSAN (Memory Sanitizer) and
running the perf record command, MSAN throws a use of uninitialized
value warning in "tools/perf/util/util.c:333:6".

This warning stems from the "buf" variable being passed into "write".
It originated as the variable "ev" with the type union perf_event*
defined in the "perf_event__synthesize_attr" function in
"tools/perf/util/header.c".

In the "perf_event__synthesize_attr" function they allocate space with a malloc
call using ev, then go on to only assign some of the member variables before
passing "ev" on as a parameter to the "process" function therefore "ev"
contains uninitialized memory. Changing the malloc call to zalloc to initialize
all the members of "ev" which gets rid of the warning.

To reproduce this warning, build perf by running:
make -C tools/perf CLANG=1 CC=clang EXTRA_CFLAGS="-fsanitize=memory\
 -fsanitize-memory-track-origins"

(Additionally, llvm might have to be installed and clang might have to
be specified as the compiler - export CC=/usr/bin/clang)

then running:
tools/perf/perf record -o - ls / | tools/perf/perf --no-pager annotate\
 -i - --stdio

Please see the cover letter for why false positive warnings may be
generated.

Signed-off-by: Numfor Mbiziwo-Tiapo <nums@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Drayton <mbd@fb.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/r/20190724234500.253358-2-nums@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/header.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 4a5e1907a7ab3..54c34c107cab5 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3372,7 +3372,7 @@ int perf_event__synthesize_attr(struct perf_tool *tool,
 	size += sizeof(struct perf_event_header);
 	size += ids * sizeof(u64);
 
-	ev = malloc(size);
+	ev = zalloc(size);
 
 	if (ev == NULL)
 		return -ENOMEM;
-- 
GitLab


From f69fd790edf709cfdfdfc912c2f6fd7e498d1fed Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Mon, 29 Jul 2019 14:47:22 -0700
Subject: [PATCH 1557/1835] libata: zpodd: Fix small read overflow in
 zpodd_get_mech_type()

[ Upstream commit 71d6c505b4d9e6f76586350450e785e3d452b346 ]

Jeffrin reported a KASAN issue:

  BUG: KASAN: global-out-of-bounds in ata_exec_internal_sg+0x50f/0xc70
  Read of size 16 at addr ffffffff91f41f80 by task scsi_eh_1/149
  ...
  The buggy address belongs to the variable:
    cdb.48319+0x0/0x40

Much like commit 18c9a99bce2a ("libata: zpodd: small read overflow in
eject_tray()"), this fixes a cdb[] buffer length, this time in
zpodd_get_mech_type():

We read from the cdb[] buffer in ata_exec_internal_sg(). It has to be
ATAPI_CDB_LEN (16) bytes long, but this buffer is only 12 bytes.

Reported-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
Fixes: afe759511808c ("libata: identify and init ZPODD devices")
Link: https://lore.kernel.org/lkml/201907181423.E808958@keescook/
Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-zpodd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 173e6f2dd9af0..eefda51f97d35 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -56,7 +56,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
 	unsigned int ret;
 	struct rm_feature_desc *desc;
 	struct ata_taskfile tf;
-	static const char cdb[] = {  GPCMD_GET_CONFIGURATION,
+	static const char cdb[ATAPI_CDB_LEN] = {  GPCMD_GET_CONFIGURATION,
 			2,      /* only 1 feature descriptor requested */
 			0, 3,   /* 3, removable medium feature */
 			0, 0, 0,/* reserved */
-- 
GitLab


From 202aa96f052aa65d13a2e49f9c268ed124dbd648 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Mon, 29 Jul 2019 15:12:16 +0800
Subject: [PATCH 1558/1835] drm/bridge: lvds-encoder: Fix build error while
 CONFIG_DRM_KMS_HELPER=m

[ Upstream commit f4cc743a98136df3c3763050a0e8223b52d9a960 ]

If DRM_LVDS_ENCODER=y but CONFIG_DRM_KMS_HELPER=m,
build fails:

drivers/gpu/drm/bridge/lvds-encoder.o: In function `lvds_encoder_probe':
lvds-encoder.c:(.text+0x155): undefined reference to `devm_drm_panel_bridge_add'

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: dbb58bfd9ae6 ("drm/bridge: Fix lvds-encoder since the panel_bridge rework.")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190729071216.27488-1-yuehaibing@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index bf6cad6c9178b..7a3e5a8f6439b 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -46,6 +46,7 @@ config DRM_DUMB_VGA_DAC
 config DRM_LVDS_ENCODER
 	tristate "Transparent parallel to LVDS encoder support"
 	depends on OF
+	select DRM_KMS_HELPER
 	select DRM_PANEL_BRIDGE
 	help
 	  Support for transparent parallel to LVDS encoders that don't require
-- 
GitLab


From f833deae2a06bc33340da5769098490cb77dc8dc Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Mon, 29 Jul 2019 09:37:10 +0100
Subject: [PATCH 1559/1835] Btrfs: fix deadlock between fiemap and transaction
 commits

[ Upstream commit a6d155d2e363f26290ffd50591169cb96c2a609e ]

The fiemap handler locks a file range that can have unflushed delalloc,
and after locking the range, it tries to attach to a running transaction.
If the running transaction started its commit, that is, it is in state
TRANS_STATE_COMMIT_START, and either the filesystem was mounted with the
flushoncommit option or the transaction is creating a snapshot for the
subvolume that contains the file that fiemap is operating on, we end up
deadlocking. This happens because fiemap is blocked on the transaction,
waiting for it to complete, and the transaction is waiting for the flushed
dealloc to complete, which requires locking the file range that the fiemap
task already locked. The following stack traces serve as an example of
when this deadlock happens:

  (...)
  [404571.515510] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs]
  [404571.515956] Call Trace:
  [404571.516360]  ? __schedule+0x3ae/0x7b0
  [404571.516730]  schedule+0x3a/0xb0
  [404571.517104]  lock_extent_bits+0x1ec/0x2a0 [btrfs]
  [404571.517465]  ? remove_wait_queue+0x60/0x60
  [404571.517832]  btrfs_finish_ordered_io+0x292/0x800 [btrfs]
  [404571.518202]  normal_work_helper+0xea/0x530 [btrfs]
  [404571.518566]  process_one_work+0x21e/0x5c0
  [404571.518990]  worker_thread+0x4f/0x3b0
  [404571.519413]  ? process_one_work+0x5c0/0x5c0
  [404571.519829]  kthread+0x103/0x140
  [404571.520191]  ? kthread_create_worker_on_cpu+0x70/0x70
  [404571.520565]  ret_from_fork+0x3a/0x50
  [404571.520915] kworker/u8:6    D    0 31651      2 0x80004000
  [404571.521290] Workqueue: btrfs-flush_delalloc btrfs_flush_delalloc_helper [btrfs]
  (...)
  [404571.537000] fsstress        D    0 13117  13115 0x00004000
  [404571.537263] Call Trace:
  [404571.537524]  ? __schedule+0x3ae/0x7b0
  [404571.537788]  schedule+0x3a/0xb0
  [404571.538066]  wait_current_trans+0xc8/0x100 [btrfs]
  [404571.538349]  ? remove_wait_queue+0x60/0x60
  [404571.538680]  start_transaction+0x33c/0x500 [btrfs]
  [404571.539076]  btrfs_check_shared+0xa3/0x1f0 [btrfs]
  [404571.539513]  ? extent_fiemap+0x2ce/0x650 [btrfs]
  [404571.539866]  extent_fiemap+0x2ce/0x650 [btrfs]
  [404571.540170]  do_vfs_ioctl+0x526/0x6f0
  [404571.540436]  ksys_ioctl+0x70/0x80
  [404571.540734]  __x64_sys_ioctl+0x16/0x20
  [404571.540997]  do_syscall_64+0x60/0x1d0
  [404571.541279]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  (...)
  [404571.543729] btrfs           D    0 14210  14208 0x00004000
  [404571.544023] Call Trace:
  [404571.544275]  ? __schedule+0x3ae/0x7b0
  [404571.544526]  ? wait_for_completion+0x112/0x1a0
  [404571.544795]  schedule+0x3a/0xb0
  [404571.545064]  schedule_timeout+0x1ff/0x390
  [404571.545351]  ? lock_acquire+0xa6/0x190
  [404571.545638]  ? wait_for_completion+0x49/0x1a0
  [404571.545890]  ? wait_for_completion+0x112/0x1a0
  [404571.546228]  wait_for_completion+0x131/0x1a0
  [404571.546503]  ? wake_up_q+0x70/0x70
  [404571.546775]  btrfs_wait_ordered_extents+0x27c/0x400 [btrfs]
  [404571.547159]  btrfs_commit_transaction+0x3b0/0xae0 [btrfs]
  [404571.547449]  ? btrfs_mksubvol+0x4a4/0x640 [btrfs]
  [404571.547703]  ? remove_wait_queue+0x60/0x60
  [404571.547969]  btrfs_mksubvol+0x605/0x640 [btrfs]
  [404571.548226]  ? __sb_start_write+0xd4/0x1c0
  [404571.548512]  ? mnt_want_write_file+0x24/0x50
  [404571.548789]  btrfs_ioctl_snap_create_transid+0x169/0x1a0 [btrfs]
  [404571.549048]  btrfs_ioctl_snap_create_v2+0x11d/0x170 [btrfs]
  [404571.549307]  btrfs_ioctl+0x133f/0x3150 [btrfs]
  [404571.549549]  ? mem_cgroup_charge_statistics+0x4c/0xd0
  [404571.549792]  ? mem_cgroup_commit_charge+0x84/0x4b0
  [404571.550064]  ? __handle_mm_fault+0xe3e/0x11f0
  [404571.550306]  ? do_raw_spin_unlock+0x49/0xc0
  [404571.550608]  ? _raw_spin_unlock+0x24/0x30
  [404571.550976]  ? __handle_mm_fault+0xedf/0x11f0
  [404571.551319]  ? do_vfs_ioctl+0xa2/0x6f0
  [404571.551659]  ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
  [404571.552087]  do_vfs_ioctl+0xa2/0x6f0
  [404571.552355]  ksys_ioctl+0x70/0x80
  [404571.552621]  __x64_sys_ioctl+0x16/0x20
  [404571.552864]  do_syscall_64+0x60/0x1d0
  [404571.553104]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  (...)

If we were joining the transaction instead of attaching to it, we would
not risk a deadlock because a join only blocks if the transaction is in a
state greater then or equals to TRANS_STATE_COMMIT_DOING, and the delalloc
flush performed by a transaction is done before it reaches that state,
when it is in the state TRANS_STATE_COMMIT_START. However a transaction
join is intended for use cases where we do modify the filesystem, and
fiemap only needs to peek at delayed references from the current
transaction in order to determine if extents are shared, and, besides
that, when there is no current transaction or when it blocks to wait for
a current committing transaction to complete, it creates a new transaction
without reserving any space. Such unnecessary transactions, besides doing
unnecessary IO, can cause transaction aborts (-ENOSPC) and unnecessary
rotation of the precious backup roots.

So fix this by adding a new transaction join variant, named join_nostart,
which behaves like the regular join, but it does not create a transaction
when none currently exists or after waiting for a committing transaction
to complete.

Fixes: 03628cdbc64db6 ("Btrfs: do not start a transaction during fiemap")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/backref.c     |  2 +-
 fs/btrfs/transaction.c | 22 ++++++++++++++++++----
 fs/btrfs/transaction.h |  3 +++
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index ac6c383d63140..19855659f6503 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1485,7 +1485,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
 		goto out;
 	}
 
-	trans = btrfs_attach_transaction(root);
+	trans = btrfs_join_transaction_nostart(root);
 	if (IS_ERR(trans)) {
 		if (PTR_ERR(trans) != -ENOENT && PTR_ERR(trans) != -EROFS) {
 			ret = PTR_ERR(trans);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index f1ca53a3ff0bf..26317bca56499 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -28,15 +28,18 @@ static const unsigned int btrfs_blocked_trans_types[TRANS_STATE_MAX] = {
 	[TRANS_STATE_COMMIT_START]	= (__TRANS_START | __TRANS_ATTACH),
 	[TRANS_STATE_COMMIT_DOING]	= (__TRANS_START |
 					   __TRANS_ATTACH |
-					   __TRANS_JOIN),
+					   __TRANS_JOIN |
+					   __TRANS_JOIN_NOSTART),
 	[TRANS_STATE_UNBLOCKED]		= (__TRANS_START |
 					   __TRANS_ATTACH |
 					   __TRANS_JOIN |
-					   __TRANS_JOIN_NOLOCK),
+					   __TRANS_JOIN_NOLOCK |
+					   __TRANS_JOIN_NOSTART),
 	[TRANS_STATE_COMPLETED]		= (__TRANS_START |
 					   __TRANS_ATTACH |
 					   __TRANS_JOIN |
-					   __TRANS_JOIN_NOLOCK),
+					   __TRANS_JOIN_NOLOCK |
+					   __TRANS_JOIN_NOSTART),
 };
 
 void btrfs_put_transaction(struct btrfs_transaction *transaction)
@@ -531,7 +534,8 @@ again:
 		ret = join_transaction(fs_info, type);
 		if (ret == -EBUSY) {
 			wait_current_trans(fs_info);
-			if (unlikely(type == TRANS_ATTACH))
+			if (unlikely(type == TRANS_ATTACH ||
+				     type == TRANS_JOIN_NOSTART))
 				ret = -ENOENT;
 		}
 	} while (ret == -EBUSY);
@@ -647,6 +651,16 @@ struct btrfs_trans_handle *btrfs_join_transaction_nolock(struct btrfs_root *root
 				 BTRFS_RESERVE_NO_FLUSH, true);
 }
 
+/*
+ * Similar to regular join but it never starts a transaction when none is
+ * running or after waiting for the current one to finish.
+ */
+struct btrfs_trans_handle *btrfs_join_transaction_nostart(struct btrfs_root *root)
+{
+	return start_transaction(root, 0, TRANS_JOIN_NOSTART,
+				 BTRFS_RESERVE_NO_FLUSH, true);
+}
+
 /*
  * btrfs_attach_transaction() - catch the running transaction
  *
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 4cbb1b55387dc..c1d34cc704722 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -97,11 +97,13 @@ struct btrfs_transaction {
 #define __TRANS_JOIN		(1U << 11)
 #define __TRANS_JOIN_NOLOCK	(1U << 12)
 #define __TRANS_DUMMY		(1U << 13)
+#define __TRANS_JOIN_NOSTART	(1U << 14)
 
 #define TRANS_START		(__TRANS_START | __TRANS_FREEZABLE)
 #define TRANS_ATTACH		(__TRANS_ATTACH)
 #define TRANS_JOIN		(__TRANS_JOIN | __TRANS_FREEZABLE)
 #define TRANS_JOIN_NOLOCK	(__TRANS_JOIN_NOLOCK)
+#define TRANS_JOIN_NOSTART	(__TRANS_JOIN_NOSTART)
 
 #define TRANS_EXTWRITERS	(__TRANS_START | __TRANS_ATTACH)
 
@@ -187,6 +189,7 @@ struct btrfs_trans_handle *btrfs_start_transaction_fallback_global_rsv(
 					int min_factor);
 struct btrfs_trans_handle *btrfs_join_transaction(struct btrfs_root *root);
 struct btrfs_trans_handle *btrfs_join_transaction_nolock(struct btrfs_root *root);
+struct btrfs_trans_handle *btrfs_join_transaction_nostart(struct btrfs_root *root);
 struct btrfs_trans_handle *btrfs_attach_transaction(struct btrfs_root *root);
 struct btrfs_trans_handle *btrfs_attach_transaction_barrier(
 					struct btrfs_root *root);
-- 
GitLab


From 3435e025ed71f4b3243e0c5209e2669d79ceff96 Mon Sep 17 00:00:00 2001
From: Don Brace <don.brace@microsemi.com>
Date: Wed, 24 Jul 2019 17:08:06 -0500
Subject: [PATCH 1560/1835] scsi: hpsa: correct scsi command status issue after
 reset

[ Upstream commit eeebce1862970653cdf5c01e98bc669edd8f529a ]

Reviewed-by: Bader Ali - Saleh <bader.alisaleh@microsemi.com>
Reviewed-by: Scott Teel <scott.teel@microsemi.com>
Reviewed-by: Scott Benesh <scott.benesh@microsemi.com>
Reviewed-by: Kevin Barnett <kevin.barnett@microsemi.com>
Signed-off-by: Don Brace <don.brace@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/hpsa.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index c43eccdea65d2..f570b8c5d857c 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2320,6 +2320,8 @@ static int handle_ioaccel_mode2_error(struct ctlr_info *h,
 	case IOACCEL2_SERV_RESPONSE_COMPLETE:
 		switch (c2->error_data.status) {
 		case IOACCEL2_STATUS_SR_TASK_COMP_GOOD:
+			if (cmd)
+				cmd->result = 0;
 			break;
 		case IOACCEL2_STATUS_SR_TASK_COMP_CHK_COND:
 			cmd->result |= SAM_STAT_CHECK_CONDITION;
@@ -2479,8 +2481,10 @@ static void process_ioaccel2_completion(struct ctlr_info *h,
 
 	/* check for good status */
 	if (likely(c2->error_data.serv_response == 0 &&
-			c2->error_data.status == 0))
+			c2->error_data.status == 0)) {
+		cmd->result = 0;
 		return hpsa_cmd_free_and_done(h, c, cmd);
+	}
 
 	/*
 	 * Any RAID offload error results in retry which will use
@@ -5617,6 +5621,12 @@ static int hpsa_scsi_queue_command(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
 	}
 	c = cmd_tagged_alloc(h, cmd);
 
+	/*
+	 * This is necessary because the SML doesn't zero out this field during
+	 * error recovery.
+	 */
+	cmd->result = 0;
+
 	/*
 	 * Call alternate submit routine for I/O accelerated commands.
 	 * Retries always go down the normal I/O path.
-- 
GitLab


From 02d4fe0193d569ecce9dfa9e45b10f98521df472 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Mon, 29 Jul 2019 16:44:51 +0800
Subject: [PATCH 1561/1835] scsi: qla2xxx: Fix possible fcport null-pointer
 dereferences

[ Upstream commit e82f04ec6ba91065fd33a6201ffd7cab840e1475 ]

In qla2x00_alloc_fcport(), fcport is assigned to NULL in the error
handling code on line 4880:
    fcport = NULL;

Then fcport is used on lines 4883-4886:
    INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn);
	INIT_WORK(&fcport->reg_work, qla_register_fcport_fn);
	INIT_LIST_HEAD(&fcport->gnl_entry);
	INIT_LIST_HEAD(&fcport->list);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, qla2x00_alloc_fcport() directly returns NULL
in the error handling code.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index f84f9bf150278..ddce32fe0513a 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -4732,7 +4732,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
 		ql_log(ql_log_warn, vha, 0xd049,
 		    "Failed to allocate ct_sns request.\n");
 		kfree(fcport);
-		fcport = NULL;
+		return NULL;
 	}
 	INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn);
 	INIT_LIST_HEAD(&fcport->gnl_entry);
-- 
GitLab


From 68340db992f6704b86a27e3f9f91d44ce1c8cb31 Mon Sep 17 00:00:00 2001
From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Date: Sat, 27 Jul 2019 17:30:30 +0800
Subject: [PATCH 1562/1835] drm/amdgpu: fix a potential information leaking bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 929e571c04c285861e0bb049a396a2bdaea63282 ]

Coccinelle reports a path that the array "data" is never initialized.
The path skips the checks in the conditional branches when either
of callback functions, read_wave_vgprs and read_wave_sgprs, is not
registered. Later, the uninitialized "data" array is read
in the while-loop below and passed to put_user().

Fix the path by allocating the array with kcalloc().

The patch is simplier than adding a fall-back branch that explicitly
calls memset(data, 0, ...). Also it does not need the multiplication
1024*sizeof(*data) as the size parameter for memset() though there is
no risk of integer overflow.

Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index f5fb93795a69a..65cecfdd9b454 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -707,7 +707,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
 	thread = (*pos & GENMASK_ULL(59, 52)) >> 52;
 	bank = (*pos & GENMASK_ULL(61, 60)) >> 60;
 
-	data = kmalloc_array(1024, sizeof(*data), GFP_KERNEL);
+	data = kcalloc(1024, sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
-- 
GitLab


From 23bc01f0d95508be2407ebf65616d73a9dbfb381 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 31 Jul 2019 14:26:51 +0200
Subject: [PATCH 1563/1835] ata: libahci: do not complain in case of deferred
 probe

[ Upstream commit 090bb803708198e5ab6b0046398c7ed9f4d12d6b ]

Retrieving PHYs can defer the probe, do not spawn an error when
-EPROBE_DEFER is returned, it is normal behavior.

Fixes: b1a9edbda040 ("ata: libahci: allow to use multiple PHYs")
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libahci_platform.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index c92c10d553746..5bece9752ed68 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -313,6 +313,9 @@ static int ahci_platform_get_phy(struct ahci_host_priv *hpriv, u32 port,
 		hpriv->phys[port] = NULL;
 		rc = 0;
 		break;
+	case -EPROBE_DEFER:
+		/* Do not complain yet */
+		break;
 
 	default:
 		dev_err(dev,
-- 
GitLab


From b3aebdd46d633d542badfb0d680eb491a001bf90 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Wed, 31 Jul 2019 00:59:00 +0900
Subject: [PATCH 1564/1835] kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only
 for external modules

[ Upstream commit cb4819934a7f9b87876f11ed05b8624c0114551b ]

KBUILD_EXTRA_SYMBOLS makes sense only when building external modules.
Moreover, the modpost sets 'external_module' if the -e option is given.

I replaced $(patsubst %, -e %,...) with simpler $(addprefix -e,...)
while I was here.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/Makefile.modpost | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index 7d4af0d0accb3..51884c7b80697 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -75,7 +75,7 @@ modpost = scripts/mod/modpost                    \
  $(if $(CONFIG_MODULE_SRCVERSION_ALL),-a,)       \
  $(if $(KBUILD_EXTMOD),-i,-o) $(kernelsymfile)   \
  $(if $(KBUILD_EXTMOD),-I $(modulesymfile))      \
- $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \
+ $(if $(KBUILD_EXTMOD),$(addprefix -e ,$(KBUILD_EXTRA_SYMBOLS))) \
  $(if $(KBUILD_EXTMOD),-o $(modulesymfile))      \
  $(if $(CONFIG_DEBUG_SECTION_MISMATCH),,-S)      \
  $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E)  \
-- 
GitLab


From 48522289bf50cdeab90ef2c5cc6e998c513e2a4c Mon Sep 17 00:00:00 2001
From: Stephen Boyd <swboyd@chromium.org>
Date: Tue, 30 Jul 2019 09:48:03 -0700
Subject: [PATCH 1565/1835] kbuild: Check for unknown options with cc-option
 usage in Kconfig and clang

[ Upstream commit e8de12fb7cde2c85bc31097cd098da79a4818305 ]

If the particular version of clang a user has doesn't enable
-Werror=unknown-warning-option by default, even though it is the
default[1], then make sure to pass the option to the Kconfig cc-option
command so that testing options from Kconfig files works properly.
Otherwise, depending on the default values setup in the clang toolchain
we will silently assume options such as -Wmaybe-uninitialized are
supported by clang, when they really aren't.

A compilation issue only started happening for me once commit
589834b3a009 ("kbuild: Add -Werror=unknown-warning-option to
CLANG_FLAGS") was applied on top of commit b303c6df80c9 ("kbuild:
compute false-positive -Wmaybe-uninitialized cases in Kconfig"). This
leads kbuild to try and test for the existence of the
-Wmaybe-uninitialized flag with the cc-option command in
scripts/Kconfig.include, and it doesn't see an error returned from the
option test so it sets the config value to Y. Then the Makefile tries to
pass the unknown option on the command line and
-Werror=unknown-warning-option catches the invalid option and breaks the
build. Before commit 589834b3a009 ("kbuild: Add
-Werror=unknown-warning-option to CLANG_FLAGS") the build works fine,
but any cc-option test of a warning option in Kconfig files silently
evaluates to true, even if the warning option flag isn't supported on
clang.

Note: This doesn't change cc-option usages in Makefiles because those
use a different rule that includes KBUILD_CFLAGS by default (see the
__cc-option command in scripts/Kbuild.incluide). The KBUILD_CFLAGS
variable already has the -Werror=unknown-warning-option flag set. Thanks
to Doug for pointing out the different rule.

[1] https://clang.llvm.org/docs/DiagnosticsReference.html#wunknown-warning-option
Cc: Peter Smith <peter.smith@linaro.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/Kconfig.include | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
index dad5583451afb..3b2861f47709b 100644
--- a/scripts/Kconfig.include
+++ b/scripts/Kconfig.include
@@ -20,7 +20,7 @@ success = $(if-success,$(1),y,n)
 
 # $(cc-option,<flag>)
 # Return y if the compiler supports <flag>, n otherwise
-cc-option = $(success,$(CC) -Werror $(1) -E -x c /dev/null -o /dev/null)
+cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -E -x c /dev/null -o /dev/null)
 
 # $(ld-option,<flag>)
 # Return y if the linker supports <flag>, n otherwise
-- 
GitLab


From ffb1a76d1c29435e0c1e0ca16fd21bb37969ae60 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Tue, 30 Jul 2019 17:23:48 -0400
Subject: [PATCH 1566/1835] arm64/efi: fix variable 'si' set but not used

[ Upstream commit f1d4836201543e88ebe70237e67938168d5fab19 ]

GCC throws out this warning on arm64.

drivers/firmware/efi/libstub/arm-stub.c: In function 'efi_entry':
drivers/firmware/efi/libstub/arm-stub.c:132:22: warning: variable 'si'
set but not used [-Wunused-but-set-variable]

Fix it by making free_screen_info() a static inline function.

Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/efi.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
index 7ed320895d1f4..f52a2968a3b69 100644
--- a/arch/arm64/include/asm/efi.h
+++ b/arch/arm64/include/asm/efi.h
@@ -94,7 +94,11 @@ static inline unsigned long efi_get_max_initrd_addr(unsigned long dram_base,
 	((protocol##_t *)instance)->f(instance, ##__VA_ARGS__)
 
 #define alloc_screen_info(x...)		&screen_info
-#define free_screen_info(x...)
+
+static inline void free_screen_info(efi_system_table_t *sys_table_arg,
+				    struct screen_info *si)
+{
+}
 
 /* redeclare as 'hidden' so the compiler will generate relative references */
 extern struct screen_info screen_info __attribute__((__visibility__("hidden")));
-- 
GitLab


From 6af9263f685d8ae3fc93ba8a19eb586e5d387b23 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Thu, 25 Jul 2019 17:16:05 +0900
Subject: [PATCH 1567/1835] arm64: unwind: Prohibit probing on return_address()

[ Upstream commit ee07b93e7721ccd5d5b9fa6f0c10cb3fe2f1f4f9 ]

Prohibit probing on return_address() and subroutines which
is called from return_address(), since the it is invoked from
trace_hardirqs_off() which is also kprobe blacklisted.

Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/return_address.c | 3 +++
 arch/arm64/kernel/stacktrace.c     | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/arch/arm64/kernel/return_address.c b/arch/arm64/kernel/return_address.c
index 933adbc0f654d..0311fe52c8ffb 100644
--- a/arch/arm64/kernel/return_address.c
+++ b/arch/arm64/kernel/return_address.c
@@ -11,6 +11,7 @@
 
 #include <linux/export.h>
 #include <linux/ftrace.h>
+#include <linux/kprobes.h>
 
 #include <asm/stack_pointer.h>
 #include <asm/stacktrace.h>
@@ -32,6 +33,7 @@ static int save_return_addr(struct stackframe *frame, void *d)
 		return 0;
 	}
 }
+NOKPROBE_SYMBOL(save_return_addr);
 
 void *return_address(unsigned int level)
 {
@@ -55,3 +57,4 @@ void *return_address(unsigned int level)
 		return NULL;
 }
 EXPORT_SYMBOL_GPL(return_address);
+NOKPROBE_SYMBOL(return_address);
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 4989f7ea1e599..bb482ec044b61 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -18,6 +18,7 @@
 #include <linux/kernel.h>
 #include <linux/export.h>
 #include <linux/ftrace.h>
+#include <linux/kprobes.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
 #include <linux/sched/task_stack.h>
@@ -85,6 +86,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
 
 	return 0;
 }
+NOKPROBE_SYMBOL(unwind_frame);
 
 void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
 		     int (*fn)(struct stackframe *, void *), void *data)
@@ -99,6 +101,7 @@ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
 			break;
 	}
 }
+NOKPROBE_SYMBOL(walk_stackframe);
 
 #ifdef CONFIG_STACKTRACE
 struct stack_trace_data {
-- 
GitLab


From 4a0d2eeea27a868c7a3288fe96607580f27ed84e Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Wed, 31 Jul 2019 16:05:45 -0400
Subject: [PATCH 1568/1835] arm64/mm: fix variable 'pud' set but not used

[ Upstream commit 7d4e2dcf311d3b98421d1f119efe5964cafa32fc ]

GCC throws a warning,

arch/arm64/mm/mmu.c: In function 'pud_free_pmd_page':
arch/arm64/mm/mmu.c:1033:8: warning: variable 'pud' set but not used
[-Wunused-but-set-variable]
  pud_t pud;
        ^~~

because pud_table() is a macro and compiled away. Fix it by making it a
static inline function and for pud_sect() as well.

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/pgtable.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index ea423db393644..2214a403f39b9 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -419,8 +419,8 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 				 PMD_TYPE_SECT)
 
 #if defined(CONFIG_ARM64_64K_PAGES) || CONFIG_PGTABLE_LEVELS < 3
-#define pud_sect(pud)		(0)
-#define pud_table(pud)		(1)
+static inline bool pud_sect(pud_t pud) { return false; }
+static inline bool pud_table(pud_t pud) { return true; }
 #else
 #define pud_sect(pud)		((pud_val(pud) & PUD_TYPE_MASK) == \
 				 PUD_TYPE_SECT)
-- 
GitLab


From efb742ce4e27be7740157e0c83a74c2cbafa23d7 Mon Sep 17 00:00:00 2001
From: "Luck, Tony" <tony.luck@intel.com>
Date: Tue, 30 Jul 2019 21:39:57 -0700
Subject: [PATCH 1569/1835] IB/core: Add mitigation for Spectre V1

[ Upstream commit 61f259821dd3306e49b7d42a3f90fb5a4ff3351b ]

Some processors may mispredict an array bounds check and
speculatively access memory that they should not. With
a user supplied array index we like to play things safe
by masking the value with the array size before it is
used as an index.

Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/20190731043957.GA1600@agluck-desk2.amr.corp.intel.com
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/user_mad.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index c34a6852d691f..a18f3f8ad77fe 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -49,6 +49,7 @@
 #include <linux/sched.h>
 #include <linux/semaphore.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 
@@ -868,11 +869,14 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)
 
 	if (get_user(id, arg))
 		return -EFAULT;
+	if (id >= IB_UMAD_MAX_AGENTS)
+		return -EINVAL;
 
 	mutex_lock(&file->port->file_mutex);
 	mutex_lock(&file->mutex);
 
-	if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
+	id = array_index_nospec(id, IB_UMAD_MAX_AGENTS);
+	if (!__get_agent(file, id)) {
 		ret = -EINVAL;
 		goto out;
 	}
-- 
GitLab


From a0258ff4993f263c0943f6e6411e483c1a83c9e6 Mon Sep 17 00:00:00 2001
From: Guy Levi <guyle@mellanox.com>
Date: Wed, 31 Jul 2019 11:19:29 +0300
Subject: [PATCH 1570/1835] IB/mlx5: Fix MR registration flow to use UMR
 properly

[ Upstream commit e5366d309a772fef264ec85e858f9ea46f939848 ]

Driver shouldn't allow to use UMR to register a MR when
umr_modify_atomic_disabled is set. Otherwise it will always end up with a
failure in the post send flow which sets the UMR WQE to modify atomic access
right.

Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities")
Signed-off-by: Guy Levi <guyle@mellanox.com>
Reviewed-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Link: https://lore.kernel.org/r/20190731081929.32559-1-leon@kernel.org
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/mr.c | 27 +++++++++------------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 9bab4fb65c688..bd1fdadf7ba01 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -51,22 +51,12 @@ static void clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static int mr_cache_max_order(struct mlx5_ib_dev *dev);
 static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
-static bool umr_can_modify_entity_size(struct mlx5_ib_dev *dev)
-{
-	return !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled);
-}
 
 static bool umr_can_use_indirect_mkey(struct mlx5_ib_dev *dev)
 {
 	return !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled);
 }
 
-static bool use_umr(struct mlx5_ib_dev *dev, int order)
-{
-	return order <= mr_cache_max_order(dev) &&
-		umr_can_modify_entity_size(dev);
-}
-
 static int destroy_mkey(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
 	int err = mlx5_core_destroy_mkey(dev->mdev, &mr->mmkey);
@@ -1305,7 +1295,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 {
 	struct mlx5_ib_dev *dev = to_mdev(pd->device);
 	struct mlx5_ib_mr *mr = NULL;
-	bool populate_mtts = false;
+	bool use_umr;
 	struct ib_umem *umem;
 	int page_shift;
 	int npages;
@@ -1338,29 +1328,30 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	if (err < 0)
 		return ERR_PTR(err);
 
-	if (use_umr(dev, order)) {
+	use_umr = !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled) &&
+		  (!MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled) ||
+		   !MLX5_CAP_GEN(dev->mdev, atomic));
+
+	if (order <= mr_cache_max_order(dev) && use_umr) {
 		mr = alloc_mr_from_cache(pd, umem, virt_addr, length, ncont,
 					 page_shift, order, access_flags);
 		if (PTR_ERR(mr) == -EAGAIN) {
 			mlx5_ib_dbg(dev, "cache empty for order %d\n", order);
 			mr = NULL;
 		}
-		populate_mtts = false;
 	} else if (!MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset)) {
 		if (access_flags & IB_ACCESS_ON_DEMAND) {
 			err = -EINVAL;
 			pr_err("Got MR registration for ODP MR > 512MB, not supported for Connect-IB\n");
 			goto error;
 		}
-		populate_mtts = true;
+		use_umr = false;
 	}
 
 	if (!mr) {
-		if (!umr_can_modify_entity_size(dev))
-			populate_mtts = true;
 		mutex_lock(&dev->slow_path_mutex);
 		mr = reg_create(NULL, pd, virt_addr, length, umem, ncont,
-				page_shift, access_flags, populate_mtts);
+				page_shift, access_flags, !use_umr);
 		mutex_unlock(&dev->slow_path_mutex);
 	}
 
@@ -1378,7 +1369,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	update_odp_mr(mr);
 #endif
 
-	if (!populate_mtts) {
+	if (use_umr) {
 		int update_xlt_flags = MLX5_IB_UPD_XLT_ENABLE;
 
 		if (access_flags & IB_ACCESS_ON_DEMAND)
-- 
GitLab


From b4f0fee7f77c258c315053941349e19498412a4b Mon Sep 17 00:00:00 2001
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date: Thu, 1 Aug 2019 15:14:49 +0300
Subject: [PATCH 1571/1835] IB/mad: Fix use-after-free in ib mad completion
 handling

[ Upstream commit 770b7d96cfff6a8bf6c9f261ba6f135dc9edf484 ]

We encountered a use-after-free bug when unloading the driver:

[ 3562.116059] BUG: KASAN: use-after-free in ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
[ 3562.117233] Read of size 4 at addr ffff8882ca5aa868 by task kworker/u13:2/23862
[ 3562.118385]
[ 3562.119519] CPU: 2 PID: 23862 Comm: kworker/u13:2 Tainted: G           OE     5.1.0-for-upstream-dbg-2019-05-19_16-44-30-13 #1
[ 3562.121806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014
[ 3562.123075] Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]
[ 3562.124383] Call Trace:
[ 3562.125640]  dump_stack+0x9a/0xeb
[ 3562.126911]  print_address_description+0xe3/0x2e0
[ 3562.128223]  ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
[ 3562.129545]  __kasan_report+0x15c/0x1df
[ 3562.130866]  ? ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
[ 3562.132174]  kasan_report+0xe/0x20
[ 3562.133514]  ib_mad_post_receive_mads+0xddc/0xed0 [ib_core]
[ 3562.134835]  ? find_mad_agent+0xa00/0xa00 [ib_core]
[ 3562.136158]  ? qlist_free_all+0x51/0xb0
[ 3562.137498]  ? mlx4_ib_sqp_comp_worker+0x1970/0x1970 [mlx4_ib]
[ 3562.138833]  ? quarantine_reduce+0x1fa/0x270
[ 3562.140171]  ? kasan_unpoison_shadow+0x30/0x40
[ 3562.141522]  ib_mad_recv_done+0xdf6/0x3000 [ib_core]
[ 3562.142880]  ? _raw_spin_unlock_irqrestore+0x46/0x70
[ 3562.144277]  ? ib_mad_send_done+0x1810/0x1810 [ib_core]
[ 3562.145649]  ? mlx4_ib_destroy_cq+0x2a0/0x2a0 [mlx4_ib]
[ 3562.147008]  ? _raw_spin_unlock_irqrestore+0x46/0x70
[ 3562.148380]  ? debug_object_deactivate+0x2b9/0x4a0
[ 3562.149814]  __ib_process_cq+0xe2/0x1d0 [ib_core]
[ 3562.151195]  ib_cq_poll_work+0x45/0xf0 [ib_core]
[ 3562.152577]  process_one_work+0x90c/0x1860
[ 3562.153959]  ? pwq_dec_nr_in_flight+0x320/0x320
[ 3562.155320]  worker_thread+0x87/0xbb0
[ 3562.156687]  ? __kthread_parkme+0xb6/0x180
[ 3562.158058]  ? process_one_work+0x1860/0x1860
[ 3562.159429]  kthread+0x320/0x3e0
[ 3562.161391]  ? kthread_park+0x120/0x120
[ 3562.162744]  ret_from_fork+0x24/0x30
...
[ 3562.187615] Freed by task 31682:
[ 3562.188602]  save_stack+0x19/0x80
[ 3562.189586]  __kasan_slab_free+0x11d/0x160
[ 3562.190571]  kfree+0xf5/0x2f0
[ 3562.191552]  ib_mad_port_close+0x200/0x380 [ib_core]
[ 3562.192538]  ib_mad_remove_device+0xf0/0x230 [ib_core]
[ 3562.193538]  remove_client_context+0xa6/0xe0 [ib_core]
[ 3562.194514]  disable_device+0x14e/0x260 [ib_core]
[ 3562.195488]  __ib_unregister_device+0x79/0x150 [ib_core]
[ 3562.196462]  ib_unregister_device+0x21/0x30 [ib_core]
[ 3562.197439]  mlx4_ib_remove+0x162/0x690 [mlx4_ib]
[ 3562.198408]  mlx4_remove_device+0x204/0x2c0 [mlx4_core]
[ 3562.199381]  mlx4_unregister_interface+0x49/0x1d0 [mlx4_core]
[ 3562.200356]  mlx4_ib_cleanup+0xc/0x1d [mlx4_ib]
[ 3562.201329]  __x64_sys_delete_module+0x2d2/0x400
[ 3562.202288]  do_syscall_64+0x95/0x470
[ 3562.203277]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The problem was that the MAD PD was deallocated before the MAD CQ.
There was completion work pending for the CQ when the PD got deallocated.
When the mad completion handling reached procedure
ib_mad_post_receive_mads(), we got a use-after-free bug in the following
line of code in that procedure:
   sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
(the pd pointer in the above line is no longer valid, because the
pd has been deallocated).

We fix this by allocating the PD before the CQ in procedure
ib_mad_port_open(), and deallocating the PD after freeing the CQ
in procedure ib_mad_port_close().

Since the CQ completion work queue is flushed during ib_free_cq(),
no completions will be pending for that CQ when the PD is later
deallocated.

Note that freeing the CQ before deallocating the PD is the practice
in the ULPs.

Fixes: 4be90bc60df4 ("IB/mad: Remove ib_get_dma_mr calls")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Link: https://lore.kernel.org/r/20190801121449.24973-1-leon@kernel.org
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/mad.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index ef459f2f2eeb8..7586c1dd73f19 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -3182,18 +3182,18 @@ static int ib_mad_port_open(struct ib_device *device,
 	if (has_smi)
 		cq_size *= 2;
 
+	port_priv->pd = ib_alloc_pd(device, 0);
+	if (IS_ERR(port_priv->pd)) {
+		dev_err(&device->dev, "Couldn't create ib_mad PD\n");
+		ret = PTR_ERR(port_priv->pd);
+		goto error3;
+	}
+
 	port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
 			IB_POLL_WORKQUEUE);
 	if (IS_ERR(port_priv->cq)) {
 		dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
 		ret = PTR_ERR(port_priv->cq);
-		goto error3;
-	}
-
-	port_priv->pd = ib_alloc_pd(device, 0);
-	if (IS_ERR(port_priv->pd)) {
-		dev_err(&device->dev, "Couldn't create ib_mad PD\n");
-		ret = PTR_ERR(port_priv->pd);
 		goto error4;
 	}
 
@@ -3236,11 +3236,11 @@ error8:
 error7:
 	destroy_mad_qp(&port_priv->qp_info[0]);
 error6:
-	ib_dealloc_pd(port_priv->pd);
-error4:
 	ib_free_cq(port_priv->cq);
 	cleanup_recv_queue(&port_priv->qp_info[1]);
 	cleanup_recv_queue(&port_priv->qp_info[0]);
+error4:
+	ib_dealloc_pd(port_priv->pd);
 error3:
 	kfree(port_priv);
 
@@ -3270,8 +3270,8 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
 	destroy_workqueue(port_priv->wq);
 	destroy_mad_qp(&port_priv->qp_info[1]);
 	destroy_mad_qp(&port_priv->qp_info[0]);
-	ib_dealloc_pd(port_priv->pd);
 	ib_free_cq(port_priv->cq);
+	ib_dealloc_pd(port_priv->pd);
 	cleanup_recv_queue(&port_priv->qp_info[1]);
 	cleanup_recv_queue(&port_priv->qp_info[0]);
 	/* XXX: Handle deallocation of MAD registration tables */
-- 
GitLab


From c256729f269521508a517bc5255a116c189700be Mon Sep 17 00:00:00 2001
From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Date: Wed, 26 Jun 2019 11:00:15 -0700
Subject: [PATCH 1572/1835] drm: msm: Fix add_gpu_components

[ Upstream commit 9ca7ad6c7706edeae331c1632d0c63897418ebad ]

add_gpu_components() adds found GPU nodes from the DT to the match list,
regardless of the status of the nodes.  This is a problem, because if the
nodes are disabled, they should not be on the match list because they will
not be matched.  This prevents display from initing if a GPU node is
defined, but it's status is disabled.

Fix this by checking the node's status before adding it to the match list.

Fixes: dc3ea265b856 (drm/msm: Drop the gpu binding)
Reviewed-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190626180015.45242-1-jeffrey.l.hugo@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index ed9a3a1e50efb..dbfd2c006f740 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -1284,7 +1284,8 @@ static int add_gpu_components(struct device *dev,
 	if (!np)
 		return 0;
 
-	drm_of_component_match_add(dev, matchptr, compare_of, np);
+	if (of_device_is_available(np))
+		drm_of_component_match_add(dev, matchptr, compare_of, np);
 
 	of_node_put(np);
 
-- 
GitLab


From cf9a18d7bcd067675afa3161836b2007893ea7a4 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Mon, 22 Jul 2019 23:25:35 +0100
Subject: [PATCH 1573/1835] drm/exynos: fix missing decrement of retry counter

[ Upstream commit 1bbbab097a05276e312dd2462791d32b21ceb1ee ]

Currently the retry counter is not being decremented, leading to a
potential infinite spin if the scalar_reads don't change state.

Addresses-Coverity: ("Infinite loop")
Fixes: 280e54c9f614 ("drm/exynos: scaler: Reset hardware before starting the operation")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/exynos/exynos_drm_scaler.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_scaler.c b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
index 0ddb6eec7b113..df228436a03d9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_scaler.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
@@ -108,12 +108,12 @@ static inline int scaler_reset(struct scaler_context *scaler)
 	scaler_write(SCALER_CFG_SOFT_RESET, SCALER_CFG);
 	do {
 		cpu_relax();
-	} while (retry > 1 &&
+	} while (--retry > 1 &&
 		 scaler_read(SCALER_CFG) & SCALER_CFG_SOFT_RESET);
 	do {
 		cpu_relax();
 		scaler_write(1, SCALER_INT_EN);
-	} while (retry > 0 && scaler_read(SCALER_INT_EN) != 1);
+	} while (--retry > 0 && scaler_read(SCALER_INT_EN) != 1);
 
 	return retry ? 0 : -EIO;
 }
-- 
GitLab


From 01d8d08f4cd41eba7f3e594def8df97c56342c2c Mon Sep 17 00:00:00 2001
From: Yang Shi <yang.shi@linux.alibaba.com>
Date: Fri, 2 Aug 2019 21:48:37 -0700
Subject: [PATCH 1574/1835] Revert "kmemleak: allow to coexist with fault
 injection"

[ Upstream commit df9576def004d2cd5beedc00cb6e8901427634b9 ]

When running ltp's oom test with kmemleak enabled, the below warning was
triggerred since kernel detects __GFP_NOFAIL & ~__GFP_DIRECT_RECLAIM is
passed in:

  WARNING: CPU: 105 PID: 2138 at mm/page_alloc.c:4608 __alloc_pages_nodemask+0x1c31/0x1d50
  Modules linked in: loop dax_pmem dax_pmem_core ip_tables x_tables xfs virtio_net net_failover virtio_blk failover ata_generic virtio_pci virtio_ring virtio libata
  CPU: 105 PID: 2138 Comm: oom01 Not tainted 5.2.0-next-20190710+ #7
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
  RIP: 0010:__alloc_pages_nodemask+0x1c31/0x1d50
  ...
   kmemleak_alloc+0x4e/0xb0
   kmem_cache_alloc+0x2a7/0x3e0
   mempool_alloc_slab+0x2d/0x40
   mempool_alloc+0x118/0x2b0
   bio_alloc_bioset+0x19d/0x350
   get_swap_bio+0x80/0x230
   __swap_writepage+0x5ff/0xb20

The mempool_alloc_slab() clears __GFP_DIRECT_RECLAIM, however kmemleak
has __GFP_NOFAIL set all the time due to d9570ee3bd1d4f2 ("kmemleak:
allow to coexist with fault injection").  But, it doesn't make any sense
to have __GFP_NOFAIL and ~__GFP_DIRECT_RECLAIM specified at the same
time.

According to the discussion on the mailing list, the commit should be
reverted for short term solution.  Catalin Marinas would follow up with
a better solution for longer term.

The failure rate of kmemleak metadata allocation may increase in some
circumstances, but this should be expected side effect.

Link: http://lkml.kernel.org/r/1563299431-111710-1-git-send-email-yang.shi@linux.alibaba.com
Fixes: d9570ee3bd1d4f2 ("kmemleak: allow to coexist with fault injection")
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Qian Cai <cai@lca.pw>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/kmemleak.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 6c94b6865ac22..5eeabece0c178 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -126,7 +126,7 @@
 /* GFP bitmask for kmemleak internal allocations */
 #define gfp_kmemleak_mask(gfp)	(((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
 				 __GFP_NORETRY | __GFP_NOMEMALLOC | \
-				 __GFP_NOWARN | __GFP_NOFAIL)
+				 __GFP_NOWARN)
 
 /* scanning area inside a memory block */
 struct kmemleak_scan_area {
-- 
GitLab


From 7113a1bc19fa1d5c2de1de98ad2076b7fc0a3b6d Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 2 Aug 2019 21:48:40 -0700
Subject: [PATCH 1575/1835] ocfs2: remove set but not used variable 'last_hash'

[ Upstream commit 7bc36e3ce91471b6377c8eadc0a2f220a2280083 ]

Fixes gcc '-Wunused-but-set-variable' warning:

  fs/ocfs2/xattr.c: In function ocfs2_xattr_bucket_find:
  fs/ocfs2/xattr.c:3828:6: warning: variable last_hash set but not used [-Wunused-but-set-variable]

It's never used and can be removed.

Link: http://lkml.kernel.org/r/20190716132110.34836-1-yuehaibing@huawei.com
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ocfs2/xattr.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 3a24ce3deb013..c146e12a8601f 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -3833,7 +3833,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
 	u16 blk_per_bucket = ocfs2_blocks_per_xattr_bucket(inode->i_sb);
 	int low_bucket = 0, bucket, high_bucket;
 	struct ocfs2_xattr_bucket *search;
-	u32 last_hash;
 	u64 blkno, lower_blkno = 0;
 
 	search = ocfs2_xattr_bucket_new(inode);
@@ -3877,8 +3876,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
 		if (xh->xh_count)
 			xe = &xh->xh_entries[le16_to_cpu(xh->xh_count) - 1];
 
-		last_hash = le32_to_cpu(xe->xe_name_hash);
-
 		/* record lower_blkno which may be the insert place. */
 		lower_blkno = blkno;
 
-- 
GitLab


From 0755b6b152cb4c677228089ca530e3834c708fcf Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Fri, 2 Aug 2019 21:49:19 -0700
Subject: [PATCH 1576/1835] asm-generic: fix -Wtype-limits compiler warnings

[ Upstream commit cbedfe11347fe418621bd188d58a206beb676218 ]

Commit d66acc39c7ce ("bitops: Optimise get_order()") introduced a
compilation warning because "rx_frag_size" is an "ushort" while
PAGE_SHIFT here is 16.

The commit changed the get_order() to be a multi-line macro where
compilers insist to check all statements in the macro even when
__builtin_constant_p(rx_frag_size) will return false as "rx_frag_size"
is a module parameter.

In file included from ./arch/powerpc/include/asm/page_64.h:107,
                 from ./arch/powerpc/include/asm/page.h:242,
                 from ./arch/powerpc/include/asm/mmu.h:132,
                 from ./arch/powerpc/include/asm/lppaca.h:47,
                 from ./arch/powerpc/include/asm/paca.h:17,
                 from ./arch/powerpc/include/asm/current.h:13,
                 from ./include/linux/thread_info.h:21,
                 from ./arch/powerpc/include/asm/processor.h:39,
                 from ./include/linux/prefetch.h:15,
                 from drivers/net/ethernet/emulex/benet/be_main.c:14:
drivers/net/ethernet/emulex/benet/be_main.c: In function 'be_rx_cqs_create':
./include/asm-generic/getorder.h:54:9: warning: comparison is always
true due to limited range of data type [-Wtype-limits]
   (((n) < (1UL << PAGE_SHIFT)) ? 0 :  \
         ^
drivers/net/ethernet/emulex/benet/be_main.c:3138:33: note: in expansion
of macro 'get_order'
  adapter->big_page_size = (1 << get_order(rx_frag_size)) * PAGE_SIZE;
                                 ^~~~~~~~~

Fix it by moving all of this multi-line macro into a proper function,
and killing __get_order() off.

[akpm@linux-foundation.org: remove __get_order() altogether]
[cai@lca.pw: v2]
  Link: http://lkml.kernel.org/r/1564000166-31428-1-git-send-email-cai@lca.pw
Link: http://lkml.kernel.org/r/1563914986-26502-1-git-send-email-cai@lca.pw
Fixes: d66acc39c7ce ("bitops: Optimise get_order()")
Signed-off-by: Qian Cai <cai@lca.pw>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Bill Wendling <morbo@google.com>
Cc: James Y Knight <jyknight@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/asm-generic/getorder.h | 50 ++++++++++++++--------------------
 1 file changed, 20 insertions(+), 30 deletions(-)

diff --git a/include/asm-generic/getorder.h b/include/asm-generic/getorder.h
index c64bea7a52beb..e9f20b813a699 100644
--- a/include/asm-generic/getorder.h
+++ b/include/asm-generic/getorder.h
@@ -7,24 +7,6 @@
 #include <linux/compiler.h>
 #include <linux/log2.h>
 
-/*
- * Runtime evaluation of get_order()
- */
-static inline __attribute_const__
-int __get_order(unsigned long size)
-{
-	int order;
-
-	size--;
-	size >>= PAGE_SHIFT;
-#if BITS_PER_LONG == 32
-	order = fls(size);
-#else
-	order = fls64(size);
-#endif
-	return order;
-}
-
 /**
  * get_order - Determine the allocation order of a memory size
  * @size: The size for which to get the order
@@ -43,19 +25,27 @@ int __get_order(unsigned long size)
  * to hold an object of the specified size.
  *
  * The result is undefined if the size is 0.
- *
- * This function may be used to initialise variables with compile time
- * evaluations of constants.
  */
-#define get_order(n)						\
-(								\
-	__builtin_constant_p(n) ? (				\
-		((n) == 0UL) ? BITS_PER_LONG - PAGE_SHIFT :	\
-		(((n) < (1UL << PAGE_SHIFT)) ? 0 :		\
-		 ilog2((n) - 1) - PAGE_SHIFT + 1)		\
-	) :							\
-	__get_order(n)						\
-)
+static inline __attribute_const__ int get_order(unsigned long size)
+{
+	if (__builtin_constant_p(size)) {
+		if (!size)
+			return BITS_PER_LONG - PAGE_SHIFT;
+
+		if (size < (1UL << PAGE_SHIFT))
+			return 0;
+
+		return ilog2((size) - 1) - PAGE_SHIFT + 1;
+	}
+
+	size--;
+	size >>= PAGE_SHIFT;
+#if BITS_PER_LONG == 32
+	return fls(size);
+#else
+	return fls64(size);
+#endif
+}
 
 #endif	/* __ASSEMBLY__ */
 
-- 
GitLab


From c8d95668c4caf845d2fa5e5a0c0df83cac00fc37 Mon Sep 17 00:00:00 2001
From: Anders Roxell <anders.roxell@linaro.org>
Date: Fri, 26 Jul 2019 13:27:05 +0200
Subject: [PATCH 1577/1835] arm64: KVM: regmap: Fix unexpected switch
 fall-through
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 3d584a3c85d6fe2cf878f220d4ad7145e7f89218 upstream.

When fall-through warnings was enabled by default, commit d93512ef0f0e
("Makefile: Globally enable fall-through warning"), the following
warnings was starting to show up:

In file included from ../arch/arm64/include/asm/kvm_emulate.h:19,
                 from ../arch/arm64/kvm/regmap.c:13:
../arch/arm64/kvm/regmap.c: In function ‘vcpu_write_spsr32’:
../arch/arm64/include/asm/kvm_hyp.h:31:3: warning: this statement may fall
 through [-Wimplicit-fallthrough=]
   asm volatile(ALTERNATIVE(__msr_s(r##nvh, "%x0"), \
   ^~~
../arch/arm64/include/asm/kvm_hyp.h:46:31: note: in expansion of macro ‘write_sysreg_elx’
 #define write_sysreg_el1(v,r) write_sysreg_elx(v, r, _EL1, _EL12)
                               ^~~~~~~~~~~~~~~~
../arch/arm64/kvm/regmap.c:180:3: note: in expansion of macro ‘write_sysreg_el1’
   write_sysreg_el1(v, SYS_SPSR);
   ^~~~~~~~~~~~~~~~
../arch/arm64/kvm/regmap.c:181:2: note: here
  case KVM_SPSR_ABT:
  ^~~~
In file included from ../arch/arm64/include/asm/cputype.h:132,
                 from ../arch/arm64/include/asm/cache.h:8,
                 from ../include/linux/cache.h:6,
                 from ../include/linux/printk.h:9,
                 from ../include/linux/kernel.h:15,
                 from ../include/asm-generic/bug.h:18,
                 from ../arch/arm64/include/asm/bug.h:26,
                 from ../include/linux/bug.h:5,
                 from ../include/linux/mmdebug.h:5,
                 from ../include/linux/mm.h:9,
                 from ../arch/arm64/kvm/regmap.c:11:
../arch/arm64/include/asm/sysreg.h:837:2: warning: this statement may fall
 through [-Wimplicit-fallthrough=]
  asm volatile("msr " __stringify(r) ", %x0"  \
  ^~~
../arch/arm64/kvm/regmap.c:182:3: note: in expansion of macro ‘write_sysreg’
   write_sysreg(v, spsr_abt);
   ^~~~~~~~~~~~
../arch/arm64/kvm/regmap.c:183:2: note: here
  case KVM_SPSR_UND:
  ^~~~

Rework to add a 'break;' in the swich-case since it didn't have that,
leading to an interresting set of bugs.

Cc: stable@vger.kernel.org # v4.17+
Fixes: a892819560c4 ("KVM: arm64: Prepare to handle deferred save/restore of 32-bit registers")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
[maz: reworked commit message, fixed stable range]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/regmap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/kvm/regmap.c b/arch/arm64/kvm/regmap.c
index 7a5173ea22764..4c2e96ef306ed 100644
--- a/arch/arm64/kvm/regmap.c
+++ b/arch/arm64/kvm/regmap.c
@@ -189,13 +189,18 @@ void vcpu_write_spsr32(struct kvm_vcpu *vcpu, unsigned long v)
 	switch (spsr_idx) {
 	case KVM_SPSR_SVC:
 		write_sysreg_el1(v, spsr);
+		break;
 	case KVM_SPSR_ABT:
 		write_sysreg(v, spsr_abt);
+		break;
 	case KVM_SPSR_UND:
 		write_sysreg(v, spsr_und);
+		break;
 	case KVM_SPSR_IRQ:
 		write_sysreg(v, spsr_irq);
+		break;
 	case KVM_SPSR_FIQ:
 		write_sysreg(v, spsr_fiq);
+		break;
 	}
 }
-- 
GitLab


From 8c7053d162d99d49fd929a1a7977acf704fa35a6 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Fri, 2 Aug 2019 10:28:32 +0100
Subject: [PATCH 1578/1835] KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about
 to block

commit 5eeaf10eec394b28fad2c58f1f5c3a5da0e87d1c upstream.

Since commit commit 328e56647944 ("KVM: arm/arm64: vgic: Defer
touching GICH_VMCR to vcpu_load/put"), we leave ICH_VMCR_EL2 (or
its GICv2 equivalent) loaded as long as we can, only syncing it
back when we're scheduled out.

There is a small snag with that though: kvm_vgic_vcpu_pending_irq(),
which is indirectly called from kvm_vcpu_check_block(), needs to
evaluate the guest's view of ICC_PMR_EL1. At the point were we
call kvm_vcpu_check_block(), the vcpu is still loaded, and whatever
changes to PMR is not visible in memory until we do a vcpu_put().

Things go really south if the guest does the following:

	mov x0, #0	// or any small value masking interrupts
	msr ICC_PMR_EL1, x0

	[vcpu preempted, then rescheduled, VMCR sampled]

	mov x0, #ff	// allow all interrupts
	msr ICC_PMR_EL1, x0
	wfi		// traps to EL2, so samping of VMCR

	[interrupt arrives just after WFI]

Here, the hypervisor's view of PMR is zero, while the guest has enabled
its interrupts. kvm_vgic_vcpu_pending_irq() will then say that no
interrupts are pending (despite an interrupt being received) and we'll
block for no reason. If the guest doesn't have a periodic interrupt
firing once it has blocked, it will stay there forever.

To avoid this unfortuante situation, let's resync VMCR from
kvm_arch_vcpu_blocking(), ensuring that a following kvm_vcpu_check_block()
will observe the latest value of PMR.

This has been found by booting an arm64 Linux guest with the pseudo NMI
feature, and thus using interrupt priorities to mask interrupts instead
of the usual PSTATE masking.

Cc: stable@vger.kernel.org # 4.12
Fixes: 328e56647944 ("KVM: arm/arm64: vgic: Defer touching GICH_VMCR to vcpu_load/put")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/kvm/arm_vgic.h      |  1 +
 virt/kvm/arm/arm.c          | 11 +++++++++++
 virt/kvm/arm/vgic/vgic-v2.c |  9 ++++++++-
 virt/kvm/arm/vgic/vgic-v3.c |  7 ++++++-
 virt/kvm/arm/vgic/vgic.c    | 11 +++++++++++
 virt/kvm/arm/vgic/vgic.h    |  2 ++
 6 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 90ac450745f18..561fefc2a9801 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -361,6 +361,7 @@ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu);
 
 void kvm_vgic_load(struct kvm_vcpu *vcpu);
 void kvm_vgic_put(struct kvm_vcpu *vcpu);
+void kvm_vgic_vmcr_sync(struct kvm_vcpu *vcpu);
 
 #define irqchip_in_kernel(k)	(!!((k)->arch.vgic.in_kernel))
 #define vgic_initialized(k)	((k)->arch.vgic.initialized)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 02bac8abd206f..d982650deb33f 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -338,6 +338,17 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
 void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu)
 {
 	kvm_timer_schedule(vcpu);
+	/*
+	 * If we're about to block (most likely because we've just hit a
+	 * WFI), we need to sync back the state of the GIC CPU interface
+	 * so that we have the lastest PMR and group enables. This ensures
+	 * that kvm_arch_vcpu_runnable has up-to-date data to decide
+	 * whether we have pending interrupts.
+	 */
+	preempt_disable();
+	kvm_vgic_vmcr_sync(vcpu);
+	preempt_enable();
+
 	kvm_vgic_v4_enable_doorbell(vcpu);
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 69b892abd7dc6..57281c1594d0f 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -495,10 +495,17 @@ void vgic_v2_load(struct kvm_vcpu *vcpu)
 		       kvm_vgic_global_state.vctrl_base + GICH_APR);
 }
 
-void vgic_v2_put(struct kvm_vcpu *vcpu)
+void vgic_v2_vmcr_sync(struct kvm_vcpu *vcpu)
 {
 	struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
 
 	cpu_if->vgic_vmcr = readl_relaxed(kvm_vgic_global_state.vctrl_base + GICH_VMCR);
+}
+
+void vgic_v2_put(struct kvm_vcpu *vcpu)
+{
+	struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
+
+	vgic_v2_vmcr_sync(vcpu);
 	cpu_if->vgic_apr = readl_relaxed(kvm_vgic_global_state.vctrl_base + GICH_APR);
 }
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 3f2350a4d4ab8..5c55995a1a164 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -674,12 +674,17 @@ void vgic_v3_load(struct kvm_vcpu *vcpu)
 		__vgic_v3_activate_traps(vcpu);
 }
 
-void vgic_v3_put(struct kvm_vcpu *vcpu)
+void vgic_v3_vmcr_sync(struct kvm_vcpu *vcpu)
 {
 	struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
 
 	if (likely(cpu_if->vgic_sre))
 		cpu_if->vgic_vmcr = kvm_call_hyp(__vgic_v3_read_vmcr);
+}
+
+void vgic_v3_put(struct kvm_vcpu *vcpu)
+{
+	vgic_v3_vmcr_sync(vcpu);
 
 	kvm_call_hyp(__vgic_v3_save_aprs, vcpu);
 
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index c5165e3b80cbe..250cd72c95a52 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -902,6 +902,17 @@ void kvm_vgic_put(struct kvm_vcpu *vcpu)
 		vgic_v3_put(vcpu);
 }
 
+void kvm_vgic_vmcr_sync(struct kvm_vcpu *vcpu)
+{
+	if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
+		return;
+
+	if (kvm_vgic_global_state.type == VGIC_V2)
+		vgic_v2_vmcr_sync(vcpu);
+	else
+		vgic_v3_vmcr_sync(vcpu);
+}
+
 int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
 {
 	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index a90024718ca44..d5e4542799252 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -204,6 +204,7 @@ int vgic_register_dist_iodev(struct kvm *kvm, gpa_t dist_base_address,
 void vgic_v2_init_lrs(void);
 void vgic_v2_load(struct kvm_vcpu *vcpu);
 void vgic_v2_put(struct kvm_vcpu *vcpu);
+void vgic_v2_vmcr_sync(struct kvm_vcpu *vcpu);
 
 void vgic_v2_save_state(struct kvm_vcpu *vcpu);
 void vgic_v2_restore_state(struct kvm_vcpu *vcpu);
@@ -234,6 +235,7 @@ bool vgic_v3_check_base(struct kvm *kvm);
 
 void vgic_v3_load(struct kvm_vcpu *vcpu);
 void vgic_v3_put(struct kvm_vcpu *vcpu);
+void vgic_v3_vmcr_sync(struct kvm_vcpu *vcpu);
 
 bool vgic_has_its(struct kvm *kvm);
 int kvm_vgic_register_its_device(void);
-- 
GitLab


From 2e394bcfdcf35ee49a09b441b01c0b7a105ea72f Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Mon, 12 Aug 2019 12:15:17 +0100
Subject: [PATCH 1579/1835] staging: comedi: dt3000: Fix signed integer
 overflow 'divider * base'

commit b4d98bc3fc93ec3a58459948a2c0e0c9b501cd88 upstream.

In `dt3k_ns_to_timer()` the following lines near the end of the function
result in a signed integer overflow:

	prescale = 15;
	base = timer_base * (1 << prescale);
	divider = 65535;
	*nanosec = divider * base;

(`divider`, `base` and `prescale` are type `int`, `timer_base` and
`*nanosec` are type `unsigned int`.  The value of `timer_base` will be
either 50 or 100.)

The main reason for the overflow is that the calculation for `base` is
completely wrong.  It should be:

	base = timer_base * (prescale + 1);

which matches an earlier instance of this calculation in the same
function.

Reported-by: David Binderman <dcb314@hotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20190812111517.26803-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/dt3000.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c
index 2edf3ee913000..4ad176fc14ad1 100644
--- a/drivers/staging/comedi/drivers/dt3000.c
+++ b/drivers/staging/comedi/drivers/dt3000.c
@@ -368,7 +368,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
 	}
 
 	prescale = 15;
-	base = timer_base * (1 << prescale);
+	base = timer_base * (prescale + 1);
 	divider = 65535;
 	*nanosec = divider * base;
 	return (prescale << 16) | (divider);
-- 
GitLab


From dac96992f00aedbf988cb91da3b12cb07b6632d8 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Mon, 12 Aug 2019 13:08:14 +0100
Subject: [PATCH 1580/1835] staging: comedi: dt3000: Fix rounding up of timer
 divisor

commit 8e2a589a3fc36ce858d42e767c3bcd8fc62a512b upstream.

`dt3k_ns_to_timer()` determines the prescaler and divisor to use to
produce a desired timing period.  It is influenced by a rounding mode
and can round the divisor up, down, or to the nearest value.  However,
the code for rounding up currently does the same as rounding down!  Fix
ir by using the `DIV_ROUND_UP()` macro to calculate the divisor when
rounding up.

Also, change the types of the `divider`, `base` and `prescale` variables
from `int` to `unsigned int` to avoid mixing signed and unsigned types
in the calculations.

Also fix a typo in a nearby comment: "improvment" => "improvement".

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190812120814.21188-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/dt3000.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c
index 4ad176fc14ad1..caf4d4df4bd30 100644
--- a/drivers/staging/comedi/drivers/dt3000.c
+++ b/drivers/staging/comedi/drivers/dt3000.c
@@ -342,9 +342,9 @@ static irqreturn_t dt3k_interrupt(int irq, void *d)
 static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
 			    unsigned int flags)
 {
-	int divider, base, prescale;
+	unsigned int divider, base, prescale;
 
-	/* This function needs improvment */
+	/* This function needs improvement */
 	/* Don't know if divider==0 works. */
 
 	for (prescale = 0; prescale < 16; prescale++) {
@@ -358,7 +358,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
 			divider = (*nanosec) / base;
 			break;
 		case CMDF_ROUND_UP:
-			divider = (*nanosec) / base;
+			divider = DIV_ROUND_UP(*nanosec, base);
 			break;
 		}
 		if (divider < 65536) {
-- 
GitLab


From 367d103a4a937cfdb2fbccdb860099cdb8487180 Mon Sep 17 00:00:00 2001
From: Jacopo Mondi <jacopo+renesas@jmondi.org>
Date: Mon, 5 Aug 2019 17:55:15 +0200
Subject: [PATCH 1581/1835] iio: adc: max9611: Fix temperature reading in probe

commit b9ddd5091160793ee9fac10da765cf3f53d2aaf0 upstream.

The max9611 driver reads the die temperature at probe time to validate
the communication channel. Use the actual read value to perform the test
instead of the read function return value, which was mistakenly used so
far.

The temperature reading test was only successful because the 0 return
value is in the range of supported temperatures.

Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver")
Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/max9611.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index ce9af43fa2de7..49c1956e6a674 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -483,7 +483,7 @@ static int max9611_init(struct max9611_dev *max9611)
 	if (ret)
 		return ret;
 
-	regval = ret & MAX9611_TEMP_MASK;
+	regval &= MAX9611_TEMP_MASK;
 
 	if ((regval > MAX9611_TEMP_MAX_POS &&
 	     regval < MAX9611_TEMP_MIN_NEG) ||
-- 
GitLab


From 7f52d6d2a82df15d7ea01d69d0943d2abc201b43 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Mon, 12 Aug 2019 16:11:07 -0400
Subject: [PATCH 1582/1835] USB: core: Fix races in character device
 registration and deregistraion

commit 303911cfc5b95d33687d9046133ff184cf5043ff upstream.

The syzbot fuzzer has found two (!) races in the USB character device
registration and deregistration routines.  This patch fixes the races.

The first race results from the fact that usb_deregister_dev() sets
usb_minors[intf->minor] to NULL before calling device_destroy() on the
class device.  This leaves a window during which another thread can
allocate the same minor number but will encounter a duplicate name
error when it tries to register its own class device.  A typical error
message in the system log would look like:

    sysfs: cannot create duplicate filename '/class/usbmisc/ldusb0'

The patch fixes this race by destroying the class device first.

The second race is in usb_register_dev().  When that routine runs, it
first allocates a minor number, then drops minor_rwsem, and then
creates the class device.  If the device creation fails, the minor
number is deallocated and the whole routine returns an error.  But
during the time while minor_rwsem was dropped, there is a window in
which the minor number is allocated and so another thread can
successfully open the device file.  Typically this results in
use-after-free errors or invalid accesses when the other thread closes
its open file reference, because the kernel then tries to release
resources that were already deallocated when usb_register_dev()
failed.  The patch fixes this race by keeping minor_rwsem locked
throughout the entire routine.

Reported-and-tested-by: syzbot+30cf45ebfe0b0c4847a1@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1908121607590.1659-100000@iolanthe.rowland.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/file.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 65de6f73b6725..558890ada0e5b 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -193,9 +193,10 @@ int usb_register_dev(struct usb_interface *intf,
 		intf->minor = minor;
 		break;
 	}
-	up_write(&minor_rwsem);
-	if (intf->minor < 0)
+	if (intf->minor < 0) {
+		up_write(&minor_rwsem);
 		return -EXFULL;
+	}
 
 	/* create a usb class device for this usb interface */
 	snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
@@ -203,12 +204,11 @@ int usb_register_dev(struct usb_interface *intf,
 				      MKDEV(USB_MAJOR, minor), class_driver,
 				      "%s", kbasename(name));
 	if (IS_ERR(intf->usb_dev)) {
-		down_write(&minor_rwsem);
 		usb_minors[minor] = NULL;
 		intf->minor = -1;
-		up_write(&minor_rwsem);
 		retval = PTR_ERR(intf->usb_dev);
 	}
+	up_write(&minor_rwsem);
 	return retval;
 }
 EXPORT_SYMBOL_GPL(usb_register_dev);
@@ -234,12 +234,12 @@ void usb_deregister_dev(struct usb_interface *intf,
 		return;
 
 	dev_dbg(&intf->dev, "removing %d minor\n", intf->minor);
+	device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
 
 	down_write(&minor_rwsem);
 	usb_minors[intf->minor] = NULL;
 	up_write(&minor_rwsem);
 
-	device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
 	intf->usb_dev = NULL;
 	intf->minor = -1;
 	destroy_usb_class();
-- 
GitLab


From f417f9715f4c745bdf94ad81c731cabc3a795692 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Wed, 31 Jul 2019 19:15:43 +0900
Subject: [PATCH 1583/1835] usb: gadget: udc: renesas_usb3: Fix sysfs interface
 of "role"

commit 5dac665cf403967bb79a7aeb8c182a621fe617ff upstream.

Since the role_store() uses strncmp(), it's possible to refer
out-of-memory if the sysfs data size is smaller than strlen("host").
This patch fixes it by using sysfs_streq() instead of strncmp().

Fixes: cc995c9ec118 ("usb: gadget: udc: renesas_usb3: add support for usb role swap")
Cc: <stable@vger.kernel.org> # v4.12+
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/renesas_usb3.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index fea02c7ad4f43..a5254e82d6282 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -19,6 +19,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/sizes.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <linux/sys_soc.h>
 #include <linux/uaccess.h>
 #include <linux/usb/ch9.h>
@@ -2378,9 +2379,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
 	if (usb3->forced_b_device)
 		return -EBUSY;
 
-	if (!strncmp(buf, "host", strlen("host")))
+	if (sysfs_streq(buf, "host"))
 		new_mode_is_host = true;
-	else if (!strncmp(buf, "peripheral", strlen("peripheral")))
+	else if (sysfs_streq(buf, "peripheral"))
 		new_mode_is_host = false;
 	else
 		return -EINVAL;
-- 
GitLab


From c02c0249ce5523a7a264136ed36f857b85555bac Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 8 Aug 2019 16:21:19 +0200
Subject: [PATCH 1584/1835] usb: cdc-acm: make sure a refcount is taken early
 enough

commit c52873e5a1ef72f845526d9f6a50704433f9c625 upstream.

destroy() will decrement the refcount on the interface, so that
it needs to be taken so early that it never undercounts.

Fixes: 7fb57a019f94e ("USB: cdc-acm: Fix potential deadlock (lockdep warning)")
Cc: stable <stable@vger.kernel.org>
Reported-and-tested-by: syzbot+1b2449b7b5dc240d107a@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20190808142119.7998-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 5b442bc68a767..59675cc7aa017 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1333,10 +1333,6 @@ made_compressed_probe:
 	tty_port_init(&acm->port);
 	acm->port.ops = &acm_port_ops;
 
-	minor = acm_alloc_minor(acm);
-	if (minor < 0)
-		goto alloc_fail1;
-
 	ctrlsize = usb_endpoint_maxp(epctrl);
 	readsize = usb_endpoint_maxp(epread) *
 				(quirks == SINGLE_RX_URB ? 1 : 2);
@@ -1344,6 +1340,13 @@ made_compressed_probe:
 	acm->writesize = usb_endpoint_maxp(epwrite) * 20;
 	acm->control = control_interface;
 	acm->data = data_interface;
+
+	usb_get_intf(acm->control); /* undone in destruct() */
+
+	minor = acm_alloc_minor(acm);
+	if (minor < 0)
+		goto alloc_fail1;
+
 	acm->minor = minor;
 	acm->dev = usb_dev;
 	if (h.usb_cdc_acm_descriptor)
@@ -1490,7 +1493,6 @@ skip_countries:
 	usb_driver_claim_interface(&acm_driver, data_interface, acm);
 	usb_set_intfdata(data_interface, acm);
 
-	usb_get_intf(control_interface);
 	tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
 			&control_interface->dev);
 	if (IS_ERR(tty_dev)) {
-- 
GitLab


From 487d66ae8f4531cd7a9ed96b370f238fcb0d3021 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 13 Aug 2019 11:35:41 +0200
Subject: [PATCH 1585/1835] USB: CDC: fix sanity checks in CDC union parser

commit 54364278fb3cabdea51d6398b07c87415065b3fc upstream.

A few checks checked for the size of the pointer to a structure
instead of the structure itself. Copy & paste issue presumably.

Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core")
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+45a53506b65321c1fe91@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20190813093541.18889-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/message.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 4020ce8db6ce5..0d3fd20831656 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2211,14 +2211,14 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
 				(struct usb_cdc_dmm_desc *)buffer;
 			break;
 		case USB_CDC_MDLM_TYPE:
-			if (elength < sizeof(struct usb_cdc_mdlm_desc *))
+			if (elength < sizeof(struct usb_cdc_mdlm_desc))
 				goto next_desc;
 			if (desc)
 				return -EINVAL;
 			desc = (struct usb_cdc_mdlm_desc *)buffer;
 			break;
 		case USB_CDC_MDLM_DETAIL_TYPE:
-			if (elength < sizeof(struct usb_cdc_mdlm_detail_desc *))
+			if (elength < sizeof(struct usb_cdc_mdlm_detail_desc))
 				goto next_desc;
 			if (detail)
 				return -EINVAL;
-- 
GitLab


From afb677b299950b8749079df0c432b70dc951ba88 Mon Sep 17 00:00:00 2001
From: Rogan Dawes <rogan@dawes.za.net>
Date: Wed, 17 Jul 2019 11:11:34 +0200
Subject: [PATCH 1586/1835] USB: serial: option: add D-Link DWM-222 device ID

commit 552573e42aab5f75aff9bab855a9677979d9a7d5 upstream.

Add device id for D-Link DWM-222 A2.

MI_00 D-Link HS-USB Diagnostics
MI_01 D-Link HS-USB Modem
MI_02 D-Link HS-USB AT Port
MI_03 D-Link HS-USB NMEA
MI_04 D-Link HS-USB WWAN Adapter (qmi_wwan)
MI_05 USB Mass Storage Device

Cc: stable@vger.kernel.org
Signed-off-by: Rogan Dawes <rogan@dawes.za.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e0a4749ba565e..298d0fd76ea4d 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1952,6 +1952,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),			/* D-Link DWM-222 */
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e3d, 0xff),			/* D-Link DWM-222 A2 */
+	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },	/* D-Link DWM-152/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/A3 */
-- 
GitLab


From 8175fa2987a66363f39100362291192101165a2f Mon Sep 17 00:00:00 2001
From: Yoshiaki Okamoto <yokamoto@allied-telesis.co.jp>
Date: Sat, 20 Jul 2019 22:23:18 +0900
Subject: [PATCH 1587/1835] USB: serial: option: Add support for ZTE MF871A

commit 7e7ae38bf928c5cfa6dd6e9a2cf8b42c84a27c92 upstream.

This patch adds support for MF871A USB modem (aka Speed USB STICK U03)
to option driver. This modem is manufactured by ZTE corporation, and
sold by KDDI.

Interface layout:
0: AT
1: MODEM

usb-devices output:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  9 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=1481 Rev=52.87
S:  Manufacturer=ZTE,Incorporated
S:  Product=ZTE Technologies MSM
S:  SerialNumber=1234567890ABCDEF
C:  #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option

Co-developed-by: Hiroyuki Yamamoto <hyamamo@allied-telesis.co.jp>
Signed-off-by: Hiroyuki Yamamoto <hyamamo@allied-telesis.co.jp>
Signed-off-by: Yoshiaki Okamoto <yokamoto@allied-telesis.co.jp>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 298d0fd76ea4d..6522100b532fb 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1549,6 +1549,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff),  /* Telewell TW-LTE 4G v2 */
 	  .driver_info = RSVD(2) },
 	{ USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) },	/* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
-- 
GitLab


From e480d6cf6f79122459f1348d6af3dee654ce3c6e Mon Sep 17 00:00:00 2001
From: Bob Ham <bob.ham@puri.sm>
Date: Wed, 24 Jul 2019 07:52:26 -0700
Subject: [PATCH 1588/1835] USB: serial: option: add the BroadMobi BM818 card

commit e5d8badf37e6b547842f2fcde10361b29e08bd36 upstream.

Add a VID:PID for the BroadMobi BM818 M.2 card

T:  Bus=01 Lev=03 Prnt=40 Port=03 Cnt=01 Dev#= 44 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2020 ProdID=2060 Rev=00.00
S:  Manufacturer=Qualcomm, Incorporated
S:  Product=Qualcomm CDMA Technologies MSM
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)

Signed-off-by: Bob Ham <bob.ham@puri.sm>
Signed-off-by: Angus Ainslie (Purism) <angus@akkea.ca>
Cc: stable <stable@vger.kernel.org>
[ johan: use USB_DEVICE_INTERFACE_CLASS() ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6522100b532fb..11cf79948d9cc 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1960,6 +1960,8 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/A3 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),			/* Olicard 600 */
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),			/* BroadMobi BM818 */
+	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },			/* OLICARD300 - MT6225 */
 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
 	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
-- 
GitLab


From 3ca5b7b4afeef6be791f998c1b43109489e603c6 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Thu, 15 Aug 2019 01:26:02 -0700
Subject: [PATCH 1589/1835] USB: serial: option: Add Motorola modem UARTs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 6caf0be40a707689e8ff8824fdb96ef77685b1ba upstream.

On Motorola Mapphone devices such as Droid 4 there are five USB ports
that do not use the same layout as Gobi 1K/2K/etc devices listed in
qcserial.c. So we should use qcaux.c or option.c as noted by
Dan Williams <dan.j.williams@intel.com>.

As the Motorola USB serial ports have an interrupt endpoint as shown
with lsusb -v, we should use option.c instead of qcaux.c as pointed out
by Johan Hovold <johan@kernel.org>.

The ff/ff/ff interfaces seem to always be UARTs on Motorola devices.
For the other interfaces, class 0x0a (CDC Data) should not in general
be added as they are typically part of a multi-interface function as
noted earlier by Bjørn Mork <bjorn@mork.no>.

However, looking at the Motorola mapphone kernel code, the mdm6600 0x0a
class is only used for flashing the modem firmware, and there are no
other interfaces. So I've added that too with more details below as it
works just fine.

The ttyUSB ports on Droid 4 are:

ttyUSB0 DIAG, CQDM-capable
ttyUSB1 MUX or NMEA, no response
ttyUSB2 MUX or NMEA, no response
ttyUSB3 TCMD
ttyUSB4 AT-capable

The ttyUSB0 is detected as QCDM capable by ModemManager. I think
it's only used for debugging with ModemManager --debug for sending
custom AT commands though. ModemManager already can manage data
connection using the USB QMI ports that are already handled by the
qmi_wwan.c driver.

To enable the MUX or NMEA ports, it seems that something needs to be
done additionally to enable them, maybe via the DIAG or TCMD port.
It might be just a NVRAM setting somewhere, but I have no idea what
NVRAM settings may need changing for that.

The TCMD port seems to be a Motorola custom protocol for testing
the modem and to configure it's NVRAM and seems to work just fine
based on a quick test with a minimal tcmdrw tool I wrote.

The voice modem AT-capable port seems to provide only partial
support, and no PM support compared to the TS 27.010 based UART
wired directly to the modem.

The UARTs added with this change are the same product IDs as the
Motorola Mapphone Android Linux kernel mdm6600_id_table. I don't
have any mdm9600 based devices, so I have only tested these on
mdm6600 based droid 4.

Then for the class 0x0a (CDC Data) mode, the Motorola Mapphone Android
Linux kernel driver moto_flashqsc.c just seems to change the
port->bulk_out_size to 8K from the default. And is only used for
flashing the modem firmware it seems.

I've verified that flashing the modem with signed firmware works just
fine with the option driver after manually toggling the GPIO pins, so
I've added droid 4 modem flashing mode to the option driver. I've not
added the other devices listed in moto_flashqsc.c in case they really
need different port->bulk_out_size. Those can be added as they get
tested to work for flashing the modem.

After this patch the output of /sys/kernel/debug/usb/devices has
the following for normal 22b8:2a70 mode including the related qmi_wwan
interfaces:

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=22b8 ProdID=2a70 Rev= 0.00
S:  Manufacturer=Motorola, Incorporated
S:  Product=Flash MZ600
C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
E:  Ad=86(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
E:  Ad=87(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
E:  Ad=88(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=06(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
E:  Ad=89(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
E:  Ad=8a(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=07(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
E:  Ad=8b(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
E:  Ad=8c(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=08(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
E:  Ad=8d(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
E:  Ad=8e(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=09(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms

In 22b8:900e "qc_dload" mode the device shows up as:

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=22b8 ProdID=900e Rev= 0.00
S:  Manufacturer=Motorola, Incorporated
S:  Product=Flash MZ600
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms

And in 22b8:4281 "ram_downloader" mode the device shows up as:

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=22b8 ProdID=4281 Rev= 0.00
S:  Manufacturer=Motorola, Incorporated
S:  Product=Flash MZ600
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=fc Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms

Cc: Bjørn Mork <bjorn@mork.no>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Lars Melin <larsm17@gmail.com>
Cc: Marcel Partap <mpartap@gmx.net>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Michael Scott <hashcode0f@gmail.com>
Cc: NeKit <nekit1000@gmail.com>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Tested-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 11cf79948d9cc..56f572cb08f8b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -968,6 +968,11 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
 	{ USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
 
+	/* Motorola devices */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2a70, 0xff, 0xff, 0xff) },	/* mdm6600 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2e0a, 0xff, 0xff, 0xff) },	/* mdm9600 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x4281, 0x0a, 0x00, 0xfc) },	/* mdm ram dl */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x900e, 0xff, 0xff, 0xff) },	/* mdm qc dl */
 
 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
-- 
GitLab


From 4af28b2f19b0a3343b39cc4c86067965ee34a249 Mon Sep 17 00:00:00 2001
From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Date: Fri, 3 Aug 2018 16:27:21 -0700
Subject: [PATCH 1590/1835] drm/i915/cfl: Add a new CFL PCI ID.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit d0e062ebb3a44b56a7e672da568334c76f763552 upstream.

One more CFL ID added to spec.

Cc: José Roberto de Souza <jose.souza@intel.com>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180803232721.20038-1-rodrigo.vivi@intel.com
Signed-off-by: Wan Yusof, Wan Fahim AsqalaniX <wan.fahim.asqalanix.wan.yusof@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/drm/i915_pciids.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index fbf5cfc9b352f..fd965ffbb92e3 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -386,6 +386,7 @@
 	INTEL_VGA_DEVICE(0x3E91, info), /* SRV GT2 */ \
 	INTEL_VGA_DEVICE(0x3E92, info), /* SRV GT2 */ \
 	INTEL_VGA_DEVICE(0x3E96, info), /* SRV GT2 */ \
+	INTEL_VGA_DEVICE(0x3E98, info), /* SRV GT2 */ \
 	INTEL_VGA_DEVICE(0x3E9A, info)  /* SRV GT2 */
 
 /* CFL H */
-- 
GitLab


From a1cd2f7015bdcd22652937ca1936814658647e6d Mon Sep 17 00:00:00 2001
From: Mike Snitzer <snitzer@redhat.com>
Date: Wed, 3 Apr 2019 12:23:11 -0400
Subject: [PATCH 1591/1835] dm: disable DISCARD if the underlying storage no
 longer supports it

commit bcb44433bba5eaff293888ef22ffa07f1f0347d6 upstream.

Storage devices which report supporting discard commands like
WRITE_SAME_16 with unmap, but reject discard commands sent to the
storage device.  This is a clear storage firmware bug but it doesn't
change the fact that should a program cause discards to be sent to a
multipath device layered on this buggy storage, all paths can end up
failed at the same time from the discards, causing possible I/O loss.

The first discard to a path will fail with Illegal Request, Invalid
field in cdb, e.g.:
 kernel: sd 8:0:8:19: [sdfn] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
 kernel: sd 8:0:8:19: [sdfn] tag#0 Sense Key : Illegal Request [current]
 kernel: sd 8:0:8:19: [sdfn] tag#0 Add. Sense: Invalid field in cdb
 kernel: sd 8:0:8:19: [sdfn] tag#0 CDB: Write same(16) 93 08 00 00 00 00 00 a0 08 00 00 00 80 00 00 00
 kernel: blk_update_request: critical target error, dev sdfn, sector 10487808

The SCSI layer converts this to the BLK_STS_TARGET error number, the sd
device disables its support for discard on this path, and because of the
BLK_STS_TARGET error multipath fails the discard without failing any
path or retrying down a different path.  But subsequent discards can
cause path failures.  Any discards sent to the path which already failed
a discard ends up failing with EIO from blk_cloned_rq_check_limits with
an "over max size limit" error since the discard limit was set to 0 by
the sd driver for the path.  As the error is EIO, this now fails the
path and multipath tries to send the discard down the next path.  This
cycle continues as discards are sent until all paths fail.

Fix this by training DM core to disable DISCARD if the underlying
storage already did so.

Also, fix branching in dm_done() and clone_endio() to reflect the
mutually exclussive nature of the IO operations in question.

Cc: stable@vger.kernel.org
Reported-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[Salvatore Bonaccorso: backported to 4.19: Adjust for context changes in
drivers/md/dm-core.h]
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-core.h |  1 +
 drivers/md/dm-rq.c   | 11 +++++++----
 drivers/md/dm.c      | 20 ++++++++++++++++----
 3 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 7d480c930eaf0..7e426e4d13528 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -130,6 +130,7 @@ struct mapped_device {
 };
 
 int md_in_flight(struct mapped_device *md);
+void disable_discard(struct mapped_device *md);
 void disable_write_same(struct mapped_device *md);
 void disable_write_zeroes(struct mapped_device *md);
 
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 6e547b8dd2982..264b84e274aac 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -295,11 +295,14 @@ static void dm_done(struct request *clone, blk_status_t error, bool mapped)
 	}
 
 	if (unlikely(error == BLK_STS_TARGET)) {
-		if (req_op(clone) == REQ_OP_WRITE_SAME &&
-		    !clone->q->limits.max_write_same_sectors)
+		if (req_op(clone) == REQ_OP_DISCARD &&
+		    !clone->q->limits.max_discard_sectors)
+			disable_discard(tio->md);
+		else if (req_op(clone) == REQ_OP_WRITE_SAME &&
+			 !clone->q->limits.max_write_same_sectors)
 			disable_write_same(tio->md);
-		if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
-		    !clone->q->limits.max_write_zeroes_sectors)
+		else if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
+			 !clone->q->limits.max_write_zeroes_sectors)
 			disable_write_zeroes(tio->md);
 	}
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 42768fe92b41b..c9860e3b04ddf 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -910,6 +910,15 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
 	}
 }
 
+void disable_discard(struct mapped_device *md)
+{
+	struct queue_limits *limits = dm_get_queue_limits(md);
+
+	/* device doesn't really support DISCARD, disable it */
+	limits->max_discard_sectors = 0;
+	blk_queue_flag_clear(QUEUE_FLAG_DISCARD, md->queue);
+}
+
 void disable_write_same(struct mapped_device *md)
 {
 	struct queue_limits *limits = dm_get_queue_limits(md);
@@ -935,11 +944,14 @@ static void clone_endio(struct bio *bio)
 	dm_endio_fn endio = tio->ti->type->end_io;
 
 	if (unlikely(error == BLK_STS_TARGET) && md->type != DM_TYPE_NVME_BIO_BASED) {
-		if (bio_op(bio) == REQ_OP_WRITE_SAME &&
-		    !bio->bi_disk->queue->limits.max_write_same_sectors)
+		if (bio_op(bio) == REQ_OP_DISCARD &&
+		    !bio->bi_disk->queue->limits.max_discard_sectors)
+			disable_discard(md);
+		else if (bio_op(bio) == REQ_OP_WRITE_SAME &&
+			 !bio->bi_disk->queue->limits.max_write_same_sectors)
 			disable_write_same(md);
-		if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
-		    !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
+		else if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
+			 !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
 			disable_write_zeroes(md);
 	}
 
-- 
GitLab


From 30b9da0ec2a2f93b2f78ee54732185ce30c19df3 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Fri, 16 Aug 2019 14:57:43 +0100
Subject: [PATCH 1592/1835] arm64: ftrace: Ensure module ftrace trampoline is
 coherent with I-side

commit b6143d10d23ebb4a77af311e8b8b7f019d0163e6 upstream.

The initial support for dynamic ftrace trampolines in modules made use
of an indirect branch which loaded its target from the beginning of
a special section (e71a4e1bebaf7 ("arm64: ftrace: add support for far
branches to dynamic ftrace")). Since no instructions were being patched,
no cache maintenance was needed. However, later in be0f272bfc83 ("arm64:
ftrace: emit ftrace-mod.o contents through code") this code was reworked
to output the trampoline instructions directly into the PLT entry but,
unfortunately, the necessary cache maintenance was overlooked.

Add a call to __flush_icache_range() after writing the new trampoline
instructions but before patching in the branch to the trampoline.

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: James Morse <james.morse@arm.com>
Cc: <stable@vger.kernel.org>
Fixes: be0f272bfc83 ("arm64: ftrace: emit ftrace-mod.o contents through code")
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/ftrace.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 57e962290df3a..7eff8afa035fd 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -76,7 +76,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 
 	if (offset < -SZ_128M || offset >= SZ_128M) {
 #ifdef CONFIG_ARM64_MODULE_PLTS
-		struct plt_entry trampoline;
+		struct plt_entry trampoline, *dst;
 		struct module *mod;
 
 		/*
@@ -104,24 +104,27 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 		 * is added in the future, but for now, the pr_err() below
 		 * deals with a theoretical issue only.
 		 */
+		dst = mod->arch.ftrace_trampoline;
 		trampoline = get_plt_entry(addr);
-		if (!plt_entries_equal(mod->arch.ftrace_trampoline,
-				       &trampoline)) {
-			if (!plt_entries_equal(mod->arch.ftrace_trampoline,
-					       &(struct plt_entry){})) {
+		if (!plt_entries_equal(dst, &trampoline)) {
+			if (!plt_entries_equal(dst, &(struct plt_entry){})) {
 				pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
 				return -EINVAL;
 			}
 
 			/* point the trampoline to our ftrace entry point */
 			module_disable_ro(mod);
-			*mod->arch.ftrace_trampoline = trampoline;
+			*dst = trampoline;
 			module_enable_ro(mod, true);
 
-			/* update trampoline before patching in the branch */
-			smp_wmb();
+			/*
+			 * Ensure updated trampoline is visible to instruction
+			 * fetch before we patch in the branch.
+			 */
+			__flush_icache_range((unsigned long)&dst[0],
+					     (unsigned long)&dst[1]);
 		}
-		addr = (unsigned long)(void *)mod->arch.ftrace_trampoline;
+		addr = (unsigned long)dst;
 #else /* CONFIG_ARM64_MODULE_PLTS */
 		return -EINVAL;
 #endif /* CONFIG_ARM64_MODULE_PLTS */
-- 
GitLab


From 28ff7d3b3fda978eff04151989c4043b1ead7a38 Mon Sep 17 00:00:00 2001
From: Dirk Morris <dmorris@metaloft.com>
Date: Thu, 8 Aug 2019 13:57:51 -0700
Subject: [PATCH 1593/1835] netfilter: conntrack: Use consistent ct id hash
 calculation

commit 656c8e9cc1badbc18eefe6ba01d33ebbcae61b9a upstream.

Change ct id hash calculation to only use invariants.

Currently the ct id hash calculation is based on some fields that can
change in the lifetime on a conntrack entry in some corner cases. The
current hash uses the whole tuple which contains an hlist pointer which
will change when the conntrack is placed on the dying list resulting in
a ct id change.

This patch also removes the reply-side tuple and extension pointer from
the hash calculation so that the ct id will will not change from
initialization until confirmation.

Fixes: 3c79107631db1f7 ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id")
Signed-off-by: Dirk Morris <dmorris@metaloft.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_conntrack_core.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 27eff89fad01c..c6073d17c3244 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -431,13 +431,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
  * table location, we assume id gets exposed to userspace.
  *
  * Following nf_conn items do not change throughout lifetime
- * of the nf_conn after it has been committed to main hash table:
+ * of the nf_conn:
  *
  * 1. nf_conn address
- * 2. nf_conn->ext address
- * 3. nf_conn->master address (normally NULL)
- * 4. tuple
- * 5. the associated net namespace
+ * 2. nf_conn->master address (normally NULL)
+ * 3. the associated net namespace
+ * 4. the original direction tuple
  */
 u32 nf_ct_get_id(const struct nf_conn *ct)
 {
@@ -447,9 +446,10 @@ u32 nf_ct_get_id(const struct nf_conn *ct)
 	net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
 
 	a = (unsigned long)ct;
-	b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
-	c = (unsigned long)ct->ext;
-	d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
+	b = (unsigned long)ct->master;
+	c = (unsigned long)nf_ct_net(ct);
+	d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+				   sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
 				   &ct_id_seed);
 #ifdef CONFIG_64BIT
 	return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
-- 
GitLab


From 62e023ddd01a56d9f1bf0dcd3c878fd7f2326c25 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Tue, 16 Jul 2019 20:17:20 +0200
Subject: [PATCH 1594/1835] Input: psmouse - fix build error of multiple
 definition

commit 49e6979e7e92cf496105b5636f1df0ac17c159c0 upstream.

trackpoint_detect() should be static inline while
CONFIG_MOUSE_PS2_TRACKPOINT is not set, otherwise, we build fails:

drivers/input/mouse/alps.o: In function `trackpoint_detect':
alps.c:(.text+0x8e00): multiple definition of `trackpoint_detect'
drivers/input/mouse/psmouse-base.o:psmouse-base.c:(.text+0x1b50): first defined here

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 55e3d9224b60 ("Input: psmouse - allow disabing certain protocol extensions")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/trackpoint.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
index 10a0391482343..538986e5ac5bc 100644
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -161,7 +161,8 @@ struct trackpoint_data {
 #ifdef CONFIG_MOUSE_PS2_TRACKPOINT
 int trackpoint_detect(struct psmouse *psmouse, bool set_properties);
 #else
-inline int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
+static inline int trackpoint_detect(struct psmouse *psmouse,
+				    bool set_properties)
 {
 	return -ENOSYS;
 }
-- 
GitLab


From 03d54393e3d7d78c72742353026505766c93eac1 Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Fri, 5 Oct 2018 12:32:46 +0200
Subject: [PATCH 1595/1835] iommu/amd: Move iommu_init_pci() to .init section

commit 24d2c521749d8547765b555b7a85cca179bb2275 upstream.

The function is only called from another __init function, so
it should be moved to .init too.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/amd_iommu_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 3a1d30304f7e9..66b4800bcdd8b 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1710,7 +1710,7 @@ static const struct attribute_group *amd_iommu_groups[] = {
 	NULL,
 };
 
-static int iommu_init_pci(struct amd_iommu *iommu)
+static int __init iommu_init_pci(struct amd_iommu *iommu)
 {
 	int cap_ptr = iommu->cap_ptr;
 	u32 range, misc, low, high;
-- 
GitLab


From 40933af400c5e0e37fe475111d7d9fcc815f27de Mon Sep 17 00:00:00 2001
From: Manish Chopra <manishc@marvell.com>
Date: Sun, 18 Aug 2019 07:25:48 -0700
Subject: [PATCH 1596/1835] bnx2x: Fix VF's VLAN reconfiguration in reload.

[ Upstream commit 4a4d2d372fb9b9229327e2ed01d5d9572eddf4de ]

Commit 04f05230c5c13 ("bnx2x: Remove configured vlans as
part of unload sequence."), introduced a regression in driver
that as a part of VF's reload flow, VLANs created on the VF
doesn't get re-configured in hardware as vlan metadata/info
was not getting cleared for the VFs which causes vlan PING to stop.

This patch clears the vlan metadata/info so that VLANs gets
re-configured back in the hardware in VF's reload flow and
PING/traffic continues for VLANs created over the VFs.

Fixes: 04f05230c5c13 ("bnx2x: Remove configured vlans as part of unload sequence.")
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com>
Signed-off-by: Shahed Shaikh <shshaikh@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c |  7 ++++---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h |  2 ++
 .../net/ethernet/broadcom/bnx2x/bnx2x_main.c    | 17 ++++++++++++-----
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 33baa17fa9d55..cf01e73d1bcc8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3058,12 +3058,13 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
 	/* if VF indicate to PF this function is going down (PF will delete sp
 	 * elements and clear initializations
 	 */
-	if (IS_VF(bp))
+	if (IS_VF(bp)) {
+		bnx2x_clear_vlan_info(bp);
 		bnx2x_vfpf_close_vf(bp);
-	else if (unload_mode != UNLOAD_RECOVERY)
+	} else if (unload_mode != UNLOAD_RECOVERY) {
 		/* if this is a normal/close unload need to clean up chip*/
 		bnx2x_chip_cleanup(bp, unload_mode, keep_link);
-	else {
+	} else {
 		/* Send the UNLOAD_REQUEST to the MCP */
 		bnx2x_send_unload_req(bp, unload_mode);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 0e508e5defce3..ee5159ef837e3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -425,6 +425,8 @@ void bnx2x_set_reset_global(struct bnx2x *bp);
 void bnx2x_disable_close_the_gate(struct bnx2x *bp);
 int bnx2x_init_hw_func_cnic(struct bnx2x *bp);
 
+void bnx2x_clear_vlan_info(struct bnx2x *bp);
+
 /**
  * bnx2x_sp_event - handle ramrods completion.
  *
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2c9af0f420e5d..68c62e32e8820 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -8488,11 +8488,21 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
 	return rc;
 }
 
+void bnx2x_clear_vlan_info(struct bnx2x *bp)
+{
+	struct bnx2x_vlan_entry *vlan;
+
+	/* Mark that hw forgot all entries */
+	list_for_each_entry(vlan, &bp->vlan_reg, link)
+		vlan->hw = false;
+
+	bp->vlan_cnt = 0;
+}
+
 static int bnx2x_del_all_vlans(struct bnx2x *bp)
 {
 	struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
 	unsigned long ramrod_flags = 0, vlan_flags = 0;
-	struct bnx2x_vlan_entry *vlan;
 	int rc;
 
 	__set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
@@ -8501,10 +8511,7 @@ static int bnx2x_del_all_vlans(struct bnx2x *bp)
 	if (rc)
 		return rc;
 
-	/* Mark that hw forgot all entries */
-	list_for_each_entry(vlan, &bp->vlan_reg, link)
-		vlan->hw = false;
-	bp->vlan_cnt = 0;
+	bnx2x_clear_vlan_info(bp);
 
 	return 0;
 }
-- 
GitLab


From d61d8ea9ca1296fcdf1ed2eb979a18c09bce5581 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Wed, 7 Aug 2019 10:19:59 +0800
Subject: [PATCH 1597/1835] bonding: Add vlan tx offload to hw_enc_features

[ Upstream commit d595b03de2cb0bdf9bcdf35ff27840cc3a37158f ]

As commit 30d8177e8ac7 ("bonding: Always enable vlan tx offload")
said, we should always enable bonding's vlan tx offload, pass the
vlan packets to the slave devices with vlan tci, let them to handle
vlan implementation.

Now if encapsulation protocols like VXLAN is used, skb->encapsulation
may be set, then the packet is passed to vlan device which based on
bonding device. However in netif_skb_features(), the check of
hw_enc_features:

	 if (skb->encapsulation)
                 features &= dev->hw_enc_features;

clears NETIF_F_HW_VLAN_CTAG_TX/NETIF_F_HW_VLAN_STAG_TX. This results
in same issue in commit 30d8177e8ac7 like this:

vlan_dev_hard_start_xmit
  -->dev_queue_xmit
    -->validate_xmit_skb
      -->netif_skb_features //NETIF_F_HW_VLAN_CTAG_TX is cleared
      -->validate_xmit_vlan
        -->__vlan_hwaccel_push_inside //skb->tci is cleared
...
 --> bond_start_xmit
   --> bond_xmit_hash //BOND_XMIT_POLICY_ENCAP34
     --> __skb_flow_dissect // nhoff point to IP header
        -->  case htons(ETH_P_8021Q)
             // skb_vlan_tag_present is false, so
             vlan = __skb_header_pointer(skb, nhoff, sizeof(_vlan),
             //vlan point to ip header wrongly

Fixes: b2a103e6d0af ("bonding: convert to ndo_fix_features")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index be0b785becd09..8f14f85b8e95e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1102,6 +1102,8 @@ static void bond_compute_features(struct bonding *bond)
 done:
 	bond_dev->vlan_features = vlan_features;
 	bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+				    NETIF_F_HW_VLAN_CTAG_TX |
+				    NETIF_F_HW_VLAN_STAG_TX |
 				    NETIF_F_GSO_UDP_L4;
 	bond_dev->gso_max_segs = gso_max_segs;
 	netif_set_gso_max_size(bond_dev, gso_max_size);
-- 
GitLab


From 8905a249448cc80e9932a2f013f4954846d9f45a Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wens@csie.org>
Date: Sun, 11 Aug 2019 22:18:25 +0800
Subject: [PATCH 1598/1835] net: dsa: Check existence of .port_mdb_add callback
 before calling it

[ Upstream commit 58799865be84e2a895dab72de0e1b996ed943f22 ]

The dsa framework has optional .port_mdb_{prepare,add,del} callback fields
for drivers to handle multicast database entries. When adding an entry, the
framework goes through a prepare phase, then a commit phase. Drivers not
providing these callbacks should be detected in the prepare phase.

DSA core may still bypass the bridge layer and call the dsa_port_mdb_add
function directly with no prepare phase or no switchdev trans object,
and the framework ends up calling an undefined .port_mdb_add callback.
This results in a NULL pointer dereference, as shown in the log below.

The other functions seem to be properly guarded. Do the same for
.port_mdb_add in dsa_switch_mdb_add_bitmap() as well.

    8<--- cut here ---
    Unable to handle kernel NULL pointer dereference at virtual address 00000000
    pgd = (ptrval)
    [00000000] *pgd=00000000
    Internal error: Oops: 80000005 [#1] SMP ARM
    Modules linked in: rtl8xxxu rtl8192cu rtl_usb rtl8192c_common rtlwifi mac80211 cfg80211
    CPU: 1 PID: 134 Comm: kworker/1:2 Not tainted 5.3.0-rc1-00247-gd3519030752a #1
    Hardware name: Allwinner sun7i (A20) Family
    Workqueue: events switchdev_deferred_process_work
    PC is at 0x0
    LR is at dsa_switch_event+0x570/0x620
    pc : [<00000000>]    lr : [<c08533ec>]    psr: 80070013
    sp : ee871db8  ip : 00000000  fp : ee98d0a4
    r10: 0000000c  r9 : 00000008  r8 : ee89f710
    r7 : ee98d040  r6 : ee98d088  r5 : c0f04c48  r4 : ee98d04c
    r3 : 00000000  r2 : ee89f710  r1 : 00000008  r0 : ee98d040
    Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    Control: 10c5387d  Table: 6deb406a  DAC: 00000051
    Process kworker/1:2 (pid: 134, stack limit = 0x(ptrval))
    Stack: (0xee871db8 to 0xee872000)
    1da0:                                                       ee871e14 103ace2d
    1dc0: 00000000 ffffffff 00000000 ee871e14 00000005 00000000 c08524a0 00000000
    1de0: ffffe000 c014bdfc c0f04c48 ee871e98 c0f04c48 ee9e5000 c0851120 c014bef0
    1e00: 00000000 b643aea2 ee9b4068 c08509a8 ee2bf940 ee89f710 ee871ecb 00000000
    1e20: 00000008 103ace2d 00000000 c087e248 ee29c868 103ace2d 00000001 ffffffff
    1e40: 00000000 ee871e98 00000006 00000000 c0fb2a50 c087e2d0 ffffffff c08523c4
    1e60: ffffffff c014bdfc 00000006 c0fad2d0 ee871e98 ee89f710 00000000 c014c500
    1e80: 00000000 ee89f3c0 c0f04c48 00000000 ee9e5000 c087dfb4 ee9e5000 00000000
    1ea0: ee89f710 ee871ecb 00000001 103ace2d 00000000 c0f04c48 00000000 c087e0a8
    1ec0: 00000000 efd9a3e0 0089f3c0 103ace2d ee89f700 ee89f710 ee9e5000 00000122
    1ee0: 00000100 c087e130 ee89f700 c0fad2c8 c1003ef0 c087de4c 2e928000 c0fad2ec
    1f00: c0fad2ec ee839580 ef7a62c0 ef7a9400 00000000 c087def8 c0fad2ec c01447dc
    1f20: ef315640 ef7a62c0 00000008 ee839580 ee839594 ef7a62c0 00000008 c0f03d00
    1f40: ef7a62d8 ef7a62c0 ffffe000 c0145b84 ffffe000 c0fb2420 c0bfaa8c 00000000
    1f60: ffffe000 ee84b600 ee84b5c0 00000000 ee870000 ee839580 c0145b40 ef0e5ea4
    1f80: ee84b61c c014a6f8 00000001 ee84b5c0 c014a5b0 00000000 00000000 00000000
    1fa0: 00000000 00000000 00000000 c01010e8 00000000 00000000 00000000 00000000
    1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
    [<c08533ec>] (dsa_switch_event) from [<c014bdfc>] (notifier_call_chain+0x48/0x84)
    [<c014bdfc>] (notifier_call_chain) from [<c014bef0>] (raw_notifier_call_chain+0x18/0x20)
    [<c014bef0>] (raw_notifier_call_chain) from [<c08509a8>] (dsa_port_mdb_add+0x48/0x74)
    [<c08509a8>] (dsa_port_mdb_add) from [<c087e248>] (__switchdev_handle_port_obj_add+0x54/0xd4)
    [<c087e248>] (__switchdev_handle_port_obj_add) from [<c087e2d0>] (switchdev_handle_port_obj_add+0x8/0x14)
    [<c087e2d0>] (switchdev_handle_port_obj_add) from [<c08523c4>] (dsa_slave_switchdev_blocking_event+0x94/0xa4)
    [<c08523c4>] (dsa_slave_switchdev_blocking_event) from [<c014bdfc>] (notifier_call_chain+0x48/0x84)
    [<c014bdfc>] (notifier_call_chain) from [<c014c500>] (blocking_notifier_call_chain+0x50/0x68)
    [<c014c500>] (blocking_notifier_call_chain) from [<c087dfb4>] (switchdev_port_obj_notify+0x44/0xa8)
    [<c087dfb4>] (switchdev_port_obj_notify) from [<c087e0a8>] (switchdev_port_obj_add_now+0x90/0x104)
    [<c087e0a8>] (switchdev_port_obj_add_now) from [<c087e130>] (switchdev_port_obj_add_deferred+0x14/0x5c)
    [<c087e130>] (switchdev_port_obj_add_deferred) from [<c087de4c>] (switchdev_deferred_process+0x64/0x104)
    [<c087de4c>] (switchdev_deferred_process) from [<c087def8>] (switchdev_deferred_process_work+0xc/0x14)
    [<c087def8>] (switchdev_deferred_process_work) from [<c01447dc>] (process_one_work+0x218/0x50c)
    [<c01447dc>] (process_one_work) from [<c0145b84>] (worker_thread+0x44/0x5bc)
    [<c0145b84>] (worker_thread) from [<c014a6f8>] (kthread+0x148/0x150)
    [<c014a6f8>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
    Exception stack(0xee871fb0 to 0xee871ff8)
    1fa0:                                     00000000 00000000 00000000 00000000
    1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
    Code: bad PC value
    ---[ end trace 1292c61abd17b130 ]---

    [<c08533ec>] (dsa_switch_event) from [<c014bdfc>] (notifier_call_chain+0x48/0x84)
    corresponds to

	$ arm-linux-gnueabihf-addr2line -C -i -e vmlinux c08533ec

	linux/net/dsa/switch.c:156
	linux/net/dsa/switch.c:178
	linux/net/dsa/switch.c:328

Fixes: e6db98db8a95 ("net: dsa: add switch mdb bitmap functions")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dsa/switch.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 142b294d34468..b0b9413fa5bf9 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -127,6 +127,9 @@ static void dsa_switch_mdb_add_bitmap(struct dsa_switch *ds,
 {
 	int port;
 
+	if (!ds->ops->port_mdb_add)
+		return;
+
 	for_each_set_bit(port, bitmap, ds->num_ports)
 		ds->ops->port_mdb_add(ds, port, mdb);
 }
-- 
GitLab


From f588dccfc13714bed02c036dde2daf16e625b499 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Mon, 12 Aug 2019 14:11:35 -0500
Subject: [PATCH 1599/1835] net/mlx4_en: fix a memory leak bug

[ Upstream commit 48ec7014c56e5eb2fbf6f479896143622d834f3b ]

In mlx4_en_config_rss_steer(), 'rss_map->indir_qp' is allocated through
kzalloc(). After that, mlx4_qp_alloc() is invoked to configure RSS
indirection. However, if mlx4_qp_alloc() fails, the allocated
'rss_map->indir_qp' is not deallocated, leading to a memory leak bug.

To fix the above issue, add the 'qp_alloc_err' label to free
'rss_map->indir_qp'.

Fixes: 4931c6ef04b4 ("net/mlx4_en: Optimized single ring steering")
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index f5cd9539980f8..45d9a5f8fa1bc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -1190,7 +1190,7 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
 	err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, rss_map->indir_qp);
 	if (err) {
 		en_err(priv, "Failed to allocate RSS indirection QP\n");
-		goto rss_err;
+		goto qp_alloc_err;
 	}
 
 	rss_map->indir_qp->event = mlx4_en_sqp_event;
@@ -1244,6 +1244,7 @@ indir_err:
 		       MLX4_QP_STATE_RST, NULL, 0, 0, rss_map->indir_qp);
 	mlx4_qp_remove(mdev->dev, rss_map->indir_qp);
 	mlx4_qp_free(mdev->dev, rss_map->indir_qp);
+qp_alloc_err:
 	kfree(rss_map->indir_qp);
 	rss_map->indir_qp = NULL;
 rss_err:
-- 
GitLab


From 154e6bc497c9c4dd4c8ce41a10615dbe474135cf Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 14 Aug 2019 02:11:57 -0700
Subject: [PATCH 1600/1835] net/packet: fix race in tpacket_snd()

[ Upstream commit 32d3182cd2cd29b2e7e04df7b0db350fbe11289f ]

packet_sendmsg() checks tx_ring.pg_vec to decide
if it must call tpacket_snd().

Problem is that the check is lockless, meaning another thread
can issue a concurrent setsockopt(PACKET_TX_RING ) to flip
tx_ring.pg_vec back to NULL.

Given that tpacket_snd() grabs pg_vec_lock mutex, we can
perform the check again to solve the race.

syzbot reported :

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 11429 Comm: syz-executor394 Not tainted 5.3.0-rc4+ #101
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:packet_lookup_frame+0x8d/0x270 net/packet/af_packet.c:474
Code: c1 ee 03 f7 73 0c 80 3c 0e 00 0f 85 cb 01 00 00 48 8b 0b 89 c0 4c 8d 24 c1 48 b8 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 <80> 3c 01 00 0f 85 94 01 00 00 48 8d 7b 10 4d 8b 3c 24 48 b8 00 00
RSP: 0018:ffff88809f82f7b8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880a45c7030 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffff110148b8e06 RDI: ffff8880a45c703c
RBP: ffff88809f82f7e8 R08: ffff888087aea200 R09: fffffbfff134ae50
R10: fffffbfff134ae4f R11: ffffffff89a5727f R12: 0000000000000000
R13: 0000000000000001 R14: ffff8880a45c6ac0 R15: 0000000000000000
FS:  00007fa04716f700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa04716edb8 CR3: 0000000091eb4000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 packet_current_frame net/packet/af_packet.c:487 [inline]
 tpacket_snd net/packet/af_packet.c:2667 [inline]
 packet_sendmsg+0x590/0x6250 net/packet/af_packet.c:2975
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:657
 ___sys_sendmsg+0x3e2/0x920 net/socket.c:2311
 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2439
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/packet/af_packet.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 93b5a42005850..7204e7bbebb0d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2616,6 +2616,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 
 	mutex_lock(&po->pg_vec_lock);
 
+	/* packet_sendmsg() check on tx_ring.pg_vec was lockless,
+	 * we need to confirm it under protection of pg_vec_lock.
+	 */
+	if (unlikely(!po->tx_ring.pg_vec)) {
+		err = -EBUSY;
+		goto out;
+	}
 	if (likely(saddr == NULL)) {
 		dev	= packet_cached_dev_get(po);
 		proto	= po->num;
-- 
GitLab


From 227f204ad1974866bb79b29a94e8b9ee9491793a Mon Sep 17 00:00:00 2001
From: zhengbin <zhengbin13@huawei.com>
Date: Tue, 13 Aug 2019 22:05:50 +0800
Subject: [PATCH 1601/1835] sctp: fix memleak in sctp_send_reset_streams

[ Upstream commit 6d5afe20397b478192ed8c38ec0ee10fa3aec649 ]

If the stream outq is not empty, need to kfree nstr_list.

Fixes: d570a59c5b5f ("sctp: only allow the out stream reset when the stream outq is empty")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/stream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 0da57938a6c5d..87061a4bb44b6 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -416,6 +416,7 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
 		nstr_list[i] = htons(str_list[i]);
 
 	if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
+		kfree(nstr_list);
 		retval = -EAGAIN;
 		goto out;
 	}
-- 
GitLab


From eeb148d20819b94d22990a162f751f4df12a660b Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 12 Aug 2019 20:49:12 +0800
Subject: [PATCH 1602/1835] sctp: fix the transport error_count check

[ Upstream commit a1794de8b92ea6bc2037f445b296814ac826693e ]

As the annotation says in sctp_do_8_2_transport_strike():

  "If the transport error count is greater than the pf_retrans
   threshold, and less than pathmaxrtx ..."

It should be transport->error_count checked with pathmaxrxt,
instead of asoc->pf_retrans.

Fixes: 5aa93bcf66f4 ("sctp: Implement quick failover draft from tsvwg")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/sm_sideeffect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 3131b4154c74d..28adac31f0ff0 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -561,7 +561,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
 	 */
 	if (net->sctp.pf_enable &&
 	   (transport->state == SCTP_ACTIVE) &&
-	   (asoc->pf_retrans < transport->pathmaxrxt) &&
+	   (transport->error_count < transport->pathmaxrxt) &&
 	   (transport->error_count > asoc->pf_retrans)) {
 
 		sctp_assoc_control_transport(asoc, transport,
-- 
GitLab


From e89bb758c030150f6cf0a990011f109258b815dd Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Thu, 8 Aug 2019 14:22:47 +0800
Subject: [PATCH 1603/1835] team: Add vlan tx offload to hw_enc_features

[ Upstream commit 227f2f030e28d8783c3d10ce70ff4ba79cad653f ]

We should also enable team's vlan tx offload in hw_enc_features,
pass the vlan packets to the slave devices with vlan tci, let the
slave handle vlan tunneling offload implementation.

Fixes: 3268e5cb494d ("team: Advertise tunneling offload features")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/team/team.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index dc30f11f47664..3feb49badda9c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1011,6 +1011,8 @@ static void __team_compute_features(struct team *team)
 
 	team->dev->vlan_features = vlan_features;
 	team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+				     NETIF_F_HW_VLAN_CTAG_TX |
+				     NETIF_F_HW_VLAN_STAG_TX |
 				     NETIF_F_GSO_UDP_L4;
 	team->dev->hard_header_len = max_hard_header_len;
 
-- 
GitLab


From cc4ff0f4f564a4e88bb88507b6b333eced41b4bb Mon Sep 17 00:00:00 2001
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
Date: Mon, 12 Aug 2019 08:18:25 +1200
Subject: [PATCH 1604/1835] tipc: initialise addr_trail_end when setting node
 addresses

[ Upstream commit 8874ecae2977e5a2d4f0ba301364435b81c05938 ]

We set the field 'addr_trial_end' to 'jiffies', instead of the current
value 0, at the moment the node address is initialized. This guarantees
we don't inadvertently enter an address trial period when the node
address is explicitly set by the user.

Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/addr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index b88d48d009130..0f1eaed1bd1b3 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -75,6 +75,7 @@ void tipc_set_node_addr(struct net *net, u32 addr)
 		tipc_set_node_id(net, node_id);
 	}
 	tn->trial_addr = addr;
+	tn->addr_trial_end = jiffies;
 	pr_info("32-bit node address hash set to %x\n", addr);
 }
 
-- 
GitLab


From b3410f0f850567cf1fa673b46a817928c8d9361f Mon Sep 17 00:00:00 2001
From: Ross Lagerwall <ross.lagerwall@citrix.com>
Date: Mon, 5 Aug 2019 16:34:34 +0100
Subject: [PATCH 1605/1835] xen/netback: Reset nr_frags before freeing skb

[ Upstream commit 3a0233ddec554b886298de2428edb5c50a20e694 ]

At this point nr_frags has been incremented but the frag does not yet
have a page assigned so freeing the skb results in a crash. Reset
nr_frags before freeing the skb to prevent this.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/netback.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index d5081ffdc8f03..1c849106b7935 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 			skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
 			nskb = xenvif_alloc_skb(0);
 			if (unlikely(nskb == NULL)) {
+				skb_shinfo(skb)->nr_frags = 0;
 				kfree_skb(skb);
 				xenvif_tx_err(queue, &txreq, extra_count, idx);
 				if (net_ratelimit())
@@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 
 			if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
 				/* Failure in xenvif_set_skb_gso is fatal. */
+				skb_shinfo(skb)->nr_frags = 0;
 				kfree_skb(skb);
 				kfree_skb(nskb);
 				break;
-- 
GitLab


From fbd8ab68067534a11976ba2031f531644669ee51 Mon Sep 17 00:00:00 2001
From: Huy Nguyen <huyn@mellanox.com>
Date: Thu, 1 Aug 2019 11:10:19 -0500
Subject: [PATCH 1606/1835] net/mlx5e: Only support tx/rx pause setting for
 port owner

[ Upstream commit 466df6eb4a9e813b3cfc674363316450c57a89c5 ]

Only support changing tx/rx pause frame setting if the net device
is the vport group manager.

Fixes: 3c2d18ef22df ("net/mlx5e: Support ethtool get/set_pauseparam")
Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Reviewed-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 792bb8bc0cd34..2b9350f4c7522 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1083,6 +1083,9 @@ static int mlx5e_set_pauseparam(struct net_device *netdev,
 	struct mlx5_core_dev *mdev = priv->mdev;
 	int err;
 
+	if (!MLX5_CAP_GEN(mdev, vport_group_manager))
+		return -EOPNOTSUPP;
+
 	if (pauseparam->autoneg)
 		return -EINVAL;
 
-- 
GitLab


From 447f5f48f4fad049e8f7d7c86ec45825af130ca8 Mon Sep 17 00:00:00 2001
From: Maxim Mikityanskiy <maximmi@mellanox.com>
Date: Fri, 5 Jul 2019 17:59:28 +0300
Subject: [PATCH 1607/1835] net/mlx5e: Use flow keys dissector to parse packets
 for ARFS

[ Upstream commit 405b93eb764367a670e729da18e54dc42db32620 ]

The current ARFS code relies on certain fields to be set in the SKB
(e.g. transport_header) and extracts IP addresses and ports by custom
code that parses the packet. The necessary SKB fields, however, are not
always set at that point, which leads to an out-of-bounds access. Use
skb_flow_dissect_flow_keys() to get the necessary information reliably,
fix the out-of-bounds access and reuse the code.

Fixes: 18c908e477dc ("net/mlx5e: Add accelerated RFS support")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 97 +++++++------------
 1 file changed, 34 insertions(+), 63 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
index 45cdde694d200..a4be04debe671 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
@@ -437,12 +437,6 @@ arfs_hash_bucket(struct arfs_table *arfs_t, __be16 src_port,
 	return &arfs_t->rules_hash[bucket_idx];
 }
 
-static u8 arfs_get_ip_proto(const struct sk_buff *skb)
-{
-	return (skb->protocol == htons(ETH_P_IP)) ?
-		ip_hdr(skb)->protocol : ipv6_hdr(skb)->nexthdr;
-}
-
 static struct arfs_table *arfs_get_table(struct mlx5e_arfs_tables *arfs,
 					 u8 ip_proto, __be16 etype)
 {
@@ -599,31 +593,9 @@ out:
 	arfs_may_expire_flow(priv);
 }
 
-/* return L4 destination port from ip4/6 packets */
-static __be16 arfs_get_dst_port(const struct sk_buff *skb)
-{
-	char *transport_header;
-
-	transport_header = skb_transport_header(skb);
-	if (arfs_get_ip_proto(skb) == IPPROTO_TCP)
-		return ((struct tcphdr *)transport_header)->dest;
-	return ((struct udphdr *)transport_header)->dest;
-}
-
-/* return L4 source port from ip4/6 packets */
-static __be16 arfs_get_src_port(const struct sk_buff *skb)
-{
-	char *transport_header;
-
-	transport_header = skb_transport_header(skb);
-	if (arfs_get_ip_proto(skb) == IPPROTO_TCP)
-		return ((struct tcphdr *)transport_header)->source;
-	return ((struct udphdr *)transport_header)->source;
-}
-
 static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
 					 struct arfs_table *arfs_t,
-					 const struct sk_buff *skb,
+					 const struct flow_keys *fk,
 					 u16 rxq, u32 flow_id)
 {
 	struct arfs_rule *rule;
@@ -638,19 +610,19 @@ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
 	INIT_WORK(&rule->arfs_work, arfs_handle_work);
 
 	tuple = &rule->tuple;
-	tuple->etype = skb->protocol;
+	tuple->etype = fk->basic.n_proto;
+	tuple->ip_proto = fk->basic.ip_proto;
 	if (tuple->etype == htons(ETH_P_IP)) {
-		tuple->src_ipv4 = ip_hdr(skb)->saddr;
-		tuple->dst_ipv4 = ip_hdr(skb)->daddr;
+		tuple->src_ipv4 = fk->addrs.v4addrs.src;
+		tuple->dst_ipv4 = fk->addrs.v4addrs.dst;
 	} else {
-		memcpy(&tuple->src_ipv6, &ipv6_hdr(skb)->saddr,
+		memcpy(&tuple->src_ipv6, &fk->addrs.v6addrs.src,
 		       sizeof(struct in6_addr));
-		memcpy(&tuple->dst_ipv6, &ipv6_hdr(skb)->daddr,
+		memcpy(&tuple->dst_ipv6, &fk->addrs.v6addrs.dst,
 		       sizeof(struct in6_addr));
 	}
-	tuple->ip_proto = arfs_get_ip_proto(skb);
-	tuple->src_port = arfs_get_src_port(skb);
-	tuple->dst_port = arfs_get_dst_port(skb);
+	tuple->src_port = fk->ports.src;
+	tuple->dst_port = fk->ports.dst;
 
 	rule->flow_id = flow_id;
 	rule->filter_id = priv->fs.arfs.last_filter_id++ % RPS_NO_FILTER;
@@ -661,37 +633,33 @@ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
 	return rule;
 }
 
-static bool arfs_cmp_ips(struct arfs_tuple *tuple,
-			 const struct sk_buff *skb)
+static bool arfs_cmp(const struct arfs_tuple *tuple, const struct flow_keys *fk)
 {
-	if (tuple->etype == htons(ETH_P_IP) &&
-	    tuple->src_ipv4 == ip_hdr(skb)->saddr &&
-	    tuple->dst_ipv4 == ip_hdr(skb)->daddr)
-		return true;
-	if (tuple->etype == htons(ETH_P_IPV6) &&
-	    (!memcmp(&tuple->src_ipv6, &ipv6_hdr(skb)->saddr,
-		     sizeof(struct in6_addr))) &&
-	    (!memcmp(&tuple->dst_ipv6, &ipv6_hdr(skb)->daddr,
-		     sizeof(struct in6_addr))))
-		return true;
+	if (tuple->src_port != fk->ports.src || tuple->dst_port != fk->ports.dst)
+		return false;
+	if (tuple->etype != fk->basic.n_proto)
+		return false;
+	if (tuple->etype == htons(ETH_P_IP))
+		return tuple->src_ipv4 == fk->addrs.v4addrs.src &&
+		       tuple->dst_ipv4 == fk->addrs.v4addrs.dst;
+	if (tuple->etype == htons(ETH_P_IPV6))
+		return !memcmp(&tuple->src_ipv6, &fk->addrs.v6addrs.src,
+			       sizeof(struct in6_addr)) &&
+		       !memcmp(&tuple->dst_ipv6, &fk->addrs.v6addrs.dst,
+			       sizeof(struct in6_addr));
 	return false;
 }
 
 static struct arfs_rule *arfs_find_rule(struct arfs_table *arfs_t,
-					const struct sk_buff *skb)
+					const struct flow_keys *fk)
 {
 	struct arfs_rule *arfs_rule;
 	struct hlist_head *head;
-	__be16 src_port = arfs_get_src_port(skb);
-	__be16 dst_port = arfs_get_dst_port(skb);
 
-	head = arfs_hash_bucket(arfs_t, src_port, dst_port);
+	head = arfs_hash_bucket(arfs_t, fk->ports.src, fk->ports.dst);
 	hlist_for_each_entry(arfs_rule, head, hlist) {
-		if (arfs_rule->tuple.src_port == src_port &&
-		    arfs_rule->tuple.dst_port == dst_port &&
-		    arfs_cmp_ips(&arfs_rule->tuple, skb)) {
+		if (arfs_cmp(&arfs_rule->tuple, fk))
 			return arfs_rule;
-		}
 	}
 
 	return NULL;
@@ -704,20 +672,24 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
 	struct mlx5e_arfs_tables *arfs = &priv->fs.arfs;
 	struct arfs_table *arfs_t;
 	struct arfs_rule *arfs_rule;
+	struct flow_keys fk;
+
+	if (!skb_flow_dissect_flow_keys(skb, &fk, 0))
+		return -EPROTONOSUPPORT;
 
-	if (skb->protocol != htons(ETH_P_IP) &&
-	    skb->protocol != htons(ETH_P_IPV6))
+	if (fk.basic.n_proto != htons(ETH_P_IP) &&
+	    fk.basic.n_proto != htons(ETH_P_IPV6))
 		return -EPROTONOSUPPORT;
 
 	if (skb->encapsulation)
 		return -EPROTONOSUPPORT;
 
-	arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol);
+	arfs_t = arfs_get_table(arfs, fk.basic.ip_proto, fk.basic.n_proto);
 	if (!arfs_t)
 		return -EPROTONOSUPPORT;
 
 	spin_lock_bh(&arfs->arfs_lock);
-	arfs_rule = arfs_find_rule(arfs_t, skb);
+	arfs_rule = arfs_find_rule(arfs_t, &fk);
 	if (arfs_rule) {
 		if (arfs_rule->rxq == rxq_index) {
 			spin_unlock_bh(&arfs->arfs_lock);
@@ -725,8 +697,7 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
 		}
 		arfs_rule->rxq = rxq_index;
 	} else {
-		arfs_rule = arfs_alloc_rule(priv, arfs_t, skb,
-					    rxq_index, flow_id);
+		arfs_rule = arfs_alloc_rule(priv, arfs_t, &fk, rxq_index, flow_id);
 		if (!arfs_rule) {
 			spin_unlock_bh(&arfs->arfs_lock);
 			return -ENOMEM;
-- 
GitLab


From 7c13983a2860294925ee5a1faa989f13cea8232e Mon Sep 17 00:00:00 2001
From: Michal Simek <michal.simek@xilinx.com>
Date: Mon, 6 Aug 2018 10:43:10 +0200
Subject: [PATCH 1608/1835] mmc: sdhci-of-arasan: Do now show error message in
 case of deffered probe

commit 60208a267208c27fa3f23dfd36cbda180471fa98 upstream.

When mmc-pwrseq property is passed mmc_pwrseq_alloc() can return
-EPROBE_DEFER because driver for power sequence provider is not probed
yet. Do not show error message when this situation happens.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-of-arasan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index 7fdac277e382f..9c77bfe4334f3 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -788,7 +788,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev)
 
 	ret = mmc_of_parse(host->mmc);
 	if (ret) {
-		dev_err(&pdev->dev, "parsing dt failed (%d)\n", ret);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "parsing dt failed (%d)\n", ret);
 		goto unreg_clk;
 	}
 
-- 
GitLab


From def4c11b31312777a8db1f1083e0d4bc6c9bbef0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 25 Aug 2019 10:48:06 +0200
Subject: [PATCH 1609/1835] Linux 4.19.68

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index b6aa6e8d4411f..6f164b04d953b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 67
+SUBLEVEL = 68
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 7241f531acc796d03fb2fdc5ceb52576e16113ad Mon Sep 17 00:00:00 2001
From: Aman Gupta <aman@tmm1.net>
Date: Fri, 23 Aug 2019 16:29:07 -0700
Subject: [PATCH 1610/1835] staging: bcm2835-codec: remove unnecessary padding
 on encoder input

The ISP and ENCODE roles have the same underlying hardware. Neither requires vertical alignment.

Signed-off-by: Aman Gupta <aman@tmm1.net>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 6ef7b16374953..d4a31d0259ccb 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -1050,12 +1050,12 @@ static int vidioc_try_fmt(struct bcm2835_codec_ctx *ctx, struct v4l2_format *f,
 			f->fmt.pix_mp.height = MIN_H;
 
 		/*
-		 * For codecs the buffer must have a vertical alignment of 16
+		 * For decoders the buffer must have a vertical alignment of 16
 		 * lines.
 		 * The selection will reflect any cropping rectangle when only
 		 * some of the pixels are active.
 		 */
-		if (ctx->dev->role != ISP)
+		if (ctx->dev->role == DECODE)
 			f->fmt.pix_mp.height = ALIGN(f->fmt.pix_mp.height, 16);
 	}
 	f->fmt.pix_mp.num_planes = 1;
-- 
GitLab


From 117a698295eb616398109b244de67231dd233f02 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Wed, 15 May 2019 19:14:18 +0200
Subject: [PATCH 1611/1835] watchdog: bcm2835_wdt: Fix module autoload

The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe
to an MFD.") broke module autoloading on Raspberry Pi. So add a
module alias this fix this.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
---
 drivers/watchdog/bcm2835_wdt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 4ed73194a64df..81783f628b4de 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -246,6 +246,7 @@ module_param(nowayout, bool, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
 				__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+MODULE_ALIAS("platform:bcm2835-wdt");
 MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
 MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
 MODULE_LICENSE("GPL");
-- 
GitLab


From a6067c6e630f99e9b994707b5659acdecb68a34d Mon Sep 17 00:00:00 2001
From: Ilya Trukhanov <lahvuun@gmail.com>
Date: Tue, 2 Jul 2019 13:37:16 +0300
Subject: [PATCH 1612/1835] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT

[ Upstream commit 65f11c72780fa9d598df88def045ccb6a885cf80 ]

Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force
gamepad. Compared to other Thrustmaster devices, left and right rumble
motors here are swapped.

Signed-off-by: Ilya Trukhanov <lahvuun@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-tmff.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index bea8def64f437..30b8c3256c991 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -34,6 +34,8 @@
 
 #include "hid-ids.h"
 
+#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT	0xb320
+
 static const signed short ff_rumble[] = {
 	FF_RUMBLE,
 	-1
@@ -88,6 +90,7 @@ static int tmff_play(struct input_dev *dev, void *data,
 	struct hid_field *ff_field = tmff->ff_field;
 	int x, y;
 	int left, right;	/* Rumbling */
+	int motor_swap;
 
 	switch (effect->type) {
 	case FF_CONSTANT:
@@ -112,6 +115,13 @@ static int tmff_play(struct input_dev *dev, void *data,
 					ff_field->logical_minimum,
 					ff_field->logical_maximum);
 
+		/* 2-in-1 strong motor is left */
+		if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
+			motor_swap = left;
+			left = right;
+			right = motor_swap;
+		}
+
 		dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
 		ff_field->value[0] = left;
 		ff_field->value[1] = right;
@@ -238,6 +248,8 @@ static const struct hid_device_id tm_devices[] = {
 		.driver_data = (unsigned long)ff_rumble },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304),   /* FireStorm Dual Power 2 (and 3) */
 		.driver_data = (unsigned long)ff_rumble },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT),   /* Dual Trigger 2-in-1 */
+		.driver_data = (unsigned long)ff_rumble },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323),   /* Dual Trigger 3-in-1 (PC Mode) */
 		.driver_data = (unsigned long)ff_rumble },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324),   /* Dual Trigger 3-in-1 (PS3 Mode) */
-- 
GitLab


From 326175aa28fd29faf7b6554f4f370cae14155aae Mon Sep 17 00:00:00 2001
From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Date: Mon, 13 May 2019 13:47:25 +0200
Subject: [PATCH 1613/1835] MIPS: kernel: only use i8253 clocksource with
 periodic clockevent

[ Upstream commit a07e3324538a989b7cdbf2c679be6a7f9df2544f ]

i8253 clocksource needs a free running timer. This could only
be used, if i8253 clockevent is set up as periodic.

Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/kernel/i8253.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
index 5f209f111e59e..df7ddd246eaac 100644
--- a/arch/mips/kernel/i8253.c
+++ b/arch/mips/kernel/i8253.c
@@ -32,7 +32,8 @@ void __init setup_pit_timer(void)
 
 static int __init init_pit_clocksource(void)
 {
-	if (num_possible_cpus() > 1) /* PIT does not scale! */
+	if (num_possible_cpus() > 1 || /* PIT does not scale! */
+	    !clockevent_state_periodic(&i8253_clockevent))
 		return 0;
 
 	return clocksource_i8253_init();
-- 
GitLab


From 70b4edd74b6dbd28e12486e5c679c7c128c07b54 Mon Sep 17 00:00:00 2001
From: Vladimir Kondratiev <vladimir.kondratiev@linux.intel.com>
Date: Tue, 16 Jul 2019 10:36:56 +0300
Subject: [PATCH 1614/1835] mips: fix cacheinfo

[ Upstream commit b8bea8a5e5d942e62203416ab41edecaed4fda02 ]

Because CONFIG_OF defined for MIPS, cacheinfo attempts to fill information
from DT, ignoring data filled by architecture routine. This leads to error
reported

 cacheinfo: Unable to detect cache hierarchy for CPU 0

Way to fix this provided in
commit fac51482577d ("drivers: base: cacheinfo: fix x86 with
 CONFIG_OF enabled")

Utilize same mechanism to report that cacheinfo set by architecture
specific function

Signed-off-by: Vladimir Kondratiev <vladimir.kondratiev@linux.intel.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/kernel/cacheinfo.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
index 97d5239ca47ba..428ef21892039 100644
--- a/arch/mips/kernel/cacheinfo.c
+++ b/arch/mips/kernel/cacheinfo.c
@@ -80,6 +80,8 @@ static int __populate_cache_leaves(unsigned int cpu)
 	if (c->tcache.waysize)
 		populate_cache(tcache, this_leaf, 3, CACHE_TYPE_UNIFIED);
 
+	this_cpu_ci->cpu_map_populated = true;
+
 	return 0;
 }
 
-- 
GitLab


From 71305e8ee503f03561377ec6584d5b284973599f Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Sat, 20 Jul 2019 07:22:45 -0500
Subject: [PATCH 1615/1835] netfilter: ebtables: fix a memory leak bug in
 compat

[ Upstream commit 15a78ba1844a8e052c1226f930133de4cef4e7ad ]

In compat_do_replace(), a temporary buffer is allocated through vmalloc()
to hold entries copied from the user space. The buffer address is firstly
saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then
the entries in this temporary buffer is copied to the internal kernel
structure through compat_copy_entries(). If this copy process fails,
compat_do_replace() should be terminated. However, the allocated temporary
buffer is not freed on this path, leading to a memory leak.

To fix the bug, free the buffer before returning from compat_do_replace().

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/ebtables.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 995b3842ba7c0..62ffc989a44a2 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2274,8 +2274,10 @@ static int compat_do_replace(struct net *net, void __user *user,
 	state.buf_kern_len = size64;
 
 	ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
-	if (WARN_ON(ret < 0))
+	if (WARN_ON(ret < 0)) {
+		vfree(entries_tmp);
 		goto out_unlock;
+	}
 
 	vfree(entries_tmp);
 	tmp.entries_size = size64;
-- 
GitLab


From e6dc6409f47446ba632b8bd7415529e5986d99a2 Mon Sep 17 00:00:00 2001
From: Charles Keepax <ckeepax@opensource.cirrus.com>
Date: Thu, 18 Jul 2019 09:43:33 +0100
Subject: [PATCH 1616/1835] ASoC: dapm: Fix handling of custom_stop_condition
 on DAPM graph walks

[ Upstream commit 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77 ]

DPCM uses snd_soc_dapm_dai_get_connected_widgets to build a
list of the widgets connected to a specific front end DAI so it
can search through this list for available back end DAIs. The
custom_stop_condition was added to is_connected_ep to facilitate this
list not containing more widgets than is necessary. Doing so both
speeds up the DPCM handling as less widgets need to be searched and
avoids issues with CODEC to CODEC links as these would be confused
with back end DAIs if they appeared in the list of available widgets.

custom_stop_condition was implemented by aborting the graph walk
when the condition is triggered, however there is an issue with this
approach. Whilst walking the graph is_connected_ep should update the
endpoints cache on each widget, if the walk is aborted the number
of attached end points is unknown for that sub-graph. When the stop
condition triggered, the original patch ignored the triggering widget
and returned zero connected end points; a later patch updated this
to set the triggering widget's cache to 1 and return that. Both of
these approaches result in inaccurate values being stored in various
end point caches as the values propagate back through the graph,
which can result in later issues with widgets powering/not powering
unexpectedly.

As the original goal was to reduce the size of the widget list passed
to the DPCM code, the simplest solution is to limit the functionality
of the custom_stop_condition to the widget list. This means the rest
of the graph will still be processed resulting in correct end point
caches, but only widgets up to the stop condition will be added to the
returned widget list.

Fixes: 6742064aef7f ("ASoC: dapm: support user-defined stop condition in dai_get_connected_widgets")
Fixes: 5fdd022c2026 ("ASoC: dpcm: play nice with CODEC<->CODEC links")
Fixes: 09464974eaa8 ("ASoC: dapm: Fix to return correct path list in is_connected_ep.")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20190718084333.15598-1-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-dapm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 3bfc788372f31..4ce57510b6236 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1145,8 +1145,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
 		list_add_tail(&widget->work_list, list);
 
 	if (custom_stop_condition && custom_stop_condition(widget, dir)) {
-		widget->endpoints[dir] = 1;
-		return widget->endpoints[dir];
+		list = NULL;
+		custom_stop_condition = NULL;
 	}
 
 	if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) {
@@ -1183,8 +1183,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
  *
  * Optionally, can be supplied with a function acting as a stopping condition.
  * This function takes the dapm widget currently being examined and the walk
- * direction as an arguments, it should return true if the walk should be
- * stopped and false otherwise.
+ * direction as an arguments, it should return true if widgets from that point
+ * in the graph onwards should not be added to the widget list.
  */
 static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
 	struct list_head *list,
-- 
GitLab


From b7038c195fd172b322ed1bf71d62ca3674407077 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 19 Jul 2019 11:06:11 +0200
Subject: [PATCH 1617/1835] selftests/bpf: fix sendmsg6_prog on s390

[ Upstream commit c8eee4135a456bc031d67cadc454e76880d1afd8 ]

"sendmsg6: rewrite IP & port (C)" fails on s390, because the code in
sendmsg_v6_prog() assumes that (ctx->user_ip6[0] & 0xFFFF) refers to
leading IPv6 address digits, which is not the case on big-endian
machines.

Since checking bitwise operations doesn't seem to be the point of the
test, replace two short comparisons with a single int comparison.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/sendmsg6_prog.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/sendmsg6_prog.c b/tools/testing/selftests/bpf/sendmsg6_prog.c
index 5aeaa284fc474..a680628204108 100644
--- a/tools/testing/selftests/bpf/sendmsg6_prog.c
+++ b/tools/testing/selftests/bpf/sendmsg6_prog.c
@@ -41,8 +41,7 @@ int sendmsg_v6_prog(struct bpf_sock_addr *ctx)
 	}
 
 	/* Rewrite destination. */
-	if ((ctx->user_ip6[0] & 0xFFFF) == bpf_htons(0xFACE) &&
-	     ctx->user_ip6[0] >> 16 == bpf_htons(0xB00C)) {
+	if (ctx->user_ip6[0] == bpf_htonl(0xFACEB00C)) {
 		ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0);
 		ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1);
 		ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2);
-- 
GitLab


From a1e5a76db8ddfd8dbd629af14c73e6b7de4955bd Mon Sep 17 00:00:00 2001
From: Thomas Falcon <tlfalcon@linux.ibm.com>
Date: Tue, 16 Jul 2019 17:25:10 -0500
Subject: [PATCH 1618/1835] bonding: Force slave speed check after link state
 recovery for 802.3ad

[ Upstream commit 12185dfe44360f814ac4ead9d22ad2af7511b2e9 ]

The following scenario was encountered during testing of logical
partition mobility on pseries partitions with bonded ibmvnic
adapters in LACP mode.

1. Driver receives a signal that the device has been
   swapped, and it needs to reset to initialize the new
   device.

2. Driver reports loss of carrier and begins initialization.

3. Bonding driver receives NETDEV_CHANGE notifier and checks
   the slave's current speed and duplex settings. Because these
   are unknown at the time, the bond sets its link state to
   BOND_LINK_FAIL and handles the speed update, clearing
   AD_PORT_LACP_ENABLE.

4. Driver finishes recovery and reports that the carrier is on.

5. Bond receives a new notification and checks the speed again.
   The speeds are valid but miimon has not altered the link
   state yet.  AD_PORT_LACP_ENABLE remains off.

Because the slave's link state is still BOND_LINK_FAIL,
no further port checks are made when it recovers. Though
the slave devices are operational and have valid speed
and duplex settings, the bond will not send LACPDU's. The
simplest fix I can see is to force another speed check
in bond_miimon_commit. This way the bond will update
AD_PORT_LACP_ENABLE if needed when transitioning from
BOND_LINK_FAIL to BOND_LINK_UP.

CC: Jarod Wilson <jarod@redhat.com>
CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Veaceslav Falico <vfalico@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 8f14f85b8e95e..0d2392c4b625a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2190,6 +2190,15 @@ static void bond_miimon_commit(struct bonding *bond)
 	bond_for_each_slave(bond, slave, iter) {
 		switch (slave->new_link) {
 		case BOND_LINK_NOCHANGE:
+			/* For 802.3ad mode, check current slave speed and
+			 * duplex again in case its port was disabled after
+			 * invalid speed/duplex reporting but recovered before
+			 * link monitoring could make a decision on the actual
+			 * link status
+			 */
+			if (BOND_MODE(bond) == BOND_MODE_8023AD &&
+			    slave->link == BOND_LINK_UP)
+				bond_3ad_adapter_speed_duplex_changed(slave);
 			continue;
 
 		case BOND_LINK_UP:
-- 
GitLab


From 192bbe9d57ed9dd1285796c5f0236bda91842c38 Mon Sep 17 00:00:00 2001
From: Maxime Chevallier <maxime.chevallier@bootlin.com>
Date: Fri, 19 Jul 2019 16:38:48 +0200
Subject: [PATCH 1619/1835] net: mvpp2: Don't check for 3 consecutive Idle
 frames for 10G links

[ Upstream commit bba18318e7d1d5c8b0bbafd65010a0cee3c65608 ]

PPv2's XLGMAC can wait for 3 idle frames before triggering a link up
event. This can cause the link to be stuck low when there's traffic on
the interface, so disable this feature.

Fixes: 4bb043262878 ("net: mvpp2: phylink support")
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 6455511457ca3..9b608d23ff7ee 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -4412,9 +4412,9 @@ static void mvpp2_xlg_config(struct mvpp2_port *port, unsigned int mode,
 	if (state->pause & MLO_PAUSE_RX)
 		ctrl0 |= MVPP22_XLG_CTRL0_RX_FLOW_CTRL_EN;
 
-	ctrl4 &= ~MVPP22_XLG_CTRL4_MACMODSELECT_GMAC;
-	ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC |
-		 MVPP22_XLG_CTRL4_EN_IDLE_CHECK;
+	ctrl4 &= ~(MVPP22_XLG_CTRL4_MACMODSELECT_GMAC |
+		   MVPP22_XLG_CTRL4_EN_IDLE_CHECK);
+	ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC;
 
 	writel(ctrl0, port->base + MVPP22_XLG_CTRL0_REG);
 	writel(ctrl4, port->base + MVPP22_XLG_CTRL4_REG);
-- 
GitLab


From ef52e2b9a621d1a6ccbe2fe3e7edd7e14ff0f226 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@mellanox.com>
Date: Tue, 23 Jul 2019 11:19:25 +0300
Subject: [PATCH 1620/1835] selftests: forwarding: gre_multipath: Enable IPv4
 forwarding

[ Upstream commit efa7b79f675da0efafe3f32ba0d6efe916cf4867 ]

The test did not enable IPv4 forwarding during its setup phase, which
causes the test to fail on machines where IPv4 forwarding is disabled.

Fixes: 54818c4c4b93 ("selftests: forwarding: Test multipath tunneling")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Tested-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/forwarding/gre_multipath.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh
index cca2baa03fb81..37d7297e1cf8a 100755
--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh
+++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh
@@ -187,12 +187,16 @@ setup_prepare()
 	sw1_create
 	sw2_create
 	h2_create
+
+	forwarding_enable
 }
 
 cleanup()
 {
 	pre_cleanup
 
+	forwarding_restore
+
 	h2_destroy
 	sw2_destroy
 	sw1_destroy
-- 
GitLab


From 43d31fd9a8f243cd2a021df682dce1e6979a2a2e Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@mellanox.com>
Date: Tue, 23 Jul 2019 11:19:26 +0300
Subject: [PATCH 1621/1835] selftests: forwarding: gre_multipath: Fix flower
 filters

[ Upstream commit 1be79d89b7ae96e004911bd228ce8c2b5cc6415f ]

The TC filters used in the test do not work with veth devices because the
outer Ethertype is 802.1Q and not IPv4. The test passes with mlxsw
netdevs since the hardware always looks at "The first Ethertype that
does not point to either: VLAN, CNTAG or configurable Ethertype".

Fix this by matching on the VLAN ID instead, but on the ingress side.
The reason why this is not performed at egress is explained in the
commit cited below.

Fixes: 541ad323db3a ("selftests: forwarding: gre_multipath: Update next-hop statistics match criteria")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Tested-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/net/forwarding/gre_multipath.sh | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh
index 37d7297e1cf8a..a8d8e8b3dc819 100755
--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh
+++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh
@@ -93,18 +93,10 @@ sw1_create()
 	ip route add vrf v$ol1 192.0.2.16/28 \
 	   nexthop dev g1a \
 	   nexthop dev g1b
-
-	tc qdisc add dev $ul1 clsact
-	tc filter add dev $ul1 egress pref 111 prot ipv4 \
-	   flower dst_ip 192.0.2.66 action pass
-	tc filter add dev $ul1 egress pref 222 prot ipv4 \
-	   flower dst_ip 192.0.2.82 action pass
 }
 
 sw1_destroy()
 {
-	tc qdisc del dev $ul1 clsact
-
 	ip route del vrf v$ol1 192.0.2.16/28
 
 	ip route del vrf v$ol1 192.0.2.82/32 via 192.0.2.146
@@ -139,10 +131,18 @@ sw2_create()
 	ip route add vrf v$ol2 192.0.2.0/28 \
 	   nexthop dev g2a \
 	   nexthop dev g2b
+
+	tc qdisc add dev $ul2 clsact
+	tc filter add dev $ul2 ingress pref 111 prot 802.1Q \
+	   flower vlan_id 111 action pass
+	tc filter add dev $ul2 ingress pref 222 prot 802.1Q \
+	   flower vlan_id 222 action pass
 }
 
 sw2_destroy()
 {
+	tc qdisc del dev $ul2 clsact
+
 	ip route del vrf v$ol2 192.0.2.0/28
 
 	ip route del vrf v$ol2 192.0.2.81/32 via 192.0.2.145
@@ -215,15 +215,15 @@ multipath4_test()
 	   nexthop dev g1a weight $weight1 \
 	   nexthop dev g1b weight $weight2
 
-	local t0_111=$(tc_rule_stats_get $ul1 111 egress)
-	local t0_222=$(tc_rule_stats_get $ul1 222 egress)
+	local t0_111=$(tc_rule_stats_get $ul2 111 ingress)
+	local t0_222=$(tc_rule_stats_get $ul2 222 ingress)
 
 	ip vrf exec v$h1 \
 	   $MZ $h1 -q -p 64 -A 192.0.2.1 -B 192.0.2.18 \
 	       -d 1msec -t udp "sp=1024,dp=0-32768"
 
-	local t1_111=$(tc_rule_stats_get $ul1 111 egress)
-	local t1_222=$(tc_rule_stats_get $ul1 222 egress)
+	local t1_111=$(tc_rule_stats_get $ul2 111 ingress)
+	local t1_222=$(tc_rule_stats_get $ul2 222 ingress)
 
 	local d111=$((t1_111 - t0_111))
 	local d222=$((t1_222 - t0_222))
-- 
GitLab


From dbf790dcb8a9d7beb57f14004e0bba8235d833b8 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Date: Mon, 24 Jun 2019 08:34:13 +0000
Subject: [PATCH 1622/1835] can: dev: call netif_carrier_off() in
 register_candev()

[ Upstream commit c63845609c4700488e5eacd6ab4d06d5d420e5ef ]

CONFIG_CAN_LEDS is deprecated. When trying to use the generic netdev
trigger as suggested, there's a small inconsistency with the link
property: The LED is on initially, stays on when the device is brought
up, and then turns off (as expected) when the device is brought down.

Make sure the LED always reflects the state of the CAN device.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index c05e4d50d43d7..bd127ce3aba24 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -1260,6 +1260,8 @@ int register_candev(struct net_device *dev)
 		return -EINVAL;
 
 	dev->rtnl_link_ops = &can_link_ops;
+	netif_carrier_off(dev);
+
 	return register_netdev(dev);
 }
 EXPORT_SYMBOL_GPL(register_candev);
-- 
GitLab


From 3257103502cf8c74d4979e96445d7409a0e7cd68 Mon Sep 17 00:00:00 2001
From: Weitao Hou <houweitaoo@gmail.com>
Date: Tue, 25 Jun 2019 20:50:48 +0800
Subject: [PATCH 1623/1835] can: mcp251x: add error check when wq alloc failed

[ Upstream commit 375f755899b8fc21196197e02aab26257df26e85 ]

add error check when workqueue alloc failed, and remove redundant code
to make it clear.

Fixes: e0000163e30e ("can: Driver for the Microchip MCP251x SPI CAN controllers")
Signed-off-by: Weitao Hou <houweitaoo@gmail.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Tested-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/spi/mcp251x.c | 49 ++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 27 deletions(-)

diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index da64e71a62ee2..fccb6bf21fada 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -678,17 +678,6 @@ static int mcp251x_power_enable(struct regulator *reg, int enable)
 		return regulator_disable(reg);
 }
 
-static void mcp251x_open_clean(struct net_device *net)
-{
-	struct mcp251x_priv *priv = netdev_priv(net);
-	struct spi_device *spi = priv->spi;
-
-	free_irq(spi->irq, priv);
-	mcp251x_hw_sleep(spi);
-	mcp251x_power_enable(priv->transceiver, 0);
-	close_candev(net);
-}
-
 static int mcp251x_stop(struct net_device *net)
 {
 	struct mcp251x_priv *priv = netdev_priv(net);
@@ -954,37 +943,43 @@ static int mcp251x_open(struct net_device *net)
 				   flags | IRQF_ONESHOT, DEVICE_NAME, priv);
 	if (ret) {
 		dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
-		mcp251x_power_enable(priv->transceiver, 0);
-		close_candev(net);
-		goto open_unlock;
+		goto out_close;
 	}
 
 	priv->wq = alloc_workqueue("mcp251x_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
 				   0);
+	if (!priv->wq) {
+		ret = -ENOMEM;
+		goto out_clean;
+	}
 	INIT_WORK(&priv->tx_work, mcp251x_tx_work_handler);
 	INIT_WORK(&priv->restart_work, mcp251x_restart_work_handler);
 
 	ret = mcp251x_hw_reset(spi);
-	if (ret) {
-		mcp251x_open_clean(net);
-		goto open_unlock;
-	}
+	if (ret)
+		goto out_free_wq;
 	ret = mcp251x_setup(net, spi);
-	if (ret) {
-		mcp251x_open_clean(net);
-		goto open_unlock;
-	}
+	if (ret)
+		goto out_free_wq;
 	ret = mcp251x_set_normal_mode(spi);
-	if (ret) {
-		mcp251x_open_clean(net);
-		goto open_unlock;
-	}
+	if (ret)
+		goto out_free_wq;
 
 	can_led_event(net, CAN_LED_EVENT_OPEN);
 
 	netif_wake_queue(net);
+	mutex_unlock(&priv->mcp_lock);
 
-open_unlock:
+	return 0;
+
+out_free_wq:
+	destroy_workqueue(priv->wq);
+out_clean:
+	free_irq(spi->irq, priv);
+	mcp251x_hw_sleep(spi);
+out_close:
+	mcp251x_power_enable(priv->transceiver, 0);
+	close_candev(net);
 	mutex_unlock(&priv->mcp_lock);
 	return ret;
 }
-- 
GitLab


From bd2f4c7c2d6a6f09a23756ae6d97b0615bdd05d7 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Sat, 18 May 2019 17:35:43 +0800
Subject: [PATCH 1624/1835] can: gw: Fix error path of cgw_module_init

[ Upstream commit b7a14297f102b6e2ce6f16feffebbb9bde1e9b55 ]

This patch add error path for cgw_module_init to avoid possible crash if
some error occurs.

Fixes: c1aabdf379bc ("can-gw: add netlink based CAN routing")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/can/gw.c | 48 +++++++++++++++++++++++++++++++++---------------
 1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/net/can/gw.c b/net/can/gw.c
index 53859346dc9a9..bd2161470e456 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -1046,32 +1046,50 @@ static __init int cgw_module_init(void)
 	pr_info("can: netlink gateway (rev " CAN_GW_VERSION ") max_hops=%d\n",
 		max_hops);
 
-	register_pernet_subsys(&cangw_pernet_ops);
+	ret = register_pernet_subsys(&cangw_pernet_ops);
+	if (ret)
+		return ret;
+
+	ret = -ENOMEM;
 	cgw_cache = kmem_cache_create("can_gw", sizeof(struct cgw_job),
 				      0, 0, NULL);
-
 	if (!cgw_cache)
-		return -ENOMEM;
+		goto out_cache_create;
 
 	/* set notifier */
 	notifier.notifier_call = cgw_notifier;
-	register_netdevice_notifier(&notifier);
+	ret = register_netdevice_notifier(&notifier);
+	if (ret)
+		goto out_register_notifier;
 
 	ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_GETROUTE,
 				   NULL, cgw_dump_jobs, 0);
-	if (ret) {
-		unregister_netdevice_notifier(&notifier);
-		kmem_cache_destroy(cgw_cache);
-		return -ENOBUFS;
-	}
-
-	/* Only the first call to rtnl_register_module can fail */
-	rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
-			     cgw_create_job, NULL, 0);
-	rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
-			     cgw_remove_job, NULL, 0);
+	if (ret)
+		goto out_rtnl_register1;
+
+	ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
+				   cgw_create_job, NULL, 0);
+	if (ret)
+		goto out_rtnl_register2;
+	ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
+				   cgw_remove_job, NULL, 0);
+	if (ret)
+		goto out_rtnl_register3;
 
 	return 0;
+
+out_rtnl_register3:
+	rtnl_unregister(PF_CAN, RTM_NEWROUTE);
+out_rtnl_register2:
+	rtnl_unregister(PF_CAN, RTM_GETROUTE);
+out_rtnl_register1:
+	unregister_netdevice_notifier(&notifier);
+out_register_notifier:
+	kmem_cache_destroy(cgw_cache);
+out_cache_create:
+	unregister_pernet_subsys(&cangw_pernet_ops);
+
+	return ret;
 }
 
 static __exit void cgw_module_exit(void)
-- 
GitLab


From 714a8438fc8ae88aa22c25065e241bce0260db13 Mon Sep 17 00:00:00 2001
From: Ricard Wanderlof <ricard.wanderlof@axis.com>
Date: Wed, 24 Jul 2019 11:38:44 +0200
Subject: [PATCH 1625/1835] ASoC: Fail card instantiation if DAI format setup
 fails

[ Upstream commit 40aa5383e393d72f6aa3943a4e7b1aae25a1e43b ]

If the DAI format setup fails, there is no valid communication format
between CPU and CODEC, so fail card instantiation, rather than continue
with a card that will most likely not function properly.

Signed-off-by: Ricard Wanderlof <ricardw@axis.com>
Link: https://lore.kernel.org/r/alpine.DEB.2.20.1907241132350.6338@lnxricardw1.se.axis.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 62aa320c20708..dafc3b7f8d723 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1513,8 +1513,11 @@ static int soc_probe_link_dais(struct snd_soc_card *card,
 		}
 	}
 
-	if (dai_link->dai_fmt)
-		snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
+	if (dai_link->dai_fmt) {
+		ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
+		if (ret)
+			return ret;
+	}
 
 	ret = soc_post_component_init(rtd, dai_link->name);
 	if (ret)
-- 
GitLab


From 0d73ba88f466b65a3c6877cc2cd16383a5548cba Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Tue, 23 Jul 2019 17:04:30 -0500
Subject: [PATCH 1626/1835] st21nfca_connectivity_event_received: null check
 the allocation

[ Upstream commit 9891d06836e67324c9e9c4675ed90fc8b8110034 ]

devm_kzalloc may fail and return null. So the null check is needed.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/st21nfca/se.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
index 4bed9e842db38..fd967a38a94a5 100644
--- a/drivers/nfc/st21nfca/se.c
+++ b/drivers/nfc/st21nfca/se.c
@@ -328,6 +328,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
 
 		transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
 						   skb->len - 2, GFP_KERNEL);
+		if (!transaction)
+			return -ENOMEM;
 
 		transaction->aid_len = skb->data[1];
 		memcpy(transaction->aid, &skb->data[2],
-- 
GitLab


From c5cb10632c0fb4a4a4f7782e87e40aa6257bff9b Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Tue, 23 Jul 2019 17:11:51 -0500
Subject: [PATCH 1627/1835] st_nci_hci_connectivity_event_received: null check
 the allocation

[ Upstream commit 3008e06fdf0973770370f97d5f1fba3701d8281d ]

devm_kzalloc may fail and return NULL. So the null check is needed.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/st-nci/se.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
index f55d082ace715..5d6e7e931bc6c 100644
--- a/drivers/nfc/st-nci/se.c
+++ b/drivers/nfc/st-nci/se.c
@@ -344,6 +344,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
 
 		transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
 					    skb->len - 2, GFP_KERNEL);
+		if (!transaction)
+			return -ENOMEM;
 
 		transaction->aid_len = skb->data[1];
 		memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
-- 
GitLab


From dd0ff288e3441bd06d34dd37ead473cc41d413d4 Mon Sep 17 00:00:00 2001
From: Cheng-Yi Chiang <cychiang@chromium.org>
Date: Fri, 26 Jul 2019 12:42:02 +0800
Subject: [PATCH 1628/1835] ASoC: rockchip: Fix mono capture

[ Upstream commit 789e162a6255325325bd321ab0cd51dc7e285054 ]

This reverts commit db51707b9c9aeedd310ebce60f15d5bb006567e0.
Revert "ASoC: rockchip: i2s: Support mono capture"

Previous discussion in

https://patchwork.kernel.org/patch/10147153/

explains the issue of the patch.
While device is configured as 1-ch, hardware is still
generating a 2-ch stream.
When user space reads the data and assumes it is a 1-ch stream,
the rate will be slower by 2x.

Revert the change so 1-ch is not supported.
User space can selectively take one channel data out of two channel
if 1-ch is preferred.
Currently, both channels record identical data.

Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org>
Link: https://lore.kernel.org/r/20190726044202.26866-1-cychiang@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/rockchip/rockchip_i2s.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index 60d43d53a8f5e..11399f81c92f9 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -329,7 +329,6 @@ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,
 		val |= I2S_CHN_4;
 		break;
 	case 2:
-	case 1:
 		val |= I2S_CHN_2;
 		break;
 	default:
@@ -462,7 +461,7 @@ static struct snd_soc_dai_driver rockchip_i2s_dai = {
 	},
 	.capture = {
 		.stream_name = "Capture",
-		.channels_min = 1,
+		.channels_min = 2,
 		.channels_max = 2,
 		.rates = SNDRV_PCM_RATE_8000_192000,
 		.formats = (SNDRV_PCM_FMTBIT_S8 |
@@ -662,7 +661,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
 	}
 
 	if (!of_property_read_u32(node, "rockchip,capture-channels", &val)) {
-		if (val >= 1 && val <= 8)
+		if (val >= 2 && val <= 8)
 			soc_dai->capture.channels_max = val;
 	}
 
-- 
GitLab


From bfa713f5cec57aeaa0860bba24ca251e2d1cd6e1 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Fri, 26 Jul 2019 09:42:43 +0300
Subject: [PATCH 1629/1835] ASoC: ti: davinci-mcasp: Correct slot_width posed
 constraint

[ Upstream commit 1e112c35e3c96db7c8ca6ddaa96574f00c06e7db ]

The slot_width is a property for the bus while the constraint for
SNDRV_PCM_HW_PARAM_SAMPLE_BITS is for the in memory format.

Applying slot_width constraint to sample_bits works most of the time, but
it will blacklist valid formats in some cases.

With slot_width 24 we can support S24_3LE and S24_LE formats as they both
look the same on the bus, but a a 24 constraint on sample_bits would not
allow S24_LE as it is stored in 32bits in memory.

Implement a simple hw_rule function to allow all formats which require less
or equal number of bits on the bus as slot_width (if configured).

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20190726064244.3762-2-peter.ujfalusi@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/davinci/davinci-mcasp.c | 43 ++++++++++++++++++++++++-------
 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 160b2764b2ad8..6a8c279a4b20b 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -1150,6 +1150,28 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
 	return ret;
 }
 
+static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params,
+					    struct snd_pcm_hw_rule *rule)
+{
+	struct davinci_mcasp_ruledata *rd = rule->private;
+	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+	struct snd_mask nfmt;
+	int i, slot_width;
+
+	snd_mask_none(&nfmt);
+	slot_width = rd->mcasp->slot_width;
+
+	for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
+		if (snd_mask_test(fmt, i)) {
+			if (snd_pcm_format_width(i) <= slot_width) {
+				snd_mask_set(&nfmt, i);
+			}
+		}
+	}
+
+	return snd_mask_refine(fmt, &nfmt);
+}
+
 static const unsigned int davinci_mcasp_dai_rates[] = {
 	8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
 	88200, 96000, 176400, 192000,
@@ -1257,7 +1279,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
 	struct davinci_mcasp_ruledata *ruledata =
 					&mcasp->ruledata[substream->stream];
 	u32 max_channels = 0;
-	int i, dir;
+	int i, dir, ret;
 	int tdm_slots = mcasp->tdm_slots;
 
 	/* Do not allow more then one stream per direction */
@@ -1286,6 +1308,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
 			max_channels++;
 	}
 	ruledata->serializers = max_channels;
+	ruledata->mcasp = mcasp;
 	max_channels *= tdm_slots;
 	/*
 	 * If the already active stream has less channels than the calculated
@@ -1311,20 +1334,22 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
 				   0, SNDRV_PCM_HW_PARAM_CHANNELS,
 				   &mcasp->chconstr[substream->stream]);
 
-	if (mcasp->slot_width)
-		snd_pcm_hw_constraint_minmax(substream->runtime,
-					     SNDRV_PCM_HW_PARAM_SAMPLE_BITS,
-					     8, mcasp->slot_width);
+	if (mcasp->slot_width) {
+		/* Only allow formats require <= slot_width bits on the bus */
+		ret = snd_pcm_hw_rule_add(substream->runtime, 0,
+					  SNDRV_PCM_HW_PARAM_FORMAT,
+					  davinci_mcasp_hw_rule_slot_width,
+					  ruledata,
+					  SNDRV_PCM_HW_PARAM_FORMAT, -1);
+		if (ret)
+			return ret;
+	}
 
 	/*
 	 * If we rely on implicit BCLK divider setting we should
 	 * set constraints based on what we can provide.
 	 */
 	if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) {
-		int ret;
-
-		ruledata->mcasp = mcasp;
-
 		ret = snd_pcm_hw_rule_add(substream->runtime, 0,
 					  SNDRV_PCM_HW_PARAM_RATE,
 					  davinci_mcasp_hw_rule_rate,
-- 
GitLab


From cb64e86ee0d1763cb7ac45117f1de1f62bb6ba7c Mon Sep 17 00:00:00 2001
From: Bob Ham <bob.ham@puri.sm>
Date: Wed, 24 Jul 2019 07:52:27 -0700
Subject: [PATCH 1630/1835] net: usb: qmi_wwan: Add the BroadMobi BM818 card

[ Upstream commit 9a07406b00cdc6ec689dc142540739575c717f3c ]

The BroadMobi BM818 M.2 card uses the QMI protocol

Signed-off-by: Bob Ham <bob.ham@puri.sm>
Signed-off-by: Angus Ainslie (Purism) <angus@akkea.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 128c8a327d8ee..51017c6bb3bcb 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1231,6 +1231,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x2001, 0x7e35, 4)},	/* D-Link DWM-222 */
 	{QMI_FIXED_INTF(0x2020, 0x2031, 4)},	/* Olicard 600 */
 	{QMI_FIXED_INTF(0x2020, 0x2033, 4)},	/* BroadMobi BM806U */
+	{QMI_FIXED_INTF(0x2020, 0x2060, 4)},	/* BroadMobi BM818 */
 	{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
 	{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},	/* Sierra Wireless MC7710 in QMI mode */
-- 
GitLab


From 8a24df575c97c2076260bd359f921e6a8becf219 Mon Sep 17 00:00:00 2001
From: Michal Kalderon <michal.kalderon@marvell.com>
Date: Thu, 25 Jul 2019 13:59:55 +0300
Subject: [PATCH 1631/1835] qed: RDMA - Fix the hw_ver returned in device
 attributes

[ Upstream commit 81af04b432fdfabcdbd2c06be2ee647e3ca41a22 ]

The hw_ver field was initialized to zero. Return the chip revision.
This is relevant for rdma driver.

Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_rdma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 13802b825d65a..909422d939033 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -442,7 +442,7 @@ static void qed_rdma_init_devinfo(struct qed_hwfn *p_hwfn,
 	/* Vendor specific information */
 	dev->vendor_id = cdev->vendor_id;
 	dev->vendor_part_id = cdev->device_id;
-	dev->hw_ver = 0;
+	dev->hw_ver = cdev->chip_rev;
 	dev->fw_ver = (FW_MAJOR_VERSION << 24) | (FW_MINOR_VERSION << 16) |
 		      (FW_REVISION_VERSION << 8) | (FW_ENGINEERING_VERSION);
 
-- 
GitLab


From 32cbe03539ac50b4bcb85681b523292e18ab4f0d Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Fri, 26 Jul 2019 16:27:36 +0800
Subject: [PATCH 1632/1835] isdn: mISDN: hfcsusb: Fix possible null-pointer
 dereferences in start_isoc_chain()

[ Upstream commit a0d57a552b836206ad7705a1060e6e1ce5a38203 ]

In start_isoc_chain(), usb_alloc_urb() on line 1392 may fail
and return NULL. At this time, fifo->iso[i].urb is assigned to NULL.

Then, fifo->iso[i].urb is used at some places, such as:
LINE 1405:    fill_isoc_urb(fifo->iso[i].urb, ...)
                  urb->number_of_packets = num_packets;
                  urb->transfer_flags = URB_ISO_ASAP;
                  urb->actual_length = 0;
                  urb->interval = interval;
LINE 1416:    fifo->iso[i].urb->...
LINE 1419:    fifo->iso[i].urb->...

Thus, possible null-pointer dereferences may occur.

To fix these bugs, "continue" is added to avoid using fifo->iso[i].urb
when it is NULL.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/hfcsusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index 060dc7fd66c1d..cfdb130cb1008 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1406,6 +1406,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb,
 				printk(KERN_DEBUG
 				       "%s: %s: alloc urb for fifo %i failed",
 				       hw->name, __func__, fifo->fifonum);
+				continue;
 			}
 			fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
 			fifo->iso[i].indx = i;
-- 
GitLab


From ba42212ac0a022104deb5971337602a81cc5242d Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Mon, 29 Jul 2019 16:23:32 +0800
Subject: [PATCH 1633/1835] mac80211_hwsim: Fix possible null-pointer
 dereferences in hwsim_dump_radio_nl()

[ Upstream commit b55f3b841099e641bdb2701d361a4c304e2dbd6f ]

In hwsim_dump_radio_nl(), when genlmsg_put() on line 3617 fails, hdr is
assigned to NULL. Then hdr is used on lines 3622 and 3623:
    genl_dump_check_consistent(cb, hdr);
    genlmsg_end(skb, hdr);

Thus, possible null-pointer dereferences may occur.

To fix these bugs, hdr is used here when it is not NULL.

This bug is found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Link: https://lore.kernel.org/r/20190729082332.28895-1-baijiaju1990@gmail.com
[put braces on all branches]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mac80211_hwsim.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 7cd428c0af433..ce2dd06af62e8 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3502,10 +3502,12 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb,
 		hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
 				  cb->nlh->nlmsg_seq, &hwsim_genl_family,
 				  NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
-		if (!hdr)
+		if (hdr) {
+			genl_dump_check_consistent(cb, hdr);
+			genlmsg_end(skb, hdr);
+		} else {
 			res = -EMSGSIZE;
-		genl_dump_check_consistent(cb, hdr);
-		genlmsg_end(skb, hdr);
+		}
 	}
 
 done:
-- 
GitLab


From 5a072ef6a296ecdb740998366cc441443a50d66f Mon Sep 17 00:00:00 2001
From: Stefano Brivio <sbrivio@redhat.com>
Date: Mon, 24 Jun 2019 15:20:11 +0200
Subject: [PATCH 1634/1835] netfilter: ipset: Actually allow destination MAC
 address for hash:ip,mac sets too

[ Upstream commit b89d15480d0cacacae1a0fe0b3da01b529f2914f ]

In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
for mac and ipmac sets"), ipset.git commit 1543514c46a7, I removed the
KADT check that prevents matching on destination MAC addresses for
hash:mac sets, but forgot to remove the same check for hash:ip,mac set.

Drop this check: functionality is now commented in man pages and there's
no reason to restrict to source MAC address matching anymore.

Reported-by: Chen Yi <yiche@redhat.com>
Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_hash_ipmac.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index fd87de3ed55b3..75c21c8b76514 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -95,10 +95,6 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
 	struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
 	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 
-	 /* MAC can be src only */
-	if (!(opt->flags & IPSET_DIM_TWO_SRC))
-		return 0;
-
 	if (skb_mac_header(skb) < skb->head ||
 	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
 		return -EINVAL;
-- 
GitLab


From ea08214d8cd0e1ea33c391b0d9dac1040d6c3429 Mon Sep 17 00:00:00 2001
From: Stefano Brivio <sbrivio@redhat.com>
Date: Mon, 24 Jun 2019 15:20:12 +0200
Subject: [PATCH 1635/1835] netfilter: ipset: Copy the right MAC address in
 bitmap:ip,mac and hash:ip,mac sets

[ Upstream commit 1b4a75108d5bc153daf965d334e77e8e94534f96 ]

In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the
KADT functions for sets matching on MAC addreses the copy of source or
destination MAC address depending on the configured match.

This was done correctly for hash:mac, but for hash:ip,mac and
bitmap:ip,mac, copying and pasting the same code block presents an
obvious problem: in these two set types, the MAC address is the second
dimension, not the first one, and we are actually selecting the MAC
address depending on whether the first dimension (IP address) specifies
source or destination.

Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags.

This way, mixing source and destination matches for the two dimensions
of ip,mac set types works as expected. With this setup:

  ip netns add A
  ip link add veth1 type veth peer name veth2 netns A
  ip addr add 192.0.2.1/24 dev veth1
  ip -net A addr add 192.0.2.2/24 dev veth2
  ip link set veth1 up
  ip -net A link set veth2 up

  dst=$(ip netns exec A cat /sys/class/net/veth2/address)

  ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16
  ip netns exec A ipset add test_bitmap 192.0.2.1,${dst}
  ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP

  ip netns exec A ipset create test_hash hash:ip,mac
  ip netns exec A ipset add test_hash 192.0.2.1,${dst}
  ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP

ipset correctly matches a test packet:

  # ping -c1 192.0.2.2 >/dev/null
  # echo $?
  0

Reported-by: Chen Yi <yiche@redhat.com>
Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
 net/netfilter/ipset/ip_set_hash_ipmac.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 13ade5782847b..4f01321e793ce 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -230,7 +230,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 
 	e.id = ip_to_id(map, ip);
 
-	if (opt->flags & IPSET_DIM_ONE_SRC)
+	if (opt->flags & IPSET_DIM_TWO_SRC)
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
 	else
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index 75c21c8b76514..16ec822e40447 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -99,7 +99,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
 	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
 		return -EINVAL;
 
-	if (opt->flags & IPSET_DIM_ONE_SRC)
+	if (opt->flags & IPSET_DIM_TWO_SRC)
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
 	else
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
-- 
GitLab


From 63dd147e7af0e69e5275191ff077e2c7f4ff53f8 Mon Sep 17 00:00:00 2001
From: Jozsef Kadlecsik <kadlec@netfilter.org>
Date: Tue, 23 Jul 2019 10:25:55 +0200
Subject: [PATCH 1636/1835] netfilter: ipset: Fix rename concurrency with
 listing

[ Upstream commit 6c1f7e2c1b96ab9b09ac97c4df2bd9dc327206f6 ]

Shijie Luo reported that when stress-testing ipset with multiple concurrent
create, rename, flush, list, destroy commands, it can result

ipset <version>: Broken LIST kernel message: missing DATA part!

error messages and broken list results. The problem was the rename operation
was not properly handled with respect of listing. The patch fixes the issue.

Reported-by: Shijie Luo <luoshijie1@huawei.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 1577f2f76060d..e2538c5786714 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1157,7 +1157,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
 		return -ENOENT;
 
 	write_lock_bh(&ip_set_ref_lock);
-	if (set->ref != 0) {
+	if (set->ref != 0 || set->ref_netlink != 0) {
 		ret = -IPSET_ERR_REFERENCED;
 		goto out;
 	}
-- 
GitLab


From 0d68fbc2d07b5914fb8712b05549bd558fccf1c8 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 30 Jul 2019 14:42:50 +0100
Subject: [PATCH 1637/1835] rxrpc: Fix potential deadlock

[ Upstream commit 60034d3d146b11922ab1db613bce062dddc0327a ]

There is a potential deadlock in rxrpc_peer_keepalive_dispatch() whereby
rxrpc_put_peer() is called with the peer_hash_lock held, but if it reduces
the peer's refcount to 0, rxrpc_put_peer() calls __rxrpc_put_peer() - which
the tries to take the already held lock.

Fix this by providing a version of rxrpc_put_peer() that can be called in
situations where the lock is already held.

The bug may produce the following lockdep report:

============================================
WARNING: possible recursive locking detected
5.2.0-next-20190718 #41 Not tainted
--------------------------------------------
kworker/0:3/21678 is trying to acquire lock:
00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh
/./include/linux/spinlock.h:343 [inline]
00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
__rxrpc_put_peer /net/rxrpc/peer_object.c:415 [inline]
00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
rxrpc_put_peer+0x2d3/0x6a0 /net/rxrpc/peer_object.c:435

but task is already holding lock:
00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh
/./include/linux/spinlock.h:343 [inline]
00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
rxrpc_peer_keepalive_dispatch /net/rxrpc/peer_event.c:378 [inline]
00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
rxrpc_peer_keepalive_worker+0x6b3/0xd02 /net/rxrpc/peer_event.c:430

Fixes: 330bdcfadcee ("rxrpc: Fix the keepalive generator [ver #2]")
Reported-by: syzbot+72af434e4b3417318f84@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/ar-internal.h |  1 +
 net/rxrpc/peer_event.c  |  2 +-
 net/rxrpc/peer_object.c | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 03e0fc8c183f0..a4c341828b72f 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -1057,6 +1057,7 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *);
 struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
 struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
 void rxrpc_put_peer(struct rxrpc_peer *);
+void rxrpc_put_peer_locked(struct rxrpc_peer *);
 
 /*
  * proc.c
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index bd2fa3b7caa7e..dc7fdaf20445b 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -375,7 +375,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
 		spin_lock_bh(&rxnet->peer_hash_lock);
 		list_add_tail(&peer->keepalive_link,
 			      &rxnet->peer_keepalive[slot & mask]);
-		rxrpc_put_peer(peer);
+		rxrpc_put_peer_locked(peer);
 	}
 
 	spin_unlock_bh(&rxnet->peer_hash_lock);
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index 5691b7d266ca0..71547e8673b99 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -440,6 +440,24 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
 	}
 }
 
+/*
+ * Drop a ref on a peer record where the caller already holds the
+ * peer_hash_lock.
+ */
+void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
+{
+	const void *here = __builtin_return_address(0);
+	int n;
+
+	n = atomic_dec_return(&peer->usage);
+	trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
+	if (n == 0) {
+		hash_del_rcu(&peer->hash_link);
+		list_del_init(&peer->keepalive_link);
+		kfree_rcu(peer, rcu);
+	}
+}
+
 /*
  * Make sure all peer records have been discarded.
  */
-- 
GitLab


From 4db2043eec468ed358ff1100a3024dcae3b1b5ad Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 30 Jul 2019 14:42:50 +0100
Subject: [PATCH 1638/1835] rxrpc: Fix the lack of notification when sendmsg()
 fails on a DATA packet

[ Upstream commit c69565ee6681e151e2bb80502930a16e04b553d1 ]

Fix the fact that a notification isn't sent to the recvmsg side to indicate
a call failed when sendmsg() fails to transmit a DATA packet with the error
ENETUNREACH, EHOSTUNREACH or ECONNREFUSED.

Without this notification, the afs client just sits there waiting for the
call to complete in some manner (which it's not now going to do), which
also pins the rxrpc call in place.

This can be seen if the client has a scope-level IPv6 address, but not a
global-level IPv6 address, and we try and transmit an operation to a
server's IPv6 address.

Looking in /proc/net/rxrpc/calls shows completed calls just sat there with
an abort code of RX_USER_ABORT and an error code of -ENETUNREACH.

Fixes: c54e43d752c7 ("rxrpc: Fix missing start of call timeout")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/sendmsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index be01f9c5d963d..5d6ab4f6fd7ab 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -230,6 +230,7 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
 			rxrpc_set_call_completion(call,
 						  RXRPC_CALL_LOCAL_ERROR,
 						  0, ret);
+			rxrpc_notify_socket(call);
 			goto out;
 		}
 		_debug("need instant resend %d", ret);
-- 
GitLab


From 07efe13b95ab577085c2b920c86791fef5104541 Mon Sep 17 00:00:00 2001
From: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
Date: Wed, 31 Jul 2019 15:17:23 +0200
Subject: [PATCH 1639/1835] isdn: hfcsusb: Fix mISDN driver crash caused by
 transfer buffer on the stack

[ Upstream commit d8a1de3d5bb881507602bc02e004904828f88711 ]

Since linux 4.9 it is not possible to use buffers on the stack for DMA transfers.

During usb probe the driver crashes with "transfer buffer is on stack" message.

This fix k-allocates a buffer to be used on "read_reg_atomic", which is a macro
that calls "usb_control_msg" under the hood.

Kernel 4.19 backtrace:

usb_hcd_submit_urb+0x3e5/0x900
? sched_clock+0x9/0x10
? log_store+0x203/0x270
? get_random_u32+0x6f/0x90
? cache_alloc_refill+0x784/0x8a0
usb_submit_urb+0x3b4/0x550
usb_start_wait_urb+0x4e/0xd0
usb_control_msg+0xb8/0x120
hfcsusb_probe+0x6bc/0xb40 [hfcsusb]
usb_probe_interface+0xc2/0x260
really_probe+0x176/0x280
driver_probe_device+0x49/0x130
__driver_attach+0xa9/0xb0
? driver_probe_device+0x130/0x130
bus_for_each_dev+0x5a/0x90
driver_attach+0x14/0x20
? driver_probe_device+0x130/0x130
bus_add_driver+0x157/0x1e0
driver_register+0x51/0xe0
usb_register_driver+0x5d/0x120
? 0xf81ed000
hfcsusb_drv_init+0x17/0x1000 [hfcsusb]
do_one_initcall+0x44/0x190
? free_unref_page_commit+0x6a/0xd0
do_init_module+0x46/0x1c0
load_module+0x1dc1/0x2400
sys_init_module+0xed/0x120
do_fast_syscall_32+0x7a/0x200
entry_SYSENTER_32+0x6b/0xbe

Signed-off-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/hfcsusb.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index cfdb130cb1008..c952002c6301d 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1705,13 +1705,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel)
 static int
 setup_hfcsusb(struct hfcsusb *hw)
 {
+	void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
 	u_char b;
+	int ret;
 
 	if (debug & DBG_HFC_CALL_TRACE)
 		printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
 
+	if (!dmabuf)
+		return -ENOMEM;
+
+	ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
+
+	memcpy(&b, dmabuf, sizeof(u_char));
+	kfree(dmabuf);
+
 	/* check the chip id */
-	if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
+	if (ret != 1) {
 		printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
 		       hw->name, __func__);
 		return 1;
-- 
GitLab


From 4533d08b65283ea673e112f38a32880813a78e25 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Tue, 30 Jul 2019 16:08:13 +0800
Subject: [PATCH 1640/1835] net: phy: phy_led_triggers: Fix a possible
 null-pointer dereference in phy_led_trigger_change_speed()

[ Upstream commit 271da132e29b5341c31eca6ba6a72ea1302ebac8 ]

In phy_led_trigger_change_speed(), there is an if statement on line 48
to check whether phy->last_triggered is NULL:
    if (!phy->last_triggered)

When phy->last_triggered is NULL, it is used on line 52:
    led_trigger_event(&phy->last_triggered->trigger, LED_OFF);

Thus, a possible null-pointer dereference may occur.

To fix this bug, led_trigger_event(&phy->last_triggered->trigger,
LED_OFF) is called when phy->last_triggered is not NULL.

This bug is found by a static analysis tool STCheck written by
the OSLAB group in Tsinghua University.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_led_triggers.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
index 491efc1bf5c48..7278eca70f9f3 100644
--- a/drivers/net/phy/phy_led_triggers.c
+++ b/drivers/net/phy/phy_led_triggers.c
@@ -58,8 +58,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy)
 		if (!phy->last_triggered)
 			led_trigger_event(&phy->led_link_trigger->trigger,
 					  LED_FULL);
+		else
+			led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
 
-		led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
 		led_trigger_event(&plt->trigger, LED_FULL);
 		phy->last_triggered = plt;
 	}
-- 
GitLab


From a3d1263c9b03b3c873be974705d50f17b363e3d0 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@kernel.org>
Date: Thu, 1 Aug 2019 16:26:42 +0200
Subject: [PATCH 1641/1835] perf bench numa: Fix cpu0 binding

[ Upstream commit 6bbfe4e602691b90ac866712bd4c43c51e546a60 ]

Michael reported an issue with perf bench numa failing with binding to
cpu0 with '-0' option.

  # perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd
  # Running 'numa/mem' benchmark:

   # Running main, "perf bench numa numa-mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd"
  binding to node 0, mask: 0000000000000001 => -1
  perf: bench/numa.c:356: bind_to_memnode: Assertion `!(ret)' failed.
  Aborted (core dumped)

This happens when the cpu0 is not part of node0, which is the benchmark
assumption and we can see that's not the case for some powerpc servers.

Using correct node for cpu0 binding.

Reported-by: Michael Petlan <mpetlan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20190801142642.28004-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/bench/numa.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index fa56fde6e8d80..91c0a4434da27 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -378,8 +378,10 @@ static u8 *alloc_data(ssize_t bytes0, int map_flags,
 
 	/* Allocate and initialize all memory on CPU#0: */
 	if (init_cpu0) {
-		orig_mask = bind_to_node(0);
-		bind_to_memnode(0);
+		int node = numa_node_of_cpu(0);
+
+		orig_mask = bind_to_node(node);
+		bind_to_memnode(node);
 	}
 
 	bytes = bytes0 + HPSIZE;
-- 
GitLab


From 895c8fcfedad2af3fe265e796afbbc43096c84a3 Mon Sep 17 00:00:00 2001
From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Date: Wed, 31 Jul 2019 15:31:14 +0800
Subject: [PATCH 1642/1835] can: sja1000: force the string buffer
 NULL-terminated

[ Upstream commit cd28aa2e056cd1ea79fc5f24eed0ce868c6cab5c ]

strncpy() does not ensure NULL-termination when the input string size
equals to the destination buffer size IFNAMSIZ. The output string
'name' is passed to dev_info which relies on NULL-termination.

Use strlcpy() instead.

This issue is identified by a Coccinelle script.

Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/sja1000/peak_pcmcia.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
index b8c39ede7cd51..179bfcd541f2f 100644
--- a/drivers/net/can/sja1000/peak_pcmcia.c
+++ b/drivers/net/can/sja1000/peak_pcmcia.c
@@ -487,7 +487,7 @@ static void pcan_free_channels(struct pcan_pccard *card)
 		if (!netdev)
 			continue;
 
-		strncpy(name, netdev->name, IFNAMSIZ);
+		strlcpy(name, netdev->name, IFNAMSIZ);
 
 		unregister_sja1000dev(netdev);
 
-- 
GitLab


From 35d9e9211baf303037c3aae155428666b279d295 Mon Sep 17 00:00:00 2001
From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Date: Wed, 31 Jul 2019 15:25:59 +0800
Subject: [PATCH 1643/1835] can: peak_usb: force the string buffer
 NULL-terminated

[ Upstream commit e787f19373b8a5fa24087800ed78314fd17b984a ]

strncpy() does not ensure NULL-termination when the input string size
equals to the destination buffer size IFNAMSIZ. The output string is
passed to dev_info() which relies on the NULL-termination.

Use strlcpy() instead.

This issue is identified by a Coccinelle script.

Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 740ef47eab017..43b0fa2b99322 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -863,7 +863,7 @@ static void peak_usb_disconnect(struct usb_interface *intf)
 
 		dev_prev_siblings = dev->prev_siblings;
 		dev->state &= ~PCAN_USB_STATE_CONNECTED;
-		strncpy(name, netdev->name, IFNAMSIZ);
+		strlcpy(name, netdev->name, IFNAMSIZ);
 
 		unregister_netdev(netdev);
 
-- 
GitLab


From d1ba0b81e70976ab8022aa5e1a1740c455f6fbfb Mon Sep 17 00:00:00 2001
From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Date: Wed, 31 Jul 2019 16:15:42 +0800
Subject: [PATCH 1644/1835] net/ethernet/qlogic/qed: force the string buffer
 NULL-terminated

[ Upstream commit 3690c8c9a8edff0db077a38783112d8fe12a7dd2 ]

strncpy() does not ensure NULL-termination when the input string
size equals to the destination buffer size 30.
The output string is passed to qed_int_deassertion_aeu_bit()
which calls DP_INFO() and relies NULL-termination.

Use strlcpy instead. The other conditional branch above strncpy()
needs no fix as snprintf() ensures NULL-termination.

This issue is identified by a Coccinelle script.

Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_int.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index b22f464ea3fa7..f9e475075d3ea 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -939,7 +939,7 @@ static int qed_int_deassertion(struct qed_hwfn  *p_hwfn,
 						snprintf(bit_name, 30,
 							 p_aeu->bit_name, num);
 					else
-						strncpy(bit_name,
+						strlcpy(bit_name,
 							p_aeu->bit_name, 30);
 
 					/* We now need to pass bitmask in its
-- 
GitLab


From 66daeec347f057032c5026086dbcb460f6131b9b Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sat, 3 Aug 2019 10:11:27 -0400
Subject: [PATCH 1645/1835] NFSv4: Fix a potential sleep while atomic in
 nfs4_do_reclaim()

[ Upstream commit c77e22834ae9a11891cb613bd9a551be1b94f2bc ]

John Hubbard reports seeing the following stack trace:

nfs4_do_reclaim
   rcu_read_lock /* we are now in_atomic() and must not sleep */
       nfs4_purge_state_owners
           nfs4_free_state_owner
               nfs4_destroy_seqid_counter
                   rpc_destroy_wait_queue
                       cancel_delayed_work_sync
                           __cancel_work_timer
                               __flush_work
                                   start_flush_work
                                       might_sleep:
                                        (kernel/workqueue.c:2975: BUG)

The solution is to separate out the freeing of the state owners
from nfs4_purge_state_owners(), and perform that outside the atomic
context.

Reported-by: John Hubbard <jhubbard@nvidia.com>
Fixes: 0aaaf5c424c7f ("NFS: Cache state owners after files are closed")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4_fs.h    |  3 ++-
 fs/nfs/nfs4client.c |  5 ++++-
 fs/nfs/nfs4state.c  | 27 ++++++++++++++++++++++-----
 3 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 63287d911c088..5b61520dce888 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -469,7 +469,8 @@ static inline void nfs4_schedule_session_recovery(struct nfs4_session *session,
 
 extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, struct rpc_cred *, gfp_t);
 extern void nfs4_put_state_owner(struct nfs4_state_owner *);
-extern void nfs4_purge_state_owners(struct nfs_server *);
+extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *);
+extern void nfs4_free_state_owners(struct list_head *head);
 extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *);
 extern void nfs4_put_open_state(struct nfs4_state *);
 extern void nfs4_close_state(struct nfs4_state *, fmode_t);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 8f53455c47653..86991bcfbeb12 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -754,9 +754,12 @@ out:
 
 static void nfs4_destroy_server(struct nfs_server *server)
 {
+	LIST_HEAD(freeme);
+
 	nfs_server_return_all_delegations(server);
 	unset_pnfs_layoutdriver(server);
-	nfs4_purge_state_owners(server);
+	nfs4_purge_state_owners(server, &freeme);
+	nfs4_free_state_owners(&freeme);
 }
 
 /*
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 3ba2087469ac8..c36ef75f2054b 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -628,24 +628,39 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
 /**
  * nfs4_purge_state_owners - Release all cached state owners
  * @server: nfs_server with cached state owners to release
+ * @head: resulting list of state owners
  *
  * Called at umount time.  Remaining state owners will be on
  * the LRU with ref count of zero.
+ * Note that the state owners are not freed, but are added
+ * to the list @head, which can later be used as an argument
+ * to nfs4_free_state_owners.
  */
-void nfs4_purge_state_owners(struct nfs_server *server)
+void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head)
 {
 	struct nfs_client *clp = server->nfs_client;
 	struct nfs4_state_owner *sp, *tmp;
-	LIST_HEAD(doomed);
 
 	spin_lock(&clp->cl_lock);
 	list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) {
-		list_move(&sp->so_lru, &doomed);
+		list_move(&sp->so_lru, head);
 		nfs4_remove_state_owner_locked(sp);
 	}
 	spin_unlock(&clp->cl_lock);
+}
 
-	list_for_each_entry_safe(sp, tmp, &doomed, so_lru) {
+/**
+ * nfs4_purge_state_owners - Release all cached state owners
+ * @head: resulting list of state owners
+ *
+ * Frees a list of state owners that was generated by
+ * nfs4_purge_state_owners
+ */
+void nfs4_free_state_owners(struct list_head *head)
+{
+	struct nfs4_state_owner *sp, *tmp;
+
+	list_for_each_entry_safe(sp, tmp, head, so_lru) {
 		list_del(&sp->so_lru);
 		nfs4_free_state_owner(sp);
 	}
@@ -1843,12 +1858,13 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov
 	struct nfs4_state_owner *sp;
 	struct nfs_server *server;
 	struct rb_node *pos;
+	LIST_HEAD(freeme);
 	int status = 0;
 
 restart:
 	rcu_read_lock();
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
-		nfs4_purge_state_owners(server);
+		nfs4_purge_state_owners(server, &freeme);
 		spin_lock(&clp->cl_lock);
 		for (pos = rb_first(&server->state_owners);
 		     pos != NULL;
@@ -1877,6 +1893,7 @@ restart:
 		spin_unlock(&clp->cl_lock);
 	}
 	rcu_read_unlock();
+	nfs4_free_state_owners(&freeme);
 	return 0;
 }
 
-- 
GitLab


From b6fb2f5b33f277604374f28c486e8e897462c005 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sat, 3 Aug 2019 13:39:24 -0400
Subject: [PATCH 1646/1835] NFS: Fix regression whereby fscache errors are
 appearing on 'nofsc' mounts

[ Upstream commit dea1bb35c5f35e0577cfc61f79261d80b8715221 ]

People are reporing seeing fscache errors being reported concerning
duplicate cookies even in cases where they are not setting up fscache
at all. The rule needs to be that if fscache is not enabled, then it
should have no side effects at all.

To ensure this is the case, we disable fscache completely on all superblocks
for which the 'fsc' mount option was not set. In order to avoid issues
with '-oremount', we also disable the ability to turn fscache on via
remount.

Fixes: f1fe29b4a02d ("NFS: Use i_writecount to control whether...")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=200145
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Steve Dickson <steved@redhat.com>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/fscache.c | 7 ++++++-
 fs/nfs/fscache.h | 2 +-
 fs/nfs/super.c   | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index 4dc887813c71d..a7bc4e0494f92 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -118,6 +118,10 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
 	struct rb_node **p, *parent;
 	int diff;
 
+	nfss->fscache_key = NULL;
+	nfss->fscache = NULL;
+	if (!(nfss->options & NFS_OPTION_FSCACHE))
+		return;
 	if (!uniq) {
 		uniq = "";
 		ulen = 1;
@@ -230,10 +234,11 @@ void nfs_fscache_release_super_cookie(struct super_block *sb)
 void nfs_fscache_init_inode(struct inode *inode)
 {
 	struct nfs_fscache_inode_auxdata auxdata;
+	struct nfs_server *nfss = NFS_SERVER(inode);
 	struct nfs_inode *nfsi = NFS_I(inode);
 
 	nfsi->fscache = NULL;
-	if (!S_ISREG(inode->i_mode))
+	if (!(nfss->fscache && S_ISREG(inode->i_mode)))
 		return;
 
 	memset(&auxdata, 0, sizeof(auxdata));
diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h
index 161ba2edb9d04..6363ea9568581 100644
--- a/fs/nfs/fscache.h
+++ b/fs/nfs/fscache.h
@@ -186,7 +186,7 @@ static inline void nfs_fscache_wait_on_invalidate(struct inode *inode)
  */
 static inline const char *nfs_server_fscache_state(struct nfs_server *server)
 {
-	if (server->fscache && (server->options & NFS_OPTION_FSCACHE))
+	if (server->fscache)
 		return "yes";
 	return "no ";
 }
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 6df9b85caf205..d90efdea9fbd6 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2239,6 +2239,7 @@ nfs_compare_remount_data(struct nfs_server *nfss,
 	    data->acdirmin != nfss->acdirmin / HZ ||
 	    data->acdirmax != nfss->acdirmax / HZ ||
 	    data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) ||
+	    (data->options & NFS_OPTION_FSCACHE) != (nfss->options & NFS_OPTION_FSCACHE) ||
 	    data->nfs_server.port != nfss->port ||
 	    data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen ||
 	    !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address,
-- 
GitLab


From f6f9c4491ec52e13c6621b04b0c05301611b1711 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Istv=C3=A1n=20V=C3=A1radi?= <ivaradi@varadiistvan.hu>
Date: Wed, 24 Jul 2019 20:09:18 +0200
Subject: [PATCH 1647/1835] HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE
 quirk on Saitek X52
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7bc74853fd61432ec59f812a40425bf6d8c986a4 ]

The Saitek X52 joystick has a pair of axes that are originally
(by the Windows driver) used as mouse pointer controls. The corresponding
usage->hid values are 0x50024 and 0x50026. Thus they are handled
as unknown axes and both get mapped to ABS_MISC. The quirk makes
the second axis to be mapped to ABS_MISC1 and thus made available
separately.

[jkosina@suse.cz: squashed two patches into one]
Signed-off-by: István Váradi <ivaradi@varadiistvan.hu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h    | 1 +
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 2898bb0619454..4a2fa57ddcb84 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -971,6 +971,7 @@
 #define USB_DEVICE_ID_SAITEK_RAT7	0x0cd7
 #define USB_DEVICE_ID_SAITEK_RAT9	0x0cfa
 #define USB_DEVICE_ID_SAITEK_MMO7	0x0cd0
+#define USB_DEVICE_ID_SAITEK_X52	0x075c
 
 #define USB_VENDOR_ID_SAMSUNG		0x0419
 #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE	0x0001
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index d29c7c9cd185d..e553f6fae7a4c 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -143,6 +143,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
-- 
GitLab


From 1c6ca09217054d9fe72977a168781ad0af9b1623 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Date: Tue, 11 Jun 2019 14:13:20 +0200
Subject: [PATCH 1648/1835] HID: input: fix a4tech horizontal wheel custom
 usage

[ Upstream commit 1c703b53e5bfb5c2205c30f0fb157ce271fd42fb ]

Some a4tech mice use the 'GenericDesktop.00b8' usage to inform whether
the previous wheel report was horizontal or vertical. Before
c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") this
usage was being mapped to 'Relative.Misc'. After the patch it's simply
ignored (usage->type == 0 & usage->code == 0). Which ultimately makes
hid-a4tech ignore the WHEEL/HWHEEL selection event, as it has no
usage->type.

We shouldn't rely on a mapping for that usage as it's nonstandard and
doesn't really map to an input event. So we bypass the mapping and make
sure the custom event handling properly handles both reports.

Fixes: c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key")
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-a4tech.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
index 9428ea7cdf8a0..c52bd163abb3e 100644
--- a/drivers/hid/hid-a4tech.c
+++ b/drivers/hid/hid-a4tech.c
@@ -26,12 +26,36 @@
 #define A4_2WHEEL_MOUSE_HACK_7	0x01
 #define A4_2WHEEL_MOUSE_HACK_B8	0x02
 
+#define A4_WHEEL_ORIENTATION	(HID_UP_GENDESK | 0x000000b8)
+
 struct a4tech_sc {
 	unsigned long quirks;
 	unsigned int hw_wheel;
 	__s32 delayed_value;
 };
 
+static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+			    struct hid_field *field, struct hid_usage *usage,
+			    unsigned long **bit, int *max)
+{
+	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+
+	if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
+	    usage->hid == A4_WHEEL_ORIENTATION) {
+		/*
+		 * We do not want to have this usage mapped to anything as it's
+		 * nonstandard and doesn't really behave like an HID report.
+		 * It's only selecting the orientation (vertical/horizontal) of
+		 * the previous mouse wheel report. The input_events will be
+		 * generated once both reports are recorded in a4_event().
+		 */
+		return -1;
+	}
+
+	return 0;
+
+}
+
 static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 		struct hid_field *field, struct hid_usage *usage,
 		unsigned long **bit, int *max)
@@ -53,8 +77,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
 	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
 	struct input_dev *input;
 
-	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
-			!usage->type)
+	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
 		return 0;
 
 	input = field->hidinput->input;
@@ -65,7 +88,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
 			return 1;
 		}
 
-		if (usage->hid == 0x000100b8) {
+		if (usage->hid == A4_WHEEL_ORIENTATION) {
 			input_event(input, EV_REL, value ? REL_HWHEEL :
 					REL_WHEEL, a4->delayed_value);
 			return 1;
@@ -129,6 +152,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
 static struct hid_driver a4_driver = {
 	.name = "a4tech",
 	.id_table = a4_devices,
+	.input_mapping = a4_input_mapping,
 	.input_mapped = a4_input_mapped,
 	.event = a4_event,
 	.probe = a4_probe,
-- 
GitLab


From 6cb4997861c8bf9a73b54b123c02fab436b852a6 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 2 Aug 2019 11:46:16 -0700
Subject: [PATCH 1649/1835] drm/rockchip: Suspend DP late

[ Upstream commit f7ccbed656f78212593ca965d9a8f34bf24e0aab ]

In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved
resume to be early but left suspend at its normal time.  This seems
like it could be OK, but casues problems if a suspend gets interrupted
partway through.  The OS only balances matching suspend/resume levels.
...so if suspend was called then resume will be called.  If suspend
late was called then resume early will be called.  ...but if suspend
was called resume early might not get called.  This leads to an
unbalance in the clock enables / disables.

Lets take the simple fix and just move suspend to be late to match.
This makes the PM core take proper care in keeping things balanced.

Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index 080f053521950..6a4da3a0ff1c3 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -436,7 +436,7 @@ static int rockchip_dp_resume(struct device *dev)
 
 static const struct dev_pm_ops rockchip_dp_pm_ops = {
 #ifdef CONFIG_PM_SLEEP
-	.suspend = rockchip_dp_suspend,
+	.suspend_late = rockchip_dp_suspend,
 	.resume_early = rockchip_dp_resume,
 #endif
 };
-- 
GitLab


From fab5a1fd17a62017871c52e568b40aacc0c23fe8 Mon Sep 17 00:00:00 2001
From: Pavel Shilovsky <pshilov@microsoft.com>
Date: Mon, 22 Jul 2019 11:38:22 -0700
Subject: [PATCH 1650/1835] SMB3: Fix potential memory leak when processing
 compound chain

[ Upstream commit 3edeb4a4146dc3b54d6fa71b7ee0585cb52ebfdf ]

When a reconnect happens in the middle of processing a compound chain
the code leaks a buffer from the memory pool. Fix this by properly
checking for a return code and freeing buffers in case of error.

Also maintain a buf variable to be equal to either smallbuf or bigbuf
depending on a response buffer size while parsing a chain and when
returning to the caller.

Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2ops.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 0ccf8f9b63a2e..97fdbec54db97 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -3121,7 +3121,6 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
 {
 	int ret, length;
 	char *buf = server->smallbuf;
-	char *tmpbuf;
 	struct smb2_sync_hdr *shdr;
 	unsigned int pdu_length = server->pdu_size;
 	unsigned int buf_size;
@@ -3151,18 +3150,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
 		return length;
 
 	next_is_large = server->large_buf;
- one_more:
+one_more:
 	shdr = (struct smb2_sync_hdr *)buf;
 	if (shdr->NextCommand) {
-		if (next_is_large) {
-			tmpbuf = server->bigbuf;
+		if (next_is_large)
 			next_buffer = (char *)cifs_buf_get();
-		} else {
-			tmpbuf = server->smallbuf;
+		else
 			next_buffer = (char *)cifs_small_buf_get();
-		}
 		memcpy(next_buffer,
-		       tmpbuf + le32_to_cpu(shdr->NextCommand),
+		       buf + le32_to_cpu(shdr->NextCommand),
 		       pdu_length - le32_to_cpu(shdr->NextCommand));
 	}
 
@@ -3191,12 +3187,21 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
 		pdu_length -= le32_to_cpu(shdr->NextCommand);
 		server->large_buf = next_is_large;
 		if (next_is_large)
-			server->bigbuf = next_buffer;
+			server->bigbuf = buf = next_buffer;
 		else
-			server->smallbuf = next_buffer;
-
-		buf += le32_to_cpu(shdr->NextCommand);
+			server->smallbuf = buf = next_buffer;
 		goto one_more;
+	} else if (ret != 0) {
+		/*
+		 * ret != 0 here means that we didn't get to handle_mid() thus
+		 * server->smallbuf and server->bigbuf are still valid. We need
+		 * to free next_buffer because it is not going to be used
+		 * anywhere.
+		 */
+		if (next_is_large)
+			free_rsp_buf(CIFS_LARGE_BUFFER, next_buffer);
+		else
+			free_rsp_buf(CIFS_SMALL_BUFFER, next_buffer);
 	}
 
 	return ret;
-- 
GitLab


From 33bdea175df0ffbb2327b6ea90012dd581eb501f Mon Sep 17 00:00:00 2001
From: Sebastien Tisserant <stisserant@wallix.com>
Date: Thu, 1 Aug 2019 12:06:08 -0500
Subject: [PATCH 1651/1835] SMB3: Kernel oops mounting a encryptData share with
 CONFIG_DEBUG_VIRTUAL

[ Upstream commit ee9d66182392695535cc9fccfcb40c16f72de2a9 ]

Fix kernel oops when mounting a encryptData CIFS share with
CONFIG_DEBUG_VIRTUAL

Signed-off-by: Sebastien Tisserant <stisserant@wallix.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2ops.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 97fdbec54db97..cc9e846a38658 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -2545,7 +2545,15 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
 static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
 				   unsigned int buflen)
 {
-	sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));
+	void *addr;
+	/*
+	 * VMAP_STACK (at least) puts stack into the vmalloc address space
+	 */
+	if (is_vmalloc_addr(buf))
+		addr = vmalloc_to_page(buf);
+	else
+		addr = virt_to_page(buf);
+	sg_set_page(sg, addr, buflen, offset_in_page(buf));
 }
 
 /* Assumes the first rqst has a transform header as the first iov.
-- 
GitLab


From db106f695414144d3cc1de97c7e601eecdb48ae8 Mon Sep 17 00:00:00 2001
From: Vasily Gorbik <gor@linux.ibm.com>
Date: Mon, 5 Aug 2019 14:25:16 +0200
Subject: [PATCH 1652/1835] s390: put _stext and _etext into .text section

[ Upstream commit 24350fdadbdec780406a1ef988e6cd3875e374a8 ]

Perf relies on _etext and _stext symbols being one of 't', 'T', 'v' or
'V'. Put them into .text section to guarantee that.

Also moves padding to page boundary inside .text which has an effect that
.text section is now padded with nops rather than 0's, which apparently
has been the initial intention for specifying 0x0700 fill expression.

Reported-by: Thomas Richter <tmricht@linux.ibm.com>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Suggested-by: Andreas Krebbel <krebbel@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/vmlinux.lds.S | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index b43f8d33a3697..18ede6e806b91 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -31,10 +31,9 @@ PHDRS {
 SECTIONS
 {
 	. = 0x100000;
-	_stext = .;		/* Start of text section */
 	.text : {
-		/* Text and read-only data */
-		_text = .;
+		_stext = .;		/* Start of text section */
+		_text = .;		/* Text and read-only data */
 		HEAD_TEXT
 		TEXT_TEXT
 		SCHED_TEXT
@@ -46,11 +45,10 @@ SECTIONS
 		*(.text.*_indirect_*)
 		*(.fixup)
 		*(.gnu.warning)
+		. = ALIGN(PAGE_SIZE);
+		_etext = .;		/* End of text section */
 	} :text = 0x0700
 
-	. = ALIGN(PAGE_SIZE);
-	_etext = .;		/* End of text section */
-
 	NOTES :text :note
 
 	.dummy : { *(.dummy) } :data
-- 
GitLab


From 45e7e4e66b08984dd3fce1a7a16f6487bbb1bbf6 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Tue, 6 Aug 2019 10:55:12 +0200
Subject: [PATCH 1653/1835] net: cxgb3_main: Fix a resource leak in a error
 path in 'init_one()'

[ Upstream commit debea2cd3193ac868289e8893c3a719c265b0612 ]

A call to 'kfree_skb()' is missing in the error handling path of
'init_one()'.
This is already present in 'remove_one()' but is missing here.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index c34ea385fe4a5..6be6de0774b61 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -3270,7 +3270,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 	if (!adapter->regs) {
 		dev_err(&pdev->dev, "cannot map device registers\n");
 		err = -ENOMEM;
-		goto out_free_adapter;
+		goto out_free_adapter_nofail;
 	}
 
 	adapter->pdev = pdev;
@@ -3398,6 +3398,9 @@ out_free_dev:
 		if (adapter->port[i])
 			free_netdev(adapter->port[i]);
 
+out_free_adapter_nofail:
+	kfree_skb(adapter->nofail_skb);
+
 out_free_adapter:
 	kfree(adapter);
 
-- 
GitLab


From b6cd6d18423eb59be98a361bfae40844de534c62 Mon Sep 17 00:00:00 2001
From: Jose Abreu <Jose.Abreu@synopsys.com>
Date: Tue, 6 Aug 2019 15:16:17 +0200
Subject: [PATCH 1654/1835] net: stmmac: Fix issues when number of Queues >= 4

[ Upstream commit e8df7e8c233a18d2704e37ecff47583b494789d3 ]

When queues >= 4 we use different registers but we were not subtracting
the offset of 4. Fix this.

Found out by Coverity.

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c   | 4 ++++
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index d0e6e1503581f..48cf5e2b24417 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -88,6 +88,8 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw,
 	u32 value;
 
 	base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
+	if (queue >= 4)
+		queue -= 4;
 
 	value = readl(ioaddr + base_register);
 
@@ -105,6 +107,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
 	u32 value;
 
 	base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
+	if (queue >= 4)
+		queue -= 4;
 
 	value = readl(ioaddr + base_register);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index d182f82f7b586..870302a7177e2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -106,6 +106,8 @@ static void dwxgmac2_rx_queue_prio(struct mac_device_info *hw, u32 prio,
 	u32 value, reg;
 
 	reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
+	if (queue >= 4)
+		queue -= 4;
 
 	value = readl(ioaddr + reg);
 	value &= ~XGMAC_PSRQ(queue);
@@ -169,6 +171,8 @@ static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue,
 	u32 value, reg;
 
 	reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1;
+	if (queue >= 4)
+		queue -= 4;
 
 	value = readl(ioaddr + reg);
 	value &= ~XGMAC_QxMDMACH(queue);
-- 
GitLab


From b8d03c79e4033dc0d516e1d7ff14065439986a5c Mon Sep 17 00:00:00 2001
From: Jose Abreu <Jose.Abreu@synopsys.com>
Date: Tue, 6 Aug 2019 15:16:18 +0200
Subject: [PATCH 1655/1835] net: stmmac: tc: Do not return a fragment entry

[ Upstream commit 4a6a1385a4db5f42258a40fcd497cbfd22075968 ]

Do not try to return a fragment entry from TC list. Otherwise we may not
clean properly allocated entries.

Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 58ea18af9813a..37c0bc699cd9c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -37,7 +37,7 @@ static struct stmmac_tc_entry *tc_find_entry(struct stmmac_priv *priv,
 		entry = &priv->tc_entries[i];
 		if (!entry->in_use && !first && free)
 			first = entry;
-		if (entry->handle == loc && !free)
+		if ((entry->handle == loc) && !free && !entry->is_frag)
 			dup = entry;
 	}
 
-- 
GitLab


From 09ec5bf10749f75e2f0c5dceacf929b6af8c3caa Mon Sep 17 00:00:00 2001
From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
Date: Sat, 3 Aug 2019 20:31:39 +0800
Subject: [PATCH 1656/1835] net: hisilicon: make hip04_tx_reclaim non-reentrant

[ Upstream commit 1a2c070ae805910a853b4a14818481ed2e17c727 ]

If hip04_tx_reclaim is interrupted while it is running
and then __napi_schedule continues to execute
hip04_rx_poll->hip04_tx_reclaim, reentrancy occurs
and oops is generated. So you need to mask the interrupt
during the hip04_tx_reclaim run.

The kernel oops exception stack is as follows:

Unable to handle kernel NULL pointer dereference
at virtual address 00000050
pgd = c0003000
[00000050] *pgd=80000000a04003, *pmd=00000000
Internal error: Oops: 206 [#1] SMP ARM
Modules linked in: hip04_eth mtdblock mtd_blkdevs mtd
ohci_platform ehci_platform ohci_hcd ehci_hcd
vfat fat sd_mod usb_storage scsi_mod usbcore usb_common
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O    4.4.185 #1
Hardware name: Hisilicon A15
task: c0a250e0 task.stack: c0a00000
PC is at hip04_tx_reclaim+0xe0/0x17c [hip04_eth]
LR is at hip04_tx_reclaim+0x30/0x17c [hip04_eth]
pc : [<bf30c3a4>]    lr : [<bf30c2f4>]    psr: 600e0313
sp : c0a01d88  ip : 00000000  fp : c0601f9c
r10: 00000000  r9 : c3482380  r8 : 00000001
r7 : 00000000  r6 : 000000e1  r5 : c3482000  r4 : 0000000c
r3 : f2209800  r2 : 00000000  r1 : 00000000  r0 : 00000000
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 32c5387d  Table: 03d28c80  DAC: 55555555
Process swapper/0 (pid: 0, stack limit = 0xc0a00190)
Stack: (0xc0a01d88 to 0xc0a02000)
[<bf30c3a4>] (hip04_tx_reclaim [hip04_eth]) from [<bf30d2e0>]
                                                (hip04_rx_poll+0x88/0x368 [hip04_eth])
[<bf30d2e0>] (hip04_rx_poll [hip04_eth]) from [<c04c2d9c>] (net_rx_action+0x114/0x34c)
[<c04c2d9c>] (net_rx_action) from [<c021eed8>] (__do_softirq+0x218/0x318)
[<c021eed8>] (__do_softirq) from [<c021f284>] (irq_exit+0x88/0xac)
[<c021f284>] (irq_exit) from [<c0240090>] (msa_irq_exit+0x11c/0x1d4)
[<c0240090>] (msa_irq_exit) from [<c02677e0>] (__handle_domain_irq+0x110/0x148)
[<c02677e0>] (__handle_domain_irq) from [<c0201588>] (gic_handle_irq+0xd4/0x118)
[<c0201588>] (gic_handle_irq) from [<c0551700>] (__irq_svc+0x40/0x58)
Exception stack(0xc0a01f30 to 0xc0a01f78)
1f20:                                     c0ae8b40 00000000 00000000 00000000
1f40: 00000002 ffffe000 c0601f9c 00000000 ffffffff c0a2257c c0a22440 c0831a38
1f60: c0a01ec4 c0a01f80 c0203714 c0203718 600e0213 ffffffff
[<c0551700>] (__irq_svc) from [<c0203718>] (arch_cpu_idle+0x20/0x3c)
[<c0203718>] (arch_cpu_idle) from [<c025bfd8>] (cpu_startup_entry+0x244/0x29c)
[<c025bfd8>] (cpu_startup_entry) from [<c054b0d8>] (rest_init+0xc8/0x10c)
[<c054b0d8>] (rest_init) from [<c0800c58>] (start_kernel+0x468/0x514)
Code: a40599e5 016086e2 018088e2 7660efe6 (503090e5)
---[ end trace 1db21d6d09c49d74 ]---
Kernel panic - not syncing: Fatal exception in interrupt
CPU3: stopping
CPU: 3 PID: 0 Comm: swapper/3 Tainted: G      D    O    4.4.185 #1

Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hip04_eth.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index 6127697ede120..57c0afa25f9fb 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -497,6 +497,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
 	u16 len;
 	u32 err;
 
+	/* clean up tx descriptors */
+	tx_remaining = hip04_tx_reclaim(ndev, false);
+
 	while (cnt && !last) {
 		buf = priv->rx_buf[priv->rx_head];
 		skb = build_skb(buf, priv->rx_buf_size);
@@ -557,8 +560,7 @@ refill:
 	}
 	napi_complete_done(napi, rx);
 done:
-	/* clean up tx descriptors and start a new timer if necessary */
-	tx_remaining = hip04_tx_reclaim(ndev, false);
+	/* start a new timer if necessary */
 	if (rx < budget && tx_remaining)
 		hip04_start_tx_timer(priv);
 
-- 
GitLab


From 4ab3052568e5a59a41a00f4110942e366733e164 Mon Sep 17 00:00:00 2001
From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
Date: Sat, 3 Aug 2019 20:31:40 +0800
Subject: [PATCH 1657/1835] net: hisilicon: fix hip04-xmit never return TX_BUSY

[ Upstream commit f2243b82785942be519016067ee6c55a063bbfe2 ]

TX_DESC_NUM is 256, in tx_count, the maximum value of
mod(TX_DESC_NUM - 1) is 254, the variable "count" in
the hip04_mac_start_xmit function is never equal to
(TX_DESC_NUM - 1), so hip04_mac_start_xmit never
return NETDEV_TX_BUSY.

tx_count is modified to mod(TX_DESC_NUM) so that
the maximum value of tx_count can reach
(TX_DESC_NUM - 1), then hip04_mac_start_xmit can reurn
NETDEV_TX_BUSY.

Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index 57c0afa25f9fb..fe3b1637fd5f4 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -185,7 +185,7 @@ struct hip04_priv {
 
 static inline unsigned int tx_count(unsigned int head, unsigned int tail)
 {
-	return (head - tail) % (TX_DESC_NUM - 1);
+	return (head - tail) % TX_DESC_NUM;
 }
 
 static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex)
-- 
GitLab


From e0c030221b1ff10164918c32fb75a310deee5688 Mon Sep 17 00:00:00 2001
From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
Date: Sat, 3 Aug 2019 20:31:41 +0800
Subject: [PATCH 1658/1835] net: hisilicon: Fix dma_map_single failed on arm64

[ Upstream commit 96a50c0d907ac8f5c3d6b051031a19eb8a2b53e3 ]

On the arm64 platform, executing "ifconfig eth0 up" will fail,
returning "ifconfig: SIOCSIFFLAGS: Input/output error."

ndev->dev is not initialized, dma_map_single->get_dma_ops->
dummy_dma_ops->__dummy_map_page will return DMA_ERROR_CODE
directly, so when we use dma_map_single, the first parameter
is to use the device of platform_device.

Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hip04_eth.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index fe3b1637fd5f4..a91d49dd92ea6 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -157,6 +157,7 @@ struct hip04_priv {
 	unsigned int reg_inten;
 
 	struct napi_struct napi;
+	struct device *dev;
 	struct net_device *ndev;
 
 	struct tx_desc *tx_desc;
@@ -387,7 +388,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force)
 		}
 
 		if (priv->tx_phys[tx_tail]) {
-			dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail],
+			dma_unmap_single(priv->dev, priv->tx_phys[tx_tail],
 					 priv->tx_skb[tx_tail]->len,
 					 DMA_TO_DEVICE);
 			priv->tx_phys[tx_tail] = 0;
@@ -437,8 +438,8 @@ static int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 		return NETDEV_TX_BUSY;
 	}
 
-	phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE);
-	if (dma_mapping_error(&ndev->dev, phys)) {
+	phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE);
+	if (dma_mapping_error(priv->dev, phys)) {
 		dev_kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}
@@ -508,7 +509,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
 			goto refill;
 		}
 
-		dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head],
+		dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head],
 				 RX_BUF_SIZE, DMA_FROM_DEVICE);
 		priv->rx_phys[priv->rx_head] = 0;
 
@@ -537,9 +538,9 @@ refill:
 		buf = netdev_alloc_frag(priv->rx_buf_size);
 		if (!buf)
 			goto done;
-		phys = dma_map_single(&ndev->dev, buf,
+		phys = dma_map_single(priv->dev, buf,
 				      RX_BUF_SIZE, DMA_FROM_DEVICE);
-		if (dma_mapping_error(&ndev->dev, phys))
+		if (dma_mapping_error(priv->dev, phys))
 			goto done;
 		priv->rx_buf[priv->rx_head] = buf;
 		priv->rx_phys[priv->rx_head] = phys;
@@ -642,9 +643,9 @@ static int hip04_mac_open(struct net_device *ndev)
 	for (i = 0; i < RX_DESC_NUM; i++) {
 		dma_addr_t phys;
 
-		phys = dma_map_single(&ndev->dev, priv->rx_buf[i],
+		phys = dma_map_single(priv->dev, priv->rx_buf[i],
 				      RX_BUF_SIZE, DMA_FROM_DEVICE);
-		if (dma_mapping_error(&ndev->dev, phys))
+		if (dma_mapping_error(priv->dev, phys))
 			return -EIO;
 
 		priv->rx_phys[i] = phys;
@@ -678,7 +679,7 @@ static int hip04_mac_stop(struct net_device *ndev)
 
 	for (i = 0; i < RX_DESC_NUM; i++) {
 		if (priv->rx_phys[i]) {
-			dma_unmap_single(&ndev->dev, priv->rx_phys[i],
+			dma_unmap_single(priv->dev, priv->rx_phys[i],
 					 RX_BUF_SIZE, DMA_FROM_DEVICE);
 			priv->rx_phys[i] = 0;
 		}
@@ -822,6 +823,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	priv = netdev_priv(ndev);
+	priv->dev = d;
 	priv->ndev = ndev;
 	platform_set_drvdata(pdev, ndev);
 	SET_NETDEV_DEV(ndev, &pdev->dev);
-- 
GitLab


From 3b84bbef51c486af18fe93320ba85c065cf40caa Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Wed, 7 Aug 2019 12:20:52 -0600
Subject: [PATCH 1659/1835] libata: have ata_scsi_rw_xlat() fail invalid
 passthrough requests

[ Upstream commit 2d7271501720038381d45fb3dcbe4831228fc8cc ]

For passthrough requests, libata-scsi takes what the user passes in
as gospel. This can be problematic if the user fills in the CDB
incorrectly. One example of that is in request sizes. For read/write
commands, the CDB contains fields describing the transfer length of
the request. These should match with the SG_IO header fields, but
libata-scsi currently does no validation of that.

Check that the number of blocks in the CDB for passthrough requests
matches what was mapped into the request. If the CDB asks for more
data then the validated SG_IO header fields, error it.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-scsi.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1984fc78c750b..3a64fa4aaf7e3 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1803,6 +1803,21 @@ nothing_to_do:
 	return 1;
 }
 
+static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
+{
+	struct request *rq = scmd->request;
+	u32 req_blocks;
+
+	if (!blk_rq_is_passthrough(rq))
+		return true;
+
+	req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
+	if (n_blocks > req_blocks)
+		return false;
+
+	return true;
+}
+
 /**
  *	ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
  *	@qc: Storage for translated ATA taskfile
@@ -1847,6 +1862,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
 		scsi_10_lba_len(cdb, &block, &n_block);
 		if (cdb[1] & (1 << 3))
 			tf_flags |= ATA_TFLAG_FUA;
+		if (!ata_check_nblocks(scmd, n_block))
+			goto invalid_fld;
 		break;
 	case READ_6:
 	case WRITE_6:
@@ -1861,6 +1878,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
 		 */
 		if (!n_block)
 			n_block = 256;
+		if (!ata_check_nblocks(scmd, n_block))
+			goto invalid_fld;
 		break;
 	case READ_16:
 	case WRITE_16:
@@ -1871,6 +1890,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
 		scsi_16_lba_len(cdb, &block, &n_block);
 		if (cdb[1] & (1 << 3))
 			tf_flags |= ATA_TFLAG_FUA;
+		if (!ata_check_nblocks(scmd, n_block))
+			goto invalid_fld;
 		break;
 	default:
 		DPRINTK("no-byte command\n");
-- 
GitLab


From 3ca013cd63be479be95ea953d08295f05f550c19 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Wed, 7 Aug 2019 12:23:57 -0600
Subject: [PATCH 1660/1835] libata: add SG safety checks in SFF pio transfers

[ Upstream commit 752ead44491e8c91e14d7079625c5916b30921c5 ]

Abort processing of a command if we run out of mapped data in the
SG list. This should never happen, but a previous bug caused it to
be possible. Play it safe and attempt to abort nicely if we don't
have more SG segments left.

Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-sff.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index c5ea0fc635e54..873cc09060551 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -674,6 +674,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
 	unsigned int offset;
 	unsigned char *buf;
 
+	if (!qc->cursg) {
+		qc->curbytes = qc->nbytes;
+		return;
+	}
 	if (qc->curbytes == qc->nbytes - qc->sect_size)
 		ap->hsm_task_state = HSM_ST_LAST;
 
@@ -699,6 +703,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
 
 	if (qc->cursg_ofs == qc->cursg->length) {
 		qc->cursg = sg_next(qc->cursg);
+		if (!qc->cursg)
+			ap->hsm_task_state = HSM_ST_LAST;
 		qc->cursg_ofs = 0;
 	}
 }
-- 
GitLab


From 923de016dc8842710e76311167957b1d2dbc60a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valdis=20Kl=C4=93tnieks?= <valdis.kletnieks@vt.edu>
Date: Wed, 7 Aug 2019 23:27:17 -0400
Subject: [PATCH 1661/1835] x86/lib/cpu: Address missing prototypes warning

[ Upstream commit 04f5bda84b0712d6f172556a7e8dca9ded5e73b9 ]

When building with W=1, warnings about missing prototypes are emitted:

  CC      arch/x86/lib/cpu.o
arch/x86/lib/cpu.c:5:14: warning: no previous prototype for 'x86_family' [-Wmissing-prototypes]
    5 | unsigned int x86_family(unsigned int sig)
      |              ^~~~~~~~~~
arch/x86/lib/cpu.c:18:14: warning: no previous prototype for 'x86_model' [-Wmissing-prototypes]
   18 | unsigned int x86_model(unsigned int sig)
      |              ^~~~~~~~~
arch/x86/lib/cpu.c:33:14: warning: no previous prototype for 'x86_stepping' [-Wmissing-prototypes]
   33 | unsigned int x86_stepping(unsigned int sig)
      |              ^~~~~~~~~~~~

Add the proper include file so the prototypes are there.

Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/42513.1565234837@turing-police
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/lib/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
index 2dd1fe13a37b3..19f707992db22 100644
--- a/arch/x86/lib/cpu.c
+++ b/arch/x86/lib/cpu.c
@@ -1,5 +1,6 @@
 #include <linux/types.h>
 #include <linux/export.h>
+#include <asm/cpu.h>
 
 unsigned int x86_family(unsigned int sig)
 {
-- 
GitLab


From fa6f4687805a38af3dd27cd02445daa806736335 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Mon, 24 Jun 2019 09:39:59 -0700
Subject: [PATCH 1662/1835] drm/vmwgfx: fix memory leak when too many retries
 have occurred

[ Upstream commit 6b7c3b86f0b63134b2ab56508921a0853ffa687a ]

Currently when too many retries have occurred there is a memory
leak on the allocation for reply on the error return path. Fix
this by kfree'ing reply before returning.

Addresses-Coverity: ("Resource leak")
Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Signed-off-by: Deepak Rawat <drawat@vmware.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index e4e09d47c5c0e..59e9d05ab928b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -389,8 +389,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
 		break;
 	}
 
-	if (retries == RETRIES)
+	if (retries == RETRIES) {
+		kfree(reply);
 		return -EINVAL;
+	}
 
 	*msg_len = reply_len;
 	*msg     = reply;
-- 
GitLab


From 7aa8dfa450b44a42b66be219de4d249e988d1605 Mon Sep 17 00:00:00 2001
From: Paolo Valente <paolo.valente@linaro.org>
Date: Wed, 7 Aug 2019 19:21:11 +0200
Subject: [PATCH 1663/1835] block, bfq: handle NULL return value by
 bfq_init_rq()

[ Upstream commit fd03177c33b287c6541f4048f1d67b7b45a1abc9 ]

As reported in [1], the call bfq_init_rq(rq) may return NULL in case
of OOM (in particular, if rq->elv.icq is NULL because memory
allocation failed in failed in ioc_create_icq()).

This commit handles this circumstance.

[1] https://lkml.org/lkml/2019/7/22/824

Cc: Hsin-Yi Wang <hsinyi@google.com>
Cc: Nicolas Boichat <drinkcat@chromium.org>
Cc: Doug Anderson <dianders@chromium.org>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Hsin-Yi Wang <hsinyi@google.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bfq-iosched.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index becd793a258c8..d8d2ac294b0c0 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -1886,9 +1886,14 @@ static void bfq_request_merged(struct request_queue *q, struct request *req,
 	    blk_rq_pos(container_of(rb_prev(&req->rb_node),
 				    struct request, rb_node))) {
 		struct bfq_queue *bfqq = bfq_init_rq(req);
-		struct bfq_data *bfqd = bfqq->bfqd;
+		struct bfq_data *bfqd;
 		struct request *prev, *next_rq;
 
+		if (!bfqq)
+			return;
+
+		bfqd = bfqq->bfqd;
+
 		/* Reposition request in its sort_list */
 		elv_rb_del(&bfqq->sort_list, req);
 		elv_rb_add(&bfqq->sort_list, req);
@@ -1930,6 +1935,9 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq,
 	struct bfq_queue *bfqq = bfq_init_rq(rq),
 		*next_bfqq = bfq_init_rq(next);
 
+	if (!bfqq)
+		return;
+
 	/*
 	 * If next and rq belong to the same bfq_queue and next is older
 	 * than rq, then reposition rq in the fifo (by substituting next
@@ -4590,12 +4598,12 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
 
 	spin_lock_irq(&bfqd->lock);
 	bfqq = bfq_init_rq(rq);
-	if (at_head || blk_rq_is_passthrough(rq)) {
+	if (!bfqq || at_head || blk_rq_is_passthrough(rq)) {
 		if (at_head)
 			list_add(&rq->queuelist, &bfqd->dispatch);
 		else
 			list_add_tail(&rq->queuelist, &bfqd->dispatch);
-	} else { /* bfqq is assumed to be non null here */
+	} else {
 		idle_timer_disabled = __bfq_insert_request(bfqd, rq);
 		/*
 		 * Update bfqq, because, if a queue merge has occurred
-- 
GitLab


From e49cfed0a8cb94942f03ff11e7405b2f8368d415 Mon Sep 17 00:00:00 2001
From: He Zhe <zhe.he@windriver.com>
Date: Fri, 2 Aug 2019 16:29:51 +0800
Subject: [PATCH 1664/1835] perf ftrace: Fix failure to set cpumask when only
 one cpu is present

[ Upstream commit cf30ae726c011e0372fd4c2d588466c8b50a8907 ]

The buffer containing the string used to set cpumask is overwritten at
the end of the string later in cpu_map__snprint_mask due to not enough
memory space, when there is only one cpu.

And thus causes the following failure:

  $ perf ftrace ls
  failed to reset ftrace
  $

This patch fixes the calculation of the cpumask string size.

Signed-off-by: He Zhe <zhe.he@windriver.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Fixes: dc23103278c5 ("perf ftrace: Add support for -a and -C option")
Link: http://lkml.kernel.org/r/1564734592-15624-1-git-send-email-zhe.he@windriver.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-ftrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index f42f228e88992..137955197ba8d 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -174,7 +174,7 @@ static int set_tracing_cpumask(struct cpu_map *cpumap)
 	int last_cpu;
 
 	last_cpu = cpu_map__cpu(cpumap, cpumap->nr - 1);
-	mask_size = (last_cpu + 3) / 4 + 1;
+	mask_size = last_cpu / 4 + 2; /* one more byte for EOS */
 	mask_size += last_cpu / 32; /* ',' is needed for every 32th cpus */
 
 	cpumask = malloc(mask_size);
-- 
GitLab


From 06ed429b901877e256e7829e6effb2799014b41e Mon Sep 17 00:00:00 2001
From: He Zhe <zhe.he@windriver.com>
Date: Fri, 2 Aug 2019 16:29:52 +0800
Subject: [PATCH 1665/1835] perf cpumap: Fix writing to illegal memory in
 handling cpumap mask

[ Upstream commit 5f5e25f1c7933a6e1673515c0b1d5acd82fea1ed ]

cpu_map__snprint_mask() would write to illegal memory pointed by
zalloc(0) when there is only one cpu.

This patch fixes the calculation and adds sanity check against the input
parameters.

Signed-off-by: He Zhe <zhe.he@windriver.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Fixes: 4400ac8a9a90 ("perf cpumap: Introduce cpu_map__snprint_mask()")
Link: http://lkml.kernel.org/r/1564734592-15624-2-git-send-email-zhe.he@windriver.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/cpumap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 383674f448fcd..f93846edc1e0d 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -701,7 +701,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
 	unsigned char *bitmap;
 	int last_cpu = cpu_map__cpu(map, map->nr - 1);
 
-	bitmap = zalloc((last_cpu + 7) / 8);
+	if (buf == NULL)
+		return 0;
+
+	bitmap = zalloc(last_cpu / 8 + 1);
 	if (bitmap == NULL) {
 		buf[0] = '\0';
 		return 0;
-- 
GitLab


From 590549487679473835ba8c64454baae7e81d9b71 Mon Sep 17 00:00:00 2001
From: Jin Yao <yao.jin@linux.intel.com>
Date: Mon, 29 Jul 2019 15:27:55 +0800
Subject: [PATCH 1666/1835] perf pmu-events: Fix missing
 "cpu_clk_unhalted.core" event

[ Upstream commit 8e6e5bea2e34c61291d00cb3f47560341aa84bc3 ]

The events defined in pmu-events JSON are parsed and added into perf
tool. For fixed counters, we handle the encodings between JSON and perf
by using a static array fixed[].

But the fixed[] has missed an important event "cpu_clk_unhalted.core".

For example, on the Tremont platform,

  [root@localhost ~]# perf stat -e cpu_clk_unhalted.core -a
  event syntax error: 'cpu_clk_unhalted.core'
                       \___ parser error

With this patch, the event cpu_clk_unhalted.core can be parsed.

  [root@localhost perf]# ./perf stat -e cpu_clk_unhalted.core -a -vvv
  ------------------------------------------------------------
  perf_event_attr:
    type                             4
    size                             112
    config                           0x3c
    sample_type                      IDENTIFIER
    read_format                      TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING
    disabled                         1
    inherit                          1
    exclude_guest                    1
  ------------------------------------------------------------
...

Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jin Yao <yao.jin@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20190729072755.2166-1-yao.jin@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/pmu-events/jevents.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
index 68c92bb599eef..6b36b71106695 100644
--- a/tools/perf/pmu-events/jevents.c
+++ b/tools/perf/pmu-events/jevents.c
@@ -450,6 +450,7 @@ static struct fixed {
 	{ "inst_retired.any_p", "event=0xc0" },
 	{ "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" },
 	{ "cpu_clk_unhalted.thread", "event=0x3c" },
+	{ "cpu_clk_unhalted.core", "event=0x3c" },
 	{ "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" },
 	{ NULL, NULL},
 };
-- 
GitLab


From d5cb5b493030a7856906e4efd6b9d695ec8eeea5 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Mon, 5 Aug 2019 10:34:51 +0100
Subject: [PATCH 1667/1835] KVM: arm64: Don't write junk to sysregs on reset

[ Upstream commit 03fdfb2690099c19160a3f2c5b77db60b3afeded ]

At the moment, the way we reset system registers is mildly insane:
We write junk to them, call the reset functions, and then check that
we have something else in them.

The "fun" thing is that this can happen while the guest is running
(PSCI, for example). If anything in KVM has to evaluate the state
of a system register while junk is in there, bad thing may happen.

Let's stop doing that. Instead, we track that we have called a
reset function for that register, and assume that the reset
function has done something. This requires fixing a couple of
sysreg refinition in the trap table.

In the end, the very need of this reset check is pretty dubious,
as it doesn't check everything (a lot of the sysregs leave outside of
the sys_regs[] array). It may well be axed in the near future.

Tested-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/sys_regs.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index d112af75680bb..6da2bbdb9648f 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -626,7 +626,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
 	 */
 	val = ((pmcr & ~ARMV8_PMU_PMCR_MASK)
 	       | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E);
-	__vcpu_sys_reg(vcpu, PMCR_EL0) = val;
+	__vcpu_sys_reg(vcpu, r->reg) = val;
 }
 
 static bool check_pmu_access_disabled(struct kvm_vcpu *vcpu, u64 flags)
@@ -968,13 +968,13 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
 /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */
 #define DBG_BCR_BVR_WCR_WVR_EL1(n)					\
 	{ SYS_DESC(SYS_DBGBVRn_EL1(n)),					\
-	  trap_bvr, reset_bvr, n, 0, get_bvr, set_bvr },		\
+	  trap_bvr, reset_bvr, 0, 0, get_bvr, set_bvr },		\
 	{ SYS_DESC(SYS_DBGBCRn_EL1(n)),					\
-	  trap_bcr, reset_bcr, n, 0, get_bcr, set_bcr },		\
+	  trap_bcr, reset_bcr, 0, 0, get_bcr, set_bcr },		\
 	{ SYS_DESC(SYS_DBGWVRn_EL1(n)),					\
-	  trap_wvr, reset_wvr, n, 0,  get_wvr, set_wvr },		\
+	  trap_wvr, reset_wvr, 0, 0,  get_wvr, set_wvr },		\
 	{ SYS_DESC(SYS_DBGWCRn_EL1(n)),					\
-	  trap_wcr, reset_wcr, n, 0,  get_wcr, set_wcr }
+	  trap_wcr, reset_wcr, 0, 0,  get_wcr, set_wcr }
 
 /* Macro to expand the PMEVCNTRn_EL0 register */
 #define PMU_PMEVCNTR_EL0(n)						\
@@ -1359,7 +1359,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
 
 	{ SYS_DESC(SYS_CSSELR_EL1), NULL, reset_unknown, CSSELR_EL1 },
 
-	{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, },
+	{ SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
 	{ SYS_DESC(SYS_PMCNTENSET_EL0), access_pmcnten, reset_unknown, PMCNTENSET_EL0 },
 	{ SYS_DESC(SYS_PMCNTENCLR_EL0), access_pmcnten, NULL, PMCNTENSET_EL0 },
 	{ SYS_DESC(SYS_PMOVSCLR_EL0), access_pmovs, NULL, PMOVSSET_EL0 },
@@ -2072,13 +2072,19 @@ static int emulate_sys_reg(struct kvm_vcpu *vcpu,
 }
 
 static void reset_sys_reg_descs(struct kvm_vcpu *vcpu,
-			      const struct sys_reg_desc *table, size_t num)
+				const struct sys_reg_desc *table, size_t num,
+				unsigned long *bmap)
 {
 	unsigned long i;
 
 	for (i = 0; i < num; i++)
-		if (table[i].reset)
+		if (table[i].reset) {
+			int reg = table[i].reg;
+
 			table[i].reset(vcpu, &table[i]);
+			if (reg > 0 && reg < NR_SYS_REGS)
+				set_bit(reg, bmap);
+		}
 }
 
 /**
@@ -2576,18 +2582,16 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
 {
 	size_t num;
 	const struct sys_reg_desc *table;
-
-	/* Catch someone adding a register without putting in reset entry. */
-	memset(&vcpu->arch.ctxt.sys_regs, 0x42, sizeof(vcpu->arch.ctxt.sys_regs));
+	DECLARE_BITMAP(bmap, NR_SYS_REGS) = { 0, };
 
 	/* Generic chip reset first (so target could override). */
-	reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
+	reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs), bmap);
 
 	table = get_target_table(vcpu->arch.target, true, &num);
-	reset_sys_reg_descs(vcpu, table, num);
+	reset_sys_reg_descs(vcpu, table, num, bmap);
 
 	for (num = 1; num < NR_SYS_REGS; num++) {
-		if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242,
+		if (WARN(!test_bit(num, bmap),
 			 "Didn't reset __vcpu_sys_reg(%zi)\n", num))
 			break;
 	}
-- 
GitLab


From ef61b79017ff626f1ab75afcc37bf1a629449ed1 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Mon, 5 Aug 2019 10:34:51 +0100
Subject: [PATCH 1668/1835] KVM: arm: Don't write junk to CP15 registers on
 reset

[ Upstream commit c69509c70aa45a8c4954c88c629a64acf4ee4a36 ]

At the moment, the way we reset CP15 registers is mildly insane:
We write junk to them, call the reset functions, and then check that
we have something else in them.

The "fun" thing is that this can happen while the guest is running
(PSCI, for example). If anything in KVM has to evaluate the state
of a CP15 register while junk is in there, bad thing may happen.

Let's stop doing that. Instead, we track that we have called a
reset function for that register, and assume that the reset
function has done something.

In the end, the very need of this reset check is pretty dubious,
as it doesn't check everything (a lot of the CP15 reg leave outside
of the cp15_regs[] array). It may well be axed in the near future.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kvm/coproc.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index fd6cde23bb5d0..871fa50a09f19 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -658,13 +658,22 @@ int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
 }
 
 static void reset_coproc_regs(struct kvm_vcpu *vcpu,
-			      const struct coproc_reg *table, size_t num)
+			      const struct coproc_reg *table, size_t num,
+			      unsigned long *bmap)
 {
 	unsigned long i;
 
 	for (i = 0; i < num; i++)
-		if (table[i].reset)
+		if (table[i].reset) {
+			int reg = table[i].reg;
+
 			table[i].reset(vcpu, &table[i]);
+			if (reg > 0 && reg < NR_CP15_REGS) {
+				set_bit(reg, bmap);
+				if (table[i].is_64bit)
+					set_bit(reg + 1, bmap);
+			}
+		}
 }
 
 static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu)
@@ -1439,17 +1448,15 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)
 {
 	size_t num;
 	const struct coproc_reg *table;
-
-	/* Catch someone adding a register without putting in reset entry. */
-	memset(vcpu->arch.ctxt.cp15, 0x42, sizeof(vcpu->arch.ctxt.cp15));
+	DECLARE_BITMAP(bmap, NR_CP15_REGS) = { 0, };
 
 	/* Generic chip reset first (so target could override). */
-	reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs));
+	reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs), bmap);
 
 	table = get_target_table(vcpu->arch.target, &num);
-	reset_coproc_regs(vcpu, table, num);
+	reset_coproc_regs(vcpu, table, num, bmap);
 
 	for (num = 1; num < NR_CP15_REGS; num++)
-		WARN(vcpu_cp15(vcpu, num) == 0x42424242,
+		WARN(!test_bit(num, bmap),
 		     "Didn't reset vcpu_cp15(vcpu, %zi)", num);
 }
-- 
GitLab


From 3c4b283a0deb62e4a4f1b7f93c7a43985f47be2e Mon Sep 17 00:00:00 2001
From: Naresh Kamboju <naresh.kamboju () linaro ! org>
Date: Wed, 7 Aug 2019 13:58:14 +0000
Subject: [PATCH 1669/1835] selftests: kvm: Adding config fragments

[ Upstream commit c096397c78f766db972f923433031f2dec01cae0 ]

selftests kvm test cases need pre-required kernel configs for the test
to get pass.

Signed-off-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/config | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 tools/testing/selftests/kvm/config

diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config
new file mode 100644
index 0000000000000..63ed533f73d6e
--- /dev/null
+++ b/tools/testing/selftests/kvm/config
@@ -0,0 +1,3 @@
+CONFIG_KVM=y
+CONFIG_KVM_INTEL=y
+CONFIG_KVM_AMD=y
-- 
GitLab


From 8317fe4a39066fbbee69dca5d848e10c4b40eeb6 Mon Sep 17 00:00:00 2001
From: Aaron Armstrong Skomra <skomra@gmail.com>
Date: Fri, 16 Aug 2019 12:00:54 -0700
Subject: [PATCH 1670/1835] HID: wacom: correct misreported EKR ring values

commit fcf887e7caaa813eea821d11bf2b7619a37df37a upstream.

The EKR ring claims a range of 0 to 71 but actually reports
values 1 to 72. The ring is used in relative mode so this
change should not affect users.

Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Fixes: 72b236d60218f ("HID: wacom: Add support for Express Key Remote.")
Cc: <stable@vger.kernel.org> # v4.3+
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index e56dc97fe4b6e..c46aab6319c43 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1061,7 +1061,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len)
 	input_report_key(input, BTN_BASE2, (data[11] & 0x02));
 
 	if (data[12] & 0x80)
-		input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f));
+		input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f) - 1);
 	else
 		input_report_abs(input, ABS_WHEEL, 0);
 
-- 
GitLab


From 375c6c72f56cb2468595c365c82af2fa640d6430 Mon Sep 17 00:00:00 2001
From: Jason Gerecke <jason.gerecke@wacom.com>
Date: Wed, 7 Aug 2019 14:11:55 -0700
Subject: [PATCH 1671/1835] HID: wacom: Correct distance scale for 2nd-gen
 Intuos devices

commit b72fb1dcd2ea9d29417711cb302cef3006fa8d5a upstream.

Distance values reported by 2nd-gen Intuos tablets are on an inverted
scale (0 == far, 63 == near). We need to change them over to a normal
scale before reporting to userspace or else userspace drivers and
applications can get confused.

Ref: https://github.com/linuxwacom/input-wacom/issues/98
Fixes: eda01dab53 ("HID: wacom: Add four new Intuos devices")
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/wacom_wac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index c46aab6319c43..50ef7b6cd1957 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -848,6 +848,8 @@ static int wacom_intuos_general(struct wacom_wac *wacom)
 		y >>= 1;
 		distance >>= 1;
 	}
+	if (features->type == INTUOSHT2)
+		distance = features->distance_max - distance;
 	input_report_abs(input, ABS_X, x);
 	input_report_abs(input, ABS_Y, y);
 	input_report_abs(input, ABS_DISTANCE, distance);
-- 
GitLab


From b608a5a238d52d89e0b60a87400d3166f937c010 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Thu, 8 Aug 2019 05:40:04 -0400
Subject: [PATCH 1672/1835] Revert "dm bufio: fix deadlock with loop device"

commit cf3591ef832915892f2499b7e54b51d4c578b28c upstream.

Revert the commit bd293d071ffe65e645b4d8104f9d8fe15ea13862. The proper
fix has been made available with commit d0a255e795ab ("loop: set
PF_MEMALLOC_NOIO for the worker thread").

Note that the fix offered by commit bd293d071ffe doesn't really prevent
the deadlock from occuring - if we look at the stacktrace reported by
Junxiao Bi, we see that it hangs in bit_wait_io and not on the mutex -
i.e. it has already successfully taken the mutex. Changing the mutex
from mutex_lock to mutex_trylock won't help with deadlocks that happen
afterwards.

PID: 474    TASK: ffff8813e11f4600  CPU: 10  COMMAND: "kswapd0"
   #0 [ffff8813dedfb938] __schedule at ffffffff8173f405
   #1 [ffff8813dedfb990] schedule at ffffffff8173fa27
   #2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec
   #3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186
   #4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f
   #5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8
   #6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81
   #7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio]
   #8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio]
   #9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio]
  #10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce
  #11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778
  #12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f
  #13 [ffff8813dedfbec0] kthread at ffffffff810a8428
  #14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: bd293d071ffe ("dm bufio: fix deadlock with loop device")
Depends-on: d0a255e795ab ("loop: set PF_MEMALLOC_NOIO for the worker thread")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-bufio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index b1d0ae2dbd3dd..dc385b70e4c33 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1602,7 +1602,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
 	unsigned long freed;
 
 	c = container_of(shrink, struct dm_bufio_client, shrinker);
-	if (!dm_bufio_trylock(c))
+	if (sc->gfp_mask & __GFP_FS)
+		dm_bufio_lock(c);
+	else if (!dm_bufio_trylock(c))
 		return SHRINK_STOP;
 
 	freed  = __scan(c, sc->nr_to_scan, sc->gfp_mask);
-- 
GitLab


From a8f7703f221347b7dcfa1d4077695782edddbf78 Mon Sep 17 00:00:00 2001
From: Dinh Nguyen <dinguyen@kernel.org>
Date: Wed, 14 Aug 2019 10:30:14 -0500
Subject: [PATCH 1673/1835] clk: socfpga: stratix10: fix rate caclulationg for
 cnt_clks

commit c7ec75ea4d5316518adc87224e3cff47192579e7 upstream.

Checking bypass_reg is incorrect for calculating the cnt_clk rates.
Instead we should be checking that there is a proper hardware register
that holds the clock divider.

Cc: stable@vger.kernel.org
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lkml.kernel.org/r/20190814153014.12962-1-dinguyen@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/socfpga/clk-periph-s10.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/socfpga/clk-periph-s10.c b/drivers/clk/socfpga/clk-periph-s10.c
index 568f59b58ddfa..e7c877d354c7b 100644
--- a/drivers/clk/socfpga/clk-periph-s10.c
+++ b/drivers/clk/socfpga/clk-periph-s10.c
@@ -37,7 +37,7 @@ static unsigned long clk_peri_cnt_clk_recalc_rate(struct clk_hw *hwclk,
 	if (socfpgaclk->fixed_div) {
 		div = socfpgaclk->fixed_div;
 	} else {
-		if (!socfpgaclk->bypass_reg)
+		if (socfpgaclk->hw.reg)
 			div = ((readl(socfpgaclk->hw.reg) & 0x7ff) + 1);
 	}
 
-- 
GitLab


From 7bed2889cd184df203aab27ab7293b26b61816c6 Mon Sep 17 00:00:00 2001
From: Erqi Chen <chenerqi@gmail.com>
Date: Wed, 24 Jul 2019 10:26:09 +0800
Subject: [PATCH 1674/1835] ceph: clear page dirty before invalidate page

commit c95f1c5f436badb9bb87e9b30fd573f6b3d59423 upstream.

clear_page_dirty_for_io(page) before mapping->a_ops->invalidatepage().
invalidatepage() clears page's private flag, if dirty flag is not
cleared, the page may cause BUG_ON failure in ceph_set_page_dirty().

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/40862
Signed-off-by: Erqi Chen <chenerqi@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/addr.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 9c332a6f66678..476728bdae8c6 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -913,8 +913,9 @@ get_more_pages:
 			if (page_offset(page) >= ceph_wbc.i_size) {
 				dout("%p page eof %llu\n",
 				     page, ceph_wbc.i_size);
-				if (ceph_wbc.size_stable ||
-				    page_offset(page) >= i_size_read(inode))
+				if ((ceph_wbc.size_stable ||
+				    page_offset(page) >= i_size_read(inode)) &&
+				    clear_page_dirty_for_io(page))
 					mapping->a_ops->invalidatepage(page,
 								0, PAGE_SIZE);
 				unlock_page(page);
-- 
GitLab


From f2951720629e7af751eccf4d8245d858cffc4d2c Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 15 Aug 2019 06:23:38 -0400
Subject: [PATCH 1675/1835] ceph: don't try fill file_lock on unsuccessful
 GETFILELOCK reply

commit 28a282616f56990547b9dcd5c6fbd2001344664c upstream.

When ceph_mdsc_do_request returns an error, we can't assume that the
filelock_reply pointer will be set. Only try to fetch fields out of
the r_reply_info when it returns success.

Cc: stable@vger.kernel.org
Reported-by: Hector Martin <hector@marcansoft.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/locks.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index 9dae2ec7e1fa8..6a8f4a99582e5 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -111,8 +111,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct inode *inode,
 		req->r_wait_for_completion = ceph_lock_wait_for_completion;
 
 	err = ceph_mdsc_do_request(mdsc, inode, req);
-
-	if (operation == CEPH_MDS_OP_GETFILELOCK) {
+	if (!err && operation == CEPH_MDS_OP_GETFILELOCK) {
 		fl->fl_pid = -le64_to_cpu(req->r_reply_info.filelock_reply->pid);
 		if (CEPH_LOCK_SHARED == req->r_reply_info.filelock_reply->type)
 			fl->fl_type = F_RDLCK;
-- 
GitLab


From 51f6afddb1475a3debe3feb60610ae0df0346f18 Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Tue, 20 Aug 2019 16:40:33 +0200
Subject: [PATCH 1676/1835] libceph: fix PG split vs OSD (re)connect race

commit a561372405cf6bc6f14239b3a9e57bb39f2788b0 upstream.

We can't rely on ->peer_features in calc_target() because it may be
called both when the OSD session is established and open and when it's
not.  ->peer_features is not valid unless the OSD session is open.  If
this happens on a PG split (pg_num increase), that could mean we don't
resend a request that should have been resent, hanging the client
indefinitely.

In userspace this was fixed by looking at require_osd_release and
get_xinfo[osd].features fields of the osdmap.  However these fields
belong to the OSD section of the osdmap, which the kernel doesn't
decode (only the client section is decoded).

Instead, let's drop this feature check.  It effectively checks for
luminous, so only pre-luminous OSDs would be affected in that on a PG
split the kernel might resend a request that should not have been
resent.  Duplicates can occur in other scenarios, so both sides should
already be prepared for them: see dup/replay logic on the OSD side and
retry_attempt check on the client side.

Cc: stable@vger.kernel.org
Fixes: 7de030d6b10a ("libceph: resend on PG splits if OSD has RESEND_ON_SPLIT")
Link: https://tracker.ceph.com/issues/41162
Reported-by: Jerry Lee <leisurelysw24@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Tested-by: Jerry Lee <leisurelysw24@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/osd_client.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 60934bd8796c5..76c41a84550e7 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1423,7 +1423,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
 	struct ceph_osds up, acting;
 	bool force_resend = false;
 	bool unpaused = false;
-	bool legacy_change;
+	bool legacy_change = false;
 	bool split = false;
 	bool sort_bitwise = ceph_osdmap_flag(osdc, CEPH_OSDMAP_SORTBITWISE);
 	bool recovery_deletes = ceph_osdmap_flag(osdc,
@@ -1511,15 +1511,14 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
 		t->osd = acting.primary;
 	}
 
-	if (unpaused || legacy_change || force_resend ||
-	    (split && con && CEPH_HAVE_FEATURE(con->peer_features,
-					       RESEND_ON_SPLIT)))
+	if (unpaused || legacy_change || force_resend || split)
 		ct_res = CALC_TARGET_NEED_RESEND;
 	else
 		ct_res = CALC_TARGET_NO_ACTION;
 
 out:
-	dout("%s t %p -> ct_res %d osd %d\n", __func__, t, ct_res, t->osd);
+	dout("%s t %p -> %d%d%d%d ct_res %d osd%d\n", __func__, t, unpaused,
+	     legacy_change, force_resend, split, ct_res, t->osd);
 	return ct_res;
 }
 
-- 
GitLab


From f88c31b43babfab3bcd85d18aede278455f0776d Mon Sep 17 00:00:00 2001
From: Lyude Paul <lyude@redhat.com>
Date: Thu, 25 Jul 2019 15:40:01 -0400
Subject: [PATCH 1677/1835] drm/nouveau: Don't retry infinitely when receiving
 no data on i2c over AUX

commit c358ebf59634f06d8ed176da651ec150df3c8686 upstream.

While I had thought I had fixed this issue in:

commit 342406e4fbba ("drm/nouveau/i2c: Disable i2c bus access after
->fini()")

It turns out that while I did fix the error messages I was seeing on my
P50 when trying to access i2c busses with the GPU in runtime suspend, I
accidentally had missed one important detail that was mentioned on the
bug report this commit was supposed to fix: that the CPU would only lock
up when trying to access i2c busses _on connected devices_ _while the
GPU is not in runtime suspend_. Whoops. That definitely explains why I
was not able to get my machine to hang with i2c bus interactions until
now, as plugging my P50 into it's dock with an HDMI monitor connected
allowed me to finally reproduce this locally.

Now that I have managed to reproduce this issue properly, it looks like
the problem is much simpler then it looks. It turns out that some
connected devices, such as MST laptop docks, will actually ACK i2c reads
even if no data was actually read:

[  275.063043] nouveau 0000:01:00.0: i2c: aux 000a: 1: 0000004c 1
[  275.063447] nouveau 0000:01:00.0: i2c: aux 000a: 00 01101000 10040000
[  275.063759] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000001
[  275.064024] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000
[  275.064285] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000
[  275.064594] nouveau 0000:01:00.0: i2c: aux 000a: rd 00000000

Because we don't handle the situation of i2c ack without any data, we
end up entering an infinite loop in nvkm_i2c_aux_i2c_xfer() since the
value of cnt always remains at 0. This finally properly explains how
this could result in a CPU hang like the ones observed in the
aforementioned commit.

So, fix this by retrying transactions if no data is written or received,
and give up and fail the transaction if we continue to not write or
receive any data after 32 retries.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
index b4e7404fe660e..a11637b0f6ccf 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
@@ -40,8 +40,7 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 		u8 *ptr = msg->buf;
 
 		while (remaining) {
-			u8 cnt = (remaining > 16) ? 16 : remaining;
-			u8 cmd;
+			u8 cnt, retries, cmd;
 
 			if (msg->flags & I2C_M_RD)
 				cmd = 1;
@@ -51,10 +50,19 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 			if (mcnt || remaining > 16)
 				cmd |= 4; /* MOT */
 
-			ret = aux->func->xfer(aux, true, cmd, msg->addr, ptr, &cnt);
-			if (ret < 0) {
-				nvkm_i2c_aux_release(aux);
-				return ret;
+			for (retries = 0, cnt = 0;
+			     retries < 32 && !cnt;
+			     retries++) {
+				cnt = min_t(u8, remaining, 16);
+				ret = aux->func->xfer(aux, true, cmd,
+						      msg->addr, ptr, &cnt);
+				if (ret < 0)
+					goto out;
+			}
+			if (!cnt) {
+				AUX_TRACE(aux, "no data after 32 retries");
+				ret = -EIO;
+				goto out;
 			}
 
 			ptr += cnt;
@@ -64,8 +72,10 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 		msg++;
 	}
 
+	ret = num;
+out:
 	nvkm_i2c_aux_release(aux);
-	return num;
+	return ret;
 }
 
 static u32
-- 
GitLab


From 3783c7ee9920fac998117a9f8ec715693c5ed34b Mon Sep 17 00:00:00 2001
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Date: Tue, 6 Aug 2019 13:41:51 +0200
Subject: [PATCH 1678/1835] gpiolib: never report open-drain/source lines as
 'input' to user-space

commit 2c60e6b5c9241b24b8b523fefd3e44fb85622cda upstream.

If the driver doesn't support open-drain/source config options, we
emulate this behavior when setting the direction by calling
gpiod_direction_input() if the default value is 0 (open-source) or
1 (open-drain), thus not actively driving the line in those cases.

This however clears the FLAG_IS_OUT bit for the GPIO line descriptor
and makes the LINEINFO ioctl() incorrectly report this line's mode as
'input' to user-space.

This commit modifies the ioctl() to always set the GPIOLINE_FLAG_IS_OUT
bit in the lineinfo structure's flags field. Since it's impossible to
use the input mode and open-drain/source options at the same time, we
can be sure the reported information will be correct.

Fixes: 521a2ad6f862 ("gpio: add userspace ABI for GPIO line information")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Link: https://lore.kernel.org/r/20190806114151.17652-1-brgl@bgdev.pl
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpiolib.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index b308ce92685d9..53395852f0124 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1082,9 +1082,11 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
 			lineinfo.flags |= GPIOLINE_FLAG_ACTIVE_LOW;
 		if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
-			lineinfo.flags |= GPIOLINE_FLAG_OPEN_DRAIN;
+			lineinfo.flags |= (GPIOLINE_FLAG_OPEN_DRAIN |
+					   GPIOLINE_FLAG_IS_OUT);
 		if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
-			lineinfo.flags |= GPIOLINE_FLAG_OPEN_SOURCE;
+			lineinfo.flags |= (GPIOLINE_FLAG_OPEN_SOURCE |
+					   GPIOLINE_FLAG_IS_OUT);
 
 		if (copy_to_user(ip, &lineinfo, sizeof(lineinfo)))
 			return -EFAULT;
-- 
GitLab


From a6f236e1bd97d89d80c07dfe0e0b566044473b5a Mon Sep 17 00:00:00 2001
From: Dexuan Cui <decui@microsoft.com>
Date: Tue, 7 May 2019 07:46:55 +0000
Subject: [PATCH 1679/1835] Drivers: hv: vmbus: Fix virt_to_hvpfn() for X86_PAE

commit a9fc4340aee041dd186d1fb8f1b5d1e9caf28212 upstream.

In the case of X86_PAE, unsigned long is u32, but the physical address type
should be u64. Due to the bug here, the netvsc driver can not load
successfully, and sometimes the VM can panic due to memory corruption (the
hypervisor writes data to the wrong location).

Fixes: 6ba34171bcbd ("Drivers: hv: vmbus: Remove use of slow_virt_to_phys()")
Cc: stable@vger.kernel.org
Cc: Michael Kelley <mikelley@microsoft.com>
Reported-and-tested-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Reviewed-by:  Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hv/channel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 2f164bd746874..fdb0f832fadef 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -38,7 +38,7 @@
 
 static unsigned long virt_to_hvpfn(void *addr)
 {
-	unsigned long paddr;
+	phys_addr_t paddr;
 
 	if (is_vmalloc_addr(addr))
 		paddr = page_to_phys(vmalloc_to_page(addr)) +
-- 
GitLab


From cf13e30c58d4e4d19f773bc77a054d4892e26da9 Mon Sep 17 00:00:00 2001
From: Oleg Nesterov <oleg@redhat.com>
Date: Sat, 24 Aug 2019 17:54:56 -0700
Subject: [PATCH 1680/1835] userfaultfd_release: always remove uffd flags and
 clear vm_userfaultfd_ctx

commit 46d0b24c5ee10a15dfb25e20642f5a5ed59c5003 upstream.

userfaultfd_release() should clear vm_flags/vm_userfaultfd_ctx even if
mm->core_state != NULL.

Otherwise a page fault can see userfaultfd_missing() == T and use an
already freed userfaultfd_ctx.

Link: http://lkml.kernel.org/r/20190820160237.GB4983@redhat.com
Fixes: 04f5866e41fb ("coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping")
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Tested-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Jann Horn <jannh@google.com>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/userfaultfd.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index e1ebdbe40032e..9c2955f67f708 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -881,6 +881,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 	/* len == 0 means wake all */
 	struct userfaultfd_wake_range range = { .len = 0, };
 	unsigned long new_flags;
+	bool still_valid;
 
 	WRITE_ONCE(ctx->released, true);
 
@@ -896,8 +897,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 	 * taking the mmap_sem for writing.
 	 */
 	down_write(&mm->mmap_sem);
-	if (!mmget_still_valid(mm))
-		goto skip_mm;
+	still_valid = mmget_still_valid(mm);
 	prev = NULL;
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
 		cond_resched();
@@ -908,19 +908,20 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 			continue;
 		}
 		new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
-		prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
-				 new_flags, vma->anon_vma,
-				 vma->vm_file, vma->vm_pgoff,
-				 vma_policy(vma),
-				 NULL_VM_UFFD_CTX);
-		if (prev)
-			vma = prev;
-		else
-			prev = vma;
+		if (still_valid) {
+			prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
+					 new_flags, vma->anon_vma,
+					 vma->vm_file, vma->vm_pgoff,
+					 vma_policy(vma),
+					 NULL_VM_UFFD_CTX);
+			if (prev)
+				vma = prev;
+			else
+				prev = vma;
+		}
 		vma->vm_flags = new_flags;
 		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
 	}
-skip_mm:
 	up_write(&mm->mmap_sem);
 	mmput(mm);
 wakeup:
-- 
GitLab


From f9747104a5c80bbaa5c4ea3204f96cca35ae0dbd Mon Sep 17 00:00:00 2001
From: Sean Christopherson <sean.j.christopherson@intel.com>
Date: Thu, 22 Aug 2019 14:11:22 -0700
Subject: [PATCH 1681/1835] x86/retpoline: Don't clobber RFLAGS during
 CALL_NOSPEC on i386

commit b63f20a778c88b6a04458ed6ffc69da953d3a109 upstream.

Use 'lea' instead of 'add' when adjusting %rsp in CALL_NOSPEC so as to
avoid clobbering flags.

KVM's emulator makes indirect calls into a jump table of sorts, where
the destination of the CALL_NOSPEC is a small blob of code that performs
fast emulation by executing the target instruction with fixed operands.

  adcb_al_dl:
     0x000339f8 <+0>:   adc    %dl,%al
     0x000339fa <+2>:   ret

A major motiviation for doing fast emulation is to leverage the CPU to
handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is
both an input and output to the target of CALL_NOSPEC.  Clobbering flags
results in all sorts of incorrect emulation, e.g. Jcc instructions often
take the wrong path.  Sans the nops...

  asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n"
     0x0003595a <+58>:  mov    0xc0(%ebx),%eax
     0x00035960 <+64>:  mov    0x60(%ebx),%edx
     0x00035963 <+67>:  mov    0x90(%ebx),%ecx
     0x00035969 <+73>:  push   %edi
     0x0003596a <+74>:  popf
     0x0003596b <+75>:  call   *%esi
     0x000359a0 <+128>: pushf
     0x000359a1 <+129>: pop    %edi
     0x000359a2 <+130>: mov    %eax,0xc0(%ebx)
     0x000359b1 <+145>: mov    %edx,0x60(%ebx)

  ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
     0x000359a8 <+136>: mov    -0x10(%ebp),%eax
     0x000359ab <+139>: and    $0x8d5,%edi
     0x000359b4 <+148>: and    $0xfffff72a,%eax
     0x000359b9 <+153>: or     %eax,%edi
     0x000359bd <+157>: mov    %edi,0x4(%ebx)

For the most part this has gone unnoticed as emulation of guest code
that can trigger fast emulation is effectively limited to MMIO when
running on modern hardware, and MMIO is rarely, if ever, accessed by
instructions that affect or consume flags.

Breakage is almost instantaneous when running with unrestricted guest
disabled, in which case KVM must emulate all instructions when the guest
has invalid state, e.g. when the guest is in Big Real Mode during early
BIOS.

Fixes: 776b043848fd2 ("x86/retpoline: Add initial retpoline support")
Fixes: 1a29b5b7f347a ("KVM: x86: Make indirect calls in emulator speculation safe")
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190822211122.27579-1-sean.j.christopherson@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/nospec-branch.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 599c273f5d006..28cb2b31527a3 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -202,7 +202,7 @@
 	"    	lfence;\n"					\
 	"       jmp    902b;\n"					\
 	"       .align 16\n"					\
-	"903:	addl   $4, %%esp;\n"				\
+	"903:	lea    4(%%esp), %%esp;\n"			\
 	"       pushl  %[thunk_target];\n"			\
 	"       ret;\n"						\
 	"       .align 16\n"					\
-- 
GitLab


From 685e598e447ed062a3a2dd375e83576bf86c506d Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 9 Aug 2019 14:54:07 +0200
Subject: [PATCH 1682/1835] x86/apic: Handle missing global clockevent
 gracefully

commit f897e60a12f0b9146357780d317879bce2a877dc upstream.

Some newer machines do not advertise legacy timers. The kernel can handle
that situation if the TSC and the CPU frequency are enumerated by CPUID or
MSRs and the CPU supports TSC deadline timer. If the CPU does not support
TSC deadline timer the local APIC timer frequency has to be known as well.

Some Ryzens machines do not advertize legacy timers, but there is no
reliable way to determine the bus frequency which feeds the local APIC
timer when the machine allows overclocking of that frequency.

As there is no legacy timer the local APIC timer calibration crashes due to
a NULL pointer dereference when accessing the not installed global clock
event device.

Switch the calibration loop to a non interrupt based one, which polls
either TSC (if frequency is known) or jiffies. The latter requires a global
clockevent. As the machines which do not have a global clockevent installed
have a known TSC frequency this is a non issue. For older machines where
TSC frequency is not known, there is no known case where the legacy timers
do not exist as that would have been reported long ago.

Reported-by: Daniel Drake <drake@endlessm.com>
Reported-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Daniel Drake <drake@endlessm.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908091443030.21433@nanos.tec.linutronix.de
Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1142926#c12
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/apic/apic.c | 68 +++++++++++++++++++++++++++++--------
 1 file changed, 53 insertions(+), 15 deletions(-)

diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 272a12865b2aa..b316bd61a6ace 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -715,7 +715,7 @@ static __initdata unsigned long lapic_cal_pm1, lapic_cal_pm2;
 static __initdata unsigned long lapic_cal_j1, lapic_cal_j2;
 
 /*
- * Temporary interrupt handler.
+ * Temporary interrupt handler and polled calibration function.
  */
 static void __init lapic_cal_handler(struct clock_event_device *dev)
 {
@@ -799,7 +799,8 @@ calibrate_by_pmtimer(long deltapm, long *delta, long *deltatsc)
 static int __init calibrate_APIC_clock(void)
 {
 	struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
-	void (*real_handler)(struct clock_event_device *dev);
+	u64 tsc_perj = 0, tsc_start = 0;
+	unsigned long jif_start;
 	unsigned long deltaj;
 	long delta, deltatsc;
 	int pm_referenced = 0;
@@ -830,28 +831,64 @@ static int __init calibrate_APIC_clock(void)
 	apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n"
 		    "calibrating APIC timer ...\n");
 
+	/*
+	 * There are platforms w/o global clockevent devices. Instead of
+	 * making the calibration conditional on that, use a polling based
+	 * approach everywhere.
+	 */
 	local_irq_disable();
 
-	/* Replace the global interrupt handler */
-	real_handler = global_clock_event->event_handler;
-	global_clock_event->event_handler = lapic_cal_handler;
-
 	/*
 	 * Setup the APIC counter to maximum. There is no way the lapic
 	 * can underflow in the 100ms detection time frame
 	 */
 	__setup_APIC_LVTT(0xffffffff, 0, 0);
 
-	/* Let the interrupts run */
+	/*
+	 * Methods to terminate the calibration loop:
+	 *  1) Global clockevent if available (jiffies)
+	 *  2) TSC if available and frequency is known
+	 */
+	jif_start = READ_ONCE(jiffies);
+
+	if (tsc_khz) {
+		tsc_start = rdtsc();
+		tsc_perj = div_u64((u64)tsc_khz * 1000, HZ);
+	}
+
+	/*
+	 * Enable interrupts so the tick can fire, if a global
+	 * clockevent device is available
+	 */
 	local_irq_enable();
 
-	while (lapic_cal_loops <= LAPIC_CAL_LOOPS)
-		cpu_relax();
+	while (lapic_cal_loops <= LAPIC_CAL_LOOPS) {
+		/* Wait for a tick to elapse */
+		while (1) {
+			if (tsc_khz) {
+				u64 tsc_now = rdtsc();
+				if ((tsc_now - tsc_start) >= tsc_perj) {
+					tsc_start += tsc_perj;
+					break;
+				}
+			} else {
+				unsigned long jif_now = READ_ONCE(jiffies);
 
-	local_irq_disable();
+				if (time_after(jif_now, jif_start)) {
+					jif_start = jif_now;
+					break;
+				}
+			}
+			cpu_relax();
+		}
 
-	/* Restore the real event handler */
-	global_clock_event->event_handler = real_handler;
+		/* Invoke the calibration routine */
+		local_irq_disable();
+		lapic_cal_handler(NULL);
+		local_irq_enable();
+	}
+
+	local_irq_disable();
 
 	/* Build delta t1-t2 as apic timer counts down */
 	delta = lapic_cal_t1 - lapic_cal_t2;
@@ -904,10 +941,11 @@ static int __init calibrate_APIC_clock(void)
 	levt->features &= ~CLOCK_EVT_FEAT_DUMMY;
 
 	/*
-	 * PM timer calibration failed or not turned on
-	 * so lets try APIC timer based calibration
+	 * PM timer calibration failed or not turned on so lets try APIC
+	 * timer based calibration, if a global clockevent device is
+	 * available.
 	 */
-	if (!pm_referenced) {
+	if (!pm_referenced && global_clock_event) {
 		apic_printk(APIC_VERBOSE, "... verify APIC timer\n");
 
 		/*
-- 
GitLab


From e063b03b451a26acdb840f9080871faf3a00b28d Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Mon, 19 Aug 2019 15:52:35 +0000
Subject: [PATCH 1683/1835] x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family
 15h/16h

commit c49a0a80137c7ca7d6ced4c812c9e07a949f6f24 upstream.

There have been reports of RDRAND issues after resuming from suspend on
some AMD family 15h and family 16h systems. This issue stems from a BIOS
not performing the proper steps during resume to ensure RDRAND continues
to function properly.

RDRAND support is indicated by CPUID Fn00000001_ECX[30]. This bit can be
reset by clearing MSR C001_1004[62]. Any software that checks for RDRAND
support using CPUID, including the kernel, will believe that RDRAND is
not supported.

Update the CPU initialization to clear the RDRAND CPUID bit for any family
15h and 16h processor that supports RDRAND. If it is known that the family
15h or family 16h system does not have an RDRAND resume issue or that the
system will not be placed in suspend, the "rdrand=force" kernel parameter
can be used to stop the clearing of the RDRAND CPUID bit.

Additionally, update the suspend and resume path to save and restore the
MSR C001_1004 value to ensure that the RDRAND CPUID setting remains in
place after resuming from suspend.

Note, that clearing the RDRAND CPUID bit does not prevent a processor
that normally supports the RDRAND instruction from executing it. So any
code that determined the support based on family and model won't #UD.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Chen Yu <yu.c.chen@intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: "linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>
Cc: "linux-pm@vger.kernel.org" <linux-pm@vger.kernel.org>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: <stable@vger.kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "x86@kernel.org" <x86@kernel.org>
Link: https://lkml.kernel.org/r/7543af91666f491547bd86cebb1e17c66824ab9f.1566229943.git.thomas.lendacky@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../admin-guide/kernel-parameters.txt         |  7 ++
 arch/x86/include/asm/msr-index.h              |  1 +
 arch/x86/kernel/cpu/amd.c                     | 66 ++++++++++++++
 arch/x86/power/cpu.c                          | 86 ++++++++++++++++---
 4 files changed, 147 insertions(+), 13 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index c96a8e9ad5c2e..e8ddf0ef232e3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3948,6 +3948,13 @@
 			Run specified binary instead of /init from the ramdisk,
 			used for early userspace startup. See initrd.
 
+	rdrand=		[X86]
+			force - Override the decision by the kernel to hide the
+				advertisement of RDRAND support (this affects
+				certain AMD processors because of buggy BIOS
+				support, specifically around the suspend/resume
+				path).
+
 	rdt=		[HW,X86,RDT]
 			Turn on/off individual RDT features. List is:
 			cmt, mbmtotal, mbmlocal, l3cat, l3cdp, l2cat, l2cdp,
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index f85f43db92254..a1d22e4428f63 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -334,6 +334,7 @@
 #define MSR_AMD64_PATCH_LEVEL		0x0000008b
 #define MSR_AMD64_TSC_RATIO		0xc0000104
 #define MSR_AMD64_NB_CFG		0xc001001f
+#define MSR_AMD64_CPUID_FN_1		0xc0011004
 #define MSR_AMD64_PATCH_LOADER		0xc0010020
 #define MSR_AMD64_OSVW_ID_LENGTH	0xc0010140
 #define MSR_AMD64_OSVW_STATUS		0xc0010141
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index da1f5e78363e9..f86f912ce2158 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -799,6 +799,64 @@ static void init_amd_ln(struct cpuinfo_x86 *c)
 	msr_set_bit(MSR_AMD64_DE_CFG, 31);
 }
 
+static bool rdrand_force;
+
+static int __init rdrand_cmdline(char *str)
+{
+	if (!str)
+		return -EINVAL;
+
+	if (!strcmp(str, "force"))
+		rdrand_force = true;
+	else
+		return -EINVAL;
+
+	return 0;
+}
+early_param("rdrand", rdrand_cmdline);
+
+static void clear_rdrand_cpuid_bit(struct cpuinfo_x86 *c)
+{
+	/*
+	 * Saving of the MSR used to hide the RDRAND support during
+	 * suspend/resume is done by arch/x86/power/cpu.c, which is
+	 * dependent on CONFIG_PM_SLEEP.
+	 */
+	if (!IS_ENABLED(CONFIG_PM_SLEEP))
+		return;
+
+	/*
+	 * The nordrand option can clear X86_FEATURE_RDRAND, so check for
+	 * RDRAND support using the CPUID function directly.
+	 */
+	if (!(cpuid_ecx(1) & BIT(30)) || rdrand_force)
+		return;
+
+	msr_clear_bit(MSR_AMD64_CPUID_FN_1, 62);
+
+	/*
+	 * Verify that the CPUID change has occurred in case the kernel is
+	 * running virtualized and the hypervisor doesn't support the MSR.
+	 */
+	if (cpuid_ecx(1) & BIT(30)) {
+		pr_info_once("BIOS may not properly restore RDRAND after suspend, but hypervisor does not support hiding RDRAND via CPUID.\n");
+		return;
+	}
+
+	clear_cpu_cap(c, X86_FEATURE_RDRAND);
+	pr_info_once("BIOS may not properly restore RDRAND after suspend, hiding RDRAND via CPUID. Use rdrand=force to reenable.\n");
+}
+
+static void init_amd_jg(struct cpuinfo_x86 *c)
+{
+	/*
+	 * Some BIOS implementations do not restore proper RDRAND support
+	 * across suspend and resume. Check on whether to hide the RDRAND
+	 * instruction support via CPUID.
+	 */
+	clear_rdrand_cpuid_bit(c);
+}
+
 static void init_amd_bd(struct cpuinfo_x86 *c)
 {
 	u64 value;
@@ -813,6 +871,13 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
 			wrmsrl_safe(MSR_F15H_IC_CFG, value);
 		}
 	}
+
+	/*
+	 * Some BIOS implementations do not restore proper RDRAND support
+	 * across suspend and resume. Check on whether to hide the RDRAND
+	 * instruction support via CPUID.
+	 */
+	clear_rdrand_cpuid_bit(c);
 }
 
 static void init_amd_zn(struct cpuinfo_x86 *c)
@@ -855,6 +920,7 @@ static void init_amd(struct cpuinfo_x86 *c)
 	case 0x10: init_amd_gh(c); break;
 	case 0x12: init_amd_ln(c); break;
 	case 0x15: init_amd_bd(c); break;
+	case 0x16: init_amd_jg(c); break;
 	case 0x17: init_amd_zn(c); break;
 	}
 
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 513ce09e99504..3aa3149df07f9 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -13,6 +13,7 @@
 #include <linux/smp.h>
 #include <linux/perf_event.h>
 #include <linux/tboot.h>
+#include <linux/dmi.h>
 
 #include <asm/pgtable.h>
 #include <asm/proto.h>
@@ -24,7 +25,7 @@
 #include <asm/debugreg.h>
 #include <asm/cpu.h>
 #include <asm/mmu_context.h>
-#include <linux/dmi.h>
+#include <asm/cpu_device_id.h>
 
 #ifdef CONFIG_X86_32
 __visible unsigned long saved_context_ebx;
@@ -398,15 +399,14 @@ static int __init bsp_pm_check_init(void)
 
 core_initcall(bsp_pm_check_init);
 
-static int msr_init_context(const u32 *msr_id, const int total_num)
+static int msr_build_context(const u32 *msr_id, const int num)
 {
-	int i = 0;
+	struct saved_msrs *saved_msrs = &saved_context.saved_msrs;
 	struct saved_msr *msr_array;
+	int total_num;
+	int i, j;
 
-	if (saved_context.saved_msrs.array || saved_context.saved_msrs.num > 0) {
-		pr_err("x86/pm: MSR quirk already applied, please check your DMI match table.\n");
-		return -EINVAL;
-	}
+	total_num = saved_msrs->num + num;
 
 	msr_array = kmalloc_array(total_num, sizeof(struct saved_msr), GFP_KERNEL);
 	if (!msr_array) {
@@ -414,19 +414,30 @@ static int msr_init_context(const u32 *msr_id, const int total_num)
 		return -ENOMEM;
 	}
 
-	for (i = 0; i < total_num; i++) {
-		msr_array[i].info.msr_no	= msr_id[i];
+	if (saved_msrs->array) {
+		/*
+		 * Multiple callbacks can invoke this function, so copy any
+		 * MSR save requests from previous invocations.
+		 */
+		memcpy(msr_array, saved_msrs->array,
+		       sizeof(struct saved_msr) * saved_msrs->num);
+
+		kfree(saved_msrs->array);
+	}
+
+	for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) {
+		msr_array[i].info.msr_no	= msr_id[j];
 		msr_array[i].valid		= false;
 		msr_array[i].info.reg.q		= 0;
 	}
-	saved_context.saved_msrs.num	= total_num;
-	saved_context.saved_msrs.array	= msr_array;
+	saved_msrs->num   = total_num;
+	saved_msrs->array = msr_array;
 
 	return 0;
 }
 
 /*
- * The following section is a quirk framework for problematic BIOSen:
+ * The following sections are a quirk framework for problematic BIOSen:
  * Sometimes MSRs are modified by the BIOSen after suspended to
  * RAM, this might cause unexpected behavior after wakeup.
  * Thus we save/restore these specified MSRs across suspend/resume
@@ -441,7 +452,7 @@ static int msr_initialize_bdw(const struct dmi_system_id *d)
 	u32 bdw_msr_id[] = { MSR_IA32_THERM_CONTROL };
 
 	pr_info("x86/pm: %s detected, MSR saving is needed during suspending.\n", d->ident);
-	return msr_init_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
+	return msr_build_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
 }
 
 static const struct dmi_system_id msr_save_dmi_table[] = {
@@ -456,9 +467,58 @@ static const struct dmi_system_id msr_save_dmi_table[] = {
 	{}
 };
 
+static int msr_save_cpuid_features(const struct x86_cpu_id *c)
+{
+	u32 cpuid_msr_id[] = {
+		MSR_AMD64_CPUID_FN_1,
+	};
+
+	pr_info("x86/pm: family %#hx cpu detected, MSR saving is needed during suspending.\n",
+		c->family);
+
+	return msr_build_context(cpuid_msr_id, ARRAY_SIZE(cpuid_msr_id));
+}
+
+static const struct x86_cpu_id msr_save_cpu_table[] = {
+	{
+		.vendor = X86_VENDOR_AMD,
+		.family = 0x15,
+		.model = X86_MODEL_ANY,
+		.feature = X86_FEATURE_ANY,
+		.driver_data = (kernel_ulong_t)msr_save_cpuid_features,
+	},
+	{
+		.vendor = X86_VENDOR_AMD,
+		.family = 0x16,
+		.model = X86_MODEL_ANY,
+		.feature = X86_FEATURE_ANY,
+		.driver_data = (kernel_ulong_t)msr_save_cpuid_features,
+	},
+	{}
+};
+
+typedef int (*pm_cpu_match_t)(const struct x86_cpu_id *);
+static int pm_cpu_check(const struct x86_cpu_id *c)
+{
+	const struct x86_cpu_id *m;
+	int ret = 0;
+
+	m = x86_match_cpu(msr_save_cpu_table);
+	if (m) {
+		pm_cpu_match_t fn;
+
+		fn = (pm_cpu_match_t)m->driver_data;
+		ret = fn(m);
+	}
+
+	return ret;
+}
+
 static int pm_check_save_msr(void)
 {
 	dmi_check_system(msr_save_dmi_table);
+	pm_cpu_check(msr_save_cpu_table);
+
 	return 0;
 }
 
-- 
GitLab


From d955601166f8e738f6c098d924e2f4147632bf4b Mon Sep 17 00:00:00 2001
From: John Hubbard <jhubbard@nvidia.com>
Date: Tue, 30 Jul 2019 22:46:27 -0700
Subject: [PATCH 1684/1835] x86/boot: Save fields explicitly, zero out
 everything else

commit a90118c445cc7f07781de26a9684d4ec58bfcfd1 upstream.

Recent gcc compilers (gcc 9.1) generate warnings about an out of bounds
memset, if the memset goes accross several fields of a struct. This
generated a couple of warnings on x86_64 builds in sanitize_boot_params().

Fix this by explicitly saving the fields in struct boot_params
that are intended to be preserved, and zeroing all the rest.

[ tglx: Tagged for stable as it breaks the warning free build there as well ]

Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Suggested-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190731054627.5627-2-jhubbard@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/bootparam_utils.h | 60 ++++++++++++++++++++------
 1 file changed, 47 insertions(+), 13 deletions(-)

diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
index a07ffd23e4dd6..18575047d201a 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -18,6 +18,20 @@
  * Note: efi_info is commonly left uninitialized, but that field has a
  * private magic, so it is better to leave it unchanged.
  */
+
+#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); })
+
+#define BOOT_PARAM_PRESERVE(struct_member)				\
+	{								\
+		.start = offsetof(struct boot_params, struct_member),	\
+		.len   = sizeof_mbr(struct boot_params, struct_member),	\
+	}
+
+struct boot_params_to_save {
+	unsigned int start;
+	unsigned int len;
+};
+
 static void sanitize_boot_params(struct boot_params *boot_params)
 {
 	/* 
@@ -36,19 +50,39 @@ static void sanitize_boot_params(struct boot_params *boot_params)
 	 */
 	if (boot_params->sentinel) {
 		/* fields in boot_params are left uninitialized, clear them */
-		memset(&boot_params->ext_ramdisk_image, 0,
-		       (char *)&boot_params->efi_info -
-			(char *)&boot_params->ext_ramdisk_image);
-		memset(&boot_params->kbd_status, 0,
-		       (char *)&boot_params->hdr -
-		       (char *)&boot_params->kbd_status);
-		memset(&boot_params->_pad7[0], 0,
-		       (char *)&boot_params->edd_mbr_sig_buffer[0] -
-			(char *)&boot_params->_pad7[0]);
-		memset(&boot_params->_pad8[0], 0,
-		       (char *)&boot_params->eddbuf[0] -
-			(char *)&boot_params->_pad8[0]);
-		memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9));
+		static struct boot_params scratch;
+		char *bp_base = (char *)boot_params;
+		char *save_base = (char *)&scratch;
+		int i;
+
+		const struct boot_params_to_save to_save[] = {
+			BOOT_PARAM_PRESERVE(screen_info),
+			BOOT_PARAM_PRESERVE(apm_bios_info),
+			BOOT_PARAM_PRESERVE(tboot_addr),
+			BOOT_PARAM_PRESERVE(ist_info),
+			BOOT_PARAM_PRESERVE(hd0_info),
+			BOOT_PARAM_PRESERVE(hd1_info),
+			BOOT_PARAM_PRESERVE(sys_desc_table),
+			BOOT_PARAM_PRESERVE(olpc_ofw_header),
+			BOOT_PARAM_PRESERVE(efi_info),
+			BOOT_PARAM_PRESERVE(alt_mem_k),
+			BOOT_PARAM_PRESERVE(scratch),
+			BOOT_PARAM_PRESERVE(e820_entries),
+			BOOT_PARAM_PRESERVE(eddbuf_entries),
+			BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
+			BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
+			BOOT_PARAM_PRESERVE(e820_table),
+			BOOT_PARAM_PRESERVE(eddbuf),
+		};
+
+		memset(&scratch, 0, sizeof(scratch));
+
+		for (i = 0; i < ARRAY_SIZE(to_save); i++) {
+			memcpy(save_base + to_save[i].start,
+			       bp_base + to_save[i].start, to_save[i].len);
+		}
+
+		memcpy(boot_params, save_base, sizeof(*boot_params));
 	}
 }
 
-- 
GitLab


From f7d157f330018da765995e21244d2e68dff20eec Mon Sep 17 00:00:00 2001
From: John Hubbard <jhubbard@nvidia.com>
Date: Wed, 21 Aug 2019 12:25:13 -0700
Subject: [PATCH 1685/1835] x86/boot: Fix boot regression caused by bootparam
 sanitizing

commit 7846f58fba964af7cb8cf77d4d13c33254725211 upstream.

commit a90118c445cc ("x86/boot: Save fields explicitly, zero out everything
else") had two errors:

    * It preserved boot_params.acpi_rsdp_addr, and
    * It failed to preserve boot_params.hdr

Therefore, zero out acpi_rsdp_addr, and preserve hdr.

Fixes: a90118c445cc ("x86/boot: Save fields explicitly, zero out everything else")
Reported-by: Neil MacLeod <neil@nmacleod.com>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Neil MacLeod <neil@nmacleod.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190821192513.20126-1-jhubbard@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/bootparam_utils.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
index 18575047d201a..d3983fdf10121 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -71,6 +71,7 @@ static void sanitize_boot_params(struct boot_params *boot_params)
 			BOOT_PARAM_PRESERVE(eddbuf_entries),
 			BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
 			BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
+			BOOT_PARAM_PRESERVE(hdr),
 			BOOT_PARAM_PRESERVE(e820_table),
 			BOOT_PARAM_PRESERVE(eddbuf),
 		};
-- 
GitLab


From e0fb8135de9e29f5594bc29cee5b2ce1f52e5b9e Mon Sep 17 00:00:00 2001
From: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Date: Mon, 5 Aug 2019 16:56:03 -0700
Subject: [PATCH 1686/1835] dm kcopyd: always complete failed jobs

commit d1fef41465f0e8cae0693fb184caa6bfafb6cd16 upstream.

This patch fixes a problem in dm-kcopyd that may leave jobs in
complete queue indefinitely in the event of backing storage failure.

This behavior has been observed while running 100% write file fio
workload against an XFS volume created on top of a dm-zoned target
device. If the underlying storage of dm-zoned goes to offline state
under I/O, kcopyd sometimes never issues the end copy callback and
dm-zoned reclaim work hangs indefinitely waiting for that completion.

This behavior was traced down to the error handling code in
process_jobs() function that places the failed job to complete_jobs
queue, but doesn't wake up the job handler. In case of backing device
failure, all outstanding jobs may end up going to complete_jobs queue
via this code path and then stay there forever because there are no
more successful I/O jobs to wake up the job handler.

This patch adds a wake() call to always wake up kcopyd job wait queue
for all I/O jobs that fail before dm_io() gets called for that job.

The patch also sets the write error status in all sub jobs that are
failed because their master job has failed.

Fixes: b73c67c2cbb00 ("dm kcopyd: add sequential write feature")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-kcopyd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
index 671c24332802e..3f694d9061ec5 100644
--- a/drivers/md/dm-kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -548,8 +548,10 @@ static int run_io_job(struct kcopyd_job *job)
 	 * no point in continuing.
 	 */
 	if (test_bit(DM_KCOPYD_WRITE_SEQ, &job->flags) &&
-	    job->master_job->write_err)
+	    job->master_job->write_err) {
+		job->write_err = job->master_job->write_err;
 		return -EIO;
+	}
 
 	io_job_start(job->kc->throttle);
 
@@ -601,6 +603,7 @@ static int process_jobs(struct list_head *jobs, struct dm_kcopyd_client *kc,
 			else
 				job->read_err = 1;
 			push(&kc->complete_jobs, job);
+			wake(kc);
 			break;
 		}
 
-- 
GitLab


From 8114012de6c111188306ca8e0b3ae2510cf51f8c Mon Sep 17 00:00:00 2001
From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Date: Sat, 17 Aug 2019 13:32:40 +0800
Subject: [PATCH 1687/1835] dm btree: fix order of block initialization in
 btree_split_beneath

commit e4f9d6013820d1eba1432d51dd1c5795759aa77f upstream.

When btree_split_beneath() splits a node to two new children, it will
allocate two blocks: left and right.  If right block's allocation
failed, the left block will be unlocked and marked dirty.  If this
happened, the left block'ss content is zero, because it wasn't
initialized with the btree struct before the attempot to allocate the
right block.  Upon return, when flushing the left block to disk, the
validator will fail when check this block.  Then a BUG_ON is raised.

Fix this by completely initializing the left block before allocating and
initializing the right block.

Fixes: 4dcb8b57df359 ("dm btree: fix leak of bufio-backed block in btree_split_beneath error path")
Cc: stable@vger.kernel.org
Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/persistent-data/dm-btree.c | 31 ++++++++++++++-------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 58b319757b1e5..8aae0624a2971 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -628,39 +628,40 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
 
 	new_parent = shadow_current(s);
 
+	pn = dm_block_data(new_parent);
+	size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
+		sizeof(__le64) : s->info->value_type.size;
+
+	/* create & init the left block */
 	r = new_block(s->info, &left);
 	if (r < 0)
 		return r;
 
+	ln = dm_block_data(left);
+	nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
+
+	ln->header.flags = pn->header.flags;
+	ln->header.nr_entries = cpu_to_le32(nr_left);
+	ln->header.max_entries = pn->header.max_entries;
+	ln->header.value_size = pn->header.value_size;
+	memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
+	memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
+
+	/* create & init the right block */
 	r = new_block(s->info, &right);
 	if (r < 0) {
 		unlock_block(s->info, left);
 		return r;
 	}
 
-	pn = dm_block_data(new_parent);
-	ln = dm_block_data(left);
 	rn = dm_block_data(right);
-
-	nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
 	nr_right = le32_to_cpu(pn->header.nr_entries) - nr_left;
 
-	ln->header.flags = pn->header.flags;
-	ln->header.nr_entries = cpu_to_le32(nr_left);
-	ln->header.max_entries = pn->header.max_entries;
-	ln->header.value_size = pn->header.value_size;
-
 	rn->header.flags = pn->header.flags;
 	rn->header.nr_entries = cpu_to_le32(nr_right);
 	rn->header.max_entries = pn->header.max_entries;
 	rn->header.value_size = pn->header.value_size;
-
-	memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
 	memcpy(rn->keys, pn->keys + nr_left, nr_right * sizeof(pn->keys[0]));
-
-	size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
-		sizeof(__le64) : s->info->value_type.size;
-	memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
 	memcpy(value_ptr(rn, 0), value_ptr(pn, nr_left),
 	       nr_right * size);
 
-- 
GitLab


From 795b0572729bc828710f8783feb432678da87ccb Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Sat, 10 Aug 2019 12:30:27 -0400
Subject: [PATCH 1688/1835] dm integrity: fix a crash due to BUG_ON in
 __journal_read_write()

commit 5729b6e5a1bcb0bbc28abe82d749c7392f66d2c7 upstream.

Fix a crash that was introduced by the commit 724376a04d1a. The crash is
reported here: https://gitlab.com/cryptsetup/cryptsetup/issues/468

When reading from the integrity device, the function
dm_integrity_map_continue calls find_journal_node to find out if the
location to read is present in the journal. Then, it calculates how many
sectors are consecutively stored in the journal. Then, it locks the range
with add_new_range and wait_and_add_new_range.

The problem is that during wait_and_add_new_range, we hold no locks (we
don't hold ic->endio_wait.lock and we don't hold a range lock), so the
journal may change arbitrarily while wait_and_add_new_range sleeps.

The code then goes to __journal_read_write and hits
BUG_ON(journal_entry_get_sector(je) != logical_sector); because the
journal has changed.

In order to fix this bug, we need to re-check the journal location after
wait_and_add_new_range. We restrict the length to one block in order to
not complicate the code too much.

Fixes: 724376a04d1a ("dm integrity: implement fair range locks")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-integrity.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index dbdcc543832df..2e22d588f0563 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -1749,7 +1749,22 @@ offload_to_thread:
 			queue_work(ic->wait_wq, &dio->work);
 			return;
 		}
+		if (journal_read_pos != NOT_FOUND)
+			dio->range.n_sectors = ic->sectors_per_block;
 		wait_and_add_new_range(ic, &dio->range);
+		/*
+		 * wait_and_add_new_range drops the spinlock, so the journal
+		 * may have been changed arbitrarily. We need to recheck.
+		 * To simplify the code, we restrict I/O size to just one block.
+		 */
+		if (journal_read_pos != NOT_FOUND) {
+			sector_t next_sector;
+			unsigned new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
+			if (unlikely(new_pos != journal_read_pos)) {
+				remove_range_unlocked(ic, &dio->range);
+				goto retry;
+			}
+		}
 	}
 	spin_unlock_irq(&ic->endio_wait.lock);
 
-- 
GitLab


From 2cff6c87a0dcb83b886b07e32e69f840e5b84cfd Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Sun, 18 Aug 2019 19:18:34 -0500
Subject: [PATCH 1689/1835] dm raid: add missing cleanup in raid_ctr()

commit dc1a3e8e0cc6b2293b48c044710e63395aeb4fb4 upstream.

If rs_prepare_reshape() fails, no cleanup is executed, leading to
leak of the raid_set structure allocated at the beginning of
raid_ctr(). To fix this issue, go to the label 'bad' if the error
occurs.

Fixes: 11e4723206683 ("dm raid: stop keeping raid set frozen altogether")
Cc: stable@vger.kernel.org
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-raid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index c44925e4e4813..b78a8a4d061ca 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3199,7 +3199,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 			  */
 			r = rs_prepare_reshape(rs);
 			if (r)
-				return r;
+				goto bad;
 
 			/* Reshaping ain't recovery, so disable recovery */
 			rs_setup_recovery(rs, MaxSector);
-- 
GitLab


From 53e73d1079d7550f607db3d946e863b28573cc52 Mon Sep 17 00:00:00 2001
From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Date: Mon, 19 Aug 2019 11:31:21 +0800
Subject: [PATCH 1690/1835] dm space map metadata: fix missing store of
 apply_bops() return value

commit ae148243d3f0816b37477106c05a2ec7d5f32614 upstream.

In commit 6096d91af0b6 ("dm space map metadata: fix occasional leak
of a metadata block on resize"), we refactor the commit logic to a new
function 'apply_bops'.  But when that logic was replaced in out() the
return value was not stored.  This may lead out() returning a wrong
value to the caller.

Fixes: 6096d91af0b6 ("dm space map metadata: fix occasional leak of a metadata block on resize")
Cc: stable@vger.kernel.org
Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/persistent-data/dm-space-map-metadata.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index aec4492439662..25328582cc482 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -249,7 +249,7 @@ static int out(struct sm_metadata *smm)
 	}
 
 	if (smm->recursion_count == 1)
-		apply_bops(smm);
+		r = apply_bops(smm);
 
 	smm->recursion_count--;
 
-- 
GitLab


From ded8e524cfa6deb20e499ffcc51079ae3787d30a Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Fri, 23 Aug 2019 09:54:09 -0400
Subject: [PATCH 1691/1835] dm table: fix invalid memory accesses with too high
 sector number

commit 1cfd5d3399e87167b7f9157ef99daa0e959f395d upstream.

If the sector number is too high, dm_table_find_target() should return a
pointer to a zeroed dm_target structure (the caller should test it with
dm_target_is_valid).

However, for some table sizes, the code in dm_table_find_target() that
performs btree lookup will access out of bound memory structures.

Fix this bug by testing the sector number at the beginning of
dm_table_find_target(). Also, add an "inline" keyword to the function
dm_table_get_size() because this is a hot path.

Fixes: 512875bd9661 ("dm: table detect io beyond device")
Cc: stable@vger.kernel.org
Reported-by: Zhang Tao <kontais@zoho.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-table.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 34ab30dd5de93..36275c59e4e7b 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1349,7 +1349,7 @@ void dm_table_event(struct dm_table *t)
 }
 EXPORT_SYMBOL(dm_table_event);
 
-sector_t dm_table_get_size(struct dm_table *t)
+inline sector_t dm_table_get_size(struct dm_table *t)
 {
 	return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
 }
@@ -1374,6 +1374,9 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
 	unsigned int l, n = 0, k = 0;
 	sector_t *node;
 
+	if (unlikely(sector >= dm_table_get_size(t)))
+		return &t->targets[t->num_targets];
+
 	for (l = 0; l < t->depth; l++) {
 		n = get_child(n, k);
 		node = get_node(t, l, n);
-- 
GitLab


From 8b7c17bb2753aacbe7a1ca220865f2b8954c5e65 Mon Sep 17 00:00:00 2001
From: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Date: Sat, 10 Aug 2019 14:43:09 -0700
Subject: [PATCH 1692/1835] dm zoned: improve error handling in reclaim

commit b234c6d7a703661b5045c5bf569b7c99d2edbf88 upstream.

There are several places in reclaim code where errors are not
propagated to the main function, dmz_reclaim(). This function
is responsible for unlocking zones that might be still locked
at the end of any failed reclaim iterations. As the result,
some device zones may be left permanently locked for reclaim,
degrading target's capability to reclaim zones.

This patch fixes these issues as follows -

Make sure that dmz_reclaim_buf(), dmz_reclaim_seq_data() and
dmz_reclaim_rnd_data() return error codes to the caller.

dmz_reclaim() function is renamed to dmz_do_reclaim() to avoid
clashing with "struct dmz_reclaim" and is modified to return the
error to the caller.

dmz_get_zone_for_reclaim() now returns an error instead of NULL
pointer and reclaim code checks for that error.

Error logging/debug messages are added where necessary.

Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-zoned-metadata.c |  4 ++--
 drivers/md/dm-zoned-reclaim.c  | 28 +++++++++++++++++++---------
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index 4cdde7a02e94a..1b8df136b7f69 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1534,7 +1534,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
 	struct dm_zone *zone;
 
 	if (list_empty(&zmd->map_rnd_list))
-		return NULL;
+		return ERR_PTR(-EBUSY);
 
 	list_for_each_entry(zone, &zmd->map_rnd_list, link) {
 		if (dmz_is_buf(zone))
@@ -1545,7 +1545,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
 			return dzone;
 	}
 
-	return NULL;
+	return ERR_PTR(-EBUSY);
 }
 
 /*
diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
index edf4b95eb0750..e381354dc1368 100644
--- a/drivers/md/dm-zoned-reclaim.c
+++ b/drivers/md/dm-zoned-reclaim.c
@@ -215,7 +215,7 @@ static int dmz_reclaim_buf(struct dmz_reclaim *zrc, struct dm_zone *dzone)
 
 	dmz_unlock_flush(zmd);
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -259,7 +259,7 @@ static int dmz_reclaim_seq_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
 
 	dmz_unlock_flush(zmd);
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -312,7 +312,7 @@ static int dmz_reclaim_rnd_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
 
 	dmz_unlock_flush(zmd);
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -334,7 +334,7 @@ static void dmz_reclaim_empty(struct dmz_reclaim *zrc, struct dm_zone *dzone)
 /*
  * Find a candidate zone for reclaim and process it.
  */
-static void dmz_reclaim(struct dmz_reclaim *zrc)
+static int dmz_do_reclaim(struct dmz_reclaim *zrc)
 {
 	struct dmz_metadata *zmd = zrc->metadata;
 	struct dm_zone *dzone;
@@ -344,8 +344,8 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
 
 	/* Get a data zone */
 	dzone = dmz_get_zone_for_reclaim(zmd);
-	if (!dzone)
-		return;
+	if (IS_ERR(dzone))
+		return PTR_ERR(dzone);
 
 	start = jiffies;
 
@@ -391,13 +391,20 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
 out:
 	if (ret) {
 		dmz_unlock_zone_reclaim(dzone);
-		return;
+		return ret;
 	}
 
-	(void) dmz_flush_metadata(zrc->metadata);
+	ret = dmz_flush_metadata(zrc->metadata);
+	if (ret) {
+		dmz_dev_debug(zrc->dev,
+			      "Metadata flush for zone %u failed, err %d\n",
+			      dmz_id(zmd, rzone), ret);
+		return ret;
+	}
 
 	dmz_dev_debug(zrc->dev, "Reclaimed zone %u in %u ms",
 		      dmz_id(zmd, rzone), jiffies_to_msecs(jiffies - start));
+	return 0;
 }
 
 /*
@@ -442,6 +449,7 @@ static void dmz_reclaim_work(struct work_struct *work)
 	struct dmz_metadata *zmd = zrc->metadata;
 	unsigned int nr_rnd, nr_unmap_rnd;
 	unsigned int p_unmap_rnd;
+	int ret;
 
 	if (!dmz_should_reclaim(zrc)) {
 		mod_delayed_work(zrc->wq, &zrc->work, DMZ_IDLE_PERIOD);
@@ -471,7 +479,9 @@ static void dmz_reclaim_work(struct work_struct *work)
 		      (dmz_target_idle(zrc) ? "Idle" : "Busy"),
 		      p_unmap_rnd, nr_unmap_rnd, nr_rnd);
 
-	dmz_reclaim(zrc);
+	ret = dmz_do_reclaim(zrc);
+	if (ret)
+		dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret);
 
 	dmz_schedule_reclaim(zrc);
 }
-- 
GitLab


From 4530f2f1a79ab2ff096eb0122655a6a0a51d4c37 Mon Sep 17 00:00:00 2001
From: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Date: Sat, 10 Aug 2019 14:43:10 -0700
Subject: [PATCH 1693/1835] dm zoned: improve error handling in i/o map code

commit d7428c50118e739e672656c28d2b26b09375d4e0 upstream.

Some errors are ignored in the I/O path during queueing chunks
for processing by chunk works. Since at least these errors are
transient in nature, it should be possible to retry the failed
incoming commands.

The fix -

Errors that can happen while queueing chunks are carried upwards
to the main mapping function and it now returns DM_MAPIO_REQUEUE
for any incoming requests that can not be properly queued.

Error logging/debug messages are added where needed.

Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-zoned-target.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 85fb2baa8a7fa..91beacfc966fe 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -513,22 +513,24 @@ static void dmz_flush_work(struct work_struct *work)
  * Get a chunk work and start it to process a new BIO.
  * If the BIO chunk has no work yet, create one.
  */
-static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+static int dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
 {
 	unsigned int chunk = dmz_bio_chunk(dmz->dev, bio);
 	struct dm_chunk_work *cw;
+	int ret = 0;
 
 	mutex_lock(&dmz->chunk_lock);
 
 	/* Get the BIO chunk work. If one is not active yet, create one */
 	cw = radix_tree_lookup(&dmz->chunk_rxtree, chunk);
 	if (!cw) {
-		int ret;
 
 		/* Create a new chunk work */
 		cw = kmalloc(sizeof(struct dm_chunk_work), GFP_NOIO);
-		if (!cw)
+		if (unlikely(!cw)) {
+			ret = -ENOMEM;
 			goto out;
+		}
 
 		INIT_WORK(&cw->work, dmz_chunk_work);
 		atomic_set(&cw->refcount, 0);
@@ -539,7 +541,6 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
 		ret = radix_tree_insert(&dmz->chunk_rxtree, chunk, cw);
 		if (unlikely(ret)) {
 			kfree(cw);
-			cw = NULL;
 			goto out;
 		}
 	}
@@ -547,10 +548,12 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
 	bio_list_add(&cw->bio_list, bio);
 	dmz_get_chunk_work(cw);
 
+	dmz_reclaim_bio_acc(dmz->reclaim);
 	if (queue_work(dmz->chunk_wq, &cw->work))
 		dmz_get_chunk_work(cw);
 out:
 	mutex_unlock(&dmz->chunk_lock);
+	return ret;
 }
 
 /*
@@ -564,6 +567,7 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
 	sector_t sector = bio->bi_iter.bi_sector;
 	unsigned int nr_sectors = bio_sectors(bio);
 	sector_t chunk_sector;
+	int ret;
 
 	dmz_dev_debug(dev, "BIO op %d sector %llu + %u => chunk %llu, block %llu, %u blocks",
 		      bio_op(bio), (unsigned long long)sector, nr_sectors,
@@ -601,8 +605,14 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
 		dm_accept_partial_bio(bio, dev->zone_nr_sectors - chunk_sector);
 
 	/* Now ready to handle this BIO */
-	dmz_reclaim_bio_acc(dmz->reclaim);
-	dmz_queue_chunk_work(dmz, bio);
+	ret = dmz_queue_chunk_work(dmz, bio);
+	if (ret) {
+		dmz_dev_debug(dmz->dev,
+			      "BIO op %d, can't process chunk %llu, err %i\n",
+			      bio_op(bio), (u64)dmz_bio_chunk(dmz->dev, bio),
+			      ret);
+		return DM_MAPIO_REQUEUE;
+	}
 
 	return DM_MAPIO_SUBMITTED;
 }
-- 
GitLab


From c14fe4e8fd011c702c8867c8dc685d396fb5f538 Mon Sep 17 00:00:00 2001
From: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Date: Sat, 10 Aug 2019 14:43:11 -0700
Subject: [PATCH 1694/1835] dm zoned: properly handle backing device failure

commit 75d66ffb48efb30f2dd42f041ba8b39c5b2bd115 upstream.

dm-zoned is observed to lock up or livelock in case of hardware
failure or some misconfiguration of the backing zoned device.

This patch adds a new dm-zoned target function that checks the status of
the backing device. If the request queue of the backing device is found
to be in dying state or the SCSI backing device enters offline state,
the health check code sets a dm-zoned target flag prompting all further
incoming I/O to be rejected. In order to detect backing device failures
timely, this new function is called in the request mapping path, at the
beginning of every reclaim run and before performing any metadata I/O.

The proper way out of this situation is to do

dmsetup remove <dm-zoned target>

and recreate the target when the problem with the backing device
is resolved.

Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-zoned-metadata.c | 51 +++++++++++++++++++++++++++-------
 drivers/md/dm-zoned-reclaim.c  | 18 ++++++++++--
 drivers/md/dm-zoned-target.c   | 45 ++++++++++++++++++++++++++++--
 drivers/md/dm-zoned.h          | 10 +++++++
 4 files changed, 110 insertions(+), 14 deletions(-)

diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index 1b8df136b7f69..00e7a343eacf1 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -401,15 +401,18 @@ static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
 	sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
 	struct bio *bio;
 
+	if (dmz_bdev_is_dying(zmd->dev))
+		return ERR_PTR(-EIO);
+
 	/* Get a new block and a BIO to read it */
 	mblk = dmz_alloc_mblock(zmd, mblk_no);
 	if (!mblk)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	bio = bio_alloc(GFP_NOIO, 1);
 	if (!bio) {
 		dmz_free_mblock(zmd, mblk);
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 	}
 
 	spin_lock(&zmd->mblk_lock);
@@ -540,8 +543,8 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
 	if (!mblk) {
 		/* Cache miss: read the block from disk */
 		mblk = dmz_get_mblock_slow(zmd, mblk_no);
-		if (!mblk)
-			return ERR_PTR(-ENOMEM);
+		if (IS_ERR(mblk))
+			return mblk;
 	}
 
 	/* Wait for on-going read I/O and check for error */
@@ -569,16 +572,19 @@ static void dmz_dirty_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
 /*
  * Issue a metadata block write BIO.
  */
-static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
-			     unsigned int set)
+static int dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
+			    unsigned int set)
 {
 	sector_t block = zmd->sb[set].block + mblk->no;
 	struct bio *bio;
 
+	if (dmz_bdev_is_dying(zmd->dev))
+		return -EIO;
+
 	bio = bio_alloc(GFP_NOIO, 1);
 	if (!bio) {
 		set_bit(DMZ_META_ERROR, &mblk->state);
-		return;
+		return -ENOMEM;
 	}
 
 	set_bit(DMZ_META_WRITING, &mblk->state);
@@ -590,6 +596,8 @@ static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
 	bio_set_op_attrs(bio, REQ_OP_WRITE, REQ_META | REQ_PRIO);
 	bio_add_page(bio, mblk->page, DMZ_BLOCK_SIZE, 0);
 	submit_bio(bio);
+
+	return 0;
 }
 
 /*
@@ -601,6 +609,9 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block,
 	struct bio *bio;
 	int ret;
 
+	if (dmz_bdev_is_dying(zmd->dev))
+		return -EIO;
+
 	bio = bio_alloc(GFP_NOIO, 1);
 	if (!bio)
 		return -ENOMEM;
@@ -658,22 +669,29 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd,
 {
 	struct dmz_mblock *mblk;
 	struct blk_plug plug;
-	int ret = 0;
+	int ret = 0, nr_mblks_submitted = 0;
 
 	/* Issue writes */
 	blk_start_plug(&plug);
-	list_for_each_entry(mblk, write_list, link)
-		dmz_write_mblock(zmd, mblk, set);
+	list_for_each_entry(mblk, write_list, link) {
+		ret = dmz_write_mblock(zmd, mblk, set);
+		if (ret)
+			break;
+		nr_mblks_submitted++;
+	}
 	blk_finish_plug(&plug);
 
 	/* Wait for completion */
 	list_for_each_entry(mblk, write_list, link) {
+		if (!nr_mblks_submitted)
+			break;
 		wait_on_bit_io(&mblk->state, DMZ_META_WRITING,
 			       TASK_UNINTERRUPTIBLE);
 		if (test_bit(DMZ_META_ERROR, &mblk->state)) {
 			clear_bit(DMZ_META_ERROR, &mblk->state);
 			ret = -EIO;
 		}
+		nr_mblks_submitted--;
 	}
 
 	/* Flush drive cache (this will also sync data) */
@@ -735,6 +753,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
 	 */
 	dmz_lock_flush(zmd);
 
+	if (dmz_bdev_is_dying(zmd->dev)) {
+		ret = -EIO;
+		goto out;
+	}
+
 	/* Get dirty blocks */
 	spin_lock(&zmd->mblk_lock);
 	list_splice_init(&zmd->mblk_dirty_list, &write_list);
@@ -1623,6 +1646,10 @@ again:
 		/* Alloate a random zone */
 		dzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
 		if (!dzone) {
+			if (dmz_bdev_is_dying(zmd->dev)) {
+				dzone = ERR_PTR(-EIO);
+				goto out;
+			}
 			dmz_wait_for_free_zones(zmd);
 			goto again;
 		}
@@ -1720,6 +1747,10 @@ again:
 	/* Alloate a random zone */
 	bzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
 	if (!bzone) {
+		if (dmz_bdev_is_dying(zmd->dev)) {
+			bzone = ERR_PTR(-EIO);
+			goto out;
+		}
 		dmz_wait_for_free_zones(zmd);
 		goto again;
 	}
diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
index e381354dc1368..9470b8f77a337 100644
--- a/drivers/md/dm-zoned-reclaim.c
+++ b/drivers/md/dm-zoned-reclaim.c
@@ -37,7 +37,7 @@ enum {
 /*
  * Number of seconds of target BIO inactivity to consider the target idle.
  */
-#define DMZ_IDLE_PERIOD		(10UL * HZ)
+#define DMZ_IDLE_PERIOD			(10UL * HZ)
 
 /*
  * Percentage of unmapped (free) random zones below which reclaim starts
@@ -134,6 +134,9 @@ static int dmz_reclaim_copy(struct dmz_reclaim *zrc,
 		set_bit(DM_KCOPYD_WRITE_SEQ, &flags);
 
 	while (block < end_block) {
+		if (dev->flags & DMZ_BDEV_DYING)
+			return -EIO;
+
 		/* Get a valid region from the source zone */
 		ret = dmz_first_valid_block(zmd, src_zone, &block);
 		if (ret <= 0)
@@ -451,6 +454,9 @@ static void dmz_reclaim_work(struct work_struct *work)
 	unsigned int p_unmap_rnd;
 	int ret;
 
+	if (dmz_bdev_is_dying(zrc->dev))
+		return;
+
 	if (!dmz_should_reclaim(zrc)) {
 		mod_delayed_work(zrc->wq, &zrc->work, DMZ_IDLE_PERIOD);
 		return;
@@ -480,8 +486,16 @@ static void dmz_reclaim_work(struct work_struct *work)
 		      p_unmap_rnd, nr_unmap_rnd, nr_rnd);
 
 	ret = dmz_do_reclaim(zrc);
-	if (ret)
+	if (ret) {
 		dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret);
+		if (ret == -EIO)
+			/*
+			 * LLD might be performing some error handling sequence
+			 * at the underlying device. To not interfere, do not
+			 * attempt to schedule the next reclaim run immediately.
+			 */
+			return;
+	}
 
 	dmz_schedule_reclaim(zrc);
 }
diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 91beacfc966fe..1030c42add05f 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -133,6 +133,8 @@ static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
 
 	atomic_inc(&bioctx->ref);
 	generic_make_request(clone);
+	if (clone->bi_status == BLK_STS_IOERR)
+		return -EIO;
 
 	if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
 		zone->wp_block += nr_blocks;
@@ -277,8 +279,8 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
 
 	/* Get the buffer zone. One will be allocated if needed */
 	bzone = dmz_get_chunk_buffer(zmd, zone);
-	if (!bzone)
-		return -ENOSPC;
+	if (IS_ERR(bzone))
+		return PTR_ERR(bzone);
 
 	if (dmz_is_readonly(bzone))
 		return -EROFS;
@@ -389,6 +391,11 @@ static void dmz_handle_bio(struct dmz_target *dmz, struct dm_chunk_work *cw,
 
 	dmz_lock_metadata(zmd);
 
+	if (dmz->dev->flags & DMZ_BDEV_DYING) {
+		ret = -EIO;
+		goto out;
+	}
+
 	/*
 	 * Get the data zone mapping the chunk. There may be no
 	 * mapping for read and discard. If a mapping is obtained,
@@ -493,6 +500,8 @@ static void dmz_flush_work(struct work_struct *work)
 
 	/* Flush dirty metadata blocks */
 	ret = dmz_flush_metadata(dmz->metadata);
+	if (ret)
+		dmz_dev_debug(dmz->dev, "Metadata flush failed, rc=%d\n", ret);
 
 	/* Process queued flush requests */
 	while (1) {
@@ -556,6 +565,32 @@ out:
 	return ret;
 }
 
+/*
+ * Check the backing device availability. If it's on the way out,
+ * start failing I/O. Reclaim and metadata components also call this
+ * function to cleanly abort operation in the event of such failure.
+ */
+bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev)
+{
+	struct gendisk *disk;
+
+	if (!(dmz_dev->flags & DMZ_BDEV_DYING)) {
+		disk = dmz_dev->bdev->bd_disk;
+		if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) {
+			dmz_dev_warn(dmz_dev, "Backing device queue dying");
+			dmz_dev->flags |= DMZ_BDEV_DYING;
+		} else if (disk->fops->check_events) {
+			if (disk->fops->check_events(disk, 0) &
+					DISK_EVENT_MEDIA_CHANGE) {
+				dmz_dev_warn(dmz_dev, "Backing device offline");
+				dmz_dev->flags |= DMZ_BDEV_DYING;
+			}
+		}
+	}
+
+	return dmz_dev->flags & DMZ_BDEV_DYING;
+}
+
 /*
  * Process a new BIO.
  */
@@ -569,6 +604,9 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
 	sector_t chunk_sector;
 	int ret;
 
+	if (dmz_bdev_is_dying(dmz->dev))
+		return DM_MAPIO_KILL;
+
 	dmz_dev_debug(dev, "BIO op %d sector %llu + %u => chunk %llu, block %llu, %u blocks",
 		      bio_op(bio), (unsigned long long)sector, nr_sectors,
 		      (unsigned long long)dmz_bio_chunk(dmz->dev, bio),
@@ -866,6 +904,9 @@ static int dmz_prepare_ioctl(struct dm_target *ti, struct block_device **bdev)
 {
 	struct dmz_target *dmz = ti->private;
 
+	if (dmz_bdev_is_dying(dmz->dev))
+		return -ENODEV;
+
 	*bdev = dmz->dev->bdev;
 
 	return 0;
diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
index ed8de49c9a082..93a64529f2190 100644
--- a/drivers/md/dm-zoned.h
+++ b/drivers/md/dm-zoned.h
@@ -56,6 +56,8 @@ struct dmz_dev {
 
 	unsigned int		nr_zones;
 
+	unsigned int		flags;
+
 	sector_t		zone_nr_sectors;
 	unsigned int		zone_nr_sectors_shift;
 
@@ -67,6 +69,9 @@ struct dmz_dev {
 				 (dev)->zone_nr_sectors_shift)
 #define dmz_chunk_block(dev, b)	((b) & ((dev)->zone_nr_blocks - 1))
 
+/* Device flags. */
+#define DMZ_BDEV_DYING		(1 << 0)
+
 /*
  * Zone descriptor.
  */
@@ -245,4 +250,9 @@ void dmz_resume_reclaim(struct dmz_reclaim *zrc);
 void dmz_reclaim_bio_acc(struct dmz_reclaim *zrc);
 void dmz_schedule_reclaim(struct dmz_reclaim *zrc);
 
+/*
+ * Functions defined in dm-zoned-target.c
+ */
+bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev);
+
 #endif /* DM_ZONED_H */
-- 
GitLab


From 42731deff2ea9629ff655549f5c3cd3908887f8e Mon Sep 17 00:00:00 2001
From: Michael Kelley <mikelley@microsoft.com>
Date: Thu, 1 Aug 2019 23:53:53 +0000
Subject: [PATCH 1695/1835] genirq: Properly pair kobject_del() with
 kobject_add()

commit d0ff14fdc987303aeeb7de6f1bd72c3749ae2a9b upstream.

If alloc_descs() fails before irq_sysfs_init() has run, free_desc() in the
cleanup path will call kobject_del() even though the kobject has not been
added with kobject_add().

Fix this by making the call to kobject_del() conditional on whether
irq_sysfs_init() has run.

This problem surfaced because commit aa30f47cf666 ("kobject: Add support
for default attribute groups to kobj_type") makes kobject_del() stricter
about pairing with kobject_add(). If the pairing is incorrrect, a WARNING
and backtrace occur in sysfs_remove_group() because there is no parent.

[ tglx: Add a comment to the code and make it work with CONFIG_SYSFS=n ]

Fixes: ecb3f394c5db ("genirq: Expose interrupt information through sysfs")
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1564703564-4116-1-git-send-email-mikelley@microsoft.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/irqdesc.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 8e009cee65174..26814a14013cb 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -294,6 +294,18 @@ static void irq_sysfs_add(int irq, struct irq_desc *desc)
 	}
 }
 
+static void irq_sysfs_del(struct irq_desc *desc)
+{
+	/*
+	 * If irq_sysfs_init() has not yet been invoked (early boot), then
+	 * irq_kobj_base is NULL and the descriptor was never added.
+	 * kobject_del() complains about a object with no parent, so make
+	 * it conditional.
+	 */
+	if (irq_kobj_base)
+		kobject_del(&desc->kobj);
+}
+
 static int __init irq_sysfs_init(void)
 {
 	struct irq_desc *desc;
@@ -324,6 +336,7 @@ static struct kobj_type irq_kobj_type = {
 };
 
 static void irq_sysfs_add(int irq, struct irq_desc *desc) {}
+static void irq_sysfs_del(struct irq_desc *desc) {}
 
 #endif /* CONFIG_SYSFS */
 
@@ -437,7 +450,7 @@ static void free_desc(unsigned int irq)
 	 * The sysfs entry must be serialized against a concurrent
 	 * irq_sysfs_init() as well.
 	 */
-	kobject_del(&desc->kobj);
+	irq_sysfs_del(desc);
 	delete_irq_desc(irq);
 
 	/*
-- 
GitLab


From db67ac0316550a4f1b79a931750609be1f206b6c Mon Sep 17 00:00:00 2001
From: Vlastimil Babka <vbabka@suse.cz>
Date: Sat, 24 Aug 2019 17:54:59 -0700
Subject: [PATCH 1696/1835] mm, page_owner: handle THP splits correctly

commit f7da677bc6e72033f0981b9d58b5c5d409fa641e upstream.

THP splitting path is missing the split_page_owner() call that
split_page() has.

As a result, split THP pages are wrongly reported in the page_owner file
as order-9 pages.  Furthermore when the former head page is freed, the
remaining former tail pages are not listed in the page_owner file at
all.  This patch fixes that by adding the split_page_owner() call into
__split_huge_page().

Link: http://lkml.kernel.org/r/20190820131828.22684-2-vbabka@suse.cz
Fixes: a9627bc5e34e ("mm/page_owner: introduce split_page_owner and replace manual handling")
Reported-by: Kirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/huge_memory.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 6fad1864ba03b..09ce8528bbdd9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -33,6 +33,7 @@
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
 #include <linux/oom.h>
+#include <linux/page_owner.h>
 
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -2477,6 +2478,9 @@ static void __split_huge_page(struct page *page, struct list_head *list,
 	}
 
 	ClearPageCompound(head);
+
+	split_page_owner(head, HPAGE_PMD_ORDER);
+
 	/* See comment in __split_huge_page_tail() */
 	if (PageAnon(head)) {
 		/* Additional pin to radix tree of swap cache */
-- 
GitLab


From b30a2f608e942321efb6b26e5a152555e6bb68c4 Mon Sep 17 00:00:00 2001
From: Henry Burns <henryburns@google.com>
Date: Sat, 24 Aug 2019 17:55:03 -0700
Subject: [PATCH 1697/1835] mm/zsmalloc.c: migration can leave pages in
 ZS_EMPTY indefinitely

commit 1a87aa03597efa9641e92875b883c94c7f872ccb upstream.

In zs_page_migrate() we call putback_zspage() after we have finished
migrating all pages in this zspage.  However, the return value is
ignored.  If a zs_free() races in between zs_page_isolate() and
zs_page_migrate(), freeing the last object in the zspage,
putback_zspage() will leave the page in ZS_EMPTY for potentially an
unbounded amount of time.

To fix this, we need to do the same thing as zs_page_putback() does:
schedule free_work to occur.

To avoid duplicated code, move the sequence to a new
putback_zspage_deferred() function which both zs_page_migrate() and
zs_page_putback() call.

Link: http://lkml.kernel.org/r/20190809181751.219326-1-henryburns@google.com
Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
Signed-off-by: Henry Burns <henryburns@google.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Henry Burns <henrywolfeburns@gmail.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Jonathan Adams <jwadams@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/zsmalloc.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 9da65552e7ca7..69d2063bb112c 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1882,6 +1882,18 @@ static void dec_zspage_isolation(struct zspage *zspage)
 	zspage->isolated--;
 }
 
+static void putback_zspage_deferred(struct zs_pool *pool,
+				    struct size_class *class,
+				    struct zspage *zspage)
+{
+	enum fullness_group fg;
+
+	fg = putback_zspage(class, zspage);
+	if (fg == ZS_EMPTY)
+		schedule_work(&pool->free_work);
+
+}
+
 static void replace_sub_page(struct size_class *class, struct zspage *zspage,
 				struct page *newpage, struct page *oldpage)
 {
@@ -2051,7 +2063,7 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
 	 * the list if @page is final isolated subpage in the zspage.
 	 */
 	if (!is_zspage_isolated(zspage))
-		putback_zspage(class, zspage);
+		putback_zspage_deferred(pool, class, zspage);
 
 	reset_page(page);
 	put_page(page);
@@ -2097,14 +2109,13 @@ static void zs_page_putback(struct page *page)
 	spin_lock(&class->lock);
 	dec_zspage_isolation(zspage);
 	if (!is_zspage_isolated(zspage)) {
-		fg = putback_zspage(class, zspage);
 		/*
 		 * Due to page_lock, we cannot free zspage immediately
 		 * so let's defer.
 		 */
-		if (fg == ZS_EMPTY)
-			schedule_work(&pool->free_work);
+		putback_zspage_deferred(pool, class, zspage);
 	}
+
 	spin_unlock(&class->lock);
 }
 
-- 
GitLab


From ed11e60033147c6e94a56ccccf9bcdb1f57722ed Mon Sep 17 00:00:00 2001
From: Henry Burns <henryburns@google.com>
Date: Sat, 24 Aug 2019 17:55:06 -0700
Subject: [PATCH 1698/1835] mm/zsmalloc.c: fix race condition in
 zs_destroy_pool

commit 701d678599d0c1623aaf4139c03eea260a75b027 upstream.

In zs_destroy_pool() we call flush_work(&pool->free_work).  However, we
have no guarantee that migration isn't happening in the background at
that time.

Since migration can't directly free pages, it relies on free_work being
scheduled to free the pages.  But there's nothing preventing an
in-progress migrate from queuing the work *after*
zs_unregister_migration() has called flush_work().  Which would mean
pages still pointing at the inode when we free it.

Since we know at destroy time all objects should be free, no new
migrations can come in (since zs_page_isolate() fails for fully-free
zspages).  This means it is sufficient to track a "# isolated zspages"
count by class, and have the destroy logic ensure all such pages have
drained before proceeding.  Keeping that state under the class spinlock
keeps the logic straightforward.

In this case a memory leak could lead to an eventual crash if compaction
hits the leaked page.  This crash would only occur if people are
changing their zswap backend at runtime (which eventually starts
destruction).

Link: http://lkml.kernel.org/r/20190809181751.219326-2-henryburns@google.com
Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
Signed-off-by: Henry Burns <henryburns@google.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Henry Burns <henrywolfeburns@gmail.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Jonathan Adams <jwadams@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/zsmalloc.c | 61 +++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 59 insertions(+), 2 deletions(-)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 69d2063bb112c..c2c4f739da8f0 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -53,6 +53,7 @@
 #include <linux/zpool.h>
 #include <linux/mount.h>
 #include <linux/migrate.h>
+#include <linux/wait.h>
 #include <linux/pagemap.h>
 #include <linux/fs.h>
 
@@ -267,6 +268,10 @@ struct zs_pool {
 #ifdef CONFIG_COMPACTION
 	struct inode *inode;
 	struct work_struct free_work;
+	/* A wait queue for when migration races with async_free_zspage() */
+	struct wait_queue_head migration_wait;
+	atomic_long_t isolated_pages;
+	bool destroying;
 #endif
 };
 
@@ -1894,6 +1899,19 @@ static void putback_zspage_deferred(struct zs_pool *pool,
 
 }
 
+static inline void zs_pool_dec_isolated(struct zs_pool *pool)
+{
+	VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
+	atomic_long_dec(&pool->isolated_pages);
+	/*
+	 * There's no possibility of racing, since wait_for_isolated_drain()
+	 * checks the isolated count under &class->lock after enqueuing
+	 * on migration_wait.
+	 */
+	if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
+		wake_up_all(&pool->migration_wait);
+}
+
 static void replace_sub_page(struct size_class *class, struct zspage *zspage,
 				struct page *newpage, struct page *oldpage)
 {
@@ -1963,6 +1981,7 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
 	 */
 	if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
 		get_zspage_mapping(zspage, &class_idx, &fullness);
+		atomic_long_inc(&pool->isolated_pages);
 		remove_zspage(class, zspage, fullness);
 	}
 
@@ -2062,8 +2081,16 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
 	 * Page migration is done so let's putback isolated zspage to
 	 * the list if @page is final isolated subpage in the zspage.
 	 */
-	if (!is_zspage_isolated(zspage))
+	if (!is_zspage_isolated(zspage)) {
+		/*
+		 * We cannot race with zs_destroy_pool() here because we wait
+		 * for isolation to hit zero before we start destroying.
+		 * Also, we ensure that everyone can see pool->destroying before
+		 * we start waiting.
+		 */
 		putback_zspage_deferred(pool, class, zspage);
+		zs_pool_dec_isolated(pool);
+	}
 
 	reset_page(page);
 	put_page(page);
@@ -2114,8 +2141,8 @@ static void zs_page_putback(struct page *page)
 		 * so let's defer.
 		 */
 		putback_zspage_deferred(pool, class, zspage);
+		zs_pool_dec_isolated(pool);
 	}
-
 	spin_unlock(&class->lock);
 }
 
@@ -2138,8 +2165,36 @@ static int zs_register_migration(struct zs_pool *pool)
 	return 0;
 }
 
+static bool pool_isolated_are_drained(struct zs_pool *pool)
+{
+	return atomic_long_read(&pool->isolated_pages) == 0;
+}
+
+/* Function for resolving migration */
+static void wait_for_isolated_drain(struct zs_pool *pool)
+{
+
+	/*
+	 * We're in the process of destroying the pool, so there are no
+	 * active allocations. zs_page_isolate() fails for completely free
+	 * zspages, so we need only wait for the zs_pool's isolated
+	 * count to hit zero.
+	 */
+	wait_event(pool->migration_wait,
+		   pool_isolated_are_drained(pool));
+}
+
 static void zs_unregister_migration(struct zs_pool *pool)
 {
+	pool->destroying = true;
+	/*
+	 * We need a memory barrier here to ensure global visibility of
+	 * pool->destroying. Thus pool->isolated pages will either be 0 in which
+	 * case we don't care, or it will be > 0 and pool->destroying will
+	 * ensure that we wake up once isolation hits 0.
+	 */
+	smp_mb();
+	wait_for_isolated_drain(pool); /* This can block */
 	flush_work(&pool->free_work);
 	iput(pool->inode);
 }
@@ -2377,6 +2432,8 @@ struct zs_pool *zs_create_pool(const char *name)
 	if (!pool->name)
 		goto err;
 
+	init_waitqueue_head(&pool->migration_wait);
+
 	if (create_cache(pool))
 		goto err;
 
-- 
GitLab


From 11f85d4d77afb8f1cb1989f1565b26df21280118 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Thu, 22 Aug 2019 20:55:54 -0700
Subject: [PATCH 1699/1835] xfs: fix missing ILOCK unlock when
 xfs_setattr_nonsize fails due to EDQUOT

commit 1fb254aa983bf190cfd685d40c64a480a9bafaee upstream.

Benjamin Moody reported to Debian that XFS partially wedges when a chgrp
fails on account of being out of disk quota.  I ran his reproducer
script:

# adduser dummy
# adduser dummy plugdev

# dd if=/dev/zero bs=1M count=100 of=test.img
# mkfs.xfs test.img
# mount -t xfs -o gquota test.img /mnt
# mkdir -p /mnt/dummy
# chown -c dummy /mnt/dummy
# xfs_quota -xc 'limit -g bsoft=100k bhard=100k plugdev' /mnt

(and then as user dummy)

$ dd if=/dev/urandom bs=1M count=50 of=/mnt/dummy/foo
$ chgrp plugdev /mnt/dummy/foo

and saw:

================================================
WARNING: lock held when returning to user space!
5.3.0-rc5 #rc5 Tainted: G        W
------------------------------------------------
chgrp/47006 is leaving the kernel with locks still held!
1 lock held by chgrp/47006:
 #0: 000000006664ea2d (&xfs_nondir_ilock_class){++++}, at: xfs_ilock+0xd2/0x290 [xfs]

...which is clearly caused by xfs_setattr_nonsize failing to unlock the
ILOCK after the xfs_qm_vop_chown_reserve call fails.  Add the missing
unlock.

Reported-by: benjamin.moody@gmail.com
Fixes: 253f4911f297 ("xfs: better xfs_trans_alloc interface")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_iops.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 74047bd0c1aeb..e427ad097e2ee 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -803,6 +803,7 @@ xfs_setattr_nonsize(
 
 out_cancel:
 	xfs_trans_cancel(tp);
+	xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out_dqrele:
 	xfs_qm_dqrele(udqp);
 	xfs_qm_dqrele(gdqp);
-- 
GitLab


From 17c2b7af71f27ed33ce1ba65596301c57ce73f0d Mon Sep 17 00:00:00 2001
From: Brian Foster <bfoster@redhat.com>
Date: Wed, 24 Jul 2019 06:34:46 +0000
Subject: [PATCH 1700/1835] xfs: don't trip over uninitialized buffer on extent
 read of corrupted inode

commit 6958d11f77d45db80f7e22a21a74d4d5f44dc667 upstream.

We've had rather rare reports of bmap btree block corruption where
the bmap root block has a level count of zero. The root cause of the
corruption is so far unknown. We do have verifier checks to detect
this form of on-disk corruption, but this doesn't cover a memory
corruption variant of the problem. The latter is a reasonable
possibility because the root block is part of the inode fork and can
reside in-core for some time before inode extents are read.

If this occurs, it leads to a system crash such as the following:

 BUG: unable to handle kernel paging request at ffffffff00000221
 PF error: [normal kernel read fault]
 ...
 RIP: 0010:xfs_trans_brelse+0xf/0x200 [xfs]
 ...
 Call Trace:
  xfs_iread_extents+0x379/0x540 [xfs]
  xfs_file_iomap_begin_delay+0x11a/0xb40 [xfs]
  ? xfs_attr_get+0xd1/0x120 [xfs]
  ? iomap_write_begin.constprop.40+0x2d0/0x2d0
  xfs_file_iomap_begin+0x4c4/0x6d0 [xfs]
  ? __vfs_getxattr+0x53/0x70
  ? iomap_write_begin.constprop.40+0x2d0/0x2d0
  iomap_apply+0x63/0x130
  ? iomap_write_begin.constprop.40+0x2d0/0x2d0
  iomap_file_buffered_write+0x62/0x90
  ? iomap_write_begin.constprop.40+0x2d0/0x2d0
  xfs_file_buffered_aio_write+0xe4/0x3b0 [xfs]
  __vfs_write+0x150/0x1b0
  vfs_write+0xba/0x1c0
  ksys_pwrite64+0x64/0xa0
  do_syscall_64+0x5a/0x1d0
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The crash occurs because xfs_iread_extents() attempts to release an
uninitialized buffer pointer as the level == 0 value prevented the
buffer from ever being allocated or read. Change the level > 0
assert to an explicit error check in xfs_iread_extents() to avoid
crashing the kernel in the event of localized, in-core inode
corruption.

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_bmap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 3a496ffe6551c..ab2465bc413af 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1178,7 +1178,10 @@ xfs_iread_extents(
 	 * Root level must use BMAP_BROOT_PTR_ADDR macro to get ptr out.
 	 */
 	level = be16_to_cpu(block->bb_level);
-	ASSERT(level > 0);
+	if (unlikely(level == 0)) {
+		XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
+		return -EFSCORRUPTED;
+	}
 	pp = XFS_BMAP_BROOT_PTR_ADDR(mp, block, 1, ifp->if_broot_bytes);
 	bno = be64_to_cpu(*pp);
 
-- 
GitLab


From a9912f346bdc6db395c9a13512a3517eb4ad9bf6 Mon Sep 17 00:00:00 2001
From: Allison Henderson <allison.henderson@oracle.com>
Date: Wed, 24 Jul 2019 06:34:47 +0000
Subject: [PATCH 1701/1835] xfs: Move fs/xfs/xfs_attr.h to
 fs/xfs/libxfs/xfs_attr.h

commit e2421f0b5ff3ce279573036f5cfcb0ce28b422a9 upstream.

This patch moves fs/xfs/xfs_attr.h to fs/xfs/libxfs/xfs_attr.h
since xfs_attr.c is in libxfs.  We will need these later in
xfsprogs.

Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/{ => libxfs}/xfs_attr.h | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename fs/xfs/{ => libxfs}/xfs_attr.h (100%)

diff --git a/fs/xfs/xfs_attr.h b/fs/xfs/libxfs/xfs_attr.h
similarity index 100%
rename from fs/xfs/xfs_attr.h
rename to fs/xfs/libxfs/xfs_attr.h
-- 
GitLab


From b3a248f2307c6d73536851b2b487c538ccf1c106 Mon Sep 17 00:00:00 2001
From: Allison Henderson <allison.henderson@oracle.com>
Date: Wed, 24 Jul 2019 06:34:48 +0000
Subject: [PATCH 1702/1835] xfs: Add helper function xfs_attr_try_sf_addname

commit 4c74a56b9de76bb6b581274b76b52535ad77c2a7 upstream.

This patch adds a subroutine xfs_attr_try_sf_addname
used by xfs_attr_set.  This subrotine will attempt to
add the attribute name specified in args in shortform,
as well and perform error handling previously done in
xfs_attr_set.

This patch helps to pre-simplify xfs_attr_set for reviewing
purposes and reduce indentation.  New function will be added
in the next patch.

[dgc: moved commit to helper function, too.]

Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr.c | 53 +++++++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index c6299f82a6e49..c15a1debec907 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -191,6 +191,33 @@ xfs_attr_calc_size(
 	return nblks;
 }
 
+STATIC int
+xfs_attr_try_sf_addname(
+	struct xfs_inode	*dp,
+	struct xfs_da_args	*args)
+{
+
+	struct xfs_mount	*mp = dp->i_mount;
+	int			error, error2;
+
+	error = xfs_attr_shortform_addname(args);
+	if (error == -ENOSPC)
+		return error;
+
+	/*
+	 * Commit the shortform mods, and we're done.
+	 * NOTE: this is also the error path (EEXIST, etc).
+	 */
+	if (!error && (args->flags & ATTR_KERNOTIME) == 0)
+		xfs_trans_ichgtime(args->trans, dp, XFS_ICHGTIME_CHG);
+
+	if (mp->m_flags & XFS_MOUNT_WSYNC)
+		xfs_trans_set_sync(args->trans);
+
+	error2 = xfs_trans_commit(args->trans);
+	return error ? error : error2;
+}
+
 int
 xfs_attr_set(
 	struct xfs_inode	*dp,
@@ -204,7 +231,7 @@ xfs_attr_set(
 	struct xfs_da_args	args;
 	struct xfs_trans_res	tres;
 	int			rsvd = (flags & ATTR_ROOT) != 0;
-	int			error, err2, local;
+	int			error, local;
 
 	XFS_STATS_INC(mp, xs_attr_set);
 
@@ -281,30 +308,10 @@ xfs_attr_set(
 		 * Try to add the attr to the attribute list in
 		 * the inode.
 		 */
-		error = xfs_attr_shortform_addname(&args);
+		error = xfs_attr_try_sf_addname(dp, &args);
 		if (error != -ENOSPC) {
-			/*
-			 * Commit the shortform mods, and we're done.
-			 * NOTE: this is also the error path (EEXIST, etc).
-			 */
-			ASSERT(args.trans != NULL);
-
-			/*
-			 * If this is a synchronous mount, make sure that
-			 * the transaction goes to disk before returning
-			 * to the user.
-			 */
-			if (mp->m_flags & XFS_MOUNT_WSYNC)
-				xfs_trans_set_sync(args.trans);
-
-			if (!error && (flags & ATTR_KERNOTIME) == 0) {
-				xfs_trans_ichgtime(args.trans, dp,
-							XFS_ICHGTIME_CHG);
-			}
-			err2 = xfs_trans_commit(args.trans);
 			xfs_iunlock(dp, XFS_ILOCK_EXCL);
-
-			return error ? error : err2;
+			return error;
 		}
 
 		/*
-- 
GitLab


From b21ff6cfcc240e0aee5ac94975dc7f65dfccaf0b Mon Sep 17 00:00:00 2001
From: Allison Henderson <allison.henderson@oracle.com>
Date: Wed, 24 Jul 2019 06:34:49 +0000
Subject: [PATCH 1703/1835] xfs: Add attibute set and helper functions

commit 2f3cd8091963810d85e6a5dd6ed1247e10e9e6f2 upstream.

This patch adds xfs_attr_set_args and xfs_bmap_set_attrforkoff.
These sub-routines set the attributes specified in @args.
We will use this later for setting parent pointers as a deferred
attribute operation.

[dgc: remove attr fork init code from xfs_attr_set_args().]
[dgc: xfs_attr_try_sf_addname() NULLs args.trans after commit.]
[dgc: correct sf add error handling.]

Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr.c | 151 +++++++++++++++++++++------------------
 fs/xfs/libxfs/xfs_attr.h |   1 +
 fs/xfs/libxfs/xfs_bmap.c |  49 ++++++++-----
 fs/xfs/libxfs/xfs_bmap.h |   1 +
 4 files changed, 115 insertions(+), 87 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index c15a1debec907..25431ddba1fab 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -215,9 +215,80 @@ xfs_attr_try_sf_addname(
 		xfs_trans_set_sync(args->trans);
 
 	error2 = xfs_trans_commit(args->trans);
+	args->trans = NULL;
 	return error ? error : error2;
 }
 
+/*
+ * Set the attribute specified in @args.
+ */
+int
+xfs_attr_set_args(
+	struct xfs_da_args	*args,
+	struct xfs_buf          **leaf_bp)
+{
+	struct xfs_inode	*dp = args->dp;
+	int			error;
+
+	/*
+	 * If the attribute list is non-existent or a shortform list,
+	 * upgrade it to a single-leaf-block attribute list.
+	 */
+	if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL ||
+	    (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS &&
+	     dp->i_d.di_anextents == 0)) {
+
+		/*
+		 * Build initial attribute list (if required).
+		 */
+		if (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS)
+			xfs_attr_shortform_create(args);
+
+		/*
+		 * Try to add the attr to the attribute list in the inode.
+		 */
+		error = xfs_attr_try_sf_addname(dp, args);
+		if (error != -ENOSPC)
+			return error;
+
+		/*
+		 * It won't fit in the shortform, transform to a leaf block.
+		 * GROT: another possible req'mt for a double-split btree op.
+		 */
+		error = xfs_attr_shortform_to_leaf(args, leaf_bp);
+		if (error)
+			return error;
+
+		/*
+		 * Prevent the leaf buffer from being unlocked so that a
+		 * concurrent AIL push cannot grab the half-baked leaf
+		 * buffer and run into problems with the write verifier.
+		 */
+		xfs_trans_bhold(args->trans, *leaf_bp);
+
+		error = xfs_defer_finish(&args->trans);
+		if (error)
+			return error;
+
+		/*
+		 * Commit the leaf transformation.  We'll need another
+		 * (linked) transaction to add the new attribute to the
+		 * leaf.
+		 */
+		error = xfs_trans_roll_inode(&args->trans, dp);
+		if (error)
+			return error;
+		xfs_trans_bjoin(args->trans, *leaf_bp);
+		*leaf_bp = NULL;
+	}
+
+	if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
+		error = xfs_attr_leaf_addname(args);
+	else
+		error = xfs_attr_node_addname(args);
+	return error;
+}
+
 int
 xfs_attr_set(
 	struct xfs_inode	*dp,
@@ -282,73 +353,17 @@ xfs_attr_set(
 	error = xfs_trans_reserve_quota_nblks(args.trans, dp, args.total, 0,
 				rsvd ? XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_FORCE_RES :
 				       XFS_QMOPT_RES_REGBLKS);
-	if (error) {
-		xfs_iunlock(dp, XFS_ILOCK_EXCL);
-		xfs_trans_cancel(args.trans);
-		return error;
-	}
+	if (error)
+		goto out_trans_cancel;
 
 	xfs_trans_ijoin(args.trans, dp, 0);
-
-	/*
-	 * If the attribute list is non-existent or a shortform list,
-	 * upgrade it to a single-leaf-block attribute list.
-	 */
-	if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL ||
-	    (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS &&
-	     dp->i_d.di_anextents == 0)) {
-
-		/*
-		 * Build initial attribute list (if required).
-		 */
-		if (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS)
-			xfs_attr_shortform_create(&args);
-
-		/*
-		 * Try to add the attr to the attribute list in
-		 * the inode.
-		 */
-		error = xfs_attr_try_sf_addname(dp, &args);
-		if (error != -ENOSPC) {
-			xfs_iunlock(dp, XFS_ILOCK_EXCL);
-			return error;
-		}
-
-		/*
-		 * It won't fit in the shortform, transform to a leaf block.
-		 * GROT: another possible req'mt for a double-split btree op.
-		 */
-		error = xfs_attr_shortform_to_leaf(&args, &leaf_bp);
-		if (error)
-			goto out;
-		/*
-		 * Prevent the leaf buffer from being unlocked so that a
-		 * concurrent AIL push cannot grab the half-baked leaf
-		 * buffer and run into problems with the write verifier.
-		 */
-		xfs_trans_bhold(args.trans, leaf_bp);
-		error = xfs_defer_finish(&args.trans);
-		if (error)
-			goto out;
-
-		/*
-		 * Commit the leaf transformation.  We'll need another (linked)
-		 * transaction to add the new attribute to the leaf, which
-		 * means that we have to hold & join the leaf buffer here too.
-		 */
-		error = xfs_trans_roll_inode(&args.trans, dp);
-		if (error)
-			goto out;
-		xfs_trans_bjoin(args.trans, leaf_bp);
-		leaf_bp = NULL;
-	}
-
-	if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
-		error = xfs_attr_leaf_addname(&args);
-	else
-		error = xfs_attr_node_addname(&args);
+	error = xfs_attr_set_args(&args, &leaf_bp);
 	if (error)
-		goto out;
+		goto out_release_leaf;
+	if (!args.trans) {
+		/* shortform attribute has already been committed */
+		goto out_unlock;
+	}
 
 	/*
 	 * If this is a synchronous mount, make sure that the
@@ -365,17 +380,17 @@ xfs_attr_set(
 	 */
 	xfs_trans_log_inode(args.trans, dp, XFS_ILOG_CORE);
 	error = xfs_trans_commit(args.trans);
+out_unlock:
 	xfs_iunlock(dp, XFS_ILOCK_EXCL);
-
 	return error;
 
-out:
+out_release_leaf:
 	if (leaf_bp)
 		xfs_trans_brelse(args.trans, leaf_bp);
+out_trans_cancel:
 	if (args.trans)
 		xfs_trans_cancel(args.trans);
-	xfs_iunlock(dp, XFS_ILOCK_EXCL);
-	return error;
+	goto out_unlock;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_attr.h b/fs/xfs/libxfs/xfs_attr.h
index 033ff8c478e2e..f608ac8f306f9 100644
--- a/fs/xfs/libxfs/xfs_attr.h
+++ b/fs/xfs/libxfs/xfs_attr.h
@@ -140,6 +140,7 @@ int xfs_attr_get(struct xfs_inode *ip, const unsigned char *name,
 		 unsigned char *value, int *valuelenp, int flags);
 int xfs_attr_set(struct xfs_inode *dp, const unsigned char *name,
 		 unsigned char *value, int valuelen, int flags);
+int xfs_attr_set_args(struct xfs_da_args *args, struct xfs_buf **leaf_bp);
 int xfs_attr_remove(struct xfs_inode *dp, const unsigned char *name, int flags);
 int xfs_attr_list(struct xfs_inode *dp, char *buffer, int bufsize,
 		  int flags, struct attrlist_cursor_kern *cursor);
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index ab2465bc413af..06a7da8dbda5c 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1019,6 +1019,34 @@ xfs_bmap_add_attrfork_local(
 	return -EFSCORRUPTED;
 }
 
+/* Set an inode attr fork off based on the format */
+int
+xfs_bmap_set_attrforkoff(
+	struct xfs_inode	*ip,
+	int			size,
+	int			*version)
+{
+	switch (ip->i_d.di_format) {
+	case XFS_DINODE_FMT_DEV:
+		ip->i_d.di_forkoff = roundup(sizeof(xfs_dev_t), 8) >> 3;
+		break;
+	case XFS_DINODE_FMT_LOCAL:
+	case XFS_DINODE_FMT_EXTENTS:
+	case XFS_DINODE_FMT_BTREE:
+		ip->i_d.di_forkoff = xfs_attr_shortform_bytesfit(ip, size);
+		if (!ip->i_d.di_forkoff)
+			ip->i_d.di_forkoff = xfs_default_attroffset(ip) >> 3;
+		else if ((ip->i_mount->m_flags & XFS_MOUNT_ATTR2) && version)
+			*version = 2;
+		break;
+	default:
+		ASSERT(0);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 /*
  * Convert inode from non-attributed to attributed.
  * Must not be in a transaction, ip must not be locked.
@@ -1070,26 +1098,9 @@ xfs_bmap_add_attrfork(
 
 	xfs_trans_ijoin(tp, ip, 0);
 	xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-
-	switch (ip->i_d.di_format) {
-	case XFS_DINODE_FMT_DEV:
-		ip->i_d.di_forkoff = roundup(sizeof(xfs_dev_t), 8) >> 3;
-		break;
-	case XFS_DINODE_FMT_LOCAL:
-	case XFS_DINODE_FMT_EXTENTS:
-	case XFS_DINODE_FMT_BTREE:
-		ip->i_d.di_forkoff = xfs_attr_shortform_bytesfit(ip, size);
-		if (!ip->i_d.di_forkoff)
-			ip->i_d.di_forkoff = xfs_default_attroffset(ip) >> 3;
-		else if (mp->m_flags & XFS_MOUNT_ATTR2)
-			version = 2;
-		break;
-	default:
-		ASSERT(0);
-		error = -EINVAL;
+	error = xfs_bmap_set_attrforkoff(ip, size, &version);
+	if (error)
 		goto trans_cancel;
-	}
-
 	ASSERT(ip->i_afp == NULL);
 	ip->i_afp = kmem_zone_zalloc(xfs_ifork_zone, KM_SLEEP);
 	ip->i_afp->if_flags = XFS_IFEXTENTS;
diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
index b6e9b639e731a..488dc8860fd7c 100644
--- a/fs/xfs/libxfs/xfs_bmap.h
+++ b/fs/xfs/libxfs/xfs_bmap.h
@@ -183,6 +183,7 @@ void	xfs_trim_extent(struct xfs_bmbt_irec *irec, xfs_fileoff_t bno,
 		xfs_filblks_t len);
 void	xfs_trim_extent_eof(struct xfs_bmbt_irec *, struct xfs_inode *);
 int	xfs_bmap_add_attrfork(struct xfs_inode *ip, int size, int rsvd);
+int	xfs_bmap_set_attrforkoff(struct xfs_inode *ip, int size, int *version);
 void	xfs_bmap_local_to_extents_empty(struct xfs_inode *ip, int whichfork);
 void	__xfs_bmap_add_free(struct xfs_trans *tp, xfs_fsblock_t bno,
 		xfs_filblks_t len, struct xfs_owner_info *oinfo,
-- 
GitLab


From 83a8e6b2f2e39d4b500ed67e68145751ba9140ed Mon Sep 17 00:00:00 2001
From: Allison Henderson <allison.henderson@oracle.com>
Date: Wed, 24 Jul 2019 06:34:50 +0000
Subject: [PATCH 1704/1835] xfs: Add attibute remove and helper functions

commit 068f985a9e5ec70fde58d8f679994fdbbd093a36 upstream.

This patch adds xfs_attr_remove_args. These sub-routines remove
the attributes specified in @args. We will use this later for setting
parent pointers as a deferred attribute operation.

Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr.c | 36 +++++++++++++++++++++++++-----------
 fs/xfs/libxfs/xfs_attr.h |  1 +
 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index 25431ddba1fab..844ed87b19007 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -289,6 +289,30 @@ xfs_attr_set_args(
 	return error;
 }
 
+/*
+ * Remove the attribute specified in @args.
+ */
+int
+xfs_attr_remove_args(
+	struct xfs_da_args      *args)
+{
+	struct xfs_inode	*dp = args->dp;
+	int			error;
+
+	if (!xfs_inode_hasattr(dp)) {
+		error = -ENOATTR;
+	} else if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
+		ASSERT(dp->i_afp->if_flags & XFS_IFINLINE);
+		error = xfs_attr_shortform_remove(args);
+	} else if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) {
+		error = xfs_attr_leaf_removename(args);
+	} else {
+		error = xfs_attr_node_removename(args);
+	}
+
+	return error;
+}
+
 int
 xfs_attr_set(
 	struct xfs_inode	*dp,
@@ -445,17 +469,7 @@ xfs_attr_remove(
 	 */
 	xfs_trans_ijoin(args.trans, dp, 0);
 
-	if (!xfs_inode_hasattr(dp)) {
-		error = -ENOATTR;
-	} else if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
-		ASSERT(dp->i_afp->if_flags & XFS_IFINLINE);
-		error = xfs_attr_shortform_remove(&args);
-	} else if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) {
-		error = xfs_attr_leaf_removename(&args);
-	} else {
-		error = xfs_attr_node_removename(&args);
-	}
-
+	error = xfs_attr_remove_args(&args);
 	if (error)
 		goto out;
 
diff --git a/fs/xfs/libxfs/xfs_attr.h b/fs/xfs/libxfs/xfs_attr.h
index f608ac8f306f9..bdf52a333f3f9 100644
--- a/fs/xfs/libxfs/xfs_attr.h
+++ b/fs/xfs/libxfs/xfs_attr.h
@@ -142,6 +142,7 @@ int xfs_attr_set(struct xfs_inode *dp, const unsigned char *name,
 		 unsigned char *value, int valuelen, int flags);
 int xfs_attr_set_args(struct xfs_da_args *args, struct xfs_buf **leaf_bp);
 int xfs_attr_remove(struct xfs_inode *dp, const unsigned char *name, int flags);
+int xfs_attr_remove_args(struct xfs_da_args *args);
 int xfs_attr_list(struct xfs_inode *dp, char *buffer, int bufsize,
 		  int flags, struct attrlist_cursor_kern *cursor);
 
-- 
GitLab


From 655bb2c4ace4ef3b34791b3ca4cc45693f2c0ecd Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Wed, 24 Jul 2019 06:34:51 +0000
Subject: [PATCH 1705/1835] xfs: always rejoin held resources during defer roll

commit 710d707d2fa9cf4c2aa9def129e71e99513466ea upstream.

During testing of xfs/141 on a V4 filesystem, I observed some
inconsistent behavior with regards to resources that are held (i.e.
remain locked) across a defer roll.  The transaction roll always gives
the defer roll function a new transaction, even if committing the old
transaction fails.  However, the defer roll function only rejoins the
held resources if the transaction commit succeedied.  This means that
callers of defer roll have to figure out whether the held resources are
attached to the transaction being passed back.

Worse yet, if the defer roll was part of a defer finish call, we have a
third possibility: the defer finish could pass back a dirty transaction
with dirty held resources and an error code.

The only sane way to handle all of these scenarios is to require that
the code that held the resource either cancel the transaction before
unlocking and releasing the resources, or use functions that detach
resources from a transaction properly (e.g.  xfs_trans_brelse) if they
need to drop the reference before committing or cancelling the
transaction.

In order to make this so, change the defer roll code to join held
resources to the new transaction unconditionally and fix all the bhold
callers to release the held buffers correctly.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
[mcgrof: fixes kz#204223 ]
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr.c  | 35 ++++++++++++-----------------------
 fs/xfs/libxfs/xfs_attr.h  |  2 +-
 fs/xfs/libxfs/xfs_defer.c | 14 +++++++++-----
 fs/xfs/xfs_dquot.c        | 17 +++++++++--------
 4 files changed, 31 insertions(+), 37 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index 844ed87b19007..6410d3e00ce07 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -224,10 +224,10 @@ xfs_attr_try_sf_addname(
  */
 int
 xfs_attr_set_args(
-	struct xfs_da_args	*args,
-	struct xfs_buf          **leaf_bp)
+	struct xfs_da_args	*args)
 {
 	struct xfs_inode	*dp = args->dp;
+	struct xfs_buf          *leaf_bp = NULL;
 	int			error;
 
 	/*
@@ -255,7 +255,7 @@ xfs_attr_set_args(
 		 * It won't fit in the shortform, transform to a leaf block.
 		 * GROT: another possible req'mt for a double-split btree op.
 		 */
-		error = xfs_attr_shortform_to_leaf(args, leaf_bp);
+		error = xfs_attr_shortform_to_leaf(args, &leaf_bp);
 		if (error)
 			return error;
 
@@ -263,23 +263,16 @@ xfs_attr_set_args(
 		 * Prevent the leaf buffer from being unlocked so that a
 		 * concurrent AIL push cannot grab the half-baked leaf
 		 * buffer and run into problems with the write verifier.
+		 * Once we're done rolling the transaction we can release
+		 * the hold and add the attr to the leaf.
 		 */
-		xfs_trans_bhold(args->trans, *leaf_bp);
-
+		xfs_trans_bhold(args->trans, leaf_bp);
 		error = xfs_defer_finish(&args->trans);
-		if (error)
-			return error;
-
-		/*
-		 * Commit the leaf transformation.  We'll need another
-		 * (linked) transaction to add the new attribute to the
-		 * leaf.
-		 */
-		error = xfs_trans_roll_inode(&args->trans, dp);
-		if (error)
+		xfs_trans_bhold_release(args->trans, leaf_bp);
+		if (error) {
+			xfs_trans_brelse(args->trans, leaf_bp);
 			return error;
-		xfs_trans_bjoin(args->trans, *leaf_bp);
-		*leaf_bp = NULL;
+		}
 	}
 
 	if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
@@ -322,7 +315,6 @@ xfs_attr_set(
 	int			flags)
 {
 	struct xfs_mount	*mp = dp->i_mount;
-	struct xfs_buf		*leaf_bp = NULL;
 	struct xfs_da_args	args;
 	struct xfs_trans_res	tres;
 	int			rsvd = (flags & ATTR_ROOT) != 0;
@@ -381,9 +373,9 @@ xfs_attr_set(
 		goto out_trans_cancel;
 
 	xfs_trans_ijoin(args.trans, dp, 0);
-	error = xfs_attr_set_args(&args, &leaf_bp);
+	error = xfs_attr_set_args(&args);
 	if (error)
-		goto out_release_leaf;
+		goto out_trans_cancel;
 	if (!args.trans) {
 		/* shortform attribute has already been committed */
 		goto out_unlock;
@@ -408,9 +400,6 @@ out_unlock:
 	xfs_iunlock(dp, XFS_ILOCK_EXCL);
 	return error;
 
-out_release_leaf:
-	if (leaf_bp)
-		xfs_trans_brelse(args.trans, leaf_bp);
 out_trans_cancel:
 	if (args.trans)
 		xfs_trans_cancel(args.trans);
diff --git a/fs/xfs/libxfs/xfs_attr.h b/fs/xfs/libxfs/xfs_attr.h
index bdf52a333f3f9..cc04ee0aacfbe 100644
--- a/fs/xfs/libxfs/xfs_attr.h
+++ b/fs/xfs/libxfs/xfs_attr.h
@@ -140,7 +140,7 @@ int xfs_attr_get(struct xfs_inode *ip, const unsigned char *name,
 		 unsigned char *value, int *valuelenp, int flags);
 int xfs_attr_set(struct xfs_inode *dp, const unsigned char *name,
 		 unsigned char *value, int valuelen, int flags);
-int xfs_attr_set_args(struct xfs_da_args *args, struct xfs_buf **leaf_bp);
+int xfs_attr_set_args(struct xfs_da_args *args);
 int xfs_attr_remove(struct xfs_inode *dp, const unsigned char *name, int flags);
 int xfs_attr_remove_args(struct xfs_da_args *args);
 int xfs_attr_list(struct xfs_inode *dp, char *buffer, int bufsize,
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index e792b167150a0..c52beee31836a 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -266,13 +266,15 @@ xfs_defer_trans_roll(
 
 	trace_xfs_defer_trans_roll(tp, _RET_IP_);
 
-	/* Roll the transaction. */
+	/*
+	 * Roll the transaction.  Rolling always given a new transaction (even
+	 * if committing the old one fails!) to hand back to the caller, so we
+	 * join the held resources to the new transaction so that we always
+	 * return with the held resources joined to @tpp, no matter what
+	 * happened.
+	 */
 	error = xfs_trans_roll(tpp);
 	tp = *tpp;
-	if (error) {
-		trace_xfs_defer_trans_roll_error(tp, error);
-		return error;
-	}
 
 	/* Rejoin the joined inodes. */
 	for (i = 0; i < ipcount; i++)
@@ -284,6 +286,8 @@ xfs_defer_trans_roll(
 		xfs_trans_bhold(tp, bplist[i]);
 	}
 
+	if (error)
+		trace_xfs_defer_trans_roll_error(tp, error);
 	return error;
 }
 
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 87e6dd5326d5d..a1af984e4913e 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -277,7 +277,8 @@ xfs_dquot_set_prealloc_limits(struct xfs_dquot *dqp)
 
 /*
  * Ensure that the given in-core dquot has a buffer on disk backing it, and
- * return the buffer. This is called when the bmapi finds a hole.
+ * return the buffer locked and held. This is called when the bmapi finds a
+ * hole.
  */
 STATIC int
 xfs_dquot_disk_alloc(
@@ -355,13 +356,14 @@ xfs_dquot_disk_alloc(
 	 * If everything succeeds, the caller of this function is returned a
 	 * buffer that is locked and held to the transaction.  The caller
 	 * is responsible for unlocking any buffer passed back, either
-	 * manually or by committing the transaction.
+	 * manually or by committing the transaction.  On error, the buffer is
+	 * released and not passed back.
 	 */
 	xfs_trans_bhold(tp, bp);
 	error = xfs_defer_finish(tpp);
-	tp = *tpp;
 	if (error) {
-		xfs_buf_relse(bp);
+		xfs_trans_bhold_release(*tpp, bp);
+		xfs_trans_brelse(*tpp, bp);
 		return error;
 	}
 	*bpp = bp;
@@ -521,7 +523,6 @@ xfs_qm_dqread_alloc(
 	struct xfs_buf		**bpp)
 {
 	struct xfs_trans	*tp;
-	struct xfs_buf		*bp;
 	int			error;
 
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_qm_dqalloc,
@@ -529,7 +530,7 @@ xfs_qm_dqread_alloc(
 	if (error)
 		goto err;
 
-	error = xfs_dquot_disk_alloc(&tp, dqp, &bp);
+	error = xfs_dquot_disk_alloc(&tp, dqp, bpp);
 	if (error)
 		goto err_cancel;
 
@@ -539,10 +540,10 @@ xfs_qm_dqread_alloc(
 		 * Buffer was held to the transaction, so we have to unlock it
 		 * manually here because we're not passing it back.
 		 */
-		xfs_buf_relse(bp);
+		xfs_buf_relse(*bpp);
+		*bpp = NULL;
 		goto err;
 	}
-	*bpp = bp;
 	return 0;
 
 err_cancel:
-- 
GitLab


From 0d5e34c1e2633e6256826b8ae2f7fe0d6b3b45d1 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 19 Aug 2019 12:58:14 +0300
Subject: [PATCH 1706/1835] dm zoned: fix potential NULL dereference in
 dmz_do_reclaim()

[ Upstream commit e0702d90b79d430b0ccc276ead4f88440bb51352 ]

This function is supposed to return error pointers so it matches the
dmz_get_rnd_zone_for_reclaim() function.  The current code could lead to
a NULL dereference in dmz_do_reclaim()

Fixes: b234c6d7a703 ("dm zoned: improve error handling in reclaim")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-zoned-metadata.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index 00e7a343eacf1..7e8d7fc99410d 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1579,7 +1579,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
 	struct dm_zone *zone;
 
 	if (list_empty(&zmd->map_seq_list))
-		return NULL;
+		return ERR_PTR(-EBUSY);
 
 	list_for_each_entry(zone, &zmd->map_seq_list, link) {
 		if (!zone->bzone)
@@ -1588,7 +1588,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
 			return zone;
 	}
 
-	return NULL;
+	return ERR_PTR(-EBUSY);
 }
 
 /*
-- 
GitLab


From 32df8a30b73474403a09b6cc686bc409652a2919 Mon Sep 17 00:00:00 2001
From: Alastair D'Silva <alastair@d-silva.org>
Date: Wed, 21 Aug 2019 10:19:27 +1000
Subject: [PATCH 1707/1835] powerpc: Allow flush_(inval_)dcache_range to work
 across ranges >4GB

The upstream commit:
22e9c88d486a ("powerpc/64: reuse PPC32 static inline flush_dcache_range()")
has a similar effect, but since it is a rewrite of the assembler to C, is
too invasive for stable. This patch is a minimal fix to address the issue in
assembler.

This patch applies cleanly to v5.2, v4.19 & v4.14.

When calling flush_(inval_)dcache_range with a size >4GB, we were masking
off the upper 32 bits, so we would incorrectly flush a range smaller
than intended.

This patch replaces the 32 bit shifts with 64 bit ones, so that
the full size is accounted for.

Signed-off-by: Alastair D'Silva <alastair@d-silva.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/misc_64.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index 262ba94817810..1bf6aaefd26a2 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -135,7 +135,7 @@ _GLOBAL_TOC(flush_dcache_range)
 	subf	r8,r6,r4		/* compute length */
 	add	r8,r8,r5		/* ensure we get enough */
 	lwz	r9,DCACHEL1LOGBLOCKSIZE(r10)	/* Get log-2 of dcache block size */
-	srw.	r8,r8,r9		/* compute line count */
+	srd.	r8,r8,r9		/* compute line count */
 	beqlr				/* nothing to do? */
 	mtctr	r8
 0:	dcbst	0,r6
@@ -153,7 +153,7 @@ _GLOBAL(flush_inval_dcache_range)
 	subf	r8,r6,r4		/* compute length */
 	add	r8,r8,r5		/* ensure we get enough */
 	lwz	r9,DCACHEL1LOGBLOCKSIZE(r10)/* Get log-2 of dcache block size */
-	srw.	r8,r8,r9		/* compute line count */
+	srd.	r8,r8,r9		/* compute line count */
 	beqlr				/* nothing to do? */
 	sync
 	isync
-- 
GitLab


From f28023c4eedcf0467c887af6eaf5e7d5bf0bf1c4 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Fri, 9 Aug 2019 15:20:41 +0100
Subject: [PATCH 1708/1835] rxrpc: Fix local endpoint refcounting

commit 730c5fd42c1e3652a065448fd235cb9fafb2bd10 upstream.

The object lifetime management on the rxrpc_local struct is broken in that
the rxrpc_local_processor() function is expected to clean up and remove an
object - but it may get requeued by packets coming in on the backing UDP
socket once it starts running.

This may result in the assertion in rxrpc_local_rcu() firing because the
memory has been scheduled for RCU destruction whilst still queued:

	rxrpc: Assertion failed
	------------[ cut here ]------------
	kernel BUG at net/rxrpc/local_object.c:468!

Note that if the processor comes around before the RCU free function, it
will just do nothing because ->dead is true.

Fix this by adding a separate refcount to count active users of the
endpoint that causes the endpoint to be destroyed when it reaches 0.

The original refcount can then be used to refcount objects through the work
processor and cause the memory to be rcu freed when that reaches 0.

Fixes: 4f95dd78a77e ("rxrpc: Rework local endpoint management")
Reported-by: syzbot+1e0edc4b8b7494c28450@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/af_rxrpc.c     |  4 +-
 net/rxrpc/ar-internal.h  |  5 ++-
 net/rxrpc/input.c        | 16 ++++++--
 net/rxrpc/local_object.c | 86 +++++++++++++++++++++++++---------------
 4 files changed, 72 insertions(+), 39 deletions(-)

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d76e5e58905d8..7319d3ca30e94 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -195,7 +195,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
 
 service_in_use:
 	write_unlock(&local->services_lock);
-	rxrpc_put_local(local);
+	rxrpc_unuse_local(local);
 	ret = -EADDRINUSE;
 error_unlock:
 	release_sock(&rx->sk);
@@ -908,7 +908,7 @@ static int rxrpc_release_sock(struct sock *sk)
 	rxrpc_queue_work(&rxnet->service_conn_reaper);
 	rxrpc_queue_work(&rxnet->client_conn_reaper);
 
-	rxrpc_put_local(rx->local);
+	rxrpc_unuse_local(rx->local);
 	rx->local = NULL;
 	key_put(rx->key);
 	rx->key = NULL;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index a4c341828b72f..dfd9eab77cc8a 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -258,7 +258,8 @@ struct rxrpc_security {
  */
 struct rxrpc_local {
 	struct rcu_head		rcu;
-	atomic_t		usage;
+	atomic_t		active_users;	/* Number of users of the local endpoint */
+	atomic_t		usage;		/* Number of references to the structure */
 	struct rxrpc_net	*rxnet;		/* The network ns in which this resides */
 	struct list_head	link;
 	struct socket		*socket;	/* my UDP socket */
@@ -998,6 +999,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc
 struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *);
 struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *);
 void rxrpc_put_local(struct rxrpc_local *);
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *);
+void rxrpc_unuse_local(struct rxrpc_local *);
 void rxrpc_queue_local(struct rxrpc_local *);
 void rxrpc_destroy_all_locals(struct rxrpc_net *);
 
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index d591f54cb91fb..7965600ee5dec 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -1106,8 +1106,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
 {
 	_enter("%p,%p", local, skb);
 
-	skb_queue_tail(&local->event_queue, skb);
-	rxrpc_queue_local(local);
+	if (rxrpc_get_local_maybe(local)) {
+		skb_queue_tail(&local->event_queue, skb);
+		rxrpc_queue_local(local);
+	} else {
+		rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+	}
 }
 
 /*
@@ -1117,8 +1121,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
 {
 	CHECK_SLAB_OKAY(&local->usage);
 
-	skb_queue_tail(&local->reject_queue, skb);
-	rxrpc_queue_local(local);
+	if (rxrpc_get_local_maybe(local)) {
+		skb_queue_tail(&local->reject_queue, skb);
+		rxrpc_queue_local(local);
+	} else {
+		rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+	}
 }
 
 /*
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 10317dbdab5f4..2182ebfc7df4c 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -83,6 +83,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
 	local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
 	if (local) {
 		atomic_set(&local->usage, 1);
+		atomic_set(&local->active_users, 1);
 		local->rxnet = rxnet;
 		INIT_LIST_HEAD(&local->link);
 		INIT_WORK(&local->processor, rxrpc_local_processor);
@@ -270,11 +271,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
 		 * bind the transport socket may still fail if we're attempting
 		 * to use a local address that the dying object is still using.
 		 */
-		if (!rxrpc_get_local_maybe(local)) {
-			cursor = cursor->next;
-			list_del_init(&local->link);
+		if (!rxrpc_use_local(local))
 			break;
-		}
 
 		age = "old";
 		goto found;
@@ -288,7 +286,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
 	if (ret < 0)
 		goto sock_error;
 
-	list_add_tail(&local->link, cursor);
+	if (cursor != &rxnet->local_endpoints)
+		list_replace(cursor, &local->link);
+	else
+		list_add_tail(&local->link, cursor);
 	age = "new";
 
 found:
@@ -346,7 +347,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
 }
 
 /*
- * Queue a local endpoint.
+ * Queue a local endpoint unless it has become unreferenced and pass the
+ * caller's reference to the work item.
  */
 void rxrpc_queue_local(struct rxrpc_local *local)
 {
@@ -355,15 +357,8 @@ void rxrpc_queue_local(struct rxrpc_local *local)
 	if (rxrpc_queue_work(&local->processor))
 		trace_rxrpc_local(local, rxrpc_local_queued,
 				  atomic_read(&local->usage), here);
-}
-
-/*
- * A local endpoint reached its end of life.
- */
-static void __rxrpc_put_local(struct rxrpc_local *local)
-{
-	_enter("%d", local->debug_id);
-	rxrpc_queue_work(&local->processor);
+	else
+		rxrpc_put_local(local);
 }
 
 /*
@@ -379,10 +374,45 @@ void rxrpc_put_local(struct rxrpc_local *local)
 		trace_rxrpc_local(local, rxrpc_local_put, n, here);
 
 		if (n == 0)
-			__rxrpc_put_local(local);
+			call_rcu(&local->rcu, rxrpc_local_rcu);
 	}
 }
 
+/*
+ * Start using a local endpoint.
+ */
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
+{
+	unsigned int au;
+
+	local = rxrpc_get_local_maybe(local);
+	if (!local)
+		return NULL;
+
+	au = atomic_fetch_add_unless(&local->active_users, 1, 0);
+	if (au == 0) {
+		rxrpc_put_local(local);
+		return NULL;
+	}
+
+	return local;
+}
+
+/*
+ * Cease using a local endpoint.  Once the number of active users reaches 0, we
+ * start the closure of the transport in the work processor.
+ */
+void rxrpc_unuse_local(struct rxrpc_local *local)
+{
+	unsigned int au;
+
+	au = atomic_dec_return(&local->active_users);
+	if (au == 0)
+		rxrpc_queue_local(local);
+	else
+		rxrpc_put_local(local);
+}
+
 /*
  * Destroy a local endpoint's socket and then hand the record to RCU to dispose
  * of.
@@ -397,16 +427,6 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
 
 	_enter("%d", local->debug_id);
 
-	/* We can get a race between an incoming call packet queueing the
-	 * processor again and the work processor starting the destruction
-	 * process which will shut down the UDP socket.
-	 */
-	if (local->dead) {
-		_leave(" [already dead]");
-		return;
-	}
-	local->dead = true;
-
 	mutex_lock(&rxnet->local_mutex);
 	list_del_init(&local->link);
 	mutex_unlock(&rxnet->local_mutex);
@@ -426,13 +446,11 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
 	 */
 	rxrpc_purge_queue(&local->reject_queue);
 	rxrpc_purge_queue(&local->event_queue);
-
-	_debug("rcu local %d", local->debug_id);
-	call_rcu(&local->rcu, rxrpc_local_rcu);
 }
 
 /*
- * Process events on an endpoint
+ * Process events on an endpoint.  The work item carries a ref which
+ * we must release.
  */
 static void rxrpc_local_processor(struct work_struct *work)
 {
@@ -445,8 +463,10 @@ static void rxrpc_local_processor(struct work_struct *work)
 
 	do {
 		again = false;
-		if (atomic_read(&local->usage) == 0)
-			return rxrpc_local_destroyer(local);
+		if (atomic_read(&local->active_users) == 0) {
+			rxrpc_local_destroyer(local);
+			break;
+		}
 
 		if (!skb_queue_empty(&local->reject_queue)) {
 			rxrpc_reject_packets(local);
@@ -458,6 +478,8 @@ static void rxrpc_local_processor(struct work_struct *work)
 			again = true;
 		}
 	} while (again);
+
+	rxrpc_put_local(local);
 }
 
 /*
-- 
GitLab


From a05354cbb82248469f907712587992c52fd1c254 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 13 Aug 2019 22:26:36 +0100
Subject: [PATCH 1709/1835] rxrpc: Fix read-after-free in rxrpc_queue_local()

commit 06d9532fa6b34f12a6d75711162d47c17c1add72 upstream.

rxrpc_queue_local() attempts to queue the local endpoint it is given and
then, if successful, prints a trace line.  The trace line includes the
current usage count - but we're not allowed to look at the local endpoint
at this point as we passed our ref on it to the workqueue.

Fix this by reading the usage count before queuing the work item.

Also fix the reading of local->debug_id for trace lines, which must be done
with the same consideration as reading the usage count.

Fixes: 09d2bf595db4 ("rxrpc: Add a tracepoint to track rxrpc_local refcounting")
Reported-by: syzbot+78e71c5bab4f76a6a719@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/trace/events/rxrpc.h |  6 +++---
 net/rxrpc/local_object.c     | 19 ++++++++++---------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 147546e0c11bd..815dcfa647430 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -500,10 +500,10 @@ rxrpc_tx_points;
 #define E_(a, b)	{ a, b }
 
 TRACE_EVENT(rxrpc_local,
-	    TP_PROTO(struct rxrpc_local *local, enum rxrpc_local_trace op,
+	    TP_PROTO(unsigned int local_debug_id, enum rxrpc_local_trace op,
 		     int usage, const void *where),
 
-	    TP_ARGS(local, op, usage, where),
+	    TP_ARGS(local_debug_id, op, usage, where),
 
 	    TP_STRUCT__entry(
 		    __field(unsigned int,	local		)
@@ -513,7 +513,7 @@ TRACE_EVENT(rxrpc_local,
 			     ),
 
 	    TP_fast_assign(
-		    __entry->local = local->debug_id;
+		    __entry->local = local_debug_id;
 		    __entry->op = op;
 		    __entry->usage = usage;
 		    __entry->where = where;
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 2182ebfc7df4c..34ec96e5898e6 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -97,7 +97,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
 		local->debug_id = atomic_inc_return(&rxrpc_debug_id);
 		memcpy(&local->srx, srx, sizeof(*srx));
 		local->srx.srx_service = 0;
-		trace_rxrpc_local(local, rxrpc_local_new, 1, NULL);
+		trace_rxrpc_local(local->debug_id, rxrpc_local_new, 1, NULL);
 	}
 
 	_leave(" = %p", local);
@@ -325,7 +325,7 @@ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *local)
 	int n;
 
 	n = atomic_inc_return(&local->usage);
-	trace_rxrpc_local(local, rxrpc_local_got, n, here);
+	trace_rxrpc_local(local->debug_id, rxrpc_local_got, n, here);
 	return local;
 }
 
@@ -339,7 +339,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
 	if (local) {
 		int n = atomic_fetch_add_unless(&local->usage, 1, 0);
 		if (n > 0)
-			trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
+			trace_rxrpc_local(local->debug_id, rxrpc_local_got,
+					  n + 1, here);
 		else
 			local = NULL;
 	}
@@ -347,16 +348,16 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
 }
 
 /*
- * Queue a local endpoint unless it has become unreferenced and pass the
- * caller's reference to the work item.
+ * Queue a local endpoint and pass the caller's reference to the work item.
  */
 void rxrpc_queue_local(struct rxrpc_local *local)
 {
 	const void *here = __builtin_return_address(0);
+	unsigned int debug_id = local->debug_id;
+	int n = atomic_read(&local->usage);
 
 	if (rxrpc_queue_work(&local->processor))
-		trace_rxrpc_local(local, rxrpc_local_queued,
-				  atomic_read(&local->usage), here);
+		trace_rxrpc_local(debug_id, rxrpc_local_queued, n, here);
 	else
 		rxrpc_put_local(local);
 }
@@ -371,7 +372,7 @@ void rxrpc_put_local(struct rxrpc_local *local)
 
 	if (local) {
 		n = atomic_dec_return(&local->usage);
-		trace_rxrpc_local(local, rxrpc_local_put, n, here);
+		trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
 
 		if (n == 0)
 			call_rcu(&local->rcu, rxrpc_local_rcu);
@@ -458,7 +459,7 @@ static void rxrpc_local_processor(struct work_struct *work)
 		container_of(work, struct rxrpc_local, processor);
 	bool again;
 
-	trace_rxrpc_local(local, rxrpc_local_processing,
+	trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
 			  atomic_read(&local->usage), NULL);
 
 	do {
-- 
GitLab


From ce3f9e194d25812263c1bacac8c6bcd1f99df899 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 12 Aug 2019 23:30:06 +0100
Subject: [PATCH 1710/1835] rxrpc: Fix local endpoint replacement

[ Upstream commit b00df840fb4004b7087940ac5f68801562d0d2de ]

When a local endpoint (struct rxrpc_local) ceases to be in use by any
AF_RXRPC sockets, it starts the process of being destroyed, but this
doesn't cause it to be removed from the namespace endpoint list immediately
as tearing it down isn't trivial and can't be done in softirq context, so
it gets deferred.

If a new socket comes along that wants to bind to the same endpoint, a new
rxrpc_local object will be allocated and rxrpc_lookup_local() will use
list_replace() to substitute the new one for the old.

Then, when the dying object gets to rxrpc_local_destroyer(), it is removed
unconditionally from whatever list it is on by calling list_del_init().

However, list_replace() doesn't reset the pointers in the replaced
list_head and so the list_del_init() will likely corrupt the local
endpoints list.

Fix this by using list_replace_init() instead.

Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting")
Reported-by: syzbot+193e29e9387ea5837f1d@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/local_object.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 34ec96e5898e6..27f4bbe85e799 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -287,7 +287,7 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
 		goto sock_error;
 
 	if (cursor != &rxnet->local_endpoints)
-		list_replace(cursor, &local->link);
+		list_replace_init(cursor, &local->link);
 	else
 		list_add_tail(&local->link, cursor);
 	age = "new";
-- 
GitLab


From 6d47174198ac797203b8bf0355a30bb7c6dcf030 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Fri, 9 Aug 2019 22:47:47 +0100
Subject: [PATCH 1711/1835] rxrpc: Fix local refcounting

[ Upstream commit 68553f1a6f746bf860bce3eb42d78c26a717d9c0 ]

Fix rxrpc_unuse_local() to handle a NULL local pointer as it can be called
on an unbound socket on which rx->local is not yet set.

The following reproduced (includes omitted):

	int main(void)
	{
		socket(AF_RXRPC, SOCK_DGRAM, AF_INET);
		return 0;
	}

causes the following oops to occur:

	BUG: kernel NULL pointer dereference, address: 0000000000000010
	...
	RIP: 0010:rxrpc_unuse_local+0x8/0x1b
	...
	Call Trace:
	 rxrpc_release+0x2b5/0x338
	 __sock_release+0x37/0xa1
	 sock_close+0x14/0x17
	 __fput+0x115/0x1e9
	 task_work_run+0x72/0x98
	 do_exit+0x51b/0xa7a
	 ? __context_tracking_exit+0x4e/0x10e
	 do_group_exit+0xab/0xab
	 __x64_sys_exit_group+0x14/0x17
	 do_syscall_64+0x89/0x1d4
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reported-by: syzbot+20dee719a2e090427b5f@syzkaller.appspotmail.com
Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/local_object.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 27f4bbe85e799..c752ad4870678 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -407,11 +407,13 @@ void rxrpc_unuse_local(struct rxrpc_local *local)
 {
 	unsigned int au;
 
-	au = atomic_dec_return(&local->active_users);
-	if (au == 0)
-		rxrpc_queue_local(local);
-	else
-		rxrpc_put_local(local);
+	if (local) {
+		au = atomic_dec_return(&local->active_users);
+		if (au == 0)
+			rxrpc_queue_local(local);
+		else
+			rxrpc_put_local(local);
+	}
 }
 
 /*
-- 
GitLab


From 97ab07e11fbf55c86c3758e07ab295028bf17f94 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 29 Aug 2019 08:29:00 +0200
Subject: [PATCH 1712/1835] Linux 4.19.69

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 6f164b04d953b..677341239449a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 68
+SUBLEVEL = 69
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From a8c3c3808214b02a8922d2c9f34304ecf0992884 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
Date: Thu, 29 Aug 2019 16:26:22 +0200
Subject: [PATCH 1713/1835] arm: dts: add missing Raspberry Pi model names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is needed to identify the different models on distributions like OpenWrt.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
---
 arch/arm/boot/dts/bcm2708-rpi-b-plus.dts | 1 +
 arch/arm/boot/dts/bcm2708-rpi-b.dts      | 1 +
 arch/arm/boot/dts/bcm2708-rpi-cm.dts     | 1 +
 arch/arm/boot/dts/bcm2710-rpi-cm3.dts    | 1 +
 4 files changed, 4 insertions(+)

diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
index b2b8e5c9d5823..b800699a03fbd 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
@@ -6,6 +6,7 @@
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
+	compatible = "raspberrypi,model-b-plus", "brcm,bcm2835";
 	model = "Raspberry Pi Model B+";
 };
 
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b.dts b/arch/arm/boot/dts/bcm2708-rpi-b.dts
index 3f9a8e4cfe8f5..ef47775692cea 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-b.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
@@ -6,6 +6,7 @@
 #include "bcm283x-rpi-csi1-2lane.dtsi"
 
 / {
+	compatible = "raspberrypi,model-b", "brcm,bcm2835";
 	model = "Raspberry Pi Model B";
 };
 
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dts b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
index 1a3975b356309..64809aee5c0ca 100644
--- a/arch/arm/boot/dts/bcm2708-rpi-cm.dts
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
@@ -5,6 +5,7 @@
 #include "bcm283x-rpi-csi1-4lane.dtsi"
 
 / {
+	compatible = "raspberrypi,compute-module", "brcm,bcm2835";
 	model = "Raspberry Pi Compute Module";
 };
 
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
index 14a37ffda8557..addebe448e32c 100644
--- a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -6,6 +6,7 @@
 #include "bcm283x-rpi-csi1-4lane.dtsi"
 
 / {
+	compatible = "raspberrypi,3-compute-module", "brcm,bcm2837";
 	model = "Raspberry Pi Compute Module 3";
 };
 
-- 
GitLab


From ccf30c7da203f865bc000c7c12275dbb12295740 Mon Sep 17 00:00:00 2001
From: Trevor Stiles <tstiles@shel.org>
Date: Wed, 28 Aug 2019 15:07:18 -0700
Subject: [PATCH 1714/1835] Add support for the Audio Injector Ultra in 64-bit
 land.

Signed-off-by: Trevor Stiles <tstiles@shel.org>
---
 arch/arm64/configs/bcm2711_defconfig | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 200f66c006d68..a69735c7c268d 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -856,6 +856,7 @@ CONFIG_SND_PISOUND=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_ADAU7002=m
 CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_SPDIF=m
 CONFIG_SND_SOC_WM8804_I2C=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 1e8ff7ae2b019..b5d9c62a1f657 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -823,6 +823,7 @@ CONFIG_SND_SOC_AD193X_SPI=m
 CONFIG_SND_SOC_AD193X_I2C=m
 CONFIG_SND_SOC_ADAU1701=m
 CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4265=m
 CONFIG_SND_SOC_CS4271_I2C=m
 CONFIG_SND_SOC_ICS43432=m
 CONFIG_SND_SOC_WM8804_I2C=m
-- 
GitLab


From 9828fa697eeca5b97275dfa73bcbacc8f0e1fbb7 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 3 Sep 2019 18:16:56 +0100
Subject: [PATCH 1715/1835] arch/arm: Add model string to cpuinfo

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/kernel/setup.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 7bbaa293a38ce..ece345886790e 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -1238,6 +1238,8 @@ static int c_show(struct seq_file *m, void *v)
 {
 	int i, j;
 	u32 cpuid;
+	struct device_node *np;
+	const char *model;
 
 	for_each_online_cpu(i) {
 		/*
@@ -1297,6 +1299,14 @@ static int c_show(struct seq_file *m, void *v)
 	seq_printf(m, "Revision\t: %04x\n", system_rev);
 	seq_printf(m, "Serial\t\t: %s\n", system_serial);
 
+	np = of_find_node_by_path("/");
+	if (np) {
+		if (!of_property_read_string(np, "model",
+					     &model))
+			seq_printf(m, "Model\t\t: %s\n", model);
+		of_node_put(np);
+	}
+
 	return 0;
 }
 
-- 
GitLab


From 935eb6f9a31971ef5537ac5d1b62148f8bcbad2f Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Tue, 3 Sep 2019 18:17:25 +0100
Subject: [PATCH 1716/1835] arch/arm64: Add Revision, Serial, Model to cpuinfo

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm64/kernel/cpuinfo.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index e9ab7b3ed3176..71f41de52d09d 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -27,6 +27,7 @@
 #include <linux/elf.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/of_platform.h>
 #include <linux/personality.h>
 #include <linux/preempt.h>
 #include <linux/printk.h>
@@ -125,6 +126,10 @@ static int c_show(struct seq_file *m, void *v)
 {
 	int i, j;
 	bool compat = personality(current->personality) == PER_LINUX32;
+	struct device_node *np;
+	const char *model;
+	const char *serial;
+	u32 revision;
 
 	for_each_online_cpu(i) {
 		struct cpuinfo_arm64 *cpuinfo = &per_cpu(cpu_data, i);
@@ -176,6 +181,26 @@ static int c_show(struct seq_file *m, void *v)
 		seq_printf(m, "CPU revision\t: %d\n\n", MIDR_REVISION(midr));
 	}
 
+	seq_printf(m, "Hardware\t: BCM2835\n");
+
+	np = of_find_node_by_path("/system");
+	if (np) {
+		if (!of_property_read_u32(np, "linux,revision", &revision))
+			seq_printf(m, "Revision\t: %04x\n", revision);
+		of_node_put(np);
+	}
+
+	np = of_find_node_by_path("/");
+	if (np) {
+		if (!of_property_read_string(np, "serial-number",
+					     &serial))
+			seq_printf(m, "Serial\t\t: %s\n", serial);
+		if (!of_property_read_string(np, "model",
+					     &model))
+			seq_printf(m, "Model\t\t: %s\n", model);
+		of_node_put(np);
+	}
+
 	return 0;
 }
 
-- 
GitLab


From fd5109b991494f864c118dac69013cd878bee83a Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 28 Aug 2019 13:34:30 +0100
Subject: [PATCH 1717/1835] media: dt-bindings: Add binding for the Sony IMX219
 sensor

The IMX219 is an 8MPix CSI2 sensor, supporting 2 or 4 data lanes.
Document the binding for this device.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 .../devicetree/bindings/media/i2c/imx219.txt  | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/media/i2c/imx219.txt

diff --git a/Documentation/devicetree/bindings/media/i2c/imx219.txt b/Documentation/devicetree/bindings/media/i2c/imx219.txt
new file mode 100644
index 0000000000000..a02f1ce1e1204
--- /dev/null
+++ b/Documentation/devicetree/bindings/media/i2c/imx219.txt
@@ -0,0 +1,59 @@
+* Sony 1/4.0-Inch 8Mpixel CMOS Digital Image Sensor
+
+The Sony imx219 is a 1/4.0-inch CMOS active pixel digital image sensor with
+an active array size of 3280H x 2464V. It is programmable through I2C
+interface. The I2C address is fixed to 0x10 as per sensor data sheet.
+Image data is sent through MIPI CSI-2, which is configured as either 2 or 4
+data lanes.
+
+Required Properties:
+- compatible: value should be "sony,imx219" for imx219 sensor
+- reg: I2C bus address of the device
+- clocks: reference to the xclk input clock.
+- clock-names: should be "xclk".
+- DOVDD-supply: Digital I/O voltage supply, 1.8 volts
+- AVDD-supply: Analog voltage supply, 2.8 volts
+- DVDD-supply: Digital core voltage supply, 1.2 volts
+
+Optional Properties:
+- xclr-gpios: reference to the GPIO connected to the xclr pin, if any. Must be
+	      released after all supplies are applied.
+	      This is an active high signal to the imx219.
+
+The imx219 device node should contain one 'port' child node with
+an 'endpoint' subnode. For further reading on port node refer to
+Documentation/devicetree/bindings/media/video-interfaces.txt.
+
+Endpoint node required properties for CSI-2 connection are:
+- remote-endpoint: a phandle to the bus receiver's endpoint node.
+- clock-lanes: should be set to <0> (clock lane on hardware lane 0)
+- data-lanes: should be set to <1 2>, or  <1 2 3 4> (two or four lane CSI-2
+  supported)
+
+Example:
+	sensor@10 {
+		compatible = "sony,imx219";
+		reg = <0x10>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		clocks = <&imx219_clk>;
+		clock-names = "xclk";
+		xclr-gpios = <&gpio_sensor 0 0>;
+		DOVDD-supply = <&vgen4_reg>; /* 1.8v */
+		AVDD-supply = <&vgen3_reg>;  /* 2.8v */
+		DVDD-supply = <&vgen2_reg>;  /* 1.2v */
+
+		imx219_clk: camera-clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <24000000>;
+		};
+
+		port {
+			sensor_out: endpoint {
+				remote-endpoint = <&csiss_in>;
+				clock-lanes = <0>;
+				data-lanes = <1 2>;
+			};
+		};
+	};
-- 
GitLab


From 0b46423d07d322009f40d17a292c219d70f77392 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 28 Aug 2019 13:34:49 +0100
Subject: [PATCH 1718/1835] media: i2c: Add driver for Sony IMX219 sensor

Adds a driver for the 8MPix Sony IMX219 CSI2 sensor.
Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
currently only supports 2 lanes.
8MPix @ 15fps, 1080P @ 30fps (cropped FOV), and 1640x1232 (2x2 binned)
@ 30fps are currently supported.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 drivers/media/i2c/Kconfig  |   11 +
 drivers/media/i2c/Makefile |    1 +
 drivers/media/i2c/imx219.c | 1093 ++++++++++++++++++++++++++++++++++++
 3 files changed, 1105 insertions(+)
 create mode 100644 drivers/media/i2c/imx219.c

diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index 63c9ac2c6a5ff..bd008e0d1d718 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -596,6 +596,17 @@ config VIDEO_APTINA_PLL
 config VIDEO_SMIAPP_PLL
 	tristate
 
+config VIDEO_IMX219
+	tristate "Sony IMX219 sensor support"
+	depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+	depends on MEDIA_CAMERA_SUPPORT
+	help
+	  This is a Video4Linux2 sensor driver for the Sony
+	  IMX219 camera.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called imx219.
+
 config VIDEO_IMX258
 	tristate "Sony IMX258 sensor support"
 	depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
index 520b3c3bf48c2..8b4fe01411b9b 100644
--- a/drivers/media/i2c/Makefile
+++ b/drivers/media/i2c/Makefile
@@ -106,6 +106,7 @@ obj-$(CONFIG_VIDEO_I2C)		+= video-i2c.o
 obj-$(CONFIG_VIDEO_ML86V7667)	+= ml86v7667.o
 obj-$(CONFIG_VIDEO_OV2659)	+= ov2659.o
 obj-$(CONFIG_VIDEO_TC358743)	+= tc358743.o
+obj-$(CONFIG_VIDEO_IMX219)	+= imx219.o
 obj-$(CONFIG_VIDEO_IMX258)	+= imx258.o
 obj-$(CONFIG_VIDEO_IMX274)	+= imx274.o
 
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
new file mode 100644
index 0000000000000..682397a484922
--- /dev/null
+++ b/drivers/media/i2c/imx219.c
@@ -0,0 +1,1093 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * A V4L2 driver for Sony IMX219 cameras.
+ * Copyright (C) 2019, Raspberry Pi (Trading) Ltd
+ *
+ * Based on Sony imx258 camera driver
+ * Copyright (C) 2018 Intel Corporation
+ *
+ * DT / fwnode changes, and regulator / GPIO control taken from ov5640.c
+ * Copyright (C) 2011-2013 Freescale Semiconductor, Inc. All Rights Reserved.
+ * Copyright (C) 2014-2017 Mentor Graphics Inc.
+ *
+ */
+
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/delay.h>
+#include <linux/gpio/consumer.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/pm_runtime.h>
+#include <linux/regulator/consumer.h>
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-fwnode.h>
+#include <media/v4l2-mediabus.h>
+#include <asm/unaligned.h>
+
+#define IMX219_REG_VALUE_08BIT		1
+#define IMX219_REG_VALUE_16BIT		2
+
+#define IMX219_REG_MODE_SELECT		0x0100
+#define IMX219_MODE_STANDBY		0x00
+#define IMX219_MODE_STREAMING		0x01
+
+/* Chip ID */
+#define IMX219_REG_CHIP_ID		0x0000
+#define IMX219_CHIP_ID			0x0219
+
+/* V_TIMING internal */
+#define IMX219_REG_VTS			0x0160
+#define IMX219_VTS_15FPS		0x0dc6
+#define IMX219_VTS_30FPS_1080P		0x06e3
+#define IMX219_VTS_30FPS_BINNED		0x06e3
+#define IMX219_VTS_MAX			0xffff
+
+/*Frame Length Line*/
+#define IMX219_FLL_MIN			0x08a6
+#define IMX219_FLL_MAX			0xffff
+#define IMX219_FLL_STEP			1
+#define IMX219_FLL_DEFAULT		0x0c98
+
+/* HBLANK control - read only */
+#define IMX219_PPL_DEFAULT		5352
+
+/* Exposure control */
+#define IMX219_REG_EXPOSURE		0x015a
+#define IMX219_EXPOSURE_MIN		4
+#define IMX219_EXPOSURE_STEP		1
+#define IMX219_EXPOSURE_DEFAULT		0x640
+#define IMX219_EXPOSURE_MAX		65535
+
+/* Analog gain control */
+#define IMX219_REG_ANALOG_GAIN		0x0157
+#define IMX219_ANA_GAIN_MIN		0
+#define IMX219_ANA_GAIN_MAX		232
+#define IMX219_ANA_GAIN_STEP		1
+#define IMX219_ANA_GAIN_DEFAULT		0x0
+
+/* Digital gain control */
+#define IMX219_REG_DIGITAL_GAIN		0x0158
+#define IMX219_DGTL_GAIN_MIN		0x0100
+#define IMX219_DGTL_GAIN_MAX		0x0fff
+#define IMX219_DGTL_GAIN_DEFAULT	0x0100
+#define IMX219_DGTL_GAIN_STEP		1
+
+/* Test Pattern Control */
+#define IMX219_REG_TEST_PATTERN		0x0600
+#define IMX219_TEST_PATTERN_DISABLE	0
+#define IMX219_TEST_PATTERN_SOLID_COLOR	1
+#define IMX219_TEST_PATTERN_COLOR_BARS	2
+#define IMX219_TEST_PATTERN_GREY_COLOR	3
+#define IMX219_TEST_PATTERN_PN9		4
+
+struct imx219_reg {
+	u16 address;
+	u8 val;
+};
+
+struct imx219_reg_list {
+	u32 num_of_regs;
+	const struct imx219_reg *regs;
+};
+
+/* Mode : resolution and related config&values */
+struct imx219_mode {
+	/* Frame width */
+	u32 width;
+	/* Frame height */
+	u32 height;
+
+	/* V-timing */
+	u32 vts_def;
+
+	/* Default register values */
+	struct imx219_reg_list reg_list;
+};
+
+/*
+ * Register sets lifted off the i2C interface from the Raspberry Pi firmware
+ * driver.
+ * 3280x2464 = mode 2, 1920x1080 = mode 1, and 1640x1232 = mode 4.
+ */
+static const struct imx219_reg mode_3280x2464_regs[] = {
+	{0x0100, 0x00},
+	{0x30eb, 0x0c},
+	{0x30eb, 0x05},
+	{0x300a, 0xff},
+	{0x300b, 0xff},
+	{0x30eb, 0x05},
+	{0x30eb, 0x09},
+	{0x0114, 0x01},
+	{0x0128, 0x00},
+	{0x012a, 0x18},
+	{0x012b, 0x00},
+	{0x0164, 0x00},
+	{0x0165, 0x00},
+	{0x0166, 0x0c},
+	{0x0167, 0xcf},
+	{0x0168, 0x00},
+	{0x0169, 0x00},
+	{0x016a, 0x09},
+	{0x016b, 0x9f},
+	{0x016c, 0x0c},
+	{0x016d, 0xd0},
+	{0x016e, 0x09},
+	{0x016f, 0xa0},
+	{0x0170, 0x01},
+	{0x0171, 0x01},
+	{0x0174, 0x00},
+	{0x0175, 0x00},
+	{0x018c, 0x0a},
+	{0x018d, 0x0a},
+	{0x0301, 0x05},
+	{0x0303, 0x01},
+	{0x0304, 0x03},
+	{0x0305, 0x03},
+	{0x0306, 0x00},
+	{0x0307, 0x39},
+	{0x0309, 0x0a},
+	{0x030b, 0x01},
+	{0x030c, 0x00},
+	{0x030d, 0x72},
+	{0x0624, 0x0c},
+	{0x0625, 0xd0},
+	{0x0626, 0x09},
+	{0x0627, 0xa0},
+	{0x455e, 0x00},
+	{0x471e, 0x4b},
+	{0x4767, 0x0f},
+	{0x4750, 0x14},
+	{0x4540, 0x00},
+	{0x47b4, 0x14},
+	{0x4713, 0x30},
+	{0x478b, 0x10},
+	{0x478f, 0x10},
+	{0x4793, 0x10},
+	{0x4797, 0x0e},
+	{0x479b, 0x0e},
+
+	{0x0172, 0x03},
+	{0x0162, 0x0d},
+	{0x0163, 0x78},
+};
+
+static const struct imx219_reg mode_1920_1080_regs[] = {
+	{0x0100, 0x00},
+	{0x30eb, 0x05},
+	{0x30eb, 0x0c},
+	{0x300a, 0xff},
+	{0x300b, 0xff},
+	{0x30eb, 0x05},
+	{0x30eb, 0x09},
+	{0x0114, 0x01},
+	{0x0128, 0x00},
+	{0x012a, 0x18},
+	{0x012b, 0x00},
+	{0x0162, 0x0d},
+	{0x0163, 0x78},
+	{0x0164, 0x02},
+	{0x0165, 0xa8},
+	{0x0166, 0x0a},
+	{0x0167, 0x27},
+	{0x0168, 0x02},
+	{0x0169, 0xb4},
+	{0x016a, 0x06},
+	{0x016b, 0xeb},
+	{0x016c, 0x07},
+	{0x016d, 0x80},
+	{0x016e, 0x04},
+	{0x016f, 0x38},
+	{0x0170, 0x01},
+	{0x0171, 0x01},
+	{0x0174, 0x00},
+	{0x0175, 0x00},
+	{0x018c, 0x0a},
+	{0x018d, 0x0a},
+	{0x0301, 0x05},
+	{0x0303, 0x01},
+	{0x0304, 0x03},
+	{0x0305, 0x03},
+	{0x0306, 0x00},
+	{0x0307, 0x39},
+	{0x0309, 0x0a},
+	{0x030b, 0x01},
+	{0x030c, 0x00},
+	{0x030d, 0x72},
+	{0x455e, 0x00},
+	{0x471e, 0x4b},
+	{0x4767, 0x0f},
+	{0x4750, 0x14},
+	{0x4540, 0x00},
+	{0x47b4, 0x14},
+	{0x4713, 0x30},
+	{0x478b, 0x10},
+	{0x478f, 0x10},
+	{0x4793, 0x10},
+	{0x4797, 0x0e},
+	{0x479b, 0x0e},
+
+	{0x0172, 0x03},
+	{0x0162, 0x0d},
+	{0x0163, 0x78},
+};
+
+static const struct imx219_reg mode_1640_1232_regs[] = {
+	{0x30eb, 0x0c},
+	{0x30eb, 0x05},
+	{0x300a, 0xff},
+	{0x300b, 0xff},
+	{0x30eb, 0x05},
+	{0x30eb, 0x09},
+	{0x0114, 0x01},
+	{0x0128, 0x00},
+	{0x012a, 0x18},
+	{0x012b, 0x00},
+	{0x0164, 0x00},
+	{0x0165, 0x00},
+	{0x0166, 0x0c},
+	{0x0167, 0xcf},
+	{0x0168, 0x00},
+	{0x0169, 0x00},
+	{0x016a, 0x09},
+	{0x016b, 0x9f},
+	{0x016c, 0x06},
+	{0x016d, 0x68},
+	{0x016e, 0x04},
+	{0x016f, 0xd0},
+	{0x0170, 0x01},
+	{0x0171, 0x01},
+	{0x0174, 0x01},
+	{0x0175, 0x01},
+	{0x018c, 0x0a},
+	{0x018d, 0x0a},
+	{0x0301, 0x05},
+	{0x0303, 0x01},
+	{0x0304, 0x03},
+	{0x0305, 0x03},
+	{0x0306, 0x00},
+	{0x0307, 0x39},
+	{0x0309, 0x0a},
+	{0x030b, 0x01},
+	{0x030c, 0x00},
+	{0x030d, 0x72},
+	{0x455e, 0x00},
+	{0x471e, 0x4b},
+	{0x4767, 0x0f},
+	{0x4750, 0x14},
+	{0x4540, 0x00},
+	{0x47b4, 0x14},
+	{0x4713, 0x30},
+	{0x478b, 0x10},
+	{0x478f, 0x10},
+	{0x4793, 0x10},
+	{0x4797, 0x0e},
+	{0x479b, 0x0e},
+
+	{0x0172, 0x03},
+	{0x0162, 0x0d},
+	{0x0163, 0x78},
+};
+
+static const char * const imx219_test_pattern_menu[] = {
+	"Disabled",
+	"Color Bars",
+	"Solid Color",
+	"Grey Color Bars",
+	"PN9"
+};
+
+static const int imx219_test_pattern_val[] = {
+	IMX219_TEST_PATTERN_DISABLE,
+	IMX219_TEST_PATTERN_COLOR_BARS,
+	IMX219_TEST_PATTERN_SOLID_COLOR,
+	IMX219_TEST_PATTERN_GREY_COLOR,
+	IMX219_TEST_PATTERN_PN9,
+};
+
+/* regulator supplies */
+static const char * const imx219_supply_name[] = {
+	/* Supplies can be enabled in any order */
+	"VANA",  /* Analog (2.8V) supply */
+	"VDIG",  /* Digital Core (1.8V) supply */
+	"VDDL",  /* IF (1.2V) supply */
+};
+
+#define IMX219_NUM_SUPPLIES ARRAY_SIZE(imx219_supply_name)
+
+#define IMX219_XCLR_DELAY_MS 10	/* Initialisation delay after XCLR low->high */
+
+/* Mode configs */
+static const struct imx219_mode supported_modes[] = {
+	{
+		/* 8MPix 15fps mode */
+		.width = 3280,
+		.height = 2464,
+		.vts_def = IMX219_VTS_15FPS,
+		.reg_list = {
+			.num_of_regs = ARRAY_SIZE(mode_3280x2464_regs),
+			.regs = mode_3280x2464_regs,
+		},
+	},
+	{
+		/* 1080P 30fps cropped */
+		.width = 1920,
+		.height = 1080,
+		.vts_def = IMX219_VTS_30FPS_1080P,
+		.reg_list = {
+			.num_of_regs = ARRAY_SIZE(mode_1920_1080_regs),
+			.regs = mode_1920_1080_regs,
+		},
+	},
+	{
+		/* 2x2 binned 30fps mode */
+		.width = 1640,
+		.height = 1232,
+		.vts_def = IMX219_VTS_30FPS_BINNED,
+		.reg_list = {
+			.num_of_regs = ARRAY_SIZE(mode_1640_1232_regs),
+			.regs = mode_1640_1232_regs,
+		},
+	},
+};
+
+struct imx219 {
+	struct v4l2_subdev sd;
+	struct media_pad pad;
+
+	struct v4l2_fwnode_endpoint ep; /* the parsed DT endpoint info */
+	struct clk *xclk; /* system clock to IMX219 */
+	u32 xclk_freq;
+
+	struct gpio_desc *xclr_gpio;
+	struct regulator_bulk_data supplies[IMX219_NUM_SUPPLIES];
+
+	struct v4l2_ctrl_handler ctrl_handler;
+	/* V4L2 Controls */
+	struct v4l2_ctrl *pixel_rate;
+	struct v4l2_ctrl *exposure;
+
+	/* Current mode */
+	const struct imx219_mode *mode;
+
+	/*
+	 * Mutex for serialized access:
+	 * Protect sensor module set pad format and start/stop streaming safely.
+	 */
+	struct mutex mutex;
+
+	int power_count;
+	/* Streaming on/off */
+	bool streaming;
+};
+
+static inline struct imx219 *to_imx219(struct v4l2_subdev *_sd)
+{
+	return container_of(_sd, struct imx219, sd);
+}
+
+/* Read registers up to 2 at a time */
+static int imx219_read_reg(struct imx219 *imx219, u16 reg, u32 len, u32 *val)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	struct i2c_msg msgs[2];
+	u8 addr_buf[2] = { reg >> 8, reg & 0xff };
+	u8 data_buf[4] = { 0, };
+	int ret;
+
+	if (len > 4)
+		return -EINVAL;
+
+	/* Write register address */
+	msgs[0].addr = client->addr;
+	msgs[0].flags = 0;
+	msgs[0].len = ARRAY_SIZE(addr_buf);
+	msgs[0].buf = addr_buf;
+
+	/* Read data from register */
+	msgs[1].addr = client->addr;
+	msgs[1].flags = I2C_M_RD;
+	msgs[1].len = len;
+	msgs[1].buf = &data_buf[4 - len];
+
+	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+	if (ret != ARRAY_SIZE(msgs))
+		return -EIO;
+
+	*val = get_unaligned_be32(data_buf);
+
+	return 0;
+}
+
+/* Write registers up to 2 at a time */
+static int imx219_write_reg(struct imx219 *imx219, u16 reg, u32 len, u32 val)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	u8 buf[6];
+
+	if (len > 4)
+		return -EINVAL;
+
+	put_unaligned_be16(reg, buf);
+	put_unaligned_be32(val << (8 * (4 - len)), buf + 2);
+	if (i2c_master_send(client, buf, len + 2) != len + 2)
+		return -EIO;
+
+	return 0;
+}
+
+/* Write a list of registers */
+static int imx219_write_regs(struct imx219 *imx219,
+			     const struct imx219_reg *regs, u32 len)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < len; i++) {
+		ret = imx219_write_reg(imx219, regs[i].address, 1, regs[i].val);
+		if (ret) {
+			dev_err_ratelimited(&client->dev,
+					    "Failed to write reg 0x%4.4x. error = %d\n",
+					    regs[i].address, ret);
+
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+/* Power/clock management functions */
+static void imx219_power(struct imx219 *imx219, bool enable)
+{
+	gpiod_set_value_cansleep(imx219->xclr_gpio, enable ? 1 : 0);
+}
+
+static int imx219_set_power_on(struct imx219 *imx219)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	int ret;
+
+	ret = clk_prepare_enable(imx219->xclk);
+	if (ret) {
+		dev_err(&client->dev, "%s: failed to enable clock\n",
+			__func__);
+		return ret;
+	}
+
+	ret = regulator_bulk_enable(IMX219_NUM_SUPPLIES,
+				    imx219->supplies);
+	if (ret) {
+		dev_err(&client->dev, "%s: failed to enable regulators\n",
+			__func__);
+		goto xclk_off;
+	}
+
+	imx219_power(imx219, true);
+	msleep(IMX219_XCLR_DELAY_MS);
+
+	return 0;
+xclk_off:
+	clk_disable_unprepare(imx219->xclk);
+	return ret;
+}
+
+static void imx219_set_power_off(struct imx219 *imx219)
+{
+	imx219_power(imx219, false);
+	regulator_bulk_disable(IMX219_NUM_SUPPLIES, imx219->supplies);
+	clk_disable_unprepare(imx219->xclk);
+}
+
+static int imx219_set_power(struct imx219 *imx219, bool on)
+{
+	int ret = 0;
+
+	if (on) {
+		ret = imx219_set_power_on(imx219);
+		if (ret)
+			return ret;
+	} else {
+		imx219_set_power_off(imx219);
+	}
+
+	return 0;
+}
+
+/* Open sub-device */
+static int imx219_s_power(struct v4l2_subdev *sd, int on)
+{
+	struct imx219 *imx219 = to_imx219(sd);
+	int ret = 0;
+
+	mutex_lock(&imx219->mutex);
+
+	/*
+	 * If the power count is modified from 0 to != 0 or from != 0 to 0,
+	 * update the power state.
+	 */
+	if (imx219->power_count == !on) {
+		ret = imx219_set_power(imx219, !!on);
+		if (ret)
+			goto out;
+	}
+
+	/* Update the power count. */
+	imx219->power_count += on ? 1 : -1;
+	WARN_ON(imx219->power_count < 0);
+out:
+	mutex_unlock(&imx219->mutex);
+
+	return ret;
+}
+
+static int imx219_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
+{
+	struct v4l2_mbus_framefmt *try_fmt =
+		v4l2_subdev_get_try_format(sd, fh->pad, 0);
+
+	/* Initialize try_fmt */
+	try_fmt->width = supported_modes[0].width;
+	try_fmt->height = supported_modes[0].height;
+	try_fmt->code = MEDIA_BUS_FMT_SBGGR10_1X10;
+	try_fmt->field = V4L2_FIELD_NONE;
+
+	return 0;
+}
+
+static int imx219_set_ctrl(struct v4l2_ctrl *ctrl)
+{
+	struct imx219 *imx219 =
+		container_of(ctrl->handler, struct imx219, ctrl_handler);
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	int ret = 0;
+
+	/*
+	 * Applying V4L2 control value only happens
+	 * when power is up for streaming
+	 */
+	if (pm_runtime_get_if_in_use(&client->dev) == 0)
+		return 0;
+
+	switch (ctrl->id) {
+	case V4L2_CID_ANALOGUE_GAIN:
+		ret = imx219_write_reg(imx219, IMX219_REG_ANALOG_GAIN,
+				       IMX219_REG_VALUE_08BIT, ctrl->val);
+		break;
+	case V4L2_CID_EXPOSURE:
+		ret = imx219_write_reg(imx219, IMX219_REG_EXPOSURE,
+				       IMX219_REG_VALUE_16BIT, ctrl->val);
+		break;
+	case V4L2_CID_DIGITAL_GAIN:
+		ret = imx219_write_reg(imx219, IMX219_REG_DIGITAL_GAIN,
+				       IMX219_REG_VALUE_16BIT, ctrl->val);
+		break;
+	case V4L2_CID_TEST_PATTERN:
+		ret = imx219_write_reg(imx219, IMX219_REG_TEST_PATTERN,
+				       IMX219_REG_VALUE_16BIT,
+				       imx219_test_pattern_val[ctrl->val]);
+		break;
+	default:
+		dev_info(&client->dev,
+			 "ctrl(id:0x%x,val:0x%x) is not handled\n",
+			 ctrl->id, ctrl->val);
+		ret = -EINVAL;
+		break;
+	}
+
+	pm_runtime_put(&client->dev);
+
+	return ret;
+}
+
+static const struct v4l2_ctrl_ops imx219_ctrl_ops = {
+	.s_ctrl = imx219_set_ctrl,
+};
+
+static int imx219_enum_mbus_code(struct v4l2_subdev *sd,
+				 struct v4l2_subdev_pad_config *cfg,
+				 struct v4l2_subdev_mbus_code_enum *code)
+{
+	/* Only one bayer order(GRBG) is supported */
+	if (code->index > 0)
+		return -EINVAL;
+
+	code->code = MEDIA_BUS_FMT_SBGGR10_1X10;
+
+	return 0;
+}
+
+static int imx219_enum_frame_size(struct v4l2_subdev *sd,
+				  struct v4l2_subdev_pad_config *cfg,
+				  struct v4l2_subdev_frame_size_enum *fse)
+{
+	if (fse->index >= ARRAY_SIZE(supported_modes))
+		return -EINVAL;
+
+	if (fse->code != MEDIA_BUS_FMT_SBGGR10_1X10)
+		return -EINVAL;
+
+	fse->min_width = supported_modes[fse->index].width;
+	fse->max_width = fse->min_width;
+	fse->min_height = supported_modes[fse->index].height;
+	fse->max_height = fse->min_height;
+
+	return 0;
+}
+
+static void imx219_update_pad_format(const struct imx219_mode *mode,
+				     struct v4l2_subdev_format *fmt)
+{
+	fmt->format.width = mode->width;
+	fmt->format.height = mode->height;
+	fmt->format.code = MEDIA_BUS_FMT_SBGGR10_1X10;
+	fmt->format.field = V4L2_FIELD_NONE;
+}
+
+static int __imx219_get_pad_format(struct imx219 *imx219,
+				   struct v4l2_subdev_pad_config *cfg,
+				   struct v4l2_subdev_format *fmt)
+{
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
+		fmt->format = *v4l2_subdev_get_try_format(&imx219->sd, cfg,
+							  fmt->pad);
+	else
+		imx219_update_pad_format(imx219->mode, fmt);
+
+	return 0;
+}
+
+static int imx219_get_pad_format(struct v4l2_subdev *sd,
+				 struct v4l2_subdev_pad_config *cfg,
+				 struct v4l2_subdev_format *fmt)
+{
+	struct imx219 *imx219 = to_imx219(sd);
+	int ret;
+
+	mutex_lock(&imx219->mutex);
+	ret = __imx219_get_pad_format(imx219, cfg, fmt);
+	mutex_unlock(&imx219->mutex);
+
+	return ret;
+}
+
+static int imx219_set_pad_format(struct v4l2_subdev *sd,
+				 struct v4l2_subdev_pad_config *cfg,
+				 struct v4l2_subdev_format *fmt)
+{
+	struct imx219 *imx219 = to_imx219(sd);
+	const struct imx219_mode *mode;
+	struct v4l2_mbus_framefmt *framefmt;
+
+	mutex_lock(&imx219->mutex);
+
+	/* Only one raw bayer(BGGR) order is supported */
+	fmt->format.code = MEDIA_BUS_FMT_SBGGR10_1X10;
+
+	mode = v4l2_find_nearest_size(supported_modes,
+				      ARRAY_SIZE(supported_modes),
+				      width, height,
+				      fmt->format.width, fmt->format.height);
+	imx219_update_pad_format(mode, fmt);
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+		framefmt = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+		*framefmt = fmt->format;
+	} else {
+		imx219->mode = mode;
+	}
+
+	mutex_unlock(&imx219->mutex);
+
+	return 0;
+}
+
+/* Start streaming */
+static int imx219_start_streaming(struct imx219 *imx219)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	const struct imx219_reg_list *reg_list;
+	int ret;
+
+	/* Apply default values of current mode */
+	reg_list = &imx219->mode->reg_list;
+	ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs);
+	if (ret) {
+		dev_err(&client->dev, "%s failed to set mode\n", __func__);
+		return ret;
+	}
+
+	/*
+	 * Set VTS appropriately for frame rate control.
+	 * Currently fixed per mode.
+	 */
+	ret = imx219_write_reg(imx219, IMX219_REG_VTS,
+			       IMX219_REG_VALUE_16BIT, imx219->mode->vts_def);
+	if (ret)
+		return ret;
+
+	/* Apply customized values from user */
+	ret =  __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler);
+	if (ret)
+		return ret;
+
+	/* set stream on register */
+	return imx219_write_reg(imx219, IMX219_REG_MODE_SELECT,
+				IMX219_REG_VALUE_08BIT, IMX219_MODE_STREAMING);
+}
+
+/* Stop streaming */
+static int imx219_stop_streaming(struct imx219 *imx219)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	int ret;
+
+	/* set stream off register */
+	ret = imx219_write_reg(imx219, IMX219_REG_MODE_SELECT,
+			       IMX219_REG_VALUE_08BIT, IMX219_MODE_STANDBY);
+	if (ret)
+		dev_err(&client->dev, "%s failed to set stream\n", __func__);
+
+	/*
+	 * Return success even if it was an error, as there is nothing the
+	 * caller can do about it.
+	 */
+	return 0;
+}
+
+static int imx219_set_stream(struct v4l2_subdev *sd, int enable)
+{
+	struct imx219 *imx219 = to_imx219(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	int ret = 0;
+
+	mutex_lock(&imx219->mutex);
+	if (imx219->streaming == enable) {
+		mutex_unlock(&imx219->mutex);
+		return 0;
+	}
+
+	if (enable) {
+		ret = pm_runtime_get_sync(&client->dev);
+		if (ret < 0) {
+			pm_runtime_put_noidle(&client->dev);
+			goto err_unlock;
+		}
+
+		/*
+		 * Apply default & customized values
+		 * and then start streaming.
+		 */
+		ret = imx219_start_streaming(imx219);
+		if (ret) {
+			pm_runtime_put(&client->dev);
+			goto err_unlock;
+		}
+	} else {
+		imx219_stop_streaming(imx219);
+		pm_runtime_put(&client->dev);
+	}
+
+	imx219->streaming = enable;
+	mutex_unlock(&imx219->mutex);
+
+	return ret;
+
+err_unlock:
+	mutex_unlock(&imx219->mutex);
+
+	return ret;
+}
+
+static int __maybe_unused imx219_suspend(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+	struct imx219 *imx219 = to_imx219(sd);
+
+	if (imx219->streaming)
+		imx219_stop_streaming(imx219);
+
+	return 0;
+}
+
+static int __maybe_unused imx219_resume(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+	struct imx219 *imx219 = to_imx219(sd);
+	int ret;
+
+	if (imx219->streaming) {
+		ret = imx219_start_streaming(imx219);
+		if (ret)
+			goto error;
+	}
+
+	return 0;
+
+error:
+	imx219_stop_streaming(imx219);
+	imx219->streaming = 0;
+	return ret;
+}
+
+static int imx219_get_regulators(struct imx219 *imx219)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	int i;
+
+	for (i = 0; i < IMX219_NUM_SUPPLIES; i++)
+		imx219->supplies[i].supply = imx219_supply_name[i];
+
+	return devm_regulator_bulk_get(&client->dev,
+				       IMX219_NUM_SUPPLIES,
+				       imx219->supplies);
+}
+
+/* Verify chip ID */
+static int imx219_identify_module(struct imx219 *imx219)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	int ret;
+	u32 val;
+
+	ret = imx219_set_power_on(imx219);
+	if (ret)
+		return ret;
+
+	ret = imx219_read_reg(imx219, IMX219_REG_CHIP_ID,
+			      IMX219_REG_VALUE_16BIT, &val);
+	if (ret) {
+		dev_err(&client->dev, "failed to read chip id %x\n",
+			IMX219_CHIP_ID);
+		goto power_off;
+	}
+
+	if (val != IMX219_CHIP_ID) {
+		dev_err(&client->dev, "chip id mismatch: %x!=%x\n",
+			IMX219_CHIP_ID, val);
+		ret = -EIO;
+	}
+
+power_off:
+	imx219_set_power_off(imx219);
+	return ret;
+}
+
+static const struct v4l2_subdev_core_ops imx219_core_ops = {
+	.s_power = imx219_s_power,
+};
+
+static const struct v4l2_subdev_video_ops imx219_video_ops = {
+	.s_stream = imx219_set_stream,
+};
+
+static const struct v4l2_subdev_pad_ops imx219_pad_ops = {
+	.enum_mbus_code = imx219_enum_mbus_code,
+	.get_fmt = imx219_get_pad_format,
+	.set_fmt = imx219_set_pad_format,
+	.enum_frame_size = imx219_enum_frame_size,
+};
+
+static const struct v4l2_subdev_ops imx219_subdev_ops = {
+	.core = &imx219_core_ops,
+	.video = &imx219_video_ops,
+	.pad = &imx219_pad_ops,
+};
+
+static const struct v4l2_subdev_internal_ops imx219_internal_ops = {
+	.open = imx219_open,
+};
+
+/* Initialize control handlers */
+static int imx219_init_controls(struct imx219 *imx219)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(&imx219->sd);
+	struct v4l2_ctrl_handler *ctrl_hdlr;
+	int ret;
+
+	ctrl_hdlr = &imx219->ctrl_handler;
+	ret = v4l2_ctrl_handler_init(ctrl_hdlr, 8);
+	if (ret)
+		return ret;
+
+	mutex_init(&imx219->mutex);
+	ctrl_hdlr->lock = &imx219->mutex;
+
+	imx219->exposure = v4l2_ctrl_new_std(ctrl_hdlr, &imx219_ctrl_ops,
+					     V4L2_CID_EXPOSURE,
+					     IMX219_EXPOSURE_MIN,
+					     IMX219_EXPOSURE_MAX,
+					     IMX219_EXPOSURE_STEP,
+					     IMX219_EXPOSURE_DEFAULT);
+
+	v4l2_ctrl_new_std(ctrl_hdlr, &imx219_ctrl_ops, V4L2_CID_ANALOGUE_GAIN,
+			  IMX219_ANA_GAIN_MIN, IMX219_ANA_GAIN_MAX,
+			  IMX219_ANA_GAIN_STEP, IMX219_ANA_GAIN_DEFAULT);
+
+	v4l2_ctrl_new_std(ctrl_hdlr, &imx219_ctrl_ops, V4L2_CID_DIGITAL_GAIN,
+			  IMX219_DGTL_GAIN_MIN, IMX219_DGTL_GAIN_MAX,
+			  IMX219_DGTL_GAIN_STEP, IMX219_DGTL_GAIN_DEFAULT);
+
+	v4l2_ctrl_new_std_menu_items(ctrl_hdlr, &imx219_ctrl_ops,
+				     V4L2_CID_TEST_PATTERN,
+				     ARRAY_SIZE(imx219_test_pattern_menu) - 1,
+				     0, 0, imx219_test_pattern_menu);
+
+	if (ctrl_hdlr->error) {
+		ret = ctrl_hdlr->error;
+		dev_err(&client->dev, "%s control init failed (%d)\n",
+			__func__, ret);
+		goto error;
+	}
+
+	imx219->sd.ctrl_handler = ctrl_hdlr;
+
+	return 0;
+
+error:
+	v4l2_ctrl_handler_free(ctrl_hdlr);
+	mutex_destroy(&imx219->mutex);
+
+	return ret;
+}
+
+static void imx219_free_controls(struct imx219 *imx219)
+{
+	v4l2_ctrl_handler_free(imx219->sd.ctrl_handler);
+	mutex_destroy(&imx219->mutex);
+}
+
+static int imx219_probe(struct i2c_client *client,
+			const struct i2c_device_id *id)
+{
+	struct device *dev = &client->dev;
+	struct fwnode_handle *endpoint;
+	struct imx219 *imx219;
+	int ret;
+
+	imx219 = devm_kzalloc(&client->dev, sizeof(*imx219), GFP_KERNEL);
+	if (!imx219)
+		return -ENOMEM;
+
+	/* Initialize subdev */
+	v4l2_i2c_subdev_init(&imx219->sd, client, &imx219_subdev_ops);
+
+	/* Get CSI2 bus config */
+	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(&client->dev),
+						  NULL);
+	if (!endpoint) {
+		dev_err(dev, "endpoint node not found\n");
+		return -EINVAL;
+	}
+
+	ret = v4l2_fwnode_endpoint_parse(endpoint, &imx219->ep);
+	fwnode_handle_put(endpoint);
+	if (ret) {
+		dev_err(dev, "Could not parse endpoint\n");
+		return ret;
+	}
+
+	/* Get system clock (xclk) */
+	imx219->xclk = devm_clk_get(dev, "xclk");
+	if (IS_ERR(imx219->xclk)) {
+		dev_err(dev, "failed to get xclk\n");
+		return PTR_ERR(imx219->xclk);
+	}
+
+	imx219->xclk_freq = clk_get_rate(imx219->xclk);
+	if (imx219->xclk_freq != 24000000) {
+		dev_err(dev, "xclk frequency not supported: %d Hz\n",
+			imx219->xclk_freq);
+		return -EINVAL;
+	}
+
+	ret = imx219_get_regulators(imx219);
+	if (ret)
+		return ret;
+
+	/* request optional power down pin */
+	imx219->xclr_gpio = devm_gpiod_get_optional(dev, "xclr",
+						    GPIOD_OUT_HIGH);
+
+	/* Check module identity */
+	ret = imx219_identify_module(imx219);
+	if (ret)
+		return ret;
+
+	/* Set default mode to max resolution */
+	imx219->mode = &supported_modes[0];
+
+	ret = imx219_init_controls(imx219);
+	if (ret)
+		return ret;
+
+	/* Initialize subdev */
+	imx219->sd.internal_ops = &imx219_internal_ops;
+	imx219->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+	imx219->sd.entity.function = MEDIA_ENT_F_CAM_SENSOR;
+
+	/* Initialize source pad */
+	imx219->pad.flags = MEDIA_PAD_FL_SOURCE;
+
+	ret = media_entity_pads_init(&imx219->sd.entity, 1, &imx219->pad);
+	if (ret)
+		goto error_handler_free;
+
+	ret = v4l2_async_register_subdev_sensor_common(&imx219->sd);
+	if (ret < 0)
+		goto error_media_entity;
+
+	pm_runtime_set_active(&client->dev);
+	pm_runtime_enable(&client->dev);
+	pm_runtime_idle(&client->dev);
+
+	return 0;
+
+error_media_entity:
+	media_entity_cleanup(&imx219->sd.entity);
+
+error_handler_free:
+	imx219_free_controls(imx219);
+
+	return ret;
+}
+
+static int imx219_remove(struct i2c_client *client)
+{
+	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+	struct imx219 *imx219 = to_imx219(sd);
+
+	v4l2_async_unregister_subdev(sd);
+	media_entity_cleanup(&sd->entity);
+	imx219_free_controls(imx219);
+
+	pm_runtime_disable(&client->dev);
+	pm_runtime_set_suspended(&client->dev);
+
+	return 0;
+}
+
+static const struct of_device_id imx219_dt_ids[] = {
+	{ .compatible = "sony,imx219" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, imx219_dt_ids);
+
+static struct i2c_driver imx219_i2c_driver = {
+	.driver = {
+		.name = "imx219",
+		.of_match_table	= imx219_dt_ids,
+	},
+	.probe = imx219_probe,
+	.remove = imx219_remove,
+};
+
+module_i2c_driver(imx219_i2c_driver);
+
+MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.org");
+MODULE_DESCRIPTION("Sony IMX219 sensor driver");
+MODULE_LICENSE("GPL v2");
-- 
GitLab


From 5acbb575fde08abeea86c593250edf034ef724d0 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 28 Aug 2019 13:35:10 +0100
Subject: [PATCH 1719/1835] defconfigs: Add Sony IMX219 driver to RPi
 defconfigs

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 1 +
 arch/arm/configs/bcm2711_defconfig   | 1 +
 arch/arm/configs/bcmrpi_defconfig    | 1 +
 arch/arm64/configs/bcm2711_defconfig | 1 +
 arch/arm64/configs/bcmrpi3_defconfig | 1 +
 5 files changed, 5 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 9e909da129936..f4b435948816c 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -914,6 +914,7 @@ CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_IMX219=m
 CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index cea778ba68564..944a52f32fb40 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -924,6 +924,7 @@ CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_IMX219=m
 CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index aff78029b95f5..9de5bd576fdf6 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -906,6 +906,7 @@ CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_IMX219=m
 CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index a69735c7c268d..74175c727ece0 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -784,6 +784,7 @@ CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_IMX219=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
 CONFIG_DRM=m
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index b5d9c62a1f657..44c9f069552bc 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -761,6 +761,7 @@ CONFIG_VIDEO_TVP5150=m
 CONFIG_VIDEO_TW2804=m
 CONFIG_VIDEO_TW9903=m
 CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_IMX219=m
 CONFIG_VIDEO_OV5647=m
 CONFIG_VIDEO_OV7640=m
 CONFIG_VIDEO_MT9V011=m
-- 
GitLab


From 8a9ebbd9b474592730dbbaee9be726600af1157b Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Wed, 28 Aug 2019 13:35:19 +0100
Subject: [PATCH 1720/1835] dtoverlays: Add overlay for the Sony IMX219 image
 sensor.

Adds an overlay for the IMX219 image sensor, connected to the
Unicam CSI2 receiver peripheral.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/Makefile           |   1 +
 arch/arm/boot/dts/overlays/README             |  12 ++
 arch/arm/boot/dts/overlays/imx219-overlay.dts | 129 ++++++++++++++++++
 3 files changed, 142 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/imx219-overlay.dts

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 260fce213a575..87082d64302da 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -77,6 +77,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	i2c6.dtbo \
 	i2s-gpio28-31.dtbo \
 	ilitek251x.dtbo \
+	imx219.dtbo \
 	iqaudio-codec.dtbo \
 	iqaudio-dac.dtbo \
 	iqaudio-dacplus.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index a034d07be96af..022972b428ba8 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1269,6 +1269,18 @@ Params: interrupt               GPIO used for interrupt (default 4)
                                 touchscreen (in pixels)
 
 
+Name:   imx219
+Info:   Sony IMX219 camera module.
+        Uses Unicam 1, which is the standard camera connector on most Pi
+        variants.
+Load:   dtoverlay=imx219,<param>=<val>
+Params: i2c_pins_0_1            Use pins 0&1 for the I2C instead of 44&45.
+                                Useful on Compute Modules.
+
+        i2c_pins_28_29          Use pins 28&29 for the I2C instead of 44&45.
+                                This is required for Pi B+, 2, 0, and 0W.
+
+
 Name:   iqaudio-codec
 Info:   Configures the IQaudio Codec audio card
 Load:   dtoverlay=iqaudio-codec
diff --git a/arch/arm/boot/dts/overlays/imx219-overlay.dts b/arch/arm/boot/dts/overlays/imx219-overlay.dts
new file mode 100644
index 0000000000000..2a1500d07b680
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/imx219-overlay.dts
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Definitions for IMX219 camera module on VC I2C bus
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			imx219: imx219@10 {
+				compatible = "sony,imx219";
+				reg = <0x10>;
+				status = "okay";
+
+				clocks = <&imx219_clk>;
+				clock-names = "xclk";
+
+				VANA-supply = <&imx219_vana>;	/* 2.8v */
+				VDIG-supply = <&imx219_vdig>;	/* 1.8v */
+				VDDL-supply = <&imx219_vddl>;	/* 1.2v */
+
+				imx219_clk: camera-clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <24000000>;
+				};
+
+				port {
+					imx219_0: endpoint {
+						remote-endpoint = <&csi1_ep>;
+						clock-lanes = <0>;
+						data-lanes = <1 2>;
+						clock-noncontinuous;
+						link-frequencies =
+							/bits/ 64 <297000000>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&csi1>;
+		__overlay__ {
+			status = "okay";
+
+			port {
+				csi1_ep: endpoint {
+					remote-endpoint = <&imx219_0>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <28 29>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@3 {
+		target = <&i2c0_pins>;
+		__overlay__ {
+			brcm,pins = <44 45>;
+			brcm,function = <5>; /* alt1 */
+		};
+	};
+	fragment@4 {
+		target = <&i2c0_pins>;
+		__dormant__ {
+			brcm,pins = <0 1>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+	fragment@5 {
+		target = <&i2c_vc>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@6 {
+		target-path="/";
+		__overlay__ {
+			imx219_vana: fixedregulator@0 {
+				compatible = "regulator-fixed";
+				regulator-name = "imx219_vana";
+				regulator-min-microvolt = <2800000>;
+				regulator-max-microvolt = <2800000>;
+				gpio = <&gpio 41 GPIO_ACTIVE_HIGH>;
+				enable-active-high;
+			};
+			imx219_vdig: fixedregulator@1 {
+				compatible = "regulator-fixed";
+				regulator-name = "imx219_vdig";
+				regulator-min-microvolt = <1800000>;
+				regulator-max-microvolt = <1800000>;
+			};
+			imx219_vddl: fixedregulator@2 {
+				compatible = "regulator-fixed";
+				regulator-name = "imx219_vddl";
+				regulator-min-microvolt = <1200000>;
+				regulator-max-microvolt = <1200000>;
+			};
+		};
+	};
+
+	fragment@7 {
+		target-path="/__overrides__";
+		__overlay__ {
+			cam0-pwdn-ctrl = <&imx219_vana>,"gpio:0";
+			cam0-pwdn      = <&imx219_vana>,"gpio:4";
+		};
+	};
+
+	__overrides__ {
+		i2c_pins_0_1 = <0>,"-2-3+4";
+		i2c_pins_28_29 = <0>,"+2-3-4";
+	};
+};
-- 
GitLab


From 1cc670f5d62a8f9f2078b2e0978ee2d3d53a6fab Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Sun, 28 Apr 2019 12:15:35 +0200
Subject: [PATCH 1721/1835] staging: bcm2835-codec: Fix non-documentation
 comment block

The job_ready comment is incorrectly using the documentation prefix
(/**) which causes a warning at build time.

Simplify it.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index d4a31d0259ccb..ad071ad53067d 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -557,7 +557,7 @@ static struct vchiq_mmal_port *get_port_data(struct bcm2835_codec_ctx *ctx,
  * mem2mem callbacks
  */
 
-/**
+/*
  * job_ready() - check whether an instance is ready to be scheduled to run
  */
 static int job_ready(void *priv)
-- 
GitLab


From 435bf1c1d2c4981500a714113dacb1337386ea39 Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Wed, 20 Mar 2019 11:42:39 +0000
Subject: [PATCH 1722/1835] staging: bcm2835-codec: Fix declaration of roles

The static role text is declared incorrectly. The static should be
first, and the roles should also be constified.

Convert from "const static char *" to "static const char * const".

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 .../staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index ad071ad53067d..185bf7246bb50 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -77,7 +77,7 @@ enum bcm2835_codec_role {
 	ISP,
 };
 
-const static char *roles[] = {
+static const char * const roles[] = {
 	"decode",
 	"encode",
 	"isp"
-- 
GitLab


From 06ffffc70e85f431350ffe49af4122a0fe3b1dfd Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Wed, 20 Mar 2019 11:55:43 +0000
Subject: [PATCH 1723/1835] staging: bcm2835-codec: Add role to device name

Three entities are created, Decode, Encode and ISP but all of the video
nodes use the same video name string "bcm2835-codec" which makes it
difficult to identify each role.

Append the role-name to the video name to facilitate identifying a
specific instance from userspace.

The Card-Type is also extended with the role name to support identifying
the device context from within QUERY_CAP operations.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 .../vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c      | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index 185bf7246bb50..b828c5c00bd0e 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -947,8 +947,10 @@ static void device_run(void *priv)
 static int vidioc_querycap(struct file *file, void *priv,
 			   struct v4l2_capability *cap)
 {
+	struct bcm2835_codec_dev *dev = video_drvdata(file);
+
 	strncpy(cap->driver, MEM2MEM_NAME, sizeof(cap->driver) - 1);
-	strncpy(cap->card, MEM2MEM_NAME, sizeof(cap->card) - 1);
+	strncpy(cap->card, dev->vfd.name, sizeof(cap->card) - 1);
 	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
 		 MEM2MEM_NAME);
 	return 0;
@@ -2657,8 +2659,8 @@ static int bcm2835_codec_create(struct platform_device *pdev,
 	}
 
 	video_set_drvdata(vfd, dev);
-	snprintf(vfd->name, sizeof(vfd->name), "%s",
-		 bcm2835_codec_videodev.name);
+	snprintf(vfd->name, sizeof(vfd->name), "%s-%s",
+		 bcm2835_codec_videodev.name, roles[role]);
 	v4l2_info(&dev->v4l2_dev, "Device registered as /dev/video%d\n",
 		  vfd->num);
 
-- 
GitLab


From 83358aa6902c6588b22c1950523bf6b261083fec Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Wed, 20 Mar 2019 11:35:26 +0000
Subject: [PATCH 1724/1835] staging: bcm2835-codec: Pass driver context to
 create entities

Pass the bcm2835_codec_driver driver context directly into the
bcm2835_codec_create() so that it can be used to store driver global
state. Pass the struct platform_device *pdev by adding it to the driver
global state.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 .../bcm2835-codec/bcm2835-v4l2-codec.c              | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index b828c5c00bd0e..b558884f5d46f 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -457,6 +457,8 @@ struct bcm2835_codec_ctx {
 };
 
 struct bcm2835_codec_driver {
+	struct platform_device *pdev;
+
 	struct bcm2835_codec_dev *encode;
 	struct bcm2835_codec_dev *decode;
 	struct bcm2835_codec_dev *isp;
@@ -2587,10 +2589,11 @@ destroy_component:
 	return ret;
 }
 
-static int bcm2835_codec_create(struct platform_device *pdev,
+static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
 				struct bcm2835_codec_dev **new_dev,
 				enum bcm2835_codec_role role)
 {
+	struct platform_device *pdev = drv->pdev;
 	struct bcm2835_codec_dev *dev;
 	struct video_device *vfd;
 	int video_nr;
@@ -2711,15 +2714,17 @@ static int bcm2835_codec_probe(struct platform_device *pdev)
 	if (!drv)
 		return -ENOMEM;
 
-	ret = bcm2835_codec_create(pdev, &drv->decode, DECODE);
+	drv->pdev = pdev;
+
+	ret = bcm2835_codec_create(drv, &drv->decode, DECODE);
 	if (ret)
 		goto out;
 
-	ret = bcm2835_codec_create(pdev, &drv->encode, ENCODE);
+	ret = bcm2835_codec_create(drv, &drv->encode, ENCODE);
 	if (ret)
 		goto out;
 
-	ret = bcm2835_codec_create(pdev, &drv->isp, ISP);
+	ret = bcm2835_codec_create(drv, &drv->isp, ISP);
 	if (ret)
 		goto out;
 
-- 
GitLab


From e00b1e303a893277965720a3348a3c552ac9f22b Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Wed, 20 Mar 2019 12:54:15 +0000
Subject: [PATCH 1725/1835] staging: bcm2835-codec: add media controller
 support

Provide a single media device to contain all of the bcm2835_codec
devices created.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 .../vc04_services/bcm2835-codec/Kconfig       |  2 +-
 .../bcm2835-codec/bcm2835-v4l2-codec.c        | 41 +++++++++++++++++--
 2 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-codec/Kconfig b/drivers/staging/vc04_services/bcm2835-codec/Kconfig
index 951971b39ce0e..c104be9ad6da5 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/Kconfig
+++ b/drivers/staging/vc04_services/bcm2835-codec/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_CODEC_BCM2835
 	tristate "BCM2835 Video codec support"
-	depends on MEDIA_SUPPORT
+	depends on MEDIA_SUPPORT && MEDIA_CONTROLLER
 	depends on VIDEO_V4L2 && (ARCH_BCM2835 || COMPILE_TEST)
 	select BCM2835_VCHIQ_MMAL
 	select VIDEOBUF2_DMA_CONTIG
diff --git a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
index b558884f5d46f..16f8dfb86cb46 100644
--- a/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
+++ b/drivers/staging/vc04_services/bcm2835-codec/bcm2835-v4l2-codec.c
@@ -458,6 +458,7 @@ struct bcm2835_codec_ctx {
 
 struct bcm2835_codec_driver {
 	struct platform_device *pdev;
+	struct media_device	mdev;
 
 	struct bcm2835_codec_dev *encode;
 	struct bcm2835_codec_dev *decode;
@@ -2596,6 +2597,7 @@ static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
 	struct platform_device *pdev = drv->pdev;
 	struct bcm2835_codec_dev *dev;
 	struct video_device *vfd;
+	int function;
 	int video_nr;
 	int ret;
 
@@ -2615,18 +2617,21 @@ static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
 	if (ret)
 		goto vchiq_finalise;
 
-	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
-	if (ret)
-		goto vchiq_finalise;
-
 	atomic_set(&dev->num_inst, 0);
 	mutex_init(&dev->dev_mutex);
 
+	/* Initialise the video device */
 	dev->vfd = bcm2835_codec_videodev;
+
 	vfd = &dev->vfd;
 	vfd->lock = &dev->dev_mutex;
 	vfd->v4l2_dev = &dev->v4l2_dev;
 	vfd->device_caps = V4L2_CAP_VIDEO_M2M_MPLANE | V4L2_CAP_STREAMING;
+	vfd->v4l2_dev->mdev = &drv->mdev;
+
+	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
+	if (ret)
+		goto vchiq_finalise;
 
 	switch (role) {
 	case DECODE:
@@ -2634,11 +2639,13 @@ static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
 		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
+		function = MEDIA_ENT_F_PROC_VIDEO_DECODER;
 		video_nr = decode_video_nr;
 		break;
 	case ENCODE:
 		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
+		function = MEDIA_ENT_F_PROC_VIDEO_ENCODER;
 		video_nr = encode_video_nr;
 		break;
 	case ISP:
@@ -2648,6 +2655,7 @@ static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
 		v4l2_disable_ioctl(vfd, VIDIOC_S_PARM);
 		v4l2_disable_ioctl(vfd, VIDIOC_G_PARM);
+		function = MEDIA_ENT_F_PROC_VIDEO_SCALER;
 		video_nr = isp_video_nr;
 		break;
 	default:
@@ -2676,6 +2684,10 @@ static int bcm2835_codec_create(struct bcm2835_codec_driver *drv,
 		goto err_m2m;
 	}
 
+	ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd, function);
+	if (ret)
+		goto err_m2m;
+
 	v4l2_info(&dev->v4l2_dev, "Loaded V4L2 %s\n",
 		  roles[role]);
 	return 0;
@@ -2697,6 +2709,7 @@ static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
 
 	v4l2_info(&dev->v4l2_dev, "Removing " MEM2MEM_NAME ", %s\n",
 		  roles[dev->role]);
+	v4l2_m2m_unregister_media_controller(dev->m2m_dev);
 	v4l2_m2m_release(dev->m2m_dev);
 	video_unregister_device(&dev->vfd);
 	v4l2_device_unregister(&dev->v4l2_dev);
@@ -2708,6 +2721,7 @@ static int bcm2835_codec_destroy(struct bcm2835_codec_dev *dev)
 static int bcm2835_codec_probe(struct platform_device *pdev)
 {
 	struct bcm2835_codec_driver *drv;
+	struct media_device *mdev;
 	int ret = 0;
 
 	drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
@@ -2715,6 +2729,17 @@ static int bcm2835_codec_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	drv->pdev = pdev;
+	mdev = &drv->mdev;
+	mdev->dev = &pdev->dev;
+
+	strscpy(mdev->model, bcm2835_codec_videodev.name, sizeof(mdev->model));
+	strscpy(mdev->serial, "0000", sizeof(mdev->serial));
+	snprintf(mdev->bus_info, sizeof(mdev->bus_info), "platform:%s",
+		 pdev->name);
+
+	/* This should return the vgencmd version information or such .. */
+	mdev->hw_revision = 1;
+	media_device_init(mdev);
 
 	ret = bcm2835_codec_create(drv, &drv->decode, DECODE);
 	if (ret)
@@ -2728,6 +2753,10 @@ static int bcm2835_codec_probe(struct platform_device *pdev)
 	if (ret)
 		goto out;
 
+	/* Register the media device node */
+	if (media_device_register(mdev) < 0)
+		goto out;
+
 	platform_set_drvdata(pdev, drv);
 
 	return 0;
@@ -2748,12 +2777,16 @@ static int bcm2835_codec_remove(struct platform_device *pdev)
 {
 	struct bcm2835_codec_driver *drv = platform_get_drvdata(pdev);
 
+	media_device_unregister(&drv->mdev);
+
 	bcm2835_codec_destroy(drv->isp);
 
 	bcm2835_codec_destroy(drv->encode);
 
 	bcm2835_codec_destroy(drv->decode);
 
+	media_device_cleanup(&drv->mdev);
+
 	return 0;
 }
 
-- 
GitLab


From 298b72cf13951347898f92847d1cdc74c96bf5ed Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Wed, 28 Aug 2019 15:54:19 +0100
Subject: [PATCH 1726/1835] media: bcm2835: unicam: Reduce scope of local
 function

unicam_start_rx() is not used outside of the unicam module.  Its current
definition produces a compiler warning, that no function prototype
exists.

As the function is only used within the local scope of the module,
convert it to a static function.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 drivers/media/platform/bcm2835/bcm2835-unicam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
index 5f9375add5207..93742e6312bf0 100644
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -963,7 +963,7 @@ static void unicam_cfg_image_id(struct unicam_device *dev)
 	}
 }
 
-void unicam_start_rx(struct unicam_device *dev, unsigned long addr)
+static void unicam_start_rx(struct unicam_device *dev, unsigned long addr)
 {
 	struct unicam_cfg *cfg = &dev->cfg;
 	int line_int_freq = dev->v_fmt.fmt.pix.height >> 2;
-- 
GitLab


From 656dbed5db34b21bc951c918b597a6fd00740059 Mon Sep 17 00:00:00 2001
From: Kieran Bingham <kieran.bingham@ideasonboard.com>
Date: Wed, 20 Mar 2019 12:54:47 +0000
Subject: [PATCH 1727/1835] media: bcm2835: unicam: add media controller
 support

Add a media controller device node to represent the Unicam device.
The attached sensor will be automatically added to the media graph by
V4L2 core.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
---
 drivers/media/platform/bcm2835/Kconfig        |  2 +-
 .../media/platform/bcm2835/bcm2835-unicam.c   | 46 ++++++++++++++++++-
 2 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/bcm2835/Kconfig b/drivers/media/platform/bcm2835/Kconfig
index dac4e92bbbb6d..20e15147ee02f 100644
--- a/drivers/media/platform/bcm2835/Kconfig
+++ b/drivers/media/platform/bcm2835/Kconfig
@@ -2,7 +2,7 @@
 
 config VIDEO_BCM2835_UNICAM
 	tristate "Broadcom BCM2835 Unicam video capture driver"
-	depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+	depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && MEDIA_CONTROLLER
 	depends on ARCH_BCM2835 || COMPILE_TEST
 	select VIDEOBUF2_DMA_CONTIG
 	select V4L2_FWNODE
diff --git a/drivers/media/platform/bcm2835/bcm2835-unicam.c b/drivers/media/platform/bcm2835/bcm2835-unicam.c
index 93742e6312bf0..3f79bd86ac5ff 100644
--- a/drivers/media/platform/bcm2835/bcm2835-unicam.c
+++ b/drivers/media/platform/bcm2835/bcm2835-unicam.c
@@ -314,6 +314,9 @@ struct unicam_device {
 	struct clk *clock;
 	/* V4l2 device */
 	struct v4l2_device v4l2_dev;
+	struct media_device mdev;
+	struct media_pad pad;
+
 	/* parent device */
 	struct platform_device *pdev;
 	/* subdevice async Notifier */
@@ -1912,6 +1915,8 @@ static int unicam_probe_complete(struct unicam_device *unicam)
 		unicam->v4l2_dev.ctrl_handler = NULL;
 
 	video_set_drvdata(vdev, unicam);
+	vdev->entity.flags |= MEDIA_ENT_FL_DEFAULT;
+
 	ret = video_register_device(vdev, VFL_TYPE_GRABBER, -1);
 	if (ret) {
 		unicam_err(unicam, "Unable to register video device.\n");
@@ -1953,6 +1958,16 @@ static int unicam_probe_complete(struct unicam_device *unicam)
 		return ret;
 	}
 
+	ret = media_create_pad_link(&unicam->sensor->entity, 0,
+				    &unicam->video_dev.entity, 0,
+				    MEDIA_LNK_FL_ENABLED |
+				    MEDIA_LNK_FL_IMMUTABLE);
+	if (ret) {
+		unicam_err(unicam, "Unable to create pad links.\n");
+		video_unregister_device(&unicam->video_dev);
+		return ret;
+	}
+
 	return 0;
 }
 
@@ -2155,18 +2170,38 @@ static int unicam_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
+	unicam->mdev.dev = &pdev->dev;
+	strscpy(unicam->mdev.model, UNICAM_MODULE_NAME,
+		sizeof(unicam->mdev.model));
+	strscpy(unicam->mdev.serial, "", sizeof(unicam->mdev.serial));
+	snprintf(unicam->mdev.bus_info, sizeof(unicam->mdev.bus_info),
+		 "platform:%s", pdev->name);
+	unicam->mdev.hw_revision = 1;
+
+	media_entity_pads_init(&unicam->video_dev.entity, 1, &unicam->pad);
+	media_device_init(&unicam->mdev);
+
+	unicam->v4l2_dev.mdev = &unicam->mdev;
+
 	ret = v4l2_device_register(&pdev->dev, &unicam->v4l2_dev);
 	if (ret) {
 		unicam_err(unicam,
 			   "Unable to register v4l2 device.\n");
-		return ret;
+		goto media_cleanup;
+	}
+
+	ret = media_device_register(&unicam->mdev);
+	if (ret < 0) {
+		unicam_err(unicam,
+			   "Unable to register media-controller device.\n");
+		goto probe_out_v4l2_unregister;
 	}
 
 	/* Reserve space for the controls */
 	hdl = &unicam->ctrl_handler;
 	ret = v4l2_ctrl_handler_init(hdl, 16);
 	if (ret < 0)
-		goto probe_out_v4l2_unregister;
+		goto media_unregister;
 	unicam->v4l2_dev.ctrl_handler = hdl;
 
 	/* set the driver data in platform device */
@@ -2185,8 +2220,13 @@ static int unicam_probe(struct platform_device *pdev)
 
 free_hdl:
 	v4l2_ctrl_handler_free(hdl);
+media_unregister:
+	media_device_unregister(&unicam->mdev);
 probe_out_v4l2_unregister:
 	v4l2_device_unregister(&unicam->v4l2_dev);
+media_cleanup:
+	media_device_cleanup(&unicam->mdev);
+
 	return ret;
 }
 
@@ -2204,6 +2244,8 @@ static int unicam_remove(struct platform_device *pdev)
 	video_unregister_device(&unicam->video_dev);
 	if (unicam->sensor_config)
 		v4l2_subdev_free_pad_config(unicam->sensor_config);
+	media_device_unregister(&unicam->mdev);
+	media_device_cleanup(&unicam->mdev);
 
 	return 0;
 }
-- 
GitLab


From b052ce5c59e36fbcff2acb0c348b553a7dcdc948 Mon Sep 17 00:00:00 2001
From: Yaroslav Rosomakho <yaroslavros@gmail.com>
Date: Fri, 23 Aug 2019 11:02:22 +0200
Subject: [PATCH 1728/1835] Limit max_req_size under arm64 (or any other
 platform that uses swiotlb) to prevent potential buffer overflow due to
 bouncing.

Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
---
 drivers/mmc/host/bcm2835-mmc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index 68daa59d313b4..dc0c64f7f3486 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -38,6 +38,7 @@
 #include <linux/dmaengine.h>
 #include <linux/dma-mapping.h>
 #include <linux/of_dma.h>
+#include <linux/swiotlb.h>
 
 #include "sdhci.h"
 
@@ -1374,7 +1375,10 @@ static int bcm2835_mmc_add_host(struct bcm2835_host *host)
 	}
 #endif
 	mmc->max_segs = 128;
-	mmc->max_req_size = 524288;
+	if (swiotlb_max_segment())
+		mmc->max_req_size = (1 << IO_TLB_SHIFT) * IO_TLB_SEGSIZE;
+	else
+		mmc->max_req_size = 524288;
 	mmc->max_seg_size = mmc->max_req_size;
 	mmc->max_blk_size = 512;
 	mmc->max_blk_count =  65535;
-- 
GitLab


From f91882d9208992e286bc174859d0661b74ed10e8 Mon Sep 17 00:00:00 2001
From: Yaroslav Rosomakho <yaroslavros@gmail.com>
Date: Fri, 23 Aug 2019 11:05:51 +0200
Subject: [PATCH 1729/1835] Add missing dma_unmap_sg calls to free relevant
 swiotlb bounce buffers. This prevents DMA leaks.

Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
---
 drivers/mmc/host/bcm2835-mmc.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
index dc0c64f7f3486..1311c8268e83e 100644
--- a/drivers/mmc/host/bcm2835-mmc.c
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -345,16 +345,17 @@ static void bcm2835_mmc_dma_complete(void *param)
 
 	host->use_dma = false;
 
-	if (host->data && !(host->data->flags & MMC_DATA_WRITE)) {
-		/* otherwise handled in SDHCI IRQ */
+	if (host->data) {
 		dma_chan = host->dma_chan_rxtx;
-		dir_data = DMA_FROM_DEVICE;
-
+		if (host->data->flags & MMC_DATA_WRITE)
+			dir_data = DMA_TO_DEVICE;
+		else
+			dir_data = DMA_FROM_DEVICE;
 		dma_unmap_sg(dma_chan->device->dev,
 		     host->data->sg, host->data->sg_len,
 		     dir_data);
-
-		bcm2835_mmc_finish_data(host);
+		if (! (host->data->flags & MMC_DATA_WRITE))
+			bcm2835_mmc_finish_data(host);
 	} else if (host->wait_for_dma) {
 		host->wait_for_dma = false;
 		tasklet_schedule(&host->finish_tasklet);
@@ -540,6 +541,8 @@ static void bcm2835_mmc_transfer_dma(struct bcm2835_host *host)
 		spin_unlock_irqrestore(&host->lock, flags);
 		dmaengine_submit(desc);
 		dma_async_issue_pending(dma_chan);
+	} else {
+		dma_unmap_sg(dma_chan->device->dev, host->data->sg, len, dir_data);
 	}
 
 }
-- 
GitLab


From 2013d6ec0bc06868da86e338d01124e5caa3b7a1 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 12 Jul 2019 11:13:30 +0200
Subject: [PATCH 1730/1835] dmaengine: ste_dma40: fix unneeded variable warning

[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]

clang-9 points out that there are two variables that depending on the
configuration may only be used in an ARRAY_SIZE() expression but not
referenced:

drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs[] = {
           ^
drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
static u32 d40_backup_regs_chan[] = {

Mark these __maybe_unused to shut up the warning.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ste_dma40.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index f4edfc56f34ef..3d55405c49cac 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
  * when the DMA hw is powered off.
  * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
  */
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
 	D40_DREG_LCPA,
 	D40_DREG_LCLA,
 	D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
 
 #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
 
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
 	D40_CHAN_REG_SSCFG,
 	D40_CHAN_REG_SSELT,
 	D40_CHAN_REG_SSPTR,
-- 
GitLab


From 7436dc2adeff1c7f018e8b48d049c81a7f4099d6 Mon Sep 17 00:00:00 2001
From: Anthony Iliopoulos <ailiopoulos@suse.com>
Date: Mon, 29 Jul 2019 14:40:40 +0200
Subject: [PATCH 1731/1835] nvme-multipath: revalidate nvme_ns_head gendisk in
 nvme_validate_ns

[ Upstream commit fab7772bfbcfe8fb8e3e352a6a8fcaf044cded17 ]

When CONFIG_NVME_MULTIPATH is set, only the hidden gendisk associated
with the per-controller ns is run through revalidate_disk when a
rescan is triggered, while the visible blockdev never gets its size
(bdev->bd_inode->i_size) updated to reflect any capacity changes that
may have occurred.

This prevents online resizing of nvme block devices and in extension of
any filesystems atop that will are unable to expand while mounted, as
userspace relies on the blockdev size for obtaining the disk capacity
(via BLKGETSIZE/64 ioctls).

Fix this by explicitly revalidating the actual namespace gendisk in
addition to the per-controller gendisk, when multipath is enabled.

Signed-off-by: Anthony Iliopoulos <ailiopoulos@suse.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index e26d1191c5ad6..d838a300ae770 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1557,6 +1557,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
 	if (ns->head->disk) {
 		nvme_update_disk_info(ns->head->disk, ns, id);
 		blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
+		revalidate_disk(ns->head->disk);
 	}
 #endif
 }
-- 
GitLab


From dfc438c0bc6d40204ca5c05da12abb57002004c0 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 30 Jul 2019 14:38:51 +0100
Subject: [PATCH 1732/1835] afs: Fix the CB.ProbeUuid service handler to reply
 correctly

[ Upstream commit 2067b2b3f4846402a040286135f98f46f8919939 ]

Fix the service handler function for the CB.ProbeUuid RPC call so that it
replies in the correct manner - that is an empty reply for success and an
abort of 1 for failure.

Putting 0 or 1 in an integer in the body of the reply should result in the
fileserver throwing an RX_PROTOCOL_ERROR abort and discarding its record of
the client; older servers, however, don't necessarily check that all the
data got consumed, and so might incorrectly think that they got a positive
response and associate the client with the wrong host record.

If the client is incorrectly associated, this will result in callbacks
intended for a different client being delivered to this one and then, when
the other client connects and responds positively, all of the callback
promises meant for the client that issued the improper response will be
lost and it won't receive any further change notifications.

Fixes: 9396d496d745 ("afs: support the CB.ProbeUuid RPC op")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/cmservice.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 9e51d6fe7e8f9..40c6860d4c632 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -423,18 +423,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
 	struct afs_call *call = container_of(work, struct afs_call, work);
 	struct afs_uuid *r = call->request;
 
-	struct {
-		__be32	match;
-	} reply;
-
 	_enter("");
 
 	if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
-		reply.match = htonl(0);
+		afs_send_empty_reply(call);
 	else
-		reply.match = htonl(1);
+		rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+					1, 1, "K-1");
 
-	afs_send_simple_reply(call, &reply, sizeof(reply));
 	afs_put_call(call);
 	_leave("");
 }
-- 
GitLab


From 8e5179f982f94a28dc661adcc1d8a6a50c6a7537 Mon Sep 17 00:00:00 2001
From: Marc Dionne <marc.dionne@auristor.com>
Date: Tue, 30 Jul 2019 14:38:51 +0100
Subject: [PATCH 1733/1835] afs: Fix loop index mixup in
 afs_deliver_vl_get_entry_by_name_u()

[ Upstream commit 4a46fdba449a5cd890271df5a9e23927d519ed00 ]

afs_deliver_vl_get_entry_by_name_u() scans through the vl entry
received from the volume location server and builds a return list
containing the sites that are currently valid.  When assigning
values for the return list, the index into the vl entry (i) is used
rather than the one for the new list (entry->nr_server).  If all
sites are usable, this works out fine as the indices will match.
If some sites are not valid, for example if AFS_VLSF_DONTUSE is
set, fs_mask and the uuid will be set for the wrong return site.

Fix this by using entry->nr_server as the index into the arrays
being filled in rather than i.

This can lead to EDESTADDRREQ errors if none of the returned sites
have a valid fs_mask.

Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation")
Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/vlclient.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index c3b740813fc71..c7dd47eaff29d 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -60,23 +60,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
 		struct afs_uuid__xdr *xdr;
 		struct afs_uuid *uuid;
 		int j;
+		int n = entry->nr_servers;
 
 		tmp = ntohl(uvldb->serverFlags[i]);
 		if (tmp & AFS_VLSF_DONTUSE ||
 		    (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
 			continue;
 		if (tmp & AFS_VLSF_RWVOL) {
-			entry->fs_mask[i] |= AFS_VOL_VTM_RW;
+			entry->fs_mask[n] |= AFS_VOL_VTM_RW;
 			if (vlflags & AFS_VLF_BACKEXISTS)
-				entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
+				entry->fs_mask[n] |= AFS_VOL_VTM_BAK;
 		}
 		if (tmp & AFS_VLSF_ROVOL)
-			entry->fs_mask[i] |= AFS_VOL_VTM_RO;
-		if (!entry->fs_mask[i])
+			entry->fs_mask[n] |= AFS_VOL_VTM_RO;
+		if (!entry->fs_mask[n])
 			continue;
 
 		xdr = &uvldb->serverNumber[i];
-		uuid = (struct afs_uuid *)&entry->fs_server[i];
+		uuid = (struct afs_uuid *)&entry->fs_server[n];
 		uuid->time_low			= xdr->time_low;
 		uuid->time_mid			= htons(ntohl(xdr->time_mid));
 		uuid->time_hi_and_version	= htons(ntohl(xdr->time_hi_and_version));
-- 
GitLab


From 24e093b9690588c41522245dfc777f7f9b210d52 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Tue, 30 Jul 2019 14:38:51 +0100
Subject: [PATCH 1734/1835] fs: afs: Fix a possible null-pointer dereference in
 afs_put_read()

[ Upstream commit a6eed4ab5dd4bfb696c1a3f49742b8d1846a66a0 ]

In afs_read_dir(), there is an if statement on line 255 to check whether
req->pages is NULL:
	if (!req->pages)
		goto error;

If req->pages is NULL, afs_put_read() on line 337 is executed.
In afs_put_read(), req->pages[i] is used on line 195.
Thus, a possible null-pointer dereference may occur in this case.

To fix this possible bug, an if statement is added in afs_put_read() to
check req->pages.

This bug is found by a static analysis tool STCheck written by us.

Fixes: f3ddee8dc4e2 ("afs: Fix directory handling")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/file.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/afs/file.c b/fs/afs/file.c
index 7d4f26198573d..843d3b970b845 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -193,11 +193,13 @@ void afs_put_read(struct afs_read *req)
 	int i;
 
 	if (refcount_dec_and_test(&req->usage)) {
-		for (i = 0; i < req->nr_pages; i++)
-			if (req->pages[i])
-				put_page(req->pages[i]);
-		if (req->pages != req->array)
-			kfree(req->pages);
+		if (req->pages) {
+			for (i = 0; i < req->nr_pages; i++)
+				if (req->pages[i])
+					put_page(req->pages[i]);
+			if (req->pages != req->array)
+				kfree(req->pages);
+		}
 		kfree(req);
 	}
 }
-- 
GitLab


From 9c55dc85d890b6705f3a7f801ca59c8a7059c4f4 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 30 Jul 2019 14:38:51 +0100
Subject: [PATCH 1735/1835] afs: Only update d_fsdata if different in
 afs_d_revalidate()

[ Upstream commit 5dc84855b0fc7e1db182b55c5564fd539d6eff92 ]

In the in-kernel afs filesystem, d_fsdata is set with the data version of
the parent directory.  afs_d_revalidate() will update this to the current
directory version, but it shouldn't do this if it the value it read from
d_fsdata is the same as no lock is held and cmpxchg() is not used.

Fix the code to only change the value if it is different from the current
directory version.

Fixes: 260a980317da ("[AFS]: Add "directory write" support.")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/dir.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 855bf2b79fed4..54e7f6f1405e2 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -937,7 +937,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 	dir_version = (long)dir->status.data_version;
 	de_version = (long)dentry->d_fsdata;
 	if (de_version == dir_version)
-		goto out_valid;
+		goto out_valid_noupdate;
 
 	dir_version = (long)dir->invalid_before;
 	if (de_version - dir_version >= 0)
@@ -1001,6 +1001,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 
 out_valid:
 	dentry->d_fsdata = (void *)dir_version;
+out_valid_noupdate:
 	dput(parent);
 	key_put(key);
 	_leave(" = 1 [valid]");
-- 
GitLab


From 32c0b8f1035189078415131ebfb35491a5eff1dc Mon Sep 17 00:00:00 2001
From: Logan Gunthorpe <logang@deltatee.com>
Date: Wed, 31 Jul 2019 17:35:32 -0600
Subject: [PATCH 1736/1835] nvmet-loop: Flush nvme_delete_wq when removing the
 port

[ Upstream commit 86b9a63e595ff03f9d0a7b92b6acc231fecefc29 ]

After calling nvme_loop_delete_ctrl(), the controllers will not
yet be deleted because nvme_delete_ctrl() only schedules work
to do the delete.

This means a race can occur if a port is removed but there
are still active controllers trying to access that memory.

To fix this, flush the nvme_delete_wq before returning from
nvme_loop_remove_port() so that any controllers that might
be in the process of being deleted won't access a freed port.

Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by : Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/loop.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 9908082b32c4b..137a27fa369cb 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -678,6 +678,14 @@ static void nvme_loop_remove_port(struct nvmet_port *port)
 	mutex_lock(&nvme_loop_ports_mutex);
 	list_del_init(&port->entry);
 	mutex_unlock(&nvme_loop_ports_mutex);
+
+	/*
+	 * Ensure any ctrls that are in the process of being
+	 * deleted are in fact deleted before we return
+	 * and free the port. This is to prevent active
+	 * ctrls from using a port after it's freed.
+	 */
+	flush_workqueue(nvme_delete_wq);
 }
 
 static const struct nvmet_fabrics_ops nvme_loop_ops = {
-- 
GitLab


From 431f579a534931980b623e9657c0b149d5bb0679 Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Wed, 31 Jul 2019 11:00:26 -0700
Subject: [PATCH 1737/1835] nvme: fix a possible deadlock when passthru
 commands sent to a multipath device

[ Upstream commit b9156daeb1601d69007b7e50efcf89d69d72ec1d ]

When the user issues a command with side effects, we will end up freezing
the namespace request queue when updating disk info (and the same for
the corresponding mpath disk node).

However, we are not freezing the mpath node request queue,
which means that mpath I/O can still come in and block on blk_queue_enter
(called from nvme_ns_head_make_request -> direct_make_request).

This is a deadlock, because blk_queue_enter will block until the inner
namespace request queue is unfroze, but that process is blocked because
the namespace revalidation is trying to update the mpath disk info
and freeze its request queue (which will never complete because
of the I/O that is blocked on blk_queue_enter).

Fix this by freezing all the subsystem nsheads request queues before
executing the passthru command. Given that these commands are infrequent
we should not worry about this temporary I/O freeze to keep things sane.

Here is the matching hang traces:
--
[ 374.465002] INFO: task systemd-udevd:17994 blocked for more than 122 seconds.
[ 374.472975] Not tainted 5.2.0-rc3-mpdebug+ #42
[ 374.478522] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 374.487274] systemd-udevd D 0 17994 1 0x00000000
[ 374.493407] Call Trace:
[ 374.496145] __schedule+0x2ef/0x620
[ 374.500047] schedule+0x38/0xa0
[ 374.503569] blk_queue_enter+0x139/0x220
[ 374.507959] ? remove_wait_queue+0x60/0x60
[ 374.512540] direct_make_request+0x60/0x130
[ 374.517219] nvme_ns_head_make_request+0x11d/0x420 [nvme_core]
[ 374.523740] ? generic_make_request_checks+0x307/0x6f0
[ 374.529484] generic_make_request+0x10d/0x2e0
[ 374.534356] submit_bio+0x75/0x140
[ 374.538163] ? guard_bio_eod+0x32/0xe0
[ 374.542361] submit_bh_wbc+0x171/0x1b0
[ 374.546553] block_read_full_page+0x1ed/0x330
[ 374.551426] ? check_disk_change+0x70/0x70
[ 374.556008] ? scan_shadow_nodes+0x30/0x30
[ 374.560588] blkdev_readpage+0x18/0x20
[ 374.564783] do_read_cache_page+0x301/0x860
[ 374.569463] ? blkdev_writepages+0x10/0x10
[ 374.574037] ? prep_new_page+0x88/0x130
[ 374.578329] ? get_page_from_freelist+0xa2f/0x1280
[ 374.583688] ? __alloc_pages_nodemask+0x179/0x320
[ 374.588947] read_cache_page+0x12/0x20
[ 374.593142] read_dev_sector+0x2d/0xd0
[ 374.597337] read_lba+0x104/0x1f0
[ 374.601046] find_valid_gpt+0xfa/0x720
[ 374.605243] ? string_nocheck+0x58/0x70
[ 374.609534] ? find_valid_gpt+0x720/0x720
[ 374.614016] efi_partition+0x89/0x430
[ 374.618113] ? string+0x48/0x60
[ 374.621632] ? snprintf+0x49/0x70
[ 374.625339] ? find_valid_gpt+0x720/0x720
[ 374.629828] check_partition+0x116/0x210
[ 374.634214] rescan_partitions+0xb6/0x360
[ 374.638699] __blkdev_reread_part+0x64/0x70
[ 374.643377] blkdev_reread_part+0x23/0x40
[ 374.647860] blkdev_ioctl+0x48c/0x990
[ 374.651956] block_ioctl+0x41/0x50
[ 374.655766] do_vfs_ioctl+0xa7/0x600
[ 374.659766] ? locks_lock_inode_wait+0xb1/0x150
[ 374.664832] ksys_ioctl+0x67/0x90
[ 374.668539] __x64_sys_ioctl+0x1a/0x20
[ 374.672732] do_syscall_64+0x5a/0x1c0
[ 374.676828] entry_SYSCALL_64_after_hwframe+0x44/0xa9

[ 374.738474] INFO: task nvmeadm:49141 blocked for more than 123 seconds.
[ 374.745871] Not tainted 5.2.0-rc3-mpdebug+ #42
[ 374.751419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 374.760170] nvmeadm D 0 49141 36333 0x00004080
[ 374.766301] Call Trace:
[ 374.769038] __schedule+0x2ef/0x620
[ 374.772939] schedule+0x38/0xa0
[ 374.776452] blk_mq_freeze_queue_wait+0x59/0x100
[ 374.781614] ? remove_wait_queue+0x60/0x60
[ 374.786192] blk_mq_freeze_queue+0x1a/0x20
[ 374.790773] nvme_update_disk_info.isra.57+0x5f/0x350 [nvme_core]
[ 374.797582] ? nvme_identify_ns.isra.50+0x71/0xc0 [nvme_core]
[ 374.804006] __nvme_revalidate_disk+0xe5/0x110 [nvme_core]
[ 374.810139] nvme_revalidate_disk+0xa6/0x120 [nvme_core]
[ 374.816078] ? nvme_submit_user_cmd+0x11e/0x320 [nvme_core]
[ 374.822299] nvme_user_cmd+0x264/0x370 [nvme_core]
[ 374.827661] nvme_dev_ioctl+0x112/0x1d0 [nvme_core]
[ 374.833114] do_vfs_ioctl+0xa7/0x600
[ 374.837117] ? __audit_syscall_entry+0xdd/0x130
[ 374.842184] ksys_ioctl+0x67/0x90
[ 374.845891] __x64_sys_ioctl+0x1a/0x20
[ 374.850082] do_syscall_64+0x5a/0x1c0
[ 374.854178] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--

Reported-by: James Puthukattukaran <james.puthukattukaran@oracle.com>
Tested-by: James Puthukattukaran <james.puthukattukaran@oracle.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c      |  5 +++++
 drivers/nvme/host/multipath.c | 30 ++++++++++++++++++++++++++++++
 drivers/nvme/host/nvme.h      | 12 ++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d838a300ae770..ae0b01059fc6d 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1183,6 +1183,9 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 	 */
 	if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
 		mutex_lock(&ctrl->scan_lock);
+		mutex_lock(&ctrl->subsys->lock);
+		nvme_mpath_start_freeze(ctrl->subsys);
+		nvme_mpath_wait_freeze(ctrl->subsys);
 		nvme_start_freeze(ctrl);
 		nvme_wait_freeze(ctrl);
 	}
@@ -1213,6 +1216,8 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
 		nvme_update_formats(ctrl);
 	if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
 		nvme_unfreeze(ctrl);
+		nvme_mpath_unfreeze(ctrl->subsys);
+		mutex_unlock(&ctrl->subsys->lock);
 		mutex_unlock(&ctrl->scan_lock);
 	}
 	if (effects & NVME_CMD_EFFECTS_CCC)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index a11e210d173e4..05d6371c7f385 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -20,6 +20,36 @@ module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
 	"turn on native support for multiple controllers per subsystem");
 
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
+{
+	struct nvme_ns_head *h;
+
+	lockdep_assert_held(&subsys->lock);
+	list_for_each_entry(h, &subsys->nsheads, entry)
+		if (h->disk)
+			blk_mq_unfreeze_queue(h->disk->queue);
+}
+
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+{
+	struct nvme_ns_head *h;
+
+	lockdep_assert_held(&subsys->lock);
+	list_for_each_entry(h, &subsys->nsheads, entry)
+		if (h->disk)
+			blk_mq_freeze_queue_wait(h->disk->queue);
+}
+
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+{
+	struct nvme_ns_head *h;
+
+	lockdep_assert_held(&subsys->lock);
+	list_for_each_entry(h, &subsys->nsheads, entry)
+		if (h->disk)
+			blk_freeze_queue_start(h->disk->queue);
+}
+
 /*
  * If multipathing is enabled we need to always use the subsystem instance
  * number for numbering our devices to avoid conflicts between subsystems that
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index d5e29b57eb340..2653e1f4196d5 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -469,6 +469,9 @@ static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
 	return ctrl->ana_log_buf != NULL;
 }
 
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys);
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
 void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
 			struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
@@ -553,6 +556,15 @@ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
 static inline void nvme_mpath_stop(struct nvme_ctrl *ctrl)
 {
 }
+static inline void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
+{
+}
+static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+{
+}
+static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+{
+}
 #endif /* CONFIG_NVME_MULTIPATH */
 
 #ifdef CONFIG_NVM
-- 
GitLab


From 4a9829195d9e6c5cec1ea65e030da80e64c38db0 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Mon, 29 Jul 2019 16:34:52 -0600
Subject: [PATCH 1738/1835] nvme-pci: Fix async probe remove race

[ Upstream commit bd46a90634302bfe791e93ad5496f98f165f7ae0 ]

Ensure the controller is not in the NEW state when nvme_probe() exits.
This will always allow a subsequent nvme_remove() to set the state to
DELETING, fixing a potential race between the initial asynchronous probe
and device removal.

Reported-by: Li Zhong <lizhongfs@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 0a5d064f82ca3..a64a8bca0d5b9 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2468,7 +2468,7 @@ static void nvme_async_probe(void *data, async_cookie_t cookie)
 {
 	struct nvme_dev *dev = data;
 
-	nvme_reset_ctrl_sync(&dev->ctrl);
+	flush_work(&dev->ctrl.reset_work);
 	flush_work(&dev->ctrl.scan_work);
 	nvme_put_ctrl(&dev->ctrl);
 }
@@ -2535,6 +2535,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
+	nvme_reset_ctrl(&dev->ctrl);
 	nvme_get_ctrl(&dev->ctrl);
 	async_schedule(nvme_async_probe, dev);
 
-- 
GitLab


From 29b064d300a20ee7c7c0f1fd82e6a4d5a3d61e4d Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Thu, 25 Jul 2019 18:40:05 -0500
Subject: [PATCH 1739/1835] soundwire: cadence_master: fix register definition
 for SLAVE_STATE

[ Upstream commit b07dd9b400981f487940a4d84292d3a0e7cd9362 ]

wrong prefix and wrong macro.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20190725234032.21152-14-pierre-louis.bossart@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/cadence_master.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
index cb6a331f448ab..d3d7de5a319c5 100644
--- a/drivers/soundwire/cadence_master.c
+++ b/drivers/soundwire/cadence_master.c
@@ -81,8 +81,8 @@
 
 #define CDNS_MCP_INTSET				0x4C
 
-#define CDNS_SDW_SLAVE_STAT			0x50
-#define CDNS_MCP_SLAVE_STAT_MASK		BIT(1, 0)
+#define CDNS_MCP_SLAVE_STAT			0x50
+#define CDNS_MCP_SLAVE_STAT_MASK		GENMASK(1, 0)
 
 #define CDNS_MCP_SLAVE_INTSTAT0			0x54
 #define CDNS_MCP_SLAVE_INTSTAT1			0x58
-- 
GitLab


From 2f87eb895ebde8da302b5a52699a3ba45ccc27d5 Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Thu, 25 Jul 2019 18:40:06 -0500
Subject: [PATCH 1740/1835] soundwire: cadence_master: fix definitions for
 INTSTAT0/1

[ Upstream commit 664b16589f882202b8fa8149d0074f3159bade76 ]

Two off-by-one errors: INTSTAT0 missed BIT(31) and INTSTAT1 is only
defined on first 16 bits.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20190725234032.21152-15-pierre-louis.bossart@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/cadence_master.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
index d3d7de5a319c5..70f78eda037e8 100644
--- a/drivers/soundwire/cadence_master.c
+++ b/drivers/soundwire/cadence_master.c
@@ -96,8 +96,8 @@
 #define CDNS_MCP_SLAVE_INTMASK0			0x5C
 #define CDNS_MCP_SLAVE_INTMASK1			0x60
 
-#define CDNS_MCP_SLAVE_INTMASK0_MASK		GENMASK(30, 0)
-#define CDNS_MCP_SLAVE_INTMASK1_MASK		GENMASK(16, 0)
+#define CDNS_MCP_SLAVE_INTMASK0_MASK		GENMASK(31, 0)
+#define CDNS_MCP_SLAVE_INTMASK1_MASK		GENMASK(15, 0)
 
 #define CDNS_MCP_PORT_INTSTAT			0x64
 #define CDNS_MCP_PDI_STAT			0x6C
-- 
GitLab


From 377ebe613ed8fa55b19e6cc72d289f261e10a28d Mon Sep 17 00:00:00 2001
From: zhengbin <zhengbin13@huawei.com>
Date: Mon, 8 Jul 2019 20:42:18 +0800
Subject: [PATCH 1741/1835] auxdisplay: panel: need to delete scan_timer when
 misc_register fails in panel_attach

[ Upstream commit b33d567560c1aadf3033290d74d4fd67af47aa61 ]

In panel_attach, if misc_register fails, we need to delete scan_timer,
which was setup in keypad_init->init_scan_timer.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/auxdisplay/panel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index 3b25a643058c9..0b8e2a7d6e934 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1618,6 +1618,8 @@ static void panel_attach(struct parport *port)
 	return;
 
 err_lcd_unreg:
+	if (scan_timer.function)
+		del_timer_sync(&scan_timer);
 	if (lcd.enabled)
 		charlcd_unregister(lcd.charlcd);
 err_unreg_device:
-- 
GitLab


From 71d24f45f905a7ab481ed9c62ffc400b7961221d Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Mon, 29 Jul 2019 10:08:49 +0800
Subject: [PATCH 1742/1835] dmaengine: stm32-mdma: Fix a possible null-pointer
 dereference in stm32_mdma_irq_handler()

[ Upstream commit 39c71a5b8212f4b502d9a630c6706ac723abd422 ]

In stm32_mdma_irq_handler(), chan is checked on line 1368.
When chan is NULL, it is still used on line 1369:
    dev_err(chan2dev(chan), "MDMA channel not initialized\n");

Thus, a possible null-pointer dereference may occur.

To fix this bug, "dev_dbg(mdma2dev(dmadev), ...)" is used instead.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver")
Link: https://lore.kernel.org/r/20190729020849.17971-1-baijiaju1990@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/stm32-mdma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
index 06dd1725375e5..8c3c3e5b812a8 100644
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -1376,7 +1376,7 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid)
 
 	chan = &dmadev->chan[id];
 	if (!chan) {
-		dev_err(chan2dev(chan), "MDMA channel not initialized\n");
+		dev_dbg(mdma2dev(dmadev), "MDMA channel not initialized\n");
 		goto exit;
 	}
 
-- 
GitLab


From 7f4b81365e83084eb64534e13998c3c97248380f Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil@xs4all.nl>
Date: Fri, 9 Aug 2019 10:32:40 +0200
Subject: [PATCH 1743/1835] omap-dma/omap_vout_vrfb: fix off-by-one fi value

[ Upstream commit d555c34338cae844b207564c482e5a3fb089d25e ]

The OMAP 4 TRM specifies that when using double-index addressing
the address increases by the ES plus the EI value minus 1 within
a frame. When a full frame is transferred, the address increases
by the ES plus the frame index (FI) value minus 1.

The omap-dma code didn't account for the 'minus 1' in the FI register.
To get correct addressing, add 1 to the src_icg value.

This was found when testing a hacked version of the media m2m-deinterlace.c
driver on a Pandaboard.

The only other source that uses this feature is omap_vout_vrfb.c,
and that adds a + 1 when setting the dst_icg. This is a workaround
for the broken omap-dma.c behavior. So remove the workaround at the
same time that we fix omap-dma.c.

I tested the omap_vout driver with a Beagle XM board to check that
the '+ 1' in omap_vout_vrfb.c was indeed a workaround for the omap-dma
bug.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Acked-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Link: https://lore.kernel.org/r/952e7f51-f208-9333-6f58-b7ed20d2ea0b@xs4all.nl
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ti/omap-dma.c                    | 4 ++--
 drivers/media/platform/omap/omap_vout_vrfb.c | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index a4a931ddf6f69..aeb9c29e52554 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -1237,7 +1237,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
 	if (src_icg) {
 		d->ccr |= CCR_SRC_AMODE_DBLIDX;
 		d->ei = 1;
-		d->fi = src_icg;
+		d->fi = src_icg + 1;
 	} else if (xt->src_inc) {
 		d->ccr |= CCR_SRC_AMODE_POSTINC;
 		d->fi = 0;
@@ -1252,7 +1252,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
 	if (dst_icg) {
 		d->ccr |= CCR_DST_AMODE_DBLIDX;
 		sg->ei = 1;
-		sg->fi = dst_icg;
+		sg->fi = dst_icg + 1;
 	} else if (xt->dst_inc) {
 		d->ccr |= CCR_DST_AMODE_POSTINC;
 		sg->fi = 0;
diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c
index 29e3f5da59c1f..11ec048929e80 100644
--- a/drivers/media/platform/omap/omap_vout_vrfb.c
+++ b/drivers/media/platform/omap/omap_vout_vrfb.c
@@ -253,8 +253,7 @@ int omap_vout_prepare_vrfb(struct omap_vout_device *vout,
 	 */
 
 	pixsize = vout->bpp * vout->vrfb_bpp;
-	dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) -
-		  (vout->pix.width * vout->bpp)) + 1;
+	dst_icg = MAX_PIXELS_PER_LINE * pixsize - vout->pix.width * vout->bpp;
 
 	xt->src_start = vout->buf_phy_addr[vb->i];
 	xt->dst_start = vout->vrfb_context[vb->i].paddr[0];
-- 
GitLab


From 21ec20f62fae40d39ac2076e57d190b155ad27b0 Mon Sep 17 00:00:00 2001
From: Robin Murphy <robin.murphy@arm.com>
Date: Mon, 29 Jul 2019 17:46:00 +0100
Subject: [PATCH 1744/1835] iommu/dma: Handle SG length overflow better

[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ]

Since scatterlist dimensions are all unsigned ints, in the relatively
rare cases where a device's max_segment_size is set to UINT_MAX, then
the "cur_len + s_length <= max_len" check in __finalise_sg() will always
return true. As a result, the corner case of such a device mapping an
excessively large scatterlist which is mergeable to or beyond a total
length of 4GB can lead to overflow and a bogus truncated dma_length in
the resulting segment.

As we already assume that any single segment must be no longer than
max_len to begin with, this can easily be addressed by reshuffling the
comparison.

Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
Reported-by: Nicolin Chen <nicoleotsuka@gmail.com>
Tested-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/dma-iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 511ff9a1d6d94..f9dbb064f9571 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -675,7 +675,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
 		 * - and wouldn't make the resulting output segment too long
 		 */
 		if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
-		    (cur_len + s_length <= max_len)) {
+		    (max_len - cur_len >= s_length)) {
 			/* ...then concatenate it with the previous one */
 			cur_len += s_length;
 		} else {
-- 
GitLab


From 122ab8ea641cd7752290d2c0179a6e8b42c48d8a Mon Sep 17 00:00:00 2001
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Fri, 26 Jul 2019 14:59:03 +1000
Subject: [PATCH 1745/1835] usb: gadget: composite: Clear "suspended" on
 reset/disconnect

[ Upstream commit 602fda17c7356bb7ae98467d93549057481d11dd ]

In some cases, one can get out of suspend with a reset or
a disconnect followed by a reconnect. Previously we would
leave a stale suspended flag set.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/composite.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index b8a15840b4ffd..dfcabadeed01b 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1976,6 +1976,7 @@ void composite_disconnect(struct usb_gadget *gadget)
 	 * disconnect callbacks?
 	 */
 	spin_lock_irqsave(&cdev->lock, flags);
+	cdev->suspended = 0;
 	if (cdev->config)
 		reset_config(cdev);
 	if (cdev->driver->disconnect)
-- 
GitLab


From 339c1572a2664cc30fd2e3521e1bdcc8f5ce8333 Mon Sep 17 00:00:00 2001
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Fri, 26 Jul 2019 14:59:04 +1000
Subject: [PATCH 1746/1835] usb: gadget: mass_storage: Fix races between
 fsg_disable and fsg_set_alt

[ Upstream commit 4a56a478a525d6427be90753451c40e1327caa1a ]

If fsg_disable() and fsg_set_alt() are called too closely to each
other (for example due to a quick reset/reconnect), what can happen
is that fsg_set_alt sets common->new_fsg from an interrupt while
handle_exception is trying to process the config change caused by
fsg_disable():

	fsg_disable()
	...
	handle_exception()
		sets state back to FSG_STATE_NORMAL
		hasn't yet called do_set_interface()
		or is inside it.

 ---> interrupt
	fsg_set_alt
		sets common->new_fsg
		queues a new FSG_STATE_CONFIG_CHANGE
 <---

Now, the first handle_exception can "see" the updated
new_fsg, treats it as if it was a fsg_set_alt() response,
call usb_composite_setup_continue() etc...

But then, the thread sees the second FSG_STATE_CONFIG_CHANGE,
and goes back down the same path, wipes and reattaches a now
active fsg, and .. calls usb_composite_setup_continue() which
at this point is wrong.

Not only we get a backtrace, but I suspect the second set_interface
wrecks some state causing the host to get upset in my case.

This fixes it by replacing "new_fsg" by a "state argument" (same
principle) which is set in the same lock section as the state
update, and retrieved similarly.

That way, there is never any discrepancy between the dequeued
state and the observed value of it. We keep the ability to have
the latest reconfig operation take precedence, but we guarantee
that once "dequeued" the argument (new_fsg) will not be clobbered
by any new event.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++-------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 1074cb82ec172..0b7b4d09785b6 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -261,7 +261,7 @@ struct fsg_common;
 struct fsg_common {
 	struct usb_gadget	*gadget;
 	struct usb_composite_dev *cdev;
-	struct fsg_dev		*fsg, *new_fsg;
+	struct fsg_dev		*fsg;
 	wait_queue_head_t	io_wait;
 	wait_queue_head_t	fsg_wait;
 
@@ -290,6 +290,7 @@ struct fsg_common {
 	unsigned int		bulk_out_maxpacket;
 	enum fsg_state		state;		/* For exception handling */
 	unsigned int		exception_req_tag;
+	void			*exception_arg;
 
 	enum data_direction	data_dir;
 	u32			data_size;
@@ -391,7 +392,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 
 /* These routines may be called in process context or in_irq */
 
-static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
+			      void *arg)
 {
 	unsigned long		flags;
 
@@ -404,6 +406,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
 	if (common->state <= new_state) {
 		common->exception_req_tag = common->ep0_req_tag;
 		common->state = new_state;
+		common->exception_arg = arg;
 		if (common->thread_task)
 			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
 				      common->thread_task);
@@ -411,6 +414,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
 	spin_unlock_irqrestore(&common->lock, flags);
 }
 
+static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+{
+	__raise_exception(common, new_state, NULL);
+}
 
 /*-------------------------------------------------------------------------*/
 
@@ -2285,16 +2292,16 @@ reset:
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
 	struct fsg_dev *fsg = fsg_from_func(f);
-	fsg->common->new_fsg = fsg;
-	raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+
+	__raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
 	return USB_GADGET_DELAYED_STATUS;
 }
 
 static void fsg_disable(struct usb_function *f)
 {
 	struct fsg_dev *fsg = fsg_from_func(f);
-	fsg->common->new_fsg = NULL;
-	raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+
+	__raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
 }
 
 
@@ -2307,6 +2314,7 @@ static void handle_exception(struct fsg_common *common)
 	enum fsg_state		old_state;
 	struct fsg_lun		*curlun;
 	unsigned int		exception_req_tag;
+	struct fsg_dev		*new_fsg;
 
 	/*
 	 * Clear the existing signals.  Anything but SIGUSR1 is converted
@@ -2360,6 +2368,7 @@ static void handle_exception(struct fsg_common *common)
 	common->next_buffhd_to_fill = &common->buffhds[0];
 	common->next_buffhd_to_drain = &common->buffhds[0];
 	exception_req_tag = common->exception_req_tag;
+	new_fsg = common->exception_arg;
 	old_state = common->state;
 	common->state = FSG_STATE_NORMAL;
 
@@ -2413,8 +2422,8 @@ static void handle_exception(struct fsg_common *common)
 		break;
 
 	case FSG_STATE_CONFIG_CHANGE:
-		do_set_interface(common, common->new_fsg);
-		if (common->new_fsg)
+		do_set_interface(common, new_fsg);
+		if (new_fsg)
 			usb_composite_setup_continue(common->cdev);
 		break;
 
@@ -2989,8 +2998,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 
 	DBG(fsg, "unbind\n");
 	if (fsg->common->fsg == fsg) {
-		fsg->common->new_fsg = NULL;
-		raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+		__raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
 		/* FIXME: make interruptible or killable somehow? */
 		wait_event(common->fsg_wait, common->fsg != fsg);
 	}
-- 
GitLab


From eb535aaf3cd77ae188f715b22b823f5f16ad3075 Mon Sep 17 00:00:00 2001
From: Wenwen Wang <wenwen@cs.uga.edu>
Date: Sun, 11 Aug 2019 12:23:22 -0500
Subject: [PATCH 1747/1835] xen/blkback: fix memory leaks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ]

In read_per_ring_refs(), after 'req' and related memory regions are
allocated, xen_blkif_map() is invoked to map the shared frame, irq, and
etc. However, if this mapping process fails, no cleanup is performed,
leading to memory leaks. To fix this issue, invoke the cleanup before
returning the error.

Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/xen-blkback/xenbus.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index a4bc74e72c394..55869b362fdfb 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -974,6 +974,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
 	}
 	blkif->nr_ring_pages = nr_grefs;
 
+	err = -ENOMEM;
 	for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
 		req = kzalloc(sizeof(*req), GFP_KERNEL);
 		if (!req)
@@ -996,7 +997,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
 	err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
 	if (err) {
 		xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
-		return err;
+		goto fail;
 	}
 
 	return 0;
@@ -1016,8 +1017,7 @@ fail:
 		}
 		kfree(req);
 	}
-	return -ENOMEM;
-
+	return err;
 }
 
 static int connect_ring(struct backend_info *be)
-- 
GitLab


From 8bd5426889c20809174c666771e23cde009a7e65 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Mon, 12 Aug 2019 16:02:25 +0100
Subject: [PATCH 1748/1835] arm64: cpufeature: Don't treat granule sizes as
 strict

[ Upstream commit 5717fe5ab38f9ccb32718bcb03bea68409c9cce4 ]

If a CPU doesn't support the page size for which the kernel is
configured, then we will complain and refuse to bring it online. For
secondary CPUs (and the boot CPU on a system booting with EFI), we will
also print an error identifying the mismatch.

Consequently, the only time that the cpufeature code can detect a
granule size mismatch is for a granule other than the one that is
currently being used. Although we would rather such systems didn't
exist, we've unfortunately lost that battle and Kevin reports that
on his amlogic S922X (odroid-n2 board) we end up warning and taining
with defconfig because 16k pages are not supported by all of the CPUs.

In such a situation, we don't actually care about the feature mismatch,
particularly now that KVM only exposes the sanitised view of the CPU
registers (commit 93390c0a1b20 - "arm64: KVM: Hide unsupported AArch64
CPU features from guests"). Treat the granule fields as non-strict and
let Kevin run without a tainted kernel.

Cc: Marc Zyngier <maz@kernel.org>
Reported-by: Kevin Hilman <khilman@baylibre.com>
Tested-by: Kevin Hilman <khilman@baylibre.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
[catalin.marinas@arm.com: changelog updated with KVM sanitised regs commit]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/cpufeature.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index bce06083685dc..94babc3d0ec2c 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -165,9 +165,17 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
 };
 
 static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
-	S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
-	S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
+	/*
+	 * We already refuse to boot CPUs that don't support our configured
+	 * page size, so we can only detect mismatches for a page size other
+	 * than the one we're currently using. Unfortunately, SoCs like this
+	 * exist in the wild so, even though we don't like it, we'll have to go
+	 * along with it and treat them as non-strict.
+	 */
+	S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
+	S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
+	ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
+
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_BIGENDEL0_SHIFT, 4, 0),
 	/* Linux shouldn't care about secure memory */
 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_SNSMEM_SHIFT, 4, 0),
-- 
GitLab


From 7048cd814f4e162427686c816e26511cd3e841b5 Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Thu, 8 Aug 2019 21:39:10 +0200
Subject: [PATCH 1749/1835] i2c: rcar: avoid race when unregistering slave
 client

[ Upstream commit 7b814d852af6944657c2961039f404c4490771c0 ]

After we disabled interrupts, there might still be an active one
running. Sync before clearing the pointer to the slave device.

Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
Reported-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-rcar.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 254e6219e5389..2c29f901d3090 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -139,6 +139,7 @@ struct rcar_i2c_priv {
 	enum dma_data_direction dma_direction;
 
 	struct reset_control *rstc;
+	int irq;
 };
 
 #define rcar_i2c_priv_to_dev(p)		((p)->adap.dev.parent)
@@ -859,9 +860,11 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 
 	WARN_ON(!priv->slave);
 
+	/* disable irqs and ensure none is running before clearing ptr */
 	rcar_i2c_write(priv, ICSIER, 0);
 	rcar_i2c_write(priv, ICSCR, 0);
 
+	synchronize_irq(priv->irq);
 	priv->slave = NULL;
 
 	pm_runtime_put(rcar_i2c_priv_to_dev(priv));
@@ -916,7 +919,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
 	struct i2c_adapter *adap;
 	struct device *dev = &pdev->dev;
 	struct i2c_timings i2c_t;
-	int irq, ret;
+	int ret;
 
 	priv = devm_kzalloc(dev, sizeof(struct rcar_i2c_priv), GFP_KERNEL);
 	if (!priv)
@@ -979,10 +982,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
 		pm_runtime_put(dev);
 
 
-	irq = platform_get_irq(pdev, 0);
-	ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv);
+	priv->irq = platform_get_irq(pdev, 0);
+	ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv);
 	if (ret < 0) {
-		dev_err(dev, "cannot get irq %d\n", irq);
+		dev_err(dev, "cannot get irq %d\n", priv->irq);
 		goto out_pm_disable;
 	}
 
-- 
GitLab


From 1cc2ef1cfbd88c5e742f2ee483033d362f4eaa89 Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Thu, 8 Aug 2019 21:54:17 +0200
Subject: [PATCH 1750/1835] i2c: emev2: avoid race when unregistering slave
 client

[ Upstream commit d7437fc0d8291181debe032671a289b6bd93f46f ]

After we disabled interrupts, there might still be an active one
running. Sync before clearing the pointer to the slave device.

Fixes: c31d0a00021d ("i2c: emev2: add slave support")
Reported-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-emev2.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
index 35b302d983e0d..959d4912ec0d5 100644
--- a/drivers/i2c/busses/i2c-emev2.c
+++ b/drivers/i2c/busses/i2c-emev2.c
@@ -69,6 +69,7 @@ struct em_i2c_device {
 	struct completion msg_done;
 	struct clk *sclk;
 	struct i2c_client *slave;
+	int irq;
 };
 
 static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
@@ -339,6 +340,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave)
 
 	writeb(0, priv->base + I2C_OFS_SVA0);
 
+	/*
+	 * Wait for interrupt to finish. New slave irqs cannot happen because we
+	 * cleared the slave address and, thus, only extension codes will be
+	 * detected which do not use the slave ptr.
+	 */
+	synchronize_irq(priv->irq);
 	priv->slave = NULL;
 
 	return 0;
@@ -355,7 +362,7 @@ static int em_i2c_probe(struct platform_device *pdev)
 {
 	struct em_i2c_device *priv;
 	struct resource *r;
-	int irq, ret;
+	int ret;
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -390,8 +397,8 @@ static int em_i2c_probe(struct platform_device *pdev)
 
 	em_i2c_reset(&priv->adap);
 
-	irq = platform_get_irq(pdev, 0);
-	ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
+	priv->irq = platform_get_irq(pdev, 0);
+	ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
 				"em_i2c", priv);
 	if (ret)
 		goto err_clk;
@@ -401,7 +408,8 @@ static int em_i2c_probe(struct platform_device *pdev)
 	if (ret)
 		goto err_clk;
 
-	dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
+	dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
+		 priv->irq);
 
 	return 0;
 
-- 
GitLab


From 37654abed26f77429c23de4d777842320c95945c Mon Sep 17 00:00:00 2001
From: "Y.C. Chen" <yc_chen@aspeedtech.com>
Date: Wed, 11 Apr 2018 09:27:39 +0800
Subject: [PATCH 1751/1835] drm/ast: Fixed reboot test may cause system hanged

[ Upstream commit 05b439711f6ff8700e8660f97a1179650778b9cb ]

There is another thread still access standard VGA I/O while loading drm driver.
Disable standard VGA I/O decode to avoid this issue.

Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com>
Reviewed-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/ast/ast_main.c | 5 ++++-
 drivers/gpu/drm/ast/ast_mode.c | 2 +-
 drivers/gpu/drm/ast/ast_post.c | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 373700c05a00f..224fa1ef87ff9 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
 
 
 	/* Enable extended register access */
-	ast_enable_mmio(dev);
 	ast_open_key(ast);
+	ast_enable_mmio(dev);
 
 	/* Find out whether P2A works or whether to use device-tree */
 	ast_detect_config_mode(dev, &scu_rev);
@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev)
 {
 	struct ast_private *ast = dev->dev_private;
 
+	/* enable standard VGA decode */
+	ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04);
+
 	ast_release_firmware(dev);
 	kfree(ast->dp501_fw_addr);
 	ast_mode_fini(dev);
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index 8bb355d5d43d8..9d92d2d2fcfc7 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -600,7 +600,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc,
 		return -EINVAL;
 	ast_open_key(ast);
 
-	ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
+	ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
 
 	ast_set_std_reg(crtc, adjusted_mode, &vbios_mode);
 	ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode);
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index f7d421359d564..c1d1ac51d1c20 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev)
 {
 	struct ast_private *ast = dev->dev_private;
 
-	ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
+	ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
 }
 
 
-- 
GitLab


From 39ad18a042ab939e4f5a307b2057ea550b376537 Mon Sep 17 00:00:00 2001
From: Hans Ulli Kroll <ulli.kroll@googlemail.com>
Date: Sat, 10 Aug 2019 17:04:58 +0200
Subject: [PATCH 1752/1835] usb: host: fotg2: restart hcd after port reset

[ Upstream commit 777758888ffe59ef754cc39ab2f275dc277732f4 ]

On the Gemini SoC the FOTG2 stalls after port reset
so restart the HCD after each port reset.

Signed-off-by: Hans Ulli Kroll <ulli.kroll@googlemail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/fotg210-hcd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index e64eb47770c8b..2d5a72c15069e 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -1627,6 +1627,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			/* see what we found out */
 			temp = check_reset_complete(fotg210, wIndex, status_reg,
 					fotg210_readl(fotg210, status_reg));
+
+			/* restart schedule */
+			fotg210->command |= CMD_RUN;
+			fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
 		}
 
 		if (!(temp & (PORT_RESUME|PORT_RESET))) {
-- 
GitLab


From 0c39d818aae44bc7033a7b6b49e2f041cbfd68ab Mon Sep 17 00:00:00 2001
From: Adrian Vladu <avladu@cloudbasesolutions.com>
Date: Mon, 6 May 2019 17:27:37 +0000
Subject: [PATCH 1753/1835] tools: hv: fixed Python pep8/flake8 warnings for
 lsvmbus

[ Upstream commit 5912e791f3018de0a007c8cfa9cb38c97d3e5f5c ]

Fixed pep8/flake8 python style code for lsvmbus tool.

The TAB indentation was on purpose ignored (pep8 rule W191) to make
sure the code is complying with the Linux code guideline.
The following command doe not show any warnings now:
pep8 --ignore=W191 lsvmbus
flake8 --ignore=W191 lsvmbus

Signed-off-by: Adrian Vladu <avladu@cloudbasesolutions.com>

Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/hv/lsvmbus | 75 +++++++++++++++++++++++++++---------------------
 1 file changed, 42 insertions(+), 33 deletions(-)

diff --git a/tools/hv/lsvmbus b/tools/hv/lsvmbus
index 55e7374bade0d..099f2c44dbed2 100644
--- a/tools/hv/lsvmbus
+++ b/tools/hv/lsvmbus
@@ -4,10 +4,10 @@
 import os
 from optparse import OptionParser
 
+help_msg = "print verbose messages. Try -vv, -vvv for  more verbose messages"
 parser = OptionParser()
-parser.add_option("-v", "--verbose", dest="verbose",
-		   help="print verbose messages. Try -vv, -vvv for \
-			more verbose messages", action="count")
+parser.add_option(
+	"-v", "--verbose", dest="verbose", help=help_msg, action="count")
 
 (options, args) = parser.parse_args()
 
@@ -21,27 +21,28 @@ if not os.path.isdir(vmbus_sys_path):
 	exit(-1)
 
 vmbus_dev_dict = {
-	'{0e0b6031-5213-4934-818b-38d90ced39db}' : '[Operating system shutdown]',
-	'{9527e630-d0ae-497b-adce-e80ab0175caf}' : '[Time Synchronization]',
-	'{57164f39-9115-4e78-ab55-382f3bd5422d}' : '[Heartbeat]',
-	'{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}' : '[Data Exchange]',
-	'{35fa2e29-ea23-4236-96ae-3a6ebacba440}' : '[Backup (volume checkpoint)]',
-	'{34d14be3-dee4-41c8-9ae7-6b174977c192}' : '[Guest services]',
-	'{525074dc-8985-46e2-8057-a307dc18a502}' : '[Dynamic Memory]',
-	'{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}' : 'Synthetic mouse',
-	'{f912ad6d-2b17-48ea-bd65-f927a61c7684}' : 'Synthetic keyboard',
-	'{da0a7802-e377-4aac-8e77-0558eb1073f8}' : 'Synthetic framebuffer adapter',
-	'{f8615163-df3e-46c5-913f-f2d2f965ed0e}' : 'Synthetic network adapter',
-	'{32412632-86cb-44a2-9b5c-50d1417354f5}' : 'Synthetic IDE Controller',
-	'{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}' : 'Synthetic SCSI Controller',
-	'{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}' : 'Synthetic fiber channel adapter',
-	'{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}' : 'Synthetic RDMA adapter',
-	'{44c4f61d-4444-4400-9d52-802e27ede19f}' : 'PCI Express pass-through',
-	'{276aacf4-ac15-426c-98dd-7521ad3f01fe}' : '[Reserved system device]',
-	'{f8e65716-3cb3-4a06-9a60-1889c5cccab5}' : '[Reserved system device]',
-	'{3375baf4-9e15-4b30-b765-67acb10d607b}' : '[Reserved system device]',
+	'{0e0b6031-5213-4934-818b-38d90ced39db}': '[Operating system shutdown]',
+	'{9527e630-d0ae-497b-adce-e80ab0175caf}': '[Time Synchronization]',
+	'{57164f39-9115-4e78-ab55-382f3bd5422d}': '[Heartbeat]',
+	'{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}': '[Data Exchange]',
+	'{35fa2e29-ea23-4236-96ae-3a6ebacba440}': '[Backup (volume checkpoint)]',
+	'{34d14be3-dee4-41c8-9ae7-6b174977c192}': '[Guest services]',
+	'{525074dc-8985-46e2-8057-a307dc18a502}': '[Dynamic Memory]',
+	'{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}': 'Synthetic mouse',
+	'{f912ad6d-2b17-48ea-bd65-f927a61c7684}': 'Synthetic keyboard',
+	'{da0a7802-e377-4aac-8e77-0558eb1073f8}': 'Synthetic framebuffer adapter',
+	'{f8615163-df3e-46c5-913f-f2d2f965ed0e}': 'Synthetic network adapter',
+	'{32412632-86cb-44a2-9b5c-50d1417354f5}': 'Synthetic IDE Controller',
+	'{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}': 'Synthetic SCSI Controller',
+	'{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}': 'Synthetic fiber channel adapter',
+	'{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}': 'Synthetic RDMA adapter',
+	'{44c4f61d-4444-4400-9d52-802e27ede19f}': 'PCI Express pass-through',
+	'{276aacf4-ac15-426c-98dd-7521ad3f01fe}': '[Reserved system device]',
+	'{f8e65716-3cb3-4a06-9a60-1889c5cccab5}': '[Reserved system device]',
+	'{3375baf4-9e15-4b30-b765-67acb10d607b}': '[Reserved system device]',
 }
 
+
 def get_vmbus_dev_attr(dev_name, attr):
 	try:
 		f = open('%s/%s/%s' % (vmbus_sys_path, dev_name, attr), 'r')
@@ -52,6 +53,7 @@ def get_vmbus_dev_attr(dev_name, attr):
 
 	return lines
 
+
 class VMBus_Dev:
 	pass
 
@@ -66,12 +68,13 @@ for f in os.listdir(vmbus_sys_path):
 
 	chn_vp_mapping = get_vmbus_dev_attr(f, 'channel_vp_mapping')
 	chn_vp_mapping = [c.strip() for c in chn_vp_mapping]
-	chn_vp_mapping = sorted(chn_vp_mapping,
-		key = lambda c : int(c.split(':')[0]))
+	chn_vp_mapping = sorted(
+		chn_vp_mapping, key=lambda c: int(c.split(':')[0]))
 
-	chn_vp_mapping = ['\tRel_ID=%s, target_cpu=%s' %
-				(c.split(':')[0], c.split(':')[1])
-					for c in chn_vp_mapping]
+	chn_vp_mapping = [
+		'\tRel_ID=%s, target_cpu=%s' %
+		(c.split(':')[0], c.split(':')[1]) for c in chn_vp_mapping
+	]
 	d = VMBus_Dev()
 	d.sysfs_path = '%s/%s' % (vmbus_sys_path, f)
 	d.vmbus_id = vmbus_id
@@ -85,7 +88,7 @@ for f in os.listdir(vmbus_sys_path):
 	vmbus_dev_list.append(d)
 
 
-vmbus_dev_list  = sorted(vmbus_dev_list, key = lambda d : int(d.vmbus_id))
+vmbus_dev_list = sorted(vmbus_dev_list, key=lambda d: int(d.vmbus_id))
 
 format0 = '%2s: %s'
 format1 = '%2s: Class_ID = %s - %s\n%s'
@@ -95,9 +98,15 @@ for d in vmbus_dev_list:
 	if verbose == 0:
 		print(('VMBUS ID ' + format0) % (d.vmbus_id, d.dev_desc))
 	elif verbose == 1:
-		print (('VMBUS ID ' + format1) %	\
-			(d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping))
+		print(
+			('VMBUS ID ' + format1) %
+			(d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping)
+		)
 	else:
-		print (('VMBUS ID ' + format2) % \
-			(d.vmbus_id, d.class_id, d.dev_desc, \
-			d.device_id, d.sysfs_path, d.chn_vp_mapping))
+		print(
+			('VMBUS ID ' + format2) %
+			(
+				d.vmbus_id, d.class_id, d.dev_desc,
+				d.device_id, d.sysfs_path, d.chn_vp_mapping
+			)
+		)
-- 
GitLab


From c61c7246dc1fdadbebe492e5e9fecf1dd711925d Mon Sep 17 00:00:00 2001
From: Adrian Vladu <avladu@cloudbasesolutions.com>
Date: Mon, 6 May 2019 16:50:58 +0000
Subject: [PATCH 1754/1835] tools: hv: fix KVP and VSS daemons exit code

[ Upstream commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 ]

HyperV KVP and VSS daemons should exit with 0 when the '--help'
or '-h' flags are used.

Signed-off-by: Adrian Vladu <avladu@cloudbasesolutions.com>

Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/hv/hv_kvp_daemon.c | 2 ++
 tools/hv/hv_vss_daemon.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index d7e06fe0270ee..0ce50c319cfd6 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -1386,6 +1386,8 @@ int main(int argc, char *argv[])
 			daemonize = 0;
 			break;
 		case 'h':
+			print_usage(argv);
+			exit(0);
 		default:
 			print_usage(argv);
 			exit(EXIT_FAILURE);
diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
index b133001727623..c2bb8a3601777 100644
--- a/tools/hv/hv_vss_daemon.c
+++ b/tools/hv/hv_vss_daemon.c
@@ -229,6 +229,8 @@ int main(int argc, char *argv[])
 			daemonize = 0;
 			break;
 		case 'h':
+			print_usage(argv);
+			exit(0);
 		default:
 			print_usage(argv);
 			exit(EXIT_FAILURE);
-- 
GitLab


From a3eb2eba2f79950b788342562604d36c5a260da7 Mon Sep 17 00:00:00 2001
From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Date: Mon, 12 Nov 2018 12:39:31 +0000
Subject: [PATCH 1755/1835] drm/i915: fix broadwell EU computation

[ Upstream commit 63ac3328f0d1d37f286e397b14d9596ed09d7ca5 ]

subslice_mask is an array indexed by slice, not subslice.

Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Fixes: 8cc7669355136f ("drm/i915: store all subslice masks")
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108712
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181112123931.2815-1-lionel.g.landwerlin@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/i915/intel_device_info.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
index 0ef0c6448d53a..01fa98299bae6 100644
--- a/drivers/gpu/drm/i915/intel_device_info.c
+++ b/drivers/gpu/drm/i915/intel_device_info.c
@@ -474,7 +474,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
 			u8 eu_disabled_mask;
 			u32 n_disabled;
 
-			if (!(sseu->subslice_mask[ss] & BIT(ss)))
+			if (!(sseu->subslice_mask[s] & BIT(ss)))
 				/* skip disabled subslice */
 				continue;
 
-- 
GitLab


From 2fa7c944e11fc1b1f5cc454f2ea16941b3bacd51 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Wed, 15 May 2019 19:14:18 +0200
Subject: [PATCH 1756/1835] watchdog: bcm2835_wdt: Fix module autoload

[ Upstream commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf ]

The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe
to an MFD.") broke module autoloading on Raspberry Pi. So add a
module alias this fix this.

Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/bcm2835_wdt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index ed05514cc2dce..e6c27b71b136d 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -249,6 +249,7 @@ module_param(nowayout, bool, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
 				__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+MODULE_ALIAS("platform:bcm2835-wdt");
 MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
 MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
 MODULE_LICENSE("GPL");
-- 
GitLab


From edd40f54736d716ad4e40aa6f18b0a1b79051f70 Mon Sep 17 00:00:00 2001
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
Date: Mon, 10 Jun 2019 16:57:38 +0300
Subject: [PATCH 1757/1835] drm/bridge: tfp410: fix memleak in get_modes()

[ Upstream commit c08f99c39083ab55a9c93b3e93cef48711294dad ]

We don't free the edid blob allocated by the call to drm_get_edid(),
causing a memleak. Fix this by calling kfree(edid) at the end of the
get_modes().

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190610135739.6077-1-tomi.valkeinen@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-tfp410.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c b/drivers/gpu/drm/bridge/ti-tfp410.c
index c3e32138c6bb0..9dc109df0808c 100644
--- a/drivers/gpu/drm/bridge/ti-tfp410.c
+++ b/drivers/gpu/drm/bridge/ti-tfp410.c
@@ -64,7 +64,12 @@ static int tfp410_get_modes(struct drm_connector *connector)
 
 	drm_connector_update_edid_property(connector, edid);
 
-	return drm_add_edid_modes(connector, edid);
+	ret = drm_add_edid_modes(connector, edid);
+
+	kfree(edid);
+
+	return ret;
+
 fallback:
 	/* No EDID, fallback on the XGA standard modes */
 	ret = drm_add_modes_noedid(connector, 1920, 1200);
-- 
GitLab


From eba86f0a909f2a8b022a0afb5e3fb8aaefbc7c26 Mon Sep 17 00:00:00 2001
From: Pedro Sousa <sousa@synopsys.com>
Date: Thu, 18 Apr 2019 21:13:34 +0200
Subject: [PATCH 1758/1835] scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define
 value

[ Upstream commit ebcb8f8508c5edf428f52525cec74d28edea7bcb ]

Fix RX_TERMINATION_FORCE_ENABLE define value from 0x0089 to 0x00A9
according to MIPI Alliance MPHY specification.

Fixes: e785060ea3a1 ("ufs: definitions for phy interface")
Signed-off-by: Pedro Sousa <sousa@synopsys.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/unipro.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h
index 23129d7b2678d..c77e365264478 100644
--- a/drivers/scsi/ufs/unipro.h
+++ b/drivers/scsi/ufs/unipro.h
@@ -52,7 +52,7 @@
 #define RX_HS_UNTERMINATED_ENABLE		0x00A6
 #define RX_ENTER_HIBERN8			0x00A7
 #define RX_BYPASS_8B10B_ENABLE			0x00A8
-#define RX_TERMINATION_FORCE_ENABLE		0x0089
+#define RX_TERMINATION_FORCE_ENABLE		0x00A9
 #define RX_MIN_ACTIVATETIME_CAPABILITY		0x008F
 #define RX_HIBERN8TIME_CAPABILITY		0x0092
 #define RX_REFCLKFREQ				0x00EB
-- 
GitLab


From dc066fd0d0737b0e4263775951789c9aa765a8c3 Mon Sep 17 00:00:00 2001
From: Jyri Sarha <jsarha@ti.com>
Date: Wed, 12 Dec 2018 19:26:32 +0200
Subject: [PATCH 1759/1835] drm/tilcdc: Register cpufreq notifier after we have
 initialized crtc

[ Upstream commit 432973fd3a20102840d5f7e61af9f1a03c217a4c ]

Register cpufreq notifier after we have initialized the crtc and
unregister it before we remove the ctrc. Receiving a cpufreq notify
without crtc causes a crash.

Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Jyri Sarha <jsarha@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++---------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
index 0fb300d41a09c..e1868776da252 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
@@ -184,6 +184,12 @@ static void tilcdc_fini(struct drm_device *dev)
 {
 	struct tilcdc_drm_private *priv = dev->dev_private;
 
+#ifdef CONFIG_CPU_FREQ
+	if (priv->freq_transition.notifier_call)
+		cpufreq_unregister_notifier(&priv->freq_transition,
+					    CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+
 	if (priv->crtc)
 		tilcdc_crtc_shutdown(priv->crtc);
 
@@ -198,12 +204,6 @@ static void tilcdc_fini(struct drm_device *dev)
 	drm_mode_config_cleanup(dev);
 	tilcdc_remove_external_device(dev);
 
-#ifdef CONFIG_CPU_FREQ
-	if (priv->freq_transition.notifier_call)
-		cpufreq_unregister_notifier(&priv->freq_transition,
-					    CPUFREQ_TRANSITION_NOTIFIER);
-#endif
-
 	if (priv->clk)
 		clk_put(priv->clk);
 
@@ -274,17 +274,6 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
 		goto init_failed;
 	}
 
-#ifdef CONFIG_CPU_FREQ
-	priv->freq_transition.notifier_call = cpufreq_transition;
-	ret = cpufreq_register_notifier(&priv->freq_transition,
-			CPUFREQ_TRANSITION_NOTIFIER);
-	if (ret) {
-		dev_err(dev, "failed to register cpufreq notifier\n");
-		priv->freq_transition.notifier_call = NULL;
-		goto init_failed;
-	}
-#endif
-
 	if (of_property_read_u32(node, "max-bandwidth", &priv->max_bandwidth))
 		priv->max_bandwidth = TILCDC_DEFAULT_MAX_BANDWIDTH;
 
@@ -361,6 +350,17 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
 	}
 	modeset_init(ddev);
 
+#ifdef CONFIG_CPU_FREQ
+	priv->freq_transition.notifier_call = cpufreq_transition;
+	ret = cpufreq_register_notifier(&priv->freq_transition,
+			CPUFREQ_TRANSITION_NOTIFIER);
+	if (ret) {
+		dev_err(dev, "failed to register cpufreq notifier\n");
+		priv->freq_transition.notifier_call = NULL;
+		goto init_failed;
+	}
+#endif
+
 	if (priv->is_componentized) {
 		ret = component_bind_all(dev, ddev);
 		if (ret < 0)
-- 
GitLab


From f7009bbaff54d5e4b72909ac3beb07920dd95d84 Mon Sep 17 00:00:00 2001
From: Vakul Garg <vakul.garg@nxp.com>
Date: Mon, 10 Sep 2018 22:53:46 +0530
Subject: [PATCH 1760/1835] net/tls: Fixed return value when
 tls_complete_pending_work() fails

[ Upstream commit 150085791afb8054e11d2e080d4b9cd755dd7f69 ]

In tls_sw_sendmsg() and tls_sw_sendpage(), the variable 'ret' has
been set to return value of tls_complete_pending_work(). This allows
return of proper error code if tls_complete_pending_work() fails.

Fixes: 3c4d7559159b ("tls: kernel TLS support")
Signed-off-by: Vakul Garg <vakul.garg@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_sw.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 6848a81967118..bbb2da70e8701 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -354,7 +354,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 {
 	struct tls_context *tls_ctx = tls_get_ctx(sk);
 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
-	int ret = 0;
+	int ret;
 	int required_size;
 	long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
 	bool eor = !(msg->msg_flags & MSG_MORE);
@@ -370,7 +370,8 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 
 	lock_sock(sk);
 
-	if (tls_complete_pending_work(sk, tls_ctx, msg->msg_flags, &timeo))
+	ret = tls_complete_pending_work(sk, tls_ctx, msg->msg_flags, &timeo);
+	if (ret)
 		goto send_end;
 
 	if (unlikely(msg->msg_controllen)) {
@@ -505,7 +506,7 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
 {
 	struct tls_context *tls_ctx = tls_get_ctx(sk);
 	struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
-	int ret = 0;
+	int ret;
 	long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 	bool eor;
 	size_t orig_size = size;
@@ -525,7 +526,8 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
 
 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 
-	if (tls_complete_pending_work(sk, tls_ctx, flags, &timeo))
+	ret = tls_complete_pending_work(sk, tls_ctx, flags, &timeo);
+	if (ret)
 		goto sendpage_end;
 
 	/* Call the sk_stream functions to manage the sndbuf mem. */
-- 
GitLab


From fdc4400e962804bc9d9364fcaa998c0b084eff72 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <jakub.kicinski@netronome.com>
Date: Fri, 9 Aug 2019 18:36:23 -0700
Subject: [PATCH 1761/1835] net/tls: swap sk_write_space on close

[ Upstream commit 57c722e932cfb82e9820bbaae1b1f7222ea97b52 ]

Now that we swap the original proto and clear the ULP pointer
on close we have to make sure no callback will try to access
the freed state. sk_write_space is not part of sk_prot, remember
to swap it.

Reported-by: syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com
Fixes: 95fa145479fb ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 4c0ac79f82d4e..f636aff11d51e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -301,6 +301,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
 #else
 	{
 #endif
+		sk->sk_write_space = ctx->sk_write_space;
 		tls_ctx_free(ctx);
 		ctx = NULL;
 	}
-- 
GitLab


From a1407b26a6ed1f7b26488f9707decb24d1473a82 Mon Sep 17 00:00:00 2001
From: John Fastabend <john.fastabend@gmail.com>
Date: Wed, 14 Aug 2019 05:31:54 +0000
Subject: [PATCH 1762/1835] net: tls, fix sk_write_space NULL write when tx
 disabled

[ Upstream commit d85f01775850a35eae47a0090839baf510c1ef12 ]

The ctx->sk_write_space pointer is only set when TLS tx mode is enabled.
When running without TX mode its a null pointer but we still set the
sk sk_write_space pointer on close().

Fix the close path to only overwrite sk->sk_write_space when the current
pointer is to the tls_write_space function indicating the tls module should
clean it up properly as well.

Reported-by: Hillf Danton <hdanton@sina.com>
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Fixes: 57c722e932cfb ("net/tls: swap sk_write_space on close")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index f636aff11d51e..3288bdff98894 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -301,7 +301,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
 #else
 	{
 #endif
-		sk->sk_write_space = ctx->sk_write_space;
+		if (sk->sk_write_space == tls_write_space)
+			sk->sk_write_space = ctx->sk_write_space;
 		tls_ctx_free(ctx);
 		ctx = NULL;
 	}
-- 
GitLab


From 02127bdfee97c51189830612eff0e5c3f41c908f Mon Sep 17 00:00:00 2001
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Tue, 20 Aug 2019 10:19:47 +0800
Subject: [PATCH 1763/1835] ipv6/addrconf: allow adding multicast addr if
 IFA_F_MCAUTOJOIN is set

[ Upstream commit f17f7648a49aa6728649ddf79bdbcac4f1970ce4 ]

In commit 93a714d6b53d ("multicast: Extend ip address command to enable
multicast group join/leave on") we added a new flag IFA_F_MCAUTOJOIN
to make user able to add multicast address on ethernet interface.

This works for IPv4, but not for IPv6. See the inet6_addr_add code.

static int inet6_addr_add()
{
	...
	if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) {
		ipv6_mc_config(net->ipv6.mc_autojoin_sk, true...)
	}

	ifp = ipv6_add_addr(idev, cfg, true, extack); <- always fail with maddr
	if (!IS_ERR(ifp)) {
		...
	} else if (cfg->ifa_flags & IFA_F_MCAUTOJOIN) {
		ipv6_mc_config(net->ipv6.mc_autojoin_sk, false...)
	}
}

But in ipv6_add_addr() it will check the address type and reject multicast
address directly. So this feature is never worked for IPv6.

We should not remove the multicast address check totally in ipv6_add_addr(),
but could accept multicast address only when IFA_F_MCAUTOJOIN flag supplied.

v2: update commit description

Fixes: 93a714d6b53d ("multicast: Extend ip address command to enable multicast group join/leave on")
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/addrconf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c57efd5c5b387..49e2f6dac6462 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -995,7 +995,8 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
 	int err = 0;
 
 	if (addr_type == IPV6_ADDR_ANY ||
-	    addr_type & IPV6_ADDR_MULTICAST ||
+	    (addr_type & IPV6_ADDR_MULTICAST &&
+	     !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) ||
 	    (!(idev->dev->flags & IFF_LOOPBACK) &&
 	     addr_type & IPV6_ADDR_LOOPBACK))
 		return ERR_PTR(-EADDRNOTAVAIL);
-- 
GitLab


From ff129837a5f6837bc10310201d132a66210e4879 Mon Sep 17 00:00:00 2001
From: David Ahern <dsahern@gmail.com>
Date: Wed, 19 Jun 2019 10:50:24 -0700
Subject: [PATCH 1764/1835] ipv6: Default fib6_type to RTN_UNICAST when not set

[ Upstream commit c7036d97acd2527cef145b5ef9ad1a37ed21bbe6 ]

A user reported that routes are getting installed with type 0 (RTN_UNSPEC)
where before the routes were RTN_UNICAST. One example is from accel-ppp
which apparently still uses the ioctl interface and does not set
rtmsg_type. Another is the netlink interface where ipv6 does not require
rtm_type to be set (v4 does). Prior to the commit in the Fixes tag the
ipv6 stack converted type 0 to RTN_UNICAST, so restore that behavior.

Fixes: e8478e80e5a7 ("net/ipv6: Save route type in rt6_info")
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 81220077d62f2..c885863801340 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3109,7 +3109,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
 	rt->fib6_metric = cfg->fc_metric;
 	rt->fib6_nh.nh_weight = 1;
 
-	rt->fib6_type = cfg->fc_type;
+	rt->fib6_type = cfg->fc_type ? : RTN_UNICAST;
 
 	/* We cannot add true routes via loopback here,
 	   they would result in kernel looping; promote them to reject routes
-- 
GitLab


From 3e79bd1e4f9aad859e3eb4a24463979d47f1fb10 Mon Sep 17 00:00:00 2001
From: Jason Baron <jbaron@akamai.com>
Date: Mon, 19 Aug 2019 14:36:01 -0400
Subject: [PATCH 1765/1835] net/smc: make sure EPOLLOUT is raised

[ Upstream commit 4651d1802f7063e4d8c0bcad957f46ece0c04024 ]

Currently, we are only explicitly setting SOCK_NOSPACE on a write timeout
for non-blocking sockets. Epoll() edge-trigger mode relies on SOCK_NOSPACE
being set when -EAGAIN is returned to ensure that EPOLLOUT is raised.
Expand the setting of SOCK_NOSPACE to non-blocking sockets as well that can
use SO_SNDTIMEO to adjust their write timeout. This mirrors the behavior
that Eric Dumazet introduced for tcp sockets.

Signed-off-by: Jason Baron <jbaron@akamai.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Ursula Braun <ubraun@linux.ibm.com>
Cc: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/smc/smc_tx.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index d8366ed517576..28361aef99825 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -75,13 +75,11 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct smc_connection *conn = &smc->conn;
 	struct sock *sk = &smc->sk;
-	bool noblock;
 	long timeo;
 	int rc = 0;
 
 	/* similar to sk_stream_wait_memory */
 	timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
-	noblock = timeo ? false : true;
 	add_wait_queue(sk_sleep(sk), &wait);
 	while (1) {
 		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -96,8 +94,8 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
 			break;
 		}
 		if (!timeo) {
-			if (noblock)
-				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+			/* ensure EPOLLOUT is subsequently generated */
+			set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 			rc = -EAGAIN;
 			break;
 		}
-- 
GitLab


From 0a6a9c473080801b7a738b828b4e651206febc79 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 16 Aug 2019 21:26:22 -0700
Subject: [PATCH 1766/1835] tcp: make sure EPOLLOUT wont be missed

[ Upstream commit ef8d8ccdc216f797e66cb4a1372f5c4c285ce1e4 ]

As Jason Baron explained in commit 790ba4566c1a ("tcp: set SOCK_NOSPACE
under memory pressure"), it is crucial we properly set SOCK_NOSPACE
when needed.

However, Jason patch had a bug, because the 'nonblocking' status
as far as sk_stream_wait_memory() is concerned is governed
by MSG_DONTWAIT flag passed at sendmsg() time :

    long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);

So it is very possible that tcp sendmsg() calls sk_stream_wait_memory(),
and that sk_stream_wait_memory() returns -EAGAIN with SOCK_NOSPACE
cleared, if sk->sk_sndtimeo has been set to a small (but not zero)
value.

This patch removes the 'noblock' variable since we must always
set SOCK_NOSPACE if -EAGAIN is returned.

It also renames the do_nonblock label since we might reach this
code path even if we were in blocking mode.

Fixes: 790ba4566c1a ("tcp: set SOCK_NOSPACE under memory pressure")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jason Baron <jbaron@akamai.com>
Reported-by: Vladimir Rutsky  <rutsky@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Jason Baron <jbaron@akamai.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/stream.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/net/core/stream.c b/net/core/stream.c
index 7d329fb1f553a..7f5eaa95a6756 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -120,7 +120,6 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 	int err = 0;
 	long vm_wait = 0;
 	long current_timeo = *timeo_p;
-	bool noblock = (*timeo_p ? false : true);
 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
 	if (sk_stream_memory_free(sk))
@@ -133,11 +132,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 
 		if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
 			goto do_error;
-		if (!*timeo_p) {
-			if (noblock)
-				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-			goto do_nonblock;
-		}
+		if (!*timeo_p)
+			goto do_eagain;
 		if (signal_pending(current))
 			goto do_interrupted;
 		sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -169,7 +165,13 @@ out:
 do_error:
 	err = -EPIPE;
 	goto out;
-do_nonblock:
+do_eagain:
+	/* Make sure that whenever EAGAIN is returned, EPOLLOUT event can
+	 * be generated later.
+	 * When TCP receives ACK packets that make room, tcp_check_space()
+	 * only calls tcp_new_space() if SOCK_NOSPACE is set.
+	 */
+	set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 	err = -EAGAIN;
 	goto out;
 do_interrupted:
-- 
GitLab


From 9febfd30aede7ef0296cf23f72bfff81334d8b22 Mon Sep 17 00:00:00 2001
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Thu, 22 Aug 2019 22:19:48 +0800
Subject: [PATCH 1767/1835] ipv4/icmp: fix rt dst dev null pointer dereference

[ Upstream commit e2c693934194fd3b4e795635934883354c06ebc9 ]

In __icmp_send() there is a possibility that the rt->dst.dev is NULL,
e,g, with tunnel collect_md mode, which will cause kernel crash.
Here is what the code path looks like, for GRE:

- ip6gre_tunnel_xmit
  - ip6gre_xmit_ipv4
    - __gre6_xmit
      - ip6_tnl_xmit
        - if skb->len - t->tun_hlen - eth_hlen > mtu; return -EMSGSIZE
    - icmp_send
      - net = dev_net(rt->dst.dev); <-- here

The reason is __metadata_dst_init() init dst->dev to NULL by default.
We could not fix it in __metadata_dst_init() as there is no dev supplied.
On the other hand, the reason we need rt->dst.dev is to get the net.
So we can just try get it from skb->dev when rt->dst.dev is NULL.

v4: Julian Anastasov remind skb->dev also could be NULL. We'd better
still use dst.dev and do a check to avoid crash.

v3: No changes.

v2: fix the issue in __icmp_send() instead of updating shared dst dev
in {ip_md, ip6}_tunnel_xmit.

Fixes: c8b34e680a09 ("ip_tunnel: Add tnl_update_pmtu in ip_md_tunnel_xmit")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/icmp.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index ad75c468ecfb2..0167e23d1c8fa 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -587,7 +587,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
 
 	if (!rt)
 		goto out;
-	net = dev_net(rt->dst.dev);
+
+	if (rt->dst.dev)
+		net = dev_net(rt->dst.dev);
+	else if (skb_in->dev)
+		net = dev_net(skb_in->dev);
+	else
+		goto out;
 
 	/*
 	 *	Find the original header. It is expected to be valid, of course.
-- 
GitLab


From 5dd2db1ab0062052af9e6da8146f9655c94f8378 Mon Sep 17 00:00:00 2001
From: Andrew Morton <akpm@linux-foundation.org>
Date: Fri, 30 Aug 2019 16:04:35 -0700
Subject: [PATCH 1768/1835] mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n

commit 441e254cd40dc03beec3c650ce6ce6074bc6517f upstream.

Fixes: 701d678599d0c1 ("mm/zsmalloc.c: fix race condition in zs_destroy_pool")
Link: http://lkml.kernel.org/r/201908251039.5oSbEEUT%25lkp@intel.com
Reported-by: kbuild test robot <lkp@intel.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Henry Burns <henrywolfeburns@gmail.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Jonathan Adams <jwadams@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/zsmalloc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index c2c4f739da8f0..4b9063d12b932 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -2432,7 +2432,9 @@ struct zs_pool *zs_create_pool(const char *name)
 	if (!pool->name)
 		goto err;
 
+#ifdef CONFIG_COMPACTION
 	init_waitqueue_head(&pool->migration_wait);
+#endif
 
 	if (create_cache(pool))
 		goto err;
-- 
GitLab


From c94c0bf878bf299dcc957c8a3d85ee61caa887b2 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 20 Aug 2019 21:43:42 +0200
Subject: [PATCH 1769/1835] ALSA: usb-audio: Check mixer unit bitmap yet more
 strictly

commit f9f0e9ed350e15d51ad07364b4cf910de50c472a upstream.

The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a
variable size depending on both input and output pins.  Its size is to
fit with input * output bits.  The problem is that the input size
can't be determined simply from the unit descriptor itself but it
needs to parse the whole connected sources.  Although the
uac_mixer_unit_get_channels() tries to check some possible overflow of
this bitmap, it's incomplete due to the lack of the  evaluation of
input pins.

For covering possible overflows, this patch adds the bitmap overflow
check in the loop of input pins in parse_audio_mixer_unit().

Fixes: 0bfe5e434e66 ("ALSA: usb-audio: Check mixer unit descriptors more strictly")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer.c | 36 ++++++++++++++++++++++++++++--------
 1 file changed, 28 insertions(+), 8 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 4b3e1c48ca2f3..b0c5d4ef61374 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -754,7 +754,6 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
 				       struct uac_mixer_unit_descriptor *desc)
 {
 	int mu_channels;
-	void *c;
 
 	if (desc->bLength < sizeof(*desc))
 		return -EINVAL;
@@ -777,13 +776,6 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
 		break;
 	}
 
-	if (!mu_channels)
-		return 0;
-
-	c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
-	if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
-		return 0; /* no bmControls -> skip */
-
 	return mu_channels;
 }
 
@@ -2028,6 +2020,31 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
  * Mixer Unit
  */
 
+/* check whether the given in/out overflows bmMixerControls matrix */
+static bool mixer_bitmap_overflow(struct uac_mixer_unit_descriptor *desc,
+				  int protocol, int num_ins, int num_outs)
+{
+	u8 *hdr = (u8 *)desc;
+	u8 *c = uac_mixer_unit_bmControls(desc, protocol);
+	size_t rest; /* remaining bytes after bmMixerControls */
+
+	switch (protocol) {
+	case UAC_VERSION_1:
+	default:
+		rest = 1; /* iMixer */
+		break;
+	case UAC_VERSION_2:
+		rest = 2; /* bmControls + iMixer */
+		break;
+	case UAC_VERSION_3:
+		rest = 6; /* bmControls + wMixerDescrStr */
+		break;
+	}
+
+	/* overflow? */
+	return c + (num_ins * num_outs + 7) / 8 + rest > hdr + hdr[0];
+}
+
 /*
  * build a mixer unit control
  *
@@ -2156,6 +2173,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
 		if (err < 0)
 			return err;
 		num_ins += iterm.channels;
+		if (mixer_bitmap_overflow(desc, state->mixer->protocol,
+					  num_ins, num_outs))
+			break;
 		for (; ich < num_ins; ich++) {
 			int och, ich_has_controls = 0;
 
-- 
GitLab


From 5ef43bdc7321d07a3a8246a483f6a75bca10fe8f Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 21 Aug 2019 20:00:02 +0200
Subject: [PATCH 1770/1835] ALSA: line6: Fix memory leak at line6_init_pcm()
 error path

commit 1bc8d18c75fef3b478dbdfef722aae09e2a9fde7 upstream.

I forgot to release the allocated object at the early error path in
line6_init_pcm().  For addressing it, slightly shuffle the code so
that the PCM destructor (pcm->private_free) is assigned properly
before all error paths.

Fixes: 3450121997ce ("ALSA: line6: Fix write on zero-sized buffer")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/line6/pcm.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 78c2d6cab3b52..531564269444e 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -554,6 +554,15 @@ int line6_init_pcm(struct usb_line6 *line6,
 	line6pcm->volume_monitor = 255;
 	line6pcm->line6 = line6;
 
+	spin_lock_init(&line6pcm->out.lock);
+	spin_lock_init(&line6pcm->in.lock);
+	line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
+
+	line6->line6pcm = line6pcm;
+
+	pcm->private_data = line6pcm;
+	pcm->private_free = line6_cleanup_pcm;
+
 	line6pcm->max_packet_size_in =
 		usb_maxpacket(line6->usbdev,
 			usb_rcvisocpipe(line6->usbdev, ep_read), 0);
@@ -566,15 +575,6 @@ int line6_init_pcm(struct usb_line6 *line6,
 		return -EINVAL;
 	}
 
-	spin_lock_init(&line6pcm->out.lock);
-	spin_lock_init(&line6pcm->in.lock);
-	line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
-
-	line6->line6pcm = line6pcm;
-
-	pcm->private_data = line6pcm;
-	pcm->private_free = line6_cleanup_pcm;
-
 	err = line6_create_audio_out_urbs(line6pcm);
 	if (err < 0)
 		return err;
-- 
GitLab


From 842317de9797072ad7528fd2c140e9365517311f Mon Sep 17 00:00:00 2001
From: Jeronimo Borque <jeronimo@borque.com.ar>
Date: Sun, 18 Aug 2019 22:35:38 -0300
Subject: [PATCH 1771/1835] ALSA: hda - Fixes inverted Conexant GPIO mic mute
 led

commit f9ef724d4896763479f3921afd1ee61552fc9836 upstream.

"enabled" parameter historically referred to the device input or
output, not to the led indicator. After the changes added with the led
helper functions the mic mute led logic refers to the led and not to
the mic input which caused led indicator to be negated.
Fixing logic in cxt_update_gpio_led and updated
cxt_fixup_gpio_mute_hook
Also updated debug messages to ease further debugging if necessary.

Fixes: 184e302b46c9 ("ALSA: hda/conexant - Use the mic-mute LED helper")
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jeronimo Borque <jeronimo@borque.com.ar>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_conexant.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 6f17b256fcd02..ae8fde4c1a125 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -624,18 +624,20 @@ static void cxt_fixup_hp_gate_mic_jack(struct hda_codec *codec,
 
 /* update LED status via GPIO */
 static void cxt_update_gpio_led(struct hda_codec *codec, unsigned int mask,
-				bool enabled)
+				bool led_on)
 {
 	struct conexant_spec *spec = codec->spec;
 	unsigned int oldval = spec->gpio_led;
 
 	if (spec->mute_led_polarity)
-		enabled = !enabled;
+		led_on = !led_on;
 
-	if (enabled)
-		spec->gpio_led &= ~mask;
-	else
+	if (led_on)
 		spec->gpio_led |= mask;
+	else
+		spec->gpio_led &= ~mask;
+	codec_dbg(codec, "mask:%d enabled:%d gpio_led:%d\n",
+			mask, led_on, spec->gpio_led);
 	if (spec->gpio_led != oldval)
 		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
 				    spec->gpio_led);
@@ -646,8 +648,8 @@ static void cxt_fixup_gpio_mute_hook(void *private_data, int enabled)
 {
 	struct hda_codec *codec = private_data;
 	struct conexant_spec *spec = codec->spec;
-
-	cxt_update_gpio_led(codec, spec->gpio_mute_led_mask, enabled);
+	/* muted -> LED on */
+	cxt_update_gpio_led(codec, spec->gpio_mute_led_mask, !enabled);
 }
 
 /* turn on/off mic-mute LED via GPIO per capture hook */
@@ -669,7 +671,6 @@ static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
 		{ 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03 },
 		{}
 	};
-	codec_info(codec, "action: %d gpio_led: %d\n", action, spec->gpio_led);
 
 	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
 		spec->gen.vmaster_mute.hook = cxt_fixup_gpio_mute_hook;
-- 
GitLab


From 98a2017c4a17fea2f935d2463c852294d1bfbb5d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Sun, 25 Aug 2019 09:21:44 +0200
Subject: [PATCH 1772/1835] ALSA: seq: Fix potential concurrent access to the
 deleted pool

commit 75545304eba6a3d282f923b96a466dc25a81e359 upstream.

The input pool of a client might be deleted via the resize ioctl, the
the access to it should be covered by the proper locks.  Currently the
only missing place is the call in snd_seq_ioctl_get_client_pool(), and
this patch papers over it.

Reported-by: syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq/seq_clientmgr.c |  3 +--
 sound/core/seq/seq_fifo.c      | 17 +++++++++++++++++
 sound/core/seq/seq_fifo.h      |  2 ++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index bbf91a5a938b6..bd3d68e0489dd 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1818,8 +1818,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client,
 	if (cptr->type == USER_CLIENT) {
 		info->input_pool = cptr->data.user.fifo_pool_size;
 		info->input_free = info->input_pool;
-		if (cptr->data.user.fifo)
-			info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool);
+		info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo);
 	} else {
 		info->input_pool = 0;
 		info->input_free = 0;
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 72c0302a55d23..6a24732704fcf 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -280,3 +280,20 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
 
 	return 0;
 }
+
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f)
+{
+	unsigned long flags;
+	int cells;
+
+	if (!f)
+		return 0;
+
+	snd_use_lock_use(&f->use_lock);
+	spin_lock_irqsave(&f->lock, flags);
+	cells = snd_seq_unused_cells(f->pool);
+	spin_unlock_irqrestore(&f->lock, flags);
+	snd_use_lock_free(&f->use_lock);
+	return cells;
+}
diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h
index 062c446e78672..5d38a0d7f0cd6 100644
--- a/sound/core/seq/seq_fifo.h
+++ b/sound/core/seq/seq_fifo.h
@@ -68,5 +68,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file, poll_table
 /* resize pool in fifo */
 int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize);
 
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f);
 
 #endif
-- 
GitLab


From b5d1f31d97afc06b340cd5a04a5dd6693c0a0052 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 15 Aug 2019 11:41:06 +0200
Subject: [PATCH 1773/1835] ALSA: usb-audio: Fix invalid NULL check in
 snd_emuusb_set_samplerate()

commit 6de3c9e3f6b3eaf66859e1379b3f35dda781416b upstream.

The quirk function snd_emuusb_set_samplerate() has a NULL check for
the mixer element, but this is useless in the current code.  It used
to be a check against mixer->id_elems[unitid] but it was changed later
to the value after mixer_eleme_list_to_info() which is always non-NULL
due to the container_of() usage.

This patch fixes the check before the conversion.

While we're at it, correct a typo in the comment in the function,
too.

Fixes: 8c558076c740 ("ALSA: usb-audio: Clean up mixer element list traverse")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer_quirks.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 5b342fe30c751..10c6971cf4772 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1167,17 +1167,17 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
 {
 	struct usb_mixer_interface *mixer;
 	struct usb_mixer_elem_info *cval;
-	int unitid = 12; /* SamleRate ExtensionUnit ID */
+	int unitid = 12; /* SampleRate ExtensionUnit ID */
 
 	list_for_each_entry(mixer, &chip->mixer_list, list) {
-		cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
-		if (cval) {
+		if (mixer->id_elems[unitid]) {
+			cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
 			snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
 						    cval->control << 8,
 						    samplerate_id);
 			snd_usb_mixer_notify_id(mixer, unitid);
+			break;
 		}
-		break;
 	}
 }
 
-- 
GitLab


From cbd905dac5357a3b9c3ebd0343833bfd88884c2a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 20 Aug 2019 08:58:12 +0200
Subject: [PATCH 1774/1835] ALSA: usb-audio: Add implicit fb quirk for
 Behringer UFX1604

commit 1a15718b41df026cffd0e42cfdc38a1384ce19f9 upstream.

Behringer UFX1604 requires the similar quirk to apply implicit fb like
another Behringer model UFX1204 in order to fix the noisy playback.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204631
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/pcm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index db114f3977e0f..35c57a4204a8a 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -350,6 +350,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 		ep = 0x81;
 		ifnum = 2;
 		goto add_sync_ep_from_ifnum;
+	case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */
 	case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */
 		ep = 0x81;
 		ifnum = 1;
-- 
GitLab


From 3ec35109c80a47a506b8751a575d0bf4a41e8d4e Mon Sep 17 00:00:00 2001
From: Radim Krcmar <rkrcmar@redhat.com>
Date: Tue, 13 Aug 2019 23:37:37 -0400
Subject: [PATCH 1775/1835] kvm: x86: skip populating logical dest map if apic
 is not sw enabled

commit b14c876b994f208b6b95c222056e1deb0a45de0e upstream.

recalculate_apic_map does not santize ldr and it's possible that
multiple bits are set. In that case, a previous valid entry
can potentially be overwritten by an invalid one.

This condition is hit when booting a 32 bit, >8 CPU, RHEL6 guest and then
triggering a crash to boot a kdump kernel. This is the sequence of
events:
1. Linux boots in bigsmp mode and enables PhysFlat, however, it still
writes to the LDR which probably will never be used.
2. However, when booting into kdump, the stale LDR values remain as
they are not cleared by the guest and there isn't a apic reset.
3. kdump boots with 1 cpu, and uses Logical Destination Mode but the
logical map has been overwritten and points to an inactive vcpu.

Signed-off-by: Radim Krcmar <rkrcmar@redhat.com>
Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/lapic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 031bd7f91f98a..5f5bc59768042 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -209,6 +209,9 @@ static void recalculate_apic_map(struct kvm *kvm)
 		if (!apic_x2apic_mode(apic) && !new->phys_map[xapic_id])
 			new->phys_map[xapic_id] = apic;
 
+		if (!kvm_apic_sw_enabled(apic))
+			continue;
+
 		ldr = kvm_lapic_get_reg(apic, APIC_LDR);
 
 		if (apic_x2apic_mode(apic)) {
@@ -252,6 +255,8 @@ static inline void apic_set_spiv(struct kvm_lapic *apic, u32 val)
 			recalculate_apic_map(apic->vcpu->kvm);
 		} else
 			static_key_slow_inc(&apic_sw_disabled.key);
+
+		recalculate_apic_map(apic->vcpu->kvm);
 	}
 }
 
-- 
GitLab


From 3c2b4827798e53c8fd90d25a361e19cb13d22dfd Mon Sep 17 00:00:00 2001
From: Sean Christopherson <sean.j.christopherson@intel.com>
Date: Fri, 23 Aug 2019 13:55:44 -0700
Subject: [PATCH 1776/1835] KVM: x86: Don't update RIP or do single-step on
 faulting emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 75ee23b30dc712d80d2421a9a547e7ab6e379b44 upstream.

Don't advance RIP or inject a single-step #DB if emulation signals a
fault.  This logic applies to all state updates that are conditional on
clean retirement of the emulation instruction, e.g. updating RFLAGS was
previously handled by commit 38827dbd3fb85 ("KVM: x86: Do not update
EFLAGS on faulting emulation").

Not advancing RIP is likely a nop, i.e. ctxt->eip isn't updated with
ctxt->_eip until emulation "retires" anyways.  Skipping #DB injection
fixes a bug reported by Andy Lutomirski where a #UD on SYSCALL due to
invalid state with EFLAGS.TF=1 would loop indefinitely due to emulation
overwriting the #UD with #DB and thus restarting the bad SYSCALL over
and over.

Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: stable@vger.kernel.org
Reported-by: Andy Lutomirski <luto@kernel.org>
Fixes: 663f4c61b803 ("KVM: x86: handle singlestep during emulation")
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index e10a7a42449b3..c27ce60590905 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6308,12 +6308,13 @@ restart:
 		unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
 		toggle_interruptibility(vcpu, ctxt->interruptibility);
 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
-		kvm_rip_write(vcpu, ctxt->eip);
-		if (r == EMULATE_DONE && ctxt->tf)
-			kvm_vcpu_do_singlestep(vcpu, &r);
 		if (!ctxt->have_exception ||
-		    exception_type(ctxt->exception.vector) == EXCPT_TRAP)
+		    exception_type(ctxt->exception.vector) == EXCPT_TRAP) {
+			kvm_rip_write(vcpu, ctxt->eip);
+			if (r == EMULATE_DONE && ctxt->tf)
+				kvm_vcpu_do_singlestep(vcpu, &r);
 			__kvm_set_rflags(vcpu, ctxt->eflags);
+		}
 
 		/*
 		 * For STI, interrupts are shadowed; so KVM_REQ_EVENT will
-- 
GitLab


From 941d875cd44a7d610e68fc11960b8298f5f2aee9 Mon Sep 17 00:00:00 2001
From: Sebastian Mayr <me@sam.st>
Date: Sun, 28 Jul 2019 17:26:17 +0200
Subject: [PATCH 1777/1835] uprobes/x86: Fix detection of 32-bit user mode

commit 9212ec7d8357ea630031e89d0d399c761421c83b upstream.

32-bit processes running on a 64-bit kernel are not always detected
correctly, causing the process to crash when uretprobes are installed.

The reason for the crash is that in_ia32_syscall() is used to determine the
process's mode, which only works correctly when called from a syscall.

In the case of uretprobes, however, the function is called from a exception
and always returns 'false' on a 64-bit kernel. In consequence this leads to
corruption of the process's return address.

Fix this by using user_64bit_mode() instead of in_ia32_syscall(), which
is correct in any situation.

[ tglx: Add a comment and the following historical info ]

This should have been detected by the rename which happened in commit

  abfb9498ee13 ("x86/entry: Rename is_{ia32,x32}_task() to in_{ia32,x32}_syscall()")

which states in the changelog:

    The is_ia32_task()/is_x32_task() function names are a big misnomer: they
    suggests that the compat-ness of a system call is a task property, which
    is not true, the compatness of a system call purely depends on how it
    was invoked through the system call layer.
    .....

and then it went and blindly renamed every call site.

Sadly enough this was already mentioned here:

   8faaed1b9f50 ("uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and
arch_uretprobe_hijack_return_addr()")

where the changelog says:

    TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
    not necessarily mean 32bit. Fortunately syscall-like insns can't be
    probed so it actually works, but it would be better to rename and
    use is_ia32_frame().

and goes all the way back to:

    0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")

Oh well. 7+ years until someone actually tried a uretprobe on a 32bit
process on a 64bit kernel....

Fixes: 0326f5a94dde ("uprobes/core: Handle breakpoint and singlestep exceptions")
Signed-off-by: Sebastian Mayr <me@sam.st>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Dmitry Safonov <dsafonov@virtuozzo.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190728152617.7308-1-me@sam.st
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/uprobes.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index deb576b23b7cf..9119859ba7871 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -521,9 +521,12 @@ struct uprobe_xol_ops {
 	void	(*abort)(struct arch_uprobe *, struct pt_regs *);
 };
 
-static inline int sizeof_long(void)
+static inline int sizeof_long(struct pt_regs *regs)
 {
-	return in_ia32_syscall() ? 4 : 8;
+	/*
+	 * Check registers for mode as in_xxx_syscall() does not apply here.
+	 */
+	return user_64bit_mode(regs) ? 8 : 4;
 }
 
 static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
@@ -534,9 +537,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
 
 static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
 {
-	unsigned long new_sp = regs->sp - sizeof_long();
+	unsigned long new_sp = regs->sp - sizeof_long(regs);
 
-	if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
+	if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
 		return -EFAULT;
 
 	regs->sp = new_sp;
@@ -569,7 +572,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
 		long correction = utask->vaddr - utask->xol_vaddr;
 		regs->ip += correction;
 	} else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
-		regs->sp += sizeof_long(); /* Pop incorrect return address */
+		regs->sp += sizeof_long(regs); /* Pop incorrect return address */
 		if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
 			return -ERESTART;
 	}
@@ -688,7 +691,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
 	 * "call" insn was executed out-of-line. Just restore ->sp and restart.
 	 * We could also restore ->ip and try to call branch_emulate_op() again.
 	 */
-	regs->sp += sizeof_long();
+	regs->sp += sizeof_long(regs);
 	return -ERESTART;
 }
 
@@ -1068,7 +1071,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 unsigned long
 arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
 {
-	int rasize = sizeof_long(), nleft;
+	int rasize = sizeof_long(regs), nleft;
 	unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
 
 	if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
-- 
GitLab


From 959832657c03575cfd65d2c2c796ced667005398 Mon Sep 17 00:00:00 2001
From: Bandan Das <bsd@redhat.com>
Date: Mon, 26 Aug 2019 06:15:12 -0400
Subject: [PATCH 1778/1835] x86/apic: Do not initialize LDR and DFR for bigsmp

commit bae3a8d3308ee69a7dbdf145911b18dfda8ade0d upstream.

Legacy apic init uses bigsmp for smp systems with 8 and more CPUs. The
bigsmp APIC implementation uses physical destination mode, but it
nevertheless initializes LDR and DFR. The LDR even ends up incorrectly with
multiple bit being set.

This does not cause a functional problem because LDR and DFR are ignored
when physical destination mode is active, but it triggered a problem on a
32-bit KVM guest which jumps into a kdump kernel.

The multiple bits set unearthed a bug in the KVM APIC implementation. The
code which creates the logical destination map for VCPUs ignores the
disabled state of the APIC and ends up overwriting an existing valid entry
and as a result, APIC calibration hangs in the guest during kdump
initialization.

Remove the bogus LDR/DFR initialization.

This is not intended to work around the KVM APIC bug. The LDR/DFR
ininitalization is wrong on its own.

The issue goes back into the pre git history. The fixes tag is the commit
in the bitkeeper import which introduced bigsmp support in 2003.

  git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git

Fixes: db7b9e9f26b8 ("[PATCH] Clustered APIC setup for >8 CPU systems")
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190826101513.5080-2-bsd@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/apic/bigsmp_32.c | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c
index afee386ff711e..caedd8d60d361 100644
--- a/arch/x86/kernel/apic/bigsmp_32.c
+++ b/arch/x86/kernel/apic/bigsmp_32.c
@@ -38,32 +38,12 @@ static int bigsmp_early_logical_apicid(int cpu)
 	return early_per_cpu(x86_cpu_to_apicid, cpu);
 }
 
-static inline unsigned long calculate_ldr(int cpu)
-{
-	unsigned long val, id;
-
-	val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
-	id = per_cpu(x86_bios_cpu_apicid, cpu);
-	val |= SET_APIC_LOGICAL_ID(id);
-
-	return val;
-}
-
 /*
- * Set up the logical destination ID.
- *
- * Intel recommends to set DFR, LDR and TPR before enabling
- * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
- * document number 292116).  So here it goes...
+ * bigsmp enables physical destination mode
+ * and doesn't use LDR and DFR
  */
 static void bigsmp_init_apic_ldr(void)
 {
-	unsigned long val;
-	int cpu = smp_processor_id();
-
-	apic_write(APIC_DFR, APIC_DFR_FLAT);
-	val = calculate_ldr(cpu);
-	apic_write(APIC_LDR, val);
 }
 
 static void bigsmp_setup_apic_routing(void)
-- 
GitLab


From edc454cd5a04c7c4ed76edd5b91ba20e4d3ebcd8 Mon Sep 17 00:00:00 2001
From: Bandan Das <bsd@redhat.com>
Date: Mon, 26 Aug 2019 06:15:13 -0400
Subject: [PATCH 1779/1835] x86/apic: Include the LDR when clearing out APIC
 registers

commit 558682b5291937a70748d36fd9ba757fb25b99ae upstream.

Although APIC initialization will typically clear out the LDR before
setting it, the APIC cleanup code should reset the LDR.

This was discovered with a 32-bit KVM guest jumping into a kdump
kernel. The stale bits in the LDR triggered a bug in the KVM APIC
implementation which caused the destination mapping for VCPUs to be
corrupted.

Note that this isn't intended to paper over the KVM APIC bug. The kernel
has to clear the LDR when resetting the APIC registers except when X2APIC
is enabled.

This lacks a Fixes tag because missing to clear LDR goes way back into pre
git history.

[ tglx: Made x2apic_enabled a function call as required ]

Signed-off-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20190826101513.5080-3-bsd@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/apic/apic.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index b316bd61a6ace..90be3a1506d3f 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1140,6 +1140,10 @@ void clear_local_APIC(void)
 	apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
 	v = apic_read(APIC_LVT1);
 	apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
+	if (!x2apic_enabled()) {
+		v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+		apic_write(APIC_LDR, v);
+	}
 	if (maxlvt >= 4) {
 		v = apic_read(APIC_LVTPC);
 		apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);
-- 
GitLab


From f184b16748f496cd399f3823151f4a6ced5a57c6 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Thu, 4 Jul 2019 20:04:41 +0530
Subject: [PATCH 1780/1835] ftrace: Fix NULL pointer dereference in
 t_probe_next()

commit 7bd46644ea0f6021dc396a39a8bfd3a58f6f1f9f upstream.

LTP testsuite on powerpc results in the below crash:

  Unable to handle kernel paging request for data at address 0x00000000
  Faulting instruction address: 0xc00000000029d800
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE SMP NR_CPUS=2048 NUMA PowerNV
  ...
  CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G        W
  NIP:  c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0
  REGS: c0002017fae8ba10 TRAP: 0300   Tainted: G        W
  MSR:  9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE>  CR: 28022422  XER: 20040000
  CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
  ...
  NIP [c00000000029d800] t_probe_next+0x60/0x180
  LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0
  Call Trace:
  [c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable)
  [c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0
  [c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640
  [c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300
  [c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70

The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests
and the crash happens when the test does 'cat
$TRACING_PATH/set_ftrace_filter'.

The address points to the second line below, in t_probe_next(), where
filter_hash is dereferenced:
  hash = iter->probe->ops.func_hash->filter_hash;
  size = 1 << hash->size_bits;

This happens due to a race with register_ftrace_function_probe(). A new
ftrace_func_probe is created and added into the func_probes list in
trace_array under ftrace_lock. However, before initializing the filter,
we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If
another process is trying to read set_ftrace_filter, it will be able to
acquire ftrace_lock during this window and it will end up seeing a NULL
filter_hash.

Fix this by just checking for a NULL filter_hash in t_probe_next(). If
the filter_hash is NULL, then this probe is just being added and we can
simply return from here.

Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.1562249521.git.naveen.n.rao@linux.vnet.ibm.com

Cc: stable@vger.kernel.org
Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ftrace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index d9dd709b3c12f..7d02a6eadfb78 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3112,6 +3112,10 @@ t_probe_next(struct seq_file *m, loff_t *pos)
 		hnd = &iter->probe_entry->hlist;
 
 	hash = iter->probe->ops.func_hash->filter_hash;
+
+	if (!hash)
+		return NULL;
+
 	size = 1 << hash->size_bits;
 
  retry:
-- 
GitLab


From 9d98e0f4859d970291dc95996d8fdee058455edc Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Thu, 4 Jul 2019 20:04:42 +0530
Subject: [PATCH 1781/1835] ftrace: Check for successful allocation of hash

commit 5b0022dd32b7c2e15edf1827ba80aa1407edf9ff upstream.

In register_ftrace_function_probe(), we are not checking the return
value of alloc_and_copy_ftrace_hash(). The subsequent call to
ftrace_match_records() may end up dereferencing the same. Add a check to
ensure this doesn't happen.

Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.1562249521.git.naveen.n.rao@linux.vnet.ibm.com

Cc: stable@vger.kernel.org
Fixes: 1ec3a81a0cf42 ("ftrace: Have each function probe use its own ftrace_ops")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ftrace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 7d02a6eadfb78..fada89337e4cb 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4317,6 +4317,11 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
 	old_hash = *orig_hash;
 	hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
 
+	if (!hash) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
 	ret = ftrace_match_records(hash, glob, strlen(glob));
 
 	/* Nothing found? */
-- 
GitLab


From 8ea639525db652d33b2673f97e2db21a6d2564ef Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Fri, 30 Aug 2019 16:30:01 -0400
Subject: [PATCH 1782/1835] ftrace: Check for empty hash and comment the race
 with registering probes

commit 372e0d01da71c84dcecf7028598a33813b0d5256 upstream.

The race between adding a function probe and reading the probes that exist
is very subtle. It needs a comment. Also, the issue can also happen if the
probe has has the EMPTY_HASH as its func_hash.

Cc: stable@vger.kernel.org
Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ftrace.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index fada89337e4cb..7e215dac96933 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3113,7 +3113,11 @@ t_probe_next(struct seq_file *m, loff_t *pos)
 
 	hash = iter->probe->ops.func_hash->filter_hash;
 
-	if (!hash)
+	/*
+	 * A probe being registered may temporarily have an empty hash
+	 * and it's at the end of the func_probes list.
+	 */
+	if (!hash || hash == EMPTY_HASH)
 		return NULL;
 
 	size = 1 << hash->size_bits;
@@ -4311,6 +4315,10 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
 
 	mutex_unlock(&ftrace_lock);
 
+	/*
+	 * Note, there's a small window here that the func_hash->filter_hash
+	 * may be NULL or empty. Need to be carefule when reading the loop.
+	 */
 	mutex_lock(&probe->ops.func_hash->regex_lock);
 
 	orig_hash = &probe->ops.func_hash->filter_hash;
-- 
GitLab


From cbf5a279a22db0a56afd6a0193f86376951aad86 Mon Sep 17 00:00:00 2001
From: Henk van der Laan <opensource@henkvdlaan.com>
Date: Fri, 16 Aug 2019 22:08:47 +0200
Subject: [PATCH 1783/1835] usb-storage: Add new JMS567 revision to
 unusual_devs

commit 08d676d1685c2a29e4d0e1b0242324e564d4589e upstream.

Revision 0x0117 suffers from an identical issue to earlier revisions,
therefore it should be added to the quirks list.

Signed-off-by: Henk van der Laan <opensource@henkvdlaan.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190816200847.21366-1-opensource@henkvdlaan.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_devs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ea0d27a94afe0..1cd9b6305b060 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2100,7 +2100,7 @@ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
 		US_FL_IGNORE_RESIDUE ),
 
 /* Reported by Michael Büsch <m@bues.ch> */
-UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0117,
 		"JMicron",
 		"USB to ATA/ATAPI Bridge",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-- 
GitLab


From ebad9fd106da2da65ac92f66c7ad8eed64f6952c Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 27 Aug 2019 12:34:36 +0200
Subject: [PATCH 1784/1835] USB: cdc-wdm: fix race between write and disconnect
 due to flag abuse

commit 1426bd2c9f7e3126e2678e7469dca9fd9fc6dd3e upstream.

In case of a disconnect an ongoing flush() has to be made fail.
Nevertheless we cannot be sure that any pending URB has already
finished, so although they will never succeed, they still must
not be touched.
The clean solution for this is to check for WDM_IN_USE
and WDM_DISCONNECTED in flush(). There is no point in ever
clearing WDM_IN_USE, as no further writes make sense.

The issue is as old as the driver.

Fixes: afba937e540c9 ("USB: CDC WDM driver")
Reported-by: syzbot+d232cca6ec42c2edb3fc@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190827103436.21143-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-wdm.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index bec581fb7c636..b8a1fdefb5150 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -587,10 +587,20 @@ static int wdm_flush(struct file *file, fl_owner_t id)
 {
 	struct wdm_device *desc = file->private_data;
 
-	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
+	wait_event(desc->wait,
+			/*
+			 * needs both flags. We cannot do with one
+			 * because resetting it would cause a race
+			 * with write() yet we need to signal
+			 * a disconnect
+			 */
+			!test_bit(WDM_IN_USE, &desc->flags) ||
+			test_bit(WDM_DISCONNECTING, &desc->flags));
 
 	/* cannot dereference desc->intf if WDM_DISCONNECTING */
-	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
+	if (test_bit(WDM_DISCONNECTING, &desc->flags))
+		return -ENODEV;
+	if (desc->werr < 0)
 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
 			desc->werr);
 
@@ -974,8 +984,6 @@ static void wdm_disconnect(struct usb_interface *intf)
 	spin_lock_irqsave(&desc->iuspin, flags);
 	set_bit(WDM_DISCONNECTING, &desc->flags);
 	set_bit(WDM_READ, &desc->flags);
-	/* to terminate pending flushes */
-	clear_bit(WDM_IN_USE, &desc->flags);
 	spin_unlock_irqrestore(&desc->iuspin, flags);
 	wake_up_all(&desc->wait);
 	mutex_lock(&desc->rlock);
-- 
GitLab


From 97bec7afb98f310f0757d96e564020d0d31b6e0c Mon Sep 17 00:00:00 2001
From: "Schmid, Carsten" <Carsten_Schmid@mentor.com>
Date: Fri, 23 Aug 2019 14:11:28 +0000
Subject: [PATCH 1785/1835] usb: hcd: use managed device resources

commit 76da906ad727048a74bb8067031ee99fc070c7da upstream.

Using managed device resources in usb_hcd_pci_probe() allows devm usage for
resource subranges, such as the mmio resource for the platform device
created to control host/device mode mux, which is a xhci extended
capability, and sits inside the xhci mmio region.

If managed device resources are not used then "parent" resource
is released before subrange at driver removal as .remove callback is
called before the devres list of resources for this device is walked
and released.

This has been observed with the xhci extended capability driver causing a
use-after-free which is now fixed.

An additional nice benefit is that error handling on driver initialisation
is simplified much.

Signed-off-by: Carsten Schmid <carsten_schmid@mentor.com>
Tested-by: Carsten Schmid <carsten_schmid@mentor.com>
Reviewed-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Fixes: fa31b3cb2ae1 ("xhci: Add Intel extended cap / otg phy mux handling")
Cc: <stable@vger.kernel.org> # v4.19+
Link: https://lore.kernel.org/r/1566569488679.31808@mentor.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hcd-pci.c | 30 ++++++++----------------------
 1 file changed, 8 insertions(+), 22 deletions(-)

diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 03432467b05fb..7537681355f67 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -216,17 +216,18 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 		/* EHCI, OHCI */
 		hcd->rsrc_start = pci_resource_start(dev, 0);
 		hcd->rsrc_len = pci_resource_len(dev, 0);
-		if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
-				driver->description)) {
+		if (!devm_request_mem_region(&dev->dev, hcd->rsrc_start,
+				hcd->rsrc_len, driver->description)) {
 			dev_dbg(&dev->dev, "controller already in use\n");
 			retval = -EBUSY;
 			goto put_hcd;
 		}
-		hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
+		hcd->regs = devm_ioremap_nocache(&dev->dev, hcd->rsrc_start,
+				hcd->rsrc_len);
 		if (hcd->regs == NULL) {
 			dev_dbg(&dev->dev, "error mapping memory\n");
 			retval = -EFAULT;
-			goto release_mem_region;
+			goto put_hcd;
 		}
 
 	} else {
@@ -240,8 +241,8 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 
 			hcd->rsrc_start = pci_resource_start(dev, region);
 			hcd->rsrc_len = pci_resource_len(dev, region);
-			if (request_region(hcd->rsrc_start, hcd->rsrc_len,
-					driver->description))
+			if (devm_request_region(&dev->dev, hcd->rsrc_start,
+					hcd->rsrc_len, driver->description))
 				break;
 		}
 		if (region == PCI_ROM_RESOURCE) {
@@ -275,20 +276,13 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	}
 
 	if (retval != 0)
-		goto unmap_registers;
+		goto put_hcd;
 	device_wakeup_enable(hcd->self.controller);
 
 	if (pci_dev_run_wake(dev))
 		pm_runtime_put_noidle(&dev->dev);
 	return retval;
 
-unmap_registers:
-	if (driver->flags & HCD_MEMORY) {
-		iounmap(hcd->regs);
-release_mem_region:
-		release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
-	} else
-		release_region(hcd->rsrc_start, hcd->rsrc_len);
 put_hcd:
 	usb_put_hcd(hcd);
 disable_pci:
@@ -347,14 +341,6 @@ void usb_hcd_pci_remove(struct pci_dev *dev)
 		dev_set_drvdata(&dev->dev, NULL);
 		up_read(&companions_rwsem);
 	}
-
-	if (hcd->driver->flags & HCD_MEMORY) {
-		iounmap(hcd->regs);
-		release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
-	} else {
-		release_region(hcd->rsrc_start, hcd->rsrc_len);
-	}
-
 	usb_put_hcd(hcd);
 	pci_disable_device(dev);
 }
-- 
GitLab


From a209827549da0724ad0b6a9dbdc6d4742d875ebb Mon Sep 17 00:00:00 2001
From: Peter Chen <peter.chen@nxp.com>
Date: Tue, 20 Aug 2019 02:07:58 +0000
Subject: [PATCH 1786/1835] usb: chipidea: udc: don't do hardware access if
 gadget has stopped

commit cbe85c88ce80fb92956a0793518d415864dcead8 upstream.

After _gadget_stop_activity is executed, we can consider the hardware
operation for gadget has finished, and the udc can be stopped and enter
low power mode. So, any later hardware operations (from usb_ep_ops APIs
or usb_gadget_ops APIs) should be considered invalid, any deinitializatons
has been covered at _gadget_stop_activity.

I meet this problem when I plug out usb cable from PC using mass_storage
gadget, my callstack like: vbus interrupt->.vbus_session->
composite_disconnect ->pm_runtime_put_sync(&_gadget->dev),
the composite_disconnect will call fsg_disable, but fsg_disable calls
usb_ep_disable using async way, there are register accesses for
usb_ep_disable. So sometimes, I get system hang due to visit register
without clock, sometimes not.

The Linux Kernel USB maintainer Alan Stern suggests this kinds of solution.
See: http://marc.info/?l=linux-usb&m=138541769810983&w=2.

Cc: <stable@vger.kernel.org> #v4.9+
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20190820020503.27080-2-peter.chen@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/chipidea/udc.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index cc7c856126df5..169ccfacfc755 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -708,12 +708,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
 	struct ci_hdrc    *ci = container_of(gadget, struct ci_hdrc, gadget);
 	unsigned long flags;
 
-	spin_lock_irqsave(&ci->lock, flags);
-	ci->gadget.speed = USB_SPEED_UNKNOWN;
-	ci->remote_wakeup = 0;
-	ci->suspended = 0;
-	spin_unlock_irqrestore(&ci->lock, flags);
-
 	/* flush all endpoints */
 	gadget_for_each_ep(ep, gadget) {
 		usb_ep_fifo_flush(ep);
@@ -731,6 +725,12 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
 		ci->status = NULL;
 	}
 
+	spin_lock_irqsave(&ci->lock, flags);
+	ci->gadget.speed = USB_SPEED_UNKNOWN;
+	ci->remote_wakeup = 0;
+	ci->suspended = 0;
+	spin_unlock_irqrestore(&ci->lock, flags);
+
 	return 0;
 }
 
@@ -1302,6 +1302,10 @@ static int ep_disable(struct usb_ep *ep)
 		return -EBUSY;
 
 	spin_lock_irqsave(hwep->lock, flags);
+	if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return 0;
+	}
 
 	/* only internal SW should disable ctrl endpts */
 
@@ -1391,6 +1395,10 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
 		return -EINVAL;
 
 	spin_lock_irqsave(hwep->lock, flags);
+	if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return 0;
+	}
 	retval = _ep_queue(ep, req, gfp_flags);
 	spin_unlock_irqrestore(hwep->lock, flags);
 	return retval;
@@ -1414,8 +1422,8 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
 		return -EINVAL;
 
 	spin_lock_irqsave(hwep->lock, flags);
-
-	hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+	if (hwep->ci->gadget.speed != USB_SPEED_UNKNOWN)
+		hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
 
 	list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
 		dma_pool_free(hwep->td_pool, node->ptr, node->dma);
@@ -1486,6 +1494,10 @@ static void ep_fifo_flush(struct usb_ep *ep)
 	}
 
 	spin_lock_irqsave(hwep->lock, flags);
+	if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(hwep->lock, flags);
+		return;
+	}
 
 	hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
 
@@ -1558,6 +1570,10 @@ static int ci_udc_wakeup(struct usb_gadget *_gadget)
 	int ret = 0;
 
 	spin_lock_irqsave(&ci->lock, flags);
+	if (ci->gadget.speed == USB_SPEED_UNKNOWN) {
+		spin_unlock_irqrestore(&ci->lock, flags);
+		return 0;
+	}
 	if (!ci->remote_wakeup) {
 		ret = -EOPNOTSUPP;
 		goto out;
-- 
GitLab


From 7af7737491ceb904331299733614cbaaa6e375ba Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Tue, 27 Aug 2019 12:51:50 +0900
Subject: [PATCH 1787/1835] usb: host: ohci: fix a race condition between
 shutdown and irq

commit a349b95d7ca0cea71be4a7dac29830703de7eb62 upstream.

This patch fixes an issue that the following error is
possible to happen when ohci hardware causes an interruption
and the system is shutting down at the same time.

[   34.851754] usb 2-1: USB disconnect, device number 2
[   35.166658] irq 156: nobody cared (try booting with the "irqpoll" option)
[   35.173445] CPU: 0 PID: 22 Comm: kworker/0:1 Not tainted 5.3.0-rc5 #85
[   35.179964] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
[   35.187886] Workqueue: usb_hub_wq hub_event
[   35.192063] Call trace:
[   35.194509]  dump_backtrace+0x0/0x150
[   35.198165]  show_stack+0x14/0x20
[   35.201475]  dump_stack+0xa0/0xc4
[   35.204785]  __report_bad_irq+0x34/0xe8
[   35.208614]  note_interrupt+0x2cc/0x318
[   35.212446]  handle_irq_event_percpu+0x5c/0x88
[   35.216883]  handle_irq_event+0x48/0x78
[   35.220712]  handle_fasteoi_irq+0xb4/0x188
[   35.224802]  generic_handle_irq+0x24/0x38
[   35.228804]  __handle_domain_irq+0x5c/0xb0
[   35.232893]  gic_handle_irq+0x58/0xa8
[   35.236548]  el1_irq+0xb8/0x180
[   35.239681]  __do_softirq+0x94/0x23c
[   35.243253]  irq_exit+0xd0/0xd8
[   35.246387]  __handle_domain_irq+0x60/0xb0
[   35.250475]  gic_handle_irq+0x58/0xa8
[   35.254130]  el1_irq+0xb8/0x180
[   35.257268]  kernfs_find_ns+0x5c/0x120
[   35.261010]  kernfs_find_and_get_ns+0x3c/0x60
[   35.265361]  sysfs_unmerge_group+0x20/0x68
[   35.269454]  dpm_sysfs_remove+0x2c/0x68
[   35.273284]  device_del+0x80/0x370
[   35.276683]  hid_destroy_device+0x28/0x60
[   35.280686]  usbhid_disconnect+0x4c/0x80
[   35.284602]  usb_unbind_interface+0x6c/0x268
[   35.288867]  device_release_driver_internal+0xe4/0x1b0
[   35.293998]  device_release_driver+0x14/0x20
[   35.298261]  bus_remove_device+0x110/0x128
[   35.302350]  device_del+0x148/0x370
[   35.305832]  usb_disable_device+0x8c/0x1d0
[   35.309921]  usb_disconnect+0xc8/0x2d0
[   35.313663]  hub_event+0x6e0/0x1128
[   35.317146]  process_one_work+0x1e0/0x320
[   35.321148]  worker_thread+0x40/0x450
[   35.324805]  kthread+0x124/0x128
[   35.328027]  ret_from_fork+0x10/0x18
[   35.331594] handlers:
[   35.333862] [<0000000079300c1d>] usb_hcd_irq
[   35.338126] [<0000000079300c1d>] usb_hcd_irq
[   35.342389] Disabling IRQ #156

ohci_shutdown() disables all the interrupt and rh_state is set to
OHCI_RH_HALTED. In other hand, ohci_irq() is possible to enable
OHCI_INTR_SF and OHCI_INTR_MIE on ohci_irq(). Note that OHCI_INTR_SF
is possible to be set by start_ed_unlink() which is called:
 ohci_irq()
  -> process_done_list()
   -> takeback_td()
    -> start_ed_unlink()

So, ohci_irq() has the following condition, the issue happens by
&ohci->regs->intrenable = OHCI_INTR_MIE | OHCI_INTR_SF and
ohci->rh_state = OHCI_RH_HALTED:

	/* interrupt for some other device? */
	if (ints == 0 || unlikely(ohci->rh_state == OHCI_RH_HALTED))
		return IRQ_NOTMINE;

To fix the issue, ohci_shutdown() holds the spin lock while disabling
the interruption and changing the rh_state flag to prevent reenable
the OHCI_INTR_MIE unexpectedly. Note that io_watchdog_func() also
calls the ohci_shutdown() and it already held the spin lock, so that
the patch makes a new function as _ohci_shutdown().

This patch is inspired by a Renesas R-Car Gen3 BSP patch
from Tho Vu.

Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1566877910-6020-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ohci-hcd.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 210181fd98d2e..af11887f5f9e4 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -418,8 +418,7 @@ static void ohci_usb_reset (struct ohci_hcd *ohci)
  * other cases where the next software may expect clean state from the
  * "firmware".  this is bus-neutral, unlike shutdown() methods.
  */
-static void
-ohci_shutdown (struct usb_hcd *hcd)
+static void _ohci_shutdown(struct usb_hcd *hcd)
 {
 	struct ohci_hcd *ohci;
 
@@ -435,6 +434,16 @@ ohci_shutdown (struct usb_hcd *hcd)
 	ohci->rh_state = OHCI_RH_HALTED;
 }
 
+static void ohci_shutdown(struct usb_hcd *hcd)
+{
+	struct ohci_hcd	*ohci = hcd_to_ohci(hcd);
+	unsigned long flags;
+
+	spin_lock_irqsave(&ohci->lock, flags);
+	_ohci_shutdown(hcd);
+	spin_unlock_irqrestore(&ohci->lock, flags);
+}
+
 /*-------------------------------------------------------------------------*
  * HC functions
  *-------------------------------------------------------------------------*/
@@ -752,7 +761,7 @@ static void io_watchdog_func(struct timer_list *t)
  died:
 			usb_hc_died(ohci_to_hcd(ohci));
 			ohci_dump(ohci);
-			ohci_shutdown(ohci_to_hcd(ohci));
+			_ohci_shutdown(ohci_to_hcd(ohci));
 			goto done;
 		} else {
 			/* No write back because the done queue was empty */
-- 
GitLab


From f46fd68a541ffc4ee23ea1b3d5f407b89d2a2742 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Tue, 27 Aug 2019 14:51:12 +0200
Subject: [PATCH 1788/1835] usb: host: xhci: rcar: Fix typo in compatible
 string matching

commit 636bd02a7ba9025ff851d0cfb92768c8fa865859 upstream.

It's spelled "renesas", not "renensas".

Due to this typo, RZ/G1M and RZ/G1N were not covered by the check.

Fixes: 2dc240a3308b ("usb: host: xhci: rcar: retire use of xhci_plat_type_is()")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20190827125112.12192-1-geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-rcar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index 8616c52849c6d..2b0ccd150209f 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -104,7 +104,7 @@ static int xhci_rcar_is_gen2(struct device *dev)
 	return of_device_is_compatible(node, "renesas,xhci-r8a7790") ||
 		of_device_is_compatible(node, "renesas,xhci-r8a7791") ||
 		of_device_is_compatible(node, "renesas,xhci-r8a7793") ||
-		of_device_is_compatible(node, "renensas,rcar-gen2-xhci");
+		of_device_is_compatible(node, "renesas,rcar-gen2-xhci");
 }
 
 static int xhci_rcar_is_gen3(struct device *dev)
-- 
GitLab


From f79d1598968b04204b3ace7adbab9f22cf09037e Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Wed, 28 Aug 2019 01:34:49 +0800
Subject: [PATCH 1789/1835] USB: storage: ums-realtek: Update module parameter
 description for auto_delink_en

commit f6445b6b2f2bb1745080af4a0926049e8bca2617 upstream.

The option named "auto_delink_en" is a bit misleading, as setting it to
false doesn't really disable auto-delink but let auto-delink be firmware
controlled.

Update the description to reflect the real usage of this parameter.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190827173450.13572-1-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/realtek_cr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index cc794e25a0b6e..beaffac805af2 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -38,7 +38,7 @@ MODULE_LICENSE("GPL");
 
 static int auto_delink_en = 1;
 module_param(auto_delink_en, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(auto_delink_en, "enable auto delink");
+MODULE_PARM_DESC(auto_delink_en, "auto delink mode (0=firmware, 1=software [default])");
 
 #ifdef CONFIG_REALTEK_AUTOPM
 static int ss_en = 1;
-- 
GitLab


From 5ed36421af249bdcc6e8ca953e6a00abe9bb6db3 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Wed, 28 Aug 2019 01:34:50 +0800
Subject: [PATCH 1790/1835] USB: storage: ums-realtek: Whitelist auto-delink
 support

commit 1902a01e2bcc3abd7c9a18dc05e78c7ab4a53c54 upstream.

Auto-delink requires writing special registers to ums-realtek devices.
Unconditionally enable auto-delink may break newer devices.

So only enable auto-delink by default for the original three IDs,
0x0138, 0x0158 and 0x0159.

Realtek is working on a patch to properly support auto-delink for other
IDs.

BugLink: https://bugs.launchpad.net/bugs/1838886
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190827173450.13572-2-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/realtek_cr.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index beaffac805af2..1d9ce9cbc831d 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -996,12 +996,15 @@ static int init_realtek_cr(struct us_data *us)
 			goto INIT_FAIL;
 	}
 
-	if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
-	    CHECK_FW_VER(chip, 0x5901))
-		SET_AUTO_DELINK(chip);
-	if (STATUS_LEN(chip) == 16) {
-		if (SUPPORT_AUTO_DELINK(chip))
+	if (CHECK_PID(chip, 0x0138) || CHECK_PID(chip, 0x0158) ||
+	    CHECK_PID(chip, 0x0159)) {
+		if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
+				CHECK_FW_VER(chip, 0x5901))
 			SET_AUTO_DELINK(chip);
+		if (STATUS_LEN(chip) == 16) {
+			if (SUPPORT_AUTO_DELINK(chip))
+				SET_AUTO_DELINK(chip);
+		}
 	}
 #ifdef CONFIG_REALTEK_AUTOPM
 	if (ss_en)
-- 
GitLab


From be8e9fa67ea730ab0287c6d59dfef9aa680d95e1 Mon Sep 17 00:00:00 2001
From: Tomas Winkler <tomas.winkler@intel.com>
Date: Mon, 19 Aug 2019 13:32:10 +0300
Subject: [PATCH 1791/1835] mei: me: add Tiger Lake point LP device ID

commit 587f17407741a5be07f8a2d1809ec946c8120962 upstream.

Add Tiger Lake Point device ID for TGP LP.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190819103210.32748-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/hw-me-regs.h | 2 ++
 drivers/misc/mei/pci-me.c     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 225373e4a9ef9..cdd7af16d5eee 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -141,6 +141,8 @@
 
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
 
+#define MEI_DEV_ID_TGP_LP     0xA0E0  /* Tiger Lake Point LP */
+
 #define MEI_DEV_ID_MCC        0x4B70  /* Mule Creek Canyon (EHL) */
 #define MEI_DEV_ID_MCC_4      0x4B75  /* Mule Creek Canyon 4 (EHL) */
 
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index a66ebceea4081..e41f9e0a3fdf9 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -107,6 +107,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
 
+	{MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH12_CFG)},
+
 	{MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH12_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
 
-- 
GitLab


From 1ecc65e1418be1209a20e83c2f5134d12f58848f Mon Sep 17 00:00:00 2001
From: Eugen Hristev <eugen.hristev@microchip.com>
Date: Thu, 8 Aug 2019 08:35:40 +0000
Subject: [PATCH 1792/1835] mmc: sdhci-of-at91: add quirk for broken HS200

commit 7871aa60ae0086fe4626abdf5ed13eeddf306c61 upstream.

HS200 is not implemented in the driver, but the controller claims it
through caps. Remove it via a quirk, to make sure the mmc core do not try
to enable HS200, as it causes the eMMC initialization to fail.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: bb5f8ea4d514 ("mmc: sdhci-of-at91: introduce driver for the Atmel SDMMC")
Cc: stable@vger.kernel.org # v4.4+
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-of-at91.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 682c573e20a72..e284102c16e97 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -365,6 +365,9 @@ static int sdhci_at91_probe(struct platform_device *pdev)
 	pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
 	pm_runtime_use_autosuspend(&pdev->dev);
 
+	/* HS200 is broken at this moment */
+	host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200;
+
 	ret = sdhci_add_host(host);
 	if (ret)
 		goto pm_runtime_disable;
-- 
GitLab


From abc42341b6c4871161c99eeeb4733823f36af642 Mon Sep 17 00:00:00 2001
From: Ulf Hansson <ulf.hansson@linaro.org>
Date: Tue, 27 Aug 2019 10:10:43 +0200
Subject: [PATCH 1793/1835] mmc: core: Fix init of SD cards reporting an
 invalid VDD range

commit 72741084d903e65e121c27bd29494d941729d4a1 upstream.

The OCR register defines the supported range of VDD voltages for SD cards.
However, it has turned out that some SD cards reports an invalid voltage
range, for example having bit7 set.

When a host supports MMC_CAP2_FULL_PWR_CYCLE and some of the voltages from
the invalid VDD range, this triggers the core to run a power cycle of the
card to try to initialize it at the lowest common supported voltage.
Obviously this fails, since the card can't support it.

Let's fix this problem, by clearing invalid bits from the read OCR register
for SD cards, before proceeding with the VDD voltage negotiation.

Cc: stable@vger.kernel.org
Reported-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Philip Langdale <philipl@overt.org>
Tested-by: Philip Langdale <philipl@overt.org>
Tested-by: Manuel Presnitz <mail@mpy.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/sd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index cfb8ee24eaba1..04738359ec029 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -1277,6 +1277,12 @@ int mmc_attach_sd(struct mmc_host *host)
 			goto err;
 	}
 
+	/*
+	 * Some SD cards claims an out of spec VDD voltage range. Let's treat
+	 * these bits as being in-valid and especially also bit7.
+	 */
+	ocr &= ~0x7FFF;
+
 	rocr = mmc_select_voltage(host, ocr);
 
 	/*
-- 
GitLab


From cad1d3bfdd5dfb48781cbb8733e2f305f8f604fb Mon Sep 17 00:00:00 2001
From: Ding Xiang <dingxiang@cmss.chinamobile.com>
Date: Wed, 21 Aug 2019 10:49:52 +0300
Subject: [PATCH 1794/1835] stm class: Fix a double free of stm_source_device

commit 961b6ffe0e2c403b09a8efe4a2e986b3c415391a upstream.

In the error path of stm_source_register_device(), the kfree is
unnecessary, as the put_device() before it ends up calling
stm_source_device_release() to free stm_source_device, leading to
a double free at the outer kfree() call. Remove it.

Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: 7bd1d4093c2fa ("stm class: Introduce an abstraction for System Trace Module devices")
Link: https://lore.kernel.org/linux-arm-kernel/1563354988-23826-1-git-send-email-dingxiang@cmss.chinamobile.com/
Cc: stable@vger.kernel.org # v4.4+
Link: https://lore.kernel.org/r/20190821074955.3925-2-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/stm/core.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9ec9197edffaf..eeba421dc823d 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1098,7 +1098,6 @@ int stm_source_register_device(struct device *parent,
 
 err:
 	put_device(&src->dev);
-	kfree(src);
 
 	return err;
 }
-- 
GitLab


From ce1c894e1e89101169c1ea6fb084d25dc44898fc Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date: Wed, 21 Aug 2019 10:49:54 +0300
Subject: [PATCH 1795/1835] intel_th: pci: Add support for another Lewisburg
 PCH

commit 164eb56e3b64f3a816238d410c9efec7567a82ef upstream.

Add support for the Trace Hub in another Lewisburg PCH.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: stable@vger.kernel.org # v4.14+
Link: https://lore.kernel.org/r/20190821074955.3925-4-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/intel_th/pci.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index e759ac0d48bee..ac72184732b3b 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -140,6 +140,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
 		.driver_data = (kernel_ulong_t)0,
 	},
+	{
+		/* Lewisburg PCH */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa226),
+		.driver_data = (kernel_ulong_t)0,
+	},
 	{
 		/* Gemini Lake */
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
-- 
GitLab


From e91c9c119dba1f16ae5bff1c4259a3df290cbe0b Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date: Wed, 21 Aug 2019 10:49:55 +0300
Subject: [PATCH 1796/1835] intel_th: pci: Add Tiger Lake support

commit 9c78255fdde45c6b9a1ee30f652f7b34c727f5c7 upstream.

This adds support for the Trace Hub in Tiger Lake PCH.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: stable@vger.kernel.org # v4.14+
Link: https://lore.kernel.org/r/20190821074955.3925-5-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/intel_th/pci.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index ac72184732b3b..968319f4e5f10 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -180,6 +180,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
 	},
+	{
+		/* Tiger Lake PCH */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
 	{ 0 },
 };
 
-- 
GitLab


From e44840b7320c5019faa2e33d684e75620dcab6e2 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 22 Aug 2019 14:52:12 +0100
Subject: [PATCH 1797/1835] typec: tcpm: fix a typo in the comparison of
 pdo_max_voltage

commit a684d8fd87182090ee96e34519ecdf009cef093a upstream.

There appears to be a typo in the comparison of pdo_max_voltage[i]
with the previous value, currently it is checking against the
array pdo_min_voltage rather than pdo_max_voltage. I believe this
is a typo. Fix this.

Addresses-Coverity: ("Copy-paste error")
Fixes: 5007e1b5db73 ("typec: tcpm: Validate source and sink caps")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20190822135212.10195-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 5f29ce8d6c3f9..fb20aa974ae12 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -1445,7 +1445,7 @@ static enum pdo_err tcpm_caps_err(struct tcpm_port *port, const u32 *pdo,
 				else if ((pdo_min_voltage(pdo[i]) ==
 					  pdo_min_voltage(pdo[i - 1])) &&
 					 (pdo_max_voltage(pdo[i]) ==
-					  pdo_min_voltage(pdo[i - 1])))
+					  pdo_max_voltage(pdo[i - 1])))
 					return PDO_ERR_DUPE_PDO;
 				break;
 			/*
-- 
GitLab


From 79829fc4ff33199bc9adc083785f15a004b15fde Mon Sep 17 00:00:00 2001
From: Eddie James <eajames@linux.ibm.com>
Date: Tue, 27 Aug 2019 12:12:49 +0800
Subject: [PATCH 1798/1835] fsi: scom: Don't abort operations for minor errors

commit 8919dfcb31161fae7d607bbef5247e5e82fd6457 upstream.

The scom driver currently fails out of operations if certain system
errors are flagged in the status register; system checkstop, special
attention, or recoverable error. These errors won't impact the ability
of the scom engine to perform operations, so the driver should continue
under these conditions.
Also, don't do a PIB reset for these conditions, since it won't help.

Fixes: 6b293258cded ("fsi: scom: Major overhaul")
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Jeremy Kerr <jk@ozlabs.org>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20190827041249.13381-1-jk@ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/fsi/fsi-scom.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
index df94021dd9d12..fdc0e458dbaaf 100644
--- a/drivers/fsi/fsi-scom.c
+++ b/drivers/fsi/fsi-scom.c
@@ -47,8 +47,7 @@
 #define SCOM_STATUS_PIB_RESP_MASK	0x00007000
 #define SCOM_STATUS_PIB_RESP_SHIFT	12
 
-#define SCOM_STATUS_ANY_ERR		(SCOM_STATUS_ERR_SUMMARY | \
-					 SCOM_STATUS_PROTECTION | \
+#define SCOM_STATUS_ANY_ERR		(SCOM_STATUS_PROTECTION | \
 					 SCOM_STATUS_PARITY |	  \
 					 SCOM_STATUS_PIB_ABORT | \
 					 SCOM_STATUS_PIB_RESP_MASK)
@@ -260,11 +259,6 @@ static int handle_fsi2pib_status(struct scom_device *scom, uint32_t status)
 	/* Return -EBUSY on PIB abort to force a retry */
 	if (status & SCOM_STATUS_PIB_ABORT)
 		return -EBUSY;
-	if (status & SCOM_STATUS_ERR_SUMMARY) {
-		fsi_device_write(scom->fsi_dev, SCOM_FSI2PIB_RESET_REG, &dummy,
-				 sizeof(uint32_t));
-		return -EIO;
-	}
 	return 0;
 }
 
-- 
GitLab


From b865c2c6e3f2ab13196c736318f2112d22b7c9de Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Tue, 30 Jul 2019 21:29:52 +0800
Subject: [PATCH 1799/1835] lib: logic_pio: Fix RCU usage

commit 06709e81c668f5f56c65b806895b278517bd44e0 upstream.

The traversing of io_range_list with list_for_each_entry_rcu()
is not properly protected by rcu_read_lock() and rcu_read_unlock(),
so add them.

These functions mark the critical section scope where the list is
protected for the reader, it cannot be  "reclaimed". Any updater - in
this case, the logical PIO registration functions - cannot update the
list until the reader exits this critical section.

In addition, the list traversing used in logic_pio_register_range()
does not need to use the rcu variant.

This is because we are already using io_range_mutex to guarantee mutual
exclusion from mutating the list.

Cc: stable@vger.kernel.org
Fixes: 031e3601869c ("lib: Add generic PIO mapping method")
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/logic_pio.c | 49 +++++++++++++++++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 14 deletions(-)

diff --git a/lib/logic_pio.c b/lib/logic_pio.c
index feea48fd1a0dd..761296376fbc7 100644
--- a/lib/logic_pio.c
+++ b/lib/logic_pio.c
@@ -46,7 +46,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
 	end = new_range->hw_start + new_range->size;
 
 	mutex_lock(&io_range_mutex);
-	list_for_each_entry_rcu(range, &io_range_list, list) {
+	list_for_each_entry(range, &io_range_list, list) {
 		if (range->fwnode == new_range->fwnode) {
 			/* range already there */
 			goto end_register;
@@ -108,26 +108,38 @@ end_register:
  */
 struct logic_pio_hwaddr *find_io_range_by_fwnode(struct fwnode_handle *fwnode)
 {
-	struct logic_pio_hwaddr *range;
+	struct logic_pio_hwaddr *range, *found_range = NULL;
 
+	rcu_read_lock();
 	list_for_each_entry_rcu(range, &io_range_list, list) {
-		if (range->fwnode == fwnode)
-			return range;
+		if (range->fwnode == fwnode) {
+			found_range = range;
+			break;
+		}
 	}
-	return NULL;
+	rcu_read_unlock();
+
+	return found_range;
 }
 
 /* Return a registered range given an input PIO token */
 static struct logic_pio_hwaddr *find_io_range(unsigned long pio)
 {
-	struct logic_pio_hwaddr *range;
+	struct logic_pio_hwaddr *range, *found_range = NULL;
 
+	rcu_read_lock();
 	list_for_each_entry_rcu(range, &io_range_list, list) {
-		if (in_range(pio, range->io_start, range->size))
-			return range;
+		if (in_range(pio, range->io_start, range->size)) {
+			found_range = range;
+			break;
+		}
 	}
-	pr_err("PIO entry token %lx invalid\n", pio);
-	return NULL;
+	rcu_read_unlock();
+
+	if (!found_range)
+		pr_err("PIO entry token 0x%lx invalid\n", pio);
+
+	return found_range;
 }
 
 /**
@@ -180,14 +192,23 @@ unsigned long logic_pio_trans_cpuaddr(resource_size_t addr)
 {
 	struct logic_pio_hwaddr *range;
 
+	rcu_read_lock();
 	list_for_each_entry_rcu(range, &io_range_list, list) {
 		if (range->flags != LOGIC_PIO_CPU_MMIO)
 			continue;
-		if (in_range(addr, range->hw_start, range->size))
-			return addr - range->hw_start + range->io_start;
+		if (in_range(addr, range->hw_start, range->size)) {
+			unsigned long cpuaddr;
+
+			cpuaddr = addr - range->hw_start + range->io_start;
+
+			rcu_read_unlock();
+			return cpuaddr;
+		}
 	}
-	pr_err("addr %llx not registered in io_range_list\n",
-	       (unsigned long long) addr);
+	rcu_read_unlock();
+
+	pr_err("addr %pa not registered in io_range_list\n", &addr);
+
 	return ~0UL;
 }
 
-- 
GitLab


From 7faef13e6f68d50aa50846cfc79ae499f82becf6 Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Tue, 30 Jul 2019 21:29:53 +0800
Subject: [PATCH 1800/1835] lib: logic_pio: Avoid possible overlap for
 unregistering regions

commit 0a27142bd1ee259e24a0be2b0133e5ca5df8da91 upstream.

The code was originally written to not support unregistering logical PIO
regions.

To accommodate supporting unregistering logical PIO regions, subtly modify
LOGIC_PIO_CPU_MMIO region registration code, such that the "end" of the
registered regions is the "end" of the last region, and not the sum of
the sizes of all the registered regions.

Cc: stable@vger.kernel.org
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/logic_pio.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/logic_pio.c b/lib/logic_pio.c
index 761296376fbc7..d0165c88f705b 100644
--- a/lib/logic_pio.c
+++ b/lib/logic_pio.c
@@ -35,7 +35,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
 	struct logic_pio_hwaddr *range;
 	resource_size_t start;
 	resource_size_t end;
-	resource_size_t mmio_sz = 0;
+	resource_size_t mmio_end = 0;
 	resource_size_t iio_sz = MMIO_UPPER_LIMIT;
 	int ret = 0;
 
@@ -56,7 +56,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
 			/* for MMIO ranges we need to check for overlap */
 			if (start >= range->hw_start + range->size ||
 			    end < range->hw_start) {
-				mmio_sz += range->size;
+				mmio_end = range->io_start + range->size;
 			} else {
 				ret = -EFAULT;
 				goto end_register;
@@ -69,16 +69,16 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
 
 	/* range not registered yet, check for available space */
 	if (new_range->flags == LOGIC_PIO_CPU_MMIO) {
-		if (mmio_sz + new_range->size - 1 > MMIO_UPPER_LIMIT) {
+		if (mmio_end + new_range->size - 1 > MMIO_UPPER_LIMIT) {
 			/* if it's too big check if 64K space can be reserved */
-			if (mmio_sz + SZ_64K - 1 > MMIO_UPPER_LIMIT) {
+			if (mmio_end + SZ_64K - 1 > MMIO_UPPER_LIMIT) {
 				ret = -E2BIG;
 				goto end_register;
 			}
 			new_range->size = SZ_64K;
 			pr_warn("Requested IO range too big, new size set to 64K\n");
 		}
-		new_range->io_start = mmio_sz;
+		new_range->io_start = mmio_end;
 	} else if (new_range->flags == LOGIC_PIO_INDIRECT) {
 		if (iio_sz + new_range->size - 1 > IO_SPACE_LIMIT) {
 			ret = -E2BIG;
-- 
GitLab


From c4616a9b3d3f8763532dfeded6a7e9e1f592bba7 Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Tue, 30 Jul 2019 21:29:54 +0800
Subject: [PATCH 1801/1835] lib: logic_pio: Add logic_pio_unregister_range()

commit b884e2de2afc68ce30f7093747378ef972dde253 upstream.

Add a function to unregister a logical PIO range.

Logical PIO space can still be leaked when unregistering certain
LOGIC_PIO_CPU_MMIO regions, but this acceptable for now since there are no
callers to unregister LOGIC_PIO_CPU_MMIO regions, and the logical PIO
region allocation scheme would need significant work to improve this.

Cc: stable@vger.kernel.org
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/logic_pio.h |  1 +
 lib/logic_pio.c           | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/include/linux/logic_pio.h b/include/linux/logic_pio.h
index cbd9d84956902..88e1e6304a719 100644
--- a/include/linux/logic_pio.h
+++ b/include/linux/logic_pio.h
@@ -117,6 +117,7 @@ struct logic_pio_hwaddr *find_io_range_by_fwnode(struct fwnode_handle *fwnode);
 unsigned long logic_pio_trans_hwaddr(struct fwnode_handle *fwnode,
 			resource_size_t hw_addr, resource_size_t size);
 int logic_pio_register_range(struct logic_pio_hwaddr *newrange);
+void logic_pio_unregister_range(struct logic_pio_hwaddr *range);
 resource_size_t logic_pio_to_hwaddr(unsigned long pio);
 unsigned long logic_pio_trans_cpuaddr(resource_size_t hw_addr);
 
diff --git a/lib/logic_pio.c b/lib/logic_pio.c
index d0165c88f705b..905027574e5d8 100644
--- a/lib/logic_pio.c
+++ b/lib/logic_pio.c
@@ -98,6 +98,20 @@ end_register:
 	return ret;
 }
 
+/**
+ * logic_pio_unregister_range - unregister a logical PIO range for a host
+ * @range: pointer to the IO range which has been already registered.
+ *
+ * Unregister a previously-registered IO range node.
+ */
+void logic_pio_unregister_range(struct logic_pio_hwaddr *range)
+{
+	mutex_lock(&io_range_mutex);
+	list_del_rcu(&range->list);
+	mutex_unlock(&io_range_mutex);
+	synchronize_rcu();
+}
+
 /**
  * find_io_range_by_fwnode - find logical PIO range for given FW node
  * @fwnode: FW node handle associated with logical PIO range
-- 
GitLab


From 6d3003f56449756ad5bcdd2994a0d7262e84da99 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Tue, 27 Aug 2019 17:33:32 +0800
Subject: [PATCH 1802/1835] drm/amdgpu: Add APTX quirk for Dell Latitude 5495

commit 317a3aaef94d73ba6be88aea11b41bb631b2d581 upstream.

Needs ATPX rather than _PR3 to really turn off the dGPU. This can save
~5W when dGPU is runtime-suspended.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 92b11de195813..354c8b6106dc2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -575,6 +575,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
 	{ 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
 	{ 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
 	{ 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
+	{ 0x1002, 0x699f, 0x1028, 0x0814, AMDGPU_PX_QUIRK_FORCE_ATPX },
 	{ 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
 	{ 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
 	{ 0, 0, 0, 0, 0 },
-- 
GitLab


From c7615333645de572cae573da0a92dd3fc8e099e0 Mon Sep 17 00:00:00 2001
From: Xiong Zhang <xiong.y.zhang@intel.com>
Date: Tue, 20 Aug 2019 13:46:17 +0800
Subject: [PATCH 1803/1835] drm/i915: Don't deballoon unused ggtt drm_mm_node
 in linux guest

commit 0a3dfbb5cd9033752639ef33e319c2f2863c713a upstream.

The following call trace may exist in linux guest dmesg when guest i915
driver is unloaded.
[   90.776610] [drm:vgt_deballoon_space.isra.0 [i915]] deballoon space: range [0x0 - 0x0] 0 KiB.
[   90.776621] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0
[   90.776691] IP: drm_mm_remove_node+0x4d/0x320 [drm]
[   90.776718] PGD 800000012c7d0067 P4D 800000012c7d0067 PUD 138e4c067 PMD 0
[   90.777091] task: ffff9adab60f2f00 task.stack: ffffaf39c0fe0000
[   90.777142] RIP: 0010:drm_mm_remove_node+0x4d/0x320 [drm]
[   90.777573] Call Trace:
[   90.777653]  intel_vgt_deballoon+0x4c/0x60 [i915]
[   90.777729]  i915_ggtt_cleanup_hw+0x121/0x190 [i915]
[   90.777792]  i915_driver_unload+0x145/0x180 [i915]
[   90.777856]  i915_pci_remove+0x15/0x20 [i915]
[   90.777890]  pci_device_remove+0x3b/0xc0
[   90.777916]  device_release_driver_internal+0x157/0x220
[   90.777945]  driver_detach+0x39/0x70
[   90.777967]  bus_remove_driver+0x51/0xd0
[   90.777990]  pci_unregister_driver+0x23/0x90
[   90.778019]  SyS_delete_module+0x1da/0x240
[   90.778045]  entry_SYSCALL_64_fastpath+0x24/0x87
[   90.778072] RIP: 0033:0x7f34312af067
[   90.778092] RSP: 002b:00007ffdea3da0d8 EFLAGS: 00000206
[   90.778297] RIP: drm_mm_remove_node+0x4d/0x320 [drm] RSP: ffffaf39c0fe3dc0
[   90.778344] ---[ end trace f4b1bc8305fc59dd ]---

Four drm_mm_node are used to reserve guest ggtt space, but some of them
may be skipped and not initialised due to space constraints in
intel_vgt_balloon(). If drm_mm_remove_node() is called with
uninitialized drm_mm_node, the above call trace occurs.

This patch check drm_mm_node's validity before calling
drm_mm_remove_node().

Fixes: ff8f797557c7("drm/i915: return the correct usable aperture size under gvt environment")
Cc: stable@vger.kernel.org
Signed-off-by: Xiong Zhang <xiong.y.zhang@intel.com>
Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/1566279978-9659-1-git-send-email-xiong.y.zhang@intel.com
(cherry picked from commit 4776f3529d6b1e47f02904ad1d264d25ea22b27b)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/i915_vgpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index 869cf4a3b6de7..a6cb3e034dd5a 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -100,6 +100,9 @@ static struct _balloon_info_ bl_info;
 static void vgt_deballoon_space(struct i915_ggtt *ggtt,
 				struct drm_mm_node *node)
 {
+	if (!drm_mm_node_allocated(node))
+		return;
+
 	DRM_DEBUG_DRIVER("deballoon space: range [0x%llx - 0x%llx] %llu KiB.\n",
 			 node->start,
 			 node->start + node->size,
-- 
GitLab


From 68b58d3924645356415ae4f6922da8fa14ea1642 Mon Sep 17 00:00:00 2001
From: Lyude Paul <lyude@redhat.com>
Date: Fri, 23 Aug 2019 16:52:51 -0400
Subject: [PATCH 1804/1835] drm/i915: Call dma_set_max_seg_size() in
 i915_driver_hw_probe()

commit 32f0a982650b123bdab36865617d3e03ebcacf3b upstream.

Currently, we don't call dma_set_max_seg_size() for i915 because we
intentionally do not limit the segment length that the device supports.
However, this results in a warning being emitted if we try to map
anything larger than SZ_64K on a kernel with CONFIG_DMA_API_DEBUG_SG
enabled:

[    7.751926] DMA-API: i915 0000:00:02.0: mapping sg segment longer
than device claims to support [len=98304] [max=65536]
[    7.751934] WARNING: CPU: 5 PID: 474 at kernel/dma/debug.c:1220
debug_dma_map_sg+0x20f/0x340

This was originally brought up on
https://bugs.freedesktop.org/show_bug.cgi?id=108517 , and the consensus
there was it wasn't really useful to set a limit (and that dma-debug
isn't really all that useful for i915 in the first place). Unfortunately
though, CONFIG_DMA_API_DEBUG_SG is enabled in the debug configs for
various distro kernels. Since a WARN_ON() will disable automatic problem
reporting (and cause any CI with said option enabled to start
complaining), we really should just fix the problem.

Note that as me and Chris Wilson discussed, the other solution for this
would be to make DMA-API not make such assumptions when a driver hasn't
explicitly set a maximum segment size. But, taking a look at the commit
which originally introduced this behavior, commit 78c47830a5cb
("dma-debug: check scatterlist segments"), there is an explicit mention
of this assumption and how it applies to devices with no segment size:

	Conversely, devices which are less limited than the rather
	conservative defaults, or indeed have no limitations at all
	(e.g. GPUs with their own internal MMU), should be encouraged to
	set appropriate dma_parms, as they may get more efficient DMA
	mapping performance out of it.

So unless there's any concerns (I'm open to discussion!), let's just
follow suite and call dma_set_max_seg_size() with UINT_MAX as our limit
to silence any warnings.

Changes since v3:
* Drop patch for enabling CONFIG_DMA_API_DEBUG_SG in CI. It looks like
  just turning it on causes the kernel to spit out bogus WARN_ONs()
  during some igt tests which would otherwise require teaching igt to
  disable the various DMA-API debugging options causing this. This is
  too much work to be worth it, since DMA-API debugging is useless for
  us. So, we'll just settle with this single patch to squelch WARN_ONs()
  during driver load for users that have CONFIG_DMA_API_DEBUG_SG turned
  on for some reason.
* Move dma_set_max_seg_size() call into i915_driver_hw_probe() - Chris
  Wilson

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: <stable@vger.kernel.org> # v4.18+
Link: https://patchwork.freedesktop.org/patch/msgid/20190823205251.14298-1-lyude@redhat.com
(cherry picked from commit acd674af95d3f627062007429b9c195c6b32361d)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/i915_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f8cfd16be534c..a4b4ab7b9f8ef 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1120,6 +1120,12 @@ static int i915_driver_init_hw(struct drm_i915_private *dev_priv)
 
 	pci_set_master(pdev);
 
+	/*
+	 * We don't have a max segment size, so set it to the max so sg's
+	 * debugging layer doesn't complain
+	 */
+	dma_set_max_seg_size(&pdev->dev, UINT_MAX);
+
 	/* overlay on gen2 is broken and can't address above 1G */
 	if (IS_GEN2(dev_priv)) {
 		ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(30));
-- 
GitLab


From 649532efef4605574defafadb84b4b45c3cdb14f Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Tue, 30 Jul 2019 21:29:55 +0800
Subject: [PATCH 1805/1835] bus: hisi_lpc: Unregister logical PIO range to
 avoid potential use-after-free

commit 1b15a5632a809ab57d403fd972ca68785363b654 upstream.

If, after registering a logical PIO range, the driver probe later fails,
the logical PIO range memory will be released automatically.

This causes an issue, in that the logical PIO range is not unregistered
and the released range memory may be later referenced.

Fix by unregistering the logical PIO range.

And since we now unregister the logical PIO range for probe failure, avoid
the special ordering of setting logical PIO range ops, which was the
previous (poor) attempt at a safeguard against this.

Cc: stable@vger.kernel.org
Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings")
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bus/hisi_lpc.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c
index d5f85455fa621..6fb7111c20097 100644
--- a/drivers/bus/hisi_lpc.c
+++ b/drivers/bus/hisi_lpc.c
@@ -607,24 +607,25 @@ static int hisi_lpc_probe(struct platform_device *pdev)
 	range->fwnode = dev->fwnode;
 	range->flags = LOGIC_PIO_INDIRECT;
 	range->size = PIO_INDIRECT_SIZE;
+	range->hostdata = lpcdev;
+	range->ops = &hisi_lpc_ops;
+	lpcdev->io_host = range;
 
 	ret = logic_pio_register_range(range);
 	if (ret) {
 		dev_err(dev, "register IO range failed (%d)!\n", ret);
 		return ret;
 	}
-	lpcdev->io_host = range;
 
 	/* register the LPC host PIO resources */
 	if (acpi_device)
 		ret = hisi_lpc_acpi_probe(dev);
 	else
 		ret = of_platform_populate(dev->of_node, NULL, NULL, dev);
-	if (ret)
+	if (ret) {
+		logic_pio_unregister_range(range);
 		return ret;
-
-	lpcdev->io_host->hostdata = lpcdev;
-	lpcdev->io_host->ops = &hisi_lpc_ops;
+	}
 
 	io_end = lpcdev->io_host->io_start + lpcdev->io_host->size;
 	dev_info(dev, "registered range [%pa - %pa]\n",
-- 
GitLab


From 2a964875def7d72a150f52c1e84f8041ad1072d5 Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Tue, 30 Jul 2019 21:29:56 +0800
Subject: [PATCH 1806/1835] bus: hisi_lpc: Add .remove method to avoid driver
 unbind crash

commit 10e62b47973b0b0ceda076255bcb147b83e20517 upstream.

The original driver author seemed to be under the impression that a driver
cannot be removed if it does not have a .remove method. Or maybe if it is
a built-in platform driver.

This is not true. This crash can be created:

root@ubuntu:/sys/bus/platform/drivers/hisi-lpc# echo HISI0191\:00 > unbind
root@ubuntu:/sys/bus/platform/drivers/hisi-lpc# ipmitool raw 6 1
 Unable to handle kernel paging request at virtual address ffff000010035010
 Mem abort info:
   ESR = 0x96000047
   Exception class = DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
 Data abort info:
   ISV = 0, ISS = 0x00000047
   CM = 0, WnR = 1
 swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000118b000
 [ffff000010035010] pgd=0000041ffbfff003, pud=0000041ffbffe003, pmd=0000041ffbffd003, pte=0000000000000000
 Internal error: Oops: 96000047 [#1] PREEMPT SMP
 Modules linked in:
 CPU: 17 PID: 1473 Comm: ipmitool Not tainted 5.2.0-rc5-00003-gf68c53b414a3-dirty #198
 Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
 pstate: 20000085 (nzCv daIf -PAN -UAO)
 pc : hisi_lpc_target_in+0x7c/0x120
 lr : hisi_lpc_target_in+0x70/0x120
 sp : ffff00001efe3930
 x29: ffff00001efe3930 x28: ffff841f9f599200
 x27: 0000000000000002 x26: 0000000000000000
 x25: 0000000000000080 x24: 00000000000000e4
 x23: 0000000000000000 x22: 0000000000000064
 x21: ffff801fb667d280 x20: 0000000000000001
 x19: ffff00001efe39ac x18: 0000000000000000
 x17: 0000000000000000 x16: 0000000000000000
 x15: 0000000000000000 x14: 0000000000000000
 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: 0000000000000000
 x9 : 0000000000000000 x8 : ffff841febe60340
 x7 : ffff801fb55c52e8 x6 : 0000000000000000
 x5 : 0000000000ffc0e3 x4 : 0000000000000001
 x3 : ffff801fb667d280 x2 : 0000000000000001
 x1 : ffff000010035010 x0 : ffff000010035000
 Call trace:
  hisi_lpc_target_in+0x7c/0x120
  hisi_lpc_comm_in+0x88/0x98
  logic_inb+0x5c/0xb8
  port_inb+0x18/0x20
  bt_event+0x38/0x808
  smi_event_handler+0x4c/0x5a0
  check_start_timer_thread.part.4+0x40/0x58
  sender+0x78/0x88
  smi_send.isra.6+0x94/0x108
  i_ipmi_request+0x2c4/0x8f8
  ipmi_request_settime+0x124/0x160
  handle_send_req+0x19c/0x208
  ipmi_ioctl+0x2c0/0x990
  do_vfs_ioctl+0xb8/0x8f8
  ksys_ioctl+0x80/0xb8
  __arm64_sys_ioctl+0x1c/0x28
  el0_svc_common.constprop.0+0x64/0x160
  el0_svc_handler+0x28/0x78
  el0_svc+0x8/0xc
 Code: 941d1511 aa0003f9 f94006a0 91004001 (b9000034)
 ---[ end trace aa842b86af7069e4 ]---

The problem here is that the host goes away but the associated logical PIO
region remains registered, as do the children devices.

Fix by adding a .remove method to tidy-up by removing the child devices
and unregistering the logical PIO region.

Cc: stable@vger.kernel.org
Fixes: adf38bb0b595 ("HISI LPC: Support the LPC host on Hip06/Hip07 with DT bindings")
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bus/hisi_lpc.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c
index 6fb7111c20097..e31c02dc77709 100644
--- a/drivers/bus/hisi_lpc.c
+++ b/drivers/bus/hisi_lpc.c
@@ -456,6 +456,17 @@ struct hisi_lpc_acpi_cell {
 	size_t pdata_size;
 };
 
+static void hisi_lpc_acpi_remove(struct device *hostdev)
+{
+	struct acpi_device *adev = ACPI_COMPANION(hostdev);
+	struct acpi_device *child;
+
+	device_for_each_child(hostdev, NULL, hisi_lpc_acpi_remove_subdev);
+
+	list_for_each_entry(child, &adev->children, node)
+		acpi_device_clear_enumerated(child);
+}
+
 /*
  * hisi_lpc_acpi_probe - probe children for ACPI FW
  * @hostdev: LPC host device pointer
@@ -556,8 +567,7 @@ static int hisi_lpc_acpi_probe(struct device *hostdev)
 	return 0;
 
 fail:
-	device_for_each_child(hostdev, NULL,
-			      hisi_lpc_acpi_remove_subdev);
+	hisi_lpc_acpi_remove(hostdev);
 	return ret;
 }
 
@@ -570,6 +580,10 @@ static int hisi_lpc_acpi_probe(struct device *dev)
 {
 	return -ENODEV;
 }
+
+static void hisi_lpc_acpi_remove(struct device *hostdev)
+{
+}
 #endif // CONFIG_ACPI
 
 /*
@@ -627,6 +641,8 @@ static int hisi_lpc_probe(struct platform_device *pdev)
 		return ret;
 	}
 
+	dev_set_drvdata(dev, lpcdev);
+
 	io_end = lpcdev->io_host->io_start + lpcdev->io_host->size;
 	dev_info(dev, "registered range [%pa - %pa]\n",
 		 &lpcdev->io_host->io_start, &io_end);
@@ -634,6 +650,23 @@ static int hisi_lpc_probe(struct platform_device *pdev)
 	return ret;
 }
 
+static int hisi_lpc_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct acpi_device *acpi_device = ACPI_COMPANION(dev);
+	struct hisi_lpc_dev *lpcdev = dev_get_drvdata(dev);
+	struct logic_pio_hwaddr *range = lpcdev->io_host;
+
+	if (acpi_device)
+		hisi_lpc_acpi_remove(dev);
+	else
+		of_platform_depopulate(dev);
+
+	logic_pio_unregister_range(range);
+
+	return 0;
+}
+
 static const struct of_device_id hisi_lpc_of_match[] = {
 	{ .compatible = "hisilicon,hip06-lpc", },
 	{ .compatible = "hisilicon,hip07-lpc", },
@@ -647,5 +680,6 @@ static struct platform_driver hisi_lpc_driver = {
 		.acpi_match_table = ACPI_PTR(hisi_lpc_acpi_match),
 	},
 	.probe = hisi_lpc_probe,
+	.remove = hisi_lpc_remove,
 };
 builtin_platform_driver(hisi_lpc_driver);
-- 
GitLab


From 4e77b2ea941b3a3d5aea682528f56e94c9b2da4e Mon Sep 17 00:00:00 2001
From: Nadav Amit <namit@vmware.com>
Date: Tue, 20 Aug 2019 13:26:38 -0700
Subject: [PATCH 1807/1835] VMCI: Release resource if the work is already
 queued

commit ba03a9bbd17b149c373c0ea44017f35fc2cd0f28 upstream.

Francois reported that VMware balloon gets stuck after a balloon reset,
when the VMCI doorbell is removed. A similar error can occur when the
balloon driver is removed with the following splat:

[ 1088.622000] INFO: task modprobe:3565 blocked for more than 120 seconds.
[ 1088.622035]       Tainted: G        W         5.2.0 #4
[ 1088.622087] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1088.622205] modprobe        D    0  3565   1450 0x00000000
[ 1088.622210] Call Trace:
[ 1088.622246]  __schedule+0x2a8/0x690
[ 1088.622248]  schedule+0x2d/0x90
[ 1088.622250]  schedule_timeout+0x1d3/0x2f0
[ 1088.622252]  wait_for_completion+0xba/0x140
[ 1088.622320]  ? wake_up_q+0x80/0x80
[ 1088.622370]  vmci_resource_remove+0xb9/0xc0 [vmw_vmci]
[ 1088.622373]  vmci_doorbell_destroy+0x9e/0xd0 [vmw_vmci]
[ 1088.622379]  vmballoon_vmci_cleanup+0x6e/0xf0 [vmw_balloon]
[ 1088.622381]  vmballoon_exit+0x18/0xcc8 [vmw_balloon]
[ 1088.622394]  __x64_sys_delete_module+0x146/0x280
[ 1088.622408]  do_syscall_64+0x5a/0x130
[ 1088.622410]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1088.622415] RIP: 0033:0x7f54f62791b7
[ 1088.622421] Code: Bad RIP value.
[ 1088.622421] RSP: 002b:00007fff2a949008 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 1088.622426] RAX: ffffffffffffffda RBX: 000055dff8b55d00 RCX: 00007f54f62791b7
[ 1088.622426] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055dff8b55d68
[ 1088.622427] RBP: 000055dff8b55d00 R08: 00007fff2a947fb1 R09: 0000000000000000
[ 1088.622427] R10: 00007f54f62f5cc0 R11: 0000000000000206 R12: 000055dff8b55d68
[ 1088.622428] R13: 0000000000000001 R14: 000055dff8b55d68 R15: 00007fff2a94a3f0

The cause for the bug is that when the "delayed" doorbell is invoked, it
takes a reference on the doorbell entry and schedules work that is
supposed to run the appropriate code and drop the doorbell entry
reference. The code ignores the fact that if the work is already queued,
it will not be scheduled to run one more time. As a result one of the
references would not be dropped. When the code waits for the reference
to get to zero, during balloon reset or module removal, it gets stuck.

Fix it. Drop the reference if schedule_work() indicates that the work is
already queued.

Note that this bug got more apparent (or apparent at all) due to
commit ce664331b248 ("vmw_balloon: VMCI_DOORBELL_SET does not check status").

Fixes: 83e2ec765be03 ("VMCI: doorbell implementation.")
Reported-by: Francois Rigault <rigault.francois@gmail.com>
Cc: Jorgen Hansen <jhansen@vmware.com>
Cc: Adit Ranadive <aditr@vmware.com>
Cc: Alexios Zavras <alexios.zavras@intel.com>
Cc: Vishnu DASA <vdasa@vmware.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nadav Amit <namit@vmware.com>
Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
Link: https://lore.kernel.org/r/20190820202638.49003-1-namit@vmware.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_doorbell.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
index b3fa738ae0050..f005206d9033b 100644
--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -318,7 +318,8 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle)
 
 	entry = container_of(resource, struct dbell_entry, resource);
 	if (entry->run_delayed) {
-		schedule_work(&entry->work);
+		if (!schedule_work(&entry->work))
+			vmci_resource_put(resource);
 	} else {
 		entry->notify_cb(entry->client_data);
 		vmci_resource_put(resource);
@@ -366,7 +367,8 @@ static void dbell_fire_entries(u32 notify_idx)
 		    atomic_read(&dbell->active) == 1) {
 			if (dbell->run_delayed) {
 				vmci_resource_get(&dbell->resource);
-				schedule_work(&dbell->work);
+				if (!schedule_work(&dbell->work))
+					vmci_resource_put(&dbell->resource);
 			} else {
 				dbell->notify_cb(dbell->client_data);
 			}
-- 
GitLab


From 690a424838ca3b5a8fc884fb0055a93aab781e7d Mon Sep 17 00:00:00 2001
From: Gary R Hook <gary.hook@amd.com>
Date: Mon, 19 Aug 2019 22:23:27 +0000
Subject: [PATCH 1808/1835] crypto: ccp - Ignore unconfigured CCP device on
 suspend/resume

commit 5871cd93692c8071fb9358daccb715b5081316ac upstream.

If a CCP is unconfigured (e.g. there are no available queues) then
there will be no data structures allocated for the device. Thus, we
must check for validity of a pointer before trying to access structure
members.

Fixes: 720419f01832f ("crypto: ccp - Introduce the AMD Secure Processor device")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-dev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
index 9b6d8972a5650..b8c94a01cfc94 100644
--- a/drivers/crypto/ccp/ccp-dev.c
+++ b/drivers/crypto/ccp/ccp-dev.c
@@ -543,6 +543,10 @@ int ccp_dev_suspend(struct sp_device *sp, pm_message_t state)
 	unsigned long flags;
 	unsigned int i;
 
+	/* If there's no device there's nothing to do */
+	if (!ccp)
+		return 0;
+
 	spin_lock_irqsave(&ccp->cmd_lock, flags);
 
 	ccp->suspending = 1;
@@ -567,6 +571,10 @@ int ccp_dev_resume(struct sp_device *sp)
 	unsigned long flags;
 	unsigned int i;
 
+	/* If there's no device there's nothing to do */
+	if (!ccp)
+		return 0;
+
 	spin_lock_irqsave(&ccp->cmd_lock, flags);
 
 	ccp->suspending = 0;
-- 
GitLab


From 945b35972803a1da244b46b32668af30d64279bb Mon Sep 17 00:00:00 2001
From: "Hodaszi, Robert" <Robert.Hodaszi@digi.com>
Date: Fri, 14 Jun 2019 13:16:01 +0000
Subject: [PATCH 1809/1835] Revert "cfg80211: fix processing world regdomain
 when non modular"

commit 0d31d4dbf38412f5b8b11b4511d07b840eebe8cb upstream.

This reverts commit 96cce12ff6e0 ("cfg80211: fix processing world
regdomain when non modular").

Re-triggering a reg_process_hint with the last request on all events,
can make the regulatory domain fail in case of multiple WiFi modules. On
slower boards (espacially with mdev), enumeration of the WiFi modules
can end up in an intersected regulatory domain, and user cannot set it
with 'iw reg set' anymore.

This is happening, because:
- 1st module enumerates, queues up a regulatory request
- request gets processed by __reg_process_hint_driver():
  - checks if previous was set by CORE -> yes
    - checks if regulator domain changed -> yes, from '00' to e.g. 'US'
      -> sends request to the 'crda'
- 2nd module enumerates, queues up a regulator request (which triggers
  the reg_todo() work)
- reg_todo() -> reg_process_pending_hints() sees, that the last request
  is not processed yet, so it tries to process it again.
  __reg_process_hint driver() will run again, and:
  - checks if the last request's initiator was the core -> no, it was
    the driver (1st WiFi module)
  - checks, if the previous initiator was the driver -> yes
    - checks if the regulator domain changed -> yes, it was '00' (set by
      core, and crda call did not return yet), and should be changed to 'US'

------> __reg_process_hint_driver calls an intersect

Besides, the reg_process_hint call with the last request is meaningless
since the crda call has a timeout work. If that timeout expires, the
first module's request will lost.

Cc: stable@vger.kernel.org
Fixes: 96cce12ff6e0 ("cfg80211: fix processing world regdomain when non modular")
Signed-off-by: Robert Hodaszi <robert.hodaszi@digi.com>
Link: https://lore.kernel.org/r/20190614131600.GA13897@a1-hr
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/reg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 8a47297ff206d..d8ebf4f0ef6e2 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2777,7 +2777,7 @@ static void reg_process_pending_hints(void)
 
 	/* When last_request->processed becomes true this will be rescheduled */
 	if (lr && !lr->processed) {
-		reg_process_hint(lr);
+		pr_debug("Pending regulatory request, waiting for it to be processed...\n");
 		return;
 	}
 
-- 
GitLab


From 58f91aac4dfe184b07584533f83b51e0a9a39cf8 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 1 Aug 2019 09:30:33 +0200
Subject: [PATCH 1810/1835] mac80211: fix possible sta leak

commit 5fd2f91ad483baffdbe798f8a08f1b41442d1e24 upstream.

If TDLS station addition is rejected, the sta memory is leaked.
Avoid this by moving the check before the allocation.

Cc: stable@vger.kernel.org
Fixes: 7ed5285396c2 ("mac80211: don't initiate TDLS connection if station is not associated to AP")
Link: https://lore.kernel.org/r/20190801073033.7892-1-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/cfg.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 40c5102234679..a48e83b19cfa7 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1471,6 +1471,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 	if (is_multicast_ether_addr(mac))
 		return -EINVAL;
 
+	if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
+	    sdata->vif.type == NL80211_IFTYPE_STATION &&
+	    !sdata->u.mgd.associated)
+		return -EINVAL;
+
 	sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
 	if (!sta)
 		return -ENOMEM;
@@ -1478,10 +1483,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 	if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
 		sta->sta.tdls = true;
 
-	if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
-	    !sdata->u.mgd.associated)
-		return -EINVAL;
-
 	err = sta_apply_parameters(local, sta, params);
 	if (err) {
 		sta_info_free(local, sta);
-- 
GitLab


From 4f139c0376fb028d64d7a6ca5ad0a3c8dc78941f Mon Sep 17 00:00:00 2001
From: Denis Kenzior <denkenz@gmail.com>
Date: Tue, 27 Aug 2019 17:41:19 -0500
Subject: [PATCH 1811/1835] mac80211: Don't memset RXCB prior to PAE intercept

commit c8a41c6afa27b8c3f61622dfd882b912da9d6721 upstream.

In ieee80211_deliver_skb_to_local_stack intercepts EAPoL frames if
mac80211 is configured to do so and forwards the contents over nl80211.
During this process some additional data is also forwarded, including
whether the frame was received encrypted or not.  Unfortunately just
prior to the call to ieee80211_deliver_skb_to_local_stack, skb->cb is
cleared, resulting in incorrect data being exposed over nl80211.

Fixes: 018f6fbf540d ("mac80211: Send control port frames over nl80211")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Kenzior <denkenz@gmail.com>
Link: https://lore.kernel.org/r/20190827224120.14545-2-denkenz@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7523d995ea8ab..348e9ddaf3126 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2377,6 +2377,8 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
 		cfg80211_rx_control_port(dev, skb, noencrypt);
 		dev_kfree_skb(skb);
 	} else {
+		memset(skb->cb, 0, sizeof(skb->cb));
+
 		/* deliver to local stack */
 		if (rx->napi)
 			napi_gro_receive(rx->napi, skb);
@@ -2470,8 +2472,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 
 	if (skb) {
 		skb->protocol = eth_type_trans(skb, dev);
-		memset(skb->cb, 0, sizeof(skb->cb));
-
 		ieee80211_deliver_skb_to_local_stack(skb, rx);
 	}
 
-- 
GitLab


From 938e383738d9752faf6447a9c290739f33683a50 Mon Sep 17 00:00:00 2001
From: Denis Kenzior <denkenz@gmail.com>
Date: Tue, 27 Aug 2019 17:41:20 -0500
Subject: [PATCH 1812/1835] mac80211: Correctly set noencrypt for PAE frames

commit f8b43c5cf4b62a19f2210a0f5367b84e1eff1ab9 upstream.

The noencrypt flag was intended to be set if the "frame was received
unencrypted" according to include/uapi/linux/nl80211.h.  However, the
current behavior is opposite of this.

Cc: stable@vger.kernel.org
Fixes: 018f6fbf540d ("mac80211: Send control port frames over nl80211")
Signed-off-by: Denis Kenzior <denkenz@gmail.com>
Link: https://lore.kernel.org/r/20190827224120.14545-3-denkenz@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 348e9ddaf3126..b12f23c996f4e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2372,7 +2372,7 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
 		      skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) &&
 		     sdata->control_port_over_nl80211)) {
 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-		bool noencrypt = status->flag & RX_FLAG_DECRYPTED;
+		bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
 
 		cfg80211_rx_control_port(dev, skb, noencrypt);
 		dev_kfree_skb(skb);
-- 
GitLab


From db1841a2dd4c84f390c3e0ed15d6a4ea601433e9 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Tue, 3 Sep 2019 16:16:27 -0400
Subject: [PATCH 1813/1835] KVM: PPC: Book3S: Fix incorrect
 guest-to-user-translation error handling

[ Upstream commit ddfd151f3def9258397fcde7a372205a2d661903 ]

H_PUT_TCE_INDIRECT handlers receive a page with up to 512 TCEs from
a guest. Although we verify correctness of TCEs before we do anything
with the existing tables, there is a small window when a check in
kvmppc_tce_validate might pass and right after that the guest alters
the page of TCEs, causing an early exit from the handler and leaving
srcu_read_lock(&vcpu->kvm->srcu) (virtual mode) or lock_rmap(rmap)
(real mode) locked.

This fixes the bug by jumping to the common exit code with an appropriate
unlock.

Cc: stable@vger.kernel.org # v4.11+
Fixes: 121f80ba68f1 ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/book3s_64_vio.c    | 6 ++++--
 arch/powerpc/kvm/book3s_64_vio_hv.c | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index 9a3f2646ecc7e..07a8004c3c237 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -602,8 +602,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
 
 		if (kvmppc_gpa_to_ua(vcpu->kvm,
 				tce & ~(TCE_PCI_READ | TCE_PCI_WRITE),
-				&ua, NULL))
-			return H_PARAMETER;
+				&ua, NULL)) {
+			ret = H_PARAMETER;
+			goto unlock_exit;
+		}
 
 		list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
 			ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index 6821ead4b4ebc..eb8b11515a7ff 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -528,8 +528,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
 		ua = 0;
 		if (kvmppc_gpa_to_ua(vcpu->kvm,
 				tce & ~(TCE_PCI_READ | TCE_PCI_WRITE),
-				&ua, NULL))
-			return H_PARAMETER;
+				&ua, NULL)) {
+			ret = H_PARAMETER;
+			goto unlock_exit;
+		}
 
 		list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
 			ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
-- 
GitLab


From ab8ecc278dc8f6a63bd7a34387c65c600b2ab77a Mon Sep 17 00:00:00 2001
From: Heyi Guo <guoheyi@huawei.com>
Date: Tue, 27 Aug 2019 12:26:50 +0100
Subject: [PATCH 1814/1835] KVM: arm/arm64: vgic: Fix potential deadlock when
 ap_list is long

[ Upstream commit d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 ]

If the ap_list is longer than 256 entries, merge_final() in list_sort()
will call the comparison callback with the same element twice, causing
a deadlock in vgic_irq_cmp().

Fix it by returning early when irqa == irqb.

Cc: stable@vger.kernel.org # 4.7+
Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting")
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Heyi Guo <guoheyi@huawei.com>
[maz: massaged commit log and patch, added Fixes and Cc-stable]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 virt/kvm/arm/vgic/vgic.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 250cd72c95a52..4040a33cdc902 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -244,6 +244,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
 	bool penda, pendb;
 	int ret;
 
+	/*
+	 * list_sort may call this function with the same element when
+	 * the list is fairly long.
+	 */
+	if (unlikely(irqa == irqb))
+		return 0;
+
 	spin_lock(&irqa->irq_lock);
 	spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
 
-- 
GitLab


From 79f1b33c53a0f54c6f624792d5cb51826d8f5cff Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Wed, 28 Aug 2019 11:10:16 +0100
Subject: [PATCH 1815/1835] KVM: arm/arm64: vgic-v2: Handle SGI bits in
 GICD_I{S,C}PENDR0 as WI

[ Upstream commit 82e40f558de566fdee214bec68096bbd5e64a6a4 ]

A guest is not allowed to inject a SGI (or clear its pending state)
by writing to GICD_ISPENDR0 (resp. GICD_ICPENDR0), as these bits are
defined as WI (as per ARM IHI 0048B 4.3.7 and 4.3.8).

Make sure we correctly emulate the architecture.

Fixes: 96b298000db4 ("KVM: arm/arm64: vgic-new: Add PENDING registers handlers")
Cc: stable@vger.kernel.org # 4.7+
Reported-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 virt/kvm/arm/vgic/vgic-mmio.c | 18 ++++++++++++++++++
 virt/kvm/arm/vgic/vgic-v2.c   |  5 ++++-
 virt/kvm/arm/vgic/vgic-v3.c   |  5 ++++-
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index ceeda7e04a4d9..762f81900529e 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -203,6 +203,12 @@ static void vgic_hw_irq_spending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
 	vgic_irq_set_phys_active(irq, true);
 }
 
+static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
+{
+	return (vgic_irq_is_sgi(irq->intid) &&
+		vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2);
+}
+
 void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
 			      gpa_t addr, unsigned int len,
 			      unsigned long val)
@@ -215,6 +221,12 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
 	for_each_set_bit(i, &val, len * 8) {
 		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
+		/* GICD_ISPENDR0 SGI bits are WI */
+		if (is_vgic_v2_sgi(vcpu, irq)) {
+			vgic_put_irq(vcpu->kvm, irq);
+			continue;
+		}
+
 		spin_lock_irqsave(&irq->irq_lock, flags);
 		if (irq->hw)
 			vgic_hw_irq_spending(vcpu, irq, is_uaccess);
@@ -262,6 +274,12 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
 	for_each_set_bit(i, &val, len * 8) {
 		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
+		/* GICD_ICPENDR0 SGI bits are WI */
+		if (is_vgic_v2_sgi(vcpu, irq)) {
+			vgic_put_irq(vcpu->kvm, irq);
+			continue;
+		}
+
 		spin_lock_irqsave(&irq->irq_lock, flags);
 
 		if (irq->hw)
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 57281c1594d0f..91b14dfacd1dd 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -195,7 +195,10 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
 		if (vgic_irq_is_sgi(irq->intid)) {
 			u32 src = ffs(irq->source);
 
-			BUG_ON(!src);
+			if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
+					   irq->intid))
+				return;
+
 			val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
 			irq->source &= ~(1 << (src - 1));
 			if (irq->source) {
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 5c55995a1a164..8b958ed05306e 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -179,7 +179,10 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
 		    model == KVM_DEV_TYPE_ARM_VGIC_V2) {
 			u32 src = ffs(irq->source);
 
-			BUG_ON(!src);
+			if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
+					   irq->intid))
+				return;
+
 			val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
 			irq->source &= ~(1 << (src - 1));
 			if (irq->source) {
-- 
GitLab


From 57c491fd844d71a1d1e472204153aa86e2a3dd6e Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 18 Feb 2019 11:35:54 -0500
Subject: [PATCH 1816/1835] NFS: Clean up list moves of struct nfs_page

[ Upstream commit 078b5fd92c4913dd367361db6c28568386077c89 ]

In several places we're just moving the struct nfs_page from one list to
another by first removing from the existing list, then adding to the new
one.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/direct.c          |  3 +--
 fs/nfs/pagelist.c        | 12 ++++--------
 include/linux/nfs_page.h | 10 ++++++++++
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 33824a0a57bfe..1377ee20ecf91 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -664,8 +664,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
 
 	list_for_each_entry_safe(req, tmp, &reqs, wb_list) {
 		if (!nfs_pageio_add_request(&desc, req)) {
-			nfs_list_remove_request(req);
-			nfs_list_add_request(req, &failed);
+			nfs_list_move_request(req, &failed);
 			spin_lock(&cinfo.inode->i_lock);
 			dreq->flags = 0;
 			if (desc.pg_error < 0)
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 0ec6bce3dd692..d40bf560f3ca7 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -769,8 +769,7 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc,
 	pageused = 0;
 	while (!list_empty(head)) {
 		req = nfs_list_entry(head->next);
-		nfs_list_remove_request(req);
-		nfs_list_add_request(req, &hdr->pages);
+		nfs_list_move_request(req, &hdr->pages);
 
 		if (!last_page || last_page != req->wb_page) {
 			pageused++;
@@ -962,8 +961,7 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc,
 	}
 	if (!nfs_can_coalesce_requests(prev, req, desc))
 		return 0;
-	nfs_list_remove_request(req);
-	nfs_list_add_request(req, &mirror->pg_list);
+	nfs_list_move_request(req, &mirror->pg_list);
 	mirror->pg_count += req->wb_bytes;
 	return 1;
 }
@@ -995,8 +993,7 @@ nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc,
 {
 	LIST_HEAD(head);
 
-	nfs_list_remove_request(req);
-	nfs_list_add_request(req, &head);
+	nfs_list_move_request(req, &head);
 	desc->pg_completion_ops->error_cleanup(&head);
 }
 
@@ -1242,9 +1239,8 @@ int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
 	while (!list_empty(&hdr->pages)) {
 		struct nfs_page *req = nfs_list_entry(hdr->pages.next);
 
-		nfs_list_remove_request(req);
 		if (!nfs_pageio_add_request(desc, req))
-			nfs_list_add_request(req, &failed);
+			nfs_list_move_request(req, &failed);
 	}
 	nfs_pageio_complete(desc);
 	if (!list_empty(&failed)) {
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index e27572d30d977..ad69430fd0eb5 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -164,6 +164,16 @@ nfs_list_add_request(struct nfs_page *req, struct list_head *head)
 	list_add_tail(&req->wb_list, head);
 }
 
+/**
+ * nfs_list_move_request - Move a request to a new list
+ * @req: request
+ * @head: head of list into which to insert the request.
+ */
+static inline void
+nfs_list_move_request(struct nfs_page *req, struct list_head *head)
+{
+	list_move_tail(&req->wb_list, head);
+}
 
 /**
  * nfs_list_remove_request - Remove a request from its wb_list
-- 
GitLab


From 812de6dee596e10d46ce3d7dc4736fa288218117 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 12 Aug 2019 15:19:54 -0400
Subject: [PATCH 1817/1835] NFSv4/pnfs: Fix a page lock leak in
 nfs_pageio_resend()

[ Upstream commit f4340e9314dbfadc48758945f85fc3b16612d06f ]

If the attempt to resend the pages fails, we need to ensure that we
clean up those pages that were not transmitted.

Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: stable@vger.kernel.org # v4.5+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pagelist.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index d40bf560f3ca7..9cbd829b4ed5f 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1232,20 +1232,22 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
 int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
 		      struct nfs_pgio_header *hdr)
 {
-	LIST_HEAD(failed);
+	LIST_HEAD(pages);
 
 	desc->pg_io_completion = hdr->io_completion;
 	desc->pg_dreq = hdr->dreq;
-	while (!list_empty(&hdr->pages)) {
-		struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+	list_splice_init(&hdr->pages, &pages);
+	while (!list_empty(&pages)) {
+		struct nfs_page *req = nfs_list_entry(pages.next);
 
 		if (!nfs_pageio_add_request(desc, req))
-			nfs_list_move_request(req, &failed);
+			break;
 	}
 	nfs_pageio_complete(desc);
-	if (!list_empty(&failed)) {
-		list_move(&failed, &hdr->pages);
-		return desc->pg_error < 0 ? desc->pg_error : -EIO;
+	if (!list_empty(&pages)) {
+		int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
+		hdr->completion_ops->error_cleanup(&pages, err);
+		return err;
 	}
 	return 0;
 }
-- 
GitLab


From b5891b624b9a5d3dd65b6c5a6601480bcb1a3dc3 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Wed, 13 Feb 2019 10:39:39 -0500
Subject: [PATCH 1818/1835] NFS: Pass error information to the pgio error
 cleanup routine

[ Upstream commit df3accb849607a86278a37c35e6b313635ccc48b ]

Allow the caller to pass error information when cleaning up a failed
I/O request so that we can conditionally take action to cancel the
request altogether if the error turned out to be fatal.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/direct.c         |  4 ++--
 fs/nfs/pagelist.c       |  5 +++--
 fs/nfs/read.c           |  2 +-
 fs/nfs/write.c          | 11 +++++++++--
 include/linux/nfs_xdr.h |  2 +-
 5 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 1377ee20ecf91..0fd811ac08b52 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -428,7 +428,7 @@ out_put:
 	hdr->release(hdr);
 }
 
-static void nfs_read_sync_pgio_error(struct list_head *head)
+static void nfs_read_sync_pgio_error(struct list_head *head, int error)
 {
 	struct nfs_page *req;
 
@@ -820,7 +820,7 @@ out_put:
 	hdr->release(hdr);
 }
 
-static void nfs_write_sync_pgio_error(struct list_head *head)
+static void nfs_write_sync_pgio_error(struct list_head *head, int error)
 {
 	struct nfs_page *req;
 
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 9cbd829b4ed5f..7f0b9409202cc 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -994,7 +994,7 @@ nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc,
 	LIST_HEAD(head);
 
 	nfs_list_move_request(req, &head);
-	desc->pg_completion_ops->error_cleanup(&head);
+	desc->pg_completion_ops->error_cleanup(&head, desc->pg_error);
 }
 
 /**
@@ -1130,7 +1130,8 @@ static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
 
 	for (midx = 0; midx < desc->pg_mirror_count; midx++) {
 		mirror = &desc->pg_mirrors[midx];
-		desc->pg_completion_ops->error_cleanup(&mirror->pg_list);
+		desc->pg_completion_ops->error_cleanup(&mirror->pg_list,
+				desc->pg_error);
 	}
 }
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 48d7277c60a97..09d5c282f50e9 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -205,7 +205,7 @@ static void nfs_initiate_read(struct nfs_pgio_header *hdr,
 }
 
 static void
-nfs_async_read_error(struct list_head *head)
+nfs_async_read_error(struct list_head *head, int error)
 {
 	struct nfs_page	*req;
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 51d0b7913c04c..5ab997912d8d5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1394,20 +1394,27 @@ static void nfs_redirty_request(struct nfs_page *req)
 	nfs_release_request(req);
 }
 
-static void nfs_async_write_error(struct list_head *head)
+static void nfs_async_write_error(struct list_head *head, int error)
 {
 	struct nfs_page	*req;
 
 	while (!list_empty(head)) {
 		req = nfs_list_entry(head->next);
 		nfs_list_remove_request(req);
+		if (nfs_error_is_fatal(error)) {
+			nfs_context_set_write_error(req->wb_context, error);
+			if (nfs_error_is_fatal_on_server(error)) {
+				nfs_write_error_remove_page(req);
+				continue;
+			}
+		}
 		nfs_redirty_request(req);
 	}
 }
 
 static void nfs_async_write_reschedule_io(struct nfs_pgio_header *hdr)
 {
-	nfs_async_write_error(&hdr->pages);
+	nfs_async_write_error(&hdr->pages, 0);
 	filemap_fdatawrite_range(hdr->inode->i_mapping, hdr->args.offset,
 			hdr->args.offset + hdr->args.count - 1);
 }
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index bd1c889a9ed95..cab24a127feb3 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1539,7 +1539,7 @@ struct nfs_commit_data {
 };
 
 struct nfs_pgio_completion_ops {
-	void	(*error_cleanup)(struct list_head *head);
+	void	(*error_cleanup)(struct list_head *head, int);
 	void	(*init_hdr)(struct nfs_pgio_header *hdr);
 	void	(*completion)(struct nfs_pgio_header *hdr);
 	void	(*reschedule_io)(struct nfs_pgio_header *hdr);
-- 
GitLab


From 4f4be79c9ee7f36996163c6cf7056dae94e1b17e Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 12 Aug 2019 18:04:36 -0400
Subject: [PATCH 1819/1835] NFS: Ensure O_DIRECT reports an error if the bytes
 read/written is 0

[ Upstream commit eb2c50da9e256dbbb3ff27694440e4c1900cfef8 ]

If the attempt to resend the I/O results in no bytes being read/written,
we must ensure that we report the error.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Fixes: 0a00b77b331a ("nfs: mirroring support for direct io")
Cc: stable@vger.kernel.org # v3.20+
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/direct.c   | 27 ++++++++++++++++++---------
 fs/nfs/pagelist.c |  1 +
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 0fd811ac08b52..f516ace8f45d3 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -400,15 +400,21 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
 	unsigned long bytes = 0;
 	struct nfs_direct_req *dreq = hdr->dreq;
 
-	if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
-		goto out_put;
-
 	spin_lock(&dreq->lock);
-	if (test_bit(NFS_IOHDR_ERROR, &hdr->flags) && (hdr->good_bytes == 0))
+	if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
 		dreq->error = hdr->error;
-	else
+
+	if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+		spin_unlock(&dreq->lock);
+		goto out_put;
+	}
+
+	if (hdr->good_bytes != 0)
 		nfs_direct_good_bytes(dreq, hdr);
 
+	if (test_bit(NFS_IOHDR_EOF, &hdr->flags))
+		dreq->error = 0;
+
 	spin_unlock(&dreq->lock);
 
 	while (!list_empty(&hdr->pages)) {
@@ -774,16 +780,19 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
 	bool request_commit = false;
 	struct nfs_page *req = nfs_list_entry(hdr->pages.next);
 
-	if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
-		goto out_put;
-
 	nfs_init_cinfo_from_dreq(&cinfo, dreq);
 
 	spin_lock(&dreq->lock);
 
 	if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
 		dreq->error = hdr->error;
-	if (dreq->error == 0) {
+
+	if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+		spin_unlock(&dreq->lock);
+		goto out_put;
+	}
+
+	if (hdr->good_bytes != 0) {
 		nfs_direct_good_bytes(dreq, hdr);
 		if (nfs_write_need_commit(hdr)) {
 			if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 7f0b9409202cc..d23ea74b5d203 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1248,6 +1248,7 @@ int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
 	if (!list_empty(&pages)) {
 		int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
 		hdr->completion_ops->error_cleanup(&pages, err);
+		nfs_set_pgio_error(hdr, err, hdr->io_start);
 		return err;
 	}
 	return 0;
-- 
GitLab


From 3b26fa9e3ec3973b5747ce53031414229e1bb8e7 Mon Sep 17 00:00:00 2001
From: Andrew Cooks <andrew.cooks@opengear.com>
Date: Fri, 2 Aug 2019 14:52:46 +0200
Subject: [PATCH 1820/1835] i2c: piix4: Fix port selection for AMD Family 16h
 Model 30h

[ Upstream commit c7c06a1532f3fe106687ac82a13492c6a619ff1c ]

Family 16h Model 30h SMBus controller needs the same port selection fix
as described and fixed in commit 0fe16195f891 ("i2c: piix4: Fix SMBus port
selection for AMD Family 17h chips")

commit 6befa3fde65f ("i2c: piix4: Support alternative port selection
register") also fixed the port selection for Hudson2, but unfortunately
this is not the exact same device and the AMD naming and PCI Device IDs
aren't particularly helpful here.

The SMBus port selection register is common to the following Families
and models, as documented in AMD's publicly available BIOS and Kernel
Developer Guides:

 50742 - Family 15h Model 60h-6Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
 55072 - Family 15h Model 70h-7Fh (PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)
 52740 - Family 16h Model 30h-3Fh (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS)

The Hudson2 PCI Device ID (PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) is shared
between Bolton FCH and Family 16h Model 30h, but the location of the
SmBus0Sel port selection bits are different:

 51192 - Bolton Register Reference Guide

We distinguish between Bolton and Family 16h Model 30h using the PCI
Revision ID:

  Bolton is device 0x780b, revision 0x15
  Family 16h Model 30h is device 0x780b, revision 0x1F
  Family 15h Model 60h and 70h are both device 0x790b, revision 0x4A.

The following additional public AMD BKDG documents were checked and do
not share the same port selection register:

 42301 - Family 15h Model 00h-0Fh doesn't mention any
 42300 - Family 15h Model 10h-1Fh doesn't mention any
 49125 - Family 15h Model 30h-3Fh doesn't mention any

 48751 - Family 16h Model 00h-0Fh uses the previously supported
         index register SB800_PIIX4_PORT_IDX_ALT at 0x2e

Signed-off-by: Andrew Cooks <andrew.cooks@opengear.com>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: stable@vger.kernel.org [v4.6+]
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-piix4.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 90946a8b9a75a..9ff3371ec385d 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -98,7 +98,7 @@
 #define SB800_PIIX4_PORT_IDX_MASK	0x06
 #define SB800_PIIX4_PORT_IDX_SHIFT	1
 
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
 #define SB800_PIIX4_PORT_IDX_KERNCZ		0x02
 #define SB800_PIIX4_PORT_IDX_MASK_KERNCZ	0x18
 #define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ	3
@@ -362,18 +362,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
 
 	/* Find which register is used for port selection */
 	if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD) {
-		switch (PIIX4_dev->device) {
-		case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+		if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
+		    (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+		     PIIX4_dev->revision >= 0x1F)) {
 			piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
 			piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
 			piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
-			break;
-		case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
-		default:
+		} else {
 			piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
 			piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
 			piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
-			break;
 		}
 	} else {
 		if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
-- 
GitLab


From b307f99dca5ab33edc1e04b9b479bcb0852ff85f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 4 Sep 2019 12:27:18 +0200
Subject: [PATCH 1821/1835] x86/ptrace: fix up botched merge of spectrev1 fix

I incorrectly merged commit 31a2fbb390fe ("x86/ptrace: Fix possible
spectre-v1 in ptrace_get_debugreg()") when backporting it, as was
graciously pointed out at
https://grsecurity.net/teardown_of_a_failed_linux_lts_spectre_fix.php

Resolve the upstream difference with the stable kernel merge to properly
protect things.

Reported-by: Brad Spengler <spender@grsecurity.net>
Cc: Dianzhang Chen <dianzhangchen0@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <bp@alien8.de>
Cc: <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index aeba77881d854..516ec7586a5fb 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -652,11 +652,10 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
 {
 	struct thread_struct *thread = &tsk->thread;
 	unsigned long val = 0;
-	int index = n;
 
 	if (n < HBP_NUM) {
+		int index = array_index_nospec(n, HBP_NUM);
 		struct perf_event *bp = thread->ptrace_bps[index];
-		index = array_index_nospec(index, HBP_NUM);
 
 		if (bp)
 			val = bp->hw.info.address;
-- 
GitLab


From e064466cb614cfd6c2eeff503c520ad0417d3954 Mon Sep 17 00:00:00 2001
From: Stanislaw Gruszka <sgruszka@redhat.com>
Date: Wed, 4 Sep 2019 10:07:10 +0200
Subject: [PATCH 1822/1835] mt76: mt76x0u: do not reset radio on resume

commit 8f2d163cb26da87e7d8e1677368b8ba1ba4d30b3 upstream.

On some machines mt76x0u firmware can hung during resume,
what result on messages like below:

[  475.480062] mt76x0 1-8:1.0: Error: MCU response pre-completed!
[  475.990066] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110
[  475.990075] mt76x0 1-8:1.0: Error: MCU response pre-completed!
[  476.500003] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110
[  476.500012] mt76x0 1-8:1.0: Error: MCU response pre-completed!
[  477.010046] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110
[  477.010055] mt76x0 1-8:1.0: Error: MCU response pre-completed!
[  477.529997] mt76x0 1-8:1.0: Error: send MCU cmd failed:-110
[  477.530006] mt76x0 1-8:1.0: Error: MCU response pre-completed!
[  477.824907] mt76x0 1-8:1.0: Error: send MCU cmd failed:-71
[  477.824916] mt76x0 1-8:1.0: Error: MCU response pre-completed!
[  477.825029] usb 1-8: USB disconnect, device number 6

and possible whole system freeze.

This can be avoided, if we do not perform mt76x0_chip_onoff() reset.

Cc: stable@vger.kernel.org
Fixes: 134b2d0d1fcf ("mt76x0: init files")
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x0/init.c   | 4 ++--
 drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h | 2 +-
 drivers/net/wireless/mediatek/mt76/mt76x0/usb.c    | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/init.c b/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
index 0a3e046d78db3..da2ba51dec352 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
@@ -369,7 +369,7 @@ static void mt76x0_stop_hardware(struct mt76x0_dev *dev)
 	mt76x0_chip_onoff(dev, false, false);
 }
 
-int mt76x0_init_hardware(struct mt76x0_dev *dev)
+int mt76x0_init_hardware(struct mt76x0_dev *dev, bool reset)
 {
 	static const u16 beacon_offsets[16] = {
 		/* 512 byte per beacon */
@@ -382,7 +382,7 @@ int mt76x0_init_hardware(struct mt76x0_dev *dev)
 
 	dev->beacon_offsets = beacon_offsets;
 
-	mt76x0_chip_onoff(dev, true, true);
+	mt76x0_chip_onoff(dev, true, reset);
 
 	ret = mt76x0_wait_asic_ready(dev);
 	if (ret)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h b/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h
index fc9857f61771c..f9dfe5097b099 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h
@@ -279,7 +279,7 @@ void mt76x0_addr_wr(struct mt76x0_dev *dev, const u32 offset, const u8 *addr);
 
 /* Init */
 struct mt76x0_dev *mt76x0_alloc_device(struct device *dev);
-int mt76x0_init_hardware(struct mt76x0_dev *dev);
+int mt76x0_init_hardware(struct mt76x0_dev *dev, bool reset);
 int mt76x0_register_device(struct mt76x0_dev *dev);
 void mt76x0_cleanup(struct mt76x0_dev *dev);
 void mt76x0_chip_onoff(struct mt76x0_dev *dev, bool enable, bool reset);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index 54ae1f113be23..5aacb1f6a841d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -300,7 +300,7 @@ static int mt76x0_probe(struct usb_interface *usb_intf,
 	if (!(mt76_rr(dev, MT_EFUSE_CTRL) & MT_EFUSE_CTRL_SEL))
 		dev_warn(dev->mt76.dev, "Warning: eFUSE not present\n");
 
-	ret = mt76x0_init_hardware(dev);
+	ret = mt76x0_init_hardware(dev, true);
 	if (ret)
 		goto err;
 
@@ -354,7 +354,7 @@ static int mt76x0_resume(struct usb_interface *usb_intf)
 	struct mt76x0_dev *dev = usb_get_intfdata(usb_intf);
 	int ret;
 
-	ret = mt76x0_init_hardware(dev);
+	ret = mt76x0_init_hardware(dev, false);
 	if (ret)
 		return ret;
 
-- 
GitLab


From 9854d089f790695bfd5e52904902ff3972b69cc9 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 5 Sep 2019 20:48:46 +0200
Subject: [PATCH 1823/1835] Revert "ASoC: Fail card instantiation if DAI format
 setup fails"

This reverts commit 714a8438fc8ae88aa22c25065e241bce0260db13 which is
commit 40aa5383e393d72f6aa3943a4e7b1aae25a1e43b upstream.

Mark Brown writes:
	I nacked this patch when Sasha posted it - it only improves
	diagnostics and might make systems that worked by accident break
	since it turns things into a hard failure, it won't make
	anything that didn't work previously work.

Reported-by: Mark Brown <broonie@kernel.org>
Cc: Ricard Wanderlof <ricardw@axis.com>
Cc: Sasha Levin <sashal@kernel.org>
Link: https://lore.kernel.org/lkml/20190904181027.GG4348@sirena.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/soc-core.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index dafc3b7f8d723..62aa320c20708 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1513,11 +1513,8 @@ static int soc_probe_link_dais(struct snd_soc_card *card,
 		}
 	}
 
-	if (dai_link->dai_fmt) {
-		ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
-		if (ret)
-			return ret;
-	}
+	if (dai_link->dai_fmt)
+		snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
 
 	ret = soc_post_component_init(rtd, dai_link->name);
 	if (ret)
-- 
GitLab


From 0fed55c248d98e70dd74f0942f64a139ba07f75d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Sep 2019 10:22:24 +0200
Subject: [PATCH 1824/1835] Linux 4.19.70

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 677341239449a..ecf8806cb71f4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 69
+SUBLEVEL = 70
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 72168ae786296b3ec1b447faf96c4ff2ab82c439 Mon Sep 17 00:00:00 2001
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date: Fri, 6 Sep 2019 10:53:45 +0200
Subject: [PATCH 1825/1835] Revert "Input: elantech - enable SMBus on new
 (2018+) systems"

This reverts commit 3d180fe5cd7625b67e0879ffa1f6ae1f09385485 which is
commit 883a2a80f79ca5c0c105605fafabd1f3df99b34c upstream.

This patch depends on an other series:
https://patchwork.kernel.org/project/linux-input/list/?series=122327&state=%2A&archive=both

It was a mistake to backport it in the v5.2 branch, as there
is a high chance we encounter a touchpad that needs the series
above.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=204733
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204771
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/elantech.c | 54 ++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 25 deletions(-)

diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index eb9b9de47fd1c..530142b5a1154 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1810,30 +1810,6 @@ static int elantech_create_smbus(struct psmouse *psmouse,
 				  leave_breadcrumbs);
 }
 
-static bool elantech_use_host_notify(struct psmouse *psmouse,
-				     struct elantech_device_info *info)
-{
-	if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
-		return true;
-
-	switch (info->bus) {
-	case ETP_BUS_PS2_ONLY:
-		/* expected case */
-		break;
-	case ETP_BUS_SMB_HST_NTFY_ONLY:
-	case ETP_BUS_PS2_SMB_HST_NTFY:
-		/* SMbus implementation is stable since 2018 */
-		if (dmi_get_bios_year() >= 2018)
-			return true;
-	default:
-		psmouse_dbg(psmouse,
-			    "Ignoring SMBus bus provider %d\n", info->bus);
-		break;
-	}
-
-	return false;
-}
-
 /**
  * elantech_setup_smbus - called once the PS/2 devices are enumerated
  * and decides to instantiate a SMBus InterTouch device.
@@ -1853,7 +1829,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
 		 * i2c_blacklist_pnp_ids.
 		 * Old ICs are up to the user to decide.
 		 */
-		if (!elantech_use_host_notify(psmouse, info) ||
+		if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
 		    psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
 			return -ENXIO;
 	}
@@ -1873,6 +1849,34 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
 	return 0;
 }
 
+static bool elantech_use_host_notify(struct psmouse *psmouse,
+				     struct elantech_device_info *info)
+{
+	if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+		return true;
+
+	switch (info->bus) {
+	case ETP_BUS_PS2_ONLY:
+		/* expected case */
+		break;
+	case ETP_BUS_SMB_ALERT_ONLY:
+		/* fall-through  */
+	case ETP_BUS_PS2_SMB_ALERT:
+		psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
+		break;
+	case ETP_BUS_SMB_HST_NTFY_ONLY:
+		/* fall-through  */
+	case ETP_BUS_PS2_SMB_HST_NTFY:
+		return true;
+	default:
+		psmouse_dbg(psmouse,
+			    "Ignoring SMBus bus provider %d.\n",
+			    info->bus);
+	}
+
+	return false;
+}
+
 int elantech_init_smbus(struct psmouse *psmouse)
 {
 	struct elantech_device_info info;
-- 
GitLab


From e7d2672c66e4d3675570369bf20856296da312c4 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 6 Sep 2019 12:40:02 +0200
Subject: [PATCH 1826/1835] Linux 4.19.71

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ecf8806cb71f4..f6c9d5757470e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 70
+SUBLEVEL = 71
 EXTRAVERSION =
 NAME = "People's Front"
 
-- 
GitLab


From 1c501f92ccb41b55f55e32dca1aea9ebdb28e991 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 5 Sep 2019 17:36:38 +0100
Subject: [PATCH 1827/1835] overlays: mcp23017: rename the GPIO pins node with
 the device

In order to allow the overlay to be loaded multiple times the
GPIO node for the interrupt line needs to be unique.
Rename it based on the MCP23017 I2C address

https://github.com/raspberrypi/linux/issues/3207

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/mcp23017-overlay.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
index f6421bd476f9c..b5148ba82e470 100644
--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
@@ -16,7 +16,7 @@
 	fragment@1 {
 		target = <&gpio>;
 		__overlay__ {
-			mcp23017_pins: mcp23017_pins {
+			mcp23017_pins: mcp23017_pins@20 {
 				brcm,pins = <4>;
 				brcm,function = <0>;
 			};
@@ -55,7 +55,7 @@
 	__overrides__ {
 		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
 				<&mcp23017>,"interrupts:0";
-		addr = <&mcp23017>,"reg:0";
+		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
 		mcp23008 = <0>,"=3";
 	};
 };
-- 
GitLab


From 3da8071c3b4ef62d5954074af1330fd561eae61c Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Thu, 5 Sep 2019 17:41:46 +0100
Subject: [PATCH 1828/1835] overlays: mcp23017: Add option for not connecting
 the int GPIO

The interrupt GPIO is optional to the driver, therefore add an
option to not configure it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 arch/arm/boot/dts/overlays/README             |  1 +
 .../boot/dts/overlays/mcp23017-overlay.dts    | 21 +++++++++++++------
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 022972b428ba8..915461238b025 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -1427,6 +1427,7 @@ Params: gpiopin                 Gpio pin connected to the INTA output of the
         addr                    I2C address of the MCP23017 (default: 0x20)
 
         mcp23008                Configure an MCP23008 instead.
+        noints                  Disable the interrupt GPIO line.
 
 
 Name:   mcp23s17
diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
index b5148ba82e470..16af971c3bdb7 100644
--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
@@ -34,11 +34,6 @@
 				reg = <0x20>;
 				gpio-controller;
 				#gpio-cells = <2>;
-				#interrupt-cells=<2>;
-				interrupt-parent = <&gpio>;
-				interrupts = <4 2>;
-				interrupt-controller;
-				microchip,irq-mirror;
 
 				status = "okay";
 			};
@@ -52,11 +47,25 @@
 		};
 	};
 
+	fragment@4 {
+		target = <&i2c1>;
+		__overlay__ {
+			mcp23017_irq: mcp@20 {
+				#interrupt-cells=<2>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 2>;
+				interrupt-controller;
+				microchip,irq-mirror;
+			};
+		};
+	};
+
 	__overrides__ {
 		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
-				<&mcp23017>,"interrupts:0";
+				<&mcp23017_irq>,"interrupts:0";
 		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
 		mcp23008 = <0>,"=3";
+		noints = <0>,"!1!4";
 	};
 };
 
-- 
GitLab


From 510ea22f15abacceece4cc98553a14b5c986a1e6 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 6 Sep 2019 15:04:51 +0100
Subject: [PATCH 1829/1835] v4l2: Add a Greyworld AWB mode.

Adds a simple greyworld white balance preset, mainly for use
with cameras without an IR filter (eg Raspberry Pi NoIR)

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/media/v4l2-core/v4l2-ctrls.c | 1 +
 include/uapi/linux/v4l2-controls.h   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 0986572bbe881..c5b2bd7e5973f 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -275,6 +275,7 @@ const char * const *v4l2_ctrl_get_menu(u32 id)
 		"Flash",
 		"Cloudy",
 		"Shade",
+		"Greyworld",
 		NULL,
 	};
 	static const char * const camera_iso_sensitivity_auto[] = {
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index e4ee10ee917de..baa768253fc30 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -815,6 +815,7 @@ enum v4l2_auto_n_preset_white_balance {
 	V4L2_WHITE_BALANCE_FLASH		= 7,
 	V4L2_WHITE_BALANCE_CLOUDY		= 8,
 	V4L2_WHITE_BALANCE_SHADE		= 9,
+	V4L2_WHITE_BALANCE_GREYWORLD		= 10,
 };
 
 #define V4L2_CID_WIDE_DYNAMIC_RANGE		(V4L2_CID_CAMERA_CLASS_BASE+21)
-- 
GitLab


From 93ccb21c1457d5024439c4ec87d475c3e42bc449 Mon Sep 17 00:00:00 2001
From: Dave Stevenson <dave.stevenson@raspberrypi.org>
Date: Fri, 6 Sep 2019 15:13:06 +0100
Subject: [PATCH 1830/1835] staging: bcm2835-camera: Add greyworld AWB mode

This is mainly used for the NoIR camera which has no IR
filter and can completely confuse normal AWB presets.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
---
 drivers/staging/vc04_services/bcm2835-camera/controls.c   | 8 ++++++--
 .../staging/vc04_services/vchiq-mmal/mmal-parameters.h    | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index e49897b958d2c..ae724fa5c69af 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -481,6 +481,10 @@ static int ctrl_set_awb_mode(struct bm2835_mmal_dev *dev,
 	case V4L2_WHITE_BALANCE_SHADE:
 		u32_value = MMAL_PARAM_AWBMODE_SHADE;
 		break;
+
+	case V4L2_WHITE_BALANCE_GREYWORLD:
+		u32_value = MMAL_PARAM_AWBMODE_GREYWORLD;
+		break;
 	}
 
 	return vchiq_mmal_port_parameter_set(dev->instance, control,
@@ -1008,8 +1012,8 @@ static const struct bm2835_mmal_v4l2_ctrl v4l2_ctrls[V4L2_CTRL_COUNT] = {
 	{
 		V4L2_CID_AUTO_N_PRESET_WHITE_BALANCE,
 		MMAL_CONTROL_TYPE_STD_MENU,
-		~0x3ff, V4L2_WHITE_BALANCE_SHADE, V4L2_WHITE_BALANCE_AUTO, 0,
-		NULL,
+		~0x7ff, V4L2_WHITE_BALANCE_GREYWORLD, V4L2_WHITE_BALANCE_AUTO,
+		0, NULL,
 		MMAL_PARAMETER_AWB_MODE,
 		&ctrl_set_awb_mode,
 		false
diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
index 416b4e1f0bb82..38702d3063c19 100644
--- a/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
+++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-parameters.h
@@ -313,6 +313,7 @@ enum mmal_parameter_awbmode {
 	MMAL_PARAM_AWBMODE_INCANDESCENT,
 	MMAL_PARAM_AWBMODE_FLASH,
 	MMAL_PARAM_AWBMODE_HORIZON,
+	MMAL_PARAM_AWBMODE_GREYWORLD,
 };
 
 enum mmal_parameter_imagefx {
-- 
GitLab


From 8a32d41f63c5789d8cbada3e014fac96ae813300 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 6 Sep 2019 17:31:51 +0100
Subject: [PATCH 1831/1835] configs: Add GPIO_PCA953X, LEDS_PCA9532/PCA955X

See: https://github.com/raspberrypi/linux/issues/3182

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm/configs/bcm2709_defconfig   | 3 +++
 arch/arm/configs/bcm2711_defconfig   | 3 +++
 arch/arm/configs/bcmrpi_defconfig    | 3 +++
 arch/arm64/configs/bcm2711_defconfig | 3 +++
 arch/arm64/configs/bcmrpi3_defconfig | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index f4b435948816c..5dc2e1451d7ec 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -686,6 +686,7 @@ CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_PINCTRL_MCP23S08=m
 CONFIG_GPIO_BCM_VIRT=y
 CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCA953X=m
 CONFIG_GPIO_PCF857X=m
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
@@ -1188,7 +1189,9 @@ CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_PCA9532=m
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA955X=m
 CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 944a52f32fb40..29e56df2c1763 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -694,6 +694,7 @@ CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_PINCTRL_MCP23S08=m
 CONFIG_GPIO_BCM_VIRT=y
 CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCA953X=m
 CONFIG_GPIO_PCF857X=m
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
@@ -1220,7 +1221,9 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_IPROC=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_PCA9532=m
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA955X=m
 CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 9de5bd576fdf6..5ef5b73028aa7 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -678,6 +678,7 @@ CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_PINCTRL_MCP23S08=m
 CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCA953X=m
 CONFIG_GPIO_PCF857X=m
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
@@ -1198,7 +1199,9 @@ CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_PCA9532=m
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA955X=m
 CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 74175c727ece0..3fe86b265a990 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -624,6 +624,7 @@ CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_PINCTRL_MCP23S08=m
 CONFIG_GPIO_BCM_VIRT=y
 CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCA953X=m
 CONFIG_GPIO_PCF857X=m
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
@@ -1043,7 +1044,9 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_IPROC=y
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_PCA9532=m
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA955X=m
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
index 44c9f069552bc..3bdf97a2a5332 100644
--- a/arch/arm64/configs/bcmrpi3_defconfig
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -610,6 +610,7 @@ CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PPS_CLIENT_GPIO=m
 CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_PCA953X=m
 CONFIG_GPIO_ARIZONA=m
 CONFIG_GPIO_STMPE=y
 CONFIG_W1=m
@@ -994,7 +995,9 @@ CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_IPROC=m
 CONFIG_MMC_SPI=m
 CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_PCA9532=m
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_PCA955X=m
 CONFIG_LEDS_PCA963X=m
 CONFIG_LEDS_IS31FL32XX=m
 CONFIG_LEDS_TRIGGER_TIMER=y
-- 
GitLab


From 9532eb3c84d8d952ef28da3d135683ac01adc9b8 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Fri, 6 Sep 2019 17:48:25 +0100
Subject: [PATCH 1832/1835] configs: Set VIDEO_V4L2_SUBDEV_API=y on
 arm64/bcm2711

This one got missed.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 arch/arm64/configs/bcm2711_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/configs/bcm2711_defconfig b/arch/arm64/configs/bcm2711_defconfig
index 3fe86b265a990..fccdb4c8e3c21 100644
--- a/arch/arm64/configs/bcm2711_defconfig
+++ b/arch/arm64/configs/bcm2711_defconfig
@@ -680,6 +680,7 @@ CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
 CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
 CONFIG_MEDIA_RADIO_SUPPORT=y
 CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
 CONFIG_USB_VIDEO_CLASS=m
 CONFIG_USB_M5602=m
-- 
GitLab


From 13ce09db830e0c2fe524460b0673afb974359bc2 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.org>
Date: Mon, 9 Sep 2019 10:16:08 +0100
Subject: [PATCH 1833/1835] PCI: brcmstb: Fix compilation warning

Fixes: ea2c11a187c0e248343452846457b94715e04969
Fixes: https://github.com/raspberrypi/linux/issues/3216

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
---
 drivers/pci/controller/pcie-brcmstb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index f279ed67e4e16..b1b53ad41f19a 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -653,7 +653,7 @@ static int brcmstb_platform_notifier(struct notifier_block *nb,
 			ret = of_dma_configure(dev, dev->of_node, true);
 			if (ret) {
 				dev_err(dev, "of_dma_configure() failed: %d\n", ret);
-				return;
+				return ret;
 			}
 		}
 		brcm_set_dma_ops(dev);
-- 
GitLab


From 6de367fd7236049b74a55970186543d37699ab8b Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Wed, 11 Sep 2019 14:57:18 +0100
Subject: [PATCH 1834/1835] drm/vc4: Fix for margins in composite/SDTV mode
 (#3223)

Margins were incorrectly assumed to be setup in SDTV mode, but were
not actually done, so this make the setup non-conditional on mode.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
 drivers/gpu/drm/vc4/vc4_firmware_kms.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
index 89ad71cff2bdf..d75fbd2a48477 100644
--- a/drivers/gpu/drm/vc4/vc4_firmware_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -1588,14 +1588,9 @@ vc4_fkms_connector_init(struct drm_device *dev, struct drm_encoder *encoder,
 		connector->interlace_allowed = 0;
 	}
 
-	/* Create and attach TV margin props to this connector.
-	 * Already done for SDTV outputs.
-	 */
-	if (fkms_connector->display_type != DRM_MODE_ENCODER_TVDAC) {
-		ret = drm_mode_create_tv_margin_properties(dev);
-		if (ret)
-			goto fail;
-	}
+	ret = drm_mode_create_tv_margin_properties(dev);
+	if (ret)
+		goto fail;
 
 	drm_connector_attach_tv_margin_properties(connector);
 
-- 
GitLab


From bd3452c84c206a171fa4cf5f6ddfab5687667228 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Schambacher?=
 <j-schambacher@users.noreply.github.com>
Date: Thu, 12 Sep 2019 14:57:32 +0200
Subject: [PATCH 1835/1835] Add Hifiberry DAC+DSP soundcard driver (#3224)

Adds the driver for the Hifiberry DAC+DSP. It supports capture and
playback depending on the DSP firmware.

Signed-off-by: Joerg Schambacher <joerg@i2audio.com>
---
 arch/arm/boot/dts/overlays/Makefile           |  1 +
 arch/arm/boot/dts/overlays/README             |  6 ++
 .../overlays/hifiberry-dacplusdsp-overlay.dts | 34 +++++++
 arch/arm/configs/bcm2709_defconfig            |  1 +
 arch/arm/configs/bcm2711_defconfig            |  1 +
 arch/arm/configs/bcmrpi_defconfig             |  1 +
 sound/soc/bcm/Kconfig                         |  7 ++
 sound/soc/bcm/Makefile                        |  2 +
 sound/soc/bcm/hifiberry_dacplusdsp.c          | 90 +++++++++++++++++++
 sound/soc/bcm/rpi-simple-soundcard.c          | 19 ++++
 10 files changed, 162 insertions(+)
 create mode 100644 arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
 create mode 100644 sound/soc/bcm/hifiberry_dacplusdsp.c

diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
index 87082d64302da..6b4af500f51c4 100644
--- a/arch/arm/boot/dts/overlays/Makefile
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -54,6 +54,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
 	hifiberry-dacplus.dtbo \
 	hifiberry-dacplusadc.dtbo \
 	hifiberry-dacplusadcpro.dtbo \
+	hifiberry-dacplusdsp.dtbo \
 	hifiberry-digi.dtbo \
 	hifiberry-digi-pro.dtbo \
 	hy28a.dtbo \
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
index 915461238b025..7b134fb1b6077 100644
--- a/arch/arm/boot/dts/overlays/README
+++ b/arch/arm/boot/dts/overlays/README
@@ -904,6 +904,12 @@ Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
                                 master for bit clock and frame clock.
 
 
+Name:   hifiberry-dacplusdsp
+Info:   Configures the HifiBerry DAC+DSP audio card
+Load:   dtoverlay=hifiberry-dacplusdsp
+Params: <None>
+
+
 Name:   hifiberry-digi
 Info:   Configures the HifiBerry Digi and Digi+ audio card
 Load:   dtoverlay=hifiberry-digi
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
new file mode 100644
index 0000000000000..63432e8b983fe
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplusdsp-overlay.dts
@@ -0,0 +1,34 @@
+// Definitions for hifiberry DAC+DSP soundcard overlay
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			dacplusdsp-codec {
+				#sound-dai-cells = <0>;
+				compatible = "hifiberry,dacplusdsp";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberrydacplusdsp,hifiberrydacplusdsp-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
index 5dc2e1451d7ec..0b7032bee488d 100644
--- a/arch/arm/configs/bcm2709_defconfig
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -970,6 +970,7 @@ CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
diff --git a/arch/arm/configs/bcm2711_defconfig b/arch/arm/configs/bcm2711_defconfig
index 29e56df2c1763..bdaa6561b70a0 100644
--- a/arch/arm/configs/bcm2711_defconfig
+++ b/arch/arm/configs/bcm2711_defconfig
@@ -981,6 +981,7 @@ CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
index 5ef5b73028aa7..5fc283c0561fe 100644
--- a/arch/arm/configs/bcmrpi_defconfig
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -962,6 +962,7 @@ CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
 CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
 CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index a40042489b6cd..51cef18441f96 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -56,6 +56,13 @@ config SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO
         help
          Say Y or M if you want to add support for HifiBerry DAC+ADC PRO.
 
+config SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP
+        tristate "Support for HifiBerry DAC+DSP"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_RPI_SIMPLE_SOUNDCARD
+        help
+         Say Y or M if you want to add support for HifiBerry DSP-DAC.
+
 config SND_BCM2708_SOC_HIFIBERRY_DIGI
         tristate "Support for HifiBerry Digi"
         depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index 78a96fa577d72..ba80a12ca25a9 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -15,6 +15,7 @@ snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
 snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
 snd-soc-hifiberry-dacplusadc-objs := hifiberry_dacplusadc.o
 snd-soc-hifiberry-dacplusadcpro-objs := hifiberry_dacplusadcpro.o
+snd-soc-hifiberry-dacplusdsp-objs := hifiberry_dacplusdsp.o
 snd-soc-justboom-dac-objs := justboom-dac.o
 snd-soc-rpi-cirrus-objs := rpi-cirrus.o
 snd-soc-rpi-proto-objs := rpi-proto.o
@@ -40,6 +41,7 @@ obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoiceha
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADC) += snd-soc-hifiberry-dacplusadc.o
 obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSADCPRO) += snd-soc-hifiberry-dacplusadcpro.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUSDSP) += snd-soc-hifiberry-dacplusdsp.o
 obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
 obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
diff --git a/sound/soc/bcm/hifiberry_dacplusdsp.c b/sound/soc/bcm/hifiberry_dacplusdsp.c
new file mode 100644
index 0000000000000..cda7ee5190930
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_dacplusdsp.c
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * ASoC Driver for HiFiBerry DAC + DSP
+ *
+ * Author:	Joerg Schambacher <joscha@schambacher.com>
+ *		Copyright 2018
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <sound/soc.h>
+
+static struct snd_soc_component_driver dacplusdsp_component_driver;
+
+static struct snd_soc_dai_driver dacplusdsp_dai = {
+	.name = "dacplusdsp-hifi",
+	.capture = {
+		.stream_name = "DAC+DSP Capture",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_CONTINUOUS,
+		.formats = SNDRV_PCM_FMTBIT_S16_LE |
+			   SNDRV_PCM_FMTBIT_S24_LE |
+			   SNDRV_PCM_FMTBIT_S32_LE,
+	},
+	.playback = {
+		.stream_name = "DACP+DSP Playback",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_CONTINUOUS,
+		.formats = SNDRV_PCM_FMTBIT_S16_LE |
+			   SNDRV_PCM_FMTBIT_S24_LE |
+			   SNDRV_PCM_FMTBIT_S32_LE,
+	},
+	.symmetric_rates = 1};
+
+#ifdef CONFIG_OF
+static const struct of_device_id dacplusdsp_ids[] = {
+	{
+		.compatible = "hifiberry,dacplusdsp",
+	},
+	{} };
+MODULE_DEVICE_TABLE(of, dacplusdsp_ids);
+#endif
+
+static int dacplusdsp_platform_probe(struct platform_device *pdev)
+{
+	int ret;
+
+	ret = snd_soc_register_component(&pdev->dev,
+			&dacplusdsp_component_driver, &dacplusdsp_dai, 1);
+	if (ret) {
+		pr_alert("snd_soc_register_component failed\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static int dacplusdsp_platform_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_component(&pdev->dev);
+	return 0;
+}
+
+static struct platform_driver dacplusdsp_driver = {
+	.driver = {
+		.name = "hifiberry-dacplusdsp-codec",
+		.of_match_table = of_match_ptr(dacplusdsp_ids),
+		},
+		.probe = dacplusdsp_platform_probe,
+		.remove = dacplusdsp_platform_remove,
+};
+
+module_platform_driver(dacplusdsp_driver);
+
+MODULE_AUTHOR("Joerg Schambacher <joerg@i2audio.com>");
+MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+DSP");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/rpi-simple-soundcard.c b/sound/soc/bcm/rpi-simple-soundcard.c
index 7fa92e29502aa..4748c9ee21c61 100644
--- a/sound/soc/bcm/rpi-simple-soundcard.c
+++ b/sound/soc/bcm/rpi-simple-soundcard.c
@@ -136,6 +136,23 @@ static struct snd_rpi_simple_drvdata drvdata_googlevoicehat = {
 	.dai       = snd_googlevoicehat_soundcard_dai,
 };
 
+static struct snd_soc_dai_link snd_hifiberrydacplusdsp_soundcard_dai[] = {
+{
+	.name           = "Hifiberry DAC+DSP SoundCard",
+	.stream_name    = "Hifiberry DAC+DSP SoundCard HiFi",
+	.codec_dai_name = "dacplusdsp-hifi",
+	.codec_name     = "dacplusdsp-codec",
+	.dai_fmt        =  SND_SOC_DAIFMT_I2S |
+			   SND_SOC_DAIFMT_NB_NF |
+			   SND_SOC_DAIFMT_CBS_CFS,
+},
+};
+
+static struct snd_rpi_simple_drvdata drvdata_hifiberrydacplusdsp = {
+	.card_name = "snd_rpi_hifiberrydacplusdsp_soundcard",
+	.dai       = snd_hifiberrydacplusdsp_soundcard_dai,
+};
+
 static struct snd_soc_dai_link snd_hifiberry_amp_dai[] = {
 	{
 		.name           = "HifiBerry AMP",
@@ -193,6 +210,8 @@ static const struct of_device_id snd_rpi_simple_of_match[] = {
 		.data = (void *) &drvdata_adau1977 },
 	{ .compatible = "googlevoicehat,googlevoicehat-soundcard",
 		.data = (void *) &drvdata_googlevoicehat },
+	{ .compatible = "hifiberrydacplusdsp,hifiberrydacplusdsp-soundcard",
+		.data = (void *) &drvdata_hifiberrydacplusdsp },
 	{ .compatible = "hifiberry,hifiberry-amp",
 		.data = (void *) &drvdata_hifiberry_amp },
 	{ .compatible = "hifiberry,hifiberry-dac",
-- 
GitLab